From nobody Mon Aug 1 02:41:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93C2B12D0BE for ; Mon, 1 Aug 2016 02:41:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ToPZi4XbDf-d for ; Mon, 1 Aug 2016 02:41:20 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1135B12B063 for ; Mon, 1 Aug 2016 02:41:19 -0700 (PDT) X-AuditID: c1b4fb3a-0618b980000009bd-a7-579f193ddc21 Received: from ESESSHC004.ericsson.se (Unknown_Domain [153.88.183.30]) by (Symantec Mail Security) with SMTP id 2B.CA.02493.D391F975; Mon, 1 Aug 2016 11:41:17 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.142]) by ESESSHC004.ericsson.se ([153.88.183.30]) with mapi id 14.03.0301.000; Mon, 1 Aug 2016 11:40:59 +0200 From: Christer Holmberg To: Richard Shockey , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa8IhcNFBWCX0CjWpL6ATcrHqAvhU6AgAAES4CAAAVOAIAAOSgAgAAMsQCAACJJAIAA4os4///4oACAAIdwgIABfXdE///slQCAADZcAIAA5aTu Date: Mon, 1 Aug 2016 09:40:59 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B47709A51@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B477074D5@ESESSMB209.ericsson.se>, In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B47709A51ESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrLLMWRmVeSWpSXmKPExsUyM2K7nK6t5Pxwgz29EhYzfhhYLF+7jcmB yWPJkp9MHhM/nmEOYIrisklJzcksSy3St0vgyrj+u5Wp4O5ZxoqOeV3sDYzn1zF2MXJySAiY SLy5NYW5i5GLQ0hgPaPEwkvr2UASQgKLGSV+L6zpYuTgYBOwkOj+pw0SFhHwlNj34jkziC0s YCWxd9UxNpASEQFrifszJUHGiAg0MUoc7LrNClLDIqAi8e/xArB6XgFfiUuvHzFC7JrAKvH9 0wSwIzgF7CR6HrWCNTAKiEl8P7WGCcRmFhCXaPqykhXiUAGJJXvOM0PYohIvH/9jhajJl/h2 5hvUAkGJkzOfsExgFJqFpH0WkrJZSMog4gYSX97fhrK1JZYtfM0MYetLdL8/zYQsvoCRfRWj aHFqcXFuupGRXmpRZnJxcX6eXl5qySZGYKQc3PLbagfjweeOhxgFOBiVeHgTWOaFC7EmlhVX 5h5ilOBgVhLhfSQ6P1yINyWxsiq1KD++qDQntfgQozQHi5I4r/9LxXAhgfTEktTs1NSC1CKY LBMHp1QD4+zNObF5rodnpFepMy7Nm7GgfPWh0BLW5uvdn8uYn96r7Hd/OVer8+rpa5FW5wq3 9lryvWu7tOUKR/heDbMJLMVf7IJ3Rklu9y6Xn71JKSRsz/p3bt21k9v+spiZGHbtKA2Ysr4q Yadz4ok1Ksx8P28xVpznsbktkb4vdvGc57M3i+007lCbp8RSnJFoqMVcVJwIAAbvYvmQAgAA Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Aug 2016 09:41:24 -0000 --_000_7594FB04B1934943A5C02806D1A2204B47709A51ESESSMB209erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi, As Richard said, there is still work to do related to how things look in th= e wire, especially since we are not going to include the encoded JWT object= string in one piece. But, again, I think that is more an 4474bis issue. I do not, however, think that other "bodies" shall have to clarify the enco= ding on the wire - that needs to be clear in the core spec (other bodies mi= ght profile exactly what information is used to calculate the signature etc= ). Regards, Christer Sent from my Windows Phone ________________________________ From: Richard Shockey Sent: =FD01/=FD08/=FD2016 01:04 To: stir@ietf.org Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 Yep=85 +1 Dave whats the problem here? What do you want? We choose JWT for a perfectly rational and technically elegant reasons. We= do know what data we want assert and sign. On one point we totally agree. I have been less than satisified on how this= actually looks on the wire. Examples. Jon has acknoledged this in his pres= entation in Berlin. Fine picture from my presentation to the Genband conference BTW. Where do the claims go in the INVITE. I=92m prepared to accept less than p= erfect since I know there are other bodies ready to provide guidence in ord= er to accelerate adoption among the vendor community. We think it will work and we have virturilly the entire US voice communicai= tons industry using E164 addressing, as well at the NRA in the US and else= where lined up ready to GO. I support the last call I have trust the authors can provide revisions that= can address some of the issues raised. Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 From: stir on behalf of Victor Pascual Date: Sunday, July 31, 2016 at 2:44 PM To: Christer Holmberg Cc: Chris Wendt , "dcrocker@bbiw.net" , "Peterson, Jon" , IETF STIR Mail List = Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 Fully agree On 31 Jul 2016, at 19:54, Christer Holmberg > wrote: Hi, I agree with Chris. JWT is NOT a mechanism to sign any arbitrary JSON struc= ture. JWT is a mechanism to sign data, and it uses a specific JSON structur= e (header, claims etc) for doing so. In addition, it provides a mechanism t= o signal what data/algorithm is used to calculate the signature. Regards, Christer Sent from my Windows Phone ________________________________ From: Chris Wendt Sent: =FD31/=FD07/=FD2016 00:08 To: dcrocker@bbiw.net Cc: Christer Holmberg; Peterson, Jon= ; IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 Hi Dave, I=92m not following your argument that because there isn=92t a JSON object = to sign, we can=92t use JWT? In general, most/all uses of JWT don=92t sign an existing object, a set of = claims are constructed into a JSON payload that is signed. There are JWT defined claims precisely defined to create a secure token int= entionally meant to be only signed in a JWT. So to me, we are more than appropriately using JSON and JWT. It is in 4474bis, we define the exact information to construct the JSON pay= load object to be signed, so please refer to that. There are many advantages to using the JWT construct both for STIR charter = specifically and elsewhere. Is that a bad thing? -Chris > On Jul 30, 2016, at 9:03 AM, Dave Crocker > wrote: > > Christer, > > Thanks for the background... > > On 7/30/2016 4:30 AM, Christer Holmberg wrote: >> I am the one who originally suggested the usage of JWT. I don't >> understand the claim that JWT is "outside the context of SIP". JWT is a >> generic/standardized mechanism how to calculate and encode a signature, > > Actually, it isn't. > > It's own opening text [RFC 7519] says it is "a compact, URL-safe means of= representing claims to be transferred between two parties" but more import= antly for this issue, it goes on to say: > > "encoded as a JSON object that is used as the payload of a JSON > Web Signature (JWS) structure or as the plaintext of a JSON Web > Encryption (JWE) structure" > > That is, it provides value-added functions... to a JSON object (structure= ). However SIP doesn't have a JSON object to sign. So the working group h= as had to invent a JSON-based abstraction of SIP header information and the= n sign it. > > Now it has to invent an encoding for the resulting signature. It would h= ave to do that for a SIP call, no matter the signature's computational abst= raction, but because that abstraction is actually an independent format, it= wound up distracting the wg from doing a complete job -- so far, after 3 y= ears -- of defining all the details for a complete authentication mechanism= . > > From what I can tell of the email record for the wg, the unfortunate part= of the discussion about choices here was to count JSON/JWT as something ot= her than an abstraction. > > Signing an object requires defining the data over which the signature wil= l be made, and how that data will be fed into the signing algorithm. Necess= arily, that defines an abstraction of the data. (Canonicalization seems to= be a common component of that abstraction, for example.) > > There might be nothing different or better (or, probably, worse) about JW= T in those terms; I haven't tried to evaluate it in those terms. The probl= em is that its existence as a distinct format has caused the working group = to worry about that new and independent object as distinct from the SIP dat= a being signed, rather than as a computational result that then needs to be= stored into the SIP header. So all of the discussion about what to do wit= h the JWT object is additional wg overhead and, IMO, a complete distraction= for the primary task of the working group. (My guess is that there is als= o added overall system complexity, but I won't press that concern, at this = point.) > > Arguments that it's a general mechanism for use in other aspects of this = space are always appealing. However they are, so far, without merit in the = working group context: There are no specifications for any of those other u= ses. > > And the wg still hasn't resolved the very basic and very essential step o= f putting the signature into the SIP header. > > > >> If we would NOT use JWT we would >> probably have to define more STIR-specific procedures regarding the >> calculating/encoding of the signature ourselves. It's better to use a >> standardized mechanism in my opinion. > > Well, yeah, I thought/think that too, which was why I originally suggeste= d adapting DKIM. (DANE might be another relevant choice.) DKIM offers an e= xtremely high point of departure for SIP header signing. The continued lac= k of complete specification details about use with SIP demonstrates that JW= T doesn't. > > >> I am also the one who raised the encoding issue in Berlin. But that was >> not related to the usage of JWT as such, but to the fact that we don't >> carry the encoded JWT object in one piece in the SIP message. We "split" >> the object into two pieces, and carry one piece as the Identity header >> field value, and the other piece as the canon header field parameter >> value. > > Right. And the point I'm raising is not about the details of that choice= but the fact that it still hasn't been made at this very late stage. > > Besides merely being a missing, essential bit of system specification, it= suggests that the wg is still not completely clear about the concrete use = of this capability. > > > d/ > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir --_000_7594FB04B1934943A5C02806D1A2204B47709A51ESESSMB209erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi,

As Richard said, there is still work to do related to how things look in th= e wire, especially since we are not going to include the encoded JWT object= string in one piece. But, again, I think that is more an 4474bis issue.
I do not, however, think that other "bodies" shall have to clarif= y the encoding on the wire - that needs to be clear in the core spec (other= bodies might profile exactly what information is used to calculate the sig= nature etc).

Regards,

Christer

Sent from my Windows Phone
From: Richard Shockey
Sent: =FD01= /=FD08/=FD2016 01:04
To: stir@ietf.org
Subject: Re: [= stir] Review of: draft-ietf-stir-passport-05

Yep=85 +1

 

Dave whats the problem here? What do you want? 

 

We choose JWT for a perfectly rational and technically elega= nt reasons.  We do know what data we want assert and sign.

 

On one point we totally agree. I have been less than satisif= ied on how this actually looks on the wire. Examples. Jon has acknoledged t= his in his presentation in Berlin.  

 

Fine picture from my presentation to the Genband conference = BTW.

 

Where do the claims go in the INVITE.  I=92m prepared t= o accept less than perfect since I know there are other bodies ready to pro= vide guidence in order to accelerate adoption among the vendor community.

 

We think it will work and we have virturilly the entire US v= oice communicaitons industry using E164 addressing,  as well at the NR= A in the US and elsewhere lined up ready to GO.

 

I support the last call I have trust the authors can provide= revisions that can address some of the issues raised.

 

 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

richard<at>shockey.us

Skype-Linkedin-Facebook rshockey101

PSTN +1 703-593-2683

= From: stir <stir-bounces@= ietf.org> on behalf of Victor Pascual <victor.pascual.avila@oracle.co= m>
Date: Sunday, July 31, 2016 at 2:44 PM
To: Christer Holmberg <christer.holmberg@ericsson.com>
Cc: Chris Wendt <chris-ietf@chriswendt.net>, "dcrocker@bb= iw.net" <dcrocker@bbiw.net>, "Peterson, Jon" <jon.p= eterson@neustar.biz>, IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] Review of: draft-ietf-stir-passport-05

 

Fully agree


On 31 Jul 2016, at 19:54, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

From: Chris Wendt
Sent: <= span style=3D"font-size:11.0pt; font-family:Calibri">=FD31/=FD07/=FD2016 00= :08
To: dcrocker@bbiw.net
Cc: Christer Holmberg; Peterson, Jon; IETF STIR Mail List
Subject: Re: [stir] Review o= f: draft-ietf-stir-passport-05

Hi Dave,

I=92m not following your argument that because there isn=92t a JSON object = to sign, we can=92t use JWT?
In general, most/all uses of JWT do= n=92t sign an existing object, a set of claims are constructed into a JSON = payload that is signed.
There are JWT defined claims precis= ely defined to create a secure token intentionally meant to be only signed = in a JWT.

So to me, we are more than appropriately using JSON and JWT.

It is in 4474bis, we define the exact information to construct the JSON pay= load object to be signed, so please refer to that.

There are many advantages to using the JWT construct both for STIR charter = specifically and elsewhere.

Is that a bad thing?

-Chris

> On Jul 30, 2016, at 9:03 AM, Dave Crocker <dhc@dcrocker.net> wrote:
>
> Christer,
>
> Thanks for the background...
>
> On 7/30/2016 4:30 AM, Christer Holmberg wrote:
>> I am the one who originally suggested the usage of JWT. I don't >> understand the claim that JWT is "outside the context of SIP&= quot;. JWT is a
>> generic/standardized mechanism how to calculate and encode a signa= ture,
>
> Actually, it isn't.
>
> It's own opening text [RFC 7519] says it is "a compact, URL-safe = means of representing claims to be transferred between two parties" bu= t more importantly for this issue, it goes on to say:
>
>   "encoded as a JSON object that is used as the payload= of a JSON
>   Web Signature (JWS) structure or as the plaintext of a JSO= N Web
>   Encryption (JWE) structure"
>
> That is, it provides value-added functions... to a JSON object (struct= ure).  However SIP doesn't have a JSON object to sign.  So the wo= rking group has had to invent a JSON-based abstraction of SIP header inform= ation and then sign it.
>
> Now it has to invent an encoding for the resulting signature.  It= would have to do that for a SIP call, no matter the signature's computatio= nal abstraction, but because that abstraction is actually an independent fo= rmat, it wound up distracting the wg from doing a complete job -- so far, after 3 years -- of defining all the detai= ls for a complete authentication mechanism.
>
> From what I can tell of the email record for the wg, the unfortunate p= art of the discussion about choices here was to count JSON/JWT as something= other than an abstraction.
>
> Signing an object requires defining the data over which the signature = will be made, and how that data will be fed into the signing algorithm. Nec= essarily, that defines an abstraction of the data.  (Canonicalization = seems to be a common component of that abstraction, for example.)
>
> There might be nothing different or better (or, probably, worse) about= JWT in those terms; I haven't tried to evaluate it in those terms.  T= he problem is that its existence as a distinct format has caused the workin= g group to worry about that new and independent object as distinct from the SIP data being signed, rather than as a comput= ational result that then needs to be stored into the SIP header.  So a= ll of the discussion about what to do with the JWT object is additional wg = overhead and, IMO, a complete distraction for the primary task of the working group.  (My guess is that there i= s also added overall system complexity, but I won't press that concern, at = this point.)
>
> Arguments that it's a general mechanism for use in other aspects of th= is space are always appealing. However they are, so far, without merit in t= he working group context: There are no specifications for any of those othe= r uses.
>
> And the wg still hasn't resolved the very basic and very essential ste= p of putting the signature into the SIP header.
>
>
>
>>     If we would NOT use JWT we would
>> probably have to define more STIR-specific procedures regarding th= e
>> calculating/encoding of the signature ourselves. It's better to us= e a
>> standardized mechanism in my opinion.
>
> Well, yeah, I thought/think that too, which was why I originally sugge= sted adapting DKIM. (DANE might be another relevant choice.)  DKIM off= ers an extremely high point of departure for SIP header signing.  The = continued lack of complete specification details about use with SIP demonstrates that JWT doesn't.
>
>
>> I am also the one who raised the encoding issue in Berlin. But tha= t was
>> not related to the usage of JWT as such, but to the fact that we d= on't
>> carry the encoded JWT object in one piece in the SIP message. We &= quot;split"
>> the object into two pieces, and carry one piece as the Identity he= ader
>> field value, and the other piece as the canon header field paramet= er
>> value.
>
> Right.  And the point I'm raising is not about the details of tha= t choice but the fact that it still hasn't been made at this very late stag= e.
>
> Besides merely being a missing, essential bit of system specification,= it suggests that the wg is still not completely clear about the concrete u= se of this capability.
>
>
> d/
> --
>
>  Dave Crocker
>  Brandenburg InternetWorking
>  bbiw.net
>
> _______________________________________________
> stir mailing list
> stir@ietf.org
> https://www.iet= f.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org= /mailman/listinfo/stir

_______________________________________________ stir= mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--_000_7594FB04B1934943A5C02806D1A2204B47709A51ESESSMB209erics_-- From nobody Wed Aug 3 08:50:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1019712DC9C for ; Wed, 3 Aug 2016 08:50:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cJGzxRpRZuoD for ; Wed, 3 Aug 2016 08:50:12 -0700 (PDT) Received: from resqmta-po-02v.sys.comcast.net (resqmta-po-02v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12A9012DB94 for ; Wed, 3 Aug 2016 08:49:31 -0700 (PDT) Received: from resomta-po-10v.sys.comcast.net ([96.114.154.234]) by resqmta-po-02v.sys.comcast.net with SMTP id UyOybkaLw1zBdUyQEbcGRP; Wed, 03 Aug 2016 15:49:30 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by comcast with SMTP id UyQ8bJx7skumdUyQ9bOK8W; Wed, 03 Aug 2016 15:49:30 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Wed, 3 Aug 2016 08:35:37 -0700 From: Alex Bobotek To: "stir@ietf.org" Date: Wed, 3 Aug 2016 08:35:36 -0700 Thread-Topic: STIR 4474bis-10 comments Thread-Index: AdHtnZL44XSdzpn5S4ezxStpcxWG/g== Message-ID: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_4B1956260CD29F4A9622F00322FE053101285D016E24BOBO1Abobot_" MIME-Version: 1.0 X-CMAE-Envelope: MS4wfDhNYBEyUJkrGBamW/LaHhGGGKvz+B3hLzFe5JGZdLFsShMmWtysEZm1EdGSbKVR/PPzI/TP2oI/5aM1TE0mIGSEhxbFtkrdXI+OnMrn25wqoI3tt3Hv /EaCUXayoHsl1C5JoOmUN9xktfoyBEDx5CqBAh1aZ4fUNwT5Z5pjVW+k Archived-At: Subject: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Aug 2016 15:50:17 -0000 --_000_4B1956260CD29F4A9622F00322FE053101285D016E24BOBO1Abobot_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable 1. Permit authorization without authentication In the current telephony network practice, some service provider implementa= tions choose not to authenticate identity, but simply facilitate the use of= an arbitrary or selected user-provided identity. Are there legitimate use= cases for this? Has anyone established that there are not? How can the i= ndustry reasonably expect to end this (often bad) practice? If it can't be= ended, there's value in at least identifying the originating service provi= der (i.e., the signer/authorizer). Given the prevalence of abuse using tel= ephone numbers assigned to a sometimes-anonymous abuser, it becomes critica= lly important to identify the service provider(s) closest to the abuser. B= ased on the assumption that it's better to ID service providers than unreas= onably expect a ban of the use of unauthenticated (and therefore unsigned) = SIP requests, STIR signing should support authorization without authenticat= ion. The practice of authorizing unauthenticated use exists, and there is = benefit to signing in these cases (service provider identification). The l= anguage of the ID should permit this use. 4474bis-10 should NOT require or= assume that that authentication will precede authorization. Of course the= re may be other use cases where signing includes authentication and may not= include a specific service provider's authorization. 2. Improve replay prevention Proximate replay is possible while complying with this spec. First, one or= more proximate (e.g., within 60 seconds) SIP requests using the same token= are legal and subject to replay in many cases. An SDP body's mky may not = be present and if present its use is optional. Some sort of mandatory new = or existing signed sequence, random # or request ID (e.g., Call-ID or CSeq)= and a 1-time use policy on the receiving end of the request (e.g., tokens = only good for 1 use) could prevent replay. Different methods (e.g., INVITE= vs MESSAGE) might be handled by different receiving infrastructure, and th= erefore difficulties with 'it's been used already' coordination allow a fak= ed MESSAGE based on a captured request. This might include an mkey from a c= aptured INVITE. So it may be possible to DOS, spam or text-bomb a recipie= nt using a captured identity. While large-scale or distributed implementat= ions may make the enforcement difficult, there is little cost to signing an= d decoding a method and possibly a numeric ID. Some sort of '1-use' pract= ice should at least be discussed while perhaps not required. Specific markup suggestions: NITS The verifier MUST inspect any optional "ppt" parameter appearing in the Identity request. If no "ppt" parameter is present, then the verifier proceeds normally below. If a "ppt" parameter value is present, and the verifier does not support it, it MUST ignore the Identity header. If a supported "ppt" parameter value is present, the verifier follows the procedures below, including the variations described in Step 5. 3. Background [...] Per [RFC7340], problems such as rob= ocalling, voicemail hacking, and swatting are enabled by an attacker's ability to impersonate someone else. The secure operation of most SIP applications and services depends on authenticating and/or authorizing the source of communication= s as it is represented in a SIP request. This identity architecture for SIP depends on includes provisions for a = logical "authentication service" which validates caller identity at or near orig= ination. outgoing requests. An authentication service may be implemented either as part of a user agent or as a proxy server; typically, it is a component of a network intermediary like a proxy to which originating user agents send unsigned requests. Once the sender of the message has been This document specifies a means of sharing a cryptographic assurance of authenticity of and/or authorization to use end-user SIP identity in = an interdomain or intradomain context. It relies on the authentication service constructing tokens based on [..= .] To maximize end-to-end security, it is typically obviously preferable for end-users to acquire their own credentials; if they do, their user agents can act as authentication services. However, for some deployments, [...] Regards, Alex Alex Bobotek --_000_4B1956260CD29F4A9622F00322FE053101285D016E24BOBO1Abobot_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

1.often bad) practice?  If it can’t be ended, there= ’s value in at least identifying the originating service provider (i.e., the signer/authorizer).  Give= n the prevalence of abuse using telephone numbers assigned to a sometimes-a= nonymous abuser, it becomes critically important to identify the service pr= ovider(s) closest to the abuser.  Based on the assumption that it̵= 7;s better to ID service providers than unreasonably expect a ban of the us= e of unauthenticated (and therefore unsigned) SIP requests, STIR signing sh= ould support authorization without authentication.  The practice of au= thorizing unauthenticated use exists, and there is benefit to signing in th= ese cases (service provider identification).  The language of the ID s= hould permit this use.  4474bis-10 should NOT require or assume that&n= bsp; that authentication will precede authorization. Of course there may be= other use cases where signing includes authentication and may not include = a specific service provider’s authorization.

 

 

2.   =     Improve replay prevention

Proximate replay is possible while complying with this spec.  First, one= or more proximate (e.g., within 60 seconds) SIP requests using the same to= ken are legal and subject to replay in many cases.  An SDP body’= s mky may not be present and if present its use is optional.  Some sor= t of mandatory new or existing signed sequence, random # or request ID (e.g= ., Call-ID or CSeq) and a 1-time use policy on the receiving end of the req= uest (e.g., tokens only good for 1 use) could prevent replay.  Different methods (e.g., INVITE vs MESSAGE) m= ight be handled by different receiving infrastructure, and therefore diffic= ulties with ‘it’s been used already’ coordination allow a= faked MESSAGE based on a captured request. This might include an mkey from a captured INVITE.   S= o it may be possible to DOS, spam or text-bomb a recipient using a captured= identity.  While large-scale or distributed implementations may make = the enforcement difficult, there is little cost to signing and decoding a m= ethod and possibly a numeric ID.   = Some sort of ‘1-use’ practice should at least be discussed whil= e perhaps not required.  

 

 

Specific markup suggestions: 

 

 = ;

NITS

 

   The verifier MUST inspect=
 any optional "ppt" parameter appearing in the
   Identity request.  If no "ppt"=
; parameter is present, then the
   verifier=
 proceeds normally below.  If a "ppt" parameter value is
   present, and the verifier does not support i=
t, it MUST ignore the
   Identity header.&nb=
sp; If a supported "ppt" parameter value is present,
   the verifier follows the procedures below, including =
the variations
   described in Step 5.<=
/o:p>
 
3.  Background
[…]
 
   Per [RFC7340], problems such as robocallin=
g, voicemail hacking, and
   swatting are en=
abled by an attacker's ability to impersonate someone
=
   else.  The secure operation of most SIP applications and =
services
   depends on authenticating and/or authorizing the source of communications =
as it is
   represented in a SIP request. 
 
   =
This identity architecture for SIP depends on includes provisions for a logical
 &nb=
sp; "authentication service" which validates caller identity at or near origination.  outgoing requ=
ests.  An
   authentication service=
 may be implemented either as part of a user
 &nb=
sp; agent or as a proxy server; typically, it is a component of a network
   intermediary like a proxy to which origina=
ting user agents send
   unsigned requests.&=
nbsp; Once the sender of the message has been
 
 
   This document specifies a means of sharing a cryptographic as=
surance
   of auth=
enticity of and/or authorization to use end-user SIP identity in an =
interdomain or intradomain context.
   It re=
lies on the authentication service constructing tokens based on […] <=
o:p>
 
 
 
&nb=
sp;  To maximize end-to-end security, it is =
typically obviously
   prefera=
ble for end-users to acquire their own credentials; if they
   do, their user agents can act as authentication services=
.  However,
   for some deployments, [&=
#8230;]
 
 
Regards,<=
/p>
 
Alex 
 
Alex Bobotek
 
 
= --_000_4B1956260CD29F4A9622F00322FE053101285D016E24BOBO1Abobot_-- From nobody Wed Aug 3 13:26:03 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C236E12D7F0 for ; Wed, 3 Aug 2016 13:26:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.086 X-Spam-Level: X-Spam-Status: No, score=-0.086 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MISSING_HEADERS=1.021, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aWOVIDMFTcMa for ; Wed, 3 Aug 2016 13:26:00 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9812012B02A for ; Wed, 3 Aug 2016 13:26:00 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u73KQl3l024930 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Wed, 3 Aug 2016 13:26:47 -0700 References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> Cc: IETF STIR Mail List From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Wed, 3 Aug 2016 13:25:46 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Aug 2016 20:26:02 -0000 On 7/29/2016 2:11 PM, Dave Crocker wrote: > On 7/29/2016 10:46 AM, Peterson, Jon wrote: >> I wouldn't say it's a correction to the STIR charter - the charter was >> always clear that it was not limited to SIP (see the bits about "one or >> more non-SIP hops" and "out-of-band mechanism" in the charter). But given >> that our original signing mechanism was, as I said, a concatenation of >> SIP >> header field values, the intervention was that other protocols would need >> something less bound to SIP. JWT turned out to be the solution that the >> group had consensus to adopt. > > JWT has nothing to do with SIP. So when applied to a SIP context, it's > entirely artificial. And yes, I noted the views that thought it simpler > or equivalent to the computed string, but could not see the explicit > logic that made JWT a better choice, no does it seem obvious to me. > Quite the contrary. > > Note that during the wg session in Berlin there was /still/ question > about where to put the JWT information. Folks, I'm citing the above text, for discussing the concern I rasied about JWT/JSON use in Passport, because that was the first time I criticized it, which was several rounds of postings after I sent my review. That is, it was /not/ part of my review. I made a conscious choice to leave that concern out, although I already saw it as likely problematic. On its face, yes it looks like a reasonable choice. It's pre-existing technology and it looks clean. The concerns develop in its application, not its concept. Look for JSON and JWT in SIP. You won't find it. That means that it is an added layer of specification. Or, in this case, specifications. And since JSON and JWT are their own environments, that means there is a learning curve and other baggage to carry, before it is useful to SIP and STIR. Even better is that even the STIR specification for SIP does not require using JWT or JSON. Note that ppt is optional. This adds to the view that, at best, JWT/JSON is really just an abstraction for STIR. But in fact the fact that ppt is optional really means that the SIP STIR specification has added complexity, with very unclear benefit. As for the underlying justification for the Passport model, references to broader applicability are always appealing, but lacking concrete specifications and clear, documented intentions of use -- including a clear explanation of the benefit to be gained by the abstraction -- they turn out mostly to be a distraction from the immediate concern, namely added complexity to the mainstream use. Again: JSON/JWT adds a layer (or two) of mechanism that almost certainly is not needed and almost certainly adds problematic complexity to the specification, probably to the point of impeding reader comprehension. As I've noted, the underlying task here is pretty straightforward: * Define a mechanism for finding and validating a public key. * Decide on scope and canonicalization of data to be signed. Define a signing mechanism. * Define a validation mechanism. * Decide how to deal with partial adoption * Decide how to deal with broken signatures. Maybe a little more than this, but not much. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 4 07:02:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53E7412B025 for ; Thu, 4 Aug 2016 07:01:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id plc0y7IRhPWi for ; Thu, 4 Aug 2016 07:01:56 -0700 (PDT) Received: from mail-qk0-x22b.google.com (mail-qk0-x22b.google.com [IPv6:2607:f8b0:400d:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1F8412D98B for ; Thu, 4 Aug 2016 07:01:53 -0700 (PDT) Received: by mail-qk0-x22b.google.com with SMTP id p186so105833737qkd.1 for ; Thu, 04 Aug 2016 07:01:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=3LdgQ4wrK3WPzAv4+n0/N/sY9UVlKQoI3p4OCpuPGBs=; b=FGzl339HzifTKfSXjbsAUP7vRz7EiMKpEgmdffbALVSCEbSLh9qrtGSZMosFMqkmSy ugpEHA4oS4ZqowUIw4L7zqQSX8e2aOEzoZ9stsjCyV22UmRol6IxrcMnl156wygEGMRw sr0irsyR4Uiw9E1+/yx6mF+k7X3OqGJmVmR8Nv3cYbumASbQkkr4uF/oulQN0DBgxkc0 I/Um09mqQFbiaXaoZBth2dUJdFtVlatgCTXBpRsQySutZccGbVW6UEiW9JpzRvKlFa8E 06hAENw/jG7i7TBqfuWerUKpGkyvCGzmDDspSh4W81VaRIELEnfhp0K12hhrcInxFhsb CLNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=3LdgQ4wrK3WPzAv4+n0/N/sY9UVlKQoI3p4OCpuPGBs=; b=C7jPNmc/Tyi1yD6wUQFo6Yu2Rxyx8fZFQzCTWqqlsL5LwA/ruEIJikr5g9miFeBjbq tVw9c52c93U4TAhUBPHeVmu+eqqSRISUgDT9mSQfmNFXAtSdJM7W7PiyMv2D4tSMW7E5 4S4PX2Pk6WfjONn2xLQHAOvBS9db5okUGdqpCr60hdQog8/ac7W9R9xn8bvRoAtohErE dxUr8NSz5BS4DjH+ZogVvx8R1+pbwYcuoNn7afL3zJcyDU7eoTzQLImMtzSRSY8LjA7T dJbFRYCxqx2/RT15Uvm95r4K90iXFCkH/wk0Er6CQMd9AqPX5BNhYcdtMJpBkdHOvuz/ axDg== X-Gm-Message-State: AEkoouvhS52p9Xo2T7weuY4W/9FQiQLnpdYXwx30+g8uoV0rDJZ9//lDzBF5G/B8HuFkdA== X-Received: by 10.55.141.193 with SMTP id p184mr6853538qkd.94.1470319312718; Thu, 04 Aug 2016 07:01:52 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id w185sm6997761qkd.23.2016.08.04.07.01.51 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 07:01:51 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_3AC4D77E-11C6-4AAA-9CCA-538CD3FFF9D4" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> Date: Thu, 4 Aug 2016 10:01:49 -0400 Message-Id: <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> To: Alex Bobotek X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 14:01:59 -0000 --Apple-Mail=_3AC4D77E-11C6-4AAA-9CCA-538CD3FFF9D4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 There are reasonable circumstances where a party placing a call is not = the authorized entity assigned the telephone number used in From/PAI, = and in such circumstances the service provider servicing the entity = placing the call may or may not be the same as the service provider = serving the entity that is assigned the TN. In all such cases, the = entity that is assigned the TN explicitly authorizes calls placed using = it=E2=80=99s TN. The design accommodates such use cases. It=E2=80=99s = not a blanket authorization without authentication. We=E2=80=99re not = aware of any cases where there is an actual requirement for legitimate = calling without explicit authorization from the assigned entity, = although we certainly are aware that various parts of various service = providers don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more. Brian > On Aug 3, 2016, at 8:35 AM, Alex Bobotek wrote: >=20 > 1. Permit authorization without authentication > In the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided identity. = Are there legitimate use cases for this? Has anyone established that = there are not? How can the industry reasonably expect to end this = (often bad) practice? If it can=E2=80=99t be ended, there=E2=80=99s = value in at least identifying the originating service provider (i.e., = the signer/authorizer). Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the abuser. = Based on the assumption that it=E2=80=99s better to ID service providers = than unreasonably expect a ban of the use of unauthenticated (and = therefore unsigned) SIP requests, STIR signing should support = authorization without authentication. The practice of authorizing = unauthenticated use exists, and there is benefit to signing in these = cases (service provider identification). The language of the ID should = permit this use. 4474bis-10 should NOT require or assume that that = authentication will precede authorization. Of course there may be other = use cases where signing includes authentication and may not include a = specific service provider=E2=80=99s authorization. > =20 > =20 > 2. Improve replay prevention > Proximate replay is possible while complying with this spec. First, = one or more proximate (e.g., within 60 seconds) SIP requests using the = same token are legal and subject to replay in many cases. An SDP = body=E2=80=99s mky may not be present and if present its use is = optional. Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) = could prevent replay. Different methods (e.g., INVITE vs MESSAGE) might = be handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured request. This = might include an mkey from a captured INVITE. So it may be possible to = DOS, spam or text-bomb a recipient using a captured identity. While = large-scale or distributed implementations may make the enforcement = difficult, there is little cost to signing and decoding a method and = possibly a numeric ID. Some sort of =E2=80=981-use=E2=80=99 practice = should at least be discussed while perhaps not required. =20 > =20 > =20 > Specific markup suggestions: =20 > =20 > =20 > NITS > =20 > The verifier MUST inspect any optional "ppt" parameter appearing in = the > Identity request. If no "ppt" parameter is present, then the > verifier proceeds normally below. If a "ppt" parameter value is > present, and the verifier does not support it, it MUST ignore the > Identity header. If a supported "ppt" parameter value is present, > the verifier follows the procedures below, including the variations > described in Step 5. > =20 > <>3 = . Background >=20 > [=E2=80=A6] > =20 > Per [RFC7340 ], problems such = as robocalling, voicemail hacking, and > swatting are enabled by an attacker's ability to impersonate = someone > else. The secure operation of most SIP applications and services > depends on authenticating and/or authorizing the source of = communications as it is > represented in a SIP request.=20 > =20 > This identity architecture for SIP depends on includes provisions = for a logical > "authentication service" which validates caller identity at or near = origination. outgoing requests. An > authentication service may be implemented either as part of a user > agent or as a proxy server; typically, it is a component of a = network > intermediary like a proxy to which originating user agents send > unsigned requests. Once the sender of the message has been > =20 > =20 > This document specifies a means of sharing a cryptographic = assurance > of authenticity of and/or authorization to use end-user SIP = identity in an interdomain or intradomain context. > It relies on the authentication service constructing tokens based = on [=E2=80=A6]=20 > =20 > =20 > =20 > To maximize end-to-end security, it is typically obviously > preferable for end-users to acquire their own credentials; if they > do, their user agents can act as authentication services. However, > for some deployments, [=E2=80=A6] > =20 > =20 > Regards, > =20 > Alex=20 > =20 > Alex Bobotek > =20 > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_3AC4D77E-11C6-4AAA-9CCA-538CD3FFF9D4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 There are reasonable circumstances where a party placing a = call is not the authorized entity assigned the telephone number used in = From/PAI, and in such circumstances the service provider servicing the = entity placing the call may or may not be the same as the service = provider serving the entity that is assigned the TN.  In all such = cases, the entity that is assigned the TN explicitly authorizes calls = placed using it=E2=80=99s TN.  The design accommodates such use = cases.  It=E2=80=99s not a blanket authorization without = authentication.   We=E2=80=99re not aware of any cases where there = is an actual requirement for legitimate calling without explicit = authorization from the assigned entity, although we certainly are aware = that various parts of various service providers don=E2=80=99t bother to = check. At this point, at least in some countries, there is a realization = that the laxity of allowing unchecked spoofing is not acceptable any = more.

Brian

On = Aug 3, 2016, at 8:35 AM, Alex Bobotek <alex@bobotek.net> = wrote:

1.       Permit = authorization without authentication
In the current telephony network = practice, some service provider implementations choose not to = authenticate identity, but simply facilitate the use of an arbitrary or = selected user-provided identity.  Are there legitimate use cases = for this?  Has anyone established that there are not?  How can = the industry reasonably expect to end this (often bad) practice?  If it = can=E2=80=99t be ended, there=E2=80=99s value in at least identifying = the originating service provider (i.e., the = signer/authorizer).  Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the = abuser.  Based on the assumption that it=E2=80=99s better to ID = service providers than unreasonably expect a ban of the use of = unauthenticated (and therefore unsigned) SIP requests, STIR signing = should support authorization without authentication.  The practice = of authorizing unauthenticated use exists, and there is benefit to = signing in these cases (service provider identification).  The = language of the ID should permit this use.  4474bis-10 should NOT = require or assume that  that authentication will precede = authorization. Of course there may be other use cases where signing = includes authentication and may not include a specific service = provider=E2=80=99s authorization.
 
 
2.       Improve = replay prevention
Proximate replay is possible while complying with this spec.  First, one = or more proximate (e.g., within 60 seconds) SIP requests using the same = token are legal and subject to replay in many cases.  An SDP = body=E2=80=99s mky may not be present and if present its use is = optional.  Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) could prevent = replay.  Different methods (e.g., INVITE vs MESSAGE) might be = handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured = request. This might include an mkey from a captured = INVITE.   So it may be possible to DOS, spam or text-bomb a = recipient using a captured identity.  While large-scale or = distributed implementations may make the enforcement difficult, there is = little cost to signing and decoding a method and possibly a numeric = ID.   Some = sort of =E2=80=981-use=E2=80=99 practice should at least be discussed = while perhaps not required.  
 
 
Specific markup suggestions:  
 
 
NITS
 
   The verifier MUST inspect any optional "ppt" =
parameter appearing in =
the
   Identity request.  If no "ppt" parameter is =
present, then the
   verifier proceeds normally below.  If a =
"ppt" parameter value is
   present, and the verifier does not support it, =
it MUST ignore the
   Identity header.  If a supported "ppt" =
parameter value is present,
   the verifier follows the =
procedures below, including the variations
   described in Step 5.
 

3.  Background

[=E2=80=A6]
 
   =
Per [RFC7340], problems such as robocalling, voicemail =
hacking, and
   swatting are enabled by an attacker's ability to =
impersonate someone
   else.  The secure operation of most SIP =
applications and services
   depends on authenticating and/or authorizing the source of =
communications as it is
   represented in a SIP request.
 
   =
This identity architecture for SIP depends on includes provisions for a =
logical
   "authentication service" which validates caller identity at or near =
origination.  outgoing requests.  =
An
   =
authentication service may be implemented either as part of a user
   =
agent or as a proxy server; typically, it is a component of a =
network
   intermediary like a proxy to which originating =
user agents send
   unsigned requests.  Once the sender of the =
message has been
 
 
   This document specifies a means of sharing a =
cryptographic assurance
   of authenticity of and/or authorization to use end-user =
SIP identity in an interdomain or intradomain context.
   It =
relies on the authentication service constructing tokens based on [=E2=80=A6=
]
 
 
 
   To =
maximize end-to-end security, it is typically obviously
   =
preferable for end-users to acquire their own credentials; if they
   =
do, their user agents can act as authentication services.  =
However,
   for some deployments, [=E2=80=A6]
 
 
Regards,
 
Alex 
 
Alex = Bobotek
 
 
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_3AC4D77E-11C6-4AAA-9CCA-538CD3FFF9D4-- From nobody Thu Aug 4 09:41:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F10B12DA8C for ; Thu, 4 Aug 2016 09:41:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.911 X-Spam-Level: X-Spam-Status: No, score=-2.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qEa8i3vVwJVO for ; Thu, 4 Aug 2016 09:41:20 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0122.outbound.protection.outlook.com [104.47.41.122]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E173F12D768 for ; Thu, 4 Aug 2016 09:41:17 -0700 (PDT) Received: from BN1AFFO11FD010.protection.gbl (10.58.52.31) by BN1AFFO11HUB006.protection.gbl (10.58.52.116) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Thu, 4 Aug 2016 16:41:15 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BN1AFFO11FD010.mail.protection.outlook.com (10.58.52.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Thu, 4 Aug 2016 16:41:15 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u74GdStH034912; Thu, 4 Aug 2016 12:41:15 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24gns3pstq-2 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 04 Aug 2016 12:41:15 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 4 Aug 2016 11:41:13 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Thu, 4 Aug 2016 11:41:13 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen , Alex Bobotek Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA490iQ Date: Thu, 4 Aug 2016 16:41:13 +0000 Message-ID: <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> In-Reply-To: <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: multipart/alternative; boundary="_000_61386a070cd14ccba7099f3951e81c9fPLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(24454002)(199003)(189002)(377454003)(102836003)(790700001)(6116002)(106466001)(92566002)(4546004)(30436002)(586003)(8936002)(7846002)(84326002)(19300405004)(15975445007)(2900100001)(11100500001)(2950100001)(33646002)(5250100002)(106116001)(3846002)(4326007)(5001770100001)(97736004)(19617315012)(108616004)(16236675004)(24736003)(86362001)(68736007)(7906003)(356003)(512874002)(19580395003)(7696003)(2906002)(19580405001)(7736002)(19625215002)(87936001)(81166006)(50986999)(81156014)(8676002)(54356999)(189998001)(76176999); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB006; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD010; 1:Jv7Sf6B3B792x9cNZHWpRVPuCGxuk3gIQ3RYf/y+kkD1p4wNVmMhTZzxd1gZNRUnLheLJoXJmHeBpUqLFG85RRNe8nac9gxn12m0BiqPDSrygO80f9eTFD4f4DbNRd1REKGypTG/SjRvgAJjW9Kb32UrLKPrbe9l4qsx9hbB/6tn4Qqw1ng6DrdkIX8QpVjLFsDmRhGUNV4chnufQtHdlTP1YQR7S7HL+nBF+utP/6J+TKRL638fArORGq+Aw57ThxOHLJ7a2VXm7bJ7xLC1qUks2EkNY0kh6k0tQIoXqvEkHMkChfGbMWLPz0mfBbPFmvZXhK2MyWGaaWnB8Vpsr1LXlbRFqIfsQ5+8AGg/isNAIAB3136Nau4vxMjJi3hSl/rO5BS4wYUGIXpa7NmnM7KrNhfd6Py6twH/xw8EH1t0iqT9w/xIFvEIDpbPyASwTEbNmPaQcxVQ74HIeIojG/evYGgf3S4lse6yBR1bCGVZujRtoIvyimQt/EG1e4azhPKtUGR50LJWPnG+bPTTtp03yakBnWpR5q8deID9Cq8Ok4K1daccKfM7moB9TqPa X-MS-Office365-Filtering-Correlation-Id: 1f684756-055f-499a-2a03-08d3bc862713 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB006; 2:3swo7+jIVVXPG/Qx8AazlkR/HaQgCBe8qPlmflAZtM6GVvSaguKg8qFDtU8quIfbmOC2NJmkd/jD9BqnObvCnhl2h3iLTJgdqWOKwmdpe9RozlKSIRmI6fDmFTlZeo+SXa6BZF53kMGioC2PwtjzvRHToLkAJ+s/4jj9ChmcAW+q0CgnF1fvYnEnvP6gR9sU; 3:NRJ+PQLRgU+43EURmFjs8Yuu1DSaV2JhX/dPcGmGIxZktoSjerekSiQKTxQ2EontaAtPYmT63WbNQ+SqsZSc+u28rb0LTj2hctmGs/1i3laEiYy+d6tJPkfuw2DH9BZgqncDTkYaUEFjYuxkxxjqUw8VNTBF1FnddjGlWE61q+QunU/IWDfB7ps3DsDxXRu8/59h/z+kUpk8jkElpEmwaOQOnmh9sJB4wiiiLCaxOzsFGOMH/P/CsMAKPtclLKrJc3mXLVrjCUDt4tYRMpIJPA==; 25:UjEOU+Xq0q7eoMqjo2NOUS3Kl8CjPOvSBlhZwlE7xaPBmr1tAMv3uj3nuoIdi6uwDFWBFyhGI5crAM2LtK7cCSJWlCFIbfrnADBLjpNzCZR+Zdj3FhnGeVyLTHdKC55kaG69dB/ZWvL3pmzZ+GxJi0c1msG/wlOUno2RwRmpLo1rcBhSh1Kw3CHazd7Mo2gfeHeLjj/+IP+hr9we51d1+H+d0eyk1oHahP+2n8EKoPh8xvIFCSU90vCOaC8sQts8hX8Jg1+mzmjBFiXE62q8R1aNlGpT36fNXjeQlDje9dURNJXfB0Lg2LQ101ERwo+vh6STrMwJB+wEu0okSoNXaRjvVZnZ7wi5/mNNQ0mxZRMrUbVWZRqnOEqckj1B7AQoYku8t1PDAhUgfyWajlv8y6JYjNEDwv5o8sCFFmSMcCbbkQfZ8QOMc/zXkdtgZFJA X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB006; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB006; 31:oqieBq5AduoSY747SBXR97kR+4o05o2LGpgJOrbXlY15k1Jx5K1LPtpM5drocBUMIZLy9jaYRqVT+baX6kGuMzCL22f1u/JHNJN8LCesh5H/hiWEyJPqUG3/C1IiYLxIunqf60zRZbQvuMnpxFobDp+O94Pq5mw0mL38O3b1QSUxQ3rtQMymTrAYi0S6FPVxTXUDFAH0vmkrxYeMsF2GQ5pKarWcVcc595JrzNWN3jI=; 20:ObvkrwJ6EhRtVLSF3A+y+AL7gP/xCSjFGDCePktJ58Xu+nAKxUyy44nay4CdkgW8PGPJF5fFu+EqvppnJya6fPlsxVlK12AeHHtOGGn5XBJz6MAx62qQNagZpeMyHHwew1w+UGy+G45b6XU2UzNudgCjH99GXpCPGLxxI7cO8U0/SGsv/KjUzBExk1ILJv1TytQ5be9faU9ivPTnDIMThiXEpvhEWVnXsATxlChd3/GfxQtEP9LYUdup+xv74/X8FIvEayCdDv4F2yorL6OWOocoDwKc6lYx9PAcROXwqbXfwsTviqWjP3JMa65+el0gKQsp9j/Eg3Xas7FGZQeroojaRR5e8MDeMzU/hURGRK6Khv5b9vZ0HZB0CReKYEWDxQ/X17HQFTV0zLbM8ODikEHtZOiRz9zAq0kVAYsy4nE= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(278428928389397)(192374486261705)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(13023025)(13017025)(13018025)(13015025)(13024025)(8121501046)(5005006)(10201501046)(3002001)(6055026); SRVR:BN1AFFO11HUB006; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB006; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB006; 4:IU8DFXC+Nef9ieirm1mF8LC/SPw/tRywHnHbbBAx+smgF5NmWJFT3ZHPThyeA1/qg9cf9MsIhM0H8RpcVeGHUlH4Qslh8d9hlp0QeN7p/wOrw7VqSmK1Q2YpO/Y+6qGru1rIN1UWHUCoDMCNxz3nMicV/NR+drevsHHo+K+TH7tvWetIzEyHxl0H3p533tm9XFDGD9tk4WsW/P+RA8IeanqsrZwrNRgqqyTBNrZtkOp4J4EszX48xMruyKbDpB/Eu4MG0IHY4tRIe6HavxPlFQSx8dn7sbALE4sTbxL/IWKPJZ0NlgwqMvgNSm0ZzRvIWdXaBGcrdbR+fajaPvRNrLXM4HoN8bVDniJl+eZXTmxfPQlU8JbKrB2uv5BSSwEPoQ+RoXvbUjxEXvFLwR1iYOBtBkr3IwSrNU5IynUmQaMmwpXOp3P3A5EoG0Ks7ICUJV54aWkIQsalGc+szVj6VOgyQCl/ounDYHLgUh/JticFyO3Sf8u/taS3w61HiKUSRq/W1aRsY/8nqPUCF9mMUjg/GTVPdFoNMuZKXXSGiiGWfh3MIaNeGWWdmnu6TbUTtyvfxlYUcE2E1sQqwSae0pAHy5qtNWt5uzWW7DtuPH47iB+ACMtMiES0wij3jW1S42zD8zNRmix5blfq6uDp3g== X-Forefront-PRVS: 00246AB517 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB006; 23:eLin6h1uq019W1g2Cazaeq7GBo/HEs7R9JfvbzU?= =?us-ascii?Q?ojlHU0IJ4Ene2elaZevgmk6zAS/s023Rk2iKBXl8wYwqJct1STm9RkDM8Xwt?= =?us-ascii?Q?/T2fFmFEGZat2bXZLUmKjwctWAnyWxXoCpjRB+eaOPUIBISA45XXDdYlT+/g?= =?us-ascii?Q?rKYqIu7dUed8ZcbNceyvo0zULeecuozIikbhMt8dzYTh8EP9JiRmhjoCzJ66?= =?us-ascii?Q?/xRKemNlWjByw2pKBeF3sSAC2SOaEvC/TOYzUQ1rsoVef8OPXIIFOfUVN+od?= =?us-ascii?Q?nQt9egLF/USAH4e0Etp/goSwtjP+01qGu/j7PrdUn276GoQhsgMUNRnXB5J8?= =?us-ascii?Q?EuwwLXrgTcBhV0JJLQS+uPWyiLldfNXEvX6cprQJGAyne2fr8B5RzF6ZjBR5?= =?us-ascii?Q?bcmP968lCb5m2thTzWu5U6H0V7E0n+BUrZa6YmuUhyqN9PYdLGk+I85vTds9?= =?us-ascii?Q?2ACjBEEYG9KgwF/iyB9gg5BhSbOWIj5Jn8KCJzUDf2b4wVaQGuRWe9qrBKzn?= =?us-ascii?Q?5O6cFSVA55JHNwfGvjioKRggCwymdY/FLaNfmRg/lKz8O12Z7fexqykK7OZO?= =?us-ascii?Q?t0IVHb/A6PVGIMjeFpW/8c9mswW3NvOViTciI8v0god4iWyGIx49kVX7sBY9?= =?us-ascii?Q?LuoDCjfkE+EmDiaRIA4CijYrCsNBT5y3n8LklB6d5x1kOSD4EJFfq0nIECQg?= =?us-ascii?Q?kHxPqoZ8KdsAuiQT2oLF/b0wQzCDWpA4/OieVa900MV5/IF7ZNKttvGOC9V+?= =?us-ascii?Q?NTjOlB23xj1d2KYz8Mca2PtQnej3OEYbzSYXdaWxaGuhX+OgdRzBxZblV3Xv?= =?us-ascii?Q?O4jzPRwGpz55fex2iRZjpF52O71jyulBsUmNslIL+zH20rDCg99s0juZ51xr?= =?us-ascii?Q?w4twvRXACrcJFxW3AToHs+QS804m0gv6bNkldweNN2l6jTrM9j9gM11pFfxY?= =?us-ascii?Q?wjCOGOtbYZhVX6HRtq7NvTTTLAGimjlaAxoHyhWiglpggU69PnZnDUbUS+Cb?= =?us-ascii?Q?C6HdO1wjiSqDmzi6ffhLMlAA2IkZO2kQ0lMHeXrc3g2esY94F+qN7Wh1yqgr?= =?us-ascii?Q?wFautsiJy71yYzLPH56D7yx4dsLX2Gy7V29HkMgD5emY+ZsKjxxc0V9f2vBh?= =?us-ascii?Q?Eh8nmVjtzVKsj7lMlHKdwDLs3bNZxhPpoJfQEDQebRPpxnxaqqUWf8XOS0cS?= =?us-ascii?Q?75yPGuaFU5arTReZyVI7dbbt6o4mYlNrOyFWowdFSYbG6NvuQJyFGrCPSd3U?= =?us-ascii?Q?zxtL2VccBgTVcJNj/1cBugpBJuyN8qUl3s+tyj9hUL3KpsH813/piI8ZZ4wV?= =?us-ascii?Q?bOigBoUSNaXP4eoCAsmq875roQWJONyksy7pCTil4J/39?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB006; 6:IRzokKGBtP1gip9MVQbrSxKtr5BteD3yI+Znhm8eLtNR8OPRk4ISp05/Pe+k64TyO90cUC0zr5wxpOFaVkdqrVwqGSLQpKFVpxMBeoKMalbQgAVTlVqCUazCbiVnoTegn7XpbnQix3UWyVezbsspjvokEjXH+S7cson11LXqIcdybAluBtdV9o8vz0IiSdpYWpezGchWdUFBspZhERyQDrlLF9rrX3dUas8uYfHC3o7L/TYUM/5FoFUxDsgCTvESGPMxch0TccK1aZ9+iKaGg8Mb4PoW8PQ+fmjxtfN08T5YtHHjueiS6TV0F87z2hBYQrmvV6hOIYHr7jOZcH5sdA==; 5:vy7K2JNqva6rvdpC+vK11TQ2SJNVNkFGC1p7nHSxBVA9OF9tyvqc33Qj7ppcCUpYWBZEVfuaNoLY9QV/7Wxr7oxVlhdDldxAX+ygYxajdANUnyhjg2Ap0SpWjanpfOIejDK6G2tnU5R4N+7chFQNZA==; 24:w0+4YsmyxWBF66Pqte8heAFyvUZkYGO+2YIS13WRSYq1MFEEEQgZH+JpnhE3FEibbND5+yub9gIP+eW3kyg2IILl2yQCQQABDV1qiuBPzjU=; 7:ANbs39unsjYZH7Ff9RnaTXxnnzma8EZ0F4qpfETaNkQ+X24rOdDcRfj/KnsukzFoPIAhiNCLtEJ+MqLSCIzwd2WSSuRKXR+yl7VBFodZz5F2DeMmhgK2P5XU+k5jTLgqshLvQFwGNTDgFN5nCeIzu9HvVCy+0BBPljxIg0JwwZFg+QUelM7Cf5BtFe31l+CThKfViikRzsr3CGJow5L8A98d9Sn/EOj3oVGYGbbRav0Tzj23BoisUw/Gm2aAoJNZ SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2016 16:41:15.4862 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB006 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 16:41:26 -0000 --_000_61386a070cd14ccba7099f3951e81c9fPLSWE13M08adsprintcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJhdWQgZnJvbSBjb21wcm9taXNlZCBQQlhlcyBpcyBjb21tb24uICBBbmQgZXZlbiB3aGVyZSBh IFBCWCBpcyBub3QgY29tcHJvbWlzZWQsIGEgY2FycmllciBoYXMgbm8gcHJhY3RpY2FsIHdheSBv ZiBrbm93aW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVtYmVyIGlzIHByb3Blcmx5IGFzc2lnbmVk IGFuZCB2YWxpZCBmcm9tIHRoZSBwZXJzcGVjdGl2ZSBvZiB0aGUgRW50ZXJwcmlzZS4gIFRoZXJl Zm9yZSwgY2hlY2tpbmcgd2hldGhlciB0aGUgY2FsbGluZyBudW1iZXIgd2FzIGZyb20gYW4gYXNz aWduZWQgcmFuZ2UgbWlnaHQgYmUgcG9zc2libGUgKGFuZCBmcmF1Z2h0IHdpdGggYWRtaW5pc3Ry YXRpdmUgY2hhbGxlbmdlcyksIGJ1dCBvZiBsaW1pdGVkIHZhbHVlLiAgQW5kIGluIHRoZSBjb25z dW1lciBtYXJrZXQsIHRoZXJlIGFyZSBjYWxsaW5nIHByb2R1Y3RzIHdoaWNoIHN1cHBvcnQgYSBw YXJlbnQgc3Vic2NyaWJlciBudW1iZXIgYW5kIOKAnGNvbXBhbmlvbuKAnSBkZXZpY2VzIChlLmcu LCB0YWJsZXRzKSB3aGljaCBjYW4gcGxhY2UgYSBjYWxsIHVzaW5nIHRoZSBNRE4gb2YgdGhlIHBh cmVudCBzdWJzY3JpYmVyLiAgVGhlc2UgYXJlIGV4YW1wbGVzIG9mIHdoZXJlIHRoZSBhdXRoZW50 aWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyIHdvbuKAmXQgbmVjZXNzYXJpbHkgbWVhbiB0aGUg c2FtZSB0aGluZyBhcyB0aGUgYXV0aGVudGljaXR5IG9mIGEgY2FsbCBmcm9tIGEgc2luZ2xlIHN1 YnNjcmliZXIgd2l0aCBhIHNpbmdsZSBNRE4gcmVnYXJkbGVzcyBvZiDigJxsYXhpdHnigJ0gb2Yg c3Bvb2YgY2hlY2tpbmcuDQoNCkluIGFub3RoZXIgZm9ydW0gYW5kIGFudGljaXBhdGluZyBjYWxs aW5nIG51bWJlciBhdXRoZW50aWNhdGlvbiBtYW5kYXRlcyBmcm9tIENvbmdyZXNzIGFuZC9vciBG Q0MsIEkgc3VnZ2VzdGVkIHVzaW5nIGNhcnJpZXItc3BlY2lmaWMgY2VydHMgYW5kIGVuY29kaW5n IHNwZWNpZmljaXR5IG9mIGF1dGhlbnRpY2l0eSwgYW5kIGNhbGxpbmcgbnVtYmVyLiAgVGhpcyBw cm92aWRlcyB0aGUgaWRlbnRpdHkgb2YgdGhlIG9yaWdpbmF0aW5nIGNhcnJpZXIsIHNvbWUgaWRl YSBhcyB0byB0aGUgYWNjdXJhY3kgb3Igc3BlY2lmaWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVy LCBhbmQgdmFsaWR0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgKGFzc3VtaW5nIG5vbmNlIGFuZCBy ZXBsYXkgaXNzdWVzIGNhbiBiZSBhZGRyZXNzZWQgYXMgcmVhc29uYWJseSBzdWdnZXN0ZWQgYmVs b3cgYnkgQWxleCkuDQoNClRoZSByZXByZXNlbnRhdGlvbiBvZiBvcmlnLWNhcnJpZXIgYW5kIHRy dXN0d29ydGhpbmVzcyBjb3VsZCBiZSBhcyBmb2xsb3dzOg0KDQoNClJlZ3VsYXRlZC9tYW5kYXRl ZCBDYXJyaWVyIENsYXNzIFVzZSBDYXNlOg0KDQoNCjAwIC0gTm8gQ3JlZGVudGlhbHMNCg0KVXNl IGNhc2UgZXhhbXBsZShzKTogUHJlLUlNUywgbGVnYWN5IGNpcmN1aXQtc3dpdGNoZWQgbmV0d29y a3MgdGhhdCBkb24ndCBuYXRpdmVseSBzdXBwb3J0IFNJUCBvciB3aGljaCBkb24ndCBjaG9vc2Ug dG8gc2lnbiBjYWxscy4gIEUuZy4sIGludGVybmF0aW9uYWwgY2FycmllcnMuDQoNClRydXN0IEVz dGltYXRlOiAgR29vZCBsdWNrLiAgQ2Fycmllcl9vcmlnIGFuZCBDZ1BOIGVudGlyZWx5IHVudHJ1 c3R3b3J0aHkuDQoNCg0KDQowMSAtIENhcnJpZXIgc2lnbmVkLCBubyBhdXRoZW50aWNhdGlvbiBv ZiBDZ1BODQoNClVzZSBjYXNlIGV4YW1wbGUocyk6IEU5MTEgb24gdmlzaXRlZCBuZXR3b3JrIHcv byByb2FtaW5nIGFncmVlbWVudCwgbWFudWFsIHJvYW1pbmcuDQoNClRydXN0IEVzdGltYXRlOiAg Q2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGVudGlyZWx5IHVudHJ1c3R3b3J0aHkNCg0K DQoNCjEwIC0gQ2FycmllciBzaWduZWQsIHNlbWktYXV0aGVudGljYXRlZCBDZ1BODQoNClVzZSBj YXNlIGV4YW1wbGUocyk6IE51bWJlciBibG9jayBkZWxlZ2F0ZWQgZnJvbSBPQ04sIGJ1dCBubyBw ZXItVE4gc2NyZWVuIChTSVAgdHJ1bmtzKS4NCg0KVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVyX29y aWcgdHJ1c3R3b3J0aHksIENnUE4gbGVzcyB0aGFuIG1vc3QgdHJ1c3R3b3J0aHkgYnV0IG5vdCBl bnRpcmVseSB1bnRydXN0d29ydGh5Lg0KDQoNCg0KMTEgLSBDYXJyaWVyIHNpZ25lZCwgYXV0aGVu dGljYXRlZCBDZ1BODQoNClVzZSBjYXNlIGV4YW1wbGUocyk6IEJyZWFkLWFuZC1idXR0ZXIgOTUl KyBvZiBjYWxscyBmcm9tIHN1YnNjcmliZXIgbGluZXMgKElNUy1iYXNlZCBhbmQgb3RoZXJ3aXNl KS4NCg0KVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4gbW9z dCB0cnVzdHdvcnRoeQ0KDQoNCg0KUHVibGljIFVzZSBDYXNlOg0KDQoNCg0KVW5kZWZpbmVkIGJ1 dCBhc3N1bWVkIHRvIHVzZSBwdWJsaWMgb3IgY29tbWVyY2lhbGx5IGF2YWlsYWJsZSBhdXRoZW50 aWNhdGlvbiBzZXJ2aWNlcyByZXNvdXJjZXMuICBlLmcuLCBub21vcm9iby1saWtlIGNyb3dkLXNv dXJjZWQgYWNjZXB0L2RlbnkgbGlzdHMsIGV0IGNldGVyYS4gIENvdWxkL3dvdWxkIHBhc3MgY3Jl ZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUgZGV2aWNlcyB3aGljaCB3b3VsZCBwcm9jZXNzIHRo ZW0gYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBvZiB0aGUgUHVibGljIENsYXNzIGFwcGxpY2F0aW9u KHMpLg0KDQpQaWVyY2UNCg0KRnJvbTogQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2Vu Lm5ldF0NClNlbnQ6IEF1Z3VzdCAwNCwgMjAxNiA5OjAyIEFNDQpUbzogQWxleCBCb2JvdGVrIDxh bGV4QGJvYm90ZWsubmV0Pg0KQ2M6IHN0aXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbc3Rpcl0g U1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQoNClRoZXJlIGFyZSByZWFzb25hYmxlIGNpcmN1bXN0 YW5jZXMgd2hlcmUgYSBwYXJ0eSBwbGFjaW5nIGEgY2FsbCBpcyBub3QgdGhlIGF1dGhvcml6ZWQg ZW50aXR5IGFzc2lnbmVkIHRoZSB0ZWxlcGhvbmUgbnVtYmVyIHVzZWQgaW4gRnJvbS9QQUksIGFu ZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlIHNlcnZpY2UgcHJvdmlkZXIgc2VydmljaW5nIHRo ZSBlbnRpdHkgcGxhY2luZyB0aGUgY2FsbCBtYXkgb3IgbWF5IG5vdCBiZSB0aGUgc2FtZSBhcyB0 aGUgc2VydmljZSBwcm92aWRlciBzZXJ2aW5nIHRoZSBlbnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0 aGUgVE4uICBJbiBhbGwgc3VjaCBjYXNlcywgdGhlIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVkIHRo ZSBUTiBleHBsaWNpdGx5IGF1dGhvcml6ZXMgY2FsbHMgcGxhY2VkIHVzaW5nIGl04oCZcyBUTi4g IFRoZSBkZXNpZ24gYWNjb21tb2RhdGVzIHN1Y2ggdXNlIGNhc2VzLiAgSXTigJlzIG5vdCBhIGJs YW5rZXQgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLiAgIFdl4oCZcmUgbm90 IGF3YXJlIG9mIGFueSBjYXNlcyB3aGVyZSB0aGVyZSBpcyBhbiBhY3R1YWwgcmVxdWlyZW1lbnQg Zm9yIGxlZ2l0aW1hdGUgY2FsbGluZyB3aXRob3V0IGV4cGxpY2l0IGF1dGhvcml6YXRpb24gZnJv bSB0aGUgYXNzaWduZWQgZW50aXR5LCBhbHRob3VnaCB3ZSBjZXJ0YWlubHkgYXJlIGF3YXJlIHRo YXQgdmFyaW91cyBwYXJ0cyBvZiB2YXJpb3VzIHNlcnZpY2UgcHJvdmlkZXJzIGRvbuKAmXQgYm90 aGVyIHRvIGNoZWNrLiBBdCB0aGlzIHBvaW50LCBhdCBsZWFzdCBpbiBzb21lIGNvdW50cmllcywg dGhlcmUgaXMgYSByZWFsaXphdGlvbiB0aGF0IHRoZSBsYXhpdHkgb2YgYWxsb3dpbmcgdW5jaGVj a2VkIHNwb29maW5nIGlzIG5vdCBhY2NlcHRhYmxlIGFueSBtb3JlLg0KDQpCcmlhbg0KDQpPbiBB dWcgMywgMjAxNiwgYXQgODozNSBBTSwgQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0PG1h aWx0bzphbGV4QGJvYm90ZWsubmV0Pj4gd3JvdGU6DQoNCjEuICAgICAgIFBlcm1pdCBhdXRob3Jp emF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24NCkluIHRoZSBjdXJyZW50IHRlbGVwaG9ueSBu ZXR3b3JrIHByYWN0aWNlLCBzb21lIHNlcnZpY2UgcHJvdmlkZXIgaW1wbGVtZW50YXRpb25zIGNo b29zZSBub3QgdG8gYXV0aGVudGljYXRlIGlkZW50aXR5LCBidXQgc2ltcGx5IGZhY2lsaXRhdGUg dGhlIHVzZSBvZiBhbiBhcmJpdHJhcnkgb3Igc2VsZWN0ZWQgdXNlci1wcm92aWRlZCBpZGVudGl0 eS4gIEFyZSB0aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8gIEhhcyBhbnlvbmUg ZXN0YWJsaXNoZWQgdGhhdCB0aGVyZSBhcmUgbm90PyAgSG93IGNhbiB0aGUgaW5kdXN0cnkgcmVh c29uYWJseSBleHBlY3QgdG8gZW5kIHRoaXMgKG9mdGVuIGJhZCkgcHJhY3RpY2U/ICBJZiBpdCBj YW7igJl0IGJlIGVuZGVkLCB0aGVyZeKAmXMgdmFsdWUgaW4gYXQgbGVhc3QgaWRlbnRpZnlpbmcg dGhlIG9yaWdpbmF0aW5nIHNlcnZpY2UgcHJvdmlkZXIgKGkuZS4sIHRoZSBzaWduZXIvYXV0aG9y aXplcikuICBHaXZlbiB0aGUgcHJldmFsZW5jZSBvZiBhYnVzZSB1c2luZyB0ZWxlcGhvbmUgbnVt YmVycyBhc3NpZ25lZCB0byBhIHNvbWV0aW1lcy1hbm9ueW1vdXMgYWJ1c2VyLCBpdCBiZWNvbWVz IGNyaXRpY2FsbHkgaW1wb3J0YW50IHRvIGlkZW50aWZ5IHRoZSBzZXJ2aWNlIHByb3ZpZGVyKHMp IGNsb3Nlc3QgdG8gdGhlIGFidXNlci4gIEJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQgaXTi gJlzIGJldHRlciB0byBJRCBzZXJ2aWNlIHByb3ZpZGVycyB0aGFuIHVucmVhc29uYWJseSBleHBl Y3QgYSBiYW4gb2YgdGhlIHVzZSBvZiB1bmF1dGhlbnRpY2F0ZWQgKGFuZCB0aGVyZWZvcmUgdW5z aWduZWQpIFNJUCByZXF1ZXN0cywgU1RJUiBzaWduaW5nIHNob3VsZCBzdXBwb3J0IGF1dGhvcml6 YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbi4gIFRoZSBwcmFjdGljZSBvZiBhdXRob3Jpemlu ZyB1bmF1dGhlbnRpY2F0ZWQgdXNlIGV4aXN0cywgYW5kIHRoZXJlIGlzIGJlbmVmaXQgdG8gc2ln bmluZyBpbiB0aGVzZSBjYXNlcyAoc2VydmljZSBwcm92aWRlciBpZGVudGlmaWNhdGlvbikuICBU aGUgbGFuZ3VhZ2Ugb2YgdGhlIElEIHNob3VsZCBwZXJtaXQgdGhpcyB1c2UuICA0NDc0YmlzLTEw IHNob3VsZCBOT1QgcmVxdWlyZSBvciBhc3N1bWUgdGhhdCAgdGhhdCBhdXRoZW50aWNhdGlvbiB3 aWxsIHByZWNlZGUgYXV0aG9yaXphdGlvbi4gT2YgY291cnNlIHRoZXJlIG1heSBiZSBvdGhlciB1 c2UgY2FzZXMgd2hlcmUgc2lnbmluZyBpbmNsdWRlcyBhdXRoZW50aWNhdGlvbiBhbmQgbWF5IG5v dCBpbmNsdWRlIGEgc3BlY2lmaWMgc2VydmljZSBwcm92aWRlcuKAmXMgYXV0aG9yaXphdGlvbi4N Cg0KDQoyLiAgICAgICBJbXByb3ZlIHJlcGxheSBwcmV2ZW50aW9uDQpQcm94aW1hdGUgcmVwbGF5 IGlzIHBvc3NpYmxlIHdoaWxlIGNvbXBseWluZyB3aXRoIHRoaXMgc3BlYy4gIEZpcnN0LCBvbmUg b3IgbW9yZSBwcm94aW1hdGUgKGUuZy4sIHdpdGhpbiA2MCBzZWNvbmRzKSBTSVAgcmVxdWVzdHMg dXNpbmcgdGhlIHNhbWUgdG9rZW4gYXJlIGxlZ2FsIGFuZCBzdWJqZWN0IHRvIHJlcGxheSBpbiBt YW55IGNhc2VzLiAgQW4gU0RQIGJvZHnigJlzIG1reSBtYXkgbm90IGJlIHByZXNlbnQgYW5kIGlm IHByZXNlbnQgaXRzIHVzZSBpcyBvcHRpb25hbC4gIFNvbWUgc29ydCBvZiBtYW5kYXRvcnkgbmV3 IG9yIGV4aXN0aW5nIHNpZ25lZCBzZXF1ZW5jZSwgcmFuZG9tICMgb3IgcmVxdWVzdCBJRCAoZS5n LiwgQ2FsbC1JRCBvciBDU2VxKSBhbmQgYSAxLXRpbWUgdXNlIHBvbGljeSBvbiB0aGUgcmVjZWl2 aW5nIGVuZCBvZiB0aGUgcmVxdWVzdCAoZS5nLiwgdG9rZW5zIG9ubHkgZ29vZCBmb3IgMSB1c2Up IGNvdWxkIHByZXZlbnQgcmVwbGF5LiAgRGlmZmVyZW50IG1ldGhvZHMgKGUuZy4sIElOVklURSB2 cyBNRVNTQUdFKSBtaWdodCBiZSBoYW5kbGVkIGJ5IGRpZmZlcmVudCByZWNlaXZpbmcgaW5mcmFz dHJ1Y3R1cmUsIGFuZCB0aGVyZWZvcmUgZGlmZmljdWx0aWVzIHdpdGgg4oCYaXTigJlzIGJlZW4g dXNlZCBhbHJlYWR54oCZIGNvb3JkaW5hdGlvbiBhbGxvdyBhIGZha2VkIE1FU1NBR0UgYmFzZWQg b24gYSBjYXB0dXJlZCByZXF1ZXN0LiBUaGlzIG1pZ2h0IGluY2x1ZGUgYW4gbWtleSBmcm9tIGEg Y2FwdHVyZWQgSU5WSVRFLiAgIFNvIGl0IG1heSBiZSBwb3NzaWJsZSB0byBET1MsIHNwYW0gb3Ig dGV4dC1ib21iIGEgcmVjaXBpZW50IHVzaW5nIGEgY2FwdHVyZWQgaWRlbnRpdHkuICBXaGlsZSBs YXJnZS1zY2FsZSBvciBkaXN0cmlidXRlZCBpbXBsZW1lbnRhdGlvbnMgbWF5IG1ha2UgdGhlIGVu Zm9yY2VtZW50IGRpZmZpY3VsdCwgdGhlcmUgaXMgbGl0dGxlIGNvc3QgdG8gc2lnbmluZyBhbmQg ZGVjb2RpbmcgYSBtZXRob2QgYW5kIHBvc3NpYmx5IGEgbnVtZXJpYyBJRC4gICBTb21lIHNvcnQg b2Yg4oCYMS11c2XigJkgcHJhY3RpY2Ugc2hvdWxkIGF0IGxlYXN0IGJlIGRpc2N1c3NlZCB3aGls ZSBwZXJoYXBzIG5vdCByZXF1aXJlZC4NCg0KDQpTcGVjaWZpYyBtYXJrdXAgc3VnZ2VzdGlvbnM6 DQoNCg0KTklUUw0KDQoNCiAgIFRoZSB2ZXJpZmllciBNVVNUIGluc3BlY3QgYW55IG9wdGlvbmFs ICJwcHQiIHBhcmFtZXRlciBhcHBlYXJpbmcgaW4gdGhlDQoNCiAgIElkZW50aXR5IHJlcXVlc3Qu ICBJZiBubyAicHB0IiBwYXJhbWV0ZXIgaXMgcHJlc2VudCwgdGhlbiB0aGUNCg0KICAgdmVyaWZp ZXIgcHJvY2VlZHMgbm9ybWFsbHkgYmVsb3cuICBJZiBhICJwcHQiIHBhcmFtZXRlciB2YWx1ZSBp cw0KDQogICBwcmVzZW50LCBhbmQgdGhlIHZlcmlmaWVyIGRvZXMgbm90IHN1cHBvcnQgaXQsIGl0 IE1VU1QgaWdub3JlIHRoZQ0KDQogICBJZGVudGl0eSBoZWFkZXIuICBJZiBhIHN1cHBvcnRlZCAi cHB0IiBwYXJhbWV0ZXIgdmFsdWUgaXMgcHJlc2VudCwNCg0KICAgdGhlIHZlcmlmaWVyIGZvbGxv d3MgdGhlIHByb2NlZHVyZXMgYmVsb3csIGluY2x1ZGluZyB0aGUgdmFyaWF0aW9ucw0KDQogICBk ZXNjcmliZWQgaW4gU3RlcCA1Lg0KDQozPGZpbGU6Ly8vQzpcVXNlcnNcYWIzNzc4XERvY3VtZW50 c1xJRVRGXGRyYWZ0LWlldGYtc3Rpci1yZmM0NDc0YmlzLTEwJTIwLSUyMEF1dGhlbnRpY2F0ZWQl MjBJZGVudGl0eSUyME1hbmFnZW1lbnQlMjBpbiUyMHRoZSUyMFNlc3Npb24lMjBJbml0aWF0aW9u JTIwUHJvdG9jb2wlMjAlMjhTSVAlMjkuaHRtI3NlY3Rpb24tMz4uICBCYWNrZ3JvdW5kDQoNClvi gKZdDQoNCg0KDQogICBQZXIgW1JGQzczNDA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3Jm YzczNDA+XSwgcHJvYmxlbXMgc3VjaCBhcyByb2JvY2FsbGluZywgdm9pY2VtYWlsIGhhY2tpbmcs IGFuZA0KDQogICBzd2F0dGluZyBhcmUgZW5hYmxlZCBieSBhbiBhdHRhY2tlcidzIGFiaWxpdHkg dG8gaW1wZXJzb25hdGUgc29tZW9uZQ0KDQogICBlbHNlLiAgVGhlIHNlY3VyZSBvcGVyYXRpb24g b2YgbW9zdCBTSVAgYXBwbGljYXRpb25zIGFuZCBzZXJ2aWNlcw0KDQogICBkZXBlbmRzIG9uIGF1 dGhlbnRpY2F0aW5nIGFuZC9vciBhdXRob3JpemluZyB0aGUgc291cmNlIG9mIGNvbW11bmljYXRp b25zIGFzIGl0IGlzDQoNCiAgIHJlcHJlc2VudGVkIGluIGEgU0lQIHJlcXVlc3QuDQoNCg0KICAg VGhpcyBpZGVudGl0eSBhcmNoaXRlY3R1cmUgZm9yIFNJUCBkZXBlbmRzIG9uIGluY2x1ZGVzIHBy b3Zpc2lvbnMgZm9yIGEgbG9naWNhbA0KDQogICAiYXV0aGVudGljYXRpb24gc2VydmljZSIgd2hp Y2ggdmFsaWRhdGVzIGNhbGxlciBpZGVudGl0eSBhdCBvciBuZWFyIG9yaWdpbmF0aW9uLiAgb3V0 Z29pbmcgcmVxdWVzdHMuICBBbg0KDQogICBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIG1heSBiZSBp bXBsZW1lbnRlZCBlaXRoZXIgYXMgcGFydCBvZiBhIHVzZXINCg0KICAgYWdlbnQgb3IgYXMgYSBw cm94eSBzZXJ2ZXI7IHR5cGljYWxseSwgaXQgaXMgYSBjb21wb25lbnQgb2YgYSBuZXR3b3JrDQoN CiAgIGludGVybWVkaWFyeSBsaWtlIGEgcHJveHkgdG8gd2hpY2ggb3JpZ2luYXRpbmcgdXNlciBh Z2VudHMgc2VuZA0KDQogICB1bnNpZ25lZCByZXF1ZXN0cy4gIE9uY2UgdGhlIHNlbmRlciBvZiB0 aGUgbWVzc2FnZSBoYXMgYmVlbg0KDQoNCg0KICAgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgYSBt ZWFucyBvZiBzaGFyaW5nIGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2UNCg0KICAgb2YgYXV0aGVu dGljaXR5IG9mIGFuZC9vciBhdXRob3JpemF0aW9uIHRvIHVzZSBlbmQtdXNlciBTSVAgaWRlbnRp dHkgaW4gYW4gaW50ZXJkb21haW4gb3IgaW50cmFkb21haW4gY29udGV4dC4NCg0KICAgSXQgcmVs aWVzIG9uIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGNvbnN0cnVjdGluZyB0b2tlbnMgYmFz ZWQgb24gW+KApl0NCg0KDQoNCg0KICAgVG8gbWF4aW1pemUgZW5kLXRvLWVuZCBzZWN1cml0eSwg aXQgaXMgdHlwaWNhbGx5IG9idmlvdXNseQ0KDQogICBwcmVmZXJhYmxlIGZvciBlbmQtdXNlcnMg dG8gYWNxdWlyZSB0aGVpciBvd24gY3JlZGVudGlhbHM7IGlmIHRoZXkNCg0KICAgZG8sIHRoZWly IHVzZXIgYWdlbnRzIGNhbiBhY3QgYXMgYXV0aGVudGljYXRpb24gc2VydmljZXMuICBIb3dldmVy LA0KDQogICBmb3Igc29tZSBkZXBsb3ltZW50cywgW+KApl0NCg0KDQpSZWdhcmRzLA0KDQpBbGV4 DQoNCkFsZXggQm9ib3Rlaw0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQpzdGlyIG1haWxpbmcgbGlzdA0Kc3RpckBpZXRmLm9yZzxtYWlsdG86c3Rp ckBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0K DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNClRoaXMgZS1tYWlsIG1heSBj b250YWluIFNwcmludCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbiBpbnRlbmRlZCBmb3IgdGhlIHNv bGUgdXNlIG9mIHRoZSByZWNpcGllbnQocykuIEFueSB1c2UgYnkgb3RoZXJzIGlzIHByb2hpYml0 ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBjb250YWN0 IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSBhbGwgY29waWVzIG9mIHRoZSBtZXNzYWdlLg0K --_000_61386a070cd14ccba7099f3951e81c9fPLSWE13M08adsprintcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OkdhcmFtb25kOw0KCXBhbm9zZS0xOjIgMiA0IDQgMyAzIDEgMSA4IDM7fQ0KLyogU3R5bGUg RGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwN Cgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBw dDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpoMg0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGluZyAyIENoYXIiOw0KCW1zby1t YXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxOC4wcHQ7DQoJZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVy bGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KcC5Nc29QbGFpblRleHQsIGxpLk1zb1BsYWluVGV4dCwgZGl2Lk1zb1Bs YWluVGV4dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlBsYWlu IFRleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9u dC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwcmUN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1h dHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5hcHBsZS1j b252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30N CnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9y bWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi SFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uSGVhZGlu ZzJDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIZWFkaW5nIDIgQ2hhciI7DQoJbXNvLXN0eWxlLXBy aW9yaXR5Ojk7DQoJbXNvLXN0eWxlLWxpbms6IkhlYWRpbmcgMiI7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkgTGlnaHQiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzJFNzRCNTt9DQpzcGFuLkVtYWlsU3R5 bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQXJp YWwiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMDBDQzsNCglmb250LXdlaWdodDpub3JtYWw7DQoJ Zm9udC1zdHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQpzcGFuLlBs YWluVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IlBsYWluIFRleHQgQ2hhciI7DQoJbXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IjsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUt dHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9u MQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47 fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3Bp ZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRh dGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8 Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMDAwMENDIj5GcmF1ZCBmcm9tIGNvbXByb21pc2VkIFBCWGVzIGlzIGNvbW1vbi4mbmJzcDsg QW5kIGV2ZW4gd2hlcmUgYSBQQlggaXMgbm90IGNvbXByb21pc2VkLCBhIGNhcnJpZXIgaGFzIG5v IHByYWN0aWNhbCB3YXkgb2Yga25vd2luZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciBpcyBw cm9wZXJseQ0KIGFzc2lnbmVkIGFuZCB2YWxpZCBmcm9tIHRoZSBwZXJzcGVjdGl2ZSBvZiB0aGUg RW50ZXJwcmlzZS4mbmJzcDsgVGhlcmVmb3JlLCBjaGVja2luZyB3aGV0aGVyIHRoZSBjYWxsaW5n IG51bWJlciB3YXMgZnJvbSBhbiBhc3NpZ25lZCByYW5nZSBtaWdodCBiZSBwb3NzaWJsZSAoYW5k IGZyYXVnaHQgd2l0aCBhZG1pbmlzdHJhdGl2ZSBjaGFsbGVuZ2VzKSwgYnV0IG9mIGxpbWl0ZWQg dmFsdWUuJm5ic3A7IEFuZCBpbiB0aGUgY29uc3VtZXIgbWFya2V0LCB0aGVyZSBhcmUNCiBjYWxs aW5nIHByb2R1Y3RzIHdoaWNoIHN1cHBvcnQgYSBwYXJlbnQgc3Vic2NyaWJlciBudW1iZXIgYW5k IOKAnGNvbXBhbmlvbuKAnSBkZXZpY2VzIChlLmcuLCB0YWJsZXRzKSB3aGljaCBjYW4gcGxhY2Ug YSBjYWxsIHVzaW5nIHRoZSBNRE4gb2YgdGhlIHBhcmVudCBzdWJzY3JpYmVyLiZuYnNwOyBUaGVz ZSBhcmUgZXhhbXBsZXMgb2Ygd2hlcmUgdGhlIGF1dGhlbnRpY2l0eSBvZiB0aGUgY2FsbGluZyBu dW1iZXIgd29u4oCZdCBuZWNlc3NhcmlseSBtZWFuIHRoZQ0KIHNhbWUgdGhpbmcgYXMgdGhlIGF1 dGhlbnRpY2l0eSBvZiBhIGNhbGwgZnJvbSBhIHNpbmdsZSBzdWJzY3JpYmVyIHdpdGggYSBzaW5n bGUgTUROIHJlZ2FyZGxlc3Mgb2Yg4oCcbGF4aXR54oCdIG9mIHNwb29mIGNoZWNraW5nLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMDBDQyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj5JbiBhbm90aGVyIGZvcnVtIGFuZCBh bnRpY2lwYXRpbmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljYXRpb24gbWFuZGF0ZXMgZnJvbSBD b25ncmVzcyBhbmQvb3IgRkNDLCBJIHN1Z2dlc3RlZCB1c2luZyBjYXJyaWVyLXNwZWNpZmljIGNl cnRzIGFuZCBlbmNvZGluZyBzcGVjaWZpY2l0eQ0KIG9mIGF1dGhlbnRpY2l0eSwgYW5kIGNhbGxp bmcgbnVtYmVyLiZuYnNwOyBUaGlzIHByb3ZpZGVzIHRoZSBpZGVudGl0eSBvZiB0aGUgb3JpZ2lu YXRpbmcgY2Fycmllciwgc29tZSBpZGVhIGFzIHRvIHRoZSBhY2N1cmFjeSBvciBzcGVjaWZpY2l0 eSBvZiB0aGUgY2FsbGluZyBudW1iZXIsIGFuZCB2YWxpZHR5IG9mIHRoZSBjYWxsaW5nIG51bWJl ciAoYXNzdW1pbmcgbm9uY2UgYW5kIHJlcGxheSBpc3N1ZXMgY2FuIGJlIGFkZHJlc3NlZCBhcyBy ZWFzb25hYmx5DQogc3VnZ2VzdGVkIGJlbG93IGJ5IEFsZXgpLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDAwMENDIj5UaGUgcmVwcmVzZW50YXRpb24gb2Ygb3JpZy1jYXJyaWVyIGFu ZCB0cnVzdHdvcnRoaW5lc3MgY291bGQgYmUgYXMgZm9sbG93czo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48Yj5SZWd1bGF0ZWQvbWFuZGF0ZWQgQ2FycmllciBDbGFzcyBV c2UgQ2FzZTo8bzpwPjwvbzpwPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPjxiPjAwIC0gTm8gQ3JlZGVudGlhbHM8bzpwPjwvbzpwPjwvYj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlVzZSBjYXNl IGV4YW1wbGUocyk6IFByZS1JTVMsIGxlZ2FjeSBjaXJjdWl0LXN3aXRjaGVkIG5ldHdvcmtzIHRo YXQgZG9uJ3QgbmF0aXZlbHkgc3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3QgY2hvb3NlIHRvIHNp Z24gY2FsbHMuJm5ic3A7IEUuZy4sIGludGVybmF0aW9uYWwgY2FycmllcnMuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlRy dXN0IEVzdGltYXRlOiAmbmJzcDtHb29kIGx1Y2suJm5ic3A7IENhcnJpZXJfb3JpZyBhbmQgQ2dQ TiBlbnRpcmVseSB1bnRydXN0d29ydGh5LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PGI+MDEg LSBDYXJyaWVyIHNpZ25lZCwgbm8gYXV0aGVudGljYXRpb24gb2YgQ2dQTjxvOnA+PC9vOnA+PC9i PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ VXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBvbiB2aXNpdGVkIG5ldHdvcmsgdy9vIHJvYW1pbmcg YWdyZWVtZW50LCBtYW51YWwgcm9hbWluZy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VHJ1c3QgRXN0aW1hdGU6ICZuYnNw O0NhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBlbnRpcmVseSB1bnRydXN0d29ydGh5PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48Yj4xMCAtIENhcnJpZXIgc2lnbmVkLCBzZW1pLWF1dGhl bnRpY2F0ZWQgQ2dQTjxvOnA+PC9vOnA+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VXNlIGNhc2UgZXhhbXBsZShzKTogTnVtYmVyIGJs b2NrIGRlbGVnYXRlZCBmcm9tIE9DTiwgYnV0IG5vIHBlci1UTiBzY3JlZW4gKFNJUCB0cnVua3Mp LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj5UcnVzdCBFc3RpbWF0ZTogJm5ic3A7Q2Fycmllcl9vcmlnIHRydXN0d29ydGh5 LCBDZ1BOIGxlc3MgdGhhbiBtb3N0IHRydXN0d29ydGh5IGJ1dCBub3QgZW50aXJlbHkgdW50cnVz dHdvcnRoeS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJt YXJnaW4tbGVmdDoxLjBpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxiPjExIC0gQ2FycmllciBzaWduZWQs IGF1dGhlbnRpY2F0ZWQgQ2dQTjxvOnA+PC9vOnA+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VXNlIGNhc2UgZXhhbXBsZShzKTogQnJl YWQtYW5kLWJ1dHRlciA5NSUmIzQzOyBvZiBjYWxscyBmcm9tIHN1YnNjcmliZXIgbGluZXMgKElN Uy1iYXNlZCBhbmQgb3RoZXJ3aXNlKS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VHJ1c3QgRXN0aW1hdGU6ICZuYnNwO0Nh cnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBtb3N0IHRydXN0d29ydGh5PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PGI+UHVibGljIFVzZSBDYXNlOjxvOnA+PC9vOnA+PC9iPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij5VbmRlZmluZWQgYnV0IGFzc3VtZWQgdG8gdXNlIHB1YmxpYyBvciBjb21tZXJjaWFsbHkgYXZh aWxhYmxlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2VzIHJlc291cmNlcy4mbmJzcDsgZS5nLiwgbm9t b3JvYm8tbGlrZSBjcm93ZC1zb3VyY2VkIGFjY2VwdC9kZW55IGxpc3RzLCBldCBjZXRlcmEuJm5i c3A7IENvdWxkL3dvdWxkIHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUNCiBkZXZp Y2VzIHdoaWNoIHdvdWxkIHByb2Nlc3MgdGhlbSBhY2NvcmRpbmcgdG8gdGhlIHJ1bGVzIG9mIHRo ZSBQdWJsaWMgQ2xhc3MgYXBwbGljYXRpb24ocykuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MDBDQyI+UGllcmNlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQnJp YW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCjxicj4NCjxiPlNlbnQ6PC9iPiBB dWd1c3QgMDQsIDIwMTYgOTowMiBBTTxicj4NCjxiPlRvOjwvYj4gQWxleCBCb2JvdGVrICZsdDth bGV4QGJvYm90ZWsubmV0Jmd0Ozxicj4NCjxiPkNjOjwvYj4gc3RpckBpZXRmLm9yZzxicj4NCjxi PlN1YmplY3Q6PC9iPiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50czxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGFyZSByZWFzb25h YmxlIGNpcmN1bXN0YW5jZXMgd2hlcmUgYSBwYXJ0eSBwbGFjaW5nIGEgY2FsbCBpcyBub3QgdGhl IGF1dGhvcml6ZWQgZW50aXR5IGFzc2lnbmVkIHRoZSB0ZWxlcGhvbmUgbnVtYmVyIHVzZWQgaW4g RnJvbS9QQUksIGFuZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlIHNlcnZpY2UgcHJvdmlkZXIg c2VydmljaW5nIHRoZSBlbnRpdHkgcGxhY2luZyB0aGUgY2FsbCBtYXkgb3IgbWF5DQogbm90IGJl IHRoZSBzYW1lIGFzIHRoZSBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpbmcgdGhlIGVudGl0eSB0aGF0 IGlzIGFzc2lnbmVkIHRoZSBUTi4gJm5ic3A7SW4gYWxsIHN1Y2ggY2FzZXMsIHRoZSBlbnRpdHkg dGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4gZXhwbGljaXRseSBhdXRob3JpemVzIGNhbGxzIHBsYWNl ZCB1c2luZyBpdOKAmXMgVE4uICZuYnNwO1RoZSBkZXNpZ24gYWNjb21tb2RhdGVzIHN1Y2ggdXNl IGNhc2VzLiAmbmJzcDtJdOKAmXMgbm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uDQogd2l0aG91 dCBhdXRoZW50aWNhdGlvbi4gJm5ic3A7IFdl4oCZcmUgbm90IGF3YXJlIG9mIGFueSBjYXNlcyB3 aGVyZSB0aGVyZSBpcyBhbiBhY3R1YWwgcmVxdWlyZW1lbnQgZm9yIGxlZ2l0aW1hdGUgY2FsbGlu ZyB3aXRob3V0IGV4cGxpY2l0IGF1dGhvcml6YXRpb24gZnJvbSB0aGUgYXNzaWduZWQgZW50aXR5 LCBhbHRob3VnaCB3ZSBjZXJ0YWlubHkgYXJlIGF3YXJlIHRoYXQgdmFyaW91cyBwYXJ0cyBvZiB2 YXJpb3VzIHNlcnZpY2UgcHJvdmlkZXJzIGRvbuKAmXQNCiBib3RoZXIgdG8gY2hlY2suIEF0IHRo aXMgcG9pbnQsIGF0IGxlYXN0IGluIHNvbWUgY291bnRyaWVzLCB0aGVyZSBpcyBhIHJlYWxpemF0 aW9uIHRoYXQgdGhlIGxheGl0eSBvZiBhbGxvd2luZyB1bmNoZWNrZWQgc3Bvb2ZpbmcgaXMgbm90 IGFjY2VwdGFibGUgYW55IG1vcmUuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBdWcgMywgMjAxNiwgYXQgODozNSBBTSwg QWxleCBCb2JvdGVrICZsdDs8YSBocmVmPSJtYWlsdG86YWxleEBib2JvdGVrLm5ldCI+YWxleEBi b2JvdGVrLm5ldDwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWluZGVu dDotLjI1aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+MS48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo3LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPlBlcm1pdA0KIGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkluIHRoZSBjdXJyZW50IHRlbGVw aG9ueSBuZXR3b3JrIHByYWN0aWNlLCBzb21lIHNlcnZpY2UgcHJvdmlkZXIgaW1wbGVtZW50YXRp b25zIGNob29zZSBub3QgdG8gYXV0aGVudGljYXRlIGlkZW50aXR5LCBidXQgc2ltcGx5IGZhY2ls aXRhdGUgdGhlIHVzZSBvZiBhbiBhcmJpdHJhcnkgb3Igc2VsZWN0ZWQNCiB1c2VyLXByb3ZpZGVk IGlkZW50aXR5LiZuYnNwOyBBcmUgdGhlcmUgbGVnaXRpbWF0ZSB1c2UgY2FzZXMgZm9yIHRoaXM/ Jm5ic3A7IEhhcyBhbnlvbmUgZXN0YWJsaXNoZWQgdGhhdCB0aGVyZSBhcmUgbm90PyZuYnNwOyBI b3cgY2FuIHRoZSBpbmR1c3RyeSByZWFzb25hYmx5IGV4cGVjdCB0byBlbmQgdGhpcyAoPHNwYW4g c3R5bGU9ImNvbG9yOiMxRjQ5N0QiPm9mdGVuPC9zcGFuPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5iYWQpIHByYWN0aWNlPyZuYnNwOw0KIElmIGl0IGNh buKAmXQgYmUgZW5kZWQsIHRoZXJl4oCZcyB2YWx1ZSBpbiBhdCBsZWFzdCBpZGVudGlmeWluZyB0 aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92aWRlciAoPHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPmkuZS4sPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj50aGUgc2lnbmVyL2F1dGhvcml6ZXIpLiZuYnNwOyBHaXZlbiB0aGUgcHJldmFsZW5j ZSBvZiBhYnVzZSB1c2luZyB0ZWxlcGhvbmUgbnVtYmVycw0KIGFzc2lnbmVkIHRvIGEgc29tZXRp bWVzLWFub255bW91cyBhYnVzZXIsIGl0IGJlY29tZXMgY3JpdGljYWxseSBpbXBvcnRhbnQgdG8g aWRlbnRpZnkgdGhlIHNlcnZpY2UgcHJvdmlkZXIocykgY2xvc2VzdCB0byB0aGUgYWJ1c2VyLiZu YnNwOyBCYXNlZCBvbiB0aGUgYXNzdW1wdGlvbiB0aGF0IGl04oCZcyBiZXR0ZXIgdG8gSUQgc2Vy dmljZSBwcm92aWRlcnMgdGhhbiB1bnJlYXNvbmFibHkgZXhwZWN0IGEgYmFuIG9mIHRoZSB1c2Ug b2YgdW5hdXRoZW50aWNhdGVkDQogKGFuZCB0aGVyZWZvcmUgdW5zaWduZWQpIFNJUCByZXF1ZXN0 cywgU1RJUiBzaWduaW5nIHNob3VsZCBzdXBwb3J0IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRo ZW50aWNhdGlvbi4mbmJzcDsgVGhlIHByYWN0aWNlIG9mIGF1dGhvcml6aW5nIHVuYXV0aGVudGlj YXRlZCB1c2UgZXhpc3RzLCBhbmQgdGhlcmUgaXMgYmVuZWZpdCB0byBzaWduaW5nIGluIHRoZXNl IGNhc2VzIChzZXJ2aWNlIHByb3ZpZGVyIGlkZW50aWZpY2F0aW9uKS4mbmJzcDsgVGhlIGxhbmd1 YWdlDQogb2YgdGhlIElEIHNob3VsZCBwZXJtaXQgdGhpcyB1c2UuJm5ic3A7IDQ0NzRiaXMtMTAg c2hvdWxkIE5PVCByZXF1aXJlIG9yIGFzc3VtZSB0aGF0Jm5ic3A7IHRoYXQgYXV0aGVudGljYXRp b24gd2lsbCBwcmVjZWRlIGF1dGhvcml6YXRpb24uIE9mIGNvdXJzZSB0aGVyZSBtYXkgYmUgb3Ro ZXIgdXNlIGNhc2VzIHdoZXJlIHNpZ25pbmcgaW5jbHVkZXMgYXV0aGVudGljYXRpb24gYW5kIG1h eSBub3QgaW5jbHVkZSBhIHNwZWNpZmljIHNlcnZpY2UgcHJvdmlkZXLigJlzDQogYXV0aG9yaXph dGlvbjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4uPC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW4iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Mi48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdCI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkltcHJvdmUNCiBy ZXBsYXkgcHJldmVudGlvbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPlByb3hpbWF0ZSByZXBsYXkgaXMgcG9zc2libGU8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPndoaWxl IGNvbXBseWluZyB3aXRoPC9zcGFuPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj50aGlzDQogc3BlYy4mbmJzcDsgRmlyc3QsIG9uZSBvciBtb3JlIHByb3hp bWF0ZSAoZS5nLiwgd2l0aGluIDYwIHNlY29uZHMpIFNJUCByZXF1ZXN0cyB1c2luZyB0aGUgc2Ft ZSB0b2tlbiBhcmUgbGVnYWwgYW5kIHN1YmplY3QgdG8gcmVwbGF5IGluIG1hbnkgY2FzZXMuJm5i c3A7IEFuIFNEUCBib2R54oCZcyBta3kgbWF5IG5vdCBiZSBwcmVzZW50IGFuZCBpZiBwcmVzZW50 IGl0cyB1c2UgaXMgb3B0aW9uYWwuJm5ic3A7IFNvbWUgc29ydCBvZiBtYW5kYXRvcnkgbmV3IG9y IGV4aXN0aW5nDQogc2lnbmVkIHNlcXVlbmNlLCByYW5kb20gIyBvciByZXF1ZXN0IElEIChlLmcu LCBDYWxsLUlEIG9yIENTZXEpIGFuZCBhIDEtdGltZSB1c2UgcG9saWN5IG9uIHRoZSByZWNlaXZp bmcgZW5kIG9mIHRoZSByZXF1ZXN0PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4oZS5nLiwgdG9rZW5zIG9u bHkgZ29vZCBmb3IgMSB1c2UpPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjwvc3Bhbj5jb3VsZA0KIHByZXZlbnQgcmVwbGF5LiZuYnNwOyBEaWZmZXJlbnQg bWV0aG9kcyAoZS5nLiwgSU5WSVRFIHZzIE1FU1NBR0UpIG1pZ2h0IGJlIGhhbmRsZWQgYnkgZGlm ZmVyZW50IHJlY2VpdmluZyBpbmZyYXN0cnVjdHVyZSwgYW5kIHRoZXJlZm9yZSBkaWZmaWN1bHRp ZXMgd2l0aCDigJhpdOKAmXMgYmVlbiB1c2VkIGFscmVhZHnigJkgY29vcmRpbmF0aW9uIGFsbG93 IGEgZmFrZWQgTUVTU0FHRSBiYXNlZCBvbiBhIGNhcHR1cmVkIHJlcXVlc3QuJm5ic3A7PHNwYW4g c3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlQ8L3NwYW4+aGlzDQogbWlnaHQgaW5jbHVkZSBhbiBta2V5 IGZyb20gYSBjYXB0dXJlZCBJTlZJVEUuJm5ic3A7ICZuYnNwO1NvIGl0IG1heSBiZSBwb3NzaWJs ZSB0byBET1MsIHNwYW0gb3IgdGV4dC1ib21iIGEgcmVjaXBpZW50IHVzaW5nIGEgY2FwdHVyZWQg aWRlbnRpdHkuJm5ic3A7IFdoaWxlIGxhcmdlLXNjYWxlIG9yIGRpc3RyaWJ1dGVkIGltcGxlbWVu dGF0aW9ucyBtYXkgbWFrZSB0aGUgZW5mb3JjZW1lbnQgZGlmZmljdWx0LCB0aGVyZSBpcyBsaXR0 bGUgY29zdCB0byBzaWduaW5nIGFuZA0KIGRlY29kaW5nIGEgbWV0aG9kIGFuZCBwb3NzaWJseSBh IG51bWVyaWMgSUQuJm5ic3A7ICZuYnNwOzxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5Tb21l IHNvcnQgb2Yg4oCYMS11c2XigJkgcHJhY3RpY2Ugc2hvdWxkIGF0IGxlYXN0IGJlIGRpc2N1c3Nl ZCB3aGlsZSBwZXJoYXBzIG5vdCByZXF1aXJlZC4gJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+U3BlY2lmaWMgbWFya3VwIHN1Z2dlc3Rpb25zOiZuYnNwOzxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5OSVRTPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyBUaGUgdmVyaWZpZXIgTVVTVCBp bnNwZWN0IGFueSBvcHRpb25hbCAmcXVvdDtwcHQmcXVvdDsgcGFyYW1ldGVyIGFwcGVhcmluZyA8 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE2LjBwdDtjb2xvcjpyZWQiPmluPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iY29sb3I6cmVkIj4gPC9zcGFuPnRoZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyBJZGVudGl0eSByZXF1ZXN0LiZuYnNwOyBJZiBubyAmcXVvdDtwcHQmcXVv dDsgcGFyYW1ldGVyIGlzIHByZXNlbnQsIHRoZW4gdGhlPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7IHZlcmlmaWVyIHByb2NlZWRzIG5vcm1hbGx5IGJlbG93LiZuYnNwOyBJZiBh ICZxdW90O3BwdCZxdW90OyBwYXJhbWV0ZXIgdmFsdWUgaXM8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsgcHJlc2VudCwgYW5kIHRoZSB2ZXJpZmllciBkb2VzIG5vdCBzdXBwb3J0 IGl0LCBpdCBNVVNUIGlnbm9yZSB0aGU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsgSWRlbnRpdHkgaGVhZGVyLiZuYnNwOyBJZiBhIHN1cHBvcnRlZCAmcXVvdDtwcHQmcXVvdDsg cGFyYW1ldGVyIHZhbHVlIGlzIHByZXNlbnQsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7IHRoZSB2ZXJpZmllciBmb2xsb3dzIHRoZSBwcm9jZWR1cmVzIGJlbG93LCBpbmNsdWRp bmcgdGhlIHZhcmlhdGlvbnM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgZGVz Y3JpYmVkIGluIFN0ZXAgNS48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGgyPjxhIG5hbWU9InNlY3Rpb24tMyI+PC9h PjxhIGhyZWY9ImZpbGU6Ly8vQzpcVXNlcnNcYWIzNzc4XERvY3VtZW50c1xJRVRGXGRyYWZ0LWll dGYtc3Rpci1yZmM0NDc0YmlzLTEwJTIwLSUyMEF1dGhlbnRpY2F0ZWQlMjBJZGVudGl0eSUyME1h bmFnZW1lbnQlMjBpbiUyMHRoZSUyMFNlc3Npb24lMjBJbml0aWF0aW9uJTIwUHJvdG9jb2wlMjAl MjhTSVAlMjkuaHRtI3NlY3Rpb24tMyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7O2NvbG9yOiM5NTRGNzIiPjM8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+LiZuYnNwOw0KIEJhY2tncm91bmQ8 L3NwYW4+PG86cD48L286cD48L2gyPg0KPHByZT5b4oCmXTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBQZXIgWzxhIGhyZWY9 Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3MzQwIiB0aXRsZT0iJnF1b3Q7U2VjdXJl IFRlbGVwaG9uZSBJZGVudGl0eSBQcm9ibGVtIFN0YXRlbWVudCBhbmQgUmVxdWlyZW1lbnRzJnF1 b3Q7Ij48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+UkZDNzM0MDwvc3Bhbj48L2E+XSwgcHJv YmxlbXMgc3VjaCBhcyByb2JvY2FsbGluZywgdm9pY2VtYWlsIGhhY2tpbmcsIGFuZDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBzd2F0dGluZyBhcmUgZW5hYmxlZCBieSBhbiBh dHRhY2tlcidzIGFiaWxpdHkgdG8gaW1wZXJzb25hdGUgc29tZW9uZTxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyBlbHNlLiZuYnNwOyBUaGUgc2VjdXJlIG9wZXJhdGlvbiBvZiBt b3N0IFNJUCBhcHBsaWNhdGlvbnMgYW5kIHNlcnZpY2VzPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7IGRlcGVuZHMgb24gPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+YXV0aGVudGlj YXRpbmcgYW5kL29yIDwvc3Bhbj5hdXRob3JpemluZyB0aGUgc291cmNlIG9mIGNvbW11bmljYXRp b25zIGFzIGl0IGlzPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHJlcHJlc2Vu dGVkIGluIGEgU0lQIHJlcXVlc3QuIDxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IFRoaXMgaWRlbnRpdHkgYXJjaGl0ZWN0dXJlIGZv ciBTSVAgPHM+ZGVwZW5kcyBvbjwvcz4gPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+aW5jbHVkZXMg cHJvdmlzaW9ucyBmb3IgPC9zcGFuPmEgbG9naWNhbDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyAmcXVvdDthdXRoZW50aWNhdGlvbiBzZXJ2aWNlJnF1b3Q7IHdoaWNoIHZhbGlk YXRlcyA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5jYWxsZXIgaWRlbnRpdHkgYXQgb3IgbmVhciBv cmlnaW5hdGlvbi4mbmJzcDsgPC9zcGFuPjxzPm91dGdvaW5nIHJlcXVlc3RzLjwvcz4mbmJzcDsg QW48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgYXV0aGVudGljYXRpb24gc2Vy dmljZSBtYXkgYmUgaW1wbGVtZW50ZWQgZWl0aGVyIGFzIHBhcnQgb2YgYSB1c2VyPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGFnZW50IG9yIGFzIGEgcHJveHkgc2VydmVyOyB0 eXBpY2FsbHksIGl0IGlzIGEgY29tcG9uZW50IG9mIGEgbmV0d29yazxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyBpbnRlcm1lZGlhcnkgbGlrZSBhIHByb3h5IHRvIHdoaWNoIG9y aWdpbmF0aW5nIHVzZXIgYWdlbnRzIHNlbmQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsgdW5zaWduZWQgcmVxdWVzdHMuJm5ic3A7IE9uY2UgdGhlIHNlbmRlciBvZiB0aGUgbWVz c2FnZSBoYXMgYmVlbjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsgVGhpcyBkb2N1bWVu dCBzcGVjaWZpZXMgYSBtZWFucyBvZiBzaGFyaW5nIGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2U8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgb2YgPHNwYW4gc3R5bGU9ImNvbG9y OnJlZCI+YXV0aGVudGljaXR5IG9mIGFuZC9vciBhdXRob3JpemF0aW9uIHRvIHVzZSA8L3NwYW4+ ZW5kLXVzZXIgU0lQIGlkZW50aXR5IGluIGFuIGludGVyZG9tYWluIG9yIGludHJhZG9tYWluIGNv bnRleHQuPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IEl0IHJlbGllcyBvbiB0 aGUgYXV0aGVudGljYXRpb24gc2VydmljZSBjb25zdHJ1Y3RpbmcgdG9rZW5zIGJhc2VkIG9uIFvi gKZdIDxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZu YnNwOyBUbyBtYXhpbWl6ZSBlbmQtdG8tZW5kIHNlY3VyaXR5LCBpdCBpcyA8c3BhbiBzdHlsZT0i Y29sb3I6cmVkIj50eXBpY2FsbHkgPC9zcGFuPjxzPm9idmlvdXNseTwvcz48bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgcHJlZmVyYWJsZSBmb3IgZW5kLXVzZXJzIHRvIGFjcXVp cmUgdGhlaXIgb3duIGNyZWRlbnRpYWxzOyBpZiB0aGV5PG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7IGRvLCB0aGVpciB1c2VyIGFnZW50cyBjYW4gYWN0IGFzIGF1dGhlbnRpY2F0 aW9uIHNlcnZpY2VzLiZuYnNwOyBIb3dldmVyLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyBmb3Igc29tZSBkZXBsb3ltZW50cywgW+KApl08bzpwPjwvbzpwPjwvcHJlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlJlZ2FyZHMsPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFsZXg8c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo4LjBwdDtmb250LWZhbWlseTomcXVvdDtHYXJhbW9uZCZxdW90OyxzZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDs8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo4LjBwdDtmb250LWZhbWlseTomcXVvdDtHYXJhbW9uZCZxdW90OyxzZXJpZjtj b2xvcjojMUY0OTdEIj5BbGV4IEJvYm90ZWs8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOm5hdnkiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCnN0aXIgbWFpbGluZyBsaXN0PGJyPg0K PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiM5NTRGNzIiPnN0aXJAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxi cj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3N0aXIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk1NEY3MiI+aHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9zdGlyPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJyPg0KPGhyPg0K PGZvbnQgZmFjZT0iQXJpYWwiIGNvbG9yPSJHcmF5IiBzaXplPSIxIj48YnI+DQpUaGlzIGUtbWFp bCBtYXkgY29udGFpbiBTcHJpbnQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gaW50ZW5kZWQgZm9y IHRoZSBzb2xlIHVzZSBvZiB0aGUgcmVjaXBpZW50KHMpLiBBbnkgdXNlIGJ5IG90aGVycyBpcyBw cm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ug Y29udGFjdCB0aGUgc2VuZGVyIGFuZCBkZWxldGUgYWxsIGNvcGllcyBvZiB0aGUgbWVzc2FnZS48 YnI+DQo8L2ZvbnQ+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_61386a070cd14ccba7099f3951e81c9fPLSWE13M08adsprintcom_-- From nobody Thu Aug 4 09:46:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32F2212D786 for ; Thu, 4 Aug 2016 09:45:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P8Bfv4lr2SyD for ; Thu, 4 Aug 2016 09:45:57 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A397A12D643 for ; Thu, 4 Aug 2016 09:45:56 -0700 (PDT) X-AuditID: c1b4fb2d-fa6bb98000000190-b0-57a37142e582 Received: from ESESSHC017.ericsson.se (Unknown_Domain [153.88.183.69]) by (Symantec Mail Security) with SMTP id 23.C5.00400.04173A75; Thu, 4 Aug 2016 18:45:54 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.142]) by ESESSHC017.ericsson.se ([153.88.183.69]) with mapi id 14.03.0301.000; Thu, 4 Aug 2016 18:45:51 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR7cVDXuJS+g/WSkeh6tAl1YoI8qA42Vqg Date: Thu, 4 Aug 2016 16:45:52 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.154] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrNLMWRmVeSWpSXmKPExsUyM2K7q65T4eJwg3MTbSx+f/rAZrF87TYm ByaPSztPsnksWfKTKYApissmJTUnsyy1SN8ugStj/2yzgqnMFXsu72VuYNzF1MXIySEhYCJx /+FKti5GLg4hgfWMEgef7GKGcBYzShxveAiU4eBgE7CQ6P6nDdIgIqAtca//FSOIzSygLvHi 0Rt2EFtYIFBi5dYVLBA1QRInX7xkh7CNJL486GUFsVkEVCTuvXgE1ssr4Cux/Pk/Johdu5kk Zi1cygyyi1PAQeLk2jCQGkYBMYnvp9YwQewSl7j1ZD7U0QISS/acZ4awRSVePv7HCmErSSy6 /RmqXkdiwe5PbBC2tsSyha+ZIfYKSpyc+YRlAqPoLCRjZyFpmYWkZRaSlgWMLKsYRYtTi4tz 042M9VKLMpOLi/Pz9PJSSzYxAqPk4JbfujsYV792PMQowMGoxMOrYLgoXIg1say4MvcQowQH s5IIr1vc4nAh3pTEyqrUovz4otKc1OJDjNIcLErivP4vFcOFBNITS1KzU1MLUotgskwcnFIN jCEHb3YHGB1b1sDwrcn/lNF07R/lqz8VNwTLfrzyzDLlcwxHRca231/2S51O3snMsVY+97/y 5bAE/6y7ipcU1nz6/6XnptU+AY8JGcJvJTxMjS/xla+KXG4uxBK2kOn0IiWNZ6W/WwQXxx/m 0rp78y375+110beya4uVr5sKeV3b2GnQtLvlphJLcUaioRZzUXEiAC/MHCmOAgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 16:45:59 -0000 Hi Dave, Since this discussion seems to be about JSON and SIP in general, perhaps it= should be moved to SIPCORE? Note that I am authoring another draft (not related to STIR), which also de= fines a signature calculated based on SIP header field information. It has = been suggested - by one of the SIPCORE chairs - to calculate and carry the = signature as a JWT :) Regards, Christer From nobody Thu Aug 4 09:59:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 442DC12DA9E for ; Thu, 4 Aug 2016 09:59:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ha_KdVA7JG9T for ; Thu, 4 Aug 2016 09:59:40 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5637512D10C for ; Thu, 4 Aug 2016 09:59:40 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u74Gxb79029350 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 4 Aug 2016 09:59:37 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470329978; bh=L1XxHCaJ1c4l25UwQTeU/QAwnA8HOuYWhnRLlYuaGu8=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=c99+tZ0HuG6aOlO81Kxvsr6qp4zstOIhceNowrypPRcZFmQhHJoySJIEIQit+zpmy 4fqD397LMERLAUXEHMgHpNgndfDBaBYMBbfRdxWyNKIKiA/QZGxqR+JWwgX1r6IVOy o0G+rgcpG/lERxzOiHrzS5bfo+BcSMS3NcmKf/Rk= To: Christer Holmberg References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <47137e29-f3ba-a4d9-2e6b-ed5ade4a6f26@dcrocker.net> Date: Thu, 4 Aug 2016 09:59:22 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 16:59:42 -0000 On 8/4/2016 9:45 AM, Christer Holmberg wrote: > Hi Dave, > > Since this discussion seems to be about JSON and SIP in general, perhaps it should be moved to SIPCORE? Christer, Gosh, I hope not. My focus is currently only on the STIR effort. The use of json/jwt has been raised, discussed, and justified solely within the STIR wg, from what I've read of the archive. So it can and should be considered within STIR. If the comments have applicability beyond STIR, that's fine but that's not my immediate concern. Feel free to copy them over if you wish, of course. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 4 10:03:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CC6712DAAD for ; Thu, 4 Aug 2016 10:03:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uq0XZ2ki1XEz for ; Thu, 4 Aug 2016 10:03:06 -0700 (PDT) Received: from resqmta-ch2-03v.sys.comcast.net (resqmta-ch2-03v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DF7212DA91 for ; Thu, 4 Aug 2016 10:03:06 -0700 (PDT) Received: from resomta-ch2-06v.sys.comcast.net ([69.252.207.102]) by resqmta-ch2-03v.sys.comcast.net with SMTP id VM1AbG6rz8GkCVM2zblvP5; Thu, 04 Aug 2016 17:03:05 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VM2ybVD5aMJgPVM2zbc4oQ; Thu, 04 Aug 2016 17:03:05 +0000 To: stir@ietf.org References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> From: Paul Kyzivat Message-ID: <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> Date: Thu, 4 Aug 2016 13:03:04 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfGP+zA+tDYi9n1aZWqItT5B4P+DEzSR8Te1cKTE087ntgs2RbGL7eMhWNJbjqYmbNKBgYUKU9oiEXm3TCZWyJ07ZWmjlSHc9A2+eW2ogpkN/Vnfu5cn+ cs6gVaxLMu0temkjs4LU7CyCsnYLWBrGVv5n/QED8O6gnLPEtsXqw6lc5YNqn52l9NHHNevHTrSF4g== Archived-At: Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 17:03:07 -0000 On 8/4/16 12:45 PM, Christer Holmberg wrote: > Hi Dave, > > Since this discussion seems to be about JSON and SIP in general, perhaps it should be moved to SIPCORE? > > Note that I am authoring another draft (not related to STIR), which also defines a signature calculated based on SIP header field information. It has been suggested - by one of the SIPCORE chairs - to calculate and carry the signature as a JWT :) I have been loosely following this discussion. IIUC, one of Dave's arguments is that SIP implementations don't currently involve JSON, so introducing it with STIR will further complicate those implementations. But, again IIUC, the use of JSON with passport doesn't require anyone to *parse* JSON. It is only necessary to *generate* a very special purpose JSON and then generate a signature over it. If I'm right about that, the use of JSON will be no particular burden. It doesn't require a JSON "stack". Generating it is hardly more complicated than what it replaced: generating a string that is a concatenation of a number of bits of data separated by colons. I don't see what the problem is. Thanks, Paul From nobody Thu Aug 4 10:24:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F14AB12D0CE for ; Thu, 4 Aug 2016 10:24:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vG_gJri438M5 for ; Thu, 4 Aug 2016 10:24:11 -0700 (PDT) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDA2C12D099 for ; Thu, 4 Aug 2016 10:24:10 -0700 (PDT) Received: by mail-qk0-x22a.google.com with SMTP id p186so111394006qkd.1 for ; Thu, 04 Aug 2016 10:24:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=79fwGXw9WJ0W3pIdNXl37zaNJWu1tlrEyf5WFT5dSPg=; b=aHWBhuc0O8rLffROsLoMiZ760BFiYEN3j0UeQtNdB6+I2pGo+4fwjo+g4DDB8XoQkp wOG2+IxfRwE+kBtl15Kq22pKAS+LVLm3qfrJcgxoavKS4iNXuSI8OlICId7mIXnSI0SK iT376BX1Cz1mpSI4+PnHs0cha8TkFBUO59siHsHom613xFHgqMB1/+Qwswum21UsEjNq EQgbUsXjzuitUuJjrQx9lNtUufrVxpBywF/kJbSXt+GZuPemYpVOIAN+dxcSDs91n9f/ tIH36St7jUQ0d1tWIPFzKO/OyC7q4ZQ3RgXYcVZ78aIzRgRjo4Vdlj7S/vr3wZDswJMs XLkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=79fwGXw9WJ0W3pIdNXl37zaNJWu1tlrEyf5WFT5dSPg=; b=Gp6r1/PMRhQ+ZWGKOCEWskDIhe8xFrPCInjJMW6aZgc5odrleVbNG7v847+EI5iNuf soQivprIy1sMde+tZwNF/5qtPDWIfzBwkeCOjkyC8l7e8smudFQC5PgtBy1zzdI0bpmI XFIeFg9ZIJz+Qxzr/XKw4NA5NAG8zFU+G0t0to11jgk1/3i0ju+JxDCU62cKiK65w4XS +qTJCG/SxzpLj9AyfgoixT2OZZNbvGyai2dfDepxamZavRBGMOQ0NzowYsKx3ez4Fl/X dr48ih/bGQ7xE6IccduD02s9nBURi7QqEDZAWW+6l4PQn/+Nh7feG+Z9AE4nIMBp1qug d9iA== X-Gm-Message-State: AEkoouuiekOBc2PjuH1s2cWXobuH3PW7JY5ixKkrwmWqj5I3FI3C3svhXLUxKU0kZcy1bw== X-Received: by 10.55.68.81 with SMTP id r78mr7371154qka.55.1470331449843; Thu, 04 Aug 2016 10:24:09 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id i65sm7402123qtb.18.2016.08.04.10.24.08 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 10:24:08 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_F78E9B75-5F48-4F17-B9D0-1F1FC40EF8B2" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> Date: Thu, 4 Aug 2016 13:24:06 -0400 Message-Id: <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 17:24:16 -0000 --Apple-Mail=_F78E9B75-5F48-4F17-B9D0-1F1FC40EF8B2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 First of all, we would want the PBX to generate the signature, but the = service provider can do that. It should not add a valid signature to a = call from a number it did not assign to the trunk group connecting to = the PBX, although it could support the extra delegation required to = support =E2=80=9Cauthorized spoofing=E2=80=9D. The companion devices = I=E2=80=99m aware of always send calls from the same service provider = and should not present any issue.=20 Everyone will have to do work they don=E2=80=99t do now to implement = stop spoofed calls. TANSTAAFL Brian > On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] = wrote: >=20 > Fraud from compromised PBXes is common. And even where a PBX is not = compromised, a carrier has no practical way of knowing whether the = calling number is properly assigned and valid from the perspective of = the Enterprise. Therefore, checking whether the calling number was from = an assigned range might be possible (and fraught with administrative = challenges), but of limited value. And in the consumer market, there = are calling products which support a parent subscriber number and = =E2=80=9Ccompanion=E2=80=9D devices (e.g., tablets) which can place a = call using the MDN of the parent subscriber. These are examples of = where the authenticity of the calling number won=E2=80=99t necessarily = mean the same thing as the authenticity of a call from a single = subscriber with a single MDN regardless of =E2=80=9Claxity=E2=80=9D of = spoof checking. > =20 > In another forum and anticipating calling number authentication = mandates from Congress and/or FCC, I suggested using carrier-specific = certs and encoding specificity of authenticity, and calling number. = This provides the identity of the originating carrier, some idea as to = the accuracy or specificity of the calling number, and validty of the = calling number (assuming nonce and replay issues can be addressed as = reasonably suggested below by Alex). > =20 > The representation of orig-carrier and trustworthiness could be as = follows: > =20 > Regulated/mandated Carrier Class Use Case: > =20 > 00 - No Credentials > Use case example(s): Pre-IMS, legacy circuit-switched networks that = don't natively support SIP or which don't choose to sign calls. E.g., = international carriers. > Trust Estimate: Good luck. Carrier_orig and CgPN entirely = untrustworthy. > =20 > 01 - Carrier signed, no authentication of CgPN > Use case example(s): E911 on visited network w/o roaming agreement, = manual roaming. > Trust Estimate: Carrier_orig trustworthy, CgPN entirely untrustworthy > =20 > 10 - Carrier signed, semi-authenticated CgPN > Use case example(s): Number block delegated from OCN, but no per-TN = screen (SIP trunks). > Trust Estimate: Carrier_orig trustworthy, CgPN less than most = trustworthy but not entirely untrustworthy. > =20 > 11 - Carrier signed, authenticated CgPN > Use case example(s): Bread-and-butter 95%+ of calls from subscriber = lines (IMS-based and otherwise). > Trust Estimate: Carrier_orig trustworthy, CgPN most trustworthy > =20 > Public Use Case: > =20 > Undefined but assumed to use public or commercially available = authentication services resources. e.g., nomorobo-like crowd-sourced = accept/deny lists, et cetera. Could/would pass credentials down to = SIP-aware devices which would process them according to the rules of the = Public Class application(s). > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net]=20 > Sent: August 04, 2016 9:02 AM > To: Alex Bobotek > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > There are reasonable circumstances where a party placing a call is not = the authorized entity assigned the telephone number used in From/PAI, = and in such circumstances the service provider servicing the entity = placing the call may or may not be the same as the service provider = serving the entity that is assigned the TN. In all such cases, the = entity that is assigned the TN explicitly authorizes calls placed using = it=E2=80=99s TN. The design accommodates such use cases. It=E2=80=99s = not a blanket authorization without authentication. We=E2=80=99re not = aware of any cases where there is an actual requirement for legitimate = calling without explicit authorization from the assigned entity, = although we certainly are aware that various parts of various service = providers don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more. > =20 > Brian > =20 > On Aug 3, 2016, at 8:35 AM, Alex Bobotek > wrote: > =20 > 1. Permit authorization without authentication > In the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided identity. = Are there legitimate use cases for this? Has anyone established that = there are not? How can the industry reasonably expect to end this = (often bad) practice? If it can=E2=80=99t be ended, there=E2=80=99s = value in at least identifying the originating service provider (i.e., = the signer/authorizer). Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the abuser. = Based on the assumption that it=E2=80=99s better to ID service providers = than unreasonably expect a ban of the use of unauthenticated (and = therefore unsigned) SIP requests, STIR signing should support = authorization without authentication. The practice of authorizing = unauthenticated use exists, and there is benefit to signing in these = cases (service provider identification). The language of the ID should = permit this use. 4474bis-10 should NOT require or assume that that = authentication will precede authorization. Of course there may be other = use cases where signing includes authentication and may not include a = specific service provider=E2=80=99s authorization. > =20 > =20 > 2. Improve replay prevention > Proximate replay is possible while complying with this spec. First, = one or more proximate (e.g., within 60 seconds) SIP requests using the = same token are legal and subject to replay in many cases. An SDP = body=E2=80=99s mky may not be present and if present its use is = optional. Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) = could prevent replay. Different methods (e.g., INVITE vs MESSAGE) might = be handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured request. This = might include an mkey from a captured INVITE. So it may be possible to = DOS, spam or text-bomb a recipient using a captured identity. While = large-scale or distributed implementations may make the enforcement = difficult, there is little cost to signing and decoding a method and = possibly a numeric ID. Some sort of =E2=80=981-use=E2=80=99 practice = should at least be discussed while perhaps not required. =20 > =20 > =20 > Specific markup suggestions: =20 > =20 > =20 > NITS > =20 > The verifier MUST inspect any optional "ppt" parameter appearing in = the > Identity request. If no "ppt" parameter is present, then the > verifier proceeds normally below. If a "ppt" parameter value is > present, and the verifier does not support it, it MUST ignore the > Identity header. If a supported "ppt" parameter value is present, > the verifier follows the procedures below, including the variations > described in Step 5. > =20 > <>3 = . Background >=20 > [=E2=80=A6] > =20 > Per [RFC7340 ], problems such = as robocalling, voicemail hacking, and > swatting are enabled by an attacker's ability to impersonate = someone > else. The secure operation of most SIP applications and services > depends on authenticating and/or authorizing the source of = communications as it is > represented in a SIP request.=20 > =20 > This identity architecture for SIP depends on includes provisions = for a logical > "authentication service" which validates caller identity at or near = origination. outgoing requests. An > authentication service may be implemented either as part of a user > agent or as a proxy server; typically, it is a component of a = network > intermediary like a proxy to which originating user agents send > unsigned requests. Once the sender of the message has been > =20 > =20 > This document specifies a means of sharing a cryptographic = assurance > of authenticity of and/or authorization to use end-user SIP = identity in an interdomain or intradomain context. > It relies on the authentication service constructing tokens based = on [=E2=80=A6]=20 > =20 > =20 > =20 > To maximize end-to-end security, it is typically obviously > preferable for end-users to acquire their own credentials; if they > do, their user agents can act as authentication services. However, > for some deployments, [=E2=80=A6] > =20 > =20 > Regards, > =20 > Alex=20 > =20 > Alex Bobotek > =20 > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 >=20 >=20 > This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. --Apple-Mail=_F78E9B75-5F48-4F17-B9D0-1F1FC40EF8B2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 First of all, we would want the PBX to generate the = signature, but the service provider can do that.  It should not add = a valid signature to a call from a number it did not assign to the trunk = group connecting to the PBX, although it could support the extra = delegation required to support =E2=80=9Cauthorized spoofing=E2=80=9D. =  The companion devices I=E2=80=99m aware of always send calls from = the same service provider and should not present any issue. 

Everyone will have to do = work they don=E2=80=99t do now to implement stop spoofed calls. = TANSTAAFL

Brian

On Aug 4, 2016, at 12:41 PM, = Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

Fraud from compromised PBXes is common.  And = even where a PBX is not compromised, a carrier has no practical way of = knowing whether the calling number is properly assigned and valid from = the perspective of the Enterprise.  Therefore, checking whether the = calling number was from an assigned range might be possible (and fraught = with administrative challenges), but of limited value.  And in the = consumer market, there are calling products which support a parent = subscriber number and =E2=80=9Ccompanion=E2=80=9D devices (e.g., = tablets) which can place a call using the MDN of the parent = subscriber.  These are examples of where the authenticity of the = calling number won=E2=80=99t necessarily mean the same thing as the = authenticity of a call from a single subscriber with a single MDN = regardless of =E2=80=9Claxity=E2=80=9D of spoof checking.
 
In = another forum and anticipating calling number authentication mandates = from Congress and/or FCC, I suggested using carrier-specific certs and = encoding specificity of authenticity, and calling number.  This = provides the identity of the originating carrier, some idea as to the = accuracy or specificity of the calling number, and validty of the = calling number (assuming nonce and replay issues can be addressed as = reasonably suggested below by Alex).
 
The = representation of orig-carrier and trustworthiness could be as = follows:
 
Regulated/mandated Carrier Class Use Case:
 
00 - No Credentials
Use case = example(s): Pre-IMS, legacy circuit-switched networks that don't = natively support SIP or which don't choose to sign calls.  E.g., = international carriers.
Trust Estimate:  Good luck.  = Carrier_orig and CgPN entirely untrustworthy.
 
01 - Carrier signed, no authentication of CgPN
Use case = example(s): E911 on visited network w/o roaming agreement, manual = roaming.
Trust Estimate:  Carrier_orig trustworthy, CgPN entirely = untrustworthy
 
10 - Carrier signed, semi-authenticated = CgPN
Use case example(s): Number block delegated from OCN, but no = per-TN screen (SIP trunks).
Trust Estimate:  Carrier_orig = trustworthy, CgPN less than most trustworthy but not entirely = untrustworthy.
 
11 - Carrier signed, authenticated CgPN
Use case = example(s): Bread-and-butter 95%+ of calls from subscriber lines = (IMS-based and otherwise).
Trust Estimate:  Carrier_orig = trustworthy, CgPN most trustworthy
 
Public Use Case:
 
Undefined but assumed to use public or commercially available = authentication services resources.  e.g., nomorobo-like = crowd-sourced accept/deny lists, et cetera.  Could/would pass = credentials down to SIP-aware devices which would process them according = to the rules of the Public Class application(s).
 
Pierce
 
From: Brian = Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 9:02 AM
To: Alex Bobotek <alex@bobotek.net>
Cc: stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
There are reasonable circumstances where = a party placing a call is not the authorized entity assigned the = telephone number used in From/PAI, and in such circumstances the service = provider servicing the entity placing the call may or may not be the = same as the service provider serving the entity that is assigned the TN. =  In all such cases, the entity that is assigned the TN explicitly = authorizes calls placed using it=E2=80=99s TN.  The design = accommodates such use cases.  It=E2=80=99s not a blanket = authorization without authentication.   We=E2=80=99re not aware of = any cases where there is an actual requirement for legitimate calling = without explicit authorization from the assigned entity, although we = certainly are aware that various parts of various service providers = don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more.
 
Brian
 
On = Aug 3, 2016, at 8:35 AM, Alex Bobotek <alex@bobotek.net> = wrote:
 
1.       Permit authorization without authentication
In= the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided = identity.  Are there legitimate use cases for this?  Has = anyone established that there are not?  How can the industry = reasonably expect to end this (often bad) practice?  If it = can=E2=80=99t be ended, there=E2=80=99s value in at least identifying = the originating service provider (i.e., the = signer/authorizer).  Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the = abuser.  Based on the assumption that it=E2=80=99s better to ID = service providers than unreasonably expect a ban of the use of = unauthenticated (and therefore unsigned) SIP requests, STIR signing = should support authorization without authentication.  The practice = of authorizing unauthenticated use exists, and there is benefit to = signing in these cases (service provider identification).  The = language of the ID should permit this use.  4474bis-10 should NOT = require or assume that  that authentication will precede = authorization. Of course there may be other use cases where signing = includes authentication and may not include a specific service = provider=E2=80=99s authorization.
 
 
2.       Improve replay prevention
Proximate replay is possible while complying with this spec.  First, one = or more proximate (e.g., within 60 seconds) SIP requests using the same = token are legal and subject to replay in many cases.  An SDP = body=E2=80=99s mky may not be present and if present its use is = optional.  Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) could prevent = replay.  Different methods (e.g., INVITE vs MESSAGE) might be = handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured = request. This might include an mkey from a captured = INVITE.   So it may be possible to DOS, spam or text-bomb a = recipient using a captured identity.  While large-scale or = distributed implementations may make the enforcement difficult, there is = little cost to signing and decoding a method and possibly a numeric = ID.   Some = sort of =E2=80=981-use=E2=80=99 practice should at least be discussed = while perhaps not required.  
 
 
Specific markup = suggestions:  
 
 
NITS
 
   The verifier MUST inspect any optional "ppt" =
parameter appearing in =
the
   Identity request.  If no "ppt" parameter is =
present, then the
   verifier proceeds normally below.  If a =
"ppt" parameter value is
   present, and the verifier does not support it, =
it MUST ignore the
   Identity header.  If a supported "ppt" =
parameter value is present,
   the verifier follows the =
procedures below, including the variations
   described in Step 5.
 

3.  = Background

[=E2=80=A6]
 
   Per [RFC7340], =
problems such as robocalling, voicemail hacking, and
   =
swatting are enabled by an attacker's ability to impersonate someone
   =
else.  The secure operation of most SIP applications and =
services
   depends on authenticating and/or authorizing the source of =
communications as it is
   represented in a SIP request.
 
   This identity architecture for SIP depends on includes =
provisions for a logical
   "authentication service" which =
validates caller identity at or =
near origination.  outgoing =
requests.  An
   authentication service may be implemented either =
as part of a user
   agent or as a proxy server; typically, it is a =
component of a network
   intermediary like a proxy to which originating =
user agents send
   unsigned requests.  Once the sender of the =
message has been
 
 
   This document specifies a means of sharing a =
cryptographic assurance
   of authenticity of and/or authorization to use end-user =
SIP identity in an interdomain or intradomain context.
   It =
relies on the authentication service constructing tokens based on [=E2=80=A6=
]
 
 
 
   To maximize end-to-end security, it is typically obviously
   preferable for end-users to acquire their own =
credentials; if they
   do, their user agents can act as authentication =
services.  However,
   for some deployments, [=E2=80=A6]
 
 
Regards,
 
Alex 
 
Alex = Bobotek
 
 
_______________________________________________stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 


This e-mail may contain Sprint proprietary information = intended for the sole use of the recipient(s). Any use by others is = prohibited. If you are not the intended recipient, please contact the = sender and delete all copies of the = message.

= --Apple-Mail=_F78E9B75-5F48-4F17-B9D0-1F1FC40EF8B2-- From nobody Thu Aug 4 11:22:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91C5212B019 for ; Thu, 4 Aug 2016 11:22:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uqcUI93aw-UR for ; Thu, 4 Aug 2016 11:22:38 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0112.outbound.protection.outlook.com [104.47.34.112]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DE9812D798 for ; Thu, 4 Aug 2016 11:22:38 -0700 (PDT) Received: from BN1AFFO11FD034.protection.gbl (10.58.52.33) by BN1AFFO11HUB032.protection.gbl (10.58.52.142) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.5; Thu, 4 Aug 2016 18:22:36 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BN1AFFO11FD034.mail.protection.outlook.com (10.58.52.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Thu, 4 Aug 2016 18:22:36 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u74IGbxj022909; Thu, 4 Aug 2016 14:22:36 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24gns3qesp-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 04 Aug 2016 14:22:36 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 4 Aug 2016 13:22:34 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Thu, 4 Aug 2016 13:22:34 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA490iQgABp2QD//7d2kA== Date: Thu, 4 Aug 2016 18:22:33 +0000 Message-ID: <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> In-Reply-To: <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: multipart/alternative; boundary="_000_595a825401b04d198dfc137546fba535PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(377454003)(199003)(24454002)(189002)(4326007)(50986999)(86362001)(106466001)(19625215002)(790700001)(16236675004)(6116002)(24736003)(2906002)(4546004)(102836003)(84326002)(108616004)(106116001)(19580405001)(3846002)(15975445007)(356003)(586003)(189998001)(2950100001)(92566002)(19580395003)(76176999)(68736007)(5250100002)(2900100001)(54356999)(19617315012)(19300405004)(7736002)(8936002)(97736004)(93886004)(8676002)(7906003)(81156014)(11100500001)(81166006)(30436002)(87936001)(33646002)(512874002)(7846002)(7696003)(110136002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB032; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD034; 1:z5mxvJaQ9q8BeWQGPjW/WbUQD1fBRlhjlnk6RGSjdBQiFmg6gqtdJSmvTVnImsL7+QQMot9MSNo5Zm6myBne2XxOTw2xQakQu6XkZ4+pJWEwMEweir6hFWyoZE7b+e/rDQoC2udoNq9fEVtwrwV+1s+RwJnyFecIMfLOiqltOVmQOjAnw6xiiZ8D2EW03tC0ZFB8sZdMDbYCS2e8m4Nr5mqCG4xSkr9SKjtr1laZ9f5yfKhz3qow8sR66OdXB6cGalQo4Dxg93jz4NepX8/9jc8X9vXZ3y9QEVmfTjAlkrxGDtTEKCG52UFMd6UWieQPrTdamKFkQXn8Q3bqja06bF3n9BMLcjNwOV0HFj6jv7KsX/1094s1NA4WX6bmJHMtCJ+zuzGibBPC5XMEY4PGi62YMfw5EsguNWW1RyAcS4B1wAm+/U6RLpo6wioH2xcHNl+kpsf/nvUkHzoriXO8GzrLAXq7okWyFP6mer3WJwXZ+ocdHvshxOIiy/pssQnUlaNSQt6SGiCNYbQKc01HPyb0wd7NeKdvAzTkGdf3XmqTrGvHZ/hHlsr4Wkt6IArF X-MS-Office365-Filtering-Correlation-Id: 6b6536c0-3d44-402f-1962-08d3bc944f86 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB032; 2:6zpGJ1tO3OkyjYKck0UDVVe4TajMrMNoUXke+n256Issy/3ORuAnVoEUWyYOZsV95fQpzV7+mZDmn3wgOrWE5QG3mLz6N2AUy2etr0NKhXvzd1PK2uGx3CQuawWbXieGeF2p+cZi59L1mhGiKpa1Ih/XI026OxRcUUvMbiq/e7LzVXLWVYU1ggqT7cNGTcwU; 3:9SxdRaGZlh30PdaqaTgQKCq++40nteNyzCooEA0lBuzSfnH+rex3IYcfbCuwLuBmHApKl3TX/vAYZBQ3L11P60XIDEbUD2J8/auOhKwlBLLFIIc7VbErstXJx2+J6FwBjErh1EgKUiC5e/kP/ZTS2bHwci+jzaO3mBRsqJVgqp5upr9TPJII61BDd64qJmO+c1Eqe+eEN2XdUrU2Fz1QFeA/AzrsbwJ62pcmL09yqXW0DccC+/gjukWas6QKtaHvCY9eABgEnwd/uIBtQfokuA==; 25:fLlbHivfr8bGXEZoZ83eJBB2/Ov8Ls8uKbYcbLSXdrtcfaUk1TRgQ+uLBjOj7a2MxEgOTy2de8DSfKgvetRctEJ5U/cIt46AVcw5kzGcJZrtMuIxCTyo+wz/medjCzqmr/NA5fvFrG6b6h8CJ2tuGh76MNsQhw8rNoFkAyorc9y7Gosx9fKCAAYEcFiw+yj+QPdaQURg5y080q4ogCcmaD2OUo+t2L0c+8Z7yXKE/nYY5GGH4/Rwzz4g2XOfBUtuqWLr+IUJjqoC/ul8d67RUDmn+OHgg6wPcXyo9K8sW6OhHqEDGQCd2r0nT/Z3MtjU05WGDJsWJp2VTGRdFW57na+plxjzrFfBisUxQf6JkBAy+VfkC6vGHpsNPvjScL37DX67oeXLhGeSdIn8Uo2X5qXKyhwkjmzOYFcRl9p7SLi3EhlDKWi4gWmjO2EQ8cRF X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB032; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB032; 31:DYBo1iKftzxBEV0772K/ratBQRcu5SodH0WWutJE9P9iRM/gNYVmUVSN7LThwIKlBD7mLS/C1es8K+FcmM3THuWcU3KDWHUdhfeCU3qpPCwXlDkTl5LiCAM3xhtNV1cca5d4UJ1JhMH3rzlZJ8rUeB2vdWhW/wdGEYMzrYv7Yso9xxh2BqDX6YgGy/VpVcHGafSXyoEW9Z+LGSfKqkXd2LvfKblEPDKbedTybf+Q/GM=; 20:22KOSa3MGyOWDQCY/gMhfbjjp/6BcH/yhflAWJhMKGoLvnZcDRXMq/8bAFxnCW79KEERzhJ5e6fzMTnjcXxkaaw0+ZlWbSnrIyo0WPkyxL+2o/4LPBmrwJios8XM0GkitjFvp2mcqLy2GT0UMLTVZxgVEpYadk1UJjDq0ehvh96apicxj0w8tvJwF9Jhe5RItUBjnQKrsq9uCJyOv8N7UmXApqiod0Cw2hlON5+MgJrCdgpFRURqRl7TLXA11Q2DNWHWdJAl/lc8m07rGDHF58GnpH5SVsW/lv0syfrgK3nxzG/j6s9TbNcK1mwSYypBwQ2zjP2fbuAVuiddO8/mHApNrmvGFoVB9Dmj2KsOKS1HPFoGjY/NbhgxJS3ax55CnLwL1XxA8EVGimAs/DTKae0toKl091aVKqlxPGUEI+c= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(278428928389397)(192374486261705)(18430343700868)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(13024025)(5005006)(13023025)(8121501046)(13015025)(13017025)(13018025)(3002001)(10201501046)(6055026); SRVR:BN1AFFO11HUB032; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB032; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB032; 4:CFIPmxEtV/TAvsJ9QhPfr/VW8EnLbXThO6smvlmZRFy3pCMfkniLHUFUvnMuWVOKyEkOZmpYekieZ76voWRVNE8tYPvt+pONn913jXY8MPkEtDmY3trDCPgbUIhiAe/Uay6tqbps6xjCCGK5dojHiKOoeegzW42bHmWjwuYbNSckpKZajbTps+69pksmEQLX6uCBkfjJqpcyhTr2NKjHk92UsjVKHDX/EXe9YJkNIr9Lpy9XRCYgqps/iIYu5/TvCgU4rZZtgEjO31MNEj500t4n1THSZcjOoE6NjO9PSLS31iIen9gVaxRnj0nsp0lQoef5d98tmvpuZ9BwTL0lgkYIKfJAH1by8ZfSJzB9NBU0ckuqOx6bnyj8OoVkbI0R/pqi6YHxas4+99wKNSD+cU55QVF+6/9oRqMKWc4lh3r0Vh1cER+TALVE0KPTswEzCbinQftdVTkkL3KY9HbrK2571CvDUxYoUgO/EkzYq5+0MsnQs/k2twoJN0I5jQwv7+Uebe3ecAPO9HceUbepuU0cAKn7yoimSQHG0Wlv5ccp8JbBfXihnoXGd6qtDe+GzdjsQ7R/jHld8uW1gkM+kQu0jaBPltyVebkXlLe4LUBfDwqYN3VuSTREg7EXY5+9F3GUUBOtl7x48Le9VqFASFMAC5HAeUGwVhqc8s9hk8s= X-Forefront-PRVS: 00246AB517 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB032; 23:70bLbC2dfWy0GJkYqQJysg1P58mlQTOOvRs9Br2?= =?us-ascii?Q?El388dYQeowD9qDv4w+9FU8cB/TA0D0MvvVIiQZYygUFHbH4RvZ3yoMRM40n?= =?us-ascii?Q?TlFgBHJlFIspYsmdql/V30pNrfsUR8g9K0vMQNfRCeHE4nqy81aaeW5lZKL8?= =?us-ascii?Q?GWrLiS90GKo2ZYzhM11nfaZMDC+xm72i9G2O8fSQcuTqbOuIsqXJZdX59yfJ?= =?us-ascii?Q?OwVcEjqkr9pnO5cOJreA+5PKH2TJ2l6WfQZo70bLNf/hQHiXzIlcHnCh2BW2?= =?us-ascii?Q?7CShp99ENBaTg6fOTojtHwm0PDy+wbq5TznqFPEaIXi4uqqbLzxtwhDprPba?= =?us-ascii?Q?2tpjyERVATk67J8BHqb7ASPs5JNl7Z8f0o4UwOIj2paKT190zuENLG7Iok5P?= =?us-ascii?Q?411o9HZvpqgIGZ1FsIIzgRNpNRx5PRiy6fql+BjGdTjgKGvr86IcvMKzWkcf?= =?us-ascii?Q?Tfljjtsbvf54GL2HWcBZ2QEpNT3/WV+r/oM+jXO8I3ypPNOjs2jMS6F7Q6+C?= =?us-ascii?Q?QLItpRSZAoWBbA+46Ntx4WMVhyhXuthQaAz5cEqn2N1tKgXOBQccaMnfewvK?= =?us-ascii?Q?oDqQQUWkEuPFDltqiEw7czlYWaoM3+ZK0ez1/JFK/M2issi5pf5a6QotqT1D?= =?us-ascii?Q?r+BL+qA4Nt9EVxiJB7ndUAGFgJYTNguJBO0hl5UWzRaSm1e0nKzKx9Q6V4l2?= =?us-ascii?Q?e1TMxRcLNt821+DB5bLbnY1QGeTdLeZDuwtqOY0vkgie2DeXYymcRiXW/LdK?= =?us-ascii?Q?OP2JIQRFDXSPK/8tFMWRB+lGNzFxNShQnBk8PhPBPy5jzPPsqm8kkY3I1BM1?= =?us-ascii?Q?cMkZqlgS2Mf+0ilca3OxHuTuTUFb9T94gLOeTIxMQEkhh5UxP3PLDXsWhXaD?= =?us-ascii?Q?fym+EuxbhC/qDZKa1HNROkenhBcqIN/5uaRBgvbIlKXoYH3Kya3sODgPUXeo?= =?us-ascii?Q?ZqE5Z/F1kEGqODETAwCrukEYnMf11O2IMhOJg1nPXejS5pw5jUxr8CdPEFaE?= =?us-ascii?Q?4wnUWwG8wz1V91SU+iwlXVmawMfiVcrtja6y3jP6RGDEmz48lYxwjRPOymrB?= =?us-ascii?Q?oImZ0qzFJBBN2hCFZPKkRnTykUzID9vJgwaFzS/beU/yhHiH9i9qy8+NpFDt?= =?us-ascii?Q?h4odFyqIjNt3oFoDWJ5PXabAJFt6+RrUPu8Z3dlb0Z9fCCNbDdxR8PehnBm5?= =?us-ascii?Q?+hG2eCzvrqZS2kBRR8JhJX5WnYd84P6ilhd5IYdNbgffLQkj82Not04RLmaW?= =?us-ascii?Q?OGqT56RoeLLh5voKFjGA2rJiiUJrvO2YPSIDheRTHYNM56nONfbXAH7FPwtm?= =?us-ascii?Q?ukD7xO1IBxgu22qHAJ2Kv8EJpRIkptOMXT+2RuEWkjROt?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB032; 6:S8DMw4L0zL4wq3v10aqZ9S0rDYBRiz4VoBImJX3ROWfGoLr/+D8W2YbDTtR9yQzdmecz5jBVSzz0VlR6NV0bMysmFyuBKQ7xewMlNARwS+URXhmBaTpkhuHs/PqyXBkisA9BQvu8ahnWtBbQDmeuWtDzrsJF+lETmpCS1OFELyXjXjI2kPDFfzLik/g8dsvTgzfcveHCKLUMedMR0aqCeVxsc6rtYUYVi/vu2Vlob80tuljIx0mM3QMe+Q3qWkQ+wHsOElMgSVW85aCy+Z93HFFZ3LCORx5AN9qhljTjEoWqs7lQLycCjhndXtjnw4kEXDGpWX6MR5+EWgK/TpFvFA==; 5:k13E0OK2UaEoomK80eRpDM0y4IOwifU78PbsbBWLGxRyLgwGvwbCqEGDEq3gGf9dI9ghgyLb5o8LM0jd7qfdRTi82Dec9O++gSoHuLzvDosMhChoBZhotcEW8kpZcIr61xsSfPsD+wHu/B4RoYneLw==; 24:N8KaiRwrP5sLGcLhBTvYVstoile+O2T1UWMb/GEgX0FxfuM09Io7WMJz0JG7vIzoui+6bSimC7Zb4TOmvbclq8ZTVR2o8FXLz7rET2dUMk0=; 7:jESZGGq49nxQxS4yH9/bqR/QBCxsaHyWH30+2IfzYtlAop1HNHcth6YmW9tFmCnITcveY3NDNhXYcoBBUEo5U/tJ6OYI4W5aommHig7jFvFWCaupfpTwrL5n31Xer8AZthwrbMWzmlRnkByJGcp1m0OF0MLbfbB2K+A4fYBOPjT3QcutKP43eKch45Q4UofgCoo1+0UNYwrU7tiNPZ1C/MhNtWF0cjF6D9DggWtYTGD9R68GiPuBZyBWwofiB4C+ SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2016 18:22:36.3961 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB032 Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 18:22:42 -0000 --_000_595a825401b04d198dfc137546fba535PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WW91IHdhbnQgSVAgUEJYZXMgdG8gc2lnbiBjYWxscz8gIFdvbuKAmXQgdGhhdCBtYWtlIGl0IGV4 dHJhb3JkaW5hcmlseSBlYXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRoIGF1dGhlbnRpY2F0ZWQgbnVt YmVycz8NCg0KDQpGcm9tOiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0K U2VudDogQXVndXN0IDA0LCAyMDE2IDEyOjI0IFBNDQpUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RP XSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KQ2M6IEFsZXggQm9ib3RlayA8YWxleEBib2Jv dGVrLm5ldD47IHN0aXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0Ymlz LTEwIGNvbW1lbnRzDQoNCkZpcnN0IG9mIGFsbCwgd2Ugd291bGQgd2FudCB0aGUgUEJYIHRvIGdl bmVyYXRlIHRoZSBzaWduYXR1cmUsIGJ1dCB0aGUgc2VydmljZSBwcm92aWRlciBjYW4gZG8gdGhh dC4gIEl0IHNob3VsZCBub3QgYWRkIGEgdmFsaWQgc2lnbmF0dXJlIHRvIGEgY2FsbCBmcm9tIGEg bnVtYmVyIGl0IGRpZCBub3QgYXNzaWduIHRvIHRoZSB0cnVuayBncm91cCBjb25uZWN0aW5nIHRv IHRoZSBQQlgsIGFsdGhvdWdoIGl0IGNvdWxkIHN1cHBvcnQgdGhlIGV4dHJhIGRlbGVnYXRpb24g cmVxdWlyZWQgdG8gc3VwcG9ydCDigJxhdXRob3JpemVkIHNwb29maW5n4oCdLiAgVGhlIGNvbXBh bmlvbiBkZXZpY2VzIEnigJltIGF3YXJlIG9mIGFsd2F5cyBzZW5kIGNhbGxzIGZyb20gdGhlIHNh bWUgc2VydmljZSBwcm92aWRlciBhbmQgc2hvdWxkIG5vdCBwcmVzZW50IGFueSBpc3N1ZS4NCg0K RXZlcnlvbmUgd2lsbCBoYXZlIHRvIGRvIHdvcmsgdGhleSBkb27igJl0IGRvIG5vdyB0byBpbXBs ZW1lbnQgc3RvcCBzcG9vZmVkIGNhbGxzLiBUQU5TVEFBRkwNCg0KQnJpYW4NCg0KT24gQXVnIDQs IDIwMTYsIGF0IDEyOjQxIFBNLCBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFu QHNwcmludC5jb208bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+IHdyb3RlOg0KDQpG cmF1ZCBmcm9tIGNvbXByb21pc2VkIFBCWGVzIGlzIGNvbW1vbi4gIEFuZCBldmVuIHdoZXJlIGEg UEJYIGlzIG5vdCBjb21wcm9taXNlZCwgYSBjYXJyaWVyIGhhcyBubyBwcmFjdGljYWwgd2F5IG9m IGtub3dpbmcgd2hldGhlciB0aGUgY2FsbGluZyBudW1iZXIgaXMgcHJvcGVybHkgYXNzaWduZWQg YW5kIHZhbGlkIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHRoZSBFbnRlcnByaXNlLiAgVGhlcmVm b3JlLCBjaGVja2luZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciB3YXMgZnJvbSBhbiBhc3Np Z25lZCByYW5nZSBtaWdodCBiZSBwb3NzaWJsZSAoYW5kIGZyYXVnaHQgd2l0aCBhZG1pbmlzdHJh dGl2ZSBjaGFsbGVuZ2VzKSwgYnV0IG9mIGxpbWl0ZWQgdmFsdWUuICBBbmQgaW4gdGhlIGNvbnN1 bWVyIG1hcmtldCwgdGhlcmUgYXJlIGNhbGxpbmcgcHJvZHVjdHMgd2hpY2ggc3VwcG9ydCBhIHBh cmVudCBzdWJzY3JpYmVyIG51bWJlciBhbmQg4oCcY29tcGFuaW9u4oCdIGRldmljZXMgKGUuZy4s IHRhYmxldHMpIHdoaWNoIGNhbiBwbGFjZSBhIGNhbGwgdXNpbmcgdGhlIE1ETiBvZiB0aGUgcGFy ZW50IHN1YnNjcmliZXIuICBUaGVzZSBhcmUgZXhhbXBsZXMgb2Ygd2hlcmUgdGhlIGF1dGhlbnRp Y2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgd29u4oCZdCBuZWNlc3NhcmlseSBtZWFuIHRoZSBz YW1lIHRoaW5nIGFzIHRoZSBhdXRoZW50aWNpdHkgb2YgYSBjYWxsIGZyb20gYSBzaW5nbGUgc3Vi c2NyaWJlciB3aXRoIGEgc2luZ2xlIE1ETiByZWdhcmRsZXNzIG9mIOKAnGxheGl0eeKAnSBvZiBz cG9vZiBjaGVja2luZy4NCg0KSW4gYW5vdGhlciBmb3J1bSBhbmQgYW50aWNpcGF0aW5nIGNhbGxp bmcgbnVtYmVyIGF1dGhlbnRpY2F0aW9uIG1hbmRhdGVzIGZyb20gQ29uZ3Jlc3MgYW5kL29yIEZD QywgSSBzdWdnZXN0ZWQgdXNpbmcgY2Fycmllci1zcGVjaWZpYyBjZXJ0cyBhbmQgZW5jb2Rpbmcg c3BlY2lmaWNpdHkgb2YgYXV0aGVudGljaXR5LCBhbmQgY2FsbGluZyBudW1iZXIuICBUaGlzIHBy b3ZpZGVzIHRoZSBpZGVudGl0eSBvZiB0aGUgb3JpZ2luYXRpbmcgY2Fycmllciwgc29tZSBpZGVh IGFzIHRvIHRoZSBhY2N1cmFjeSBvciBzcGVjaWZpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIs IGFuZCB2YWxpZHR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciAoYXNzdW1pbmcgbm9uY2UgYW5kIHJl cGxheSBpc3N1ZXMgY2FuIGJlIGFkZHJlc3NlZCBhcyByZWFzb25hYmx5IHN1Z2dlc3RlZCBiZWxv dyBieSBBbGV4KS4NCg0KVGhlIHJlcHJlc2VudGF0aW9uIG9mIG9yaWctY2FycmllciBhbmQgdHJ1 c3R3b3J0aGluZXNzIGNvdWxkIGJlIGFzIGZvbGxvd3M6DQoNClJlZ3VsYXRlZC9tYW5kYXRlZCBD YXJyaWVyIENsYXNzIFVzZSBDYXNlOg0KDQowMCAtIE5vIENyZWRlbnRpYWxzDQpVc2UgY2FzZSBl eGFtcGxlKHMpOiBQcmUtSU1TLCBsZWdhY3kgY2lyY3VpdC1zd2l0Y2hlZCBuZXR3b3JrcyB0aGF0 IGRvbid0IG5hdGl2ZWx5IHN1cHBvcnQgU0lQIG9yIHdoaWNoIGRvbid0IGNob29zZSB0byBzaWdu IGNhbGxzLiAgRS5nLiwgaW50ZXJuYXRpb25hbCBjYXJyaWVycy4NClRydXN0IEVzdGltYXRlOiAg R29vZCBsdWNrLiAgQ2Fycmllcl9vcmlnIGFuZCBDZ1BOIGVudGlyZWx5IHVudHJ1c3R3b3J0aHku DQoNCjAxIC0gQ2FycmllciBzaWduZWQsIG5vIGF1dGhlbnRpY2F0aW9uIG9mIENnUE4NClVzZSBj YXNlIGV4YW1wbGUocyk6IEU5MTEgb24gdmlzaXRlZCBuZXR3b3JrIHcvbyByb2FtaW5nIGFncmVl bWVudCwgbWFudWFsIHJvYW1pbmcuDQpUcnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3JpZyB0cnVz dHdvcnRoeSwgQ2dQTiBlbnRpcmVseSB1bnRydXN0d29ydGh5DQoNCjEwIC0gQ2FycmllciBzaWdu ZWQsIHNlbWktYXV0aGVudGljYXRlZCBDZ1BODQpVc2UgY2FzZSBleGFtcGxlKHMpOiBOdW1iZXIg YmxvY2sgZGVsZWdhdGVkIGZyb20gT0NOLCBidXQgbm8gcGVyLVROIHNjcmVlbiAoU0lQIHRydW5r cykuDQpUcnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBsZXNz IHRoYW4gbW9zdCB0cnVzdHdvcnRoeSBidXQgbm90IGVudGlyZWx5IHVudHJ1c3R3b3J0aHkuDQoN CjExIC0gQ2FycmllciBzaWduZWQsIGF1dGhlbnRpY2F0ZWQgQ2dQTg0KVXNlIGNhc2UgZXhhbXBs ZShzKTogQnJlYWQtYW5kLWJ1dHRlciA5NSUrIG9mIGNhbGxzIGZyb20gc3Vic2NyaWJlciBsaW5l cyAoSU1TLWJhc2VkIGFuZCBvdGhlcndpc2UpLg0KVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVyX29y aWcgdHJ1c3R3b3J0aHksIENnUE4gbW9zdCB0cnVzdHdvcnRoeQ0KDQpQdWJsaWMgVXNlIENhc2U6 DQoNClVuZGVmaW5lZCBidXQgYXNzdW1lZCB0byB1c2UgcHVibGljIG9yIGNvbW1lcmNpYWxseSBh dmFpbGFibGUgYXV0aGVudGljYXRpb24gc2VydmljZXMgcmVzb3VyY2VzLiAgZS5nLiwgbm9tb3Jv Ym8tbGlrZSBjcm93ZC1zb3VyY2VkIGFjY2VwdC9kZW55IGxpc3RzLCBldCBjZXRlcmEuICBDb3Vs ZC93b3VsZCBwYXNzIGNyZWRlbnRpYWxzIGRvd24gdG8gU0lQLWF3YXJlIGRldmljZXMgd2hpY2gg d291bGQgcHJvY2VzcyB0aGVtIGFjY29yZGluZyB0byB0aGUgcnVsZXMgb2YgdGhlIFB1YmxpYyBD bGFzcyBhcHBsaWNhdGlvbihzKS4NCg0KUGllcmNlDQoNCkZyb206IEJyaWFuIFJvc2VuIFttYWls dG86YnJAYnJpYW5yb3Nlbi5uZXRdDQpTZW50OiBBdWd1c3QgMDQsIDIwMTYgOTowMiBBTQ0KVG86 IEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+ DQpDYzogc3RpckBpZXRmLm9yZzxtYWlsdG86c3RpckBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBb c3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQoNClRoZXJlIGFyZSByZWFzb25hYmxlIGNp cmN1bXN0YW5jZXMgd2hlcmUgYSBwYXJ0eSBwbGFjaW5nIGEgY2FsbCBpcyBub3QgdGhlIGF1dGhv cml6ZWQgZW50aXR5IGFzc2lnbmVkIHRoZSB0ZWxlcGhvbmUgbnVtYmVyIHVzZWQgaW4gRnJvbS9Q QUksIGFuZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlIHNlcnZpY2UgcHJvdmlkZXIgc2Vydmlj aW5nIHRoZSBlbnRpdHkgcGxhY2luZyB0aGUgY2FsbCBtYXkgb3IgbWF5IG5vdCBiZSB0aGUgc2Ft ZSBhcyB0aGUgc2VydmljZSBwcm92aWRlciBzZXJ2aW5nIHRoZSBlbnRpdHkgdGhhdCBpcyBhc3Np Z25lZCB0aGUgVE4uICBJbiBhbGwgc3VjaCBjYXNlcywgdGhlIGVudGl0eSB0aGF0IGlzIGFzc2ln bmVkIHRoZSBUTiBleHBsaWNpdGx5IGF1dGhvcml6ZXMgY2FsbHMgcGxhY2VkIHVzaW5nIGl04oCZ cyBUTi4gIFRoZSBkZXNpZ24gYWNjb21tb2RhdGVzIHN1Y2ggdXNlIGNhc2VzLiAgSXTigJlzIG5v dCBhIGJsYW5rZXQgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLiAgIFdl4oCZ cmUgbm90IGF3YXJlIG9mIGFueSBjYXNlcyB3aGVyZSB0aGVyZSBpcyBhbiBhY3R1YWwgcmVxdWly ZW1lbnQgZm9yIGxlZ2l0aW1hdGUgY2FsbGluZyB3aXRob3V0IGV4cGxpY2l0IGF1dGhvcml6YXRp b24gZnJvbSB0aGUgYXNzaWduZWQgZW50aXR5LCBhbHRob3VnaCB3ZSBjZXJ0YWlubHkgYXJlIGF3 YXJlIHRoYXQgdmFyaW91cyBwYXJ0cyBvZiB2YXJpb3VzIHNlcnZpY2UgcHJvdmlkZXJzIGRvbuKA mXQgYm90aGVyIHRvIGNoZWNrLiBBdCB0aGlzIHBvaW50LCBhdCBsZWFzdCBpbiBzb21lIGNvdW50 cmllcywgdGhlcmUgaXMgYSByZWFsaXphdGlvbiB0aGF0IHRoZSBsYXhpdHkgb2YgYWxsb3dpbmcg dW5jaGVja2VkIHNwb29maW5nIGlzIG5vdCBhY2NlcHRhYmxlIGFueSBtb3JlLg0KDQpCcmlhbg0K DQpPbiBBdWcgMywgMjAxNiwgYXQgODozNSBBTSwgQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsu bmV0PG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pj4gd3JvdGU6DQoNCjEuICAgICAgIFBlcm1pdCBh dXRob3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24NCkluIHRoZSBjdXJyZW50IHRlbGVw aG9ueSBuZXR3b3JrIHByYWN0aWNlLCBzb21lIHNlcnZpY2UgcHJvdmlkZXIgaW1wbGVtZW50YXRp b25zIGNob29zZSBub3QgdG8gYXV0aGVudGljYXRlIGlkZW50aXR5LCBidXQgc2ltcGx5IGZhY2ls aXRhdGUgdGhlIHVzZSBvZiBhbiBhcmJpdHJhcnkgb3Igc2VsZWN0ZWQgdXNlci1wcm92aWRlZCBp ZGVudGl0eS4gIEFyZSB0aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8gIEhhcyBh bnlvbmUgZXN0YWJsaXNoZWQgdGhhdCB0aGVyZSBhcmUgbm90PyAgSG93IGNhbiB0aGUgaW5kdXN0 cnkgcmVhc29uYWJseSBleHBlY3QgdG8gZW5kIHRoaXMgKG9mdGVuIGJhZCkgcHJhY3RpY2U/ICBJ ZiBpdCBjYW7igJl0IGJlIGVuZGVkLCB0aGVyZeKAmXMgdmFsdWUgaW4gYXQgbGVhc3QgaWRlbnRp ZnlpbmcgdGhlIG9yaWdpbmF0aW5nIHNlcnZpY2UgcHJvdmlkZXIgKGkuZS4sIHRoZSBzaWduZXIv YXV0aG9yaXplcikuICBHaXZlbiB0aGUgcHJldmFsZW5jZSBvZiBhYnVzZSB1c2luZyB0ZWxlcGhv bmUgbnVtYmVycyBhc3NpZ25lZCB0byBhIHNvbWV0aW1lcy1hbm9ueW1vdXMgYWJ1c2VyLCBpdCBi ZWNvbWVzIGNyaXRpY2FsbHkgaW1wb3J0YW50IHRvIGlkZW50aWZ5IHRoZSBzZXJ2aWNlIHByb3Zp ZGVyKHMpIGNsb3Nlc3QgdG8gdGhlIGFidXNlci4gIEJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRo YXQgaXTigJlzIGJldHRlciB0byBJRCBzZXJ2aWNlIHByb3ZpZGVycyB0aGFuIHVucmVhc29uYWJs eSBleHBlY3QgYSBiYW4gb2YgdGhlIHVzZSBvZiB1bmF1dGhlbnRpY2F0ZWQgKGFuZCB0aGVyZWZv cmUgdW5zaWduZWQpIFNJUCByZXF1ZXN0cywgU1RJUiBzaWduaW5nIHNob3VsZCBzdXBwb3J0IGF1 dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbi4gIFRoZSBwcmFjdGljZSBvZiBhdXRo b3JpemluZyB1bmF1dGhlbnRpY2F0ZWQgdXNlIGV4aXN0cywgYW5kIHRoZXJlIGlzIGJlbmVmaXQg dG8gc2lnbmluZyBpbiB0aGVzZSBjYXNlcyAoc2VydmljZSBwcm92aWRlciBpZGVudGlmaWNhdGlv bikuICBUaGUgbGFuZ3VhZ2Ugb2YgdGhlIElEIHNob3VsZCBwZXJtaXQgdGhpcyB1c2UuICA0NDc0 YmlzLTEwIHNob3VsZCBOT1QgcmVxdWlyZSBvciBhc3N1bWUgdGhhdCAgdGhhdCBhdXRoZW50aWNh dGlvbiB3aWxsIHByZWNlZGUgYXV0aG9yaXphdGlvbi4gT2YgY291cnNlIHRoZXJlIG1heSBiZSBv dGhlciB1c2UgY2FzZXMgd2hlcmUgc2lnbmluZyBpbmNsdWRlcyBhdXRoZW50aWNhdGlvbiBhbmQg bWF5IG5vdCBpbmNsdWRlIGEgc3BlY2lmaWMgc2VydmljZSBwcm92aWRlcuKAmXMgYXV0aG9yaXph dGlvbi4NCg0KDQoyLiAgICAgICBJbXByb3ZlIHJlcGxheSBwcmV2ZW50aW9uDQpQcm94aW1hdGUg cmVwbGF5IGlzIHBvc3NpYmxlIHdoaWxlIGNvbXBseWluZyB3aXRoIHRoaXMgc3BlYy4gIEZpcnN0 LCBvbmUgb3IgbW9yZSBwcm94aW1hdGUgKGUuZy4sIHdpdGhpbiA2MCBzZWNvbmRzKSBTSVAgcmVx dWVzdHMgdXNpbmcgdGhlIHNhbWUgdG9rZW4gYXJlIGxlZ2FsIGFuZCBzdWJqZWN0IHRvIHJlcGxh eSBpbiBtYW55IGNhc2VzLiAgQW4gU0RQIGJvZHnigJlzIG1reSBtYXkgbm90IGJlIHByZXNlbnQg YW5kIGlmIHByZXNlbnQgaXRzIHVzZSBpcyBvcHRpb25hbC4gIFNvbWUgc29ydCBvZiBtYW5kYXRv cnkgbmV3IG9yIGV4aXN0aW5nIHNpZ25lZCBzZXF1ZW5jZSwgcmFuZG9tICMgb3IgcmVxdWVzdCBJ RCAoZS5nLiwgQ2FsbC1JRCBvciBDU2VxKSBhbmQgYSAxLXRpbWUgdXNlIHBvbGljeSBvbiB0aGUg cmVjZWl2aW5nIGVuZCBvZiB0aGUgcmVxdWVzdCAoZS5nLiwgdG9rZW5zIG9ubHkgZ29vZCBmb3Ig MSB1c2UpIGNvdWxkIHByZXZlbnQgcmVwbGF5LiAgRGlmZmVyZW50IG1ldGhvZHMgKGUuZy4sIElO VklURSB2cyBNRVNTQUdFKSBtaWdodCBiZSBoYW5kbGVkIGJ5IGRpZmZlcmVudCByZWNlaXZpbmcg aW5mcmFzdHJ1Y3R1cmUsIGFuZCB0aGVyZWZvcmUgZGlmZmljdWx0aWVzIHdpdGgg4oCYaXTigJlz IGJlZW4gdXNlZCBhbHJlYWR54oCZIGNvb3JkaW5hdGlvbiBhbGxvdyBhIGZha2VkIE1FU1NBR0Ug YmFzZWQgb24gYSBjYXB0dXJlZCByZXF1ZXN0LiBUaGlzIG1pZ2h0IGluY2x1ZGUgYW4gbWtleSBm cm9tIGEgY2FwdHVyZWQgSU5WSVRFLiAgIFNvIGl0IG1heSBiZSBwb3NzaWJsZSB0byBET1MsIHNw YW0gb3IgdGV4dC1ib21iIGEgcmVjaXBpZW50IHVzaW5nIGEgY2FwdHVyZWQgaWRlbnRpdHkuICBX aGlsZSBsYXJnZS1zY2FsZSBvciBkaXN0cmlidXRlZCBpbXBsZW1lbnRhdGlvbnMgbWF5IG1ha2Ug dGhlIGVuZm9yY2VtZW50IGRpZmZpY3VsdCwgdGhlcmUgaXMgbGl0dGxlIGNvc3QgdG8gc2lnbmlu ZyBhbmQgZGVjb2RpbmcgYSBtZXRob2QgYW5kIHBvc3NpYmx5IGEgbnVtZXJpYyBJRC4gICBTb21l IHNvcnQgb2Yg4oCYMS11c2XigJkgcHJhY3RpY2Ugc2hvdWxkIGF0IGxlYXN0IGJlIGRpc2N1c3Nl ZCB3aGlsZSBwZXJoYXBzIG5vdCByZXF1aXJlZC4NCg0KDQpTcGVjaWZpYyBtYXJrdXAgc3VnZ2Vz dGlvbnM6DQoNCg0KTklUUw0KDQoNCiAgIFRoZSB2ZXJpZmllciBNVVNUIGluc3BlY3QgYW55IG9w dGlvbmFsICJwcHQiIHBhcmFtZXRlciBhcHBlYXJpbmcgaW4gdGhlDQoNCiAgIElkZW50aXR5IHJl cXVlc3QuICBJZiBubyAicHB0IiBwYXJhbWV0ZXIgaXMgcHJlc2VudCwgdGhlbiB0aGUNCg0KICAg dmVyaWZpZXIgcHJvY2VlZHMgbm9ybWFsbHkgYmVsb3cuICBJZiBhICJwcHQiIHBhcmFtZXRlciB2 YWx1ZSBpcw0KDQogICBwcmVzZW50LCBhbmQgdGhlIHZlcmlmaWVyIGRvZXMgbm90IHN1cHBvcnQg aXQsIGl0IE1VU1QgaWdub3JlIHRoZQ0KDQogICBJZGVudGl0eSBoZWFkZXIuICBJZiBhIHN1cHBv cnRlZCAicHB0IiBwYXJhbWV0ZXIgdmFsdWUgaXMgcHJlc2VudCwNCg0KICAgdGhlIHZlcmlmaWVy IGZvbGxvd3MgdGhlIHByb2NlZHVyZXMgYmVsb3csIGluY2x1ZGluZyB0aGUgdmFyaWF0aW9ucw0K DQogICBkZXNjcmliZWQgaW4gU3RlcCA1Lg0KDQozPGZpbGU6Ly8vQzpcVXNlcnNcYWIzNzc4XERv Y3VtZW50c1xJRVRGXGRyYWZ0LWlldGYtc3Rpci1yZmM0NDc0YmlzLTEwJTIwLSUyMEF1dGhlbnRp Y2F0ZWQlMjBJZGVudGl0eSUyME1hbmFnZW1lbnQlMjBpbiUyMHRoZSUyMFNlc3Npb24lMjBJbml0 aWF0aW9uJTIwUHJvdG9jb2wlMjAlMjhTSVAlMjkuaHRtI3NlY3Rpb24tMz4uICBCYWNrZ3JvdW5k DQoNClvigKZdDQoNCg0KDQogICBQZXIgW1JGQzczNDA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9o dG1sL3JmYzczNDA+XSwgcHJvYmxlbXMgc3VjaCBhcyByb2JvY2FsbGluZywgdm9pY2VtYWlsIGhh Y2tpbmcsIGFuZA0KDQogICBzd2F0dGluZyBhcmUgZW5hYmxlZCBieSBhbiBhdHRhY2tlcidzIGFi aWxpdHkgdG8gaW1wZXJzb25hdGUgc29tZW9uZQ0KDQogICBlbHNlLiAgVGhlIHNlY3VyZSBvcGVy YXRpb24gb2YgbW9zdCBTSVAgYXBwbGljYXRpb25zIGFuZCBzZXJ2aWNlcw0KDQogICBkZXBlbmRz IG9uIGF1dGhlbnRpY2F0aW5nIGFuZC9vciBhdXRob3JpemluZyB0aGUgc291cmNlIG9mIGNvbW11 bmljYXRpb25zIGFzIGl0IGlzDQoNCiAgIHJlcHJlc2VudGVkIGluIGEgU0lQIHJlcXVlc3QuDQoN Cg0KICAgVGhpcyBpZGVudGl0eSBhcmNoaXRlY3R1cmUgZm9yIFNJUCBkZXBlbmRzIG9uIGluY2x1 ZGVzIHByb3Zpc2lvbnMgZm9yIGEgbG9naWNhbA0KDQogICAiYXV0aGVudGljYXRpb24gc2Vydmlj ZSIgd2hpY2ggdmFsaWRhdGVzIGNhbGxlciBpZGVudGl0eSBhdCBvciBuZWFyIG9yaWdpbmF0aW9u LiAgb3V0Z29pbmcgcmVxdWVzdHMuICBBbg0KDQogICBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIG1h eSBiZSBpbXBsZW1lbnRlZCBlaXRoZXIgYXMgcGFydCBvZiBhIHVzZXINCg0KICAgYWdlbnQgb3Ig YXMgYSBwcm94eSBzZXJ2ZXI7IHR5cGljYWxseSwgaXQgaXMgYSBjb21wb25lbnQgb2YgYSBuZXR3 b3JrDQoNCiAgIGludGVybWVkaWFyeSBsaWtlIGEgcHJveHkgdG8gd2hpY2ggb3JpZ2luYXRpbmcg dXNlciBhZ2VudHMgc2VuZA0KDQogICB1bnNpZ25lZCByZXF1ZXN0cy4gIE9uY2UgdGhlIHNlbmRl ciBvZiB0aGUgbWVzc2FnZSBoYXMgYmVlbg0KDQoNCg0KICAgVGhpcyBkb2N1bWVudCBzcGVjaWZp ZXMgYSBtZWFucyBvZiBzaGFyaW5nIGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2UNCg0KICAgb2Yg YXV0aGVudGljaXR5IG9mIGFuZC9vciBhdXRob3JpemF0aW9uIHRvIHVzZSBlbmQtdXNlciBTSVAg aWRlbnRpdHkgaW4gYW4gaW50ZXJkb21haW4gb3IgaW50cmFkb21haW4gY29udGV4dC4NCg0KICAg SXQgcmVsaWVzIG9uIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGNvbnN0cnVjdGluZyB0b2tl bnMgYmFzZWQgb24gW+KApl0NCg0KDQoNCg0KICAgVG8gbWF4aW1pemUgZW5kLXRvLWVuZCBzZWN1 cml0eSwgaXQgaXMgdHlwaWNhbGx5IG9idmlvdXNseQ0KDQogICBwcmVmZXJhYmxlIGZvciBlbmQt dXNlcnMgdG8gYWNxdWlyZSB0aGVpciBvd24gY3JlZGVudGlhbHM7IGlmIHRoZXkNCg0KICAgZG8s IHRoZWlyIHVzZXIgYWdlbnRzIGNhbiBhY3QgYXMgYXV0aGVudGljYXRpb24gc2VydmljZXMuICBI b3dldmVyLA0KDQogICBmb3Igc29tZSBkZXBsb3ltZW50cywgW+KApl0NCg0KDQpSZWdhcmRzLA0K DQpBbGV4DQoNCkFsZXggQm9ib3Rlaw0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpzdGlyIG1haWxpbmcgbGlzdA0Kc3RpckBpZXRmLm9yZzxtYWls dG86c3RpckBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3Rpcg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNClRoaXMgZS1tYWls IG1heSBjb250YWluIFNwcmludCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbiBpbnRlbmRlZCBmb3Ig dGhlIHNvbGUgdXNlIG9mIHRoZSByZWNpcGllbnQocykuIEFueSB1c2UgYnkgb3RoZXJzIGlzIHBy b2hpYml0ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBj b250YWN0IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSBhbGwgY29waWVzIG9mIHRoZSBtZXNzYWdlLg0K DQo= --_000_595a825401b04d198dfc137546fba535PLSWE13M08adsprintcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseTpHYXJhbW9uZDsNCglwYW5vc2UtMToyIDIgNCA0IDMgMyAxIDEg OCAzO30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFs LCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0K CWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7 fQ0KaDINCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJbXNvLXN0eWxlLWxpbms6IkhlYWRpbmcg MiBDaGFyIjsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGlu aywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJs dWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlw ZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6 OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28t c3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVk Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJ Zm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5IZWFkaW5nMkNoYXINCgl7bXNvLXN0eWxlLW5h bWU6IkhlYWRpbmcgMiBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUt bGluazoiSGVhZGluZyAyIjsNCglmb250LWZhbWlseToiQ2FsaWJyaSBMaWdodCIsc2Fucy1zZXJp ZjsNCgljb2xvcjojMkU3NEI1O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJBcmlhbCIsc2Fucy1zZXJpZjsNCgljb2xv cjojMDAwMENDOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0 ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlk bWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0 YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxi b2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9 IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDAwQ0MiPllvdSB3YW50IElQIFBCWGVzIHRvIHNpZ24gY2FsbHM/ICZuYnNwO1dvbuKAmXQg dGhhdCBtYWtlIGl0IGV4dHJhb3JkaW5hcmlseSBlYXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRoIGF1 dGhlbnRpY2F0ZWQgbnVtYmVycz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1yaWdodDo1LjhwdCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDAwQ0MiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4gQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCjxi cj4NCjxiPlNlbnQ6PC9iPiBBdWd1c3QgMDQsIDIwMTYgMTI6MjQgUE08YnI+DQo8Yj5Ubzo8L2I+ IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gJmx0O1BpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbSZndDs8 YnI+DQo8Yj5DYzo8L2I+IEFsZXggQm9ib3RlayAmbHQ7YWxleEBib2JvdGVrLm5ldCZndDs7IHN0 aXJAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMt MTAgY29tbWVudHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5GaXJzdCBvZiBhbGwsIHdlIHdvdWxkIHdhbnQgdGhlIFBCWCB0byBnZW5lcmF0ZSB0aGUgc2ln bmF0dXJlLCBidXQgdGhlIHNlcnZpY2UgcHJvdmlkZXIgY2FuIGRvIHRoYXQuICZuYnNwO0l0IHNo b3VsZCBub3QgYWRkIGEgdmFsaWQgc2lnbmF0dXJlIHRvIGEgY2FsbCBmcm9tIGEgbnVtYmVyIGl0 IGRpZCBub3QgYXNzaWduIHRvIHRoZSB0cnVuayBncm91cCBjb25uZWN0aW5nIHRvIHRoZSBQQlgs IGFsdGhvdWdoIGl0IGNvdWxkDQogc3VwcG9ydCB0aGUgZXh0cmEgZGVsZWdhdGlvbiByZXF1aXJl ZCB0byBzdXBwb3J0IOKAnGF1dGhvcml6ZWQgc3Bvb2ZpbmfigJ0uICZuYnNwO1RoZSBjb21wYW5p b24gZGV2aWNlcyBJ4oCZbSBhd2FyZSBvZiBhbHdheXMgc2VuZCBjYWxscyBmcm9tIHRoZSBzYW1l IHNlcnZpY2UgcHJvdmlkZXIgYW5kIHNob3VsZCBub3QgcHJlc2VudCBhbnkgaXNzdWUuJm5ic3A7 PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FdmVyeW9uZSB3 aWxsIGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbuKAmXQgZG8gbm93IHRvIGltcGxlbWVudCBzdG9w IHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJs b2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDQsIDIwMTYsIGF0IDEyOjQxIFBNLCBH b3JtYW4sIFBpZXJjZSBBIFtDVE9dICZsdDs8YSBocmVmPSJtYWlsdG86UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tIj5QaWVyY2UuR29ybWFuQHNwcmludC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMDBDQyI+RnJhdWQgZnJvbSBjb21wcm9taXNlZCBQQlhlcyBpcyBjb21tb24uJm5ic3A7 IEFuZCBldmVuIHdoZXJlIGEgUEJYIGlzIG5vdCBjb21wcm9taXNlZCwgYSBjYXJyaWVyIGhhcyBu byBwcmFjdGljYWwgd2F5IG9mIGtub3dpbmcgd2hldGhlciB0aGUgY2FsbGluZyBudW1iZXIgaXMg cHJvcGVybHkNCiBhc3NpZ25lZCBhbmQgdmFsaWQgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgdGhl IEVudGVycHJpc2UuJm5ic3A7IFRoZXJlZm9yZSwgY2hlY2tpbmcgd2hldGhlciB0aGUgY2FsbGlu ZyBudW1iZXIgd2FzIGZyb20gYW4gYXNzaWduZWQgcmFuZ2UgbWlnaHQgYmUgcG9zc2libGUgKGFu ZCBmcmF1Z2h0IHdpdGggYWRtaW5pc3RyYXRpdmUgY2hhbGxlbmdlcyksIGJ1dCBvZiBsaW1pdGVk IHZhbHVlLiZuYnNwOyBBbmQgaW4gdGhlIGNvbnN1bWVyIG1hcmtldCwgdGhlcmUgYXJlDQogY2Fs bGluZyBwcm9kdWN0cyB3aGljaCBzdXBwb3J0IGEgcGFyZW50IHN1YnNjcmliZXIgbnVtYmVyIGFu ZCDigJxjb21wYW5pb27igJ0gZGV2aWNlcyAoZS5nLiwgdGFibGV0cykgd2hpY2ggY2FuIHBsYWNl IGEgY2FsbCB1c2luZyB0aGUgTUROIG9mIHRoZSBwYXJlbnQgc3Vic2NyaWJlci4mbmJzcDsgVGhl c2UgYXJlIGV4YW1wbGVzIG9mIHdoZXJlIHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIGNhbGxpbmcg bnVtYmVyIHdvbuKAmXQgbmVjZXNzYXJpbHkgbWVhbiB0aGUNCiBzYW1lIHRoaW5nIGFzIHRoZSBh dXRoZW50aWNpdHkgb2YgYSBjYWxsIGZyb20gYSBzaW5nbGUgc3Vic2NyaWJlciB3aXRoIGEgc2lu Z2xlIE1ETiByZWdhcmRsZXNzIG9mIOKAnGxheGl0eeKAnSBvZiBzcG9vZiBjaGVja2luZy48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzAwMDBDQyI+SW4gYW5vdGhlciBmb3J1bSBhbmQgYW50aWNpcGF0aW5nIGNhbGxpbmcgbnVtYmVy IGF1dGhlbnRpY2F0aW9uIG1hbmRhdGVzIGZyb20gQ29uZ3Jlc3MgYW5kL29yIEZDQywgSSBzdWdn ZXN0ZWQgdXNpbmcgY2Fycmllci1zcGVjaWZpYyBjZXJ0cyBhbmQgZW5jb2Rpbmcgc3BlY2lmaWNp dHkNCiBvZiBhdXRoZW50aWNpdHksIGFuZCBjYWxsaW5nIG51bWJlci4mbmJzcDsgVGhpcyBwcm92 aWRlcyB0aGUgaWRlbnRpdHkgb2YgdGhlIG9yaWdpbmF0aW5nIGNhcnJpZXIsIHNvbWUgaWRlYSBh cyB0byB0aGUgYWNjdXJhY3kgb3Igc3BlY2lmaWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyLCBh bmQgdmFsaWR0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgKGFzc3VtaW5nIG5vbmNlIGFuZCByZXBs YXkgaXNzdWVzIGNhbiBiZSBhZGRyZXNzZWQgYXMgcmVhc29uYWJseQ0KIHN1Z2dlc3RlZCBiZWxv dyBieSBBbGV4KS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+VGhlIHJlcHJlc2VudGF0aW9uIG9mIG9yaWctY2Fycmll ciBhbmQgdHJ1c3R3b3J0aGluZXNzIGNvdWxkIGJlIGFzIGZvbGxvd3M6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAwMENDIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5SZWd1bGF0ZWQvbWFuZGF0ZWQgQ2FycmllciBDbGFzcyBVc2UgQ2FzZTo8 L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjAwIC0gTm8gQ3JlZGVudGlhbHM8L3NwYW4+PC9iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPlVzZSBjYXNlIGV4YW1wbGUocyk6IFByZS1JTVMsIGxlZ2FjeSBjaXJjdWl0LXN3aXRjaGVk IG5ldHdvcmtzIHRoYXQgZG9uJ3QgbmF0aXZlbHkgc3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3Qg Y2hvb3NlIHRvIHNpZ24gY2FsbHMuJm5ic3A7IEUuZy4sIGludGVybmF0aW9uYWwgY2FycmllcnMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDox LjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRydXN0IEVzdGlt YXRlOiAmbmJzcDtHb29kIGx1Y2suJm5ic3A7IENhcnJpZXJfb3JpZyBhbmQgQ2dQTiBlbnRpcmVs eSB1bnRydXN0d29ydGh5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+MDEgLSBDYXJyaWVyIHNpZ25lZCwgbm8gYXV0aGVudGljYXRpb24gb2YgQ2dQTjwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+VXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBvbiB2aXNpdGVkIG5ldHdvcmsgdy9v IHJvYW1pbmcgYWdyZWVtZW50LCBtYW51YWwgcm9hbWluZy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VHJ1c3QgRXN0aW1hdGU6ICZuYnNwO0NhcnJpZXJfb3Jp ZyB0cnVzdHdvcnRoeSwgQ2dQTiBlbnRpcmVseSB1bnRydXN0d29ydGh5PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4xMCAtIENhcnJpZXIgc2lnbmVkLCBzZW1pLWF1 dGhlbnRpY2F0ZWQgQ2dQTjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VXNlIGNhc2UgZXhhbXBsZShzKTogTnVt YmVyIGJsb2NrIGRlbGVnYXRlZCBmcm9tIE9DTiwgYnV0IG5vIHBlci1UTiBzY3JlZW4gKFNJUCB0 cnVua3MpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UcnVz dCBFc3RpbWF0ZTogJm5ic3A7Q2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGxlc3MgdGhh biBtb3N0IHRydXN0d29ydGh5IGJ1dCBub3QgZW50aXJlbHkgdW50cnVzdHdvcnRoeS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjExIC0gQ2FycmllciBzaWduZWQs IGF1dGhlbnRpY2F0ZWQgQ2dQTjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VXNlIGNhc2UgZXhhbXBsZShzKTog QnJlYWQtYW5kLWJ1dHRlciA5NSUmIzQzOyBvZiBjYWxscyBmcm9tIHN1YnNjcmliZXIgbGluZXMg KElNUy1iYXNlZCBhbmQgb3RoZXJ3aXNlKS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+VHJ1c3QgRXN0aW1hdGU6ICZuYnNwO0NhcnJpZXJfb3JpZyB0cnVzdHdv cnRoeSwgQ2dQTiBtb3N0IHRydXN0d29ydGh5PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+UHVibGljIFVzZSBDYXNlOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5VbmRlZmluZWQgYnV0IGFzc3Vt ZWQgdG8gdXNlIHB1YmxpYyBvciBjb21tZXJjaWFsbHkgYXZhaWxhYmxlIGF1dGhlbnRpY2F0aW9u IHNlcnZpY2VzIHJlc291cmNlcy4mbmJzcDsgZS5nLiwgbm9tb3JvYm8tbGlrZSBjcm93ZC1zb3Vy Y2VkIGFjY2VwdC9kZW55IGxpc3RzLCBldCBjZXRlcmEuJm5ic3A7IENvdWxkL3dvdWxkDQogcGFz cyBjcmVkZW50aWFscyBkb3duIHRvIFNJUC1hd2FyZSBkZXZpY2VzIHdoaWNoIHdvdWxkIHByb2Nl c3MgdGhlbSBhY2NvcmRpbmcgdG8gdGhlIHJ1bGVzIG9mIHRoZSBQdWJsaWMgQ2xhc3MgYXBwbGlj YXRpb24ocykuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMwMDAwQ0MiPlBpZXJjZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBD QyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4w cHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkJyaWFuDQogUm9zZW4gWzxhIGhyZWY9Im1haWx0bzpickBicmlhbnJvc2VuLm5ldCI+bWFpbHRv OmJyQGJyaWFucm9zZW4ubmV0PC9hPl08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PGJyPg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkF1Z3VzdCAwNCwgMjAxNiA5OjAyIEFNPGJyPg0KPGI+ VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5B bGV4IEJvYm90ZWsgJmx0OzxhIGhyZWY9Im1haWx0bzphbGV4QGJvYm90ZWsubmV0Ij5hbGV4QGJv Ym90ZWsubmV0PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIj5z dGlyQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBj b21tZW50czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGFyZSByZWFzb25hYmxlIGNpcmN1bXN0 YW5jZXMgd2hlcmUgYSBwYXJ0eSBwbGFjaW5nIGEgY2FsbCBpcyBub3QgdGhlIGF1dGhvcml6ZWQg ZW50aXR5IGFzc2lnbmVkIHRoZSB0ZWxlcGhvbmUgbnVtYmVyIHVzZWQgaW4gRnJvbS9QQUksIGFu ZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlIHNlcnZpY2UgcHJvdmlkZXIgc2VydmljaW5nIHRo ZSBlbnRpdHkgcGxhY2luZyB0aGUgY2FsbCBtYXkgb3IgbWF5DQogbm90IGJlIHRoZSBzYW1lIGFz IHRoZSBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpbmcgdGhlIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVk IHRoZSBUTi4gJm5ic3A7SW4gYWxsIHN1Y2ggY2FzZXMsIHRoZSBlbnRpdHkgdGhhdCBpcyBhc3Np Z25lZCB0aGUgVE4gZXhwbGljaXRseSBhdXRob3JpemVzIGNhbGxzIHBsYWNlZCB1c2luZyBpdOKA mXMgVE4uICZuYnNwO1RoZSBkZXNpZ24gYWNjb21tb2RhdGVzIHN1Y2ggdXNlIGNhc2VzLiAmbmJz cDtJdOKAmXMgbm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uDQogd2l0aG91dCBhdXRoZW50aWNh dGlvbi4gJm5ic3A7IFdl4oCZcmUgbm90IGF3YXJlIG9mIGFueSBjYXNlcyB3aGVyZSB0aGVyZSBp cyBhbiBhY3R1YWwgcmVxdWlyZW1lbnQgZm9yIGxlZ2l0aW1hdGUgY2FsbGluZyB3aXRob3V0IGV4 cGxpY2l0IGF1dGhvcml6YXRpb24gZnJvbSB0aGUgYXNzaWduZWQgZW50aXR5LCBhbHRob3VnaCB3 ZSBjZXJ0YWlubHkgYXJlIGF3YXJlIHRoYXQgdmFyaW91cyBwYXJ0cyBvZiB2YXJpb3VzIHNlcnZp Y2UgcHJvdmlkZXJzIGRvbuKAmXQNCiBib3RoZXIgdG8gY2hlY2suIEF0IHRoaXMgcG9pbnQsIGF0 IGxlYXN0IGluIHNvbWUgY291bnRyaWVzLCB0aGVyZSBpcyBhIHJlYWxpemF0aW9uIHRoYXQgdGhl IGxheGl0eSBvZiBhbGxvd2luZyB1bmNoZWNrZWQgc3Bvb2ZpbmcgaXMgbm90IGFjY2VwdGFibGUg YW55IG1vcmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBdWcgMywgMjAxNiwgYXQgODozNSBBTSwgQWxleCBCb2Jv dGVrICZsdDs8YSBocmVmPSJtYWlsdG86YWxleEBib2JvdGVrLm5ldCI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+YWxleEBib2JvdGVrLm5ldDwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4dC1pbmRlbnQ6 LS4yNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjEuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 Ny4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5QZXJtaXQNCiBhdXRob3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb248L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JbiB0aGUg Y3VycmVudCB0ZWxlcGhvbnkgbmV0d29yayBwcmFjdGljZSwgc29tZSBzZXJ2aWNlIHByb3ZpZGVy IGltcGxlbWVudGF0aW9ucyBjaG9vc2Ugbm90IHRvIGF1dGhlbnRpY2F0ZSBpZGVudGl0eSwgYnV0 IHNpbXBseSBmYWNpbGl0YXRlIHRoZSB1c2Ugb2YgYW4gYXJiaXRyYXJ5IG9yIHNlbGVjdGVkDQog dXNlci1wcm92aWRlZCBpZGVudGl0eS4mbmJzcDsgQXJlIHRoZXJlIGxlZ2l0aW1hdGUgdXNlIGNh c2VzIGZvciB0aGlzPyZuYnNwOyBIYXMgYW55b25lIGVzdGFibGlzaGVkIHRoYXQgdGhlcmUgYXJl IG5vdD8mbmJzcDsgSG93IGNhbiB0aGUgaW5kdXN0cnkgcmVhc29uYWJseSBleHBlY3QgdG8gZW5k IHRoaXMgKDxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5vZnRlbjwvc3Bhbj48c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+YmFkKSBwcmFjdGljZT8mbmJz cDsNCiBJZiBpdCBjYW7igJl0IGJlIGVuZGVkLCB0aGVyZeKAmXMgdmFsdWUgaW4gYXQgbGVhc3Qg aWRlbnRpZnlpbmcgdGhlIG9yaWdpbmF0aW5nIHNlcnZpY2UgcHJvdmlkZXIgKDxzcGFuIHN0eWxl PSJjb2xvcjojMUY0OTdEIj5pLmUuLDxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj48L3NwYW4+dGhlIHNpZ25lci9hdXRob3JpemVyKS4mbmJzcDsgR2l2ZW4g dGhlIHByZXZhbGVuY2Ugb2YgYWJ1c2UgdXNpbmcgdGVsZXBob25lIG51bWJlcnMNCiBhc3NpZ25l ZCB0byBhIHNvbWV0aW1lcy1hbm9ueW1vdXMgYWJ1c2VyLCBpdCBiZWNvbWVzIGNyaXRpY2FsbHkg aW1wb3J0YW50IHRvIGlkZW50aWZ5IHRoZSBzZXJ2aWNlIHByb3ZpZGVyKHMpIGNsb3Nlc3QgdG8g dGhlIGFidXNlci4mbmJzcDsgQmFzZWQgb24gdGhlIGFzc3VtcHRpb24gdGhhdCBpdOKAmXMgYmV0 dGVyIHRvIElEIHNlcnZpY2UgcHJvdmlkZXJzIHRoYW4gdW5yZWFzb25hYmx5IGV4cGVjdCBhIGJh biBvZiB0aGUgdXNlIG9mIHVuYXV0aGVudGljYXRlZA0KIChhbmQgdGhlcmVmb3JlIHVuc2lnbmVk KSBTSVAgcmVxdWVzdHMsIFNUSVIgc2lnbmluZyBzaG91bGQgc3VwcG9ydCBhdXRob3JpemF0aW9u IHdpdGhvdXQgYXV0aGVudGljYXRpb24uJm5ic3A7IFRoZSBwcmFjdGljZSBvZiBhdXRob3Jpemlu ZyB1bmF1dGhlbnRpY2F0ZWQgdXNlIGV4aXN0cywgYW5kIHRoZXJlIGlzIGJlbmVmaXQgdG8gc2ln bmluZyBpbiB0aGVzZSBjYXNlcyAoc2VydmljZSBwcm92aWRlciBpZGVudGlmaWNhdGlvbikuJm5i c3A7IFRoZSBsYW5ndWFnZQ0KIG9mIHRoZSBJRCBzaG91bGQgcGVybWl0IHRoaXMgdXNlLiZuYnNw OyA0NDc0YmlzLTEwIHNob3VsZCBOT1QgcmVxdWlyZSBvciBhc3N1bWUgdGhhdCZuYnNwOyB0aGF0 IGF1dGhlbnRpY2F0aW9uIHdpbGwgcHJlY2VkZSBhdXRob3JpemF0aW9uLiBPZiBjb3Vyc2UgdGhl cmUgbWF5IGJlIG90aGVyIHVzZSBjYXNlcyB3aGVyZSBzaWduaW5nIGluY2x1ZGVzIGF1dGhlbnRp Y2F0aW9uIGFuZCBtYXkgbm90IGluY2x1ZGUgYSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVy4oCZ cw0KIGF1dGhvcml6YXRpb248c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Ljwvc3Bhbj48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4y NWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjIuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4w cHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5J bXByb3ZlDQogcmVwbGF5IHByZXZlbnRpb248L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Qcm94aW1hdGUgcmVwbGF5IGlzIHBvc3NpYmxl PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0 eWxlPSJjb2xvcjojMUY0OTdEIj53aGlsZSBjb21wbHlpbmcgd2l0aDwvc3Bhbj48c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+dGhpcw0KIHNwZWMuJm5ic3A7 IEZpcnN0LCBvbmUgb3IgbW9yZSBwcm94aW1hdGUgKGUuZy4sIHdpdGhpbiA2MCBzZWNvbmRzKSBT SVAgcmVxdWVzdHMgdXNpbmcgdGhlIHNhbWUgdG9rZW4gYXJlIGxlZ2FsIGFuZCBzdWJqZWN0IHRv IHJlcGxheSBpbiBtYW55IGNhc2VzLiZuYnNwOyBBbiBTRFAgYm9keeKAmXMgbWt5IG1heSBub3Qg YmUgcHJlc2VudCBhbmQgaWYgcHJlc2VudCBpdHMgdXNlIGlzIG9wdGlvbmFsLiZuYnNwOyBTb21l IHNvcnQgb2YgbWFuZGF0b3J5IG5ldyBvciBleGlzdGluZw0KIHNpZ25lZCBzZXF1ZW5jZSwgcmFu ZG9tICMgb3IgcmVxdWVzdCBJRCAoZS5nLiwgQ2FsbC1JRCBvciBDU2VxKSBhbmQgYSAxLXRpbWUg dXNlIHBvbGljeSBvbiB0aGUgcmVjZWl2aW5nIGVuZCBvZiB0aGUgcmVxdWVzdDxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+KGUuZy4sIHRva2VucyBvbmx5IGdvb2QgZm9yIDEgdXNlKTxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+Y291bGQNCiBwcmV2ZW50 IHJlcGxheS4mbmJzcDsgRGlmZmVyZW50IG1ldGhvZHMgKGUuZy4sIElOVklURSB2cyBNRVNTQUdF KSBtaWdodCBiZSBoYW5kbGVkIGJ5IGRpZmZlcmVudCByZWNlaXZpbmcgaW5mcmFzdHJ1Y3R1cmUs IGFuZCB0aGVyZWZvcmUgZGlmZmljdWx0aWVzIHdpdGgg4oCYaXTigJlzIGJlZW4gdXNlZCBhbHJl YWR54oCZIGNvb3JkaW5hdGlvbiBhbGxvdyBhIGZha2VkIE1FU1NBR0UgYmFzZWQgb24gYSBjYXB0 dXJlZCByZXF1ZXN0LiZuYnNwOzxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5UPC9zcGFuPmhp cw0KIG1pZ2h0IGluY2x1ZGUgYW4gbWtleSBmcm9tIGEgY2FwdHVyZWQgSU5WSVRFLiZuYnNwOyAm bmJzcDtTbyBpdCBtYXkgYmUgcG9zc2libGUgdG8gRE9TLCBzcGFtIG9yIHRleHQtYm9tYiBhIHJl Y2lwaWVudCB1c2luZyBhIGNhcHR1cmVkIGlkZW50aXR5LiZuYnNwOyBXaGlsZSBsYXJnZS1zY2Fs ZSBvciBkaXN0cmlidXRlZCBpbXBsZW1lbnRhdGlvbnMgbWF5IG1ha2UgdGhlIGVuZm9yY2VtZW50 IGRpZmZpY3VsdCwgdGhlcmUgaXMgbGl0dGxlIGNvc3QgdG8gc2lnbmluZyBhbmQNCiBkZWNvZGlu ZyBhIG1ldGhvZCBhbmQgcG9zc2libHkgYSBudW1lcmljIElELiZuYnNwOyAmbmJzcDs8c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+U29tZSBzb3J0IG9mIOKAmDEtdXNl4oCZIHByYWN0aWNlIHNo b3VsZCBhdCBsZWFzdCBiZSBkaXNjdXNzZWQgd2hpbGUgcGVyaGFwcyBub3QgcmVxdWlyZWQuICZu YnNwOzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPlNwZWNpZmljIG1hcmt1cCBzdWdnZXN0aW9uczombmJzcDs8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ TklUUzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cHJl PiZuYnNwOyZuYnNwOyBUaGUgdmVyaWZpZXIgTVVTVCBpbnNwZWN0IGFueSBvcHRpb25hbCAmcXVv dDtwcHQmcXVvdDsgcGFyYW1ldGVyIGFwcGVhcmluZyA8Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjE2LjBwdDtjb2xvcjpyZWQiPmluPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj4g PC9zcGFuPnRoZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBJZGVudGl0eSBy ZXF1ZXN0LiZuYnNwOyBJZiBubyAmcXVvdDtwcHQmcXVvdDsgcGFyYW1ldGVyIGlzIHByZXNlbnQs IHRoZW4gdGhlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHZlcmlmaWVyIHBy b2NlZWRzIG5vcm1hbGx5IGJlbG93LiZuYnNwOyBJZiBhICZxdW90O3BwdCZxdW90OyBwYXJhbWV0 ZXIgdmFsdWUgaXM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgcHJlc2VudCwg YW5kIHRoZSB2ZXJpZmllciBkb2VzIG5vdCBzdXBwb3J0IGl0LCBpdCBNVVNUIGlnbm9yZSB0aGU8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgSWRlbnRpdHkgaGVhZGVyLiZuYnNw OyBJZiBhIHN1cHBvcnRlZCAmcXVvdDtwcHQmcXVvdDsgcGFyYW1ldGVyIHZhbHVlIGlzIHByZXNl bnQsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZSB2ZXJpZmllciBmb2xs b3dzIHRoZSBwcm9jZWR1cmVzIGJlbG93LCBpbmNsdWRpbmcgdGhlIHZhcmlhdGlvbnM8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgZGVzY3JpYmVkIGluIFN0ZXAgNS48bzpwPjwv bzpwPjwvcHJlPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGgyPjxhIG5hbWU9InNlY3Rpb24tMyI+PC9hPjxhIGhyZWY9 ImZpbGU6Ly8vQzpcVXNlcnNcYWIzNzc4XERvY3VtZW50c1xJRVRGXGRyYWZ0LWlldGYtc3Rpci1y ZmM0NDc0YmlzLTEwJTIwLSUyMEF1dGhlbnRpY2F0ZWQlMjBJZGVudGl0eSUyME1hbmFnZW1lbnQl MjBpbiUyMHRoZSUyMFNlc3Npb24lMjBJbml0aWF0aW9uJTIwUHJvdG9jb2wlMjAlMjhTSVAlMjku aHRtI3NlY3Rpb24tMyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2NvbG9yOiM5NTRGNzIiPjM8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+LiZuYnNwOw0KIEJhY2tncm91bmQ8L3NwYW4+PG86 cD48L286cD48L2gyPg0KPHByZT5b4oCmXTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBQZXIgWzxhIGhyZWY9Imh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3MzQwIiB0aXRsZT0iJnF1b3Q7U2VjdXJlIFRlbGVwaG9u ZSBJZGVudGl0eSBQcm9ibGVtIFN0YXRlbWVudCBhbmQgUmVxdWlyZW1lbnRzJnF1b3Q7Ij48c3Bh biBzdHlsZT0iY29sb3I6Izk1NEY3MiI+UkZDNzM0MDwvc3Bhbj48L2E+XSwgcHJvYmxlbXMgc3Vj aCBhcyByb2JvY2FsbGluZywgdm9pY2VtYWlsIGhhY2tpbmcsIGFuZDxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyBzd2F0dGluZyBhcmUgZW5hYmxlZCBieSBhbiBhdHRhY2tlcidz IGFiaWxpdHkgdG8gaW1wZXJzb25hdGUgc29tZW9uZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyBlbHNlLiZuYnNwOyBUaGUgc2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUCBh cHBsaWNhdGlvbnMgYW5kIHNlcnZpY2VzPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7IGRlcGVuZHMgb24gPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+YXV0aGVudGljYXRpbmcgYW5k L29yIDwvc3Bhbj5hdXRob3JpemluZyB0aGUgc291cmNlIG9mIGNvbW11bmljYXRpb25zIGFzIGl0 IGlzPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHJlcHJlc2VudGVkIGluIGEg U0lQIHJlcXVlc3QuIDxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IFRoaXMgaWRlbnRpdHkgYXJjaGl0ZWN0 dXJlIGZvciBTSVAgPHM+ZGVwZW5kcyBvbjwvcz4gPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+aW5j bHVkZXMgcHJvdmlzaW9ucyBmb3IgPC9zcGFuPmEgbG9naWNhbDxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyAmcXVvdDthdXRoZW50aWNhdGlvbiBzZXJ2aWNlJnF1b3Q7IHdoaWNo IHZhbGlkYXRlcyA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5jYWxsZXIgaWRlbnRpdHkgYXQgb3Ig bmVhciBvcmlnaW5hdGlvbi4mbmJzcDsgPC9zcGFuPjxzPm91dGdvaW5nIHJlcXVlc3RzLjwvcz4m bmJzcDsgQW48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgYXV0aGVudGljYXRp b24gc2VydmljZSBtYXkgYmUgaW1wbGVtZW50ZWQgZWl0aGVyIGFzIHBhcnQgb2YgYSB1c2VyPG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGFnZW50IG9yIGFzIGEgcHJveHkgc2Vy dmVyOyB0eXBpY2FsbHksIGl0IGlzIGEgY29tcG9uZW50IG9mIGEgbmV0d29yazxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBpbnRlcm1lZGlhcnkgbGlrZSBhIHByb3h5IHRvIHdo aWNoIG9yaWdpbmF0aW5nIHVzZXIgYWdlbnRzIHNlbmQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsgdW5zaWduZWQgcmVxdWVzdHMuJm5ic3A7IE9uY2UgdGhlIHNlbmRlciBvZiB0 aGUgbWVzc2FnZSBoYXMgYmVlbjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgYSBtZWFucyBv ZiBzaGFyaW5nIGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2U8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsgb2YgPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+YXV0aGVudGljaXR5IG9m IGFuZC9vciBhdXRob3JpemF0aW9uIHRvIHVzZSA8L3NwYW4+ZW5kLXVzZXIgU0lQIGlkZW50aXR5 IGluIGFuIGludGVyZG9tYWluIG9yIGludHJhZG9tYWluIGNvbnRleHQuPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IEl0IHJlbGllcyBvbiB0aGUgYXV0aGVudGljYXRpb24gc2Vy dmljZSBjb25zdHJ1Y3RpbmcgdG9rZW5zIGJhc2VkIG9uIFvigKZdIDxvOnA+PC9vOnA+PC9wcmU+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyBUbyBtYXhpbWl6ZSBlbmQtdG8tZW5kIHNlY3Vy aXR5LCBpdCBpcyA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj50eXBpY2FsbHkgPC9zcGFuPjxzPm9i dmlvdXNseTwvcz48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgcHJlZmVyYWJs ZSBmb3IgZW5kLXVzZXJzIHRvIGFjcXVpcmUgdGhlaXIgb3duIGNyZWRlbnRpYWxzOyBpZiB0aGV5 PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGRvLCB0aGVpciB1c2VyIGFnZW50 cyBjYW4gYWN0IGFzIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2VzLiZuYnNwOyBIb3dldmVyLDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBmb3Igc29tZSBkZXBsb3ltZW50cywgW+KA pl08bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5SZWdhcmRzLDwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5BbGV4PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7R2FyYW1vbmQmcXVvdDssc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7R2FyYW1vbmQmcXVvdDssc2VyaWY7Y29sb3I6IzFGNDk3RCI+QWxl eCBCb2JvdGVrPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny41 cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpuYXZ5Ij4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX188YnI+DQpzdGlyIG1haWxpbmcgbGlzdDxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWls dG86c3RpckBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTU0RjcyIj5zdGlyQGll dGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0i aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiM5NTRGNzIiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3Rpcjwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0i Y2VudGVyIiBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPg0KPGhyIHNpemU9IjIiIHdpZHRoPSIx MDAlIiBhbGlnbj0iY2VudGVyIj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo3LjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOmdyYXkiPjxicj4NClRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmludCBw cm9wcmlldGFyeSBpbmZvcm1hdGlvbiBpbnRlbmRlZCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBy ZWNpcGllbnQocykuIEFueSB1c2UgYnkgb3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBhcmUg bm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYW5k IGRlbGV0ZSBhbGwgY29waWVzIG9mIHRoZSBtZXNzYWdlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_595a825401b04d198dfc137546fba535PLSWE13M08adsprintcom_-- From nobody Thu Aug 4 11:34:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F32012D591 for ; Thu, 4 Aug 2016 11:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QpF_EUQK0yed for ; Thu, 4 Aug 2016 11:34:24 -0700 (PDT) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F34B12D147 for ; Thu, 4 Aug 2016 11:34:23 -0700 (PDT) Received: by mail-qk0-x232.google.com with SMTP id v123so106592127qkh.3 for ; Thu, 04 Aug 2016 11:34:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=5pPAzLDAubQSYmUO0ooYnUzJ7gvaxyA90w+DlhdvO/U=; b=oHsooXc/xYv2XOLiJKOcUlogrjXoyvOGPvlLf09DmRgs2AtWcBMO5AXyToTATxvTia IUKkaSvSsi50aNKtiTJb53euGldgTm/5dv35/PO8JxHegW6a4unsUjXnNQuX0tzOD95F L0s67IbnXg/on7Az1aOQt5Qc2NJYn3IR2vpJhii2MfQR57XR0pTFLFKN6dCSXjxohWwM A79r8NGmY11lZ+gcscXZbCim2PYoKYDM0cssegBPzAW+bQOpx/GyLhIrHHdmGjGmfM5M WdfM1y+TDfOjHKyAr6jOe8UPZiiST8KlOQq/4xrmJVcMlvwFmPVVv8TGe2qolM34uIE4 5x2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=5pPAzLDAubQSYmUO0ooYnUzJ7gvaxyA90w+DlhdvO/U=; b=nDw4ei3AbLmqTbZXeSVj7wixgTCgQOuoAPv7yN56XeBR7vmfiUwk+nPYhwjy/zFdgS LA29tWu5ksLoZMLotlPIS3o/5kWgbo0N0eaf4B9+Fo9gIBSNZULoMQGqDcp7f3nrThu7 8fp2cSY9smpUQA+K2fy5GIkC/mEBXM/7vIGMuAzSI92saCsZcfcaulwaXNnMD3XUg1qQ 2qoTf+8fH75Gxy/QSa4gm2yALnm19eZghpbc3/0yghXswHX62J15gf5z+Xkcg63X4YUi iAG8dnerxXYPHXR6ld/W1r1Erb7j2bhhsFYPBwbN9uaR6pywc3tWALAAUMVm3zq1yiUe 7Q/w== X-Gm-Message-State: AEkoouv/uZSKGjC8kE5hhVOOcEHBOm7BH2YssjvNdEYD+eHmCg2nvTuS2VeMuV6tT0YS1Q== X-Received: by 10.55.42.83 with SMTP id q80mr8413350qkh.239.1470335662547; Thu, 04 Aug 2016 11:34:22 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id g3sm7558657qkf.35.2016.08.04.11.34.20 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 11:34:21 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_758D0793-8518-4BEB-AD6F-946D09601743" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> Date: Thu, 4 Aug 2016 14:34:18 -0400 Message-Id: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 18:34:28 -0000 --Apple-Mail=_758D0793-8518-4BEB-AD6F-946D09601743 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Of course I want PBXs to sign calls. As well as smart phones and any = other devices that can be programmed to do so. They will be given credentials that only are valid for the TNs they are = authorized to sign for. They can try to sign any call, but the validity = of the credential would make such a signature fail the checking. Getting service providers to sign on behalf of devices is a reasonable = way to deploy quickly, but I expect many SPs will want to get out of the = liability of signing on behalf of their customers. If they can push of = that responsibility to their customer, only being responsible for = getting the customer an appropriate credential when they assign TNs, = then I would expect them to want to do so. That means the devices have = to be able to sign, but I understand many of the PBX vendors think = that=E2=80=99s something they could provide in a future release. Brian > On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] = wrote: >=20 > You want IP PBXes to sign calls? Won=E2=80=99t that make it = extraordinarily easy to commit fraud with authenticated numbers? > =20 > =20 > From: Brian Rosen [mailto:br@brianrosen.net]=20 > Sent: August 04, 2016 12:24 PM > To: Gorman, Pierce A [CTO] > Cc: Alex Bobotek ; stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > First of all, we would want the PBX to generate the signature, but the = service provider can do that. It should not add a valid signature to a = call from a number it did not assign to the trunk group connecting to = the PBX, although it could support the extra delegation required to = support =E2=80=9Cauthorized spoofing=E2=80=9D. The companion devices = I=E2=80=99m aware of always send calls from the same service provider = and should not present any issue.=20 > =20 > Everyone will have to do work they don=E2=80=99t do now to implement = stop spoofed calls. TANSTAAFL > =20 > Brian > =20 > On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] = > wrote: > =20 > Fraud from compromised PBXes is common. And even where a PBX is not = compromised, a carrier has no practical way of knowing whether the = calling number is properly assigned and valid from the perspective of = the Enterprise. Therefore, checking whether the calling number was from = an assigned range might be possible (and fraught with administrative = challenges), but of limited value. And in the consumer market, there = are calling products which support a parent subscriber number and = =E2=80=9Ccompanion=E2=80=9D devices (e.g., tablets) which can place a = call using the MDN of the parent subscriber. These are examples of = where the authenticity of the calling number won=E2=80=99t necessarily = mean the same thing as the authenticity of a call from a single = subscriber with a single MDN regardless of =E2=80=9Claxity=E2=80=9D of = spoof checking. > =20 > In another forum and anticipating calling number authentication = mandates from Congress and/or FCC, I suggested using carrier-specific = certs and encoding specificity of authenticity, and calling number. = This provides the identity of the originating carrier, some idea as to = the accuracy or specificity of the calling number, and validty of the = calling number (assuming nonce and replay issues can be addressed as = reasonably suggested below by Alex). > =20 > The representation of orig-carrier and trustworthiness could be as = follows: > =20 > Regulated/mandated Carrier Class Use Case: > =20 > 00 - No Credentials > Use case example(s): Pre-IMS, legacy circuit-switched networks that = don't natively support SIP or which don't choose to sign calls. E.g., = international carriers. > Trust Estimate: Good luck. Carrier_orig and CgPN entirely = untrustworthy. > =20 > 01 - Carrier signed, no authentication of CgPN > Use case example(s): E911 on visited network w/o roaming agreement, = manual roaming. > Trust Estimate: Carrier_orig trustworthy, CgPN entirely untrustworthy > =20 > 10 - Carrier signed, semi-authenticated CgPN > Use case example(s): Number block delegated from OCN, but no per-TN = screen (SIP trunks). > Trust Estimate: Carrier_orig trustworthy, CgPN less than most = trustworthy but not entirely untrustworthy. > =20 > 11 - Carrier signed, authenticated CgPN > Use case example(s): Bread-and-butter 95%+ of calls from subscriber = lines (IMS-based and otherwise). > Trust Estimate: Carrier_orig trustworthy, CgPN most trustworthy > =20 > Public Use Case: > =20 > Undefined but assumed to use public or commercially available = authentication services resources. e.g., nomorobo-like crowd-sourced = accept/deny lists, et cetera. Could/would pass credentials down to = SIP-aware devices which would process them according to the rules of the = Public Class application(s). > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net = ]=20 > Sent: August 04, 2016 9:02 AM > To: Alex Bobotek > > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > There are reasonable circumstances where a party placing a call is not = the authorized entity assigned the telephone number used in From/PAI, = and in such circumstances the service provider servicing the entity = placing the call may or may not be the same as the service provider = serving the entity that is assigned the TN. In all such cases, the = entity that is assigned the TN explicitly authorizes calls placed using = it=E2=80=99s TN. The design accommodates such use cases. It=E2=80=99s = not a blanket authorization without authentication. We=E2=80=99re not = aware of any cases where there is an actual requirement for legitimate = calling without explicit authorization from the assigned entity, = although we certainly are aware that various parts of various service = providers don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more. > =20 > Brian > =20 > On Aug 3, 2016, at 8:35 AM, Alex Bobotek > wrote: > =20 > 1. Permit authorization without authentication > In the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided identity. = Are there legitimate use cases for this? Has anyone established that = there are not? How can the industry reasonably expect to end this = (often bad) practice? If it can=E2=80=99t be ended, there=E2=80=99s = value in at least identifying the originating service provider (i.e., = the signer/authorizer). Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the abuser. = Based on the assumption that it=E2=80=99s better to ID service providers = than unreasonably expect a ban of the use of unauthenticated (and = therefore unsigned) SIP requests, STIR signing should support = authorization without authentication. The practice of authorizing = unauthenticated use exists, and there is benefit to signing in these = cases (service provider identification). The language of the ID should = permit this use. 4474bis-10 should NOT require or assume that that = authentication will precede authorization. Of course there may be other = use cases where signing includes authentication and may not include a = specific service provider=E2=80=99s authorization. > =20 > =20 > 2. Improve replay prevention > Proximate replay is possible while complying with this spec. First, = one or more proximate (e.g., within 60 seconds) SIP requests using the = same token are legal and subject to replay in many cases. An SDP = body=E2=80=99s mky may not be present and if present its use is = optional. Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) = could prevent replay. Different methods (e.g., INVITE vs MESSAGE) might = be handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured request. This = might include an mkey from a captured INVITE. So it may be possible to = DOS, spam or text-bomb a recipient using a captured identity. While = large-scale or distributed implementations may make the enforcement = difficult, there is little cost to signing and decoding a method and = possibly a numeric ID. Some sort of =E2=80=981-use=E2=80=99 practice = should at least be discussed while perhaps not required. =20 > =20 > =20 > Specific markup suggestions: =20 > =20 > =20 > NITS > =20 > The verifier MUST inspect any optional "ppt" parameter appearing in = the > Identity request. If no "ppt" parameter is present, then the > verifier proceeds normally below. If a "ppt" parameter value is > present, and the verifier does not support it, it MUST ignore the > Identity header. If a supported "ppt" parameter value is present, > the verifier follows the procedures below, including the variations > described in Step 5. > =20 > <>3 = . Background >=20 > [=E2=80=A6] > =20 > Per [RFC7340 ], problems such = as robocalling, voicemail hacking, and > swatting are enabled by an attacker's ability to impersonate = someone > else. The secure operation of most SIP applications and services > depends on authenticating and/or authorizing the source of = communications as it is > represented in a SIP request.=20 > =20 > This identity architecture for SIP depends on includes provisions = for a logical > "authentication service" which validates caller identity at or near = origination. outgoing requests. An > authentication service may be implemented either as part of a user > agent or as a proxy server; typically, it is a component of a = network > intermediary like a proxy to which originating user agents send > unsigned requests. Once the sender of the message has been > =20 > =20 > This document specifies a means of sharing a cryptographic = assurance > of authenticity of and/or authorization to use end-user SIP = identity in an interdomain or intradomain context. > It relies on the authentication service constructing tokens based = on [=E2=80=A6]=20 > =20 > =20 > =20 > To maximize end-to-end security, it is typically obviously > preferable for end-users to acquire their own credentials; if they > do, their user agents can act as authentication services. However, > for some deployments, [=E2=80=A6] > =20 > =20 > Regards, > =20 > Alex=20 > =20 > Alex Bobotek > =20 > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > =20 >=20 > This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. --Apple-Mail=_758D0793-8518-4BEB-AD6F-946D09601743 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Of course I want PBXs to sign calls.  As well as smart = phones and any other devices that can be programmed to do so.
They will be given credentials that only are valid for the = TNs they are authorized to sign for.  They can try to sign any = call, but the validity of the credential would make such a signature = fail the checking.

Getting service providers to sign on behalf of devices is a = reasonable way to deploy quickly, but I expect many SPs will want to get = out of the liability of signing on behalf of their customers.  If = they can push of that responsibility to their customer, only being = responsible for getting the customer an appropriate credential when they = assign TNs, then I would expect them to want to do so.  That means = the devices have to be able to sign, but I understand many of the PBX = vendors think that=E2=80=99s something they could provide in a future = release.

Brian

On Aug 4, 2016, at 2:22 PM, = Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

You want IP PBXes to sign calls?  Won=E2=80=99t = that make it extraordinarily easy to commit fraud with authenticated = numbers?
 
 
From: Brian = Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 12:24 PM
To: Gorman, Pierce A [CTO] = <Pierce.Gorman@sprint.com>
Cc: Alex = Bobotek <alex@bobotek.net>; stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
First of all, we would want the PBX to = generate the signature, but the service provider can do that.  It = should not add a valid signature to a call from a number it did not = assign to the trunk group connecting to the PBX, although it could = support the extra delegation required to support =E2=80=9Cauthorized = spoofing=E2=80=9D.  The companion devices I=E2=80=99m aware of = always send calls from the same service provider and should not present = any issue. 
 
Everyone will have to do work they don=E2=80=99t do = now to implement stop spoofed calls. TANSTAAFL
 
Brian
 
On Aug 4, 2016, at = 12:41 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> = wrote:
 
Fraud from compromised PBXes is common.  And = even where a PBX is not compromised, a carrier has no practical way of = knowing whether the calling number is properly assigned and valid from = the perspective of the Enterprise.  Therefore, checking whether the = calling number was from an assigned range might be possible (and fraught = with administrative challenges), but of limited value.  And in the = consumer market, there are calling products which support a parent = subscriber number and =E2=80=9Ccompanion=E2=80=9D devices (e.g., = tablets) which can place a call using the MDN of the parent = subscriber.  These are examples of where the authenticity of the = calling number won=E2=80=99t necessarily mean the same thing as the = authenticity of a call from a single subscriber with a single MDN = regardless of =E2=80=9Claxity=E2=80=9D of spoof checking.
 
In another forum and = anticipating calling number authentication mandates from Congress and/or = FCC, I suggested using carrier-specific certs and encoding specificity = of authenticity, and calling number.  This provides the identity of = the originating carrier, some idea as to the accuracy or specificity of = the calling number, and validty of the calling number (assuming nonce = and replay issues can be addressed as reasonably suggested below by = Alex).
 
The representation of orig-carrier and = trustworthiness could be as follows:
 
Regulated/mandated Carrier Class Use Case:
 
00= - No Credentials
Use case example(s): Pre-IMS, legacy circuit-switched = networks that don't natively support SIP or which don't choose to sign = calls.  E.g., international carriers.
Trust Estimate:  Good luck.  Carrier_orig and CgPN = entirely untrustworthy.
 
01= - Carrier signed, no authentication of CgPN
Use case example(s): E911 on visited network w/o = roaming agreement, manual roaming.
Trust Estimate:  Carrier_orig trustworthy, CgPN entirely = untrustworthy
 
10= - Carrier signed, semi-authenticated CgPN
Use case example(s): Number block delegated from = OCN, but no per-TN screen (SIP trunks).
Trust Estimate:  Carrier_orig trustworthy, CgPN less = than most trustworthy but not entirely untrustworthy.
 
11 - Carrier signed, authenticated = CgPN
Use case example(s): Bread-and-butter 95%+ of = calls from subscriber lines (IMS-based and otherwise).
Trust Estimate:  Carrier_orig trustworthy, CgPN most = trustworthy
 
Public Use Case:
 
Undefined but assumed to use public or = commercially available authentication services resources.  e.g., = nomorobo-like crowd-sourced accept/deny lists, et cetera.  = Could/would pass credentials down to SIP-aware devices which would = process them according to the rules of the Public Class = application(s).
 
Pierce
 
From: Brian Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 9:02 AM
To: Alex Bobotek <alex@bobotek.net>
Cc: stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
There are reasonable circumstances where a party placing a = call is not the authorized entity assigned the telephone number used in = From/PAI, and in such circumstances the service provider servicing the = entity placing the call may or may not be the same as the service = provider serving the entity that is assigned the TN.  In all such = cases, the entity that is assigned the TN explicitly authorizes calls = placed using it=E2=80=99s TN.  The design accommodates such use = cases.  It=E2=80=99s not a blanket authorization without = authentication.   We=E2=80=99re not aware of any cases where there = is an actual requirement for legitimate calling without explicit = authorization from the assigned entity, although we certainly are aware = that various parts of various service providers don=E2=80=99t bother to = check. At this point, at least in some countries, there is a realization = that the laxity of allowing unchecked spoofing is not acceptable any = more.
 
Brian
 
On = Aug 3, 2016, at 8:35 AM, Alex Bobotek <alex@bobotek.net> wrote:
 
1.       Permit authorization without authentication
In= the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided = identity.  Are there legitimate use cases for this?  Has = anyone established that there are not?  How can the industry = reasonably expect to end this (often bad) practice?  If it = can=E2=80=99t be ended, there=E2=80=99s value in at least identifying = the originating service provider (i.e., the = signer/authorizer).  Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the = abuser.  Based on the assumption that it=E2=80=99s better to ID = service providers than unreasonably expect a ban of the use of = unauthenticated (and therefore unsigned) SIP requests, STIR signing = should support authorization without authentication.  The practice = of authorizing unauthenticated use exists, and there is benefit to = signing in these cases (service provider identification).  The = language of the ID should permit this use.  4474bis-10 should NOT = require or assume that  that authentication will precede = authorization. Of course there may be other use cases where signing = includes authentication and may not include a specific service = provider=E2=80=99s authorization.
 
 
2.       Improve replay prevention
Proximate replay is possible while complying with this spec.  First, one = or more proximate (e.g., within 60 seconds) SIP requests using the same = token are legal and subject to replay in many cases.  An SDP = body=E2=80=99s mky may not be present and if present its use is = optional.  Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) could prevent = replay.  Different methods (e.g., INVITE vs MESSAGE) might be = handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured = request. This might include an mkey from a captured = INVITE.   So it may be possible to DOS, spam or text-bomb a = recipient using a captured identity.  While large-scale or = distributed implementations may make the enforcement difficult, there is = little cost to signing and decoding a method and possibly a numeric = ID.   Some = sort of =E2=80=981-use=E2=80=99 practice should at least be discussed = while perhaps not required.  
 
 
Specific markup suggestions:  
 
 
NITS
 
   The verifier MUST inspect any optional "ppt" =
parameter appearing in =
the
   Identity request.  If no "ppt" parameter is =
present, then the
   verifier proceeds normally below.  If a =
"ppt" parameter value is
   present, and the verifier does not support it, =
it MUST ignore the
   Identity header.  If a supported "ppt" =
parameter value is present,
   the verifier follows the =
procedures below, including the variations
   described in Step 5.
 

3.  = Background

[=E2=80=A6]
 
   Per [RFC7340], =
problems such as robocalling, voicemail hacking, and
   =
swatting are enabled by an attacker's ability to impersonate someone
   =
else.  The secure operation of most SIP applications and =
services
   depends on authenticating and/or authorizing the source of =
communications as it is
   represented in a SIP request.
 
   This identity architecture for SIP depends on includes =
provisions for a logical
   "authentication service" which =
validates caller identity at or =
near origination.  outgoing =
requests.  An
   authentication service may be implemented either =
as part of a user
   agent or as a proxy server; typically, it is a =
component of a network
   intermediary like a proxy to which originating =
user agents send
   unsigned requests.  Once the sender of the =
message has been
 
 
   This document specifies a means =
of sharing a cryptographic assurance
   of authenticity of and/or authorization to use end-user =
SIP identity in an interdomain or intradomain context.
   It =
relies on the authentication service constructing tokens based on [=E2=80=A6=
]
 
 
 
   To maximize end-to-end security, it is typically obviously
   preferable for end-users to acquire their own =
credentials; if they
   do, their user agents can act as authentication =
services.  However,
   for some deployments, [=E2=80=A6]
 
 
Regards,
 
Alex 
 
Alex Bobotek
 
 
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
 

This e-mail may = contain Sprint proprietary information intended for the sole use of the = recipient(s). Any use by others is prohibited. If you are not the = intended recipient, please contact the sender and delete all copies of = the = message.

= --Apple-Mail=_758D0793-8518-4BEB-AD6F-946D09601743-- From nobody Thu Aug 4 11:41:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64EAE12DAC1 for ; Thu, 4 Aug 2016 11:41:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jwQtIOeg0k3a for ; Thu, 4 Aug 2016 11:41:40 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B52312D1BC for ; Thu, 4 Aug 2016 11:41:40 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u74IfaSd002741 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 4 Aug 2016 11:41:37 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470336097; bh=IWeEmvmUkNBCO1gLzBZFL1y7cLhf2khqAv4YxLYKjvs=; h=Subject:To:References:From:Reply-To:Cc:Date:In-Reply-To:From; b=E0smv2Q4Z6srmtkynTYpcbBGAhYW4K30WUmnbhvQIkF4OHDpSGSK8aNcJ3uJMP789 zom0h70VtEcMDDLbtnoiCj5JWKQ+YNyd3s8MH/QA0SeAgPs/GklN78NscnvhacZ9jX h1+m6GWUwoflemqTxtfxA9eWPdmWaFQSxZWCBo1Y= To: Paul Kyzivat References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Thu, 4 Aug 2016 11:41:21 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 18:41:41 -0000 On 8/4/2016 10:03 AM, Paul Kyzivat wrote: > I have been loosely following this discussion. IIUC, one of Dave's > arguments is that SIP implementations don't currently involve JSON, so > introducing it with STIR will further complicate those implementations. > > But, again IIUC, the use of JSON with passport doesn't require anyone to > *parse* JSON. It is only necessary to *generate* a very special purpose > JSON and then generate a signature over it. Clever point. I think you are correct, except for the contents of the so-called "ppt" parameter, which does require parsing. Now about JWT...? From my reading, so far, I suspect the answer for JWT is the same as for JSON? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 4 11:52:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C4EE12D778 for ; Thu, 4 Aug 2016 11:52:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IIaz4T9HG2A4 for ; Thu, 4 Aug 2016 11:52:39 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0105.outbound.protection.outlook.com [104.47.41.105]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13F2B12DAC1 for ; Thu, 4 Aug 2016 11:52:37 -0700 (PDT) Received: from BL2FFO11OLC008.protection.gbl (10.173.160.30) by BL2FFO11HUB029.protection.gbl (10.173.161.53) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.5; Thu, 4 Aug 2016 18:52:35 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.80) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.80 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.80; helo=preapdm1.corp.sprint.com; Received: from preapdm1.corp.sprint.com (144.230.32.80) by BL2FFO11OLC008.mail.protection.outlook.com (10.173.160.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Thu, 4 Aug 2016 18:52:35 +0000 Received: from pps.filterd (preapdm1.corp.sprint.com [127.0.0.1]) by preapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u74InV7V044098; Thu, 4 Aug 2016 14:52:35 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm1.corp.sprint.com with ESMTP id 24grqeq4sx-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 04 Aug 2016 14:52:35 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 4 Aug 2016 13:52:31 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Thu, 4 Aug 2016 13:52:31 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA490iQgABp2QD//7d2kIAAXCcA//+wgXA= Date: Thu, 4 Aug 2016 18:52:30 +0000 Message-ID: <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: multipart/alternative; boundary="_000_837ed8129f6a4b14ba524f7e154540b9PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.80; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(199003)(377454003)(189002)(24454002)(2906002)(189998001)(68736007)(356003)(93886004)(7906003)(19580395003)(19580405001)(108616004)(86362001)(7696003)(3846002)(33646002)(7846002)(5250100002)(4326007)(84326002)(102836003)(24736003)(790700001)(8936002)(110136002)(19617315012)(30436002)(87936001)(16236675004)(15975445007)(2900100001)(11100500001)(106116001)(6116002)(97736004)(512874002)(8676002)(81156014)(81166006)(19625215002)(54356999)(19300405004)(92566002)(7736002)(106466001)(4546004)(586003)(50986999)(2950100001)(76176999)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2FFO11HUB029; H:preapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11OLC008; 1:PAs9d8BaCMAHG8YklFUwcevHPAjsicygiRoBbucrDV0dSHgd5pFEyMCspr3wCbYnn+lPt0qdWXtYmqYWiyHRNWk/Zailgn2qU6JzdylZKylfO1YdkjOFB++uZgs03t+jiu89cTftoxBDRNz3q9HcA6QLhZ8JvhAzx8IQ44FK5JXZbEMuZxC18f9RVW8cv+j53ZXHaU2+/T64y9R+jizOn2YN3eNSwxx/IM9E1/D3PjfM+YVrfckz0kxqnLiVIIdpY7g6TTHx/X4uHS1IbbfwRR9DyAlrna6gTlJXEr6detkM92KPcaIPz/1ILb+bB1kHCEAMvLG8SfsPOaipVElTD7XOQvNyPt38Uk3cvrnkx1aGwmI3jLcOLOKIMx6NxbABwVczg9za99p7Z7E32++8/Y/Ofhhm7m/gUJZdoPkIKUe8AwKk4kVOKcRQd7Y0GzrX7NIcBTA1yh++IkauoOimTJZZRqyulwA1fvnRIW2o1u/0DCXTWl+z60adag1O+fB9Z88eVhwKB3gt2qMg1dXdy88D6729Xd0USmbvQqGQV0eT3UhmLarX/WcEZMYGaQvt X-MS-Office365-Filtering-Correlation-Id: 45d4e555-6ee9-482e-5800-08d3bc987fcf X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 2:p0UULNSGkgPDkAP2mgvgl18hFartBlGj9MAGqEfIG1msDx860ythUjri5L0euzNZH/XjNfA85M/Y/U2mwFMYJEfFKvyD5ISxbE1JJhLdjnSqJC8oN3Iz28rMro/Z8sUNK7dkvdyC0/AL1kM4GICc1QCXOb+IhWtn6Ev/IPN3MDJ11B51Pl1IPqYSDzjzs5Sf; 3:fhEuECVNcVGM0vovg1IBra67RZRqPw2ifalhTF2qRd0iPHPWUWP9reqFPk9VwV0C7O9QpUb4nReFDvZatucnJiWCVg3O2wYmepyo2e1aJECKJUvSNVZI1lo/z8PBzIbPQarVPM0mmPoW3mJlco3klvSttFezt/0OiES2OoiYAxiHe8ks4l3ws0Qvn2Th85zdFxfRRBKX9dWnNSygHr28Dv0ObAatv/9KyXB4Ie4SAg2iwRReQKbAQvqgOpkZLD02N0fRfd0I4SppHMsW6vZn9Q== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BL2FFO11HUB029; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2FFO11HUB029; 25:koyP2bRbbgvU9S4jeHyRBWeMS1Fx7yBYfZvDTUhP?= =?us-ascii?Q?ajx0wGI4vmFzGOj4xq+33SM8FivhVRjivcAk7Y7KVIl4Om36YpSigyRhZnkk?= =?us-ascii?Q?gFunCo+idBIgAWfF6nme5vRdz6Kpzji0bhB9qFB8w37V+W5v6BY/U56V76mO?= =?us-ascii?Q?BOcwz0O4gWcwfKUFctFSv4dfUZyeyCudAwlnimck2Eyn0QrAFKy2hWTkFmi5?= =?us-ascii?Q?9xMemvlMaYB31rsCygev5yLNpncXhCF7d2vlOiFg7n8nBWtvUhBgiT00NS6z?= =?us-ascii?Q?O9Lw5sSSc4A5Iapu1aikzM+h18jndnxuncRbAz57GF7XMnTmwhFZe93kQ62K?= =?us-ascii?Q?+Rg/ZQdc8rGy23VRSyrOoSvwSsL0ikBBk3oGMae6lHpVQ4csl9fK8VgVOFOF?= =?us-ascii?Q?kKSMOLOeq+gXTBI8lVJ3Tp8Tn/LBwVvcsBvrpXCTCFIXzziPefZ+Z6Gr2TSz?= =?us-ascii?Q?8wD7u2WzDdsK+ZQI5PLk9QBMBjjoITX2NZV4lA3CmRxpZBDZp/Jwf77Q0kyQ?= =?us-ascii?Q?AzNCqxmQZG9gynmijeAkg3jtmpbHc+XX74FT5F0mL0c3wMFWwDrDxSv98DKk?= =?us-ascii?Q?CK1uwgXpNfMa8sgee127mPKsFSx6rFRwq8WyCaR530+yMyK7Ia9YsAOm4oaE?= =?us-ascii?Q?PaoOsEvtUcyBS2631CFoi6349MezvatD9hDI+3+0TtniHPta5HHQzdSFvRcJ?= =?us-ascii?Q?EIo6VzPfSWfFeI1znJ8ZqmH62eElwBG4WWahniSXSkREY6TprhY1m6yjYMCA?= =?us-ascii?Q?qgpD7y/EzKEOdBH7RsCedfj0966+1J1JO23EJ9hUh25Fzq+Zw4PHRHB3ozPe?= =?us-ascii?Q?Hkb2sU83kVB3/k603ioPE493+qZgdyik8NA4wExtX9ID4S8A1ygrGmqEFgQT?= =?us-ascii?Q?2SyHIgGa0hMXkBoGMDxEb/lolxdXnByNBywEVm2ZFbMvEgV2X2K0VP9HS5hn?= =?us-ascii?Q?CQu5UpBL7+F9R7H3O7NKgSQriDinyes9yI6Cjlgiz+e7JN48H/5jdcxdvFV/?= =?us-ascii?Q?bQRBj1mYj5zS6eX9ccgQ2+NNZkWyxgsRK2Wm57yClPWe5A=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 31:WXlOOWdXfR7UW4EOLLW8nIjHimn45tBPZaCAT/GdCFbHKZLGvK9dai1ZtG1tODEbsPamAqOqpzYdaOcBMbI7h6MXX6mnF1DlJoORX8Rk9JyVNH/DbOiDQl79WIrrylo+j4SoocQsPa6xGjs6UedLcMVIVeW7toRE8aeEKzQNtkZZ7PMHHLuoh7UfivmsK6jattVpwe+6mWsk0o/YisotEABkNPsRovw5/TyZBQVlsOY=; 20:P7cNtsmJHrIrGP+peuJsyq8qbTr3Oc89poTUQ+/gDMR33X64QrIVpEn6m6Uo9evGn8qFfvv8MQfT2831mwRe0QE1Btwos0o4laojoLYGz0jCpKt0koYWBH+AFZKg4vZy6P8TUhLLPotyOv7OpkGbj3db7Wd6GwmNbWbRixD21p7zsUVOmPDgfBzEv88tgpualNRBw+H7ZIZYnscKtC2p0OTO3xPdFjlPWo8MUMPHFNUaqiRmju0EXCZzjIDRd/5xniSm64uGI4RKKlB6XobzUpgEkRB5825/YcYO2bLu22G7Jl7wwb9mZ0ZQH6NwtyU9VF9E5xiCVqhZQ7jx86aG0zBx+z8GM5VhFKjD+jjaGT/TcjCTdDVeVt0RBUot98ScpJsgL7ur8eIvq4O1JtL3SgsMisYkyEDsCHbh2YuWlms= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(278428928389397)(192374486261705)(18430343700868)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(5005006)(8121501046)(13018025)(13023025)(13024025)(13015025)(13017025)(10201501046)(3002001)(6055026); SRVR:BL2FFO11HUB029; BCL:0; PCL:0; RULEID:; SRVR:BL2FFO11HUB029; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 4:/wFHOwidRIsi0BVnnFyhp0+vv3IglcXiSzDLw0LomGV3W5NR9W4k1QUzAutQcA+gutG5Nov8HcC8DyDvVpf0BrqdOH0Y39MXJPqd36JKl3zTyr8DUuVQlYFX9NYY8txa94dJlSDC9Lv6eiut9tnnfnle5XRyOC2sdnapvPsjWncbd5k0PMB4Ne63er6jtlzwb8kOX2Pz1+CAlDGw5h63HVcum9r74OucvZJauBz/oGHYFKTrNb6dUJwMEOsWB+4Mno07Mg/yobWOhlTKfkWDUgUDw04dgfzJN76AtWJ6yGzx5R1MTisNmhkaal5yuLNnrj7KC3LtYle0G+2bXFTIskLrJ9E2pSknOwfor0QzEWjE1uNX4nr9ima3bhIrzCARfco72KeNVbuGr2VFPJ2uxGK/BnaRhMts9lshrhuyqMmMXVB76JequgR9TPWTr/1/lCKH4VIkKaHPGm9dh/YkqZ93hJ2QiwiKOn0+EzJydGqFtzj5fGTBN1o+F0aWuahlx7tdcoEPgSsaXemzXTLVCSqO70FzaacPajiO7pZ3v4Q4sOZAr2cVliNpKAtkWtRcO1t/Vw2PH72RQ5nag6qCQurqkmlI82r5LJ7MWuGr5blUQPAKB1khd455V6uMNb3I9mpeawI6l9uUPPERfIl28DzhKwmEXZtLe1vMhkzKeio= X-Forefront-PRVS: 00246AB517 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2FFO11HUB029; 23:5gD9xeVbz12lxRtNdaEboUE6lpHhUSu0zfTGRR5X?= =?us-ascii?Q?EXas05nahqO1fcyUlL+tjg8T2wNfpY55hBqZUGbWSWnQCEsVYKxDOmLahJLg?= =?us-ascii?Q?Q2k4YFfYtsd24IBZHKRyw/vCzLRi+k3iNVMjuwHBf5nnDyignWwVbKtWUnm/?= =?us-ascii?Q?QDg43U2dcF90QHuFFUING8DEFM6riBdEfpzG7DMHg6Y5LypZpNCYwr7xkOCY?= =?us-ascii?Q?kuww41kcosDKWMWKP9u5uDo/k+5ph3g4NUyl+zwin9g88AuuL/OBVlvQpt4r?= =?us-ascii?Q?TuUAj0KmFgzRqfKWqKo98ywMc4xbSRm7B56TBeYFsvBpe/hllgkg+SqTchMo?= =?us-ascii?Q?22flZTAXqvgvSJ2ENzArEyuFb3bpGBLTq3tozkSehAJaksS+me0L/62+IkOd?= =?us-ascii?Q?YkkvLVt+figXvX9RLhE6mCbSAyQaqcTUHsUZjK1g32ltIqz3CX+Mvdf12PsF?= =?us-ascii?Q?Nd9/Gfcgl9zoyu+RQQMcF3GcDagbJtcq2i2N5ammb3wb0IStgytQNhPrC8j0?= =?us-ascii?Q?2zOmApGSejTABdv0hNq0RF3VsFVLAOlhdXNmQR9YWv6s2eA4Itc+InGLllXH?= =?us-ascii?Q?6d/lK9p/0jOJsKTXsjet3RNmYx0fxVwjpSeDN0Uh2riq7nkTUqFTJf5AAurq?= =?us-ascii?Q?zbiy20tDWtyMV1CQ6RBpNqagvaZzdHr8iGRHfSszOtS7pwgdU7rKFuA/v+vs?= =?us-ascii?Q?EMTL2IgZniq2O3BRhzQff5elfD+RH+e9u8hfTDQoY25Z6D82dKzdOvYejXMg?= =?us-ascii?Q?9Wb2DqRLygYihw1Its1noTgXr9D+63jFkeq0Rh8MBOmN6pR2vqwjp4UMkguw?= =?us-ascii?Q?su7a/q4ZIrx9RpoKCZvId7WsLrt1WAvo29Coss3nu9fCcDNdPBEh4VTFzVIV?= =?us-ascii?Q?Px8o9oXPOiEN6POfY04yArENi648g9infOf9KtT/JLJTtajk3NyfKjx2esG/?= =?us-ascii?Q?6HN80O4C31ZkXolCJ573lv8118c0hT5FhVYXhtjcoC3BcsyQTd4SkYHthwDs?= =?us-ascii?Q?NWHKgwl4L4bBY2yLU/asgL6T9ZVR0j+LkDDKgwbOMhek24haaWKI8q8HwkTu?= =?us-ascii?Q?hjVlfPTONt6+83C1dDWHWbTJ9sUWZ9a03pomfdgjOwmU0e89NWJ5Do6PfD8u?= =?us-ascii?Q?75/8+Gfs8XDnhRQIe+aXGyWWfpZwSUN3XV40Go4+xGof156MNHamdDbCiieV?= =?us-ascii?Q?gPoIsOvm+xoLyeDTmcy/mumWtUjMaXCos+Ad492cCB+1Dlv7Tp6tr3/cxgVE?= =?us-ascii?Q?9bmAdK2lBAx2NrkqRw+cy3iOOasAb+2UkJrD/l9goW9Nkx7knnt2lexBaKV8?= =?us-ascii?Q?w1rxpuPNwnQ1PMFNCIzMpI6OEldXFH/bvfuur9+ZcBcZ5UJYYSlKUrrTwrww?= =?us-ascii?Q?0pJeeA=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 6:iaOnHfFqqKIiqzE04Ev6yfT/ugLZMBl8ZCWbLKxR8fEdagXimiNmD6sxHzZz3WCmfqKM+Yk1f5p2IOxdzv6CGNUqJrptE88II/8W8dLRbSFfcy8TYwfgqMKup0hca8MQsgW8JjQMCFEbhIZ6aBNBkc//AKs3fvEuX+Ja/E96jj1RdKiNM7rvilT20t5jrkICOOSP5GNZ4xhbfthAgcc2t4D120Ld2ogqrJwFDVD44/k/3Fz+OybCaGZdu3gWOMNZ6re37mc4YPsgxerHoPNfL6E+iCZRbjFDHHQbKxIqbsz6JkZrsKYNCtAQoVDxDd4l5Kn87JXQqsvfysoBPmGdCw==; 5:pB3Vlm5DEcNU6cr/3/LxS+QOoElPX0EAowPBvz5TZYzvRFZ8EeRLcOQEnCDskfJufX+BdJE86/2ybFb/ASNpUtVc6djNhXgHYqYdLCO7Hvo45pfo+K3PdzYjNSiT+319WQJ6Ycd6jXty5QVJOV+MPQ==; 24:/SmA37wzEJK+PSWoaVhrDpZPrfUch3KmWwGdnVQcCuc2ipOZEqV14Pv7lrJwxdCCxNu/Vx9cfwZJUyLQUbwpM3LZNtHLWsnhOluKJ1RQgq8=; 7:z76fqDkV09fYQZ4f6H+QVq+LQ+eUnzFxBqA5Aq2yZgRvnnCiTdbt3Dtc44AGSvwc8NmHhGm3cezuYDecYeU4MhPaMy04R9jkJUuK57S5YE9U1ViP+1d4Q2Mzj00fElW6vNE7ITN3VtBBTAt7ISYytE6O6g+i7/D2buU+tawies5jNqMX44hJ/FhfcEKtQTtVbhFSbYYccr2dhPSFfyXb2ilxubWiPWeaUiu0XSvtkdJ3QKl4MmbcnE7gB94ThnbN SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2016 18:52:35.3937 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.80]; Helo=[preapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2FFO11HUB029 Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 18:52:43 -0000 --_000_837ed8129f6a4b14ba524f7e154540b9PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIEJyaWFuLiAgSeKAmW0gYWZyYWlkIHdl4oCZcmUgc3RyYXlpbmcgaW50byBhIHBvbGlj eSBkaXNjdXNzaW9uLiAgUmVnYXJkbGVzcywgSSBkbyBhcHByZWNpYXRlIHlvdXIgZXhwbGFuYXRp b24uICBJIHdvdWxkIGxpa2UgdG8gY29udGludWUgdGhlIGRpc2N1c3Npb24sIGJ1dCBJ4oCZbSBw cmV0dHkgc3VyZSB0aGlzIGlzbuKAmXQgdGhlIHJpZ2h0IGZvcnVtLg0KDQpQaWVyY2UNCg0KRnJv bTogQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NClNlbnQ6IEF1Z3VzdCAw NCwgMjAxNiAxOjM0IFBNDQpUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1h bkBzcHJpbnQuY29tPg0KQ2M6IEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldD47IHN0aXJA aWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQoN Ck9mIGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBhcyBzbWFydCBw aG9uZXMgYW5kIGFueSBvdGhlciBkZXZpY2VzIHRoYXQgY2FuIGJlIHByb2dyYW1tZWQgdG8gZG8g c28uDQpUaGV5IHdpbGwgYmUgZ2l2ZW4gY3JlZGVudGlhbHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBm b3IgdGhlIFROcyB0aGV5IGFyZSBhdXRob3JpemVkIHRvIHNpZ24gZm9yLiAgVGhleSBjYW4gdHJ5 IHRvIHNpZ24gYW55IGNhbGwsIGJ1dCB0aGUgdmFsaWRpdHkgb2YgdGhlIGNyZWRlbnRpYWwgd291 bGQgbWFrZSBzdWNoIGEgc2lnbmF0dXJlIGZhaWwgdGhlIGNoZWNraW5nLg0KDQpHZXR0aW5nIHNl cnZpY2UgcHJvdmlkZXJzIHRvIHNpZ24gb24gYmVoYWxmIG9mIGRldmljZXMgaXMgYSByZWFzb25h YmxlIHdheSB0byBkZXBsb3kgcXVpY2tseSwgYnV0IEkgZXhwZWN0IG1hbnkgU1BzIHdpbGwgd2Fu dCB0byBnZXQgb3V0IG9mIHRoZSBsaWFiaWxpdHkgb2Ygc2lnbmluZyBvbiBiZWhhbGYgb2YgdGhl aXIgY3VzdG9tZXJzLiAgSWYgdGhleSBjYW4gcHVzaCBvZiB0aGF0IHJlc3BvbnNpYmlsaXR5IHRv IHRoZWlyIGN1c3RvbWVyLCBvbmx5IGJlaW5nIHJlc3BvbnNpYmxlIGZvciBnZXR0aW5nIHRoZSBj dXN0b21lciBhbiBhcHByb3ByaWF0ZSBjcmVkZW50aWFsIHdoZW4gdGhleSBhc3NpZ24gVE5zLCB0 aGVuIEkgd291bGQgZXhwZWN0IHRoZW0gdG8gd2FudCB0byBkbyBzby4gIFRoYXQgbWVhbnMgdGhl IGRldmljZXMgaGF2ZSB0byBiZSBhYmxlIHRvIHNpZ24sIGJ1dCBJIHVuZGVyc3RhbmQgbWFueSBv ZiB0aGUgUEJYIHZlbmRvcnMgdGhpbmsgdGhhdOKAmXMgc29tZXRoaW5nIHRoZXkgY291bGQgcHJv dmlkZSBpbiBhIGZ1dHVyZSByZWxlYXNlLg0KDQpCcmlhbg0KDQpPbiBBdWcgNCwgMjAxNiwgYXQg MjoyMiBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29t PG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+PiB3cm90ZToNCg0KWW91IHdhbnQgSVAg UEJYZXMgdG8gc2lnbiBjYWxscz8gIFdvbuKAmXQgdGhhdCBtYWtlIGl0IGV4dHJhb3JkaW5hcmls eSBlYXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRoIGF1dGhlbnRpY2F0ZWQgbnVtYmVycz8NCg0KDQpG cm9tOiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KU2VudDogQXVndXN0 IDA0LCAyMDE2IDEyOjI0IFBNDQpUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdv cm1hbkBzcHJpbnQuY29tPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KQ2M6IEFs ZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBz dGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtzdGlyXSBT VElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCg0KRmlyc3Qgb2YgYWxsLCB3ZSB3b3VsZCB3YW50IHRo ZSBQQlggdG8gZ2VuZXJhdGUgdGhlIHNpZ25hdHVyZSwgYnV0IHRoZSBzZXJ2aWNlIHByb3ZpZGVy IGNhbiBkbyB0aGF0LiAgSXQgc2hvdWxkIG5vdCBhZGQgYSB2YWxpZCBzaWduYXR1cmUgdG8gYSBj YWxsIGZyb20gYSBudW1iZXIgaXQgZGlkIG5vdCBhc3NpZ24gdG8gdGhlIHRydW5rIGdyb3VwIGNv bm5lY3RpbmcgdG8gdGhlIFBCWCwgYWx0aG91Z2ggaXQgY291bGQgc3VwcG9ydCB0aGUgZXh0cmEg ZGVsZWdhdGlvbiByZXF1aXJlZCB0byBzdXBwb3J0IOKAnGF1dGhvcml6ZWQgc3Bvb2ZpbmfigJ0u ICBUaGUgY29tcGFuaW9uIGRldmljZXMgSeKAmW0gYXdhcmUgb2YgYWx3YXlzIHNlbmQgY2FsbHMg ZnJvbSB0aGUgc2FtZSBzZXJ2aWNlIHByb3ZpZGVyIGFuZCBzaG91bGQgbm90IHByZXNlbnQgYW55 IGlzc3VlLg0KDQpFdmVyeW9uZSB3aWxsIGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbuKAmXQgZG8g bm93IHRvIGltcGxlbWVudCBzdG9wIHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTA0KDQpCcmlhbg0K DQpPbiBBdWcgNCwgMjAxNiwgYXQgMTI6NDEgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBp ZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbTxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4g d3JvdGU6DQoNCkZyYXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29tbW9uLiAgQW5kIGV2 ZW4gd2hlcmUgYSBQQlggaXMgbm90IGNvbXByb21pc2VkLCBhIGNhcnJpZXIgaGFzIG5vIHByYWN0 aWNhbCB3YXkgb2Yga25vd2luZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciBpcyBwcm9wZXJs eSBhc3NpZ25lZCBhbmQgdmFsaWQgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgdGhlIEVudGVycHJp c2UuICBUaGVyZWZvcmUsIGNoZWNraW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVtYmVyIHdhcyBm cm9tIGFuIGFzc2lnbmVkIHJhbmdlIG1pZ2h0IGJlIHBvc3NpYmxlIChhbmQgZnJhdWdodCB3aXRo IGFkbWluaXN0cmF0aXZlIGNoYWxsZW5nZXMpLCBidXQgb2YgbGltaXRlZCB2YWx1ZS4gIEFuZCBp biB0aGUgY29uc3VtZXIgbWFya2V0LCB0aGVyZSBhcmUgY2FsbGluZyBwcm9kdWN0cyB3aGljaCBz dXBwb3J0IGEgcGFyZW50IHN1YnNjcmliZXIgbnVtYmVyIGFuZCDigJxjb21wYW5pb27igJ0gZGV2 aWNlcyAoZS5nLiwgdGFibGV0cykgd2hpY2ggY2FuIHBsYWNlIGEgY2FsbCB1c2luZyB0aGUgTURO IG9mIHRoZSBwYXJlbnQgc3Vic2NyaWJlci4gIFRoZXNlIGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0 aGUgYXV0aGVudGljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciB3b27igJl0IG5lY2Vzc2FyaWx5 IG1lYW4gdGhlIHNhbWUgdGhpbmcgYXMgdGhlIGF1dGhlbnRpY2l0eSBvZiBhIGNhbGwgZnJvbSBh IHNpbmdsZSBzdWJzY3JpYmVyIHdpdGggYSBzaW5nbGUgTUROIHJlZ2FyZGxlc3Mgb2Yg4oCcbGF4 aXR54oCdIG9mIHNwb29mIGNoZWNraW5nLg0KDQpJbiBhbm90aGVyIGZvcnVtIGFuZCBhbnRpY2lw YXRpbmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljYXRpb24gbWFuZGF0ZXMgZnJvbSBDb25ncmVz cyBhbmQvb3IgRkNDLCBJIHN1Z2dlc3RlZCB1c2luZyBjYXJyaWVyLXNwZWNpZmljIGNlcnRzIGFu ZCBlbmNvZGluZyBzcGVjaWZpY2l0eSBvZiBhdXRoZW50aWNpdHksIGFuZCBjYWxsaW5nIG51bWJl ci4gIFRoaXMgcHJvdmlkZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBvcmlnaW5hdGluZyBjYXJyaWVy LCBzb21lIGlkZWEgYXMgdG8gdGhlIGFjY3VyYWN5IG9yIHNwZWNpZmljaXR5IG9mIHRoZSBjYWxs aW5nIG51bWJlciwgYW5kIHZhbGlkdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyIChhc3N1bWluZyBu b25jZSBhbmQgcmVwbGF5IGlzc3VlcyBjYW4gYmUgYWRkcmVzc2VkIGFzIHJlYXNvbmFibHkgc3Vn Z2VzdGVkIGJlbG93IGJ5IEFsZXgpLg0KDQpUaGUgcmVwcmVzZW50YXRpb24gb2Ygb3JpZy1jYXJy aWVyIGFuZCB0cnVzdHdvcnRoaW5lc3MgY291bGQgYmUgYXMgZm9sbG93czoNCg0KUmVndWxhdGVk L21hbmRhdGVkIENhcnJpZXIgQ2xhc3MgVXNlIENhc2U6DQoNCjAwIC0gTm8gQ3JlZGVudGlhbHMN ClVzZSBjYXNlIGV4YW1wbGUocyk6IFByZS1JTVMsIGxlZ2FjeSBjaXJjdWl0LXN3aXRjaGVkIG5l dHdvcmtzIHRoYXQgZG9uJ3QgbmF0aXZlbHkgc3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3QgY2hv b3NlIHRvIHNpZ24gY2FsbHMuICBFLmcuLCBpbnRlcm5hdGlvbmFsIGNhcnJpZXJzLg0KVHJ1c3Qg RXN0aW1hdGU6ICBHb29kIGx1Y2suICBDYXJyaWVyX29yaWcgYW5kIENnUE4gZW50aXJlbHkgdW50 cnVzdHdvcnRoeS4NCg0KMDEgLSBDYXJyaWVyIHNpZ25lZCwgbm8gYXV0aGVudGljYXRpb24gb2Yg Q2dQTg0KVXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBvbiB2aXNpdGVkIG5ldHdvcmsgdy9vIHJv YW1pbmcgYWdyZWVtZW50LCBtYW51YWwgcm9hbWluZy4NClRydXN0IEVzdGltYXRlOiAgQ2Fycmll cl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGVudGlyZWx5IHVudHJ1c3R3b3J0aHkNCg0KMTAgLSBD YXJyaWVyIHNpZ25lZCwgc2VtaS1hdXRoZW50aWNhdGVkIENnUE4NClVzZSBjYXNlIGV4YW1wbGUo cyk6IE51bWJlciBibG9jayBkZWxlZ2F0ZWQgZnJvbSBPQ04sIGJ1dCBubyBwZXItVE4gc2NyZWVu IChTSVAgdHJ1bmtzKS4NClRydXN0IEVzdGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5 LCBDZ1BOIGxlc3MgdGhhbiBtb3N0IHRydXN0d29ydGh5IGJ1dCBub3QgZW50aXJlbHkgdW50cnVz dHdvcnRoeS4NCg0KMTEgLSBDYXJyaWVyIHNpZ25lZCwgYXV0aGVudGljYXRlZCBDZ1BODQpVc2Ug Y2FzZSBleGFtcGxlKHMpOiBCcmVhZC1hbmQtYnV0dGVyIDk1JSsgb2YgY2FsbHMgZnJvbSBzdWJz Y3JpYmVyIGxpbmVzIChJTVMtYmFzZWQgYW5kIG90aGVyd2lzZSkuDQpUcnVzdCBFc3RpbWF0ZTog IENhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBtb3N0IHRydXN0d29ydGh5DQoNClB1Ymxp YyBVc2UgQ2FzZToNCg0KVW5kZWZpbmVkIGJ1dCBhc3N1bWVkIHRvIHVzZSBwdWJsaWMgb3IgY29t bWVyY2lhbGx5IGF2YWlsYWJsZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlcyByZXNvdXJjZXMuICBl LmcuLCBub21vcm9iby1saWtlIGNyb3dkLXNvdXJjZWQgYWNjZXB0L2RlbnkgbGlzdHMsIGV0IGNl dGVyYS4gIENvdWxkL3dvdWxkIHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUgZGV2 aWNlcyB3aGljaCB3b3VsZCBwcm9jZXNzIHRoZW0gYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBvZiB0 aGUgUHVibGljIENsYXNzIGFwcGxpY2F0aW9uKHMpLg0KDQpQaWVyY2UNCg0KRnJvbTogQnJpYW4g Um9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NClNlbnQ6IEF1Z3VzdCAwNCwgMjAxNiA5 OjAyIEFNDQpUbzogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0PG1haWx0bzphbGV4QGJv Ym90ZWsubmV0Pj4NCkNjOiBzdGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KU3Vi amVjdDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCg0KVGhlcmUgYXJlIHJl YXNvbmFibGUgY2lyY3Vtc3RhbmNlcyB3aGVyZSBhIHBhcnR5IHBsYWNpbmcgYSBjYWxsIGlzIG5v dCB0aGUgYXV0aG9yaXplZCBlbnRpdHkgYXNzaWduZWQgdGhlIHRlbGVwaG9uZSBudW1iZXIgdXNl ZCBpbiBGcm9tL1BBSSwgYW5kIGluIHN1Y2ggY2lyY3Vtc3RhbmNlcyB0aGUgc2VydmljZSBwcm92 aWRlciBzZXJ2aWNpbmcgdGhlIGVudGl0eSBwbGFjaW5nIHRoZSBjYWxsIG1heSBvciBtYXkgbm90 IGJlIHRoZSBzYW1lIGFzIHRoZSBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpbmcgdGhlIGVudGl0eSB0 aGF0IGlzIGFzc2lnbmVkIHRoZSBUTi4gIEluIGFsbCBzdWNoIGNhc2VzLCB0aGUgZW50aXR5IHRo YXQgaXMgYXNzaWduZWQgdGhlIFROIGV4cGxpY2l0bHkgYXV0aG9yaXplcyBjYWxscyBwbGFjZWQg dXNpbmcgaXTigJlzIFROLiAgVGhlIGRlc2lnbiBhY2NvbW1vZGF0ZXMgc3VjaCB1c2UgY2FzZXMu ICBJdOKAmXMgbm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRp b24uICAgV2XigJlyZSBub3QgYXdhcmUgb2YgYW55IGNhc2VzIHdoZXJlIHRoZXJlIGlzIGFuIGFj dHVhbCByZXF1aXJlbWVudCBmb3IgbGVnaXRpbWF0ZSBjYWxsaW5nIHdpdGhvdXQgZXhwbGljaXQg YXV0aG9yaXphdGlvbiBmcm9tIHRoZSBhc3NpZ25lZCBlbnRpdHksIGFsdGhvdWdoIHdlIGNlcnRh aW5seSBhcmUgYXdhcmUgdGhhdCB2YXJpb3VzIHBhcnRzIG9mIHZhcmlvdXMgc2VydmljZSBwcm92 aWRlcnMgZG9u4oCZdCBib3RoZXIgdG8gY2hlY2suIEF0IHRoaXMgcG9pbnQsIGF0IGxlYXN0IGlu IHNvbWUgY291bnRyaWVzLCB0aGVyZSBpcyBhIHJlYWxpemF0aW9uIHRoYXQgdGhlIGxheGl0eSBv ZiBhbGxvd2luZyB1bmNoZWNrZWQgc3Bvb2ZpbmcgaXMgbm90IGFjY2VwdGFibGUgYW55IG1vcmUu DQoNCkJyaWFuDQoNCk9uIEF1ZyAzLCAyMDE2LCBhdCA4OjM1IEFNLCBBbGV4IEJvYm90ZWsgPGFs ZXhAYm9ib3Rlay5uZXQ8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+PiB3cm90ZToNCg0KMS4gICAg ICAgUGVybWl0IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbg0KSW4gdGhlIGN1 cnJlbnQgdGVsZXBob255IG5ldHdvcmsgcHJhY3RpY2UsIHNvbWUgc2VydmljZSBwcm92aWRlciBp bXBsZW1lbnRhdGlvbnMgY2hvb3NlIG5vdCB0byBhdXRoZW50aWNhdGUgaWRlbnRpdHksIGJ1dCBz aW1wbHkgZmFjaWxpdGF0ZSB0aGUgdXNlIG9mIGFuIGFyYml0cmFyeSBvciBzZWxlY3RlZCB1c2Vy LXByb3ZpZGVkIGlkZW50aXR5LiAgQXJlIHRoZXJlIGxlZ2l0aW1hdGUgdXNlIGNhc2VzIGZvciB0 aGlzPyAgSGFzIGFueW9uZSBlc3RhYmxpc2hlZCB0aGF0IHRoZXJlIGFyZSBub3Q/ICBIb3cgY2Fu IHRoZSBpbmR1c3RyeSByZWFzb25hYmx5IGV4cGVjdCB0byBlbmQgdGhpcyAob2Z0ZW4gYmFkKSBw cmFjdGljZT8gIElmIGl0IGNhbuKAmXQgYmUgZW5kZWQsIHRoZXJl4oCZcyB2YWx1ZSBpbiBhdCBs ZWFzdCBpZGVudGlmeWluZyB0aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92aWRlciAoaS5lLiwg dGhlIHNpZ25lci9hdXRob3JpemVyKS4gIEdpdmVuIHRoZSBwcmV2YWxlbmNlIG9mIGFidXNlIHVz aW5nIHRlbGVwaG9uZSBudW1iZXJzIGFzc2lnbmVkIHRvIGEgc29tZXRpbWVzLWFub255bW91cyBh YnVzZXIsIGl0IGJlY29tZXMgY3JpdGljYWxseSBpbXBvcnRhbnQgdG8gaWRlbnRpZnkgdGhlIHNl cnZpY2UgcHJvdmlkZXIocykgY2xvc2VzdCB0byB0aGUgYWJ1c2VyLiAgQmFzZWQgb24gdGhlIGFz c3VtcHRpb24gdGhhdCBpdOKAmXMgYmV0dGVyIHRvIElEIHNlcnZpY2UgcHJvdmlkZXJzIHRoYW4g dW5yZWFzb25hYmx5IGV4cGVjdCBhIGJhbiBvZiB0aGUgdXNlIG9mIHVuYXV0aGVudGljYXRlZCAo YW5kIHRoZXJlZm9yZSB1bnNpZ25lZCkgU0lQIHJlcXVlc3RzLCBTVElSIHNpZ25pbmcgc2hvdWxk IHN1cHBvcnQgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLiAgVGhlIHByYWN0 aWNlIG9mIGF1dGhvcml6aW5nIHVuYXV0aGVudGljYXRlZCB1c2UgZXhpc3RzLCBhbmQgdGhlcmUg aXMgYmVuZWZpdCB0byBzaWduaW5nIGluIHRoZXNlIGNhc2VzIChzZXJ2aWNlIHByb3ZpZGVyIGlk ZW50aWZpY2F0aW9uKS4gIFRoZSBsYW5ndWFnZSBvZiB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlz IHVzZS4gIDQ0NzRiaXMtMTAgc2hvdWxkIE5PVCByZXF1aXJlIG9yIGFzc3VtZSB0aGF0ICB0aGF0 IGF1dGhlbnRpY2F0aW9uIHdpbGwgcHJlY2VkZSBhdXRob3JpemF0aW9uLiBPZiBjb3Vyc2UgdGhl cmUgbWF5IGJlIG90aGVyIHVzZSBjYXNlcyB3aGVyZSBzaWduaW5nIGluY2x1ZGVzIGF1dGhlbnRp Y2F0aW9uIGFuZCBtYXkgbm90IGluY2x1ZGUgYSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVy4oCZ cyBhdXRob3JpemF0aW9uLg0KDQoNCjIuICAgICAgIEltcHJvdmUgcmVwbGF5IHByZXZlbnRpb24N ClByb3hpbWF0ZSByZXBsYXkgaXMgcG9zc2libGUgd2hpbGUgY29tcGx5aW5nIHdpdGggdGhpcyBz cGVjLiAgRmlyc3QsIG9uZSBvciBtb3JlIHByb3hpbWF0ZSAoZS5nLiwgd2l0aGluIDYwIHNlY29u ZHMpIFNJUCByZXF1ZXN0cyB1c2luZyB0aGUgc2FtZSB0b2tlbiBhcmUgbGVnYWwgYW5kIHN1Ympl Y3QgdG8gcmVwbGF5IGluIG1hbnkgY2FzZXMuICBBbiBTRFAgYm9keeKAmXMgbWt5IG1heSBub3Qg YmUgcHJlc2VudCBhbmQgaWYgcHJlc2VudCBpdHMgdXNlIGlzIG9wdGlvbmFsLiAgU29tZSBzb3J0 IG9mIG1hbmRhdG9yeSBuZXcgb3IgZXhpc3Rpbmcgc2lnbmVkIHNlcXVlbmNlLCByYW5kb20gIyBv ciByZXF1ZXN0IElEIChlLmcuLCBDYWxsLUlEIG9yIENTZXEpIGFuZCBhIDEtdGltZSB1c2UgcG9s aWN5IG9uIHRoZSByZWNlaXZpbmcgZW5kIG9mIHRoZSByZXF1ZXN0IChlLmcuLCB0b2tlbnMgb25s eSBnb29kIGZvciAxIHVzZSkgY291bGQgcHJldmVudCByZXBsYXkuICBEaWZmZXJlbnQgbWV0aG9k cyAoZS5nLiwgSU5WSVRFIHZzIE1FU1NBR0UpIG1pZ2h0IGJlIGhhbmRsZWQgYnkgZGlmZmVyZW50 IHJlY2VpdmluZyBpbmZyYXN0cnVjdHVyZSwgYW5kIHRoZXJlZm9yZSBkaWZmaWN1bHRpZXMgd2l0 aCDigJhpdOKAmXMgYmVlbiB1c2VkIGFscmVhZHnigJkgY29vcmRpbmF0aW9uIGFsbG93IGEgZmFr ZWQgTUVTU0FHRSBiYXNlZCBvbiBhIGNhcHR1cmVkIHJlcXVlc3QuIFRoaXMgbWlnaHQgaW5jbHVk ZSBhbiBta2V5IGZyb20gYSBjYXB0dXJlZCBJTlZJVEUuICAgU28gaXQgbWF5IGJlIHBvc3NpYmxl IHRvIERPUywgc3BhbSBvciB0ZXh0LWJvbWIgYSByZWNpcGllbnQgdXNpbmcgYSBjYXB0dXJlZCBp ZGVudGl0eS4gIFdoaWxlIGxhcmdlLXNjYWxlIG9yIGRpc3RyaWJ1dGVkIGltcGxlbWVudGF0aW9u cyBtYXkgbWFrZSB0aGUgZW5mb3JjZW1lbnQgZGlmZmljdWx0LCB0aGVyZSBpcyBsaXR0bGUgY29z dCB0byBzaWduaW5nIGFuZCBkZWNvZGluZyBhIG1ldGhvZCBhbmQgcG9zc2libHkgYSBudW1lcmlj IElELiAgIFNvbWUgc29ydCBvZiDigJgxLXVzZeKAmSBwcmFjdGljZSBzaG91bGQgYXQgbGVhc3Qg YmUgZGlzY3Vzc2VkIHdoaWxlIHBlcmhhcHMgbm90IHJlcXVpcmVkLg0KDQoNClNwZWNpZmljIG1h cmt1cCBzdWdnZXN0aW9uczoNCg0KDQpOSVRTDQoNCg0KICAgVGhlIHZlcmlmaWVyIE1VU1QgaW5z cGVjdCBhbnkgb3B0aW9uYWwgInBwdCIgcGFyYW1ldGVyIGFwcGVhcmluZyBpbiB0aGUNCg0KICAg SWRlbnRpdHkgcmVxdWVzdC4gIElmIG5vICJwcHQiIHBhcmFtZXRlciBpcyBwcmVzZW50LCB0aGVu IHRoZQ0KDQogICB2ZXJpZmllciBwcm9jZWVkcyBub3JtYWxseSBiZWxvdy4gIElmIGEgInBwdCIg cGFyYW1ldGVyIHZhbHVlIGlzDQoNCiAgIHByZXNlbnQsIGFuZCB0aGUgdmVyaWZpZXIgZG9lcyBu b3Qgc3VwcG9ydCBpdCwgaXQgTVVTVCBpZ25vcmUgdGhlDQoNCiAgIElkZW50aXR5IGhlYWRlci4g IElmIGEgc3VwcG9ydGVkICJwcHQiIHBhcmFtZXRlciB2YWx1ZSBpcyBwcmVzZW50LA0KDQogICB0 aGUgdmVyaWZpZXIgZm9sbG93cyB0aGUgcHJvY2VkdXJlcyBiZWxvdywgaW5jbHVkaW5nIHRoZSB2 YXJpYXRpb25zDQoNCiAgIGRlc2NyaWJlZCBpbiBTdGVwIDUuDQoNCjM8ZmlsZTovLy9DOlxVc2Vy c1xhYjM3NzhcRG9jdW1lbnRzXElFVEZcZHJhZnQtaWV0Zi1zdGlyLXJmYzQ0NzRiaXMtMTAlMjAt JTIwQXV0aGVudGljYXRlZCUyMElkZW50aXR5JTIwTWFuYWdlbWVudCUyMGluJTIwdGhlJTIwU2Vz c2lvbiUyMEluaXRpYXRpb24lMjBQcm90b2NvbCUyMCUyOFNJUCUyOS5odG0jc2VjdGlvbi0zPi4g IEJhY2tncm91bmQNCg0KW+KApl0NCg0KDQoNCiAgIFBlciBbUkZDNzM0MDxodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvcmZjNzM0MD5dLCBwcm9ibGVtcyBzdWNoIGFzIHJvYm9jYWxsaW5nLCB2 b2ljZW1haWwgaGFja2luZywgYW5kDQoNCiAgIHN3YXR0aW5nIGFyZSBlbmFibGVkIGJ5IGFuIGF0 dGFja2VyJ3MgYWJpbGl0eSB0byBpbXBlcnNvbmF0ZSBzb21lb25lDQoNCiAgIGVsc2UuICBUaGUg c2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUCBhcHBsaWNhdGlvbnMgYW5kIHNlcnZpY2VzDQoN CiAgIGRlcGVuZHMgb24gYXV0aGVudGljYXRpbmcgYW5kL29yIGF1dGhvcml6aW5nIHRoZSBzb3Vy Y2Ugb2YgY29tbXVuaWNhdGlvbnMgYXMgaXQgaXMNCg0KICAgcmVwcmVzZW50ZWQgaW4gYSBTSVAg cmVxdWVzdC4NCg0KDQogICBUaGlzIGlkZW50aXR5IGFyY2hpdGVjdHVyZSBmb3IgU0lQIGRlcGVu ZHMgb24gaW5jbHVkZXMgcHJvdmlzaW9ucyBmb3IgYSBsb2dpY2FsDQoNCiAgICJhdXRoZW50aWNh dGlvbiBzZXJ2aWNlIiB3aGljaCB2YWxpZGF0ZXMgY2FsbGVyIGlkZW50aXR5IGF0IG9yIG5lYXIg b3JpZ2luYXRpb24uICBvdXRnb2luZyByZXF1ZXN0cy4gIEFuDQoNCiAgIGF1dGhlbnRpY2F0aW9u IHNlcnZpY2UgbWF5IGJlIGltcGxlbWVudGVkIGVpdGhlciBhcyBwYXJ0IG9mIGEgdXNlcg0KDQog ICBhZ2VudCBvciBhcyBhIHByb3h5IHNlcnZlcjsgdHlwaWNhbGx5LCBpdCBpcyBhIGNvbXBvbmVu dCBvZiBhIG5ldHdvcmsNCg0KICAgaW50ZXJtZWRpYXJ5IGxpa2UgYSBwcm94eSB0byB3aGljaCBv cmlnaW5hdGluZyB1c2VyIGFnZW50cyBzZW5kDQoNCiAgIHVuc2lnbmVkIHJlcXVlc3RzLiAgT25j ZSB0aGUgc2VuZGVyIG9mIHRoZSBtZXNzYWdlIGhhcyBiZWVuDQoNCg0KDQogICBUaGlzIGRvY3Vt ZW50IHNwZWNpZmllcyBhIG1lYW5zIG9mIHNoYXJpbmcgYSBjcnlwdG9ncmFwaGljIGFzc3VyYW5j ZQ0KDQogICBvZiBhdXRoZW50aWNpdHkgb2YgYW5kL29yIGF1dGhvcml6YXRpb24gdG8gdXNlIGVu ZC11c2VyIFNJUCBpZGVudGl0eSBpbiBhbiBpbnRlcmRvbWFpbiBvciBpbnRyYWRvbWFpbiBjb250 ZXh0Lg0KDQogICBJdCByZWxpZXMgb24gdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgY29uc3Ry dWN0aW5nIHRva2VucyBiYXNlZCBvbiBb4oCmXQ0KDQoNCg0KDQogICBUbyBtYXhpbWl6ZSBlbmQt dG8tZW5kIHNlY3VyaXR5LCBpdCBpcyB0eXBpY2FsbHkgb2J2aW91c2x5DQoNCiAgIHByZWZlcmFi bGUgZm9yIGVuZC11c2VycyB0byBhY3F1aXJlIHRoZWlyIG93biBjcmVkZW50aWFsczsgaWYgdGhl eQ0KDQogICBkbywgdGhlaXIgdXNlciBhZ2VudHMgY2FuIGFjdCBhcyBhdXRoZW50aWNhdGlvbiBz ZXJ2aWNlcy4gIEhvd2V2ZXIsDQoNCiAgIGZvciBzb21lIGRlcGxveW1lbnRzLCBb4oCmXQ0KDQoN ClJlZ2FyZHMsDQoNCkFsZXgNCg0KQWxleCBCb2JvdGVrDQoNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0DQpzdGlyQGll dGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9zdGlyDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0K VGhpcyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIGlu dGVuZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55IHVzZSBieSBv dGhlcnMgaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVu dCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIGFsbCBjb3BpZXMgb2YgdGhl IG1lc3NhZ2UuDQoNCg== --_000_837ed8129f6a4b14ba524f7e154540b9PLSWE13M08adsprintcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseTpHYXJhbW9uZDsNCglwYW5vc2UtMToyIDIgNCA0IDMgMyAxIDEg OCAzO30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFs LCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0K CWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7 fQ0KaDINCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJbXNvLXN0eWxlLWxpbms6IkhlYWRpbmcg MiBDaGFyIjsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGlu aywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJs dWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlw ZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6 OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28t c3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVk Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJ Zm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5IZWFkaW5nMkNoYXINCgl7bXNvLXN0eWxlLW5h bWU6IkhlYWRpbmcgMiBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUt bGluazoiSGVhZGluZyAyIjsNCglmb250LWZhbWlseToiQ2FsaWJyaSBMaWdodCIsc2Fucy1zZXJp ZjsNCgljb2xvcjojMkU3NEI1O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJBcmlhbCIsc2Fucy1zZXJpZjsNCgljb2xv cjojMDAwMENDOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0 ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlk bWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0 YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxi b2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9 IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDAwQ0MiPlRoYW5rcyBCcmlhbi4mbmJzcDsgSeKAmW0gYWZyYWlkIHdl4oCZcmUgc3RyYXlp bmcgaW50byBhIHBvbGljeSBkaXNjdXNzaW9uLiZuYnNwOyBSZWdhcmRsZXNzLCBJIGRvIGFwcHJl Y2lhdGUgeW91ciBleHBsYW5hdGlvbi4mbmJzcDsgSSB3b3VsZCBsaWtlIHRvIGNvbnRpbnVlIHRo ZSBkaXNjdXNzaW9uLCBidXQNCiBJ4oCZbSBwcmV0dHkgc3VyZSB0aGlzIGlzbuKAmXQgdGhlIHJp Z2h0IGZvcnVtLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MDBDQyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1yaWdodDo1LjhwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0Mi PlBpZXJjZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4g QnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCjxicj4NCjxiPlNlbnQ6PC9i PiBBdWd1c3QgMDQsIDIwMTYgMTozNCBQTTxicj4NCjxiPlRvOjwvYj4gR29ybWFuLCBQaWVyY2Ug QSBbQ1RPXSAmbHQ7UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4g QWxleCBCb2JvdGVrICZsdDthbGV4QGJvYm90ZWsubmV0Jmd0Ozsgc3RpckBpZXRmLm9yZzxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50czxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9mIGNvdXJzZSBJIHdh bnQgUEJYcyB0byBzaWduIGNhbGxzLiAmbmJzcDtBcyB3ZWxsIGFzIHNtYXJ0IHBob25lcyBhbmQg YW55IG90aGVyIGRldmljZXMgdGhhdCBjYW4gYmUgcHJvZ3JhbW1lZCB0byBkbyBzby48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGV5IHdpbGwgYmUgZ2l2ZW4g Y3JlZGVudGlhbHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBmb3IgdGhlIFROcyB0aGV5IGFyZSBhdXRo b3JpemVkIHRvIHNpZ24gZm9yLiAmbmJzcDtUaGV5IGNhbiB0cnkgdG8gc2lnbiBhbnkgY2FsbCwg YnV0IHRoZSB2YWxpZGl0eSBvZiB0aGUgY3JlZGVudGlhbCB3b3VsZCBtYWtlIHN1Y2ggYSBzaWdu YXR1cmUgZmFpbCB0aGUgY2hlY2tpbmcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkdldHRpbmcgc2VydmljZSBwcm92aWRlcnMgdG8gc2lnbiBv biBiZWhhbGYgb2YgZGV2aWNlcyBpcyBhIHJlYXNvbmFibGUgd2F5IHRvIGRlcGxveSBxdWlja2x5 LCBidXQgSSBleHBlY3QgbWFueSBTUHMgd2lsbCB3YW50IHRvIGdldCBvdXQgb2YgdGhlIGxpYWJp bGl0eSBvZiBzaWduaW5nIG9uIGJlaGFsZiBvZiB0aGVpciBjdXN0b21lcnMuICZuYnNwO0lmIHRo ZXkgY2FuIHB1c2ggb2YgdGhhdCByZXNwb25zaWJpbGl0eQ0KIHRvIHRoZWlyIGN1c3RvbWVyLCBv bmx5IGJlaW5nIHJlc3BvbnNpYmxlIGZvciBnZXR0aW5nIHRoZSBjdXN0b21lciBhbiBhcHByb3By aWF0ZSBjcmVkZW50aWFsIHdoZW4gdGhleSBhc3NpZ24gVE5zLCB0aGVuIEkgd291bGQgZXhwZWN0 IHRoZW0gdG8gd2FudCB0byBkbyBzby4gJm5ic3A7VGhhdCBtZWFucyB0aGUgZGV2aWNlcyBoYXZl IHRvIGJlIGFibGUgdG8gc2lnbiwgYnV0IEkgdW5kZXJzdGFuZCBtYW55IG9mIHRoZSBQQlggdmVu ZG9ycyB0aGluayB0aGF04oCZcw0KIHNvbWV0aGluZyB0aGV5IGNvdWxkIHByb3ZpZGUgaW4gYSBm dXR1cmUgcmVsZWFzZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+QnJpYW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIEF1ZyA0LCAyMDE2LCBhdCAyOjIyIFBNLCBHb3JtYW4sIFBpZXJj ZSBBIFtDVE9dICZsdDs8YSBocmVmPSJtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tIj5Q aWVyY2UuR29ybWFuQHNwcmludC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+ WW91IHdhbnQgSVAgUEJYZXMgdG8gc2lnbiBjYWxscz8gJm5ic3A7V29u4oCZdCB0aGF0IG1ha2Ug aXQgZXh0cmFvcmRpbmFyaWx5IGVhc3kgdG8gY29tbWl0IGZyYXVkIHdpdGggYXV0aGVudGljYXRl ZCBudW1iZXJzPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1yaWdodDo1LjhwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5Ccmlhbg0KIFJvc2VuIFs8YSBocmVmPSJtYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXQi Pm1haWx0bzpickBicmlhbnJvc2VuLm5ldDwvYT5dPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5BdWd1c3QgMDQsIDIwMTYgMTI6MjQgUE08 YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPkdvcm1hbiwgUGllcmNlIEEgW0NUT10gJmx0OzxhIGhyZWY9Im1haWx0bzpQaWVyY2Uu R29ybWFuQHNwcmludC5jb20iPlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbTwvYT4mZ3Q7PGJyPg0K PGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5BbGV4IEJvYm90ZWsgJmx0OzxhIGhyZWY9Im1haWx0bzphbGV4QGJvYm90ZWsubmV0Ij5hbGV4 QGJvYm90ZWsubmV0PC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyI+c3Rp ckBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29t bWVudHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GaXJzdCBvZiBhbGwsIHdlIHdvdWxkIHdhbnQgdGhl IFBCWCB0byBnZW5lcmF0ZSB0aGUgc2lnbmF0dXJlLCBidXQgdGhlIHNlcnZpY2UgcHJvdmlkZXIg Y2FuIGRvIHRoYXQuICZuYnNwO0l0IHNob3VsZCBub3QgYWRkIGEgdmFsaWQgc2lnbmF0dXJlIHRv IGEgY2FsbCBmcm9tIGEgbnVtYmVyIGl0IGRpZCBub3QgYXNzaWduIHRvIHRoZSB0cnVuayBncm91 cCBjb25uZWN0aW5nIHRvIHRoZSBQQlgsIGFsdGhvdWdoIGl0IGNvdWxkDQogc3VwcG9ydCB0aGUg ZXh0cmEgZGVsZWdhdGlvbiByZXF1aXJlZCB0byBzdXBwb3J0IOKAnGF1dGhvcml6ZWQgc3Bvb2Zp bmfigJ0uICZuYnNwO1RoZSBjb21wYW5pb24gZGV2aWNlcyBJ4oCZbSBhd2FyZSBvZiBhbHdheXMg c2VuZCBjYWxscyBmcm9tIHRoZSBzYW1lIHNlcnZpY2UgcHJvdmlkZXIgYW5kIHNob3VsZCBub3Qg cHJlc2VudCBhbnkgaXNzdWUuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FdmVyeW9uZSB3aWxs IGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbuKAmXQgZG8gbm93IHRvIGltcGxlbWVudCBzdG9wIHNw b29mZWQgY2FsbHMuIFRBTlNUQUFGTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ccmlhbjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDQsIDIwMTYsIGF0IDEyOjQxIFBNLCBH b3JtYW4sIFBpZXJjZSBBIFtDVE9dICZsdDs8YSBocmVmPSJtYWlsdG86UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5QaWVyY2UuR29ybWFuQHNwcmlu dC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDAwQ0MiPkZyYXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29tbW9u LiZuYnNwOyBBbmQgZXZlbiB3aGVyZSBhIFBCWCBpcyBub3QgY29tcHJvbWlzZWQsIGEgY2Fycmll ciBoYXMgbm8gcHJhY3RpY2FsIHdheSBvZiBrbm93aW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVt YmVyIGlzIHByb3Blcmx5DQogYXNzaWduZWQgYW5kIHZhbGlkIGZyb20gdGhlIHBlcnNwZWN0aXZl IG9mIHRoZSBFbnRlcnByaXNlLiZuYnNwOyBUaGVyZWZvcmUsIGNoZWNraW5nIHdoZXRoZXIgdGhl IGNhbGxpbmcgbnVtYmVyIHdhcyBmcm9tIGFuIGFzc2lnbmVkIHJhbmdlIG1pZ2h0IGJlIHBvc3Np YmxlIChhbmQgZnJhdWdodCB3aXRoIGFkbWluaXN0cmF0aXZlIGNoYWxsZW5nZXMpLCBidXQgb2Yg bGltaXRlZCB2YWx1ZS4mbmJzcDsgQW5kIGluIHRoZSBjb25zdW1lciBtYXJrZXQsIHRoZXJlIGFy ZQ0KIGNhbGxpbmcgcHJvZHVjdHMgd2hpY2ggc3VwcG9ydCBhIHBhcmVudCBzdWJzY3JpYmVyIG51 bWJlciBhbmQg4oCcY29tcGFuaW9u4oCdIGRldmljZXMgKGUuZy4sIHRhYmxldHMpIHdoaWNoIGNh biBwbGFjZSBhIGNhbGwgdXNpbmcgdGhlIE1ETiBvZiB0aGUgcGFyZW50IHN1YnNjcmliZXIuJm5i c3A7IFRoZXNlIGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUgYXV0aGVudGljaXR5IG9mIHRoZSBj YWxsaW5nIG51bWJlciB3b27igJl0IG5lY2Vzc2FyaWx5IG1lYW4gdGhlDQogc2FtZSB0aGluZyBh cyB0aGUgYXV0aGVudGljaXR5IG9mIGEgY2FsbCBmcm9tIGEgc2luZ2xlIHN1YnNjcmliZXIgd2l0 aCBhIHNpbmdsZSBNRE4gcmVnYXJkbGVzcyBvZiDigJxsYXhpdHnigJ0gb2Ygc3Bvb2YgY2hlY2tp bmcuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPkluIGFub3RoZXIg Zm9ydW0gYW5kIGFudGljaXBhdGluZyBjYWxsaW5nIG51bWJlciBhdXRoZW50aWNhdGlvbiBtYW5k YXRlcyBmcm9tIENvbmdyZXNzIGFuZC9vciBGQ0MsIEkgc3VnZ2VzdGVkIHVzaW5nIGNhcnJpZXIt c3BlY2lmaWMgY2VydHMgYW5kIGVuY29kaW5nIHNwZWNpZmljaXR5DQogb2YgYXV0aGVudGljaXR5 LCBhbmQgY2FsbGluZyBudW1iZXIuJm5ic3A7IFRoaXMgcHJvdmlkZXMgdGhlIGlkZW50aXR5IG9m IHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyLCBzb21lIGlkZWEgYXMgdG8gdGhlIGFjY3VyYWN5IG9y IHNwZWNpZmljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciwgYW5kIHZhbGlkdHkgb2YgdGhlIGNh bGxpbmcgbnVtYmVyIChhc3N1bWluZyBub25jZSBhbmQgcmVwbGF5IGlzc3VlcyBjYW4gYmUgYWRk cmVzc2VkIGFzIHJlYXNvbmFibHkNCiBzdWdnZXN0ZWQgYmVsb3cgYnkgQWxleCkuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPlRoZSByZXByZXNlbnRhdGlvbiBvZiBv cmlnLWNhcnJpZXIgYW5kIHRydXN0d29ydGhpbmVzcyBjb3VsZCBiZSBhcyBmb2xsb3dzOjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+UmVn dWxhdGVkL21hbmRhdGVkIENhcnJpZXIgQ2xhc3MgVXNlIENhc2U6PC9zcGFuPjwvYj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0Mi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4wMCAtIE5vIENyZWRlbnRpYWxzPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Vc2UgY2FzZSBleGFtcGxl KHMpOiBQcmUtSU1TLCBsZWdhY3kgY2lyY3VpdC1zd2l0Y2hlZCBuZXR3b3JrcyB0aGF0IGRvbid0 IG5hdGl2ZWx5IHN1cHBvcnQgU0lQIG9yIHdoaWNoIGRvbid0IGNob29zZSB0byBzaWduIGNhbGxz LiZuYnNwOyBFLmcuLCBpbnRlcm5hdGlvbmFsIGNhcnJpZXJzLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UcnVzdCBFc3RpbWF0ZTog Jm5ic3A7R29vZCBsdWNrLiZuYnNwOyBDYXJyaWVyX29yaWcgYW5kIENnUE4gZW50aXJlbHkgdW50 cnVzdHdvcnRoeS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjAxIC0gQ2FycmllciBzaWduZWQsIG5vIGF1dGhl bnRpY2F0aW9uIG9mIENnUE48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVzZSBjYXNlIGV4YW1wbGUocyk6IEU5MTEgb24gdmlz aXRlZCBuZXR3b3JrIHcvbyByb2FtaW5nIGFncmVlbWVudCwgbWFudWFsIHJvYW1pbmcuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRy dXN0IEVzdGltYXRlOiAmbmJzcDtDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4gZW50aXJl bHkgdW50cnVzdHdvcnRoeTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+MTAgLSBDYXJyaWVyIHNpZ25lZCwgc2Vt aS1hdXRoZW50aWNhdGVkIENnUE48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVzZSBjYXNlIGV4YW1wbGUocyk6IE51bWJlciBi bG9jayBkZWxlZ2F0ZWQgZnJvbSBPQ04sIGJ1dCBubyBwZXItVE4gc2NyZWVuIChTSVAgdHJ1bmtz KS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+VHJ1c3QgRXN0aW1hdGU6ICZuYnNwO0NhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQ TiBsZXNzIHRoYW4gbW9zdCB0cnVzdHdvcnRoeSBidXQgbm90IGVudGlyZWx5IHVudHJ1c3R3b3J0 aHkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4xMSAtIENhcnJpZXIgc2lnbmVkLCBhdXRoZW50aWNhdGVkIENn UE48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPlVzZSBjYXNlIGV4YW1wbGUocyk6IEJyZWFkLWFuZC1idXR0ZXIgOTUlJiM0Mzsg b2YgY2FsbHMgZnJvbSBzdWJzY3JpYmVyIGxpbmVzIChJTVMtYmFzZWQgYW5kIG90aGVyd2lzZSku PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPlRydXN0IEVzdGltYXRlOiAmbmJzcDtDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4g bW9zdCB0cnVzdHdvcnRoeTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlB1YmxpYyBVc2UgQ2FzZTo8L3NwYW4+PC9i PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+VW5kZWZpbmVkIGJ1dCBhc3N1bWVkIHRvIHVzZSBwdWJsaWMgb3IgY29tbWVyY2lhbGx5 IGF2YWlsYWJsZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlcyByZXNvdXJjZXMuJm5ic3A7IGUuZy4s IG5vbW9yb2JvLWxpa2UgY3Jvd2Qtc291cmNlZCBhY2NlcHQvZGVueSBsaXN0cywgZXQgY2V0ZXJh LiZuYnNwOyBDb3VsZC93b3VsZA0KIHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUg ZGV2aWNlcyB3aGljaCB3b3VsZCBwcm9jZXNzIHRoZW0gYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBv ZiB0aGUgUHVibGljIENsYXNzIGFwcGxpY2F0aW9uKHMpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDAwMENDIj5QaWVyY2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Ccmlhbg0KIFJvc2VuIFs8YSBocmVmPSJtYWls dG86YnJAYnJpYW5yb3Nlbi5uZXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm1haWx0bzpi ckBicmlhbnJvc2VuLm5ldDwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+QXVndXN0IDA0LCAyMDE2IDk6MDIgQU08YnI+ DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPkFsZXggQm9ib3RlayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFsZXhAYm9ib3Rlay5uZXQ8L3NwYW4+PC9hPiZndDs8 YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5zdGlyQGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtzdGlyXSBT VElSIDQ0NzRiaXMtMTAgY29tbWVudHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UaGVyZSBhcmUgcmVhc29uYWJsZSBjaXJjdW1zdGFuY2VzIHdoZXJl IGEgcGFydHkgcGxhY2luZyBhIGNhbGwgaXMgbm90IHRoZSBhdXRob3JpemVkIGVudGl0eSBhc3Np Z25lZCB0aGUgdGVsZXBob25lIG51bWJlciB1c2VkIGluIEZyb20vUEFJLCBhbmQgaW4gc3VjaCBj aXJjdW1zdGFuY2VzIHRoZSBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpY2luZyB0aGUgZW50aXR5IHBs YWNpbmcgdGhlIGNhbGwgbWF5IG9yIG1heQ0KIG5vdCBiZSB0aGUgc2FtZSBhcyB0aGUgc2Vydmlj ZSBwcm92aWRlciBzZXJ2aW5nIHRoZSBlbnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4uICZu YnNwO0luIGFsbCBzdWNoIGNhc2VzLCB0aGUgZW50aXR5IHRoYXQgaXMgYXNzaWduZWQgdGhlIFRO IGV4cGxpY2l0bHkgYXV0aG9yaXplcyBjYWxscyBwbGFjZWQgdXNpbmcgaXTigJlzIFROLiAmbmJz cDtUaGUgZGVzaWduIGFjY29tbW9kYXRlcyBzdWNoIHVzZSBjYXNlcy4gJm5ic3A7SXTigJlzIG5v dCBhIGJsYW5rZXQgYXV0aG9yaXphdGlvbg0KIHdpdGhvdXQgYXV0aGVudGljYXRpb24uICZuYnNw OyBXZeKAmXJlIG5vdCBhd2FyZSBvZiBhbnkgY2FzZXMgd2hlcmUgdGhlcmUgaXMgYW4gYWN0dWFs IHJlcXVpcmVtZW50IGZvciBsZWdpdGltYXRlIGNhbGxpbmcgd2l0aG91dCBleHBsaWNpdCBhdXRo b3JpemF0aW9uIGZyb20gdGhlIGFzc2lnbmVkIGVudGl0eSwgYWx0aG91Z2ggd2UgY2VydGFpbmx5 IGFyZSBhd2FyZSB0aGF0IHZhcmlvdXMgcGFydHMgb2YgdmFyaW91cyBzZXJ2aWNlIHByb3ZpZGVy cyBkb27igJl0DQogYm90aGVyIHRvIGNoZWNrLiBBdCB0aGlzIHBvaW50LCBhdCBsZWFzdCBpbiBz b21lIGNvdW50cmllcywgdGhlcmUgaXMgYSByZWFsaXphdGlvbiB0aGF0IHRoZSBsYXhpdHkgb2Yg YWxsb3dpbmcgdW5jaGVja2VkIHNwb29maW5nIGlzIG5vdCBhY2NlcHRhYmxlIGFueSBtb3JlLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnJpYW48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+T24gQXVnIDMsIDIwMTYsIGF0IDg6MzUgQU0sIEFsZXggQm9ib3RlayAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPmFsZXhAYm9ib3Rlay5uZXQ8L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4xLjwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+UGVybWl0DQogYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1 dGhlbnRpY2F0aW9uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SW4gdGhlIGN1cnJlbnQgdGVsZXBob255IG5l dHdvcmsgcHJhY3RpY2UsIHNvbWUgc2VydmljZSBwcm92aWRlciBpbXBsZW1lbnRhdGlvbnMgY2hv b3NlIG5vdCB0byBhdXRoZW50aWNhdGUgaWRlbnRpdHksIGJ1dCBzaW1wbHkgZmFjaWxpdGF0ZSB0 aGUgdXNlIG9mIGFuIGFyYml0cmFyeSBvciBzZWxlY3RlZA0KIHVzZXItcHJvdmlkZWQgaWRlbnRp dHkuJm5ic3A7IEFyZSB0aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8mbmJzcDsg SGFzIGFueW9uZSBlc3RhYmxpc2hlZCB0aGF0IHRoZXJlIGFyZSBub3Q/Jm5ic3A7IEhvdyBjYW4g dGhlIGluZHVzdHJ5IHJlYXNvbmFibHkgZXhwZWN0IHRvIGVuZCB0aGlzICg8c3BhbiBzdHlsZT0i Y29sb3I6IzFGNDk3RCI+b2Z0ZW48L3NwYW4+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPmJhZCkgcHJhY3RpY2U/Jm5ic3A7DQogSWYgaXQgY2Fu4oCZdCBi ZSBlbmRlZCwgdGhlcmXigJlzIHZhbHVlIGluIGF0IGxlYXN0IGlkZW50aWZ5aW5nIHRoZSBvcmln aW5hdGluZyBzZXJ2aWNlIHByb3ZpZGVyICg8c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+aS5l Liw8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFu PnRoZSBzaWduZXIvYXV0aG9yaXplcikuJm5ic3A7IEdpdmVuIHRoZSBwcmV2YWxlbmNlIG9mIGFi dXNlIHVzaW5nIHRlbGVwaG9uZSBudW1iZXJzDQogYXNzaWduZWQgdG8gYSBzb21ldGltZXMtYW5v bnltb3VzIGFidXNlciwgaXQgYmVjb21lcyBjcml0aWNhbGx5IGltcG9ydGFudCB0byBpZGVudGlm eSB0aGUgc2VydmljZSBwcm92aWRlcihzKSBjbG9zZXN0IHRvIHRoZSBhYnVzZXIuJm5ic3A7IEJh c2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQgaXTigJlzIGJldHRlciB0byBJRCBzZXJ2aWNlIHBy b3ZpZGVycyB0aGFuIHVucmVhc29uYWJseSBleHBlY3QgYSBiYW4gb2YgdGhlIHVzZSBvZiB1bmF1 dGhlbnRpY2F0ZWQNCiAoYW5kIHRoZXJlZm9yZSB1bnNpZ25lZCkgU0lQIHJlcXVlc3RzLCBTVElS IHNpZ25pbmcgc2hvdWxkIHN1cHBvcnQgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0 aW9uLiZuYnNwOyBUaGUgcHJhY3RpY2Ugb2YgYXV0aG9yaXppbmcgdW5hdXRoZW50aWNhdGVkIHVz ZSBleGlzdHMsIGFuZCB0aGVyZSBpcyBiZW5lZml0IHRvIHNpZ25pbmcgaW4gdGhlc2UgY2FzZXMg KHNlcnZpY2UgcHJvdmlkZXIgaWRlbnRpZmljYXRpb24pLiZuYnNwOyBUaGUgbGFuZ3VhZ2UNCiBv ZiB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlzIHVzZS4mbmJzcDsgNDQ3NGJpcy0xMCBzaG91bGQg Tk9UIHJlcXVpcmUgb3IgYXNzdW1lIHRoYXQmbmJzcDsgdGhhdCBhdXRoZW50aWNhdGlvbiB3aWxs IHByZWNlZGUgYXV0aG9yaXphdGlvbi4gT2YgY291cnNlIHRoZXJlIG1heSBiZSBvdGhlciB1c2Ug Y2FzZXMgd2hlcmUgc2lnbmluZyBpbmNsdWRlcyBhdXRoZW50aWNhdGlvbiBhbmQgbWF5IG5vdCBp bmNsdWRlIGEgc3BlY2lmaWMgc2VydmljZSBwcm92aWRlcuKAmXMNCiBhdXRob3JpemF0aW9uPHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPi48L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4yLjwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SW1wcm92ZQ0KIHJlcGxheSBwcmV2ZW50aW9uPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+UHJveGltYXRlIHJlcGxheSBpcyBwb3NzaWJsZTxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3 RCI+d2hpbGUgY29tcGx5aW5nIHdpdGg8L3NwYW4+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPnRoaXMNCiBzcGVjLiZuYnNwOyBGaXJzdCwgb25lIG9yIG1v cmUgcHJveGltYXRlIChlLmcuLCB3aXRoaW4gNjAgc2Vjb25kcykgU0lQIHJlcXVlc3RzIHVzaW5n IHRoZSBzYW1lIHRva2VuIGFyZSBsZWdhbCBhbmQgc3ViamVjdCB0byByZXBsYXkgaW4gbWFueSBj YXNlcy4mbmJzcDsgQW4gU0RQIGJvZHnigJlzIG1reSBtYXkgbm90IGJlIHByZXNlbnQgYW5kIGlm IHByZXNlbnQgaXRzIHVzZSBpcyBvcHRpb25hbC4mbmJzcDsgU29tZSBzb3J0IG9mIG1hbmRhdG9y eSBuZXcgb3IgZXhpc3RpbmcNCiBzaWduZWQgc2VxdWVuY2UsIHJhbmRvbSAjIG9yIHJlcXVlc3Qg SUQgKGUuZy4sIENhbGwtSUQgb3IgQ1NlcSkgYW5kIGEgMS10aW1lIHVzZSBwb2xpY3kgb24gdGhl IHJlY2VpdmluZyBlbmQgb2YgdGhlIHJlcXVlc3Q8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPihlLmcuLCB0 b2tlbnMgb25seSBnb29kIGZvciAxIHVzZSk8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPmNvdWxkDQogcHJldmVudCByZXBsYXkuJm5ic3A7IERp ZmZlcmVudCBtZXRob2RzIChlLmcuLCBJTlZJVEUgdnMgTUVTU0FHRSkgbWlnaHQgYmUgaGFuZGxl ZCBieSBkaWZmZXJlbnQgcmVjZWl2aW5nIGluZnJhc3RydWN0dXJlLCBhbmQgdGhlcmVmb3JlIGRp ZmZpY3VsdGllcyB3aXRoIOKAmGl04oCZcyBiZWVuIHVzZWQgYWxyZWFkeeKAmSBjb29yZGluYXRp b24gYWxsb3cgYSBmYWtlZCBNRVNTQUdFIGJhc2VkIG9uIGEgY2FwdHVyZWQgcmVxdWVzdC4mbmJz cDs8c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+VDwvc3Bhbj5oaXMNCiBtaWdodCBpbmNsdWRl IGFuIG1rZXkgZnJvbSBhIGNhcHR1cmVkIElOVklURS4mbmJzcDsgJm5ic3A7U28gaXQgbWF5IGJl IHBvc3NpYmxlIHRvIERPUywgc3BhbSBvciB0ZXh0LWJvbWIgYSByZWNpcGllbnQgdXNpbmcgYSBj YXB0dXJlZCBpZGVudGl0eS4mbmJzcDsgV2hpbGUgbGFyZ2Utc2NhbGUgb3IgZGlzdHJpYnV0ZWQg aW1wbGVtZW50YXRpb25zIG1heSBtYWtlIHRoZSBlbmZvcmNlbWVudCBkaWZmaWN1bHQsIHRoZXJl IGlzIGxpdHRsZSBjb3N0IHRvIHNpZ25pbmcgYW5kDQogZGVjb2RpbmcgYSBtZXRob2QgYW5kIHBv c3NpYmx5IGEgbnVtZXJpYyBJRC4mbmJzcDsgJm5ic3A7PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPlNvbWUgc29ydCBvZiDigJgxLXVzZeKAmSBwcmFjdGljZSBzaG91bGQgYXQgbGVhc3QgYmUg ZGlzY3Vzc2VkIHdoaWxlIHBlcmhhcHMgbm90IHJlcXVpcmVkLiAmbmJzcDs8L3NwYW4+PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TcGVjaWZpYyBtYXJrdXAgc3Vn Z2VzdGlvbnM6Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPk5JVFM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyBUaGUg dmVyaWZpZXIgTVVTVCBpbnNwZWN0IGFueSBvcHRpb25hbCAmcXVvdDtwcHQmcXVvdDsgcGFyYW1l dGVyIGFwcGVhcmluZyA8Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE2LjBwdDtjb2xvcjpyZWQi PmluPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj4gPC9zcGFuPnRoZTxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBJZGVudGl0eSByZXF1ZXN0LiZuYnNwOyBJZiBu byAmcXVvdDtwcHQmcXVvdDsgcGFyYW1ldGVyIGlzIHByZXNlbnQsIHRoZW4gdGhlPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHZlcmlmaWVyIHByb2NlZWRzIG5vcm1hbGx5IGJl bG93LiZuYnNwOyBJZiBhICZxdW90O3BwdCZxdW90OyBwYXJhbWV0ZXIgdmFsdWUgaXM8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgcHJlc2VudCwgYW5kIHRoZSB2ZXJpZmllciBk b2VzIG5vdCBzdXBwb3J0IGl0LCBpdCBNVVNUIGlnbm9yZSB0aGU8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsgSWRlbnRpdHkgaGVhZGVyLiZuYnNwOyBJZiBhIHN1cHBvcnRlZCAm cXVvdDtwcHQmcXVvdDsgcGFyYW1ldGVyIHZhbHVlIGlzIHByZXNlbnQsPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZSB2ZXJpZmllciBmb2xsb3dzIHRoZSBwcm9jZWR1cmVz IGJlbG93LCBpbmNsdWRpbmcgdGhlIHZhcmlhdGlvbnM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsgZGVzY3JpYmVkIGluIFN0ZXAgNS48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGgyPjxhIG5hbWU9InNlY3Rpb24tMyI+PC9hPjxhIGhyZWY9ImZp bGU6Ly8vQzpcVXNlcnNcYWIzNzc4XERvY3VtZW50c1xJRVRGXGRyYWZ0LWlldGYtc3Rpci1yZmM0 NDc0YmlzLTEwJTIwLSUyMEF1dGhlbnRpY2F0ZWQlMjBJZGVudGl0eSUyME1hbmFnZW1lbnQlMjBp biUyMHRoZSUyMFNlc3Npb24lMjBJbml0aWF0aW9uJTIwUHJvdG9jb2wlMjAlMjhTSVAlMjkuaHRt I3NlY3Rpb24tMyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7O2NvbG9yOiM5NTRGNzIiPjM8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+LiZuYnNwOw0KIEJhY2tncm91bmQ8L3NwYW4+PG86cD48 L286cD48L2gyPg0KPHByZT5b4oCmXTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBQZXIgWzxhIGhyZWY9Imh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9yZmM3MzQwIiB0aXRsZT0iJnF1b3Q7U2VjdXJlIFRlbGVwaG9uZSBJ ZGVudGl0eSBQcm9ibGVtIFN0YXRlbWVudCBhbmQgUmVxdWlyZW1lbnRzJnF1b3Q7Ij48c3BhbiBz dHlsZT0iY29sb3I6Izk1NEY3MiI+UkZDNzM0MDwvc3Bhbj48L2E+XSwgcHJvYmxlbXMgc3VjaCBh cyByb2JvY2FsbGluZywgdm9pY2VtYWlsIGhhY2tpbmcsIGFuZDxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyBzd2F0dGluZyBhcmUgZW5hYmxlZCBieSBhbiBhdHRhY2tlcidzIGFi aWxpdHkgdG8gaW1wZXJzb25hdGUgc29tZW9uZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyBlbHNlLiZuYnNwOyBUaGUgc2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUCBhcHBs aWNhdGlvbnMgYW5kIHNlcnZpY2VzPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 IGRlcGVuZHMgb24gPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+YXV0aGVudGljYXRpbmcgYW5kL29y IDwvc3Bhbj5hdXRob3JpemluZyB0aGUgc291cmNlIG9mIGNvbW11bmljYXRpb25zIGFzIGl0IGlz PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHJlcHJlc2VudGVkIGluIGEgU0lQ IHJlcXVlc3QuIDxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IFRoaXMgaWRlbnRp dHkgYXJjaGl0ZWN0dXJlIGZvciBTSVAgPHM+ZGVwZW5kcyBvbjwvcz4gPHNwYW4gc3R5bGU9ImNv bG9yOnJlZCI+aW5jbHVkZXMgcHJvdmlzaW9ucyBmb3IgPC9zcGFuPmEgbG9naWNhbDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyAmcXVvdDthdXRoZW50aWNhdGlvbiBzZXJ2aWNl JnF1b3Q7IHdoaWNoIHZhbGlkYXRlcyA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5jYWxsZXIgaWRl bnRpdHkgYXQgb3IgbmVhciBvcmlnaW5hdGlvbi4mbmJzcDsgPC9zcGFuPjxzPm91dGdvaW5nIHJl cXVlc3RzLjwvcz4mbmJzcDsgQW48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsg YXV0aGVudGljYXRpb24gc2VydmljZSBtYXkgYmUgaW1wbGVtZW50ZWQgZWl0aGVyIGFzIHBhcnQg b2YgYSB1c2VyPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGFnZW50IG9yIGFz IGEgcHJveHkgc2VydmVyOyB0eXBpY2FsbHksIGl0IGlzIGEgY29tcG9uZW50IG9mIGEgbmV0d29y azxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBpbnRlcm1lZGlhcnkgbGlrZSBh IHByb3h5IHRvIHdoaWNoIG9yaWdpbmF0aW5nIHVzZXIgYWdlbnRzIHNlbmQ8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgdW5zaWduZWQgcmVxdWVzdHMuJm5ic3A7IE9uY2UgdGhl IHNlbmRlciBvZiB0aGUgbWVzc2FnZSBoYXMgYmVlbjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHByZT4mbmJz cDsmbmJzcDsgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgYSBtZWFucyBvZiBzaGFyaW5nIGEgY3J5 cHRvZ3JhcGhpYyBhc3N1cmFuY2U8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsg b2YgPHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+YXV0aGVudGljaXR5IG9mIGFuZC9vciBhdXRob3Jp emF0aW9uIHRvIHVzZSA8L3NwYW4+ZW5kLXVzZXIgU0lQIGlkZW50aXR5IGluIGFuIGludGVyZG9t YWluIG9yIGludHJhZG9tYWluIGNvbnRleHQuPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7IEl0IHJlbGllcyBvbiB0aGUgYXV0aGVudGljYXRpb24gc2VydmljZSBjb25zdHJ1Y3Rp bmcgdG9rZW5zIGJhc2VkIG9uIFvigKZdIDxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZuYnNw OyBUbyBtYXhpbWl6ZSBlbmQtdG8tZW5kIHNlY3VyaXR5LCBpdCBpcyA8c3BhbiBzdHlsZT0iY29s b3I6cmVkIj50eXBpY2FsbHkgPC9zcGFuPjxzPm9idmlvdXNseTwvcz48bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsgcHJlZmVyYWJsZSBmb3IgZW5kLXVzZXJzIHRvIGFjcXVpcmUg dGhlaXIgb3duIGNyZWRlbnRpYWxzOyBpZiB0aGV5PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7IGRvLCB0aGVpciB1c2VyIGFnZW50cyBjYW4gYWN0IGFzIGF1dGhlbnRpY2F0aW9u IHNlcnZpY2VzLiZuYnNwOyBIb3dldmVyLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyBmb3Igc29tZSBkZXBsb3ltZW50cywgW+KApl08bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+UmVnYXJk cyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+QWxleDxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0dhcmFtb25kJnF1b3Q7LHNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjguMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0dhcmFtb25kJnF1b3Q7LHNlcmlmO2NvbG9y OiMxRjQ5N0QiPkFsZXggQm9ib3Rlazwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6bmF2eSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPGJyPg0Kc3RpciBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFp bHRvOnN0aXJAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk1NEY3MiI+c3RpckBp ZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9 Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3RpciI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojOTU0RjcyIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3N0aXI8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdiBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0idGV4 dC1hbGlnbjpjZW50ZXIiPg0KPGhyIHNpemU9IjIiIHdpZHRoPSIxMDAlIiBhbGlnbj0iY2VudGVy Ij4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6Ny41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpncmF5Ij48YnI+DQpUaGlzIGUtbWFpbCBtYXkgY29udGFpbiBTcHJpbnQgcHJvcHJpZXRhcnkg aW5mb3JtYXRpb24gaW50ZW5kZWQgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgcmVjaXBpZW50KHMp LiBBbnkgdXNlIGJ5IG90aGVycyBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50 ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UgY29udGFjdCB0aGUgc2VuZGVyIGFuZCBkZWxldGUgYWxs IGNvcGllcyBvZiB0aGUgbWVzc2FnZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_837ed8129f6a4b14ba524f7e154540b9PLSWE13M08adsprintcom_-- From nobody Thu Aug 4 12:02:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5E8712DAE8 for ; Thu, 4 Aug 2016 12:02:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FL1V5bgTvN88 for ; Thu, 4 Aug 2016 12:02:38 -0700 (PDT) Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F6D312DAE7 for ; Thu, 4 Aug 2016 12:02:38 -0700 (PDT) Received: by mail-qt0-x230.google.com with SMTP id x25so163522927qtx.2 for ; Thu, 04 Aug 2016 12:02:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=7n5fYurrgmLlzoNo7BpBOFRo602T30mWs1K//GVHW68=; b=xXKuIZDy2dE3HMYsezKoh3OrA+483DR67fSh4ghvH+iQFjXs5XAm33l82c7+NzsA93 sYpdAlUPuf29aIzcdATFO+qV07mB/t4CawWGSNsYqqtSoY0VwjUAa683hqi9JBFZwGF2 q/2E6mNuXEoETlsA6+zRJ6SQic2YKsJZCfV3cqwulEX6N1ZV2QyWZu3xgfp64RARdc8O r7eoEnvP+KPd74ePke4jac73EK4wkZfOyEkDO2j60TonDyGczmeDPNfmhl2de/Dwkggu w1XrxMi/7OLKokuJ93p+31USALhnpDmiinTPu06AdaB0du5AXVIDeRqDtgvgYmgx24z5 STCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=7n5fYurrgmLlzoNo7BpBOFRo602T30mWs1K//GVHW68=; b=Cs5MW4KQxdEEv3W4od8tBS/16dBN32prOp/4BjYZMCLDS2kutpMLNwyRxnwOkXQu2M Hs43/6xJdzTMQOYQDsmyo8tZoJjb1LXi9aImkd2X3Og+GLTItB8dP99jW7Kx5MAEDlwq 8qqKDz4nlYfnhxLJafgYggdSh9D+sZSZxKqKB/1PlltPhRbU+iMsnWahWbgDhcIwQdFv XE4ZSimzUrs0x4Qq33UJj85lx1rA721kwMenGyYHOF5ZaafF1RTg1mipd10AwjPhVyDT twn/JkGdtA5GD5Vfvs4FuOzSkzIQUkSTTjYS5vBCJBe/1YF4JzyLctQL82hyJXFUfJa2 XgUw== X-Gm-Message-State: AEkoouvlUtx9kXE+hy2KpyvU7R0pXVMFmy2PZqJVgvoD1R6S3hFu6U5/wnAYu4ZIK+Htdw== X-Received: by 10.200.42.69 with SMTP id l5mr8397603qtl.13.1470337357330; Thu, 04 Aug 2016 12:02:37 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id j188sm4629669qke.22.2016.08.04.12.02.35 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 12:02:36 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_C012A696-476B-4B71-9AB1-43137115F93D" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> Date: Thu, 4 Aug 2016 15:02:35 -0400 Message-Id: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 19:02:42 -0000 --Apple-Mail=_C012A696-476B-4B71-9AB1-43137115F93D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Well, the mechanisms are designed so that they could be deployed on = devices and PBXs. Whether they will be is a policy issue. The notion of credentials that are traceable to a delegation of a TN is = a mechanism that is part of the design of stir, and the design allows = delegation of one TN (to one device, although a device like a PBX would = have more than one TN per =E2=80=9Cdevice=E2=80=9D, and something like a = dual NAM phone could have more than one credential. For the use case = we=E2=80=99ve discussed, a mobile phone may also have a credential for, = say, a TN that is delegated to a landline, to cover the example case of = a doctor placing a call on his mobile, but getting his office number to = show up as the calling party. Use of such mechanisms is policy. Brian > On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] = wrote: >=20 > Thanks Brian. I=E2=80=99m afraid we=E2=80=99re straying into a policy = discussion. Regardless, I do appreciate your explanation. I would like = to continue the discussion, but I=E2=80=99m pretty sure this isn=E2=80=99t= the right forum. > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net]=20 > Sent: August 04, 2016 1:34 PM > To: Gorman, Pierce A [CTO] > Cc: Alex Bobotek ; stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > Of course I want PBXs to sign calls. As well as smart phones and any = other devices that can be programmed to do so. > They will be given credentials that only are valid for the TNs they = are authorized to sign for. They can try to sign any call, but the = validity of the credential would make such a signature fail the = checking. > =20 > Getting service providers to sign on behalf of devices is a reasonable = way to deploy quickly, but I expect many SPs will want to get out of the = liability of signing on behalf of their customers. If they can push of = that responsibility to their customer, only being responsible for = getting the customer an appropriate credential when they assign TNs, = then I would expect them to want to do so. That means the devices have = to be able to sign, but I understand many of the PBX vendors think = that=E2=80=99s something they could provide in a future release. > =20 > Brian > =20 > On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] = > wrote: > =20 > You want IP PBXes to sign calls? Won=E2=80=99t that make it = extraordinarily easy to commit fraud with authenticated numbers? > =20 > =20 > From: Brian Rosen [mailto:br@brianrosen.net = ]=20 > Sent: August 04, 2016 12:24 PM > To: Gorman, Pierce A [CTO] > > Cc: Alex Bobotek >; = stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > First of all, we would want the PBX to generate the signature, but the = service provider can do that. It should not add a valid signature to a = call from a number it did not assign to the trunk group connecting to = the PBX, although it could support the extra delegation required to = support =E2=80=9Cauthorized spoofing=E2=80=9D. The companion devices = I=E2=80=99m aware of always send calls from the same service provider = and should not present any issue.=20 > =20 > Everyone will have to do work they don=E2=80=99t do now to implement = stop spoofed calls. TANSTAAFL > =20 > Brian > =20 > On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] = > wrote: > =20 > Fraud from compromised PBXes is common. And even where a PBX is not = compromised, a carrier has no practical way of knowing whether the = calling number is properly assigned and valid from the perspective of = the Enterprise. Therefore, checking whether the calling number was from = an assigned range might be possible (and fraught with administrative = challenges), but of limited value. And in the consumer market, there = are calling products which support a parent subscriber number and = =E2=80=9Ccompanion=E2=80=9D devices (e.g., tablets) which can place a = call using the MDN of the parent subscriber. These are examples of = where the authenticity of the calling number won=E2=80=99t necessarily = mean the same thing as the authenticity of a call from a single = subscriber with a single MDN regardless of =E2=80=9Claxity=E2=80=9D of = spoof checking. > =20 > In another forum and anticipating calling number authentication = mandates from Congress and/or FCC, I suggested using carrier-specific = certs and encoding specificity of authenticity, and calling number. = This provides the identity of the originating carrier, some idea as to = the accuracy or specificity of the calling number, and validty of the = calling number (assuming nonce and replay issues can be addressed as = reasonably suggested below by Alex). > =20 > The representation of orig-carrier and trustworthiness could be as = follows: > =20 > Regulated/mandated Carrier Class Use Case: > =20 > 00 - No Credentials > Use case example(s): Pre-IMS, legacy circuit-switched networks that = don't natively support SIP or which don't choose to sign calls. E.g., = international carriers. > Trust Estimate: Good luck. Carrier_orig and CgPN entirely = untrustworthy. > =20 > 01 - Carrier signed, no authentication of CgPN > Use case example(s): E911 on visited network w/o roaming agreement, = manual roaming. > Trust Estimate: Carrier_orig trustworthy, CgPN entirely untrustworthy > =20 > 10 - Carrier signed, semi-authenticated CgPN > Use case example(s): Number block delegated from OCN, but no per-TN = screen (SIP trunks). > Trust Estimate: Carrier_orig trustworthy, CgPN less than most = trustworthy but not entirely untrustworthy. > =20 > 11 - Carrier signed, authenticated CgPN > Use case example(s): Bread-and-butter 95%+ of calls from subscriber = lines (IMS-based and otherwise). > Trust Estimate: Carrier_orig trustworthy, CgPN most trustworthy > =20 > Public Use Case: > =20 > Undefined but assumed to use public or commercially available = authentication services resources. e.g., nomorobo-like crowd-sourced = accept/deny lists, et cetera. Could/would pass credentials down to = SIP-aware devices which would process them according to the rules of the = Public Class application(s). > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net = ]=20 > Sent: August 04, 2016 9:02 AM > To: Alex Bobotek > > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > There are reasonable circumstances where a party placing a call is not = the authorized entity assigned the telephone number used in From/PAI, = and in such circumstances the service provider servicing the entity = placing the call may or may not be the same as the service provider = serving the entity that is assigned the TN. In all such cases, the = entity that is assigned the TN explicitly authorizes calls placed using = it=E2=80=99s TN. The design accommodates such use cases. It=E2=80=99s = not a blanket authorization without authentication. We=E2=80=99re not = aware of any cases where there is an actual requirement for legitimate = calling without explicit authorization from the assigned entity, = although we certainly are aware that various parts of various service = providers don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more. > =20 > Brian > =20 > On Aug 3, 2016, at 8:35 AM, Alex Bobotek > wrote: > =20 > 1. Permit authorization without authentication > In the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided identity. = Are there legitimate use cases for this? Has anyone established that = there are not? How can the industry reasonably expect to end this = (often bad) practice? If it can=E2=80=99t be ended, there=E2=80=99s = value in at least identifying the originating service provider (i.e., = the signer/authorizer). Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the abuser. = Based on the assumption that it=E2=80=99s better to ID service providers = than unreasonably expect a ban of the use of unauthenticated (and = therefore unsigned) SIP requests, STIR signing should support = authorization without authentication. The practice of authorizing = unauthenticated use exists, and there is benefit to signing in these = cases (service provider identification). The language of the ID should = permit this use. 4474bis-10 should NOT require or assume that that = authentication will precede authorization. Of course there may be other = use cases where signing includes authentication and may not include a = specific service provider=E2=80=99s authorization. > =20 > =20 > 2. Improve replay prevention > Proximate replay is possible while complying with this spec. First, = one or more proximate (e.g., within 60 seconds) SIP requests using the = same token are legal and subject to replay in many cases. An SDP = body=E2=80=99s mky may not be present and if present its use is = optional. Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) = could prevent replay. Different methods (e.g., INVITE vs MESSAGE) might = be handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured request. This = might include an mkey from a captured INVITE. So it may be possible to = DOS, spam or text-bomb a recipient using a captured identity. While = large-scale or distributed implementations may make the enforcement = difficult, there is little cost to signing and decoding a method and = possibly a numeric ID. Some sort of =E2=80=981-use=E2=80=99 practice = should at least be discussed while perhaps not required. =20 > =20 > =20 > Specific markup suggestions: =20 > =20 > =20 > NITS > =20 > The verifier MUST inspect any optional "ppt" parameter appearing in = the > Identity request. If no "ppt" parameter is present, then the > verifier proceeds normally below. If a "ppt" parameter value is > present, and the verifier does not support it, it MUST ignore the > Identity header. If a supported "ppt" parameter value is present, > the verifier follows the procedures below, including the variations > described in Step 5. > =20 > <>3 = . Background >=20 > [=E2=80=A6] > =20 > Per [RFC7340 ], problems such = as robocalling, voicemail hacking, and > swatting are enabled by an attacker's ability to impersonate = someone > else. The secure operation of most SIP applications and services > depends on authenticating and/or authorizing the source of = communications as it is > represented in a SIP request.=20 > =20 > This identity architecture for SIP depends on includes provisions = for a logical > "authentication service" which validates caller identity at or near = origination. outgoing requests. An > authentication service may be implemented either as part of a user > agent or as a proxy server; typically, it is a component of a = network > intermediary like a proxy to which originating user agents send > unsigned requests. Once the sender of the message has been > =20 > =20 > This document specifies a means of sharing a cryptographic = assurance > of authenticity of and/or authorization to use end-user SIP = identity in an interdomain or intradomain context. > It relies on the authentication service constructing tokens based = on [=E2=80=A6]=20 > =20 > =20 > =20 > To maximize end-to-end security, it is typically obviously > preferable for end-users to acquire their own credentials; if they > do, their user agents can act as authentication services. However, > for some deployments, [=E2=80=A6] > =20 > =20 > Regards, > =20 > Alex=20 > =20 > Alex Bobotek > =20 > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > =20 >=20 > This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. --Apple-Mail=_C012A696-476B-4B71-9AB1-43137115F93D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Well, the mechanisms are designed so that they could be = deployed on devices and PBXs.  Whether they will be is a policy = issue.

The notion of = credentials that are traceable to a delegation of a TN is a mechanism = that is part of the design of stir, and the design allows delegation of = one TN (to one device, although a device like a PBX would have more than = one TN per =E2=80=9Cdevice=E2=80=9D, and something like a dual NAM phone = could have more than one credential.  For the use case we=E2=80=99ve = discussed, a mobile phone may also have a credential for, say, a TN that = is delegated to a landline, to cover the example case of a doctor = placing a call on his mobile, but getting his office number to show up = as the calling party.  Use of such mechanisms is policy.

Brian

On Aug 4, 2016, at 2:52 PM, = Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

Thanks Brian.  I=E2=80=99m afraid we=E2=80=99re = straying into a policy discussion.  Regardless, I do appreciate = your explanation.  I would like to continue the discussion, but = I=E2=80=99m pretty sure this isn=E2=80=99t the right forum.
 
Pierce
 
From: Brian = Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 1:34 PM
To: Gorman, Pierce A [CTO] = <Pierce.Gorman@sprint.com>
Cc: Alex = Bobotek <alex@bobotek.net>; stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
Of course I want PBXs to sign calls. =  As well as smart phones and any other devices that can be = programmed to do so.
They will be given credentials that only = are valid for the TNs they are authorized to sign for.  They can = try to sign any call, but the validity of the credential would make such = a signature fail the checking.
 
Getting service providers to sign on behalf of = devices is a reasonable way to deploy quickly, but I expect many SPs = will want to get out of the liability of signing on behalf of their = customers.  If they can push of that responsibility to their = customer, only being responsible for getting the customer an appropriate = credential when they assign TNs, then I would expect them to want to do = so.  That means the devices have to be able to sign, but I = understand many of the PBX vendors think that=E2=80=99s something they = could provide in a future release.
 
Brian
 
On Aug 4, 2016, at = 2:22 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> = wrote:
 
You want IP PBXes to sign calls?  Won=E2=80=99t = that make it extraordinarily easy to commit fraud with authenticated = numbers?
 
 
From: Brian Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 12:24 PM
To: Gorman, Pierce A [CTO] = <Pierce.Gorman@sprint.com>
Cc: Alex = Bobotek <alex@bobotek.net>; stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
First of all, we would want the PBX to generate the = signature, but the service provider can do that.  It should not add = a valid signature to a call from a number it did not assign to the trunk = group connecting to the PBX, although it could support the extra = delegation required to support =E2=80=9Cauthorized spoofing=E2=80=9D. =  The companion devices I=E2=80=99m aware of always send calls from = the same service provider and should not present any issue. 
 
Everyone will have to do work they = don=E2=80=99t do now to implement stop spoofed calls. TANSTAAFL
 
Brian
 
On = Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:
 
Fraud from compromised = PBXes is common.  And even where a PBX is not compromised, a = carrier has no practical way of knowing whether the calling number is = properly assigned and valid from the perspective of the = Enterprise.  Therefore, checking whether the calling number was = from an assigned range might be possible (and fraught with = administrative challenges), but of limited value.  And in the = consumer market, there are calling products which support a parent = subscriber number and =E2=80=9Ccompanion=E2=80=9D devices (e.g., = tablets) which can place a call using the MDN of the parent = subscriber.  These are examples of where the authenticity of the = calling number won=E2=80=99t necessarily mean the same thing as the = authenticity of a call from a single subscriber with a single MDN = regardless of =E2=80=9Claxity=E2=80=9D of spoof checking.
 
In another forum and anticipating calling number = authentication mandates from Congress and/or FCC, I suggested using = carrier-specific certs and encoding specificity of authenticity, and = calling number.  This provides the identity of the originating = carrier, some idea as to the accuracy or specificity of the calling = number, and validty of the calling number (assuming nonce and replay = issues can be addressed as reasonably suggested below by = Alex).
 
The = representation of orig-carrier and trustworthiness could be as = follows:
 
Regulated/mandated Carrier Class Use = Case:
 
00 - No = Credentials
Use case example(s): = Pre-IMS, legacy circuit-switched networks that don't natively support = SIP or which don't choose to sign calls.  E.g., international = carriers.
Trust Estimate:  Good = luck.  Carrier_orig and CgPN entirely untrustworthy.
 
01 - Carrier signed, = no authentication of CgPN
Use case example(s): E911 on visited network w/o roaming = agreement, manual roaming.
Trust Estimate:  Carrier_orig trustworthy, CgPN entirely = untrustworthy
 
10 - Carrier signed, semi-authenticated = CgPN
Use case example(s): = Number block delegated from OCN, but no per-TN screen (SIP = trunks).
Trust Estimate: =  Carrier_orig trustworthy, CgPN less than most trustworthy but not = entirely untrustworthy.
 
11 - Carrier signed, authenticated = CgPN
Use case example(s): = Bread-and-butter 95%+ of calls from subscriber lines (IMS-based and = otherwise).
Trust Estimate: =  Carrier_orig trustworthy, CgPN most trustworthy
 
Public Use = Case:
 
Undefined but assumed to use public or commercially available = authentication services resources.  e.g., nomorobo-like = crowd-sourced accept/deny lists, et cetera.  Could/would pass = credentials down to SIP-aware devices which would process them according = to the rules of the Public Class application(s).
 
Pierce
 
From: Brian Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 9:02 AM
To: Alex Bobotek <alex@bobotek.net>
Cc: stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
There = are reasonable circumstances where a party placing a call is not the = authorized entity assigned the telephone number used in From/PAI, and in = such circumstances the service provider servicing the entity placing the = call may or may not be the same as the service provider serving the = entity that is assigned the TN.  In all such cases, the entity that = is assigned the TN explicitly authorizes calls placed using it=E2=80=99s = TN.  The design accommodates such use cases.  It=E2=80=99s not = a blanket authorization without authentication.   We=E2=80=99re not = aware of any cases where there is an actual requirement for legitimate = calling without explicit authorization from the assigned entity, = although we certainly are aware that various parts of various service = providers don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more.
 
Brian
 
On Aug 3, 2016, at 8:35 AM, Alex Bobotek <alex@bobotek.net> wrote:
 
1.       Permit authorization without authentication
In the current telephony network practice, some = service provider implementations choose not to authenticate identity, = but simply facilitate the use of an arbitrary or selected user-provided = identity.  Are there legitimate use cases for this?  Has = anyone established that there are not?  How can the industry = reasonably expect to end this (often bad) practice?  If it = can=E2=80=99t be ended, there=E2=80=99s value in at least identifying = the originating service provider (i.e., the = signer/authorizer).  Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the = abuser.  Based on the assumption that it=E2=80=99s better to ID = service providers than unreasonably expect a ban of the use of = unauthenticated (and therefore unsigned) SIP requests, STIR signing = should support authorization without authentication.  The practice = of authorizing unauthenticated use exists, and there is benefit to = signing in these cases (service provider identification).  The = language of the ID should permit this use.  4474bis-10 should NOT = require or assume that  that authentication will precede = authorization. Of course there may be other use cases where signing = includes authentication and may not include a specific service = provider=E2=80=99s authorization.
 
 
2.       Improve replay prevention
Proximate replay is possible while complying with this spec.  First, one = or more proximate (e.g., within 60 seconds) SIP requests using the same = token are legal and subject to replay in many cases.  An SDP = body=E2=80=99s mky may not be present and if present its use is = optional.  Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) could prevent = replay.  Different methods (e.g., INVITE vs MESSAGE) might be = handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured = request. This might include an mkey from a captured = INVITE.   So it may be possible to DOS, spam or text-bomb a = recipient using a captured identity.  While large-scale or = distributed implementations may make the enforcement difficult, there is = little cost to signing and decoding a method and possibly a numeric = ID.   Some = sort of =E2=80=981-use=E2=80=99 practice should at least be discussed = while perhaps not required.  
 
 
Specific markup suggestions:  
 
 
NITS
 
   The verifier MUST inspect any optional "ppt" =
parameter appearing in =
the
   Identity request.  If no "ppt" parameter is =
present, then the
   verifier proceeds normally below.  If a =
"ppt" parameter value is
   present, and the verifier does not support it, =
it MUST ignore the
   Identity header.  If a supported "ppt" =
parameter value is present,
   the verifier follows the =
procedures below, including the variations
   described in Step 5.
 

3.  = Background

[=E2=80=A6]
 
   Per [RFC7340], =
problems such as robocalling, voicemail hacking, and
   =
swatting are enabled by an attacker's ability to impersonate someone
   =
else.  The secure operation of most SIP applications and =
services
   depends on authenticating and/or authorizing the source of =
communications as it is
   represented in a SIP request.
 
   This identity architecture for = SIP depends on includes provisions for a logical
   =
"authentication service" which validates caller identity at or near origination.  outgoing requests.  An
   authentication service may be = implemented either as part of a user
   agent or as a proxy server; =
typically, it is a component of a network
   intermediary like a proxy to =
which originating user agents send
   unsigned requests.  Once =
the sender of the message has been
 
 
   This document specifies a means = of sharing a cryptographic assurance
   of authenticity of and/or authorization to use end-user =
SIP identity in an interdomain or intradomain context.
   It =
relies on the authentication service constructing tokens based on [=E2=80=A6=
]
 
 
 
   To maximize end-to-end security, = it is typically obviously
   preferable for end-users to acquire their own =
credentials; if they
   do, their user agents can act as authentication =
services.  However,
   for some deployments, [=E2=80=A6]
 
 
Regards,
 
Alex 
 
Alex Bobotek
 
 
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
 

This e-mail may = contain Sprint proprietary information intended for the sole use of the = recipient(s). Any use by others is prohibited. If you are not the = intended recipient, please contact the sender and delete all copies of = the = message.

= --Apple-Mail=_C012A696-476B-4B71-9AB1-43137115F93D-- From nobody Thu Aug 4 13:53:50 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF37312B005 for ; Thu, 4 Aug 2016 13:53:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id inscvXQJIUt9 for ; Thu, 4 Aug 2016 13:53:43 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0127.outbound.protection.outlook.com [104.47.32.127]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F40A112B029 for ; Thu, 4 Aug 2016 13:53:42 -0700 (PDT) Received: from BN1BFFO11FD031.protection.gbl (10.58.144.32) by BN1BFFO11HUB016.protection.gbl (10.58.144.163) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.5; Thu, 4 Aug 2016 20:53:40 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.39) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.39 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.39; helo=plsapdm3.corp.sprint.com; Received: from plsapdm3.corp.sprint.com (144.230.172.39) by BN1BFFO11FD031.mail.protection.outlook.com (10.58.144.94) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Thu, 4 Aug 2016 20:53:40 +0000 Received: from pps.filterd (plsapdm3.corp.sprint.com [127.0.0.1]) by plsapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u74KZSsu004237; Thu, 4 Aug 2016 15:53:40 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm3.corp.sprint.com with ESMTP id 24jxar7bkv-2 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 04 Aug 2016 15:53:40 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 4 Aug 2016 15:53:38 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Thu, 4 Aug 2016 15:53:38 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA490iQgABp2QD//7d2kIAAXCcA//+wgXCAAFdmgP//rKIQ Date: Thu, 4 Aug 2016 20:53:37 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: multipart/alternative; boundary="_000_ced872efc4a549ce9157b2440fd2a408PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.39; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(24454002)(189002)(377454003)(199003)(4546004)(19625215002)(7846002)(84326002)(93886004)(2906002)(4326007)(7736002)(7906003)(86362001)(3846002)(87936001)(68736007)(6116002)(2900100001)(189998001)(19580405001)(19580395003)(11100500001)(7696003)(19617315012)(50986999)(76176999)(24736003)(102836003)(92566002)(54356999)(110136002)(5250100002)(2950100001)(790700001)(108616004)(97736004)(15975445007)(16236675004)(19300405004)(106116001)(81156014)(81166006)(106466001)(8676002)(33646002)(356003)(586003)(512874002)(8936002)(559001)(579004)(569005); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1BFFO11HUB016; H:plsapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11FD031; 1:6egyJg3Dp/YcBdVYbtzGzBtkCMJEtxJJHKNfJ6qCrqkhJ7ykKXTkgwnZ4B+qu3I/94l1MfL+h7RmLYtEcQ0TqB8npTmdrc6FaT8uos6/37A9wZTheVP85YN35yf99chliu7jfUFpp5YpWXw1Xje4ylIfnWFY1g4c2M7ITLt2aSNjea5RKmlh5ZH72kLrh9PzYjiyCiRoSUo3Jg5CdTypGk2QLKCmd/4yL/FrHRI/czIxsJ1MiSpxSMjYubEs+wDXPvwbdx9D6yB/ztwyss7LlSSH5R38TuyJo6wjeDuQNy9KP5ou53yVPtQ/BfmBsqDUNn2Te4Z7+bxbFQYk2FfH0CG/xdOw01mbFr4I2TW8LqpfMc+J6wCxldqC3Mjvyzs2J8F19O4WD68qjYjjTwBoeFUmxAtCidXaqxKs5XWs1WvkIGji5lX9G2VDvYXfZFLzYpUxdhk5+FiUxyOT9GU13kw9aeeAJRY/EZ/2J/L57bNLhjqVjQ0ai63nO8jzObiVw91hH+dpvRQb1JCtnWE3yezVIqbAnN9kTMd4Jh4JFtTdlUmKp52j+EvHEAIY9cC1 X-MS-Office365-Filtering-Correlation-Id: 205cd4b8-8667-463e-d207-08d3bca96a31 X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB016; 2:0EFrAcwWi+ZYsMYuEoJHgNhjefqTmrGVdzBmeAmdNeRMkHZWupIYhJOfdM/2qzjccAd7z43Nu8Cd51cCbigbVmNAx3UzLfqiobqI1k7c09UYmzNPHneDZV6G5cRTlVQr2re7CsEQ6AVxCHiHaBNWmYbtFn0WmTeUl6CK3bEjmqPknv5BaoorszfMAAEE2l3h; 3:a4F09vleTwVmJ2ZAuigNIZmgPre69WTnQNv3E1cgsMRXydvAriKGwnNDohIHaX1XOckq3FOX754vjmcr/P+OC4U6dqpAiYxwuJ798LjhnHczW2WA8v0+m3KiHAAvTaXag+t4Qb08+6Y1GafBb2DzjPg+BYA2dOrJc3xpUKM0X3pRtGMmOkahAJe97GiUddDfNrTU+x9PavkGkuNMR145vB7mh4+zyi64OnGDhuy//C4MAyCxnElcr+V1Rooer3HhnOyKnKfu+q4Lo+L2p83wNw==; 25:3MOCkvYHHq3Iyt96GMNHI0M+SE8d9HTS8ZgkE1hUzVFFzauHQabqllFjrYCJb+uro89iF4yA/K1/tezq9h3CBG6oWVoaaGxroTiY+lWGIwwrHvwVahppThTW1tMBYetZfRHC6BTzgW2xpQ2z2RZUzm3c2uKOQ9BZj49DhpuIevfuKVXK4tTaPNnX+vtTXHhzfIfP6QGHYc87qAjT5UM28oynGruk+uacacD2sRyl9BT57H5yZkPnI7fXMj1LrG6ulV1V43TOmc9pLDgDSp+0nsA0Dwueok+ZpHR+yavicZmPzurZMF7rrn5NyLiNc3D97JMB1RBIPy+5I3mI1hNCqm8QYhstzSlFPSn/N2CfmZtOTMLUE0iKP+VBhrvvbTrxIaKVAKiskGTMmqf11n94sbA1GiJ/wSmCnNjckqEGpPV1MeLOs+PlG1DT7SliI/Vu X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1BFFO11HUB016; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB016; 31:Wxu1KStw3zhlNZkKpfem8Ou+pgIXENm03BXJKx01HMqyvy/bXwsBCZkX9d2hN0Fu9e1+m641ohlg4YFhgLXEO399JX1j+Dh+TGTQDdIY5h3Zv3cLl8JBViCoO/7PZKrzMB7+1CjsIY3aqr7hXU+BnzaboVyS5ieJq91f3QD867L58B5EdLnOiYE2FdCkuDtQT7qijdiuI+JzSCFhMsUt8h4kkNsY0+m/rDFHx5/Pzs8=; 20:0zmkzX4craVKZ+gzzwd1hAk+gt94FsYdNU7fjh7+bkzs68eVB2aHFp0Ogs0dOIo+fjPbaCjdYcwn7CGp0VXOpMY4RBwL9bTGK+M/4Wa0ZGRdibmIJBOUjEwyqJG/JDKzYWygZplg3UdSlQeuAYletLmjcur64mVhF6FfQX3yFmhaYY0/sPx8w5bvpZne2/hK8ksCMxxBZRidxBKouyLMGqbjKxsLTpNComiQ+dC7wel7f20oQx6qJKQlCf8M5iKWqo6FDExhnBxI2DWQ97hVLs4HuZmnPfmno3Q+kqVwTSnh8JQ8oBOiYnztL7ywVf4KYTyWZxtKVbYTZg1yYQQSlzSV4t7NgcPbLXNkyBUwE+grbi8Yhj96BvdeE5Hna2pHJycikd0R3q+WRtJspWorv7UrohOATYAIydD5KBFQw7k= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(278428928389397)(192374486261705)(18430343700868)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(8121501046)(5005006)(13024025)(13015025)(13018025)(13023025)(13017025)(10201501046)(3002001)(6055026); SRVR:BN1BFFO11HUB016; BCL:0; PCL:0; RULEID:; SRVR:BN1BFFO11HUB016; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB016; 4:CWlJ1JU0dugba4x879UWrcIT2PrIWmmQpjhw6HJg+GGl6f5wJ6EPV0Jqs+GAdhExGooBN9uknYbjIyiEnWI1JWj2COnWR1w89CpfquG38rVacazE+3zX5W3UqmIPL5jMDDPKecGgmf/Sn9GhuglRpw2fQBI2ZbRvxqIPU3UnICoN7DaE8ybT7vF4zdI6r0X0WSIxoUSM9tp+kAsoJnj7mc0dYo/PN4k8pZctz7MeRa0ySo1iaIjPH7keUeT56BLDGP1zcBRnJW5FNXYrF/JsK5TbSj3GQHwhhDjCvHGVIh2O11SSrRl1xBbQO6Kjbw7sxVuZQ1XNmBpGzUF0RD1DJOdDfP9lIHJaQCXjgVl6ShnPh9isOnSwbRM42mJsjPhL/uq9TEf7Vp7UFYyppcXFlqeDxppJVpSB5gNgAwCsm/vV4yfXBS69IUv8s22mGJDpPgKUPAL6wz7g1qUICI0cn7z1ieJMGaf8QmUrtL4KruMaK92Hq/BF1O5Rm+63ocy7yQ9b6AMItI8mKETheFao9CMPX4m8LVnn8APV+V+szUrhhaFy6zNSeCaVUdMZMcOnz7T8eNnELkKsBrR1T3dig9AEByHIiVBLR6USuTuiRe0spU6edCBT6bKklsTX/xpa2PWIkHX3zL27674moureIeJZJHzOg4DLAvVLe99L9tU= X-Forefront-PRVS: 00246AB517 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1BFFO11HUB016; 23:oxw6+4bc/+EBHoSDA/7KprUTACSTXRB3lq3Fmjg?= =?us-ascii?Q?nQ1a2fjAi9zBnfxuHEL2oy0cybz3nS7MV4GcaesLHVTkQ9FTH85/1xFWL37n?= =?us-ascii?Q?oVwWoWRnJ6Txsj+q4E7Pvp5RYEXC/qOi/kK8de6Q8+ZgLlK1LmsP7hzP8cs6?= =?us-ascii?Q?XEVV25ezjmSYZ/Z+wQAsBpgLtGbYZIhmhD+bDsXE4siVyDGCugeoiRuO5Suh?= =?us-ascii?Q?a2g61O9XgUhWCMM1N2Oo2mlRTHicApTk160jmfJBRVY/V72ileCiP7KPRbop?= =?us-ascii?Q?3a0jgmxlBwBpAaOx6uMWosAMb6Bl9h7E/QFBbh6N/yg+FPER80BMbpcyYELA?= =?us-ascii?Q?2HCjkWjHdeOkIuVx2DmYl5qjX/d9clEPmvVLTlaH554+AyzAWtJrGLfwm8LM?= =?us-ascii?Q?AjVOXiXm+mZ1LPfaS2GDxhjPlLabiIYfVYcXGiY/sNvUhOxpXRc/fpI5bid1?= =?us-ascii?Q?sMVR+j7je84nXnIFQTKhE1a4EbuYumArsq/j2BwVfITLIm3N+sCZAffK6zMv?= =?us-ascii?Q?hURzLFThAqco41DjQp8Cl6QWY0ZcJp1tFNe6TCDBNh5mhKBeC37jx1VDPF1E?= =?us-ascii?Q?4K+llqzbLCdMZGO273x3cUDyQbT1sDqIQk5CD40CPqusjdlMRCK8POQoUl37?= =?us-ascii?Q?YXSjBoMh9tE85HLxIrmtMeejItRs8ioJ5WzLQayWosaK1FUkhT5qAq1q8CeD?= =?us-ascii?Q?EmgsDZ0BonsoG0QModcOBMpa3sfhyn1u2Oqh/VAZwtOnnPPG9geJasPacV4j?= =?us-ascii?Q?6snOa2S/3kZ4Ah4PW0jP+SU1XskbJF5J70oIgQZ+70p/VMxAAN3n1EfycE5D?= =?us-ascii?Q?0fS4r+Y4rDoXI6F/Ncq9rODsdYa7gcBg6oof4aWl6jDDwd+N+Ao4h83Y1PzP?= =?us-ascii?Q?lFI1kOPPKDIVmn0vQFlJjrjbx3u19CwNr7WE1EiatDIu0zR7oMVyuI7ImQew?= =?us-ascii?Q?9HsRwLZ/oYXCgAv12zR+RzBINP3G6Z+dIbt0uPdTrSqksUXUZ/hZYdn5SLgF?= =?us-ascii?Q?lY6kDmPi8cAYYhVCKqT0qRN4IkIsednlGhUyk9Nio4uSz9iF/4EofswAJoRe?= =?us-ascii?Q?tb1CT+PI5zEGwznF2jbDD+VgTdCicuXCdGwcyD/thWYSi0oWIwRInZBWkO9o?= =?us-ascii?Q?FBGTDUX8n0oln4u+3ZA7jrWsQ0fByXJP5+tXnDLYRIxvoviVRSkllHVHUAzk?= =?us-ascii?Q?BSjna4XCUBVZbFquiRgKUyk3gUpYKUEZKhvOHj0g+V4HlgGwMl1+3fL/SbAC?= =?us-ascii?Q?n7/GMZweLBhM6D/bmZa52B5eNEUHzzSqVIvDTCkGjYiT6QMcpnOfsAbPopVI?= =?us-ascii?Q?YW+YFzWDiBk53dJIAV9wxcvNbv6uAsNUahSLEOryEWXkOeLisD5VFTLLnT5y?= =?us-ascii?Q?25QNkIK/BepB0EqTqSbLl4DLwdRg=3D?= X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB016; 6:rl3AqSsem+fbTJ96swZ5eUJRRhE/zoCUE/vNo/QMbZag1r1OUt0Q+Rl6ygEmRM9cnWT/gM4v2dknA3Haml5FDSdInTd6IA95cQ8ZIOl7xoe+oKr77cdAHopAgl9PlqL2l8a+1oLSp9PYTjAaVrJYrpBPEfA0wTEnLY/WBJAnIBtoy3GAyE1KDM8nImoEN94cXbUFK9engc76rW/11A1hV7KJQF6caQ6auA8uNjxxQqTLhSzS47/9kMDCm3VFcV8Q8qAwjbjiuEp1lT8Lju8M17VfF1jNzP5Zo+jDzMasNPtxr951CkYHPLmt9IsOEu/Hz67eQXnFUPutbAAH4TWBJA==; 5:Ny4ciyoh0u5sVQ96g+EMeEC+dJOalchNISXtAFTvOuZ3eRfsFQzGFKtvDi+ODEYPGSVZazu1EUMaXEZGgrdrAF7tNQ/fDoQzuhKqiB65F1HlTcQkl0wMRyYyOXTrLZpG0Ztl86seCKgn3HX1W0UFxg==; 24:w5f+mIDCjHb3JxMkC/BOfrfsedZnvkPZlB6jQxatI2gsA7z+bwL3kk27RrpR4SMgafb8Kca172g988vwkdAaDn2BZ1fPEbErWFigo046Q3A=; 7:LggwCVNC/r3NlUQ7AS2ic+dV7Xqf+YVbXMOzX/cOouHiPVUhD+8cLlxzHWog3crpp5DgMGo3tJ5XBbTyeum6/gz/6xWJULugMeJGFgZTa+cXgh8cWlykzIx4s/1EDHvnDsX0YcCLJc6wf7GzupRNg4hDVODCDiNgydVNwQOEVFgzyGM3WcqYidNUgYfiZ9Aw/v5i9QrILzgc2QWqKw9gfJRoZ62nwq1KAhdy0OmdeAm6GlDillwRJ1VsODPCgXlW SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2016 20:53:40.4956 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.39]; Helo=[plsapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1BFFO11HUB016 Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 20:53:49 -0000 --_000_ced872efc4a549ce9157b2440fd2a408PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T0ssIHlvdSB0YWxrZWQgbWUgaW50byBpbmR1bGdpbmcgaW4gb25lIG1vcmUgbWVzc2FnZSBvbiBw b2xpY3kgYW5kIHVzZSBjYXNlcy4NCg0KSSBhZ3JlZSB0aGF0IHRoZSBTVElSL1BBU1Nwb3JUIG1l Y2hhbmlzbXMgY291bGQgYmUgZGVwbG95ZWQgb24gaW5kaXZpZHVhbCBkZXZpY2VzIGFzIHdlbGwg YXMgbXVsdGktZGV2aWNlIGFuZCBtdWx0aS1udW1iZXIgcGxhdGZvcm1zLg0KDQpOdW1iZXIgZGVs ZWdhdGlvbiAoYW5kIHN1Yi1kZWxlZ2F0aW9uKSwgYW5kIGJ1c2luZXNzIHJlbGF0aW9uc2hpcHMg YXJlIHR3byBhZGRpdGlvbmFsIGZhY3RvcnMgd2hpY2ggYWZmZWN0IHRydXN0d29ydGhpbmVzcyBv ZiBhIGdpdmVuIGNhbGxpbmcgbnVtYmVyIGF1dGhlbnRpY2F0aW9uLg0KDQpJbmhlcmVudCB2YXJp YWJsZSB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBjYWxsaW5nIG51bWJlciB3YXMgbXkgcmVhc29uIGZv ciBzdWdnZXN0aW5nIGEgd2F5IHRvIHF1YWxpZnkgdGhlIHNpZ25hdHVyZSB0byByZWZsZWN0IHRo YXQgdmFyaWFiaWxpdHkuDQoNCk9yaWdpbmF0aW5nIGNhcnJpZXJzIGFyZSBpbiBhIHBvc2l0aW9u IHRvIGtub3cgaWYgYSBjYWxsIGlzIGNvbWluZyBmcm9tIGEgZGV2aWNlIGFzc2lnbmVkIGEgc2lu Z2xlIG51bWJlciwgb3IgZnJvbSDigJx0cnVuayBncm91cOKAnSB3aGljaCBjb3VsZCBvcmlnaW5h dGUgY2FsbHMgdXNpbmcgbXVsdGlwbGUgbnVtYmVycywgYW5kIGNhbiBxdWFsaWZ5IHRvIHNvbWUg ZGVncmVlIHRoZSB0cnVzdHdvcnRoaW5lc3Mgb2YgbnVtYmVyIGF1dGhlbnRpY2l0eSBhY2NvcmRp bmdseS4NCg0KTXkgc3VnZ2VzdGlvbiB3YXMgcXVhbGlmeWluZyBjYWxsaW5nIG51bWJlciBhdXRo ZW50aWNpdHkgaW50byBjYXRlZ29yaWVzIG9mIGNhcnJpZXItc2lnbmVkIChvciBub3QpLCBhbmQg dW5hdXRoZW50aWNhdGVkLCBzZW1pLWF1dGhlbnRpY2F0ZWQsIGFuZCBtb3N0LWF1dGhlbnRpY2F0 ZWQuICBUaGVyZSBjYW4gYmUgbW9yZSBncmFudWxhcml0eSwgYnV0IGl0IGltcGxpZXMgYWRkaXRp b25hbCBvcGVyYXRpb25hbCBjb21wbGV4aXR5IChib3RoIGZvciB0aGUgY2FycmllcnMgYW5kIHRo ZSBjb25zdW1lcnMpIGFuZCBJIGFzc3VtZSBkaW1pbmlzaGVzIHZhbHVlLg0KDQpNeSByZWFzb24g Zm9yIGFkZGluZyB0aGUgYXV0aGVudGljaXR5IG9mIHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyIGlz IHR5cGljYWwgdHJ1c3R3b3J0aGluZXNzIG9mIGEgY2FycmllciBidXNpbmVzcyByZWxhdGlvbnNo aXAgd2l0aCB0eXBpY2FsIGNvbnN1bWVycyBhZGRzIHRvIHRoZSB0cnVzdHdvcnRoaW5lc3MgYXNz ZXNzbWVudCBhbmQgcGFydGlhbGx5IGJlY2F1c2UgY2FycmllcnMgYXJlIGEgcmVndWxhdGVkIHBv aW50IG9mIGZvcmVuc2ljIGlucXVpcnkgZm9yIENBTEVBIGFuZCBmcmF1ZC4gIEFkZGl0aW9uYWxs eSwgbW9zdCBjYWxscyBvcmlnaW5hdGUgYW5kIHRlcm1pbmF0ZSBiZXR3ZWVuIG1vYmlsZSBjb25z dW1lcnMgd2hlcmUgdGhlaXIgY2FycmllcnMgYXJlIGFibGUgdG8gdXNlZnVsbHkgYXV0aGVudGlj YXRlIHRoZWlyIGRldmljZSBhbmQgaGF2ZSBhIGhpZ2ggZGVncmVlIG9mIGNvbmZpZGVuY2Ugb2Yg dGhlIGF1dGhlbnRpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIuDQoNCkkgdGhpbmsgYmlsbGlv bnMgb2YgcGVyLVROIGNlcnRzIG9mIHZhcnlpbmcgdXNhYmlsaXR5IChyZXZva2VkLCBub3QgcmV2 b2tlZCkgZm9yIGF1dGhlbnRpY2F0aW5nIGNhbGxpbmcgbnVtYmVyIHdpbGwgbm90IHdvcmsgd2Vs bC4NCg0KQ29udmVyc2VseSwgSSB0aGluayBiaWxsaW9ucyBvZiBwZXItVE4gY2VydHMgd2lsbCB3 b3JrIHdlbGwsIGlmIHRoZSBjYWxsaW5nIHBhcnR5IGhhcyB0byBzaWduIGEgY2FsbCB3aXRoIGEg cGVyLVROIGNlcnQgcHJvdmlkZWQgYnkgdGhlIGNhbGxlZCBwYXJ0eS4gIE5vIGNhbGxlZCBwYXJ0 eSBjZXJ0IHRvIGluY2x1ZGU/ICBUaGVuIHRoZSBjYWxsaW5nIHBhcnR5IGRvZXMgbm90IGhhdmUg YSB0cnVzdGVkIHJlbGF0aW9uc2hpcCB3aXRoIHRoZSBjYWxsZWQgcGFydHksIGFuZCB0aGUgY2Fs bCBjYW4gYmUgYXV0aG9yaXplZC90cmVhdGVkIGFjY29yZGluZ2x5LiAgKEnigJl2ZSBtYWRlIHNp bWlsYXIsIG1vc3RseSBpZ25vcmVkIGNvbW1lbnRzIGluIE1PREVSTi4pDQoNClBpZXJjZQ0KDQpG cm9tOiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KU2VudDogQXVndXN0 IDA0LCAyMDE2IDI6MDMgUE0NClRvOiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29y bWFuQHNwcmludC5jb20+DQpDYzogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0Pjsgc3Rp ckBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMN Cg0KV2VsbCwgdGhlIG1lY2hhbmlzbXMgYXJlIGRlc2lnbmVkIHNvIHRoYXQgdGhleSBjb3VsZCBi ZSBkZXBsb3llZCBvbiBkZXZpY2VzIGFuZCBQQlhzLiAgV2hldGhlciB0aGV5IHdpbGwgYmUgaXMg YSBwb2xpY3kgaXNzdWUuDQoNClRoZSBub3Rpb24gb2YgY3JlZGVudGlhbHMgdGhhdCBhcmUgdHJh Y2VhYmxlIHRvIGEgZGVsZWdhdGlvbiBvZiBhIFROIGlzIGEgbWVjaGFuaXNtIHRoYXQgaXMgcGFy dCBvZiB0aGUgZGVzaWduIG9mIHN0aXIsIGFuZCB0aGUgZGVzaWduIGFsbG93cyBkZWxlZ2F0aW9u IG9mIG9uZSBUTiAodG8gb25lIGRldmljZSwgYWx0aG91Z2ggYSBkZXZpY2UgbGlrZSBhIFBCWCB3 b3VsZCBoYXZlIG1vcmUgdGhhbiBvbmUgVE4gcGVyIOKAnGRldmljZeKAnSwgYW5kIHNvbWV0aGlu ZyBsaWtlIGEgZHVhbCBOQU0gcGhvbmUgY291bGQgaGF2ZSBtb3JlIHRoYW4gb25lIGNyZWRlbnRp YWwuICBGb3IgdGhlIHVzZSBjYXNlIHdl4oCZdmUgZGlzY3Vzc2VkLCBhIG1vYmlsZSBwaG9uZSBt YXkgYWxzbyBoYXZlIGEgY3JlZGVudGlhbCBmb3IsIHNheSwgYSBUTiB0aGF0IGlzIGRlbGVnYXRl ZCB0byBhIGxhbmRsaW5lLCB0byBjb3ZlciB0aGUgZXhhbXBsZSBjYXNlIG9mIGEgZG9jdG9yIHBs YWNpbmcgYSBjYWxsIG9uIGhpcyBtb2JpbGUsIGJ1dCBnZXR0aW5nIGhpcyBvZmZpY2UgbnVtYmVy IHRvIHNob3cgdXAgYXMgdGhlIGNhbGxpbmcgcGFydHkuICBVc2Ugb2Ygc3VjaCBtZWNoYW5pc21z IGlzIHBvbGljeS4NCg0KQnJpYW4NCg0KT24gQXVnIDQsIDIwMTYsIGF0IDI6NTIgUE0sIEdvcm1h biwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbTxtYWlsdG86UGllcmNl Lkdvcm1hbkBzcHJpbnQuY29tPj4gd3JvdGU6DQoNClRoYW5rcyBCcmlhbi4gIEnigJltIGFmcmFp ZCB3ZeKAmXJlIHN0cmF5aW5nIGludG8gYSBwb2xpY3kgZGlzY3Vzc2lvbi4gIFJlZ2FyZGxlc3Ms IEkgZG8gYXBwcmVjaWF0ZSB5b3VyIGV4cGxhbmF0aW9uLiAgSSB3b3VsZCBsaWtlIHRvIGNvbnRp bnVlIHRoZSBkaXNjdXNzaW9uLCBidXQgSeKAmW0gcHJldHR5IHN1cmUgdGhpcyBpc27igJl0IHRo ZSByaWdodCBmb3J1bS4NCg0KUGllcmNlDQoNCkZyb206IEJyaWFuIFJvc2VuIFttYWlsdG86YnJA YnJpYW5yb3Nlbi5uZXRdDQpTZW50OiBBdWd1c3QgMDQsIDIwMTYgMTozNCBQTQ0KVG86IEdvcm1h biwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbTxtYWlsdG86UGllcmNl Lkdvcm1hbkBzcHJpbnQuY29tPj4NCkNjOiBBbGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQ8 bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+Pjsgc3RpckBpZXRmLm9yZzxtYWlsdG86c3RpckBpZXRm Lm9yZz4NClN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQoNCk9m IGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBhcyBzbWFydCBwaG9u ZXMgYW5kIGFueSBvdGhlciBkZXZpY2VzIHRoYXQgY2FuIGJlIHByb2dyYW1tZWQgdG8gZG8gc28u DQpUaGV5IHdpbGwgYmUgZ2l2ZW4gY3JlZGVudGlhbHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBmb3Ig dGhlIFROcyB0aGV5IGFyZSBhdXRob3JpemVkIHRvIHNpZ24gZm9yLiAgVGhleSBjYW4gdHJ5IHRv IHNpZ24gYW55IGNhbGwsIGJ1dCB0aGUgdmFsaWRpdHkgb2YgdGhlIGNyZWRlbnRpYWwgd291bGQg bWFrZSBzdWNoIGEgc2lnbmF0dXJlIGZhaWwgdGhlIGNoZWNraW5nLg0KDQpHZXR0aW5nIHNlcnZp Y2UgcHJvdmlkZXJzIHRvIHNpZ24gb24gYmVoYWxmIG9mIGRldmljZXMgaXMgYSByZWFzb25hYmxl IHdheSB0byBkZXBsb3kgcXVpY2tseSwgYnV0IEkgZXhwZWN0IG1hbnkgU1BzIHdpbGwgd2FudCB0 byBnZXQgb3V0IG9mIHRoZSBsaWFiaWxpdHkgb2Ygc2lnbmluZyBvbiBiZWhhbGYgb2YgdGhlaXIg Y3VzdG9tZXJzLiAgSWYgdGhleSBjYW4gcHVzaCBvZiB0aGF0IHJlc3BvbnNpYmlsaXR5IHRvIHRo ZWlyIGN1c3RvbWVyLCBvbmx5IGJlaW5nIHJlc3BvbnNpYmxlIGZvciBnZXR0aW5nIHRoZSBjdXN0 b21lciBhbiBhcHByb3ByaWF0ZSBjcmVkZW50aWFsIHdoZW4gdGhleSBhc3NpZ24gVE5zLCB0aGVu IEkgd291bGQgZXhwZWN0IHRoZW0gdG8gd2FudCB0byBkbyBzby4gIFRoYXQgbWVhbnMgdGhlIGRl dmljZXMgaGF2ZSB0byBiZSBhYmxlIHRvIHNpZ24sIGJ1dCBJIHVuZGVyc3RhbmQgbWFueSBvZiB0 aGUgUEJYIHZlbmRvcnMgdGhpbmsgdGhhdOKAmXMgc29tZXRoaW5nIHRoZXkgY291bGQgcHJvdmlk ZSBpbiBhIGZ1dHVyZSByZWxlYXNlLg0KDQpCcmlhbg0KDQpPbiBBdWcgNCwgMjAxNiwgYXQgMjoy MiBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPG1h aWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+PiB3cm90ZToNCg0KWW91IHdhbnQgSVAgUEJY ZXMgdG8gc2lnbiBjYWxscz8gIFdvbuKAmXQgdGhhdCBtYWtlIGl0IGV4dHJhb3JkaW5hcmlseSBl YXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRoIGF1dGhlbnRpY2F0ZWQgbnVtYmVycz8NCg0KDQpGcm9t OiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KU2VudDogQXVndXN0IDA0 LCAyMDE2IDEyOjI0IFBNDQpUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1h bkBzcHJpbnQuY29tPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KQ2M6IEFsZXgg Qm9ib3RlayA8YWxleEBib2JvdGVrLm5ldDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBzdGly QGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtzdGlyXSBTVElS IDQ0NzRiaXMtMTAgY29tbWVudHMNCg0KRmlyc3Qgb2YgYWxsLCB3ZSB3b3VsZCB3YW50IHRoZSBQ QlggdG8gZ2VuZXJhdGUgdGhlIHNpZ25hdHVyZSwgYnV0IHRoZSBzZXJ2aWNlIHByb3ZpZGVyIGNh biBkbyB0aGF0LiAgSXQgc2hvdWxkIG5vdCBhZGQgYSB2YWxpZCBzaWduYXR1cmUgdG8gYSBjYWxs IGZyb20gYSBudW1iZXIgaXQgZGlkIG5vdCBhc3NpZ24gdG8gdGhlIHRydW5rIGdyb3VwIGNvbm5l Y3RpbmcgdG8gdGhlIFBCWCwgYWx0aG91Z2ggaXQgY291bGQgc3VwcG9ydCB0aGUgZXh0cmEgZGVs ZWdhdGlvbiByZXF1aXJlZCB0byBzdXBwb3J0IOKAnGF1dGhvcml6ZWQgc3Bvb2ZpbmfigJ0uICBU aGUgY29tcGFuaW9uIGRldmljZXMgSeKAmW0gYXdhcmUgb2YgYWx3YXlzIHNlbmQgY2FsbHMgZnJv bSB0aGUgc2FtZSBzZXJ2aWNlIHByb3ZpZGVyIGFuZCBzaG91bGQgbm90IHByZXNlbnQgYW55IGlz c3VlLg0KDQpFdmVyeW9uZSB3aWxsIGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbuKAmXQgZG8gbm93 IHRvIGltcGxlbWVudCBzdG9wIHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTA0KDQpCcmlhbg0KDQpP biBBdWcgNCwgMjAxNiwgYXQgMTI6NDEgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJj ZS5Hb3JtYW5Ac3ByaW50LmNvbTxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4gd3Jv dGU6DQoNCkZyYXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29tbW9uLiAgQW5kIGV2ZW4g d2hlcmUgYSBQQlggaXMgbm90IGNvbXByb21pc2VkLCBhIGNhcnJpZXIgaGFzIG5vIHByYWN0aWNh bCB3YXkgb2Yga25vd2luZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciBpcyBwcm9wZXJseSBh c3NpZ25lZCBhbmQgdmFsaWQgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgdGhlIEVudGVycHJpc2Uu ICBUaGVyZWZvcmUsIGNoZWNraW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVtYmVyIHdhcyBmcm9t IGFuIGFzc2lnbmVkIHJhbmdlIG1pZ2h0IGJlIHBvc3NpYmxlIChhbmQgZnJhdWdodCB3aXRoIGFk bWluaXN0cmF0aXZlIGNoYWxsZW5nZXMpLCBidXQgb2YgbGltaXRlZCB2YWx1ZS4gIEFuZCBpbiB0 aGUgY29uc3VtZXIgbWFya2V0LCB0aGVyZSBhcmUgY2FsbGluZyBwcm9kdWN0cyB3aGljaCBzdXBw b3J0IGEgcGFyZW50IHN1YnNjcmliZXIgbnVtYmVyIGFuZCDigJxjb21wYW5pb27igJ0gZGV2aWNl cyAoZS5nLiwgdGFibGV0cykgd2hpY2ggY2FuIHBsYWNlIGEgY2FsbCB1c2luZyB0aGUgTUROIG9m IHRoZSBwYXJlbnQgc3Vic2NyaWJlci4gIFRoZXNlIGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUg YXV0aGVudGljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciB3b27igJl0IG5lY2Vzc2FyaWx5IG1l YW4gdGhlIHNhbWUgdGhpbmcgYXMgdGhlIGF1dGhlbnRpY2l0eSBvZiBhIGNhbGwgZnJvbSBhIHNp bmdsZSBzdWJzY3JpYmVyIHdpdGggYSBzaW5nbGUgTUROIHJlZ2FyZGxlc3Mgb2Yg4oCcbGF4aXR5 4oCdIG9mIHNwb29mIGNoZWNraW5nLg0KDQpJbiBhbm90aGVyIGZvcnVtIGFuZCBhbnRpY2lwYXRp bmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljYXRpb24gbWFuZGF0ZXMgZnJvbSBDb25ncmVzcyBh bmQvb3IgRkNDLCBJIHN1Z2dlc3RlZCB1c2luZyBjYXJyaWVyLXNwZWNpZmljIGNlcnRzIGFuZCBl bmNvZGluZyBzcGVjaWZpY2l0eSBvZiBhdXRoZW50aWNpdHksIGFuZCBjYWxsaW5nIG51bWJlci4g IFRoaXMgcHJvdmlkZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyLCBz b21lIGlkZWEgYXMgdG8gdGhlIGFjY3VyYWN5IG9yIHNwZWNpZmljaXR5IG9mIHRoZSBjYWxsaW5n IG51bWJlciwgYW5kIHZhbGlkdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyIChhc3N1bWluZyBub25j ZSBhbmQgcmVwbGF5IGlzc3VlcyBjYW4gYmUgYWRkcmVzc2VkIGFzIHJlYXNvbmFibHkgc3VnZ2Vz dGVkIGJlbG93IGJ5IEFsZXgpLg0KDQpUaGUgcmVwcmVzZW50YXRpb24gb2Ygb3JpZy1jYXJyaWVy IGFuZCB0cnVzdHdvcnRoaW5lc3MgY291bGQgYmUgYXMgZm9sbG93czoNCg0KUmVndWxhdGVkL21h bmRhdGVkIENhcnJpZXIgQ2xhc3MgVXNlIENhc2U6DQoNCjAwIC0gTm8gQ3JlZGVudGlhbHMNClVz ZSBjYXNlIGV4YW1wbGUocyk6IFByZS1JTVMsIGxlZ2FjeSBjaXJjdWl0LXN3aXRjaGVkIG5ldHdv cmtzIHRoYXQgZG9uJ3QgbmF0aXZlbHkgc3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3QgY2hvb3Nl IHRvIHNpZ24gY2FsbHMuICBFLmcuLCBpbnRlcm5hdGlvbmFsIGNhcnJpZXJzLg0KVHJ1c3QgRXN0 aW1hdGU6ICBHb29kIGx1Y2suICBDYXJyaWVyX29yaWcgYW5kIENnUE4gZW50aXJlbHkgdW50cnVz dHdvcnRoeS4NCg0KMDEgLSBDYXJyaWVyIHNpZ25lZCwgbm8gYXV0aGVudGljYXRpb24gb2YgQ2dQ Tg0KVXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBvbiB2aXNpdGVkIG5ldHdvcmsgdy9vIHJvYW1p bmcgYWdyZWVtZW50LCBtYW51YWwgcm9hbWluZy4NClRydXN0IEVzdGltYXRlOiAgQ2Fycmllcl9v cmlnIHRydXN0d29ydGh5LCBDZ1BOIGVudGlyZWx5IHVudHJ1c3R3b3J0aHkNCg0KMTAgLSBDYXJy aWVyIHNpZ25lZCwgc2VtaS1hdXRoZW50aWNhdGVkIENnUE4NClVzZSBjYXNlIGV4YW1wbGUocyk6 IE51bWJlciBibG9jayBkZWxlZ2F0ZWQgZnJvbSBPQ04sIGJ1dCBubyBwZXItVE4gc2NyZWVuIChT SVAgdHJ1bmtzKS4NClRydXN0IEVzdGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBD Z1BOIGxlc3MgdGhhbiBtb3N0IHRydXN0d29ydGh5IGJ1dCBub3QgZW50aXJlbHkgdW50cnVzdHdv cnRoeS4NCg0KMTEgLSBDYXJyaWVyIHNpZ25lZCwgYXV0aGVudGljYXRlZCBDZ1BODQpVc2UgY2Fz ZSBleGFtcGxlKHMpOiBCcmVhZC1hbmQtYnV0dGVyIDk1JSsgb2YgY2FsbHMgZnJvbSBzdWJzY3Jp YmVyIGxpbmVzIChJTVMtYmFzZWQgYW5kIG90aGVyd2lzZSkuDQpUcnVzdCBFc3RpbWF0ZTogIENh cnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBtb3N0IHRydXN0d29ydGh5DQoNClB1YmxpYyBV c2UgQ2FzZToNCg0KVW5kZWZpbmVkIGJ1dCBhc3N1bWVkIHRvIHVzZSBwdWJsaWMgb3IgY29tbWVy Y2lhbGx5IGF2YWlsYWJsZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlcyByZXNvdXJjZXMuICBlLmcu LCBub21vcm9iby1saWtlIGNyb3dkLXNvdXJjZWQgYWNjZXB0L2RlbnkgbGlzdHMsIGV0IGNldGVy YS4gIENvdWxkL3dvdWxkIHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUgZGV2aWNl cyB3aGljaCB3b3VsZCBwcm9jZXNzIHRoZW0gYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBvZiB0aGUg UHVibGljIENsYXNzIGFwcGxpY2F0aW9uKHMpLg0KDQpQaWVyY2UNCg0KRnJvbTogQnJpYW4gUm9z ZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NClNlbnQ6IEF1Z3VzdCAwNCwgMjAxNiA5OjAy IEFNDQpUbzogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0PG1haWx0bzphbGV4QGJvYm90 ZWsubmV0Pj4NCkNjOiBzdGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KU3ViamVj dDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCg0KVGhlcmUgYXJlIHJlYXNv bmFibGUgY2lyY3Vtc3RhbmNlcyB3aGVyZSBhIHBhcnR5IHBsYWNpbmcgYSBjYWxsIGlzIG5vdCB0 aGUgYXV0aG9yaXplZCBlbnRpdHkgYXNzaWduZWQgdGhlIHRlbGVwaG9uZSBudW1iZXIgdXNlZCBp biBGcm9tL1BBSSwgYW5kIGluIHN1Y2ggY2lyY3Vtc3RhbmNlcyB0aGUgc2VydmljZSBwcm92aWRl ciBzZXJ2aWNpbmcgdGhlIGVudGl0eSBwbGFjaW5nIHRoZSBjYWxsIG1heSBvciBtYXkgbm90IGJl IHRoZSBzYW1lIGFzIHRoZSBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpbmcgdGhlIGVudGl0eSB0aGF0 IGlzIGFzc2lnbmVkIHRoZSBUTi4gIEluIGFsbCBzdWNoIGNhc2VzLCB0aGUgZW50aXR5IHRoYXQg aXMgYXNzaWduZWQgdGhlIFROIGV4cGxpY2l0bHkgYXV0aG9yaXplcyBjYWxscyBwbGFjZWQgdXNp bmcgaXTigJlzIFROLiAgVGhlIGRlc2lnbiBhY2NvbW1vZGF0ZXMgc3VjaCB1c2UgY2FzZXMuICBJ dOKAmXMgbm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24u ICAgV2XigJlyZSBub3QgYXdhcmUgb2YgYW55IGNhc2VzIHdoZXJlIHRoZXJlIGlzIGFuIGFjdHVh bCByZXF1aXJlbWVudCBmb3IgbGVnaXRpbWF0ZSBjYWxsaW5nIHdpdGhvdXQgZXhwbGljaXQgYXV0 aG9yaXphdGlvbiBmcm9tIHRoZSBhc3NpZ25lZCBlbnRpdHksIGFsdGhvdWdoIHdlIGNlcnRhaW5s eSBhcmUgYXdhcmUgdGhhdCB2YXJpb3VzIHBhcnRzIG9mIHZhcmlvdXMgc2VydmljZSBwcm92aWRl cnMgZG9u4oCZdCBib3RoZXIgdG8gY2hlY2suIEF0IHRoaXMgcG9pbnQsIGF0IGxlYXN0IGluIHNv bWUgY291bnRyaWVzLCB0aGVyZSBpcyBhIHJlYWxpemF0aW9uIHRoYXQgdGhlIGxheGl0eSBvZiBh bGxvd2luZyB1bmNoZWNrZWQgc3Bvb2ZpbmcgaXMgbm90IGFjY2VwdGFibGUgYW55IG1vcmUuDQoN CkJyaWFuDQoNCk9uIEF1ZyAzLCAyMDE2LCBhdCA4OjM1IEFNLCBBbGV4IEJvYm90ZWsgPGFsZXhA Ym9ib3Rlay5uZXQ8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+PiB3cm90ZToNCg0KMS4gICAgICAg UGVybWl0IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbg0KSW4gdGhlIGN1cnJl bnQgdGVsZXBob255IG5ldHdvcmsgcHJhY3RpY2UsIHNvbWUgc2VydmljZSBwcm92aWRlciBpbXBs ZW1lbnRhdGlvbnMgY2hvb3NlIG5vdCB0byBhdXRoZW50aWNhdGUgaWRlbnRpdHksIGJ1dCBzaW1w bHkgZmFjaWxpdGF0ZSB0aGUgdXNlIG9mIGFuIGFyYml0cmFyeSBvciBzZWxlY3RlZCB1c2VyLXBy b3ZpZGVkIGlkZW50aXR5LiAgQXJlIHRoZXJlIGxlZ2l0aW1hdGUgdXNlIGNhc2VzIGZvciB0aGlz PyAgSGFzIGFueW9uZSBlc3RhYmxpc2hlZCB0aGF0IHRoZXJlIGFyZSBub3Q/ICBIb3cgY2FuIHRo ZSBpbmR1c3RyeSByZWFzb25hYmx5IGV4cGVjdCB0byBlbmQgdGhpcyAob2Z0ZW4gYmFkKSBwcmFj dGljZT8gIElmIGl0IGNhbuKAmXQgYmUgZW5kZWQsIHRoZXJl4oCZcyB2YWx1ZSBpbiBhdCBsZWFz dCBpZGVudGlmeWluZyB0aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92aWRlciAoaS5lLiwgdGhl IHNpZ25lci9hdXRob3JpemVyKS4gIEdpdmVuIHRoZSBwcmV2YWxlbmNlIG9mIGFidXNlIHVzaW5n IHRlbGVwaG9uZSBudW1iZXJzIGFzc2lnbmVkIHRvIGEgc29tZXRpbWVzLWFub255bW91cyBhYnVz ZXIsIGl0IGJlY29tZXMgY3JpdGljYWxseSBpbXBvcnRhbnQgdG8gaWRlbnRpZnkgdGhlIHNlcnZp Y2UgcHJvdmlkZXIocykgY2xvc2VzdCB0byB0aGUgYWJ1c2VyLiAgQmFzZWQgb24gdGhlIGFzc3Vt cHRpb24gdGhhdCBpdOKAmXMgYmV0dGVyIHRvIElEIHNlcnZpY2UgcHJvdmlkZXJzIHRoYW4gdW5y ZWFzb25hYmx5IGV4cGVjdCBhIGJhbiBvZiB0aGUgdXNlIG9mIHVuYXV0aGVudGljYXRlZCAoYW5k IHRoZXJlZm9yZSB1bnNpZ25lZCkgU0lQIHJlcXVlc3RzLCBTVElSIHNpZ25pbmcgc2hvdWxkIHN1 cHBvcnQgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLiAgVGhlIHByYWN0aWNl IG9mIGF1dGhvcml6aW5nIHVuYXV0aGVudGljYXRlZCB1c2UgZXhpc3RzLCBhbmQgdGhlcmUgaXMg YmVuZWZpdCB0byBzaWduaW5nIGluIHRoZXNlIGNhc2VzIChzZXJ2aWNlIHByb3ZpZGVyIGlkZW50 aWZpY2F0aW9uKS4gIFRoZSBsYW5ndWFnZSBvZiB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlzIHVz ZS4gIDQ0NzRiaXMtMTAgc2hvdWxkIE5PVCByZXF1aXJlIG9yIGFzc3VtZSB0aGF0ICB0aGF0IGF1 dGhlbnRpY2F0aW9uIHdpbGwgcHJlY2VkZSBhdXRob3JpemF0aW9uLiBPZiBjb3Vyc2UgdGhlcmUg bWF5IGJlIG90aGVyIHVzZSBjYXNlcyB3aGVyZSBzaWduaW5nIGluY2x1ZGVzIGF1dGhlbnRpY2F0 aW9uIGFuZCBtYXkgbm90IGluY2x1ZGUgYSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVy4oCZcyBh dXRob3JpemF0aW9uLg0KDQoNCjIuICAgICAgIEltcHJvdmUgcmVwbGF5IHByZXZlbnRpb24NClBy b3hpbWF0ZSByZXBsYXkgaXMgcG9zc2libGUgd2hpbGUgY29tcGx5aW5nIHdpdGggdGhpcyBzcGVj LiAgRmlyc3QsIG9uZSBvciBtb3JlIHByb3hpbWF0ZSAoZS5nLiwgd2l0aGluIDYwIHNlY29uZHMp IFNJUCByZXF1ZXN0cyB1c2luZyB0aGUgc2FtZSB0b2tlbiBhcmUgbGVnYWwgYW5kIHN1YmplY3Qg dG8gcmVwbGF5IGluIG1hbnkgY2FzZXMuICBBbiBTRFAgYm9keeKAmXMgbWt5IG1heSBub3QgYmUg cHJlc2VudCBhbmQgaWYgcHJlc2VudCBpdHMgdXNlIGlzIG9wdGlvbmFsLiAgU29tZSBzb3J0IG9m IG1hbmRhdG9yeSBuZXcgb3IgZXhpc3Rpbmcgc2lnbmVkIHNlcXVlbmNlLCByYW5kb20gIyBvciBy ZXF1ZXN0IElEIChlLmcuLCBDYWxsLUlEIG9yIENTZXEpIGFuZCBhIDEtdGltZSB1c2UgcG9saWN5 IG9uIHRoZSByZWNlaXZpbmcgZW5kIG9mIHRoZSByZXF1ZXN0IChlLmcuLCB0b2tlbnMgb25seSBn b29kIGZvciAxIHVzZSkgY291bGQgcHJldmVudCByZXBsYXkuICBEaWZmZXJlbnQgbWV0aG9kcyAo ZS5nLiwgSU5WSVRFIHZzIE1FU1NBR0UpIG1pZ2h0IGJlIGhhbmRsZWQgYnkgZGlmZmVyZW50IHJl Y2VpdmluZyBpbmZyYXN0cnVjdHVyZSwgYW5kIHRoZXJlZm9yZSBkaWZmaWN1bHRpZXMgd2l0aCDi gJhpdOKAmXMgYmVlbiB1c2VkIGFscmVhZHnigJkgY29vcmRpbmF0aW9uIGFsbG93IGEgZmFrZWQg TUVTU0FHRSBiYXNlZCBvbiBhIGNhcHR1cmVkIHJlcXVlc3QuIFRoaXMgbWlnaHQgaW5jbHVkZSBh biBta2V5IGZyb20gYSBjYXB0dXJlZCBJTlZJVEUuICAgU28gaXQgbWF5IGJlIHBvc3NpYmxlIHRv IERPUywgc3BhbSBvciB0ZXh0LWJvbWIgYSByZWNpcGllbnQgdXNpbmcgYSBjYXB0dXJlZCBpZGVu dGl0eS4gIFdoaWxlIGxhcmdlLXNjYWxlIG9yIGRpc3RyaWJ1dGVkIGltcGxlbWVudGF0aW9ucyBt YXkgbWFrZSB0aGUgZW5mb3JjZW1lbnQgZGlmZmljdWx0LCB0aGVyZSBpcyBsaXR0bGUgY29zdCB0 byBzaWduaW5nIGFuZCBkZWNvZGluZyBhIG1ldGhvZCBhbmQgcG9zc2libHkgYSBudW1lcmljIElE LiAgIFNvbWUgc29ydCBvZiDigJgxLXVzZeKAmSBwcmFjdGljZSBzaG91bGQgYXQgbGVhc3QgYmUg ZGlzY3Vzc2VkIHdoaWxlIHBlcmhhcHMgbm90IHJlcXVpcmVkLg0KDQoNClNwZWNpZmljIG1hcmt1 cCBzdWdnZXN0aW9uczoNCg0KDQpOSVRTDQoNCg0KICAgVGhlIHZlcmlmaWVyIE1VU1QgaW5zcGVj dCBhbnkgb3B0aW9uYWwgInBwdCIgcGFyYW1ldGVyIGFwcGVhcmluZyBpbiB0aGUNCg0KICAgSWRl bnRpdHkgcmVxdWVzdC4gIElmIG5vICJwcHQiIHBhcmFtZXRlciBpcyBwcmVzZW50LCB0aGVuIHRo ZQ0KDQogICB2ZXJpZmllciBwcm9jZWVkcyBub3JtYWxseSBiZWxvdy4gIElmIGEgInBwdCIgcGFy YW1ldGVyIHZhbHVlIGlzDQoNCiAgIHByZXNlbnQsIGFuZCB0aGUgdmVyaWZpZXIgZG9lcyBub3Qg c3VwcG9ydCBpdCwgaXQgTVVTVCBpZ25vcmUgdGhlDQoNCiAgIElkZW50aXR5IGhlYWRlci4gIElm IGEgc3VwcG9ydGVkICJwcHQiIHBhcmFtZXRlciB2YWx1ZSBpcyBwcmVzZW50LA0KDQogICB0aGUg dmVyaWZpZXIgZm9sbG93cyB0aGUgcHJvY2VkdXJlcyBiZWxvdywgaW5jbHVkaW5nIHRoZSB2YXJp YXRpb25zDQoNCiAgIGRlc2NyaWJlZCBpbiBTdGVwIDUuDQoNCjM8ZmlsZTovLy9DOlxVc2Vyc1xh YjM3NzhcRG9jdW1lbnRzXElFVEZcZHJhZnQtaWV0Zi1zdGlyLXJmYzQ0NzRiaXMtMTAlMjAtJTIw QXV0aGVudGljYXRlZCUyMElkZW50aXR5JTIwTWFuYWdlbWVudCUyMGluJTIwdGhlJTIwU2Vzc2lv biUyMEluaXRpYXRpb24lMjBQcm90b2NvbCUyMCUyOFNJUCUyOS5odG0jc2VjdGlvbi0zPi4gIEJh Y2tncm91bmQNCg0KW+KApl0NCg0KDQoNCiAgIFBlciBbUkZDNzM0MDxodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvcmZjNzM0MD5dLCBwcm9ibGVtcyBzdWNoIGFzIHJvYm9jYWxsaW5nLCB2b2lj ZW1haWwgaGFja2luZywgYW5kDQoNCiAgIHN3YXR0aW5nIGFyZSBlbmFibGVkIGJ5IGFuIGF0dGFj a2VyJ3MgYWJpbGl0eSB0byBpbXBlcnNvbmF0ZSBzb21lb25lDQoNCiAgIGVsc2UuICBUaGUgc2Vj dXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUCBhcHBsaWNhdGlvbnMgYW5kIHNlcnZpY2VzDQoNCiAg IGRlcGVuZHMgb24gYXV0aGVudGljYXRpbmcgYW5kL29yIGF1dGhvcml6aW5nIHRoZSBzb3VyY2Ug b2YgY29tbXVuaWNhdGlvbnMgYXMgaXQgaXMNCg0KICAgcmVwcmVzZW50ZWQgaW4gYSBTSVAgcmVx dWVzdC4NCg0KDQogICBUaGlzIGlkZW50aXR5IGFyY2hpdGVjdHVyZSBmb3IgU0lQIGRlcGVuZHMg b24gaW5jbHVkZXMgcHJvdmlzaW9ucyBmb3IgYSBsb2dpY2FsDQoNCiAgICJhdXRoZW50aWNhdGlv biBzZXJ2aWNlIiB3aGljaCB2YWxpZGF0ZXMgY2FsbGVyIGlkZW50aXR5IGF0IG9yIG5lYXIgb3Jp Z2luYXRpb24uICBvdXRnb2luZyByZXF1ZXN0cy4gIEFuDQoNCiAgIGF1dGhlbnRpY2F0aW9uIHNl cnZpY2UgbWF5IGJlIGltcGxlbWVudGVkIGVpdGhlciBhcyBwYXJ0IG9mIGEgdXNlcg0KDQogICBh Z2VudCBvciBhcyBhIHByb3h5IHNlcnZlcjsgdHlwaWNhbGx5LCBpdCBpcyBhIGNvbXBvbmVudCBv ZiBhIG5ldHdvcmsNCg0KICAgaW50ZXJtZWRpYXJ5IGxpa2UgYSBwcm94eSB0byB3aGljaCBvcmln aW5hdGluZyB1c2VyIGFnZW50cyBzZW5kDQoNCiAgIHVuc2lnbmVkIHJlcXVlc3RzLiAgT25jZSB0 aGUgc2VuZGVyIG9mIHRoZSBtZXNzYWdlIGhhcyBiZWVuDQoNCg0KDQogICBUaGlzIGRvY3VtZW50 IHNwZWNpZmllcyBhIG1lYW5zIG9mIHNoYXJpbmcgYSBjcnlwdG9ncmFwaGljIGFzc3VyYW5jZQ0K DQogICBvZiBhdXRoZW50aWNpdHkgb2YgYW5kL29yIGF1dGhvcml6YXRpb24gdG8gdXNlIGVuZC11 c2VyIFNJUCBpZGVudGl0eSBpbiBhbiBpbnRlcmRvbWFpbiBvciBpbnRyYWRvbWFpbiBjb250ZXh0 Lg0KDQogICBJdCByZWxpZXMgb24gdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgY29uc3RydWN0 aW5nIHRva2VucyBiYXNlZCBvbiBb4oCmXQ0KDQoNCg0KDQogICBUbyBtYXhpbWl6ZSBlbmQtdG8t ZW5kIHNlY3VyaXR5LCBpdCBpcyB0eXBpY2FsbHkgb2J2aW91c2x5DQoNCiAgIHByZWZlcmFibGUg Zm9yIGVuZC11c2VycyB0byBhY3F1aXJlIHRoZWlyIG93biBjcmVkZW50aWFsczsgaWYgdGhleQ0K DQogICBkbywgdGhlaXIgdXNlciBhZ2VudHMgY2FuIGFjdCBhcyBhdXRoZW50aWNhdGlvbiBzZXJ2 aWNlcy4gIEhvd2V2ZXIsDQoNCiAgIGZvciBzb21lIGRlcGxveW1lbnRzLCBb4oCmXQ0KDQoNClJl Z2FyZHMsDQoNCkFsZXgNCg0KQWxleCBCb2JvdGVrDQoNCg0KX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0DQpzdGlyQGlldGYu b3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9zdGlyDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KVGhp cyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIGludGVu ZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55IHVzZSBieSBvdGhl cnMgaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwg cGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIGFsbCBjb3BpZXMgb2YgdGhlIG1l c3NhZ2UuDQoNCg== --_000_ced872efc4a549ce9157b2440fd2a408PLSWE13M08adsprintcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OldpbmdkaW5nczsNCglwYW5vc2UtMTo1IDAg MCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkdhcmFtb25kOw0KCXBhbm9zZS0xOjIg MiA0IDQgMyAzIDEgMSA4IDM7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3 IFJvbWFuIixzZXJpZjt9DQpoMg0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUt bGluazoiSGVhZGluZyAyIENoYXIiOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6 MGluOw0KCWZvbnQtc2l6ZToxOC4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIs c2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6 OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRl ZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ Y29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hh ciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnAuTXNvTGlzdFBhcmFncmFwaCwg bGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXBy aW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2lu LWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJp Zjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1j b252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUt bmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29s YXM7fQ0Kc3Bhbi5IZWFkaW5nMkNoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhlYWRpbmcgMiBDaGFy IjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGluZyAyIjsN Cglmb250LWZhbWlseToiQ2FsaWJyaSBMaWdodCIsc2Fucy1zZXJpZjsNCgljb2xvcjojMkU3NEI1 O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0K CWZvbnQtZmFtaWx5OiJBcmlhbCIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAwMENDOw0KCWZvbnQt d2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9u ZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEu MGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24x DQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGww DQoJe21zby1saXN0LWlkOjYzODE0NjQ3NzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28t bGlzdC10ZW1wbGF0ZS1pZHM6MTI4ODE4MTU2NCAtMjA4NjM0MTI4IDY3Njk4NjkxIDY3Njk4Njkz IDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30N CkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 U3ltYm9sOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9u dC1mYW1pbHk6QXJpYWw7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZl bDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmll ciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2 ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0K b2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tcmlnaHQ6NS44cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+T0ssIHlvdSB0 YWxrZWQgbWUgaW50byBpbmR1bGdpbmcgaW4gb25lIG1vcmUgbWVzc2FnZSBvbiBwb2xpY3kgYW5k IHVzZSBjYXNlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tcmlnaHQ6NS44cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+SSBhZ3JlZSB0 aGF0IHRoZSBTVElSL1BBU1Nwb3JUIG1lY2hhbmlzbXMgY291bGQgYmUgZGVwbG95ZWQgb24gaW5k aXZpZHVhbCBkZXZpY2VzIGFzIHdlbGwgYXMgbXVsdGktZGV2aWNlIGFuZCBtdWx0aS1udW1iZXIg cGxhdGZvcm1zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tcmlnaHQ6NS44cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1yaWdodDo1LjhwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj5OdW1iZXIgZGVs ZWdhdGlvbiAoYW5kIHN1Yi1kZWxlZ2F0aW9uKSwgYW5kIGJ1c2luZXNzIHJlbGF0aW9uc2hpcHMg YXJlIHR3byBhZGRpdGlvbmFsIGZhY3RvcnMgd2hpY2ggYWZmZWN0IHRydXN0d29ydGhpbmVzcyBv ZiBhIGdpdmVuDQogY2FsbGluZyBudW1iZXIgYXV0aGVudGljYXRpb24uPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1yaWdodDo1LjhwdCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMwMDAwQ0MiPkluaGVyZW50IHZhcmlhYmxlIHRydXN0d29ydGhpbmVzcyBv ZiBhIGNhbGxpbmcgbnVtYmVyIHdhcyBteSByZWFzb24gZm9yIHN1Z2dlc3RpbmcgYSB3YXkgdG8g cXVhbGlmeSB0aGUgc2lnbmF0dXJlIHRvIHJlZmxlY3QgdGhhdCB2YXJpYWJpbGl0eS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLXJpZ2h0 OjUuOHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tcmlnaHQ6NS44cHQi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+T3JpZ2luYXRpbmcgY2FycmllcnMgYXJlIGlu IGEgcG9zaXRpb24gdG8ga25vdyBpZiBhIGNhbGwgaXMgY29taW5nIGZyb20gYSBkZXZpY2UgYXNz aWduZWQgYSBzaW5nbGUgbnVtYmVyLCBvciBmcm9tIOKAnHRydW5rIGdyb3Vw4oCdIHdoaWNoDQog Y291bGQgb3JpZ2luYXRlIGNhbGxzIHVzaW5nIG11bHRpcGxlIG51bWJlcnMsIGFuZCBjYW4gcXVh bGlmeSB0byBzb21lIGRlZ3JlZSB0aGUgdHJ1c3R3b3J0aGluZXNzIG9mIG51bWJlciBhdXRoZW50 aWNpdHkgYWNjb3JkaW5nbHkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1yaWdodDo1LjhwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAw MENDIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPk15 IHN1Z2dlc3Rpb24gd2FzIHF1YWxpZnlpbmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljaXR5IGlu dG8gY2F0ZWdvcmllcyBvZiBjYXJyaWVyLXNpZ25lZCAob3Igbm90KSwgYW5kIHVuYXV0aGVudGlj YXRlZCwgc2VtaS1hdXRoZW50aWNhdGVkLA0KIGFuZCBtb3N0LWF1dGhlbnRpY2F0ZWQuJm5ic3A7 IFRoZXJlIGNhbiBiZSBtb3JlIGdyYW51bGFyaXR5LCBidXQgaXQgaW1wbGllcyBhZGRpdGlvbmFs IG9wZXJhdGlvbmFsIGNvbXBsZXhpdHkgKGJvdGggZm9yIHRoZSBjYXJyaWVycyBhbmQgdGhlIGNv bnN1bWVycykgYW5kIEkgYXNzdW1lIGRpbWluaXNoZXMgdmFsdWUuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1yaWdodDo1LjhwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDAwQ0MiPk15IHJlYXNvbiBmb3IgYWRkaW5nIHRoZSBhdXRoZW50aWNpdHkg b2YgdGhlIG9yaWdpbmF0aW5nIGNhcnJpZXIgaXMgdHlwaWNhbCB0cnVzdHdvcnRoaW5lc3Mgb2Yg YSBjYXJyaWVyIGJ1c2luZXNzIHJlbGF0aW9uc2hpcCB3aXRoIHR5cGljYWwNCiBjb25zdW1lcnMg YWRkcyB0byB0aGUgdHJ1c3R3b3J0aGluZXNzIGFzc2Vzc21lbnQgYW5kIHBhcnRpYWxseSBiZWNh dXNlIGNhcnJpZXJzIGFyZSBhIHJlZ3VsYXRlZCBwb2ludCBvZiBmb3JlbnNpYyBpbnF1aXJ5IGZv ciBDQUxFQSBhbmQgZnJhdWQuJm5ic3A7IEFkZGl0aW9uYWxseSwgbW9zdCBjYWxscyBvcmlnaW5h dGUgYW5kIHRlcm1pbmF0ZSBiZXR3ZWVuIG1vYmlsZSBjb25zdW1lcnMgd2hlcmUgdGhlaXIgY2Fy cmllcnMgYXJlIGFibGUgdG8gdXNlZnVsbHkNCiBhdXRoZW50aWNhdGUgdGhlaXIgZGV2aWNlIGFu ZCBoYXZlIGEgaGlnaCBkZWdyZWUgb2YgY29uZmlkZW5jZSBvZiB0aGUgYXV0aGVudGljaXR5IG9m IHRoZSBjYWxsaW5nIG51bWJlci48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBD QyI+SSB0aGluayBiaWxsaW9ucyBvZiBwZXItVE4gY2VydHMgb2YgdmFyeWluZyB1c2FiaWxpdHkg KHJldm9rZWQsIG5vdCByZXZva2VkKSBmb3IgYXV0aGVudGljYXRpbmcgY2FsbGluZyBudW1iZXIg d2lsbCBub3Qgd29yayB3ZWxsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMEND Ij5Db252ZXJzZWx5LCBJIHRoaW5rIGJpbGxpb25zIG9mIHBlci1UTiBjZXJ0cyB3aWxsIHdvcmsg d2VsbCwgaWYgdGhlIGNhbGxpbmcgcGFydHkgaGFzIHRvIHNpZ24gYSBjYWxsIHdpdGggYSBwZXIt VE4gY2VydCBwcm92aWRlZCBieSB0aGUgY2FsbGVkIHBhcnR5LiZuYnNwOyBObyBjYWxsZWQNCiBw YXJ0eSBjZXJ0IHRvIGluY2x1ZGU/Jm5ic3A7IFRoZW4gdGhlIGNhbGxpbmcgcGFydHkgZG9lcyBu b3QgaGF2ZSBhIHRydXN0ZWQgcmVsYXRpb25zaGlwIHdpdGggdGhlIGNhbGxlZCBwYXJ0eSwgYW5k IHRoZSBjYWxsIGNhbiBiZSBhdXRob3JpemVkL3RyZWF0ZWQgYWNjb3JkaW5nbHkuJm5ic3A7IChJ 4oCZdmUgbWFkZSBzaW1pbGFyLCBtb3N0bHkgaWdub3JlZCBjb21tZW50cyBpbiBNT0RFUk4uKTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMDBDQyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj5QaWVyY2U8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAw Q0MiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFu cm9zZW4ubmV0XQ0KPGJyPg0KPGI+U2VudDo8L2I+IEF1Z3VzdCAwNCwgMjAxNiAyOjAzIFBNPGJy Pg0KPGI+VG86PC9iPiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dICZsdDtQaWVyY2UuR29ybWFuQHNw cmludC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBBbGV4IEJvYm90ZWsgJmx0O2FsZXhAYm9ib3Rl ay5uZXQmZ3Q7OyBzdGlyQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbc3Rpcl0g U1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+V2VsbCwgdGhlIG1lY2hhbmlzbXMgYXJlIGRlc2lnbmVkIHNvIHRoYXQg dGhleSBjb3VsZCBiZSBkZXBsb3llZCBvbiBkZXZpY2VzIGFuZCBQQlhzLiAmbmJzcDtXaGV0aGVy IHRoZXkgd2lsbCBiZSBpcyBhIHBvbGljeSBpc3N1ZS48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBub3Rpb24gb2YgY3JlZGVudGlhbHMgdGhhdCBhcmUg dHJhY2VhYmxlIHRvIGEgZGVsZWdhdGlvbiBvZiBhIFROIGlzIGEgbWVjaGFuaXNtIHRoYXQgaXMg cGFydCBvZiB0aGUgZGVzaWduIG9mIHN0aXIsIGFuZCB0aGUgZGVzaWduIGFsbG93cyBkZWxlZ2F0 aW9uIG9mIG9uZSBUTiAodG8gb25lIGRldmljZSwgYWx0aG91Z2ggYSBkZXZpY2UgbGlrZSBhIFBC WCB3b3VsZCBoYXZlIG1vcmUgdGhhbiBvbmUgVE4NCiBwZXIg4oCcZGV2aWNl4oCdLCBhbmQgc29t ZXRoaW5nIGxpa2UgYSBkdWFsIE5BTSBwaG9uZSBjb3VsZCBoYXZlIG1vcmUgdGhhbiBvbmUgY3Jl ZGVudGlhbC4gJm5ic3A7Rm9yIHRoZSB1c2UgY2FzZSB3ZeKAmXZlIGRpc2N1c3NlZCwgYSBtb2Jp bGUgcGhvbmUgbWF5IGFsc28gaGF2ZSBhIGNyZWRlbnRpYWwgZm9yLCBzYXksIGEgVE4gdGhhdCBp cyBkZWxlZ2F0ZWQgdG8gYSBsYW5kbGluZSwgdG8gY292ZXIgdGhlIGV4YW1wbGUgY2FzZSBvZiBh IGRvY3RvciBwbGFjaW5nDQogYSBjYWxsIG9uIGhpcyBtb2JpbGUsIGJ1dCBnZXR0aW5nIGhpcyBv ZmZpY2UgbnVtYmVyIHRvIHNob3cgdXAgYXMgdGhlIGNhbGxpbmcgcGFydHkuICZuYnNwO1VzZSBv ZiBzdWNoIG1lY2hhbmlzbXMgaXMgcG9saWN5LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2lu LWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDQsIDIw MTYsIGF0IDI6NTIgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gJmx0OzxhIGhyZWY9Im1haWx0 bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20iPlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj5UaGFua3MgQnJpYW4uJm5ic3A7IEnigJltIGFm cmFpZCB3ZeKAmXJlIHN0cmF5aW5nIGludG8gYSBwb2xpY3kgZGlzY3Vzc2lvbi4mbmJzcDsgUmVn YXJkbGVzcywgSSBkbyBhcHByZWNpYXRlIHlvdXIgZXhwbGFuYXRpb24uJm5ic3A7IEkgd291bGQg bGlrZSB0byBjb250aW51ZSB0aGUgZGlzY3Vzc2lvbiwgYnV0DQogSeKAmW0gcHJldHR5IHN1cmUg dGhpcyBpc27igJl0IHRoZSByaWdodCBmb3J1bS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tcmlnaHQ6NS44cHQiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj5QaWVyY2U8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+ PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkJyaWFuDQogUm9zZW4gWzxhIGhy ZWY9Im1haWx0bzpickBicmlhbnJvc2VuLm5ldCI+bWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0PC9h Pl08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0K PGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPkF1Z3VzdCAwNCwgMjAxNiAxOjM0IFBNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5Hb3JtYW4sIFBpZXJjZSBBIFtDVE9d ICZsdDs8YSBocmVmPSJtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tIj5QaWVyY2UuR29y bWFuQHNwcmludC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+QWxleCBCb2JvdGVrICZsdDs8YSBocmVmPSJt YWlsdG86YWxleEBib2JvdGVrLm5ldCI+YWxleEBib2JvdGVrLm5ldDwvYT4mZ3Q7Ow0KPGEgaHJl Zj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPnN0aXJAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVj dDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJl OiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T2Yg Y291cnNlIEkgd2FudCBQQlhzIHRvIHNpZ24gY2FsbHMuICZuYnNwO0FzIHdlbGwgYXMgc21hcnQg cGhvbmVzIGFuZCBhbnkgb3RoZXIgZGV2aWNlcyB0aGF0IGNhbiBiZSBwcm9ncmFtbWVkIHRvIGRv IHNvLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlRoZXkgd2lsbCBiZSBnaXZlbiBjcmVkZW50aWFscyB0aGF0IG9ubHkgYXJlIHZhbGlk IGZvciB0aGUgVE5zIHRoZXkgYXJlIGF1dGhvcml6ZWQgdG8gc2lnbiBmb3IuICZuYnNwO1RoZXkg Y2FuIHRyeSB0byBzaWduIGFueSBjYWxsLCBidXQgdGhlIHZhbGlkaXR5IG9mIHRoZSBjcmVkZW50 aWFsIHdvdWxkIG1ha2Ugc3VjaCBhIHNpZ25hdHVyZSBmYWlsIHRoZSBjaGVja2luZy48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+R2V0dGluZyBzZXJ2aWNlIHByb3ZpZGVycyB0byBzaWduIG9u IGJlaGFsZiBvZiBkZXZpY2VzIGlzIGEgcmVhc29uYWJsZSB3YXkgdG8gZGVwbG95IHF1aWNrbHks IGJ1dCBJIGV4cGVjdCBtYW55IFNQcyB3aWxsIHdhbnQgdG8gZ2V0IG91dCBvZiB0aGUgbGlhYmls aXR5IG9mIHNpZ25pbmcgb24gYmVoYWxmIG9mIHRoZWlyIGN1c3RvbWVycy4gJm5ic3A7SWYgdGhl eSBjYW4gcHVzaCBvZiB0aGF0IHJlc3BvbnNpYmlsaXR5DQogdG8gdGhlaXIgY3VzdG9tZXIsIG9u bHkgYmVpbmcgcmVzcG9uc2libGUgZm9yIGdldHRpbmcgdGhlIGN1c3RvbWVyIGFuIGFwcHJvcHJp YXRlIGNyZWRlbnRpYWwgd2hlbiB0aGV5IGFzc2lnbiBUTnMsIHRoZW4gSSB3b3VsZCBleHBlY3Qg dGhlbSB0byB3YW50IHRvIGRvIHNvLiAmbmJzcDtUaGF0IG1lYW5zIHRoZSBkZXZpY2VzIGhhdmUg dG8gYmUgYWJsZSB0byBzaWduLCBidXQgSSB1bmRlcnN0YW5kIG1hbnkgb2YgdGhlIFBCWCB2ZW5k b3JzIHRoaW5rIHRoYXTigJlzDQogc29tZXRoaW5nIHRoZXkgY291bGQgcHJvdmlkZSBpbiBhIGZ1 dHVyZSByZWxlYXNlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDQsIDIwMTYsIGF0IDI6MjIgUE0sIEdvcm1hbiwgUGll cmNlIEEgW0NUT10gJmx0OzxhIGhyZWY9Im1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20i PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbTwvc3Bh bj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzAwMDBDQyI+WW91IHdhbnQgSVAgUEJYZXMgdG8gc2lnbiBjYWxscz8gJm5ic3A7V29u4oCZdCB0 aGF0IG1ha2UgaXQgZXh0cmFvcmRpbmFyaWx5IGVhc3kgdG8gY29tbWl0IGZyYXVkIHdpdGggYXV0 aGVudGljYXRlZCBudW1iZXJzPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXJpZ2h0OjUuOHB0Ij4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Ccmlhbg0KIFJvc2VuIFs8YSBocmVmPSJtYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXQiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm1haWx0bzpickBicmlhbnJvc2VuLm5ldDwvc3Bhbj48 L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+ DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+QXVndXN0IDA0LCAyMDE2IDEyOjI0IFBNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5Hb3JtYW4sIFBpZXJjZSBBIFtD VE9dICZsdDs8YSBocmVmPSJtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5QaWVyY2UuR29ybWFuQHNwcmludC5jb208L3NwYW4+PC9hPiZn dDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPkFsZXggQm9ib3RlayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFsZXhAYm9ib3Rlay5u ZXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFsZXhAYm9ib3Rlay5uZXQ8L3NwYW4+PC9h PiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxh IGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5z dGlyQGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtzdGlyXSBTVElSIDQ0NzRi aXMtMTAgY29tbWVudHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5GaXJzdCBvZiBhbGwsIHdlIHdvdWxkIHdhbnQgdGhlIFBCWCB0byBnZW5lcmF0ZSB0 aGUgc2lnbmF0dXJlLCBidXQgdGhlIHNlcnZpY2UgcHJvdmlkZXIgY2FuIGRvIHRoYXQuICZuYnNw O0l0IHNob3VsZCBub3QgYWRkIGEgdmFsaWQgc2lnbmF0dXJlIHRvIGEgY2FsbCBmcm9tIGEgbnVt YmVyIGl0IGRpZCBub3QgYXNzaWduIHRvIHRoZSB0cnVuayBncm91cCBjb25uZWN0aW5nIHRvIHRo ZSBQQlgsIGFsdGhvdWdoIGl0IGNvdWxkDQogc3VwcG9ydCB0aGUgZXh0cmEgZGVsZWdhdGlvbiBy ZXF1aXJlZCB0byBzdXBwb3J0IOKAnGF1dGhvcml6ZWQgc3Bvb2ZpbmfigJ0uICZuYnNwO1RoZSBj b21wYW5pb24gZGV2aWNlcyBJ4oCZbSBhd2FyZSBvZiBhbHdheXMgc2VuZCBjYWxscyBmcm9tIHRo ZSBzYW1lIHNlcnZpY2UgcHJvdmlkZXIgYW5kIHNob3VsZCBub3QgcHJlc2VudCBhbnkgaXNzdWUu Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5F dmVyeW9uZSB3aWxsIGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbuKAmXQgZG8gbm93IHRvIGltcGxl bWVudCBzdG9wIHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDQsIDIwMTYs IGF0IDEyOjQxIFBNLCBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dICZsdDs8YSBocmVmPSJtYWlsdG86 UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5QaWVy Y2UuR29ybWFuQHNwcmludC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDAwQ0MiPkZyYXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29tbW9uLiZuYnNwOyBBbmQg ZXZlbiB3aGVyZSBhIFBCWCBpcyBub3QgY29tcHJvbWlzZWQsIGEgY2FycmllciBoYXMgbm8gcHJh Y3RpY2FsIHdheSBvZiBrbm93aW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVtYmVyIGlzIHByb3Bl cmx5DQogYXNzaWduZWQgYW5kIHZhbGlkIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHRoZSBFbnRl cnByaXNlLiZuYnNwOyBUaGVyZWZvcmUsIGNoZWNraW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVt YmVyIHdhcyBmcm9tIGFuIGFzc2lnbmVkIHJhbmdlIG1pZ2h0IGJlIHBvc3NpYmxlIChhbmQgZnJh dWdodCB3aXRoIGFkbWluaXN0cmF0aXZlIGNoYWxsZW5nZXMpLCBidXQgb2YgbGltaXRlZCB2YWx1 ZS4mbmJzcDsgQW5kIGluIHRoZSBjb25zdW1lciBtYXJrZXQsIHRoZXJlIGFyZQ0KIGNhbGxpbmcg cHJvZHVjdHMgd2hpY2ggc3VwcG9ydCBhIHBhcmVudCBzdWJzY3JpYmVyIG51bWJlciBhbmQg4oCc Y29tcGFuaW9u4oCdIGRldmljZXMgKGUuZy4sIHRhYmxldHMpIHdoaWNoIGNhbiBwbGFjZSBhIGNh bGwgdXNpbmcgdGhlIE1ETiBvZiB0aGUgcGFyZW50IHN1YnNjcmliZXIuJm5ic3A7IFRoZXNlIGFy ZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUgYXV0aGVudGljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJl ciB3b27igJl0IG5lY2Vzc2FyaWx5IG1lYW4gdGhlDQogc2FtZSB0aGluZyBhcyB0aGUgYXV0aGVu dGljaXR5IG9mIGEgY2FsbCBmcm9tIGEgc2luZ2xlIHN1YnNjcmliZXIgd2l0aCBhIHNpbmdsZSBN RE4gcmVnYXJkbGVzcyBvZiDigJxsYXhpdHnigJ0gb2Ygc3Bvb2YgY2hlY2tpbmcuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDAwQ0MiPkluIGFub3RoZXIgZm9ydW0gYW5kIGFudGljaXBhdGluZyBjYWxsaW5nIG51bWJlciBh dXRoZW50aWNhdGlvbiBtYW5kYXRlcyBmcm9tIENvbmdyZXNzIGFuZC9vciBGQ0MsIEkgc3VnZ2Vz dGVkIHVzaW5nIGNhcnJpZXItc3BlY2lmaWMgY2VydHMgYW5kIGVuY29kaW5nIHNwZWNpZmljaXR5 DQogb2YgYXV0aGVudGljaXR5LCBhbmQgY2FsbGluZyBudW1iZXIuJm5ic3A7IFRoaXMgcHJvdmlk ZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyLCBzb21lIGlkZWEgYXMg dG8gdGhlIGFjY3VyYWN5IG9yIHNwZWNpZmljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciwgYW5k IHZhbGlkdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyIChhc3N1bWluZyBub25jZSBhbmQgcmVwbGF5 IGlzc3VlcyBjYW4gYmUgYWRkcmVzc2VkIGFzIHJlYXNvbmFibHkNCiBzdWdnZXN0ZWQgYmVsb3cg YnkgQWxleCkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMDAwMENDIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPlRoZSByZXByZXNlbnRhdGlvbiBvZiBvcmlnLWNhcnJp ZXIgYW5kIHRydXN0d29ydGhpbmVzcyBjb3VsZCBiZSBhcyBmb2xsb3dzOjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+UmVndWxhdGVkL21hbmRhdGVkIENhcnJpZXIgQ2xhc3MgVXNlIENh c2U6PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4wMCAtIE5vIENyZWRlbnRpYWxzPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Vc2UgY2Fz ZSBleGFtcGxlKHMpOiBQcmUtSU1TLCBsZWdhY3kgY2lyY3VpdC1zd2l0Y2hlZCBuZXR3b3JrcyB0 aGF0IGRvbid0IG5hdGl2ZWx5IHN1cHBvcnQgU0lQIG9yIHdoaWNoIGRvbid0IGNob29zZSB0byBz aWduIGNhbGxzLiZuYnNwOyBFLmcuLCBpbnRlcm5hdGlvbmFsIGNhcnJpZXJzLjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5UcnVzdCBFc3RpbWF0ZTogJm5ic3A7R29vZCBsdWNrLiZuYnNwOyBDYXJyaWVyX29y aWcgYW5kIENnUE4gZW50aXJlbHkgdW50cnVzdHdvcnRoeS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjAxIC0gQ2FycmllciBzaWduZWQsIG5vIGF1dGhlbnRp Y2F0aW9uIG9mIENnUE48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVzZSBjYXNlIGV4YW1wbGUocyk6 IEU5MTEgb24gdmlzaXRlZCBuZXR3b3JrIHcvbyByb2FtaW5nIGFncmVlbWVudCwgbWFudWFsIHJv YW1pbmcuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRydXN0IEVzdGltYXRlOiAmbmJzcDtDYXJyaWVyX29y aWcgdHJ1c3R3b3J0aHksIENnUE4gZW50aXJlbHkgdW50cnVzdHdvcnRoeTwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+MTAgLSBDYXJyaWVyIHNpZ25lZCwgc2Vt aS1hdXRoZW50aWNhdGVkIENnUE48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVzZSBjYXNlIGV4YW1w bGUocyk6IE51bWJlciBibG9jayBkZWxlZ2F0ZWQgZnJvbSBPQ04sIGJ1dCBubyBwZXItVE4gc2Ny ZWVuIChTSVAgdHJ1bmtzKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VHJ1c3QgRXN0aW1hdGU6ICZuYnNw O0NhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBsZXNzIHRoYW4gbW9zdCB0cnVzdHdvcnRo eSBidXQgbm90IGVudGlyZWx5IHVudHJ1c3R3b3J0aHkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4xMSAtIENhcnJpZXIgc2lnbmVkLCBhdXRoZW50aWNhdGVk IENnUE48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVzZSBjYXNlIGV4YW1wbGUocyk6IEJyZWFkLWFu ZC1idXR0ZXIgOTUlJiM0Mzsgb2YgY2FsbHMgZnJvbSBzdWJzY3JpYmVyIGxpbmVzIChJTVMtYmFz ZWQgYW5kIG90aGVyd2lzZSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRydXN0IEVzdGltYXRlOiAmbmJz cDtDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4gbW9zdCB0cnVzdHdvcnRoeTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlB1YmxpYyBVc2UgQ2FzZTo8L3Nw YW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VW5kZWZpbmVkIGJ1dCBh c3N1bWVkIHRvIHVzZSBwdWJsaWMgb3IgY29tbWVyY2lhbGx5IGF2YWlsYWJsZSBhdXRoZW50aWNh dGlvbiBzZXJ2aWNlcyByZXNvdXJjZXMuJm5ic3A7IGUuZy4sIG5vbW9yb2JvLWxpa2UgY3Jvd2Qt c291cmNlZCBhY2NlcHQvZGVueSBsaXN0cywgZXQgY2V0ZXJhLiZuYnNwOyBDb3VsZC93b3VsZA0K IHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUgZGV2aWNlcyB3aGljaCB3b3VsZCBw cm9jZXNzIHRoZW0gYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBvZiB0aGUgUHVibGljIENsYXNzIGFw cGxpY2F0aW9uKHMpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzAwMDBDQyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj5QaWVyY2U8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAw aW4gMGluIDBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5Ccmlhbg0KIFJvc2VuIFs8YSBocmVmPSJtYWlsdG86YnJAYnJpYW5yb3Nlbi5u ZXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm1haWx0bzpickBicmlhbnJvc2VuLm5ldDwv c3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+QXVndXN0IDA0LCAyMDE2IDk6MDIgQU08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkFsZXggQm9ib3RlayAm bHQ7PGEgaHJlZj0ibWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPmFsZXhAYm9ib3Rlay5uZXQ8L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1h aWx0bzpzdGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5zdGlyQGlldGYu b3JnPC9zcGFuPjwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29t bWVudHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVyZSBhcmUgcmVhc29uYWJsZSBjaXJjdW1z dGFuY2VzIHdoZXJlIGEgcGFydHkgcGxhY2luZyBhIGNhbGwgaXMgbm90IHRoZSBhdXRob3JpemVk IGVudGl0eSBhc3NpZ25lZCB0aGUgdGVsZXBob25lIG51bWJlciB1c2VkIGluIEZyb20vUEFJLCBh bmQgaW4gc3VjaCBjaXJjdW1zdGFuY2VzIHRoZSBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpY2luZyB0 aGUgZW50aXR5IHBsYWNpbmcgdGhlIGNhbGwgbWF5IG9yIG1heQ0KIG5vdCBiZSB0aGUgc2FtZSBh cyB0aGUgc2VydmljZSBwcm92aWRlciBzZXJ2aW5nIHRoZSBlbnRpdHkgdGhhdCBpcyBhc3NpZ25l ZCB0aGUgVE4uICZuYnNwO0luIGFsbCBzdWNoIGNhc2VzLCB0aGUgZW50aXR5IHRoYXQgaXMgYXNz aWduZWQgdGhlIFROIGV4cGxpY2l0bHkgYXV0aG9yaXplcyBjYWxscyBwbGFjZWQgdXNpbmcgaXTi gJlzIFROLiAmbmJzcDtUaGUgZGVzaWduIGFjY29tbW9kYXRlcyBzdWNoIHVzZSBjYXNlcy4gJm5i c3A7SXTigJlzIG5vdCBhIGJsYW5rZXQgYXV0aG9yaXphdGlvbg0KIHdpdGhvdXQgYXV0aGVudGlj YXRpb24uICZuYnNwOyBXZeKAmXJlIG5vdCBhd2FyZSBvZiBhbnkgY2FzZXMgd2hlcmUgdGhlcmUg aXMgYW4gYWN0dWFsIHJlcXVpcmVtZW50IGZvciBsZWdpdGltYXRlIGNhbGxpbmcgd2l0aG91dCBl eHBsaWNpdCBhdXRob3JpemF0aW9uIGZyb20gdGhlIGFzc2lnbmVkIGVudGl0eSwgYWx0aG91Z2gg d2UgY2VydGFpbmx5IGFyZSBhd2FyZSB0aGF0IHZhcmlvdXMgcGFydHMgb2YgdmFyaW91cyBzZXJ2 aWNlIHByb3ZpZGVycyBkb27igJl0DQogYm90aGVyIHRvIGNoZWNrLiBBdCB0aGlzIHBvaW50LCBh dCBsZWFzdCBpbiBzb21lIGNvdW50cmllcywgdGhlcmUgaXMgYSByZWFsaXphdGlvbiB0aGF0IHRo ZSBsYXhpdHkgb2YgYWxsb3dpbmcgdW5jaGVja2VkIHNwb29maW5nIGlzIG5vdCBhY2NlcHRhYmxl IGFueSBtb3JlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnJpYW48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDMsIDIwMTYsIGF0IDg6MzUgQU0sIEFs ZXggQm9ib3RlayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmFsZXhAYm9ib3Rlay5uZXQ8L3NwYW4+PC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRl eHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4xLjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+UGVybWl0DQogYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9u PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SW4gdGhlIGN1cnJlbnQgdGVsZXBob255 IG5ldHdvcmsgcHJhY3RpY2UsIHNvbWUgc2VydmljZSBwcm92aWRlciBpbXBsZW1lbnRhdGlvbnMg Y2hvb3NlIG5vdCB0byBhdXRoZW50aWNhdGUgaWRlbnRpdHksIGJ1dCBzaW1wbHkgZmFjaWxpdGF0 ZSB0aGUgdXNlIG9mIGFuIGFyYml0cmFyeSBvciBzZWxlY3RlZA0KIHVzZXItcHJvdmlkZWQgaWRl bnRpdHkuJm5ic3A7IEFyZSB0aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8mbmJz cDsgSGFzIGFueW9uZSBlc3RhYmxpc2hlZCB0aGF0IHRoZXJlIGFyZSBub3Q/Jm5ic3A7IEhvdyBj YW4gdGhlIGluZHVzdHJ5IHJlYXNvbmFibHkgZXhwZWN0IHRvIGVuZCB0aGlzICg8c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+b2Z0ZW48L3NwYW4+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPmJhZCkgcHJhY3RpY2U/Jm5ic3A7DQogSWYgaXQgY2Fu4oCZ dCBiZSBlbmRlZCwgdGhlcmXigJlzIHZhbHVlIGluIGF0IGxlYXN0IGlkZW50aWZ5aW5nIHRoZSBv cmlnaW5hdGluZyBzZXJ2aWNlIHByb3ZpZGVyICg8c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+ aS5lLiw8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9z cGFuPnRoZSBzaWduZXIvYXV0aG9yaXplcikuJm5ic3A7IEdpdmVuIHRoZSBwcmV2YWxlbmNlIG9m IGFidXNlIHVzaW5nIHRlbGVwaG9uZSBudW1iZXJzDQogYXNzaWduZWQgdG8gYSBzb21ldGltZXMt YW5vbnltb3VzIGFidXNlciwgaXQgYmVjb21lcyBjcml0aWNhbGx5IGltcG9ydGFudCB0byBpZGVu dGlmeSB0aGUgc2VydmljZSBwcm92aWRlcihzKSBjbG9zZXN0IHRvIHRoZSBhYnVzZXIuJm5ic3A7 IEJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQgaXTigJlzIGJldHRlciB0byBJRCBzZXJ2aWNl IHByb3ZpZGVycyB0aGFuIHVucmVhc29uYWJseSBleHBlY3QgYSBiYW4gb2YgdGhlIHVzZSBvZiB1 bmF1dGhlbnRpY2F0ZWQNCiAoYW5kIHRoZXJlZm9yZSB1bnNpZ25lZCkgU0lQIHJlcXVlc3RzLCBT VElSIHNpZ25pbmcgc2hvdWxkIHN1cHBvcnQgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRp Y2F0aW9uLiZuYnNwOyBUaGUgcHJhY3RpY2Ugb2YgYXV0aG9yaXppbmcgdW5hdXRoZW50aWNhdGVk IHVzZSBleGlzdHMsIGFuZCB0aGVyZSBpcyBiZW5lZml0IHRvIHNpZ25pbmcgaW4gdGhlc2UgY2Fz ZXMgKHNlcnZpY2UgcHJvdmlkZXIgaWRlbnRpZmljYXRpb24pLiZuYnNwOyBUaGUgbGFuZ3VhZ2UN CiBvZiB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlzIHVzZS4mbmJzcDsgNDQ3NGJpcy0xMCBzaG91 bGQgTk9UIHJlcXVpcmUgb3IgYXNzdW1lIHRoYXQmbmJzcDsgdGhhdCBhdXRoZW50aWNhdGlvbiB3 aWxsIHByZWNlZGUgYXV0aG9yaXphdGlvbi4gT2YgY291cnNlIHRoZXJlIG1heSBiZSBvdGhlciB1 c2UgY2FzZXMgd2hlcmUgc2lnbmluZyBpbmNsdWRlcyBhdXRoZW50aWNhdGlvbiBhbmQgbWF5IG5v dCBpbmNsdWRlIGEgc3BlY2lmaWMgc2VydmljZSBwcm92aWRlcuKAmXMNCiBhdXRob3JpemF0aW9u PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPi48L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4yLjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+SW1wcm92ZQ0KIHJlcGxheSBwcmV2ZW50aW9uPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+UHJveGltYXRlIHJlcGxheSBpcyBwb3NzaWJsZTxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+d2hpbGUgY29tcGx5aW5nIHdpdGg8L3NwYW4+PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPnRoaXMNCiBzcGVjLiZuYnNwOyBGaXJzdCwgb25l IG9yIG1vcmUgcHJveGltYXRlIChlLmcuLCB3aXRoaW4gNjAgc2Vjb25kcykgU0lQIHJlcXVlc3Rz IHVzaW5nIHRoZSBzYW1lIHRva2VuIGFyZSBsZWdhbCBhbmQgc3ViamVjdCB0byByZXBsYXkgaW4g bWFueSBjYXNlcy4mbmJzcDsgQW4gU0RQIGJvZHnigJlzIG1reSBtYXkgbm90IGJlIHByZXNlbnQg YW5kIGlmIHByZXNlbnQgaXRzIHVzZSBpcyBvcHRpb25hbC4mbmJzcDsgU29tZSBzb3J0IG9mIG1h bmRhdG9yeSBuZXcgb3IgZXhpc3RpbmcNCiBzaWduZWQgc2VxdWVuY2UsIHJhbmRvbSAjIG9yIHJl cXVlc3QgSUQgKGUuZy4sIENhbGwtSUQgb3IgQ1NlcSkgYW5kIGEgMS10aW1lIHVzZSBwb2xpY3kg b24gdGhlIHJlY2VpdmluZyBlbmQgb2YgdGhlIHJlcXVlc3Q8c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPihl LmcuLCB0b2tlbnMgb25seSBnb29kIGZvciAxIHVzZSk8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPmNvdWxkDQogcHJldmVudCByZXBsYXkuJm5i c3A7IERpZmZlcmVudCBtZXRob2RzIChlLmcuLCBJTlZJVEUgdnMgTUVTU0FHRSkgbWlnaHQgYmUg aGFuZGxlZCBieSBkaWZmZXJlbnQgcmVjZWl2aW5nIGluZnJhc3RydWN0dXJlLCBhbmQgdGhlcmVm b3JlIGRpZmZpY3VsdGllcyB3aXRoIOKAmGl04oCZcyBiZWVuIHVzZWQgYWxyZWFkeeKAmSBjb29y ZGluYXRpb24gYWxsb3cgYSBmYWtlZCBNRVNTQUdFIGJhc2VkIG9uIGEgY2FwdHVyZWQgcmVxdWVz dC4mbmJzcDs8c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+VDwvc3Bhbj5oaXMNCiBtaWdodCBp bmNsdWRlIGFuIG1rZXkgZnJvbSBhIGNhcHR1cmVkIElOVklURS4mbmJzcDsgJm5ic3A7U28gaXQg bWF5IGJlIHBvc3NpYmxlIHRvIERPUywgc3BhbSBvciB0ZXh0LWJvbWIgYSByZWNpcGllbnQgdXNp bmcgYSBjYXB0dXJlZCBpZGVudGl0eS4mbmJzcDsgV2hpbGUgbGFyZ2Utc2NhbGUgb3IgZGlzdHJp YnV0ZWQgaW1wbGVtZW50YXRpb25zIG1heSBtYWtlIHRoZSBlbmZvcmNlbWVudCBkaWZmaWN1bHQs IHRoZXJlIGlzIGxpdHRsZSBjb3N0IHRvIHNpZ25pbmcgYW5kDQogZGVjb2RpbmcgYSBtZXRob2Qg YW5kIHBvc3NpYmx5IGEgbnVtZXJpYyBJRC4mbmJzcDsgJm5ic3A7PHNwYW4gc3R5bGU9ImNvbG9y OiMxRjQ5N0QiPlNvbWUgc29ydCBvZiDigJgxLXVzZeKAmSBwcmFjdGljZSBzaG91bGQgYXQgbGVh c3QgYmUgZGlzY3Vzc2VkIHdoaWxlIHBlcmhhcHMgbm90IHJlcXVpcmVkLiAmbmJzcDs8L3NwYW4+ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TcGVjaWZpYyBtYXJrdXAgc3VnZ2VzdGlv bnM6Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPk5J VFM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7 IFRoZSB2ZXJpZmllciBNVVNUIGluc3BlY3QgYW55IG9wdGlvbmFsICZxdW90O3BwdCZxdW90OyBw YXJhbWV0ZXIgYXBwZWFyaW5nIDxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTYuMHB0O2NvbG9y OnJlZCI+aW48L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJjb2xvcjpyZWQiPiA8L3NwYW4+dGhlPG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IElkZW50aXR5IHJlcXVlc3QuJm5ic3A7 IElmIG5vICZxdW90O3BwdCZxdW90OyBwYXJhbWV0ZXIgaXMgcHJlc2VudCwgdGhlbiB0aGU8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgdmVyaWZpZXIgcHJvY2VlZHMgbm9ybWFs bHkgYmVsb3cuJm5ic3A7IElmIGEgJnF1b3Q7cHB0JnF1b3Q7IHBhcmFtZXRlciB2YWx1ZSBpczxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBwcmVzZW50LCBhbmQgdGhlIHZlcmlm aWVyIGRvZXMgbm90IHN1cHBvcnQgaXQsIGl0IE1VU1QgaWdub3JlIHRoZTxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBJZGVudGl0eSBoZWFkZXIuJm5ic3A7IElmIGEgc3VwcG9y dGVkICZxdW90O3BwdCZxdW90OyBwYXJhbWV0ZXIgdmFsdWUgaXMgcHJlc2VudCw8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgdGhlIHZlcmlmaWVyIGZvbGxvd3MgdGhlIHByb2Nl ZHVyZXMgYmVsb3csIGluY2x1ZGluZyB0aGUgdmFyaWF0aW9uczxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyBkZXNjcmliZWQgaW4gU3RlcCA1LjxvOnA+PC9vOnA+PC9wcmU+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8aDI+PGEgbmFtZT0ic2VjdGlv bi0zIj48L2E+PGEgaHJlZj0iZmlsZTovLy9DOlxVc2Vyc1xhYjM3NzhcRG9jdW1lbnRzXElFVEZc ZHJhZnQtaWV0Zi1zdGlyLXJmYzQ0NzRiaXMtMTAlMjAtJTIwQXV0aGVudGljYXRlZCUyMElkZW50 aXR5JTIwTWFuYWdlbWVudCUyMGluJTIwdGhlJTIwU2Vzc2lvbiUyMEluaXRpYXRpb24lMjBQcm90 b2NvbCUyMCUyOFNJUCUyOS5odG0jc2VjdGlvbi0zIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Izk1NEY3MiI+Mzwvc3Bhbj48L2E+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4uJm5ic3A7DQogQmFj a2dyb3VuZDwvc3Bhbj48bzpwPjwvbzpwPjwvaDI+DQo8cHJlPlvigKZdPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IFBlciBb PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzczNDAiIHRpdGxlPSImcXVv dDtTZWN1cmUgVGVsZXBob25lIElkZW50aXR5IFByb2JsZW0gU3RhdGVtZW50IGFuZCBSZXF1aXJl bWVudHMmcXVvdDsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5SRkM3MzQwPC9zcGFuPjwv YT5dLCBwcm9ibGVtcyBzdWNoIGFzIHJvYm9jYWxsaW5nLCB2b2ljZW1haWwgaGFja2luZywgYW5k PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHN3YXR0aW5nIGFyZSBlbmFibGVk IGJ5IGFuIGF0dGFja2VyJ3MgYWJpbGl0eSB0byBpbXBlcnNvbmF0ZSBzb21lb25lPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGVsc2UuJm5ic3A7IFRoZSBzZWN1cmUgb3BlcmF0 aW9uIG9mIG1vc3QgU0lQIGFwcGxpY2F0aW9ucyBhbmQgc2VydmljZXM8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsgZGVwZW5kcyBvbiA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5h dXRoZW50aWNhdGluZyBhbmQvb3IgPC9zcGFuPmF1dGhvcml6aW5nIHRoZSBzb3VyY2Ugb2YgY29t bXVuaWNhdGlvbnMgYXMgaXQgaXM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsg cmVwcmVzZW50ZWQgaW4gYSBTSVAgcmVxdWVzdC4gPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsgVGhpcyBpZGVudGl0eSBhcmNoaXRlY3R1cmUgZm9yIFNJ UCA8cz5kZXBlbmRzIG9uPC9zPiA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5pbmNsdWRlcyBwcm92 aXNpb25zIGZvciA8L3NwYW4+YSBsb2dpY2FsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7ICZxdW90O2F1dGhlbnRpY2F0aW9uIHNlcnZpY2UmcXVvdDsgd2hpY2ggdmFsaWRhdGVz IDxzcGFuIHN0eWxlPSJjb2xvcjpyZWQiPmNhbGxlciBpZGVudGl0eSBhdCBvciBuZWFyIG9yaWdp bmF0aW9uLiZuYnNwOyA8L3NwYW4+PHM+b3V0Z29pbmcgcmVxdWVzdHMuPC9zPiZuYnNwOyBBbjxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBhdXRoZW50aWNhdGlvbiBzZXJ2aWNl IG1heSBiZSBpbXBsZW1lbnRlZCBlaXRoZXIgYXMgcGFydCBvZiBhIHVzZXI8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgYWdlbnQgb3IgYXMgYSBwcm94eSBzZXJ2ZXI7IHR5cGlj YWxseSwgaXQgaXMgYSBjb21wb25lbnQgb2YgYSBuZXR3b3JrPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7IGludGVybWVkaWFyeSBsaWtlIGEgcHJveHkgdG8gd2hpY2ggb3JpZ2lu YXRpbmcgdXNlciBhZ2VudHMgc2VuZDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyB1bnNpZ25lZCByZXF1ZXN0cy4mbmJzcDsgT25jZSB0aGUgc2VuZGVyIG9mIHRoZSBtZXNzYWdl IGhhcyBiZWVuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cHJlPiZuYnNwOyZuYnNwOyBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIG1lYW5zIG9mIHNoYXJp bmcgYSBjcnlwdG9ncmFwaGljIGFzc3VyYW5jZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyBvZiA8c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5hdXRoZW50aWNpdHkgb2YgYW5kL29y IGF1dGhvcml6YXRpb24gdG8gdXNlIDwvc3Bhbj5lbmQtdXNlciBTSVAgaWRlbnRpdHkgaW4gYW4g aW50ZXJkb21haW4gb3IgaW50cmFkb21haW4gY29udGV4dC48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsgSXQgcmVsaWVzIG9uIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGNv bnN0cnVjdGluZyB0b2tlbnMgYmFzZWQgb24gW+KApl0gPG86cD48L286cD48L3ByZT4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IFRv IG1heGltaXplIGVuZC10by1lbmQgc2VjdXJpdHksIGl0IGlzIDxzcGFuIHN0eWxlPSJjb2xvcjpy ZWQiPnR5cGljYWxseSA8L3NwYW4+PHM+b2J2aW91c2x5PC9zPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyBwcmVmZXJhYmxlIGZvciBlbmQtdXNlcnMgdG8gYWNxdWlyZSB0aGVp ciBvd24gY3JlZGVudGlhbHM7IGlmIHRoZXk8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsgZG8sIHRoZWlyIHVzZXIgYWdlbnRzIGNhbiBhY3QgYXMgYXV0aGVudGljYXRpb24gc2Vy dmljZXMuJm5ic3A7IEhvd2V2ZXIsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 IGZvciBzb21lIGRlcGxveW1lbnRzLCBb4oCmXTxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+UmVnYXJkcyw8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ QWxleDxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjguMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0dhcmFtb25kJnF1b3Q7LHNlcmlm O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0dhcmFtb25kJnF1b3Q7LHNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFsZXggQm9ib3Rl azwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjcuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6bmF2eSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0Kc3RpciBtYWlsaW5nIGxpc3Q8 YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6Izk1NEY3MiI+c3RpckBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vc3RpciI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTU0RjcyIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxl PSJ0ZXh0LWFsaWduOmNlbnRlciI+DQo8aHIgc2l6ZT0iMiIgd2lkdGg9IjEwMCUiIGFsaWduPSJj ZW50ZXIiPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6Ny41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpncmF5Ij48YnI+DQpUaGlzIGUtbWFpbCBtYXkgY29udGFpbiBTcHJpbnQg cHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gaW50ZW5kZWQgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUg cmVjaXBpZW50KHMpLiBBbnkgdXNlIGJ5IG90aGVycyBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgYXJl IG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UgY29udGFjdCB0aGUgc2VuZGVyIGFu ZCBkZWxldGUgYWxsIGNvcGllcyBvZiB0aGUgbWVzc2FnZS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_ced872efc4a549ce9157b2440fd2a408PLSWE13M08adsprintcom_-- From nobody Thu Aug 4 14:14:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C31B12D767 for ; Thu, 4 Aug 2016 14:14:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YvSga8nI-vJ6 for ; Thu, 4 Aug 2016 14:14:33 -0700 (PDT) Received: from mail-qt0-x233.google.com (mail-qt0-x233.google.com [IPv6:2607:f8b0:400d:c0d::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7446212D0E9 for ; Thu, 4 Aug 2016 14:14:33 -0700 (PDT) Received: by mail-qt0-x233.google.com with SMTP id w38so165410741qtb.0 for ; Thu, 04 Aug 2016 14:14:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=mLzlkgjcbyiNw/8Sd8KqyFLSb5A4CY8uGh1OhV/qOsU=; b=lVHp+gZAYMmq4gT3QNQY+uFJgXPdQrMm+eSPsj2JVT13GCK6znFFkt2FGLEMD7ykDN ZRNx7plW1BEqp31ezs5p7VNhq62wMrqI5lusazWdkh3ecvFuA8+l2Do/CuA0RmscL/n7 dQCyK5XuWQomqmXBQMxjbevQwoqjh4O+NlSveuZOn5/qUua4EO4paDA0JfViunRoFwIF d7h9KNt25pbsSAueIg0FfMnj9FX/jgbGZg+qsj7lHUqrhPrUG5ssEc2gvXPOYKyDiaoO BLYcu6z5n1FFynQc/MiHSxed8G+E4xBH9HMY/m2LR5MDpZ6n4sURWylKN/xTPiHO6HPx eVPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=mLzlkgjcbyiNw/8Sd8KqyFLSb5A4CY8uGh1OhV/qOsU=; b=DEwA5H2T0MKwhVjWXLGBwUT26D8I7ylg00GWhKzxL3iMotuJd5WdMJuTWzyR5dmjZx 9ueKDMOKTID4KwigNdNWRn+lh0WMqzsam62jPeCNePOgijGwJZ13jiFR6hO72nF/fDo/ 0Q2pdvINbty8EC0FVvcVoQBz6UdKGjrf2xZYrUtB47tyE4/eIS0aC1K+jG35t+Z8cSUh /j/IojopmuB2+x+6G1DsAcwhBMC78WXLeMHdkOUajBYHE5Ybh7005F7cNuZLYFXAk5Pq sa0e7zBuKAlLtcLJ0tl4okeAxdjSaAWCN+DBioLikGrYWqh2mlZklB6bFAS+JzPhsrsL NyHA== X-Gm-Message-State: AEkoouu8ujSQfw2T7nkFhiuO+v3Zt1uZ6cnNFs9l0DOvIzJNygjctCy5aqp97yhvQiuijg== X-Received: by 10.200.35.108 with SMTP id b41mr9005021qtb.142.1470345272358; Thu, 04 Aug 2016 14:14:32 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id k8sm7896501qke.39.2016.08.04.14.14.30 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 14:14:31 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_5345AA14-F9C7-42FD-ABFB-6955AA767DC0" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Thu, 4 Aug 2016 17:14:27 -0400 Message-Id: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 21:14:38 -0000 --Apple-Mail=_5345AA14-F9C7-42FD-ABFB-6955AA767DC0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I think all we need is to have credentials follow the delegation path, = plus the option to add another level (not delegation) for authorized = spoofers. I don=E2=80=99t think it matters who the delegator or delegatee are as = long as the delegator is willing to take the heat for delegating to = someone who sends a lot of bad calls. They can pass the buck (=E2=80=9CI = delegated the TN to him, and now I=E2=80=99m not responsible=E2=80=9D), = but only if the SP knows who they delegated to, so authorities can = follow the delegation path. There are plenty of certificated carriers = who are willing to not care who they delegate to. The fact that there = are some who do doesn=E2=80=99t change much. Making stir work means = knowing who you are delegating to, so that you can pass the hot potato. It=E2=80=99s perfectly reasonable for a carrier to be able to sign for = any calls placed on its network on any number it has been delegated. If = it does, it=E2=80=99s asserting that the calls are from who they are = supposed to be from. That should be straightforward, but we know it=E2=80= =99s not always, and that represents the hard part of deployment in my = opinion. But once they delegate, they can hand responsibility to sign = to the delegatee. But, that only works if they know who they are = delegating to. The root of the whole model is that there is a formal or informal = delegation path for telephone numbers in every country, and we can build = a chain of trust from that delegation path. If you propose to alter = that model, then we get into (policy) issues of which carriers/entities = we trust and which we don=E2=80=99t. Our model is that you know who you = delegate to, and once you do that delegation, it=E2=80=99s their = problem. That=E2=80=99s pretty appealing I think, even if it=E2=80=99s = a change in some business practices. The mechanism is chaining credentials in a form of a PKI and having a = way to know which TNs are covered by a credential. That=E2=80=99s what = we have, and I=E2=80=99m loath to change it. Brian > On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] = wrote: >=20 > OK, you talked me into indulging in one more message on policy and use = cases. > =20 > I agree that the STIR/PASSporT mechanisms could be deployed on = individual devices as well as multi-device and multi-number platforms. > =20 > Number delegation (and sub-delegation), and business relationships are = two additional factors which affect trustworthiness of a given calling = number authentication. > =20 > Inherent variable trustworthiness of a calling number was my reason = for suggesting a way to qualify the signature to reflect that = variability. > =20 > Originating carriers are in a position to know if a call is coming = from a device assigned a single number, or from =E2=80=9Ctrunk group=E2=80= =9D which could originate calls using multiple numbers, and can qualify = to some degree the trustworthiness of number authenticity accordingly. > =20 > My suggestion was qualifying calling number authenticity into = categories of carrier-signed (or not), and unauthenticated, = semi-authenticated, and most-authenticated. There can be more = granularity, but it implies additional operational complexity (both for = the carriers and the consumers) and I assume diminishes value. > =20 > My reason for adding the authenticity of the originating carrier is = typical trustworthiness of a carrier business relationship with typical = consumers adds to the trustworthiness assessment and partially because = carriers are a regulated point of forensic inquiry for CALEA and fraud. = Additionally, most calls originate and terminate between mobile = consumers where their carriers are able to usefully authenticate their = device and have a high degree of confidence of the authenticity of the = calling number. > =20 > I think billions of per-TN certs of varying usability (revoked, not = revoked) for authenticating calling number will not work well. > =20 > Conversely, I think billions of per-TN certs will work well, if the = calling party has to sign a call with a per-TN cert provided by the = called party. No called party cert to include? Then the calling party = does not have a trusted relationship with the called party, and the call = can be authorized/treated accordingly. (I=E2=80=99ve made similar, = mostly ignored comments in MODERN.) > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net]=20 > Sent: August 04, 2016 2:03 PM > To: Gorman, Pierce A [CTO] > Cc: Alex Bobotek ; stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > Well, the mechanisms are designed so that they could be deployed on = devices and PBXs. Whether they will be is a policy issue. > =20 > The notion of credentials that are traceable to a delegation of a TN = is a mechanism that is part of the design of stir, and the design allows = delegation of one TN (to one device, although a device like a PBX would = have more than one TN per =E2=80=9Cdevice=E2=80=9D, and something like a = dual NAM phone could have more than one credential. For the use case = we=E2=80=99ve discussed, a mobile phone may also have a credential for, = say, a TN that is delegated to a landline, to cover the example case of = a doctor placing a call on his mobile, but getting his office number to = show up as the calling party. Use of such mechanisms is policy. > =20 > Brian > =20 > On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] = > wrote: > =20 > Thanks Brian. I=E2=80=99m afraid we=E2=80=99re straying into a policy = discussion. Regardless, I do appreciate your explanation. I would like = to continue the discussion, but I=E2=80=99m pretty sure this isn=E2=80=99t= the right forum. > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net = ]=20 > Sent: August 04, 2016 1:34 PM > To: Gorman, Pierce A [CTO] > > Cc: Alex Bobotek >; = stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > Of course I want PBXs to sign calls. As well as smart phones and any = other devices that can be programmed to do so. > They will be given credentials that only are valid for the TNs they = are authorized to sign for. They can try to sign any call, but the = validity of the credential would make such a signature fail the = checking. > =20 > Getting service providers to sign on behalf of devices is a reasonable = way to deploy quickly, but I expect many SPs will want to get out of the = liability of signing on behalf of their customers. If they can push of = that responsibility to their customer, only being responsible for = getting the customer an appropriate credential when they assign TNs, = then I would expect them to want to do so. That means the devices have = to be able to sign, but I understand many of the PBX vendors think = that=E2=80=99s something they could provide in a future release. > =20 > Brian > =20 > On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] = > wrote: > =20 > You want IP PBXes to sign calls? Won=E2=80=99t that make it = extraordinarily easy to commit fraud with authenticated numbers? > =20 > =20 > From: Brian Rosen [mailto:br@brianrosen.net = ]=20 > Sent: August 04, 2016 12:24 PM > To: Gorman, Pierce A [CTO] > > Cc: Alex Bobotek >; = stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > First of all, we would want the PBX to generate the signature, but the = service provider can do that. It should not add a valid signature to a = call from a number it did not assign to the trunk group connecting to = the PBX, although it could support the extra delegation required to = support =E2=80=9Cauthorized spoofing=E2=80=9D. The companion devices = I=E2=80=99m aware of always send calls from the same service provider = and should not present any issue.=20 > =20 > Everyone will have to do work they don=E2=80=99t do now to implement = stop spoofed calls. TANSTAAFL > =20 > Brian > =20 > On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] = > wrote: > =20 > Fraud from compromised PBXes is common. And even where a PBX is not = compromised, a carrier has no practical way of knowing whether the = calling number is properly assigned and valid from the perspective of = the Enterprise. Therefore, checking whether the calling number was from = an assigned range might be possible (and fraught with administrative = challenges), but of limited value. And in the consumer market, there = are calling products which support a parent subscriber number and = =E2=80=9Ccompanion=E2=80=9D devices (e.g., tablets) which can place a = call using the MDN of the parent subscriber. These are examples of = where the authenticity of the calling number won=E2=80=99t necessarily = mean the same thing as the authenticity of a call from a single = subscriber with a single MDN regardless of =E2=80=9Claxity=E2=80=9D of = spoof checking. > =20 > In another forum and anticipating calling number authentication = mandates from Congress and/or FCC, I suggested using carrier-specific = certs and encoding specificity of authenticity, and calling number. = This provides the identity of the originating carrier, some idea as to = the accuracy or specificity of the calling number, and validty of the = calling number (assuming nonce and replay issues can be addressed as = reasonably suggested below by Alex). > =20 > The representation of orig-carrier and trustworthiness could be as = follows: > =20 > Regulated/mandated Carrier Class Use Case: > =20 > 00 - No Credentials > Use case example(s): Pre-IMS, legacy circuit-switched networks that = don't natively support SIP or which don't choose to sign calls. E.g., = international carriers. > Trust Estimate: Good luck. Carrier_orig and CgPN entirely = untrustworthy. > =20 > 01 - Carrier signed, no authentication of CgPN > Use case example(s): E911 on visited network w/o roaming agreement, = manual roaming. > Trust Estimate: Carrier_orig trustworthy, CgPN entirely untrustworthy > =20 > 10 - Carrier signed, semi-authenticated CgPN > Use case example(s): Number block delegated from OCN, but no per-TN = screen (SIP trunks). > Trust Estimate: Carrier_orig trustworthy, CgPN less than most = trustworthy but not entirely untrustworthy. > =20 > 11 - Carrier signed, authenticated CgPN > Use case example(s): Bread-and-butter 95%+ of calls from subscriber = lines (IMS-based and otherwise). > Trust Estimate: Carrier_orig trustworthy, CgPN most trustworthy > =20 > Public Use Case: > =20 > Undefined but assumed to use public or commercially available = authentication services resources. e.g., nomorobo-like crowd-sourced = accept/deny lists, et cetera. Could/would pass credentials down to = SIP-aware devices which would process them according to the rules of the = Public Class application(s). > =20 > Pierce > =20 > From: Brian Rosen [mailto:br@brianrosen.net = ]=20 > Sent: August 04, 2016 9:02 AM > To: Alex Bobotek > > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > =20 > There are reasonable circumstances where a party placing a call is not = the authorized entity assigned the telephone number used in From/PAI, = and in such circumstances the service provider servicing the entity = placing the call may or may not be the same as the service provider = serving the entity that is assigned the TN. In all such cases, the = entity that is assigned the TN explicitly authorizes calls placed using = it=E2=80=99s TN. The design accommodates such use cases. It=E2=80=99s = not a blanket authorization without authentication. We=E2=80=99re not = aware of any cases where there is an actual requirement for legitimate = calling without explicit authorization from the assigned entity, = although we certainly are aware that various parts of various service = providers don=E2=80=99t bother to check. At this point, at least in some = countries, there is a realization that the laxity of allowing unchecked = spoofing is not acceptable any more. > =20 > Brian > =20 > On Aug 3, 2016, at 8:35 AM, Alex Bobotek > wrote: > =20 > 1. Permit authorization without authentication > In the current telephony network practice, some service provider = implementations choose not to authenticate identity, but simply = facilitate the use of an arbitrary or selected user-provided identity. = Are there legitimate use cases for this? Has anyone established that = there are not? How can the industry reasonably expect to end this = (often bad) practice? If it can=E2=80=99t be ended, there=E2=80=99s = value in at least identifying the originating service provider (i.e., = the signer/authorizer). Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the abuser. = Based on the assumption that it=E2=80=99s better to ID service providers = than unreasonably expect a ban of the use of unauthenticated (and = therefore unsigned) SIP requests, STIR signing should support = authorization without authentication. The practice of authorizing = unauthenticated use exists, and there is benefit to signing in these = cases (service provider identification). The language of the ID should = permit this use. 4474bis-10 should NOT require or assume that that = authentication will precede authorization. Of course there may be other = use cases where signing includes authentication and may not include a = specific service provider=E2=80=99s authorization. > =20 > =20 > 2. Improve replay prevention > Proximate replay is possible while complying with this spec. First, = one or more proximate (e.g., within 60 seconds) SIP requests using the = same token are legal and subject to replay in many cases. An SDP = body=E2=80=99s mky may not be present and if present its use is = optional. Some sort of mandatory new or existing signed sequence, = random # or request ID (e.g., Call-ID or CSeq) and a 1-time use policy = on the receiving end of the request (e.g., tokens only good for 1 use) = could prevent replay. Different methods (e.g., INVITE vs MESSAGE) might = be handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured request. This = might include an mkey from a captured INVITE. So it may be possible to = DOS, spam or text-bomb a recipient using a captured identity. While = large-scale or distributed implementations may make the enforcement = difficult, there is little cost to signing and decoding a method and = possibly a numeric ID. Some sort of =E2=80=981-use=E2=80=99 practice = should at least be discussed while perhaps not required. =20 > =20 > =20 > Specific markup suggestions: =20 > =20 > =20 > NITS > =20 > The verifier MUST inspect any optional "ppt" parameter appearing in = the > Identity request. If no "ppt" parameter is present, then the > verifier proceeds normally below. If a "ppt" parameter value is > present, and the verifier does not support it, it MUST ignore the > Identity header. If a supported "ppt" parameter value is present, > the verifier follows the procedures below, including the variations > described in Step 5. > =20 > <>3 = . Background >=20 > [=E2=80=A6] > =20 > Per [RFC7340 ], problems such = as robocalling, voicemail hacking, and > swatting are enabled by an attacker's ability to impersonate = someone > else. The secure operation of most SIP applications and services > depends on authenticating and/or authorizing the source of = communications as it is > represented in a SIP request.=20 > =20 > This identity architecture for SIP depends on includes provisions = for a logical > "authentication service" which validates caller identity at or near = origination. outgoing requests. An > authentication service may be implemented either as part of a user > agent or as a proxy server; typically, it is a component of a = network > intermediary like a proxy to which originating user agents send > unsigned requests. Once the sender of the message has been > =20 > =20 > This document specifies a means of sharing a cryptographic = assurance > of authenticity of and/or authorization to use end-user SIP = identity in an interdomain or intradomain context. > It relies on the authentication service constructing tokens based = on [=E2=80=A6]=20 > =20 > =20 > =20 > To maximize end-to-end security, it is typically obviously > preferable for end-users to acquire their own credentials; if they > do, their user agents can act as authentication services. However, > for some deployments, [=E2=80=A6] > =20 > =20 > Regards, > =20 > Alex=20 > =20 > Alex Bobotek > =20 > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > =20 >=20 > This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. --Apple-Mail=_5345AA14-F9C7-42FD-ABFB-6955AA767DC0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I think all we need is to have credentials follow the = delegation path, plus the option to add another level (not delegation) = for authorized spoofers.

I = don=E2=80=99t think it matters who the delegator or delegatee are as = long as the delegator is willing to take the heat for delegating to = someone who sends a lot of bad calls.  They can pass the buck (=E2=80= =9CI delegated the TN to him, and now I=E2=80=99m not responsible=E2=80=9D= ), but only if the SP knows who they delegated to, so authorities can = follow the delegation path.  There are plenty of certificated = carriers who are willing to not care who they delegate to.  The = fact that there are some who do doesn=E2=80=99t change much. =  Making stir work means knowing who you are delegating to, so that = you can pass the hot potato.

It=E2=80=99s perfectly reasonable for a = carrier to be able to sign for any calls placed on its network on any = number it has been delegated.  If it does, it=E2=80=99s asserting = that the calls are from who they are supposed to be from.  That = should be straightforward, but we know it=E2=80=99s not always, and that = represents the hard part of deployment in my opinion.  But once = they delegate, they can hand responsibility to sign to the delegatee. =  But, that only works if they know who they are delegating = to.

The root = of the whole model is that there is a formal or informal delegation path = for telephone numbers in every country, and we can build a chain of = trust from that delegation path.  If you propose to alter that = model, then we get into (policy) issues of which carriers/entities we = trust and which we don=E2=80=99t.  Our model is that you know who = you delegate to, and once you do that delegation, it=E2=80=99s their = problem.  That=E2=80=99s pretty appealing I think, even if it=E2=80=99= s a change in some business practices.

The mechanism is chaining credentials = in a form of a PKI and having a way to know which TNs are covered by a = credential.  That=E2=80=99s what we have, and I=E2=80=99m loath to = change it.

Brian


On Aug 4, 2016, at 4:53 PM, = Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

OK, you talked me into indulging in one more = message on policy and use cases.
 
I agree that the = STIR/PASSporT mechanisms could be deployed on individual devices as well = as multi-device and multi-number platforms.
 
Number delegation (and = sub-delegation), and business relationships are two additional factors = which affect trustworthiness of a given calling number = authentication.
 
Inherent variable = trustworthiness of a calling number was my reason for suggesting a way = to qualify the signature to reflect that variability.
 
Originating carriers are = in a position to know if a call is coming from a device assigned a = single number, or from =E2=80=9Ctrunk group=E2=80=9D which could = originate calls using multiple numbers, and can qualify to some degree = the trustworthiness of number authenticity accordingly.
 
My suggestion was = qualifying calling number authenticity into categories of carrier-signed = (or not), and unauthenticated, semi-authenticated, and = most-authenticated.  There can be more granularity, but it implies = additional operational complexity (both for the carriers and the = consumers) and I assume diminishes value.
 
My reason for adding the = authenticity of the originating carrier is typical trustworthiness of a = carrier business relationship with typical consumers adds to the = trustworthiness assessment and partially because carriers are a = regulated point of forensic inquiry for CALEA and fraud.  = Additionally, most calls originate and terminate between mobile = consumers where their carriers are able to usefully authenticate their = device and have a high degree of confidence of the authenticity of the = calling number.
 
I think billions of = per-TN certs of varying usability (revoked, not revoked) for = authenticating calling number will not work well.
 
Conversely, I think billions of per-TN certs will work well, = if the calling party has to sign a call with a per-TN cert provided by = the called party.  No called party cert to include?  Then the = calling party does not have a trusted relationship with the called = party, and the call can be authorized/treated accordingly.  (I=E2=80=99= ve made similar, mostly ignored comments in MODERN.)
 
Pierce
 
From: Brian = Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 2:03 PM
To: Gorman, Pierce A [CTO] = <Pierce.Gorman@sprint.com>
Cc: Alex = Bobotek <alex@bobotek.net>; stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
Well, the mechanisms are designed so that = they could be deployed on devices and PBXs.  Whether they will be = is a policy issue.
 
The notion of credentials that are traceable to a = delegation of a TN is a mechanism that is part of the design of stir, = and the design allows delegation of one TN (to one device, although a = device like a PBX would have more than one TN per =E2=80=9Cdevice=E2=80=9D= , and something like a dual NAM phone could have more than one = credential.  For the use case we=E2=80=99ve discussed, a mobile = phone may also have a credential for, say, a TN that is delegated to a = landline, to cover the example case of a doctor placing a call on his = mobile, but getting his office number to show up as the calling party. =  Use of such mechanisms is policy.
 
Brian
 
On = Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> = wrote:
 
Thanks Brian.  I=E2=80=99m afraid we=E2=80=99re = straying into a policy discussion.  Regardless, I do appreciate = your explanation.  I would like to continue the discussion, but = I=E2=80=99m pretty sure this isn=E2=80=99t the right forum.
 
Pierce
 
From: Brian Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 1:34 PM
To: Gorman, Pierce A [CTO] = <Pierce.Gorman@sprint.com>
Cc: Alex = Bobotek <alex@bobotek.net>; stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
Of course I want PBXs to sign calls.  As well as smart = phones and any other devices that can be programmed to do so.
They will be given credentials that only = are valid for the TNs they are authorized to sign for.  They can = try to sign any call, but the validity of the credential would make such = a signature fail the checking.
 
Getting service providers to sign on behalf of devices is a = reasonable way to deploy quickly, but I expect many SPs will want to get = out of the liability of signing on behalf of their customers.  If = they can push of that responsibility to their customer, only being = responsible for getting the customer an appropriate credential when they = assign TNs, then I would expect them to want to do so.  That means = the devices have to be able to sign, but I understand many of the PBX = vendors think that=E2=80=99s something they could provide in a future = release.
 
Brian
 
On = Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:
 
You want IP PBXes to sign = calls?  Won=E2=80=99t that make it extraordinarily easy to commit = fraud with authenticated numbers?
 
 
From: Brian Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 12:24 PM
To: Gorman, Pierce A [CTO] = <Pierce.Gorman@sprint.com>
Cc: Alex = Bobotek <alex@bobotek.net>; stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
First = of all, we would want the PBX to generate the signature, but the service = provider can do that.  It should not add a valid signature to a = call from a number it did not assign to the trunk group connecting to = the PBX, although it could support the extra delegation required to = support =E2=80=9Cauthorized spoofing=E2=80=9D.  The companion = devices I=E2=80=99m aware of always send calls from the same service = provider and should not present any issue. 
 
Everyone will have to do work they don=E2=80=99t do now to = implement stop spoofed calls. TANSTAAFL
 
Brian
 
On Aug 4, 2016, at 12:41 PM, Gorman, = Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:
 
Fraud from compromised PBXes is common.  And = even where a PBX is not compromised, a carrier has no practical way of = knowing whether the calling number is properly assigned and valid from = the perspective of the Enterprise.  Therefore, checking whether the = calling number was from an assigned range might be possible (and fraught = with administrative challenges), but of limited value.  And in the = consumer market, there are calling products which support a parent = subscriber number and =E2=80=9Ccompanion=E2=80=9D devices (e.g., = tablets) which can place a call using the MDN of the parent = subscriber.  These are examples of where the authenticity of the = calling number won=E2=80=99t necessarily mean the same thing as the = authenticity of a call from a single subscriber with a single MDN = regardless of =E2=80=9Claxity=E2=80=9D of spoof checking.
 
In another forum and anticipating calling number = authentication mandates from Congress and/or FCC, I suggested using = carrier-specific certs and encoding specificity of authenticity, and = calling number.  This provides the identity of the originating = carrier, some idea as to the accuracy or specificity of the calling = number, and validty of the calling number (assuming nonce and replay = issues can be addressed as reasonably suggested below by = Alex).
 
The representation of orig-carrier and = trustworthiness could be as follows:
 
Regulated/mandated Carrier = Class Use Case:
 
00 - No = Credentials
Use case example(s): Pre-IMS, legacy circuit-switched = networks that don't natively support SIP or which don't choose to sign = calls.  E.g., international carriers.
Trust Estimate:  Good luck.  = Carrier_orig and CgPN entirely untrustworthy.
 
01 - Carrier signed, no = authentication of CgPN
Use case example(s): E911 on visited network w/o = roaming agreement, manual roaming.
Trust Estimate:  Carrier_orig trustworthy, = CgPN entirely untrustworthy
 
10 - Carrier signed, = semi-authenticated CgPN
Use case example(s): Number block delegated from = OCN, but no per-TN screen (SIP trunks).
Trust Estimate:  Carrier_orig trustworthy, = CgPN less than most trustworthy but not entirely = untrustworthy.
 
11= - Carrier signed, authenticated CgPN
Use case example(s): Bread-and-butter 95%+ of = calls from subscriber lines (IMS-based and otherwise).
Trust Estimate:  Carrier_orig trustworthy, = CgPN most trustworthy
 
Public Use = Case:
 
Undefined but assumed to use public or commercially available = authentication services resources.  e.g., nomorobo-like = crowd-sourced accept/deny lists, et cetera.  Could/would pass = credentials down to SIP-aware devices which would process them according = to the rules of the Public Class application(s).
 
Pierce
 
From: Brian Rosen [mailto:br@brianrosen.net] 
Sent: August 04, 2016 9:02 AM
To: Alex Bobotek <alex@bobotek.net>
Cc: stir@ietf.org
Subject: Re: [stir] STIR 4474bis-10 = comments
 
There are reasonable circumstances where a party placing a = call is not the authorized entity assigned the telephone number used in = From/PAI, and in such circumstances the service provider servicing the = entity placing the call may or may not be the same as the service = provider serving the entity that is assigned the TN.  In all such = cases, the entity that is assigned the TN explicitly authorizes calls = placed using it=E2=80=99s TN.  The design accommodates such use = cases.  It=E2=80=99s not a blanket authorization without = authentication.   We=E2=80=99re not aware of any cases where there = is an actual requirement for legitimate calling without explicit = authorization from the assigned entity, although we certainly are aware = that various parts of various service providers don=E2=80=99t bother to = check. At this point, at least in some countries, there is a realization = that the laxity of allowing unchecked spoofing is not acceptable any = more.
 
Brian
 
On Aug 3, 2016, at 8:35 AM, Alex Bobotek = <alex@bobotek.net> wrote:
 
1.       Permit authorization without authentication
In the current telephony = network practice, some service provider implementations choose not to = authenticate identity, but simply facilitate the use of an arbitrary or = selected user-provided identity.  Are there legitimate use cases = for this?  Has anyone established that there are not?  How can = the industry reasonably expect to end this (often bad) practice?  If it = can=E2=80=99t be ended, there=E2=80=99s value in at least identifying = the originating service provider (i.e., the = signer/authorizer).  Given the prevalence of abuse using telephone = numbers assigned to a sometimes-anonymous abuser, it becomes critically = important to identify the service provider(s) closest to the = abuser.  Based on the assumption that it=E2=80=99s better to ID = service providers than unreasonably expect a ban of the use of = unauthenticated (and therefore unsigned) SIP requests, STIR signing = should support authorization without authentication.  The practice = of authorizing unauthenticated use exists, and there is benefit to = signing in these cases (service provider identification).  The = language of the ID should permit this use.  4474bis-10 should NOT = require or assume that  that authentication will precede = authorization. Of course there may be other use cases where signing = includes authentication and may not include a specific service = provider=E2=80=99s authorization.
 
 
2.       Improve replay prevention
Proximate replay is = possible while complying = with this = spec.  First, one or more proximate (e.g., within 60 seconds) SIP = requests using the same token are legal and subject to replay in many = cases.  An SDP body=E2=80=99s mky may not be present and if present = its use is optional.  Some sort of mandatory new or existing signed = sequence, random # or request ID (e.g., Call-ID or CSeq) and a 1-time = use policy on the receiving end of the request (e.g., tokens only good for 1 use) could prevent = replay.  Different methods (e.g., INVITE vs MESSAGE) might be = handled by different receiving infrastructure, and therefore = difficulties with =E2=80=98it=E2=80=99s been used already=E2=80=99 = coordination allow a faked MESSAGE based on a captured = request. This might include an mkey from a captured = INVITE.   So it may be possible to DOS, spam or text-bomb a = recipient using a captured identity.  While large-scale or = distributed implementations may make the enforcement difficult, there is = little cost to signing and decoding a method and possibly a numeric = ID.   Some = sort of =E2=80=981-use=E2=80=99 practice should at least be discussed = while perhaps not required.  
 
 
Specific markup = suggestions:  
 
 
NITS
 
   The verifier MUST inspect any optional "ppt" =
parameter appearing in =
the
   Identity request.  If no "ppt" parameter is =
present, then the
   verifier proceeds normally below.  If a =
"ppt" parameter value is
   present, and the verifier does not support it, =
it MUST ignore the
   Identity header.  If a supported "ppt" =
parameter value is present,
   the verifier follows the =
procedures below, including the variations
   described in Step 5.
 

3.  = Background

[=E2=80=A6]
 
   Per [RFC7340], =
problems such as robocalling, voicemail hacking, and
   =
swatting are enabled by an attacker's ability to impersonate someone
   =
else.  The secure operation of most SIP applications and =
services
   depends on authenticating and/or authorizing the source of =
communications as it is
   represented in a SIP request.
 
   This identity architecture for SIP depends on includes =
provisions for a logical
   "authentication service" which =
validates caller identity at or =
near origination.  outgoing =
requests.  An
   authentication service may be implemented either =
as part of a user
   agent or as a proxy server; typically, it is a =
component of a network
   intermediary like a proxy to which originating =
user agents send
   unsigned requests.  Once the sender of the =
message has been
 
 
   This document specifies a means of sharing a =
cryptographic assurance
   of authenticity of and/or authorization to use end-user =
SIP identity in an interdomain or intradomain context.
   It =
relies on the authentication service constructing tokens based on [=E2=80=A6=
]
 
 
 
   To maximize end-to-end security, it is typically obviously
   preferable for end-users to acquire their own =
credentials; if they
   do, their user agents can act as authentication =
services.  However,
   for some deployments, [=E2=80=A6]
 
 
Regards,
 
Alex 
 
Alex = Bobotek
 
 
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
 

This e-mail may = contain Sprint proprietary information intended for the sole use of the = recipient(s). Any use by others is prohibited. If you are not the = intended recipient, please contact the sender and delete all copies of = the = message.

= --Apple-Mail=_5345AA14-F9C7-42FD-ABFB-6955AA767DC0-- From nobody Thu Aug 4 14:37:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3795012D83F for ; Thu, 4 Aug 2016 14:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1hBvozbRdEgu for ; Thu, 4 Aug 2016 14:37:18 -0700 (PDT) Received: from resqmta-ch2-04v.sys.comcast.net (resqmta-ch2-04v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A736512D7FC for ; Thu, 4 Aug 2016 14:37:18 -0700 (PDT) Received: from resomta-ch2-04v.sys.comcast.net ([69.252.207.100]) by resqmta-ch2-04v.sys.comcast.net with SMTP id VQJEbhwOE8PeaVQKMbHF9P; Thu, 04 Aug 2016 21:37:18 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VQKLb5e5HX5ezVQKLbJGLU; Thu, 04 Aug 2016 21:37:17 +0000 To: stir@ietf.org References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> From: Paul Kyzivat Message-ID: <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> Date: Thu, 4 Aug 2016 17:37:16 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfKW06l8n1pjCYgCx7CNk5ESltbbbbHGC1gWnp69ZWEKQq61mU4zCCr1CIIBGz506eRReKpgLVdGSkS33Iq6MgAUrDB37upyjSkkKuV0j+RmhrbmHtg/w mP0G/xd/metymRCILm50V6RPh5SCBSSII3Ajq4mYj7hsFHiFXTdwKLeZ2698Z29S58+xyJonakaDgA== Archived-At: Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 21:37:21 -0000 +1, but with one question below: On 8/4/16 5:14 PM, Brian Rosen wrote: > I think all we need is to have credentials follow the delegation path, > plus the option to add another level (not delegation) for authorized > spoofers. I don't understand "authorized spoofers" in this context, as contrasted to "spoofers" who have been delegated their authority. Thanks, Paul > I dont think it matters who the delegator or delegatee are as long as > the delegator is willing to take the heat for delegating to someone who > sends a lot of bad calls. They can pass the buck (I delegated the TN > to him, and now Im not responsible), but only if the SP knows who they > delegated to, so authorities can follow the delegation path. There are > plenty of certificated carriers who are willing to not care who they > delegate to. The fact that there are some who do doesnt change much. > Making stir work means knowing who you are delegating to, so that you > can pass the hot potato. > > Its perfectly reasonable for a carrier to be able to sign for any calls > placed on its network on any number it has been delegated. If it does, > its asserting that the calls are from who they are supposed to be from. > That should be straightforward, but we know its not always, and that > represents the hard part of deployment in my opinion. But once they > delegate, they can hand responsibility to sign to the delegatee. But, > that only works if they know who they are delegating to. > > The root of the whole model is that there is a formal or informal > delegation path for telephone numbers in every country, and we can build > a chain of trust from that delegation path. If you propose to alter > that model, then we get into (policy) issues of which carriers/entities > we trust and which we dont. Our model is that you know who you > delegate to, and once you do that delegation, its their problem. > Thats pretty appealing I think, even if its a change in some business > practices. > > The mechanism is chaining credentials in a form of a PKI and having a > way to know which TNs are covered by a credential. Thats what we have, > and Im loath to change it. > > Brian > > >> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >> > wrote: >> >> OK, you talked me into indulging in one more message on policy and use >> cases. >> >> I agree that the STIR/PASSporT mechanisms could be deployed on >> individual devices as well as multi-device and multi-number platforms. >> >> Number delegation (and sub-delegation), and business relationships are >> two additional factors which affect trustworthiness of a given calling >> number authentication. >> >> Inherent variable trustworthiness of a calling number was my reason >> for suggesting a way to qualify the signature to reflect that variability. >> >> Originating carriers are in a position to know if a call is coming >> from a device assigned a single number, or from trunk group which >> could originate calls using multiple numbers, and can qualify to some >> degree the trustworthiness of number authenticity accordingly. >> >> My suggestion was qualifying calling number authenticity into >> categories of carrier-signed (or not), and unauthenticated, >> semi-authenticated, and most-authenticated. There can be more >> granularity, but it implies additional operational complexity (both >> for the carriers and the consumers) and I assume diminishes value. >> >> My reason for adding the authenticity of the originating carrier is >> typical trustworthiness of a carrier business relationship with >> typical consumers adds to the trustworthiness assessment and partially >> because carriers are a regulated point of forensic inquiry for CALEA >> and fraud. Additionally, most calls originate and terminate between >> mobile consumers where their carriers are able to usefully >> authenticate their device and have a high degree of confidence of the >> authenticity of the calling number. >> >> I think billions of per-TN certs of varying usability (revoked, not >> revoked) for authenticating calling number will not work well. >> >> Conversely, I think billions of per-TN certs will work well, if the >> calling party has to sign a call with a per-TN cert provided by the >> called party. No called party cert to include? Then the calling >> party does not have a trusted relationship with the called party, and >> the call can be authorized/treated accordingly. (Ive made similar, >> mostly ignored comments in MODERN.) >> >> Pierce >> >> *From:* Brian Rosen [mailto:br@brianrosen.net] >> *Sent:* August 04, 2016 2:03 PM >> *To:* Gorman, Pierce A [CTO] > > >> *Cc:* Alex Bobotek >; >> stir@ietf.org >> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >> Well, the mechanisms are designed so that they could be deployed on >> devices and PBXs. Whether they will be is a policy issue. >> >> The notion of credentials that are traceable to a delegation of a TN >> is a mechanism that is part of the design of stir, and the design >> allows delegation of one TN (to one device, although a device like a >> PBX would have more than one TN per device, and something like a >> dual NAM phone could have more than one credential. For the use case >> weve discussed, a mobile phone may also have a credential for, say, a >> TN that is delegated to a landline, to cover the example case of a >> doctor placing a call on his mobile, but getting his office number to >> show up as the calling party. Use of such mechanisms is policy. >> >> Brian >> >> >> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >> > wrote: >> >> Thanks Brian. Im afraid were straying into a policy >> discussion. Regardless, I do appreciate your explanation. I >> would like to continue the discussion, but Im pretty sure this >> isnt the right forum. >> >> Pierce >> >> *From:* Brian Rosen [mailto:br@brianrosen.net] >> *Sent:* August 04, 2016 1:34 PM >> *To:* Gorman, Pierce A [CTO] > > >> *Cc:* Alex Bobotek > >; stir@ietf.org >> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >> Of course I want PBXs to sign calls. As well as smart phones and >> any other devices that can be programmed to do so. >> They will be given credentials that only are valid for the TNs >> they are authorized to sign for. They can try to sign any call, >> but the validity of the credential would make such a signature >> fail the checking. >> >> Getting service providers to sign on behalf of devices is a >> reasonable way to deploy quickly, but I expect many SPs will want >> to get out of the liability of signing on behalf of their >> customers. If they can push of that responsibility to their >> customer, only being responsible for getting the customer an >> appropriate credential when they assign TNs, then I would expect >> them to want to do so. That means the devices have to be able to >> sign, but I understand many of the PBX vendors think thats >> something they could provide in a future release. >> >> Brian >> >> >> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >> > >> wrote: >> >> You want IP PBXes to sign calls? Wont that make it >> extraordinarily easy to commit fraud with authenticated numbers? >> >> >> *From:* Brian Rosen [mailto:br@brianrosen.net] >> *Sent:* August 04, 2016 12:24 PM >> *To:* Gorman, Pierce A [CTO] > > >> *Cc:* Alex Bobotek > >; stir@ietf.org >> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >> First of all, we would want the PBX to generate the signature, >> but the service provider can do that. It should not add a >> valid signature to a call from a number it did not assign to >> the trunk group connecting to the PBX, although it could >> support the extra delegation required to support authorized >> spoofing. The companion devices Im aware of always send >> calls from the same service provider and should not present >> any issue. >> >> Everyone will have to do work they dont do now to implement >> stop spoofed calls. TANSTAAFL >> >> Brian >> >> >> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >> > > wrote: >> >> Fraud from compromised PBXes is common. And even where a >> PBX is not compromised, a carrier has no practical way of >> knowing whether the calling number is properly assigned >> and valid from the perspective of the Enterprise. >> Therefore, checking whether the calling number was from an >> assigned range might be possible (and fraught with >> administrative challenges), but of limited value. And in >> the consumer market, there are calling products which >> support a parent subscriber number and companion devices >> (e.g., tablets) which can place a call using the MDN of >> the parent subscriber. These are examples of where the >> authenticity of the calling number wont necessarily mean >> the same thing as the authenticity of a call from a single >> subscriber with a single MDN regardless of laxity of >> spoof checking. >> >> In another forum and anticipating calling number >> authentication mandates from Congress and/or FCC, I >> suggested using carrier-specific certs and encoding >> specificity of authenticity, and calling number. This >> provides the identity of the originating carrier, some >> idea as to the accuracy or specificity of the calling >> number, and validty of the calling number (assuming nonce >> and replay issues can be addressed as reasonably suggested >> below by Alex). >> >> The representation of orig-carrier and trustworthiness >> could be as follows: >> >> *Regulated/mandated Carrier Class Use Case:* >> >> *00 - No Credentials* >> Use case example(s): Pre-IMS, legacy circuit-switched >> networks that don't natively support SIP or which don't >> choose to sign calls. E.g., international carriers. >> Trust Estimate: Good luck. Carrier_orig and CgPN >> entirely untrustworthy. >> >> *01 - Carrier signed, no authentication of CgPN* >> Use case example(s): E911 on visited network w/o roaming >> agreement, manual roaming. >> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >> untrustworthy >> >> *10 - Carrier signed, semi-authenticated CgPN* >> Use case example(s): Number block delegated from OCN, but >> no per-TN screen (SIP trunks). >> Trust Estimate: Carrier_orig trustworthy, CgPN less than >> most trustworthy but not entirely untrustworthy. >> >> *11 - Carrier signed, authenticated CgPN* >> Use case example(s): Bread-and-butter 95%+ of calls from >> subscriber lines (IMS-based and otherwise). >> Trust Estimate: Carrier_orig trustworthy, CgPN most >> trustworthy >> >> *Public Use Case:* >> >> Undefined but assumed to use public or commercially >> available authentication services resources. e.g., >> nomorobo-like crowd-sourced accept/deny lists, et cetera. >> Could/would pass credentials down to SIP-aware devices >> which would process them according to the rules of the >> Public Class application(s). >> >> Pierce >> >> *From:* Brian Rosen [mailto:br@brianrosen.net] >> *Sent:* August 04, 2016 9:02 AM >> *To:* Alex Bobotek > > >> *Cc:* stir@ietf.org >> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >> There are reasonable circumstances where a party placing a >> call is not the authorized entity assigned the telephone >> number used in From/PAI, and in such circumstances the >> service provider servicing the entity placing the call may >> or may not be the same as the service provider serving the >> entity that is assigned the TN. In all such cases, the >> entity that is assigned the TN explicitly authorizes calls >> placed using its TN. The design accommodates such use >> cases. Its not a blanket authorization without >> authentication. Were not aware of any cases where there >> is an actual requirement for legitimate calling without >> explicit authorization from the assigned entity, although >> we certainly are aware that various parts of various >> service providers dont bother to check. At this point, at >> least in some countries, there is a realization that the >> laxity of allowing unchecked spoofing is not acceptable >> any more. >> >> Brian >> >> >> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >> > wrote: >> >> 1. Permit authorization without authentication >> In the current telephony network practice, some >> service provider implementations choose not to >> authenticate identity, but simply facilitate the use >> of an arbitrary or selected user-provided identity. >> Are there legitimate use cases for this? Has anyone >> established that there are not? How can the industry >> reasonably expect to end this (often bad) practice? >> If it cant be ended, theres value in at least >> identifying the originating service provider >> (i.e., the signer/authorizer). Given the prevalence >> of abuse using telephone numbers assigned to a >> sometimes-anonymous abuser, it becomes critically >> important to identify the service provider(s) closest >> to the abuser. Based on the assumption that its >> better to ID service providers than unreasonably >> expect a ban of the use of unauthenticated (and >> therefore unsigned) SIP requests, STIR signing should >> support authorization without authentication. The >> practice of authorizing unauthenticated use exists, >> and there is benefit to signing in these cases >> (service provider identification). The language of >> the ID should permit this use. 4474bis-10 should NOT >> require or assume that that authentication will >> precede authorization. Of course there may be other >> use cases where signing includes authentication and >> may not include a specific service providers >> authorization. >> >> >> 2. Improve replay prevention >> Proximate replay is possible while complying with this >> spec. First, one or more proximate (e.g., within 60 >> seconds) SIP requests using the same token are legal >> and subject to replay in many cases. An SDP bodys >> mky may not be present and if present its use is >> optional. Some sort of mandatory new or existing >> signed sequence, random # or request ID (e.g., Call-ID >> or CSeq) and a 1-time use policy on the receiving end >> of the request (e.g., tokens only good for 1 >> use) could prevent replay. Different methods (e.g., >> INVITE vs MESSAGE) might be handled by different >> receiving infrastructure, and therefore difficulties >> with its been used already coordination allow a >> faked MESSAGE based on a captured request. This might >> include an mkey from a captured INVITE. So it may be >> possible to DOS, spam or text-bomb a recipient using a >> captured identity. While large-scale or distributed >> implementations may make the enforcement difficult, >> there is little cost to signing and decoding a method >> and possibly a numeric ID. Some sort of 1-use >> practice should at least be discussed while perhaps >> not required. >> >> >> Specific markup suggestions: >> >> >> NITS >> >> >> The verifier MUST inspect any optional "ppt" parameter appearing *in*the >> >> Identity request. If no "ppt" parameter is present, then the >> >> verifier proceeds normally below. If a "ppt" parameter value is >> >> present, and the verifier does not support it, it MUST ignore the >> >> Identity header. If a supported "ppt" parameter value is present, >> >> the verifier follows the procedures below, including the variations >> >> described in Step 5. >> >> >> >> >> 3 >> . >> Background >> >> [] >> >> >> >> Per [RFC7340 ], problems such as robocalling, voicemail hacking, and >> >> swatting are enabled by an attacker's ability to impersonate someone >> >> else. The secure operation of most SIP applications and services >> >> depends on authenticating and/or authorizing the source of communications as it is >> >> represented in a SIP request. >> >> >> >> This identity architecture for SIP depends on includes provisions for a logical >> >> "authentication service" which validates caller identity at or near origination. outgoing >> requests. An >> >> authentication service may be implemented either as part of a user >> >> agent or as a proxy server; typically, it is a component of a network >> >> intermediary like a proxy to which originating user agents send >> >> unsigned requests. Once the sender of the message has been >> >> >> >> >> This document specifies a means of sharing a cryptographic assurance >> >> of authenticity of and/or authorization to use end-user SIP identity in an interdomain or intradomain context. >> >> It relies on the authentication service constructing tokens based on [] >> >> >> >> >> >> To maximize end-to-end security, it is typically obviously >> >> preferable for end-users to acquire their own credentials; if they >> >> do, their user agents can act as authentication services. However, >> >> for some deployments, [] >> >> >> >> Regards, >> >> Alex >> * * >> *Alex Bobotek* >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> >> >> ------------------------------------------------------------------------ >> >> This e-mail may contain Sprint proprietary information >> intended for the sole use of the recipient(s). Any use by >> others is prohibited. If you are not the intended >> recipient, please contact the sender and delete all copies >> of the message. > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Thu Aug 4 14:43:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B08EF12D855 for ; Thu, 4 Aug 2016 14:43:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xCunNgkTdgH4 for ; Thu, 4 Aug 2016 14:43:21 -0700 (PDT) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E16312D7F6 for ; Thu, 4 Aug 2016 14:43:19 -0700 (PDT) Received: by mail-qk0-x232.google.com with SMTP id p74so246500227qka.0 for ; Thu, 04 Aug 2016 14:43:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=TJilFac+PCY+Jhf2lIQsU+lxa3beC7idUhjpeJJqhcs=; b=B+ugXM9ToM6nV76ldY3EeDD1AISvKUx51drSinGNE2ZM+0P0FEYXfD6Jk3nhgKX6C/ 37pZvkfgcursZL35UFVQe8EjzvmQH5kcqTSGvISzMGB09GnEliKi2UmYuwEaXEAroECe prsKkOjXu0FdFdE+px97ScwwUTUAQpZX3AWtr7h3OtybQ/JBnEKoQItimnTjWlNkNbSn uQmH5DZ3fgSeb72BwckgvBkw1I2RttOYONl13cSWCj7I2Sr5kQK0wSVrbYZApvBMng1x ollnX9OYzimexjRwCLLj5z+fclQWdCNbnDOPHx9BH89qqdVbpQVBFaAXsZRO56EufScd NlFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=TJilFac+PCY+Jhf2lIQsU+lxa3beC7idUhjpeJJqhcs=; b=Dyk/8eHLOOffszcw+l3I7/Eyqzje8xtbBidhvDA4dlhSckavDU9ICBrLgFisNTm1jv 7GvJDRGBBk/JNHNiqgIODqZtor3NP6T7SxYaKpdCxM4YYrGnstAvm4cKJDlW0+ykEWug lav0NIaXm2f8ei1ilmdDHYbAcYTrU/R651Y4U67U6vXcQia00p2aVjx/tBUFGsDeo+Sn ekzoLNOprrZiS4TJFJdiTJoM/b8mOhdDifjphX++81TMJoTnP+T4iknDfFe0D3TfUu40 iMHDhZ9U+ZWr1xiiCWzyBpWG81TCDHLkdliRx7Sudc/4e8m9DGotj2Xz9iF+Ro80kW8K rz/g== X-Gm-Message-State: AEkoouucjU8EzI/m089FnVMRYictg/E2qmBHQZiYVjHMpmczkkuhXz9GJjikp2aXow4xeQ== X-Received: by 10.55.207.87 with SMTP id e84mr9855108qkj.266.1470346998286; Thu, 04 Aug 2016 14:43:18 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id j62sm7983053qtd.37.2016.08.04.14.43.16 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 14:43:16 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_4C324DD4-35A1-49A2-AF82-170AC95022D5" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> Date: Thu, 4 Aug 2016 17:43:15 -0400 Message-Id: <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> To: Paul Kyzivat X-Mailer: Apple Mail (2.3124) Archived-At: Cc: stir@ietf.org Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 21:43:26 -0000 --Apple-Mail=_4C324DD4-35A1-49A2-AF82-170AC95022D5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 In my jargon an =93authorized spoofer=94 is the doctor who is calling = from his mobile, but sending the TN of his office phone as calling = party. The delegation to his office phone was made by his landline = carrier to him. He then creates another credential, which he signs with = his office phone credential that authorizes his mobile to send calls = from his office number. He is spoofing (because the call is coming from = his mobile=92s TN but claims to be from his office), but it=92s = authorized spoofing. The doc could give the credential to his mobile SP = if they sign on his behalf. Some folks don=92t like attaching the =93spoofing=94 label to a = legitimate use. But that=92s how I describe it. Brian > On Aug 4, 2016, at 5:37 PM, Paul Kyzivat = wrote: >=20 > +1, but with one question below: >=20 > On 8/4/16 5:14 PM, Brian Rosen wrote: >> I think all we need is to have credentials follow the delegation = path, >=20 >> plus the option to add another level (not delegation) for authorized >> spoofers. >=20 > I don't understand "authorized spoofers" in this context, as = contrasted to "spoofers" who have been delegated their authority. >=20 > Thanks, > Paul >=20 >> I don=92t think it matters who the delegator or delegatee are as long = as >> the delegator is willing to take the heat for delegating to someone = who >> sends a lot of bad calls. They can pass the buck (=93I delegated the = TN >> to him, and now I=92m not responsible=94), but only if the SP knows = who they >> delegated to, so authorities can follow the delegation path. There = are >> plenty of certificated carriers who are willing to not care who they >> delegate to. The fact that there are some who do doesn=92t change = much. >> Making stir work means knowing who you are delegating to, so that you >> can pass the hot potato. >>=20 >> It=92s perfectly reasonable for a carrier to be able to sign for any = calls >> placed on its network on any number it has been delegated. If it = does, >> it=92s asserting that the calls are from who they are supposed to be = from. >> That should be straightforward, but we know it=92s not always, and = that >> represents the hard part of deployment in my opinion. But once they >> delegate, they can hand responsibility to sign to the delegatee. = But, >> that only works if they know who they are delegating to. >>=20 >> The root of the whole model is that there is a formal or informal >> delegation path for telephone numbers in every country, and we can = build >> a chain of trust from that delegation path. If you propose to alter >> that model, then we get into (policy) issues of which = carriers/entities >> we trust and which we don=92t. Our model is that you know who you >> delegate to, and once you do that delegation, it=92s their problem. >> That=92s pretty appealing I think, even if it=92s a change in some = business >> practices. >>=20 >> The mechanism is chaining credentials in a form of a PKI and having a >> way to know which TNs are covered by a credential. That=92s what we = have, >> and I=92m loath to change it. >>=20 >> Brian >>=20 >>=20 >>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>> = >> = wrote: >>>=20 >>> OK, you talked me into indulging in one more message on policy and = use >>> cases. >>>=20 >>> I agree that the STIR/PASSporT mechanisms could be deployed on >>> individual devices as well as multi-device and multi-number = platforms. >>>=20 >>> Number delegation (and sub-delegation), and business relationships = are >>> two additional factors which affect trustworthiness of a given = calling >>> number authentication. >>>=20 >>> Inherent variable trustworthiness of a calling number was my reason >>> for suggesting a way to qualify the signature to reflect that = variability. >>>=20 >>> Originating carriers are in a position to know if a call is coming >>> from a device assigned a single number, or from =93trunk group=94 = which >>> could originate calls using multiple numbers, and can qualify to = some >>> degree the trustworthiness of number authenticity accordingly. >>>=20 >>> My suggestion was qualifying calling number authenticity into >>> categories of carrier-signed (or not), and unauthenticated, >>> semi-authenticated, and most-authenticated. There can be more >>> granularity, but it implies additional operational complexity (both >>> for the carriers and the consumers) and I assume diminishes value. >>>=20 >>> My reason for adding the authenticity of the originating carrier is >>> typical trustworthiness of a carrier business relationship with >>> typical consumers adds to the trustworthiness assessment and = partially >>> because carriers are a regulated point of forensic inquiry for CALEA >>> and fraud. Additionally, most calls originate and terminate between >>> mobile consumers where their carriers are able to usefully >>> authenticate their device and have a high degree of confidence of = the >>> authenticity of the calling number. >>>=20 >>> I think billions of per-TN certs of varying usability (revoked, not >>> revoked) for authenticating calling number will not work well. >>>=20 >>> Conversely, I think billions of per-TN certs will work well, if the >>> calling party has to sign a call with a per-TN cert provided by the >>> called party. No called party cert to include? Then the calling >>> party does not have a trusted relationship with the called party, = and >>> the call can be authorized/treated accordingly. (I=92ve made = similar, >>> mostly ignored comments in MODERN.) >>>=20 >>> Pierce >>>=20 >>> *From:* Brian Rosen [mailto:br@brianrosen.net = ] >>> *Sent:* August 04, 2016 2:03 PM >>> *To:* Gorman, Pierce A [CTO] >>> >> >>> *Cc:* Alex Bobotek = >>; >>> stir@ietf.org > >>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>=20 >>> Well, the mechanisms are designed so that they could be deployed on >>> devices and PBXs. Whether they will be is a policy issue. >>>=20 >>> The notion of credentials that are traceable to a delegation of a TN >>> is a mechanism that is part of the design of stir, and the design >>> allows delegation of one TN (to one device, although a device like a >>> PBX would have more than one TN per =93device=94, and something like = a >>> dual NAM phone could have more than one credential. For the use = case >>> we=92ve discussed, a mobile phone may also have a credential for, = say, a >>> TN that is delegated to a landline, to cover the example case of a >>> doctor placing a call on his mobile, but getting his office number = to >>> show up as the calling party. Use of such mechanisms is policy. >>>=20 >>> Brian >>>=20 >>>=20 >>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>> = >> = wrote: >>>=20 >>> Thanks Brian. I=92m afraid we=92re straying into a policy >>> discussion. Regardless, I do appreciate your explanation. I >>> would like to continue the discussion, but I=92m pretty sure this >>> isn=92t the right forum. >>>=20 >>> Pierce >>>=20 >>> *From:* Brian Rosen [mailto:br@brianrosen.net = ] >>> *Sent:* August 04, 2016 1:34 PM >>> *To:* Gorman, Pierce A [CTO] >>> >> >>> *Cc:* Alex Bobotek >>> >>; = stir@ietf.org > >>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>=20 >>> Of course I want PBXs to sign calls. As well as smart phones and >>> any other devices that can be programmed to do so. >>> They will be given credentials that only are valid for the TNs >>> they are authorized to sign for. They can try to sign any call, >>> but the validity of the credential would make such a signature >>> fail the checking. >>>=20 >>> Getting service providers to sign on behalf of devices is a >>> reasonable way to deploy quickly, but I expect many SPs will want >>> to get out of the liability of signing on behalf of their >>> customers. If they can push of that responsibility to their >>> customer, only being responsible for getting the customer an >>> appropriate credential when they assign TNs, then I would expect >>> them to want to do so. That means the devices have to be able to >>> sign, but I understand many of the PBX vendors think that=92s >>> something they could provide in a future release. >>>=20 >>> Brian >>>=20 >>>=20 >>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>> = >> >>> wrote: >>>=20 >>> You want IP PBXes to sign calls? Won=92t that make it >>> extraordinarily easy to commit fraud with authenticated = numbers? >>>=20 >>>=20 >>> *From:* Brian Rosen [mailto:br@brianrosen.net = ] >>> *Sent:* August 04, 2016 12:24 PM >>> *To:* Gorman, Pierce A [CTO] >>> >> >>> *Cc:* Alex Bobotek >>> >>; = stir@ietf.org > >>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>=20 >>> First of all, we would want the PBX to generate the = signature, >>> but the service provider can do that. It should not add a >>> valid signature to a call from a number it did not assign to >>> the trunk group connecting to the PBX, although it could >>> support the extra delegation required to support =93authorized >>> spoofing=94. The companion devices I=92m aware of always = send >>> calls from the same service provider and should not present >>> any issue. >>>=20 >>> Everyone will have to do work they don=92t do now to = implement >>> stop spoofed calls. TANSTAAFL >>>=20 >>> Brian >>>=20 >>>=20 >>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>> >>> >> wrote: >>>=20 >>> Fraud from compromised PBXes is common. And even where a >>> PBX is not compromised, a carrier has no practical way of >>> knowing whether the calling number is properly assigned >>> and valid from the perspective of the Enterprise. >>> Therefore, checking whether the calling number was from = an >>> assigned range might be possible (and fraught with >>> administrative challenges), but of limited value. And in >>> the consumer market, there are calling products which >>> support a parent subscriber number and =93companion=94 = devices >>> (e.g., tablets) which can place a call using the MDN of >>> the parent subscriber. These are examples of where the >>> authenticity of the calling number won=92t necessarily = mean >>> the same thing as the authenticity of a call from a = single >>> subscriber with a single MDN regardless of =93laxity=94 = of >>> spoof checking. >>>=20 >>> In another forum and anticipating calling number >>> authentication mandates from Congress and/or FCC, I >>> suggested using carrier-specific certs and encoding >>> specificity of authenticity, and calling number. This >>> provides the identity of the originating carrier, some >>> idea as to the accuracy or specificity of the calling >>> number, and validty of the calling number (assuming nonce >>> and replay issues can be addressed as reasonably = suggested >>> below by Alex). >>>=20 >>> The representation of orig-carrier and trustworthiness >>> could be as follows: >>>=20 >>> *Regulated/mandated Carrier Class Use Case:* >>>=20 >>> *00 - No Credentials* >>> Use case example(s): Pre-IMS, legacy circuit-switched >>> networks that don't natively support SIP or which don't >>> choose to sign calls. E.g., international carriers. >>> Trust Estimate: Good luck. Carrier_orig and CgPN >>> entirely untrustworthy. >>>=20 >>> *01 - Carrier signed, no authentication of CgPN* >>> Use case example(s): E911 on visited network w/o roaming >>> agreement, manual roaming. >>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>> untrustworthy >>>=20 >>> *10 - Carrier signed, semi-authenticated CgPN* >>> Use case example(s): Number block delegated from OCN, but >>> no per-TN screen (SIP trunks). >>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>> most trustworthy but not entirely untrustworthy. >>>=20 >>> *11 - Carrier signed, authenticated CgPN* >>> Use case example(s): Bread-and-butter 95%+ of calls from >>> subscriber lines (IMS-based and otherwise). >>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>> trustworthy >>>=20 >>> *Public Use Case:* >>>=20 >>> Undefined but assumed to use public or commercially >>> available authentication services resources. e.g., >>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>> Could/would pass credentials down to SIP-aware devices >>> which would process them according to the rules of the >>> Public Class application(s). >>>=20 >>> Pierce >>>=20 >>> *From:* Brian Rosen [mailto:br@brianrosen.net = ] >>> *Sent:* August 04, 2016 9:02 AM >>> *To:* Alex Bobotek >>> >> >>> *Cc:* stir@ietf.org = > >>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>=20 >>> There are reasonable circumstances where a party placing = a >>> call is not the authorized entity assigned the telephone >>> number used in From/PAI, and in such circumstances the >>> service provider servicing the entity placing the call = may >>> or may not be the same as the service provider serving = the >>> entity that is assigned the TN. In all such cases, the >>> entity that is assigned the TN explicitly authorizes = calls >>> placed using it=92s TN. The design accommodates such use >>> cases. It=92s not a blanket authorization without >>> authentication. We=92re not aware of any cases where = there >>> is an actual requirement for legitimate calling without >>> explicit authorization from the assigned entity, although >>> we certainly are aware that various parts of various >>> service providers don=92t bother to check. At this point, = at >>> least in some countries, there is a realization that the >>> laxity of allowing unchecked spoofing is not acceptable >>> any more. >>>=20 >>> Brian >>>=20 >>>=20 >>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>> = >> wrote: >>>=20 >>> 1. Permit authorization without authentication >>> In the current telephony network practice, some >>> service provider implementations choose not to >>> authenticate identity, but simply facilitate the use >>> of an arbitrary or selected user-provided identity. >>> Are there legitimate use cases for this? Has anyone >>> established that there are not? How can the industry >>> reasonably expect to end this (often bad) practice? >>> If it can=92t be ended, there=92s value in at least >>> identifying the originating service provider >>> (i.e., the signer/authorizer). Given the prevalence >>> of abuse using telephone numbers assigned to a >>> sometimes-anonymous abuser, it becomes critically >>> important to identify the service provider(s) closest >>> to the abuser. Based on the assumption that it=92s >>> better to ID service providers than unreasonably >>> expect a ban of the use of unauthenticated (and >>> therefore unsigned) SIP requests, STIR signing should >>> support authorization without authentication. The >>> practice of authorizing unauthenticated use exists, >>> and there is benefit to signing in these cases >>> (service provider identification). The language of >>> the ID should permit this use. 4474bis-10 should NOT >>> require or assume that that authentication will >>> precede authorization. Of course there may be other >>> use cases where signing includes authentication and >>> may not include a specific service provider=92s >>> authorization. >>>=20 >>>=20 >>> 2. Improve replay prevention >>> Proximate replay is possible while complying with = this >>> spec. First, one or more proximate (e.g., within 60 >>> seconds) SIP requests using the same token are legal >>> and subject to replay in many cases. An SDP body=92s >>> mky may not be present and if present its use is >>> optional. Some sort of mandatory new or existing >>> signed sequence, random # or request ID (e.g., = Call-ID >>> or CSeq) and a 1-time use policy on the receiving end >>> of the request (e.g., tokens only good for 1 >>> use) could prevent replay. Different methods (e.g., >>> INVITE vs MESSAGE) might be handled by different >>> receiving infrastructure, and therefore difficulties >>> with =91it=92s been used already=92 coordination = allow a >>> faked MESSAGE based on a captured request. This might >>> include an mkey from a captured INVITE. So it may = be >>> possible to DOS, spam or text-bomb a recipient using = a >>> captured identity. While large-scale or distributed >>> implementations may make the enforcement difficult, >>> there is little cost to signing and decoding a method >>> and possibly a numeric ID. Some sort of =911-use=92 >>> practice should at least be discussed while perhaps >>> not required. >>>=20 >>>=20 >>> Specific markup suggestions: >>>=20 >>>=20 >>> NITS >>>=20 >>>=20 >>> The verifier MUST inspect any optional "ppt" = parameter appearing *in*the >>>=20 >>> Identity request. If no "ppt" parameter is = present, then the >>>=20 >>> verifier proceeds normally below. If a "ppt" = parameter value is >>>=20 >>> present, and the verifier does not support it, it = MUST ignore the >>>=20 >>> Identity header. If a supported "ppt" parameter = value is present, >>>=20 >>> the verifier follows the procedures below, = including the variations >>>=20 >>> described in Step 5. >>>=20 >>>=20 >>>=20 >>>=20 >>> 3 >>> = >. >>> Background >>>=20 >>> [=85] >>>=20 >>>=20 >>>=20 >>> Per [RFC7340 >], problems such as robocalling, = voicemail hacking, and >>>=20 >>> swatting are enabled by an attacker's ability to = impersonate someone >>>=20 >>> else. The secure operation of most SIP = applications and services >>>=20 >>> depends on authenticating and/or authorizing the = source of communications as it is >>>=20 >>> represented in a SIP request. >>>=20 >>>=20 >>>=20 >>> This identity architecture for SIP depends on = includes provisions for a logical >>>=20 >>> "authentication service" which validates caller = identity at or near origination. outgoing >>> requests. An >>>=20 >>> authentication service may be implemented either = as part of a user >>>=20 >>> agent or as a proxy server; typically, it is a = component of a network >>>=20 >>> intermediary like a proxy to which originating = user agents send >>>=20 >>> unsigned requests. Once the sender of the message = has been >>>=20 >>>=20 >>>=20 >>>=20 >>> This document specifies a means of sharing a = cryptographic assurance >>>=20 >>> of authenticity of and/or authorization to use = end-user SIP identity in an interdomain or intradomain context. >>>=20 >>> It relies on the authentication service = constructing tokens based on [=85] >>>=20 >>>=20 >>>=20 >>>=20 >>>=20 >>> To maximize end-to-end security, it is typically = obviously >>>=20 >>> preferable for end-users to acquire their own = credentials; if they >>>=20 >>> do, their user agents can act as authentication = services. However, >>>=20 >>> for some deployments, [=85] >>>=20 >>>=20 >>>=20 >>> Regards, >>>=20 >>> Alex >>> * * >>> *Alex Bobotek* >>>=20 >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org = > >>> https://www.ietf.org/mailman/listinfo/stir = >>>=20 >>>=20 >>>=20 >>> = ------------------------------------------------------------------------ >>>=20 >>> This e-mail may contain Sprint proprietary information >>> intended for the sole use of the recipient(s). Any use by >>> others is prohibited. If you are not the intended >>> recipient, please contact the sender and delete all = copies >>> of the message. >>=20 >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir = >>=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_4C324DD4-35A1-49A2-AF82-170AC95022D5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 In my jargon an =93authorized spoofer=94 is the doctor who is = calling from his mobile, but sending the TN of his office phone as = calling party.  The delegation to his office phone was made by his = landline carrier to him.  He then creates another credential, which = he signs with his office phone credential that authorizes his mobile to = send calls from his office number.  He is spoofing (because the = call is coming from his mobile=92s TN but claims to be from his office), = but it=92s authorized spoofing.  The doc could give the credential = to his mobile SP if they sign on his behalf.

Some folks don=92t like attaching the = =93spoofing=94 label to a legitimate use.

But that=92s how I describe = it.

Brian

On = Aug 4, 2016, at 5:37 PM, Paul Kyzivat <pkyzivat@alum.mit.edu> wrote:

+1, but with one question below:

On 8/4/16 5:14 PM, Brian Rosen = wrote:
I think = all we need is to have credentials follow the delegation path,

plus the option to add another level (not delegation) for = authorized
spoofers.

I don't understand = "authorized spoofers" in this context, as contrasted to "spoofers" who = have been delegated their authority.

Thanks,
= Paul

I don=92t = think it matters who the delegator or delegatee are as long as
the delegator is willing to take the heat for delegating to = someone who
sends a lot of bad calls.  They can pass = the buck (=93I delegated the TN
to him, and now I=92m not = responsible=94), but only if the SP knows who they
delegated= to, so authorities can follow the delegation path.  There are
plenty of certificated carriers who are willing to not care = who they
delegate to.  The fact that there are some = who do doesn=92t change much.
Making stir work means = knowing who you are delegating to, so that you
can pass = the hot potato.

It=92s perfectly reasonable = for a carrier to be able to sign for any calls
placed on = its network on any number it has been delegated.  If it does,
it=92s asserting that the calls are from who they are = supposed to be from.
That should be straightforward, but = we know it=92s not always, and that
represents the hard = part of deployment in my opinion.  But once they
delegate, they can hand responsibility to sign to the = delegatee.  But,
that only works if they know who = they are delegating to.

The root of the = whole model is that there is a formal or informal
delegation= path for telephone numbers in every country, and we can build
a chain of trust from that delegation path.  If you = propose to alter
that model, then we get into (policy) = issues of which carriers/entities
we trust and which we = don=92t.  Our model is that you know who you
delegate = to, and once you do that delegation, it=92s their problem.
That=92s pretty appealing I think, even if it=92s a change in = some business
practices.

The = mechanism is chaining credentials in a form of a PKI and having a
way to know which TNs are covered by a credential. =  That=92s what we have,
and I=92m loath to change = it.

Brian


On Aug 4, 2016, at 4:53 = PM, Gorman, Pierce A [CTO]
<Pierce.Gorman@sprint.com <mailto:Pierce.Gorman@sprint.com>> wrote:

OK, you talked me into indulging in one more = message on policy and use
cases.

I agree that the STIR/PASSporT mechanisms could be deployed = on
individual devices as well as multi-device and = multi-number platforms.

Number delegation = (and sub-delegation), and business relationships are
two = additional factors which affect trustworthiness of a given calling
number authentication.

Inherent = variable trustworthiness of a calling number was my reason
for suggesting a way to qualify the signature to reflect that = variability.

Originating carriers are in a = position to know if a call is coming
from a device = assigned a single number, or from =93trunk group=94 which
could originate calls using multiple numbers, and can qualify = to some
degree the trustworthiness of number authenticity = accordingly.

My suggestion was qualifying = calling number authenticity into
categories of = carrier-signed (or not), and unauthenticated,
semi-authenticated, and most-authenticated.  There can = be more
granularity, but it implies additional operational = complexity (both
for the carriers and the consumers) and I = assume diminishes value.

My reason for = adding the authenticity of the originating carrier is
typical trustworthiness of a carrier business relationship = with
typical consumers adds to the trustworthiness = assessment and partially
because carriers are a regulated = point of forensic inquiry for CALEA
and fraud. =  Additionally, most calls originate and terminate between
mobile consumers where their carriers are able to usefully
authenticate their device and have a high degree of = confidence of the
authenticity of the calling number.

I think billions of per-TN certs of varying = usability (revoked, not
revoked) for authenticating = calling number will not work well.

Conversely, I think billions of per-TN certs will work well, = if the
calling party has to sign a call with a per-TN cert = provided by the
called party.  No called party cert = to include?  Then the calling
party does not have a = trusted relationship with the called party, and
the call = can be authorized/treated accordingly.  (I=92ve made similar,
mostly ignored comments in MODERN.)

Pierce

*From:* Brian Rosen [mailto:br@brianrosen.net]
*Sent:* August = 04, 2016 2:03 PM
*To:* Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com
<mailto:Pierce.Gorman@sprint.com>>
*Cc:*= Alex Bobotek <alex@bobotek.net <mailto:alex@bobotek.net>>;
stir@ietf.org <mailto:stir@ietf.org>
*Subject:* Re: [stir] STIR 4474bis-10 comments

Well, the mechanisms are designed so that they = could be deployed on
devices and PBXs.  Whether they = will be is a policy issue.

The notion of = credentials that are traceable to a delegation of a TN
is = a mechanism that is part of the design of stir, and the design
allows delegation of one TN (to one device, although a device = like a
PBX would have more than one TN per =93device=94, = and something like a
dual NAM phone could have more than = one credential.  For the use case
we=92ve discussed, = a mobile phone may also have a credential for, say, a
TN = that is delegated to a landline, to cover the example case of a
doctor placing a call on his mobile, but getting his office = number to
show up as the calling party.  Use of such = mechanisms is policy.

Brian

   On Aug 4, 2016, at 2:52 PM, = Gorman, Pierce A [CTO]
   <Pierce.Gorman@sprint.com <mailto:Pierce.Gorman@sprint.com>> wrote:

   Thanks Brian.  I=92m = afraid we=92re straying into a policy
   discussion.  Regardless, I do = appreciate your explanation.  I
   would= like to continue the discussion, but I=92m pretty sure this
   isn=92t the right forum.

   Pierce

   *From:* Brian Rosen [mailto:br@brianrosen.net]
   *Sent:* August 04, 2016 1:34 PM
   *To:* Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com
   <mailto:Pierce.Gorman@sprint.com>>
   *Cc:* Alex Bobotek <alex@bobotek.net
   <mailto:alex@bobotek.net>>; stir@ietf.org <mailto:stir@ietf.org>
   *Subject:* Re: [stir] STIR 4474bis-10 = comments

   Of course I want = PBXs to sign calls.  As well as smart phones and
   any other devices that can be programmed to = do so.
   They will be given credentials = that only are valid for the TNs
   they are = authorized to sign for.  They can try to sign any call,
   but the validity of the credential would = make such a signature
   fail the = checking.

   Getting service = providers to sign on behalf of devices is a
   reasonable way to deploy quickly, but I = expect many SPs will want
   to get out of = the liability of signing on behalf of their
   customers.  If they can push of that = responsibility to their
   customer, only = being responsible for getting the customer an
   appropriate credential when they assign = TNs, then I would expect
   them to want to = do so.  That means the devices have to be able to
   sign, but I understand many of the PBX = vendors think that=92s
   something they = could provide in a future release.

   Brian


       On Aug 4, 2016, at = 2:22 PM, Gorman, Pierce A [CTO]
       <Pierce.Gorman@sprint.com <mailto:Pierce.Gorman@sprint.com>>
       wrote:

       You = want IP PBXes to sign calls?  Won=92t that make it
       extraordinarily = easy to commit fraud with authenticated numbers?


       *From:* Brian Rosen = [mailto:br@brianrosen.net]
       *Sent:* August 04, = 2016 12:24 PM
       *To:* Gorman, = Pierce A [CTO] <Pierce.Gorman@sprint.com
       <mailto:Pierce.Gorman@sprint.com>>
       *Cc:* Alex Bobotek = <alex@bobotek.net       <mailto:alex@bobotek.net>>; stir@ietf.org <mailto:stir@ietf.org>
       *Subject:* Re: = [stir] STIR 4474bis-10 comments

       First of all, we = would want the PBX to generate the signature,
       but the service = provider can do that.  It should not add a
       valid signature to = a call from a number it did not assign to
       the trunk group = connecting to the PBX, although it could
       support the extra = delegation required to support =93authorized
       spoofing=94. =  The companion devices I=92m aware of always send
       calls from the same = service provider and should not present
       any issue.

       Everyone will have = to do work they don=92t do now to implement
       stop spoofed calls. = TANSTAAFL

       Brian


          &nb= sp;On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO]
          &nb= sp;<Pierce.Gorman@sprint.com
          &nb= sp;<mailto:Pierce.Gorman@sprint.com>> wrote:

          &nb= sp;Fraud from compromised PBXes is common.  And even where a
          &nb= sp;PBX is not compromised, a carrier has no practical way of
          &nb= sp;knowing whether the calling number is properly assigned
          &nb= sp;and valid from the perspective of the Enterprise.
          &nb= sp;Therefore, checking whether the calling number was from an
          &nb= sp;assigned range might be possible (and fraught with
          &nb= sp;administrative challenges), but of limited value.  And in
          &nb= sp;the consumer market, there are calling products which
          &nb= sp;support a parent subscriber number and =93companion=94 devices
          &nb= sp;(e.g., tablets) which can place a call using the MDN of
          &nb= sp;the parent subscriber.  These are examples of where the
          &nb= sp;authenticity of the calling number won=92t necessarily mean
          &nb= sp;the same thing as the authenticity of a call from a single
          &nb= sp;subscriber with a single MDN regardless of =93laxity=94 of
          &nb= sp;spoof checking.

          &nb= sp;In another forum and anticipating calling number
          &nb= sp;authentication mandates from Congress and/or FCC, I
          &nb= sp;suggested using carrier-specific certs and encoding
          &nb= sp;specificity of authenticity, and calling number.  This
          &nb= sp;provides the identity of the originating carrier, some
          &nb= sp;idea as to the accuracy or specificity of the calling
          &nb= sp;number, and validty of the calling number (assuming nonce
          &nb= sp;and replay issues can be addressed as reasonably suggested
          &nb= sp;below by Alex).

          &nb= sp;The representation of orig-carrier and trustworthiness
          &nb= sp;could be as follows:

          &nb= sp;*Regulated/mandated Carrier Class Use Case:*

          &nb= sp;*00 - No Credentials*
          &nb= sp;Use case example(s): Pre-IMS, legacy circuit-switched
          &nb= sp;networks that don't natively support SIP or which don't
          &nb= sp;choose to sign calls.  E.g., international carriers.
          &nb= sp;Trust Estimate:  Good luck.  Carrier_orig and CgPN
          &nb= sp;entirely untrustworthy.

          &nb= sp;*01 - Carrier signed, no authentication of CgPN*
          &nb= sp;Use case example(s): E911 on visited network w/o roaming
          &nb= sp;agreement, manual roaming.
          &nb= sp;Trust Estimate:  Carrier_orig trustworthy, CgPN entirely
          &nb= sp;untrustworthy

          &nb= sp;*10 - Carrier signed, semi-authenticated CgPN*
          &nb= sp;Use case example(s): Number block delegated from OCN, but
          &nb= sp;no per-TN screen (SIP trunks).
          &nb= sp;Trust Estimate:  Carrier_orig trustworthy, CgPN less than
          &nb= sp;most trustworthy but not entirely untrustworthy.

          &nb= sp;*11 - Carrier signed, authenticated CgPN*
          &nb= sp;Use case example(s): Bread-and-butter 95%+ of calls from
          &nb= sp;subscriber lines (IMS-based and otherwise).
          &nb= sp;Trust Estimate:  Carrier_orig trustworthy, CgPN most
          &nb= sp;trustworthy

          &nb= sp;*Public Use Case:*

          &nb= sp;Undefined but assumed to use public or commercially
          &nb= sp;available authentication services resources.  e.g.,
          &nb= sp;nomorobo-like crowd-sourced accept/deny lists, et cetera.
          &nb= sp;Could/would pass credentials down to SIP-aware devices
          &nb= sp;which would process them according to the rules of the
          &nb= sp;Public Class application(s).

          &nb= sp;Pierce

          &nb= sp;*From:* Brian Rosen [mailto:br@brianrosen.net]
          &nb= sp;*Sent:* August 04, 2016 9:02 AM
          &nb= sp;*To:* Alex Bobotek <alex@bobotek.net
          &nb= sp;<mailto:alex@bobotek.net>>
          &nb= sp;*Cc:* stir@ietf.org <mailto:stir@ietf.org>
          &nb= sp;*Subject:* Re: [stir] STIR 4474bis-10 comments

          &nb= sp;There are reasonable circumstances where a party placing a
          &nb= sp;call is not the authorized entity assigned the telephone
          &nb= sp;number used in From/PAI, and in such circumstances the
          &nb= sp;service provider servicing the entity placing the call may
          &nb= sp;or may not be the same as the service provider serving the
          &nb= sp;entity that is assigned the TN.  In all such cases, the
          &nb= sp;entity that is assigned the TN explicitly authorizes calls
          &nb= sp;placed using it=92s TN.  The design accommodates such use
          &nb= sp;cases.  It=92s not a blanket authorization without
          &nb= sp;authentication.   We=92re not aware of any cases where = there
          &nb= sp;is an actual requirement for legitimate calling without
          &nb= sp;explicit authorization from the assigned entity, although
          &nb= sp;we certainly are aware that various parts of various
          &nb= sp;service providers don=92t bother to check. At this point, at
          &nb= sp;least in some countries, there is a realization that the
          &nb= sp;laxity of allowing unchecked spoofing is not acceptable
          &nb= sp;any more.

          &nb= sp;Brian


          &nb= sp;    On Aug 3, 2016, at 8:35 AM, Alex Bobotek
          &nb= sp;    <alex@bobotek.net <mailto:alex@bobotek.net>> wrote:

          &nb= sp;    1.       Permit = authorization without authentication
          &nb= sp;    In the current telephony network practice, = some
          &nb= sp;    service provider implementations choose not = to
          &nb= sp;    authenticate identity, but simply facilitate = the use
          &nb= sp;    of an arbitrary or selected user-provided = identity.
          &nb= sp;    Are there legitimate use cases for this? =  Has anyone
          &nb= sp;    established that there are not?  How can = the industry
          &nb= sp;    reasonably expect to end this (often bad) = practice?
          &nb= sp;    If it can=92t be ended, there=92s value in at = least
          &nb= sp;    identifying the originating service = provider
          &nb= sp;    (i.e., the signer/authorizer).  Given = the prevalence
          &nb= sp;    of abuse using telephone numbers assigned to = a
          &nb= sp;    sometimes-anonymous abuser, it becomes = critically
          &nb= sp;    important to identify the service provider(s) = closest
          &nb= sp;    to the abuser.  Based on the assumption = that it=92s
          &nb= sp;    better to ID service providers than = unreasonably
          &nb= sp;    expect a ban of the use of unauthenticated = (and
          &nb= sp;    therefore unsigned) SIP requests, STIR = signing should
          &nb= sp;    support authorization without authentication. =  The
          &nb= sp;    practice of authorizing unauthenticated use = exists,
          &nb= sp;    and there is benefit to signing in these = cases
          &nb= sp;    (service provider identification).  The = language of
          &nb= sp;    the ID should permit this use. =  4474bis-10 should NOT
          &nb= sp;    require or assume that  that = authentication will
          &nb= sp;    precede authorization. Of course there may be = other
          &nb= sp;    use cases where signing includes = authentication and
          &nb= sp;    may not include a specific service = provider=92s
          &nb= sp;    authorization.

          &nb= sp;    2. =       Improve replay prevention
          &nb= sp;    Proximate replay is possible while complying = with this
          &nb= sp;    spec.  First, one or more proximate = (e.g., within 60
          &nb= sp;    seconds) SIP requests using the same token = are legal
          &nb= sp;    and subject to replay in many cases.  An = SDP body=92s
          &nb= sp;    mky may not be present and if present its use = is
          &nb= sp;    optional.  Some sort of mandatory new or = existing
          &nb= sp;    signed sequence, random # or request ID = (e.g., Call-ID
          &nb= sp;    or CSeq) and a 1-time use policy on the = receiving end
          &nb= sp;    of the request (e.g., tokens only good for = 1
          &nb= sp;    use) could prevent replay.  Different = methods (e.g.,
          &nb= sp;    INVITE vs MESSAGE) might be handled by = different
          &nb= sp;    receiving infrastructure, and therefore = difficulties
          &nb= sp;    with =91it=92s been used already=92 = coordination allow a
          &nb= sp;    faked MESSAGE based on a captured request. = This might
          &nb= sp;    include an mkey from a captured INVITE. =   So it may be
          &nb= sp;    possible to DOS, spam or text-bomb a = recipient using a
          &nb= sp;    captured identity.  While large-scale or = distributed
          &nb= sp;    implementations may make the enforcement = difficult,
          &nb= sp;    there is little cost to signing and decoding = a method
          &nb= sp;    and possibly a numeric ID.   Some = sort of =911-use=92
          &nb= sp;    practice should at least be discussed while = perhaps
          &nb= sp;    not required.


          &nb= sp;    Specific markup suggestions:


          &nb= sp;    NITS


          &nb= sp;       The verifier MUST inspect = any optional "ppt" parameter appearing *in*the

          &nb= sp;       Identity request.  If = no "ppt" parameter is present, then the

          &nb= sp;       verifier proceeds normally = below.  If a "ppt" parameter value is

          &nb= sp;       present, and the verifier = does not support it, it MUST ignore the

          &nb= sp;       Identity header.  If a = supported "ppt" parameter value is present,

          &nb= sp;       the verifier follows the = procedures below, including the variations

          &nb= sp;       described in Step 5.




          &nb= sp;        3
          &nb= sp;        <file:///C:/Users/ab3778/Documents/IETF/draft-ietf-stir-rfc4474b= is-10%20-%20Authenticated%20Identity%20Management%20in%20the%20Session%20I= nitiation%20Protocol%20%28SIP%29.htm#section-3>.
          &nb= sp;        Background

          &nb= sp;    [=85]



          &nb= sp;       Per [RFC7340 <https://tools.ietf.org/html/rfc7340>], problems such = as robocalling, voicemail hacking, and

          &nb= sp;       swatting are enabled by an = attacker's ability to impersonate someone

          &nb= sp;       else.  The secure = operation of most SIP applications and services

          &nb= sp;       depends on authenticating = and/or authorizing the source of communications as it is
          &nb= sp;       represented in a SIP = request.



          &nb= sp;       This identity architecture = for SIP depends on includes provisions for a logical

          &nb= sp;       "authentication service" = which validates caller identity at or near origination. =  outgoing
          &nb= sp;    requests.  An

          &nb= sp;       authentication service may = be implemented either as part of a user

          &nb= sp;       agent or as a proxy server; = typically, it is a component of a network

          &nb= sp;       intermediary like a proxy = to which originating user agents send

          &nb= sp;       unsigned requests. =  Once the sender of the message has been




          &nb= sp;       This document specifies a = means of sharing a cryptographic assurance

          &nb= sp;       of authenticity of and/or = authorization to use end-user SIP identity in an interdomain or = intradomain context.

          &nb= sp;       It relies on the = authentication service constructing tokens based on [=85]




          &nb= sp;       To maximize end-to-end = security, it is typically obviously

          &nb= sp;       preferable for end-users to = acquire their own credentials; if they

          &nb= sp;       do, their user agents can = act as authentication services.  However,

          &nb= sp;       for some deployments, = [=85]



          &nb= sp;    Regards,

          &nb= sp;    Alex
          &nb= sp;    * *
          &nb= sp;    *Alex Bobotek*

          &nb= sp;    _______________________________________________=
          &nb= sp;    stir mailing list
          &nb= sp;    stir@ietf.org <mailto:stir@ietf.org>
          &nb= sp;    https://www.ietf.org/mailman/listinfo/stir



          &nb= sp;-----------------------------------------------------------------------= -

          &nb= sp;This e-mail may contain Sprint proprietary information
          &nb= sp;intended for the sole use of the recipient(s). Any use by
          &nb= sp;others is prohibited. If you are not the intended
          &nb= sp;recipient, please contact the sender and delete all copies
          &nb= sp;of the message.



_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_4C324DD4-35A1-49A2-AF82-170AC95022D5-- From nobody Thu Aug 4 14:51:16 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51F5212D9ED for ; Thu, 4 Aug 2016 14:51:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9zol1KeUzVQj for ; Thu, 4 Aug 2016 14:51:13 -0700 (PDT) Received: from resqmta-ch2-01v.sys.comcast.net (resqmta-ch2-01v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:33]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EF7B126D74 for ; Thu, 4 Aug 2016 14:51:13 -0700 (PDT) Received: from resomta-ch2-02v.sys.comcast.net ([69.252.207.98]) by resqmta-ch2-01v.sys.comcast.net with SMTP id VQX2bwYMgTaLwVQXob2ZEE; Thu, 04 Aug 2016 21:51:12 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VQXnbik7LOEhWVQXnb1HhF; Thu, 04 Aug 2016 21:51:12 +0000 To: Brian Rosen References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> From: Paul Kyzivat Message-ID: <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> Date: Thu, 4 Aug 2016 17:51:10 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfI+mes05bN7yeb3p46IN3uPvRThFeorrndWUGuB/xn284akJ2Md0nXxZgTJix95M8ZJ/sBQrc1jUPr3Mp767EV2o5I0K6TDGNLxnJQOkT+fqbPNXWKLa r/FXjblN2/Fs2SXp4SAVSyQbVanZ1WKofyffI9IV53mFgDCqQGgj4lDNAP75Mf6Eb2XMsOLNGBynBEBZPanBtgw8UiGYAVkIf48= Archived-At: Cc: stir@ietf.org Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 21:51:16 -0000 On 8/4/16 5:43 PM, Brian Rosen wrote: > In my jargon an authorized spoofer is the doctor who is calling from > his mobile, but sending the TN of his office phone as calling party. > The delegation to his office phone was made by his landline carrier to > him. He then creates another credential, which he signs with his office > phone credential that authorizes his mobile to send calls from his > office number. He is spoofing (because the call is coming from his > mobiles TN but claims to be from his office), but its authorized > spoofing. The doc could give the credential to his mobile SP if they > sign on his behalf. I don't understand how that is different from regular delegation. When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. Thanks, Paul > Some folks dont like attaching the spoofing label to a legitimate use. > > But thats how I describe it. > > Brian > >> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat > > wrote: >> >> +1, but with one question below: >> >> On 8/4/16 5:14 PM, Brian Rosen wrote: >>> I think all we need is to have credentials follow the delegation path, >> >>> plus the option to add another level (not delegation) for authorized >>> spoofers. >> >> I don't understand "authorized spoofers" in this context, as >> contrasted to "spoofers" who have been delegated their authority. >> >> Thanks, >> Paul >> >>> I dont think it matters who the delegator or delegatee are as long as >>> the delegator is willing to take the heat for delegating to someone who >>> sends a lot of bad calls. They can pass the buck (I delegated the TN >>> to him, and now Im not responsible), but only if the SP knows who they >>> delegated to, so authorities can follow the delegation path. There are >>> plenty of certificated carriers who are willing to not care who they >>> delegate to. The fact that there are some who do doesnt change much. >>> Making stir work means knowing who you are delegating to, so that you >>> can pass the hot potato. >>> >>> Its perfectly reasonable for a carrier to be able to sign for any calls >>> placed on its network on any number it has been delegated. If it does, >>> its asserting that the calls are from who they are supposed to be from. >>> That should be straightforward, but we know its not always, and that >>> represents the hard part of deployment in my opinion. But once they >>> delegate, they can hand responsibility to sign to the delegatee. But, >>> that only works if they know who they are delegating to. >>> >>> The root of the whole model is that there is a formal or informal >>> delegation path for telephone numbers in every country, and we can build >>> a chain of trust from that delegation path. If you propose to alter >>> that model, then we get into (policy) issues of which carriers/entities >>> we trust and which we dont. Our model is that you know who you >>> delegate to, and once you do that delegation, its their problem. >>> Thats pretty appealing I think, even if its a change in some business >>> practices. >>> >>> The mechanism is chaining credentials in a form of a PKI and having a >>> way to know which TNs are covered by a credential. Thats what we have, >>> and Im loath to change it. >>> >>> Brian >>> >>> >>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>> >>> > >>>> wrote: >>>> >>>> OK, you talked me into indulging in one more message on policy and use >>>> cases. >>>> >>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>> individual devices as well as multi-device and multi-number platforms. >>>> >>>> Number delegation (and sub-delegation), and business relationships are >>>> two additional factors which affect trustworthiness of a given calling >>>> number authentication. >>>> >>>> Inherent variable trustworthiness of a calling number was my reason >>>> for suggesting a way to qualify the signature to reflect that >>>> variability. >>>> >>>> Originating carriers are in a position to know if a call is coming >>>> from a device assigned a single number, or from trunk group which >>>> could originate calls using multiple numbers, and can qualify to some >>>> degree the trustworthiness of number authenticity accordingly. >>>> >>>> My suggestion was qualifying calling number authenticity into >>>> categories of carrier-signed (or not), and unauthenticated, >>>> semi-authenticated, and most-authenticated. There can be more >>>> granularity, but it implies additional operational complexity (both >>>> for the carriers and the consumers) and I assume diminishes value. >>>> >>>> My reason for adding the authenticity of the originating carrier is >>>> typical trustworthiness of a carrier business relationship with >>>> typical consumers adds to the trustworthiness assessment and partially >>>> because carriers are a regulated point of forensic inquiry for CALEA >>>> and fraud. Additionally, most calls originate and terminate between >>>> mobile consumers where their carriers are able to usefully >>>> authenticate their device and have a high degree of confidence of the >>>> authenticity of the calling number. >>>> >>>> I think billions of per-TN certs of varying usability (revoked, not >>>> revoked) for authenticating calling number will not work well. >>>> >>>> Conversely, I think billions of per-TN certs will work well, if the >>>> calling party has to sign a call with a per-TN cert provided by the >>>> called party. No called party cert to include? Then the calling >>>> party does not have a trusted relationship with the called party, and >>>> the call can be authorized/treated accordingly. (Ive made similar, >>>> mostly ignored comments in MODERN.) >>>> >>>> Pierce >>>> >>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>> *Sent:* August 04, 2016 2:03 PM >>>> *To:* Gorman, Pierce A [CTO] >>> >>>> > >>>> *Cc:* Alex Bobotek >>> >; >>>> stir@ietf.org >>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>> >>>> Well, the mechanisms are designed so that they could be deployed on >>>> devices and PBXs. Whether they will be is a policy issue. >>>> >>>> The notion of credentials that are traceable to a delegation of a TN >>>> is a mechanism that is part of the design of stir, and the design >>>> allows delegation of one TN (to one device, although a device like a >>>> PBX would have more than one TN per device, and something like a >>>> dual NAM phone could have more than one credential. For the use case >>>> weve discussed, a mobile phone may also have a credential for, say, a >>>> TN that is delegated to a landline, to cover the example case of a >>>> doctor placing a call on his mobile, but getting his office number to >>>> show up as the calling party. Use of such mechanisms is policy. >>>> >>>> Brian >>>> >>>> >>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>> >>> > >>>> wrote: >>>> >>>> Thanks Brian. Im afraid were straying into a policy >>>> discussion. Regardless, I do appreciate your explanation. I >>>> would like to continue the discussion, but Im pretty sure this >>>> isnt the right forum. >>>> >>>> Pierce >>>> >>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>> *Sent:* August 04, 2016 1:34 PM >>>> *To:* Gorman, Pierce A [CTO] >>> >>>> > >>>> *Cc:* Alex Bobotek >>>> >; stir@ietf.org >>>> >>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>> >>>> Of course I want PBXs to sign calls. As well as smart phones and >>>> any other devices that can be programmed to do so. >>>> They will be given credentials that only are valid for the TNs >>>> they are authorized to sign for. They can try to sign any call, >>>> but the validity of the credential would make such a signature >>>> fail the checking. >>>> >>>> Getting service providers to sign on behalf of devices is a >>>> reasonable way to deploy quickly, but I expect many SPs will want >>>> to get out of the liability of signing on behalf of their >>>> customers. If they can push of that responsibility to their >>>> customer, only being responsible for getting the customer an >>>> appropriate credential when they assign TNs, then I would expect >>>> them to want to do so. That means the devices have to be able to >>>> sign, but I understand many of the PBX vendors think thats >>>> something they could provide in a future release. >>>> >>>> Brian >>>> >>>> >>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>> >>> > >>>> wrote: >>>> >>>> You want IP PBXes to sign calls? Wont that make it >>>> extraordinarily easy to commit fraud with authenticated numbers? >>>> >>>> >>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>> *Sent:* August 04, 2016 12:24 PM >>>> *To:* Gorman, Pierce A [CTO] >>> >>>> > >>>> *Cc:* Alex Bobotek >>>> >; stir@ietf.org >>>> >>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>> >>>> First of all, we would want the PBX to generate the signature, >>>> but the service provider can do that. It should not add a >>>> valid signature to a call from a number it did not assign to >>>> the trunk group connecting to the PBX, although it could >>>> support the extra delegation required to support authorized >>>> spoofing. The companion devices Im aware of always send >>>> calls from the same service provider and should not present >>>> any issue. >>>> >>>> Everyone will have to do work they dont do now to implement >>>> stop spoofed calls. TANSTAAFL >>>> >>>> Brian >>>> >>>> >>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>> >>>> > wrote: >>>> >>>> Fraud from compromised PBXes is common. And even where a >>>> PBX is not compromised, a carrier has no practical way of >>>> knowing whether the calling number is properly assigned >>>> and valid from the perspective of the Enterprise. >>>> Therefore, checking whether the calling number was from an >>>> assigned range might be possible (and fraught with >>>> administrative challenges), but of limited value. And in >>>> the consumer market, there are calling products which >>>> support a parent subscriber number and companion devices >>>> (e.g., tablets) which can place a call using the MDN of >>>> the parent subscriber. These are examples of where the >>>> authenticity of the calling number wont necessarily mean >>>> the same thing as the authenticity of a call from a single >>>> subscriber with a single MDN regardless of laxity of >>>> spoof checking. >>>> >>>> In another forum and anticipating calling number >>>> authentication mandates from Congress and/or FCC, I >>>> suggested using carrier-specific certs and encoding >>>> specificity of authenticity, and calling number. This >>>> provides the identity of the originating carrier, some >>>> idea as to the accuracy or specificity of the calling >>>> number, and validty of the calling number (assuming nonce >>>> and replay issues can be addressed as reasonably suggested >>>> below by Alex). >>>> >>>> The representation of orig-carrier and trustworthiness >>>> could be as follows: >>>> >>>> *Regulated/mandated Carrier Class Use Case:* >>>> >>>> *00 - No Credentials* >>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>> networks that don't natively support SIP or which don't >>>> choose to sign calls. E.g., international carriers. >>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>> entirely untrustworthy. >>>> >>>> *01 - Carrier signed, no authentication of CgPN* >>>> Use case example(s): E911 on visited network w/o roaming >>>> agreement, manual roaming. >>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>> untrustworthy >>>> >>>> *10 - Carrier signed, semi-authenticated CgPN* >>>> Use case example(s): Number block delegated from OCN, but >>>> no per-TN screen (SIP trunks). >>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>> most trustworthy but not entirely untrustworthy. >>>> >>>> *11 - Carrier signed, authenticated CgPN* >>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>> subscriber lines (IMS-based and otherwise). >>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>> trustworthy >>>> >>>> *Public Use Case:* >>>> >>>> Undefined but assumed to use public or commercially >>>> available authentication services resources. e.g., >>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>> Could/would pass credentials down to SIP-aware devices >>>> which would process them according to the rules of the >>>> Public Class application(s). >>>> >>>> Pierce >>>> >>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>> *Sent:* August 04, 2016 9:02 AM >>>> *To:* Alex Bobotek >>> >>>> > >>>> *Cc:* stir@ietf.org >>>> >>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>> >>>> There are reasonable circumstances where a party placing a >>>> call is not the authorized entity assigned the telephone >>>> number used in From/PAI, and in such circumstances the >>>> service provider servicing the entity placing the call may >>>> or may not be the same as the service provider serving the >>>> entity that is assigned the TN. In all such cases, the >>>> entity that is assigned the TN explicitly authorizes calls >>>> placed using its TN. The design accommodates such use >>>> cases. Its not a blanket authorization without >>>> authentication. Were not aware of any cases where there >>>> is an actual requirement for legitimate calling without >>>> explicit authorization from the assigned entity, although >>>> we certainly are aware that various parts of various >>>> service providers dont bother to check. At this point, at >>>> least in some countries, there is a realization that the >>>> laxity of allowing unchecked spoofing is not acceptable >>>> any more. >>>> >>>> Brian >>>> >>>> >>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>> >>> > wrote: >>>> >>>> 1. Permit authorization without authentication >>>> In the current telephony network practice, some >>>> service provider implementations choose not to >>>> authenticate identity, but simply facilitate the use >>>> of an arbitrary or selected user-provided identity. >>>> Are there legitimate use cases for this? Has anyone >>>> established that there are not? How can the industry >>>> reasonably expect to end this (often bad) practice? >>>> If it cant be ended, theres value in at least >>>> identifying the originating service provider >>>> (i.e., the signer/authorizer). Given the prevalence >>>> of abuse using telephone numbers assigned to a >>>> sometimes-anonymous abuser, it becomes critically >>>> important to identify the service provider(s) closest >>>> to the abuser. Based on the assumption that its >>>> better to ID service providers than unreasonably >>>> expect a ban of the use of unauthenticated (and >>>> therefore unsigned) SIP requests, STIR signing should >>>> support authorization without authentication. The >>>> practice of authorizing unauthenticated use exists, >>>> and there is benefit to signing in these cases >>>> (service provider identification). The language of >>>> the ID should permit this use. 4474bis-10 should NOT >>>> require or assume that that authentication will >>>> precede authorization. Of course there may be other >>>> use cases where signing includes authentication and >>>> may not include a specific service providers >>>> authorization. >>>> >>>> >>>> 2. Improve replay prevention >>>> Proximate replay is possible while complying with this >>>> spec. First, one or more proximate (e.g., within 60 >>>> seconds) SIP requests using the same token are legal >>>> and subject to replay in many cases. An SDP bodys >>>> mky may not be present and if present its use is >>>> optional. Some sort of mandatory new or existing >>>> signed sequence, random # or request ID (e.g., Call-ID >>>> or CSeq) and a 1-time use policy on the receiving end >>>> of the request (e.g., tokens only good for 1 >>>> use) could prevent replay. Different methods (e.g., >>>> INVITE vs MESSAGE) might be handled by different >>>> receiving infrastructure, and therefore difficulties >>>> with its been used already coordination allow a >>>> faked MESSAGE based on a captured request. This might >>>> include an mkey from a captured INVITE. So it may be >>>> possible to DOS, spam or text-bomb a recipient using a >>>> captured identity. While large-scale or distributed >>>> implementations may make the enforcement difficult, >>>> there is little cost to signing and decoding a method >>>> and possibly a numeric ID. Some sort of 1-use >>>> practice should at least be discussed while perhaps >>>> not required. >>>> >>>> >>>> Specific markup suggestions: >>>> >>>> >>>> NITS >>>> >>>> >>>> The verifier MUST inspect any optional "ppt" >>>> parameter appearing *in*the >>>> >>>> Identity request. If no "ppt" parameter is >>>> present, then the >>>> >>>> verifier proceeds normally below. If a "ppt" >>>> parameter value is >>>> >>>> present, and the verifier does not support it, it >>>> MUST ignore the >>>> >>>> Identity header. If a supported "ppt" parameter >>>> value is present, >>>> >>>> the verifier follows the procedures below, >>>> including the variations >>>> >>>> described in Step 5. >>>> >>>> >>>> >>>> >>>> 3 >>>> . >>>> Background >>>> >>>> [] >>>> >>>> >>>> >>>> Per [RFC7340 >>>> ], problems such as >>>> robocalling, voicemail hacking, and >>>> >>>> swatting are enabled by an attacker's ability to >>>> impersonate someone >>>> >>>> else. The secure operation of most SIP >>>> applications and services >>>> >>>> depends on authenticating and/or authorizing the >>>> source of communications as it is >>>> >>>> represented in a SIP request. >>>> >>>> >>>> >>>> This identity architecture for SIP depends on >>>> includes provisions for a logical >>>> >>>> "authentication service" which validates caller >>>> identity at or near origination. outgoing >>>> requests. An >>>> >>>> authentication service may be implemented either >>>> as part of a user >>>> >>>> agent or as a proxy server; typically, it is a >>>> component of a network >>>> >>>> intermediary like a proxy to which originating >>>> user agents send >>>> >>>> unsigned requests. Once the sender of the message >>>> has been >>>> >>>> >>>> >>>> >>>> This document specifies a means of sharing a >>>> cryptographic assurance >>>> >>>> of authenticity of and/or authorization to use >>>> end-user SIP identity in an interdomain or intradomain context. >>>> >>>> It relies on the authentication service >>>> constructing tokens based on [] >>>> >>>> >>>> >>>> >>>> >>>> To maximize end-to-end security, it is typically >>>> obviously >>>> >>>> preferable for end-users to acquire their own >>>> credentials; if they >>>> >>>> do, their user agents can act as authentication >>>> services. However, >>>> >>>> for some deployments, [] >>>> >>>> >>>> >>>> Regards, >>>> >>>> Alex >>>> * * >>>> *Alex Bobotek* >>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> >>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> >>>> >>>> ------------------------------------------------------------------------ >>>> >>>> This e-mail may contain Sprint proprietary information >>>> intended for the sole use of the recipient(s). Any use by >>>> others is prohibited. If you are not the intended >>>> recipient, please contact the sender and delete all copies >>>> of the message. >>> >>> >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > From nobody Thu Aug 4 15:02:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8217A12DB2E for ; Thu, 4 Aug 2016 15:02:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JXw-gnMN_tAo for ; Thu, 4 Aug 2016 15:02:40 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8878912DB2F for ; Thu, 4 Aug 2016 15:02:40 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id p186so121099735qkd.1 for ; Thu, 04 Aug 2016 15:02:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=URe40YxOHzctsBMysZmfEdc0iLT7HTQAcqk+iih/ilc=; b=OI827FjAmsLvzCfbCYfUU1iLbyIQJrttKaVAnJVnJjYSxxiG9t1IhQUmhag5DgkQLn IyD8zF5EEA3C6lyYO7VYrMlh4ePxCjoJbe2PcHg4Z4dxg84x/bvu/MFryv2IfXc1P+II j4vP/vwTkGmUMVi72MBQeQV99XvOlaw7Rs8CwgAusy//How8iu/gfKAIqvOho1JKdlD6 lXMUzRCcb6Gm5nVa6e/UmPLkyx5LSuae3/KpHwgxlWChZ6cTtX/DJaIMxWe28w4yVZYV il6DbC/QTjChcK4wQu/oDYbZZUzqrsvkTz2yWP644Yy62Xq1AZfzUjVsE2oVECdICx6a iYAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=URe40YxOHzctsBMysZmfEdc0iLT7HTQAcqk+iih/ilc=; b=Bo+at1FFZ+2jL1pbBuolO7T6hq7RisvsU3MUg9VigEB+FxbzOohw6Ir5VW2WFEisBJ YPkPobEPxymAv5Ie58+ktuHyvs11OsiPcB68BRQoEnSs4yirRQNuUH8kiPZWHkby+3w+ PSyJZ4YGsZfNKqD11ztDWPS4M57n/9gv4dCtrOPHHGEk4LTrWAQWPLvT+ib0cTFHjdcv gIo6BhtclRFm2Knv1jLCgxawywZ6tHE9bizTveD1nGGmhd92dEynAhkIKkhZO+kdkLJ3 FcCnaCpipp6MVbqWnvsiC6pKO3jbVJ/EEpTZVttFFR/Sk/FoDLJv/ZWhoisOxYwv8eh9 tujQ== X-Gm-Message-State: AEkoousR1zFtjEWqQa/CwKPU+Hh2vUGiRdLJEyZ7E2yFC2FG3+GmRbBhrD7UTMfwVLZ0TQ== X-Received: by 10.233.237.75 with SMTP id c72mr8862644qkg.162.1470348159136; Thu, 04 Aug 2016 15:02:39 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id i13sm8003940qte.42.2016.08.04.15.02.37 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Aug 2016 15:02:37 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> Date: Thu, 4 Aug 2016 18:02:36 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> To: Paul Kyzivat X-Mailer: Apple Mail (2.3124) Archived-At: Cc: stir@ietf.org Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 22:02:43 -0000 I think it=92s not a delegation. The mobile phone is not being = delegated the TN, it=92s being authorized to place calls that are not = from that TN, but appear to be. The mechanism to handle the credential is exactly the same as a = delegation, so if you want to call it delegation, go ahead, but I prefer = to call it authorized spoofing. Brian > On Aug 4, 2016, at 5:51 PM, Paul Kyzivat = wrote: >=20 > On 8/4/16 5:43 PM, Brian Rosen wrote: >> In my jargon an =93authorized spoofer=94 is the doctor who is calling = from >> his mobile, but sending the TN of his office phone as calling party. >> The delegation to his office phone was made by his landline carrier = to >> him. He then creates another credential, which he signs with his = office >> phone credential that authorizes his mobile to send calls from his >> office number. He is spoofing (because the call is coming from his >> mobile=92s TN but claims to be from his office), but it=92s = authorized >> spoofing. The doc could give the credential to his mobile SP if they >> sign on his behalf. >=20 > I don't understand how that is different from regular delegation. >=20 > When his landline carrier gave him a delegated certificate for his = landline number, he should be able to install that in whatever devices = he wants - his landline UA, his mobile phone, etc. It is still delegated = from his landline carrier, even when used with calls via his mobile = carrier. >=20 > Thanks, > Paul >=20 >> Some folks don=92t like attaching the =93spoofing=94 label to a = legitimate use. >>=20 >> But that=92s how I describe it. >>=20 >> Brian >>=20 >>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >> > wrote: >>>=20 >>> +1, but with one question below: >>>=20 >>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>> I think all we need is to have credentials follow the delegation = path, >>>=20 >>>> plus the option to add another level (not delegation) for = authorized >>>> spoofers. >>>=20 >>> I don't understand "authorized spoofers" in this context, as >>> contrasted to "spoofers" who have been delegated their authority. >>>=20 >>> Thanks, >>> Paul >>>=20 >>>> I don=92t think it matters who the delegator or delegatee are as = long as >>>> the delegator is willing to take the heat for delegating to someone = who >>>> sends a lot of bad calls. They can pass the buck (=93I delegated = the TN >>>> to him, and now I=92m not responsible=94), but only if the SP knows = who they >>>> delegated to, so authorities can follow the delegation path. There = are >>>> plenty of certificated carriers who are willing to not care who = they >>>> delegate to. The fact that there are some who do doesn=92t change = much. >>>> Making stir work means knowing who you are delegating to, so that = you >>>> can pass the hot potato. >>>>=20 >>>> It=92s perfectly reasonable for a carrier to be able to sign for = any calls >>>> placed on its network on any number it has been delegated. If it = does, >>>> it=92s asserting that the calls are from who they are supposed to = be from. >>>> That should be straightforward, but we know it=92s not always, and = that >>>> represents the hard part of deployment in my opinion. But once = they >>>> delegate, they can hand responsibility to sign to the delegatee. = But, >>>> that only works if they know who they are delegating to. >>>>=20 >>>> The root of the whole model is that there is a formal or informal >>>> delegation path for telephone numbers in every country, and we can = build >>>> a chain of trust from that delegation path. If you propose to = alter >>>> that model, then we get into (policy) issues of which = carriers/entities >>>> we trust and which we don=92t. Our model is that you know who you >>>> delegate to, and once you do that delegation, it=92s their problem. >>>> That=92s pretty appealing I think, even if it=92s a change in some = business >>>> practices. >>>>=20 >>>> The mechanism is chaining credentials in a form of a PKI and having = a >>>> way to know which TNs are covered by a credential. That=92s what = we have, >>>> and I=92m loath to change it. >>>>=20 >>>> Brian >>>>=20 >>>>=20 >>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>> >>>> = > >>>>> wrote: >>>>>=20 >>>>> OK, you talked me into indulging in one more message on policy and = use >>>>> cases. >>>>>=20 >>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>> individual devices as well as multi-device and multi-number = platforms. >>>>>=20 >>>>> Number delegation (and sub-delegation), and business relationships = are >>>>> two additional factors which affect trustworthiness of a given = calling >>>>> number authentication. >>>>>=20 >>>>> Inherent variable trustworthiness of a calling number was my = reason >>>>> for suggesting a way to qualify the signature to reflect that >>>>> variability. >>>>>=20 >>>>> Originating carriers are in a position to know if a call is coming >>>>> from a device assigned a single number, or from =93trunk group=94 = which >>>>> could originate calls using multiple numbers, and can qualify to = some >>>>> degree the trustworthiness of number authenticity accordingly. >>>>>=20 >>>>> My suggestion was qualifying calling number authenticity into >>>>> categories of carrier-signed (or not), and unauthenticated, >>>>> semi-authenticated, and most-authenticated. There can be more >>>>> granularity, but it implies additional operational complexity = (both >>>>> for the carriers and the consumers) and I assume diminishes value. >>>>>=20 >>>>> My reason for adding the authenticity of the originating carrier = is >>>>> typical trustworthiness of a carrier business relationship with >>>>> typical consumers adds to the trustworthiness assessment and = partially >>>>> because carriers are a regulated point of forensic inquiry for = CALEA >>>>> and fraud. Additionally, most calls originate and terminate = between >>>>> mobile consumers where their carriers are able to usefully >>>>> authenticate their device and have a high degree of confidence of = the >>>>> authenticity of the calling number. >>>>>=20 >>>>> I think billions of per-TN certs of varying usability (revoked, = not >>>>> revoked) for authenticating calling number will not work well. >>>>>=20 >>>>> Conversely, I think billions of per-TN certs will work well, if = the >>>>> calling party has to sign a call with a per-TN cert provided by = the >>>>> called party. No called party cert to include? Then the calling >>>>> party does not have a trusted relationship with the called party, = and >>>>> the call can be authorized/treated accordingly. (I=92ve made = similar, >>>>> mostly ignored comments in MODERN.) >>>>>=20 >>>>> Pierce >>>>>=20 >>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>> *Sent:* August 04, 2016 2:03 PM >>>>> *To:* Gorman, Pierce A [CTO] >>>> >>>>> > >>>>> *Cc:* Alex Bobotek >>>> >; >>>>> stir@ietf.org >>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> Well, the mechanisms are designed so that they could be deployed = on >>>>> devices and PBXs. Whether they will be is a policy issue. >>>>>=20 >>>>> The notion of credentials that are traceable to a delegation of a = TN >>>>> is a mechanism that is part of the design of stir, and the design >>>>> allows delegation of one TN (to one device, although a device like = a >>>>> PBX would have more than one TN per =93device=94, and something = like a >>>>> dual NAM phone could have more than one credential. For the use = case >>>>> we=92ve discussed, a mobile phone may also have a credential for, = say, a >>>>> TN that is delegated to a landline, to cover the example case of a >>>>> doctor placing a call on his mobile, but getting his office number = to >>>>> show up as the calling party. Use of such mechanisms is policy. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>=20 >>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>> >>>> = > >>>>> wrote: >>>>>=20 >>>>> Thanks Brian. I=92m afraid we=92re straying into a policy >>>>> discussion. Regardless, I do appreciate your explanation. I >>>>> would like to continue the discussion, but I=92m pretty sure = this >>>>> isn=92t the right forum. >>>>>=20 >>>>> Pierce >>>>>=20 >>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>> *Sent:* August 04, 2016 1:34 PM >>>>> *To:* Gorman, Pierce A [CTO] >>>> >>>>> > >>>>> *Cc:* Alex Bobotek >>>>> >; stir@ietf.org >>>>> >>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> Of course I want PBXs to sign calls. As well as smart phones = and >>>>> any other devices that can be programmed to do so. >>>>> They will be given credentials that only are valid for the TNs >>>>> they are authorized to sign for. They can try to sign any call, >>>>> but the validity of the credential would make such a signature >>>>> fail the checking. >>>>>=20 >>>>> Getting service providers to sign on behalf of devices is a >>>>> reasonable way to deploy quickly, but I expect many SPs will = want >>>>> to get out of the liability of signing on behalf of their >>>>> customers. If they can push of that responsibility to their >>>>> customer, only being responsible for getting the customer an >>>>> appropriate credential when they assign TNs, then I would expect >>>>> them to want to do so. That means the devices have to be able = to >>>>> sign, but I understand many of the PBX vendors think that=92s >>>>> something they could provide in a future release. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>=20 >>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>> >>>> = > >>>>> wrote: >>>>>=20 >>>>> You want IP PBXes to sign calls? Won=92t that make it >>>>> extraordinarily easy to commit fraud with authenticated = numbers? >>>>>=20 >>>>>=20 >>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>> *Sent:* August 04, 2016 12:24 PM >>>>> *To:* Gorman, Pierce A [CTO] >>>> >>>>> > >>>>> *Cc:* Alex Bobotek >>>>> >; stir@ietf.org >>>>> >>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> First of all, we would want the PBX to generate the = signature, >>>>> but the service provider can do that. It should not add a >>>>> valid signature to a call from a number it did not assign to >>>>> the trunk group connecting to the PBX, although it could >>>>> support the extra delegation required to support =93authorized= >>>>> spoofing=94. The companion devices I=92m aware of always = send >>>>> calls from the same service provider and should not present >>>>> any issue. >>>>>=20 >>>>> Everyone will have to do work they don=92t do now to = implement >>>>> stop spoofed calls. TANSTAAFL >>>>>=20 >>>>> Brian >>>>>=20 >>>>>=20 >>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>> >>>>> > wrote: >>>>>=20 >>>>> Fraud from compromised PBXes is common. And even where = a >>>>> PBX is not compromised, a carrier has no practical way = of >>>>> knowing whether the calling number is properly assigned >>>>> and valid from the perspective of the Enterprise. >>>>> Therefore, checking whether the calling number was from = an >>>>> assigned range might be possible (and fraught with >>>>> administrative challenges), but of limited value. And = in >>>>> the consumer market, there are calling products which >>>>> support a parent subscriber number and =93companion=94 = devices >>>>> (e.g., tablets) which can place a call using the MDN of >>>>> the parent subscriber. These are examples of where the >>>>> authenticity of the calling number won=92t necessarily = mean >>>>> the same thing as the authenticity of a call from a = single >>>>> subscriber with a single MDN regardless of =93laxity=94 = of >>>>> spoof checking. >>>>>=20 >>>>> In another forum and anticipating calling number >>>>> authentication mandates from Congress and/or FCC, I >>>>> suggested using carrier-specific certs and encoding >>>>> specificity of authenticity, and calling number. This >>>>> provides the identity of the originating carrier, some >>>>> idea as to the accuracy or specificity of the calling >>>>> number, and validty of the calling number (assuming = nonce >>>>> and replay issues can be addressed as reasonably = suggested >>>>> below by Alex). >>>>>=20 >>>>> The representation of orig-carrier and trustworthiness >>>>> could be as follows: >>>>>=20 >>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>=20 >>>>> *00 - No Credentials* >>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>> networks that don't natively support SIP or which don't >>>>> choose to sign calls. E.g., international carriers. >>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>> entirely untrustworthy. >>>>>=20 >>>>> *01 - Carrier signed, no authentication of CgPN* >>>>> Use case example(s): E911 on visited network w/o roaming >>>>> agreement, manual roaming. >>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>> untrustworthy >>>>>=20 >>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>> Use case example(s): Number block delegated from OCN, = but >>>>> no per-TN screen (SIP trunks). >>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less = than >>>>> most trustworthy but not entirely untrustworthy. >>>>>=20 >>>>> *11 - Carrier signed, authenticated CgPN* >>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>> subscriber lines (IMS-based and otherwise). >>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>> trustworthy >>>>>=20 >>>>> *Public Use Case:* >>>>>=20 >>>>> Undefined but assumed to use public or commercially >>>>> available authentication services resources. e.g., >>>>> nomorobo-like crowd-sourced accept/deny lists, et = cetera. >>>>> Could/would pass credentials down to SIP-aware devices >>>>> which would process them according to the rules of the >>>>> Public Class application(s). >>>>>=20 >>>>> Pierce >>>>>=20 >>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>> *Sent:* August 04, 2016 9:02 AM >>>>> *To:* Alex Bobotek >>>> >>>>> > >>>>> *Cc:* stir@ietf.org >>>>> >>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> There are reasonable circumstances where a party placing = a >>>>> call is not the authorized entity assigned the telephone >>>>> number used in From/PAI, and in such circumstances the >>>>> service provider servicing the entity placing the call = may >>>>> or may not be the same as the service provider serving = the >>>>> entity that is assigned the TN. In all such cases, the >>>>> entity that is assigned the TN explicitly authorizes = calls >>>>> placed using it=92s TN. The design accommodates such = use >>>>> cases. It=92s not a blanket authorization without >>>>> authentication. We=92re not aware of any cases where = there >>>>> is an actual requirement for legitimate calling without >>>>> explicit authorization from the assigned entity, = although >>>>> we certainly are aware that various parts of various >>>>> service providers don=92t bother to check. At this = point, at >>>>> least in some countries, there is a realization that the >>>>> laxity of allowing unchecked spoofing is not acceptable >>>>> any more. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>=20 >>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>> >>>> > wrote: >>>>>=20 >>>>> 1. Permit authorization without authentication >>>>> In the current telephony network practice, some >>>>> service provider implementations choose not to >>>>> authenticate identity, but simply facilitate the use >>>>> of an arbitrary or selected user-provided identity. >>>>> Are there legitimate use cases for this? Has anyone >>>>> established that there are not? How can the = industry >>>>> reasonably expect to end this (often bad) practice? >>>>> If it can=92t be ended, there=92s value in at least >>>>> identifying the originating service provider >>>>> (i.e., the signer/authorizer). Given the prevalence >>>>> of abuse using telephone numbers assigned to a >>>>> sometimes-anonymous abuser, it becomes critically >>>>> important to identify the service provider(s) = closest >>>>> to the abuser. Based on the assumption that it=92s >>>>> better to ID service providers than unreasonably >>>>> expect a ban of the use of unauthenticated (and >>>>> therefore unsigned) SIP requests, STIR signing = should >>>>> support authorization without authentication. The >>>>> practice of authorizing unauthenticated use exists, >>>>> and there is benefit to signing in these cases >>>>> (service provider identification). The language of >>>>> the ID should permit this use. 4474bis-10 should = NOT >>>>> require or assume that that authentication will >>>>> precede authorization. Of course there may be other >>>>> use cases where signing includes authentication and >>>>> may not include a specific service provider=92s >>>>> authorization. >>>>>=20 >>>>>=20 >>>>> 2. Improve replay prevention >>>>> Proximate replay is possible while complying with = this >>>>> spec. First, one or more proximate (e.g., within 60 >>>>> seconds) SIP requests using the same token are legal >>>>> and subject to replay in many cases. An SDP body=92s >>>>> mky may not be present and if present its use is >>>>> optional. Some sort of mandatory new or existing >>>>> signed sequence, random # or request ID (e.g., = Call-ID >>>>> or CSeq) and a 1-time use policy on the receiving = end >>>>> of the request (e.g., tokens only good for 1 >>>>> use) could prevent replay. Different methods (e.g., >>>>> INVITE vs MESSAGE) might be handled by different >>>>> receiving infrastructure, and therefore difficulties >>>>> with =91it=92s been used already=92 coordination = allow a >>>>> faked MESSAGE based on a captured request. This = might >>>>> include an mkey from a captured INVITE. So it may = be >>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>> captured identity. While large-scale or distributed >>>>> implementations may make the enforcement difficult, >>>>> there is little cost to signing and decoding a = method >>>>> and possibly a numeric ID. Some sort of =911-use=92 >>>>> practice should at least be discussed while perhaps >>>>> not required. >>>>>=20 >>>>>=20 >>>>> Specific markup suggestions: >>>>>=20 >>>>>=20 >>>>> NITS >>>>>=20 >>>>>=20 >>>>> The verifier MUST inspect any optional "ppt" >>>>> parameter appearing *in*the >>>>>=20 >>>>> Identity request. If no "ppt" parameter is >>>>> present, then the >>>>>=20 >>>>> verifier proceeds normally below. If a "ppt" >>>>> parameter value is >>>>>=20 >>>>> present, and the verifier does not support it, it >>>>> MUST ignore the >>>>>=20 >>>>> Identity header. If a supported "ppt" parameter >>>>> value is present, >>>>>=20 >>>>> the verifier follows the procedures below, >>>>> including the variations >>>>>=20 >>>>> described in Step 5. >>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>> 3 >>>>> = . >>>>> Background >>>>>=20 >>>>> [=85] >>>>>=20 >>>>>=20 >>>>>=20 >>>>> Per [RFC7340 >>>>> ], problems such as >>>>> robocalling, voicemail hacking, and >>>>>=20 >>>>> swatting are enabled by an attacker's ability to >>>>> impersonate someone >>>>>=20 >>>>> else. The secure operation of most SIP >>>>> applications and services >>>>>=20 >>>>> depends on authenticating and/or authorizing the >>>>> source of communications as it is >>>>>=20 >>>>> represented in a SIP request. >>>>>=20 >>>>>=20 >>>>>=20 >>>>> This identity architecture for SIP depends on >>>>> includes provisions for a logical >>>>>=20 >>>>> "authentication service" which validates caller >>>>> identity at or near origination. outgoing >>>>> requests. An >>>>>=20 >>>>> authentication service may be implemented either >>>>> as part of a user >>>>>=20 >>>>> agent or as a proxy server; typically, it is a >>>>> component of a network >>>>>=20 >>>>> intermediary like a proxy to which originating >>>>> user agents send >>>>>=20 >>>>> unsigned requests. Once the sender of the = message >>>>> has been >>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>> This document specifies a means of sharing a >>>>> cryptographic assurance >>>>>=20 >>>>> of authenticity of and/or authorization to use >>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>=20 >>>>> It relies on the authentication service >>>>> constructing tokens based on [=85] >>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>> To maximize end-to-end security, it is typically >>>>> obviously >>>>>=20 >>>>> preferable for end-users to acquire their own >>>>> credentials; if they >>>>>=20 >>>>> do, their user agents can act as authentication >>>>> services. However, >>>>>=20 >>>>> for some deployments, [=85] >>>>>=20 >>>>>=20 >>>>>=20 >>>>> Regards, >>>>>=20 >>>>> Alex >>>>> * * >>>>> *Alex Bobotek* >>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>=20 >>>>>=20 >>>>>=20 >>>>> = ------------------------------------------------------------------------ >>>>>=20 >>>>> This e-mail may contain Sprint proprietary information >>>>> intended for the sole use of the recipient(s). Any use = by >>>>> others is prohibited. If you are not the intended >>>>> recipient, please contact the sender and delete all = copies >>>>> of the message. >>>>=20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Thu Aug 4 15:11:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCE15126579 for ; Thu, 4 Aug 2016 15:11:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GcYdXwxY0YuT for ; Thu, 4 Aug 2016 15:11:51 -0700 (PDT) Received: from resqmta-ch2-07v.sys.comcast.net (resqmta-ch2-07v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7839A12DB2E for ; Thu, 4 Aug 2016 15:11:51 -0700 (PDT) Received: from resomta-ch2-19v.sys.comcast.net ([69.252.207.115]) by resqmta-ch2-07v.sys.comcast.net with SMTP id VQrGb7XAhff8qVQrmbuAlY; Thu, 04 Aug 2016 22:11:50 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VQrlbDBTvkIEeVQrmbJABg; Thu, 04 Aug 2016 22:11:50 +0000 To: Brian Rosen References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> From: Paul Kyzivat Message-ID: <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> Date: Thu, 4 Aug 2016 18:11:48 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfAoCKPjSxzxKSeIG2sePBONQpHm9FvgXsemRLzZOXW7W/DCvF2IU4qu+AfomNpEd9eQ2qGbENZ6V5RRznHBZ8NpUI7taFIPwaaWPnYYAaoXEOp3Vd9vN hcSszqvuUGWnweGtZong652DouL6CMf8SLMFzlVsjNtWKDiWVQIQoxFLbEPdMAQUqB/OukEFUAo0Knl4T20KdSPXNFO/ByNEkTM= Archived-At: Cc: stir@ietf.org Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Aug 2016 22:11:54 -0000 On 8/4/16 6:02 PM, Brian Rosen wrote: > I think its not a delegation. The mobile phone is not being delegated the TN, its being authorized to place calls that are not from that TN, but appear to be. > > The mechanism to handle the credential is exactly the same as a delegation, so if you want to call it delegation, go ahead, but I prefer to call it authorized spoofing. IIUC the delegation is to a responsible entity (something that can be held legally accountable - e.g. a person), not to a device. The entity can then "use" the credential via any device(s) it chooses. In the case of the mobile, the device then becomes a two-line phone. Thanks, Paul > Brian > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: >> >> On 8/4/16 5:43 PM, Brian Rosen wrote: >>> In my jargon an authorized spoofer is the doctor who is calling from >>> his mobile, but sending the TN of his office phone as calling party. >>> The delegation to his office phone was made by his landline carrier to >>> him. He then creates another credential, which he signs with his office >>> phone credential that authorizes his mobile to send calls from his >>> office number. He is spoofing (because the call is coming from his >>> mobiles TN but claims to be from his office), but its authorized >>> spoofing. The doc could give the credential to his mobile SP if they >>> sign on his behalf. >> >> I don't understand how that is different from regular delegation. >> >> When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. >> >> Thanks, >> Paul >> >>> Some folks dont like attaching the spoofing label to a legitimate use. >>> >>> But thats how I describe it. >>> >>> Brian >>> >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>> > wrote: >>>> >>>> +1, but with one question below: >>>> >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>> I think all we need is to have credentials follow the delegation path, >>>> >>>>> plus the option to add another level (not delegation) for authorized >>>>> spoofers. >>>> >>>> I don't understand "authorized spoofers" in this context, as >>>> contrasted to "spoofers" who have been delegated their authority. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> I dont think it matters who the delegator or delegatee are as long as >>>>> the delegator is willing to take the heat for delegating to someone who >>>>> sends a lot of bad calls. They can pass the buck (I delegated the TN >>>>> to him, and now Im not responsible), but only if the SP knows who they >>>>> delegated to, so authorities can follow the delegation path. There are >>>>> plenty of certificated carriers who are willing to not care who they >>>>> delegate to. The fact that there are some who do doesnt change much. >>>>> Making stir work means knowing who you are delegating to, so that you >>>>> can pass the hot potato. >>>>> >>>>> Its perfectly reasonable for a carrier to be able to sign for any calls >>>>> placed on its network on any number it has been delegated. If it does, >>>>> its asserting that the calls are from who they are supposed to be from. >>>>> That should be straightforward, but we know its not always, and that >>>>> represents the hard part of deployment in my opinion. But once they >>>>> delegate, they can hand responsibility to sign to the delegatee. But, >>>>> that only works if they know who they are delegating to. >>>>> >>>>> The root of the whole model is that there is a formal or informal >>>>> delegation path for telephone numbers in every country, and we can build >>>>> a chain of trust from that delegation path. If you propose to alter >>>>> that model, then we get into (policy) issues of which carriers/entities >>>>> we trust and which we dont. Our model is that you know who you >>>>> delegate to, and once you do that delegation, its their problem. >>>>> Thats pretty appealing I think, even if its a change in some business >>>>> practices. >>>>> >>>>> The mechanism is chaining credentials in a form of a PKI and having a >>>>> way to know which TNs are covered by a credential. Thats what we have, >>>>> and Im loath to change it. >>>>> >>>>> Brian >>>>> >>>>> >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> > >>>>>> wrote: >>>>>> >>>>>> OK, you talked me into indulging in one more message on policy and use >>>>>> cases. >>>>>> >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>>> individual devices as well as multi-device and multi-number platforms. >>>>>> >>>>>> Number delegation (and sub-delegation), and business relationships are >>>>>> two additional factors which affect trustworthiness of a given calling >>>>>> number authentication. >>>>>> >>>>>> Inherent variable trustworthiness of a calling number was my reason >>>>>> for suggesting a way to qualify the signature to reflect that >>>>>> variability. >>>>>> >>>>>> Originating carriers are in a position to know if a call is coming >>>>>> from a device assigned a single number, or from trunk group which >>>>>> could originate calls using multiple numbers, and can qualify to some >>>>>> degree the trustworthiness of number authenticity accordingly. >>>>>> >>>>>> My suggestion was qualifying calling number authenticity into >>>>>> categories of carrier-signed (or not), and unauthenticated, >>>>>> semi-authenticated, and most-authenticated. There can be more >>>>>> granularity, but it implies additional operational complexity (both >>>>>> for the carriers and the consumers) and I assume diminishes value. >>>>>> >>>>>> My reason for adding the authenticity of the originating carrier is >>>>>> typical trustworthiness of a carrier business relationship with >>>>>> typical consumers adds to the trustworthiness assessment and partially >>>>>> because carriers are a regulated point of forensic inquiry for CALEA >>>>>> and fraud. Additionally, most calls originate and terminate between >>>>>> mobile consumers where their carriers are able to usefully >>>>>> authenticate their device and have a high degree of confidence of the >>>>>> authenticity of the calling number. >>>>>> >>>>>> I think billions of per-TN certs of varying usability (revoked, not >>>>>> revoked) for authenticating calling number will not work well. >>>>>> >>>>>> Conversely, I think billions of per-TN certs will work well, if the >>>>>> calling party has to sign a call with a per-TN cert provided by the >>>>>> called party. No called party cert to include? Then the calling >>>>>> party does not have a trusted relationship with the called party, and >>>>>> the call can be authorized/treated accordingly. (Ive made similar, >>>>>> mostly ignored comments in MODERN.) >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>> >; >>>>>> stir@ietf.org >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Well, the mechanisms are designed so that they could be deployed on >>>>>> devices and PBXs. Whether they will be is a policy issue. >>>>>> >>>>>> The notion of credentials that are traceable to a delegation of a TN >>>>>> is a mechanism that is part of the design of stir, and the design >>>>>> allows delegation of one TN (to one device, although a device like a >>>>>> PBX would have more than one TN per device, and something like a >>>>>> dual NAM phone could have more than one credential. For the use case >>>>>> weve discussed, a mobile phone may also have a credential for, say, a >>>>>> TN that is delegated to a landline, to cover the example case of a >>>>>> doctor placing a call on his mobile, but getting his office number to >>>>>> show up as the calling party. Use of such mechanisms is policy. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> > >>>>>> wrote: >>>>>> >>>>>> Thanks Brian. Im afraid were straying into a policy >>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>> would like to continue the discussion, but Im pretty sure this >>>>>> isnt the right forum. >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>>> >; stir@ietf.org >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Of course I want PBXs to sign calls. As well as smart phones and >>>>>> any other devices that can be programmed to do so. >>>>>> They will be given credentials that only are valid for the TNs >>>>>> they are authorized to sign for. They can try to sign any call, >>>>>> but the validity of the credential would make such a signature >>>>>> fail the checking. >>>>>> >>>>>> Getting service providers to sign on behalf of devices is a >>>>>> reasonable way to deploy quickly, but I expect many SPs will want >>>>>> to get out of the liability of signing on behalf of their >>>>>> customers. If they can push of that responsibility to their >>>>>> customer, only being responsible for getting the customer an >>>>>> appropriate credential when they assign TNs, then I would expect >>>>>> them to want to do so. That means the devices have to be able to >>>>>> sign, but I understand many of the PBX vendors think thats >>>>>> something they could provide in a future release. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> > >>>>>> wrote: >>>>>> >>>>>> You want IP PBXes to sign calls? Wont that make it >>>>>> extraordinarily easy to commit fraud with authenticated numbers? >>>>>> >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>>> >; stir@ietf.org >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> First of all, we would want the PBX to generate the signature, >>>>>> but the service provider can do that. It should not add a >>>>>> valid signature to a call from a number it did not assign to >>>>>> the trunk group connecting to the PBX, although it could >>>>>> support the extra delegation required to support authorized >>>>>> spoofing. The companion devices Im aware of always send >>>>>> calls from the same service provider and should not present >>>>>> any issue. >>>>>> >>>>>> Everyone will have to do work they dont do now to implement >>>>>> stop spoofed calls. TANSTAAFL >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>> >>>>>> > wrote: >>>>>> >>>>>> Fraud from compromised PBXes is common. And even where a >>>>>> PBX is not compromised, a carrier has no practical way of >>>>>> knowing whether the calling number is properly assigned >>>>>> and valid from the perspective of the Enterprise. >>>>>> Therefore, checking whether the calling number was from an >>>>>> assigned range might be possible (and fraught with >>>>>> administrative challenges), but of limited value. And in >>>>>> the consumer market, there are calling products which >>>>>> support a parent subscriber number and companion devices >>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>> the parent subscriber. These are examples of where the >>>>>> authenticity of the calling number wont necessarily mean >>>>>> the same thing as the authenticity of a call from a single >>>>>> subscriber with a single MDN regardless of laxity of >>>>>> spoof checking. >>>>>> >>>>>> In another forum and anticipating calling number >>>>>> authentication mandates from Congress and/or FCC, I >>>>>> suggested using carrier-specific certs and encoding >>>>>> specificity of authenticity, and calling number. This >>>>>> provides the identity of the originating carrier, some >>>>>> idea as to the accuracy or specificity of the calling >>>>>> number, and validty of the calling number (assuming nonce >>>>>> and replay issues can be addressed as reasonably suggested >>>>>> below by Alex). >>>>>> >>>>>> The representation of orig-carrier and trustworthiness >>>>>> could be as follows: >>>>>> >>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>> >>>>>> *00 - No Credentials* >>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>> networks that don't natively support SIP or which don't >>>>>> choose to sign calls. E.g., international carriers. >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>> entirely untrustworthy. >>>>>> >>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>> agreement, manual roaming. >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>> untrustworthy >>>>>> >>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>> Use case example(s): Number block delegated from OCN, but >>>>>> no per-TN screen (SIP trunks). >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>> most trustworthy but not entirely untrustworthy. >>>>>> >>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>> subscriber lines (IMS-based and otherwise). >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>> trustworthy >>>>>> >>>>>> *Public Use Case:* >>>>>> >>>>>> Undefined but assumed to use public or commercially >>>>>> available authentication services resources. e.g., >>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>> Could/would pass credentials down to SIP-aware devices >>>>>> which would process them according to the rules of the >>>>>> Public Class application(s). >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>> *To:* Alex Bobotek >>>>> >>>>>> > >>>>>> *Cc:* stir@ietf.org >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> There are reasonable circumstances where a party placing a >>>>>> call is not the authorized entity assigned the telephone >>>>>> number used in From/PAI, and in such circumstances the >>>>>> service provider servicing the entity placing the call may >>>>>> or may not be the same as the service provider serving the >>>>>> entity that is assigned the TN. In all such cases, the >>>>>> entity that is assigned the TN explicitly authorizes calls >>>>>> placed using its TN. The design accommodates such use >>>>>> cases. Its not a blanket authorization without >>>>>> authentication. Were not aware of any cases where there >>>>>> is an actual requirement for legitimate calling without >>>>>> explicit authorization from the assigned entity, although >>>>>> we certainly are aware that various parts of various >>>>>> service providers dont bother to check. At this point, at >>>>>> least in some countries, there is a realization that the >>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>> any more. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>> >>>>> > wrote: >>>>>> >>>>>> 1. Permit authorization without authentication >>>>>> In the current telephony network practice, some >>>>>> service provider implementations choose not to >>>>>> authenticate identity, but simply facilitate the use >>>>>> of an arbitrary or selected user-provided identity. >>>>>> Are there legitimate use cases for this? Has anyone >>>>>> established that there are not? How can the industry >>>>>> reasonably expect to end this (often bad) practice? >>>>>> If it cant be ended, theres value in at least >>>>>> identifying the originating service provider >>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>> of abuse using telephone numbers assigned to a >>>>>> sometimes-anonymous abuser, it becomes critically >>>>>> important to identify the service provider(s) closest >>>>>> to the abuser. Based on the assumption that its >>>>>> better to ID service providers than unreasonably >>>>>> expect a ban of the use of unauthenticated (and >>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>> support authorization without authentication. The >>>>>> practice of authorizing unauthenticated use exists, >>>>>> and there is benefit to signing in these cases >>>>>> (service provider identification). The language of >>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>> require or assume that that authentication will >>>>>> precede authorization. Of course there may be other >>>>>> use cases where signing includes authentication and >>>>>> may not include a specific service providers >>>>>> authorization. >>>>>> >>>>>> >>>>>> 2. Improve replay prevention >>>>>> Proximate replay is possible while complying with this >>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>> seconds) SIP requests using the same token are legal >>>>>> and subject to replay in many cases. An SDP bodys >>>>>> mky may not be present and if present its use is >>>>>> optional. Some sort of mandatory new or existing >>>>>> signed sequence, random # or request ID (e.g., Call-ID >>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>> of the request (e.g., tokens only good for 1 >>>>>> use) could prevent replay. Different methods (e.g., >>>>>> INVITE vs MESSAGE) might be handled by different >>>>>> receiving infrastructure, and therefore difficulties >>>>>> with its been used already coordination allow a >>>>>> faked MESSAGE based on a captured request. This might >>>>>> include an mkey from a captured INVITE. So it may be >>>>>> possible to DOS, spam or text-bomb a recipient using a >>>>>> captured identity. While large-scale or distributed >>>>>> implementations may make the enforcement difficult, >>>>>> there is little cost to signing and decoding a method >>>>>> and possibly a numeric ID. Some sort of 1-use >>>>>> practice should at least be discussed while perhaps >>>>>> not required. >>>>>> >>>>>> >>>>>> Specific markup suggestions: >>>>>> >>>>>> >>>>>> NITS >>>>>> >>>>>> >>>>>> The verifier MUST inspect any optional "ppt" >>>>>> parameter appearing *in*the >>>>>> >>>>>> Identity request. If no "ppt" parameter is >>>>>> present, then the >>>>>> >>>>>> verifier proceeds normally below. If a "ppt" >>>>>> parameter value is >>>>>> >>>>>> present, and the verifier does not support it, it >>>>>> MUST ignore the >>>>>> >>>>>> Identity header. If a supported "ppt" parameter >>>>>> value is present, >>>>>> >>>>>> the verifier follows the procedures below, >>>>>> including the variations >>>>>> >>>>>> described in Step 5. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> 3 >>>>>> . >>>>>> Background >>>>>> >>>>>> [] >>>>>> >>>>>> >>>>>> >>>>>> Per [RFC7340 >>>>>> ], problems such as >>>>>> robocalling, voicemail hacking, and >>>>>> >>>>>> swatting are enabled by an attacker's ability to >>>>>> impersonate someone >>>>>> >>>>>> else. The secure operation of most SIP >>>>>> applications and services >>>>>> >>>>>> depends on authenticating and/or authorizing the >>>>>> source of communications as it is >>>>>> >>>>>> represented in a SIP request. >>>>>> >>>>>> >>>>>> >>>>>> This identity architecture for SIP depends on >>>>>> includes provisions for a logical >>>>>> >>>>>> "authentication service" which validates caller >>>>>> identity at or near origination. outgoing >>>>>> requests. An >>>>>> >>>>>> authentication service may be implemented either >>>>>> as part of a user >>>>>> >>>>>> agent or as a proxy server; typically, it is a >>>>>> component of a network >>>>>> >>>>>> intermediary like a proxy to which originating >>>>>> user agents send >>>>>> >>>>>> unsigned requests. Once the sender of the message >>>>>> has been >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> This document specifies a means of sharing a >>>>>> cryptographic assurance >>>>>> >>>>>> of authenticity of and/or authorization to use >>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>> >>>>>> It relies on the authentication service >>>>>> constructing tokens based on [] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> To maximize end-to-end security, it is typically >>>>>> obviously >>>>>> >>>>>> preferable for end-users to acquire their own >>>>>> credentials; if they >>>>>> >>>>>> do, their user agents can act as authentication >>>>>> services. However, >>>>>> >>>>>> for some deployments, [] >>>>>> >>>>>> >>>>>> >>>>>> Regards, >>>>>> >>>>>> Alex >>>>>> * * >>>>>> *Alex Bobotek* >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> >>>>>> >>>>>> ------------------------------------------------------------------------ >>>>>> >>>>>> This e-mail may contain Sprint proprietary information >>>>>> intended for the sole use of the recipient(s). Any use by >>>>>> others is prohibited. If you are not the intended >>>>>> recipient, please contact the sender and delete all copies >>>>>> of the message. >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > From nobody Thu Aug 4 23:45:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F35BC12B01D for ; Thu, 4 Aug 2016 23:45:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sJBisOE4oAMm for ; Thu, 4 Aug 2016 23:45:35 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C041F127071 for ; Thu, 4 Aug 2016 23:45:34 -0700 (PDT) X-AuditID: c1b4fb2d-bd3fb70000000190-c9-57a4360b0688 Received: from ESESSHC008.ericsson.se (Unknown_Domain [153.88.183.42]) by (Symantec Mail Security) with SMTP id 27.74.00400.B0634A75; Fri, 5 Aug 2016 08:45:33 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.142]) by ESESSHC008.ericsson.se ([153.88.183.42]) with mapi id 14.03.0301.000; Fri, 5 Aug 2016 08:45:30 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Paul Kyzivat Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR7nIUk69kv+WAF0qaS4iCLGS8A6A5ASuAgADr2rw= Date: Fri, 5 Aug 2016 06:45:29 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu>, In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B47723C55ESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprIIsWRmVeSWpSXmKPExsUyM2K7li6v2ZJwg8Nd7Ba/P31gs1ix4QCr xfK125gcmD3+vv/A5HFp50k2jyVLfjIFMEdx2aSk5mSWpRbp2yVwZSxrP8xU8FezouvMK9YG xt/KXYycHBICJhLdd/+zdDFycQgJrGeUeLfwEZSzmFFiWdNcIIeDg03AQqL7nzZIg4hAsMSe E7vYQMLMAsoS/3bbg4SFBQIlmnrbGCFKgiReH/zLDmFbSfzc3cIGYrMIqEjs+LeeGcTmFfCV uPmxmRFi1UtmiVl73rGDzOQUcJC4dkIQpIZRQEzi+6k1TCA2s4C4RNOXlawQNwtILNlznhnC FpV4+fgfK0RNvsT+t90sEPMFJU7OfMIygVF4FpL2WUjKZiEpg4gbSHx5fxvK1pZYtvA1M4St L9H9/jQTsvgCRvZVjKLFqcXFuelGxnqpRZnJxcX5eXp5qSWbGIERdXDLb90djKtfOx5iFOBg VOLhXdC0OFyINbGsuDL3EKMEB7OSCK+v0ZJwId6UxMqq1KL8+KLSnNTiQ4zSHCxK4rz+LxXD hQTSE0tSs1NTC1KLYLJMHJxSDYxrhV4FfH54S2eb15mFATFbI9e3zhcpFqgKkeWwW9Yns33Z yodTWiZvf6tcmW95hell1p6HZ6vDfq7uMJ6+bt4hvSfsl2ZbTqjnOlxys8V8wqH9xhVRDnq9 qddZP67n/KHi+zbkWJum4T7lMxPFTvx7teE4c2hz9Z29Dw7LPC4+yN20e8qtCyLBSizFGYmG WsxFxYkA0m7x7qQCAAA= Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 06:45:37 -0000 --_000_7594FB04B1934943A5C02806D1A2204B47723C55ESESSMB209erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi, The receiver needs to be able to parse JSON if the sender includes the clai= ms, in order to verify the signature. Also, whatever headers we include, I assume the receiver should be able to = parse them. But, parsing JSON is not a difficult thing to do, and there are available l= ibraries for those who don't want to implement the parser themselves. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD04/=FD08/=FD2016 21:41 To: Paul Kyzivat Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) On 8/4/2016 10:03 AM, Paul Kyzivat wrote: > I have been loosely following this discussion. IIUC, one of Dave's > arguments is that SIP implementations don't currently involve JSON, so > introducing it with STIR will further complicate those implementations. > > But, again IIUC, the use of JSON with passport doesn't require anyone to > *parse* JSON. It is only necessary to *generate* a very special purpose > JSON and then generate a signature over it. Clever point. I think you are correct, except for the contents of the so-called "ppt" parameter, which does require parsing. Now about JWT...? From my reading, so far, I suspect the answer for JWT is the same as for JSON? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_7594FB04B1934943A5C02806D1A2204B47723C55ESESSMB209erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi,

The receiver needs to be able to parse JSON if the sender includes the clai= ms, in order to verify the signature.

Also, whatever headers we include, I assume the receiver should be able to = parse them.

But, parsing JSON is not a difficult thing to do, and there are available l= ibraries for those who don't want to implement the parser themselves.

Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD04= /=FD08/=FD2016 21:41
To: Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
On 8/4/2016 10:03 AM, Paul Kyzivat wrote:
> I have been loosely following this discussion. IIUC, one of Dave's
> arguments is that SIP implementations don't currently involve JSON, so=
> introducing it with STIR will further complicate those implementations= .
>
> But, again IIUC, the use of JSON with passport doesn't require anyone = to
> *parse* JSON. It is only necessary to *generate* a very special purpos= e
> JSON and then generate a signature over it.


Clever point.  I think you are correct, except for the contents of the=
so-called "ppt" parameter, which does require parsing.

Now about JWT...?  From my reading, so far, I suspect the answer for J= WT
is the same as for JSON?



d/
--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org= /mailman/listinfo/stir
 --_000_7594FB04B1934943A5C02806D1A2204B47723C55ESESSMB209erics_-- From nobody Fri Aug 5 00:46:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9821312D131 for ; Fri, 5 Aug 2016 00:46:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h87Za1vedjzv for ; Fri, 5 Aug 2016 00:46:33 -0700 (PDT) Received: from mail1.bemta3.messagelabs.com (mail1.bemta3.messagelabs.com [195.245.230.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34C7712D11A for ; Fri, 5 Aug 2016 00:46:31 -0700 (PDT) Received: from [85.158.138.179] by server-13.bemta-3.messagelabs.com id 35/F3-06162-55444A75; Fri, 05 Aug 2016 07:46:29 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrEKsWRWlGSWpSXmKPExsVy+MWXdt0QlyX hBo+mWFk8vT+NzWLFhgOsFsvXbmNyYPb4+/4Dk8f9b3/ZPZYs+ckUwBzFmpmXlF+RwJrxY9Zf loL7Dxgr3p+ewNrA+GstYxcjJ4eQwF5GibWrQ7oYuYDsVYwSC//cYYdwVjBJTGj8DuUcYpQ4+ 34yM4SzkVHiw76fTCD9bAJOEvN3rwOzRQQ8JTr+3wCay8HBLKAs8W+3PUhYWEBH4s7NR+wQJb oSh469AJsjIjCJUeLX5MPMIAkWARWJvefPMIH08gqEShxaXwGx6yGbRMvSlWDzOQUcJK5d7gc bxCggK/GlcTVYL7OAuMStJ/PBaiQEBCSW7DnPDGGLSrx8/I8VokZHYsHuT2wQtrbEsoWvwWp4 BQQlTs58wjKBUWwWklGzkLTMQtIyC0nLAkaWVYzqxalFZalFuqZ6SUWZ6RkluYmZObqGBsZ6u anFxYnpqTmJScV6yfm5mxiBcVfPwMC4g/HyV6dDjJIcTEqivHmbF4cL8SXlp1RmJBZnxBeV5q QWH2KU4eBQkuC1cF4SLiRYlJqeWpGWmQNMADBpCQ4eJRHe/U5Aad7igsTc4sx0iNQpRkUpcd7 PIAkBkERGaR5cGyzpXGKUlRLmZWRgYBDiKUgtys0sQZV/xSjOwagkzOsIsp0nM68EbvoroMVM QIs/WoEtLklESEk1MJ5ZZ3VQeGqa1rM+piruyk3ClUee3pl6MLbDQtbpWn5j18xzG39dm+G5l /WV026DzddEfigEbJdgcH+it929gfn1qbCd+/6sijQ79j/qRqkn45y6pWr5J4sdZUqWFWUHrA 3bfNHs95Lz53VWqasduXrk3UW/WYcTrm9srpjhHrWON7LRVE4/tlOJpTgj0VCLuag4EQCcDTQ MNQMAAA== X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-10.tower-169.messagelabs.com!1470383188!50556815!1 X-Originating-IP: [195.232.244.135] X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 31231 invoked from network); 5 Aug 2016 07:46:28 -0000 Received: from mailout03.vodafone.com (HELO mailout03.vodafone.com) (195.232.244.135) by server-10.tower-169.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 5 Aug 2016 07:46:28 -0000 Received: from mailint03.vodafone.com (mailint03.vodafone.com [195.232.244.200]) by mailout03.vodafone.com (Postfix) with ESMTP id 3s5Jlm2sfxz17HLp; Fri, 5 Aug 2016 09:46:28 +0200 (CEST) Received: from mailint03.vodafone.com (localhost [127.0.0.1]) by mailint03.vodafone.com (Postfix) with ESMTP id 3s5Jlm1DNpz16LZ4; Fri, 5 Aug 2016 09:46:28 +0200 (CEST) Received: from VOEXC02W.internal.vodafone.com (voexc02w.dc-ratingen.de [145.230.101.22]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint03.vodafone.com (Postfix) with ESMTPS id 3s5Jlm0rfCz16Km3; Fri, 5 Aug 2016 09:46:28 +0200 (CEST) Received: from VOEXC15W.internal.vodafone.com (145.230.101.17) by VOEXC02W.internal.vodafone.com (145.230.101.22) with Microsoft SMTP Server (TLS) id 14.3.224.2; Fri, 5 Aug 2016 09:46:27 +0200 Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by voexc15w.internal.vodafone.com ([145.230.101.17]) with mapi id 14.03.0224.002; Fri, 5 Aug 2016 09:46:26 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Paul Kyzivat , Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AdHtnZL44XSdzpn5S4ezxStpcxWG/gAqmfuAAAWRJoAAAX9oAAACCpaAAABpDQAAAKK5AAAAWieAAAPgt4AAALpDgAAAzAAAAAA1foAAAEbIAAAAZjkAAABSQQAAF5txgA== Date: Fri, 5 Aug 2016 07:46:25 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> In-Reply-To: <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 07:46:41 -0000 Jumping in now that we're on European working time, +1 on Paul's observatio= n. Here in the UK, we've got 2 numbers carried as calling line IDs....one (we = term the Network Number, carried in PAID) uniquely identifies the line, the= other (we term Presentation Number, carried in From) is used for display p= urposes. Only the carrier has the authority to set the Network Number so only they c= ould sign it. =20 But - subject to regulatory restrictions which are well documented - the nu= mber sent for display purposes belongs to the customer. For blue-chip cust= omers, I can allow them to send their Presentation Numbers into the network= , and can't readily check at a network level that they're theirs (I do have= contractual safeguards). The number may have been allocated by me, or cou= ld be allocated by a third party provider. If it's a call-centre they'll b= e making outbound calls for lots of different customers which will change o= n day-by-day basis. This is business as usual. I don't like the term "aut= horised spoofing" because it implies that the CLI is in some way being rigg= ed: it's not, it's the corporate customer or their subcontractor using the = number that's been assigned (so in internet terms delegated) to them via a = chain of trust from the regulator. What I want is the ability for customers to use their credentials to sign t= he CLIs they send me so that at the terminating end it can be checked (or i= ndeed somewhere en-route if that's the business model). I can and would si= gn for customers on my mobile business since I'm driving what number is pre= sented, but that's by-the-by because they aren't the ones who generate mill= ions of nuisance calls. If the signing only occurs at the originating carr= ier level for corporate/call-centre customers that's no use because I'm not= in a position to do that for these type of customers...and the whole syste= m becomes a waste of time. I'd also highlight there are many more of my lar= ge customers that I'd trust more than a far end originating carrier that co= uld be anywhere in the world (though we have no shortage of small carriers = that I wouldn't know from Adam more locally in the UK....) Regards Paul -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat Sent: 04 August 2016 23:12 To: Brian Rosen Cc: stir@ietf.org Subject: Re: [stir] STIR 4474bis-10 comments On 8/4/16 6:02 PM, Brian Rosen wrote: > I think it's not a delegation. The mobile phone is not being delegated t= he TN, it's being authorized to place calls that are not from that TN, but = appear to be. > > The mechanism to handle the credential is exactly the same as a delegatio= n, so if you want to call it delegation, go ahead, but I prefer to call it = authorized spoofing. IIUC the delegation is to a responsible entity (something that can be held = legally accountable - e.g. a person), not to a device. The entity can then = "use" the credential via any device(s) it chooses. In the case of the mobil= e, the device then becomes a two-line phone. Thanks, Paul > Brian > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: >> >> On 8/4/16 5:43 PM, Brian Rosen wrote: >>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>> from his mobile, but sending the TN of his office phone as calling part= y. >>> The delegation to his office phone was made by his landline carrier=20 >>> to him. He then creates another credential, which he signs with his=20 >>> office phone credential that authorizes his mobile to send calls=20 >>> from his office number. He is spoofing (because the call is coming=20 >>> from his mobile's TN but claims to be from his office), but it's=20 >>> authorized spoofing. The doc could give the credential to his=20 >>> mobile SP if they sign on his behalf. >> >> I don't understand how that is different from regular delegation. >> >> When his landline carrier gave him a delegated certificate for his landl= ine number, he should be able to install that in whatever devices he wants = - his landline UA, his mobile phone, etc. It is still delegated from his la= ndline carrier, even when used with calls via his mobile carrier. >> >> Thanks, >> Paul >> >>> Some folks don't like attaching the "spoofing" label to a legitimate us= e. >>> >>> But that's how I describe it. >>> >>> Brian >>> >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>> > wrote: >>>> >>>> +1, but with one question below: >>>> >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>> I think all we need is to have credentials follow the delegation=20 >>>>> path, >>>> >>>>> plus the option to add another level (not delegation) for=20 >>>>> authorized spoofers. >>>> >>>> I don't understand "authorized spoofers" in this context, as=20 >>>> contrasted to "spoofers" who have been delegated their authority. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>> long as the delegator is willing to take the heat for delegating=20 >>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>> follow the delegation path. There are plenty of certificated=20 >>>>> carriers who are willing to not care who they delegate to. The fact = that there are some who do doesn't change much. >>>>> Making stir work means knowing who you are delegating to, so that=20 >>>>> you can pass the hot potato. >>>>> >>>>> It's perfectly reasonable for a carrier to be able to sign for any=20 >>>>> calls placed on its network on any number it has been delegated. =20 >>>>> If it does, it's asserting that the calls are from who they are suppo= sed to be from. >>>>> That should be straightforward, but we know it's not always, and=20 >>>>> that represents the hard part of deployment in my opinion. But=20 >>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>> delegatee. But, that only works if they know who they are delegating= to. >>>>> >>>>> The root of the whole model is that there is a formal or informal=20 >>>>> delegation path for telephone numbers in every country, and we can=20 >>>>> build a chain of trust from that delegation path. If you propose=20 >>>>> to alter that model, then we get into (policy) issues of which=20 >>>>> carriers/entities we trust and which we don't. Our model is that=20 >>>>> you know who you delegate to, and once you do that delegation, it's t= heir problem. >>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>> business practices. >>>>> >>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>> having a way to know which TNs are covered by a credential. =20 >>>>> That's what we have, and I'm loath to change it. >>>>> >>>>> Brian >>>>> >>>>> >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>> =20 >>>>>> > >>>>>> wrote: >>>>>> >>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>> and use cases. >>>>>> >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>> individual devices as well as multi-device and multi-number platform= s. >>>>>> >>>>>> Number delegation (and sub-delegation), and business=20 >>>>>> relationships are two additional factors which affect=20 >>>>>> trustworthiness of a given calling number authentication. >>>>>> >>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>> that variability. >>>>>> >>>>>> Originating carriers are in a position to know if a call is=20 >>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>> can qualify to some degree the trustworthiness of number authenticit= y accordingly. >>>>>> >>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>> granularity, but it implies additional operational complexity=20 >>>>>> (both for the carriers and the consumers) and I assume diminishes va= lue. >>>>>> >>>>>> My reason for adding the authenticity of the originating carrier=20 >>>>>> is typical trustworthiness of a carrier business relationship=20 >>>>>> with typical consumers adds to the trustworthiness assessment and=20 >>>>>> partially because carriers are a regulated point of forensic=20 >>>>>> inquiry for CALEA and fraud. Additionally, most calls originate=20 >>>>>> and terminate between mobile consumers where their carriers are=20 >>>>>> able to usefully authenticate their device and have a high degree=20 >>>>>> of confidence of the authenticity of the calling number. >>>>>> >>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>> not >>>>>> revoked) for authenticating calling number will not work well. >>>>>> >>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>> the calling party has to sign a call with a per-TN cert provided=20 >>>>>> by the called party. No called party cert to include? Then the=20 >>>>>> calling party does not have a trusted relationship with the=20 >>>>>> called party, and the call can be authorized/treated accordingly. =20 >>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> =20 >>>>>> > >>>>>> *Cc:* Alex Bobotek =20 >>>>>> >; stir@ietf.org =20 >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Well, the mechanisms are designed so that they could be deployed=20 >>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>> >>>>>> The notion of credentials that are traceable to a delegation of a=20 >>>>>> TN is a mechanism that is part of the design of stir, and the=20 >>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>> something like a dual NAM phone could have more than one=20 >>>>>> credential. For the use case we've discussed, a mobile phone may=20 >>>>>> also have a credential for, say, a TN that is delegated to a=20 >>>>>> landline, to cover the example case of a doctor placing a call on=20 >>>>>> his mobile, but getting his office number to show up as the calling = party. Use of such mechanisms is policy. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> =20 >>>>>> > >>>>>> wrote: >>>>>> >>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>> isn't the right forum. >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>>> >; stir@ietf.org=20 >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Of course I want PBXs to sign calls. As well as smart phones and >>>>>> any other devices that can be programmed to do so. >>>>>> They will be given credentials that only are valid for the TNs >>>>>> they are authorized to sign for. They can try to sign any call, >>>>>> but the validity of the credential would make such a signature >>>>>> fail the checking. >>>>>> >>>>>> Getting service providers to sign on behalf of devices is a >>>>>> reasonable way to deploy quickly, but I expect many SPs will want >>>>>> to get out of the liability of signing on behalf of their >>>>>> customers. If they can push of that responsibility to their >>>>>> customer, only being responsible for getting the customer an >>>>>> appropriate credential when they assign TNs, then I would expect >>>>>> them to want to do so. That means the devices have to be able to >>>>>> sign, but I understand many of the PBX vendors think that's >>>>>> something they could provide in a future release. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> > >>>>>> wrote: >>>>>> >>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>> extraordinarily easy to commit fraud with authenticated number= s? >>>>>> >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>>> >; stir@ietf.org=20 >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> First of all, we would want the PBX to generate the signature, >>>>>> but the service provider can do that. It should not add a >>>>>> valid signature to a call from a number it did not assign to >>>>>> the trunk group connecting to the PBX, although it could >>>>>> support the extra delegation required to support "authorized >>>>>> spoofing". The companion devices I'm aware of always send >>>>>> calls from the same service provider and should not present >>>>>> any issue. >>>>>> >>>>>> Everyone will have to do work they don't do now to implement >>>>>> stop spoofed calls. TANSTAAFL >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>> >>>>>> > wrote: >>>>>> >>>>>> Fraud from compromised PBXes is common. And even where a >>>>>> PBX is not compromised, a carrier has no practical way of >>>>>> knowing whether the calling number is properly assigned >>>>>> and valid from the perspective of the Enterprise. >>>>>> Therefore, checking whether the calling number was from an >>>>>> assigned range might be possible (and fraught with >>>>>> administrative challenges), but of limited value. And in >>>>>> the consumer market, there are calling products which >>>>>> support a parent subscriber number and "companion" devices >>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>> the parent subscriber. These are examples of where the >>>>>> authenticity of the calling number won't necessarily mean >>>>>> the same thing as the authenticity of a call from a single >>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>> spoof checking. >>>>>> >>>>>> In another forum and anticipating calling number >>>>>> authentication mandates from Congress and/or FCC, I >>>>>> suggested using carrier-specific certs and encoding >>>>>> specificity of authenticity, and calling number. This >>>>>> provides the identity of the originating carrier, some >>>>>> idea as to the accuracy or specificity of the calling >>>>>> number, and validty of the calling number (assuming nonce >>>>>> and replay issues can be addressed as reasonably suggested >>>>>> below by Alex). >>>>>> >>>>>> The representation of orig-carrier and trustworthiness >>>>>> could be as follows: >>>>>> >>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>> >>>>>> *00 - No Credentials* >>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>> networks that don't natively support SIP or which don't >>>>>> choose to sign calls. E.g., international carriers. >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>> entirely untrustworthy. >>>>>> >>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>> agreement, manual roaming. >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>> untrustworthy >>>>>> >>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>> Use case example(s): Number block delegated from OCN, but >>>>>> no per-TN screen (SIP trunks). >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>> most trustworthy but not entirely untrustworthy. >>>>>> >>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>> subscriber lines (IMS-based and otherwise). >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>> trustworthy >>>>>> >>>>>> *Public Use Case:* >>>>>> >>>>>> Undefined but assumed to use public or commercially >>>>>> available authentication services resources. e.g., >>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>> Could/would pass credentials down to SIP-aware devices >>>>>> which would process them according to the rules of the >>>>>> Public Class application(s). >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>> *To:* Alex Bobotek >>>>> >>>>>> > >>>>>> *Cc:* stir@ietf.org >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> There are reasonable circumstances where a party placing a >>>>>> call is not the authorized entity assigned the telephone >>>>>> number used in From/PAI, and in such circumstances the >>>>>> service provider servicing the entity placing the call may >>>>>> or may not be the same as the service provider serving the >>>>>> entity that is assigned the TN. In all such cases, the >>>>>> entity that is assigned the TN explicitly authorizes calls >>>>>> placed using it's TN. The design accommodates such use >>>>>> cases. It's not a blanket authorization without >>>>>> authentication. We're not aware of any cases where there >>>>>> is an actual requirement for legitimate calling without >>>>>> explicit authorization from the assigned entity, although >>>>>> we certainly are aware that various parts of various >>>>>> service providers don't bother to check. At this point, at >>>>>> least in some countries, there is a realization that the >>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>> any more. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>> >>>>> > wrote: >>>>>> >>>>>> 1. Permit authorization without authentication >>>>>> In the current telephony network practice, some >>>>>> service provider implementations choose not to >>>>>> authenticate identity, but simply facilitate the use >>>>>> of an arbitrary or selected user-provided identity. >>>>>> Are there legitimate use cases for this? Has anyone >>>>>> established that there are not? How can the industry >>>>>> reasonably expect to end this (often bad) practice? >>>>>> If it can't be ended, there's value in at least >>>>>> identifying the originating service provider >>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>> of abuse using telephone numbers assigned to a >>>>>> sometimes-anonymous abuser, it becomes critically >>>>>> important to identify the service provider(s) closest >>>>>> to the abuser. Based on the assumption that it's >>>>>> better to ID service providers than unreasonably >>>>>> expect a ban of the use of unauthenticated (and >>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>> support authorization without authentication. The >>>>>> practice of authorizing unauthenticated use exists, >>>>>> and there is benefit to signing in these cases >>>>>> (service provider identification). The language of >>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>> require or assume that that authentication will >>>>>> precede authorization. Of course there may be other >>>>>> use cases where signing includes authentication and >>>>>> may not include a specific service provider's >>>>>> authorization. >>>>>> >>>>>> >>>>>> 2. Improve replay prevention >>>>>> Proximate replay is possible while complying with this >>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>> seconds) SIP requests using the same token are legal >>>>>> and subject to replay in many cases. An SDP body's >>>>>> mky may not be present and if present its use is >>>>>> optional. Some sort of mandatory new or existing >>>>>> signed sequence, random # or request ID (e.g., Call-ID >>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>> of the request (e.g., tokens only good for 1 >>>>>> use) could prevent replay. Different methods (e.g., >>>>>> INVITE vs MESSAGE) might be handled by different >>>>>> receiving infrastructure, and therefore difficulties >>>>>> with 'it's been used already' coordination allow a >>>>>> faked MESSAGE based on a captured request. This might >>>>>> include an mkey from a captured INVITE. So it may be >>>>>> possible to DOS, spam or text-bomb a recipient using a >>>>>> captured identity. While large-scale or distributed >>>>>> implementations may make the enforcement difficult, >>>>>> there is little cost to signing and decoding a method >>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>> practice should at least be discussed while perhaps >>>>>> not required. >>>>>> >>>>>> >>>>>> Specific markup suggestions: >>>>>> >>>>>> >>>>>> NITS >>>>>> >>>>>> >>>>>> The verifier MUST inspect any optional "ppt" >>>>>> parameter appearing *in*the >>>>>> >>>>>> Identity request. If no "ppt" parameter is=20 >>>>>> present, then the >>>>>> >>>>>> verifier proceeds normally below. If a "ppt" >>>>>> parameter value is >>>>>> >>>>>> present, and the verifier does not support it,=20 >>>>>> it MUST ignore the >>>>>> >>>>>> Identity header. If a supported "ppt" parameter=20 >>>>>> value is present, >>>>>> >>>>>> the verifier follows the procedures below,=20 >>>>>> including the variations >>>>>> >>>>>> described in Step 5. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> 3 >>>>>> . >>>>>> Background >>>>>> >>>>>> [...] >>>>>> >>>>>> >>>>>> >>>>>> Per [RFC7340 >>>>>> ], problems such as=20 >>>>>> robocalling, voicemail hacking, and >>>>>> >>>>>> swatting are enabled by an attacker's ability to=20 >>>>>> impersonate someone >>>>>> >>>>>> else. The secure operation of most SIP=20 >>>>>> applications and services >>>>>> >>>>>> depends on authenticating and/or authorizing the=20 >>>>>> source of communications as it is >>>>>> >>>>>> represented in a SIP request. >>>>>> >>>>>> >>>>>> >>>>>> This identity architecture for SIP depends on=20 >>>>>> includes provisions for a logical >>>>>> >>>>>> "authentication service" which validates caller=20 >>>>>> identity at or near origination. outgoing >>>>>> requests. An >>>>>> >>>>>> authentication service may be implemented either=20 >>>>>> as part of a user >>>>>> >>>>>> agent or as a proxy server; typically, it is a=20 >>>>>> component of a network >>>>>> >>>>>> intermediary like a proxy to which originating=20 >>>>>> user agents send >>>>>> >>>>>> unsigned requests. Once the sender of the=20 >>>>>> message has been >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> This document specifies a means of sharing a=20 >>>>>> cryptographic assurance >>>>>> >>>>>> of authenticity of and/or authorization to use=20 >>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>> >>>>>> It relies on the authentication service=20 >>>>>> constructing tokens based on [...] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> To maximize end-to-end security, it is typically=20 >>>>>> obviously >>>>>> >>>>>> preferable for end-users to acquire their own=20 >>>>>> credentials; if they >>>>>> >>>>>> do, their user agents can act as authentication=20 >>>>>> services. However, >>>>>> >>>>>> for some deployments, [...] >>>>>> >>>>>> >>>>>> >>>>>> Regards, >>>>>> >>>>>> Alex >>>>>> * * >>>>>> *Alex Bobotek* >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> >>>>>> >>>>>> =20 >>>>>> ----------------------------------------------------------------- >>>>>> ------- >>>>>> >>>>>> This e-mail may contain Sprint proprietary information >>>>>> intended for the sole use of the recipient(s). Any use by >>>>>> others is prohibited. If you are not the intended >>>>>> recipient, please contact the sender and delete all copies >>>>>> of the message. >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org =20 >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org =20 >>>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 5 01:10:06 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86F4512D739 for ; Fri, 5 Aug 2016 01:10:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UC9GDYnnx74F for ; Fri, 5 Aug 2016 01:10:03 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BB6412D1B3 for ; Fri, 5 Aug 2016 01:10:03 -0700 (PDT) X-AuditID: c1b4fb30-ad3ff700000009f9-96-57a449d92bbf Received: from ESESSHC011.ericsson.se (Unknown_Domain [153.88.183.51]) by (Symantec Mail Security) with SMTP id 53.57.02553.9D944A75; Fri, 5 Aug 2016 10:10:01 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.142]) by ESESSHC011.ericsson.se ([153.88.183.51]) with mapi id 14.03.0301.000; Fri, 5 Aug 2016 10:10:00 +0200 From: Christer Holmberg To: IETF STIR Mail List Thread-Topic: 4424bis: Passport considerations Thread-Index: AdHu8C2POBBPyQOQS3GzPRRUQzTyBQ== Date: Fri, 5 Aug 2016 08:09:59 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B47724152@ESESSMB209.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B47724152ESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrBLMWRmVeSWpSXmKPExsUyM2K7se5NzyXhButnWlmcabC0WL52G5MD k8eSJT+ZPHY0PGcOYIrisklJzcksSy3St0vgyni44iljQb98xdFbW1gaGDuluxg5OCQETCQm LYjvYuTiEBJYzygx4cV09i5GTiBnMaNE12UDkBo2AQuJ7n/aIGERAXWJ1rY+ZpAws4CHxIUZ VSBhYQFNiUdT3rJDlOhJzFm/hhXGPvq4iw3EZhFQkTi/eSsTiM0r4Ctxd+UHFhCbUUBM4vup NWBxZgFxiVtP5oPZEgICEkv2nGeGsEUlXj7+xwphK0ms2H6JEaI+X2LtiW3MEDMFJU7OfMIy gVFoFpJRs5CUzUJSBhHXkViw+xMbhK0tsWzha2YY+8yBx0zI4gsY2VcxihanFiflphsZ6aUW ZSYXF+fn6eWllmxiBMbHwS2/DXYwvnzueIhRgINRiYd3QdPicCHWxLLiytxDjBIczEoivAGu S8KFeFMSK6tSi/Lji0pzUosPMUpzsCiJ8/q/VAwXEkhPLEnNTk0tSC2CyTJxcEo1MCp8nt4X YaX54dWpivrZEZoNIYzbLTI/Gi+N8ja6NHcG2wrda3cc97fqs4ks8PAzslr1denr3x/XsT9J /5fCq7z11BRWuevJZ3OC3Cc+Yz+5wHCH1Aa+c0fzrit8MtzcyvFYbdblx2dOf95cpG/tLL/f f/O/FPe0p6ELJ8cbZcob1i1dv1Q0zViJpTgj0VCLuag4EQC2KqXCiwIAAA== Archived-At: Cc: "Jon Peterson \(jon.peterson@neustar.biz\)" Subject: [stir] 4424bis: Passport considerations X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 08:10:05 -0000 --_000_7594FB04B1934943A5C02806D1A2204B47724152ESESSMB209erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable DISCLAIMER: While I realize there is an ongoing discussion regarding the us= age of JWT for Passport, this e-mail assumes that JWT is used. Hi, In Berlin we discussed the fact that more text is needed regarding how the = Passport JWT is applied to 4424bis, i.e. how different parts of the JWT is = placed within different SIP elements, whether the claims and/or headers are= needed, etc. Jon promised to provide such text. My suggestion would be to add a "Passport Considerations" section to 4424bi= s. Perhaps we need text also elsewhere in the document, but it would be goo= d to have one clear overview section. Regards, Christer --_000_7594FB04B1934943A5C02806D1A2204B47724152ESESSMB209erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

DISCLAIMER: While I realize there is an ongoing disc= ussion regarding the usage of JWT for Passport, this e-mail assumes that JW= T is used.

 

Hi,

 

In Berlin we discussed the fact that more text is ne= eded regarding how the Passport JWT is applied to 4424bis, i.e. how differe= nt parts of the JWT is placed within different SIP elements, whether the cl= aims and/or headers are needed, etc.

 

Jon promised to provide such text.

 

My suggestion would be to add a “Passport Cons= iderations” section to 4424bis. Perhaps we need text also elsewhere i= n the document, but it would be good to have one clear overview section.

 

Regards,

 

Christer

--_000_7594FB04B1934943A5C02806D1A2204B47724152ESESSMB209erics_-- From nobody Fri Aug 5 06:43:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BB16128874 for ; Fri, 5 Aug 2016 06:43:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wStMKz-ZwP2p for ; Fri, 5 Aug 2016 06:43:42 -0700 (PDT) Received: from mail-qk0-x236.google.com (mail-qk0-x236.google.com [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8010212B035 for ; Fri, 5 Aug 2016 06:43:42 -0700 (PDT) Received: by mail-qk0-x236.google.com with SMTP id x185so70231520qkc.2 for ; Fri, 05 Aug 2016 06:43:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=JwksSXwVq0ekSFeFrGx/QMEkcIurUwF807Q3MA1PWCc=; b=aaB+QkMxHLMhs/Tk/6m872CoS20aVA/G5ZpPD8dOJmFIcjjQXgXxHS2P40VLDkfujW KSS6J1jIHITcLL+E7ejT9a6luxTmfWIgQx7zzyOUF9DFFq1+BRlgRw1I5mk99EVIFieS veBQQ8oMZcLEPGuavHA/x5h7ESe9EEk3E2xcW0F93JJaSpuFTfh4gFBpnLmV/NRm+ptW Po08VQhibz/JA/WN2ZEVlGtfnI/jxjYBS4PRW0YnWe6n8LhflNZJEpXtAcsdTebj7VXF 1OWDrPUqziuKU0N4Z/QHvqxPDlIrqSeDuqInmrLnglpZIn9OGtNcNZEPFvXYURFdS/Qi xm8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=JwksSXwVq0ekSFeFrGx/QMEkcIurUwF807Q3MA1PWCc=; b=LIi+dE3Yf+gLpaopqupI/jLJjt6lSb82oyulL4OM4EgOWZm4SSuN7ZhJNr/mvgm6M6 YlQRNPis+3UwFrHEV2HdsUEscqnA0ReGfpc068AN2MQAD5qWuaFaf0PTSYiav32QkBG1 z7+Gv1XGjOwiTU+KVaNDiARzv0SHG01+Xm+Z1sDXenglvfiOnSy3WDILfHyOArjea72H IFqfrnEJyI7kVgW7zbMFgNR2szNxNXdUSKidoHhIcwIDABTo9nd14fIWSEzF/9Hs2B0b grkW1xsAa/cPX6QF+3GJZlvW4kXqCdbhzwWAfgYNJhHaAlRif6ynDA9h98Gozcmre5kd AVvA== X-Gm-Message-State: AEkoouvNeO5vP+XrvRK90mSWmmL9RTumNdz2ixzBpE9H8RU5FS5PakpRpgEhLPvgSU1zyw== X-Received: by 10.55.132.198 with SMTP id g189mr12326264qkd.87.1470404621388; Fri, 05 Aug 2016 06:43:41 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id x20sm9614664qtb.7.2016.08.05.06.43.39 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 05 Aug 2016 06:43:39 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Fri, 5 Aug 2016 09:43:35 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> To: "Rosbotham, Paul, Vodafone UK" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 13:43:47 -0000 You can use any term you want, it=E2=80=99s not in the documents. = It=E2=80=99s how I explain how we handle cases like the call center or = the doctor. Jon/Chris his example is where PAI is different from From:, and both = should be signed, PAI by the SP, From: by the enterprise. Can we do = that in a way that it is clear what happened? Brian > On Aug 5, 2016, at 3:46 AM, Rosbotham, Paul, Vodafone UK = wrote: >=20 > Jumping in now that we're on European working time, +1 on Paul's = observation. >=20 > Here in the UK, we've got 2 numbers carried as calling line IDs....one = (we term the Network Number, carried in PAID) uniquely identifies the = line, the other (we term Presentation Number, carried in From) is used = for display purposes. >=20 > Only the carrier has the authority to set the Network Number so only = they could sign it. =20 >=20 > But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For = blue-chip customers, I can allow them to send their Presentation Numbers = into the network, and can't readily check at a network level that = they're theirs (I do have contractual safeguards). The number may have = been allocated by me, or could be allocated by a third party provider. = If it's a call-centre they'll be making outbound calls for lots of = different customers which will change on day-by-day basis. This is = business as usual. I don't like the term "authorised spoofing" because = it implies that the CLI is in some way being rigged: it's not, it's the = corporate customer or their subcontractor using the number that's been = assigned (so in internet terms delegated) to them via a chain of trust = from the regulator. >=20 > What I want is the ability for customers to use their credentials to = sign the CLIs they send me so that at the terminating end it can be = checked (or indeed somewhere en-route if that's the business model). I = can and would sign for customers on my mobile business since I'm driving = what number is presented, but that's by-the-by because they aren't the = ones who generate millions of nuisance calls. If the signing only = occurs at the originating carrier level for corporate/call-centre = customers that's no use because I'm not in a position to do that for = these type of customers...and the whole system becomes a waste of time. = I'd also highlight there are many more of my large customers that I'd = trust more than a far end originating carrier that could be anywhere in = the world (though we have no shortage of small carriers that I wouldn't = know from Adam more locally in the UK....) >=20 > Regards >=20 > Paul >=20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: 04 August 2016 23:12 > To: Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > On 8/4/16 6:02 PM, Brian Rosen wrote: >> I think it's not a delegation. The mobile phone is not being = delegated the TN, it's being authorized to place calls that are not from = that TN, but appear to be. >>=20 >> The mechanism to handle the credential is exactly the same as a = delegation, so if you want to call it delegation, go ahead, but I prefer = to call it authorized spoofing. >=20 > IIUC the delegation is to a responsible entity (something that can be = held legally accountable - e.g. a person), not to a device. The entity = can then "use" the credential via any device(s) it chooses. In the case = of the mobile, the device then becomes a two-line phone. >=20 > Thanks, > Paul >=20 >> Brian >>=20 >>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat = wrote: >>>=20 >>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>> In my jargon an "authorized spoofer" is the doctor who is calling=20= >>>> from his mobile, but sending the TN of his office phone as calling = party. >>>> The delegation to his office phone was made by his landline carrier=20= >>>> to him. He then creates another credential, which he signs with = his=20 >>>> office phone credential that authorizes his mobile to send calls=20 >>>> from his office number. He is spoofing (because the call is coming=20= >>>> from his mobile's TN but claims to be from his office), but it's=20 >>>> authorized spoofing. The doc could give the credential to his=20 >>>> mobile SP if they sign on his behalf. >>>=20 >>> I don't understand how that is different from regular delegation. >>>=20 >>> When his landline carrier gave him a delegated certificate for his = landline number, he should be able to install that in whatever devices = he wants - his landline UA, his mobile phone, etc. It is still delegated = from his landline carrier, even when used with calls via his mobile = carrier. >>>=20 >>> Thanks, >>> Paul >>>=20 >>>> Some folks don't like attaching the "spoofing" label to a = legitimate use. >>>>=20 >>>> But that's how I describe it. >>>>=20 >>>> Brian >>>>=20 >>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>> > wrote: >>>>>=20 >>>>> +1, but with one question below: >>>>>=20 >>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>> I think all we need is to have credentials follow the delegation=20= >>>>>> path, >>>>>=20 >>>>>> plus the option to add another level (not delegation) for=20 >>>>>> authorized spoofers. >>>>>=20 >>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>=20 >>>>> Thanks, >>>>> Paul >>>>>=20 >>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>> long as the delegator is willing to take the heat for delegating=20= >>>>>> to someone who sends a lot of bad calls. They can pass the buck=20= >>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20= >>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>> carriers who are willing to not care who they delegate to. The = fact that there are some who do doesn't change much. >>>>>> Making stir work means knowing who you are delegating to, so that=20= >>>>>> you can pass the hot potato. >>>>>>=20 >>>>>> It's perfectly reasonable for a carrier to be able to sign for = any=20 >>>>>> calls placed on its network on any number it has been delegated. =20= >>>>>> If it does, it's asserting that the calls are from who they are = supposed to be from. >>>>>> That should be straightforward, but we know it's not always, and=20= >>>>>> that represents the hard part of deployment in my opinion. But=20= >>>>>> once they delegate, they can hand responsibility to sign to the=20= >>>>>> delegatee. But, that only works if they know who they are = delegating to. >>>>>>=20 >>>>>> The root of the whole model is that there is a formal or informal=20= >>>>>> delegation path for telephone numbers in every country, and we = can=20 >>>>>> build a chain of trust from that delegation path. If you propose=20= >>>>>> to alter that model, then we get into (policy) issues of which=20 >>>>>> carriers/entities we trust and which we don't. Our model is that=20= >>>>>> you know who you delegate to, and once you do that delegation, = it's their problem. >>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>> business practices. >>>>>>=20 >>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>> having a way to know which TNs are covered by a credential. =20 >>>>>> That's what we have, and I'm loath to change it. >>>>>>=20 >>>>>> Brian >>>>>>=20 >>>>>>=20 >>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>> =20 >>>>>>> > >>>>>>> wrote: >>>>>>>=20 >>>>>>> OK, you talked me into indulging in one more message on policy=20= >>>>>>> and use cases. >>>>>>>=20 >>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20= >>>>>>> individual devices as well as multi-device and multi-number = platforms. >>>>>>>=20 >>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>> relationships are two additional factors which affect=20 >>>>>>> trustworthiness of a given calling number authentication. >>>>>>>=20 >>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>> reason for suggesting a way to qualify the signature to reflect=20= >>>>>>> that variability. >>>>>>>=20 >>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>> group" which could originate calls using multiple numbers, and=20= >>>>>>> can qualify to some degree the trustworthiness of number = authenticity accordingly. >>>>>>>=20 >>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>> semi-authenticated, and most-authenticated. There can be more=20= >>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>> (both for the carriers and the consumers) and I assume = diminishes value. >>>>>>>=20 >>>>>>> My reason for adding the authenticity of the originating carrier=20= >>>>>>> is typical trustworthiness of a carrier business relationship=20 >>>>>>> with typical consumers adds to the trustworthiness assessment = and=20 >>>>>>> partially because carriers are a regulated point of forensic=20 >>>>>>> inquiry for CALEA and fraud. Additionally, most calls originate=20= >>>>>>> and terminate between mobile consumers where their carriers are=20= >>>>>>> able to usefully authenticate their device and have a high = degree=20 >>>>>>> of confidence of the authenticity of the calling number. >>>>>>>=20 >>>>>>> I think billions of per-TN certs of varying usability (revoked,=20= >>>>>>> not >>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>=20 >>>>>>> Conversely, I think billions of per-TN certs will work well, if=20= >>>>>>> the calling party has to sign a call with a per-TN cert provided=20= >>>>>>> by the called party. No called party cert to include? Then the=20= >>>>>>> calling party does not have a trusted relationship with the=20 >>>>>>> called party, and the call can be authorized/treated = accordingly. =20 >>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> =20 >>>>>>> > >>>>>>> *Cc:* Alex Bobotek =20= >>>>>>> >; stir@ietf.org =20= >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> Well, the mechanisms are designed so that they could be deployed=20= >>>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>>>=20 >>>>>>> The notion of credentials that are traceable to a delegation of = a=20 >>>>>>> TN is a mechanism that is part of the design of stir, and the=20 >>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>> device like a PBX would have more than one TN per "device", and=20= >>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>> credential. For the use case we've discussed, a mobile phone = may=20 >>>>>>> also have a credential for, say, a TN that is delegated to a=20 >>>>>>> landline, to cover the example case of a doctor placing a call = on=20 >>>>>>> his mobile, but getting his office number to show up as the = calling party. Use of such mechanisms is policy. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>> >>>>>> =20 >>>>>>> > >>>>>>> wrote: >>>>>>>=20 >>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>> isn't the right forum. >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> >>>>>>> > >>>>>>> *Cc:* Alex Bobotek >>>>>>> >; stir@ietf.org=20 >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> Of course I want PBXs to sign calls. As well as smart phones = and >>>>>>> any other devices that can be programmed to do so. >>>>>>> They will be given credentials that only are valid for the TNs >>>>>>> they are authorized to sign for. They can try to sign any = call, >>>>>>> but the validity of the credential would make such a signature >>>>>>> fail the checking. >>>>>>>=20 >>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>> reasonable way to deploy quickly, but I expect many SPs will = want >>>>>>> to get out of the liability of signing on behalf of their >>>>>>> customers. If they can push of that responsibility to their >>>>>>> customer, only being responsible for getting the customer an >>>>>>> appropriate credential when they assign TNs, then I would = expect >>>>>>> them to want to do so. That means the devices have to be able = to >>>>>>> sign, but I understand many of the PBX vendors think that's >>>>>>> something they could provide in a future release. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>> >>>>>> = > >>>>>>> wrote: >>>>>>>=20 >>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>> extraordinarily easy to commit fraud with authenticated = numbers? >>>>>>>=20 >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> >>>>>>> > >>>>>>> *Cc:* Alex Bobotek >>>>>>> >; stir@ietf.org=20 >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> First of all, we would want the PBX to generate the = signature, >>>>>>> but the service provider can do that. It should not add a >>>>>>> valid signature to a call from a number it did not assign = to >>>>>>> the trunk group connecting to the PBX, although it could >>>>>>> support the extra delegation required to support = "authorized >>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>> calls from the same service provider and should not present >>>>>>> any issue. >>>>>>>=20 >>>>>>> Everyone will have to do work they don't do now to = implement >>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>> >>>>>>> > wrote: >>>>>>>=20 >>>>>>> Fraud from compromised PBXes is common. And even where = a >>>>>>> PBX is not compromised, a carrier has no practical way = of >>>>>>> knowing whether the calling number is properly assigned >>>>>>> and valid from the perspective of the Enterprise. >>>>>>> Therefore, checking whether the calling number was from = an >>>>>>> assigned range might be possible (and fraught with >>>>>>> administrative challenges), but of limited value. And = in >>>>>>> the consumer market, there are calling products which >>>>>>> support a parent subscriber number and "companion" = devices >>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>> the parent subscriber. These are examples of where the >>>>>>> authenticity of the calling number won't necessarily = mean >>>>>>> the same thing as the authenticity of a call from a = single >>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>> spoof checking. >>>>>>>=20 >>>>>>> In another forum and anticipating calling number >>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>> suggested using carrier-specific certs and encoding >>>>>>> specificity of authenticity, and calling number. This >>>>>>> provides the identity of the originating carrier, some >>>>>>> idea as to the accuracy or specificity of the calling >>>>>>> number, and validty of the calling number (assuming = nonce >>>>>>> and replay issues can be addressed as reasonably = suggested >>>>>>> below by Alex). >>>>>>>=20 >>>>>>> The representation of orig-carrier and trustworthiness >>>>>>> could be as follows: >>>>>>>=20 >>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>=20 >>>>>>> *00 - No Credentials* >>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>> networks that don't natively support SIP or which don't >>>>>>> choose to sign calls. E.g., international carriers. >>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>> entirely untrustworthy. >>>>>>>=20 >>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>> Use case example(s): E911 on visited network w/o = roaming >>>>>>> agreement, manual roaming. >>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = entirely >>>>>>> untrustworthy >>>>>>>=20 >>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>> Use case example(s): Number block delegated from OCN, = but >>>>>>> no per-TN screen (SIP trunks). >>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less = than >>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>=20 >>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>> Use case example(s): Bread-and-butter 95%+ of calls = from >>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>> trustworthy >>>>>>>=20 >>>>>>> *Public Use Case:* >>>>>>>=20 >>>>>>> Undefined but assumed to use public or commercially >>>>>>> available authentication services resources. e.g., >>>>>>> nomorobo-like crowd-sourced accept/deny lists, et = cetera. >>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>> which would process them according to the rules of the >>>>>>> Public Class application(s). >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>> *To:* Alex Bobotek >>>>>> >>>>>>> > >>>>>>> *Cc:* stir@ietf.org >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> There are reasonable circumstances where a party = placing a >>>>>>> call is not the authorized entity assigned the = telephone >>>>>>> number used in From/PAI, and in such circumstances the >>>>>>> service provider servicing the entity placing the call = may >>>>>>> or may not be the same as the service provider serving = the >>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>> entity that is assigned the TN explicitly authorizes = calls >>>>>>> placed using it's TN. The design accommodates such use >>>>>>> cases. It's not a blanket authorization without >>>>>>> authentication. We're not aware of any cases where = there >>>>>>> is an actual requirement for legitimate calling without >>>>>>> explicit authorization from the assigned entity, = although >>>>>>> we certainly are aware that various parts of various >>>>>>> service providers don't bother to check. At this point, = at >>>>>>> least in some countries, there is a realization that = the >>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>> any more. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>> >>>>>> > wrote: >>>>>>>=20 >>>>>>> 1. Permit authorization without = authentication >>>>>>> In the current telephony network practice, some >>>>>>> service provider implementations choose not to >>>>>>> authenticate identity, but simply facilitate the = use >>>>>>> of an arbitrary or selected user-provided identity. >>>>>>> Are there legitimate use cases for this? Has = anyone >>>>>>> established that there are not? How can the = industry >>>>>>> reasonably expect to end this (often bad) practice? >>>>>>> If it can't be ended, there's value in at least >>>>>>> identifying the originating service provider >>>>>>> (i.e., the signer/authorizer). Given the = prevalence >>>>>>> of abuse using telephone numbers assigned to a >>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>> important to identify the service provider(s) = closest >>>>>>> to the abuser. Based on the assumption that it's >>>>>>> better to ID service providers than unreasonably >>>>>>> expect a ban of the use of unauthenticated (and >>>>>>> therefore unsigned) SIP requests, STIR signing = should >>>>>>> support authorization without authentication. The >>>>>>> practice of authorizing unauthenticated use exists, >>>>>>> and there is benefit to signing in these cases >>>>>>> (service provider identification). The language of >>>>>>> the ID should permit this use. 4474bis-10 should = NOT >>>>>>> require or assume that that authentication will >>>>>>> precede authorization. Of course there may be other >>>>>>> use cases where signing includes authentication and >>>>>>> may not include a specific service provider's >>>>>>> authorization. >>>>>>>=20 >>>>>>>=20 >>>>>>> 2. Improve replay prevention >>>>>>> Proximate replay is possible while complying with = this >>>>>>> spec. First, one or more proximate (e.g., within = 60 >>>>>>> seconds) SIP requests using the same token are = legal >>>>>>> and subject to replay in many cases. An SDP body's >>>>>>> mky may not be present and if present its use is >>>>>>> optional. Some sort of mandatory new or existing >>>>>>> signed sequence, random # or request ID (e.g., = Call-ID >>>>>>> or CSeq) and a 1-time use policy on the receiving = end >>>>>>> of the request (e.g., tokens only good for 1 >>>>>>> use) could prevent replay. Different methods = (e.g., >>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>> receiving infrastructure, and therefore = difficulties >>>>>>> with 'it's been used already' coordination allow a >>>>>>> faked MESSAGE based on a captured request. This = might >>>>>>> include an mkey from a captured INVITE. So it may = be >>>>>>> possible to DOS, spam or text-bomb a recipient = using a >>>>>>> captured identity. While large-scale or = distributed >>>>>>> implementations may make the enforcement difficult, >>>>>>> there is little cost to signing and decoding a = method >>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>> practice should at least be discussed while perhaps >>>>>>> not required. >>>>>>>=20 >>>>>>>=20 >>>>>>> Specific markup suggestions: >>>>>>>=20 >>>>>>>=20 >>>>>>> NITS >>>>>>>=20 >>>>>>>=20 >>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>> parameter appearing *in*the >>>>>>>=20 >>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>> present, then the >>>>>>>=20 >>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>> parameter value is >>>>>>>=20 >>>>>>> present, and the verifier does not support it,=20= >>>>>>> it MUST ignore the >>>>>>>=20 >>>>>>> Identity header. If a supported "ppt" parameter=20= >>>>>>> value is present, >>>>>>>=20 >>>>>>> the verifier follows the procedures below,=20 >>>>>>> including the variations >>>>>>>=20 >>>>>>> described in Step 5. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> 3 >>>>>>> = . >>>>>>> Background >>>>>>>=20 >>>>>>> [...] >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> Per [RFC7340 >>>>>>> ], problems such as=20 >>>>>>> robocalling, voicemail hacking, and >>>>>>>=20 >>>>>>> swatting are enabled by an attacker's ability to=20= >>>>>>> impersonate someone >>>>>>>=20 >>>>>>> else. The secure operation of most SIP=20 >>>>>>> applications and services >>>>>>>=20 >>>>>>> depends on authenticating and/or authorizing the=20= >>>>>>> source of communications as it is >>>>>>>=20 >>>>>>> represented in a SIP request. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> This identity architecture for SIP depends on=20 >>>>>>> includes provisions for a logical >>>>>>>=20 >>>>>>> "authentication service" which validates caller=20= >>>>>>> identity at or near origination. outgoing >>>>>>> requests. An >>>>>>>=20 >>>>>>> authentication service may be implemented either=20= >>>>>>> as part of a user >>>>>>>=20 >>>>>>> agent or as a proxy server; typically, it is a=20= >>>>>>> component of a network >>>>>>>=20 >>>>>>> intermediary like a proxy to which originating=20= >>>>>>> user agents send >>>>>>>=20 >>>>>>> unsigned requests. Once the sender of the=20 >>>>>>> message has been >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> This document specifies a means of sharing a=20 >>>>>>> cryptographic assurance >>>>>>>=20 >>>>>>> of authenticity of and/or authorization to use=20= >>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>=20 >>>>>>> It relies on the authentication service=20 >>>>>>> constructing tokens based on [...] >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> To maximize end-to-end security, it is typically=20= >>>>>>> obviously >>>>>>>=20 >>>>>>> preferable for end-users to acquire their own=20 >>>>>>> credentials; if they >>>>>>>=20 >>>>>>> do, their user agents can act as authentication=20= >>>>>>> services. However, >>>>>>>=20 >>>>>>> for some deployments, [...] >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> Regards, >>>>>>>=20 >>>>>>> Alex >>>>>>> * * >>>>>>> *Alex Bobotek* >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> = ----------------------------------------------------------------- >>>>>>> ------- >>>>>>>=20 >>>>>>> This e-mail may contain Sprint proprietary information >>>>>>> intended for the sole use of the recipient(s). Any use = by >>>>>>> others is prohibited. If you are not the intended >>>>>>> recipient, please contact the sender and delete all = copies >>>>>>> of the message. >>>>>>=20 >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org =20 >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 5 07:20:38 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7652212D86D for ; Fri, 5 Aug 2016 07:20:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aU7S3ajAyOER for ; Fri, 5 Aug 2016 07:20:35 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7ACC612D86A for ; Fri, 5 Aug 2016 07:20:35 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u75EKU6b031871 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 5 Aug 2016 07:20:30 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470406831; bh=JkqRDMMMzN1L6AsH4hozWjrV01PcJsimqXndTGELVqE=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=c3dF9qxvqxUEp1oVHsd6AHeLl18zfErcd6SkyrLjrVfOKKBsk9dgLTEFwiDJJHtCG AL/Wp8DeQgt5XexM6piNtQrm8dAXRW16rJWLMx2PO04Qeid5kCAbxy452ZjDIjErEo ULXF4JOnmQCP0jB0ZsX8jXA5mC/eRmpVCFNImcbU= To: Christer Holmberg , Paul Kyzivat References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> Date: Fri, 5 Aug 2016 07:20:12 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 14:20:36 -0000 Christer, On 8/4/2016 11:45 PM, Christer Holmberg wrote: > > The receiver needs to be able to parse JSON if the sender includes the > claims, in order to verify the signature. Alternatives and options make specifications more complex and often introduce potential non-determinacies. So the 'if' that you cite is not a small matter. In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it. > Also, whatever headers we include, I assume the receiver should be able > to parse them. > > But, parsing JSON is not a difficult thing to do, and there are > available libraries for those who don't want to implement the parser > themselves. Just to make sure this sub-thread retains its context: I did not comment on the choice of JSON/JWT in the actual review. It's not an irrational or horrible choice. But it does add overhead. It adds it to the effort needed to understand the specifications. And it adds it to the software. (It might also add it to the execution of the software, but I suspect that is, at worst, a negligible difference here.) One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do". In most cases where that sort of comment is offered, it is quite true. The problem is with incremental complexities. A not-difficult here; a not-difficult there... They really do mount up. By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie, pre-occurring -- relevance to the current work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 5 07:42:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8F0312D899 for ; Fri, 5 Aug 2016 07:42:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yTrH7X1nYohZ for ; Fri, 5 Aug 2016 07:42:21 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id 0D8F312D842 for ; Fri, 5 Aug 2016 07:42:21 -0700 (PDT) Received: (qmail 11134 invoked by uid 0); 5 Aug 2016 14:42:19 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy4.mail.unifiedlayer.com with SMTP; 5 Aug 2016 14:42:19 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id TSdC1t00S1MNPNq01SdFZx; Fri, 05 Aug 2016 08:37:18 -0600 X-Authority-Analysis: v=2.1 cv=KaJB72oD c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=fGh7L_e3oJcA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=Ebs0h9rcAAAA:8 a=izV7ms69AAAA:8 a=HLLxP2VMAAAA:8 a=VfgTrTGYAAAA:8 a=8j640yorXSjXNOdXqgsA:9 a=l7dRz8s_udgmMHfP:21 a=7dfNdZnb0ii7Cwa0:21 a=QEXdDO2ut3YA:10 a=NWVoK91CQySWRX1oVYDe:22 a=NumKjXolQHiPR4xHErVj:22 a=w1C3t2QeGrPiZgrLijVG:22 a=ze-edQBmiW6TIqNp2H_K:22 a=jg1oa_xp17rrhcbVgaY4:22 a=5oret6oapBRfLy7jekVI:22 a=ORFRI7aeUVbPhtmlmiRh:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=AJtCZpoM/SGODX2mN3hCc7BScQ2AcE9DKiQ69zZ+L4o=; b=LVjYTYL8IRcOqRf0atJo62CboC 3hsubZdBGSHIuJKnULROao/u3HcCHw4Qlkysz8y1sQohG3HzzQBl98NXT/YITlV1ETZTntnVFU7cc 0t5ZxvYccDLOU2EiWr0A9SOLz; Received: from [100.36.21.178] (port=49916 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bVgFN-0000p2-Vu; Fri, 05 Aug 2016 08:37:14 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 05 Aug 2016 10:36:57 -0400 From: Richard Shockey To: "Rosbotham, Paul, Vodafone UK" , Paul Kyzivat , Brian Rosen Message-ID: Thread-Topic: [stir] STIR 4474bis-10 comments References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.21.178 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.21.178 X-Exim-ID: 1bVgFN-0000p2-Vu X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.21.178]:49916 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 14:42:25 -0000 Humm this is getting interesting. Its my understanding that the display nu= mber aka =E2=80=9Cpresentation number=E2=80=9D in the US context is the one carried in t= he PAI. Martin, Pierce?=20 On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: Jumping in now that we're on European working time, +1 on Paul's observ= ation. =20 Here in the UK, we've got 2 numbers carried as calling line IDs....one = (we term the Network Number, carried in PAID) uniquely identifies the line, = the other (we term Presentation Number, carried in From) is used for display= purposes. =20 Only the carrier has the authority to set the Network Number so only th= ey could sign it. =20 =20 But - subject to regulatory restrictions which are well documented - th= e number sent for display purposes belongs to the customer. For blue-chip c= ustomers, I can allow them to send their Presentation Numbers into the netwo= rk, and can't readily check at a network level that they're theirs (I do hav= e contractual safeguards). The number may have been allocated by me, or cou= ld be allocated by a third party provider. If it's a call-centre they'll be= making outbound calls for lots of different customers which will change on = day-by-day basis. This is business as usual. I don't like the term "author= ised spoofing" because it implies that the CLI is in some way being rigged: = it's not, it's the corporate customer or their subcontractor using the numbe= r that's been assigned (so in internet terms delegated) to them via a chain = of trust from the regulator. =20 What I want is the ability for customers to use their credentials to si= gn the CLIs they send me so that at the terminating end it can be checked (o= r indeed somewhere en-route if that's the business model). I can and would = sign for customers on my mobile business since I'm driving what number is pr= esented, but that's by-the-by because they aren't the ones who generate mill= ions of nuisance calls. If the signing only occurs at the originating carri= er level for corporate/call-centre customers that's no use because I'm not i= n a position to do that for these type of customers...and the whole system b= ecomes a waste of time. I'd also highlight there are many more of my large c= ustomers that I'd trust more than a far end originating carrier that could b= e anywhere in the world (though we have no shortage of small carriers that I= wouldn't know from Adam more locally in the UK....) =20 Regards =20 Paul =20 -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat Sent: 04 August 2016 23:12 To: Brian Rosen Cc: stir@ietf.org Subject: Re: [stir] STIR 4474bis-10 comments =20 On 8/4/16 6:02 PM, Brian Rosen wrote: > I think it's not a delegation. The mobile phone is not being delegat= ed the TN, it's being authorized to place calls that are not from that TN, b= ut appear to be. > > The mechanism to handle the credential is exactly the same as a deleg= ation, so if you want to call it delegation, go ahead, but I prefer to call = it authorized spoofing. =20 IIUC the delegation is to a responsible entity (something that can be h= eld legally accountable - e.g. a person), not to a device. The entity can th= en "use" the credential via any device(s) it chooses. In the case of the mob= ile, the device then becomes a two-line phone. =20 Thanks, Paul =20 > Brian > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wro= te: >> >> On 8/4/16 5:43 PM, Brian Rosen wrote: >>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>> from his mobile, but sending the TN of his office phone as calling = party. >>> The delegation to his office phone was made by his landline carrier= =20 >>> to him. He then creates another credential, which he signs with hi= s=20 >>> office phone credential that authorizes his mobile to send calls=20 >>> from his office number. He is spoofing (because the call is coming= =20 >>> from his mobile's TN but claims to be from his office), but it's=20 >>> authorized spoofing. The doc could give the credential to his=20 >>> mobile SP if they sign on his behalf. >> >> I don't understand how that is different from regular delegation. >> >> When his landline carrier gave him a delegated certificate for his l= andline number, he should be able to install that in whatever devices he wan= ts - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >> >> Thanks, >> Paul >> >>> Some folks don't like attaching the "spoofing" label to a legitimat= e use. >>> >>> But that's how I describe it. >>> >>> Brian >>> >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>> > wrote: >>>> >>>> +1, but with one question below: >>>> >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>> I think all we need is to have credentials follow the delegation=20 >>>>> path, >>>> >>>>> plus the option to add another level (not delegation) for=20 >>>>> authorized spoofers. >>>> >>>> I don't understand "authorized spoofers" in this context, as=20 >>>> contrasted to "spoofers" who have been delegated their authority. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>> long as the delegator is willing to take the heat for delegating=20 >>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>> follow the delegation path. There are plenty of certificated=20 >>>>> carriers who are willing to not care who they delegate to. The f= act that there are some who do doesn't change much. >>>>> Making stir work means knowing who you are delegating to, so that= =20 >>>>> you can pass the hot potato. >>>>> >>>>> It's perfectly reasonable for a carrier to be able to sign for an= y=20 >>>>> calls placed on its network on any number it has been delegated. = =20 >>>>> If it does, it's asserting that the calls are from who they are s= upposed to be from. >>>>> That should be straightforward, but we know it's not always, and=20 >>>>> that represents the hard part of deployment in my opinion. But=20 >>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>> delegatee. But, that only works if they know who they are delega= ting to. >>>>> >>>>> The root of the whole model is that there is a formal or informal= =20 >>>>> delegation path for telephone numbers in every country, and we ca= n=20 >>>>> build a chain of trust from that delegation path. If you propose= =20 >>>>> to alter that model, then we get into (policy) issues of which=20 >>>>> carriers/entities we trust and which we don't. Our model is that= =20 >>>>> you know who you delegate to, and once you do that delegation, it= 's their problem. >>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>> business practices. >>>>> >>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>> having a way to know which TNs are covered by a credential. =20 >>>>> That's what we have, and I'm loath to change it. >>>>> >>>>> Brian >>>>> >>>>> >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>> =20 >>>>>> > >>>>>> wrote: >>>>>> >>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>> and use cases. >>>>>> >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>> individual devices as well as multi-device and multi-number plat= forms. >>>>>> >>>>>> Number delegation (and sub-delegation), and business=20 >>>>>> relationships are two additional factors which affect=20 >>>>>> trustworthiness of a given calling number authentication. >>>>>> >>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>> that variability. >>>>>> >>>>>> Originating carriers are in a position to know if a call is=20 >>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>> can qualify to some degree the trustworthiness of number authent= icity accordingly. >>>>>> >>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>> granularity, but it implies additional operational complexity=20 >>>>>> (both for the carriers and the consumers) and I assume diminishe= s value. >>>>>> >>>>>> My reason for adding the authenticity of the originating carrier= =20 >>>>>> is typical trustworthiness of a carrier business relationship=20 >>>>>> with typical consumers adds to the trustworthiness assessment an= d=20 >>>>>> partially because carriers are a regulated point of forensic=20 >>>>>> inquiry for CALEA and fraud. Additionally, most calls originate= =20 >>>>>> and terminate between mobile consumers where their carriers are=20 >>>>>> able to usefully authenticate their device and have a high degre= e=20 >>>>>> of confidence of the authenticity of the calling number. >>>>>> >>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>> not >>>>>> revoked) for authenticating calling number will not work well. >>>>>> >>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>> the calling party has to sign a call with a per-TN cert provided= =20 >>>>>> by the called party. No called party cert to include? Then the= =20 >>>>>> calling party does not have a trusted relationship with the=20 >>>>>> called party, and the call can be authorized/treated accordingly= . =20 >>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> =20 >>>>>> > >>>>>> *Cc:* Alex Bobotek =20 >>>>>> >; stir@ietf.org = =20 >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Well, the mechanisms are designed so that they could be deployed= =20 >>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>> >>>>>> The notion of credentials that are traceable to a delegation of = a=20 >>>>>> TN is a mechanism that is part of the design of stir, and the=20 >>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>> something like a dual NAM phone could have more than one=20 >>>>>> credential. For the use case we've discussed, a mobile phone ma= y=20 >>>>>> also have a credential for, say, a TN that is delegated to a=20 >>>>>> landline, to cover the example case of a doctor placing a call o= n=20 >>>>>> his mobile, but getting his office number to show up as the call= ing party. Use of such mechanisms is policy. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> =20 >>>>>> > >>>>>> wrote: >>>>>> >>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>> would like to continue the discussion, but I'm pretty sure thi= s >>>>>> isn't the right forum. >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>>> >; stir@ietf.org=20 >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Of course I want PBXs to sign calls. As well as smart phones = and >>>>>> any other devices that can be programmed to do so. >>>>>> They will be given credentials that only are valid for the TNs >>>>>> they are authorized to sign for. They can try to sign any cal= l, >>>>>> but the validity of the credential would make such a signature >>>>>> fail the checking. >>>>>> >>>>>> Getting service providers to sign on behalf of devices is a >>>>>> reasonable way to deploy quickly, but I expect many SPs will w= ant >>>>>> to get out of the liability of signing on behalf of their >>>>>> customers. If they can push of that responsibility to their >>>>>> customer, only being responsible for getting the customer an >>>>>> appropriate credential when they assign TNs, then I would expe= ct >>>>>> them to want to do so. That means the devices have to be able= to >>>>>> sign, but I understand many of the PBX vendors think that's >>>>>> something they could provide in a future release. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>> >>>>> > >>>>>> wrote: >>>>>> >>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>> extraordinarily easy to commit fraud with authenticated nu= mbers? >>>>>> >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>> *To:* Gorman, Pierce A [CTO] >>>>> >>>>>> > >>>>>> *Cc:* Alex Bobotek >>>>>> >; stir@ietf.org=20 >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> First of all, we would want the PBX to generate the signat= ure, >>>>>> but the service provider can do that. It should not add a >>>>>> valid signature to a call from a number it did not assign = to >>>>>> the trunk group connecting to the PBX, although it could >>>>>> support the extra delegation required to support "authoriz= ed >>>>>> spoofing". The companion devices I'm aware of always send >>>>>> calls from the same service provider and should not presen= t >>>>>> any issue. >>>>>> >>>>>> Everyone will have to do work they don't do now to impleme= nt >>>>>> stop spoofed calls. TANSTAAFL >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>> >>>>>> > wrote: >>>>>> >>>>>> Fraud from compromised PBXes is common. And even wher= e a >>>>>> PBX is not compromised, a carrier has no practical way= of >>>>>> knowing whether the calling number is properly assigne= d >>>>>> and valid from the perspective of the Enterprise. >>>>>> Therefore, checking whether the calling number was fro= m an >>>>>> assigned range might be possible (and fraught with >>>>>> administrative challenges), but of limited value. And= in >>>>>> the consumer market, there are calling products which >>>>>> support a parent subscriber number and "companion" dev= ices >>>>>> (e.g., tablets) which can place a call using the MDN o= f >>>>>> the parent subscriber. These are examples of where th= e >>>>>> authenticity of the calling number won't necessarily m= ean >>>>>> the same thing as the authenticity of a call from a si= ngle >>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>> spoof checking. >>>>>> >>>>>> In another forum and anticipating calling number >>>>>> authentication mandates from Congress and/or FCC, I >>>>>> suggested using carrier-specific certs and encoding >>>>>> specificity of authenticity, and calling number. This >>>>>> provides the identity of the originating carrier, some >>>>>> idea as to the accuracy or specificity of the calling >>>>>> number, and validty of the calling number (assuming no= nce >>>>>> and replay issues can be addressed as reasonably sugge= sted >>>>>> below by Alex). >>>>>> >>>>>> The representation of orig-carrier and trustworthiness >>>>>> could be as follows: >>>>>> >>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>> >>>>>> *00 - No Credentials* >>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>> networks that don't natively support SIP or which don'= t >>>>>> choose to sign calls. E.g., international carriers. >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>> entirely untrustworthy. >>>>>> >>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>> Use case example(s): E911 on visited network w/o roami= ng >>>>>> agreement, manual roaming. >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entire= ly >>>>>> untrustworthy >>>>>> >>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>> Use case example(s): Number block delegated from OCN, = but >>>>>> no per-TN screen (SIP trunks). >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less t= han >>>>>> most trustworthy but not entirely untrustworthy. >>>>>> >>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>> Use case example(s): Bread-and-butter 95%+ of calls fr= om >>>>>> subscriber lines (IMS-based and otherwise). >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>> trustworthy >>>>>> >>>>>> *Public Use Case:* >>>>>> >>>>>> Undefined but assumed to use public or commercially >>>>>> available authentication services resources. e.g., >>>>>> nomorobo-like crowd-sourced accept/deny lists, et cete= ra. >>>>>> Could/would pass credentials down to SIP-aware devices >>>>>> which would process them according to the rules of the >>>>>> Public Class application(s). >>>>>> >>>>>> Pierce >>>>>> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>> *To:* Alex Bobotek >>>>> >>>>>> > >>>>>> *Cc:* stir@ietf.org >>>>>> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> There are reasonable circumstances where a party placi= ng a >>>>>> call is not the authorized entity assigned the telepho= ne >>>>>> number used in From/PAI, and in such circumstances the >>>>>> service provider servicing the entity placing the call= may >>>>>> or may not be the same as the service provider serving= the >>>>>> entity that is assigned the TN. In all such cases, th= e >>>>>> entity that is assigned the TN explicitly authorizes c= alls >>>>>> placed using it's TN. The design accommodates such us= e >>>>>> cases. It's not a blanket authorization without >>>>>> authentication. We're not aware of any cases where t= here >>>>>> is an actual requirement for legitimate calling withou= t >>>>>> explicit authorization from the assigned entity, altho= ugh >>>>>> we certainly are aware that various parts of various >>>>>> service providers don't bother to check. At this point= , at >>>>>> least in some countries, there is a realization that t= he >>>>>> laxity of allowing unchecked spoofing is not acceptabl= e >>>>>> any more. >>>>>> >>>>>> Brian >>>>>> >>>>>> >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>> >>>>> > wrote: >>>>>> >>>>>> 1. Permit authorization without authenticati= on >>>>>> In the current telephony network practice, some >>>>>> service provider implementations choose not to >>>>>> authenticate identity, but simply facilitate the u= se >>>>>> of an arbitrary or selected user-provided identity= . >>>>>> Are there legitimate use cases for this? Has anyo= ne >>>>>> established that there are not? How can the indus= try >>>>>> reasonably expect to end this (often bad) practice= ? >>>>>> If it can't be ended, there's value in at least >>>>>> identifying the originating service provider >>>>>> (i.e., the signer/authorizer). Given the prevalen= ce >>>>>> of abuse using telephone numbers assigned to a >>>>>> sometimes-anonymous abuser, it becomes critically >>>>>> important to identify the service provider(s) clos= est >>>>>> to the abuser. Based on the assumption that it's >>>>>> better to ID service providers than unreasonably >>>>>> expect a ban of the use of unauthenticated (and >>>>>> therefore unsigned) SIP requests, STIR signing sho= uld >>>>>> support authorization without authentication. The >>>>>> practice of authorizing unauthenticated use exists= , >>>>>> and there is benefit to signing in these cases >>>>>> (service provider identification). The language o= f >>>>>> the ID should permit this use. 4474bis-10 should = NOT >>>>>> require or assume that that authentication will >>>>>> precede authorization. Of course there may be othe= r >>>>>> use cases where signing includes authentication an= d >>>>>> may not include a specific service provider's >>>>>> authorization. >>>>>> >>>>>> >>>>>> 2. Improve replay prevention >>>>>> Proximate replay is possible while complying with = this >>>>>> spec. First, one or more proximate (e.g., within = 60 >>>>>> seconds) SIP requests using the same token are leg= al >>>>>> and subject to replay in many cases. An SDP body'= s >>>>>> mky may not be present and if present its use is >>>>>> optional. Some sort of mandatory new or existing >>>>>> signed sequence, random # or request ID (e.g., Cal= l-ID >>>>>> or CSeq) and a 1-time use policy on the receiving = end >>>>>> of the request (e.g., tokens only good for 1 >>>>>> use) could prevent replay. Different methods (e.g= ., >>>>>> INVITE vs MESSAGE) might be handled by different >>>>>> receiving infrastructure, and therefore difficulti= es >>>>>> with 'it's been used already' coordination allow a >>>>>> faked MESSAGE based on a captured request. This mi= ght >>>>>> include an mkey from a captured INVITE. So it ma= y be >>>>>> possible to DOS, spam or text-bomb a recipient usi= ng a >>>>>> captured identity. While large-scale or distribut= ed >>>>>> implementations may make the enforcement difficult= , >>>>>> there is little cost to signing and decoding a met= hod >>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>> practice should at least be discussed while perhap= s >>>>>> not required. >>>>>> >>>>>> >>>>>> Specific markup suggestions: >>>>>> >>>>>> >>>>>> NITS >>>>>> >>>>>> >>>>>> The verifier MUST inspect any optional "ppt" >>>>>> parameter appearing *in*the >>>>>> >>>>>> Identity request. If no "ppt" parameter is=20 >>>>>> present, then the >>>>>> >>>>>> verifier proceeds normally below. If a "ppt" >>>>>> parameter value is >>>>>> >>>>>> present, and the verifier does not support it,=20 >>>>>> it MUST ignore the >>>>>> >>>>>> Identity header. If a supported "ppt" paramete= r=20 >>>>>> value is present, >>>>>> >>>>>> the verifier follows the procedures below,=20 >>>>>> including the variations >>>>>> >>>>>> described in Step 5. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> 3 >>>>>> . >>>>>> Background >>>>>> >>>>>> [...] >>>>>> >>>>>> >>>>>> >>>>>> Per [RFC7340 >>>>>> ], problems such as=20 >>>>>> robocalling, voicemail hacking, and >>>>>> >>>>>> swatting are enabled by an attacker's ability t= o=20 >>>>>> impersonate someone >>>>>> >>>>>> else. The secure operation of most SIP=20 >>>>>> applications and services >>>>>> >>>>>> depends on authenticating and/or authorizing th= e=20 >>>>>> source of communications as it is >>>>>> >>>>>> represented in a SIP request. >>>>>> >>>>>> >>>>>> >>>>>> This identity architecture for SIP depends on=20 >>>>>> includes provisions for a logical >>>>>> >>>>>> "authentication service" which validates caller= =20 >>>>>> identity at or near origination. outgoing >>>>>> requests. An >>>>>> >>>>>> authentication service may be implemented eithe= r=20 >>>>>> as part of a user >>>>>> >>>>>> agent or as a proxy server; typically, it is a=20 >>>>>> component of a network >>>>>> >>>>>> intermediary like a proxy to which originating=20 >>>>>> user agents send >>>>>> >>>>>> unsigned requests. Once the sender of the=20 >>>>>> message has been >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> This document specifies a means of sharing a=20 >>>>>> cryptographic assurance >>>>>> >>>>>> of authenticity of and/or authorization to use=20 >>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>> >>>>>> It relies on the authentication service=20 >>>>>> constructing tokens based on [...] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> To maximize end-to-end security, it is typicall= y=20 >>>>>> obviously >>>>>> >>>>>> preferable for end-users to acquire their own=20 >>>>>> credentials; if they >>>>>> >>>>>> do, their user agents can act as authentication= =20 >>>>>> services. However, >>>>>> >>>>>> for some deployments, [...] >>>>>> >>>>>> >>>>>> >>>>>> Regards, >>>>>> >>>>>> Alex >>>>>> * * >>>>>> *Alex Bobotek* >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> >>>>>> >>>>>> =20 >>>>>> ----------------------------------------------------------------= - >>>>>> ------- >>>>>> >>>>>> This e-mail may contain Sprint proprietary information >>>>>> intended for the sole use of the recipient(s). Any use= by >>>>>> others is prohibited. If you are not the intended >>>>>> recipient, please contact the sender and delete all co= pies >>>>>> of the message. >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org =20 >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org =20 >>>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Fri Aug 5 07:54:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D42E312D1A5 for ; Fri, 5 Aug 2016 07:54:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pki4OFRGgj-i for ; Fri, 5 Aug 2016 07:54:13 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84F6512B071 for ; Fri, 5 Aug 2016 07:54:13 -0700 (PDT) Received: from pps.filterd (m0049458.ppops.net [127.0.0.1]) by m0049458.ppops.net-00191d01. (8.16.0.11/8.16.0.11) with SMTP id u75EnWXb032265; Fri, 5 Aug 2016 10:54:10 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049458.ppops.net-00191d01. with ESMTP id 24mve3t59t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Aug 2016 10:54:09 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u75Es8RZ020871; Fri, 5 Aug 2016 10:54:09 -0400 Received: from mlpi409.sfdc.sbc.com (mlpi409.sfdc.sbc.com [130.9.128.241]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u75Es1k0020715 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 5 Aug 2016 10:54:04 -0400 Received: from MISOUT7MSGHUBAF.ITServices.sbc.com (MISOUT7MSGHUBAF.itservices.sbc.com [130.9.129.150]) by mlpi409.sfdc.sbc.com (RSA Interceptor); Fri, 5 Aug 2016 14:53:48 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.146]) by MISOUT7MSGHUBAF.ITServices.sbc.com ([130.9.129.150]) with mapi id 14.03.0301.000; Fri, 5 Aug 2016 10:53:47 -0400 From: "DOLLY, MARTIN C" To: Richard Shockey Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ybRsWQuDxcKz0ueE1p7VelBT6A6dAgB Date: Fri, 5 Aug 2016 14:53:46 +0000 Message-ID: <153E750D-FF98-4261-9926-6F500EA1462F@att.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-05_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608050180 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , "stir@ietf.org" , Paul Kyzivat , Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 14:54:18 -0000 Yes if PAI present Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards=20 AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 10:42 AM, Richard Shockey wrote: >=20 >=20 > Humm this is getting interesting. Its my understanding that the display = number aka =93presentation number=94 in the US context is the one carried i= n the PAI. Martin, Pierce?=20 >=20 >=20 >=20 >=20 > On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >=20 > Jumping in now that we're on European working time, +1 on Paul's obser= vation. >=20 > Here in the UK, we've got 2 numbers carried as calling line IDs....one= (we term the Network Number, carried in PAID) uniquely identifies the line= , the other (we term Presentation Number, carried in From) is used for disp= lay purposes. >=20 > Only the carrier has the authority to set the Network Number so only t= hey could sign it. =20 >=20 > But - subject to regulatory restrictions which are well documented - t= he number sent for display purposes belongs to the customer. For blue-chip= customers, I can allow them to send their Presentation Numbers into the ne= twork, and can't readily check at a network level that they're theirs (I do= have contractual safeguards). The number may have been allocated by me, o= r could be allocated by a third party provider. If it's a call-centre they= 'll be making outbound calls for lots of different customers which will cha= nge on day-by-day basis. This is business as usual. I don't like the term= "authorised spoofing" because it implies that the CLI is in some way being= rigged: it's not, it's the corporate customer or their subcontractor using= the number that's been assigned (so in internet terms delegated) to them v= ia a chain of trust from the regulator. >=20 > What I want is the ability for customers to use their credentials to s= ign the CLIs they send me so that at the terminating end it can be checked = (or indeed somewhere en-route if that's the business model). I can and wou= ld sign for customers on my mobile business since I'm driving what number i= s presented, but that's by-the-by because they aren't the ones who generate= millions of nuisance calls. If the signing only occurs at the originating= carrier level for corporate/call-centre customers that's no use because I'= m not in a position to do that for these type of customers...and the whole = system becomes a waste of time. I'd also highlight there are many more of m= y large customers that I'd trust more than a far end originating carrier th= at could be anywhere in the world (though we have no shortage of small carr= iers that I wouldn't know from Adam more locally in the UK....) >=20 > Regards >=20 > Paul >=20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: 04 August 2016 23:12 > To: Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments >=20 >> On 8/4/16 6:02 PM, Brian Rosen wrote: >> I think it's not a delegation. The mobile phone is not being delegated = the TN, it's being authorized to place calls that are not from that TN, but= appear to be. >>=20 >> The mechanism to handle the credential is exactly the same as a delegati= on, so if you want to call it delegation, go ahead, but I prefer to call it= authorized spoofing. >=20 > IIUC the delegation is to a responsible entity (something that can be = held legally accountable - e.g. a person), not to a device. The entity can = then "use" the credential via any device(s) it chooses. In the case of the = mobile, the device then becomes a two-line phone. >=20 > Thanks, > Paul >=20 >> Brian >>=20 >>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: >>>=20 >>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>> from his mobile, but sending the TN of his office phone as calling par= ty. >>>> The delegation to his office phone was made by his landline carrier=20 >>>> to him. He then creates another credential, which he signs with his=20 >>>> office phone credential that authorizes his mobile to send calls=20 >>>> from his office number. He is spoofing (because the call is coming=20 >>>> from his mobile's TN but claims to be from his office), but it's=20 >>>> authorized spoofing. The doc could give the credential to his=20 >>>> mobile SP if they sign on his behalf. >>>=20 >>> I don't understand how that is different from regular delegation. >>>=20 >>> When his landline carrier gave him a delegated certificate for his land= line number, he should be able to install that in whatever devices he wants= - his landline UA, his mobile phone, etc. It is still delegated from his l= andline carrier, even when used with calls via his mobile carrier. >>>=20 >>> Thanks, >>> Paul >>>=20 >>>> Some folks don't like attaching the "spoofing" label to a legitimate u= se. >>>>=20 >>>> But that's how I describe it. >>>>=20 >>>> Brian >>>>=20 >>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>> > wrote: >>>>>=20 >>>>> +1, but with one question below: >>>>>=20 >>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>> I think all we need is to have credentials follow the delegation=20 >>>>>> path, >>>>>=20 >>>>>> plus the option to add another level (not delegation) for=20 >>>>>> authorized spoofers. >>>>>=20 >>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>=20 >>>>> Thanks, >>>>> Paul >>>>>=20 >>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>> long as the delegator is willing to take the heat for delegating=20 >>>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>> carriers who are willing to not care who they delegate to. The fact= that there are some who do doesn't change much. >>>>>> Making stir work means knowing who you are delegating to, so that=20 >>>>>> you can pass the hot potato. >>>>>>=20 >>>>>> It's perfectly reasonable for a carrier to be able to sign for any=20 >>>>>> calls placed on its network on any number it has been delegated. =20 >>>>>> If it does, it's asserting that the calls are from who they are supp= osed to be from. >>>>>> That should be straightforward, but we know it's not always, and=20 >>>>>> that represents the hard part of deployment in my opinion. But=20 >>>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>>> delegatee. But, that only works if they know who they are delegatin= g to. >>>>>>=20 >>>>>> The root of the whole model is that there is a formal or informal=20 >>>>>> delegation path for telephone numbers in every country, and we can=20 >>>>>> build a chain of trust from that delegation path. If you propose=20 >>>>>> to alter that model, then we get into (policy) issues of which=20 >>>>>> carriers/entities we trust and which we don't. Our model is that=20 >>>>>> you know who you delegate to, and once you do that delegation, it's = their problem. >>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>> business practices. >>>>>>=20 >>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>> having a way to know which TNs are covered by a credential. =20 >>>>>> That's what we have, and I'm loath to change it. >>>>>>=20 >>>>>> Brian >>>>>>=20 >>>>>>=20 >>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>> =20 >>>>>>> > >>>>>>> wrote: >>>>>>>=20 >>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>> and use cases. >>>>>>>=20 >>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>> individual devices as well as multi-device and multi-number platfor= ms. >>>>>>>=20 >>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>> relationships are two additional factors which affect=20 >>>>>>> trustworthiness of a given calling number authentication. >>>>>>>=20 >>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>>> that variability. >>>>>>>=20 >>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>> can qualify to some degree the trustworthiness of number authentici= ty accordingly. >>>>>>>=20 >>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>> (both for the carriers and the consumers) and I assume diminishes v= alue. >>>>>>>=20 >>>>>>> My reason for adding the authenticity of the originating carrier=20 >>>>>>> is typical trustworthiness of a carrier business relationship=20 >>>>>>> with typical consumers adds to the trustworthiness assessment and=20 >>>>>>> partially because carriers are a regulated point of forensic=20 >>>>>>> inquiry for CALEA and fraud. Additionally, most calls originate=20 >>>>>>> and terminate between mobile consumers where their carriers are=20 >>>>>>> able to usefully authenticate their device and have a high degree=20 >>>>>>> of confidence of the authenticity of the calling number. >>>>>>>=20 >>>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>>> not >>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>=20 >>>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>>> the calling party has to sign a call with a per-TN cert provided=20 >>>>>>> by the called party. No called party cert to include? Then the=20 >>>>>>> calling party does not have a trusted relationship with the=20 >>>>>>> called party, and the call can be authorized/treated accordingly. = =20 >>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> =20 >>>>>>> > >>>>>>> *Cc:* Alex Bobotek =20 >>>>>>> >; stir@ietf.org =20 >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> Well, the mechanisms are designed so that they could be deployed=20 >>>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>>>=20 >>>>>>> The notion of credentials that are traceable to a delegation of a=20 >>>>>>> TN is a mechanism that is part of the design of stir, and the=20 >>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>> credential. For the use case we've discussed, a mobile phone may=20 >>>>>>> also have a credential for, say, a TN that is delegated to a=20 >>>>>>> landline, to cover the example case of a doctor placing a call on=20 >>>>>>> his mobile, but getting his office number to show up as the calling= party. Use of such mechanisms is policy. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>> >>>>>> =20 >>>>>>> > >>>>>>> wrote: >>>>>>>=20 >>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>> isn't the right forum. >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> >>>>>>> > >>>>>>> *Cc:* Alex Bobotek >>>>>>> >; stir@ietf.org=20 >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> Of course I want PBXs to sign calls. As well as smart phones and >>>>>>> any other devices that can be programmed to do so. >>>>>>> They will be given credentials that only are valid for the TNs >>>>>>> they are authorized to sign for. They can try to sign any call, >>>>>>> but the validity of the credential would make such a signature >>>>>>> fail the checking. >>>>>>>=20 >>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>> reasonable way to deploy quickly, but I expect many SPs will want >>>>>>> to get out of the liability of signing on behalf of their >>>>>>> customers. If they can push of that responsibility to their >>>>>>> customer, only being responsible for getting the customer an >>>>>>> appropriate credential when they assign TNs, then I would expect >>>>>>> them to want to do so. That means the devices have to be able to >>>>>>> sign, but I understand many of the PBX vendors think that's >>>>>>> something they could provide in a future release. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>> >>>>>> = > >>>>>>> wrote: >>>>>>>=20 >>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>> extraordinarily easy to commit fraud with authenticated number= s? >>>>>>>=20 >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> >>>>>>> > >>>>>>> *Cc:* Alex Bobotek >>>>>>> >; stir@ietf.org=20 >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> First of all, we would want the PBX to generate the signature, >>>>>>> but the service provider can do that. It should not add a >>>>>>> valid signature to a call from a number it did not assign to >>>>>>> the trunk group connecting to the PBX, although it could >>>>>>> support the extra delegation required to support "authorized >>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>> calls from the same service provider and should not present >>>>>>> any issue. >>>>>>>=20 >>>>>>> Everyone will have to do work they don't do now to implement >>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>> >>>>>>> > wrote: >>>>>>>=20 >>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>> knowing whether the calling number is properly assigned >>>>>>> and valid from the perspective of the Enterprise. >>>>>>> Therefore, checking whether the calling number was from an >>>>>>> assigned range might be possible (and fraught with >>>>>>> administrative challenges), but of limited value. And in >>>>>>> the consumer market, there are calling products which >>>>>>> support a parent subscriber number and "companion" devices >>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>> the parent subscriber. These are examples of where the >>>>>>> authenticity of the calling number won't necessarily mean >>>>>>> the same thing as the authenticity of a call from a single >>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>> spoof checking. >>>>>>>=20 >>>>>>> In another forum and anticipating calling number >>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>> suggested using carrier-specific certs and encoding >>>>>>> specificity of authenticity, and calling number. This >>>>>>> provides the identity of the originating carrier, some >>>>>>> idea as to the accuracy or specificity of the calling >>>>>>> number, and validty of the calling number (assuming nonce >>>>>>> and replay issues can be addressed as reasonably suggested >>>>>>> below by Alex). >>>>>>>=20 >>>>>>> The representation of orig-carrier and trustworthiness >>>>>>> could be as follows: >>>>>>>=20 >>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>=20 >>>>>>> *00 - No Credentials* >>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>> networks that don't natively support SIP or which don't >>>>>>> choose to sign calls. E.g., international carriers. >>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>> entirely untrustworthy. >>>>>>>=20 >>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>> agreement, manual roaming. >>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>> untrustworthy >>>>>>>=20 >>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>> no per-TN screen (SIP trunks). >>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>=20 >>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>> trustworthy >>>>>>>=20 >>>>>>> *Public Use Case:* >>>>>>>=20 >>>>>>> Undefined but assumed to use public or commercially >>>>>>> available authentication services resources. e.g., >>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>> which would process them according to the rules of the >>>>>>> Public Class application(s). >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>> *To:* Alex Bobotek >>>>>> >>>>>>> > >>>>>>> *Cc:* stir@ietf.org >>>>>>> >>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> There are reasonable circumstances where a party placing a >>>>>>> call is not the authorized entity assigned the telephone >>>>>>> number used in From/PAI, and in such circumstances the >>>>>>> service provider servicing the entity placing the call may >>>>>>> or may not be the same as the service provider serving the >>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>> entity that is assigned the TN explicitly authorizes calls >>>>>>> placed using it's TN. The design accommodates such use >>>>>>> cases. It's not a blanket authorization without >>>>>>> authentication. We're not aware of any cases where there >>>>>>> is an actual requirement for legitimate calling without >>>>>>> explicit authorization from the assigned entity, although >>>>>>> we certainly are aware that various parts of various >>>>>>> service providers don't bother to check. At this point, at >>>>>>> least in some countries, there is a realization that the >>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>> any more. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>> >>>>>> > wrote: >>>>>>>=20 >>>>>>> 1. Permit authorization without authentication >>>>>>> In the current telephony network practice, some >>>>>>> service provider implementations choose not to >>>>>>> authenticate identity, but simply facilitate the use >>>>>>> of an arbitrary or selected user-provided identity. >>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>> established that there are not? How can the industry >>>>>>> reasonably expect to end this (often bad) practice? >>>>>>> If it can't be ended, there's value in at least >>>>>>> identifying the originating service provider >>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>> of abuse using telephone numbers assigned to a >>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>> important to identify the service provider(s) closest >>>>>>> to the abuser. Based on the assumption that it's >>>>>>> better to ID service providers than unreasonably >>>>>>> expect a ban of the use of unauthenticated (and >>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>> support authorization without authentication. The >>>>>>> practice of authorizing unauthenticated use exists, >>>>>>> and there is benefit to signing in these cases >>>>>>> (service provider identification). The language of >>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>> require or assume that that authentication will >>>>>>> precede authorization. Of course there may be other >>>>>>> use cases where signing includes authentication and >>>>>>> may not include a specific service provider's >>>>>>> authorization. >>>>>>>=20 >>>>>>>=20 >>>>>>> 2. Improve replay prevention >>>>>>> Proximate replay is possible while complying with this >>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>> seconds) SIP requests using the same token are legal >>>>>>> and subject to replay in many cases. An SDP body's >>>>>>> mky may not be present and if present its use is >>>>>>> optional. Some sort of mandatory new or existing >>>>>>> signed sequence, random # or request ID (e.g., Call-ID >>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>> of the request (e.g., tokens only good for 1 >>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>> receiving infrastructure, and therefore difficulties >>>>>>> with 'it's been used already' coordination allow a >>>>>>> faked MESSAGE based on a captured request. This might >>>>>>> include an mkey from a captured INVITE. So it may be >>>>>>> possible to DOS, spam or text-bomb a recipient using a >>>>>>> captured identity. While large-scale or distributed >>>>>>> implementations may make the enforcement difficult, >>>>>>> there is little cost to signing and decoding a method >>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>> practice should at least be discussed while perhaps >>>>>>> not required. >>>>>>>=20 >>>>>>>=20 >>>>>>> Specific markup suggestions: >>>>>>>=20 >>>>>>>=20 >>>>>>> NITS >>>>>>>=20 >>>>>>>=20 >>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>> parameter appearing *in*the >>>>>>>=20 >>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>> present, then the >>>>>>>=20 >>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>> parameter value is >>>>>>>=20 >>>>>>> present, and the verifier does not support it,=20 >>>>>>> it MUST ignore the >>>>>>>=20 >>>>>>> Identity header. If a supported "ppt" parameter=20 >>>>>>> value is present, >>>>>>>=20 >>>>>>> the verifier follows the procedures below,=20 >>>>>>> including the variations >>>>>>>=20 >>>>>>> described in Step 5. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> 3 >>>>>>> . >>>>>>> Background >>>>>>>=20 >>>>>>> [...] >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> Per [RFC7340 >>>>>>> ], problems such as=20 >>>>>>> robocalling, voicemail hacking, and >>>>>>>=20 >>>>>>> swatting are enabled by an attacker's ability to=20 >>>>>>> impersonate someone >>>>>>>=20 >>>>>>> else. The secure operation of most SIP=20 >>>>>>> applications and services >>>>>>>=20 >>>>>>> depends on authenticating and/or authorizing the=20 >>>>>>> source of communications as it is >>>>>>>=20 >>>>>>> represented in a SIP request. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> This identity architecture for SIP depends on=20 >>>>>>> includes provisions for a logical >>>>>>>=20 >>>>>>> "authentication service" which validates caller=20 >>>>>>> identity at or near origination. outgoing >>>>>>> requests. An >>>>>>>=20 >>>>>>> authentication service may be implemented either=20 >>>>>>> as part of a user >>>>>>>=20 >>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>> component of a network >>>>>>>=20 >>>>>>> intermediary like a proxy to which originating=20 >>>>>>> user agents send >>>>>>>=20 >>>>>>> unsigned requests. Once the sender of the=20 >>>>>>> message has been >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> This document specifies a means of sharing a=20 >>>>>>> cryptographic assurance >>>>>>>=20 >>>>>>> of authenticity of and/or authorization to use=20 >>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>=20 >>>>>>> It relies on the authentication service=20 >>>>>>> constructing tokens based on [...] >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> To maximize end-to-end security, it is typically=20 >>>>>>> obviously >>>>>>>=20 >>>>>>> preferable for end-users to acquire their own=20 >>>>>>> credentials; if they >>>>>>>=20 >>>>>>> do, their user agents can act as authentication=20 >>>>>>> services. However, >>>>>>>=20 >>>>>>> for some deployments, [...] >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> Regards, >>>>>>>=20 >>>>>>> Alex >>>>>>> * * >>>>>>> *Alex Bobotek* >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> ----------------------------------------------------------------- >>>>>>> ------- >>>>>>>=20 >>>>>>> This e-mail may contain Sprint proprietary information >>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>> others is prohibited. If you are not the intended >>>>>>> recipient, please contact the sender and delete all copies >>>>>>> of the message. >>>>>>=20 >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org =20 >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir >=20 >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 5 08:16:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2B7912D8EC for ; Fri, 5 Aug 2016 08:16:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 72OU7y9-DwNs for ; Fri, 5 Aug 2016 08:16:13 -0700 (PDT) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7210D12D575 for ; Fri, 5 Aug 2016 08:16:13 -0700 (PDT) Received: by mail-qk0-x22a.google.com with SMTP id x185so72964435qkc.2 for ; Fri, 05 Aug 2016 08:16:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=TTxQAW6uDwaOErT98euXvXprGrDeBjWnmsctB1crD48=; b=K5iFMMNY3FjwzFJyjopq3OR1e6uWSVrS7kHCJ7WyLYO/KFUEmQmA9ZsRWnym0a3ugO aMdVzqKa9rx8gPmOhFN3HhREP74tR+nADlz7m0PSsiSd5KQj6wY5J4T97fybelRIhcWN 3wY6JjXQrayqtOIhhYIYXD7LYnF5DA3XFRc2wqCyQ/N0BgrwlKF0J4xy5LHNM1aDRGKF llOvjcDz9myKDGL3KviFJGwwEQavYb7L7RpQhB+rc7bJIxgZFxMVwEo/MkcvSUd8yVDH vkGEgnd8GufsxspRMIFXuFEmjGLQCGAVwTZ8hcpycJFOaUp3jaoXCbj1r2gfdcEK+eyJ gDGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=TTxQAW6uDwaOErT98euXvXprGrDeBjWnmsctB1crD48=; b=fuLipHds2gcYOsPxRwZDiqQUwC2c+g/qKVGX6rcpZ1B+0IZWHISvfk6oAiaEU8/xK4 K8MtGGGRNe3oKA06dqorsiKaG/cm0MClGdgPQF2LuRzWcDVT+lO6XyzYFrCz576+wk/i t+Ksrtfq9eOe0LRMLfnavMpZgi+egUzWJJVqavij6384RniQqyTEbW438g5DkwSFARa4 fCTi3JD2pQ0ST5wDQVE59WMlW5vIHFgPu9Vj5cJ8rvirYSgIpZESTiJFyCSzL951DJ+B QETXa2wYi4YvaB2M0CJPuRIK3NUiCH2LDOovBu/zVKBGoGhxY9rKkX5vQsaHDOKSyiIc NfUA== X-Gm-Message-State: AEkoouse6jk/+HME0jtQ3zebSmL5ve4vbRdlTWBRjDyqcpw2XQYu4VPRfRU1l6RXR4G3mw== X-Received: by 10.55.191.193 with SMTP id p184mr13064188qkf.67.1470410172240; Fri, 05 Aug 2016 08:16:12 -0700 (PDT) Received: from [10.33.193.6] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id 55sm9840024qtm.36.2016.08.05.08.16.10 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 05 Aug 2016 08:16:10 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <153E750D-FF98-4261-9926-6F500EA1462F@att.com> Date: Fri, 5 Aug 2016 11:16:08 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <6B577009-93C6-4438-A9AF-E0FF15809B43@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <153E750D-FF98-4261-9926-6F500EA1462F@att.com> To: "DOLLY, MARTIN C" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , "stir@ietf.org" , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 15:16:20 -0000 Right, but we really don=92t have a concept of =93Display Numbers=94 vs = =93Network Numbers=94 in the US. We do have cases where a call center = would want to use the main number of an enterprise when it calls on = behalf of that enterprise. I would call that =93authorized spoofing=94, = especially when the carrier for the enterprise is different from the = carrier for the call center, but it doesn=92t matter what we call it, we = would have one number, and it probably would be in PAI (=46rom would be = ignored). The call center could sign the call using a credential issued = by the enterprise base on the credential it=92s carrier issued to it. = Or, the call center=92s carrier could sign using a credential issued by = the enterprise carrier based on a request to the enterprise, or some = other similar path. In the UK case, they have two numbers, both of which are carried in the = signaling, and Paul seemed to indicate that the network number was = carried in PAI. Brian > On Aug 5, 2016, at 10:53 AM, DOLLY, MARTIN C wrote: >=20 > Yes if PAI present >=20 > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards=20 > AT&T > Cell: 609-903-3360 > Email: md3135@att.com >=20 >> On Aug 5, 2016, at 10:42 AM, Richard Shockey = wrote: >>=20 >>=20 >> Humm this is getting interesting. Its my understanding that the = display number aka =93presentation number=94 in the US context is the = one carried in the PAI. Martin, Pierce?=20 >>=20 >>=20 >>=20 >>=20 >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" = wrote: >>=20 >> Jumping in now that we're on European working time, +1 on Paul's = observation. >>=20 >> Here in the UK, we've got 2 numbers carried as calling line = IDs....one (we term the Network Number, carried in PAID) uniquely = identifies the line, the other (we term Presentation Number, carried in = From) is used for display purposes. >>=20 >> Only the carrier has the authority to set the Network Number so = only they could sign it. =20 >>=20 >> But - subject to regulatory restrictions which are well documented = - the number sent for display purposes belongs to the customer. For = blue-chip customers, I can allow them to send their Presentation Numbers = into the network, and can't readily check at a network level that = they're theirs (I do have contractual safeguards). The number may have = been allocated by me, or could be allocated by a third party provider. = If it's a call-centre they'll be making outbound calls for lots of = different customers which will change on day-by-day basis. This is = business as usual. I don't like the term "authorised spoofing" because = it implies that the CLI is in some way being rigged: it's not, it's the = corporate customer or their subcontractor using the number that's been = assigned (so in internet terms delegated) to them via a chain of trust = from the regulator. >>=20 >> What I want is the ability for customers to use their credentials = to sign the CLIs they send me so that at the terminating end it can be = checked (or indeed somewhere en-route if that's the business model). I = can and would sign for customers on my mobile business since I'm driving = what number is presented, but that's by-the-by because they aren't the = ones who generate millions of nuisance calls. If the signing only = occurs at the originating carrier level for corporate/call-centre = customers that's no use because I'm not in a position to do that for = these type of customers...and the whole system becomes a waste of time. = I'd also highlight there are many more of my large customers that I'd = trust more than a far end originating carrier that could be anywhere in = the world (though we have no shortage of small carriers that I wouldn't = know from Adam more locally in the UK....) >>=20 >> Regards >>=20 >> Paul >>=20 >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being = delegated the TN, it's being authorized to place calls that are not from = that TN, but appear to be. >>>=20 >>> The mechanism to handle the credential is exactly the same as a = delegation, so if you want to call it delegation, go ahead, but I prefer = to call it authorized spoofing. >>=20 >> IIUC the delegation is to a responsible entity (something that can = be held legally accountable - e.g. a person), not to a device. The = entity can then "use" the credential via any device(s) it chooses. In = the case of the mobile, the device then becomes a two-line phone. >>=20 >> Thanks, >> Paul >>=20 >>> Brian >>>=20 >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat = wrote: >>>>=20 >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20= >>>>> from his mobile, but sending the TN of his office phone as calling = party. >>>>> The delegation to his office phone was made by his landline = carrier=20 >>>>> to him. He then creates another credential, which he signs with = his=20 >>>>> office phone credential that authorizes his mobile to send calls=20= >>>>> from his office number. He is spoofing (because the call is = coming=20 >>>>> from his mobile's TN but claims to be from his office), but it's=20= >>>>> authorized spoofing. The doc could give the credential to his=20 >>>>> mobile SP if they sign on his behalf. >>>>=20 >>>> I don't understand how that is different from regular delegation. >>>>=20 >>>> When his landline carrier gave him a delegated certificate for his = landline number, he should be able to install that in whatever devices = he wants - his landline UA, his mobile phone, etc. It is still delegated = from his landline carrier, even when used with calls via his mobile = carrier. >>>>=20 >>>> Thanks, >>>> Paul >>>>=20 >>>>> Some folks don't like attaching the "spoofing" label to a = legitimate use. >>>>>=20 >>>>> But that's how I describe it. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>>=20 >>>>>> +1, but with one question below: >>>>>>=20 >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation=20= >>>>>>> path, >>>>>>=20 >>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>> authorized spoofers. >>>>>>=20 >>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>=20 >>>>>> Thanks, >>>>>> Paul >>>>>>=20 >>>>>>> I don't think it matters who the delegator or delegatee are as=20= >>>>>>> long as the delegator is willing to take the heat for delegating=20= >>>>>>> to someone who sends a lot of bad calls. They can pass the buck=20= >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20= >>>>>>> only if the SP knows who they delegated to, so authorities can=20= >>>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>>> carriers who are willing to not care who they delegate to. The = fact that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so = that=20 >>>>>>> you can pass the hot potato. >>>>>>>=20 >>>>>>> It's perfectly reasonable for a carrier to be able to sign for = any=20 >>>>>>> calls placed on its network on any number it has been delegated. = =20 >>>>>>> If it does, it's asserting that the calls are from who they are = supposed to be from. >>>>>>> That should be straightforward, but we know it's not always, and=20= >>>>>>> that represents the hard part of deployment in my opinion. But=20= >>>>>>> once they delegate, they can hand responsibility to sign to the=20= >>>>>>> delegatee. But, that only works if they know who they are = delegating to. >>>>>>>=20 >>>>>>> The root of the whole model is that there is a formal or = informal=20 >>>>>>> delegation path for telephone numbers in every country, and we = can=20 >>>>>>> build a chain of trust from that delegation path. If you = propose=20 >>>>>>> to alter that model, then we get into (policy) issues of which=20= >>>>>>> carriers/entities we trust and which we don't. Our model is = that=20 >>>>>>> you know who you delegate to, and once you do that delegation, = it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some=20= >>>>>>> business practices. >>>>>>>=20 >>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>> having a way to know which TNs are covered by a credential. =20 >>>>>>> That's what we have, and I'm loath to change it. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> OK, you talked me into indulging in one more message on policy=20= >>>>>>>> and use cases. >>>>>>>>=20 >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20= >>>>>>>> individual devices as well as multi-device and multi-number = platforms. >>>>>>>>=20 >>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>> relationships are two additional factors which affect=20 >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>=20 >>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>> reason for suggesting a way to qualify the signature to reflect=20= >>>>>>>> that variability. >>>>>>>>=20 >>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>> coming from a device assigned a single number, or from "trunk=20= >>>>>>>> group" which could originate calls using multiple numbers, and=20= >>>>>>>> can qualify to some degree the trustworthiness of number = authenticity accordingly. >>>>>>>>=20 >>>>>>>> My suggestion was qualifying calling number authenticity into=20= >>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>> semi-authenticated, and most-authenticated. There can be more=20= >>>>>>>> granularity, but it implies additional operational complexity=20= >>>>>>>> (both for the carriers and the consumers) and I assume = diminishes value. >>>>>>>>=20 >>>>>>>> My reason for adding the authenticity of the originating = carrier=20 >>>>>>>> is typical trustworthiness of a carrier business relationship=20= >>>>>>>> with typical consumers adds to the trustworthiness assessment = and=20 >>>>>>>> partially because carriers are a regulated point of forensic=20 >>>>>>>> inquiry for CALEA and fraud. Additionally, most calls = originate=20 >>>>>>>> and terminate between mobile consumers where their carriers are=20= >>>>>>>> able to usefully authenticate their device and have a high = degree=20 >>>>>>>> of confidence of the authenticity of the calling number. >>>>>>>>=20 >>>>>>>> I think billions of per-TN certs of varying usability (revoked,=20= >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>=20 >>>>>>>> Conversely, I think billions of per-TN certs will work well, if=20= >>>>>>>> the calling party has to sign a call with a per-TN cert = provided=20 >>>>>>>> by the called party. No called party cert to include? Then = the=20 >>>>>>>> calling party does not have a trusted relationship with the=20 >>>>>>>> called party, and the call can be authorized/treated = accordingly. =20 >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20= >>>>>>>> >; stir@ietf.org = =20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Well, the mechanisms are designed so that they could be = deployed=20 >>>>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>>>>=20 >>>>>>>> The notion of credentials that are traceable to a delegation of = a=20 >>>>>>>> TN is a mechanism that is part of the design of stir, and the=20= >>>>>>>> design allows delegation of one TN (to one device, although a=20= >>>>>>>> device like a PBX would have more than one TN per "device", and=20= >>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>> credential. For the use case we've discussed, a mobile phone = may=20 >>>>>>>> also have a credential for, say, a TN that is delegated to a=20 >>>>>>>> landline, to cover the example case of a doctor placing a call = on=20 >>>>>>>> his mobile, but getting his office number to show up as the = calling party. Use of such mechanisms is policy. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>>> isn't the right forum. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones = and >>>>>>>> any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs >>>>>>>> they are authorized to sign for. They can try to sign any = call, >>>>>>>> but the validity of the credential would make such a signature >>>>>>>> fail the checking. >>>>>>>>=20 >>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will = want >>>>>>>> to get out of the liability of signing on behalf of their >>>>>>>> customers. If they can push of that responsibility to their >>>>>>>> customer, only being responsible for getting the customer an >>>>>>>> appropriate credential when they assign TNs, then I would = expect >>>>>>>> them to want to do so. That means the devices have to be able = to >>>>>>>> sign, but I understand many of the PBX vendors think that's >>>>>>>> something they could provide in a future release. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> = > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated = numbers? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> First of all, we would want the PBX to generate the = signature, >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign = to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support = "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>>=20 >>>>>>>> Everyone will have to do work they don't do now to = implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> Fraud from compromised PBXes is common. And even where = a >>>>>>>> PBX is not compromised, a carrier has no practical way = of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from = an >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And = in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" = devices >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily = mean >>>>>>>> the same thing as the authenticity of a call from a = single >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>>=20 >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming = nonce >>>>>>>> and replay issues can be addressed as reasonably = suggested >>>>>>>> below by Alex). >>>>>>>>=20 >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>>=20 >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>=20 >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o = roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = entirely >>>>>>>> untrustworthy >>>>>>>>=20 >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, = but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less = than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls = from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>>=20 >>>>>>>> *Public Use Case:* >>>>>>>>=20 >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et = cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> There are reasonable circumstances where a party = placing a >>>>>>>> call is not the authorized entity assigned the = telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call = may >>>>>>>> or may not be the same as the service provider serving = the >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes = calls >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where = there >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, = although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, = at >>>>>>>> least in some countries, there is a realization that = the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> 1. Permit authorization without = authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the = use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has = anyone >>>>>>>> established that there are not? How can the = industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the = prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) = closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing = should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should = NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with = this >>>>>>>> spec. First, one or more proximate (e.g., within = 60 >>>>>>>> seconds) SIP requests using the same token are = legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., = Call-ID >>>>>>>> or CSeq) and a 1-time use policy on the receiving = end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods = (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore = difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This = might >>>>>>>> include an mkey from a captured INVITE. So it may = be >>>>>>>> possible to DOS, spam or text-bomb a recipient = using a >>>>>>>> captured identity. While large-scale or = distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a = method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Specific markup suggestions: >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> NITS >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>>=20 >>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>> present, then the >>>>>>>>=20 >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>>=20 >>>>>>>> present, and the verifier does not support it,=20= >>>>>>>> it MUST ignore the >>>>>>>>=20 >>>>>>>> Identity header. If a supported "ppt" parameter=20= >>>>>>>> value is present, >>>>>>>>=20 >>>>>>>> the verifier follows the procedures below,=20 >>>>>>>> including the variations >>>>>>>>=20 >>>>>>>> described in Step 5. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 3 >>>>>>>> = . >>>>>>>> Background >>>>>>>>=20 >>>>>>>> [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as=20 >>>>>>>> robocalling, voicemail hacking, and >>>>>>>>=20 >>>>>>>> swatting are enabled by an attacker's ability to=20= >>>>>>>> impersonate someone >>>>>>>>=20 >>>>>>>> else. The secure operation of most SIP=20 >>>>>>>> applications and services >>>>>>>>=20 >>>>>>>> depends on authenticating and/or authorizing the=20= >>>>>>>> source of communications as it is >>>>>>>>=20 >>>>>>>> represented in a SIP request. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>> includes provisions for a logical >>>>>>>>=20 >>>>>>>> "authentication service" which validates caller=20= >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>>=20 >>>>>>>> authentication service may be implemented either=20= >>>>>>>> as part of a user >>>>>>>>=20 >>>>>>>> agent or as a proxy server; typically, it is a=20= >>>>>>>> component of a network >>>>>>>>=20 >>>>>>>> intermediary like a proxy to which originating=20= >>>>>>>> user agents send >>>>>>>>=20 >>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>> message has been >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This document specifies a means of sharing a=20 >>>>>>>> cryptographic assurance >>>>>>>>=20 >>>>>>>> of authenticity of and/or authorization to use=20= >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>=20 >>>>>>>> It relies on the authentication service=20 >>>>>>>> constructing tokens based on [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> To maximize end-to-end security, it is typically=20= >>>>>>>> obviously >>>>>>>>=20 >>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>> credentials; if they >>>>>>>>=20 >>>>>>>> do, their user agents can act as authentication=20= >>>>>>>> services. However, >>>>>>>>=20 >>>>>>>> for some deployments, [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Regards, >>>>>>>>=20 >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> = ----------------------------------------------------------------- >>>>>>>> ------- >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use = by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all = copies >>>>>>>> of the message. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>=20 >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 5 08:27:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D429912D8B1 for ; Fri, 5 Aug 2016 08:27:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSCjYNXpcOHX for ; Fri, 5 Aug 2016 08:27:12 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0130.outbound.protection.outlook.com [104.47.36.130]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9ED5212D635 for ; Fri, 5 Aug 2016 08:27:12 -0700 (PDT) Received: from BL2FFO11FD010.protection.gbl (10.173.160.31) by BL2FFO11HUB018.protection.gbl (10.173.160.110) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Fri, 5 Aug 2016 15:26:57 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BL2FFO11FD010.mail.protection.outlook.com (10.173.161.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Fri, 5 Aug 2016 15:26:57 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u75FOdUR045693; Fri, 5 Aug 2016 11:26:57 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24gns3vppp-2 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 05 Aug 2016 11:26:57 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 5 Aug 2016 10:26:55 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Fri, 5 Aug 2016 10:26:55 -0500 From: "Gorman, Pierce A [CTO]" To: Richard Shockey , "Rosbotham, Paul, Vodafone UK" , Paul Kyzivat , "Brian Rosen" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA6eNtA Date: Fri, 5 Aug 2016 15:26:54 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(189002)(13464003)(199003)(377454003)(24454002)(15975445007)(5001770100001)(97736004)(50466002)(33646002)(47776003)(305945005)(7846002)(7736002)(7696003)(8936002)(8676002)(586003)(8666005)(356003)(24736003)(92566002)(19580395003)(81156014)(81166006)(87936001)(2171001)(11100500001)(108616004)(19580405001)(6116002)(2950100001)(5250100002)(102836003)(2900100001)(5890100001)(93886004)(3846002)(4326007)(86362001)(2906002)(106116001)(106466001)(76176999)(68736007)(189998001)(54356999)(50986999)(23676002)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2FFO11HUB018; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD010; 1:3gI4AvpyadpW/+olowLqkBTqkPaUm6X8JaTu2aNBftoau4lmrfuZ5oM2JM4D6bTANgE9lEZS7q8peY+Q85XAcw0dJeMzB3yW60VzKWzteXbr6FQ0fDa1+OI/ku7AeYviCxIuEeQt2rx+56xBSlJRXHMTd9F8ykGpl4XUCAinh/lYhCf7aL/nzQl2n01Q29dQwFtZTD0luMsbaJAGn5U2j3wYGZMr8W58Kzk+W5aRtB0BcNQ/0pU1N3AAPcJTwDknkdM43qJ57SNrd7MR8OMUwjEGj/hsd8Yiow+GINcD8mru4Iz9D3B2un3ALZ0dvzj88gvkRONohjEg8d4jOlhcKuZpKO7ttdehx4BRnUsUCLliF6LEIGAu60LnyACCekQCuOcwSmCDLAEYn5Wt4PONw9hs5dZNNbpqjwOc0iC3tVNDYkR+dlnCetanxm2TSrT/bXz0jbcfB4i1SQlSIgina4x5gXdqNILuvfHbfyp7MNXM0y8e1HL9uYxMhYszpUNlPldAlha/uLUp1fGEmQ6NNI2KKaINeHu0ls8npi0GDuIDwJ4KThDW9C1wErc0PNczi9Xte9RQBfg552gqBYXbzQ== X-MS-Office365-Filtering-Correlation-Id: 101b8ba1-4421-4e6f-2cb5-08d3bd44f077 X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB018; 2:JIugCYqsIfEyQh39O7yjhhdkzQHg82MbLDvVLoi+inxkbNdwwHtJQAP9yOkkGvTIPbSLorjkzaY2DqMgjsQ8wyl/X2EylGxepfdY+4pKtf/+bJEuH/TuqAMLWmpZvKlSuMSjDip9WLgfhrEMpTac/tD60mFDIkwXMfknt9j0XdOgoPsupAMK5BO/6lGxP8R8; 3:b/EQChJRIz7exJjN4/QoYLHB4M4uwxjhenmanFa8Jopji+jy/XqeG00JavaFv0aY1fo3ZaGjBCk1QUmmrk2ulv4hpdV4S2lXwCi2qUUu5+TBz6155tzEYPkmRH14MUdpv5zM8vSbELqCEtoaW1CeFYKSV+k3U3+5iXjuXKVcyUPECNGd43HI7z5F6OFGwtoCyiZgo3OZZFCYBqkv+pO+ixevF8myPGIlsFYFjS1Wk0sSDvP3RRY+SQIaINd++HjAxZyWYvUpjGDSgRZpSof5ng==; 25:FFDxqFLFzPXvNCbjNj8FaWgI3b660px2yTKZXmjirPxZEa2sUIEjjQrdFgUoV+kz8IY6JD4x4rsYFIbHQUCTi8xQGGV8wyeOMNF8johAwF6gyBx1JCXT06DCaxxRM/+xTS7yX43EUQvIUzKwypEWnTuhc3cfTXyDK55bc2bmcDjS7GChydoP6I9FrLdrbqT2l9BYD18d9tklABGcnj2SyHQ4Ba1dyjEfptBe0ddW03Ine4gnKcPyBUm8JnTJvHPlbOH3qut70SvEj6+2jBe23KlaQGUCTvHTW21YK4D5yfRJCI51LN8AgyM0z5K28jOU5Ak71ZDhbOxCbGPHD/DVcDakie1ukrZjOjrpcd5EtG2z45AnXnscZPH/x1JxZPqIpLpQoGU5CSPAr95TKCJmf/z6y85EgfEWnDl/VZDSpzDzpz/VZwNt6k7CXhd6E8Bl X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BL2FFO11HUB018; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB018; 31:5kPVBcqq6UbxTUUHy4gNoB2ZrYD14cmlKG6J8vd8F5SyZbWJFYkUe8tRCB3VS2cTs78XMQnxT/Yemry18S4109ZtdhjzPaqt7VCoF3YUXGw7+d26ekf/AJg4dmhsvjzGlEHios46ZlczYSqHiSqnAJb0QZ+Mg8n/RSlEbrqvtm4Yg4EZT/jZYl4fXZmWDQKIZY5VWlJtWxn/vOlRVmuPofkN7jWdqxMfjFMVQ2cXK9k=; 20:kaouUwkOE3Tb2uASAMCuCtOxPqMn68XVCdCpx3FyBEDQdQZg3vUcAIxmyg6NMBuMX7fEX1iQJnMQPwcGQ5YG6egbACWpD/Gaety/ySSOWu4QoiIm659gBGltxsgPMYrTeNTQqqxZhotTQMWOd5CRKkgF9qCYJgKPfbMueRg+hfoWG9z6qcQsFR8/O63XSoutIryPV1AtyUHLxZUgl6DJYYmW5eNj+kuf9Yl1zrlKKIygaRnXnBqvEsyQ2cmgz+ZYJmejQdPBin0Y2ppMFNER+R9t03KCdBLVQG28fDKhjZzxAK3LQIZxzUJhTBUIN9Q0xa3oBbeZgx9Cp4exVZ3h1PPMzoaLilaic4+0Gf26JilyZGxZoEFynfVVtuEdW0PzX0LRE0X9oBDYyxmnjoQ5cj9OOO2YRai8sIP14nJIuhU= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(13017025)(13015025)(13024025)(13023025)(8121501046)(5005006)(13018025)(3002001)(10201501046)(6055026); SRVR:BL2FFO11HUB018; BCL:0; PCL:0; RULEID:; SRVR:BL2FFO11HUB018; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB018; 4:Pk+9zDEvTa0tXcZFMTdfrATPXcWNlY8mFYGYAc16nJbfH3tbOXJMW/h/KrgGhwjKR02uc26+Yx/wDo4OM0m5+JBr4eH31EIlqliU+a0o85t/0ab2Ng8d03v/hW9imb21XTjbBSW+Rhe8yU0yUnNylvMu2L4vBqQb2AdW5/ljWyvoK5pMFrbYbIssLDt+CsUH4Si/XhwJOfwRtjnnb/KsHoR6XqvtCS/dvzU9dscRIdOEIGJXuUmcSVG+SbirSv30z7vm07/VI81V3g4NgfpG5tXLhtvmdo58MNayOkN7sT2eCJF/z2QPMwZq62I5gDUPbr0HR3sygFNM0GVXnqqk2/yojHx8Rr+4ZAP6kqSHYDB7RtEM/zDiknFAB9dYw3PImYXaKmo6Jr6RZ6Pp8VSLwEqx13V7zlsUVAt8HX8MhKCiTldundASaoO4Zw7qP3LzCE40Ql5qqUOU8R46/D9/et9G/biigbwUjTwaxLgvHnJhcjAYg/Kbgf0s9q2Zd5v8yhslxxGzSGOLG0c5LJly1Q0oWD2VDWhIvHFoMbaJ6zyuXHqt6yLURcRKjty2x+FywbLm8z6FthpnYO9Uz03P1NWJ6ql5Yxjty1Yta5wRIsAdYh3XZSFaIZYwlSq1bUTvooVAmTzoriIIuGfoFNGCX5/dkbqKF2PGbu7Ms3hiKkM= X-Forefront-PRVS: 0025434D2D X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTDJGRk8xMUhVQjAxODsyMzpFeDVnSlVYTlczckd3cXpSVE1TSXNLd0Yz?= =?utf-8?B?NUdySy9XTjFiNyttbkVvdzkwZ0RVVUp3Q2gzTi84L01RWHN3cy94RFd2dHBW?= =?utf-8?B?YTVPZXZ0Ri9EeFFGbmRKbVVqZFlWNFRvZEo0MnZka3FBbFJSbjZhOS91bzZS?= =?utf-8?B?TW04SmxkeGJvelltS2thMGx0ekFBZEVXZ1hMcGpLWmtDbFZVUEZrdFBJZ2Jy?= =?utf-8?B?cGNMdElOWGJsSUpWU2QwZnpkSXRpcCs5alhzc1c5dmllNEp1NWJycXhuWXdC?= =?utf-8?B?TEMvTFEwaGZ6T2N1SjBVUmpIQ09EMVRGVG0vRnJqVC8zZTVSM2R5QWovcWMz?= =?utf-8?B?bnVCTkZtelBmdVZoOU1BZFEvOFk4ZXg4ekZiVERZVXNCeWVtYVVGVmhlRVR1?= =?utf-8?B?TDJEc3dua0l0SEtHR0RweU84cllaUGRUV3FTQnYxUk9mMXMxN0EvREE2cUxZ?= =?utf-8?B?dEU5K28yMnlJaVZQclJjR0hEOFdYZFFJUTRheU5razZ3bWkwRXdSbTJHYzJT?= =?utf-8?B?eFkrRmFLVmhpTy9kdi9TSVFlVDg5WlpLRzh2N1d1VmpUdTBlTzJFK2YrUTVu?= =?utf-8?B?dGhPaDMxWmt6c1RYQ3FtY1BzTVpqRlJlVzVPM0lJWDVzYlFmRkNpYm5IQUtI?= =?utf-8?B?TWJUekxlVHBPc2N3RnJjK0RJUndRTnRaOEF0bnlPY0hVQ1BuS3E4MGxEeS9m?= =?utf-8?B?ZWNpSjh4UCtvR21VOEdRQUtmc0tnSUsvemtYVlpQbFI3M2lFQmpQQjVqMEQx?= =?utf-8?B?Ulp2dFFtOE5LeWdUU01jb0U0cGJyRWd1aWJLeVYzazdHR29TTkJHVFlKcDNw?= =?utf-8?B?aXdLVk85a2xMSDRMVHBUQmN0dnpGdzI4YzJuODh4QUFRR3plNVVwSjd4VTY1?= =?utf-8?B?aW40RWVXNksxSFZWR0dyM1pZSzQrM1JObUZkUlJqdXJTcktKVFlIL0tiRUh1?= =?utf-8?B?bFpHamJhQ3pKTUx3UlVxVm1OTGppaFNjR2dlT3VBZkpCT3BsWXRzTVBEczcw?= =?utf-8?B?TEdQZGZjVTMxNFBCOTdUWGlDWElxUmxXS0lrQlNsaFV2Vi9PcjBzd05wNkZV?= =?utf-8?B?SHJSenVaVE52aXUvbW5YSnF0YStzWWZCQWw1QTJieWlCUFZSSWYycmUvQUlJ?= =?utf-8?B?VkhGc1l5WHVpQ2RaemJHa3ZoWWtTUERyMzc4bGNWaEpGZXR4bUQrbWxOZU82?= =?utf-8?B?ZWd1MlRlK1VBa2NLOWxYVHhKYzZwa0lEMHVaVTBQUXlkU3hQM09MMWlQeTBn?= =?utf-8?B?dklwUWxkaFFJMklEdmxJc2U1UWpqQVIxbGJ3RnAwQlRVcnNjZXJOYUlRVTZ5?= =?utf-8?B?T1VaMmxYS290TUFOOVFQSWdHVHZUNjdTNUZLK0lLdW5rYUIvckdkZUorWXdY?= =?utf-8?B?cGU5OGFrMEZBNWgxY2hCc3RkMENSTndzZUZWWGIyTVlCTmo0bWsrSUVXN3Qy?= =?utf-8?B?VWlLa3BHZkFDMEhoTlprbjlyN3czUXdQT2h1OG5MeU1QQmNJVUZHT2ljMlc3?= =?utf-8?B?RlF1a3Y5cUl3VHlZaU9uUzNGcjFaZWU5L0JGd0NIemFCVEE3aWR4Ukk0L0Vm?= =?utf-8?B?am8yQ2d2TnpIeitlQjI2bzFvcW5rU3Nid3Z2SDhac0ZsS1dBckYzdEgzY0NS?= =?utf-8?B?d25LVTMzS0dzZytBNGNkZ0w5SWppOExFenRWM0E0MlgybGJLaStobEFYeGMx?= =?utf-8?B?alM5SFUrSlh2T29RRFRnMzkwVW1odzRQZDRubU01RXZXTmNXalZBckpISmFM?= =?utf-8?B?dmZkdEpVU2V6M3VDcFBwNDhoR0RIMVhMZDBTK0xPTUlQcXNUbGcvalptSEtU?= =?utf-8?Q?Vo2azXK9FrsBGM?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB018; 6:+mgb2ZDyw/xIIu1HLlIPu2ojWdV/BODLgzRFgIt0VdtpV/GGIBZVsxlUqCY6BOqu82JfgN55rSRVpMWSLUsvDAkffo76S0MXjbHYxDDb8LaYoJ6cqeSEsyt+XkRQjglu6z2PAqlSNe7atIakasoYjSICe3fCokTBgr7S9sNcksRcIHu3ITsoIfM9OaV3e9lyZs63mGMaOMNY62HyU5pBWEWDzgjJUhML5qLy4jYgGZ3k1pV//3mAfF723Qp2FrvBunt/p/GIPpK8bR84FnWsK1AaY1DphdLqms3Qasrpq6v5ORoKb+5g2XEeCrCz4C/66idq51HWWYlliZZf6l7Lrg==; 5:SU/ewkLqxU45hHmnLTtouRw3W2QIwaMojeM00k4ubQjPoQH033RbZtABtAHiSMspJwlEl7GT1LfNYlWbwkyIVfga5jBhumo3L1T5geGgIv6au82/VHCOgkrYAsiesSxL5ZSGt8cQZkpg4KqGmGJCVA==; 24:Y4+v+gBGyS8u0VaH5HlBqoxPvyYnJi/Q5iE7ECU/Bz/3T8nrhBQhRV8Nr1QQzX7oO7OW4Zy6gIgVHUzjyd2/XipOr+jtBa+lm7pWxEhIDT4=; 7:BjYvZVrleTkc1kC87qSIk5dyPbGgB+6pofxiiaITg66jwiuz58EM+Vrz8nbv+nnk9oy9CmDnEKr/YhgwcYheMpRH1m7DkxSDAGKuKUsXVHBCVLlEAgDaDzYOfT0FX1QSPXsxzGarqf1+jujLZdCCpsyKiB9s699Far1sBSBwULSHRZvKwQs+afj5IrY6zH58w4lP7NcEYh99kdUsYxkLAZ5ZsOdKWYdxdLap9YG22JrXriKUNFPaybXR5fdwJGIs SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Aug 2016 15:26:57.8515 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2FFO11HUB018 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 15:27:17 -0000 UC1Bc3NlcnRlZC1JZGVudGl0eSBpcyBzdXBwb3NlZCB0byBvcGVyYXRlICJhbW9uZyB0cnVzdGVk IFNJUCBlbnRpdGllcyIgYW5kIHRoZXJlZm9yZSBzb21lIHNwZWNpZmljYXRpb25zIChlLmcuLCAz R1BQIFRTIDI0LjYwNykgYXNzdW1lIFAtQXNzZXJ0ZWQtSWRlbnRpdHkgaXMgc3RyaXBwZWQgYnkg Ym9yZGVyIGNvbnRyb2xsZXIgZnVuY3Rpb25zIGFuZCBpcyBub3QgdG8gYmUgdXNlZCBpbiBpbnRl ci1jYXJyaWVyIGludGVyLWNvbm5lY3Rpb24gKGFsdGhvdWdoIGl0IGNvbW1vbmx5IHNob3dzIHVw IGFueXdheSkuICBNeSBvcGluaW9uIGlzIHRoZSAiRnJvbSIgaGVhZGVyIGlzIGxpa2VseSB1c2Vk IG1vcmUgb2Z0ZW4gZm9yIHByZXNlbnRhdGlvbi4NCg0KUGllcmNlDQoNCg0KLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCkZyb206IFJpY2hhcmQgU2hvY2tleSBbbWFpbHRvOnJpY2hhcmRAc2hv Y2tleS51c10NClNlbnQ6IEF1Z3VzdCAwNSwgMjAxNiA5OjM3IEFNDQpUbzogUm9zYm90aGFtLCBQ YXVsLCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsgUGF1bCBLeXpp dmF0IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+OyBCcmlhbiBSb3NlbiA8YnJAYnJpYW5yb3Nlbi5u ZXQ+DQpDYzogc3RpckBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMt MTAgY29tbWVudHMNCg0KDQpIdW1tIHRoaXMgaXMgZ2V0dGluZyBpbnRlcmVzdGluZy4gIEl0cyBt eSB1bmRlcnN0YW5kaW5nIHRoYXQgdGhlIGRpc3BsYXkgbnVtYmVyIGFrYSDigJxwcmVzZW50YXRp b24gbnVtYmVy4oCdIGluIHRoZSBVUyBjb250ZXh0IGlzIHRoZSBvbmUgY2FycmllZCBpbiB0aGUg UEFJLiAgTWFydGluLCBQaWVyY2U/DQoNCg0KDQoNCk9uIDgvNS8xNiwgMzo0NiBBTSwgInN0aXIg b24gYmVoYWxmIG9mIFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsiIDxzdGlyLWJvdW5jZXNA aWV0Zi5vcmcgb24gYmVoYWxmIG9mIHBhdWwucm9zYm90aGFtQHZvZGFmb25lLmNvbT4gd3JvdGU6 DQoNCiAgICBKdW1waW5nIGluIG5vdyB0aGF0IHdlJ3JlIG9uIEV1cm9wZWFuIHdvcmtpbmcgdGlt ZSwgKzEgb24gUGF1bCdzIG9ic2VydmF0aW9uLg0KDQogICAgSGVyZSBpbiB0aGUgVUssIHdlJ3Zl IGdvdCAyIG51bWJlcnMgY2FycmllZCBhcyBjYWxsaW5nIGxpbmUgSURzLi4uLm9uZSAod2UgdGVy bSB0aGUgTmV0d29yayBOdW1iZXIsIGNhcnJpZWQgaW4gUEFJRCkgdW5pcXVlbHkgaWRlbnRpZmll cyB0aGUgbGluZSwgdGhlIG90aGVyICh3ZSB0ZXJtIFByZXNlbnRhdGlvbiBOdW1iZXIsIGNhcnJp ZWQgaW4gRnJvbSkgaXMgdXNlZCBmb3IgZGlzcGxheSBwdXJwb3Nlcy4NCg0KICAgIE9ubHkgdGhl IGNhcnJpZXIgaGFzIHRoZSBhdXRob3JpdHkgdG8gc2V0IHRoZSBOZXR3b3JrIE51bWJlciBzbyBv bmx5IHRoZXkgY291bGQgc2lnbiBpdC4NCg0KICAgIEJ1dCAtIHN1YmplY3QgdG8gcmVndWxhdG9y eSByZXN0cmljdGlvbnMgd2hpY2ggYXJlIHdlbGwgZG9jdW1lbnRlZCAtIHRoZSBudW1iZXIgc2Vu dCBmb3IgZGlzcGxheSBwdXJwb3NlcyBiZWxvbmdzIHRvIHRoZSBjdXN0b21lci4gIEZvciBibHVl LWNoaXAgY3VzdG9tZXJzLCBJIGNhbiBhbGxvdyB0aGVtIHRvIHNlbmQgdGhlaXIgUHJlc2VudGF0 aW9uIE51bWJlcnMgaW50byB0aGUgbmV0d29yaywgYW5kIGNhbid0IHJlYWRpbHkgY2hlY2sgYXQg YSBuZXR3b3JrIGxldmVsIHRoYXQgdGhleSdyZSB0aGVpcnMgKEkgZG8gaGF2ZSBjb250cmFjdHVh bCBzYWZlZ3VhcmRzKS4gIFRoZSBudW1iZXIgbWF5IGhhdmUgYmVlbiBhbGxvY2F0ZWQgYnkgbWUs IG9yIGNvdWxkIGJlIGFsbG9jYXRlZCBieSBhIHRoaXJkIHBhcnR5IHByb3ZpZGVyLiAgSWYgaXQn cyBhIGNhbGwtY2VudHJlIHRoZXknbGwgYmUgbWFraW5nIG91dGJvdW5kIGNhbGxzIGZvciBsb3Rz IG9mIGRpZmZlcmVudCBjdXN0b21lcnMgd2hpY2ggd2lsbCBjaGFuZ2Ugb24gZGF5LWJ5LWRheSBi YXNpcy4gIFRoaXMgaXMgYnVzaW5lc3MgYXMgdXN1YWwuICBJIGRvbid0IGxpa2UgdGhlIHRlcm0g ImF1dGhvcmlzZWQgc3Bvb2ZpbmciIGJlY2F1c2UgaXQgaW1wbGllcyB0aGF0IHRoZSBDTEkgaXMg aW4gc29tZSB3YXkgYmVpbmcgcmlnZ2VkOiBpdCdzIG5vdCwgaXQncyB0aGUgY29ycG9yYXRlIGN1 c3RvbWVyIG9yIHRoZWlyIHN1YmNvbnRyYWN0b3IgdXNpbmcgdGhlIG51bWJlciB0aGF0J3MgYmVl biBhc3NpZ25lZCAoc28gaW4gaW50ZXJuZXQgdGVybXMgZGVsZWdhdGVkKSB0byB0aGVtIHZpYSBh IGNoYWluIG9mIHRydXN0IGZyb20gdGhlIHJlZ3VsYXRvci4NCg0KICAgIFdoYXQgSSB3YW50IGlz IHRoZSBhYmlsaXR5IGZvciBjdXN0b21lcnMgdG8gdXNlIHRoZWlyIGNyZWRlbnRpYWxzIHRvIHNp Z24gdGhlIENMSXMgdGhleSBzZW5kIG1lIHNvIHRoYXQgYXQgdGhlIHRlcm1pbmF0aW5nIGVuZCBp dCBjYW4gYmUgY2hlY2tlZCAob3IgaW5kZWVkIHNvbWV3aGVyZSBlbi1yb3V0ZSBpZiB0aGF0J3Mg dGhlIGJ1c2luZXNzIG1vZGVsKS4gIEkgY2FuIGFuZCB3b3VsZCBzaWduIGZvciBjdXN0b21lcnMg b24gbXkgbW9iaWxlIGJ1c2luZXNzIHNpbmNlIEknbSBkcml2aW5nIHdoYXQgbnVtYmVyIGlzIHBy ZXNlbnRlZCwgYnV0IHRoYXQncyBieS10aGUtYnkgYmVjYXVzZSB0aGV5IGFyZW4ndCB0aGUgb25l cyB3aG8gZ2VuZXJhdGUgbWlsbGlvbnMgb2YgbnVpc2FuY2UgY2FsbHMuICBJZiB0aGUgc2lnbmlu ZyBvbmx5IG9jY3VycyBhdCB0aGUgb3JpZ2luYXRpbmcgY2FycmllciBsZXZlbCBmb3IgY29ycG9y YXRlL2NhbGwtY2VudHJlIGN1c3RvbWVycyB0aGF0J3Mgbm8gdXNlIGJlY2F1c2UgSSdtIG5vdCBp biBhIHBvc2l0aW9uIHRvIGRvIHRoYXQgZm9yIHRoZXNlIHR5cGUgb2YgY3VzdG9tZXJzLi4uYW5k IHRoZSB3aG9sZSBzeXN0ZW0gYmVjb21lcyBhIHdhc3RlIG9mIHRpbWUuIEknZCBhbHNvIGhpZ2hs aWdodCB0aGVyZSBhcmUgbWFueSBtb3JlIG9mIG15IGxhcmdlIGN1c3RvbWVycyB0aGF0IEknZCB0 cnVzdCBtb3JlIHRoYW4gYSBmYXIgZW5kIG9yaWdpbmF0aW5nIGNhcnJpZXIgdGhhdCBjb3VsZCBi ZSBhbnl3aGVyZSBpbiB0aGUgd29ybGQgKHRob3VnaCB3ZSBoYXZlIG5vIHNob3J0YWdlIG9mIHNt YWxsIGNhcnJpZXJzIHRoYXQgSSB3b3VsZG4ndCBrbm93IGZyb20gQWRhbSBtb3JlIGxvY2FsbHkg aW4gdGhlIFVLLi4uLikNCg0KICAgIFJlZ2FyZHMNCg0KICAgIFBhdWwNCg0KICAgIC0tLS0tT3Jp Z2luYWwgTWVzc2FnZS0tLS0tDQogICAgRnJvbTogc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0Bp ZXRmLm9yZ10gT24gQmVoYWxmIE9mIFBhdWwgS3l6aXZhdA0KICAgIFNlbnQ6IDA0IEF1Z3VzdCAy MDE2IDIzOjEyDQogICAgVG86IEJyaWFuIFJvc2VuDQogICAgQ2M6IHN0aXJAaWV0Zi5vcmcNCiAg ICBTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0KDQogICAgT24g OC80LzE2IDY6MDIgUE0sIEJyaWFuIFJvc2VuIHdyb3RlOg0KICAgID4gSSB0aGluayBpdCdzIG5v dCBhIGRlbGVnYXRpb24uICBUaGUgbW9iaWxlIHBob25lIGlzIG5vdCBiZWluZyBkZWxlZ2F0ZWQg dGhlIFROLCBpdCdzIGJlaW5nIGF1dGhvcml6ZWQgdG8gcGxhY2UgY2FsbHMgdGhhdCBhcmUgbm90 IGZyb20gdGhhdCBUTiwgYnV0IGFwcGVhciB0byBiZS4NCiAgICA+DQogICAgPiBUaGUgbWVjaGFu aXNtIHRvIGhhbmRsZSB0aGUgY3JlZGVudGlhbCBpcyBleGFjdGx5IHRoZSBzYW1lIGFzIGEgZGVs ZWdhdGlvbiwgc28gaWYgeW91IHdhbnQgdG8gY2FsbCBpdCBkZWxlZ2F0aW9uLCBnbyBhaGVhZCwg YnV0IEkgcHJlZmVyIHRvIGNhbGwgaXQgYXV0aG9yaXplZCBzcG9vZmluZy4NCg0KICAgIElJVUMg dGhlIGRlbGVnYXRpb24gaXMgdG8gYSByZXNwb25zaWJsZSBlbnRpdHkgKHNvbWV0aGluZyB0aGF0 IGNhbiBiZSBoZWxkIGxlZ2FsbHkgYWNjb3VudGFibGUgLSBlLmcuIGEgcGVyc29uKSwgbm90IHRv IGEgZGV2aWNlLiBUaGUgZW50aXR5IGNhbiB0aGVuICJ1c2UiIHRoZSBjcmVkZW50aWFsIHZpYSBh bnkgZGV2aWNlKHMpIGl0IGNob29zZXMuIEluIHRoZSBjYXNlIG9mIHRoZSBtb2JpbGUsIHRoZSBk ZXZpY2UgdGhlbiBiZWNvbWVzIGEgdHdvLWxpbmUgcGhvbmUuDQoNCiAgICBUaGFua3MsDQogICAg UGF1bA0KDQogICAgPiBCcmlhbg0KICAgID4NCiAgICA+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNTo1 MSBQTSwgUGF1bCBLeXppdmF0IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+IHdyb3RlOg0KICAgID4+ DQogICAgPj4gT24gOC80LzE2IDU6NDMgUE0sIEJyaWFuIFJvc2VuIHdyb3RlOg0KICAgID4+PiBJ biBteSBqYXJnb24gYW4gImF1dGhvcml6ZWQgc3Bvb2ZlciIgaXMgdGhlIGRvY3RvciB3aG8gaXMg Y2FsbGluZw0KICAgID4+PiBmcm9tIGhpcyBtb2JpbGUsIGJ1dCBzZW5kaW5nIHRoZSBUTiBvZiBo aXMgb2ZmaWNlIHBob25lIGFzIGNhbGxpbmcgcGFydHkuDQogICAgPj4+IFRoZSBkZWxlZ2F0aW9u IHRvIGhpcyBvZmZpY2UgcGhvbmUgd2FzIG1hZGUgYnkgaGlzIGxhbmRsaW5lIGNhcnJpZXINCiAg ICA+Pj4gdG8gaGltLiAgSGUgdGhlbiBjcmVhdGVzIGFub3RoZXIgY3JlZGVudGlhbCwgd2hpY2gg aGUgc2lnbnMgd2l0aCBoaXMNCiAgICA+Pj4gb2ZmaWNlIHBob25lIGNyZWRlbnRpYWwgdGhhdCBh dXRob3JpemVzIGhpcyBtb2JpbGUgdG8gc2VuZCBjYWxscw0KICAgID4+PiBmcm9tIGhpcyBvZmZp Y2UgbnVtYmVyLiAgSGUgaXMgc3Bvb2ZpbmcgKGJlY2F1c2UgdGhlIGNhbGwgaXMgY29taW5nDQog ICAgPj4+IGZyb20gaGlzIG1vYmlsZSdzIFROIGJ1dCBjbGFpbXMgdG8gYmUgZnJvbSBoaXMgb2Zm aWNlKSwgYnV0IGl0J3MNCiAgICA+Pj4gYXV0aG9yaXplZCBzcG9vZmluZy4gIFRoZSBkb2MgY291 bGQgZ2l2ZSB0aGUgY3JlZGVudGlhbCB0byBoaXMNCiAgICA+Pj4gbW9iaWxlIFNQIGlmIHRoZXkg c2lnbiBvbiBoaXMgYmVoYWxmLg0KICAgID4+DQogICAgPj4gSSBkb24ndCB1bmRlcnN0YW5kIGhv dyB0aGF0IGlzIGRpZmZlcmVudCBmcm9tIHJlZ3VsYXIgZGVsZWdhdGlvbi4NCiAgICA+Pg0KICAg ID4+IFdoZW4gaGlzIGxhbmRsaW5lIGNhcnJpZXIgZ2F2ZSBoaW0gYSBkZWxlZ2F0ZWQgY2VydGlm aWNhdGUgZm9yIGhpcyBsYW5kbGluZSBudW1iZXIsIGhlIHNob3VsZCBiZSBhYmxlIHRvIGluc3Rh bGwgdGhhdCBpbiB3aGF0ZXZlciBkZXZpY2VzIGhlIHdhbnRzIC0gaGlzIGxhbmRsaW5lIFVBLCBo aXMgbW9iaWxlIHBob25lLCBldGMuIEl0IGlzIHN0aWxsIGRlbGVnYXRlZCBmcm9tIGhpcyBsYW5k bGluZSBjYXJyaWVyLCBldmVuIHdoZW4gdXNlZCB3aXRoIGNhbGxzIHZpYSBoaXMgbW9iaWxlIGNh cnJpZXIuDQogICAgPj4NCiAgICA+PiBUaGFua3MsDQogICAgPj4gUGF1bA0KICAgID4+DQogICAg Pj4+IFNvbWUgZm9sa3MgZG9uJ3QgbGlrZSBhdHRhY2hpbmcgdGhlICJzcG9vZmluZyIgbGFiZWwg dG8gYSBsZWdpdGltYXRlIHVzZS4NCiAgICA+Pj4NCiAgICA+Pj4gQnV0IHRoYXQncyBob3cgSSBk ZXNjcmliZSBpdC4NCiAgICA+Pj4NCiAgICA+Pj4gQnJpYW4NCiAgICA+Pj4NCiAgICA+Pj4+IE9u IEF1ZyA0LCAyMDE2LCBhdCA1OjM3IFBNLCBQYXVsIEt5eml2YXQgPHBreXppdmF0QGFsdW0ubWl0 LmVkdQ0KICAgID4+Pj4gPG1haWx0bzpwa3l6aXZhdEBhbHVtLm1pdC5lZHU+PiB3cm90ZToNCiAg ICA+Pj4+DQogICAgPj4+PiArMSwgYnV0IHdpdGggb25lIHF1ZXN0aW9uIGJlbG93Og0KICAgID4+ Pj4NCiAgICA+Pj4+IE9uIDgvNC8xNiA1OjE0IFBNLCBCcmlhbiBSb3NlbiB3cm90ZToNCiAgICA+ Pj4+PiBJIHRoaW5rIGFsbCB3ZSBuZWVkIGlzIHRvIGhhdmUgY3JlZGVudGlhbHMgZm9sbG93IHRo ZSBkZWxlZ2F0aW9uDQogICAgPj4+Pj4gcGF0aCwNCiAgICA+Pj4+DQogICAgPj4+Pj4gcGx1cyB0 aGUgb3B0aW9uIHRvIGFkZCBhbm90aGVyIGxldmVsIChub3QgZGVsZWdhdGlvbikgZm9yDQogICAg Pj4+Pj4gYXV0aG9yaXplZCBzcG9vZmVycy4NCiAgICA+Pj4+DQogICAgPj4+PiBJIGRvbid0IHVu ZGVyc3RhbmQgImF1dGhvcml6ZWQgc3Bvb2ZlcnMiIGluIHRoaXMgY29udGV4dCwgYXMNCiAgICA+ Pj4+IGNvbnRyYXN0ZWQgdG8gInNwb29mZXJzIiB3aG8gaGF2ZSBiZWVuIGRlbGVnYXRlZCB0aGVp ciBhdXRob3JpdHkuDQogICAgPj4+Pg0KICAgID4+Pj4gVGhhbmtzLA0KICAgID4+Pj4gUGF1bA0K ICAgID4+Pj4NCiAgICA+Pj4+PiBJIGRvbid0IHRoaW5rIGl0IG1hdHRlcnMgd2hvIHRoZSBkZWxl Z2F0b3Igb3IgZGVsZWdhdGVlIGFyZSBhcw0KICAgID4+Pj4+IGxvbmcgYXMgdGhlIGRlbGVnYXRv ciBpcyB3aWxsaW5nIHRvIHRha2UgdGhlIGhlYXQgZm9yIGRlbGVnYXRpbmcNCiAgICA+Pj4+PiB0 byBzb21lb25lIHdobyBzZW5kcyBhIGxvdCBvZiBiYWQgY2FsbHMuICBUaGV5IGNhbiBwYXNzIHRo ZSBidWNrDQogICAgPj4+Pj4gKCJJIGRlbGVnYXRlZCB0aGUgVE4gdG8gaGltLCBhbmQgbm93IEkn bSBub3QgcmVzcG9uc2libGUiKSwgYnV0DQogICAgPj4+Pj4gb25seSBpZiB0aGUgU1Aga25vd3Mg d2hvIHRoZXkgZGVsZWdhdGVkIHRvLCBzbyBhdXRob3JpdGllcyBjYW4NCiAgICA+Pj4+PiBmb2xs b3cgdGhlIGRlbGVnYXRpb24gcGF0aC4gIFRoZXJlIGFyZSBwbGVudHkgb2YgY2VydGlmaWNhdGVk DQogICAgPj4+Pj4gY2FycmllcnMgd2hvIGFyZSB3aWxsaW5nIHRvIG5vdCBjYXJlIHdobyB0aGV5 IGRlbGVnYXRlIHRvLiAgVGhlIGZhY3QgdGhhdCB0aGVyZSBhcmUgc29tZSB3aG8gZG8gZG9lc24n dCBjaGFuZ2UgbXVjaC4NCiAgICA+Pj4+PiBNYWtpbmcgc3RpciB3b3JrIG1lYW5zIGtub3dpbmcg d2hvIHlvdSBhcmUgZGVsZWdhdGluZyB0bywgc28gdGhhdA0KICAgID4+Pj4+IHlvdSBjYW4gcGFz cyB0aGUgaG90IHBvdGF0by4NCiAgICA+Pj4+Pg0KICAgID4+Pj4+IEl0J3MgcGVyZmVjdGx5IHJl YXNvbmFibGUgZm9yIGEgY2FycmllciB0byBiZSBhYmxlIHRvIHNpZ24gZm9yIGFueQ0KICAgID4+ Pj4+IGNhbGxzIHBsYWNlZCBvbiBpdHMgbmV0d29yayBvbiBhbnkgbnVtYmVyIGl0IGhhcyBiZWVu IGRlbGVnYXRlZC4NCiAgICA+Pj4+PiBJZiBpdCBkb2VzLCBpdCdzIGFzc2VydGluZyB0aGF0IHRo ZSBjYWxscyBhcmUgZnJvbSB3aG8gdGhleSBhcmUgc3VwcG9zZWQgdG8gYmUgZnJvbS4NCiAgICA+ Pj4+PiBUaGF0IHNob3VsZCBiZSBzdHJhaWdodGZvcndhcmQsIGJ1dCB3ZSBrbm93IGl0J3Mgbm90 IGFsd2F5cywgYW5kDQogICAgPj4+Pj4gdGhhdCByZXByZXNlbnRzIHRoZSBoYXJkIHBhcnQgb2Yg ZGVwbG95bWVudCBpbiBteSBvcGluaW9uLiAgQnV0DQogICAgPj4+Pj4gb25jZSB0aGV5IGRlbGVn YXRlLCB0aGV5IGNhbiBoYW5kIHJlc3BvbnNpYmlsaXR5IHRvIHNpZ24gdG8gdGhlDQogICAgPj4+ Pj4gZGVsZWdhdGVlLiAgQnV0LCB0aGF0IG9ubHkgd29ya3MgaWYgdGhleSBrbm93IHdobyB0aGV5 IGFyZSBkZWxlZ2F0aW5nIHRvLg0KICAgID4+Pj4+DQogICAgPj4+Pj4gVGhlIHJvb3Qgb2YgdGhl IHdob2xlIG1vZGVsIGlzIHRoYXQgdGhlcmUgaXMgYSBmb3JtYWwgb3IgaW5mb3JtYWwNCiAgICA+ Pj4+PiBkZWxlZ2F0aW9uIHBhdGggZm9yIHRlbGVwaG9uZSBudW1iZXJzIGluIGV2ZXJ5IGNvdW50 cnksIGFuZCB3ZSBjYW4NCiAgICA+Pj4+PiBidWlsZCBhIGNoYWluIG9mIHRydXN0IGZyb20gdGhh dCBkZWxlZ2F0aW9uIHBhdGguICBJZiB5b3UgcHJvcG9zZQ0KICAgID4+Pj4+IHRvIGFsdGVyIHRo YXQgbW9kZWwsIHRoZW4gd2UgZ2V0IGludG8gKHBvbGljeSkgaXNzdWVzIG9mIHdoaWNoDQogICAg Pj4+Pj4gY2FycmllcnMvZW50aXRpZXMgd2UgdHJ1c3QgYW5kIHdoaWNoIHdlIGRvbid0LiAgT3Vy IG1vZGVsIGlzIHRoYXQNCiAgICA+Pj4+PiB5b3Uga25vdyB3aG8geW91IGRlbGVnYXRlIHRvLCBh bmQgb25jZSB5b3UgZG8gdGhhdCBkZWxlZ2F0aW9uLCBpdCdzIHRoZWlyIHByb2JsZW0uDQogICAg Pj4+Pj4gVGhhdCdzIHByZXR0eSBhcHBlYWxpbmcgSSB0aGluaywgZXZlbiBpZiBpdCdzIGEgY2hh bmdlIGluIHNvbWUNCiAgICA+Pj4+PiBidXNpbmVzcyBwcmFjdGljZXMuDQogICAgPj4+Pj4NCiAg ICA+Pj4+PiBUaGUgbWVjaGFuaXNtIGlzIGNoYWluaW5nIGNyZWRlbnRpYWxzIGluIGEgZm9ybSBv ZiBhIFBLSSBhbmQNCiAgICA+Pj4+PiBoYXZpbmcgYSB3YXkgdG8ga25vdyB3aGljaCBUTnMgYXJl IGNvdmVyZWQgYnkgYSBjcmVkZW50aWFsLg0KICAgID4+Pj4+IFRoYXQncyB3aGF0IHdlIGhhdmUs IGFuZCBJJ20gbG9hdGggdG8gY2hhbmdlIGl0Lg0KICAgID4+Pj4+DQogICAgPj4+Pj4gQnJpYW4N CiAgICA+Pj4+Pg0KICAgID4+Pj4+DQogICAgPj4+Pj4+IE9uIEF1ZyA0LCAyMDE2LCBhdCA0OjUz IFBNLCBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dDQogICAgPj4+Pj4+IDxQaWVyY2UuR29ybWFuQHNw cmludC5jb20gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQogICAgPj4+Pj4+IDxt YWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCiAgICA+Pj4+Pj4gd3JvdGU6DQogICAg Pj4+Pj4+DQogICAgPj4+Pj4+IE9LLCB5b3UgdGFsa2VkIG1lIGludG8gaW5kdWxnaW5nIGluIG9u ZSBtb3JlIG1lc3NhZ2Ugb24gcG9saWN5DQogICAgPj4+Pj4+IGFuZCB1c2UgY2FzZXMuDQogICAg Pj4+Pj4+DQogICAgPj4+Pj4+IEkgYWdyZWUgdGhhdCB0aGUgU1RJUi9QQVNTcG9yVCBtZWNoYW5p c21zIGNvdWxkIGJlIGRlcGxveWVkIG9uDQogICAgPj4+Pj4+IGluZGl2aWR1YWwgZGV2aWNlcyBh cyB3ZWxsIGFzIG11bHRpLWRldmljZSBhbmQgbXVsdGktbnVtYmVyIHBsYXRmb3Jtcy4NCiAgICA+ Pj4+Pj4NCiAgICA+Pj4+Pj4gTnVtYmVyIGRlbGVnYXRpb24gKGFuZCBzdWItZGVsZWdhdGlvbiks IGFuZCBidXNpbmVzcw0KICAgID4+Pj4+PiByZWxhdGlvbnNoaXBzIGFyZSB0d28gYWRkaXRpb25h bCBmYWN0b3JzIHdoaWNoIGFmZmVjdA0KICAgID4+Pj4+PiB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBn aXZlbiBjYWxsaW5nIG51bWJlciBhdXRoZW50aWNhdGlvbi4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+ Pj4gSW5oZXJlbnQgdmFyaWFibGUgdHJ1c3R3b3J0aGluZXNzIG9mIGEgY2FsbGluZyBudW1iZXIg d2FzIG15DQogICAgPj4+Pj4+IHJlYXNvbiBmb3Igc3VnZ2VzdGluZyBhIHdheSB0byBxdWFsaWZ5 IHRoZSBzaWduYXR1cmUgdG8gcmVmbGVjdA0KICAgID4+Pj4+PiB0aGF0IHZhcmlhYmlsaXR5Lg0K ICAgID4+Pj4+Pg0KICAgID4+Pj4+PiBPcmlnaW5hdGluZyBjYXJyaWVycyBhcmUgaW4gYSBwb3Np dGlvbiB0byBrbm93IGlmIGEgY2FsbCBpcw0KICAgID4+Pj4+PiBjb21pbmcgZnJvbSBhIGRldmlj ZSBhc3NpZ25lZCBhIHNpbmdsZSBudW1iZXIsIG9yIGZyb20gInRydW5rDQogICAgPj4+Pj4+IGdy b3VwIiB3aGljaCBjb3VsZCBvcmlnaW5hdGUgY2FsbHMgdXNpbmcgbXVsdGlwbGUgbnVtYmVycywg YW5kDQogICAgPj4+Pj4+IGNhbiBxdWFsaWZ5IHRvIHNvbWUgZGVncmVlIHRoZSB0cnVzdHdvcnRo aW5lc3Mgb2YgbnVtYmVyIGF1dGhlbnRpY2l0eSBhY2NvcmRpbmdseS4NCiAgICA+Pj4+Pj4NCiAg ICA+Pj4+Pj4gTXkgc3VnZ2VzdGlvbiB3YXMgcXVhbGlmeWluZyBjYWxsaW5nIG51bWJlciBhdXRo ZW50aWNpdHkgaW50bw0KICAgID4+Pj4+PiBjYXRlZ29yaWVzIG9mIGNhcnJpZXItc2lnbmVkIChv ciBub3QpLCBhbmQgdW5hdXRoZW50aWNhdGVkLA0KICAgID4+Pj4+PiBzZW1pLWF1dGhlbnRpY2F0 ZWQsIGFuZCBtb3N0LWF1dGhlbnRpY2F0ZWQuICBUaGVyZSBjYW4gYmUgbW9yZQ0KICAgID4+Pj4+ PiBncmFudWxhcml0eSwgYnV0IGl0IGltcGxpZXMgYWRkaXRpb25hbCBvcGVyYXRpb25hbCBjb21w bGV4aXR5DQogICAgPj4+Pj4+IChib3RoIGZvciB0aGUgY2FycmllcnMgYW5kIHRoZSBjb25zdW1l cnMpIGFuZCBJIGFzc3VtZSBkaW1pbmlzaGVzIHZhbHVlLg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+ PiBNeSByZWFzb24gZm9yIGFkZGluZyB0aGUgYXV0aGVudGljaXR5IG9mIHRoZSBvcmlnaW5hdGlu ZyBjYXJyaWVyDQogICAgPj4+Pj4+IGlzIHR5cGljYWwgdHJ1c3R3b3J0aGluZXNzIG9mIGEgY2Fy cmllciBidXNpbmVzcyByZWxhdGlvbnNoaXANCiAgICA+Pj4+Pj4gd2l0aCB0eXBpY2FsIGNvbnN1 bWVycyBhZGRzIHRvIHRoZSB0cnVzdHdvcnRoaW5lc3MgYXNzZXNzbWVudCBhbmQNCiAgICA+Pj4+ Pj4gcGFydGlhbGx5IGJlY2F1c2UgY2FycmllcnMgYXJlIGEgcmVndWxhdGVkIHBvaW50IG9mIGZv cmVuc2ljDQogICAgPj4+Pj4+IGlucXVpcnkgZm9yIENBTEVBIGFuZCBmcmF1ZC4gIEFkZGl0aW9u YWxseSwgbW9zdCBjYWxscyBvcmlnaW5hdGUNCiAgICA+Pj4+Pj4gYW5kIHRlcm1pbmF0ZSBiZXR3 ZWVuIG1vYmlsZSBjb25zdW1lcnMgd2hlcmUgdGhlaXIgY2FycmllcnMgYXJlDQogICAgPj4+Pj4+ IGFibGUgdG8gdXNlZnVsbHkgYXV0aGVudGljYXRlIHRoZWlyIGRldmljZSBhbmQgaGF2ZSBhIGhp Z2ggZGVncmVlDQogICAgPj4+Pj4+IG9mIGNvbmZpZGVuY2Ugb2YgdGhlIGF1dGhlbnRpY2l0eSBv ZiB0aGUgY2FsbGluZyBudW1iZXIuDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+IEkgdGhpbmsgYmls bGlvbnMgb2YgcGVyLVROIGNlcnRzIG9mIHZhcnlpbmcgdXNhYmlsaXR5IChyZXZva2VkLA0KICAg ID4+Pj4+PiBub3QNCiAgICA+Pj4+Pj4gcmV2b2tlZCkgZm9yIGF1dGhlbnRpY2F0aW5nIGNhbGxp bmcgbnVtYmVyIHdpbGwgbm90IHdvcmsgd2VsbC4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gQ29u dmVyc2VseSwgSSB0aGluayBiaWxsaW9ucyBvZiBwZXItVE4gY2VydHMgd2lsbCB3b3JrIHdlbGws IGlmDQogICAgPj4+Pj4+IHRoZSBjYWxsaW5nIHBhcnR5IGhhcyB0byBzaWduIGEgY2FsbCB3aXRo IGEgcGVyLVROIGNlcnQgcHJvdmlkZWQNCiAgICA+Pj4+Pj4gYnkgdGhlIGNhbGxlZCBwYXJ0eS4g IE5vIGNhbGxlZCBwYXJ0eSBjZXJ0IHRvIGluY2x1ZGU/ICBUaGVuIHRoZQ0KICAgID4+Pj4+PiBj YWxsaW5nIHBhcnR5IGRvZXMgbm90IGhhdmUgYSB0cnVzdGVkIHJlbGF0aW9uc2hpcCB3aXRoIHRo ZQ0KICAgID4+Pj4+PiBjYWxsZWQgcGFydHksIGFuZCB0aGUgY2FsbCBjYW4gYmUgYXV0aG9yaXpl ZC90cmVhdGVkIGFjY29yZGluZ2x5Lg0KICAgID4+Pj4+PiAoSSd2ZSBtYWRlIHNpbWlsYXIsIG1v c3RseSBpZ25vcmVkIGNvbW1lbnRzIGluIE1PREVSTi4pDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ IFBpZXJjZQ0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAqRnJvbToqIEJyaWFuIFJvc2VuIFttYWls dG86YnJAYnJpYW5yb3Nlbi5uZXRdDQogICAgPj4+Pj4+ICpTZW50OiogQXVndXN0IDA0LCAyMDE2 IDI6MDMgUE0NCiAgICA+Pj4+Pj4gKlRvOiogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNl Lkdvcm1hbkBzcHJpbnQuY29tDQogICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJp bnQuY29tPg0KICAgID4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQog ICAgPj4+Pj4+ICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldCA8bWFpbHRvOmFs ZXhAYm9ib3Rlay5uZXQ+DQogICAgPj4+Pj4+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBz dGlyQGlldGYub3JnIDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCiAgICA+Pj4+Pj4gPG1haWx0bzpz dGlyQGlldGYub3JnPg0KICAgID4+Pj4+PiAqU3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJUiA0NDc0 YmlzLTEwIGNvbW1lbnRzDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+IFdlbGwsIHRoZSBtZWNoYW5p c21zIGFyZSBkZXNpZ25lZCBzbyB0aGF0IHRoZXkgY291bGQgYmUgZGVwbG95ZWQNCiAgICA+Pj4+ Pj4gb24gZGV2aWNlcyBhbmQgUEJYcy4gIFdoZXRoZXIgdGhleSB3aWxsIGJlIGlzIGEgcG9saWN5 IGlzc3VlLg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiBUaGUgbm90aW9uIG9mIGNyZWRlbnRpYWxz IHRoYXQgYXJlIHRyYWNlYWJsZSB0byBhIGRlbGVnYXRpb24gb2YgYQ0KICAgID4+Pj4+PiBUTiBp cyBhIG1lY2hhbmlzbSB0aGF0IGlzIHBhcnQgb2YgdGhlIGRlc2lnbiBvZiBzdGlyLCBhbmQgdGhl DQogICAgPj4+Pj4+IGRlc2lnbiBhbGxvd3MgZGVsZWdhdGlvbiBvZiBvbmUgVE4gKHRvIG9uZSBk ZXZpY2UsIGFsdGhvdWdoIGENCiAgICA+Pj4+Pj4gZGV2aWNlIGxpa2UgYSBQQlggd291bGQgaGF2 ZSBtb3JlIHRoYW4gb25lIFROIHBlciAiZGV2aWNlIiwgYW5kDQogICAgPj4+Pj4+IHNvbWV0aGlu ZyBsaWtlIGEgZHVhbCBOQU0gcGhvbmUgY291bGQgaGF2ZSBtb3JlIHRoYW4gb25lDQogICAgPj4+ Pj4+IGNyZWRlbnRpYWwuICBGb3IgdGhlIHVzZSBjYXNlIHdlJ3ZlIGRpc2N1c3NlZCwgYSBtb2Jp bGUgcGhvbmUgbWF5DQogICAgPj4+Pj4+IGFsc28gaGF2ZSBhIGNyZWRlbnRpYWwgZm9yLCBzYXks IGEgVE4gdGhhdCBpcyBkZWxlZ2F0ZWQgdG8gYQ0KICAgID4+Pj4+PiBsYW5kbGluZSwgdG8gY292 ZXIgdGhlIGV4YW1wbGUgY2FzZSBvZiBhIGRvY3RvciBwbGFjaW5nIGEgY2FsbCBvbg0KICAgID4+ Pj4+PiBoaXMgbW9iaWxlLCBidXQgZ2V0dGluZyBoaXMgb2ZmaWNlIG51bWJlciB0byBzaG93IHVw IGFzIHRoZSBjYWxsaW5nIHBhcnR5LiAgVXNlIG9mIHN1Y2ggbWVjaGFuaXNtcyBpcyBwb2xpY3ku DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+IEJyaWFuDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+DQog ICAgPj4+Pj4+ICAgT24gQXVnIDQsIDIwMTYsIGF0IDI6NTIgUE0sIEdvcm1hbiwgUGllcmNlIEEg W0NUT10NCiAgICA+Pj4+Pj4gICA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQogICAgPj4+Pj4+ IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KICAgID4+Pj4+PiA8bWFpbHRvOlBp ZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQogICAgPj4+Pj4+IHdyb3RlOg0KICAgID4+Pj4+Pg0K ICAgID4+Pj4+PiAgIFRoYW5rcyBCcmlhbi4gIEknbSBhZnJhaWQgd2UncmUgc3RyYXlpbmcgaW50 byBhIHBvbGljeQ0KICAgID4+Pj4+PiAgIGRpc2N1c3Npb24uICBSZWdhcmRsZXNzLCBJIGRvIGFw cHJlY2lhdGUgeW91ciBleHBsYW5hdGlvbi4gIEkNCiAgICA+Pj4+Pj4gICB3b3VsZCBsaWtlIHRv IGNvbnRpbnVlIHRoZSBkaXNjdXNzaW9uLCBidXQgSSdtIHByZXR0eSBzdXJlIHRoaXMNCiAgICA+ Pj4+Pj4gICBpc24ndCB0aGUgcmlnaHQgZm9ydW0uDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAg UGllcmNlDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgKkZyb206KiBCcmlhbiBSb3NlbiBbbWFp bHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KICAgID4+Pj4+PiAgICpTZW50OiogQXVndXN0IDA0LCAy MDE2IDE6MzQgUE0NCiAgICA+Pj4+Pj4gICAqVG86KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQ aWVyY2UuR29ybWFuQHNwcmludC5jb20NCiAgICA+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFu QHNwcmludC5jb20+DQogICAgPj4+Pj4+ICAgPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5j b20+Pg0KICAgID4+Pj4+PiAgICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldCA8 bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+DQogICAgPj4+Pj4+ICAgPG1haWx0bzphbGV4QGJvYm90 ZWsubmV0Pj47IHN0aXJAaWV0Zi5vcmcNCiAgICA+Pj4+Pj4gPG1haWx0bzpzdGlyQGlldGYub3Jn PiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQogICAgPj4+Pj4+ICAgKlN1YmplY3Q6KiBSZTogW3N0 aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgIE9m IGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBhcyBzbWFydCBwaG9u ZXMgYW5kDQogICAgPj4+Pj4+ICAgYW55IG90aGVyIGRldmljZXMgdGhhdCBjYW4gYmUgcHJvZ3Jh bW1lZCB0byBkbyBzby4NCiAgICA+Pj4+Pj4gICBUaGV5IHdpbGwgYmUgZ2l2ZW4gY3JlZGVudGlh bHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBmb3IgdGhlIFROcw0KICAgID4+Pj4+PiAgIHRoZXkgYXJl IGF1dGhvcml6ZWQgdG8gc2lnbiBmb3IuICBUaGV5IGNhbiB0cnkgdG8gc2lnbiBhbnkgY2FsbCwN CiAgICA+Pj4+Pj4gICBidXQgdGhlIHZhbGlkaXR5IG9mIHRoZSBjcmVkZW50aWFsIHdvdWxkIG1h a2Ugc3VjaCBhIHNpZ25hdHVyZQ0KICAgID4+Pj4+PiAgIGZhaWwgdGhlIGNoZWNraW5nLg0KICAg ID4+Pj4+Pg0KICAgID4+Pj4+PiAgIEdldHRpbmcgc2VydmljZSBwcm92aWRlcnMgdG8gc2lnbiBv biBiZWhhbGYgb2YgZGV2aWNlcyBpcyBhDQogICAgPj4+Pj4+ICAgcmVhc29uYWJsZSB3YXkgdG8g ZGVwbG95IHF1aWNrbHksIGJ1dCBJIGV4cGVjdCBtYW55IFNQcyB3aWxsIHdhbnQNCiAgICA+Pj4+ Pj4gICB0byBnZXQgb3V0IG9mIHRoZSBsaWFiaWxpdHkgb2Ygc2lnbmluZyBvbiBiZWhhbGYgb2Yg dGhlaXINCiAgICA+Pj4+Pj4gICBjdXN0b21lcnMuICBJZiB0aGV5IGNhbiBwdXNoIG9mIHRoYXQg cmVzcG9uc2liaWxpdHkgdG8gdGhlaXINCiAgICA+Pj4+Pj4gICBjdXN0b21lciwgb25seSBiZWlu ZyByZXNwb25zaWJsZSBmb3IgZ2V0dGluZyB0aGUgY3VzdG9tZXIgYW4NCiAgICA+Pj4+Pj4gICBh cHByb3ByaWF0ZSBjcmVkZW50aWFsIHdoZW4gdGhleSBhc3NpZ24gVE5zLCB0aGVuIEkgd291bGQg ZXhwZWN0DQogICAgPj4+Pj4+ICAgdGhlbSB0byB3YW50IHRvIGRvIHNvLiAgVGhhdCBtZWFucyB0 aGUgZGV2aWNlcyBoYXZlIHRvIGJlIGFibGUgdG8NCiAgICA+Pj4+Pj4gICBzaWduLCBidXQgSSB1 bmRlcnN0YW5kIG1hbnkgb2YgdGhlIFBCWCB2ZW5kb3JzIHRoaW5rIHRoYXQncw0KICAgID4+Pj4+ PiAgIHNvbWV0aGluZyB0aGV5IGNvdWxkIHByb3ZpZGUgaW4gYSBmdXR1cmUgcmVsZWFzZS4NCiAg ICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICBCcmlhbg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAg ID4+Pj4+PiAgICAgICBPbiBBdWcgNCwgMjAxNiwgYXQgMjoyMiBQTSwgR29ybWFuLCBQaWVyY2Ug QSBbQ1RPXQ0KICAgID4+Pj4+PiAgICAgICA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQogICAg Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPiA8bWFpbHRvOlBpZXJjZS5H b3JtYW5Ac3ByaW50LmNvbT4+DQogICAgPj4+Pj4+ICAgICAgIHdyb3RlOg0KICAgID4+Pj4+Pg0K ICAgID4+Pj4+PiAgICAgICBZb3Ugd2FudCBJUCBQQlhlcyB0byBzaWduIGNhbGxzPyAgV29uJ3Qg dGhhdCBtYWtlIGl0DQogICAgPj4+Pj4+ICAgICAgIGV4dHJhb3JkaW5hcmlseSBlYXN5IHRvIGNv bW1pdCBmcmF1ZCB3aXRoIGF1dGhlbnRpY2F0ZWQgbnVtYmVycz8NCiAgICA+Pj4+Pj4NCiAgICA+ Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgKkZyb206KiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJy aWFucm9zZW4ubmV0XQ0KICAgID4+Pj4+PiAgICAgICAqU2VudDoqIEF1Z3VzdCAwNCwgMjAxNiAx MjoyNCBQTQ0KICAgID4+Pj4+PiAgICAgICAqVG86KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQ aWVyY2UuR29ybWFuQHNwcmludC5jb20NCiAgICA+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFu QHNwcmludC5jb20+DQogICAgPj4+Pj4+ICAgICAgIDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJp bnQuY29tPj4NCiAgICA+Pj4+Pj4gICAgICAgKkNjOiogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90 ZWsubmV0IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4NCiAgICA+Pj4+Pj4gICAgICAgPG1haWx0 bzphbGV4QGJvYm90ZWsubmV0Pj47IHN0aXJAaWV0Zi5vcmcNCiAgICA+Pj4+Pj4gPG1haWx0bzpz dGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQogICAgPj4+Pj4+ICAgICAgICpT dWJqZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCiAgICA+Pj4+Pj4N CiAgICA+Pj4+Pj4gICAgICAgRmlyc3Qgb2YgYWxsLCB3ZSB3b3VsZCB3YW50IHRoZSBQQlggdG8g Z2VuZXJhdGUgdGhlIHNpZ25hdHVyZSwNCiAgICA+Pj4+Pj4gICAgICAgYnV0IHRoZSBzZXJ2aWNl IHByb3ZpZGVyIGNhbiBkbyB0aGF0LiAgSXQgc2hvdWxkIG5vdCBhZGQgYQ0KICAgID4+Pj4+PiAg ICAgICB2YWxpZCBzaWduYXR1cmUgdG8gYSBjYWxsIGZyb20gYSBudW1iZXIgaXQgZGlkIG5vdCBh c3NpZ24gdG8NCiAgICA+Pj4+Pj4gICAgICAgdGhlIHRydW5rIGdyb3VwIGNvbm5lY3RpbmcgdG8g dGhlIFBCWCwgYWx0aG91Z2ggaXQgY291bGQNCiAgICA+Pj4+Pj4gICAgICAgc3VwcG9ydCB0aGUg ZXh0cmEgZGVsZWdhdGlvbiByZXF1aXJlZCB0byBzdXBwb3J0ICJhdXRob3JpemVkDQogICAgPj4+ Pj4+ICAgICAgIHNwb29maW5nIi4gIFRoZSBjb21wYW5pb24gZGV2aWNlcyBJJ20gYXdhcmUgb2Yg YWx3YXlzIHNlbmQNCiAgICA+Pj4+Pj4gICAgICAgY2FsbHMgZnJvbSB0aGUgc2FtZSBzZXJ2aWNl IHByb3ZpZGVyIGFuZCBzaG91bGQgbm90IHByZXNlbnQNCiAgICA+Pj4+Pj4gICAgICAgYW55IGlz c3VlLg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICBFdmVyeW9uZSB3aWxsIGhhdmUgdG8g ZG8gd29yayB0aGV5IGRvbid0IGRvIG5vdyB0byBpbXBsZW1lbnQNCiAgICA+Pj4+Pj4gICAgICAg c3RvcCBzcG9vZmVkIGNhbGxzLiBUQU5TVEFBRkwNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAg ICAgQnJpYW4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgIE9u IEF1ZyA0LCAyMDE2LCBhdCAxMjo0MSBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KICAgID4+ Pj4+PiAgICAgICAgICAgPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbSA8bWFpbHRvOlBpZXJjZS5H b3JtYW5Ac3ByaW50LmNvbT4NCiAgICA+Pj4+Pj4gICAgICAgICAgIDxtYWlsdG86UGllcmNlLkdv cm1hbkBzcHJpbnQuY29tPj4gd3JvdGU6DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAg ICBGcmF1ZCBmcm9tIGNvbXByb21pc2VkIFBCWGVzIGlzIGNvbW1vbi4gIEFuZCBldmVuIHdoZXJl IGENCiAgICA+Pj4+Pj4gICAgICAgICAgIFBCWCBpcyBub3QgY29tcHJvbWlzZWQsIGEgY2Fycmll ciBoYXMgbm8gcHJhY3RpY2FsIHdheSBvZg0KICAgID4+Pj4+PiAgICAgICAgICAga25vd2luZyB3 aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciBpcyBwcm9wZXJseSBhc3NpZ25lZA0KICAgID4+Pj4+ PiAgICAgICAgICAgYW5kIHZhbGlkIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHRoZSBFbnRlcnBy aXNlLg0KICAgID4+Pj4+PiAgICAgICAgICAgVGhlcmVmb3JlLCBjaGVja2luZyB3aGV0aGVyIHRo ZSBjYWxsaW5nIG51bWJlciB3YXMgZnJvbSBhbg0KICAgID4+Pj4+PiAgICAgICAgICAgYXNzaWdu ZWQgcmFuZ2UgbWlnaHQgYmUgcG9zc2libGUgKGFuZCBmcmF1Z2h0IHdpdGgNCiAgICA+Pj4+Pj4g ICAgICAgICAgIGFkbWluaXN0cmF0aXZlIGNoYWxsZW5nZXMpLCBidXQgb2YgbGltaXRlZCB2YWx1 ZS4gIEFuZCBpbg0KICAgID4+Pj4+PiAgICAgICAgICAgdGhlIGNvbnN1bWVyIG1hcmtldCwgdGhl cmUgYXJlIGNhbGxpbmcgcHJvZHVjdHMgd2hpY2gNCiAgICA+Pj4+Pj4gICAgICAgICAgIHN1cHBv cnQgYSBwYXJlbnQgc3Vic2NyaWJlciBudW1iZXIgYW5kICJjb21wYW5pb24iIGRldmljZXMNCiAg ICA+Pj4+Pj4gICAgICAgICAgIChlLmcuLCB0YWJsZXRzKSB3aGljaCBjYW4gcGxhY2UgYSBjYWxs IHVzaW5nIHRoZSBNRE4gb2YNCiAgICA+Pj4+Pj4gICAgICAgICAgIHRoZSBwYXJlbnQgc3Vic2Ny aWJlci4gIFRoZXNlIGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUNCiAgICA+Pj4+Pj4gICAgICAg ICAgIGF1dGhlbnRpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgd29uJ3QgbmVjZXNzYXJpbHkg bWVhbg0KICAgID4+Pj4+PiAgICAgICAgICAgdGhlIHNhbWUgdGhpbmcgYXMgdGhlIGF1dGhlbnRp Y2l0eSBvZiBhIGNhbGwgZnJvbSBhIHNpbmdsZQ0KICAgID4+Pj4+PiAgICAgICAgICAgc3Vic2Ny aWJlciB3aXRoIGEgc2luZ2xlIE1ETiByZWdhcmRsZXNzIG9mICJsYXhpdHkiIG9mDQogICAgPj4+ Pj4+ICAgICAgICAgICBzcG9vZiBjaGVja2luZy4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAg ICAgICAgIEluIGFub3RoZXIgZm9ydW0gYW5kIGFudGljaXBhdGluZyBjYWxsaW5nIG51bWJlcg0K ICAgID4+Pj4+PiAgICAgICAgICAgYXV0aGVudGljYXRpb24gbWFuZGF0ZXMgZnJvbSBDb25ncmVz cyBhbmQvb3IgRkNDLCBJDQogICAgPj4+Pj4+ICAgICAgICAgICBzdWdnZXN0ZWQgdXNpbmcgY2Fy cmllci1zcGVjaWZpYyBjZXJ0cyBhbmQgZW5jb2RpbmcNCiAgICA+Pj4+Pj4gICAgICAgICAgIHNw ZWNpZmljaXR5IG9mIGF1dGhlbnRpY2l0eSwgYW5kIGNhbGxpbmcgbnVtYmVyLiAgVGhpcw0KICAg ID4+Pj4+PiAgICAgICAgICAgcHJvdmlkZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBvcmlnaW5hdGlu ZyBjYXJyaWVyLCBzb21lDQogICAgPj4+Pj4+ICAgICAgICAgICBpZGVhIGFzIHRvIHRoZSBhY2N1 cmFjeSBvciBzcGVjaWZpY2l0eSBvZiB0aGUgY2FsbGluZw0KICAgID4+Pj4+PiAgICAgICAgICAg bnVtYmVyLCBhbmQgdmFsaWR0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgKGFzc3VtaW5nIG5vbmNl DQogICAgPj4+Pj4+ICAgICAgICAgICBhbmQgcmVwbGF5IGlzc3VlcyBjYW4gYmUgYWRkcmVzc2Vk IGFzIHJlYXNvbmFibHkgc3VnZ2VzdGVkDQogICAgPj4+Pj4+ICAgICAgICAgICBiZWxvdyBieSBB bGV4KS4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgIFRoZSByZXByZXNlbnRhdGlv biBvZiBvcmlnLWNhcnJpZXIgYW5kIHRydXN0d29ydGhpbmVzcw0KICAgID4+Pj4+PiAgICAgICAg ICAgY291bGQgYmUgYXMgZm9sbG93czoNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAg ICpSZWd1bGF0ZWQvbWFuZGF0ZWQgQ2FycmllciBDbGFzcyBVc2UgQ2FzZToqDQogICAgPj4+Pj4+ DQogICAgPj4+Pj4+ICAgICAgICAgICAqMDAgLSBObyBDcmVkZW50aWFscyoNCiAgICA+Pj4+Pj4g ICAgICAgICAgIFVzZSBjYXNlIGV4YW1wbGUocyk6IFByZS1JTVMsIGxlZ2FjeSBjaXJjdWl0LXN3 aXRjaGVkDQogICAgPj4+Pj4+ICAgICAgICAgICBuZXR3b3JrcyB0aGF0IGRvbid0IG5hdGl2ZWx5 IHN1cHBvcnQgU0lQIG9yIHdoaWNoIGRvbid0DQogICAgPj4+Pj4+ICAgICAgICAgICBjaG9vc2Ug dG8gc2lnbiBjYWxscy4gIEUuZy4sIGludGVybmF0aW9uYWwgY2FycmllcnMuDQogICAgPj4+Pj4+ ICAgICAgICAgICBUcnVzdCBFc3RpbWF0ZTogIEdvb2QgbHVjay4gIENhcnJpZXJfb3JpZyBhbmQg Q2dQTg0KICAgID4+Pj4+PiAgICAgICAgICAgZW50aXJlbHkgdW50cnVzdHdvcnRoeS4NCiAgICA+ Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICowMSAtIENhcnJpZXIgc2lnbmVkLCBubyBhdXRo ZW50aWNhdGlvbiBvZiBDZ1BOKg0KICAgID4+Pj4+PiAgICAgICAgICAgVXNlIGNhc2UgZXhhbXBs ZShzKTogRTkxMSBvbiB2aXNpdGVkIG5ldHdvcmsgdy9vIHJvYW1pbmcNCiAgICA+Pj4+Pj4gICAg ICAgICAgIGFncmVlbWVudCwgbWFudWFsIHJvYW1pbmcuDQogICAgPj4+Pj4+ICAgICAgICAgICBU cnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBlbnRpcmVseQ0K ICAgID4+Pj4+PiAgICAgICAgICAgdW50cnVzdHdvcnRoeQ0KICAgID4+Pj4+Pg0KICAgID4+Pj4+ PiAgICAgICAgICAgKjEwIC0gQ2FycmllciBzaWduZWQsIHNlbWktYXV0aGVudGljYXRlZCBDZ1BO Kg0KICAgID4+Pj4+PiAgICAgICAgICAgVXNlIGNhc2UgZXhhbXBsZShzKTogTnVtYmVyIGJsb2Nr IGRlbGVnYXRlZCBmcm9tIE9DTiwgYnV0DQogICAgPj4+Pj4+ICAgICAgICAgICBubyBwZXItVE4g c2NyZWVuIChTSVAgdHJ1bmtzKS4NCiAgICA+Pj4+Pj4gICAgICAgICAgIFRydXN0IEVzdGltYXRl OiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGxlc3MgdGhhbg0KICAgID4+Pj4+PiAg ICAgICAgICAgbW9zdCB0cnVzdHdvcnRoeSBidXQgbm90IGVudGlyZWx5IHVudHJ1c3R3b3J0aHku DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAqMTEgLSBDYXJyaWVyIHNpZ25lZCwg YXV0aGVudGljYXRlZCBDZ1BOKg0KICAgID4+Pj4+PiAgICAgICAgICAgVXNlIGNhc2UgZXhhbXBs ZShzKTogQnJlYWQtYW5kLWJ1dHRlciA5NSUrIG9mIGNhbGxzIGZyb20NCiAgICA+Pj4+Pj4gICAg ICAgICAgIHN1YnNjcmliZXIgbGluZXMgKElNUy1iYXNlZCBhbmQgb3RoZXJ3aXNlKS4NCiAgICA+ Pj4+Pj4gICAgICAgICAgIFRydXN0IEVzdGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5 LCBDZ1BOIG1vc3QNCiAgICA+Pj4+Pj4gICAgICAgICAgIHRydXN0d29ydGh5DQogICAgPj4+Pj4+ DQogICAgPj4+Pj4+ICAgICAgICAgICAqUHVibGljIFVzZSBDYXNlOioNCiAgICA+Pj4+Pj4NCiAg ICA+Pj4+Pj4gICAgICAgICAgIFVuZGVmaW5lZCBidXQgYXNzdW1lZCB0byB1c2UgcHVibGljIG9y IGNvbW1lcmNpYWxseQ0KICAgID4+Pj4+PiAgICAgICAgICAgYXZhaWxhYmxlIGF1dGhlbnRpY2F0 aW9uIHNlcnZpY2VzIHJlc291cmNlcy4gIGUuZy4sDQogICAgPj4+Pj4+ICAgICAgICAgICBub21v cm9iby1saWtlIGNyb3dkLXNvdXJjZWQgYWNjZXB0L2RlbnkgbGlzdHMsIGV0IGNldGVyYS4NCiAg ICA+Pj4+Pj4gICAgICAgICAgIENvdWxkL3dvdWxkIHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBT SVAtYXdhcmUgZGV2aWNlcw0KICAgID4+Pj4+PiAgICAgICAgICAgd2hpY2ggd291bGQgcHJvY2Vz cyB0aGVtIGFjY29yZGluZyB0byB0aGUgcnVsZXMgb2YgdGhlDQogICAgPj4+Pj4+ICAgICAgICAg ICBQdWJsaWMgQ2xhc3MgYXBwbGljYXRpb24ocykuDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAg ICAgICAgICBQaWVyY2UNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICpGcm9tOiog QnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCiAgICA+Pj4+Pj4gICAgICAg ICAgICpTZW50OiogQXVndXN0IDA0LCAyMDE2IDk6MDIgQU0NCiAgICA+Pj4+Pj4gICAgICAgICAg ICpUbzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0KICAgID4+Pj4+PiA8bWFpbHRv OmFsZXhAYm9ib3Rlay5uZXQ+DQogICAgPj4+Pj4+ICAgICAgICAgICA8bWFpbHRvOmFsZXhAYm9i b3Rlay5uZXQ+Pg0KICAgID4+Pj4+PiAgICAgICAgICAgKkNjOiogc3RpckBpZXRmLm9yZw0KICAg ID4+Pj4+PiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCiAg ICA+Pj4+Pj4gICAgICAgICAgICpTdWJqZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAg Y29tbWVudHMNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgIFRoZXJlIGFyZSByZWFz b25hYmxlIGNpcmN1bXN0YW5jZXMgd2hlcmUgYSBwYXJ0eSBwbGFjaW5nIGENCiAgICA+Pj4+Pj4g ICAgICAgICAgIGNhbGwgaXMgbm90IHRoZSBhdXRob3JpemVkIGVudGl0eSBhc3NpZ25lZCB0aGUg dGVsZXBob25lDQogICAgPj4+Pj4+ICAgICAgICAgICBudW1iZXIgdXNlZCBpbiBGcm9tL1BBSSwg YW5kIGluIHN1Y2ggY2lyY3Vtc3RhbmNlcyB0aGUNCiAgICA+Pj4+Pj4gICAgICAgICAgIHNlcnZp Y2UgcHJvdmlkZXIgc2VydmljaW5nIHRoZSBlbnRpdHkgcGxhY2luZyB0aGUgY2FsbCBtYXkNCiAg ICA+Pj4+Pj4gICAgICAgICAgIG9yIG1heSBub3QgYmUgdGhlIHNhbWUgYXMgdGhlIHNlcnZpY2Ug cHJvdmlkZXIgc2VydmluZyB0aGUNCiAgICA+Pj4+Pj4gICAgICAgICAgIGVudGl0eSB0aGF0IGlz IGFzc2lnbmVkIHRoZSBUTi4gIEluIGFsbCBzdWNoIGNhc2VzLCB0aGUNCiAgICA+Pj4+Pj4gICAg ICAgICAgIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVkIHRoZSBUTiBleHBsaWNpdGx5IGF1dGhvcml6 ZXMgY2FsbHMNCiAgICA+Pj4+Pj4gICAgICAgICAgIHBsYWNlZCB1c2luZyBpdCdzIFROLiAgVGhl IGRlc2lnbiBhY2NvbW1vZGF0ZXMgc3VjaCB1c2UNCiAgICA+Pj4+Pj4gICAgICAgICAgIGNhc2Vz LiAgSXQncyBub3QgYSBibGFua2V0IGF1dGhvcml6YXRpb24gd2l0aG91dA0KICAgID4+Pj4+PiAg ICAgICAgICAgYXV0aGVudGljYXRpb24uICAgV2UncmUgbm90IGF3YXJlIG9mIGFueSBjYXNlcyB3 aGVyZSB0aGVyZQ0KICAgID4+Pj4+PiAgICAgICAgICAgaXMgYW4gYWN0dWFsIHJlcXVpcmVtZW50 IGZvciBsZWdpdGltYXRlIGNhbGxpbmcgd2l0aG91dA0KICAgID4+Pj4+PiAgICAgICAgICAgZXhw bGljaXQgYXV0aG9yaXphdGlvbiBmcm9tIHRoZSBhc3NpZ25lZCBlbnRpdHksIGFsdGhvdWdoDQog ICAgPj4+Pj4+ICAgICAgICAgICB3ZSBjZXJ0YWlubHkgYXJlIGF3YXJlIHRoYXQgdmFyaW91cyBw YXJ0cyBvZiB2YXJpb3VzDQogICAgPj4+Pj4+ICAgICAgICAgICBzZXJ2aWNlIHByb3ZpZGVycyBk b24ndCBib3RoZXIgdG8gY2hlY2suIEF0IHRoaXMgcG9pbnQsIGF0DQogICAgPj4+Pj4+ICAgICAg ICAgICBsZWFzdCBpbiBzb21lIGNvdW50cmllcywgdGhlcmUgaXMgYSByZWFsaXphdGlvbiB0aGF0 IHRoZQ0KICAgID4+Pj4+PiAgICAgICAgICAgbGF4aXR5IG9mIGFsbG93aW5nIHVuY2hlY2tlZCBz cG9vZmluZyBpcyBub3QgYWNjZXB0YWJsZQ0KICAgID4+Pj4+PiAgICAgICAgICAgYW55IG1vcmUu DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICBCcmlhbg0KICAgID4+Pj4+Pg0KICAg ID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIE9uIEF1ZyAzLCAyMDE2LCBhdCA4OjM1 IEFNLCBBbGV4IEJvYm90ZWsNCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICA8YWxleEBib2JvdGVr Lm5ldA0KICAgID4+Pj4+PiA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+IDxtYWlsdG86YWxleEBi b2JvdGVrLm5ldD4+IHdyb3RlOg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICAgICAgICAg IDEuICAgICAgIFBlcm1pdCBhdXRob3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24NCiAg ICA+Pj4+Pj4gICAgICAgICAgICAgICBJbiB0aGUgY3VycmVudCB0ZWxlcGhvbnkgbmV0d29yayBw cmFjdGljZSwgc29tZQ0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHNlcnZpY2UgcHJvdmlkZXIg aW1wbGVtZW50YXRpb25zIGNob29zZSBub3QgdG8NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICBh dXRoZW50aWNhdGUgaWRlbnRpdHksIGJ1dCBzaW1wbHkgZmFjaWxpdGF0ZSB0aGUgdXNlDQogICAg Pj4+Pj4+ICAgICAgICAgICAgICAgb2YgYW4gYXJiaXRyYXJ5IG9yIHNlbGVjdGVkIHVzZXItcHJv dmlkZWQgaWRlbnRpdHkuDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgQXJlIHRoZXJlIGxlZ2l0 aW1hdGUgdXNlIGNhc2VzIGZvciB0aGlzPyAgSGFzIGFueW9uZQ0KICAgID4+Pj4+PiAgICAgICAg ICAgICAgIGVzdGFibGlzaGVkIHRoYXQgdGhlcmUgYXJlIG5vdD8gIEhvdyBjYW4gdGhlIGluZHVz dHJ5DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgcmVhc29uYWJseSBleHBlY3QgdG8gZW5kIHRo aXMgKG9mdGVuIGJhZCkgcHJhY3RpY2U/DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgSWYgaXQg Y2FuJ3QgYmUgZW5kZWQsIHRoZXJlJ3MgdmFsdWUgaW4gYXQgbGVhc3QNCiAgICA+Pj4+Pj4gICAg ICAgICAgICAgICBpZGVudGlmeWluZyB0aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92aWRlcg0K ICAgID4+Pj4+PiAgICAgICAgICAgICAgIChpLmUuLCB0aGUgc2lnbmVyL2F1dGhvcml6ZXIpLiAg R2l2ZW4gdGhlIHByZXZhbGVuY2UNCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICBvZiBhYnVzZSB1 c2luZyB0ZWxlcGhvbmUgbnVtYmVycyBhc3NpZ25lZCB0byBhDQogICAgPj4+Pj4+ICAgICAgICAg ICAgICAgc29tZXRpbWVzLWFub255bW91cyBhYnVzZXIsIGl0IGJlY29tZXMgY3JpdGljYWxseQ0K ICAgID4+Pj4+PiAgICAgICAgICAgICAgIGltcG9ydGFudCB0byBpZGVudGlmeSB0aGUgc2Vydmlj ZSBwcm92aWRlcihzKSBjbG9zZXN0DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgdG8gdGhlIGFi dXNlci4gIEJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQgaXQncw0KICAgID4+Pj4+PiAgICAg ICAgICAgICAgIGJldHRlciB0byBJRCBzZXJ2aWNlIHByb3ZpZGVycyB0aGFuIHVucmVhc29uYWJs eQ0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIGV4cGVjdCBhIGJhbiBvZiB0aGUgdXNlIG9mIHVu YXV0aGVudGljYXRlZCAoYW5kDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgdGhlcmVmb3JlIHVu c2lnbmVkKSBTSVAgcmVxdWVzdHMsIFNUSVIgc2lnbmluZyBzaG91bGQNCiAgICA+Pj4+Pj4gICAg ICAgICAgICAgICBzdXBwb3J0IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbi4g IFRoZQ0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHByYWN0aWNlIG9mIGF1dGhvcml6aW5nIHVu YXV0aGVudGljYXRlZCB1c2UgZXhpc3RzLA0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIGFuZCB0 aGVyZSBpcyBiZW5lZml0IHRvIHNpZ25pbmcgaW4gdGhlc2UgY2FzZXMNCiAgICA+Pj4+Pj4gICAg ICAgICAgICAgICAoc2VydmljZSBwcm92aWRlciBpZGVudGlmaWNhdGlvbikuICBUaGUgbGFuZ3Vh Z2Ugb2YNCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlz IHVzZS4gIDQ0NzRiaXMtMTAgc2hvdWxkIE5PVA0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHJl cXVpcmUgb3IgYXNzdW1lIHRoYXQgIHRoYXQgYXV0aGVudGljYXRpb24gd2lsbA0KICAgID4+Pj4+ PiAgICAgICAgICAgICAgIHByZWNlZGUgYXV0aG9yaXphdGlvbi4gT2YgY291cnNlIHRoZXJlIG1h eSBiZSBvdGhlcg0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHVzZSBjYXNlcyB3aGVyZSBzaWdu aW5nIGluY2x1ZGVzIGF1dGhlbnRpY2F0aW9uIGFuZA0KICAgID4+Pj4+PiAgICAgICAgICAgICAg IG1heSBub3QgaW5jbHVkZSBhIHNwZWNpZmljIHNlcnZpY2UgcHJvdmlkZXIncw0KICAgID4+Pj4+ PiAgICAgICAgICAgICAgIGF1dGhvcml6YXRpb24uDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+DQog ICAgPj4+Pj4+ICAgICAgICAgICAgICAgMi4gICAgICAgSW1wcm92ZSByZXBsYXkgcHJldmVudGlv bg0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIFByb3hpbWF0ZSByZXBsYXkgaXMgcG9zc2libGUg d2hpbGUgY29tcGx5aW5nIHdpdGggdGhpcw0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHNwZWMu ICBGaXJzdCwgb25lIG9yIG1vcmUgcHJveGltYXRlIChlLmcuLCB3aXRoaW4gNjANCiAgICA+Pj4+ Pj4gICAgICAgICAgICAgICBzZWNvbmRzKSBTSVAgcmVxdWVzdHMgdXNpbmcgdGhlIHNhbWUgdG9r ZW4gYXJlIGxlZ2FsDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgYW5kIHN1YmplY3QgdG8gcmVw bGF5IGluIG1hbnkgY2FzZXMuICBBbiBTRFAgYm9keSdzDQogICAgPj4+Pj4+ICAgICAgICAgICAg ICAgbWt5IG1heSBub3QgYmUgcHJlc2VudCBhbmQgaWYgcHJlc2VudCBpdHMgdXNlIGlzDQogICAg Pj4+Pj4+ICAgICAgICAgICAgICAgb3B0aW9uYWwuICBTb21lIHNvcnQgb2YgbWFuZGF0b3J5IG5l dyBvciBleGlzdGluZw0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHNpZ25lZCBzZXF1ZW5jZSwg cmFuZG9tICMgb3IgcmVxdWVzdCBJRCAoZS5nLiwgQ2FsbC1JRA0KICAgID4+Pj4+PiAgICAgICAg ICAgICAgIG9yIENTZXEpIGFuZCBhIDEtdGltZSB1c2UgcG9saWN5IG9uIHRoZSByZWNlaXZpbmcg ZW5kDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgb2YgdGhlIHJlcXVlc3QgKGUuZy4sIHRva2Vu cyBvbmx5IGdvb2QgZm9yIDENCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICB1c2UpIGNvdWxkIHBy ZXZlbnQgcmVwbGF5LiAgRGlmZmVyZW50IG1ldGhvZHMgKGUuZy4sDQogICAgPj4+Pj4+ICAgICAg ICAgICAgICAgSU5WSVRFIHZzIE1FU1NBR0UpIG1pZ2h0IGJlIGhhbmRsZWQgYnkgZGlmZmVyZW50 DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgcmVjZWl2aW5nIGluZnJhc3RydWN0dXJlLCBhbmQg dGhlcmVmb3JlIGRpZmZpY3VsdGllcw0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHdpdGggJ2l0 J3MgYmVlbiB1c2VkIGFscmVhZHknIGNvb3JkaW5hdGlvbiBhbGxvdyBhDQogICAgPj4+Pj4+ICAg ICAgICAgICAgICAgZmFrZWQgTUVTU0FHRSBiYXNlZCBvbiBhIGNhcHR1cmVkIHJlcXVlc3QuIFRo aXMgbWlnaHQNCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICBpbmNsdWRlIGFuIG1rZXkgZnJvbSBh IGNhcHR1cmVkIElOVklURS4gICBTbyBpdCBtYXkgYmUNCiAgICA+Pj4+Pj4gICAgICAgICAgICAg ICBwb3NzaWJsZSB0byBET1MsIHNwYW0gb3IgdGV4dC1ib21iIGEgcmVjaXBpZW50IHVzaW5nIGEN CiAgICA+Pj4+Pj4gICAgICAgICAgICAgICBjYXB0dXJlZCBpZGVudGl0eS4gIFdoaWxlIGxhcmdl LXNjYWxlIG9yIGRpc3RyaWJ1dGVkDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgaW1wbGVtZW50 YXRpb25zIG1heSBtYWtlIHRoZSBlbmZvcmNlbWVudCBkaWZmaWN1bHQsDQogICAgPj4+Pj4+ICAg ICAgICAgICAgICAgdGhlcmUgaXMgbGl0dGxlIGNvc3QgdG8gc2lnbmluZyBhbmQgZGVjb2Rpbmcg YSBtZXRob2QNCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICBhbmQgcG9zc2libHkgYSBudW1lcmlj IElELiAgIFNvbWUgc29ydCBvZiAnMS11c2UnDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgcHJh Y3RpY2Ugc2hvdWxkIGF0IGxlYXN0IGJlIGRpc2N1c3NlZCB3aGlsZSBwZXJoYXBzDQogICAgPj4+ Pj4+ICAgICAgICAgICAgICAgbm90IHJlcXVpcmVkLg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0K ICAgID4+Pj4+PiAgICAgICAgICAgICAgIFNwZWNpZmljIG1hcmt1cCBzdWdnZXN0aW9uczoNCiAg ICA+Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICBOSVRTDQogICAg Pj4+Pj4+DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgVGhlIHZlcmlm aWVyIE1VU1QgaW5zcGVjdCBhbnkgb3B0aW9uYWwgInBwdCINCiAgICA+Pj4+Pj4gcGFyYW1ldGVy IGFwcGVhcmluZyAqaW4qdGhlDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAg ICAgSWRlbnRpdHkgcmVxdWVzdC4gIElmIG5vICJwcHQiIHBhcmFtZXRlciBpcw0KICAgID4+Pj4+ PiBwcmVzZW50LCB0aGVuIHRoZQ0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICAgICAgICAg ICAgIHZlcmlmaWVyIHByb2NlZWRzIG5vcm1hbGx5IGJlbG93LiAgSWYgYSAicHB0Ig0KICAgID4+ Pj4+PiBwYXJhbWV0ZXIgdmFsdWUgaXMNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAg ICAgICAgICBwcmVzZW50LCBhbmQgdGhlIHZlcmlmaWVyIGRvZXMgbm90IHN1cHBvcnQgaXQsDQog ICAgPj4+Pj4+IGl0IE1VU1QgaWdub3JlIHRoZQ0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAg ICAgICAgICAgICAgIElkZW50aXR5IGhlYWRlci4gIElmIGEgc3VwcG9ydGVkICJwcHQiIHBhcmFt ZXRlcg0KICAgID4+Pj4+PiB2YWx1ZSBpcyBwcmVzZW50LA0KICAgID4+Pj4+Pg0KICAgID4+Pj4+ PiAgICAgICAgICAgICAgICAgIHRoZSB2ZXJpZmllciBmb2xsb3dzIHRoZSBwcm9jZWR1cmVzIGJl bG93LA0KICAgID4+Pj4+PiBpbmNsdWRpbmcgdGhlIHZhcmlhdGlvbnMNCiAgICA+Pj4+Pj4NCiAg ICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBkZXNjcmliZWQgaW4gU3RlcCA1Lg0KICAgID4+Pj4+ Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICAg ICAgICAgICAgICAzDQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgIDxmaWxlOi8vL0M6L1Vz ZXJzL2FiMzc3OC9Eb2N1bWVudHMvSUVURi9kcmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xMCUy MC0lMjBBdXRoZW50aWNhdGVkJTIwSWRlbnRpdHklMjBNYW5hZ2VtZW50JTIwaW4lMjB0aGUlMjBT ZXNzaW9uJTIwSW5pdGlhdGlvbiUyMFByb3RvY29sJTIwJTI4U0lQJTI5Lmh0bSNzZWN0aW9uLTM+ Lg0KICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgICBCYWNrZ3JvdW5kDQogICAgPj4+Pj4+DQog ICAgPj4+Pj4+ICAgICAgICAgICAgICAgWy4uLl0NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAg ICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBQZXIgW1JGQzczNDANCiAgICA+ Pj4+Pj4gPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3MzQwPl0sIHByb2JsZW1zIHN1 Y2ggYXMNCiAgICA+Pj4+Pj4gcm9ib2NhbGxpbmcsIHZvaWNlbWFpbCBoYWNraW5nLCBhbmQNCiAg ICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBzd2F0dGluZyBhcmUgZW5hYmxl ZCBieSBhbiBhdHRhY2tlcidzIGFiaWxpdHkgdG8NCiAgICA+Pj4+Pj4gaW1wZXJzb25hdGUgc29t ZW9uZQ0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIGVsc2UuICBUaGUg c2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUA0KICAgID4+Pj4+PiBhcHBsaWNhdGlvbnMgYW5k IHNlcnZpY2VzDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgZGVwZW5k cyBvbiBhdXRoZW50aWNhdGluZyBhbmQvb3IgYXV0aG9yaXppbmcgdGhlDQogICAgPj4+Pj4+IHNv dXJjZSBvZiBjb21tdW5pY2F0aW9ucyBhcyBpdCBpcw0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAg ICAgICAgICAgICAgICAgIHJlcHJlc2VudGVkIGluIGEgU0lQIHJlcXVlc3QuDQogICAgPj4+Pj4+ DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgVGhp cyBpZGVudGl0eSBhcmNoaXRlY3R1cmUgZm9yIFNJUCBkZXBlbmRzIG9uDQogICAgPj4+Pj4+IGlu Y2x1ZGVzIHByb3Zpc2lvbnMgZm9yIGEgbG9naWNhbA0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAg ICAgICAgICAgICAgICAgICJhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIiB3aGljaCB2YWxpZGF0ZXMg Y2FsbGVyDQogICAgPj4+Pj4+IGlkZW50aXR5IGF0IG9yIG5lYXIgb3JpZ2luYXRpb24uICBvdXRn b2luZw0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHJlcXVlc3RzLiAgQW4NCiAgICA+Pj4+Pj4N CiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIG1heSBi ZSBpbXBsZW1lbnRlZCBlaXRoZXINCiAgICA+Pj4+Pj4gYXMgcGFydCBvZiBhIHVzZXINCiAgICA+ Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBhZ2VudCBvciBhcyBhIHByb3h5IHNl cnZlcjsgdHlwaWNhbGx5LCBpdCBpcyBhDQogICAgPj4+Pj4+IGNvbXBvbmVudCBvZiBhIG5ldHdv cmsNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBpbnRlcm1lZGlhcnkg bGlrZSBhIHByb3h5IHRvIHdoaWNoIG9yaWdpbmF0aW5nDQogICAgPj4+Pj4+IHVzZXIgYWdlbnRz IHNlbmQNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICB1bnNpZ25lZCBy ZXF1ZXN0cy4gIE9uY2UgdGhlIHNlbmRlciBvZiB0aGUNCiAgICA+Pj4+Pj4gbWVzc2FnZSBoYXMg YmVlbg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAg ID4+Pj4+PiAgICAgICAgICAgICAgICAgIFRoaXMgZG9jdW1lbnQgc3BlY2lmaWVzIGEgbWVhbnMg b2Ygc2hhcmluZyBhDQogICAgPj4+Pj4+IGNyeXB0b2dyYXBoaWMgYXNzdXJhbmNlDQogICAgPj4+ Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgb2YgYXV0aGVudGljaXR5IG9mIGFuZC9v ciBhdXRob3JpemF0aW9uIHRvIHVzZQ0KICAgID4+Pj4+PiBlbmQtdXNlciBTSVAgaWRlbnRpdHkg aW4gYW4gaW50ZXJkb21haW4gb3IgaW50cmFkb21haW4gY29udGV4dC4NCiAgICA+Pj4+Pj4NCiAg ICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBJdCByZWxpZXMgb24gdGhlIGF1dGhlbnRpY2F0aW9u IHNlcnZpY2UNCiAgICA+Pj4+Pj4gY29uc3RydWN0aW5nIHRva2VucyBiYXNlZCBvbiBbLi4uXQ0K ICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+Pg0KICAgID4+Pj4+ Pg0KICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIFRvIG1heGltaXplIGVuZC10by1lbmQgc2Vj dXJpdHksIGl0IGlzIHR5cGljYWxseQ0KICAgID4+Pj4+PiBvYnZpb3VzbHkNCiAgICA+Pj4+Pj4N CiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBwcmVmZXJhYmxlIGZvciBlbmQtdXNlcnMgdG8g YWNxdWlyZSB0aGVpciBvd24NCiAgICA+Pj4+Pj4gY3JlZGVudGlhbHM7IGlmIHRoZXkNCiAgICA+ Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBkbywgdGhlaXIgdXNlciBhZ2VudHMg Y2FuIGFjdCBhcyBhdXRoZW50aWNhdGlvbg0KICAgID4+Pj4+PiBzZXJ2aWNlcy4gIEhvd2V2ZXIs DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgZm9yIHNvbWUgZGVwbG95 bWVudHMsIFsuLi5dDQogICAgPj4+Pj4+DQogICAgPj4+Pj4+DQogICAgPj4+Pj4+DQogICAgPj4+ Pj4+ICAgICAgICAgICAgICAgUmVnYXJkcywNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gICAgICAg ICAgICAgICBBbGV4DQogICAgPj4+Pj4+ICAgICAgICAgICAgICAgKiAqDQogICAgPj4+Pj4+ICAg ICAgICAgICAgICAgKkFsZXggQm9ib3RlayoNCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAgICA+ Pj4+Pj4gICAgICAgICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KICAgID4+Pj4+PiAgICAgICAgICAgICAgIHN0aXIgbWFpbGluZyBsaXN0DQog ICAgPj4+Pj4+ICAgICAgICAgICAgICAgc3RpckBpZXRmLm9yZw0KICAgID4+Pj4+PiA8bWFpbHRv OnN0aXJAaWV0Zi5vcmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCiAgICA+Pj4+Pj4gICAgICAg ICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCiAgICA+ Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4NCiAgICA+Pj4+Pj4gLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0NCiAgICA+Pj4+Pj4gLS0tLS0tLQ0KICAgID4+Pj4+Pg0KICAgID4+Pj4+PiAgICAgICAg ICAgVGhpcyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0YXJ5IGluZm9ybWF0aW9u DQogICAgPj4+Pj4+ICAgICAgICAgICBpbnRlbmRlZCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBy ZWNpcGllbnQocykuIEFueSB1c2UgYnkNCiAgICA+Pj4+Pj4gICAgICAgICAgIG90aGVycyBpcyBw cm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQNCiAgICA+Pj4+Pj4gICAgICAg ICAgIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIGFsbCBj b3BpZXMNCiAgICA+Pj4+Pj4gICAgICAgICAgIG9mIHRoZSBtZXNzYWdlLg0KICAgID4+Pj4+DQog ICAgPj4+Pj4NCiAgICA+Pj4+Pg0KICAgID4+Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQogICAgPj4+Pj4gc3RpciBtYWlsaW5nIGxpc3QNCiAgICA+ Pj4+PiBzdGlyQGlldGYub3JnIDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCiAgICA+Pj4+PiBodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCiAgICA+Pj4+Pg0KICAgID4+ Pj4NCiAgICA+Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQogICAgPj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KICAgID4+Pj4gc3RpckBpZXRmLm9yZyA8 bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQogICAgPj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3N0aXINCiAgICA+Pj4NCiAgICA+Pg0KICAgID4+IF9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgPj4gc3RpciBtYWlsaW5nIGxp c3QNCiAgICA+PiBzdGlyQGlldGYub3JnDQogICAgPj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9zdGlyDQogICAgPg0KICAgID4NCg0KICAgIF9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgc3RpciBtYWlsaW5nIGxpc3QNCiAg ICBzdGlyQGlldGYub3JnDQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9zdGlyDQoNCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KICAgIHN0aXIgbWFpbGluZyBsaXN0DQogICAgc3RpckBpZXRmLm9yZw0KICAgIGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KDQoNCg0KDQoNCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQoNClRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmlu dCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbiBpbnRlbmRlZCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRo ZSByZWNpcGllbnQocykuIEFueSB1c2UgYnkgb3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBh cmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIg YW5kIGRlbGV0ZSBhbGwgY29waWVzIG9mIHRoZSBtZXNzYWdlLg0K From nobody Fri Aug 5 08:34:57 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D1CB12D50A for ; Fri, 5 Aug 2016 08:34:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-0XeHaa1E2L for ; Fri, 5 Aug 2016 08:34:51 -0700 (PDT) Received: from mail1.bemta5.messagelabs.com (mail1.bemta5.messagelabs.com [195.245.231.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 303AD12B071 for ; Fri, 5 Aug 2016 08:34:50 -0700 (PDT) Received: from [85.158.136.83] by server-1.bemta-5.messagelabs.com id 7E/15-19721-912B4A75; Fri, 05 Aug 2016 15:34:49 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrOKsWRWlGSWpSXmKPExsVy+MWXNl3RTUv CDb41S1s8vT+NzeLQg6fsFis2HGC1mPHDwGL52m1MDqwef99/YPJ42T+H0eP+t7/sHkuW/GTy mPjxDHMAaxRrZl5SfkUCa8a95VeYCya0MlWs7dzN3MDYeZGxi5GLQ0hgD6PE7NddLF2MnEDOS kaJp4eqIBLLmSS+bP7EDuEcZpRY19TIAuHMYZSYfPEwO0gLm4CTxPzd65hAbBEBd4kFe7cwg9 jMAgUSF3o/gcWFBXQk7tx8xA5Roytx6NgLZpBBIgKrGCUmTNoAtptFQEVi47YJrCA2r0CoxNW 2Q6wQ245xSMzZ0M8GkuAE2nb1/1WwBkYBWYkvjauhtolL3HoyH2ybhICAxJI955khbFGJl4// sULU6Egs2P2JDcLWlli28DUzxDJBiZMzn7BMYBSbhWTULCQts5C0zELSsoCRZRWjenFqUVlqk a6RXlJRZnpGSW5iZo6uoYGpXm5qcXFiempOYlKxXnJ+7iZGYIQyAMEOxu9/nA4xSnIwKYnyrk tcEi7El5SfUpmRWJwRX1Sak1p8iFGGg0NJgvfpBqCcYFFqempFWmYOMFXApCU4eJREeK03AqV 5iwsSc4sz0yFSpxgVpcR5D4D0CYAkMkrz4Npg6ekSo6yUMC8j0CFCPAWpRbmZJajyrxjFORiV hHm5QcbzZOaVwE1/BbSYCWjxRyuwxSWJCCmpBkZB63NiFcKCfDmz3665P2/2JJnysgqLWsvr1 e91lhV+S4wxWBmRW1h83nZNg+malgtbc58dvRojd3+N9ZnbfNelDpcLzri+a8fDxMyag38ua9 yOsHwatnKNZ8jRBXX/Fju/WlZSLPnlykO1hwJ8h7ddqtjA/uXHH5Vn99qdfJ9PkWp5cr+hwGm bEktxRqKhFnNRcSIAcVazrkoDAAA= X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-5.tower-36.messagelabs.com!1470411285!45412882!1 X-Originating-IP: [195.232.244.134] X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9585 invoked from network); 5 Aug 2016 15:34:45 -0000 Received: from mailout02.vodafone.com (HELO mailout02.vodafone.com) (195.232.244.134) by server-5.tower-36.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 5 Aug 2016 15:34:45 -0000 Received: from mailint04.vodafone.com (mailint04.vodafone.com [195.232.244.201]) by mailout02.vodafone.com (Postfix) with ESMTP id 3s5W850RL9zbdMS; Fri, 5 Aug 2016 17:34:45 +0200 (CEST) Received: from mailint04.vodafone.com (localhost [127.0.0.1]) by mailint04.vodafone.com (Postfix) with ESMTP id 3s5W846HcVzfZBm; Fri, 5 Aug 2016 17:34:44 +0200 (CEST) Received: from VOEXC01W.internal.vodafone.com (voexc01w.dc-ratingen.de [145.230.101.21]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint04.vodafone.com (Postfix) with ESMTPS id 3s5W845tbVzfZGk; Fri, 5 Aug 2016 17:34:44 +0200 (CEST) Received: from VOEXC24W.internal.vodafone.com (145.230.103.196) by VOEXC01W.internal.vodafone.com (145.230.101.21) with Microsoft SMTP Server (TLS) id 14.3.224.2; Fri, 5 Aug 2016 17:34:44 +0200 Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by voexc24w ([145.230.103.196]) with mapi id 14.03.0224.002; Fri, 5 Aug 2016 17:34:42 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Brian Rosen , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AdHtnZL44XSdzpn5S4ezxStpcxWG/gAqmfuAAAWRJoAAAX9oAAACCpaAAABpDQAAAKK5AAAAWieAAAPgt4AAALpDgAAAzAAAAAA1foAAAEbIAAAAZjkAAABSQQAAF5txgAAKzH2AAACWWgAAAMf5AAAEVNRw Date: Fri, 5 Aug 2016 15:34:42 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <31940C05-9500-4F1C-85EB-9526FDA65CCD@brianrosen.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <153E750D-FF98-4261-9926-6F500EA1462F@att.com> <6B577009-93C6-4438-A9AF-E0FF15809B43@brianrosen.net> In-Reply-To: <6B577009-93C6-4438-A9AF-E0FF15809B43@brianrosen.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 15:34:55 -0000 Your interpretation's correct Brian - the UK spec is at http://www.niccstan= dards.org.uk/files/current/ND1035V2.1.1.pdf?type=3Dpdf with Section 7 refer= ring. Looks like opposite way to you guys. The details of protocol aren't really my thing & I'd need to check with the= group that wrote that spec, but my interpretation is that we couldn't use = PAI for display in our context because it's coming from the customer and (a= bsent a STIR-type mechanism) the customer PBX is outside the trust domain s= o we can't paste anything they send into a PAI. The first node in the regu= lated public network inserts the PAI under our implementation and we'll flo= w through whatever the customer sends us in the From. Could make for some interesting interworking challenges at the internationa= l boundary! Incidentally, another not uncommon use case is a customer dual parented to = two service providers for resilience....the Presentation/display number is = the same for both, but because we need to be able to trace back to a partic= ular network ingress there'd be a separate Network Number (as we call it) f= or each. Paul -----Original Message----- From: Brian Rosen [mailto:br@brianrosen.net]=20 Sent: 05 August 2016 16:16 To: DOLLY, MARTIN C Cc: Richard Shockey; Rosbotham, Paul, Vodafone UK; Paul Kyzivat; stir@ietf.= org Subject: Re: [stir] STIR 4474bis-10 comments Right, but we really don't have a concept of "Display Numbers" vs "Network = Numbers" in the US. We do have cases where a call center would want to use= the main number of an enterprise when it calls on behalf of that enterpris= e. I would call that "authorized spoofing", especially when the carrier fo= r the enterprise is different from the carrier for the call center, but it = doesn't matter what we call it, we would have one number, and it probably w= ould be in PAI (From would be ignored). The call center could sign the cal= l using a credential issued by the enterprise base on the credential it's c= arrier issued to it. Or, the call center's carrier could sign using a cred= ential issued by the enterprise carrier based on a request to the enterpris= e, or some other similar path. In the UK case, they have two numbers, both of which are carried in the sig= naling, and Paul seemed to indicate that the network number was carried in = PAI. Brian > On Aug 5, 2016, at 10:53 AM, DOLLY, MARTIN C wrote: >=20 > Yes if PAI present >=20 > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards AT&T > Cell: 609-903-3360 > Email: md3135@att.com >=20 >> On Aug 5, 2016, at 10:42 AM, Richard Shockey wrote: >>=20 >>=20 >> Humm this is getting interesting. Its my understanding that the display= number aka "presentation number" in the US context is the one carried in t= he PAI. Martin, Pierce?=20 >>=20 >>=20 >>=20 >>=20 >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>=20 >> Jumping in now that we're on European working time, +1 on Paul's obser= vation. >>=20 >> Here in the UK, we've got 2 numbers carried as calling line IDs....one= (we term the Network Number, carried in PAID) uniquely identifies the line= , the other (we term Presentation Number, carried in From) is used for disp= lay purposes. >>=20 >> Only the carrier has the authority to set the Network Number so only t= hey could sign it. =20 >>=20 >> But - subject to regulatory restrictions which are well documented - t= he number sent for display purposes belongs to the customer. For blue-chip= customers, I can allow them to send their Presentation Numbers into the ne= twork, and can't readily check at a network level that they're theirs (I do= have contractual safeguards). The number may have been allocated by me, o= r could be allocated by a third party provider. If it's a call-centre they= 'll be making outbound calls for lots of different customers which will cha= nge on day-by-day basis. This is business as usual. I don't like the term= "authorised spoofing" because it implies that the CLI is in some way being= rigged: it's not, it's the corporate customer or their subcontractor using= the number that's been assigned (so in internet terms delegated) to them v= ia a chain of trust from the regulator. >>=20 >> What I want is the ability for customers to use their credentials=20 >> to sign the CLIs they send me so that at the terminating end it can=20 >> be checked (or indeed somewhere en-route if that's the business=20 >> model). I can and would sign for customers on my mobile business=20 >> since I'm driving what number is presented, but that's by-the-by=20 >> because they aren't the ones who generate millions of nuisance calls. =20 >> If the signing only occurs at the originating carrier level for=20 >> corporate/call-centre customers that's no use because I'm not in a=20 >> position to do that for these type of customers...and the whole=20 >> system becomes a waste of time. I'd also highlight there are many=20 >> more of my large customers that I'd trust more than a far end=20 >> originating carrier that could be anywhere in the world (though we=20 >> have no shortage of small carriers that I wouldn't know from Adam=20 >> more locally in the UK....) >>=20 >> Regards >>=20 >> Paul >>=20 >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>>=20 >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >>=20 >> IIUC the delegation is to a responsible entity (something that can be = held legally accountable - e.g. a person), not to a device. The entity can = then "use" the credential via any device(s) it chooses. In the case of the = mobile, the device then becomes a two-line phone. >>=20 >> Thanks, >> Paul >>=20 >>> Brian >>>=20 >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>>=20 >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline=20 >>>>> carrier to him. He then creates another credential, which he=20 >>>>> signs with his office phone credential that authorizes his mobile=20 >>>>> to send calls from his office number. He is spoofing (because the=20 >>>>> call is coming from his mobile's TN but claims to be from his=20 >>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>> credential to his mobile SP if they sign on his behalf. >>>>=20 >>>> I don't understand how that is different from regular delegation. >>>>=20 >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>>=20 >>>> Thanks, >>>> Paul >>>>=20 >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>>=20 >>>>> But that's how I describe it. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>>=20 >>>>>> +1, but with one question below: >>>>>>=20 >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation=20 >>>>>>> path, >>>>>>=20 >>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>> authorized spoofers. >>>>>>=20 >>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>=20 >>>>>> Thanks, >>>>>> Paul >>>>>>=20 >>>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>>> long as the delegator is willing to take the heat for delegating=20 >>>>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>> that you can pass the hot potato. >>>>>>>=20 >>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20 >>>>>>> any calls placed on its network on any number it has been delegated= . >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and=20 >>>>>>> that represents the hard part of deployment in my opinion. But=20 >>>>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>>=20 >>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>> informal delegation path for telephone numbers in every country,=20 >>>>>>> and we can build a chain of trust from that delegation path. If=20 >>>>>>> you propose to alter that model, then we get into (policy)=20 >>>>>>> issues of which carriers/entities we trust and which we don't. =20 >>>>>>> Our model is that you know who you delegate to, and once you do tha= t delegation, it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>>> business practices. >>>>>>>=20 >>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>>> and use cases. >>>>>>>>=20 >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>>=20 >>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>> relationships are two additional factors which affect=20 >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>=20 >>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>>>> that variability. >>>>>>>>=20 >>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>>=20 >>>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>>=20 >>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>> relationship with typical consumers adds to the trustworthiness=20 >>>>>>>> assessment and partially because carriers are a regulated point=20 >>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most=20 >>>>>>>> calls originate and terminate between mobile consumers where=20 >>>>>>>> their carriers are able to usefully authenticate their device=20 >>>>>>>> and have a high degree of confidence of the authenticity of the ca= lling number. >>>>>>>>=20 >>>>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>=20 >>>>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>>>> the calling party has to sign a call with a per-TN cert=20 >>>>>>>> provided by the called party. No called party cert to include? =20 >>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>> with the called party, and the call can be authorized/treated acco= rdingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>> deployed on devices and PBXs. Whether they will be is a policy is= sue. >>>>>>>>=20 >>>>>>>> The notion of credentials that are traceable to a delegation of=20 >>>>>>>> a TN is a mechanism that is part of the design of stir, and the=20 >>>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>> credential. For the use case we've discussed, a mobile phone=20 >>>>>>>> may also have a credential for, say, a TN that is delegated to=20 >>>>>>>> a landline, to cover the example case of a doctor placing a=20 >>>>>>>> call on his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy=20 >>>>>>>> discussion. Regardless, I do appreciate your explanation. I=20 >>>>>>>> would like to continue the discussion, but I'm pretty sure this=20 >>>>>>>> isn't the right forum. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20 >>>>>>>> and any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs=20 >>>>>>>> they are authorized to sign for. They can try to sign any=20 >>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>> signature fail the checking. >>>>>>>>=20 >>>>>>>> Getting service providers to sign on behalf of devices is a=20 >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20 >>>>>>>> want to get out of the liability of signing on behalf of their=20 >>>>>>>> customers. If they can push of that responsibility to their=20 >>>>>>>> customer, only being responsible for getting the customer an=20 >>>>>>>> appropriate credential when they assign TNs, then I would=20 >>>>>>>> expect them to want to do so. That means the devices have to=20 >>>>>>>> be able to sign, but I understand many of the PBX vendors think=20 >>>>>>>> that's something they could provide in a future release. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated number= s? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> First of all, we would want the PBX to generate the signature, >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>>=20 >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from an >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" devices >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a single >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>>=20 >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggested >>>>>>>> below by Alex). >>>>>>>>=20 >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>>=20 >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>=20 >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>>=20 >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>>=20 >>>>>>>> *Public Use Case:* >>>>>>>>=20 >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> There are reasonable circumstances where a party placing a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call may >>>>>>>> or may not be the same as the service provider serving the >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes calls >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where there >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, at >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with this >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-ID >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may be >>>>>>>> possible to DOS, spam or text-bomb a recipient using a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Specific markup suggestions: >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> NITS >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>>=20 >>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>> present, then the >>>>>>>>=20 >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>>=20 >>>>>>>> present, and the verifier does not support it,=20 >>>>>>>> it MUST ignore the >>>>>>>>=20 >>>>>>>> Identity header. If a supported "ppt" parameter=20 >>>>>>>> value is present, >>>>>>>>=20 >>>>>>>> the verifier follows the procedures below,=20 >>>>>>>> including the variations >>>>>>>>=20 >>>>>>>> described in Step 5. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>>=20 >>>>>>>> [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as=20 >>>>>>>> robocalling, voicemail hacking, and >>>>>>>>=20 >>>>>>>> swatting are enabled by an attacker's ability to=20 >>>>>>>> impersonate someone >>>>>>>>=20 >>>>>>>> else. The secure operation of most SIP=20 >>>>>>>> applications and services >>>>>>>>=20 >>>>>>>> depends on authenticating and/or authorizing the=20 >>>>>>>> source of communications as it is >>>>>>>>=20 >>>>>>>> represented in a SIP request. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>> includes provisions for a logical >>>>>>>>=20 >>>>>>>> "authentication service" which validates caller=20 >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>>=20 >>>>>>>> authentication service may be implemented either=20 >>>>>>>> as part of a user >>>>>>>>=20 >>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>> component of a network >>>>>>>>=20 >>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>> user agents send >>>>>>>>=20 >>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>> message has been >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This document specifies a means of sharing a=20 >>>>>>>> cryptographic assurance >>>>>>>>=20 >>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>=20 >>>>>>>> It relies on the authentication service=20 >>>>>>>> constructing tokens based on [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> To maximize end-to-end security, it is typically=20 >>>>>>>> obviously >>>>>>>>=20 >>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>> credentials; if they >>>>>>>>=20 >>>>>>>> do, their user agents can act as authentication=20 >>>>>>>> services. However, >>>>>>>>=20 >>>>>>>> for some deployments, [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Regards, >>>>>>>>=20 >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> --------------------------------------------------------------- >>>>>>>> -- >>>>>>>> ------- >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copies >>>>>>>> of the message. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>=20 >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 5 09:57:48 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B04B12D91C for ; Fri, 5 Aug 2016 09:57:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8AxjZ4uVArfm for ; Fri, 5 Aug 2016 09:57:44 -0700 (PDT) Received: from resqmta-ch2-02v.sys.comcast.net (resqmta-ch2-02v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A797512D91A for ; Fri, 5 Aug 2016 09:57:43 -0700 (PDT) Received: from resomta-ch2-08v.sys.comcast.net ([69.252.207.104]) by resqmta-ch2-02v.sys.comcast.net with SMTP id ViR0bjd5L0MKRViRLb5Dad; Fri, 05 Aug 2016 16:57:43 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id ViRJbGcQTS9gdViRJbLscj; Fri, 05 Aug 2016 16:57:42 +0000 To: "Gorman, Pierce A [CTO]" , Richard Shockey , "Rosbotham, Paul, Vodafone UK" , Brian Rosen References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> From: Paul Kyzivat Message-ID: <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> Date: Fri, 5 Aug 2016 12:57:39 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfIl8oLbI0hpBCN2n/AQqKWE3bGLVyX14r9cQpK6YTZzd93Tb/42Fm0LwMultj0ojE4We5cSWftq0erlB3jQOTWRKWw54kk1cRmmvajZOQqgkkWiVjMe7 +kkBkqiF3bKBAJdKXEj4FJEjGtNI1ZBWnypo03L2zkyUOKgzJCpL14NhWpo8r1kLF8eXc1ypYPy7/uG6LQmJp0CPFdQVM2qp3ulEOZgOOWf0s6XCvrGo7q8S X2WlgLeJSfJCDVNU+amEf7vhyjsrr4515quim6fc/jPVi81VOkump1hJ33I08rvItm2Ekgp43C/ul96bxonsub7W4NU6cBNi2aSMKR/rwMs= Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 16:57:47 -0000 If PAI is present and signed, and From is also signed, I would expect it to be up to the UA to decide what to display, not the carrier. Of course this will work differently if there is a different signaling regime between the carrier and the user device (e.g. black phone). Thanks, Paul On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > P-Asserted-Identity is supposed to operate "among trusted SIP entities" and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-Identity is stripped by border controller functions and is not to be used in inter-carrier inter-connection (although it commonly shows up anyway). My opinion is the "From" header is likely used more often for presentation. > > Pierce > > > -----Original Message----- > From: Richard Shockey [mailto:richard@shockey.us] > Sent: August 05, 2016 9:37 AM > To: Rosbotham, Paul, Vodafone UK ; Paul Kyzivat ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > > Humm this is getting interesting. Its my understanding that the display number aka “presentation number” in the US context is the one carried in the PAI. Martin, Pierce? > > > > > On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: > > Jumping in now that we're on European working time, +1 on Paul's observation. > > Here in the UK, we've got 2 numbers carried as calling line IDs....one (we term the Network Number, carried in PAID) uniquely identifies the line, the other (we term Presentation Number, carried in From) is used for display purposes. > > Only the carrier has the authority to set the Network Number so only they could sign it. > > But - subject to regulatory restrictions which are well documented - the number sent for display purposes belongs to the customer. For blue-chip customers, I can allow them to send their Presentation Numbers into the network, and can't readily check at a network level that they're theirs (I do have contractual safeguards). The number may have been allocated by me, or could be allocated by a third party provider. If it's a call-centre they'll be making outbound calls for lots of different customers which will change on day-by-day basis. This is business as usual. I don't like the term "authorised spoofing" because it implies that the CLI is in some way being rigged: it's not, it's the corporate customer or their subcontractor using the number that's been assigned (so in internet terms delegated) to them via a chain of trust from the regulator. > > What I want is the ability for customers to use their credentials to sign the CLIs they send me so that at the terminating end it can be checked (or indeed somewhere en-route if that's the business model). I can and would sign for customers on my mobile business since I'm driving what number is presented, but that's by-the-by because they aren't the ones who generate millions of nuisance calls. If the signing only occurs at the originating carrier level for corporate/call-centre customers that's no use because I'm not in a position to do that for these type of customers...and the whole system becomes a waste of time. I'd also highlight there are many more of my large customers that I'd trust more than a far end originating carrier that could be anywhere in the world (though we have no shortage of small carriers that I wouldn't know from Adam more locally in the UK....) > > Regards > > Paul > > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: 04 August 2016 23:12 > To: Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > On 8/4/16 6:02 PM, Brian Rosen wrote: > > I think it's not a delegation. The mobile phone is not being delegated the TN, it's being authorized to place calls that are not from that TN, but appear to be. > > > > The mechanism to handle the credential is exactly the same as a delegation, so if you want to call it delegation, go ahead, but I prefer to call it authorized spoofing. > > IIUC the delegation is to a responsible entity (something that can be held legally accountable - e.g. a person), not to a device. The entity can then "use" the credential via any device(s) it chooses. In the case of the mobile, the device then becomes a two-line phone. > > Thanks, > Paul > > > Brian > > > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: > >> > >> On 8/4/16 5:43 PM, Brian Rosen wrote: > >>> In my jargon an "authorized spoofer" is the doctor who is calling > >>> from his mobile, but sending the TN of his office phone as calling party. > >>> The delegation to his office phone was made by his landline carrier > >>> to him. He then creates another credential, which he signs with his > >>> office phone credential that authorizes his mobile to send calls > >>> from his office number. He is spoofing (because the call is coming > >>> from his mobile's TN but claims to be from his office), but it's > >>> authorized spoofing. The doc could give the credential to his > >>> mobile SP if they sign on his behalf. > >> > >> I don't understand how that is different from regular delegation. > >> > >> When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. > >> > >> Thanks, > >> Paul > >> > >>> Some folks don't like attaching the "spoofing" label to a legitimate use. > >>> > >>> But that's how I describe it. > >>> > >>> Brian > >>> > >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>> > wrote: > >>>> > >>>> +1, but with one question below: > >>>> > >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > >>>>> I think all we need is to have credentials follow the delegation > >>>>> path, > >>>> > >>>>> plus the option to add another level (not delegation) for > >>>>> authorized spoofers. > >>>> > >>>> I don't understand "authorized spoofers" in this context, as > >>>> contrasted to "spoofers" who have been delegated their authority. > >>>> > >>>> Thanks, > >>>> Paul > >>>> > >>>>> I don't think it matters who the delegator or delegatee are as > >>>>> long as the delegator is willing to take the heat for delegating > >>>>> to someone who sends a lot of bad calls. They can pass the buck > >>>>> ("I delegated the TN to him, and now I'm not responsible"), but > >>>>> only if the SP knows who they delegated to, so authorities can > >>>>> follow the delegation path. There are plenty of certificated > >>>>> carriers who are willing to not care who they delegate to. The fact that there are some who do doesn't change much. > >>>>> Making stir work means knowing who you are delegating to, so that > >>>>> you can pass the hot potato. > >>>>> > >>>>> It's perfectly reasonable for a carrier to be able to sign for any > >>>>> calls placed on its network on any number it has been delegated. > >>>>> If it does, it's asserting that the calls are from who they are supposed to be from. > >>>>> That should be straightforward, but we know it's not always, and > >>>>> that represents the hard part of deployment in my opinion. But > >>>>> once they delegate, they can hand responsibility to sign to the > >>>>> delegatee. But, that only works if they know who they are delegating to. > >>>>> > >>>>> The root of the whole model is that there is a formal or informal > >>>>> delegation path for telephone numbers in every country, and we can > >>>>> build a chain of trust from that delegation path. If you propose > >>>>> to alter that model, then we get into (policy) issues of which > >>>>> carriers/entities we trust and which we don't. Our model is that > >>>>> you know who you delegate to, and once you do that delegation, it's their problem. > >>>>> That's pretty appealing I think, even if it's a change in some > >>>>> business practices. > >>>>> > >>>>> The mechanism is chaining credentials in a form of a PKI and > >>>>> having a way to know which TNs are covered by a credential. > >>>>> That's what we have, and I'm loath to change it. > >>>>> > >>>>> Brian > >>>>> > >>>>> > >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > >>>>>> > >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> OK, you talked me into indulging in one more message on policy > >>>>>> and use cases. > >>>>>> > >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on > >>>>>> individual devices as well as multi-device and multi-number platforms. > >>>>>> > >>>>>> Number delegation (and sub-delegation), and business > >>>>>> relationships are two additional factors which affect > >>>>>> trustworthiness of a given calling number authentication. > >>>>>> > >>>>>> Inherent variable trustworthiness of a calling number was my > >>>>>> reason for suggesting a way to qualify the signature to reflect > >>>>>> that variability. > >>>>>> > >>>>>> Originating carriers are in a position to know if a call is > >>>>>> coming from a device assigned a single number, or from "trunk > >>>>>> group" which could originate calls using multiple numbers, and > >>>>>> can qualify to some degree the trustworthiness of number authenticity accordingly. > >>>>>> > >>>>>> My suggestion was qualifying calling number authenticity into > >>>>>> categories of carrier-signed (or not), and unauthenticated, > >>>>>> semi-authenticated, and most-authenticated. There can be more > >>>>>> granularity, but it implies additional operational complexity > >>>>>> (both for the carriers and the consumers) and I assume diminishes value. > >>>>>> > >>>>>> My reason for adding the authenticity of the originating carrier > >>>>>> is typical trustworthiness of a carrier business relationship > >>>>>> with typical consumers adds to the trustworthiness assessment and > >>>>>> partially because carriers are a regulated point of forensic > >>>>>> inquiry for CALEA and fraud. Additionally, most calls originate > >>>>>> and terminate between mobile consumers where their carriers are > >>>>>> able to usefully authenticate their device and have a high degree > >>>>>> of confidence of the authenticity of the calling number. > >>>>>> > >>>>>> I think billions of per-TN certs of varying usability (revoked, > >>>>>> not > >>>>>> revoked) for authenticating calling number will not work well. > >>>>>> > >>>>>> Conversely, I think billions of per-TN certs will work well, if > >>>>>> the calling party has to sign a call with a per-TN cert provided > >>>>>> by the called party. No called party cert to include? Then the > >>>>>> calling party does not have a trusted relationship with the > >>>>>> called party, and the call can be authorized/treated accordingly. > >>>>>> (I've made similar, mostly ignored comments in MODERN.) > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 2:03 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> Well, the mechanisms are designed so that they could be deployed > >>>>>> on devices and PBXs. Whether they will be is a policy issue. > >>>>>> > >>>>>> The notion of credentials that are traceable to a delegation of a > >>>>>> TN is a mechanism that is part of the design of stir, and the > >>>>>> design allows delegation of one TN (to one device, although a > >>>>>> device like a PBX would have more than one TN per "device", and > >>>>>> something like a dual NAM phone could have more than one > >>>>>> credential. For the use case we've discussed, a mobile phone may > >>>>>> also have a credential for, say, a TN that is delegated to a > >>>>>> landline, to cover the example case of a doctor placing a call on > >>>>>> his mobile, but getting his office number to show up as the calling party. Use of such mechanisms is policy. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > >>>>>> >>>>>> > >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> Thanks Brian. I'm afraid we're straying into a policy > >>>>>> discussion. Regardless, I do appreciate your explanation. I > >>>>>> would like to continue the discussion, but I'm pretty sure this > >>>>>> isn't the right forum. > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 1:34 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> Of course I want PBXs to sign calls. As well as smart phones and > >>>>>> any other devices that can be programmed to do so. > >>>>>> They will be given credentials that only are valid for the TNs > >>>>>> they are authorized to sign for. They can try to sign any call, > >>>>>> but the validity of the credential would make such a signature > >>>>>> fail the checking. > >>>>>> > >>>>>> Getting service providers to sign on behalf of devices is a > >>>>>> reasonable way to deploy quickly, but I expect many SPs will want > >>>>>> to get out of the liability of signing on behalf of their > >>>>>> customers. If they can push of that responsibility to their > >>>>>> customer, only being responsible for getting the customer an > >>>>>> appropriate credential when they assign TNs, then I would expect > >>>>>> them to want to do so. That means the devices have to be able to > >>>>>> sign, but I understand many of the PBX vendors think that's > >>>>>> something they could provide in a future release. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > >>>>>> >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> You want IP PBXes to sign calls? Won't that make it > >>>>>> extraordinarily easy to commit fraud with authenticated numbers? > >>>>>> > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 12:24 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> First of all, we would want the PBX to generate the signature, > >>>>>> but the service provider can do that. It should not add a > >>>>>> valid signature to a call from a number it did not assign to > >>>>>> the trunk group connecting to the PBX, although it could > >>>>>> support the extra delegation required to support "authorized > >>>>>> spoofing". The companion devices I'm aware of always send > >>>>>> calls from the same service provider and should not present > >>>>>> any issue. > >>>>>> > >>>>>> Everyone will have to do work they don't do now to implement > >>>>>> stop spoofed calls. TANSTAAFL > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] > >>>>>> > >>>>>> > wrote: > >>>>>> > >>>>>> Fraud from compromised PBXes is common. And even where a > >>>>>> PBX is not compromised, a carrier has no practical way of > >>>>>> knowing whether the calling number is properly assigned > >>>>>> and valid from the perspective of the Enterprise. > >>>>>> Therefore, checking whether the calling number was from an > >>>>>> assigned range might be possible (and fraught with > >>>>>> administrative challenges), but of limited value. And in > >>>>>> the consumer market, there are calling products which > >>>>>> support a parent subscriber number and "companion" devices > >>>>>> (e.g., tablets) which can place a call using the MDN of > >>>>>> the parent subscriber. These are examples of where the > >>>>>> authenticity of the calling number won't necessarily mean > >>>>>> the same thing as the authenticity of a call from a single > >>>>>> subscriber with a single MDN regardless of "laxity" of > >>>>>> spoof checking. > >>>>>> > >>>>>> In another forum and anticipating calling number > >>>>>> authentication mandates from Congress and/or FCC, I > >>>>>> suggested using carrier-specific certs and encoding > >>>>>> specificity of authenticity, and calling number. This > >>>>>> provides the identity of the originating carrier, some > >>>>>> idea as to the accuracy or specificity of the calling > >>>>>> number, and validty of the calling number (assuming nonce > >>>>>> and replay issues can be addressed as reasonably suggested > >>>>>> below by Alex). > >>>>>> > >>>>>> The representation of orig-carrier and trustworthiness > >>>>>> could be as follows: > >>>>>> > >>>>>> *Regulated/mandated Carrier Class Use Case:* > >>>>>> > >>>>>> *00 - No Credentials* > >>>>>> Use case example(s): Pre-IMS, legacy circuit-switched > >>>>>> networks that don't natively support SIP or which don't > >>>>>> choose to sign calls. E.g., international carriers. > >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN > >>>>>> entirely untrustworthy. > >>>>>> > >>>>>> *01 - Carrier signed, no authentication of CgPN* > >>>>>> Use case example(s): E911 on visited network w/o roaming > >>>>>> agreement, manual roaming. > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely > >>>>>> untrustworthy > >>>>>> > >>>>>> *10 - Carrier signed, semi-authenticated CgPN* > >>>>>> Use case example(s): Number block delegated from OCN, but > >>>>>> no per-TN screen (SIP trunks). > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than > >>>>>> most trustworthy but not entirely untrustworthy. > >>>>>> > >>>>>> *11 - Carrier signed, authenticated CgPN* > >>>>>> Use case example(s): Bread-and-butter 95%+ of calls from > >>>>>> subscriber lines (IMS-based and otherwise). > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most > >>>>>> trustworthy > >>>>>> > >>>>>> *Public Use Case:* > >>>>>> > >>>>>> Undefined but assumed to use public or commercially > >>>>>> available authentication services resources. e.g., > >>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. > >>>>>> Could/would pass credentials down to SIP-aware devices > >>>>>> which would process them according to the rules of the > >>>>>> Public Class application(s). > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 9:02 AM > >>>>>> *To:* Alex Bobotek >>>>>> > >>>>>> > > >>>>>> *Cc:* stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> There are reasonable circumstances where a party placing a > >>>>>> call is not the authorized entity assigned the telephone > >>>>>> number used in From/PAI, and in such circumstances the > >>>>>> service provider servicing the entity placing the call may > >>>>>> or may not be the same as the service provider serving the > >>>>>> entity that is assigned the TN. In all such cases, the > >>>>>> entity that is assigned the TN explicitly authorizes calls > >>>>>> placed using it's TN. The design accommodates such use > >>>>>> cases. It's not a blanket authorization without > >>>>>> authentication. We're not aware of any cases where there > >>>>>> is an actual requirement for legitimate calling without > >>>>>> explicit authorization from the assigned entity, although > >>>>>> we certainly are aware that various parts of various > >>>>>> service providers don't bother to check. At this point, at > >>>>>> least in some countries, there is a realization that the > >>>>>> laxity of allowing unchecked spoofing is not acceptable > >>>>>> any more. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > >>>>>> >>>>>> > wrote: > >>>>>> > >>>>>> 1. Permit authorization without authentication > >>>>>> In the current telephony network practice, some > >>>>>> service provider implementations choose not to > >>>>>> authenticate identity, but simply facilitate the use > >>>>>> of an arbitrary or selected user-provided identity. > >>>>>> Are there legitimate use cases for this? Has anyone > >>>>>> established that there are not? How can the industry > >>>>>> reasonably expect to end this (often bad) practice? > >>>>>> If it can't be ended, there's value in at least > >>>>>> identifying the originating service provider > >>>>>> (i.e., the signer/authorizer). Given the prevalence > >>>>>> of abuse using telephone numbers assigned to a > >>>>>> sometimes-anonymous abuser, it becomes critically > >>>>>> important to identify the service provider(s) closest > >>>>>> to the abuser. Based on the assumption that it's > >>>>>> better to ID service providers than unreasonably > >>>>>> expect a ban of the use of unauthenticated (and > >>>>>> therefore unsigned) SIP requests, STIR signing should > >>>>>> support authorization without authentication. The > >>>>>> practice of authorizing unauthenticated use exists, > >>>>>> and there is benefit to signing in these cases > >>>>>> (service provider identification). The language of > >>>>>> the ID should permit this use. 4474bis-10 should NOT > >>>>>> require or assume that that authentication will > >>>>>> precede authorization. Of course there may be other > >>>>>> use cases where signing includes authentication and > >>>>>> may not include a specific service provider's > >>>>>> authorization. > >>>>>> > >>>>>> > >>>>>> 2. Improve replay prevention > >>>>>> Proximate replay is possible while complying with this > >>>>>> spec. First, one or more proximate (e.g., within 60 > >>>>>> seconds) SIP requests using the same token are legal > >>>>>> and subject to replay in many cases. An SDP body's > >>>>>> mky may not be present and if present its use is > >>>>>> optional. Some sort of mandatory new or existing > >>>>>> signed sequence, random # or request ID (e.g., Call-ID > >>>>>> or CSeq) and a 1-time use policy on the receiving end > >>>>>> of the request (e.g., tokens only good for 1 > >>>>>> use) could prevent replay. Different methods (e.g., > >>>>>> INVITE vs MESSAGE) might be handled by different > >>>>>> receiving infrastructure, and therefore difficulties > >>>>>> with 'it's been used already' coordination allow a > >>>>>> faked MESSAGE based on a captured request. This might > >>>>>> include an mkey from a captured INVITE. So it may be > >>>>>> possible to DOS, spam or text-bomb a recipient using a > >>>>>> captured identity. While large-scale or distributed > >>>>>> implementations may make the enforcement difficult, > >>>>>> there is little cost to signing and decoding a method > >>>>>> and possibly a numeric ID. Some sort of '1-use' > >>>>>> practice should at least be discussed while perhaps > >>>>>> not required. > >>>>>> > >>>>>> > >>>>>> Specific markup suggestions: > >>>>>> > >>>>>> > >>>>>> NITS > >>>>>> > >>>>>> > >>>>>> The verifier MUST inspect any optional "ppt" > >>>>>> parameter appearing *in*the > >>>>>> > >>>>>> Identity request. If no "ppt" parameter is > >>>>>> present, then the > >>>>>> > >>>>>> verifier proceeds normally below. If a "ppt" > >>>>>> parameter value is > >>>>>> > >>>>>> present, and the verifier does not support it, > >>>>>> it MUST ignore the > >>>>>> > >>>>>> Identity header. If a supported "ppt" parameter > >>>>>> value is present, > >>>>>> > >>>>>> the verifier follows the procedures below, > >>>>>> including the variations > >>>>>> > >>>>>> described in Step 5. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> 3 > >>>>>> . > >>>>>> Background > >>>>>> > >>>>>> [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> Per [RFC7340 > >>>>>> ], problems such as > >>>>>> robocalling, voicemail hacking, and > >>>>>> > >>>>>> swatting are enabled by an attacker's ability to > >>>>>> impersonate someone > >>>>>> > >>>>>> else. The secure operation of most SIP > >>>>>> applications and services > >>>>>> > >>>>>> depends on authenticating and/or authorizing the > >>>>>> source of communications as it is > >>>>>> > >>>>>> represented in a SIP request. > >>>>>> > >>>>>> > >>>>>> > >>>>>> This identity architecture for SIP depends on > >>>>>> includes provisions for a logical > >>>>>> > >>>>>> "authentication service" which validates caller > >>>>>> identity at or near origination. outgoing > >>>>>> requests. An > >>>>>> > >>>>>> authentication service may be implemented either > >>>>>> as part of a user > >>>>>> > >>>>>> agent or as a proxy server; typically, it is a > >>>>>> component of a network > >>>>>> > >>>>>> intermediary like a proxy to which originating > >>>>>> user agents send > >>>>>> > >>>>>> unsigned requests. Once the sender of the > >>>>>> message has been > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> This document specifies a means of sharing a > >>>>>> cryptographic assurance > >>>>>> > >>>>>> of authenticity of and/or authorization to use > >>>>>> end-user SIP identity in an interdomain or intradomain context. > >>>>>> > >>>>>> It relies on the authentication service > >>>>>> constructing tokens based on [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> To maximize end-to-end security, it is typically > >>>>>> obviously > >>>>>> > >>>>>> preferable for end-users to acquire their own > >>>>>> credentials; if they > >>>>>> > >>>>>> do, their user agents can act as authentication > >>>>>> services. However, > >>>>>> > >>>>>> for some deployments, [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> Regards, > >>>>>> > >>>>>> Alex > >>>>>> * * > >>>>>> *Alex Bobotek* > >>>>>> > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> ----------------------------------------------------------------- > >>>>>> ------- > >>>>>> > >>>>>> This e-mail may contain Sprint proprietary information > >>>>>> intended for the sole use of the recipient(s). Any use by > >>>>>> others is prohibited. If you are not the intended > >>>>>> recipient, please contact the sender and delete all copies > >>>>>> of the message. > >>>>> > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> stir mailing list > >>>>> stir@ietf.org > >>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>> > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>> > >> > >> _______________________________________________ > >> stir mailing list > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir > > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > > > ________________________________ > > This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. > From nobody Fri Aug 5 10:04:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86B5712D50B for ; Fri, 5 Aug 2016 10:04:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v08E_WnGATAF for ; Fri, 5 Aug 2016 10:04:19 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0105.outbound.protection.outlook.com [104.47.40.105]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8AD112D14D for ; Fri, 5 Aug 2016 10:04:18 -0700 (PDT) Received: from BL2FFO11OLC016.protection.gbl (10.173.160.33) by BL2FFO11HUB022.protection.gbl (10.173.161.46) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Fri, 5 Aug 2016 17:04:13 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BL2FFO11OLC016.mail.protection.outlook.com (10.173.160.82) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Fri, 5 Aug 2016 17:04:13 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u75Gq1bO027577; Fri, 5 Aug 2016 13:04:12 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24gns3wbwq-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 05 Aug 2016 13:04:12 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 5 Aug 2016 12:04:11 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Fri, 5 Aug 2016 12:04:11 -0500 From: "Gorman, Pierce A [CTO]" To: Paul Kyzivat , Richard Shockey , "Rosbotham, Paul, Vodafone UK" , Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA6eNtAgABzN4D//6ynIA== Date: Fri, 5 Aug 2016 17:04:10 +0000 Message-ID: <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> In-Reply-To: <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(377454003)(24454002)(199003)(13464003)(189002)(2900100001)(6116002)(93886004)(5890100001)(5250100002)(2950100001)(102836003)(3846002)(106116001)(2906002)(86362001)(4326007)(2171001)(87936001)(19580405001)(11100500001)(108616004)(68736007)(50986999)(23676002)(189998001)(54356999)(76176999)(106466001)(47776003)(15975445007)(33646002)(97736004)(5001770100001)(50466002)(92566002)(19580395003)(81166006)(81156014)(7696003)(7736002)(8936002)(8676002)(7846002)(305945005)(356003)(586003)(8666005)(24736003)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2FFO11HUB022; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11OLC016; 1:Z1WacnFr1kNSrYvbJOLH+QxR2OqGMtM7DYE8CKKgA4bf20bHCoo3wNUNjI5WPIAy1eyWaVaCCKfgjyGNu0hiQCw6jpZEZnWe86wT6LBV7fFc9T1gwTAUR7cMvIo8wH0rLXaKG0JIhfVpN8D1ltNobgG4wzBq7cW1cFliMPk16agMq4jZLGgfSwUf6EkxsDl1kRNWRFlHdifYcLGyxMKI9nQ64KLlpixmH/f5D86sX2PlsllHHg/tP5kU7mcOJKByC+y9NMO3ikovkR5qd/mibQJM6hBywAwczNXAzmD/6ni2toblX5sz7aHNs85DkT+2pqiIsM8BakTrYHbbDWf4JixmwNstrpRHhaQG9X8MFYLBONQZmW+9q3MGdAEGQ3Jn2Fo/XeqGW+MiG7a98zc6igv8hoZsuaekHzj6iqFSMpH7M/n0emzSICgR2N2ITegebDhnnC26ISZSoKnaxuXDUCMVcDxa4UEgZs12MDhI0ltfxxQ/DFmMlgk6Xcx2Z9D3oXs/Iv53u9M77EPon0dh6ThaDYHlvXnLvIHS6sQh3i2aH4/Kxu5idm5Kobc2MUL4/xDHhqRhPkCrdSQgeIcv0A== X-MS-Office365-Filtering-Correlation-Id: 4e28cdda-8b9c-4e23-2832-08d3bd52868f X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB022; 2:5pA7BYCxSmg9v++blEblNAcEDUG8pVBd5eWoPI1A41bqzatORmtV1bSl9WWMUgtIqWsltkknVuiVQw4SIgsVNItU+drLQ3yHfPuoeS5fLS4t/d5KMrnXH1JQF+CR+gCtlFix/WjE/44tzw9wsccEQXPxiCgalognkdyhJG8pnxYVD7WXyN1EYilehX3RTU7x; 3:GR7IWDDzpMbIe9I1lF0Nes4Ldnc0ldZOzkSiA1/qmw88J4HNbrOnkKBrGZU55Pr8U5P7xCA0TCHN7ESzybA0B1nQqBR3xniOX/9CjfjSgRu9fOBBwVfDEjutvC0qn9yJmdiIMt3IT8Po2vGg6Ds9IbZGJKRMUp8EjkCCmKfdi/rGK9ozKKF6KvaEAUD3YO4vDz9OX1tzVGHzT2EoG5RQjdDUyICT8AffT56wyIMc9IwjECP8eSTkhkbE0bylStVsLFxt/w9SyuKMqoLIt4CX5g==; 25:yyRxSvJaJlVCyfrE7pE0nf0qsmtwClMk08nBjAduVlyN2eBpqMY3GlF+qmOffRHy0NxyvXD+iAp/sWmlv+p5+B8eIPcwHu7oKlc01Fdzx1Ig+aQKXkj+cLH7iEWjIwcW62Sqj8NEfZ67v93t+dxatF2ChUAyhC3aQbUYUZwnSmm0Tn1BI8G95FDKGBt6euXYxJ7owL8ZWxdsCrEeNApECgdjXImqmBzbRapGDqBpOrICUyC5MJwXKtwsVpU6OLZjC/J8ZkqrGr7rjcZffhud7t01Ku8nsAoAGgVB9OEHUAXLb+ZKmt5JF5AFHLGJxQAzEHrwIODE5OaF3Tpfm2cXnOYLfpObYLqHbhC//9AgsPzISEnQtzfW2LRIu21N+kQthMXHINRFNJ2upnB6cTaAHIqu1UA/RdkFH5Dp7X7BMwMzpUheYMPj2QFhHDoIxuS8 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BL2FFO11HUB022; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB022; 31:FmY6xVGncF0RQMXWhmTZe4KtLpPx7G1Mr2Q/Uem6OoVGU9hezWDNPmI81oKscFDHM24cqND58YEWyGXmXqO0oDq4dNCHN9YUxC0b9nxIcNaufYgKt2Uw0t0UhUJTD7Pky4CnWJR/911U3yAWepfVoIg5ZUvnDLZVw0KVLHUZwpOnH/WwCTMi9ZwL+ce1RnpG6r698QP4bi1mbSilHeOR74h69Yw/QxMLtaJBEXORnJ4=; 20:vUE8zQIsuHcDoJeEAwxBdJbSopgk6JzzRMX/4E79Pu4qqpMb8xH9I+L1QvuB1gNrFWNc9nF7VfA43sL7qda22yYjtR4D145LA99xzjRzZx7GzhIg+FtuWfKl0azJFJdRCEC4CXxQs4DtPS31SY4fhkBq9TPQFYsYP2N82NenA8dvm7s5CRD1qLgn4AgwQN/ZFzKY5cZnKajKiVijKWB8cyda8r2DTyQiID3CP7aGugAyK8fxR86pNkzkXghopDLRl1r7/hLCAuXaKMXjvYxFkYobrh0JE3SRP5RxkduWvNbiqdcNbUzUbKKtw5WSViOii7CugO/ikQUUWksxA2OqeqDIjx5QssIyLuKRuCMLEHWPsk1r1cUTuWVHwWWL3mQDVVCfyoafvCGQyvbBsay65s8fWRPZlA5AVkmSAHYq8lo= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(13018025)(13017025)(13024025)(13023025)(13015025)(5005006)(8121501046)(3002001)(10201501046)(6055026); SRVR:BL2FFO11HUB022; BCL:0; PCL:0; RULEID:; SRVR:BL2FFO11HUB022; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB022; 4:FvNRbIm3827lHeow/7ExDe7okXlAHJHWlPvI+uiwIMVEGoPum26iDTbsJCxwzP/5upPTwsKPpFswafvUCIXjyi8h90VsyXBGchAMWHV21RaGfxOuXfW8xys1dXFDnIsifTzNrqDY/J09BWRkWXyjr/RJfHV78qV3rVI4x7bSW5xLCsSaOSHYuZtVRgCqXUUaxmfs3JPo9XDUu9MXa1P1ZakZNgw2A6oePHFFA2QPI3ShqaXMjogefRaUwzIwhtYPhs8Yatn8sOn/3pAQO4RFxGm/8JPI4qKyTlyeJ/ESsddXLc2FPk64ZPM9T/mpREQ33m6k1GEu/h9KuMQmhO3g99PKMhiwRPyhOsD2JMNffLirwn5uE0mx63J/eVgPoILlTK6hIzxuuq0Mxyx2aabY7dC52xjNGG1Hh3MuaVgAkKpxyErQe9EO7awea7athc9cp9oRpfHjJnQgFxM4PhJEuE6qnPXzqbjzMtd/H4Q0JaNmMu4U0DKCWBwoArtElUOSnbla65ZFdQfwEamj/xVHxfvuWIAsBUoJi8zo+9tDivFI85ZJUPHGonXSVkcLlhUzEMsHBcAfLhvMG2jkE/eSbROPK2VsdEoG/D7Y2qQZLNfCzzx1wdDp2SMmQ0j9eViXx31DT7jIgLIpXuugi54MpXW3WJmp1ZF8eFa+Q/h0aps= X-Forefront-PRVS: 0025434D2D X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTDJGRk8xMUhVQjAyMjsyMzp0MlBhTjlpNURQaGRNYkh2NlUyUDBjZS9n?= =?utf-8?B?b0ZtYktDRWJVY3pOak1FLzh6S2hhUEdEb0Jmb0x0QmZwbGswenpaRlpWNHpO?= =?utf-8?B?Y2pWRmNVYW0zZmZUeGVvMk9lR2ZINGVmdGp0RG5ZYVVZdVNNaFFDbW9CeFdr?= =?utf-8?B?ZTBqZzJaMGdaWUVFcUNJdkNEaWV6TmxycTRNWHc5UVN3MEo4N1FCbTRwRGZ2?= =?utf-8?B?WnhCWFBnWGxrbUNhbnUwRVl5ck1PNDIxY2ZWTWhaUnh3U0xsVHBMejdzY1FI?= =?utf-8?B?bjBmVCs2WUtXNSt4dWpLVkhsZHR0VDVxeHF1NEtTWFRsUTZaaTNYWU81cHRI?= =?utf-8?B?VHF2RXk3U0NqdzYxRys5U25WNEhVZ2RJUmRtOG05RXl0N3RubGptY3FMcURD?= =?utf-8?B?dGRvMlFOSjAxQzNKanpOT3NuMktRU2dNWHBuSkZQamxvTWNKNHk5c3dMMTlF?= =?utf-8?B?dWJFMGpEVTRaYVlFR28zeWJBRWNnMWNhSElDUEcwWUlqVGd0Q1hEc21BNk5T?= =?utf-8?B?OHRuSWVLajhtUTF1SkIyUHBiVjJOb01PSlQ3eWdaODhzbmhqZklSdE41cldj?= =?utf-8?B?KzcxcFd2ZElmRTBjTnhFK3RUWllldFBWZ0kzVC9vV1U2dGE5MGVGc0tyczBL?= =?utf-8?B?MlZyeXhQcXVCSlhrMzJkdFpLUkhmTW5UalJUYldiK29JM2ZJb1BFM1BqMXor?= =?utf-8?B?aU9ZbjhQTHJSaG1tMlYyb2Zpb29aM0FwU0ZNNmpWTkd5d2MvRFczNkF3Wlhp?= =?utf-8?B?RHBqZTA3WDRIOTMrZkJGUHE3WXh5RVNLTWw3aDJ4QWZMQUZaaDR2QjVRTFNW?= =?utf-8?B?aWx1V2tURXFoRWV6Y1VJQVVUZnNHZ0hjaURhbytWZy9qbmpqSU5hUEdBVkN3?= =?utf-8?B?TGEwOFNPL3lxTUx2QVlTdCt4Rm9hL1NaQ3FUZ0dsTFArVU1vOXdLcmpGUG1a?= =?utf-8?B?WHYvYmVRWG5DZFpyanl1SDBFK3pDU0R2WTNmRFhjK0FQNk1wL1NuM2hoTWQz?= =?utf-8?B?MVFPN3FNaVQzbTdhUllUeDlpNFkzdzd6RWpEWkd4QkZxai82M04zVjgxTDhZ?= =?utf-8?B?aXEzeTRaQlRmMWlGdEJmamc2TnBtaVM3UElBYWdBd05ZOUEyZlQvOSt1bW5h?= =?utf-8?B?MU1NU1pSbVZWWnA0NFFwTzl2WDZYRXNZM1ZseThwM1JxaFFWc3Zza09ockk5?= =?utf-8?B?b0E5cUhaaDBPU2dwd0dLdjhFb2pXN3JWLzNvRUVnSHR3T2c2VXdKUlg4TDhK?= =?utf-8?B?dU9HczZRdXFRRmhxVXpBa25WQ2VNdTE1NlAvbTRxbXZXV3ZySVl3YStwK2ha?= =?utf-8?B?VWV0TTg1aFFVSW40bE14Vlp4R29XVk03U2p1UDBYWEZBVXJUMFUrZTRUUWNr?= =?utf-8?B?MVh1UW5vZjZVWXJVZkxBN0VSb3N5ZDJrRjZyZHdhVnpjZFVjUzVYRGY5ZE1U?= =?utf-8?B?NlNVbFBkSlVHTlRBTVljUFhVODd3NGpsTGlnaWgxYkVCc3kzNUlNN3V4eEF1?= =?utf-8?B?UE1vZlpDb0daODd1SU9RclBuaTBodC9SUWFYekMvWDRrdXpBV1BFUWNVQlhn?= =?utf-8?B?QTY5YitUMEV6ZWttK05vZSthdzlTcC9IM1o4Zm5yZURpaDJOYmNSeHhhN3Vq?= =?utf-8?B?bytPdU1kdzl1eHJxNytVamhtTzF2YzBYT0hDdGlRUlJ1RklxaVZ6V1ppWHMr?= =?utf-8?B?N2hLN1ZVZXRJejJJaXFYTjl3bE1OTG4xbi8xRFF3aHZZSURqZlNDbzFJVzkz?= =?utf-8?B?Ym9mSkpIenBtNENCemF1YVJBOWZlU2U5VGVFeXgwQlVwZHZrd0NzRlBQRUhW?= =?utf-8?Q?RydmIvVdIzOjGz?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB022; 6:Iv/F0p9ckEEKu61F01Z+kuvx1FawLyJKTsU9NLiDA5T9Jh/BxIj9gA1/gpGhOmla56fCOB6hMPStwPSzIQfZcUIIM5jGcLeRi8UA2xz6t3Lz/1OtOebO1kW2PmRP6G2nm7aTXJeGO++KW3agdKy5ukBmupZCGvpTRAQlrW0DBNiYRVHVpDCU6IJ6xNnxK+xY7+PO5mfxgMbUiiMp7xyrLw5GDQx/lkkcwlP2qTDKuC3nzgk9HoKp1Nt94qc2B5nFfJHc39xZumw1Kb1stccWCbCeWsUlLGra+rOXyYK3jeIFVk6rnuUIgAGoULw4OnfaDN3LfS4QrkirrjHkGNo2Hg==; 5:H8mYOpo1j0LlnAN7K/uwGb0na/SPUIYHuugfkvHw1mbLuywR7YRVo2O/BmW267ZI9Gma2s0gSL62VJ8PWfShu8aNOgpkLOEt6rXEdtdl7Kf3f/JdsXrYD/6jpzjqn3JPY2QQ913WxoJ7oSJc7rcekQ==; 24:uCACxz/l6Qri/omSnc+842ROZYud5zEwX6P9fDyxPrnHijh8bw0jIA+9ZSSJpSJHNfHQ0xzqgmyzpcR1+IIxgt3KG0TOBm4PdRn9n+WetJE=; 7:D4V4dEu/5a48cVhe8I7IA4U8l1SYyk3MpkOoUiW9HaGlGhyFbI97AOphL+sTZ5bFA8uI0Iyxv7WKbY8ZR2r+/p33dl1EWmPnN7MVwUeN5EOzF8O0WL+aG+Vh+zAyqxIh5RWqEdXM52vpYyA/tqP0C95LrdAFZnpSJXGqSLz/bAXYbMGaVu20Sx6vEP+r7nqg2Ltb+0byEc9qKZl8UNJYGWFXD8tq117jlh8LjDVa0nX5I1PcwncaB5bxcsTRBcbe SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Aug 2016 17:04:13.1244 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2FFO11HUB022 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 17:04:23 -0000 V2hpY2ggaGVhZGVyIHRoZSBjYXJyaWVyIGNob29zZXMgdG8gZGlzcGxheSBpcyBtb290IGlmIHRo ZSBoZWFkZXIgaXMgc3RyaXBwZWQgYmV0d2VlbiBjYXJyaWVycyBhcyBwZXIgYXQgbGVhc3Qgb25l IHN0YW5kYXJkLiAgSSB0aGluayBQYXVsIFJvc2JvdGhhbSdzIG9ic2VydmF0aW9uIHdlJ3JlIGxp a2VseSB0byBlbmNvdW50ZXIgInNvbWUgaW50ZXJlc3RpbmcgaW50ZXJ3b3JraW5nIGNoYWxsZW5n ZXMiIHdhcyBwZXJoYXBzIHRoZSB1bmRlcnN0YXRlbWVudCBvZiB0aGUgeWVhci4NCg0KUGllcmNl DQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBQYXVsIEt5eml2YXQgW21haWx0 bzpwa3l6aXZhdEBhbHVtLm1pdC5lZHVdIA0KU2VudDogQXVndXN0IDA1LCAyMDE2IDExOjU4IEFN DQpUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPjsg UmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBSb3Nib3RoYW0sIFBhdWwsIFZv ZGFmb25lIFVLIDxwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+OyBCcmlhbiBSb3NlbiA8YnJA YnJpYW5yb3Nlbi5uZXQ+DQpDYzogc3RpckBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtzdGlyXSBT VElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCg0KSWYgUEFJIGlzIHByZXNlbnQgYW5kIHNpZ25lZCwg YW5kIEZyb20gaXMgYWxzbyBzaWduZWQsIEkgd291bGQgZXhwZWN0IGl0IHRvIGJlIHVwIHRvIHRo ZSBVQSB0byBkZWNpZGUgd2hhdCB0byBkaXNwbGF5LCBub3QgdGhlIGNhcnJpZXIuDQoNCk9mIGNv dXJzZSB0aGlzIHdpbGwgd29yayBkaWZmZXJlbnRseSBpZiB0aGVyZSBpcyBhIGRpZmZlcmVudCBz aWduYWxpbmcgcmVnaW1lIGJldHdlZW4gdGhlIGNhcnJpZXIgYW5kIHRoZSB1c2VyIGRldmljZSAo ZS5nLiBibGFjayBwaG9uZSkuDQoNCglUaGFua3MsDQoJUGF1bA0KDQpPbiA4LzUvMTYgMTE6MjYg QU0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gd3JvdGU6DQo+IFAtQXNzZXJ0ZWQtSWRlbnRpdHkg aXMgc3VwcG9zZWQgdG8gb3BlcmF0ZSAiYW1vbmcgdHJ1c3RlZCBTSVAgZW50aXRpZXMiIGFuZCB0 aGVyZWZvcmUgc29tZSBzcGVjaWZpY2F0aW9ucyAoZS5nLiwgM0dQUCBUUyAyNC42MDcpIGFzc3Vt ZSBQLUFzc2VydGVkLUlkZW50aXR5IGlzIHN0cmlwcGVkIGJ5IGJvcmRlciBjb250cm9sbGVyIGZ1 bmN0aW9ucyBhbmQgaXMgbm90IHRvIGJlIHVzZWQgaW4gaW50ZXItY2FycmllciBpbnRlci1jb25u ZWN0aW9uIChhbHRob3VnaCBpdCBjb21tb25seSBzaG93cyB1cCBhbnl3YXkpLiAgTXkgb3Bpbmlv biBpcyB0aGUgIkZyb20iIGhlYWRlciBpcyBsaWtlbHkgdXNlZCBtb3JlIG9mdGVuIGZvciBwcmVz ZW50YXRpb24uDQo+DQo+IFBpZXJjZQ0KPg0KPg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LQ0KPiBGcm9tOiBSaWNoYXJkIFNob2NrZXkgW21haWx0bzpyaWNoYXJkQHNob2NrZXkudXNdDQo+ IFNlbnQ6IEF1Z3VzdCAwNSwgMjAxNiA5OjM3IEFNDQo+IFRvOiBSb3Nib3RoYW0sIFBhdWwsIFZv ZGFmb25lIFVLIDxwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+OyBQYXVsIA0KPiBLeXppdmF0 IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+OyBCcmlhbiBSb3NlbiA8YnJAYnJpYW5yb3Nlbi5uZXQ+ DQo+IENjOiBzdGlyQGlldGYub3JnDQo+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0Ymlz LTEwIGNvbW1lbnRzDQo+DQo+DQo+IEh1bW0gdGhpcyBpcyBnZXR0aW5nIGludGVyZXN0aW5nLiAg SXRzIG15IHVuZGVyc3RhbmRpbmcgdGhhdCB0aGUgZGlzcGxheSBudW1iZXIgYWthIOKAnHByZXNl bnRhdGlvbiBudW1iZXLigJ0gaW4gdGhlIFVTIGNvbnRleHQgaXMgdGhlIG9uZSBjYXJyaWVkIGlu IHRoZSBQQUkuICBNYXJ0aW4sIFBpZXJjZT8NCj4NCj4NCj4NCj4NCj4gT24gOC81LzE2LCAzOjQ2 IEFNLCAic3RpciBvbiBiZWhhbGYgb2YgUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSyIgPHN0 aXItYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgcGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUu Y29tPiB3cm90ZToNCj4NCj4gICAgIEp1bXBpbmcgaW4gbm93IHRoYXQgd2UncmUgb24gRXVyb3Bl YW4gd29ya2luZyB0aW1lLCArMSBvbiBQYXVsJ3Mgb2JzZXJ2YXRpb24uDQo+DQo+ICAgICBIZXJl IGluIHRoZSBVSywgd2UndmUgZ290IDIgbnVtYmVycyBjYXJyaWVkIGFzIGNhbGxpbmcgbGluZSBJ RHMuLi4ub25lICh3ZSB0ZXJtIHRoZSBOZXR3b3JrIE51bWJlciwgY2FycmllZCBpbiBQQUlEKSB1 bmlxdWVseSBpZGVudGlmaWVzIHRoZSBsaW5lLCB0aGUgb3RoZXIgKHdlIHRlcm0gUHJlc2VudGF0 aW9uIE51bWJlciwgY2FycmllZCBpbiBGcm9tKSBpcyB1c2VkIGZvciBkaXNwbGF5IHB1cnBvc2Vz Lg0KPg0KPiAgICAgT25seSB0aGUgY2FycmllciBoYXMgdGhlIGF1dGhvcml0eSB0byBzZXQgdGhl IE5ldHdvcmsgTnVtYmVyIHNvIG9ubHkgdGhleSBjb3VsZCBzaWduIGl0Lg0KPg0KPiAgICAgQnV0 IC0gc3ViamVjdCB0byByZWd1bGF0b3J5IHJlc3RyaWN0aW9ucyB3aGljaCBhcmUgd2VsbCBkb2N1 bWVudGVkIC0gdGhlIG51bWJlciBzZW50IGZvciBkaXNwbGF5IHB1cnBvc2VzIGJlbG9uZ3MgdG8g dGhlIGN1c3RvbWVyLiAgRm9yIGJsdWUtY2hpcCBjdXN0b21lcnMsIEkgY2FuIGFsbG93IHRoZW0g dG8gc2VuZCB0aGVpciBQcmVzZW50YXRpb24gTnVtYmVycyBpbnRvIHRoZSBuZXR3b3JrLCBhbmQg Y2FuJ3QgcmVhZGlseSBjaGVjayBhdCBhIG5ldHdvcmsgbGV2ZWwgdGhhdCB0aGV5J3JlIHRoZWly cyAoSSBkbyBoYXZlIGNvbnRyYWN0dWFsIHNhZmVndWFyZHMpLiAgVGhlIG51bWJlciBtYXkgaGF2 ZSBiZWVuIGFsbG9jYXRlZCBieSBtZSwgb3IgY291bGQgYmUgYWxsb2NhdGVkIGJ5IGEgdGhpcmQg cGFydHkgcHJvdmlkZXIuICBJZiBpdCdzIGEgY2FsbC1jZW50cmUgdGhleSdsbCBiZSBtYWtpbmcg b3V0Ym91bmQgY2FsbHMgZm9yIGxvdHMgb2YgZGlmZmVyZW50IGN1c3RvbWVycyB3aGljaCB3aWxs IGNoYW5nZSBvbiBkYXktYnktZGF5IGJhc2lzLiAgVGhpcyBpcyBidXNpbmVzcyBhcyB1c3VhbC4g IEkgZG9uJ3QgbGlrZSB0aGUgdGVybSAiYXV0aG9yaXNlZCBzcG9vZmluZyIgYmVjYXVzZSBpdCBp bXBsaWVzIHRoYXQgdGhlIENMSSBpcyBpbiBzb21lIHdheSBiZWluZyByaWdnZWQ6IGl0J3Mgbm90 LCBpdCdzIHRoZSBjb3Jwb3JhdGUgY3VzdG9tZXIgb3IgdGhlaXIgc3ViY29udHJhY3RvciB1c2lu ZyB0aGUgbnVtYmVyIHRoYXQncyBiZWVuIGFzc2lnbmVkIChzbyBpbiBpbnRlcm5ldCB0ZXJtcyBk ZWxlZ2F0ZWQpIHRvIHRoZW0gdmlhIGEgY2hhaW4gb2YgdHJ1c3QgZnJvbSB0aGUgcmVndWxhdG9y Lg0KPg0KPiAgICAgV2hhdCBJIHdhbnQgaXMgdGhlIGFiaWxpdHkgZm9yIGN1c3RvbWVycyB0byB1 c2UgdGhlaXIgY3JlZGVudGlhbHMgDQo+IHRvIHNpZ24gdGhlIENMSXMgdGhleSBzZW5kIG1lIHNv IHRoYXQgYXQgdGhlIHRlcm1pbmF0aW5nIGVuZCBpdCBjYW4gYmUgDQo+IGNoZWNrZWQgKG9yIGlu ZGVlZCBzb21ld2hlcmUgZW4tcm91dGUgaWYgdGhhdCdzIHRoZSBidXNpbmVzcyBtb2RlbCkuICAN Cj4gSSBjYW4gYW5kIHdvdWxkIHNpZ24gZm9yIGN1c3RvbWVycyBvbiBteSBtb2JpbGUgYnVzaW5l c3Mgc2luY2UgSSdtIA0KPiBkcml2aW5nIHdoYXQgbnVtYmVyIGlzIHByZXNlbnRlZCwgYnV0IHRo YXQncyBieS10aGUtYnkgYmVjYXVzZSB0aGV5IA0KPiBhcmVuJ3QgdGhlIG9uZXMgd2hvIGdlbmVy YXRlIG1pbGxpb25zIG9mIG51aXNhbmNlIGNhbGxzLiAgSWYgdGhlIA0KPiBzaWduaW5nIG9ubHkg b2NjdXJzIGF0IHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyIGxldmVsIGZvciANCj4gY29ycG9yYXRl L2NhbGwtY2VudHJlIGN1c3RvbWVycyB0aGF0J3Mgbm8gdXNlIGJlY2F1c2UgSSdtIG5vdCBpbiBh IA0KPiBwb3NpdGlvbiB0byBkbyB0aGF0IGZvciB0aGVzZSB0eXBlIG9mIGN1c3RvbWVycy4uLmFu ZCB0aGUgd2hvbGUgc3lzdGVtIA0KPiBiZWNvbWVzIGEgd2FzdGUgb2YgdGltZS4gSSdkIGFsc28g aGlnaGxpZ2h0IHRoZXJlIGFyZSBtYW55IG1vcmUgb2YgbXkgDQo+IGxhcmdlIGN1c3RvbWVycyB0 aGF0IEknZCB0cnVzdCBtb3JlIHRoYW4gYSBmYXIgZW5kIG9yaWdpbmF0aW5nIGNhcnJpZXIgDQo+ IHRoYXQgY291bGQgYmUgYW55d2hlcmUgaW4gdGhlIHdvcmxkICh0aG91Z2ggd2UgaGF2ZSBubyBz aG9ydGFnZSBvZiANCj4gc21hbGwgY2FycmllcnMgdGhhdCBJIHdvdWxkbid0IGtub3cgZnJvbSBB ZGFtIG1vcmUgbG9jYWxseSBpbiB0aGUgDQo+IFVLLi4uLikNCj4NCj4gICAgIFJlZ2FyZHMNCj4N Cj4gICAgIFBhdWwNCj4NCj4gICAgIC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+ICAgICBG cm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgUGF1 bCBLeXppdmF0DQo+ICAgICBTZW50OiAwNCBBdWd1c3QgMjAxNiAyMzoxMg0KPiAgICAgVG86IEJy aWFuIFJvc2VuDQo+ICAgICBDYzogc3RpckBpZXRmLm9yZw0KPiAgICAgU3ViamVjdDogUmU6IFtz dGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4NCj4gICAgIE9uIDgvNC8xNiA2OjAyIFBN LCBCcmlhbiBSb3NlbiB3cm90ZToNCj4gICAgID4gSSB0aGluayBpdCdzIG5vdCBhIGRlbGVnYXRp b24uICBUaGUgbW9iaWxlIHBob25lIGlzIG5vdCBiZWluZyBkZWxlZ2F0ZWQgdGhlIFROLCBpdCdz IGJlaW5nIGF1dGhvcml6ZWQgdG8gcGxhY2UgY2FsbHMgdGhhdCBhcmUgbm90IGZyb20gdGhhdCBU TiwgYnV0IGFwcGVhciB0byBiZS4NCj4gICAgID4NCj4gICAgID4gVGhlIG1lY2hhbmlzbSB0byBo YW5kbGUgdGhlIGNyZWRlbnRpYWwgaXMgZXhhY3RseSB0aGUgc2FtZSBhcyBhIGRlbGVnYXRpb24s IHNvIGlmIHlvdSB3YW50IHRvIGNhbGwgaXQgZGVsZWdhdGlvbiwgZ28gYWhlYWQsIGJ1dCBJIHBy ZWZlciB0byBjYWxsIGl0IGF1dGhvcml6ZWQgc3Bvb2ZpbmcuDQo+DQo+ICAgICBJSVVDIHRoZSBk ZWxlZ2F0aW9uIGlzIHRvIGEgcmVzcG9uc2libGUgZW50aXR5IChzb21ldGhpbmcgdGhhdCBjYW4g YmUgaGVsZCBsZWdhbGx5IGFjY291bnRhYmxlIC0gZS5nLiBhIHBlcnNvbiksIG5vdCB0byBhIGRl dmljZS4gVGhlIGVudGl0eSBjYW4gdGhlbiAidXNlIiB0aGUgY3JlZGVudGlhbCB2aWEgYW55IGRl dmljZShzKSBpdCBjaG9vc2VzLiBJbiB0aGUgY2FzZSBvZiB0aGUgbW9iaWxlLCB0aGUgZGV2aWNl IHRoZW4gYmVjb21lcyBhIHR3by1saW5lIHBob25lLg0KPg0KPiAgICAgVGhhbmtzLA0KPiAgICAg UGF1bA0KPg0KPiAgICAgPiBCcmlhbg0KPiAgICAgPg0KPiAgICAgPj4gT24gQXVnIDQsIDIwMTYs IGF0IDU6NTEgUE0sIFBhdWwgS3l6aXZhdCA8cGt5eml2YXRAYWx1bS5taXQuZWR1PiB3cm90ZToN Cj4gICAgID4+DQo+ICAgICA+PiBPbiA4LzQvMTYgNTo0MyBQTSwgQnJpYW4gUm9zZW4gd3JvdGU6 DQo+ICAgICA+Pj4gSW4gbXkgamFyZ29uIGFuICJhdXRob3JpemVkIHNwb29mZXIiIGlzIHRoZSBk b2N0b3Igd2hvIGlzIGNhbGxpbmcNCj4gICAgID4+PiBmcm9tIGhpcyBtb2JpbGUsIGJ1dCBzZW5k aW5nIHRoZSBUTiBvZiBoaXMgb2ZmaWNlIHBob25lIGFzIGNhbGxpbmcgcGFydHkuDQo+ICAgICA+ Pj4gVGhlIGRlbGVnYXRpb24gdG8gaGlzIG9mZmljZSBwaG9uZSB3YXMgbWFkZSBieSBoaXMgbGFu ZGxpbmUgY2Fycmllcg0KPiAgICAgPj4+IHRvIGhpbS4gIEhlIHRoZW4gY3JlYXRlcyBhbm90aGVy IGNyZWRlbnRpYWwsIHdoaWNoIGhlIHNpZ25zIHdpdGggaGlzDQo+ICAgICA+Pj4gb2ZmaWNlIHBo b25lIGNyZWRlbnRpYWwgdGhhdCBhdXRob3JpemVzIGhpcyBtb2JpbGUgdG8gc2VuZCBjYWxscw0K PiAgICAgPj4+IGZyb20gaGlzIG9mZmljZSBudW1iZXIuICBIZSBpcyBzcG9vZmluZyAoYmVjYXVz ZSB0aGUgY2FsbCBpcyBjb21pbmcNCj4gICAgID4+PiBmcm9tIGhpcyBtb2JpbGUncyBUTiBidXQg Y2xhaW1zIHRvIGJlIGZyb20gaGlzIG9mZmljZSksIGJ1dCBpdCdzDQo+ICAgICA+Pj4gYXV0aG9y aXplZCBzcG9vZmluZy4gIFRoZSBkb2MgY291bGQgZ2l2ZSB0aGUgY3JlZGVudGlhbCB0byBoaXMN Cj4gICAgID4+PiBtb2JpbGUgU1AgaWYgdGhleSBzaWduIG9uIGhpcyBiZWhhbGYuDQo+ICAgICA+ Pg0KPiAgICAgPj4gSSBkb24ndCB1bmRlcnN0YW5kIGhvdyB0aGF0IGlzIGRpZmZlcmVudCBmcm9t IHJlZ3VsYXIgZGVsZWdhdGlvbi4NCj4gICAgID4+DQo+ICAgICA+PiBXaGVuIGhpcyBsYW5kbGlu ZSBjYXJyaWVyIGdhdmUgaGltIGEgZGVsZWdhdGVkIGNlcnRpZmljYXRlIGZvciBoaXMgbGFuZGxp bmUgbnVtYmVyLCBoZSBzaG91bGQgYmUgYWJsZSB0byBpbnN0YWxsIHRoYXQgaW4gd2hhdGV2ZXIg ZGV2aWNlcyBoZSB3YW50cyAtIGhpcyBsYW5kbGluZSBVQSwgaGlzIG1vYmlsZSBwaG9uZSwgZXRj LiBJdCBpcyBzdGlsbCBkZWxlZ2F0ZWQgZnJvbSBoaXMgbGFuZGxpbmUgY2FycmllciwgZXZlbiB3 aGVuIHVzZWQgd2l0aCBjYWxscyB2aWEgaGlzIG1vYmlsZSBjYXJyaWVyLg0KPiAgICAgPj4NCj4g ICAgID4+IFRoYW5rcywNCj4gICAgID4+IFBhdWwNCj4gICAgID4+DQo+ICAgICA+Pj4gU29tZSBm b2xrcyBkb24ndCBsaWtlIGF0dGFjaGluZyB0aGUgInNwb29maW5nIiBsYWJlbCB0byBhIGxlZ2l0 aW1hdGUgdXNlLg0KPiAgICAgPj4+DQo+ICAgICA+Pj4gQnV0IHRoYXQncyBob3cgSSBkZXNjcmli ZSBpdC4NCj4gICAgID4+Pg0KPiAgICAgPj4+IEJyaWFuDQo+ICAgICA+Pj4NCj4gICAgID4+Pj4g T24gQXVnIDQsIDIwMTYsIGF0IDU6MzcgUE0sIFBhdWwgS3l6aXZhdCA8cGt5eml2YXRAYWx1bS5t aXQuZWR1DQo+ICAgICA+Pj4+IDxtYWlsdG86cGt5eml2YXRAYWx1bS5taXQuZWR1Pj4gd3JvdGU6 DQo+ICAgICA+Pj4+DQo+ICAgICA+Pj4+ICsxLCBidXQgd2l0aCBvbmUgcXVlc3Rpb24gYmVsb3c6 DQo+ICAgICA+Pj4+DQo+ICAgICA+Pj4+IE9uIDgvNC8xNiA1OjE0IFBNLCBCcmlhbiBSb3NlbiB3 cm90ZToNCj4gICAgID4+Pj4+IEkgdGhpbmsgYWxsIHdlIG5lZWQgaXMgdG8gaGF2ZSBjcmVkZW50 aWFscyBmb2xsb3cgdGhlIGRlbGVnYXRpb24NCj4gICAgID4+Pj4+IHBhdGgsDQo+ICAgICA+Pj4+ DQo+ICAgICA+Pj4+PiBwbHVzIHRoZSBvcHRpb24gdG8gYWRkIGFub3RoZXIgbGV2ZWwgKG5vdCBk ZWxlZ2F0aW9uKSBmb3INCj4gICAgID4+Pj4+IGF1dGhvcml6ZWQgc3Bvb2ZlcnMuDQo+ICAgICA+ Pj4+DQo+ICAgICA+Pj4+IEkgZG9uJ3QgdW5kZXJzdGFuZCAiYXV0aG9yaXplZCBzcG9vZmVycyIg aW4gdGhpcyBjb250ZXh0LCBhcw0KPiAgICAgPj4+PiBjb250cmFzdGVkIHRvICJzcG9vZmVycyIg d2hvIGhhdmUgYmVlbiBkZWxlZ2F0ZWQgdGhlaXIgYXV0aG9yaXR5Lg0KPiAgICAgPj4+Pg0KPiAg ICAgPj4+PiBUaGFua3MsDQo+ICAgICA+Pj4+IFBhdWwNCj4gICAgID4+Pj4NCj4gICAgID4+Pj4+ IEkgZG9uJ3QgdGhpbmsgaXQgbWF0dGVycyB3aG8gdGhlIGRlbGVnYXRvciBvciBkZWxlZ2F0ZWUg YXJlIGFzDQo+ICAgICA+Pj4+PiBsb25nIGFzIHRoZSBkZWxlZ2F0b3IgaXMgd2lsbGluZyB0byB0 YWtlIHRoZSBoZWF0IGZvciBkZWxlZ2F0aW5nDQo+ICAgICA+Pj4+PiB0byBzb21lb25lIHdobyBz ZW5kcyBhIGxvdCBvZiBiYWQgY2FsbHMuICBUaGV5IGNhbiBwYXNzIHRoZSBidWNrDQo+ICAgICA+ Pj4+PiAoIkkgZGVsZWdhdGVkIHRoZSBUTiB0byBoaW0sIGFuZCBub3cgSSdtIG5vdCByZXNwb25z aWJsZSIpLCBidXQNCj4gICAgID4+Pj4+IG9ubHkgaWYgdGhlIFNQIGtub3dzIHdobyB0aGV5IGRl bGVnYXRlZCB0bywgc28gYXV0aG9yaXRpZXMgY2FuDQo+ICAgICA+Pj4+PiBmb2xsb3cgdGhlIGRl bGVnYXRpb24gcGF0aC4gIFRoZXJlIGFyZSBwbGVudHkgb2YgY2VydGlmaWNhdGVkDQo+ICAgICA+ Pj4+PiBjYXJyaWVycyB3aG8gYXJlIHdpbGxpbmcgdG8gbm90IGNhcmUgd2hvIHRoZXkgZGVsZWdh dGUgdG8uICBUaGUgZmFjdCB0aGF0IHRoZXJlIGFyZSBzb21lIHdobyBkbyBkb2Vzbid0IGNoYW5n ZSBtdWNoLg0KPiAgICAgPj4+Pj4gTWFraW5nIHN0aXIgd29yayBtZWFucyBrbm93aW5nIHdobyB5 b3UgYXJlIGRlbGVnYXRpbmcgdG8sIHNvIHRoYXQNCj4gICAgID4+Pj4+IHlvdSBjYW4gcGFzcyB0 aGUgaG90IHBvdGF0by4NCj4gICAgID4+Pj4+DQo+ICAgICA+Pj4+PiBJdCdzIHBlcmZlY3RseSBy ZWFzb25hYmxlIGZvciBhIGNhcnJpZXIgdG8gYmUgYWJsZSB0byBzaWduIGZvciBhbnkNCj4gICAg ID4+Pj4+IGNhbGxzIHBsYWNlZCBvbiBpdHMgbmV0d29yayBvbiBhbnkgbnVtYmVyIGl0IGhhcyBi ZWVuIGRlbGVnYXRlZC4NCj4gICAgID4+Pj4+IElmIGl0IGRvZXMsIGl0J3MgYXNzZXJ0aW5nIHRo YXQgdGhlIGNhbGxzIGFyZSBmcm9tIHdobyB0aGV5IGFyZSBzdXBwb3NlZCB0byBiZSBmcm9tLg0K PiAgICAgPj4+Pj4gVGhhdCBzaG91bGQgYmUgc3RyYWlnaHRmb3J3YXJkLCBidXQgd2Uga25vdyBp dCdzIG5vdCBhbHdheXMsIGFuZA0KPiAgICAgPj4+Pj4gdGhhdCByZXByZXNlbnRzIHRoZSBoYXJk IHBhcnQgb2YgZGVwbG95bWVudCBpbiBteSBvcGluaW9uLiAgQnV0DQo+ICAgICA+Pj4+PiBvbmNl IHRoZXkgZGVsZWdhdGUsIHRoZXkgY2FuIGhhbmQgcmVzcG9uc2liaWxpdHkgdG8gc2lnbiB0byB0 aGUNCj4gICAgID4+Pj4+IGRlbGVnYXRlZS4gIEJ1dCwgdGhhdCBvbmx5IHdvcmtzIGlmIHRoZXkg a25vdyB3aG8gdGhleSBhcmUgZGVsZWdhdGluZyB0by4NCj4gICAgID4+Pj4+DQo+ICAgICA+Pj4+ PiBUaGUgcm9vdCBvZiB0aGUgd2hvbGUgbW9kZWwgaXMgdGhhdCB0aGVyZSBpcyBhIGZvcm1hbCBv ciBpbmZvcm1hbA0KPiAgICAgPj4+Pj4gZGVsZWdhdGlvbiBwYXRoIGZvciB0ZWxlcGhvbmUgbnVt YmVycyBpbiBldmVyeSBjb3VudHJ5LCBhbmQgd2UgY2FuDQo+ICAgICA+Pj4+PiBidWlsZCBhIGNo YWluIG9mIHRydXN0IGZyb20gdGhhdCBkZWxlZ2F0aW9uIHBhdGguICBJZiB5b3UgcHJvcG9zZQ0K PiAgICAgPj4+Pj4gdG8gYWx0ZXIgdGhhdCBtb2RlbCwgdGhlbiB3ZSBnZXQgaW50byAocG9saWN5 KSBpc3N1ZXMgb2Ygd2hpY2gNCj4gICAgID4+Pj4+IGNhcnJpZXJzL2VudGl0aWVzIHdlIHRydXN0 IGFuZCB3aGljaCB3ZSBkb24ndC4gIE91ciBtb2RlbCBpcyB0aGF0DQo+ICAgICA+Pj4+PiB5b3Ug a25vdyB3aG8geW91IGRlbGVnYXRlIHRvLCBhbmQgb25jZSB5b3UgZG8gdGhhdCBkZWxlZ2F0aW9u LCBpdCdzIHRoZWlyIHByb2JsZW0uDQo+ICAgICA+Pj4+PiBUaGF0J3MgcHJldHR5IGFwcGVhbGlu ZyBJIHRoaW5rLCBldmVuIGlmIGl0J3MgYSBjaGFuZ2UgaW4gc29tZQ0KPiAgICAgPj4+Pj4gYnVz aW5lc3MgcHJhY3RpY2VzLg0KPiAgICAgPj4+Pj4NCj4gICAgID4+Pj4+IFRoZSBtZWNoYW5pc20g aXMgY2hhaW5pbmcgY3JlZGVudGlhbHMgaW4gYSBmb3JtIG9mIGEgUEtJIGFuZA0KPiAgICAgPj4+ Pj4gaGF2aW5nIGEgd2F5IHRvIGtub3cgd2hpY2ggVE5zIGFyZSBjb3ZlcmVkIGJ5IGEgY3JlZGVu dGlhbC4NCj4gICAgID4+Pj4+IFRoYXQncyB3aGF0IHdlIGhhdmUsIGFuZCBJJ20gbG9hdGggdG8g Y2hhbmdlIGl0Lg0KPiAgICAgPj4+Pj4NCj4gICAgID4+Pj4+IEJyaWFuDQo+ICAgICA+Pj4+Pg0K PiAgICAgPj4+Pj4NCj4gICAgID4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNDo1MyBQTSwgR29y bWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPiAgICAgPj4+Pj4+IDxQaWVyY2UuR29ybWFuQHNwcmludC5j b20gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+ICAgICA+Pj4+Pj4gPG1haWx0 bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPiAgICAgPj4+Pj4+IHdyb3RlOg0KPiAgICAg Pj4+Pj4+DQo+ICAgICA+Pj4+Pj4gT0ssIHlvdSB0YWxrZWQgbWUgaW50byBpbmR1bGdpbmcgaW4g b25lIG1vcmUgbWVzc2FnZSBvbiBwb2xpY3kNCj4gICAgID4+Pj4+PiBhbmQgdXNlIGNhc2VzLg0K PiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gSSBhZ3JlZSB0aGF0IHRoZSBTVElSL1BBU1Nwb3JU IG1lY2hhbmlzbXMgY291bGQgYmUgZGVwbG95ZWQgb24NCj4gICAgID4+Pj4+PiBpbmRpdmlkdWFs IGRldmljZXMgYXMgd2VsbCBhcyBtdWx0aS1kZXZpY2UgYW5kIG11bHRpLW51bWJlciBwbGF0Zm9y bXMuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiBOdW1iZXIgZGVsZWdhdGlvbiAoYW5kIHN1 Yi1kZWxlZ2F0aW9uKSwgYW5kIGJ1c2luZXNzDQo+ICAgICA+Pj4+Pj4gcmVsYXRpb25zaGlwcyBh cmUgdHdvIGFkZGl0aW9uYWwgZmFjdG9ycyB3aGljaCBhZmZlY3QNCj4gICAgID4+Pj4+PiB0cnVz dHdvcnRoaW5lc3Mgb2YgYSBnaXZlbiBjYWxsaW5nIG51bWJlciBhdXRoZW50aWNhdGlvbi4NCj4g ICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+IEluaGVyZW50IHZhcmlhYmxlIHRydXN0d29ydGhpbmVz cyBvZiBhIGNhbGxpbmcgbnVtYmVyIHdhcyBteQ0KPiAgICAgPj4+Pj4+IHJlYXNvbiBmb3Igc3Vn Z2VzdGluZyBhIHdheSB0byBxdWFsaWZ5IHRoZSBzaWduYXR1cmUgdG8gcmVmbGVjdA0KPiAgICAg Pj4+Pj4+IHRoYXQgdmFyaWFiaWxpdHkuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiBPcmln aW5hdGluZyBjYXJyaWVycyBhcmUgaW4gYSBwb3NpdGlvbiB0byBrbm93IGlmIGEgY2FsbCBpcw0K PiAgICAgPj4+Pj4+IGNvbWluZyBmcm9tIGEgZGV2aWNlIGFzc2lnbmVkIGEgc2luZ2xlIG51bWJl ciwgb3IgZnJvbSAidHJ1bmsNCj4gICAgID4+Pj4+PiBncm91cCIgd2hpY2ggY291bGQgb3JpZ2lu YXRlIGNhbGxzIHVzaW5nIG11bHRpcGxlIG51bWJlcnMsIGFuZA0KPiAgICAgPj4+Pj4+IGNhbiBx dWFsaWZ5IHRvIHNvbWUgZGVncmVlIHRoZSB0cnVzdHdvcnRoaW5lc3Mgb2YgbnVtYmVyIGF1dGhl bnRpY2l0eSBhY2NvcmRpbmdseS4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+IE15IHN1Z2dl c3Rpb24gd2FzIHF1YWxpZnlpbmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljaXR5IGludG8NCj4g ICAgID4+Pj4+PiBjYXRlZ29yaWVzIG9mIGNhcnJpZXItc2lnbmVkIChvciBub3QpLCBhbmQgdW5h dXRoZW50aWNhdGVkLA0KPiAgICAgPj4+Pj4+IHNlbWktYXV0aGVudGljYXRlZCwgYW5kIG1vc3Qt YXV0aGVudGljYXRlZC4gIFRoZXJlIGNhbiBiZSBtb3JlDQo+ICAgICA+Pj4+Pj4gZ3JhbnVsYXJp dHksIGJ1dCBpdCBpbXBsaWVzIGFkZGl0aW9uYWwgb3BlcmF0aW9uYWwgY29tcGxleGl0eQ0KPiAg ICAgPj4+Pj4+IChib3RoIGZvciB0aGUgY2FycmllcnMgYW5kIHRoZSBjb25zdW1lcnMpIGFuZCBJ IGFzc3VtZSBkaW1pbmlzaGVzIHZhbHVlLg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gTXkg cmVhc29uIGZvciBhZGRpbmcgdGhlIGF1dGhlbnRpY2l0eSBvZiB0aGUgb3JpZ2luYXRpbmcgY2Fy cmllcg0KPiAgICAgPj4+Pj4+IGlzIHR5cGljYWwgdHJ1c3R3b3J0aGluZXNzIG9mIGEgY2Fycmll ciBidXNpbmVzcyByZWxhdGlvbnNoaXANCj4gICAgID4+Pj4+PiB3aXRoIHR5cGljYWwgY29uc3Vt ZXJzIGFkZHMgdG8gdGhlIHRydXN0d29ydGhpbmVzcyBhc3Nlc3NtZW50IGFuZA0KPiAgICAgPj4+ Pj4+IHBhcnRpYWxseSBiZWNhdXNlIGNhcnJpZXJzIGFyZSBhIHJlZ3VsYXRlZCBwb2ludCBvZiBm b3JlbnNpYw0KPiAgICAgPj4+Pj4+IGlucXVpcnkgZm9yIENBTEVBIGFuZCBmcmF1ZC4gIEFkZGl0 aW9uYWxseSwgbW9zdCBjYWxscyBvcmlnaW5hdGUNCj4gICAgID4+Pj4+PiBhbmQgdGVybWluYXRl IGJldHdlZW4gbW9iaWxlIGNvbnN1bWVycyB3aGVyZSB0aGVpciBjYXJyaWVycyBhcmUNCj4gICAg ID4+Pj4+PiBhYmxlIHRvIHVzZWZ1bGx5IGF1dGhlbnRpY2F0ZSB0aGVpciBkZXZpY2UgYW5kIGhh dmUgYSBoaWdoIGRlZ3JlZQ0KPiAgICAgPj4+Pj4+IG9mIGNvbmZpZGVuY2Ugb2YgdGhlIGF1dGhl bnRpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+ PiBJIHRoaW5rIGJpbGxpb25zIG9mIHBlci1UTiBjZXJ0cyBvZiB2YXJ5aW5nIHVzYWJpbGl0eSAo cmV2b2tlZCwNCj4gICAgID4+Pj4+PiBub3QNCj4gICAgID4+Pj4+PiByZXZva2VkKSBmb3IgYXV0 aGVudGljYXRpbmcgY2FsbGluZyBudW1iZXIgd2lsbCBub3Qgd29yayB3ZWxsLg0KPiAgICAgPj4+ Pj4+DQo+ICAgICA+Pj4+Pj4gQ29udmVyc2VseSwgSSB0aGluayBiaWxsaW9ucyBvZiBwZXItVE4g Y2VydHMgd2lsbCB3b3JrIHdlbGwsIGlmDQo+ICAgICA+Pj4+Pj4gdGhlIGNhbGxpbmcgcGFydHkg aGFzIHRvIHNpZ24gYSBjYWxsIHdpdGggYSBwZXItVE4gY2VydCBwcm92aWRlZA0KPiAgICAgPj4+ Pj4+IGJ5IHRoZSBjYWxsZWQgcGFydHkuICBObyBjYWxsZWQgcGFydHkgY2VydCB0byBpbmNsdWRl PyAgVGhlbiB0aGUNCj4gICAgID4+Pj4+PiBjYWxsaW5nIHBhcnR5IGRvZXMgbm90IGhhdmUgYSB0 cnVzdGVkIHJlbGF0aW9uc2hpcCB3aXRoIHRoZQ0KPiAgICAgPj4+Pj4+IGNhbGxlZCBwYXJ0eSwg YW5kIHRoZSBjYWxsIGNhbiBiZSBhdXRob3JpemVkL3RyZWF0ZWQgYWNjb3JkaW5nbHkuDQo+ICAg ICA+Pj4+Pj4gKEkndmUgbWFkZSBzaW1pbGFyLCBtb3N0bHkgaWdub3JlZCBjb21tZW50cyBpbiBN T0RFUk4uKQ0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gUGllcmNlDQo+ICAgICA+Pj4+Pj4N Cj4gICAgID4+Pj4+PiAqRnJvbToqIEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5u ZXRdDQo+ICAgICA+Pj4+Pj4gKlNlbnQ6KiBBdWd1c3QgMDQsIDIwMTYgMjowMyBQTQ0KPiAgICAg Pj4+Pj4+ICpUbzoqIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50 LmNvbQ0KPiAgICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPiAg ICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4gICAgID4+Pj4+ PiAqQ2M6KiBBbGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQgPG1haWx0bzphbGV4QGJvYm90 ZWsubmV0Pg0KPiAgICAgPj4+Pj4+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBzdGlyQGll dGYub3JnIDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4gICAgID4+Pj4+PiA8bWFpbHRvOnN0aXJA aWV0Zi5vcmc+DQo+ICAgICA+Pj4+Pj4gKlN1YmplY3Q6KiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJp cy0xMCBjb21tZW50cw0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gV2VsbCwgdGhlIG1lY2hh bmlzbXMgYXJlIGRlc2lnbmVkIHNvIHRoYXQgdGhleSBjb3VsZCBiZSBkZXBsb3llZA0KPiAgICAg Pj4+Pj4+IG9uIGRldmljZXMgYW5kIFBCWHMuICBXaGV0aGVyIHRoZXkgd2lsbCBiZSBpcyBhIHBv bGljeSBpc3N1ZS4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+IFRoZSBub3Rpb24gb2YgY3Jl ZGVudGlhbHMgdGhhdCBhcmUgdHJhY2VhYmxlIHRvIGEgZGVsZWdhdGlvbiBvZiBhDQo+ICAgICA+ Pj4+Pj4gVE4gaXMgYSBtZWNoYW5pc20gdGhhdCBpcyBwYXJ0IG9mIHRoZSBkZXNpZ24gb2Ygc3Rp ciwgYW5kIHRoZQ0KPiAgICAgPj4+Pj4+IGRlc2lnbiBhbGxvd3MgZGVsZWdhdGlvbiBvZiBvbmUg VE4gKHRvIG9uZSBkZXZpY2UsIGFsdGhvdWdoIGENCj4gICAgID4+Pj4+PiBkZXZpY2UgbGlrZSBh IFBCWCB3b3VsZCBoYXZlIG1vcmUgdGhhbiBvbmUgVE4gcGVyICJkZXZpY2UiLCBhbmQNCj4gICAg ID4+Pj4+PiBzb21ldGhpbmcgbGlrZSBhIGR1YWwgTkFNIHBob25lIGNvdWxkIGhhdmUgbW9yZSB0 aGFuIG9uZQ0KPiAgICAgPj4+Pj4+IGNyZWRlbnRpYWwuICBGb3IgdGhlIHVzZSBjYXNlIHdlJ3Zl IGRpc2N1c3NlZCwgYSBtb2JpbGUgcGhvbmUgbWF5DQo+ICAgICA+Pj4+Pj4gYWxzbyBoYXZlIGEg Y3JlZGVudGlhbCBmb3IsIHNheSwgYSBUTiB0aGF0IGlzIGRlbGVnYXRlZCB0byBhDQo+ICAgICA+ Pj4+Pj4gbGFuZGxpbmUsIHRvIGNvdmVyIHRoZSBleGFtcGxlIGNhc2Ugb2YgYSBkb2N0b3IgcGxh Y2luZyBhIGNhbGwgb24NCj4gICAgID4+Pj4+PiBoaXMgbW9iaWxlLCBidXQgZ2V0dGluZyBoaXMg b2ZmaWNlIG51bWJlciB0byBzaG93IHVwIGFzIHRoZSBjYWxsaW5nIHBhcnR5LiAgVXNlIG9mIHN1 Y2ggbWVjaGFuaXNtcyBpcyBwb2xpY3kuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiBCcmlh bg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgIE9uIEF1ZyA0LCAy MDE2LCBhdCAyOjUyIFBNLCBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dDQo+ICAgICA+Pj4+Pj4gICA8 UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+ICAgICA+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29y bWFuQHNwcmludC5jb20+DQo+ICAgICA+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmlu dC5jb20+Pg0KPiAgICAgPj4+Pj4+IHdyb3RlOg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4g ICBUaGFua3MgQnJpYW4uICBJJ20gYWZyYWlkIHdlJ3JlIHN0cmF5aW5nIGludG8gYSBwb2xpY3kN Cj4gICAgID4+Pj4+PiAgIGRpc2N1c3Npb24uICBSZWdhcmRsZXNzLCBJIGRvIGFwcHJlY2lhdGUg eW91ciBleHBsYW5hdGlvbi4gIEkNCj4gICAgID4+Pj4+PiAgIHdvdWxkIGxpa2UgdG8gY29udGlu dWUgdGhlIGRpc2N1c3Npb24sIGJ1dCBJJ20gcHJldHR5IHN1cmUgdGhpcw0KPiAgICAgPj4+Pj4+ ICAgaXNuJ3QgdGhlIHJpZ2h0IGZvcnVtLg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICBQ aWVyY2UNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgKkZyb206KiBCcmlhbiBSb3NlbiBb bWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KPiAgICAgPj4+Pj4+ICAgKlNlbnQ6KiBBdWd1c3Qg MDQsIDIwMTYgMTozNCBQTQ0KPiAgICAgPj4+Pj4+ICAgKlRvOiogR29ybWFuLCBQaWVyY2UgQSBb Q1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+ICAgICA+Pj4+Pj4gPG1haWx0bzpQaWVy Y2UuR29ybWFuQHNwcmludC5jb20+DQo+ICAgICA+Pj4+Pj4gICA8bWFpbHRvOlBpZXJjZS5Hb3Jt YW5Ac3ByaW50LmNvbT4+DQo+ICAgICA+Pj4+Pj4gICAqQ2M6KiBBbGV4IEJvYm90ZWsgPGFsZXhA Ym9ib3Rlay5uZXQgPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pg0KPiAgICAgPj4+Pj4+ICAgPG1h aWx0bzphbGV4QGJvYm90ZWsubmV0Pj47IHN0aXJAaWV0Zi5vcmcNCj4gICAgID4+Pj4+PiA8bWFp bHRvOnN0aXJAaWV0Zi5vcmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4gICAgID4+Pj4+PiAg ICpTdWJqZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4gICAgID4+ Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgT2YgY291cnNlIEkgd2FudCBQQlhzIHRvIHNpZ24gY2FsbHMu ICBBcyB3ZWxsIGFzIHNtYXJ0IHBob25lcyBhbmQNCj4gICAgID4+Pj4+PiAgIGFueSBvdGhlciBk ZXZpY2VzIHRoYXQgY2FuIGJlIHByb2dyYW1tZWQgdG8gZG8gc28uDQo+ICAgICA+Pj4+Pj4gICBU aGV5IHdpbGwgYmUgZ2l2ZW4gY3JlZGVudGlhbHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBmb3IgdGhl IFROcw0KPiAgICAgPj4+Pj4+ICAgdGhleSBhcmUgYXV0aG9yaXplZCB0byBzaWduIGZvci4gIFRo ZXkgY2FuIHRyeSB0byBzaWduIGFueSBjYWxsLA0KPiAgICAgPj4+Pj4+ICAgYnV0IHRoZSB2YWxp ZGl0eSBvZiB0aGUgY3JlZGVudGlhbCB3b3VsZCBtYWtlIHN1Y2ggYSBzaWduYXR1cmUNCj4gICAg ID4+Pj4+PiAgIGZhaWwgdGhlIGNoZWNraW5nLg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4g ICBHZXR0aW5nIHNlcnZpY2UgcHJvdmlkZXJzIHRvIHNpZ24gb24gYmVoYWxmIG9mIGRldmljZXMg aXMgYQ0KPiAgICAgPj4+Pj4+ICAgcmVhc29uYWJsZSB3YXkgdG8gZGVwbG95IHF1aWNrbHksIGJ1 dCBJIGV4cGVjdCBtYW55IFNQcyB3aWxsIHdhbnQNCj4gICAgID4+Pj4+PiAgIHRvIGdldCBvdXQg b2YgdGhlIGxpYWJpbGl0eSBvZiBzaWduaW5nIG9uIGJlaGFsZiBvZiB0aGVpcg0KPiAgICAgPj4+ Pj4+ICAgY3VzdG9tZXJzLiAgSWYgdGhleSBjYW4gcHVzaCBvZiB0aGF0IHJlc3BvbnNpYmlsaXR5 IHRvIHRoZWlyDQo+ICAgICA+Pj4+Pj4gICBjdXN0b21lciwgb25seSBiZWluZyByZXNwb25zaWJs ZSBmb3IgZ2V0dGluZyB0aGUgY3VzdG9tZXIgYW4NCj4gICAgID4+Pj4+PiAgIGFwcHJvcHJpYXRl IGNyZWRlbnRpYWwgd2hlbiB0aGV5IGFzc2lnbiBUTnMsIHRoZW4gSSB3b3VsZCBleHBlY3QNCj4g ICAgID4+Pj4+PiAgIHRoZW0gdG8gd2FudCB0byBkbyBzby4gIFRoYXQgbWVhbnMgdGhlIGRldmlj ZXMgaGF2ZSB0byBiZSBhYmxlIHRvDQo+ICAgICA+Pj4+Pj4gICBzaWduLCBidXQgSSB1bmRlcnN0 YW5kIG1hbnkgb2YgdGhlIFBCWCB2ZW5kb3JzIHRoaW5rIHRoYXQncw0KPiAgICAgPj4+Pj4+ICAg c29tZXRoaW5nIHRoZXkgY291bGQgcHJvdmlkZSBpbiBhIGZ1dHVyZSByZWxlYXNlLg0KPiAgICAg Pj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICBCcmlhbg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4N Cj4gICAgID4+Pj4+PiAgICAgICBPbiBBdWcgNCwgMjAxNiwgYXQgMjoyMiBQTSwgR29ybWFuLCBQ aWVyY2UgQSBbQ1RPXQ0KPiAgICAgPj4+Pj4+ICAgICAgIDxQaWVyY2UuR29ybWFuQHNwcmludC5j b20NCj4gICAgID4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4gPG1haWx0 bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPiAgICAgPj4+Pj4+ICAgICAgIHdyb3RlOg0K PiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgWW91IHdhbnQgSVAgUEJYZXMgdG8gc2ln biBjYWxscz8gIFdvbid0IHRoYXQgbWFrZSBpdA0KPiAgICAgPj4+Pj4+ICAgICAgIGV4dHJhb3Jk aW5hcmlseSBlYXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRoIGF1dGhlbnRpY2F0ZWQgbnVtYmVycz8N Cj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgKkZyb206KiBC cmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KPiAgICAgPj4+Pj4+ICAgICAg ICpTZW50OiogQXVndXN0IDA0LCAyMDE2IDEyOjI0IFBNDQo+ICAgICA+Pj4+Pj4gICAgICAgKlRv OiogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+ICAg ICA+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+ICAgICA+Pj4+Pj4g ICAgICAgPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPiAgICAgPj4+Pj4+ICAg ICAgICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldCA8bWFpbHRvOmFsZXhAYm9i b3Rlay5uZXQ+DQo+ICAgICA+Pj4+Pj4gICAgICAgPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pj47 IHN0aXJAaWV0Zi5vcmcNCj4gICAgID4+Pj4+PiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IDxtYWls dG86c3RpckBpZXRmLm9yZz4NCj4gICAgID4+Pj4+PiAgICAgICAqU3ViamVjdDoqIFJlOiBbc3Rp cl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAg ICAgICBGaXJzdCBvZiBhbGwsIHdlIHdvdWxkIHdhbnQgdGhlIFBCWCB0byBnZW5lcmF0ZSB0aGUg c2lnbmF0dXJlLA0KPiAgICAgPj4+Pj4+ICAgICAgIGJ1dCB0aGUgc2VydmljZSBwcm92aWRlciBj YW4gZG8gdGhhdC4gIEl0IHNob3VsZCBub3QgYWRkIGENCj4gICAgID4+Pj4+PiAgICAgICB2YWxp ZCBzaWduYXR1cmUgdG8gYSBjYWxsIGZyb20gYSBudW1iZXIgaXQgZGlkIG5vdCBhc3NpZ24gdG8N Cj4gICAgID4+Pj4+PiAgICAgICB0aGUgdHJ1bmsgZ3JvdXAgY29ubmVjdGluZyB0byB0aGUgUEJY LCBhbHRob3VnaCBpdCBjb3VsZA0KPiAgICAgPj4+Pj4+ICAgICAgIHN1cHBvcnQgdGhlIGV4dHJh IGRlbGVnYXRpb24gcmVxdWlyZWQgdG8gc3VwcG9ydCAiYXV0aG9yaXplZA0KPiAgICAgPj4+Pj4+ ICAgICAgIHNwb29maW5nIi4gIFRoZSBjb21wYW5pb24gZGV2aWNlcyBJJ20gYXdhcmUgb2YgYWx3 YXlzIHNlbmQNCj4gICAgID4+Pj4+PiAgICAgICBjYWxscyBmcm9tIHRoZSBzYW1lIHNlcnZpY2Ug cHJvdmlkZXIgYW5kIHNob3VsZCBub3QgcHJlc2VudA0KPiAgICAgPj4+Pj4+ICAgICAgIGFueSBp c3N1ZS4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAgIEV2ZXJ5b25lIHdpbGwgaGF2 ZSB0byBkbyB3b3JrIHRoZXkgZG9uJ3QgZG8gbm93IHRvIGltcGxlbWVudA0KPiAgICAgPj4+Pj4+ ICAgICAgIHN0b3Agc3Bvb2ZlZCBjYWxscy4gVEFOU1RBQUZMDQo+ICAgICA+Pj4+Pj4NCj4gICAg ID4+Pj4+PiAgICAgICBCcmlhbg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+ Pj4+PiAgICAgICAgICAgT24gQXVnIDQsIDIwMTYsIGF0IDEyOjQxIFBNLCBHb3JtYW4sIFBpZXJj ZSBBIFtDVE9dDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIDxQaWVyY2UuR29ybWFuQHNwcmludC5j b20gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+ICAgICA+Pj4+Pj4gICAgICAg ICAgIDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4gd3JvdGU6DQo+ICAgICA+Pj4+ Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgRnJhdWQgZnJvbSBjb21wcm9taXNlZCBQQlhlcyBp cyBjb21tb24uICBBbmQgZXZlbiB3aGVyZSBhDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFBCWCBp cyBub3QgY29tcHJvbWlzZWQsIGEgY2FycmllciBoYXMgbm8gcHJhY3RpY2FsIHdheSBvZg0KPiAg ICAgPj4+Pj4+ICAgICAgICAgICBrbm93aW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcgbnVtYmVyIGlz IHByb3Blcmx5IGFzc2lnbmVkDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGFuZCB2YWxpZCBmcm9t IHRoZSBwZXJzcGVjdGl2ZSBvZiB0aGUgRW50ZXJwcmlzZS4NCj4gICAgID4+Pj4+PiAgICAgICAg ICAgVGhlcmVmb3JlLCBjaGVja2luZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciB3YXMgZnJv bSBhbg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICBhc3NpZ25lZCByYW5nZSBtaWdodCBiZSBwb3Nz aWJsZSAoYW5kIGZyYXVnaHQgd2l0aA0KPiAgICAgPj4+Pj4+ICAgICAgICAgICBhZG1pbmlzdHJh dGl2ZSBjaGFsbGVuZ2VzKSwgYnV0IG9mIGxpbWl0ZWQgdmFsdWUuICBBbmQgaW4NCj4gICAgID4+ Pj4+PiAgICAgICAgICAgdGhlIGNvbnN1bWVyIG1hcmtldCwgdGhlcmUgYXJlIGNhbGxpbmcgcHJv ZHVjdHMgd2hpY2gNCj4gICAgID4+Pj4+PiAgICAgICAgICAgc3VwcG9ydCBhIHBhcmVudCBzdWJz Y3JpYmVyIG51bWJlciBhbmQgImNvbXBhbmlvbiIgZGV2aWNlcw0KPiAgICAgPj4+Pj4+ICAgICAg ICAgICAoZS5nLiwgdGFibGV0cykgd2hpY2ggY2FuIHBsYWNlIGEgY2FsbCB1c2luZyB0aGUgTURO IG9mDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIHRoZSBwYXJlbnQgc3Vic2NyaWJlci4gIFRoZXNl IGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUNCj4gICAgID4+Pj4+PiAgICAgICAgICAgYXV0aGVu dGljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciB3b24ndCBuZWNlc3NhcmlseSBtZWFuDQo+ICAg ICA+Pj4+Pj4gICAgICAgICAgIHRoZSBzYW1lIHRoaW5nIGFzIHRoZSBhdXRoZW50aWNpdHkgb2Yg YSBjYWxsIGZyb20gYSBzaW5nbGUNCj4gICAgID4+Pj4+PiAgICAgICAgICAgc3Vic2NyaWJlciB3 aXRoIGEgc2luZ2xlIE1ETiByZWdhcmRsZXNzIG9mICJsYXhpdHkiIG9mDQo+ICAgICA+Pj4+Pj4g ICAgICAgICAgIHNwb29mIGNoZWNraW5nLg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAg ICAgICAgIEluIGFub3RoZXIgZm9ydW0gYW5kIGFudGljaXBhdGluZyBjYWxsaW5nIG51bWJlcg0K PiAgICAgPj4+Pj4+ICAgICAgICAgICBhdXRoZW50aWNhdGlvbiBtYW5kYXRlcyBmcm9tIENvbmdy ZXNzIGFuZC9vciBGQ0MsIEkNCj4gICAgID4+Pj4+PiAgICAgICAgICAgc3VnZ2VzdGVkIHVzaW5n IGNhcnJpZXItc3BlY2lmaWMgY2VydHMgYW5kIGVuY29kaW5nDQo+ICAgICA+Pj4+Pj4gICAgICAg ICAgIHNwZWNpZmljaXR5IG9mIGF1dGhlbnRpY2l0eSwgYW5kIGNhbGxpbmcgbnVtYmVyLiAgVGhp cw0KPiAgICAgPj4+Pj4+ICAgICAgICAgICBwcm92aWRlcyB0aGUgaWRlbnRpdHkgb2YgdGhlIG9y aWdpbmF0aW5nIGNhcnJpZXIsIHNvbWUNCj4gICAgID4+Pj4+PiAgICAgICAgICAgaWRlYSBhcyB0 byB0aGUgYWNjdXJhY3kgb3Igc3BlY2lmaWNpdHkgb2YgdGhlIGNhbGxpbmcNCj4gICAgID4+Pj4+ PiAgICAgICAgICAgbnVtYmVyLCBhbmQgdmFsaWR0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgKGFz c3VtaW5nIG5vbmNlDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGFuZCByZXBsYXkgaXNzdWVzIGNh biBiZSBhZGRyZXNzZWQgYXMgcmVhc29uYWJseSBzdWdnZXN0ZWQNCj4gICAgID4+Pj4+PiAgICAg ICAgICAgYmVsb3cgYnkgQWxleCkuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAg ICAgVGhlIHJlcHJlc2VudGF0aW9uIG9mIG9yaWctY2FycmllciBhbmQgdHJ1c3R3b3J0aGluZXNz DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGNvdWxkIGJlIGFzIGZvbGxvd3M6DQo+ICAgICA+Pj4+ Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgKlJlZ3VsYXRlZC9tYW5kYXRlZCBDYXJyaWVyIENs YXNzIFVzZSBDYXNlOioNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAqMDAg LSBObyBDcmVkZW50aWFscyoNCj4gICAgID4+Pj4+PiAgICAgICAgICAgVXNlIGNhc2UgZXhhbXBs ZShzKTogUHJlLUlNUywgbGVnYWN5IGNpcmN1aXQtc3dpdGNoZWQNCj4gICAgID4+Pj4+PiAgICAg ICAgICAgbmV0d29ya3MgdGhhdCBkb24ndCBuYXRpdmVseSBzdXBwb3J0IFNJUCBvciB3aGljaCBk b24ndA0KPiAgICAgPj4+Pj4+ICAgICAgICAgICBjaG9vc2UgdG8gc2lnbiBjYWxscy4gIEUuZy4s IGludGVybmF0aW9uYWwgY2FycmllcnMuDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFRydXN0IEVz dGltYXRlOiAgR29vZCBsdWNrLiAgQ2Fycmllcl9vcmlnIGFuZCBDZ1BODQo+ICAgICA+Pj4+Pj4g ICAgICAgICAgIGVudGlyZWx5IHVudHJ1c3R3b3J0aHkuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+ Pj4+PiAgICAgICAgICAgKjAxIC0gQ2FycmllciBzaWduZWQsIG5vIGF1dGhlbnRpY2F0aW9uIG9m IENnUE4qDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFVzZSBjYXNlIGV4YW1wbGUocyk6IEU5MTEg b24gdmlzaXRlZCBuZXR3b3JrIHcvbyByb2FtaW5nDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGFn cmVlbWVudCwgbWFudWFsIHJvYW1pbmcuDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFRydXN0IEVz dGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGVudGlyZWx5DQo+ICAgICA+ Pj4+Pj4gICAgICAgICAgIHVudHJ1c3R3b3J0aHkNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ ICAgICAgICAgICAqMTAgLSBDYXJyaWVyIHNpZ25lZCwgc2VtaS1hdXRoZW50aWNhdGVkIENnUE4q DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFVzZSBjYXNlIGV4YW1wbGUocyk6IE51bWJlciBibG9j ayBkZWxlZ2F0ZWQgZnJvbSBPQ04sIGJ1dA0KPiAgICAgPj4+Pj4+ICAgICAgICAgICBubyBwZXIt VE4gc2NyZWVuIChTSVAgdHJ1bmtzKS4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgVHJ1c3QgRXN0 aW1hdGU6ICBDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4gbGVzcyB0aGFuDQo+ICAgICA+ Pj4+Pj4gICAgICAgICAgIG1vc3QgdHJ1c3R3b3J0aHkgYnV0IG5vdCBlbnRpcmVseSB1bnRydXN0 d29ydGh5Lg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICoxMSAtIENhcnJp ZXIgc2lnbmVkLCBhdXRoZW50aWNhdGVkIENnUE4qDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFVz ZSBjYXNlIGV4YW1wbGUocyk6IEJyZWFkLWFuZC1idXR0ZXIgOTUlKyBvZiBjYWxscyBmcm9tDQo+ ICAgICA+Pj4+Pj4gICAgICAgICAgIHN1YnNjcmliZXIgbGluZXMgKElNUy1iYXNlZCBhbmQgb3Ro ZXJ3aXNlKS4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVy X29yaWcgdHJ1c3R3b3J0aHksIENnUE4gbW9zdA0KPiAgICAgPj4+Pj4+ICAgICAgICAgICB0cnVz dHdvcnRoeQ0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICpQdWJsaWMgVXNl IENhc2U6Kg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFVuZGVmaW5lZCBi dXQgYXNzdW1lZCB0byB1c2UgcHVibGljIG9yIGNvbW1lcmNpYWxseQ0KPiAgICAgPj4+Pj4+ICAg ICAgICAgICBhdmFpbGFibGUgYXV0aGVudGljYXRpb24gc2VydmljZXMgcmVzb3VyY2VzLiAgZS5n LiwNCj4gICAgID4+Pj4+PiAgICAgICAgICAgbm9tb3JvYm8tbGlrZSBjcm93ZC1zb3VyY2VkIGFj Y2VwdC9kZW55IGxpc3RzLCBldCBjZXRlcmEuDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIENvdWxk L3dvdWxkIHBhc3MgY3JlZGVudGlhbHMgZG93biB0byBTSVAtYXdhcmUgZGV2aWNlcw0KPiAgICAg Pj4+Pj4+ICAgICAgICAgICB3aGljaCB3b3VsZCBwcm9jZXNzIHRoZW0gYWNjb3JkaW5nIHRvIHRo ZSBydWxlcyBvZiB0aGUNCj4gICAgID4+Pj4+PiAgICAgICAgICAgUHVibGljIENsYXNzIGFwcGxp Y2F0aW9uKHMpLg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFBpZXJjZQ0K PiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICpGcm9tOiogQnJpYW4gUm9zZW4g W21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCj4gICAgID4+Pj4+PiAgICAgICAgICAgKlNlbnQ6 KiBBdWd1c3QgMDQsIDIwMTYgOTowMiBBTQ0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAqVG86KiBB bGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQNCj4gICAgID4+Pj4+PiA8bWFpbHRvOmFsZXhA Ym9ib3Rlay5uZXQ+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIDxtYWlsdG86YWxleEBib2JvdGVr Lm5ldD4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICpDYzoqIHN0aXJAaWV0Zi5vcmcNCj4gICAg ID4+Pj4+PiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4g ICAgID4+Pj4+PiAgICAgICAgICAgKlN1YmplY3Q6KiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0x MCBjb21tZW50cw0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIFRoZXJlIGFy ZSByZWFzb25hYmxlIGNpcmN1bXN0YW5jZXMgd2hlcmUgYSBwYXJ0eSBwbGFjaW5nIGENCj4gICAg ID4+Pj4+PiAgICAgICAgICAgY2FsbCBpcyBub3QgdGhlIGF1dGhvcml6ZWQgZW50aXR5IGFzc2ln bmVkIHRoZSB0ZWxlcGhvbmUNCj4gICAgID4+Pj4+PiAgICAgICAgICAgbnVtYmVyIHVzZWQgaW4g RnJvbS9QQUksIGFuZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlDQo+ICAgICA+Pj4+Pj4gICAg ICAgICAgIHNlcnZpY2UgcHJvdmlkZXIgc2VydmljaW5nIHRoZSBlbnRpdHkgcGxhY2luZyB0aGUg Y2FsbCBtYXkNCj4gICAgID4+Pj4+PiAgICAgICAgICAgb3IgbWF5IG5vdCBiZSB0aGUgc2FtZSBh cyB0aGUgc2VydmljZSBwcm92aWRlciBzZXJ2aW5nIHRoZQ0KPiAgICAgPj4+Pj4+ICAgICAgICAg ICBlbnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4uICBJbiBhbGwgc3VjaCBjYXNlcywgdGhl DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVkIHRoZSBUTiBl eHBsaWNpdGx5IGF1dGhvcml6ZXMgY2FsbHMNCj4gICAgID4+Pj4+PiAgICAgICAgICAgcGxhY2Vk IHVzaW5nIGl0J3MgVE4uICBUaGUgZGVzaWduIGFjY29tbW9kYXRlcyBzdWNoIHVzZQ0KPiAgICAg Pj4+Pj4+ICAgICAgICAgICBjYXNlcy4gIEl0J3Mgbm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9u IHdpdGhvdXQNCj4gICAgID4+Pj4+PiAgICAgICAgICAgYXV0aGVudGljYXRpb24uICAgV2UncmUg bm90IGF3YXJlIG9mIGFueSBjYXNlcyB3aGVyZSB0aGVyZQ0KPiAgICAgPj4+Pj4+ICAgICAgICAg ICBpcyBhbiBhY3R1YWwgcmVxdWlyZW1lbnQgZm9yIGxlZ2l0aW1hdGUgY2FsbGluZyB3aXRob3V0 DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGV4cGxpY2l0IGF1dGhvcml6YXRpb24gZnJvbSB0aGUg YXNzaWduZWQgZW50aXR5LCBhbHRob3VnaA0KPiAgICAgPj4+Pj4+ICAgICAgICAgICB3ZSBjZXJ0 YWlubHkgYXJlIGF3YXJlIHRoYXQgdmFyaW91cyBwYXJ0cyBvZiB2YXJpb3VzDQo+ICAgICA+Pj4+ Pj4gICAgICAgICAgIHNlcnZpY2UgcHJvdmlkZXJzIGRvbid0IGJvdGhlciB0byBjaGVjay4gQXQg dGhpcyBwb2ludCwgYXQNCj4gICAgID4+Pj4+PiAgICAgICAgICAgbGVhc3QgaW4gc29tZSBjb3Vu dHJpZXMsIHRoZXJlIGlzIGEgcmVhbGl6YXRpb24gdGhhdCB0aGUNCj4gICAgID4+Pj4+PiAgICAg ICAgICAgbGF4aXR5IG9mIGFsbG93aW5nIHVuY2hlY2tlZCBzcG9vZmluZyBpcyBub3QgYWNjZXB0 YWJsZQ0KPiAgICAgPj4+Pj4+ICAgICAgICAgICBhbnkgbW9yZS4NCj4gICAgID4+Pj4+Pg0KPiAg ICAgPj4+Pj4+ICAgICAgICAgICBCcmlhbg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4NCj4g ICAgID4+Pj4+PiAgICAgICAgICAgICAgIE9uIEF1ZyAzLCAyMDE2LCBhdCA4OjM1IEFNLCBBbGV4 IEJvYm90ZWsNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIDxhbGV4QGJvYm90ZWsubmV0DQo+ ICAgICA+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0PiA8bWFpbHRvOmFsZXhAYm9ib3Rl ay5uZXQ+PiB3cm90ZToNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAg MS4gICAgICAgUGVybWl0IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbg0KPiAg ICAgPj4+Pj4+ICAgICAgICAgICAgICAgSW4gdGhlIGN1cnJlbnQgdGVsZXBob255IG5ldHdvcmsg cHJhY3RpY2UsIHNvbWUNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHNlcnZpY2UgcHJvdmlk ZXIgaW1wbGVtZW50YXRpb25zIGNob29zZSBub3QgdG8NCj4gICAgID4+Pj4+PiAgICAgICAgICAg ICAgIGF1dGhlbnRpY2F0ZSBpZGVudGl0eSwgYnV0IHNpbXBseSBmYWNpbGl0YXRlIHRoZSB1c2UN Cj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIG9mIGFuIGFyYml0cmFyeSBvciBzZWxlY3RlZCB1 c2VyLXByb3ZpZGVkIGlkZW50aXR5Lg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgQXJlIHRo ZXJlIGxlZ2l0aW1hdGUgdXNlIGNhc2VzIGZvciB0aGlzPyAgSGFzIGFueW9uZQ0KPiAgICAgPj4+ Pj4+ICAgICAgICAgICAgICAgZXN0YWJsaXNoZWQgdGhhdCB0aGVyZSBhcmUgbm90PyAgSG93IGNh biB0aGUgaW5kdXN0cnkNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHJlYXNvbmFibHkgZXhw ZWN0IHRvIGVuZCB0aGlzIChvZnRlbiBiYWQpIHByYWN0aWNlPw0KPiAgICAgPj4+Pj4+ICAgICAg ICAgICAgICAgSWYgaXQgY2FuJ3QgYmUgZW5kZWQsIHRoZXJlJ3MgdmFsdWUgaW4gYXQgbGVhc3QN Cj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGlkZW50aWZ5aW5nIHRoZSBvcmlnaW5hdGluZyBz ZXJ2aWNlIHByb3ZpZGVyDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAoaS5lLiwgdGhlIHNp Z25lci9hdXRob3JpemVyKS4gIEdpdmVuIHRoZSBwcmV2YWxlbmNlDQo+ICAgICA+Pj4+Pj4gICAg ICAgICAgICAgICBvZiBhYnVzZSB1c2luZyB0ZWxlcGhvbmUgbnVtYmVycyBhc3NpZ25lZCB0byBh DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBzb21ldGltZXMtYW5vbnltb3VzIGFidXNlciwg aXQgYmVjb21lcyBjcml0aWNhbGx5DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBpbXBvcnRh bnQgdG8gaWRlbnRpZnkgdGhlIHNlcnZpY2UgcHJvdmlkZXIocykgY2xvc2VzdA0KPiAgICAgPj4+ Pj4+ICAgICAgICAgICAgICAgdG8gdGhlIGFidXNlci4gIEJhc2VkIG9uIHRoZSBhc3N1bXB0aW9u IHRoYXQgaXQncw0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgYmV0dGVyIHRvIElEIHNlcnZp Y2UgcHJvdmlkZXJzIHRoYW4gdW5yZWFzb25hYmx5DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAg ICBleHBlY3QgYSBiYW4gb2YgdGhlIHVzZSBvZiB1bmF1dGhlbnRpY2F0ZWQgKGFuZA0KPiAgICAg Pj4+Pj4+ICAgICAgICAgICAgICAgdGhlcmVmb3JlIHVuc2lnbmVkKSBTSVAgcmVxdWVzdHMsIFNU SVIgc2lnbmluZyBzaG91bGQNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHN1cHBvcnQgYXV0 aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLiAgVGhlDQo+ICAgICA+Pj4+Pj4gICAg ICAgICAgICAgICBwcmFjdGljZSBvZiBhdXRob3JpemluZyB1bmF1dGhlbnRpY2F0ZWQgdXNlIGV4 aXN0cywNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGFuZCB0aGVyZSBpcyBiZW5lZml0IHRv IHNpZ25pbmcgaW4gdGhlc2UgY2FzZXMNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIChzZXJ2 aWNlIHByb3ZpZGVyIGlkZW50aWZpY2F0aW9uKS4gIFRoZSBsYW5ndWFnZSBvZg0KPiAgICAgPj4+ Pj4+ICAgICAgICAgICAgICAgdGhlIElEIHNob3VsZCBwZXJtaXQgdGhpcyB1c2UuICA0NDc0Ymlz LTEwIHNob3VsZCBOT1QNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHJlcXVpcmUgb3IgYXNz dW1lIHRoYXQgIHRoYXQgYXV0aGVudGljYXRpb24gd2lsbA0KPiAgICAgPj4+Pj4+ICAgICAgICAg ICAgICAgcHJlY2VkZSBhdXRob3JpemF0aW9uLiBPZiBjb3Vyc2UgdGhlcmUgbWF5IGJlIG90aGVy DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICB1c2UgY2FzZXMgd2hlcmUgc2lnbmluZyBpbmNs dWRlcyBhdXRoZW50aWNhdGlvbiBhbmQNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIG1heSBu b3QgaW5jbHVkZSBhIHNwZWNpZmljIHNlcnZpY2UgcHJvdmlkZXIncw0KPiAgICAgPj4+Pj4+ICAg ICAgICAgICAgICAgYXV0aG9yaXphdGlvbi4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAyLiAgICAgICBJbXByb3ZlIHJlcGxheSBwcmV2ZW50 aW9uDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBQcm94aW1hdGUgcmVwbGF5IGlzIHBvc3Np YmxlIHdoaWxlIGNvbXBseWluZyB3aXRoIHRoaXMNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAg IHNwZWMuICBGaXJzdCwgb25lIG9yIG1vcmUgcHJveGltYXRlIChlLmcuLCB3aXRoaW4gNjANCj4g ICAgID4+Pj4+PiAgICAgICAgICAgICAgIHNlY29uZHMpIFNJUCByZXF1ZXN0cyB1c2luZyB0aGUg c2FtZSB0b2tlbiBhcmUgbGVnYWwNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGFuZCBzdWJq ZWN0IHRvIHJlcGxheSBpbiBtYW55IGNhc2VzLiAgQW4gU0RQIGJvZHkncw0KPiAgICAgPj4+Pj4+ ICAgICAgICAgICAgICAgbWt5IG1heSBub3QgYmUgcHJlc2VudCBhbmQgaWYgcHJlc2VudCBpdHMg dXNlIGlzDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBvcHRpb25hbC4gIFNvbWUgc29ydCBv ZiBtYW5kYXRvcnkgbmV3IG9yIGV4aXN0aW5nDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBz aWduZWQgc2VxdWVuY2UsIHJhbmRvbSAjIG9yIHJlcXVlc3QgSUQgKGUuZy4sIENhbGwtSUQNCj4g ICAgID4+Pj4+PiAgICAgICAgICAgICAgIG9yIENTZXEpIGFuZCBhIDEtdGltZSB1c2UgcG9saWN5 IG9uIHRoZSByZWNlaXZpbmcgZW5kDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBvZiB0aGUg cmVxdWVzdCAoZS5nLiwgdG9rZW5zIG9ubHkgZ29vZCBmb3IgMQ0KPiAgICAgPj4+Pj4+ICAgICAg ICAgICAgICAgdXNlKSBjb3VsZCBwcmV2ZW50IHJlcGxheS4gIERpZmZlcmVudCBtZXRob2RzIChl LmcuLA0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgSU5WSVRFIHZzIE1FU1NBR0UpIG1pZ2h0 IGJlIGhhbmRsZWQgYnkgZGlmZmVyZW50DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICByZWNl aXZpbmcgaW5mcmFzdHJ1Y3R1cmUsIGFuZCB0aGVyZWZvcmUgZGlmZmljdWx0aWVzDQo+ICAgICA+ Pj4+Pj4gICAgICAgICAgICAgICB3aXRoICdpdCdzIGJlZW4gdXNlZCBhbHJlYWR5JyBjb29yZGlu YXRpb24gYWxsb3cgYQ0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgZmFrZWQgTUVTU0FHRSBi YXNlZCBvbiBhIGNhcHR1cmVkIHJlcXVlc3QuIFRoaXMgbWlnaHQNCj4gICAgID4+Pj4+PiAgICAg ICAgICAgICAgIGluY2x1ZGUgYW4gbWtleSBmcm9tIGEgY2FwdHVyZWQgSU5WSVRFLiAgIFNvIGl0 IG1heSBiZQ0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgcG9zc2libGUgdG8gRE9TLCBzcGFt IG9yIHRleHQtYm9tYiBhIHJlY2lwaWVudCB1c2luZyBhDQo+ICAgICA+Pj4+Pj4gICAgICAgICAg ICAgICBjYXB0dXJlZCBpZGVudGl0eS4gIFdoaWxlIGxhcmdlLXNjYWxlIG9yIGRpc3RyaWJ1dGVk DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBpbXBsZW1lbnRhdGlvbnMgbWF5IG1ha2UgdGhl IGVuZm9yY2VtZW50IGRpZmZpY3VsdCwNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHRoZXJl IGlzIGxpdHRsZSBjb3N0IHRvIHNpZ25pbmcgYW5kIGRlY29kaW5nIGEgbWV0aG9kDQo+ICAgICA+ Pj4+Pj4gICAgICAgICAgICAgICBhbmQgcG9zc2libHkgYSBudW1lcmljIElELiAgIFNvbWUgc29y dCBvZiAnMS11c2UnDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBwcmFjdGljZSBzaG91bGQg YXQgbGVhc3QgYmUgZGlzY3Vzc2VkIHdoaWxlIHBlcmhhcHMNCj4gICAgID4+Pj4+PiAgICAgICAg ICAgICAgIG5vdCByZXF1aXJlZC4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+ Pj4+Pj4gICAgICAgICAgICAgICBTcGVjaWZpYyBtYXJrdXAgc3VnZ2VzdGlvbnM6DQo+ICAgICA+ Pj4+Pj4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgTklUUw0KPiAg ICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIFRo ZSB2ZXJpZmllciBNVVNUIGluc3BlY3QgYW55IG9wdGlvbmFsICJwcHQiDQo+ICAgICA+Pj4+Pj4g cGFyYW1ldGVyIGFwcGVhcmluZyAqaW4qdGhlDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAg ICAgICAgICAgICAgICAgIElkZW50aXR5IHJlcXVlc3QuICBJZiBubyAicHB0IiBwYXJhbWV0ZXIg aXMNCj4gICAgID4+Pj4+PiBwcmVzZW50LCB0aGVuIHRoZQ0KPiAgICAgPj4+Pj4+DQo+ICAgICA+ Pj4+Pj4gICAgICAgICAgICAgICAgICB2ZXJpZmllciBwcm9jZWVkcyBub3JtYWxseSBiZWxvdy4g IElmIGEgInBwdCINCj4gICAgID4+Pj4+PiBwYXJhbWV0ZXIgdmFsdWUgaXMNCj4gICAgID4+Pj4+ Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgcHJlc2VudCwgYW5kIHRoZSB2ZXJpZmll ciBkb2VzIG5vdCBzdXBwb3J0IGl0LA0KPiAgICAgPj4+Pj4+IGl0IE1VU1QgaWdub3JlIHRoZQ0K PiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBJZGVudGl0eSBoZWFk ZXIuICBJZiBhIHN1cHBvcnRlZCAicHB0IiBwYXJhbWV0ZXINCj4gICAgID4+Pj4+PiB2YWx1ZSBp cyBwcmVzZW50LA0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICB0 aGUgdmVyaWZpZXIgZm9sbG93cyB0aGUgcHJvY2VkdXJlcyBiZWxvdywNCj4gICAgID4+Pj4+PiBp bmNsdWRpbmcgdGhlIHZhcmlhdGlvbnMNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAg ICAgICAgICAgICAgZGVzY3JpYmVkIGluIFN0ZXAgNS4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+ Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAg ICAgICAgIDMNCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgICA8ZmlsZTovLy9DOi9Vc2Vy cy9hYjM3NzgvRG9jdW1lbnRzL0lFVEYvZHJhZnQtaWV0Zi1zdGlyLXJmYzQ0NzRiaXMtMTAlMjAt JTIwQXV0aGVudGljYXRlZCUyMElkZW50aXR5JTIwTWFuYWdlbWVudCUyMGluJTIwdGhlJTIwU2Vz c2lvbiUyMEluaXRpYXRpb24lMjBQcm90b2NvbCUyMCUyOFNJUCUyOS5odG0jc2VjdGlvbi0zPi4N Cj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgICBCYWNrZ3JvdW5kDQo+ICAgICA+Pj4+Pj4N Cj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIFsuLi5dDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+ Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBQZXIgW1JG QzczNDANCj4gICAgID4+Pj4+PiA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzczNDA+ XSwgcHJvYmxlbXMgc3VjaCBhcw0KPiAgICAgPj4+Pj4+IHJvYm9jYWxsaW5nLCB2b2ljZW1haWwg aGFja2luZywgYW5kDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAg IHN3YXR0aW5nIGFyZSBlbmFibGVkIGJ5IGFuIGF0dGFja2VyJ3MgYWJpbGl0eSB0bw0KPiAgICAg Pj4+Pj4+IGltcGVyc29uYXRlIHNvbWVvbmUNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAg ICAgICAgICAgICAgICAgZWxzZS4gIFRoZSBzZWN1cmUgb3BlcmF0aW9uIG9mIG1vc3QgU0lQDQo+ ICAgICA+Pj4+Pj4gYXBwbGljYXRpb25zIGFuZCBzZXJ2aWNlcw0KPiAgICAgPj4+Pj4+DQo+ICAg ICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBkZXBlbmRzIG9uIGF1dGhlbnRpY2F0aW5nIGFuZC9v ciBhdXRob3JpemluZyB0aGUNCj4gICAgID4+Pj4+PiBzb3VyY2Ugb2YgY29tbXVuaWNhdGlvbnMg YXMgaXQgaXMNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgcmVw cmVzZW50ZWQgaW4gYSBTSVAgcmVxdWVzdC4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIFRoaXMgaWRlbnRpdHkg YXJjaGl0ZWN0dXJlIGZvciBTSVAgZGVwZW5kcyBvbg0KPiAgICAgPj4+Pj4+IGluY2x1ZGVzIHBy b3Zpc2lvbnMgZm9yIGEgbG9naWNhbA0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAg ICAgICAgICAgICAiYXV0aGVudGljYXRpb24gc2VydmljZSIgd2hpY2ggdmFsaWRhdGVzIGNhbGxl cg0KPiAgICAgPj4+Pj4+IGlkZW50aXR5IGF0IG9yIG5lYXIgb3JpZ2luYXRpb24uICBvdXRnb2lu Zw0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgcmVxdWVzdHMuICBBbg0KPiAgICAgPj4+Pj4+ DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIG1h eSBiZSBpbXBsZW1lbnRlZCBlaXRoZXINCj4gICAgID4+Pj4+PiBhcyBwYXJ0IG9mIGEgdXNlcg0K PiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBhZ2VudCBvciBhcyBh IHByb3h5IHNlcnZlcjsgdHlwaWNhbGx5LCBpdCBpcyBhDQo+ICAgICA+Pj4+Pj4gY29tcG9uZW50 IG9mIGEgbmV0d29yaw0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAg ICBpbnRlcm1lZGlhcnkgbGlrZSBhIHByb3h5IHRvIHdoaWNoIG9yaWdpbmF0aW5nDQo+ICAgICA+ Pj4+Pj4gdXNlciBhZ2VudHMgc2VuZA0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAg ICAgICAgICAgICB1bnNpZ25lZCByZXF1ZXN0cy4gIE9uY2UgdGhlIHNlbmRlciBvZiB0aGUNCj4g ICAgID4+Pj4+PiBtZXNzYWdlIGhhcyBiZWVuDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+Pg0K PiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAg IFRoaXMgZG9jdW1lbnQgc3BlY2lmaWVzIGEgbWVhbnMgb2Ygc2hhcmluZyBhDQo+ICAgICA+Pj4+ Pj4gY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2UNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+ICAg ICAgICAgICAgICAgICAgb2YgYXV0aGVudGljaXR5IG9mIGFuZC9vciBhdXRob3JpemF0aW9uIHRv IHVzZQ0KPiAgICAgPj4+Pj4+IGVuZC11c2VyIFNJUCBpZGVudGl0eSBpbiBhbiBpbnRlcmRvbWFp biBvciBpbnRyYWRvbWFpbiBjb250ZXh0Lg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAg ICAgICAgICAgICAgICBJdCByZWxpZXMgb24gdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UNCj4g ICAgID4+Pj4+PiBjb25zdHJ1Y3RpbmcgdG9rZW5zIGJhc2VkIG9uIFsuLi5dDQo+ICAgICA+Pj4+ Pj4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+ Pg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgVG8gbWF4aW1pemUgZW5kLXRvLWVuZCBz ZWN1cml0eSwgaXQgaXMgdHlwaWNhbGx5DQo+ICAgICA+Pj4+Pj4gb2J2aW91c2x5DQo+ICAgICA+ Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIHByZWZlcmFibGUgZm9yIGVuZC11 c2VycyB0byBhY3F1aXJlIHRoZWlyIG93bg0KPiAgICAgPj4+Pj4+IGNyZWRlbnRpYWxzOyBpZiB0 aGV5DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIGRvLCB0aGVp ciB1c2VyIGFnZW50cyBjYW4gYWN0IGFzIGF1dGhlbnRpY2F0aW9uDQo+ICAgICA+Pj4+Pj4gc2Vy dmljZXMuICBIb3dldmVyLA0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAgICAg ICAgICBmb3Igc29tZSBkZXBsb3ltZW50cywgWy4uLl0NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+ Pj4+DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIFJlZ2FyZHMsDQo+ ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIEFsZXgNCj4gICAgID4+Pj4+ PiAgICAgICAgICAgICAgICogKg0KPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgKkFsZXggQm9i b3RlayoNCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4gICAgICAgICAg ICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiAg ICAgPj4+Pj4+ICAgICAgICAgICAgICAgc3RpciBtYWlsaW5nIGxpc3QNCj4gICAgID4+Pj4+PiAg ICAgICAgICAgICAgIHN0aXJAaWV0Zi5vcmcNCj4gICAgID4+Pj4+PiA8bWFpbHRvOnN0aXJAaWV0 Zi5vcmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4gICAgID4+Pj4+PiAgICAgICAgICAgICAg IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPiAgICAgPj4+Pj4+ DQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+Pg0KPiAgICAgPj4+Pj4+DQo+ICAgICA+Pj4+Pj4g LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0NCj4gICAgID4+Pj4+PiAtLS0tLS0tDQo+ICAgICA+Pj4+Pj4NCj4gICAgID4+Pj4+ PiAgICAgICAgICAgVGhpcyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0YXJ5IGlu Zm9ybWF0aW9uDQo+ICAgICA+Pj4+Pj4gICAgICAgICAgIGludGVuZGVkIGZvciB0aGUgc29sZSB1 c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55IHVzZSBieQ0KPiAgICAgPj4+Pj4+ICAgICAgICAg ICBvdGhlcnMgaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkDQo+ICAg ICA+Pj4+Pj4gICAgICAgICAgIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBh bmQgZGVsZXRlIGFsbCBjb3BpZXMNCj4gICAgID4+Pj4+PiAgICAgICAgICAgb2YgdGhlIG1lc3Nh Z2UuDQo+ICAgICA+Pj4+Pg0KPiAgICAgPj4+Pj4NCj4gICAgID4+Pj4+DQo+ICAgICA+Pj4+PiBf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiAgICAgPj4+ Pj4gc3RpciBtYWlsaW5nIGxpc3QNCj4gICAgID4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0bzpz dGlyQGlldGYub3JnPg0KPiAgICAgPj4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9zdGlyDQo+ICAgICA+Pj4+Pg0KPiAgICAgPj4+Pg0KPiAgICAgPj4+PiBfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiAgICAgPj4+PiBzdGly IG1haWxpbmcgbGlzdA0KPiAgICAgPj4+PiBzdGlyQGlldGYub3JnIDxtYWlsdG86c3RpckBpZXRm Lm9yZz4NCj4gICAgID4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9z dGlyDQo+ICAgICA+Pj4NCj4gICAgID4+DQo+ICAgICA+PiBfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KPiAgICAgPj4gc3RpciBtYWlsaW5nIGxpc3QNCj4g ICAgID4+IHN0aXJAaWV0Zi5vcmcNCj4gICAgID4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vc3Rpcg0KPiAgICAgPg0KPiAgICAgPg0KPg0KPiAgICAgX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gICAgIHN0aXIgbWFpbGluZyBs aXN0DQo+ICAgICBzdGlyQGlldGYub3JnDQo+ICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3N0aXINCj4NCj4gICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQo+ICAgICBzdGlyIG1haWxpbmcgbGlzdA0KPiAgICAgc3RpckBp ZXRmLm9yZw0KPiAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGly DQo+DQo+DQo+DQo+DQo+DQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+DQo+ IFRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmludCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbiBp bnRlbmRlZCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSByZWNpcGllbnQocykuIEFueSB1c2UgYnkg b3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGll bnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSBhbGwgY29waWVzIG9mIHRo ZSBtZXNzYWdlLg0KPg0KDQo= From nobody Fri Aug 5 10:55:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39A2C12D13F for ; Fri, 5 Aug 2016 10:55:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WmxNkQm6t5x7 for ; Fri, 5 Aug 2016 10:55:10 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CF1B12D753 for ; Fri, 5 Aug 2016 10:55:10 -0700 (PDT) Received: from pps.filterd (m0049458.ppops.net [127.0.0.1]) by m0049458.ppops.net-00191d01. (8.16.0.11/8.16.0.11) with SMTP id u75HsAxc043570; Fri, 5 Aug 2016 13:55:06 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049458.ppops.net-00191d01. with ESMTP id 24mxvhhfs6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Aug 2016 13:55:06 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u75Ht4NZ008077; Fri, 5 Aug 2016 13:55:05 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u75Hsumv007813 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 5 Aug 2016 13:54:59 -0400 Received: from MISOUT7MSGHUBAD.ITServices.sbc.com (MISOUT7MSGHUBAD.itservices.sbc.com [130.9.129.148]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Fri, 5 Aug 2016 17:54:35 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.146]) by MISOUT7MSGHUBAD.ITServices.sbc.com ([130.9.129.148]) with mapi id 14.03.0301.000; Fri, 5 Aug 2016 13:54:35 -0400 From: "DOLLY, MARTIN C" To: "Gorman, Pierce A [CTO]" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ybRsWQuDxcKz0ueE1p7VelBT6A6wFcAgAAZW4CAAAHSAP//ywii Date: Fri, 5 Aug 2016 17:54:34 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu>, <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> In-Reply-To: <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-05_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608050212 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 17:55:13 -0000 PAI is not stripped at the network boundary between trusted networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force=20 ITU And the list goes on Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards=20 AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: >=20 > Which header the carrier chooses to display is moot if the header is stri= pped between carriers as per at least one standard. I think Paul Rosbotham= 's observation we're likely to encounter "some interesting interworking cha= llenges" was perhaps the understatement of the year. >=20 > Pierce >=20 > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu]=20 > Sent: August 05, 2016 11:58 AM > To: Gorman, Pierce A [CTO] ; Richard Shockey ; Rosbotham, Paul, Vodafone UK ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > If PAI is present and signed, and From is also signed, I would expect it = to be up to the UA to decide what to display, not the carrier. >=20 > Of course this will work differently if there is a different signaling re= gime between the carrier and the user device (e.g. black phone). >=20 > Thanks, > Paul >=20 >> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" = and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-= Identity is stripped by border controller functions and is not to be used i= n inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. >>=20 >> Pierce >>=20 >>=20 >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul=20 >> Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>=20 >> Humm this is getting interesting. Its my understanding that the display= number aka =93presentation number=94 in the US context is the one carried = in the PAI. Martin, Pierce? >>=20 >>=20 >>=20 >>=20 >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>=20 >> Jumping in now that we're on European working time, +1 on Paul's obse= rvation. >>=20 >> Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. >>=20 >> Only the carrier has the authority to set the Network Number so only = they could sign it. >>=20 >> But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. >>=20 >> What I want is the ability for customers to use their credentials=20 >> to sign the CLIs they send me so that at the terminating end it can be=20 >> checked (or indeed somewhere en-route if that's the business model). =20 >> I can and would sign for customers on my mobile business since I'm=20 >> driving what number is presented, but that's by-the-by because they=20 >> aren't the ones who generate millions of nuisance calls. If the=20 >> signing only occurs at the originating carrier level for=20 >> corporate/call-centre customers that's no use because I'm not in a=20 >> position to do that for these type of customers...and the whole system=20 >> becomes a waste of time. I'd also highlight there are many more of my=20 >> large customers that I'd trust more than a far end originating carrier=20 >> that could be anywhere in the world (though we have no shortage of=20 >> small carriers that I wouldn't know from Adam more locally in the=20 >> UK....) >>=20 >> Regards >>=20 >> Paul >>=20 >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>>=20 >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >>=20 >> IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. >>=20 >> Thanks, >> Paul >>=20 >>> Brian >>>=20 >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>>=20 >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline carrier >>>>> to him. He then creates another credential, which he signs with his >>>>> office phone credential that authorizes his mobile to send calls >>>>> from his office number. He is spoofing (because the call is coming >>>>> from his mobile's TN but claims to be from his office), but it's >>>>> authorized spoofing. The doc could give the credential to his >>>>> mobile SP if they sign on his behalf. >>>>=20 >>>> I don't understand how that is different from regular delegation. >>>>=20 >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>>=20 >>>> Thanks, >>>> Paul >>>>=20 >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>>=20 >>>>> But that's how I describe it. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>>=20 >>>>>> +1, but with one question below: >>>>>>=20 >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation >>>>>>> path, >>>>>>=20 >>>>>>> plus the option to add another level (not delegation) for >>>>>>> authorized spoofers. >>>>>>=20 >>>>>> I don't understand "authorized spoofers" in this context, as >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>=20 >>>>>> Thanks, >>>>>> Paul >>>>>>=20 >>>>>>> I don't think it matters who the delegator or delegatee are as >>>>>>> long as the delegator is willing to take the heat for delegating >>>>>>> to someone who sends a lot of bad calls. They can pass the buck >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but >>>>>>> only if the SP knows who they delegated to, so authorities can >>>>>>> follow the delegation path. There are plenty of certificated >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so that >>>>>>> you can pass the hot potato. >>>>>>>=20 >>>>>>> It's perfectly reasonable for a carrier to be able to sign for any >>>>>>> calls placed on its network on any number it has been delegated. >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and >>>>>>> that represents the hard part of deployment in my opinion. But >>>>>>> once they delegate, they can hand responsibility to sign to the >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>>=20 >>>>>>> The root of the whole model is that there is a formal or informal >>>>>>> delegation path for telephone numbers in every country, and we can >>>>>>> build a chain of trust from that delegation path. If you propose >>>>>>> to alter that model, then we get into (policy) issues of which >>>>>>> carriers/entities we trust and which we don't. Our model is that >>>>>>> you know who you delegate to, and once you do that delegation, it's= their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some >>>>>>> business practices. >>>>>>>=20 >>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> OK, you talked me into indulging in one more message on policy >>>>>>>> and use cases. >>>>>>>>=20 >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>>=20 >>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>> relationships are two additional factors which affect >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>=20 >>>>>>>> Inherent variable trustworthiness of a calling number was my >>>>>>>> reason for suggesting a way to qualify the signature to reflect >>>>>>>> that variability. >>>>>>>>=20 >>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>> coming from a device assigned a single number, or from "trunk >>>>>>>> group" which could originate calls using multiple numbers, and >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>>=20 >>>>>>>> My suggestion was qualifying calling number authenticity into >>>>>>>> categories of carrier-signed (or not), and unauthenticated, >>>>>>>> semi-authenticated, and most-authenticated. There can be more >>>>>>>> granularity, but it implies additional operational complexity >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>>=20 >>>>>>>> My reason for adding the authenticity of the originating carrier >>>>>>>> is typical trustworthiness of a carrier business relationship >>>>>>>> with typical consumers adds to the trustworthiness assessment and >>>>>>>> partially because carriers are a regulated point of forensic >>>>>>>> inquiry for CALEA and fraud. Additionally, most calls originate >>>>>>>> and terminate between mobile consumers where their carriers are >>>>>>>> able to usefully authenticate their device and have a high degree >>>>>>>> of confidence of the authenticity of the calling number. >>>>>>>>=20 >>>>>>>> I think billions of per-TN certs of varying usability (revoked, >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>=20 >>>>>>>> Conversely, I think billions of per-TN certs will work well, if >>>>>>>> the calling party has to sign a call with a per-TN cert provided >>>>>>>> by the called party. No called party cert to include? Then the >>>>>>>> calling party does not have a trusted relationship with the >>>>>>>> called party, and the call can be authorized/treated accordingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Well, the mechanisms are designed so that they could be deployed >>>>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>>>>=20 >>>>>>>> The notion of credentials that are traceable to a delegation of a >>>>>>>> TN is a mechanism that is part of the design of stir, and the >>>>>>>> design allows delegation of one TN (to one device, although a >>>>>>>> device like a PBX would have more than one TN per "device", and >>>>>>>> something like a dual NAM phone could have more than one >>>>>>>> credential. For the use case we've discussed, a mobile phone may >>>>>>>> also have a credential for, say, a TN that is delegated to a >>>>>>>> landline, to cover the example case of a doctor placing a call on >>>>>>>> his mobile, but getting his office number to show up as the callin= g party. Use of such mechanisms is policy. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>>> isn't the right forum. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones and >>>>>>>> any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs >>>>>>>> they are authorized to sign for. They can try to sign any call, >>>>>>>> but the validity of the credential would make such a signature >>>>>>>> fail the checking. >>>>>>>>=20 >>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will want >>>>>>>> to get out of the liability of signing on behalf of their >>>>>>>> customers. If they can push of that responsibility to their >>>>>>>> customer, only being responsible for getting the customer an >>>>>>>> appropriate credential when they assign TNs, then I would expect >>>>>>>> them to want to do so. That means the devices have to be able to >>>>>>>> sign, but I understand many of the PBX vendors think that's >>>>>>>> something they could provide in a future release. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated numbe= rs? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> First of all, we would want the PBX to generate the signature= , >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>>=20 >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from a= n >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" device= s >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a singl= e >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>>=20 >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggeste= d >>>>>>>> below by Alex). >>>>>>>>=20 >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>>=20 >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>=20 >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>>=20 >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>>=20 >>>>>>>> *Public Use Case:* >>>>>>>>=20 >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> There are reasonable circumstances where a party placing = a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call ma= y >>>>>>>> or may not be the same as the service provider serving th= e >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes call= s >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where ther= e >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, a= t >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with thi= s >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-I= D >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may b= e >>>>>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Specific markup suggestions: >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> NITS >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>>=20 >>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>> present, then the >>>>>>>>=20 >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>>=20 >>>>>>>> present, and the verifier does not support it, >>>>>>>> it MUST ignore the >>>>>>>>=20 >>>>>>>> Identity header. If a supported "ppt" parameter >>>>>>>> value is present, >>>>>>>>=20 >>>>>>>> the verifier follows the procedures below, >>>>>>>> including the variations >>>>>>>>=20 >>>>>>>> described in Step 5. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>>=20 >>>>>>>> [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as >>>>>>>> robocalling, voicemail hacking, and >>>>>>>>=20 >>>>>>>> swatting are enabled by an attacker's ability to >>>>>>>> impersonate someone >>>>>>>>=20 >>>>>>>> else. The secure operation of most SIP >>>>>>>> applications and services >>>>>>>>=20 >>>>>>>> depends on authenticating and/or authorizing the >>>>>>>> source of communications as it is >>>>>>>>=20 >>>>>>>> represented in a SIP request. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This identity architecture for SIP depends on >>>>>>>> includes provisions for a logical >>>>>>>>=20 >>>>>>>> "authentication service" which validates caller >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>>=20 >>>>>>>> authentication service may be implemented either >>>>>>>> as part of a user >>>>>>>>=20 >>>>>>>> agent or as a proxy server; typically, it is a >>>>>>>> component of a network >>>>>>>>=20 >>>>>>>> intermediary like a proxy to which originating >>>>>>>> user agents send >>>>>>>>=20 >>>>>>>> unsigned requests. Once the sender of the >>>>>>>> message has been >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This document specifies a means of sharing a >>>>>>>> cryptographic assurance >>>>>>>>=20 >>>>>>>> of authenticity of and/or authorization to use >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>=20 >>>>>>>> It relies on the authentication service >>>>>>>> constructing tokens based on [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> To maximize end-to-end security, it is typically >>>>>>>> obviously >>>>>>>>=20 >>>>>>>> preferable for end-users to acquire their own >>>>>>>> credentials; if they >>>>>>>>=20 >>>>>>>> do, their user agents can act as authentication >>>>>>>> services. However, >>>>>>>>=20 >>>>>>>> for some deployments, [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Regards, >>>>>>>>=20 >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> ----------------------------------------------------------------- >>>>>>>> ------- >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copie= s >>>>>>>> of the message. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >>=20 >>=20 >>=20 >> ________________________________ >>=20 >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 5 11:02:11 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6D3D12B043 for ; Fri, 5 Aug 2016 11:02:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1oDRaP6BGXq for ; Fri, 5 Aug 2016 11:02:06 -0700 (PDT) Received: from qproxy5-pub.mail.unifiedlayer.com (qproxy5-pub.mail.unifiedlayer.com [69.89.21.30]) by ietfa.amsl.com (Postfix) with SMTP id 5B76512D952 for ; Fri, 5 Aug 2016 11:02:06 -0700 (PDT) Received: (qmail 8943 invoked by uid 0); 5 Aug 2016 18:02:05 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy5.mail.unifiedlayer.com with SMTP; 5 Aug 2016 18:02:05 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id TVx11t00e1MNPNq01Vx4Xk; Fri, 05 Aug 2016 11:57:05 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=fGh7L_e3oJcA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=Ebs0h9rcAAAA:8 a=HLLxP2VMAAAA:8 a=izV7ms69AAAA:8 a=VfgTrTGYAAAA:8 a=2UhxAi5b2YUrgVijwfkA:9 a=TjICoRftzhoAHRNd:21 a=gF2tck8fGUq1Wjwm:21 a=QEXdDO2ut3YA:10 a=NWVoK91CQySWRX1oVYDe:22 a=NumKjXolQHiPR4xHErVj:22 a=w1C3t2QeGrPiZgrLijVG:22 a=ze-edQBmiW6TIqNp2H_K:22 a=5oret6oapBRfLy7jekVI:22 a=jg1oa_xp17rrhcbVgaY4:22 a=ORFRI7aeUVbPhtmlmiRh:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=qlgQ/SwLMWp2G1gFFi9AbnSCXFuTzqtXBj6AXzGec9g=; b=hS2gqcn2xcxwe7WdK1a1fArgF2 0tbxJOoHqvULa4FsuDxzxb1CqHb6zQxL/ZDiq+lrdhT46b1QBGosM0WahnApHYK9UlJxd7wSWoHRc DA2eNeGmCx7FbSx8FAyMxvHhM; Received: from [100.36.21.178] (port=54679 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bVjMj-0002PZ-OW; Fri, 05 Aug 2016 11:57:02 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 05 Aug 2016 13:56:45 -0400 From: Richard Shockey To: Paul Kyzivat , "Gorman, Pierce A [CTO]" , "Rosbotham, Paul, Vodafone UK" , Brian Rosen Message-ID: Thread-Topic: [stir] STIR 4474bis-10 comments References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> In-Reply-To: <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.21.178 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.21.178 X-Exim-ID: 1bVjMj-0002PZ-OW X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.21.178]:54679 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 18:02:10 -0000 Don=E2=80=99t be so sure. If it=E2=80=99s a mobile device or perhaps cable you can bet = the carrier will have some say in what is displayed on the UA.=20 On 8/5/16, 12:57 PM, "stir on behalf of Paul Kyzivat" wrote: If PAI is present and signed, and From is also signed, I would expect i= t=20 to be up to the UA to decide what to display, not the carrier. =20 Of course this will work differently if there is a different signaling=20 regime between the carrier and the user device (e.g. black phone). =20 Thanks, Paul =20 On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > P-Asserted-Identity is supposed to operate "among trusted SIP entitie= s" and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserte= d-Identity is stripped by border controller functions and is not to be used = in inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. > > Pierce > > > -----Original Message----- > From: Richard Shockey [mailto:richard@shockey.us] > Sent: August 05, 2016 9:37 AM > To: Rosbotham, Paul, Vodafone UK ; Paul = Kyzivat ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > > Humm this is getting interesting. Its my understanding that the disp= lay number aka =E2=80=9Cpresentation number=E2=80=9D in the US context is the one carrie= d in the PAI. Martin, Pierce? > > > > > On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" = wrote: > > Jumping in now that we're on European working time, +1 on Paul's = observation. > > Here in the UK, we've got 2 numbers carried as calling line IDs..= ..one (we term the Network Number, carried in PAID) uniquely identifies the = line, the other (we term Presentation Number, carried in From) is used for d= isplay purposes. > > Only the carrier has the authority to set the Network Number so o= nly they could sign it. > > But - subject to regulatory restrictions which are well documente= d - the number sent for display purposes belongs to the customer. For blue-= chip customers, I can allow them to send their Presentation Numbers into the= network, and can't readily check at a network level that they're theirs (I = do have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre they= 'll be making outbound calls for lots of different customers which will chan= ge on day-by-day basis. This is business as usual. I don't like the term "= authorised spoofing" because it implies that the CLI is in some way being ri= gged: it's not, it's the corporate customer or their subcontractor using the= number that's been assigned (so in internet terms delegated) to them via a = chain of trust from the regulator. > > What I want is the ability for customers to use their credentials= to sign the CLIs they send me so that at the terminating end it can be chec= ked (or indeed somewhere en-route if that's the business model). I can and = would sign for customers on my mobile business since I'm driving what number= is presented, but that's by-the-by because they aren't the ones who generat= e millions of nuisance calls. If the signing only occurs at the originating= carrier level for corporate/call-centre customers that's no use because I'm= not in a position to do that for these type of customers...and the whole sy= stem becomes a waste of time. I'd also highlight there are many more of my l= arge customers that I'd trust more than a far end originating carrier that c= ould be anywhere in the world (though we have no shortage of small carriers = that I wouldn't know from Adam more locally in the UK....) > > Regards > > Paul > > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyziv= at > Sent: 04 August 2016 23:12 > To: Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > On 8/4/16 6:02 PM, Brian Rosen wrote: > > I think it's not a delegation. The mobile phone is not being d= elegated the TN, it's being authorized to place calls that are not from that= TN, but appear to be. > > > > The mechanism to handle the credential is exactly the same as a= delegation, so if you want to call it delegation, go ahead, but I prefer to= call it authorized spoofing. > > IIUC the delegation is to a responsible entity (something that ca= n be held legally accountable - e.g. a person), not to a device. The entity = can then "use" the credential via any device(s) it chooses. In the case of t= he mobile, the device then becomes a two-line phone. > > Thanks, > Paul > > > Brian > > > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: > >> > >> On 8/4/16 5:43 PM, Brian Rosen wrote: > >>> In my jargon an "authorized spoofer" is the doctor who is cal= ling > >>> from his mobile, but sending the TN of his office phone as ca= lling party. > >>> The delegation to his office phone was made by his landline c= arrier > >>> to him. He then creates another credential, which he signs w= ith his > >>> office phone credential that authorizes his mobile to send ca= lls > >>> from his office number. He is spoofing (because the call is = coming > >>> from his mobile's TN but claims to be from his office), but i= t's > >>> authorized spoofing. The doc could give the credential to hi= s > >>> mobile SP if they sign on his behalf. > >> > >> I don't understand how that is different from regular delegati= on. > >> > >> When his landline carrier gave him a delegated certificate for= his landline number, he should be able to install that in whatever devices = he wants - his landline UA, his mobile phone, etc. It is still delegated fro= m his landline carrier, even when used with calls via his mobile carrier. > >> > >> Thanks, > >> Paul > >> > >>> Some folks don't like attaching the "spoofing" label to a leg= itimate use. > >>> > >>> But that's how I describe it. > >>> > >>> Brian > >>> > >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>> > wrote: > >>>> > >>>> +1, but with one question below: > >>>> > >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > >>>>> I think all we need is to have credentials follow the deleg= ation > >>>>> path, > >>>> > >>>>> plus the option to add another level (not delegation) for > >>>>> authorized spoofers. > >>>> > >>>> I don't understand "authorized spoofers" in this context, as > >>>> contrasted to "spoofers" who have been delegated their autho= rity. > >>>> > >>>> Thanks, > >>>> Paul > >>>> > >>>>> I don't think it matters who the delegator or delegatee are= as > >>>>> long as the delegator is willing to take the heat for deleg= ating > >>>>> to someone who sends a lot of bad calls. They can pass the= buck > >>>>> ("I delegated the TN to him, and now I'm not responsible"),= but > >>>>> only if the SP knows who they delegated to, so authorities = can > >>>>> follow the delegation path. There are plenty of certificat= ed > >>>>> carriers who are willing to not care who they delegate to. = The fact that there are some who do doesn't change much. > >>>>> Making stir work means knowing who you are delegating to, s= o that > >>>>> you can pass the hot potato. > >>>>> > >>>>> It's perfectly reasonable for a carrier to be able to sign = for any > >>>>> calls placed on its network on any number it has been deleg= ated. > >>>>> If it does, it's asserting that the calls are from who they= are supposed to be from. > >>>>> That should be straightforward, but we know it's not always= , and > >>>>> that represents the hard part of deployment in my opinion. = But > >>>>> once they delegate, they can hand responsibility to sign to= the > >>>>> delegatee. But, that only works if they know who they are = delegating to. > >>>>> > >>>>> The root of the whole model is that there is a formal or in= formal > >>>>> delegation path for telephone numbers in every country, and= we can > >>>>> build a chain of trust from that delegation path. If you p= ropose > >>>>> to alter that model, then we get into (policy) issues of wh= ich > >>>>> carriers/entities we trust and which we don't. Our model i= s that > >>>>> you know who you delegate to, and once you do that delegati= on, it's their problem. > >>>>> That's pretty appealing I think, even if it's a change in s= ome > >>>>> business practices. > >>>>> > >>>>> The mechanism is chaining credentials in a form of a PKI an= d > >>>>> having a way to know which TNs are covered by a credential. > >>>>> That's what we have, and I'm loath to change it. > >>>>> > >>>>> Brian > >>>>> > >>>>> > >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > >>>>>> > >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> OK, you talked me into indulging in one more message on po= licy > >>>>>> and use cases. > >>>>>> > >>>>>> I agree that the STIR/PASSporT mechanisms could be deploye= d on > >>>>>> individual devices as well as multi-device and multi-numbe= r platforms. > >>>>>> > >>>>>> Number delegation (and sub-delegation), and business > >>>>>> relationships are two additional factors which affect > >>>>>> trustworthiness of a given calling number authentication. > >>>>>> > >>>>>> Inherent variable trustworthiness of a calling number was = my > >>>>>> reason for suggesting a way to qualify the signature to re= flect > >>>>>> that variability. > >>>>>> > >>>>>> Originating carriers are in a position to know if a call i= s > >>>>>> coming from a device assigned a single number, or from "tr= unk > >>>>>> group" which could originate calls using multiple numbers,= and > >>>>>> can qualify to some degree the trustworthiness of number a= uthenticity accordingly. > >>>>>> > >>>>>> My suggestion was qualifying calling number authenticity i= nto > >>>>>> categories of carrier-signed (or not), and unauthenticated= , > >>>>>> semi-authenticated, and most-authenticated. There can be = more > >>>>>> granularity, but it implies additional operational complex= ity > >>>>>> (both for the carriers and the consumers) and I assume dim= inishes value. > >>>>>> > >>>>>> My reason for adding the authenticity of the originating c= arrier > >>>>>> is typical trustworthiness of a carrier business relations= hip > >>>>>> with typical consumers adds to the trustworthiness assessm= ent and > >>>>>> partially because carriers are a regulated point of forens= ic > >>>>>> inquiry for CALEA and fraud. Additionally, most calls ori= ginate > >>>>>> and terminate between mobile consumers where their carrier= s are > >>>>>> able to usefully authenticate their device and have a high= degree > >>>>>> of confidence of the authenticity of the calling number. > >>>>>> > >>>>>> I think billions of per-TN certs of varying usability (rev= oked, > >>>>>> not > >>>>>> revoked) for authenticating calling number will not work w= ell. > >>>>>> > >>>>>> Conversely, I think billions of per-TN certs will work wel= l, if > >>>>>> the calling party has to sign a call with a per-TN cert pr= ovided > >>>>>> by the called party. No called party cert to include? Th= en the > >>>>>> calling party does not have a trusted relationship with th= e > >>>>>> called party, and the call can be authorized/treated accor= dingly. > >>>>>> (I've made similar, mostly ignored comments in MODERN.) > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 2:03 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> Well, the mechanisms are designed so that they could be de= ployed > >>>>>> on devices and PBXs. Whether they will be is a policy iss= ue. > >>>>>> > >>>>>> The notion of credentials that are traceable to a delegati= on of a > >>>>>> TN is a mechanism that is part of the design of stir, and = the > >>>>>> design allows delegation of one TN (to one device, althoug= h a > >>>>>> device like a PBX would have more than one TN per "device"= , and > >>>>>> something like a dual NAM phone could have more than one > >>>>>> credential. For the use case we've discussed, a mobile ph= one may > >>>>>> also have a credential for, say, a TN that is delegated to= a > >>>>>> landline, to cover the example case of a doctor placing a = call on > >>>>>> his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > >>>>>> >>>>>> > >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> Thanks Brian. I'm afraid we're straying into a policy > >>>>>> discussion. Regardless, I do appreciate your explanatio= n. I > >>>>>> would like to continue the discussion, but I'm pretty su= re this > >>>>>> isn't the right forum. > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 1:34 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> Of course I want PBXs to sign calls. As well as smart p= hones and > >>>>>> any other devices that can be programmed to do so. > >>>>>> They will be given credentials that only are valid for t= he TNs > >>>>>> they are authorized to sign for. They can try to sign a= ny call, > >>>>>> but the validity of the credential would make such a sig= nature > >>>>>> fail the checking. > >>>>>> > >>>>>> Getting service providers to sign on behalf of devices i= s a > >>>>>> reasonable way to deploy quickly, but I expect many SPs = will want > >>>>>> to get out of the liability of signing on behalf of thei= r > >>>>>> customers. If they can push of that responsibility to t= heir > >>>>>> customer, only being responsible for getting the custome= r an > >>>>>> appropriate credential when they assign TNs, then I woul= d expect > >>>>>> them to want to do so. That means the devices have to b= e able to > >>>>>> sign, but I understand many of the PBX vendors think tha= t's > >>>>>> something they could provide in a future release. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > >>>>>> >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> You want IP PBXes to sign calls? Won't that make it > >>>>>> extraordinarily easy to commit fraud with authentica= ted numbers? > >>>>>> > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 12:24 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> First of all, we would want the PBX to generate the = signature, > >>>>>> but the service provider can do that. It should not= add a > >>>>>> valid signature to a call from a number it did not a= ssign to > >>>>>> the trunk group connecting to the PBX, although it c= ould > >>>>>> support the extra delegation required to support "au= thorized > >>>>>> spoofing". The companion devices I'm aware of alway= s send > >>>>>> calls from the same service provider and should not = present > >>>>>> any issue. > >>>>>> > >>>>>> Everyone will have to do work they don't do now to i= mplement > >>>>>> stop spoofed calls. TANSTAAFL > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [C= TO] > >>>>>> > >>>>>> > wrote: > >>>>>> > >>>>>> Fraud from compromised PBXes is common. And eve= n where a > >>>>>> PBX is not compromised, a carrier has no practic= al way of > >>>>>> knowing whether the calling number is properly a= ssigned > >>>>>> and valid from the perspective of the Enterprise= . > >>>>>> Therefore, checking whether the calling number w= as from an > >>>>>> assigned range might be possible (and fraught wi= th > >>>>>> administrative challenges), but of limited value= . And in > >>>>>> the consumer market, there are calling products = which > >>>>>> support a parent subscriber number and "companio= n" devices > >>>>>> (e.g., tablets) which can place a call using the= MDN of > >>>>>> the parent subscriber. These are examples of wh= ere the > >>>>>> authenticity of the calling number won't necessa= rily mean > >>>>>> the same thing as the authenticity of a call fro= m a single > >>>>>> subscriber with a single MDN regardless of "laxi= ty" of > >>>>>> spoof checking. > >>>>>> > >>>>>> In another forum and anticipating calling number > >>>>>> authentication mandates from Congress and/or FCC= , I > >>>>>> suggested using carrier-specific certs and encod= ing > >>>>>> specificity of authenticity, and calling number.= This > >>>>>> provides the identity of the originating carrier= , some > >>>>>> idea as to the accuracy or specificity of the ca= lling > >>>>>> number, and validty of the calling number (assum= ing nonce > >>>>>> and replay issues can be addressed as reasonably= suggested > >>>>>> below by Alex). > >>>>>> > >>>>>> The representation of orig-carrier and trustwort= hiness > >>>>>> could be as follows: > >>>>>> > >>>>>> *Regulated/mandated Carrier Class Use Case:* > >>>>>> > >>>>>> *00 - No Credentials* > >>>>>> Use case example(s): Pre-IMS, legacy circuit-swi= tched > >>>>>> networks that don't natively support SIP or whic= h don't > >>>>>> choose to sign calls. E.g., international carri= ers. > >>>>>> Trust Estimate: Good luck. Carrier_orig and Cg= PN > >>>>>> entirely untrustworthy. > >>>>>> > >>>>>> *01 - Carrier signed, no authentication of CgPN* > >>>>>> Use case example(s): E911 on visited network w/o= roaming > >>>>>> agreement, manual roaming. > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = entirely > >>>>>> untrustworthy > >>>>>> > >>>>>> *10 - Carrier signed, semi-authenticated CgPN* > >>>>>> Use case example(s): Number block delegated from= OCN, but > >>>>>> no per-TN screen (SIP trunks). > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = less than > >>>>>> most trustworthy but not entirely untrustworthy. > >>>>>> > >>>>>> *11 - Carrier signed, authenticated CgPN* > >>>>>> Use case example(s): Bread-and-butter 95%+ of ca= lls from > >>>>>> subscriber lines (IMS-based and otherwise). > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = most > >>>>>> trustworthy > >>>>>> > >>>>>> *Public Use Case:* > >>>>>> > >>>>>> Undefined but assumed to use public or commercia= lly > >>>>>> available authentication services resources. e.= g., > >>>>>> nomorobo-like crowd-sourced accept/deny lists, e= t cetera. > >>>>>> Could/would pass credentials down to SIP-aware d= evices > >>>>>> which would process them according to the rules = of the > >>>>>> Public Class application(s). > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 9:02 AM > >>>>>> *To:* Alex Bobotek >>>>>> > >>>>>> > > >>>>>> *Cc:* stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> There are reasonable circumstances where a party= placing a > >>>>>> call is not the authorized entity assigned the t= elephone > >>>>>> number used in From/PAI, and in such circumstanc= es the > >>>>>> service provider servicing the entity placing th= e call may > >>>>>> or may not be the same as the service provider s= erving the > >>>>>> entity that is assigned the TN. In all such cas= es, the > >>>>>> entity that is assigned the TN explicitly author= izes calls > >>>>>> placed using it's TN. The design accommodates s= uch use > >>>>>> cases. It's not a blanket authorization without > >>>>>> authentication. We're not aware of any cases w= here there > >>>>>> is an actual requirement for legitimate calling = without > >>>>>> explicit authorization from the assigned entity,= although > >>>>>> we certainly are aware that various parts of var= ious > >>>>>> service providers don't bother to check. At this= point, at > >>>>>> least in some countries, there is a realization = that the > >>>>>> laxity of allowing unchecked spoofing is not acc= eptable > >>>>>> any more. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > >>>>>> >>>>>> > wrote= : > >>>>>> > >>>>>> 1. Permit authorization without authen= tication > >>>>>> In the current telephony network practice, s= ome > >>>>>> service provider implementations choose not = to > >>>>>> authenticate identity, but simply facilitate= the use > >>>>>> of an arbitrary or selected user-provided id= entity. > >>>>>> Are there legitimate use cases for this? Ha= s anyone > >>>>>> established that there are not? How can the= industry > >>>>>> reasonably expect to end this (often bad) pr= actice? > >>>>>> If it can't be ended, there's value in at le= ast > >>>>>> identifying the originating service provider > >>>>>> (i.e., the signer/authorizer). Given the pr= evalence > >>>>>> of abuse using telephone numbers assigned to= a > >>>>>> sometimes-anonymous abuser, it becomes criti= cally > >>>>>> important to identify the service provider(s= ) closest > >>>>>> to the abuser. Based on the assumption that= it's > >>>>>> better to ID service providers than unreason= ably > >>>>>> expect a ban of the use of unauthenticated (= and > >>>>>> therefore unsigned) SIP requests, STIR signi= ng should > >>>>>> support authorization without authentication= . The > >>>>>> practice of authorizing unauthenticated use = exists, > >>>>>> and there is benefit to signing in these cas= es > >>>>>> (service provider identification). The lang= uage of > >>>>>> the ID should permit this use. 4474bis-10 s= hould NOT > >>>>>> require or assume that that authentication = will > >>>>>> precede authorization. Of course there may b= e other > >>>>>> use cases where signing includes authenticat= ion and > >>>>>> may not include a specific service provider'= s > >>>>>> authorization. > >>>>>> > >>>>>> > >>>>>> 2. Improve replay prevention > >>>>>> Proximate replay is possible while complying= with this > >>>>>> spec. First, one or more proximate (e.g., w= ithin 60 > >>>>>> seconds) SIP requests using the same token a= re legal > >>>>>> and subject to replay in many cases. An SDP= body's > >>>>>> mky may not be present and if present its us= e is > >>>>>> optional. Some sort of mandatory new or exi= sting > >>>>>> signed sequence, random # or request ID (e.g= ., Call-ID > >>>>>> or CSeq) and a 1-time use policy on the rece= iving end > >>>>>> of the request (e.g., tokens only good for 1 > >>>>>> use) could prevent replay. Different method= s (e.g., > >>>>>> INVITE vs MESSAGE) might be handled by diffe= rent > >>>>>> receiving infrastructure, and therefore diff= iculties > >>>>>> with 'it's been used already' coordination a= llow a > >>>>>> faked MESSAGE based on a captured request. T= his might > >>>>>> include an mkey from a captured INVITE. So= it may be > >>>>>> possible to DOS, spam or text-bomb a recipie= nt using a > >>>>>> captured identity. While large-scale or dis= tributed > >>>>>> implementations may make the enforcement dif= ficult, > >>>>>> there is little cost to signing and decoding= a method > >>>>>> and possibly a numeric ID. Some sort of '1= -use' > >>>>>> practice should at least be discussed while = perhaps > >>>>>> not required. > >>>>>> > >>>>>> > >>>>>> Specific markup suggestions: > >>>>>> > >>>>>> > >>>>>> NITS > >>>>>> > >>>>>> > >>>>>> The verifier MUST inspect any optional "p= pt" > >>>>>> parameter appearing *in*the > >>>>>> > >>>>>> Identity request. If no "ppt" parameter = is > >>>>>> present, then the > >>>>>> > >>>>>> verifier proceeds normally below. If a "= ppt" > >>>>>> parameter value is > >>>>>> > >>>>>> present, and the verifier does not suppor= t it, > >>>>>> it MUST ignore the > >>>>>> > >>>>>> Identity header. If a supported "ppt" pa= rameter > >>>>>> value is present, > >>>>>> > >>>>>> the verifier follows the procedures below= , > >>>>>> including the variations > >>>>>> > >>>>>> described in Step 5. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> 3 > >>>>>> . > >>>>>> Background > >>>>>> > >>>>>> [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> Per [RFC7340 > >>>>>> ], problems such as > >>>>>> robocalling, voicemail hacking, and > >>>>>> > >>>>>> swatting are enabled by an attacker's abi= lity to > >>>>>> impersonate someone > >>>>>> > >>>>>> else. The secure operation of most SIP > >>>>>> applications and services > >>>>>> > >>>>>> depends on authenticating and/or authoriz= ing the > >>>>>> source of communications as it is > >>>>>> > >>>>>> represented in a SIP request. > >>>>>> > >>>>>> > >>>>>> > >>>>>> This identity architecture for SIP depend= s on > >>>>>> includes provisions for a logical > >>>>>> > >>>>>> "authentication service" which validates = caller > >>>>>> identity at or near origination. outgoing > >>>>>> requests. An > >>>>>> > >>>>>> authentication service may be implemented= either > >>>>>> as part of a user > >>>>>> > >>>>>> agent or as a proxy server; typically, it= is a > >>>>>> component of a network > >>>>>> > >>>>>> intermediary like a proxy to which origin= ating > >>>>>> user agents send > >>>>>> > >>>>>> unsigned requests. Once the sender of th= e > >>>>>> message has been > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> This document specifies a means of sharin= g a > >>>>>> cryptographic assurance > >>>>>> > >>>>>> of authenticity of and/or authorization t= o use > >>>>>> end-user SIP identity in an interdomain or intradomain con= text. > >>>>>> > >>>>>> It relies on the authentication service > >>>>>> constructing tokens based on [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> To maximize end-to-end security, it is ty= pically > >>>>>> obviously > >>>>>> > >>>>>> preferable for end-users to acquire their= own > >>>>>> credentials; if they > >>>>>> > >>>>>> do, their user agents can act as authenti= cation > >>>>>> services. However, > >>>>>> > >>>>>> for some deployments, [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> Regards, > >>>>>> > >>>>>> Alex > >>>>>> * * > >>>>>> *Alex Bobotek* > >>>>>> > >>>>>> > >>>>>> ____________________________________________= ___ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> ----------------------------------------------------------= ------- > >>>>>> ------- > >>>>>> > >>>>>> This e-mail may contain Sprint proprietary infor= mation > >>>>>> intended for the sole use of the recipient(s). A= ny use by > >>>>>> others is prohibited. If you are not the intende= d > >>>>>> recipient, please contact the sender and delete = all copies > >>>>>> of the message. > >>>>> > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> stir mailing list > >>>>> stir@ietf.org > >>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>> > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>> > >> > >> _______________________________________________ > >> stir mailing list > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir > > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > > > ________________________________ > > This e-mail may contain Sprint proprietary information intended for t= he sole use of the recipient(s). Any use by others is prohibited. If you are= not the intended recipient, please contact the sender and delete all copies= of the message. > =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Fri Aug 5 12:33:06 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F162E12D919 for ; Fri, 5 Aug 2016 12:33:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y1wXJCeW0YWz for ; Fri, 5 Aug 2016 12:33:01 -0700 (PDT) Received: from resqmta-ch2-11v.sys.comcast.net (resqmta-ch2-11v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 022AD12D61A for ; Fri, 5 Aug 2016 12:33:00 -0700 (PDT) Received: from resomta-ch2-13v.sys.comcast.net ([69.252.207.109]) by resqmta-ch2-11v.sys.comcast.net with SMTP id VkpibX6o6lSxsVkrcbQEj4; Fri, 05 Aug 2016 19:33:00 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VkrbbXXKlDgDkVkrbbUwaa; Fri, 05 Aug 2016 19:33:00 +0000 To: stir@ietf.org References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> From: Paul Kyzivat Message-ID: Date: Fri, 5 Aug 2016 15:32:58 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfLWq7Cu5CTIdcvre9Vnxp+h3ENUcfGDa8i+mPPcgnFoCRDbKf4yD8NOX5x4dthESLXtX0wSRIZA41226Va0xIzeYH+fwkMwZN8EVH9+0ekNq9Xrgx/Qv 51PYhZvJcN5XX4Gfj48IFW8T/s9XM0VYHpM157ek/Aav5B/igQfAJgxDnMkTOu3yvYjRBzkFV6l4bQ== Archived-At: Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 19:33:05 -0000 On 8/5/16 1:56 PM, Richard Shockey wrote: > > Don’t be so sure. If it’s a mobile device or perhaps cable you can bet the carrier will have some say in what is displayed on the UA. I said that is what I would *expect*. I also said "if the PAI is present". Of course the carrier can strip the PAI. (And *should* if the caller requested anonymity.) If the information is passed to the device, then AFAIK the user could install software that would be free to decide what to display. If the carrier is the supplier of the OS on the phone then it can try to "lock down" this aspect. But IIUC that is inconsistent with current practice. And it wouldn't apply to devices they don't manage, like Nexus phones. Thanks, Paul > On 8/5/16, 12:57 PM, "stir on behalf of Paul Kyzivat" wrote: > > If PAI is present and signed, and From is also signed, I would expect it > to be up to the UA to decide what to display, not the carrier. > > Of course this will work differently if there is a different signaling > regime between the carrier and the user device (e.g. black phone). > > Thanks, > Paul > > On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > > P-Asserted-Identity is supposed to operate "among trusted SIP entities" and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-Identity is stripped by border controller functions and is not to be used in inter-carrier inter-connection (although it commonly shows up anyway). My opinion is the "From" header is likely used more often for presentation. > > > > Pierce > > > > > > -----Original Message----- > > From: Richard Shockey [mailto:richard@shockey.us] > > Sent: August 05, 2016 9:37 AM > > To: Rosbotham, Paul, Vodafone UK ; Paul Kyzivat ; Brian Rosen > > Cc: stir@ietf.org > > Subject: Re: [stir] STIR 4474bis-10 comments > > > > > > Humm this is getting interesting. Its my understanding that the display number aka “presentation number” in the US context is the one carried in the PAI. Martin, Pierce? > > > > > > > > > > On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: > > > > Jumping in now that we're on European working time, +1 on Paul's observation. > > > > Here in the UK, we've got 2 numbers carried as calling line IDs....one (we term the Network Number, carried in PAID) uniquely identifies the line, the other (we term Presentation Number, carried in From) is used for display purposes. > > > > Only the carrier has the authority to set the Network Number so only they could sign it. > > > > But - subject to regulatory restrictions which are well documented - the number sent for display purposes belongs to the customer. For blue-chip customers, I can allow them to send their Presentation Numbers into the network, and can't readily check at a network level that they're theirs (I do have contractual safeguards). The number may have been allocated by me, or could be allocated by a third party provider. If it's a call-centre they'll be making outbound calls for lots of different customers which will change on day-by-day basis. This is business as usual. I don't like the term "authorised spoofing" because it implies that the CLI is in some way being rigged: it's not, it's the corporate customer or their subcontractor using the number that's been assigned (so in internet terms delegated) to them via a chain of trust from the regulator. > > > > What I want is the ability for customers to use their credentials to sign the CLIs they send me so that at the terminating end it can be checked (or indeed somewhere en-route if that's the business model). I can and would sign for customers on my mobile business since I'm driving what number is presented, but that's by-the-by because they aren't the ones who generate millions of nuisance calls. If the signing only occurs at the originating carrier level for corporate/call-centre customers that's no use because I'm not in a position to do that for these type of customers...and the whole system becomes a waste of time. I'd also highlight there are many more of my large customers that I'd trust more than a far end originating carrier that could be anywhere in the world (though we have no shortage of small carriers that I wouldn't know from Adam more locally in the UK....) > > > > Regards > > > > Paul > > > > -----Original Message----- > > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > > Sent: 04 August 2016 23:12 > > To: Brian Rosen > > Cc: stir@ietf.org > > Subject: Re: [stir] STIR 4474bis-10 comments > > > > On 8/4/16 6:02 PM, Brian Rosen wrote: > > > I think it's not a delegation. The mobile phone is not being delegated the TN, it's being authorized to place calls that are not from that TN, but appear to be. > > > > > > The mechanism to handle the credential is exactly the same as a delegation, so if you want to call it delegation, go ahead, but I prefer to call it authorized spoofing. > > > > IIUC the delegation is to a responsible entity (something that can be held legally accountable - e.g. a person), not to a device. The entity can then "use" the credential via any device(s) it chooses. In the case of the mobile, the device then becomes a two-line phone. > > > > Thanks, > > Paul > > > > > Brian > > > > > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: > > >> > > >> On 8/4/16 5:43 PM, Brian Rosen wrote: > > >>> In my jargon an "authorized spoofer" is the doctor who is calling > > >>> from his mobile, but sending the TN of his office phone as calling party. > > >>> The delegation to his office phone was made by his landline carrier > > >>> to him. He then creates another credential, which he signs with his > > >>> office phone credential that authorizes his mobile to send calls > > >>> from his office number. He is spoofing (because the call is coming > > >>> from his mobile's TN but claims to be from his office), but it's > > >>> authorized spoofing. The doc could give the credential to his > > >>> mobile SP if they sign on his behalf. > > >> > > >> I don't understand how that is different from regular delegation. > > >> > > >> When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. > > >> > > >> Thanks, > > >> Paul > > >> > > >>> Some folks don't like attaching the "spoofing" label to a legitimate use. > > >>> > > >>> But that's how I describe it. > > >>> > > >>> Brian > > >>> > > >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat > >>>> > wrote: > > >>>> > > >>>> +1, but with one question below: > > >>>> > > >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > > >>>>> I think all we need is to have credentials follow the delegation > > >>>>> path, > > >>>> > > >>>>> plus the option to add another level (not delegation) for > > >>>>> authorized spoofers. > > >>>> > > >>>> I don't understand "authorized spoofers" in this context, as > > >>>> contrasted to "spoofers" who have been delegated their authority. > > >>>> > > >>>> Thanks, > > >>>> Paul > > >>>> > > >>>>> I don't think it matters who the delegator or delegatee are as > > >>>>> long as the delegator is willing to take the heat for delegating > > >>>>> to someone who sends a lot of bad calls. They can pass the buck > > >>>>> ("I delegated the TN to him, and now I'm not responsible"), but > > >>>>> only if the SP knows who they delegated to, so authorities can > > >>>>> follow the delegation path. There are plenty of certificated > > >>>>> carriers who are willing to not care who they delegate to. The fact that there are some who do doesn't change much. > > >>>>> Making stir work means knowing who you are delegating to, so that > > >>>>> you can pass the hot potato. > > >>>>> > > >>>>> It's perfectly reasonable for a carrier to be able to sign for any > > >>>>> calls placed on its network on any number it has been delegated. > > >>>>> If it does, it's asserting that the calls are from who they are supposed to be from. > > >>>>> That should be straightforward, but we know it's not always, and > > >>>>> that represents the hard part of deployment in my opinion. But > > >>>>> once they delegate, they can hand responsibility to sign to the > > >>>>> delegatee. But, that only works if they know who they are delegating to. > > >>>>> > > >>>>> The root of the whole model is that there is a formal or informal > > >>>>> delegation path for telephone numbers in every country, and we can > > >>>>> build a chain of trust from that delegation path. If you propose > > >>>>> to alter that model, then we get into (policy) issues of which > > >>>>> carriers/entities we trust and which we don't. Our model is that > > >>>>> you know who you delegate to, and once you do that delegation, it's their problem. > > >>>>> That's pretty appealing I think, even if it's a change in some > > >>>>> business practices. > > >>>>> > > >>>>> The mechanism is chaining credentials in a form of a PKI and > > >>>>> having a way to know which TNs are covered by a credential. > > >>>>> That's what we have, and I'm loath to change it. > > >>>>> > > >>>>> Brian > > >>>>> > > >>>>> > > >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > > >>>>>> > > >>>>>> > > > >>>>>> wrote: > > >>>>>> > > >>>>>> OK, you talked me into indulging in one more message on policy > > >>>>>> and use cases. > > >>>>>> > > >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on > > >>>>>> individual devices as well as multi-device and multi-number platforms. > > >>>>>> > > >>>>>> Number delegation (and sub-delegation), and business > > >>>>>> relationships are two additional factors which affect > > >>>>>> trustworthiness of a given calling number authentication. > > >>>>>> > > >>>>>> Inherent variable trustworthiness of a calling number was my > > >>>>>> reason for suggesting a way to qualify the signature to reflect > > >>>>>> that variability. > > >>>>>> > > >>>>>> Originating carriers are in a position to know if a call is > > >>>>>> coming from a device assigned a single number, or from "trunk > > >>>>>> group" which could originate calls using multiple numbers, and > > >>>>>> can qualify to some degree the trustworthiness of number authenticity accordingly. > > >>>>>> > > >>>>>> My suggestion was qualifying calling number authenticity into > > >>>>>> categories of carrier-signed (or not), and unauthenticated, > > >>>>>> semi-authenticated, and most-authenticated. There can be more > > >>>>>> granularity, but it implies additional operational complexity > > >>>>>> (both for the carriers and the consumers) and I assume diminishes value. > > >>>>>> > > >>>>>> My reason for adding the authenticity of the originating carrier > > >>>>>> is typical trustworthiness of a carrier business relationship > > >>>>>> with typical consumers adds to the trustworthiness assessment and > > >>>>>> partially because carriers are a regulated point of forensic > > >>>>>> inquiry for CALEA and fraud. Additionally, most calls originate > > >>>>>> and terminate between mobile consumers where their carriers are > > >>>>>> able to usefully authenticate their device and have a high degree > > >>>>>> of confidence of the authenticity of the calling number. > > >>>>>> > > >>>>>> I think billions of per-TN certs of varying usability (revoked, > > >>>>>> not > > >>>>>> revoked) for authenticating calling number will not work well. > > >>>>>> > > >>>>>> Conversely, I think billions of per-TN certs will work well, if > > >>>>>> the calling party has to sign a call with a per-TN cert provided > > >>>>>> by the called party. No called party cert to include? Then the > > >>>>>> calling party does not have a trusted relationship with the > > >>>>>> called party, and the call can be authorized/treated accordingly. > > >>>>>> (I've made similar, mostly ignored comments in MODERN.) > > >>>>>> > > >>>>>> Pierce > > >>>>>> > > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > > >>>>>> *Sent:* August 04, 2016 2:03 PM > > >>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>> > > >>>>>> > > > >>>>>> *Cc:* Alex Bobotek > > >>>>>> >; stir@ietf.org > > >>>>>> > > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > > >>>>>> > > >>>>>> Well, the mechanisms are designed so that they could be deployed > > >>>>>> on devices and PBXs. Whether they will be is a policy issue. > > >>>>>> > > >>>>>> The notion of credentials that are traceable to a delegation of a > > >>>>>> TN is a mechanism that is part of the design of stir, and the > > >>>>>> design allows delegation of one TN (to one device, although a > > >>>>>> device like a PBX would have more than one TN per "device", and > > >>>>>> something like a dual NAM phone could have more than one > > >>>>>> credential. For the use case we've discussed, a mobile phone may > > >>>>>> also have a credential for, say, a TN that is delegated to a > > >>>>>> landline, to cover the example case of a doctor placing a call on > > >>>>>> his mobile, but getting his office number to show up as the calling party. Use of such mechanisms is policy. > > >>>>>> > > >>>>>> Brian > > >>>>>> > > >>>>>> > > >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > > >>>>>> > >>>>>> > > >>>>>> > > > >>>>>> wrote: > > >>>>>> > > >>>>>> Thanks Brian. I'm afraid we're straying into a policy > > >>>>>> discussion. Regardless, I do appreciate your explanation. I > > >>>>>> would like to continue the discussion, but I'm pretty sure this > > >>>>>> isn't the right forum. > > >>>>>> > > >>>>>> Pierce > > >>>>>> > > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > > >>>>>> *Sent:* August 04, 2016 1:34 PM > > >>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>> > > >>>>>> > > > >>>>>> *Cc:* Alex Bobotek > > >>>>>> >; stir@ietf.org > > >>>>>> > > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > > >>>>>> > > >>>>>> Of course I want PBXs to sign calls. As well as smart phones and > > >>>>>> any other devices that can be programmed to do so. > > >>>>>> They will be given credentials that only are valid for the TNs > > >>>>>> they are authorized to sign for. They can try to sign any call, > > >>>>>> but the validity of the credential would make such a signature > > >>>>>> fail the checking. > > >>>>>> > > >>>>>> Getting service providers to sign on behalf of devices is a > > >>>>>> reasonable way to deploy quickly, but I expect many SPs will want > > >>>>>> to get out of the liability of signing on behalf of their > > >>>>>> customers. If they can push of that responsibility to their > > >>>>>> customer, only being responsible for getting the customer an > > >>>>>> appropriate credential when they assign TNs, then I would expect > > >>>>>> them to want to do so. That means the devices have to be able to > > >>>>>> sign, but I understand many of the PBX vendors think that's > > >>>>>> something they could provide in a future release. > > >>>>>> > > >>>>>> Brian > > >>>>>> > > >>>>>> > > >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > > >>>>>> > >>>>>> > > > >>>>>> wrote: > > >>>>>> > > >>>>>> You want IP PBXes to sign calls? Won't that make it > > >>>>>> extraordinarily easy to commit fraud with authenticated numbers? > > >>>>>> > > >>>>>> > > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > > >>>>>> *Sent:* August 04, 2016 12:24 PM > > >>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>> > > >>>>>> > > > >>>>>> *Cc:* Alex Bobotek > > >>>>>> >; stir@ietf.org > > >>>>>> > > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > > >>>>>> > > >>>>>> First of all, we would want the PBX to generate the signature, > > >>>>>> but the service provider can do that. It should not add a > > >>>>>> valid signature to a call from a number it did not assign to > > >>>>>> the trunk group connecting to the PBX, although it could > > >>>>>> support the extra delegation required to support "authorized > > >>>>>> spoofing". The companion devices I'm aware of always send > > >>>>>> calls from the same service provider and should not present > > >>>>>> any issue. > > >>>>>> > > >>>>>> Everyone will have to do work they don't do now to implement > > >>>>>> stop spoofed calls. TANSTAAFL > > >>>>>> > > >>>>>> Brian > > >>>>>> > > >>>>>> > > >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] > > >>>>>> > > >>>>>> > wrote: > > >>>>>> > > >>>>>> Fraud from compromised PBXes is common. And even where a > > >>>>>> PBX is not compromised, a carrier has no practical way of > > >>>>>> knowing whether the calling number is properly assigned > > >>>>>> and valid from the perspective of the Enterprise. > > >>>>>> Therefore, checking whether the calling number was from an > > >>>>>> assigned range might be possible (and fraught with > > >>>>>> administrative challenges), but of limited value. And in > > >>>>>> the consumer market, there are calling products which > > >>>>>> support a parent subscriber number and "companion" devices > > >>>>>> (e.g., tablets) which can place a call using the MDN of > > >>>>>> the parent subscriber. These are examples of where the > > >>>>>> authenticity of the calling number won't necessarily mean > > >>>>>> the same thing as the authenticity of a call from a single > > >>>>>> subscriber with a single MDN regardless of "laxity" of > > >>>>>> spoof checking. > > >>>>>> > > >>>>>> In another forum and anticipating calling number > > >>>>>> authentication mandates from Congress and/or FCC, I > > >>>>>> suggested using carrier-specific certs and encoding > > >>>>>> specificity of authenticity, and calling number. This > > >>>>>> provides the identity of the originating carrier, some > > >>>>>> idea as to the accuracy or specificity of the calling > > >>>>>> number, and validty of the calling number (assuming nonce > > >>>>>> and replay issues can be addressed as reasonably suggested > > >>>>>> below by Alex). > > >>>>>> > > >>>>>> The representation of orig-carrier and trustworthiness > > >>>>>> could be as follows: > > >>>>>> > > >>>>>> *Regulated/mandated Carrier Class Use Case:* > > >>>>>> > > >>>>>> *00 - No Credentials* > > >>>>>> Use case example(s): Pre-IMS, legacy circuit-switched > > >>>>>> networks that don't natively support SIP or which don't > > >>>>>> choose to sign calls. E.g., international carriers. > > >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN > > >>>>>> entirely untrustworthy. > > >>>>>> > > >>>>>> *01 - Carrier signed, no authentication of CgPN* > > >>>>>> Use case example(s): E911 on visited network w/o roaming > > >>>>>> agreement, manual roaming. > > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely > > >>>>>> untrustworthy > > >>>>>> > > >>>>>> *10 - Carrier signed, semi-authenticated CgPN* > > >>>>>> Use case example(s): Number block delegated from OCN, but > > >>>>>> no per-TN screen (SIP trunks). > > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than > > >>>>>> most trustworthy but not entirely untrustworthy. > > >>>>>> > > >>>>>> *11 - Carrier signed, authenticated CgPN* > > >>>>>> Use case example(s): Bread-and-butter 95%+ of calls from > > >>>>>> subscriber lines (IMS-based and otherwise). > > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most > > >>>>>> trustworthy > > >>>>>> > > >>>>>> *Public Use Case:* > > >>>>>> > > >>>>>> Undefined but assumed to use public or commercially > > >>>>>> available authentication services resources. e.g., > > >>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. > > >>>>>> Could/would pass credentials down to SIP-aware devices > > >>>>>> which would process them according to the rules of the > > >>>>>> Public Class application(s). > > >>>>>> > > >>>>>> Pierce > > >>>>>> > > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > > >>>>>> *Sent:* August 04, 2016 9:02 AM > > >>>>>> *To:* Alex Bobotek > >>>>>> > > >>>>>> > > > >>>>>> *Cc:* stir@ietf.org > > >>>>>> > > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > > >>>>>> > > >>>>>> There are reasonable circumstances where a party placing a > > >>>>>> call is not the authorized entity assigned the telephone > > >>>>>> number used in From/PAI, and in such circumstances the > > >>>>>> service provider servicing the entity placing the call may > > >>>>>> or may not be the same as the service provider serving the > > >>>>>> entity that is assigned the TN. In all such cases, the > > >>>>>> entity that is assigned the TN explicitly authorizes calls > > >>>>>> placed using it's TN. The design accommodates such use > > >>>>>> cases. It's not a blanket authorization without > > >>>>>> authentication. We're not aware of any cases where there > > >>>>>> is an actual requirement for legitimate calling without > > >>>>>> explicit authorization from the assigned entity, although > > >>>>>> we certainly are aware that various parts of various > > >>>>>> service providers don't bother to check. At this point, at > > >>>>>> least in some countries, there is a realization that the > > >>>>>> laxity of allowing unchecked spoofing is not acceptable > > >>>>>> any more. > > >>>>>> > > >>>>>> Brian > > >>>>>> > > >>>>>> > > >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > > >>>>>> > >>>>>> > wrote: > > >>>>>> > > >>>>>> 1. Permit authorization without authentication > > >>>>>> In the current telephony network practice, some > > >>>>>> service provider implementations choose not to > > >>>>>> authenticate identity, but simply facilitate the use > > >>>>>> of an arbitrary or selected user-provided identity. > > >>>>>> Are there legitimate use cases for this? Has anyone > > >>>>>> established that there are not? How can the industry > > >>>>>> reasonably expect to end this (often bad) practice? > > >>>>>> If it can't be ended, there's value in at least > > >>>>>> identifying the originating service provider > > >>>>>> (i.e., the signer/authorizer). Given the prevalence > > >>>>>> of abuse using telephone numbers assigned to a > > >>>>>> sometimes-anonymous abuser, it becomes critically > > >>>>>> important to identify the service provider(s) closest > > >>>>>> to the abuser. Based on the assumption that it's > > >>>>>> better to ID service providers than unreasonably > > >>>>>> expect a ban of the use of unauthenticated (and > > >>>>>> therefore unsigned) SIP requests, STIR signing should > > >>>>>> support authorization without authentication. The > > >>>>>> practice of authorizing unauthenticated use exists, > > >>>>>> and there is benefit to signing in these cases > > >>>>>> (service provider identification). The language of > > >>>>>> the ID should permit this use. 4474bis-10 should NOT > > >>>>>> require or assume that that authentication will > > >>>>>> precede authorization. Of course there may be other > > >>>>>> use cases where signing includes authentication and > > >>>>>> may not include a specific service provider's > > >>>>>> authorization. > > >>>>>> > > >>>>>> > > >>>>>> 2. Improve replay prevention > > >>>>>> Proximate replay is possible while complying with this > > >>>>>> spec. First, one or more proximate (e.g., within 60 > > >>>>>> seconds) SIP requests using the same token are legal > > >>>>>> and subject to replay in many cases. An SDP body's > > >>>>>> mky may not be present and if present its use is > > >>>>>> optional. Some sort of mandatory new or existing > > >>>>>> signed sequence, random # or request ID (e.g., Call-ID > > >>>>>> or CSeq) and a 1-time use policy on the receiving end > > >>>>>> of the request (e.g., tokens only good for 1 > > >>>>>> use) could prevent replay. Different methods (e.g., > > >>>>>> INVITE vs MESSAGE) might be handled by different > > >>>>>> receiving infrastructure, and therefore difficulties > > >>>>>> with 'it's been used already' coordination allow a > > >>>>>> faked MESSAGE based on a captured request. This might > > >>>>>> include an mkey from a captured INVITE. So it may be > > >>>>>> possible to DOS, spam or text-bomb a recipient using a > > >>>>>> captured identity. While large-scale or distributed > > >>>>>> implementations may make the enforcement difficult, > > >>>>>> there is little cost to signing and decoding a method > > >>>>>> and possibly a numeric ID. Some sort of '1-use' > > >>>>>> practice should at least be discussed while perhaps > > >>>>>> not required. > > >>>>>> > > >>>>>> > > >>>>>> Specific markup suggestions: > > >>>>>> > > >>>>>> > > >>>>>> NITS > > >>>>>> > > >>>>>> > > >>>>>> The verifier MUST inspect any optional "ppt" > > >>>>>> parameter appearing *in*the > > >>>>>> > > >>>>>> Identity request. If no "ppt" parameter is > > >>>>>> present, then the > > >>>>>> > > >>>>>> verifier proceeds normally below. If a "ppt" > > >>>>>> parameter value is > > >>>>>> > > >>>>>> present, and the verifier does not support it, > > >>>>>> it MUST ignore the > > >>>>>> > > >>>>>> Identity header. If a supported "ppt" parameter > > >>>>>> value is present, > > >>>>>> > > >>>>>> the verifier follows the procedures below, > > >>>>>> including the variations > > >>>>>> > > >>>>>> described in Step 5. > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> 3 > > >>>>>> . > > >>>>>> Background > > >>>>>> > > >>>>>> [...] > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> Per [RFC7340 > > >>>>>> ], problems such as > > >>>>>> robocalling, voicemail hacking, and > > >>>>>> > > >>>>>> swatting are enabled by an attacker's ability to > > >>>>>> impersonate someone > > >>>>>> > > >>>>>> else. The secure operation of most SIP > > >>>>>> applications and services > > >>>>>> > > >>>>>> depends on authenticating and/or authorizing the > > >>>>>> source of communications as it is > > >>>>>> > > >>>>>> represented in a SIP request. > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> This identity architecture for SIP depends on > > >>>>>> includes provisions for a logical > > >>>>>> > > >>>>>> "authentication service" which validates caller > > >>>>>> identity at or near origination. outgoing > > >>>>>> requests. An > > >>>>>> > > >>>>>> authentication service may be implemented either > > >>>>>> as part of a user > > >>>>>> > > >>>>>> agent or as a proxy server; typically, it is a > > >>>>>> component of a network > > >>>>>> > > >>>>>> intermediary like a proxy to which originating > > >>>>>> user agents send > > >>>>>> > > >>>>>> unsigned requests. Once the sender of the > > >>>>>> message has been > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> This document specifies a means of sharing a > > >>>>>> cryptographic assurance > > >>>>>> > > >>>>>> of authenticity of and/or authorization to use > > >>>>>> end-user SIP identity in an interdomain or intradomain context. > > >>>>>> > > >>>>>> It relies on the authentication service > > >>>>>> constructing tokens based on [...] > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> To maximize end-to-end security, it is typically > > >>>>>> obviously > > >>>>>> > > >>>>>> preferable for end-users to acquire their own > > >>>>>> credentials; if they > > >>>>>> > > >>>>>> do, their user agents can act as authentication > > >>>>>> services. However, > > >>>>>> > > >>>>>> for some deployments, [...] > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> Regards, > > >>>>>> > > >>>>>> Alex > > >>>>>> * * > > >>>>>> *Alex Bobotek* > > >>>>>> > > >>>>>> > > >>>>>> _______________________________________________ > > >>>>>> stir mailing list > > >>>>>> stir@ietf.org > > >>>>>> > > >>>>>> https://www.ietf.org/mailman/listinfo/stir > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> ----------------------------------------------------------------- > > >>>>>> ------- > > >>>>>> > > >>>>>> This e-mail may contain Sprint proprietary information > > >>>>>> intended for the sole use of the recipient(s). Any use by > > >>>>>> others is prohibited. If you are not the intended > > >>>>>> recipient, please contact the sender and delete all copies > > >>>>>> of the message. > > >>>>> > > >>>>> > > >>>>> > > >>>>> _______________________________________________ > > >>>>> stir mailing list > > >>>>> stir@ietf.org > > >>>>> https://www.ietf.org/mailman/listinfo/stir > > >>>>> > > >>>> > > >>>> _______________________________________________ > > >>>> stir mailing list > > >>>> stir@ietf.org > > >>>> https://www.ietf.org/mailman/listinfo/stir > > >>> > > >> > > >> _______________________________________________ > > >> stir mailing list > > >> stir@ietf.org > > >> https://www.ietf.org/mailman/listinfo/stir > > > > > > > > > > _______________________________________________ > > stir mailing list > > stir@ietf.org > > https://www.ietf.org/mailman/listinfo/stir > > > > _______________________________________________ > > stir mailing list > > stir@ietf.org > > https://www.ietf.org/mailman/listinfo/stir > > > > > > > > > > > > ________________________________ > > > > This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Fri Aug 5 12:35:50 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70E9512D78F for ; Fri, 5 Aug 2016 12:35:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nv7wsvLcOuAs for ; Fri, 5 Aug 2016 12:35:46 -0700 (PDT) Received: from resqmta-ch2-11v.sys.comcast.net (resqmta-ch2-11v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4566312D0AD for ; Fri, 5 Aug 2016 12:35:46 -0700 (PDT) Received: from resomta-ch2-14v.sys.comcast.net ([69.252.207.110]) by resqmta-ch2-11v.sys.comcast.net with SMTP id VktubX7AOlSxsVkuHbQFIr; Fri, 05 Aug 2016 19:35:45 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VkuGbJNwoLiaBVkuGbmVDk; Fri, 05 Aug 2016 19:35:45 +0000 To: "DOLLY, MARTIN C" , "Gorman, Pierce A [CTO]" References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> From: Paul Kyzivat Message-ID: <80efb4d4-b75a-5c10-8068-1d7518a33c06@alum.mit.edu> Date: Fri, 5 Aug 2016 15:35:43 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfDzyNVfgJpj6/XWN84/sAJnYOpeb6fbfPC+SoSmUmXDaTpFUjH4NjHQB2StlNfndswEITocCx5/LuZ2rnIkLJFnpim2AACzN1o1ls00mxVnhJDxudJrF C3mIBrkOZZV8yMXJQy+lQYgYJS7ZJWZrG5QxQOXQcJ37ikK31wRcXM+5IU3Qaekf5HQYnBiq3PK7hQRJ3OIu5o4Bw3/6Nxh3xIz7DPcxYTvapuSHmvQYCYZE fIQr9j/SdpM8Q3kVnsMwmJ98A9tb371htkmi2txAFtkBS4iHhv0w8rgmw8IdJwKw5x4uud/vo6s73AzCcaMQwb0UnMPZT39aoaC6cebHfDh2V1TJQhPTJxdh fwRWPqRw Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 19:35:49 -0000 On 8/5/16 1:54 PM, DOLLY, MARTIN C wrote: > PAI is not stripped at the network boundary between trusted networks > 3GPP TS 29.195 > Atis specs > GSMA > Atis sip forum task force > ITU > And the list goes on Is there any reason to strip it at an *untrusted* boundary? (Yes, there *is* a reason to do so if the caller requested anonymity. But other than that.) Leaving it in provides the recipient with useful information. Thanks, Paul > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards > AT&T > Cell: 609-903-3360 > Email: md3135@att.com > >> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: >> >> Which header the carrier chooses to display is moot if the header is stripped between carriers as per at least one standard. I think Paul Rosbotham's observation we're likely to encounter "some interesting interworking challenges" was perhaps the understatement of the year. >> >> Pierce >> >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: August 05, 2016 11:58 AM >> To: Gorman, Pierce A [CTO] ; Richard Shockey ; Rosbotham, Paul, Vodafone UK ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> If PAI is present and signed, and From is also signed, I would expect it to be up to the UA to decide what to display, not the carrier. >> >> Of course this will work differently if there is a different signaling regime between the carrier and the user device (e.g. black phone). >> >> Thanks, >> Paul >> >>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>> P-Asserted-Identity is supposed to operate "among trusted SIP entities" and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-Identity is stripped by border controller functions and is not to be used in inter-carrier inter-connection (although it commonly shows up anyway). My opinion is the "From" header is likely used more often for presentation. >>> >>> Pierce >>> >>> >>> -----Original Message----- >>> From: Richard Shockey [mailto:richard@shockey.us] >>> Sent: August 05, 2016 9:37 AM >>> To: Rosbotham, Paul, Vodafone UK ; Paul >>> Kyzivat ; Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> >>> Humm this is getting interesting. Its my understanding that the display number aka presentation number in the US context is the one carried in the PAI. Martin, Pierce? >>> >>> >>> >>> >>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>> >>> Jumping in now that we're on European working time, +1 on Paul's observation. >>> >>> Here in the UK, we've got 2 numbers carried as calling line IDs....one (we term the Network Number, carried in PAID) uniquely identifies the line, the other (we term Presentation Number, carried in From) is used for display purposes. >>> >>> Only the carrier has the authority to set the Network Number so only they could sign it. >>> >>> But - subject to regulatory restrictions which are well documented - the number sent for display purposes belongs to the customer. For blue-chip customers, I can allow them to send their Presentation Numbers into the network, and can't readily check at a network level that they're theirs (I do have contractual safeguards). The number may have been allocated by me, or could be allocated by a third party provider. If it's a call-centre they'll be making outbound calls for lots of different customers which will change on day-by-day basis. This is business as usual. I don't like the term "authorised spoofing" because it implies that the CLI is in some way being rigged: it's not, it's the corporate customer or their subcontractor using the number that's been assigned (so in internet terms delegated) to them via a chain of trust from the regulator. >>> >>> What I want is the ability for customers to use their credentials >>> to sign the CLIs they send me so that at the terminating end it can be >>> checked (or indeed somewhere en-route if that's the business model). >>> I can and would sign for customers on my mobile business since I'm >>> driving what number is presented, but that's by-the-by because they >>> aren't the ones who generate millions of nuisance calls. If the >>> signing only occurs at the originating carrier level for >>> corporate/call-centre customers that's no use because I'm not in a >>> position to do that for these type of customers...and the whole system >>> becomes a waste of time. I'd also highlight there are many more of my >>> large customers that I'd trust more than a far end originating carrier >>> that could be anywhere in the world (though we have no shortage of >>> small carriers that I wouldn't know from Adam more locally in the >>> UK....) >>> >>> Regards >>> >>> Paul >>> >>> -----Original Message----- >>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >>> Sent: 04 August 2016 23:12 >>> To: Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>> I think it's not a delegation. The mobile phone is not being delegated the TN, it's being authorized to place calls that are not from that TN, but appear to be. >>>> >>>> The mechanism to handle the credential is exactly the same as a delegation, so if you want to call it delegation, go ahead, but I prefer to call it authorized spoofing. >>> >>> IIUC the delegation is to a responsible entity (something that can be held legally accountable - e.g. a person), not to a device. The entity can then "use" the credential via any device(s) it chooses. In the case of the mobile, the device then becomes a two-line phone. >>> >>> Thanks, >>> Paul >>> >>>> Brian >>>> >>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: >>>>> >>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>> In my jargon an "authorized spoofer" is the doctor who is calling >>>>>> from his mobile, but sending the TN of his office phone as calling party. >>>>>> The delegation to his office phone was made by his landline carrier >>>>>> to him. He then creates another credential, which he signs with his >>>>>> office phone credential that authorizes his mobile to send calls >>>>>> from his office number. He is spoofing (because the call is coming >>>>>> from his mobile's TN but claims to be from his office), but it's >>>>>> authorized spoofing. The doc could give the credential to his >>>>>> mobile SP if they sign on his behalf. >>>>> >>>>> I don't understand how that is different from regular delegation. >>>>> >>>>> When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. >>>>> >>>>> Thanks, >>>>> Paul >>>>> >>>>>> Some folks don't like attaching the "spoofing" label to a legitimate use. >>>>>> >>>>>> But that's how I describe it. >>>>>> >>>>>> Brian >>>>>> >>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>> > wrote: >>>>>>> >>>>>>> +1, but with one question below: >>>>>>> >>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>> I think all we need is to have credentials follow the delegation >>>>>>>> path, >>>>>>> >>>>>>>> plus the option to add another level (not delegation) for >>>>>>>> authorized spoofers. >>>>>>> >>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>> >>>>>>> Thanks, >>>>>>> Paul >>>>>>> >>>>>>>> I don't think it matters who the delegator or delegatee are as >>>>>>>> long as the delegator is willing to take the heat for delegating >>>>>>>> to someone who sends a lot of bad calls. They can pass the buck >>>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but >>>>>>>> only if the SP knows who they delegated to, so authorities can >>>>>>>> follow the delegation path. There are plenty of certificated >>>>>>>> carriers who are willing to not care who they delegate to. The fact that there are some who do doesn't change much. >>>>>>>> Making stir work means knowing who you are delegating to, so that >>>>>>>> you can pass the hot potato. >>>>>>>> >>>>>>>> It's perfectly reasonable for a carrier to be able to sign for any >>>>>>>> calls placed on its network on any number it has been delegated. >>>>>>>> If it does, it's asserting that the calls are from who they are supposed to be from. >>>>>>>> That should be straightforward, but we know it's not always, and >>>>>>>> that represents the hard part of deployment in my opinion. But >>>>>>>> once they delegate, they can hand responsibility to sign to the >>>>>>>> delegatee. But, that only works if they know who they are delegating to. >>>>>>>> >>>>>>>> The root of the whole model is that there is a formal or informal >>>>>>>> delegation path for telephone numbers in every country, and we can >>>>>>>> build a chain of trust from that delegation path. If you propose >>>>>>>> to alter that model, then we get into (policy) issues of which >>>>>>>> carriers/entities we trust and which we don't. Our model is that >>>>>>>> you know who you delegate to, and once you do that delegation, it's their problem. >>>>>>>> That's pretty appealing I think, even if it's a change in some >>>>>>>> business practices. >>>>>>>> >>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> OK, you talked me into indulging in one more message on policy >>>>>>>>> and use cases. >>>>>>>>> >>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>>>>>> individual devices as well as multi-device and multi-number platforms. >>>>>>>>> >>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>> relationships are two additional factors which affect >>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>> >>>>>>>>> Inherent variable trustworthiness of a calling number was my >>>>>>>>> reason for suggesting a way to qualify the signature to reflect >>>>>>>>> that variability. >>>>>>>>> >>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>> coming from a device assigned a single number, or from "trunk >>>>>>>>> group" which could originate calls using multiple numbers, and >>>>>>>>> can qualify to some degree the trustworthiness of number authenticity accordingly. >>>>>>>>> >>>>>>>>> My suggestion was qualifying calling number authenticity into >>>>>>>>> categories of carrier-signed (or not), and unauthenticated, >>>>>>>>> semi-authenticated, and most-authenticated. There can be more >>>>>>>>> granularity, but it implies additional operational complexity >>>>>>>>> (both for the carriers and the consumers) and I assume diminishes value. >>>>>>>>> >>>>>>>>> My reason for adding the authenticity of the originating carrier >>>>>>>>> is typical trustworthiness of a carrier business relationship >>>>>>>>> with typical consumers adds to the trustworthiness assessment and >>>>>>>>> partially because carriers are a regulated point of forensic >>>>>>>>> inquiry for CALEA and fraud. Additionally, most calls originate >>>>>>>>> and terminate between mobile consumers where their carriers are >>>>>>>>> able to usefully authenticate their device and have a high degree >>>>>>>>> of confidence of the authenticity of the calling number. >>>>>>>>> >>>>>>>>> I think billions of per-TN certs of varying usability (revoked, >>>>>>>>> not >>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>> >>>>>>>>> Conversely, I think billions of per-TN certs will work well, if >>>>>>>>> the calling party has to sign a call with a per-TN cert provided >>>>>>>>> by the called party. No called party cert to include? Then the >>>>>>>>> calling party does not have a trusted relationship with the >>>>>>>>> called party, and the call can be authorized/treated accordingly. >>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> Well, the mechanisms are designed so that they could be deployed >>>>>>>>> on devices and PBXs. Whether they will be is a policy issue. >>>>>>>>> >>>>>>>>> The notion of credentials that are traceable to a delegation of a >>>>>>>>> TN is a mechanism that is part of the design of stir, and the >>>>>>>>> design allows delegation of one TN (to one device, although a >>>>>>>>> device like a PBX would have more than one TN per "device", and >>>>>>>>> something like a dual NAM phone could have more than one >>>>>>>>> credential. For the use case we've discussed, a mobile phone may >>>>>>>>> also have a credential for, say, a TN that is delegated to a >>>>>>>>> landline, to cover the example case of a doctor placing a call on >>>>>>>>> his mobile, but getting his office number to show up as the calling party. Use of such mechanisms is policy. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>> >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>>>> isn't the right forum. >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> Of course I want PBXs to sign calls. As well as smart phones and >>>>>>>>> any other devices that can be programmed to do so. >>>>>>>>> They will be given credentials that only are valid for the TNs >>>>>>>>> they are authorized to sign for. They can try to sign any call, >>>>>>>>> but the validity of the credential would make such a signature >>>>>>>>> fail the checking. >>>>>>>>> >>>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>>> reasonable way to deploy quickly, but I expect many SPs will want >>>>>>>>> to get out of the liability of signing on behalf of their >>>>>>>>> customers. If they can push of that responsibility to their >>>>>>>>> customer, only being responsible for getting the customer an >>>>>>>>> appropriate credential when they assign TNs, then I would expect >>>>>>>>> them to want to do so. That means the devices have to be able to >>>>>>>>> sign, but I understand many of the PBX vendors think that's >>>>>>>>> something they could provide in a future release. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>> extraordinarily easy to commit fraud with authenticated numbers? >>>>>>>>> >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> First of all, we would want the PBX to generate the signature, >>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>> support the extra delegation required to support "authorized >>>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>>> calls from the same service provider and should not present >>>>>>>>> any issue. >>>>>>>>> >>>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > wrote: >>>>>>>>> >>>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>>> knowing whether the calling number is properly assigned >>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>> Therefore, checking whether the calling number was from an >>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>> administrative challenges), but of limited value. And in >>>>>>>>> the consumer market, there are calling products which >>>>>>>>> support a parent subscriber number and "companion" devices >>>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>>> the parent subscriber. These are examples of where the >>>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>>> the same thing as the authenticity of a call from a single >>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>> spoof checking. >>>>>>>>> >>>>>>>>> In another forum and anticipating calling number >>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>>> and replay issues can be addressed as reasonably suggested >>>>>>>>> below by Alex). >>>>>>>>> >>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>> could be as follows: >>>>>>>>> >>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>> >>>>>>>>> *00 - No Credentials* >>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>> networks that don't natively support SIP or which don't >>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>> entirely untrustworthy. >>>>>>>>> >>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>>> agreement, manual roaming. >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>>> untrustworthy >>>>>>>>> >>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>> >>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>> trustworthy >>>>>>>>> >>>>>>>>> *Public Use Case:* >>>>>>>>> >>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>> available authentication services resources. e.g., >>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>>> which would process them according to the rules of the >>>>>>>>> Public Class application(s). >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>> *To:* Alex Bobotek >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> There are reasonable circumstances where a party placing a >>>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>>> service provider servicing the entity placing the call may >>>>>>>>> or may not be the same as the service provider serving the >>>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>>> entity that is assigned the TN explicitly authorizes calls >>>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>> authentication. We're not aware of any cases where there >>>>>>>>> is an actual requirement for legitimate calling without >>>>>>>>> explicit authorization from the assigned entity, although >>>>>>>>> we certainly are aware that various parts of various >>>>>>>>> service providers don't bother to check. At this point, at >>>>>>>>> least in some countries, there is a realization that the >>>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>>> any more. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>> >>>>>>>> > wrote: >>>>>>>>> >>>>>>>>> 1. Permit authorization without authentication >>>>>>>>> In the current telephony network practice, some >>>>>>>>> service provider implementations choose not to >>>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>>> established that there are not? How can the industry >>>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>> identifying the originating service provider >>>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>> important to identify the service provider(s) closest >>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>> better to ID service providers than unreasonably >>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>>> support authorization without authentication. The >>>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>>> and there is benefit to signing in these cases >>>>>>>>> (service provider identification). The language of >>>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>>> require or assume that that authentication will >>>>>>>>> precede authorization. Of course there may be other >>>>>>>>> use cases where signing includes authentication and >>>>>>>>> may not include a specific service provider's >>>>>>>>> authorization. >>>>>>>>> >>>>>>>>> >>>>>>>>> 2. Improve replay prevention >>>>>>>>> Proximate replay is possible while complying with this >>>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>>> mky may not be present and if present its use is >>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>> signed sequence, random # or request ID (e.g., Call-ID >>>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>>> include an mkey from a captured INVITE. So it may be >>>>>>>>> possible to DOS, spam or text-bomb a recipient using a >>>>>>>>> captured identity. While large-scale or distributed >>>>>>>>> implementations may make the enforcement difficult, >>>>>>>>> there is little cost to signing and decoding a method >>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>> practice should at least be discussed while perhaps >>>>>>>>> not required. >>>>>>>>> >>>>>>>>> >>>>>>>>> Specific markup suggestions: >>>>>>>>> >>>>>>>>> >>>>>>>>> NITS >>>>>>>>> >>>>>>>>> >>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>> parameter appearing *in*the >>>>>>>>> >>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>> present, then the >>>>>>>>> >>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>> parameter value is >>>>>>>>> >>>>>>>>> present, and the verifier does not support it, >>>>>>>>> it MUST ignore the >>>>>>>>> >>>>>>>>> Identity header. If a supported "ppt" parameter >>>>>>>>> value is present, >>>>>>>>> >>>>>>>>> the verifier follows the procedures below, >>>>>>>>> including the variations >>>>>>>>> >>>>>>>>> described in Step 5. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> 3 >>>>>>>>> . >>>>>>>>> Background >>>>>>>>> >>>>>>>>> [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Per [RFC7340 >>>>>>>>> ], problems such as >>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>> >>>>>>>>> swatting are enabled by an attacker's ability to >>>>>>>>> impersonate someone >>>>>>>>> >>>>>>>>> else. The secure operation of most SIP >>>>>>>>> applications and services >>>>>>>>> >>>>>>>>> depends on authenticating and/or authorizing the >>>>>>>>> source of communications as it is >>>>>>>>> >>>>>>>>> represented in a SIP request. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> This identity architecture for SIP depends on >>>>>>>>> includes provisions for a logical >>>>>>>>> >>>>>>>>> "authentication service" which validates caller >>>>>>>>> identity at or near origination. outgoing >>>>>>>>> requests. An >>>>>>>>> >>>>>>>>> authentication service may be implemented either >>>>>>>>> as part of a user >>>>>>>>> >>>>>>>>> agent or as a proxy server; typically, it is a >>>>>>>>> component of a network >>>>>>>>> >>>>>>>>> intermediary like a proxy to which originating >>>>>>>>> user agents send >>>>>>>>> >>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>> message has been >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> This document specifies a means of sharing a >>>>>>>>> cryptographic assurance >>>>>>>>> >>>>>>>>> of authenticity of and/or authorization to use >>>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>> >>>>>>>>> It relies on the authentication service >>>>>>>>> constructing tokens based on [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> To maximize end-to-end security, it is typically >>>>>>>>> obviously >>>>>>>>> >>>>>>>>> preferable for end-users to acquire their own >>>>>>>>> credentials; if they >>>>>>>>> >>>>>>>>> do, their user agents can act as authentication >>>>>>>>> services. However, >>>>>>>>> >>>>>>>>> for some deployments, [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> >>>>>>>>> Alex >>>>>>>>> * * >>>>>>>>> *Alex Bobotek* >>>>>>>>> >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> ----------------------------------------------------------------- >>>>>>>>> ------- >>>>>>>>> >>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>> recipient, please contact the sender and delete all copies >>>>>>>>> of the message. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >>> >>> >>> >>> >>> ________________________________ >>> >>> This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > From nobody Fri Aug 5 12:51:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E686012D18A for ; Fri, 5 Aug 2016 12:51:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qpSQJz-HxGrz for ; Fri, 5 Aug 2016 12:51:22 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0101.outbound.protection.outlook.com [104.47.40.101]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1CAA12B01B for ; Fri, 5 Aug 2016 12:51:21 -0700 (PDT) Received: from BN1AFFO11FD030.protection.gbl (10.58.52.33) by BN1AFFO11HUB036.protection.gbl (10.58.52.147) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.5; Fri, 5 Aug 2016 19:51:19 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.80) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.80 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.80; helo=preapdm1.corp.sprint.com; Received: from preapdm1.corp.sprint.com (144.230.32.80) by BN1AFFO11FD030.mail.protection.outlook.com (10.58.52.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Fri, 5 Aug 2016 19:51:19 +0000 Received: from pps.filterd (preapdm1.corp.sprint.com [127.0.0.1]) by preapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u75Jlx42026122; Fri, 5 Aug 2016 15:51:19 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm1.corp.sprint.com with ESMTP id 24grqewwep-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 05 Aug 2016 15:51:19 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 5 Aug 2016 14:51:18 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Fri, 5 Aug 2016 14:51:18 -0500 From: "Gorman, Pierce A [CTO]" To: Paul Kyzivat , "stir@ietf.org" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA6wkEA Date: Fri, 5 Aug 2016 19:51:17 +0000 Message-ID: <8ad4ea85dcfe41bcbb516d4f66fcf6ce@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.123.104.22] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.80; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(13464003)(189002)(24454002)(199003)(377454003)(24736003)(33646002)(102836003)(47776003)(6116002)(108616004)(3846002)(86362001)(106116001)(2501003)(106466001)(19580395003)(2171001)(5890100001)(87936001)(7846002)(19580405001)(93886004)(54356999)(50466002)(2950100001)(586003)(2906002)(305945005)(97736004)(68736007)(81166006)(2900100001)(15975445007)(7696003)(50986999)(5001770100001)(81156014)(11100500001)(92566002)(76176999)(8676002)(189998001)(356003)(107886002)(8936002)(23676002)(5250100002)(7736002)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB036; H:preapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD030; 1:dW+U1ayZcjGyWR1Bt8QSiRX2xKGH8rKazYoNnaVHBDL0MsSGbyXuTI0kznHXtd35QJDD95DHlbvhYXLbkr5/+mJ2R0pKPwuTlQws0A6FTGxVETy3KBH1cZ81e4JCdW5Jb5UM7dBKTjhPKWf/r/rm1jcbTJ2+BXaXY4Thm2Bex17OtxjNZBMOpo+bAqujvXZ5FGMoppmKAFx176T3toCDsyMQ3wOHhRJk3owPHwY52KCiZ900xtYqip4oktQlnOYLPqjd89SL0RWkOFVIRFgrL8BIUUMDqF5U9OO4BG9rBBedy37ifZeObHVqL3gjX2051t7dQjcW1U4bqEtbzVx/PPN4vqiXZp6UOoQjiaojcNWKRuBy2WugqB8QUb6l0CP8/keUN1XIbuyCu0N+STbvyrj/kP6Z+HnbmS9fGwe/47WZmiPDntjKHfrqNcDpVPgSz66bR0WOIwevEJlbv9B/GiV9M8Qt5K0p6Cd1H4eCN5eKaSucAoetN8Qz3U9i7lYSsc9z9aIDkPmamZlzlQe9jO23Jh/P/CiO/l40mTNTmG0Ur8g76B9M+y31YwdjicikEt/CUmWUmNlPdYH9kXOlHQ== X-MS-Office365-Filtering-Correlation-Id: 120c3ab6-60e7-4b06-9b1d-08d3bd69def8 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB036; 2:UaYGogn2mjWxFJJ5Oj3Q0TCeCDy3AQhXyn/VfUnncpODa/4zpu+J4KV4flLvs41KADAjR9D64KXVygm+uFl0CreeHQki4X515oXvMrhR/V5oprD7iSIF14SYlTjmLruBwjZEQdUpoyvMGgukpYMv1r74ehZMAtgBFioeb6G5cKVp2aiIjPZ52KhzYIT9Q8fU; 3:7QT6t6XdWtiaFC8ouChUrY/5vJWD8i1MNXqQr1Y8Wc+SHIgKahLN4+SqzWmYGqgcrOEwVmeuN7d51t57e5Zf+amHlDCSR4MYlBO1H2Jx09jiagQ/lCvOSjfBHvqhuq5tLgpxMqAdwwpUC53+dYjqf6bpKVRc8xwxq4c91/k7SK9rEXj4bzcyv0PTXFkjtfEg8yzDYfOrdMQ7GkTbUn+jIcs4mVHxTb+6eWzJ0aLhZiC3E8lAKsfx1wH75YOTdH62L8Tu4R78X/XSGs08vzLzpw==; 25:FhKd6vOhvhV6RLk3wmrq324Mr3KA3pfpEClwk2ekn8gKmdvQYSbcqy444iXhDvFiYmeMHsAVQkJT2a+qgj/WOa9nhUA5Cbk9oBZVb7gHA/K9kBEGsgu4xBgVgtVdbLDJgGp6nCpJ/ox93JPAn7vt2WAwQtafmkhq0Z5PC57j7cerM41Ben8qkqPITh3cIyt6OgpsryWOwlLRbjWz/JrmISWjC+dFG8xRbbRF3TyJ+2Nev+fqMjfTf3QaEKAhZOpMAXmo5L0Bv1dLYZHNxu7yquFQQ+mm7z5Jf0PmnwFngj0VkZS4wZgcYPZrrKX1RuEbCHZ/aXTaYQpFJeAydIwRYerBERRymU0cteUMQ8kuWryFffC93OT1ldtrkmrtrMGQ/KcgCvttwuq3aPUClzXPAUcAKd2oMEiKqTnmk8wuq+f5zNuecUAzn/oUcrWeXHfn X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB036; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB036; 31:z/iUrtZUlxhtQDBijaTgstpXJBvlrc7Vh2jDUVKScLejvwWCrETPpkc3zkMQ7iDDibiS2eMLUdYSeiLnEsQ9tCjVT2GvreL4GiaaB8iMSVpco2MMLQCVKfalZjkwpx25Xs94mCzs2iIOvbfQGjSXMHsT19ouEipMKsYnBRSmnMQ4O5hkDoHX8lc+jr1TVV3u3CRhlaNaukb5gLFhCA2ihs+/lxq9MZmJfgAQnGrirmk=; 20:yQnSCzLsrzuRscZYMmlHFU3hmviSlY61pjK97VBGUcjgor4aTGTCzLOpFREuokTg1ctbjku1+ol1W7nb9vSzfVajRC7B3CPSHyum2d13+vKRw4dCbw/CcxyelYebgtTdQVgycn6s0GU/sFH9Iile8q3lr/8+nvZ7fX9k/rtEYsFT8HZqubGvSxbsyyk2LYF6Vt3FC8Vw+RWyNX+RJYV5EKdfSkdlY9wGx8GVwy0Qtmzq2+lzjs2bW+KWiWgMqKIbz2eju+YzFeOpqHJJxDB57cOkQbdmUQ11+nb1ENcKEXmugnnZvyAk6wp4+oZHc966PDNUHODwhbD/sLuq3p+Iu++d31Sc3kNW9HaVkntKdgDhCPVTz7qKsD72WpNq3zv5BkiwAuebWyadgjMhkMZcFtnd1SJVcH/kvudJ6nY7dBc= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040154)(601004)(2401047)(8121501046)(5005006)(13023025)(13018025)(13024025)(13015025)(13017025)(3002001)(10201501046)(6055026); SRVR:BN1AFFO11HUB036; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB036; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB036; 4:/WoCLENCghq2+mQ2lTHLIcExoRQOBj/VqMtxP73Gpc7hLTxx+wdU6SCh2JRVfLF2cR5tQLv7ouc98Fax0Q6Q+E3Fm5ofufM9aIkS1GOaEldWSQMFXJ9DXY6Co2lUZlQJQYC9drbDnFBb6HbPdTCvr6l1Vh851080eZfO40Pd4i4iB3Z9qFxtII4KHBzqoOlMsIH0jxOCDGbWXBiyoA9/m83kGlceCo/g8ScsZDzH4MBGf5TdATwK6ft+W99nhWOLidhQlSKQ8S6kN6LBHQHouszv3H2+JsyXT0GUaxHxz2qppdqnN5o5+Tydno9KJyn2iRrwoQO93x36eMhbd0rl1JgtA23/xHns44/ZlRJIidkIRUZR9iN1M6HrRxweGjvqEfXv402PU3LFfzwkc3FI1CcGEnGIYmMFcX9hjbHHg8aoJBFZzed2XmgnJe2fihJZNFQ7dlHciot1HcUsSjyOk0daMyoHV1X0LrD7pJgwrbup0iazkCtCB0QaoPPgwbvhV2UzdyNlvQEurLHjPjqQdG1c7C6XNgVpaQCb5AAMDks0r2O3BLpyWKW7x/DimSWjbF6O1R1EHL+yZw2L5KDiOqbLdIpbgLNdFZEGoXWfKNix4noOKLOTGSNB+ZtY6Q5M46DFPJqlc79fgymBTrhX1kj62oYZFLa/Kho6KSNZGaU= X-Forefront-PRVS: 0025434D2D X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjFBRkZPMTFIVUIwMzY7MjM6QldzazFmTkhMa2tCeFprOUcrWEJRK0Zp?= =?utf-8?B?UGNob0R6dWRSNlZqVjBxVVgzOUgvWTlCbG5HMUZGOGlFWlhEQXdBYWx6SWdu?= =?utf-8?B?c1k3WExBdHhjSG5PY2M4cy93OVY1RVM4MG9nWU1iUDdkWllpUHhpaVB0bUVS?= =?utf-8?B?SnFabUx0bXdRQnA1eGZiUmN0UjhBaDR1UUthN3BYbVdIb3A2WVRmSVJaMkxt?= =?utf-8?B?S0gyQ0ZrNVZQMVp3TWNtcUkvRXZYUVpxZ1ZvMVFRVkwydHFWWTJkYWJ4S1Jv?= =?utf-8?B?MVZBRmkvMHlvYzdSZEFMQjQzb2NmYWlDUVlMRTlxTWwrcW51UWN2c3dqa0VT?= =?utf-8?B?b1ROM1U3VHJsYnFZVlFNQy9meU5ZaW9UTENjcjRoWG9QaklOckNoQTd2QWQz?= =?utf-8?B?dEgrcTZKQkdRZ1I5aFg4R0I4aXBPUHpBWTJlRnp2Q0d6YTlRRVluWUROSmJ3?= =?utf-8?B?U2dFd0UydzFtZUZqR3E0eGJqSmh3aXdyaHRYaEUzUTN2RE1QL0VvNlpvYWVQ?= =?utf-8?B?RXprRElQSU1DSXdiT1I3ekJHZkxDc2g5WDJPN2VQWlN1cmRkbUZkcFNWb2hC?= =?utf-8?B?d3BxTnBqclNYcDI4YmZjUmMwN3pQK2VzZ1cwWWxyNlpaeTgraDdKeTJVblV4?= =?utf-8?B?ZVpZemwzVXZaYlFidFVvTzRaYkpJN1YzdU1ZTGFJVVFUY1YxZ0JwZmxnU3JD?= =?utf-8?B?cXFsRVE0RU1WcGUrQkZ6R3ROakpEVmVPM05ZL3NlWHZnazNNWVlOT1NYbDFS?= =?utf-8?B?amsvTTk0L09jUDBoTmErZHBEMHRrNW1qdXBnYlhONnRFdVZMS05wcDN4VzRL?= =?utf-8?B?blhRUXJsd2dJVnpISFZkRXJwTTVuQjdLMUFyeDdnc0NsWkNDbC9rc2VsK043?= =?utf-8?B?Uy8xaEhRdHBGT3hyUVVLWnBpM3VxMFVWRU5tNm5Zd0ZOUE9jVVN1aWs0bjZL?= =?utf-8?B?cUg1bms1YWh6VkQ0VjFGLzRIRDQxQXAvb01kSnpUZWgzSkVhV2RiZGdhS0kz?= =?utf-8?B?ejZaTFBTZnlzck9rb3AyRWVJaEFoSTVWVE95VFZvYzM4Z0hHejJTbEUyRUp1?= =?utf-8?B?UkdqMGJqWWNETjdoVXgrMGxIVDJxU1BoaTlLSWxtSXRFdFpOSzVzMmhWWkM0?= =?utf-8?B?K2Fxb1U2bnViOXRtUndHR2RIaXhDZzdJcWxkbnlGN1J3N1dlZmYySFU5aXBj?= =?utf-8?B?Y0RibDIrUFhVZG1HTm1LOEltUzJMalY0TndCTXNIcnpzQjlDbzZxY0tka0pH?= =?utf-8?B?aUZUVEtYdDFqQ3A5K2RSeFJkV095ZXpsbmFNdlNiZWR6cmoxaXozL0pmRXI1?= =?utf-8?B?M005TjYvSWVRWjhlUjMvUmJjTVZDTTc4TS9NeTRVMUI4Z3pFc3FLK0RJcUsz?= =?utf-8?B?T2ZqMi9WQTJpeXh4VTRSMUhlOGJvMmtiWmxYRVhreUNIdHREUTlSTEwvM3F6?= =?utf-8?B?RGovaVFkMlhjeFg3NkxVM0tXbytkc3pXdCthNGI5Y3JaYzBsUU1JWUZlY0VV?= =?utf-8?B?MDRJNklrOWV6UFlVMHNVclo4TCtCQ1ZKMjFhNjVSb3RNZ2NtYmNTMzhxeWdL?= =?utf-8?B?ZHpRRTk1YUZpbmZ3ZEFjZ0dzR0xyMzhZQWFvVVNnZDZTT2dCVUtSdDcyV0oy?= =?utf-8?B?Ti9qd2M0THk5L2cxbldTQlR2KzNIUVlTdEo0VWhkWlZQZ1puVGhadjlHeXZF?= =?utf-8?B?NTE2NUlmdVliVTZRNzhLZWhJWVNEeFdMOXBHM0k3UWlCVENDSnJaYVBHWXJk?= =?utf-8?B?RzVDQXUvdDhKaEl0YWFDRlZiU0luU0dqQkZSQURhOGw1VUhaMlRVelZDMDd4?= =?utf-8?Q?XIh98b+6JljKQJg?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB036; 6:5dS4iwQJjG4UNotUhjR2gnawcunzfy/efxNkSNlwRKh/bhc0axkvzXPnepLfmvTsjCNlEkW7YjSxHDTBkngwodilKYQqvccSIZn4IG1djkob69JzM2YLEodE1+2IzT9oOMz5WzfKTbJZFOWTUCsu8QjpdtcwU3a3NUQTYRAJtGEhBatlOml7S/ApoOePXbFKe7hq9KY+xSU8eI5gozfRgCFprPx2mAHFmgakrV2oR55GRyn7BtJQvHr+zb3DxsTBYou09RfKqkfxSnmauNAvhmq1rUFtHBflhiUUzhhKPDJuqnNrsZT2N+UTOXqz2/k+n+RE5k3pfwAV4dcgcwsWfA==; 5:D/xjE0EfrHEK+9wobr2T1CjVzkS6nKb7N7QxpfNnd5CK3AWRsBYlosiCSmpFGaguGGOg2waRJWq1VOVmFB8rCSntmzpez37dfOBU9LF93a3cZqpFXxeSXS1kpNQKSQi14I7rGspB1K+7SzyPjSBvuw==; 24:20/4jAUtke+d85Eaj/Ocq2yb1/bkBwbSjLoQC20azikF9T/WORzCJg1ezIKX4D+DpekVWy+6r6Ta7kYq7yA/nXCQTH7to+KTz9lMQWwRAv0=; 7:joVL3TJKI39huK0yEWGU7nymZWnbrn9IIHc4NTdCiMMNMZZM58DY6BblsRiYVgn8ytLHXfN3g5uAuUa6u++zIfjczL/HvCQgRH9utZpY93coiDsxDUyKfRs2YGqkEW6hUNNnxdemsDiVxDk8NEUS/aXcye+zlAVrHvly8dSD2aJ4YM8xDYQji+4g6Ya3rG5eenPgi41SEiLO8raF9Kl/VOkxd79OwbhoZJJcWIJue/34YHNq94xjsdhPDf+8At7x SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Aug 2016 19:51:19.8798 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.80]; Helo=[preapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB036 Archived-At: Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 19:51:26 -0000 QSBzZXJpb3VzIGNoYWxsZW5nZSB0byB1c2FiaWxpdHkgaXMgc2ltcGxpY2l0eS4gIEEgY29tcGxp Y2F0aW5nIGZhY3RvciBpcyB2YXJpYWJpbGl0eSBpbiB0aGUgdHJ1c3R3b3J0aGluZXNzIG9mIHNl dmVyYWwgZGlmZmVyZW50IHVzZSBjYXNlcyBvZiBhdXRoZW50aWNhdGVkIGNhbGxpbmcgbnVtYmVy cyBzaWduZWQgdXNpbmcgU1RJUi9QQVNTcG9yVCBtZWNoYW5pc21zLg0KDQpJdCB3b3VsZCBiZSAi bmljZSIgaWYgdGhlcmUgd2FzIGEgc2ltcGxlIHNldCBvZiBhdXRoZW50aWNhdGlvbiBydWxlcyBh bmQgZGlzcGxheSB0aGF0IGFyZSBjb25zaXN0ZW50IGFjcm9zcyBjYXJyaWVycywgYW5kIHBsYXRm b3JtIE9TLiAgQXQgbGVhc3QgZm9yIGFueXRoaW5nIGNhcnJpZXJzIGFyZSByZXF1aXJlZCB0byBk byBieSBtYW5kYXRlLCByZWd1bGF0aW9uLCBhbmQgc3RhbmRhcmQuICBUaGlzIGJlbmVmaXRzIGNv bnN1bWVycyBpbiB0aGF0IGlmIGRvbmUgcHJvcGVybHksIGF0IGEgbWluaW11bSB0aGUgYXV0aGVu dGljYXRpb24gYXQvb24gQ2FycmllciBBIHNob3VsZCBtZWFuIHRoZSBzYW1lIHRoaW5nIGFzIGF1 dGhlbnRpY2F0aW9uIGF0L29uIENhcnJpZXIgQi4NCg0KUHJlbWl1bSwgZW5oYW5jZWQgcHJvZHVj dHMgdXNpbmcgYXV0aG9yaXphdGlvbiwgYW5hbHl0aWNzLCBhY2NlcHQvZGVueSBsaXN0cywgZXQg Y2V0ZXJhLCBzaG91bGQgb2YgY291cnNlIGJlIHVucmVzdHJpY3RlZCwgYW5kIHRoZSBtYXJrZXRw bGFjZSBjYW4gZHJpdmUgdGhlIGJlc3Qgc29sdXRpb24uICBDb2V4aXN0ZW5jZSBzZWVtcyBwb3Nz aWJsZSBhbmQgZGVzaXJhYmxlLg0KDQpQaWVyY2UNCg0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQpGcm9tOiBQYXVsIEt5eml2YXQgW21haWx0bzpwa3l6aXZhdEBhbHVtLm1pdC5lZHVd IA0KU2VudDogQXVndXN0IDA1LCAyMDE2IDI6MzMgUE0NClRvOiBzdGlyQGlldGYub3JnDQpTdWJq ZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0KDQpPbiA4LzUvMTYgMTo1 NiBQTSwgUmljaGFyZCBTaG9ja2V5IHdyb3RlOg0KPg0KPiBEb27igJl0IGJlIHNvIHN1cmUuIElm IGl04oCZcyBhIG1vYmlsZSBkZXZpY2Ugb3IgcGVyaGFwcyBjYWJsZSB5b3UgY2FuIGJldCB0aGUg Y2FycmllciB3aWxsIGhhdmUgc29tZSBzYXkgaW4gd2hhdCBpcyBkaXNwbGF5ZWQgb24gdGhlIFVB Lg0KDQpJIHNhaWQgdGhhdCBpcyB3aGF0IEkgd291bGQgKmV4cGVjdCouIEkgYWxzbyBzYWlkICJp ZiB0aGUgUEFJIGlzIHByZXNlbnQiLiBPZiBjb3Vyc2UgdGhlIGNhcnJpZXIgY2FuIHN0cmlwIHRo ZSBQQUkuIChBbmQgKnNob3VsZCogaWYgdGhlIGNhbGxlciByZXF1ZXN0ZWQgYW5vbnltaXR5LikN Cg0KSWYgdGhlIGluZm9ybWF0aW9uIGlzIHBhc3NlZCB0byB0aGUgZGV2aWNlLCB0aGVuIEFGQUlL IHRoZSB1c2VyIGNvdWxkIGluc3RhbGwgc29mdHdhcmUgdGhhdCB3b3VsZCBiZSBmcmVlIHRvIGRl Y2lkZSB3aGF0IHRvIGRpc3BsYXkuIElmIHRoZSBjYXJyaWVyIGlzIHRoZSBzdXBwbGllciBvZiB0 aGUgT1Mgb24gdGhlIHBob25lIHRoZW4gaXQgY2FuIHRyeSB0byAibG9jayBkb3duIiB0aGlzIGFz cGVjdC4gQnV0IElJVUMgdGhhdCBpcyBpbmNvbnNpc3RlbnQgd2l0aCBjdXJyZW50IHByYWN0aWNl LiANCkFuZCBpdCB3b3VsZG4ndCBhcHBseSB0byBkZXZpY2VzIHRoZXkgZG9uJ3QgbWFuYWdlLCBs aWtlIE5leHVzIHBob25lcy4NCg0KCVRoYW5rcywNCglQYXVsDQoNCj4gT24gOC81LzE2LCAxMjo1 NyBQTSwgInN0aXIgb24gYmVoYWxmIG9mIFBhdWwgS3l6aXZhdCIgPHN0aXItYm91bmNlc0BpZXRm Lm9yZyBvbiBiZWhhbGYgb2YgcGt5eml2YXRAYWx1bS5taXQuZWR1PiB3cm90ZToNCj4NCj4gICAg IElmIFBBSSBpcyBwcmVzZW50IGFuZCBzaWduZWQsIGFuZCBGcm9tIGlzIGFsc28gc2lnbmVkLCBJ IHdvdWxkIGV4cGVjdCBpdA0KPiAgICAgdG8gYmUgdXAgdG8gdGhlIFVBIHRvIGRlY2lkZSB3aGF0 IHRvIGRpc3BsYXksIG5vdCB0aGUgY2Fycmllci4NCj4NCj4gICAgIE9mIGNvdXJzZSB0aGlzIHdp bGwgd29yayBkaWZmZXJlbnRseSBpZiB0aGVyZSBpcyBhIGRpZmZlcmVudCBzaWduYWxpbmcNCj4g ICAgIHJlZ2ltZSBiZXR3ZWVuIHRoZSBjYXJyaWVyIGFuZCB0aGUgdXNlciBkZXZpY2UgKGUuZy4g YmxhY2sgcGhvbmUpLg0KPg0KPiAgICAgCVRoYW5rcywNCj4gICAgIAlQYXVsDQo+DQo+ICAgICBP biA4LzUvMTYgMTE6MjYgQU0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gd3JvdGU6DQo+ICAgICA+ IFAtQXNzZXJ0ZWQtSWRlbnRpdHkgaXMgc3VwcG9zZWQgdG8gb3BlcmF0ZSAiYW1vbmcgdHJ1c3Rl ZCBTSVAgZW50aXRpZXMiIGFuZCB0aGVyZWZvcmUgc29tZSBzcGVjaWZpY2F0aW9ucyAoZS5nLiwg M0dQUCBUUyAyNC42MDcpIGFzc3VtZSBQLUFzc2VydGVkLUlkZW50aXR5IGlzIHN0cmlwcGVkIGJ5 IGJvcmRlciBjb250cm9sbGVyIGZ1bmN0aW9ucyBhbmQgaXMgbm90IHRvIGJlIHVzZWQgaW4gaW50 ZXItY2FycmllciBpbnRlci1jb25uZWN0aW9uIChhbHRob3VnaCBpdCBjb21tb25seSBzaG93cyB1 cCBhbnl3YXkpLiAgTXkgb3BpbmlvbiBpcyB0aGUgIkZyb20iIGhlYWRlciBpcyBsaWtlbHkgdXNl ZCBtb3JlIG9mdGVuIGZvciBwcmVzZW50YXRpb24uDQo+ICAgICA+DQo+ICAgICA+IFBpZXJjZQ0K PiAgICAgPg0KPiAgICAgPg0KPiAgICAgPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiAg ICAgPiBGcm9tOiBSaWNoYXJkIFNob2NrZXkgW21haWx0bzpyaWNoYXJkQHNob2NrZXkudXNdDQo+ ICAgICA+IFNlbnQ6IEF1Z3VzdCAwNSwgMjAxNiA5OjM3IEFNDQo+ICAgICA+IFRvOiBSb3Nib3Ro YW0sIFBhdWwsIFZvZGFmb25lIFVLIDxwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+OyBQYXVs IEt5eml2YXQgPHBreXppdmF0QGFsdW0ubWl0LmVkdT47IEJyaWFuIFJvc2VuIDxickBicmlhbnJv c2VuLm5ldD4NCj4gICAgID4gQ2M6IHN0aXJAaWV0Zi5vcmcNCj4gICAgID4gU3ViamVjdDogUmU6 IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4gICAgID4NCj4gICAgID4NCj4gICAg ID4gSHVtbSB0aGlzIGlzIGdldHRpbmcgaW50ZXJlc3RpbmcuICBJdHMgbXkgdW5kZXJzdGFuZGlu ZyB0aGF0IHRoZSBkaXNwbGF5IG51bWJlciBha2Eg4oCccHJlc2VudGF0aW9uIG51bWJlcuKAnSBp biB0aGUgVVMgY29udGV4dCBpcyB0aGUgb25lIGNhcnJpZWQgaW4gdGhlIFBBSS4gIE1hcnRpbiwg UGllcmNlPw0KPiAgICAgPg0KPiAgICAgPg0KPiAgICAgPg0KPiAgICAgPg0KPiAgICAgPiBPbiA4 LzUvMTYsIDM6NDYgQU0sICJzdGlyIG9uIGJlaGFsZiBvZiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFm b25lIFVLIiA8c3Rpci1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBwYXVsLnJvc2JvdGhh bUB2b2RhZm9uZS5jb20+IHdyb3RlOg0KPiAgICAgPg0KPiAgICAgPiAgICAgSnVtcGluZyBpbiBu b3cgdGhhdCB3ZSdyZSBvbiBFdXJvcGVhbiB3b3JraW5nIHRpbWUsICsxIG9uIFBhdWwncyBvYnNl cnZhdGlvbi4NCj4gICAgID4NCj4gICAgID4gICAgIEhlcmUgaW4gdGhlIFVLLCB3ZSd2ZSBnb3Qg MiBudW1iZXJzIGNhcnJpZWQgYXMgY2FsbGluZyBsaW5lIElEcy4uLi5vbmUgKHdlIHRlcm0gdGhl IE5ldHdvcmsgTnVtYmVyLCBjYXJyaWVkIGluIFBBSUQpIHVuaXF1ZWx5IGlkZW50aWZpZXMgdGhl IGxpbmUsIHRoZSBvdGhlciAod2UgdGVybSBQcmVzZW50YXRpb24gTnVtYmVyLCBjYXJyaWVkIGlu IEZyb20pIGlzIHVzZWQgZm9yIGRpc3BsYXkgcHVycG9zZXMuDQo+ICAgICA+DQo+ICAgICA+ICAg ICBPbmx5IHRoZSBjYXJyaWVyIGhhcyB0aGUgYXV0aG9yaXR5IHRvIHNldCB0aGUgTmV0d29yayBO dW1iZXIgc28gb25seSB0aGV5IGNvdWxkIHNpZ24gaXQuDQo+ICAgICA+DQo+ICAgICA+ICAgICBC dXQgLSBzdWJqZWN0IHRvIHJlZ3VsYXRvcnkgcmVzdHJpY3Rpb25zIHdoaWNoIGFyZSB3ZWxsIGRv Y3VtZW50ZWQgLSB0aGUgbnVtYmVyIHNlbnQgZm9yIGRpc3BsYXkgcHVycG9zZXMgYmVsb25ncyB0 byB0aGUgY3VzdG9tZXIuICBGb3IgYmx1ZS1jaGlwIGN1c3RvbWVycywgSSBjYW4gYWxsb3cgdGhl bSB0byBzZW5kIHRoZWlyIFByZXNlbnRhdGlvbiBOdW1iZXJzIGludG8gdGhlIG5ldHdvcmssIGFu ZCBjYW4ndCByZWFkaWx5IGNoZWNrIGF0IGEgbmV0d29yayBsZXZlbCB0aGF0IHRoZXkncmUgdGhl aXJzIChJIGRvIGhhdmUgY29udHJhY3R1YWwgc2FmZWd1YXJkcykuICBUaGUgbnVtYmVyIG1heSBo YXZlIGJlZW4gYWxsb2NhdGVkIGJ5IG1lLCBvciBjb3VsZCBiZSBhbGxvY2F0ZWQgYnkgYSB0aGly ZCBwYXJ0eSBwcm92aWRlci4gIElmIGl0J3MgYSBjYWxsLWNlbnRyZSB0aGV5J2xsIGJlIG1ha2lu ZyBvdXRib3VuZCBjYWxscyBmb3IgbG90cyBvZiBkaWZmZXJlbnQgY3VzdG9tZXJzIHdoaWNoIHdp bGwgY2hhbmdlIG9uIGRheS1ieS1kYXkgYmFzaXMuICBUaGlzIGlzIGJ1c2luZXNzIGFzIHVzdWFs LiAgSSBkb24ndCBsaWtlIHRoZSB0ZXJtICJhdXRob3Jpc2VkIHNwb29maW5nIiBiZWNhdXNlIGl0 IGltcGxpZXMgdGhhdCB0aGUgQ0xJIGlzIGluIHNvbWUgd2F5IGJlaW5nIHJpZ2dlZDogaXQncyBu b3QsIGl0J3MgdGhlIGNvcnBvcmF0ZSBjdXN0b21lciBvciB0aGVpciBzdWJjb250cmFjdG9yIHVz aW5nIHRoZSBudW1iZXIgdGhhdCdzIGJlZW4gYXNzaWduZWQgKHNvIGluIGludGVybmV0IHRlcm1z IGRlbGVnYXRlZCkgdG8gdGhlbSB2aWEgYSBjaGFpbiBvZiB0cnVzdCBmcm9tIHRoZSByZWd1bGF0 b3IuDQo+ICAgICA+DQo+ICAgICA+ICAgICBXaGF0IEkgd2FudCBpcyB0aGUgYWJpbGl0eSBmb3Ig Y3VzdG9tZXJzIHRvIHVzZSB0aGVpciBjcmVkZW50aWFscyB0byBzaWduIHRoZSBDTElzIHRoZXkg c2VuZCBtZSBzbyB0aGF0IGF0IHRoZSB0ZXJtaW5hdGluZyBlbmQgaXQgY2FuIGJlIGNoZWNrZWQg KG9yIGluZGVlZCBzb21ld2hlcmUgZW4tcm91dGUgaWYgdGhhdCdzIHRoZSBidXNpbmVzcyBtb2Rl bCkuICBJIGNhbiBhbmQgd291bGQgc2lnbiBmb3IgY3VzdG9tZXJzIG9uIG15IG1vYmlsZSBidXNp bmVzcyBzaW5jZSBJJ20gZHJpdmluZyB3aGF0IG51bWJlciBpcyBwcmVzZW50ZWQsIGJ1dCB0aGF0 J3MgYnktdGhlLWJ5IGJlY2F1c2UgdGhleSBhcmVuJ3QgdGhlIG9uZXMgd2hvIGdlbmVyYXRlIG1p bGxpb25zIG9mIG51aXNhbmNlIGNhbGxzLiAgSWYgdGhlIHNpZ25pbmcgb25seSBvY2N1cnMgYXQg dGhlIG9yaWdpbmF0aW5nIGNhcnJpZXIgbGV2ZWwgZm9yIGNvcnBvcmF0ZS9jYWxsLWNlbnRyZSBj dXN0b21lcnMgdGhhdCdzIG5vIHVzZSBiZWNhdXNlIEknbSBub3QgaW4gYSBwb3NpdGlvbiB0byBk byB0aGF0IGZvciB0aGVzZSB0eXBlIG9mIGN1c3RvbWVycy4uLmFuZCB0aGUgd2hvbGUgc3lzdGVt IGJlY29tZXMgYSB3YXN0ZSBvZiB0aW1lLiBJJ2QgYWxzbyBoaWdobGlnaHQgdGhlcmUgYXJlIG1h bnkgbW9yZSBvZiBteSBsYXJnZSBjdXN0b21lcnMgdGhhdCBJJ2QgdHJ1c3QgbW9yZSB0aGFuIGEg ZmFyIGVuZCBvcmlnaW5hdGluZyBjYXJyaWVyIHRoYXQgY291bGQgYmUgYW55d2hlcmUgaW4gdGhl IHdvcmxkICh0aG91Z2ggd2UgaGF2ZSBubyBzaG9ydGFnZSBvZiBzbWFsbCBjYXJyaWVycyB0aGF0 IEkgd291bGRuJ3Qga25vdyBmcm9tIEFkYW0gbW9yZSBsb2NhbGx5IGluIHRoZSBVSy4uLi4pDQo+ ICAgICA+DQo+ICAgICA+ICAgICBSZWdhcmRzDQo+ICAgICA+DQo+ICAgICA+ICAgICBQYXVsDQo+ ICAgICA+DQo+ICAgICA+ICAgICAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiAgICAgPiAg ICAgRnJvbTogc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9m IFBhdWwgS3l6aXZhdA0KPiAgICAgPiAgICAgU2VudDogMDQgQXVndXN0IDIwMTYgMjM6MTINCj4g ICAgID4gICAgIFRvOiBCcmlhbiBSb3Nlbg0KPiAgICAgPiAgICAgQ2M6IHN0aXJAaWV0Zi5vcmcN Cj4gICAgID4gICAgIFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRz DQo+ICAgICA+DQo+ICAgICA+ICAgICBPbiA4LzQvMTYgNjowMiBQTSwgQnJpYW4gUm9zZW4gd3Jv dGU6DQo+ICAgICA+ICAgICA+IEkgdGhpbmsgaXQncyBub3QgYSBkZWxlZ2F0aW9uLiAgVGhlIG1v YmlsZSBwaG9uZSBpcyBub3QgYmVpbmcgZGVsZWdhdGVkIHRoZSBUTiwgaXQncyBiZWluZyBhdXRo b3JpemVkIHRvIHBsYWNlIGNhbGxzIHRoYXQgYXJlIG5vdCBmcm9tIHRoYXQgVE4sIGJ1dCBhcHBl YXIgdG8gYmUuDQo+ICAgICA+ICAgICA+DQo+ICAgICA+ICAgICA+IFRoZSBtZWNoYW5pc20gdG8g aGFuZGxlIHRoZSBjcmVkZW50aWFsIGlzIGV4YWN0bHkgdGhlIHNhbWUgYXMgYSBkZWxlZ2F0aW9u LCBzbyBpZiB5b3Ugd2FudCB0byBjYWxsIGl0IGRlbGVnYXRpb24sIGdvIGFoZWFkLCBidXQgSSBw cmVmZXIgdG8gY2FsbCBpdCBhdXRob3JpemVkIHNwb29maW5nLg0KPiAgICAgPg0KPiAgICAgPiAg ICAgSUlVQyB0aGUgZGVsZWdhdGlvbiBpcyB0byBhIHJlc3BvbnNpYmxlIGVudGl0eSAoc29tZXRo aW5nIHRoYXQgY2FuIGJlIGhlbGQgbGVnYWxseSBhY2NvdW50YWJsZSAtIGUuZy4gYSBwZXJzb24p LCBub3QgdG8gYSBkZXZpY2UuIFRoZSBlbnRpdHkgY2FuIHRoZW4gInVzZSIgdGhlIGNyZWRlbnRp YWwgdmlhIGFueSBkZXZpY2UocykgaXQgY2hvb3Nlcy4gSW4gdGhlIGNhc2Ugb2YgdGhlIG1vYmls ZSwgdGhlIGRldmljZSB0aGVuIGJlY29tZXMgYSB0d28tbGluZSBwaG9uZS4NCj4gICAgID4NCj4g ICAgID4gICAgIFRoYW5rcywNCj4gICAgID4gICAgIFBhdWwNCj4gICAgID4NCj4gICAgID4gICAg ID4gQnJpYW4NCj4gICAgID4gICAgID4NCj4gICAgID4gICAgID4+IE9uIEF1ZyA0LCAyMDE2LCBh dCA1OjUxIFBNLCBQYXVsIEt5eml2YXQgPHBreXppdmF0QGFsdW0ubWl0LmVkdT4gd3JvdGU6DQo+ ICAgICA+ICAgICA+Pg0KPiAgICAgPiAgICAgPj4gT24gOC80LzE2IDU6NDMgUE0sIEJyaWFuIFJv c2VuIHdyb3RlOg0KPiAgICAgPiAgICAgPj4+IEluIG15IGphcmdvbiBhbiAiYXV0aG9yaXplZCBz cG9vZmVyIiBpcyB0aGUgZG9jdG9yIHdobyBpcyBjYWxsaW5nDQo+ICAgICA+ICAgICA+Pj4gZnJv bSBoaXMgbW9iaWxlLCBidXQgc2VuZGluZyB0aGUgVE4gb2YgaGlzIG9mZmljZSBwaG9uZSBhcyBj YWxsaW5nIHBhcnR5Lg0KPiAgICAgPiAgICAgPj4+IFRoZSBkZWxlZ2F0aW9uIHRvIGhpcyBvZmZp Y2UgcGhvbmUgd2FzIG1hZGUgYnkgaGlzIGxhbmRsaW5lIGNhcnJpZXINCj4gICAgID4gICAgID4+ PiB0byBoaW0uICBIZSB0aGVuIGNyZWF0ZXMgYW5vdGhlciBjcmVkZW50aWFsLCB3aGljaCBoZSBz aWducyB3aXRoIGhpcw0KPiAgICAgPiAgICAgPj4+IG9mZmljZSBwaG9uZSBjcmVkZW50aWFsIHRo YXQgYXV0aG9yaXplcyBoaXMgbW9iaWxlIHRvIHNlbmQgY2FsbHMNCj4gICAgID4gICAgID4+PiBm cm9tIGhpcyBvZmZpY2UgbnVtYmVyLiAgSGUgaXMgc3Bvb2ZpbmcgKGJlY2F1c2UgdGhlIGNhbGwg aXMgY29taW5nDQo+ICAgICA+ICAgICA+Pj4gZnJvbSBoaXMgbW9iaWxlJ3MgVE4gYnV0IGNsYWlt cyB0byBiZSBmcm9tIGhpcyBvZmZpY2UpLCBidXQgaXQncw0KPiAgICAgPiAgICAgPj4+IGF1dGhv cml6ZWQgc3Bvb2ZpbmcuICBUaGUgZG9jIGNvdWxkIGdpdmUgdGhlIGNyZWRlbnRpYWwgdG8gaGlz DQo+ICAgICA+ICAgICA+Pj4gbW9iaWxlIFNQIGlmIHRoZXkgc2lnbiBvbiBoaXMgYmVoYWxmLg0K PiAgICAgPiAgICAgPj4NCj4gICAgID4gICAgID4+IEkgZG9uJ3QgdW5kZXJzdGFuZCBob3cgdGhh dCBpcyBkaWZmZXJlbnQgZnJvbSByZWd1bGFyIGRlbGVnYXRpb24uDQo+ICAgICA+ICAgICA+Pg0K PiAgICAgPiAgICAgPj4gV2hlbiBoaXMgbGFuZGxpbmUgY2FycmllciBnYXZlIGhpbSBhIGRlbGVn YXRlZCBjZXJ0aWZpY2F0ZSBmb3IgaGlzIGxhbmRsaW5lIG51bWJlciwgaGUgc2hvdWxkIGJlIGFi bGUgdG8gaW5zdGFsbCB0aGF0IGluIHdoYXRldmVyIGRldmljZXMgaGUgd2FudHMgLSBoaXMgbGFu ZGxpbmUgVUEsIGhpcyBtb2JpbGUgcGhvbmUsIGV0Yy4gSXQgaXMgc3RpbGwgZGVsZWdhdGVkIGZy b20gaGlzIGxhbmRsaW5lIGNhcnJpZXIsIGV2ZW4gd2hlbiB1c2VkIHdpdGggY2FsbHMgdmlhIGhp cyBtb2JpbGUgY2Fycmllci4NCj4gICAgID4gICAgID4+DQo+ICAgICA+ICAgICA+PiBUaGFua3Ms DQo+ICAgICA+ICAgICA+PiBQYXVsDQo+ICAgICA+ICAgICA+Pg0KPiAgICAgPiAgICAgPj4+IFNv bWUgZm9sa3MgZG9uJ3QgbGlrZSBhdHRhY2hpbmcgdGhlICJzcG9vZmluZyIgbGFiZWwgdG8gYSBs ZWdpdGltYXRlIHVzZS4NCj4gICAgID4gICAgID4+Pg0KPiAgICAgPiAgICAgPj4+IEJ1dCB0aGF0 J3MgaG93IEkgZGVzY3JpYmUgaXQuDQo+ICAgICA+ICAgICA+Pj4NCj4gICAgID4gICAgID4+PiBC cmlhbg0KPiAgICAgPiAgICAgPj4+DQo+ICAgICA+ICAgICA+Pj4+IE9uIEF1ZyA0LCAyMDE2LCBh dCA1OjM3IFBNLCBQYXVsIEt5eml2YXQgPHBreXppdmF0QGFsdW0ubWl0LmVkdQ0KPiAgICAgPiAg ICAgPj4+PiA8bWFpbHRvOnBreXppdmF0QGFsdW0ubWl0LmVkdT4+IHdyb3RlOg0KPiAgICAgPiAg ICAgPj4+Pg0KPiAgICAgPiAgICAgPj4+PiArMSwgYnV0IHdpdGggb25lIHF1ZXN0aW9uIGJlbG93 Og0KPiAgICAgPiAgICAgPj4+Pg0KPiAgICAgPiAgICAgPj4+PiBPbiA4LzQvMTYgNToxNCBQTSwg QnJpYW4gUm9zZW4gd3JvdGU6DQo+ICAgICA+ICAgICA+Pj4+PiBJIHRoaW5rIGFsbCB3ZSBuZWVk IGlzIHRvIGhhdmUgY3JlZGVudGlhbHMgZm9sbG93IHRoZSBkZWxlZ2F0aW9uDQo+ICAgICA+ICAg ICA+Pj4+PiBwYXRoLA0KPiAgICAgPiAgICAgPj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4gcGx1cyB0 aGUgb3B0aW9uIHRvIGFkZCBhbm90aGVyIGxldmVsIChub3QgZGVsZWdhdGlvbikgZm9yDQo+ICAg ICA+ICAgICA+Pj4+PiBhdXRob3JpemVkIHNwb29mZXJzLg0KPiAgICAgPiAgICAgPj4+Pg0KPiAg ICAgPiAgICAgPj4+PiBJIGRvbid0IHVuZGVyc3RhbmQgImF1dGhvcml6ZWQgc3Bvb2ZlcnMiIGlu IHRoaXMgY29udGV4dCwgYXMNCj4gICAgID4gICAgID4+Pj4gY29udHJhc3RlZCB0byAic3Bvb2Zl cnMiIHdobyBoYXZlIGJlZW4gZGVsZWdhdGVkIHRoZWlyIGF1dGhvcml0eS4NCj4gICAgID4gICAg ID4+Pj4NCj4gICAgID4gICAgID4+Pj4gVGhhbmtzLA0KPiAgICAgPiAgICAgPj4+PiBQYXVsDQo+ ICAgICA+ICAgICA+Pj4+DQo+ICAgICA+ICAgICA+Pj4+PiBJIGRvbid0IHRoaW5rIGl0IG1hdHRl cnMgd2hvIHRoZSBkZWxlZ2F0b3Igb3IgZGVsZWdhdGVlIGFyZSBhcw0KPiAgICAgPiAgICAgPj4+ Pj4gbG9uZyBhcyB0aGUgZGVsZWdhdG9yIGlzIHdpbGxpbmcgdG8gdGFrZSB0aGUgaGVhdCBmb3Ig ZGVsZWdhdGluZw0KPiAgICAgPiAgICAgPj4+Pj4gdG8gc29tZW9uZSB3aG8gc2VuZHMgYSBsb3Qg b2YgYmFkIGNhbGxzLiAgVGhleSBjYW4gcGFzcyB0aGUgYnVjaw0KPiAgICAgPiAgICAgPj4+Pj4g KCJJIGRlbGVnYXRlZCB0aGUgVE4gdG8gaGltLCBhbmQgbm93IEknbSBub3QgcmVzcG9uc2libGUi KSwgYnV0DQo+ICAgICA+ICAgICA+Pj4+PiBvbmx5IGlmIHRoZSBTUCBrbm93cyB3aG8gdGhleSBk ZWxlZ2F0ZWQgdG8sIHNvIGF1dGhvcml0aWVzIGNhbg0KPiAgICAgPiAgICAgPj4+Pj4gZm9sbG93 IHRoZSBkZWxlZ2F0aW9uIHBhdGguICBUaGVyZSBhcmUgcGxlbnR5IG9mIGNlcnRpZmljYXRlZA0K PiAgICAgPiAgICAgPj4+Pj4gY2FycmllcnMgd2hvIGFyZSB3aWxsaW5nIHRvIG5vdCBjYXJlIHdo byB0aGV5IGRlbGVnYXRlIHRvLiAgVGhlIGZhY3QgdGhhdCB0aGVyZSBhcmUgc29tZSB3aG8gZG8g ZG9lc24ndCBjaGFuZ2UgbXVjaC4NCj4gICAgID4gICAgID4+Pj4+IE1ha2luZyBzdGlyIHdvcmsg bWVhbnMga25vd2luZyB3aG8geW91IGFyZSBkZWxlZ2F0aW5nIHRvLCBzbyB0aGF0DQo+ICAgICA+ ICAgICA+Pj4+PiB5b3UgY2FuIHBhc3MgdGhlIGhvdCBwb3RhdG8uDQo+ICAgICA+ICAgICA+Pj4+ Pg0KPiAgICAgPiAgICAgPj4+Pj4gSXQncyBwZXJmZWN0bHkgcmVhc29uYWJsZSBmb3IgYSBjYXJy aWVyIHRvIGJlIGFibGUgdG8gc2lnbiBmb3IgYW55DQo+ICAgICA+ICAgICA+Pj4+PiBjYWxscyBw bGFjZWQgb24gaXRzIG5ldHdvcmsgb24gYW55IG51bWJlciBpdCBoYXMgYmVlbiBkZWxlZ2F0ZWQu DQo+ICAgICA+ICAgICA+Pj4+PiBJZiBpdCBkb2VzLCBpdCdzIGFzc2VydGluZyB0aGF0IHRoZSBj YWxscyBhcmUgZnJvbSB3aG8gdGhleSBhcmUgc3VwcG9zZWQgdG8gYmUgZnJvbS4NCj4gICAgID4g ICAgID4+Pj4+IFRoYXQgc2hvdWxkIGJlIHN0cmFpZ2h0Zm9yd2FyZCwgYnV0IHdlIGtub3cgaXQn cyBub3QgYWx3YXlzLCBhbmQNCj4gICAgID4gICAgID4+Pj4+IHRoYXQgcmVwcmVzZW50cyB0aGUg aGFyZCBwYXJ0IG9mIGRlcGxveW1lbnQgaW4gbXkgb3Bpbmlvbi4gIEJ1dA0KPiAgICAgPiAgICAg Pj4+Pj4gb25jZSB0aGV5IGRlbGVnYXRlLCB0aGV5IGNhbiBoYW5kIHJlc3BvbnNpYmlsaXR5IHRv IHNpZ24gdG8gdGhlDQo+ICAgICA+ICAgICA+Pj4+PiBkZWxlZ2F0ZWUuICBCdXQsIHRoYXQgb25s eSB3b3JrcyBpZiB0aGV5IGtub3cgd2hvIHRoZXkgYXJlIGRlbGVnYXRpbmcgdG8uDQo+ICAgICA+ ICAgICA+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4gVGhlIHJvb3Qgb2YgdGhlIHdob2xlIG1vZGVs IGlzIHRoYXQgdGhlcmUgaXMgYSBmb3JtYWwgb3IgaW5mb3JtYWwNCj4gICAgID4gICAgID4+Pj4+ IGRlbGVnYXRpb24gcGF0aCBmb3IgdGVsZXBob25lIG51bWJlcnMgaW4gZXZlcnkgY291bnRyeSwg YW5kIHdlIGNhbg0KPiAgICAgPiAgICAgPj4+Pj4gYnVpbGQgYSBjaGFpbiBvZiB0cnVzdCBmcm9t IHRoYXQgZGVsZWdhdGlvbiBwYXRoLiAgSWYgeW91IHByb3Bvc2UNCj4gICAgID4gICAgID4+Pj4+ IHRvIGFsdGVyIHRoYXQgbW9kZWwsIHRoZW4gd2UgZ2V0IGludG8gKHBvbGljeSkgaXNzdWVzIG9m IHdoaWNoDQo+ICAgICA+ICAgICA+Pj4+PiBjYXJyaWVycy9lbnRpdGllcyB3ZSB0cnVzdCBhbmQg d2hpY2ggd2UgZG9uJ3QuICBPdXIgbW9kZWwgaXMgdGhhdA0KPiAgICAgPiAgICAgPj4+Pj4geW91 IGtub3cgd2hvIHlvdSBkZWxlZ2F0ZSB0bywgYW5kIG9uY2UgeW91IGRvIHRoYXQgZGVsZWdhdGlv biwgaXQncyB0aGVpciBwcm9ibGVtLg0KPiAgICAgPiAgICAgPj4+Pj4gVGhhdCdzIHByZXR0eSBh cHBlYWxpbmcgSSB0aGluaywgZXZlbiBpZiBpdCdzIGEgY2hhbmdlIGluIHNvbWUNCj4gICAgID4g ICAgID4+Pj4+IGJ1c2luZXNzIHByYWN0aWNlcy4NCj4gICAgID4gICAgID4+Pj4+DQo+ICAgICA+ ICAgICA+Pj4+PiBUaGUgbWVjaGFuaXNtIGlzIGNoYWluaW5nIGNyZWRlbnRpYWxzIGluIGEgZm9y bSBvZiBhIFBLSSBhbmQNCj4gICAgID4gICAgID4+Pj4+IGhhdmluZyBhIHdheSB0byBrbm93IHdo aWNoIFROcyBhcmUgY292ZXJlZCBieSBhIGNyZWRlbnRpYWwuDQo+ICAgICA+ICAgICA+Pj4+PiBU aGF0J3Mgd2hhdCB3ZSBoYXZlLCBhbmQgSSdtIGxvYXRoIHRvIGNoYW5nZSBpdC4NCj4gICAgID4g ICAgID4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+PiBCcmlhbg0KPiAgICAgPiAgICAgPj4+Pj4NCj4g ICAgID4gICAgID4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gT24gQXVnIDQsIDIwMTYsIGF0IDQ6 NTMgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10NCj4gICAgID4gICAgID4+Pj4+PiA8UGllcmNl Lkdvcm1hbkBzcHJpbnQuY29tIDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPiAg ICAgPiAgICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4gICAg ID4gICAgID4+Pj4+PiB3cm90ZToNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+ Pj4+IE9LLCB5b3UgdGFsa2VkIG1lIGludG8gaW5kdWxnaW5nIGluIG9uZSBtb3JlIG1lc3NhZ2Ug b24gcG9saWN5DQo+ICAgICA+ICAgICA+Pj4+Pj4gYW5kIHVzZSBjYXNlcy4NCj4gICAgID4gICAg ID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+IEkgYWdyZWUgdGhhdCB0aGUgU1RJUi9QQVNTcG9y VCBtZWNoYW5pc21zIGNvdWxkIGJlIGRlcGxveWVkIG9uDQo+ICAgICA+ICAgICA+Pj4+Pj4gaW5k aXZpZHVhbCBkZXZpY2VzIGFzIHdlbGwgYXMgbXVsdGktZGV2aWNlIGFuZCBtdWx0aS1udW1iZXIg cGxhdGZvcm1zLg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gTnVtYmVy IGRlbGVnYXRpb24gKGFuZCBzdWItZGVsZWdhdGlvbiksIGFuZCBidXNpbmVzcw0KPiAgICAgPiAg ICAgPj4+Pj4+IHJlbGF0aW9uc2hpcHMgYXJlIHR3byBhZGRpdGlvbmFsIGZhY3RvcnMgd2hpY2gg YWZmZWN0DQo+ICAgICA+ICAgICA+Pj4+Pj4gdHJ1c3R3b3J0aGluZXNzIG9mIGEgZ2l2ZW4gY2Fs bGluZyBudW1iZXIgYXV0aGVudGljYXRpb24uDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4g ICAgID4+Pj4+PiBJbmhlcmVudCB2YXJpYWJsZSB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBjYWxsaW5n IG51bWJlciB3YXMgbXkNCj4gICAgID4gICAgID4+Pj4+PiByZWFzb24gZm9yIHN1Z2dlc3Rpbmcg YSB3YXkgdG8gcXVhbGlmeSB0aGUgc2lnbmF0dXJlIHRvIHJlZmxlY3QNCj4gICAgID4gICAgID4+ Pj4+PiB0aGF0IHZhcmlhYmlsaXR5Lg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+ Pj4+Pj4gT3JpZ2luYXRpbmcgY2FycmllcnMgYXJlIGluIGEgcG9zaXRpb24gdG8ga25vdyBpZiBh IGNhbGwgaXMNCj4gICAgID4gICAgID4+Pj4+PiBjb21pbmcgZnJvbSBhIGRldmljZSBhc3NpZ25l ZCBhIHNpbmdsZSBudW1iZXIsIG9yIGZyb20gInRydW5rDQo+ICAgICA+ICAgICA+Pj4+Pj4gZ3Jv dXAiIHdoaWNoIGNvdWxkIG9yaWdpbmF0ZSBjYWxscyB1c2luZyBtdWx0aXBsZSBudW1iZXJzLCBh bmQNCj4gICAgID4gICAgID4+Pj4+PiBjYW4gcXVhbGlmeSB0byBzb21lIGRlZ3JlZSB0aGUgdHJ1 c3R3b3J0aGluZXNzIG9mIG51bWJlciBhdXRoZW50aWNpdHkgYWNjb3JkaW5nbHkuDQo+ICAgICA+ ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiBNeSBzdWdnZXN0aW9uIHdhcyBxdWFsaWZ5 aW5nIGNhbGxpbmcgbnVtYmVyIGF1dGhlbnRpY2l0eSBpbnRvDQo+ICAgICA+ICAgICA+Pj4+Pj4g Y2F0ZWdvcmllcyBvZiBjYXJyaWVyLXNpZ25lZCAob3Igbm90KSwgYW5kIHVuYXV0aGVudGljYXRl ZCwNCj4gICAgID4gICAgID4+Pj4+PiBzZW1pLWF1dGhlbnRpY2F0ZWQsIGFuZCBtb3N0LWF1dGhl bnRpY2F0ZWQuICBUaGVyZSBjYW4gYmUgbW9yZQ0KPiAgICAgPiAgICAgPj4+Pj4+IGdyYW51bGFy aXR5LCBidXQgaXQgaW1wbGllcyBhZGRpdGlvbmFsIG9wZXJhdGlvbmFsIGNvbXBsZXhpdHkNCj4g ICAgID4gICAgID4+Pj4+PiAoYm90aCBmb3IgdGhlIGNhcnJpZXJzIGFuZCB0aGUgY29uc3VtZXJz KSBhbmQgSSBhc3N1bWUgZGltaW5pc2hlcyB2YWx1ZS4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAg ICAgPiAgICAgPj4+Pj4+IE15IHJlYXNvbiBmb3IgYWRkaW5nIHRoZSBhdXRoZW50aWNpdHkgb2Yg dGhlIG9yaWdpbmF0aW5nIGNhcnJpZXINCj4gICAgID4gICAgID4+Pj4+PiBpcyB0eXBpY2FsIHRy dXN0d29ydGhpbmVzcyBvZiBhIGNhcnJpZXIgYnVzaW5lc3MgcmVsYXRpb25zaGlwDQo+ICAgICA+ ICAgICA+Pj4+Pj4gd2l0aCB0eXBpY2FsIGNvbnN1bWVycyBhZGRzIHRvIHRoZSB0cnVzdHdvcnRo aW5lc3MgYXNzZXNzbWVudCBhbmQNCj4gICAgID4gICAgID4+Pj4+PiBwYXJ0aWFsbHkgYmVjYXVz ZSBjYXJyaWVycyBhcmUgYSByZWd1bGF0ZWQgcG9pbnQgb2YgZm9yZW5zaWMNCj4gICAgID4gICAg ID4+Pj4+PiBpbnF1aXJ5IGZvciBDQUxFQSBhbmQgZnJhdWQuICBBZGRpdGlvbmFsbHksIG1vc3Qg Y2FsbHMgb3JpZ2luYXRlDQo+ICAgICA+ICAgICA+Pj4+Pj4gYW5kIHRlcm1pbmF0ZSBiZXR3ZWVu IG1vYmlsZSBjb25zdW1lcnMgd2hlcmUgdGhlaXIgY2FycmllcnMgYXJlDQo+ICAgICA+ICAgICA+ Pj4+Pj4gYWJsZSB0byB1c2VmdWxseSBhdXRoZW50aWNhdGUgdGhlaXIgZGV2aWNlIGFuZCBoYXZl IGEgaGlnaCBkZWdyZWUNCj4gICAgID4gICAgID4+Pj4+PiBvZiBjb25maWRlbmNlIG9mIHRoZSBh dXRoZW50aWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyLg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ ICAgICA+ICAgICA+Pj4+Pj4gSSB0aGluayBiaWxsaW9ucyBvZiBwZXItVE4gY2VydHMgb2YgdmFy eWluZyB1c2FiaWxpdHkgKHJldm9rZWQsDQo+ICAgICA+ICAgICA+Pj4+Pj4gbm90DQo+ICAgICA+ ICAgICA+Pj4+Pj4gcmV2b2tlZCkgZm9yIGF1dGhlbnRpY2F0aW5nIGNhbGxpbmcgbnVtYmVyIHdp bGwgbm90IHdvcmsgd2VsbC4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ IENvbnZlcnNlbHksIEkgdGhpbmsgYmlsbGlvbnMgb2YgcGVyLVROIGNlcnRzIHdpbGwgd29yayB3 ZWxsLCBpZg0KPiAgICAgPiAgICAgPj4+Pj4+IHRoZSBjYWxsaW5nIHBhcnR5IGhhcyB0byBzaWdu IGEgY2FsbCB3aXRoIGEgcGVyLVROIGNlcnQgcHJvdmlkZWQNCj4gICAgID4gICAgID4+Pj4+PiBi eSB0aGUgY2FsbGVkIHBhcnR5LiAgTm8gY2FsbGVkIHBhcnR5IGNlcnQgdG8gaW5jbHVkZT8gIFRo ZW4gdGhlDQo+ICAgICA+ICAgICA+Pj4+Pj4gY2FsbGluZyBwYXJ0eSBkb2VzIG5vdCBoYXZlIGEg dHJ1c3RlZCByZWxhdGlvbnNoaXAgd2l0aCB0aGUNCj4gICAgID4gICAgID4+Pj4+PiBjYWxsZWQg cGFydHksIGFuZCB0aGUgY2FsbCBjYW4gYmUgYXV0aG9yaXplZC90cmVhdGVkIGFjY29yZGluZ2x5 Lg0KPiAgICAgPiAgICAgPj4+Pj4+IChJJ3ZlIG1hZGUgc2ltaWxhciwgbW9zdGx5IGlnbm9yZWQg Y29tbWVudHMgaW4gTU9ERVJOLikNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+ Pj4+IFBpZXJjZQ0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gKkZyb206 KiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KPiAgICAgPiAgICAgPj4+ Pj4+ICpTZW50OiogQXVndXN0IDA0LCAyMDE2IDI6MDMgUE0NCj4gICAgID4gICAgID4+Pj4+PiAq VG86KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20NCj4g ICAgID4gICAgID4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4gICAg ID4gICAgID4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+ICAgICA+ ICAgICA+Pj4+Pj4gKkNjOiogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0IDxtYWlsdG86 YWxleEBib2JvdGVrLm5ldD4NCj4gICAgID4gICAgID4+Pj4+PiA8bWFpbHRvOmFsZXhAYm9ib3Rl ay5uZXQ+Pjsgc3RpckBpZXRmLm9yZyA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+ICAgICA+ICAg ICA+Pj4+Pj4gPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPiAgICAgPiAgICAgPj4+Pj4+ICpTdWJq ZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+IFdlbGwsIHRoZSBtZWNoYW5pc21zIGFyZSBkZXNpZ25l ZCBzbyB0aGF0IHRoZXkgY291bGQgYmUgZGVwbG95ZWQNCj4gICAgID4gICAgID4+Pj4+PiBvbiBk ZXZpY2VzIGFuZCBQQlhzLiAgV2hldGhlciB0aGV5IHdpbGwgYmUgaXMgYSBwb2xpY3kgaXNzdWUu DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiBUaGUgbm90aW9uIG9mIGNy ZWRlbnRpYWxzIHRoYXQgYXJlIHRyYWNlYWJsZSB0byBhIGRlbGVnYXRpb24gb2YgYQ0KPiAgICAg PiAgICAgPj4+Pj4+IFROIGlzIGEgbWVjaGFuaXNtIHRoYXQgaXMgcGFydCBvZiB0aGUgZGVzaWdu IG9mIHN0aXIsIGFuZCB0aGUNCj4gICAgID4gICAgID4+Pj4+PiBkZXNpZ24gYWxsb3dzIGRlbGVn YXRpb24gb2Ygb25lIFROICh0byBvbmUgZGV2aWNlLCBhbHRob3VnaCBhDQo+ICAgICA+ICAgICA+ Pj4+Pj4gZGV2aWNlIGxpa2UgYSBQQlggd291bGQgaGF2ZSBtb3JlIHRoYW4gb25lIFROIHBlciAi ZGV2aWNlIiwgYW5kDQo+ICAgICA+ICAgICA+Pj4+Pj4gc29tZXRoaW5nIGxpa2UgYSBkdWFsIE5B TSBwaG9uZSBjb3VsZCBoYXZlIG1vcmUgdGhhbiBvbmUNCj4gICAgID4gICAgID4+Pj4+PiBjcmVk ZW50aWFsLiAgRm9yIHRoZSB1c2UgY2FzZSB3ZSd2ZSBkaXNjdXNzZWQsIGEgbW9iaWxlIHBob25l IG1heQ0KPiAgICAgPiAgICAgPj4+Pj4+IGFsc28gaGF2ZSBhIGNyZWRlbnRpYWwgZm9yLCBzYXks IGEgVE4gdGhhdCBpcyBkZWxlZ2F0ZWQgdG8gYQ0KPiAgICAgPiAgICAgPj4+Pj4+IGxhbmRsaW5l LCB0byBjb3ZlciB0aGUgZXhhbXBsZSBjYXNlIG9mIGEgZG9jdG9yIHBsYWNpbmcgYSBjYWxsIG9u DQo+ICAgICA+ICAgICA+Pj4+Pj4gaGlzIG1vYmlsZSwgYnV0IGdldHRpbmcgaGlzIG9mZmljZSBu dW1iZXIgdG8gc2hvdyB1cCBhcyB0aGUgY2FsbGluZyBwYXJ0eS4gIFVzZSBvZiBzdWNoIG1lY2hh bmlzbXMgaXMgcG9saWN5Lg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4g QnJpYW4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAg ICA+Pj4+Pj4gICBPbiBBdWcgNCwgMjAxNiwgYXQgMjo1MiBQTSwgR29ybWFuLCBQaWVyY2UgQSBb Q1RPXQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0KPiAg ICAgPiAgICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPiAgICAg PiAgICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4gICAgID4g ICAgID4+Pj4+PiB3cm90ZToNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ ICAgVGhhbmtzIEJyaWFuLiAgSSdtIGFmcmFpZCB3ZSdyZSBzdHJheWluZyBpbnRvIGEgcG9saWN5 DQo+ICAgICA+ICAgICA+Pj4+Pj4gICBkaXNjdXNzaW9uLiAgUmVnYXJkbGVzcywgSSBkbyBhcHBy ZWNpYXRlIHlvdXIgZXhwbGFuYXRpb24uICBJDQo+ICAgICA+ICAgICA+Pj4+Pj4gICB3b3VsZCBs aWtlIHRvIGNvbnRpbnVlIHRoZSBkaXNjdXNzaW9uLCBidXQgSSdtIHByZXR0eSBzdXJlIHRoaXMN Cj4gICAgID4gICAgID4+Pj4+PiAgIGlzbid0IHRoZSByaWdodCBmb3J1bS4NCj4gICAgID4gICAg ID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgUGllcmNlDQo+ICAgICA+ICAgICA+Pj4+Pj4N Cj4gICAgID4gICAgID4+Pj4+PiAgICpGcm9tOiogQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlh bnJvc2VuLm5ldF0NCj4gICAgID4gICAgID4+Pj4+PiAgICpTZW50OiogQXVndXN0IDA0LCAyMDE2 IDE6MzQgUE0NCj4gICAgID4gICAgID4+Pj4+PiAgICpUbzoqIEdvcm1hbiwgUGllcmNlIEEgW0NU T10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0KPiAgICAgPiAgICAgPj4+Pj4+IDxtYWlsdG86 UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgPG1haWx0bzpQ aWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgKkNjOiogQWxl eCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4NCj4g ICAgID4gICAgID4+Pj4+PiAgIDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBzdGlyQGlldGYu b3JnDQo+ICAgICA+ICAgICA+Pj4+Pj4gPG1haWx0bzpzdGlyQGlldGYub3JnPiA8bWFpbHRvOnN0 aXJAaWV0Zi5vcmc+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAqU3ViamVjdDoqIFJlOiBbc3Rpcl0g U1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAg ID4+Pj4+PiAgIE9mIGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBh cyBzbWFydCBwaG9uZXMgYW5kDQo+ICAgICA+ICAgICA+Pj4+Pj4gICBhbnkgb3RoZXIgZGV2aWNl cyB0aGF0IGNhbiBiZSBwcm9ncmFtbWVkIHRvIGRvIHNvLg0KPiAgICAgPiAgICAgPj4+Pj4+ICAg VGhleSB3aWxsIGJlIGdpdmVuIGNyZWRlbnRpYWxzIHRoYXQgb25seSBhcmUgdmFsaWQgZm9yIHRo ZSBUTnMNCj4gICAgID4gICAgID4+Pj4+PiAgIHRoZXkgYXJlIGF1dGhvcml6ZWQgdG8gc2lnbiBm b3IuICBUaGV5IGNhbiB0cnkgdG8gc2lnbiBhbnkgY2FsbCwNCj4gICAgID4gICAgID4+Pj4+PiAg IGJ1dCB0aGUgdmFsaWRpdHkgb2YgdGhlIGNyZWRlbnRpYWwgd291bGQgbWFrZSBzdWNoIGEgc2ln bmF0dXJlDQo+ICAgICA+ICAgICA+Pj4+Pj4gICBmYWlsIHRoZSBjaGVja2luZy4NCj4gICAgID4g ICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgR2V0dGluZyBzZXJ2aWNlIHByb3ZpZGVy cyB0byBzaWduIG9uIGJlaGFsZiBvZiBkZXZpY2VzIGlzIGENCj4gICAgID4gICAgID4+Pj4+PiAg IHJlYXNvbmFibGUgd2F5IHRvIGRlcGxveSBxdWlja2x5LCBidXQgSSBleHBlY3QgbWFueSBTUHMg d2lsbCB3YW50DQo+ICAgICA+ICAgICA+Pj4+Pj4gICB0byBnZXQgb3V0IG9mIHRoZSBsaWFiaWxp dHkgb2Ygc2lnbmluZyBvbiBiZWhhbGYgb2YgdGhlaXINCj4gICAgID4gICAgID4+Pj4+PiAgIGN1 c3RvbWVycy4gIElmIHRoZXkgY2FuIHB1c2ggb2YgdGhhdCByZXNwb25zaWJpbGl0eSB0byB0aGVp cg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgY3VzdG9tZXIsIG9ubHkgYmVpbmcgcmVzcG9uc2libGUg Zm9yIGdldHRpbmcgdGhlIGN1c3RvbWVyIGFuDQo+ICAgICA+ICAgICA+Pj4+Pj4gICBhcHByb3By aWF0ZSBjcmVkZW50aWFsIHdoZW4gdGhleSBhc3NpZ24gVE5zLCB0aGVuIEkgd291bGQgZXhwZWN0 DQo+ICAgICA+ICAgICA+Pj4+Pj4gICB0aGVtIHRvIHdhbnQgdG8gZG8gc28uICBUaGF0IG1lYW5z IHRoZSBkZXZpY2VzIGhhdmUgdG8gYmUgYWJsZSB0bw0KPiAgICAgPiAgICAgPj4+Pj4+ICAgc2ln biwgYnV0IEkgdW5kZXJzdGFuZCBtYW55IG9mIHRoZSBQQlggdmVuZG9ycyB0aGluayB0aGF0J3MN Cj4gICAgID4gICAgID4+Pj4+PiAgIHNvbWV0aGluZyB0aGV5IGNvdWxkIHByb3ZpZGUgaW4gYSBm dXR1cmUgcmVsZWFzZS4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAg QnJpYW4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAg ICA+Pj4+Pj4gICAgICAgT24gQXVnIDQsIDIwMTYsIGF0IDI6MjIgUE0sIEdvcm1hbiwgUGllcmNl IEEgW0NUT10NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICA8UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tDQo+ICAgICA+ICAgICA+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+ IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4gICAgID4gICAgID4+Pj4+PiAg ICAgICB3cm90ZToNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg IFlvdSB3YW50IElQIFBCWGVzIHRvIHNpZ24gY2FsbHM/ICBXb24ndCB0aGF0IG1ha2UgaXQNCj4g ICAgID4gICAgID4+Pj4+PiAgICAgICBleHRyYW9yZGluYXJpbHkgZWFzeSB0byBjb21taXQgZnJh dWQgd2l0aCBhdXRoZW50aWNhdGVkIG51bWJlcnM/DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAg ID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICpGcm9tOiogQnJpYW4gUm9z ZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAq U2VudDoqIEF1Z3VzdCAwNCwgMjAxNiAxMjoyNCBQTQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICpUbzoqIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0K PiAgICAgPiAgICAgPj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPiAg ICAgPiAgICAgPj4+Pj4+ICAgICAgIDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4N Cj4gICAgID4gICAgID4+Pj4+PiAgICAgICAqQ2M6KiBBbGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rl ay5uZXQgPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBzdGlyQGlldGYub3JnDQo+ICAgICA+ICAgICA+ Pj4+Pj4gPG1haWx0bzpzdGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+ICAg ICA+ICAgICA+Pj4+Pj4gICAgICAgKlN1YmplY3Q6KiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0x MCBjb21tZW50cw0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg Rmlyc3Qgb2YgYWxsLCB3ZSB3b3VsZCB3YW50IHRoZSBQQlggdG8gZ2VuZXJhdGUgdGhlIHNpZ25h dHVyZSwNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICBidXQgdGhlIHNlcnZpY2UgcHJvdmlkZXIg Y2FuIGRvIHRoYXQuICBJdCBzaG91bGQgbm90IGFkZCBhDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAg ICAgdmFsaWQgc2lnbmF0dXJlIHRvIGEgY2FsbCBmcm9tIGEgbnVtYmVyIGl0IGRpZCBub3QgYXNz aWduIHRvDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgdGhlIHRydW5rIGdyb3VwIGNvbm5lY3Rp bmcgdG8gdGhlIFBCWCwgYWx0aG91Z2ggaXQgY291bGQNCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICBzdXBwb3J0IHRoZSBleHRyYSBkZWxlZ2F0aW9uIHJlcXVpcmVkIHRvIHN1cHBvcnQgImF1dGhv cml6ZWQNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICBzcG9vZmluZyIuICBUaGUgY29tcGFuaW9u IGRldmljZXMgSSdtIGF3YXJlIG9mIGFsd2F5cyBzZW5kDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAg ICAgY2FsbHMgZnJvbSB0aGUgc2FtZSBzZXJ2aWNlIHByb3ZpZGVyIGFuZCBzaG91bGQgbm90IHBy ZXNlbnQNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICBhbnkgaXNzdWUuDQo+ICAgICA+ICAgICA+ Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICBFdmVyeW9uZSB3aWxsIGhhdmUgdG8gZG8g d29yayB0aGV5IGRvbid0IGRvIG5vdyB0byBpbXBsZW1lbnQNCj4gICAgID4gICAgID4+Pj4+PiAg ICAgICBzdG9wIHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTA0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgQnJpYW4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAg PiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIE9uIEF1ZyA0LCAyMDE2 LCBhdCAxMjo0MSBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPiAgICAgPiAgICAgPj4+Pj4+ ICAgICAgICAgICA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tIDxtYWlsdG86UGllcmNlLkdvcm1h bkBzcHJpbnQuY29tPg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICA8bWFpbHRvOlBpZXJj ZS5Hb3JtYW5Ac3ByaW50LmNvbT4+IHdyb3RlOg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ ICAgICA+Pj4+Pj4gICAgICAgICAgIEZyYXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29t bW9uLiAgQW5kIGV2ZW4gd2hlcmUgYQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBQQlgg aXMgbm90IGNvbXByb21pc2VkLCBhIGNhcnJpZXIgaGFzIG5vIHByYWN0aWNhbCB3YXkgb2YNCj4g ICAgID4gICAgID4+Pj4+PiAgICAgICAgICAga25vd2luZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51 bWJlciBpcyBwcm9wZXJseSBhc3NpZ25lZA0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBh bmQgdmFsaWQgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgdGhlIEVudGVycHJpc2UuDQo+ICAgICA+ ICAgICA+Pj4+Pj4gICAgICAgICAgIFRoZXJlZm9yZSwgY2hlY2tpbmcgd2hldGhlciB0aGUgY2Fs bGluZyBudW1iZXIgd2FzIGZyb20gYW4NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgYXNz aWduZWQgcmFuZ2UgbWlnaHQgYmUgcG9zc2libGUgKGFuZCBmcmF1Z2h0IHdpdGgNCj4gICAgID4g ICAgID4+Pj4+PiAgICAgICAgICAgYWRtaW5pc3RyYXRpdmUgY2hhbGxlbmdlcyksIGJ1dCBvZiBs aW1pdGVkIHZhbHVlLiAgQW5kIGluDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIHRoZSBj b25zdW1lciBtYXJrZXQsIHRoZXJlIGFyZSBjYWxsaW5nIHByb2R1Y3RzIHdoaWNoDQo+ICAgICA+ ICAgICA+Pj4+Pj4gICAgICAgICAgIHN1cHBvcnQgYSBwYXJlbnQgc3Vic2NyaWJlciBudW1iZXIg YW5kICJjb21wYW5pb24iIGRldmljZXMNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgKGUu Zy4sIHRhYmxldHMpIHdoaWNoIGNhbiBwbGFjZSBhIGNhbGwgdXNpbmcgdGhlIE1ETiBvZg0KPiAg ICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICB0aGUgcGFyZW50IHN1YnNjcmliZXIuICBUaGVzZSBh cmUgZXhhbXBsZXMgb2Ygd2hlcmUgdGhlDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIGF1 dGhlbnRpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgd29uJ3QgbmVjZXNzYXJpbHkgbWVhbg0K PiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICB0aGUgc2FtZSB0aGluZyBhcyB0aGUgYXV0aGVu dGljaXR5IG9mIGEgY2FsbCBmcm9tIGEgc2luZ2xlDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgIHN1YnNjcmliZXIgd2l0aCBhIHNpbmdsZSBNRE4gcmVnYXJkbGVzcyBvZiAibGF4aXR5IiBv Zg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBzcG9vZiBjaGVja2luZy4NCj4gICAgID4g ICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBJbiBhbm90aGVyIGZvcnVt IGFuZCBhbnRpY2lwYXRpbmcgY2FsbGluZyBudW1iZXINCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICAgICAgYXV0aGVudGljYXRpb24gbWFuZGF0ZXMgZnJvbSBDb25ncmVzcyBhbmQvb3IgRkNDLCBJ DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIHN1Z2dlc3RlZCB1c2luZyBjYXJyaWVyLXNw ZWNpZmljIGNlcnRzIGFuZCBlbmNvZGluZw0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBz cGVjaWZpY2l0eSBvZiBhdXRoZW50aWNpdHksIGFuZCBjYWxsaW5nIG51bWJlci4gIFRoaXMNCj4g ICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgcHJvdmlkZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBv cmlnaW5hdGluZyBjYXJyaWVyLCBzb21lDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIGlk ZWEgYXMgdG8gdGhlIGFjY3VyYWN5IG9yIHNwZWNpZmljaXR5IG9mIHRoZSBjYWxsaW5nDQo+ICAg ICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIG51bWJlciwgYW5kIHZhbGlkdHkgb2YgdGhlIGNhbGxp bmcgbnVtYmVyIChhc3N1bWluZyBub25jZQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBh bmQgcmVwbGF5IGlzc3VlcyBjYW4gYmUgYWRkcmVzc2VkIGFzIHJlYXNvbmFibHkgc3VnZ2VzdGVk DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIGJlbG93IGJ5IEFsZXgpLg0KPiAgICAgPiAg ICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIFRoZSByZXByZXNlbnRhdGlv biBvZiBvcmlnLWNhcnJpZXIgYW5kIHRydXN0d29ydGhpbmVzcw0KPiAgICAgPiAgICAgPj4+Pj4+ ICAgICAgICAgICBjb3VsZCBiZSBhcyBmb2xsb3dzOg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAg ICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICpSZWd1bGF0ZWQvbWFuZGF0ZWQgQ2FycmllciBDbGFz cyBVc2UgQ2FzZToqDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICAgICAgKjAwIC0gTm8gQ3JlZGVudGlhbHMqDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAg IFVzZSBjYXNlIGV4YW1wbGUocyk6IFByZS1JTVMsIGxlZ2FjeSBjaXJjdWl0LXN3aXRjaGVkDQo+ ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIG5ldHdvcmtzIHRoYXQgZG9uJ3QgbmF0aXZlbHkg c3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3QNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAg Y2hvb3NlIHRvIHNpZ24gY2FsbHMuICBFLmcuLCBpbnRlcm5hdGlvbmFsIGNhcnJpZXJzLg0KPiAg ICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBUcnVzdCBFc3RpbWF0ZTogIEdvb2QgbHVjay4gIENh cnJpZXJfb3JpZyBhbmQgQ2dQTg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBlbnRpcmVs eSB1bnRydXN0d29ydGh5Lg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4g ICAgICAgICAgICowMSAtIENhcnJpZXIgc2lnbmVkLCBubyBhdXRoZW50aWNhdGlvbiBvZiBDZ1BO Kg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBVc2UgY2FzZSBleGFtcGxlKHMpOiBFOTEx IG9uIHZpc2l0ZWQgbmV0d29yayB3L28gcm9hbWluZw0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICAgICBhZ3JlZW1lbnQsIG1hbnVhbCByb2FtaW5nLg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICAgICBUcnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBlbnRp cmVseQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICB1bnRydXN0d29ydGh5DQo+ICAgICA+ ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgKjEwIC0gQ2FycmllciBz aWduZWQsIHNlbWktYXV0aGVudGljYXRlZCBDZ1BOKg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICAgICBVc2UgY2FzZSBleGFtcGxlKHMpOiBOdW1iZXIgYmxvY2sgZGVsZWdhdGVkIGZyb20gT0NO LCBidXQNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgbm8gcGVyLVROIHNjcmVlbiAoU0lQ IHRydW5rcykuDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIFRydXN0IEVzdGltYXRlOiAg Q2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGxlc3MgdGhhbg0KPiAgICAgPiAgICAgPj4+ Pj4+ICAgICAgICAgICBtb3N0IHRydXN0d29ydGh5IGJ1dCBub3QgZW50aXJlbHkgdW50cnVzdHdv cnRoeS4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAq MTEgLSBDYXJyaWVyIHNpZ25lZCwgYXV0aGVudGljYXRlZCBDZ1BOKg0KPiAgICAgPiAgICAgPj4+ Pj4+ICAgICAgICAgICBVc2UgY2FzZSBleGFtcGxlKHMpOiBCcmVhZC1hbmQtYnV0dGVyIDk1JSsg b2YgY2FsbHMgZnJvbQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBzdWJzY3JpYmVyIGxp bmVzIChJTVMtYmFzZWQgYW5kIG90aGVyd2lzZSkuDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgIFRydXN0IEVzdGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIG1vc3QN Cj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgdHJ1c3R3b3J0aHkNCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAqUHVibGljIFVzZSBDYXNlOioNCj4g ICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBVbmRlZmluZWQg YnV0IGFzc3VtZWQgdG8gdXNlIHB1YmxpYyBvciBjb21tZXJjaWFsbHkNCj4gICAgID4gICAgID4+ Pj4+PiAgICAgICAgICAgYXZhaWxhYmxlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2VzIHJlc291cmNl cy4gIGUuZy4sDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIG5vbW9yb2JvLWxpa2UgY3Jv d2Qtc291cmNlZCBhY2NlcHQvZGVueSBsaXN0cywgZXQgY2V0ZXJhLg0KPiAgICAgPiAgICAgPj4+ Pj4+ICAgICAgICAgICBDb3VsZC93b3VsZCBwYXNzIGNyZWRlbnRpYWxzIGRvd24gdG8gU0lQLWF3 YXJlIGRldmljZXMNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgd2hpY2ggd291bGQgcHJv Y2VzcyB0aGVtIGFjY29yZGluZyB0byB0aGUgcnVsZXMgb2YgdGhlDQo+ICAgICA+ICAgICA+Pj4+ Pj4gICAgICAgICAgIFB1YmxpYyBDbGFzcyBhcHBsaWNhdGlvbihzKS4NCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBQaWVyY2UNCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAqRnJvbToqIEJyaWFuIFJvc2VuIFtt YWlsdG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICpT ZW50OiogQXVndXN0IDA0LCAyMDE2IDk6MDIgQU0NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAg ICAgKlRvOiogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0DQo+ICAgICA+ICAgICA+Pj4+ Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAg ICA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAg ICAqQ2M6KiBzdGlyQGlldGYub3JnDQo+ICAgICA+ICAgICA+Pj4+Pj4gPG1haWx0bzpzdGlyQGll dGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgICpTdWJqZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4gICAg ID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBUaGVyZSBhcmUgcmVh c29uYWJsZSBjaXJjdW1zdGFuY2VzIHdoZXJlIGEgcGFydHkgcGxhY2luZyBhDQo+ICAgICA+ICAg ICA+Pj4+Pj4gICAgICAgICAgIGNhbGwgaXMgbm90IHRoZSBhdXRob3JpemVkIGVudGl0eSBhc3Np Z25lZCB0aGUgdGVsZXBob25lDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIG51bWJlciB1 c2VkIGluIEZyb20vUEFJLCBhbmQgaW4gc3VjaCBjaXJjdW1zdGFuY2VzIHRoZQ0KPiAgICAgPiAg ICAgPj4+Pj4+ICAgICAgICAgICBzZXJ2aWNlIHByb3ZpZGVyIHNlcnZpY2luZyB0aGUgZW50aXR5 IHBsYWNpbmcgdGhlIGNhbGwgbWF5DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIG9yIG1h eSBub3QgYmUgdGhlIHNhbWUgYXMgdGhlIHNlcnZpY2UgcHJvdmlkZXIgc2VydmluZyB0aGUNCj4g ICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgZW50aXR5IHRoYXQgaXMgYXNzaWduZWQgdGhlIFRO LiAgSW4gYWxsIHN1Y2ggY2FzZXMsIHRoZQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBl bnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4gZXhwbGljaXRseSBhdXRob3JpemVzIGNhbGxz DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIHBsYWNlZCB1c2luZyBpdCdzIFROLiAgVGhl IGRlc2lnbiBhY2NvbW1vZGF0ZXMgc3VjaCB1c2UNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAg ICAgY2FzZXMuICBJdCdzIG5vdCBhIGJsYW5rZXQgYXV0aG9yaXphdGlvbiB3aXRob3V0DQo+ICAg ICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIGF1dGhlbnRpY2F0aW9uLiAgIFdlJ3JlIG5vdCBhd2Fy ZSBvZiBhbnkgY2FzZXMgd2hlcmUgdGhlcmUNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAg aXMgYW4gYWN0dWFsIHJlcXVpcmVtZW50IGZvciBsZWdpdGltYXRlIGNhbGxpbmcgd2l0aG91dA0K PiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBleHBsaWNpdCBhdXRob3JpemF0aW9uIGZyb20g dGhlIGFzc2lnbmVkIGVudGl0eSwgYWx0aG91Z2gNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAg ICAgd2UgY2VydGFpbmx5IGFyZSBhd2FyZSB0aGF0IHZhcmlvdXMgcGFydHMgb2YgdmFyaW91cw0K PiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBzZXJ2aWNlIHByb3ZpZGVycyBkb24ndCBib3Ro ZXIgdG8gY2hlY2suIEF0IHRoaXMgcG9pbnQsIGF0DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgIGxlYXN0IGluIHNvbWUgY291bnRyaWVzLCB0aGVyZSBpcyBhIHJlYWxpemF0aW9uIHRoYXQg dGhlDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgIGxheGl0eSBvZiBhbGxvd2luZyB1bmNo ZWNrZWQgc3Bvb2ZpbmcgaXMgbm90IGFjY2VwdGFibGUNCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICAgICAgYW55IG1vcmUuDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAg ICAgICAgICAgQnJpYW4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBPbiBBdWcgMywgMjAxNiwgYXQgODozNSBB TSwgQWxleCBCb2JvdGVrDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICA8YWxleEBi b2JvdGVrLm5ldA0KPiAgICAgPiAgICAgPj4+Pj4+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4g PG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pj4gd3JvdGU6DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4g ICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIDEuICAgICAgIFBlcm1pdCBhdXRob3JpemF0 aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAg ICAgIEluIHRoZSBjdXJyZW50IHRlbGVwaG9ueSBuZXR3b3JrIHByYWN0aWNlLCBzb21lDQo+ICAg ICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBzZXJ2aWNlIHByb3ZpZGVyIGltcGxlbWVudGF0 aW9ucyBjaG9vc2Ugbm90IHRvDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBhdXRo ZW50aWNhdGUgaWRlbnRpdHksIGJ1dCBzaW1wbHkgZmFjaWxpdGF0ZSB0aGUgdXNlDQo+ICAgICA+ ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBvZiBhbiBhcmJpdHJhcnkgb3Igc2VsZWN0ZWQgdXNl ci1wcm92aWRlZCBpZGVudGl0eS4NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIEFy ZSB0aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8gIEhhcyBhbnlvbmUNCj4gICAg ID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGVzdGFibGlzaGVkIHRoYXQgdGhlcmUgYXJlIG5v dD8gIEhvdyBjYW4gdGhlIGluZHVzdHJ5DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAg ICByZWFzb25hYmx5IGV4cGVjdCB0byBlbmQgdGhpcyAob2Z0ZW4gYmFkKSBwcmFjdGljZT8NCj4g ICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIElmIGl0IGNhbid0IGJlIGVuZGVkLCB0aGVy ZSdzIHZhbHVlIGluIGF0IGxlYXN0DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBp ZGVudGlmeWluZyB0aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92aWRlcg0KPiAgICAgPiAgICAg Pj4+Pj4+ICAgICAgICAgICAgICAgKGkuZS4sIHRoZSBzaWduZXIvYXV0aG9yaXplcikuICBHaXZl biB0aGUgcHJldmFsZW5jZQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgb2YgYWJ1 c2UgdXNpbmcgdGVsZXBob25lIG51bWJlcnMgYXNzaWduZWQgdG8gYQ0KPiAgICAgPiAgICAgPj4+ Pj4+ICAgICAgICAgICAgICAgc29tZXRpbWVzLWFub255bW91cyBhYnVzZXIsIGl0IGJlY29tZXMg Y3JpdGljYWxseQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgaW1wb3J0YW50IHRv IGlkZW50aWZ5IHRoZSBzZXJ2aWNlIHByb3ZpZGVyKHMpIGNsb3Nlc3QNCj4gICAgID4gICAgID4+ Pj4+PiAgICAgICAgICAgICAgIHRvIHRoZSBhYnVzZXIuICBCYXNlZCBvbiB0aGUgYXNzdW1wdGlv biB0aGF0IGl0J3MNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGJldHRlciB0byBJ RCBzZXJ2aWNlIHByb3ZpZGVycyB0aGFuIHVucmVhc29uYWJseQ0KPiAgICAgPiAgICAgPj4+Pj4+ ICAgICAgICAgICAgICAgZXhwZWN0IGEgYmFuIG9mIHRoZSB1c2Ugb2YgdW5hdXRoZW50aWNhdGVk IChhbmQNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHRoZXJlZm9yZSB1bnNpZ25l ZCkgU0lQIHJlcXVlc3RzLCBTVElSIHNpZ25pbmcgc2hvdWxkDQo+ICAgICA+ICAgICA+Pj4+Pj4g ICAgICAgICAgICAgICBzdXBwb3J0IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlv bi4gIFRoZQ0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgcHJhY3RpY2Ugb2YgYXV0 aG9yaXppbmcgdW5hdXRoZW50aWNhdGVkIHVzZSBleGlzdHMsDQo+ICAgICA+ICAgICA+Pj4+Pj4g ICAgICAgICAgICAgICBhbmQgdGhlcmUgaXMgYmVuZWZpdCB0byBzaWduaW5nIGluIHRoZXNlIGNh c2VzDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAoc2VydmljZSBwcm92aWRlciBp ZGVudGlmaWNhdGlvbikuICBUaGUgbGFuZ3VhZ2Ugb2YNCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICAgICAgICAgIHRoZSBJRCBzaG91bGQgcGVybWl0IHRoaXMgdXNlLiAgNDQ3NGJpcy0xMCBzaG91 bGQgTk9UDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICByZXF1aXJlIG9yIGFzc3Vt ZSB0aGF0ICB0aGF0IGF1dGhlbnRpY2F0aW9uIHdpbGwNCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICAgICAgICAgIHByZWNlZGUgYXV0aG9yaXphdGlvbi4gT2YgY291cnNlIHRoZXJlIG1heSBiZSBv dGhlcg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgdXNlIGNhc2VzIHdoZXJlIHNp Z25pbmcgaW5jbHVkZXMgYXV0aGVudGljYXRpb24gYW5kDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAg ICAgICAgICAgICBtYXkgbm90IGluY2x1ZGUgYSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVyJ3MN Cj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGF1dGhvcml6YXRpb24uDQo+ICAgICA+ ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICAgICAgICAgMi4gICAgICAgSW1wcm92ZSByZXBsYXkgcHJldmVudGlvbg0KPiAgICAgPiAgICAg Pj4+Pj4+ICAgICAgICAgICAgICAgUHJveGltYXRlIHJlcGxheSBpcyBwb3NzaWJsZSB3aGlsZSBj b21wbHlpbmcgd2l0aCB0aGlzDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBzcGVj LiAgRmlyc3QsIG9uZSBvciBtb3JlIHByb3hpbWF0ZSAoZS5nLiwgd2l0aGluIDYwDQo+ICAgICA+ ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBzZWNvbmRzKSBTSVAgcmVxdWVzdHMgdXNpbmcgdGhl IHNhbWUgdG9rZW4gYXJlIGxlZ2FsDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBh bmQgc3ViamVjdCB0byByZXBsYXkgaW4gbWFueSBjYXNlcy4gIEFuIFNEUCBib2R5J3MNCj4gICAg ID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIG1reSBtYXkgbm90IGJlIHByZXNlbnQgYW5kIGlm IHByZXNlbnQgaXRzIHVzZSBpcw0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgb3B0 aW9uYWwuICBTb21lIHNvcnQgb2YgbWFuZGF0b3J5IG5ldyBvciBleGlzdGluZw0KPiAgICAgPiAg ICAgPj4+Pj4+ICAgICAgICAgICAgICAgc2lnbmVkIHNlcXVlbmNlLCByYW5kb20gIyBvciByZXF1 ZXN0IElEIChlLmcuLCBDYWxsLUlEDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBv ciBDU2VxKSBhbmQgYSAxLXRpbWUgdXNlIHBvbGljeSBvbiB0aGUgcmVjZWl2aW5nIGVuZA0KPiAg ICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgb2YgdGhlIHJlcXVlc3QgKGUuZy4sIHRva2Vu cyBvbmx5IGdvb2QgZm9yIDENCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIHVzZSkg Y291bGQgcHJldmVudCByZXBsYXkuICBEaWZmZXJlbnQgbWV0aG9kcyAoZS5nLiwNCj4gICAgID4g ICAgID4+Pj4+PiAgICAgICAgICAgICAgIElOVklURSB2cyBNRVNTQUdFKSBtaWdodCBiZSBoYW5k bGVkIGJ5IGRpZmZlcmVudA0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgcmVjZWl2 aW5nIGluZnJhc3RydWN0dXJlLCBhbmQgdGhlcmVmb3JlIGRpZmZpY3VsdGllcw0KPiAgICAgPiAg ICAgPj4+Pj4+ICAgICAgICAgICAgICAgd2l0aCAnaXQncyBiZWVuIHVzZWQgYWxyZWFkeScgY29v cmRpbmF0aW9uIGFsbG93IGENCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIGZha2Vk IE1FU1NBR0UgYmFzZWQgb24gYSBjYXB0dXJlZCByZXF1ZXN0LiBUaGlzIG1pZ2h0DQo+ICAgICA+ ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBpbmNsdWRlIGFuIG1rZXkgZnJvbSBhIGNhcHR1cmVk IElOVklURS4gICBTbyBpdCBtYXkgYmUNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAg IHBvc3NpYmxlIHRvIERPUywgc3BhbSBvciB0ZXh0LWJvbWIgYSByZWNpcGllbnQgdXNpbmcgYQ0K PiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgY2FwdHVyZWQgaWRlbnRpdHkuICBXaGls ZSBsYXJnZS1zY2FsZSBvciBkaXN0cmlidXRlZA0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAg ICAgICAgaW1wbGVtZW50YXRpb25zIG1heSBtYWtlIHRoZSBlbmZvcmNlbWVudCBkaWZmaWN1bHQs DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICB0aGVyZSBpcyBsaXR0bGUgY29zdCB0 byBzaWduaW5nIGFuZCBkZWNvZGluZyBhIG1ldGhvZA0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICAgICAgICAgYW5kIHBvc3NpYmx5IGEgbnVtZXJpYyBJRC4gICBTb21lIHNvcnQgb2YgJzEtdXNl Jw0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgcHJhY3RpY2Ugc2hvdWxkIGF0IGxl YXN0IGJlIGRpc2N1c3NlZCB3aGlsZSBwZXJoYXBzDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgICAgICBub3QgcmVxdWlyZWQuDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgU3BlY2lmaWMgbWFya3VwIHN1 Z2dlc3Rpb25zOg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAg ID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgIE5JVFMNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAg ICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBUaGUg dmVyaWZpZXIgTVVTVCBpbnNwZWN0IGFueSBvcHRpb25hbCAicHB0Ig0KPiAgICAgPiAgICAgPj4+ Pj4+IHBhcmFtZXRlciBhcHBlYXJpbmcgKmluKnRoZQ0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAg ICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBJZGVudGl0eSByZXF1ZXN0LiAgSWYgbm8g InBwdCIgcGFyYW1ldGVyIGlzDQo+ICAgICA+ICAgICA+Pj4+Pj4gcHJlc2VudCwgdGhlbiB0aGUN Cj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAg dmVyaWZpZXIgcHJvY2VlZHMgbm9ybWFsbHkgYmVsb3cuICBJZiBhICJwcHQiDQo+ICAgICA+ICAg ICA+Pj4+Pj4gcGFyYW1ldGVyIHZhbHVlIGlzDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4g ICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIHByZXNlbnQsIGFuZCB0aGUgdmVyaWZpZXIgZG9l cyBub3Qgc3VwcG9ydCBpdCwNCj4gICAgID4gICAgID4+Pj4+PiBpdCBNVVNUIGlnbm9yZSB0aGUN Cj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAg SWRlbnRpdHkgaGVhZGVyLiAgSWYgYSBzdXBwb3J0ZWQgInBwdCIgcGFyYW1ldGVyDQo+ICAgICA+ ICAgICA+Pj4+Pj4gdmFsdWUgaXMgcHJlc2VudCwNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAg PiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgdGhlIHZlcmlmaWVyIGZvbGxvd3MgdGhlIHBy b2NlZHVyZXMgYmVsb3csDQo+ICAgICA+ICAgICA+Pj4+Pj4gaW5jbHVkaW5nIHRoZSB2YXJpYXRp b25zDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAg ICAgIGRlc2NyaWJlZCBpbiBTdGVwIDUuDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAg ID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4g ICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgICAzDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgICAgICAgICAgPGZpbGU6Ly8vQzovVXNlcnMvYWIzNzc4L0RvY3VtZW50cy9JRVRGL2RyYWZ0 LWlldGYtc3Rpci1yZmM0NDc0YmlzLTEwJTIwLSUyMEF1dGhlbnRpY2F0ZWQlMjBJZGVudGl0eSUy ME1hbmFnZW1lbnQlMjBpbiUyMHRoZSUyMFNlc3Npb24lMjBJbml0aWF0aW9uJTIwUHJvdG9jb2wl MjAlMjhTSVAlMjkuaHRtI3NlY3Rpb24tMz4uDQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAg ICAgICAgICAgQmFja2dyb3VuZA0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+ Pj4gICAgICAgICAgICAgICBbLi4uXQ0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+ Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAg ICAgICAgUGVyIFtSRkM3MzQwDQo+ICAgICA+ICAgICA+Pj4+Pj4gPGh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9yZmM3MzQwPl0sIHByb2JsZW1zIHN1Y2ggYXMNCj4gICAgID4gICAgID4+Pj4+ PiByb2JvY2FsbGluZywgdm9pY2VtYWlsIGhhY2tpbmcsIGFuZA0KPiAgICAgPiAgICAgPj4+Pj4+ DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBzd2F0dGluZyBhcmUgZW5hYmxl ZCBieSBhbiBhdHRhY2tlcidzIGFiaWxpdHkgdG8NCj4gICAgID4gICAgID4+Pj4+PiBpbXBlcnNv bmF0ZSBzb21lb25lDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAgICAg ICAgICAgICAgICAgIGVsc2UuICBUaGUgc2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUA0KPiAg ICAgPiAgICAgPj4+Pj4+IGFwcGxpY2F0aW9ucyBhbmQgc2VydmljZXMNCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgZGVwZW5kcyBvbiBhdXRo ZW50aWNhdGluZyBhbmQvb3IgYXV0aG9yaXppbmcgdGhlDQo+ICAgICA+ICAgICA+Pj4+Pj4gc291 cmNlIG9mIGNvbW11bmljYXRpb25zIGFzIGl0IGlzDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAg ID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIHJlcHJlc2VudGVkIGluIGEgU0lQIHJlcXVl c3QuDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAg Pj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBUaGlzIGlkZW50aXR5 IGFyY2hpdGVjdHVyZSBmb3IgU0lQIGRlcGVuZHMgb24NCj4gICAgID4gICAgID4+Pj4+PiBpbmNs dWRlcyBwcm92aXNpb25zIGZvciBhIGxvZ2ljYWwNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAg PiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgImF1dGhlbnRpY2F0aW9uIHNlcnZpY2UiIHdo aWNoIHZhbGlkYXRlcyBjYWxsZXINCj4gICAgID4gICAgID4+Pj4+PiBpZGVudGl0eSBhdCBvciBu ZWFyIG9yaWdpbmF0aW9uLiAgb3V0Z29pbmcNCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAg ICAgIHJlcXVlc3RzLiAgQW4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ ICAgICAgICAgICAgICAgICAgYXV0aGVudGljYXRpb24gc2VydmljZSBtYXkgYmUgaW1wbGVtZW50 ZWQgZWl0aGVyDQo+ICAgICA+ICAgICA+Pj4+Pj4gYXMgcGFydCBvZiBhIHVzZXINCj4gICAgID4g ICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgYWdlbnQgb3Ig YXMgYSBwcm94eSBzZXJ2ZXI7IHR5cGljYWxseSwgaXQgaXMgYQ0KPiAgICAgPiAgICAgPj4+Pj4+ IGNvbXBvbmVudCBvZiBhIG5ldHdvcmsNCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAg Pj4+Pj4+ICAgICAgICAgICAgICAgICAgaW50ZXJtZWRpYXJ5IGxpa2UgYSBwcm94eSB0byB3aGlj aCBvcmlnaW5hdGluZw0KPiAgICAgPiAgICAgPj4+Pj4+IHVzZXIgYWdlbnRzIHNlbmQNCj4gICAg ID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgdW5zaWdu ZWQgcmVxdWVzdHMuICBPbmNlIHRoZSBzZW5kZXIgb2YgdGhlDQo+ICAgICA+ICAgICA+Pj4+Pj4g bWVzc2FnZSBoYXMgYmVlbg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4N Cj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+ Pj4gICAgICAgICAgICAgICAgICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIG1lYW5zIG9mIHNo YXJpbmcgYQ0KPiAgICAgPiAgICAgPj4+Pj4+IGNyeXB0b2dyYXBoaWMgYXNzdXJhbmNlDQo+ICAg ICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAgICAgICAgICAgICAgICAgIG9mIGF1 dGhlbnRpY2l0eSBvZiBhbmQvb3IgYXV0aG9yaXphdGlvbiB0byB1c2UNCj4gICAgID4gICAgID4+ Pj4+PiBlbmQtdXNlciBTSVAgaWRlbnRpdHkgaW4gYW4gaW50ZXJkb21haW4gb3IgaW50cmFkb21h aW4gY29udGV4dC4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAg ICAgICAgICAgICAgSXQgcmVsaWVzIG9uIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlDQo+ICAg ICA+ICAgICA+Pj4+Pj4gY29uc3RydWN0aW5nIHRva2VucyBiYXNlZCBvbiBbLi4uXQ0KPiAgICAg PiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAg ICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+PiAg ICAgICAgICAgICAgICAgIFRvIG1heGltaXplIGVuZC10by1lbmQgc2VjdXJpdHksIGl0IGlzIHR5 cGljYWxseQ0KPiAgICAgPiAgICAgPj4+Pj4+IG9idmlvdXNseQ0KPiAgICAgPiAgICAgPj4+Pj4+ DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAgICBwcmVmZXJhYmxlIGZvciBlbmQt dXNlcnMgdG8gYWNxdWlyZSB0aGVpciBvd24NCj4gICAgID4gICAgID4+Pj4+PiBjcmVkZW50aWFs czsgaWYgdGhleQ0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAg ICAgICAgICAgICBkbywgdGhlaXIgdXNlciBhZ2VudHMgY2FuIGFjdCBhcyBhdXRoZW50aWNhdGlv bg0KPiAgICAgPiAgICAgPj4+Pj4+IHNlcnZpY2VzLiAgSG93ZXZlciwNCj4gICAgID4gICAgID4+ Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgICAgZm9yIHNvbWUgZGVwbG95 bWVudHMsIFsuLi5dDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAg ICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBSZWdhcmRz LA0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICBB bGV4DQo+ICAgICA+ICAgICA+Pj4+Pj4gICAgICAgICAgICAgICAqICoNCj4gICAgID4gICAgID4+ Pj4+PiAgICAgICAgICAgICAgICpBbGV4IEJvYm90ZWsqDQo+ICAgICA+ICAgICA+Pj4+Pj4NCj4g ICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICAgICAgX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gICAgID4gICAgID4+ Pj4+PiAgICAgICAgICAgICAgIHN0aXIgbWFpbGluZyBsaXN0DQo+ICAgICA+ICAgICA+Pj4+Pj4g ICAgICAgICAgICAgICBzdGlyQGlldGYub3JnDQo+ICAgICA+ICAgICA+Pj4+Pj4gPG1haWx0bzpz dGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+ICAgICA+ICAgICA+Pj4+Pj4g ICAgICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXIN Cj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+ Pj4NCj4gICAgID4gICAgID4+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4+IC0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+ICAg ICA+ICAgICA+Pj4+Pj4gLS0tLS0tLQ0KPiAgICAgPiAgICAgPj4+Pj4+DQo+ICAgICA+ICAgICA+ Pj4+Pj4gICAgICAgICAgIFRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmludCBwcm9wcmlldGFy eSBpbmZvcm1hdGlvbg0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICBpbnRlbmRlZCBmb3Ig dGhlIHNvbGUgdXNlIG9mIHRoZSByZWNpcGllbnQocykuIEFueSB1c2UgYnkNCj4gICAgID4gICAg ID4+Pj4+PiAgICAgICAgICAgb3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90IHRo ZSBpbnRlbmRlZA0KPiAgICAgPiAgICAgPj4+Pj4+ICAgICAgICAgICByZWNpcGllbnQsIHBsZWFz ZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSBhbGwgY29waWVzDQo+ICAgICA+ICAgICA+ Pj4+Pj4gICAgICAgICAgIG9mIHRoZSBtZXNzYWdlLg0KPiAgICAgPiAgICAgPj4+Pj4NCj4gICAg ID4gICAgID4+Pj4+DQo+ICAgICA+ICAgICA+Pj4+Pg0KPiAgICAgPiAgICAgPj4+Pj4gX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gICAgID4gICAgID4+ Pj4+IHN0aXIgbWFpbGluZyBsaXN0DQo+ICAgICA+ICAgICA+Pj4+PiBzdGlyQGlldGYub3JnIDxt YWlsdG86c3RpckBpZXRmLm9yZz4NCj4gICAgID4gICAgID4+Pj4+IGh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPiAgICAgPiAgICAgPj4+Pj4NCj4gICAgID4gICAg ID4+Pj4NCj4gICAgID4gICAgID4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCj4gICAgID4gICAgID4+Pj4gc3RpciBtYWlsaW5nIGxpc3QNCj4gICAg ID4gICAgID4+Pj4gc3RpckBpZXRmLm9yZyA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+ICAgICA+ ICAgICA+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPiAg ICAgPiAgICAgPj4+DQo+ICAgICA+ICAgICA+Pg0KPiAgICAgPiAgICAgPj4gX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gICAgID4gICAgID4+IHN0aXIg bWFpbGluZyBsaXN0DQo+ICAgICA+ICAgICA+PiBzdGlyQGlldGYub3JnDQo+ICAgICA+ICAgICA+ PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4gICAgID4gICAg ID4NCj4gICAgID4gICAgID4NCj4gICAgID4NCj4gICAgID4gICAgIF9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ICAgICA+ICAgICBzdGlyIG1haWxpbmcg bGlzdA0KPiAgICAgPiAgICAgc3RpckBpZXRmLm9yZw0KPiAgICAgPiAgICAgaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+ICAgICA+DQo+ICAgICA+ICAgICBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiAgICAgPiAgICAg c3RpciBtYWlsaW5nIGxpc3QNCj4gICAgID4gICAgIHN0aXJAaWV0Zi5vcmcNCj4gICAgID4gICAg IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPiAgICAgPg0KPiAg ICAgPg0KPiAgICAgPg0KPiAgICAgPg0KPiAgICAgPg0KPiAgICAgPiBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KPiAgICAgPg0KPiAgICAgPiBUaGlzIGUtbWFpbCBtYXkgY29udGFp biBTcHJpbnQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gaW50ZW5kZWQgZm9yIHRoZSBzb2xlIHVz ZSBvZiB0aGUgcmVjaXBpZW50KHMpLiBBbnkgdXNlIGJ5IG90aGVycyBpcyBwcm9oaWJpdGVkLiBJ ZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UgY29udGFjdCB0aGUg c2VuZGVyIGFuZCBkZWxldGUgYWxsIGNvcGllcyBvZiB0aGUgbWVzc2FnZS4NCj4gICAgID4NCj4N Cj4gICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ ICAgICBzdGlyIG1haWxpbmcgbGlzdA0KPiAgICAgc3RpckBpZXRmLm9yZw0KPiAgICAgaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+DQo+DQo+DQo+DQo+IF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+IHN0aXIgbWFpbGlu ZyBsaXN0DQo+IHN0aXJAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9zdGlyDQo+DQoNCg0KDQo= From nobody Fri Aug 5 13:03:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA72212D18B for ; Fri, 5 Aug 2016 13:03:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HqCNcjntvWMa for ; Fri, 5 Aug 2016 13:03:14 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 945D212D15E for ; Fri, 5 Aug 2016 13:03:14 -0700 (PDT) X-AuditID: c1b4fb3a-c7bff700000009bd-d2-57a4f0fd124c Received: from ESESSHC003.ericsson.se (Unknown_Domain [153.88.183.27]) by (Symantec Mail Security) with SMTP id DD.92.02493.DF0F4A75; Fri, 5 Aug 2016 22:03:12 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.233]) by ESESSHC003.ericsson.se ([153.88.183.27]) with mapi id 14.03.0301.000; Fri, 5 Aug 2016 22:03:09 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Paul Kyzivat Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR7ySIy1H2XpMJyEWAavhfF7EeSqA6ynym Date: Fri, 5 Aug 2016 20:03:09 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se>, <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> In-Reply-To: <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BBB1D69ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprIIsWRmVeSWpSXmKPExsUyM2K7tC7jxyXhBmvZLX5/+sBmsWLDAVaL 5Wu3MTkwe/x9/4HJ49LOk2weS5b8ZApgjuKySUnNySxLLdK3S+DK2Hp7LnvBVcuKVVNaGRsY txl0MXJySAiYSGxbNYeti5GLQ0hgPaPEquuLmCCcxYwSF3+/A3I4ONgELCS6/2mDNIgIBEvs ObGLDSTMLKAs8W+3PUhYWCBQYuXWFSwQJUESJ1+8ZIewjST23VwEZrMIqEhc27WOCcTmFfCV mDd5JyvEqscsEnc2rQEr4hRwkJi8awKYzSggJvH91BqwBmYBcYmmLytZIY4WkFiy5zwzhC0q 8fLxP1aImnyJb3//MUIsEJQ4OfMJywRG4VlI2mchKZuFpAwibiDx5f1tKFtbYtnC18wQtr5E 9/vTTMjiCxjZVzGKFqcWF+emGxnppRZlJhcX5+fp5aWWbGIERtTBLb+tdjAefO54iFGAg1GJ h1fhypJwIdbEsuLK3EOMEhzMSiK8h94BhXhTEiurUovy44tKc1KLDzFKc7AoifP6v1QMFxJI TyxJzU5NLUgtgskycXBKNTAuEp/OfTvOjEPMZfLdHz61GyfaOvHG/j048+jpua9Lp/qxxpTe C0ueedCgdt7FrhDTncZzwwMazh6xPeN2Old4Z7VpcpiUtqhNfWZkymGWuw4S5XOXe8ywnTXV T+HO6beF2Xzn3584dyiA1/uax4JzQbuvFJQrtnrNX/ti+u6jEgfyMh9PepenxFKckWioxVxU nAgASul1Z6QCAAA= Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 20:03:17 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BBB1D69ESESSMB208erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi Dave, I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an "if"= :) But, if there will be an "if", 4424bis needs to describe how to correctly h= andle the different options and alternatives. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD05/=FD08/=FD2016 17:20 To: Christer Holmberg; Paul Kyzivat<= mailto:pkyzivat@alum.mit.edu> Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Christer, On 8/4/2016 11:45 PM, Christer Holmberg wrote: > > The receiver needs to be able to parse JSON if the sender includes the > claims, in order to verify the signature. Alternatives and options make specifications more complex and often introduce potential non-determinacies. So the 'if' that you cite is not a small matter. In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it. > Also, whatever headers we include, I assume the receiver should be able > to parse them. > > But, parsing JSON is not a difficult thing to do, and there are > available libraries for those who don't want to implement the parser > themselves. Just to make sure this sub-thread retains its context: I did not comment on the choice of JSON/JWT in the actual review. It's not an irrational or horrible choice. But it does add overhead. It adds it to the effort needed to understand the specifications. And it adds it to the software. (It might also add it to the execution of the software, but I suspect that is, at worst, a negligible difference here.) One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do". In most cases where that sort of comment is offered, it is quite true. The problem is with incremental complexities. A not-difficult here; a not-difficult there... They really do mount up. By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie, pre-occurring -- relevance to the current work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net --_000_7594FB04B1934943A5C02806D1A2204B4BBB1D69ESESSMB208erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi Dave,

I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an &quo= t;if" :)

But, if there will be an "if", 4424bis needs to describe how to c= orrectly handle the different options and alternatives.

Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD05= /=FD08/=FD2016 17:20
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
Christer,


On 8/4/2016 11:45 PM, Christer Holmberg wrote:
>
> The receiver needs to be able to parse JSON if the sender includes the=
> claims, in order to verify the signature.

Alternatives and options make specifications more complex and often
introduce potential non-determinacies.  So the 'if' that you cite is n= ot
a small matter.

In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it.


> Also, whatever headers we include, I assume the receiver should be abl= e
> to parse them.
>
> But, parsing JSON is not a difficult thing to do, and there are
> available libraries for those who don't want to implement the parser > themselves.

Just to make sure this sub-thread retains its context:  I did not
comment on the choice of JSON/JWT in the actual review.  It's not an <= br> irrational or horrible choice.

But it does add overhead.  It adds it to the effort needed to understa= nd
the specifications.  And it adds it to the software.  (It might a= lso add
it to the execution of the software, but I suspect that is, at worst, a negligible difference here.)

One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do".  In most cases where that = sort of
comment is offered, it is quite true.  The problem is with incremental=
complexities.  A not-difficult here; a not-difficult there... They really do mount up.

By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie,
pre-occurring -- relevance to the current work.

d/
--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
 --_000_7594FB04B1934943A5C02806D1A2204B4BBB1D69ESESSMB208erics_-- From nobody Fri Aug 5 13:11:22 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0648612B030 for ; Fri, 5 Aug 2016 13:11:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FNkCt1t7zrYf for ; Fri, 5 Aug 2016 13:11:20 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 162FD12B01B for ; Fri, 5 Aug 2016 13:11:20 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u75KBFhX015892 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 5 Aug 2016 13:11:16 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470427876; bh=5XafI43HmGJygrnBMPxKBn/MfI+NT4vh5Mh0CTb7Ejg=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=QBpsvZedqkC7fw/rje/QXVFULMAxC1V85oenYOsuA6OTtKVBh1P/1XWyxpPhSd99t CBuQ+cVTHWRRkVHuzlXaa1ExzqElBCK3bS6m9nj6FXrPgnZI1Qj8ECl2+YEwc46298 M2ezztEdD4YoWhAJ5NiR9Im/Xde2DEPm6PX9dv5A= To: Christer Holmberg , Paul Kyzivat References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 5 Aug 2016 13:10:57 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> Content-Type: text/plain; charset=windows-1256; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 20:11:21 -0000 On 8/5/2016 1:03 PM, Christer Holmberg wrote: > I don't know whether the WG has yet decided whether there will be > options and alternatives (i.e. whether sending of claims/headers will be > mandatory, optional or forbidden) - so we don't yet know whether there > will be an "if" :) > > But, if there will be an "if", 4424bis needs to describe how to > correctly handle the different options and alternatives. Thanks for nicely introducing an underlying question I have about the specs: They were submitted for last call but clearly aren't yet finished. What's up with that? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 5 13:17:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA6F112B076 for ; Fri, 5 Aug 2016 13:16:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xqThbsbMHmpx for ; Fri, 5 Aug 2016 13:16:52 -0700 (PDT) Received: from mail1.bemta3.messagelabs.com (mail1.bemta3.messagelabs.com [195.245.230.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9217A12D5D1 for ; Fri, 5 Aug 2016 13:16:51 -0700 (PDT) Received: from [85.158.138.179] by server-6.bemta-3.messagelabs.com id 56/15-28813-034F4A75; Fri, 05 Aug 2016 20:16:48 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrMKsWRWlGSWpSXmKPExsVy+MWXVl39L0v CDZrfa1s8vT+NzeLEt/+MFis2HGC1mPHDwGL52m1MDqwef99/YPK4/+0vu8eSJT+ZPCZ+PMPs 0XZpN3MAaxRrZl5SfkUCa8bmaytZC169Yqs42vSVvYHx50fWLkYuDiGBPYwS5x7sZ4JwVjFK3 O2bzgbhrGCSuLPiKQuEs5FRovXcBqAyTg42ASeJ+bvXgbWICCxjlPi7ugFoGAcHs4CyxL/d9i A1wgI6EpdaP7GC2CICuhKHjr1ghqgHWtG54QHYIBYBFYnOJ72MIL28Am4S8xq8IZbN5JC40/u UGaSGU8BBYtWGDnYQm1FAVuJL42qwOLOAuETTl5VgCyQEBCSW7DnPDGGLSrx8/I8VoiZbomni LrA4r4CgxMmZT1gmMIrMQtI+C0nZLCRlEHEDiffn5jND2NoSyxa+hrL1JTZ+OcuILL6AkX0Vo 0ZxalFZapGukaleUlFmekZJbmJmjq6hgbFebmpxcWJ6ak5iUrFecn7uJkZg5NYzMDDuYGw94X eIUZKDSUmU9/zlJeFCfEn5KZUZicUZ8UWlOanFhxhlODiUJHirPgPlBItS01Mr0jJzgCkEJi3 BwaMkwhsIkuYtLkjMLc5Mh0idYlSUEufVBkkIgCQySvPg2mBp6xKjrJQwLyMDA4MQT0FqUW5m Car8K0ZxDkYlYd5okCk8mXklcNNfAS1mAlr80QpscUkiQkqqgbFCuHZJCXM40+3+a4IPe7k/N RxQ17Y+wJry6uCtaAMxg2WbftzTbHx1aK6FBNeG7np1mV3nCrmY2ZL3qbK9Cdi6PSbWxffB4+ MnJTZKORvUislmnnuQ0sSjlSco06j14di7wNVWzQdz1rvWZFXINSev41sqsOuXtDL39F+dJ8W t5q5SYhWZqcRSnJFoqMVcVJwIADwwTSBWAwAA X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-14.tower-169.messagelabs.com!1470428207!55105163!1 X-Originating-IP: [195.232.244.133] X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 14249 invoked from network); 5 Aug 2016 20:16:47 -0000 Received: from mailout01.vodafone.com (HELO mailout01.vodafone.com) (195.232.244.133) by server-14.tower-169.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 5 Aug 2016 20:16:47 -0000 Received: from mailint03.vodafone.com (mailint03.vodafone.com [195.232.244.200]) by mailout01.vodafone.com (Postfix) with ESMTP id 3s5dPV5h2Lz1yFv; Fri, 5 Aug 2016 22:16:46 +0200 (CEST) Received: from mailint03.vodafone.com (localhost [127.0.0.1]) by mailint03.vodafone.com (Postfix) with ESMTP id 3s5dPV4RPhz16QPv; Fri, 5 Aug 2016 22:16:46 +0200 (CEST) Received: from VOEXC01W.internal.vodafone.com (voexc01w.dc-ratingen.de [145.230.101.21]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint03.vodafone.com (Postfix) with ESMTPS id 3s5dPV3yPgz16QBm; Fri, 5 Aug 2016 22:16:46 +0200 (CEST) Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by VOEXC01W.internal.vodafone.com ([145.230.101.21]) with mapi id 14.03.0224.002; Fri, 5 Aug 2016 22:16:46 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Paul Kyzivat , "Gorman, Pierce A [CTO]" , Richard Shockey , Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AdHtnZL44XSdzpn5S4ezxStpcxWG/gAqmfuAAAWRJoAAAX9oAAACCpaAAABpDQAAAKK5AAAAWieAAAPgt4AAALpDgAAAzAAAAAA1foAAAEbIAAAAZjkAAABSQQAAF5txgAAKzH2AAAG+lgAAAytegAALJQfm Date: Fri, 5 Aug 2016 20:16:45 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> , <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> In-Reply-To: <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_la63uyb27afcgmc3panhalnb1470419134540emailandroidcom_" MIME-Version: 1.0 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 20:16:58 -0000 --_000_la63uyb27afcgmc3panhalnb1470419134540emailandroidcom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable This all depends on context. In the UK the Network Number (what we have in PAI) is network internal, not= passed to end users. On originating connections from large enterprise SIP = networks in particular, as the NN represents where the call hits the public= network it'd be highly misleading/irrelevant as far a the terminating cust= omer's concerned. Rgds Paul -------- Original Message -------- Subject: Re: [stir] STIR 4474bis-10 comments From: Paul Kyzivat Date: 5 Aug 2016 17:57 To: "Gorman, Pierce A [CTO]" ,Richard Shockey ,"Rosbotham, Paul, Vodafone UK" ,Brian Rosen If PAI is present and signed, and From is also signed, I would expect it to be up to the UA to decide what to display, not the carrier. Of course this will work differently if there is a different signaling regime between the carrier and the user device (e.g. black phone). Thanks, Paul On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > P-Asserted-Identity is supposed to operate "among trusted SIP entities" a= nd therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-I= dentity is stripped by border controller functions and is not to be used in= inter-carrier inter-connection (although it commonly shows up anyway). My= opinion is the "From" header is likely used more often for presentation. > > Pierce > > > -----Original Message----- > From: Richard Shockey [mailto:richard@shockey.us] > Sent: August 05, 2016 9:37 AM > To: Rosbotham, Paul, Vodafone UK ; Paul Kyzi= vat ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > > Humm this is getting interesting. Its my understanding that the display = number aka =93presentation number=94 in the US context is the one carried i= n the PAI. Martin, Pierce? > > > > > On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: > > Jumping in now that we're on European working time, +1 on Paul's obse= rvation. > > Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. > > Only the carrier has the authority to set the Network Number so only = they could sign it. > > But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. > > What I want is the ability for customers to use their credentials to = sign the CLIs they send me so that at the terminating end it can be checked= (or indeed somewhere en-route if that's the business model). I can and wo= uld sign for customers on my mobile business since I'm driving what number = is presented, but that's by-the-by because they aren't the ones who generat= e millions of nuisance calls. If the signing only occurs at the originatin= g carrier level for corporate/call-centre customers that's no use because I= 'm not in a position to do that for these type of customers...and the whole= system becomes a waste of time. I'd also highlight there are many more of = my large customers that I'd trust more than a far end originating carrier t= hat could be anywhere in the world (though we have no shortage of small car= riers that I wouldn't know from Adam more locally in the UK....) > > Regards > > Paul > > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: 04 August 2016 23:12 > To: Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > On 8/4/16 6:02 PM, Brian Rosen wrote: > > I think it's not a delegation. The mobile phone is not being deleg= ated the TN, it's being authorized to place calls that are not from that TN= , but appear to be. > > > > The mechanism to handle the credential is exactly the same as a del= egation, so if you want to call it delegation, go ahead, but I prefer to ca= ll it authorized spoofing. > > IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. > > Thanks, > Paul > > > Brian > > > >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat w= rote: > >> > >> On 8/4/16 5:43 PM, Brian Rosen wrote: > >>> In my jargon an "authorized spoofer" is the doctor who is calling > >>> from his mobile, but sending the TN of his office phone as callin= g party. > >>> The delegation to his office phone was made by his landline carri= er > >>> to him. He then creates another credential, which he signs with = his > >>> office phone credential that authorizes his mobile to send calls > >>> from his office number. He is spoofing (because the call is comi= ng > >>> from his mobile's TN but claims to be from his office), but it's > >>> authorized spoofing. The doc could give the credential to his > >>> mobile SP if they sign on his behalf. > >> > >> I don't understand how that is different from regular delegation. > >> > >> When his landline carrier gave him a delegated certificate for his= landline number, he should be able to install that in whatever devices he = wants - his landline UA, his mobile phone, etc. It is still delegated from = his landline carrier, even when used with calls via his mobile carrier. > >> > >> Thanks, > >> Paul > >> > >>> Some folks don't like attaching the "spoofing" label to a legitim= ate use. > >>> > >>> But that's how I describe it. > >>> > >>> Brian > >>> > >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>> > wrote: > >>>> > >>>> +1, but with one question below: > >>>> > >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > >>>>> I think all we need is to have credentials follow the delegatio= n > >>>>> path, > >>>> > >>>>> plus the option to add another level (not delegation) for > >>>>> authorized spoofers. > >>>> > >>>> I don't understand "authorized spoofers" in this context, as > >>>> contrasted to "spoofers" who have been delegated their authority= . > >>>> > >>>> Thanks, > >>>> Paul > >>>> > >>>>> I don't think it matters who the delegator or delegatee are as > >>>>> long as the delegator is willing to take the heat for delegatin= g > >>>>> to someone who sends a lot of bad calls. They can pass the buc= k > >>>>> ("I delegated the TN to him, and now I'm not responsible"), but > >>>>> only if the SP knows who they delegated to, so authorities can > >>>>> follow the delegation path. There are plenty of certificated > >>>>> carriers who are willing to not care who they delegate to. The= fact that there are some who do doesn't change much. > >>>>> Making stir work means knowing who you are delegating to, so th= at > >>>>> you can pass the hot potato. > >>>>> > >>>>> It's perfectly reasonable for a carrier to be able to sign for = any > >>>>> calls placed on its network on any number it has been delegated= . > >>>>> If it does, it's asserting that the calls are from who they are= supposed to be from. > >>>>> That should be straightforward, but we know it's not always, an= d > >>>>> that represents the hard part of deployment in my opinion. But > >>>>> once they delegate, they can hand responsibility to sign to the > >>>>> delegatee. But, that only works if they know who they are dele= gating to. > >>>>> > >>>>> The root of the whole model is that there is a formal or inform= al > >>>>> delegation path for telephone numbers in every country, and we = can > >>>>> build a chain of trust from that delegation path. If you propo= se > >>>>> to alter that model, then we get into (policy) issues of which > >>>>> carriers/entities we trust and which we don't. Our model is th= at > >>>>> you know who you delegate to, and once you do that delegation, = it's their problem. > >>>>> That's pretty appealing I think, even if it's a change in some > >>>>> business practices. > >>>>> > >>>>> The mechanism is chaining credentials in a form of a PKI and > >>>>> having a way to know which TNs are covered by a credential. > >>>>> That's what we have, and I'm loath to change it. > >>>>> > >>>>> Brian > >>>>> > >>>>> > >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > >>>>>> > >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> OK, you talked me into indulging in one more message on policy > >>>>>> and use cases. > >>>>>> > >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on > >>>>>> individual devices as well as multi-device and multi-number pl= atforms. > >>>>>> > >>>>>> Number delegation (and sub-delegation), and business > >>>>>> relationships are two additional factors which affect > >>>>>> trustworthiness of a given calling number authentication. > >>>>>> > >>>>>> Inherent variable trustworthiness of a calling number was my > >>>>>> reason for suggesting a way to qualify the signature to reflec= t > >>>>>> that variability. > >>>>>> > >>>>>> Originating carriers are in a position to know if a call is > >>>>>> coming from a device assigned a single number, or from "trunk > >>>>>> group" which could originate calls using multiple numbers, and > >>>>>> can qualify to some degree the trustworthiness of number authe= nticity accordingly. > >>>>>> > >>>>>> My suggestion was qualifying calling number authenticity into > >>>>>> categories of carrier-signed (or not), and unauthenticated, > >>>>>> semi-authenticated, and most-authenticated. There can be more > >>>>>> granularity, but it implies additional operational complexity > >>>>>> (both for the carriers and the consumers) and I assume diminis= hes value. > >>>>>> > >>>>>> My reason for adding the authenticity of the originating carri= er > >>>>>> is typical trustworthiness of a carrier business relationship > >>>>>> with typical consumers adds to the trustworthiness assessment = and > >>>>>> partially because carriers are a regulated point of forensic > >>>>>> inquiry for CALEA and fraud. Additionally, most calls origina= te > >>>>>> and terminate between mobile consumers where their carriers ar= e > >>>>>> able to usefully authenticate their device and have a high deg= ree > >>>>>> of confidence of the authenticity of the calling number. > >>>>>> > >>>>>> I think billions of per-TN certs of varying usability (revoked= , > >>>>>> not > >>>>>> revoked) for authenticating calling number will not work well. > >>>>>> > >>>>>> Conversely, I think billions of per-TN certs will work well, i= f > >>>>>> the calling party has to sign a call with a per-TN cert provid= ed > >>>>>> by the called party. No called party cert to include? Then t= he > >>>>>> calling party does not have a trusted relationship with the > >>>>>> called party, and the call can be authorized/treated according= ly. > >>>>>> (I've made similar, mostly ignored comments in MODERN.) > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 2:03 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> Well, the mechanisms are designed so that they could be deploy= ed > >>>>>> on devices and PBXs. Whether they will be is a policy issue. > >>>>>> > >>>>>> The notion of credentials that are traceable to a delegation o= f a > >>>>>> TN is a mechanism that is part of the design of stir, and the > >>>>>> design allows delegation of one TN (to one device, although a > >>>>>> device like a PBX would have more than one TN per "device", an= d > >>>>>> something like a dual NAM phone could have more than one > >>>>>> credential. For the use case we've discussed, a mobile phone = may > >>>>>> also have a credential for, say, a TN that is delegated to a > >>>>>> landline, to cover the example case of a doctor placing a call= on > >>>>>> his mobile, but getting his office number to show up as the ca= lling party. Use of such mechanisms is policy. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > >>>>>> >>>>>> > >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> Thanks Brian. I'm afraid we're straying into a policy > >>>>>> discussion. Regardless, I do appreciate your explanation. = I > >>>>>> would like to continue the discussion, but I'm pretty sure t= his > >>>>>> isn't the right forum. > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 1:34 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> Of course I want PBXs to sign calls. As well as smart phone= s and > >>>>>> any other devices that can be programmed to do so. > >>>>>> They will be given credentials that only are valid for the T= Ns > >>>>>> they are authorized to sign for. They can try to sign any c= all, > >>>>>> but the validity of the credential would make such a signatu= re > >>>>>> fail the checking. > >>>>>> > >>>>>> Getting service providers to sign on behalf of devices is a > >>>>>> reasonable way to deploy quickly, but I expect many SPs will= want > >>>>>> to get out of the liability of signing on behalf of their > >>>>>> customers. If they can push of that responsibility to their > >>>>>> customer, only being responsible for getting the customer an > >>>>>> appropriate credential when they assign TNs, then I would ex= pect > >>>>>> them to want to do so. That means the devices have to be ab= le to > >>>>>> sign, but I understand many of the PBX vendors think that's > >>>>>> something they could provide in a future release. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > >>>>>> >>>>>> > > >>>>>> wrote: > >>>>>> > >>>>>> You want IP PBXes to sign calls? Won't that make it > >>>>>> extraordinarily easy to commit fraud with authenticated = numbers? > >>>>>> > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 12:24 PM > >>>>>> *To:* Gorman, Pierce A [CTO] >>>>>> > >>>>>> > > >>>>>> *Cc:* Alex Bobotek > >>>>>> >; stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> First of all, we would want the PBX to generate the sign= ature, > >>>>>> but the service provider can do that. It should not add= a > >>>>>> valid signature to a call from a number it did not assig= n to > >>>>>> the trunk group connecting to the PBX, although it could > >>>>>> support the extra delegation required to support "author= ized > >>>>>> spoofing". The companion devices I'm aware of always se= nd > >>>>>> calls from the same service provider and should not pres= ent > >>>>>> any issue. > >>>>>> > >>>>>> Everyone will have to do work they don't do now to imple= ment > >>>>>> stop spoofed calls. TANSTAAFL > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] > >>>>>> > >>>>>> > wrote: > >>>>>> > >>>>>> Fraud from compromised PBXes is common. And even wh= ere a > >>>>>> PBX is not compromised, a carrier has no practical w= ay of > >>>>>> knowing whether the calling number is properly assig= ned > >>>>>> and valid from the perspective of the Enterprise. > >>>>>> Therefore, checking whether the calling number was f= rom an > >>>>>> assigned range might be possible (and fraught with > >>>>>> administrative challenges), but of limited value. A= nd in > >>>>>> the consumer market, there are calling products whic= h > >>>>>> support a parent subscriber number and "companion" d= evices > >>>>>> (e.g., tablets) which can place a call using the MDN= of > >>>>>> the parent subscriber. These are examples of where = the > >>>>>> authenticity of the calling number won't necessarily= mean > >>>>>> the same thing as the authenticity of a call from a = single > >>>>>> subscriber with a single MDN regardless of "laxity" = of > >>>>>> spoof checking. > >>>>>> > >>>>>> In another forum and anticipating calling number > >>>>>> authentication mandates from Congress and/or FCC, I > >>>>>> suggested using carrier-specific certs and encoding > >>>>>> specificity of authenticity, and calling number. Th= is > >>>>>> provides the identity of the originating carrier, so= me > >>>>>> idea as to the accuracy or specificity of the callin= g > >>>>>> number, and validty of the calling number (assuming = nonce > >>>>>> and replay issues can be addressed as reasonably sug= gested > >>>>>> below by Alex). > >>>>>> > >>>>>> The representation of orig-carrier and trustworthine= ss > >>>>>> could be as follows: > >>>>>> > >>>>>> *Regulated/mandated Carrier Class Use Case:* > >>>>>> > >>>>>> *00 - No Credentials* > >>>>>> Use case example(s): Pre-IMS, legacy circuit-switche= d > >>>>>> networks that don't natively support SIP or which do= n't > >>>>>> choose to sign calls. E.g., international carriers. > >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN > >>>>>> entirely untrustworthy. > >>>>>> > >>>>>> *01 - Carrier signed, no authentication of CgPN* > >>>>>> Use case example(s): E911 on visited network w/o roa= ming > >>>>>> agreement, manual roaming. > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN enti= rely > >>>>>> untrustworthy > >>>>>> > >>>>>> *10 - Carrier signed, semi-authenticated CgPN* > >>>>>> Use case example(s): Number block delegated from OCN= , but > >>>>>> no per-TN screen (SIP trunks). > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less= than > >>>>>> most trustworthy but not entirely untrustworthy. > >>>>>> > >>>>>> *11 - Carrier signed, authenticated CgPN* > >>>>>> Use case example(s): Bread-and-butter 95%+ of calls = from > >>>>>> subscriber lines (IMS-based and otherwise). > >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most > >>>>>> trustworthy > >>>>>> > >>>>>> *Public Use Case:* > >>>>>> > >>>>>> Undefined but assumed to use public or commercially > >>>>>> available authentication services resources. e.g., > >>>>>> nomorobo-like crowd-sourced accept/deny lists, et ce= tera. > >>>>>> Could/would pass credentials down to SIP-aware devic= es > >>>>>> which would process them according to the rules of t= he > >>>>>> Public Class application(s). > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>> *Sent:* August 04, 2016 9:02 AM > >>>>>> *To:* Alex Bobotek >>>>>> > >>>>>> > > >>>>>> *Cc:* stir@ietf.org > >>>>>> > >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> There are reasonable circumstances where a party pla= cing a > >>>>>> call is not the authorized entity assigned the telep= hone > >>>>>> number used in From/PAI, and in such circumstances t= he > >>>>>> service provider servicing the entity placing the ca= ll may > >>>>>> or may not be the same as the service provider servi= ng the > >>>>>> entity that is assigned the TN. In all such cases, = the > >>>>>> entity that is assigned the TN explicitly authorizes= calls > >>>>>> placed using it's TN. The design accommodates such = use > >>>>>> cases. It's not a blanket authorization without > >>>>>> authentication. We're not aware of any cases where= there > >>>>>> is an actual requirement for legitimate calling with= out > >>>>>> explicit authorization from the assigned entity, alt= hough > >>>>>> we certainly are aware that various parts of various > >>>>>> service providers don't bother to check. At this poi= nt, at > >>>>>> least in some countries, there is a realization that= the > >>>>>> laxity of allowing unchecked spoofing is not accepta= ble > >>>>>> any more. > >>>>>> > >>>>>> Brian > >>>>>> > >>>>>> > >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > >>>>>> >>>>>> > wrote: > >>>>>> > >>>>>> 1. Permit authorization without authentica= tion > >>>>>> In the current telephony network practice, some > >>>>>> service provider implementations choose not to > >>>>>> authenticate identity, but simply facilitate the= use > >>>>>> of an arbitrary or selected user-provided identi= ty. > >>>>>> Are there legitimate use cases for this? Has an= yone > >>>>>> established that there are not? How can the ind= ustry > >>>>>> reasonably expect to end this (often bad) practi= ce? > >>>>>> If it can't be ended, there's value in at least > >>>>>> identifying the originating service provider > >>>>>> (i.e., the signer/authorizer). Given the preval= ence > >>>>>> of abuse using telephone numbers assigned to a > >>>>>> sometimes-anonymous abuser, it becomes criticall= y > >>>>>> important to identify the service provider(s) cl= osest > >>>>>> to the abuser. Based on the assumption that it'= s > >>>>>> better to ID service providers than unreasonably > >>>>>> expect a ban of the use of unauthenticated (and > >>>>>> therefore unsigned) SIP requests, STIR signing s= hould > >>>>>> support authorization without authentication. T= he > >>>>>> practice of authorizing unauthenticated use exis= ts, > >>>>>> and there is benefit to signing in these cases > >>>>>> (service provider identification). The language= of > >>>>>> the ID should permit this use. 4474bis-10 shoul= d NOT > >>>>>> require or assume that that authentication will > >>>>>> precede authorization. Of course there may be ot= her > >>>>>> use cases where signing includes authentication = and > >>>>>> may not include a specific service provider's > >>>>>> authorization. > >>>>>> > >>>>>> > >>>>>> 2. Improve replay prevention > >>>>>> Proximate replay is possible while complying wit= h this > >>>>>> spec. First, one or more proximate (e.g., withi= n 60 > >>>>>> seconds) SIP requests using the same token are l= egal > >>>>>> and subject to replay in many cases. An SDP bod= y's > >>>>>> mky may not be present and if present its use is > >>>>>> optional. Some sort of mandatory new or existin= g > >>>>>> signed sequence, random # or request ID (e.g., C= all-ID > >>>>>> or CSeq) and a 1-time use policy on the receivin= g end > >>>>>> of the request (e.g., tokens only good for 1 > >>>>>> use) could prevent replay. Different methods (e= .g., > >>>>>> INVITE vs MESSAGE) might be handled by different > >>>>>> receiving infrastructure, and therefore difficul= ties > >>>>>> with 'it's been used already' coordination allow= a > >>>>>> faked MESSAGE based on a captured request. This = might > >>>>>> include an mkey from a captured INVITE. So it = may be > >>>>>> possible to DOS, spam or text-bomb a recipient u= sing a > >>>>>> captured identity. While large-scale or distrib= uted > >>>>>> implementations may make the enforcement difficu= lt, > >>>>>> there is little cost to signing and decoding a m= ethod > >>>>>> and possibly a numeric ID. Some sort of '1-use= ' > >>>>>> practice should at least be discussed while perh= aps > >>>>>> not required. > >>>>>> > >>>>>> > >>>>>> Specific markup suggestions: > >>>>>> > >>>>>> > >>>>>> NITS > >>>>>> > >>>>>> > >>>>>> The verifier MUST inspect any optional "ppt" > >>>>>> parameter appearing *in*the > >>>>>> > >>>>>> Identity request. If no "ppt" parameter is > >>>>>> present, then the > >>>>>> > >>>>>> verifier proceeds normally below. If a "ppt" > >>>>>> parameter value is > >>>>>> > >>>>>> present, and the verifier does not support it= , > >>>>>> it MUST ignore the > >>>>>> > >>>>>> Identity header. If a supported "ppt" parame= ter > >>>>>> value is present, > >>>>>> > >>>>>> the verifier follows the procedures below, > >>>>>> including the variations > >>>>>> > >>>>>> described in Step 5. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> 3 > >>>>>> . > >>>>>> Background > >>>>>> > >>>>>> [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> Per [RFC7340 > >>>>>> ], problems such as > >>>>>> robocalling, voicemail hacking, and > >>>>>> > >>>>>> swatting are enabled by an attacker's ability= to > >>>>>> impersonate someone > >>>>>> > >>>>>> else. The secure operation of most SIP > >>>>>> applications and services > >>>>>> > >>>>>> depends on authenticating and/or authorizing = the > >>>>>> source of communications as it is > >>>>>> > >>>>>> represented in a SIP request. > >>>>>> > >>>>>> > >>>>>> > >>>>>> This identity architecture for SIP depends on > >>>>>> includes provisions for a logical > >>>>>> > >>>>>> "authentication service" which validates call= er > >>>>>> identity at or near origination. outgoing > >>>>>> requests. An > >>>>>> > >>>>>> authentication service may be implemented eit= her > >>>>>> as part of a user > >>>>>> > >>>>>> agent or as a proxy server; typically, it is = a > >>>>>> component of a network > >>>>>> > >>>>>> intermediary like a proxy to which originatin= g > >>>>>> user agents send > >>>>>> > >>>>>> unsigned requests. Once the sender of the > >>>>>> message has been > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> This document specifies a means of sharing a > >>>>>> cryptographic assurance > >>>>>> > >>>>>> of authenticity of and/or authorization to us= e > >>>>>> end-user SIP identity in an interdomain or intradomain context= . > >>>>>> > >>>>>> It relies on the authentication service > >>>>>> constructing tokens based on [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> To maximize end-to-end security, it is typica= lly > >>>>>> obviously > >>>>>> > >>>>>> preferable for end-users to acquire their own > >>>>>> credentials; if they > >>>>>> > >>>>>> do, their user agents can act as authenticati= on > >>>>>> services. However, > >>>>>> > >>>>>> for some deployments, [...] > >>>>>> > >>>>>> > >>>>>> > >>>>>> Regards, > >>>>>> > >>>>>> Alex > >>>>>> * * > >>>>>> *Alex Bobotek* > >>>>>> > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> --------------------------------------------------------------= --- > >>>>>> ------- > >>>>>> > >>>>>> This e-mail may contain Sprint proprietary informati= on > >>>>>> intended for the sole use of the recipient(s). Any u= se by > >>>>>> others is prohibited. If you are not the intended > >>>>>> recipient, please contact the sender and delete all = copies > >>>>>> of the message. > >>>>> > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> stir mailing list > >>>>> stir@ietf.org > >>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>> > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>> > >> > >> _______________________________________________ > >> stir mailing list > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir > > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > > > ________________________________ > > This e-mail may contain Sprint proprietary information intended for the s= ole use of the recipient(s). Any use by others is prohibited. If you are no= t the intended recipient, please contact the sender and delete all copies o= f the message. > --_000_la63uyb27afcgmc3panhalnb1470419134540emailandroidcom_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

This all depends on context.

In the UK the Network Number (what we have in PAI) is networ= k internal, not passed to end users. On originating connections from large = enterprise SIP networks in particular, as the NN represents where the call = hits the public network it'd be highly misleading/irrelevant as far a the terminating customer's concerned.

Rgds

Paul

-------- Original Message --------

Subject: Re: [stir] STIR 4474bis-10 comments

From: Paul Kyzivat <pkyzivat@alum.mit.edu>

Date: 5 Aug 2016 17:57

To: "Gorman, Pierce A [CTO]" <Pierce.Gorman@spr= int.com>,Richard Shockey <richard@shockey.us>,"Rosbotham, Pau= l, Vodafone UK" <paul.rosbotham@vodafone.com>,Brian Rosen <br= @brianrosen.net>

If PAI is present and signed, and From is also sig= ned, I would expect it
to be up to the UA to decide what to display, not the carrier.

Of course this will work differently if there is a different signaling
regime between the carrier and the user device (e.g. black phone).

        Thanks,
        Paul

On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote:
> P-Asserted-Identity is supposed to operate "among trusted SIP ent= ities" and therefore some specifications (e.g., 3GPP TS 24.607) assume= P-Asserted-Identity is stripped by border controller functions and is not = to be used in inter-carrier inter-connection (although it commonly shows up anyway).  My opinion is the "From= " header is likely used more often for presentation.
>
> Pierce
>
>
> -----Original Message-----
> From: Richard Shockey [mailto:ri= chard@shockey.us]
> Sent: August 05, 2016 9:37 AM
> To: Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>; = Paul Kyzivat <pkyzivat@alum.mit.edu>; Brian Rosen <br@brianrosen.n= et>
> Cc: stir@ietf.org
> Subject: Re: [stir] STIR 4474bis-10 comments
>
>
> Humm this is getting interesting.  Its my understanding that the = display number aka =93presentation number=94 in the US context is the one c= arried in the PAI.  Martin, Pierce?
>
>
>
>
> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone = UK" <stir-bounces@ietf.org on behalf of paul.rosbotham@vodafone.com= > wrote:
>
>     Jumping in now that we're on European working = time, +1 on Paul's observation.
>
>     Here in the UK, we've got 2 numbers carried as= calling line IDs....one (we term the Network Number, carried in PAID) uniq= uely identifies the line, the other (we term Presentation Number, carried i= n From) is used for display purposes.
>
>     Only the carrier has the authority to set the = Network Number so only they could sign it.
>
>     But - subject to regulatory restrictions which= are well documented - the number sent for display purposes belongs to the = customer.  For blue-chip customers, I can allow them to send their Pre= sentation Numbers into the network, and can't readily check at a network level that they're theirs (I do have contractual safeguards).=   The number may have been allocated by me, or could be allocated by a= third party provider.  If it's a call-centre they'll be making outbou= nd calls for lots of different customers which will change on day-by-day basis.  This is business as usual.  I = don't like the term "authorised spoofing" because it implies that= the CLI is in some way being rigged: it's not, it's the corporate customer= or their subcontractor using the number that's been assigned (so in internet terms delegated) to them via a chain of trust fro= m the regulator.
>
>     What I want is the ability for customers to us= e their credentials to sign the CLIs they send me so that at the terminatin= g end it can be checked (or indeed somewhere en-route if that's the busines= s model).  I can and would sign for customers on my mobile business since I'm driving what number is presented, but that's by-the-by = because they aren't the ones who generate millions of nuisance calls. = If the signing only occurs at the originating carrier level for corporate/= call-centre customers that's no use because I'm not in a position to do that for these type of customers...and the who= le system becomes a waste of time. I'd also highlight there are many more o= f my large customers that I'd trust more than a far end originating carrier= that could be anywhere in the world (though we have no shortage of small carriers that I wouldn't know from Ad= am more locally in the UK....)
>
>     Regards
>
>     Paul
>
>     -----Original Message-----
>     From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat
>     Sent: 04 August 2016 23:12
>     To: Brian Rosen
>     Cc: stir@ietf.org
>     Subject: Re: [stir] STIR 4474bis-10 comments >
>     On 8/4/16 6:02 PM, Brian Rosen wrote:
>     > I think it's not a delegation.  The = mobile phone is not being delegated the TN, it's being authorized to place = calls that are not from that TN, but appear to be.
>     >
>     > The mechanism to handle the credential is= exactly the same as a delegation, so if you want to call it delegation, go= ahead, but I prefer to call it authorized spoofing.
>
>     IIUC the delegation is to a responsible entity= (something that can be held legally accountable - e.g. a person), not to a= device. The entity can then "use" the credential via any device(= s) it chooses. In the case of the mobile, the device then becomes a two-line phone.
>
>     Thanks,
>     Paul
>
>     > Brian
>     >
>     >> On Aug 4, 2016, at 5:51 PM, Paul Kyzi= vat <pkyzivat@alum.mit.edu> wrote:
>     >>
>     >> On 8/4/16 5:43 PM, Brian Rosen wrote:=
>     >>> In my jargon an "authorized = spoofer" is the doctor who is calling
>     >>> from his mobile, but sending the = TN of his office phone as calling party.
>     >>> The delegation to his office phon= e was made by his landline carrier
>     >>> to him.  He then creates ano= ther credential, which he signs with his
>     >>> office phone credential that auth= orizes his mobile to send calls
>     >>> from his office number.  He = is spoofing (because the call is coming
>     >>> from his mobile's TN but claims t= o be from his office), but it's
>     >>> authorized spoofing.  The do= c could give the credential to his
>     >>> mobile SP if they sign on his beh= alf.
>     >>
>     >> I don't understand how that is differ= ent from regular delegation.
>     >>
>     >> When his landline carrier gave him a = delegated certificate for his landline number, he should be able to install= that in whatever devices he wants - his landline UA, his mobile phone, etc= . It is still delegated from his landline carrier, even when used with calls via his mobile carrier.
>     >>
>     >> Thanks,
>     >> Paul
>     >>
>     >>> Some folks don't like attaching t= he "spoofing" label to a legitimate use.
>     >>>
>     >>> But that's how I describe it.
>     >>>
>     >>> Brian
>     >>>
>     >>>> On Aug 4, 2016, at 5:37 PM, P= aul Kyzivat <pkyzivat@alum.mit.edu
>     >>>> <mailto:pkyzivat@alum.mit.edu>> wrote:
>     >>>>
>     >>>> +1, but with one question= below:
>     >>>>
>     >>>> On 8/4/16 5:14 PM, Brian Rose= n wrote:
>     >>>>> I think all we need is to= have credentials follow the delegation
>     >>>>> path,
>     >>>>
>     >>>>> plus the option to add an= other level (not delegation) for
>     >>>>> authorized spoofers.
>     >>>>
>     >>>> I don't understand "auth= orized spoofers" in this context, as
>     >>>> contrasted to "spoofers&= quot; who have been delegated their authority.
>     >>>>
>     >>>> Thanks,
>     >>>> Paul
>     >>>>
>     >>>>> I don't think it matters = who the delegator or delegatee are as
>     >>>>> long as the delegator is = willing to take the heat for delegating
>     >>>>> to someone who sends a lo= t of bad calls.  They can pass the buck
>     >>>>> ("I delegated the TN= to him, and now I'm not responsible"), but
>     >>>>> only if the SP knows who = they delegated to, so authorities can
>     >>>>> follow the delegation pat= h.  There are plenty of certificated
>     >>>>> carriers who are willing = to not care who they delegate to.  The fact that there are some who do= doesn't change much.
>     >>>>> Making stir work means kn= owing who you are delegating to, so that
>     >>>>> you can pass the hot pota= to.
>     >>>>>
>     >>>>> It's perfectly reasonable= for a carrier to be able to sign for any
>     >>>>> calls placed on its netwo= rk on any number it has been delegated.
>     >>>>> If it does, it's assertin= g that the calls are from who they are supposed to be from.
>     >>>>> That should be straightfo= rward, but we know it's not always, and
>     >>>>> that represents the hard = part of deployment in my opinion.  But
>     >>>>> once they delegate, they = can hand responsibility to sign to the
>     >>>>> delegatee.  But, tha= t only works if they know who they are delegating to.
>     >>>>>
>     >>>>> The root of the whole mod= el is that there is a formal or informal
>     >>>>> delegation path for telep= hone numbers in every country, and we can
>     >>>>> build a chain of trust fr= om that delegation path.  If you propose
>     >>>>> to alter that model, then= we get into (policy) issues of which
>     >>>>> carriers/entities we trus= t and which we don't.  Our model is that
>     >>>>> you know who you delegate= to, and once you do that delegation, it's their problem.
>     >>>>> That's pretty appealing I= think, even if it's a change in some
>     >>>>> business practices.
>     >>>>>
>     >>>>> The mechanism is chaining= credentials in a form of a PKI and
>     >>>>> having a way to know whic= h TNs are covered by a credential.
>     >>>>> That's what we have, and = I'm loath to change it.
>     >>>>>
>     >>>>> Brian
>     >>>>>
>     >>>>>
>     >>>>>> On Aug 4, 2016, at 4:= 53 PM, Gorman, Pierce A [CTO]
>     >>>>>> <Pierce.Gorman@spr= int.com <mailto:Pierce.Gorma= n@sprint.com>
>     >>>>>> <mailto:Pierce.Gorman@sprint.com>>
>     >>>>>> wrote:
>     >>>>>>
>     >>>>>> OK, you talked me int= o indulging in one more message on policy
>     >>>>>> and use cases.
>     >>>>>>
>     >>>>>> I agree that the STIR= /PASSporT mechanisms could be deployed on
>     >>>>>> individual devices as= well as multi-device and multi-number platforms.
>     >>>>>>
>     >>>>>> Number delegation (an= d sub-delegation), and business
>     >>>>>> relationships are two= additional factors which affect
>     >>>>>> trustworthiness of a = given calling number authentication.
>     >>>>>>
>     >>>>>> Inherent variable tru= stworthiness of a calling number was my
>     >>>>>> reason for suggesting= a way to qualify the signature to reflect
>     >>>>>> that variability.
>     >>>>>>
>     >>>>>> Originating carriers = are in a position to know if a call is
>     >>>>>> coming from a device = assigned a single number, or from "trunk
>     >>>>>> group" which cou= ld originate calls using multiple numbers, and
>     >>>>>> can qualify to some d= egree the trustworthiness of number authenticity accordingly.
>     >>>>>>
>     >>>>>> My suggestion was qua= lifying calling number authenticity into
>     >>>>>> categories of carrier= -signed (or not), and unauthenticated,
>     >>>>>> semi-authenticated, a= nd most-authenticated.  There can be more
>     >>>>>> granularity, but it i= mplies additional operational complexity
>     >>>>>> (both for the carrier= s and the consumers) and I assume diminishes value.
>     >>>>>>
>     >>>>>> My reason for adding = the authenticity of the originating carrier
>     >>>>>> is typical trustworth= iness of a carrier business relationship
>     >>>>>> with typical consumer= s adds to the trustworthiness assessment and
>     >>>>>> partially because car= riers are a regulated point of forensic
>     >>>>>> inquiry for CALEA and= fraud.  Additionally, most calls originate
>     >>>>>> and terminate between= mobile consumers where their carriers are
>     >>>>>> able to usefully auth= enticate their device and have a high degree
>     >>>>>> of confidence of the = authenticity of the calling number.
>     >>>>>>
>     >>>>>> I think billions of p= er-TN certs of varying usability (revoked,
>     >>>>>> not
>     >>>>>> revoked) for authenti= cating calling number will not work well.
>     >>>>>>
>     >>>>>> Conversely, I think b= illions of per-TN certs will work well, if
>     >>>>>> the calling party has= to sign a call with a per-TN cert provided
>     >>>>>> by the called party.&= nbsp; No called party cert to include?  Then the
>     >>>>>> calling party does no= t have a trusted relationship with the
>     >>>>>> called party, and the= call can be authorized/treated accordingly.
>     >>>>>> (I've made similar, m= ostly ignored comments in MODERN.)
>     >>>>>>
>     >>>>>> Pierce
>     >>>>>>
>     >>>>>> *From:* Brian Rosen [= mailto:br@brianrosen.net]
>     >>>>>> *Sent:* August 04, 20= 16 2:03 PM
>     >>>>>> *To:* Gorman, Pierce = A [CTO] <Pierce.Gorman@sprint.com
>     >>>>>> <mailto:Pierce.Gorman@sprint.com>
>     >>>>>> <mailto:Pierce.Gorman@sprint.com>>
>     >>>>>> *Cc:* Alex Bobotek &l= t;alex@bobotek.net <mailto:alex@bobo= tek.net>
>     >>>>>> <mailto:alex@bobotek.net>>; stir@ietf.org <<= a href=3D"mailto:stir@ietf.org">mailto:stir@ietf.org>
>     >>>>>> <mailto:stir@ietf.org>
>     >>>>>> *Subject:* Re: [stir]= STIR 4474bis-10 comments
>     >>>>>>
>     >>>>>> Well, the mechanisms = are designed so that they could be deployed
>     >>>>>> on devices and PBXs.&= nbsp; Whether they will be is a policy issue.
>     >>>>>>
>     >>>>>> The notion of credent= ials that are traceable to a delegation of a
>     >>>>>> TN is a mechanism tha= t is part of the design of stir, and the
>     >>>>>> design allows delegat= ion of one TN (to one device, although a
>     >>>>>> device like a PBX wou= ld have more than one TN per "device", and
>     >>>>>> something like a dual= NAM phone could have more than one
>     >>>>>> credential.  For= the use case we've discussed, a mobile phone may
>     >>>>>> also have a credentia= l for, say, a TN that is delegated to a
>     >>>>>> landline, to cover th= e example case of a doctor placing a call on
>     >>>>>> his mobile, but getti= ng his office number to show up as the calling party.  Use of such mec= hanisms is policy.
>     >>>>>>
>     >>>>>> Brian
>     >>>>>>
>     >>>>>>
>     >>>>>>   On Aug 4,= 2016, at 2:52 PM, Gorman, Pierce A [CTO]
>     >>>>>>   <Pierc= e.Gorman@sprint.com
>     >>>>>> <mailto:Pierce.Gorman@sprint.com>
>     >>>>>> <mailto:Pierce.Gorman@sprint.com>>
>     >>>>>> wrote:
>     >>>>>>
>     >>>>>>   Thanks Br= ian.  I'm afraid we're straying into a policy
>     >>>>>>   discussio= n.  Regardless, I do appreciate your explanation.  I
>     >>>>>>   would lik= e to continue the discussion, but I'm pretty sure this
>     >>>>>>   isn't the= right forum.
>     >>>>>>
>     >>>>>>   Pierce >     >>>>>>
>     >>>>>>   *From:* B= rian Rosen [mailto:br@brianrosen.net]
>     >>>>>>   *Sent:* A= ugust 04, 2016 1:34 PM
>     >>>>>>   *To:* Gor= man, Pierce A [CTO] <Pierce.Gorman@sprint.com
>     >>>>>> <mailto:Pierce.Gorman@sprint.com>
>     >>>>>>   <mailto:Pierce.Gorman@sprint.com&= gt;>
>     >>>>>>   *Cc:* Ale= x Bobotek <alex@bobotek.net <mail= to:alex@bobotek.net>
>     >>>>>>   <mailto:alex@bobotek.net>>; stir@ie= tf.org
>     >>>>>> <mailto:stir@ietf.org> <mailto:stir@ietf.org>
>     >>>>>>   *Subject:= * Re: [stir] STIR 4474bis-10 comments
>     >>>>>>
>     >>>>>>   Of course= I want PBXs to sign calls.  As well as smart phones and
>     >>>>>>   any other= devices that can be programmed to do so.
>     >>>>>>   They will= be given credentials that only are valid for the TNs
>     >>>>>>   they are = authorized to sign for.  They can try to sign any call,
>     >>>>>>   but the v= alidity of the credential would make such a signature
>     >>>>>>   fail the = checking.
>     >>>>>>
>     >>>>>>   Getting s= ervice providers to sign on behalf of devices is a
>     >>>>>>   reasonabl= e way to deploy quickly, but I expect many SPs will want
>     >>>>>>   to get ou= t of the liability of signing on behalf of their
>     >>>>>>   customers= .  If they can push of that responsibility to their
>     >>>>>>   customer,= only being responsible for getting the customer an
>     >>>>>>   appropria= te credential when they assign TNs, then I would expect
>     >>>>>>   them to w= ant to do so.  That means the devices have to be able to
>     >>>>>>   sign, but= I understand many of the PBX vendors think that's
>     >>>>>>   something= they could provide in a future release.
>     >>>>>>
>     >>>>>>   Brian
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;   On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO]
>     >>>>>>   &nbs= p;   <Pierce.Gorman@sprint.com
>     >>>>>> <mailto:Pierce.Gorman@sprint.com> <mailto:Pierce.Gorman@sprint.com= >>
>     >>>>>>   &nbs= p;   wrote:
>     >>>>>>
>     >>>>>>   &nbs= p;   You want IP PBXes to sign calls?  Won't that make it >     >>>>>>   &nbs= p;   extraordinarily easy to commit fraud with authenticated numb= ers?
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;   *From:* Brian Rosen [ma= ilto:br@brianrosen.net]
>     >>>>>>   &nbs= p;   *Sent:* August 04, 2016 12:24 PM
>     >>>>>>   &nbs= p;   *To:* Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com >     >>>>>> <mailto:Pierce.Gorman@sprint.com>
>     >>>>>>   &nbs= p;   <mailto:Pierc= e.Gorman@sprint.com>>
>     >>>>>>   &nbs= p;   *Cc:* Alex Bobotek <alex@bobotek.net <mailto:alex@bobotek.net>
>     >>>>>>   &nbs= p;   <mailto:alex@bobotek.= net>>; stir@ietf.org
>     >>>>>> <mailto:stir@ietf.org> <mailto:stir@ietf.org>
>     >>>>>>   &nbs= p;   *Subject:* Re: [stir] STIR 4474bis-10 comments
>     >>>>>>
>     >>>>>>   &nbs= p;   First of all, we would want the PBX to generate the signatur= e,
>     >>>>>>   &nbs= p;   but the service provider can do that.  It should not ad= d a
>     >>>>>>   &nbs= p;   valid signature to a call from a number it did not assign to=
>     >>>>>>   &nbs= p;   the trunk group connecting to the PBX, although it could
>     >>>>>>   &nbs= p;   support the extra delegation required to support "autho= rized
>     >>>>>>   &nbs= p;   spoofing".  The companion devices I'm aware of alw= ays send
>     >>>>>>   &nbs= p;   calls from the same service provider and should not present<= br> >     >>>>>>   &nbs= p;   any issue.
>     >>>>>>
>     >>>>>>   &nbs= p;   Everyone will have to do work they don't do now to implement=
>     >>>>>>   &nbs= p;   stop spoofed calls. TANSTAAFL
>     >>>>>>
>     >>>>>>   &nbs= p;   Brian
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;       On Aug 4, 2016, at 12:41 PM, Gorman,= Pierce A [CTO]
>     >>>>>>   &nbs= p;       <Pierce.Gorman@sprint.com <mailto:Pierce.Gorman@sprint.com>
>     >>>>>>   &nbs= p;       <mailto:Pierce.Gorman@sprint.com>> wrote:
>     >>>>>>
>     >>>>>>   &nbs= p;       Fraud from compromised PBXes is comm= on.  And even where a
>     >>>>>>   &nbs= p;       PBX is not compromised, a carrier ha= s no practical way of
>     >>>>>>   &nbs= p;       knowing whether the calling number i= s properly assigned
>     >>>>>>   &nbs= p;       and valid from the perspective of th= e Enterprise.
>     >>>>>>   &nbs= p;       Therefore, checking whether the call= ing number was from an
>     >>>>>>   &nbs= p;       assigned range might be possible (an= d fraught with
>     >>>>>>   &nbs= p;       administrative challenges), but of l= imited value.  And in
>     >>>>>>   &nbs= p;       the consumer market, there are calli= ng products which
>     >>>>>>   &nbs= p;       support a parent subscriber number a= nd "companion" devices
>     >>>>>>   &nbs= p;       (e.g., tablets) which can place a ca= ll using the MDN of
>     >>>>>>   &nbs= p;       the parent subscriber.  These a= re examples of where the
>     >>>>>>   &nbs= p;       authenticity of the calling number w= on't necessarily mean
>     >>>>>>   &nbs= p;       the same thing as the authenticity o= f a call from a single
>     >>>>>>   &nbs= p;       subscriber with a single MDN regardl= ess of "laxity" of
>     >>>>>>   &nbs= p;       spoof checking.
>     >>>>>>
>     >>>>>>   &nbs= p;       In another forum and anticipating ca= lling number
>     >>>>>>   &nbs= p;       authentication mandates from Congres= s and/or FCC, I
>     >>>>>>   &nbs= p;       suggested using carrier-specific cer= ts and encoding
>     >>>>>>   &nbs= p;       specificity of authenticity, and cal= ling number.  This
>     >>>>>>   &nbs= p;       provides the identity of the origina= ting carrier, some
>     >>>>>>   &nbs= p;       idea as to the accuracy or specifici= ty of the calling
>     >>>>>>   &nbs= p;       number, and validty of the calling n= umber (assuming nonce
>     >>>>>>   &nbs= p;       and replay issues can be addressed a= s reasonably suggested
>     >>>>>>   &nbs= p;       below by Alex).
>     >>>>>>
>     >>>>>>   &nbs= p;       The representation of orig-carrier a= nd trustworthiness
>     >>>>>>   &nbs= p;       could be as follows:
>     >>>>>>
>     >>>>>>   &nbs= p;       *Regulated/mandated Carrier Class Us= e Case:*
>     >>>>>>
>     >>>>>>   &nbs= p;       *00 - No Credentials*
>     >>>>>>   &nbs= p;       Use case example(s): Pre-IMS, legacy= circuit-switched
>     >>>>>>   &nbs= p;       networks that don't natively support= SIP or which don't
>     >>>>>>   &nbs= p;       choose to sign calls.  E.g., in= ternational carriers.
>     >>>>>>   &nbs= p;       Trust Estimate:  Good luck.&nbs= p; Carrier_orig and CgPN
>     >>>>>>   &nbs= p;       entirely untrustworthy.
>     >>>>>>
>     >>>>>>   &nbs= p;       *01 - Carrier signed, no authenticat= ion of CgPN*
>     >>>>>>   &nbs= p;       Use case example(s): E911 on visited= network w/o roaming
>     >>>>>>   &nbs= p;       agreement, manual roaming.
>     >>>>>>   &nbs= p;       Trust Estimate:  Carrier_orig t= rustworthy, CgPN entirely
>     >>>>>>   &nbs= p;       untrustworthy
>     >>>>>>
>     >>>>>>   &nbs= p;       *10 - Carrier signed, semi-authentic= ated CgPN*
>     >>>>>>   &nbs= p;       Use case example(s): Number block de= legated from OCN, but
>     >>>>>>   &nbs= p;       no per-TN screen (SIP trunks).
>     >>>>>>   &nbs= p;       Trust Estimate:  Carrier_orig t= rustworthy, CgPN less than
>     >>>>>>   &nbs= p;       most trustworthy but not entirely un= trustworthy.
>     >>>>>>
>     >>>>>>   &nbs= p;       *11 - Carrier signed, authenticated = CgPN*
>     >>>>>>   &nbs= p;       Use case example(s): Bread-and-butte= r 95%+ of calls from
>     >>>>>>   &nbs= p;       subscriber lines (IMS-based and othe= rwise).
>     >>>>>>   &nbs= p;       Trust Estimate:  Carrier_orig t= rustworthy, CgPN most
>     >>>>>>   &nbs= p;       trustworthy
>     >>>>>>
>     >>>>>>   &nbs= p;       *Public Use Case:*
>     >>>>>>
>     >>>>>>   &nbs= p;       Undefined but assumed to use public = or commercially
>     >>>>>>   &nbs= p;       available authentication services re= sources.  e.g.,
>     >>>>>>   &nbs= p;       nomorobo-like crowd-sourced accept/d= eny lists, et cetera.
>     >>>>>>   &nbs= p;       Could/would pass credentials down to= SIP-aware devices
>     >>>>>>   &nbs= p;       which would process them according t= o the rules of the
>     >>>>>>   &nbs= p;       Public Class application(s).
>     >>>>>>
>     >>>>>>   &nbs= p;       Pierce
>     >>>>>>
>     >>>>>>   &nbs= p;       *From:* Brian Rosen [mailto:br@brianrosen.net]
>     >>>>>>   &nbs= p;       *Sent:* August 04, 2016 9:02 AM
>     >>>>>>   &nbs= p;       *To:* Alex Bobotek <alex@bobotek.= net
>     >>>>>> <mailto:alex@bobotek.net>
>     >>>>>>   &nbs= p;       <mailto:alex@bobotek.net>>
>     >>>>>>   &nbs= p;       *Cc:* stir@ietf.org
>     >>>>>> <mailto:stir@ietf.org> <mailto:stir@ietf.org>
>     >>>>>>   &nbs= p;       *Subject:* Re: [stir] STIR 4474bis-1= 0 comments
>     >>>>>>
>     >>>>>>   &nbs= p;       There are reasonable circumstances w= here a party placing a
>     >>>>>>   &nbs= p;       call is not the authorized entity as= signed the telephone
>     >>>>>>   &nbs= p;       number used in From/PAI, and in such= circumstances the
>     >>>>>>   &nbs= p;       service provider servicing the entit= y placing the call may
>     >>>>>>   &nbs= p;       or may not be the same as the servic= e provider serving the
>     >>>>>>   &nbs= p;       entity that is assigned the TN. = ; In all such cases, the
>     >>>>>>   &nbs= p;       entity that is assigned the TN expli= citly authorizes calls
>     >>>>>>   &nbs= p;       placed using it's TN.  The desi= gn accommodates such use
>     >>>>>>   &nbs= p;       cases.  It's not a blanket auth= orization without
>     >>>>>>   &nbs= p;       authentication.   We're no= t aware of any cases where there
>     >>>>>>   &nbs= p;       is an actual requirement for legitim= ate calling without
>     >>>>>>   &nbs= p;       explicit authorization from the assi= gned entity, although
>     >>>>>>   &nbs= p;       we certainly are aware that various = parts of various
>     >>>>>>   &nbs= p;       service providers don't bother to ch= eck. At this point, at
>     >>>>>>   &nbs= p;       least in some countries, there is a = realization that the
>     >>>>>>   &nbs= p;       laxity of allowing unchecked spoofin= g is not acceptable
>     >>>>>>   &nbs= p;       any more.
>     >>>>>>
>     >>>>>>   &nbs= p;       Brian
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;           On Aug 3, 20= 16, at 8:35 AM, Alex Bobotek
>     >>>>>>   &nbs= p;           <alex@bob= otek.net
>     >>>>>> <mailto:alex@bobotek.net> <mailto:alex@bobotek.net>> wrote:
>     >>>>>>
>     >>>>>>   &nbs= p;           1. &nbs= p;     Permit authorization without authentication
>     >>>>>>   &nbs= p;           In the curre= nt telephony network practice, some
>     >>>>>>   &nbs= p;           service prov= ider implementations choose not to
>     >>>>>>   &nbs= p;           authenticate= identity, but simply facilitate the use
>     >>>>>>   &nbs= p;           of an arbitr= ary or selected user-provided identity.
>     >>>>>>   &nbs= p;           Are there le= gitimate use cases for this?  Has anyone
>     >>>>>>   &nbs= p;           established = that there are not?  How can the industry
>     >>>>>>   &nbs= p;           reasonably e= xpect to end this (often bad) practice?
>     >>>>>>   &nbs= p;           If it can't = be ended, there's value in at least
>     >>>>>>   &nbs= p;           identifying = the originating service provider
>     >>>>>>   &nbs= p;           (i.e., the s= igner/authorizer).  Given the prevalence
>     >>>>>>   &nbs= p;           of abuse usi= ng telephone numbers assigned to a
>     >>>>>>   &nbs= p;           sometimes-an= onymous abuser, it becomes critically
>     >>>>>>   &nbs= p;           important to= identify the service provider(s) closest
>     >>>>>>   &nbs= p;           to the abuse= r.  Based on the assumption that it's
>     >>>>>>   &nbs= p;           better to ID= service providers than unreasonably
>     >>>>>>   &nbs= p;           expect a ban= of the use of unauthenticated (and
>     >>>>>>   &nbs= p;           therefore un= signed) SIP requests, STIR signing should
>     >>>>>>   &nbs= p;           support auth= orization without authentication.  The
>     >>>>>>   &nbs= p;           practice of = authorizing unauthenticated use exists,
>     >>>>>>   &nbs= p;           and there is= benefit to signing in these cases
>     >>>>>>   &nbs= p;           (service pro= vider identification).  The language of
>     >>>>>>   &nbs= p;           the ID shoul= d permit this use.  4474bis-10 should NOT
>     >>>>>>   &nbs= p;           require or a= ssume that  that authentication will
>     >>>>>>   &nbs= p;           precede auth= orization. Of course there may be other
>     >>>>>>   &nbs= p;           use cases wh= ere signing includes authentication and
>     >>>>>>   &nbs= p;           may not incl= ude a specific service provider's
>     >>>>>>   &nbs= p;           authorizatio= n.
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;           2. &nbs= p;     Improve replay prevention
>     >>>>>>   &nbs= p;           Proximate re= play is possible while complying with this
>     >>>>>>   &nbs= p;           spec.  = First, one or more proximate (e.g., within 60
>     >>>>>>   &nbs= p;           seconds) SIP= requests using the same token are legal
>     >>>>>>   &nbs= p;           and subject = to replay in many cases.  An SDP body's
>     >>>>>>   &nbs= p;           mky may not = be present and if present its use is
>     >>>>>>   &nbs= p;           optional.&nb= sp; Some sort of mandatory new or existing
>     >>>>>>   &nbs= p;           signed seque= nce, random # or request ID (e.g., Call-ID
>     >>>>>>   &nbs= p;           or CSeq) and= a 1-time use policy on the receiving end
>     >>>>>>   &nbs= p;           of the reque= st (e.g., tokens only good for 1
>     >>>>>>   &nbs= p;           use) could p= revent replay.  Different methods (e.g.,
>     >>>>>>   &nbs= p;           INVITE vs ME= SSAGE) might be handled by different
>     >>>>>>   &nbs= p;           receiving in= frastructure, and therefore difficulties
>     >>>>>>   &nbs= p;           with 'it's b= een used already' coordination allow a
>     >>>>>>   &nbs= p;           faked MESSAG= E based on a captured request. This might
>     >>>>>>   &nbs= p;           include an m= key from a captured INVITE.   So it may be
>     >>>>>>   &nbs= p;           possible to = DOS, spam or text-bomb a recipient using a
>     >>>>>>   &nbs= p;           captured ide= ntity.  While large-scale or distributed
>     >>>>>>   &nbs= p;           implementati= ons may make the enforcement difficult,
>     >>>>>>   &nbs= p;           there is lit= tle cost to signing and decoding a method
>     >>>>>>   &nbs= p;           and possibly= a numeric ID.   Some sort of '1-use'
>     >>>>>>   &nbs= p;           practice sho= uld at least be discussed while perhaps
>     >>>>>>   &nbs= p;           not required= .
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;           Specific mar= kup suggestions:
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;           NITS
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; The verifier MUST inspect any optional "ppt"
>     >>>>>> parameter appearing *= in*the
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; Identity request.  If no "ppt" parameter is
>     >>>>>> present, then the
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; verifier proceeds normally below.  If a "ppt"
>     >>>>>> parameter value is >     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; present, and the verifier does not support it,
>     >>>>>> it MUST ignore the >     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; Identity header.  If a supported "ppt" parameter
>     >>>>>> value is present,
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; the verifier follows the procedures below,
>     >>>>>> including the variati= ons
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; described in Step 5.
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp;  3
>     >>>>>>   &nbs= p;            &= nbsp;  <file:///C:/Us= ers/ab3778/Documents/IETF/draft-ietf-stir-rfc4474bis-10%20-%20Authenticated= %20Identity%20Management%20in%20the%20Session%20Initiation%20Protocol%20%28= SIP%29.htm#section-3>.
>     >>>>>>   &nbs= p;            &= nbsp;  Background
>     >>>>>>
>     >>>>>>   &nbs= p;           [...]
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; Per [RFC7340
>     >>>>>> <https://tools.ietf.org/html/rfc7340>]= , problems such as
>     >>>>>> robocalling, voicemai= l hacking, and
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; swatting are enabled by an attacker's ability to
>     >>>>>> impersonate someone >     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; else.  The secure operation of most SIP
>     >>>>>> applications and serv= ices
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; depends on authenticating and/or authorizing the
>     >>>>>> source of communicati= ons as it is
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; represented in a SIP request.
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; This identity architecture for SIP depends on
>     >>>>>> includes provisions f= or a logical
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; "authentication service" which validates caller
>     >>>>>> identity at or near o= rigination.  outgoing
>     >>>>>>   &nbs= p;           requests.&nb= sp; An
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; authentication service may be implemented either
>     >>>>>> as part of a user
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; agent or as a proxy server; typically, it is a
>     >>>>>> component of a networ= k
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; intermediary like a proxy to which originating
>     >>>>>> user agents send
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; unsigned requests.  Once the sender of the
>     >>>>>> message has been
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; This document specifies a means of sharing a
>     >>>>>> cryptographic assuran= ce
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; of authenticity of and/or authorization to use
>     >>>>>> end-user SIP identity= in an interdomain or intradomain context.
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; It relies on the authentication service
>     >>>>>> constructing tokens b= ased on [...]
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; To maximize end-to-end security, it is typically
>     >>>>>> obviously
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; preferable for end-users to acquire their own
>     >>>>>> credentials; if they<= br> >     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; do, their user agents can act as authentication
>     >>>>>> services.  Howev= er,
>     >>>>>>
>     >>>>>>   &nbs= p;            &= nbsp; for some deployments, [...]
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;           Regards,
>     >>>>>>
>     >>>>>>   &nbs= p;           Alex
>     >>>>>>   &nbs= p;           * *
>     >>>>>>   &nbs= p;           *Alex Bobote= k*
>     >>>>>>
>     >>>>>>
>     >>>>>>   &nbs= p;           ____________= ___________________________________
>     >>>>>>   &nbs= p;           stir mailing= list
>     >>>>>>   &nbs= p;           stir@ietf.or= g
>     >>>>>> <mailto:stir@ietf.org> <mailto:stir@ietf.org>
>     >>>>>>   &nbs= p;           https://www.ietf.org/mailman/lis= tinfo/stir
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>>
>     >>>>>> ---------------------= --------------------------------------------
>     >>>>>> -------
>     >>>>>>
>     >>>>>>   &nbs= p;       This e-mail may contain Sprint propr= ietary information
>     >>>>>>   &nbs= p;       intended for the sole use of the rec= ipient(s). Any use by
>     >>>>>>   &nbs= p;       others is prohibited. If you are not= the intended
>     >>>>>>   &nbs= p;       recipient, please contact the sender= and delete all copies
>     >>>>>>   &nbs= p;       of the message.
>     >>>>>
>     >>>>>
>     >>>>>
>     >>>>> _________________________= ______________________
>     >>>>> stir mailing list
>     >>>>> stir@ietf.org <mailto:stir@ietf.org>
>     >>>>> https://www.ietf.org/mailman/listinfo/stir
>     >>>>>
>     >>>>
>     >>>> _____________________________= __________________
>     >>>> stir mailing list
>     >>>> stir@ietf.org <mailto:stir@ietf.org>
>     >>>> https://www.ietf.org/mailman/listinfo/stir >     >>>
>     >>
>     >> _____________________________________= __________
>     >> stir mailing list
>     >> stir@ietf.org
>     >> https://www.ietf.org/mailman/listinfo/stir
>     >
>     >
>
>     ______________________________________________= _
>     stir mailing list
>     stir@ietf.org
>     https://www.ietf.org/mailman/listinfo/stir
>
>     ______________________________________________= _
>     stir mailing list
>     stir@ietf.org
>     https://www.ietf.org/mailman/listinfo/stir
>
>
>
>
>
> ________________________________
>
> This e-mail may contain Sprint proprietary information intended for th= e sole use of the recipient(s). Any use by others is prohibited. If you are= not the intended recipient, please contact the sender and delete all copie= s of the message.
>

 --_000_la63uyb27afcgmc3panhalnb1470419134540emailandroidcom_-- From nobody Fri Aug 5 15:41:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBB9812D7A5 for ; Fri, 5 Aug 2016 15:41:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.32 X-Spam-Level: X-Spam-Status: No, score=-2.32 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fxZqNK_4k23f for ; Fri, 5 Aug 2016 15:41:33 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB40212D691 for ; Fri, 5 Aug 2016 15:41:32 -0700 (PDT) X-AuditID: c1b4fb3a-0618b980000009bd-ac-57a5161a0f88 Received: from ESESSHC006.ericsson.se (Unknown_Domain [153.88.183.36]) by (Symantec Mail Security) with SMTP id 20.BC.02493.A1615A75; Sat, 6 Aug 2016 00:41:30 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.233]) by ESESSHC006.ericsson.se ([153.88.183.36]) with mapi id 14.03.0301.000; Sat, 6 Aug 2016 00:41:27 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Paul Kyzivat Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR7ySIy1H2XpMJyEWAavhfF7EeSqA6ynym///gqICAAEuTkQ== Date: Fri, 5 Aug 2016 22:41:27 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BBB402F@ESESSMB208.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se>, In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BBB402FESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnkeLIzCtJLcpLzFFi42KZGbFdRVdKbGm4waLfNha/P31gs1ix4QCr xfK125gcmD3+vv/A5HFp50k2jyVLfjIFMEdx2aSk5mSWpRbp2yVwZaz/FVZwW7FiyepXLA2M 82S7GDk5JARMJHY9e8vaxcjFISSwnlGis2UmG4SzmFFi6ocZ7F2MHBxsAhYS3f+0QRpEBIIl 9pzYxQYSZhZQlvi32x4kLCwQKLFy6woWiJIgiZMvXoJ1igg4SZz6Kg8SZhFQkZjx/yUrSJhX wFfi8jEziEV3WSXefuxiBKnhFHCQ+LO+HWwMo4CYxPdTa5hAbGYBcYmmLytZIU4WkFiy5zwz hC0q8fLxP1aImnyJ2WuPgPXyCghKnJz5hGUCo/AsJO2zkJTNQlIGETeQ+PL+NpStLbFs4Wtm CFtfovv9aSZk8QWM7KsYRYtTi4tz042M9FKLMpOLi/Pz9PJSSzYxAqPp4JbfVjsYDz53PMQo wMGoxMOrcGVJuBBrYllxZe4hRgkOZiUR3gyRpeFCvCmJlVWpRfnxRaU5qcWHGKU5WJTEef1f KoYLCaQnlqRmp6YWpBbBZJk4OKUaGJuSU5MPXXVcp5K4YEPX56LQ5+ZWkSzia5YVqU1MbOeq eOg/8UnQgQ8fPtev0rPOPjTF3HbHDTmzgvOJvpuV1mYKPL+j8bZm0Z4/zWv+xT9VUmvel8Yu Gj1Fd6skT/hXjSMSyQZJ3pc2KPk+T2y/L5wVKH/0Uf/DE3xye6alMi8+n6WU/myNmxJLcUai oRZzUXEiAI3Z7+GiAgAA Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 22:41:35 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BBB402FESESSMB208erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi, draft-4424bis was not submitted for last call, was it? Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD05/=FD08/=FD2016 23:11 To: Christer Holmberg; Paul Kyzivat<= mailto:pkyzivat@alum.mit.edu> Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) On 8/5/2016 1:03 PM, Christer Holmberg wrote: > I don't know whether the WG has yet decided whether there will be > options and alternatives (i.e. whether sending of claims/headers will be > mandatory, optional or forbidden) - so we don't yet know whether there > will be an "if" :) > > But, if there will be an "if", 4424bis needs to describe how to > correctly handle the different options and alternatives. Thanks for nicely introducing an underlying question I have about the specs: They were submitted for last call but clearly aren't yet finished. What's up with that? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net --_000_7594FB04B1934943A5C02806D1A2204B4BBB402FESESSMB208erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi,

draft-4424bis was not submitted for last call, was it?

Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD05= /=FD08/=FD2016 23:11
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
On 8/5/2016 1:03 PM, Christer Holmberg wrote:
> I don't know whether the WG has yet decided whether there will be
> options and alternatives (i.e. whether sending of claims/headers will = be
> mandatory, optional or forbidden) - so we don't yet know whether there=
> will be an "if" :)
>
> But, if there will be an "if", 4424bis needs to describe how= to
> correctly handle the different options and alternatives.


Thanks for nicely introducing an underlying question I have about the
specs:  They were submitted for last call but clearly aren't yet
finished.  What's up with that?

d/

--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
 --_000_7594FB04B1934943A5C02806D1A2204B4BBB402FESESSMB208erics_-- From nobody Fri Aug 5 15:50:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 631BF12D7CE for ; Fri, 5 Aug 2016 15:50:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.272 X-Spam-Level: X-Spam-Status: No, score=0.272 tagged_above=-999 required=5 tests=[RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.972] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AczUxi3V7JxU for ; Fri, 5 Aug 2016 15:50:41 -0700 (PDT) Received: from resqmta-ch2-06v.sys.comcast.net (resqmta-ch2-06v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEE10126D74 for ; Fri, 5 Aug 2016 15:50:40 -0700 (PDT) Received: from resomta-ch2-12v.sys.comcast.net ([69.252.207.108]) by resqmta-ch2-06v.sys.comcast.net with SMTP id Vnw3b7Udg2NhqVnwubDXdP; Fri, 05 Aug 2016 22:50:40 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id VnwsboIVDvO5AVnwtbuxd4; Fri, 05 Aug 2016 22:50:39 +0000 To: "Rosbotham, Paul, Vodafone UK" , "Gorman, Pierce A [CTO]" , Richard Shockey , Brian Rosen References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> From: Paul Kyzivat Message-ID: <5b0f4ed4-acf5-b7b9-4ab0-f9746276db5f@alum.mit.edu> Date: Fri, 5 Aug 2016 18:50:38 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfIx0I+JZRAs6Ou0x7XHTaRIFnSeMH+lL65Oa2W6QkkNPwd51X8GAUOTa5YJWdm4y5dTrG6EdcFj8s3IQJjxfga2BoGr7wygVkgh9Uv/rn//FijjveXBT 0MztfyygsyYdkZmD1MfboymDoXWyBvg1gjrqmcJMkkv9rc0wEsMYfQY75LJo57TQh+iOJYh4HZukiUuFcog+3kxUyGmV7qHWK0zNfWvy6Lv5LgH09xnNsmbo gZgakzmkWqMP8OKC5o3yhQ77B80hmrGH61wKDyyKnOwWz2PryYU6Nb8qG9WcFFbhsYBJev0+co23NEOP3u4R17+wiSUVjF612cqX9ybCjeI= Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 22:50:43 -0000 On 8/5/16 4:16 PM, Rosbotham, Paul, Vodafone UK wrote: > This all depends on context. > > In the UK the Network Number (what we have in PAI) is network internal, > not passed to end users. On originating connections from large > enterprise SIP networks in particular, as the NN represents where the > call hits the public network it'd be highly misleading/irrelevant as far > a the terminating customer's concerned. OK, fine. If it isn't a number that means anything to the end user then I agree there is no point in disclosing it. Thanks, Paul > Rgds > > Paul > > -------- Original Message -------- > > Subject: Re: [stir] STIR 4474bis-10 comments > > From: Paul Kyzivat > > Date: 5 Aug 2016 17:57 > > To: "Gorman, Pierce A [CTO]" ,Richard Shockey > ,"Rosbotham, Paul, Vodafone UK" > ,Brian Rosen > > If PAI is present and signed, and From is also signed, I would expect it > to be up to the UA to decide what to display, not the carrier. > > Of course this will work differently if there is a different signaling > regime between the carrier and the user device (e.g. black phone). > > Thanks, > Paul > > On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-Identity is stripped by border controller functions and is not to be used in inter-carrier inter-connection (although it commonly shows up anyway). My opinion is the "From" > header is likely used more often for presentation. >> >> Pierce >> >> >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> >> Humm this is getting interesting. Its my understanding that the display number aka presentation number in the US context is the one carried in the PAI. Martin, Pierce? >> >> >> >> >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >> >> Jumping in now that we're on European working time, +1 on Paul's observation. >> >> Here in the UK, we've got 2 numbers carried as calling line IDs....one (we term the Network Number, carried in PAID) uniquely identifies the line, the other (we term Presentation Number, carried in From) is used for display purposes. >> >> Only the carrier has the authority to set the Network Number so only they could sign it. >> >> But - subject to regulatory restrictions which are well documented - the number sent for display purposes belongs to the customer. For blue-chip customers, I can allow them to send their Presentation Numbers into the network, and can't readily check at a network level that they're theirs (I do have contractual > safeguards). The number may have been allocated by me, or could be > allocated by a third party provider. If it's a call-centre they'll be > making outbound calls for lots of different customers which will change > on day-by-day basis. This is business as usual. I don't like the term > "authorised spoofing" because it implies that the CLI is in some way > being rigged: it's not, it's the corporate customer or their > subcontractor using the number that's been assigned (so in internet > terms delegated) to them via a chain of trust from the regulator. >> >> What I want is the ability for customers to use their credentials to sign the CLIs they send me so that at the terminating end it can be checked (or indeed somewhere en-route if that's the business model). I can and would sign for customers on my mobile business since I'm driving what number is presented, but that's > by-the-by because they aren't the ones who generate millions of nuisance > calls. If the signing only occurs at the originating carrier level for > corporate/call-centre customers that's no use because I'm not in a > position to do that for these type of customers...and the whole system > becomes a waste of time. I'd also highlight there are many more of my > large customers that I'd trust more than a far end originating carrier > that could be anywhere in the world (though we have no shortage of small > carriers that I wouldn't know from Adam more locally in the UK....) >> >> Regards >> >> Paul >> >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> On 8/4/16 6:02 PM, Brian Rosen wrote: >> > I think it's not a delegation. The mobile phone is not being delegated the TN, it's being authorized to place calls that are not from that TN, but appear to be. >> > >> > The mechanism to handle the credential is exactly the same as a delegation, so if you want to call it delegation, go ahead, but I prefer to call it authorized spoofing. >> >> IIUC the delegation is to a responsible entity (something that can be held legally accountable - e.g. a person), not to a device. The entity can then "use" the credential via any device(s) it chooses. In the case of the mobile, the device then becomes a two-line phone. >> >> Thanks, >> Paul >> >> > Brian >> > >> >> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: >> >> >> >> On 8/4/16 5:43 PM, Brian Rosen wrote: >> >>> In my jargon an "authorized spoofer" is the doctor who is calling >> >>> from his mobile, but sending the TN of his office phone as calling party. >> >>> The delegation to his office phone was made by his landline carrier >> >>> to him. He then creates another credential, which he signs with his >> >>> office phone credential that authorizes his mobile to send calls >> >>> from his office number. He is spoofing (because the call is coming >> >>> from his mobile's TN but claims to be from his office), but it's >> >>> authorized spoofing. The doc could give the credential to his >> >>> mobile SP if they sign on his behalf. >> >> >> >> I don't understand how that is different from regular delegation. >> >> >> >> When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. >> >> >> >> Thanks, >> >> Paul >> >> >> >>> Some folks don't like attaching the "spoofing" label to a legitimate use. >> >>> >> >>> But that's how I describe it. >> >>> >> >>> Brian >> >>> >> >>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat > >>>> > wrote: >> >>>> >> >>>> +1, but with one question below: >> >>>> >> >>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >> >>>>> I think all we need is to have credentials follow the delegation >> >>>>> path, >> >>>> >> >>>>> plus the option to add another level (not delegation) for >> >>>>> authorized spoofers. >> >>>> >> >>>> I don't understand "authorized spoofers" in this context, as >> >>>> contrasted to "spoofers" who have been delegated their authority. >> >>>> >> >>>> Thanks, >> >>>> Paul >> >>>> >> >>>>> I don't think it matters who the delegator or delegatee are as >> >>>>> long as the delegator is willing to take the heat for delegating >> >>>>> to someone who sends a lot of bad calls. They can pass the buck >> >>>>> ("I delegated the TN to him, and now I'm not responsible"), but >> >>>>> only if the SP knows who they delegated to, so authorities can >> >>>>> follow the delegation path. There are plenty of certificated >> >>>>> carriers who are willing to not care who they delegate to. The fact that there are some who do doesn't change much. >> >>>>> Making stir work means knowing who you are delegating to, so that >> >>>>> you can pass the hot potato. >> >>>>> >> >>>>> It's perfectly reasonable for a carrier to be able to sign for any >> >>>>> calls placed on its network on any number it has been delegated. >> >>>>> If it does, it's asserting that the calls are from who they are supposed to be from. >> >>>>> That should be straightforward, but we know it's not always, and >> >>>>> that represents the hard part of deployment in my opinion. But >> >>>>> once they delegate, they can hand responsibility to sign to the >> >>>>> delegatee. But, that only works if they know who they are delegating to. >> >>>>> >> >>>>> The root of the whole model is that there is a formal or informal >> >>>>> delegation path for telephone numbers in every country, and we can >> >>>>> build a chain of trust from that delegation path. If you propose >> >>>>> to alter that model, then we get into (policy) issues of which >> >>>>> carriers/entities we trust and which we don't. Our model is that >> >>>>> you know who you delegate to, and once you do that delegation, it's their problem. >> >>>>> That's pretty appealing I think, even if it's a change in some >> >>>>> business practices. >> >>>>> >> >>>>> The mechanism is chaining credentials in a form of a PKI and >> >>>>> having a way to know which TNs are covered by a credential. >> >>>>> That's what we have, and I'm loath to change it. >> >>>>> >> >>>>> Brian >> >>>>> >> >>>>> >> >>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >> >>>>>> >> >>>>>> > >> >>>>>> wrote: >> >>>>>> >> >>>>>> OK, you talked me into indulging in one more message on policy >> >>>>>> and use cases. >> >>>>>> >> >>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >> >>>>>> individual devices as well as multi-device and multi-number platforms. >> >>>>>> >> >>>>>> Number delegation (and sub-delegation), and business >> >>>>>> relationships are two additional factors which affect >> >>>>>> trustworthiness of a given calling number authentication. >> >>>>>> >> >>>>>> Inherent variable trustworthiness of a calling number was my >> >>>>>> reason for suggesting a way to qualify the signature to reflect >> >>>>>> that variability. >> >>>>>> >> >>>>>> Originating carriers are in a position to know if a call is >> >>>>>> coming from a device assigned a single number, or from "trunk >> >>>>>> group" which could originate calls using multiple numbers, and >> >>>>>> can qualify to some degree the trustworthiness of number authenticity accordingly. >> >>>>>> >> >>>>>> My suggestion was qualifying calling number authenticity into >> >>>>>> categories of carrier-signed (or not), and unauthenticated, >> >>>>>> semi-authenticated, and most-authenticated. There can be more >> >>>>>> granularity, but it implies additional operational complexity >> >>>>>> (both for the carriers and the consumers) and I assume diminishes value. >> >>>>>> >> >>>>>> My reason for adding the authenticity of the originating carrier >> >>>>>> is typical trustworthiness of a carrier business relationship >> >>>>>> with typical consumers adds to the trustworthiness assessment and >> >>>>>> partially because carriers are a regulated point of forensic >> >>>>>> inquiry for CALEA and fraud. Additionally, most calls originate >> >>>>>> and terminate between mobile consumers where their carriers are >> >>>>>> able to usefully authenticate their device and have a high degree >> >>>>>> of confidence of the authenticity of the calling number. >> >>>>>> >> >>>>>> I think billions of per-TN certs of varying usability (revoked, >> >>>>>> not >> >>>>>> revoked) for authenticating calling number will not work well. >> >>>>>> >> >>>>>> Conversely, I think billions of per-TN certs will work well, if >> >>>>>> the calling party has to sign a call with a per-TN cert provided >> >>>>>> by the called party. No called party cert to include? Then the >> >>>>>> calling party does not have a trusted relationship with the >> >>>>>> called party, and the call can be authorized/treated accordingly. >> >>>>>> (I've made similar, mostly ignored comments in MODERN.) >> >>>>>> >> >>>>>> Pierce >> >>>>>> >> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >> >>>>>> *Sent:* August 04, 2016 2:03 PM >> >>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>> >> >>>>>> > >> >>>>>> *Cc:* Alex Bobotek >> >>>>>> >; stir@ietf.org >> >>>>>> >> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >>>>>> >> >>>>>> Well, the mechanisms are designed so that they could be deployed >> >>>>>> on devices and PBXs. Whether they will be is a policy issue. >> >>>>>> >> >>>>>> The notion of credentials that are traceable to a delegation of a >> >>>>>> TN is a mechanism that is part of the design of stir, and the >> >>>>>> design allows delegation of one TN (to one device, although a >> >>>>>> device like a PBX would have more than one TN per "device", and >> >>>>>> something like a dual NAM phone could have more than one >> >>>>>> credential. For the use case we've discussed, a mobile phone may >> >>>>>> also have a credential for, say, a TN that is delegated to a >> >>>>>> landline, to cover the example case of a doctor placing a call on >> >>>>>> his mobile, but getting his office number to show up as the calling party. Use of such mechanisms is policy. >> >>>>>> >> >>>>>> Brian >> >>>>>> >> >>>>>> >> >>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >> >>>>>> > >>>>>> >> >>>>>> > >> >>>>>> wrote: >> >>>>>> >> >>>>>> Thanks Brian. I'm afraid we're straying into a policy >> >>>>>> discussion. Regardless, I do appreciate your explanation. I >> >>>>>> would like to continue the discussion, but I'm pretty sure this >> >>>>>> isn't the right forum. >> >>>>>> >> >>>>>> Pierce >> >>>>>> >> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >> >>>>>> *Sent:* August 04, 2016 1:34 PM >> >>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>> >> >>>>>> > >> >>>>>> *Cc:* Alex Bobotek >> >>>>>> >; stir@ietf.org >> >>>>>> >> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >>>>>> >> >>>>>> Of course I want PBXs to sign calls. As well as smart phones and >> >>>>>> any other devices that can be programmed to do so. >> >>>>>> They will be given credentials that only are valid for the TNs >> >>>>>> they are authorized to sign for. They can try to sign any call, >> >>>>>> but the validity of the credential would make such a signature >> >>>>>> fail the checking. >> >>>>>> >> >>>>>> Getting service providers to sign on behalf of devices is a >> >>>>>> reasonable way to deploy quickly, but I expect many SPs will want >> >>>>>> to get out of the liability of signing on behalf of their >> >>>>>> customers. If they can push of that responsibility to their >> >>>>>> customer, only being responsible for getting the customer an >> >>>>>> appropriate credential when they assign TNs, then I would expect >> >>>>>> them to want to do so. That means the devices have to be able to >> >>>>>> sign, but I understand many of the PBX vendors think that's >> >>>>>> something they could provide in a future release. >> >>>>>> >> >>>>>> Brian >> >>>>>> >> >>>>>> >> >>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >> >>>>>> > >>>>>> > >> >>>>>> wrote: >> >>>>>> >> >>>>>> You want IP PBXes to sign calls? Won't that make it >> >>>>>> extraordinarily easy to commit fraud with authenticated numbers? >> >>>>>> >> >>>>>> >> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >> >>>>>> *Sent:* August 04, 2016 12:24 PM >> >>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>> >> >>>>>> > >> >>>>>> *Cc:* Alex Bobotek >> >>>>>> >; stir@ietf.org >> >>>>>> >> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >>>>>> >> >>>>>> First of all, we would want the PBX to generate the signature, >> >>>>>> but the service provider can do that. It should not add a >> >>>>>> valid signature to a call from a number it did not assign to >> >>>>>> the trunk group connecting to the PBX, although it could >> >>>>>> support the extra delegation required to support "authorized >> >>>>>> spoofing". The companion devices I'm aware of always send >> >>>>>> calls from the same service provider and should not present >> >>>>>> any issue. >> >>>>>> >> >>>>>> Everyone will have to do work they don't do now to implement >> >>>>>> stop spoofed calls. TANSTAAFL >> >>>>>> >> >>>>>> Brian >> >>>>>> >> >>>>>> >> >>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >> >>>>>> >> >>>>>> > wrote: >> >>>>>> >> >>>>>> Fraud from compromised PBXes is common. And even where a >> >>>>>> PBX is not compromised, a carrier has no practical way of >> >>>>>> knowing whether the calling number is properly assigned >> >>>>>> and valid from the perspective of the Enterprise. >> >>>>>> Therefore, checking whether the calling number was from an >> >>>>>> assigned range might be possible (and fraught with >> >>>>>> administrative challenges), but of limited value. And in >> >>>>>> the consumer market, there are calling products which >> >>>>>> support a parent subscriber number and "companion" devices >> >>>>>> (e.g., tablets) which can place a call using the MDN of >> >>>>>> the parent subscriber. These are examples of where the >> >>>>>> authenticity of the calling number won't necessarily mean >> >>>>>> the same thing as the authenticity of a call from a single >> >>>>>> subscriber with a single MDN regardless of "laxity" of >> >>>>>> spoof checking. >> >>>>>> >> >>>>>> In another forum and anticipating calling number >> >>>>>> authentication mandates from Congress and/or FCC, I >> >>>>>> suggested using carrier-specific certs and encoding >> >>>>>> specificity of authenticity, and calling number. This >> >>>>>> provides the identity of the originating carrier, some >> >>>>>> idea as to the accuracy or specificity of the calling >> >>>>>> number, and validty of the calling number (assuming nonce >> >>>>>> and replay issues can be addressed as reasonably suggested >> >>>>>> below by Alex). >> >>>>>> >> >>>>>> The representation of orig-carrier and trustworthiness >> >>>>>> could be as follows: >> >>>>>> >> >>>>>> *Regulated/mandated Carrier Class Use Case:* >> >>>>>> >> >>>>>> *00 - No Credentials* >> >>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >> >>>>>> networks that don't natively support SIP or which don't >> >>>>>> choose to sign calls. E.g., international carriers. >> >>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >> >>>>>> entirely untrustworthy. >> >>>>>> >> >>>>>> *01 - Carrier signed, no authentication of CgPN* >> >>>>>> Use case example(s): E911 on visited network w/o roaming >> >>>>>> agreement, manual roaming. >> >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >> >>>>>> untrustworthy >> >>>>>> >> >>>>>> *10 - Carrier signed, semi-authenticated CgPN* >> >>>>>> Use case example(s): Number block delegated from OCN, but >> >>>>>> no per-TN screen (SIP trunks). >> >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >> >>>>>> most trustworthy but not entirely untrustworthy. >> >>>>>> >> >>>>>> *11 - Carrier signed, authenticated CgPN* >> >>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >> >>>>>> subscriber lines (IMS-based and otherwise). >> >>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >> >>>>>> trustworthy >> >>>>>> >> >>>>>> *Public Use Case:* >> >>>>>> >> >>>>>> Undefined but assumed to use public or commercially >> >>>>>> available authentication services resources. e.g., >> >>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >> >>>>>> Could/would pass credentials down to SIP-aware devices >> >>>>>> which would process them according to the rules of the >> >>>>>> Public Class application(s). >> >>>>>> >> >>>>>> Pierce >> >>>>>> >> >>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >> >>>>>> *Sent:* August 04, 2016 9:02 AM >> >>>>>> *To:* Alex Bobotek > >>>>>> >> >>>>>> > >> >>>>>> *Cc:* stir@ietf.org >> >>>>>> >> >>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >> >>>>>> >> >>>>>> There are reasonable circumstances where a party placing a >> >>>>>> call is not the authorized entity assigned the telephone >> >>>>>> number used in From/PAI, and in such circumstances the >> >>>>>> service provider servicing the entity placing the call may >> >>>>>> or may not be the same as the service provider serving the >> >>>>>> entity that is assigned the TN. In all such cases, the >> >>>>>> entity that is assigned the TN explicitly authorizes calls >> >>>>>> placed using it's TN. The design accommodates such use >> >>>>>> cases. It's not a blanket authorization without >> >>>>>> authentication. We're not aware of any cases where there >> >>>>>> is an actual requirement for legitimate calling without >> >>>>>> explicit authorization from the assigned entity, although >> >>>>>> we certainly are aware that various parts of various >> >>>>>> service providers don't bother to check. At this point, at >> >>>>>> least in some countries, there is a realization that the >> >>>>>> laxity of allowing unchecked spoofing is not acceptable >> >>>>>> any more. >> >>>>>> >> >>>>>> Brian >> >>>>>> >> >>>>>> >> >>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >> >>>>>> > >>>>>> > wrote: >> >>>>>> >> >>>>>> 1. Permit authorization without authentication >> >>>>>> In the current telephony network practice, some >> >>>>>> service provider implementations choose not to >> >>>>>> authenticate identity, but simply facilitate the use >> >>>>>> of an arbitrary or selected user-provided identity. >> >>>>>> Are there legitimate use cases for this? Has anyone >> >>>>>> established that there are not? How can the industry >> >>>>>> reasonably expect to end this (often bad) practice? >> >>>>>> If it can't be ended, there's value in at least >> >>>>>> identifying the originating service provider >> >>>>>> (i.e., the signer/authorizer). Given the prevalence >> >>>>>> of abuse using telephone numbers assigned to a >> >>>>>> sometimes-anonymous abuser, it becomes critically >> >>>>>> important to identify the service provider(s) closest >> >>>>>> to the abuser. Based on the assumption that it's >> >>>>>> better to ID service providers than unreasonably >> >>>>>> expect a ban of the use of unauthenticated (and >> >>>>>> therefore unsigned) SIP requests, STIR signing should >> >>>>>> support authorization without authentication. The >> >>>>>> practice of authorizing unauthenticated use exists, >> >>>>>> and there is benefit to signing in these cases >> >>>>>> (service provider identification). The language of >> >>>>>> the ID should permit this use. 4474bis-10 should NOT >> >>>>>> require or assume that that authentication will >> >>>>>> precede authorization. Of course there may be other >> >>>>>> use cases where signing includes authentication and >> >>>>>> may not include a specific service provider's >> >>>>>> authorization. >> >>>>>> >> >>>>>> >> >>>>>> 2. Improve replay prevention >> >>>>>> Proximate replay is possible while complying with this >> >>>>>> spec. First, one or more proximate (e.g., within 60 >> >>>>>> seconds) SIP requests using the same token are legal >> >>>>>> and subject to replay in many cases. An SDP body's >> >>>>>> mky may not be present and if present its use is >> >>>>>> optional. Some sort of mandatory new or existing >> >>>>>> signed sequence, random # or request ID (e.g., Call-ID >> >>>>>> or CSeq) and a 1-time use policy on the receiving end >> >>>>>> of the request (e.g., tokens only good for 1 >> >>>>>> use) could prevent replay. Different methods (e.g., >> >>>>>> INVITE vs MESSAGE) might be handled by different >> >>>>>> receiving infrastructure, and therefore difficulties >> >>>>>> with 'it's been used already' coordination allow a >> >>>>>> faked MESSAGE based on a captured request. This might >> >>>>>> include an mkey from a captured INVITE. So it may be >> >>>>>> possible to DOS, spam or text-bomb a recipient using a >> >>>>>> captured identity. While large-scale or distributed >> >>>>>> implementations may make the enforcement difficult, >> >>>>>> there is little cost to signing and decoding a method >> >>>>>> and possibly a numeric ID. Some sort of '1-use' >> >>>>>> practice should at least be discussed while perhaps >> >>>>>> not required. >> >>>>>> >> >>>>>> >> >>>>>> Specific markup suggestions: >> >>>>>> >> >>>>>> >> >>>>>> NITS >> >>>>>> >> >>>>>> >> >>>>>> The verifier MUST inspect any optional "ppt" >> >>>>>> parameter appearing *in*the >> >>>>>> >> >>>>>> Identity request. If no "ppt" parameter is >> >>>>>> present, then the >> >>>>>> >> >>>>>> verifier proceeds normally below. If a "ppt" >> >>>>>> parameter value is >> >>>>>> >> >>>>>> present, and the verifier does not support it, >> >>>>>> it MUST ignore the >> >>>>>> >> >>>>>> Identity header. If a supported "ppt" parameter >> >>>>>> value is present, >> >>>>>> >> >>>>>> the verifier follows the procedures below, >> >>>>>> including the variations >> >>>>>> >> >>>>>> described in Step 5. >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> 3 >> >>>>>> . >> >>>>>> Background >> >>>>>> >> >>>>>> [...] >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> Per [RFC7340 >> >>>>>> ], problems such as >> >>>>>> robocalling, voicemail hacking, and >> >>>>>> >> >>>>>> swatting are enabled by an attacker's ability to >> >>>>>> impersonate someone >> >>>>>> >> >>>>>> else. The secure operation of most SIP >> >>>>>> applications and services >> >>>>>> >> >>>>>> depends on authenticating and/or authorizing the >> >>>>>> source of communications as it is >> >>>>>> >> >>>>>> represented in a SIP request. >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> This identity architecture for SIP depends on >> >>>>>> includes provisions for a logical >> >>>>>> >> >>>>>> "authentication service" which validates caller >> >>>>>> identity at or near origination. outgoing >> >>>>>> requests. An >> >>>>>> >> >>>>>> authentication service may be implemented either >> >>>>>> as part of a user >> >>>>>> >> >>>>>> agent or as a proxy server; typically, it is a >> >>>>>> component of a network >> >>>>>> >> >>>>>> intermediary like a proxy to which originating >> >>>>>> user agents send >> >>>>>> >> >>>>>> unsigned requests. Once the sender of the >> >>>>>> message has been >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> This document specifies a means of sharing a >> >>>>>> cryptographic assurance >> >>>>>> >> >>>>>> of authenticity of and/or authorization to use >> >>>>>> end-user SIP identity in an interdomain or intradomain context. >> >>>>>> >> >>>>>> It relies on the authentication service >> >>>>>> constructing tokens based on [...] >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> To maximize end-to-end security, it is typically >> >>>>>> obviously >> >>>>>> >> >>>>>> preferable for end-users to acquire their own >> >>>>>> credentials; if they >> >>>>>> >> >>>>>> do, their user agents can act as authentication >> >>>>>> services. However, >> >>>>>> >> >>>>>> for some deployments, [...] >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> Regards, >> >>>>>> >> >>>>>> Alex >> >>>>>> * * >> >>>>>> *Alex Bobotek* >> >>>>>> >> >>>>>> >> >>>>>> _______________________________________________ >> >>>>>> stir mailing list >> >>>>>> stir@ietf.org >> >>>>>> >> >>>>>> https://www.ietf.org/mailman/listinfo/stir >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> ----------------------------------------------------------------- >> >>>>>> ------- >> >>>>>> >> >>>>>> This e-mail may contain Sprint proprietary information >> >>>>>> intended for the sole use of the recipient(s). Any use by >> >>>>>> others is prohibited. If you are not the intended >> >>>>>> recipient, please contact the sender and delete all copies >> >>>>>> of the message. >> >>>>> >> >>>>> >> >>>>> >> >>>>> _______________________________________________ >> >>>>> stir mailing list >> >>>>> stir@ietf.org >> >>>>> https://www.ietf.org/mailman/listinfo/stir >> >>>>> >> >>>> >> >>>> _______________________________________________ >> >>>> stir mailing list >> >>>> stir@ietf.org >> >>>> https://www.ietf.org/mailman/listinfo/stir >> >>> >> >> >> >> _______________________________________________ >> >> stir mailing list >> >> stir@ietf.org >> >> https://www.ietf.org/mailman/listinfo/stir >> > >> > >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> >> >> >> >> ________________________________ >> >> This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. >> > From nobody Fri Aug 5 15:52:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C82412D62A for ; Fri, 5 Aug 2016 15:52:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.382 X-Spam-Level: * X-Spam-Status: No, score=1.382 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z3qQu5U0tX2n for ; Fri, 5 Aug 2016 15:52:34 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30EC5126D74 for ; Fri, 5 Aug 2016 15:52:34 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u75MqVrn021936 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 5 Aug 2016 15:52:31 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470437551; bh=hk3w4WsLpUKIf3wSwIuaxgvE4PJhJ1XJXxi6W9Lm0sw=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=gwnW1tBc4v5YfrgyNamN+fJo2rh0ZFH8RaVg0vwXSmWJMb9WuU/43e746QfsDsAsv aeaki3ZFolusgQmYGyL1lUvNbnf1XtSQuwRLje7N9kzQvq6x9SeSXgH3RxvaiHN0XO tQ6tGDu3lJHxfvfIgPwC8dYWnPKi1U1DdUIipEVs= To: Christer Holmberg , Paul Kyzivat References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <7594FB04B1934943A5C02806D1A2204B4BBB402F@ESESSMB208.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 5 Aug 2016 15:52:12 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BBB402F@ESESSMB208.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Aug 2016 22:52:35 -0000 On 8/5/2016 3:41 PM, Christer Holmberg wrote: > draft-4424bis was not submitted for last call, was it? > Subject: [stir] WG Last Call for RFC4474bis > Date: Wed, 13 Jul 2016 15:58:10 -0400 > From: Russ Housley > Reply-To: IETF STIR Mail List > To: IETF STIR Mail List > > > The authors of the Authenticated Identity Management in SIP document > (https://www.ietf.org/id/draft-ietf-stir-rfc4474bis-10.txt) have > stated that the document is mature and ready for WG Last Call. -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 5 17:51:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6488E12D522 for ; Fri, 5 Aug 2016 17:51:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.32 X-Spam-Level: X-Spam-Status: No, score=-2.32 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IqllUIcnK2o9 for ; Fri, 5 Aug 2016 17:51:45 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F039B12B061 for ; Fri, 5 Aug 2016 17:51:44 -0700 (PDT) X-AuditID: c1b4fb25-8d3fb70000001071-c9-57a51ba72c28 Received: from ESESSHC018.ericsson.se (Unknown_Domain [153.88.183.72]) by (Symantec Mail Security) with SMTP id 7B.FF.04209.7AB15A75; Sat, 6 Aug 2016 01:05:12 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.233]) by ESESSHC018.ericsson.se ([153.88.183.72]) with mapi id 14.03.0301.000; Sat, 6 Aug 2016 01:05:11 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Paul Kyzivat Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR7ySIy1H2XpMJyEWAavhfF7EeSqA6ynym///gqICAAEuTkf//4XoAgAAlJxE= Date: Fri, 5 Aug 2016 23:05:10 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BBB410B@ESESSMB208.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <7594FB04B1934943A5C02806D1A2204B4BBB402F@ESESSMB208.ericsson.se>, In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BBB410BESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnkeLIzCtJLcpLzFFi42KZGbHdQ3eF9NJwg9P3jCx+f/rAZrFiwwFW i+VrtzE5MHv8ff+ByePSzpNsHkuW/GQKYI7isklJzcksSy3St0vgymh6u5Cp4KtixYTlX5kb GK/KdjFycEgImEicmx3dxcjFISSwnlHifdszJghnMaPE952fWECK2AQsJLr/aXcxcnKICARL 7Dmxiw0kzCygLPFvtz1IWFggUGLl1hUsECVBEidfvGQHKRER8JNY1l8AYrIIqEhcvakOUsEr 4Ctx/P4+NohF19kk1reAOJwcnAIOEu2fuxhBbEYBMYnvp9YwgdjMAuISTV9WsoLYEgICEkv2 nGeGsEUlXj7+xwpRky9x78cEFogFghInZz5hmcAoPAtJ+ywkZbOQlEHEDSS+vL8NZWtLLFv4 mhnC1pfofn+aCVl8ASP7KkbR4tTipNx0I2O91KLM5OLi/Dy9vNSSTYzAaDq45bfqDsbLbxwP MQpwMCrx8CpcWRIuxJpYVlyZe4hRgoNZSYRXWnJpuBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXFe /5eK4UIC6YklqdmpqQWpRTBZJg5OqQbGKE2rT4ubpi97aH3jWqklX8rWnUtXh09pucD/48Kx q3aP+pR41tWK7qiaJnY4QSd7XdBJHdaAfbGfptzjvyZgoP/uENNnp/dz7n6aZ/HK5bityNJn WwKzOg7esMsL+mQT/MblqbmJUmah32ITj5vymUJvLn2VC2g5u+WYXtK/xYs3sjRZTjq4R4ml OCPRUIu5qDgRANWvk5uiAgAA Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Aug 2016 00:51:47 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BBB410BESESSMB208erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable If that's the case, I assume the issues I raised will be treated as as WGLC= comments. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD06/=FD08/=FD2016 01:52 To: Christer Holmberg; Paul Kyzivat<= mailto:pkyzivat@alum.mit.edu> Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) On 8/5/2016 3:41 PM, Christer Holmberg wrote: > draft-4424bis was not submitted for last call, was it? > Subject: [stir] WG Last Call for RFC4474bis > Date: Wed, 13 Jul 2016 15:58:10 -0400 > From: Russ Housley > Reply-To: IETF STIR Mail List > To: IETF STIR Mail List > > > The authors of the Authenticated Identity Management in SIP document > (https://www.ietf.org/id/draft-ietf-stir-rfc4474bis-10.txt) have > stated that the document is mature and ready for WG Last Call. -- Dave Crocker Brandenburg InternetWorking bbiw.net --_000_7594FB04B1934943A5C02806D1A2204B4BBB410BESESSMB208erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
If that's the= case, I assume the issues I raised will be treated as as WGLC comments.
Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD06= /=FD08/=FD2016 01:52
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
On 8/5/2016 3:41 PM, Christer Holmberg wrote:
> draft-4424bis was not submitted for last call, was it?


> Subject: [stir] WG Last Call for RFC4474bis
> Date: Wed, 13 Jul 2016 15:58:10 -0400
> From: Russ Housley <housley@vigilsec.com>
> Reply-To: IETF STIR Mail List <stir@ietf.org>
> To: IETF STIR Mail List <stir@ietf.org>
>
>
> The authors of the Authenticated Identity Management in SIP document > (https://www.ietf.org/id/draft-ietf-stir-rfc4474bis-10.txt) have
> stated that the document is mature and ready for WG Last Call.



--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
 --_000_7594FB04B1934943A5C02806D1A2204B4BBB410BESESSMB208erics_-- From nobody Sat Aug 6 10:50:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D458E12D565 for ; Sat, 6 Aug 2016 10:50:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.7 X-Spam-Level: X-Spam-Status: No, score=-102.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8tXXNFLBMzXn for ; Sat, 6 Aug 2016 10:50:38 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0356B12D552 for ; Sat, 6 Aug 2016 10:50:37 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u76HhAYh021269; Sat, 6 Aug 2016 13:50:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=qeom5sWCFHf3lSK6mz0rS76YSzalZGZw0fj4zJh+sII=; b=j06EuqRdsjWNihzvuKSZ2pjswjltvAx9y9myM6RPi4v3i75WZpzAWAz1BDOrTemu9EY8 AA8Qh5aupNDFxhSCzkGzJFzVQltOOv+wtxK6zNfTR8IgyKXUNuyujzSar4Uusoe6tFl6 o0DcErUTzaIvmjga6gIMsgZDjvcPdaMB8ONmNRVAGgDtndQThn7Wbi0kLBaNYZEmLPFp +X3lRkGyZsn/rAOoAxdGt9FznTRmq/k8ZFCqBh++ikKMm3X2MBlxOZpJTWX+gwJBEQvc hUfAJFs0I3lgXpEETi5ZdSl93Rny40p8vOBINmbFq8/BucpgTLgB8ybpXTYqt10L4J0d Nw== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24nc7a0ke6-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Sat, 06 Aug 2016 13:50:30 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Sat, 6 Aug 2016 13:50:29 -0400 From: "Peterson, Jon" To: Christer Holmberg Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR7m+wzKPAmbN5IkGL9+GcpzG0bKA5Sk8AgAAbdoCAAMpSgIAAfwwAgABf0oCAASo1Bw== Date: Sat, 6 Aug 2016 17:50:29 +0000 Message-ID: <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se>, <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net>, <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_51D45AE567D24120BCA27BFC845E2126neustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-06_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608060217 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Aug 2016 17:50:40 -0000 --_000_51D45AE567D24120BCA27BFC845E2126neustarbiz_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Briefly, there is and always has been a "bare minimum" set of headers and c= laims that are mandatory for PASSporT. Ultimately, the question of what hea= ders and claims are mandatory in PASSporT is a stir-passport question. SIP = as a using protocol of PASSporT defines only which fields in a SIP request = will populate those mandatory components of a PASSporT object, and that inf= ormation is given in considerable detail in RFC 4474bis today. Extensions may propose additional claims that will appear in PASSporT objec= ts. The extensibility model of PASSporT is similarly a matter for the PASSp= orT spec rather than RFC 4474bis, though we anticipate that extensions may = want to specify some initial using protocol behavior as well. We should hav= e a few examples of that soon. Jon Peterson Neustar, Inc. Sent from my iPad On Aug 5, 2016, at 4:03 PM, Christer Holmberg > wrote: Hi Dave, I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an "if"= :) But, if there will be an "if", 4424bis needs to describe how to correctly h= andle the different options and alternatives. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD05/=FD08/=FD2016 17:20 To: Christer Holmberg; Paul Kyzivat<= mailto:pkyzivat@alum.mit.edu> Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Christer, On 8/4/2016 11:45 PM, Christer Holmberg wrote: > > The receiver needs to be able to parse JSON if the sender includes the > claims, in order to verify the signature. Alternatives and options make specifications more complex and often introduce potential non-determinacies. So the 'if' that you cite is not a small matter. In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it. > Also, whatever headers we include, I assume the receiver should be able > to parse them. > > But, parsing JSON is not a difficult thing to do, and there are > available libraries for those who don't want to implement the parser > themselves. Just to make sure this sub-thread retains its context: I did not comment on the choice of JSON/JWT in the actual review. It's not an irrational or horrible choice. But it does add overhead. It adds it to the effort needed to understand the specifications. And it adds it to the software. (It might also add it to the execution of the software, but I suspect that is, at worst, a negligible difference here.) One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do". In most cases where that sort of comment is offered, it is quite true. The problem is with incremental complexities. A not-difficult here; a not-difficult there... They really do mount up. By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie, pre-occurring -- relevance to the current work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_51D45AE567D24120BCA27BFC845E2126neustarbiz_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Briefly, there is and always has been a "bare minimum" set o= f headers and claims that are mandatory for PASSporT. Ultimately, the quest= ion of what headers and claims are mandatory in PASSporT is a stir-passport= question. SIP as a using protocol of PASSporT defines only which fields in a SIP request will populate those mandatory c= omponents of a PASSporT object, and that information is given in considerab= le detail in RFC 4474bis today. 

Extensions may propose additional claims that will appear in PASSporT = objects. The extensibility model of PASSporT is similarly a matter for the = PASSporT spec rather than RFC 4474bis, though we anticipate that extensions= may want to specify some initial using protocol behavior as well. We should have a few examples of that soo= n. 

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Aug 5, 2016, at 4:03 PM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi Dave,

I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an &quo= t;if" :)

But, if there will be an "if", 4424bis needs to describe how to c= orrectly handle the different options and alternatives.

Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD05= /=FD08/=FD2016 17:20
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
Christer,


On 8/4/2016 11:45 PM, Christer Holmberg wrote:
>
> The receiver needs to be able to parse JSON if the sender includes the=
> claims, in order to verify the signature.

Alternatives and options make specifications more complex and often
introduce potential non-determinacies.  So the 'if' that you cite is n= ot
a small matter.

In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it.


> Also, whatever headers we include, I assume the receiver should be abl= e
> to parse them.
>
> But, parsing JSON is not a difficult thing to do, and there are
> available libraries for those who don't want to implement the parser > themselves.

Just to make sure this sub-thread retains its context:  I did not
comment on the choice of JSON/JWT in the actual review.  It's not an <= br> irrational or horrible choice.

But it does add overhead.  It adds it to the effort needed to understa= nd
the specifications.  And it adds it to the software.  (It might a= lso add
it to the execution of the software, but I suspect that is, at worst, a negligible difference here.)

One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do".  In most cases where that = sort of
comment is offered, it is quite true.  The problem is with incremental=
complexities.  A not-difficult here; a not-difficult there... They really do mount up.

By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie,
pre-occurring -- relevance to the current work.

d/
--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_51D45AE567D24120BCA27BFC845E2126neustarbiz_-- From nobody Sun Aug 7 04:10:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 717EE12D08F for ; Sun, 7 Aug 2016 04:10:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hSLh2nw_x9B3 for ; Sun, 7 Aug 2016 04:10:05 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6107E12B027 for ; Sun, 7 Aug 2016 04:10:03 -0700 (PDT) X-AuditID: c1b4fb30-abfff700000009f9-19-57a71709fbfa Received: from ESESSHC004.ericsson.se (Unknown_Domain [153.88.183.30]) by (Symantec Mail Security) with SMTP id FD.40.02553.90717A75; Sun, 7 Aug 2016 13:10:02 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.233]) by ESESSHC004.ericsson.se ([153.88.183.30]) with mapi id 14.03.0301.000; Sun, 7 Aug 2016 13:10:00 +0200 From: Christer Holmberg To: "Peterson, Jon" Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR71RqNDyuE1zws0qpi74VpghCbqA8FdqAgAFD+DQ= Date: Sun, 7 Aug 2016 11:10:00 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BBB7359@ESESSMB208.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se>, <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net>, <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se>, <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> In-Reply-To: <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BBB7359ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprNIsWRmVeSWpSXmKPExsUyM2K7nC6X+PJwg1mnmC1+f/rAZnGmwdJi xYYDrBbL125jcmDx+Pv+A5PHpZ0n2TyWLPnJ5LGj4TlzAEsUl01Kak5mWWqRvl0CV8bSBy9Y C5YmVtw/bdrA+DCoi5GTQ0LAROLXg5tMXYxcHEIC6xkl3rX+Y4ZwFjNK3Jo5DSjDwcEmYCHR /U8bpEFEQE/i2/cZTCA2s0CJxPxdp1lAbGGBQImm3jZGiJogidcH/7JD2FYSv+afZAaxWQRU JOZ1HQOL8wr4SjS+PQq1+DarxLqzz8GGcgrYS5ztuw02lFFATOL7qTVQy8Qlmr6sZIW4WkBi yZ7zzBC2qMTLx/9YIWryJd72/2WEWCAocXLmE5YJjMKzkLTPQlI2C0kZRNxA4sv721C2tsSy ha+ZIWx9ie73p5mQxRcwsq9iFC1OLU7KTTcy0kstykwuLs7P08tLLdnECIyyg1t+G+xgfPnc 8RCjAAejEg+vwrRl4UKsiWXFlbmHGCU4mJVEeO+JLg8X4k1JrKxKLcqPLyrNSS0+xCjNwaIk zuv/UjFcSCA9sSQ1OzW1ILUIJsvEwSnVwJhcZrVmF+/qI68kHZyn231/ZefwXKLC4BOjyJRa Tv/PKstWiDwrvpCV57r2ZWDdw2P7K/LfClSfmL96e/XEb2wRuk9F761zz+PUmjBDtOXKipSw ZexKi9fGW6423t1VVTp55T3FXSd8ayVkAuofF6yc8JbZjm2Zptx6nmWla4SK1hubLvyu81CJ pTgj0VCLuag4EQD0sQAIrgIAAA== Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Aug 2016 11:10:07 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BBB7359ESESSMB208erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi Jon, My point is that (as you also wrote) how PASSporT is used with SIP is cover= ed in 4424bis. Whether the current text is sufficient enough or not is a se= parate discussion, not related to draft-passport. Regards, Christer Sent from my Windows Phone ________________________________ From: Peterson, Jon Sent: =FD06/=FD08/=FD2016 20:50 To: Christer Holmberg Cc: dcrocker@bbiw.net; Paul Kyzivat; stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Briefly, there is and always has been a "bare minimum" set of headers and c= laims that are mandatory for PASSporT. Ultimately, the question of what hea= ders and claims are mandatory in PASSporT is a stir-passport question. SIP = as a using protocol of PASSporT defines only which fields in a SIP request = will populate those mandatory components of a PASSporT object, and that inf= ormation is given in considerable detail in RFC 4474bis today. Extensions may propose additional claims that will appear in PASSporT objec= ts. The extensibility model of PASSporT is similarly a matter for the PASSp= orT spec rather than RFC 4474bis, though we anticipate that extensions may = want to specify some initial using protocol behavior as well. We should hav= e a few examples of that soon. Jon Peterson Neustar, Inc. Sent from my iPad On Aug 5, 2016, at 4:03 PM, Christer Holmberg > wrote: Hi Dave, I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an "if"= :) But, if there will be an "if", 4424bis needs to describe how to correctly h= andle the different options and alternatives. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD05/=FD08/=FD2016 17:20 To: Christer Holmberg; Paul Kyzivat<= mailto:pkyzivat@alum.mit.edu> Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Christer, On 8/4/2016 11:45 PM, Christer Holmberg wrote: > > The receiver needs to be able to parse JSON if the sender includes the > claims, in order to verify the signature. Alternatives and options make specifications more complex and often introduce potential non-determinacies. So the 'if' that you cite is not a small matter. In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it. > Also, whatever headers we include, I assume the receiver should be able > to parse them. > > But, parsing JSON is not a difficult thing to do, and there are > available libraries for those who don't want to implement the parser > themselves. Just to make sure this sub-thread retains its context: I did not comment on the choice of JSON/JWT in the actual review. It's not an irrational or horrible choice. But it does add overhead. It adds it to the effort needed to understand the specifications. And it adds it to the software. (It might also add it to the execution of the software, but I suspect that is, at worst, a negligible difference here.) One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do". In most cases where that sort of comment is offered, it is quite true. The problem is with incremental complexities. A not-difficult here; a not-difficult there... They really do mount up. By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie, pre-occurring -- relevance to the current work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_7594FB04B1934943A5C02806D1A2204B4BBB7359ESESSMB208erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi Jon,

My point is that (as you also wrote) how PASSporT is used with SIP is cover= ed in 4424bis. Whether the current text is sufficient enough or not is a se= parate discussion, not related to draft-passport.

Regards,

Christer

Sent from my Windows Phone
From: Peterson, Jon
Sent: =FD06= /=FD08/=FD2016 20:50
To: Christer Holmberg Cc: dcrocker@bbiw.net; Paul Kyzivat; stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
Briefly, there is and always has been a "bare minimum" set o= f headers and claims that are mandatory for PASSporT. Ultimately, the quest= ion of what headers and claims are mandatory in PASSporT is a stir-passport= question. SIP as a using protocol of PASSporT defines only which fields in a SIP request will populate those mandatory c= omponents of a PASSporT object, and that information is given in considerab= le detail in RFC 4474bis today. 

Extensions may propose additional claims that will appear in PASSporT = objects. The extensibility model of PASSporT is similarly a matter for the = PASSporT spec rather than RFC 4474bis, though we anticipate that extensions= may want to specify some initial using protocol behavior as well. We should have a few examples of that soo= n. 

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Aug 5, 2016, at 4:03 PM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi Dave,

I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an &quo= t;if" :)

But, if there will be an "if", 4424bis needs to describe how to c= orrectly handle the different options and alternatives.

Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD05= /=FD08/=FD2016 17:20
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [= stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)
Christer,


On 8/4/2016 11:45 PM, Christer Holmberg wrote:
>
> The receiver needs to be able to parse JSON if the sender includes the=
> claims, in order to verify the signature.

Alternatives and options make specifications more complex and often
introduce potential non-determinacies.  So the 'if' that you cite is n= ot
a small matter.

In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it.


> Also, whatever headers we include, I assume the receiver should be abl= e
> to parse them.
>
> But, parsing JSON is not a difficult thing to do, and there are
> available libraries for those who don't want to implement the parser > themselves.

Just to make sure this sub-thread retains its context:  I did not
comment on the choice of JSON/JWT in the actual review.  It's not an <= br> irrational or horrible choice.

But it does add overhead.  It adds it to the effort needed to understa= nd
the specifications.  And it adds it to the software.  (It might a= lso add
it to the execution of the software, but I suspect that is, at worst, a negligible difference here.)

One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do".  In most cases where that = sort of
comment is offered, it is quite true.  The problem is with incremental=
complexities.  A not-difficult here; a not-difficult there... They really do mount up.

By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie,
pre-occurring -- relevance to the current work.

d/
--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_7594FB04B1934943A5C02806D1A2204B4BBB7359ESESSMB208erics_-- From nobody Sun Aug 7 09:51:16 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3903C12B006 for ; Sun, 7 Aug 2016 09:51:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WTTcufRHnccL for ; Sun, 7 Aug 2016 09:51:09 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id E3D1B12B013 for ; Sun, 7 Aug 2016 09:51:08 -0700 (PDT) Received: (qmail 18332 invoked by uid 0); 7 Aug 2016 16:51:02 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy4.mail.unifiedlayer.com with SMTP; 7 Aug 2016 16:51:02 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id UGlw1t00f1MNPNq01GlzT5; Sun, 07 Aug 2016 10:46:01 -0600 X-Authority-Analysis: v=2.1 cv=KaJB72oD c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=fGh7L_e3oJcA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=0FD05c-RAAAA:8 a=hGBaWAWWAAAA:8 a=k7Ga1wGzAAAA:8 a=CN5uK3bRT0i0LWX1e10A:9 a=IVI4u2FyGK6UHZbX:21 a=IIjnzYgihLIJpOUH:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=b8OvNEjoAAAA:8 a=UNg5tVRWmCBYOAOt:21 a=EzRislfDozDjlHmX:21 a=Xnni5VY6iXKcIObK:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=NWVoK91CQySWRX1oVYDe:22 a=oEv2QzVjxXEItEogYapJ:22 a=NumKjXolQHiPR4xHErVj:22 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=l1rpMCqCXRGZwUSuRcM3:22 a=Q-ofuW86YyylptHqTH-7:22 a=ijMaxGghyylP-n2pFjDB:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 a=xfJ8-ueq0pyqlCF7aVox:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date; bh=WjBx56CcI6w4zjUeJVhu/fy4ERKAdRaVcI+47gt7wFs=; b=nL2a b77nNVcgadBZsoCFuIgncU6w1rqc1rgPuyoOh/9wnoNE8X3GxNspDuwtLQh5sEj+Lt88tceWSamzV SzBzVEyXF5dbPERPZe66dmdwruCnvMUR+wHC9F7AiiTMNIv; Received: from [100.36.21.178] (port=59008 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bWRD4-00032G-F6; Sun, 07 Aug 2016 10:45:58 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sun, 07 Aug 2016 12:45:58 -0400 From: Richard Shockey To: Christer Holmberg , "Peterson, Jon" Message-ID: <925FA026-4821-4A9B-822F-EAA2A5851AF2@shockey.us> Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <7594FB04B1934943A5C02806D1A2204B4BBB7359@ESESSMB208.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BBB7359@ESESSMB208.ericsson.se> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3553418758_749855961" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.21.178 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.21.178 X-Exim-ID: 1bWRD4-00032G-F6 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.21.178]:59008 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Aug 2016 16:51:12 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3553418758_749855961 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 Did someone mention examples?=20 =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 =20 =20 From: stir on behalf of Christer Holmberg Date: Sunday, August 7, 2016 at 7:10 AM To: "Peterson, Jon" Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) =20 Hi Jon, My point is that (as you also wrote) how PASSporT is used with SIP is cover= ed in 4424bis. Whether the current text is sufficient enough or not is a sep= arate discussion, not related to draft-passport. Regards, Christer Sent from my Windows Phone From: Peterson, Jon Sent: =E2=80=8E06/=E2=80=8E08/=E2=80=8E2016 20:50 To: Christer Holmberg Cc: dcrocker@bbiw.net; Paul Kyzivat; stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Briefly, there is and always has been a "bare minimum" set of headers and c= laims that are mandatory for PASSporT. Ultimately, the question of what head= ers and claims are mandatory in PASSporT is a stir-passport question. SIP as= a using protocol of PASSporT defines only which fields in a SIP request wil= l populate those mandatory components of a PASSporT object, and that informa= tion is given in considerable detail in RFC 4474bis today.=20 =20 Extensions may propose additional claims that will appear in PASSporT objec= ts. The extensibility model of PASSporT is similarly a matter for the PASSpo= rT spec rather than RFC 4474bis, though we anticipate that extensions may wa= nt to specify some initial using protocol behavior as well. We should have a= few examples of that soon.=20 =20 Jon Peterson Neustar, Inc. Sent from my iPad On Aug 5, 2016, at 4:03 PM, Christer Holmberg wrote: Hi Dave, I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, o= ptional or forbidden) - so we don't yet know whether there will be an "if" := ) But, if there will be an "if", 4424bis needs to describe how to correctly h= andle the different options and alternatives. Regards, Christer Sent from my Windows Phone From: Dave Crocker Sent: =E2=80=8E05/=E2=80=8E08/=E2=80=8E2016 17:20 To: Christer Holmberg; Paul Kyzivat Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Christer, On 8/4/2016 11:45 PM, Christer Holmberg wrote: > > The receiver needs to be able to parse JSON if the sender includes the > claims, in order to verify the signature. Alternatives and options make specifications more complex and often=20 introduce potential non-determinacies. So the 'if' that you cite is not=20 a small matter. In practical terms, the 'if' means that verifiers must be able to parse=20 json as well as encode it. > Also, whatever headers we include, I assume the receiver should be able > to parse them. > > But, parsing JSON is not a difficult thing to do, and there are > available libraries for those who don't want to implement the parser > themselves. Just to make sure this sub-thread retains its context: I did not=20 comment on the choice of JSON/JWT in the actual review. It's not an=20 irrational or horrible choice. But it does add overhead. It adds it to the effort needed to understand=20 the specifications. And it adds it to the software. (It might also add=20 it to the execution of the software, but I suspect that is, at worst, a=20 negligible difference here.) One of the more deceptive parts of writing standards is the seduction of=20 "is not a difficult thing to do". In most cases where that sort of=20 comment is offered, it is quite true. The problem is with incremental=20 complexities. A not-difficult here; a not-difficult there... They=20 really do mount up. By way of example, having to send the reader off to become proficient in=20 two additional specifications is not a small increment in developmental=20 overhead, especially when those specification have no natural -- ie,=20 pre-occurring -- relevance to the current work. d/ --=20 Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir=20 --B_3553418758_749855961 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Did someone mention examples?

 

— <= /span>

Richard Shockey

<= p class=3DMsoNormal>Shockey Consulting LLC

Chairman o= f the Board SIP Forum

www.shockey.us

www.sipforum.org

<= /div>

richard<at>shockey.us

=

Skype-Linkedin-Facebook rshockey101

PSTN +1 703-593-2683

 =

 

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg= <christer.holmberg@ericsson.com>
Date: Sunday, August 7, 20= 16 at 7:10 AM
To: "Peterson, Jon" <jon.peterson@neust= ar.biz>
Cc: "stir@ietf.org" <stir@ietf.org>, &q= uot;dcrocker@bbiw.net" <dcrocker@bbiw.net>, Paul Kyzivat <pkyz= ivat@alum.mit.edu>
Subject: Re: [stir] JWT/JSON (was - Re: Revi= ew of: draft-ietf-stir-passport-05)

 

Hi Jon,

My point = is that (as you also wrote) how PASSporT is used with SIP is covered in 4424= bis. Whether the current text is sufficient enough or not is a separate disc= ussion, not related to draft-passport.

Regards,

Christer
Sent from my Windows Phone

From: Peterson, Jon
Sent: = =E2=80=8E06/=E2=80=8E08/=E2=80=8E2016 20:50
To: Christer Holmberg
Cc: dcrocker@bbiw.net; Pau= l Kyzivat; stir@ietf.org
Subject: Re: [stir] JWT/JSON (was - Re= : Review of: draft-ietf-stir-passport-05)

Briefly, there is and always has been a "bare min= imum" set of headers and claims that are mandatory for PASSporT. Ultima= tely, the question of what headers and claims are mandatory in PASSporT is a= stir-passport question. SIP as a using protocol of PASSporT defines only wh= ich fields in a SIP request will populate those mandatory components of a PA= SSporT object, and that information is given in considerable detail in RFC 4= 474bis today. 

 <= /o:p>

Extensions may propose additional cla= ims that will appear in PASSporT objects. The extensibility model of PASSpor= T is similarly a matter for the PASSporT spec rather than RFC 4474bis, thoug= h we anticipate that extensions may want to specify some initial using proto= col behavior as well. We should have a few examples of that soon. =

 

Jon Peterson

Neustar, Inc.

Sent from my iPad


On Aug 5, 2016, at 4:03 PM, Christer Holmberg <= christer.holmberg@ericsson.c= om> wrote:

Hi Dave,

I don't know whether the WG= has yet decided whether there will be options and alternatives (i.e. whethe= r sending of claims/headers will be mandatory, optional or forbidden) - so w= e don't yet know whether there will be an "if" :)

But, if t= here will be an "if", 4424bis needs to describe how to correctly h= andle the different options and alternatives.

Regards,

Christe= r

Sent from my Windows Phone

= From: Dave Crocker
Sent: =E2=80= =8E05/=E2=80=8E08/=E2=80=8E2016 17:20
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org<= /a>
Subject:= Re: [stir] JW= T/JSON (was - Re: Review of: draft-ietf-stir-passport-05)<= /p>

Christ= er,


On 8/4/2016 11:45 PM, Christer Holmberg wrote:
>
>= ; The receiver needs to be able to parse JSON if the sender includes the
= > claims, in order to verify the signature.

Alternatives and optio= ns make specifications more complex and often
introduce potential non-de= terminacies.  So the 'if' that you cite is not
a small matter.
<= br>In practical terms, the 'if' means that verifiers must be able to parse <= br>json as well as encode it.


> Also, whatever headers we incl= ude, I assume the receiver should be able
> to parse them.
>
= > But, parsing JSON is not a difficult thing to do, and there are
>= available libraries for those who don't want to implement the parser
>= ; themselves.

Just to make sure this sub-thread retains its context:&= nbsp; I did not
comment on the choice of JSON/JWT in the actual review.&= nbsp; It's not an
irrational or horrible choice.

But it does add = overhead.  It adds it to the effort needed to understand
the specif= ications.  And it adds it to the software.  (It might also add it to the execution of the software, but I suspect that is, at worst, a negligible difference here.)

One of the more deceptive parts of writ= ing standards is the seduction of
"is not a difficult thing to do&q= uot;.  In most cases where that sort of
comment is offered, it is q= uite true.  The problem is with incremental
complexities.  A n= ot-difficult here; a not-difficult there... They
really do mount up.
=
By way of example, having to send the reader off to become proficient in=
two additional specifications is not a small increment in developmental=
overhead, especially when those specification have no natural -- ie, pre-occurring -- relevance to the current work.

d/
--

&n= bsp;  Dave Crocker
   Brandenburg InternetWorking
 = ;  bbiw.net

_______________________________________________
sti= r mailing list
stir@ietf.org
https://www.ietf.org/mailman/= listinfo/stir

_______________________________________________ stir mailing lis= t stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--B_3553418758_749855961-- From nobody Sun Aug 7 10:13:04 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2482E12B035 for ; Sun, 7 Aug 2016 10:13:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.7 X-Spam-Level: X-Spam-Status: No, score=-102.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NCgUb1_tzbNk for ; Sun, 7 Aug 2016 10:13:01 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0F9F12B025 for ; Sun, 7 Aug 2016 10:13:01 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u77HCsbe025174; Sun, 7 Aug 2016 13:12:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=vZucEkNDZFaP55a/HCxo+W4n/+yNRVjKNgQiBzDHxxc=; b=LdLol1B2qSe4Wptn8hLYtLc30zcFPPhiBJ/CYeq/WTOWZgGnnGtXdbv19jcqAg1qX1ld xDarW8rwXa0FRyvUJIXgLbS3DN/drZXh2T/W+NZKoHzvrhx7+okK98cT4Ao+8XUtxxUA ZJFMnOp67KzE8LfvrTv7XiCUE3B6kUGeACFf6hpUGNrXmiW+J1xuYckeQycJUVmphwu7 /OfJNv6w15aCSQXjsctKLewNDHpEUNX/3QMRaVNjLA3QC4Jvp8f01BnGVSm4waVF1/sn qJFkmtk+B35R1yyXVmVA1Wsj9SMpG5ftk1ZpNrQsrlOFPbl8gQXdc7qprlK4XGoKtS8v 9Q== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24nc0q22xv-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Sun, 07 Aug 2016 13:12:54 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Sun, 7 Aug 2016 13:12:49 -0400 From: "Peterson, Jon" To: Richard Shockey Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR8MvjRSkOyUzTfUSd+olrWCsp2aA9vEFM Date: Sun, 7 Aug 2016 17:12:48 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <7594FB04B1934943A5C02806D1A2204B4BBB7359@ESESSMB208.ericsson.se>, <925FA026-4821-4A9B-822F-EAA2A5851AF2@shockey.us> In-Reply-To: <925FA026-4821-4A9B-822F-EAA2A5851AF2@shockey.us> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_A1787AEC18A448228847B634774F4FABneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-07_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608070204 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat , Christer Holmberg Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Aug 2016 17:13:04 -0000 --_000_A1787AEC18A448228847B634774F4FABneustarbiz_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable :) Jon Peterson Neustar, Inc. Sent from my iPad On Aug 7, 2016, at 11:51 AM, Richard Shockey > wrote: Did someone mention examples? =97 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 From: stir > on behalf = of Christer Holmberg > Date: Sunday, August 7, 2016 at 7:10 AM To: "Peterson, Jon" > Cc: "stir@ietf.org" >, "dcrocker@bbiw.net" >, Paul Kyzivat > Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Hi Jon, My point is that (as you also wrote) how PASSporT is used with SIP is cover= ed in 4424bis. Whether the current text is sufficient enough or not is a se= parate discussion, not related to draft-passport. Regards, Christer Sent from my Windows Phone ________________________________ From: Peterson, Jon Sent: =FD06/=FD08/=FD2016 20:50 To: Christer Holmberg Cc: dcrocker@bbiw.net; Paul Kyzivat; stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Briefly, there is and always has been a "bare minimum" set of headers and c= laims that are mandatory for PASSporT. Ultimately, the question of what hea= ders and claims are mandatory in PASSporT is a stir-passport question. SIP = as a using protocol of PASSporT defines only which fields in a SIP request = will populate those mandatory components of a PASSporT object, and that inf= ormation is given in considerable detail in RFC 4474bis today. Extensions may propose additional claims that will appear in PASSporT objec= ts. The extensibility model of PASSporT is similarly a matter for the PASSp= orT spec rather than RFC 4474bis, though we anticipate that extensions may = want to specify some initial using protocol behavior as well. We should hav= e a few examples of that soon. Jon Peterson Neustar, Inc. Sent from my iPad On Aug 5, 2016, at 4:03 PM, Christer Holmberg > wrote: Hi Dave, I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an "if"= :) But, if there will be an "if", 4424bis needs to describe how to correctly h= andle the different options and alternatives. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD05/=FD08/=FD2016 17:20 To: Christer Holmberg; Paul Kyzivat<= mailto:pkyzivat@alum.mit.edu> Cc: stir@ietf.org Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport= -05) Christer, On 8/4/2016 11:45 PM, Christer Holmberg wrote: > > The receiver needs to be able to parse JSON if the sender includes the > claims, in order to verify the signature. Alternatives and options make specifications more complex and often introduce potential non-determinacies. So the 'if' that you cite is not a small matter. In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it. > Also, whatever headers we include, I assume the receiver should be able > to parse them. > > But, parsing JSON is not a difficult thing to do, and there are > available libraries for those who don't want to implement the parser > themselves. Just to make sure this sub-thread retains its context: I did not comment on the choice of JSON/JWT in the actual review. It's not an irrational or horrible choice. But it does add overhead. It adds it to the effort needed to understand the specifications. And it adds it to the software. (It might also add it to the execution of the software, but I suspect that is, at worst, a negligible difference here.) One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do". In most cases where that sort of comment is offered, it is quite true. The problem is with incremental complexities. A not-difficult here; a not-difficult there... They really do mount up. By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie, pre-occurring -- relevance to the current work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir --_000_A1787AEC18A448228847B634774F4FABneustarbiz_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
:)

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Aug 7, 2016, at 11:51 AM, Richard Shockey <richard@shockey.us> wrote:

 

Did someone mention examples?

 

=97 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

richard<at>shockey.us<= o:p>

Skype-Linkedin-Facebook rshockey101

PSTN +1 703-593-2683

 

 

F= rom: stir <stir-bounces@ietf.org> on behalf of Chris= ter Holmberg <christer= .holmberg@ericsson.com>
Date: Sunday, August 7, 2016 at 7:10 AM
To: "Peterson, Jon" <jon.peterson@neustar.biz>
Cc: "stir@ietf.org" &= lt;stir@ietf.org>, "dcrocker@bbiw.net" <dcrocker@bbiw.net>, Paul Kyzivat <pkyzivat@alum.mit.edu>
Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-p= assport-05)

 

Hi Jon,

My point is that (as you also wrote) how PASSporT is used with SIP is cover= ed in 4424bis. Whether the current text is sufficient enough or not is a se= parate discussion, not related to draft-passport.

Regards,

Christer

Sent from my Windows Phone

From: Peterson, Jon
Sent: =FD06/=FD08/=FD2016 20:5= 0
To: Christer Holmberg
Cc: dcrocker@bbiw.net; Paul Kyzivat; stir@ietf.org
Subject: Re: [stir] JWT/JSON (= was - Re: Review of: draft-ietf-stir-passport-05)

Briefly, there is and always has been a "bare m= inimum" set of headers and claims that are mandatory for PASSporT. Ult= imately, the question of what headers and claims are mandatory in PASSporT = is a stir-passport question. SIP as a using protocol of PASSporT defines only which fields in a SIP request will popul= ate those mandatory components of a PASSporT object, and that information i= s given in considerable detail in RFC 4474bis today. 

 

Extensions may propose additional claims that will a= ppear in PASSporT objects. The extensibility model of PASSporT is similarly= a matter for the PASSporT spec rather than RFC 4474bis, though we anticipa= te that extensions may want to specify some initial using protocol behavior as well. We should have a few example= s of that soon. 

 

Jon Peterson

Neustar, Inc.

Sent from my iPad


On Aug 5, 2016, at 4:03 PM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:=

Hi Dave,

I don't know whether the WG has yet decided whether there will be options a= nd alternatives (i.e. whether sending of claims/headers will be mandatory, = optional or forbidden) - so we don't yet know whether there will be an &quo= t;if" :)

But, if there will be an "if", 4424bis needs to describe how to c= orrectly handle the different options and alternatives.

Regards,

Christer

Sent from my Windows Phone

From: Dave Crocker
Sent: =FD05/=FD08/=FD2016 17:2= 0
To: Christer Holmberg; Paul Kyzivat
Cc: stir@ietf.org
Subject: Re: [stir] JWT/JSON (= was - Re: Review of: draft-ietf-stir-passport-05)

Christer,


On 8/4/2016 11:45 PM, Christer Holmberg wrote:
>
> The receiver needs to be able to parse JSON if the sender includes the=
> claims, in order to verify the signature.

Alternatives and options make specifications more complex and often
introduce potential non-determinacies.  So the 'if' that you cite is n= ot
a small matter.

In practical terms, the 'if' means that verifiers must be able to parse json as well as encode it.


> Also, whatever headers we include, I assume the receiver should be abl= e
> to parse them.
>
> But, parsing JSON is not a difficult thing to do, and there are
> available libraries for those who don't want to implement the parser > themselves.

Just to make sure this sub-thread retains its context:  I did not
comment on the choice of JSON/JWT in the actual review.  It's not an <= br> irrational or horrible choice.

But it does add overhead.  It adds it to the effort needed to understa= nd
the specifications.  And it adds it to the software.  (It might a= lso add
it to the execution of the software, but I suspect that is, at worst, a negligible difference here.)

One of the more deceptive parts of writing standards is the seduction of "is not a difficult thing to do".  In most cases where that = sort of
comment is offered, it is quite true.  The problem is with incremental=
complexities.  A not-difficult here; a not-difficult there... They really do mount up.

By way of example, having to send the reader off to become proficient in two additional specifications is not a small increment in developmental overhead, especially when those specification have no natural -- ie,
pre-occurring -- relevance to the current work.

d/
--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org= /mailman/listinfo/stir

_______________________________________________ stir= mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--_000_A1787AEC18A448228847B634774F4FABneustarbiz_-- From nobody Mon Aug 8 06:52:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A77D712D5D8 for ; Mon, 8 Aug 2016 06:52:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FjbYAvoPLXxm for ; Mon, 8 Aug 2016 06:52:33 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0111.outbound.protection.outlook.com [104.47.37.111]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8509C12D81B for ; Mon, 8 Aug 2016 06:52:33 -0700 (PDT) Received: from BN1AFFO11FD056.protection.gbl (10.58.52.31) by BN1AFFO11HUB013.protection.gbl (10.58.52.123) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Mon, 8 Aug 2016 13:52:31 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.82) smtp.mailfrom=sprint.com; shockey.us; dkim=none (message not signed) header.d=none;shockey.us; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.82 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.82; helo=preapdm3.corp.sprint.com; Received: from preapdm3.corp.sprint.com (144.230.32.82) by BN1AFFO11FD056.mail.protection.outlook.com (10.58.53.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Mon, 8 Aug 2016 13:52:32 +0000 Received: from pps.filterd (preapdm3.corp.sprint.com [127.0.0.1]) by preapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u78DpJwD024678; Mon, 8 Aug 2016 09:52:31 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm3.corp.sprint.com with ESMTP id 24na561bwb-4 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 08 Aug 2016 09:52:31 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 8 Aug 2016 08:52:29 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 8 Aug 2016 08:52:29 -0500 From: "Gorman, Pierce A [CTO]" To: "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA/FoDw Date: Mon, 8 Aug 2016 13:52:29 +0000 Message-ID: <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu>, <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.40] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.82; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(252514010)(13464003)(199003)(24454002)(377454003)(189002)(8936002)(4326007)(110136002)(92566002)(15975445007)(11100500001)(97756001)(2900100001)(19580405001)(2950100001)(106466001)(102836003)(19580395003)(5890100001)(81166006)(8746002)(6116002)(81156014)(3846002)(47776003)(23726003)(68736007)(5250100002)(189998001)(8676002)(87936001)(33646002)(97736004)(93886004)(86362001)(586003)(76176999)(7696003)(50986999)(54356999)(7736002)(325944008)(7846002)(106116001)(305945005)(108616004)(24736003)(356003)(46406003)(50466002)(2906002)(8666005)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB013; H:preapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD056; 1:/rRlo4HM8QWfkVF0PtBwclg/UctfVLCT14u89vR2XWw0BoOI6HrAazCdaXCGOAtFLwllrfmOdOmPc77Xr6il+HaxWTYoSNuAxEuor6eOKX8QM885FZz8jZM27Vee8Q6NtE4l0bBHvqYFRyKqr6zmwrs2xNX7bTMeVlkKwGszqGLbKsYDrY7uWzaNC2fE+vXms2WFAAbp3sjSEi7Xipnc9EKrKbLDhTdWXfqxFNG6vW1xjUnxO9t0Toq9tPyjctL2AiHdaY7cVQyCb7h4X3I5+rmjh+ve5UquwwNsok7x9ULLLcSGoSPLsyoM5k+JaW1/JGBM6vXaef7aFujY23GjWTehmspbHA+ZYzP09QiowPsnx0D4DUTRlAoq1IpfOY/cglh6anqA1m4/kIf3aUfDTyZxi/wTtLqN0VvM38HAphxo3+ggWkxb8d5Wstg039QIYVU7/G13zCyrwRq2+FUzprOKTSpLzLBTY6bDipPfoVnJGXVFM3xXkm8/kBp1sS9jAGWAP2bRUdC8h5Rno2l5o2EnAiQwq3hwpxUnl202b+4jYKQblLncb5tiWP/yCgAWVmk3aOESMJSzGN2tNv9bBw== X-MS-Office365-Filtering-Correlation-Id: 986dee55-8490-441b-bcb6-08d3bf933ea8 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB013; 2:F5HYQu2ymm+aJJpE6YKlIrhbFBdJCcKnFYpwz2jiDj7MSPE02sYIgLt6O7QAlJhFgIX8RECUf3s+fwU3Huxj5XbqhNXQLP8QjHs9PS22tb8rBXYjW9z8BiAsmbpshgnx5s2JTvs2s1iqLJM9W5VjCio1uWDyIV6L278GXn6PWsgXbTE+HyTuvvuwTOrLT8Ch; 3:TVZnnwgVBqlATusEjvw/lBg4NTX55h9wzB7ScLYXxJ6/ogLlOpWCIeUb2wMTE8u+VZGxgYo0RbQiKDq/GKCePB3lrP0DFGnbN0hUTomNTobDmRv4rc1gX4djXfvbbY5uL1YgBJLPmKxQecR/c0/ti64JMy2X3y2JkTSbLDjh8Pg25wYw0LsJr1qk2Z2KlPeZFyIKl6KTyMWzYU7wVwALp4MM6uTMVz7s+NSVkndU1+xlM+c3pyM1crps/xP5KTiZx/dYWmneJ/Fn6wjOgiilqg==; 25:zlEdoWpUaA+z6LBKbyRGGtXVXYKX6XF2NvlIYuO/JkY0LDHAerYxxF1zF6sgjncNTCyaEHUBfh5ekqeV+UwzPKp5Czi2inZTg6fW7msNAEQO3W5efrxf0Kb5oEyAwFNh7dyv33bcSLxl0UlIJrOhfzZvIowb1YaR7M/5pArniqiSI9jK6yNxowNRGgwpT50kjo1sNdONh8b2vmwEwdjymiv2ReZoHaF7G5bTf+ewaGUqPMyTL+6k7Y+bk645N0dlqoqlmNIjg6TTGQ76ES6ovidgL1paaRSj+99GUH1aQDUyTs3XKowj+QsZ2xzhBsVEIbz04cEi36+ltggwfv37BGzu0dAPwwghkFDXiUlIBZaAVMagshj+dfuZX8iSN6TaVzRHT4yhHA2OaJDpgCHkoqE+5PEyFImPlUr4nwGGF1BGEVDOwonilH9JJUb9zbTy X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB013; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB013; 31:Ur8pRxaI6k+JYbhD87ey3gGb3zBfsanrci0Ou39A2JGwAdO+r4fq666NdXHbAer2nS5No9jpKP64VfzmnsbIJs51K1eCdRiux6vecM+m2IhyB1KUNs1I1mzR3/kX8Jd9DA+eYH3fyCbphV+77djHedBd8Prsxc58l5bbytX2P3AwDqRSF0wy5uvLp6g5zbgJ3HVoHwoBqZFmd3fokKfG2UPror5SMp2NwsL9sGMZEA8=; 20:ulBxqRU5/FtAdcBpuCN18Qp9X80Jw21vDeYgmXFyv2N8uU62B/P69KU34lFRYuJ/hL6ECDHs7zyRjP3uecHWyPSw5uVozSBpt6qwmqJnCRF40g1EDzFkeetrg9dN/PyLlNLewhpHzak+r+iCpBq/HkV4bNaE8hFgzek7ApNJ1nmKYsZGfr8TfRdnkU77RpDWnoM55jKtDKPVyBptFkdC32M+u5CTtOsgeFmul07SVTXHc0jsT67BTzXJFdJN1KHJwVYstSwLLsZ9P4YDr8of5NmzYlssLIGRU+oKY5XQEcb3O5987RTTdO+YId9FT5w358ISESp06aZAF/aAnAaisoI3PFY4b3BXMHNBaaarKriMlgnkF8B0QkKjLT+EcAx4syvTOiER3v1jfsEPFOu20FEnEBDTzau0Z71oum8BM8U= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040157)(601004)(2401047)(13015025)(13017025)(13023025)(13024025)(8121501046)(5005006)(13018025)(3002001)(10201501046)(6055026); SRVR:BN1AFFO11HUB013; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB013; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB013; 4:pJ+L2Gfb9Sq05VGldNkNJQzijV1XCK3s5Y4PNOjIH3JMBeSZ2MvyOdw/B3asKtYQmDTjWxRWt8nGMktfB1UT8DpFUMjHQ6kyh7Jh7ewJQI/xfLGJd1hufC/7eZCYHPhA0TFdCJzLUGsmJjD4j+y9N5lorodLwAY7IyQIVtIEAJ2nyVST7jy6wc3JTWI6zfB+Ph7FxHHIh6V4RpSdQwCws7rCPhA3R291p5z+plspuykRqCYU7Zujjk5OJnj13373P32FxiuwvEtscxSptl0HZgNyTgNMcnPI/JOajnjl1eCHpPqg2SH8uFvDU3SW9pani8CR7zItWA/cBL+pjvi9OPc+1qYSpI2VNfNU+pj9jZKli9ai6+RirtgJpYbHeylwXoolugWo8mZqarKwkKpm0v15I0ODxTOKxif8QrhFYn3i+fE8SggK6o7nqoikjy+jEJKyOaTzqqTEXmkXg7dUDW46z29QGnE4vgRMimpq/DTMbFayHY+i8wEMxQ4VGc1PVQj7BLFbp49VnBADRocrGFrSKvAWFqTheojFElOZ1yRWrp64rvny1lKw9uHAUs0mkoKVr68nGmC6VarxDAYvoik2YlPRAiysJPeWSkv0wQMB8ThRdWZhaLoI9Y988fxxPAJaQr3b1qFAWSZD/Mz6uPjo7jLM1qCRuWraM2h+3G45KqSx4569egV+7moOZbHjqtF9b5kLJvd8cFrheObXrg== X-Forefront-PRVS: 00286C0CA6 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB013; 23:v80JGdvSL5ONA4ZJ+9w1AnAKC+a0ztoEf+IPWrH?= =?us-ascii?Q?++ut6J+mMDk9+hPJSauo03XBx4MUADGwmpyd6VrJJXb/7V9sNx3kKkPwrRxT?= =?us-ascii?Q?CWO5AzBFVOYduHU8cMFhXbtsH0gvhjPOtzb3ioD0GeYlQadhIyhJjCgXAGlo?= =?us-ascii?Q?RHhCLiLwbGRdeoJSxR1Mfkp7aU2gw1HlyGnS1TZ6pcnywjroQT3Gw0CfNqRh?= =?us-ascii?Q?MCs/mflCQVtOVCWVsJ4+1t4jHS9raRBKP+ugo0lXUe5I0sF3R8EM2scthekS?= =?us-ascii?Q?8aCGb/RpW46Za9f4SBh7fgtkrZy3CHc6vRWiDsxJdT1v5mFAWnaXKQIeIFpd?= =?us-ascii?Q?UbmYv1UZmY3XWCnm/LXGs4sxthxY5laCCwums/UskCXsrQ/bknRbnRjtMayg?= =?us-ascii?Q?wj62OvdwgRas+pGPuE/rGX3tFFSyvrJ0jSOwSEDB4r87mPl1BICJYWOj4Zxt?= =?us-ascii?Q?+HyUrbIKRIDu4Mhk6mUGpQBXYuUwczWvnpFEBA+kkWru0pLvk9hcc9yudoSJ?= =?us-ascii?Q?0G8oDmbieYtDysnsviluoWWlhJIP8V7JcyitSBfW0IFhXcIQVbJrPFvDfmYj?= =?us-ascii?Q?k8ZxSePxNAGL4FfMpbo/ipz8JEbDu3bFgcx1IWhnrUZBzhhrD5wFE1d6mvmo?= =?us-ascii?Q?w8asAEoPUUs1GlW1d1NKGNzeU37i2iGGoTeWM/9Er4otPQEBHyfz+UysJDqQ?= =?us-ascii?Q?ALUG+eueZUMa2+VDZAFRpcpqAF8m5tLFJ7BXK4+i7y+XJLsLO3zYyrz3Dzd5?= =?us-ascii?Q?z92TblZbk998mZNOmlxdsvFQ2dM57mgtJ7yqJvWjC6yeYHW8aih6rU2tCCqc?= =?us-ascii?Q?FDTVLUgFwSqLoIZm39sl7vqVDpprKswKmLU4boEMzes2rCH4/rUcwP11Nk2V?= =?us-ascii?Q?Y8xsSu91pAzZ1IKTg6a149KnmI+sNaiojA8+umJetlxoe5qV9RZ/jPr04YH/?= =?us-ascii?Q?tRoTG4Ov6YcEVr6/qKm/I1W9qZSROyuoTuJJJER7FcrgxVi0agZkZuNjnqnl?= =?us-ascii?Q?MlOtMugCZc/P82+KtbZv6wu8D39HJNG6+ybi/+ZvJ0E+ts4xQbF7PE5VP770?= =?us-ascii?Q?+T2teKi5jw0JhOyqKFBLvOEhU+geTkfPg3P9qD7avWzbIUrZkkuMeCugc1Qx?= =?us-ascii?Q?ReZstfyfd2O6iKgMfSflXZQkKXttVQ6aJ3LhuiRODljcB5D4lGrUZb42Kxt9?= =?us-ascii?Q?2IMwTpx4U2fn5DJwxhiXyGr535MNAwLkmu/uR/LUUpMkPfzmlXLhK9DbILXP?= =?us-ascii?Q?nPIalhjQCDIGA6uovTo46rvxAncYvzc3N8J7loOkqDdeqvs9BP7YkiyTgIT4?= =?us-ascii?Q?TlKq14G8P4eYjrRNuxTRcUf2jVE0wjPbX2rBd7l9vZUZxDmkBsHUIAf4RIxg?= =?us-ascii?Q?1b/4lrar2gXldy4KDLiI735HS3Izb3uU9w0LW8VRmN/u/qaHw?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB013; 6:ZamtDX+WxbsBDDq8PElDm9grCtSvbHsQ9mBHpig+RYMTtLI3O7CnY/o+JvMtjaYUNls45lobqmX6cLkIOuMGlADGZUfOar1z8DTGmyigrOCBozz22bonY3b7J4u4qHIt7y8B2piLUGMphJ7pGl7rqnXFlfij+cbf1iYA3+CTj/vHqoxu7tqv5eFy3Y7jVmkx5Q9TYWEPTRPrbMKcvehBKgImX6Wzct3lwgjy9j088gWCvbwRIP/oXi4Kpq1b3jvkJVRUiegjg91q26X1dqISS58a+cyuMw0EMXgm2nTTZu91y2BOR+XvkyXYzCvxggw5iCxIapc01q7B4A9PXGQELg==; 5:z4OTuTLYQPSNnldHpxtQu+iDr1JS6h/XE98Nup7Al2GR/MY9GIpTRmpkbllY23ccLq74GkwaTxTyT/sm+H84Ci7jfhRRPjG8VZ8yy8WDtRG0FaGjZ6lR2gholzcQmVkvj+smdCfMrlOLhAGz3jbHUg==; 24:QVdDnk01IsG2zJQdErNccTLG7ZTVKS9Z/NIClhjTVHgqUVfBoPMiaDuhxjX4/Y5f+vETFzSfJq6xMNwJb/f66frPrgMncGe70vIpj2zmhks=; 7:Z11bx9D+9N6f0Pvm6lYeTEVemrV5mYrvSy0xVrucXUUu4AVP7caVSTd8rOJrT8lExfzotmQRjIq/VxDrA3mDq3/Cdd7Jk/axqEHnbKOt8reoFTMtV/i919glJ2ywJgVNGtzg6AdeYvrbf+bPVvgpnTJbGl+B64wwmq3+MOWBPFRMIwMF3pwN/jZ7FjG4W6JN9ZLVQvvC2O+n+Pu83vtUeFYaDCf5y89z1jwMC2kP8uQqVH2D4LzULwAbQ4cV+8oQ SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2016 13:52:32.0935 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.82]; Helo=[preapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB013 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Richard Shockey , Paul Kyzivat , "stir@ietf.org" , Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 13:52:37 -0000 Martin, You referenced TS 29.195. I'm not familiar with that spec. Has it been de= precated? It's not showing up on the 3GPP site. I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the origina= ting side" Note 4 it states, " It is assumed that the IBCF is responsible f= or stripping the P-Asserted-Identity from the SIP header when interworking with untrusted networks." Your remark is consistent with Note 4, but only if we agree that, for insta= nce, the AT&T network and the Sprint network are "trusted networks". In re= ality, this is not the case or there would be no firewalls or Session Borde= r Controllers used for interworking and security. My opinion is the only c= arrier networks that are trusted are the SS7 network, and the Internet back= bone. What it really comes down to is that PAI is left in signaling either throug= h formal specification as a part of an inter-carrier inter-connection agree= ment, or by custom (or even by accident). I think this illustrates Paul Ro= sbotham's observation is true.=20 Pierce -----Original Message----- From: DOLLY, MARTIN C [mailto:md3135@att.com]=20 Sent: August 05, 2016 12:55 PM To: Gorman, Pierce A [CTO] Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Paul Kyzivat ; = Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments PAI is not stripped at the network boundary between trusted networks 3GPP T= S 29.195 Atis specs GSMA Atis sip forum task force ITU And the list goes on Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: >=20 > Which header the carrier chooses to display is moot if the header is stri= pped between carriers as per at least one standard. I think Paul Rosbotham= 's observation we're likely to encounter "some interesting interworking cha= llenges" was perhaps the understatement of the year. >=20 > Pierce >=20 > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 05, 2016 11:58 AM > To: Gorman, Pierce A [CTO] ; Richard Shockey=20 > ; Rosbotham, Paul, Vodafone UK=20 > ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > If PAI is present and signed, and From is also signed, I would expect it = to be up to the UA to decide what to display, not the carrier. >=20 > Of course this will work differently if there is a different signaling re= gime between the carrier and the user device (e.g. black phone). >=20 > Thanks, > Paul >=20 >> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" = and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-= Identity is stripped by border controller functions and is not to be used i= n inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. >>=20 >> Pierce >>=20 >>=20 >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul=20 >> Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>=20 >> Humm this is getting interesting. Its my understanding that the display= number aka "presentation number" in the US context is the one carried in t= he PAI. Martin, Pierce? >>=20 >>=20 >>=20 >>=20 >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>=20 >> Jumping in now that we're on European working time, +1 on Paul's obse= rvation. >>=20 >> Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. >>=20 >> Only the carrier has the authority to set the Network Number so only = they could sign it. >>=20 >> But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. >>=20 >> What I want is the ability for customers to use their credentials=20 >> to sign the CLIs they send me so that at the terminating end it can=20 >> be checked (or indeed somewhere en-route if that's the business model). >> I can and would sign for customers on my mobile business since I'm=20 >> driving what number is presented, but that's by-the-by because they=20 >> aren't the ones who generate millions of nuisance calls. If the=20 >> signing only occurs at the originating carrier level for=20 >> corporate/call-centre customers that's no use because I'm not in a=20 >> position to do that for these type of customers...and the whole=20 >> system becomes a waste of time. I'd also highlight there are many=20 >> more of my large customers that I'd trust more than a far end=20 >> originating carrier that could be anywhere in the world (though we=20 >> have no shortage of small carriers that I wouldn't know from Adam=20 >> more locally in the >> UK....) >>=20 >> Regards >>=20 >> Paul >>=20 >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>>=20 >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >>=20 >> IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. >>=20 >> Thanks, >> Paul >>=20 >>> Brian >>>=20 >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>>=20 >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline=20 >>>>> carrier to him. He then creates another credential, which he=20 >>>>> signs with his office phone credential that authorizes his mobile=20 >>>>> to send calls from his office number. He is spoofing (because the=20 >>>>> call is coming from his mobile's TN but claims to be from his=20 >>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>> credential to his mobile SP if they sign on his behalf. >>>>=20 >>>> I don't understand how that is different from regular delegation. >>>>=20 >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>>=20 >>>> Thanks, >>>> Paul >>>>=20 >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>>=20 >>>>> But that's how I describe it. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>>=20 >>>>>> +1, but with one question below: >>>>>>=20 >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation=20 >>>>>>> path, >>>>>>=20 >>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>> authorized spoofers. >>>>>>=20 >>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>=20 >>>>>> Thanks, >>>>>> Paul >>>>>>=20 >>>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>>> long as the delegator is willing to take the heat for delegating=20 >>>>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>> that you can pass the hot potato. >>>>>>>=20 >>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20 >>>>>>> any calls placed on its network on any number it has been delegated= . >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and=20 >>>>>>> that represents the hard part of deployment in my opinion. But=20 >>>>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>>=20 >>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>> informal delegation path for telephone numbers in every country,=20 >>>>>>> and we can build a chain of trust from that delegation path. If=20 >>>>>>> you propose to alter that model, then we get into (policy)=20 >>>>>>> issues of which carriers/entities we trust and which we don't. =20 >>>>>>> Our model is that you know who you delegate to, and once you do tha= t delegation, it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>>> business practices. >>>>>>>=20 >>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>>> and use cases. >>>>>>>>=20 >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>>=20 >>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>> relationships are two additional factors which affect=20 >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>=20 >>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>>>> that variability. >>>>>>>>=20 >>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>>=20 >>>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>>=20 >>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>> relationship with typical consumers adds to the trustworthiness=20 >>>>>>>> assessment and partially because carriers are a regulated point=20 >>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most=20 >>>>>>>> calls originate and terminate between mobile consumers where=20 >>>>>>>> their carriers are able to usefully authenticate their device=20 >>>>>>>> and have a high degree of confidence of the authenticity of the ca= lling number. >>>>>>>>=20 >>>>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>=20 >>>>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>>>> the calling party has to sign a call with a per-TN cert=20 >>>>>>>> provided by the called party. No called party cert to include? =20 >>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>> with the called party, and the call can be authorized/treated acco= rdingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>> deployed on devices and PBXs. Whether they will be is a policy is= sue. >>>>>>>>=20 >>>>>>>> The notion of credentials that are traceable to a delegation of=20 >>>>>>>> a TN is a mechanism that is part of the design of stir, and the=20 >>>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>> credential. For the use case we've discussed, a mobile phone=20 >>>>>>>> may also have a credential for, say, a TN that is delegated to=20 >>>>>>>> a landline, to cover the example case of a doctor placing a=20 >>>>>>>> call on his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] =20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy =20 >>>>>>>> discussion. Regardless, I do appreciate your explanation. I =20 >>>>>>>> would like to continue the discussion, but I'm pretty sure this =20 >>>>>>>> isn't the right forum. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20 >>>>>>>> and any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs =20 >>>>>>>> they are authorized to sign for. They can try to sign any=20 >>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>> signature fail the checking. >>>>>>>>=20 >>>>>>>> Getting service providers to sign on behalf of devices is a =20 >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20 >>>>>>>> want to get out of the liability of signing on behalf of their =20 >>>>>>>> customers. If they can push of that responsibility to their =20 >>>>>>>> customer, only being responsible for getting the customer an =20 >>>>>>>> appropriate credential when they assign TNs, then I would=20 >>>>>>>> expect them to want to do so. That means the devices have to=20 >>>>>>>> be able to sign, but I understand many of the PBX vendors=20 >>>>>>>> think that's something they could provide in a future release. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated numbe= rs? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> First of all, we would want the PBX to generate the signature= , >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>>=20 >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from a= n >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" device= s >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a singl= e >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>>=20 >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggeste= d >>>>>>>> below by Alex). >>>>>>>>=20 >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>>=20 >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>=20 >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>>=20 >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>>=20 >>>>>>>> *Public Use Case:* >>>>>>>>=20 >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> There are reasonable circumstances where a party placing = a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call ma= y >>>>>>>> or may not be the same as the service provider serving th= e >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes call= s >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where ther= e >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, a= t >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with thi= s >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-I= D >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may b= e >>>>>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Specific markup suggestions: >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> NITS >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>>=20 >>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>> present, then the >>>>>>>>=20 >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>>=20 >>>>>>>> present, and the verifier does not support it,=20 >>>>>>>> it MUST ignore the >>>>>>>>=20 >>>>>>>> Identity header. If a supported "ppt"=20 >>>>>>>> parameter value is present, >>>>>>>>=20 >>>>>>>> the verifier follows the procedures below,=20 >>>>>>>> including the variations >>>>>>>>=20 >>>>>>>> described in Step 5. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>>=20 >>>>>>>> [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as=20 >>>>>>>> robocalling, voicemail hacking, and >>>>>>>>=20 >>>>>>>> swatting are enabled by an attacker's ability=20 >>>>>>>> to impersonate someone >>>>>>>>=20 >>>>>>>> else. The secure operation of most SIP=20 >>>>>>>> applications and services >>>>>>>>=20 >>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>> the source of communications as it is >>>>>>>>=20 >>>>>>>> represented in a SIP request. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>> includes provisions for a logical >>>>>>>>=20 >>>>>>>> "authentication service" which validates caller=20 >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>>=20 >>>>>>>> authentication service may be implemented=20 >>>>>>>> either as part of a user >>>>>>>>=20 >>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>> component of a network >>>>>>>>=20 >>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>> user agents send >>>>>>>>=20 >>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>> message has been >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This document specifies a means of sharing a=20 >>>>>>>> cryptographic assurance >>>>>>>>=20 >>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>=20 >>>>>>>> It relies on the authentication service=20 >>>>>>>> constructing tokens based on [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>> typically obviously >>>>>>>>=20 >>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>> credentials; if they >>>>>>>>=20 >>>>>>>> do, their user agents can act as authentication=20 >>>>>>>> services. However, >>>>>>>>=20 >>>>>>>> for some deployments, [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Regards, >>>>>>>>=20 >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> --------------------------------------------------------------- >>>>>>>> -- >>>>>>>> ------- >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copie= s >>>>>>>> of the message. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >>=20 >>=20 >>=20 >> ________________________________ >>=20 >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 8 08:47:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FAA212D660 for ; Mon, 8 Aug 2016 08:47:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=verizon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lHRSqdMsfD_m for ; Mon, 8 Aug 2016 08:47:06 -0700 (PDT) Received: from omzsmtpe02.verizonbusiness.com (omzsmtpe02.verizonbusiness.com [199.249.25.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF1F412D611 for ; Mon, 8 Aug 2016 08:47:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1470671225; x=1502207225; h=from:to:cc:date:subject:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=kTN0bb95+LFUkIYMWg/bwYXYh9a5BQsy1B8Y8IpGa6A=; b=LC7TUpq9b9oksKIAaBh5hKXRXZlNmZ0aTfB93HDb+rZsuBqLjYJee2DE uGus35Kez3WtJcncqrhdS2ovvUNnFYfBxOx/9cXazs0dNiF1Sg/cB3TEk kUb6SekrAeoDBfGSTGnAmliYy3Wo1ncEcULApXM9/VH6lrj9vKQ8ciXvg M=; X-IronPort-Anti-Spam-Filtered: false Received: from omzsmtpi02.vzbi.com ([165.122.46.172]) by omzsmtpe02.verizonbusiness.com with ESMTP; 08 Aug 2016 15:47:04 +0000 From: "Dwight, Timothy M (Tim)" X-IronPort-AV: E=Sophos;i="5.28,490,1464652800"; d="scan'208";a="743642116" Received: from fhdp1lumxc7hb05.verizon.com (HELO FHDP1LUMXC7HB05.us.one.verizon.com) ([166.68.59.192]) by omzsmtpi02.vzbi.com with ESMTP; 08 Aug 2016 15:47:00 +0000 Received: from FHDP1LUMXC7V31.us.one.verizon.com ([166.68.125.32]) by FHDP1LUMXC7HB05.us.one.verizon.com ([166.68.59.192]) with mapi; Mon, 8 Aug 2016 11:47:00 -0400 To: "Gorman, Pierce A [CTO]" , "DOLLY, MARTIN C" Date: Mon, 8 Aug 2016 11:46:58 -0400 Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA/FoDwgAAi/SA= Message-ID: <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu>, <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> In-Reply-To: <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 15:47:13 -0000 Pierce, My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA IR.95= . The latter references and profiles the former. Section 4.4.1 of IR.95 r= ecommends that MNO-to-MNO or MNO-to-IPX interconnects be considered trusted= , and table 3 in that section recommends that P-Asserted-Identity (PAI) be = exchanged at a trusted interconnect. It also states that PAI is mandatory = at a roaming NNI. Tim -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce A [CT= O] Sent: Monday, August 08, 2016 8:52 AM To: DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; stir@ietf.= org; Brian Rosen Subject: [E] Re: [stir] STIR 4474bis-10 comments Martin, You referenced TS 29.195. I'm not familiar with that spec. Has it been de= precated? It's not showing up on the 3GPP site. I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the origina= ting side" Note 4 it states, " It is assumed that the IBCF is responsible f= or stripping the P-Asserted-Identity from the SIP header when interworking = with untrusted networks." Your remark is consistent with Note 4, but only if we agree that, for insta= nce, the AT&T network and the Sprint network are "trusted networks". In re= ality, this is not the case or there would be no firewalls or Session Borde= r Controllers used for interworking and security. My opinion is the only c= arrier networks that are trusted are the SS7 network, and the Internet back= bone. What it really comes down to is that PAI is left in signaling either throug= h formal specification as a part of an inter-carrier inter-connection agree= ment, or by custom (or even by accident). I think this illustrates Paul Ro= sbotham's observation is true. Pierce -----Original Message----- From: DOLLY, MARTIN C [mailto:md3135@att.com] Sent: August 05, 2016 12:55 PM To: Gorman, Pierce A [CTO] Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Paul Kyzivat ; = Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments PAI is not stripped at the network boundary between trusted networks 3GPP T= S 29.195 Atis specs GSMA Atis sip forum task force ITU And the list goes on Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: > > Which header the carrier chooses to display is moot if the header is stri= pped between carriers as per at least one standard. I think Paul Rosbotham= 's observation we're likely to encounter "some interesting interworking cha= llenges" was perhaps the understatement of the year. > > Pierce > > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 05, 2016 11:58 AM > To: Gorman, Pierce A [CTO] ; Richard Shockey > ; Rosbotham, Paul, Vodafone UK > ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > If PAI is present and signed, and From is also signed, I would expect it = to be up to the UA to decide what to display, not the carrier. > > Of course this will work differently if there is a different signaling re= gime between the carrier and the user device (e.g. black phone). > > Thanks, > Paul > >> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" = and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-= Identity is stripped by border controller functions and is not to be used i= n inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. >> >> Pierce >> >> >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul >> Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> >> Humm this is getting interesting. Its my understanding that the display= number aka "presentation number" in the US context is the one carried in t= he PAI. Martin, Pierce? >> >> >> >> >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >> >> Jumping in now that we're on European working time, +1 on Paul's obse= rvation. >> >> Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. >> >> Only the carrier has the authority to set the Network Number so only = they could sign it. >> >> But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. >> >> What I want is the ability for customers to use their credentials >> to sign the CLIs they send me so that at the terminating end it can >> be checked (or indeed somewhere en-route if that's the business model). >> I can and would sign for customers on my mobile business since I'm >> driving what number is presented, but that's by-the-by because they >> aren't the ones who generate millions of nuisance calls. If the >> signing only occurs at the originating carrier level for >> corporate/call-centre customers that's no use because I'm not in a >> position to do that for these type of customers...and the whole >> system becomes a waste of time. I'd also highlight there are many >> more of my large customers that I'd trust more than a far end >> originating carrier that could be anywhere in the world (though we >> have no shortage of small carriers that I wouldn't know from Adam >> more locally in the >> UK....) >> >> Regards >> >> Paul >> >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>> >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >> >> IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. >> >> Thanks, >> Paul >> >>> Brian >>> >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>> >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline >>>>> carrier to him. He then creates another credential, which he >>>>> signs with his office phone credential that authorizes his mobile >>>>> to send calls from his office number. He is spoofing (because the >>>>> call is coming from his mobile's TN but claims to be from his >>>>> office), but it's authorized spoofing. The doc could give the >>>>> credential to his mobile SP if they sign on his behalf. >>>> >>>> I don't understand how that is different from regular delegation. >>>> >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>> >>>>> But that's how I describe it. >>>>> >>>>> Brian >>>>> >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>> >>>>>> +1, but with one question below: >>>>>> >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation >>>>>>> path, >>>>>> >>>>>>> plus the option to add another level (not delegation) for >>>>>>> authorized spoofers. >>>>>> >>>>>> I don't understand "authorized spoofers" in this context, as >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> I don't think it matters who the delegator or delegatee are as >>>>>>> long as the delegator is willing to take the heat for delegating >>>>>>> to someone who sends a lot of bad calls. They can pass the buck >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but >>>>>>> only if the SP knows who they delegated to, so authorities can >>>>>>> follow the delegation path. There are plenty of certificated >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>> that you can pass the hot potato. >>>>>>> >>>>>>> It's perfectly reasonable for a carrier to be able to sign for >>>>>>> any calls placed on its network on any number it has been delegated= . >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and >>>>>>> that represents the hard part of deployment in my opinion. But >>>>>>> once they delegate, they can hand responsibility to sign to the >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>> >>>>>>> The root of the whole model is that there is a formal or >>>>>>> informal delegation path for telephone numbers in every country, >>>>>>> and we can build a chain of trust from that delegation path. If >>>>>>> you propose to alter that model, then we get into (policy) >>>>>>> issues of which carriers/entities we trust and which we don't. >>>>>>> Our model is that you know who you delegate to, and once you do tha= t delegation, it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some >>>>>>> business practices. >>>>>>> >>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>> >>>>>>> Brian >>>>>>> >>>>>>> >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> OK, you talked me into indulging in one more message on policy >>>>>>>> and use cases. >>>>>>>> >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>> >>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>> relationships are two additional factors which affect >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>> >>>>>>>> Inherent variable trustworthiness of a calling number was my >>>>>>>> reason for suggesting a way to qualify the signature to reflect >>>>>>>> that variability. >>>>>>>> >>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>> coming from a device assigned a single number, or from "trunk >>>>>>>> group" which could originate calls using multiple numbers, and >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>> >>>>>>>> My suggestion was qualifying calling number authenticity into >>>>>>>> categories of carrier-signed (or not), and unauthenticated, >>>>>>>> semi-authenticated, and most-authenticated. There can be more >>>>>>>> granularity, but it implies additional operational complexity >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>> >>>>>>>> My reason for adding the authenticity of the originating >>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>> relationship with typical consumers adds to the trustworthiness >>>>>>>> assessment and partially because carriers are a regulated point >>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most >>>>>>>> calls originate and terminate between mobile consumers where >>>>>>>> their carriers are able to usefully authenticate their device >>>>>>>> and have a high degree of confidence of the authenticity of the ca= lling number. >>>>>>>> >>>>>>>> I think billions of per-TN certs of varying usability (revoked, >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>> >>>>>>>> Conversely, I think billions of per-TN certs will work well, if >>>>>>>> the calling party has to sign a call with a per-TN cert >>>>>>>> provided by the called party. No called party cert to include? >>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>> with the called party, and the call can be authorized/treated acco= rdingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>> deployed on devices and PBXs. Whether they will be is a policy is= sue. >>>>>>>> >>>>>>>> The notion of credentials that are traceable to a delegation of >>>>>>>> a TN is a mechanism that is part of the design of stir, and the >>>>>>>> design allows delegation of one TN (to one device, although a >>>>>>>> device like a PBX would have more than one TN per "device", and >>>>>>>> something like a dual NAM phone could have more than one >>>>>>>> credential. For the use case we've discussed, a mobile phone >>>>>>>> may also have a credential for, say, a TN that is delegated to >>>>>>>> a landline, to cover the example case of a doctor placing a >>>>>>>> call on his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>>> isn't the right forum. >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones >>>>>>>> and any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs >>>>>>>> they are authorized to sign for. They can try to sign any >>>>>>>> call, but the validity of the credential would make such a >>>>>>>> signature fail the checking. >>>>>>>> >>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will >>>>>>>> want to get out of the liability of signing on behalf of their >>>>>>>> customers. If they can push of that responsibility to their >>>>>>>> customer, only being responsible for getting the customer an >>>>>>>> appropriate credential when they assign TNs, then I would >>>>>>>> expect them to want to do so. That means the devices have to >>>>>>>> be able to sign, but I understand many of the PBX vendors >>>>>>>> think that's something they could provide in a future release. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated numbe= rs? >>>>>>>> >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> First of all, we would want the PBX to generate the signature= , >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>> >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>> >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from a= n >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" device= s >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a singl= e >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>> >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggeste= d >>>>>>>> below by Alex). >>>>>>>> >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>> >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>> >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>> >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>> >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>> >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>> >>>>>>>> *Public Use Case:* >>>>>>>> >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> There are reasonable circumstances where a party placing = a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call ma= y >>>>>>>> or may not be the same as the service provider serving th= e >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes call= s >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where ther= e >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, a= t >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>> >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>> >>>>>>>> >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with thi= s >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-I= D >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may b= e >>>>>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>> >>>>>>>> >>>>>>>> Specific markup suggestions: >>>>>>>> >>>>>>>> >>>>>>>> NITS >>>>>>>> >>>>>>>> >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>> >>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>> present, then the >>>>>>>> >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>> >>>>>>>> present, and the verifier does not support it, >>>>>>>> it MUST ignore the >>>>>>>> >>>>>>>> Identity header. If a supported "ppt" >>>>>>>> parameter value is present, >>>>>>>> >>>>>>>> the verifier follows the procedures below, >>>>>>>> including the variations >>>>>>>> >>>>>>>> described in Step 5. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>> >>>>>>>> [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as >>>>>>>> robocalling, voicemail hacking, and >>>>>>>> >>>>>>>> swatting are enabled by an attacker's ability >>>>>>>> to impersonate someone >>>>>>>> >>>>>>>> else. The secure operation of most SIP >>>>>>>> applications and services >>>>>>>> >>>>>>>> depends on authenticating and/or authorizing >>>>>>>> the source of communications as it is >>>>>>>> >>>>>>>> represented in a SIP request. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This identity architecture for SIP depends on >>>>>>>> includes provisions for a logical >>>>>>>> >>>>>>>> "authentication service" which validates caller >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>> >>>>>>>> authentication service may be implemented >>>>>>>> either as part of a user >>>>>>>> >>>>>>>> agent or as a proxy server; typically, it is a >>>>>>>> component of a network >>>>>>>> >>>>>>>> intermediary like a proxy to which originating >>>>>>>> user agents send >>>>>>>> >>>>>>>> unsigned requests. Once the sender of the >>>>>>>> message has been >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This document specifies a means of sharing a >>>>>>>> cryptographic assurance >>>>>>>> >>>>>>>> of authenticity of and/or authorization to use >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>> >>>>>>>> It relies on the authentication service >>>>>>>> constructing tokens based on [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> To maximize end-to-end security, it is >>>>>>>> typically obviously >>>>>>>> >>>>>>>> preferable for end-users to acquire their own >>>>>>>> credentials; if they >>>>>>>> >>>>>>>> do, their user agents can act as authentication >>>>>>>> services. However, >>>>>>>> >>>>>>>> for some deployments, [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Regards, >>>>>>>> >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> --------------------------------------------------------------- >>>>>>>> -- >>>>>>>> ------- >>>>>>>> >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copie= s >>>>>>>> of the message. >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> >> >> >> >> ________________________________ >> >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 8 09:11:47 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A484E12D131 for ; Mon, 8 Aug 2016 09:11:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NG8qnkKmOijd for ; Mon, 8 Aug 2016 09:11:36 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0129.outbound.protection.outlook.com [104.47.33.129]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D595712B01B for ; Mon, 8 Aug 2016 09:11:35 -0700 (PDT) Received: from BY2FFO11FD041.protection.gbl (10.1.14.33) by BY2FFO11HUB032.protection.gbl (10.1.14.177) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.5; Mon, 8 Aug 2016 16:11:33 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; brianrosen.net; dkim=none (message not signed) header.d=none;brianrosen.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BY2FFO11FD041.mail.protection.outlook.com (10.1.14.226) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Mon, 8 Aug 2016 16:11:32 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u78G9XZq033012; Mon, 8 Aug 2016 12:11:32 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24n8wtajcu-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 08 Aug 2016 12:11:32 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 8 Aug 2016 11:11:30 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 8 Aug 2016 11:11:30 -0500 From: "Gorman, Pierce A [CTO]" To: "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA/FoDwgAAi/SCAAAN8MA== Date: Mon, 8 Aug 2016 16:11:29 +0000 Message-ID: <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu>, <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> In-Reply-To: <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.40] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(43784003)(199003)(377454003)(252514010)(13464003)(189002)(24454002)(51914003)(19580405001)(46406003)(2950100001)(92566002)(2900100001)(108616004)(19580395003)(356003)(11100500001)(97736004)(189998001)(8676002)(47776003)(2906002)(5001770100001)(5890100001)(81156014)(15975445007)(4326007)(33646002)(8746002)(5250100002)(76176999)(54356999)(81166006)(50466002)(586003)(68736007)(93886004)(24736003)(50986999)(86362001)(102836003)(87936001)(325944008)(7846002)(7736002)(8666005)(6116002)(7696003)(106466001)(23726003)(97756001)(3846002)(8936002)(106116001)(305945005)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB032; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11FD041; 1:0HDnwHA4CZGdwGOixpSljgVpT9Tkgek8VW3T8wCfCbtxN9CmTzNqZ+VWbdZTF0rVJ1GZYC1ICLAZwIux+W1KTX4TBNJAmFZwjsvdfKMHUCk0oHLXwG7/hWJah0f0X71gPcYBhhtDOIcTbi8p//1Q2+Tn66H9fmeSXSpFwSS7XZ2xFSdyd/H4UEiAjGLK66LA5/uh61W6zkkNKl13jo5YztaFv+UVgk8eaOX9xa5q2Vlj+v19ex/f53SvsQ6cz+IBUBRboi6Ok+K2mL8ZltYyUZf1GNycPnHhQT0dfYDnxI7rCES02++ByA9L1mMOP26b8GedKXuDHQhPsCb3sAt0NfNu8Oow05cNlYMxk5diPau+tIrZFs3ocdY0TLJA+nBU9usH8ocFwnhbINB6Lf9s+uUbWQd8YXSz7wp1L3QGE8caq0zepYUdViiY9LGWc//ha1JUhLm9TKAuOOwh3lCBTFd6rsqzV6wG7Om3uJNDNIXrxFQw/7rbAtaxrFFBfH0XgTAXABfgXt5hE6mZDJTRejaeFxNhJst+gbP5og3SxBpepIaIEPYYO/RslPWU1QthzkNW8KAkbMVnAf8r3PmPrQ== X-MS-Office365-Filtering-Correlation-Id: 9f8de98f-838f-43c0-2572-08d3bfa6aa42 X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB032; 2:re8P4N1Pmq2g3vA6LF+M3otK62+EhNdwfTd+r7k671F6KsQ9QX/dZCqC2JzZJPD6AvIK0DeuP9mXfSE9ruxbYknd71jPsuMSN53n0ut8Uln26WdjTGJG9iqGoBs6frpIFkTuXW6JnIsQAa1nuyWkPsDClg+TgSBtyMbKJt7mbDRhfQ8G7dppn1CBSxll0GR8; 3:WAuYBnZRC/1X86ReayQsHpSJCDdW4qs+09HjjjayfxZ6M8EtzsDfEaqaXeFWD85dtcd2g7l5I/iKzx4hloFjBLmv+Xaz4Nh/RwubL2Vst0yvb2CKo3Kz+yHU/aujO2oT44GMPR40dT+EFbV3RULx7cu8y/f5i+CHiVxiLc/vnFyn97c84x1GW9q92Vhjsbz+Qo+Ba8x8lzAlsDieckMdwWy/o6j9T0qnwKpzbNiCpAMcONSTDhVghjU6/Xmgv2U+ar4Q9vUk9wl/WbUOUETfeg==; 25:oxqP8r8rsC6Ng2XcSi0siiyxIz1jj4OtgoOfp/AkcwRlUufLrlf0w0YhWxUJhYtfvomYXJRbVFxHcEG10vpLn0U3PGFS05Ljm9M9iiNBGj7ckyHscv8kACrM49MEHj3MSzjhGYoexMkDTFbPO4G1taWxWPuAvOL9rU18qR0iGv7/tcwu/+2+y57lRl7WIgnLaqbXju5ll3dfAaBegVl91Hw61jqTFf/pBLVMKQbQhXODZpzr+1nUh8QxULsRwD4aYvs2mopwcp4A8Nmei3JV52rxSQPahZt8O192FP7IItYXfmpidx25MjJ1kcb0xCwMWvctkkEcg2eF91WYq78qWkeLHRB4iugZfNwqreaORC+GCcSiAFgVRni80AQritE2X7MNb0wlYH2Xmaz2RnB5faYR8M8djCpC9mJSrX3ND4iMuBbsuLjhxCVWAe4jOfuO X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BY2FFO11HUB032; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB032; 31:u4rzAep7Hj4b8CC36pCdMgfGgV5PhkJZXcmOuAZS2pFYpeCoNcaKVv6G/mLo4p0DyqoWNnska7hkL5Hd2bcmynVlNPRXypE/2z4U8ImbXsPG46G4vrPpaBj+Ze06hQ8jbkyYt4T4839B10wHJz0Ty5AfEayHs5J1sRT9+gSrx4emzlk6S6xSXaNM5Q5zgnCC+DYG1wqIKRfmtMv7QTABbalypwLqBRT+i0yMDP+aY/M=; 20:fp7fbAaOoGLsNJ7Y8KyOVCMWV9MC5ypqTCvwaR7bvLrt6dx3z/72ri5tJbBYnazzXE2F6i6vf2Jk+jU7G/r13Pvd8k2fZOmswGo6Pa5RbGNkExFa52TGVRmfvhxxaF+/XT0G9jADliSU3h/n1npemhZ5O/2ROIm7HZGq9Bi2AX5Enks1Gcx5pzxMD9Q6MvqWwbmAG4A/IX7GvWfGzybjnWjGzB8Pr+sxzAtqAGvbhjXs5L2PUVYUSmGOtYkfBRr8g6s1VO5Rhgh/KJ74ZaG1vaZAFC39hFIcOMbg9smtrx1C6ZMxHzC4tTh9iZMWfjCxS1U7F85D0pGr1jx8NrHuLJSPFOMmAY2VqaAKzF9dW1d96t9r93Ola8jwhZ06I8+WRRfjIJneic5B4wybcVCu/8M8OT/WbFIL63ly6e80cvI= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040157)(601004)(2401047)(13024025)(13023025)(13018025)(13017025)(13015025)(8121501046)(5005006)(3002001)(10201501046)(6055026); SRVR:BY2FFO11HUB032; BCL:0; PCL:0; RULEID:; SRVR:BY2FFO11HUB032; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB032; 4:7Hcbm2Q2vznHmJjQmp19MUELNuxp+WW7WRZdMSQyvi+IJQXmET4/kC2BSoVsSGLGwVA6LKfUuDFFShBnNM7RNVKs/JcZBokDteQY2DjXuoeHyrQA2PTG2jmlZhSha6k2sETT/E2KxY1JMabmryYDnonDWKlH0TyWI6RYmMeXq2KnaB16Aa5+L1crFsDvlYJxRpsPL5w6mTOUbHDt+d+ugIyrs+fY/nYxlDLlghaQ0XYi+AiMUcX1DIlgI7xf8IAwZtSs6kU/VJTjRzUKkWzcsKntRSeiTeW46iszd6peL4oFc6D2Eq9PA32XGGmajzdVFrKnIdLMHQTtnYqLawAxthEElG/1liPI4dYNTN41kCLJM7UB9Z1/pr/j+uZdvnQ31gdDlPLoZoPqVC+hnJrXlTBnFAf1Lvkz1Oo50egUHdR9CXdyi8Ki3F98zQ5osH84M+EYBft77wHiu9t1Ks30O8342baVkjBqRL8VFpnWo2efSQrwhCZ9mIlxU1M68QsGrqzoC0hGVc5cD8Pi52BA9uSWPE84ftXjYS8+A4lbs5/MuYIBV/GP09WXyOvxS42A9yX6iGUfxwVT1zvPrD62LRCmS1VL/PN0kO71r4ijyBecYyY3g2iwwp8ecLfesHt5m6etc+/+L+bftxb6kmuFgnquj1q1enHqNXtWdetRb4QeeXB4hHAFUgS4s3SdiSNd4A8JBhaNUIr2yzed0SmxGcZZyeCr7Msg6xrA0pZboGk= X-Forefront-PRVS: 00286C0CA6 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2FFO11HUB032; 23:AGk/124tpbTqEYS/CGL/HcZE/YlMSACyWSld1kld?= =?us-ascii?Q?tR0lJbCdzBE1vTLZCBYpAbzJYswQd9mykFkj/PyQC/sRG6c5j+Ytrw3h4RMG?= =?us-ascii?Q?fyAv3Iq2DAc4DLI+ObmM7kRr6+AY4wcyFOeBfmodQb320qOWM605nWKPp1w6?= =?us-ascii?Q?jqxWKVQjBDvvOxXeXikBjTRMOf4y7LA+lM793S6qogNlX3EK/vTM8Xwe6cLJ?= =?us-ascii?Q?5tH+eiDC5lOdRbVspuRRhZT6g+C/qyZ2KivXfwsbVUvoI69bvAGJLnzZcneN?= =?us-ascii?Q?w14UoQHPArl+57UzbCiMKHW5efBpTIb4IAveybyre1TO4et+OTQJ50TO5KPb?= =?us-ascii?Q?LKSR/E+OgwnoVBacLV6nz1xuRoGl0T6F+oWMCYAAK4cGw8vz9WXXA36MJuRu?= =?us-ascii?Q?InfJf4XFgly7r9O8KoutpFXnbEUwpqlE9DjnpFfJn4FPwtsJSxIe/yFt4ZYJ?= =?us-ascii?Q?AjWjKdLuUArdPh9scLGGnw+cT8Ff0Gx5cukfBMhCB5na499sLGtBHxBKvxbE?= =?us-ascii?Q?Aij4K5/AE6Do5ivaDUKaHbg2wW/tkVrAKH27gCAn/ZbVr+KbQel6z3SS2FJv?= =?us-ascii?Q?9Lpdd/qF5XIbXXggaPDNjTP6mzxpmg+4qQZ9fWREd7VeBOD2c44JYPF9tdV5?= =?us-ascii?Q?zA3jjKMK+6yhOAcO8dYVIwBjOFpkzv7GiTJ2KXOwGBXVXphSQDyJYoY7cuOH?= =?us-ascii?Q?APk1O2ah7OzEZTe7cOFUfUR6HUdBQ66X/EFuqZm3yd/wsQRtSqcCeOfwWaby?= =?us-ascii?Q?4vflb1Nes5t1c4N1v9KzluE4Rwepl14pAek7+nwv1GjAVHXhu8oY//Mh4361?= =?us-ascii?Q?Cyug33fIoWrO5ykuZ4CsqTtlLFC/JRUcLeRB0AqnOjX1RXcPc+UcdOAOxuNG?= =?us-ascii?Q?nGzXwgI1NMKaQKciZCF0doxoYMxnOeCDBv4BpInqRkHBBN7KGEdRji0hfPlQ?= =?us-ascii?Q?mA3UpXj6rVyWexg/3KB3OWegl1v72Vf/qnH+uOWOI3HWtADI9NdemzxhnbhC?= =?us-ascii?Q?Rywsjndn6b7RM2TrMvRmzF8qSaGMolILyZe1xZbjQ7NgmYSiYXlGTC5mdeMr?= =?us-ascii?Q?3PSPjqvDCEllM/6IrgBkhPDV7DMunz5dLkL+r6vVGWpCY0QtXoiJW13F3RUC?= =?us-ascii?Q?FMKVqyTjdYthQjDmKLeGJivb9zcj15l2RQjZ3MvZjtAYnw1+bsj2JBXprAvG?= =?us-ascii?Q?T3cEisIvcNdOg/yWYPmqNDcZciuJ27yENshVpVCj0JGAA2ajpB45Ao38obTQ?= =?us-ascii?Q?u/0DRpZrxtpNuQDxB5ov3N4qgs9FJ4Qiek3UeFEe6AwedKmaFok1/gihVW6Z?= =?us-ascii?Q?lCtN7i7eVh5P400SVJcqlexb6AlGZ8WjWFbQDDZSqcwbxKXohnVVzfWaXVVv?= =?us-ascii?Q?isUpZuznHiJPlYUUYVu3w4ccRDa3UJPLpBJXPPUcAF1LRzbBm+c9x0bBWGNv?= =?us-ascii?Q?Mh176S+xda4F0se7Q3eQCffgx4qMyxyHfE7ITlpXGeWbiwUy6eQb?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB032; 6:8X0+7pHATgkmxo4B3LNvt2vuD/AkDxNkCKUJtYDfvJrBF1/7uf63q56kVd6B3zGhKPNsTC4UJR7WkkZ+mMvERdsGZIT4hw0N38UVADGYbMeRQXJgkcaAzm09jvZ7aRxbCLCl6pRud81ws9y5lFrcqYyqAywuMbgMqwlMdt5tpU0ED2lpTXYTu1GI+W8clO86ooeSANYnVLRhJd3urQ1wxugTUMvzUaQEN5ljQ9exZY5PS8SRx/NIUGSVwCHU1OeaktQ564j91wNrgGPswF4hAoZULn22lQSjHXx3SqgZRfErANvhS8dxt5q+Zk4p5qzFK8ZdT/qYBJyu4HTpnaFq7w==; 5:S8QBQTb8zJ5lhH6ihPPlPOcljIG908QO/geoseR7lteswqcUKwLLk6i97fGGaKTgk+XoH4yo0N3FRcqkF9OprTXN6WbkX9UjWhI48br5bgeG7+XbWOjqz7ocAs5WGE5lP2XTx0cmHB7cS2twwUHUAw==; 24:lkCm8mxUmCL+RKEdrIkxOAyOxS99aa/Lu3Nd/JoPp+ihcbmU/jeYTVKR2Jr5il7jAAD0HO/9vZcnJ2RbX8wU9KK7MrljUg/YFahWsUTvypU=; 7:kzsZuI02eFm0N8M0o1Wmjq+yMEsikGjrKq6OWBtl8o3t1HAzcrgYtheM0q1LnmYa1uQ1oo3shcsgla/ZMQRFp9wqpFBqdO+OXXie0AOvILmJgOU328QzuA0QW8jrftCrszrxKxJoPT2at1FJrWksx/WnyWmu5gjhGcQGyFe99fm+2kSs9YXjSQIVI10SQI2xgFYrpC3jqX94NemNvdtZAWnVVCzp56cI+a2dY5BPWNt3+pbe/UGsqp4dVR2eQDvt SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2016 16:11:32.8813 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2FFO11HUB032 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 16:11:40 -0000 Thanks for the added comments Tim. I agree that passing P-Asserted-Identity between trusted networks is approp= riate (and the converse is true as well). Part of my issue is I have been = conditioned from the very earliest implementation of Sprint's VoIP network = that other carriers' IP networks are inherently untrusted. I've been brows= ing TS 29.165 and even there I find language that implies trust is establis= hed by agreement, not by standard. (Even roaming implies agreement.) Regardless, this discussion has been helpful and educational (to me at leas= t). And, I confirmed with my operations counterpart we generally send PAI = today. I've also made note that where standards and ICA require it, we wil= l include PAI. Thanks again. Best regards, Pierce=20 -----Original Message----- From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com]=20 Sent: August 08, 2016 10:47 AM To: Gorman, Pierce A [CTO] ; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Richard Sho= ckey ; Paul Kyzivat ; stir@ietf.= org; Brian Rosen Subject: RE: [stir] STIR 4474bis-10 comments Pierce, My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA IR.95= . The latter references and profiles the former. Section 4.4.1 of IR.95 r= ecommends that MNO-to-MNO or MNO-to-IPX interconnects be considered trusted= , and table 3 in that section recommends that P-Asserted-Identity (PAI) be = exchanged at a trusted interconnect. It also states that PAI is mandatory = at a roaming NNI. Tim -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce A [CT= O] Sent: Monday, August 08, 2016 8:52 AM To: DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; stir@ietf.= org; Brian Rosen Subject: [E] Re: [stir] STIR 4474bis-10 comments Martin, You referenced TS 29.195. I'm not familiar with that spec. Has it been de= precated? It's not showing up on the 3GPP site. I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the origina= ting side" Note 4 it states, " It is assumed that the IBCF is responsible f= or stripping the P-Asserted-Identity from the SIP header when interworking = with untrusted networks." Your remark is consistent with Note 4, but only if we agree that, for insta= nce, the AT&T network and the Sprint network are "trusted networks". In re= ality, this is not the case or there would be no firewalls or Session Borde= r Controllers used for interworking and security. My opinion is the only c= arrier networks that are trusted are the SS7 network, and the Internet back= bone. What it really comes down to is that PAI is left in signaling either throug= h formal specification as a part of an inter-carrier inter-connection agree= ment, or by custom (or even by accident). I think this illustrates Paul Ro= sbotham's observation is true. Pierce -----Original Message----- From: DOLLY, MARTIN C [mailto:md3135@att.com] Sent: August 05, 2016 12:55 PM To: Gorman, Pierce A [CTO] Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Paul Kyzivat ; = Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments PAI is not stripped at the network boundary between trusted networks 3GPP T= S 29.195 Atis specs GSMA Atis sip forum task force ITU And the list goes on Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: > > Which header the carrier chooses to display is moot if the header is stri= pped between carriers as per at least one standard. I think Paul Rosbotham= 's observation we're likely to encounter "some interesting interworking cha= llenges" was perhaps the understatement of the year. > > Pierce > > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 05, 2016 11:58 AM > To: Gorman, Pierce A [CTO] ; Richard Shockey=20 > ; Rosbotham, Paul, Vodafone UK=20 > ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > If PAI is present and signed, and From is also signed, I would expect it = to be up to the UA to decide what to display, not the carrier. > > Of course this will work differently if there is a different signaling re= gime between the carrier and the user device (e.g. black phone). > > Thanks, > Paul > >> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" = and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-= Identity is stripped by border controller functions and is not to be used i= n inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. >> >> Pierce >> >> >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul=20 >> Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> >> Humm this is getting interesting. Its my understanding that the display= number aka "presentation number" in the US context is the one carried in t= he PAI. Martin, Pierce? >> >> >> >> >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >> >> Jumping in now that we're on European working time, +1 on Paul's obse= rvation. >> >> Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. >> >> Only the carrier has the authority to set the Network Number so only = they could sign it. >> >> But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. >> >> What I want is the ability for customers to use their credentials=20 >> to sign the CLIs they send me so that at the terminating end it can=20 >> be checked (or indeed somewhere en-route if that's the business model). >> I can and would sign for customers on my mobile business since I'm=20 >> driving what number is presented, but that's by-the-by because they=20 >> aren't the ones who generate millions of nuisance calls. If the=20 >> signing only occurs at the originating carrier level for=20 >> corporate/call-centre customers that's no use because I'm not in a=20 >> position to do that for these type of customers...and the whole=20 >> system becomes a waste of time. I'd also highlight there are many=20 >> more of my large customers that I'd trust more than a far end=20 >> originating carrier that could be anywhere in the world (though we=20 >> have no shortage of small carriers that I wouldn't know from Adam=20 >> more locally in the >> UK....) >> >> Regards >> >> Paul >> >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>> >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >> >> IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. >> >> Thanks, >> Paul >> >>> Brian >>> >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>> >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline=20 >>>>> carrier to him. He then creates another credential, which he=20 >>>>> signs with his office phone credential that authorizes his mobile=20 >>>>> to send calls from his office number. He is spoofing (because the=20 >>>>> call is coming from his mobile's TN but claims to be from his=20 >>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>> credential to his mobile SP if they sign on his behalf. >>>> >>>> I don't understand how that is different from regular delegation. >>>> >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>> >>>>> But that's how I describe it. >>>>> >>>>> Brian >>>>> >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>> >>>>>> +1, but with one question below: >>>>>> >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation=20 >>>>>>> path, >>>>>> >>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>> authorized spoofers. >>>>>> >>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>>> long as the delegator is willing to take the heat for delegating=20 >>>>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>> that you can pass the hot potato. >>>>>>> >>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20 >>>>>>> any calls placed on its network on any number it has been delegated= . >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and=20 >>>>>>> that represents the hard part of deployment in my opinion. But=20 >>>>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>> >>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>> informal delegation path for telephone numbers in every country,=20 >>>>>>> and we can build a chain of trust from that delegation path. If=20 >>>>>>> you propose to alter that model, then we get into (policy)=20 >>>>>>> issues of which carriers/entities we trust and which we don't. >>>>>>> Our model is that you know who you delegate to, and once you do tha= t delegation, it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>>> business practices. >>>>>>> >>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>> >>>>>>> Brian >>>>>>> >>>>>>> >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>>> and use cases. >>>>>>>> >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>> >>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>> relationships are two additional factors which affect=20 >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>> >>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>>>> that variability. >>>>>>>> >>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>> >>>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>> >>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>> relationship with typical consumers adds to the trustworthiness=20 >>>>>>>> assessment and partially because carriers are a regulated point=20 >>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most=20 >>>>>>>> calls originate and terminate between mobile consumers where=20 >>>>>>>> their carriers are able to usefully authenticate their device=20 >>>>>>>> and have a high degree of confidence of the authenticity of the ca= lling number. >>>>>>>> >>>>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>> >>>>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>>>> the calling party has to sign a call with a per-TN cert=20 >>>>>>>> provided by the called party. No called party cert to include? >>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>> with the called party, and the call can be authorized/treated acco= rdingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>> deployed on devices and PBXs. Whether they will be is a policy is= sue. >>>>>>>> >>>>>>>> The notion of credentials that are traceable to a delegation of=20 >>>>>>>> a TN is a mechanism that is part of the design of stir, and the=20 >>>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>> credential. For the use case we've discussed, a mobile phone=20 >>>>>>>> may also have a credential for, say, a TN that is delegated to=20 >>>>>>>> a landline, to cover the example case of a doctor placing a=20 >>>>>>>> call on his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy=20 >>>>>>>> discussion. Regardless, I do appreciate your explanation. I=20 >>>>>>>> would like to continue the discussion, but I'm pretty sure this=20 >>>>>>>> isn't the right forum. >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20 >>>>>>>> and any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs=20 >>>>>>>> they are authorized to sign for. They can try to sign any=20 >>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>> signature fail the checking. >>>>>>>> >>>>>>>> Getting service providers to sign on behalf of devices is a=20 >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20 >>>>>>>> want to get out of the liability of signing on behalf of their=20 >>>>>>>> customers. If they can push of that responsibility to their=20 >>>>>>>> customer, only being responsible for getting the customer an=20 >>>>>>>> appropriate credential when they assign TNs, then I would=20 >>>>>>>> expect them to want to do so. That means the devices have to=20 >>>>>>>> be able to sign, but I understand many of the PBX vendors=20 >>>>>>>> think that's something they could provide in a future release. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated numbe= rs? >>>>>>>> >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> First of all, we would want the PBX to generate the signature= , >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>> >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>> >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from a= n >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" device= s >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a singl= e >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>> >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggeste= d >>>>>>>> below by Alex). >>>>>>>> >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>> >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>> >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>> >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>> >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>> >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>> >>>>>>>> *Public Use Case:* >>>>>>>> >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> There are reasonable circumstances where a party placing = a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call ma= y >>>>>>>> or may not be the same as the service provider serving th= e >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes call= s >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where ther= e >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, a= t >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>> >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>> >>>>>>>> >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with thi= s >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-I= D >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may b= e >>>>>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>> >>>>>>>> >>>>>>>> Specific markup suggestions: >>>>>>>> >>>>>>>> >>>>>>>> NITS >>>>>>>> >>>>>>>> >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>> >>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>> present, then the >>>>>>>> >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>> >>>>>>>> present, and the verifier does not support it,=20 >>>>>>>> it MUST ignore the >>>>>>>> >>>>>>>> Identity header. If a supported "ppt" >>>>>>>> parameter value is present, >>>>>>>> >>>>>>>> the verifier follows the procedures below,=20 >>>>>>>> including the variations >>>>>>>> >>>>>>>> described in Step 5. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>> >>>>>>>> [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as=20 >>>>>>>> robocalling, voicemail hacking, and >>>>>>>> >>>>>>>> swatting are enabled by an attacker's ability=20 >>>>>>>> to impersonate someone >>>>>>>> >>>>>>>> else. The secure operation of most SIP=20 >>>>>>>> applications and services >>>>>>>> >>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>> the source of communications as it is >>>>>>>> >>>>>>>> represented in a SIP request. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>> includes provisions for a logical >>>>>>>> >>>>>>>> "authentication service" which validates caller=20 >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>> >>>>>>>> authentication service may be implemented=20 >>>>>>>> either as part of a user >>>>>>>> >>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>> component of a network >>>>>>>> >>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>> user agents send >>>>>>>> >>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>> message has been >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This document specifies a means of sharing a=20 >>>>>>>> cryptographic assurance >>>>>>>> >>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>> >>>>>>>> It relies on the authentication service=20 >>>>>>>> constructing tokens based on [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>> typically obviously >>>>>>>> >>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>> credentials; if they >>>>>>>> >>>>>>>> do, their user agents can act as authentication=20 >>>>>>>> services. However, >>>>>>>> >>>>>>>> for some deployments, [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Regards, >>>>>>>> >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> --------------------------------------------------------------- >>>>>>>> -- >>>>>>>> ------- >>>>>>>> >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copie= s >>>>>>>> of the message. >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> >> >> >> >> ________________________________ >> >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 8 10:03:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E302E12D669 for ; Mon, 8 Aug 2016 10:03:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XYBAT7x8_fs for ; Mon, 8 Aug 2016 10:03:11 -0700 (PDT) Received: from resqmta-ch2-02v.sys.comcast.net (resqmta-ch2-02v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0ED9712B03C for ; Mon, 8 Aug 2016 10:03:09 -0700 (PDT) Received: from resomta-ch2-17v.sys.comcast.net ([69.252.207.113]) by resqmta-ch2-02v.sys.comcast.net with SMTP id Wnwubnh4i0MKRWnxFbCepe; Mon, 08 Aug 2016 17:03:09 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id WnxEbTrrHTXV7WnxEb5mgb; Mon, 08 Aug 2016 17:03:09 +0000 To: "Gorman, Pierce A [CTO]" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> From: Paul Kyzivat Message-ID: Date: Mon, 8 Aug 2016 13:03:06 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfN5pu255b7ooXos8A0GcChkJ1UyKcsqWDDeTdEwJuKY6xnRZkdzxNEam5UORnXM0NJJQhX5/VGMRyGvon5oYnJeXWPCj5H+82YLQfGS1bpL0gp4P17zO N1l7hvvAufjXytmZlr78Kl0mppAWamAO5s2Fo3XuDhIfC5hUz+1RwPowUNfhjepXtD7h6SKQoAQIJhUlSnuVrKiqUyS7e8lkYp5CuA0tzxO21Qapkc8orwVd 5gezkVRFWsuHrSrI+xDq/vJolWMCkOHApmR17cvneuCbmcw/Xd/y19HebsuhiWllt5fUc2hI1MDp56ZFvwmRDBLMfk9XwhDacCyX/FXVu3sjPB0TJbE0O8fz yi9r6/CYNCcy4Kv8P/sxqnEzASVoCIiEAZHM875IvwoHNnGi3yo= Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 17:03:18 -0000 On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: > Thanks for the added comments Tim. > > I agree that passing P-Asserted-Identity between trusted networks is appropriate (and the converse is true as well). Part of my issue is I have been conditioned from the very earliest implementation of Sprint's VoIP network that other carriers' IP networks are inherently untrusted. I've been browsing TS 29.165 and even there I find language that implies trust is established by agreement, not by standard. (Even roaming implies agreement.) I understand why *some* stuff needs to be removed when forwarding to an untrusted party. For instance, if the call has requested privacy, then P-A-ID needs to be removed. But when privacy is not a concern, trust is really more of a concern on the ingress side, not egress. If I don't trust you then I won't trust a P-A-ID you sent to me, and so *I* will remove it. But if I trust you, but you don't trust me, then what is the downside for passing along the P-A-ID? Thanks, Paul > Regardless, this discussion has been helpful and educational (to me at least). And, I confirmed with my operations counterpart we generally send PAI today. I've also made note that where standards and ICA require it, we will include PAI. Thanks again. > > Best regards, > > Pierce > > -----Original Message----- > From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] > Sent: August 08, 2016 10:47 AM > To: Gorman, Pierce A [CTO] ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; Richard Shockey ; Paul Kyzivat ; stir@ietf.org; Brian Rosen > Subject: RE: [stir] STIR 4474bis-10 comments > > Pierce, > > My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA IR.95. The latter references and profiles the former. Section 4.4.1 of IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be considered trusted, and table 3 in that section recommends that P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. It also states that PAI is mandatory at a roaming NNI. > > Tim > > > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce A [CTO] > Sent: Monday, August 08, 2016 8:52 AM > To: DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; stir@ietf.org; Brian Rosen > Subject: [E] Re: [stir] STIR 4474bis-10 comments > > Martin, > > You referenced TS 29.195. I'm not familiar with that spec. Has it been deprecated? It's not showing up on the 3GPP site. > > I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the originating side" Note 4 it states, " It is assumed that the IBCF is responsible for stripping the P-Asserted-Identity from the SIP header when interworking with untrusted networks." > > Your remark is consistent with Note 4, but only if we agree that, for instance, the AT&T network and the Sprint network are "trusted networks". In reality, this is not the case or there would be no firewalls or Session Border Controllers used for interworking and security. My opinion is the only carrier networks that are trusted are the SS7 network, and the Internet backbone. > > What it really comes down to is that PAI is left in signaling either through formal specification as a part of an inter-carrier inter-connection agreement, or by custom (or even by accident). I think this illustrates Paul Rosbotham's observation is true. > > Pierce > > -----Original Message----- > From: DOLLY, MARTIN C [mailto:md3135@att.com] > Sent: August 05, 2016 12:55 PM > To: Gorman, Pierce A [CTO] > Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen ; stir@ietf.org; Paul Kyzivat ; Richard Shockey > Subject: Re: [stir] STIR 4474bis-10 comments > > PAI is not stripped at the network boundary between trusted networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force ITU And the list goes on > > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards > AT&T > Cell: 609-903-3360 > Email: md3135@att.com > >> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: >> >> Which header the carrier chooses to display is moot if the header is stripped between carriers as per at least one standard. I think Paul Rosbotham's observation we're likely to encounter "some interesting interworking challenges" was perhaps the understatement of the year. >> >> Pierce >> >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: August 05, 2016 11:58 AM >> To: Gorman, Pierce A [CTO] ; Richard Shockey >> ; Rosbotham, Paul, Vodafone UK >> ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> If PAI is present and signed, and From is also signed, I would expect it to be up to the UA to decide what to display, not the carrier. >> >> Of course this will work differently if there is a different signaling regime between the carrier and the user device (e.g. black phone). >> >> Thanks, >> Paul >> >>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>> P-Asserted-Identity is supposed to operate "among trusted SIP entities" and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-Identity is stripped by border controller functions and is not to be used in inter-carrier inter-connection (although it commonly shows up anyway). My opinion is the "From" header is likely used more often for presentation. >>> >>> Pierce >>> >>> >>> -----Original Message----- >>> From: Richard Shockey [mailto:richard@shockey.us] >>> Sent: August 05, 2016 9:37 AM >>> To: Rosbotham, Paul, Vodafone UK ; Paul >>> Kyzivat ; Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> >>> Humm this is getting interesting. Its my understanding that the display number aka "presentation number" in the US context is the one carried in the PAI. Martin, Pierce? >>> >>> >>> >>> >>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>> >>> Jumping in now that we're on European working time, +1 on Paul's observation. >>> >>> Here in the UK, we've got 2 numbers carried as calling line IDs....one (we term the Network Number, carried in PAID) uniquely identifies the line, the other (we term Presentation Number, carried in From) is used for display purposes. >>> >>> Only the carrier has the authority to set the Network Number so only they could sign it. >>> >>> But - subject to regulatory restrictions which are well documented - the number sent for display purposes belongs to the customer. For blue-chip customers, I can allow them to send their Presentation Numbers into the network, and can't readily check at a network level that they're theirs (I do have contractual safeguards). The number may have been allocated by me, or could be allocated by a third party provider. If it's a call-centre they'll be making outbound calls for lots of different customers which will change on day-by-day basis. This is business as usual. I don't like the term "authorised spoofing" because it implies that the CLI is in some way being rigged: it's not, it's the corporate customer or their subcontractor using the number that's been assigned (so in internet terms delegated) to them via a chain of trust from the regulator. >>> >>> What I want is the ability for customers to use their credentials >>> to sign the CLIs they send me so that at the terminating end it can >>> be checked (or indeed somewhere en-route if that's the business model). >>> I can and would sign for customers on my mobile business since I'm >>> driving what number is presented, but that's by-the-by because they >>> aren't the ones who generate millions of nuisance calls. If the >>> signing only occurs at the originating carrier level for >>> corporate/call-centre customers that's no use because I'm not in a >>> position to do that for these type of customers...and the whole >>> system becomes a waste of time. I'd also highlight there are many >>> more of my large customers that I'd trust more than a far end >>> originating carrier that could be anywhere in the world (though we >>> have no shortage of small carriers that I wouldn't know from Adam >>> more locally in the >>> UK....) >>> >>> Regards >>> >>> Paul >>> >>> -----Original Message----- >>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >>> Sent: 04 August 2016 23:12 >>> To: Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>> I think it's not a delegation. The mobile phone is not being delegated the TN, it's being authorized to place calls that are not from that TN, but appear to be. >>>> >>>> The mechanism to handle the credential is exactly the same as a delegation, so if you want to call it delegation, go ahead, but I prefer to call it authorized spoofing. >>> >>> IIUC the delegation is to a responsible entity (something that can be held legally accountable - e.g. a person), not to a device. The entity can then "use" the credential via any device(s) it chooses. In the case of the mobile, the device then becomes a two-line phone. >>> >>> Thanks, >>> Paul >>> >>>> Brian >>>> >>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote: >>>>> >>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>> In my jargon an "authorized spoofer" is the doctor who is calling >>>>>> from his mobile, but sending the TN of his office phone as calling party. >>>>>> The delegation to his office phone was made by his landline >>>>>> carrier to him. He then creates another credential, which he >>>>>> signs with his office phone credential that authorizes his mobile >>>>>> to send calls from his office number. He is spoofing (because the >>>>>> call is coming from his mobile's TN but claims to be from his >>>>>> office), but it's authorized spoofing. The doc could give the >>>>>> credential to his mobile SP if they sign on his behalf. >>>>> >>>>> I don't understand how that is different from regular delegation. >>>>> >>>>> When his landline carrier gave him a delegated certificate for his landline number, he should be able to install that in whatever devices he wants - his landline UA, his mobile phone, etc. It is still delegated from his landline carrier, even when used with calls via his mobile carrier. >>>>> >>>>> Thanks, >>>>> Paul >>>>> >>>>>> Some folks don't like attaching the "spoofing" label to a legitimate use. >>>>>> >>>>>> But that's how I describe it. >>>>>> >>>>>> Brian >>>>>> >>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>> > wrote: >>>>>>> >>>>>>> +1, but with one question below: >>>>>>> >>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>> I think all we need is to have credentials follow the delegation >>>>>>>> path, >>>>>>> >>>>>>>> plus the option to add another level (not delegation) for >>>>>>>> authorized spoofers. >>>>>>> >>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>> >>>>>>> Thanks, >>>>>>> Paul >>>>>>> >>>>>>>> I don't think it matters who the delegator or delegatee are as >>>>>>>> long as the delegator is willing to take the heat for delegating >>>>>>>> to someone who sends a lot of bad calls. They can pass the buck >>>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but >>>>>>>> only if the SP knows who they delegated to, so authorities can >>>>>>>> follow the delegation path. There are plenty of certificated >>>>>>>> carriers who are willing to not care who they delegate to. The fact that there are some who do doesn't change much. >>>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>>> that you can pass the hot potato. >>>>>>>> >>>>>>>> It's perfectly reasonable for a carrier to be able to sign for >>>>>>>> any calls placed on its network on any number it has been delegated. >>>>>>>> If it does, it's asserting that the calls are from who they are supposed to be from. >>>>>>>> That should be straightforward, but we know it's not always, and >>>>>>>> that represents the hard part of deployment in my opinion. But >>>>>>>> once they delegate, they can hand responsibility to sign to the >>>>>>>> delegatee. But, that only works if they know who they are delegating to. >>>>>>>> >>>>>>>> The root of the whole model is that there is a formal or >>>>>>>> informal delegation path for telephone numbers in every country, >>>>>>>> and we can build a chain of trust from that delegation path. If >>>>>>>> you propose to alter that model, then we get into (policy) >>>>>>>> issues of which carriers/entities we trust and which we don't. >>>>>>>> Our model is that you know who you delegate to, and once you do that delegation, it's their problem. >>>>>>>> That's pretty appealing I think, even if it's a change in some >>>>>>>> business practices. >>>>>>>> >>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> OK, you talked me into indulging in one more message on policy >>>>>>>>> and use cases. >>>>>>>>> >>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>>>>>> individual devices as well as multi-device and multi-number platforms. >>>>>>>>> >>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>> relationships are two additional factors which affect >>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>> >>>>>>>>> Inherent variable trustworthiness of a calling number was my >>>>>>>>> reason for suggesting a way to qualify the signature to reflect >>>>>>>>> that variability. >>>>>>>>> >>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>> coming from a device assigned a single number, or from "trunk >>>>>>>>> group" which could originate calls using multiple numbers, and >>>>>>>>> can qualify to some degree the trustworthiness of number authenticity accordingly. >>>>>>>>> >>>>>>>>> My suggestion was qualifying calling number authenticity into >>>>>>>>> categories of carrier-signed (or not), and unauthenticated, >>>>>>>>> semi-authenticated, and most-authenticated. There can be more >>>>>>>>> granularity, but it implies additional operational complexity >>>>>>>>> (both for the carriers and the consumers) and I assume diminishes value. >>>>>>>>> >>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>> relationship with typical consumers adds to the trustworthiness >>>>>>>>> assessment and partially because carriers are a regulated point >>>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most >>>>>>>>> calls originate and terminate between mobile consumers where >>>>>>>>> their carriers are able to usefully authenticate their device >>>>>>>>> and have a high degree of confidence of the authenticity of the calling number. >>>>>>>>> >>>>>>>>> I think billions of per-TN certs of varying usability (revoked, >>>>>>>>> not >>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>> >>>>>>>>> Conversely, I think billions of per-TN certs will work well, if >>>>>>>>> the calling party has to sign a call with a per-TN cert >>>>>>>>> provided by the called party. No called party cert to include? >>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>> with the called party, and the call can be authorized/treated accordingly. >>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>> deployed on devices and PBXs. Whether they will be is a policy issue. >>>>>>>>> >>>>>>>>> The notion of credentials that are traceable to a delegation of >>>>>>>>> a TN is a mechanism that is part of the design of stir, and the >>>>>>>>> design allows delegation of one TN (to one device, although a >>>>>>>>> device like a PBX would have more than one TN per "device", and >>>>>>>>> something like a dual NAM phone could have more than one >>>>>>>>> credential. For the use case we've discussed, a mobile phone >>>>>>>>> may also have a credential for, say, a TN that is delegated to >>>>>>>>> a landline, to cover the example case of a doctor placing a >>>>>>>>> call on his mobile, but getting his office number to show up as the calling party. Use of such mechanisms is policy. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>>> would like to continue the discussion, but I'm pretty sure this >>>>>>>>> isn't the right forum. >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> Of course I want PBXs to sign calls. As well as smart phones >>>>>>>>> and any other devices that can be programmed to do so. >>>>>>>>> They will be given credentials that only are valid for the TNs >>>>>>>>> they are authorized to sign for. They can try to sign any >>>>>>>>> call, but the validity of the credential would make such a >>>>>>>>> signature fail the checking. >>>>>>>>> >>>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>>> reasonable way to deploy quickly, but I expect many SPs will >>>>>>>>> want to get out of the liability of signing on behalf of their >>>>>>>>> customers. If they can push of that responsibility to their >>>>>>>>> customer, only being responsible for getting the customer an >>>>>>>>> appropriate credential when they assign TNs, then I would >>>>>>>>> expect them to want to do so. That means the devices have to >>>>>>>>> be able to sign, but I understand many of the PBX vendors >>>>>>>>> think that's something they could provide in a future release. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>> extraordinarily easy to commit fraud with authenticated numbers? >>>>>>>>> >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> First of all, we would want the PBX to generate the signature, >>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>> support the extra delegation required to support "authorized >>>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>>> calls from the same service provider and should not present >>>>>>>>> any issue. >>>>>>>>> >>>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > wrote: >>>>>>>>> >>>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>>> knowing whether the calling number is properly assigned >>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>> Therefore, checking whether the calling number was from an >>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>> administrative challenges), but of limited value. And in >>>>>>>>> the consumer market, there are calling products which >>>>>>>>> support a parent subscriber number and "companion" devices >>>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>>> the parent subscriber. These are examples of where the >>>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>>> the same thing as the authenticity of a call from a single >>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>> spoof checking. >>>>>>>>> >>>>>>>>> In another forum and anticipating calling number >>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>>> and replay issues can be addressed as reasonably suggested >>>>>>>>> below by Alex). >>>>>>>>> >>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>> could be as follows: >>>>>>>>> >>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>> >>>>>>>>> *00 - No Credentials* >>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>> networks that don't natively support SIP or which don't >>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>> entirely untrustworthy. >>>>>>>>> >>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>>> agreement, manual roaming. >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>>> untrustworthy >>>>>>>>> >>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>> >>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>> trustworthy >>>>>>>>> >>>>>>>>> *Public Use Case:* >>>>>>>>> >>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>> available authentication services resources. e.g., >>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>>> which would process them according to the rules of the >>>>>>>>> Public Class application(s). >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>> *To:* Alex Bobotek >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> There are reasonable circumstances where a party placing a >>>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>>> service provider servicing the entity placing the call may >>>>>>>>> or may not be the same as the service provider serving the >>>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>>> entity that is assigned the TN explicitly authorizes calls >>>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>> authentication. We're not aware of any cases where there >>>>>>>>> is an actual requirement for legitimate calling without >>>>>>>>> explicit authorization from the assigned entity, although >>>>>>>>> we certainly are aware that various parts of various >>>>>>>>> service providers don't bother to check. At this point, at >>>>>>>>> least in some countries, there is a realization that the >>>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>>> any more. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>> >>>>>>>> > wrote: >>>>>>>>> >>>>>>>>> 1. Permit authorization without authentication >>>>>>>>> In the current telephony network practice, some >>>>>>>>> service provider implementations choose not to >>>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>>> established that there are not? How can the industry >>>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>> identifying the originating service provider >>>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>> important to identify the service provider(s) closest >>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>> better to ID service providers than unreasonably >>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>>> support authorization without authentication. The >>>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>>> and there is benefit to signing in these cases >>>>>>>>> (service provider identification). The language of >>>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>>> require or assume that that authentication will >>>>>>>>> precede authorization. Of course there may be other >>>>>>>>> use cases where signing includes authentication and >>>>>>>>> may not include a specific service provider's >>>>>>>>> authorization. >>>>>>>>> >>>>>>>>> >>>>>>>>> 2. Improve replay prevention >>>>>>>>> Proximate replay is possible while complying with this >>>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>>> mky may not be present and if present its use is >>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>> signed sequence, random # or request ID (e.g., Call-ID >>>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>>> include an mkey from a captured INVITE. So it may be >>>>>>>>> possible to DOS, spam or text-bomb a recipient using a >>>>>>>>> captured identity. While large-scale or distributed >>>>>>>>> implementations may make the enforcement difficult, >>>>>>>>> there is little cost to signing and decoding a method >>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>> practice should at least be discussed while perhaps >>>>>>>>> not required. >>>>>>>>> >>>>>>>>> >>>>>>>>> Specific markup suggestions: >>>>>>>>> >>>>>>>>> >>>>>>>>> NITS >>>>>>>>> >>>>>>>>> >>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>> parameter appearing *in*the >>>>>>>>> >>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>> present, then the >>>>>>>>> >>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>> parameter value is >>>>>>>>> >>>>>>>>> present, and the verifier does not support it, >>>>>>>>> it MUST ignore the >>>>>>>>> >>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>> parameter value is present, >>>>>>>>> >>>>>>>>> the verifier follows the procedures below, >>>>>>>>> including the variations >>>>>>>>> >>>>>>>>> described in Step 5. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> 3 >>>>>>>>> . >>>>>>>>> Background >>>>>>>>> >>>>>>>>> [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Per [RFC7340 >>>>>>>>> ], problems such as >>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>> >>>>>>>>> swatting are enabled by an attacker's ability >>>>>>>>> to impersonate someone >>>>>>>>> >>>>>>>>> else. The secure operation of most SIP >>>>>>>>> applications and services >>>>>>>>> >>>>>>>>> depends on authenticating and/or authorizing >>>>>>>>> the source of communications as it is >>>>>>>>> >>>>>>>>> represented in a SIP request. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> This identity architecture for SIP depends on >>>>>>>>> includes provisions for a logical >>>>>>>>> >>>>>>>>> "authentication service" which validates caller >>>>>>>>> identity at or near origination. outgoing >>>>>>>>> requests. An >>>>>>>>> >>>>>>>>> authentication service may be implemented >>>>>>>>> either as part of a user >>>>>>>>> >>>>>>>>> agent or as a proxy server; typically, it is a >>>>>>>>> component of a network >>>>>>>>> >>>>>>>>> intermediary like a proxy to which originating >>>>>>>>> user agents send >>>>>>>>> >>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>> message has been >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> This document specifies a means of sharing a >>>>>>>>> cryptographic assurance >>>>>>>>> >>>>>>>>> of authenticity of and/or authorization to use >>>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>> >>>>>>>>> It relies on the authentication service >>>>>>>>> constructing tokens based on [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> To maximize end-to-end security, it is >>>>>>>>> typically obviously >>>>>>>>> >>>>>>>>> preferable for end-users to acquire their own >>>>>>>>> credentials; if they >>>>>>>>> >>>>>>>>> do, their user agents can act as authentication >>>>>>>>> services. However, >>>>>>>>> >>>>>>>>> for some deployments, [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> >>>>>>>>> Alex >>>>>>>>> * * >>>>>>>>> *Alex Bobotek* >>>>>>>>> >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> --------------------------------------------------------------- >>>>>>>>> -- >>>>>>>>> ------- >>>>>>>>> >>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>> recipient, please contact the sender and delete all copies >>>>>>>>> of the message. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >>> >>> >>> >>> >>> ________________________________ >>> >>> This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Mon Aug 8 11:52:25 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C720412D885 for ; Mon, 8 Aug 2016 11:52:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jaThApRHC2PY for ; Mon, 8 Aug 2016 11:52:04 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0119.outbound.protection.outlook.com [104.47.42.119]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41B3412D176 for ; Mon, 8 Aug 2016 11:38:42 -0700 (PDT) Received: from BN1AFFO11FD011.protection.gbl (10.58.52.34) by BN1AFFO11HUB020.protection.gbl (10.58.52.130) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Mon, 8 Aug 2016 18:38:40 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.80) smtp.mailfrom=sprint.com; brianrosen.net; dkim=none (message not signed) header.d=none;brianrosen.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.80 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.80; helo=preapdm1.corp.sprint.com; Received: from preapdm1.corp.sprint.com (144.230.32.80) by BN1AFFO11FD011.mail.protection.outlook.com (10.58.52.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Mon, 8 Aug 2016 18:38:40 +0000 Received: from pps.filterd (preapdm1.corp.sprint.com [127.0.0.1]) by preapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u78IVsfi005961; Mon, 8 Aug 2016 14:38:40 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm1.corp.sprint.com with ESMTP id 24pxxj08fx-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 08 Aug 2016 14:38:40 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 8 Aug 2016 13:38:38 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 8 Aug 2016 13:38:38 -0500 From: "Gorman, Pierce A [CTO]" To: Paul Kyzivat , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA/FoDwgAAi/SCAAAN8MIAAZ50A///C0nA= Date: Mon, 8 Aug 2016 18:38:37 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.40] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.80; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(24454002)(51914003)(189002)(43784003)(13464003)(377454003)(252514010)(199003)(305945005)(33646002)(24736003)(50466002)(50986999)(106466001)(7846002)(76176999)(54356999)(68736007)(7696003)(7736002)(586003)(4326007)(8666005)(46406003)(11100500001)(5250100002)(2906002)(106116001)(2171001)(15975445007)(8746002)(8936002)(8676002)(356003)(3846002)(81166006)(81156014)(6116002)(102836003)(19580395003)(86362001)(97756001)(93886004)(87936001)(2950100001)(2900100001)(92566002)(97736004)(47776003)(189998001)(5001770100001)(325944008)(108616004)(23726003)(19580405001)(5890100001)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB020; H:preapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD011; 1:szCVqyyc6wkuBU61rVIyLjRN/VMVn1n+nob7sESiCr8HaaY+etR6d8CjliwANzrHKpMzeochFSksXV9Zs1pMerofamyaiTRmVhgzdl9x2l+kU1v90h3Di3i+DRADzXtBx4pnw1rYPJg0OvTXT4uoA92Fwf63l/bJutbdpAmOUgE5c1v421ZECNN8dearfvgnECQalAu+5Gmjcum+X++mNvffFz/CHHQXCwZ7rwimmegcwz4Y0GHzqn+9YRFe7DwFdmoL1kERA6Ks0cyLeU/Ig3H69INAKSSUM/W9g3U8F6DYX+jHrUCbOJkpSiiZfat9eEEyU3SkohOaeBEaO5qXl3roHePKsPLdxyA+gkNkrW7CR5IAF956doRGUiYGly7ZFm2E9IgVXN4Q6iHxoLZPszTCkpSHkHbVdPML25N4zvPI57p/exzXhFCL89QgA4Ul2G07bBWYnaibHy5yfkPU6P6mN6gNSaJEows0rdp1ucwIVzc1Z7WGeKx/j7mzI7fIk2hBvmv9h3sb1p4OaGr5Q/73lLF7tar8g1VpvYzXku2HI6AJtcg0GAKxAxL1rp8aeB81UdhPLcV2e6/fiIYfKw== X-MS-Office365-Filtering-Correlation-Id: f468d1c5-c806-41d9-2912-08d3bfbb37cd X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB020; 2:oN6wGWSqvlIjv2TOl6p1peBoGdgSvFm0HCNVame8UN5fFvYZGDK+VDCftqmWew7BVOSujxu4tdwAAMgLRjxh/+0j09dapddsyQV3RF0HDNCQwS1wxDcwv/o9oXmLEedtIVd+ja81+Vz6KIWDyYYCtCUE7XX1aAflrMUg2/LSKfjUaSRL0x3JkJxIqJz64zl8; 3:v9n44qeFV8CLkP6YbTl3/sLm56XuEM17/oFGT5gBxd9vla+T7PcLuJMCo+OIi7RrLO9aFD33hjaPXUq2CEfB6nDswYEyIN/is6MZr9KdyEOhVxfdPrBkOg5Y4rU1zcxxUqRLxsyl0/jccFdDURdxRc/CK/4+cXrIggUxfcYnDf/8swKdEwPik8UYipLP/WgYJVurv0Zofcq+2EJ15V2vLRIYZ2IyGqa0FH9fkTvEGJOoPm3chqtmifXiK4WKJ+LBjj3DRJxwwzeB/v3vr4gDYA== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB020; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB020; 25:hijVfrL/jXxIEvTTyquRuVJhNdWDbk2Z/4lWnPAjFilJCVoE7lknJMGi1rzPnf9NFnWFXy99rLA2/NhwOp4px+YGJg/RwKHtB54SgpWmWHK5mav06dpGkcU+b7J0y/j4o2VgekSJ8bxJC/W2jl25y10Zsf9BvS/tYsOGws0Vq7/s3rs745FO593LY7+4xVdZO3rO/mCvX0FqcC8ObJzM8ceP1xC4lJlQY4YcOMlZdw9J9sXvmzLqW4NjbEoVTJ6aoAiiQ3Bmi8sMAt9rV8LPU02HdlypoY9Ngk3u6Em02KOaVwn3T0qN3Shjt2cC/PXe8cKZ2MMc/8aIr69X4tzdM5HLO0jSb+4ZrEeMEAli/looBrBo1RrTMjmYmy/ztjWRnOeBJ4y/zeKJCm4h1xl3EkCYa1kqzKMN66Oo0fP4oukmTMvdyQEROJqb4B5VCWsiGry/IzXQUcXDGEKeXjjwsZX0+pU70AS0Tbo5HI1dwER1e1xw/JMFpaS21kzxa2HfK1KXeAu+oSmtuwGtGzfbcs07fQ6ePRZYJT4XfIhIZu361828ITuB4/xvXx9cTt4uWTXavRneTS3VruFalXKYKoGrzNHbyOeHTSSh3+LSBhvl+Nq/vZOzWQ0mq6b+6J9INaE6aUMvBKvgqKhKfoEpRg+yKu//J5fIG1Fug8yh1oj+lKZwkAlmhu9LmANdF38a4AvDMSCW0jdy6iCEhu4KMXab26WwLutDfIXlJp+CjkVQlltAhOpaLInbMBC4qMq43Bz9QOCnXHf6Wua40Ms8tsDK5kWxrYNRpNv5JNpyyTIpxpoZY0mLgM4v4v+xBYhNsEasSmQDpWabCXm49hNhVYSO/SMdAZ+8txCnqnjD7WTSuO3cfvnQxMt+01lVwCXOI++DpFq5IsaD2i9wU9LsRA== X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB020; 31:iwJLMvp8Q1ncjEVbhh1xj9tWrQILYrrwpxpaf0jyBapzVcZoJr6Cgn3WH1LmqYeAPWSGUCHdkGeyvtRvluRVfYa4i4Ao+afXsIR4KHSDRL9UTMsdSmgXdRHcEEjdlRv8islJFAgjjfeKRw/+s3I84ggU/gHfsKFPd4/aF7dEdhXUBdCYCE2YyLPHWvGCyInYK5zpVT/M04iw4THRs6U+JsG4V7Cdoxjn/6yl9kiXtOM=; 20:9ER4f2fH+X/g2/FeGJv99e48nCeEFro4kkhR37vf9rPdG+eq38Mub0+6fKHKxYpJuSZB553bm70+oXNp1WgD10CV23iSI/MnP/q4SuPpldw/rxGwm6AlSaxu2P5dhMP7eYYKRY7pisfpi6rUM1t2xicIwxI+sAgpfk8t66qDFitE58Tvn6vac0XkxdwvDdH3Vgdb3lYZi/ZaUCXUjT2UXMwosbn++dc/mPuMFuX+CMbxxPPpza1rEVy/Q4QtLH96D3xmd2pqHlGGhwwN+XygJeSEugpC4xFtFjlmlGM+ChYuYD1HXigbO6BTZGiUjGtJk7+W7OOXB0YZA7+alBzS18hoPz9pG0q3BgB5VuPX2Ta7hU6J/Id6WsncPy9mhlO7xH9kvV8KexyTBtPziGE+SNPHVTol7ZOnyVvJBSr+0x8= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040159)(601004)(2401047)(8121501046)(5005006)(13018025)(13017025)(13015025)(13023025)(13024025)(10201501046)(3002001)(6055026); SRVR:BN1AFFO11HUB020; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB020; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB020; 4:CSAPi3x9du3X95pjhW1ZMFC8QOOgBakxzCrJy4jKnYJp7vfbJfi6aWfAi3JxPKW4g7TaVC+CdVisiXw3zwtWuVYaWesTugONKCctJHBt7mL++gE1ru4XFDxR36xQASTXym68fnsKf+eZwXE+nHX36M6fttKIToFTRnYP0uRBnWZ7sVnkC+jnKfvukUO2skTcLzanq91uejdmY3fCDPEXk+aPgKQdOJb6WeCX7IpPX0Bf2U/OLR4ihW2+wJJEfzJw3dfEFoIsK7P5v8lqKfFtYB8RMR0azsTqLJaJGCj6cqYeaZ99LK1sj1nkxnyw2ZJjD1CY4RgwtBU9uH3d2+GvHq605Ep+VSr3rhUp/XTIN31KZWUdy501qCj7c/SVpdemiTYqllIwlPBlYs0j8uKMcWsWjCx/GTalyS6KotO089Ej4qIyguiww2qgTAOGBJ43kRuyB5MG4g1B1Ea7s598ePb5mp6Uhpq0HUJlIa0NFTfIJ78UFoXBujDqD5G7eb3O4Rhbcy7s3oBXCgd2n1UMX5V6XbAmhI2qpVYfJbGLqGJfLeJsUfDaEFDzBhSiochfBNSrNNbh9JoEd89x9cIDIoXvWXUkLBIQoivr8ooUu1JGEKu5hnIcVkWJNN3fiXFgyHI+rOpX+T5BDpM+nKwLA6EVgZ+/XjIfiPAIk2H+CX41oLIt6uTRgfShjvNmJ2Di7DnZYhhlXDO0PDl9tNspC/OeieQnAdIZPINmSzmsAwI= X-Forefront-PRVS: 00286C0CA6 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB020; 23:12ebDQZc5PfDqeDPeGinMR/+TuOQqcjxPR5GhHh?= =?us-ascii?Q?2dBMKaCmwOBejRUyZAmQyOye73g4S/rcXHVNR97kRlmAZJ68ARn+K6gKcXLk?= =?us-ascii?Q?CUUm3X3/aP1com/tEZbF7dwOow/r84G+gXkfdU5f3pTiwFsouFcqZla8rNgF?= =?us-ascii?Q?/Lib/FZ9OZBEFMAOyIO2ejerXxrxqO/drEFF/kxBM8b/woKO+2tA9yhKCqYk?= =?us-ascii?Q?7exCQu86j0YWA5dbLPLuZpt3v01hRdrVDsvaC2Gj3EQVQdZjBh3dHodLtkZl?= =?us-ascii?Q?D+drEl/LzUieH7dcGBVsQQJqaqtkV6X3jDRwwLL2cl/un4LY0V9id+nvENCG?= =?us-ascii?Q?HwsXF/Y9D9aAltPq7GAVSs/j8O0KqhFrX70S/AhPsq9l8VcplsWWzLATacLN?= =?us-ascii?Q?Syvgj7DSkJJbAWXdaPlhPnu8U7NWoAFpZMUwzm9USevFRrbaOe2IAHq5pjSv?= =?us-ascii?Q?+vog0IiOnoiZBhjl5wTMAhG05te9IJJxUS0kaApBefmB7AVYD5LureqS/K9C?= =?us-ascii?Q?5fUgRT87+27N76RbzS+ydBrrjQ+O6qLyOiAwFBeCVVyrKzAQBRGqZJ//LS+c?= =?us-ascii?Q?GtN56Z4Dk2jOpnreYOrmk99xGiJoHYiRMnW/6zzgQXkRwzSvSxzA7iq/QojT?= =?us-ascii?Q?5xcfzvnuvmtjZDedJNWd8wQKNuGG7wffzc7v+t3qTMdQw8yROXNjNdBTmfpL?= =?us-ascii?Q?C7Asobrjwn3WgdDb/Yw/rWC2Ou69nuerjju8F8JQJL1Fd8Q5cuyZH+Dh32Cx?= =?us-ascii?Q?R68I6tvI6ozNL5gTfWlzMf6gRZMsAtQSa5id0HwDeeVdt/QhjP3Va/fMmm5a?= =?us-ascii?Q?glIHcK1Lm7Ws8EULMKN355q4gldcIozLRlJ3z9rNXAwbQXTMxlXMMYa4bNmY?= =?us-ascii?Q?soJS8bFVfCK0nfngqNza3f22Qot/rzVAXP8a+fquIM6Akvp/Wig+Q3sMqYoL?= =?us-ascii?Q?1+jP5Dq/pSSegQfG+Z2NvS+e3WB07aWuoWhA3DD1sFscDIBJ7UWA/i/xDjMs?= =?us-ascii?Q?BuQm5dTfxX+6EMg1+j5570KXKb51q35iH5jNbxUTNX9nWzSD7WNyBFt8aHvn?= =?us-ascii?Q?0HfHbLWf3e/+szFy/9xOUXXcj21Wc4IE58rbtaXoCvbVufvYCwNnakpgu0Gj?= =?us-ascii?Q?RbETrtOKTSljTvvFFrJh0av8/IvrkWB3sOrhJLxDfAeRqxUmTxY187g2ewnQ?= =?us-ascii?Q?261TfmkISpEwolEUo57/SME/l+9A/xTbyg9OOU+vAzbN0mm0YlPezZ7zQtWW?= =?us-ascii?Q?BHU+t5mWR7DYCetLIgZ8bCKMl1IIx089jjzwgrx8TEvm8vfEfLRdRSjwHnav?= =?us-ascii?Q?PRc+yeJPjkDAGZIG+WO8iHjVcpjNwhPbmjjP1KoXSk2y2LtrY4DIbl5zeSsd?= =?us-ascii?Q?EfE42+ETSXt2PLVNhgBTv8GilenTjSgkAlzYer1cAqKgOcr+5KdnrunWFC82?= =?us-ascii?Q?wgN6/HU9WrxdfxYhaavaL2YPZ1TsP1qktH3OlREq4MtbPh9MziWIN2jRSU3r?= =?us-ascii?Q?EUo8Y9grtZFOXgw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB020; 6:2udWcVkdnSvmC+xvWVRSKb0B4fcgMxAX/dHRWpERdVT5z7pRLWJCdPTZLoNT740+mIStOTQtefRh7nIYzVCRTRm3o6fCgRTaCw3OBOYneEo9n4B9REiBb9sNAh0yqZ2McmssIN+/0X6zWQKiZo53CAXH2o236agNHJU52ezHsPncG2rpbbxuxvWb6lgigvGTDWQU7uM55LNLGmxU5/5V0I4KgFE3cQrtjCNZWUxt7bvEGw8gZKlBqgWokXtQ8609ckVPxT1iSxxv/c0o9T6SN17jcGMvz5Rrn1G5VSrKuy+8DvBg2gApnn2kAAyN0T3wmvEF0OGl4VvCf1aQUDiqxQ==; 5:ETAwXqCjNdGpHc2ehC9U8VGrIeKHEas73ETCttJctgbKZfDV9jewa5THjaI8F+4oRz7wmXdgf5vAShoxzMn+7kaUSvkdnsBhTiJ7FswDHvTHbuDzEtvIyb/NXasOL77ECyPSmBggcB/rG9nYIk//Eg==; 24:p4AeQV/fV0M0XvHS2GtDkZV+ScXgWvnGlDVb8yz2nGB/BtVFnC7Hlsw//kZ6xOr3jIYhxR9GpW/L2YPq00IFsPOZg3jARevlhQObaqfipT8=; 7:32oPWdJSVAM46oqYDuGh+T6Ru4qQtVg90M7J+MySd+H24LL94YUI3GuFWJEaDTDUqWFfee7yTiEsno+ALxUOfvuwtuEHlg4WaKO9to12cRjzsQyhTa6kx935/0GDzRwh3gatXWA6ILq+Z1F+k2e2N+gVxNqEb9SqeqkTkTYOweilNlPvZMXhf+jXlsyd9a9816UFzn9HbQOpKTJsyWTbOc7zsP44liee5vr9IaOenZSrWsZDDRoV8DlPoPDU4e8c SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2016 18:38:40.4573 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.80]; Helo=[preapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB020 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 18:52:09 -0000 Paul, As you know, SIP inter-working is often challenging because of variability = in implementation including proprietary headers (without an X-) and support= or lack thereof for non-mandatory (per RFC 3261) headers such as P-Asserte= d-Identity, (and things like B2BUA stacks stripping things like display nam= e in From but that's another story). I could argue that from a cleanliness= of protocol implementation, (and if I wanted to be pedantic), I would stri= p PAI outbound unless required otherwise. But the point is moot. As I men= tioned in the earlier e-mail, that is not our practice and I'm not requesti= ng it to be so. Pierce -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu]=20 Sent: August 08, 2016 12:03 PM To: Gorman, Pierce A [CTO] ; Dwight, Timothy M (T= im) ; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Richard Sho= ckey ; stir@ietf.org; Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: > Thanks for the added comments Tim. > > I agree that passing P-Asserted-Identity between trusted networks is=20 > appropriate (and the converse is true as well). Part of my issue is I=20 > have been conditioned from the very earliest implementation of=20 > Sprint's VoIP network that other carriers' IP networks are inherently=20 > untrusted. I've been browsing TS 29.165 and even there I find=20 > language that implies trust is established by agreement, not by=20 > standard. (Even roaming implies agreement.) I understand why *some* stuff needs to be removed when forwarding to an unt= rusted party. For instance, if the call has requested privacy, then P-A-ID = needs to be removed. But when privacy is not a concern, trust is really more of a concern on the= ingress side, not egress. If I don't trust you then I won't trust a P-A-ID= you sent to me, and so *I* will remove it. But if I trust you, but you don= 't trust me, then what is the downside for passing along the P-A-ID? Thanks, Paul > Regardless, this discussion has been helpful and educational (to me at le= ast). And, I confirmed with my operations counterpart we generally send PA= I today. I've also made note that where standards and ICA require it, we w= ill include PAI. Thanks again. > > Best regards, > > Pierce > > -----Original Message----- > From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] > Sent: August 08, 2016 10:47 AM > To: Gorman, Pierce A [CTO] ; DOLLY, MARTIN C=20 > > Cc: Rosbotham, Paul, Vodafone UK ;=20 > Richard Shockey ; Paul Kyzivat=20 > ; stir@ietf.org; Brian Rosen=20 > > Subject: RE: [stir] STIR 4474bis-10 comments > > Pierce, > > My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA IR.= 95. The latter references and profiles the former. Section 4.4.1 of IR.95= recommends that MNO-to-MNO or MNO-to-IPX interconnects be considered trust= ed, and table 3 in that section recommends that P-Asserted-Identity (PAI) b= e exchanged at a trusted interconnect. It also states that PAI is mandator= y at a roaming NNI. > > Tim > > > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce=20 > A [CTO] > Sent: Monday, August 08, 2016 8:52 AM > To: DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat;=20 > stir@ietf.org; Brian Rosen > Subject: [E] Re: [stir] STIR 4474bis-10 comments > > Martin, > > You referenced TS 29.195. I'm not familiar with that spec. Has it been = deprecated? It's not showing up on the 3GPP site. > > I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the origi= nating side" Note 4 it states, " It is assumed that the IBCF is responsible= for stripping the P-Asserted-Identity from the SIP header when interworkin= g with untrusted networks." > > Your remark is consistent with Note 4, but only if we agree that, for ins= tance, the AT&T network and the Sprint network are "trusted networks". In = reality, this is not the case or there would be no firewalls or Session Bor= der Controllers used for interworking and security. My opinion is the only= carrier networks that are trusted are the SS7 network, and the Internet ba= ckbone. > > What it really comes down to is that PAI is left in signaling either thro= ugh formal specification as a part of an inter-carrier inter-connection agr= eement, or by custom (or even by accident). I think this illustrates Paul = Rosbotham's observation is true. > > Pierce > > -----Original Message----- > From: DOLLY, MARTIN C [mailto:md3135@att.com] > Sent: August 05, 2016 12:55 PM > To: Gorman, Pierce A [CTO] > Cc: Rosbotham, Paul, Vodafone UK ; Brian=20 > Rosen ; stir@ietf.org; Paul Kyzivat=20 > ; Richard Shockey > Subject: Re: [stir] STIR 4474bis-10 comments > > PAI is not stripped at the network boundary between trusted networks=20 > 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force ITU And the=20 > list goes on > > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards AT&T > Cell: 609-903-3360 > Email: md3135@att.com > >> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: >> >> Which header the carrier chooses to display is moot if the header is str= ipped between carriers as per at least one standard. I think Paul Rosbotha= m's observation we're likely to encounter "some interesting interworking ch= allenges" was perhaps the understatement of the year. >> >> Pierce >> >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: August 05, 2016 11:58 AM >> To: Gorman, Pierce A [CTO] ; Richard=20 >> Shockey ; Rosbotham, Paul, Vodafone UK=20 >> ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> If PAI is present and signed, and From is also signed, I would expect it= to be up to the UA to decide what to display, not the carrier. >> >> Of course this will work differently if there is a different signaling r= egime between the carrier and the user device (e.g. black phone). >> >> Thanks, >> Paul >> >>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>> P-Asserted-Identity is supposed to operate "among trusted SIP entities"= and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted= -Identity is stripped by border controller functions and is not to be used = in inter-carrier inter-connection (although it commonly shows up anyway). = My opinion is the "From" header is likely used more often for presentation. >>> >>> Pierce >>> >>> >>> -----Original Message----- >>> From: Richard Shockey [mailto:richard@shockey.us] >>> Sent: August 05, 2016 9:37 AM >>> To: Rosbotham, Paul, Vodafone UK ; Paul=20 >>> Kyzivat ; Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> >>> Humm this is getting interesting. Its my understanding that the displa= y number aka "presentation number" in the US context is the one carried in = the PAI. Martin, Pierce? >>> >>> >>> >>> >>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>> >>> Jumping in now that we're on European working time, +1 on Paul's obs= ervation. >>> >>> Here in the UK, we've got 2 numbers carried as calling line IDs....o= ne (we term the Network Number, carried in PAID) uniquely identifies the li= ne, the other (we term Presentation Number, carried in From) is used for di= splay purposes. >>> >>> Only the carrier has the authority to set the Network Number so only= they could sign it. >>> >>> But - subject to regulatory restrictions which are well documented -= the number sent for display purposes belongs to the customer. For blue-ch= ip customers, I can allow them to send their Presentation Numbers into the = network, and can't readily check at a network level that they're theirs (I = do have contractual safeguards). The number may have been allocated by me,= or could be allocated by a third party provider. If it's a call-centre th= ey'll be making outbound calls for lots of different customers which will c= hange on day-by-day basis. This is business as usual. I don't like the te= rm "authorised spoofing" because it implies that the CLI is in some way bei= ng rigged: it's not, it's the corporate customer or their subcontractor usi= ng the number that's been assigned (so in internet terms delegated) to them= via a chain of trust from the regulator. >>> >>> What I want is the ability for customers to use their credentials=20 >>> to sign the CLIs they send me so that at the terminating end it can=20 >>> be checked (or indeed somewhere en-route if that's the business model). >>> I can and would sign for customers on my mobile business since I'm=20 >>> driving what number is presented, but that's by-the-by because they=20 >>> aren't the ones who generate millions of nuisance calls. If the=20 >>> signing only occurs at the originating carrier level for=20 >>> corporate/call-centre customers that's no use because I'm not in a=20 >>> position to do that for these type of customers...and the whole=20 >>> system becomes a waste of time. I'd also highlight there are many=20 >>> more of my large customers that I'd trust more than a far end=20 >>> originating carrier that could be anywhere in the world (though we=20 >>> have no shortage of small carriers that I wouldn't know from Adam=20 >>> more locally in the >>> UK....) >>> >>> Regards >>> >>> Paul >>> >>> -----Original Message----- >>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >>> Sent: 04 August 2016 23:12 >>> To: Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>> I think it's not a delegation. The mobile phone is not being delegate= d the TN, it's being authorized to place calls that are not from that TN, b= ut appear to be. >>>> >>>> The mechanism to handle the credential is exactly the same as a delega= tion, so if you want to call it delegation, go ahead, but I prefer to call = it authorized spoofing. >>> >>> IIUC the delegation is to a responsible entity (something that can b= e held legally accountable - e.g. a person), not to a device. The entity ca= n then "use" the credential via any device(s) it chooses. In the case of th= e mobile, the device then becomes a two-line phone. >>> >>> Thanks, >>> Paul >>> >>>> Brian >>>> >>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrot= e: >>>>> >>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>>>> from his mobile, but sending the TN of his office phone as calling p= arty. >>>>>> The delegation to his office phone was made by his landline=20 >>>>>> carrier to him. He then creates another credential, which he=20 >>>>>> signs with his office phone credential that authorizes his mobile=20 >>>>>> to send calls from his office number. He is spoofing (because=20 >>>>>> the call is coming from his mobile's TN but claims to be from his=20 >>>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>>> credential to his mobile SP if they sign on his behalf. >>>>> >>>>> I don't understand how that is different from regular delegation. >>>>> >>>>> When his landline carrier gave him a delegated certificate for his la= ndline number, he should be able to install that in whatever devices he wan= ts - his landline UA, his mobile phone, etc. It is still delegated from his= landline carrier, even when used with calls via his mobile carrier. >>>>> >>>>> Thanks, >>>>> Paul >>>>> >>>>>> Some folks don't like attaching the "spoofing" label to a legitimate= use. >>>>>> >>>>>> But that's how I describe it. >>>>>> >>>>>> Brian >>>>>> >>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>> > wrote: >>>>>>> >>>>>>> +1, but with one question below: >>>>>>> >>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>> I think all we need is to have credentials follow the=20 >>>>>>>> delegation path, >>>>>>> >>>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>>> authorized spoofers. >>>>>>> >>>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>> >>>>>>> Thanks, >>>>>>> Paul >>>>>>> >>>>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>>>> long as the delegator is willing to take the heat for=20 >>>>>>>> delegating to someone who sends a lot of bad calls. They can=20 >>>>>>>> pass the buck ("I delegated the TN to him, and now I'm not=20 >>>>>>>> responsible"), but only if the SP knows who they delegated to,=20 >>>>>>>> so authorities can follow the delegation path. There are=20 >>>>>>>> plenty of certificated carriers who are willing to not care who th= ey delegate to. The fact that there are some who do doesn't change much. >>>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>>> that you can pass the hot potato. >>>>>>>> >>>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20 >>>>>>>> any calls placed on its network on any number it has been delegate= d. >>>>>>>> If it does, it's asserting that the calls are from who they are su= pposed to be from. >>>>>>>> That should be straightforward, but we know it's not always,=20 >>>>>>>> and that represents the hard part of deployment in my opinion. =20 >>>>>>>> But once they delegate, they can hand responsibility to sign to=20 >>>>>>>> the delegatee. But, that only works if they know who they are del= egating to. >>>>>>>> >>>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>>> informal delegation path for telephone numbers in every=20 >>>>>>>> country, and we can build a chain of trust from that delegation=20 >>>>>>>> path. If you propose to alter that model, then we get into=20 >>>>>>>> (policy) issues of which carriers/entities we trust and which we d= on't. >>>>>>>> Our model is that you know who you delegate to, and once you do th= at delegation, it's their problem. >>>>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>>>> business practices. >>>>>>>> >>>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>>> =20 >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>>>> and use cases. >>>>>>>>> >>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>>>> individual devices as well as multi-device and multi-number platf= orms. >>>>>>>>> >>>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>>> relationships are two additional factors which affect=20 >>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>> >>>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>>> reason for suggesting a way to qualify the signature to=20 >>>>>>>>> reflect that variability. >>>>>>>>> >>>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>>>> can qualify to some degree the trustworthiness of number authenti= city accordingly. >>>>>>>>> >>>>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>>>> (both for the carriers and the consumers) and I assume diminishes= value. >>>>>>>>> >>>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>>> relationship with typical consumers adds to the=20 >>>>>>>>> trustworthiness assessment and partially because carriers are=20 >>>>>>>>> a regulated point of forensic inquiry for CALEA and fraud. =20 >>>>>>>>> Additionally, most calls originate and terminate between=20 >>>>>>>>> mobile consumers where their carriers are able to usefully=20 >>>>>>>>> authenticate their device and have a high degree of confidence of= the authenticity of the calling number. >>>>>>>>> >>>>>>>>> I think billions of per-TN certs of varying usability=20 >>>>>>>>> (revoked, not >>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>> >>>>>>>>> Conversely, I think billions of per-TN certs will work well,=20 >>>>>>>>> if the calling party has to sign a call with a per-TN cert=20 >>>>>>>>> provided by the called party. No called party cert to include? >>>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>>> with the called party, and the call can be authorized/treated acc= ordingly. >>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> =20 >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>>> >; stir@ietf.org=20 >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>>> deployed on devices and PBXs. Whether they will be is a policy i= ssue. >>>>>>>>> >>>>>>>>> The notion of credentials that are traceable to a delegation=20 >>>>>>>>> of a TN is a mechanism that is part of the design of stir, and=20 >>>>>>>>> the design allows delegation of one TN (to one device,=20 >>>>>>>>> although a device like a PBX would have more than one TN per=20 >>>>>>>>> "device", and something like a dual NAM phone could have more=20 >>>>>>>>> than one credential. For the use case we've discussed, a=20 >>>>>>>>> mobile phone may also have a credential for, say, a TN that is=20 >>>>>>>>> delegated to a landline, to cover the example case of a doctor=20 >>>>>>>>> placing a call on his mobile, but getting his office number to sh= ow up as the calling party. Use of such mechanisms is policy. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO]=20 >>>>>>>>> =20 >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy=20 >>>>>>>>> discussion. Regardless, I do appreciate your explanation. I=20 >>>>>>>>> would like to continue the discussion, but I'm pretty sure=20 >>>>>>>>> this isn't the right forum. >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> =20 >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >;=20 >>>>>>>>> stir@ietf.org >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20 >>>>>>>>> and any other devices that can be programmed to do so. >>>>>>>>> They will be given credentials that only are valid for the=20 >>>>>>>>> TNs they are authorized to sign for. They can try to sign any=20 >>>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>>> signature fail the checking. >>>>>>>>> >>>>>>>>> Getting service providers to sign on behalf of devices is a=20 >>>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20 >>>>>>>>> want to get out of the liability of signing on behalf of=20 >>>>>>>>> their customers. If they can push of that responsibility to=20 >>>>>>>>> their customer, only being responsible for getting the=20 >>>>>>>>> customer an appropriate credential when they assign TNs, then=20 >>>>>>>>> I would expect them to want to do so. That means the devices=20 >>>>>>>>> have to be able to sign, but I understand many of the PBX=20 >>>>>>>>> vendors think that's something they could provide in a future re= lease. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>> > >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>> extraordinarily easy to commit fraud with authenticated numb= ers? >>>>>>>>> >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org=20 >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> First of all, we would want the PBX to generate the signatur= e, >>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>> support the extra delegation required to support "authorized >>>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>>> calls from the same service provider and should not present >>>>>>>>> any issue. >>>>>>>>> >>>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > wrote: >>>>>>>>> >>>>>>>>> Fraud from compromised PBXes is common. And even where = a >>>>>>>>> PBX is not compromised, a carrier has no practical way o= f >>>>>>>>> knowing whether the calling number is properly assigned >>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>> Therefore, checking whether the calling number was from = an >>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>> administrative challenges), but of limited value. And i= n >>>>>>>>> the consumer market, there are calling products which >>>>>>>>> support a parent subscriber number and "companion" devic= es >>>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>>> the parent subscriber. These are examples of where the >>>>>>>>> authenticity of the calling number won't necessarily mea= n >>>>>>>>> the same thing as the authenticity of a call from a sing= le >>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>> spoof checking. >>>>>>>>> >>>>>>>>> In another forum and anticipating calling number >>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>> number, and validty of the calling number (assuming nonc= e >>>>>>>>> and replay issues can be addressed as reasonably suggest= ed >>>>>>>>> below by Alex). >>>>>>>>> >>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>> could be as follows: >>>>>>>>> >>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>> >>>>>>>>> *00 - No Credentials* >>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>> networks that don't natively support SIP or which don't >>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>> entirely untrustworthy. >>>>>>>>> >>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>>> agreement, manual roaming. >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>>> untrustworthy >>>>>>>>> >>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>> Use case example(s): Number block delegated from OCN, bu= t >>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less tha= n >>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>> >>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>> trustworthy >>>>>>>>> >>>>>>>>> *Public Use Case:* >>>>>>>>> >>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>> available authentication services resources. e.g., >>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera= . >>>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>>> which would process them according to the rules of the >>>>>>>>> Public Class application(s). >>>>>>>>> >>>>>>>>> Pierce >>>>>>>>> >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>> *To:* Alex Bobotek >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>> >>>>>>>>> There are reasonable circumstances where a party placing= a >>>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>>> service provider servicing the entity placing the call m= ay >>>>>>>>> or may not be the same as the service provider serving t= he >>>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>>> entity that is assigned the TN explicitly authorizes cal= ls >>>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>> authentication. We're not aware of any cases where the= re >>>>>>>>> is an actual requirement for legitimate calling without >>>>>>>>> explicit authorization from the assigned entity, althoug= h >>>>>>>>> we certainly are aware that various parts of various >>>>>>>>> service providers don't bother to check. At this point, = at >>>>>>>>> least in some countries, there is a realization that the >>>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>>> any more. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>> =20 >>>>>>>>> > wrote: >>>>>>>>> >>>>>>>>> 1. Permit authorization without authentication >>>>>>>>> In the current telephony network practice, some >>>>>>>>> service provider implementations choose not to >>>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>>> established that there are not? How can the industr= y >>>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>> identifying the originating service provider >>>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>> important to identify the service provider(s) closes= t >>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>> better to ID service providers than unreasonably >>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>> therefore unsigned) SIP requests, STIR signing shoul= d >>>>>>>>> support authorization without authentication. The >>>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>>> and there is benefit to signing in these cases >>>>>>>>> (service provider identification). The language of >>>>>>>>> the ID should permit this use. 4474bis-10 should NO= T >>>>>>>>> require or assume that that authentication will >>>>>>>>> precede authorization. Of course there may be other >>>>>>>>> use cases where signing includes authentication and >>>>>>>>> may not include a specific service provider's >>>>>>>>> authorization. >>>>>>>>> >>>>>>>>> >>>>>>>>> 2. Improve replay prevention >>>>>>>>> Proximate replay is possible while complying with th= is >>>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>>> mky may not be present and if present its use is >>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>> signed sequence, random # or request ID (e.g., Call-= ID >>>>>>>>> or CSeq) and a 1-time use policy on the receiving en= d >>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>> faked MESSAGE based on a captured request. This migh= t >>>>>>>>> include an mkey from a captured INVITE. So it may = be >>>>>>>>> possible to DOS, spam or text-bomb a recipient using= a >>>>>>>>> captured identity. While large-scale or distributed >>>>>>>>> implementations may make the enforcement difficult, >>>>>>>>> there is little cost to signing and decoding a metho= d >>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>> practice should at least be discussed while perhaps >>>>>>>>> not required. >>>>>>>>> >>>>>>>>> >>>>>>>>> Specific markup suggestions: >>>>>>>>> >>>>>>>>> >>>>>>>>> NITS >>>>>>>>> >>>>>>>>> >>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>> parameter appearing *in*the >>>>>>>>> >>>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>>> present, then the >>>>>>>>> >>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>> parameter value is >>>>>>>>> >>>>>>>>> present, and the verifier does not support it,=20 >>>>>>>>> it MUST ignore the >>>>>>>>> >>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>> parameter value is present, >>>>>>>>> >>>>>>>>> the verifier follows the procedures below,=20 >>>>>>>>> including the variations >>>>>>>>> >>>>>>>>> described in Step 5. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> 3 >>>>>>>>> . >>>>>>>>> Background >>>>>>>>> >>>>>>>>> [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Per [RFC7340 >>>>>>>>> ], problems such as=20 >>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>> >>>>>>>>> swatting are enabled by an attacker's ability=20 >>>>>>>>> to impersonate someone >>>>>>>>> >>>>>>>>> else. The secure operation of most SIP=20 >>>>>>>>> applications and services >>>>>>>>> >>>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>>> the source of communications as it is >>>>>>>>> >>>>>>>>> represented in a SIP request. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>>> includes provisions for a logical >>>>>>>>> >>>>>>>>> "authentication service" which validates=20 >>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>> requests. An >>>>>>>>> >>>>>>>>> authentication service may be implemented=20 >>>>>>>>> either as part of a user >>>>>>>>> >>>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>>> component of a network >>>>>>>>> >>>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>>> user agents send >>>>>>>>> >>>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>>> message has been >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> This document specifies a means of sharing a=20 >>>>>>>>> cryptographic assurance >>>>>>>>> >>>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>> >>>>>>>>> It relies on the authentication service=20 >>>>>>>>> constructing tokens based on [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>>> typically obviously >>>>>>>>> >>>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>>> credentials; if they >>>>>>>>> >>>>>>>>> do, their user agents can act as=20 >>>>>>>>> authentication services. However, >>>>>>>>> >>>>>>>>> for some deployments, [...] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> >>>>>>>>> Alex >>>>>>>>> * * >>>>>>>>> *Alex Bobotek* >>>>>>>>> >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> -------------------------------------------------------------- >>>>>>>>> - >>>>>>>>> -- >>>>>>>>> ------- >>>>>>>>> >>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>> intended for the sole use of the recipient(s). Any use b= y >>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>> recipient, please contact the sender and delete all copi= es >>>>>>>>> of the message. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org =20 >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >>> >>> >>> >>> >>> ________________________________ >>> >>> This e-mail may contain Sprint proprietary information intended for the= sole use of the recipient(s). Any use by others is prohibited. If you are = not the intended recipient, please contact the sender and delete all copies= of the message. >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Mon Aug 8 12:13:52 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E66812B046 for ; Mon, 8 Aug 2016 12:13:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wrAkNUqs34Jg for ; Mon, 8 Aug 2016 12:13:37 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF86812D0E1 for ; Mon, 8 Aug 2016 12:13:36 -0700 (PDT) Received: from pps.filterd (m0049459.ppops.net [127.0.0.1]) by m0049459.ppops.net-00191d01. (8.16.0.11/8.16.0.11) with SMTP id u78FURgw008380; Mon, 8 Aug 2016 11:32:18 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049459.ppops.net-00191d01. with ESMTP id 24pvd5gy4s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 08 Aug 2016 11:32:18 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u78FWG9T007122; Mon, 8 Aug 2016 11:32:17 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u78FVwuO006645 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 8 Aug 2016 11:32:07 -0400 Received: from MISOUT7MSGHUBAC.ITServices.sbc.com (MISOUT7MSGHUBAC.itservices.sbc.com [130.9.129.147]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Mon, 8 Aug 2016 15:31:39 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.146]) by MISOUT7MSGHUBAC.ITServices.sbc.com ([130.9.129.147]) with mapi id 14.03.0301.000; Mon, 8 Aug 2016 11:31:39 -0400 From: "DOLLY, MARTIN C" To: "Gorman, Pierce A [CTO]" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ybRsWQuDxcKz0ueE1p7VelBT6A6wFcAgAAZW4CAAAHSAP//ywiigAS2aYD//9iR8A== Date: Mon, 8 Aug 2016 15:31:37 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu>, <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> In-Reply-To: <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.153.107] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-08_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608080169 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Richard Shockey , Paul Kyzivat , "stir@ietf.org" , Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 19:13:44 -0000 29.165 -----Original Message----- From: Gorman, Pierce A [CTO] [mailto:Pierce.Gorman@sprint.com]=20 Sent: Monday, August 08, 2016 9:52 AM To: DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Paul Kyzivat ; = Richard Shockey Subject: RE: [stir] STIR 4474bis-10 comments Martin, You referenced TS 29.195. I'm not familiar with that spec. Has it been de= precated? It's not showing up on the 3GPP site. I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the origina= ting side" Note 4 it states, " It is assumed that the IBCF is responsible f= or stripping the P-Asserted-Identity from the SIP header when interworking = with untrusted networks." Your remark is consistent with Note 4, but only if we agree that, for insta= nce, the AT&T network and the Sprint network are "trusted networks". In re= ality, this is not the case or there would be no firewalls or Session Borde= r Controllers used for interworking and security. My opinion is the only c= arrier networks that are trusted are the SS7 network, and the Internet back= bone. What it really comes down to is that PAI is left in signaling either throug= h formal specification as a part of an inter-carrier inter-connection agree= ment, or by custom (or even by accident). I think this illustrates Paul Ro= sbotham's observation is true.=20 Pierce -----Original Message----- From: DOLLY, MARTIN C [mailto:md3135@att.com] Sent: August 05, 2016 12:55 PM To: Gorman, Pierce A [CTO] Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Paul Kyzivat ; = Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments PAI is not stripped at the network boundary between trusted networks 3GPP T= S 29.195 Atis specs GSMA Atis sip forum task force ITU And the list goes on Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: >=20 > Which header the carrier chooses to display is moot if the header is stri= pped between carriers as per at least one standard. I think Paul Rosbotham= 's observation we're likely to encounter "some interesting interworking cha= llenges" was perhaps the understatement of the year. >=20 > Pierce >=20 > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 05, 2016 11:58 AM > To: Gorman, Pierce A [CTO] ; Richard Shockey=20 > ; Rosbotham, Paul, Vodafone UK=20 > ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > If PAI is present and signed, and From is also signed, I would expect it = to be up to the UA to decide what to display, not the carrier. >=20 > Of course this will work differently if there is a different signaling re= gime between the carrier and the user device (e.g. black phone). >=20 > Thanks, > Paul >=20 >> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" = and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-= Identity is stripped by border controller functions and is not to be used i= n inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. >>=20 >> Pierce >>=20 >>=20 >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul=20 >> Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>=20 >> Humm this is getting interesting. Its my understanding that the display= number aka "presentation number" in the US context is the one carried in t= he PAI. Martin, Pierce? >>=20 >>=20 >>=20 >>=20 >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >>=20 >> Jumping in now that we're on European working time, +1 on Paul's obse= rvation. >>=20 >> Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. >>=20 >> Only the carrier has the authority to set the Network Number so only = they could sign it. >>=20 >> But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. >>=20 >> What I want is the ability for customers to use their credentials=20 >> to sign the CLIs they send me so that at the terminating end it can=20 >> be checked (or indeed somewhere en-route if that's the business model). >> I can and would sign for customers on my mobile business since I'm=20 >> driving what number is presented, but that's by-the-by because they=20 >> aren't the ones who generate millions of nuisance calls. If the=20 >> signing only occurs at the originating carrier level for=20 >> corporate/call-centre customers that's no use because I'm not in a=20 >> position to do that for these type of customers...and the whole=20 >> system becomes a waste of time. I'd also highlight there are many=20 >> more of my large customers that I'd trust more than a far end=20 >> originating carrier that could be anywhere in the world (though we=20 >> have no shortage of small carriers that I wouldn't know from Adam=20 >> more locally in the >> UK....) >>=20 >> Regards >>=20 >> Paul >>=20 >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>>=20 >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >>=20 >> IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. >>=20 >> Thanks, >> Paul >>=20 >>> Brian >>>=20 >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>>=20 >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline=20 >>>>> carrier to him. He then creates another credential, which he=20 >>>>> signs with his office phone credential that authorizes his mobile=20 >>>>> to send calls from his office number. He is spoofing (because the=20 >>>>> call is coming from his mobile's TN but claims to be from his=20 >>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>> credential to his mobile SP if they sign on his behalf. >>>>=20 >>>> I don't understand how that is different from regular delegation. >>>>=20 >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>>=20 >>>> Thanks, >>>> Paul >>>>=20 >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>>=20 >>>>> But that's how I describe it. >>>>>=20 >>>>> Brian >>>>>=20 >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>>=20 >>>>>> +1, but with one question below: >>>>>>=20 >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation=20 >>>>>>> path, >>>>>>=20 >>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>> authorized spoofers. >>>>>>=20 >>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>=20 >>>>>> Thanks, >>>>>> Paul >>>>>>=20 >>>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>>> long as the delegator is willing to take the heat for delegating=20 >>>>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>> that you can pass the hot potato. >>>>>>>=20 >>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20 >>>>>>> any calls placed on its network on any number it has been delegated= . >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and=20 >>>>>>> that represents the hard part of deployment in my opinion. But=20 >>>>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>>=20 >>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>> informal delegation path for telephone numbers in every country,=20 >>>>>>> and we can build a chain of trust from that delegation path. If=20 >>>>>>> you propose to alter that model, then we get into (policy)=20 >>>>>>> issues of which carriers/entities we trust and which we don't. >>>>>>> Our model is that you know who you delegate to, and once you do tha= t delegation, it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>>> business practices. >>>>>>>=20 >>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>>=20 >>>>>>> Brian >>>>>>>=20 >>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>>> and use cases. >>>>>>>>=20 >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>>=20 >>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>> relationships are two additional factors which affect=20 >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>=20 >>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>>>> that variability. >>>>>>>>=20 >>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>>=20 >>>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>>=20 >>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>> relationship with typical consumers adds to the trustworthiness=20 >>>>>>>> assessment and partially because carriers are a regulated point=20 >>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most=20 >>>>>>>> calls originate and terminate between mobile consumers where=20 >>>>>>>> their carriers are able to usefully authenticate their device=20 >>>>>>>> and have a high degree of confidence of the authenticity of the ca= lling number. >>>>>>>>=20 >>>>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>=20 >>>>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>>>> the calling party has to sign a call with a per-TN cert=20 >>>>>>>> provided by the called party. No called party cert to include? >>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>> with the called party, and the call can be authorized/treated acco= rdingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>> deployed on devices and PBXs. Whether they will be is a policy is= sue. >>>>>>>>=20 >>>>>>>> The notion of credentials that are traceable to a delegation of=20 >>>>>>>> a TN is a mechanism that is part of the design of stir, and the=20 >>>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>> credential. For the use case we've discussed, a mobile phone=20 >>>>>>>> may also have a credential for, say, a TN that is delegated to=20 >>>>>>>> a landline, to cover the example case of a doctor placing a=20 >>>>>>>> call on his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy=20 >>>>>>>> discussion. Regardless, I do appreciate your explanation. I=20 >>>>>>>> would like to continue the discussion, but I'm pretty sure this=20 >>>>>>>> isn't the right forum. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20 >>>>>>>> and any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs=20 >>>>>>>> they are authorized to sign for. They can try to sign any=20 >>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>> signature fail the checking. >>>>>>>>=20 >>>>>>>> Getting service providers to sign on behalf of devices is a=20 >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20 >>>>>>>> want to get out of the liability of signing on behalf of their=20 >>>>>>>> customers. If they can push of that responsibility to their=20 >>>>>>>> customer, only being responsible for getting the customer an=20 >>>>>>>> appropriate credential when they assign TNs, then I would=20 >>>>>>>> expect them to want to do so. That means the devices have to=20 >>>>>>>> be able to sign, but I understand many of the PBX vendors=20 >>>>>>>> think that's something they could provide in a future release. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>>=20 >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated numbe= rs? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> First of all, we would want the PBX to generate the signature= , >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>>=20 >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from a= n >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" device= s >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a singl= e >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>>=20 >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggeste= d >>>>>>>> below by Alex). >>>>>>>>=20 >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>>=20 >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>=20 >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>>=20 >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>=20 >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>>=20 >>>>>>>> *Public Use Case:* >>>>>>>>=20 >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>> There are reasonable circumstances where a party placing = a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call ma= y >>>>>>>> or may not be the same as the service provider serving th= e >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes call= s >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where ther= e >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, a= t >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>>=20 >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with thi= s >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-I= D >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may b= e >>>>>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Specific markup suggestions: >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> NITS >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>>=20 >>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>> present, then the >>>>>>>>=20 >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>>=20 >>>>>>>> present, and the verifier does not support it,=20 >>>>>>>> it MUST ignore the >>>>>>>>=20 >>>>>>>> Identity header. If a supported "ppt"=20 >>>>>>>> parameter value is present, >>>>>>>>=20 >>>>>>>> the verifier follows the procedures below,=20 >>>>>>>> including the variations >>>>>>>>=20 >>>>>>>> described in Step 5. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>>=20 >>>>>>>> [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as=20 >>>>>>>> robocalling, voicemail hacking, and >>>>>>>>=20 >>>>>>>> swatting are enabled by an attacker's ability=20 >>>>>>>> to impersonate someone >>>>>>>>=20 >>>>>>>> else. The secure operation of most SIP=20 >>>>>>>> applications and services >>>>>>>>=20 >>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>> the source of communications as it is >>>>>>>>=20 >>>>>>>> represented in a SIP request. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>> includes provisions for a logical >>>>>>>>=20 >>>>>>>> "authentication service" which validates caller=20 >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>>=20 >>>>>>>> authentication service may be implemented=20 >>>>>>>> either as part of a user >>>>>>>>=20 >>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>> component of a network >>>>>>>>=20 >>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>> user agents send >>>>>>>>=20 >>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>> message has been >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> This document specifies a means of sharing a=20 >>>>>>>> cryptographic assurance >>>>>>>>=20 >>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>=20 >>>>>>>> It relies on the authentication service=20 >>>>>>>> constructing tokens based on [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>> typically obviously >>>>>>>>=20 >>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>> credentials; if they >>>>>>>>=20 >>>>>>>> do, their user agents can act as authentication=20 >>>>>>>> services. However, >>>>>>>>=20 >>>>>>>> for some deployments, [...] >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Regards, >>>>>>>>=20 >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> --------------------------------------------------------------- >>>>>>>> -- >>>>>>>> ------- >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copie= s >>>>>>>> of the message. >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >>=20 >>=20 >>=20 >>=20 >> ________________________________ >>=20 >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 8 12:46:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 599E212B03F for ; Mon, 8 Aug 2016 12:46:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zg5GWJJlljxm for ; Mon, 8 Aug 2016 12:46:22 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A66B412B004 for ; Mon, 8 Aug 2016 12:46:21 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u78Jgj74005460; Mon, 8 Aug 2016 15:46:14 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=sTSk43vqu/tFYBfpsxrlHogxbZP/jslOySo6KVt6aBk=; b=azmg4ooQCIQ2T0x3+eqEvX4DYyqM3Chn0yxRmSBo3AbImvrqqfsByrdwAR+PpMbxz+iM JPu/mFDrLJNNiHH7XQDct/rQYc06XMGVS/oC8N6F2vo42gPB0L/+A4wEkQQ9ZWf3C3ud b3P3FWm+fg7YErhcdUDyMWI29eVBuaC+eq6+6ijOX8vw94Km+qwZlUvugtLvjHE8lx0w n4vs4T3ru0JBxytxsi1RqY/GIZjVFlkuFhjXy5Mw+H3yfgpp+M0zydz0VonjdPSj9Lge 2LJKwavE7PShx/ggidnNHbee8u/UObDQFrCkkl1xUKUc4ZSFooFlT5tTU25DlO96zMq4 Rg== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24napjxyt6-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Mon, 08 Aug 2016 15:46:14 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Mon, 8 Aug 2016 15:46:13 -0400 From: "Peterson, Jon" To: "Gorman, Pierce A [CTO]" , Paul Kyzivat , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AdHtnZL44XSdzpn5S4ezxStpcxWG/gA3LKKAAAWRJoAAAX9oAAACCpWAAABpDgAAAKK4AAAAWieAAAPgt4AAALpEgAAAy/8AAAA1f4AAAEbIAAAAZjkAAABSQQAAFBF5gAAOVnSAAAG+lwAAAytegAAAOkMAAAHCnQAAjmtqgAAD/5AAAADbMoAAAc19AAADVf2A//+dhAA= Date: Mon, 8 Aug 2016 19:46:12 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <45E38265EFEEB349AABEEF0EF2E5A5EC@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-08_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608080211 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Richard Shockey , "stir@ietf.org" , Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 19:46:40 -0000 Just so I'm clear, I'm not hearing an ask here in terms of changing the text of rfc4474bis-10, which does allow signing PAI instead of From for precisely the reasons outlined in this lengthy thread. To Alex's original point about providing authorization without authentication, rfc4474bis has a lot of text about signing non-TN identifiers, including for preserving anonymity; see the end of section 6.1, and then the Privacy Considerations in section 11 for more. Those should suffice to provide this property: it will identify the service provider who signed without attesting an specific user identity. I also wanted to make sure we didn't drop the other ball that Alex mentioned at the start of this thread, which is the issue of proximate replay within the 60 second Date window. This is addressed in Section 12.1 of rfc4474bis-10, which reads: "Note that per baseline [RFC3261] behavior, servers keep state of recently received requests, and thus if an Identity header is replayed by an attacker within the Date interval, verifiers can detect that it is spoofed because a message with an identical Date from the same source had recently been received." This refers to the text of RFC3261 section 23.4.2, though more properly the Date-related behavior is better detailed in RFC3893 Section 10, which introduced the first version of the partial signature mechanism that ultimately inspired RFC4474. I'll update the text here so it is clearer about exactly how to detect proximate replay. Jon Peterson Neustar, Inc. On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" wrote: >Paul, > >As you know, SIP inter-working is often challenging because of >variability in implementation including proprietary headers (without an >X-) and support or lack thereof for non-mandatory (per RFC 3261) headers >such as P-Asserted-Identity, (and things like B2BUA stacks stripping >things like display name in From but that's another story). I could >argue that from a cleanliness of protocol implementation, (and if I >wanted to be pedantic), I would strip PAI outbound unless required >otherwise. But the point is moot. As I mentioned in the earlier e-mail, >that is not our practice and I'm not requesting it to be so. > >Pierce > > >-----Original Message----- >From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >Sent: August 08, 2016 12:03 PM >To: Gorman, Pierce A [CTO] ; Dwight, Timothy M >(Tim) ; DOLLY, MARTIN C >Cc: Rosbotham, Paul, Vodafone UK ; Richard >Shockey ; stir@ietf.org; Brian Rosen > >Subject: Re: [stir] STIR 4474bis-10 comments > >On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >> Thanks for the added comments Tim. >> >> I agree that passing P-Asserted-Identity between trusted networks is >> appropriate (and the converse is true as well). Part of my issue is I >> have been conditioned from the very earliest implementation of >> Sprint's VoIP network that other carriers' IP networks are inherently >> untrusted. I've been browsing TS 29.165 and even there I find >> language that implies trust is established by agreement, not by >> standard. (Even roaming implies agreement.) > >I understand why *some* stuff needs to be removed when forwarding to an >untrusted party. For instance, if the call has requested privacy, then >P-A-ID needs to be removed. > >But when privacy is not a concern, trust is really more of a concern on >the ingress side, not egress. If I don't trust you then I won't trust a >P-A-ID you sent to me, and so *I* will remove it. But if I trust you, but >you don't trust me, then what is the downside for passing along the >P-A-ID? > > Thanks, > Paul > >> Regardless, this discussion has been helpful and educational (to me at >>least). And, I confirmed with my operations counterpart we generally >>send PAI today. I've also made note that where standards and ICA >>require it, we will include PAI. Thanks again. >> >> Best regards, >> >> Pierce >> >> -----Original Message----- >> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >> Sent: August 08, 2016 10:47 AM >> To: Gorman, Pierce A [CTO] ; DOLLY, MARTIN C >> >> Cc: Rosbotham, Paul, Vodafone UK ; >> Richard Shockey ; Paul Kyzivat >> ; stir@ietf.org; Brian Rosen >> >> Subject: RE: [stir] STIR 4474bis-10 comments >> >> Pierce, >> >> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA >>IR.95. The latter references and profiles the former. Section 4.4.1 of >>IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>considered trusted, and table 3 in that section recommends that >>P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. It >>also states that PAI is mandatory at a roaming NNI. >> >> Tim >> >> >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce >> A [CTO] >> Sent: Monday, August 08, 2016 8:52 AM >> To: DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >> stir@ietf.org; Brian Rosen >> Subject: [E] Re: [stir] STIR 4474bis-10 comments >> >> Martin, >> >> You referenced TS 29.195. I'm not familiar with that spec. Has it >>been deprecated? It's not showing up on the 3GPP site. >> >> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the >>originating side" Note 4 it states, " It is assumed that the IBCF is >>responsible for stripping the P-Asserted-Identity from the SIP header >>when interworking with untrusted networks." >> >> Your remark is consistent with Note 4, but only if we agree that, for >>instance, the AT&T network and the Sprint network are "trusted >>networks". In reality, this is not the case or there would be no >>firewalls or Session Border Controllers used for interworking and >>security. My opinion is the only carrier networks that are trusted are >>the SS7 network, and the Internet backbone. >> >> What it really comes down to is that PAI is left in signaling either >>through formal specification as a part of an inter-carrier >>inter-connection agreement, or by custom (or even by accident). I think >>this illustrates Paul Rosbotham's observation is true. >> >> Pierce >> >> -----Original Message----- >> From: DOLLY, MARTIN C [mailto:md3135@att.com] >> Sent: August 05, 2016 12:55 PM >> To: Gorman, Pierce A [CTO] >> Cc: Rosbotham, Paul, Vodafone UK ; Brian >> Rosen ; stir@ietf.org; Paul Kyzivat >> ; Richard Shockey >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> PAI is not stripped at the network boundary between trusted networks >> 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force ITU And the >> list goes on >> >> Martin C Dolly >> Lead Member of Technical Staff >> Core & Government/Regulatory Standards AT&T >> Cell: 609-903-3360 >> Email: md3135@att.com >> >>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>> wrote: >>> >>> Which header the carrier chooses to display is moot if the header is >>>stripped between carriers as per at least one standard. I think Paul >>>Rosbotham's observation we're likely to encounter "some interesting >>>interworking challenges" was perhaps the understatement of the year. >>> >>> Pierce >>> >>> -----Original Message----- >>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>> Sent: August 05, 2016 11:58 AM >>> To: Gorman, Pierce A [CTO] ; Richard >>> Shockey ; Rosbotham, Paul, Vodafone UK >>> ; Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> If PAI is present and signed, and From is also signed, I would expect >>>it to be up to the UA to decide what to display, not the carrier. >>> >>> Of course this will work differently if there is a different signaling >>>regime between the carrier and the user device (e.g. black phone). >>> >>> Thanks, >>> Paul >>> >>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>entities" and therefore some specifications (e.g., 3GPP TS 24.607) >>>>assume P-Asserted-Identity is stripped by border controller functions >>>>and is not to be used in inter-carrier inter-connection (although it >>>>commonly shows up anyway). My opinion is the "From" header is likely >>>>used more often for presentation. >>>> >>>> Pierce >>>> >>>> >>>> -----Original Message----- >>>> From: Richard Shockey [mailto:richard@shockey.us] >>>> Sent: August 05, 2016 9:37 AM >>>> To: Rosbotham, Paul, Vodafone UK ; Paul >>>> Kyzivat ; Brian Rosen >>>> Cc: stir@ietf.org >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>> >>>> Humm this is getting interesting. Its my understanding that the >>>>display number aka "presentation number" in the US context is the one >>>>carried in the PAI. Martin, Pierce? >>>> >>>> >>>> >>>> >>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" >>>> wrote: >>>> >>>> Jumping in now that we're on European working time, +1 on Paul's >>>>observation. >>>> >>>> Here in the UK, we've got 2 numbers carried as calling line >>>>IDs....one (we term the Network Number, carried in PAID) uniquely >>>>identifies the line, the other (we term Presentation Number, carried >>>>in From) is used for display purposes. >>>> >>>> Only the carrier has the authority to set the Network Number so >>>>only they could sign it. >>>> >>>> But - subject to regulatory restrictions which are well documented >>>>- the number sent for display purposes belongs to the customer. For >>>>blue-chip customers, I can allow them to send their Presentation >>>>Numbers into the network, and can't readily check at a network level >>>>that they're theirs (I do have contractual safeguards). The number >>>>may have been allocated by me, or could be allocated by a third party >>>>provider. If it's a call-centre they'll be making outbound calls for >>>>lots of different customers which will change on day-by-day basis. >>>>This is business as usual. I don't like the term "authorised >>>>spoofing" because it implies that the CLI is in some way being rigged: >>>>it's not, it's the corporate customer or their subcontractor using the >>>>number that's been assigned (so in internet terms delegated) to them >>>>via a chain of trust from the regulator. >>>> >>>> What I want is the ability for customers to use their credentials >>>> to sign the CLIs they send me so that at the terminating end it can >>>> be checked (or indeed somewhere en-route if that's the business >>>>model). >>>> I can and would sign for customers on my mobile business since I'm >>>> driving what number is presented, but that's by-the-by because they >>>> aren't the ones who generate millions of nuisance calls. If the >>>> signing only occurs at the originating carrier level for >>>> corporate/call-centre customers that's no use because I'm not in a >>>> position to do that for these type of customers...and the whole >>>> system becomes a waste of time. I'd also highlight there are many >>>> more of my large customers that I'd trust more than a far end >>>> originating carrier that could be anywhere in the world (though we >>>> have no shortage of small carriers that I wouldn't know from Adam >>>> more locally in the >>>> UK....) >>>> >>>> Regards >>>> >>>> Paul >>>> >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >>>> Sent: 04 August 2016 23:12 >>>> To: Brian Rosen >>>> Cc: stir@ietf.org >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>> I think it's not a delegation. The mobile phone is not being >>>>>delegated the TN, it's being authorized to place calls that are not >>>>>from that TN, but appear to be. >>>>> >>>>> The mechanism to handle the credential is exactly the same as a >>>>>delegation, so if you want to call it delegation, go ahead, but I >>>>>prefer to call it authorized spoofing. >>>> >>>> IIUC the delegation is to a responsible entity (something that can >>>>be held legally accountable - e.g. a person), not to a device. The >>>>entity can then "use" the credential via any device(s) it chooses. In >>>>the case of the mobile, the device then becomes a two-line phone. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> Brian >>>>> >>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>wrote: >>>>>> >>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>> In my jargon an "authorized spoofer" is the doctor who is calling >>>>>>> from his mobile, but sending the TN of his office phone as calling >>>>>>>party. >>>>>>> The delegation to his office phone was made by his landline >>>>>>> carrier to him. He then creates another credential, which he >>>>>>> signs with his office phone credential that authorizes his mobile >>>>>>> to send calls from his office number. He is spoofing (because >>>>>>> the call is coming from his mobile's TN but claims to be from his >>>>>>> office), but it's authorized spoofing. The doc could give the >>>>>>> credential to his mobile SP if they sign on his behalf. >>>>>> >>>>>> I don't understand how that is different from regular delegation. >>>>>> >>>>>> When his landline carrier gave him a delegated certificate for his >>>>>>landline number, he should be able to install that in whatever >>>>>>devices he wants - his landline UA, his mobile phone, etc. It is >>>>>>still delegated from his landline carrier, even when used with calls >>>>>>via his mobile carrier. >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>legitimate use. >>>>>>> >>>>>>> But that's how I describe it. >>>>>>> >>>>>>> Brian >>>>>>> >>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>> > wrote: >>>>>>>> >>>>>>>> +1, but with one question below: >>>>>>>> >>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>> delegation path, >>>>>>>> >>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>> authorized spoofers. >>>>>>>> >>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>> >>>>>>>>> I don't think it matters who the delegator or delegatee are as >>>>>>>>> long as the delegator is willing to take the heat for >>>>>>>>> delegating to someone who sends a lot of bad calls. They can >>>>>>>>> pass the buck ("I delegated the TN to him, and now I'm not >>>>>>>>> responsible"), but only if the SP knows who they delegated to, >>>>>>>>> so authorities can follow the delegation path. There are >>>>>>>>> plenty of certificated carriers who are willing to not care who >>>>>>>>>they delegate to. The fact that there are some who do doesn't >>>>>>>>>change much. >>>>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>>>> that you can pass the hot potato. >>>>>>>>> >>>>>>>>> It's perfectly reasonable for a carrier to be able to sign for >>>>>>>>> any calls placed on its network on any number it has been >>>>>>>>>delegated. >>>>>>>>> If it does, it's asserting that the calls are from who they are >>>>>>>>>supposed to be from. >>>>>>>>> That should be straightforward, but we know it's not always, >>>>>>>>> and that represents the hard part of deployment in my opinion. >>>>>>>>> But once they delegate, they can hand responsibility to sign to >>>>>>>>> the delegatee. But, that only works if they know who they are >>>>>>>>>delegating to. >>>>>>>>> >>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>> country, and we can build a chain of trust from that delegation >>>>>>>>> path. If you propose to alter that model, then we get into >>>>>>>>> (policy) issues of which carriers/entities we trust and which we >>>>>>>>>don't. >>>>>>>>> Our model is that you know who you delegate to, and once you do >>>>>>>>>that delegation, it's their problem. >>>>>>>>> That's pretty appealing I think, even if it's a change in some >>>>>>>>> business practices. >>>>>>>>> >>>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>>> > >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> OK, you talked me into indulging in one more message on policy >>>>>>>>>> and use cases. >>>>>>>>>> >>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on >>>>>>>>>> individual devices as well as multi-device and multi-number >>>>>>>>>>platforms. >>>>>>>>>> >>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>> >>>>>>>>>> Inherent variable trustworthiness of a calling number was my >>>>>>>>>> reason for suggesting a way to qualify the signature to >>>>>>>>>> reflect that variability. >>>>>>>>>> >>>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>>> coming from a device assigned a single number, or from "trunk >>>>>>>>>> group" which could originate calls using multiple numbers, and >>>>>>>>>> can qualify to some degree the trustworthiness of number >>>>>>>>>>authenticity accordingly. >>>>>>>>>> >>>>>>>>>> My suggestion was qualifying calling number authenticity into >>>>>>>>>> categories of carrier-signed (or not), and unauthenticated, >>>>>>>>>> semi-authenticated, and most-authenticated. There can be more >>>>>>>>>> granularity, but it implies additional operational complexity >>>>>>>>>> (both for the carriers and the consumers) and I assume >>>>>>>>>>diminishes value. >>>>>>>>>> >>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>> trustworthiness assessment and partially because carriers are >>>>>>>>>> a regulated point of forensic inquiry for CALEA and fraud. >>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>> mobile consumers where their carriers are able to usefully >>>>>>>>>> authenticate their device and have a high degree of confidence >>>>>>>>>>of the authenticity of the calling number. >>>>>>>>>> >>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>> (revoked, not >>>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>>> >>>>>>>>>> Conversely, I think billions of per-TN certs will work well, >>>>>>>>>> if the calling party has to sign a call with a per-TN cert >>>>>>>>>> provided by the called party. No called party cert to include? >>>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>>> with the called party, and the call can be authorized/treated >>>>>>>>>>accordingly. >>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>> >>>>>>>>>> Pierce >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>> >; stir@ietf.org >>>>>>>>>> >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>> deployed on devices and PBXs. Whether they will be is a policy >>>>>>>>>>issue. >>>>>>>>>> >>>>>>>>>> The notion of credentials that are traceable to a delegation >>>>>>>>>> of a TN is a mechanism that is part of the design of stir, and >>>>>>>>>> the design allows delegation of one TN (to one device, >>>>>>>>>> although a device like a PBX would have more than one TN per >>>>>>>>>> "device", and something like a dual NAM phone could have more >>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>> mobile phone may also have a credential for, say, a TN that is >>>>>>>>>> delegated to a landline, to cover the example case of a doctor >>>>>>>>>> placing a call on his mobile, but getting his office number to >>>>>>>>>>show up as the calling party. Use of such mechanisms is policy. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>>> > >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>>>> would like to continue the discussion, but I'm pretty sure >>>>>>>>>> this isn't the right forum. >>>>>>>>>> >>>>>>>>>> Pierce >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; >>>>>>>>>> stir@ietf.org >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> Of course I want PBXs to sign calls. As well as smart phones >>>>>>>>>> and any other devices that can be programmed to do so. >>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>> TNs they are authorized to sign for. They can try to sign any >>>>>>>>>> call, but the validity of the credential would make such a >>>>>>>>>> signature fail the checking. >>>>>>>>>> >>>>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>>>> reasonable way to deploy quickly, but I expect many SPs will >>>>>>>>>> want to get out of the liability of signing on behalf of >>>>>>>>>> their customers. If they can push of that responsibility to >>>>>>>>>> their customer, only being responsible for getting the >>>>>>>>>> customer an appropriate credential when they assign TNs, then >>>>>>>>>> I would expect them to want to do so. That means the devices >>>>>>>>>> have to be able to sign, but I understand many of the PBX >>>>>>>>>> vendors think that's something they could provide in a future >>>>>>>>>>release. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>> >>>>>>>>>>> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>> extraordinarily easy to commit fraud with authenticated >>>>>>>>>>numbers? >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >>>>>>>>>> >; stir@ietf.org >>>>>>>>>> >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>signature, >>>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>>> valid signature to a call from a number it did not assign >>>>>>>>>>to >>>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>>> support the extra delegation required to support >>>>>>>>>>"authorized >>>>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>>>> calls from the same service provider and should not present >>>>>>>>>> any issue. >>>>>>>>>> >>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>implement >>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>> >>>>>>>>>> > wrote: >>>>>>>>>> >>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>where a >>>>>>>>>> PBX is not compromised, a carrier has no practical way >>>>>>>>>>of >>>>>>>>>> knowing whether the calling number is properly assigned >>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>from an >>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>> administrative challenges), but of limited value. And >>>>>>>>>>in >>>>>>>>>> the consumer market, there are calling products which >>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>devices >>>>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>>>> the parent subscriber. These are examples of where the >>>>>>>>>> authenticity of the calling number won't necessarily >>>>>>>>>>mean >>>>>>>>>> the same thing as the authenticity of a call from a >>>>>>>>>>single >>>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>>> spoof checking. >>>>>>>>>> >>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>>> number, and validty of the calling number (assuming >>>>>>>>>>nonce >>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>suggested >>>>>>>>>> below by Alex). >>>>>>>>>> >>>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>>> could be as follows: >>>>>>>>>> >>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>> >>>>>>>>>> *00 - No Credentials* >>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>>> networks that don't natively support SIP or which don't >>>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>> entirely untrustworthy. >>>>>>>>>> >>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>roaming >>>>>>>>>> agreement, manual roaming. >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>entirely >>>>>>>>>> untrustworthy >>>>>>>>>> >>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>> Use case example(s): Number block delegated from OCN, >>>>>>>>>>but >>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less >>>>>>>>>>than >>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>> >>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls >>>>>>>>>>from >>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>>> trustworthy >>>>>>>>>> >>>>>>>>>> *Public Use Case:* >>>>>>>>>> >>>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>>> available authentication services resources. e.g., >>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>cetera. >>>>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>>>> which would process them according to the rules of the >>>>>>>>>> Public Class application(s). >>>>>>>>>> >>>>>>>>>> Pierce >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>> *To:* Alex Bobotek >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>> >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>placing a >>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>telephone >>>>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>>>> service provider servicing the entity placing the call >>>>>>>>>>may >>>>>>>>>> or may not be the same as the service provider serving >>>>>>>>>>the >>>>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>>>> entity that is assigned the TN explicitly authorizes >>>>>>>>>>calls >>>>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>> authentication. We're not aware of any cases where >>>>>>>>>>there >>>>>>>>>> is an actual requirement for legitimate calling without >>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>although >>>>>>>>>> we certainly are aware that various parts of various >>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>point, at >>>>>>>>>> least in some countries, there is a realization that >>>>>>>>>>the >>>>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>>>> any more. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>> >>>>>>>>>> > wrote: >>>>>>>>>> >>>>>>>>>> 1. Permit authorization without >>>>>>>>>>authentication >>>>>>>>>> In the current telephony network practice, some >>>>>>>>>> service provider implementations choose not to >>>>>>>>>> authenticate identity, but simply facilitate the >>>>>>>>>>use >>>>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>anyone >>>>>>>>>> established that there are not? How can the >>>>>>>>>>industry >>>>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>>> identifying the originating service provider >>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>prevalence >>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>closest >>>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>>> better to ID service providers than unreasonably >>>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>>> therefore unsigned) SIP requests, STIR signing=20 >>>>>>>>>>should >>>>>>>>>> support authorization without authentication. The >>>>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>> (service provider identification). The language of >>>>>>>>>> the ID should permit this use. 4474bis-10 should=20 >>>>>>>>>>NOT >>>>>>>>>> require or assume that that authentication will >>>>>>>>>> precede authorization. Of course there may be other >>>>>>>>>> use cases where signing includes authentication and >>>>>>>>>> may not include a specific service provider's >>>>>>>>>> authorization. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> 2. Improve replay prevention >>>>>>>>>> Proximate replay is possible while complying with=20 >>>>>>>>>>this >>>>>>>>>> spec. First, one or more proximate (e.g., within=20 >>>>>>>>>>60 >>>>>>>>>> seconds) SIP requests using the same token are=20 >>>>>>>>>>legal >>>>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>>>> mky may not be present and if present its use is >>>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>>> signed sequence, random # or request ID (e.g.,=20 >>>>>>>>>>Call-ID >>>>>>>>>> or CSeq) and a 1-time use policy on the receiving=20 >>>>>>>>>>end >>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>> use) could prevent replay. Different methods=20 >>>>>>>>>>(e.g., >>>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>>> receiving infrastructure, and therefore=20 >>>>>>>>>>difficulties >>>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>>> faked MESSAGE based on a captured request. This=20 >>>>>>>>>>might >>>>>>>>>> include an mkey from a captured INVITE. So it=20 >>>>>>>>>>may be >>>>>>>>>> possible to DOS, spam or text-bomb a recipient=20 >>>>>>>>>>using a >>>>>>>>>> captured identity. While large-scale or=20 >>>>>>>>>>distributed >>>>>>>>>> implementations may make the enforcement difficult, >>>>>>>>>> there is little cost to signing and decoding a=20 >>>>>>>>>>method >>>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>>> practice should at least be discussed while perhaps >>>>>>>>>> not required. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Specific markup suggestions: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> NITS >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>>> parameter appearing *in*the >>>>>>>>>> >>>>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>>>> present, then the >>>>>>>>>> >>>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>>> parameter value is >>>>>>>>>> >>>>>>>>>> present, and the verifier does not support it,=20 >>>>>>>>>> it MUST ignore the >>>>>>>>>> >>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>> parameter value is present, >>>>>>>>>> >>>>>>>>>> the verifier follows the procedures below,=20 >>>>>>>>>> including the variations >>>>>>>>>> >>>>>>>>>> described in Step 5. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> 3 >>>>>>>>>> =20 >>>>>>>>>>>>>>>>>>>s-10%20-%20Authenticated%20Identity%20Management%20in%20the%20Ses >>>>>>>>>>sion%20Initiation%20Protocol%20%28SIP%29.htm#section-3>. >>>>>>>>>> Background >>>>>>>>>> >>>>>>>>>> [...] >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Per [RFC7340 >>>>>>>>>> ], problems such as=20 >>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>> >>>>>>>>>> swatting are enabled by an attacker's ability=20 >>>>>>>>>> to impersonate someone >>>>>>>>>> >>>>>>>>>> else. The secure operation of most SIP=20 >>>>>>>>>> applications and services >>>>>>>>>> >>>>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>>>> the source of communications as it is >>>>>>>>>> >>>>>>>>>> represented in a SIP request. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>>>> includes provisions for a logical >>>>>>>>>> >>>>>>>>>> "authentication service" which validates=20 >>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>> requests. An >>>>>>>>>> >>>>>>>>>> authentication service may be implemented=20 >>>>>>>>>> either as part of a user >>>>>>>>>> >>>>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>>>> component of a network >>>>>>>>>> >>>>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>>>> user agents send >>>>>>>>>> >>>>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>>>> message has been >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> This document specifies a means of sharing a=20 >>>>>>>>>> cryptographic assurance >>>>>>>>>> >>>>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>>>> >>>>>>>>>> It relies on the authentication service=20 >>>>>>>>>> constructing tokens based on [...] >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>>>> typically obviously >>>>>>>>>> >>>>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>>>> credentials; if they >>>>>>>>>> >>>>>>>>>> do, their user agents can act as=20 >>>>>>>>>> authentication services. However, >>>>>>>>>> >>>>>>>>>> for some deployments, [...] >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Regards, >>>>>>>>>> >>>>>>>>>> Alex >>>>>>>>>> * * >>>>>>>>>> *Alex Bobotek* >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -------------------------------------------------------------- >>>>>>>>>> - >>>>>>>>>> -- >>>>>>>>>> ------- >>>>>>>>>> >>>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>>> intended for the sole use of the recipient(s). Any use= =20 >>>>>>>>>>by >>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>> recipient, please contact the sender and delete all=20 >>>>>>>>>>copies >>>>>>>>>> of the message. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org =20 >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org =20 >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> >>>> >>>> >>>> >>>> ________________________________ >>>> >>>> This e-mail may contain Sprint proprietary information intended for=20 >>>>the sole use of the recipient(s). Any use by others is prohibited. If=20 >>>>you are not the intended recipient, please contact the sender and=20 >>>>delete all copies of the message. >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 8 13:01:33 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EC0312D0CB for ; Mon, 8 Aug 2016 13:01:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YY3-mswO8OUA for ; Mon, 8 Aug 2016 13:01:09 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0107.outbound.protection.outlook.com [104.47.41.107]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 276CB12D09C for ; Mon, 8 Aug 2016 13:01:09 -0700 (PDT) Received: from BN1BFFO11FD017.protection.gbl (10.58.144.32) by BN1BFFO11HUB018.protection.gbl (10.58.144.165) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Mon, 8 Aug 2016 20:01:06 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.38) smtp.mailfrom=sprint.com; shockey.us; dkim=none (message not signed) header.d=none;shockey.us; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.38 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.38; helo=plsapdm2.corp.sprint.com; Received: from plsapdm2.corp.sprint.com (144.230.172.38) by BN1BFFO11FD017.mail.protection.outlook.com (10.58.144.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Mon, 8 Aug 2016 20:01:06 +0000 Received: from pps.filterd (plsapdm2.corp.sprint.com [127.0.0.1]) by plsapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u78Jpvme015010; Mon, 8 Aug 2016 15:01:05 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm2.corp.sprint.com with ESMTP id 24ndp5359n-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 08 Aug 2016 15:01:05 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 8 Aug 2016 15:01:04 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 8 Aug 2016 15:01:04 -0500 From: "Gorman, Pierce A [CTO]" To: "Peterson, Jon" , Paul Kyzivat , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7aA/FoDwgAAi/SCAAAN8MIAAZ50A///C0nCAAGrAAP//sEMg Date: Mon, 8 Aug 2016 20:01:03 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.40] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.38; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(189002)(252514010)(24454002)(199003)(43784003)(51914003)(13464003)(377454003)(8936002)(93886004)(8746002)(81156014)(86362001)(24736003)(7846002)(81166006)(5890100001)(5250100002)(50986999)(47776003)(68736007)(8666005)(54356999)(108616004)(97756001)(106466001)(4326007)(76176999)(8676002)(305945005)(7736002)(11100500001)(33646002)(7696003)(15975445007)(87936001)(46406003)(2900100001)(6116002)(356003)(5001770100001)(325944008)(189998001)(19580405001)(3846002)(23726003)(102836003)(2171001)(586003)(106116001)(19580395003)(97736004)(2906002)(50466002)(92566002)(2950100001)(7059030)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1BFFO11HUB018; H:plsapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11FD017; 1:Zlq/2ryxoHHejxRZc0EjzMejFOkEOfU8zp234D+deIRpjkgtdzGelFC7tt/7wtDd1YsngVhRyUCYu+xaxQHmRvQUFsbWEeuhONFyRV4yUIy1G0zb9tw9+EWv4lAIT4kw9nzo12fykbPbQyogTfmbqYq5gIDsBmlgVr4swztHRoyYIMSgviNF1hi0a2cJSVZXKjaoGZHvt5cCdTv57b95pWgD1uE0z4LxFzHplsl2mtvPmLCo8bAwwaieN3iaKqHWh28+TDT/h/PGf4WsUnqJM/afb8J4n1yNj4QeFJF4OiPBZ8KT4ZjVAVtGtnpHWZEYzx6nn/H1Jyv5mfsTsGJc8oRbj3GWYyWIsmPbwlg+6xYL7ETdF9xyhKaiAeA0GyKDgu0EeidPUBBx6EUzn4gO8mw6F2ccS2oi4CNicsKv34cgor/gRXztC5PjYVDHaAQMetK52ILU10c3QWYYyR/XpiL+7VFQ/0V53sSWYEEEtZQcnrhUlFrs5HCUHXPIwWzrk3GZmZuRZCLik7FaowMOtMDn8bzdDZ2NkMOrdzdQAMiVP6Is1mX2Z6N8lLeKeK2jxW3d5m3RQhTzq9rvnrv5Fw== X-MS-Office365-Filtering-Correlation-Id: 731f3107-7c52-4e5a-e308-08d3bfc6bbdd X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB018; 2:bZ96hAPFe6sX5q/OfMyzQxWPC24ItFAPcL8NeQ92e3RHjEfxF7IxQVhdqUw7+AOFFVAqC2xw1fgqBVPUA8A0Mj1Jz1QE1WGflOzHCXbGlmVqTylxFi+K4gemryrfGkZWxVxKmjTXfeO7YtBHR132GuXSRN4P9yhlXNSyo5aalnmGcW9bXP44gqb1jbpMIU1i; 3:NEQDe7mkp03LmyffjftOxHl49/rrlhcjRYPbEx30LQKGNn1JkMfhxc2u+t3efCUblJ2+2PdJ1uH7heNIV/M7KsQsKiwa+wNfTcqBSMyIIVSW72DFAabc1irIAcA+5z9cyCsf76Bjde962VyDETx4agJ7DCzXA/UxPUiBaqak4ZkEEKcjjJuxFkzhIFGTv9qxNiKdxACZUq3BNEoFY/uS6EkP+Ld4PvqcrodHFvYf/cFqe1tQw+fv9tyxPkgarj5zSZnUwezA2ZXDbdY49CxnVA== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1BFFO11HUB018; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB018; 25:hvQsaq0lckPTIamF2+SZLHfLXXWhFSKrvjML5db+Wf+6Pn+OH/qfUzxXFHBXnZcxXbSPXUiECQYxRi5UMq+pcGV2I74v6mg34AgOYFUJtsNiaU7ThQ50uQxfahKgqsOPlJk19XBSB5euPerMXvnFen0SWhe5nfanmfwRZvZrk2CvghJSkRkDgSNipXjlktKW5sc0G/+ndpmxmqH26YfQRaGQwrIwJ82Yxtsd1ya2wZYlNeea839AsorBDK1D8rnScK+RgGJUxhgFesox/ef1wqJsJs5aHwXClYQULOVxSb1auvMUjd399UW2u1fUwC7uLjHm3aGtAkWjyft5vowPaBoYHYMHJBZ7iQpmdMI29k4ziHpb5Z/hmJvIXVavLy8N8R39ay96WyD+r7lcC9Nq/qshCVKi4V47Y7C38IjvXNouYXKsE7Zi6uA+coUoXL79bJAyTVoRBmd5CwfSEwG8e4nXr/Nk97f7UEgfaQ0ogoydioaVfTu1huF7sUZr+x1zxB7xOOeUrAMs8eTMTUOEPcWjrPbQlr4nybzKGNvDsbAhu1zg3SF6hnfbG+h8rBeS1rgEZvX4X8Qj+MGkoBDBRjJwVOdoH1DzgJh2/X2LiEgtjztYVOUB+s07iSDxwoVvzXLHA64CJVl10kAQAzeFAJhl/rITtdMM5+IvF/BYDvuufV9b97e/K692Sq8t3E90UtkBsc2nN8AvyvLApodGxPvt8lPBqCMkNUTPMl+6l4WaRNeOJPgXOP+bpczACwTIUvZplWbCfFSSmpZDON1s4mQMYkE/+R/q88UPhpXi+zSsgNUMFSJGRljx42fvCJrkzM7Yvl98Gzk456VeLhEkyA4ID7XbaVUcdkTiLZU2FbjqYcTkh4cLgleSMD0fuXIWor6/uQspf0Pv3TP/2k4zRA== X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB018; 31:VGbmheXeXw9E3X5RsT7TPDJgUchKGRZSR/tNODVaAzzSwhVzU5J+CNjIiDRDSP5yUgZiw1VemQegb1A/ckFeqhH1C7mASFjMpeJ8dR/ze97/BBtVHPEBbkpnAeRjIuVmvEI3CedgML1T9V9sClj2bKPEc5ll8vvfhh4WjXJvjrag8i0g67nkZqdjH4qFx/l3I1uAWI5sWfIhzFocD9L3v8BtnuD7ExwkNP6+IauTKKo=; 20:kQzc1oMnaWmAK6c3YHC/ONvweynjFRpIZbc3VX8QWwFSXXGnNAcHQSzwCXUCernBVwCYltMZs0mhPk+rW2QiATt0EymeBMNfoG03rRwM2M5jCRo+SjHQ2s9v7LjzermE9HFZFJFdm76/1Fwr3ytWrqN+ZiKpxZ1JknPp4w5wdV/aipUXrSTOWOBLOx2e4du9gF5ZhCfUXBJGOiq6eEyarJl5zRrTaGKWHFhOfR+QLuJJcQDaj3VPQsegbAO/vsA90hq/NNkgX0O+7u0m6PscweDJJknQaw2t2ErYSgo+sxynBDZVGfEU5aWyN6p2xlWO5FfuQ1WVxlyeeXC7kMZpjbyv4O7+smumEihWzcyfPK3uID2K/YIFE99maW1+9nfP1HqEDb2y64ZhOt0Hsc+9qmcMYp3+C24LrPoTjfLXUe0= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040160)(601004)(2401047)(13023025)(13017025)(13024025)(13015025)(13018025)(8121501046)(5005006)(10201501046)(3002001)(6055026); SRVR:BN1BFFO11HUB018; BCL:0; PCL:0; RULEID:; SRVR:BN1BFFO11HUB018; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB018; 4:B9xy6izwEb8i0DCsZcNRJ392NxlS/6/cGKcoJTNQ9sTgLbmKGgPcUm87z075sT2ANDVMFIva0O93FrTPi6SDTbi7FVgO4hoqkj5uCzkXbRzlTqinr+CuucuZ/X1uHgibT/P+rdPbBIvfh4vVnakO8kK7f2YQmqRD4G241Dbjt3zfd2WYpt6W+ReH9Tp01irq0RBQxQG6642njiffVvrIsBUy0YPnkKNJFhNBwMbBaF7tSR4BN8kuum6wvNlYU0o8t/Jv83WYWq8KfOvMm/qri/ke/1OYnG6V4FxQFA0ZwFt9KEaEaoDdpu/jrXGLlCN9NdFCDSnOOidp2KrvSBwx0KY8EnkEXaJYseWDcaFMYDHMdsE/JXlCJ81KT1al8atVpZVHpnOAdw/2oRdLSqV/x8EWTaVu5obBG3S1MaPr3NU3+kMNrZA+FlH71Fe1l58WwxUJ404zBQU+Ofibrhq6FOHyBaGgbcXFAIFOz6xKT2oNtmLG6BrJCUrukOvWbNqSlzXtTl70FmR2ltCXz5sxjZV5XGpH1c21K85EWQp9vEp0MSuEjr9xiKzrhFK2pdFyHSpMxfdr4qF8WMG8fF6M/y2bGc8WbSGSIP7d+mijBlFgn7rz7KW+VW2dti/QlswaDxMQ+j4nP9lCFfyjZkCfm6C3oaY+IoYhWwGGHOEYFw7JW1H6WL0BhVO+wGUwHCY889M/7Fq5m2D8n4WLiXzUhrWEcXsHT4pJXWXpPnazsHxXtFBCcUs9aBxnA4JyOvbE X-Forefront-PRVS: 00286C0CA6 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1BFFO11HUB018; 23:WveBNWdqCd4AUsMpPkW1OqhHK+cJVy6I7TEdJyD?= =?us-ascii?Q?UMGkaeXs3wqA77HrUld/beNJNPTLwTlE9ZpQDd7VOwloSWdISeHMGTZsrFeA?= =?us-ascii?Q?2VRHG9xjihhiRT5FgJilAyO59cqxFWT7Wy9kOrbUwXgy/dRG3+W0o2sxeLyM?= =?us-ascii?Q?O/I2Yu/akRuzh07pzjWJGHFUn/KHazU8SsuUYqc06zQwbrHUJA+rWbirbsqT?= =?us-ascii?Q?RLFluruI+MUzTLRu2Of9I5okorpwdI4uRsxg4jk4G5MmHac6+L9+ITw+stuj?= =?us-ascii?Q?Z9Me0pcK+zQvCnFA8RWYiaXwV4PGPwz1Myn73W4R1iQPGA3VnrKzU+5uuPeq?= =?us-ascii?Q?CJaRZuZoP75gJUFrWXlMJeLY3JU0ttT5PeyO6HxbvY6F4Zp28dcJzw6fb2lM?= =?us-ascii?Q?82SfSSNIKmjIzVrXEWSWKMfF/btg5epVw1Ad681G4Co3f/kUoMvCafGIR8I2?= =?us-ascii?Q?kuvieFEGJ1W4PNZOESTTAsaFEGxQE0HKrL3SOfK+e3ueo/DILFREeTUraKz+?= =?us-ascii?Q?Ooqd+nRt2y6DodfwXzwh4LtbFY2Ev9xGTIWdTd1610UcZnTj4v6UaXMk0Ci3?= =?us-ascii?Q?b7Douzjs21At9x+yezl0KlprzLb806sZcDqKyYKsOiM+VEXjUTT5xCTEGx2c?= =?us-ascii?Q?cElJvNuMZCPuphl3C02O/MdV0aaUnB7d+1Xm1EMqS3Tgag52nWcoySyqa75p?= =?us-ascii?Q?ffOjXkIK9rm+Ol97m4isMClOobF/TQVX3VqfRy3sbRxC9EwCgkYMrQKPaP65?= =?us-ascii?Q?ovJNnDooFwP7wJbYLxyBCkK9i9+DETEfBQxossDHI6GrTPqL3uWb5BrRf2dT?= =?us-ascii?Q?3U81rshFt0nPMm6SIrPoqpANqPOZjFayZjFR0oHtGVIPukfl4qXDwjAl6pcs?= =?us-ascii?Q?zXRwWQ303WAeurPar+KVYw+Vv9bMWB0KFFMF1SmxcVrwb80sNKafLJXlJCd+?= =?us-ascii?Q?B2hfyNZqj3/CWJ92Ng+td7pH2ayWJVdlqvBVOqsL6TfIRH7GIxe9kTn49QaA?= =?us-ascii?Q?cmNqbSFpzU1El++rUn2GaPW4qhBU7g19lmxrPiUBa/UGySp0Qsgnf+nXjGDa?= =?us-ascii?Q?JA9UtQajOir56uC9jBxPdMLjaWHeDWEIdmrkCjQ5FmLsvGE5ABS6VRlCmS+W?= =?us-ascii?Q?k5Eg57yAlYMIlMDWusEaVSOtLK/kyZdmHkIQvSWJ/sGC7y5s6rAo8z3Gip+X?= =?us-ascii?Q?53u59pH3f5zxHGp6HbvlGGVSxQM3UTw6LU6qs4RCPe+nHm36b3hCGPOBcyvU?= =?us-ascii?Q?HOzIOhnDx2qi8NfMC/0ZVP9UF4IIzK6Id3TBNXJIfxK+Swkris9jFfIS9XrQ?= =?us-ascii?Q?hd7DYbVOpMKgg0X6oUGC3SVJdujit2uKemUUKrXoxOdsjRAq/9deYxUFtnwc?= =?us-ascii?Q?p446KKCgwuIxTVas/CQ78jMV8f3H111Z2phBgrCMZRCOvOqoQAxRhKZEIzs4?= =?us-ascii?Q?rf4gdoTpmeVJ0W3CZGjVzpp3nz+f+fhJZvFtkduDIt04UXv468IEZ79+Pyp9?= =?us-ascii?Q?Mpypb5TU1Afr2OQ=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB018; 6:gqJaTEPv+eAbED9gsE9v5q3YZWpjjOfdSJAHgdfj/WEIYGFP362hqhL0sYbyJEXp37ykJoctQ5rAOe7Xz4M+i4U11VMjxO9Xtn8haVc2T74G8RUNo9kXNV5T+At+iIrSlPtCKQkZ/Sbz1EHRIiXGoEvphuXGJS3PV5VBlU2dt8ix/4I8BGogqzT/Nvqvw7YTEDrg+NEdBhUkws7Lr6QnIDLU42dO1Ux5hHzsLAzYHLHP/1+Us5raCmK7q/KjFaCU34VsufXW25DXdXu4qrAnU0Xhsca6ph6VXKVvqYhqVkmZVbSXWDltewCwfP3bZ2onDB9KafV+d5sDjxVKiLCXkQ==; 5:vJwJ3tRx3O5N7zXZrv7Z474VYry9MZIO/PqkDlnqplpzVlw3czxPtVjUTuHkvar7kEfVai1CrSZyW+XffZE2yTcSIJVosaN0sUaXS9dcu+gMicrWqa7q1/pl+30wXVgLueZ7e2b2gXw3oVwuybWgJg==; 24:dzhaD89u1oqNExnh3LdybBH3Uq5yNhVghJwXA/TpfolKkWNLF72MdnLPtmaxLEJQrvmYECBwmnY1REP3qcjFS8nZoYfkIUKHhOeF3vhbyC4=; 7:G6MtLp1VpiIr3nBqjb57JweksRmQUCHB1z5UChhdLJYQt6PVcckz2knEnUA6ghKjMjv2JW5qHemLfn7jqnJ+aZhERZ5vifgkFsATJuqp+kDfhOSTEocbPzaH0+7K6xpWN0ERDk62bwslNEVkWnG8Wf/of5mc5QT9OrPn/aadkiA7MRDUccYwIuipym0aWW6x1e8e4XWKd1RsSAd3Q8DUCHVm2zft3RlxZdLCopyRnllZcAZtWCyirMV7MY3+bN43 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2016 20:01:06.4122 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.38]; Helo=[plsapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1BFFO11HUB018 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Richard Shockey , "stir@ietf.org" , Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 20:01:22 -0000 Agree. Pierce -----Original Message----- From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: August 08, 2016 2:46 PM To: Gorman, Pierce A [CTO] ; Paul Kyzivat ; Dwight, Timothy M (Tim) ; DOL= LY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments Just so I'm clear, I'm not hearing an ask here in terms of changing the tex= t of rfc4474bis-10, which does allow signing PAI instead of From for precis= ely the reasons outlined in this lengthy thread. To Alex's original point a= bout providing authorization without authentication, rfc4474bis has a lot o= f text about signing non-TN identifiers, including for preserving anonymity= ; see the end of section 6.1, and then the Privacy Considerations in sectio= n 11 for more. Those should suffice to provide this property: it will ident= ify the service provider who signed without attesting an specific user iden= tity. I also wanted to make sure we didn't drop the other ball that Alex mentione= d at the start of this thread, which is the issue of proximate replay withi= n the 60 second Date window. This is addressed in Section 12.1 of rfc4474bi= s-10, which reads: "Note that per baseline [RFC3261] behavior, servers keep= state of recently received requests, and thus if an Identity header is rep= layed by an attacker within the Date interval, verifiers can detect that it= is spoofed because a message with an identical Date from the same source h= ad recently been received." This refers to the text of RFC3261 section 23.4.2, though more properly the Date-related behavior is b= etter detailed in RFC3893 Section 10, which introduced the first version of= the partial signature mechanism that ultimately inspired RFC4474. I'll upd= ate the text here so it is clearer about exactly how to detect proximate re= play. Jon Peterson Neustar, Inc. On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" wrote: >Paul, > >As you know, SIP inter-working is often challenging because of >variability in implementation including proprietary headers (without an >X-) and support or lack thereof for non-mandatory (per RFC 3261) >headers such as P-Asserted-Identity, (and things like B2BUA stacks >stripping things like display name in From but that's another story). >I could argue that from a cleanliness of protocol implementation, (and >if I wanted to be pedantic), I would strip PAI outbound unless required >otherwise. But the point is moot. As I mentioned in the earlier >e-mail, that is not our practice and I'm not requesting it to be so. > >Pierce > > >-----Original Message----- >From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >Sent: August 08, 2016 12:03 PM >To: Gorman, Pierce A [CTO] ; Dwight, Timothy >M >(Tim) ; DOLLY, MARTIN C >Cc: Rosbotham, Paul, Vodafone UK ; Richard >Shockey ; stir@ietf.org; Brian Rosen > >Subject: Re: [stir] STIR 4474bis-10 comments > >On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >> Thanks for the added comments Tim. >> >> I agree that passing P-Asserted-Identity between trusted networks is >> appropriate (and the converse is true as well). Part of my issue is >> I have been conditioned from the very earliest implementation of >> Sprint's VoIP network that other carriers' IP networks are inherently >> untrusted. I've been browsing TS 29.165 and even there I find >> language that implies trust is established by agreement, not by >> standard. (Even roaming implies agreement.) > >I understand why *some* stuff needs to be removed when forwarding to an >untrusted party. For instance, if the call has requested privacy, then >P-A-ID needs to be removed. > >But when privacy is not a concern, trust is really more of a concern on >the ingress side, not egress. If I don't trust you then I won't trust a >P-A-ID you sent to me, and so *I* will remove it. But if I trust you, >but you don't trust me, then what is the downside for passing along the >P-A-ID? > >Thanks, >Paul > >> Regardless, this discussion has been helpful and educational (to me >>at least). And, I confirmed with my operations counterpart we >>generally send PAI today. I've also made note that where standards and I= CA >>require it, we will include PAI. Thanks again. >> >> Best regards, >> >> Pierce >> >> -----Original Message----- >> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >> Sent: August 08, 2016 10:47 AM >> To: Gorman, Pierce A [CTO] ; DOLLY, MARTIN >> C >> Cc: Rosbotham, Paul, Vodafone UK ; >> Richard Shockey ; Paul Kyzivat >> ; stir@ietf.org; Brian Rosen >> >> Subject: RE: [stir] STIR 4474bis-10 comments >> >> Pierce, >> >> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA >>IR.95. The latter references and profiles the former. Section 4.4.1 >>of >>IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>considered trusted, and table 3 in that section recommends that >>P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. It >>also states that PAI is mandatory at a roaming NNI. >> >> Tim >> >> >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce >> A [CTO] >> Sent: Monday, August 08, 2016 8:52 AM >> To: DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >> stir@ietf.org; Brian Rosen >> Subject: [E] Re: [stir] STIR 4474bis-10 comments >> >> Martin, >> >> You referenced TS 29.195. I'm not familiar with that spec. Has it >>been deprecated? It's not showing up on the 3GPP site. >> >> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the >>originating side" Note 4 it states, " It is assumed that the IBCF is >>responsible for stripping the P-Asserted-Identity from the SIP header >>when interworking with untrusted networks." >> >> Your remark is consistent with Note 4, but only if we agree that, for >>instance, the AT&T network and the Sprint network are "trusted >>networks". In reality, this is not the case or there would be no >>firewalls or Session Border Controllers used for interworking and >>security. My opinion is the only carrier networks that are trusted >>are the SS7 network, and the Internet backbone. >> >> What it really comes down to is that PAI is left in signaling either >>through formal specification as a part of an inter-carrier >>inter-connection agreement, or by custom (or even by accident). I >>think this illustrates Paul Rosbotham's observation is true. >> >> Pierce >> >> -----Original Message----- >> From: DOLLY, MARTIN C [mailto:md3135@att.com] >> Sent: August 05, 2016 12:55 PM >> To: Gorman, Pierce A [CTO] >> Cc: Rosbotham, Paul, Vodafone UK ; Brian >> Rosen ; stir@ietf.org; Paul Kyzivat >> ; Richard Shockey >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> PAI is not stripped at the network boundary between trusted networks >> 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force ITU And the >> list goes on >> >> Martin C Dolly >> Lead Member of Technical Staff >> Core & Government/Regulatory Standards AT&T >> Cell: 609-903-3360 >> Email: md3135@att.com >> >>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>> wrote: >>> >>> Which header the carrier chooses to display is moot if the header is >>>stripped between carriers as per at least one standard. I think Paul >>>Rosbotham's observation we're likely to encounter "some interesting >>>interworking challenges" was perhaps the understatement of the year. >>> >>> Pierce >>> >>> -----Original Message----- >>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>> Sent: August 05, 2016 11:58 AM >>> To: Gorman, Pierce A [CTO] ; Richard >>> Shockey ; Rosbotham, Paul, Vodafone UK >>> ; Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> If PAI is present and signed, and From is also signed, I would >>>expect it to be up to the UA to decide what to display, not the carrier. >>> >>> Of course this will work differently if there is a different >>>signaling regime between the carrier and the user device (e.g. black pho= ne). >>> >>> Thanks, >>> Paul >>> >>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>entities" and therefore some specifications (e.g., 3GPP TS 24.607) >>>>assume P-Asserted-Identity is stripped by border controller >>>>functions and is not to be used in inter-carrier inter-connection >>>>(although it commonly shows up anyway). My opinion is the "From" >>>>header is likely used more often for presentation. >>>> >>>> Pierce >>>> >>>> >>>> -----Original Message----- >>>> From: Richard Shockey [mailto:richard@shockey.us] >>>> Sent: August 05, 2016 9:37 AM >>>> To: Rosbotham, Paul, Vodafone UK ; >>>> Paul Kyzivat ; Brian Rosen >>>> >>>> Cc: stir@ietf.org >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>> >>>> Humm this is getting interesting. Its my understanding that the >>>>display number aka "presentation number" in the US context is the >>>>one carried in the PAI. Martin, Pierce? >>>> >>>> >>>> >>>> >>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" >>>> wrote: >>>> >>>> Jumping in now that we're on European working time, +1 on Paul's >>>>observation. >>>> >>>> Here in the UK, we've got 2 numbers carried as calling line >>>>IDs....one (we term the Network Number, carried in PAID) uniquely >>>>identifies the line, the other (we term Presentation Number, carried >>>>in From) is used for display purposes. >>>> >>>> Only the carrier has the authority to set the Network Number so >>>>only they could sign it. >>>> >>>> But - subject to regulatory restrictions which are well >>>>documented >>>>- the number sent for display purposes belongs to the customer. For >>>>blue-chip customers, I can allow them to send their Presentation >>>>Numbers into the network, and can't readily check at a network level >>>>that they're theirs (I do have contractual safeguards). The number >>>>may have been allocated by me, or could be allocated by a third >>>>party provider. If it's a call-centre they'll be making outbound >>>>calls for lots of different customers which will change on day-by-day b= asis. >>>>This is business as usual. I don't like the term "authorised >>>>spoofing" because it implies that the CLI is in some way being rigged: >>>>it's not, it's the corporate customer or their subcontractor using >>>>the number that's been assigned (so in internet terms delegated) to >>>>them via a chain of trust from the regulator. >>>> >>>> What I want is the ability for customers to use their >>>>credentials to sign the CLIs they send me so that at the >>>>terminating end it can be checked (or indeed somewhere en-route if >>>>that's the business model). >>>> I can and would sign for customers on my mobile business since I'm >>>>driving what number is presented, but that's by-the-by because they >>>>aren't the ones who generate millions of nuisance calls. If the >>>>signing only occurs at the originating carrier level for >>>>corporate/call-centre customers that's no use because I'm not in a >>>>position to do that for these type of customers...and the whole >>>>system becomes a waste of time. I'd also highlight there are many >>>>more of my large customers that I'd trust more than a far end >>>>originating carrier that could be anywhere in the world (though we >>>>have no shortage of small carriers that I wouldn't know from Adam >>>>more locally in the >>>> UK....) >>>> >>>> Regards >>>> >>>> Paul >>>> >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >>>> Sent: 04 August 2016 23:12 >>>> To: Brian Rosen >>>> Cc: stir@ietf.org >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>> I think it's not a delegation. The mobile phone is not being >>>>>delegated the TN, it's being authorized to place calls that are not >>>>>from that TN, but appear to be. >>>>> >>>>> The mechanism to handle the credential is exactly the same as a >>>>>delegation, so if you want to call it delegation, go ahead, but I >>>>>prefer to call it authorized spoofing. >>>> >>>> IIUC the delegation is to a responsible entity (something that >>>>can be held legally accountable - e.g. a person), not to a device. >>>>The entity can then "use" the credential via any device(s) it >>>>chooses. In the case of the mobile, the device then becomes a two-line = phone. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> Brian >>>>> >>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>wrote: >>>>>> >>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>calling from his mobile, but sending the TN of his office phone >>>>>>>as calling party. >>>>>>> The delegation to his office phone was made by his landline >>>>>>>carrier to him. He then creates another credential, which he >>>>>>>signs with his office phone credential that authorizes his mobile >>>>>>>to send calls from his office number. He is spoofing (because >>>>>>>the call is coming from his mobile's TN but claims to be from his >>>>>>>office), but it's authorized spoofing. The doc could give the >>>>>>>credential to his mobile SP if they sign on his behalf. >>>>>> >>>>>> I don't understand how that is different from regular delegation. >>>>>> >>>>>> When his landline carrier gave him a delegated certificate for >>>>>>his landline number, he should be able to install that in whatever >>>>>>devices he wants - his landline UA, his mobile phone, etc. It is >>>>>>still delegated from his landline carrier, even when used with >>>>>>calls via his mobile carrier. >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>legitimate use. >>>>>>> >>>>>>> But that's how I describe it. >>>>>>> >>>>>>> Brian >>>>>>> >>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>> > wrote: >>>>>>>> >>>>>>>> +1, but with one question below: >>>>>>>> >>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>> delegation path, >>>>>>>> >>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>> authorized spoofers. >>>>>>>> >>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>> >>>>>>>>> I don't think it matters who the delegator or delegatee are as >>>>>>>>>long as the delegator is willing to take the heat for >>>>>>>>>delegating to someone who sends a lot of bad calls. They can >>>>>>>>>pass the buck ("I delegated the TN to him, and now I'm not >>>>>>>>>responsible"), but only if the SP knows who they delegated to, >>>>>>>>>so authorities can follow the delegation path. There are >>>>>>>>>plenty of certificated carriers who are willing to not care who >>>>>>>>>they delegate to. The fact that there are some who do doesn't >>>>>>>>>change much. >>>>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>>>>that you can pass the hot potato. >>>>>>>>> >>>>>>>>> It's perfectly reasonable for a carrier to be able to sign for >>>>>>>>>any calls placed on its network on any number it has been >>>>>>>>>delegated. >>>>>>>>> If it does, it's asserting that the calls are from who they >>>>>>>>>are supposed to be from. >>>>>>>>> That should be straightforward, but we know it's not always, >>>>>>>>>and that represents the hard part of deployment in my opinion. >>>>>>>>> But once they delegate, they can hand responsibility to sign >>>>>>>>>to the delegatee. But, that only works if they know who they >>>>>>>>>are delegating to. >>>>>>>>> >>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>informal delegation path for telephone numbers in every >>>>>>>>>country, and we can build a chain of trust from that delegation >>>>>>>>>path. If you propose to alter that model, then we get into >>>>>>>>> (policy) issues of which carriers/entities we trust and which >>>>>>>>>we don't. >>>>>>>>> Our model is that you know who you delegate to, and once you >>>>>>>>>do that delegation, it's their problem. >>>>>>>>> That's pretty appealing I think, even if it's a change in some >>>>>>>>>business practices. >>>>>>>>> >>>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>>> > >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>> policy and use cases. >>>>>>>>>> >>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed >>>>>>>>>>on individual devices as well as multi-device and >>>>>>>>>>multi-number platforms. >>>>>>>>>> >>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>> >>>>>>>>>> Inherent variable trustworthiness of a calling number was my >>>>>>>>>> reason for suggesting a way to qualify the signature to >>>>>>>>>> reflect that variability. >>>>>>>>>> >>>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>>>coming from a device assigned a single number, or from "trunk >>>>>>>>>>group" which could originate calls using multiple numbers, and >>>>>>>>>>can qualify to some degree the trustworthiness of number >>>>>>>>>>authenticity accordingly. >>>>>>>>>> >>>>>>>>>> My suggestion was qualifying calling number authenticity into >>>>>>>>>>categories of carrier-signed (or not), and unauthenticated, >>>>>>>>>>semi-authenticated, and most-authenticated. There can be more >>>>>>>>>>granularity, but it implies additional operational complexity >>>>>>>>>>(both for the carriers and the consumers) and I assume >>>>>>>>>>diminishes value. >>>>>>>>>> >>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>carrier is typical trustworthiness of a carrier business >>>>>>>>>>relationship with typical consumers adds to the >>>>>>>>>>trustworthiness assessment and partially because carriers are >>>>>>>>>>a regulated point of forensic inquiry for CALEA and fraud. >>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>mobile consumers where their carriers are able to usefully >>>>>>>>>>authenticate their device and have a high degree of confidence >>>>>>>>>>of the authenticity of the calling number. >>>>>>>>>> >>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>> (revoked, not >>>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>>> >>>>>>>>>> Conversely, I think billions of per-TN certs will work well, >>>>>>>>>>if the calling party has to sign a call with a per-TN cert >>>>>>>>>>provided by the called party. No called party cert to include? >>>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>>>with the called party, and the call can be authorized/treated >>>>>>>>>>accordingly. >>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>> >>>>>>>>>> Pierce >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; >>>>>>>>>> stir@ietf.org >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>policy issue. >>>>>>>>>> >>>>>>>>>> The notion of credentials that are traceable to a delegation >>>>>>>>>>of a TN is a mechanism that is part of the design of stir, and >>>>>>>>>>the design allows delegation of one TN (to one device, >>>>>>>>>>although a device like a PBX would have more than one TN per >>>>>>>>>>"device", and something like a dual NAM phone could have more >>>>>>>>>>than one credential. For the use case we've discussed, a >>>>>>>>>>mobile phone may also have a credential for, say, a TN that is >>>>>>>>>>delegated to a landline, to cover the example case of a doctor >>>>>>>>>>placing a call on his mobile, but getting his office number to >>>>>>>>>>show up as the calling party. Use of such mechanisms is policy. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>>> > >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>> discussion. Regardless, I do appreciate your explanation. I >>>>>>>>>> would like to continue the discussion, but I'm pretty sure >>>>>>>>>> this isn't the right forum. >>>>>>>>>> >>>>>>>>>> Pierce >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; >>>>>>>>>> stir@ietf.org >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>> phones and any other devices that can be programmed to do so. >>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>> TNs they are authorized to sign for. They can try to sign >>>>>>>>>> any call, but the validity of the credential would make such >>>>>>>>>> a signature fail the checking. >>>>>>>>>> >>>>>>>>>> Getting service providers to sign on behalf of devices is a >>>>>>>>>>reasonable way to deploy quickly, but I expect many SPs will >>>>>>>>>>want to get out of the liability of signing on behalf of >>>>>>>>>>their customers. If they can push of that responsibility to >>>>>>>>>>their customer, only being responsible for getting the >>>>>>>>>>customer an appropriate credential when they assign TNs, then >>>>>>>>>>I would expect them to want to do so. That means the devices >>>>>>>>>>have to be able to sign, but I understand many of the PBX >>>>>>>>>>vendors think that's something they could provide in a future >>>>>>>>>>release. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>> >>>>>>>>>>> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>> extraordinarily easy to commit fraud with authenticated >>>>>>>>>>numbers? >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >>>>>>>>>> >; stir@ietf.org >>>>>>>>>> >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>signature, >>>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>assign to >>>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>>> support the extra delegation required to support >>>>>>>>>>"authorized >>>>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>>>> calls from the same service provider and should not present >>>>>>>>>> any issue. >>>>>>>>>> >>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>implement >>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>>> >>>>>>>>> >>>>>>>>>> > wrote: >>>>>>>>>> >>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>where a >>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>way of >>>>>>>>>> knowing whether the calling number is properly assigned >>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>from an >>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>And in >>>>>>>>>> the consumer market, there are calling products which >>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>devices >>>>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>>>> the parent subscriber. These are examples of where the >>>>>>>>>> authenticity of the calling number won't necessarily >>>>>>>>>>mean >>>>>>>>>> the same thing as the authenticity of a call from a >>>>>>>>>>single >>>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>>> spoof checking. >>>>>>>>>> >>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>>> number, and validty of the calling number (assuming >>>>>>>>>>nonce >>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>suggested >>>>>>>>>> below by Alex). >>>>>>>>>> >>>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>>> could be as follows: >>>>>>>>>> >>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>> >>>>>>>>>> *00 - No Credentials* >>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>>> networks that don't natively support SIP or which don't >>>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>> entirely untrustworthy. >>>>>>>>>> >>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>roaming >>>>>>>>>> agreement, manual roaming. >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>entirely >>>>>>>>>> untrustworthy >>>>>>>>>> >>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>OCN, but >>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less >>>>>>>>>>than >>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>> >>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls >>>>>>>>>>from >>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>>> trustworthy >>>>>>>>>> >>>>>>>>>> *Public Use Case:* >>>>>>>>>> >>>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>>> available authentication services resources. e.g., >>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>cetera. >>>>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>>>> which would process them according to the rules of the >>>>>>>>>> Public Class application(s). >>>>>>>>>> >>>>>>>>>> Pierce >>>>>>>>>> >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>> *To:* Alex Bobotek >>>>>>>>> >>>>>>>>>> > >>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>> >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>> >>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>placing a >>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>telephone >>>>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>call may >>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>serving the >>>>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>>>> entity that is assigned the TN explicitly authorizes >>>>>>>>>>calls >>>>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>> authentication. We're not aware of any cases where >>>>>>>>>>there >>>>>>>>>> is an actual requirement for legitimate calling without >>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>although >>>>>>>>>> we certainly are aware that various parts of various >>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>point, at >>>>>>>>>> least in some countries, there is a realization that >>>>>>>>>>the >>>>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>>>> any more. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>> >>>>>>>>>> > wrote: >>>>>>>>>> >>>>>>>>>> 1. Permit authorization without >>>>>>>>>>authentication >>>>>>>>>> In the current telephony network practice, some >>>>>>>>>> service provider implementations choose not to >>>>>>>>>> authenticate identity, but simply facilitate the >>>>>>>>>>use >>>>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>anyone >>>>>>>>>> established that there are not? How can the >>>>>>>>>>industry >>>>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>>> identifying the originating service provider >>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>prevalence >>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>closest >>>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>>> better to ID service providers than unreasonably >>>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>should >>>>>>>>>> support authorization without authentication. The >>>>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>> (service provider identification). The language of >>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>should NOT >>>>>>>>>> require or assume that that authentication will >>>>>>>>>> precede authorization. Of course there may be other >>>>>>>>>> use cases where signing includes authentication and >>>>>>>>>> may not include a specific service provider's >>>>>>>>>> authorization. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> 2. Improve replay prevention >>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>with this >>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>within >>>>>>>>>>60 >>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>legal >>>>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>>>> mky may not be present and if present its use is >>>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>Call-ID >>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>receiving end >>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>(e.g., >>>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>difficulties >>>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>>> faked MESSAGE based on a captured request. This >>>>>>>>>>might >>>>>>>>>> include an mkey from a captured INVITE. So it >>>>>>>>>>may be >>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>using a >>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>distributed >>>>>>>>>> implementations may make the enforcement difficult, >>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>method >>>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>>> practice should at least be discussed while perhaps >>>>>>>>>> not required. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Specific markup suggestions: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> NITS >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>>> parameter appearing *in*the >>>>>>>>>> >>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>> present, then the >>>>>>>>>> >>>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>>> parameter value is >>>>>>>>>> >>>>>>>>>> present, and the verifier does not support >>>>>>>>>> it, it MUST ignore the >>>>>>>>>> >>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>> parameter value is present, >>>>>>>>>> >>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>> including the variations >>>>>>>>>> >>>>>>>>>> described in Step 5. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> 3 >>>>>>>>>> >>>>>>>>>>>>>>>>>>>4bi >>>>>>>>>>s-10%20-%20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section-3>. >>>>>>>>>> Background >>>>>>>>>> >>>>>>>>>> [...] >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Per [RFC7340 >>>>>>>>>> ], problems such as >>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>> >>>>>>>>>> swatting are enabled by an attacker's ability >>>>>>>>>> to impersonate someone >>>>>>>>>> >>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>> applications and services >>>>>>>>>> >>>>>>>>>> depends on authenticating and/or authorizing >>>>>>>>>> the source of communications as it is >>>>>>>>>> >>>>>>>>>> represented in a SIP request. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> This identity architecture for SIP depends on >>>>>>>>>> includes provisions for a logical >>>>>>>>>> >>>>>>>>>> "authentication service" which validates >>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>> requests. An >>>>>>>>>> >>>>>>>>>> authentication service may be implemented >>>>>>>>>> either as part of a user >>>>>>>>>> >>>>>>>>>> agent or as a proxy server; typically, it is >>>>>>>>>> a component of a network >>>>>>>>>> >>>>>>>>>> intermediary like a proxy to which >>>>>>>>>> originating user agents send >>>>>>>>>> >>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>> message has been >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> This document specifies a means of sharing a >>>>>>>>>> cryptographic assurance >>>>>>>>>> >>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>> use end-user SIP identity in an interdomain or intradomain conte= xt. >>>>>>>>>> >>>>>>>>>> It relies on the authentication service >>>>>>>>>> constructing tokens based on [...] >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>> typically obviously >>>>>>>>>> >>>>>>>>>> preferable for end-users to acquire their own >>>>>>>>>> credentials; if they >>>>>>>>>> >>>>>>>>>> do, their user agents can act as >>>>>>>>>> authentication services. However, >>>>>>>>>> >>>>>>>>>> for some deployments, [...] >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Regards, >>>>>>>>>> >>>>>>>>>> Alex >>>>>>>>>> * * >>>>>>>>>> *Alex Bobotek* >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> ------------------------------------------------------------- >>>>>>>>>> - >>>>>>>>>> - >>>>>>>>>> -- >>>>>>>>>> ------- >>>>>>>>>> >>>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>use by >>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>> recipient, please contact the sender and delete all >>>>>>>>>>copies >>>>>>>>>> of the message. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> >>>> >>>> >>>> >>>> ________________________________ >>>> >>>> This e-mail may contain Sprint proprietary information intended for >>>>the sole use of the recipient(s). Any use by others is prohibited. >>>>If you are not the intended recipient, please contact the sender and >>>>delete all copies of the message. >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. From nobody Mon Aug 8 14:22:13 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2842612D196 for ; Mon, 8 Aug 2016 14:22:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IoSm5x62v1d4 for ; Mon, 8 Aug 2016 14:22:11 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0736412D17E for ; Mon, 8 Aug 2016 14:22:11 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u78LM70b025324 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 8 Aug 2016 14:22:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470691327; bh=3L2eUl8kgSljPFi2otyE4rHFABndiBgl3Vxk+esXjAQ=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=dgkMgW+zf9dNwt1JJ333ie1kUyitICzZ0o0u2sHsjC97SfYXmNibrbbIkAxGupSql TwjWPjd7hW/WpOwXcZkVjDTO56XFKvk41Xp6BMG5GvEPKH/X++/XlEpVWtabC3AZxB XhoRJ6XMcM7EC4WjaIBL+2G/hXqgOIGbWQDostxE= To: "Peterson, Jon" , Christer Holmberg References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Mon, 8 Aug 2016 14:21:41 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> Content-Type: text/plain; charset=windows-1256; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 21:22:12 -0000 On 8/6/2016 10:50 AM, Peterson, Jon wrote: > Briefly, there is and always has been a "bare minimum" set of headers > and claims that are mandatory for PASSporT. Ultimately, the question of > what headers and claims are mandatory in PASSporT is a stir-passport > question. SIP as a using protocol of PASSporT defines only which fields > in a SIP request will populate those mandatory components of a PASSporT > object, and that information is given in considerable detail in RFC > 4474bis today. > > Extensions may propose additional claims that will appear in PASSporT > objects. The extensibility model of PASSporT is similarly a matter for > the PASSporT spec rather than RFC 4474bis, though we anticipate that > extensions may want to specify some initial using protocol behavior as > well. We should have a few examples of that soon. I've read through the above a few times, to make sure I understood it. (Really, it did take more than once.) The role being played by passport is to aid in authentication of the SIP caller-id information. In terms of STIR's charter and the current round of specifications, that's is sole role. (I've phrased it with a generic term like 'caller-id' in order to encompass the variations that provide the value to be validated.) In spite of having carefully read the passport spec and slogging through the rfc4474bis spec, I had not fully appreciated the level of indirection and complexity being introduced with the passport construct, until your note above. This isn't just an encoding abstraction. It's an entirely independent layer of complex mechanism, where the actual job that needs to be done is just finding a key and then hashing and signing some SIP header information. The aggregate complexity and indirection of the specs developed so far seem to make it essentially impossible to determine a specific usage scenario that is viable. And from what I can tell, this includes an inability to determine what details are yet to be specified, before there is core, usable capability that can operate over the Internet. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 8 14:45:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FDAD12D531 for ; Mon, 8 Aug 2016 14:45:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bf5o83RZR2ef for ; Mon, 8 Aug 2016 14:45:05 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34F2912D529 for ; Mon, 8 Aug 2016 14:45:05 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u78LhPkg031633; Mon, 8 Aug 2016 17:44:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=qx1VJ0auu1aUJUTEYP8tsSUYOeoJv4tPJ0z5rE5bzqM=; b=uvV00L1T0Yumc8XtOZ6VHGALuUI1aYg85zrvx2ReFEtIlr5fTX7/jJOsQ4Z7ZabfLPUu rk29aMq0135gUqyR/HoMOOQEl6JiItvsL3ZAIR4XtFAMZCmM3uSlayKiNvLz9vyaoylS 6Hc4VkrPXwpI1HfEOZ+RrURwe9ekprR1Q4KcfVFj6yFL5Drt/RJz69VEbNY5fejYYruf CqYb095/MBBuZbkJUXmAohsx9dBeuNw8qT7Nv6vXPE1nVslTseh8a3MMpGk+vf/9n28N lfkf6iMt9UaQIMKPsqvChTrctffwQDmvSRA7kOcJInjWHc3B+5QMr1UOqFiJDS6oFX1p Bg== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24nc7a766n-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Mon, 08 Aug 2016 17:44:58 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Mon, 8 Aug 2016 17:44:57 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , Christer Holmberg Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR8brwrNk3cgxDsEaYkseWd4G+9KA/ZnIA Date: Mon, 8 Aug 2016 21:44:56 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <8E4B55D8D266BE4AA34DA3449EB564F0@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-08_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608080233 Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 21:45:08 -0000 PASSporT is indeed an object format in its own individual specification, if that's what you mean by the "level of indirection". I consider it a point of architectural modularity. The working group agreed to organize the work this way because we did not want to tie STIR too closely to any particular using protocol (such as SIP). The actual job that needs to be done here is mitigating the threats defined in our charter and threat model, which are not specific to SIP. Even though we've repeatedly explained to you that this independence from SIP was the motivation for adopting PASSporT, it still does not seem to be sinking in, as you keep saying things below about how the role of PASSporT is SIP-specific. Although you seem to feel that this modularity is for some reason a matter of impossible complexity, the working group, as far as I can tell, is comfortable with this architecturally. I'm aware of a couple of early implementations, of running code that does this today. While the situation you describe sounds very alarming, it is also as far as I can tell utterly detached from reality. If there's a practical problem here worthy of a fundamental reconsideration of our direction, it is not coming through in your objections. Jon Peterson Neustar, Inc. On 8/8/16, 2:21 PM, "Dave Crocker" wrote: >On 8/6/2016 10:50 AM, Peterson, Jon wrote: >> Briefly, there is and always has been a "bare minimum" set of headers >> and claims that are mandatory for PASSporT. Ultimately, the question of >> what headers and claims are mandatory in PASSporT is a stir-passport >> question. SIP as a using protocol of PASSporT defines only which fields >> in a SIP request will populate those mandatory components of a PASSporT >> object, and that information is given in considerable detail in RFC >> 4474bis today. >> >> Extensions may propose additional claims that will appear in PASSporT >> objects. The extensibility model of PASSporT is similarly a matter for >> the PASSporT spec rather than RFC 4474bis, though we anticipate that >> extensions may want to specify some initial using protocol behavior as >> well. We should have a few examples of that soon. > > >I've read through the above a few times, to make sure I understood it. >(Really, it did take more than once.) > > >The role being played by passport is to aid in authentication of the SIP >caller-id information. In terms of STIR's charter and the current round >of specifications, that's is sole role. (I've phrased it with a generic >term like 'caller-id' in order to encompass the variations that provide >the value to be validated.) > >In spite of having carefully read the passport spec and slogging through >the rfc4474bis spec, I had not fully appreciated the level of >indirection and complexity being introduced with the passport construct, >until your note above. > >This isn't just an encoding abstraction. It's an entirely independent >layer of complex mechanism, where the actual job that needs to be done >is just finding a key and then hashing and signing some SIP header >information. > >The aggregate complexity and indirection of the specs developed so far >seem to make it essentially impossible to determine a specific usage >scenario that is viable. And from what I can tell, this includes an >inability to determine what details are yet to be specified, before >there is core, usable capability that can operate over the Internet. > >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Mon Aug 8 15:19:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A67E612D0CB for ; Mon, 8 Aug 2016 15:19:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lqy06Hy7cgKs for ; Mon, 8 Aug 2016 15:19:12 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C140312B02C for ; Mon, 8 Aug 2016 15:19:12 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u78MJ8Sq027491 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 8 Aug 2016 15:19:09 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470694749; bh=VeNlcvCCtyCxWhIuTFF/hkxs9Ut6pMjvh98Cwh1NHv0=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=ixE1TM5ptTzC/kT+AOeT9BCle1RsLvbV3GgEcMyrg9Dq9MSuua9CeJXeYG0By0w8h CW0ZdLpL20MQHr22x5yQg0kHSrqJ/IdvzVmRUUuvZfntykjgJ4fgsJsnoYWxh0gV5p HqzjAXX5E5IXFKv37BGxd9IaXdJ6ZVPpXxcjyQLk= To: "Peterson, Jon" , Christer Holmberg References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> Date: Mon, 8 Aug 2016 15:18:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 22:19:13 -0000 On 8/8/2016 2:44 PM, Peterson, Jon wrote: > > PASSporT is indeed an object format in its own individual specification, > if that's what you mean by the "level of indirection". I consider it a It's not. It's more than that. The small thread that eventually produced your note was debating support for format processing and whether it was a requirement for a verifying entity to support the syntax. The conclusion was that it does. My point, however, is that you note makes clear there is an entire semantic engine embodied in Passport that is independent of SIP and independent of 4474bis. That engine needs care and feeding, just like any other networking service. Think carefully about the language you used: "... bare minimum" set of headers and claims that are mandatory for PASSporT. Ultimately, the question of what headers and claims are mandatory in PASSporT is a stir-passport question...will populate those mandatory components of a PASSporT object...Extensions may propose additional claims..." That's an entity that is more than just a format. > point of architectural modularity. Yes, and it's appealing. I /like/ modularization too. That's why it has taken be awhile to appreciate how much downside this particular modularization is introducing. If there were a variety of specifications that used and benefited from all that generality, it might be defensible. But the specifications in front of us today merely show added complexity, making concrete analysis challenging. At that, it's pretty clear that the specifications in front of us are still significantly incomplete. That is, they are insufficient for developing a working caller-id authentication service. The working group agreed to organize > the work this way because we did not want to tie STIR too closely to any > particular using protocol (such as SIP). I understand the motivation. Really I do. But after 3 years, SIP is all you've got and even that isn't complete. The actual job that needs to be > done here is mitigating the threats defined in our charter and threat > model, which are not specific to SIP. That phrasing is common in the email anti-abuse community too. Threats (attacks) are what motivate the work, and so threats are what everybody focuses on. However the underlying nature of the current solution path in fact is not to 'prevent' misbehavior, but rather to have a way of detecting valid behavior. That is, rather than a focus on MIStrust, authentication focuses on Trust... of the identifier. (The actor associated with the identifier might not be a good actor, but assessing that is a separate matter.) Again: It seeks to validate something, rather than to find things that aren't valid. Those sound obviously related but in fact they require entirely different operational modes. Consequently, I'll claim that the working group task isn't really to mitigate threats but to create a basis for trusting a caller-id, and I'll claim that that difference in wording has fundamental import. That the mechanism for doing this is resistant to those threats is merely an enticing distraction, because nothing in this work is going to stop that folk from creating false caller-ids. Really. Consider that point a bit... Over 90% of email traffic across the open Internet is still spam. However the mail that comes in with SPF and/or DKIM protection constitutes a clean channel of authorized identifiers. Mail coming through that channel can be handled differently that mail coming through the messy, unauthenticated channel. (And for folk who know something of the way actual filtering engines work, yes, I'm being simplistic.) Even though we've repeatedly > explained to you that this independence from SIP was the motivation for > adopting PASSporT, it still does not seem to be sinking in, as you keep > saying things below about how the role of PASSporT is SIP-specific. Actually, I've been careful to distinguish theory from fact. I said that the actual /use/ is for SIP. After 3 years, there are no other specifications than for SIP. And even that is incomplete. > Although you seem to feel that this modularity is for some reason a matter > of impossible complexity, the working group, as far as I can tell, is Marshall Rose once noted that with enough thrust, even pigs can fly. So I've been careful not to say or imply anything quite as absolute as 'impossible'. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 8 15:36:30 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2016C12D1B7 for ; Mon, 8 Aug 2016 15:36:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rs548c6EtwiB for ; Mon, 8 Aug 2016 15:36:28 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC7F412D0EE for ; Mon, 8 Aug 2016 15:36:27 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u78MX647008069; Mon, 8 Aug 2016 18:36:22 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=19SRXnZ1b6fOi9lzYgJwyLvvL18DvpZmjszIlttgl04=; b=BKYGNmPFyVm6YjGCm7xKqlKeuN6FC7R9VFdHIbcdQrd3Mu7r0tf/Krm0t8joPDEwIwGJ APm11/5yobn8rAkDHBQhTdJ63ShNHGSVmtijrX/f0/pUDur+qDcUqnTfNfJ6Mf0xe7H3 u8zWAW6XbPN7AygHIwFKgmWVWKoINUNkGya2QoL+udzMFpMWz8LiMcOXPNiOVXnrDhRj 2uH32U9tOzEzfl7VuHP9tdupS9o3aHepDTdBkauBfMItnkCPlKpmO1GUUgvge+oDijyH 35gK6VJX9Cl8FJjsy2XPeawhT1Erg9tH5yXPWT2fft5oXwgtLAJyE7pmgo8e5WOhekfs /A== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24nahu6wmy-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Mon, 08 Aug 2016 18:36:22 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Mon, 8 Aug 2016 18:36:20 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , Christer Holmberg Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR8brwrNk3cgxDsEaYkseWd4G+9KA/ZnIAgAB+ygD//4+QAA== Date: Mon, 8 Aug 2016 22:36:20 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> In-Reply-To: <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-08_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608080243 Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 22:36:29 -0000 >If there were a variety of specifications that used and benefited from >all that generality, it might be defensible. But the specifications in >front of us today merely show added complexity, making concrete analysis >challenging. Actually, as I've also already pointed out, our charter constrains us from working on the non-SIP parts until the "in-band" SIP using protocol is complete. Which is why, as you say, some years have gone by and the SIP use case is the only one we are putting forward for an RFC now. That said, I could point for example to Cullen's rtcweb STIR draft as an example of the direction the STIR work is going - the lack of discussion of that is entirely an artifact of the charter here. This modularity is eminently defensible. >At that, it's pretty clear that the specifications in front of us are >still significantly incomplete. That is, they are insufficient for >developing a working caller-id authentication service. We still have some clean-up to do as a result of the last call comments, I won't argue with that. And yes, we are trying not to drag our feet at this point but to move aggressively to address something that the industry and regulators are quite urgently demanding. But the strong claim that you can't develop a solution based on this work has not been established by your intervention, and would seem to depend much more on the likelihood of implementation and deployment than your newcomer's impression of the wisdom of the architecture. I've seen this code run myself. I hear a lot of implementers and operators participating in this discussion who do not share your anxiety on this point. Why do you know better than them? Jon Peterson Neustar, Inc. P.S.=20 >Consider that point a bit... Over 90% of email traffic across the open >Internet is still spam. However the mail that comes in with SPF and/or >DKIM protection constitutes a clean channel of authorized identifiers. >Mail coming through that channel can be handled differently that mail >coming through the messy, unauthenticated channel. Once again, I see no reason to revisit this working group's consensus and undo our years of work to start over with a technology that you helped design for email. From nobody Mon Aug 8 15:45:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7070312D529 for ; Mon, 8 Aug 2016 15:45:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sbgsHsjzd-g2 for ; Mon, 8 Aug 2016 15:45:36 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C91E412D1B7 for ; Mon, 8 Aug 2016 15:45:36 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u78MjZ6e028221 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 8 Aug 2016 15:45:35 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470696335; bh=Dn9fsm90vFBkbao2cGaKf1DnkPUMJmoLyULBjelJxuA=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=bdevO/STn35/FiCZaY9PLuH3nenJVdKjAUo77YtXSznZjlmOrrjJ7fcx3fbFKx/z9 e5Qu2Hr+YCrotzKJ/lUhm//7ycF2Pus8UKbe8K/foWwYtBxSZ/+wpERrf2WPDa47mw ptLfagFDrkBx11o4FfnW12RBQU9+MIhO/y/Dd+Vo= To: "Peterson, Jon" , Christer Holmberg References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Mon, 8 Aug 2016 15:45:08 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 22:45:38 -0000 On 8/8/2016 3:36 PM, Peterson, Jon wrote: > We still have some clean-up to do as a result of the last call comments, I > won't argue with that. Good to hear. A small point of process... My review of Passport includes items for discussion, not only specific and easy suggestions for documentation changes. In order to avoid having authors do a guessing game about what will resolve questions and concerns, they normally pursue those items on the working group's mailing list. I hope that will be happening here, rather than, for example, having the authors go off and draft what they think will resolve non-trivial issues, without seeking working group review and agreement first... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 8 16:03:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BECE512D125 for ; Mon, 8 Aug 2016 16:03:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4IlIpIm8doLH for ; Mon, 8 Aug 2016 16:03:13 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1130512D0EC for ; Mon, 8 Aug 2016 16:03:13 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u78N2ak3014190; Mon, 8 Aug 2016 19:03:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=0fPu7ATIqUXPtEjPctzz2HkTYGBxoZ0Vdo8ESLRfKGI=; b=ERxNC0+Ognj69L9cV6lHwmwpDpnVmFKKB5urCMuMQIf+kVlnpSQZ2zhcfJwYGv/FOyqc Q3wdiLvFIPPQekU3ZsZ/ZjyZ3sJdq7e/MYYkLjHQH1uvNDGc8VTuFtEnHnviqBxZT1kN XGYloULUorrsSkPt2Hx0OA1rbNu47YXZtTWNi5TbYI0chNl/RX9u8WqRcKDemrx3xuZ4 eRbT0VH97VLncsRh8drVLckC8v+Oc2ymo65xnqhRhQ8dtqmgyHxJ++CCLbScGqitekIz 8k4PasHBnxROmEkXk3Ha5HQV3EQDsvf3OTOBq0+X267WWhhSci6zB/arTfer9Dz1C6r+ VA== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24nc0q6tch-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Mon, 08 Aug 2016 19:03:07 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Mon, 8 Aug 2016 19:03:06 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , Christer Holmberg Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR8brwrNk3cgxDsEaYkseWd4G+9KA/ZnIAgAB+ygD//4+QAIAAd9IA//+PqYA= Date: Mon, 8 Aug 2016 23:03:05 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <039A2DFA80E17E47ABE10B9ED09681F5@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-08_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608080249 Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 23:03:15 -0000 While I will leave it to the chairs to decide how the consensus of the group on such points should be measured, I might suggest an alternative approach.=20 As your review of PASSporT is quite exhaustive, and is a mix of stylistic concerns, philosophical concerns, and technical concerns, perhaps you could narrow those down for the group into a list of explicitly non-trivial blocking issues. Where you can forge a consensus on the list for those changes to be made, we editors will happily implement them in the specs. To date, I have not heard a lot of support for the general direction you seem to be going, and I'm not sure our consensus process requires us to satisfy all parties to a discussion. Jon Peterson Neustar, Inc. On 8/8/16, 3:45 PM, "Dave Crocker" wrote: >On 8/8/2016 3:36 PM, Peterson, Jon wrote: >> We still have some clean-up to do as a result of the last call >>comments, I >> won't argue with that. > > >Good to hear. > >A small point of process... > >My review of Passport includes items for discussion, not only specific >and easy suggestions for documentation changes. > >In order to avoid having authors do a guessing game about what will >resolve questions and concerns, they normally pursue those items on the >working group's mailing list. > >I hope that will be happening here, rather than, for example, having the >authors go off and draft what they think will resolve non-trivial >issues, without seeking working group review and agreement first... > >d/ > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Mon Aug 8 16:06:57 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 150AC12D0EE for ; Mon, 8 Aug 2016 16:06:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=bbiw.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AN5pmkb-lLlG for ; Mon, 8 Aug 2016 16:06:55 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6723212D0EC for ; Mon, 8 Aug 2016 16:06:55 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u78N6rBi029736 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 8 Aug 2016 16:06:53 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=bbiw.net; s=default; t=1470697613; bh=OC9nzUkaCgJsl31+cxxfgbS9L+7Zi7bns0KZIvJ2oFs=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=HAP826vRHpCn+N914qq4uV4GrGek2wNkf6cWFJYyEojfTdAhQgVQZC/1v4lPNn0Ri Y+MmLPRyF3PMEldhFC9jhas1TT7XH50zl4qK9+Y2iVaQahES4QXCQjo2E3WYMxQTco ry3UDcL8U+cZesvgLMlnmFlwTrZ18M6IvwBNfhvU= To: "Peterson, Jon" , Christer Holmberg References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <6688dd94-5c7e-4a9c-f873-69c4eb33f59a@bbiw.net> Date: Mon, 8 Aug 2016 16:06:27 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 23:06:56 -0000 > As your review of PASSporT is quite exhaustive, and is a mix of stylistic > concerns, philosophical concerns, and technical concerns, perhaps you > could narrow those down for the group into a list of explicitly > non-trivial blocking issues. Jon, I produced a careful review. It's not that difficult to distinguish questions from non-questions or even to distinguish substantive from editorial comments. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 8 16:14:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC91E12D0BB for ; Mon, 8 Aug 2016 16:14:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZVdFDNzzFXxI for ; Mon, 8 Aug 2016 16:14:15 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AD0912B030 for ; Mon, 8 Aug 2016 16:14:15 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u78NDEYL002083; Mon, 8 Aug 2016 19:14:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=P2WtxuL1A4VUq+lB+Vpj27fcxvrIqC1NvtINH2IBAbM=; b=gLF3k4JPBSwjz5K4x73ddBThsXAS02941vwBrkI0xA4U9OHo6AT3wmOrb4E36Cy6cQRQ V83Un98Fl/TSiz2Cwkyw3/C8QMDhbqbf23rhOPzcksgUyg76J9UHVvgJhVCKOg+pOVSL /UdPcDk4ixU26atXm3AYrgbSDAL2eioQ3aj5MbkufKT3B6iPNX7MdHUJlQoM4iIESnOb BqBTfRTPpLZhacxEHUmvhMMw1QHhd2AIc2G0ht+W/hMF7CHSgK/pG2XwHRgM1Yio2Pp0 axZeSoU8eyOfJB2MgrmijN8wv5xaALuomJ1dF9pdTrsYkEda/E6QBvGe/CvpMsCOduS6 nQ== Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24napjyadc-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Mon, 08 Aug 2016 19:14:07 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Mon, 8 Aug 2016 19:14:06 -0400 From: "Peterson, Jon" To: Dave Crocker , Christer Holmberg Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR8brwrNk3cgxDsEaYkseWd4G+9KA/ZnIAgAB+ygD//4+QAIAAd9IA//+PqYCAAHZMgP//jMeA Date: Mon, 8 Aug 2016 23:14:05 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> <6688dd94-5c7e-4a9c-f873-69c4eb33f59a@bbiw.net> In-Reply-To: <6688dd94-5c7e-4a9c-f873-69c4eb33f59a@bbiw.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-08_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608080250 Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 23:14:17 -0000 In that case, if the list has heard your issues, I'd be interested in knowing how much support there is for implementing the changes you proposed. Jon Peterson Neustar, Inc. On 8/8/16, 4:06 PM, "Dave Crocker" wrote: > >> As your review of PASSporT is quite exhaustive, and is a mix of >>stylistic >> concerns, philosophical concerns, and technical concerns, perhaps you >> could narrow those down for the group into a list of explicitly >> non-trivial blocking issues. > >Jon, > >I produced a careful review. > >It's not that difficult to distinguish questions from non-questions or >even to distinguish substantive from editorial comments. > >d/ > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Mon Aug 8 16:24:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50B2112B030 for ; Mon, 8 Aug 2016 16:24:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gmOTd6lQ-Gyb for ; Mon, 8 Aug 2016 16:24:34 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F70D12B012 for ; Mon, 8 Aug 2016 16:24:34 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u78NOWs4030340 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 8 Aug 2016 16:24:32 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470698672; bh=Ly50G2j788KSZ1lIIoF0gWjmm2Ptd3Oul/0g+gPGiys=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=f6PNGfKlBKOKTWkASRxzLYRuLDHHypqGynGqB9o+AW+IO3LSGET3Iw7gIlkzWzsX+ qzrMmiVbBsdGFXDQpM0Pba+Vvae1e2K7SMxM+21oyFdZWW1PEeqNqE5Uj9NPUkcI8d yOJkQr6sb8MGA1Jq96Ot2nOud0x9ftoZtapoqgHE= To: "Peterson, Jon" , Christer Holmberg References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> <6688dd94-5c7e-4a9c-f873-69c4eb33f59a@bbiw.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <5e418462-1670-75f8-6c68-6857ceff4a09@dcrocker.net> Date: Mon, 8 Aug 2016 16:24:06 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2016 23:24:35 -0000 On 8/8/2016 4:14 PM, Peterson, Jon wrote: > In that case, if the list has heard your issues, I'd be interested in > knowing how much support there is for implementing the changes you > proposed. Jon, It appears you misread my note. What I asked for was that the feedback I provided be processed in the usual way it is done in the IETF. That is: On 8/8/2016 3:45 PM, Dave Crocker wrote: > In order to avoid having authors do a guessing game about what will > resolve questions and concerns, they normally pursue those items on > the working group's mailing list. Unless things are done differently in this part of the IETF, it is not considered normal IETF process to request working group consensus about whether to respond to the details of a review... But perhaps the word 'respond' is unclear? In the IETF it means to give meaningful responses. That's quite different from, say, automatically expecting suggestions to be agreed to. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 8 20:46:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6888112D72A for ; Mon, 8 Aug 2016 20:46:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zW0asWM7gvnE for ; Mon, 8 Aug 2016 20:46:32 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB9A912D73E for ; Mon, 8 Aug 2016 20:46:32 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u793kYYQ007767 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Mon, 8 Aug 2016 20:46:34 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470714395; bh=P6fb+GXGWubM/onlifD3a/S4CfAvz3VTUxWbez3VRxA=; h=From:Subject:To:Reply-To:Date:From; b=EegGOKf0lmDOO6loywrIR4aQnVGDGh6l6IGbDgYUJ9mjfH/waVeIiPlE117DTlh25 S3KD12cd9OJPO1owP1hpuYo056ucFUyJ+T9zf61Uua2Faj/J0lR10Sc67HPcCiMDH1 glXgeywjbHGAovJNtSKP3xchZicqAKVMKjHNm0GI= From: Dave Crocker Organization: Brandenburg InternetWorking To: "stir@ietf.org" Message-ID: Date: Mon, 8 Aug 2016 20:46:07 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 03:46:37 -0000 Review of: Authenticated Identity Management in the Session Initiation Protocol (SIP) ID: draft-ietf-stir-rfc4474bis-10.txt Date: 8 August 2016 Reviewer: D. Crocker Summary ------- SIP needs to support a mechanism that validates the identifier used for the originator of the request. That is, to ensure that the entity that placed the identification value into the field was authorized by its owner to do so. This specifications is part of a collection of specifications intended to enable such validation. Taken on its own and also when taken with its companion documents, the specifications are confusing and incomplete. It is quite far from being ready for publication. Terminology is used inconsistently. It often is introduced with no background or citation. Many uses of 'header' are probably supposed to be 'header field'. My sense is that quite a bit of terminology is used equally loosely. There is no integrative architectural description, so the reader has difficulty understanding what all of the pieces are or how they fit together. In fact is appears that the document itself gets confused on this matter. Algorithms are all offered only as prose and often in a form mitigating comprehension, such as tending towards negation or disjunction, which humans process less well than affirmatives and conjunctions. From what I can tell, the algorithms often are incomplete, but serious analysis is difficult. The documents appear to rely on a reader's having quite a bit of prior knowledge and are certainly not usable by an implementer who is not already deeply embedded in the community that produced these specifications. My impression is that being embedded won't suffice either, both from my assessment of the documents' deficiencies and given back-channel comments I have heard about the expectation of the work to be done after these specifications are published. Overall, the writing impedes comprehension and the document needs a very diligent pass by a technical editor. I suspect this will uncover quite a number of semantic deficiencies in the text. There is a possible tendency to support more alternative behavior than appropriate. Successful interoperability usually benefits from fewer choices, not more. Common, mandatory canonicalization is an example. Credentials: the specification neither defines nor references a standard for the specification of credentials, here. That means that the technical details -- as distinct from the operational policies -- of credentials are out of scope, although they are fundamental to proper operation of this serve. This is a showstopper, in terms of specification completeness for the service. How is the recipient to know what credential 'standard' is used? How does this ensure interoperability between two participants who have not interacted before? At base, these specifications appear intended to roughly chart out a system structure, leaving most of the difficult work for later and elsewhere. By way of example, there are few if any cross-organization key management services on the Internet that demonstrate the utility needed here. I am pretty sure that Web certs don't qualify. We know that DKIM's operation does, of course. However DKIM strictly uses domain names as identifiers and they conveniently align with their administrative authorities, whereas telephone numbers do not... [[[ The mailing list just had an extensive regurgitation of critical commentary about ENUM. What appears to be getting missed is that whatever mechanism is going to be used for finding and validating keys is going to have no operational history of reliability, safety or efficacy. ]]] There is remarkably little of the original RFC 4474 substance still in this document. Calling it a bis is a bit like tearing all of a building except its fireplace or its front door and calling that a remodeling. The previous document does not have an installed base, so I strongly suggest removing all references to it. It will allow some of the text to be notably simpler and clearer. The document is heavy with forward references. These force the reader to stop what they are in the middle of, try to hold that place, and look forward to understand what they've just been interrupted from reading. As a literary style, forward references create useful tension. In specifications they just interrupt the flow. The document should be reorganization so that integrative text comes /after/ the text describing the pieces being integrated. And opening overview, design summary, or the like can give a non-normative description of the architecture and the service, so the reader has a basic sense of the big picture, before diving into the detail of those to-be-integrated pieces. Detail Comments --------------- > Abstract > > The baseline security mechanisms in the Session Initiation Protocol > (SIP) are inadequate for cryptographically assuring the identity of > the end users that originate SIP requests, especially in an an end user originating a SIP request cryptographically -> adequately 'cryptographically' is not the issue here That is, it is a means, not an end. > interdomain context. This document defines a mechanism for securely 'interdomain' might suffice, but I suspect it's worth pressing the issue, with language like "especially across trust boundaries" or somesuch. > identifying originators of SIP requests. It does so by defining a > SIP header field for conveying a signature used for validating the > identity, and for conveying a reference to the credentials of the > signer. ... > 1. Introduction > > This document provides enhancements to the existing mechanisms for > authenticated identity management in the Session Initiation Protocol > (SIP, [RFC3261]). An identity, for the purposes of this document, is > defined as either a SIP URI, commonly a canonical address-of-record > (AoR) employed to reach a user (such as > 'sip:alice@atlanta.example.com'), or a telephone number, which can be > represented as either a TEL URI [RFC3966] or as the user portion of a > SIP URI. I suspect it does not 'enhance' existing mechanisms as much as add a new one. If the claim is actual enhancement, then what mechanism is enhanced and how does authenticating origin constitute enhancement of it? My point is that I believe the existing mechanisms will operate the same in the future as they have been. This spec doesn't change them. Move definitions to an explicit terminology section, rather than putting them into an Introduction. Also, does this document use the term differently than elsewhere than SIP??? Then why is 'for the purposes of this document' included? > [RFC3261] specifies several places within a SIP request where users > can express an identity for themselves, most prominently the user- > populated From header field. However, the recipient of a SIP request > has no way to verify that the From header field has been populated > appropriately, in the absence of some sort of cryptographic > authentication mechanism. This leaves SIP vulnerable to a category > of abuses, including impersonation attacks that enable robocalling > and related problems as described in [RFC7340]. Ideally, a > cryptographic approach to identity can provide a much stronger and > less spoofable assurance of identity than the Caller ID services that > the telephone network provides today. > > [RFC3261] encourages user agents (UAs) to implement a number of > potential authentication mechanisms, including Digest authentication, > Transport Layer Security (TLS), and S/MIME (implementations may > support other security schemes as well). However, few SIP user > agents today support the end-user certificates necessary to > authenticate themselves (via S/MIME, for example), and for its part > Digest authentication is limited by the fact that the originator and > destination must share a prearranged secret. Practically speaking, > originating user agents need to be able to securely communicate their > users' identity to destinations with which they have no previous > association. > > As an initial attempt to address this gap, [RFC4474] specified a > means of signing portions of SIP requests in order to provide an > identity assurance. However, RFC 4474 was in several ways misaligned > with deployment realities (see [I-D.rosenberg-sip-rfc4474-concerns]). > Most significantly, RFC 4474 did not deal well with telephone numbers > as identifiers, despite their enduring use in SIP deployments. RFC > 4474 also provided a signature over material that intermediaries in > existing deployments commonly altered. This specification therefore > > > > Peterson, et al. Expires January 8, 2017 [Page 3] > > > Internet-Draft SIP Identity July 2016 > > > revises RFC 4474 in light of recent reconsideration of the problem > space to align with the threat model in [RFC7375], and aligns the > signature format with PASSporT [I-D.ietf-stir-passport]. This kind of review of history is best relegated to a minor location in the document. If the current spec is successful, history like this will be distracting, 10 years from now.... > 2. Terminology > > In this document, the key words "MUST", "MUST NOT", "REQUIRED", > "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT > RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as > described in RFC 2119 [RFC2119] and RFC 6919 [RFC6919]. > > 3. Background This section includes far more than background. It also provides a summary description of the mechanism being defined here. I suggest having this section only give background on sip and the problem, with a separate section for the design summary. Or else call this Introduction, but really it would be better to split them. > Per [RFC7340], problems such as robocalling, voicemail hacking, and > swatting are enabled by an attacker's ability to impersonate someone > else. The secure operation of most SIP applications and services > depends on authorizing the source of communications as it is > represented in a SIP request. Such authorization policies can be > automated or be a part of human operation of SIP devices. An example > of the former would be a voicemail service that compares the identity > of the caller to a whitelist before determining whether it should > allow the caller access to recorded messages. An example of the > latter would be an Internet telephone application that displays the > calling party number (and/or Caller-ID) of a caller, which a human > may review to make a policy decision before answering a call. In > both of these cases, attackers might attempt to circumvent these > authorization policies through impersonation. Since the primary > identifier of the sender of a SIP request, the From header field, can > be populated arbitrarily by the controller of a user agent, > impersonation is very simple today in many environments. The add: Hence the foundation to accurate authorization is valid authentication. > mechanism described in this document provides a strong identity > system for detecting attempted impersonation in SIP requests. "provides a strong identity system for detecting" could mean many things, whereas the goal here is quite specific. So replace it with: ...enables an authentication capability for protecting against... > This identity architecture for SIP depends on a logical > "authentication service" which validates outgoing requests. An It likely will validate them in multiple places, including incoming requests. > authentication service may be implemented either as part of a user > agent or as a proxy server; typically, it is a component of a network > intermediary like a proxy to which originating user agents send > unsigned requests. Once the sender of the message has been > authenticated, the authentication service then computes and adds sender? Does that mean the caller? the caller's ua? the caller's operator? the term is ambiguous. > cryptographic information (including a digital signature over some > components of messages) to requests to communicate to other SIP > entities that the sending user has been authenticated and its claim worth breaking this sentence into two, for better clarity. > of a particular identity has been authorized. A "verification > service" on the receiving end then validates this signature and > enables policy decisions to be made based on the results of the > verification. > > > > > Peterson, et al. Expires January 8, 2017 [Page 4] > > > Internet-Draft SIP Identity July 2016 > > > Identities are issued to users by authorities. When a new user > becomes associated with example.com, the administrator of the SIP > service for that domain can issue them an identity in that namespace, > such as alice@example.com. Alice may then send REGISTER requests to > example.com that make her user agents eligible to receive requests > for sip:alice@example.com. In some cases, Alice may be the owner of > the domain herself, and may issue herself identities as she chooses. > But ultimately, it is the controller of the SIP service at > example.com that must be responsible for authorizing the use of names > in the example.com domain. Therefore, for the purposes of baseline > SIP, the credentials needed to prove a user is authorized to use a > particular From header field must ultimately derive from the domain > owner: either a user agent gives requests to the domain name owner in > order for them to be signed by the domain owner's credentials, or the > user agent must possess credentials that prove in some fashion that > the domain owner has given the user agent the right to a name. > > The situation is however more complicated for telephone numbers, > however. Authority over telephone numbers does not correspond however...however > directly to Internet domains. While a user could register at a SIP > domain with a username that corresponds to a telephone number, any > connection between the administrator of that domain and the > assignment of telephone numbers is not currently reflected on the > Internet. Telephone numbers do not share the domain-scope property > described above, as they are dialed without any domain component. > This document thus assumes the existence of a separate means of > establishing authority over telephone numbers, for cases where the > telephone number is the identity of the user. As with SIP URIs, the > necessary credentials to prove authority for a name might reside > either in the endpoint or at some intermediary. Note that the preceding discussion makes no mention of "SIP URI". If one reads back and connects some dots, the reader might guess that the alice@ discussion is for a SIP URI, but the text should make this explicit. The following paragraph really is the design summary for the specification: > This document specifies a means of sharing a cryptographic assurance > of end-user SIP identity in an interdomain or intradomain context. I suspect the above sentence is seriously redundant. If it isn't, it needs to be quite a bit sooner, since it is fundamental. Certainly it is not 'background'. > It relies on the authentication service constructing tokens based on > the PASSporT [I-D.ietf-stir-passport] format, a JSON [RFC7159] object > comprising values copied from certain header field values in the SIP > request. The authentication service then computes a signature over > those JSON object in a manner following PASSporT. That signature is "those JSON object" ? Also, where is the object? How is it created? How is it conveyed? Also 'The authentication service' might refer to the signing side or to the verifying side. How is the reader to know for certain? A diagram of the overall service and its components could be quite helpful. > then placed in a SIP Identity header. In order to assist in the header /field/? > validation of the Identity header, this specification also describes > some metadata fields associated with the header that can be used by > the recipient of a request to recover the credentials of the signer. > Note that the scope of this document is limited to providing this > identity assurance for SIP requests; solving this problem for SIP > responses is outside the scope of this work (see [RFC4916]). Future > work might specify ways that a SIP implementation could gateway > PASSporT objects to other protocols. And it might not. To the extent that you have to say something about work that might or might not be done, just cite the topic and that it isn't covered here. Such as: Gatewaying Passport objects to other services is outside the scope of this specification. (Odd thought: Given that JSON isn't native to SIP and that there must be some translation/encoding of the json object to work with SIP, that effectively means that this /is/ a gatewaying application of the object...) > > > Peterson, et al. Expires January 8, 2017 [Page 5] > > > Internet-Draft SIP Identity July 2016 > > > This specification allows either a user agent or a proxy server to > provide the authentication service function and/or the verification > service function. To maximize end-to-end security, it is obviously > preferable for end-users to acquire their own credentials; if they "To maximize end-to-end security, it is obviously preferable for end-users to acquire their own credentials;? I'm not exactly sure what this means or is supposed to mean, but I suspect it's incorrect. > do, their user agents can act as authentication services. However, > for some deployments, end-user credentials may be neither practical > nor affordable, given the potentially large number of SIP user agents > (phones, PCs, laptops, PDAs, gaming devices) that may be employed by > a single user. In such environments, synchronizing keying material > across multiple devices may be prohibitively complex and require > quite a good deal of additional endpoint behavior. Managing several > credentials for the various devices could also be burdensome. In > these cases, implementation the authentication service at an > intermediary may be more practical. This trade-off needs to be > understood by implementers of this specification. > > 4. Overview of Operations > > This section provides an informative (non-normative) high-level > overview of the mechanisms described in this document. described -> specified (or defined) But note that we've already been given a high-level overview... On reflection, this section isn't an 'overview'. It's an example scenario. The essential difference is that this makes specific choices, such as use of a proxy, which might not apply in some valid scenarios. As some integrative pedagogy, that's fine. So I suggest re=labeling the section rather than changing it's substance. > Imagine a case where Alice, who has the home proxy of example.com and > the address-of-record sip:alice@example.com, wants to communicate > with Bob at sip:bob@example.org. They have no prior relationship, > and Bob implements best practices to prevent impersonation attacks. > > Alice generates an INVITE and places her identity, in this case her > address-of-record, in the From header field of the request. She then > sends an INVITE over TLS to an authentication service proxy for the > example.com domain. How is reference to TLS meaningful here? > > The proxy authenticates Alice (possibly by sending a Digest > authentication challenge), and validates that she is authorized to Again, how is discussion of the internal, non-STIR aspects of SIP operationally relevant here? > assert the identity that she populated in the From header field. > This value could be Alice's AoR, but in other cases it could be some > different value that the authentication service has authority over, That bit of vagueness isn't helpful, given the motivation for doing this work. It reduces to: something will get authenticated, but we won't say what and we won't say where to find out. > such as a telephone number. The proxy authentication service then > constructs a PASSporT object which contains a JSON representations of > headers and claims which mirror certain parts of the SIP request, > including the identity in the From header field. As a part of > generating the PASSporT object, the authentication service signs a > hash of those headers and claims with the appropriate credential for > the identity (in this case, the certificate for example.com, which > covers the identity sip:alice@example.com), and the signature is > inserted by the proxy server into the Identity header field value of > the request. Optionally, the JSON headers and claims themselves may > also be included in the object, encoded in the "canon" parameter of > the Identity header. why? when? Tossing in vague references about optional behavior that is neither motivated nor explained usually proves more of a distraction than a help, when writing an 'overview' or an example. > > > > Peterson, et al. Expires January 8, 2017 [Page 6] > > > Internet-Draft SIP Identity July 2016 > > > The proxy, as the holder of the private key for the example.com > domain, is asserting that the originator of this request has been > authenticated and that she is authorized to claim the identity that > appears in the From header field. The proxy inserts an "info" > parameter into the Identity header that tells Bob how to acquire > keying material necessary to validate its credentials (a public key), > in case he doesn't already have it. A scheme that has an untrusted object carrying information about where to find trust information for the object sounds like a serious security hole. Why should the pointer be trusted? > When Bob's domain receives the request, it verifies the signature > provided in the Identity header, and thus can validate that the > authority over the identity in the From header field authenticated > the user, and permitted the user to assert that From header field > value. This same validation operation may be performed by Bob's user > agent server (UAS). As the request has been validated, it is > rendered to Bob. If the validation was unsuccessful, some other > treatment would be applied by the receiving domain. Huge operational transition question: How is the absence of the signature treated? Today, there are no signatures. Tomorrow there might be some, both it won't be true that /all/ incoming requests are signed. So how is the receiver supposed to handle the absence of a signature? Related question: Is everyone certain that transit of the request will /never/ break the signature? What is the basis for that assessment? And if a signature /can/ break, then the interpretation of an invalid signature could mean either spoofing or operational error. > > 5. Signature Generation and Validation > > 5.1. Authentication Service Behavior > > This document specifies a role for SIP entities called an delete first sentence. it adds no useful information. > authentication service. The authentication service role can be > instantiated, for example, by an intermediary such as a proxy server Constant references to implementation (and 'instantiation') possibilities distracts from the required task of defining the architecture and functions of the service. > or by a user agent. Any entity that instantiates the authentication > service role MUST possess the private key of one or more credentials "private key of one or more credentials" - not sure what this means? One key can have more than one credential? On the signing side, I'd expect the process to start by choosing a credential and then using its associated key. Simpler wording: The authentication service possesses the private... > that can be used to sign for a domain or a telephone number (see can be used to sign the From identity. > Section 6.1). Intermediaries that instantiate this role MUST be forward reference. better to put that material before this. > capable of authenticating one or more SIP users who can register for one or more SIP users -> users the word identity hasn't bee used in this paragraph, before this, so the referent is unclear. Also, this requirement for authentication appears to be redundant with the later specification for authentication in Step 2. > that identity. Commonly, this role will be instantiated by a proxy > server, since these entities are more likely to have a static > hostname, hold corresponding credentials, and have access to SIP > registrar capabilities that allow them to authenticate users. It is > also possible that the authentication service role might be > instantiated by an entity that acts as a redirect server, but that is > left as a topic for future work. Not only is the above, last sentence about future work; it appears to be entirely irrelevant to this specification. Remove it. > > An authentication service adds the Identity header to SIP requests. Note that we've read this before. So I'm raising a redundancy flag. > The procedures below define the steps that must be taken when each an > header is added. More than one may appear in a single request, and header -> header /field/ ? And, by the way, what header field is that? The "the procedures" sentence adds nothing and is redundant with the later "entities instantiating" sentence. In any event, don't make forward references like this. Put it after the relevant details, so that there already is context and this just enhances it. From what I can tell, this entire paragraph should be moved toward the end of this section. > an authentication service may add an Identity header to a request > that already contains one or more Identity headers. If the Identity > header added follows extended signing procedures beyond the baseline > given in Section 8, then it differentiates the header with a "ppt" > parameter per the fourth step below. > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 7] > > > Internet-Draft SIP Identity July 2016 > > > Entities instantiating the authentication service role perform the > following steps, in order, to generate an Identity header for a SIP > request: The authentication service performs the following steps in order, to... Procedural detail should be in a procedural form. Extended prose like this isn't as easily grokked. That invites both writing and reading errors to the algorithm. > Step 1: Step 1: Authoritative for Identity > First, the authentication service must determine whether it is > authoritative for the identity of the sender of the request. In > ordinary operations, the authentication service decides this by > inspecting the URI value from the addr-spec component of From header > field; this URI will be referred to here as the 'identity field'. If > the identity field contains a SIP or SIP Secure (SIPS) URI, and the > user portion is not a telephone number, the authentication service how is its not being a telephone number determined deterministically and correctly? > MUST extract the hostname portion of the identity field and compare > it to the domain(s) for which it is responsible (following the > procedures in RFC 3261 [RFC3261], Section 16.4). If the identity > field uses the TEL URI scheme [RFC3966], or the identity field is a > SIP or SIPS URI with a telephone number in the user portion, the > authentication service determines whether or not it is responsible > for this telephone number; see Section 7.1 for more information. An This canonicalization text seems entirely out of place, in the middle of specification about authority. > authentication service proceeding with a signature over a telephone > number MUST then follow the canonicalization procedures described in > Section 7.2. If the authentication service is not authoritative for > the identity in question, it SHOULD process and forward the request > normally unless the local policy is to block such requests. The > authentication service MUST NOT add an Identity header if the > authentication service does not have the authority to make the claim > it asserts. > > Step 2: Step 2: Authorization > > The authentication service MUST then determine whether or not the [or not] remove > sender of the request is authorized to claim the identity given in sender: calling user?, calling ua?, originating operator? intermediary? Although the word is used frequently in the SIP spec, it is not defined. > the identity field. In order to do so, the authentication service > MUST authenticate the sender of the message. Some possible ways in > which this authentication might be performed include: Remove the pedagogy after the first sentence. The choices are outside of this specification and the spec is not enhanced by pedagogy about technical matters outside of its scope. Also isn't the first sentence redundant with other text in the spec? > > If the authentication service is instantiated by a SIP > intermediary (proxy server), it may authenticate the request with > the authentication scheme used for registration in its domain > (e.g., Digest authentication). > > If the authentication service is instantiated by a SIP user agent, > a user agent may authenticate its own user through any system- > specific means, perhaps simply by virtue of having physical access > to the user agent. > > > > > > Peterson, et al. Expires January 8, 2017 [Page 8] > > > Internet-Draft SIP Identity July 2016 > > > Authorization of the use of a particular username or telephone number > in the user part of the From header field is a matter of local policy > for the authentication service; see Section 6.1 for more information. > > Note that this check is performed only on the addr-spec in the > identity field (e.g., the URI of the sender, like > 'sip:alice@atlanta.example.com'); it does not convert the display- > name portion of the From header field (e.g., 'Alice Atlanta'). For > more information, see Section 12.6. 'checking' and 'converting' are very different actions. So 'it does not' does not flow from the preceding text in the sentence. > > Step 3: Step 3: Timestamp > > An authentication service MUST add a Date header field to SIP Why? (Probably only need to cite the earlier discussion about its use for replay mitigation. But merely cite; don't duplicate.) > requests that do not have one. The authentication service MUST > ensure that any preexisting Date header in the request is accurate. > Local policy can dictate precisely how accurate the Date must be; a > RECOMMENDED maximum discrepancy of sixty seconds will ensure that the > request is unlikely to upset any verifiers. If the Date header > contains a time different by more than one minute from the current > time noted by the authentication service, the authentication service > SHOULD reject the request. This behavior is not mandatory because a > user agent client (UAC) could only exploit the Date header in order > to cause a request to fail verification; the Identity header is not > intended to provide a source of non-repudiation or a perfect record Then where does the non-repudiation feature of STIR come from? > of when messages are processed. Finally, the authentication service > MUST verify that both the Date header and the current time fall > within the validity period of its credential. > > See Section 12 for information on how the Date header field assists > verifiers. > > Step 4: > > Subsequently, the authentication service MUST form a PASSporT object > and add a corresponding an Identity header to the request containing a corresponding an ?->? a corresponding > this signature. For baseline PASSporT objects headers (without an baseline PASSporT objects headers -> a baseline PASSporT objects header > Identity header "ppt" parameter), this follows the procedures in header? or header field? > Section 8; if the authentication service is using an alternative > "ppt" format, it MUST add an appropriate "ppt" parameter and follow Isn't this text repeating specification text that is elsewhere in the document? If so, remove it. > the procedures associated with that extension (see Section 9). After > the Identity header has been added to the request, the authentication > service MUST also add a "info" parameter to the Identity header. The > "info" parameter contains a URI from which the authentication > service's credential can be acquired; see Section 6.3 for more on > credential acquisition. > > Step 5: Step 5: Canonicalization > > > > Peterson, et al. Expires January 8, 2017 [Page 9] > > > Internet-Draft SIP Identity July 2016 > > > In the circumstances described below, an authentication service will another forward reference, this time without even a specific pointer. > add a "canon" parameter to the Identity header. The syntax of > "canon" is given in Section 8; essentially, it contains a base64 > encoding of the JSON header and claims in the PASSporT object. The > presence of "canon" is OPTIONAL baseline PASSporT objects in SIP as a > because the information carried in the baseline PASSporT object's > headers and claims is usually redundant with information already > carried elsewhere in the SIP request. Omitting "canon" can > significantly reduce SIP message size, especially when the PASSporT > object contains media keys. > > When however an authentication service creates a PASSporT that uses "When however"? > extension claims beyond the baseline PASSporT object, including > "canon" is REQUIRED in order for the verification service to be > capable of validating the signature. See Section 9. > > Also, in some cases, a request signed by an authentication service "in some cases"? This is a specification. Where is the clear detail? > will be rejected by the verification service on the receiving side, "on the receiving side" is redundant. Remove it. Where else is there a verification service? > and the authentication service will receive a SIP 4xx status code in > the backwards direction, such as a 438 indicating a verification This is offered as descriptive text here. Where is this SIP behavior documented in this spec? > failure. If the authentication service did not originally send the The authentication service does sending? I think it doesn't, and the definition of its roles implies that it doesn't, but rather that it is part of one or another module that does. > Identity header with the "canon" parameter, it SHOULD retry a request and hence it doesn't do retries. All of this needs to be recast in terms that match the specified architecture. > once after receiving a 438 response, this time including the "canon". Why? This is just guessing. Protocols that do guessing don't work very well. This interaction needs to be re-specified to be deterministic. > The information in "canon" is useful on the verification side for > debugging errors, and there are some known causes of verification > failures (such as the Date header changing in transit, see > Section 12.1 for more information) that can be resolved by the > inclusion of "canon". > > Finally, the authentication service MUST forward the message > normally. it doesn't do forwarding. > > 5.2. Verifier Behavior > > This document specifies a logical role for SIP entities called a redundant detail. > verification service, or verifier. When a verifier receives a SIP > message containing one or more Identity headers, it inspects the headers? header fields? > signature(s) to verify the identity of the sender of the message. > The results of a verification are provided as input to an > authorization process that is outside the scope of this document. Step 5, below, specifies a behavior that is within scope. > A SIP request may contain zero, one, or more Identity headers. A > verification service performs the procedures above on each Identity > header that appears in a request. If the verifier does not support What does it mean to 'not support an Identity header [field]"? Why might there be multiple Identity header [fields]? How might they differ? > an Identity header present in a request due to the presence of an > unsupported "ppt" parameter, or if no Identity header is present, and > the presence of an Identity header is required by local policy (for > example, based on a per-sending-domain policy, or a per-sending-user > > > > Peterson, et al. Expires January 8, 2017 [Page 10] > > > Internet-Draft SIP Identity July 2016 > > > policy), then a 428 'Use Identity Header' response MUST be sent in > the backwards direction. For more on this and other failure > responses, see Section 13.3. > > In order to verify an Identity header in a message, an entity acting > as a verifier MUST perform the following steps, in the order here > specified. Note that when an Identity header contains the optional > "canon" parameter, the verifier MUST follow the additional procedures > in Section 5.2.1. > > Step 1: Step 1: PPT parameter > The verifier MUST inspect any optional "ppt" parameter appearing the [optional] remove. Especially given the MUST. It doesn't matter whether the ppt was optional for the signer. "any" can there be more than one? If only one then perhaps: MUST inspect the "ppt" parameter, if present in the Identity request. > Identity request. If no "ppt" parameter is present, then the > verifier proceeds normally below. If a "ppt" parameter value is 'normally' implies the alternative is abnormal. also, 'below' where? > present, and the verifier does not support it, it MUST ignore the > Identity header. If a supported "ppt" parameter value is present, > the verifier follows the procedures below, including the variations > described in Step 5. is the 'below' here different from the one before it? From the above text, it appears that ppt does not affect processing, as long as the ppt is "supported". That is, an absent ppt and a valid ppt both produce the same sequence 'below'. > > Step 2: Step 2: Signature Scope > In order to determine whether the signature for the identity field > should be over the entire identity field URI or just a canonicalized > telephone number, the verification service MUST follow the > canonicalization process described in Section 7.2. That section also > describes the procedures the verification service MUST follow to > determine if the signer is authoritative for a telephone number. For Those two functions are wildly different. Why are they part of the same process? > domains, the verifier MUST follow the process described in > Section 7.3 to determine if the signer is authoritative for the > identity field. > > Step 3: Step 3: Obtain Key > The verifier must first ensure that it possesses the proper keying > material to validate the signature in the Identity header field, > which usually involves dereferencing a URI in the "info" parameter of > the Identity header. See Section 6.2 for more information on these > procedures. If the verifier does not support the credential > described in the "info" parameter, then it should consider the Only should? Why??? > credential for this header unsupported. If a SIP request contains no > Identity headers with a supported credential, then the verifier MUST > return a 437 "Unsupported Credential" response Verifier returns responses? > Step 4: Step 4: Date Window Enforcement > The verifier MUST furthermore ensure that the value of the Date > header of the request meets local policy for freshness (usually, > > > > Peterson, et al. Expires January 8, 2017 [Page 11] > > > Internet-Draft SIP Identity July 2016 > > > within sixty seconds) and that it falls within the validity period of > the credential used to sign the Identity header. For more on the > attacks this prevents, see Section 12.1. If the "canon" parameter is There was earlier discussion of using a date window validation to mitigate against some attacks. There doesn't need to be yet-another reference here. Just cite the earlier discussion. > present, the verifier should follow the Date-related behavior in > Section 5.2.1. > > Step 5: Step 5: Signature Validation > The verifier MUST validate the signature in the Identity header field > over the PASSporT object. For baseline PASSporT objects (with no > Identity header "ppt" parameter) the verifier MUST follow the > procedures for generating the signature over a PASSporT object > described in Section 8. If a "ppt" parameter is present (and per > Step 1, is understood), the verifier follows the procedures for that > "ppt" (see Section 9). If a verifier determines that the that the > signature in the Identity does not correspond to the reconstructed > signed-identity-digest, then the Identity header should be considered > invalid. I suggest breaking this step into two parts: signature regeneration and signature validation. It appears that the specification is calling for two (or more???) different methods of doing signature validation, depending upon whether ppt is present. This seems like an outstandingly bad idea. It creates complexity and possibly even outright confusion. There needs to be a single algorithm for validation, even if components of the algorithm have branches, such as depending on whether the 'address' is a URI or a telephone number. > > The presence of multiple Identity headers within a message raises the > prospect that a verification services could receive a message > containing some valid and some invalid Identity headers. If the > verifier determines all Identity headers within a message are > invalid, then a 438 'Invalid Identity Header' response MUST be > returned. So it's ok to have no Identity header fields but it's not ok to have identity, where none validate. This means that the entire transfer environment is expected and required to convey Identity fields perfectly, all the time. > The verification of an Identity header does not entail any particular > treatment of the request. The handling of the message after the > verification process depends on how the implementation service is > implemented and on local policy. This specification does not propose > any authorization policy for user agents or proxy servers to follow > based on the presence of a valid Identity header, the presence of an > invalid Identity header, or the absence of an Identity header, but it > is anticipated that local policies could involve making different > forwarding decisions in intermediary implementations, or changing how > the user is alerted, or how identity is rendered, in user agent > implementations. I suspect the above paragraph belongs elsewhere and sooner. It isn't part of the step sequence. > > 5.2.1. Handling 'canon' parameters > > If the optional "canon" parameter of the Identity header is present, [optional] remove. it's redudnant with 'if' [of the Identity header] remove. there is no other canon parameter. But really I suspect that even the 'if' is unecessary. The optionality has been established elsewhere. The task here is merely to specify what is in a canon. > it contains a base64 encoding of the header and claim component of This appears to be a re-specification of canon. Don't do that. Cite its spec and then simply use it. > the PASSporT object constructed by the authentication service, and > this it conveys any canonical telephone number formats created by the this -> thus ? there are multiple canon formats? that doesn't sound very canonical. but again, stating what it conveys is redundant. > authentication service (see Section 7.2), as well as an "iat" claim > corresponding to the Date header that the authentication service > used. The "canon" is provided purely as an optimization and > debugging mechanism for the verification service. This is the wrong place to state what canon is for. > > > > Peterson, et al. Expires January 8, 2017 [Page 12] > > > Internet-Draft SIP Identity July 2016 > > > When "canon" is present, the verification service MAY compute its own 'MAY'??? I don't understand making canonicalization optional, either during signing or during verification. > canonicalization of the numbers and compare them to the values in the > "canon" parameter before performing any cryptographic functions in > order to ascertain whether or not the two ends agree on the canonical > number form. Also, when "canon" is present, during Step 4 the > verification service SHOULD compare the "iat" value in the "canon" to This is talking about actions during Step 4. Move it to Step 4! > its Date header field value. If the two are different, and the "iat" > value is later but within verification service policy for freshness, > the verification service SHOULD perform the computation required by > Step 5 using the "iat" value instead of the Date value. As some > deployments in the field have been observed to change the Date header > in transit, this procedure will prevent some unnecessary verification > failures. [unnecessary] remove. But it won't prevent others. This means that signatures that were valid will break. And this ought to mitigate the handling of broken signatures. > > 6. Credentials > > 6.1. Credential Use by the Authentication Service > > In order to act as an authentication service, a SIP entity must have > access to the private keying material of one or more credentials that > cover domain names or telephone numbers. These credentials may > represent authority over an entire domain (such as example.com) or > potentially a set of domains enumerated by the credential. [potentially] remove The implication is that "a set of domains" is not "an entire domain", but I don't understand how the language says that. As written, this actually translates to something like: authority over one or more domains. Possibly what was meant is something like: authority over an entire domain, or some number of sub-domains under that higher-level domain. > Similarly, a credential may represent authority over a single > telephone number or a range of telephone numbers. The way that the Similarly for telephone numbers, a credential can represent one or a range of numbers. > scope of a credential is expressed is specific to the credential > mechanism. So, there is no standard for the specification of credentials, here. That means that the technical details -- as distinct from the operational policies -- of credentials are out of scope, although they are fundamental to proper operation of this serve. This is a showstopper, in terms of specification completeness for the service. The following paragraph is not about credentials. It is about signing policy. It belongs elsewhere. And since it isn't really specifying anything, that elsewhere probably is up towards introductory text. > Authorization of the use of a particular username or telephone number > in the identity field is a matter of local policy for the > authentication service, one that depends greatly on the manner in Huh? But really, when a specification says something is out of scope and is a matter for local policy, the specification should not then go on to specify examples of local policy. In those cases where there is a compelling benefit to include such examples, put them in an appendix. But please, then, explain that compelling benefit. > which authentication is performed. For non-telephone number user > parts, one policy might be as follows: the username given in the > 'username' parameter of the Proxy-Authorization header MUST > correspond exactly to the username in the From header field of the > SIP message. However, there are many cases in which this is too > limiting or inappropriate; a realm might use 'username' parameters in > Proxy-Authorization that do not correspond to the user-portion of SIP > From headers, or a user might manage multiple accounts in the same > administrative domain. In this latter case, a domain might maintain > a mapping between the values in the 'username' parameter of Proxy- > Authorization and a set of one or more SIP URIs that might > legitimately be asserted for that 'username'. For example, the > username can correspond to the 'private identity' as defined in Third > Generation Partnership Project (3GPP), in which case the From header > field can contain any one of the public identities associated with > this private identity. In this instance, another policy might be as > follows: the URI in the From header field MUST correspond exactly to > > > > Peterson, et al. Expires January 8, 2017 [Page 13] > > > Internet-Draft SIP Identity July 2016 > > > one of the mapped URIs associated with the 'username' given in the > Proxy-Authorization header. This is a suitable approach for > telephone numbers in particular. > > This specification could also be used with credentials that cover a > single name or URI, such as alice@example.com or > sip:alice@example.com. This would require a modification to > authentication service behavior to operate on a whole URI rather than > a domain name. Because this is not believed to be a pressing use > case, this is deferred to future work, but implementers should note > this as a possible future direction. > > Exceptions to such authentication service policies arise for cases > like anonymity; if the AoR asserted in the From header field uses a > form like 'sip:anonymous@example.com' (see [RFC3323]), then the > 'example.com' proxy might authenticate only that the user is a valid > user in the domain and insert the signature over the From header > field as usual. > > 6.2. Credential Use by the Verification Service > > In order to act as a verification service, a SIP entity must have a > way to acquire and retain credentials for authorities over particular for -> from ? > domain names and/or telephone numbers or number ranges. > Dereferencing the URI found in the "info" parameter of the Identity > header (as described in the next section) MUST be supported by all forward reference > verification service implementations to create a baseline means of I /really/ don't understand the trust model that has a security scheme where the object giving a pointer to its own credential. Or rather, I fear that I do understand it, but don't understand why its considered credible. > credential acquisition. Provided that the credential used to sign a > message is not previously known to the verifier, SIP entities SHOULD > discover this credential by dereferencing the "info" parameter, > unless they have some more other implementation-specific way of > acquiring the needed keying material, such as an offline store of > periodically-updated credentials. If the URI in the "info" parameter > cannot be dereferenced, then a 436 'Bad Identity-Info' response MUST > be returned. Again, this much non-determinacy in such an essential mechanism ensures /non-/interoperability. I do understand the intent to have private/proprietary mechanism at work for use of this spec back in the regulated telecom space, but that does not mean it needs to distract the public specification. A complete specification of a STIR service needs to include a publicly-usable key certification mechanism, a la DANE or DKIM or the like. The application of STIR for other, non-open operations are always free to amend the specification through a separate profile that overrides one or another piece of the base STIR specifications. > > This specification does not propose any particular policy for a > verification service to determine whether or not the holder of a > credential is the appropriate party to sign for a given SIP identity. This is a fundamental flaw in this specification. It reduces to saying that the document is specifying a validation service that does not provide a deterministic means for assessing validation. > Guidance on this is deferred to the credential mechanism > specifications, which must meet the requirements in Section 6.4. > > Verification service implementations supporting this specification > may wish to have some means of retaining credentials (in accordance > with normal practices for credential lifetimes and revocation) in > order to prevent themselves from needlessly downloading the same > credential every time a request from the same identity is received. > Credentials cached in this manner may be indexed in accordance with This is gratuitous implementation advice. Remove it. If there is a compelling desire to give implementation advice, move it to a separate document and make it more complete. It is especially ironic to try to give implementation advice about a mechanism that isn't fully specified. > > Peterson, et al. Expires January 8, 2017 [Page 14] > > > Internet-Draft SIP Identity July 2016 > > > local policy: for example, by their scope, or the URI given in the > "info" parameter value. Further consideration of how to cache > credentials is deferred to the credential mechanism specifications. > > 6.3. Handling 'info' parameter URIs I don't find a specification for the 'info' parameter. I find many references to the Identity-Info header field, but assume that's not what is meant here. I also find abnf for an ident-info rule, which includes an "ident" literal string. I suspect this is the reference you intend? Please reference these more formally and properly cite their definition at first use. (If you want to rename rules, to make the use of the rulename more pleasant in the text, that's fine. But just make sure that a new reader can understand what type of reference is being made and where to go to find its definition. Ditto for "alg". Ditto for ppt. And, of course, these are more forward references. In this case, it's giving detail about something that hasn't even been defined yet. > An "info" parameter MUST contain a URI which dereferences to a This isn't about the handling of info. It's defining its contents. They need to be separate segments of text. > resource that contains the public key components of the credential > used by the authentication service to sign a request. It is > essential that a URI in the "info parameter" be dereferencable by any Again, specification, not handling. Also, what do the instructions mean? How is the signer to know what is dereferenceable by the verifier? > entity that could plausibly receive the request. For common cases, > this means that the URI must be dereferencable by any entity on the > public Internet. In constrained deployment environments, a service > private to the environment might be used instead. > > Beyond providing a means of accessing credentials for an identity, > the "info" parameter further serves as a means of differentiating > which particular credential was used to sign a request, when there > are potentially multiple authorities eligible to sign. For example, It sounds as if the real need is to have an external registry of authorized credentialing services and then refer to the one that is used by name. That provides independent vetting and limits the 'vocabulary' of credential service references the message can cite. > imagine a case where a domain implements the authentication service > role for a range of telephone and a user agent belonging to Alice has > acquired a credential for a single telephone number within that > range. Either would be eligible to sign a SIP request for the number > in question. Verification services however need a means to > differentiate which one performed the signature. The "info" > parameter performs that function. > > 6.4. Credential System Requirements Besides having extraneous material, this section is almost certainly incomplete and probably extremely incomplete. I suggest removing the section and simply state that the details of the credentialing system are outside the scope of this specification, except for specifying a registry that lists possible systems. Also note that the claimed interest in authentication beyond SIP will also require credentialing systems. As such, the entire topic appears to be larger than this specification. > This document makes no recommendation for the use of any specific > credential system. Today, there are two primary credential systems A review of current, external services and hypothetical capabilities is not appropriate for inclusion inside a technical specification. Move it to a separate document. > in place for proving ownership of domain names: certificates (e.g., > X.509 v3, see [RFC5280]) and the domain name system itself (e.g., > DANE, see [RFC6698]). It is envisioned that either could be used in > the SIP identity context: an "info" parameter could for example give > an HTTP URL of the Content-Type 'application/pkix-cert' pointing to a > certificate (following the conventions of [RFC2585]). The "info" > parameter may use the DNS URL scheme (see [RFC4501]) to designate > keys in the DNS. > > While no comparable public credentials exist for telephone numbers, > either approach could be applied to telephone numbers. A credential > system based on certificates is given in > [I-D.ietf-stir-certificates], but this specification can work with > other credential systems; for example, using the DNS was proposed in > [I-D.kaplan-stir-cider]. the above isn't 'requirements'. > > > > > Peterson, et al. Expires January 8, 2017 [Page 15] > > > Internet-Draft SIP Identity July 2016 > > > In order for a credential system to work with this mechanism, its > specification must detail: > > which URIs schemes the credential will use in the "info" > parameter, and any special procedures required to dereference the > URIs > > how the verifier can learn the scope of the credential what does scope of the credential'? > any special procedures required to extract keying material from > the resources designated by the URI > > any algorithms required to validate the credentials (e.g. for > certificates, any algorithms used by certificate authorities to > sign certificates themselves) Looks like this needs to define a STIR Credential Registry. > It is furthermore required that all credential specifications > describe how the associated credentials will support the mandatory > signing algorithm(s) required by PASSporT [I-D.ietf-stir-passport]. So this really is another bullet for the above, indented list? Then again: credentials supporting signing algorithms? I don't understand this. The signing algorithms are for the payload using the key /from/ the credential. So what does this requirement mean, and why? > > SIP entities cannot reliably predict where SIP requests will > terminate. When choosing a credential scheme for deployments of this > specification, it is therefore essential that the trust anchor(s) for > credentials be widely trusted, or that deployments restrict the use > of this mechanism to environments where the reliance on particular > trust anchors is assured by business arrangements or similar > constraints. replace above with: Use of a credentialing mechanism must be supported within a scope sufficient to include the authentication service, the verifying service and the credentialing service. > > Note that credential systems must address key lifecycle management > concerns: were a domain to change the credential available at the > Identity-Info URI before a verifier evaluates a request signed by an > authentication service, this would cause obvious verifier failures. > When a rollover occurs, authentication services SHOULD thus provide > new Identity-Info URIs for each new credential, and SHOULD continue > to make older key acquisition URIs available for a duration longer > than the plausible lifetime of a SIP transaction (a minute would most > likely suffice). > > 7. Identity Types > > This specification focuses primarily on cases where the called and Focuses primarily? What I've been reading in this spec covers both phone and uri forms. So I don't know what the 'primarily' refers to. > calling parties identified in the To and From header field values use > telephone numbers, as this remains the dominant use case in the > deployment of SIP. However, this specification also works with > "greenfield" identifiers (of the form "sip:user@host"), and > potentially other identifiers when SIP interworks with another > protocol. What about these is 'greenfield'? What does it mean here? > > > > Peterson, et al. Expires January 8, 2017 [Page 16] > > > Internet-Draft SIP Identity July 2016 > > > The guidance in this section also applies to extracting the URI guidance vs. specification? > containing the originator's identity from the P-Asserted-Identity > header field value instead of the From header field value. In some Huh? How is the verifier supposed to know where to draw the values from? > environments, the P-Asserted-Identity header field is used in lieu of > the From header field to convey the address-of-record or telephone > number of the sender of a request; while it is not envisioned that > many of those networks would or should make use of the Identity > mechanism described in this specification, where they do, local > policy might therefore dictate that the canonical identity derive > from the P-Asserted-Identity header field rather than the From. As soon as a document says 'local policy' it needs to stop specifying detail, since it is both outside of the scope of the document and it is distracting from the details of the specification. If you have to make reference to the possibility, then include something simple and brief, such as: Local policies might choose to use a value from fields other than To and From. The details for this are outside the scope of this specification. To the extent there is a compelling need to specify this alternative mechanism, do it in a separate specification. > Ultimately, in any case where local policy canonicalizes the idenity > into a form different from how it appears in the From header field, > the use of the "canon" parameter by authentication services is > RECOMMENDED, but because "canon" itself could then divulge > information about users or networks, implementers should be mindful > of the guidelines in Section 11. remove above paragraph. > > It may not be trivial to tell if a given URI contains a telephone If that means it isn't deterministic, we've got a basic problem, since protocol specs do not offer heuristics. If it just means there is complexity, then the sentence says nothing useful. > number. In order to determine whether or not the user portion of a [or not] remove > SIP URI is a telephone number, authentication services and > verification services MUST perform the following procedure on any SIP > URI they inspect which contains a numeric user part. Note that the > same procedures are followed for creating the canonical form of URIs > found in the From header field as they are in the To header field or > the P-Asserted-Identity header field. If there is an algorithm to follow, specify it as an algorithm. Otherwise, this is non-normative discussion and isn't very helpful here. > First, implementations must look for obvious indications that the > user-portion of the URI constitutes a telephone number. Telephone > numbers most commonly appear in SIP header field values in the "most commonly" suggests that this is discussion, not specification. > username portion of a SIP URI (e.g., > 'sip:+17005551008@chicago.example.com;user=phone'). The user part of > that URI conforms to the syntax of the TEL URI scheme (RFC 3966 > [RFC3966]). It is also possible for a TEL URI to appear in the SIP > To or From header field outside the context of a SIP or SIPS URI > (e.g., 'tel:+17005551008'). Thus, in some environments, numbers will > be explicitly labeled by the use of TEL URIs or the 'user=phone' > parameter, or implicitly by the presence of the '+' indicator at the > start of the user-portion. Absent these indications, if there are > numbers present in the user-portion, implementations may also detect > that the user-portion of the URI contains a telephone number by > determining whether or not those numbers would be dialable or > routable in the local environment -- bearing in mind that the > telephone number may be a valid E.164 number, a nationally-specific > number, or even a private branch exchange number. Once a telephone > number has been detected, implementations should follow the > procedures in Section 7.2. > > > > > Peterson, et al. Expires January 8, 2017 [Page 17] > > > Internet-Draft SIP Identity July 2016 > > > If the URI field does not contain a telephone number, URI > normalization procedures are invoked to canonicalize the URI before > it is included in a PASSporT object in, for example, an "uri" claim. > See Section 7.4 for that behavior. I suspect that the above topic is confusing what can/must be done as a deterministic specification, with what incremental value can be obtained by the addition of some non-normative heuristics. Separate these and make the deterministic stuff part of the specification and the heuristics part of an external document discussing real-world implementation, or somesuch. > 7.1. Authority for Telephone Numbers > > In order for telephone numbers to be used with the mechanism > described in this document, authentication services must enroll with > an authority that issues credentials authoritative for telephone > numbers or telephone number ranges, and verification services must > trust the authority employed by the authentication service that signs "enroll"??? > a request. Per Section 6.4, enrollment procedures and credential > management are outside the scope of this document; approaches to > credential management for telephone numbers are discussed in > [I-D.ietf-stir-certificates]. If they are outside the scope, then don't provide details such as about enrolling. At the least, don't repeat information provided elsewhere in the document. > > 7.2. Telephone Number Canonicalization Procedures > > Once an implementation has identified a telephone number in the URI, Once a telephone number is identified... And what about telephone numbers that are not part of a URI? > it must construct a number string. That requires performing the > following steps: If a 'number string' has been identified, then what does it mean to 'construct a number string'? I think what's meant is that it is necessary to put the number into a canonical form. In any case, please clarify what is meant. The algorithm should be specified in the form of an algorithm, rather than as normative prose, and language like "except only" encourages coding errors: > Implementations MUST drop any leading +'s, any internal dashes, > parentheses or other non-numeric characters, excepting only the > leading "#" or "*" keys used in some special service numbers > (typically, these will appear only in the To header field value). > This MUST result in an ASCII string limited to "#", "*" and digits > without whitespace or visual separators. So '+' is retained if it's internal? Why? Move commentary about the algorithm -- such as "these will appear..." -- to be outside of the algorithm specification. > Next, an implementation must assess if the number string is a > valid, globally-routable number with a leading country code. If How are they to do this? > not, implementations SHOULD convert the number into E.164 format, > adding a country code if necessary; this may involve transforming > the number from a dial string (see [RFC3966]), removing any So, again, this isn't really a specification. Language like 'may involve' makes this commentary. > national or international dialing prefixes or performing similar > procedures. It is only in the case that an implementation cannot > determine how to convert the number to a globally-routable format Again, this kind of language is not really a specification. > that this step may be skipped. This will be the case, for > example, for nationally-specific service numbers (e.g. 911, 112); > however, the routing procedures associated with those numbers will > likely make sure that the verification service understands the > context of their use. > > Other transformations during canonicalization MAY be made in > accordance with specific policies used within a local domain. For > example, one domain may only use local number formatting and need > to convert all To/From user portions to E.164 by prepending And the above text also is not a specification. It also isn't interoperable. It says "the folks encoding the strings will do whatever local stuff they feel like and the folks at the verification side won't know what it was and won't be able to replicate it. So canonicalization won't be a standard, global service. The alternative model, is that 'local policy' will be the same for both ends, in which case, the spec is saying that there might be canonicalizations that are outside the specifications. But in that case, text referring to it is distracting rather than helpful. If a local environment is doing 'local policy' then it will document that separately. There is no utility in making vague statements about possibilities that are outside the spec. > > > Peterson, et al. Expires January 8, 2017 [Page 18] > > > Internet-Draft SIP Identity July 2016 > > > country-code and region code digits; another domain might prefix > usernames with trunk-routing codes and need to remove the prefix. > This specification cannot anticipate all of the potential > transformations that might be useful. > > The resulting canonical number string will be used as input to the > hash calculation during signing and verifying processes. > > The ABNF of this number string is: > > tn-spec = [ "#" / "*" ] 1*DIGIT I suspect that the entire topic of canonicalization merely needs core text that says somethg like: Take the original string and remove any characters that do not conform to the above format. Then tweak that text for any cases that need to add characters. > > If the result of this procedure forms a complete telephone number, What is the definition of a 'complete tn'? Cite it. > that number is used for the purpose of creating and signing the for the purpose of creating and signing -> for creating I suspect it is /not/ used "for signing" but is in fact used to create part of the content that is signed. That's different. > signed-identity-string by both the authentication service and > verification service. Practically, entities that perform the > authentication service role will sometimes alter the telephone > numbers that appear in the To and From header field values, > converting them to this format (though note this is not a function > that [RFC3261] permits proxy servers to perform). The result of the > canonicalization process of the From header field value may also be > recorded through the use of the "canon" parameter of the Identity(see > Section 8). Why is this significant? How does it affect processing? > > If the result of the canonicalization of the From header field value > does not form a complete and valid telephone number, the > authentication service and/or verification service SHOULD treat the > entire URI as a SIP URI, and apply the procedures in Section 7.4. Here, having a SHOULD rather than a MUST seems likely to produce non-interoperability, since signer and validator are allowed to behave differently, thereby making it likely they will produce different results. > > 7.3. Authority for Domain Names Authority for domain names comes from ICANN. Unfortunately, I'm not clear enough about the specific purpose of this section, but it needs a title that is more specific and clear. It appears that this section is both trying to give background about various occurrences of domain names and (redundantly?) discuss the challenges of finding the right caller-id string. This suggests splitting the discussion to an earlier, non-normative section, and a section here that simply specifies technical detail to perform. > When a verifier processes a request containing an Identity-Info > header with a domain signature, it must compare the domain portion of must or MUST? > the URI in the From header field of the request with the domain name > that is the subject of the credential acquired from the "info" > parameter. While it might seem that this should be a straightforward > process, it is complicated by two deployment realities. In the first > place, credentials have varying ways of describing their subjects, > and may indeed have multiple subjects, especially in 'virtual > hosting' cases where multiple domains are managed by a single > application. Secondly, some SIP services may delegate SIP functions > to a subordinate domain and utilize the procedures in RFC 3263 > [RFC3263] that allow requests for, say, 'example.com' to be routed to > 'sip.example.com'. As a result, a user with the AoR > 'sip:jon@example.com' may process requests through a host like > 'sip.example.com', and it may be that latter host that acts as an > authentication service. > But since credentials are a modularized construct, outside of this specification, why is this specification going into this sort of detail about them? > > Peterson, et al. Expires January 8, 2017 [Page 19] > > > Internet-Draft SIP Identity July 2016 > > > To meet the second of these problems, a domain that deploys an > authentication service on a subordinate host MUST be willing to > supply that host with the private keying material associated with a > credential whose subject is a domain name that corresponds to the > domain portion of the AoRs that the domain distributes to users. > Note that this corresponds to the comparable case of routing inbound > SIP requests to a domain. When the NAPTR and SRV procedures of RFC > 3263 are used to direct requests to a domain name other than the > domain in the original Request-URI (e.g., for 'sip:jon@example.com', > the corresponding SRV records point to the service > 'sip1.example.org'), the client expects that the certificate passed > back in any TLS exchange with that host will correspond exactly with > the domain of the original Request-URI, not the domain name of the > host. Consequently, in order to make inbound routing to such SIP > services work, a domain administrator must similarly be willing to > share the domain's private key with the service. This design > decision was made to compensate for the insecurity of the DNS, and it > makes certain potential approaches to DNS-based 'virtual hosting' > unsecurable for SIP in environments where domain administrators are > unwilling to share keys with hosting services. Really, I suspect all of the above detail is out of scope, given the way these specifications have been partitioned. > > A verifier MUST evaluate the correspondence between the user's > identity and the signing credential by following the procedures > defined in RFC 2818 [RFC2818], Section 3.1. While RFC 2818 [RFC2818] > deals with the use of HTTP in TLS and is specific to certificates, > the procedures described are applicable to verifying identity if one > substitutes the "hostname of the server" in HTTP for the domain > portion of the user's identity in the From header field of a SIP > request with an Identity header. What does 'must evaluate' mean? What specific 'evaluation' actions are being required? And actions are to be taken in response to the evaluation? > > 7.4. URI Normalization Canonicalization for phone numbers and Normalization for URI. Why the difference? > Just as telephone numbers may undergo a number of syntactic > transformation during transit, the same can happen to SIP and SIPS transformation -> transformations > URIs without telephone numbers as they traverse certain > intermediaries. Therefore, when generating a PASSporT object based > on a SIP request, any SIP and SIPS URIs must be transformed into a > canonical form which captures the address-of-record represented by > the URI before they are provisioned in PASSporT claims such as "uri". The above text belongs in an earlier discussion of issues, so that the specification section can focus on specifying. > The URI normalization procedures required are as follows. > > Following the ABNF of RFC3261, the SIP or SIPS URI in question MUST Which ABNF? Where in the document? Section 25.1? What about the ABNF requires any of what is asserted here? Again, algorithms need to be specified as algorithms, not just prose. > discard all elements after the "hostport" of the URI, including all > uri-parameters and headers, from its ayntax. Of the userinfo "including"? By my reading there isn't anything other than those two rules. > component of the SIP URI, only the user element will be retained: any > password (and any leading ":" before the password) MUST be removed, > and since this userinfo necessarily does not contain a telephone- I think the algorithm intended here is: 1. Parse the SIP/SIPS URI 2. Retain if present ; will not be present 3. Retain done. > Peterson, et al. Expires January 8, 2017 [Page 20] > > > Internet-Draft SIP Identity July 2016 > > > subscriber component, no further parameters can appear in the user > portion. > > The hostport portion of the SIP or SIPS URI MUST similarly be > stripped of any trailing port along with the ":" that proceeds the > port, leaving only the host. In other words, just get > > The ABNF of this canonical URI form (following the syntax defined in > RFC3261) is: > > canon-uri = ( "sip" / "sips" ) ":" user "@" host What is the purpose of retaining the sip/sips distinction, within this context? > Finally, the URI will be subject to syntax-based URI normalization > procedures of [RFC3986] Section 6.2.2, especially to perform case Except that 6.2.2 does not actually specify normalization. Rather, it talks about an approach to normalization, without giving precise details. > normalization and percent-encoding normalization. However, note that > normalization procedures face known challenges in some > internationalized environments (see [I-D.ietf-iri-comparison]) and > that perfect normalization of URIs may not be possible in those > environments. The above last sentence reduces to: do normalization but don't rely on it working. This again raises the question of treating a broken signature the same as no signature present. > > For future PASSporT applications, it may be desirable to provide an > identifier without an attached protocol scheme. Future Discussion about future hypotheticals, again. Remove. > specifications that define PASSporT claims for SIP as a using > protocol could use these basic procedures, but eliminate the scheme > component. A more exact definition is left to future specifications. Exactly. > > 8. Header Syntax I'm quite confused. This section appears to be simultaneously specifying a SIP Identity header field as well as how to populate an associate Passort entity. > The Identity and Identity-Info headers that were previously defined header *field* > in RFC4474 are deprecated. Reference to the previous 4474 content is unproductive and distracting. Remove all of it. This is a new specification. It is not revising an installed base. So this section should merely define what it defines and not put it in terms of the earlier document. This revised specification collapses the > grammar of Identity-Info into the Identity header via the "info" > parameter. Note that unlike the prior specification in RFC4474, the > Identity header is now allowed to appear more than one time in a SIP > request. The revised grammar for the Identity header is (following > the ABNF [RFC4234] in RFC 3261 [RFC3261]): > > Identity = "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) > signed-identity-digest = LDQUOT *base64-char RDQUOT > ident-info = "info" EQUAL ident-info-uri > ident-info-uri = LAQUOT absoluteURI RAQUOT > ident-info-params = ident-info-alg / ident-type / canonical-str / ident-info-extension > ident-info-alg = "alg" EQUAL token > ident-type = "ppt" EQUAL token > canonical-str = "canon" EQUAL *base64-char > ident-info-extension = generic-param > > base64-char = ALPHA / DIGIT / "/" / "+" Note the use of ABNF here, rather than JSON. canon is optional. why doesn't the abnf show it as optional? I suspect the issue is that the abnf needs to distinguish between mandatory and optional components of the Identity header field. isn't defined!!! isn't defined. LAQUOT, EQUAL, RAQUOT, absoluteURI are all undefined. Rules like these are usually inherited from another document. If that's the case here, cite it. These sorts of rules (including base-64-char, which is defined syntactically but not semantically) need explicit ABNF rules with their names and then need prose text to explain their semantics. > > Peterson, et al. Expires January 8, 2017 [Page 21] > > > Internet-Draft SIP Identity July 2016 > > > In addition to "info" parameter, and the "alg" parameter previously to -> to the > defined in RFC4474, this specification includes the optional "canon" > and "ppt" parameters. Note that in RFC4474, the signed-identity- > digest (see ABNF above) was given as quoted 32LHEX, whereas here it > is given as a quoted sequence of base64-char. > > The 'absoluteURI' portion of ident-info-uri MUST contain a URI; see > Section 6.3 for more on choosing how to advertise credentials through > this parameter. > > The signed-identity-digest is the signed hash component of a PASSporT > object [I-D.ietf-stir-passport], a signature which PASSporT generates That document does not contain the string "signed hash". The word 'hash' only appears in 3.2.2.2 "mky". Worse, that section really does not specify its contents. Rather -- yet again -- we get discussion about purpose and possibility. Specific reference to a specific value that can be interoperably generated is needed. > over a pair of JSON objects. The first PASSporT object contains What is meant by "the first passport object"? Where is there specification of multiple of them and how is their ordering determined? > header information, and the second contains claims, following the > conventions of JWT [RFC7519]; some header and claim values will > mirror elements of the SIP request. Once these two JSON objects have I've gone back and looked at the Passport references to "object" and do not see any clear indication that there are two, in the style being summarized here. Note that Passport's Section 3.1 does not say "object". Nor does the next section, 3.2. Yet, apparently, both should. But matters appear to be more confusing than that, in the Passport document, such as Section 3.2.2.1, which is titled 'claims' but makes references to objects. I naturally assume that some portion of this is inherited from JSON and/or JWT, which is a nice example of the significant, additional overhead being being introduced with their use. And in this case, apparently confusion. > been generated, they will be encoded, then hashed with a SHA-256 > hash. Those two hashes are then concatenated (header then claims) > into a string separated by a single "." per baseline PASSporT. > Finally, that string is signed to generate the signed-identity-digest > value of the Identity header. Another algorithm needing to be specified as an algorithm. > > For SIP implementations to populate the PASSporT header object from a > SIP request, the following elements message MUST be placed as the placed where? Or is this really a straight data copy from the JSON form to parameters in the SIP Identity header field? > values corresponding to the designated JSON keys: Delete the opening clause. > First, per baseline [I-D.ietf-stir-passport], the JSON key "typ" > key MUST have the value "passport". This appears to be introducing a redundancy between this spec and the Passport spec. There needs to be language in one that merely cites the other, rather than respecifying it. > > Second, the JSON key "alg" MUST mirror the value of the optional > "alg" parameter in the SIP Identity header. Note if the "alg" > parameter is absent, the default value is "ES256". > > Third, the JSON key "x5u" MUST have a value equivalent to the > quoted URI in the "info" parameter. > > Fourth, the optional JSON key "ppt", if present, MUST have a value > equivalent to the quoted value of the "ppt" parameter of the > Identity header. If the "ppt" parameter is absent from the > header, the "ppt" key MUST NOT not appear in the JSON heaer > object. All of these 'must' formations are overkill. Normally, algorithms are specified in a simple, declarative manner. > For example: > > { "typ":"passport", > "alg":"ES256", > "x5u":"https://www.example.com/cert.pkx" } What is this example demonstrating? How is the reader to know? > > > > Peterson, et al. Expires January 8, 2017 [Page 22] > > > Internet-Draft SIP Identity July 2016 > > > To populate the PASSporT claims JSON object from a SIP request, the > following elements MUST be placed as values corresponding to the > designated JSON keys: > > First, the JSON "orig" array MUST be populated. If the > originating identity is a telephone number, then the array MUST be > populated with a "tn" claim with a value set to the value of the > quoted originating identity, a canonicalized telephone number (see > Section 7.2). Otherwise, the array MUST be populated with a "uri" > claim, set to the value of the AoR of the UA sending the message > as taken from addr-spec of the From header field, per the > procedures in Section 7.4. Again, this appears to be quite a bit of detail that is redundant with specifications elsewhere. > > Second, the JSON "dest" array MUST be populated. If the > destination identity is a telephone number, then the array MUST be > populated with a "tn" claim with a value set to the value of the > quoted destination identity, a canonicalized telephone number (see > Section 7.2). Otherwise, the array MUST be populated with a "uri" > claim, set to the value of the addr-spec component of the To > header field, which is the AoR to which the request is being sent, > per the procedures in Section 7.4. > > Third, the JSON key "iat" MUST appear, set to the value of a > quoted encoding of the value of the SIP Date header field as a > JSON NumericDate (as UNIX time, per [RFC7519] Section 2). > > Fourth, if the request contains an SDP message body, and if that > SDP contains one or more "a=fingerprint" attributes, then the JSON > key "mky" MUST appear with the algorithm(s) and value(s) of the > fingerprint attributes (if they differ), following the format > given in [I-D.ietf-stir-passport] Section 3.2.2.2. > > For example: > > { "orig":{"tn":"12155551212"}, > "dest":{"tn":"12155551213"}, > "iat":"1443208345" } > > For more information on the security properties of these SIP message 'more'? is there security information here? where? > elements, and why their inclusion mitigates replay attacks, see > Section 12 and [RFC3893]. Note that future extensions to the And since every RFC contains a security considerations section, a generic reference like this, here, is of no obvious value. It's just more text. > PASSporT object could introduce new claims, and that further SIP Future reference to hypotheticals. > procedures could be required to extract further information from the > SIP request to populate the values of those claims; see Section 9. > > The "orig" and "dest" arrays may contain identifiers of heterogeneous > type; for example, the "orig" array might contain a "tn" claim, while What is the import of this observation? Is there something in the specification that appears to constrain the choices? > the "dest" contains a "uri" claim. Also note that in some cases, the > > > > Peterson, et al. Expires January 8, 2017 [Page 23] > > > Internet-Draft SIP Identity July 2016 > > > "orig" and "dest" arrays might be populated with more than one value. > This could for example occur when multiple "dest" identities are > specified in a meshed conference. Defining how a SIP implementation > would provision multiple originating or destination identities is > left as a subject for future specification. > > After these two JSON objects, the header and the claims, have been > constructed, they must each be hashed per [I-D.ietf-stir-passport] > Section 3.3. The signed value of those concatenated hashes then Except that Passport Section 3.3 says nothing more than: The signature of the PASSporT is created as specified by JWS using the private key corresponding to the X.509 public key certificate referenced by the "x5u" header parameter. and that doesn't look like an implementable specification to me. > becomes the signed-identity-string of the Identity header. The > hashing and signing algorithm is specified by the 'alg' parameter of > the Identity header and the mirrored "alg" parameter of PASSporT. > This specification inherits from the PASSporT specification one value > for the 'alg' parameter: 'ES256', as defined in [RFC7519], which > connotes an ECDSA P-256 digital signature. All implementations of > this specification MUST support the required signing algorithms of > PASSporT. > > The complete form of the Identity header will therefore look like the > following example: > > Identity: "sv5CTo05KqpSmtHt3dcEiO/1CWTSZtnG3iV+1nmurLXV/HmtyNS7Ltrg9dlxkWzo > eU7d7OV8HweTTDobV3itTmgPwCFjaEmMyEI3d7SyN21yNDo2ER/Ovgtw0Lu5csIp > pPqOg1uXndzHbG7mR6Rl9BnUhHufVRbp51Mn3w0gfUs="; \ > info=;alg=ES256 It would be quite a bit more helpful to have a detail, incremental example that shows how each of the bits are created and then assembled. > In a departure from JWT practice, the SIP usage of PASSporT MAY NOT > include the base64 encoded version of the JSON objects in the JWT normally calls for including the encoded version of JSON objects in the Identity header (field)? Really, it isn't clear what the exact exception is. If citing this is that important, please make the details clear including appropriate citations, such as to the relevant part of the JWT spec. > Identity header: only the signature component of the PASSporT is > REQUIRED. Optionally, as a debugging measure or optimization, the > base64 encoded concatenation of the JSON header and claims may be > included as the value of a "canon" parameter of the Identity header. > Note that this may be lengthy string. > > 9. Extensibility > > For the extensibility of baseline PASSporT with now claims, see > [I-D.ietf-stir-passport] Section 4. "with now claims"? And what is the benefit of having this directive? > > As future requirements may warrant increasing the scope of the > Identity mechanism, this specification defines an optional "ppt" > parameter of the Identity header, which mirrors the "ppt" header key The term 'header key' does not occur in the Passport specifiction. Perhaps this is meant to refer to that doc's section 4.1 header parameter? > in PASSporT. The "ppt" parameter value MUST consist of a token > containing an extension specification, which denotes an extended set > of one or more signed claims per the type extensibility mechanism > specified in [I-D.ietf-stir-passport]. So they will only be able to use one extension? Also, what is the utility of having this information in the SIP Identity header field? > > > > > > Peterson, et al. Expires January 8, 2017 [Page 24] > > > Internet-Draft SIP Identity July 2016 > > > An authentication service cannot assume that verifiers will > understand any given extension. Verifiers that do support an > extension may then trigger appropriate application-level behavior in > the presence of an extension; authors of extensions should provide > appropriate extension-specific guidance to application developers on > this point. This is likely redundant information. > > If any claim in an extension contains a JSON value that does not > correspond to any field of the SIP request, but then the optional > "canon" parameter MUST be used for the Identity header containing > that extension. If...but then appears to be a non-sequitor or incompletely formulated sentence. > > 10. Backwards Compatibililty with RFC4474 Delete this section. > This specification introduces several significant changes from the > RFC4474 version of the Identity header. However, due to the problems > enumerated in [I-D.rosenberg-sip-rfc4474-concerns], it is not > believed that the original Identity header has seen any deployment, > or even implementation in deployed products. > > As such, this mechanism contains no provisions for signatures > generated with this specification to work with RFC4474-compliant > implementations, nor any related backwards-compatibility provisions. > Hypothetically, were an RFC4474-compliant implementation to receive > messages containing this revised version of the Identity header, it > would likely fail the request due to the absence of an Identity-Info > header with a 436 response code. Implementations of this > specification, for debugging purposes, might interpret a 436 with a > reason phrase of "Bad Identity-Info" as an indication that the > request has failed because it reached a (hypothetical) > RFC4474-compliant verification service. In fact there is so little overlap of substantive text, this really is an entirely new document and not a bis. > 11. Privacy Considerations > > The purpose of this mechanism is to provide a strong identification I think the usual terms are 'strong authentication' or 'strong security' (though 'security' has no clear technical meaning.) 'Strong identification' appears to have no common meaning. > of the originator of a SIP request, specifically a cryptographic > assurance that an authority asserts the originator can claim the URI > given in the From header field. This URI may contain a variety of > personally identifying information, including the name of a human > being, their place of work or service provider, and possibly further > details. The intrinsic privacy risks associated with that URI are, > however, no different from those of baseline SIP. Per the guidance > in [RFC6973], implementers should make users aware of the privacy > trade-off of providing secure identity. > > The identity mechanism presented in this document is compatible with > the standard SIP practices for privacy described in [RFC3323]. A SIP > proxy server can act both as a privacy service and as an I think that I don't know what it means to be a 'privacy service'. What functionality does this reference here and how is the reader to know? > > > > Peterson, et al. Expires January 8, 2017 [Page 25] > > > Internet-Draft SIP Identity July 2016 > > > authentication service. Since a user agent can provide any From > header field value that the authentication service is willing to > authorize, there is no reason why private SIP URIs that contain > legitimate domains (e.g., sip:anonymous@example.com) cannot be signed This sentence sounds as if it is signaling an important point, but the text does not make clear what that import is. My guess is that it needs to be preceded by a sentence that explains what problem the reader might think exists. Then this text explains that it doesn't. > by an authentication service. The construction of the Identity > header is the same for private URIs as it is for any other sort of How is that a privacy matter? > URIs. Similar practices could be used to support opportunistic > signing of SIP requests for UA-integrated authentications services > with self-signed certificates, though that is outside the scope of > this specification and is left as a matter for future investigation. > > Note, however, that even when using anonymous SIP URIs, an > authentication service must possess a certificate corresponding to > the host portion of the addr-spec of the From header field of the The 'however' does not follow any statement that it matches against. Again, there's no stage that has been set, for which this resolves a concern. > request; accordingly, using domains like 'anonymous.invalid' will not if this is actually a domain value that is used, please cite where it is documented. For that matter, how is one to tell what other domains are 'like' it? If the string isn't in actual use then why doesn't it use the usual RFC choices for an example domain name? > be possible for privacy services that also act as authentication > services. The assurance offered by the usage of anonymous URIs with > a valid domain portion is "this is a known user in my domain that I > have authenticated, but I am keeping its identity private". ... -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 01:12:41 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A378112B00F for ; Tue, 9 Aug 2016 01:12:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wDN9SttHDaLU for ; Tue, 9 Aug 2016 01:12:34 -0700 (PDT) Received: from resqmta-po-04v.sys.comcast.net (resqmta-po-04v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:163]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CABD9127058 for ; Tue, 9 Aug 2016 01:12:32 -0700 (PDT) Received: from resomta-po-17v.sys.comcast.net ([96.114.154.241]) by resqmta-po-04v.sys.comcast.net with SMTP id X29IbHoHwGkXBX29IbWP84; Tue, 09 Aug 2016 08:12:32 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by comcast with SMTP id X29DbPpOBce4sX29DbSVkG; Tue, 09 Aug 2016 08:12:32 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Tue, 9 Aug 2016 00:57:42 -0700 From: Alex Bobotek To: "dcrocker@bbiw.net" , "stir@ietf.org" , "Peterson, Jon" Date: Tue, 9 Aug 2016 00:57:41 -0700 Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AdHx7pOYy5HGIi3WRhKxbHpmhyrW4wADYNqA Message-ID: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CMAE-Envelope: MS4wfLIYSX8URpD3ulfToU9C+6+AQB/aAw6INWvEzESOUdCDtnCGxim0rE14MpWcLqSyFaA1h5GfeBcJi1DWbibqtexnSvCAi2m6wVnRZI/0Rmvk/xDeIlo6 vVasK187iKpuj9CcDpch1b7y5gg2XoiSU2BJ2elH+fZQ297si88p5CxQoEh5TBNc1Ax8WUqw+eFOwTyUvQu98f4sARCDJCQufdTJw0Bxmo7lk/8j+awkfvo1 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 08:12:39 -0000 I'm responding to Jon's fair question of how much support there is for impl= ementing the changes proposed by Dave. I've only been able to make it around 1/2 of the way through Dave's comment= s. My detailed reactions to these are inline below. In summary, I believe that the majority of comments, if accepted, would sub= stantially improve the doc. A number of them address areas that were confu= sing to me on first reading of the draft, as well at least one point that I= independently believed to be just plain wrong, detracting from the overall= credibility of the doc. There are also some nits, some comments that I do= not agree with, and others that I have expanded upon below. In any document there is always room for improvement. However, at some poi= nt a group's edits reach a point at which there is little further improveme= nt and the value of continued edits is low. I do not believe that the draf= t is yet at this point. Consistent with the goal of producing a sound, clear and precise RFC in a r= easonable amount of time, I humbly suggest that careful evaluation and inco= rporation of Dave's (and others') comments where appropriate would be benef= icial, and there are many (though likely not all) that could be addressed w= ithout major delay. That said, it is clear that an RFC is needed sooner ra= ther than later, and it makes sense to be mindful that delays from going ba= ck to the drawing board on some issues may result in a cure not worth the d= elay. But these deserve at least a response to that effect. Many thanks to all the parties for their editing and comments on what promi= ses to be a highly impactful suite of RFCs. Regards, Alex > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Dave Crocker > Sent: Monday, August 8, 2016 8:46 PM > To: stir@ietf.org > Subject: [stir] Review of: draft-ietf-stir-rfc4474bis-10 > > > > Review of: Authenticated Identity Management in the Session Initiation > Protocol (SIP) > ID: draft-ietf-stir-rfc4474bis-10.txt > Date: 8 August 2016 > Reviewer: D. Crocker > > > > > Summary > ------- > > SIP needs to support a mechanism that validates the identifier used for > the originator of the request. That is, to ensure that the entity that > placed the identification value into the field was authorized by its > owner to do so. This specifications is part of a collection of > specifications intended to enable such validation. > > > Taken on its own and also when taken with its companion documents, the > specifications are confusing and incomplete. It is quite far from being > ready for publication. > > > > Terminology is used inconsistently. It often is introduced with no > background or citation. Many uses of 'header' are probably supposed to > be 'header field'. My sense is that quite a bit of terminology is used > equally loosely. > > There is no integrative architectural description, so the reader has > difficulty understanding what all of the pieces are or how they fit > together. In fact is appears that the document itself gets confused on > this matter. > > Algorithms are all offered only as prose and often in a form mitigating > comprehension, such as tending towards negation or disjunction, which > humans process less well than affirmatives and conjunctions. From what I > can tell, the algorithms often are incomplete, but serious analysis is > difficult. > > The documents appear to rely on a reader's having quite a bit of prior > knowledge and are certainly not usable by an implementer who is not > already deeply embedded in the community that produced these > specifications. My impression is that being embedded won't suffice > either, both from my assessment of the documents' deficiencies and given > back-channel comments I have heard about the expectation of the work to > be done after these specifications are published. > > > Overall, the writing impedes comprehension and the document needs a very > diligent pass by a technical editor. I suspect this will uncover quite > a number of semantic deficiencies in the text. > > > There is a possible tendency to support more alternative behavior than > appropriate. Successful interoperability usually benefits from fewer > choices, not more. Common, mandatory canonicalization is an example. > > Credentials: the specification neither defines nor references a standard > for the specification of credentials, here. That means that the > technical details -- as distinct from the operational policies -- of > credentials are out of scope, although they are fundamental to proper > operation of this serve. This is a showstopper, in terms of > specification completeness for the service. > > How is the recipient to know what credential 'standard' is used? How > does this ensure interoperability between two participants who have not > interacted before? > > At base, these specifications appear intended to roughly chart out a > system structure, leaving most of the difficult work for later and > elsewhere. By way of example, there are few if any cross-organization > key management services on the Internet that demonstrate the utility > needed here. I am pretty sure that Web certs don't qualify. We know > that DKIM's operation does, of course. However DKIM strictly uses > domain names as identifiers and they conveniently align with their > administrative authorities, whereas telephone numbers do not... > > [[[ The mailing list just had an extensive regurgitation of > critical commentary about ENUM. What appears to be getting missed is > that whatever mechanism is going to be used for finding and validating > keys is going to have no operational history of reliability, safety or > efficacy. ]]] This is a point of extreme importance. There are much simpler mechanisms o= f distributing public keys for signature validation, assuming connectivity = (e.g., via internet) to a suitable public key repository (e.g., ENUM, which= seems to be trusted well enough to route calls by). If I understand this = correctly, certs are used to facilitate offline validation, an edge case, w= ith the addition of considerable complexity (certs and associated infrastru= cture). A much simpler and tested mechanism is used in DKIM/DMARC. > > There is remarkably little of the original RFC 4474 substance still in > this document. Calling it a bis is a bit like tearing all of a building > except its fireplace or its front door and calling that a remodeling. > The previous document does not have an installed base, so I strongly > suggest removing all references to it. It will allow some of the text > to be notably simpler and clearer. > > The document is heavy with forward references. These force the reader > to stop what they are in the middle of, try to hold that place, and look > forward to understand what they've just been interrupted from reading. > As a literary style, forward references create useful tension. In > specifications they just interrupt the flow. The document should be > reorganization so that integrative text comes /after/ the text > describing the pieces being integrated. And opening overview, design > summary, or the like can give a non-normative description of the > architecture and the service, so the reader has a basic sense of the big > picture, before diving into the detail of those to-be-integrated pieces. > > > > > Detail Comments > --------------- > > > Abstract > > > > The baseline security mechanisms in the Session Initiation Protocol > > (SIP) are inadequate for cryptographically assuring the identity of > > the end users that originate SIP requests, especially in an > > an end user originating a SIP request > > cryptographically -> adequately > > 'cryptographically' is not the issue here That is, it is a means, not > an end. > > > > interdomain context. This document defines a mechanism for securely > > 'interdomain' might suffice, but I suspect it's worth pressing the > issue, with language like "especially across trust boundaries" or somesuc= h. > > > > identifying originators of SIP requests. It does so by defining a > > SIP header field for conveying a signature used for validating the > > identity, and for conveying a reference to the credentials of the > > signer. > ... > > > 1. Introduction > > > > This document provides enhancements to the existing mechanisms for > > authenticated identity management in the Session Initiation Protocol > > (SIP, [RFC3261]). An identity, for the purposes of this document, i= s > > defined as either a SIP URI, commonly a canonical address-of-record > > (AoR) employed to reach a user (such as > > 'sip:alice@atlanta.example.com'), or a telephone number, which can b= e > > represented as either a TEL URI [RFC3966] or as the user portion of = a > > SIP URI. > > I suspect it does not 'enhance' existing mechanisms as much as add a new > one. If the claim is actual enhancement, then what mechanism is > enhanced and how does authenticating origin constitute enhancement of > it? My point is that I believe the existing mechanisms will operate the > same in the future as they have been. This spec doesn't change them. > That identity management is enhanced is true. That it adds a new identity = management mechanism is clearer. > Move definitions to an explicit terminology section, rather than putting > them into an Introduction. Also, does this document use the term > differently than elsewhere than SIP??? Then why is 'for the purposes of > this document' included? > > > > [RFC3261] specifies several places within a SIP request where users > > can express an identity for themselves, most prominently the user- > > populated From header field. However, the recipient of a SIP reques= t > > has no way to verify that the From header field has been populated > > appropriately, in the absence of some sort of cryptographic > > authentication mechanism. This leaves SIP vulnerable to a category > > of abuses, including impersonation attacks that enable robocalling > > and related problems as described in [RFC7340]. Ideally, a > > cryptographic approach to identity can provide a much stronger and > > less spoofable assurance of identity than the Caller ID services tha= t > > the telephone network provides today. > > > > [RFC3261] encourages user agents (UAs) to implement a number of > > potential authentication mechanisms, including Digest authentication= , > > Transport Layer Security (TLS), and S/MIME (implementations may > > support other security schemes as well). However, few SIP user > > agents today support the end-user certificates necessary to > > authenticate themselves (via S/MIME, for example), and for its part > > Digest authentication is limited by the fact that the originator and > > destination must share a prearranged secret. Practically speaking, > > originating user agents need to be able to securely communicate thei= r > > users' identity to destinations with which they have no previous > > association. > > > > As an initial attempt to address this gap, [RFC4474] specified a > > means of signing portions of SIP requests in order to provide an > > identity assurance. However, RFC 4474 was in several ways misaligne= d > > with deployment realities (see [I-D.rosenberg-sip-rfc4474-concerns])= . > > Most significantly, RFC 4474 did not deal well with telephone number= s > > as identifiers, despite their enduring use in SIP deployments. RFC > > 4474 also provided a signature over material that intermediaries in > > existing deployments commonly altered. This specification therefore > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 3= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > revises RFC 4474 in light of recent reconsideration of the problem > > space to align with the threat model in [RFC7375], and aligns the > > signature format with PASSporT [I-D.ietf-stir-passport]. > > This kind of review of history is best relegated to a minor location in > the document. If the current spec is successful, history like this will > be distracting, 10 years from now.... > > > > 2. Terminology > > > > In this document, the key words "MUST", "MUST NOT", "REQUIRED", > > "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", > "NOT > > RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as > > described in RFC 2119 [RFC2119] and RFC 6919 [RFC6919]. > > > > 3. Background > > This section includes far more than background. It also provides a > summary description of the mechanism being defined here. I suggest > having this section only give background on sip and the problem, with a > separate section for the design summary. Or else call this > Introduction, but really it would be better to split them. > True, and it would be beneficial to split them. Further, it would be beneficial to add that one of the most important benef= its of authenticated identity is to provide a foundation for reputation-bas= ed policies. Given that identities (e.g., phone numbers) are highly access= ible and can be obtained anonymously (i.e., without a validated identity re= adily traceable to a person) in bulk, knowing that an identity isn't spoofe= d is generally insufficient information to establish whether a call is lega= l and non-abusive, or illegal or abusive. One of the problems with the i= ntroductory sections is that they foster a mistaken belief that secure call= er ID will solve the robocall problem. As we know, it only even attempts t= o solve the spoofing problem. It's a part of the solution. > > > > Per [RFC7340], problems such as robocalling, voicemail hacking, and > > swatting are enabled by an attacker's ability to impersonate someone > > else. The secure operation of most SIP applications and services > > depends on authorizing the source of communications as it is > > represented in a SIP request. Such authorization policies can be > > automated or be a part of human operation of SIP devices. An exampl= e > > of the former would be a voicemail service that compares the identit= y > > of the caller to a whitelist before determining whether it should > > allow the caller access to recorded messages. An example of the > > latter would be an Internet telephone application that displays the > > calling party number (and/or Caller-ID) of a caller, which a human > > may review to make a policy decision before answering a call. In > > both of these cases, attackers might attempt to circumvent these > > authorization policies through impersonation. Since the primary > > identifier of the sender of a SIP request, the From header field, ca= n > > be populated arbitrarily by the controller of a user agent, > > impersonation is very simple today in many environments. The > > add: Hence the foundation to accurate authorization is valid > authentication. This is a true statement of the philosophy behind this spec. However, ther= e are many cases in the current telephony system where it is unrealistic to= expect authentication before authorization. > > > > mechanism described in this document provides a strong identity > > system for detecting attempted impersonation in SIP requests. > > "provides a strong identity system for detecting" could mean > many things, whereas the goal here is quite specific. > > So replace it with: > > ...enables an authentication capability for protecting against= ... > No strong opinion here > > > This identity architecture for SIP depends on a logical > > "authentication service" which validates outgoing requests. An > > It likely will validate them in multiple places, including incoming > requests. > The current text I found confusing, and on my first reading of the doc had = to read the sentence three times to understand it. The intended perspectiv= e (e.g., of the call originator) is unclear. I _initially_ fell into the t= rap of thinking that "incoming" was from the perspective of the terminating= service provider. > > > authentication service may be implemented either as part of a user > > agent or as a proxy server; typically, it is a component of a networ= k > > intermediary like a proxy to which originating user agents send > > unsigned requests. Once the sender of the message has been > > authenticated, the authentication service then computes and adds > > sender? Does that mean the caller? the caller's ua? the caller's > operator? the term is ambiguous. > I do not have a problem here. Yes, it's ambiguous, but I suspect that this= ambiguity may be intentional. > > > cryptographic information (including a digital signature over some > > components of messages) to requests to communicate to other SIP > > entities that the sending user has been authenticated and its claim > > worth breaking this sentence into two, for better clarity. > > > > of a particular identity has been authorized. A "verification The sentence above is most intelligible when the three steps are distinctly= listed in order, probably in three sentences for highest clarity: Authent= ication, determination of authority, and finally signature computation/appe= nding. > > service" on the receiving end then validates this signature and > > enables policy decisions to be made based on the results of the > > verification. > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 4= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > Identities are issued to users by authorities. When a new user > > becomes associated with example.com, the administrator of the SIP > > service for that domain can issue them an identity in that namespace= , > > such as alice@example.com. Alice may then send REGISTER requests to > > example.com that make her user agents eligible to receive requests > > for sip:alice@example.com. In some cases, Alice may be the owner of > > the domain herself, and may issue herself identities as she chooses. > > But ultimately, it is the controller of the SIP service at > > example.com that must be responsible for authorizing the use of name= s > > in the example.com domain. Therefore, for the purposes of baseline > > SIP, the credentials needed to prove a user is authorized to use a > > particular From header field must ultimately derive from the domain > > owner: either a user agent gives requests to the domain name owner i= n > > order for them to be signed by the domain owner's credentials, or th= e > > user agent must possess credentials that prove in some fashion that > > the domain owner has given the user agent the right to a name. > > > > The situation is however more complicated for telephone numbers, > > however. Authority over telephone numbers does not correspond > > however...however > > > > directly to Internet domains. While a user could register at a SIP > > domain with a username that corresponds to a telephone number, any > > connection between the administrator of that domain and the > > assignment of telephone numbers is not currently reflected on the > > Internet. Telephone numbers do not share the domain-scope property > > described above, as they are dialed without any domain component. > > This document thus assumes the existence of a separate means of > > establishing authority over telephone numbers, for cases where the > > telephone number is the identity of the user. As with SIP URIs, the > > necessary credentials to prove authority for a name might reside > > either in the endpoint or at some intermediary. > > Note that the preceding discussion makes no mention of "SIP URI". If > one reads back and connects some dots, the reader might guess that the > alice@ discussion is for a SIP URI, but the text should make this explici= t. > Yes this would be clearer > The following paragraph really is the design summary for the specificatio= n: > > > This document specifies a means of sharing a cryptographic assurance > > of end-user SIP identity in an interdomain or intradomain context. > > I suspect the above sentence is seriously redundant. If it isn't, it > needs to be quite a bit sooner, since it is fundamental. Certainly it > is not 'background'. > > > > It relies on the authentication service constructing tokens based on > > the PASSporT [I-D.ietf-stir-passport] format, a JSON [RFC7159] objec= t > > comprising values copied from certain header field values in the SIP > > request. The authentication service then computes a signature over > > those JSON object in a manner following PASSporT. That signature is > > "those JSON object" ? > a nit that needs correction Also, "following" is probably not the best word choice > Also, where is the object? How is it created? How is it conveyed? > On my first read, I felt this was a hole that I needed to dive into (and di= d - I put down STIR and dove into other IDs). It would be easier for the r= eader if some of these questions were answered. > Also 'The authentication service' might refer to the signing side or to > the verifying side. How is the reader to know for certain? A diagram > of the overall service and its components could be quite helpful. > APIWATW > > > then placed in a SIP Identity header. In order to assist in the > > header /field/? > > > > validation of the Identity header, this specification also describes > > some metadata fields associated with the header that can be used by > > the recipient of a request to recover the credentials of the signer. > > Note that the scope of this document is limited to providing this > > identity assurance for SIP requests; solving this problem for SIP > > responses is outside the scope of this work (see [RFC4916]). Future > > work might specify ways that a SIP implementation could gateway > > PASSporT objects to other protocols. > > And it might not. To the extent that you have to say something about > work that might or might not be done, just cite the topic and that it > isn't covered here. Such as: > > Gatewaying Passport objects to other services is outside the > scope of this specification. > > (Odd thought: Given that JSON isn't native to SIP and that there must > be some translation/encoding of the json object to work with SIP, that > effectively means that this /is/ a gatewaying application of the object..= .) > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 5= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > This specification allows either a user agent or a proxy server to > > provide the authentication service function and/or the verification > > service function. To maximize end-to-end security, it is obviously > > preferable for end-users to acquire their own credentials; if they > > "To maximize end-to-end security, it is obviously preferable for > end-users to acquire their own credentials;? > > I'm not exactly sure what this means or is supposed to mean, but I > suspect it's incorrect. > I, too, reacted very negatively to the word "obviously" on my first read of= the spec. It's not strictly true IMO, but this is an informative rather t= han normative section. I think I submitted a comment to that effect that i= t's false and better to say 'typically' or 'often' instead (not sure if I e= ver sent that one, however). > > > do, their user agents can act as authentication services. However, > > for some deployments, end-user credentials may be neither practical > > nor affordable, given the potentially large number of SIP user agent= s > > (phones, PCs, laptops, PDAs, gaming devices) that may be employed by > > a single user. In such environments, synchronizing keying material > > across multiple devices may be prohibitively complex and require > > quite a good deal of additional endpoint behavior. Managing several > > credentials for the various devices could also be burdensome. In > > these cases, implementation the authentication service at an > > intermediary may be more practical. This trade-off needs to be > > understood by implementers of this specification. > > > > 4. Overview of Operations > > > > This section provides an informative (non-normative) high-level > > overview of the mechanisms described in this document. > > described -> specified (or defined) > > But note that we've already been given a high-level overview... > > On reflection, this section isn't an 'overview'. It's an example > scenario. The essential difference is that this makes specific choices, > such as use of a proxy, which might not apply in some valid scenarios. > As some integrative pedagogy, that's fine. So I suggest re=3Dlabeling th= e > section rather than changing it's substance. > +1 It's typical use scenarios (examples). > > > Imagine a case where Alice, who has the home proxy of example.com > and > > the address-of-record sip:alice@example.com, wants to communicate > > with Bob at sip:bob@example.org. They have no prior relationship, > > and Bob implements best practices to prevent impersonation attacks. > > > > Alice generates an INVITE and places her identity, in this case her > > address-of-record, in the From header field of the request. She the= n > > sends an INVITE over TLS to an authentication service proxy for the > > example.com domain. > > How is reference to TLS meaningful here? > > > > > > The proxy authenticates Alice (possibly by sending a Digest > > authentication challenge), and validates that she is authorized to > > Again, how is discussion of the internal, non-STIR aspects of SIP > operationally relevant here? > > > > assert the identity that she populated in the From header field. > > This value could be Alice's AoR, but in other cases it could be some > > different value that the authentication service has authority over, > > That bit of vagueness isn't helpful, given the motivation for doing this > work. It reduces to: something will get authenticated, but we won't > say what and we won't say where to find out. > > > > such as a telephone number. The proxy authentication service then > > constructs a PASSporT object which contains a JSON representations o= f > > headers and claims which mirror certain parts of the SIP request, > > including the identity in the From header field. As a part of > > generating the PASSporT object, the authentication service signs a > > hash of those headers and claims with the appropriate credential for > > the identity (in this case, the certificate for example.com, which > > covers the identity sip:alice@example.com), and the signature is > > inserted by the proxy server into the Identity header field value of > > the request. Optionally, the JSON headers and claims themselves may > > also be included in the object, encoded in the "canon" parameter of > > the Identity header. > > why? when? > > Tossing in vague references about optional behavior that is neither > motivated nor explained usually proves more of a distraction than a > help, when writing an 'overview' or an example. > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 6= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > The proxy, as the holder of the private key for the example.com > > domain, is asserting that the originator of this request has been > > authenticated and that she is authorized to claim the identity that > > appears in the From header field. The proxy inserts an "info" > > parameter into the Identity header that tells Bob how to acquire > > keying material necessary to validate its credentials (a public key)= , > > in case he doesn't already have it. > > A scheme that has an untrusted object carrying information about where > to find trust information for the object sounds like a serious security > hole. Why should the pointer be trusted? > > > > When Bob's domain receives the request, it verifies the signature > > provided in the Identity header, and thus can validate that the > > authority over the identity in the From header field authenticated > > the user, and permitted the user to assert that From header field > > value. This same validation operation may be performed by Bob's use= r > > agent server (UAS). As the request has been validated, it is > > rendered to Bob. If the validation was unsuccessful, some other > > treatment would be applied by the receiving domain. > > Huge operational transition question: How is the absence of the > signature treated? Today, there are no signatures. Tomorrow there > might be some, both it won't be true that /all/ incoming requests are > signed. So how is the receiver supposed to handle the absence of a > signature? > > Related question: Is everyone certain that transit of the request will > /never/ break the signature? What is the basis for that assessment? And > if a signature /can/ break, then the interpretation of an invalid > signature could mean either spoofing or operational error. > > > > > > 5. Signature Generation and Validation > > > > 5.1. Authentication Service Behavior > > > > This document specifies a role for SIP entities called an > > delete first sentence. it adds no useful information. > > > > authentication service. The authentication service role can be > > instantiated, for example, by an intermediary such as a proxy server > > Constant references to implementation (and 'instantiation') > possibilities distracts from the required task of defining the > architecture and functions of the service. > > > > or by a user agent. Any entity that instantiates the authentication > > service role MUST possess the private key of one or more credentials > > "private key of one or more credentials" - not sure what this mea= ns? > > One key can have more than one credential? On the signing side, I'd > expect the process to start by choosing a credential and then using its > associated key. > > > Simpler wording: The authentication service possesses the private... > > > > that can be used to sign for a domain or a telephone number (see > > can be used to sign the From identity. > > > > Section 6.1). Intermediaries that instantiate this role MUST be > > forward reference. better to put that material before this. > > > > capable of authenticating one or more SIP users who can register for > > one or more SIP users -> users > > the word identity hasn't bee used in this paragraph, before this, so the > referent is unclear. > > Also, this requirement for authentication appears to be redundant with > the later specification for authentication in Step 2. > > > > that identity. Commonly, this role will be instantiated by a proxy > > server, since these entities are more likely to have a static > > hostname, hold corresponding credentials, and have access to SIP > > registrar capabilities that allow them to authenticate users. It is > > also possible that the authentication service role might be > > instantiated by an entity that acts as a redirect server, but that i= s > > left as a topic for future work. > > Not only is the above, last sentence about future work; it appears to be > entirely irrelevant to this specification. Remove it. > > > > > > An authentication service adds the Identity header to SIP requests. > > Note that we've read this before. So I'm raising a redundancy flag. > > > > The procedures below define the steps that must be taken when each a= n > > header is added. More than one may appear in a single request, and > > header -> header /field/ ? > > And, by the way, what header field is that? > > The "the procedures" sentence adds nothing and is redundant with the > later "entities instantiating" sentence. > > In any event, don't make forward references like this. Put it after the > relevant details, so that there already is context and this just > enhances it. > > From what I can tell, this entire paragraph should be moved toward > the end of this section. > > > > an authentication service may add an Identity header to a request > > that already contains one or more Identity headers. If the Identity > > header added follows extended signing procedures beyond the baseline > > given in Section 8, then it differentiates the header with a "ppt" > > parameter per the fourth step below. > > > > > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 7= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > Entities instantiating the authentication service role perform the > > following steps, in order, to generate an Identity header for a SIP > > request: > > The authentication service performs the following steps in > order, to... > > Procedural detail should be in a procedural form. Extended prose like > this isn't as easily grokked. That invites both writing and reading > errors to the algorithm. > > > > Step 1: > > > Step 1: Authoritative for Identity > > > > First, the authentication service must determine whether it is > > authoritative for the identity of the sender of the request. In > > ordinary operations, the authentication service decides this by > > inspecting the URI value from the addr-spec component of From header > > field; this URI will be referred to here as the 'identity field'. I= f > > the identity field contains a SIP or SIP Secure (SIPS) URI, and the > > user portion is not a telephone number, the authentication service > > how is its not being a telephone number determined deterministically and > correctly? > > > > MUST extract the hostname portion of the identity field and compare > > it to the domain(s) for which it is responsible (following the > > procedures in RFC 3261 [RFC3261], Section 16.4). If the identity > > field uses the TEL URI scheme [RFC3966], or the identity field is a > > SIP or SIPS URI with a telephone number in the user portion, the > > authentication service determines whether or not it is responsible > > for this telephone number; see Section 7.1 for more information. An > > This canonicalization text seems entirely out of place, in the middle of > specification about authority. > > > > authentication service proceeding with a signature over a telephone > > number MUST then follow the canonicalization procedures described in > > Section 7.2. If the authentication service is not authoritative for > > the identity in question, it SHOULD process and forward the request > > normally unless the local policy is to block such requests. The > > authentication service MUST NOT add an Identity header if the > > authentication service does not have the authority to make the claim > > it asserts. > > > > Step 2: > > Step 2: Authorization > > > > > The authentication service MUST then determine whether or not the > > [or not] remove > > > > sender of the request is authorized to claim the identity given in > > sender: calling user?, calling ua?, originating operator? > intermediary? Although the word is used frequently in the SIP spec, it > is not defined. > > > > the identity field. In order to do so, the authentication service > > MUST authenticate the sender of the message. Some possible ways in > > which this authentication might be performed include: > > Remove the pedagogy after the first sentence. The choices are outside > of this specification and the spec is not enhanced by pedagogy about > technical matters outside of its scope. > > Also isn't the first sentence redundant with other text in the spec? > > > > > If the authentication service is instantiated by a SIP > > intermediary (proxy server), it may authenticate the request with > > the authentication scheme used for registration in its domain > > (e.g., Digest authentication). > > > > If the authentication service is instantiated by a SIP user agent= , > > a user agent may authenticate its own user through any system- > > specific means, perhaps simply by virtue of having physical acces= s > > to the user agent. > > > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 8= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > Authorization of the use of a particular username or telephone numbe= r > > in the user part of the From header field is a matter of local polic= y > > for the authentication service; see Section 6.1 for more information= . > > > > Note that this check is performed only on the addr-spec in the > > identity field (e.g., the URI of the sender, like > > 'sip:alice@atlanta.example.com'); it does not convert the display- > > name portion of the From header field (e.g., 'Alice Atlanta'). For > > more information, see Section 12.6. > > 'checking' and 'converting' are very different actions. So 'it does > not' does not flow from the preceding text in the sentence. > > > > > > Step 3: > > Step 3: Timestamp > > > > > > An authentication service MUST add a Date header field to SIP > > Why? (Probably only need to cite the earlier discussion about its use > for replay mitigation. But merely cite; don't duplicate.) > > > > requests that do not have one. The authentication service MUST > > ensure that any preexisting Date header in the request is accurate. > > Local policy can dictate precisely how accurate the Date must be; a > > RECOMMENDED maximum discrepancy of sixty seconds will ensure that > the > > request is unlikely to upset any verifiers. If the Date header > > contains a time different by more than one minute from the current > > time noted by the authentication service, the authentication service > > SHOULD reject the request. This behavior is not mandatory because a > > user agent client (UAC) could only exploit the Date header in order > > to cause a request to fail verification; the Identity header is not > > intended to provide a source of non-repudiation or a perfect record > > Then where does the non-repudiation feature of STIR come from? > > > > of when messages are processed. Finally, the authentication service > > MUST verify that both the Date header and the current time fall > > within the validity period of its credential. > > > > See Section 12 for information on how the Date header field assists > > verifiers. > > > > Step 4: > > > > Subsequently, the authentication service MUST form a PASSporT object > > and add a corresponding an Identity header to the request containing > > a corresponding an ?->? a corresponding > > > > this signature. For baseline PASSporT objects headers (without an > > baseline PASSporT objects headers > -> > a baseline PASSporT objects header > > > > Identity header "ppt" parameter), this follows the procedures in > > header? or header field? > > > > Section 8; if the authentication service is using an alternative > > "ppt" format, it MUST add an appropriate "ppt" parameter and follow > > Isn't this text repeating specification text that is elsewhere in the > document? If so, remove it. > > > > the procedures associated with that extension (see Section 9). Afte= r > > the Identity header has been added to the request, the authenticatio= n > > service MUST also add a "info" parameter to the Identity header. Th= e > > "info" parameter contains a URI from which the authentication > > service's credential can be acquired; see Section 6.3 for more on > > credential acquisition. > > > > Step 5: > > > Step 5: Canonicalization > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 9= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > In the circumstances described below, an authentication service will > > another forward reference, this time without even a specific pointer. > > > > add a "canon" parameter to the Identity header. The syntax of > > "canon" is given in Section 8; essentially, it contains a base64 > > encoding of the JSON header and claims in the PASSporT object. The > > presence of "canon" is OPTIONAL baseline PASSporT objects in SIP as = a > > because the information carried in the baseline PASSporT object's > > headers and claims is usually redundant with information already > > carried elsewhere in the SIP request. Omitting "canon" can > > significantly reduce SIP message size, especially when the PASSporT > > object contains media keys. > > > > When however an authentication service creates a PASSporT that uses > > "When however"? > > > > extension claims beyond the baseline PASSporT object, including > > "canon" is REQUIRED in order for the verification service to be > > capable of validating the signature. See Section 9. > > > > Also, in some cases, a request signed by an authentication service > > "in some cases"? This is a specification. Where is the clear detail? > > > > will be rejected by the verification service on the receiving side, > > "on the receiving side" is redundant. Remove it. Where else is there a > verification service? > > > > and the authentication service will receive a SIP 4xx status code in > > the backwards direction, such as a 438 indicating a verification > > This is offered as descriptive text here. Where is this SIP behavior > documented in this spec? > > > > failure. If the authentication service did not originally send the > > The authentication service does sending? I think it doesn't, and the > definition of its roles implies that it doesn't, but rather that it is > part of one or another module that does. > > > > Identity header with the "canon" parameter, it SHOULD retry a reques= t > > and hence it doesn't do retries. All of this needs to be recast in > terms that match the specified architecture. > > > > once after receiving a 438 response, this time including the "canon"= . > > Why? This is just guessing. Protocols that do guessing don't work very > well. > > This interaction needs to be re-specified to be deterministic. > > > > The information in "canon" is useful on the verification side for > > debugging errors, and there are some known causes of verification > > failures (such as the Date header changing in transit, see > > Section 12.1 for more information) that can be resolved by the > > inclusion of "canon". > > > > Finally, the authentication service MUST forward the message > > normally. > > it doesn't do forwarding. > > > > > > 5.2. Verifier Behavior > > > > This document specifies a logical role for SIP entities called a > > redundant detail. > > > > verification service, or verifier. When a verifier receives a SIP > > message containing one or more Identity headers, it inspects the > > headers? header fields? > > > > signature(s) to verify the identity of the sender of the message. > > The results of a verification are provided as input to an > > authorization process that is outside the scope of this document. > > Step 5, below, specifies a behavior that is within scope. > > > > A SIP request may contain zero, one, or more Identity headers. A > > verification service performs the procedures above on each Identity > > header that appears in a request. If the verifier does not support > > What does it mean to 'not support an Identity header [field]"? > > Why might there be multiple Identity header [fields]? How might they > differ? > > > > an Identity header present in a request due to the presence of an > > unsupported "ppt" parameter, or if no Identity header is present, an= d > > the presence of an Identity header is required by local policy (for > > example, based on a per-sending-domain policy, or a per-sending-user > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 10= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > policy), then a 428 'Use Identity Header' response MUST be sent in > > the backwards direction. For more on this and other failure > > responses, see Section 13.3. > > > > In order to verify an Identity header in a message, an entity acting > > as a verifier MUST perform the following steps, in the order here > > specified. Note that when an Identity header contains the optional > > "canon" parameter, the verifier MUST follow the additional procedure= s > > in Section 5.2.1. > > > > Step 1: > > Step 1: PPT parameter > > > > The verifier MUST inspect any optional "ppt" parameter appearing the > > [optional] remove. Especially given the MUST. It doesn't matter > whether the ppt was optional for the signer. > > "any" can there be more than one? If only one then perhaps: > > MUST inspect the "ppt" parameter, if present in the Identity reque= st. > > > > Identity request. If no "ppt" parameter is present, then the > > verifier proceeds normally below. If a "ppt" parameter value is > > 'normally' implies the alternative is abnormal. also, 'below' where? > > > > present, and the verifier does not support it, it MUST ignore the > > Identity header. If a supported "ppt" parameter value is present, > > the verifier follows the procedures below, including the variations > > described in Step 5. > > is the 'below' here different from the one before it? > > From the above text, it appears that ppt does not affect > processing, as long as the ppt is "supported". That is, an absent ppt > and a valid ppt both produce the same sequence 'below'. > > > > > > Step 2: > > Step 2: Signature Scope > > > > In order to determine whether the signature for the identity field > > should be over the entire identity field URI or just a canonicalized > > telephone number, the verification service MUST follow the > > canonicalization process described in Section 7.2. That section als= o > > describes the procedures the verification service MUST follow to > > determine if the signer is authoritative for a telephone number. Fo= r > > Those two functions are wildly different. Why are they part of the same > process? > > > > domains, the verifier MUST follow the process described in > > Section 7.3 to determine if the signer is authoritative for the > > identity field. > > > > Step 3: > > Step 3: Obtain Key > > > > The verifier must first ensure that it possesses the proper keying > > material to validate the signature in the Identity header field, > > which usually involves dereferencing a URI in the "info" parameter o= f > > the Identity header. See Section 6.2 for more information on these > > procedures. If the verifier does not support the credential > > described in the "info" parameter, then it should consider the > > Only should? Why??? > > > > credential for this header unsupported. If a SIP request contains n= o > > Identity headers with a supported credential, then the verifier MUST > > return a 437 "Unsupported Credential" response > > Verifier returns responses? > > > > Step 4: > > Step 4: Date Window Enforcement > > > > The verifier MUST furthermore ensure that the value of the Date > > header of the request meets local policy for freshness (usually, > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 11= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > within sixty seconds) and that it falls within the validity period o= f > > the credential used to sign the Identity header. For more on the > > attacks this prevents, see Section 12.1. If the "canon" parameter i= s > > There was earlier discussion of using a date window validation to > mitigate against some attacks. There doesn't need to be yet-another > reference here. Just cite the earlier discussion. > > > > present, the verifier should follow the Date-related behavior in > > Section 5.2.1. > > > > Step 5: > > Step 5: Signature Validation > > > > The verifier MUST validate the signature in the Identity header fiel= d > > over the PASSporT object. For baseline PASSporT objects (with no > > Identity header "ppt" parameter) the verifier MUST follow the > > procedures for generating the signature over a PASSporT object > > described in Section 8. If a "ppt" parameter is present (and per > > Step 1, is understood), the verifier follows the procedures for that > > "ppt" (see Section 9). If a verifier determines that the that the > > signature in the Identity does not correspond to the reconstructed > > signed-identity-digest, then the Identity header should be considere= d > > invalid. > > I suggest breaking this step into two parts: signature regeneration and > signature validation. > > It appears that the specification is calling for two (or more???) > different methods of doing signature validation, depending upon whether > ppt is present. This seems like an outstandingly bad idea. It creates > complexity and possibly even outright confusion. > > There needs to be a single algorithm for validation, even if components > of the algorithm have branches, such as depending on whether the > 'address' is a URI or a telephone number. > > > > > > The presence of multiple Identity headers within a message raises th= e > > prospect that a verification services could receive a message > > containing some valid and some invalid Identity headers. If the > > verifier determines all Identity headers within a message are > > invalid, then a 438 'Invalid Identity Header' response MUST be > > returned. > > So it's ok to have no Identity header fields but it's not ok to have > identity, where none validate. This means that the entire transfer > environment is expected and required to convey Identity fields > perfectly, all the time. > > > > The verification of an Identity header does not entail any particula= r > > treatment of the request. The handling of the message after the > > verification process depends on how the implementation service is > > implemented and on local policy. This specification does not propos= e > > any authorization policy for user agents or proxy servers to follow > > based on the presence of a valid Identity header, the presence of an > > invalid Identity header, or the absence of an Identity header, but i= t > > is anticipated that local policies could involve making different > > forwarding decisions in intermediary implementations, or changing ho= w > > the user is alerted, or how identity is rendered, in user agent > > implementations. > > I suspect the above paragraph belongs elsewhere and sooner. It isn't > part of the step sequence. > > > > > > 5.2.1. Handling 'canon' parameters > > > > If the optional "canon" parameter of the Identity header is present, > > [optional] remove. it's redudnant with 'if' > > [of the Identity header] remove. there is no other canon parameter. > > But really I suspect that even the 'if' is unecessary. The optionality > has been established elsewhere. The task here is merely to specify what > is in a canon. > > > > it contains a base64 encoding of the header and claim component of > > This appears to be a re-specification of canon. Don't do that. Cite > its spec and then simply use it. > > > > the PASSporT object constructed by the authentication service, and > > this it conveys any canonical telephone number formats created by th= e > > this -> thus ? > > there are multiple canon formats? that doesn't sound very canonical. > > but again, stating what it conveys is redundant. > > > > authentication service (see Section 7.2), as well as an "iat" claim > > corresponding to the Date header that the authentication service > > used. The "canon" is provided purely as an optimization and > > debugging mechanism for the verification service. > > This is the wrong place to state what canon is for. > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 12= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > When "canon" is present, the verification service MAY compute its ow= n > > 'MAY'??? I don't understand making canonicalization optional, either > during signing or during verification. > > > > canonicalization of the numbers and compare them to the values in th= e > > "canon" parameter before performing any cryptographic functions in > > order to ascertain whether or not the two ends agree on the canonica= l > > number form. Also, when "canon" is present, during Step 4 the > > verification service SHOULD compare the "iat" value in the "canon" t= o > > This is talking about actions during Step 4. Move it to Step 4! > > > > its Date header field value. If the two are different, and the "iat= " > > value is later but within verification service policy for freshness, > > the verification service SHOULD perform the computation required by > > Step 5 using the "iat" value instead of the Date value. As some > > deployments in the field have been observed to change the Date heade= r > > in transit, this procedure will prevent some unnecessary verificatio= n > > failures. > > [unnecessary] remove. > > But it won't prevent others. This means that signatures that were valid > will break. And this ought to mitigate the handling of broken signatures= . > > > > > > 6. Credentials > > > > 6.1. Credential Use by the Authentication Service > > > > In order to act as an authentication service, a SIP entity must have > > access to the private keying material of one or more credentials tha= t > > cover domain names or telephone numbers. These credentials may > > represent authority over an entire domain (such as example.com) or > > potentially a set of domains enumerated by the credential. > > [potentially] remove > > The implication is that "a set of domains" is not "an entire domain", > but I don't understand how the language says that. As written, this > actually translates to something like: authority over one or more > domains. Possibly what was meant is something like: authority over an > entire domain, or some number of sub-domains under that higher-level > domain. > > > > Similarly, a credential may represent authority over a single > > telephone number or a range of telephone numbers. The way that the > > Similarly for telephone numbers, a credential can represent one > or a range of numbers. > > > > scope of a credential is expressed is specific to the credential > > mechanism. > > So, there is no standard for the specification of credentials, here. > That means that the technical details -- as distinct from the > operational policies -- of credentials are out of scope, although they > are fundamental to proper operation of this serve. This is a > showstopper, in terms of specification completeness for the service. > > > The following paragraph is not about credentials. It is about signing > policy. It belongs elsewhere. And since it isn't really specifying > anything, that elsewhere probably is up towards introductory text. > > > > Authorization of the use of a particular username or telephone numbe= r > > in the identity field is a matter of local policy for the > > authentication service, one that depends greatly on the manner in > > Huh? > > But really, when a specification says something is out of scope and is a > matter for local policy, the specification should not then go on to > specify examples of local policy. In those cases where there is a > compelling benefit to include such examples, put them in an appendix. > But please, then, explain that compelling benefit. > > > > which authentication is performed. For non-telephone number user > > parts, one policy might be as follows: the username given in the > > 'username' parameter of the Proxy-Authorization header MUST > > correspond exactly to the username in the From header field of the > > SIP message. However, there are many cases in which this is too > > limiting or inappropriate; a realm might use 'username' parameters i= n > > Proxy-Authorization that do not correspond to the user-portion of SI= P > > From headers, or a user might manage multiple accounts in the same > > administrative domain. In this latter case, a domain might maintain > > a mapping between the values in the 'username' parameter of Proxy- > > Authorization and a set of one or more SIP URIs that might > > legitimately be asserted for that 'username'. For example, the > > username can correspond to the 'private identity' as defined in Thir= d > > Generation Partnership Project (3GPP), in which case the From header > > field can contain any one of the public identities associated with > > this private identity. In this instance, another policy might be as > > follows: the URI in the From header field MUST correspond exactly to > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 13= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > one of the mapped URIs associated with the 'username' given in the > > Proxy-Authorization header. This is a suitable approach for > > telephone numbers in particular. > > > > This specification could also be used with credentials that cover a > > single name or URI, such as alice@example.com or > > sip:alice@example.com. This would require a modification to > > authentication service behavior to operate on a whole URI rather tha= n > > a domain name. Because this is not believed to be a pressing use > > case, this is deferred to future work, but implementers should note > > this as a possible future direction. > > > > Exceptions to such authentication service policies arise for cases > > like anonymity; if the AoR asserted in the From header field uses a > > form like 'sip:anonymous@example.com' (see [RFC3323]), then the > > 'example.com' proxy might authenticate only that the user is a valid > > user in the domain and insert the signature over the From header > > field as usual. > > > > 6.2. Credential Use by the Verification Service > > > > In order to act as a verification service, a SIP entity must have a > > way to acquire and retain credentials for authorities over particula= r > > for -> from ? > > > > domain names and/or telephone numbers or number ranges. > > Dereferencing the URI found in the "info" parameter of the Identity > > header (as described in the next section) MUST be supported by all > > forward reference > > > > verification service implementations to create a baseline means of > > I /really/ don't understand the trust model that has a security scheme > where the object giving a pointer to its own credential. Or rather, I > fear that I do understand it, but don't understand why its considered > credible. > > > > credential acquisition. Provided that the credential used to sign a > > message is not previously known to the verifier, SIP entities SHOULD > > discover this credential by dereferencing the "info" parameter, > > unless they have some more other implementation-specific way of > > acquiring the needed keying material, such as an offline store of > > periodically-updated credentials. If the URI in the "info" paramete= r > > cannot be dereferenced, then a 436 'Bad Identity-Info' response MUST > > be returned. > > Again, this much non-determinacy in such an essential mechanism ensures > /non-/interoperability. I do understand the intent to have > private/proprietary mechanism at work for use of this spec back in the > regulated telecom space, but that does not mean it needs to distract the > public specification. A complete specification of a STIR service needs > to include a publicly-usable key certification mechanism, a la DANE or > DKIM or the like. > > The application of STIR for other, non-open operations are always free > to amend the specification through a separate profile that overrides one > or another piece of the base STIR specifications. > > > > > > This specification does not propose any particular policy for a > > verification service to determine whether or not the holder of a > > credential is the appropriate party to sign for a given SIP identity= . > > This is a fundamental flaw in this specification. It reduces to saying > that the document is specifying a validation service that does not > provide a deterministic means for assessing validation. Is this truly a flaw or a feature? Something that struck me as much or mor= e than any introductory words to any RFC I've read are the first sentence o= f RFC6376: "DomainKeys Identified Mail (DKIM) permits a person, role, or organization that owns the signing domain to claim some _responsibility_ for a message by associating the domain with the message." There's _ENORMOUS_ value to this (DKIM's) association of message with signe= r, arguably as much or more as the conveyance of trusted caller authenticat= ion. IMHO, STIR would be more modular if it said less about what the signatures = mean and left the door more open to additional/alternative signing mechanis= ms. Having these in other specs or future revisions may help future proof = this doc and assist in modularization. > > > > Guidance on this is deferred to the credential mechanism > > specifications, which must meet the requirements in Section 6.4. > > > > Verification service implementations supporting this specification > > may wish to have some means of retaining credentials (in accordance > > with normal practices for credential lifetimes and revocation) in > > order to prevent themselves from needlessly downloading the same > > credential every time a request from the same identity is received. > > Credentials cached in this manner may be indexed in accordance with > > This is gratuitous implementation advice. Remove it. Generally, I agree. Possible exception is a note that any cache mechanism = implementations should consider impact on cert revocation timelines. This = might help the casual reader, but it's difficult to expect any competent ca= che designer to need this advice. > > If there is a compelling desire to give implementation advice, move it > to a separate document and make it more complete. > > It is especially ironic to try to give implementation advice about a > mechanism that isn't fully specified. > > > > > > Peterson, et al. Expires January 8, 2017 [Page 14= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > local policy: for example, by their scope, or the URI given in the > > "info" parameter value. Further consideration of how to cache > > credentials is deferred to the credential mechanism specifications. > > > > 6.3. Handling 'info' parameter URIs > > > I don't find a specification for the 'info' parameter. I find many > references to the Identity-Info header field, but assume that's not what > is meant here. > > I also find abnf for an ident-info rule, which includes an "ident" > literal string. I suspect this is the reference you intend? > > Please reference these more formally and properly cite their definition > at first use. (If you want to rename rules, to make the use of the > rulename more pleasant in the text, that's fine. But just make sure > that a new reader can understand what type of reference is being made > and where to go to find its definition. > > Ditto for "alg". > > Ditto for ppt. > > And, of course, these are more forward references. In this case, it's > giving detail about something that hasn't even been defined yet. > > > > An "info" parameter MUST contain a URI which dereferences to a > > This isn't about the handling of info. It's defining its contents. They > need to be separate segments of text. > > > resource that contains the public key components of the credential > > used by the authentication service to sign a request. It is > > essential that a URI in the "info parameter" be dereferencable by an= y > > Again, specification, not handling. Also, what do the instructions > mean? How is the signer to know what is dereferenceable by the verifier? > > > > entity that could plausibly receive the request. For common cases, > > this means that the URI must be dereferencable by any entity on the > > public Internet. In constrained deployment environments, a service > > private to the environment might be used instead. > > > > Beyond providing a means of accessing credentials for an identity, > > the "info" parameter further serves as a means of differentiating > > which particular credential was used to sign a request, when there > > are potentially multiple authorities eligible to sign. For example, > > It sounds as if the real need is to have an external registry of > authorized credentialing services and then refer to the one that is used > by name. That provides independent vetting and limits the 'vocabulary' > of credential service references the message can cite. > > > > imagine a case where a domain implements the authentication service > > role for a range of telephone and a user agent belonging to Alice ha= s > > acquired a credential for a single telephone number within that > > range. Either would be eligible to sign a SIP request for the numbe= r > > in question. Verification services however need a means to > > differentiate which one performed the signature. The "info" > > parameter performs that function. > > > > 6.4. Credential System Requirements > > Besides having extraneous material, this section is almost certainly > incomplete and probably extremely incomplete. I suggest removing the > section and simply state that the details of the credentialing system > are outside the scope of this specification, except for specifying a > registry that lists possible systems. > > Also note that the claimed interest in authentication beyond SIP will > also require credentialing systems. As such, the entire topic appears > to be larger than this specification. > > > > This document makes no recommendation for the use of any specific > > credential system. Today, there are two primary credential systems > > A review of current, external services and hypothetical capabilities is > not appropriate for inclusion inside a technical specification. Move it > to a separate document. > > > > in place for proving ownership of domain names: certificates (e.g., > > X.509 v3, see [RFC5280]) and the domain name system itself (e.g., > > DANE, see [RFC6698]). It is envisioned that either could be used in > > the SIP identity context: an "info" parameter could for example give > > an HTTP URL of the Content-Type 'application/pkix-cert' pointing to = a > > certificate (following the conventions of [RFC2585]). The "info" > > parameter may use the DNS URL scheme (see [RFC4501]) to designate > > keys in the DNS. > > > > While no comparable public credentials exist for telephone numbers, > > either approach could be applied to telephone numbers. A credential > > system based on certificates is given in > > [I-D.ietf-stir-certificates], but this specification can work with > > other credential systems; for example, using the DNS was proposed in > > [I-D.kaplan-stir-cider]. > > the above isn't 'requirements'. > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 15= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > In order for a credential system to work with this mechanism, its > > specification must detail: > > > > which URIs schemes the credential will use in the "info" > > parameter, and any special procedures required to dereference the > > URIs > > > > how the verifier can learn the scope of the credential > > what does scope of the credential'? > > > > any special procedures required to extract keying material from > > the resources designated by the URI > > > > any algorithms required to validate the credentials (e.g. for > > certificates, any algorithms used by certificate authorities to > > sign certificates themselves) > > Looks like this needs to define a STIR Credential Registry. > > > > It is furthermore required that all credential specifications > > describe how the associated credentials will support the mandatory > > signing algorithm(s) required by PASSporT [I-D.ietf-stir-passport]. > > So this really is another bullet for the above, indented list? > > Then again: credentials supporting signing algorithms? I don't > understand this. The signing algorithms are for the payload using the > key /from/ the credential. So what does this requirement mean, and why? > > > > > > SIP entities cannot reliably predict where SIP requests will > > terminate. When choosing a credential scheme for deployments of thi= s > > specification, it is therefore essential that the trust anchor(s) fo= r > > credentials be widely trusted, or that deployments restrict the use > > of this mechanism to environments where the reliance on particular > > trust anchors is assured by business arrangements or similar > > constraints. > > replace above with: Use of a credentialing mechanism must be > supported within a scope sufficient to include the authentication > service, the verifying service and the credentialing service. > > > > > > Note that credential systems must address key lifecycle management > > concerns: were a domain to change the credential available at the > > Identity-Info URI before a verifier evaluates a request signed by an > > authentication service, this would cause obvious verifier failures. > > When a rollover occurs, authentication services SHOULD thus provide > > new Identity-Info URIs for each new credential, and SHOULD continue > > to make older key acquisition URIs available for a duration longer > > than the plausible lifetime of a SIP transaction (a minute would mos= t > > likely suffice). > > > > 7. Identity Types > > > > This specification focuses primarily on cases where the called and > > Focuses primarily? What I've been reading in this spec covers both > phone and uri forms. So I don't know what the 'primarily' refers to. > > > > calling parties identified in the To and From header field values us= e > > telephone numbers, as this remains the dominant use case in the > > deployment of SIP. However, this specification also works with > > "greenfield" identifiers (of the form "sip:user@host"), and > > potentially other identifiers when SIP interworks with another > > protocol. > > What about these is 'greenfield'? What does it mean here? > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 16= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > The guidance in this section also applies to extracting the URI > > guidance vs. specification? > > > > containing the originator's identity from the P-Asserted-Identity > > header field value instead of the From header field value. In some > > Huh? How is the verifier supposed to know where to draw the values from? > > > > environments, the P-Asserted-Identity header field is used in lieu o= f > > the From header field to convey the address-of-record or telephone > > number of the sender of a request; while it is not envisioned that > > many of those networks would or should make use of the Identity > > mechanism described in this specification, where they do, local > > policy might therefore dictate that the canonical identity derive > > from the P-Asserted-Identity header field rather than the From. > > As soon as a document says 'local policy' it needs to stop specifying > detail, since it is both outside of the scope of the document and it is > distracting from the details of the specification. > > If you have to make reference to the possibility, then include something > simple and brief, such as: > > Local policies might choose to use a value from fields other than > To and From. The details for this are outside the scope of this > specification. > > To the extent there is a compelling need to specify this alternative > mechanism, do it in a separate specification. > > > > Ultimately, in any case where local policy canonicalizes the idenity > > into a form different from how it appears in the From header field, > > the use of the "canon" parameter by authentication services is > > RECOMMENDED, but because "canon" itself could then divulge > > information about users or networks, implementers should be mindful > > of the guidelines in Section 11. > > remove above paragraph. > > > > > It may not be trivial to tell if a given URI contains a telephone > > If that means it isn't deterministic, we've got a basic problem, since > protocol specs do not offer heuristics. > > If it just means there is complexity, then the sentence says nothing usef= ul. > > > > number. In order to determine whether or not the user portion of a > > [or not] remove > > > > SIP URI is a telephone number, authentication services and > > verification services MUST perform the following procedure on any SI= P > > URI they inspect which contains a numeric user part. Note that the > > same procedures are followed for creating the canonical form of URIs > > found in the From header field as they are in the To header field or > > the P-Asserted-Identity header field. > > If there is an algorithm to follow, specify it as an algorithm. > Otherwise, this is non-normative discussion and isn't very helpful here. > > > > First, implementations must look for obvious indications that the > > user-portion of the URI constitutes a telephone number. Telephone > > numbers most commonly appear in SIP header field values in the > > "most commonly" suggests that this is discussion, not specification. > > > > username portion of a SIP URI (e.g., > > 'sip:+17005551008@chicago.example.com;user=3Dphone'). The user part= of > > that URI conforms to the syntax of the TEL URI scheme (RFC 3966 > > [RFC3966]). It is also possible for a TEL URI to appear in the SIP > > To or From header field outside the context of a SIP or SIPS URI > > (e.g., 'tel:+17005551008'). Thus, in some environments, numbers wil= l > > be explicitly labeled by the use of TEL URIs or the 'user=3Dphone' > > parameter, or implicitly by the presence of the '+' indicator at the > > start of the user-portion. Absent these indications, if there are > > numbers present in the user-portion, implementations may also detect > > that the user-portion of the URI contains a telephone number by > > determining whether or not those numbers would be dialable or > > routable in the local environment -- bearing in mind that the > > telephone number may be a valid E.164 number, a nationally-specific > > number, or even a private branch exchange number. Once a telephone > > number has been detected, implementations should follow the > > procedures in Section 7.2. > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 17= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > If the URI field does not contain a telephone number, URI > > normalization procedures are invoked to canonicalize the URI before > > it is included in a PASSporT object in, for example, an "uri" claim. > > See Section 7.4 for that behavior. > > I suspect that the above topic is confusing what can/must be done as a > deterministic specification, with what incremental value can be obtained > by the addition of some non-normative heuristics. Separate these and > make the deterministic stuff part of the specification and the > heuristics part of an external document discussing real-world > implementation, or somesuch. > > > > > > 7.1. Authority for Telephone Numbers > > > > In order for telephone numbers to be used with the mechanism > > described in this document, authentication services must enroll with > > an authority that issues credentials authoritative for telephone > > numbers or telephone number ranges, and verification services must > > trust the authority employed by the authentication service that sign= s > > "enroll"??? > > > > a request. Per Section 6.4, enrollment procedures and credential > > management are outside the scope of this document; approaches to > > credential management for telephone numbers are discussed in > > [I-D.ietf-stir-certificates]. > > If they are outside the scope, then don't provide details such as about > enrolling. At the least, don't repeat information provided elsewhere in > the document. > > > > > > 7.2. Telephone Number Canonicalization Procedures > > > > Once an implementation has identified a telephone number in the URI, > > Once a telephone number is identified... > > And what about telephone numbers that are not part of a URI? > > > > it must construct a number string. That requires performing the > > following steps: > > If a 'number string' has been identified, then what does it mean to > 'construct a number string'? I think what's meant is that it is > necessary to put the number into a canonical form. In any case, please > clarify what is meant. > > The algorithm should be specified in the form of an algorithm, rather > than as normative prose, and language like "except only" encourages > coding errors: > > > > Implementations MUST drop any leading +'s, any internal dashes, > > parentheses or other non-numeric characters, excepting only the > > leading "#" or "*" keys used in some special service numbers > > (typically, these will appear only in the To header field value). > > This MUST result in an ASCII string limited to "#", "*" and digit= s > > without whitespace or visual separators. > > So '+' is retained if it's internal? Why? > > Move commentary about the algorithm -- such as "these will appear..." -- > to be outside of the algorithm specification. > > > Next, an implementation must assess if the number string is a > > valid, globally-routable number with a leading country code. If > > How are they to do this? > > > > not, implementations SHOULD convert the number into E.164 format, > > adding a country code if necessary; this may involve transforming > > the number from a dial string (see [RFC3966]), removing any > > So, again, this isn't really a specification. Language like 'may > involve' makes this commentary. > > > > national or international dialing prefixes or performing similar > > procedures. It is only in the case that an implementation cannot > > determine how to convert the number to a globally-routable format > > Again, this kind of language is not really a specification. > > > > that this step may be skipped. This will be the case, for > > example, for nationally-specific service numbers (e.g. 911, 112); > > however, the routing procedures associated with those numbers wil= l > > likely make sure that the verification service understands the > > context of their use. > > > > Other transformations during canonicalization MAY be made in > > accordance with specific policies used within a local domain. Fo= r > > example, one domain may only use local number formatting and need > > to convert all To/From user portions to E.164 by prepending > > And the above text also is not a specification. It also isn't > interoperable. It says "the folks encoding the strings will do whatever > local stuff they feel like and the folks at the verification side won't > know what it was and won't be able to replicate it. So canonicalization > won't be a standard, global service. > > The alternative model, is that 'local policy' will be the same for both > ends, in which case, the spec is saying that there might be > canonicalizations that are outside the specifications. But in that > case, text referring to it is distracting rather than helpful. > > If a local environment is doing 'local policy' then it will document > that separately. There is no utility in making vague statements about > possibilities that are outside the spec. > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 18= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > country-code and region code digits; another domain might prefix > > usernames with trunk-routing codes and need to remove the prefix. > > This specification cannot anticipate all of the potential > > transformations that might be useful. > > > > The resulting canonical number string will be used as input to th= e > > hash calculation during signing and verifying processes. > > > > The ABNF of this number string is: > > > > tn-spec =3D [ "#" / "*" ] 1*DIGIT > > I suspect that the entire topic of canonicalization merely needs core > text that says somethg like: > > Take the original string and remove any characters that do not > conform to the above format. > > Then tweak that text for any cases that need to add characters. > > > > > > If the result of this procedure forms a complete telephone number, > > What is the definition of a 'complete tn'? Cite it. > > > > that number is used for the purpose of creating and signing the > > for the purpose of creating and signing -> for creating > > I suspect it is /not/ used "for signing" but is in fact used to create > part of the content that is signed. That's different. > > > > signed-identity-string by both the authentication service and > > verification service. Practically, entities that perform the > > authentication service role will sometimes alter the telephone > > numbers that appear in the To and From header field values, > > converting them to this format (though note this is not a function > > that [RFC3261] permits proxy servers to perform). The result of the > > canonicalization process of the From header field value may also be > > recorded through the use of the "canon" parameter of the Identity(se= e > > Section 8). > > Why is this significant? How does it affect processing? > > > > > > If the result of the canonicalization of the From header field value > > does not form a complete and valid telephone number, the > > authentication service and/or verification service SHOULD treat the > > entire URI as a SIP URI, and apply the procedures in Section 7.4. > > Here, having a SHOULD rather than a MUST seems likely to produce > non-interoperability, since signer and validator are allowed to behave > differently, thereby making it likely they will produce different results= . > > > > > > 7.3. Authority for Domain Names > > Authority for domain names comes from ICANN. Unfortunately, I'm not > clear enough about the specific purpose of this section, but it needs a > title that is more specific and clear. > > It appears that this section is both trying to give background about > various occurrences of domain names and (redundantly?) discuss the > challenges of finding the right caller-id string. This suggests > splitting the discussion to an earlier, non-normative section, and a > section here that simply specifies technical detail to perform. > > > > When a verifier processes a request containing an Identity-Info > > header with a domain signature, it must compare the domain portion o= f > > must or MUST? > > > > the URI in the From header field of the request with the domain name > > that is the subject of the credential acquired from the "info" > > parameter. While it might seem that this should be a straightforwar= d > > process, it is complicated by two deployment realities. In the firs= t > > place, credentials have varying ways of describing their subjects, > > and may indeed have multiple subjects, especially in 'virtual > > hosting' cases where multiple domains are managed by a single > > application. Secondly, some SIP services may delegate SIP functions > > to a subordinate domain and utilize the procedures in RFC 3263 > > [RFC3263] that allow requests for, say, 'example.com' to be routed t= o > > 'sip.example.com'. As a result, a user with the AoR > > 'sip:jon@example.com' may process requests through a host like > > 'sip.example.com', and it may be that latter host that acts as an > > authentication service. > > > > But since credentials are a modularized construct, outside of this > specification, why is this specification going into this sort of detail > about them? > > > > > > Peterson, et al. Expires January 8, 2017 [Page 19= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > To meet the second of these problems, a domain that deploys an > > authentication service on a subordinate host MUST be willing to > > supply that host with the private keying material associated with a > > credential whose subject is a domain name that corresponds to the > > domain portion of the AoRs that the domain distributes to users. > > Note that this corresponds to the comparable case of routing inbound > > SIP requests to a domain. When the NAPTR and SRV procedures of RFC > > 3263 are used to direct requests to a domain name other than the > > domain in the original Request-URI (e.g., for 'sip:jon@example.com', > > the corresponding SRV records point to the service > > 'sip1.example.org'), the client expects that the certificate passed > > back in any TLS exchange with that host will correspond exactly with > > the domain of the original Request-URI, not the domain name of the > > host. Consequently, in order to make inbound routing to such SIP > > services work, a domain administrator must similarly be willing to > > share the domain's private key with the service. This design > > decision was made to compensate for the insecurity of the DNS, and i= t > > makes certain potential approaches to DNS-based 'virtual hosting' > > unsecurable for SIP in environments where domain administrators are > > unwilling to share keys with hosting services. > > Really, I suspect all of the above detail is out of scope, given the way > these specifications have been partitioned. > > > > > A verifier MUST evaluate the correspondence between the user's > > identity and the signing credential by following the procedures > > defined in RFC 2818 [RFC2818], Section 3.1. While RFC 2818 [RFC2818= ] > > deals with the use of HTTP in TLS and is specific to certificates, > > the procedures described are applicable to verifying identity if one > > substitutes the "hostname of the server" in HTTP for the domain > > portion of the user's identity in the From header field of a SIP > > request with an Identity header. > > What does 'must evaluate' mean? What specific 'evaluation' actions are > being required? And actions are to be taken in response to the evaluatio= n? > > > > > > 7.4. URI Normalization > > Canonicalization for phone numbers and Normalization for URI. Why the > difference? > > > > Just as telephone numbers may undergo a number of syntactic > > transformation during transit, the same can happen to SIP and SIPS > > transformation -> transformations > > > > URIs without telephone numbers as they traverse certain > > intermediaries. Therefore, when generating a PASSporT object based > > on a SIP request, any SIP and SIPS URIs must be transformed into a > > canonical form which captures the address-of-record represented by > > the URI before they are provisioned in PASSporT claims such as "uri"= . > > The above text belongs in an earlier discussion of issues, so that the > specification section can focus on specifying. > > > > The URI normalization procedures required are as follows. > > > > Following the ABNF of RFC3261, the SIP or SIPS URI in question MUST > > Which ABNF? Where in the document? Section 25.1? > > What about the ABNF requires any of what is asserted here? > > Again, algorithms need to be specified as algorithms, not just prose. > > > > discard all elements after the "hostport" of the URI, including all > > uri-parameters and headers, from its ayntax. Of the userinfo > > "including"? By my reading there isn't anything other than those two rul= es. > > > > component of the SIP URI, only the user element will be retained: an= y > > password (and any leading ":" before the password) MUST be removed, > > and since this userinfo necessarily does not contain a telephone- > > I think the algorithm intended here is: > > 1. Parse the SIP/SIPS URI > > 2. Retain if present > ; will not be present > > 3. Retain > > done. > > > > > Peterson, et al. Expires January 8, 2017 [Page 20= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > subscriber component, no further parameters can appear in the user > > portion. > > > > The hostport portion of the SIP or SIPS URI MUST similarly be > > stripped of any trailing port along with the ":" that proceeds the > > port, leaving only the host. > > In other words, just get > > > > > > The ABNF of this canonical URI form (following the syntax defined in > > RFC3261) is: > > > > canon-uri =3D ( "sip" / "sips" ) ":" user "@" host > > What is the purpose of retaining the sip/sips distinction, within this > context? > > > > Finally, the URI will be subject to syntax-based URI normalization > > procedures of [RFC3986] Section 6.2.2, especially to perform case > > Except that 6.2.2 does not actually specify normalization. Rather, it > talks about an approach to normalization, without giving precise details. > > > > normalization and percent-encoding normalization. However, note tha= t > > normalization procedures face known challenges in some > > internationalized environments (see [I-D.ietf-iri-comparison]) and > > that perfect normalization of URIs may not be possible in those > > environments. > > The above last sentence reduces to: do normalization but don't rely on > it working. > > This again raises the question of treating a broken signature the same > as no signature present. > > > > > > For future PASSporT applications, it may be desirable to provide an > > identifier without an attached protocol scheme. Future > > Discussion about future hypotheticals, again. Remove. > > > > specifications that define PASSporT claims for SIP as a using > > protocol could use these basic procedures, but eliminate the scheme > > component. A more exact definition is left to future specifications= . > > Exactly. > > > > > > 8. Header Syntax > > > I'm quite confused. This section appears to be simultaneously > specifying a SIP Identity header field as well as how to populate an > associate Passort entity. > > > > The Identity and Identity-Info headers that were previously defined > > header *field* > > > > in RFC4474 are deprecated. > > Reference to the previous 4474 content is unproductive and distracting. > Remove all of it. This is a new specification. > > It is not revising an installed base. So this section should merely > define what it defines and not put it in terms of the earlier document. > > > This revised specification collapses the > > grammar of Identity-Info into the Identity header via the "info" > > parameter. Note that unlike the prior specification in RFC4474, the > > Identity header is now allowed to appear more than one time in a SIP > > request. The revised grammar for the Identity header is (following > > the ABNF [RFC4234] in RFC 3261 [RFC3261]): > > > > Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-inf= o *( > SEMI ident-info-params ) > > signed-identity-digest =3D LDQUOT *base64-char RDQUOT > > ident-info =3D "info" EQUAL ident-info-uri > > ident-info-uri =3D LAQUOT absoluteURI RAQUOT > > ident-info-params =3D ident-info-alg / ident-type / canonical-str / = ident- > info-extension > > ident-info-alg =3D "alg" EQUAL token > > ident-type =3D "ppt" EQUAL token > > canonical-str =3D "canon" EQUAL *base64-char > > ident-info-extension =3D generic-param > > > > base64-char =3D ALPHA / DIGIT / "/" / "+" > > > Note the use of ABNF here, rather than JSON. > > canon is optional. why doesn't the abnf show it as optional? I suspect > the issue is that the abnf needs to distinguish between mandatory and > optional components of the Identity header field. > > isn't defined!!! > > isn't defined. > > LAQUOT, EQUAL, RAQUOT, absoluteURI are all undefined. Rules like these > are usually inherited from another document. If that's the case here, > cite it. > > These sorts of rules (including base-64-char, which is defined > syntactically but not semantically) need explicit ABNF rules with their > names and then need prose text to explain their semantics. > > > > > > Peterson, et al. Expires January 8, 2017 [Page 21= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > In addition to "info" parameter, and the "alg" parameter previously > > to -> to the > > > > defined in RFC4474, this specification includes the optional "canon" > > and "ppt" parameters. Note that in RFC4474, the signed-identity- > > digest (see ABNF above) was given as quoted 32LHEX, whereas here it > > is given as a quoted sequence of base64-char. > > > > The 'absoluteURI' portion of ident-info-uri MUST contain a URI; see > > Section 6.3 for more on choosing how to advertise credentials throug= h > > this parameter. > > > > The signed-identity-digest is the signed hash component of a PASSpor= T > > object [I-D.ietf-stir-passport], a signature which PASSporT generate= s > > That document does not contain the string "signed hash". The word > 'hash' only appears in 3.2.2.2 "mky". Worse, that section really does > not specify its contents. Rather -- yet again -- we get discussion > about purpose and possibility. > > Specific reference to a specific value that can be interoperably > generated is needed. > > > > over a pair of JSON objects. The first PASSporT object contains > > What is meant by "the first passport object"? Where is there > specification of multiple of them and how is their ordering determined? > > > > header information, and the second contains claims, following the > > conventions of JWT [RFC7519]; some header and claim values will > > mirror elements of the SIP request. Once these two JSON objects hav= e > > I've gone back and looked at the Passport references to "object" and do > not see any clear indication that there are two, in the style being > summarized here. Note that Passport's Section 3.1 does not say > "object". Nor does the next section, 3.2. Yet, apparently, both should. > > But matters appear to be more confusing than that, in the Passport > document, such as Section 3.2.2.1, which is titled 'claims' but makes > references to objects. > > I naturally assume that some portion of this is inherited from JSON > and/or JWT, which is a nice example of the significant, additional > overhead being being introduced with their use. And in this case, > apparently confusion. > > > > been generated, they will be encoded, then hashed with a SHA-256 > > hash. Those two hashes are then concatenated (header then claims) > > into a string separated by a single "." per baseline PASSporT. > > Finally, that string is signed to generate the signed-identity-diges= t > > value of the Identity header. > > Another algorithm needing to be specified as an algorithm. > > > > > > For SIP implementations to populate the PASSporT header object from = a > > SIP request, the following elements message MUST be placed as the > > placed where? > > Or is this really a straight data copy from the JSON form to parameters > in the SIP Identity header field? > > > > values corresponding to the designated JSON keys: > > Delete the opening clause. > > > > First, per baseline [I-D.ietf-stir-passport], the JSON key "typ" > > key MUST have the value "passport". > > This appears to be introducing a redundancy between this spec and the > Passport spec. There needs to be language in one that merely cites the > other, rather than respecifying it. > > > > > Second, the JSON key "alg" MUST mirror the value of the optional > > "alg" parameter in the SIP Identity header. Note if the "alg" > > parameter is absent, the default value is "ES256". > > > > Third, the JSON key "x5u" MUST have a value equivalent to the > > quoted URI in the "info" parameter. > > > > Fourth, the optional JSON key "ppt", if present, MUST have a valu= e > > equivalent to the quoted value of the "ppt" parameter of the > > Identity header. If the "ppt" parameter is absent from the > > header, the "ppt" key MUST NOT not appear in the JSON heaer > > object. > > All of these 'must' formations are overkill. Normally, algorithms are > specified in a simple, declarative manner. > > > > For example: > > > > { "typ":"passport", > > "alg":"ES256", > > "x5u":"https://www.example.com/cert.pkx" } > > What is this example demonstrating? How is the reader to know? > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 22= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > To populate the PASSporT claims JSON object from a SIP request, the > > following elements MUST be placed as values corresponding to the > > designated JSON keys: > > > > First, the JSON "orig" array MUST be populated. If the > > originating identity is a telephone number, then the array MUST b= e > > populated with a "tn" claim with a value set to the value of the > > quoted originating identity, a canonicalized telephone number (se= e > > Section 7.2). Otherwise, the array MUST be populated with a "uri= " > > claim, set to the value of the AoR of the UA sending the message > > as taken from addr-spec of the From header field, per the > > procedures in Section 7.4. > > Again, this appears to be quite a bit of detail that is redundant with > specifications elsewhere. > > > > > > Second, the JSON "dest" array MUST be populated. If the > > destination identity is a telephone number, then the array MUST b= e > > populated with a "tn" claim with a value set to the value of the > > quoted destination identity, a canonicalized telephone number (se= e > > Section 7.2). Otherwise, the array MUST be populated with a "uri= " > > claim, set to the value of the addr-spec component of the To > > header field, which is the AoR to which the request is being sent= , > > per the procedures in Section 7.4. > > > > Third, the JSON key "iat" MUST appear, set to the value of a > > quoted encoding of the value of the SIP Date header field as a > > JSON NumericDate (as UNIX time, per [RFC7519] Section 2). > > > > Fourth, if the request contains an SDP message body, and if that > > SDP contains one or more "a=3Dfingerprint" attributes, then the J= SON > > key "mky" MUST appear with the algorithm(s) and value(s) of the > > fingerprint attributes (if they differ), following the format > > given in [I-D.ietf-stir-passport] Section 3.2.2.2. > > > > For example: > > > > { "orig":{"tn":"12155551212"}, > > "dest":{"tn":"12155551213"}, > > "iat":"1443208345" } > > > > For more information on the security properties of these SIP message > > 'more'? is there security information here? where? > > > > elements, and why their inclusion mitigates replay attacks, see > > Section 12 and [RFC3893]. Note that future extensions to the > > And since every RFC contains a security considerations section, a > generic reference like this, here, is of no obvious value. It's just > more text. > > > > PASSporT object could introduce new claims, and that further SIP > > Future reference to hypotheticals. > > > > procedures could be required to extract further information from the > > SIP request to populate the values of those claims; see Section 9. > > > > The "orig" and "dest" arrays may contain identifiers of heterogeneou= s > > type; for example, the "orig" array might contain a "tn" claim, whil= e > > What is the import of this observation? > > Is there something in the specification that appears to constrain the > choices? > > > > the "dest" contains a "uri" claim. Also note that in some cases, th= e > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 23= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > "orig" and "dest" arrays might be populated with more than one value= . > > This could for example occur when multiple "dest" identities are > > specified in a meshed conference. Defining how a SIP implementation > > would provision multiple originating or destination identities is > > left as a subject for future specification. > > > > After these two JSON objects, the header and the claims, have been > > constructed, they must each be hashed per [I-D.ietf-stir-passport] > > Section 3.3. The signed value of those concatenated hashes then > > Except that Passport Section 3.3 says nothing more than: > > The signature of the PASSporT is created as specified by JWS using > the private key corresponding to the X.509 public key certificate > referenced by the "x5u" header parameter. > > and that doesn't look like an implementable specification to me. > > > > becomes the signed-identity-string of the Identity header. The > > hashing and signing algorithm is specified by the 'alg' parameter of > > the Identity header and the mirrored "alg" parameter of PASSporT. > > This specification inherits from the PASSporT specification one valu= e > > for the 'alg' parameter: 'ES256', as defined in [RFC7519], which > > connotes an ECDSA P-256 digital signature. All implementations of > > this specification MUST support the required signing algorithms of > > PASSporT. > > > > The complete form of the Identity header will therefore look like th= e > > following example: > > > > Identity: > "sv5CTo05KqpSmtHt3dcEiO/1CWTSZtnG3iV+1nmurLXV/HmtyNS7Ltrg9dlxkW > zo > > > eU7d7OV8HweTTDobV3itTmgPwCFjaEmMyEI3d7SyN21yNDo2ER/Ovgtw0Lu5 > csIp > > pPqOg1uXndzHbG7mR6Rl9BnUhHufVRbp51Mn3w0gfUs=3D"; \ > > info=3D;alg=3DES256 > > It would be quite a bit more helpful to have a detail, incremental > example that shows how each of the bits are created and then assembled. > > > > In a departure from JWT practice, the SIP usage of PASSporT MAY NOT > > include the base64 encoded version of the JSON objects in the > > JWT normally calls for including the encoded version of JSON objects in > the Identity header (field)? > > Really, it isn't clear what the exact exception is. If citing this is > that important, please make the details clear including appropriate > citations, such as to the relevant part of the JWT spec. > > > > Identity header: only the signature component of the PASSporT is > > REQUIRED. Optionally, as a debugging measure or optimization, the > > base64 encoded concatenation of the JSON header and claims may be > > included as the value of a "canon" parameter of the Identity header. > > Note that this may be lengthy string. > > > > 9. Extensibility > > > > For the extensibility of baseline PASSporT with now claims, see > > [I-D.ietf-stir-passport] Section 4. > > "with now claims"? > > And what is the benefit of having this directive? > > > > > As future requirements may warrant increasing the scope of the > > Identity mechanism, this specification defines an optional "ppt" > > parameter of the Identity header, which mirrors the "ppt" header key > > The term 'header key' does not occur in the Passport specifiction. > Perhaps this is meant to refer to that doc's section 4.1 header parameter= ? > > > > in PASSporT. The "ppt" parameter value MUST consist of a token > > containing an extension specification, which denotes an extended set > > of one or more signed claims per the type extensibility mechanism > > specified in [I-D.ietf-stir-passport]. > > So they will only be able to use one extension? > > Also, what is the utility of having this information in the SIP Identity > header field? > > > > > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 24= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > An authentication service cannot assume that verifiers will > > understand any given extension. Verifiers that do support an > > extension may then trigger appropriate application-level behavior in > > the presence of an extension; authors of extensions should provide > > appropriate extension-specific guidance to application developers on > > this point. > > This is likely redundant information. > > > > > > If any claim in an extension contains a JSON value that does not > > correspond to any field of the SIP request, but then the optional > > "canon" parameter MUST be used for the Identity header containing > > that extension. > > If...but then appears to be a non-sequitor or incompletely > formulated sentence. > > > > > > 10. Backwards Compatibililty with RFC4474 > > Delete this section. > > > > This specification introduces several significant changes from the > > RFC4474 version of the Identity header. However, due to the problem= s > > enumerated in [I-D.rosenberg-sip-rfc4474-concerns], it is not > > believed that the original Identity header has seen any deployment, > > or even implementation in deployed products. > > > > As such, this mechanism contains no provisions for signatures > > generated with this specification to work with RFC4474-compliant > > implementations, nor any related backwards-compatibility provisions. > > Hypothetically, were an RFC4474-compliant implementation to receive > > messages containing this revised version of the Identity header, it > > would likely fail the request due to the absence of an Identity-Info > > header with a 436 response code. Implementations of this > > specification, for debugging purposes, might interpret a 436 with a > > reason phrase of "Bad Identity-Info" as an indication that the > > request has failed because it reached a (hypothetical) > > RFC4474-compliant verification service. > > In fact there is so little overlap of substantive text, this really is > an entirely new document and not a bis. > > > > > 11. Privacy Considerations > > > > The purpose of this mechanism is to provide a strong identification > > I think the usual terms are 'strong authentication' or 'strong security' > (though 'security' has no clear technical meaning.) 'Strong > identification' appears to have no common meaning. > > > > of the originator of a SIP request, specifically a cryptographic > > assurance that an authority asserts the originator can claim the URI > > given in the From header field. This URI may contain a variety of > > personally identifying information, including the name of a human > > being, their place of work or service provider, and possibly further > > details. The intrinsic privacy risks associated with that URI are, > > however, no different from those of baseline SIP. Per the guidance > > in [RFC6973], implementers should make users aware of the privacy > > trade-off of providing secure identity. > > > > The identity mechanism presented in this document is compatible with > > the standard SIP practices for privacy described in [RFC3323]. A SI= P > > proxy server can act both as a privacy service and as an > > I think that I don't know what it means to be a 'privacy service'. What > functionality does this reference here and how is the reader to know? > > > > > > > > > > Peterson, et al. Expires January 8, 2017 [Page 25= ] > > > > > > Internet-Draft SIP Identity July 201= 6 > > > > > > authentication service. Since a user agent can provide any From > > header field value that the authentication service is willing to > > authorize, there is no reason why private SIP URIs that contain > > legitimate domains (e.g., sip:anonymous@example.com) cannot be > signed > > This sentence sounds as if it is signaling an important point, but the > text does not make clear what that import is. My guess is that it needs > to be preceded by a sentence that explains what problem the reader might > think exists. Then this text explains that it doesn't. > > > > by an authentication service. The construction of the Identity > > header is the same for private URIs as it is for any other sort of > > How is that a privacy matter? > > > > URIs. Similar practices could be used to support opportunistic > > signing of SIP requests for UA-integrated authentications services > > with self-signed certificates, though that is outside the scope of > > this specification and is left as a matter for future investigation. > > > > Note, however, that even when using anonymous SIP URIs, an > > authentication service must possess a certificate corresponding to > > the host portion of the addr-spec of the From header field of the > > The 'however' does not follow any statement that it matches against. > Again, there's no stage that has been set, for which this resolves a > concern. > > > > request; accordingly, using domains like 'anonymous.invalid' will no= t > > if this is actually a domain value that is used, please cite where it is > documented. For that matter, how is one to tell what other domains are > 'like' it? If the string isn't in actual use then why doesn't it use > the usual RFC choices for an example domain name? > > > > be possible for privacy services that also act as authentication > > services. The assurance offered by the usage of anonymous URIs with > > a valid domain portion is "this is a known user in my domain that I > > have authenticated, but I am keeping its identity private". > > ... > > > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 9 02:18:50 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E14A412D0A7 for ; Tue, 9 Aug 2016 02:18:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o1RU5bWEvFg2 for ; Tue, 9 Aug 2016 02:18:45 -0700 (PDT) Received: from resqmta-po-05v.sys.comcast.net (resqmta-po-05v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2F1312B058 for ; Tue, 9 Aug 2016 02:18:45 -0700 (PDT) Received: from resomta-po-13v.sys.comcast.net ([96.114.154.237]) by resqmta-po-05v.sys.comcast.net with SMTP id X3BEb2WUKcEL1X3BMbmK0Q; Tue, 09 Aug 2016 09:18:45 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by comcast with SMTP id X3BGb62tKRzCKX3BHbO3WX; Tue, 09 Aug 2016 09:18:44 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Tue, 9 Aug 2016 02:03:53 -0700 From: Alex Bobotek To: "Peterson, Jon" , "Gorman, Pierce A [CTO]" , Paul Kyzivat , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Date: Tue, 9 Aug 2016 02:03:53 -0700 Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AdHtnZL44XSdzpn5S4ezxStpcxWG/gA3LKKAAAWRJoAAAX9oAAACCpWAAABpDgAAAKK4AAAAWieAAAPgt4AAALpEgAAAy/8AAAA1f4AAAEbIAAAAZjkAAABSQQAAFBF5gAAOVnSAAAG+lwAAAytegAAAOkMAAAHCnQAAjmtqgAAD/5AAAADbMoAAAc19AAADVf2A//+dhAD//vySsA== Message-ID: <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CMAE-Envelope: MS4wfPr699VNfZATo23wqq2C9gRH5THgUrgZyhdbTn4cE8MzJM43PaVBsYPipFESfRGWpz7LLkPQLsBnHCZKjl6ga1BP5UzaB6F0XkQ09WWam+vK+gvG0kqT pl+Jx3EEDtSHxUR9dN6PhEqZqb0j2RXiZsRIz54oxK0Hq3WmpF+yJcx2DTJPe6eVzitmbKQ9a7C2V37fpqOb230ragFZOPfxxxrWbhXDiYDzbSkzOzHWejuH NPZWFZKkSjCcmfSkjPSxfnDs6xaS7bcLDXqvRuUTeM2k6PZ8G+YSV88bWweCw9VLUoFuMpsDz8LJaMUxtO+wzkthUqGCnAFRoLSZKKfHwPv8pTzv7L6EMccQ k8+HQBMXYrbHmXOZHmnjSEQRXXM2xDaw9zYbrEgZTmNDiYM28hEqEKexWG+mmQIcGL18onZbExxSvZbmpMr+t3w/ibCEeQ== Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 09:18:50 -0000 Jon, Thanks much for your thoughtful response to the original points. Yes, thin= gs got somewhat sidetracked. On the first point (signing without authentication), I do not read 6.1 as p= ermitting "I'm signing to assert that I've authorized use of this phone num= ber without authenticating the caller and/or completing a number delegation= authority check", a use case that reflects the currently-widespread practi= ce of authorization without authentication. My read of section 6.1 is that= it allows anonymity rather than signer-attribution with unauthenticated (n= on-anonymous) caller identity. Knowing the triple of purported calling pho= ne number that flashes on a recipient's phone, the terminating phone number= and a timestamp is important in reporting/tracing/mitigating abusive calls= . [On a side note, I reread Section 11, but had trouble with the definitio= n of "private URI" (note: "private URI" and "private SIP URI" each occur e= xactly once each in the doc and could benefit from a definition or two).] = Additionally, Brian Rosen's comment on 8/4 seems to corroborate my reading= of a ban on authorization without authentication in the non-anonymous case= (i.e., that using someone else's phone number requires that "the entity th= at is assigned the TN explicitly authorizes calls placed using it's TN"). In summary, there is a high value in allowing signing/authorization in the = categories and use cases Pierce outlined. In my operational experience, it= really helps to know which company to contact to get the callers kicked of= f a network. And signer attribution even without caller authentication is = a huge win for the public. On the second point, thanks for pointing out that 12.1 requires servers to = keep the state of recently received requests. This is a point that I misse= d in my reading of the draft, and this feature as you have described it def= eats most conceivable replay attacks. My bad for missing this, but as you = suggest, there may be some potential for emphasizing this point. But there= 's another part of the issue -- cross method replay. For example, it may b= e difficult to expect a messaging node (which handles SIP MESSAGE) and a vo= ice-capable IMS node (handling SIP INVITE) to coordinate their anti-replay = caches, allowing an attacker that observes a SIP invite for a voice call to= piggyback a spam text message. As it's common to use the same "To" addres= s for multiple services that may be served by very different infrastructure= components, it would be beneficial to allow signatures to cover more than = "To", "From/PAI" and "Timestamp". I do not see this issue as meriting sig= nificant delay of a STIR RFC if there's no quick fix. Regards, Alex > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon > Sent: Monday, August 8, 2016 12:46 PM > To: Gorman, Pierce A [CTO] ; Paul Kyzivat > ; Dwight, Timothy M (Tim) > ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; > Richard Shockey ; stir@ietf.org; Brian Rosen > > Subject: Re: [stir] STIR 4474bis-10 comments > > > Just so I'm clear, I'm not hearing an ask here in terms of changing the t= ext of > rfc4474bis-10, which does allow signing PAI instead of From for precisely= the > reasons outlined in this lengthy thread. To Alex's original point about > providing authorization without authentication, rfc4474bis has a lot of t= ext > about signing non-TN identifiers, including for preserving anonymity; see= the > end of section 6.1, and then the Privacy Considerations in section 11 for > more. Those should suffice to provide this property: it will identify the > service provider who signed without attesting an specific user identity. > > I also wanted to make sure we didn't drop the other ball that Alex mentio= ned > at the start of this thread, which is the issue of proximate replay withi= n the 60 > second Date window. This is addressed in Section 12.1 of rfc4474bis-10, w= hich > reads: "Note that per baseline [RFC3261] behavior, servers keep state of > recently received requests, and thus if an Identity header is replayed by= an > attacker within the Date interval, verifiers can detect that it is spoofe= d > because a message with an identical Date from the same source had recentl= y > been received." This refers to the text of > RFC3261 section 23.4.2, though more properly the Date-related behavior is > better detailed in RFC3893 Section 10, which introduced the first version= of > the partial signature mechanism that ultimately inspired RFC4474. I'll up= date > the text here so it is clearer about exactly how to detect proximate repl= ay. > > Jon Peterson > Neustar, Inc. > > On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" > wrote: > > >Paul, > > > >As you know, SIP inter-working is often challenging because of > >variability in implementation including proprietary headers (without an > >X-) and support or lack thereof for non-mandatory (per RFC 3261) > >headers such as P-Asserted-Identity, (and things like B2BUA stacks > >stripping things like display name in From but that's another story). > >I could argue that from a cleanliness of protocol implementation, (and > >if I wanted to be pedantic), I would strip PAI outbound unless required > >otherwise. But the point is moot. As I mentioned in the earlier > >e-mail, that is not our practice and I'm not requesting it to be so. > > > >Pierce > > > > > >-----Original Message----- > >From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > >Sent: August 08, 2016 12:03 PM > >To: Gorman, Pierce A [CTO] ; Dwight, > Timothy > >M > >(Tim) ; DOLLY, MARTIN C > > >Cc: Rosbotham, Paul, Vodafone UK ; > Richard > >Shockey ; stir@ietf.org; Brian Rosen > > > >Subject: Re: [stir] STIR 4474bis-10 comments > > > >On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: > >> Thanks for the added comments Tim. > >> > >> I agree that passing P-Asserted-Identity between trusted networks is > >> appropriate (and the converse is true as well). Part of my issue is > >> I have been conditioned from the very earliest implementation of > >> Sprint's VoIP network that other carriers' IP networks are inherently > >> untrusted. I've been browsing TS 29.165 and even there I find > >> language that implies trust is established by agreement, not by > >> standard. (Even roaming implies agreement.) > > > >I understand why *some* stuff needs to be removed when forwarding to > an > >untrusted party. For instance, if the call has requested privacy, then > >P-A-ID needs to be removed. > > > >But when privacy is not a concern, trust is really more of a concern on > >the ingress side, not egress. If I don't trust you then I won't trust a > >P-A-ID you sent to me, and so *I* will remove it. But if I trust you, > >but you don't trust me, then what is the downside for passing along the > >P-A-ID? > > > > Thanks, > > Paul > > > >> Regardless, this discussion has been helpful and educational (to me > >>at least). And, I confirmed with my operations counterpart we > >>generally send PAI today. I've also made note that where standards and > ICA > >>require it, we will include PAI. Thanks again. > >> > >> Best regards, > >> > >> Pierce > >> > >> -----Original Message----- > >> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] > >> Sent: August 08, 2016 10:47 AM > >> To: Gorman, Pierce A [CTO] ; DOLLY, > MARTIN > >> C > >> Cc: Rosbotham, Paul, Vodafone UK ; > >> Richard Shockey ; Paul Kyzivat > >> ; stir@ietf.org; Brian Rosen > >> > >> Subject: RE: [stir] STIR 4474bis-10 comments > >> > >> Pierce, > >> > >> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and > GSMA > >>IR.95. The latter references and profiles the former. Section 4.4.1 > >>of > >>IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be > >>considered trusted, and table 3 in that section recommends that > >>P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. It > >>also states that PAI is mandatory at a roaming NNI. > >> > >> Tim > >> > >> > >> -----Original Message----- > >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce > >> A [CTO] > >> Sent: Monday, August 08, 2016 8:52 AM > >> To: DOLLY, MARTIN C > >> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; > >> stir@ietf.org; Brian Rosen > >> Subject: [E] Re: [stir] STIR 4474bis-10 comments > >> > >> Martin, > >> > >> You referenced TS 29.195. I'm not familiar with that spec. Has it > >>been deprecated? It's not showing up on the 3GPP site. > >> > >> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the > >>originating side" Note 4 it states, " It is assumed that the IBCF is > >>responsible for stripping the P-Asserted-Identity from the SIP header > >>when interworking with untrusted networks." > >> > >> Your remark is consistent with Note 4, but only if we agree that, for > >>instance, the AT&T network and the Sprint network are "trusted > >>networks". In reality, this is not the case or there would be no > >>firewalls or Session Border Controllers used for interworking and > >>security. My opinion is the only carrier networks that are trusted > >>are the SS7 network, and the Internet backbone. > >> > >> What it really comes down to is that PAI is left in signaling either > >>through formal specification as a part of an inter-carrier > >>inter-connection agreement, or by custom (or even by accident). I > >>think this illustrates Paul Rosbotham's observation is true. > >> > >> Pierce > >> > >> -----Original Message----- > >> From: DOLLY, MARTIN C [mailto:md3135@att.com] > >> Sent: August 05, 2016 12:55 PM > >> To: Gorman, Pierce A [CTO] > >> Cc: Rosbotham, Paul, Vodafone UK ; > Brian > >> Rosen ; stir@ietf.org; Paul Kyzivat > >> ; Richard Shockey > >> Subject: Re: [stir] STIR 4474bis-10 comments > >> > >> PAI is not stripped at the network boundary between trusted networks > >> 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force ITU And the > >> list goes on > >> > >> Martin C Dolly > >> Lead Member of Technical Staff > >> Core & Government/Regulatory Standards AT&T > >> Cell: 609-903-3360 > >> Email: md3135@att.com > >> > >>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] > >>> wrote: > >>> > >>> Which header the carrier chooses to display is moot if the header is > >>>stripped between carriers as per at least one standard. I think Paul > >>>Rosbotham's observation we're likely to encounter "some interesting > >>>interworking challenges" was perhaps the understatement of the year. > >>> > >>> Pierce > >>> > >>> -----Original Message----- > >>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > >>> Sent: August 05, 2016 11:58 AM > >>> To: Gorman, Pierce A [CTO] ; Richard > >>> Shockey ; Rosbotham, Paul, Vodafone UK > >>> ; Brian Rosen > >>> Cc: stir@ietf.org > >>> Subject: Re: [stir] STIR 4474bis-10 comments > >>> > >>> If PAI is present and signed, and From is also signed, I would > >>>expect it to be up to the UA to decide what to display, not the carrie= r. > >>> > >>> Of course this will work differently if there is a different > >>>signaling regime between the carrier and the user device (e.g. black > phone). > >>> > >>> Thanks, > >>> Paul > >>> > >>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > >>>> P-Asserted-Identity is supposed to operate "among trusted SIP > >>>>entities" and therefore some specifications (e.g., 3GPP TS 24.607) > >>>>assume P-Asserted-Identity is stripped by border controller > >>>>functions and is not to be used in inter-carrier inter-connection > >>>>(although it commonly shows up anyway). My opinion is the "From" > >>>>header is likely used more often for presentation. > >>>> > >>>> Pierce > >>>> > >>>> > >>>> -----Original Message----- > >>>> From: Richard Shockey [mailto:richard@shockey.us] > >>>> Sent: August 05, 2016 9:37 AM > >>>> To: Rosbotham, Paul, Vodafone UK > ; > >>>> Paul Kyzivat ; Brian Rosen > >>>> > >>>> Cc: stir@ietf.org > >>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>> > >>>> > >>>> Humm this is getting interesting. Its my understanding that the > >>>>display number aka "presentation number" in the US context is the > >>>>one carried in the PAI. Martin, Pierce? > >>>> > >>>> > >>>> > >>>> > >>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" > >>>> > wrote: > >>>> > >>>> Jumping in now that we're on European working time, +1 on Paul's > >>>>observation. > >>>> > >>>> Here in the UK, we've got 2 numbers carried as calling line > >>>>IDs....one (we term the Network Number, carried in PAID) uniquely > >>>>identifies the line, the other (we term Presentation Number, carried > >>>>in From) is used for display purposes. > >>>> > >>>> Only the carrier has the authority to set the Network Number so > >>>>only they could sign it. > >>>> > >>>> But - subject to regulatory restrictions which are well > >>>>documented > >>>>- the number sent for display purposes belongs to the customer. For > >>>>blue-chip customers, I can allow them to send their Presentation > >>>>Numbers into the network, and can't readily check at a network level > >>>>that they're theirs (I do have contractual safeguards). The number > >>>>may have been allocated by me, or could be allocated by a third > >>>>party provider. If it's a call-centre they'll be making outbound > >>>>calls for lots of different customers which will change on day-by-day > basis. > >>>>This is business as usual. I don't like the term "authorised > >>>>spoofing" because it implies that the CLI is in some way being rigged= : > >>>>it's not, it's the corporate customer or their subcontractor using > >>>>the number that's been assigned (so in internet terms delegated) to > >>>>them via a chain of trust from the regulator. > >>>> > >>>> What I want is the ability for customers to use their > >>>>credentials to sign the CLIs they send me so that at the > >>>>terminating end it can be checked (or indeed somewhere en-route if > >>>>that's the business model). > >>>> I can and would sign for customers on my mobile business since I'm > >>>>driving what number is presented, but that's by-the-by because they > >>>>aren't the ones who generate millions of nuisance calls. If the > >>>>signing only occurs at the originating carrier level for > >>>>corporate/call-centre customers that's no use because I'm not in a > >>>>position to do that for these type of customers...and the whole > >>>>system becomes a waste of time. I'd also highlight there are many > >>>>more of my large customers that I'd trust more than a far end > >>>>originating carrier that could be anywhere in the world (though we > >>>>have no shortage of small carriers that I wouldn't know from Adam > >>>>more locally in the > >>>> UK....) > >>>> > >>>> Regards > >>>> > >>>> Paul > >>>> > >>>> -----Original Message----- > >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyziv= at > >>>> Sent: 04 August 2016 23:12 > >>>> To: Brian Rosen > >>>> Cc: stir@ietf.org > >>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>> > >>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: > >>>>> I think it's not a delegation. The mobile phone is not being > >>>>>delegated the TN, it's being authorized to place calls that are not > >>>>>from that TN, but appear to be. > >>>>> > >>>>> The mechanism to handle the credential is exactly the same as a > >>>>>delegation, so if you want to call it delegation, go ahead, but I > >>>>>prefer to call it authorized spoofing. > >>>> > >>>> IIUC the delegation is to a responsible entity (something that > >>>>can be held legally accountable - e.g. a person), not to a device. > >>>>The entity can then "use" the credential via any device(s) it > >>>>chooses. In the case of the mobile, the device then becomes a two-lin= e > phone. > >>>> > >>>> Thanks, > >>>> Paul > >>>> > >>>>> Brian > >>>>> > >>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat > >>>>>>wrote: > >>>>>> > >>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: > >>>>>>> In my jargon an "authorized spoofer" is the doctor who is > >>>>>>>calling from his mobile, but sending the TN of his office phone > >>>>>>>as calling party. > >>>>>>> The delegation to his office phone was made by his landline > >>>>>>>carrier to him. He then creates another credential, which he > >>>>>>>signs with his office phone credential that authorizes his mobile > >>>>>>>to send calls from his office number. He is spoofing (because > >>>>>>>the call is coming from his mobile's TN but claims to be from his > >>>>>>>office), but it's authorized spoofing. The doc could give the > >>>>>>>credential to his mobile SP if they sign on his behalf. > >>>>>> > >>>>>> I don't understand how that is different from regular delegation. > >>>>>> > >>>>>> When his landline carrier gave him a delegated certificate for > >>>>>>his landline number, he should be able to install that in whatever > >>>>>>devices he wants - his landline UA, his mobile phone, etc. It is > >>>>>>still delegated from his landline carrier, even when used with > >>>>>>calls via his mobile carrier. > >>>>>> > >>>>>> Thanks, > >>>>>> Paul > >>>>>> > >>>>>>> Some folks don't like attaching the "spoofing" label to a > >>>>>>>legitimate use. > >>>>>>> > >>>>>>> But that's how I describe it. > >>>>>>> > >>>>>>> Brian > >>>>>>> > >>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>> > wrote: > >>>>>>>> > >>>>>>>> +1, but with one question below: > >>>>>>>> > >>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > >>>>>>>>> I think all we need is to have credentials follow the > >>>>>>>>> delegation path, > >>>>>>>> > >>>>>>>>> plus the option to add another level (not delegation) for > >>>>>>>>> authorized spoofers. > >>>>>>>> > >>>>>>>> I don't understand "authorized spoofers" in this context, as > >>>>>>>> contrasted to "spoofers" who have been delegated their > authority. > >>>>>>>> > >>>>>>>> Thanks, > >>>>>>>> Paul > >>>>>>>> > >>>>>>>>> I don't think it matters who the delegator or delegatee are as > >>>>>>>>>long as the delegator is willing to take the heat for > >>>>>>>>>delegating to someone who sends a lot of bad calls. They can > >>>>>>>>>pass the buck ("I delegated the TN to him, and now I'm not > >>>>>>>>>responsible"), but only if the SP knows who they delegated to, > >>>>>>>>>so authorities can follow the delegation path. There are > >>>>>>>>>plenty of certificated carriers who are willing to not care who > >>>>>>>>>they delegate to. The fact that there are some who do doesn't > >>>>>>>>>change much. > >>>>>>>>> Making stir work means knowing who you are delegating to, so > >>>>>>>>>that you can pass the hot potato. > >>>>>>>>> > >>>>>>>>> It's perfectly reasonable for a carrier to be able to sign for > >>>>>>>>>any calls placed on its network on any number it has been > >>>>>>>>>delegated. > >>>>>>>>> If it does, it's asserting that the calls are from who they > >>>>>>>>>are supposed to be from. > >>>>>>>>> That should be straightforward, but we know it's not always, > >>>>>>>>>and that represents the hard part of deployment in my opinion. > >>>>>>>>> But once they delegate, they can hand responsibility to sign > >>>>>>>>>to the delegatee. But, that only works if they know who they > >>>>>>>>>are delegating to. > >>>>>>>>> > >>>>>>>>> The root of the whole model is that there is a formal or > >>>>>>>>>informal delegation path for telephone numbers in every > >>>>>>>>>country, and we can build a chain of trust from that delegation > >>>>>>>>>path. If you propose to alter that model, then we get into > >>>>>>>>> (policy) issues of which carriers/entities we trust and which > >>>>>>>>>we don't. > >>>>>>>>> Our model is that you know who you delegate to, and once you > >>>>>>>>>do that delegation, it's their problem. > >>>>>>>>> That's pretty appealing I think, even if it's a change in some > >>>>>>>>>business practices. > >>>>>>>>> > >>>>>>>>> The mechanism is chaining credentials in a form of a PKI and > >>>>>>>>> having a way to know which TNs are covered by a credential. > >>>>>>>>> That's what we have, and I'm loath to change it. > >>>>>>>>> > >>>>>>>>> Brian > >>>>>>>>> > >>>>>>>>> > >>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > >>>>>>>>>> > >>>>>>>>>> > > >>>>>>>>>> wrote: > >>>>>>>>>> > >>>>>>>>>> OK, you talked me into indulging in one more message on > >>>>>>>>>> policy and use cases. > >>>>>>>>>> > >>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed > >>>>>>>>>>on individual devices as well as multi-device and > >>>>>>>>>>multi-number platforms. > >>>>>>>>>> > >>>>>>>>>> Number delegation (and sub-delegation), and business > >>>>>>>>>> relationships are two additional factors which affect > >>>>>>>>>> trustworthiness of a given calling number authentication. > >>>>>>>>>> > >>>>>>>>>> Inherent variable trustworthiness of a calling number was my > >>>>>>>>>> reason for suggesting a way to qualify the signature to > >>>>>>>>>> reflect that variability. > >>>>>>>>>> > >>>>>>>>>> Originating carriers are in a position to know if a call is > >>>>>>>>>>coming from a device assigned a single number, or from "trunk > >>>>>>>>>>group" which could originate calls using multiple numbers, and > >>>>>>>>>>can qualify to some degree the trustworthiness of number > >>>>>>>>>>authenticity accordingly. > >>>>>>>>>> > >>>>>>>>>> My suggestion was qualifying calling number authenticity into > >>>>>>>>>>categories of carrier-signed (or not), and unauthenticated, > >>>>>>>>>>semi-authenticated, and most-authenticated. There can be > more > >>>>>>>>>>granularity, but it implies additional operational complexity > >>>>>>>>>>(both for the carriers and the consumers) and I assume > >>>>>>>>>>diminishes value. > >>>>>>>>>> > >>>>>>>>>> My reason for adding the authenticity of the originating > >>>>>>>>>>carrier is typical trustworthiness of a carrier business > >>>>>>>>>>relationship with typical consumers adds to the > >>>>>>>>>>trustworthiness assessment and partially because carriers are > >>>>>>>>>>a regulated point of forensic inquiry for CALEA and fraud. > >>>>>>>>>> Additionally, most calls originate and terminate between > >>>>>>>>>>mobile consumers where their carriers are able to usefully > >>>>>>>>>>authenticate their device and have a high degree of confidence > >>>>>>>>>>of the authenticity of the calling number. > >>>>>>>>>> > >>>>>>>>>> I think billions of per-TN certs of varying usability > >>>>>>>>>> (revoked, not > >>>>>>>>>> revoked) for authenticating calling number will not work well. > >>>>>>>>>> > >>>>>>>>>> Conversely, I think billions of per-TN certs will work well, > >>>>>>>>>>if the calling party has to sign a call with a per-TN cert > >>>>>>>>>>provided by the called party. No called party cert to include? > >>>>>>>>>> Then the calling party does not have a trusted relationship > >>>>>>>>>>with the called party, and the call can be authorized/treated > >>>>>>>>>>accordingly. > >>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) > >>>>>>>>>> > >>>>>>>>>> Pierce > >>>>>>>>>> > >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>> *Sent:* August 04, 2016 2:03 PM > >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>> > >>>>>>>>>> > > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>> >; > >>>>>>>>>> stir@ietf.org > >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>> > >>>>>>>>>> Well, the mechanisms are designed so that they could be > >>>>>>>>>>deployed on devices and PBXs. Whether they will be is a > >>>>>>>>>>policy issue. > >>>>>>>>>> > >>>>>>>>>> The notion of credentials that are traceable to a delegation > >>>>>>>>>>of a TN is a mechanism that is part of the design of stir, and > >>>>>>>>>>the design allows delegation of one TN (to one device, > >>>>>>>>>>although a device like a PBX would have more than one TN per > >>>>>>>>>>"device", and something like a dual NAM phone could have > more > >>>>>>>>>>than one credential. For the use case we've discussed, a > >>>>>>>>>>mobile phone may also have a credential for, say, a TN that is > >>>>>>>>>>delegated to a landline, to cover the example case of a doctor > >>>>>>>>>>placing a call on his mobile, but getting his office number to > >>>>>>>>>>show up as the calling party. Use of such mechanisms is policy= . > >>>>>>>>>> > >>>>>>>>>> Brian > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > >>>>>>>>>> > >>>>>>>>>> > > >>>>>>>>>> wrote: > >>>>>>>>>> > >>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy > >>>>>>>>>> discussion. Regardless, I do appreciate your explanation. I > >>>>>>>>>> would like to continue the discussion, but I'm pretty sure > >>>>>>>>>> this isn't the right forum. > >>>>>>>>>> > >>>>>>>>>> Pierce > >>>>>>>>>> > >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>> *Sent:* August 04, 2016 1:34 PM > >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>> > >>>>>>>>>> > > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>> >; > >>>>>>>>>> stir@ietf.org > >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>> > >>>>>>>>>> Of course I want PBXs to sign calls. As well as smart > >>>>>>>>>> phones and any other devices that can be programmed to do > so. > >>>>>>>>>> They will be given credentials that only are valid for the > >>>>>>>>>> TNs they are authorized to sign for. They can try to sign > >>>>>>>>>> any call, but the validity of the credential would make such > >>>>>>>>>> a signature fail the checking. > >>>>>>>>>> > >>>>>>>>>> Getting service providers to sign on behalf of devices is a > >>>>>>>>>>reasonable way to deploy quickly, but I expect many SPs will > >>>>>>>>>>want to get out of the liability of signing on behalf of > >>>>>>>>>>their customers. If they can push of that responsibility to > >>>>>>>>>>their customer, only being responsible for getting the > >>>>>>>>>>customer an appropriate credential when they assign TNs, then > >>>>>>>>>>I would expect them to want to do so. That means the devices > >>>>>>>>>>have to be able to sign, but I understand many of the PBX > >>>>>>>>>>vendors think that's something they could provide in a future > >>>>>>>>>>release. > >>>>>>>>>> > >>>>>>>>>> Brian > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > >>>>>>>>>> >>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> wrote: > >>>>>>>>>> > >>>>>>>>>> You want IP PBXes to sign calls? Won't that make it > >>>>>>>>>> extraordinarily easy to commit fraud with authenticated > >>>>>>>>>>numbers? > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>> *Sent:* August 04, 2016 12:24 PM > >>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>> > >>>>>>>>>> > > >>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>> > >>>>>>>>>> >; stir@ietf.org > >>>>>>>>>> > >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>> > >>>>>>>>>> First of all, we would want the PBX to generate the > >>>>>>>>>>signature, > >>>>>>>>>> but the service provider can do that. It should not add = a > >>>>>>>>>> valid signature to a call from a number it did not > >>>>>>>>>>assign to > >>>>>>>>>> the trunk group connecting to the PBX, although it could > >>>>>>>>>> support the extra delegation required to support > >>>>>>>>>>"authorized > >>>>>>>>>> spoofing". The companion devices I'm aware of always sen= d > >>>>>>>>>> calls from the same service provider and should not prese= nt > >>>>>>>>>> any issue. > >>>>>>>>>> > >>>>>>>>>> Everyone will have to do work they don't do now to > >>>>>>>>>>implement > >>>>>>>>>> stop spoofed calls. TANSTAAFL > >>>>>>>>>> > >>>>>>>>>> Brian > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] > >>>>>>>>>> >>>>>>>>>> > >>>>>>>>>> > wrote: > >>>>>>>>>> > >>>>>>>>>> Fraud from compromised PBXes is common. And even > >>>>>>>>>>where a > >>>>>>>>>> PBX is not compromised, a carrier has no practical > >>>>>>>>>>way of > >>>>>>>>>> knowing whether the calling number is properly assign= ed > >>>>>>>>>> and valid from the perspective of the Enterprise. > >>>>>>>>>> Therefore, checking whether the calling number was > >>>>>>>>>>from an > >>>>>>>>>> assigned range might be possible (and fraught with > >>>>>>>>>> administrative challenges), but of limited value. > >>>>>>>>>>And in > >>>>>>>>>> the consumer market, there are calling products which > >>>>>>>>>> support a parent subscriber number and "companion" > >>>>>>>>>>devices > >>>>>>>>>> (e.g., tablets) which can place a call using the MDN = of > >>>>>>>>>> the parent subscriber. These are examples of where t= he > >>>>>>>>>> authenticity of the calling number won't necessarily > >>>>>>>>>>mean > >>>>>>>>>> the same thing as the authenticity of a call from a > >>>>>>>>>>single > >>>>>>>>>> subscriber with a single MDN regardless of "laxity" o= f > >>>>>>>>>> spoof checking. > >>>>>>>>>> > >>>>>>>>>> In another forum and anticipating calling number > >>>>>>>>>> authentication mandates from Congress and/or FCC, I > >>>>>>>>>> suggested using carrier-specific certs and encoding > >>>>>>>>>> specificity of authenticity, and calling number. Thi= s > >>>>>>>>>> provides the identity of the originating carrier, som= e > >>>>>>>>>> idea as to the accuracy or specificity of the calling > >>>>>>>>>> number, and validty of the calling number (assuming > >>>>>>>>>>nonce > >>>>>>>>>> and replay issues can be addressed as reasonably > >>>>>>>>>>suggested > >>>>>>>>>> below by Alex). > >>>>>>>>>> > >>>>>>>>>> The representation of orig-carrier and trustworthines= s > >>>>>>>>>> could be as follows: > >>>>>>>>>> > >>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* > >>>>>>>>>> > >>>>>>>>>> *00 - No Credentials* > >>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched > >>>>>>>>>> networks that don't natively support SIP or which don= 't > >>>>>>>>>> choose to sign calls. E.g., international carriers. > >>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN > >>>>>>>>>> entirely untrustworthy. > >>>>>>>>>> > >>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* > >>>>>>>>>> Use case example(s): E911 on visited network w/o > >>>>>>>>>>roaming > >>>>>>>>>> agreement, manual roaming. > >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN > >>>>>>>>>>entirely > >>>>>>>>>> untrustworthy > >>>>>>>>>> > >>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* > >>>>>>>>>> Use case example(s): Number block delegated from > >>>>>>>>>>OCN, but > >>>>>>>>>> no per-TN screen (SIP trunks). > >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less > >>>>>>>>>>than > >>>>>>>>>> most trustworthy but not entirely untrustworthy. > >>>>>>>>>> > >>>>>>>>>> *11 - Carrier signed, authenticated CgPN* > >>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls > >>>>>>>>>>from > >>>>>>>>>> subscriber lines (IMS-based and otherwise). > >>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most > >>>>>>>>>> trustworthy > >>>>>>>>>> > >>>>>>>>>> *Public Use Case:* > >>>>>>>>>> > >>>>>>>>>> Undefined but assumed to use public or commercially > >>>>>>>>>> available authentication services resources. e.g., > >>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et > >>>>>>>>>>cetera. > >>>>>>>>>> Could/would pass credentials down to SIP-aware device= s > >>>>>>>>>> which would process them according to the rules of th= e > >>>>>>>>>> Public Class application(s). > >>>>>>>>>> > >>>>>>>>>> Pierce > >>>>>>>>>> > >>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>> *Sent:* August 04, 2016 9:02 AM > >>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>> > >>>>>>>>>> > > >>>>>>>>>> *Cc:* stir@ietf.org > >>>>>>>>>> > >>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>> > >>>>>>>>>> There are reasonable circumstances where a party > >>>>>>>>>>placing a > >>>>>>>>>> call is not the authorized entity assigned the > >>>>>>>>>>telephone > >>>>>>>>>> number used in From/PAI, and in such circumstances th= e > >>>>>>>>>> service provider servicing the entity placing the > >>>>>>>>>>call may > >>>>>>>>>> or may not be the same as the service provider > >>>>>>>>>>serving the > >>>>>>>>>> entity that is assigned the TN. In all such cases, t= he > >>>>>>>>>> entity that is assigned the TN explicitly authorizes > >>>>>>>>>>calls > >>>>>>>>>> placed using it's TN. The design accommodates such u= se > >>>>>>>>>> cases. It's not a blanket authorization without > >>>>>>>>>> authentication. We're not aware of any cases where > >>>>>>>>>>there > >>>>>>>>>> is an actual requirement for legitimate calling witho= ut > >>>>>>>>>> explicit authorization from the assigned entity, > >>>>>>>>>>although > >>>>>>>>>> we certainly are aware that various parts of various > >>>>>>>>>> service providers don't bother to check. At this > >>>>>>>>>>point, at > >>>>>>>>>> least in some countries, there is a realization that > >>>>>>>>>>the > >>>>>>>>>> laxity of allowing unchecked spoofing is not acceptab= le > >>>>>>>>>> any more. > >>>>>>>>>> > >>>>>>>>>> Brian > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > >>>>>>>>>> > >>>>>>>>>> > wrote: > >>>>>>>>>> > >>>>>>>>>> 1. Permit authorization without > >>>>>>>>>>authentication > >>>>>>>>>> In the current telephony network practice, some > >>>>>>>>>> service provider implementations choose not to > >>>>>>>>>> authenticate identity, but simply facilitate the > >>>>>>>>>>use > >>>>>>>>>> of an arbitrary or selected user-provided identit= y. > >>>>>>>>>> Are there legitimate use cases for this? Has > >>>>>>>>>>anyone > >>>>>>>>>> established that there are not? How can the > >>>>>>>>>>industry > >>>>>>>>>> reasonably expect to end this (often bad) practic= e? > >>>>>>>>>> If it can't be ended, there's value in at least > >>>>>>>>>> identifying the originating service provider > >>>>>>>>>> (i.e., the signer/authorizer). Given the > >>>>>>>>>>prevalence > >>>>>>>>>> of abuse using telephone numbers assigned to a > >>>>>>>>>> sometimes-anonymous abuser, it becomes critically > >>>>>>>>>> important to identify the service provider(s) > >>>>>>>>>>closest > >>>>>>>>>> to the abuser. Based on the assumption that it's > >>>>>>>>>> better to ID service providers than unreasonably > >>>>>>>>>> expect a ban of the use of unauthenticated (and > >>>>>>>>>> therefore unsigned) SIP requests, STIR signing > >>>>>>>>>>should > >>>>>>>>>> support authorization without authentication. Th= e > >>>>>>>>>> practice of authorizing unauthenticated use exist= s, > >>>>>>>>>> and there is benefit to signing in these cases > >>>>>>>>>> (service provider identification). The language = of > >>>>>>>>>> the ID should permit this use. 4474bis-10 > >>>>>>>>>>should NOT > >>>>>>>>>> require or assume that that authentication will > >>>>>>>>>> precede authorization. Of course there may be oth= er > >>>>>>>>>> use cases where signing includes authentication a= nd > >>>>>>>>>> may not include a specific service provider's > >>>>>>>>>> authorization. > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> 2. Improve replay prevention > >>>>>>>>>> Proximate replay is possible while complying > >>>>>>>>>>with this > >>>>>>>>>> spec. First, one or more proximate (e.g., > >>>>>>>>>>within > >>>>>>>>>>60 > >>>>>>>>>> seconds) SIP requests using the same token are > >>>>>>>>>>legal > >>>>>>>>>> and subject to replay in many cases. An SDP body= 's > >>>>>>>>>> mky may not be present and if present its use is > >>>>>>>>>> optional. Some sort of mandatory new or existing > >>>>>>>>>> signed sequence, random # or request ID (e.g., > >>>>>>>>>>Call-ID > >>>>>>>>>> or CSeq) and a 1-time use policy on the > >>>>>>>>>>receiving end > >>>>>>>>>> of the request (e.g., tokens only good for 1 > >>>>>>>>>> use) could prevent replay. Different methods > >>>>>>>>>>(e.g., > >>>>>>>>>> INVITE vs MESSAGE) might be handled by different > >>>>>>>>>> receiving infrastructure, and therefore > >>>>>>>>>>difficulties > >>>>>>>>>> with 'it's been used already' coordination allow = a > >>>>>>>>>> faked MESSAGE based on a captured request. This > >>>>>>>>>>might > >>>>>>>>>> include an mkey from a captured INVITE. So it > >>>>>>>>>>may be > >>>>>>>>>> possible to DOS, spam or text-bomb a recipient > >>>>>>>>>>using a > >>>>>>>>>> captured identity. While large-scale or > >>>>>>>>>>distributed > >>>>>>>>>> implementations may make the enforcement difficul= t, > >>>>>>>>>> there is little cost to signing and decoding a > >>>>>>>>>>method > >>>>>>>>>> and possibly a numeric ID. Some sort of '1-use' > >>>>>>>>>> practice should at least be discussed while perha= ps > >>>>>>>>>> not required. > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> Specific markup suggestions: > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> NITS > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> The verifier MUST inspect any optional "ppt" > >>>>>>>>>> parameter appearing *in*the > >>>>>>>>>> > >>>>>>>>>> Identity request. If no "ppt" parameter is > >>>>>>>>>> present, then the > >>>>>>>>>> > >>>>>>>>>> verifier proceeds normally below. If a "ppt" > >>>>>>>>>> parameter value is > >>>>>>>>>> > >>>>>>>>>> present, and the verifier does not support > >>>>>>>>>> it, it MUST ignore the > >>>>>>>>>> > >>>>>>>>>> Identity header. If a supported "ppt" > >>>>>>>>>> parameter value is present, > >>>>>>>>>> > >>>>>>>>>> the verifier follows the procedures below, > >>>>>>>>>> including the variations > >>>>>>>>>> > >>>>>>>>>> described in Step 5. > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> 3 > >>>>>>>>>> > >>>>>>>>>> >>>>>>>>>>4bi > >>>>>>>>>>s-10%20- > %20Authenticated%20Identity%20Management%20in%20the%20 > >>>>>>>>>>Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section- > 3>. > >>>>>>>>>> Background > >>>>>>>>>> > >>>>>>>>>> [...] > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> Per [RFC7340 > >>>>>>>>>> ], problems such as > >>>>>>>>>> robocalling, voicemail hacking, and > >>>>>>>>>> > >>>>>>>>>> swatting are enabled by an attacker's ability > >>>>>>>>>> to impersonate someone > >>>>>>>>>> > >>>>>>>>>> else. The secure operation of most SIP > >>>>>>>>>> applications and services > >>>>>>>>>> > >>>>>>>>>> depends on authenticating and/or authorizing > >>>>>>>>>> the source of communications as it is > >>>>>>>>>> > >>>>>>>>>> represented in a SIP request. > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> This identity architecture for SIP depends on > >>>>>>>>>> includes provisions for a logical > >>>>>>>>>> > >>>>>>>>>> "authentication service" which validates > >>>>>>>>>> caller identity at or near origination. outgoing > >>>>>>>>>> requests. An > >>>>>>>>>> > >>>>>>>>>> authentication service may be implemented > >>>>>>>>>> either as part of a user > >>>>>>>>>> > >>>>>>>>>> agent or as a proxy server; typically, it is > >>>>>>>>>> a component of a network > >>>>>>>>>> > >>>>>>>>>> intermediary like a proxy to which > >>>>>>>>>> originating user agents send > >>>>>>>>>> > >>>>>>>>>> unsigned requests. Once the sender of the > >>>>>>>>>> message has been > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> This document specifies a means of sharing a > >>>>>>>>>> cryptographic assurance > >>>>>>>>>> > >>>>>>>>>> of authenticity of and/or authorization to > >>>>>>>>>> use end-user SIP identity in an interdomain or intradomain > context. > >>>>>>>>>> > >>>>>>>>>> It relies on the authentication service > >>>>>>>>>> constructing tokens based on [...] > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> To maximize end-to-end security, it is > >>>>>>>>>> typically obviously > >>>>>>>>>> > >>>>>>>>>> preferable for end-users to acquire their own > >>>>>>>>>> credentials; if they > >>>>>>>>>> > >>>>>>>>>> do, their user agents can act as > >>>>>>>>>> authentication services. However, > >>>>>>>>>> > >>>>>>>>>> for some deployments, [...] > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> Regards, > >>>>>>>>>> > >>>>>>>>>> Alex > >>>>>>>>>> * * > >>>>>>>>>> *Alex Bobotek* > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > _______________________________________________ > >>>>>>>>>> stir mailing list > >>>>>>>>>> stir@ietf.org > >>>>>>>>>> > >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> ------------------------------------------------------------- > >>>>>>>>>> - > >>>>>>>>>> - > >>>>>>>>>> -- > >>>>>>>>>> ------- > >>>>>>>>>> > >>>>>>>>>> This e-mail may contain Sprint proprietary informatio= n > >>>>>>>>>> intended for the sole use of the recipient(s). Any > >>>>>>>>>>use by > >>>>>>>>>> others is prohibited. If you are not the intended > >>>>>>>>>> recipient, please contact the sender and delete all > >>>>>>>>>>copies > >>>>>>>>>> of the message. > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> _______________________________________________ > >>>>>>>>> stir mailing list > >>>>>>>>> stir@ietf.org > >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>> > >>>>>>>> _______________________________________________ > >>>>>>>> stir mailing list > >>>>>>>> stir@ietf.org > >>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> ________________________________ > >>>> > >>>> This e-mail may contain Sprint proprietary information intended for > >>>>the sole use of the recipient(s). Any use by others is prohibited. > >>>>If you are not the intended recipient, please contact the sender and > >>>>delete all copies of the message. > >>> > >>> _______________________________________________ > >>> stir mailing list > >>> stir@ietf.org > >>> https://www.ietf.org/mailman/listinfo/stir > >> > >> > >> _______________________________________________ > >> stir mailing list > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir > >> > > > >_______________________________________________ > >stir mailing list > >stir@ietf.org > >https://www.ietf.org/mailman/listinfo/stir > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 9 06:52:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8ADEC12D806 for ; Tue, 9 Aug 2016 06:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zwMBeA84KbAY for ; Tue, 9 Aug 2016 06:52:21 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F183412D7FA for ; Tue, 9 Aug 2016 06:52:20 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u79DgnGP015053; Tue, 9 Aug 2016 09:52:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=8OrQ/6mAfqCAUazKAzR/BuhW7F8wY2GGlgyKMNMJ3r4=; b=OPsruhnA4SnUsI5PRr6+HyZP8Hg/XONdvNSjkVTTB29DiHKWwx3rZAtKpcq+mdqZQz8c X/GOKUidh6V7awSl7WgU78nQcwdLEEXTaoFb09ADK9XkiUw13FH9QNxe7BwqS9zsBBcO 13dyoE7SPbPVBos9sSmHngV8bwD76Ql0u6MMbeq/DcjNIUn52L64ZH9OdCURGY1lhD9r Ls0gd5O6kG1MRAYDMQYYHOK6oAIACkhZsy/M4Xie41QOmTw7exLOG31EO6J/31/PpVzq CR005FX7QxCM4pX/TETjDOKWxs37oaJ0LqmbJTdtHnMoxGgbfmLoiXVqZJDeIpoYJ8zU 0A== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24nc0q8e24-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 09 Aug 2016 09:52:17 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Tue, 9 Aug 2016 09:52:16 -0400 From: "Peterson, Jon" To: Alex Bobotek , "dcrocker@bbiw.net" , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBAhpWA///ttYA= Date: Tue, 9 Aug 2016 13:52:15 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> In-Reply-To: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090142 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 13:52:22 -0000 >I'm responding to Jon's fair question of how much support there is for >implementing the changes proposed by Dave. Well, I asked that about the changes he proposed to stir-passport, not to rfc4474bis - the latter hadn't been sent to the list when I posed the question. >In summary, I believe that the majority of comments, if accepted, would >substantially improve the doc. Also, I posed my question in connection with the set of issues that Dave had identified as substantial, non-blocking issues with PASSporT, rather than minor changes that might improve readability or clarify technical principles. I am not proposing to ignore those. In fact, if you go back to my initial response to Dave's review of stir-passport: https://www.ietf.org/mail-archive/web/stir/current/msg02478.html ... I say that many of Dave's suggestions for that document make a lot of sense to me, and I promise that Chris and I will go through and implement them where appropriate. I'm sure the same will be true for Dave's review of rfc4474bis. But as your point out in your note, other of these comments are not offered with a mind to improving the document or advancing the work of STIR. I've long since learned that the price of doing business in an open standards body is identifying the useful comments that are often buried in a heap of obstructionism or personal animus. That is what it is - like I said, sifting through material like this is part of the cost of doing Internet standards in an open fashion, and the alternative would lead to work of lesser quality. The question I posed about the stir-passport review concerned the more fundamental reconsiderations of the STIR architecture that Dave is proposing, and the support or lack thereof for that set of objections among working group participants. Since Dave refused to identify which of his issues were blocking, I could only allude to them indirectly. Jon Peterson Neustar, Inc. From nobody Tue Aug 9 07:05:54 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D225712D5D1 for ; Tue, 9 Aug 2016 07:05:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mvS6b-17sFCd for ; Tue, 9 Aug 2016 07:05:52 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55E4212D16F for ; Tue, 9 Aug 2016 07:05:52 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u79Dgwks026153; Tue, 9 Aug 2016 09:48:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=yqQLrmpZRSqx7OBgWc3SraFhfnYhGWrpdgLfgyOYw7o=; b=EB/gyA1VmpNum0PTaWUGJPMxmKsXv2aNRhV+nFWqZ50DS5JdthUdGFzF1ATEixLXWncm OAEA2SoQsFsFwgruM7qhD5l7gjxjkAB2aWWNrWazOFDQ3ukeDBL5xVkKIZbVsrFMTQDe ZNNzp1V7QGi5QPQM0v5fsEVQm2GAZDyJ5386Tfq4H8mDwM5t6AzPujsia3p1YHDmAQY8 3mosrmE4PdhaCWWVu46kQZjDbXw9TV8TgWjmmaqvLHc+9O9eQdtw0ESHz/Xixou9hJeN S907o/RQGCDAJGkyqSNbFkgvc3dZtG8s8VkLx2rD1a/XzNLrvukYWDDbtKSSPHJ8DX0P sw== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24napk0vku-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 09 Aug 2016 09:48:58 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Tue, 9 Aug 2016 09:48:57 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , Christer Holmberg Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR8brwrNk3cgxDsEaYkseWd4G+9KA/ZnIAgAB+ygD//4+QAIAAd9IA//+PqYCAAHZMgP//jMeAAA8FAgAAD4isgA== Date: Tue, 9 Aug 2016 13:48:56 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4771FF73@ESESSMB209.ericsson.se> <5fdf4ad3-1528-3d79-6bdb-b5eb350e5c2a@alum.mit.edu> <7594FB04B1934943A5C02806D1A2204B47723C55@ESESSMB209.ericsson.se> <503738d8-c166-dfc1-d153-338d56b844c1@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BBB1D69@ESESSMB208.ericsson.se> <51D45AE5-67D2-4120-BCA2-7BFC845E2126@neustar.biz> <01df1722-2cb0-d238-dcb4-df101a657820@dcrocker.net> <6688dd94-5c7e-4a9c-f873-69c4eb33f59a@bbiw.net> <5e418462-1670-75f8-6c68-6857ceff4a09@dcrocker.net> In-Reply-To: <5e418462-1670-75f8-6c68-6857ceff4a09@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <98A9F84E4977BE4AAC5DB98DAEF97AC4@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090142 Archived-At: Cc: "stir@ietf.org" , Paul Kyzivat Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 14:05:54 -0000 I responded to your PASSporT review here: https://www.ietf.org/mail-archive/web/stir/current/msg02478.html That was the response that I anyway believed the points in your review warranted: I addressed what I took to be your main concerns, while promising to incorporate some of your minor points in the next revision. Since then, we've been talking about what major changes should or shouldn't be made to the architecture as a result of your review. If you think there's something else that the process guarantees you from a response, or if my response doesn't address your major points, tell us what you want to talk about. Jon Peterson Neustar, Inc. On 8/8/16, 4:24 PM, "Dave Crocker" wrote: >On 8/8/2016 4:14 PM, Peterson, Jon wrote: >> In that case, if the list has heard your issues, I'd be interested in >> knowing how much support there is for implementing the changes you >> proposed. > > >Jon, > >It appears you misread my note. What I asked for was that the feedback >I provided be processed in the usual way it is done in the IETF. > >That is: > >On 8/8/2016 3:45 PM, Dave Crocker wrote: >> In order to avoid having authors do a guessing game about what will >> resolve questions and concerns, they normally pursue those items on >> the working group's mailing list. > > >Unless things are done differently in this part of the IETF, it is not >considered normal IETF process to request working group consensus about >whether to respond to the details of a review... > >But perhaps the word 'respond' is unclear? In the IETF it means to give >meaningful responses. That's quite different from, say, automatically >expecting suggestions to be agreed to. > >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Tue Aug 9 07:12:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A822612D827 for ; Tue, 9 Aug 2016 07:12:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6UXUvuS-IONb for ; Tue, 9 Aug 2016 07:12:37 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F8C812D7FA for ; Tue, 9 Aug 2016 07:12:37 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79ECdhh007047 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Tue, 9 Aug 2016 07:12:39 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470751959; bh=fOa0mQSTRwgxCpo0PxsSul/cxWFkbl9BxrmoJiusz8U=; h=Subject:To:References:From:Reply-To:Date:In-Reply-To:From; b=E2AmNiGCcQUiVXlQU8y0VzKIU5FDn8HKCxSz/qJgHRZPuFsIDDiXvz6dk+DS+ojDh 6AaCZPdOWi7/5fVl7hIXefAXQxaBl/VV80akQrKFolE7jMm37DtkCMm8H0DPqLZ9ln EDYhaQlOiieYquAzQ8SX5fZrkXYy2wf+oQrmdlzg= To: "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> Date: Tue, 9 Aug 2016 07:12:10 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 14:12:38 -0000 On 8/9/2016 6:52 AM, Peterson, Jon wrote: > and I promise that Chris and I will go through and implement > them where appropriate. This is the nugget of the process problem I was anticipating and seeking to resolve: This is a working group, not a cheerleading section for some authors. In the IETF work is supposed to reflect the understanding and agreement of the working group. The nature and extent of the problems I'm seeing with these documents suggests a significant lack of that shared effort. In some cases, a document really comes from and remains primarily the souls of the authors and the wg simply provides a surrounding sanity check. That's fine, when the sanity check is meaningful. But these documents don't have that kind of history or nature. A process in which the authors take extensive comments and go into a back room and decide on their own what to do with them is a deviation from the pure IETF model. It is supported as an IETF process efficiency hack only when there is rock solid working group synchronicity with the authors. Based on the nature and extent of the problems I'm seeing with these documents, that synchronicity is lacking. In sum: The reviews I am doing are noting many and serious problems. They need working group discussion, not back-room author filtering, with selective public comments by the authors. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 07:16:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9AAF12D876 for ; Tue, 9 Aug 2016 07:15:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WhcSCwmjrZD1 for ; Tue, 9 Aug 2016 07:15:59 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 296DF12D832 for ; Tue, 9 Aug 2016 07:15:59 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79EFp4s007160 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 9 Aug 2016 07:15:51 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470752158; bh=TzUWUf7iwXCXr/cOgTiTHH3j9p1BXR5+x+L0dKZLZqY=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=Q6cDe7WfuwKGSQnpQU1h8RotIa/RpAMGgdyoHg1jDTRfv7vXIR5oIZxSXDbha4BIg U+tQnOQMGh3a2vn7g70CZopPlJ8n27aFkkKo3gMP1Ikk/lLBCyY3kuGo7Q7w3KyFKl La0JTjRY2Iyq1Ynb7HOsnTyzhu+gZ9AmnW5uxvoI= To: "Peterson, Jon" , Alex Bobotek , "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Tue, 9 Aug 2016 07:15:22 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] ad hominems - (was: Re: Review of: draft-ietf-stir-rfc4474bis-10) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 14:16:00 -0000 On 8/9/2016 6:52 AM, Peterson, Jon wrote: > But as your point out in your note, other of these comments are not > offered with a mind to improving the document or advancing the work of > STIR. I've long since learned that the price of doing business in an open > standards body is identifying the useful comments that are often buried in > a heap of obstructionism or personal animus. Jon, You appear to be having a problem refraining from ad hominem distractions in your latest messages. I will ask that you step rather more carefully and quite a bit more professionally. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 07:55:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6336012D115 for ; Tue, 9 Aug 2016 07:55:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zsAw7TY9CDX4 for ; Tue, 9 Aug 2016 07:55:07 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FED812D16F for ; Tue, 9 Aug 2016 07:55:07 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u79EqoHS027021; Tue, 9 Aug 2016 10:55:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=OlM5Ejze6DNo6YwKAav8n+4DIcCofbtbTg6s4Roa764=; b=soSJbfH/+Y8wOF2Qd/otAFTNxYjqhRW7NmA902HswdgPuouOCxX144hOKazDr3ga0rML WFxu1ZH0CNcgEvG0GWpQ3JmIv93a/zzyycdEzlo/fTjOHta2fffAtX5XH3mibGMeredh Mjl92MD+OTTDhLt/OekxENbzQg268GylrRGtKzvvzgflO0gWxBW71aa2K6xQIWYki2fx CM7ixAKckXP7tIC/Lib7HiqaMoSmvHUKDrAQM5+yyOv2BaeLnDtS2df4Da4gd5OrNHDH BIFRtOnljLM3YVl4ZVJmzZmm0PV0yzaWhvXEFIPMWLQWvg7/U7r1W5C1woQ+XOpaWQv0 Fw== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24nc0q8r9u-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 09 Aug 2016 10:55:05 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Tue, 9 Aug 2016 10:55:04 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBAhpWA///ttYCAAHrsAP//lqEA Date: Tue, 9 Aug 2016 14:55:04 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> In-Reply-To: <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <47BD143CA46EC74D9F4FE36A87116915@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090153 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 14:55:09 -0000 I don't know how to start a working group discussion about "many and serious problems." Like I said, my first response to your stir-passport review covered what I considered to be its most significant issues, which were largely about the fundamental architecture and the document organization (that is, the modularity with other specifications). I just read the whole thing again. The remainder of your comments are overwhelmingly stylistic, editorial or philosophical. The many places where you call out points like "insecure" vs. "unsecure" are stylistic in nature. At one point you say as an aside, "FWIW, this isn't quibbling. It is an example of the difference between regular prose writing and direct, specification language." You make a number of organizational points about where information should appear in the document, like in 3.1 how "the section starts with structure detail and ends with purpose. This should be swapped." Pervasive comments like "what is a persona?" or "identity string? What does this mean?" are philosophical or terminological in nature. We see these sometimes as technical objections, like when you question what "delta time" means. You point out places where more citations to existing RFCs would be appropriate. You question why some things are SHOULDs and not MUSTs. Are comments like this useful and actionable? They are, as I said in my initial response to your review. Should we implement fixes for most of these points? We should, as I said. But are these non-trivial, blocking issues that require working group discussion to resolve? I must be missing something. I'll ask again. If below the line in your stir-passport review there are specific non-trivial blocking issues that warrant the attention of the working group, please identify what they are. I honestly don't know what working group discussion you think needs to happen. Jon Peterson Neustar, Inc. On 8/9/16, 7:12 AM, "stir on behalf of Dave Crocker" wrote: >On 8/9/2016 6:52 AM, Peterson, Jon wrote: >> and I promise that Chris and I will go through and implement >> them where appropriate. > > >This is the nugget of the process problem I was anticipating and seeking >to resolve: > > This is a working group, not a cheerleading section for some >authors. In the IETF work is supposed to reflect the understanding and >agreement of the working group. The nature and extent of the problems >I'm seeing with these documents suggests a significant lack of that >shared effort. > > In some cases, a document really comes from and remains primarily >the souls of the authors and the wg simply provides a surrounding sanity >check. That's fine, when the sanity check is meaningful. But these >documents don't have that kind of history or nature. > > A process in which the authors take extensive comments and go into a >back room and decide on their own what to do with them is a deviation >from the pure IETF model. It is supported as an IETF process efficiency >hack only when there is rock solid working group synchronicity with the >authors. Based on the nature and extent of the problems I'm seeing with >these documents, that synchronicity is lacking. > > > >In sum: The reviews I am doing are noting many and serious problems. >They need working group discussion, not back-room author filtering, with >selective public comments by the authors. > > > >d/ > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 9 08:12:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A26EF12D8BF for ; Tue, 9 Aug 2016 08:11:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eqOIXGLZuWne for ; Tue, 9 Aug 2016 08:11:58 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13D6C12D8BD for ; Tue, 9 Aug 2016 08:11:58 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79FC0MY010098 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Tue, 9 Aug 2016 08:12:00 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470755520; bh=RTZeCVwMhgT2CBDu5042Xtk/VCYCBZa5mvVOozK1YKo=; h=From:Subject:To:Reply-To:Date:From; b=i/Lz57jj405pCpq+XEVdogIK4CK7lbKXYdfppD//Zlk+LbudVJKrgjEQFmE8P9rYE tiNOyws/terfv5BBgFqNvJgSa41GfBsR/3++ikDc/nvGeARscZb93e2MtQcFGYQ6zz J0VIFPMFbCFkLwo4VzMInG3M4NT/1C5tu0jthE+A= From: Dave Crocker Organization: Brandenburg InternetWorking To: "stir@ietf.org" Message-ID: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> Date: Tue, 9 Aug 2016 08:11:31 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 15:11:58 -0000 Folks, From what I've been told offline -- but which is not explicitly documented in the specifications -- the intended operational framework for these specifications is amongst a relatively small set of service providers. That is, the community of folk who are regulated and/or used to doing business with bilateral agreements. This appears to produce an expectation of a service infrastructure for STIR that is not public. That is, the query service for obtaining keys and key validation information will not be accessible to random users over the open Internet. For the SIP-based portion of the validation service, this means that a caller or a callee with their own SIP clients will not be able to participate in the validation process. If that is not correct, would someone please explain? If it is correct, why is that an acceptable operational choice for a SIP service? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 08:18:56 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 417D912D5FC for ; Tue, 9 Aug 2016 08:18:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bCa5MGVOkc7C for ; Tue, 9 Aug 2016 08:18:53 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7370512D82C for ; Tue, 9 Aug 2016 08:18:53 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id x185so15787936qkc.2 for ; Tue, 09 Aug 2016 08:18:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=CTqOTAVHbOlq77dIoX5zRmLo+eMpQnWbA4Tc81x3p10=; b=iD63sV3Rab1+OGCYKpLCmpVIyb5sW8A31Fgr5fpUSf5vc9FdtyR9nT62brnqlzqxdN yQTSndLPToLWiZUBrQlUphx0nENkzMDli3d6Mowmcz7c6JwQD9ax7XIjre/trHsFCc/w 9/YofE8aaBqjbzcEXAeWL4qjiDDOhSf/ST4Lb06i8qD/68nPykLacs1MmZCja+hfdWiJ XFTeuMJe/8WHvYOAO5vs3hp5BaVMyWdejD48sMRiK8hT2T6lCJzNWq1zYvAqOcMu+lGb DqgJxMIq7vTK84zthnpenykBaGNAUZlcRWp6Jf/V+aroRQeRCnTRKXnQnIc2Ugcd8gId 3Wug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=CTqOTAVHbOlq77dIoX5zRmLo+eMpQnWbA4Tc81x3p10=; b=TRroYYytb1C48XBvEBF59yMqm7DbDGLku85Xv/llBi921gJM36DcqzXonmfl8+gPqw 6pl1n8k+6feRI6djy4mQ7ec5GATNKTkaNNe8PWrT27hILLcMuPTbpe4eCI3qgZEHMzKo YGljUgXoUg1WKO7BjQ2mM7p+ooOJe/UUGeslKJ6/c1JWjEW/tnines73e4LBb15Y/i2b 2tVWOpHlWFisDM8hN6xhm+vTDgA7CcyVVJI7a46sQPvDSB2PogA+zo3LAmCh1YnUf/EQ 4yjFVmo0yBrmbLeJTOvZseaDLCXNCswTGhF9E5DsOXcC9yRWLRYqlCk5428lquyXklHM iYXw== X-Gm-Message-State: AEkoous3jtSq6qmJhZGB6+K+w/QMrpUGa83Cs0JzZNGIbw8sgkzCk4DJBEJA8lc6/r+UCQ== X-Received: by 10.55.70.75 with SMTP id t72mr9903741qka.146.1470755932505; Tue, 09 Aug 2016 08:18:52 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id f94sm20581924qtb.13.2016.08.09.08.18.50 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 09 Aug 2016 08:18:50 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> Date: Tue, 9 Aug 2016 11:18:49 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 15:18:55 -0000 I think we believe that is where implementations will start, but not = where we will end up. Many of us want to get to the point where devices sign and check and = carriers only delegate credentials. Might take a while to do that. To get rid of robocalling, larger carriers have to push down signing = responsibility to smaller service providers. If they don=E2=80=99t, = then they will be left holding the bag when the authorities come. All service providers can sign on behalf of their subscribers, but they = may want to shed responsibility and liability by pushing that off to the = subscriber. But to get the whole system up and running, it will be the = big guys doing it for a while. So I think you got the =E2=80=9Cnecessary=E2=80=9D part, but not the = =E2=80=9Csufficient=E2=80=9D part. I certainly hope that SPs don=E2=80=99t strip the validation headers. = There are no protocol police however. Brian > On Aug 9, 2016, at 11:11 AM, Dave Crocker wrote: >=20 > Folks, >=20 > =46rom what I've been told offline -- but which is not explicitly = documented in the specifications -- the intended operational framework = for these specifications is amongst a relatively small set of service = providers. That is, the community of folk who are regulated and/or used = to doing business with bilateral agreements. >=20 > This appears to produce an expectation of a service infrastructure for = STIR that is not public. That is, the query service for obtaining keys = and key validation information will not be accessible to random users = over the open Internet. >=20 > For the SIP-based portion of the validation service, this means that a = caller or a callee with their own SIP clients will not be able to = participate in the validation process. >=20 > If that is not correct, would someone please explain? >=20 > If it is correct, why is that an acceptable operational choice for a = SIP service? >=20 > d/ > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 9 08:49:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EDC712D559 for ; Tue, 9 Aug 2016 08:49:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bBEQlk7PT9sD for ; Tue, 9 Aug 2016 08:49:15 -0700 (PDT) Received: from mail1.bemta3.messagelabs.com (mail1.bemta3.messagelabs.com [195.245.230.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E26312D13A for ; Tue, 9 Aug 2016 08:49:15 -0700 (PDT) Received: from [85.158.138.179] by server-16.bemta-3.messagelabs.com id 0E/87-29579-87BF9A75; Tue, 09 Aug 2016 15:49:12 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLKsWRWlGSWpSXmKPExsVy+MWXVt2i3yv DDX526Fs8vT+NzeL3pw9sFsvXbmNyYPa4tPMkm8f9b3/ZPZYs+ckUwBzFmpmXlF+RwJox6d92 toIF2hWbTu9maWC8odXFyMUhJLCHUeLB1bssEM5KRomFM/cyQzjLmSSm7prPBuEcZpS4/vsaV NkmRonPk7uYuhg5OdgEnCTm714HZosI+Eg8en+CtYuRg4NZQFni3257EFNYwFpi3/UciAobif mP+9ggbCuJBTc+MYLYLAIqElsaLoPFeQVCJR7Oew42RUigTKJthQNImBNo0YVHW8DKGQVkJb4 0rmYGsZkFxCVuPZkPdoCEgIDEkj3nmSFsUYmXj/9BHaMpsX6XPkS5osSU7ofsEJsEJU7OfMIy gVFsFpJJsxA6ZiHpmIWkYwEjyypGjeLUorLUIl0jQ72kosz0jJLcxMwcXUMDY73c1OLixPTUn MSkYr3k/NxNjMBoq2dgYNzB2LPX7xCjJAeTkijvvwMrw4X4kvJTKjMSizPii0pzUosPMcpwcC hJ8Nr+AsoJFqWmp1akZeYA4x4mLcHBoyTC6wiS5i0uSMwtzkyHSJ1iVJQS573yEyghAJLIKM2 Da4OlmkuMslLCvIwMDAxCPAWpRbmZJajyrxjFORiVhHkZQMbzZOaVwE1/BbSYCWhxkuoKkMUl iQgpqQbGTeUskp/dn16O/dJ1fPa1mLnTUnpeTHu4z/frY9tsrcDTM+Z+nxfxIuvLtOpqp3Wvd y+J4k/93rdQufj+153cu5cXRN7ud+xnPGbeu2PLhsPNmxoZ9Re+snNfP+WWT0jGXu9txpU5c1 9Jm9o9kxfZqunjct49vOqG39oTz/sj1Tfy34/yfMX5U4mlOCPRUIu5qDgRAOKFL/gwAwAA X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-8.tower-169.messagelabs.com!1470757746!55725154!1 X-Originating-IP: [195.232.244.133] X-StarScan-Received: X-StarScan-Version: 8.84; banners=-,-,- X-VirusChecked: Checked Received: (qmail 25413 invoked from network); 9 Aug 2016 15:49:06 -0000 Received: from mailout01.vodafone.com (HELO mailout01.vodafone.com) (195.232.244.133) by server-8.tower-169.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 9 Aug 2016 15:49:06 -0000 Received: from mailint02.vodafone.com (mailint02.vodafone.com [195.232.244.199]) by mailout01.vodafone.com (Postfix) with ESMTP id 3s7zGn5hG2z2255; Tue, 9 Aug 2016 17:49:05 +0200 (CEST) Received: from mailint02.vodafone.com (localhost [127.0.0.1]) by mailint02.vodafone.com (Postfix) with ESMTP id 3s7zGQ5zYrzR3Q6; Tue, 9 Aug 2016 17:48:46 +0200 (CEST) Received: from VOEXC02W.internal.vodafone.com (voexc02w.dc-ratingen.de [145.230.101.22]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint02.vodafone.com (Postfix) with ESMTPS id 3s7zGQ5bSQzR3PK; Tue, 9 Aug 2016 17:48:46 +0200 (CEST) Received: from AVOEXC03W.internal.vodafone.com (145.230.15.132) by VOEXC02W.internal.vodafone.com (145.230.101.22) with Microsoft SMTP Server (TLS) id 14.3.224.2; Tue, 9 Aug 2016 17:48:47 +0200 Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by AVOEXC03W.internal.vodafone.com ([145.230.15.132]) with mapi id 14.03.0224.002; Tue, 9 Aug 2016 17:48:45 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Brian Rosen , "dcrocker@bbiw.net" Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8lBj1t5W5xui1EmlbeWYjdSbSqBAnICAgAAmc7A= Date: Tue, 9 Aug 2016 15:48:44 +0000 Message-ID: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> In-Reply-To: <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 15:49:18 -0000 KzEuLi4uaXNoLg0KDQpHaXZlbiB0aGUgc291cmNlIG9mIG1hbnkgY2FsbHMgKGxlZ2l0aW1hdGUg b3Igb3RoZXJ3aXNlKSBpcyBjYWxsLWNlbnRyZXMsIGFuZCBpbiBtYW55IGp1cmlzZGljdGlvbnMg dGhlc2UgY2FuICYgZG8gcHVzaCB0aGVpciBDTElzIGludG8gdGhlIG5ldHdvcmssIGZvciBTVElS IHRvIGhhdmUgYW55IGFiaWxpdHkgdG8gaW5kaWNhdGUgdGhlIHRydXN0d29ydGhpbmVzcyBvZiB0 aGUgQ0xJLCB0aGUgc2lnbmluZyBoYXMgdG8gZ28gYmFjayBpbnRvIHRoZSBjYWxsLWNlbnRyZS4g IA0KDQpBcyBJIHNhaWQgbGFzdCB3ZWVrLCBteSBjYWxsLWNlbnRyZSBjdXN0b21lcnMgZ2V0IHRo ZWlyIG51bWJlcnMgYm90aCBmcm9tIG1lICYgdGhpcmQgcGFydHkgcHJvdmlkZXJzLi4uSSBjYW4n dCBhdHRlc3QgdG8gdGhlIHZlcmFjaXR5IG9mIHRoZSBDTElzIG9uIGEgY2FsbC1ieS1jYWxsIGJh c2lzIHRvIHNpZ24gdGhlbSBhdCB0aGUgZmlyc3Qgbm9kZSBpbiB0aGUgcHVibGljIG5ldHdvcmss IGFuZCBsaWtld2lzZSBzYXlpbmcgdGhhdCBjYWxsLWNlbnRyZXMgaGF2ZSB0byB1c2UgQ0xJcyBw cm92aWRlZCBieSBhIGdpdmVuIHNlcnZpY2UgcHJvdmlkZXIgb3ZlciB0cnVua3MgaW50byB0aGF0 IHNlcnZpY2UgcHJvdmlkZXIgYnJlYWtzIHRoZSBidXNpbmVzcyAmIHJlZ3VsYXRvcnkgbW9kZWwg dGhhdCB0aGUgY3VzdG9tZXIgb3ducyB0aGVpciBudW1iZXIgKG9yIGF0IGxlYXN0IGhhcyByaWdo dCBvZiB1c2Ugb3ZlciksIG5vdCB0aGUgc2VydmljZSBwcm92aWRlci4NCg0KRm9yIGV4YW1wbGUs IHRoZSBvdXRzb3VyY2VkIGNhbGwtY2VudHJlIHRoYXQgZG9lcyBvdXIgb3duIG91dGJvdW5kIGNh bGxpbmcgKHdpdGggb3VyIG51bWJlciBkaXNwbGF5ZWQpIGFsc28gcHJvY2Vzc2VzIG91dGJvdW5k IGNhbGxzIGZvciBhIGRvemVuIGxhcmdlIGVudGVycHJpc2VzLCBwcmVzZW50aW5nIGEgcmVsZXZh bnQgQ0xJIG9uIGVhY2ggY2FsbC4gIE9yIGFzIGFub3RoZXIgZXhhbXBsZSBhbiBlbnRlcnByaXNl IHdpdGggYSBoZWFkLW9mZmljZSBhbmQgMTAwKyBoaWdoIHN0cmVldCBzaG9wcyB3aWxsIGhhdmUg YSBzaW5nbGUgYnJlYWtvdXQgaW50byBteSBwdWJsaWMgbmV0d29yayBhbmQgc2VuZCB0aGUgcmVs ZXZhbnQgQ0xJIGFjY29yZGluZyB0byB3aGljaCBzaG9wL2hlYWQtb2ZmaWNlIGV4dGVuc2lvbiBw bGFjZWQgYW4gb3V0Ym91bmQgY2FsbCAoJiBub3QgYWxsIG9mIHRob3NlIG51bWJlcnMgd2lsbCBy b3V0ZSBiYWNrIHZpYSBteSBuZXR3b3JrKS4NCg0KU28gc2VydmljZSBwcm92aWRlciBzaWduaW5n IHdpbGwgZ2V0IHRoZSBiYWxsIHJvbGxpbmcgYW5kIHdpbGwgY29udGludWUgdG8gYmUgc3VpdGFi bGUgb24gdGhlIHdob2xlIGZvciByZXNpZGVudGlhbCBhbmQgbW9iaWxlLCBidXQgZm9yIGVudGVy cHJpc2UgaXQncyBlc3NlbnRpYWwgdGhhdCB0aGUgZXZlbnR1YWwgbW9kZWwgaXMgdG8gYWxsb3cg dGhlIGVudGVycHJpc2UgdG8gc2lnbjsgYW5kIHVudGlsIHRoZW4gYW55b25lIHJlZnVzaW5nIGNh bGxzIGJhc2VkIG9uIHRoZSBDTEkgbm90IGJlaW5nIHNpZ25lZCB3aWxsIHRocm93IGF3YXkgYSBs b3Qgb2YgbGVnaXRpbWF0ZSBjYWxscy4NCg0KQ2hlZXJzDQoNClBhdWwNCg0KLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCkZyb206IHN0aXIgW21haWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmdd IE9uIEJlaGFsZiBPZiBCcmlhbiBSb3Nlbg0KU2VudDogMDkgQXVndXN0IDIwMTYgMTY6MTkNClRv OiBkY3JvY2tlckBiYml3Lm5ldA0KQ2M6IHN0aXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbc3Rp cl0gU1RJUidzIGJhc2ljIG9wZXJhdGlvbmFsIG1vZGVsIHdpdGggU0lQDQoNCkkgdGhpbmsgd2Ug YmVsaWV2ZSB0aGF0IGlzIHdoZXJlIGltcGxlbWVudGF0aW9ucyB3aWxsIHN0YXJ0LCBidXQgbm90 IHdoZXJlIHdlIHdpbGwgZW5kIHVwLg0KDQpNYW55IG9mIHVzIHdhbnQgdG8gZ2V0IHRvIHRoZSBw b2ludCB3aGVyZSBkZXZpY2VzIHNpZ24gYW5kIGNoZWNrIGFuZCBjYXJyaWVycyBvbmx5IGRlbGVn YXRlIGNyZWRlbnRpYWxzLiAgTWlnaHQgdGFrZSBhIHdoaWxlIHRvIGRvIHRoYXQuDQoNClRvIGdl dCByaWQgb2Ygcm9ib2NhbGxpbmcsIGxhcmdlciBjYXJyaWVycyBoYXZlIHRvIHB1c2ggZG93biBz aWduaW5nIHJlc3BvbnNpYmlsaXR5IHRvIHNtYWxsZXIgc2VydmljZSBwcm92aWRlcnMuICBJZiB0 aGV5IGRvbuKAmXQsIHRoZW4gdGhleSB3aWxsIGJlIGxlZnQgaG9sZGluZyB0aGUgYmFnIHdoZW4g dGhlIGF1dGhvcml0aWVzIGNvbWUuDQoNCkFsbCBzZXJ2aWNlIHByb3ZpZGVycyBjYW4gc2lnbiBv biBiZWhhbGYgb2YgdGhlaXIgc3Vic2NyaWJlcnMsIGJ1dCB0aGV5IG1heSB3YW50IHRvIHNoZWQg cmVzcG9uc2liaWxpdHkgYW5kIGxpYWJpbGl0eSBieSBwdXNoaW5nIHRoYXQgb2ZmIHRvIHRoZSBz dWJzY3JpYmVyLiAgQnV0IHRvIGdldCB0aGUgd2hvbGUgc3lzdGVtIHVwIGFuZCBydW5uaW5nLCBp dCB3aWxsIGJlIHRoZSBiaWcgZ3V5cyBkb2luZyBpdCBmb3IgYSB3aGlsZS4NCg0KU28gSSB0aGlu ayB5b3UgZ290IHRoZSDigJxuZWNlc3NhcnnigJ0gcGFydCwgYnV0IG5vdCB0aGUg4oCcc3VmZmlj aWVudOKAnSBwYXJ0Lg0KDQpJIGNlcnRhaW5seSBob3BlIHRoYXQgU1BzIGRvbuKAmXQgc3RyaXAg dGhlIHZhbGlkYXRpb24gaGVhZGVycy4gICBUaGVyZSBhcmUgbm8gcHJvdG9jb2wgcG9saWNlIGhv d2V2ZXIuDQoNCkJyaWFuDQoNCj4gT24gQXVnIDksIDIwMTYsIGF0IDExOjExIEFNLCBEYXZlIENy b2NrZXIgPGRoY0BkY3JvY2tlci5uZXQ+IHdyb3RlOg0KPiANCj4gRm9sa3MsDQo+IA0KPiBGcm9t IHdoYXQgSSd2ZSBiZWVuIHRvbGQgb2ZmbGluZSAtLSBidXQgd2hpY2ggaXMgbm90IGV4cGxpY2l0 bHkgZG9jdW1lbnRlZCBpbiB0aGUgc3BlY2lmaWNhdGlvbnMgLS0gdGhlIGludGVuZGVkIG9wZXJh dGlvbmFsIGZyYW1ld29yayBmb3IgdGhlc2Ugc3BlY2lmaWNhdGlvbnMgaXMgYW1vbmdzdCBhIHJl bGF0aXZlbHkgc21hbGwgc2V0IG9mIHNlcnZpY2UgcHJvdmlkZXJzLiAgVGhhdCBpcywgdGhlIGNv bW11bml0eSBvZiBmb2xrIHdobyBhcmUgcmVndWxhdGVkIGFuZC9vciB1c2VkIHRvIGRvaW5nIGJ1 c2luZXNzIHdpdGggYmlsYXRlcmFsIGFncmVlbWVudHMuDQo+IA0KPiBUaGlzIGFwcGVhcnMgdG8g cHJvZHVjZSBhbiBleHBlY3RhdGlvbiBvZiBhIHNlcnZpY2UgaW5mcmFzdHJ1Y3R1cmUgZm9yIFNU SVIgdGhhdCBpcyBub3QgcHVibGljLiAgVGhhdCBpcywgdGhlIHF1ZXJ5IHNlcnZpY2UgZm9yIG9i dGFpbmluZyBrZXlzIGFuZCBrZXkgdmFsaWRhdGlvbiBpbmZvcm1hdGlvbiB3aWxsIG5vdCBiZSBh Y2Nlc3NpYmxlIHRvIHJhbmRvbSB1c2VycyBvdmVyIHRoZSBvcGVuIEludGVybmV0Lg0KPiANCj4g Rm9yIHRoZSBTSVAtYmFzZWQgcG9ydGlvbiBvZiB0aGUgdmFsaWRhdGlvbiBzZXJ2aWNlLCB0aGlz IG1lYW5zIHRoYXQgYSBjYWxsZXIgb3IgYSBjYWxsZWUgd2l0aCB0aGVpciBvd24gU0lQIGNsaWVu dHMgd2lsbCBub3QgYmUgYWJsZSB0byBwYXJ0aWNpcGF0ZSBpbiB0aGUgdmFsaWRhdGlvbiBwcm9j ZXNzLg0KPiANCj4gSWYgdGhhdCBpcyBub3QgY29ycmVjdCwgd291bGQgc29tZW9uZSBwbGVhc2Ug ZXhwbGFpbj8NCj4gDQo+IElmIGl0IGlzIGNvcnJlY3QsIHdoeSBpcyB0aGF0IGFuIGFjY2VwdGFi bGUgb3BlcmF0aW9uYWwgY2hvaWNlIGZvciBhIFNJUCBzZXJ2aWNlPw0KPiANCj4gZC8NCj4gLS0g DQo+IA0KPiAgRGF2ZSBDcm9ja2VyDQo+ICBCcmFuZGVuYnVyZyBJbnRlcm5ldFdvcmtpbmcNCj4g IGJiaXcubmV0DQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPiBzdGlyIG1haWxpbmcgbGlzdA0KPiBzdGlyQGlldGYub3JnDQo+IGh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0Kc3RpciBtYWlsaW5nIGxpc3QNCnN0aXJAaWV0 Zi5vcmcNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0K From nobody Tue Aug 9 08:53:33 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C14512B030 for ; Tue, 9 Aug 2016 08:53:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.448 X-Spam-Level: X-Spam-Status: No, score=-5.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PTYBJcAG8zy7 for ; Tue, 9 Aug 2016 08:53:28 -0700 (PDT) Received: from alum-mailsec-scanner-5.mit.edu (alum-mailsec-scanner-5.mit.edu [18.7.68.17]) by ietfa.amsl.com (Postfix) with ESMTP id 47E4712B011 for ; Tue, 9 Aug 2016 08:44:35 -0700 (PDT) X-AuditID: 12074411-a1bff70000000932-88-57a9fa60762b Received: from outgoing-alum.mit.edu (OUTGOING-ALUM.MIT.EDU [18.7.68.33]) by (Symantec Messaging Gateway) with SMTP id 5F.C4.02354.06AF9A75; Tue, 9 Aug 2016 11:44:32 -0400 (EDT) Received: from Paul-Kyzivats-MacBook-Pro.local (c-73-218-51-154.hsd1.ma.comcast.net [73.218.51.154]) (authenticated bits=0) (User authenticated as pkyzivat@ALUM.MIT.EDU) by outgoing-alum.mit.edu (8.13.8/8.12.4) with ESMTP id u79FiRP1031679 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Tue, 9 Aug 2016 11:44:27 -0400 To: Alex Bobotek , "Peterson, Jon" , "Gorman, Pierce A [CTO]" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> From: Paul Kyzivat Message-ID: <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> Date: Tue, 9 Aug 2016 11:44:25 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: base64 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrCKsWRmVeSWpSXmKPExsUixO6iqJv4a2W4wf+lQhZvJjayWDy9P43N 4kyDpcWhB0/ZLXbduspqceLbf0aLGT8MLJav3cZkMWX2NDYHTo+X/XMYPbb1Vnjc//aX3WPJ kp9MHjsanjN7TPx4htmj7dJuZo/W76IefTPWMwZwRnHZpKTmZJalFunbJXBlLPo3jbVgywSW ii2Xv7M2ME5oYuli5OSQEDCRaH+ykr2LkYtDSGAro8TRD0cZIZwnTBJr+vpYQaqEBXQkLrV+ YgVJiAh0MEm0P1jIBlHVxiHx/XQPmMMssItR4sXPJUwgLWwCWhJzDv0HW8IrYC+xt+8fWJxF QEVi751PYHFRgTSJ6Yf7GSFqBCVOznwCFucU8JN48vUCWJxZwFbiztzdzBC2osSU7ofsExj5 ZyFpmYWkbBaSsgWMzKsY5RJzSnN1cxMzc4pTk3WLkxPz8lKLdE31cjNL9FJTSjcxQiJEcAfj jJNyhxgFOBiVeHgvLF8RLsSaWFZcmXuIUZKDSUmU99+BleFCfEn5KZUZicUZ8UWlOanFhxgl OJiVRHivfgfK8aYkVlalFuXDpKQ5WJTEefmWqPsJCaQnlqRmp6YWpBbBZGU4OJQkeI/8AGoU LEpNT61Iy8wpQUgzcXCCDOcBGn4JpIa3uCAxtzgzHSJ/ilGX41Xr/bVMQix5+XmpUuK8i14C FQmAFGWU5sHNgSW2V4ziQG8J814BGcUDTIpwk14BLWECWpKkugJkSUkiQkqqgTH3MGv1YrXk N2euTVmSeVDGap9PyLv97Dc+3fuySnL+tkfKy+MfhT87PzNCNiZst8WsV+7uGhmqtu4aH5WW fGoVspsqo/FujXZ02s86zdniM15eexEgvywhPuv6lrNBzSwafreupKva637j807+kzRLl7/m Tof380zX30fOmhyqWRZ6J3P65rNKLMUZiYZazEXFiQDimvpkRwMAAA== Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 15:53:31 -0000 T24gOC85LzE2IDU6MDMgQU0sIEFsZXggQm9ib3RlayB3cm90ZToNCj4gSm9uLA0KPg0KPiBU aGFua3MgbXVjaCBmb3IgeW91ciB0aG91Z2h0ZnVsIHJlc3BvbnNlIHRvIHRoZSBvcmlnaW5h bCBwb2ludHMuICBZZXMsIHRoaW5ncyBnb3Qgc29tZXdoYXQgc2lkZXRyYWNrZWQuDQo+DQo+ IE9uIHRoZSBmaXJzdCBwb2ludCAoc2lnbmluZyB3aXRob3V0IGF1dGhlbnRpY2F0aW9uKSwg SSBkbyBub3QgcmVhZCA2LjEgYXMgcGVybWl0dGluZyAiSSdtIHNpZ25pbmcgdG8gYXNzZXJ0 IHRoYXQgSSd2ZSBhdXRob3JpemVkIHVzZSBvZiB0aGlzIHBob25lIG51bWJlciB3aXRob3V0 IGF1dGhlbnRpY2F0aW5nIHRoZSBjYWxsZXIgYW5kL29yIGNvbXBsZXRpbmcgYSBudW1iZXIg ZGVsZWdhdGlvbiBhdXRob3JpdHkgY2hlY2siLA0KDQpJJ20gbm90IHN1cmUgSSB1bmRlcnN0 YW5kLiBJcyB0aGlzIHRoZSBhc3NlcnRpb24geW91IGFyZSBhc2tpbmcgZm9yPw0KDQoiSSAo QWNtZSBDb3JwKSwgaGF2aW5nIGFkbWluaXN0cmF0aXZlIGF1dGhvcml0eSBvdmVyIG51bWJl ciBOTk4sIGNlcnRpZnkgDQp0aGF0IHRoaXMgbWVzc2FnZSBpcyAiZnJvbSIgTk5OLCB0aG91 Z2ggSSBoYXZlIG5vIGlkZWEgd2hvIGFjdHVhbGx5IA0Kb3JpZ2luYXRlZCB0aGlzIG1lc3Nh Z2UuIg0KDQpUaGlzIGlzIGEgZ29vZCB0aGluZz8/Pw0KDQpJZiB5b3Ugc2lnbiB0aGUgbWVz c2FnZSB5b3UgYXJlIHRha2luZyByZXNwb25zaWJpbGl0eSBmb3IgdGhlIGFzc2VydGlvbiAN CnRoYXQgaXQgaXMgZnJvbSBOTk4uIElmIHlvdSBjaG9vc2UgdG8gZG8gc28gd2l0aG91dCBr bm93aW5nIHdobyBpdCBpcyANCmZyb20gdGhlbiB0aGF0IGlzIHlvdXIgcHJvYmxlbS4gWW91 IHNob3VsZCBiZSBsZWdhbGx5IGxpYWJsZS4gQXQgdGhlIA0KdmVyeSBsZWFzdCB5b3VyIHJl cHV0YXRpb24gYXMgYSBzaWduZXIgc2hvdWxkIGJlIGRpbWluaXNoZWQgYXMgDQpmcmF1ZHVs ZW50IGNhbGxzIHlvdSBoYXZlIHNpZ25lZCBhcmUgZGV0ZWN0ZWQuIEV2ZW50dWFsbHkgeW91 IHdpbGwgYmUgDQpwdXQgb24gYmxhY2tsaXN0cyBhcyBhbiB1bnRydXN0d29ydGh5IHNpZ25l ci4NCg0KSSBndWVzcyB3ZSBjb3VsZCBzcGVlZCB0aGUgYmxhY2tsaXN0aW5nIGJ5IGFsbG93 aW5nIHNpZ25lcnMgdG8gDQpwcmUtZGVjbGFyZSB0aGF0IHRoZXkgYXJlIHVudHJ1c3R3b3J0 aHkuIChUaGF0IHNlZW1zIHRvIGJlIHdoYXQgeW91IGFyZSANCmFza2luZyBmb3IuKQ0KDQo+ IGEgdXNlIGNhc2UgdGhhdCByZWZsZWN0cyB0aGUgY3VycmVudGx5LXdpZGVzcHJlYWQgcHJh Y3RpY2Ugb2YgYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLg0KDQpObyB3 b25kZXIgd2UgaGF2ZSBhIHByb2JsZW0gd2l0aCBzcG9vZmVkIGNhbGxzLg0KDQoJVGhhbmtz LA0KCVBhdWwNCg0KPiBNeSByZWFkIG9mIHNlY3Rpb24gNi4xIGlzIHRoYXQgaXQgYWxsb3dz IGFub255bWl0eSByYXRoZXIgdGhhbiBzaWduZXItYXR0cmlidXRpb24gd2l0aCB1bmF1dGhl bnRpY2F0ZWQgKG5vbi1hbm9ueW1vdXMpIGNhbGxlciBpZGVudGl0eS4gIEtub3dpbmcgdGhl IHRyaXBsZSBvZiBwdXJwb3J0ZWQgY2FsbGluZyBwaG9uZSBudW1iZXIgdGhhdCBmbGFzaGVz IG9uIGEgcmVjaXBpZW50J3MgcGhvbmUsIHRoZSB0ZXJtaW5hdGluZyBwaG9uZSBudW1iZXIg YW5kIGEgdGltZXN0YW1wIGlzIGltcG9ydGFudCBpbiByZXBvcnRpbmcvdHJhY2luZy9taXRp Z2F0aW5nIGFidXNpdmUgY2FsbHMuICBbT24gYSBzaWRlIG5vdGUsIEkgcmVyZWFkIFNlY3Rp b24gMTEsIGJ1dCBoYWQgdHJvdWJsZSB3aXRoIHRoZSBkZWZpbml0aW9uIG9mICJwcml2YXRl IFVSSSIgKG5vdGU6ICAicHJpdmF0ZSBVUkkiIGFuZCAicHJpdmF0ZSBTSVAgVVJJIiBlYWNo IG9jY3VyIGV4YWN0bHkgb25jZSBlYWNoIGluIHRoZSBkb2MgYW5kIGNvdWxkIGJlbmVmaXQg ZnJvbSBhIGRlZmluaXRpb24gb3IgdHdvKS5dICAgQWRkaXRpb25hbGx5LCBCcmlhbiBSb3Nl bidzIGNvbW1lbnQgb24gOC80IHNlZW1zIHRvIGNvcnJvYm9yYXRlIG15IHJlYWRpbmcgb2Yg YSBiYW4gb24gYXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uIGluIHRoZSBu b24tYW5vbnltb3VzIGNhc2UgKGkuZS4sIHRoYXQgdXNpbmcgc29tZW9uZSBlbHNlJ3MgcGhv bmUgbnVtYmVyIHJlcXVpcmVzIHRoYXQgInRoZSBlbnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0 aGUgVE4gZXhwbGljaXRseSBhdXRob3JpemVzIGNhbGxzIHBsYWNlZCB1c2luZyBpdCdzIFRO IikuDQo+DQo+IEluIHN1bW1hcnksIHRoZXJlIGlzIGEgaGlnaCB2YWx1ZSBpbiBhbGxvd2lu ZyBzaWduaW5nL2F1dGhvcml6YXRpb24gaW4gdGhlIGNhdGVnb3JpZXMgYW5kIHVzZSBjYXNl cyBQaWVyY2Ugb3V0bGluZWQuICBJbiBteSBvcGVyYXRpb25hbCBleHBlcmllbmNlLCBpdCBy ZWFsbHkgaGVscHMgdG8ga25vdyB3aGljaCBjb21wYW55IHRvIGNvbnRhY3QgdG8gZ2V0IHRo ZSBjYWxsZXJzIGtpY2tlZCBvZmYgYSBuZXR3b3JrLiAgQW5kIHNpZ25lciBhdHRyaWJ1dGlv biBldmVuIHdpdGhvdXQgY2FsbGVyIGF1dGhlbnRpY2F0aW9uIGlzIGEgaHVnZSB3aW4gZm9y IHRoZSBwdWJsaWMuDQo+DQo+DQo+DQo+IE9uIHRoZSBzZWNvbmQgcG9pbnQsIHRoYW5rcyBm b3IgcG9pbnRpbmcgb3V0IHRoYXQgMTIuMSByZXF1aXJlcyBzZXJ2ZXJzIHRvIGtlZXAgdGhl IHN0YXRlIG9mIHJlY2VudGx5IHJlY2VpdmVkIHJlcXVlc3RzLiAgVGhpcyBpcyBhIHBvaW50 IHRoYXQgSSBtaXNzZWQgaW4gbXkgcmVhZGluZyBvZiB0aGUgZHJhZnQsIGFuZCB0aGlzIGZl YXR1cmUgYXMgeW91IGhhdmUgZGVzY3JpYmVkIGl0IGRlZmVhdHMgbW9zdCBjb25jZWl2YWJs ZSByZXBsYXkgYXR0YWNrcy4gIE15IGJhZCBmb3IgbWlzc2luZyB0aGlzLCBidXQgYXMgeW91 IHN1Z2dlc3QsIHRoZXJlIG1heSBiZSBzb21lIHBvdGVudGlhbCBmb3IgZW1waGFzaXppbmcg dGhpcyBwb2ludC4gIEJ1dCB0aGVyZSdzIGFub3RoZXIgcGFydCBvZiB0aGUgaXNzdWUgLS0g Y3Jvc3MgbWV0aG9kIHJlcGxheS4gIEZvciBleGFtcGxlLCBpdCBtYXkgYmUgZGlmZmljdWx0 IHRvIGV4cGVjdCBhIG1lc3NhZ2luZyBub2RlICh3aGljaCBoYW5kbGVzIFNJUCBNRVNTQUdF KSBhbmQgYSB2b2ljZS1jYXBhYmxlIElNUyBub2RlIChoYW5kbGluZyBTSVAgSU5WSVRFKSB0 byBjb29yZGluYXRlIHRoZWlyIGFudGktcmVwbGF5IGNhY2hlcywgYWxsb3dpbmcgYW4gYXR0 YWNrZXIgdGhhdCBvYnNlcnZlcyBhIFNJUCBpbnZpdGUgZm9yIGEgdm9pY2UgY2FsbCB0byBw aWdneWJhY2sgYSBzcGFtIHRleHQgbWVzc2FnZS4gIEFzIGl0J3MgY29tbW9uIHRvIHVzZSB0 aGUgc2FtZSAiVG8iIGFkZHJlc3MgZm9yIG11bHRpcGxlIHNlcnZpY2VzIHRoYXQgbWF5IGJl IHNlcnZlZCBieSB2ZXJ5IGRpZmZlcmVudCBpbmZyYXN0cnVjdHVyZSBjb21wb25lbnRzLCBp dCB3b3VsZCBiZSBiZW5lZmljaWFsIHRvIGFsbG93IHNpZ25hdHVyZXMgdG8gY292ZXIgbW9y ZSB0aGFuICJUbyIsICJGcm9tL1BBSSIgYW5kICJUaW1lc3RhbXAiLiAgIEkgZG8gbm90IHNl ZSB0aGlzIGlzc3VlIGFzIG1lcml0aW5nIHNpZ25pZmljYW50IGRlbGF5IG9mIGEgU1RJUiBS RkMgaWYgdGhlcmUncyBubyBxdWljayBmaXguDQo+DQo+IFJlZ2FyZHMsDQo+DQo+IEFsZXgN Cj4NCj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+PiBGcm9tOiBzdGlyIFttYWls dG86c3Rpci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgUGV0ZXJzb24sIEpvbg0K Pj4gU2VudDogTW9uZGF5LCBBdWd1c3QgOCwgMjAxNiAxMjo0NiBQTQ0KPj4gVG86IEdvcm1h biwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT47IFBhdWwgS3l6 aXZhdA0KPj4gPHBreXppdmF0QGFsdW0ubWl0LmVkdT47IER3aWdodCwgVGltb3RoeSBNIChU aW0pDQo+PiA8dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5jb20+OyBET0xMWSwgTUFSVElOIEMg PG1kMzEzNUBhdHQuY29tPg0KPj4gQ2M6IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsg PHBhdWwucm9zYm90aGFtQHZvZGFmb25lLmNvbT47DQo+PiBSaWNoYXJkIFNob2NrZXkgPHJp Y2hhcmRAc2hvY2tleS51cz47IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2VuDQo+PiA8YnJA YnJpYW5yb3Nlbi5uZXQ+DQo+PiBTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0x MCBjb21tZW50cw0KPj4NCj4+DQo+PiBKdXN0IHNvIEknbSBjbGVhciwgSSdtIG5vdCBoZWFy aW5nIGFuIGFzayBoZXJlIGluIHRlcm1zIG9mIGNoYW5naW5nIHRoZSB0ZXh0IG9mDQo+PiBy ZmM0NDc0YmlzLTEwLCB3aGljaCBkb2VzIGFsbG93IHNpZ25pbmcgUEFJIGluc3RlYWQgb2Yg RnJvbSBmb3IgcHJlY2lzZWx5IHRoZQ0KPj4gcmVhc29ucyBvdXRsaW5lZCBpbiB0aGlzIGxl bmd0aHkgdGhyZWFkLiBUbyBBbGV4J3Mgb3JpZ2luYWwgcG9pbnQgYWJvdXQNCj4+IHByb3Zp ZGluZyBhdXRob3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24sIHJmYzQ0NzRiaXMg aGFzIGEgbG90IG9mIHRleHQNCj4+IGFib3V0IHNpZ25pbmcgbm9uLVROIGlkZW50aWZpZXJz LCBpbmNsdWRpbmcgZm9yIHByZXNlcnZpbmcgYW5vbnltaXR5OyBzZWUgdGhlDQo+PiBlbmQg b2Ygc2VjdGlvbiA2LjEsIGFuZCB0aGVuIHRoZSBQcml2YWN5IENvbnNpZGVyYXRpb25zIGlu IHNlY3Rpb24gMTEgZm9yDQo+PiBtb3JlLiBUaG9zZSBzaG91bGQgc3VmZmljZSB0byBwcm92 aWRlIHRoaXMgcHJvcGVydHk6IGl0IHdpbGwgaWRlbnRpZnkgdGhlDQo+PiBzZXJ2aWNlIHBy b3ZpZGVyIHdobyBzaWduZWQgd2l0aG91dCBhdHRlc3RpbmcgYW4gc3BlY2lmaWMgdXNlciBp ZGVudGl0eS4NCj4+DQo+PiBJIGFsc28gd2FudGVkIHRvIG1ha2Ugc3VyZSB3ZSBkaWRuJ3Qg ZHJvcCB0aGUgb3RoZXIgYmFsbCB0aGF0IEFsZXggbWVudGlvbmVkDQo+PiBhdCB0aGUgc3Rh cnQgb2YgdGhpcyB0aHJlYWQsIHdoaWNoIGlzIHRoZSBpc3N1ZSBvZiBwcm94aW1hdGUgcmVw bGF5IHdpdGhpbiB0aGUgNjANCj4+IHNlY29uZCBEYXRlIHdpbmRvdy4gVGhpcyBpcyBhZGRy ZXNzZWQgaW4gU2VjdGlvbiAxMi4xIG9mIHJmYzQ0NzRiaXMtMTAsIHdoaWNoDQo+PiByZWFk czogIk5vdGUgdGhhdCBwZXIgYmFzZWxpbmUgW1JGQzMyNjFdIGJlaGF2aW9yLCBzZXJ2ZXJz IGtlZXAgc3RhdGUgb2YNCj4+IHJlY2VudGx5IHJlY2VpdmVkIHJlcXVlc3RzLCBhbmQgdGh1 cyBpZiBhbiBJZGVudGl0eSBoZWFkZXIgaXMgcmVwbGF5ZWQgYnkgYW4NCj4+IGF0dGFja2Vy IHdpdGhpbiB0aGUgRGF0ZSBpbnRlcnZhbCwgdmVyaWZpZXJzIGNhbiBkZXRlY3QgdGhhdCBp dCBpcyBzcG9vZmVkDQo+PiBiZWNhdXNlIGEgbWVzc2FnZSB3aXRoIGFuIGlkZW50aWNhbCBE YXRlIGZyb20gdGhlIHNhbWUgc291cmNlIGhhZCByZWNlbnRseQ0KPj4gYmVlbiByZWNlaXZl ZC4iIFRoaXMgcmVmZXJzIHRvIHRoZSB0ZXh0IG9mDQo+PiBSRkMzMjYxIHNlY3Rpb24gMjMu NC4yLCB0aG91Z2ggbW9yZSBwcm9wZXJseSB0aGUgRGF0ZS1yZWxhdGVkIGJlaGF2aW9yIGlz DQo+PiBiZXR0ZXIgZGV0YWlsZWQgaW4gUkZDMzg5MyBTZWN0aW9uIDEwLCB3aGljaCBpbnRy b2R1Y2VkIHRoZSBmaXJzdCB2ZXJzaW9uIG9mDQo+PiB0aGUgcGFydGlhbCBzaWduYXR1cmUg bWVjaGFuaXNtIHRoYXQgdWx0aW1hdGVseSBpbnNwaXJlZCBSRkM0NDc0LiBJJ2xsIHVwZGF0 ZQ0KPj4gdGhlIHRleHQgaGVyZSBzbyBpdCBpcyBjbGVhcmVyIGFib3V0IGV4YWN0bHkgaG93 IHRvIGRldGVjdCBwcm94aW1hdGUgcmVwbGF5Lg0KPj4NCj4+IEpvbiBQZXRlcnNvbg0KPj4g TmV1c3RhciwgSW5jLg0KPj4NCj4+IE9uIDgvOC8xNiwgMTE6MzggQU0sICJzdGlyIG9uIGJl aGFsZiBvZiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIg0KPj4gPHN0aXItYm91bmNlc0BpZXRm Lm9yZyBvbiBiZWhhbGYgb2YgUGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPiB3cm90ZToNCj4+ DQo+Pj4gUGF1bCwNCj4+Pg0KPj4+IEFzIHlvdSBrbm93LCBTSVAgaW50ZXItd29ya2luZyBp cyBvZnRlbiBjaGFsbGVuZ2luZyBiZWNhdXNlIG9mDQo+Pj4gdmFyaWFiaWxpdHkgaW4gaW1w bGVtZW50YXRpb24gaW5jbHVkaW5nIHByb3ByaWV0YXJ5IGhlYWRlcnMgKHdpdGhvdXQgYW4N Cj4+PiBYLSkgYW5kIHN1cHBvcnQgb3IgbGFjayB0aGVyZW9mIGZvciBub24tbWFuZGF0b3J5 IChwZXIgUkZDIDMyNjEpDQo+Pj4gaGVhZGVycyBzdWNoIGFzIFAtQXNzZXJ0ZWQtSWRlbnRp dHksIChhbmQgdGhpbmdzIGxpa2UgQjJCVUEgc3RhY2tzDQo+Pj4gc3RyaXBwaW5nIHRoaW5n cyBsaWtlIGRpc3BsYXkgbmFtZSBpbiBGcm9tIGJ1dCB0aGF0J3MgYW5vdGhlciBzdG9yeSku DQo+Pj4gSSBjb3VsZCBhcmd1ZSB0aGF0IGZyb20gYSBjbGVhbmxpbmVzcyBvZiBwcm90b2Nv bCBpbXBsZW1lbnRhdGlvbiwgKGFuZA0KPj4+IGlmIEkgd2FudGVkIHRvIGJlIHBlZGFudGlj KSwgSSB3b3VsZCBzdHJpcCBQQUkgb3V0Ym91bmQgdW5sZXNzIHJlcXVpcmVkDQo+Pj4gb3Ro ZXJ3aXNlLiAgQnV0IHRoZSBwb2ludCBpcyBtb290LiAgQXMgSSBtZW50aW9uZWQgaW4gdGhl IGVhcmxpZXINCj4+PiBlLW1haWwsIHRoYXQgaXMgbm90IG91ciBwcmFjdGljZSBhbmQgSSdt IG5vdCByZXF1ZXN0aW5nIGl0IHRvIGJlIHNvLg0KPj4+DQo+Pj4gUGllcmNlDQo+Pj4NCj4+ Pg0KPj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+Pj4gRnJvbTogUGF1bCBLeXpp dmF0IFttYWlsdG86cGt5eml2YXRAYWx1bS5taXQuZWR1XQ0KPj4+IFNlbnQ6IEF1Z3VzdCAw OCwgMjAxNiAxMjowMyBQTQ0KPj4+IFRvOiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVy Y2UuR29ybWFuQHNwcmludC5jb20+OyBEd2lnaHQsDQo+PiBUaW1vdGh5DQo+Pj4gTQ0KPj4+ IChUaW0pIDx0aW1vdGh5LmR3aWdodEB2ZXJpem9uLmNvbT47IERPTExZLCBNQVJUSU4gQw0K Pj4gPG1kMzEzNUBhdHQuY29tPg0KPj4+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25l IFVLIDxwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+Ow0KPj4gUmljaGFyZA0KPj4+IFNo b2NrZXkgPHJpY2hhcmRAc2hvY2tleS51cz47IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2Vu DQo+Pj4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJ UiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4NCj4+PiBPbiA4LzgvMTYgMTI6MTEgUE0sIEdv cm1hbiwgUGllcmNlIEEgW0NUT10gd3JvdGU6DQo+Pj4+IFRoYW5rcyBmb3IgdGhlIGFkZGVk IGNvbW1lbnRzIFRpbS4NCj4+Pj4NCj4+Pj4gSSBhZ3JlZSB0aGF0IHBhc3NpbmcgUC1Bc3Nl cnRlZC1JZGVudGl0eSBiZXR3ZWVuIHRydXN0ZWQgbmV0d29ya3MgaXMNCj4+Pj4gYXBwcm9w cmlhdGUgKGFuZCB0aGUgY29udmVyc2UgaXMgdHJ1ZSBhcyB3ZWxsKS4gIFBhcnQgb2YgbXkg aXNzdWUgaXMNCj4+Pj4gSSBoYXZlIGJlZW4gY29uZGl0aW9uZWQgZnJvbSB0aGUgdmVyeSBl YXJsaWVzdCBpbXBsZW1lbnRhdGlvbiBvZg0KPj4+PiBTcHJpbnQncyBWb0lQIG5ldHdvcmsg dGhhdCBvdGhlciBjYXJyaWVycycgSVAgbmV0d29ya3MgYXJlIGluaGVyZW50bHkNCj4+Pj4g dW50cnVzdGVkLiAgSSd2ZSBiZWVuIGJyb3dzaW5nIFRTIDI5LjE2NSBhbmQgZXZlbiB0aGVy ZSBJIGZpbmQNCj4+Pj4gbGFuZ3VhZ2UgdGhhdCBpbXBsaWVzIHRydXN0IGlzIGVzdGFibGlz aGVkIGJ5IGFncmVlbWVudCwgbm90IGJ5DQo+Pj4+IHN0YW5kYXJkLiAgKEV2ZW4gcm9hbWlu ZyBpbXBsaWVzIGFncmVlbWVudC4pDQo+Pj4NCj4+PiBJIHVuZGVyc3RhbmQgd2h5ICpzb21l KiBzdHVmZiBuZWVkcyB0byBiZSByZW1vdmVkIHdoZW4gZm9yd2FyZGluZyB0bw0KPj4gYW4N Cj4+PiB1bnRydXN0ZWQgcGFydHkuIEZvciBpbnN0YW5jZSwgaWYgdGhlIGNhbGwgaGFzIHJl cXVlc3RlZCBwcml2YWN5LCB0aGVuDQo+Pj4gUC1BLUlEIG5lZWRzIHRvIGJlIHJlbW92ZWQu DQo+Pj4NCj4+PiBCdXQgd2hlbiBwcml2YWN5IGlzIG5vdCBhIGNvbmNlcm4sIHRydXN0IGlz IHJlYWxseSBtb3JlIG9mIGEgY29uY2VybiBvbg0KPj4+IHRoZSBpbmdyZXNzIHNpZGUsIG5v dCBlZ3Jlc3MuIElmIEkgZG9uJ3QgdHJ1c3QgeW91IHRoZW4gSSB3b24ndCB0cnVzdCBhDQo+ Pj4gUC1BLUlEIHlvdSBzZW50IHRvIG1lLCBhbmQgc28gKkkqIHdpbGwgcmVtb3ZlIGl0LiBC dXQgaWYgSSB0cnVzdCB5b3UsDQo+Pj4gYnV0IHlvdSBkb24ndCB0cnVzdCBtZSwgdGhlbiB3 aGF0IGlzIHRoZSBkb3duc2lkZSBmb3IgcGFzc2luZyBhbG9uZyB0aGUNCj4+PiBQLUEtSUQ/ DQo+Pj4NCj4+PiAgICAgVGhhbmtzLA0KPj4+ICAgICBQYXVsDQo+Pj4NCj4+Pj4gUmVnYXJk bGVzcywgdGhpcyBkaXNjdXNzaW9uIGhhcyBiZWVuIGhlbHBmdWwgYW5kIGVkdWNhdGlvbmFs ICh0byBtZQ0KPj4+PiBhdCBsZWFzdCkuICBBbmQsIEkgY29uZmlybWVkIHdpdGggbXkgb3Bl cmF0aW9ucyBjb3VudGVycGFydCB3ZQ0KPj4+PiBnZW5lcmFsbHkgc2VuZCBQQUkgdG9kYXku ICBJJ3ZlIGFsc28gbWFkZSBub3RlIHRoYXQgd2hlcmUgc3RhbmRhcmRzIGFuZA0KPj4gSUNB DQo+Pj4+IHJlcXVpcmUgaXQsIHdlIHdpbGwgaW5jbHVkZSBQQUkuICAgVGhhbmtzIGFnYWlu Lg0KPj4+Pg0KPj4+PiBCZXN0IHJlZ2FyZHMsDQo+Pj4+DQo+Pj4+IFBpZXJjZQ0KPj4+Pg0K Pj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPj4+PiBGcm9tOiBEd2lnaHQsIFRp bW90aHkgTSAoVGltKSBbbWFpbHRvOnRpbW90aHkuZHdpZ2h0QHZlcml6b24uY29tXQ0KPj4+ PiBTZW50OiBBdWd1c3QgMDgsIDIwMTYgMTA6NDcgQU0NCj4+Pj4gVG86IEdvcm1hbiwgUGll cmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT47IERPTExZLA0KPj4gTUFS VElODQo+Pj4+IEMgPG1kMzEzNUBhdHQuY29tPg0KPj4+PiBDYzogUm9zYm90aGFtLCBQYXVs LCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsNCj4+Pj4gUmlj aGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBQYXVsIEt5eml2YXQNCj4+Pj4g PHBreXppdmF0QGFsdW0ubWl0LmVkdT47IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2VuDQo+ Pj4+IDxickBicmlhbnJvc2VuLm5ldD4NCj4+Pj4gU3ViamVjdDogUkU6IFtzdGlyXSBTVElS IDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4NCj4+Pj4gUGllcmNlLA0KPj4+Pg0KPj4+PiBN eSBhc3N1bXB0aW9uIGlzIHRoYXQgTWFydGluIG1vcnBoZWQgMiBzcGVjcywgM0dQUCBUUyAy OS4xNjUgYW5kDQo+PiBHU01BDQo+Pj4+IElSLjk1LiAgVGhlIGxhdHRlciByZWZlcmVuY2Vz IGFuZCBwcm9maWxlcyB0aGUgZm9ybWVyLiAgU2VjdGlvbiA0LjQuMQ0KPj4+PiBvZg0KPj4+ PiBJUi45NSByZWNvbW1lbmRzIHRoYXQgTU5PLXRvLU1OTyBvciBNTk8tdG8tSVBYIGludGVy Y29ubmVjdHMgYmUNCj4+Pj4gY29uc2lkZXJlZCB0cnVzdGVkLCBhbmQgdGFibGUgMyBpbiB0 aGF0IHNlY3Rpb24gcmVjb21tZW5kcyB0aGF0DQo+Pj4+IFAtQXNzZXJ0ZWQtSWRlbnRpdHkg KFBBSSkgYmUgZXhjaGFuZ2VkIGF0IGEgdHJ1c3RlZCBpbnRlcmNvbm5lY3QuICBJdA0KPj4+ PiBhbHNvIHN0YXRlcyB0aGF0IFBBSSBpcyBtYW5kYXRvcnkgYXQgYSByb2FtaW5nIE5OSS4N Cj4+Pj4NCj4+Pj4gVGltDQo+Pj4+DQo+Pj4+DQo+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQo+Pj4+IEZyb206IHN0aXIgW21haWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmdd IE9uIEJlaGFsZiBPZiBHb3JtYW4sIFBpZXJjZQ0KPj4+PiBBIFtDVE9dDQo+Pj4+IFNlbnQ6 IE1vbmRheSwgQXVndXN0IDA4LCAyMDE2IDg6NTIgQU0NCj4+Pj4gVG86IERPTExZLCBNQVJU SU4gQw0KPj4+PiBDYzogUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSzsgUmljaGFyZCBT aG9ja2V5OyBQYXVsIEt5eml2YXQ7DQo+Pj4+IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2Vu DQo+Pj4+IFN1YmplY3Q6IFtFXSBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50 cw0KPj4+Pg0KPj4+PiBNYXJ0aW4sDQo+Pj4+DQo+Pj4+IFlvdSByZWZlcmVuY2VkIFRTIDI5 LjE5NS4gIEknbSBub3QgZmFtaWxpYXIgd2l0aCB0aGF0IHNwZWMuICBIYXMgaXQNCj4+Pj4g YmVlbiBkZXByZWNhdGVkPyAgSXQncyBub3Qgc2hvd2luZyB1cCBvbiB0aGUgM0dQUCBzaXRl Lg0KPj4+Pg0KPj4+PiBJIHJlZmVyZW5jZWQgM0dQUCBUUyAyNC42MDcuICBJbiBTZWN0aW9u IDQuMy4yICJSZXF1aXJlbWVudHMgb24gdGhlDQo+Pj4+IG9yaWdpbmF0aW5nIHNpZGUiIE5v dGUgNCBpdCBzdGF0ZXMsICIgSXQgaXMgYXNzdW1lZCB0aGF0IHRoZSBJQkNGIGlzDQo+Pj4+ IHJlc3BvbnNpYmxlIGZvciBzdHJpcHBpbmcgdGhlIFAtQXNzZXJ0ZWQtSWRlbnRpdHkgZnJv bSB0aGUgU0lQIGhlYWRlcg0KPj4+PiB3aGVuIGludGVyd29ya2luZyB3aXRoIHVudHJ1c3Rl ZCBuZXR3b3Jrcy4iDQo+Pj4+DQo+Pj4+IFlvdXIgcmVtYXJrIGlzIGNvbnNpc3RlbnQgd2l0 aCBOb3RlIDQsIGJ1dCBvbmx5IGlmIHdlIGFncmVlIHRoYXQsIGZvcg0KPj4+PiBpbnN0YW5j ZSwgdGhlIEFUJlQgbmV0d29yayBhbmQgdGhlIFNwcmludCBuZXR3b3JrIGFyZSAidHJ1c3Rl ZA0KPj4+PiBuZXR3b3JrcyIuICBJbiByZWFsaXR5LCB0aGlzIGlzIG5vdCB0aGUgY2FzZSBv ciB0aGVyZSB3b3VsZCBiZSBubw0KPj4+PiBmaXJld2FsbHMgb3IgU2Vzc2lvbiBCb3JkZXIg Q29udHJvbGxlcnMgdXNlZCBmb3IgaW50ZXJ3b3JraW5nIGFuZA0KPj4+PiBzZWN1cml0eS4g IE15IG9waW5pb24gaXMgdGhlIG9ubHkgY2FycmllciBuZXR3b3JrcyB0aGF0IGFyZSB0cnVz dGVkDQo+Pj4+IGFyZSB0aGUgU1M3IG5ldHdvcmssIGFuZCB0aGUgSW50ZXJuZXQgYmFja2Jv bmUuDQo+Pj4+DQo+Pj4+IFdoYXQgaXQgcmVhbGx5IGNvbWVzIGRvd24gdG8gaXMgdGhhdCBQ QUkgaXMgbGVmdCBpbiBzaWduYWxpbmcgZWl0aGVyDQo+Pj4+IHRocm91Z2ggZm9ybWFsIHNw ZWNpZmljYXRpb24gYXMgYSBwYXJ0IG9mIGFuIGludGVyLWNhcnJpZXINCj4+Pj4gaW50ZXIt Y29ubmVjdGlvbiBhZ3JlZW1lbnQsIG9yIGJ5IGN1c3RvbSAob3IgZXZlbiBieSBhY2NpZGVu dCkuICBJDQo+Pj4+IHRoaW5rIHRoaXMgaWxsdXN0cmF0ZXMgUGF1bCBSb3Nib3RoYW0ncyBv YnNlcnZhdGlvbiBpcyB0cnVlLg0KPj4+Pg0KPj4+PiBQaWVyY2UNCj4+Pj4NCj4+Pj4gLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4gRnJvbTogRE9MTFksIE1BUlRJTiBDIFtt YWlsdG86bWQzMTM1QGF0dC5jb21dDQo+Pj4+IFNlbnQ6IEF1Z3VzdCAwNSwgMjAxNiAxMjo1 NSBQTQ0KPj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tPg0KPj4+PiBDYzogUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSyA8cGF1 bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsNCj4+IEJyaWFuDQo+Pj4+IFJvc2VuIDxickBi cmlhbnJvc2VuLm5ldD47IHN0aXJAaWV0Zi5vcmc7IFBhdWwgS3l6aXZhdA0KPj4+PiA8cGt5 eml2YXRAYWx1bS5taXQuZWR1PjsgUmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXku dXM+DQo+Pj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRz DQo+Pj4+DQo+Pj4+IFBBSSBpcyBub3Qgc3RyaXBwZWQgYXQgdGhlIG5ldHdvcmsgYm91bmRh cnkgYmV0d2VlbiB0cnVzdGVkIG5ldHdvcmtzDQo+Pj4+IDNHUFAgVFMgMjkuMTk1IEF0aXMg c3BlY3MgR1NNQSBBdGlzIHNpcCBmb3J1bSB0YXNrIGZvcmNlIElUVSBBbmQgdGhlDQo+Pj4+ IGxpc3QgZ29lcyBvbg0KPj4+Pg0KPj4+PiBNYXJ0aW4gQyBEb2xseQ0KPj4+PiBMZWFkIE1l bWJlciBvZiBUZWNobmljYWwgU3RhZmYNCj4+Pj4gQ29yZSAmIEdvdmVybm1lbnQvUmVndWxh dG9yeSBTdGFuZGFyZHMgQVQmVA0KPj4+PiBDZWxsOiA2MDktOTAzLTMzNjANCj4+Pj4gRW1h aWw6IG1kMzEzNUBhdHQuY29tDQo+Pj4+DQo+Pj4+PiBPbiBBdWcgNSwgMjAxNiwgYXQgMTow NCBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4gPFBpZXJjZS5Hb3JtYW5Ac3By aW50LmNvbT4gd3JvdGU6DQo+Pj4+Pg0KPj4+Pj4gV2hpY2ggaGVhZGVyIHRoZSBjYXJyaWVy IGNob29zZXMgdG8gZGlzcGxheSBpcyBtb290IGlmIHRoZSBoZWFkZXIgaXMNCj4+Pj4+IHN0 cmlwcGVkIGJldHdlZW4gY2FycmllcnMgYXMgcGVyIGF0IGxlYXN0IG9uZSBzdGFuZGFyZC4g IEkgdGhpbmsgUGF1bA0KPj4+Pj4gUm9zYm90aGFtJ3Mgb2JzZXJ2YXRpb24gd2UncmUgbGlr ZWx5IHRvIGVuY291bnRlciAic29tZSBpbnRlcmVzdGluZw0KPj4+Pj4gaW50ZXJ3b3JraW5n IGNoYWxsZW5nZXMiIHdhcyBwZXJoYXBzIHRoZSB1bmRlcnN0YXRlbWVudCBvZiB0aGUgeWVh ci4NCj4+Pj4+DQo+Pj4+PiBQaWVyY2UNCj4+Pj4+DQo+Pj4+PiAtLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KPj4+Pj4gRnJvbTogUGF1bCBLeXppdmF0IFttYWlsdG86cGt5eml2YXRA YWx1bS5taXQuZWR1XQ0KPj4+Pj4gU2VudDogQXVndXN0IDA1LCAyMDE2IDExOjU4IEFNDQo+ Pj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tPjsgUmljaGFyZA0KPj4+Pj4gU2hvY2tleSA8cmljaGFyZEBzaG9ja2V5LnVzPjsgUm9z Ym90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSw0KPj4+Pj4gPHBhdWwucm9zYm90aGFtQHZvZGFm b25lLmNvbT47IEJyaWFuIFJvc2VuIDxickBicmlhbnJvc2VuLm5ldD4NCj4+Pj4+IENjOiBz dGlyQGlldGYub3JnDQo+Pj4+PiBTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0x MCBjb21tZW50cw0KPj4+Pj4NCj4+Pj4+IElmIFBBSSBpcyBwcmVzZW50IGFuZCBzaWduZWQs IGFuZCBGcm9tIGlzIGFsc28gc2lnbmVkLCBJIHdvdWxkDQo+Pj4+PiBleHBlY3QgaXQgdG8g YmUgdXAgdG8gdGhlIFVBIHRvIGRlY2lkZSB3aGF0IHRvIGRpc3BsYXksIG5vdCB0aGUgY2Fy cmllci4NCj4+Pj4+DQo+Pj4+PiBPZiBjb3Vyc2UgdGhpcyB3aWxsIHdvcmsgZGlmZmVyZW50 bHkgaWYgdGhlcmUgaXMgYSBkaWZmZXJlbnQNCj4+Pj4+IHNpZ25hbGluZyByZWdpbWUgYmV0 d2VlbiB0aGUgY2FycmllciBhbmQgdGhlIHVzZXIgZGV2aWNlIChlLmcuIGJsYWNrDQo+PiBw aG9uZSkuDQo+Pj4+Pg0KPj4+Pj4gICAgVGhhbmtzLA0KPj4+Pj4gICAgUGF1bA0KPj4+Pj4N Cj4+Pj4+PiBPbiA4LzUvMTYgMTE6MjYgQU0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gd3Jv dGU6DQo+Pj4+Pj4gUC1Bc3NlcnRlZC1JZGVudGl0eSBpcyBzdXBwb3NlZCB0byBvcGVyYXRl ICJhbW9uZyB0cnVzdGVkIFNJUA0KPj4+Pj4+IGVudGl0aWVzIiBhbmQgdGhlcmVmb3JlIHNv bWUgc3BlY2lmaWNhdGlvbnMgKGUuZy4sIDNHUFAgVFMgMjQuNjA3KQ0KPj4+Pj4+IGFzc3Vt ZSBQLUFzc2VydGVkLUlkZW50aXR5IGlzIHN0cmlwcGVkIGJ5IGJvcmRlciBjb250cm9sbGVy DQo+Pj4+Pj4gZnVuY3Rpb25zIGFuZCBpcyBub3QgdG8gYmUgdXNlZCBpbiBpbnRlci1jYXJy aWVyIGludGVyLWNvbm5lY3Rpb24NCj4+Pj4+PiAoYWx0aG91Z2ggaXQgY29tbW9ubHkgc2hv d3MgdXAgYW55d2F5KS4gIE15IG9waW5pb24gaXMgdGhlICJGcm9tIg0KPj4+Pj4+IGhlYWRl ciBpcyBsaWtlbHkgdXNlZCBtb3JlIG9mdGVuIGZvciBwcmVzZW50YXRpb24uDQo+Pj4+Pj4N Cj4+Pj4+PiBQaWVyY2UNCj4+Pj4+Pg0KPj4+Pj4+DQo+Pj4+Pj4gLS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0NCj4+Pj4+PiBGcm9tOiBSaWNoYXJkIFNob2NrZXkgW21haWx0bzpyaWNo YXJkQHNob2NrZXkudXNdDQo+Pj4+Pj4gU2VudDogQXVndXN0IDA1LCAyMDE2IDk6MzcgQU0N Cj4+Pj4+PiBUbzogUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSw0KPj4gPHBhdWwucm9z Ym90aGFtQHZvZGFmb25lLmNvbT47DQo+Pj4+Pj4gUGF1bCBLeXppdmF0IDxwa3l6aXZhdEBh bHVtLm1pdC5lZHU+OyBCcmlhbiBSb3Nlbg0KPj4+Pj4+IDxickBicmlhbnJvc2VuLm5ldD4N Cj4+Pj4+PiBDYzogc3RpckBpZXRmLm9yZw0KPj4+Pj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0g U1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4NCj4+Pj4+Pg0KPj4+Pj4+IEh1bW0g dGhpcyBpcyBnZXR0aW5nIGludGVyZXN0aW5nLiAgSXRzIG15IHVuZGVyc3RhbmRpbmcgdGhh dCB0aGUNCj4+Pj4+PiBkaXNwbGF5IG51bWJlciBha2EgInByZXNlbnRhdGlvbiBudW1iZXIi IGluIHRoZSBVUyBjb250ZXh0IGlzIHRoZQ0KPj4+Pj4+IG9uZSBjYXJyaWVkIGluIHRoZSBQ QUkuICBNYXJ0aW4sIFBpZXJjZT8NCj4+Pj4+Pg0KPj4+Pj4+DQo+Pj4+Pj4NCj4+Pj4+Pg0K Pj4+Pj4+IE9uIDgvNS8xNiwgMzo0NiBBTSwgInN0aXIgb24gYmVoYWxmIG9mIFJvc2JvdGhh bSwgUGF1bCwgVm9kYWZvbmUgVUsiDQo+Pj4+Pj4gPHN0aXItYm91bmNlc0BpZXRmLm9yZyBv biBiZWhhbGYgb2YgcGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPg0KPj4gd3JvdGU6DQo+ Pj4+Pj4NCj4+Pj4+PiAgICBKdW1waW5nIGluIG5vdyB0aGF0IHdlJ3JlIG9uIEV1cm9wZWFu IHdvcmtpbmcgdGltZSwgKzEgb24gUGF1bCdzDQo+Pj4+Pj4gb2JzZXJ2YXRpb24uDQo+Pj4+ Pj4NCj4+Pj4+PiAgICBIZXJlIGluIHRoZSBVSywgd2UndmUgZ290IDIgbnVtYmVycyBjYXJy aWVkIGFzIGNhbGxpbmcgbGluZQ0KPj4+Pj4+IElEcy4uLi5vbmUgKHdlIHRlcm0gdGhlIE5l dHdvcmsgTnVtYmVyLCBjYXJyaWVkIGluIFBBSUQpIHVuaXF1ZWx5DQo+Pj4+Pj4gaWRlbnRp ZmllcyB0aGUgbGluZSwgdGhlIG90aGVyICh3ZSB0ZXJtIFByZXNlbnRhdGlvbiBOdW1iZXIs IGNhcnJpZWQNCj4+Pj4+PiBpbiBGcm9tKSBpcyB1c2VkIGZvciBkaXNwbGF5IHB1cnBvc2Vz Lg0KPj4+Pj4+DQo+Pj4+Pj4gICAgT25seSB0aGUgY2FycmllciBoYXMgdGhlIGF1dGhvcml0 eSB0byBzZXQgdGhlIE5ldHdvcmsgTnVtYmVyIHNvDQo+Pj4+Pj4gb25seSB0aGV5IGNvdWxk IHNpZ24gaXQuDQo+Pj4+Pj4NCj4+Pj4+PiAgICBCdXQgLSBzdWJqZWN0IHRvIHJlZ3VsYXRv cnkgcmVzdHJpY3Rpb25zIHdoaWNoIGFyZSB3ZWxsDQo+Pj4+Pj4gZG9jdW1lbnRlZA0KPj4+ Pj4+IC0gdGhlIG51bWJlciBzZW50IGZvciBkaXNwbGF5IHB1cnBvc2VzIGJlbG9uZ3MgdG8g dGhlIGN1c3RvbWVyLiAgRm9yDQo+Pj4+Pj4gYmx1ZS1jaGlwIGN1c3RvbWVycywgSSBjYW4g YWxsb3cgdGhlbSB0byBzZW5kIHRoZWlyIFByZXNlbnRhdGlvbg0KPj4+Pj4+IE51bWJlcnMg aW50byB0aGUgbmV0d29yaywgYW5kIGNhbid0IHJlYWRpbHkgY2hlY2sgYXQgYSBuZXR3b3Jr IGxldmVsDQo+Pj4+Pj4gdGhhdCB0aGV5J3JlIHRoZWlycyAoSSBkbyBoYXZlIGNvbnRyYWN0 dWFsIHNhZmVndWFyZHMpLiAgVGhlIG51bWJlcg0KPj4+Pj4+IG1heSBoYXZlIGJlZW4gYWxs b2NhdGVkIGJ5IG1lLCBvciBjb3VsZCBiZSBhbGxvY2F0ZWQgYnkgYSB0aGlyZA0KPj4+Pj4+ IHBhcnR5IHByb3ZpZGVyLiAgSWYgaXQncyBhIGNhbGwtY2VudHJlIHRoZXknbGwgYmUgbWFr aW5nIG91dGJvdW5kDQo+Pj4+Pj4gY2FsbHMgZm9yIGxvdHMgb2YgZGlmZmVyZW50IGN1c3Rv bWVycyB3aGljaCB3aWxsIGNoYW5nZSBvbiBkYXktYnktZGF5DQo+PiBiYXNpcy4NCj4+Pj4+ PiBUaGlzIGlzIGJ1c2luZXNzIGFzIHVzdWFsLiAgSSBkb24ndCBsaWtlIHRoZSB0ZXJtICJh dXRob3Jpc2VkDQo+Pj4+Pj4gc3Bvb2ZpbmciIGJlY2F1c2UgaXQgaW1wbGllcyB0aGF0IHRo ZSBDTEkgaXMgaW4gc29tZSB3YXkgYmVpbmcgcmlnZ2VkOg0KPj4+Pj4+IGl0J3Mgbm90LCBp dCdzIHRoZSBjb3Jwb3JhdGUgY3VzdG9tZXIgb3IgdGhlaXIgc3ViY29udHJhY3RvciB1c2lu Zw0KPj4+Pj4+IHRoZSBudW1iZXIgdGhhdCdzIGJlZW4gYXNzaWduZWQgKHNvIGluIGludGVy bmV0IHRlcm1zIGRlbGVnYXRlZCkgdG8NCj4+Pj4+PiB0aGVtIHZpYSBhIGNoYWluIG9mIHRy dXN0IGZyb20gdGhlIHJlZ3VsYXRvci4NCj4+Pj4+Pg0KPj4+Pj4+ICAgIFdoYXQgSSB3YW50 IGlzIHRoZSBhYmlsaXR5IGZvciBjdXN0b21lcnMgdG8gdXNlIHRoZWlyDQo+Pj4+Pj4gY3Jl ZGVudGlhbHMgIHRvIHNpZ24gdGhlIENMSXMgdGhleSBzZW5kIG1lIHNvIHRoYXQgYXQgdGhl DQo+Pj4+Pj4gdGVybWluYXRpbmcgZW5kIGl0IGNhbiAgYmUgY2hlY2tlZCAob3IgaW5kZWVk IHNvbWV3aGVyZSBlbi1yb3V0ZSBpZg0KPj4+Pj4+IHRoYXQncyB0aGUgYnVzaW5lc3MgbW9k ZWwpLg0KPj4+Pj4+IEkgY2FuIGFuZCB3b3VsZCBzaWduIGZvciBjdXN0b21lcnMgb24gbXkg bW9iaWxlIGJ1c2luZXNzIHNpbmNlIEknbQ0KPj4+Pj4+IGRyaXZpbmcgd2hhdCBudW1iZXIg aXMgcHJlc2VudGVkLCBidXQgdGhhdCdzIGJ5LXRoZS1ieSBiZWNhdXNlIHRoZXkNCj4+Pj4+ PiBhcmVuJ3QgdGhlIG9uZXMgd2hvIGdlbmVyYXRlIG1pbGxpb25zIG9mIG51aXNhbmNlIGNh bGxzLiAgSWYgdGhlDQo+Pj4+Pj4gc2lnbmluZyBvbmx5IG9jY3VycyBhdCB0aGUgb3JpZ2lu YXRpbmcgY2FycmllciBsZXZlbCBmb3INCj4+Pj4+PiBjb3Jwb3JhdGUvY2FsbC1jZW50cmUg Y3VzdG9tZXJzIHRoYXQncyBubyB1c2UgYmVjYXVzZSBJJ20gbm90IGluIGENCj4+Pj4+PiBw b3NpdGlvbiB0byBkbyB0aGF0IGZvciB0aGVzZSB0eXBlIG9mIGN1c3RvbWVycy4uLmFuZCB0 aGUgd2hvbGUNCj4+Pj4+PiBzeXN0ZW0gYmVjb21lcyBhIHdhc3RlIG9mIHRpbWUuIEknZCBh bHNvIGhpZ2hsaWdodCB0aGVyZSBhcmUgbWFueQ0KPj4+Pj4+IG1vcmUgb2YgbXkgbGFyZ2Ug Y3VzdG9tZXJzIHRoYXQgSSdkIHRydXN0IG1vcmUgdGhhbiBhIGZhciBlbmQNCj4+Pj4+PiBv cmlnaW5hdGluZyBjYXJyaWVyIHRoYXQgY291bGQgYmUgYW55d2hlcmUgaW4gdGhlIHdvcmxk ICh0aG91Z2ggd2UNCj4+Pj4+PiBoYXZlIG5vIHNob3J0YWdlIG9mIHNtYWxsIGNhcnJpZXJz IHRoYXQgSSB3b3VsZG4ndCBrbm93IGZyb20gQWRhbQ0KPj4+Pj4+IG1vcmUgbG9jYWxseSBp biB0aGUNCj4+Pj4+PiBVSy4uLi4pDQo+Pj4+Pj4NCj4+Pj4+PiAgICBSZWdhcmRzDQo+Pj4+ Pj4NCj4+Pj4+PiAgICBQYXVsDQo+Pj4+Pj4NCj4+Pj4+PiAgICAtLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KPj4+Pj4+ICAgIEZyb206IHN0aXIgW21haWx0bzpzdGlyLWJvdW5jZXNA aWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBQYXVsIEt5eml2YXQNCj4+Pj4+PiAgICBTZW50OiAw NCBBdWd1c3QgMjAxNiAyMzoxMg0KPj4+Pj4+ICAgIFRvOiBCcmlhbiBSb3Nlbg0KPj4+Pj4+ ICAgIENjOiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4gICAgU3ViamVjdDogUmU6IFtzdGlyXSBT VElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pg0KPj4+Pj4+PiAgICBPbiA4LzQvMTYg NjowMiBQTSwgQnJpYW4gUm9zZW4gd3JvdGU6DQo+Pj4+Pj4+IEkgdGhpbmsgaXQncyBub3Qg YSBkZWxlZ2F0aW9uLiAgVGhlIG1vYmlsZSBwaG9uZSBpcyBub3QgYmVpbmcNCj4+Pj4+Pj4g ZGVsZWdhdGVkIHRoZSBUTiwgaXQncyBiZWluZyBhdXRob3JpemVkIHRvIHBsYWNlIGNhbGxz IHRoYXQgYXJlIG5vdA0KPj4+Pj4+ID5mcm9tIHRoYXQgVE4sIGJ1dCBhcHBlYXIgdG8gYmUu DQo+Pj4+Pj4+DQo+Pj4+Pj4+IFRoZSBtZWNoYW5pc20gdG8gaGFuZGxlIHRoZSBjcmVkZW50 aWFsIGlzIGV4YWN0bHkgdGhlIHNhbWUgYXMgYQ0KPj4+Pj4+PiBkZWxlZ2F0aW9uLCBzbyBp ZiB5b3Ugd2FudCB0byBjYWxsIGl0IGRlbGVnYXRpb24sIGdvIGFoZWFkLCBidXQgSQ0KPj4+ Pj4+PiBwcmVmZXIgdG8gY2FsbCBpdCBhdXRob3JpemVkIHNwb29maW5nLg0KPj4+Pj4+DQo+ Pj4+Pj4gICAgSUlVQyB0aGUgZGVsZWdhdGlvbiBpcyB0byBhIHJlc3BvbnNpYmxlIGVudGl0 eSAoc29tZXRoaW5nIHRoYXQNCj4+Pj4+PiBjYW4gYmUgaGVsZCBsZWdhbGx5IGFjY291bnRh YmxlIC0gZS5nLiBhIHBlcnNvbiksIG5vdCB0byBhIGRldmljZS4NCj4+Pj4+PiBUaGUgZW50 aXR5IGNhbiB0aGVuICJ1c2UiIHRoZSBjcmVkZW50aWFsIHZpYSBhbnkgZGV2aWNlKHMpIGl0 DQo+Pj4+Pj4gY2hvb3Nlcy4gSW4gdGhlIGNhc2Ugb2YgdGhlIG1vYmlsZSwgdGhlIGRldmlj ZSB0aGVuIGJlY29tZXMgYSB0d28tbGluZQ0KPj4gcGhvbmUuDQo+Pj4+Pj4NCj4+Pj4+PiAg ICBUaGFua3MsDQo+Pj4+Pj4gICAgUGF1bA0KPj4+Pj4+DQo+Pj4+Pj4+IEJyaWFuDQo+Pj4+ Pj4+DQo+Pj4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNTo1MSBQTSwgUGF1bCBLeXppdmF0 IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+DQo+Pj4+Pj4+PiB3cm90ZToNCj4+Pj4+Pj4+DQo+ Pj4+Pj4+PiBPbiA4LzQvMTYgNTo0MyBQTSwgQnJpYW4gUm9zZW4gd3JvdGU6DQo+Pj4+Pj4+ Pj4gSW4gbXkgamFyZ29uIGFuICJhdXRob3JpemVkIHNwb29mZXIiIGlzIHRoZSBkb2N0b3Ig d2hvIGlzDQo+Pj4+Pj4+Pj4gY2FsbGluZyAgZnJvbSBoaXMgbW9iaWxlLCBidXQgc2VuZGlu ZyB0aGUgVE4gb2YgaGlzIG9mZmljZSBwaG9uZQ0KPj4+Pj4+Pj4+IGFzIGNhbGxpbmcgcGFy dHkuDQo+Pj4+Pj4+Pj4gVGhlIGRlbGVnYXRpb24gdG8gaGlzIG9mZmljZSBwaG9uZSB3YXMg bWFkZSBieSBoaXMgbGFuZGxpbmUNCj4+Pj4+Pj4+PiBjYXJyaWVyIHRvIGhpbS4gIEhlIHRo ZW4gY3JlYXRlcyBhbm90aGVyIGNyZWRlbnRpYWwsIHdoaWNoIGhlDQo+Pj4+Pj4+Pj4gc2ln bnMgd2l0aCBoaXMgb2ZmaWNlIHBob25lIGNyZWRlbnRpYWwgdGhhdCBhdXRob3JpemVzIGhp cyBtb2JpbGUNCj4+Pj4+Pj4+PiB0byBzZW5kIGNhbGxzIGZyb20gaGlzIG9mZmljZSBudW1i ZXIuICBIZSBpcyBzcG9vZmluZyAoYmVjYXVzZQ0KPj4+Pj4+Pj4+IHRoZSBjYWxsIGlzIGNv bWluZyBmcm9tIGhpcyBtb2JpbGUncyBUTiBidXQgY2xhaW1zIHRvIGJlIGZyb20gaGlzDQo+ Pj4+Pj4+Pj4gb2ZmaWNlKSwgYnV0IGl0J3MgYXV0aG9yaXplZCBzcG9vZmluZy4gIFRoZSBk b2MgY291bGQgZ2l2ZSB0aGUNCj4+Pj4+Pj4+PiBjcmVkZW50aWFsIHRvIGhpcyBtb2JpbGUg U1AgaWYgdGhleSBzaWduIG9uIGhpcyBiZWhhbGYuDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gSSBk b24ndCB1bmRlcnN0YW5kIGhvdyB0aGF0IGlzIGRpZmZlcmVudCBmcm9tIHJlZ3VsYXIgZGVs ZWdhdGlvbi4NCj4+Pj4+Pj4+DQo+Pj4+Pj4+PiBXaGVuIGhpcyBsYW5kbGluZSBjYXJyaWVy IGdhdmUgaGltIGEgZGVsZWdhdGVkIGNlcnRpZmljYXRlIGZvcg0KPj4+Pj4+Pj4gaGlzIGxh bmRsaW5lIG51bWJlciwgaGUgc2hvdWxkIGJlIGFibGUgdG8gaW5zdGFsbCB0aGF0IGluIHdo YXRldmVyDQo+Pj4+Pj4+PiBkZXZpY2VzIGhlIHdhbnRzIC0gaGlzIGxhbmRsaW5lIFVBLCBo aXMgbW9iaWxlIHBob25lLCBldGMuIEl0IGlzDQo+Pj4+Pj4+PiBzdGlsbCBkZWxlZ2F0ZWQg ZnJvbSBoaXMgbGFuZGxpbmUgY2FycmllciwgZXZlbiB3aGVuIHVzZWQgd2l0aA0KPj4+Pj4+ Pj4gY2FsbHMgdmlhIGhpcyBtb2JpbGUgY2Fycmllci4NCj4+Pj4+Pj4+DQo+Pj4+Pj4+PiBU aGFua3MsDQo+Pj4+Pj4+PiBQYXVsDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+IFNvbWUgZm9sa3Mg ZG9uJ3QgbGlrZSBhdHRhY2hpbmcgdGhlICJzcG9vZmluZyIgbGFiZWwgdG8gYQ0KPj4+Pj4+ Pj4+IGxlZ2l0aW1hdGUgdXNlLg0KPj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4gQnV0IHRoYXQncyBo b3cgSSBkZXNjcmliZSBpdC4NCj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+IEJyaWFuDQo+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4gT24gQXVnIDQsIDIwMTYsIGF0IDU6MzcgUE0sIFBhdWwgS3l6aXZh dCA8cGt5eml2YXRAYWx1bS5taXQuZWR1DQo+Pj4+Pj4+Pj4+IDxtYWlsdG86cGt5eml2YXRA YWx1bS5taXQuZWR1Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+ICsxLCBidXQg d2l0aCBvbmUgcXVlc3Rpb24gYmVsb3c6DQo+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+PiBPbiA4 LzQvMTYgNToxNCBQTSwgQnJpYW4gUm9zZW4gd3JvdGU6DQo+Pj4+Pj4+Pj4+PiBJIHRoaW5r IGFsbCB3ZSBuZWVkIGlzIHRvIGhhdmUgY3JlZGVudGlhbHMgZm9sbG93IHRoZQ0KPj4+Pj4+ Pj4+Pj4gZGVsZWdhdGlvbiBwYXRoLA0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4gcGx1cyB0 aGUgb3B0aW9uIHRvIGFkZCBhbm90aGVyIGxldmVsIChub3QgZGVsZWdhdGlvbikgZm9yDQo+ Pj4+Pj4+Pj4+PiBhdXRob3JpemVkIHNwb29mZXJzLg0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ PiBJIGRvbid0IHVuZGVyc3RhbmQgImF1dGhvcml6ZWQgc3Bvb2ZlcnMiIGluIHRoaXMgY29u dGV4dCwgYXMNCj4+Pj4+Pj4+Pj4gY29udHJhc3RlZCB0byAic3Bvb2ZlcnMiIHdobyBoYXZl IGJlZW4gZGVsZWdhdGVkIHRoZWlyDQo+PiBhdXRob3JpdHkuDQo+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+IFRoYW5rcywNCj4+Pj4+Pj4+Pj4gUGF1bA0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4gSSBkb24ndCB0aGluayBpdCBtYXR0ZXJzIHdobyB0aGUgZGVsZWdhdG9yIG9yIGRlbGVn YXRlZSBhcmUgYXMNCj4+Pj4+Pj4+Pj4+IGxvbmcgYXMgdGhlIGRlbGVnYXRvciBpcyB3aWxs aW5nIHRvIHRha2UgdGhlIGhlYXQgZm9yDQo+Pj4+Pj4+Pj4+PiBkZWxlZ2F0aW5nIHRvIHNv bWVvbmUgd2hvIHNlbmRzIGEgbG90IG9mIGJhZCBjYWxscy4gIFRoZXkgY2FuDQo+Pj4+Pj4+ Pj4+PiBwYXNzIHRoZSBidWNrICgiSSBkZWxlZ2F0ZWQgdGhlIFROIHRvIGhpbSwgYW5kIG5v dyBJJ20gbm90DQo+Pj4+Pj4+Pj4+PiByZXNwb25zaWJsZSIpLCBidXQgb25seSBpZiB0aGUg U1Aga25vd3Mgd2hvIHRoZXkgZGVsZWdhdGVkIHRvLA0KPj4+Pj4+Pj4+Pj4gc28gYXV0aG9y aXRpZXMgY2FuIGZvbGxvdyB0aGUgZGVsZWdhdGlvbiBwYXRoLiAgVGhlcmUgYXJlDQo+Pj4+ Pj4+Pj4+PiBwbGVudHkgb2YgY2VydGlmaWNhdGVkIGNhcnJpZXJzIHdobyBhcmUgd2lsbGlu ZyB0byBub3QgY2FyZSB3aG8NCj4+Pj4+Pj4+Pj4+IHRoZXkgZGVsZWdhdGUgdG8uICBUaGUg ZmFjdCB0aGF0IHRoZXJlIGFyZSBzb21lIHdobyBkbyBkb2Vzbid0DQo+Pj4+Pj4+Pj4+PiBj aGFuZ2UgbXVjaC4NCj4+Pj4+Pj4+Pj4+IE1ha2luZyBzdGlyIHdvcmsgbWVhbnMga25vd2lu ZyB3aG8geW91IGFyZSBkZWxlZ2F0aW5nIHRvLCBzbw0KPj4+Pj4+Pj4+Pj4gdGhhdCB5b3Ug Y2FuIHBhc3MgdGhlIGhvdCBwb3RhdG8uDQo+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4gSXQn cyBwZXJmZWN0bHkgcmVhc29uYWJsZSBmb3IgYSBjYXJyaWVyIHRvIGJlIGFibGUgdG8gc2ln biBmb3INCj4+Pj4+Pj4+Pj4+IGFueSBjYWxscyBwbGFjZWQgb24gaXRzIG5ldHdvcmsgb24g YW55IG51bWJlciBpdCBoYXMgYmVlbg0KPj4+Pj4+Pj4+Pj4gZGVsZWdhdGVkLg0KPj4+Pj4+ Pj4+Pj4gSWYgaXQgZG9lcywgaXQncyBhc3NlcnRpbmcgdGhhdCB0aGUgY2FsbHMgYXJlIGZy b20gd2hvIHRoZXkNCj4+Pj4+Pj4+Pj4+IGFyZSBzdXBwb3NlZCB0byBiZSBmcm9tLg0KPj4+ Pj4+Pj4+Pj4gVGhhdCBzaG91bGQgYmUgc3RyYWlnaHRmb3J3YXJkLCBidXQgd2Uga25vdyBp dCdzIG5vdCBhbHdheXMsDQo+Pj4+Pj4+Pj4+PiBhbmQgdGhhdCByZXByZXNlbnRzIHRoZSBo YXJkIHBhcnQgb2YgZGVwbG95bWVudCBpbiBteSBvcGluaW9uLg0KPj4+Pj4+Pj4+Pj4gQnV0 IG9uY2UgdGhleSBkZWxlZ2F0ZSwgdGhleSBjYW4gaGFuZCByZXNwb25zaWJpbGl0eSB0byBz aWduDQo+Pj4+Pj4+Pj4+PiB0byAgdGhlIGRlbGVnYXRlZS4gIEJ1dCwgdGhhdCBvbmx5IHdv cmtzIGlmIHRoZXkga25vdyB3aG8gdGhleQ0KPj4+Pj4+Pj4+Pj4gYXJlIGRlbGVnYXRpbmcg dG8uDQo+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4gVGhlIHJvb3Qgb2YgdGhlIHdob2xlIG1v ZGVsIGlzIHRoYXQgdGhlcmUgaXMgYSBmb3JtYWwgb3INCj4+Pj4+Pj4+Pj4+IGluZm9ybWFs IGRlbGVnYXRpb24gcGF0aCBmb3IgdGVsZXBob25lIG51bWJlcnMgaW4gZXZlcnkNCj4+Pj4+ Pj4+Pj4+IGNvdW50cnksIGFuZCB3ZSBjYW4gYnVpbGQgYSBjaGFpbiBvZiB0cnVzdCBmcm9t IHRoYXQgZGVsZWdhdGlvbg0KPj4+Pj4+Pj4+Pj4gcGF0aC4gIElmIHlvdSBwcm9wb3NlIHRv IGFsdGVyIHRoYXQgbW9kZWwsIHRoZW4gd2UgZ2V0IGludG8NCj4+Pj4+Pj4+Pj4+IChwb2xp Y3kpIGlzc3VlcyBvZiB3aGljaCBjYXJyaWVycy9lbnRpdGllcyB3ZSB0cnVzdCBhbmQgd2hp Y2gNCj4+Pj4+Pj4+Pj4+IHdlIGRvbid0Lg0KPj4+Pj4+Pj4+Pj4gT3VyIG1vZGVsIGlzIHRo YXQgeW91IGtub3cgd2hvIHlvdSBkZWxlZ2F0ZSB0bywgYW5kIG9uY2UgeW91DQo+Pj4+Pj4+ Pj4+PiBkbyB0aGF0IGRlbGVnYXRpb24sIGl0J3MgdGhlaXIgcHJvYmxlbS4NCj4+Pj4+Pj4+ Pj4+IFRoYXQncyBwcmV0dHkgYXBwZWFsaW5nIEkgdGhpbmssIGV2ZW4gaWYgaXQncyBhIGNo YW5nZSBpbiBzb21lDQo+Pj4+Pj4+Pj4+PiBidXNpbmVzcyBwcmFjdGljZXMuDQo+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4gVGhlIG1lY2hhbmlzbSBpcyBjaGFpbmluZyBjcmVkZW50aWFs cyBpbiBhIGZvcm0gb2YgYSBQS0kgYW5kDQo+Pj4+Pj4+Pj4+PiBoYXZpbmcgYSB3YXkgdG8g a25vdyB3aGljaCBUTnMgYXJlIGNvdmVyZWQgYnkgYSBjcmVkZW50aWFsLg0KPj4+Pj4+Pj4+ Pj4gVGhhdCdzIHdoYXQgd2UgaGF2ZSwgYW5kIEknbSBsb2F0aCB0byBjaGFuZ2UgaXQuDQo+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4gQnJpYW4NCj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+ Pg0KPj4+Pj4+Pj4+Pj4+IE9uIEF1ZyA0LCAyMDE2LCBhdCA0OjUzIFBNLCBHb3JtYW4sIFBp ZXJjZSBBIFtDVE9dDQo+Pj4+Pj4+Pj4+Pj4gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0K Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+Pj4+Pj4+Pj4+Pj4gPG1h aWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPj4+Pj4+Pj4+Pj4+IHdyb3RlOg0K Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gT0ssIHlvdSB0YWxrZWQgbWUgaW50byBpbmR1 bGdpbmcgaW4gb25lIG1vcmUgbWVzc2FnZSBvbg0KPj4+Pj4+Pj4+Pj4+IHBvbGljeSBhbmQg dXNlIGNhc2VzLg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gSSBhZ3JlZSB0aGF0IHRo ZSBTVElSL1BBU1Nwb3JUIG1lY2hhbmlzbXMgY291bGQgYmUgZGVwbG95ZWQNCj4+Pj4+Pj4+ Pj4+PiBvbiAgaW5kaXZpZHVhbCBkZXZpY2VzIGFzIHdlbGwgYXMgbXVsdGktZGV2aWNlIGFu ZA0KPj4+Pj4+Pj4+Pj4+IG11bHRpLW51bWJlciBwbGF0Zm9ybXMuDQo+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+PiBOdW1iZXIgZGVsZWdhdGlvbiAoYW5kIHN1Yi1kZWxlZ2F0aW9uKSwg YW5kIGJ1c2luZXNzDQo+Pj4+Pj4+Pj4+Pj4gcmVsYXRpb25zaGlwcyBhcmUgdHdvIGFkZGl0 aW9uYWwgZmFjdG9ycyB3aGljaCBhZmZlY3QNCj4+Pj4+Pj4+Pj4+PiB0cnVzdHdvcnRoaW5l c3Mgb2YgYSBnaXZlbiBjYWxsaW5nIG51bWJlciBhdXRoZW50aWNhdGlvbi4NCj4+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4+IEluaGVyZW50IHZhcmlhYmxlIHRydXN0d29ydGhpbmVzcyBv ZiBhIGNhbGxpbmcgbnVtYmVyIHdhcyBteQ0KPj4+Pj4+Pj4+Pj4+IHJlYXNvbiBmb3Igc3Vn Z2VzdGluZyBhIHdheSB0byBxdWFsaWZ5IHRoZSBzaWduYXR1cmUgdG8NCj4+Pj4+Pj4+Pj4+ PiByZWZsZWN0IHRoYXQgdmFyaWFiaWxpdHkuDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ PiBPcmlnaW5hdGluZyBjYXJyaWVycyBhcmUgaW4gYSBwb3NpdGlvbiB0byBrbm93IGlmIGEg Y2FsbCBpcw0KPj4+Pj4+Pj4+Pj4+IGNvbWluZyBmcm9tIGEgZGV2aWNlIGFzc2lnbmVkIGEg c2luZ2xlIG51bWJlciwgb3IgZnJvbSAidHJ1bmsNCj4+Pj4+Pj4+Pj4+PiBncm91cCIgd2hp Y2ggY291bGQgb3JpZ2luYXRlIGNhbGxzIHVzaW5nIG11bHRpcGxlIG51bWJlcnMsIGFuZA0K Pj4+Pj4+Pj4+Pj4+IGNhbiBxdWFsaWZ5IHRvIHNvbWUgZGVncmVlIHRoZSB0cnVzdHdvcnRo aW5lc3Mgb2YgbnVtYmVyDQo+Pj4+Pj4+Pj4+Pj4gYXV0aGVudGljaXR5IGFjY29yZGluZ2x5 Lg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gTXkgc3VnZ2VzdGlvbiB3YXMgcXVhbGlm eWluZyBjYWxsaW5nIG51bWJlciBhdXRoZW50aWNpdHkgaW50bw0KPj4+Pj4+Pj4+Pj4+IGNh dGVnb3JpZXMgb2YgY2Fycmllci1zaWduZWQgKG9yIG5vdCksIGFuZCB1bmF1dGhlbnRpY2F0 ZWQsDQo+Pj4+Pj4+Pj4+Pj4gc2VtaS1hdXRoZW50aWNhdGVkLCBhbmQgbW9zdC1hdXRoZW50 aWNhdGVkLiAgVGhlcmUgY2FuIGJlDQo+PiBtb3JlDQo+Pj4+Pj4+Pj4+Pj4gZ3JhbnVsYXJp dHksIGJ1dCBpdCBpbXBsaWVzIGFkZGl0aW9uYWwgb3BlcmF0aW9uYWwgY29tcGxleGl0eQ0K Pj4+Pj4+Pj4+Pj4+IChib3RoIGZvciB0aGUgY2FycmllcnMgYW5kIHRoZSBjb25zdW1lcnMp IGFuZCBJIGFzc3VtZQ0KPj4+Pj4+Pj4+Pj4+IGRpbWluaXNoZXMgdmFsdWUuDQo+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiBNeSByZWFzb24gZm9yIGFkZGluZyB0aGUgYXV0aGVudGlj aXR5IG9mIHRoZSBvcmlnaW5hdGluZw0KPj4+Pj4+Pj4+Pj4+IGNhcnJpZXIgaXMgdHlwaWNh bCB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBjYXJyaWVyIGJ1c2luZXNzDQo+Pj4+Pj4+Pj4+Pj4g cmVsYXRpb25zaGlwIHdpdGggdHlwaWNhbCBjb25zdW1lcnMgYWRkcyB0byB0aGUNCj4+Pj4+ Pj4+Pj4+PiB0cnVzdHdvcnRoaW5lc3MgYXNzZXNzbWVudCBhbmQgcGFydGlhbGx5IGJlY2F1 c2UgY2FycmllcnMgYXJlDQo+Pj4+Pj4+Pj4+Pj4gYSByZWd1bGF0ZWQgcG9pbnQgb2YgZm9y ZW5zaWMgaW5xdWlyeSBmb3IgQ0FMRUEgYW5kIGZyYXVkLg0KPj4+Pj4+Pj4+Pj4+IEFkZGl0 aW9uYWxseSwgbW9zdCBjYWxscyBvcmlnaW5hdGUgYW5kIHRlcm1pbmF0ZSBiZXR3ZWVuDQo+ Pj4+Pj4+Pj4+Pj4gbW9iaWxlIGNvbnN1bWVycyB3aGVyZSB0aGVpciBjYXJyaWVycyBhcmUg YWJsZSB0byB1c2VmdWxseQ0KPj4+Pj4+Pj4+Pj4+IGF1dGhlbnRpY2F0ZSB0aGVpciBkZXZp Y2UgYW5kIGhhdmUgYSBoaWdoIGRlZ3JlZSBvZiBjb25maWRlbmNlDQo+Pj4+Pj4+Pj4+Pj4g b2YgdGhlIGF1dGhlbnRpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIuDQo+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+PiBJIHRoaW5rIGJpbGxpb25zIG9mIHBlci1UTiBjZXJ0cyBvZiB2 YXJ5aW5nIHVzYWJpbGl0eQ0KPj4+Pj4+Pj4+Pj4+IChyZXZva2VkLCBub3QNCj4+Pj4+Pj4+ Pj4+PiByZXZva2VkKSBmb3IgYXV0aGVudGljYXRpbmcgY2FsbGluZyBudW1iZXIgd2lsbCBu b3Qgd29yayB3ZWxsLg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gQ29udmVyc2VseSwg SSB0aGluayBiaWxsaW9ucyBvZiBwZXItVE4gY2VydHMgd2lsbCB3b3JrIHdlbGwsDQo+Pj4+ Pj4+Pj4+Pj4gaWYgdGhlIGNhbGxpbmcgcGFydHkgaGFzIHRvIHNpZ24gYSBjYWxsIHdpdGgg YSBwZXItVE4gY2VydA0KPj4+Pj4+Pj4+Pj4+IHByb3ZpZGVkIGJ5IHRoZSBjYWxsZWQgcGFy dHkuICBObyBjYWxsZWQgcGFydHkgY2VydCB0byBpbmNsdWRlPw0KPj4+Pj4+Pj4+Pj4+IFRo ZW4gdGhlIGNhbGxpbmcgcGFydHkgZG9lcyBub3QgaGF2ZSBhIHRydXN0ZWQgcmVsYXRpb25z aGlwDQo+Pj4+Pj4+Pj4+Pj4gd2l0aCB0aGUgY2FsbGVkIHBhcnR5LCBhbmQgdGhlIGNhbGwg Y2FuIGJlIGF1dGhvcml6ZWQvdHJlYXRlZA0KPj4+Pj4+Pj4+Pj4+IGFjY29yZGluZ2x5Lg0K Pj4+Pj4+Pj4+Pj4+IChJJ3ZlIG1hZGUgc2ltaWxhciwgbW9zdGx5IGlnbm9yZWQgY29tbWVu dHMgaW4gTU9ERVJOLikNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+IFBpZXJjZQ0KPj4+ Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gKkZyb206KiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJy QGJyaWFucm9zZW4ubmV0XQ0KPj4+Pj4+Pj4+Pj4+ICpTZW50OiogQXVndXN0IDA0LCAyMDE2 IDI6MDMgUE0NCj4+Pj4+Pj4+Pj4+PiAqVG86KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQ aWVyY2UuR29ybWFuQHNwcmludC5jb20NCj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5H b3JtYW5Ac3ByaW50LmNvbT4NCj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5A c3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+Pj4gKkNjOiogQWxleCBCb2JvdGVrIDxhbGV4QGJv Ym90ZWsubmV0DQo+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0PiA8bWFp bHRvOmFsZXhAYm9ib3Rlay5uZXQ+PjsNCj4+Pj4+Pj4+Pj4+PiBzdGlyQGlldGYub3JnIDxt YWlsdG86c3RpckBpZXRmLm9yZz4gPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+ Pj4+ICpTdWJqZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+IFdlbGwsIHRoZSBtZWNoYW5pc21zIGFyZSBkZXNp Z25lZCBzbyB0aGF0IHRoZXkgY291bGQgYmUNCj4+Pj4+Pj4+Pj4+PiBkZXBsb3llZCBvbiBk ZXZpY2VzIGFuZCBQQlhzLiAgV2hldGhlciB0aGV5IHdpbGwgYmUgaXMgYQ0KPj4+Pj4+Pj4+ Pj4+IHBvbGljeSBpc3N1ZS4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+IFRoZSBub3Rp b24gb2YgY3JlZGVudGlhbHMgdGhhdCBhcmUgdHJhY2VhYmxlIHRvIGEgZGVsZWdhdGlvbg0K Pj4+Pj4+Pj4+Pj4+IG9mIGEgVE4gaXMgYSBtZWNoYW5pc20gdGhhdCBpcyBwYXJ0IG9mIHRo ZSBkZXNpZ24gb2Ygc3RpciwgYW5kDQo+Pj4+Pj4+Pj4+Pj4gdGhlIGRlc2lnbiBhbGxvd3Mg ZGVsZWdhdGlvbiBvZiBvbmUgVE4gKHRvIG9uZSBkZXZpY2UsDQo+Pj4+Pj4+Pj4+Pj4gYWx0 aG91Z2ggYSBkZXZpY2UgbGlrZSBhIFBCWCB3b3VsZCBoYXZlIG1vcmUgdGhhbiBvbmUgVE4g cGVyDQo+Pj4+Pj4+Pj4+Pj4gImRldmljZSIsIGFuZCBzb21ldGhpbmcgbGlrZSBhIGR1YWwg TkFNIHBob25lIGNvdWxkIGhhdmUNCj4+IG1vcmUNCj4+Pj4+Pj4+Pj4+PiB0aGFuIG9uZSBj cmVkZW50aWFsLiAgRm9yIHRoZSB1c2UgY2FzZSB3ZSd2ZSBkaXNjdXNzZWQsIGENCj4+Pj4+ Pj4+Pj4+PiBtb2JpbGUgcGhvbmUgbWF5IGFsc28gaGF2ZSBhIGNyZWRlbnRpYWwgZm9yLCBz YXksIGEgVE4gdGhhdCBpcw0KPj4+Pj4+Pj4+Pj4+IGRlbGVnYXRlZCB0byBhIGxhbmRsaW5l LCB0byBjb3ZlciB0aGUgZXhhbXBsZSBjYXNlIG9mIGEgZG9jdG9yDQo+Pj4+Pj4+Pj4+Pj4g cGxhY2luZyBhIGNhbGwgb24gaGlzIG1vYmlsZSwgYnV0IGdldHRpbmcgaGlzIG9mZmljZSBu dW1iZXIgdG8NCj4+Pj4+Pj4+Pj4+PiBzaG93IHVwIGFzIHRoZSBjYWxsaW5nIHBhcnR5LiAg VXNlIG9mIHN1Y2ggbWVjaGFuaXNtcyBpcyBwb2xpY3kuDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+PiBCcmlhbg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ PiAgT24gQXVnIDQsIDIwMTYsIGF0IDI6NTIgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10N Cj4+Pj4+Pj4+Pj4+PiA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+PiA8bWFpbHRvOlBp ZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5H b3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+PiAgVGhhbmtzIEJyaWFuLiAgSSdtIGFmcmFpZCB3ZSdyZSBzdHJheWlu ZyBpbnRvIGEgcG9saWN5DQo+Pj4+Pj4+Pj4+Pj4gZGlzY3Vzc2lvbi4gIFJlZ2FyZGxlc3Ms IEkgZG8gYXBwcmVjaWF0ZSB5b3VyIGV4cGxhbmF0aW9uLiAgSQ0KPj4+Pj4+Pj4+Pj4+IHdv dWxkIGxpa2UgdG8gY29udGludWUgdGhlIGRpc2N1c3Npb24sIGJ1dCBJJ20gcHJldHR5IHN1 cmUNCj4+Pj4+Pj4+Pj4+PiB0aGlzIGlzbid0IHRoZSByaWdodCBmb3J1bS4NCj4+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICBQaWVyY2UNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ ICAqRnJvbToqIEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+Pj4+ Pj4+Pj4+Pj4gICpTZW50OiogQXVndXN0IDA0LCAyMDE2IDE6MzQgUE0NCj4+Pj4+Pj4+Pj4+ PiAgKlRvOiogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tDQo+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+ Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPj4+Pj4+ Pj4+Pj4+ICAqQ2M6KiBBbGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQNCj4+Pj4+Pj4+ Pj4+PiA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+IDxtYWlsdG86YWxleEBib2JvdGVrLm5l dD4+Ow0KPj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0bzpzdGlyQGlldGYub3Jn PiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+Pj4+Pj4+Pj4+Pj4gICpTdWJqZWN0OiogUmU6 IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4+Pj4+ICBPZiBjb3Vyc2UgSSB3YW50IFBCWHMgdG8gc2lnbiBjYWxscy4gIEFzIHdlbGwg YXMgc21hcnQNCj4+Pj4+Pj4+Pj4+PiBwaG9uZXMgYW5kICBhbnkgb3RoZXIgZGV2aWNlcyB0 aGF0IGNhbiBiZSBwcm9ncmFtbWVkIHRvIGRvDQo+PiBzby4NCj4+Pj4+Pj4+Pj4+PiAgVGhl eSB3aWxsIGJlIGdpdmVuIGNyZWRlbnRpYWxzIHRoYXQgb25seSBhcmUgdmFsaWQgZm9yIHRo ZQ0KPj4+Pj4+Pj4+Pj4+IFROcyB0aGV5IGFyZSBhdXRob3JpemVkIHRvIHNpZ24gZm9yLiAg VGhleSBjYW4gdHJ5IHRvIHNpZ24NCj4+Pj4+Pj4+Pj4+PiBhbnkgY2FsbCwgIGJ1dCB0aGUg dmFsaWRpdHkgb2YgdGhlIGNyZWRlbnRpYWwgd291bGQgbWFrZSBzdWNoDQo+Pj4+Pj4+Pj4+ Pj4gYSBzaWduYXR1cmUgIGZhaWwgdGhlIGNoZWNraW5nLg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+Pj4gIEdldHRpbmcgc2VydmljZSBwcm92aWRlcnMgdG8gc2lnbiBvbiBiZWhhbGYg b2YgZGV2aWNlcyBpcyBhDQo+Pj4+Pj4+Pj4+Pj4gcmVhc29uYWJsZSB3YXkgdG8gZGVwbG95 IHF1aWNrbHksIGJ1dCBJIGV4cGVjdCBtYW55IFNQcyB3aWxsDQo+Pj4+Pj4+Pj4+Pj4gd2Fu dCAgdG8gZ2V0IG91dCBvZiB0aGUgbGlhYmlsaXR5IG9mIHNpZ25pbmcgb24gYmVoYWxmIG9m DQo+Pj4+Pj4+Pj4+Pj4gdGhlaXIgY3VzdG9tZXJzLiAgSWYgdGhleSBjYW4gcHVzaCBvZiB0 aGF0IHJlc3BvbnNpYmlsaXR5IHRvDQo+Pj4+Pj4+Pj4+Pj4gdGhlaXIgY3VzdG9tZXIsIG9u bHkgYmVpbmcgcmVzcG9uc2libGUgZm9yIGdldHRpbmcgdGhlDQo+Pj4+Pj4+Pj4+Pj4gY3Vz dG9tZXIgYW4gYXBwcm9wcmlhdGUgY3JlZGVudGlhbCB3aGVuIHRoZXkgYXNzaWduIFROcywg dGhlbg0KPj4+Pj4+Pj4+Pj4+IEkgd291bGQgZXhwZWN0ICB0aGVtIHRvIHdhbnQgdG8gZG8g c28uICBUaGF0IG1lYW5zIHRoZSBkZXZpY2VzDQo+Pj4+Pj4+Pj4+Pj4gaGF2ZSB0byBiZSBh YmxlIHRvICBzaWduLCBidXQgSSB1bmRlcnN0YW5kIG1hbnkgb2YgdGhlIFBCWA0KPj4+Pj4+ Pj4+Pj4+IHZlbmRvcnMgdGhpbmsgdGhhdCdzICBzb21ldGhpbmcgdGhleSBjb3VsZCBwcm92 aWRlIGluIGEgZnV0dXJlDQo+Pj4+Pj4+Pj4+Pj4gcmVsZWFzZS4NCj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+ICBCcmlhbg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+PiAgICAgIE9uIEF1ZyA0LCAyMDE2LCBhdCAyOjIyIFBNLCBHb3JtYW4sIFBpZXJj ZSBBIFtDVE9dDQo+Pj4+Pj4+Pj4+Pj4gICAgICA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29t DQo+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+Pj4+ Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPj4+Pj4+Pj4+ Pj4+ICAgICAgd3JvdGU6DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgIFlvdSB3 YW50IElQIFBCWGVzIHRvIHNpZ24gY2FsbHM/ICBXb24ndCB0aGF0IG1ha2UgaXQNCj4+Pj4+ Pj4+Pj4+PiAgICAgIGV4dHJhb3JkaW5hcmlseSBlYXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRo IGF1dGhlbnRpY2F0ZWQNCj4+Pj4+Pj4+Pj4+PiBudW1iZXJzPw0KPj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICpGcm9tOiogQnJpYW4gUm9zZW4gW21h aWx0bzpickBicmlhbnJvc2VuLm5ldF0NCj4+Pj4+Pj4+Pj4+PiAgICAgICpTZW50OiogQXVn dXN0IDA0LCAyMDE2IDEyOjI0IFBNDQo+Pj4+Pj4+Pj4+Pj4gICAgICAqVG86KiBHb3JtYW4s IFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20NCj4+Pj4+Pj4+Pj4+ PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+Pj4+Pj4+Pj4+PiAgICAg IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4+Pj4+Pj4+Pj4+PiAgICAg ICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0KPj4+Pj4+Pj4+Pj4+IDxt YWlsdG86YWxleEBib2JvdGVrLm5ldD4NCj4+Pj4+Pj4+Pj4+PiAgICAgIDxtYWlsdG86YWxl eEBib2JvdGVrLm5ldD4+OyBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpz dGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+Pj4+Pj4+Pj4+Pj4gICAg ICAqU3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+ Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgIEZpcnN0IG9mIGFsbCwgd2Ugd291bGQgd2Fu dCB0aGUgUEJYIHRvIGdlbmVyYXRlIHRoZQ0KPj4+Pj4+Pj4+Pj4+IHNpZ25hdHVyZSwNCj4+ Pj4+Pj4+Pj4+PiAgICAgIGJ1dCB0aGUgc2VydmljZSBwcm92aWRlciBjYW4gZG8gdGhhdC4g IEl0IHNob3VsZCBub3QgYWRkIGENCj4+Pj4+Pj4+Pj4+PiAgICAgIHZhbGlkIHNpZ25hdHVy ZSB0byBhIGNhbGwgZnJvbSBhIG51bWJlciBpdCBkaWQgbm90DQo+Pj4+Pj4+Pj4+Pj4gYXNz aWduIHRvDQo+Pj4+Pj4+Pj4+Pj4gICAgICB0aGUgdHJ1bmsgZ3JvdXAgY29ubmVjdGluZyB0 byB0aGUgUEJYLCBhbHRob3VnaCBpdCBjb3VsZA0KPj4+Pj4+Pj4+Pj4+ICAgICAgc3VwcG9y dCB0aGUgZXh0cmEgZGVsZWdhdGlvbiByZXF1aXJlZCB0byBzdXBwb3J0DQo+Pj4+Pj4+Pj4+ Pj4gImF1dGhvcml6ZWQNCj4+Pj4+Pj4+Pj4+PiAgICAgIHNwb29maW5nIi4gIFRoZSBjb21w YW5pb24gZGV2aWNlcyBJJ20gYXdhcmUgb2YgYWx3YXlzIHNlbmQNCj4+Pj4+Pj4+Pj4+PiAg ICAgIGNhbGxzIGZyb20gdGhlIHNhbWUgc2VydmljZSBwcm92aWRlciBhbmQgc2hvdWxkIG5v dCBwcmVzZW50DQo+Pj4+Pj4+Pj4+Pj4gICAgICBhbnkgaXNzdWUuDQo+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+PiAgICAgIEV2ZXJ5b25lIHdpbGwgaGF2ZSB0byBkbyB3b3JrIHRoZXkg ZG9uJ3QgZG8gbm93IHRvDQo+Pj4+Pj4+Pj4+Pj4gaW1wbGVtZW50DQo+Pj4+Pj4+Pj4+Pj4g ICAgICBzdG9wIHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTA0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+Pj4gICAgICBCcmlhbg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICBPbiBBdWcgNCwgMjAxNiwgYXQgMTI6NDEgUE0sIEdvcm1hbiwg UGllcmNlIEEgW0NUT10NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICA8UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5j b20+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmlu dC5jb20+PiB3cm90ZToNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIEZy YXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29tbW9uLiAgQW5kIGV2ZW4NCj4+Pj4+ Pj4+Pj4+PiB3aGVyZSBhDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgUEJYIGlzIG5vdCBjb21w cm9taXNlZCwgYSBjYXJyaWVyIGhhcyBubyBwcmFjdGljYWwNCj4+Pj4+Pj4+Pj4+PiB3YXkg b2YNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBrbm93aW5nIHdoZXRoZXIgdGhlIGNhbGxpbmcg bnVtYmVyIGlzIHByb3Blcmx5IGFzc2lnbmVkDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgYW5k IHZhbGlkIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHRoZSBFbnRlcnByaXNlLg0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIFRoZXJlZm9yZSwgY2hlY2tpbmcgd2hldGhlciB0aGUgY2FsbGlu ZyBudW1iZXIgd2FzDQo+Pj4+Pj4+Pj4+PiA+ZnJvbSBhbg0KPj4+Pj4+Pj4+Pj4+ICAgICAg ICAgIGFzc2lnbmVkIHJhbmdlIG1pZ2h0IGJlIHBvc3NpYmxlIChhbmQgZnJhdWdodCB3aXRo DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgYWRtaW5pc3RyYXRpdmUgY2hhbGxlbmdlcyksIGJ1 dCBvZiBsaW1pdGVkIHZhbHVlLg0KPj4+Pj4+Pj4+Pj4+IEFuZCBpbg0KPj4+Pj4+Pj4+Pj4+ ICAgICAgICAgIHRoZSBjb25zdW1lciBtYXJrZXQsIHRoZXJlIGFyZSBjYWxsaW5nIHByb2R1 Y3RzIHdoaWNoDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc3VwcG9ydCBhIHBhcmVudCBzdWJz Y3JpYmVyIG51bWJlciBhbmQgImNvbXBhbmlvbiINCj4+Pj4+Pj4+Pj4+PiBkZXZpY2VzDQo+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKGUuZy4sIHRhYmxldHMpIHdoaWNoIGNhbiBwbGFjZSBh IGNhbGwgdXNpbmcgdGhlIE1ETiBvZg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHRoZSBwYXJl bnQgc3Vic2NyaWJlci4gIFRoZXNlIGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUNCj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICBhdXRoZW50aWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyIHdv bid0IG5lY2Vzc2FyaWx5DQo+Pj4+Pj4+Pj4+Pj4gbWVhbg0KPj4+Pj4+Pj4+Pj4+ICAgICAg ICAgIHRoZSBzYW1lIHRoaW5nIGFzIHRoZSBhdXRoZW50aWNpdHkgb2YgYSBjYWxsIGZyb20g YQ0KPj4+Pj4+Pj4+Pj4+IHNpbmdsZQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHN1YnNjcmli ZXIgd2l0aCBhIHNpbmdsZSBNRE4gcmVnYXJkbGVzcyBvZiAibGF4aXR5IiBvZg0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIHNwb29mIGNoZWNraW5nLg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgSW4gYW5vdGhlciBmb3J1bSBhbmQgYW50aWNpcGF0aW5nIGNhbGxp bmcgbnVtYmVyDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgYXV0aGVudGljYXRpb24gbWFuZGF0 ZXMgZnJvbSBDb25ncmVzcyBhbmQvb3IgRkNDLCBJDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg c3VnZ2VzdGVkIHVzaW5nIGNhcnJpZXItc3BlY2lmaWMgY2VydHMgYW5kIGVuY29kaW5nDQo+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc3BlY2lmaWNpdHkgb2YgYXV0aGVudGljaXR5LCBhbmQg Y2FsbGluZyBudW1iZXIuICBUaGlzDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgcHJvdmlkZXMg dGhlIGlkZW50aXR5IG9mIHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyLCBzb21lDQo+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgaWRlYSBhcyB0byB0aGUgYWNjdXJhY3kgb3Igc3BlY2lmaWNpdHkg b2YgdGhlIGNhbGxpbmcNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBudW1iZXIsIGFuZCB2YWxp ZHR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciAoYXNzdW1pbmcNCj4+Pj4+Pj4+Pj4+PiBub25j ZQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGFuZCByZXBsYXkgaXNzdWVzIGNhbiBiZSBhZGRy ZXNzZWQgYXMgcmVhc29uYWJseQ0KPj4+Pj4+Pj4+Pj4+IHN1Z2dlc3RlZA0KPj4+Pj4+Pj4+ Pj4+ICAgICAgICAgIGJlbG93IGJ5IEFsZXgpLg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgVGhlIHJlcHJlc2VudGF0aW9uIG9mIG9yaWctY2FycmllciBhbmQgdHJ1 c3R3b3J0aGluZXNzDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgY291bGQgYmUgYXMgZm9sbG93 czoNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpSZWd1bGF0ZWQvbWFu ZGF0ZWQgQ2FycmllciBDbGFzcyBVc2UgQ2FzZToqDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAqMDAgLSBObyBDcmVkZW50aWFscyoNCj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICBVc2UgY2FzZSBleGFtcGxlKHMpOiBQcmUtSU1TLCBsZWdhY3kgY2lyY3VpdC1zd2l0 Y2hlZA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG5ldHdvcmtzIHRoYXQgZG9uJ3QgbmF0aXZl bHkgc3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3QNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBj aG9vc2UgdG8gc2lnbiBjYWxscy4gIEUuZy4sIGludGVybmF0aW9uYWwgY2FycmllcnMuDQo+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6ICBHb29kIGx1Y2suICBDYXJy aWVyX29yaWcgYW5kIENnUE4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBlbnRpcmVseSB1bnRy dXN0d29ydGh5Lg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKjAxIC0g Q2FycmllciBzaWduZWQsIG5vIGF1dGhlbnRpY2F0aW9uIG9mIENnUE4qDQo+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgVXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBvbiB2aXNpdGVkIG5ldHdv cmsgdy9vDQo+Pj4+Pj4+Pj4+Pj4gcm9hbWluZw0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGFn cmVlbWVudCwgbWFudWFsIHJvYW1pbmcuDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgVHJ1c3Qg RXN0aW1hdGU6ICBDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4NCj4+Pj4+Pj4+Pj4+ PiBlbnRpcmVseQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHVudHJ1c3R3b3J0aHkNCj4+Pj4+ Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICoxMCAtIENhcnJpZXIgc2lnbmVkLCBz ZW1pLWF1dGhlbnRpY2F0ZWQgQ2dQTioNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBVc2UgY2Fz ZSBleGFtcGxlKHMpOiBOdW1iZXIgYmxvY2sgZGVsZWdhdGVkIGZyb20NCj4+Pj4+Pj4+Pj4+ PiBPQ04sIGJ1dA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG5vIHBlci1UTiBzY3JlZW4gKFNJ UCB0cnVua3MpLg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFRydXN0IEVzdGltYXRlOiAgQ2Fy cmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BOIGxlc3MNCj4+Pj4+Pj4+Pj4+PiB0aGFuDQo+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgbW9zdCB0cnVzdHdvcnRoeSBidXQgbm90IGVudGlyZWx5 IHVudHJ1c3R3b3J0aHkuDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAq MTEgLSBDYXJyaWVyIHNpZ25lZCwgYXV0aGVudGljYXRlZCBDZ1BOKg0KPj4+Pj4+Pj4+Pj4+ ICAgICAgICAgIFVzZSBjYXNlIGV4YW1wbGUocyk6IEJyZWFkLWFuZC1idXR0ZXIgOTUlKyBv ZiBjYWxscw0KPj4+Pj4+Pj4+Pj4+IGZyb20NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBzdWJz Y3JpYmVyIGxpbmVzIChJTVMtYmFzZWQgYW5kIG90aGVyd2lzZSkuDQo+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENn UE4gbW9zdA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHRydXN0d29ydGh5DQo+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAqUHVibGljIFVzZSBDYXNlOioNCj4+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFVuZGVmaW5lZCBidXQgYXNzdW1lZCB0byB1 c2UgcHVibGljIG9yIGNvbW1lcmNpYWxseQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGF2YWls YWJsZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlcyByZXNvdXJjZXMuICBlLmcuLA0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIG5vbW9yb2JvLWxpa2UgY3Jvd2Qtc291cmNlZCBhY2NlcHQvZGVu eSBsaXN0cywgZXQNCj4+Pj4+Pj4+Pj4+PiBjZXRlcmEuDQo+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgQ291bGQvd291bGQgcGFzcyBjcmVkZW50aWFscyBkb3duIHRvIFNJUC1hd2FyZSBkZXZp Y2VzDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgd2hpY2ggd291bGQgcHJvY2VzcyB0aGVtIGFj Y29yZGluZyB0byB0aGUgcnVsZXMgb2YgdGhlDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgUHVi bGljIENsYXNzIGFwcGxpY2F0aW9uKHMpLg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgUGllcmNlDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAq RnJvbToqIEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgKlNlbnQ6KiBBdWd1c3QgMDQsIDIwMTYgOTowMiBBTQ0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICpUbzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0K Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4NCj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICpDYzoqIHN0aXJAaWV0Zi5vcmcNCj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOnN0aXJAaWV0 Zi5vcmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAq U3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBUaGVyZSBhcmUgcmVhc29uYWJsZSBjaXJj dW1zdGFuY2VzIHdoZXJlIGEgcGFydHkNCj4+Pj4+Pj4+Pj4+PiBwbGFjaW5nIGENCj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICBjYWxsIGlzIG5vdCB0aGUgYXV0aG9yaXplZCBlbnRpdHkgYXNz aWduZWQgdGhlDQo+Pj4+Pj4+Pj4+Pj4gdGVsZXBob25lDQo+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgbnVtYmVyIHVzZWQgaW4gRnJvbS9QQUksIGFuZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMg dGhlDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc2VydmljZSBwcm92aWRlciBzZXJ2aWNpbmcg dGhlIGVudGl0eSBwbGFjaW5nIHRoZQ0KPj4+Pj4+Pj4+Pj4+IGNhbGwgbWF5DQo+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgb3IgbWF5IG5vdCBiZSB0aGUgc2FtZSBhcyB0aGUgc2VydmljZSBw cm92aWRlcg0KPj4+Pj4+Pj4+Pj4+IHNlcnZpbmcgdGhlDQo+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgZW50aXR5IHRoYXQgaXMgYXNzaWduZWQgdGhlIFROLiAgSW4gYWxsIHN1Y2ggY2FzZXMs IHRoZQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVkIHRo ZSBUTiBleHBsaWNpdGx5IGF1dGhvcml6ZXMNCj4+Pj4+Pj4+Pj4+PiBjYWxscw0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIHBsYWNlZCB1c2luZyBpdCdzIFROLiAgVGhlIGRlc2lnbiBhY2Nv bW1vZGF0ZXMgc3VjaCB1c2UNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBjYXNlcy4gIEl0J3Mg bm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uIHdpdGhvdXQNCj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICBhdXRoZW50aWNhdGlvbi4gICBXZSdyZSBub3QgYXdhcmUgb2YgYW55IGNhc2VzIHdo ZXJlDQo+Pj4+Pj4+Pj4+Pj4gdGhlcmUNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBpcyBhbiBh Y3R1YWwgcmVxdWlyZW1lbnQgZm9yIGxlZ2l0aW1hdGUgY2FsbGluZyB3aXRob3V0DQo+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgZXhwbGljaXQgYXV0aG9yaXphdGlvbiBmcm9tIHRoZSBhc3Np Z25lZCBlbnRpdHksDQo+Pj4+Pj4+Pj4+Pj4gYWx0aG91Z2gNCj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICB3ZSBjZXJ0YWlubHkgYXJlIGF3YXJlIHRoYXQgdmFyaW91cyBwYXJ0cyBvZiB2YXJp b3VzDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc2VydmljZSBwcm92aWRlcnMgZG9uJ3QgYm90 aGVyIHRvIGNoZWNrLiBBdCB0aGlzDQo+Pj4+Pj4+Pj4+Pj4gcG9pbnQsIGF0DQo+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgbGVhc3QgaW4gc29tZSBjb3VudHJpZXMsIHRoZXJlIGlzIGEgcmVh bGl6YXRpb24gdGhhdA0KPj4+Pj4+Pj4+Pj4+IHRoZQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAg IGxheGl0eSBvZiBhbGxvd2luZyB1bmNoZWNrZWQgc3Bvb2ZpbmcgaXMgbm90IGFjY2VwdGFi bGUNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBhbnkgbW9yZS4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+ Pj4+Pj4+Pj4+ICAgICAgICAgIEJyaWFuDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBPbiBBdWcgMywgMjAxNiwgYXQgODozNSBBTSwg QWxleCBCb2JvdGVrDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIDxhbGV4QGJvYm90ZWsu bmV0IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4NCj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOmFs ZXhAYm9ib3Rlay5uZXQ+PiB3cm90ZToNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICAxLiAgICAgICBQZXJtaXQgYXV0aG9yaXphdGlvbiB3aXRob3V0DQo+Pj4+ Pj4+Pj4+Pj4gYXV0aGVudGljYXRpb24NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgSW4g dGhlIGN1cnJlbnQgdGVsZXBob255IG5ldHdvcmsgcHJhY3RpY2UsIHNvbWUNCj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgc2VydmljZSBwcm92aWRlciBpbXBsZW1lbnRhdGlvbnMgY2hv b3NlIG5vdCB0bw0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBhdXRoZW50aWNhdGUgaWRl bnRpdHksIGJ1dCBzaW1wbHkgZmFjaWxpdGF0ZSB0aGUNCj4+Pj4+Pj4+Pj4+PiB1c2UNCj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgb2YgYW4gYXJiaXRyYXJ5IG9yIHNlbGVjdGVkIHVz ZXItcHJvdmlkZWQgaWRlbnRpdHkuDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIEFyZSB0 aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8gIEhhcw0KPj4+Pj4+Pj4+Pj4+ IGFueW9uZQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBlc3RhYmxpc2hlZCB0aGF0IHRo ZXJlIGFyZSBub3Q/ICBIb3cgY2FuIHRoZQ0KPj4+Pj4+Pj4+Pj4+IGluZHVzdHJ5DQo+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgICAgIHJlYXNvbmFibHkgZXhwZWN0IHRvIGVuZCB0aGlzIChv ZnRlbiBiYWQpIHByYWN0aWNlPw0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBJZiBpdCBj YW4ndCBiZSBlbmRlZCwgdGhlcmUncyB2YWx1ZSBpbiBhdCBsZWFzdA0KPj4+Pj4+Pj4+Pj4+ ICAgICAgICAgICAgICBpZGVudGlmeWluZyB0aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92 aWRlcg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAoaS5lLiwgdGhlIHNpZ25lci9hdXRo b3JpemVyKS4gIEdpdmVuIHRoZQ0KPj4+Pj4+Pj4+Pj4+IHByZXZhbGVuY2UNCj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgb2YgYWJ1c2UgdXNpbmcgdGVsZXBob25lIG51bWJlcnMgYXNz aWduZWQgdG8gYQ0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzb21ldGltZXMtYW5vbnlt b3VzIGFidXNlciwgaXQgYmVjb21lcyBjcml0aWNhbGx5DQo+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgICAgIGltcG9ydGFudCB0byBpZGVudGlmeSB0aGUgc2VydmljZSBwcm92aWRlcihzKQ0K Pj4+Pj4+Pj4+Pj4+IGNsb3Nlc3QNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgdG8gdGhl IGFidXNlci4gIEJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQgaXQncw0KPj4+Pj4+Pj4+ Pj4+ICAgICAgICAgICAgICBiZXR0ZXIgdG8gSUQgc2VydmljZSBwcm92aWRlcnMgdGhhbiB1 bnJlYXNvbmFibHkNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgZXhwZWN0IGEgYmFuIG9m IHRoZSB1c2Ugb2YgdW5hdXRoZW50aWNhdGVkIChhbmQNCj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgdGhlcmVmb3JlIHVuc2lnbmVkKSBTSVAgcmVxdWVzdHMsIFNUSVIgc2lnbmluZw0K Pj4+Pj4+Pj4+Pj4+IHNob3VsZA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzdXBwb3J0 IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbi4gIFRoZQ0KPj4+Pj4+Pj4+ Pj4+ICAgICAgICAgICAgICBwcmFjdGljZSBvZiBhdXRob3JpemluZyB1bmF1dGhlbnRpY2F0 ZWQgdXNlIGV4aXN0cywNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgYW5kIHRoZXJlIGlz IGJlbmVmaXQgdG8gc2lnbmluZyBpbiB0aGVzZSBjYXNlcw0KPj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICAgICAoc2VydmljZSBwcm92aWRlciBpZGVudGlmaWNhdGlvbikuICBUaGUgbGFuZ3Vh Z2Ugb2YNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgdGhlIElEIHNob3VsZCBwZXJtaXQg dGhpcyB1c2UuICA0NDc0YmlzLTEwDQo+Pj4+Pj4+Pj4+Pj4gc2hvdWxkIE5PVA0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICAgICByZXF1aXJlIG9yIGFzc3VtZSB0aGF0ICB0aGF0IGF1dGhl bnRpY2F0aW9uIHdpbGwNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgcHJlY2VkZSBhdXRo b3JpemF0aW9uLiBPZiBjb3Vyc2UgdGhlcmUgbWF5IGJlIG90aGVyDQo+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgIHVzZSBjYXNlcyB3aGVyZSBzaWduaW5nIGluY2x1ZGVzIGF1dGhlbnRp Y2F0aW9uIGFuZA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBtYXkgbm90IGluY2x1ZGUg YSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVyJ3MNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICAgYXV0aG9yaXphdGlvbi4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgIDIuICAgICAgIEltcHJvdmUgcmVwbGF5IHByZXZlbnRpb24N Cj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgUHJveGltYXRlIHJlcGxheSBpcyBwb3NzaWJs ZSB3aGlsZSBjb21wbHlpbmcNCj4+Pj4+Pj4+Pj4+PiB3aXRoIHRoaXMNCj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICAgICAgc3BlYy4gIEZpcnN0LCBvbmUgb3IgbW9yZSBwcm94aW1hdGUgKGUu Zy4sDQo+Pj4+Pj4+Pj4+Pj4gd2l0aGluDQo+Pj4+Pj4+Pj4+Pj4gNjANCj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICAgICAgc2Vjb25kcykgU0lQIHJlcXVlc3RzIHVzaW5nIHRoZSBzYW1lIHRv a2VuIGFyZQ0KPj4+Pj4+Pj4+Pj4+IGxlZ2FsDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg IGFuZCBzdWJqZWN0IHRvIHJlcGxheSBpbiBtYW55IGNhc2VzLiAgQW4gU0RQIGJvZHkncw0K Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBta3kgbWF5IG5vdCBiZSBwcmVzZW50IGFuZCBp ZiBwcmVzZW50IGl0cyB1c2UgaXMNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgb3B0aW9u YWwuICBTb21lIHNvcnQgb2YgbWFuZGF0b3J5IG5ldyBvciBleGlzdGluZw0KPj4+Pj4+Pj4+ Pj4+ICAgICAgICAgICAgICBzaWduZWQgc2VxdWVuY2UsIHJhbmRvbSAjIG9yIHJlcXVlc3Qg SUQgKGUuZy4sDQo+Pj4+Pj4+Pj4+Pj4gQ2FsbC1JRA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAg ICAgICBvciBDU2VxKSBhbmQgYSAxLXRpbWUgdXNlIHBvbGljeSBvbiB0aGUNCj4+Pj4+Pj4+ Pj4+PiByZWNlaXZpbmcgZW5kDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIG9mIHRoZSBy ZXF1ZXN0IChlLmcuLCB0b2tlbnMgb25seSBnb29kIGZvciAxDQo+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgIHVzZSkgY291bGQgcHJldmVudCByZXBsYXkuICBEaWZmZXJlbnQgbWV0aG9k cw0KPj4+Pj4+Pj4+Pj4+IChlLmcuLA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBJTlZJ VEUgdnMgTUVTU0FHRSkgbWlnaHQgYmUgaGFuZGxlZCBieSBkaWZmZXJlbnQNCj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgcmVjZWl2aW5nIGluZnJhc3RydWN0dXJlLCBhbmQgdGhlcmVm b3JlDQo+Pj4+Pj4+Pj4+Pj4gZGlmZmljdWx0aWVzDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg ICAgIHdpdGggJ2l0J3MgYmVlbiB1c2VkIGFscmVhZHknIGNvb3JkaW5hdGlvbiBhbGxvdyBh DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGZha2VkIE1FU1NBR0UgYmFzZWQgb24gYSBj YXB0dXJlZCByZXF1ZXN0LiBUaGlzDQo+Pj4+Pj4+Pj4+Pj4gbWlnaHQNCj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICAgICAgaW5jbHVkZSBhbiBta2V5IGZyb20gYSBjYXB0dXJlZCBJTlZJVEUu ICAgU28gaXQNCj4+Pj4+Pj4+Pj4+PiBtYXkgYmUNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICAgcG9zc2libGUgdG8gRE9TLCBzcGFtIG9yIHRleHQtYm9tYiBhIHJlY2lwaWVudA0KPj4+ Pj4+Pj4+Pj4+IHVzaW5nIGENCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgY2FwdHVyZWQg aWRlbnRpdHkuICBXaGlsZSBsYXJnZS1zY2FsZSBvcg0KPj4+Pj4+Pj4+Pj4+IGRpc3RyaWJ1 dGVkDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGltcGxlbWVudGF0aW9ucyBtYXkgbWFr ZSB0aGUgZW5mb3JjZW1lbnQgZGlmZmljdWx0LA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAg ICB0aGVyZSBpcyBsaXR0bGUgY29zdCB0byBzaWduaW5nIGFuZCBkZWNvZGluZyBhDQo+Pj4+ Pj4+Pj4+Pj4gbWV0aG9kDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGFuZCBwb3NzaWJs eSBhIG51bWVyaWMgSUQuICAgU29tZSBzb3J0IG9mICcxLXVzZScNCj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgcHJhY3RpY2Ugc2hvdWxkIGF0IGxlYXN0IGJlIGRpc2N1c3NlZCB3aGls ZSBwZXJoYXBzDQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIG5vdCByZXF1aXJlZC4NCj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFNw ZWNpZmljIG1hcmt1cCBzdWdnZXN0aW9uczoNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIE5JVFMNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIFRoZSB2ZXJpZmllciBNVVNU IGluc3BlY3QgYW55IG9wdGlvbmFsICJwcHQiDQo+Pj4+Pj4+Pj4+Pj4gcGFyYW1ldGVyIGFw cGVhcmluZyAqaW4qdGhlDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICAgICAgSWRlbnRpdHkgcmVxdWVzdC4gIElmIG5vICJwcHQiIHBhcmFtZXRlciBpcw0KPj4+ Pj4+Pj4+Pj4+IHByZXNlbnQsIHRoZW4gdGhlDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICAgICAgICAgdmVyaWZpZXIgcHJvY2VlZHMgbm9ybWFsbHkgYmVsb3cuICBJ ZiBhICJwcHQiDQo+Pj4+Pj4+Pj4+Pj4gcGFyYW1ldGVyIHZhbHVlIGlzDQo+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgcHJlc2VudCwgYW5kIHRoZSB2ZXJp ZmllciBkb2VzIG5vdCBzdXBwb3J0DQo+Pj4+Pj4+Pj4+Pj4gaXQsIGl0IE1VU1QgaWdub3Jl IHRoZQ0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIElkZW50 aXR5IGhlYWRlci4gIElmIGEgc3VwcG9ydGVkICJwcHQiDQo+Pj4+Pj4+Pj4+Pj4gcGFyYW1l dGVyIHZhbHVlIGlzIHByZXNlbnQsDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICAgICAgICAgdGhlIHZlcmlmaWVyIGZvbGxvd3MgdGhlIHByb2NlZHVyZXMgYmVsb3cs DQo+Pj4+Pj4+Pj4+Pj4gaW5jbHVkaW5nIHRoZSB2YXJpYXRpb25zDQo+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgZGVzY3JpYmVkIGluIFN0ZXAgNS4NCj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICAgMw0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4gPGZpbGU6Ly8vQzovVXNlcnMvYWIzNzc4L0RvY3VtZW50cy9JRVRGL2RyYWZ0LWll dGYtc3Rpci1yZmM0NDcNCj4+Pj4+Pj4+Pj4+PiA0YmkNCj4+Pj4+Pj4+Pj4+PiBzLTEwJTIw LQ0KPj4gJTIwQXV0aGVudGljYXRlZCUyMElkZW50aXR5JTIwTWFuYWdlbWVudCUyMGluJTIw dGhlJTIwDQo+Pj4+Pj4+Pj4+Pj4gU2VzIHNpb24lMjBJbml0aWF0aW9uJTIwUHJvdG9jb2wl MjAlMjhTSVAlMjkuaHRtI3NlY3Rpb24tDQo+PiAzPi4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgICAgIEJhY2tncm91bmQNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICAgICBbLi4uXQ0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBQZXIgW1JGQzczNDANCj4+Pj4+Pj4+ Pj4+PiA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzczNDA+XSwgcHJvYmxlbXMg c3VjaCBhcw0KPj4+Pj4+Pj4+Pj4+IHJvYm9jYWxsaW5nLCB2b2ljZW1haWwgaGFja2luZywg YW5kDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgc3dhdHRp bmcgYXJlIGVuYWJsZWQgYnkgYW4gYXR0YWNrZXIncyBhYmlsaXR5DQo+Pj4+Pj4+Pj4+Pj4g dG8gaW1wZXJzb25hdGUgc29tZW9uZQ0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgICAgIGVsc2UuICBUaGUgc2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUA0K Pj4+Pj4+Pj4+Pj4+IGFwcGxpY2F0aW9ucyBhbmQgc2VydmljZXMNCj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBkZXBlbmRzIG9uIGF1dGhlbnRpY2F0aW5n IGFuZC9vciBhdXRob3JpemluZw0KPj4+Pj4+Pj4+Pj4+IHRoZSBzb3VyY2Ugb2YgY29tbXVu aWNhdGlvbnMgYXMgaXQgaXMNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAg ICAgICAgICByZXByZXNlbnRlZCBpbiBhIFNJUCByZXF1ZXN0Lg0KPj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAg ICBUaGlzIGlkZW50aXR5IGFyY2hpdGVjdHVyZSBmb3IgU0lQIGRlcGVuZHMgb24NCj4+Pj4+ Pj4+Pj4+PiBpbmNsdWRlcyBwcm92aXNpb25zIGZvciBhIGxvZ2ljYWwNCj4+Pj4+Pj4+Pj4+ Pg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICAiYXV0aGVudGljYXRpb24gc2Vydmlj ZSIgd2hpY2ggdmFsaWRhdGVzDQo+Pj4+Pj4+Pj4+Pj4gY2FsbGVyIGlkZW50aXR5IGF0IG9y IG5lYXIgb3JpZ2luYXRpb24uICBvdXRnb2luZw0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAg ICByZXF1ZXN0cy4gIEFuDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICAgICAgYXV0aGVudGljYXRpb24gc2VydmljZSBtYXkgYmUgaW1wbGVtZW50ZWQNCj4+Pj4+ Pj4+Pj4+PiBlaXRoZXIgYXMgcGFydCBvZiBhIHVzZXINCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICAgICAgICBhZ2VudCBvciBhcyBhIHByb3h5IHNlcnZlcjsgdHlw aWNhbGx5LCBpdCBpcw0KPj4+Pj4+Pj4+Pj4+IGEgY29tcG9uZW50IG9mIGEgbmV0d29yaw0K Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIGludGVybWVkaWFy eSBsaWtlIGEgcHJveHkgdG8gd2hpY2gNCj4+Pj4+Pj4+Pj4+PiBvcmlnaW5hdGluZyB1c2Vy IGFnZW50cyBzZW5kDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg ICAgdW5zaWduZWQgcmVxdWVzdHMuICBPbmNlIHRoZSBzZW5kZXIgb2YgdGhlDQo+Pj4+Pj4+ Pj4+Pj4gbWVzc2FnZSBoYXMgYmVlbg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAg IFRoaXMgZG9jdW1lbnQgc3BlY2lmaWVzIGEgbWVhbnMgb2Ygc2hhcmluZyBhDQo+Pj4+Pj4+ Pj4+Pj4gY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2UNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+ICAgICAgICAgICAgICAgICBvZiBhdXRoZW50aWNpdHkgb2YgYW5kL29yIGF1dGhvcml6 YXRpb24gdG8NCj4+Pj4+Pj4+Pj4+PiB1c2UgZW5kLXVzZXIgU0lQIGlkZW50aXR5IGluIGFu IGludGVyZG9tYWluIG9yIGludHJhZG9tYWluDQo+PiBjb250ZXh0Lg0KPj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIEl0IHJlbGllcyBvbiB0aGUgYXV0aGVu dGljYXRpb24gc2VydmljZQ0KPj4+Pj4+Pj4+Pj4+IGNvbnN0cnVjdGluZyB0b2tlbnMgYmFz ZWQgb24gWy4uLl0NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg ICAgIFRvIG1heGltaXplIGVuZC10by1lbmQgc2VjdXJpdHksIGl0IGlzDQo+Pj4+Pj4+Pj4+ Pj4gdHlwaWNhbGx5IG9idmlvdXNseQ0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgICAgIHByZWZlcmFibGUgZm9yIGVuZC11c2VycyB0byBhY3F1aXJlIHRoZWly IG93bg0KPj4+Pj4+Pj4+Pj4+IGNyZWRlbnRpYWxzOyBpZiB0aGV5DQo+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgZG8sIHRoZWlyIHVzZXIgYWdlbnRzIGNh biBhY3QgYXMNCj4+Pj4+Pj4+Pj4+PiBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlcy4gIEhvd2V2 ZXIsDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgZm9yIHNv bWUgZGVwbG95bWVudHMsIFsuLi5dDQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+ Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFJlZ2FyZHMsDQo+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgQWxleA0KPj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICAqICoNCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgKkFsZXggQm9ib3Rl ayoNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+IF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgICAgIHN0aXIgbWFpbGluZyBsaXN0DQo+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgICAgIHN0aXJAaWV0Zi5vcmcNCj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOnN0aXJAaWV0Zi5v cmc+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+ Pj4+PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tDQo+Pj4+Pj4+Pj4+Pj4gLQ0KPj4+Pj4+Pj4+Pj4+IC0NCj4+Pj4+Pj4+ Pj4+PiAtLQ0KPj4+Pj4+Pj4+Pj4+IC0tLS0tLS0NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+ICAgICAgICAgIFRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmludCBwcm9wcmlldGFy eSBpbmZvcm1hdGlvbg0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGludGVuZGVkIGZvciB0aGUg c29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55DQo+Pj4+Pj4+Pj4+Pj4gdXNlIGJ5 DQo+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgb3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBh cmUgbm90IHRoZSBpbnRlbmRlZA0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHJlY2lwaWVudCwg cGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIGFsbA0KPj4+Pj4+Pj4+Pj4+ IGNvcGllcw0KPj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG9mIHRoZSBtZXNzYWdlLg0KPj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4gX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+Pj4+IHN0 aXIgbWFpbGluZyBsaXN0DQo+Pj4+Pj4+Pj4+PiBzdGlyQGlldGYub3JnIDxtYWlsdG86c3Rp ckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vc3Rpcg0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+PiBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+Pj4+PiBzdGlyIG1haWxp bmcgbGlzdA0KPj4+Pj4+Pj4+PiBzdGlyQGlldGYub3JnIDxtYWlsdG86c3RpckBpZXRmLm9y Zz4NCj4+Pj4+Pj4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9z dGlyDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+IHN0aXIgbWFpbGluZyBsaXN0DQo+Pj4+Pj4+ PiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3N0aXINCj4+Pj4+Pg0KPj4+Pj4+ICAgIF9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4+Pj4gICAgc3RpciBtYWlsaW5nIGxp c3QNCj4+Pj4+PiAgICBzdGlyQGlldGYub3JnDQo+Pj4+Pj4gICAgaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+Pj4+Pj4NCj4+Pj4+PiAgICBfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+ICAgIHN0 aXIgbWFpbGluZyBsaXN0DQo+Pj4+Pj4gICAgc3RpckBpZXRmLm9yZw0KPj4+Pj4+ICAgIGh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4+DQo+Pj4+ Pj4NCj4+Pj4+Pg0KPj4+Pj4+DQo+Pj4+Pj4NCj4+Pj4+PiBfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KPj4+Pj4+DQo+Pj4+Pj4gVGhpcyBlLW1haWwgbWF5IGNvbnRhaW4g U3ByaW50IHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIGludGVuZGVkIGZvcg0KPj4+Pj4+IHRo ZSBzb2xlIHVzZSBvZiB0aGUgcmVjaXBpZW50KHMpLiBBbnkgdXNlIGJ5IG90aGVycyBpcyBw cm9oaWJpdGVkLg0KPj4+Pj4+IElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGll bnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kDQo+Pj4+Pj4gZGVsZXRlIGFsbCBj b3BpZXMgb2YgdGhlIG1lc3NhZ2UuDQo+Pj4+Pg0KPj4+Pj4gX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+IHN0aXIgbWFpbGluZyBsaXN0 DQo+Pj4+PiBzdGlyQGlldGYub3JnDQo+Pj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4NCj4+Pj4NCj4+Pj4gX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4gc3RpciBtYWlsaW5nIGxpc3QN Cj4+Pj4gc3RpckBpZXRmLm9yZw0KPj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3N0aXINCj4+Pj4NCj4+Pg0KPj4+IF9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4gc3RpciBtYWlsaW5nIGxpc3QNCj4+PiBz dGlyQGlldGYub3JnDQo+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9zdGlyDQo+Pg0KPj4NCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQo+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4gc3RpckBpZXRmLm9yZw0K Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+DQoNCg== From nobody Tue Aug 9 09:30:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CEC412D5FB for ; Tue, 9 Aug 2016 09:30:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TpoV_elI26vL for ; Tue, 9 Aug 2016 09:30:42 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 1E2F912D0BE for ; Tue, 9 Aug 2016 09:30:42 -0700 (PDT) Received: (qmail 18114 invoked by uid 0); 9 Aug 2016 16:30:37 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy2.mail.unifiedlayer.com with SMTP; 9 Aug 2016 16:30:37 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id V4Ra1t00q1MNPNq014RdEn; Tue, 09 Aug 2016 10:25:37 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=HLLxP2VMAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=4VJiKODVKOXx82wONCUA:9 a=V_wAfhMsku1IVoWy:21 a=gt3g2pwK2jS7i3Ay:21 a=QEXdDO2ut3YA:10 a=NWVoK91CQySWRX1oVYDe:22 a=NumKjXolQHiPR4xHErVj:22 a=w1C3t2QeGrPiZgrLijVG:22 a=5oret6oapBRfLy7jekVI:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=4bdGTHaPxfmsioka6FEiETWhbrpFaSQAJrOofUU1a0o=; b=K1kR08lOlX4fjrgHGBo73MHWwq 8nukrAFslAIssTnwFpAftGTcTrh1tH7RxlJJn5Vz+bGO+MJsHxcH9JXHnHAFSfoScH5uj2jXID9AI +wV80SLD0YNxOPcoVIMRG9TYB; Received: from [100.36.40.228] (port=52490 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bX9qQ-0001tt-RU for stir@ietf.org; Tue, 09 Aug 2016 10:25:35 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Tue, 09 Aug 2016 12:25:18 -0400 From: Richard Shockey To: "stir@ietf.org" Message-ID: Thread-Topic: [stir] STIR's basic operational model with SIP References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> In-Reply-To: <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bX9qQ-0001tt-RU X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.40.228]:52490 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 16:30:44 -0000 +1 it has to start some where. =20 The circles of trust start first with the circles of authority and then can= be delegated as requirements dictate. The integrity numbering plan is a di= rect and plenary responsibility of NRA=E2=80=99s period full stop.=20 I=E2=80=99m less confident we will ever get to the device level..at least not for= the foreeable future aka my lifetime.=20 On 8/9/16, 11:18 AM, "stir on behalf of Brian Rosen" wrote: I think we believe that is where implementations will start, but not wh= ere we will end up. =20 Many of us want to get to the point where devices sign and check and ca= rriers only delegate credentials. Might take a while to do that. =20 To get rid of robocalling, larger carriers have to push down signing re= sponsibility to smaller service providers. If they don=E2=80=99t, then they will = be left holding the bag when the authorities come. =20 All service providers can sign on behalf of their subscribers, but they= may want to shed responsibility and liability by pushing that off to the su= bscriber. But to get the whole system up and running, it will be the big gu= ys doing it for a while. =20 So I think you got the =E2=80=9Cnecessary=E2=80=9D part, but not the =E2=80=9Csufficient=E2= =80=9D part. =20 I certainly hope that SPs don=E2=80=99t strip the validation headers. There= are no protocol police however. =20 Brian =20 > On Aug 9, 2016, at 11:11 AM, Dave Crocker wrote: >=20 > Folks, >=20 > From what I've been told offline -- but which is not explicitly docum= ented in the specifications -- the intended operational framework for these = specifications is amongst a relatively small set of service providers. That= is, the community of folk who are regulated and/or used to doing business w= ith bilateral agreements. >=20 > This appears to produce an expectation of a service infrastructure fo= r STIR that is not public. That is, the query service for obtaining keys an= d key validation information will not be accessible to random users over the= open Internet. >=20 > For the SIP-based portion of the validation service, this means that = a caller or a callee with their own SIP clients will not be able to particip= ate in the validation process. >=20 > If that is not correct, would someone please explain? >=20 > If it is correct, why is that an acceptable operational choice for a = SIP service? >=20 > d/ > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Tue Aug 9 09:55:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0313F12D847 for ; Tue, 9 Aug 2016 09:55:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wuqd2DUrxSvG for ; Tue, 9 Aug 2016 09:55:43 -0700 (PDT) Received: from resqmta-po-09v.sys.comcast.net (resqmta-po-09v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:168]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9625812D78D for ; Tue, 9 Aug 2016 09:55:40 -0700 (PDT) Received: from resomta-po-01v.sys.comcast.net ([96.114.154.225]) by resqmta-po-09v.sys.comcast.net with SMTP id XAJYbV1FoS0FEXAJYb6vAS; Tue, 09 Aug 2016 16:55:40 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by comcast with SMTP id XAJUb9EjXNu4RXAJVbMCXg; Tue, 09 Aug 2016 16:55:40 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Tue, 9 Aug 2016 09:40:52 -0700 From: Alex Bobotek To: Paul Kyzivat , "Peterson, Jon" , "Gorman, Pierce A [CTO]" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Date: Tue, 9 Aug 2016 09:40:52 -0700 Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AdHyUuDkq1wH2/qdTvO1SDPrAPpGYAABmKgA Message-ID: <4B1956260CD29F4A9622F00322FE053101285D016E37@BOBO1A.bobotek.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> In-Reply-To: <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CMAE-Envelope: MS4wfGo3e2sDOVqJiE1csku2XoA0gu6nxVMcMJIFpWnuRsuMci4njXPnA5EmfnBh6Idhu5Tfr6s6rB36ZHoYtR022cc466lurYW3sgh+55lZz05OwoMIkUgv pAQg0TBZRECV4Rv8T+9YuLB8GNBqsxazBPodxb0iCU5H5skD/WEKpymCvid6X4Nxbi+CJdnRBI5GfvxjMwjTm/uDbEMcf3CCms6dLgxf7H/A91fhJf8XAz1m O7vNJDaeqaE03NlSz8jUb85IuQK6BBIUCzSWB1gv1h0+KUNPctCs0yFW3rVG2n2raA47nh4ReXo5TPnaBYTwlbb2s7Zc6i6SzluVjIRua0Lg9Shk/e05PxM9 lfbx+A8Fqt+oWP8Atgmr4BIM493Yb4TqEkJuSN5LYytVaf+646zuiLo7FRbtJ/FpOvpWlxYq1c/QlZOYDb65dAfK+uyMEw== Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 16:55:48 -0000 Paul, The assertion I'm referring to is a bit different. It's: "I (Acme Corp), certify that this message originated and or gatewayed to SI= P on my network, (and btw, I probably know which account/user actually orig= inated this message and take responsibility for its origination or gatewayi= ng)" Is this a good thing? Yes and no. From a security perspective I believe w= e all agree that it's best to have the (possibly delegated) authority of th= e rightful owner of the originating phone number as well as the identity of= the responsible originating service provider (typically the signer). But = this goal will be elusive; there are cases where even a well-meaning a serv= ice provider may not be able to enforce or determine whether the owner of a= n originating number has authorized its use. In these cases, there is hig= h value in knowing the identity of a signer claiming some responsibility fo= r the call's origination. The carriers' abuse desks and systems then know = who to contact for abuse mitigation. The con to this is that some signers may be lazy, and elect to sign while o= mitting or not enforcing number authority policies in cases where they coul= d. So IMO the right question to ask is whether the pros outweigh the cons. IH= MO, the answer is an emphatic yes. Regards, Alex > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: Tuesday, August 9, 2016 8:44 AM > To: Alex Bobotek ; Peterson, Jon > ; Gorman, Pierce A [CTO] > ; Dwight, Timothy M (Tim) > ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; > Richard Shockey ; stir@ietf.org; Brian Rosen > > Subject: Re: [stir] STIR 4474bis-10 comments > > On 8/9/16 5:03 AM, Alex Bobotek wrote: > > Jon, > > > > Thanks much for your thoughtful response to the original points. Yes, > things got somewhat sidetracked. > > > > On the first point (signing without authentication), I do not read 6.1 > > as permitting "I'm signing to assert that I've authorized use of this > > phone number without authenticating the caller and/or completing a > > number delegation authority check", > > I'm not sure I understand. Is this the assertion you are asking for? > > "I (Acme Corp), having administrative authority over number NNN, certify > that this message is "from" NNN, though I have no idea who actually > originated this message." > > This is a good thing??? > > If you sign the message you are taking responsibility for the assertion t= hat it > is from NNN. If you choose to do so without knowing who it is from then t= hat > is your problem. You should be legally liable. At the very least your rep= utation > as a signer should be diminished as fraudulent calls you have signed are > detected. Eventually you will be put on blacklists as an untrustworthy si= gner. > > I guess we could speed the blacklisting by allowing signers to pre-declar= e that > they are untrustworthy. (That seems to be what you are asking for.) > > > a use case that reflects the currently-widespread practice of authoriza= tion > without authentication. > > No wonder we have a problem with spoofed calls. > > Thanks, > Paul > > > My read of section 6.1 is that it allows anonymity rather than signer- > attribution with unauthenticated (non-anonymous) caller identity. Knowin= g > the triple of purported calling phone number that flashes on a recipient'= s > phone, the terminating phone number and a timestamp is important in > reporting/tracing/mitigating abusive calls. [On a side note, I reread Se= ction > 11, but had trouble with the definition of "private URI" (note: "private= URI" > and "private SIP URI" each occur exactly once each in the doc and could > benefit from a definition or two).] Additionally, Brian Rosen's comment= on > 8/4 seems to corroborate my reading of a ban on authorization without > authentication in the non-anonymous case (i.e., that using someone else's > phone number requires that "the entity that is assigned the TN explicitly > authorizes calls placed using it's TN"). > > > > In summary, there is a high value in allowing signing/authorization in = the > categories and use cases Pierce outlined. In my operational experience, = it > really helps to know which company to contact to get the callers kicked o= ff a > network. And signer attribution even without caller authentication is a = huge > win for the public. > > > > > > > > On the second point, thanks for pointing out that 12.1 requires servers= to > keep the state of recently received requests. This is a point that I mis= sed in > my reading of the draft, and this feature as you have described it defeat= s > most conceivable replay attacks. My bad for missing this, but as you sug= gest, > there may be some potential for emphasizing this point. But there's anot= her > part of the issue -- cross method replay. For example, it may be difficu= lt to > expect a messaging node (which handles SIP MESSAGE) and a voice-capable > IMS node (handling SIP INVITE) to coordinate their anti-replay caches, > allowing an attacker that observes a SIP invite for a voice call to piggy= back a > spam text message. As it's common to use the same "To" address for > multiple services that may be served by very different infrastructure > components, it would be beneficial to allow signatures to cover more than > "To", "From/PAI" and "Timestamp". I do not see this issue as meriting > significant delay of a STIR RFC if there's no quick fix. > > > > Regards, > > > > Alex > > > >> -----Original Message----- > >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon > >> Sent: Monday, August 8, 2016 12:46 PM > >> To: Gorman, Pierce A [CTO] ; Paul Kyzivat > >> ; Dwight, Timothy M (Tim) > >> ; DOLLY, MARTIN C > >> Cc: Rosbotham, Paul, Vodafone UK ; > >> Richard Shockey ; stir@ietf.org; Brian Rosen > >> > >> Subject: Re: [stir] STIR 4474bis-10 comments > >> > >> > >> Just so I'm clear, I'm not hearing an ask here in terms of changing > >> the text of rfc4474bis-10, which does allow signing PAI instead of > >> From for precisely the reasons outlined in this lengthy thread. To > >> Alex's original point about providing authorization without > >> authentication, rfc4474bis has a lot of text about signing non-TN > >> identifiers, including for preserving anonymity; see the end of > >> section 6.1, and then the Privacy Considerations in section 11 for > >> more. Those should suffice to provide this property: it will identify = the > service provider who signed without attesting an specific user identity. > >> > >> I also wanted to make sure we didn't drop the other ball that Alex > >> mentioned at the start of this thread, which is the issue of > >> proximate replay within the 60 second Date window. This is addressed > >> in Section 12.1 of rfc4474bis-10, which > >> reads: "Note that per baseline [RFC3261] behavior, servers keep state > >> of recently received requests, and thus if an Identity header is > >> replayed by an attacker within the Date interval, verifiers can > >> detect that it is spoofed because a message with an identical Date > >> from the same source had recently been received." This refers to the > >> text of > >> RFC3261 section 23.4.2, though more properly the Date-related > >> behavior is better detailed in RFC3893 Section 10, which introduced > >> the first version of the partial signature mechanism that ultimately > >> inspired RFC4474. I'll update the text here so it is clearer about exa= ctly > how to detect proximate replay. > >> > >> Jon Peterson > >> Neustar, Inc. > >> > >> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" > >> wrote: > >> > >>> Paul, > >>> > >>> As you know, SIP inter-working is often challenging because of > >>> variability in implementation including proprietary headers (without > >>> an > >>> X-) and support or lack thereof for non-mandatory (per RFC 3261) > >>> headers such as P-Asserted-Identity, (and things like B2BUA stacks > >>> stripping things like display name in From but that's another story). > >>> I could argue that from a cleanliness of protocol implementation, > >>> (and if I wanted to be pedantic), I would strip PAI outbound unless > >>> required otherwise. But the point is moot. As I mentioned in the > >>> earlier e-mail, that is not our practice and I'm not requesting it to= be so. > >>> > >>> Pierce > >>> > >>> > >>> -----Original Message----- > >>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > >>> Sent: August 08, 2016 12:03 PM > >>> To: Gorman, Pierce A [CTO] ; Dwight, > >> Timothy > >>> M > >>> (Tim) ; DOLLY, MARTIN C > >> > >>> Cc: Rosbotham, Paul, Vodafone UK ; > >> Richard > >>> Shockey ; stir@ietf.org; Brian Rosen > >>> > >>> Subject: Re: [stir] STIR 4474bis-10 comments > >>> > >>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: > >>>> Thanks for the added comments Tim. > >>>> > >>>> I agree that passing P-Asserted-Identity between trusted networks > >>>> is appropriate (and the converse is true as well). Part of my > >>>> issue is I have been conditioned from the very earliest > >>>> implementation of Sprint's VoIP network that other carriers' IP > >>>> networks are inherently untrusted. I've been browsing TS 29.165 > >>>> and even there I find language that implies trust is established by > >>>> agreement, not by standard. (Even roaming implies agreement.) > >>> > >>> I understand why *some* stuff needs to be removed when forwarding > to > >> an > >>> untrusted party. For instance, if the call has requested privacy, > >>> then P-A-ID needs to be removed. > >>> > >>> But when privacy is not a concern, trust is really more of a concern > >>> on the ingress side, not egress. If I don't trust you then I won't > >>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I > >>> trust you, but you don't trust me, then what is the downside for > >>> passing along the P-A-ID? > >>> > >>> Thanks, > >>> Paul > >>> > >>>> Regardless, this discussion has been helpful and educational (to me > >>>> at least). And, I confirmed with my operations counterpart we > >>>> generally send PAI today. I've also made note that where standards > >>>> and > >> ICA > >>>> require it, we will include PAI. Thanks again. > >>>> > >>>> Best regards, > >>>> > >>>> Pierce > >>>> > >>>> -----Original Message----- > >>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] > >>>> Sent: August 08, 2016 10:47 AM > >>>> To: Gorman, Pierce A [CTO] ; DOLLY, > >> MARTIN > >>>> C > >>>> Cc: Rosbotham, Paul, Vodafone UK ; > >>>> Richard Shockey ; Paul Kyzivat > >>>> ; stir@ietf.org; Brian Rosen > >>>> > >>>> Subject: RE: [stir] STIR 4474bis-10 comments > >>>> > >>>> Pierce, > >>>> > >>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and > >> GSMA > >>>> IR.95. The latter references and profiles the former. Section > >>>> 4.4.1 of > >>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be > >>>> considered trusted, and table 3 in that section recommends that > >>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. > >>>> It also states that PAI is mandatory at a roaming NNI. > >>>> > >>>> Tim > >>>> > >>>> > >>>> -----Original Message----- > >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, > >>>> Pierce A [CTO] > >>>> Sent: Monday, August 08, 2016 8:52 AM > >>>> To: DOLLY, MARTIN C > >>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; > >>>> stir@ietf.org; Brian Rosen > >>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments > >>>> > >>>> Martin, > >>>> > >>>> You referenced TS 29.195. I'm not familiar with that spec. Has it > >>>> been deprecated? It's not showing up on the 3GPP site. > >>>> > >>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the > >>>> originating side" Note 4 it states, " It is assumed that the IBCF > >>>> is responsible for stripping the P-Asserted-Identity from the SIP > >>>> header when interworking with untrusted networks." > >>>> > >>>> Your remark is consistent with Note 4, but only if we agree that, > >>>> for instance, the AT&T network and the Sprint network are "trusted > >>>> networks". In reality, this is not the case or there would be no > >>>> firewalls or Session Border Controllers used for interworking and > >>>> security. My opinion is the only carrier networks that are trusted > >>>> are the SS7 network, and the Internet backbone. > >>>> > >>>> What it really comes down to is that PAI is left in signaling > >>>> either through formal specification as a part of an inter-carrier > >>>> inter-connection agreement, or by custom (or even by accident). I > >>>> think this illustrates Paul Rosbotham's observation is true. > >>>> > >>>> Pierce > >>>> > >>>> -----Original Message----- > >>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] > >>>> Sent: August 05, 2016 12:55 PM > >>>> To: Gorman, Pierce A [CTO] > >>>> Cc: Rosbotham, Paul, Vodafone UK ; > >> Brian > >>>> Rosen ; stir@ietf.org; Paul Kyzivat > >>>> ; Richard Shockey > >>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>> > >>>> PAI is not stripped at the network boundary between trusted > >>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force > >>>> ITU And the list goes on > >>>> > >>>> Martin C Dolly > >>>> Lead Member of Technical Staff > >>>> Core & Government/Regulatory Standards AT&T > >>>> Cell: 609-903-3360 > >>>> Email: md3135@att.com > >>>> > >>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] > >>>>> wrote: > >>>>> > >>>>> Which header the carrier chooses to display is moot if the header > >>>>> is stripped between carriers as per at least one standard. I > >>>>> think Paul Rosbotham's observation we're likely to encounter "some > >>>>> interesting interworking challenges" was perhaps the > understatement of the year. > >>>>> > >>>>> Pierce > >>>>> > >>>>> -----Original Message----- > >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > >>>>> Sent: August 05, 2016 11:58 AM > >>>>> To: Gorman, Pierce A [CTO] ; Richard > >>>>> Shockey ; Rosbotham, Paul, Vodafone UK > >>>>> ; Brian Rosen > > >>>>> Cc: stir@ietf.org > >>>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>>> > >>>>> If PAI is present and signed, and From is also signed, I would > >>>>> expect it to be up to the UA to decide what to display, not the car= rier. > >>>>> > >>>>> Of course this will work differently if there is a different > >>>>> signaling regime between the carrier and the user device (e.g. > >>>>> black > >> phone). > >>>>> > >>>>> Thanks, > >>>>> Paul > >>>>> > >>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > >>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP > >>>>>> entities" and therefore some specifications (e.g., 3GPP TS > >>>>>> 24.607) assume P-Asserted-Identity is stripped by border > >>>>>> controller functions and is not to be used in inter-carrier > >>>>>> inter-connection (although it commonly shows up anyway). My > opinion is the "From" > >>>>>> header is likely used more often for presentation. > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> > >>>>>> -----Original Message----- > >>>>>> From: Richard Shockey [mailto:richard@shockey.us] > >>>>>> Sent: August 05, 2016 9:37 AM > >>>>>> To: Rosbotham, Paul, Vodafone UK > >> ; > >>>>>> Paul Kyzivat ; Brian Rosen > >>>>>> > >>>>>> Cc: stir@ietf.org > >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> > >>>>>> Humm this is getting interesting. Its my understanding that the > >>>>>> display number aka "presentation number" in the US context is the > >>>>>> one carried in the PAI. Martin, Pierce? > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone > UK" > >>>>>> paul.rosbotham@vodafone.com> > >> wrote: > >>>>>> > >>>>>> Jumping in now that we're on European working time, +1 on > >>>>>> Paul's observation. > >>>>>> > >>>>>> Here in the UK, we've got 2 numbers carried as calling line > >>>>>> IDs....one (we term the Network Number, carried in PAID) uniquely > >>>>>> identifies the line, the other (we term Presentation Number, > >>>>>> carried in From) is used for display purposes. > >>>>>> > >>>>>> Only the carrier has the authority to set the Network Number > >>>>>> so only they could sign it. > >>>>>> > >>>>>> But - subject to regulatory restrictions which are well > >>>>>> documented > >>>>>> - the number sent for display purposes belongs to the customer. > >>>>>> For blue-chip customers, I can allow them to send their > >>>>>> Presentation Numbers into the network, and can't readily check at > >>>>>> a network level that they're theirs (I do have contractual > >>>>>> safeguards). The number may have been allocated by me, or could > >>>>>> be allocated by a third party provider. If it's a call-centre > >>>>>> they'll be making outbound calls for lots of different customers > >>>>>> which will change on day-by-day > >> basis. > >>>>>> This is business as usual. I don't like the term "authorised > >>>>>> spoofing" because it implies that the CLI is in some way being rig= ged: > >>>>>> it's not, it's the corporate customer or their subcontractor > >>>>>> using the number that's been assigned (so in internet terms > >>>>>> delegated) to them via a chain of trust from the regulator. > >>>>>> > >>>>>> What I want is the ability for customers to use their > >>>>>> credentials to sign the CLIs they send me so that at the > >>>>>> terminating end it can be checked (or indeed somewhere en-route > >>>>>> if that's the business model). > >>>>>> I can and would sign for customers on my mobile business since > >>>>>> I'm driving what number is presented, but that's by-the-by > >>>>>> because they aren't the ones who generate millions of nuisance > >>>>>> calls. If the signing only occurs at the originating carrier > >>>>>> level for corporate/call-centre customers that's no use because > >>>>>> I'm not in a position to do that for these type of > >>>>>> customers...and the whole system becomes a waste of time. I'd > >>>>>> also highlight there are many more of my large customers that I'd > >>>>>> trust more than a far end originating carrier that could be > >>>>>> anywhere in the world (though we have no shortage of small > >>>>>> carriers that I wouldn't know from Adam more locally in the > >>>>>> UK....) > >>>>>> > >>>>>> Regards > >>>>>> > >>>>>> Paul > >>>>>> > >>>>>> -----Original Message----- > >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyz= ivat > >>>>>> Sent: 04 August 2016 23:12 > >>>>>> To: Brian Rosen > >>>>>> Cc: stir@ietf.org > >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: > >>>>>>> I think it's not a delegation. The mobile phone is not being > >>>>>>> delegated the TN, it's being authorized to place calls that are > >>>>>>> not > >>>>>> >from that TN, but appear to be. > >>>>>>> > >>>>>>> The mechanism to handle the credential is exactly the same as a > >>>>>>> delegation, so if you want to call it delegation, go ahead, but > >>>>>>> I prefer to call it authorized spoofing. > >>>>>> > >>>>>> IIUC the delegation is to a responsible entity (something that > >>>>>> can be held legally accountable - e.g. a person), not to a device. > >>>>>> The entity can then "use" the credential via any device(s) it > >>>>>> chooses. In the case of the mobile, the device then becomes a > >>>>>> two-line > >> phone. > >>>>>> > >>>>>> Thanks, > >>>>>> Paul > >>>>>> > >>>>>>> Brian > >>>>>>> > >>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat > >>>>>>>> > >>>>>>>> wrote: > >>>>>>>> > >>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: > >>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is > >>>>>>>>> calling from his mobile, but sending the TN of his office > >>>>>>>>> phone as calling party. > >>>>>>>>> The delegation to his office phone was made by his landline > >>>>>>>>> carrier to him. He then creates another credential, which he > >>>>>>>>> signs with his office phone credential that authorizes his > >>>>>>>>> mobile to send calls from his office number. He is spoofing > >>>>>>>>> (because the call is coming from his mobile's TN but claims to > >>>>>>>>> be from his office), but it's authorized spoofing. The doc > >>>>>>>>> could give the credential to his mobile SP if they sign on his > behalf. > >>>>>>>> > >>>>>>>> I don't understand how that is different from regular delegation= . > >>>>>>>> > >>>>>>>> When his landline carrier gave him a delegated certificate for > >>>>>>>> his landline number, he should be able to install that in > >>>>>>>> whatever devices he wants - his landline UA, his mobile phone, > >>>>>>>> etc. It is still delegated from his landline carrier, even when > >>>>>>>> used with calls via his mobile carrier. > >>>>>>>> > >>>>>>>> Thanks, > >>>>>>>> Paul > >>>>>>>> > >>>>>>>>> Some folks don't like attaching the "spoofing" label to a > >>>>>>>>> legitimate use. > >>>>>>>>> > >>>>>>>>> But that's how I describe it. > >>>>>>>>> > >>>>>>>>> Brian > >>>>>>>>> > >>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat > >>>>>>>>>> > > wrote: > >>>>>>>>>> > >>>>>>>>>> +1, but with one question below: > >>>>>>>>>> > >>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > >>>>>>>>>>> I think all we need is to have credentials follow the > >>>>>>>>>>> delegation path, > >>>>>>>>>> > >>>>>>>>>>> plus the option to add another level (not delegation) for > >>>>>>>>>>> authorized spoofers. > >>>>>>>>>> > >>>>>>>>>> I don't understand "authorized spoofers" in this context, as > >>>>>>>>>> contrasted to "spoofers" who have been delegated their > >> authority. > >>>>>>>>>> > >>>>>>>>>> Thanks, > >>>>>>>>>> Paul > >>>>>>>>>> > >>>>>>>>>>> I don't think it matters who the delegator or delegatee are > >>>>>>>>>>> as long as the delegator is willing to take the heat for > >>>>>>>>>>> delegating to someone who sends a lot of bad calls. They > >>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm > >>>>>>>>>>> not responsible"), but only if the SP knows who they > >>>>>>>>>>> delegated to, so authorities can follow the delegation path. > >>>>>>>>>>> There are plenty of certificated carriers who are willing to > >>>>>>>>>>> not care who they delegate to. The fact that there are some > >>>>>>>>>>> who do doesn't change much. > >>>>>>>>>>> Making stir work means knowing who you are delegating to, > so > >>>>>>>>>>> that you can pass the hot potato. > >>>>>>>>>>> > >>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign > >>>>>>>>>>> for any calls placed on its network on any number it has > >>>>>>>>>>> been delegated. > >>>>>>>>>>> If it does, it's asserting that the calls are from who they > >>>>>>>>>>> are supposed to be from. > >>>>>>>>>>> That should be straightforward, but we know it's not always, > >>>>>>>>>>> and that represents the hard part of deployment in my > opinion. > >>>>>>>>>>> But once they delegate, they can hand responsibility to sign > >>>>>>>>>>> to the delegatee. But, that only works if they know who > >>>>>>>>>>> they are delegating to. > >>>>>>>>>>> > >>>>>>>>>>> The root of the whole model is that there is a formal or > >>>>>>>>>>> informal delegation path for telephone numbers in every > >>>>>>>>>>> country, and we can build a chain of trust from that > >>>>>>>>>>> delegation path. If you propose to alter that model, then > >>>>>>>>>>> we get into > >>>>>>>>>>> (policy) issues of which carriers/entities we trust and > >>>>>>>>>>> which we don't. > >>>>>>>>>>> Our model is that you know who you delegate to, and once > you > >>>>>>>>>>> do that delegation, it's their problem. > >>>>>>>>>>> That's pretty appealing I think, even if it's a change in > >>>>>>>>>>> some business practices. > >>>>>>>>>>> > >>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI and > >>>>>>>>>>> having a way to know which TNs are covered by a credential. > >>>>>>>>>>> That's what we have, and I'm loath to change it. > >>>>>>>>>>> > >>>>>>>>>>> Brian > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >> > >>>>>>>>>>>> > > >>>>>>>>>>>> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> OK, you talked me into indulging in one more message on > >>>>>>>>>>>> policy and use cases. > >>>>>>>>>>>> > >>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be > deployed > >>>>>>>>>>>> on individual devices as well as multi-device and > >>>>>>>>>>>> multi-number platforms. > >>>>>>>>>>>> > >>>>>>>>>>>> Number delegation (and sub-delegation), and business > >>>>>>>>>>>> relationships are two additional factors which affect > >>>>>>>>>>>> trustworthiness of a given calling number authentication. > >>>>>>>>>>>> > >>>>>>>>>>>> Inherent variable trustworthiness of a calling number was > >>>>>>>>>>>> my reason for suggesting a way to qualify the signature to > >>>>>>>>>>>> reflect that variability. > >>>>>>>>>>>> > >>>>>>>>>>>> Originating carriers are in a position to know if a call is > >>>>>>>>>>>> coming from a device assigned a single number, or from > >>>>>>>>>>>> "trunk group" which could originate calls using multiple > >>>>>>>>>>>> numbers, and can qualify to some degree the > trustworthiness > >>>>>>>>>>>> of number authenticity accordingly. > >>>>>>>>>>>> > >>>>>>>>>>>> My suggestion was qualifying calling number authenticity > >>>>>>>>>>>> into categories of carrier-signed (or not), and > >>>>>>>>>>>> unauthenticated, semi-authenticated, and > >>>>>>>>>>>> most-authenticated. There can be > >> more > >>>>>>>>>>>> granularity, but it implies additional operational > >>>>>>>>>>>> complexity (both for the carriers and the consumers) and I > >>>>>>>>>>>> assume diminishes value. > >>>>>>>>>>>> > >>>>>>>>>>>> My reason for adding the authenticity of the originating > >>>>>>>>>>>> carrier is typical trustworthiness of a carrier business > >>>>>>>>>>>> relationship with typical consumers adds to the > >>>>>>>>>>>> trustworthiness assessment and partially because carriers > >>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and frau= d. > >>>>>>>>>>>> Additionally, most calls originate and terminate between > >>>>>>>>>>>> mobile consumers where their carriers are able to usefully > >>>>>>>>>>>> authenticate their device and have a high degree of > >>>>>>>>>>>> confidence of the authenticity of the calling number. > >>>>>>>>>>>> > >>>>>>>>>>>> I think billions of per-TN certs of varying usability > >>>>>>>>>>>> (revoked, not > >>>>>>>>>>>> revoked) for authenticating calling number will not work > well. > >>>>>>>>>>>> > >>>>>>>>>>>> Conversely, I think billions of per-TN certs will work > >>>>>>>>>>>> well, if the calling party has to sign a call with a per-TN > >>>>>>>>>>>> cert provided by the called party. No called party cert to > include? > >>>>>>>>>>>> Then the calling party does not have a trusted relationship > >>>>>>>>>>>> with the called party, and the call can be > >>>>>>>>>>>> authorized/treated accordingly. > >>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) > >>>>>>>>>>>> > >>>>>>>>>>>> Pierce > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM > >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; > >>>>>>>>>>>> stir@ietf.org > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> Well, the mechanisms are designed so that they could be > >>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a > >>>>>>>>>>>> policy issue. > >>>>>>>>>>>> > >>>>>>>>>>>> The notion of credentials that are traceable to a > >>>>>>>>>>>> delegation of a TN is a mechanism that is part of the > >>>>>>>>>>>> design of stir, and the design allows delegation of one TN > >>>>>>>>>>>> (to one device, although a device like a PBX would have > >>>>>>>>>>>> more than one TN per "device", and something like a dual > >>>>>>>>>>>> NAM phone could have > >> more > >>>>>>>>>>>> than one credential. For the use case we've discussed, a > >>>>>>>>>>>> mobile phone may also have a credential for, say, a TN that > >>>>>>>>>>>> is delegated to a landline, to cover the example case of a > >>>>>>>>>>>> doctor placing a call on his mobile, but getting his office > >>>>>>>>>>>> number to show up as the calling party. Use of such > mechanisms is policy. > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >> > >>>>>>>>>>>> > > >>>>>>>>>>>> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy > >>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. > >>>>>>>>>>>> I would like to continue the discussion, but I'm pretty > >>>>>>>>>>>> sure this isn't the right forum. > >>>>>>>>>>>> > >>>>>>>>>>>> Pierce > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM > >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; > >>>>>>>>>>>> stir@ietf.org > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart > >>>>>>>>>>>> phones and any other devices that can be programmed to > do > >> so. > >>>>>>>>>>>> They will be given credentials that only are valid for the > >>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign > >>>>>>>>>>>> any call, but the validity of the credential would make > >>>>>>>>>>>> such a signature fail the checking. > >>>>>>>>>>>> > >>>>>>>>>>>> Getting service providers to sign on behalf of devices is > >>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs > >>>>>>>>>>>> will want to get out of the liability of signing on behalf > >>>>>>>>>>>> of their customers. If they can push of that > >>>>>>>>>>>> responsibility to their customer, only being responsible > >>>>>>>>>>>> for getting the customer an appropriate credential when > >>>>>>>>>>>> they assign TNs, then I would expect them to want to do > >>>>>>>>>>>> so. That means the devices have to be able to sign, but I > >>>>>>>>>>>> understand many of the PBX vendors think that's something > >>>>>>>>>>>> they could provide in a future release. > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it > >>>>>>>>>>>> extraordinarily easy to commit fraud with > >>>>>>>>>>>> authenticated numbers? > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM > >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> > >>>>>>>>>>>> >; stir@ietf.org > >>>>>>>>>>>> > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> First of all, we would want the PBX to generate the > >>>>>>>>>>>> signature, > >>>>>>>>>>>> but the service provider can do that. It should not ad= d a > >>>>>>>>>>>> valid signature to a call from a number it did not > >>>>>>>>>>>> assign to > >>>>>>>>>>>> the trunk group connecting to the PBX, although it coul= d > >>>>>>>>>>>> support the extra delegation required to support > >>>>>>>>>>>> "authorized > >>>>>>>>>>>> spoofing". The companion devices I'm aware of always > send > >>>>>>>>>>>> calls from the same service provider and should not > present > >>>>>>>>>>>> any issue. > >>>>>>>>>>>> > >>>>>>>>>>>> Everyone will have to do work they don't do now to > >>>>>>>>>>>> implement > >>>>>>>>>>>> stop spoofed calls. TANSTAAFL > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> > wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> Fraud from compromised PBXes is common. And even > >>>>>>>>>>>> where a > >>>>>>>>>>>> PBX is not compromised, a carrier has no practical > >>>>>>>>>>>> way of > >>>>>>>>>>>> knowing whether the calling number is properly > assigned > >>>>>>>>>>>> and valid from the perspective of the Enterprise. > >>>>>>>>>>>> Therefore, checking whether the calling number was > >>>>>>>>>>> >from an > >>>>>>>>>>>> assigned range might be possible (and fraught with > >>>>>>>>>>>> administrative challenges), but of limited value. > >>>>>>>>>>>> And in > >>>>>>>>>>>> the consumer market, there are calling products whi= ch > >>>>>>>>>>>> support a parent subscriber number and "companion" > >>>>>>>>>>>> devices > >>>>>>>>>>>> (e.g., tablets) which can place a call using the MD= N of > >>>>>>>>>>>> the parent subscriber. These are examples of where > the > >>>>>>>>>>>> authenticity of the calling number won't > >>>>>>>>>>>> necessarily mean > >>>>>>>>>>>> the same thing as the authenticity of a call from > >>>>>>>>>>>> a single > >>>>>>>>>>>> subscriber with a single MDN regardless of "laxity"= of > >>>>>>>>>>>> spoof checking. > >>>>>>>>>>>> > >>>>>>>>>>>> In another forum and anticipating calling number > >>>>>>>>>>>> authentication mandates from Congress and/or FCC, I > >>>>>>>>>>>> suggested using carrier-specific certs and encoding > >>>>>>>>>>>> specificity of authenticity, and calling number. T= his > >>>>>>>>>>>> provides the identity of the originating carrier, s= ome > >>>>>>>>>>>> idea as to the accuracy or specificity of the calli= ng > >>>>>>>>>>>> number, and validty of the calling number > >>>>>>>>>>>> (assuming nonce > >>>>>>>>>>>> and replay issues can be addressed as reasonably > >>>>>>>>>>>> suggested > >>>>>>>>>>>> below by Alex). > >>>>>>>>>>>> > >>>>>>>>>>>> The representation of orig-carrier and trustworthin= ess > >>>>>>>>>>>> could be as follows: > >>>>>>>>>>>> > >>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* > >>>>>>>>>>>> > >>>>>>>>>>>> *00 - No Credentials* > >>>>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switch= ed > >>>>>>>>>>>> networks that don't natively support SIP or which d= on't > >>>>>>>>>>>> choose to sign calls. E.g., international carriers= . > >>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN > >>>>>>>>>>>> entirely untrustworthy. > >>>>>>>>>>>> > >>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* > >>>>>>>>>>>> Use case example(s): E911 on visited network w/o > >>>>>>>>>>>> roaming > >>>>>>>>>>>> agreement, manual roaming. > >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN > >>>>>>>>>>>> entirely > >>>>>>>>>>>> untrustworthy > >>>>>>>>>>>> > >>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* > >>>>>>>>>>>> Use case example(s): Number block delegated from > >>>>>>>>>>>> OCN, but > >>>>>>>>>>>> no per-TN screen (SIP trunks). > >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN > >>>>>>>>>>>> less than > >>>>>>>>>>>> most trustworthy but not entirely untrustworthy. > >>>>>>>>>>>> > >>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* > >>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of > >>>>>>>>>>>> calls from > >>>>>>>>>>>> subscriber lines (IMS-based and otherwise). > >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN mos= t > >>>>>>>>>>>> trustworthy > >>>>>>>>>>>> > >>>>>>>>>>>> *Public Use Case:* > >>>>>>>>>>>> > >>>>>>>>>>>> Undefined but assumed to use public or commercially > >>>>>>>>>>>> available authentication services resources. e.g., > >>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et > >>>>>>>>>>>> cetera. > >>>>>>>>>>>> Could/would pass credentials down to SIP-aware > devices > >>>>>>>>>>>> which would process them according to the rules of = the > >>>>>>>>>>>> Public Class application(s). > >>>>>>>>>>>> > >>>>>>>>>>>> Pierce > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM > >>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* stir@ietf.org > >>>>>>>>>>>> > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> There are reasonable circumstances where a party > >>>>>>>>>>>> placing a > >>>>>>>>>>>> call is not the authorized entity assigned the > >>>>>>>>>>>> telephone > >>>>>>>>>>>> number used in From/PAI, and in such circumstances > the > >>>>>>>>>>>> service provider servicing the entity placing the > >>>>>>>>>>>> call may > >>>>>>>>>>>> or may not be the same as the service provider > >>>>>>>>>>>> serving the > >>>>>>>>>>>> entity that is assigned the TN. In all such cases,= the > >>>>>>>>>>>> entity that is assigned the TN explicitly > >>>>>>>>>>>> authorizes calls > >>>>>>>>>>>> placed using it's TN. The design accommodates such= use > >>>>>>>>>>>> cases. It's not a blanket authorization without > >>>>>>>>>>>> authentication. We're not aware of any cases wher= e > >>>>>>>>>>>> there > >>>>>>>>>>>> is an actual requirement for legitimate calling wit= hout > >>>>>>>>>>>> explicit authorization from the assigned entity, > >>>>>>>>>>>> although > >>>>>>>>>>>> we certainly are aware that various parts of variou= s > >>>>>>>>>>>> service providers don't bother to check. At this > >>>>>>>>>>>> point, at > >>>>>>>>>>>> least in some countries, there is a realization > >>>>>>>>>>>> that the > >>>>>>>>>>>> laxity of allowing unchecked spoofing is not accept= able > >>>>>>>>>>>> any more. > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > >>>>>>>>>>>> > >>>>>>>>>>>> > wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> 1. Permit authorization without > >>>>>>>>>>>> authentication > >>>>>>>>>>>> In the current telephony network practice, some > >>>>>>>>>>>> service provider implementations choose not to > >>>>>>>>>>>> authenticate identity, but simply facilitate > >>>>>>>>>>>> the use > >>>>>>>>>>>> of an arbitrary or selected user-provided ident= ity. > >>>>>>>>>>>> Are there legitimate use cases for this? Has > >>>>>>>>>>>> anyone > >>>>>>>>>>>> established that there are not? How can the > >>>>>>>>>>>> industry > >>>>>>>>>>>> reasonably expect to end this (often bad) pract= ice? > >>>>>>>>>>>> If it can't be ended, there's value in at least > >>>>>>>>>>>> identifying the originating service provider > >>>>>>>>>>>> (i.e., the signer/authorizer). Given the > >>>>>>>>>>>> prevalence > >>>>>>>>>>>> of abuse using telephone numbers assigned to a > >>>>>>>>>>>> sometimes-anonymous abuser, it becomes critical= ly > >>>>>>>>>>>> important to identify the service provider(s) > >>>>>>>>>>>> closest > >>>>>>>>>>>> to the abuser. Based on the assumption that it= 's > >>>>>>>>>>>> better to ID service providers than unreasonabl= y > >>>>>>>>>>>> expect a ban of the use of unauthenticated (and > >>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing > >>>>>>>>>>>> should > >>>>>>>>>>>> support authorization without authentication. = The > >>>>>>>>>>>> practice of authorizing unauthenticated use exi= sts, > >>>>>>>>>>>> and there is benefit to signing in these cases > >>>>>>>>>>>> (service provider identification). The languag= e of > >>>>>>>>>>>> the ID should permit this use. 4474bis-10 > >>>>>>>>>>>> should NOT > >>>>>>>>>>>> require or assume that that authentication wil= l > >>>>>>>>>>>> precede authorization. Of course there may be o= ther > >>>>>>>>>>>> use cases where signing includes authentication= and > >>>>>>>>>>>> may not include a specific service provider's > >>>>>>>>>>>> authorization. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> 2. Improve replay prevention > >>>>>>>>>>>> Proximate replay is possible while complying > >>>>>>>>>>>> with this > >>>>>>>>>>>> spec. First, one or more proximate (e.g., > >>>>>>>>>>>> within > >>>>>>>>>>>> 60 > >>>>>>>>>>>> seconds) SIP requests using the same token are > >>>>>>>>>>>> legal > >>>>>>>>>>>> and subject to replay in many cases. An SDP bo= dy's > >>>>>>>>>>>> mky may not be present and if present its use i= s > >>>>>>>>>>>> optional. Some sort of mandatory new or existi= ng > >>>>>>>>>>>> signed sequence, random # or request ID (e.g., > >>>>>>>>>>>> Call-ID > >>>>>>>>>>>> or CSeq) and a 1-time use policy on the > >>>>>>>>>>>> receiving end > >>>>>>>>>>>> of the request (e.g., tokens only good for 1 > >>>>>>>>>>>> use) could prevent replay. Different methods > >>>>>>>>>>>> (e.g., > >>>>>>>>>>>> INVITE vs MESSAGE) might be handled by differen= t > >>>>>>>>>>>> receiving infrastructure, and therefore > >>>>>>>>>>>> difficulties > >>>>>>>>>>>> with 'it's been used already' coordination allo= w a > >>>>>>>>>>>> faked MESSAGE based on a captured request. > >>>>>>>>>>>> This might > >>>>>>>>>>>> include an mkey from a captured INVITE. So it > >>>>>>>>>>>> may be > >>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient > >>>>>>>>>>>> using a > >>>>>>>>>>>> captured identity. While large-scale or > >>>>>>>>>>>> distributed > >>>>>>>>>>>> implementations may make the enforcement diffic= ult, > >>>>>>>>>>>> there is little cost to signing and decoding a > >>>>>>>>>>>> method > >>>>>>>>>>>> and possibly a numeric ID. Some sort of '1-us= e' > >>>>>>>>>>>> practice should at least be discussed while per= haps > >>>>>>>>>>>> not required. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Specific markup suggestions: > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> NITS > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> The verifier MUST inspect any optional "ppt" > >>>>>>>>>>>> parameter appearing *in*the > >>>>>>>>>>>> > >>>>>>>>>>>> Identity request. If no "ppt" parameter is > >>>>>>>>>>>> present, then the > >>>>>>>>>>>> > >>>>>>>>>>>> verifier proceeds normally below. If a "ppt= " > >>>>>>>>>>>> parameter value is > >>>>>>>>>>>> > >>>>>>>>>>>> present, and the verifier does not support > >>>>>>>>>>>> it, it MUST ignore the > >>>>>>>>>>>> > >>>>>>>>>>>> Identity header. If a supported "ppt" > >>>>>>>>>>>> parameter value is present, > >>>>>>>>>>>> > >>>>>>>>>>>> the verifier follows the procedures below, > >>>>>>>>>>>> including the variations > >>>>>>>>>>>> > >>>>>>>>>>>> described in Step 5. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> 3 > >>>>>>>>>>>> > >>>>>>>>>>>> >>>>>>>>>>>> 447 > >>>>>>>>>>>> 4bi > >>>>>>>>>>>> s-10%20- > >> %20Authenticated%20Identity%20Management%20in%20the%20 > >>>>>>>>>>>> Ses > sion%20Initiation%20Protocol%20%28SIP%29.htm#section- > >> 3>. > >>>>>>>>>>>> Background > >>>>>>>>>>>> > >>>>>>>>>>>> [...] > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Per [RFC7340 > >>>>>>>>>>>> ], problems such as > >>>>>>>>>>>> robocalling, voicemail hacking, and > >>>>>>>>>>>> > >>>>>>>>>>>> swatting are enabled by an attacker's > >>>>>>>>>>>> ability to impersonate someone > >>>>>>>>>>>> > >>>>>>>>>>>> else. The secure operation of most SIP > >>>>>>>>>>>> applications and services > >>>>>>>>>>>> > >>>>>>>>>>>> depends on authenticating and/or > >>>>>>>>>>>> authorizing the source of communications as it is > >>>>>>>>>>>> > >>>>>>>>>>>> represented in a SIP request. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> This identity architecture for SIP depends > >>>>>>>>>>>> on includes provisions for a logical > >>>>>>>>>>>> > >>>>>>>>>>>> "authentication service" which validates > >>>>>>>>>>>> caller identity at or near origination. outgoing > >>>>>>>>>>>> requests. An > >>>>>>>>>>>> > >>>>>>>>>>>> authentication service may be implemented > >>>>>>>>>>>> either as part of a user > >>>>>>>>>>>> > >>>>>>>>>>>> agent or as a proxy server; typically, it > >>>>>>>>>>>> is a component of a network > >>>>>>>>>>>> > >>>>>>>>>>>> intermediary like a proxy to which > >>>>>>>>>>>> originating user agents send > >>>>>>>>>>>> > >>>>>>>>>>>> unsigned requests. Once the sender of the > >>>>>>>>>>>> message has been > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> This document specifies a means of sharing > >>>>>>>>>>>> a cryptographic assurance > >>>>>>>>>>>> > >>>>>>>>>>>> of authenticity of and/or authorization to > >>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain > >> context. > >>>>>>>>>>>> > >>>>>>>>>>>> It relies on the authentication service > >>>>>>>>>>>> constructing tokens based on [...] > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> To maximize end-to-end security, it is > >>>>>>>>>>>> typically obviously > >>>>>>>>>>>> > >>>>>>>>>>>> preferable for end-users to acquire their > >>>>>>>>>>>> own credentials; if they > >>>>>>>>>>>> > >>>>>>>>>>>> do, their user agents can act as > >>>>>>>>>>>> authentication services. However, > >>>>>>>>>>>> > >>>>>>>>>>>> for some deployments, [...] > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Regards, > >>>>>>>>>>>> > >>>>>>>>>>>> Alex > >>>>>>>>>>>> * * > >>>>>>>>>>>> *Alex Bobotek* > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >> _______________________________________________ > >>>>>>>>>>>> stir mailing list > >>>>>>>>>>>> stir@ietf.org > >>>>>>>>>>>> > >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> ----------------------------------------------------------- > >>>>>>>>>>>> -- > >>>>>>>>>>>> - > >>>>>>>>>>>> - > >>>>>>>>>>>> -- > >>>>>>>>>>>> ------- > >>>>>>>>>>>> > >>>>>>>>>>>> This e-mail may contain Sprint proprietary informat= ion > >>>>>>>>>>>> intended for the sole use of the recipient(s). Any > >>>>>>>>>>>> use by > >>>>>>>>>>>> others is prohibited. If you are not the intended > >>>>>>>>>>>> recipient, please contact the sender and delete > >>>>>>>>>>>> all copies > >>>>>>>>>>>> of the message. > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> _______________________________________________ > >>>>>>>>>>> stir mailing list > >>>>>>>>>>> stir@ietf.org > >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>>>> > >>>>>>>>>> _______________________________________________ > >>>>>>>>>> stir mailing list > >>>>>>>>>> stir@ietf.org > >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>> > >>>>>>>> _______________________________________________ > >>>>>>>> stir mailing list > >>>>>>>> stir@ietf.org > >>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> ________________________________ > >>>>>> > >>>>>> This e-mail may contain Sprint proprietary information intended > >>>>>> for the sole use of the recipient(s). Any use by others is prohibi= ted. > >>>>>> If you are not the intended recipient, please contact the sender > >>>>>> and delete all copies of the message. > >>>>> > >>>>> _______________________________________________ > >>>>> stir mailing list > >>>>> stir@ietf.org > >>>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>> > >>> _______________________________________________ > >>> stir mailing list > >>> stir@ietf.org > >>> https://www.ietf.org/mailman/listinfo/stir > >> > >> > >> _______________________________________________ > >> stir mailing list > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir > > From nobody Tue Aug 9 09:58:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36FB212D891 for ; Tue, 9 Aug 2016 09:58:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t7vRE3h5Kyh6 for ; Tue, 9 Aug 2016 09:58:24 -0700 (PDT) Received: from resqmta-po-06v.sys.comcast.net (resqmta-po-06v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:165]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7FAA12D847 for ; Tue, 9 Aug 2016 09:58:24 -0700 (PDT) Received: from resomta-ch2-14v.sys.comcast.net ([96.114.154.238]) by resqmta-po-06v.sys.comcast.net with SMTP id XAMCbQL98jWBpXAMCbPrMn; Tue, 09 Aug 2016 16:58:24 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id XAMBbf6BbSg8VXAMBbDj5H; Tue, 09 Aug 2016 16:58:24 +0000 To: stir@ietf.org References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> From: Paul Kyzivat Message-ID: Date: Tue, 9 Aug 2016 12:58:23 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfNvD+f3yuTpWuCVpljJf/ZPL2Qxl6t+vvD/Qjy4tH86HkT7jRXU7u9Uzx0xktquuiuU6iSXaUA6dUjzzhBGH2m5ZSYSGl0P+iQxvdZzdm7Yd3T8ecQma vNCQSKBL6NbQAEeBoupC2tD0Zm46BPTA5hJMDdlEiEyYKvhLr/JuFtHYRCyB/XDdBLMBYJsZPVsjfA== Archived-At: Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 16:58:26 -0000 On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and then can be delegated as requirements dictate. The integrity numbering plan is a direct and plenary responsibility of NRA’s period full stop. > > I’m less confident we will ever get to the device level..at least not for the foreeable future aka my lifetime. If the SPs have an incentive to *not* delegate then it will be very hard to get there. OTOH, if they have an incentive then the chances are better. Brian and Paul R outlined some possible incentives to delegate. That gives some hope. Thanks, Paul > On 8/9/16, 11:18 AM, "stir on behalf of Brian Rosen" wrote: > > I think we believe that is where implementations will start, but not where we will end up. > > Many of us want to get to the point where devices sign and check and carriers only delegate credentials. Might take a while to do that. > > To get rid of robocalling, larger carriers have to push down signing responsibility to smaller service providers. If they don’t, then they will be left holding the bag when the authorities come. > > All service providers can sign on behalf of their subscribers, but they may want to shed responsibility and liability by pushing that off to the subscriber. But to get the whole system up and running, it will be the big guys doing it for a while. > > So I think you got the “necessary” part, but not the “sufficient” part. > > I certainly hope that SPs don’t strip the validation headers. There are no protocol police however. > > Brian > > > On Aug 9, 2016, at 11:11 AM, Dave Crocker wrote: > > > > Folks, > > > > From what I've been told offline -- but which is not explicitly documented in the specifications -- the intended operational framework for these specifications is amongst a relatively small set of service providers. That is, the community of folk who are regulated and/or used to doing business with bilateral agreements. > > > > This appears to produce an expectation of a service infrastructure for STIR that is not public. That is, the query service for obtaining keys and key validation information will not be accessible to random users over the open Internet. > > > > For the SIP-based portion of the validation service, this means that a caller or a callee with their own SIP clients will not be able to participate in the validation process. > > > > If that is not correct, would someone please explain? > > > > If it is correct, why is that an acceptable operational choice for a SIP service? > > > > d/ > > -- > > > > Dave Crocker > > Brandenburg InternetWorking > > bbiw.net > > > > _______________________________________________ > > stir mailing list > > stir@ietf.org > > https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Tue Aug 9 10:04:47 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 947D212D863 for ; Tue, 9 Aug 2016 10:04:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mNaO8Ma9aCf3 for ; Tue, 9 Aug 2016 10:04:41 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0125.outbound.protection.outlook.com [104.47.34.125]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 717C312B05A for ; Tue, 9 Aug 2016 10:04:41 -0700 (PDT) Received: from BN1BFFO11FD006.protection.gbl (10.58.144.32) by BN1BFFO11HUB012.protection.gbl (10.58.144.159) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Tue, 9 Aug 2016 17:04:38 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.36) smtp.mailfrom=sprint.com; brianrosen.net; dkim=none (message not signed) header.d=none;brianrosen.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.36 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.36; helo=plsapdm1.corp.sprint.com; Received: from plsapdm1.corp.sprint.com (144.230.172.36) by BN1BFFO11FD006.mail.protection.outlook.com (10.58.144.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Tue, 9 Aug 2016 17:04:38 +0000 Received: from pps.filterd (plsapdm1.corp.sprint.com [127.0.0.1]) by plsapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u79G04Th003556; Tue, 9 Aug 2016 12:04:37 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm1.corp.sprint.com with ESMTP id 24pxx4dxdr-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 09 Aug 2016 12:04:37 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 9 Aug 2016 12:04:36 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Tue, 9 Aug 2016 12:04:36 -0500 From: "Gorman, Pierce A [CTO]" To: Paul Kyzivat , Alex Bobotek , "Peterson, Jon" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7QA3LKKAAAWRJoAAAX9oAAACCpWAAABpDgAAAKK4AAAAWieAAAPgt4AAALpEgAAAy/8AAAA1f4AAAEbIAAAAZjkAAABSQQAAFBF5gAAOVnSAAAG+lwAAAytegAAAOkMAAAHCnQAAjmtqgAAD/5AAAADbMoAAAc19AAADVf2A//+dhAD//vySsKA6NsqA//+0l1A= Date: Tue, 9 Aug 2016 17:04:36 +0000 Message-ID: <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> In-Reply-To: <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.46] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.36; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(24454002)(51914003)(189002)(13464003)(252514010)(43784003)(377454003)(199003)(19580395003)(86362001)(50466002)(33646002)(81156014)(3846002)(8676002)(8936002)(586003)(8746002)(2950100001)(102836003)(6116002)(93886004)(81166006)(97756001)(2171001)(47776003)(23726003)(106116001)(15975445007)(2900100001)(87936001)(24736003)(54356999)(305945005)(31430400001)(189998001)(76176999)(106466001)(97736004)(92566002)(4326007)(108616004)(68736007)(11100500001)(46406003)(7696003)(356003)(5001770100001)(2906002)(50986999)(5250100002)(5890100001)(325944008)(19580405001)(7736002)(8666005)(7846002)(7059030)(579004)(559001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1BFFO11HUB012; H:plsapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11FD006; 1:IVyNirdnCf3BARqS7Fc60bgdWbWv853zGS9ay7Fw0UWRROS3c6NAVRY2tae21nfKOMAw7qmf0OdU4rUaJ5P6B34+fzILfr723z7EmoYGSZ6SHJ+BrtV9auCsKtZJZgWgDz4vohF5Ct0zTKQpBearXOkV0y1pQnwvtX4XbHoxUdFm8IA81ILHdFHVYGzzGwfLHjN7Fp1LbviZpt2tl8M46lupD6HG0Ys70thQcb5ls42dFispHyV0FZZ54QsUb/4gESncNFK5wFkx1o0vKh8zdaVmvmOQ3GLNvpYhCLGXTwjhGRP7NhOv9zznX83G+CF3tv4ihtFp8sfCsqzF/cy+lQIbps/Qc/NH7voYp1ag0hQ33Z+42dtssTsNKrrODQnvg+yYj7OXwUYJAMxMD8fi9wpRR1rHAiGl6yN3iNpfYZ9vG3vJ4+8AvRryxehQ3VSKxPBXV2MTy4kUkYkgvUZVP3LS6DhpF2ugmL+l0TjCdaY1RnN5TSOoeI52pvVn2WNRO51WARnARgBhvYlamcTNTSgeKx8G0gntzSs6jP4atH+qPEQYN1Z1AuUAS/FYzTuBQkppE6r7lBTJlQTMJwnBIA== X-MS-Office365-Filtering-Correlation-Id: d02c4987-a520-48c1-291e-08d3c0773f86 X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB012; 2:uP4qEgPUjjXEbmREM6Vhq40LxzVabrl540hYgsTUdZh+lNFyUd2Fe2bEX17rj04uXD4TXkb7iimsevR/BXt8wgwL/QN4Y2gIW54GckDjPf1GpkPltEo27GLXE4HrGaIJcLXiBFNRcQDD2AnnDpbqjRis69LqcNA0Hl+TuOddXskeXG7yShjE7xNIa6niGmHq; 3:aE1K1RpQub2JrjE3PN8ZBjvxv22dvQy19kgFtbkckiGaRSVb+He8fu1fAgedRqXl2quSH/qpAlMQJeqtx9Ejk3X0auxkTEmH+fdiFk24VfNAU4r9WW3GxtTcjT9dZ6zjeLjirzQnVDo2U4IDUaMY5OrXO17cKO7mxC0feogvauZqBnoP4Fkvd4MuyBLlByUwICvyvSCTDW0ka2/0M4apKgtGfz+3MkuHX6Xi7vQVwzEPQuwopIBWI5isYxEatG0qck78JrkJbNZiLLtD7HrB3A==; 25:W8LfhnBF4+mhvccbQYASZjf2YnCN3A0Crl7fFIA2+izW3vDVvDApYg1fV/D1npQpfwIs8vo9v13uXguAe77rhnspl+8Gvz1MNCepnx1WDc/YSwAchnVACL6HYYy2zv2AwoGLGyHKG2WWWW1jvg9wRfYskJk5tVVCkDpbeRRPjRQF8Nea2FiuGYZu43YjKLoqFgezhics3jjtY4TiHWosZ6HVBspn4JbsAa0fTQbySgnPio29XbcQ/7PSpAuS7t4A3NerpXDfyQ+YvaYuL7t8lkxHYuwHnWcO16wpcjpytuaRSbGlJDlx/6Qoh0uovoZuy9u94NM3SfsuNSfHobwYtiIAgUorAdOLHcqpFt15C7qgZ786zLNGBKqSHLwvW8vhgvaqo029RVKbH+CD3Zd+gGIrZg4rpMuqsDLgKYgbXqPAuBr8Wbu3dVec9cVBFlqA X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1BFFO11HUB012; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB012; 31:U9LDW+nEWSfRwLLaUmn1Gx7ZUQDTrfd0/mElBpLmYuVo8nCQ/PsusD/bIm3S3lewEBXoPjh54foEXmUxa4ApbPkmx9B7l4zQNG3cHZ7iZ0HxORNJH9UZ7OMdgGw7qpDMdmQALwxKq6j92FTPEUMIjK1ANclVCGjPfIB89KgaBek9ucYrRBnxiys+qC6hSG1qEMxVykqcymKkYtmxZLvmCj9XEJRpYZ6ampaSG1EQG3I=; 20:vhk9sKJaxLgvexCOZnvVZPSV1yI49FH+xbscC4Eei2b6sqoeF8fi6tCb04K6jBhu4DASg57BWxYT4YwrptZvjxH/AO1HbPtDTCiFffEv0ADC7CGLvOtIgIiTRZI992hRsl8xyApsbdKShSf87XAvfY4xP9pw6V1hyTvTD4A1WEsyKOFMnusSxAY2ky11/2YHqiWJjxWe0Uq+dVDojkv1Bn5tYYt07HNIeQ0KhWW9bNbISinpQTgDiUehr023/4mLRZ3sNVq0otQ0AkwIQV4cmERqPhS9YiEFKM0QL6UC3vjUPxG/CAvjOUT8cETu/BiJKJ9YUr/3URBaVs0SUBCIozvql7o79AOOKtN6NutH2wWsC2/EPIdp8/HCb/HKyzOVHmZtkS5VfsYdVEFnkLVZ0tYYEjKFHqhd6+c8n9n6rHg= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(211171220733660)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040161)(601004)(2401047)(8121501046)(13018025)(13015025)(5005006)(13024025)(13023025)(13017025)(3002001)(10201501046)(6055026); SRVR:BN1BFFO11HUB012; BCL:0; PCL:0; RULEID:; SRVR:BN1BFFO11HUB012; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB012; 4:oLLObPk77QOi2Ie8Nz/OdJVyny5dhoY4yE3dMc6IyY90tB+vKUT6KwLpf63BVs+uXt4bkLd2jNUcOUD4KbfTmb/r4p8bp8FmQdkgCjf9qsK5+W+9mDYX3dpkDWrMvDKsYJqeAB8OFni0GI/p9mVwitMX9rZIMD9yr3o9W7CzCgfcsCXmEr7JpLr+tOJk8pDNYMIJ4fExWorPh5SBhTF9zFlmSo1VtlS9j80/Od8Yecbmkvniwzkf3+8c+Bd7Qop0v7ozp+npN6zzBKIXrc2KGTq9gX84fn1On9K6RWAdfPNnxEOYhG5QCaDJ6olN7fTb8LCg1/BibPlFvCElLMGMmE6hZrCNP88WsIV+IXvNg0KZc+u1oAkNZBVPHArAnuLm0eg9/pSL1jPmwedTF88CIbD4i0JLQf2I9BzCQl3q/6Dl+o+Mff4nWGoNgZhwd9Pyd0udMbaKxi3ssicrz2vp41gjlhj+I5Ez4MWfZKthJF2cTB/x+eQyqsSQJj7iGpXAJKdx8KdrvTtN+u9uoUeDMPQG3osjOc37Onv7Mqn+WV0pIugoNhjtOIGRd+CeMArbMuiuyPzxZwyPgUNjUX9AXbj5xg5gAYlY5pxr06hXzuennRJYLdskTHCBcoF3Yv9QCRcCGCBcfpIi22oEvbeWsNNKhNKtXQyk5TrNO6zDH79QeLdhEzZ9MykeJ3BvDuP/s9SyyjFZ7KiOlI0Dh56E5CyM1n5jGKY2NIVvNOCvdGrpBrEK55W6hwSnxs3GmnmcCQqMbruPWpxU6g14uCTzxg== X-Forefront-PRVS: 0029F17A3F X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1BFFO11HUB012; 23:aas+Aj0UFl1kX8t33O3Ri8Bjf8uf3hNpWdcjZ5t?= =?us-ascii?Q?OzFBsbN5p4fSEHTLCxeD0hwp4FrKL/5lH/fbzFsZ0ncbEdLYlxeTjkgxHFoL?= =?us-ascii?Q?enIM5ukw40gEPiC42fuOZirGz094aZqqaYzHk28PPQq9FSBDBGpwj33/WKVQ?= =?us-ascii?Q?vHLFGqj5zpmCw1Vac0kBPy3eVDEUbI+1OoM1R5nv8c+w/1rP4rxlFX6/+TRW?= =?us-ascii?Q?atzl1dQKBPXThabDA7O8GDb9IValpLYnRj4Gk7VrTpIc3frGPB81g/mESWZc?= =?us-ascii?Q?mUIrbnqNvpE5kyMZOD/gWCS0LKeHnSVNTRQ/OGWBWPjpPBjNBTBYCGzlz8lb?= =?us-ascii?Q?lWQn+sHLfRWi+I8gj2pJ6KxL+t2LQZT2E0UtW2tCLlN+tVJLXt0Tbmw9gHvE?= =?us-ascii?Q?N3PssgunIAl9zh0bBPtJDkSf8ZBJxgHF6BDTocVny2hEdiS5bL3PVhTg84+R?= =?us-ascii?Q?9hu3VDuHBjr4OQ8NG6fHPTc11ouBKsId6V5d8+9shTMMujmJ1oksePt9oLUD?= =?us-ascii?Q?i5iDDiK13A2WWwJ5ErU9avEn9Ki+4AMkmxycI+c3LaGWG8Q+o/s2dVmXGdoS?= =?us-ascii?Q?lptjceNKb5dBOKuZWKlqNp2HBtTrfDrdrQv4X0R5EEwXSMZFJiNISHvvL0Ux?= =?us-ascii?Q?dYeM80ThcL2fm22JbTYtjdFOp+kPSziTyfvQJw4IWneGGuW7Ew2oVRBb1RPH?= =?us-ascii?Q?ntr1pRv9VVWEy8ApBusGzO6eSq3F+/T+NNm86Z5o8kCTMU99fEoe5vI44JSg?= =?us-ascii?Q?yPIV2AJQtK0H7Yz+JNN+KI+8EzMQVDbRQl+0PA6B4DCCbinknHFX8WYNjeK4?= =?us-ascii?Q?QWrRTuAnFfpf79N7ow0KZ/AmZvoiyGRQXPbQEB44iptQfxz2tojha6YvCSSZ?= =?us-ascii?Q?KtDB1UzorEsTd4bGITrZAdPyvms3iecVaIjkGM1r193Q6MMFaSsTslwxExNb?= =?us-ascii?Q?QtnKlZky4U5XldnAwWFdc6ysy+rOGz7wzByHhtfPzIx5UiNYwWEFYVBJVJuS?= =?us-ascii?Q?Y3BsnDc9uhxfg1+u/YwtcjatZ14qArXFw0CwfXIXNKbPHgKIQORufPgsxL43?= =?us-ascii?Q?7B4FQIrmFUEsj3U5Ry1eKgJ+61U8ZDex5b3KOVisJdfxfNxXCJqEig4/s2x2?= =?us-ascii?Q?QMCf/k9a0eI5DFyG3MwPNlQvQVcHNXxtwV5xQfmYhY1Lsscw38zOzjP7X6+C?= =?us-ascii?Q?zTZ9XeYG//000oLarzXzgXX7ExbINrbwbTzxPXHJCjV4etRU12yTZAgV3aWB?= =?us-ascii?Q?GBDd1Z8SFQ9jjem0Tj6B60k8WD+T5OvcsmzZw8+KZyyTSOY2eR2VfyGOj1K8?= =?us-ascii?Q?W463k9gqD4jPih9Y90uss33WOROkwIUkwHKIgdRTUnmms+eTzvxhaJUrCIHT?= =?us-ascii?Q?HkBZTke1IJY7BmaHuCeW51eQeq08hgUOirJWwXLRcYcQSfVW5GfWpAPFVT4T?= =?us-ascii?Q?dVIgekq/vTSTikpCr4aH6QnRAPLABhiBYtq/jXoZ8Y3VPteMeAIMCcjFSpD/?= =?us-ascii?Q?t3sv0w7vq3CPwYEbfXha0ZB+aYuM2FHVbRajzwx7lIClDUw9JKUuoSgyi?= X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB012; 6:cuqQUwBYSrhJ/9EPpNEefNuZ15pxbjT8w7WxHR6WOxR6CSIU7zkGDdrvtTqsxKnWuSLyBuQxGsKMWoFzpf/m1LgJ1lv1s/YxA5vQyH27sEv82IKt5jNGLMK9rs/dxPQdgd6Vc5qrT32mD9XLhuC8DTBCva7LQFZNN1nu0uJAQZsqrQZg/7M9z7f1r7I/bYkTLmIAvdqkUVwEszP/LSZL9tpr3nmtuZrJXLg9UprgLo7XjHaPrzj2qylWHNfu6nztpeRyqqEyFu9HIeRk3jcOffNDYdZlYp12C7k/UTSuRs+kG9MEeW41QNP7oNyiC9ZoqLXgzOgs+6BDe7u+TBamWQ==; 5:BfRnlLKgf/WwmKtWNu+qAr5GrjJk91effWujFXUqH1cwwNY3G2uM8R5EAJ+f709efQSQYoVSeLdjj1a4hIjk4J99DRkzQV5FRTwNFQFEErovt3G4Bj2d15n0DWkoUEsjgdpWwbc8Cg/sb0u5B7q8mA==; 24:4BGMZZL+eEubADWcnTDEnO/quVaEHmghYFaKcxzD5OCFCEVe9IClxKWVXd8XYXY0hzxmDpJ2zhb2CI+qC2YAvdf4Gk6U/AYXWkOdU0IKX+g=; 7:ZRHc/CpXCVVp8eNPyfnqwtrEKBcerfb/fy8wIQl/HO0oebu1KkuZ5H8l2yms6CJcVMjeef3PRDKTSN4ZK0GyR0rMVlIWuBLFa3wBVKmFCV8BSjITJEaNbqghnSxTCt3iPpqYkoh8AEUmMG4Xu1UDMak7+6ev3KHRQBvNSpACwyuXF+PvfPzOW+wMUU1NG4IxQI1UXEBYiUAutqbJ5cRLr9+mbI4hIegT0nfjbegjs8nfhrfzxDuX0xxBXOhLeKyt SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2016 17:04:38.7054 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.36]; Helo=[plsapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1BFFO11HUB012 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:04:46 -0000 " If you sign the message you are taking responsibility for the assertion t= hat it is from NNN. If you choose to do so without knowing who it is from t= hen that is your problem." Paul, Following this standard of liability, every ISP should be forced to sign IP= packets and be liable for hacking attempts which originate on their IP net= works. Just as reverse unicast path forwarding is not often (ever?) used in the In= ternet backbone or ISP networks to ensure IP packets don't come from networ= ks they can't have originated from, neither do all telephone networks "chec= k" each originating telephone number to determine whether they should have = been able to originate from a particular carrier or enterprise and for the = same reasons - it is difficult, imperfect, and expensive. Just as it is wi= th the Internet backbone, it's actually reasonably challenging just deliver= ing the calls (or IP packets) to the number that it is addressed to, withou= t also having to also worry about where it supposedly came from. I'm telling you we can differentiate the trustworthy-ness (like Stephen Col= bert's "truth-iness") of calls. We can tell if a call originated from a su= bscriber using a device which has to authenticate to the network before it'= s permitted to place calls (except manual roaming and some E911 calls). An= d we can tell if a call originated (or was subjected to mid-call 3rd party = call control from an enterprise or mobile virtual network operator partner = for example) and is therefore not as trustworthy as the directly-connected = and authenticated mobile subscriber (for example). We can pass that relati= ve trustworthiness information along in signaling and it can be used to use= fully differentiate treatment, ultimately, by the consumer. What you want is that the calling number is always, universally, only ever = trustworthy. My opinion is that is unrealistic and unreasonable. Pierce -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] Sent: August 09, 2016 10:44 AM To: Alex Bobotek ; Peterson, Jon ; Gorman, Pierce A [CTO] ; Dwight, Timothy M (T= im) ; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Richard Sho= ckey ; stir@ietf.org; Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments On 8/9/16 5:03 AM, Alex Bobotek wrote: > Jon, > > Thanks much for your thoughtful response to the original points. Yes, th= ings got somewhat sidetracked. > > On the first point (signing without authentication), I do not read 6.1 > as permitting "I'm signing to assert that I've authorized use of this > phone number without authenticating the caller and/or completing a > number delegation authority check", I'm not sure I understand. Is this the assertion you are asking for? "I (Acme Corp), having administrative authority over number NNN, certify th= at this message is "from" NNN, though I have no idea who actually originate= d this message." This is a good thing??? If you sign the message you are taking responsibility for the assertion tha= t it is from NNN. If you choose to do so without knowing who it is from the= n that is your problem. You should be legally liable. At the very least you= r reputation as a signer should be diminished as fraudulent calls you have = signed are detected. Eventually you will be put on blacklists as an untrust= worthy signer. I guess we could speed the blacklisting by allowing signers to pre-declare = that they are untrustworthy. (That seems to be what you are asking for.) > a use case that reflects the currently-widespread practice of authorizati= on without authentication. No wonder we have a problem with spoofed calls. Thanks, Paul > My read of section 6.1 is that it allows anonymity rather than signer-att= ribution with unauthenticated (non-anonymous) caller identity. Knowing the= triple of purported calling phone number that flashes on a recipient's pho= ne, the terminating phone number and a timestamp is important in reporting/= tracing/mitigating abusive calls. [On a side note, I reread Section 11, bu= t had trouble with the definition of "private URI" (note: "private URI" an= d "private SIP URI" each occur exactly once each in the doc and could benef= it from a definition or two).] Additionally, Brian Rosen's comment on 8/4= seems to corroborate my reading of a ban on authorization without authenti= cation in the non-anonymous case (i.e., that using someone else's phone num= ber requires that "the entity that is assigned the TN explicitly authorizes= calls placed using it's TN"). > > In summary, there is a high value in allowing signing/authorization in th= e categories and use cases Pierce outlined. In my operational experience, = it really helps to know which company to contact to get the callers kicked = off a network. And signer attribution even without caller authentication i= s a huge win for the public. > > > > On the second point, thanks for pointing out that 12.1 requires servers t= o keep the state of recently received requests. This is a point that I mis= sed in my reading of the draft, and this feature as you have described it d= efeats most conceivable replay attacks. My bad for missing this, but as yo= u suggest, there may be some potential for emphasizing this point. But the= re's another part of the issue -- cross method replay. For example, it may= be difficult to expect a messaging node (which handles SIP MESSAGE) and a = voice-capable IMS node (handling SIP INVITE) to coordinate their anti-repla= y caches, allowing an attacker that observes a SIP invite for a voice call = to piggyback a spam text message. As it's common to use the same "To" addr= ess for multiple services that may be served by very different infrastructu= re components, it would be beneficial to allow signatures to cover more tha= n "To", "From/PAI" and "Timestamp". I do not see this issue as meriting s= ignificant delay of a STIR RFC if there's no quick fix. > > Regards, > > Alex > >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon >> Sent: Monday, August 8, 2016 12:46 PM >> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >> ; Dwight, Timothy M (Tim) >> ; DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK ; >> Richard Shockey ; stir@ietf.org; Brian Rosen >> >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> >> Just so I'm clear, I'm not hearing an ask here in terms of changing >> the text of rfc4474bis-10, which does allow signing PAI instead of >> From for precisely the reasons outlined in this lengthy thread. To >> Alex's original point about providing authorization without >> authentication, rfc4474bis has a lot of text about signing non-TN >> identifiers, including for preserving anonymity; see the end of >> section 6.1, and then the Privacy Considerations in section 11 for >> more. Those should suffice to provide this property: it will identify th= e service provider who signed without attesting an specific user identity. >> >> I also wanted to make sure we didn't drop the other ball that Alex >> mentioned at the start of this thread, which is the issue of >> proximate replay within the 60 second Date window. This is addressed >> in Section 12.1 of rfc4474bis-10, which >> reads: "Note that per baseline [RFC3261] behavior, servers keep state >> of recently received requests, and thus if an Identity header is >> replayed by an attacker within the Date interval, verifiers can >> detect that it is spoofed because a message with an identical Date >> from the same source had recently been received." This refers to the >> text of >> RFC3261 section 23.4.2, though more properly the Date-related >> behavior is better detailed in RFC3893 Section 10, which introduced >> the first version of the partial signature mechanism that ultimately >> inspired RFC4474. I'll update the text here so it is clearer about exact= ly how to detect proximate replay. >> >> Jon Peterson >> Neustar, Inc. >> >> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >> wrote: >> >>> Paul, >>> >>> As you know, SIP inter-working is often challenging because of >>> variability in implementation including proprietary headers (without >>> an >>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>> stripping things like display name in From but that's another story). >>> I could argue that from a cleanliness of protocol implementation, >>> (and if I wanted to be pedantic), I would strip PAI outbound unless >>> required otherwise. But the point is moot. As I mentioned in the >>> earlier e-mail, that is not our practice and I'm not requesting it to b= e so. >>> >>> Pierce >>> >>> >>> -----Original Message----- >>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>> Sent: August 08, 2016 12:03 PM >>> To: Gorman, Pierce A [CTO] ; Dwight, >> Timothy >>> M >>> (Tim) ; DOLLY, MARTIN C >> >>> Cc: Rosbotham, Paul, Vodafone UK ; >> Richard >>> Shockey ; stir@ietf.org; Brian Rosen >>> >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>> Thanks for the added comments Tim. >>>> >>>> I agree that passing P-Asserted-Identity between trusted networks >>>> is appropriate (and the converse is true as well). Part of my >>>> issue is I have been conditioned from the very earliest >>>> implementation of Sprint's VoIP network that other carriers' IP >>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>> and even there I find language that implies trust is established by >>>> agreement, not by standard. (Even roaming implies agreement.) >>> >>> I understand why *some* stuff needs to be removed when forwarding to >> an >>> untrusted party. For instance, if the call has requested privacy, >>> then P-A-ID needs to be removed. >>> >>> But when privacy is not a concern, trust is really more of a concern >>> on the ingress side, not egress. If I don't trust you then I won't >>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>> trust you, but you don't trust me, then what is the downside for >>> passing along the P-A-ID? >>> >>> Thanks, >>> Paul >>> >>>> Regardless, this discussion has been helpful and educational (to me >>>> at least). And, I confirmed with my operations counterpart we >>>> generally send PAI today. I've also made note that where standards >>>> and >> ICA >>>> require it, we will include PAI. Thanks again. >>>> >>>> Best regards, >>>> >>>> Pierce >>>> >>>> -----Original Message----- >>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>> Sent: August 08, 2016 10:47 AM >>>> To: Gorman, Pierce A [CTO] ; DOLLY, >> MARTIN >>>> C >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard Shockey ; Paul Kyzivat >>>> ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>> >>>> Pierce, >>>> >>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >> GSMA >>>> IR.95. The latter references and profiles the former. Section >>>> 4.4.1 of >>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>> considered trusted, and table 3 in that section recommends that >>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>> It also states that PAI is mandatory at a roaming NNI. >>>> >>>> Tim >>>> >>>> >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>> Pierce A [CTO] >>>> Sent: Monday, August 08, 2016 8:52 AM >>>> To: DOLLY, MARTIN C >>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>> stir@ietf.org; Brian Rosen >>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>> >>>> Martin, >>>> >>>> You referenced TS 29.195. I'm not familiar with that spec. Has it >>>> been deprecated? It's not showing up on the 3GPP site. >>>> >>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the >>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>> header when interworking with untrusted networks." >>>> >>>> Your remark is consistent with Note 4, but only if we agree that, >>>> for instance, the AT&T network and the Sprint network are "trusted >>>> networks". In reality, this is not the case or there would be no >>>> firewalls or Session Border Controllers used for interworking and >>>> security. My opinion is the only carrier networks that are trusted >>>> are the SS7 network, and the Internet backbone. >>>> >>>> What it really comes down to is that PAI is left in signaling >>>> either through formal specification as a part of an inter-carrier >>>> inter-connection agreement, or by custom (or even by accident). I >>>> think this illustrates Paul Rosbotham's observation is true. >>>> >>>> Pierce >>>> >>>> -----Original Message----- >>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>> Sent: August 05, 2016 12:55 PM >>>> To: Gorman, Pierce A [CTO] >>>> Cc: Rosbotham, Paul, Vodafone UK ; >> Brian >>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>> ; Richard Shockey >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>> PAI is not stripped at the network boundary between trusted >>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>> ITU And the list goes on >>>> >>>> Martin C Dolly >>>> Lead Member of Technical Staff >>>> Core & Government/Regulatory Standards AT&T >>>> Cell: 609-903-3360 >>>> Email: md3135@att.com >>>> >>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>> wrote: >>>>> >>>>> Which header the carrier chooses to display is moot if the header >>>>> is stripped between carriers as per at least one standard. I >>>>> think Paul Rosbotham's observation we're likely to encounter "some >>>>> interesting interworking challenges" was perhaps the understatement o= f the year. >>>>> >>>>> Pierce >>>>> >>>>> -----Original Message----- >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>> Sent: August 05, 2016 11:58 AM >>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>> ; Brian Rosen >>>>> Cc: stir@ietf.org >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>> >>>>> If PAI is present and signed, and From is also signed, I would >>>>> expect it to be up to the UA to decide what to display, not the carri= er. >>>>> >>>>> Of course this will work differently if there is a different >>>>> signaling regime between the carrier and the user device (e.g. >>>>> black >> phone). >>>>> >>>>> Thanks, >>>>> Paul >>>>> >>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>> controller functions and is not to be used in inter-carrier >>>>>> inter-connection (although it commonly shows up anyway). My opinion= is the "From" >>>>>> header is likely used more often for presentation. >>>>>> >>>>>> Pierce >>>>>> >>>>>> >>>>>> -----Original Message----- >>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>> Sent: August 05, 2016 9:37 AM >>>>>> To: Rosbotham, Paul, Vodafone UK >> ; >>>>>> Paul Kyzivat ; Brian Rosen >>>>>> >>>>>> Cc: stir@ietf.org >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> >>>>>> Humm this is getting interesting. Its my understanding that the >>>>>> display number aka "presentation number" in the US context is the >>>>>> one carried in the PAI. Martin, Pierce? >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" >>>>>> >> wrote: >>>>>> >>>>>> Jumping in now that we're on European working time, +1 on >>>>>> Paul's observation. >>>>>> >>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>> IDs....one (we term the Network Number, carried in PAID) uniquely >>>>>> identifies the line, the other (we term Presentation Number, >>>>>> carried in From) is used for display purposes. >>>>>> >>>>>> Only the carrier has the authority to set the Network Number >>>>>> so only they could sign it. >>>>>> >>>>>> But - subject to regulatory restrictions which are well >>>>>> documented >>>>>> - the number sent for display purposes belongs to the customer. >>>>>> For blue-chip customers, I can allow them to send their >>>>>> Presentation Numbers into the network, and can't readily check at >>>>>> a network level that they're theirs (I do have contractual >>>>>> safeguards). The number may have been allocated by me, or could >>>>>> be allocated by a third party provider. If it's a call-centre >>>>>> they'll be making outbound calls for lots of different customers >>>>>> which will change on day-by-day >> basis. >>>>>> This is business as usual. I don't like the term "authorised >>>>>> spoofing" because it implies that the CLI is in some way being rigge= d: >>>>>> it's not, it's the corporate customer or their subcontractor >>>>>> using the number that's been assigned (so in internet terms >>>>>> delegated) to them via a chain of trust from the regulator. >>>>>> >>>>>> What I want is the ability for customers to use their >>>>>> credentials to sign the CLIs they send me so that at the >>>>>> terminating end it can be checked (or indeed somewhere en-route >>>>>> if that's the business model). >>>>>> I can and would sign for customers on my mobile business since >>>>>> I'm driving what number is presented, but that's by-the-by >>>>>> because they aren't the ones who generate millions of nuisance >>>>>> calls. If the signing only occurs at the originating carrier >>>>>> level for corporate/call-centre customers that's no use because >>>>>> I'm not in a position to do that for these type of >>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>> also highlight there are many more of my large customers that I'd >>>>>> trust more than a far end originating carrier that could be >>>>>> anywhere in the world (though we have no shortage of small >>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>> UK....) >>>>>> >>>>>> Regards >>>>>> >>>>>> Paul >>>>>> >>>>>> -----Original Message----- >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyziv= at >>>>>> Sent: 04 August 2016 23:12 >>>>>> To: Brian Rosen >>>>>> Cc: stir@ietf.org >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>> delegated the TN, it's being authorized to place calls that are >>>>>>> not >>>>>> >from that TN, but appear to be. >>>>>>> >>>>>>> The mechanism to handle the credential is exactly the same as a >>>>>>> delegation, so if you want to call it delegation, go ahead, but >>>>>>> I prefer to call it authorized spoofing. >>>>>> >>>>>> IIUC the delegation is to a responsible entity (something that >>>>>> can be held legally accountable - e.g. a person), not to a device. >>>>>> The entity can then "use" the credential via any device(s) it >>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>> two-line >> phone. >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> Brian >>>>>>> >>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>> >>>>>>>> wrote: >>>>>>>> >>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>> phone as calling party. >>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>> carrier to him. He then creates another credential, which he >>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>> (because the call is coming from his mobile's TN but claims to >>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>> could give the credential to his mobile SP if they sign on his be= half. >>>>>>>> >>>>>>>> I don't understand how that is different from regular delegation. >>>>>>>> >>>>>>>> When his landline carrier gave him a delegated certificate for >>>>>>>> his landline number, he should be able to install that in >>>>>>>> whatever devices he wants - his landline UA, his mobile phone, >>>>>>>> etc. It is still delegated from his landline carrier, even when >>>>>>>> used with calls via his mobile carrier. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>> >>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>> legitimate use. >>>>>>>>> >>>>>>>>> But that's how I describe it. >>>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>> > wrote: >>>>>>>>>> >>>>>>>>>> +1, but with one question below: >>>>>>>>>> >>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>> delegation path, >>>>>>>>>> >>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>> authorized spoofers. >>>>>>>>>> >>>>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>>>> contrasted to "spoofers" who have been delegated their >> authority. >>>>>>>>>> >>>>>>>>>> Thanks, >>>>>>>>>> Paul >>>>>>>>>> >>>>>>>>>>> I don't think it matters who the delegator or delegatee are >>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>> delegated to, so authorities can follow the delegation path. >>>>>>>>>>> There are plenty of certificated carriers who are willing to >>>>>>>>>>> not care who they delegate to. The fact that there are some >>>>>>>>>>> who do doesn't change much. >>>>>>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>> >>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>> been delegated. >>>>>>>>>>> If it does, it's asserting that the calls are from who they >>>>>>>>>>> are supposed to be from. >>>>>>>>>>> That should be straightforward, but we know it's not always, >>>>>>>>>>> and that represents the hard part of deployment in my opinion. >>>>>>>>>>> But once they delegate, they can hand responsibility to sign >>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>> they are delegating to. >>>>>>>>>>> >>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>> we get into >>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>> which we don't. >>>>>>>>>>> Our model is that you know who you delegate to, and once you >>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>> some business practices. >>>>>>>>>>> >>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>> >>>>>>>>>>> Brian >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> wrote: >>>>>>>>>>>> >>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>> policy and use cases. >>>>>>>>>>>> >>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed >>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>> >>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>> >>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>> my reason for suggesting a way to qualify the signature to >>>>>>>>>>>> reflect that variability. >>>>>>>>>>>> >>>>>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>> numbers, and can qualify to some degree the trustworthiness >>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>> >>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>> most-authenticated. There can be >> more >>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>> complexity (both for the carriers and the consumers) and I >>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>> >>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and fraud. >>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>> mobile consumers where their carriers are able to usefully >>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>> >>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>> (revoked, not >>>>>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>>>>> >>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>> well, if the calling party has to sign a call with a per-TN >>>>>>>>>>>> cert provided by the called party. No called party cert to in= clude? >>>>>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>> >>>>>>>>>>>> Pierce >>>>>>>>>>>> >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>> >; >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>> >>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>> policy issue. >>>>>>>>>>>> >>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>> design of stir, and the design allows delegation of one TN >>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>> NAM phone could have >> more >>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>> mobile phone may also have a credential for, say, a TN that >>>>>>>>>>>> is delegated to a landline, to cover the example case of a >>>>>>>>>>>> doctor placing a call on his mobile, but getting his office >>>>>>>>>>>> number to show up as the calling party. Use of such mechanism= s is policy. >>>>>>>>>>>> >>>>>>>>>>>> Brian >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> wrote: >>>>>>>>>>>> >>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. >>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>> >>>>>>>>>>>> Pierce >>>>>>>>>>>> >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>> >; >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>> >>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>> phones and any other devices that can be programmed to do >> so. >>>>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign >>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>> >>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>> will want to get out of the liability of signing on behalf >>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>> so. That means the devices have to be able to sign, but I >>>>>>>>>>>> understand many of the PBX vendors think that's something >>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>> >>>>>>>>>>>> Brian >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> wrote: >>>>>>>>>>>> >>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>> >>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>> >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>> >>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>> signature, >>>>>>>>>>>> but the service provider can do that. It should not add = a >>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>> assign to >>>>>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>> "authorized >>>>>>>>>>>> spoofing". The companion devices I'm aware of always sen= d >>>>>>>>>>>> calls from the same service provider and should not prese= nt >>>>>>>>>>>> any issue. >>>>>>>>>>>> >>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>> implement >>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>> >>>>>>>>>>>> Brian >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> > wrote: >>>>>>>>>>>> >>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>> where a >>>>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>>> way of >>>>>>>>>>>> knowing whether the calling number is properly assign= ed >>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>> >from an >>>>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>> And in >>>>>>>>>>>> the consumer market, there are calling products which >>>>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>>> devices >>>>>>>>>>>> (e.g., tablets) which can place a call using the MDN = of >>>>>>>>>>>> the parent subscriber. These are examples of where t= he >>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>> necessarily mean >>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>> a single >>>>>>>>>>>> subscriber with a single MDN regardless of "laxity" o= f >>>>>>>>>>>> spoof checking. >>>>>>>>>>>> >>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>>>>> specificity of authenticity, and calling number. Thi= s >>>>>>>>>>>> provides the identity of the originating carrier, som= e >>>>>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>> (assuming nonce >>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>> suggested >>>>>>>>>>>> below by Alex). >>>>>>>>>>>> >>>>>>>>>>>> The representation of orig-carrier and trustworthines= s >>>>>>>>>>>> could be as follows: >>>>>>>>>>>> >>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>> >>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>>>>> networks that don't natively support SIP or which don= 't >>>>>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>> >>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>> roaming >>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>> entirely >>>>>>>>>>>> untrustworthy >>>>>>>>>>>> >>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>> OCN, but >>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>> less than >>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>> >>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>> calls from >>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>>>>> trustworthy >>>>>>>>>>>> >>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>> >>>>>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>>>>> available authentication services resources. e.g., >>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>> cetera. >>>>>>>>>>>> Could/would pass credentials down to SIP-aware device= s >>>>>>>>>>>> which would process them according to the rules of th= e >>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>> >>>>>>>>>>>> Pierce >>>>>>>>>>>> >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>> >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>> >>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>> placing a >>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>> telephone >>>>>>>>>>>> number used in From/PAI, and in such circumstances th= e >>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>> call may >>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>> serving the >>>>>>>>>>>> entity that is assigned the TN. In all such cases, t= he >>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>> authorizes calls >>>>>>>>>>>> placed using it's TN. The design accommodates such u= se >>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>> authentication. We're not aware of any cases where >>>>>>>>>>>> there >>>>>>>>>>>> is an actual requirement for legitimate calling witho= ut >>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>> although >>>>>>>>>>>> we certainly are aware that various parts of various >>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>> point, at >>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>> that the >>>>>>>>>>>> laxity of allowing unchecked spoofing is not acceptab= le >>>>>>>>>>>> any more. >>>>>>>>>>>> >>>>>>>>>>>> Brian >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>> >>>>>>>>>>>> > wrote: >>>>>>>>>>>> >>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>> authentication >>>>>>>>>>>> In the current telephony network practice, some >>>>>>>>>>>> service provider implementations choose not to >>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>> the use >>>>>>>>>>>> of an arbitrary or selected user-provided identit= y. >>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>> anyone >>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>> industry >>>>>>>>>>>> reasonably expect to end this (often bad) practic= e? >>>>>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>> prevalence >>>>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>> closest >>>>>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>>>>> better to ID service providers than unreasonably >>>>>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>>> should >>>>>>>>>>>> support authorization without authentication. Th= e >>>>>>>>>>>> practice of authorizing unauthenticated use exist= s, >>>>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>>>> (service provider identification). The language = of >>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>> should NOT >>>>>>>>>>>> require or assume that that authentication will >>>>>>>>>>>> precede authorization. Of course there may be oth= er >>>>>>>>>>>> use cases where signing includes authentication a= nd >>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>> authorization. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>> with this >>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>> within >>>>>>>>>>>> 60 >>>>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>>> legal >>>>>>>>>>>> and subject to replay in many cases. An SDP body= 's >>>>>>>>>>>> mky may not be present and if present its use is >>>>>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>>> Call-ID >>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>> receiving end >>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>> (e.g., >>>>>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>> difficulties >>>>>>>>>>>> with 'it's been used already' coordination allow = a >>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>> This might >>>>>>>>>>>> include an mkey from a captured INVITE. So it >>>>>>>>>>>> may be >>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>>> using a >>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>> distributed >>>>>>>>>>>> implementations may make the enforcement difficul= t, >>>>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>>> method >>>>>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>>>>> practice should at least be discussed while perha= ps >>>>>>>>>>>> not required. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> NITS >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>> >>>>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>>>> present, then the >>>>>>>>>>>> >>>>>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>>>>> parameter value is >>>>>>>>>>>> >>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>> >>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>> parameter value is present, >>>>>>>>>>>> >>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>> including the variations >>>>>>>>>>>> >>>>>>>>>>>> described in Step 5. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> 3 >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> 447 >>>>>>>>>>>> 4bi >>>>>>>>>>>> s-10%20- >> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>> Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >> 3>. >>>>>>>>>>>> Background >>>>>>>>>>>> >>>>>>>>>>>> [...] >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>> ], problems such as >>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>> >>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>> >>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>> applications and services >>>>>>>>>>>> >>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>> >>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>> >>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>> requests. An >>>>>>>>>>>> >>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>> either as part of a user >>>>>>>>>>>> >>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>> is a component of a network >>>>>>>>>>>> >>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>> originating user agents send >>>>>>>>>>>> >>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>> message has been >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>> >>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain >> context. >>>>>>>>>>>> >>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>> typically obviously >>>>>>>>>>>> >>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>> own credentials; if they >>>>>>>>>>>> >>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>> authentication services. However, >>>>>>>>>>>> >>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Regards, >>>>>>>>>>>> >>>>>>>>>>>> Alex >>>>>>>>>>>> * * >>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> ----------------------------------------------------------- >>>>>>>>>>>> -- >>>>>>>>>>>> - >>>>>>>>>>>> - >>>>>>>>>>>> -- >>>>>>>>>>>> ------- >>>>>>>>>>>> >>>>>>>>>>>> This e-mail may contain Sprint proprietary informatio= n >>>>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>>> use by >>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>> all copies >>>>>>>>>>>> of the message. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> _______________________________________________ >>>>>>>>>>> stir mailing list >>>>>>>>>>> stir@ietf.org >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>> >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> ________________________________ >>>>>> >>>>>> This e-mail may contain Sprint proprietary information intended >>>>>> for the sole use of the recipient(s). Any use by others is prohibite= d. >>>>>> If you are not the intended recipient, please contact the sender >>>>>> and delete all copies of the message. >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. From nobody Tue Aug 9 10:08:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9C23127077 for ; Tue, 9 Aug 2016 10:08:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 67RI87-HAZwL for ; Tue, 9 Aug 2016 10:08:48 -0700 (PDT) Received: from resqmta-ch2-12v.sys.comcast.net (resqmta-ch2-12v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A543A12B00E for ; Tue, 9 Aug 2016 10:08:46 -0700 (PDT) Received: from resomta-ch2-08v.sys.comcast.net ([69.252.207.104]) by resqmta-ch2-12v.sys.comcast.net with SMTP id XAVMbLsZIxBKTXAWDbYpKt; Tue, 09 Aug 2016 17:08:45 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id XAWBbbDh6S9gdXAWBbUqug; Tue, 09 Aug 2016 17:08:45 +0000 To: Alex Bobotek , "Peterson, Jon" , "Gorman, Pierce A [CTO]" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <4B1956260CD29F4A9622F00322FE053101285D016E37@BOBO1A.bobotek.net> From: Paul Kyzivat Message-ID: <6129213e-6747-d67d-d959-25c77ccf5bcc@alum.mit.edu> Date: Tue, 9 Aug 2016 13:08:42 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <4B1956260CD29F4A9622F00322FE053101285D016E37@BOBO1A.bobotek.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfPJ1fcnFhbgGBTySbtQbtjKRqzocE8FOBhqJdP6r4AyRy16pgG79Pid9V9GMRoxItKw2v7NmGWuHyjv9Tk3IdnGL6VHGaatbkhbxIgiYv/+kzhtjlfH6 EDZBjtmW0dNGIAOISJdyVS53zy1EJamzSxNZQdptb8Hp7UNGmukBn6Upfav4CvbEnl9Hs5UUjMmQqjVV//5EPciVpNrIysPBHGRorf6Hng0fI19scrKLE/pA k9T7ebhQ6aUs7SnN8q4wvye30aSZnW7hgOeXE1JFKchMMlf4fCOsOrjG1YKd5rUmM1Xk/+a9q5TAB/uvoXu8co6xzrwPHMPuR6zWvFs0S6+aS0EK+r5I2lVY EARC2kewV3wmUhsuCDpEKcVRm7oGkn66AtCQS3dkdGsNwy2k96QG+/bqEaBDpupwMp1IUw8vv/JXK73Wo3WeOfIrwl3dyIxvfE6xWwp7yyf/sAhi/uM= Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:08:53 -0000 On 8/9/16 12:40 PM, Alex Bobotek wrote: > Paul, > > The assertion I'm referring to is a bit different. It's: > > "I (Acme Corp), certify that this message originated and or gatewayed to SIP on my network, (and btw, I probably know which account/user actually originated this message and take responsibility for its origination or gatewaying)" The weasel word here is "probably". That needs considerably more definition. Is it your intent that there be multiple "levels" of confidence, with the signer choosing which one it is willing to use? If so, then careful consideration is required about how useful that is to the recipient. Is there sufficient definition about the differences so that the recipient can make a meaningful distinction about how to handle the call? IMO it would be better to simply sign or not, with the signer taking responsibility. If they are too lax about verification then they will be responsible for more penalties when bad things happen. This is similar to the issue of liability for fraudulent credit card charges. Retailers sometimes accept a card without a signature, because it makes customers happy and speeds transactions. But in doing so they accept the responsibility for the charge if the transaction turns out to be fraudulent. Thanks, Paul > Is this a good thing? Yes and no. From a security perspective I believe we all agree that it's best to have the (possibly delegated) authority of the rightful owner of the originating phone number as well as the identity of the responsible originating service provider (typically the signer). But this goal will be elusive; there are cases where even a well-meaning a service provider may not be able to enforce or determine whether the owner of an originating number has authorized its use. In these cases, there is high value in knowing the identity of a signer claiming some responsibility for the call's origination. The carriers' abuse desks and systems then know who to contact for abuse mitigation. > > The con to this is that some signers may be lazy, and elect to sign while omitting or not enforcing number authority policies in cases where they could. > > So IMO the right question to ask is whether the pros outweigh the cons. IHMO, the answer is an emphatic yes. > > > Regards, > > Alex > > > > >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: Tuesday, August 9, 2016 8:44 AM >> To: Alex Bobotek ; Peterson, Jon >> ; Gorman, Pierce A [CTO] >> ; Dwight, Timothy M (Tim) >> ; DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK ; >> Richard Shockey ; stir@ietf.org; Brian Rosen >> >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> On 8/9/16 5:03 AM, Alex Bobotek wrote: >>> Jon, >>> >>> Thanks much for your thoughtful response to the original points. Yes, >> things got somewhat sidetracked. >>> >>> On the first point (signing without authentication), I do not read 6.1 >>> as permitting "I'm signing to assert that I've authorized use of this >>> phone number without authenticating the caller and/or completing a >>> number delegation authority check", >> >> I'm not sure I understand. Is this the assertion you are asking for? >> >> "I (Acme Corp), having administrative authority over number NNN, certify >> that this message is "from" NNN, though I have no idea who actually >> originated this message." >> >> This is a good thing??? >> >> If you sign the message you are taking responsibility for the assertion that it >> is from NNN. If you choose to do so without knowing who it is from then that >> is your problem. You should be legally liable. At the very least your reputation >> as a signer should be diminished as fraudulent calls you have signed are >> detected. Eventually you will be put on blacklists as an untrustworthy signer. >> >> I guess we could speed the blacklisting by allowing signers to pre-declare that >> they are untrustworthy. (That seems to be what you are asking for.) >> >>> a use case that reflects the currently-widespread practice of authorization >> without authentication. >> >> No wonder we have a problem with spoofed calls. >> >> Thanks, >> Paul >> >>> My read of section 6.1 is that it allows anonymity rather than signer- >> attribution with unauthenticated (non-anonymous) caller identity. Knowing >> the triple of purported calling phone number that flashes on a recipient's >> phone, the terminating phone number and a timestamp is important in >> reporting/tracing/mitigating abusive calls. [On a side note, I reread Section >> 11, but had trouble with the definition of "private URI" (note: "private URI" >> and "private SIP URI" each occur exactly once each in the doc and could >> benefit from a definition or two).] Additionally, Brian Rosen's comment on >> 8/4 seems to corroborate my reading of a ban on authorization without >> authentication in the non-anonymous case (i.e., that using someone else's >> phone number requires that "the entity that is assigned the TN explicitly >> authorizes calls placed using it's TN"). >>> >>> In summary, there is a high value in allowing signing/authorization in the >> categories and use cases Pierce outlined. In my operational experience, it >> really helps to know which company to contact to get the callers kicked off a >> network. And signer attribution even without caller authentication is a huge >> win for the public. >>> >>> >>> >>> On the second point, thanks for pointing out that 12.1 requires servers to >> keep the state of recently received requests. This is a point that I missed in >> my reading of the draft, and this feature as you have described it defeats >> most conceivable replay attacks. My bad for missing this, but as you suggest, >> there may be some potential for emphasizing this point. But there's another >> part of the issue -- cross method replay. For example, it may be difficult to >> expect a messaging node (which handles SIP MESSAGE) and a voice-capable >> IMS node (handling SIP INVITE) to coordinate their anti-replay caches, >> allowing an attacker that observes a SIP invite for a voice call to piggyback a >> spam text message. As it's common to use the same "To" address for >> multiple services that may be served by very different infrastructure >> components, it would be beneficial to allow signatures to cover more than >> "To", "From/PAI" and "Timestamp". I do not see this issue as meriting >> significant delay of a STIR RFC if there's no quick fix. >>> >>> Regards, >>> >>> Alex >>> >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon >>>> Sent: Monday, August 8, 2016 12:46 PM >>>> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >>>> ; Dwight, Timothy M (Tim) >>>> ; DOLLY, MARTIN C >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard Shockey ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>> >>>> Just so I'm clear, I'm not hearing an ask here in terms of changing >>>> the text of rfc4474bis-10, which does allow signing PAI instead of >>>> From for precisely the reasons outlined in this lengthy thread. To >>>> Alex's original point about providing authorization without >>>> authentication, rfc4474bis has a lot of text about signing non-TN >>>> identifiers, including for preserving anonymity; see the end of >>>> section 6.1, and then the Privacy Considerations in section 11 for >>>> more. Those should suffice to provide this property: it will identify the >> service provider who signed without attesting an specific user identity. >>>> >>>> I also wanted to make sure we didn't drop the other ball that Alex >>>> mentioned at the start of this thread, which is the issue of >>>> proximate replay within the 60 second Date window. This is addressed >>>> in Section 12.1 of rfc4474bis-10, which >>>> reads: "Note that per baseline [RFC3261] behavior, servers keep state >>>> of recently received requests, and thus if an Identity header is >>>> replayed by an attacker within the Date interval, verifiers can >>>> detect that it is spoofed because a message with an identical Date >>>> from the same source had recently been received." This refers to the >>>> text of >>>> RFC3261 section 23.4.2, though more properly the Date-related >>>> behavior is better detailed in RFC3893 Section 10, which introduced >>>> the first version of the partial signature mechanism that ultimately >>>> inspired RFC4474. I'll update the text here so it is clearer about exactly >> how to detect proximate replay. >>>> >>>> Jon Peterson >>>> Neustar, Inc. >>>> >>>> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >>>> wrote: >>>> >>>>> Paul, >>>>> >>>>> As you know, SIP inter-working is often challenging because of >>>>> variability in implementation including proprietary headers (without >>>>> an >>>>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>>>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>>>> stripping things like display name in From but that's another story). >>>>> I could argue that from a cleanliness of protocol implementation, >>>>> (and if I wanted to be pedantic), I would strip PAI outbound unless >>>>> required otherwise. But the point is moot. As I mentioned in the >>>>> earlier e-mail, that is not our practice and I'm not requesting it to be so. >>>>> >>>>> Pierce >>>>> >>>>> >>>>> -----Original Message----- >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>> Sent: August 08, 2016 12:03 PM >>>>> To: Gorman, Pierce A [CTO] ; Dwight, >>>> Timothy >>>>> M >>>>> (Tim) ; DOLLY, MARTIN C >>>> >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard >>>>> Shockey ; stir@ietf.org; Brian Rosen >>>>> >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>> >>>>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>>>> Thanks for the added comments Tim. >>>>>> >>>>>> I agree that passing P-Asserted-Identity between trusted networks >>>>>> is appropriate (and the converse is true as well). Part of my >>>>>> issue is I have been conditioned from the very earliest >>>>>> implementation of Sprint's VoIP network that other carriers' IP >>>>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>>>> and even there I find language that implies trust is established by >>>>>> agreement, not by standard. (Even roaming implies agreement.) >>>>> >>>>> I understand why *some* stuff needs to be removed when forwarding >> to >>>> an >>>>> untrusted party. For instance, if the call has requested privacy, >>>>> then P-A-ID needs to be removed. >>>>> >>>>> But when privacy is not a concern, trust is really more of a concern >>>>> on the ingress side, not egress. If I don't trust you then I won't >>>>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>>>> trust you, but you don't trust me, then what is the downside for >>>>> passing along the P-A-ID? >>>>> >>>>> Thanks, >>>>> Paul >>>>> >>>>>> Regardless, this discussion has been helpful and educational (to me >>>>>> at least). And, I confirmed with my operations counterpart we >>>>>> generally send PAI today. I've also made note that where standards >>>>>> and >>>> ICA >>>>>> require it, we will include PAI. Thanks again. >>>>>> >>>>>> Best regards, >>>>>> >>>>>> Pierce >>>>>> >>>>>> -----Original Message----- >>>>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>>>> Sent: August 08, 2016 10:47 AM >>>>>> To: Gorman, Pierce A [CTO] ; DOLLY, >>>> MARTIN >>>>>> C >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>>>> Richard Shockey ; Paul Kyzivat >>>>>> ; stir@ietf.org; Brian Rosen >>>>>> >>>>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Pierce, >>>>>> >>>>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >>>> GSMA >>>>>> IR.95. The latter references and profiles the former. Section >>>>>> 4.4.1 of >>>>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>>>> considered trusted, and table 3 in that section recommends that >>>>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>>>> It also states that PAI is mandatory at a roaming NNI. >>>>>> >>>>>> Tim >>>>>> >>>>>> >>>>>> -----Original Message----- >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>>>> Pierce A [CTO] >>>>>> Sent: Monday, August 08, 2016 8:52 AM >>>>>> To: DOLLY, MARTIN C >>>>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>>>> stir@ietf.org; Brian Rosen >>>>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Martin, >>>>>> >>>>>> You referenced TS 29.195. I'm not familiar with that spec. Has it >>>>>> been deprecated? It's not showing up on the 3GPP site. >>>>>> >>>>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the >>>>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>>>> header when interworking with untrusted networks." >>>>>> >>>>>> Your remark is consistent with Note 4, but only if we agree that, >>>>>> for instance, the AT&T network and the Sprint network are "trusted >>>>>> networks". In reality, this is not the case or there would be no >>>>>> firewalls or Session Border Controllers used for interworking and >>>>>> security. My opinion is the only carrier networks that are trusted >>>>>> are the SS7 network, and the Internet backbone. >>>>>> >>>>>> What it really comes down to is that PAI is left in signaling >>>>>> either through formal specification as a part of an inter-carrier >>>>>> inter-connection agreement, or by custom (or even by accident). I >>>>>> think this illustrates Paul Rosbotham's observation is true. >>>>>> >>>>>> Pierce >>>>>> >>>>>> -----Original Message----- >>>>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>>>> Sent: August 05, 2016 12:55 PM >>>>>> To: Gorman, Pierce A [CTO] >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Brian >>>>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>>>> ; Richard Shockey >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> PAI is not stripped at the network boundary between trusted >>>>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>>>> ITU And the list goes on >>>>>> >>>>>> Martin C Dolly >>>>>> Lead Member of Technical Staff >>>>>> Core & Government/Regulatory Standards AT&T >>>>>> Cell: 609-903-3360 >>>>>> Email: md3135@att.com >>>>>> >>>>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>>>> wrote: >>>>>>> >>>>>>> Which header the carrier chooses to display is moot if the header >>>>>>> is stripped between carriers as per at least one standard. I >>>>>>> think Paul Rosbotham's observation we're likely to encounter "some >>>>>>> interesting interworking challenges" was perhaps the >> understatement of the year. >>>>>>> >>>>>>> Pierce >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>>>> Sent: August 05, 2016 11:58 AM >>>>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>>>> ; Brian Rosen >> >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>> >>>>>>> If PAI is present and signed, and From is also signed, I would >>>>>>> expect it to be up to the UA to decide what to display, not the carrier. >>>>>>> >>>>>>> Of course this will work differently if there is a different >>>>>>> signaling regime between the carrier and the user device (e.g. >>>>>>> black >>>> phone). >>>>>>> >>>>>>> Thanks, >>>>>>> Paul >>>>>>> >>>>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>>>> controller functions and is not to be used in inter-carrier >>>>>>>> inter-connection (although it commonly shows up anyway). My >> opinion is the "From" >>>>>>>> header is likely used more often for presentation. >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>>>> Sent: August 05, 2016 9:37 AM >>>>>>>> To: Rosbotham, Paul, Vodafone UK >>>> ; >>>>>>>> Paul Kyzivat ; Brian Rosen >>>>>>>> >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> >>>>>>>> Humm this is getting interesting. Its my understanding that the >>>>>>>> display number aka "presentation number" in the US context is the >>>>>>>> one carried in the PAI. Martin, Pierce? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone >> UK" >>>>>>>> > paul.rosbotham@vodafone.com> >>>> wrote: >>>>>>>> >>>>>>>> Jumping in now that we're on European working time, +1 on >>>>>>>> Paul's observation. >>>>>>>> >>>>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>>>> IDs....one (we term the Network Number, carried in PAID) uniquely >>>>>>>> identifies the line, the other (we term Presentation Number, >>>>>>>> carried in From) is used for display purposes. >>>>>>>> >>>>>>>> Only the carrier has the authority to set the Network Number >>>>>>>> so only they could sign it. >>>>>>>> >>>>>>>> But - subject to regulatory restrictions which are well >>>>>>>> documented >>>>>>>> - the number sent for display purposes belongs to the customer. >>>>>>>> For blue-chip customers, I can allow them to send their >>>>>>>> Presentation Numbers into the network, and can't readily check at >>>>>>>> a network level that they're theirs (I do have contractual >>>>>>>> safeguards). The number may have been allocated by me, or could >>>>>>>> be allocated by a third party provider. If it's a call-centre >>>>>>>> they'll be making outbound calls for lots of different customers >>>>>>>> which will change on day-by-day >>>> basis. >>>>>>>> This is business as usual. I don't like the term "authorised >>>>>>>> spoofing" because it implies that the CLI is in some way being rigged: >>>>>>>> it's not, it's the corporate customer or their subcontractor >>>>>>>> using the number that's been assigned (so in internet terms >>>>>>>> delegated) to them via a chain of trust from the regulator. >>>>>>>> >>>>>>>> What I want is the ability for customers to use their >>>>>>>> credentials to sign the CLIs they send me so that at the >>>>>>>> terminating end it can be checked (or indeed somewhere en-route >>>>>>>> if that's the business model). >>>>>>>> I can and would sign for customers on my mobile business since >>>>>>>> I'm driving what number is presented, but that's by-the-by >>>>>>>> because they aren't the ones who generate millions of nuisance >>>>>>>> calls. If the signing only occurs at the originating carrier >>>>>>>> level for corporate/call-centre customers that's no use because >>>>>>>> I'm not in a position to do that for these type of >>>>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>>>> also highlight there are many more of my large customers that I'd >>>>>>>> trust more than a far end originating carrier that could be >>>>>>>> anywhere in the world (though we have no shortage of small >>>>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>>>> UK....) >>>>>>>> >>>>>>>> Regards >>>>>>>> >>>>>>>> Paul >>>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >>>>>>>> Sent: 04 August 2016 23:12 >>>>>>>> To: Brian Rosen >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>>>> delegated the TN, it's being authorized to place calls that are >>>>>>>>> not >>>>>>>> >from that TN, but appear to be. >>>>>>>>> >>>>>>>>> The mechanism to handle the credential is exactly the same as a >>>>>>>>> delegation, so if you want to call it delegation, go ahead, but >>>>>>>>> I prefer to call it authorized spoofing. >>>>>>>> >>>>>>>> IIUC the delegation is to a responsible entity (something that >>>>>>>> can be held legally accountable - e.g. a person), not to a device. >>>>>>>> The entity can then "use" the credential via any device(s) it >>>>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>>>> two-line >>>> phone. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>>>> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>>>> phone as calling party. >>>>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>>>> carrier to him. He then creates another credential, which he >>>>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>>>> (because the call is coming from his mobile's TN but claims to >>>>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>>>> could give the credential to his mobile SP if they sign on his >> behalf. >>>>>>>>>> >>>>>>>>>> I don't understand how that is different from regular delegation. >>>>>>>>>> >>>>>>>>>> When his landline carrier gave him a delegated certificate for >>>>>>>>>> his landline number, he should be able to install that in >>>>>>>>>> whatever devices he wants - his landline UA, his mobile phone, >>>>>>>>>> etc. It is still delegated from his landline carrier, even when >>>>>>>>>> used with calls via his mobile carrier. >>>>>>>>>> >>>>>>>>>> Thanks, >>>>>>>>>> Paul >>>>>>>>>> >>>>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>>>> legitimate use. >>>>>>>>>>> >>>>>>>>>>> But that's how I describe it. >>>>>>>>>>> >>>>>>>>>>> Brian >>>>>>>>>>> >>>>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>>>> > >> wrote: >>>>>>>>>>>> >>>>>>>>>>>> +1, but with one question below: >>>>>>>>>>>> >>>>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>>>> delegation path, >>>>>>>>>>>> >>>>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>>>> authorized spoofers. >>>>>>>>>>>> >>>>>>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>>>>>> contrasted to "spoofers" who have been delegated their >>>> authority. >>>>>>>>>>>> >>>>>>>>>>>> Thanks, >>>>>>>>>>>> Paul >>>>>>>>>>>> >>>>>>>>>>>>> I don't think it matters who the delegator or delegatee are >>>>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>>>> delegated to, so authorities can follow the delegation path. >>>>>>>>>>>>> There are plenty of certificated carriers who are willing to >>>>>>>>>>>>> not care who they delegate to. The fact that there are some >>>>>>>>>>>>> who do doesn't change much. >>>>>>>>>>>>> Making stir work means knowing who you are delegating to, >> so >>>>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>>>> >>>>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>>>> been delegated. >>>>>>>>>>>>> If it does, it's asserting that the calls are from who they >>>>>>>>>>>>> are supposed to be from. >>>>>>>>>>>>> That should be straightforward, but we know it's not always, >>>>>>>>>>>>> and that represents the hard part of deployment in my >> opinion. >>>>>>>>>>>>> But once they delegate, they can hand responsibility to sign >>>>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>>>> they are delegating to. >>>>>>>>>>>>> >>>>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>>>> we get into >>>>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>>>> which we don't. >>>>>>>>>>>>> Our model is that you know who you delegate to, and once >> you >>>>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>>>> some business practices. >>>>>>>>>>>>> >>>>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>>>> >>>>>>>>>>>>> Brian >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>>>> policy and use cases. >>>>>>>>>>>>>> >>>>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be >> deployed >>>>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>>>> my reason for suggesting a way to qualify the signature to >>>>>>>>>>>>>> reflect that variability. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>>>> numbers, and can qualify to some degree the >> trustworthiness >>>>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>>>> >>>>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>>>> most-authenticated. There can be >>>> more >>>>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>>>> complexity (both for the carriers and the consumers) and I >>>>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>>>> >>>>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and fraud. >>>>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>>>> mobile consumers where their carriers are able to usefully >>>>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>>>> >>>>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>>>> (revoked, not >>>>>>>>>>>>>> revoked) for authenticating calling number will not work >> well. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>>>> well, if the calling party has to sign a call with a per-TN >>>>>>>>>>>>>> cert provided by the called party. No called party cert to >> include? >>>>>>>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>>>> >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>>>> policy issue. >>>>>>>>>>>>>> >>>>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>>>> design of stir, and the design allows delegation of one TN >>>>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>>>> NAM phone could have >>>> more >>>>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>>>> mobile phone may also have a credential for, say, a TN that >>>>>>>>>>>>>> is delegated to a landline, to cover the example case of a >>>>>>>>>>>>>> doctor placing a call on his mobile, but getting his office >>>>>>>>>>>>>> number to show up as the calling party. Use of such >> mechanisms is policy. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. >>>>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>>>> phones and any other devices that can be programmed to >> do >>>> so. >>>>>>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign >>>>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>>>> will want to get out of the liability of signing on behalf >>>>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>>>> so. That means the devices have to be able to sign, but I >>>>>>>>>>>>>> understand many of the PBX vendors think that's something >>>>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >> >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>>>> signature, >>>>>>>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>>>> assign to >>>>>>>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>>>> "authorized >>>>>>>>>>>>>> spoofing". The companion devices I'm aware of always >> send >>>>>>>>>>>>>> calls from the same service provider and should not >> present >>>>>>>>>>>>>> any issue. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>>>> implement >>>>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>>>> where a >>>>>>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>>>>> way of >>>>>>>>>>>>>> knowing whether the calling number is properly >> assigned >>>>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>>>> >from an >>>>>>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>>>> And in >>>>>>>>>>>>>> the consumer market, there are calling products which >>>>>>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>>>>> devices >>>>>>>>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>>>>>>>> the parent subscriber. These are examples of where >> the >>>>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>>>> necessarily mean >>>>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>>>> a single >>>>>>>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>>>>>>> spoof checking. >>>>>>>>>>>>>> >>>>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>>>> (assuming nonce >>>>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>>>> suggested >>>>>>>>>>>>>> below by Alex). >>>>>>>>>>>>>> >>>>>>>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>>>>>>> could be as follows: >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>>>> >>>>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>>>>>>> networks that don't natively support SIP or which don't >>>>>>>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>>>> >>>>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>>>> roaming >>>>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> entirely >>>>>>>>>>>>>> untrustworthy >>>>>>>>>>>>>> >>>>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>>>> OCN, but >>>>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> less than >>>>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>>>> >>>>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>>>> calls from >>>>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>>>>>>> trustworthy >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>>>> >>>>>>>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>>>>>>> available authentication services resources. e.g., >>>>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>>>> cetera. >>>>>>>>>>>>>> Could/would pass credentials down to SIP-aware >> devices >>>>>>>>>>>>>> which would process them according to the rules of the >>>>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>>>> >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>>>> placing a >>>>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>>>> telephone >>>>>>>>>>>>>> number used in From/PAI, and in such circumstances >> the >>>>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>>>> call may >>>>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>>>> serving the >>>>>>>>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>>>> authorizes calls >>>>>>>>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>>>> authentication. We're not aware of any cases where >>>>>>>>>>>>>> there >>>>>>>>>>>>>> is an actual requirement for legitimate calling without >>>>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>>>> although >>>>>>>>>>>>>> we certainly are aware that various parts of various >>>>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>>>> point, at >>>>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>>>> that the >>>>>>>>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>>>>>>>> any more. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>>>> authentication >>>>>>>>>>>>>> In the current telephony network practice, some >>>>>>>>>>>>>> service provider implementations choose not to >>>>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>>>> the use >>>>>>>>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>>>> anyone >>>>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>>>> industry >>>>>>>>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>>>> prevalence >>>>>>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>>>> closest >>>>>>>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>>>>>>> better to ID service providers than unreasonably >>>>>>>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>>>>> should >>>>>>>>>>>>>> support authorization without authentication. The >>>>>>>>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>>>>>> (service provider identification). The language of >>>>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>>>> should NOT >>>>>>>>>>>>>> require or assume that that authentication will >>>>>>>>>>>>>> precede authorization. Of course there may be other >>>>>>>>>>>>>> use cases where signing includes authentication and >>>>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>>>> authorization. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>>>> with this >>>>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>>>> within >>>>>>>>>>>>>> 60 >>>>>>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>>>>> legal >>>>>>>>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>>>>>>>> mky may not be present and if present its use is >>>>>>>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>>>>> Call-ID >>>>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>>>> receiving end >>>>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>>>> (e.g., >>>>>>>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>>>> difficulties >>>>>>>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>>>> This might >>>>>>>>>>>>>> include an mkey from a captured INVITE. So it >>>>>>>>>>>>>> may be >>>>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>>>>> using a >>>>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>>>> distributed >>>>>>>>>>>>>> implementations may make the enforcement difficult, >>>>>>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>>>>> method >>>>>>>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>>>>>>> practice should at least be discussed while perhaps >>>>>>>>>>>>>> not required. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> NITS >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>>>> >>>>>>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>>>>>> present, then the >>>>>>>>>>>>>> >>>>>>>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>>>>>>> parameter value is >>>>>>>>>>>>>> >>>>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>>>> >>>>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>>>> parameter value is present, >>>>>>>>>>>>>> >>>>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>>>> including the variations >>>>>>>>>>>>>> >>>>>>>>>>>>>> described in Step 5. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> 3 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>> 447 >>>>>>>>>>>>>> 4bi >>>>>>>>>>>>>> s-10%20- >>>> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>>>> Ses >> sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >>>> 3>. >>>>>>>>>>>>>> Background >>>>>>>>>>>>>> >>>>>>>>>>>>>> [...] >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>>>> ], problems such as >>>>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>>>> >>>>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>>>> >>>>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>>>> applications and services >>>>>>>>>>>>>> >>>>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>>>> >>>>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>>>> >>>>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>>>> requests. An >>>>>>>>>>>>>> >>>>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>>>> either as part of a user >>>>>>>>>>>>>> >>>>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>>>> is a component of a network >>>>>>>>>>>>>> >>>>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>>>> originating user agents send >>>>>>>>>>>>>> >>>>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>>>> message has been >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>>>> >>>>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain >>>> context. >>>>>>>>>>>>>> >>>>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>>>> typically obviously >>>>>>>>>>>>>> >>>>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>>>> own credentials; if they >>>>>>>>>>>>>> >>>>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>>>> authentication services. However, >>>>>>>>>>>>>> >>>>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Regards, >>>>>>>>>>>>>> >>>>>>>>>>>>>> Alex >>>>>>>>>>>>>> * * >>>>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>> _______________________________________________ >>>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> ----------------------------------------------------------- >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> - >>>>>>>>>>>>>> - >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> ------- >>>>>>>>>>>>>> >>>>>>>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>>>>> use by >>>>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>>>> all copies >>>>>>>>>>>>>> of the message. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>> >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>> >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> ________________________________ >>>>>>>> >>>>>>>> This e-mail may contain Sprint proprietary information intended >>>>>>>> for the sole use of the recipient(s). Any use by others is prohibited. >>>>>>>> If you are not the intended recipient, please contact the sender >>>>>>>> and delete all copies of the message. >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>> > > From nobody Tue Aug 9 10:10:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9477912D0F6 for ; Tue, 9 Aug 2016 10:10:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfjyfHsN9v7M for ; Tue, 9 Aug 2016 10:10:32 -0700 (PDT) Received: from resqmta-ch2-05v.sys.comcast.net (resqmta-ch2-05v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F07D12D1D5 for ; Tue, 9 Aug 2016 10:10:32 -0700 (PDT) Received: from resomta-ch2-08v.sys.comcast.net ([69.252.207.104]) by resqmta-ch2-05v.sys.comcast.net with SMTP id XATqbTgyL2FGMXAXvb5j6X; Tue, 09 Aug 2016 17:10:31 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id XAXubbE7BS9gdXAXubUrBV; Tue, 09 Aug 2016 17:10:31 +0000 To: "Gorman, Pierce A [CTO]" , Alex Bobotek , "Peterson, Jon" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> From: Paul Kyzivat Message-ID: <0ce62665-ccb8-4668-71f4-ae59f4d7f698@alum.mit.edu> Date: Tue, 9 Aug 2016 13:10:30 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: base64 X-CMAE-Envelope: MS4wfOysB99ILu7C8xVJSbtnpPdp30/4dYPeMafTnnwu4dacrPHwcxPBSJnn1bOIBDZv6Kn9iyk1EIKI2qOmx/tSGB/cDA8eiMnMGLP7YYgZoBPoRW9XJjrG hFdOrL2fx4uPeBjUktMXPRuoDpgxidmA36162iTRc5YPtpuYTdc3kWvWS7smiJ4RPDWwQeifNssmGn+SvEHoIgjodJ/qkB4Sqmc9pRZYnx6+OJMNgrtMSwHC Qvwe4icBERrzAGhudu2Xw/2Zfjeer9f38+Jy/WkTED5Rz1VMJ2bYd2w7qOzkdlPznmpDtONOBYIWGfqizM0v4gQFqpVKWREZib4fOqjya4fLC6wkNOkhCdaB XR/BzSLM7mccsUWVQYXJydtpz6YC+jvL4dt3MW40Q9rtWcwtdmomNGgHFn19kV4ds8XmE6Yns1gd0zhAn5xP9qk8MfCFKGqvbnrjkoOVkuA/hYzznOc= Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:10:35 -0000 U2VlIHRoZSByZXBseSBJIGp1c3Qgc2VudCB0byBBbGV4Lg0KDQpPbiA4LzkvMTYgMTowNCBQ TSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSB3cm90ZToNCj4gIiBJZiB5b3Ugc2lnbiB0aGUg bWVzc2FnZSB5b3UgYXJlIHRha2luZyByZXNwb25zaWJpbGl0eSBmb3IgdGhlIGFzc2VydGlv biB0aGF0IGl0IGlzIGZyb20gTk5OLiBJZiB5b3UgY2hvb3NlIHRvIGRvIHNvIHdpdGhvdXQg a25vd2luZyB3aG8gaXQgaXMgZnJvbSB0aGVuIHRoYXQgaXMgeW91ciBwcm9ibGVtLiINCj4N Cj4gUGF1bCwNCj4NCj4gRm9sbG93aW5nIHRoaXMgc3RhbmRhcmQgb2YgbGlhYmlsaXR5LCBl dmVyeSBJU1Agc2hvdWxkIGJlIGZvcmNlZCB0byBzaWduIElQIHBhY2tldHMgYW5kIGJlIGxp YWJsZSBmb3IgaGFja2luZyBhdHRlbXB0cyB3aGljaCBvcmlnaW5hdGUgb24gdGhlaXIgSVAg bmV0d29ya3MuDQo+DQo+IEp1c3QgYXMgcmV2ZXJzZSB1bmljYXN0IHBhdGggZm9yd2FyZGlu ZyBpcyBub3Qgb2Z0ZW4gKGV2ZXI/KSB1c2VkIGluIHRoZSBJbnRlcm5ldCBiYWNrYm9uZSBv ciBJU1AgbmV0d29ya3MgdG8gZW5zdXJlIElQIHBhY2tldHMgZG9uJ3QgY29tZSBmcm9tIG5l dHdvcmtzIHRoZXkgY2FuJ3QgaGF2ZSBvcmlnaW5hdGVkIGZyb20sIG5laXRoZXIgZG8gYWxs IHRlbGVwaG9uZSBuZXR3b3JrcyAiY2hlY2siIGVhY2ggb3JpZ2luYXRpbmcgdGVsZXBob25l IG51bWJlciB0byBkZXRlcm1pbmUgd2hldGhlciB0aGV5IHNob3VsZCBoYXZlIGJlZW4gYWJs ZSB0byBvcmlnaW5hdGUgZnJvbSBhIHBhcnRpY3VsYXIgY2FycmllciBvciBlbnRlcnByaXNl IGFuZCBmb3IgdGhlIHNhbWUgcmVhc29ucyAtIGl0IGlzIGRpZmZpY3VsdCwgaW1wZXJmZWN0 LCBhbmQgZXhwZW5zaXZlLiAgSnVzdCBhcyBpdCBpcyB3aXRoIHRoZSBJbnRlcm5ldCBiYWNr Ym9uZSwgaXQncyBhY3R1YWxseSByZWFzb25hYmx5IGNoYWxsZW5naW5nIGp1c3QgZGVsaXZl cmluZyB0aGUgY2FsbHMgKG9yIElQIHBhY2tldHMpIHRvIHRoZSBudW1iZXIgdGhhdCBpdCBp cyBhZGRyZXNzZWQgdG8sIHdpdGhvdXQgYWxzbyBoYXZpbmcgdG8gYWxzbyB3b3JyeSBhYm91 dCB3aGVyZSBpdCBzdXBwb3NlZGx5IGNhbWUgZnJvbS4NCj4NCj4gSSdtIHRlbGxpbmcgeW91 IHdlIGNhbiBkaWZmZXJlbnRpYXRlIHRoZSB0cnVzdHdvcnRoeS1uZXNzIChsaWtlIFN0ZXBo ZW4gQ29sYmVydCdzICJ0cnV0aC1pbmVzcyIpIG9mIGNhbGxzLiAgV2UgY2FuIHRlbGwgaWYg YSBjYWxsIG9yaWdpbmF0ZWQgZnJvbSBhIHN1YnNjcmliZXIgdXNpbmcgYSBkZXZpY2Ugd2hp Y2ggaGFzIHRvIGF1dGhlbnRpY2F0ZSB0byB0aGUgbmV0d29yayBiZWZvcmUgaXQncyBwZXJt aXR0ZWQgdG8gcGxhY2UgY2FsbHMgKGV4Y2VwdCBtYW51YWwgcm9hbWluZyBhbmQgc29tZSBF OTExIGNhbGxzKS4gIEFuZCB3ZSBjYW4gdGVsbCBpZiBhIGNhbGwgb3JpZ2luYXRlZCAob3Ig d2FzIHN1YmplY3RlZCB0byBtaWQtY2FsbCAzcmQgcGFydHkgY2FsbCBjb250cm9sIGZyb20g YW4gZW50ZXJwcmlzZSBvciBtb2JpbGUgdmlydHVhbCBuZXR3b3JrIG9wZXJhdG9yIHBhcnRu ZXIgZm9yIGV4YW1wbGUpIGFuZCBpcyB0aGVyZWZvcmUgbm90IGFzIHRydXN0d29ydGh5IGFz IHRoZSBkaXJlY3RseS1jb25uZWN0ZWQgYW5kIGF1dGhlbnRpY2F0ZWQgbW9iaWxlIHN1YnNj cmliZXIgKGZvciBleGFtcGxlKS4gIFdlIGNhbiBwYXNzIHRoYXQgcmVsYXRpdmUgdHJ1c3R3 b3J0aGluZXNzIGluZm9ybWF0aW9uIGFsb25nIGluIHNpZ25hbGluZyBhbmQgaXQgY2FuIGJl IHVzZWQgdG8gdXNlZnVsbHkgZGlmZmVyZW50aWF0ZSB0cmVhdG1lbnQsIHVsdGltYXRlbHks IGJ5IHRoZSBjb25zdW1lci4NCj4NCj4gV2hhdCB5b3Ugd2FudCBpcyB0aGF0IHRoZSBjYWxs aW5nIG51bWJlciBpcyBhbHdheXMsIHVuaXZlcnNhbGx5LCBvbmx5IGV2ZXIgdHJ1c3R3b3J0 aHkuICBNeSBvcGluaW9uIGlzIHRoYXQgaXMgdW5yZWFsaXN0aWMgYW5kIHVucmVhc29uYWJs ZS4NCj4NCj4gUGllcmNlDQo+DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZy b206IFBhdWwgS3l6aXZhdCBbbWFpbHRvOnBreXppdmF0QGFsdW0ubWl0LmVkdV0NCj4gU2Vu dDogQXVndXN0IDA5LCAyMDE2IDEwOjQ0IEFNDQo+IFRvOiBBbGV4IEJvYm90ZWsgPGFsZXhA Ym9ib3Rlay5uZXQ+OyBQZXRlcnNvbiwgSm9uIDxqb24ucGV0ZXJzb25AbmV1c3Rhci5iaXo+ OyBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20+OyBE d2lnaHQsIFRpbW90aHkgTSAoVGltKSA8dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5jb20+OyBE T0xMWSwgTUFSVElOIEMgPG1kMzEzNUBhdHQuY29tPg0KPiBDYzogUm9zYm90aGFtLCBQYXVs LCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsgUmljaGFyZCBT aG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3Nl biA8YnJAYnJpYW5yb3Nlbi5uZXQ+DQo+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0 YmlzLTEwIGNvbW1lbnRzDQo+DQo+IE9uIDgvOS8xNiA1OjAzIEFNLCBBbGV4IEJvYm90ZWsg d3JvdGU6DQo+PiBKb24sDQo+Pg0KPj4gVGhhbmtzIG11Y2ggZm9yIHlvdXIgdGhvdWdodGZ1 bCByZXNwb25zZSB0byB0aGUgb3JpZ2luYWwgcG9pbnRzLiAgWWVzLCB0aGluZ3MgZ290IHNv bWV3aGF0IHNpZGV0cmFja2VkLg0KPj4NCj4+IE9uIHRoZSBmaXJzdCBwb2ludCAoc2lnbmlu ZyB3aXRob3V0IGF1dGhlbnRpY2F0aW9uKSwgSSBkbyBub3QgcmVhZCA2LjENCj4+IGFzIHBl cm1pdHRpbmcgIkknbSBzaWduaW5nIHRvIGFzc2VydCB0aGF0IEkndmUgYXV0aG9yaXplZCB1 c2Ugb2YgdGhpcw0KPj4gcGhvbmUgbnVtYmVyIHdpdGhvdXQgYXV0aGVudGljYXRpbmcgdGhl IGNhbGxlciBhbmQvb3IgY29tcGxldGluZyBhDQo+PiBudW1iZXIgZGVsZWdhdGlvbiBhdXRo b3JpdHkgY2hlY2siLA0KPg0KPiBJJ20gbm90IHN1cmUgSSB1bmRlcnN0YW5kLiBJcyB0aGlz IHRoZSBhc3NlcnRpb24geW91IGFyZSBhc2tpbmcgZm9yPw0KPg0KPiAiSSAoQWNtZSBDb3Jw KSwgaGF2aW5nIGFkbWluaXN0cmF0aXZlIGF1dGhvcml0eSBvdmVyIG51bWJlciBOTk4sIGNl cnRpZnkgdGhhdCB0aGlzIG1lc3NhZ2UgaXMgImZyb20iIE5OTiwgdGhvdWdoIEkgaGF2ZSBu byBpZGVhIHdobyBhY3R1YWxseSBvcmlnaW5hdGVkIHRoaXMgbWVzc2FnZS4iDQo+DQo+IFRo aXMgaXMgYSBnb29kIHRoaW5nPz8/DQo+DQo+IElmIHlvdSBzaWduIHRoZSBtZXNzYWdlIHlv dSBhcmUgdGFraW5nIHJlc3BvbnNpYmlsaXR5IGZvciB0aGUgYXNzZXJ0aW9uIHRoYXQgaXQg aXMgZnJvbSBOTk4uIElmIHlvdSBjaG9vc2UgdG8gZG8gc28gd2l0aG91dCBrbm93aW5nIHdo byBpdCBpcyBmcm9tIHRoZW4gdGhhdCBpcyB5b3VyIHByb2JsZW0uIFlvdSBzaG91bGQgYmUg bGVnYWxseSBsaWFibGUuIEF0IHRoZSB2ZXJ5IGxlYXN0IHlvdXIgcmVwdXRhdGlvbiBhcyBh IHNpZ25lciBzaG91bGQgYmUgZGltaW5pc2hlZCBhcyBmcmF1ZHVsZW50IGNhbGxzIHlvdSBo YXZlIHNpZ25lZCBhcmUgZGV0ZWN0ZWQuIEV2ZW50dWFsbHkgeW91IHdpbGwgYmUgcHV0IG9u IGJsYWNrbGlzdHMgYXMgYW4gdW50cnVzdHdvcnRoeSBzaWduZXIuDQo+DQo+IEkgZ3Vlc3Mg d2UgY291bGQgc3BlZWQgdGhlIGJsYWNrbGlzdGluZyBieSBhbGxvd2luZyBzaWduZXJzIHRv IHByZS1kZWNsYXJlIHRoYXQgdGhleSBhcmUgdW50cnVzdHdvcnRoeS4gKFRoYXQgc2VlbXMg dG8gYmUgd2hhdCB5b3UgYXJlIGFza2luZyBmb3IuKQ0KPg0KPj4gYSB1c2UgY2FzZSB0aGF0 IHJlZmxlY3RzIHRoZSBjdXJyZW50bHktd2lkZXNwcmVhZCBwcmFjdGljZSBvZiBhdXRob3Jp emF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24uDQo+DQo+IE5vIHdvbmRlciB3ZSBoYXZl IGEgcHJvYmxlbSB3aXRoIHNwb29mZWQgY2FsbHMuDQo+DQo+IFRoYW5rcywNCj4gUGF1bA0K Pg0KPj4gTXkgcmVhZCBvZiBzZWN0aW9uIDYuMSBpcyB0aGF0IGl0IGFsbG93cyBhbm9ueW1p dHkgcmF0aGVyIHRoYW4gc2lnbmVyLWF0dHJpYnV0aW9uIHdpdGggdW5hdXRoZW50aWNhdGVk IChub24tYW5vbnltb3VzKSBjYWxsZXIgaWRlbnRpdHkuICBLbm93aW5nIHRoZSB0cmlwbGUg b2YgcHVycG9ydGVkIGNhbGxpbmcgcGhvbmUgbnVtYmVyIHRoYXQgZmxhc2hlcyBvbiBhIHJl Y2lwaWVudCdzIHBob25lLCB0aGUgdGVybWluYXRpbmcgcGhvbmUgbnVtYmVyIGFuZCBhIHRp bWVzdGFtcCBpcyBpbXBvcnRhbnQgaW4gcmVwb3J0aW5nL3RyYWNpbmcvbWl0aWdhdGluZyBh YnVzaXZlIGNhbGxzLiAgW09uIGEgc2lkZSBub3RlLCBJIHJlcmVhZCBTZWN0aW9uIDExLCBi dXQgaGFkIHRyb3VibGUgd2l0aCB0aGUgZGVmaW5pdGlvbiBvZiAicHJpdmF0ZSBVUkkiIChu b3RlOiAgInByaXZhdGUgVVJJIiBhbmQgInByaXZhdGUgU0lQIFVSSSIgZWFjaCBvY2N1ciBl eGFjdGx5IG9uY2UgZWFjaCBpbiB0aGUgZG9jIGFuZCBjb3VsZCBiZW5lZml0IGZyb20gYSBk ZWZpbml0aW9uIG9yIHR3bykuXSAgIEFkZGl0aW9uYWxseSwgQnJpYW4gUm9zZW4ncyBjb21t ZW50IG9uIDgvNCBzZWVtcyB0byBjb3Jyb2JvcmF0ZSBteSByZWFkaW5nIG9mIGEgYmFuIG9u IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbiBpbiB0aGUgbm9uLWFub255 bW91cyBjYXNlIChpLmUuLCB0aGF0IHVzaW5nIHNvbWVvbmUgZWxzZSdzIHBob25lIG51bWJl ciByZXF1aXJlcyB0aGF0ICJ0aGUgZW50aXR5IHRoYXQgaXMgYXNzaWduZWQgdGhlIFROIGV4 cGxpY2l0bHkgYXV0aG9yaXplcyBjYWxscyBwbGFjZWQgdXNpbmcgaXQncyBUTiIpLg0KPj4N Cj4+IEluIHN1bW1hcnksIHRoZXJlIGlzIGEgaGlnaCB2YWx1ZSBpbiBhbGxvd2luZyBzaWdu aW5nL2F1dGhvcml6YXRpb24gaW4gdGhlIGNhdGVnb3JpZXMgYW5kIHVzZSBjYXNlcyBQaWVy Y2Ugb3V0bGluZWQuICBJbiBteSBvcGVyYXRpb25hbCBleHBlcmllbmNlLCBpdCByZWFsbHkg aGVscHMgdG8ga25vdyB3aGljaCBjb21wYW55IHRvIGNvbnRhY3QgdG8gZ2V0IHRoZSBjYWxs ZXJzIGtpY2tlZCBvZmYgYSBuZXR3b3JrLiAgQW5kIHNpZ25lciBhdHRyaWJ1dGlvbiBldmVu IHdpdGhvdXQgY2FsbGVyIGF1dGhlbnRpY2F0aW9uIGlzIGEgaHVnZSB3aW4gZm9yIHRoZSBw dWJsaWMuDQo+Pg0KPj4NCj4+DQo+PiBPbiB0aGUgc2Vjb25kIHBvaW50LCB0aGFua3MgZm9y IHBvaW50aW5nIG91dCB0aGF0IDEyLjEgcmVxdWlyZXMgc2VydmVycyB0byBrZWVwIHRoZSBz dGF0ZSBvZiByZWNlbnRseSByZWNlaXZlZCByZXF1ZXN0cy4gIFRoaXMgaXMgYSBwb2ludCB0 aGF0IEkgbWlzc2VkIGluIG15IHJlYWRpbmcgb2YgdGhlIGRyYWZ0LCBhbmQgdGhpcyBmZWF0 dXJlIGFzIHlvdSBoYXZlIGRlc2NyaWJlZCBpdCBkZWZlYXRzIG1vc3QgY29uY2VpdmFibGUg cmVwbGF5IGF0dGFja3MuICBNeSBiYWQgZm9yIG1pc3NpbmcgdGhpcywgYnV0IGFzIHlvdSBz dWdnZXN0LCB0aGVyZSBtYXkgYmUgc29tZSBwb3RlbnRpYWwgZm9yIGVtcGhhc2l6aW5nIHRo aXMgcG9pbnQuICBCdXQgdGhlcmUncyBhbm90aGVyIHBhcnQgb2YgdGhlIGlzc3VlIC0tIGNy b3NzIG1ldGhvZCByZXBsYXkuICBGb3IgZXhhbXBsZSwgaXQgbWF5IGJlIGRpZmZpY3VsdCB0 byBleHBlY3QgYSBtZXNzYWdpbmcgbm9kZSAod2hpY2ggaGFuZGxlcyBTSVAgTUVTU0FHRSkg YW5kIGEgdm9pY2UtY2FwYWJsZSBJTVMgbm9kZSAoaGFuZGxpbmcgU0lQIElOVklURSkgdG8g Y29vcmRpbmF0ZSB0aGVpciBhbnRpLXJlcGxheSBjYWNoZXMsIGFsbG93aW5nIGFuIGF0dGFj a2VyIHRoYXQgb2JzZXJ2ZXMgYSBTSVAgaW52aXRlIGZvciBhIHZvaWNlIGNhbGwgdG8gcGln Z3liYWNrIGEgc3BhbSB0ZXh0IG1lc3NhZ2UuICBBcyBpdCdzIGNvbW1vbiB0byB1c2UgdGhl IHNhbWUgIlRvIiBhZGRyZXNzIGZvciBtdWx0aXBsZSBzZXJ2aWNlcyB0aGF0IG1heSBiZSBz ZXJ2ZWQgYnkgdmVyeSBkaWZmZXJlbnQgaW5mcmFzdHJ1Y3R1cmUgY29tcG9uZW50cywgaXQg d291bGQgYmUgYmVuZWZpY2lhbCB0byBhbGxvdyBzaWduYXR1cmVzIHRvIGNvdmVyIG1vcmUg dGhhbiAiVG8iLCAiRnJvbS9QQUkiIGFuZCAiVGltZXN0YW1wIi4gICBJIGRvIG5vdCBzZWUg dGhpcyBpc3N1ZSBhcyBtZXJpdGluZyBzaWduaWZpY2FudCBkZWxheSBvZiBhIFNUSVIgUkZD IGlmIHRoZXJlJ3Mgbm8gcXVpY2sgZml4Lg0KPj4NCj4+IFJlZ2FyZHMsDQo+Pg0KPj4gQWxl eA0KPj4NCj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPj4+IEZyb206IHN0aXIg W21haWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBQZXRlcnNvbiwg Sm9uDQo+Pj4gU2VudDogTW9uZGF5LCBBdWd1c3QgOCwgMjAxNiAxMjo0NiBQTQ0KPj4+IFRv OiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20+OyBQ YXVsIEt5eml2YXQNCj4+PiA8cGt5eml2YXRAYWx1bS5taXQuZWR1PjsgRHdpZ2h0LCBUaW1v dGh5IE0gKFRpbSkNCj4+PiA8dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5jb20+OyBET0xMWSwg TUFSVElOIEMgPG1kMzEzNUBhdHQuY29tPg0KPj4+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZv ZGFmb25lIFVLIDxwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+Ow0KPj4+IFJpY2hhcmQg U2hvY2tleSA8cmljaGFyZEBzaG9ja2V5LnVzPjsgc3RpckBpZXRmLm9yZzsgQnJpYW4gUm9z ZW4NCj4+PiA8YnJAYnJpYW5yb3Nlbi5uZXQ+DQo+Pj4gU3ViamVjdDogUmU6IFtzdGlyXSBT VElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pg0KPj4+DQo+Pj4gSnVzdCBzbyBJJ20gY2xl YXIsIEknbSBub3QgaGVhcmluZyBhbiBhc2sgaGVyZSBpbiB0ZXJtcyBvZiBjaGFuZ2luZw0K Pj4+IHRoZSB0ZXh0IG9mIHJmYzQ0NzRiaXMtMTAsIHdoaWNoIGRvZXMgYWxsb3cgc2lnbmlu ZyBQQUkgaW5zdGVhZCBvZg0KPj4+IEZyb20gZm9yIHByZWNpc2VseSB0aGUgcmVhc29ucyBv dXRsaW5lZCBpbiB0aGlzIGxlbmd0aHkgdGhyZWFkLiBUbw0KPj4+IEFsZXgncyBvcmlnaW5h bCBwb2ludCBhYm91dCBwcm92aWRpbmcgYXV0aG9yaXphdGlvbiB3aXRob3V0DQo+Pj4gYXV0 aGVudGljYXRpb24sIHJmYzQ0NzRiaXMgaGFzIGEgbG90IG9mIHRleHQgYWJvdXQgc2lnbmlu ZyBub24tVE4NCj4+PiBpZGVudGlmaWVycywgaW5jbHVkaW5nIGZvciBwcmVzZXJ2aW5nIGFu b255bWl0eTsgc2VlIHRoZSBlbmQgb2YNCj4+PiBzZWN0aW9uIDYuMSwgYW5kIHRoZW4gdGhl IFByaXZhY3kgQ29uc2lkZXJhdGlvbnMgaW4gc2VjdGlvbiAxMSBmb3INCj4+PiBtb3JlLiBU aG9zZSBzaG91bGQgc3VmZmljZSB0byBwcm92aWRlIHRoaXMgcHJvcGVydHk6IGl0IHdpbGwg aWRlbnRpZnkgdGhlIHNlcnZpY2UgcHJvdmlkZXIgd2hvIHNpZ25lZCB3aXRob3V0IGF0dGVz dGluZyBhbiBzcGVjaWZpYyB1c2VyIGlkZW50aXR5Lg0KPj4+DQo+Pj4gSSBhbHNvIHdhbnRl ZCB0byBtYWtlIHN1cmUgd2UgZGlkbid0IGRyb3AgdGhlIG90aGVyIGJhbGwgdGhhdCBBbGV4 DQo+Pj4gbWVudGlvbmVkIGF0IHRoZSBzdGFydCBvZiB0aGlzIHRocmVhZCwgd2hpY2ggaXMg dGhlIGlzc3VlIG9mDQo+Pj4gcHJveGltYXRlIHJlcGxheSB3aXRoaW4gdGhlIDYwIHNlY29u ZCBEYXRlIHdpbmRvdy4gVGhpcyBpcyBhZGRyZXNzZWQNCj4+PiBpbiBTZWN0aW9uIDEyLjEg b2YgcmZjNDQ3NGJpcy0xMCwgd2hpY2gNCj4+PiByZWFkczogIk5vdGUgdGhhdCBwZXIgYmFz ZWxpbmUgW1JGQzMyNjFdIGJlaGF2aW9yLCBzZXJ2ZXJzIGtlZXAgc3RhdGUNCj4+PiBvZiBy ZWNlbnRseSByZWNlaXZlZCByZXF1ZXN0cywgYW5kIHRodXMgaWYgYW4gSWRlbnRpdHkgaGVh ZGVyIGlzDQo+Pj4gcmVwbGF5ZWQgYnkgYW4gYXR0YWNrZXIgd2l0aGluIHRoZSBEYXRlIGlu dGVydmFsLCB2ZXJpZmllcnMgY2FuDQo+Pj4gZGV0ZWN0IHRoYXQgaXQgaXMgc3Bvb2ZlZCBi ZWNhdXNlIGEgbWVzc2FnZSB3aXRoIGFuIGlkZW50aWNhbCBEYXRlDQo+Pj4gZnJvbSB0aGUg c2FtZSBzb3VyY2UgaGFkIHJlY2VudGx5IGJlZW4gcmVjZWl2ZWQuIiBUaGlzIHJlZmVycyB0 byB0aGUNCj4+PiB0ZXh0IG9mDQo+Pj4gUkZDMzI2MSBzZWN0aW9uIDIzLjQuMiwgdGhvdWdo IG1vcmUgcHJvcGVybHkgdGhlIERhdGUtcmVsYXRlZA0KPj4+IGJlaGF2aW9yIGlzIGJldHRl ciBkZXRhaWxlZCBpbiBSRkMzODkzIFNlY3Rpb24gMTAsIHdoaWNoIGludHJvZHVjZWQNCj4+ PiB0aGUgZmlyc3QgdmVyc2lvbiBvZiB0aGUgcGFydGlhbCBzaWduYXR1cmUgbWVjaGFuaXNt IHRoYXQgdWx0aW1hdGVseQ0KPj4+IGluc3BpcmVkIFJGQzQ0NzQuIEknbGwgdXBkYXRlIHRo ZSB0ZXh0IGhlcmUgc28gaXQgaXMgY2xlYXJlciBhYm91dCBleGFjdGx5IGhvdyB0byBkZXRl Y3QgcHJveGltYXRlIHJlcGxheS4NCj4+Pg0KPj4+IEpvbiBQZXRlcnNvbg0KPj4+IE5ldXN0 YXIsIEluYy4NCj4+Pg0KPj4+IE9uIDgvOC8xNiwgMTE6MzggQU0sICJzdGlyIG9uIGJlaGFs ZiBvZiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIg0KPj4+IDxzdGlyLWJvdW5jZXNAaWV0Zi5v cmcgb24gYmVoYWxmIG9mIFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4gd3JvdGU6DQo+Pj4N Cj4+Pj4gUGF1bCwNCj4+Pj4NCj4+Pj4gQXMgeW91IGtub3csIFNJUCBpbnRlci13b3JraW5n IGlzIG9mdGVuIGNoYWxsZW5naW5nIGJlY2F1c2Ugb2YNCj4+Pj4gdmFyaWFiaWxpdHkgaW4g aW1wbGVtZW50YXRpb24gaW5jbHVkaW5nIHByb3ByaWV0YXJ5IGhlYWRlcnMgKHdpdGhvdXQN Cj4+Pj4gYW4NCj4+Pj4gWC0pIGFuZCBzdXBwb3J0IG9yIGxhY2sgdGhlcmVvZiBmb3Igbm9u LW1hbmRhdG9yeSAocGVyIFJGQyAzMjYxKQ0KPj4+PiBoZWFkZXJzIHN1Y2ggYXMgUC1Bc3Nl cnRlZC1JZGVudGl0eSwgKGFuZCB0aGluZ3MgbGlrZSBCMkJVQSBzdGFja3MNCj4+Pj4gc3Ry aXBwaW5nIHRoaW5ncyBsaWtlIGRpc3BsYXkgbmFtZSBpbiBGcm9tIGJ1dCB0aGF0J3MgYW5v dGhlciBzdG9yeSkuDQo+Pj4+IEkgY291bGQgYXJndWUgdGhhdCBmcm9tIGEgY2xlYW5saW5l c3Mgb2YgcHJvdG9jb2wgaW1wbGVtZW50YXRpb24sDQo+Pj4+IChhbmQgaWYgSSB3YW50ZWQg dG8gYmUgcGVkYW50aWMpLCBJIHdvdWxkIHN0cmlwIFBBSSBvdXRib3VuZCB1bmxlc3MNCj4+ Pj4gcmVxdWlyZWQgb3RoZXJ3aXNlLiAgQnV0IHRoZSBwb2ludCBpcyBtb290LiAgQXMgSSBt ZW50aW9uZWQgaW4gdGhlDQo+Pj4+IGVhcmxpZXIgZS1tYWlsLCB0aGF0IGlzIG5vdCBvdXIg cHJhY3RpY2UgYW5kIEknbSBub3QgcmVxdWVzdGluZyBpdCB0byBiZSBzby4NCj4+Pj4NCj4+ Pj4gUGllcmNlDQo+Pj4+DQo+Pj4+DQo+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQo+Pj4+IEZyb206IFBhdWwgS3l6aXZhdCBbbWFpbHRvOnBreXppdmF0QGFsdW0ubWl0LmVk dV0NCj4+Pj4gU2VudDogQXVndXN0IDA4LCAyMDE2IDEyOjAzIFBNDQo+Pj4+IFRvOiBHb3Jt YW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20+OyBEd2lnaHQs DQo+Pj4gVGltb3RoeQ0KPj4+PiBNDQo+Pj4+IChUaW0pIDx0aW1vdGh5LmR3aWdodEB2ZXJp em9uLmNvbT47IERPTExZLCBNQVJUSU4gQw0KPj4+IDxtZDMxMzVAYXR0LmNvbT4NCj4+Pj4g Q2M6IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsgPHBhdWwucm9zYm90aGFtQHZvZGFm b25lLmNvbT47DQo+Pj4gUmljaGFyZA0KPj4+PiBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXku dXM+OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3Nlbg0KPj4+PiA8YnJAYnJpYW5yb3Nlbi5u ZXQ+DQo+Pj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRz DQo+Pj4+DQo+Pj4+IE9uIDgvOC8xNiAxMjoxMSBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RP XSB3cm90ZToNCj4+Pj4+IFRoYW5rcyBmb3IgdGhlIGFkZGVkIGNvbW1lbnRzIFRpbS4NCj4+ Pj4+DQo+Pj4+PiBJIGFncmVlIHRoYXQgcGFzc2luZyBQLUFzc2VydGVkLUlkZW50aXR5IGJl dHdlZW4gdHJ1c3RlZCBuZXR3b3Jrcw0KPj4+Pj4gaXMgYXBwcm9wcmlhdGUgKGFuZCB0aGUg Y29udmVyc2UgaXMgdHJ1ZSBhcyB3ZWxsKS4gIFBhcnQgb2YgbXkNCj4+Pj4+IGlzc3VlIGlz IEkgaGF2ZSBiZWVuIGNvbmRpdGlvbmVkIGZyb20gdGhlIHZlcnkgZWFybGllc3QNCj4+Pj4+ IGltcGxlbWVudGF0aW9uIG9mIFNwcmludCdzIFZvSVAgbmV0d29yayB0aGF0IG90aGVyIGNh cnJpZXJzJyBJUA0KPj4+Pj4gbmV0d29ya3MgYXJlIGluaGVyZW50bHkgdW50cnVzdGVkLiAg SSd2ZSBiZWVuIGJyb3dzaW5nIFRTIDI5LjE2NQ0KPj4+Pj4gYW5kIGV2ZW4gdGhlcmUgSSBm aW5kIGxhbmd1YWdlIHRoYXQgaW1wbGllcyB0cnVzdCBpcyBlc3RhYmxpc2hlZCBieQ0KPj4+ Pj4gYWdyZWVtZW50LCBub3QgYnkgc3RhbmRhcmQuICAoRXZlbiByb2FtaW5nIGltcGxpZXMg YWdyZWVtZW50LikNCj4+Pj4NCj4+Pj4gSSB1bmRlcnN0YW5kIHdoeSAqc29tZSogc3R1ZmYg bmVlZHMgdG8gYmUgcmVtb3ZlZCB3aGVuIGZvcndhcmRpbmcgdG8NCj4+PiBhbg0KPj4+PiB1 bnRydXN0ZWQgcGFydHkuIEZvciBpbnN0YW5jZSwgaWYgdGhlIGNhbGwgaGFzIHJlcXVlc3Rl ZCBwcml2YWN5LA0KPj4+PiB0aGVuIFAtQS1JRCBuZWVkcyB0byBiZSByZW1vdmVkLg0KPj4+ Pg0KPj4+PiBCdXQgd2hlbiBwcml2YWN5IGlzIG5vdCBhIGNvbmNlcm4sIHRydXN0IGlzIHJl YWxseSBtb3JlIG9mIGEgY29uY2Vybg0KPj4+PiBvbiB0aGUgaW5ncmVzcyBzaWRlLCBub3Qg ZWdyZXNzLiBJZiBJIGRvbid0IHRydXN0IHlvdSB0aGVuIEkgd29uJ3QNCj4+Pj4gdHJ1c3Qg YSBQLUEtSUQgeW91IHNlbnQgdG8gbWUsIGFuZCBzbyAqSSogd2lsbCByZW1vdmUgaXQuIEJ1 dCBpZiBJDQo+Pj4+IHRydXN0IHlvdSwgYnV0IHlvdSBkb24ndCB0cnVzdCBtZSwgdGhlbiB3 aGF0IGlzIHRoZSBkb3duc2lkZSBmb3INCj4+Pj4gcGFzc2luZyBhbG9uZyB0aGUgUC1BLUlE Pw0KPj4+Pg0KPj4+PiAgICAgVGhhbmtzLA0KPj4+PiAgICAgUGF1bA0KPj4+Pg0KPj4+Pj4g UmVnYXJkbGVzcywgdGhpcyBkaXNjdXNzaW9uIGhhcyBiZWVuIGhlbHBmdWwgYW5kIGVkdWNh dGlvbmFsICh0byBtZQ0KPj4+Pj4gYXQgbGVhc3QpLiAgQW5kLCBJIGNvbmZpcm1lZCB3aXRo IG15IG9wZXJhdGlvbnMgY291bnRlcnBhcnQgd2UNCj4+Pj4+IGdlbmVyYWxseSBzZW5kIFBB SSB0b2RheS4gIEkndmUgYWxzbyBtYWRlIG5vdGUgdGhhdCB3aGVyZSBzdGFuZGFyZHMNCj4+ Pj4+IGFuZA0KPj4+IElDQQ0KPj4+Pj4gcmVxdWlyZSBpdCwgd2Ugd2lsbCBpbmNsdWRlIFBB SS4gICBUaGFua3MgYWdhaW4uDQo+Pj4+Pg0KPj4+Pj4gQmVzdCByZWdhcmRzLA0KPj4+Pj4N Cj4+Pj4+IFBpZXJjZQ0KPj4+Pj4NCj4+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQo+Pj4+PiBGcm9tOiBEd2lnaHQsIFRpbW90aHkgTSAoVGltKSBbbWFpbHRvOnRpbW90aHku ZHdpZ2h0QHZlcml6b24uY29tXQ0KPj4+Pj4gU2VudDogQXVndXN0IDA4LCAyMDE2IDEwOjQ3 IEFNDQo+Pj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tPjsgRE9MTFksDQo+Pj4gTUFSVElODQo+Pj4+PiBDIDxtZDMxMzVAYXR0LmNv bT4NCj4+Pj4+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLIDxwYXVsLnJvc2Jv dGhhbUB2b2RhZm9uZS5jb20+Ow0KPj4+Pj4gUmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNo b2NrZXkudXM+OyBQYXVsIEt5eml2YXQNCj4+Pj4+IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+ OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3Nlbg0KPj4+Pj4gPGJyQGJyaWFucm9zZW4ubmV0 Pg0KPj4+Pj4gU3ViamVjdDogUkU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMN Cj4+Pj4+DQo+Pj4+PiBQaWVyY2UsDQo+Pj4+Pg0KPj4+Pj4gTXkgYXNzdW1wdGlvbiBpcyB0 aGF0IE1hcnRpbiBtb3JwaGVkIDIgc3BlY3MsIDNHUFAgVFMgMjkuMTY1IGFuZA0KPj4+IEdT TUENCj4+Pj4+IElSLjk1LiAgVGhlIGxhdHRlciByZWZlcmVuY2VzIGFuZCBwcm9maWxlcyB0 aGUgZm9ybWVyLiAgU2VjdGlvbg0KPj4+Pj4gNC40LjEgb2YNCj4+Pj4+IElSLjk1IHJlY29t bWVuZHMgdGhhdCBNTk8tdG8tTU5PIG9yIE1OTy10by1JUFggaW50ZXJjb25uZWN0cyBiZQ0K Pj4+Pj4gY29uc2lkZXJlZCB0cnVzdGVkLCBhbmQgdGFibGUgMyBpbiB0aGF0IHNlY3Rpb24g cmVjb21tZW5kcyB0aGF0DQo+Pj4+PiBQLUFzc2VydGVkLUlkZW50aXR5IChQQUkpIGJlIGV4 Y2hhbmdlZCBhdCBhIHRydXN0ZWQgaW50ZXJjb25uZWN0Lg0KPj4+Pj4gSXQgYWxzbyBzdGF0 ZXMgdGhhdCBQQUkgaXMgbWFuZGF0b3J5IGF0IGEgcm9hbWluZyBOTkkuDQo+Pj4+Pg0KPj4+ Pj4gVGltDQo+Pj4+Pg0KPj4+Pj4NCj4+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQo+Pj4+PiBGcm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3JnXSBPbiBC ZWhhbGYgT2YgR29ybWFuLA0KPj4+Pj4gUGllcmNlIEEgW0NUT10NCj4+Pj4+IFNlbnQ6IE1v bmRheSwgQXVndXN0IDA4LCAyMDE2IDg6NTIgQU0NCj4+Pj4+IFRvOiBET0xMWSwgTUFSVElO IEMNCj4+Pj4+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLOyBSaWNoYXJkIFNo b2NrZXk7IFBhdWwgS3l6aXZhdDsNCj4+Pj4+IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2Vu DQo+Pj4+PiBTdWJqZWN0OiBbRV0gUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVu dHMNCj4+Pj4+DQo+Pj4+PiBNYXJ0aW4sDQo+Pj4+Pg0KPj4+Pj4gWW91IHJlZmVyZW5jZWQg VFMgMjkuMTk1LiAgSSdtIG5vdCBmYW1pbGlhciB3aXRoIHRoYXQgc3BlYy4gIEhhcyBpdA0K Pj4+Pj4gYmVlbiBkZXByZWNhdGVkPyAgSXQncyBub3Qgc2hvd2luZyB1cCBvbiB0aGUgM0dQ UCBzaXRlLg0KPj4+Pj4NCj4+Pj4+IEkgcmVmZXJlbmNlZCAzR1BQIFRTIDI0LjYwNy4gIElu IFNlY3Rpb24gNC4zLjIgIlJlcXVpcmVtZW50cyBvbiB0aGUNCj4+Pj4+IG9yaWdpbmF0aW5n IHNpZGUiIE5vdGUgNCBpdCBzdGF0ZXMsICIgSXQgaXMgYXNzdW1lZCB0aGF0IHRoZSBJQkNG DQo+Pj4+PiBpcyByZXNwb25zaWJsZSBmb3Igc3RyaXBwaW5nIHRoZSBQLUFzc2VydGVkLUlk ZW50aXR5IGZyb20gdGhlIFNJUA0KPj4+Pj4gaGVhZGVyIHdoZW4gaW50ZXJ3b3JraW5nIHdp dGggdW50cnVzdGVkIG5ldHdvcmtzLiINCj4+Pj4+DQo+Pj4+PiBZb3VyIHJlbWFyayBpcyBj b25zaXN0ZW50IHdpdGggTm90ZSA0LCBidXQgb25seSBpZiB3ZSBhZ3JlZSB0aGF0LA0KPj4+ Pj4gZm9yIGluc3RhbmNlLCB0aGUgQVQmVCBuZXR3b3JrIGFuZCB0aGUgU3ByaW50IG5ldHdv cmsgYXJlICJ0cnVzdGVkDQo+Pj4+PiBuZXR3b3JrcyIuICBJbiByZWFsaXR5LCB0aGlzIGlz IG5vdCB0aGUgY2FzZSBvciB0aGVyZSB3b3VsZCBiZSBubw0KPj4+Pj4gZmlyZXdhbGxzIG9y IFNlc3Npb24gQm9yZGVyIENvbnRyb2xsZXJzIHVzZWQgZm9yIGludGVyd29ya2luZyBhbmQN Cj4+Pj4+IHNlY3VyaXR5LiAgTXkgb3BpbmlvbiBpcyB0aGUgb25seSBjYXJyaWVyIG5ldHdv cmtzIHRoYXQgYXJlIHRydXN0ZWQNCj4+Pj4+IGFyZSB0aGUgU1M3IG5ldHdvcmssIGFuZCB0 aGUgSW50ZXJuZXQgYmFja2JvbmUuDQo+Pj4+Pg0KPj4+Pj4gV2hhdCBpdCByZWFsbHkgY29t ZXMgZG93biB0byBpcyB0aGF0IFBBSSBpcyBsZWZ0IGluIHNpZ25hbGluZw0KPj4+Pj4gZWl0 aGVyIHRocm91Z2ggZm9ybWFsIHNwZWNpZmljYXRpb24gYXMgYSBwYXJ0IG9mIGFuIGludGVy LWNhcnJpZXINCj4+Pj4+IGludGVyLWNvbm5lY3Rpb24gYWdyZWVtZW50LCBvciBieSBjdXN0 b20gKG9yIGV2ZW4gYnkgYWNjaWRlbnQpLiAgSQ0KPj4+Pj4gdGhpbmsgdGhpcyBpbGx1c3Ry YXRlcyBQYXVsIFJvc2JvdGhhbSdzIG9ic2VydmF0aW9uIGlzIHRydWUuDQo+Pj4+Pg0KPj4+ Pj4gUGllcmNlDQo+Pj4+Pg0KPj4+Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+ Pj4+IEZyb206IERPTExZLCBNQVJUSU4gQyBbbWFpbHRvOm1kMzEzNUBhdHQuY29tXQ0KPj4+ Pj4gU2VudDogQXVndXN0IDA1LCAyMDE2IDEyOjU1IFBNDQo+Pj4+PiBUbzogR29ybWFuLCBQ aWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPj4+Pj4gQ2M6IFJv c2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsgPHBhdWwucm9zYm90aGFtQHZvZGFmb25lLmNv bT47DQo+Pj4gQnJpYW4NCj4+Pj4+IFJvc2VuIDxickBicmlhbnJvc2VuLm5ldD47IHN0aXJA aWV0Zi5vcmc7IFBhdWwgS3l6aXZhdA0KPj4+Pj4gPHBreXppdmF0QGFsdW0ubWl0LmVkdT47 IFJpY2hhcmQgU2hvY2tleSA8cmljaGFyZEBzaG9ja2V5LnVzPg0KPj4+Pj4gU3ViamVjdDog UmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+DQo+Pj4+PiBQQUkg aXMgbm90IHN0cmlwcGVkIGF0IHRoZSBuZXR3b3JrIGJvdW5kYXJ5IGJldHdlZW4gdHJ1c3Rl ZA0KPj4+Pj4gbmV0d29ya3MgM0dQUCBUUyAyOS4xOTUgQXRpcyBzcGVjcyBHU01BIEF0aXMg c2lwIGZvcnVtIHRhc2sgZm9yY2UNCj4+Pj4+IElUVSBBbmQgdGhlIGxpc3QgZ29lcyBvbg0K Pj4+Pj4NCj4+Pj4+IE1hcnRpbiBDIERvbGx5DQo+Pj4+PiBMZWFkIE1lbWJlciBvZiBUZWNo bmljYWwgU3RhZmYNCj4+Pj4+IENvcmUgJiBHb3Zlcm5tZW50L1JlZ3VsYXRvcnkgU3RhbmRh cmRzIEFUJlQNCj4+Pj4+IENlbGw6IDYwOS05MDMtMzM2MA0KPj4+Pj4gRW1haWw6IG1kMzEz NUBhdHQuY29tDQo+Pj4+Pg0KPj4+Pj4+IE9uIEF1ZyA1LCAyMDE2LCBhdCAxOjA0IFBNLCBH b3JtYW4sIFBpZXJjZSBBIFtDVE9dDQo+Pj4+Pj4gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNv bT4gd3JvdGU6DQo+Pj4+Pj4NCj4+Pj4+PiBXaGljaCBoZWFkZXIgdGhlIGNhcnJpZXIgY2hv b3NlcyB0byBkaXNwbGF5IGlzIG1vb3QgaWYgdGhlIGhlYWRlcg0KPj4+Pj4+IGlzIHN0cmlw cGVkIGJldHdlZW4gY2FycmllcnMgYXMgcGVyIGF0IGxlYXN0IG9uZSBzdGFuZGFyZC4gIEkN Cj4+Pj4+PiB0aGluayBQYXVsIFJvc2JvdGhhbSdzIG9ic2VydmF0aW9uIHdlJ3JlIGxpa2Vs eSB0byBlbmNvdW50ZXIgInNvbWUNCj4+Pj4+PiBpbnRlcmVzdGluZyBpbnRlcndvcmtpbmcg Y2hhbGxlbmdlcyIgd2FzIHBlcmhhcHMgdGhlIHVuZGVyc3RhdGVtZW50IG9mIHRoZSB5ZWFy Lg0KPj4+Pj4+DQo+Pj4+Pj4gUGllcmNlDQo+Pj4+Pj4NCj4+Pj4+PiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPj4+Pj4+IEZyb206IFBhdWwgS3l6aXZhdCBbbWFpbHRvOnBreXpp dmF0QGFsdW0ubWl0LmVkdV0NCj4+Pj4+PiBTZW50OiBBdWd1c3QgMDUsIDIwMTYgMTE6NTgg QU0NCj4+Pj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tPjsgUmljaGFyZA0KPj4+Pj4+IFNob2NrZXkgPHJpY2hhcmRAc2hvY2tleS51 cz47IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsNCj4+Pj4+PiA8cGF1bC5yb3Nib3Ro YW1Adm9kYWZvbmUuY29tPjsgQnJpYW4gUm9zZW4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4+ Pj4+IENjOiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4gU3ViamVjdDogUmU6IFtzdGlyXSBTVElS IDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pg0KPj4+Pj4+IElmIFBBSSBpcyBwcmVzZW50 IGFuZCBzaWduZWQsIGFuZCBGcm9tIGlzIGFsc28gc2lnbmVkLCBJIHdvdWxkDQo+Pj4+Pj4g ZXhwZWN0IGl0IHRvIGJlIHVwIHRvIHRoZSBVQSB0byBkZWNpZGUgd2hhdCB0byBkaXNwbGF5 LCBub3QgdGhlIGNhcnJpZXIuDQo+Pj4+Pj4NCj4+Pj4+PiBPZiBjb3Vyc2UgdGhpcyB3aWxs IHdvcmsgZGlmZmVyZW50bHkgaWYgdGhlcmUgaXMgYSBkaWZmZXJlbnQNCj4+Pj4+PiBzaWdu YWxpbmcgcmVnaW1lIGJldHdlZW4gdGhlIGNhcnJpZXIgYW5kIHRoZSB1c2VyIGRldmljZSAo ZS5nLg0KPj4+Pj4+IGJsYWNrDQo+Pj4gcGhvbmUpLg0KPj4+Pj4+DQo+Pj4+Pj4gICAgVGhh bmtzLA0KPj4+Pj4+ICAgIFBhdWwNCj4+Pj4+Pg0KPj4+Pj4+PiBPbiA4LzUvMTYgMTE6MjYg QU0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gd3JvdGU6DQo+Pj4+Pj4+IFAtQXNzZXJ0ZWQt SWRlbnRpdHkgaXMgc3VwcG9zZWQgdG8gb3BlcmF0ZSAiYW1vbmcgdHJ1c3RlZCBTSVANCj4+ Pj4+Pj4gZW50aXRpZXMiIGFuZCB0aGVyZWZvcmUgc29tZSBzcGVjaWZpY2F0aW9ucyAoZS5n LiwgM0dQUCBUUw0KPj4+Pj4+PiAyNC42MDcpIGFzc3VtZSBQLUFzc2VydGVkLUlkZW50aXR5 IGlzIHN0cmlwcGVkIGJ5IGJvcmRlcg0KPj4+Pj4+PiBjb250cm9sbGVyIGZ1bmN0aW9ucyBh bmQgaXMgbm90IHRvIGJlIHVzZWQgaW4gaW50ZXItY2Fycmllcg0KPj4+Pj4+PiBpbnRlci1j b25uZWN0aW9uIChhbHRob3VnaCBpdCBjb21tb25seSBzaG93cyB1cCBhbnl3YXkpLiAgTXkg b3BpbmlvbiBpcyB0aGUgIkZyb20iDQo+Pj4+Pj4+IGhlYWRlciBpcyBsaWtlbHkgdXNlZCBt b3JlIG9mdGVuIGZvciBwcmVzZW50YXRpb24uDQo+Pj4+Pj4+DQo+Pj4+Pj4+IFBpZXJjZQ0K Pj4+Pj4+Pg0KPj4+Pj4+Pg0KPj4+Pj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0K Pj4+Pj4+PiBGcm9tOiBSaWNoYXJkIFNob2NrZXkgW21haWx0bzpyaWNoYXJkQHNob2NrZXku dXNdDQo+Pj4+Pj4+IFNlbnQ6IEF1Z3VzdCAwNSwgMjAxNiA5OjM3IEFNDQo+Pj4+Pj4+IFRv OiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLDQo+Pj4gPHBhdWwucm9zYm90aGFtQHZv ZGFmb25lLmNvbT47DQo+Pj4+Pj4+IFBhdWwgS3l6aXZhdCA8cGt5eml2YXRAYWx1bS5taXQu ZWR1PjsgQnJpYW4gUm9zZW4NCj4+Pj4+Pj4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4+Pj4+ PiBDYzogc3RpckBpZXRmLm9yZw0KPj4+Pj4+PiBTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIg NDQ3NGJpcy0xMCBjb21tZW50cw0KPj4+Pj4+Pg0KPj4+Pj4+Pg0KPj4+Pj4+PiBIdW1tIHRo aXMgaXMgZ2V0dGluZyBpbnRlcmVzdGluZy4gIEl0cyBteSB1bmRlcnN0YW5kaW5nIHRoYXQg dGhlDQo+Pj4+Pj4+IGRpc3BsYXkgbnVtYmVyIGFrYSAicHJlc2VudGF0aW9uIG51bWJlciIg aW4gdGhlIFVTIGNvbnRleHQgaXMgdGhlDQo+Pj4+Pj4+IG9uZSBjYXJyaWVkIGluIHRoZSBQ QUkuICBNYXJ0aW4sIFBpZXJjZT8NCj4+Pj4+Pj4NCj4+Pj4+Pj4NCj4+Pj4+Pj4NCj4+Pj4+ Pj4NCj4+Pj4+Pj4gT24gOC81LzE2LCAzOjQ2IEFNLCAic3RpciBvbiBiZWhhbGYgb2YgUm9z Ym90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSyINCj4+Pj4+Pj4gPHN0aXItYm91bmNlc0BpZXRm Lm9yZyBvbiBiZWhhbGYgb2YgcGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPg0KPj4+IHdy b3RlOg0KPj4+Pj4+Pg0KPj4+Pj4+PiAgICBKdW1waW5nIGluIG5vdyB0aGF0IHdlJ3JlIG9u IEV1cm9wZWFuIHdvcmtpbmcgdGltZSwgKzEgb24NCj4+Pj4+Pj4gUGF1bCdzIG9ic2VydmF0 aW9uLg0KPj4+Pj4+Pg0KPj4+Pj4+PiAgICBIZXJlIGluIHRoZSBVSywgd2UndmUgZ290IDIg bnVtYmVycyBjYXJyaWVkIGFzIGNhbGxpbmcgbGluZQ0KPj4+Pj4+PiBJRHMuLi4ub25lICh3 ZSB0ZXJtIHRoZSBOZXR3b3JrIE51bWJlciwgY2FycmllZCBpbiBQQUlEKSB1bmlxdWVseQ0K Pj4+Pj4+PiBpZGVudGlmaWVzIHRoZSBsaW5lLCB0aGUgb3RoZXIgKHdlIHRlcm0gUHJlc2Vu dGF0aW9uIE51bWJlciwNCj4+Pj4+Pj4gY2FycmllZCBpbiBGcm9tKSBpcyB1c2VkIGZvciBk aXNwbGF5IHB1cnBvc2VzLg0KPj4+Pj4+Pg0KPj4+Pj4+PiAgICBPbmx5IHRoZSBjYXJyaWVy IGhhcyB0aGUgYXV0aG9yaXR5IHRvIHNldCB0aGUgTmV0d29yayBOdW1iZXINCj4+Pj4+Pj4g c28gb25seSB0aGV5IGNvdWxkIHNpZ24gaXQuDQo+Pj4+Pj4+DQo+Pj4+Pj4+ICAgIEJ1dCAt IHN1YmplY3QgdG8gcmVndWxhdG9yeSByZXN0cmljdGlvbnMgd2hpY2ggYXJlIHdlbGwNCj4+ Pj4+Pj4gZG9jdW1lbnRlZA0KPj4+Pj4+PiAtIHRoZSBudW1iZXIgc2VudCBmb3IgZGlzcGxh eSBwdXJwb3NlcyBiZWxvbmdzIHRvIHRoZSBjdXN0b21lci4NCj4+Pj4+Pj4gRm9yIGJsdWUt Y2hpcCBjdXN0b21lcnMsIEkgY2FuIGFsbG93IHRoZW0gdG8gc2VuZCB0aGVpcg0KPj4+Pj4+ PiBQcmVzZW50YXRpb24gTnVtYmVycyBpbnRvIHRoZSBuZXR3b3JrLCBhbmQgY2FuJ3QgcmVh ZGlseSBjaGVjayBhdA0KPj4+Pj4+PiBhIG5ldHdvcmsgbGV2ZWwgdGhhdCB0aGV5J3JlIHRo ZWlycyAoSSBkbyBoYXZlIGNvbnRyYWN0dWFsDQo+Pj4+Pj4+IHNhZmVndWFyZHMpLiAgVGhl IG51bWJlciBtYXkgaGF2ZSBiZWVuIGFsbG9jYXRlZCBieSBtZSwgb3IgY291bGQNCj4+Pj4+ Pj4gYmUgYWxsb2NhdGVkIGJ5IGEgdGhpcmQgcGFydHkgcHJvdmlkZXIuICBJZiBpdCdzIGEg Y2FsbC1jZW50cmUNCj4+Pj4+Pj4gdGhleSdsbCBiZSBtYWtpbmcgb3V0Ym91bmQgY2FsbHMg Zm9yIGxvdHMgb2YgZGlmZmVyZW50IGN1c3RvbWVycw0KPj4+Pj4+PiB3aGljaCB3aWxsIGNo YW5nZSBvbiBkYXktYnktZGF5DQo+Pj4gYmFzaXMuDQo+Pj4+Pj4+IFRoaXMgaXMgYnVzaW5l c3MgYXMgdXN1YWwuICBJIGRvbid0IGxpa2UgdGhlIHRlcm0gImF1dGhvcmlzZWQNCj4+Pj4+ Pj4gc3Bvb2ZpbmciIGJlY2F1c2UgaXQgaW1wbGllcyB0aGF0IHRoZSBDTEkgaXMgaW4gc29t ZSB3YXkgYmVpbmcgcmlnZ2VkOg0KPj4+Pj4+PiBpdCdzIG5vdCwgaXQncyB0aGUgY29ycG9y YXRlIGN1c3RvbWVyIG9yIHRoZWlyIHN1YmNvbnRyYWN0b3INCj4+Pj4+Pj4gdXNpbmcgdGhl IG51bWJlciB0aGF0J3MgYmVlbiBhc3NpZ25lZCAoc28gaW4gaW50ZXJuZXQgdGVybXMNCj4+ Pj4+Pj4gZGVsZWdhdGVkKSB0byB0aGVtIHZpYSBhIGNoYWluIG9mIHRydXN0IGZyb20gdGhl IHJlZ3VsYXRvci4NCj4+Pj4+Pj4NCj4+Pj4+Pj4gICAgV2hhdCBJIHdhbnQgaXMgdGhlIGFi aWxpdHkgZm9yIGN1c3RvbWVycyB0byB1c2UgdGhlaXINCj4+Pj4+Pj4gY3JlZGVudGlhbHMg IHRvIHNpZ24gdGhlIENMSXMgdGhleSBzZW5kIG1lIHNvIHRoYXQgYXQgdGhlDQo+Pj4+Pj4+ IHRlcm1pbmF0aW5nIGVuZCBpdCBjYW4gIGJlIGNoZWNrZWQgKG9yIGluZGVlZCBzb21ld2hl cmUgZW4tcm91dGUNCj4+Pj4+Pj4gaWYgdGhhdCdzIHRoZSBidXNpbmVzcyBtb2RlbCkuDQo+ Pj4+Pj4+IEkgY2FuIGFuZCB3b3VsZCBzaWduIGZvciBjdXN0b21lcnMgb24gbXkgbW9iaWxl IGJ1c2luZXNzIHNpbmNlDQo+Pj4+Pj4+IEknbSBkcml2aW5nIHdoYXQgbnVtYmVyIGlzIHBy ZXNlbnRlZCwgYnV0IHRoYXQncyBieS10aGUtYnkNCj4+Pj4+Pj4gYmVjYXVzZSB0aGV5IGFy ZW4ndCB0aGUgb25lcyB3aG8gZ2VuZXJhdGUgbWlsbGlvbnMgb2YgbnVpc2FuY2UNCj4+Pj4+ Pj4gY2FsbHMuICBJZiB0aGUgc2lnbmluZyBvbmx5IG9jY3VycyBhdCB0aGUgb3JpZ2luYXRp bmcgY2Fycmllcg0KPj4+Pj4+PiBsZXZlbCBmb3IgY29ycG9yYXRlL2NhbGwtY2VudHJlIGN1 c3RvbWVycyB0aGF0J3Mgbm8gdXNlIGJlY2F1c2UNCj4+Pj4+Pj4gSSdtIG5vdCBpbiBhIHBv c2l0aW9uIHRvIGRvIHRoYXQgZm9yIHRoZXNlIHR5cGUgb2YNCj4+Pj4+Pj4gY3VzdG9tZXJz Li4uYW5kIHRoZSB3aG9sZSBzeXN0ZW0gYmVjb21lcyBhIHdhc3RlIG9mIHRpbWUuIEknZA0K Pj4+Pj4+PiBhbHNvIGhpZ2hsaWdodCB0aGVyZSBhcmUgbWFueSBtb3JlIG9mIG15IGxhcmdl IGN1c3RvbWVycyB0aGF0IEknZA0KPj4+Pj4+PiB0cnVzdCBtb3JlIHRoYW4gYSBmYXIgZW5k IG9yaWdpbmF0aW5nIGNhcnJpZXIgdGhhdCBjb3VsZCBiZQ0KPj4+Pj4+PiBhbnl3aGVyZSBp biB0aGUgd29ybGQgKHRob3VnaCB3ZSBoYXZlIG5vIHNob3J0YWdlIG9mIHNtYWxsDQo+Pj4+ Pj4+IGNhcnJpZXJzIHRoYXQgSSB3b3VsZG4ndCBrbm93IGZyb20gQWRhbSBtb3JlIGxvY2Fs bHkgaW4gdGhlDQo+Pj4+Pj4+IFVLLi4uLikNCj4+Pj4+Pj4NCj4+Pj4+Pj4gICAgUmVnYXJk cw0KPj4+Pj4+Pg0KPj4+Pj4+PiAgICBQYXVsDQo+Pj4+Pj4+DQo+Pj4+Pj4+ICAgIC0tLS0t T3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+Pj4+Pj4+ICAgIEZyb206IHN0aXIgW21haWx0bzpz dGlyLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBQYXVsIEt5eml2YXQNCj4+Pj4+ Pj4gICAgU2VudDogMDQgQXVndXN0IDIwMTYgMjM6MTINCj4+Pj4+Pj4gICAgVG86IEJyaWFu IFJvc2VuDQo+Pj4+Pj4+ICAgIENjOiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+ICAgIFN1Ympl Y3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+DQo+Pj4+ Pj4+PiAgICBPbiA4LzQvMTYgNjowMiBQTSwgQnJpYW4gUm9zZW4gd3JvdGU6DQo+Pj4+Pj4+ PiBJIHRoaW5rIGl0J3Mgbm90IGEgZGVsZWdhdGlvbi4gIFRoZSBtb2JpbGUgcGhvbmUgaXMg bm90IGJlaW5nDQo+Pj4+Pj4+PiBkZWxlZ2F0ZWQgdGhlIFROLCBpdCdzIGJlaW5nIGF1dGhv cml6ZWQgdG8gcGxhY2UgY2FsbHMgdGhhdCBhcmUNCj4+Pj4+Pj4+IG5vdA0KPj4+Pj4+PiA+ ZnJvbSB0aGF0IFROLCBidXQgYXBwZWFyIHRvIGJlLg0KPj4+Pj4+Pj4NCj4+Pj4+Pj4+IFRo ZSBtZWNoYW5pc20gdG8gaGFuZGxlIHRoZSBjcmVkZW50aWFsIGlzIGV4YWN0bHkgdGhlIHNh bWUgYXMgYQ0KPj4+Pj4+Pj4gZGVsZWdhdGlvbiwgc28gaWYgeW91IHdhbnQgdG8gY2FsbCBp dCBkZWxlZ2F0aW9uLCBnbyBhaGVhZCwgYnV0DQo+Pj4+Pj4+PiBJIHByZWZlciB0byBjYWxs IGl0IGF1dGhvcml6ZWQgc3Bvb2ZpbmcuDQo+Pj4+Pj4+DQo+Pj4+Pj4+ICAgIElJVUMgdGhl IGRlbGVnYXRpb24gaXMgdG8gYSByZXNwb25zaWJsZSBlbnRpdHkgKHNvbWV0aGluZyB0aGF0 DQo+Pj4+Pj4+IGNhbiBiZSBoZWxkIGxlZ2FsbHkgYWNjb3VudGFibGUgLSBlLmcuIGEgcGVy c29uKSwgbm90IHRvIGEgZGV2aWNlLg0KPj4+Pj4+PiBUaGUgZW50aXR5IGNhbiB0aGVuICJ1 c2UiIHRoZSBjcmVkZW50aWFsIHZpYSBhbnkgZGV2aWNlKHMpIGl0DQo+Pj4+Pj4+IGNob29z ZXMuIEluIHRoZSBjYXNlIG9mIHRoZSBtb2JpbGUsIHRoZSBkZXZpY2UgdGhlbiBiZWNvbWVz IGENCj4+Pj4+Pj4gdHdvLWxpbmUNCj4+PiBwaG9uZS4NCj4+Pj4+Pj4NCj4+Pj4+Pj4gICAg VGhhbmtzLA0KPj4+Pj4+PiAgICBQYXVsDQo+Pj4+Pj4+DQo+Pj4+Pj4+PiBCcmlhbg0KPj4+ Pj4+Pj4NCj4+Pj4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNTo1MSBQTSwgUGF1bCBLeXpp dmF0DQo+Pj4+Pj4+Pj4gPHBreXppdmF0QGFsdW0ubWl0LmVkdT4NCj4+Pj4+Pj4+PiB3cm90 ZToNCj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+IE9uIDgvNC8xNiA1OjQzIFBNLCBCcmlhbiBSb3Nl biB3cm90ZToNCj4+Pj4+Pj4+Pj4gSW4gbXkgamFyZ29uIGFuICJhdXRob3JpemVkIHNwb29m ZXIiIGlzIHRoZSBkb2N0b3Igd2hvIGlzDQo+Pj4+Pj4+Pj4+IGNhbGxpbmcgIGZyb20gaGlz IG1vYmlsZSwgYnV0IHNlbmRpbmcgdGhlIFROIG9mIGhpcyBvZmZpY2UNCj4+Pj4+Pj4+Pj4g cGhvbmUgYXMgY2FsbGluZyBwYXJ0eS4NCj4+Pj4+Pj4+Pj4gVGhlIGRlbGVnYXRpb24gdG8g aGlzIG9mZmljZSBwaG9uZSB3YXMgbWFkZSBieSBoaXMgbGFuZGxpbmUNCj4+Pj4+Pj4+Pj4g Y2FycmllciB0byBoaW0uICBIZSB0aGVuIGNyZWF0ZXMgYW5vdGhlciBjcmVkZW50aWFsLCB3 aGljaCBoZQ0KPj4+Pj4+Pj4+PiBzaWducyB3aXRoIGhpcyBvZmZpY2UgcGhvbmUgY3JlZGVu dGlhbCB0aGF0IGF1dGhvcml6ZXMgaGlzDQo+Pj4+Pj4+Pj4+IG1vYmlsZSB0byBzZW5kIGNh bGxzIGZyb20gaGlzIG9mZmljZSBudW1iZXIuICBIZSBpcyBzcG9vZmluZw0KPj4+Pj4+Pj4+ PiAoYmVjYXVzZSB0aGUgY2FsbCBpcyBjb21pbmcgZnJvbSBoaXMgbW9iaWxlJ3MgVE4gYnV0 IGNsYWltcyB0bw0KPj4+Pj4+Pj4+PiBiZSBmcm9tIGhpcyBvZmZpY2UpLCBidXQgaXQncyBh dXRob3JpemVkIHNwb29maW5nLiAgVGhlIGRvYw0KPj4+Pj4+Pj4+PiBjb3VsZCBnaXZlIHRo ZSBjcmVkZW50aWFsIHRvIGhpcyBtb2JpbGUgU1AgaWYgdGhleSBzaWduIG9uIGhpcyBiZWhh bGYuDQo+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+PiBJIGRvbid0IHVuZGVyc3RhbmQgaG93IHRoYXQg aXMgZGlmZmVyZW50IGZyb20gcmVndWxhciBkZWxlZ2F0aW9uLg0KPj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4gV2hlbiBoaXMgbGFuZGxpbmUgY2FycmllciBnYXZlIGhpbSBhIGRlbGVnYXRlZCBj ZXJ0aWZpY2F0ZSBmb3INCj4+Pj4+Pj4+PiBoaXMgbGFuZGxpbmUgbnVtYmVyLCBoZSBzaG91 bGQgYmUgYWJsZSB0byBpbnN0YWxsIHRoYXQgaW4NCj4+Pj4+Pj4+PiB3aGF0ZXZlciBkZXZp Y2VzIGhlIHdhbnRzIC0gaGlzIGxhbmRsaW5lIFVBLCBoaXMgbW9iaWxlIHBob25lLA0KPj4+ Pj4+Pj4+IGV0Yy4gSXQgaXMgc3RpbGwgZGVsZWdhdGVkIGZyb20gaGlzIGxhbmRsaW5lIGNh cnJpZXIsIGV2ZW4gd2hlbg0KPj4+Pj4+Pj4+IHVzZWQgd2l0aCBjYWxscyB2aWEgaGlzIG1v YmlsZSBjYXJyaWVyLg0KPj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4gVGhhbmtzLA0KPj4+Pj4+Pj4+ IFBhdWwNCj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+PiBTb21lIGZvbGtzIGRvbid0IGxpa2UgYXR0 YWNoaW5nIHRoZSAic3Bvb2ZpbmciIGxhYmVsIHRvIGENCj4+Pj4+Pj4+Pj4gbGVnaXRpbWF0 ZSB1c2UuDQo+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+IEJ1dCB0aGF0J3MgaG93IEkgZGVzY3Jp YmUgaXQuDQo+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+IEJyaWFuDQo+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNTozNyBQTSwgUGF1bCBLeXppdmF0DQo+Pj4+ Pj4+Pj4+PiA8cGt5eml2YXRAYWx1bS5taXQuZWR1IDxtYWlsdG86cGt5eml2YXRAYWx1bS5t aXQuZWR1Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4gKzEsIGJ1dCB3aXRo IG9uZSBxdWVzdGlvbiBiZWxvdzoNCj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gT24gOC80 LzE2IDU6MTQgUE0sIEJyaWFuIFJvc2VuIHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+IEkgdGhpbmsg YWxsIHdlIG5lZWQgaXMgdG8gaGF2ZSBjcmVkZW50aWFscyBmb2xsb3cgdGhlDQo+Pj4+Pj4+ Pj4+Pj4gZGVsZWdhdGlvbiBwYXRoLA0KPj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiBwbHVz IHRoZSBvcHRpb24gdG8gYWRkIGFub3RoZXIgbGV2ZWwgKG5vdCBkZWxlZ2F0aW9uKSBmb3IN Cj4+Pj4+Pj4+Pj4+PiBhdXRob3JpemVkIHNwb29mZXJzLg0KPj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+IEkgZG9uJ3QgdW5kZXJzdGFuZCAiYXV0aG9yaXplZCBzcG9vZmVycyIgaW4gdGhp cyBjb250ZXh0LCBhcw0KPj4+Pj4+Pj4+Pj4gY29udHJhc3RlZCB0byAic3Bvb2ZlcnMiIHdo byBoYXZlIGJlZW4gZGVsZWdhdGVkIHRoZWlyDQo+Pj4gYXV0aG9yaXR5Lg0KPj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+IFRoYW5rcywNCj4+Pj4+Pj4+Pj4+IFBhdWwNCj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4gSSBkb24ndCB0aGluayBpdCBtYXR0ZXJzIHdobyB0aGUgZGVsZWdh dG9yIG9yIGRlbGVnYXRlZSBhcmUNCj4+Pj4+Pj4+Pj4+PiBhcyBsb25nIGFzIHRoZSBkZWxl Z2F0b3IgaXMgd2lsbGluZyB0byB0YWtlIHRoZSBoZWF0IGZvcg0KPj4+Pj4+Pj4+Pj4+IGRl bGVnYXRpbmcgdG8gc29tZW9uZSB3aG8gc2VuZHMgYSBsb3Qgb2YgYmFkIGNhbGxzLiAgVGhl eQ0KPj4+Pj4+Pj4+Pj4+IGNhbiBwYXNzIHRoZSBidWNrICgiSSBkZWxlZ2F0ZWQgdGhlIFRO IHRvIGhpbSwgYW5kIG5vdyBJJ20NCj4+Pj4+Pj4+Pj4+PiBub3QgcmVzcG9uc2libGUiKSwg YnV0IG9ubHkgaWYgdGhlIFNQIGtub3dzIHdobyB0aGV5DQo+Pj4+Pj4+Pj4+Pj4gZGVsZWdh dGVkIHRvLCBzbyBhdXRob3JpdGllcyBjYW4gZm9sbG93IHRoZSBkZWxlZ2F0aW9uIHBhdGgu DQo+Pj4+Pj4+Pj4+Pj4gVGhlcmUgYXJlIHBsZW50eSBvZiBjZXJ0aWZpY2F0ZWQgY2Fycmll cnMgd2hvIGFyZSB3aWxsaW5nIHRvDQo+Pj4+Pj4+Pj4+Pj4gbm90IGNhcmUgd2hvIHRoZXkg ZGVsZWdhdGUgdG8uICBUaGUgZmFjdCB0aGF0IHRoZXJlIGFyZSBzb21lDQo+Pj4+Pj4+Pj4+ Pj4gd2hvIGRvIGRvZXNuJ3QgY2hhbmdlIG11Y2guDQo+Pj4+Pj4+Pj4+Pj4gTWFraW5nIHN0 aXIgd29yayBtZWFucyBrbm93aW5nIHdobyB5b3UgYXJlIGRlbGVnYXRpbmcgdG8sIHNvDQo+ Pj4+Pj4+Pj4+Pj4gdGhhdCB5b3UgY2FuIHBhc3MgdGhlIGhvdCBwb3RhdG8uDQo+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiBJdCdzIHBlcmZlY3RseSByZWFzb25hYmxlIGZvciBhIGNh cnJpZXIgdG8gYmUgYWJsZSB0byBzaWduDQo+Pj4+Pj4+Pj4+Pj4gZm9yIGFueSBjYWxscyBw bGFjZWQgb24gaXRzIG5ldHdvcmsgb24gYW55IG51bWJlciBpdCBoYXMNCj4+Pj4+Pj4+Pj4+ PiBiZWVuIGRlbGVnYXRlZC4NCj4+Pj4+Pj4+Pj4+PiBJZiBpdCBkb2VzLCBpdCdzIGFzc2Vy dGluZyB0aGF0IHRoZSBjYWxscyBhcmUgZnJvbSB3aG8gdGhleQ0KPj4+Pj4+Pj4+Pj4+IGFy ZSBzdXBwb3NlZCB0byBiZSBmcm9tLg0KPj4+Pj4+Pj4+Pj4+IFRoYXQgc2hvdWxkIGJlIHN0 cmFpZ2h0Zm9yd2FyZCwgYnV0IHdlIGtub3cgaXQncyBub3QgYWx3YXlzLA0KPj4+Pj4+Pj4+ Pj4+IGFuZCB0aGF0IHJlcHJlc2VudHMgdGhlIGhhcmQgcGFydCBvZiBkZXBsb3ltZW50IGlu IG15IG9waW5pb24uDQo+Pj4+Pj4+Pj4+Pj4gQnV0IG9uY2UgdGhleSBkZWxlZ2F0ZSwgdGhl eSBjYW4gaGFuZCByZXNwb25zaWJpbGl0eSB0byBzaWduDQo+Pj4+Pj4+Pj4+Pj4gdG8gIHRo ZSBkZWxlZ2F0ZWUuICBCdXQsIHRoYXQgb25seSB3b3JrcyBpZiB0aGV5IGtub3cgd2hvDQo+ Pj4+Pj4+Pj4+Pj4gdGhleSBhcmUgZGVsZWdhdGluZyB0by4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+ Pj4+Pj4+Pj4+IFRoZSByb290IG9mIHRoZSB3aG9sZSBtb2RlbCBpcyB0aGF0IHRoZXJlIGlz IGEgZm9ybWFsIG9yDQo+Pj4+Pj4+Pj4+Pj4gaW5mb3JtYWwgZGVsZWdhdGlvbiBwYXRoIGZv ciB0ZWxlcGhvbmUgbnVtYmVycyBpbiBldmVyeQ0KPj4+Pj4+Pj4+Pj4+IGNvdW50cnksIGFu ZCB3ZSBjYW4gYnVpbGQgYSBjaGFpbiBvZiB0cnVzdCBmcm9tIHRoYXQNCj4+Pj4+Pj4+Pj4+ PiBkZWxlZ2F0aW9uIHBhdGguICBJZiB5b3UgcHJvcG9zZSB0byBhbHRlciB0aGF0IG1vZGVs LCB0aGVuDQo+Pj4+Pj4+Pj4+Pj4gd2UgZ2V0IGludG8NCj4+Pj4+Pj4+Pj4+PiAocG9saWN5 KSBpc3N1ZXMgb2Ygd2hpY2ggY2FycmllcnMvZW50aXRpZXMgd2UgdHJ1c3QgYW5kDQo+Pj4+ Pj4+Pj4+Pj4gd2hpY2ggd2UgZG9uJ3QuDQo+Pj4+Pj4+Pj4+Pj4gT3VyIG1vZGVsIGlzIHRo YXQgeW91IGtub3cgd2hvIHlvdSBkZWxlZ2F0ZSB0bywgYW5kIG9uY2UgeW91DQo+Pj4+Pj4+ Pj4+Pj4gZG8gdGhhdCBkZWxlZ2F0aW9uLCBpdCdzIHRoZWlyIHByb2JsZW0uDQo+Pj4+Pj4+ Pj4+Pj4gVGhhdCdzIHByZXR0eSBhcHBlYWxpbmcgSSB0aGluaywgZXZlbiBpZiBpdCdzIGEg Y2hhbmdlIGluDQo+Pj4+Pj4+Pj4+Pj4gc29tZSBidXNpbmVzcyBwcmFjdGljZXMuDQo+Pj4+ Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiBUaGUgbWVjaGFuaXNtIGlzIGNoYWluaW5nIGNyZWRl bnRpYWxzIGluIGEgZm9ybSBvZiBhIFBLSSBhbmQNCj4+Pj4+Pj4+Pj4+PiBoYXZpbmcgYSB3 YXkgdG8ga25vdyB3aGljaCBUTnMgYXJlIGNvdmVyZWQgYnkgYSBjcmVkZW50aWFsLg0KPj4+ Pj4+Pj4+Pj4+IFRoYXQncyB3aGF0IHdlIGhhdmUsIGFuZCBJJ20gbG9hdGggdG8gY2hhbmdl IGl0Lg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gQnJpYW4NCj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IE9uIEF1ZyA0LCAyMDE2LCBhdCA0OjUzIFBN LCBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dDQo+Pj4+Pj4+Pj4+Pj4+IDxQaWVyY2UuR29ybWFu QHNwcmludC5jb20NCj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+ Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPj4+Pj4+ Pj4+Pj4+PiB3cm90ZToNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gT0ssIHlvdSB0 YWxrZWQgbWUgaW50byBpbmR1bGdpbmcgaW4gb25lIG1vcmUgbWVzc2FnZSBvbg0KPj4+Pj4+ Pj4+Pj4+PiBwb2xpY3kgYW5kIHVzZSBjYXNlcy4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+ Pj4+Pj4gSSBhZ3JlZSB0aGF0IHRoZSBTVElSL1BBU1Nwb3JUIG1lY2hhbmlzbXMgY291bGQg YmUgZGVwbG95ZWQNCj4+Pj4+Pj4+Pj4+Pj4gb24gIGluZGl2aWR1YWwgZGV2aWNlcyBhcyB3 ZWxsIGFzIG11bHRpLWRldmljZSBhbmQNCj4+Pj4+Pj4+Pj4+Pj4gbXVsdGktbnVtYmVyIHBs YXRmb3Jtcy4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gTnVtYmVyIGRlbGVnYXRp b24gKGFuZCBzdWItZGVsZWdhdGlvbiksIGFuZCBidXNpbmVzcw0KPj4+Pj4+Pj4+Pj4+PiBy ZWxhdGlvbnNoaXBzIGFyZSB0d28gYWRkaXRpb25hbCBmYWN0b3JzIHdoaWNoIGFmZmVjdA0K Pj4+Pj4+Pj4+Pj4+PiB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBnaXZlbiBjYWxsaW5nIG51bWJl ciBhdXRoZW50aWNhdGlvbi4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gSW5oZXJl bnQgdmFyaWFibGUgdHJ1c3R3b3J0aGluZXNzIG9mIGEgY2FsbGluZyBudW1iZXIgd2FzDQo+ Pj4+Pj4+Pj4+Pj4+IG15IHJlYXNvbiBmb3Igc3VnZ2VzdGluZyBhIHdheSB0byBxdWFsaWZ5 IHRoZSBzaWduYXR1cmUgdG8NCj4+Pj4+Pj4+Pj4+Pj4gcmVmbGVjdCB0aGF0IHZhcmlhYmls aXR5Lg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiBPcmlnaW5hdGluZyBjYXJyaWVy cyBhcmUgaW4gYSBwb3NpdGlvbiB0byBrbm93IGlmIGEgY2FsbCBpcw0KPj4+Pj4+Pj4+Pj4+ PiBjb21pbmcgZnJvbSBhIGRldmljZSBhc3NpZ25lZCBhIHNpbmdsZSBudW1iZXIsIG9yIGZy b20NCj4+Pj4+Pj4+Pj4+Pj4gInRydW5rIGdyb3VwIiB3aGljaCBjb3VsZCBvcmlnaW5hdGUg Y2FsbHMgdXNpbmcgbXVsdGlwbGUNCj4+Pj4+Pj4+Pj4+Pj4gbnVtYmVycywgYW5kIGNhbiBx dWFsaWZ5IHRvIHNvbWUgZGVncmVlIHRoZSB0cnVzdHdvcnRoaW5lc3MNCj4+Pj4+Pj4+Pj4+ Pj4gb2YgbnVtYmVyIGF1dGhlbnRpY2l0eSBhY2NvcmRpbmdseS4NCj4+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pj4gTXkgc3VnZ2VzdGlvbiB3YXMgcXVhbGlmeWluZyBjYWxsaW5nIG51 bWJlciBhdXRoZW50aWNpdHkNCj4+Pj4+Pj4+Pj4+Pj4gaW50byBjYXRlZ29yaWVzIG9mIGNh cnJpZXItc2lnbmVkIChvciBub3QpLCBhbmQNCj4+Pj4+Pj4+Pj4+Pj4gdW5hdXRoZW50aWNh dGVkLCBzZW1pLWF1dGhlbnRpY2F0ZWQsIGFuZA0KPj4+Pj4+Pj4+Pj4+PiBtb3N0LWF1dGhl bnRpY2F0ZWQuICBUaGVyZSBjYW4gYmUNCj4+PiBtb3JlDQo+Pj4+Pj4+Pj4+Pj4+IGdyYW51 bGFyaXR5LCBidXQgaXQgaW1wbGllcyBhZGRpdGlvbmFsIG9wZXJhdGlvbmFsDQo+Pj4+Pj4+ Pj4+Pj4+IGNvbXBsZXhpdHkgKGJvdGggZm9yIHRoZSBjYXJyaWVycyBhbmQgdGhlIGNvbnN1 bWVycykgYW5kIEkNCj4+Pj4+Pj4+Pj4+Pj4gYXNzdW1lIGRpbWluaXNoZXMgdmFsdWUuDQo+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IE15IHJlYXNvbiBmb3IgYWRkaW5nIHRoZSBh dXRoZW50aWNpdHkgb2YgdGhlIG9yaWdpbmF0aW5nDQo+Pj4+Pj4+Pj4+Pj4+IGNhcnJpZXIg aXMgdHlwaWNhbCB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBjYXJyaWVyIGJ1c2luZXNzDQo+Pj4+ Pj4+Pj4+Pj4+IHJlbGF0aW9uc2hpcCB3aXRoIHR5cGljYWwgY29uc3VtZXJzIGFkZHMgdG8g dGhlDQo+Pj4+Pj4+Pj4+Pj4+IHRydXN0d29ydGhpbmVzcyBhc3Nlc3NtZW50IGFuZCBwYXJ0 aWFsbHkgYmVjYXVzZSBjYXJyaWVycw0KPj4+Pj4+Pj4+Pj4+PiBhcmUgYSByZWd1bGF0ZWQg cG9pbnQgb2YgZm9yZW5zaWMgaW5xdWlyeSBmb3IgQ0FMRUEgYW5kIGZyYXVkLg0KPj4+Pj4+ Pj4+Pj4+PiBBZGRpdGlvbmFsbHksIG1vc3QgY2FsbHMgb3JpZ2luYXRlIGFuZCB0ZXJtaW5h dGUgYmV0d2Vlbg0KPj4+Pj4+Pj4+Pj4+PiBtb2JpbGUgY29uc3VtZXJzIHdoZXJlIHRoZWly IGNhcnJpZXJzIGFyZSBhYmxlIHRvIHVzZWZ1bGx5DQo+Pj4+Pj4+Pj4+Pj4+IGF1dGhlbnRp Y2F0ZSB0aGVpciBkZXZpY2UgYW5kIGhhdmUgYSBoaWdoIGRlZ3JlZSBvZg0KPj4+Pj4+Pj4+ Pj4+PiBjb25maWRlbmNlIG9mIHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVt YmVyLg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiBJIHRoaW5rIGJpbGxpb25zIG9m IHBlci1UTiBjZXJ0cyBvZiB2YXJ5aW5nIHVzYWJpbGl0eQ0KPj4+Pj4+Pj4+Pj4+PiAocmV2 b2tlZCwgbm90DQo+Pj4+Pj4+Pj4+Pj4+IHJldm9rZWQpIGZvciBhdXRoZW50aWNhdGluZyBj YWxsaW5nIG51bWJlciB3aWxsIG5vdCB3b3JrIHdlbGwuDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+Pj4+IENvbnZlcnNlbHksIEkgdGhpbmsgYmlsbGlvbnMgb2YgcGVyLVROIGNlcnRz IHdpbGwgd29yaw0KPj4+Pj4+Pj4+Pj4+PiB3ZWxsLCBpZiB0aGUgY2FsbGluZyBwYXJ0eSBo YXMgdG8gc2lnbiBhIGNhbGwgd2l0aCBhIHBlci1UTg0KPj4+Pj4+Pj4+Pj4+PiBjZXJ0IHBy b3ZpZGVkIGJ5IHRoZSBjYWxsZWQgcGFydHkuICBObyBjYWxsZWQgcGFydHkgY2VydCB0byBp bmNsdWRlPw0KPj4+Pj4+Pj4+Pj4+PiBUaGVuIHRoZSBjYWxsaW5nIHBhcnR5IGRvZXMgbm90 IGhhdmUgYSB0cnVzdGVkIHJlbGF0aW9uc2hpcA0KPj4+Pj4+Pj4+Pj4+PiB3aXRoIHRoZSBj YWxsZWQgcGFydHksIGFuZCB0aGUgY2FsbCBjYW4gYmUNCj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9y aXplZC90cmVhdGVkIGFjY29yZGluZ2x5Lg0KPj4+Pj4+Pj4+Pj4+PiAoSSd2ZSBtYWRlIHNp bWlsYXIsIG1vc3RseSBpZ25vcmVkIGNvbW1lbnRzIGluIE1PREVSTi4pDQo+Pj4+Pj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IFBpZXJjZQ0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ PiAqRnJvbToqIEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+Pj4+ Pj4+Pj4+Pj4+ICpTZW50OiogQXVndXN0IDA0LCAyMDE2IDI6MDMgUE0NCj4+Pj4+Pj4+Pj4+ Pj4gKlRvOiogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0K Pj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+ Pj4+Pj4+Pj4+ICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0KPj4+Pj4+ Pj4+Pj4+PiA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+IDxtYWlsdG86YWxleEBib2JvdGVr Lm5ldD4+Ow0KPj4+Pj4+Pj4+Pj4+PiBzdGlyQGlldGYub3JnIDxtYWlsdG86c3RpckBpZXRm Lm9yZz4gPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+PiAqU3ViamVjdDoq IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+IFdlbGwsIHRoZSBtZWNoYW5pc21zIGFyZSBkZXNpZ25lZCBzbyB0aGF0 IHRoZXkgY291bGQgYmUNCj4+Pj4+Pj4+Pj4+Pj4gZGVwbG95ZWQgb24gZGV2aWNlcyBhbmQg UEJYcy4gIFdoZXRoZXIgdGhleSB3aWxsIGJlIGlzIGENCj4+Pj4+Pj4+Pj4+Pj4gcG9saWN5 IGlzc3VlLg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiBUaGUgbm90aW9uIG9mIGNy ZWRlbnRpYWxzIHRoYXQgYXJlIHRyYWNlYWJsZSB0byBhDQo+Pj4+Pj4+Pj4+Pj4+IGRlbGVn YXRpb24gb2YgYSBUTiBpcyBhIG1lY2hhbmlzbSB0aGF0IGlzIHBhcnQgb2YgdGhlDQo+Pj4+ Pj4+Pj4+Pj4+IGRlc2lnbiBvZiBzdGlyLCBhbmQgdGhlIGRlc2lnbiBhbGxvd3MgZGVsZWdh dGlvbiBvZiBvbmUgVE4NCj4+Pj4+Pj4+Pj4+Pj4gKHRvIG9uZSBkZXZpY2UsIGFsdGhvdWdo IGEgZGV2aWNlIGxpa2UgYSBQQlggd291bGQgaGF2ZQ0KPj4+Pj4+Pj4+Pj4+PiBtb3JlIHRo YW4gb25lIFROIHBlciAiZGV2aWNlIiwgYW5kIHNvbWV0aGluZyBsaWtlIGEgZHVhbA0KPj4+ Pj4+Pj4+Pj4+PiBOQU0gcGhvbmUgY291bGQgaGF2ZQ0KPj4+IG1vcmUNCj4+Pj4+Pj4+Pj4+ Pj4gdGhhbiBvbmUgY3JlZGVudGlhbC4gIEZvciB0aGUgdXNlIGNhc2Ugd2UndmUgZGlzY3Vz c2VkLCBhDQo+Pj4+Pj4+Pj4+Pj4+IG1vYmlsZSBwaG9uZSBtYXkgYWxzbyBoYXZlIGEgY3Jl ZGVudGlhbCBmb3IsIHNheSwgYSBUTiB0aGF0DQo+Pj4+Pj4+Pj4+Pj4+IGlzIGRlbGVnYXRl ZCB0byBhIGxhbmRsaW5lLCB0byBjb3ZlciB0aGUgZXhhbXBsZSBjYXNlIG9mIGENCj4+Pj4+ Pj4+Pj4+Pj4gZG9jdG9yIHBsYWNpbmcgYSBjYWxsIG9uIGhpcyBtb2JpbGUsIGJ1dCBnZXR0 aW5nIGhpcyBvZmZpY2UNCj4+Pj4+Pj4+Pj4+Pj4gbnVtYmVyIHRvIHNob3cgdXAgYXMgdGhl IGNhbGxpbmcgcGFydHkuICBVc2Ugb2Ygc3VjaCBtZWNoYW5pc21zIGlzIHBvbGljeS4NCj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gQnJpYW4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gIE9uIEF1ZyA0LCAyMDE2LCBhdCAyOjUyIFBNLCBH b3JtYW4sIFBpZXJjZSBBIFtDVE9dDQo+Pj4+Pj4+Pj4+Pj4+IDxQaWVyY2UuR29ybWFuQHNw cmludC5jb20NCj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+Pj4+ Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+Pg0KPj4+Pj4+Pj4+ Pj4+PiB3cm90ZToNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gIFRoYW5rcyBCcmlh bi4gIEknbSBhZnJhaWQgd2UncmUgc3RyYXlpbmcgaW50byBhIHBvbGljeQ0KPj4+Pj4+Pj4+ Pj4+PiBkaXNjdXNzaW9uLiAgUmVnYXJkbGVzcywgSSBkbyBhcHByZWNpYXRlIHlvdXIgZXhw bGFuYXRpb24uDQo+Pj4+Pj4+Pj4+Pj4+IEkgd291bGQgbGlrZSB0byBjb250aW51ZSB0aGUg ZGlzY3Vzc2lvbiwgYnV0IEknbSBwcmV0dHkNCj4+Pj4+Pj4+Pj4+Pj4gc3VyZSB0aGlzIGlz bid0IHRoZSByaWdodCBmb3J1bS4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gIFBp ZXJjZQ0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAgKkZyb206KiBCcmlhbiBSb3Nl biBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KPj4+Pj4+Pj4+Pj4+PiAgKlNlbnQ6KiBB dWd1c3QgMDQsIDIwMTYgMTozNCBQTQ0KPj4+Pj4+Pj4+Pj4+PiAgKlRvOiogR29ybWFuLCBQ aWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4+ IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPj4+Pj4+Pj4+Pj4+PiA8bWFp bHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+Pj4+ICAqQ2M6KiBB bGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQNCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzph bGV4QGJvYm90ZWsubmV0PiA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+PjsNCj4+Pj4+Pj4+ Pj4+Pj4gc3RpckBpZXRmLm9yZyA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IDxtYWlsdG86c3Rp ckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+Pj4gICpTdWJqZWN0OiogUmU6IFtzdGlyXSBTVElS IDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gIE9m IGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBhcyBzbWFydA0K Pj4+Pj4+Pj4+Pj4+PiBwaG9uZXMgYW5kICBhbnkgb3RoZXIgZGV2aWNlcyB0aGF0IGNhbiBi ZSBwcm9ncmFtbWVkIHRvIGRvDQo+Pj4gc28uDQo+Pj4+Pj4+Pj4+Pj4+ICBUaGV5IHdpbGwg YmUgZ2l2ZW4gY3JlZGVudGlhbHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBmb3IgdGhlDQo+Pj4+ Pj4+Pj4+Pj4+IFROcyB0aGV5IGFyZSBhdXRob3JpemVkIHRvIHNpZ24gZm9yLiAgVGhleSBj YW4gdHJ5IHRvIHNpZ24NCj4+Pj4+Pj4+Pj4+Pj4gYW55IGNhbGwsICBidXQgdGhlIHZhbGlk aXR5IG9mIHRoZSBjcmVkZW50aWFsIHdvdWxkIG1ha2UNCj4+Pj4+Pj4+Pj4+Pj4gc3VjaCBh IHNpZ25hdHVyZSAgZmFpbCB0aGUgY2hlY2tpbmcuDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+ICBHZXR0aW5nIHNlcnZpY2UgcHJvdmlkZXJzIHRvIHNpZ24gb24gYmVoYWxmIG9m IGRldmljZXMgaXMNCj4+Pj4+Pj4+Pj4+Pj4gYSByZWFzb25hYmxlIHdheSB0byBkZXBsb3kg cXVpY2tseSwgYnV0IEkgZXhwZWN0IG1hbnkgU1BzDQo+Pj4+Pj4+Pj4+Pj4+IHdpbGwgd2Fu dCAgdG8gZ2V0IG91dCBvZiB0aGUgbGlhYmlsaXR5IG9mIHNpZ25pbmcgb24gYmVoYWxmDQo+ Pj4+Pj4+Pj4+Pj4+IG9mIHRoZWlyIGN1c3RvbWVycy4gIElmIHRoZXkgY2FuIHB1c2ggb2Yg dGhhdA0KPj4+Pj4+Pj4+Pj4+PiByZXNwb25zaWJpbGl0eSB0byB0aGVpciBjdXN0b21lciwg b25seSBiZWluZyByZXNwb25zaWJsZQ0KPj4+Pj4+Pj4+Pj4+PiBmb3IgZ2V0dGluZyB0aGUg Y3VzdG9tZXIgYW4gYXBwcm9wcmlhdGUgY3JlZGVudGlhbCB3aGVuDQo+Pj4+Pj4+Pj4+Pj4+ IHRoZXkgYXNzaWduIFROcywgdGhlbiBJIHdvdWxkIGV4cGVjdCAgdGhlbSB0byB3YW50IHRv IGRvDQo+Pj4+Pj4+Pj4+Pj4+IHNvLiAgVGhhdCBtZWFucyB0aGUgZGV2aWNlcyBoYXZlIHRv IGJlIGFibGUgdG8gIHNpZ24sIGJ1dCBJDQo+Pj4+Pj4+Pj4+Pj4+IHVuZGVyc3RhbmQgbWFu eSBvZiB0aGUgUEJYIHZlbmRvcnMgdGhpbmsgdGhhdCdzICBzb21ldGhpbmcNCj4+Pj4+Pj4+ Pj4+Pj4gdGhleSBjb3VsZCBwcm92aWRlIGluIGEgZnV0dXJlIHJlbGVhc2UuDQo+Pj4+Pj4+ Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICBCcmlhbg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgIE9uIEF1ZyA0LCAyMDE2LCBhdCAyOjIyIFBNLCBH b3JtYW4sIFBpZXJjZSBBIFtDVE9dDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgPFBpZXJjZS5Hb3Jt YW5Ac3ByaW50LmNvbQ0KPj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3By aW50LmNvbT4NCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5j b20+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgIHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4+Pj4+PiAgICAgIFlvdSB3YW50IElQIFBCWGVzIHRvIHNpZ24gY2FsbHM/ICBXb24ndCB0 aGF0IG1ha2UgaXQNCj4+Pj4+Pj4+Pj4+Pj4gICAgICBleHRyYW9yZGluYXJpbHkgZWFzeSB0 byBjb21taXQgZnJhdWQgd2l0aA0KPj4+Pj4+Pj4+Pj4+PiBhdXRoZW50aWNhdGVkIG51bWJl cnM/DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAg KkZyb206KiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KPj4+Pj4+ Pj4+Pj4+PiAgICAgICpTZW50OiogQXVndXN0IDA0LCAyMDE2IDEyOjI0IFBNDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgKlRvOiogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1h bkBzcHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJp bnQuY29tPg0KPj4+Pj4+Pj4+Pj4+PiAgICAgIDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJp bnQuY29tPj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAqQ2M6KiBBbGV4IEJvYm90ZWsgPGFsZXhA Ym9ib3Rlay5uZXQNCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pg0K Pj4+Pj4+Pj4+Pj4+PiAgICAgIDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+OyBzdGlyQGll dGYub3JnDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4gPG1haWx0bzpz dGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICpTdWJqZWN0OiogUmU6IFtzdGly XSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4gICAgICBGaXJzdCBvZiBhbGwsIHdlIHdvdWxkIHdhbnQgdGhlIFBCWCB0byBnZW5lcmF0 ZSB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gc2lnbmF0dXJlLA0KPj4+Pj4+Pj4+Pj4+PiAgICAgIGJ1 dCB0aGUgc2VydmljZSBwcm92aWRlciBjYW4gZG8gdGhhdC4gIEl0IHNob3VsZCBub3QgYWRk IGENCj4+Pj4+Pj4+Pj4+Pj4gICAgICB2YWxpZCBzaWduYXR1cmUgdG8gYSBjYWxsIGZyb20g YSBudW1iZXIgaXQgZGlkIG5vdA0KPj4+Pj4+Pj4+Pj4+PiBhc3NpZ24gdG8NCj4+Pj4+Pj4+ Pj4+Pj4gICAgICB0aGUgdHJ1bmsgZ3JvdXAgY29ubmVjdGluZyB0byB0aGUgUEJYLCBhbHRo b3VnaCBpdCBjb3VsZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgIHN1cHBvcnQgdGhlIGV4dHJhIGRl bGVnYXRpb24gcmVxdWlyZWQgdG8gc3VwcG9ydA0KPj4+Pj4+Pj4+Pj4+PiAiYXV0aG9yaXpl ZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgIHNwb29maW5nIi4gIFRoZSBjb21wYW5pb24gZGV2aWNl cyBJJ20gYXdhcmUgb2YgYWx3YXlzIHNlbmQNCj4+Pj4+Pj4+Pj4+Pj4gICAgICBjYWxscyBm cm9tIHRoZSBzYW1lIHNlcnZpY2UgcHJvdmlkZXIgYW5kIHNob3VsZCBub3QgcHJlc2VudA0K Pj4+Pj4+Pj4+Pj4+PiAgICAgIGFueSBpc3N1ZS4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+ Pj4+Pj4gICAgICBFdmVyeW9uZSB3aWxsIGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbid0IGRv IG5vdyB0bw0KPj4+Pj4+Pj4+Pj4+PiBpbXBsZW1lbnQNCj4+Pj4+Pj4+Pj4+Pj4gICAgICBz dG9wIHNwb29mZWQgY2FsbHMuIFRBTlNUQUFGTA0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+PiAgICAgIEJyaWFuDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIE9uIEF1ZyA0LCAyMDE2LCBhdCAxMjo0MSBQTSwgR29ybWFuLCBQ aWVyY2UgQSBbQ1RPXQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICA8UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tPg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3By aW50LmNvbT4+IHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICBGcmF1ZCBmcm9tIGNvbXByb21pc2VkIFBCWGVzIGlzIGNvbW1vbi4gIEFuZCBldmVuDQo+ Pj4+Pj4+Pj4+Pj4+IHdoZXJlIGENCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgUEJYIGlzIG5v dCBjb21wcm9taXNlZCwgYSBjYXJyaWVyIGhhcyBubyBwcmFjdGljYWwNCj4+Pj4+Pj4+Pj4+ Pj4gd2F5IG9mDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGtub3dpbmcgd2hldGhlciB0aGUg Y2FsbGluZyBudW1iZXIgaXMgcHJvcGVybHkgYXNzaWduZWQNCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgYW5kIHZhbGlkIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHRoZSBFbnRlcnByaXNl Lg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBUaGVyZWZvcmUsIGNoZWNraW5nIHdoZXRoZXIg dGhlIGNhbGxpbmcgbnVtYmVyIHdhcw0KPj4+Pj4+Pj4+Pj4+ID5mcm9tIGFuDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIGFzc2lnbmVkIHJhbmdlIG1pZ2h0IGJlIHBvc3NpYmxlIChhbmQg ZnJhdWdodCB3aXRoDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGFkbWluaXN0cmF0aXZlIGNo YWxsZW5nZXMpLCBidXQgb2YgbGltaXRlZCB2YWx1ZS4NCj4+Pj4+Pj4+Pj4+Pj4gQW5kIGlu DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHRoZSBjb25zdW1lciBtYXJrZXQsIHRoZXJlIGFy ZSBjYWxsaW5nIHByb2R1Y3RzIHdoaWNoDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHN1cHBv cnQgYSBwYXJlbnQgc3Vic2NyaWJlciBudW1iZXIgYW5kICJjb21wYW5pb24iDQo+Pj4+Pj4+ Pj4+Pj4+IGRldmljZXMNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKGUuZy4sIHRhYmxldHMp IHdoaWNoIGNhbiBwbGFjZSBhIGNhbGwgdXNpbmcgdGhlIE1ETiBvZg0KPj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICB0aGUgcGFyZW50IHN1YnNjcmliZXIuICBUaGVzZSBhcmUgZXhhbXBsZXMg b2Ygd2hlcmUgdGhlDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGF1dGhlbnRpY2l0eSBvZiB0 aGUgY2FsbGluZyBudW1iZXIgd29uJ3QNCj4+Pj4+Pj4+Pj4+Pj4gbmVjZXNzYXJpbHkgbWVh bg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICB0aGUgc2FtZSB0aGluZyBhcyB0aGUgYXV0aGVu dGljaXR5IG9mIGEgY2FsbCBmcm9tDQo+Pj4+Pj4+Pj4+Pj4+IGEgc2luZ2xlDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIHN1YnNjcmliZXIgd2l0aCBhIHNpbmdsZSBNRE4gcmVnYXJkbGVz cyBvZiAibGF4aXR5IiBvZg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBzcG9vZiBjaGVja2lu Zy4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgSW4gYW5vdGhlciBm b3J1bSBhbmQgYW50aWNpcGF0aW5nIGNhbGxpbmcgbnVtYmVyDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgIGF1dGhlbnRpY2F0aW9uIG1hbmRhdGVzIGZyb20gQ29uZ3Jlc3MgYW5kL29yIEZD QywgSQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBzdWdnZXN0ZWQgdXNpbmcgY2Fycmllci1z cGVjaWZpYyBjZXJ0cyBhbmQgZW5jb2RpbmcNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc3Bl Y2lmaWNpdHkgb2YgYXV0aGVudGljaXR5LCBhbmQgY2FsbGluZyBudW1iZXIuICBUaGlzDQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHByb3ZpZGVzIHRoZSBpZGVudGl0eSBvZiB0aGUgb3Jp Z2luYXRpbmcgY2Fycmllciwgc29tZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBpZGVhIGFz IHRvIHRoZSBhY2N1cmFjeSBvciBzcGVjaWZpY2l0eSBvZiB0aGUgY2FsbGluZw0KPj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICBudW1iZXIsIGFuZCB2YWxpZHR5IG9mIHRoZSBjYWxsaW5nIG51 bWJlcg0KPj4+Pj4+Pj4+Pj4+PiAoYXNzdW1pbmcgbm9uY2UNCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgYW5kIHJlcGxheSBpc3N1ZXMgY2FuIGJlIGFkZHJlc3NlZCBhcyByZWFzb25hYmx5 DQo+Pj4+Pj4+Pj4+Pj4+IHN1Z2dlc3RlZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBiZWxv dyBieSBBbGV4KS4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgVGhl IHJlcHJlc2VudGF0aW9uIG9mIG9yaWctY2FycmllciBhbmQgdHJ1c3R3b3J0aGluZXNzDQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGNvdWxkIGJlIGFzIGZvbGxvd3M6DQo+Pj4+Pj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpSZWd1bGF0ZWQvbWFuZGF0ZWQgQ2Fycmll ciBDbGFzcyBVc2UgQ2FzZToqDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICowMCAtIE5vIENyZWRlbnRpYWxzKg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBVc2Ug Y2FzZSBleGFtcGxlKHMpOiBQcmUtSU1TLCBsZWdhY3kgY2lyY3VpdC1zd2l0Y2hlZA0KPj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICBuZXR3b3JrcyB0aGF0IGRvbid0IG5hdGl2ZWx5IHN1cHBv cnQgU0lQIG9yIHdoaWNoIGRvbid0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGNob29zZSB0 byBzaWduIGNhbGxzLiAgRS5nLiwgaW50ZXJuYXRpb25hbCBjYXJyaWVycy4NCj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6ICBHb29kIGx1Y2suICBDYXJyaWVyX29y aWcgYW5kIENnUE4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgZW50aXJlbHkgdW50cnVzdHdv cnRoeS4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKjAxIC0gQ2Fy cmllciBzaWduZWQsIG5vIGF1dGhlbnRpY2F0aW9uIG9mIENnUE4qDQo+Pj4+Pj4+Pj4+Pj4+ ICAgICAgICAgIFVzZSBjYXNlIGV4YW1wbGUocyk6IEU5MTEgb24gdmlzaXRlZCBuZXR3b3Jr IHcvbw0KPj4+Pj4+Pj4+Pj4+PiByb2FtaW5nDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGFn cmVlbWVudCwgbWFudWFsIHJvYW1pbmcuDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFRydXN0 IEVzdGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BODQo+Pj4+Pj4+Pj4+ Pj4+IGVudGlyZWx5DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHVudHJ1c3R3b3J0aHkNCj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKjEwIC0gQ2FycmllciBzaWdu ZWQsIHNlbWktYXV0aGVudGljYXRlZCBDZ1BOKg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBV c2UgY2FzZSBleGFtcGxlKHMpOiBOdW1iZXIgYmxvY2sgZGVsZWdhdGVkIGZyb20NCj4+Pj4+ Pj4+Pj4+Pj4gT0NOLCBidXQNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgbm8gcGVyLVROIHNj cmVlbiAoU0lQIHRydW5rcykuDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFRydXN0IEVzdGlt YXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BODQo+Pj4+Pj4+Pj4+Pj4+IGxl c3MgdGhhbg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBtb3N0IHRydXN0d29ydGh5IGJ1dCBu b3QgZW50aXJlbHkgdW50cnVzdHdvcnRoeS4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgKjExIC0gQ2FycmllciBzaWduZWQsIGF1dGhlbnRpY2F0ZWQgQ2dQTioN Cj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgVXNlIGNhc2UgZXhhbXBsZShzKTogQnJlYWQtYW5k LWJ1dHRlciA5NSUrIG9mDQo+Pj4+Pj4+Pj4+Pj4+IGNhbGxzIGZyb20NCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgc3Vic2NyaWJlciBsaW5lcyAoSU1TLWJhc2VkIGFuZCBvdGhlcndpc2Up Lg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBUcnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3Jp ZyB0cnVzdHdvcnRoeSwgQ2dQTiBtb3N0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHRydXN0 d29ydGh5DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpQdWJsaWMg VXNlIENhc2U6Kg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBVbmRl ZmluZWQgYnV0IGFzc3VtZWQgdG8gdXNlIHB1YmxpYyBvciBjb21tZXJjaWFsbHkNCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgYXZhaWxhYmxlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2VzIHJl c291cmNlcy4gIGUuZy4sDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG5vbW9yb2JvLWxpa2Ug Y3Jvd2Qtc291cmNlZCBhY2NlcHQvZGVueSBsaXN0cywgZXQNCj4+Pj4+Pj4+Pj4+Pj4gY2V0 ZXJhLg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBDb3VsZC93b3VsZCBwYXNzIGNyZWRlbnRp YWxzIGRvd24gdG8gU0lQLWF3YXJlIGRldmljZXMNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg d2hpY2ggd291bGQgcHJvY2VzcyB0aGVtIGFjY29yZGluZyB0byB0aGUgcnVsZXMgb2YgdGhl DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFB1YmxpYyBDbGFzcyBhcHBsaWNhdGlvbihzKS4N Cj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgUGllcmNlDQo+Pj4+Pj4+ Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpGcm9tOiogQnJpYW4gUm9zZW4gW21h aWx0bzpickBicmlhbnJvc2VuLm5ldF0NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKlNlbnQ6 KiBBdWd1c3QgMDQsIDIwMTYgOTowMiBBTQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAqVG86 KiBBbGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQNCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0 bzphbGV4QGJvYm90ZWsubmV0Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICA8bWFpbHRvOmFs ZXhAYm9ib3Rlay5uZXQ+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAqQ2M6KiBzdGlyQGll dGYub3JnIDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpz dGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAqU3ViamVjdDoqIFJlOiBb c3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIFRoZXJlIGFyZSByZWFzb25hYmxlIGNpcmN1bXN0YW5jZXMgd2hl cmUgYSBwYXJ0eQ0KPj4+Pj4+Pj4+Pj4+PiBwbGFjaW5nIGENCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgY2FsbCBpcyBub3QgdGhlIGF1dGhvcml6ZWQgZW50aXR5IGFzc2lnbmVkIHRoZQ0K Pj4+Pj4+Pj4+Pj4+PiB0ZWxlcGhvbmUNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgbnVtYmVy IHVzZWQgaW4gRnJvbS9QQUksIGFuZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlDQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgIHNlcnZpY2UgcHJvdmlkZXIgc2VydmljaW5nIHRoZSBlbnRp dHkgcGxhY2luZyB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gY2FsbCBtYXkNCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgb3IgbWF5IG5vdCBiZSB0aGUgc2FtZSBhcyB0aGUgc2VydmljZSBwcm92aWRl cg0KPj4+Pj4+Pj4+Pj4+PiBzZXJ2aW5nIHRoZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBl bnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4uICBJbiBhbGwgc3VjaCBjYXNlcywgdGhl DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVkIHRoZSBU TiBleHBsaWNpdGx5DQo+Pj4+Pj4+Pj4+Pj4+IGF1dGhvcml6ZXMgY2FsbHMNCj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgcGxhY2VkIHVzaW5nIGl0J3MgVE4uICBUaGUgZGVzaWduIGFjY29t bW9kYXRlcyBzdWNoIHVzZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBjYXNlcy4gIEl0J3Mg bm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uIHdpdGhvdXQNCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgYXV0aGVudGljYXRpb24uICAgV2UncmUgbm90IGF3YXJlIG9mIGFueSBjYXNlcyB3 aGVyZQ0KPj4+Pj4+Pj4+Pj4+PiB0aGVyZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBpcyBh biBhY3R1YWwgcmVxdWlyZW1lbnQgZm9yIGxlZ2l0aW1hdGUgY2FsbGluZyB3aXRob3V0DQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGV4cGxpY2l0IGF1dGhvcml6YXRpb24gZnJvbSB0aGUg YXNzaWduZWQgZW50aXR5LA0KPj4+Pj4+Pj4+Pj4+PiBhbHRob3VnaA0KPj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICB3ZSBjZXJ0YWlubHkgYXJlIGF3YXJlIHRoYXQgdmFyaW91cyBwYXJ0cyBv ZiB2YXJpb3VzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHNlcnZpY2UgcHJvdmlkZXJzIGRv bid0IGJvdGhlciB0byBjaGVjay4gQXQgdGhpcw0KPj4+Pj4+Pj4+Pj4+PiBwb2ludCwgYXQN Cj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgbGVhc3QgaW4gc29tZSBjb3VudHJpZXMsIHRoZXJl IGlzIGEgcmVhbGl6YXRpb24NCj4+Pj4+Pj4+Pj4+Pj4gdGhhdCB0aGUNCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgbGF4aXR5IG9mIGFsbG93aW5nIHVuY2hlY2tlZCBzcG9vZmluZyBpcyBu b3QgYWNjZXB0YWJsZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBhbnkgbW9yZS4NCj4+Pj4+ Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgQnJpYW4NCj4+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIE9uIEF1ZyAzLCAy MDE2LCBhdCA4OjM1IEFNLCBBbGV4IEJvYm90ZWsNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg ICAgIDxhbGV4QGJvYm90ZWsubmV0IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4NCj4+Pj4+ Pj4+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAxLiAgICAgICBQZXJtaXQgYXV0aG9y aXphdGlvbiB3aXRob3V0DQo+Pj4+Pj4+Pj4+Pj4+IGF1dGhlbnRpY2F0aW9uDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICAgICBJbiB0aGUgY3VycmVudCB0ZWxlcGhvbnkgbmV0d29yayBw cmFjdGljZSwgc29tZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgc2VydmljZSBwcm92 aWRlciBpbXBsZW1lbnRhdGlvbnMgY2hvb3NlIG5vdCB0bw0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICAgICAgYXV0aGVudGljYXRlIGlkZW50aXR5LCBidXQgc2ltcGx5IGZhY2lsaXRhdGUN Cj4+Pj4+Pj4+Pj4+Pj4gdGhlIHVzZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgb2Yg YW4gYXJiaXRyYXJ5IG9yIHNlbGVjdGVkIHVzZXItcHJvdmlkZWQgaWRlbnRpdHkuDQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBBcmUgdGhlcmUgbGVnaXRpbWF0ZSB1c2UgY2FzZXMg Zm9yIHRoaXM/ICBIYXMNCj4+Pj4+Pj4+Pj4+Pj4gYW55b25lDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICBlc3RhYmxpc2hlZCB0aGF0IHRoZXJlIGFyZSBub3Q/ICBIb3cgY2FuIHRo ZQ0KPj4+Pj4+Pj4+Pj4+PiBpbmR1c3RyeQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg cmVhc29uYWJseSBleHBlY3QgdG8gZW5kIHRoaXMgKG9mdGVuIGJhZCkgcHJhY3RpY2U/DQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBJZiBpdCBjYW4ndCBiZSBlbmRlZCwgdGhlcmUn cyB2YWx1ZSBpbiBhdCBsZWFzdA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgaWRlbnRp ZnlpbmcgdGhlIG9yaWdpbmF0aW5nIHNlcnZpY2UgcHJvdmlkZXINCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgIChpLmUuLCB0aGUgc2lnbmVyL2F1dGhvcml6ZXIpLiAgR2l2ZW4gdGhl DQo+Pj4+Pj4+Pj4+Pj4+IHByZXZhbGVuY2UNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg IG9mIGFidXNlIHVzaW5nIHRlbGVwaG9uZSBudW1iZXJzIGFzc2lnbmVkIHRvIGENCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgICAgIHNvbWV0aW1lcy1hbm9ueW1vdXMgYWJ1c2VyLCBpdCBi ZWNvbWVzIGNyaXRpY2FsbHkNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGltcG9ydGFu dCB0byBpZGVudGlmeSB0aGUgc2VydmljZSBwcm92aWRlcihzKQ0KPj4+Pj4+Pj4+Pj4+PiBj bG9zZXN0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0byB0aGUgYWJ1c2VyLiAgQmFz ZWQgb24gdGhlIGFzc3VtcHRpb24gdGhhdCBpdCdzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAg ICAgICBiZXR0ZXIgdG8gSUQgc2VydmljZSBwcm92aWRlcnMgdGhhbiB1bnJlYXNvbmFibHkN Cj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGV4cGVjdCBhIGJhbiBvZiB0aGUgdXNlIG9m IHVuYXV0aGVudGljYXRlZCAoYW5kDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0aGVy ZWZvcmUgdW5zaWduZWQpIFNJUCByZXF1ZXN0cywgU1RJUiBzaWduaW5nDQo+Pj4+Pj4+Pj4+ Pj4+IHNob3VsZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgc3VwcG9ydCBhdXRob3Jp emF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24uICBUaGUNCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgIHByYWN0aWNlIG9mIGF1dGhvcml6aW5nIHVuYXV0aGVudGljYXRlZCB1c2Ug ZXhpc3RzLA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgYW5kIHRoZXJlIGlzIGJlbmVm aXQgdG8gc2lnbmluZyBpbiB0aGVzZSBjYXNlcw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICAgKHNlcnZpY2UgcHJvdmlkZXIgaWRlbnRpZmljYXRpb24pLiAgVGhlIGxhbmd1YWdlIG9m DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlz IHVzZS4gIDQ0NzRiaXMtMTANCj4+Pj4+Pj4+Pj4+Pj4gc2hvdWxkIE5PVA0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgcmVxdWlyZSBvciBhc3N1bWUgdGhhdCAgdGhhdCBhdXRoZW50 aWNhdGlvbiB3aWxsDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBwcmVjZWRlIGF1dGhv cml6YXRpb24uIE9mIGNvdXJzZSB0aGVyZSBtYXkgYmUgb3RoZXINCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgIHVzZSBjYXNlcyB3aGVyZSBzaWduaW5nIGluY2x1ZGVzIGF1dGhlbnRp Y2F0aW9uIGFuZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgbWF5IG5vdCBpbmNsdWRl IGEgc3BlY2lmaWMgc2VydmljZSBwcm92aWRlcidzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAg ICAgICBhdXRob3JpemF0aW9uLg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgMi4gICAgICAgSW1wcm92ZSByZXBsYXkgcHJldmVu dGlvbg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgUHJveGltYXRlIHJlcGxheSBpcyBw b3NzaWJsZSB3aGlsZSBjb21wbHlpbmcNCj4+Pj4+Pj4+Pj4+Pj4gd2l0aCB0aGlzDQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzcGVjLiAgRmlyc3QsIG9uZSBvciBtb3JlIHByb3hp bWF0ZSAoZS5nLiwNCj4+Pj4+Pj4+Pj4+Pj4gd2l0aGluDQo+Pj4+Pj4+Pj4+Pj4+IDYwDQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzZWNvbmRzKSBTSVAgcmVxdWVzdHMgdXNpbmcg dGhlIHNhbWUgdG9rZW4gYXJlDQo+Pj4+Pj4+Pj4+Pj4+IGxlZ2FsDQo+Pj4+Pj4+Pj4+Pj4+ ICAgICAgICAgICAgICBhbmQgc3ViamVjdCB0byByZXBsYXkgaW4gbWFueSBjYXNlcy4gIEFu IFNEUCBib2R5J3MNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIG1reSBtYXkgbm90IGJl IHByZXNlbnQgYW5kIGlmIHByZXNlbnQgaXRzIHVzZSBpcw0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICAgICAgb3B0aW9uYWwuICBTb21lIHNvcnQgb2YgbWFuZGF0b3J5IG5ldyBvciBleGlz dGluZw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgc2lnbmVkIHNlcXVlbmNlLCByYW5k b20gIyBvciByZXF1ZXN0IElEIChlLmcuLA0KPj4+Pj4+Pj4+Pj4+PiBDYWxsLUlEDQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBvciBDU2VxKSBhbmQgYSAxLXRpbWUgdXNlIHBvbGlj eSBvbiB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gcmVjZWl2aW5nIGVuZA0KPj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgb2YgdGhlIHJlcXVlc3QgKGUuZy4sIHRva2VucyBvbmx5IGdvb2QgZm9y IDENCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHVzZSkgY291bGQgcHJldmVudCByZXBs YXkuICBEaWZmZXJlbnQgbWV0aG9kcw0KPj4+Pj4+Pj4+Pj4+PiAoZS5nLiwNCj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgIElOVklURSB2cyBNRVNTQUdFKSBtaWdodCBiZSBoYW5kbGVk IGJ5IGRpZmZlcmVudA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgcmVjZWl2aW5nIGlu ZnJhc3RydWN0dXJlLCBhbmQgdGhlcmVmb3JlDQo+Pj4+Pj4+Pj4+Pj4+IGRpZmZpY3VsdGll cw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgd2l0aCAnaXQncyBiZWVuIHVzZWQgYWxy ZWFkeScgY29vcmRpbmF0aW9uIGFsbG93IGENCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg IGZha2VkIE1FU1NBR0UgYmFzZWQgb24gYSBjYXB0dXJlZCByZXF1ZXN0Lg0KPj4+Pj4+Pj4+ Pj4+PiBUaGlzIG1pZ2h0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBpbmNsdWRlIGFu IG1rZXkgZnJvbSBhIGNhcHR1cmVkIElOVklURS4gICBTbyBpdA0KPj4+Pj4+Pj4+Pj4+PiBt YXkgYmUNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHBvc3NpYmxlIHRvIERPUywgc3Bh bSBvciB0ZXh0LWJvbWIgYSByZWNpcGllbnQNCj4+Pj4+Pj4+Pj4+Pj4gdXNpbmcgYQ0KPj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgY2FwdHVyZWQgaWRlbnRpdHkuICBXaGlsZSBsYXJn ZS1zY2FsZSBvcg0KPj4+Pj4+Pj4+Pj4+PiBkaXN0cmlidXRlZA0KPj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgaW1wbGVtZW50YXRpb25zIG1heSBtYWtlIHRoZSBlbmZvcmNlbWVudCBk aWZmaWN1bHQsDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0aGVyZSBpcyBsaXR0bGUg Y29zdCB0byBzaWduaW5nIGFuZCBkZWNvZGluZyBhDQo+Pj4+Pj4+Pj4+Pj4+IG1ldGhvZA0K Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgYW5kIHBvc3NpYmx5IGEgbnVtZXJpYyBJRC4g ICBTb21lIHNvcnQgb2YgJzEtdXNlJw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgcHJh Y3RpY2Ugc2hvdWxkIGF0IGxlYXN0IGJlIGRpc2N1c3NlZCB3aGlsZSBwZXJoYXBzDQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBub3QgcmVxdWlyZWQuDQo+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBTcGVjaWZpYyBtYXJr dXAgc3VnZ2VzdGlvbnM6DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICAgICBOSVRTDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBUaGUgdmVyaWZpZXIgTVVTVCBpbnNw ZWN0IGFueSBvcHRpb25hbCAicHB0Ig0KPj4+Pj4+Pj4+Pj4+PiBwYXJhbWV0ZXIgYXBwZWFy aW5nICppbip0aGUNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg ICAgIElkZW50aXR5IHJlcXVlc3QuICBJZiBubyAicHB0IiBwYXJhbWV0ZXIgaXMNCj4+Pj4+ Pj4+Pj4+Pj4gcHJlc2VudCwgdGhlbiB0aGUNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgICAgICAgIHZlcmlmaWVyIHByb2NlZWRzIG5vcm1hbGx5IGJlbG93LiAg SWYgYSAicHB0Ig0KPj4+Pj4+Pj4+Pj4+PiBwYXJhbWV0ZXIgdmFsdWUgaXMNCj4+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIHByZXNlbnQsIGFuZCB0aGUg dmVyaWZpZXIgZG9lcyBub3Qgc3VwcG9ydA0KPj4+Pj4+Pj4+Pj4+PiBpdCwgaXQgTVVTVCBp Z25vcmUgdGhlDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAg ICBJZGVudGl0eSBoZWFkZXIuICBJZiBhIHN1cHBvcnRlZCAicHB0Ig0KPj4+Pj4+Pj4+Pj4+ PiBwYXJhbWV0ZXIgdmFsdWUgaXMgcHJlc2VudCwNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgICAgIHRoZSB2ZXJpZmllciBmb2xsb3dzIHRoZSBwcm9jZWR1 cmVzIGJlbG93LA0KPj4+Pj4+Pj4+Pj4+PiBpbmNsdWRpbmcgdGhlIHZhcmlhdGlvbnMNCj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIGRlc2NyaWJlZCBp biBTdGVwIDUuDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICAgMw0KPj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiA8ZmlsZTovLy9DOi9Vc2Vycy9hYjM3NzgvRG9j dW1lbnRzL0lFVEYvZHJhZnQtaWV0Zi1zdGlyLXJmYw0KPj4+Pj4+Pj4+Pj4+PiA0NDcNCj4+ Pj4+Pj4+Pj4+Pj4gNGJpDQo+Pj4+Pj4+Pj4+Pj4+IHMtMTAlMjAtDQo+Pj4gJTIwQXV0aGVu dGljYXRlZCUyMElkZW50aXR5JTIwTWFuYWdlbWVudCUyMGluJTIwdGhlJTIwDQo+Pj4+Pj4+ Pj4+Pj4+IFNlcyBzaW9uJTIwSW5pdGlhdGlvbiUyMFByb3RvY29sJTIwJTI4U0lQJTI5Lmh0 bSNzZWN0aW9uLQ0KPj4+IDM+Lg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgIEJh Y2tncm91bmQNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFsu Li5dDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBQZXIgW1JGQzczNDANCj4+Pj4+Pj4+Pj4+Pj4g PGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3MzQwPl0sIHByb2JsZW1zIHN1Y2gg YXMNCj4+Pj4+Pj4+Pj4+Pj4gcm9ib2NhbGxpbmcsIHZvaWNlbWFpbCBoYWNraW5nLCBhbmQN Cj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIHN3YXR0aW5n IGFyZSBlbmFibGVkIGJ5IGFuIGF0dGFja2VyJ3MNCj4+Pj4+Pj4+Pj4+Pj4gYWJpbGl0eSB0 byBpbXBlcnNvbmF0ZSBzb21lb25lDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICAgICBlbHNlLiAgVGhlIHNlY3VyZSBvcGVyYXRpb24gb2YgbW9zdCBTSVAN Cj4+Pj4+Pj4+Pj4+Pj4gYXBwbGljYXRpb25zIGFuZCBzZXJ2aWNlcw0KPj4+Pj4+Pj4+Pj4+ Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgZGVwZW5kcyBvbiBhdXRoZW50aWNh dGluZyBhbmQvb3INCj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXppbmcgdGhlIHNvdXJjZSBvZiBj b21tdW5pY2F0aW9ucyBhcyBpdCBpcw0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgICAgcmVwcmVzZW50ZWQgaW4gYSBTSVAgcmVxdWVzdC4NCj4+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgICAgIFRoaXMgaWRlbnRpdHkgYXJjaGl0ZWN0dXJlIGZvciBTSVAgZGVwZW5k cw0KPj4+Pj4+Pj4+Pj4+PiBvbiBpbmNsdWRlcyBwcm92aXNpb25zIGZvciBhIGxvZ2ljYWwN Cj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgICJhdXRoZW50 aWNhdGlvbiBzZXJ2aWNlIiB3aGljaCB2YWxpZGF0ZXMNCj4+Pj4+Pj4+Pj4+Pj4gY2FsbGVy IGlkZW50aXR5IGF0IG9yIG5lYXIgb3JpZ2luYXRpb24uICBvdXRnb2luZw0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgcmVxdWVzdHMuICBBbg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICAgICAgICAgYXV0aGVudGljYXRpb24gc2VydmljZSBtYXkgYmUg aW1wbGVtZW50ZWQNCj4+Pj4+Pj4+Pj4+Pj4gZWl0aGVyIGFzIHBhcnQgb2YgYSB1c2VyDQo+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBhZ2VudCBvciBh cyBhIHByb3h5IHNlcnZlcjsgdHlwaWNhbGx5LCBpdA0KPj4+Pj4+Pj4+Pj4+PiBpcyBhIGNv bXBvbmVudCBvZiBhIG5ldHdvcmsNCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgICAgIGludGVybWVkaWFyeSBsaWtlIGEgcHJveHkgdG8gd2hpY2gNCj4+Pj4+ Pj4+Pj4+Pj4gb3JpZ2luYXRpbmcgdXNlciBhZ2VudHMgc2VuZA0KPj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgdW5zaWduZWQgcmVxdWVzdHMuICBPbmNl IHRoZSBzZW5kZXIgb2YgdGhlDQo+Pj4+Pj4+Pj4+Pj4+IG1lc3NhZ2UgaGFzIGJlZW4NCj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIFRoaXMgZG9jdW1lbnQgc3BlY2lm aWVzIGEgbWVhbnMgb2Ygc2hhcmluZw0KPj4+Pj4+Pj4+Pj4+PiBhIGNyeXB0b2dyYXBoaWMg YXNzdXJhbmNlDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAg ICBvZiBhdXRoZW50aWNpdHkgb2YgYW5kL29yIGF1dGhvcml6YXRpb24gdG8NCj4+Pj4+Pj4+ Pj4+Pj4gdXNlIGVuZC11c2VyIFNJUCBpZGVudGl0eSBpbiBhbiBpbnRlcmRvbWFpbiBvciBp bnRyYWRvbWFpbg0KPj4+IGNvbnRleHQuDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ ICAgICAgICAgICAgICAgICBJdCByZWxpZXMgb24gdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZp Y2UNCj4+Pj4+Pj4+Pj4+Pj4gY29uc3RydWN0aW5nIHRva2VucyBiYXNlZCBvbiBbLi4uXQ0K Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgVG8g bWF4aW1pemUgZW5kLXRvLWVuZCBzZWN1cml0eSwgaXQgaXMNCj4+Pj4+Pj4+Pj4+Pj4gdHlw aWNhbGx5IG9idmlvdXNseQ0KPj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgICAgcHJlZmVyYWJsZSBmb3IgZW5kLXVzZXJzIHRvIGFjcXVpcmUgdGhlaXINCj4+ Pj4+Pj4+Pj4+Pj4gb3duIGNyZWRlbnRpYWxzOyBpZiB0aGV5DQo+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBkbywgdGhlaXIgdXNlciBhZ2VudHMgY2Fu IGFjdCBhcw0KPj4+Pj4+Pj4+Pj4+PiBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlcy4gIEhvd2V2 ZXIsDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBmb3Ig c29tZSBkZXBsb3ltZW50cywgWy4uLl0NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFJlZ2FyZHMsDQo+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBBbGV4DQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICAgICAqICoNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICpB bGV4IEJvYm90ZWsqDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+ Pj4+DQo+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHN0aXIgbWFpbGluZyBsaXN0DQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+Pj4+Pj4+IDxt YWlsdG86c3RpckBpZXRmLm9yZz4gPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9zdGlyDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+Pj4+Pj4+Pj4+Pj4+IC0tDQo+ Pj4+Pj4+Pj4+Pj4+IC0NCj4+Pj4+Pj4+Pj4+Pj4gLQ0KPj4+Pj4+Pj4+Pj4+PiAtLQ0KPj4+ Pj4+Pj4+Pj4+PiAtLS0tLS0tDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgIFRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmludCBwcm9wcmlldGFyeSBpbmZvcm1h dGlvbg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBpbnRlbmRlZCBmb3IgdGhlIHNvbGUgdXNl IG9mIHRoZSByZWNpcGllbnQocykuIEFueQ0KPj4+Pj4+Pj4+Pj4+PiB1c2UgYnkNCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgb3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90 IHRoZSBpbnRlbmRlZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICByZWNpcGllbnQsIHBsZWFz ZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZQ0KPj4+Pj4+Pj4+Pj4+PiBhbGwgY29w aWVzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG9mIHRoZSBtZXNzYWdlLg0KPj4+Pj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+IF9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4+Pj4+Pj4+Pj4g c3RpciBtYWlsaW5nIGxpc3QNCj4+Pj4+Pj4+Pj4+PiBzdGlyQGlldGYub3JnIDxtYWlsdG86 c3RpckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+PiBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+Pj4+Pj4gc3Rp ciBtYWlsaW5nIGxpc3QNCj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0bzpzdGly QGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9zdGlyDQo+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+PiBfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+Pj4+IHN0aXIgbWFpbGluZyBs aXN0DQo+Pj4+Pj4+Pj4gc3RpckBpZXRmLm9yZw0KPj4+Pj4+Pj4+IGh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4+Pg0KPj4+Pj4+PiAgICBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+PiAg ICBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+PiAgICBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+ ICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4+ Pg0KPj4+Pj4+PiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPj4+Pj4+PiAgICBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+PiAgICBzdGly QGlldGYub3JnDQo+Pj4+Pj4+ICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vc3Rpcg0KPj4+Pj4+Pg0KPj4+Pj4+Pg0KPj4+Pj4+Pg0KPj4+Pj4+Pg0KPj4+Pj4+ Pg0KPj4+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+Pg0K Pj4+Pj4+PiBUaGlzIGUtbWFpbCBtYXkgY29udGFpbiBTcHJpbnQgcHJvcHJpZXRhcnkgaW5m b3JtYXRpb24gaW50ZW5kZWQNCj4+Pj4+Pj4gZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgcmVj aXBpZW50KHMpLiBBbnkgdXNlIGJ5IG90aGVycyBpcyBwcm9oaWJpdGVkLg0KPj4+Pj4+PiBJ ZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UgY29udGFjdCB0 aGUgc2VuZGVyDQo+Pj4+Pj4+IGFuZCBkZWxldGUgYWxsIGNvcGllcyBvZiB0aGUgbWVzc2Fn ZS4NCj4+Pj4+Pg0KPj4+Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQo+Pj4+Pj4gc3RpciBtYWlsaW5nIGxpc3QNCj4+Pj4+PiBzdGlyQGll dGYub3JnDQo+Pj4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9z dGlyDQo+Pj4+Pg0KPj4+Pj4NCj4+Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQo+Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4gc3Rp ckBpZXRmLm9yZw0KPj4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9zdGlyDQo+Pj4+Pg0KPj4+Pg0KPj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KPj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+PiBzdGly QGlldGYub3JnDQo+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3Rpcg0KPj4+DQo+Pj4NCj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KPj4+IHN0aXIgbWFpbGluZyBsaXN0DQo+Pj4gc3RpckBpZXRmLm9y Zw0KPj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4N Cj4NCj4NCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4NCj4gVGhpcyBl LW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIGludGVu ZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55IHVzZSBieSBv dGhlcnMgaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lw aWVudCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIGFsbCBjb3BpZXMg b2YgdGhlIG1lc3NhZ2UuDQo+DQoNCg== From nobody Tue Aug 9 10:14:54 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6F8912D093 for ; Tue, 9 Aug 2016 10:14:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jGiw4PsxKsWq for ; Tue, 9 Aug 2016 10:14:52 -0700 (PDT) Received: from qproxy1-pub.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id 28C6712B01B for ; Tue, 9 Aug 2016 10:14:52 -0700 (PDT) Received: (qmail 16909 invoked by uid 0); 9 Aug 2016 17:14:49 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by qproxy1.mail.unifiedlayer.com with SMTP; 9 Aug 2016 17:14:49 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by CMOut01 with id V59l1t00N1MNPNq0159ouS; Tue, 09 Aug 2016 11:09:48 -0600 X-Authority-Analysis: v=2.1 cv=AL9Ak13q c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=Gx3mCN22sJO7LWft-yMA:9 a=mHfF5bBJsO8XdvSO:21 a=uUrgh1U9QY5ObCKl:21 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=+8GWjZ0HIq/bWn3HVccVuxaZtg1ZEuEAcWnJkxeuiB4=; b=X3YRLEsIuthf2NFUYyLkoFoXTQ DXlV485IAjXOM00glX9+UIYlhpeE/CeDj9HDWzxGGWK9Qs8kHGuylW03ytU1rw+aduv8n/CdQdKzw E8FNzigIEj7grdb3AmUPqW7I9; Received: from [100.36.40.228] (port=52540 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bXAXC-0000pb-CF; Tue, 09 Aug 2016 11:09:46 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Tue, 09 Aug 2016 13:09:29 -0400 From: Richard Shockey To: Paul Kyzivat , Message-ID: Thread-Topic: [stir] STIR's basic operational model with SIP References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bXAXC-0000pb-CF X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.40.228]:52540 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:14:54 -0000 On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" wrote: On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and th= en can be delegated as requirements dictate. The integrity numbering plan i= s a direct and plenary responsibility of NRA=E2=80=99s period full stop. > > I=E2=80=99m less confident we will ever get to the device level..at least n= ot for the foreeable future aka my lifetime. =20 If the SPs have an incentive to *not* delegate then it will be very har= d=20 to get there. RS> Not our concern. Way beyond our scope of competence here. Don=E2=80=99t for= get the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80=99s Silver Hammer=E2=80=9D and you can be= sure they can use it if delegation or lack thereof is perceived to be anti = competitive. =20 =20 OTOH, if they have an incentive then the chances are better. =20 Brian and Paul R outlined some possible incentives to delegate. That=20 gives some hope. =20 Thanks, Paul =20 From nobody Tue Aug 9 10:36:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0397612B042 for ; Tue, 9 Aug 2016 10:36:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bt8qh1hvoAkz for ; Tue, 9 Aug 2016 10:36:52 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0125.outbound.protection.outlook.com [104.47.38.125]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6C4912D0E7 for ; Tue, 9 Aug 2016 10:36:51 -0700 (PDT) Received: from BY2FFO11FD004.protection.gbl (10.1.14.31) by BY2FFO11HUB019.protection.gbl (10.1.14.178) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Tue, 9 Aug 2016 17:36:48 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.36) smtp.mailfrom=sprint.com; brianrosen.net; dkim=none (message not signed) header.d=none;brianrosen.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.36 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.36; helo=plsapdm1.corp.sprint.com; Received: from plsapdm1.corp.sprint.com (144.230.172.36) by BY2FFO11FD004.mail.protection.outlook.com (10.1.14.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Tue, 9 Aug 2016 17:36:48 +0000 Received: from pps.filterd (plsapdm1.corp.sprint.com [127.0.0.1]) by plsapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u79HI7l1024869; Tue, 9 Aug 2016 12:36:47 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm1.corp.sprint.com with ESMTP id 24pxx4e5e3-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 09 Aug 2016 12:36:47 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 9 Aug 2016 12:36:45 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Tue, 9 Aug 2016 12:36:45 -0500 From: "Gorman, Pierce A [CTO]" To: Paul Kyzivat , Alex Bobotek , "Peterson, Jon" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7QA3LKKAAAWRJoAAAX9oAAACCpWAAABpDgAAAKK4AAAAWieAAAPgt4AAALpEgAAAy/8AAAA1f4AAAEbIAAAAZjkAAABSQQAAFBF5gAAOVnSAAAG+lwAAAytegAAAOkMAAAHCnQAAjmtqgAAD/5AAAADbMoAAAc19AAADVf2A//+dhAD//vySsKA6NsqA//+0l1AADG7kAAAKcEfQ Date: Tue, 9 Aug 2016 17:36:45 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> <0ce62665-ccb8-4668-71f4-ae59f4d7f698@alum.mit.edu> In-Reply-To: <0ce62665-ccb8-4668-71f4-ae59f4d7f698@alum.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.46] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.36; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(252514010)(377454003)(51914003)(13464003)(199003)(24454002)(43784003)(189002)(325944008)(189998001)(2171001)(3846002)(23726003)(102836003)(19580405001)(356003)(31430400001)(586003)(5001770100001)(46406003)(15975445007)(87936001)(2900100001)(2906002)(19580395003)(50466002)(6116002)(2950100001)(92566002)(97736004)(106116001)(47776003)(68736007)(50986999)(5890100001)(5250100002)(551934003)(93886004)(8936002)(8746002)(24736003)(81166006)(7846002)(86362001)(81156014)(11100500001)(305945005)(8676002)(33646002)(7696003)(106466001)(8666005)(97756001)(54356999)(108616004)(7736002)(4326007)(76176999)(7059030)(579004)(559001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB019; H:plsapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11FD004; 1:WsZLVAOOrzvfoRsAupHaAG8/CKnEL+eEQKoSANuzLxSudO8XSdB8RFHrOWcZgPZqOYC7/YpDmDs9Z1Zl8iwoEijxXDdz9beDHP7l+6X0ibSHAtPZ7GVuXp75oaCPFbL4JZIXdNhqoTR7ggmIyfwOFWhAF1IvHWJqUXEkViv8OJl1rN2SQg75uWlaQIENxgZ9wMCx/X0BJ2X7cMOZFQeEzWAwKFDrajG+Fjy+1DgsJ0EoeYFDEbR/UhJ5RU7QUhSU1CTNKmob7L/2ObEK+Ahqwg1Zvv8sEwEUgpn4jAiGDdcIiJB43WdXZXvyGRQPQOuubWCegyCf102XUz0HMYmTBRVC1C4CHevdeqg6MvaTGzVFTZiMv1vMvHPOvXDgkYVqZ+roAYfRySi/HmK+ISUcqLu8ulnLunoXkwVlM2/noMNgmFvK4hfG6CsNjSK1lQDr31nzddBTlqUo+6XEymsxM1Ds4TSe7arrgRxXQtPHLkTOZGTJi9eaMXNl5Koytv8LN8YWWEXCrk7IKMj2z9ee9+f2Rzppd+zh41+Q/ZUcZ5Gy7+R6Xuu1eCwoCKMmELZ9Anq8Q2envg/GDZXMmBUnpQ== X-MS-Office365-Filtering-Correlation-Id: 9fd14b06-a218-4ff5-734c-08d3c07bbd90 X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB019; 2:es5Pw14raveA2JpWqWx2GFg4z9LnGj7U2W3VYWI7yGz8zAyd5zvVmY1h/fnVsNUDC9eZruLFdv0vWW8pkMTW6h3CQyT+zji0dyVO7yF2+LWeV6tn+xSPr2yyogsyKCk3cQQrm17HgaTPJwq1xyZUmrEMwK56FdjkZIkUFk0JY++jg+YfXtwrqRB5gNZub+QX; 3:ecsrj2fQR182JIdxSRdOhCZEOcZRQ+hLV3+JVkMVzI8bPfyvjNCnckv48XfRKz3lfIe4E1ziwk5Ct+30rxbbnm0iTDLN6WuYqiYTEcAKW5WyFndEYyUT0Md8s5+kilhIRBcMoCRongG4tE7jNpr/963v8FyJF6pBKMWD3QkVWIuii23TBseBeKlEyi/iETO4PAe/7unALLNSpTT3uOhX4S6Wwz2Iu5n3W3tYjg93apjauKDrnCJCuNPCZnGAi9iVc+qKLT3KZ+H4uMQJ6vytFQ== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BY2FFO11HUB019; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB019; 25:JsRb6MwcfHOb4CEoc/nAJ4eikFirCF68wz6jlbzLeYXvswRbgbQPLyCDV6DuUrSh61dwi1jedVVi1QpyLm/X0K5vqVHwf++kS69LLpyuk8HbJA241J8Xx5b+E7M8J0Ua43VypgDNRu4mDYpIQcBQWMtduQoCosDBctfkEVNT02WCbUv4ly0qzeXNOPaWYNIUi63NdMD/hYFY+yZyZ4Dpw95x7M7ZEhnuCZBx6oXW0rN4y4Ll8RFaSnqAmaHGagIYXPC1ppVf0UaKJ4YmWnwtSM6wr5KTIvnDf3TprN7piO+nS7jWWCeqE5SrdleFHAiV/sLtUrh8bixA2CU1lvsLIpxyJlDEoVvkGwY0W4QaVSEIUSDEF8u4OqX3vT17CUdR0xDjA3rKWhhf/m6gwB8sXm3EH8AVsYAT87hdxszoErwIeyjSNPZsZ000MkrFqm4vCYfjwkubvNB4yLf1HlEf5L2WS1tKq4PyvqVBSTbfpUR/CHpVm+mxfc7QYYYVdQpGQmyGIdaHaNSyv0O/3GEp1tM6aTQ50a7WpLLkZ/LmsM+pu2+KXEvqdE7x5Y+0BrtCJrENPXZzpr30GIUI7d+A4s/nEpcmEvyLy63a6BzpNTLpsAwRdF7vlFKOQJMgQ16iMmzBen3uZBajJx5r3DUO2KIESgTBIT4Uh6O4B13Cnp47BhcaTeEnntd0kKyty1/RQ1uA/Kii7ZkFkc/cahEWSjRZXwiQ+ff8APspt6pzVCzoLVetIpveEJNYP7hag5+q9wU2raq/4fY/D3034HphMVGZ/hPBfkQxm6n4zbt2OvQwIJXo0qcxPyFWb9ptYm8x1v7uXJ5Kxgp9z1cdnlynjcGWiC1Rkj4mKyINtc5mCX/Z0QvXT2QcxXX1Z2jzHg1hTaFuYYsbfzYB+JooRlxDwg== X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB019; 31:Gx0ZhOqsrIoRBJ0xdvy4CdJkMFU6AR0MR5MFMrJ1gzNIA42Ue5vMq0tNpu++scpQn512PCs4DgXy52iI6vYRTF3EhhW3SZ+NyXwgL0KLgbB4sSRQHwZD231vi347SNc/hR3mf/nZJK4kRYqlwK9nXrGaIzaPty8O0kxbbXJGGK2zAptiKbG3asFBVyU1xe6q6yzOWGXl55lixvVBuG8pmdNMMgHyzhDt+p9qQjtyAfQ=; 20:GrI97WVq68nJaShklOhIq8LvnIJV489sKKKO+K2+Ean/7OSN6JYDmFlRrYZ1fhLIGKzCgTRNDZAQ+mFpBAbW4kdi0SRhXuhgz26WM1gQW4laSDQBoTcv1S2wGPRrbzPse7vEvBEKqbdW2DI+0JOHw92kUYKIOButyUUIz1uq0UBhjmoqEzC8AUZyvWNY4QfyVJ8QPiIrnDCqNAcIWDmOfSAiGWbD3cuJ6yxrpac4iRv/b1Dvqrt5lxCLINirkkcqpAqANCjhAbXegv0vTf64ckqikZCpcy/aIvPeOEgQr7IDz+3HTTh8ZFmIjdoUAl9/YP5VVNAWp+383y8idZk2wxYyBdqVyVIw4U6XERtEsokcNNp2RFnPO5ZDy5gV9lcwYdsP6g4C9tIsgRlNwQ6RWyiIyBdezDxmVdIAdkRiDiY= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(211171220733660)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040161)(601004)(2401047)(8121501046)(13018025)(13015025)(5005006)(13024025)(13023025)(13017025)(3002001)(10201501046)(6055026); SRVR:BY2FFO11HUB019; BCL:0; PCL:0; RULEID:; SRVR:BY2FFO11HUB019; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB019; 4:hBVe7T0kyHSJ2I89kW1LidfE0RFTyOgr4s0eJST4mI+jD3tLl/iqI7cxZxNGm2n9k7oJC0hdlIyRBG5HJUfDRMze3g/9AoddlovZ6rf/JvhMdQZfDCTyPYCUZz81iFsAY09zbRV+mEKLzSijwutdXwR0/0k7DDiDslNvec5eZ4rfSPp2gDIqScc3QnXc/rUdRaw5NvxkbVjWwONi+OYqOgGObdeRo2jQvIRsorI5z8N7wOKV2G3NFV2hUtdMev4zYwKapa+kPVWXFKoUlB/BSIahWaBW2UoYgAhM3JPP53INSRVHKkeMzIeA8G2pkqmzYW6g9z7FQR8fuuQTn8CbfdXU7HjfhwQFRQ22m4zUhYHH7EJTufEQ3/PGuoLbVAQmAgANXtF7VslvKYbqvfoyn2UV46qS96dvrzfNRlDk8cY0UDGWM2CqOMJqlEgLOZIqkQuPa7VPK9tp7cTAnfk9XBVF964nnnvrCn+YKW8lkzaEl++ccKC/zg1ISAa4mFG9W7i1Bw5lf4RGBrJhtisbfHXsY9S9suSjH/UJzuE78gjZqmjtDdqdRwp141nwXRkJmkC4GQCTH4jnGAChs7n3/4Xia6rZm7vSh6J8WliEGO4qha0/vsRHSbQdV2yshyYcO9LYeBnSEkTarzzzuvjKet5KrFzF5iFqU/KCZmFID1lxdUleWWt1W6CFZQMWmawwU3akJt2RRHt4SQl7JORLg9hfgIkryjxRr3QrOpOFywBygZ8FuxYuhrotgBNr3sIHTpOcYKvMgPPY0iFzrJClNQ== X-Forefront-PRVS: 0029F17A3F X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2FFO11HUB019; 23:V6wi/a3hwakZKnk06YQbtvp+6A9BjQLbZYd1orwg?= =?us-ascii?Q?X5dqnmLYkcaac753d5BxVs7/guFQg2FO/Eqt/yPZSJfbTqscEcQZif7YdJSo?= =?us-ascii?Q?gt1p7IQNqNoFmc4SQKeTN6iMxNxcRnBPKYU4eziAs4pmPnHRmlsJWFdMC9Xo?= =?us-ascii?Q?TbyFi059LsqCk8/lbRJxADHhxfJuFUEMvynFJitn09HAo0NsQtBteGCWflZv?= =?us-ascii?Q?5BbwUndRz5WcO1qaMAGZgMRfmgUTWZ04b2sSW7/a6x7KeI1j2rX4jDHvg118?= =?us-ascii?Q?6DtOnK8zOOl06VcFdT+ef2sJ9gNOWCi+dyYJcPnGZrppavQs9eo3B00jiPVi?= =?us-ascii?Q?WNtoo24tW842XXiJL3hesjVJGV07PPp4DQvtJo0IZijOJjwWeIlprcr1eM+Z?= =?us-ascii?Q?ReEsa69AoWxjgpaI89g3Yx2XfFkSxKQTMcbMW/QaVwuIXoz7Cw9FMFSjtw4/?= =?us-ascii?Q?iyIGGmccwh0Bj3lHEZ+L8ZZ33CnOBwRkFr14lq9r3nFKWhUNiudsSMNZMMgO?= =?us-ascii?Q?OV8U4J5vS/WiIK7jnKj/ZXDu9TW36Pzx6O2Mp21rR73SsdujXKG2V/xCEcpx?= =?us-ascii?Q?gH1yUpBH/uC0l3D1B9niAsiyhApTe4sjE/Yo/k9YSZC8TpEoolDQxW2GSWZD?= =?us-ascii?Q?673vzD045p8G2VeuNj6W8gBmCw7H7UEbmHTlo7ABDWd7b6oFaM2ymeX215sd?= =?us-ascii?Q?EPaTrGDY9vmE2yiwUYkLWqV9Iy5CwXyWbyHASyE8ht5c3x7hOOwQ1OAsql7V?= =?us-ascii?Q?dEEkyRoG/e+s+YvXEkmNM3DEzxdwn0cY2ACrQC1Nmx2kODN3ez6zvnZOm3pM?= =?us-ascii?Q?iFXnt4KG8Jq9HUP5wu7qSIGqOb1e5xsSzdMjzBdmvnnunqLI8ih4ofZzcp2n?= =?us-ascii?Q?e39s8tBsVbF1CeiMZBV/dt0jUAZAzBJxwKfoG4amkXgYRjA/wA4w+QiCdBNr?= =?us-ascii?Q?7mXXb7rJezcDvCmZm+4rI85VkYBIhqm2qpcS7/h9zQhFhTKcPMN91O97Rth3?= =?us-ascii?Q?Z/l8J7bO5g/Mqh6ibNQ3ImoGbXosAswuIY+udz6z43s2X1E28/IvZWWMYFFc?= =?us-ascii?Q?pFqPOBtnfWNXhSpCaMAUQUgYcLQ+FM9yp/8BaUDmkrRpka0bKET5RzOcRF4y?= =?us-ascii?Q?d41mkln7lRqzrHAmYIhszz30ZE2bR30lTEQkGh1huU/2ggjBsL3GEdTqs0xy?= =?us-ascii?Q?jQwPfZvkaMtuUtIvqUQQyTrseMG/vaTohmfu1aEWLr/9Q4w7OR30edKjON+R?= =?us-ascii?Q?2kfopbtmRbAI3iItj8dCEZ7WJbFr+Gr+zl4+60y2K+hp4aS/xSDON2fCAyFO?= =?us-ascii?Q?xDqNDk0Zl/CkWrymMaFnkyfDOPkQhVT6d2Ady3XWZkJGXa/upO4jnuScQF4L?= =?us-ascii?Q?XLtO+ZvjaU6dO5FdZ12enqtEOzUUqnKzgDNGd7VA00sg/wvxvga/fkMNoxQG?= =?us-ascii?Q?saMufrrVG9HEz3AOOo00BI70Vw5Q1eFGJsbjl0qM6EDRyIRHjNRLkMYspjc4?= =?us-ascii?Q?ct/z+VrOhLXo/qyteoI5sI7hVgkcoCJi5JbDFzWQGUlsgoy7/sDrZ6PIJ5WT?= =?us-ascii?Q?gGMztKi5sx8ROmgCKfAON30NCxHb3gVC9af5sk8=3D?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB019; 6:UlCVzkinZm7pXzjYyP3GcJE/Gc7wanIEY+wge9kLb3BkF6xNUI1VIkPjgM5wPibZKo1+ZMvXaJKI5rbw3zHjM7wJ+9Hl5KEC8IuI7b7Z0aMMkXDZoGXfAqT6ydzuVtGeV5jGghnHDjfbrLeCRuCub+AsoKHdmPMRVUensNd5J1KzinVfEUvorTuo2eZj/gESfSSqWE2tzJkDsVzYBQLYIVMHH8Fz66rN0j56Of13/vkkY15GhoP/Rjepq2AkrLvcRLnh70pFMOxvOXJbfMrtvatbBNrTeGeCQcJa3F5UOSfc/lR8ZWLl5HRc9QKs6rVWXgY0VmOFB40AJElXEYZu5A==; 5:oBE6+vbTQPuvwrSAHzY+HH+YZ7YguA6kT/qP71VE+ig7rsCt1Pryh2hfYaRIHGaKRgOr2aQV76b1g4h+zBOPUhqqxWT9Z7PBRsa08v770I4bqwWjh111BM1XrTXfrYUCkEk5S9KYUoZzVq6tQeF0uQ==; 24:S0kN2GU/9JxTxnyg7Vdq/JWpzcwhI9XQOtog4XHZffDo4D7ayWNEa0ziObXTk+KWf2421sAUwrfOX8Kj3CiJC//LyhWXttGsUVJbP0Qazdc=; 7:s/J4/nWHj0qEyC/7wCvtyXqaSXAWihS5Ye/0JzKZtiwZy8S3U1moLWo3yzc+JE38jwffuOQrUZZJA5YUlpFaGlr7cppFipwbqGNrFo66nJC8EycEvP4uins5j1oXJc9lJ/KJPSrSfic0JQ+fV0/mm943ds2AoD3Xk6BnWy3qG0AIFAaEi7CTlb4hivcSBBlAuyGHhAaqaSV5E1kGkAS+WTfuRAgXZXqWVEdHqVhfMHZAjLc2XdYNnbBUYhQYiZg9 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2016 17:36:48.1214 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.36]; Helo=[plsapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2FFO11HUB019 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:36:57 -0000 I did. Similar is a weasel word too isn't it? " This is similar to the issue of liability for fraudulent credit card=20 charges. Retailers sometimes accept a card without a signature, because=20 it makes customers happy and speeds transactions. But in doing so they=20 accept the responsibility for the charge if the transaction turns out to=20 be fraudulent." It's not at all the same. The retailer is liable for eating the cost of th= at which they thought they sold. Instead, applying the logic of making the= operator liable for calling number verification is the same as asking the = retailer to be liable for the fraud committed by the criminal. Let's not forget that a criminal can get a phone that is authenticated to t= he network and whose calling numbers is signed, either by the operator, or = by the SIP stack on the phone, and still commit crime. If you want the operators to eat the cost of transporting and processing th= e phone call where the originating number was fraudulently provided, I'm pr= etty sure it will fail in court, but it probably wouldn't be very offensive= to operators. What I think you're asking for is operators to be police, both detectives a= nd traffic cops, and to be liable (sounds eerily like other current events)= .=20 Pierce -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu]=20 Sent: August 09, 2016 12:11 PM To: Gorman, Pierce A [CTO] ; Alex Bobotek ; Peterson, Jon ; Dwight, Timothy M (T= im) ; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Richard Sho= ckey ; stir@ietf.org; Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments See the reply I just sent to Alex. On 8/9/16 1:04 PM, Gorman, Pierce A [CTO] wrote: > " If you sign the message you are taking responsibility for the assertion= that it is from NNN. If you choose to do so without knowing who it is from= then that is your problem." > > Paul, > > Following this standard of liability, every ISP should be forced to sign = IP packets and be liable for hacking attempts which originate on their IP n= etworks. > > Just as reverse unicast path forwarding is not often (ever?) used in the = Internet backbone or ISP networks to ensure IP packets don't come from netw= orks they can't have originated from, neither do all telephone networks "ch= eck" each originating telephone number to determine whether they should hav= e been able to originate from a particular carrier or enterprise and for th= e same reasons - it is difficult, imperfect, and expensive. Just as it is = with the Internet backbone, it's actually reasonably challenging just deliv= ering the calls (or IP packets) to the number that it is addressed to, with= out also having to also worry about where it supposedly came from. > > I'm telling you we can differentiate the trustworthy-ness (like Stephen C= olbert's "truth-iness") of calls. We can tell if a call originated from a = subscriber using a device which has to authenticate to the network before i= t's permitted to place calls (except manual roaming and some E911 calls). = And we can tell if a call originated (or was subjected to mid-call 3rd part= y call control from an enterprise or mobile virtual network operator partne= r for example) and is therefore not as trustworthy as the directly-connecte= d and authenticated mobile subscriber (for example). We can pass that rela= tive trustworthiness information along in signaling and it can be used to u= sefully differentiate treatment, ultimately, by the consumer. > > What you want is that the calling number is always, universally, only eve= r trustworthy. My opinion is that is unrealistic and unreasonable. > > Pierce > > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 09, 2016 10:44 AM > To: Alex Bobotek ; Peterson, Jon ; Gorman, Pierce A [CTO] ; Dwight, Timothy M = (Tim) ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; Richard S= hockey ; stir@ietf.org; Brian Rosen > Subject: Re: [stir] STIR 4474bis-10 comments > > On 8/9/16 5:03 AM, Alex Bobotek wrote: >> Jon, >> >> Thanks much for your thoughtful response to the original points. Yes, t= hings got somewhat sidetracked. >> >> On the first point (signing without authentication), I do not read 6.1 >> as permitting "I'm signing to assert that I've authorized use of this >> phone number without authenticating the caller and/or completing a >> number delegation authority check", > > I'm not sure I understand. Is this the assertion you are asking for? > > "I (Acme Corp), having administrative authority over number NNN, certify = that this message is "from" NNN, though I have no idea who actually origina= ted this message." > > This is a good thing??? > > If you sign the message you are taking responsibility for the assertion t= hat it is from NNN. If you choose to do so without knowing who it is from t= hen that is your problem. You should be legally liable. At the very least y= our reputation as a signer should be diminished as fraudulent calls you hav= e signed are detected. Eventually you will be put on blacklists as an untru= stworthy signer. > > I guess we could speed the blacklisting by allowing signers to pre-declar= e that they are untrustworthy. (That seems to be what you are asking for.) > >> a use case that reflects the currently-widespread practice of authorizat= ion without authentication. > > No wonder we have a problem with spoofed calls. > > Thanks, > Paul > >> My read of section 6.1 is that it allows anonymity rather than signer-at= tribution with unauthenticated (non-anonymous) caller identity. Knowing th= e triple of purported calling phone number that flashes on a recipient's ph= one, the terminating phone number and a timestamp is important in reporting= /tracing/mitigating abusive calls. [On a side note, I reread Section 11, b= ut had trouble with the definition of "private URI" (note: "private URI" a= nd "private SIP URI" each occur exactly once each in the doc and could bene= fit from a definition or two).] Additionally, Brian Rosen's comment on 8/= 4 seems to corroborate my reading of a ban on authorization without authent= ication in the non-anonymous case (i.e., that using someone else's phone nu= mber requires that "the entity that is assigned the TN explicitly authorize= s calls placed using it's TN"). >> >> In summary, there is a high value in allowing signing/authorization in t= he categories and use cases Pierce outlined. In my operational experience,= it really helps to know which company to contact to get the callers kicked= off a network. And signer attribution even without caller authentication = is a huge win for the public. >> >> >> >> On the second point, thanks for pointing out that 12.1 requires servers = to keep the state of recently received requests. This is a point that I mi= ssed in my reading of the draft, and this feature as you have described it = defeats most conceivable replay attacks. My bad for missing this, but as y= ou suggest, there may be some potential for emphasizing this point. But th= ere's another part of the issue -- cross method replay. For example, it ma= y be difficult to expect a messaging node (which handles SIP MESSAGE) and a= voice-capable IMS node (handling SIP INVITE) to coordinate their anti-repl= ay caches, allowing an attacker that observes a SIP invite for a voice call= to piggyback a spam text message. As it's common to use the same "To" add= ress for multiple services that may be served by very different infrastruct= ure components, it would be beneficial to allow signatures to cover more th= an "To", "From/PAI" and "Timestamp". I do not see this issue as meriting = significant delay of a STIR RFC if there's no quick fix. >> >> Regards, >> >> Alex >> >>> -----Original Message----- >>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon >>> Sent: Monday, August 8, 2016 12:46 PM >>> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >>> ; Dwight, Timothy M (Tim) >>> ; DOLLY, MARTIN C >>> Cc: Rosbotham, Paul, Vodafone UK ; >>> Richard Shockey ; stir@ietf.org; Brian Rosen >>> >>> Subject: Re: [stir] STIR 4474bis-10 comments >>> >>> >>> Just so I'm clear, I'm not hearing an ask here in terms of changing >>> the text of rfc4474bis-10, which does allow signing PAI instead of >>> From for precisely the reasons outlined in this lengthy thread. To >>> Alex's original point about providing authorization without >>> authentication, rfc4474bis has a lot of text about signing non-TN >>> identifiers, including for preserving anonymity; see the end of >>> section 6.1, and then the Privacy Considerations in section 11 for >>> more. Those should suffice to provide this property: it will identify t= he service provider who signed without attesting an specific user identity. >>> >>> I also wanted to make sure we didn't drop the other ball that Alex >>> mentioned at the start of this thread, which is the issue of >>> proximate replay within the 60 second Date window. This is addressed >>> in Section 12.1 of rfc4474bis-10, which >>> reads: "Note that per baseline [RFC3261] behavior, servers keep state >>> of recently received requests, and thus if an Identity header is >>> replayed by an attacker within the Date interval, verifiers can >>> detect that it is spoofed because a message with an identical Date >>> from the same source had recently been received." This refers to the >>> text of >>> RFC3261 section 23.4.2, though more properly the Date-related >>> behavior is better detailed in RFC3893 Section 10, which introduced >>> the first version of the partial signature mechanism that ultimately >>> inspired RFC4474. I'll update the text here so it is clearer about exac= tly how to detect proximate replay. >>> >>> Jon Peterson >>> Neustar, Inc. >>> >>> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >>> wrote: >>> >>>> Paul, >>>> >>>> As you know, SIP inter-working is often challenging because of >>>> variability in implementation including proprietary headers (without >>>> an >>>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>>> stripping things like display name in From but that's another story). >>>> I could argue that from a cleanliness of protocol implementation, >>>> (and if I wanted to be pedantic), I would strip PAI outbound unless >>>> required otherwise. But the point is moot. As I mentioned in the >>>> earlier e-mail, that is not our practice and I'm not requesting it to = be so. >>>> >>>> Pierce >>>> >>>> >>>> -----Original Message----- >>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>> Sent: August 08, 2016 12:03 PM >>>> To: Gorman, Pierce A [CTO] ; Dwight, >>> Timothy >>>> M >>>> (Tim) ; DOLLY, MARTIN C >>> >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>> Richard >>>> Shockey ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>>> Thanks for the added comments Tim. >>>>> >>>>> I agree that passing P-Asserted-Identity between trusted networks >>>>> is appropriate (and the converse is true as well). Part of my >>>>> issue is I have been conditioned from the very earliest >>>>> implementation of Sprint's VoIP network that other carriers' IP >>>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>>> and even there I find language that implies trust is established by >>>>> agreement, not by standard. (Even roaming implies agreement.) >>>> >>>> I understand why *some* stuff needs to be removed when forwarding to >>> an >>>> untrusted party. For instance, if the call has requested privacy, >>>> then P-A-ID needs to be removed. >>>> >>>> But when privacy is not a concern, trust is really more of a concern >>>> on the ingress side, not egress. If I don't trust you then I won't >>>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>>> trust you, but you don't trust me, then what is the downside for >>>> passing along the P-A-ID? >>>> >>>> Thanks, >>>> Paul >>>> >>>>> Regardless, this discussion has been helpful and educational (to me >>>>> at least). And, I confirmed with my operations counterpart we >>>>> generally send PAI today. I've also made note that where standards >>>>> and >>> ICA >>>>> require it, we will include PAI. Thanks again. >>>>> >>>>> Best regards, >>>>> >>>>> Pierce >>>>> >>>>> -----Original Message----- >>>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>>> Sent: August 08, 2016 10:47 AM >>>>> To: Gorman, Pierce A [CTO] ; DOLLY, >>> MARTIN >>>>> C >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>>> Richard Shockey ; Paul Kyzivat >>>>> ; stir@ietf.org; Brian Rosen >>>>> >>>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>>> >>>>> Pierce, >>>>> >>>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >>> GSMA >>>>> IR.95. The latter references and profiles the former. Section >>>>> 4.4.1 of >>>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>>> considered trusted, and table 3 in that section recommends that >>>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>>> It also states that PAI is mandatory at a roaming NNI. >>>>> >>>>> Tim >>>>> >>>>> >>>>> -----Original Message----- >>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>>> Pierce A [CTO] >>>>> Sent: Monday, August 08, 2016 8:52 AM >>>>> To: DOLLY, MARTIN C >>>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>>> stir@ietf.org; Brian Rosen >>>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>>> >>>>> Martin, >>>>> >>>>> You referenced TS 29.195. I'm not familiar with that spec. Has it >>>>> been deprecated? It's not showing up on the 3GPP site. >>>>> >>>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the >>>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>>> header when interworking with untrusted networks." >>>>> >>>>> Your remark is consistent with Note 4, but only if we agree that, >>>>> for instance, the AT&T network and the Sprint network are "trusted >>>>> networks". In reality, this is not the case or there would be no >>>>> firewalls or Session Border Controllers used for interworking and >>>>> security. My opinion is the only carrier networks that are trusted >>>>> are the SS7 network, and the Internet backbone. >>>>> >>>>> What it really comes down to is that PAI is left in signaling >>>>> either through formal specification as a part of an inter-carrier >>>>> inter-connection agreement, or by custom (or even by accident). I >>>>> think this illustrates Paul Rosbotham's observation is true. >>>>> >>>>> Pierce >>>>> >>>>> -----Original Message----- >>>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>>> Sent: August 05, 2016 12:55 PM >>>>> To: Gorman, Pierce A [CTO] >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>> Brian >>>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>>> ; Richard Shockey >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>> >>>>> PAI is not stripped at the network boundary between trusted >>>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>>> ITU And the list goes on >>>>> >>>>> Martin C Dolly >>>>> Lead Member of Technical Staff >>>>> Core & Government/Regulatory Standards AT&T >>>>> Cell: 609-903-3360 >>>>> Email: md3135@att.com >>>>> >>>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>>> wrote: >>>>>> >>>>>> Which header the carrier chooses to display is moot if the header >>>>>> is stripped between carriers as per at least one standard. I >>>>>> think Paul Rosbotham's observation we're likely to encounter "some >>>>>> interesting interworking challenges" was perhaps the understatement = of the year. >>>>>> >>>>>> Pierce >>>>>> >>>>>> -----Original Message----- >>>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>>> Sent: August 05, 2016 11:58 AM >>>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>>> ; Brian Rosen >>>>>> Cc: stir@ietf.org >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> If PAI is present and signed, and From is also signed, I would >>>>>> expect it to be up to the UA to decide what to display, not the carr= ier. >>>>>> >>>>>> Of course this will work differently if there is a different >>>>>> signaling regime between the carrier and the user device (e.g. >>>>>> black >>> phone). >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>>> controller functions and is not to be used in inter-carrier >>>>>>> inter-connection (although it commonly shows up anyway). My opinio= n is the "From" >>>>>>> header is likely used more often for presentation. >>>>>>> >>>>>>> Pierce >>>>>>> >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>>> Sent: August 05, 2016 9:37 AM >>>>>>> To: Rosbotham, Paul, Vodafone UK >>> ; >>>>>>> Paul Kyzivat ; Brian Rosen >>>>>>> >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>> >>>>>>> >>>>>>> Humm this is getting interesting. Its my understanding that the >>>>>>> display number aka "presentation number" in the US context is the >>>>>>> one carried in the PAI. Martin, Pierce? >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK= " >>>>>>> >>> wrote: >>>>>>> >>>>>>> Jumping in now that we're on European working time, +1 on >>>>>>> Paul's observation. >>>>>>> >>>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>>> IDs....one (we term the Network Number, carried in PAID) uniquely >>>>>>> identifies the line, the other (we term Presentation Number, >>>>>>> carried in From) is used for display purposes. >>>>>>> >>>>>>> Only the carrier has the authority to set the Network Number >>>>>>> so only they could sign it. >>>>>>> >>>>>>> But - subject to regulatory restrictions which are well >>>>>>> documented >>>>>>> - the number sent for display purposes belongs to the customer. >>>>>>> For blue-chip customers, I can allow them to send their >>>>>>> Presentation Numbers into the network, and can't readily check at >>>>>>> a network level that they're theirs (I do have contractual >>>>>>> safeguards). The number may have been allocated by me, or could >>>>>>> be allocated by a third party provider. If it's a call-centre >>>>>>> they'll be making outbound calls for lots of different customers >>>>>>> which will change on day-by-day >>> basis. >>>>>>> This is business as usual. I don't like the term "authorised >>>>>>> spoofing" because it implies that the CLI is in some way being rigg= ed: >>>>>>> it's not, it's the corporate customer or their subcontractor >>>>>>> using the number that's been assigned (so in internet terms >>>>>>> delegated) to them via a chain of trust from the regulator. >>>>>>> >>>>>>> What I want is the ability for customers to use their >>>>>>> credentials to sign the CLIs they send me so that at the >>>>>>> terminating end it can be checked (or indeed somewhere en-route >>>>>>> if that's the business model). >>>>>>> I can and would sign for customers on my mobile business since >>>>>>> I'm driving what number is presented, but that's by-the-by >>>>>>> because they aren't the ones who generate millions of nuisance >>>>>>> calls. If the signing only occurs at the originating carrier >>>>>>> level for corporate/call-centre customers that's no use because >>>>>>> I'm not in a position to do that for these type of >>>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>>> also highlight there are many more of my large customers that I'd >>>>>>> trust more than a far end originating carrier that could be >>>>>>> anywhere in the world (though we have no shortage of small >>>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>>> UK....) >>>>>>> >>>>>>> Regards >>>>>>> >>>>>>> Paul >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzi= vat >>>>>>> Sent: 04 August 2016 23:12 >>>>>>> To: Brian Rosen >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>> >>>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>>> delegated the TN, it's being authorized to place calls that are >>>>>>>> not >>>>>>> >from that TN, but appear to be. >>>>>>>> >>>>>>>> The mechanism to handle the credential is exactly the same as a >>>>>>>> delegation, so if you want to call it delegation, go ahead, but >>>>>>>> I prefer to call it authorized spoofing. >>>>>>> >>>>>>> IIUC the delegation is to a responsible entity (something that >>>>>>> can be held legally accountable - e.g. a person), not to a device. >>>>>>> The entity can then "use" the credential via any device(s) it >>>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>>> two-line >>> phone. >>>>>>> >>>>>>> Thanks, >>>>>>> Paul >>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>>> >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>>> phone as calling party. >>>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>>> carrier to him. He then creates another credential, which he >>>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>>> (because the call is coming from his mobile's TN but claims to >>>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>>> could give the credential to his mobile SP if they sign on his b= ehalf. >>>>>>>>> >>>>>>>>> I don't understand how that is different from regular delegation. >>>>>>>>> >>>>>>>>> When his landline carrier gave him a delegated certificate for >>>>>>>>> his landline number, he should be able to install that in >>>>>>>>> whatever devices he wants - his landline UA, his mobile phone, >>>>>>>>> etc. It is still delegated from his landline carrier, even when >>>>>>>>> used with calls via his mobile carrier. >>>>>>>>> >>>>>>>>> Thanks, >>>>>>>>> Paul >>>>>>>>> >>>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>>> legitimate use. >>>>>>>>>> >>>>>>>>>> But that's how I describe it. >>>>>>>>>> >>>>>>>>>> Brian >>>>>>>>>> >>>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>>> > wrote: >>>>>>>>>>> >>>>>>>>>>> +1, but with one question below: >>>>>>>>>>> >>>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>>> delegation path, >>>>>>>>>>> >>>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>>> authorized spoofers. >>>>>>>>>>> >>>>>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>>>>> contrasted to "spoofers" who have been delegated their >>> authority. >>>>>>>>>>> >>>>>>>>>>> Thanks, >>>>>>>>>>> Paul >>>>>>>>>>> >>>>>>>>>>>> I don't think it matters who the delegator or delegatee are >>>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>>> delegated to, so authorities can follow the delegation path. >>>>>>>>>>>> There are plenty of certificated carriers who are willing to >>>>>>>>>>>> not care who they delegate to. The fact that there are some >>>>>>>>>>>> who do doesn't change much. >>>>>>>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>>> >>>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>>> been delegated. >>>>>>>>>>>> If it does, it's asserting that the calls are from who they >>>>>>>>>>>> are supposed to be from. >>>>>>>>>>>> That should be straightforward, but we know it's not always, >>>>>>>>>>>> and that represents the hard part of deployment in my opinion. >>>>>>>>>>>> But once they delegate, they can hand responsibility to sign >>>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>>> they are delegating to. >>>>>>>>>>>> >>>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>>> we get into >>>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>>> which we don't. >>>>>>>>>>>> Our model is that you know who you delegate to, and once you >>>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>>> some business practices. >>>>>>>>>>>> >>>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>>> >>>>>>>>>>>> Brian >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >> >>>>>>>>>>>>> > >>>>>>>>>>>>> wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>>> policy and use cases. >>>>>>>>>>>>> >>>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed >>>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>>> >>>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>>> >>>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>>> my reason for suggesting a way to qualify the signature to >>>>>>>>>>>>> reflect that variability. >>>>>>>>>>>>> >>>>>>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>>> numbers, and can qualify to some degree the trustworthiness >>>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>>> >>>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>>> most-authenticated. There can be >>> more >>>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>>> complexity (both for the carriers and the consumers) and I >>>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>>> >>>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and fraud= . >>>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>>> mobile consumers where their carriers are able to usefully >>>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>>> >>>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>>> (revoked, not >>>>>>>>>>>>> revoked) for authenticating calling number will not work well= . >>>>>>>>>>>>> >>>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>>> well, if the calling party has to sign a call with a per-TN >>>>>>>>>>>>> cert provided by the called party. No called party cert to i= nclude? >>>>>>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>>> >>>>>>>>>>>>> Pierce >>>>>>>>>>>>> >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>> >>>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>>> policy issue. >>>>>>>>>>>>> >>>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>>> design of stir, and the design allows delegation of one TN >>>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>>> NAM phone could have >>> more >>>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>>> mobile phone may also have a credential for, say, a TN that >>>>>>>>>>>>> is delegated to a landline, to cover the example case of a >>>>>>>>>>>>> doctor placing a call on his mobile, but getting his office >>>>>>>>>>>>> number to show up as the calling party. Use of such mechanis= ms is policy. >>>>>>>>>>>>> >>>>>>>>>>>>> Brian >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >> >>>>>>>>>>>>> > >>>>>>>>>>>>> wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. >>>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>>> >>>>>>>>>>>>> Pierce >>>>>>>>>>>>> >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>> >>>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>>> phones and any other devices that can be programmed to do >>> so. >>>>>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign >>>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>>> >>>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>>> will want to get out of the liability of signing on behalf >>>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>>> so. That means the devices have to be able to sign, but I >>>>>>>>>>>>> understand many of the PBX vendors think that's something >>>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>>> >>>>>>>>>>>>> Brian >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >>>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>>> >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>> >>>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>>> signature, >>>>>>>>>>>>> but the service provider can do that. It should not add= a >>>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>>> assign to >>>>>>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>>> "authorized >>>>>>>>>>>>> spoofing". The companion devices I'm aware of always se= nd >>>>>>>>>>>>> calls from the same service provider and should not pres= ent >>>>>>>>>>>>> any issue. >>>>>>>>>>>>> >>>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>>> implement >>>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>>> >>>>>>>>>>>>> Brian >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> > wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>>> where a >>>>>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>>>> way of >>>>>>>>>>>>> knowing whether the calling number is properly assig= ned >>>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>>> >from an >>>>>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>>> And in >>>>>>>>>>>>> the consumer market, there are calling products whic= h >>>>>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>>>> devices >>>>>>>>>>>>> (e.g., tablets) which can place a call using the MDN= of >>>>>>>>>>>>> the parent subscriber. These are examples of where = the >>>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>>> necessarily mean >>>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>>> a single >>>>>>>>>>>>> subscriber with a single MDN regardless of "laxity" = of >>>>>>>>>>>>> spoof checking. >>>>>>>>>>>>> >>>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>>>>>> specificity of authenticity, and calling number. Th= is >>>>>>>>>>>>> provides the identity of the originating carrier, so= me >>>>>>>>>>>>> idea as to the accuracy or specificity of the callin= g >>>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>>> (assuming nonce >>>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>>> suggested >>>>>>>>>>>>> below by Alex). >>>>>>>>>>>>> >>>>>>>>>>>>> The representation of orig-carrier and trustworthine= ss >>>>>>>>>>>>> could be as follows: >>>>>>>>>>>>> >>>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>>> >>>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switche= d >>>>>>>>>>>>> networks that don't natively support SIP or which do= n't >>>>>>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>>> >>>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>>> roaming >>>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>> entirely >>>>>>>>>>>>> untrustworthy >>>>>>>>>>>>> >>>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>>> OCN, but >>>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>> less than >>>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>>> >>>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>>> calls from >>>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>>>>>> trustworthy >>>>>>>>>>>>> >>>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>>> >>>>>>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>>>>>> available authentication services resources. e.g., >>>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>>> cetera. >>>>>>>>>>>>> Could/would pass credentials down to SIP-aware devic= es >>>>>>>>>>>>> which would process them according to the rules of t= he >>>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>>> >>>>>>>>>>>>> Pierce >>>>>>>>>>>>> >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>>> >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>> >>>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>>> placing a >>>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>>> telephone >>>>>>>>>>>>> number used in From/PAI, and in such circumstances t= he >>>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>>> call may >>>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>>> serving the >>>>>>>>>>>>> entity that is assigned the TN. In all such cases, = the >>>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>>> authorizes calls >>>>>>>>>>>>> placed using it's TN. The design accommodates such = use >>>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>>> authentication. We're not aware of any cases where >>>>>>>>>>>>> there >>>>>>>>>>>>> is an actual requirement for legitimate calling with= out >>>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>>> although >>>>>>>>>>>>> we certainly are aware that various parts of various >>>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>>> point, at >>>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>>> that the >>>>>>>>>>>>> laxity of allowing unchecked spoofing is not accepta= ble >>>>>>>>>>>>> any more. >>>>>>>>>>>>> >>>>>>>>>>>>> Brian >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>> > wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>>> authentication >>>>>>>>>>>>> In the current telephony network practice, some >>>>>>>>>>>>> service provider implementations choose not to >>>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>>> the use >>>>>>>>>>>>> of an arbitrary or selected user-provided identi= ty. >>>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>>> anyone >>>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>>> industry >>>>>>>>>>>>> reasonably expect to end this (often bad) practi= ce? >>>>>>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>>> prevalence >>>>>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>>>>> sometimes-anonymous abuser, it becomes criticall= y >>>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>>> closest >>>>>>>>>>>>> to the abuser. Based on the assumption that it'= s >>>>>>>>>>>>> better to ID service providers than unreasonably >>>>>>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>>>> should >>>>>>>>>>>>> support authorization without authentication. T= he >>>>>>>>>>>>> practice of authorizing unauthenticated use exis= ts, >>>>>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>>>>> (service provider identification). The language= of >>>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>>> should NOT >>>>>>>>>>>>> require or assume that that authentication will >>>>>>>>>>>>> precede authorization. Of course there may be ot= her >>>>>>>>>>>>> use cases where signing includes authentication = and >>>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>>> authorization. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>>> with this >>>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>>> within >>>>>>>>>>>>> 60 >>>>>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>>>> legal >>>>>>>>>>>>> and subject to replay in many cases. An SDP bod= y's >>>>>>>>>>>>> mky may not be present and if present its use is >>>>>>>>>>>>> optional. Some sort of mandatory new or existin= g >>>>>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>>>> Call-ID >>>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>>> receiving end >>>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>>> (e.g., >>>>>>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>>> difficulties >>>>>>>>>>>>> with 'it's been used already' coordination allow= a >>>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>>> This might >>>>>>>>>>>>> include an mkey from a captured INVITE. So it >>>>>>>>>>>>> may be >>>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>>>> using a >>>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>>> distributed >>>>>>>>>>>>> implementations may make the enforcement difficu= lt, >>>>>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>>>> method >>>>>>>>>>>>> and possibly a numeric ID. Some sort of '1-use= ' >>>>>>>>>>>>> practice should at least be discussed while perh= aps >>>>>>>>>>>>> not required. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> NITS >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>>> >>>>>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>>>>> present, then the >>>>>>>>>>>>> >>>>>>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>>>>>> parameter value is >>>>>>>>>>>>> >>>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>>> >>>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>>> parameter value is present, >>>>>>>>>>>>> >>>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>>> including the variations >>>>>>>>>>>>> >>>>>>>>>>>>> described in Step 5. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> 3 >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>> 447 >>>>>>>>>>>>> 4bi >>>>>>>>>>>>> s-10%20- >>> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>>> Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >>> 3>. >>>>>>>>>>>>> Background >>>>>>>>>>>>> >>>>>>>>>>>>> [...] >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>>> ], problems such as >>>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>>> >>>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>>> >>>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>>> applications and services >>>>>>>>>>>>> >>>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>>> >>>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>>> >>>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>>> requests. An >>>>>>>>>>>>> >>>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>>> either as part of a user >>>>>>>>>>>>> >>>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>>> is a component of a network >>>>>>>>>>>>> >>>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>>> originating user agents send >>>>>>>>>>>>> >>>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>>> message has been >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>>> >>>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain >>> context. >>>>>>>>>>>>> >>>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>>> typically obviously >>>>>>>>>>>>> >>>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>>> own credentials; if they >>>>>>>>>>>>> >>>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>>> authentication services. However, >>>>>>>>>>>>> >>>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> >>>>>>>>>>>>> Alex >>>>>>>>>>>>> * * >>>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>> _______________________________________________ >>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> ----------------------------------------------------------- >>>>>>>>>>>>> -- >>>>>>>>>>>>> - >>>>>>>>>>>>> - >>>>>>>>>>>>> -- >>>>>>>>>>>>> ------- >>>>>>>>>>>>> >>>>>>>>>>>>> This e-mail may contain Sprint proprietary informati= on >>>>>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>>>> use by >>>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>>> all copies >>>>>>>>>>>>> of the message. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>> >>>>>>>>>>> _______________________________________________ >>>>>>>>>>> stir mailing list >>>>>>>>>>> stir@ietf.org >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> ________________________________ >>>>>>> >>>>>>> This e-mail may contain Sprint proprietary information intended >>>>>>> for the sole use of the recipient(s). Any use by others is prohibit= ed. >>>>>>> If you are not the intended recipient, please contact the sender >>>>>>> and delete all copies of the message. >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>> >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> > > > ________________________________ > > This e-mail may contain Sprint proprietary information intended for the s= ole use of the recipient(s). Any use by others is prohibited. If you are no= t the intended recipient, please contact the sender and delete all copies o= f the message. > From nobody Tue Aug 9 10:44:17 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82EC612D0AF for ; Tue, 9 Aug 2016 10:44:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oKHz8M65P7ZR for ; Tue, 9 Aug 2016 10:44:12 -0700 (PDT) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AC4112D0A5 for ; Tue, 9 Aug 2016 10:44:11 -0700 (PDT) Received: by mail-qk0-x22f.google.com with SMTP id l2so19991099qkf.3 for ; Tue, 09 Aug 2016 10:44:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UCQVKEI7IKtv/JAYV1iDOodsXQf6c6N6qf65ABd7E1w=; b=2AxTeHaQ77iWHbVL0FFGk1YEIbb4UJaEm9DldHqd6d8cU7EhINjnKpolBRqIQ6eLa3 eRqOqDg6m1ppjPLt2y6x3VaLYgfdYjCNXzZVSzqHhGuUgIqD6UOTIBvb60zf/k+FifRf 1xI7bAA3xlxJ4HtrMl0UsKgsUoY45aZT/lMXmTFvuNQN/LNdhSyCgsnKVsgGUVTq8Pnn Kdwtpo81BXPZAcqilF+rMSLD1iWGEKlqbZoMKSzbulOz3plwUhK22ifbkHmyBkrytnId juKlewkLFauTH+OManf+mdN5UOYOqMjYgUODh2CxFz7ij5jjXIP/giBnoP8OFZ4aVk3Q tVRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UCQVKEI7IKtv/JAYV1iDOodsXQf6c6N6qf65ABd7E1w=; b=hKeTJljwoa3OxyDnJwoQTb2gIxSSE4m6UDPGe1XIBqomZQgQwztTUAqVkp2/hyfeBg sDp2eFp4YzsRw1Y2i72WMJiN5xY7299au1OhRqFY37UPdRsMdcwZMWn3vkTpcoyo0pgo hDZd3cv41WNYcyCdzkV+1sYcJrKLnkIK0Z5sieR9OqhtMQSqD/XVlDm8M7IOkTdRwdiM 3/+sewWXl9I5a3/npHMOZCkSooJ+u/vzxY9qX3dsb/NtfoxOJfTWoiTShaTsDG++T6Jc 4GyYzxMJ41n9m/iehwCgfeaIqQkaFv8EqLjD1hldwhao0J7WoY8qoy0U0XlirWy8+M4a kMQw== X-Gm-Message-State: AEkoous1YxG0KGyuvigbH43/lI2cdGmuRJAJDrLpDYHwnDT9av8Wvhw8uu34NW9D+MKjpA== X-Received: by 10.55.73.145 with SMTP id w139mr34142849qka.37.1470764650374; Tue, 09 Aug 2016 10:44:10 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id u44sm21030605qtc.27.2016.08.09.10.44.08 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 09 Aug 2016 10:44:09 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> Date: Tue, 9 Aug 2016 13:44:03 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "Peterson, Jon" , "Rosbotham, Paul, Vodafone UK" , "DOLLY, MARTIN C" , Paul Kyzivat , Richard Shockey , "stir@ietf.org" , Alex Bobotek , "Dwight, Timothy M \(Tim\)" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:44:15 -0000 To get rid of the scourge of robocalling, service providers will have to = check to make sure the calling party number is delegated to the = subscriber, or delegate them credentials so they can sign. That is not current practice, but current practice will need to change. Where you aren=E2=80=99t doing it because, well, just because, you will = need to. That=E2=80=99s the actual change, Signing is the mechanics, = but the change is checking.=20 Where you are already just asserting PAI, without regard to what is in = From, you are good. It=E2=80=99s when you blindly accept =46rom and = copy to PAI that you have a problem, If you are accepting PAI, then = whomever is asserting it needs to sign. Where there is a reason, like the call center, an extra delegation will = be required, and probably you will be looking to the call center to sign = calls that are coming over your network, but are being placed by the = call center on behalf of someone not on your network. Where you are a transit network, you will need to push signing = responsibility to your transit customer. It would be good to be able to push the problem to your = subscriber/customer, but that won=E2=80=99t work for a while unless they = are a service provider (where you need to make them responsible for = signing, because you don=E2=80=99t know their customers). The bigger, = and more complex the subscriber=E2=80=99s connection to your network, = the more you are incentivised to push the problem down. Things that = just work now (like a multi-location enterprise least cost routing = outbound calls through several networks) may no longer work unless they = do the signing. Most of the larger PBX vendors know about stir and are = planning to support it. =E2=80=9CWhen" is always the issue, and the = more we make the consequences of stir deployment known to service = providers, enterprises and regulators, the quicker we=E2=80=99ll get the = vendors to respond. Brian > On Aug 9, 2016, at 1:04 PM, Gorman, Pierce A [CTO] = wrote: >=20 > " If you sign the message you are taking responsibility for the = assertion that it is from NNN. If you choose to do so without knowing = who it is from then that is your problem." >=20 > Paul, >=20 > Following this standard of liability, every ISP should be forced to = sign IP packets and be liable for hacking attempts which originate on = their IP networks. >=20 > Just as reverse unicast path forwarding is not often (ever?) used in = the Internet backbone or ISP networks to ensure IP packets don't come = from networks they can't have originated from, neither do all telephone = networks "check" each originating telephone number to determine whether = they should have been able to originate from a particular carrier or = enterprise and for the same reasons - it is difficult, imperfect, and = expensive. Just as it is with the Internet backbone, it's actually = reasonably challenging just delivering the calls (or IP packets) to the = number that it is addressed to, without also having to also worry about = where it supposedly came from. >=20 > I'm telling you we can differentiate the trustworthy-ness (like = Stephen Colbert's "truth-iness") of calls. We can tell if a call = originated from a subscriber using a device which has to authenticate to = the network before it's permitted to place calls (except manual roaming = and some E911 calls). And we can tell if a call originated (or was = subjected to mid-call 3rd party call control from an enterprise or = mobile virtual network operator partner for example) and is therefore = not as trustworthy as the directly-connected and authenticated mobile = subscriber (for example). We can pass that relative trustworthiness = information along in signaling and it can be used to usefully = differentiate treatment, ultimately, by the consumer. >=20 > What you want is that the calling number is always, universally, only = ever trustworthy. My opinion is that is unrealistic and unreasonable. >=20 > Pierce >=20 > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 09, 2016 10:44 AM > To: Alex Bobotek ; Peterson, Jon = ; Gorman, Pierce A [CTO] = ; Dwight, Timothy M (Tim) = ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; = Richard Shockey ; stir@ietf.org; Brian Rosen = > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > On 8/9/16 5:03 AM, Alex Bobotek wrote: >> Jon, >>=20 >> Thanks much for your thoughtful response to the original points. = Yes, things got somewhat sidetracked. >>=20 >> On the first point (signing without authentication), I do not read = 6.1 >> as permitting "I'm signing to assert that I've authorized use of this >> phone number without authenticating the caller and/or completing a >> number delegation authority check", >=20 > I'm not sure I understand. Is this the assertion you are asking for? >=20 > "I (Acme Corp), having administrative authority over number NNN, = certify that this message is "from" NNN, though I have no idea who = actually originated this message." >=20 > This is a good thing??? >=20 > If you sign the message you are taking responsibility for the = assertion that it is from NNN. If you choose to do so without knowing = who it is from then that is your problem. You should be legally liable. = At the very least your reputation as a signer should be diminished as = fraudulent calls you have signed are detected. Eventually you will be = put on blacklists as an untrustworthy signer. >=20 > I guess we could speed the blacklisting by allowing signers to = pre-declare that they are untrustworthy. (That seems to be what you are = asking for.) >=20 >> a use case that reflects the currently-widespread practice of = authorization without authentication. >=20 > No wonder we have a problem with spoofed calls. >=20 > Thanks, > Paul >=20 >> My read of section 6.1 is that it allows anonymity rather than = signer-attribution with unauthenticated (non-anonymous) caller identity. = Knowing the triple of purported calling phone number that flashes on a = recipient's phone, the terminating phone number and a timestamp is = important in reporting/tracing/mitigating abusive calls. [On a side = note, I reread Section 11, but had trouble with the definition of = "private URI" (note: "private URI" and "private SIP URI" each occur = exactly once each in the doc and could benefit from a definition or = two).] Additionally, Brian Rosen's comment on 8/4 seems to corroborate = my reading of a ban on authorization without authentication in the = non-anonymous case (i.e., that using someone else's phone number = requires that "the entity that is assigned the TN explicitly authorizes = calls placed using it's TN"). >>=20 >> In summary, there is a high value in allowing signing/authorization = in the categories and use cases Pierce outlined. In my operational = experience, it really helps to know which company to contact to get the = callers kicked off a network. And signer attribution even without = caller authentication is a huge win for the public. >>=20 >>=20 >>=20 >> On the second point, thanks for pointing out that 12.1 requires = servers to keep the state of recently received requests. This is a = point that I missed in my reading of the draft, and this feature as you = have described it defeats most conceivable replay attacks. My bad for = missing this, but as you suggest, there may be some potential for = emphasizing this point. But there's another part of the issue -- cross = method replay. For example, it may be difficult to expect a messaging = node (which handles SIP MESSAGE) and a voice-capable IMS node (handling = SIP INVITE) to coordinate their anti-replay caches, allowing an attacker = that observes a SIP invite for a voice call to piggyback a spam text = message. As it's common to use the same "To" address for multiple = services that may be served by very different infrastructure components, = it would be beneficial to allow signatures to cover more than "To", = "From/PAI" and "Timestamp". I do not see this issue as meriting = significant delay of a STIR RFC if there's no quick fix. >>=20 >> Regards, >>=20 >> Alex >>=20 >>> -----Original Message----- >>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon >>> Sent: Monday, August 8, 2016 12:46 PM >>> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >>> ; Dwight, Timothy M (Tim) >>> ; DOLLY, MARTIN C >>> Cc: Rosbotham, Paul, Vodafone UK ; >>> Richard Shockey ; stir@ietf.org; Brian Rosen >>> >>> Subject: Re: [stir] STIR 4474bis-10 comments >>>=20 >>>=20 >>> Just so I'm clear, I'm not hearing an ask here in terms of changing >>> the text of rfc4474bis-10, which does allow signing PAI instead of >>> =46rom for precisely the reasons outlined in this lengthy thread. To >>> Alex's original point about providing authorization without >>> authentication, rfc4474bis has a lot of text about signing non-TN >>> identifiers, including for preserving anonymity; see the end of >>> section 6.1, and then the Privacy Considerations in section 11 for >>> more. Those should suffice to provide this property: it will = identify the service provider who signed without attesting an specific = user identity. >>>=20 >>> I also wanted to make sure we didn't drop the other ball that Alex >>> mentioned at the start of this thread, which is the issue of >>> proximate replay within the 60 second Date window. This is addressed >>> in Section 12.1 of rfc4474bis-10, which >>> reads: "Note that per baseline [RFC3261] behavior, servers keep = state >>> of recently received requests, and thus if an Identity header is >>> replayed by an attacker within the Date interval, verifiers can >>> detect that it is spoofed because a message with an identical Date >>> from the same source had recently been received." This refers to the >>> text of >>> RFC3261 section 23.4.2, though more properly the Date-related >>> behavior is better detailed in RFC3893 Section 10, which introduced >>> the first version of the partial signature mechanism that ultimately >>> inspired RFC4474. I'll update the text here so it is clearer about = exactly how to detect proximate replay. >>>=20 >>> Jon Peterson >>> Neustar, Inc. >>>=20 >>> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >>> wrote: >>>=20 >>>> Paul, >>>>=20 >>>> As you know, SIP inter-working is often challenging because of >>>> variability in implementation including proprietary headers = (without >>>> an >>>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>>> stripping things like display name in =46rom but that's another = story). >>>> I could argue that from a cleanliness of protocol implementation, >>>> (and if I wanted to be pedantic), I would strip PAI outbound unless >>>> required otherwise. But the point is moot. As I mentioned in the >>>> earlier e-mail, that is not our practice and I'm not requesting it = to be so. >>>>=20 >>>> Pierce >>>>=20 >>>>=20 >>>> -----Original Message----- >>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>> Sent: August 08, 2016 12:03 PM >>>> To: Gorman, Pierce A [CTO] ; Dwight, >>> Timothy >>>> M >>>> (Tim) ; DOLLY, MARTIN C >>> >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>> Richard >>>> Shockey ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>=20 >>>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>>> Thanks for the added comments Tim. >>>>>=20 >>>>> I agree that passing P-Asserted-Identity between trusted networks >>>>> is appropriate (and the converse is true as well). Part of my >>>>> issue is I have been conditioned from the very earliest >>>>> implementation of Sprint's VoIP network that other carriers' IP >>>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>>> and even there I find language that implies trust is established = by >>>>> agreement, not by standard. (Even roaming implies agreement.) >>>>=20 >>>> I understand why *some* stuff needs to be removed when forwarding = to >>> an >>>> untrusted party. For instance, if the call has requested privacy, >>>> then P-A-ID needs to be removed. >>>>=20 >>>> But when privacy is not a concern, trust is really more of a = concern >>>> on the ingress side, not egress. If I don't trust you then I won't >>>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>>> trust you, but you don't trust me, then what is the downside for >>>> passing along the P-A-ID? >>>>=20 >>>> Thanks, >>>> Paul >>>>=20 >>>>> Regardless, this discussion has been helpful and educational (to = me >>>>> at least). And, I confirmed with my operations counterpart we >>>>> generally send PAI today. I've also made note that where = standards >>>>> and >>> ICA >>>>> require it, we will include PAI. Thanks again. >>>>>=20 >>>>> Best regards, >>>>>=20 >>>>> Pierce >>>>>=20 >>>>> -----Original Message----- >>>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>>> Sent: August 08, 2016 10:47 AM >>>>> To: Gorman, Pierce A [CTO] ; DOLLY, >>> MARTIN >>>>> C >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>>> Richard Shockey ; Paul Kyzivat >>>>> ; stir@ietf.org; Brian Rosen >>>>> >>>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> Pierce, >>>>>=20 >>>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >>> GSMA >>>>> IR.95. The latter references and profiles the former. Section >>>>> 4.4.1 of >>>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>>> considered trusted, and table 3 in that section recommends that >>>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>>> It also states that PAI is mandatory at a roaming NNI. >>>>>=20 >>>>> Tim >>>>>=20 >>>>>=20 >>>>> -----Original Message----- >>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>>> Pierce A [CTO] >>>>> Sent: Monday, August 08, 2016 8:52 AM >>>>> To: DOLLY, MARTIN C >>>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>>> stir@ietf.org; Brian Rosen >>>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> Martin, >>>>>=20 >>>>> You referenced TS 29.195. I'm not familiar with that spec. Has = it >>>>> been deprecated? It's not showing up on the 3GPP site. >>>>>=20 >>>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on = the >>>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>>> header when interworking with untrusted networks." >>>>>=20 >>>>> Your remark is consistent with Note 4, but only if we agree that, >>>>> for instance, the AT&T network and the Sprint network are "trusted >>>>> networks". In reality, this is not the case or there would be no >>>>> firewalls or Session Border Controllers used for interworking and >>>>> security. My opinion is the only carrier networks that are = trusted >>>>> are the SS7 network, and the Internet backbone. >>>>>=20 >>>>> What it really comes down to is that PAI is left in signaling >>>>> either through formal specification as a part of an inter-carrier >>>>> inter-connection agreement, or by custom (or even by accident). I >>>>> think this illustrates Paul Rosbotham's observation is true. >>>>>=20 >>>>> Pierce >>>>>=20 >>>>> -----Original Message----- >>>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>>> Sent: August 05, 2016 12:55 PM >>>>> To: Gorman, Pierce A [CTO] >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>> Brian >>>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>>> ; Richard Shockey >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> PAI is not stripped at the network boundary between trusted >>>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>>> ITU And the list goes on >>>>>=20 >>>>> Martin C Dolly >>>>> Lead Member of Technical Staff >>>>> Core & Government/Regulatory Standards AT&T >>>>> Cell: 609-903-3360 >>>>> Email: md3135@att.com >>>>>=20 >>>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>>> wrote: >>>>>>=20 >>>>>> Which header the carrier chooses to display is moot if the header >>>>>> is stripped between carriers as per at least one standard. I >>>>>> think Paul Rosbotham's observation we're likely to encounter = "some >>>>>> interesting interworking challenges" was perhaps the = understatement of the year. >>>>>>=20 >>>>>> Pierce >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>>> Sent: August 05, 2016 11:58 AM >>>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>>> ; Brian Rosen >>>>>> Cc: stir@ietf.org >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> If PAI is present and signed, and =46rom is also signed, I would >>>>>> expect it to be up to the UA to decide what to display, not the = carrier. >>>>>>=20 >>>>>> Of course this will work differently if there is a different >>>>>> signaling regime between the carrier and the user device (e.g. >>>>>> black >>> phone). >>>>>>=20 >>>>>> Thanks, >>>>>> Paul >>>>>>=20 >>>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>>> controller functions and is not to be used in inter-carrier >>>>>>> inter-connection (although it commonly shows up anyway). My = opinion is the "From" >>>>>>> header is likely used more often for presentation. >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>>=20 >>>>>>> -----Original Message----- >>>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>>> Sent: August 05, 2016 9:37 AM >>>>>>> To: Rosbotham, Paul, Vodafone UK >>> ; >>>>>>> Paul Kyzivat ; Brian Rosen >>>>>>> >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>>=20 >>>>>>> Humm this is getting interesting. Its my understanding that the >>>>>>> display number aka "presentation number" in the US context is = the >>>>>>> one carried in the PAI. Martin, Pierce? >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone = UK" >>>>>>> >>> wrote: >>>>>>>=20 >>>>>>> Jumping in now that we're on European working time, +1 on >>>>>>> Paul's observation. >>>>>>>=20 >>>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>>> IDs....one (we term the Network Number, carried in PAID) = uniquely >>>>>>> identifies the line, the other (we term Presentation Number, >>>>>>> carried in From) is used for display purposes. >>>>>>>=20 >>>>>>> Only the carrier has the authority to set the Network Number >>>>>>> so only they could sign it. >>>>>>>=20 >>>>>>> But - subject to regulatory restrictions which are well >>>>>>> documented >>>>>>> - the number sent for display purposes belongs to the customer. >>>>>>> For blue-chip customers, I can allow them to send their >>>>>>> Presentation Numbers into the network, and can't readily check = at >>>>>>> a network level that they're theirs (I do have contractual >>>>>>> safeguards). The number may have been allocated by me, or could >>>>>>> be allocated by a third party provider. If it's a call-centre >>>>>>> they'll be making outbound calls for lots of different customers >>>>>>> which will change on day-by-day >>> basis. >>>>>>> This is business as usual. I don't like the term "authorised >>>>>>> spoofing" because it implies that the CLI is in some way being = rigged: >>>>>>> it's not, it's the corporate customer or their subcontractor >>>>>>> using the number that's been assigned (so in internet terms >>>>>>> delegated) to them via a chain of trust from the regulator. >>>>>>>=20 >>>>>>> What I want is the ability for customers to use their >>>>>>> credentials to sign the CLIs they send me so that at the >>>>>>> terminating end it can be checked (or indeed somewhere en-route >>>>>>> if that's the business model). >>>>>>> I can and would sign for customers on my mobile business since >>>>>>> I'm driving what number is presented, but that's by-the-by >>>>>>> because they aren't the ones who generate millions of nuisance >>>>>>> calls. If the signing only occurs at the originating carrier >>>>>>> level for corporate/call-centre customers that's no use because >>>>>>> I'm not in a position to do that for these type of >>>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>>> also highlight there are many more of my large customers that = I'd >>>>>>> trust more than a far end originating carrier that could be >>>>>>> anywhere in the world (though we have no shortage of small >>>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>>> UK....) >>>>>>>=20 >>>>>>> Regards >>>>>>>=20 >>>>>>> Paul >>>>>>>=20 >>>>>>> -----Original Message----- >>>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul = Kyzivat >>>>>>> Sent: 04 August 2016 23:12 >>>>>>> To: Brian Rosen >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>>> delegated the TN, it's being authorized to place calls that are >>>>>>>> not >>>>>>>> from that TN, but appear to be. >>>>>>>>=20 >>>>>>>> The mechanism to handle the credential is exactly the same as a >>>>>>>> delegation, so if you want to call it delegation, go ahead, but >>>>>>>> I prefer to call it authorized spoofing. >>>>>>>=20 >>>>>>> IIUC the delegation is to a responsible entity (something that >>>>>>> can be held legally accountable - e.g. a person), not to a = device. >>>>>>> The entity can then "use" the credential via any device(s) it >>>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>>> two-line >>> phone. >>>>>>>=20 >>>>>>> Thanks, >>>>>>> Paul >>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>>> >>>>>>>>> wrote: >>>>>>>>>=20 >>>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>>> phone as calling party. >>>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>>> carrier to him. He then creates another credential, which he >>>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>>> (because the call is coming from his mobile's TN but claims = to >>>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>>> could give the credential to his mobile SP if they sign on = his behalf. >>>>>>>>>=20 >>>>>>>>> I don't understand how that is different from regular = delegation. >>>>>>>>>=20 >>>>>>>>> When his landline carrier gave him a delegated certificate for >>>>>>>>> his landline number, he should be able to install that in >>>>>>>>> whatever devices he wants - his landline UA, his mobile phone, >>>>>>>>> etc. It is still delegated from his landline carrier, even = when >>>>>>>>> used with calls via his mobile carrier. >>>>>>>>>=20 >>>>>>>>> Thanks, >>>>>>>>> Paul >>>>>>>>>=20 >>>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>>> legitimate use. >>>>>>>>>>=20 >>>>>>>>>> But that's how I describe it. >>>>>>>>>>=20 >>>>>>>>>> Brian >>>>>>>>>>=20 >>>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>>> > = wrote: >>>>>>>>>>>=20 >>>>>>>>>>> +1, but with one question below: >>>>>>>>>>>=20 >>>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>>> delegation path, >>>>>>>>>>>=20 >>>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>>> authorized spoofers. >>>>>>>>>>>=20 >>>>>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>>>>> contrasted to "spoofers" who have been delegated their >>> authority. >>>>>>>>>>>=20 >>>>>>>>>>> Thanks, >>>>>>>>>>> Paul >>>>>>>>>>>=20 >>>>>>>>>>>> I don't think it matters who the delegator or delegatee are >>>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>>> delegated to, so authorities can follow the delegation = path. >>>>>>>>>>>> There are plenty of certificated carriers who are willing = to >>>>>>>>>>>> not care who they delegate to. The fact that there are = some >>>>>>>>>>>> who do doesn't change much. >>>>>>>>>>>> Making stir work means knowing who you are delegating to, = so >>>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>>>=20 >>>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>>> been delegated. >>>>>>>>>>>> If it does, it's asserting that the calls are from who they >>>>>>>>>>>> are supposed to be from. >>>>>>>>>>>> That should be straightforward, but we know it's not = always, >>>>>>>>>>>> and that represents the hard part of deployment in my = opinion. >>>>>>>>>>>> But once they delegate, they can hand responsibility to = sign >>>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>>> they are delegating to. >>>>>>>>>>>>=20 >>>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>>> we get into >>>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>>> which we don't. >>>>>>>>>>>> Our model is that you know who you delegate to, and once = you >>>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>>> some business practices. >>>>>>>>>>>>=20 >>>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI = and >>>>>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>>>=20 >>>>>>>>>>>> Brian >>>>>>>>>>>>=20 >>>>>>>>>>>>=20 >>>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >> >>>>>>>>>>>>> > >>>>>>>>>>>>> wrote: >>>>>>>>>>>>>=20 >>>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>>> policy and use cases. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be = deployed >>>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>>> my reason for suggesting a way to qualify the signature to >>>>>>>>>>>>> reflect that variability. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Originating carriers are in a position to know if a call = is >>>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>>> numbers, and can qualify to some degree the = trustworthiness >>>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>>> most-authenticated. There can be >>> more >>>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>>> complexity (both for the carriers and the consumers) and I >>>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and = fraud. >>>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>>> mobile consumers where their carriers are able to usefully >>>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>>> (revoked, not >>>>>>>>>>>>> revoked) for authenticating calling number will not work = well. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>>> well, if the calling party has to sign a call with a = per-TN >>>>>>>>>>>>> cert provided by the called party. No called party cert = to include? >>>>>>>>>>>>> Then the calling party does not have a trusted = relationship >>>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Pierce >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; >>>>>>>>>>>>> stir@ietf.org = >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>>> policy issue. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>>> design of stir, and the design allows delegation of one TN >>>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>>> NAM phone could have >>> more >>>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>>> mobile phone may also have a credential for, say, a TN = that >>>>>>>>>>>>> is delegated to a landline, to cover the example case of a >>>>>>>>>>>>> doctor placing a call on his mobile, but getting his = office >>>>>>>>>>>>> number to show up as the calling party. Use of such = mechanisms is policy. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Brian >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >> >>>>>>>>>>>>> > >>>>>>>>>>>>> wrote: >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. >>>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Pierce >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; >>>>>>>>>>>>> stir@ietf.org = >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>>> phones and any other devices that can be programmed to do >>> so. >>>>>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign >>>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>>> will want to get out of the liability of signing on = behalf >>>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>>> so. That means the devices have to be able to sign, but = I >>>>>>>>>>>>> understand many of the PBX vendors think that's something >>>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Brian >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> wrote: >>>>>>>>>>>>>=20 >>>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >>>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>>> >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>=20 >>>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>>> signature, >>>>>>>>>>>>> but the service provider can do that. It should not = add a >>>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>>> assign to >>>>>>>>>>>>> the trunk group connecting to the PBX, although it = could >>>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>>> "authorized >>>>>>>>>>>>> spoofing". The companion devices I'm aware of always = send >>>>>>>>>>>>> calls from the same service provider and should not = present >>>>>>>>>>>>> any issue. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>>> implement >>>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Brian >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A = [CTO] >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>>> where a >>>>>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>>>> way of >>>>>>>>>>>>> knowing whether the calling number is properly = assigned >>>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>>>> from an >>>>>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>>> And in >>>>>>>>>>>>> the consumer market, there are calling products = which >>>>>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>>>> devices >>>>>>>>>>>>> (e.g., tablets) which can place a call using the = MDN of >>>>>>>>>>>>> the parent subscriber. These are examples of = where the >>>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>>> necessarily mean >>>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>>> a single >>>>>>>>>>>>> subscriber with a single MDN regardless of = "laxity" of >>>>>>>>>>>>> spoof checking. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>>> authentication mandates from Congress and/or FCC, = I >>>>>>>>>>>>> suggested using carrier-specific certs and = encoding >>>>>>>>>>>>> specificity of authenticity, and calling number. = This >>>>>>>>>>>>> provides the identity of the originating carrier, = some >>>>>>>>>>>>> idea as to the accuracy or specificity of the = calling >>>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>>> (assuming nonce >>>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>>> suggested >>>>>>>>>>>>> below by Alex). >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The representation of orig-carrier and = trustworthiness >>>>>>>>>>>>> could be as follows: >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>>> Use case example(s): Pre-IMS, legacy = circuit-switched >>>>>>>>>>>>> networks that don't natively support SIP or which = don't >>>>>>>>>>>>> choose to sign calls. E.g., international = carriers. >>>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>>> roaming >>>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>> entirely >>>>>>>>>>>>> untrustworthy >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>>> OCN, but >>>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>> less than >>>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>>> calls from >>>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = most >>>>>>>>>>>>> trustworthy >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Undefined but assumed to use public or = commercially >>>>>>>>>>>>> available authentication services resources. = e.g., >>>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>>> cetera. >>>>>>>>>>>>> Could/would pass credentials down to SIP-aware = devices >>>>>>>>>>>>> which would process them according to the rules of = the >>>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Pierce >>>>>>>>>>>>>=20 >>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>>> >>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>=20 >>>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>>> placing a >>>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>>> telephone >>>>>>>>>>>>> number used in From/PAI, and in such circumstances = the >>>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>>> call may >>>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>>> serving the >>>>>>>>>>>>> entity that is assigned the TN. In all such = cases, the >>>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>>> authorizes calls >>>>>>>>>>>>> placed using it's TN. The design accommodates = such use >>>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>>> authentication. We're not aware of any cases = where >>>>>>>>>>>>> there >>>>>>>>>>>>> is an actual requirement for legitimate calling = without >>>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>>> although >>>>>>>>>>>>> we certainly are aware that various parts of = various >>>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>>> point, at >>>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>>> that the >>>>>>>>>>>>> laxity of allowing unchecked spoofing is not = acceptable >>>>>>>>>>>>> any more. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Brian >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>=20 >>>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>>> authentication >>>>>>>>>>>>> In the current telephony network practice, = some >>>>>>>>>>>>> service provider implementations choose not to >>>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>>> the use >>>>>>>>>>>>> of an arbitrary or selected user-provided = identity. >>>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>>> anyone >>>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>>> industry >>>>>>>>>>>>> reasonably expect to end this (often bad) = practice? >>>>>>>>>>>>> If it can't be ended, there's value in at = least >>>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>>> prevalence >>>>>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>>>>> sometimes-anonymous abuser, it becomes = critically >>>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>>> closest >>>>>>>>>>>>> to the abuser. Based on the assumption that = it's >>>>>>>>>>>>> better to ID service providers than = unreasonably >>>>>>>>>>>>> expect a ban of the use of unauthenticated = (and >>>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>>>> should >>>>>>>>>>>>> support authorization without authentication. = The >>>>>>>>>>>>> practice of authorizing unauthenticated use = exists, >>>>>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>>>>> (service provider identification). The = language of >>>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>>> should NOT >>>>>>>>>>>>> require or assume that that authentication = will >>>>>>>>>>>>> precede authorization. Of course there may be = other >>>>>>>>>>>>> use cases where signing includes = authentication and >>>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>>> authorization. >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>>> with this >>>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>>> within >>>>>>>>>>>>> 60 >>>>>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>>>> legal >>>>>>>>>>>>> and subject to replay in many cases. An SDP = body's >>>>>>>>>>>>> mky may not be present and if present its use = is >>>>>>>>>>>>> optional. Some sort of mandatory new or = existing >>>>>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>>>> Call-ID >>>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>>> receiving end >>>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>>> (e.g., >>>>>>>>>>>>> INVITE vs MESSAGE) might be handled by = different >>>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>>> difficulties >>>>>>>>>>>>> with 'it's been used already' coordination = allow a >>>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>>> This might >>>>>>>>>>>>> include an mkey from a captured INVITE. So = it >>>>>>>>>>>>> may be >>>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>>>> using a >>>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>>> distributed >>>>>>>>>>>>> implementations may make the enforcement = difficult, >>>>>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>>>> method >>>>>>>>>>>>> and possibly a numeric ID. Some sort of = '1-use' >>>>>>>>>>>>> practice should at least be discussed while = perhaps >>>>>>>>>>>>> not required. >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> NITS >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The verifier MUST inspect any optional = "ppt" >>>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>>>>> present, then the >>>>>>>>>>>>>=20 >>>>>>>>>>>>> verifier proceeds normally below. If a = "ppt" >>>>>>>>>>>>> parameter value is >>>>>>>>>>>>>=20 >>>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>>> parameter value is present, >>>>>>>>>>>>>=20 >>>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>>> including the variations >>>>>>>>>>>>>=20 >>>>>>>>>>>>> described in Step 5. >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> 3 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> = >>>>>>>>>>>> 447 >>>>>>>>>>>>> 4bi >>>>>>>>>>>>> s-10%20- >>> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>>> Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >>> 3>. >>>>>>>>>>>>> Background >>>>>>>>>>>>>=20 >>>>>>>>>>>>> [...] >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>>> ], problems such as >>>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>>>=20 >>>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>>>=20 >>>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>>> applications and services >>>>>>>>>>>>>=20 >>>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>>>=20 >>>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>>>=20 >>>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>>> requests. An >>>>>>>>>>>>>=20 >>>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>>> either as part of a user >>>>>>>>>>>>>=20 >>>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>>> is a component of a network >>>>>>>>>>>>>=20 >>>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>>> originating user agents send >>>>>>>>>>>>>=20 >>>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>>> message has been >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>>>=20 >>>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain >>> context. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>>> typically obviously >>>>>>>>>>>>>=20 >>>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>>> own credentials; if they >>>>>>>>>>>>>=20 >>>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>>> authentication services. However, >>>>>>>>>>>>>=20 >>>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Regards, >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Alex >>>>>>>>>>>>> * * >>>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>> _______________________________________________ >>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> = ----------------------------------------------------------- >>>>>>>>>>>>> -- >>>>>>>>>>>>> - >>>>>>>>>>>>> - >>>>>>>>>>>>> -- >>>>>>>>>>>>> ------- >>>>>>>>>>>>>=20 >>>>>>>>>>>>> This e-mail may contain Sprint proprietary = information >>>>>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>>>> use by >>>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>>> all copies >>>>>>>>>>>>> of the message. >>>>>>>>>>>>=20 >>>>>>>>>>>>=20 >>>>>>>>>>>>=20 >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>=20 >>>>>>>>>>> _______________________________________________ >>>>>>>>>>> stir mailing list >>>>>>>>>>> stir@ietf.org >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>=20 >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> ________________________________ >>>>>>>=20 >>>>>>> This e-mail may contain Sprint proprietary information intended >>>>>>> for the sole use of the recipient(s). Any use by others is = prohibited. >>>>>>> If you are not the intended recipient, please contact the sender >>>>>>> and delete all copies of the message. >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>=20 >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>=20 >=20 >=20 > ________________________________ >=20 > This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. From nobody Tue Aug 9 10:57:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8961212D865 for ; Tue, 9 Aug 2016 10:57:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7gfEq_hE8D-Y for ; Tue, 9 Aug 2016 10:57:07 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0098.outbound.protection.outlook.com [104.47.42.98]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32C6212D859 for ; Tue, 9 Aug 2016 10:57:00 -0700 (PDT) Received: from BY2FFO11OLC014.protection.gbl (10.1.14.33) by BY2FFO11HUB008.protection.gbl (10.1.14.214) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Tue, 9 Aug 2016 17:56:57 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.36) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.36 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.36; helo=plsapdm1.corp.sprint.com; Received: from plsapdm1.corp.sprint.com (144.230.172.36) by BY2FFO11OLC014.mail.protection.outlook.com (10.1.15.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.557.8 via Frontend Transport; Tue, 9 Aug 2016 17:56:57 +0000 Received: from pps.filterd (plsapdm1.corp.sprint.com [127.0.0.1]) by plsapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u79HtcYi010968; Tue, 9 Aug 2016 12:56:57 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm1.corp.sprint.com with ESMTP id 24qm0d00b3-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 09 Aug 2016 12:56:57 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 9 Aug 2016 12:56:55 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Tue, 9 Aug 2016 12:56:55 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7QA3LKKAAAWRJoAAAX9oAAACCpWAAABpDgAAAKK4AAAAWieAAAPgt4AAALpEgAAAy/8AAAA1f4AAAEbIAAAAZjkAAABSQQAAFBF5gAAOVnSAAAG+lwAAAytegAAAOkMAAAHCnQAAjmtqgAAD/5AAAADbMoAAAc19AAADVf2A//+dhAD//vySsKA6NsqA//+0l1AADZrZgAAKRnXw Date: Tue, 9 Aug 2016 17:56:55 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.46] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.36; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(13464003)(51914003)(189002)(377454003)(24454002)(43784003)(252514010)(199003)(81156014)(106116001)(76176999)(97736004)(81166006)(50986999)(356003)(54356999)(8676002)(11100500001)(108616004)(8936002)(19580395003)(2906002)(305945005)(23676002)(8666005)(4326007)(33646002)(110136002)(24736003)(47776003)(7696003)(93886004)(106466001)(5250100002)(325944008)(6116002)(3846002)(19580405001)(102836003)(87936001)(31430400001)(5890100001)(86362001)(68736007)(189998001)(92566002)(586003)(15975445007)(7736002)(2950100001)(50466002)(2900100001)(7846002)(7059030)(559001)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB008; H:plsapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11OLC014; 1:hDHTD005rKSAhqaFCd1BbDcxCcRxE+s2/qebh64tHbwrFy9tCbM3QeEAdw7UJqLDvuNWgyKs/O5szu5dfQTlSyC96GD0GZJtywTEjnmddvMtHr5xCQzF0raNNE5L+3hnM6t+hiyYbKWeBoafpsWxtOgJuxx953R4+05tfqD3A2fE6I93MCI1FbgmEW21kfSIPoVCKiDCbbaSq4JQJjg8aOPCjfsEyziz4mkpFd2ZAi7afFOk+357V/F6IS8XeLc80wk3jdKllxQ825mYjGCHdR0wIjdlz4YoIVPaX4bm3QtXORTvGqu14QxqLOpn5UpojoF8aVUF1Yg/ZwZcH3frc86sao2wgiK4x1G5bs/YYkQ9w78ncKJQZ/Ji5Rhg4hA//5MZka2w5OsH5UXM7OjcXH9VDPLCJlVQcRO5jI2vKte2oUdZGJb+hAkrFq9iG3/Ce6+cZZXZMHSY7czj31JMR+5rLQpuSduOD2Kr+LqKkwasDLI5jXGeXvukOmXYWSddb4jWTkoJW3xzuDBl2vNKNr6oSBGrKlSiG2+MMBkWshRe0xXrWkkI03RyOG69Fv3wQB2w/4BqFFowvHyabcw3Bw== X-MS-Office365-Filtering-Correlation-Id: d5052465-1bbc-410d-1434-08d3c07e8e8c X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB008; 2:j4Ac6o0DYqw0ZefZO6HT7VVgSRxU9MJR9nJjmVUGOO4BhoewxtrbiNk0Bg8fRfk9VtTovYFNe0nhUyUbuSfiS/4ROqJezmSO2R400OGArpW/gYbntVzohqqqkm+XuuL/G/P81QZ7p2W6nZW1pIUHsUtpYVjDkjZJ5wzuQRLOY8wGRmkxoGlBQsU1qqoj+Og7; 3:ic49S2V8BnoDTI578LG+d1c0yHYFvZfM7VFvxisRIUymgc8bqk+ugYoc6cgoxfLZp//BnEcQfDoOjzCZll/oh+xqMyif78D+2+Vc7nRf2PPhCI3T/WnY9GmUV7O+mlvHxJUqv8HtbWtstBx7ZtiuKYFw9Cf+vN0XmkaDdY6dd9ISnoGx+11hYOaf4Abvt2UjD35ycTJcTkANKqNq7wTBuQLih06xVOqR/yGcY/a+yMD+wXKhMZVL1jUMwdMawFXQ0J0enNjO5uOSUADS8PbjyQ== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BY2FFO11HUB008; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB008; 25:csqP+N87wU4is4fIxYLQAxZCJcMEBSwqXeGTki7BUh1z+TwY9CkVTrhiW9MflEyAWAO5WmDyg2eQ0rAp+zBTbDLop4+/pTmYgLwg5uRV4IModItOWeyenvTE1dJ8v6ZE5pU5FKUcybqFckW+C4HosL8cDGSAj/5iTlkBFUMMhjGWpn5HKAk2sYpmCQn0L04tPfFtWkaywTWH1Wnmb+t7PTM9siXIZ4uv9IM9rxMoQNSzBwoLJpRa3VVs03yQVqSc6CvZ6+iIzC1y7h+NVDvsqrSNlCeOUKOWnXvTPe8zSFTtT+R/x3LZBzaq/xIjca3lQPelpAOdhLuwlxuKddtItVRHsRQo9BUxZLlENQrT/2t3B1g/Xz0kQ4ohiO2y3SIMziXeLDxgSpQ1hpoWxx4ey2SiWyKSZWkQ7rtnGvgwYGKRXl5N40mcZ7xcAgZwUR979+XVcW4XpBJEiIzoWg0UbjtUgK4aFvZuUMXV51sdtQm0C/XW+7djUqeFGVq+tATGc8z4esQBFogXHfQFzfkG7SLSm5SMOcKmfkPU7COguN7hV3DlM3y1Y48dCcvkfyApwhso3AkVU6l20whdzboNwsQ34CEQylujc3X/EaPydyX55vQhh+/A8B7wsujwReINTgHyoHyxYvYNk0ACqjKinR0CIENrsk2dNqZMO2YV6ZSM39R7QiLaNlrLP7T0Xd8diTzIyuZjeT41pibq5Ph9L1RLnUCLKc6MItyXS7GHpufWRO+EEa22rdKeS+KC336nvQYL4zTqzvwodBItZBIAIc2lLz4YLXgyDpHZsWgC025ZYYeiTSRdQb1HYFaE83L9n9dtwgz8V6nTEsEyYli2YXYdlBzTJzq0JHbZmdnFbmVErH0sC7fpKjoHc/BO2O+nf64ey12oIMKF5jdGtakisQ== X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB008; 31:+bOwJ2fVhL6TfFr9S4N67ECGOC5Xmmi2uNii5r6zuebRbaUXVxi7Kk551RNP5vNzkzPAcyEpE/E+UkSrMGd57vFqZbma1QOz3n7TFaQkrtOmMnF6E6Xg/nxtzpMeMwtjflcrR7Y0Lpvjm/PzkZv/Bstd5iFpiq+pnXC6k3NWOKIt08ARaOhrgwaAr5s0QAQjJuaKRH2DLonhCDFSEfIx5zbvJJte26/xhweCLfQYJHg=; 20:evKacPnkr6SY/FGtbZrvCQlVuPCeHLNP3e5KOW/JN1iv67F+XyrbtDV5JQ+AVhHFIMKCnw3ij1bB1LIihCiW80EFj2uY+f/eL+2XgDwaft7pyPofzIJhqhtoWhvL10bgerE0kjp0wW6PCvodQQYM3wrm3bCwUivXTrXIsH+CQv/oID8O6PhrTBxgvq+T+EuByAnx2Hw2tbGprMKHEuzCymI401e4gCZTe++wGA5vuNo7mBh/QhG3YR2czmKEaYulrvBiLmvqJAJz2IBHxeipI4heKhfS2euusg7VEC3Hb75tdTgNJpnta8X5xvNIZrKpfgB4MnWwxKOYc/JqOy+y+BDlc3jERzvMil+4IyVCHjQj7A/2HXoVQwbFvmdt1v6Al8CxF1pk8TZwiZi8yGwx4Rn3lHgy+64omUv65+OL8Ro= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(211171220733660)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040161)(601004)(2401047)(5005006)(8121501046)(13018025)(13017025)(13024025)(13015025)(13023025)(10201501046)(3002001)(6055026); SRVR:BY2FFO11HUB008; BCL:0; PCL:0; RULEID:; SRVR:BY2FFO11HUB008; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB008; 4:jzdqewgRtJrbX8gKcJvb5g0MbnojjqGY1/N5MlHuTcHqJFT5tWKz3/T6IJ3q+MmI3NU19OSHsbNUJRiaZ8jtOY6KD2KlRMS/9pRazf5KW94e0z5wFRKY5CPjny0SXjgcJ0Hncnl03mGdy0Jt+/9v9lwpuNf/wbC2PjnLEhFQYfEvHwy5GQnkhqBViHk7iR3r4ltiHjEtLZuZr/p0EsUbwvImynQAKtKT7OnWouy/nt4NHTCkriZwBfvAq8N/mNAAYVjuIdQ3xhaCHjv15DrCjRQc/Ga0BsITZJbH+q/gjiSo07XC0Qc3WIJ86XJlHi4VDLH3LIyDJOoXCfFYleL+A9r82qllRnZu/vjAjX4U/qDrYEp/PEbHY+GO71RyBPNz/l7D5OMmrETDv3Rka5UhKyYt2nYVyG6JktX/27gf0+eTQ1ByHS2pIbFHpESZPrxYm66BSA0p4AizcBB6QB3AK3yPXqVAQXHHueBBo5x/3i4ULL1AlyWC3cmytJ7T3zlAcSp5qZE/ymlZ252w3cQPlbPHhBiwh+G1eh02NEzgpR05mSg6xcSt4Te15jcJqX6Gd+cjjhwIbTzzz+sPHpcnQ9spPIUMzukimrjpuAJ/hE4ZDiKNjmynUYwmqjJ4aKR/FZGYAO8bBJNG0PZaH7ZK7XnGc2/Cn0daw3/66kem+abapqMpljrIWNF6F6iePprNu7kdz1BYyoaNLABliD5JAhqzE5nOjM7qob6NuAsS81BIujmCRukeHw3JseRF1oE1zs/wfqEazto1ex3eEL6JFw== X-Forefront-PRVS: 0029F17A3F X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCWTJGRk8xMUhVQjAwODsyMzpDUXJycDVRNFFXOThCWkp0bStYcUJVQXNI?= =?utf-8?B?eWRKNE5aMGNPdEl3TlIwRFAzaldsNFpiSWE3dFFZTjF5ZnB0bEZBdm5KL1VL?= =?utf-8?B?VE9nSFFPL0E1c1BzbkVUeVZPWUVBUW5UR2xKRUZlZHpRK05jRFNNNGw3Z013?= =?utf-8?B?VTJhclRrZ1ZsVzZjM2cxdnpyRDlzallndXFOaXE5eERKNW1vd3I4MVZPSnZJ?= =?utf-8?B?ZitQeStmQmdMS24xMzBFeUZYN3puU1dQclJoRml1UFFzOGh5UmhXSk1Md1BZ?= =?utf-8?B?ZFJiSVd5ZWdFOGxEeTRocGlkOFJ6Y1EybTVDa2JFYW4yeWpoVUhIOVdMWGZ6?= =?utf-8?B?RCtVQnFadWpWYnM1R0piN05SNGV0UENjY092alBwSUoxa0s3VVlkK1dndTVJ?= =?utf-8?B?SWtiSmtCUGhtSW9aT3FLNFNOb04wY3dpL1BBaU9TRG5RdjBwTWFzSGhvM2Qx?= =?utf-8?B?T0pOTjRyS2RKOWZLT1puTjBlVHJmWGs5aHVIRk9UTllXT3llTys4QXI0R2Ft?= =?utf-8?B?S0x4MXZITGpGak4zR05tdnNtQUlFbTRjcFdKK2JMSFl6cmphN0dXSllJZmh4?= =?utf-8?B?SksyV0dESDJXTGhsQ2VHMFQ0SnAwYmQ2akVBbGFRZEQrcy9GSUNzM3l4Vnht?= =?utf-8?B?MzRlN3pXVm5vTVQ0UTdLVVA3ZTF4bDBIMWtDWDVDUk9FSmRrSy9yUSt2c1Ey?= =?utf-8?B?bERuN1ZPN3VXM3dqSnRzMjVKcjg0R3B0MVh4V1JaVURXeFkwdFVZUmVYQUwr?= =?utf-8?B?aTBrQTRTUkoyRHhZMWtiTHgwOXpWZ1NUcllrYWF2aWo2R2JqeW1lVjNTM2ll?= =?utf-8?B?MDg3TVRMMnkrSmRFY3hVNmNIQ21GcVpQeVVuY3RNenQrOEw0NEtUOVE3eVor?= =?utf-8?B?aDllVGR4UVUxZTJKekZnZENqelIvamxZYlJmaFFQTmthL0swNXVFblh4WnlT?= =?utf-8?B?MHJXWnpjcU1QTFpsQmcxY2IvVkg5M2ZWbm96STBXVE1XZGdkUlc4UXM2NXdn?= =?utf-8?B?djd5c3E4QzdvelBjdGdTV2QvOXRjZ20rVWo0bU5nZEMxaWJxOHFJaVFXb0RN?= =?utf-8?B?amdGcWJEdjBaaTJZc25yQlNxaksxcHZBcWkza2RnVWV4dTRtb3RDUCtiN3dI?= =?utf-8?B?cGsvaUpHWHRwRlY2VU5hVnJlMHpCWGxzR0NlVVJZVFBKRzdqanZIWmZsRm5s?= =?utf-8?B?OERjazFMVXg5WUdvVHBack4va2RaTXBLVTIxbzQyQ1lDWkk1LzE0NFRjM1JF?= =?utf-8?B?eG9lZU5CU2JkSW0yRmw5a2xhVGNOKytiS2cweGFZaFV5Y0UyTjdvVkwzQ0FD?= =?utf-8?B?aGRab0dvNno3UGhqcFo0aU1KMmtya1N5RldjOSsyYkhybEZwRnUvS1grYkZP?= =?utf-8?B?UThFdmMvWWlPeHBDS2Rpb1lnZlZNV1RTSWt4QklxaWJPQ1E0U3lNVWNtYVc3?= =?utf-8?B?T2tZWmkwV2RCZmN2NlJHdDYvTmpYNWpwWVRvM2pnVWkvNmx3WGJXa3hReFBl?= =?utf-8?B?MndLdFptVEdGMW5PWTJBT1FNVTFYWDNzb0N4Qjh1d2dMVnJhWDBxU01BR01s?= =?utf-8?B?T2Q4ZWFwUzVHR0xTNy9zNnU1M0ZkMC9GUERCUWQ4TTRFQngyN3NIbTBaRTZm?= =?utf-8?B?MHpLZ2lIbHJDdjIwbW5KVW5zcWtWRk9IdzVZeWova0lFaFhORmRUbjZyYlgx?= =?utf-8?B?V2I4eHpZUG1BTkM2Y3lvRCtrSjRJaWNINzk0d0dFU2JSZHpHVnp6Sk1SeFVy?= =?utf-8?B?eDQzSm5BdWphQ2xiVHRnVzRFUWhzOVRiZ3lKK2pwYVhGWThkcW9qaTcrbW1q?= =?utf-8?B?UE53WDJ1TzZmQSt4ejdPKzJ1V1d0Um54SzJSWk9ZTm1abkdweHRNVjd4Ni81?= =?utf-8?B?NG4xQ0w5M204UE00eW93TUY0c3pFT21UeWhzRkFWeUp6YnFBS1dBb240NDd2?= =?utf-8?Q?k7yP5IhO30AiNXTkhv9FPmuM5KsO4G4=3D?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB008; 6:fQVWP4iYaHTzMT0MMeqJrdCRSWAXXRnMkBMl3GDl6ahcW5CrB7WmBnBSFiuKn7V5EgTaaHuwuVMa5Ai+YykczzP772enWLD4Scdwwwq6DpJeTlMqqJH7tkevyTciEcyP/LQCDJ90+uupXPZ9jmUwMtqXmJno2VxQD3PMlzZLEaGW1FK9Q9p5DdV0fh9FttMOaRw4j+oCSbxf61Crod1zCt0OlZj9U5++tLpDjXrC81XdxGoWGtRp0LJJ3tFleU61Xzi/gR1iNdWCXAtNkQehu+lCg7W0DAqVMjSdeGhcGpC6T7FiRSK/EVHykwF7Uwp7Xrf2xvupLwnMM0WFsovzcw==; 5:5kX0yMNV5C8rAYVzagNRIUPPr0eRvmX3DdK0LtuZMsdPY/aRlE13MZgkh5LnuE9Y9Mn3pFiLTn6HuegPDwZWlvtNZuKZj4OUoR5mPwf8gPw/TkOehc0Q143JcX2OjwjL1alO6jQ3Havlzn/7wtdPEg==; 24:Uuqvus92KdB4hsv1Kn5libpJB2H298hTv4XtFqedSkIJhGE8Sy0tYaQRVacVb9idKid7yhuKTANnRh1JxEci5u652SPFzRLZk9EKZl+JsCc=; 7:8syVUiD7aaOjzA9EliTBztsAsiB2BKW6+5EkfQElE6nsK5zNvuV4D+2caOGLvoz/n4nRCw2KwLsYD0R7glsR+V9Kq8RKlqwaWcs8D/yrD6NaKeVB6CL9P5sz0bqO7Om4jT6GvabTpm1gdhsw5zQIeNRdl2tB+eo5aOhLSegagQuLo6kWd75Qu8qV24aquIPJIYQjM8h+66cNQtZK2Pj59tm7wYkCCDv15sIC4BEVh0zMMInak+asnNRmq5+Q7gml SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2016 17:56:57.7145 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.36]; Helo=[plsapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2FFO11HUB008 Archived-At: Cc: "Peterson, Jon" , "Rosbotham, Paul, Vodafone UK" , "DOLLY, MARTIN C" , Paul Kyzivat , Richard Shockey , "stir@ietf.org" , Alex Bobotek , "Dwight, Timothy M \(Tim\)" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 17:57:13 -0000 SSBhY3R1YWxseSBkb24ndCB0aGluayBTVElSIGlzIGdvaW5nIHRvICJnZXQgcmlkIG9mIHRoZSBz Y291cmdlIG9mIHJvYm9jYWxsaW5nIi4gIEFuZCB0byBiZSBtb3JlIHNwZWNpZmljLCB3ZSBtZWFu IHJvYm9jYWxsaW5nIGZvciBuZWZhcmlvdXMgcHVycG9zZXMgKGlmIHlvdSBjYW4gYWNjZXB0IHJv Ym9jYWxsIGZvciBwb2xpdGljYWwgcHVycG9zZXMgYXMgbm9uLW5lZmFyaW91cykuDQoNCkkgYXNz dW1lIHRoYXQgY2xvdWQtYmFzZWQgb24tbGluZSBjb21tdW5pY2F0aW9ucyBzZXJ2aWNlcyB3aWxs IG1ha2UgaXQgdHJpdmlhbCB0byBnZXQgYW5kIGNvbW1pdCByb2JvLWNhbGxpbmcgZm9yIG5lZmFy aW91cyBwdXJwb3NlcyB3aXRoIGF1dGhlbnRpY2F0ZWQgbnVtYmVycywgYW5kIHRoYXQgaXQgd2ls bCBiZSBkaWZmaWN1bHQgdG8gaW1wb3NzaWJsZSB0byB0cmFjayBkb3duIHRoZSBwZXJwZXRyYXRv cnMuICBXZSdyZSBwbGF5aW5nIHdhY2stYS1tb2xlIGhlcmUuDQoNClJlZ2FyZGxlc3MsIEkgYWxz byBhZ3JlZSB3aXRoIG1vc3Qgb2Ygd2hhdCB5b3Ugc2FpZC4NCg0KQWxsIFBhdWwgYW5kIEkgaGF2 ZSBiZWVuIGRlYmF0aW5nIGlzIHdoZXRoZXIgb3Igbm90IGFsbCBzaWduZWQgbnVtYmVycyBjYW4g aGF2ZSBlcXVpdmFsZW50IHRydXN0d29ydGhpbmVzcyAoYW5kIHRoZXkgY2FuJ3QpIGFuZCB3aGV0 aGVyIHRoZSBuZXR3b3JrIG9wZXJhdG9yIHNob3VsZCBiZSBsaWFibGUgZm9yIGEgY3VzdG9tZXIn cyBjcmltZXMgKGFuZCB0aGV5IHNob3VsZG4ndCkuDQoNClBpZXJjZQ0KDQotLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KRnJvbTogQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5l dF0gDQpTZW50OiBBdWd1c3QgMDksIDIwMTYgMTI6NDQgUE0NClRvOiBHb3JtYW4sIFBpZXJjZSBB IFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQpDYzogUGF1bCBLeXppdmF0IDxwa3l6 aXZhdEBhbHVtLm1pdC5lZHU+OyBBbGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQ+OyBQZXRl cnNvbiwgSm9uIDxqb24ucGV0ZXJzb25AbmV1c3Rhci5iaXo+OyBEd2lnaHQsIFRpbW90aHkgTSAo VGltKSA8dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5jb20+OyBET0xMWSwgTUFSVElOIEMgPG1kMzEz NUBhdHQuY29tPjsgUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1A dm9kYWZvbmUuY29tPjsgUmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBzdGly QGlldGYub3JnDQpTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0K DQpUbyBnZXQgcmlkIG9mIHRoZSBzY291cmdlIG9mIHJvYm9jYWxsaW5nLCBzZXJ2aWNlIHByb3Zp ZGVycyB3aWxsIGhhdmUgdG8gY2hlY2sgdG8gbWFrZSBzdXJlIHRoZSBjYWxsaW5nIHBhcnR5IG51 bWJlciBpcyBkZWxlZ2F0ZWQgdG8gdGhlIHN1YnNjcmliZXIsIG9yIGRlbGVnYXRlIHRoZW0gY3Jl ZGVudGlhbHMgc28gdGhleSBjYW4gc2lnbi4NClRoYXQgaXMgbm90IGN1cnJlbnQgcHJhY3RpY2Us IGJ1dCBjdXJyZW50IHByYWN0aWNlIHdpbGwgbmVlZCB0byBjaGFuZ2UuDQoNCldoZXJlIHlvdSBh cmVu4oCZdCBkb2luZyBpdCBiZWNhdXNlLCB3ZWxsLCBqdXN0IGJlY2F1c2UsIHlvdSB3aWxsIG5l ZWQgdG8uICBUaGF04oCZcyB0aGUgYWN0dWFsIGNoYW5nZSwgIFNpZ25pbmcgaXMgdGhlIG1lY2hh bmljcywgYnV0IHRoZSBjaGFuZ2UgaXMgY2hlY2tpbmcuIA0KV2hlcmUgeW91IGFyZSBhbHJlYWR5 IGp1c3QgYXNzZXJ0aW5nIFBBSSwgd2l0aG91dCByZWdhcmQgdG8gd2hhdCBpcyBpbiBGcm9tLCB5 b3UgYXJlIGdvb2QuICBJdOKAmXMgd2hlbiB5b3UgYmxpbmRseSBhY2NlcHQgRnJvbSAgYW5kIGNv cHkgdG8gUEFJIHRoYXQgeW91IGhhdmUgYSBwcm9ibGVtLCAgSWYgeW91IGFyZSBhY2NlcHRpbmcg UEFJLCB0aGVuIHdob21ldmVyIGlzIGFzc2VydGluZyBpdCBuZWVkcyB0byBzaWduLg0KDQpXaGVy ZSB0aGVyZSBpcyBhIHJlYXNvbiwgbGlrZSB0aGUgY2FsbCBjZW50ZXIsIGFuIGV4dHJhIGRlbGVn YXRpb24gd2lsbCBiZSByZXF1aXJlZCwgYW5kIHByb2JhYmx5IHlvdSB3aWxsIGJlIGxvb2tpbmcg dG8gdGhlIGNhbGwgY2VudGVyIHRvIHNpZ24gY2FsbHMgdGhhdCBhcmUgY29taW5nIG92ZXIgeW91 ciBuZXR3b3JrLCBidXQgYXJlIGJlaW5nIHBsYWNlZCBieSB0aGUgY2FsbCBjZW50ZXIgb24gYmVo YWxmIG9mIHNvbWVvbmUgbm90IG9uIHlvdXIgbmV0d29yay4NCg0KV2hlcmUgeW91IGFyZSBhIHRy YW5zaXQgbmV0d29yaywgeW91IHdpbGwgbmVlZCB0byBwdXNoIHNpZ25pbmcgcmVzcG9uc2liaWxp dHkgdG8geW91ciB0cmFuc2l0IGN1c3RvbWVyLg0KDQpJdCB3b3VsZCBiZSBnb29kIHRvIGJlIGFi bGUgdG8gcHVzaCB0aGUgcHJvYmxlbSB0byB5b3VyIHN1YnNjcmliZXIvY3VzdG9tZXIsIGJ1dCB0 aGF0IHdvbuKAmXQgd29yayBmb3IgYSB3aGlsZSB1bmxlc3MgdGhleSBhcmUgYSBzZXJ2aWNlIHBy b3ZpZGVyICh3aGVyZSB5b3UgbmVlZCB0byBtYWtlIHRoZW0gcmVzcG9uc2libGUgZm9yIHNpZ25p bmcsIGJlY2F1c2UgeW91IGRvbuKAmXQga25vdyB0aGVpciBjdXN0b21lcnMpLiAgVGhlIGJpZ2dl ciwgYW5kIG1vcmUgY29tcGxleCB0aGUgc3Vic2NyaWJlcuKAmXMgY29ubmVjdGlvbiB0byB5b3Vy IG5ldHdvcmssIHRoZSBtb3JlIHlvdSBhcmUgaW5jZW50aXZpc2VkIHRvIHB1c2ggdGhlIHByb2Js ZW0gZG93bi4gIFRoaW5ncyB0aGF0IGp1c3Qgd29yayBub3cgKGxpa2UgYSBtdWx0aS1sb2NhdGlv biBlbnRlcnByaXNlIGxlYXN0IGNvc3Qgcm91dGluZyBvdXRib3VuZCBjYWxscyB0aHJvdWdoIHNl dmVyYWwgbmV0d29ya3MpIG1heSBubyBsb25nZXIgd29yayB1bmxlc3MgdGhleSBkbyB0aGUgc2ln bmluZy4gIE1vc3Qgb2YgdGhlIGxhcmdlciBQQlggdmVuZG9ycyBrbm93IGFib3V0IHN0aXIgYW5k IGFyZSBwbGFubmluZyB0byBzdXBwb3J0IGl0LiAg4oCcV2hlbiIgaXMgYWx3YXlzIHRoZSBpc3N1 ZSwgYW5kIHRoZSBtb3JlIHdlIG1ha2UgdGhlIGNvbnNlcXVlbmNlcyBvZiBzdGlyIGRlcGxveW1l bnQga25vd24gdG8gc2VydmljZSBwcm92aWRlcnMsIGVudGVycHJpc2VzIGFuZCByZWd1bGF0b3Jz LCB0aGUgcXVpY2tlciB3ZeKAmWxsIGdldCB0aGUgdmVuZG9ycyB0byByZXNwb25kLg0KDQpCcmlh bg0KDQoNCj4gT24gQXVnIDksIDIwMTYsIGF0IDE6MDQgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NU T10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4gd3JvdGU6DQo+IA0KPiAiIElmIHlvdSBzaWdu IHRoZSBtZXNzYWdlIHlvdSBhcmUgdGFraW5nIHJlc3BvbnNpYmlsaXR5IGZvciB0aGUgYXNzZXJ0 aW9uIHRoYXQgaXQgaXMgZnJvbSBOTk4uIElmIHlvdSBjaG9vc2UgdG8gZG8gc28gd2l0aG91dCBr bm93aW5nIHdobyBpdCBpcyBmcm9tIHRoZW4gdGhhdCBpcyB5b3VyIHByb2JsZW0uIg0KPiANCj4g UGF1bCwNCj4gDQo+IEZvbGxvd2luZyB0aGlzIHN0YW5kYXJkIG9mIGxpYWJpbGl0eSwgZXZlcnkg SVNQIHNob3VsZCBiZSBmb3JjZWQgdG8gc2lnbiBJUCBwYWNrZXRzIGFuZCBiZSBsaWFibGUgZm9y IGhhY2tpbmcgYXR0ZW1wdHMgd2hpY2ggb3JpZ2luYXRlIG9uIHRoZWlyIElQIG5ldHdvcmtzLg0K PiANCj4gSnVzdCBhcyByZXZlcnNlIHVuaWNhc3QgcGF0aCBmb3J3YXJkaW5nIGlzIG5vdCBvZnRl biAoZXZlcj8pIHVzZWQgaW4gdGhlIEludGVybmV0IGJhY2tib25lIG9yIElTUCBuZXR3b3JrcyB0 byBlbnN1cmUgSVAgcGFja2V0cyBkb24ndCBjb21lIGZyb20gbmV0d29ya3MgdGhleSBjYW4ndCBo YXZlIG9yaWdpbmF0ZWQgZnJvbSwgbmVpdGhlciBkbyBhbGwgdGVsZXBob25lIG5ldHdvcmtzICJj aGVjayIgZWFjaCBvcmlnaW5hdGluZyB0ZWxlcGhvbmUgbnVtYmVyIHRvIGRldGVybWluZSB3aGV0 aGVyIHRoZXkgc2hvdWxkIGhhdmUgYmVlbiBhYmxlIHRvIG9yaWdpbmF0ZSBmcm9tIGEgcGFydGlj dWxhciBjYXJyaWVyIG9yIGVudGVycHJpc2UgYW5kIGZvciB0aGUgc2FtZSByZWFzb25zIC0gaXQg aXMgZGlmZmljdWx0LCBpbXBlcmZlY3QsIGFuZCBleHBlbnNpdmUuICBKdXN0IGFzIGl0IGlzIHdp dGggdGhlIEludGVybmV0IGJhY2tib25lLCBpdCdzIGFjdHVhbGx5IHJlYXNvbmFibHkgY2hhbGxl bmdpbmcganVzdCBkZWxpdmVyaW5nIHRoZSBjYWxscyAob3IgSVAgcGFja2V0cykgdG8gdGhlIG51 bWJlciB0aGF0IGl0IGlzIGFkZHJlc3NlZCB0bywgd2l0aG91dCBhbHNvIGhhdmluZyB0byBhbHNv IHdvcnJ5IGFib3V0IHdoZXJlIGl0IHN1cHBvc2VkbHkgY2FtZSBmcm9tLg0KPiANCj4gSSdtIHRl bGxpbmcgeW91IHdlIGNhbiBkaWZmZXJlbnRpYXRlIHRoZSB0cnVzdHdvcnRoeS1uZXNzIChsaWtl IFN0ZXBoZW4gQ29sYmVydCdzICJ0cnV0aC1pbmVzcyIpIG9mIGNhbGxzLiAgV2UgY2FuIHRlbGwg aWYgYSBjYWxsIG9yaWdpbmF0ZWQgZnJvbSBhIHN1YnNjcmliZXIgdXNpbmcgYSBkZXZpY2Ugd2hp Y2ggaGFzIHRvIGF1dGhlbnRpY2F0ZSB0byB0aGUgbmV0d29yayBiZWZvcmUgaXQncyBwZXJtaXR0 ZWQgdG8gcGxhY2UgY2FsbHMgKGV4Y2VwdCBtYW51YWwgcm9hbWluZyBhbmQgc29tZSBFOTExIGNh bGxzKS4gIEFuZCB3ZSBjYW4gdGVsbCBpZiBhIGNhbGwgb3JpZ2luYXRlZCAob3Igd2FzIHN1Ympl Y3RlZCB0byBtaWQtY2FsbCAzcmQgcGFydHkgY2FsbCBjb250cm9sIGZyb20gYW4gZW50ZXJwcmlz ZSBvciBtb2JpbGUgdmlydHVhbCBuZXR3b3JrIG9wZXJhdG9yIHBhcnRuZXIgZm9yIGV4YW1wbGUp IGFuZCBpcyB0aGVyZWZvcmUgbm90IGFzIHRydXN0d29ydGh5IGFzIHRoZSBkaXJlY3RseS1jb25u ZWN0ZWQgYW5kIGF1dGhlbnRpY2F0ZWQgbW9iaWxlIHN1YnNjcmliZXIgKGZvciBleGFtcGxlKS4g IFdlIGNhbiBwYXNzIHRoYXQgcmVsYXRpdmUgdHJ1c3R3b3J0aGluZXNzIGluZm9ybWF0aW9uIGFs b25nIGluIHNpZ25hbGluZyBhbmQgaXQgY2FuIGJlIHVzZWQgdG8gdXNlZnVsbHkgZGlmZmVyZW50 aWF0ZSB0cmVhdG1lbnQsIHVsdGltYXRlbHksIGJ5IHRoZSBjb25zdW1lci4NCj4gDQo+IFdoYXQg eW91IHdhbnQgaXMgdGhhdCB0aGUgY2FsbGluZyBudW1iZXIgaXMgYWx3YXlzLCB1bml2ZXJzYWxs eSwgb25seSBldmVyIHRydXN0d29ydGh5LiAgTXkgb3BpbmlvbiBpcyB0aGF0IGlzIHVucmVhbGlz dGljIGFuZCB1bnJlYXNvbmFibGUuDQo+IA0KPiBQaWVyY2UNCj4gDQo+IC0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tDQo+IEZyb206IFBhdWwgS3l6aXZhdCBbbWFpbHRvOnBreXppdmF0QGFsdW0u bWl0LmVkdV0NCj4gU2VudDogQXVndXN0IDA5LCAyMDE2IDEwOjQ0IEFNDQo+IFRvOiBBbGV4IEJv Ym90ZWsgPGFsZXhAYm9ib3Rlay5uZXQ+OyBQZXRlcnNvbiwgSm9uIDxqb24ucGV0ZXJzb25AbmV1 c3Rhci5iaXo+OyBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5j b20+OyBEd2lnaHQsIFRpbW90aHkgTSAoVGltKSA8dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5jb20+ OyBET0xMWSwgTUFSVElOIEMgPG1kMzEzNUBhdHQuY29tPg0KPiBDYzogUm9zYm90aGFtLCBQYXVs LCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsgUmljaGFyZCBTaG9j a2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3NlbiA8YnJA YnJpYW5yb3Nlbi5uZXQ+DQo+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNv bW1lbnRzDQo+IA0KPiBPbiA4LzkvMTYgNTowMyBBTSwgQWxleCBCb2JvdGVrIHdyb3RlOg0KPj4g Sm9uLA0KPj4gDQo+PiBUaGFua3MgbXVjaCBmb3IgeW91ciB0aG91Z2h0ZnVsIHJlc3BvbnNlIHRv IHRoZSBvcmlnaW5hbCBwb2ludHMuICBZZXMsIHRoaW5ncyBnb3Qgc29tZXdoYXQgc2lkZXRyYWNr ZWQuDQo+PiANCj4+IE9uIHRoZSBmaXJzdCBwb2ludCAoc2lnbmluZyB3aXRob3V0IGF1dGhlbnRp Y2F0aW9uKSwgSSBkbyBub3QgcmVhZCA2LjENCj4+IGFzIHBlcm1pdHRpbmcgIkknbSBzaWduaW5n IHRvIGFzc2VydCB0aGF0IEkndmUgYXV0aG9yaXplZCB1c2Ugb2YgdGhpcw0KPj4gcGhvbmUgbnVt YmVyIHdpdGhvdXQgYXV0aGVudGljYXRpbmcgdGhlIGNhbGxlciBhbmQvb3IgY29tcGxldGluZyBh DQo+PiBudW1iZXIgZGVsZWdhdGlvbiBhdXRob3JpdHkgY2hlY2siLA0KPiANCj4gSSdtIG5vdCBz dXJlIEkgdW5kZXJzdGFuZC4gSXMgdGhpcyB0aGUgYXNzZXJ0aW9uIHlvdSBhcmUgYXNraW5nIGZv cj8NCj4gDQo+ICJJIChBY21lIENvcnApLCBoYXZpbmcgYWRtaW5pc3RyYXRpdmUgYXV0aG9yaXR5 IG92ZXIgbnVtYmVyIE5OTiwgY2VydGlmeSB0aGF0IHRoaXMgbWVzc2FnZSBpcyAiZnJvbSIgTk5O LCB0aG91Z2ggSSBoYXZlIG5vIGlkZWEgd2hvIGFjdHVhbGx5IG9yaWdpbmF0ZWQgdGhpcyBtZXNz YWdlLiINCj4gDQo+IFRoaXMgaXMgYSBnb29kIHRoaW5nPz8/DQo+IA0KPiBJZiB5b3Ugc2lnbiB0 aGUgbWVzc2FnZSB5b3UgYXJlIHRha2luZyByZXNwb25zaWJpbGl0eSBmb3IgdGhlIGFzc2VydGlv biB0aGF0IGl0IGlzIGZyb20gTk5OLiBJZiB5b3UgY2hvb3NlIHRvIGRvIHNvIHdpdGhvdXQga25v d2luZyB3aG8gaXQgaXMgZnJvbSB0aGVuIHRoYXQgaXMgeW91ciBwcm9ibGVtLiBZb3Ugc2hvdWxk IGJlIGxlZ2FsbHkgbGlhYmxlLiBBdCB0aGUgdmVyeSBsZWFzdCB5b3VyIHJlcHV0YXRpb24gYXMg YSBzaWduZXIgc2hvdWxkIGJlIGRpbWluaXNoZWQgYXMgZnJhdWR1bGVudCBjYWxscyB5b3UgaGF2 ZSBzaWduZWQgYXJlIGRldGVjdGVkLiBFdmVudHVhbGx5IHlvdSB3aWxsIGJlIHB1dCBvbiBibGFj a2xpc3RzIGFzIGFuIHVudHJ1c3R3b3J0aHkgc2lnbmVyLg0KPiANCj4gSSBndWVzcyB3ZSBjb3Vs ZCBzcGVlZCB0aGUgYmxhY2tsaXN0aW5nIGJ5IGFsbG93aW5nIHNpZ25lcnMgdG8gcHJlLWRlY2xh cmUgdGhhdCB0aGV5IGFyZSB1bnRydXN0d29ydGh5LiAoVGhhdCBzZWVtcyB0byBiZSB3aGF0IHlv dSBhcmUgYXNraW5nIGZvci4pDQo+IA0KPj4gYSB1c2UgY2FzZSB0aGF0IHJlZmxlY3RzIHRoZSBj dXJyZW50bHktd2lkZXNwcmVhZCBwcmFjdGljZSBvZiBhdXRob3JpemF0aW9uIHdpdGhvdXQgYXV0 aGVudGljYXRpb24uDQo+IA0KPiBObyB3b25kZXIgd2UgaGF2ZSBhIHByb2JsZW0gd2l0aCBzcG9v ZmVkIGNhbGxzLg0KPiANCj4gVGhhbmtzLA0KPiBQYXVsDQo+IA0KPj4gTXkgcmVhZCBvZiBzZWN0 aW9uIDYuMSBpcyB0aGF0IGl0IGFsbG93cyBhbm9ueW1pdHkgcmF0aGVyIHRoYW4gc2lnbmVyLWF0 dHJpYnV0aW9uIHdpdGggdW5hdXRoZW50aWNhdGVkIChub24tYW5vbnltb3VzKSBjYWxsZXIgaWRl bnRpdHkuICBLbm93aW5nIHRoZSB0cmlwbGUgb2YgcHVycG9ydGVkIGNhbGxpbmcgcGhvbmUgbnVt YmVyIHRoYXQgZmxhc2hlcyBvbiBhIHJlY2lwaWVudCdzIHBob25lLCB0aGUgdGVybWluYXRpbmcg cGhvbmUgbnVtYmVyIGFuZCBhIHRpbWVzdGFtcCBpcyBpbXBvcnRhbnQgaW4gcmVwb3J0aW5nL3Ry YWNpbmcvbWl0aWdhdGluZyBhYnVzaXZlIGNhbGxzLiAgW09uIGEgc2lkZSBub3RlLCBJIHJlcmVh ZCBTZWN0aW9uIDExLCBidXQgaGFkIHRyb3VibGUgd2l0aCB0aGUgZGVmaW5pdGlvbiBvZiAicHJp dmF0ZSBVUkkiIChub3RlOiAgInByaXZhdGUgVVJJIiBhbmQgInByaXZhdGUgU0lQIFVSSSIgZWFj aCBvY2N1ciBleGFjdGx5IG9uY2UgZWFjaCBpbiB0aGUgZG9jIGFuZCBjb3VsZCBiZW5lZml0IGZy b20gYSBkZWZpbml0aW9uIG9yIHR3bykuXSAgIEFkZGl0aW9uYWxseSwgQnJpYW4gUm9zZW4ncyBj b21tZW50IG9uIDgvNCBzZWVtcyB0byBjb3Jyb2JvcmF0ZSBteSByZWFkaW5nIG9mIGEgYmFuIG9u IGF1dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbiBpbiB0aGUgbm9uLWFub255bW91 cyBjYXNlIChpLmUuLCB0aGF0IHVzaW5nIHNvbWVvbmUgZWxzZSdzIHBob25lIG51bWJlciByZXF1 aXJlcyB0aGF0ICJ0aGUgZW50aXR5IHRoYXQgaXMgYXNzaWduZWQgdGhlIFROIGV4cGxpY2l0bHkg YXV0aG9yaXplcyBjYWxscyBwbGFjZWQgdXNpbmcgaXQncyBUTiIpLg0KPj4gDQo+PiBJbiBzdW1t YXJ5LCB0aGVyZSBpcyBhIGhpZ2ggdmFsdWUgaW4gYWxsb3dpbmcgc2lnbmluZy9hdXRob3JpemF0 aW9uIGluIHRoZSBjYXRlZ29yaWVzIGFuZCB1c2UgY2FzZXMgUGllcmNlIG91dGxpbmVkLiAgSW4g bXkgb3BlcmF0aW9uYWwgZXhwZXJpZW5jZSwgaXQgcmVhbGx5IGhlbHBzIHRvIGtub3cgd2hpY2gg Y29tcGFueSB0byBjb250YWN0IHRvIGdldCB0aGUgY2FsbGVycyBraWNrZWQgb2ZmIGEgbmV0d29y ay4gIEFuZCBzaWduZXIgYXR0cmlidXRpb24gZXZlbiB3aXRob3V0IGNhbGxlciBhdXRoZW50aWNh dGlvbiBpcyBhIGh1Z2Ugd2luIGZvciB0aGUgcHVibGljLg0KPj4gDQo+PiANCj4+IA0KPj4gT24g dGhlIHNlY29uZCBwb2ludCwgdGhhbmtzIGZvciBwb2ludGluZyBvdXQgdGhhdCAxMi4xIHJlcXVp cmVzIHNlcnZlcnMgdG8ga2VlcCB0aGUgc3RhdGUgb2YgcmVjZW50bHkgcmVjZWl2ZWQgcmVxdWVz dHMuICBUaGlzIGlzIGEgcG9pbnQgdGhhdCBJIG1pc3NlZCBpbiBteSByZWFkaW5nIG9mIHRoZSBk cmFmdCwgYW5kIHRoaXMgZmVhdHVyZSBhcyB5b3UgaGF2ZSBkZXNjcmliZWQgaXQgZGVmZWF0cyBt b3N0IGNvbmNlaXZhYmxlIHJlcGxheSBhdHRhY2tzLiAgTXkgYmFkIGZvciBtaXNzaW5nIHRoaXMs IGJ1dCBhcyB5b3Ugc3VnZ2VzdCwgdGhlcmUgbWF5IGJlIHNvbWUgcG90ZW50aWFsIGZvciBlbXBo YXNpemluZyB0aGlzIHBvaW50LiAgQnV0IHRoZXJlJ3MgYW5vdGhlciBwYXJ0IG9mIHRoZSBpc3N1 ZSAtLSBjcm9zcyBtZXRob2QgcmVwbGF5LiAgRm9yIGV4YW1wbGUsIGl0IG1heSBiZSBkaWZmaWN1 bHQgdG8gZXhwZWN0IGEgbWVzc2FnaW5nIG5vZGUgKHdoaWNoIGhhbmRsZXMgU0lQIE1FU1NBR0Up IGFuZCBhIHZvaWNlLWNhcGFibGUgSU1TIG5vZGUgKGhhbmRsaW5nIFNJUCBJTlZJVEUpIHRvIGNv b3JkaW5hdGUgdGhlaXIgYW50aS1yZXBsYXkgY2FjaGVzLCBhbGxvd2luZyBhbiBhdHRhY2tlciB0 aGF0IG9ic2VydmVzIGEgU0lQIGludml0ZSBmb3IgYSB2b2ljZSBjYWxsIHRvIHBpZ2d5YmFjayBh IHNwYW0gdGV4dCBtZXNzYWdlLiAgQXMgaXQncyBjb21tb24gdG8gdXNlIHRoZSBzYW1lICJUbyIg YWRkcmVzcyBmb3IgbXVsdGlwbGUgc2VydmljZXMgdGhhdCBtYXkgYmUgc2VydmVkIGJ5IHZlcnkg ZGlmZmVyZW50IGluZnJhc3RydWN0dXJlIGNvbXBvbmVudHMsIGl0IHdvdWxkIGJlIGJlbmVmaWNp YWwgdG8gYWxsb3cgc2lnbmF0dXJlcyB0byBjb3ZlciBtb3JlIHRoYW4gIlRvIiwgIkZyb20vUEFJ IiBhbmQgIlRpbWVzdGFtcCIuICAgSSBkbyBub3Qgc2VlIHRoaXMgaXNzdWUgYXMgbWVyaXRpbmcg c2lnbmlmaWNhbnQgZGVsYXkgb2YgYSBTVElSIFJGQyBpZiB0aGVyZSdzIG5vIHF1aWNrIGZpeC4N Cj4+IA0KPj4gUmVnYXJkcywNCj4+IA0KPj4gQWxleA0KPj4gDQo+Pj4gLS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0NCj4+PiBGcm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3Jn XSBPbiBCZWhhbGYgT2YgUGV0ZXJzb24sIEpvbg0KPj4+IFNlbnQ6IE1vbmRheSwgQXVndXN0IDgs IDIwMTYgMTI6NDYgUE0NCj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdv cm1hbkBzcHJpbnQuY29tPjsgUGF1bCBLeXppdmF0DQo+Pj4gPHBreXppdmF0QGFsdW0ubWl0LmVk dT47IER3aWdodCwgVGltb3RoeSBNIChUaW0pDQo+Pj4gPHRpbW90aHkuZHdpZ2h0QHZlcml6b24u Y29tPjsgRE9MTFksIE1BUlRJTiBDIDxtZDMxMzVAYXR0LmNvbT4NCj4+PiBDYzogUm9zYm90aGFt LCBQYXVsLCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsNCj4+PiBS aWNoYXJkIFNob2NrZXkgPHJpY2hhcmRAc2hvY2tleS51cz47IHN0aXJAaWV0Zi5vcmc7IEJyaWFu IFJvc2VuDQo+Pj4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0g U1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4gDQo+Pj4gDQo+Pj4gSnVzdCBzbyBJJ20gY2xl YXIsIEknbSBub3QgaGVhcmluZyBhbiBhc2sgaGVyZSBpbiB0ZXJtcyBvZiBjaGFuZ2luZw0KPj4+ IHRoZSB0ZXh0IG9mIHJmYzQ0NzRiaXMtMTAsIHdoaWNoIGRvZXMgYWxsb3cgc2lnbmluZyBQQUkg aW5zdGVhZCBvZg0KPj4+IEZyb20gZm9yIHByZWNpc2VseSB0aGUgcmVhc29ucyBvdXRsaW5lZCBp biB0aGlzIGxlbmd0aHkgdGhyZWFkLiBUbw0KPj4+IEFsZXgncyBvcmlnaW5hbCBwb2ludCBhYm91 dCBwcm92aWRpbmcgYXV0aG9yaXphdGlvbiB3aXRob3V0DQo+Pj4gYXV0aGVudGljYXRpb24sIHJm YzQ0NzRiaXMgaGFzIGEgbG90IG9mIHRleHQgYWJvdXQgc2lnbmluZyBub24tVE4NCj4+PiBpZGVu dGlmaWVycywgaW5jbHVkaW5nIGZvciBwcmVzZXJ2aW5nIGFub255bWl0eTsgc2VlIHRoZSBlbmQg b2YNCj4+PiBzZWN0aW9uIDYuMSwgYW5kIHRoZW4gdGhlIFByaXZhY3kgQ29uc2lkZXJhdGlvbnMg aW4gc2VjdGlvbiAxMSBmb3INCj4+PiBtb3JlLiBUaG9zZSBzaG91bGQgc3VmZmljZSB0byBwcm92 aWRlIHRoaXMgcHJvcGVydHk6IGl0IHdpbGwgaWRlbnRpZnkgdGhlIHNlcnZpY2UgcHJvdmlkZXIg d2hvIHNpZ25lZCB3aXRob3V0IGF0dGVzdGluZyBhbiBzcGVjaWZpYyB1c2VyIGlkZW50aXR5Lg0K Pj4+IA0KPj4+IEkgYWxzbyB3YW50ZWQgdG8gbWFrZSBzdXJlIHdlIGRpZG4ndCBkcm9wIHRoZSBv dGhlciBiYWxsIHRoYXQgQWxleA0KPj4+IG1lbnRpb25lZCBhdCB0aGUgc3RhcnQgb2YgdGhpcyB0 aHJlYWQsIHdoaWNoIGlzIHRoZSBpc3N1ZSBvZg0KPj4+IHByb3hpbWF0ZSByZXBsYXkgd2l0aGlu IHRoZSA2MCBzZWNvbmQgRGF0ZSB3aW5kb3cuIFRoaXMgaXMgYWRkcmVzc2VkDQo+Pj4gaW4gU2Vj dGlvbiAxMi4xIG9mIHJmYzQ0NzRiaXMtMTAsIHdoaWNoDQo+Pj4gcmVhZHM6ICJOb3RlIHRoYXQg cGVyIGJhc2VsaW5lIFtSRkMzMjYxXSBiZWhhdmlvciwgc2VydmVycyBrZWVwIHN0YXRlDQo+Pj4g b2YgcmVjZW50bHkgcmVjZWl2ZWQgcmVxdWVzdHMsIGFuZCB0aHVzIGlmIGFuIElkZW50aXR5IGhl YWRlciBpcw0KPj4+IHJlcGxheWVkIGJ5IGFuIGF0dGFja2VyIHdpdGhpbiB0aGUgRGF0ZSBpbnRl cnZhbCwgdmVyaWZpZXJzIGNhbg0KPj4+IGRldGVjdCB0aGF0IGl0IGlzIHNwb29mZWQgYmVjYXVz ZSBhIG1lc3NhZ2Ugd2l0aCBhbiBpZGVudGljYWwgRGF0ZQ0KPj4+IGZyb20gdGhlIHNhbWUgc291 cmNlIGhhZCByZWNlbnRseSBiZWVuIHJlY2VpdmVkLiIgVGhpcyByZWZlcnMgdG8gdGhlDQo+Pj4g dGV4dCBvZg0KPj4+IFJGQzMyNjEgc2VjdGlvbiAyMy40LjIsIHRob3VnaCBtb3JlIHByb3Blcmx5 IHRoZSBEYXRlLXJlbGF0ZWQNCj4+PiBiZWhhdmlvciBpcyBiZXR0ZXIgZGV0YWlsZWQgaW4gUkZD Mzg5MyBTZWN0aW9uIDEwLCB3aGljaCBpbnRyb2R1Y2VkDQo+Pj4gdGhlIGZpcnN0IHZlcnNpb24g b2YgdGhlIHBhcnRpYWwgc2lnbmF0dXJlIG1lY2hhbmlzbSB0aGF0IHVsdGltYXRlbHkNCj4+PiBp bnNwaXJlZCBSRkM0NDc0LiBJJ2xsIHVwZGF0ZSB0aGUgdGV4dCBoZXJlIHNvIGl0IGlzIGNsZWFy ZXIgYWJvdXQgZXhhY3RseSBob3cgdG8gZGV0ZWN0IHByb3hpbWF0ZSByZXBsYXkuDQo+Pj4gDQo+ Pj4gSm9uIFBldGVyc29uDQo+Pj4gTmV1c3RhciwgSW5jLg0KPj4+IA0KPj4+IE9uIDgvOC8xNiwg MTE6MzggQU0sICJzdGlyIG9uIGJlaGFsZiBvZiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIg0KPj4+ IDxzdGlyLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIFBpZXJjZS5Hb3JtYW5Ac3ByaW50 LmNvbT4gd3JvdGU6DQo+Pj4gDQo+Pj4+IFBhdWwsDQo+Pj4+IA0KPj4+PiBBcyB5b3Uga25vdywg U0lQIGludGVyLXdvcmtpbmcgaXMgb2Z0ZW4gY2hhbGxlbmdpbmcgYmVjYXVzZSBvZg0KPj4+PiB2 YXJpYWJpbGl0eSBpbiBpbXBsZW1lbnRhdGlvbiBpbmNsdWRpbmcgcHJvcHJpZXRhcnkgaGVhZGVy cyAod2l0aG91dA0KPj4+PiBhbg0KPj4+PiBYLSkgYW5kIHN1cHBvcnQgb3IgbGFjayB0aGVyZW9m IGZvciBub24tbWFuZGF0b3J5IChwZXIgUkZDIDMyNjEpDQo+Pj4+IGhlYWRlcnMgc3VjaCBhcyBQ LUFzc2VydGVkLUlkZW50aXR5LCAoYW5kIHRoaW5ncyBsaWtlIEIyQlVBIHN0YWNrcw0KPj4+PiBz dHJpcHBpbmcgdGhpbmdzIGxpa2UgZGlzcGxheSBuYW1lIGluIEZyb20gYnV0IHRoYXQncyBhbm90 aGVyIHN0b3J5KS4NCj4+Pj4gSSBjb3VsZCBhcmd1ZSB0aGF0IGZyb20gYSBjbGVhbmxpbmVzcyBv ZiBwcm90b2NvbCBpbXBsZW1lbnRhdGlvbiwNCj4+Pj4gKGFuZCBpZiBJIHdhbnRlZCB0byBiZSBw ZWRhbnRpYyksIEkgd291bGQgc3RyaXAgUEFJIG91dGJvdW5kIHVubGVzcw0KPj4+PiByZXF1aXJl ZCBvdGhlcndpc2UuICBCdXQgdGhlIHBvaW50IGlzIG1vb3QuICBBcyBJIG1lbnRpb25lZCBpbiB0 aGUNCj4+Pj4gZWFybGllciBlLW1haWwsIHRoYXQgaXMgbm90IG91ciBwcmFjdGljZSBhbmQgSSdt IG5vdCByZXF1ZXN0aW5nIGl0IHRvIGJlIHNvLg0KPj4+PiANCj4+Pj4gUGllcmNlDQo+Pj4+IA0K Pj4+PiANCj4+Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4gRnJvbTogUGF1bCBL eXppdmF0IFttYWlsdG86cGt5eml2YXRAYWx1bS5taXQuZWR1XQ0KPj4+PiBTZW50OiBBdWd1c3Qg MDgsIDIwMTYgMTI6MDMgUE0NCj4+Pj4gVG86IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJj ZS5Hb3JtYW5Ac3ByaW50LmNvbT47IER3aWdodCwNCj4+PiBUaW1vdGh5DQo+Pj4+IE0NCj4+Pj4g KFRpbSkgPHRpbW90aHkuZHdpZ2h0QHZlcml6b24uY29tPjsgRE9MTFksIE1BUlRJTiBDDQo+Pj4g PG1kMzEzNUBhdHQuY29tPg0KPj4+PiBDYzogUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSyA8 cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsNCj4+PiBSaWNoYXJkDQo+Pj4+IFNob2NrZXkg PHJpY2hhcmRAc2hvY2tleS51cz47IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2VuDQo+Pj4+IDxi ckBicmlhbnJvc2VuLm5ldD4NCj4+Pj4gU3ViamVjdDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMt MTAgY29tbWVudHMNCj4+Pj4gDQo+Pj4+IE9uIDgvOC8xNiAxMjoxMSBQTSwgR29ybWFuLCBQaWVy Y2UgQSBbQ1RPXSB3cm90ZToNCj4+Pj4+IFRoYW5rcyBmb3IgdGhlIGFkZGVkIGNvbW1lbnRzIFRp bS4NCj4+Pj4+IA0KPj4+Pj4gSSBhZ3JlZSB0aGF0IHBhc3NpbmcgUC1Bc3NlcnRlZC1JZGVudGl0 eSBiZXR3ZWVuIHRydXN0ZWQgbmV0d29ya3MNCj4+Pj4+IGlzIGFwcHJvcHJpYXRlIChhbmQgdGhl IGNvbnZlcnNlIGlzIHRydWUgYXMgd2VsbCkuICBQYXJ0IG9mIG15DQo+Pj4+PiBpc3N1ZSBpcyBJ IGhhdmUgYmVlbiBjb25kaXRpb25lZCBmcm9tIHRoZSB2ZXJ5IGVhcmxpZXN0DQo+Pj4+PiBpbXBs ZW1lbnRhdGlvbiBvZiBTcHJpbnQncyBWb0lQIG5ldHdvcmsgdGhhdCBvdGhlciBjYXJyaWVycycg SVANCj4+Pj4+IG5ldHdvcmtzIGFyZSBpbmhlcmVudGx5IHVudHJ1c3RlZC4gIEkndmUgYmVlbiBi cm93c2luZyBUUyAyOS4xNjUNCj4+Pj4+IGFuZCBldmVuIHRoZXJlIEkgZmluZCBsYW5ndWFnZSB0 aGF0IGltcGxpZXMgdHJ1c3QgaXMgZXN0YWJsaXNoZWQgYnkNCj4+Pj4+IGFncmVlbWVudCwgbm90 IGJ5IHN0YW5kYXJkLiAgKEV2ZW4gcm9hbWluZyBpbXBsaWVzIGFncmVlbWVudC4pDQo+Pj4+IA0K Pj4+PiBJIHVuZGVyc3RhbmQgd2h5ICpzb21lKiBzdHVmZiBuZWVkcyB0byBiZSByZW1vdmVkIHdo ZW4gZm9yd2FyZGluZyB0bw0KPj4+IGFuDQo+Pj4+IHVudHJ1c3RlZCBwYXJ0eS4gRm9yIGluc3Rh bmNlLCBpZiB0aGUgY2FsbCBoYXMgcmVxdWVzdGVkIHByaXZhY3ksDQo+Pj4+IHRoZW4gUC1BLUlE IG5lZWRzIHRvIGJlIHJlbW92ZWQuDQo+Pj4+IA0KPj4+PiBCdXQgd2hlbiBwcml2YWN5IGlzIG5v dCBhIGNvbmNlcm4sIHRydXN0IGlzIHJlYWxseSBtb3JlIG9mIGEgY29uY2Vybg0KPj4+PiBvbiB0 aGUgaW5ncmVzcyBzaWRlLCBub3QgZWdyZXNzLiBJZiBJIGRvbid0IHRydXN0IHlvdSB0aGVuIEkg d29uJ3QNCj4+Pj4gdHJ1c3QgYSBQLUEtSUQgeW91IHNlbnQgdG8gbWUsIGFuZCBzbyAqSSogd2ls bCByZW1vdmUgaXQuIEJ1dCBpZiBJDQo+Pj4+IHRydXN0IHlvdSwgYnV0IHlvdSBkb24ndCB0cnVz dCBtZSwgdGhlbiB3aGF0IGlzIHRoZSBkb3duc2lkZSBmb3INCj4+Pj4gcGFzc2luZyBhbG9uZyB0 aGUgUC1BLUlEPw0KPj4+PiANCj4+Pj4gICAgVGhhbmtzLA0KPj4+PiAgICBQYXVsDQo+Pj4+IA0K Pj4+Pj4gUmVnYXJkbGVzcywgdGhpcyBkaXNjdXNzaW9uIGhhcyBiZWVuIGhlbHBmdWwgYW5kIGVk dWNhdGlvbmFsICh0byBtZQ0KPj4+Pj4gYXQgbGVhc3QpLiAgQW5kLCBJIGNvbmZpcm1lZCB3aXRo IG15IG9wZXJhdGlvbnMgY291bnRlcnBhcnQgd2UNCj4+Pj4+IGdlbmVyYWxseSBzZW5kIFBBSSB0 b2RheS4gIEkndmUgYWxzbyBtYWRlIG5vdGUgdGhhdCB3aGVyZSBzdGFuZGFyZHMNCj4+Pj4+IGFu ZA0KPj4+IElDQQ0KPj4+Pj4gcmVxdWlyZSBpdCwgd2Ugd2lsbCBpbmNsdWRlIFBBSS4gICBUaGFu a3MgYWdhaW4uDQo+Pj4+PiANCj4+Pj4+IEJlc3QgcmVnYXJkcywNCj4+Pj4+IA0KPj4+Pj4gUGll cmNlDQo+Pj4+PiANCj4+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+Pj4+PiBGcm9t OiBEd2lnaHQsIFRpbW90aHkgTSAoVGltKSBbbWFpbHRvOnRpbW90aHkuZHdpZ2h0QHZlcml6b24u Y29tXQ0KPj4+Pj4gU2VudDogQXVndXN0IDA4LCAyMDE2IDEwOjQ3IEFNDQo+Pj4+PiBUbzogR29y bWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPjsgRE9MTFksDQo+ Pj4gTUFSVElODQo+Pj4+PiBDIDxtZDMxMzVAYXR0LmNvbT4NCj4+Pj4+IENjOiBSb3Nib3RoYW0s IFBhdWwsIFZvZGFmb25lIFVLIDxwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+Ow0KPj4+Pj4g UmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBQYXVsIEt5eml2YXQNCj4+Pj4+ IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3Nlbg0KPj4+ Pj4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4+Pj4gU3ViamVjdDogUkU6IFtzdGlyXSBTVElSIDQ0 NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+IA0KPj4+Pj4gUGllcmNlLA0KPj4+Pj4gDQo+Pj4+PiBN eSBhc3N1bXB0aW9uIGlzIHRoYXQgTWFydGluIG1vcnBoZWQgMiBzcGVjcywgM0dQUCBUUyAyOS4x NjUgYW5kDQo+Pj4gR1NNQQ0KPj4+Pj4gSVIuOTUuICBUaGUgbGF0dGVyIHJlZmVyZW5jZXMgYW5k IHByb2ZpbGVzIHRoZSBmb3JtZXIuICBTZWN0aW9uDQo+Pj4+PiA0LjQuMSBvZg0KPj4+Pj4gSVIu OTUgcmVjb21tZW5kcyB0aGF0IE1OTy10by1NTk8gb3IgTU5PLXRvLUlQWCBpbnRlcmNvbm5lY3Rz IGJlDQo+Pj4+PiBjb25zaWRlcmVkIHRydXN0ZWQsIGFuZCB0YWJsZSAzIGluIHRoYXQgc2VjdGlv biByZWNvbW1lbmRzIHRoYXQNCj4+Pj4+IFAtQXNzZXJ0ZWQtSWRlbnRpdHkgKFBBSSkgYmUgZXhj aGFuZ2VkIGF0IGEgdHJ1c3RlZCBpbnRlcmNvbm5lY3QuDQo+Pj4+PiBJdCBhbHNvIHN0YXRlcyB0 aGF0IFBBSSBpcyBtYW5kYXRvcnkgYXQgYSByb2FtaW5nIE5OSS4NCj4+Pj4+IA0KPj4+Pj4gVGlt DQo+Pj4+PiANCj4+Pj4+IA0KPj4+Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4+ IEZyb206IHN0aXIgW21haWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBH b3JtYW4sDQo+Pj4+PiBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4gU2VudDogTW9uZGF5LCBBdWd1c3Qg MDgsIDIwMTYgODo1MiBBTQ0KPj4+Pj4gVG86IERPTExZLCBNQVJUSU4gQw0KPj4+Pj4gQ2M6IFJv c2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUs7IFJpY2hhcmQgU2hvY2tleTsgUGF1bCBLeXppdmF0 Ow0KPj4+Pj4gc3RpckBpZXRmLm9yZzsgQnJpYW4gUm9zZW4NCj4+Pj4+IFN1YmplY3Q6IFtFXSBS ZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0KPj4+Pj4gDQo+Pj4+PiBNYXJ0aW4s DQo+Pj4+PiANCj4+Pj4+IFlvdSByZWZlcmVuY2VkIFRTIDI5LjE5NS4gIEknbSBub3QgZmFtaWxp YXIgd2l0aCB0aGF0IHNwZWMuICBIYXMgaXQNCj4+Pj4+IGJlZW4gZGVwcmVjYXRlZD8gIEl0J3Mg bm90IHNob3dpbmcgdXAgb24gdGhlIDNHUFAgc2l0ZS4NCj4+Pj4+IA0KPj4+Pj4gSSByZWZlcmVu Y2VkIDNHUFAgVFMgMjQuNjA3LiAgSW4gU2VjdGlvbiA0LjMuMiAiUmVxdWlyZW1lbnRzIG9uIHRo ZQ0KPj4+Pj4gb3JpZ2luYXRpbmcgc2lkZSIgTm90ZSA0IGl0IHN0YXRlcywgIiBJdCBpcyBhc3N1 bWVkIHRoYXQgdGhlIElCQ0YNCj4+Pj4+IGlzIHJlc3BvbnNpYmxlIGZvciBzdHJpcHBpbmcgdGhl IFAtQXNzZXJ0ZWQtSWRlbnRpdHkgZnJvbSB0aGUgU0lQDQo+Pj4+PiBoZWFkZXIgd2hlbiBpbnRl cndvcmtpbmcgd2l0aCB1bnRydXN0ZWQgbmV0d29ya3MuIg0KPj4+Pj4gDQo+Pj4+PiBZb3VyIHJl bWFyayBpcyBjb25zaXN0ZW50IHdpdGggTm90ZSA0LCBidXQgb25seSBpZiB3ZSBhZ3JlZSB0aGF0 LA0KPj4+Pj4gZm9yIGluc3RhbmNlLCB0aGUgQVQmVCBuZXR3b3JrIGFuZCB0aGUgU3ByaW50IG5l dHdvcmsgYXJlICJ0cnVzdGVkDQo+Pj4+PiBuZXR3b3JrcyIuICBJbiByZWFsaXR5LCB0aGlzIGlz IG5vdCB0aGUgY2FzZSBvciB0aGVyZSB3b3VsZCBiZSBubw0KPj4+Pj4gZmlyZXdhbGxzIG9yIFNl c3Npb24gQm9yZGVyIENvbnRyb2xsZXJzIHVzZWQgZm9yIGludGVyd29ya2luZyBhbmQNCj4+Pj4+ IHNlY3VyaXR5LiAgTXkgb3BpbmlvbiBpcyB0aGUgb25seSBjYXJyaWVyIG5ldHdvcmtzIHRoYXQg YXJlIHRydXN0ZWQNCj4+Pj4+IGFyZSB0aGUgU1M3IG5ldHdvcmssIGFuZCB0aGUgSW50ZXJuZXQg YmFja2JvbmUuDQo+Pj4+PiANCj4+Pj4+IFdoYXQgaXQgcmVhbGx5IGNvbWVzIGRvd24gdG8gaXMg dGhhdCBQQUkgaXMgbGVmdCBpbiBzaWduYWxpbmcNCj4+Pj4+IGVpdGhlciB0aHJvdWdoIGZvcm1h bCBzcGVjaWZpY2F0aW9uIGFzIGEgcGFydCBvZiBhbiBpbnRlci1jYXJyaWVyDQo+Pj4+PiBpbnRl ci1jb25uZWN0aW9uIGFncmVlbWVudCwgb3IgYnkgY3VzdG9tIChvciBldmVuIGJ5IGFjY2lkZW50 KS4gIEkNCj4+Pj4+IHRoaW5rIHRoaXMgaWxsdXN0cmF0ZXMgUGF1bCBSb3Nib3RoYW0ncyBvYnNl cnZhdGlvbiBpcyB0cnVlLg0KPj4+Pj4gDQo+Pj4+PiBQaWVyY2UNCj4+Pj4+IA0KPj4+Pj4gLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4+IEZyb206IERPTExZLCBNQVJUSU4gQyBbbWFp bHRvOm1kMzEzNUBhdHQuY29tXQ0KPj4+Pj4gU2VudDogQXVndXN0IDA1LCAyMDE2IDEyOjU1IFBN DQo+Pj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tPg0KPj4+Pj4gQ2M6IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsgPHBhdWwucm9zYm90 aGFtQHZvZGFmb25lLmNvbT47DQo+Pj4gQnJpYW4NCj4+Pj4+IFJvc2VuIDxickBicmlhbnJvc2Vu Lm5ldD47IHN0aXJAaWV0Zi5vcmc7IFBhdWwgS3l6aXZhdA0KPj4+Pj4gPHBreXppdmF0QGFsdW0u bWl0LmVkdT47IFJpY2hhcmQgU2hvY2tleSA8cmljaGFyZEBzaG9ja2V5LnVzPg0KPj4+Pj4gU3Vi amVjdDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+IA0KPj4+Pj4g UEFJIGlzIG5vdCBzdHJpcHBlZCBhdCB0aGUgbmV0d29yayBib3VuZGFyeSBiZXR3ZWVuIHRydXN0 ZWQNCj4+Pj4+IG5ldHdvcmtzIDNHUFAgVFMgMjkuMTk1IEF0aXMgc3BlY3MgR1NNQSBBdGlzIHNp cCBmb3J1bSB0YXNrIGZvcmNlDQo+Pj4+PiBJVFUgQW5kIHRoZSBsaXN0IGdvZXMgb24NCj4+Pj4+ IA0KPj4+Pj4gTWFydGluIEMgRG9sbHkNCj4+Pj4+IExlYWQgTWVtYmVyIG9mIFRlY2huaWNhbCBT dGFmZg0KPj4+Pj4gQ29yZSAmIEdvdmVybm1lbnQvUmVndWxhdG9yeSBTdGFuZGFyZHMgQVQmVA0K Pj4+Pj4gQ2VsbDogNjA5LTkwMy0zMzYwDQo+Pj4+PiBFbWFpbDogbWQzMTM1QGF0dC5jb20NCj4+ Pj4+IA0KPj4+Pj4+IE9uIEF1ZyA1LCAyMDE2LCBhdCAxOjA0IFBNLCBHb3JtYW4sIFBpZXJjZSBB IFtDVE9dDQo+Pj4+Pj4gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4gd3JvdGU6DQo+Pj4+Pj4g DQo+Pj4+Pj4gV2hpY2ggaGVhZGVyIHRoZSBjYXJyaWVyIGNob29zZXMgdG8gZGlzcGxheSBpcyBt b290IGlmIHRoZSBoZWFkZXINCj4+Pj4+PiBpcyBzdHJpcHBlZCBiZXR3ZWVuIGNhcnJpZXJzIGFz IHBlciBhdCBsZWFzdCBvbmUgc3RhbmRhcmQuICBJDQo+Pj4+Pj4gdGhpbmsgUGF1bCBSb3Nib3Ro YW0ncyBvYnNlcnZhdGlvbiB3ZSdyZSBsaWtlbHkgdG8gZW5jb3VudGVyICJzb21lDQo+Pj4+Pj4g aW50ZXJlc3RpbmcgaW50ZXJ3b3JraW5nIGNoYWxsZW5nZXMiIHdhcyBwZXJoYXBzIHRoZSB1bmRl cnN0YXRlbWVudCBvZiB0aGUgeWVhci4NCj4+Pj4+PiANCj4+Pj4+PiBQaWVyY2UNCj4+Pj4+PiAN Cj4+Pj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPj4+Pj4+IEZyb206IFBhdWwgS3l6 aXZhdCBbbWFpbHRvOnBreXppdmF0QGFsdW0ubWl0LmVkdV0NCj4+Pj4+PiBTZW50OiBBdWd1c3Qg MDUsIDIwMTYgMTE6NTggQU0NCj4+Pj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGll cmNlLkdvcm1hbkBzcHJpbnQuY29tPjsgUmljaGFyZA0KPj4+Pj4+IFNob2NrZXkgPHJpY2hhcmRA c2hvY2tleS51cz47IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsNCj4+Pj4+PiA8cGF1bC5y b3Nib3RoYW1Adm9kYWZvbmUuY29tPjsgQnJpYW4gUm9zZW4gPGJyQGJyaWFucm9zZW4ubmV0Pg0K Pj4+Pj4+IENjOiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4gU3ViamVjdDogUmU6IFtzdGlyXSBTVElS IDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+PiANCj4+Pj4+PiBJZiBQQUkgaXMgcHJlc2VudCBh bmQgc2lnbmVkLCBhbmQgRnJvbSBpcyBhbHNvIHNpZ25lZCwgSSB3b3VsZA0KPj4+Pj4+IGV4cGVj dCBpdCB0byBiZSB1cCB0byB0aGUgVUEgdG8gZGVjaWRlIHdoYXQgdG8gZGlzcGxheSwgbm90IHRo ZSBjYXJyaWVyLg0KPj4+Pj4+IA0KPj4+Pj4+IE9mIGNvdXJzZSB0aGlzIHdpbGwgd29yayBkaWZm ZXJlbnRseSBpZiB0aGVyZSBpcyBhIGRpZmZlcmVudA0KPj4+Pj4+IHNpZ25hbGluZyByZWdpbWUg YmV0d2VlbiB0aGUgY2FycmllciBhbmQgdGhlIHVzZXIgZGV2aWNlIChlLmcuDQo+Pj4+Pj4gYmxh Y2sNCj4+PiBwaG9uZSkuDQo+Pj4+Pj4gDQo+Pj4+Pj4gICBUaGFua3MsDQo+Pj4+Pj4gICBQYXVs DQo+Pj4+Pj4gDQo+Pj4+Pj4+IE9uIDgvNS8xNiAxMToyNiBBTSwgR29ybWFuLCBQaWVyY2UgQSBb Q1RPXSB3cm90ZToNCj4+Pj4+Pj4gUC1Bc3NlcnRlZC1JZGVudGl0eSBpcyBzdXBwb3NlZCB0byBv cGVyYXRlICJhbW9uZyB0cnVzdGVkIFNJUA0KPj4+Pj4+PiBlbnRpdGllcyIgYW5kIHRoZXJlZm9y ZSBzb21lIHNwZWNpZmljYXRpb25zIChlLmcuLCAzR1BQIFRTDQo+Pj4+Pj4+IDI0LjYwNykgYXNz dW1lIFAtQXNzZXJ0ZWQtSWRlbnRpdHkgaXMgc3RyaXBwZWQgYnkgYm9yZGVyDQo+Pj4+Pj4+IGNv bnRyb2xsZXIgZnVuY3Rpb25zIGFuZCBpcyBub3QgdG8gYmUgdXNlZCBpbiBpbnRlci1jYXJyaWVy DQo+Pj4+Pj4+IGludGVyLWNvbm5lY3Rpb24gKGFsdGhvdWdoIGl0IGNvbW1vbmx5IHNob3dzIHVw IGFueXdheSkuICBNeSBvcGluaW9uIGlzIHRoZSAiRnJvbSINCj4+Pj4+Pj4gaGVhZGVyIGlzIGxp a2VseSB1c2VkIG1vcmUgb2Z0ZW4gZm9yIHByZXNlbnRhdGlvbi4NCj4+Pj4+Pj4gDQo+Pj4+Pj4+ IFBpZXJjZQ0KPj4+Pj4+PiANCj4+Pj4+Pj4gDQo+Pj4+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQo+Pj4+Pj4+IEZyb206IFJpY2hhcmQgU2hvY2tleSBbbWFpbHRvOnJpY2hhcmRAc2hv Y2tleS51c10NCj4+Pj4+Pj4gU2VudDogQXVndXN0IDA1LCAyMDE2IDk6MzcgQU0NCj4+Pj4+Pj4g VG86IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsNCj4+PiA8cGF1bC5yb3Nib3RoYW1Adm9k YWZvbmUuY29tPjsNCj4+Pj4+Pj4gUGF1bCBLeXppdmF0IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+ OyBCcmlhbiBSb3Nlbg0KPj4+Pj4+PiA8YnJAYnJpYW5yb3Nlbi5uZXQ+DQo+Pj4+Pj4+IENjOiBz dGlyQGlldGYub3JnDQo+Pj4+Pj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEw IGNvbW1lbnRzDQo+Pj4+Pj4+IA0KPj4+Pj4+PiANCj4+Pj4+Pj4gSHVtbSB0aGlzIGlzIGdldHRp bmcgaW50ZXJlc3RpbmcuICBJdHMgbXkgdW5kZXJzdGFuZGluZyB0aGF0IHRoZQ0KPj4+Pj4+PiBk aXNwbGF5IG51bWJlciBha2EgInByZXNlbnRhdGlvbiBudW1iZXIiIGluIHRoZSBVUyBjb250ZXh0 IGlzIHRoZQ0KPj4+Pj4+PiBvbmUgY2FycmllZCBpbiB0aGUgUEFJLiAgTWFydGluLCBQaWVyY2U/ DQo+Pj4+Pj4+IA0KPj4+Pj4+PiANCj4+Pj4+Pj4gDQo+Pj4+Pj4+IA0KPj4+Pj4+PiBPbiA4LzUv MTYsIDM6NDYgQU0sICJzdGlyIG9uIGJlaGFsZiBvZiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25l IFVLIg0KPj4+Pj4+PiA8c3Rpci1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBwYXVsLnJv c2JvdGhhbUB2b2RhZm9uZS5jb20+DQo+Pj4gd3JvdGU6DQo+Pj4+Pj4+IA0KPj4+Pj4+PiAgIEp1 bXBpbmcgaW4gbm93IHRoYXQgd2UncmUgb24gRXVyb3BlYW4gd29ya2luZyB0aW1lLCArMSBvbg0K Pj4+Pj4+PiBQYXVsJ3Mgb2JzZXJ2YXRpb24uDQo+Pj4+Pj4+IA0KPj4+Pj4+PiAgIEhlcmUgaW4g dGhlIFVLLCB3ZSd2ZSBnb3QgMiBudW1iZXJzIGNhcnJpZWQgYXMgY2FsbGluZyBsaW5lDQo+Pj4+ Pj4+IElEcy4uLi5vbmUgKHdlIHRlcm0gdGhlIE5ldHdvcmsgTnVtYmVyLCBjYXJyaWVkIGluIFBB SUQpIHVuaXF1ZWx5DQo+Pj4+Pj4+IGlkZW50aWZpZXMgdGhlIGxpbmUsIHRoZSBvdGhlciAod2Ug dGVybSBQcmVzZW50YXRpb24gTnVtYmVyLA0KPj4+Pj4+PiBjYXJyaWVkIGluIEZyb20pIGlzIHVz ZWQgZm9yIGRpc3BsYXkgcHVycG9zZXMuDQo+Pj4+Pj4+IA0KPj4+Pj4+PiAgIE9ubHkgdGhlIGNh cnJpZXIgaGFzIHRoZSBhdXRob3JpdHkgdG8gc2V0IHRoZSBOZXR3b3JrIE51bWJlcg0KPj4+Pj4+ PiBzbyBvbmx5IHRoZXkgY291bGQgc2lnbiBpdC4NCj4+Pj4+Pj4gDQo+Pj4+Pj4+ICAgQnV0IC0g c3ViamVjdCB0byByZWd1bGF0b3J5IHJlc3RyaWN0aW9ucyB3aGljaCBhcmUgd2VsbA0KPj4+Pj4+ PiBkb2N1bWVudGVkDQo+Pj4+Pj4+IC0gdGhlIG51bWJlciBzZW50IGZvciBkaXNwbGF5IHB1cnBv c2VzIGJlbG9uZ3MgdG8gdGhlIGN1c3RvbWVyLg0KPj4+Pj4+PiBGb3IgYmx1ZS1jaGlwIGN1c3Rv bWVycywgSSBjYW4gYWxsb3cgdGhlbSB0byBzZW5kIHRoZWlyDQo+Pj4+Pj4+IFByZXNlbnRhdGlv biBOdW1iZXJzIGludG8gdGhlIG5ldHdvcmssIGFuZCBjYW4ndCByZWFkaWx5IGNoZWNrIGF0DQo+ Pj4+Pj4+IGEgbmV0d29yayBsZXZlbCB0aGF0IHRoZXkncmUgdGhlaXJzIChJIGRvIGhhdmUgY29u dHJhY3R1YWwNCj4+Pj4+Pj4gc2FmZWd1YXJkcykuICBUaGUgbnVtYmVyIG1heSBoYXZlIGJlZW4g YWxsb2NhdGVkIGJ5IG1lLCBvciBjb3VsZA0KPj4+Pj4+PiBiZSBhbGxvY2F0ZWQgYnkgYSB0aGly ZCBwYXJ0eSBwcm92aWRlci4gIElmIGl0J3MgYSBjYWxsLWNlbnRyZQ0KPj4+Pj4+PiB0aGV5J2xs IGJlIG1ha2luZyBvdXRib3VuZCBjYWxscyBmb3IgbG90cyBvZiBkaWZmZXJlbnQgY3VzdG9tZXJz DQo+Pj4+Pj4+IHdoaWNoIHdpbGwgY2hhbmdlIG9uIGRheS1ieS1kYXkNCj4+PiBiYXNpcy4NCj4+ Pj4+Pj4gVGhpcyBpcyBidXNpbmVzcyBhcyB1c3VhbC4gIEkgZG9uJ3QgbGlrZSB0aGUgdGVybSAi YXV0aG9yaXNlZA0KPj4+Pj4+PiBzcG9vZmluZyIgYmVjYXVzZSBpdCBpbXBsaWVzIHRoYXQgdGhl IENMSSBpcyBpbiBzb21lIHdheSBiZWluZyByaWdnZWQ6DQo+Pj4+Pj4+IGl0J3Mgbm90LCBpdCdz IHRoZSBjb3Jwb3JhdGUgY3VzdG9tZXIgb3IgdGhlaXIgc3ViY29udHJhY3Rvcg0KPj4+Pj4+PiB1 c2luZyB0aGUgbnVtYmVyIHRoYXQncyBiZWVuIGFzc2lnbmVkIChzbyBpbiBpbnRlcm5ldCB0ZXJt cw0KPj4+Pj4+PiBkZWxlZ2F0ZWQpIHRvIHRoZW0gdmlhIGEgY2hhaW4gb2YgdHJ1c3QgZnJvbSB0 aGUgcmVndWxhdG9yLg0KPj4+Pj4+PiANCj4+Pj4+Pj4gICBXaGF0IEkgd2FudCBpcyB0aGUgYWJp bGl0eSBmb3IgY3VzdG9tZXJzIHRvIHVzZSB0aGVpcg0KPj4+Pj4+PiBjcmVkZW50aWFscyAgdG8g c2lnbiB0aGUgQ0xJcyB0aGV5IHNlbmQgbWUgc28gdGhhdCBhdCB0aGUNCj4+Pj4+Pj4gdGVybWlu YXRpbmcgZW5kIGl0IGNhbiAgYmUgY2hlY2tlZCAob3IgaW5kZWVkIHNvbWV3aGVyZSBlbi1yb3V0 ZQ0KPj4+Pj4+PiBpZiB0aGF0J3MgdGhlIGJ1c2luZXNzIG1vZGVsKS4NCj4+Pj4+Pj4gSSBjYW4g YW5kIHdvdWxkIHNpZ24gZm9yIGN1c3RvbWVycyBvbiBteSBtb2JpbGUgYnVzaW5lc3Mgc2luY2UN Cj4+Pj4+Pj4gSSdtIGRyaXZpbmcgd2hhdCBudW1iZXIgaXMgcHJlc2VudGVkLCBidXQgdGhhdCdz IGJ5LXRoZS1ieQ0KPj4+Pj4+PiBiZWNhdXNlIHRoZXkgYXJlbid0IHRoZSBvbmVzIHdobyBnZW5l cmF0ZSBtaWxsaW9ucyBvZiBudWlzYW5jZQ0KPj4+Pj4+PiBjYWxscy4gIElmIHRoZSBzaWduaW5n IG9ubHkgb2NjdXJzIGF0IHRoZSBvcmlnaW5hdGluZyBjYXJyaWVyDQo+Pj4+Pj4+IGxldmVsIGZv ciBjb3Jwb3JhdGUvY2FsbC1jZW50cmUgY3VzdG9tZXJzIHRoYXQncyBubyB1c2UgYmVjYXVzZQ0K Pj4+Pj4+PiBJJ20gbm90IGluIGEgcG9zaXRpb24gdG8gZG8gdGhhdCBmb3IgdGhlc2UgdHlwZSBv Zg0KPj4+Pj4+PiBjdXN0b21lcnMuLi5hbmQgdGhlIHdob2xlIHN5c3RlbSBiZWNvbWVzIGEgd2Fz dGUgb2YgdGltZS4gSSdkDQo+Pj4+Pj4+IGFsc28gaGlnaGxpZ2h0IHRoZXJlIGFyZSBtYW55IG1v cmUgb2YgbXkgbGFyZ2UgY3VzdG9tZXJzIHRoYXQgSSdkDQo+Pj4+Pj4+IHRydXN0IG1vcmUgdGhh biBhIGZhciBlbmQgb3JpZ2luYXRpbmcgY2FycmllciB0aGF0IGNvdWxkIGJlDQo+Pj4+Pj4+IGFu eXdoZXJlIGluIHRoZSB3b3JsZCAodGhvdWdoIHdlIGhhdmUgbm8gc2hvcnRhZ2Ugb2Ygc21hbGwN Cj4+Pj4+Pj4gY2FycmllcnMgdGhhdCBJIHdvdWxkbid0IGtub3cgZnJvbSBBZGFtIG1vcmUgbG9j YWxseSBpbiB0aGUNCj4+Pj4+Pj4gVUsuLi4uKQ0KPj4+Pj4+PiANCj4+Pj4+Pj4gICBSZWdhcmRz DQo+Pj4+Pj4+IA0KPj4+Pj4+PiAgIFBhdWwNCj4+Pj4+Pj4gDQo+Pj4+Pj4+ICAgLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4+Pj4gICBGcm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3Vu Y2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgUGF1bCBLeXppdmF0DQo+Pj4+Pj4+ICAgU2VudDog MDQgQXVndXN0IDIwMTYgMjM6MTINCj4+Pj4+Pj4gICBUbzogQnJpYW4gUm9zZW4NCj4+Pj4+Pj4g ICBDYzogc3RpckBpZXRmLm9yZw0KPj4+Pj4+PiAgIFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0 NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+IA0KPj4+Pj4+Pj4gICBPbiA4LzQvMTYgNjowMiBQ TSwgQnJpYW4gUm9zZW4gd3JvdGU6DQo+Pj4+Pj4+PiBJIHRoaW5rIGl0J3Mgbm90IGEgZGVsZWdh dGlvbi4gIFRoZSBtb2JpbGUgcGhvbmUgaXMgbm90IGJlaW5nDQo+Pj4+Pj4+PiBkZWxlZ2F0ZWQg dGhlIFROLCBpdCdzIGJlaW5nIGF1dGhvcml6ZWQgdG8gcGxhY2UgY2FsbHMgdGhhdCBhcmUNCj4+ Pj4+Pj4+IG5vdA0KPj4+Pj4+Pj4gZnJvbSB0aGF0IFROLCBidXQgYXBwZWFyIHRvIGJlLg0KPj4+ Pj4+Pj4gDQo+Pj4+Pj4+PiBUaGUgbWVjaGFuaXNtIHRvIGhhbmRsZSB0aGUgY3JlZGVudGlhbCBp cyBleGFjdGx5IHRoZSBzYW1lIGFzIGENCj4+Pj4+Pj4+IGRlbGVnYXRpb24sIHNvIGlmIHlvdSB3 YW50IHRvIGNhbGwgaXQgZGVsZWdhdGlvbiwgZ28gYWhlYWQsIGJ1dA0KPj4+Pj4+Pj4gSSBwcmVm ZXIgdG8gY2FsbCBpdCBhdXRob3JpemVkIHNwb29maW5nLg0KPj4+Pj4+PiANCj4+Pj4+Pj4gICBJ SVVDIHRoZSBkZWxlZ2F0aW9uIGlzIHRvIGEgcmVzcG9uc2libGUgZW50aXR5IChzb21ldGhpbmcg dGhhdA0KPj4+Pj4+PiBjYW4gYmUgaGVsZCBsZWdhbGx5IGFjY291bnRhYmxlIC0gZS5nLiBhIHBl cnNvbiksIG5vdCB0byBhIGRldmljZS4NCj4+Pj4+Pj4gVGhlIGVudGl0eSBjYW4gdGhlbiAidXNl IiB0aGUgY3JlZGVudGlhbCB2aWEgYW55IGRldmljZShzKSBpdA0KPj4+Pj4+PiBjaG9vc2VzLiBJ biB0aGUgY2FzZSBvZiB0aGUgbW9iaWxlLCB0aGUgZGV2aWNlIHRoZW4gYmVjb21lcyBhDQo+Pj4+ Pj4+IHR3by1saW5lDQo+Pj4gcGhvbmUuDQo+Pj4+Pj4+IA0KPj4+Pj4+PiAgIFRoYW5rcywNCj4+ Pj4+Pj4gICBQYXVsDQo+Pj4+Pj4+IA0KPj4+Pj4+Pj4gQnJpYW4NCj4+Pj4+Pj4+IA0KPj4+Pj4+ Pj4+IE9uIEF1ZyA0LCAyMDE2LCBhdCA1OjUxIFBNLCBQYXVsIEt5eml2YXQNCj4+Pj4+Pj4+PiA8 cGt5eml2YXRAYWx1bS5taXQuZWR1Pg0KPj4+Pj4+Pj4+IHdyb3RlOg0KPj4+Pj4+Pj4+IA0KPj4+ Pj4+Pj4+IE9uIDgvNC8xNiA1OjQzIFBNLCBCcmlhbiBSb3NlbiB3cm90ZToNCj4+Pj4+Pj4+Pj4g SW4gbXkgamFyZ29uIGFuICJhdXRob3JpemVkIHNwb29mZXIiIGlzIHRoZSBkb2N0b3Igd2hvIGlz DQo+Pj4+Pj4+Pj4+IGNhbGxpbmcgIGZyb20gaGlzIG1vYmlsZSwgYnV0IHNlbmRpbmcgdGhlIFRO IG9mIGhpcyBvZmZpY2UNCj4+Pj4+Pj4+Pj4gcGhvbmUgYXMgY2FsbGluZyBwYXJ0eS4NCj4+Pj4+ Pj4+Pj4gVGhlIGRlbGVnYXRpb24gdG8gaGlzIG9mZmljZSBwaG9uZSB3YXMgbWFkZSBieSBoaXMg bGFuZGxpbmUNCj4+Pj4+Pj4+Pj4gY2FycmllciB0byBoaW0uICBIZSB0aGVuIGNyZWF0ZXMgYW5v dGhlciBjcmVkZW50aWFsLCB3aGljaCBoZQ0KPj4+Pj4+Pj4+PiBzaWducyB3aXRoIGhpcyBvZmZp Y2UgcGhvbmUgY3JlZGVudGlhbCB0aGF0IGF1dGhvcml6ZXMgaGlzDQo+Pj4+Pj4+Pj4+IG1vYmls ZSB0byBzZW5kIGNhbGxzIGZyb20gaGlzIG9mZmljZSBudW1iZXIuICBIZSBpcyBzcG9vZmluZw0K Pj4+Pj4+Pj4+PiAoYmVjYXVzZSB0aGUgY2FsbCBpcyBjb21pbmcgZnJvbSBoaXMgbW9iaWxlJ3Mg VE4gYnV0IGNsYWltcyB0bw0KPj4+Pj4+Pj4+PiBiZSBmcm9tIGhpcyBvZmZpY2UpLCBidXQgaXQn cyBhdXRob3JpemVkIHNwb29maW5nLiAgVGhlIGRvYw0KPj4+Pj4+Pj4+PiBjb3VsZCBnaXZlIHRo ZSBjcmVkZW50aWFsIHRvIGhpcyBtb2JpbGUgU1AgaWYgdGhleSBzaWduIG9uIGhpcyBiZWhhbGYu DQo+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4gSSBkb24ndCB1bmRlcnN0YW5kIGhvdyB0aGF0IGlzIGRp ZmZlcmVudCBmcm9tIHJlZ3VsYXIgZGVsZWdhdGlvbi4NCj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+PiBX aGVuIGhpcyBsYW5kbGluZSBjYXJyaWVyIGdhdmUgaGltIGEgZGVsZWdhdGVkIGNlcnRpZmljYXRl IGZvcg0KPj4+Pj4+Pj4+IGhpcyBsYW5kbGluZSBudW1iZXIsIGhlIHNob3VsZCBiZSBhYmxlIHRv IGluc3RhbGwgdGhhdCBpbg0KPj4+Pj4+Pj4+IHdoYXRldmVyIGRldmljZXMgaGUgd2FudHMgLSBo aXMgbGFuZGxpbmUgVUEsIGhpcyBtb2JpbGUgcGhvbmUsDQo+Pj4+Pj4+Pj4gZXRjLiBJdCBpcyBz dGlsbCBkZWxlZ2F0ZWQgZnJvbSBoaXMgbGFuZGxpbmUgY2FycmllciwgZXZlbiB3aGVuDQo+Pj4+ Pj4+Pj4gdXNlZCB3aXRoIGNhbGxzIHZpYSBoaXMgbW9iaWxlIGNhcnJpZXIuDQo+Pj4+Pj4+Pj4g DQo+Pj4+Pj4+Pj4gVGhhbmtzLA0KPj4+Pj4+Pj4+IFBhdWwNCj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+ Pj4gU29tZSBmb2xrcyBkb24ndCBsaWtlIGF0dGFjaGluZyB0aGUgInNwb29maW5nIiBsYWJlbCB0 byBhDQo+Pj4+Pj4+Pj4+IGxlZ2l0aW1hdGUgdXNlLg0KPj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4g QnV0IHRoYXQncyBob3cgSSBkZXNjcmliZSBpdC4NCj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+IEJy aWFuDQo+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4gT24gQXVnIDQsIDIwMTYsIGF0IDU6MzcgUE0s IFBhdWwgS3l6aXZhdA0KPj4+Pj4+Pj4+Pj4gPHBreXppdmF0QGFsdW0ubWl0LmVkdSA8bWFpbHRv OnBreXppdmF0QGFsdW0ubWl0LmVkdT4+IHdyb3RlOg0KPj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+ PiArMSwgYnV0IHdpdGggb25lIHF1ZXN0aW9uIGJlbG93Og0KPj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+ Pj4+Pj4gT24gOC80LzE2IDU6MTQgUE0sIEJyaWFuIFJvc2VuIHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+ IEkgdGhpbmsgYWxsIHdlIG5lZWQgaXMgdG8gaGF2ZSBjcmVkZW50aWFscyBmb2xsb3cgdGhlDQo+ Pj4+Pj4+Pj4+Pj4gZGVsZWdhdGlvbiBwYXRoLA0KPj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4g cGx1cyB0aGUgb3B0aW9uIHRvIGFkZCBhbm90aGVyIGxldmVsIChub3QgZGVsZWdhdGlvbikgZm9y DQo+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXplZCBzcG9vZmVycy4NCj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+ Pj4+Pj4gSSBkb24ndCB1bmRlcnN0YW5kICJhdXRob3JpemVkIHNwb29mZXJzIiBpbiB0aGlzIGNv bnRleHQsIGFzDQo+Pj4+Pj4+Pj4+PiBjb250cmFzdGVkIHRvICJzcG9vZmVycyIgd2hvIGhhdmUg YmVlbiBkZWxlZ2F0ZWQgdGhlaXINCj4+PiBhdXRob3JpdHkuDQo+Pj4+Pj4+Pj4+PiANCj4+Pj4+ Pj4+Pj4+IFRoYW5rcywNCj4+Pj4+Pj4+Pj4+IFBhdWwNCj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+ Pj4+IEkgZG9uJ3QgdGhpbmsgaXQgbWF0dGVycyB3aG8gdGhlIGRlbGVnYXRvciBvciBkZWxlZ2F0 ZWUgYXJlDQo+Pj4+Pj4+Pj4+Pj4gYXMgbG9uZyBhcyB0aGUgZGVsZWdhdG9yIGlzIHdpbGxpbmcg dG8gdGFrZSB0aGUgaGVhdCBmb3INCj4+Pj4+Pj4+Pj4+PiBkZWxlZ2F0aW5nIHRvIHNvbWVvbmUg d2hvIHNlbmRzIGEgbG90IG9mIGJhZCBjYWxscy4gIFRoZXkNCj4+Pj4+Pj4+Pj4+PiBjYW4gcGFz cyB0aGUgYnVjayAoIkkgZGVsZWdhdGVkIHRoZSBUTiB0byBoaW0sIGFuZCBub3cgSSdtDQo+Pj4+ Pj4+Pj4+Pj4gbm90IHJlc3BvbnNpYmxlIiksIGJ1dCBvbmx5IGlmIHRoZSBTUCBrbm93cyB3aG8g dGhleQ0KPj4+Pj4+Pj4+Pj4+IGRlbGVnYXRlZCB0bywgc28gYXV0aG9yaXRpZXMgY2FuIGZvbGxv dyB0aGUgZGVsZWdhdGlvbiBwYXRoLg0KPj4+Pj4+Pj4+Pj4+IFRoZXJlIGFyZSBwbGVudHkgb2Yg Y2VydGlmaWNhdGVkIGNhcnJpZXJzIHdobyBhcmUgd2lsbGluZyB0bw0KPj4+Pj4+Pj4+Pj4+IG5v dCBjYXJlIHdobyB0aGV5IGRlbGVnYXRlIHRvLiAgVGhlIGZhY3QgdGhhdCB0aGVyZSBhcmUgc29t ZQ0KPj4+Pj4+Pj4+Pj4+IHdobyBkbyBkb2Vzbid0IGNoYW5nZSBtdWNoLg0KPj4+Pj4+Pj4+Pj4+ IE1ha2luZyBzdGlyIHdvcmsgbWVhbnMga25vd2luZyB3aG8geW91IGFyZSBkZWxlZ2F0aW5nIHRv LCBzbw0KPj4+Pj4+Pj4+Pj4+IHRoYXQgeW91IGNhbiBwYXNzIHRoZSBob3QgcG90YXRvLg0KPj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+IEl0J3MgcGVyZmVjdGx5IHJlYXNvbmFibGUgZm9yIGEg Y2FycmllciB0byBiZSBhYmxlIHRvIHNpZ24NCj4+Pj4+Pj4+Pj4+PiBmb3IgYW55IGNhbGxzIHBs YWNlZCBvbiBpdHMgbmV0d29yayBvbiBhbnkgbnVtYmVyIGl0IGhhcw0KPj4+Pj4+Pj4+Pj4+IGJl ZW4gZGVsZWdhdGVkLg0KPj4+Pj4+Pj4+Pj4+IElmIGl0IGRvZXMsIGl0J3MgYXNzZXJ0aW5nIHRo YXQgdGhlIGNhbGxzIGFyZSBmcm9tIHdobyB0aGV5DQo+Pj4+Pj4+Pj4+Pj4gYXJlIHN1cHBvc2Vk IHRvIGJlIGZyb20uDQo+Pj4+Pj4+Pj4+Pj4gVGhhdCBzaG91bGQgYmUgc3RyYWlnaHRmb3J3YXJk LCBidXQgd2Uga25vdyBpdCdzIG5vdCBhbHdheXMsDQo+Pj4+Pj4+Pj4+Pj4gYW5kIHRoYXQgcmVw cmVzZW50cyB0aGUgaGFyZCBwYXJ0IG9mIGRlcGxveW1lbnQgaW4gbXkgb3Bpbmlvbi4NCj4+Pj4+ Pj4+Pj4+PiBCdXQgb25jZSB0aGV5IGRlbGVnYXRlLCB0aGV5IGNhbiBoYW5kIHJlc3BvbnNpYmls aXR5IHRvIHNpZ24NCj4+Pj4+Pj4+Pj4+PiB0byAgdGhlIGRlbGVnYXRlZS4gIEJ1dCwgdGhhdCBv bmx5IHdvcmtzIGlmIHRoZXkga25vdyB3aG8NCj4+Pj4+Pj4+Pj4+PiB0aGV5IGFyZSBkZWxlZ2F0 aW5nIHRvLg0KPj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+IFRoZSByb290IG9mIHRoZSB3aG9s ZSBtb2RlbCBpcyB0aGF0IHRoZXJlIGlzIGEgZm9ybWFsIG9yDQo+Pj4+Pj4+Pj4+Pj4gaW5mb3Jt YWwgZGVsZWdhdGlvbiBwYXRoIGZvciB0ZWxlcGhvbmUgbnVtYmVycyBpbiBldmVyeQ0KPj4+Pj4+ Pj4+Pj4+IGNvdW50cnksIGFuZCB3ZSBjYW4gYnVpbGQgYSBjaGFpbiBvZiB0cnVzdCBmcm9tIHRo YXQNCj4+Pj4+Pj4+Pj4+PiBkZWxlZ2F0aW9uIHBhdGguICBJZiB5b3UgcHJvcG9zZSB0byBhbHRl ciB0aGF0IG1vZGVsLCB0aGVuDQo+Pj4+Pj4+Pj4+Pj4gd2UgZ2V0IGludG8NCj4+Pj4+Pj4+Pj4+ PiAocG9saWN5KSBpc3N1ZXMgb2Ygd2hpY2ggY2FycmllcnMvZW50aXRpZXMgd2UgdHJ1c3QgYW5k DQo+Pj4+Pj4+Pj4+Pj4gd2hpY2ggd2UgZG9uJ3QuDQo+Pj4+Pj4+Pj4+Pj4gT3VyIG1vZGVsIGlz IHRoYXQgeW91IGtub3cgd2hvIHlvdSBkZWxlZ2F0ZSB0bywgYW5kIG9uY2UgeW91DQo+Pj4+Pj4+ Pj4+Pj4gZG8gdGhhdCBkZWxlZ2F0aW9uLCBpdCdzIHRoZWlyIHByb2JsZW0uDQo+Pj4+Pj4+Pj4+ Pj4gVGhhdCdzIHByZXR0eSBhcHBlYWxpbmcgSSB0aGluaywgZXZlbiBpZiBpdCdzIGEgY2hhbmdl IGluDQo+Pj4+Pj4+Pj4+Pj4gc29tZSBidXNpbmVzcyBwcmFjdGljZXMuDQo+Pj4+Pj4+Pj4+Pj4g DQo+Pj4+Pj4+Pj4+Pj4gVGhlIG1lY2hhbmlzbSBpcyBjaGFpbmluZyBjcmVkZW50aWFscyBpbiBh IGZvcm0gb2YgYSBQS0kgYW5kDQo+Pj4+Pj4+Pj4+Pj4gaGF2aW5nIGEgd2F5IHRvIGtub3cgd2hp Y2ggVE5zIGFyZSBjb3ZlcmVkIGJ5IGEgY3JlZGVudGlhbC4NCj4+Pj4+Pj4+Pj4+PiBUaGF0J3Mg d2hhdCB3ZSBoYXZlLCBhbmQgSSdtIGxvYXRoIHRvIGNoYW5nZSBpdC4NCj4+Pj4+Pj4+Pj4+PiAN Cj4+Pj4+Pj4+Pj4+PiBCcmlhbg0KPj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+ Pj4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNDo1MyBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RP XQ0KPj4+Pj4+Pj4+Pj4+PiA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+Pj4gPG1haWx0bzpQ aWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdv cm1hbkBzcHJpbnQuY29tPj4NCj4+Pj4+Pj4+Pj4+Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+Pj4+IA0K Pj4+Pj4+Pj4+Pj4+PiBPSywgeW91IHRhbGtlZCBtZSBpbnRvIGluZHVsZ2luZyBpbiBvbmUgbW9y ZSBtZXNzYWdlIG9uDQo+Pj4+Pj4+Pj4+Pj4+IHBvbGljeSBhbmQgdXNlIGNhc2VzLg0KPj4+Pj4+ Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gSSBhZ3JlZSB0aGF0IHRoZSBTVElSL1BBU1Nwb3JUIG1l Y2hhbmlzbXMgY291bGQgYmUgZGVwbG95ZWQNCj4+Pj4+Pj4+Pj4+Pj4gb24gIGluZGl2aWR1YWwg ZGV2aWNlcyBhcyB3ZWxsIGFzIG11bHRpLWRldmljZSBhbmQNCj4+Pj4+Pj4+Pj4+Pj4gbXVsdGkt bnVtYmVyIHBsYXRmb3Jtcy4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IE51bWJlciBk ZWxlZ2F0aW9uIChhbmQgc3ViLWRlbGVnYXRpb24pLCBhbmQgYnVzaW5lc3MNCj4+Pj4+Pj4+Pj4+ Pj4gcmVsYXRpb25zaGlwcyBhcmUgdHdvIGFkZGl0aW9uYWwgZmFjdG9ycyB3aGljaCBhZmZlY3QN Cj4+Pj4+Pj4+Pj4+Pj4gdHJ1c3R3b3J0aGluZXNzIG9mIGEgZ2l2ZW4gY2FsbGluZyBudW1iZXIg YXV0aGVudGljYXRpb24uDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBJbmhlcmVudCB2 YXJpYWJsZSB0cnVzdHdvcnRoaW5lc3Mgb2YgYSBjYWxsaW5nIG51bWJlciB3YXMNCj4+Pj4+Pj4+ Pj4+Pj4gbXkgcmVhc29uIGZvciBzdWdnZXN0aW5nIGEgd2F5IHRvIHF1YWxpZnkgdGhlIHNpZ25h dHVyZSB0bw0KPj4+Pj4+Pj4+Pj4+PiByZWZsZWN0IHRoYXQgdmFyaWFiaWxpdHkuDQo+Pj4+Pj4+ Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBPcmlnaW5hdGluZyBjYXJyaWVycyBhcmUgaW4gYSBwb3Np dGlvbiB0byBrbm93IGlmIGEgY2FsbCBpcw0KPj4+Pj4+Pj4+Pj4+PiBjb21pbmcgZnJvbSBhIGRl dmljZSBhc3NpZ25lZCBhIHNpbmdsZSBudW1iZXIsIG9yIGZyb20NCj4+Pj4+Pj4+Pj4+Pj4gInRy dW5rIGdyb3VwIiB3aGljaCBjb3VsZCBvcmlnaW5hdGUgY2FsbHMgdXNpbmcgbXVsdGlwbGUNCj4+ Pj4+Pj4+Pj4+Pj4gbnVtYmVycywgYW5kIGNhbiBxdWFsaWZ5IHRvIHNvbWUgZGVncmVlIHRoZSB0 cnVzdHdvcnRoaW5lc3MNCj4+Pj4+Pj4+Pj4+Pj4gb2YgbnVtYmVyIGF1dGhlbnRpY2l0eSBhY2Nv cmRpbmdseS4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IE15IHN1Z2dlc3Rpb24gd2Fz IHF1YWxpZnlpbmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljaXR5DQo+Pj4+Pj4+Pj4+Pj4+IGlu dG8gY2F0ZWdvcmllcyBvZiBjYXJyaWVyLXNpZ25lZCAob3Igbm90KSwgYW5kDQo+Pj4+Pj4+Pj4+ Pj4+IHVuYXV0aGVudGljYXRlZCwgc2VtaS1hdXRoZW50aWNhdGVkLCBhbmQNCj4+Pj4+Pj4+Pj4+ Pj4gbW9zdC1hdXRoZW50aWNhdGVkLiAgVGhlcmUgY2FuIGJlDQo+Pj4gbW9yZQ0KPj4+Pj4+Pj4+ Pj4+PiBncmFudWxhcml0eSwgYnV0IGl0IGltcGxpZXMgYWRkaXRpb25hbCBvcGVyYXRpb25hbA0K Pj4+Pj4+Pj4+Pj4+PiBjb21wbGV4aXR5IChib3RoIGZvciB0aGUgY2FycmllcnMgYW5kIHRoZSBj b25zdW1lcnMpIGFuZCBJDQo+Pj4+Pj4+Pj4+Pj4+IGFzc3VtZSBkaW1pbmlzaGVzIHZhbHVlLg0K Pj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gTXkgcmVhc29uIGZvciBhZGRpbmcgdGhlIGF1 dGhlbnRpY2l0eSBvZiB0aGUgb3JpZ2luYXRpbmcNCj4+Pj4+Pj4+Pj4+Pj4gY2FycmllciBpcyB0 eXBpY2FsIHRydXN0d29ydGhpbmVzcyBvZiBhIGNhcnJpZXIgYnVzaW5lc3MNCj4+Pj4+Pj4+Pj4+ Pj4gcmVsYXRpb25zaGlwIHdpdGggdHlwaWNhbCBjb25zdW1lcnMgYWRkcyB0byB0aGUNCj4+Pj4+ Pj4+Pj4+Pj4gdHJ1c3R3b3J0aGluZXNzIGFzc2Vzc21lbnQgYW5kIHBhcnRpYWxseSBiZWNhdXNl IGNhcnJpZXJzDQo+Pj4+Pj4+Pj4+Pj4+IGFyZSBhIHJlZ3VsYXRlZCBwb2ludCBvZiBmb3JlbnNp YyBpbnF1aXJ5IGZvciBDQUxFQSBhbmQgZnJhdWQuDQo+Pj4+Pj4+Pj4+Pj4+IEFkZGl0aW9uYWxs eSwgbW9zdCBjYWxscyBvcmlnaW5hdGUgYW5kIHRlcm1pbmF0ZSBiZXR3ZWVuDQo+Pj4+Pj4+Pj4+ Pj4+IG1vYmlsZSBjb25zdW1lcnMgd2hlcmUgdGhlaXIgY2FycmllcnMgYXJlIGFibGUgdG8gdXNl ZnVsbHkNCj4+Pj4+Pj4+Pj4+Pj4gYXV0aGVudGljYXRlIHRoZWlyIGRldmljZSBhbmQgaGF2ZSBh IGhpZ2ggZGVncmVlIG9mDQo+Pj4+Pj4+Pj4+Pj4+IGNvbmZpZGVuY2Ugb2YgdGhlIGF1dGhlbnRp Y2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIuDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+ PiBJIHRoaW5rIGJpbGxpb25zIG9mIHBlci1UTiBjZXJ0cyBvZiB2YXJ5aW5nIHVzYWJpbGl0eQ0K Pj4+Pj4+Pj4+Pj4+PiAocmV2b2tlZCwgbm90DQo+Pj4+Pj4+Pj4+Pj4+IHJldm9rZWQpIGZvciBh dXRoZW50aWNhdGluZyBjYWxsaW5nIG51bWJlciB3aWxsIG5vdCB3b3JrIHdlbGwuDQo+Pj4+Pj4+ Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBDb252ZXJzZWx5LCBJIHRoaW5rIGJpbGxpb25zIG9mIHBl ci1UTiBjZXJ0cyB3aWxsIHdvcmsNCj4+Pj4+Pj4+Pj4+Pj4gd2VsbCwgaWYgdGhlIGNhbGxpbmcg cGFydHkgaGFzIHRvIHNpZ24gYSBjYWxsIHdpdGggYSBwZXItVE4NCj4+Pj4+Pj4+Pj4+Pj4gY2Vy dCBwcm92aWRlZCBieSB0aGUgY2FsbGVkIHBhcnR5LiAgTm8gY2FsbGVkIHBhcnR5IGNlcnQgdG8g aW5jbHVkZT8NCj4+Pj4+Pj4+Pj4+Pj4gVGhlbiB0aGUgY2FsbGluZyBwYXJ0eSBkb2VzIG5vdCBo YXZlIGEgdHJ1c3RlZCByZWxhdGlvbnNoaXANCj4+Pj4+Pj4+Pj4+Pj4gd2l0aCB0aGUgY2FsbGVk IHBhcnR5LCBhbmQgdGhlIGNhbGwgY2FuIGJlDQo+Pj4+Pj4+Pj4+Pj4+IGF1dGhvcml6ZWQvdHJl YXRlZCBhY2NvcmRpbmdseS4NCj4+Pj4+Pj4+Pj4+Pj4gKEkndmUgbWFkZSBzaW1pbGFyLCBtb3N0 bHkgaWdub3JlZCBjb21tZW50cyBpbiBNT0RFUk4uKQ0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+ Pj4+Pj4gUGllcmNlDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAqRnJvbToqIEJyaWFu IFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+Pj4+Pj4+Pj4+Pj4+ICpTZW50Oiog QXVndXN0IDA0LCAyMDE2IDI6MDMgUE0NCj4+Pj4+Pj4+Pj4+Pj4gKlRvOiogR29ybWFuLCBQaWVy Y2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWls dG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJj ZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+Pj4+ICpDYzoqIEFsZXggQm9ib3RlayA8 YWxleEBib2JvdGVrLm5ldA0KPj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+ IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+Ow0KPj4+Pj4+Pj4+Pj4+PiBzdGlyQGlldGYub3Jn IDxtYWlsdG86c3RpckBpZXRmLm9yZz4gPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+ Pj4+PiAqU3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBXZWxsLCB0aGUgbWVjaGFuaXNtcyBhcmUgZGVzaWdu ZWQgc28gdGhhdCB0aGV5IGNvdWxkIGJlDQo+Pj4+Pj4+Pj4+Pj4+IGRlcGxveWVkIG9uIGRldmlj ZXMgYW5kIFBCWHMuICBXaGV0aGVyIHRoZXkgd2lsbCBiZSBpcyBhDQo+Pj4+Pj4+Pj4+Pj4+IHBv bGljeSBpc3N1ZS4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IFRoZSBub3Rpb24gb2Yg Y3JlZGVudGlhbHMgdGhhdCBhcmUgdHJhY2VhYmxlIHRvIGENCj4+Pj4+Pj4+Pj4+Pj4gZGVsZWdh dGlvbiBvZiBhIFROIGlzIGEgbWVjaGFuaXNtIHRoYXQgaXMgcGFydCBvZiB0aGUNCj4+Pj4+Pj4+ Pj4+Pj4gZGVzaWduIG9mIHN0aXIsIGFuZCB0aGUgZGVzaWduIGFsbG93cyBkZWxlZ2F0aW9uIG9m IG9uZSBUTg0KPj4+Pj4+Pj4+Pj4+PiAodG8gb25lIGRldmljZSwgYWx0aG91Z2ggYSBkZXZpY2Ug bGlrZSBhIFBCWCB3b3VsZCBoYXZlDQo+Pj4+Pj4+Pj4+Pj4+IG1vcmUgdGhhbiBvbmUgVE4gcGVy ICJkZXZpY2UiLCBhbmQgc29tZXRoaW5nIGxpa2UgYSBkdWFsDQo+Pj4+Pj4+Pj4+Pj4+IE5BTSBw aG9uZSBjb3VsZCBoYXZlDQo+Pj4gbW9yZQ0KPj4+Pj4+Pj4+Pj4+PiB0aGFuIG9uZSBjcmVkZW50 aWFsLiAgRm9yIHRoZSB1c2UgY2FzZSB3ZSd2ZSBkaXNjdXNzZWQsIGENCj4+Pj4+Pj4+Pj4+Pj4g bW9iaWxlIHBob25lIG1heSBhbHNvIGhhdmUgYSBjcmVkZW50aWFsIGZvciwgc2F5LCBhIFROIHRo YXQNCj4+Pj4+Pj4+Pj4+Pj4gaXMgZGVsZWdhdGVkIHRvIGEgbGFuZGxpbmUsIHRvIGNvdmVyIHRo ZSBleGFtcGxlIGNhc2Ugb2YgYQ0KPj4+Pj4+Pj4+Pj4+PiBkb2N0b3IgcGxhY2luZyBhIGNhbGwg b24gaGlzIG1vYmlsZSwgYnV0IGdldHRpbmcgaGlzIG9mZmljZQ0KPj4+Pj4+Pj4+Pj4+PiBudW1i ZXIgdG8gc2hvdyB1cCBhcyB0aGUgY2FsbGluZyBwYXJ0eS4gIFVzZSBvZiBzdWNoIG1lY2hhbmlz bXMgaXMgcG9saWN5Lg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gQnJpYW4NCj4+Pj4+ Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwg YXQgMjo1MiBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4+Pj4+Pj4+PiA8UGllcmNl Lkdvcm1hbkBzcHJpbnQuY29tDQo+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+ DQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4+Pj4+ Pj4+Pj4+Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBUaGFua3MgQnJp YW4uICBJJ20gYWZyYWlkIHdlJ3JlIHN0cmF5aW5nIGludG8gYSBwb2xpY3kNCj4+Pj4+Pj4+Pj4+ Pj4gZGlzY3Vzc2lvbi4gIFJlZ2FyZGxlc3MsIEkgZG8gYXBwcmVjaWF0ZSB5b3VyIGV4cGxhbmF0 aW9uLg0KPj4+Pj4+Pj4+Pj4+PiBJIHdvdWxkIGxpa2UgdG8gY29udGludWUgdGhlIGRpc2N1c3Np b24sIGJ1dCBJJ20gcHJldHR5DQo+Pj4+Pj4+Pj4+Pj4+IHN1cmUgdGhpcyBpc24ndCB0aGUgcmln aHQgZm9ydW0uDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiBQaWVyY2UNCj4+Pj4+Pj4+ Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICpGcm9tOiogQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlh bnJvc2VuLm5ldF0NCj4+Pj4+Pj4+Pj4+Pj4gKlNlbnQ6KiBBdWd1c3QgMDQsIDIwMTYgMTozNCBQ TQ0KPj4+Pj4+Pj4+Pj4+PiAqVG86KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29y bWFuQHNwcmludC5jb20NCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmlu dC5jb20+DQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4N Cj4+Pj4+Pj4+Pj4+Pj4gKkNjOiogQWxleCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0DQo+Pj4+ Pj4+Pj4+Pj4+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4gPG1haWx0bzphbGV4QGJvYm90ZWsu bmV0Pj47DQo+Pj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0bzpzdGlyQGlldGYub3Jn PiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+Pj4+Pj4+Pj4+Pj4+ICpTdWJqZWN0OiogUmU6IFtz dGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+ Pj4+IE9mIGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBhcyBzbWFy dA0KPj4+Pj4+Pj4+Pj4+PiBwaG9uZXMgYW5kICBhbnkgb3RoZXIgZGV2aWNlcyB0aGF0IGNhbiBi ZSBwcm9ncmFtbWVkIHRvIGRvDQo+Pj4gc28uDQo+Pj4+Pj4+Pj4+Pj4+IFRoZXkgd2lsbCBiZSBn aXZlbiBjcmVkZW50aWFscyB0aGF0IG9ubHkgYXJlIHZhbGlkIGZvciB0aGUNCj4+Pj4+Pj4+Pj4+ Pj4gVE5zIHRoZXkgYXJlIGF1dGhvcml6ZWQgdG8gc2lnbiBmb3IuICBUaGV5IGNhbiB0cnkgdG8g c2lnbg0KPj4+Pj4+Pj4+Pj4+PiBhbnkgY2FsbCwgIGJ1dCB0aGUgdmFsaWRpdHkgb2YgdGhlIGNy ZWRlbnRpYWwgd291bGQgbWFrZQ0KPj4+Pj4+Pj4+Pj4+PiBzdWNoIGEgc2lnbmF0dXJlICBmYWls IHRoZSBjaGVja2luZy4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IEdldHRpbmcgc2Vy dmljZSBwcm92aWRlcnMgdG8gc2lnbiBvbiBiZWhhbGYgb2YgZGV2aWNlcyBpcw0KPj4+Pj4+Pj4+ Pj4+PiBhIHJlYXNvbmFibGUgd2F5IHRvIGRlcGxveSBxdWlja2x5LCBidXQgSSBleHBlY3QgbWFu eSBTUHMNCj4+Pj4+Pj4+Pj4+Pj4gd2lsbCB3YW50ICB0byBnZXQgb3V0IG9mIHRoZSBsaWFiaWxp dHkgb2Ygc2lnbmluZyBvbiBiZWhhbGYNCj4+Pj4+Pj4+Pj4+Pj4gb2YgdGhlaXIgY3VzdG9tZXJz LiAgSWYgdGhleSBjYW4gcHVzaCBvZiB0aGF0DQo+Pj4+Pj4+Pj4+Pj4+IHJlc3BvbnNpYmlsaXR5 IHRvIHRoZWlyIGN1c3RvbWVyLCBvbmx5IGJlaW5nIHJlc3BvbnNpYmxlDQo+Pj4+Pj4+Pj4+Pj4+ IGZvciBnZXR0aW5nIHRoZSBjdXN0b21lciBhbiBhcHByb3ByaWF0ZSBjcmVkZW50aWFsIHdoZW4N Cj4+Pj4+Pj4+Pj4+Pj4gdGhleSBhc3NpZ24gVE5zLCB0aGVuIEkgd291bGQgZXhwZWN0ICB0aGVt IHRvIHdhbnQgdG8gZG8NCj4+Pj4+Pj4+Pj4+Pj4gc28uICBUaGF0IG1lYW5zIHRoZSBkZXZpY2Vz IGhhdmUgdG8gYmUgYWJsZSB0byAgc2lnbiwgYnV0IEkNCj4+Pj4+Pj4+Pj4+Pj4gdW5kZXJzdGFu ZCBtYW55IG9mIHRoZSBQQlggdmVuZG9ycyB0aGluayB0aGF0J3MgIHNvbWV0aGluZw0KPj4+Pj4+ Pj4+Pj4+PiB0aGV5IGNvdWxkIHByb3ZpZGUgaW4gYSBmdXR1cmUgcmVsZWFzZS4NCj4+Pj4+Pj4+ Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IEJyaWFuDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+ PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgIE9uIEF1ZyA0LCAyMDE2LCBhdCAyOjIyIFBNLCBHb3JtYW4s IFBpZXJjZSBBIFtDVE9dDQo+Pj4+Pj4+Pj4+Pj4+ICAgICA8UGllcmNlLkdvcm1hbkBzcHJpbnQu Y29tDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPj4+ Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+ Pj4+ICAgICB3cm90ZToNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICBZb3Ugd2Fu dCBJUCBQQlhlcyB0byBzaWduIGNhbGxzPyAgV29uJ3QgdGhhdCBtYWtlIGl0DQo+Pj4+Pj4+Pj4+ Pj4+ICAgICBleHRyYW9yZGluYXJpbHkgZWFzeSB0byBjb21taXQgZnJhdWQgd2l0aA0KPj4+Pj4+ Pj4+Pj4+PiBhdXRoZW50aWNhdGVkIG51bWJlcnM/DQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+ Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICpGcm9tOiogQnJpYW4gUm9zZW4gW21haWx0bzpickBi cmlhbnJvc2VuLm5ldF0NCj4+Pj4+Pj4+Pj4+Pj4gICAgICpTZW50OiogQXVndXN0IDA0LCAyMDE2 IDEyOjI0IFBNDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAqVG86KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9d IDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20NCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2Uu R29ybWFuQHNwcmludC5jb20+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICA8bWFpbHRvOlBpZXJjZS5Hb3Jt YW5Ac3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAqQ2M6KiBBbGV4IEJvYm90ZWsgPGFs ZXhAYm9ib3Rlay5uZXQNCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pg0K Pj4+Pj4+Pj4+Pj4+PiAgICAgPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pj47IHN0aXJAaWV0Zi5v cmcNCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpzdGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0 Zi5vcmc+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAqU3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJUiA0NDc0 YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgRmlyc3Qg b2YgYWxsLCB3ZSB3b3VsZCB3YW50IHRoZSBQQlggdG8gZ2VuZXJhdGUgdGhlDQo+Pj4+Pj4+Pj4+ Pj4+IHNpZ25hdHVyZSwNCj4+Pj4+Pj4+Pj4+Pj4gICAgIGJ1dCB0aGUgc2VydmljZSBwcm92aWRl ciBjYW4gZG8gdGhhdC4gIEl0IHNob3VsZCBub3QgYWRkIGENCj4+Pj4+Pj4+Pj4+Pj4gICAgIHZh bGlkIHNpZ25hdHVyZSB0byBhIGNhbGwgZnJvbSBhIG51bWJlciBpdCBkaWQgbm90DQo+Pj4+Pj4+ Pj4+Pj4+IGFzc2lnbiB0bw0KPj4+Pj4+Pj4+Pj4+PiAgICAgdGhlIHRydW5rIGdyb3VwIGNvbm5l Y3RpbmcgdG8gdGhlIFBCWCwgYWx0aG91Z2ggaXQgY291bGQNCj4+Pj4+Pj4+Pj4+Pj4gICAgIHN1 cHBvcnQgdGhlIGV4dHJhIGRlbGVnYXRpb24gcmVxdWlyZWQgdG8gc3VwcG9ydA0KPj4+Pj4+Pj4+ Pj4+PiAiYXV0aG9yaXplZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgc3Bvb2ZpbmciLiAgVGhlIGNvbXBh bmlvbiBkZXZpY2VzIEknbSBhd2FyZSBvZiBhbHdheXMgc2VuZA0KPj4+Pj4+Pj4+Pj4+PiAgICAg Y2FsbHMgZnJvbSB0aGUgc2FtZSBzZXJ2aWNlIHByb3ZpZGVyIGFuZCBzaG91bGQgbm90IHByZXNl bnQNCj4+Pj4+Pj4+Pj4+Pj4gICAgIGFueSBpc3N1ZS4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICBFdmVyeW9uZSB3aWxsIGhhdmUgdG8gZG8gd29yayB0aGV5IGRvbid0IGRvIG5v dyB0bw0KPj4+Pj4+Pj4+Pj4+PiBpbXBsZW1lbnQNCj4+Pj4+Pj4+Pj4+Pj4gICAgIHN0b3Agc3Bv b2ZlZCBjYWxscy4gVEFOU1RBQUZMDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAg QnJpYW4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgIE9uIEF1ZyA0LCAyMDE2LCBhdCAxMjo0MSBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0K Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20NCj4+Pj4+Pj4+ Pj4+Pj4gPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+PiB3cm90ZToNCj4+Pj4+Pj4+ Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgRnJhdWQgZnJvbSBjb21wcm9taXNlZCBQQlhl cyBpcyBjb21tb24uICBBbmQgZXZlbg0KPj4+Pj4+Pj4+Pj4+PiB3aGVyZSBhDQo+Pj4+Pj4+Pj4+ Pj4+ICAgICAgICAgUEJYIGlzIG5vdCBjb21wcm9taXNlZCwgYSBjYXJyaWVyIGhhcyBubyBwcmFj dGljYWwNCj4+Pj4+Pj4+Pj4+Pj4gd2F5IG9mDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAga25vd2lu ZyB3aGV0aGVyIHRoZSBjYWxsaW5nIG51bWJlciBpcyBwcm9wZXJseSBhc3NpZ25lZA0KPj4+Pj4+ Pj4+Pj4+PiAgICAgICAgIGFuZCB2YWxpZCBmcm9tIHRoZSBwZXJzcGVjdGl2ZSBvZiB0aGUgRW50 ZXJwcmlzZS4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBUaGVyZWZvcmUsIGNoZWNraW5nIHdoZXRo ZXIgdGhlIGNhbGxpbmcgbnVtYmVyIHdhcw0KPj4+Pj4+Pj4+Pj4+PiBmcm9tIGFuDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgYXNzaWduZWQgcmFuZ2UgbWlnaHQgYmUgcG9zc2libGUgKGFuZCBmcmF1 Z2h0IHdpdGgNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBhZG1pbmlzdHJhdGl2ZSBjaGFsbGVuZ2Vz KSwgYnV0IG9mIGxpbWl0ZWQgdmFsdWUuDQo+Pj4+Pj4+Pj4+Pj4+IEFuZCBpbg0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgIHRoZSBjb25zdW1lciBtYXJrZXQsIHRoZXJlIGFyZSBjYWxsaW5nIHByb2R1 Y3RzIHdoaWNoDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgc3VwcG9ydCBhIHBhcmVudCBzdWJzY3Jp YmVyIG51bWJlciBhbmQgImNvbXBhbmlvbiINCj4+Pj4+Pj4+Pj4+Pj4gZGV2aWNlcw0KPj4+Pj4+ Pj4+Pj4+PiAgICAgICAgIChlLmcuLCB0YWJsZXRzKSB3aGljaCBjYW4gcGxhY2UgYSBjYWxsIHVz aW5nIHRoZSBNRE4gb2YNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICB0aGUgcGFyZW50IHN1YnNjcmli ZXIuICBUaGVzZSBhcmUgZXhhbXBsZXMgb2Ygd2hlcmUgdGhlDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgYXV0aGVudGljaXR5IG9mIHRoZSBjYWxsaW5nIG51bWJlciB3b24ndA0KPj4+Pj4+Pj4+Pj4+ PiBuZWNlc3NhcmlseSBtZWFuDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgdGhlIHNhbWUgdGhpbmcg YXMgdGhlIGF1dGhlbnRpY2l0eSBvZiBhIGNhbGwgZnJvbQ0KPj4+Pj4+Pj4+Pj4+PiBhIHNpbmds ZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIHN1YnNjcmliZXIgd2l0aCBhIHNpbmdsZSBNRE4gcmVn YXJkbGVzcyBvZiAibGF4aXR5IiBvZg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIHNwb29mIGNoZWNr aW5nLg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBJbiBhbm90aGVyIGZv cnVtIGFuZCBhbnRpY2lwYXRpbmcgY2FsbGluZyBudW1iZXINCj4+Pj4+Pj4+Pj4+Pj4gICAgICAg ICBhdXRoZW50aWNhdGlvbiBtYW5kYXRlcyBmcm9tIENvbmdyZXNzIGFuZC9vciBGQ0MsIEkNCj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICBzdWdnZXN0ZWQgdXNpbmcgY2Fycmllci1zcGVjaWZpYyBjZXJ0 cyBhbmQgZW5jb2RpbmcNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBzcGVjaWZpY2l0eSBvZiBhdXRo ZW50aWNpdHksIGFuZCBjYWxsaW5nIG51bWJlci4gIFRoaXMNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAg ICBwcm92aWRlcyB0aGUgaWRlbnRpdHkgb2YgdGhlIG9yaWdpbmF0aW5nIGNhcnJpZXIsIHNvbWUN Cj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBpZGVhIGFzIHRvIHRoZSBhY2N1cmFjeSBvciBzcGVjaWZp Y2l0eSBvZiB0aGUgY2FsbGluZw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIG51bWJlciwgYW5kIHZh bGlkdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyDQo+Pj4+Pj4+Pj4+Pj4+IChhc3N1bWluZyBub25j ZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIGFuZCByZXBsYXkgaXNzdWVzIGNhbiBiZSBhZGRyZXNz ZWQgYXMgcmVhc29uYWJseQ0KPj4+Pj4+Pj4+Pj4+PiBzdWdnZXN0ZWQNCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICBiZWxvdyBieSBBbGV4KS4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgVGhlIHJlcHJlc2VudGF0aW9uIG9mIG9yaWctY2FycmllciBhbmQgdHJ1c3R3b3J0aGlu ZXNzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgY291bGQgYmUgYXMgZm9sbG93czoNCj4+Pj4+Pj4+ Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgKlJlZ3VsYXRlZC9tYW5kYXRlZCBDYXJyaWVy IENsYXNzIFVzZSBDYXNlOioNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAg KjAwIC0gTm8gQ3JlZGVudGlhbHMqDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgVXNlIGNhc2UgZXhh bXBsZShzKTogUHJlLUlNUywgbGVnYWN5IGNpcmN1aXQtc3dpdGNoZWQNCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICBuZXR3b3JrcyB0aGF0IGRvbid0IG5hdGl2ZWx5IHN1cHBvcnQgU0lQIG9yIHdoaWNo IGRvbid0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgY2hvb3NlIHRvIHNpZ24gY2FsbHMuICBFLmcu LCBpbnRlcm5hdGlvbmFsIGNhcnJpZXJzLg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIFRydXN0IEVz dGltYXRlOiAgR29vZCBsdWNrLiAgQ2Fycmllcl9vcmlnIGFuZCBDZ1BODQo+Pj4+Pj4+Pj4+Pj4+ ICAgICAgICAgZW50aXJlbHkgdW50cnVzdHdvcnRoeS4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgKjAxIC0gQ2FycmllciBzaWduZWQsIG5vIGF1dGhlbnRpY2F0aW9uIG9m IENnUE4qDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgVXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBv biB2aXNpdGVkIG5ldHdvcmsgdy9vDQo+Pj4+Pj4+Pj4+Pj4+IHJvYW1pbmcNCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICBhZ3JlZW1lbnQsIG1hbnVhbCByb2FtaW5nLg0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgIFRydXN0IEVzdGltYXRlOiAgQ2Fycmllcl9vcmlnIHRydXN0d29ydGh5LCBDZ1BODQo+Pj4+ Pj4+Pj4+Pj4+IGVudGlyZWx5DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgdW50cnVzdHdvcnRoeQ0K Pj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAqMTAgLSBDYXJyaWVyIHNpZ25l ZCwgc2VtaS1hdXRoZW50aWNhdGVkIENnUE4qDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgVXNlIGNh c2UgZXhhbXBsZShzKTogTnVtYmVyIGJsb2NrIGRlbGVnYXRlZCBmcm9tDQo+Pj4+Pj4+Pj4+Pj4+ IE9DTiwgYnV0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgbm8gcGVyLVROIHNjcmVlbiAoU0lQIHRy dW5rcykuDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVyX29y aWcgdHJ1c3R3b3J0aHksIENnUE4NCj4+Pj4+Pj4+Pj4+Pj4gbGVzcyB0aGFuDQo+Pj4+Pj4+Pj4+ Pj4+ICAgICAgICAgbW9zdCB0cnVzdHdvcnRoeSBidXQgbm90IGVudGlyZWx5IHVudHJ1c3R3b3J0 aHkuDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICoxMSAtIENhcnJpZXIg c2lnbmVkLCBhdXRoZW50aWNhdGVkIENnUE4qDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgVXNlIGNh c2UgZXhhbXBsZShzKTogQnJlYWQtYW5kLWJ1dHRlciA5NSUrIG9mDQo+Pj4+Pj4+Pj4+Pj4+IGNh bGxzIGZyb20NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBzdWJzY3JpYmVyIGxpbmVzIChJTVMtYmFz ZWQgYW5kIG90aGVyd2lzZSkuDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6 ICBDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENnUE4gbW9zdA0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgIHRydXN0d29ydGh5DQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICpQ dWJsaWMgVXNlIENhc2U6Kg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBV bmRlZmluZWQgYnV0IGFzc3VtZWQgdG8gdXNlIHB1YmxpYyBvciBjb21tZXJjaWFsbHkNCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICBhdmFpbGFibGUgYXV0aGVudGljYXRpb24gc2VydmljZXMgcmVzb3Vy Y2VzLiAgZS5nLiwNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBub21vcm9iby1saWtlIGNyb3dkLXNv dXJjZWQgYWNjZXB0L2RlbnkgbGlzdHMsIGV0DQo+Pj4+Pj4+Pj4+Pj4+IGNldGVyYS4NCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICBDb3VsZC93b3VsZCBwYXNzIGNyZWRlbnRpYWxzIGRvd24gdG8gU0lQ LWF3YXJlIGRldmljZXMNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICB3aGljaCB3b3VsZCBwcm9jZXNz IHRoZW0gYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBvZiB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAg ICBQdWJsaWMgQ2xhc3MgYXBwbGljYXRpb24ocykuDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgIFBpZXJjZQ0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAqRnJvbToqIEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgKlNlbnQ6KiBBdWd1c3QgMDQsIDIwMTYgOTowMiBBTQ0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICpUbzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0KPj4+Pj4+ Pj4+Pj4+PiA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAg PG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pj4NCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAqQ2M6KiBz dGlyQGlldGYub3JnIDxtYWlsdG86c3RpckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0 bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICpTdWJqZWN0OiogUmU6IFtz dGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+ Pj4+ICAgICAgICAgVGhlcmUgYXJlIHJlYXNvbmFibGUgY2lyY3Vtc3RhbmNlcyB3aGVyZSBhIHBh cnR5DQo+Pj4+Pj4+Pj4+Pj4+IHBsYWNpbmcgYQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIGNhbGwg aXMgbm90IHRoZSBhdXRob3JpemVkIGVudGl0eSBhc3NpZ25lZCB0aGUNCj4+Pj4+Pj4+Pj4+Pj4g dGVsZXBob25lDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgbnVtYmVyIHVzZWQgaW4gRnJvbS9QQUks IGFuZCBpbiBzdWNoIGNpcmN1bXN0YW5jZXMgdGhlDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgc2Vy dmljZSBwcm92aWRlciBzZXJ2aWNpbmcgdGhlIGVudGl0eSBwbGFjaW5nIHRoZQ0KPj4+Pj4+Pj4+ Pj4+PiBjYWxsIG1heQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIG9yIG1heSBub3QgYmUgdGhlIHNh bWUgYXMgdGhlIHNlcnZpY2UgcHJvdmlkZXINCj4+Pj4+Pj4+Pj4+Pj4gc2VydmluZyB0aGUNCj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICBlbnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4uICBJbiBh bGwgc3VjaCBjYXNlcywgdGhlDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgZW50aXR5IHRoYXQgaXMg YXNzaWduZWQgdGhlIFROIGV4cGxpY2l0bHkNCj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXplcyBjYWxs cw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIHBsYWNlZCB1c2luZyBpdCdzIFROLiAgVGhlIGRlc2ln biBhY2NvbW1vZGF0ZXMgc3VjaCB1c2UNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBjYXNlcy4gIEl0 J3Mgbm90IGEgYmxhbmtldCBhdXRob3JpemF0aW9uIHdpdGhvdXQNCj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICBhdXRoZW50aWNhdGlvbi4gICBXZSdyZSBub3QgYXdhcmUgb2YgYW55IGNhc2VzIHdoZXJl DQo+Pj4+Pj4+Pj4+Pj4+IHRoZXJlDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgaXMgYW4gYWN0dWFs IHJlcXVpcmVtZW50IGZvciBsZWdpdGltYXRlIGNhbGxpbmcgd2l0aG91dA0KPj4+Pj4+Pj4+Pj4+ PiAgICAgICAgIGV4cGxpY2l0IGF1dGhvcml6YXRpb24gZnJvbSB0aGUgYXNzaWduZWQgZW50aXR5 LA0KPj4+Pj4+Pj4+Pj4+PiBhbHRob3VnaA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIHdlIGNlcnRh aW5seSBhcmUgYXdhcmUgdGhhdCB2YXJpb3VzIHBhcnRzIG9mIHZhcmlvdXMNCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICBzZXJ2aWNlIHByb3ZpZGVycyBkb24ndCBib3RoZXIgdG8gY2hlY2suIEF0IHRo aXMNCj4+Pj4+Pj4+Pj4+Pj4gcG9pbnQsIGF0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgbGVhc3Qg aW4gc29tZSBjb3VudHJpZXMsIHRoZXJlIGlzIGEgcmVhbGl6YXRpb24NCj4+Pj4+Pj4+Pj4+Pj4g dGhhdCB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBsYXhpdHkgb2YgYWxsb3dpbmcgdW5jaGVj a2VkIHNwb29maW5nIGlzIG5vdCBhY2NlcHRhYmxlDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgYW55 IG1vcmUuDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIEJyaWFuDQo+Pj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgT24g QXVnIDMsIDIwMTYsIGF0IDg6MzUgQU0sIEFsZXggQm9ib3Rlaw0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICAgICA8YWxleEBib2JvdGVrLm5ldCA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+DQo+Pj4+ Pj4+Pj4+Pj4+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+IHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+ PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgMS4gICAgICAgUGVybWl0IGF1dGhvcml6YXRp b24gd2l0aG91dA0KPj4+Pj4+Pj4+Pj4+PiBhdXRoZW50aWNhdGlvbg0KPj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICBJbiB0aGUgY3VycmVudCB0ZWxlcGhvbnkgbmV0d29yayBwcmFjdGljZSwgc29t ZQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBzZXJ2aWNlIHByb3ZpZGVyIGltcGxlbWVudGF0 aW9ucyBjaG9vc2Ugbm90IHRvDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIGF1dGhlbnRpY2F0 ZSBpZGVudGl0eSwgYnV0IHNpbXBseSBmYWNpbGl0YXRlDQo+Pj4+Pj4+Pj4+Pj4+IHRoZSB1c2UN Cj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgb2YgYW4gYXJiaXRyYXJ5IG9yIHNlbGVjdGVkIHVz ZXItcHJvdmlkZWQgaWRlbnRpdHkuDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIEFyZSB0aGVy ZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8gIEhhcw0KPj4+Pj4+Pj4+Pj4+PiBhbnlv bmUNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgZXN0YWJsaXNoZWQgdGhhdCB0aGVyZSBhcmUg bm90PyAgSG93IGNhbiB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gaW5kdXN0cnkNCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgcmVhc29uYWJseSBleHBlY3QgdG8gZW5kIHRoaXMgKG9mdGVuIGJhZCkgcHJh Y3RpY2U/DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIElmIGl0IGNhbid0IGJlIGVuZGVkLCB0 aGVyZSdzIHZhbHVlIGluIGF0IGxlYXN0DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIGlkZW50 aWZ5aW5nIHRoZSBvcmlnaW5hdGluZyBzZXJ2aWNlIHByb3ZpZGVyDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgIChpLmUuLCB0aGUgc2lnbmVyL2F1dGhvcml6ZXIpLiAgR2l2ZW4gdGhlDQo+Pj4+ Pj4+Pj4+Pj4+IHByZXZhbGVuY2UNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgb2YgYWJ1c2Ug dXNpbmcgdGVsZXBob25lIG51bWJlcnMgYXNzaWduZWQgdG8gYQ0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICAgICBzb21ldGltZXMtYW5vbnltb3VzIGFidXNlciwgaXQgYmVjb21lcyBjcml0aWNhbGx5 DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIGltcG9ydGFudCB0byBpZGVudGlmeSB0aGUgc2Vy dmljZSBwcm92aWRlcihzKQ0KPj4+Pj4+Pj4+Pj4+PiBjbG9zZXN0DQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgIHRvIHRoZSBhYnVzZXIuICBCYXNlZCBvbiB0aGUgYXNzdW1wdGlvbiB0aGF0IGl0 J3MNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgYmV0dGVyIHRvIElEIHNlcnZpY2UgcHJvdmlk ZXJzIHRoYW4gdW5yZWFzb25hYmx5DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIGV4cGVjdCBh IGJhbiBvZiB0aGUgdXNlIG9mIHVuYXV0aGVudGljYXRlZCAoYW5kDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgIHRoZXJlZm9yZSB1bnNpZ25lZCkgU0lQIHJlcXVlc3RzLCBTVElSIHNpZ25pbmcN Cj4+Pj4+Pj4+Pj4+Pj4gc2hvdWxkDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIHN1cHBvcnQg YXV0aG9yaXphdGlvbiB3aXRob3V0IGF1dGhlbnRpY2F0aW9uLiAgVGhlDQo+Pj4+Pj4+Pj4+Pj4+ ICAgICAgICAgICAgIHByYWN0aWNlIG9mIGF1dGhvcml6aW5nIHVuYXV0aGVudGljYXRlZCB1c2Ug ZXhpc3RzLA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBhbmQgdGhlcmUgaXMgYmVuZWZpdCB0 byBzaWduaW5nIGluIHRoZXNlIGNhc2VzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIChzZXJ2 aWNlIHByb3ZpZGVyIGlkZW50aWZpY2F0aW9uKS4gIFRoZSBsYW5ndWFnZSBvZg0KPj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICB0aGUgSUQgc2hvdWxkIHBlcm1pdCB0aGlzIHVzZS4gIDQ0NzRiaXMt MTANCj4+Pj4+Pj4+Pj4+Pj4gc2hvdWxkIE5PVA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBy ZXF1aXJlIG9yIGFzc3VtZSB0aGF0ICB0aGF0IGF1dGhlbnRpY2F0aW9uIHdpbGwNCj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgcHJlY2VkZSBhdXRob3JpemF0aW9uLiBPZiBjb3Vyc2UgdGhlcmUg bWF5IGJlIG90aGVyDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIHVzZSBjYXNlcyB3aGVyZSBz aWduaW5nIGluY2x1ZGVzIGF1dGhlbnRpY2F0aW9uIGFuZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICBtYXkgbm90IGluY2x1ZGUgYSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVyJ3MNCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgICAgYXV0aG9yaXphdGlvbi4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAyLiAgICAgICBJbXByb3ZlIHJl cGxheSBwcmV2ZW50aW9uDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIFByb3hpbWF0ZSByZXBs YXkgaXMgcG9zc2libGUgd2hpbGUgY29tcGx5aW5nDQo+Pj4+Pj4+Pj4+Pj4+IHdpdGggdGhpcw0K Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBzcGVjLiAgRmlyc3QsIG9uZSBvciBtb3JlIHByb3hp bWF0ZSAoZS5nLiwNCj4+Pj4+Pj4+Pj4+Pj4gd2l0aGluDQo+Pj4+Pj4+Pj4+Pj4+IDYwDQo+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgIHNlY29uZHMpIFNJUCByZXF1ZXN0cyB1c2luZyB0aGUgc2Ft ZSB0b2tlbiBhcmUNCj4+Pj4+Pj4+Pj4+Pj4gbGVnYWwNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg ICAgYW5kIHN1YmplY3QgdG8gcmVwbGF5IGluIG1hbnkgY2FzZXMuICBBbiBTRFAgYm9keSdzDQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIG1reSBtYXkgbm90IGJlIHByZXNlbnQgYW5kIGlmIHBy ZXNlbnQgaXRzIHVzZSBpcw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBvcHRpb25hbC4gIFNv bWUgc29ydCBvZiBtYW5kYXRvcnkgbmV3IG9yIGV4aXN0aW5nDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICAgIHNpZ25lZCBzZXF1ZW5jZSwgcmFuZG9tICMgb3IgcmVxdWVzdCBJRCAoZS5nLiwNCj4+ Pj4+Pj4+Pj4+Pj4gQ2FsbC1JRA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBvciBDU2VxKSBh bmQgYSAxLXRpbWUgdXNlIHBvbGljeSBvbiB0aGUNCj4+Pj4+Pj4+Pj4+Pj4gcmVjZWl2aW5nIGVu ZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBvZiB0aGUgcmVxdWVzdCAoZS5nLiwgdG9rZW5z IG9ubHkgZ29vZCBmb3IgMQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICB1c2UpIGNvdWxkIHBy ZXZlbnQgcmVwbGF5LiAgRGlmZmVyZW50IG1ldGhvZHMNCj4+Pj4+Pj4+Pj4+Pj4gKGUuZy4sDQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIElOVklURSB2cyBNRVNTQUdFKSBtaWdodCBiZSBoYW5k bGVkIGJ5IGRpZmZlcmVudA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICByZWNlaXZpbmcgaW5m cmFzdHJ1Y3R1cmUsIGFuZCB0aGVyZWZvcmUNCj4+Pj4+Pj4+Pj4+Pj4gZGlmZmljdWx0aWVzDQo+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIHdpdGggJ2l0J3MgYmVlbiB1c2VkIGFscmVhZHknIGNv b3JkaW5hdGlvbiBhbGxvdyBhDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIGZha2VkIE1FU1NB R0UgYmFzZWQgb24gYSBjYXB0dXJlZCByZXF1ZXN0Lg0KPj4+Pj4+Pj4+Pj4+PiBUaGlzIG1pZ2h0 DQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIGluY2x1ZGUgYW4gbWtleSBmcm9tIGEgY2FwdHVy ZWQgSU5WSVRFLiAgIFNvIGl0DQo+Pj4+Pj4+Pj4+Pj4+IG1heSBiZQ0KPj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICBwb3NzaWJsZSB0byBET1MsIHNwYW0gb3IgdGV4dC1ib21iIGEgcmVjaXBpZW50 DQo+Pj4+Pj4+Pj4+Pj4+IHVzaW5nIGENCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgY2FwdHVy ZWQgaWRlbnRpdHkuICBXaGlsZSBsYXJnZS1zY2FsZSBvcg0KPj4+Pj4+Pj4+Pj4+PiBkaXN0cmli dXRlZA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBpbXBsZW1lbnRhdGlvbnMgbWF5IG1ha2Ug dGhlIGVuZm9yY2VtZW50IGRpZmZpY3VsdCwNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgdGhl cmUgaXMgbGl0dGxlIGNvc3QgdG8gc2lnbmluZyBhbmQgZGVjb2RpbmcgYQ0KPj4+Pj4+Pj4+Pj4+ PiBtZXRob2QNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgYW5kIHBvc3NpYmx5IGEgbnVtZXJp YyBJRC4gICBTb21lIHNvcnQgb2YgJzEtdXNlJw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBw cmFjdGljZSBzaG91bGQgYXQgbGVhc3QgYmUgZGlzY3Vzc2VkIHdoaWxlIHBlcmhhcHMNCj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgICAgbm90IHJlcXVpcmVkLg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+ Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIFNwZWNpZmljIG1hcmt1cCBzdWdn ZXN0aW9uczoNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICBOSVRTDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgICAgVGhlIHZlcmlmaWVyIE1VU1QgaW5zcGVjdCBhbnkgb3B0aW9u YWwgInBwdCINCj4+Pj4+Pj4+Pj4+Pj4gcGFyYW1ldGVyIGFwcGVhcmluZyAqaW4qdGhlDQo+Pj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBJZGVudGl0eSByZXF1ZXN0 LiAgSWYgbm8gInBwdCIgcGFyYW1ldGVyIGlzDQo+Pj4+Pj4+Pj4+Pj4+IHByZXNlbnQsIHRoZW4g dGhlDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICB2ZXJpZmll ciBwcm9jZWVkcyBub3JtYWxseSBiZWxvdy4gIElmIGEgInBwdCINCj4+Pj4+Pj4+Pj4+Pj4gcGFy YW1ldGVyIHZhbHVlIGlzDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICAgICBwcmVzZW50LCBhbmQgdGhlIHZlcmlmaWVyIGRvZXMgbm90IHN1cHBvcnQNCj4+Pj4+Pj4+ Pj4+Pj4gaXQsIGl0IE1VU1QgaWdub3JlIHRoZQ0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgICAgICAgSWRlbnRpdHkgaGVhZGVyLiAgSWYgYSBzdXBwb3J0ZWQgInBwdCIN Cj4+Pj4+Pj4+Pj4+Pj4gcGFyYW1ldGVyIHZhbHVlIGlzIHByZXNlbnQsDQo+Pj4+Pj4+Pj4+Pj4+ IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICB0aGUgdmVyaWZpZXIgZm9sbG93cyB0aGUg cHJvY2VkdXJlcyBiZWxvdywNCj4+Pj4+Pj4+Pj4+Pj4gaW5jbHVkaW5nIHRoZSB2YXJpYXRpb25z DQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBkZXNjcmliZWQg aW4gU3RlcCA1Lg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIDMNCj4+Pj4+ Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IDxmaWxlOi8vL0M6L1VzZXJzL2FiMzc3OC9Eb2N1bWVu dHMvSUVURi9kcmFmdC1pZXRmLXN0aXItcmZjDQo+Pj4+Pj4+Pj4+Pj4+IDQ0Nw0KPj4+Pj4+Pj4+ Pj4+PiA0YmkNCj4+Pj4+Pj4+Pj4+Pj4gcy0xMCUyMC0NCj4+PiAlMjBBdXRoZW50aWNhdGVkJTIw SWRlbnRpdHklMjBNYW5hZ2VtZW50JTIwaW4lMjB0aGUlMjANCj4+Pj4+Pj4+Pj4+Pj4gU2VzIHNp b24lMjBJbml0aWF0aW9uJTIwUHJvdG9jb2wlMjAlMjhTSVAlMjkuaHRtI3NlY3Rpb24tDQo+Pj4g Mz4uDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBCYWNrZ3JvdW5kDQo+Pj4+Pj4+Pj4+ Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBbLi4uXQ0KPj4+Pj4+Pj4+Pj4+PiANCj4+ Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg ICBQZXIgW1JGQzczNDANCj4+Pj4+Pj4+Pj4+Pj4gPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9yZmM3MzQwPl0sIHByb2JsZW1zIHN1Y2ggYXMNCj4+Pj4+Pj4+Pj4+Pj4gcm9ib2NhbGxpbmcs IHZvaWNlbWFpbCBoYWNraW5nLCBhbmQNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICAgIHN3YXR0aW5nIGFyZSBlbmFibGVkIGJ5IGFuIGF0dGFja2VyJ3MNCj4+Pj4+ Pj4+Pj4+Pj4gYWJpbGl0eSB0byBpbXBlcnNvbmF0ZSBzb21lb25lDQo+Pj4+Pj4+Pj4+Pj4+IA0K Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBlbHNlLiAgVGhlIHNlY3VyZSBvcGVyYXRpb24g b2YgbW9zdCBTSVANCj4+Pj4+Pj4+Pj4+Pj4gYXBwbGljYXRpb25zIGFuZCBzZXJ2aWNlcw0KPj4+ Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgZGVwZW5kcyBvbiBhdXRo ZW50aWNhdGluZyBhbmQvb3INCj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXppbmcgdGhlIHNvdXJjZSBv ZiBjb21tdW5pY2F0aW9ucyBhcyBpdCBpcw0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgICAgcmVwcmVzZW50ZWQgaW4gYSBTSVAgcmVxdWVzdC4NCj4+Pj4+Pj4+Pj4+ Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgICAgICAgVGhpcyBpZGVudGl0eSBhcmNoaXRlY3R1cmUgZm9yIFNJUCBkZXBlbmRzDQo+Pj4+ Pj4+Pj4+Pj4+IG9uIGluY2x1ZGVzIHByb3Zpc2lvbnMgZm9yIGEgbG9naWNhbA0KPj4+Pj4+Pj4+ Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgImF1dGhlbnRpY2F0aW9uIHNlcnZp Y2UiIHdoaWNoIHZhbGlkYXRlcw0KPj4+Pj4+Pj4+Pj4+PiBjYWxsZXIgaWRlbnRpdHkgYXQgb3Ig bmVhciBvcmlnaW5hdGlvbi4gIG91dGdvaW5nDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgIHJl cXVlc3RzLiAgQW4NCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAg IGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgbWF5IGJlIGltcGxlbWVudGVkDQo+Pj4+Pj4+Pj4+Pj4+ IGVpdGhlciBhcyBwYXJ0IG9mIGEgdXNlcg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgICAgYWdlbnQgb3IgYXMgYSBwcm94eSBzZXJ2ZXI7IHR5cGljYWxseSwgaXQN Cj4+Pj4+Pj4+Pj4+Pj4gaXMgYSBjb21wb25lbnQgb2YgYSBuZXR3b3JrDQo+Pj4+Pj4+Pj4+Pj4+ IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBpbnRlcm1lZGlhcnkgbGlrZSBhIHByb3h5 IHRvIHdoaWNoDQo+Pj4+Pj4+Pj4+Pj4+IG9yaWdpbmF0aW5nIHVzZXIgYWdlbnRzIHNlbmQNCj4+ Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgIHVuc2lnbmVkIHJlcXVl c3RzLiAgT25jZSB0aGUgc2VuZGVyIG9mIHRoZQ0KPj4+Pj4+Pj4+Pj4+PiBtZXNzYWdlIGhhcyBi ZWVuDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBUaGlzIGRvY3VtZW50IHNw ZWNpZmllcyBhIG1lYW5zIG9mIHNoYXJpbmcNCj4+Pj4+Pj4+Pj4+Pj4gYSBjcnlwdG9ncmFwaGlj IGFzc3VyYW5jZQ0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAg b2YgYXV0aGVudGljaXR5IG9mIGFuZC9vciBhdXRob3JpemF0aW9uIHRvDQo+Pj4+Pj4+Pj4+Pj4+ IHVzZSBlbmQtdXNlciBTSVAgaWRlbnRpdHkgaW4gYW4gaW50ZXJkb21haW4gb3IgaW50cmFkb21h aW4NCj4+PiBjb250ZXh0Lg0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg ICAgICAgSXQgcmVsaWVzIG9uIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlDQo+Pj4+Pj4+Pj4+ Pj4+IGNvbnN0cnVjdGluZyB0b2tlbnMgYmFzZWQgb24gWy4uLl0NCj4+Pj4+Pj4+Pj4+Pj4gDQo+ Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+ Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBUbyBtYXhpbWl6ZSBlbmQtdG8tZW5k IHNlY3VyaXR5LCBpdCBpcw0KPj4+Pj4+Pj4+Pj4+PiB0eXBpY2FsbHkgb2J2aW91c2x5DQo+Pj4+ Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICBwcmVmZXJhYmxlIGZvciBl bmQtdXNlcnMgdG8gYWNxdWlyZSB0aGVpcg0KPj4+Pj4+Pj4+Pj4+PiBvd24gY3JlZGVudGlhbHM7 IGlmIHRoZXkNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgIGRv LCB0aGVpciB1c2VyIGFnZW50cyBjYW4gYWN0IGFzDQo+Pj4+Pj4+Pj4+Pj4+IGF1dGhlbnRpY2F0 aW9uIHNlcnZpY2VzLiAgSG93ZXZlciwNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICAgIGZvciBzb21lIGRlcGxveW1lbnRzLCBbLi4uXQ0KPj4+Pj4+Pj4+Pj4+PiAN Cj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAg ICBSZWdhcmRzLA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgQWxl eA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAqICoNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg ICAgKkFsZXggQm9ib3RlayoNCj4+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+ Pj4+Pj4+PiANCj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICAgICBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86 c3RpckBpZXRmLm9yZz4gPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+PiAgICAg ICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+ Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+Pj4+Pj4g DQo+Pj4+Pj4+Pj4+Pj4+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQo+Pj4+Pj4+Pj4+Pj4+IC0tDQo+Pj4+Pj4+Pj4+Pj4+IC0NCj4+ Pj4+Pj4+Pj4+Pj4gLQ0KPj4+Pj4+Pj4+Pj4+PiAtLQ0KPj4+Pj4+Pj4+Pj4+PiAtLS0tLS0tDQo+ Pj4+Pj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIFRoaXMgZS1tYWlsIG1heSBjb250 YWluIFNwcmludCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbg0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAg IGludGVuZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55DQo+Pj4+ Pj4+Pj4+Pj4+IHVzZSBieQ0KPj4+Pj4+Pj4+Pj4+PiAgICAgICAgIG90aGVycyBpcyBwcm9oaWJp dGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQNCj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICBy ZWNpcGllbnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZQ0KPj4+Pj4+Pj4+ Pj4+PiBhbGwgY29waWVzDQo+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgb2YgdGhlIG1lc3NhZ2UuDQo+ Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+Pj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+ Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0 bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4+PiBfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+Pj4+Pj4gc3RpciBtYWls aW5nIGxpc3QNCj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0bzpzdGlyQGlldGYub3Jn Pg0KPj4+Pj4+Pj4+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGly DQo+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCj4+Pj4+Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+Pj4+IHN0 aXJAaWV0Zi5vcmcNCj4+Pj4+Pj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3N0aXINCj4+Pj4+Pj4gDQo+Pj4+Pj4+ICAgX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4gICBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+ PiAgIHN0aXJAaWV0Zi5vcmcNCj4+Pj4+Pj4gICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3N0aXINCj4+Pj4+Pj4gDQo+Pj4+Pj4+ICAgX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4gICBzdGlyIG1haWxpbmcgbGlzdA0K Pj4+Pj4+PiAgIHN0aXJAaWV0Zi5vcmcNCj4+Pj4+Pj4gICBodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+Pj4gDQo+Pj4+Pj4+IA0KPj4+Pj4+PiANCj4+Pj4+ Pj4gDQo+Pj4+Pj4+IA0KPj4+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K Pj4+Pj4+PiANCj4+Pj4+Pj4gVGhpcyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0 YXJ5IGluZm9ybWF0aW9uIGludGVuZGVkDQo+Pj4+Pj4+IGZvciB0aGUgc29sZSB1c2Ugb2YgdGhl IHJlY2lwaWVudChzKS4gQW55IHVzZSBieSBvdGhlcnMgaXMgcHJvaGliaXRlZC4NCj4+Pj4+Pj4g SWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3QgdGhl IHNlbmRlcg0KPj4+Pj4+PiBhbmQgZGVsZXRlIGFsbCBjb3BpZXMgb2YgdGhlIG1lc3NhZ2UuDQo+ Pj4+Pj4gDQo+Pj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCj4+Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+IHN0aXJAaWV0Zi5vcmcNCj4+ Pj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+IA0K Pj4+Pj4gDQo+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KPj4+Pj4gc3RpciBtYWlsaW5nIGxpc3QNCj4+Pj4+IHN0aXJAaWV0Zi5vcmcNCj4+Pj4+ IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4gDQo+Pj4+ IA0KPj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+PiBzdGlyQGlldGYub3JnDQo+Pj4+IGh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+IA0KPj4+IA0KPj4+IF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4gc3RpciBtYWls aW5nIGxpc3QNCj4+PiBzdGlyQGlldGYub3JnDQo+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9zdGlyDQo+PiANCj4gDQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KPiANCj4gVGhpcyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0 YXJ5IGluZm9ybWF0aW9uIGludGVuZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVu dChzKS4gQW55IHVzZSBieSBvdGhlcnMgaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3QgdGhl IGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVsZXRl IGFsbCBjb3BpZXMgb2YgdGhlIG1lc3NhZ2UuDQoNCg== From nobody Tue Aug 9 11:05:41 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D75D12B03A for ; Tue, 9 Aug 2016 11:05:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4takpavQoWWq for ; Tue, 9 Aug 2016 11:05:35 -0700 (PDT) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8D6A12B005 for ; Tue, 9 Aug 2016 11:05:34 -0700 (PDT) Received: by mail-qk0-x231.google.com with SMTP id x185so20616387qkc.2 for ; Tue, 09 Aug 2016 11:05:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=A+1rORlUSkWFCNxVqtAOvZ496ihgdDAmiHAH4C7nxnQ=; b=1MG3FGzLxXv5Vmm8boQkyLTv07VYza0UFu/PDeoyUyBeBFZ79R1Z9Cfj5bemNsBgUv cAw/uHlYrSO+8Bz7K1ZTrlpJlShwaAtE28V3ppXHPk80bbA2OiV5OE4KTwS8sCj6h+/n zfNBrVdCGm2X1C6k8W5SWHs01muwta1n6VihhZdB10MXRftlAxHpdyvbbKl7Vbfz4g70 Xq7Cig9SoPeloqRIePyoQIaDwyZGEQQIv8l8rcBORb2JFzo8ZU3Mhd4lS7Zs8TaO6xRv nwAUXlvHn4XIOooj2NH+Y7udnj2lxxC+loZEs5G/dzCaSU/reTnsYRWq1yVTw7gwxXg4 7Q7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=A+1rORlUSkWFCNxVqtAOvZ496ihgdDAmiHAH4C7nxnQ=; b=Jzfcq55Fi4KKvK7NpfLCfHXKelHNRbeVjTiGwQ6vOzSOzn9fvopvhtidltPdG9A0Q1 tdfee5ppX1+fhfN3uZkovoxdtBhpe+BD+WzvfKStwm0z8e8TQXjDenirv9bVJq40OB/i seMnISJIxAQDAOvE2kfpQL1YDmljAgudHlCImUz7xiKdoB4xjR9KYtkFhOt/BZlFpjn/ djbzdJiZvRfYY3YFpYbP/BymtFvu/Qzt+pQyJ/KBefs/oVl1H+roQLm0T/TOj424zLIc 0fHltDp0i63+WJDqDvT/klaU0gQvOR9oBDDAik6CCzNk2vRQkPwfOwPxgZQYYNqD8rZ6 5dUw== X-Gm-Message-State: AEkoousEeBulq1zc69kHB0Wncw0SOyxn3mJudEQdR+lWun4OLUZK+ivSApNtRoHObPBiTw== X-Received: by 10.55.174.2 with SMTP id x2mr35979341qke.123.1470765933614; Tue, 09 Aug 2016 11:05:33 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id s52sm21046821qtc.4.2016.08.09.11.05.31 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 09 Aug 2016 11:05:32 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Tue, 9 Aug 2016 14:05:28 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <0556D70A-15D6-4D79-BA87-AE5097D3F009@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "Peterson, Jon" , "Rosbotham, Paul, Vodafone UK" , "DOLLY, MARTIN C" , Paul Kyzivat , Richard Shockey , "stir@ietf.org" , Alex Bobotek , "Dwight, Timothy M \(Tim\)" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 18:05:39 -0000 I do think we will need to extend stir to cover WebRTC and that solution = will =E2=80=9Cwork=E2=80=9D for other cloud based calling services using = telephone numbers as identifiers. stir as we are defining it will work = for any origination mechanism that terminates on a telephony device = (PSTN/mobile/VoIP) using a telephone number as the address. Wherever = the gateway to the telephone network exists, it will have to sign, or = the carrier serving it will have to sign, and thus check the TN. To get more complex, and cover the case of an SS7 link in the path will = need some more work (out of band), that can=E2=80=99t start until we = finish our base effort. Brian > On Aug 9, 2016, at 1:56 PM, Gorman, Pierce A [CTO] = wrote: >=20 > I actually don't think STIR is going to "get rid of the scourge of = robocalling". And to be more specific, we mean robocalling for = nefarious purposes (if you can accept robocall for political purposes as = non-nefarious). >=20 > I assume that cloud-based on-line communications services will make it = trivial to get and commit robo-calling for nefarious purposes with = authenticated numbers, and that it will be difficult to impossible to = track down the perpetrators. We're playing wack-a-mole here. >=20 > Regardless, I also agree with most of what you said. >=20 > All Paul and I have been debating is whether or not all signed numbers = can have equivalent trustworthiness (and they can't) and whether the = network operator should be liable for a customer's crimes (and they = shouldn't). >=20 > Pierce >=20 > -----Original Message----- > From: Brian Rosen [mailto:br@brianrosen.net]=20 > Sent: August 09, 2016 12:44 PM > To: Gorman, Pierce A [CTO] > Cc: Paul Kyzivat ; Alex Bobotek = ; Peterson, Jon ; Dwight, = Timothy M (Tim) ; DOLLY, MARTIN C = ; Rosbotham, Paul, Vodafone UK = ; Richard Shockey ; = stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > To get rid of the scourge of robocalling, service providers will have = to check to make sure the calling party number is delegated to the = subscriber, or delegate them credentials so they can sign. > That is not current practice, but current practice will need to = change. >=20 > Where you aren=E2=80=99t doing it because, well, just because, you = will need to. That=E2=80=99s the actual change, Signing is the = mechanics, but the change is checking.=20 > Where you are already just asserting PAI, without regard to what is in = From, you are good. It=E2=80=99s when you blindly accept =46rom and = copy to PAI that you have a problem, If you are accepting PAI, then = whomever is asserting it needs to sign. >=20 > Where there is a reason, like the call center, an extra delegation = will be required, and probably you will be looking to the call center to = sign calls that are coming over your network, but are being placed by = the call center on behalf of someone not on your network. >=20 > Where you are a transit network, you will need to push signing = responsibility to your transit customer. >=20 > It would be good to be able to push the problem to your = subscriber/customer, but that won=E2=80=99t work for a while unless they = are a service provider (where you need to make them responsible for = signing, because you don=E2=80=99t know their customers). The bigger, = and more complex the subscriber=E2=80=99s connection to your network, = the more you are incentivised to push the problem down. Things that = just work now (like a multi-location enterprise least cost routing = outbound calls through several networks) may no longer work unless they = do the signing. Most of the larger PBX vendors know about stir and are = planning to support it. =E2=80=9CWhen" is always the issue, and the = more we make the consequences of stir deployment known to service = providers, enterprises and regulators, the quicker we=E2=80=99ll get the = vendors to respond. >=20 > Brian >=20 >=20 >> On Aug 9, 2016, at 1:04 PM, Gorman, Pierce A [CTO] = wrote: >>=20 >> " If you sign the message you are taking responsibility for the = assertion that it is from NNN. If you choose to do so without knowing = who it is from then that is your problem." >>=20 >> Paul, >>=20 >> Following this standard of liability, every ISP should be forced to = sign IP packets and be liable for hacking attempts which originate on = their IP networks. >>=20 >> Just as reverse unicast path forwarding is not often (ever?) used in = the Internet backbone or ISP networks to ensure IP packets don't come = from networks they can't have originated from, neither do all telephone = networks "check" each originating telephone number to determine whether = they should have been able to originate from a particular carrier or = enterprise and for the same reasons - it is difficult, imperfect, and = expensive. Just as it is with the Internet backbone, it's actually = reasonably challenging just delivering the calls (or IP packets) to the = number that it is addressed to, without also having to also worry about = where it supposedly came from. >>=20 >> I'm telling you we can differentiate the trustworthy-ness (like = Stephen Colbert's "truth-iness") of calls. We can tell if a call = originated from a subscriber using a device which has to authenticate to = the network before it's permitted to place calls (except manual roaming = and some E911 calls). And we can tell if a call originated (or was = subjected to mid-call 3rd party call control from an enterprise or = mobile virtual network operator partner for example) and is therefore = not as trustworthy as the directly-connected and authenticated mobile = subscriber (for example). We can pass that relative trustworthiness = information along in signaling and it can be used to usefully = differentiate treatment, ultimately, by the consumer. >>=20 >> What you want is that the calling number is always, universally, only = ever trustworthy. My opinion is that is unrealistic and unreasonable. >>=20 >> Pierce >>=20 >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: August 09, 2016 10:44 AM >> To: Alex Bobotek ; Peterson, Jon = ; Gorman, Pierce A [CTO] = ; Dwight, Timothy M (Tim) = ; DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK ; = Richard Shockey ; stir@ietf.org; Brian Rosen = >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >> On 8/9/16 5:03 AM, Alex Bobotek wrote: >>> Jon, >>>=20 >>> Thanks much for your thoughtful response to the original points. = Yes, things got somewhat sidetracked. >>>=20 >>> On the first point (signing without authentication), I do not read = 6.1 >>> as permitting "I'm signing to assert that I've authorized use of = this >>> phone number without authenticating the caller and/or completing a >>> number delegation authority check", >>=20 >> I'm not sure I understand. Is this the assertion you are asking for? >>=20 >> "I (Acme Corp), having administrative authority over number NNN, = certify that this message is "from" NNN, though I have no idea who = actually originated this message." >>=20 >> This is a good thing??? >>=20 >> If you sign the message you are taking responsibility for the = assertion that it is from NNN. If you choose to do so without knowing = who it is from then that is your problem. You should be legally liable. = At the very least your reputation as a signer should be diminished as = fraudulent calls you have signed are detected. Eventually you will be = put on blacklists as an untrustworthy signer. >>=20 >> I guess we could speed the blacklisting by allowing signers to = pre-declare that they are untrustworthy. (That seems to be what you are = asking for.) >>=20 >>> a use case that reflects the currently-widespread practice of = authorization without authentication. >>=20 >> No wonder we have a problem with spoofed calls. >>=20 >> Thanks, >> Paul >>=20 >>> My read of section 6.1 is that it allows anonymity rather than = signer-attribution with unauthenticated (non-anonymous) caller identity. = Knowing the triple of purported calling phone number that flashes on a = recipient's phone, the terminating phone number and a timestamp is = important in reporting/tracing/mitigating abusive calls. [On a side = note, I reread Section 11, but had trouble with the definition of = "private URI" (note: "private URI" and "private SIP URI" each occur = exactly once each in the doc and could benefit from a definition or = two).] Additionally, Brian Rosen's comment on 8/4 seems to corroborate = my reading of a ban on authorization without authentication in the = non-anonymous case (i.e., that using someone else's phone number = requires that "the entity that is assigned the TN explicitly authorizes = calls placed using it's TN"). >>>=20 >>> In summary, there is a high value in allowing signing/authorization = in the categories and use cases Pierce outlined. In my operational = experience, it really helps to know which company to contact to get the = callers kicked off a network. And signer attribution even without = caller authentication is a huge win for the public. >>>=20 >>>=20 >>>=20 >>> On the second point, thanks for pointing out that 12.1 requires = servers to keep the state of recently received requests. This is a = point that I missed in my reading of the draft, and this feature as you = have described it defeats most conceivable replay attacks. My bad for = missing this, but as you suggest, there may be some potential for = emphasizing this point. But there's another part of the issue -- cross = method replay. For example, it may be difficult to expect a messaging = node (which handles SIP MESSAGE) and a voice-capable IMS node (handling = SIP INVITE) to coordinate their anti-replay caches, allowing an attacker = that observes a SIP invite for a voice call to piggyback a spam text = message. As it's common to use the same "To" address for multiple = services that may be served by very different infrastructure components, = it would be beneficial to allow signatures to cover more than "To", = "From/PAI" and "Timestamp". I do not see this issue as meriting = significant delay of a STIR RFC if there's no quick fix. >>>=20 >>> Regards, >>>=20 >>> Alex >>>=20 >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, = Jon >>>> Sent: Monday, August 8, 2016 12:46 PM >>>> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >>>> ; Dwight, Timothy M (Tim) >>>> ; DOLLY, MARTIN C >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard Shockey ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>=20 >>>>=20 >>>> Just so I'm clear, I'm not hearing an ask here in terms of changing >>>> the text of rfc4474bis-10, which does allow signing PAI instead of >>>> =46rom for precisely the reasons outlined in this lengthy thread. = To >>>> Alex's original point about providing authorization without >>>> authentication, rfc4474bis has a lot of text about signing non-TN >>>> identifiers, including for preserving anonymity; see the end of >>>> section 6.1, and then the Privacy Considerations in section 11 for >>>> more. Those should suffice to provide this property: it will = identify the service provider who signed without attesting an specific = user identity. >>>>=20 >>>> I also wanted to make sure we didn't drop the other ball that Alex >>>> mentioned at the start of this thread, which is the issue of >>>> proximate replay within the 60 second Date window. This is = addressed >>>> in Section 12.1 of rfc4474bis-10, which >>>> reads: "Note that per baseline [RFC3261] behavior, servers keep = state >>>> of recently received requests, and thus if an Identity header is >>>> replayed by an attacker within the Date interval, verifiers can >>>> detect that it is spoofed because a message with an identical Date >>>> from the same source had recently been received." This refers to = the >>>> text of >>>> RFC3261 section 23.4.2, though more properly the Date-related >>>> behavior is better detailed in RFC3893 Section 10, which introduced >>>> the first version of the partial signature mechanism that = ultimately >>>> inspired RFC4474. I'll update the text here so it is clearer about = exactly how to detect proximate replay. >>>>=20 >>>> Jon Peterson >>>> Neustar, Inc. >>>>=20 >>>> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >>>> = wrote: >>>>=20 >>>>> Paul, >>>>>=20 >>>>> As you know, SIP inter-working is often challenging because of >>>>> variability in implementation including proprietary headers = (without >>>>> an >>>>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>>>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>>>> stripping things like display name in =46rom but that's another = story). >>>>> I could argue that from a cleanliness of protocol implementation, >>>>> (and if I wanted to be pedantic), I would strip PAI outbound = unless >>>>> required otherwise. But the point is moot. As I mentioned in the >>>>> earlier e-mail, that is not our practice and I'm not requesting it = to be so. >>>>>=20 >>>>> Pierce >>>>>=20 >>>>>=20 >>>>> -----Original Message----- >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>> Sent: August 08, 2016 12:03 PM >>>>> To: Gorman, Pierce A [CTO] ; Dwight, >>>> Timothy >>>>> M >>>>> (Tim) ; DOLLY, MARTIN C >>>> >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard >>>>> Shockey ; stir@ietf.org; Brian Rosen >>>>> >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>>>> Thanks for the added comments Tim. >>>>>>=20 >>>>>> I agree that passing P-Asserted-Identity between trusted networks >>>>>> is appropriate (and the converse is true as well). Part of my >>>>>> issue is I have been conditioned from the very earliest >>>>>> implementation of Sprint's VoIP network that other carriers' IP >>>>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>>>> and even there I find language that implies trust is established = by >>>>>> agreement, not by standard. (Even roaming implies agreement.) >>>>>=20 >>>>> I understand why *some* stuff needs to be removed when forwarding = to >>>> an >>>>> untrusted party. For instance, if the call has requested privacy, >>>>> then P-A-ID needs to be removed. >>>>>=20 >>>>> But when privacy is not a concern, trust is really more of a = concern >>>>> on the ingress side, not egress. If I don't trust you then I won't >>>>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>>>> trust you, but you don't trust me, then what is the downside for >>>>> passing along the P-A-ID? >>>>>=20 >>>>> Thanks, >>>>> Paul >>>>>=20 >>>>>> Regardless, this discussion has been helpful and educational (to = me >>>>>> at least). And, I confirmed with my operations counterpart we >>>>>> generally send PAI today. I've also made note that where = standards >>>>>> and >>>> ICA >>>>>> require it, we will include PAI. Thanks again. >>>>>>=20 >>>>>> Best regards, >>>>>>=20 >>>>>> Pierce >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>>>> Sent: August 08, 2016 10:47 AM >>>>>> To: Gorman, Pierce A [CTO] ; DOLLY, >>>> MARTIN >>>>>> C >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>>>> Richard Shockey ; Paul Kyzivat >>>>>> ; stir@ietf.org; Brian Rosen >>>>>> >>>>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> Pierce, >>>>>>=20 >>>>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >>>> GSMA >>>>>> IR.95. The latter references and profiles the former. Section >>>>>> 4.4.1 of >>>>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>>>> considered trusted, and table 3 in that section recommends that >>>>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>>>> It also states that PAI is mandatory at a roaming NNI. >>>>>>=20 >>>>>> Tim >>>>>>=20 >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>>>> Pierce A [CTO] >>>>>> Sent: Monday, August 08, 2016 8:52 AM >>>>>> To: DOLLY, MARTIN C >>>>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>>>> stir@ietf.org; Brian Rosen >>>>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> Martin, >>>>>>=20 >>>>>> You referenced TS 29.195. I'm not familiar with that spec. Has = it >>>>>> been deprecated? It's not showing up on the 3GPP site. >>>>>>=20 >>>>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on = the >>>>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>>>> header when interworking with untrusted networks." >>>>>>=20 >>>>>> Your remark is consistent with Note 4, but only if we agree that, >>>>>> for instance, the AT&T network and the Sprint network are = "trusted >>>>>> networks". In reality, this is not the case or there would be no >>>>>> firewalls or Session Border Controllers used for interworking and >>>>>> security. My opinion is the only carrier networks that are = trusted >>>>>> are the SS7 network, and the Internet backbone. >>>>>>=20 >>>>>> What it really comes down to is that PAI is left in signaling >>>>>> either through formal specification as a part of an inter-carrier >>>>>> inter-connection agreement, or by custom (or even by accident). = I >>>>>> think this illustrates Paul Rosbotham's observation is true. >>>>>>=20 >>>>>> Pierce >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>>>> Sent: August 05, 2016 12:55 PM >>>>>> To: Gorman, Pierce A [CTO] >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Brian >>>>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>>>> ; Richard Shockey >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> PAI is not stripped at the network boundary between trusted >>>>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>>>> ITU And the list goes on >>>>>>=20 >>>>>> Martin C Dolly >>>>>> Lead Member of Technical Staff >>>>>> Core & Government/Regulatory Standards AT&T >>>>>> Cell: 609-903-3360 >>>>>> Email: md3135@att.com >>>>>>=20 >>>>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>>>> wrote: >>>>>>>=20 >>>>>>> Which header the carrier chooses to display is moot if the = header >>>>>>> is stripped between carriers as per at least one standard. I >>>>>>> think Paul Rosbotham's observation we're likely to encounter = "some >>>>>>> interesting interworking challenges" was perhaps the = understatement of the year. >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> -----Original Message----- >>>>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>>>> Sent: August 05, 2016 11:58 AM >>>>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>>>> ; Brian Rosen >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> If PAI is present and signed, and =46rom is also signed, I would >>>>>>> expect it to be up to the UA to decide what to display, not the = carrier. >>>>>>>=20 >>>>>>> Of course this will work differently if there is a different >>>>>>> signaling regime between the carrier and the user device (e.g. >>>>>>> black >>>> phone). >>>>>>>=20 >>>>>>> Thanks, >>>>>>> Paul >>>>>>>=20 >>>>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>>>> controller functions and is not to be used in inter-carrier >>>>>>>> inter-connection (although it commonly shows up anyway). My = opinion is the "From" >>>>>>>> header is likely used more often for presentation. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> -----Original Message----- >>>>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>>>> Sent: August 05, 2016 9:37 AM >>>>>>>> To: Rosbotham, Paul, Vodafone UK >>>> ; >>>>>>>> Paul Kyzivat ; Brian Rosen >>>>>>>> >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Humm this is getting interesting. Its my understanding that = the >>>>>>>> display number aka "presentation number" in the US context is = the >>>>>>>> one carried in the PAI. Martin, Pierce? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, = Vodafone UK" >>>>>>>> >>>> wrote: >>>>>>>>=20 >>>>>>>> Jumping in now that we're on European working time, +1 on >>>>>>>> Paul's observation. >>>>>>>>=20 >>>>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>>>> IDs....one (we term the Network Number, carried in PAID) = uniquely >>>>>>>> identifies the line, the other (we term Presentation Number, >>>>>>>> carried in From) is used for display purposes. >>>>>>>>=20 >>>>>>>> Only the carrier has the authority to set the Network Number >>>>>>>> so only they could sign it. >>>>>>>>=20 >>>>>>>> But - subject to regulatory restrictions which are well >>>>>>>> documented >>>>>>>> - the number sent for display purposes belongs to the customer. >>>>>>>> For blue-chip customers, I can allow them to send their >>>>>>>> Presentation Numbers into the network, and can't readily check = at >>>>>>>> a network level that they're theirs (I do have contractual >>>>>>>> safeguards). The number may have been allocated by me, or = could >>>>>>>> be allocated by a third party provider. If it's a call-centre >>>>>>>> they'll be making outbound calls for lots of different = customers >>>>>>>> which will change on day-by-day >>>> basis. >>>>>>>> This is business as usual. I don't like the term "authorised >>>>>>>> spoofing" because it implies that the CLI is in some way being = rigged: >>>>>>>> it's not, it's the corporate customer or their subcontractor >>>>>>>> using the number that's been assigned (so in internet terms >>>>>>>> delegated) to them via a chain of trust from the regulator. >>>>>>>>=20 >>>>>>>> What I want is the ability for customers to use their >>>>>>>> credentials to sign the CLIs they send me so that at the >>>>>>>> terminating end it can be checked (or indeed somewhere = en-route >>>>>>>> if that's the business model). >>>>>>>> I can and would sign for customers on my mobile business since >>>>>>>> I'm driving what number is presented, but that's by-the-by >>>>>>>> because they aren't the ones who generate millions of nuisance >>>>>>>> calls. If the signing only occurs at the originating carrier >>>>>>>> level for corporate/call-centre customers that's no use because >>>>>>>> I'm not in a position to do that for these type of >>>>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>>>> also highlight there are many more of my large customers that = I'd >>>>>>>> trust more than a far end originating carrier that could be >>>>>>>> anywhere in the world (though we have no shortage of small >>>>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>>>> UK....) >>>>>>>>=20 >>>>>>>> Regards >>>>>>>>=20 >>>>>>>> Paul >>>>>>>>=20 >>>>>>>> -----Original Message----- >>>>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul = Kyzivat >>>>>>>> Sent: 04 August 2016 23:12 >>>>>>>> To: Brian Rosen >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>>>> delegated the TN, it's being authorized to place calls that = are >>>>>>>>> not >>>>>>>>> from that TN, but appear to be. >>>>>>>>>=20 >>>>>>>>> The mechanism to handle the credential is exactly the same as = a >>>>>>>>> delegation, so if you want to call it delegation, go ahead, = but >>>>>>>>> I prefer to call it authorized spoofing. >>>>>>>>=20 >>>>>>>> IIUC the delegation is to a responsible entity (something that >>>>>>>> can be held legally accountable - e.g. a person), not to a = device. >>>>>>>> The entity can then "use" the credential via any device(s) it >>>>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>>>> two-line >>>> phone. >>>>>>>>=20 >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>>=20 >>>>>>>>> Brian >>>>>>>>>=20 >>>>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>>>> >>>>>>>>>> wrote: >>>>>>>>>>=20 >>>>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>>>> phone as calling party. >>>>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>>>> carrier to him. He then creates another credential, which = he >>>>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>>>> (because the call is coming from his mobile's TN but claims = to >>>>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>>>> could give the credential to his mobile SP if they sign on = his behalf. >>>>>>>>>>=20 >>>>>>>>>> I don't understand how that is different from regular = delegation. >>>>>>>>>>=20 >>>>>>>>>> When his landline carrier gave him a delegated certificate = for >>>>>>>>>> his landline number, he should be able to install that in >>>>>>>>>> whatever devices he wants - his landline UA, his mobile = phone, >>>>>>>>>> etc. It is still delegated from his landline carrier, even = when >>>>>>>>>> used with calls via his mobile carrier. >>>>>>>>>>=20 >>>>>>>>>> Thanks, >>>>>>>>>> Paul >>>>>>>>>>=20 >>>>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>>>> legitimate use. >>>>>>>>>>>=20 >>>>>>>>>>> But that's how I describe it. >>>>>>>>>>>=20 >>>>>>>>>>> Brian >>>>>>>>>>>=20 >>>>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>>>> > = wrote: >>>>>>>>>>>>=20 >>>>>>>>>>>> +1, but with one question below: >>>>>>>>>>>>=20 >>>>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>>>> delegation path, >>>>>>>>>>>>=20 >>>>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>>>> authorized spoofers. >>>>>>>>>>>>=20 >>>>>>>>>>>> I don't understand "authorized spoofers" in this context, = as >>>>>>>>>>>> contrasted to "spoofers" who have been delegated their >>>> authority. >>>>>>>>>>>>=20 >>>>>>>>>>>> Thanks, >>>>>>>>>>>> Paul >>>>>>>>>>>>=20 >>>>>>>>>>>>> I don't think it matters who the delegator or delegatee = are >>>>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>>>> delegated to, so authorities can follow the delegation = path. >>>>>>>>>>>>> There are plenty of certificated carriers who are willing = to >>>>>>>>>>>>> not care who they delegate to. The fact that there are = some >>>>>>>>>>>>> who do doesn't change much. >>>>>>>>>>>>> Making stir work means knowing who you are delegating to, = so >>>>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>>>> been delegated. >>>>>>>>>>>>> If it does, it's asserting that the calls are from who = they >>>>>>>>>>>>> are supposed to be from. >>>>>>>>>>>>> That should be straightforward, but we know it's not = always, >>>>>>>>>>>>> and that represents the hard part of deployment in my = opinion. >>>>>>>>>>>>> But once they delegate, they can hand responsibility to = sign >>>>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>>>> they are delegating to. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>>>> we get into >>>>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>>>> which we don't. >>>>>>>>>>>>> Our model is that you know who you delegate to, and once = you >>>>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>>>> some business practices. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI = and >>>>>>>>>>>>> having a way to know which TNs are covered by a = credential. >>>>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Brian >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>>>> policy and use cases. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be = deployed >>>>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>>>> my reason for suggesting a way to qualify the signature = to >>>>>>>>>>>>>> reflect that variability. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Originating carriers are in a position to know if a call = is >>>>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>>>> numbers, and can qualify to some degree the = trustworthiness >>>>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>>>> most-authenticated. There can be >>>> more >>>>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>>>> complexity (both for the carriers and the consumers) and = I >>>>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and = fraud. >>>>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>>>> mobile consumers where their carriers are able to = usefully >>>>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>>>> (revoked, not >>>>>>>>>>>>>> revoked) for authenticating calling number will not work = well. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>>>> well, if the calling party has to sign a call with a = per-TN >>>>>>>>>>>>>> cert provided by the called party. No called party cert = to include? >>>>>>>>>>>>>> Then the calling party does not have a trusted = relationship >>>>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org = >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>>>> policy issue. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>>>> design of stir, and the design allows delegation of one = TN >>>>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>>>> NAM phone could have >>>> more >>>>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>>>> mobile phone may also have a credential for, say, a TN = that >>>>>>>>>>>>>> is delegated to a landline, to cover the example case of = a >>>>>>>>>>>>>> doctor placing a call on his mobile, but getting his = office >>>>>>>>>>>>>> number to show up as the calling party. Use of such = mechanisms is policy. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>>>> discussion. Regardless, I do appreciate your = explanation. >>>>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org = >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>>>> phones and any other devices that can be programmed to = do >>>> so. >>>>>>>>>>>>>> They will be given credentials that only are valid for = the >>>>>>>>>>>>>> TNs they are authorized to sign for. They can try to = sign >>>>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>>>> will want to get out of the liability of signing on = behalf >>>>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>>>> so. That means the devices have to be able to sign, but = I >>>>>>>>>>>>>> understand many of the PBX vendors think that's = something >>>>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>>>> signature, >>>>>>>>>>>>>> but the service provider can do that. It should not = add a >>>>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>>>> assign to >>>>>>>>>>>>>> the trunk group connecting to the PBX, although it = could >>>>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>>>> "authorized >>>>>>>>>>>>>> spoofing". The companion devices I'm aware of always = send >>>>>>>>>>>>>> calls from the same service provider and should not = present >>>>>>>>>>>>>> any issue. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>>>> implement >>>>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A = [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>>>> where a >>>>>>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>>>>> way of >>>>>>>>>>>>>> knowing whether the calling number is properly = assigned >>>>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>>>>> from an >>>>>>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>>>> And in >>>>>>>>>>>>>> the consumer market, there are calling products = which >>>>>>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>>>>> devices >>>>>>>>>>>>>> (e.g., tablets) which can place a call using the = MDN of >>>>>>>>>>>>>> the parent subscriber. These are examples of = where the >>>>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>>>> necessarily mean >>>>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>>>> a single >>>>>>>>>>>>>> subscriber with a single MDN regardless of = "laxity" of >>>>>>>>>>>>>> spoof checking. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>>>> authentication mandates from Congress and/or FCC, = I >>>>>>>>>>>>>> suggested using carrier-specific certs and = encoding >>>>>>>>>>>>>> specificity of authenticity, and calling number. = This >>>>>>>>>>>>>> provides the identity of the originating carrier, = some >>>>>>>>>>>>>> idea as to the accuracy or specificity of the = calling >>>>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>>>> (assuming nonce >>>>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>>>> suggested >>>>>>>>>>>>>> below by Alex). >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> The representation of orig-carrier and = trustworthiness >>>>>>>>>>>>>> could be as follows: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>>>> Use case example(s): Pre-IMS, legacy = circuit-switched >>>>>>>>>>>>>> networks that don't natively support SIP or which = don't >>>>>>>>>>>>>> choose to sign calls. E.g., international = carriers. >>>>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>>>> roaming >>>>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> entirely >>>>>>>>>>>>>> untrustworthy >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>>>> OCN, but >>>>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> less than >>>>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>>>> calls from >>>>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = most >>>>>>>>>>>>>> trustworthy >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Undefined but assumed to use public or = commercially >>>>>>>>>>>>>> available authentication services resources. = e.g., >>>>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>>>> cetera. >>>>>>>>>>>>>> Could/would pass credentials down to SIP-aware = devices >>>>>>>>>>>>>> which would process them according to the rules of = the >>>>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>>>> placing a >>>>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>>>> telephone >>>>>>>>>>>>>> number used in From/PAI, and in such circumstances = the >>>>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>>>> call may >>>>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>>>> serving the >>>>>>>>>>>>>> entity that is assigned the TN. In all such = cases, the >>>>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>>>> authorizes calls >>>>>>>>>>>>>> placed using it's TN. The design accommodates = such use >>>>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>>>> authentication. We're not aware of any cases = where >>>>>>>>>>>>>> there >>>>>>>>>>>>>> is an actual requirement for legitimate calling = without >>>>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>>>> although >>>>>>>>>>>>>> we certainly are aware that various parts of = various >>>>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>>>> point, at >>>>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>>>> that the >>>>>>>>>>>>>> laxity of allowing unchecked spoofing is not = acceptable >>>>>>>>>>>>>> any more. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>>>> authentication >>>>>>>>>>>>>> In the current telephony network practice, = some >>>>>>>>>>>>>> service provider implementations choose not to >>>>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>>>> the use >>>>>>>>>>>>>> of an arbitrary or selected user-provided = identity. >>>>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>>>> anyone >>>>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>>>> industry >>>>>>>>>>>>>> reasonably expect to end this (often bad) = practice? >>>>>>>>>>>>>> If it can't be ended, there's value in at = least >>>>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>>>> prevalence >>>>>>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>>>>>> sometimes-anonymous abuser, it becomes = critically >>>>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>>>> closest >>>>>>>>>>>>>> to the abuser. Based on the assumption that = it's >>>>>>>>>>>>>> better to ID service providers than = unreasonably >>>>>>>>>>>>>> expect a ban of the use of unauthenticated = (and >>>>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>>>>> should >>>>>>>>>>>>>> support authorization without authentication. = The >>>>>>>>>>>>>> practice of authorizing unauthenticated use = exists, >>>>>>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>>>>>> (service provider identification). The = language of >>>>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>>>> should NOT >>>>>>>>>>>>>> require or assume that that authentication = will >>>>>>>>>>>>>> precede authorization. Of course there may be = other >>>>>>>>>>>>>> use cases where signing includes = authentication and >>>>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>>>> authorization. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>>>> with this >>>>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>>>> within >>>>>>>>>>>>>> 60 >>>>>>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>>>>> legal >>>>>>>>>>>>>> and subject to replay in many cases. An SDP = body's >>>>>>>>>>>>>> mky may not be present and if present its use = is >>>>>>>>>>>>>> optional. Some sort of mandatory new or = existing >>>>>>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>>>>> Call-ID >>>>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>>>> receiving end >>>>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>>>> (e.g., >>>>>>>>>>>>>> INVITE vs MESSAGE) might be handled by = different >>>>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>>>> difficulties >>>>>>>>>>>>>> with 'it's been used already' coordination = allow a >>>>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>>>> This might >>>>>>>>>>>>>> include an mkey from a captured INVITE. So = it >>>>>>>>>>>>>> may be >>>>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>>>>> using a >>>>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>>>> distributed >>>>>>>>>>>>>> implementations may make the enforcement = difficult, >>>>>>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>>>>> method >>>>>>>>>>>>>> and possibly a numeric ID. Some sort of = '1-use' >>>>>>>>>>>>>> practice should at least be discussed while = perhaps >>>>>>>>>>>>>> not required. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> NITS >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> The verifier MUST inspect any optional = "ppt" >>>>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>>>>>> present, then the >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> verifier proceeds normally below. If a = "ppt" >>>>>>>>>>>>>> parameter value is >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>>>> parameter value is present, >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>>>> including the variations >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> described in Step 5. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> 3 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> = >>>>>>>>>>>>> 447 >>>>>>>>>>>>>> 4bi >>>>>>>>>>>>>> s-10%20- >>>> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>>>> Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >>>> 3>. >>>>>>>>>>>>>> Background >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> [...] >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>>>> ], problems such as >>>>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>>>> applications and services >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>>>> requests. An >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>>>> either as part of a user >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>>>> is a component of a network >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>>>> originating user agents send >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>>>> message has been >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>>>> use end-user SIP identity in an interdomain or = intradomain >>>> context. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>>>> typically obviously >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>>>> own credentials; if they >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>>>> authentication services. However, >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Regards, >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Alex >>>>>>>>>>>>>> * * >>>>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>> _______________________________________________ >>>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> = ----------------------------------------------------------- >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> - >>>>>>>>>>>>>> - >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> ------- >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> This e-mail may contain Sprint proprietary = information >>>>>>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>>>>> use by >>>>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>>>> all copies >>>>>>>>>>>>>> of the message. >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>=20 >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>=20 >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> ________________________________ >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information intended >>>>>>>> for the sole use of the recipient(s). Any use by others is = prohibited. >>>>>>>> If you are not the intended recipient, please contact the = sender >>>>>>>> and delete all copies of the message. >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>=20 >>=20 >> ________________________________ >>=20 >> This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. >=20 From nobody Tue Aug 9 11:51:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9F8C12D189 for ; Tue, 9 Aug 2016 11:51:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PRqUyEBpI2TK for ; Tue, 9 Aug 2016 11:51:28 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB12512D17B for ; Tue, 9 Aug 2016 11:51:28 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.11/8.16.0.11) with SMTP id u79Iig2w000515; Tue, 9 Aug 2016 14:51:24 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049287.ppops.net-00191d01. with ESMTP id 24qmqasdwq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 09 Aug 2016 14:51:23 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u79IpKr3011676; Tue, 9 Aug 2016 14:51:22 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u79Ip2Z5010878 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 9 Aug 2016 14:51:10 -0400 Received: from MISOUT7MSGHUBAH.ITServices.sbc.com (MISOUT7MSGHUBAH.itservices.sbc.com [130.9.129.152]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Tue, 9 Aug 2016 18:50:46 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.146]) by MISOUT7MSGHUBAH.ITServices.sbc.com ([130.9.129.152]) with mapi id 14.03.0301.000; Tue, 9 Aug 2016 14:50:45 -0400 From: "DOLLY, MARTIN C" To: Alex Bobotek , Paul Kyzivat , "Peterson, Jon" , "Gorman, Pierce A [CTO]" , "Dwight, Timothy M (Tim)" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ybRsWQuDxcKz0ueE1p7VelBT6A6wFcAgAAZW4CAAAHSAP//ywiigAYlHOCAAFKtAP//4PGA Date: Tue, 9 Aug 2016 18:50:44 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <4B1956260CD29F4A9622F00322FE053101285D016E37@BOBO1A.bobotek.net> In-Reply-To: <4B1956260CD29F4A9622F00322FE053101285D016E37@BOBO1A.bobotek.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.169.57] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090191 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 18:51:33 -0000 If you sign, the call traces back to you and thereby you can be punished by= the FTC/FCC -----Original Message----- From: Alex Bobotek [mailto:alex@bobotek.net]=20 Sent: Tuesday, August 09, 2016 12:41 PM To: Paul Kyzivat ; Peterson, Jon ; Gorman, Pierce A [CTO] ; Dwight, Timothy= M (Tim) ; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Richard Sho= ckey ; stir@ietf.org; Brian Rosen Subject: RE: [stir] STIR 4474bis-10 comments Paul, The assertion I'm referring to is a bit different. It's: "I (Acme Corp), certify that this message originated and or gatewayed to SI= P on my network, (and btw, I probably know which account/user actually orig= inated this message and take responsibility for its origination or gatewayi= ng)" Is this a good thing? Yes and no. From a security perspective I believe w= e all agree that it's best to have the (possibly delegated) authority of th= e rightful owner of the originating phone number as well as the identity of= the responsible originating service provider (typically the signer). But = this goal will be elusive; there are cases where even a well-meaning a serv= ice provider may not be able to enforce or determine whether the owner of a= n originating number has authorized its use. In these cases, there is hig= h value in knowing the identity of a signer claiming some responsibility fo= r the call's origination. The carriers' abuse desks and systems then know = who to contact for abuse mitigation. The con to this is that some signers may be lazy, and elect to sign while o= mitting or not enforcing number authority policies in cases where they coul= d. So IMO the right question to ask is whether the pros outweigh the cons. IH= MO, the answer is an emphatic yes. Regards, Alex > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: Tuesday, August 9, 2016 8:44 AM > To: Alex Bobotek ; Peterson, Jon > ; Gorman, Pierce A [CTO] > ; Dwight, Timothy M (Tim) > ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; > Richard Shockey ; stir@ietf.org; Brian Rosen > > Subject: Re: [stir] STIR 4474bis-10 comments > > On 8/9/16 5:03 AM, Alex Bobotek wrote: > > Jon, > > > > Thanks much for your thoughtful response to the original points. Yes, > things got somewhat sidetracked. > > > > On the first point (signing without authentication), I do not read 6.1 > > as permitting "I'm signing to assert that I've authorized use of this > > phone number without authenticating the caller and/or completing a > > number delegation authority check", > > I'm not sure I understand. Is this the assertion you are asking for? > > "I (Acme Corp), having administrative authority over number NNN, certify > that this message is "from" NNN, though I have no idea who actually > originated this message." > > This is a good thing??? > > If you sign the message you are taking responsibility for the assertion t= hat it > is from NNN. If you choose to do so without knowing who it is from then t= hat > is your problem. You should be legally liable. At the very least your rep= utation > as a signer should be diminished as fraudulent calls you have signed are > detected. Eventually you will be put on blacklists as an untrustworthy si= gner. > > I guess we could speed the blacklisting by allowing signers to pre-declar= e that > they are untrustworthy. (That seems to be what you are asking for.) > > > a use case that reflects the currently-widespread practice of authoriza= tion > without authentication. > > No wonder we have a problem with spoofed calls. > > Thanks, > Paul > > > My read of section 6.1 is that it allows anonymity rather than signer- > attribution with unauthenticated (non-anonymous) caller identity. Knowin= g > the triple of purported calling phone number that flashes on a recipient'= s > phone, the terminating phone number and a timestamp is important in > reporting/tracing/mitigating abusive calls. [On a side note, I reread Se= ction > 11, but had trouble with the definition of "private URI" (note: "private= URI" > and "private SIP URI" each occur exactly once each in the doc and could > benefit from a definition or two).] Additionally, Brian Rosen's comment= on > 8/4 seems to corroborate my reading of a ban on authorization without > authentication in the non-anonymous case (i.e., that using someone else's > phone number requires that "the entity that is assigned the TN explicitly > authorizes calls placed using it's TN"). > > > > In summary, there is a high value in allowing signing/authorization in = the > categories and use cases Pierce outlined. In my operational experience, = it > really helps to know which company to contact to get the callers kicked o= ff a > network. And signer attribution even without caller authentication is a = huge > win for the public. > > > > > > > > On the second point, thanks for pointing out that 12.1 requires servers= to > keep the state of recently received requests. This is a point that I mis= sed in > my reading of the draft, and this feature as you have described it defeat= s > most conceivable replay attacks. My bad for missing this, but as you sug= gest, > there may be some potential for emphasizing this point. But there's anot= her > part of the issue -- cross method replay. For example, it may be difficu= lt to > expect a messaging node (which handles SIP MESSAGE) and a voice-capable > IMS node (handling SIP INVITE) to coordinate their anti-replay caches, > allowing an attacker that observes a SIP invite for a voice call to piggy= back a > spam text message. As it's common to use the same "To" address for > multiple services that may be served by very different infrastructure > components, it would be beneficial to allow signatures to cover more than > "To", "From/PAI" and "Timestamp". I do not see this issue as meriting > significant delay of a STIR RFC if there's no quick fix. > > > > Regards, > > > > Alex > > > >> -----Original Message----- > >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon > >> Sent: Monday, August 8, 2016 12:46 PM > >> To: Gorman, Pierce A [CTO] ; Paul Kyzivat > >> ; Dwight, Timothy M (Tim) > >> ; DOLLY, MARTIN C > >> Cc: Rosbotham, Paul, Vodafone UK ; > >> Richard Shockey ; stir@ietf.org; Brian Rosen > >> > >> Subject: Re: [stir] STIR 4474bis-10 comments > >> > >> > >> Just so I'm clear, I'm not hearing an ask here in terms of changing > >> the text of rfc4474bis-10, which does allow signing PAI instead of > >> From for precisely the reasons outlined in this lengthy thread. To > >> Alex's original point about providing authorization without > >> authentication, rfc4474bis has a lot of text about signing non-TN > >> identifiers, including for preserving anonymity; see the end of > >> section 6.1, and then the Privacy Considerations in section 11 for > >> more. Those should suffice to provide this property: it will identify = the > service provider who signed without attesting an specific user identity. > >> > >> I also wanted to make sure we didn't drop the other ball that Alex > >> mentioned at the start of this thread, which is the issue of > >> proximate replay within the 60 second Date window. This is addressed > >> in Section 12.1 of rfc4474bis-10, which > >> reads: "Note that per baseline [RFC3261] behavior, servers keep state > >> of recently received requests, and thus if an Identity header is > >> replayed by an attacker within the Date interval, verifiers can > >> detect that it is spoofed because a message with an identical Date > >> from the same source had recently been received." This refers to the > >> text of > >> RFC3261 section 23.4.2, though more properly the Date-related > >> behavior is better detailed in RFC3893 Section 10, which introduced > >> the first version of the partial signature mechanism that ultimately > >> inspired RFC4474. I'll update the text here so it is clearer about exa= ctly > how to detect proximate replay. > >> > >> Jon Peterson > >> Neustar, Inc. > >> > >> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" > >> wrote: > >> > >>> Paul, > >>> > >>> As you know, SIP inter-working is often challenging because of > >>> variability in implementation including proprietary headers (without > >>> an > >>> X-) and support or lack thereof for non-mandatory (per RFC 3261) > >>> headers such as P-Asserted-Identity, (and things like B2BUA stacks > >>> stripping things like display name in From but that's another story). > >>> I could argue that from a cleanliness of protocol implementation, > >>> (and if I wanted to be pedantic), I would strip PAI outbound unless > >>> required otherwise. But the point is moot. As I mentioned in the > >>> earlier e-mail, that is not our practice and I'm not requesting it to= be so. > >>> > >>> Pierce > >>> > >>> > >>> -----Original Message----- > >>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > >>> Sent: August 08, 2016 12:03 PM > >>> To: Gorman, Pierce A [CTO] ; Dwight, > >> Timothy > >>> M > >>> (Tim) ; DOLLY, MARTIN C > >> > >>> Cc: Rosbotham, Paul, Vodafone UK ; > >> Richard > >>> Shockey ; stir@ietf.org; Brian Rosen > >>> > >>> Subject: Re: [stir] STIR 4474bis-10 comments > >>> > >>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: > >>>> Thanks for the added comments Tim. > >>>> > >>>> I agree that passing P-Asserted-Identity between trusted networks > >>>> is appropriate (and the converse is true as well). Part of my > >>>> issue is I have been conditioned from the very earliest > >>>> implementation of Sprint's VoIP network that other carriers' IP > >>>> networks are inherently untrusted. I've been browsing TS 29.165 > >>>> and even there I find language that implies trust is established by > >>>> agreement, not by standard. (Even roaming implies agreement.) > >>> > >>> I understand why *some* stuff needs to be removed when forwarding > to > >> an > >>> untrusted party. For instance, if the call has requested privacy, > >>> then P-A-ID needs to be removed. > >>> > >>> But when privacy is not a concern, trust is really more of a concern > >>> on the ingress side, not egress. If I don't trust you then I won't > >>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I > >>> trust you, but you don't trust me, then what is the downside for > >>> passing along the P-A-ID? > >>> > >>> Thanks, > >>> Paul > >>> > >>>> Regardless, this discussion has been helpful and educational (to me > >>>> at least). And, I confirmed with my operations counterpart we > >>>> generally send PAI today. I've also made note that where standards > >>>> and > >> ICA > >>>> require it, we will include PAI. Thanks again. > >>>> > >>>> Best regards, > >>>> > >>>> Pierce > >>>> > >>>> -----Original Message----- > >>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] > >>>> Sent: August 08, 2016 10:47 AM > >>>> To: Gorman, Pierce A [CTO] ; DOLLY, > >> MARTIN > >>>> C > >>>> Cc: Rosbotham, Paul, Vodafone UK ; > >>>> Richard Shockey ; Paul Kyzivat > >>>> ; stir@ietf.org; Brian Rosen > >>>> > >>>> Subject: RE: [stir] STIR 4474bis-10 comments > >>>> > >>>> Pierce, > >>>> > >>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and > >> GSMA > >>>> IR.95. The latter references and profiles the former. Section > >>>> 4.4.1 of > >>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be > >>>> considered trusted, and table 3 in that section recommends that > >>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. > >>>> It also states that PAI is mandatory at a roaming NNI. > >>>> > >>>> Tim > >>>> > >>>> > >>>> -----Original Message----- > >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, > >>>> Pierce A [CTO] > >>>> Sent: Monday, August 08, 2016 8:52 AM > >>>> To: DOLLY, MARTIN C > >>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; > >>>> stir@ietf.org; Brian Rosen > >>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments > >>>> > >>>> Martin, > >>>> > >>>> You referenced TS 29.195. I'm not familiar with that spec. Has it > >>>> been deprecated? It's not showing up on the 3GPP site. > >>>> > >>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the > >>>> originating side" Note 4 it states, " It is assumed that the IBCF > >>>> is responsible for stripping the P-Asserted-Identity from the SIP > >>>> header when interworking with untrusted networks." > >>>> > >>>> Your remark is consistent with Note 4, but only if we agree that, > >>>> for instance, the AT&T network and the Sprint network are "trusted > >>>> networks". In reality, this is not the case or there would be no > >>>> firewalls or Session Border Controllers used for interworking and > >>>> security. My opinion is the only carrier networks that are trusted > >>>> are the SS7 network, and the Internet backbone. > >>>> > >>>> What it really comes down to is that PAI is left in signaling > >>>> either through formal specification as a part of an inter-carrier > >>>> inter-connection agreement, or by custom (or even by accident). I > >>>> think this illustrates Paul Rosbotham's observation is true. > >>>> > >>>> Pierce > >>>> > >>>> -----Original Message----- > >>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] > >>>> Sent: August 05, 2016 12:55 PM > >>>> To: Gorman, Pierce A [CTO] > >>>> Cc: Rosbotham, Paul, Vodafone UK ; > >> Brian > >>>> Rosen ; stir@ietf.org; Paul Kyzivat > >>>> ; Richard Shockey > >>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>> > >>>> PAI is not stripped at the network boundary between trusted > >>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force > >>>> ITU And the list goes on > >>>> > >>>> Martin C Dolly > >>>> Lead Member of Technical Staff > >>>> Core & Government/Regulatory Standards AT&T > >>>> Cell: 609-903-3360 > >>>> Email: md3135@att.com > >>>> > >>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] > >>>>> wrote: > >>>>> > >>>>> Which header the carrier chooses to display is moot if the header > >>>>> is stripped between carriers as per at least one standard. I > >>>>> think Paul Rosbotham's observation we're likely to encounter "some > >>>>> interesting interworking challenges" was perhaps the > understatement of the year. > >>>>> > >>>>> Pierce > >>>>> > >>>>> -----Original Message----- > >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > >>>>> Sent: August 05, 2016 11:58 AM > >>>>> To: Gorman, Pierce A [CTO] ; Richard > >>>>> Shockey ; Rosbotham, Paul, Vodafone UK > >>>>> ; Brian Rosen > > >>>>> Cc: stir@ietf.org > >>>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>>> > >>>>> If PAI is present and signed, and From is also signed, I would > >>>>> expect it to be up to the UA to decide what to display, not the car= rier. > >>>>> > >>>>> Of course this will work differently if there is a different > >>>>> signaling regime between the carrier and the user device (e.g. > >>>>> black > >> phone). > >>>>> > >>>>> Thanks, > >>>>> Paul > >>>>> > >>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: > >>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP > >>>>>> entities" and therefore some specifications (e.g., 3GPP TS > >>>>>> 24.607) assume P-Asserted-Identity is stripped by border > >>>>>> controller functions and is not to be used in inter-carrier > >>>>>> inter-connection (although it commonly shows up anyway). My > opinion is the "From" > >>>>>> header is likely used more often for presentation. > >>>>>> > >>>>>> Pierce > >>>>>> > >>>>>> > >>>>>> -----Original Message----- > >>>>>> From: Richard Shockey [mailto:richard@shockey.us] > >>>>>> Sent: August 05, 2016 9:37 AM > >>>>>> To: Rosbotham, Paul, Vodafone UK > >> ; > >>>>>> Paul Kyzivat ; Brian Rosen > >>>>>> > >>>>>> Cc: stir@ietf.org > >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>> > >>>>>> Humm this is getting interesting. Its my understanding that the > >>>>>> display number aka "presentation number" in the US context is the > >>>>>> one carried in the PAI. Martin, Pierce? > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone > UK" > >>>>>> paul.rosbotham@vodafone.com> > >> wrote: > >>>>>> > >>>>>> Jumping in now that we're on European working time, +1 on > >>>>>> Paul's observation. > >>>>>> > >>>>>> Here in the UK, we've got 2 numbers carried as calling line > >>>>>> IDs....one (we term the Network Number, carried in PAID) uniquely > >>>>>> identifies the line, the other (we term Presentation Number, > >>>>>> carried in From) is used for display purposes. > >>>>>> > >>>>>> Only the carrier has the authority to set the Network Number > >>>>>> so only they could sign it. > >>>>>> > >>>>>> But - subject to regulatory restrictions which are well > >>>>>> documented > >>>>>> - the number sent for display purposes belongs to the customer. > >>>>>> For blue-chip customers, I can allow them to send their > >>>>>> Presentation Numbers into the network, and can't readily check at > >>>>>> a network level that they're theirs (I do have contractual > >>>>>> safeguards). The number may have been allocated by me, or could > >>>>>> be allocated by a third party provider. If it's a call-centre > >>>>>> they'll be making outbound calls for lots of different customers > >>>>>> which will change on day-by-day > >> basis. > >>>>>> This is business as usual. I don't like the term "authorised > >>>>>> spoofing" because it implies that the CLI is in some way being rig= ged: > >>>>>> it's not, it's the corporate customer or their subcontractor > >>>>>> using the number that's been assigned (so in internet terms > >>>>>> delegated) to them via a chain of trust from the regulator. > >>>>>> > >>>>>> What I want is the ability for customers to use their > >>>>>> credentials to sign the CLIs they send me so that at the > >>>>>> terminating end it can be checked (or indeed somewhere en-route > >>>>>> if that's the business model). > >>>>>> I can and would sign for customers on my mobile business since > >>>>>> I'm driving what number is presented, but that's by-the-by > >>>>>> because they aren't the ones who generate millions of nuisance > >>>>>> calls. If the signing only occurs at the originating carrier > >>>>>> level for corporate/call-centre customers that's no use because > >>>>>> I'm not in a position to do that for these type of > >>>>>> customers...and the whole system becomes a waste of time. I'd > >>>>>> also highlight there are many more of my large customers that I'd > >>>>>> trust more than a far end originating carrier that could be > >>>>>> anywhere in the world (though we have no shortage of small > >>>>>> carriers that I wouldn't know from Adam more locally in the > >>>>>> UK....) > >>>>>> > >>>>>> Regards > >>>>>> > >>>>>> Paul > >>>>>> > >>>>>> -----Original Message----- > >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyz= ivat > >>>>>> Sent: 04 August 2016 23:12 > >>>>>> To: Brian Rosen > >>>>>> Cc: stir@ietf.org > >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments > >>>>>> > >>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: > >>>>>>> I think it's not a delegation. The mobile phone is not being > >>>>>>> delegated the TN, it's being authorized to place calls that are > >>>>>>> not > >>>>>> >from that TN, but appear to be. > >>>>>>> > >>>>>>> The mechanism to handle the credential is exactly the same as a > >>>>>>> delegation, so if you want to call it delegation, go ahead, but > >>>>>>> I prefer to call it authorized spoofing. > >>>>>> > >>>>>> IIUC the delegation is to a responsible entity (something that > >>>>>> can be held legally accountable - e.g. a person), not to a device. > >>>>>> The entity can then "use" the credential via any device(s) it > >>>>>> chooses. In the case of the mobile, the device then becomes a > >>>>>> two-line > >> phone. > >>>>>> > >>>>>> Thanks, > >>>>>> Paul > >>>>>> > >>>>>>> Brian > >>>>>>> > >>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat > >>>>>>>> > >>>>>>>> wrote: > >>>>>>>> > >>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: > >>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is > >>>>>>>>> calling from his mobile, but sending the TN of his office > >>>>>>>>> phone as calling party. > >>>>>>>>> The delegation to his office phone was made by his landline > >>>>>>>>> carrier to him. He then creates another credential, which he > >>>>>>>>> signs with his office phone credential that authorizes his > >>>>>>>>> mobile to send calls from his office number. He is spoofing > >>>>>>>>> (because the call is coming from his mobile's TN but claims to > >>>>>>>>> be from his office), but it's authorized spoofing. The doc > >>>>>>>>> could give the credential to his mobile SP if they sign on his > behalf. > >>>>>>>> > >>>>>>>> I don't understand how that is different from regular delegation= . > >>>>>>>> > >>>>>>>> When his landline carrier gave him a delegated certificate for > >>>>>>>> his landline number, he should be able to install that in > >>>>>>>> whatever devices he wants - his landline UA, his mobile phone, > >>>>>>>> etc. It is still delegated from his landline carrier, even when > >>>>>>>> used with calls via his mobile carrier. > >>>>>>>> > >>>>>>>> Thanks, > >>>>>>>> Paul > >>>>>>>> > >>>>>>>>> Some folks don't like attaching the "spoofing" label to a > >>>>>>>>> legitimate use. > >>>>>>>>> > >>>>>>>>> But that's how I describe it. > >>>>>>>>> > >>>>>>>>> Brian > >>>>>>>>> > >>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat > >>>>>>>>>> > > wrote: > >>>>>>>>>> > >>>>>>>>>> +1, but with one question below: > >>>>>>>>>> > >>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: > >>>>>>>>>>> I think all we need is to have credentials follow the > >>>>>>>>>>> delegation path, > >>>>>>>>>> > >>>>>>>>>>> plus the option to add another level (not delegation) for > >>>>>>>>>>> authorized spoofers. > >>>>>>>>>> > >>>>>>>>>> I don't understand "authorized spoofers" in this context, as > >>>>>>>>>> contrasted to "spoofers" who have been delegated their > >> authority. > >>>>>>>>>> > >>>>>>>>>> Thanks, > >>>>>>>>>> Paul > >>>>>>>>>> > >>>>>>>>>>> I don't think it matters who the delegator or delegatee are > >>>>>>>>>>> as long as the delegator is willing to take the heat for > >>>>>>>>>>> delegating to someone who sends a lot of bad calls. They > >>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm > >>>>>>>>>>> not responsible"), but only if the SP knows who they > >>>>>>>>>>> delegated to, so authorities can follow the delegation path. > >>>>>>>>>>> There are plenty of certificated carriers who are willing to > >>>>>>>>>>> not care who they delegate to. The fact that there are some > >>>>>>>>>>> who do doesn't change much. > >>>>>>>>>>> Making stir work means knowing who you are delegating to, > so > >>>>>>>>>>> that you can pass the hot potato. > >>>>>>>>>>> > >>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign > >>>>>>>>>>> for any calls placed on its network on any number it has > >>>>>>>>>>> been delegated. > >>>>>>>>>>> If it does, it's asserting that the calls are from who they > >>>>>>>>>>> are supposed to be from. > >>>>>>>>>>> That should be straightforward, but we know it's not always, > >>>>>>>>>>> and that represents the hard part of deployment in my > opinion. > >>>>>>>>>>> But once they delegate, they can hand responsibility to sign > >>>>>>>>>>> to the delegatee. But, that only works if they know who > >>>>>>>>>>> they are delegating to. > >>>>>>>>>>> > >>>>>>>>>>> The root of the whole model is that there is a formal or > >>>>>>>>>>> informal delegation path for telephone numbers in every > >>>>>>>>>>> country, and we can build a chain of trust from that > >>>>>>>>>>> delegation path. If you propose to alter that model, then > >>>>>>>>>>> we get into > >>>>>>>>>>> (policy) issues of which carriers/entities we trust and > >>>>>>>>>>> which we don't. > >>>>>>>>>>> Our model is that you know who you delegate to, and once > you > >>>>>>>>>>> do that delegation, it's their problem. > >>>>>>>>>>> That's pretty appealing I think, even if it's a change in > >>>>>>>>>>> some business practices. > >>>>>>>>>>> > >>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI and > >>>>>>>>>>> having a way to know which TNs are covered by a credential. > >>>>>>>>>>> That's what we have, and I'm loath to change it. > >>>>>>>>>>> > >>>>>>>>>>> Brian > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >> > >>>>>>>>>>>> > > >>>>>>>>>>>> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> OK, you talked me into indulging in one more message on > >>>>>>>>>>>> policy and use cases. > >>>>>>>>>>>> > >>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be > deployed > >>>>>>>>>>>> on individual devices as well as multi-device and > >>>>>>>>>>>> multi-number platforms. > >>>>>>>>>>>> > >>>>>>>>>>>> Number delegation (and sub-delegation), and business > >>>>>>>>>>>> relationships are two additional factors which affect > >>>>>>>>>>>> trustworthiness of a given calling number authentication. > >>>>>>>>>>>> > >>>>>>>>>>>> Inherent variable trustworthiness of a calling number was > >>>>>>>>>>>> my reason for suggesting a way to qualify the signature to > >>>>>>>>>>>> reflect that variability. > >>>>>>>>>>>> > >>>>>>>>>>>> Originating carriers are in a position to know if a call is > >>>>>>>>>>>> coming from a device assigned a single number, or from > >>>>>>>>>>>> "trunk group" which could originate calls using multiple > >>>>>>>>>>>> numbers, and can qualify to some degree the > trustworthiness > >>>>>>>>>>>> of number authenticity accordingly. > >>>>>>>>>>>> > >>>>>>>>>>>> My suggestion was qualifying calling number authenticity > >>>>>>>>>>>> into categories of carrier-signed (or not), and > >>>>>>>>>>>> unauthenticated, semi-authenticated, and > >>>>>>>>>>>> most-authenticated. There can be > >> more > >>>>>>>>>>>> granularity, but it implies additional operational > >>>>>>>>>>>> complexity (both for the carriers and the consumers) and I > >>>>>>>>>>>> assume diminishes value. > >>>>>>>>>>>> > >>>>>>>>>>>> My reason for adding the authenticity of the originating > >>>>>>>>>>>> carrier is typical trustworthiness of a carrier business > >>>>>>>>>>>> relationship with typical consumers adds to the > >>>>>>>>>>>> trustworthiness assessment and partially because carriers > >>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and frau= d. > >>>>>>>>>>>> Additionally, most calls originate and terminate between > >>>>>>>>>>>> mobile consumers where their carriers are able to usefully > >>>>>>>>>>>> authenticate their device and have a high degree of > >>>>>>>>>>>> confidence of the authenticity of the calling number. > >>>>>>>>>>>> > >>>>>>>>>>>> I think billions of per-TN certs of varying usability > >>>>>>>>>>>> (revoked, not > >>>>>>>>>>>> revoked) for authenticating calling number will not work > well. > >>>>>>>>>>>> > >>>>>>>>>>>> Conversely, I think billions of per-TN certs will work > >>>>>>>>>>>> well, if the calling party has to sign a call with a per-TN > >>>>>>>>>>>> cert provided by the called party. No called party cert to > include? > >>>>>>>>>>>> Then the calling party does not have a trusted relationship > >>>>>>>>>>>> with the called party, and the call can be > >>>>>>>>>>>> authorized/treated accordingly. > >>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) > >>>>>>>>>>>> > >>>>>>>>>>>> Pierce > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM > >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; > >>>>>>>>>>>> stir@ietf.org > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> Well, the mechanisms are designed so that they could be > >>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a > >>>>>>>>>>>> policy issue. > >>>>>>>>>>>> > >>>>>>>>>>>> The notion of credentials that are traceable to a > >>>>>>>>>>>> delegation of a TN is a mechanism that is part of the > >>>>>>>>>>>> design of stir, and the design allows delegation of one TN > >>>>>>>>>>>> (to one device, although a device like a PBX would have > >>>>>>>>>>>> more than one TN per "device", and something like a dual > >>>>>>>>>>>> NAM phone could have > >> more > >>>>>>>>>>>> than one credential. For the use case we've discussed, a > >>>>>>>>>>>> mobile phone may also have a credential for, say, a TN that > >>>>>>>>>>>> is delegated to a landline, to cover the example case of a > >>>>>>>>>>>> doctor placing a call on his mobile, but getting his office > >>>>>>>>>>>> number to show up as the calling party. Use of such > mechanisms is policy. > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >> > >>>>>>>>>>>> > > >>>>>>>>>>>> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy > >>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. > >>>>>>>>>>>> I would like to continue the discussion, but I'm pretty > >>>>>>>>>>>> sure this isn't the right forum. > >>>>>>>>>>>> > >>>>>>>>>>>> Pierce > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM > >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> >; > >>>>>>>>>>>> stir@ietf.org > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart > >>>>>>>>>>>> phones and any other devices that can be programmed to > do > >> so. > >>>>>>>>>>>> They will be given credentials that only are valid for the > >>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign > >>>>>>>>>>>> any call, but the validity of the credential would make > >>>>>>>>>>>> such a signature fail the checking. > >>>>>>>>>>>> > >>>>>>>>>>>> Getting service providers to sign on behalf of devices is > >>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs > >>>>>>>>>>>> will want to get out of the liability of signing on behalf > >>>>>>>>>>>> of their customers. If they can push of that > >>>>>>>>>>>> responsibility to their customer, only being responsible > >>>>>>>>>>>> for getting the customer an appropriate credential when > >>>>>>>>>>>> they assign TNs, then I would expect them to want to do > >>>>>>>>>>>> so. That means the devices have to be able to sign, but I > >>>>>>>>>>>> understand many of the PBX vendors think that's something > >>>>>>>>>>>> they could provide in a future release. > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it > >>>>>>>>>>>> extraordinarily easy to commit fraud with > >>>>>>>>>>>> authenticated numbers? > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM > >>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] > >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>> > >>>>>>>>>>>> >; stir@ietf.org > >>>>>>>>>>>> > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> First of all, we would want the PBX to generate the > >>>>>>>>>>>> signature, > >>>>>>>>>>>> but the service provider can do that. It should not ad= d a > >>>>>>>>>>>> valid signature to a call from a number it did not > >>>>>>>>>>>> assign to > >>>>>>>>>>>> the trunk group connecting to the PBX, although it coul= d > >>>>>>>>>>>> support the extra delegation required to support > >>>>>>>>>>>> "authorized > >>>>>>>>>>>> spoofing". The companion devices I'm aware of always > send > >>>>>>>>>>>> calls from the same service provider and should not > present > >>>>>>>>>>>> any issue. > >>>>>>>>>>>> > >>>>>>>>>>>> Everyone will have to do work they don't do now to > >>>>>>>>>>>> implement > >>>>>>>>>>>> stop spoofed calls. TANSTAAFL > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] > >>>>>>>>>>>> >>>>>>>>>>>> > >>>>>>>>>>>> > wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> Fraud from compromised PBXes is common. And even > >>>>>>>>>>>> where a > >>>>>>>>>>>> PBX is not compromised, a carrier has no practical > >>>>>>>>>>>> way of > >>>>>>>>>>>> knowing whether the calling number is properly > assigned > >>>>>>>>>>>> and valid from the perspective of the Enterprise. > >>>>>>>>>>>> Therefore, checking whether the calling number was > >>>>>>>>>>> >from an > >>>>>>>>>>>> assigned range might be possible (and fraught with > >>>>>>>>>>>> administrative challenges), but of limited value. > >>>>>>>>>>>> And in > >>>>>>>>>>>> the consumer market, there are calling products whi= ch > >>>>>>>>>>>> support a parent subscriber number and "companion" > >>>>>>>>>>>> devices > >>>>>>>>>>>> (e.g., tablets) which can place a call using the MD= N of > >>>>>>>>>>>> the parent subscriber. These are examples of where > the > >>>>>>>>>>>> authenticity of the calling number won't > >>>>>>>>>>>> necessarily mean > >>>>>>>>>>>> the same thing as the authenticity of a call from > >>>>>>>>>>>> a single > >>>>>>>>>>>> subscriber with a single MDN regardless of "laxity"= of > >>>>>>>>>>>> spoof checking. > >>>>>>>>>>>> > >>>>>>>>>>>> In another forum and anticipating calling number > >>>>>>>>>>>> authentication mandates from Congress and/or FCC, I > >>>>>>>>>>>> suggested using carrier-specific certs and encoding > >>>>>>>>>>>> specificity of authenticity, and calling number. T= his > >>>>>>>>>>>> provides the identity of the originating carrier, s= ome > >>>>>>>>>>>> idea as to the accuracy or specificity of the calli= ng > >>>>>>>>>>>> number, and validty of the calling number > >>>>>>>>>>>> (assuming nonce > >>>>>>>>>>>> and replay issues can be addressed as reasonably > >>>>>>>>>>>> suggested > >>>>>>>>>>>> below by Alex). > >>>>>>>>>>>> > >>>>>>>>>>>> The representation of orig-carrier and trustworthin= ess > >>>>>>>>>>>> could be as follows: > >>>>>>>>>>>> > >>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* > >>>>>>>>>>>> > >>>>>>>>>>>> *00 - No Credentials* > >>>>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switch= ed > >>>>>>>>>>>> networks that don't natively support SIP or which d= on't > >>>>>>>>>>>> choose to sign calls. E.g., international carriers= . > >>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN > >>>>>>>>>>>> entirely untrustworthy. > >>>>>>>>>>>> > >>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* > >>>>>>>>>>>> Use case example(s): E911 on visited network w/o > >>>>>>>>>>>> roaming > >>>>>>>>>>>> agreement, manual roaming. > >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN > >>>>>>>>>>>> entirely > >>>>>>>>>>>> untrustworthy > >>>>>>>>>>>> > >>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* > >>>>>>>>>>>> Use case example(s): Number block delegated from > >>>>>>>>>>>> OCN, but > >>>>>>>>>>>> no per-TN screen (SIP trunks). > >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN > >>>>>>>>>>>> less than > >>>>>>>>>>>> most trustworthy but not entirely untrustworthy. > >>>>>>>>>>>> > >>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* > >>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of > >>>>>>>>>>>> calls from > >>>>>>>>>>>> subscriber lines (IMS-based and otherwise). > >>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN mos= t > >>>>>>>>>>>> trustworthy > >>>>>>>>>>>> > >>>>>>>>>>>> *Public Use Case:* > >>>>>>>>>>>> > >>>>>>>>>>>> Undefined but assumed to use public or commercially > >>>>>>>>>>>> available authentication services resources. e.g., > >>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et > >>>>>>>>>>>> cetera. > >>>>>>>>>>>> Could/would pass credentials down to SIP-aware > devices > >>>>>>>>>>>> which would process them according to the rules of = the > >>>>>>>>>>>> Public Class application(s). > >>>>>>>>>>>> > >>>>>>>>>>>> Pierce > >>>>>>>>>>>> > >>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] > >>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM > >>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>> > >>>>>>>>>>>> > > >>>>>>>>>>>> *Cc:* stir@ietf.org > >>>>>>>>>>>> > >>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments > >>>>>>>>>>>> > >>>>>>>>>>>> There are reasonable circumstances where a party > >>>>>>>>>>>> placing a > >>>>>>>>>>>> call is not the authorized entity assigned the > >>>>>>>>>>>> telephone > >>>>>>>>>>>> number used in From/PAI, and in such circumstances > the > >>>>>>>>>>>> service provider servicing the entity placing the > >>>>>>>>>>>> call may > >>>>>>>>>>>> or may not be the same as the service provider > >>>>>>>>>>>> serving the > >>>>>>>>>>>> entity that is assigned the TN. In all such cases,= the > >>>>>>>>>>>> entity that is assigned the TN explicitly > >>>>>>>>>>>> authorizes calls > >>>>>>>>>>>> placed using it's TN. The design accommodates such= use > >>>>>>>>>>>> cases. It's not a blanket authorization without > >>>>>>>>>>>> authentication. We're not aware of any cases wher= e > >>>>>>>>>>>> there > >>>>>>>>>>>> is an actual requirement for legitimate calling wit= hout > >>>>>>>>>>>> explicit authorization from the assigned entity, > >>>>>>>>>>>> although > >>>>>>>>>>>> we certainly are aware that various parts of variou= s > >>>>>>>>>>>> service providers don't bother to check. At this > >>>>>>>>>>>> point, at > >>>>>>>>>>>> least in some countries, there is a realization > >>>>>>>>>>>> that the > >>>>>>>>>>>> laxity of allowing unchecked spoofing is not accept= able > >>>>>>>>>>>> any more. > >>>>>>>>>>>> > >>>>>>>>>>>> Brian > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek > >>>>>>>>>>>> > >>>>>>>>>>>> > wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> 1. Permit authorization without > >>>>>>>>>>>> authentication > >>>>>>>>>>>> In the current telephony network practice, some > >>>>>>>>>>>> service provider implementations choose not to > >>>>>>>>>>>> authenticate identity, but simply facilitate > >>>>>>>>>>>> the use > >>>>>>>>>>>> of an arbitrary or selected user-provided ident= ity. > >>>>>>>>>>>> Are there legitimate use cases for this? Has > >>>>>>>>>>>> anyone > >>>>>>>>>>>> established that there are not? How can the > >>>>>>>>>>>> industry > >>>>>>>>>>>> reasonably expect to end this (often bad) pract= ice? > >>>>>>>>>>>> If it can't be ended, there's value in at least > >>>>>>>>>>>> identifying the originating service provider > >>>>>>>>>>>> (i.e., the signer/authorizer). Given the > >>>>>>>>>>>> prevalence > >>>>>>>>>>>> of abuse using telephone numbers assigned to a > >>>>>>>>>>>> sometimes-anonymous abuser, it becomes critical= ly > >>>>>>>>>>>> important to identify the service provider(s) > >>>>>>>>>>>> closest > >>>>>>>>>>>> to the abuser. Based on the assumption that it= 's > >>>>>>>>>>>> better to ID service providers than unreasonabl= y > >>>>>>>>>>>> expect a ban of the use of unauthenticated (and > >>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing > >>>>>>>>>>>> should > >>>>>>>>>>>> support authorization without authentication. = The > >>>>>>>>>>>> practice of authorizing unauthenticated use exi= sts, > >>>>>>>>>>>> and there is benefit to signing in these cases > >>>>>>>>>>>> (service provider identification). The languag= e of > >>>>>>>>>>>> the ID should permit this use. 4474bis-10 > >>>>>>>>>>>> should NOT > >>>>>>>>>>>> require or assume that that authentication wil= l > >>>>>>>>>>>> precede authorization. Of course there may be o= ther > >>>>>>>>>>>> use cases where signing includes authentication= and > >>>>>>>>>>>> may not include a specific service provider's > >>>>>>>>>>>> authorization. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> 2. Improve replay prevention > >>>>>>>>>>>> Proximate replay is possible while complying > >>>>>>>>>>>> with this > >>>>>>>>>>>> spec. First, one or more proximate (e.g., > >>>>>>>>>>>> within > >>>>>>>>>>>> 60 > >>>>>>>>>>>> seconds) SIP requests using the same token are > >>>>>>>>>>>> legal > >>>>>>>>>>>> and subject to replay in many cases. An SDP bo= dy's > >>>>>>>>>>>> mky may not be present and if present its use i= s > >>>>>>>>>>>> optional. Some sort of mandatory new or existi= ng > >>>>>>>>>>>> signed sequence, random # or request ID (e.g., > >>>>>>>>>>>> Call-ID > >>>>>>>>>>>> or CSeq) and a 1-time use policy on the > >>>>>>>>>>>> receiving end > >>>>>>>>>>>> of the request (e.g., tokens only good for 1 > >>>>>>>>>>>> use) could prevent replay. Different methods > >>>>>>>>>>>> (e.g., > >>>>>>>>>>>> INVITE vs MESSAGE) might be handled by differen= t > >>>>>>>>>>>> receiving infrastructure, and therefore > >>>>>>>>>>>> difficulties > >>>>>>>>>>>> with 'it's been used already' coordination allo= w a > >>>>>>>>>>>> faked MESSAGE based on a captured request. > >>>>>>>>>>>> This might > >>>>>>>>>>>> include an mkey from a captured INVITE. So it > >>>>>>>>>>>> may be > >>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient > >>>>>>>>>>>> using a > >>>>>>>>>>>> captured identity. While large-scale or > >>>>>>>>>>>> distributed > >>>>>>>>>>>> implementations may make the enforcement diffic= ult, > >>>>>>>>>>>> there is little cost to signing and decoding a > >>>>>>>>>>>> method > >>>>>>>>>>>> and possibly a numeric ID. Some sort of '1-us= e' > >>>>>>>>>>>> practice should at least be discussed while per= haps > >>>>>>>>>>>> not required. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Specific markup suggestions: > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> NITS > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> The verifier MUST inspect any optional "ppt" > >>>>>>>>>>>> parameter appearing *in*the > >>>>>>>>>>>> > >>>>>>>>>>>> Identity request. If no "ppt" parameter is > >>>>>>>>>>>> present, then the > >>>>>>>>>>>> > >>>>>>>>>>>> verifier proceeds normally below. If a "ppt= " > >>>>>>>>>>>> parameter value is > >>>>>>>>>>>> > >>>>>>>>>>>> present, and the verifier does not support > >>>>>>>>>>>> it, it MUST ignore the > >>>>>>>>>>>> > >>>>>>>>>>>> Identity header. If a supported "ppt" > >>>>>>>>>>>> parameter value is present, > >>>>>>>>>>>> > >>>>>>>>>>>> the verifier follows the procedures below, > >>>>>>>>>>>> including the variations > >>>>>>>>>>>> > >>>>>>>>>>>> described in Step 5. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> 3 > >>>>>>>>>>>> > >>>>>>>>>>>> >>>>>>>>>>>> 447 > >>>>>>>>>>>> 4bi > >>>>>>>>>>>> s-10%20- > >> %20Authenticated%20Identity%20Management%20in%20the%20 > >>>>>>>>>>>> Ses > sion%20Initiation%20Protocol%20%28SIP%29.htm#section- > >> 3>. > >>>>>>>>>>>> Background > >>>>>>>>>>>> > >>>>>>>>>>>> [...] > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Per [RFC7340 > >>>>>>>>>>>> ], problems such as > >>>>>>>>>>>> robocalling, voicemail hacking, and > >>>>>>>>>>>> > >>>>>>>>>>>> swatting are enabled by an attacker's > >>>>>>>>>>>> ability to impersonate someone > >>>>>>>>>>>> > >>>>>>>>>>>> else. The secure operation of most SIP > >>>>>>>>>>>> applications and services > >>>>>>>>>>>> > >>>>>>>>>>>> depends on authenticating and/or > >>>>>>>>>>>> authorizing the source of communications as it is > >>>>>>>>>>>> > >>>>>>>>>>>> represented in a SIP request. > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> This identity architecture for SIP depends > >>>>>>>>>>>> on includes provisions for a logical > >>>>>>>>>>>> > >>>>>>>>>>>> "authentication service" which validates > >>>>>>>>>>>> caller identity at or near origination. outgoing > >>>>>>>>>>>> requests. An > >>>>>>>>>>>> > >>>>>>>>>>>> authentication service may be implemented > >>>>>>>>>>>> either as part of a user > >>>>>>>>>>>> > >>>>>>>>>>>> agent or as a proxy server; typically, it > >>>>>>>>>>>> is a component of a network > >>>>>>>>>>>> > >>>>>>>>>>>> intermediary like a proxy to which > >>>>>>>>>>>> originating user agents send > >>>>>>>>>>>> > >>>>>>>>>>>> unsigned requests. Once the sender of the > >>>>>>>>>>>> message has been > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> This document specifies a means of sharing > >>>>>>>>>>>> a cryptographic assurance > >>>>>>>>>>>> > >>>>>>>>>>>> of authenticity of and/or authorization to > >>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain > >> context. > >>>>>>>>>>>> > >>>>>>>>>>>> It relies on the authentication service > >>>>>>>>>>>> constructing tokens based on [...] > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> To maximize end-to-end security, it is > >>>>>>>>>>>> typically obviously > >>>>>>>>>>>> > >>>>>>>>>>>> preferable for end-users to acquire their > >>>>>>>>>>>> own credentials; if they > >>>>>>>>>>>> > >>>>>>>>>>>> do, their user agents can act as > >>>>>>>>>>>> authentication services. However, > >>>>>>>>>>>> > >>>>>>>>>>>> for some deployments, [...] > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Regards, > >>>>>>>>>>>> > >>>>>>>>>>>> Alex > >>>>>>>>>>>> * * > >>>>>>>>>>>> *Alex Bobotek* > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >> _______________________________________________ > >>>>>>>>>>>> stir mailing list > >>>>>>>>>>>> stir@ietf.org > >>>>>>>>>>>> > >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> ----------------------------------------------------------- > >>>>>>>>>>>> -- > >>>>>>>>>>>> - > >>>>>>>>>>>> - > >>>>>>>>>>>> -- > >>>>>>>>>>>> ------- > >>>>>>>>>>>> > >>>>>>>>>>>> This e-mail may contain Sprint proprietary informat= ion > >>>>>>>>>>>> intended for the sole use of the recipient(s). Any > >>>>>>>>>>>> use by > >>>>>>>>>>>> others is prohibited. If you are not the intended > >>>>>>>>>>>> recipient, please contact the sender and delete > >>>>>>>>>>>> all copies > >>>>>>>>>>>> of the message. > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> _______________________________________________ > >>>>>>>>>>> stir mailing list > >>>>>>>>>>> stir@ietf.org > >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>>>> > >>>>>>>>>> _______________________________________________ > >>>>>>>>>> stir mailing list > >>>>>>>>>> stir@ietf.org > >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>>>> > >>>>>>>> _______________________________________________ > >>>>>>>> stir mailing list > >>>>>>>> stir@ietf.org > >>>>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> _______________________________________________ > >>>>>> stir mailing list > >>>>>> stir@ietf.org > >>>>>> https://www.ietf.org/mailman/listinfo/stir > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> ________________________________ > >>>>>> > >>>>>> This e-mail may contain Sprint proprietary information intended > >>>>>> for the sole use of the recipient(s). Any use by others is prohibi= ted. > >>>>>> If you are not the intended recipient, please contact the sender > >>>>>> and delete all copies of the message. > >>>>> > >>>>> _______________________________________________ > >>>>> stir mailing list > >>>>> stir@ietf.org > >>>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>>> > >>>> _______________________________________________ > >>>> stir mailing list > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir > >>>> > >>> > >>> _______________________________________________ > >>> stir mailing list > >>> stir@ietf.org > >>> https://www.ietf.org/mailman/listinfo/stir > >> > >> > >> _______________________________________________ > >> stir mailing list > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir > > From nobody Tue Aug 9 11:56:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 209EA12D5CB for ; Tue, 9 Aug 2016 11:56:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6mhjTHHNWdkF for ; Tue, 9 Aug 2016 11:56:20 -0700 (PDT) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A317512B013 for ; Tue, 9 Aug 2016 11:56:19 -0700 (PDT) Received: by mail-qt0-x22f.google.com with SMTP id 52so10267766qtq.3 for ; Tue, 09 Aug 2016 11:56:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=kWY0QHpG9DmEHLb+qId1m9op02QQTKA2amIIvqUyl+Y=; b=IPTVSc+uejulXMIKODLWuAdiDjk6DsLIY3tgJzlYvCxv5D9RSawb8dGTcG7u4BYyR7 orJIqYqZPuhf7kD4OnAlTiHNEBO11yOwQTJnOMumAMi02jozK8h+vUgoigjUCDoQrfSz r4faRi09b3Ku37AjO+pPh/pGWAhfe6I2U1GfkyyWMNpkKvulkaxnCTnR154zTSxZL6jd 1+N+SSazJudZ3jCewDvyTHBrLwaWFSdmTTUgP1i3Sx9qiv0s76LvBGV63GjQlDN4zzlN sv90RMtiLH7tMUPM/EV2HB7ZWnPV8PMEf+5eiQd2kDFYKeOFx7p7qjn7o4Q8WeCohLwM QItw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=kWY0QHpG9DmEHLb+qId1m9op02QQTKA2amIIvqUyl+Y=; b=l/31uBIh1KW1uwqyQ5A9DSPKc+9xKJ7FdCmKur9sRraNY90qPbFV3L5vBqfXQh3qRY WsWQJe2RVD4H7CkGtZhcqELIcu88o+pG1/6lTR7gotyyhUWXxKa206//GBeksnMzJhNu a3RSGwPzed+pk9+PAyZjGVewegB4u3n8VH0WJ14Cx8bcD1Gvjf7DSOGBfTcWskuWLCQI DKk9A+Kk1JIyxulAjMbKO3sY5oTeGeMSdAhx7I9JMuaEV6jJPYHPvSQYP/8Z+xmGvZmO Z46vXrM0LS0dwzblNTTDv98g/RO1uoxA5ze4N8l3H3Ngv9wV4QXzgkOXPk4Uac2L5pEf Xhyg== X-Gm-Message-State: AEkoouuWr6WNsRwmb4aP3TvhjzISG7h8vbCKm6P5CqFZ24Nw9ra16vHxhEVXznukn6wiIw== X-Received: by 10.200.41.88 with SMTP id z24mr34883131qtz.127.1470768978215; Tue, 09 Aug 2016 11:56:18 -0700 (PDT) Received: from [10.0.1.72] (dynamic-acs-24-154-119-181.zoominternet.net. [24.154.119.181]) by smtp.gmail.com with ESMTPSA id l63sm21145408qkf.16.2016.08.09.11.56.16 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 09 Aug 2016 11:56:16 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Tue, 9 Aug 2016 14:56:14 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <182C2D77-DEF1-4D19-8804-8E5FEABC1294@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <4B1956260CD29F4A9622F00322FE053101285D016E37@BOBO1A.bobotek.net> To: "DOLLY, MARTIN C" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "Peterson, Jon" , "Rosbotham, Paul, Vodafone UK" , Paul Kyzivat , Richard Shockey , "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" , Alex Bobotek , "Dwight, Timothy M \(Tim\)" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 18:56:24 -0000 Yup, the ultimate motivator to push the problem upstream to your = customer. But, you have to KNOW your customer. If the FTC/FCC or equivalent in = other jurisdictions can=E2=80=99t follow the cert trail back, then you = are left holding the bag. So it probably won=E2=80=99t work to push off signing authority to a = subscriber you only know by an email address and a pre-paid debit card. Remember that anonymity is allowed, but it has to be labeled as = anonymous. You can=E2=80=99t spoof and claim it=E2=80=99s because you = want to remain anonymous.=20 Brian > On Aug 9, 2016, at 2:50 PM, DOLLY, MARTIN C wrote: >=20 > If you sign, the call traces back to you and thereby you can be = punished by the FTC/FCC >=20 > -----Original Message----- > From: Alex Bobotek [mailto:alex@bobotek.net]=20 > Sent: Tuesday, August 09, 2016 12:41 PM > To: Paul Kyzivat ; Peterson, Jon = ; Gorman, Pierce A [CTO] = ; Dwight, Timothy M (Tim) = ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; = Richard Shockey ; stir@ietf.org; Brian Rosen = > Subject: RE: [stir] STIR 4474bis-10 comments >=20 > Paul, >=20 > The assertion I'm referring to is a bit different. It's: >=20 > "I (Acme Corp), certify that this message originated and or gatewayed = to SIP on my network, (and btw, I probably know which account/user = actually originated this message and take responsibility for its = origination or gatewaying)" >=20 > Is this a good thing? Yes and no. =46rom a security perspective I = believe we all agree that it's best to have the (possibly delegated) = authority of the rightful owner of the originating phone number as well = as the identity of the responsible originating service provider = (typically the signer). But this goal will be elusive; there are cases = where even a well-meaning a service provider may not be able to enforce = or determine whether the owner of an originating number has authorized = its use. In these cases, there is high value in knowing the identity = of a signer claiming some responsibility for the call's origination. = The carriers' abuse desks and systems then know who to contact for abuse = mitigation. >=20 > The con to this is that some signers may be lazy, and elect to sign = while omitting or not enforcing number authority policies in cases where = they could. >=20 > So IMO the right question to ask is whether the pros outweigh the = cons. IHMO, the answer is an emphatic yes. >=20 >=20 > Regards, >=20 > Alex >=20 >=20 >=20 >=20 >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: Tuesday, August 9, 2016 8:44 AM >> To: Alex Bobotek ; Peterson, Jon >> ; Gorman, Pierce A [CTO] >> ; Dwight, Timothy M (Tim) >> ; DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK ; >> Richard Shockey ; stir@ietf.org; Brian Rosen >> >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >> On 8/9/16 5:03 AM, Alex Bobotek wrote: >>> Jon, >>>=20 >>> Thanks much for your thoughtful response to the original points. = Yes, >> things got somewhat sidetracked. >>>=20 >>> On the first point (signing without authentication), I do not read = 6.1 >>> as permitting "I'm signing to assert that I've authorized use of = this >>> phone number without authenticating the caller and/or completing a >>> number delegation authority check", >>=20 >> I'm not sure I understand. Is this the assertion you are asking for? >>=20 >> "I (Acme Corp), having administrative authority over number NNN, = certify >> that this message is "from" NNN, though I have no idea who actually >> originated this message." >>=20 >> This is a good thing??? >>=20 >> If you sign the message you are taking responsibility for the = assertion that it >> is from NNN. If you choose to do so without knowing who it is from = then that >> is your problem. You should be legally liable. At the very least your = reputation >> as a signer should be diminished as fraudulent calls you have signed = are >> detected. Eventually you will be put on blacklists as an = untrustworthy signer. >>=20 >> I guess we could speed the blacklisting by allowing signers to = pre-declare that >> they are untrustworthy. (That seems to be what you are asking for.) >>=20 >>> a use case that reflects the currently-widespread practice of = authorization >> without authentication. >>=20 >> No wonder we have a problem with spoofed calls. >>=20 >> Thanks, >> Paul >>=20 >>> My read of section 6.1 is that it allows anonymity rather than = signer- >> attribution with unauthenticated (non-anonymous) caller identity. = Knowing >> the triple of purported calling phone number that flashes on a = recipient's >> phone, the terminating phone number and a timestamp is important in >> reporting/tracing/mitigating abusive calls. [On a side note, I = reread Section >> 11, but had trouble with the definition of "private URI" (note: = "private URI" >> and "private SIP URI" each occur exactly once each in the doc and = could >> benefit from a definition or two).] Additionally, Brian Rosen's = comment on >> 8/4 seems to corroborate my reading of a ban on authorization without >> authentication in the non-anonymous case (i.e., that using someone = else's >> phone number requires that "the entity that is assigned the TN = explicitly >> authorizes calls placed using it's TN"). >>>=20 >>> In summary, there is a high value in allowing signing/authorization = in the >> categories and use cases Pierce outlined. In my operational = experience, it >> really helps to know which company to contact to get the callers = kicked off a >> network. And signer attribution even without caller authentication = is a huge >> win for the public. >>>=20 >>>=20 >>>=20 >>> On the second point, thanks for pointing out that 12.1 requires = servers to >> keep the state of recently received requests. This is a point that I = missed in >> my reading of the draft, and this feature as you have described it = defeats >> most conceivable replay attacks. My bad for missing this, but as you = suggest, >> there may be some potential for emphasizing this point. But there's = another >> part of the issue -- cross method replay. For example, it may be = difficult to >> expect a messaging node (which handles SIP MESSAGE) and a = voice-capable >> IMS node (handling SIP INVITE) to coordinate their anti-replay = caches, >> allowing an attacker that observes a SIP invite for a voice call to = piggyback a >> spam text message. As it's common to use the same "To" address for >> multiple services that may be served by very different infrastructure >> components, it would be beneficial to allow signatures to cover more = than >> "To", "From/PAI" and "Timestamp". I do not see this issue as = meriting >> significant delay of a STIR RFC if there's no quick fix. >>>=20 >>> Regards, >>>=20 >>> Alex >>>=20 >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, = Jon >>>> Sent: Monday, August 8, 2016 12:46 PM >>>> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >>>> ; Dwight, Timothy M (Tim) >>>> ; DOLLY, MARTIN C >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard Shockey ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>=20 >>>>=20 >>>> Just so I'm clear, I'm not hearing an ask here in terms of changing >>>> the text of rfc4474bis-10, which does allow signing PAI instead of >>>> =46rom for precisely the reasons outlined in this lengthy thread. = To >>>> Alex's original point about providing authorization without >>>> authentication, rfc4474bis has a lot of text about signing non-TN >>>> identifiers, including for preserving anonymity; see the end of >>>> section 6.1, and then the Privacy Considerations in section 11 for >>>> more. Those should suffice to provide this property: it will = identify the >> service provider who signed without attesting an specific user = identity. >>>>=20 >>>> I also wanted to make sure we didn't drop the other ball that Alex >>>> mentioned at the start of this thread, which is the issue of >>>> proximate replay within the 60 second Date window. This is = addressed >>>> in Section 12.1 of rfc4474bis-10, which >>>> reads: "Note that per baseline [RFC3261] behavior, servers keep = state >>>> of recently received requests, and thus if an Identity header is >>>> replayed by an attacker within the Date interval, verifiers can >>>> detect that it is spoofed because a message with an identical Date >>>> from the same source had recently been received." This refers to = the >>>> text of >>>> RFC3261 section 23.4.2, though more properly the Date-related >>>> behavior is better detailed in RFC3893 Section 10, which introduced >>>> the first version of the partial signature mechanism that = ultimately >>>> inspired RFC4474. I'll update the text here so it is clearer about = exactly >> how to detect proximate replay. >>>>=20 >>>> Jon Peterson >>>> Neustar, Inc. >>>>=20 >>>> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >>>> = wrote: >>>>=20 >>>>> Paul, >>>>>=20 >>>>> As you know, SIP inter-working is often challenging because of >>>>> variability in implementation including proprietary headers = (without >>>>> an >>>>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>>>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>>>> stripping things like display name in =46rom but that's another = story). >>>>> I could argue that from a cleanliness of protocol implementation, >>>>> (and if I wanted to be pedantic), I would strip PAI outbound = unless >>>>> required otherwise. But the point is moot. As I mentioned in the >>>>> earlier e-mail, that is not our practice and I'm not requesting it = to be so. >>>>>=20 >>>>> Pierce >>>>>=20 >>>>>=20 >>>>> -----Original Message----- >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>> Sent: August 08, 2016 12:03 PM >>>>> To: Gorman, Pierce A [CTO] ; Dwight, >>>> Timothy >>>>> M >>>>> (Tim) ; DOLLY, MARTIN C >>>> >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard >>>>> Shockey ; stir@ietf.org; Brian Rosen >>>>> >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>=20 >>>>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>>>> Thanks for the added comments Tim. >>>>>>=20 >>>>>> I agree that passing P-Asserted-Identity between trusted networks >>>>>> is appropriate (and the converse is true as well). Part of my >>>>>> issue is I have been conditioned from the very earliest >>>>>> implementation of Sprint's VoIP network that other carriers' IP >>>>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>>>> and even there I find language that implies trust is established = by >>>>>> agreement, not by standard. (Even roaming implies agreement.) >>>>>=20 >>>>> I understand why *some* stuff needs to be removed when forwarding >> to >>>> an >>>>> untrusted party. For instance, if the call has requested privacy, >>>>> then P-A-ID needs to be removed. >>>>>=20 >>>>> But when privacy is not a concern, trust is really more of a = concern >>>>> on the ingress side, not egress. If I don't trust you then I won't >>>>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>>>> trust you, but you don't trust me, then what is the downside for >>>>> passing along the P-A-ID? >>>>>=20 >>>>> Thanks, >>>>> Paul >>>>>=20 >>>>>> Regardless, this discussion has been helpful and educational (to = me >>>>>> at least). And, I confirmed with my operations counterpart we >>>>>> generally send PAI today. I've also made note that where = standards >>>>>> and >>>> ICA >>>>>> require it, we will include PAI. Thanks again. >>>>>>=20 >>>>>> Best regards, >>>>>>=20 >>>>>> Pierce >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>>>> Sent: August 08, 2016 10:47 AM >>>>>> To: Gorman, Pierce A [CTO] ; DOLLY, >>>> MARTIN >>>>>> C >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>>>> Richard Shockey ; Paul Kyzivat >>>>>> ; stir@ietf.org; Brian Rosen >>>>>> >>>>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> Pierce, >>>>>>=20 >>>>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >>>> GSMA >>>>>> IR.95. The latter references and profiles the former. Section >>>>>> 4.4.1 of >>>>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>>>> considered trusted, and table 3 in that section recommends that >>>>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>>>> It also states that PAI is mandatory at a roaming NNI. >>>>>>=20 >>>>>> Tim >>>>>>=20 >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>>>> Pierce A [CTO] >>>>>> Sent: Monday, August 08, 2016 8:52 AM >>>>>> To: DOLLY, MARTIN C >>>>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>>>> stir@ietf.org; Brian Rosen >>>>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> Martin, >>>>>>=20 >>>>>> You referenced TS 29.195. I'm not familiar with that spec. Has = it >>>>>> been deprecated? It's not showing up on the 3GPP site. >>>>>>=20 >>>>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on = the >>>>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>>>> header when interworking with untrusted networks." >>>>>>=20 >>>>>> Your remark is consistent with Note 4, but only if we agree that, >>>>>> for instance, the AT&T network and the Sprint network are = "trusted >>>>>> networks". In reality, this is not the case or there would be no >>>>>> firewalls or Session Border Controllers used for interworking and >>>>>> security. My opinion is the only carrier networks that are = trusted >>>>>> are the SS7 network, and the Internet backbone. >>>>>>=20 >>>>>> What it really comes down to is that PAI is left in signaling >>>>>> either through formal specification as a part of an inter-carrier >>>>>> inter-connection agreement, or by custom (or even by accident). = I >>>>>> think this illustrates Paul Rosbotham's observation is true. >>>>>>=20 >>>>>> Pierce >>>>>>=20 >>>>>> -----Original Message----- >>>>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>>>> Sent: August 05, 2016 12:55 PM >>>>>> To: Gorman, Pierce A [CTO] >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Brian >>>>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>>>> ; Richard Shockey >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>=20 >>>>>> PAI is not stripped at the network boundary between trusted >>>>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>>>> ITU And the list goes on >>>>>>=20 >>>>>> Martin C Dolly >>>>>> Lead Member of Technical Staff >>>>>> Core & Government/Regulatory Standards AT&T >>>>>> Cell: 609-903-3360 >>>>>> Email: md3135@att.com >>>>>>=20 >>>>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>>>> wrote: >>>>>>>=20 >>>>>>> Which header the carrier chooses to display is moot if the = header >>>>>>> is stripped between carriers as per at least one standard. I >>>>>>> think Paul Rosbotham's observation we're likely to encounter = "some >>>>>>> interesting interworking challenges" was perhaps the >> understatement of the year. >>>>>>>=20 >>>>>>> Pierce >>>>>>>=20 >>>>>>> -----Original Message----- >>>>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>>>> Sent: August 05, 2016 11:58 AM >>>>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>>>> ; Brian Rosen >> >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>=20 >>>>>>> If PAI is present and signed, and =46rom is also signed, I would >>>>>>> expect it to be up to the UA to decide what to display, not the = carrier. >>>>>>>=20 >>>>>>> Of course this will work differently if there is a different >>>>>>> signaling regime between the carrier and the user device (e.g. >>>>>>> black >>>> phone). >>>>>>>=20 >>>>>>> Thanks, >>>>>>> Paul >>>>>>>=20 >>>>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>>>> controller functions and is not to be used in inter-carrier >>>>>>>> inter-connection (although it commonly shows up anyway). My >> opinion is the "From" >>>>>>>> header is likely used more often for presentation. >>>>>>>>=20 >>>>>>>> Pierce >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> -----Original Message----- >>>>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>>>> Sent: August 05, 2016 9:37 AM >>>>>>>> To: Rosbotham, Paul, Vodafone UK >>>> ; >>>>>>>> Paul Kyzivat ; Brian Rosen >>>>>>>> >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Humm this is getting interesting. Its my understanding that = the >>>>>>>> display number aka "presentation number" in the US context is = the >>>>>>>> one carried in the PAI. Martin, Pierce? >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, = Vodafone >> UK" >>>>>>>> > paul.rosbotham@vodafone.com> >>>> wrote: >>>>>>>>=20 >>>>>>>> Jumping in now that we're on European working time, +1 on >>>>>>>> Paul's observation. >>>>>>>>=20 >>>>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>>>> IDs....one (we term the Network Number, carried in PAID) = uniquely >>>>>>>> identifies the line, the other (we term Presentation Number, >>>>>>>> carried in From) is used for display purposes. >>>>>>>>=20 >>>>>>>> Only the carrier has the authority to set the Network Number >>>>>>>> so only they could sign it. >>>>>>>>=20 >>>>>>>> But - subject to regulatory restrictions which are well >>>>>>>> documented >>>>>>>> - the number sent for display purposes belongs to the customer. >>>>>>>> For blue-chip customers, I can allow them to send their >>>>>>>> Presentation Numbers into the network, and can't readily check = at >>>>>>>> a network level that they're theirs (I do have contractual >>>>>>>> safeguards). The number may have been allocated by me, or = could >>>>>>>> be allocated by a third party provider. If it's a call-centre >>>>>>>> they'll be making outbound calls for lots of different = customers >>>>>>>> which will change on day-by-day >>>> basis. >>>>>>>> This is business as usual. I don't like the term "authorised >>>>>>>> spoofing" because it implies that the CLI is in some way being = rigged: >>>>>>>> it's not, it's the corporate customer or their subcontractor >>>>>>>> using the number that's been assigned (so in internet terms >>>>>>>> delegated) to them via a chain of trust from the regulator. >>>>>>>>=20 >>>>>>>> What I want is the ability for customers to use their >>>>>>>> credentials to sign the CLIs they send me so that at the >>>>>>>> terminating end it can be checked (or indeed somewhere = en-route >>>>>>>> if that's the business model). >>>>>>>> I can and would sign for customers on my mobile business since >>>>>>>> I'm driving what number is presented, but that's by-the-by >>>>>>>> because they aren't the ones who generate millions of nuisance >>>>>>>> calls. If the signing only occurs at the originating carrier >>>>>>>> level for corporate/call-centre customers that's no use because >>>>>>>> I'm not in a position to do that for these type of >>>>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>>>> also highlight there are many more of my large customers that = I'd >>>>>>>> trust more than a far end originating carrier that could be >>>>>>>> anywhere in the world (though we have no shortage of small >>>>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>>>> UK....) >>>>>>>>=20 >>>>>>>> Regards >>>>>>>>=20 >>>>>>>> Paul >>>>>>>>=20 >>>>>>>> -----Original Message----- >>>>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul = Kyzivat >>>>>>>> Sent: 04 August 2016 23:12 >>>>>>>> To: Brian Rosen >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>>=20 >>>>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>>>> delegated the TN, it's being authorized to place calls that = are >>>>>>>>> not >>>>>>>>> from that TN, but appear to be. >>>>>>>>>=20 >>>>>>>>> The mechanism to handle the credential is exactly the same as = a >>>>>>>>> delegation, so if you want to call it delegation, go ahead, = but >>>>>>>>> I prefer to call it authorized spoofing. >>>>>>>>=20 >>>>>>>> IIUC the delegation is to a responsible entity (something = that >>>>>>>> can be held legally accountable - e.g. a person), not to a = device. >>>>>>>> The entity can then "use" the credential via any device(s) it >>>>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>>>> two-line >>>> phone. >>>>>>>>=20 >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>>=20 >>>>>>>>> Brian >>>>>>>>>=20 >>>>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>>>> >>>>>>>>>> wrote: >>>>>>>>>>=20 >>>>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>>>> phone as calling party. >>>>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>>>> carrier to him. He then creates another credential, which = he >>>>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>>>> (because the call is coming from his mobile's TN but claims = to >>>>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>>>> could give the credential to his mobile SP if they sign on = his >> behalf. >>>>>>>>>>=20 >>>>>>>>>> I don't understand how that is different from regular = delegation. >>>>>>>>>>=20 >>>>>>>>>> When his landline carrier gave him a delegated certificate = for >>>>>>>>>> his landline number, he should be able to install that in >>>>>>>>>> whatever devices he wants - his landline UA, his mobile = phone, >>>>>>>>>> etc. It is still delegated from his landline carrier, even = when >>>>>>>>>> used with calls via his mobile carrier. >>>>>>>>>>=20 >>>>>>>>>> Thanks, >>>>>>>>>> Paul >>>>>>>>>>=20 >>>>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>>>> legitimate use. >>>>>>>>>>>=20 >>>>>>>>>>> But that's how I describe it. >>>>>>>>>>>=20 >>>>>>>>>>> Brian >>>>>>>>>>>=20 >>>>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>>>> > >> wrote: >>>>>>>>>>>>=20 >>>>>>>>>>>> +1, but with one question below: >>>>>>>>>>>>=20 >>>>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>>>> delegation path, >>>>>>>>>>>>=20 >>>>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>>>> authorized spoofers. >>>>>>>>>>>>=20 >>>>>>>>>>>> I don't understand "authorized spoofers" in this context, = as >>>>>>>>>>>> contrasted to "spoofers" who have been delegated their >>>> authority. >>>>>>>>>>>>=20 >>>>>>>>>>>> Thanks, >>>>>>>>>>>> Paul >>>>>>>>>>>>=20 >>>>>>>>>>>>> I don't think it matters who the delegator or delegatee = are >>>>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>>>> delegated to, so authorities can follow the delegation = path. >>>>>>>>>>>>> There are plenty of certificated carriers who are willing = to >>>>>>>>>>>>> not care who they delegate to. The fact that there are = some >>>>>>>>>>>>> who do doesn't change much. >>>>>>>>>>>>> Making stir work means knowing who you are delegating to, >> so >>>>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>>>> been delegated. >>>>>>>>>>>>> If it does, it's asserting that the calls are from who = they >>>>>>>>>>>>> are supposed to be from. >>>>>>>>>>>>> That should be straightforward, but we know it's not = always, >>>>>>>>>>>>> and that represents the hard part of deployment in my >> opinion. >>>>>>>>>>>>> But once they delegate, they can hand responsibility to = sign >>>>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>>>> they are delegating to. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>>>> we get into >>>>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>>>> which we don't. >>>>>>>>>>>>> Our model is that you know who you delegate to, and once >> you >>>>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>>>> some business practices. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI = and >>>>>>>>>>>>> having a way to know which TNs are covered by a = credential. >>>>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Brian >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>>>> policy and use cases. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be >> deployed >>>>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>>>> my reason for suggesting a way to qualify the signature = to >>>>>>>>>>>>>> reflect that variability. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Originating carriers are in a position to know if a call = is >>>>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>>>> numbers, and can qualify to some degree the >> trustworthiness >>>>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>>>> most-authenticated. There can be >>>> more >>>>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>>>> complexity (both for the carriers and the consumers) and = I >>>>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and = fraud. >>>>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>>>> mobile consumers where their carriers are able to = usefully >>>>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>>>> (revoked, not >>>>>>>>>>>>>> revoked) for authenticating calling number will not work >> well. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>>>> well, if the calling party has to sign a call with a = per-TN >>>>>>>>>>>>>> cert provided by the called party. No called party cert = to >> include? >>>>>>>>>>>>>> Then the calling party does not have a trusted = relationship >>>>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org = >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>>>> policy issue. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>>>> design of stir, and the design allows delegation of one = TN >>>>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>>>> NAM phone could have >>>> more >>>>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>>>> mobile phone may also have a credential for, say, a TN = that >>>>>>>>>>>>>> is delegated to a landline, to cover the example case of = a >>>>>>>>>>>>>> doctor placing a call on his mobile, but getting his = office >>>>>>>>>>>>>> number to show up as the calling party. Use of such >> mechanisms is policy. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>>>> discussion. Regardless, I do appreciate your = explanation. >>>>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org = >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>>>> phones and any other devices that can be programmed to >> do >>>> so. >>>>>>>>>>>>>> They will be given credentials that only are valid for = the >>>>>>>>>>>>>> TNs they are authorized to sign for. They can try to = sign >>>>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>>>> will want to get out of the liability of signing on = behalf >>>>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>>>> so. That means the devices have to be able to sign, but = I >>>>>>>>>>>>>> understand many of the PBX vendors think that's = something >>>>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >> >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>>>> signature, >>>>>>>>>>>>>> but the service provider can do that. It should not = add a >>>>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>>>> assign to >>>>>>>>>>>>>> the trunk group connecting to the PBX, although it = could >>>>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>>>> "authorized >>>>>>>>>>>>>> spoofing". The companion devices I'm aware of always >> send >>>>>>>>>>>>>> calls from the same service provider and should not >> present >>>>>>>>>>>>>> any issue. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>>>> implement >>>>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A = [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>>>> where a >>>>>>>>>>>>>> PBX is not compromised, a carrier has no = practical >>>>>>>>>>>>>> way of >>>>>>>>>>>>>> knowing whether the calling number is properly >> assigned >>>>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>>>> Therefore, checking whether the calling number = was >>>>>>>>>>>>>> from an >>>>>>>>>>>>>> assigned range might be possible (and fraught = with >>>>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>>>> And in >>>>>>>>>>>>>> the consumer market, there are calling products = which >>>>>>>>>>>>>> support a parent subscriber number and = "companion" >>>>>>>>>>>>>> devices >>>>>>>>>>>>>> (e.g., tablets) which can place a call using the = MDN of >>>>>>>>>>>>>> the parent subscriber. These are examples of = where >> the >>>>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>>>> necessarily mean >>>>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>>>> a single >>>>>>>>>>>>>> subscriber with a single MDN regardless of = "laxity" of >>>>>>>>>>>>>> spoof checking. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>>>> authentication mandates from Congress and/or FCC, = I >>>>>>>>>>>>>> suggested using carrier-specific certs and = encoding >>>>>>>>>>>>>> specificity of authenticity, and calling number. = This >>>>>>>>>>>>>> provides the identity of the originating carrier, = some >>>>>>>>>>>>>> idea as to the accuracy or specificity of the = calling >>>>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>>>> (assuming nonce >>>>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>>>> suggested >>>>>>>>>>>>>> below by Alex). >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> The representation of orig-carrier and = trustworthiness >>>>>>>>>>>>>> could be as follows: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>>>> Use case example(s): Pre-IMS, legacy = circuit-switched >>>>>>>>>>>>>> networks that don't natively support SIP or which = don't >>>>>>>>>>>>>> choose to sign calls. E.g., international = carriers. >>>>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and = CgPN >>>>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>>>> roaming >>>>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> entirely >>>>>>>>>>>>>> untrustworthy >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>>>> OCN, but >>>>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> less than >>>>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>>>> calls from >>>>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = most >>>>>>>>>>>>>> trustworthy >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Undefined but assumed to use public or = commercially >>>>>>>>>>>>>> available authentication services resources. = e.g., >>>>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>>>> cetera. >>>>>>>>>>>>>> Could/would pass credentials down to SIP-aware >> devices >>>>>>>>>>>>>> which would process them according to the rules = of the >>>>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>>>> placing a >>>>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>>>> telephone >>>>>>>>>>>>>> number used in From/PAI, and in such = circumstances >> the >>>>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>>>> call may >>>>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>>>> serving the >>>>>>>>>>>>>> entity that is assigned the TN. In all such = cases, the >>>>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>>>> authorizes calls >>>>>>>>>>>>>> placed using it's TN. The design accommodates = such use >>>>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>>>> authentication. We're not aware of any cases = where >>>>>>>>>>>>>> there >>>>>>>>>>>>>> is an actual requirement for legitimate calling = without >>>>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>>>> although >>>>>>>>>>>>>> we certainly are aware that various parts of = various >>>>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>>>> point, at >>>>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>>>> that the >>>>>>>>>>>>>> laxity of allowing unchecked spoofing is not = acceptable >>>>>>>>>>>>>> any more. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>>>> authentication >>>>>>>>>>>>>> In the current telephony network practice, = some >>>>>>>>>>>>>> service provider implementations choose not = to >>>>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>>>> the use >>>>>>>>>>>>>> of an arbitrary or selected user-provided = identity. >>>>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>>>> anyone >>>>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>>>> industry >>>>>>>>>>>>>> reasonably expect to end this (often bad) = practice? >>>>>>>>>>>>>> If it can't be ended, there's value in at = least >>>>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>>>> prevalence >>>>>>>>>>>>>> of abuse using telephone numbers assigned to = a >>>>>>>>>>>>>> sometimes-anonymous abuser, it becomes = critically >>>>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>>>> closest >>>>>>>>>>>>>> to the abuser. Based on the assumption that = it's >>>>>>>>>>>>>> better to ID service providers than = unreasonably >>>>>>>>>>>>>> expect a ban of the use of unauthenticated = (and >>>>>>>>>>>>>> therefore unsigned) SIP requests, STIR = signing >>>>>>>>>>>>>> should >>>>>>>>>>>>>> support authorization without authentication. = The >>>>>>>>>>>>>> practice of authorizing unauthenticated use = exists, >>>>>>>>>>>>>> and there is benefit to signing in these = cases >>>>>>>>>>>>>> (service provider identification). The = language of >>>>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>>>> should NOT >>>>>>>>>>>>>> require or assume that that authentication = will >>>>>>>>>>>>>> precede authorization. Of course there may be = other >>>>>>>>>>>>>> use cases where signing includes = authentication and >>>>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>>>> authorization. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>>>> with this >>>>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>>>> within >>>>>>>>>>>>>> 60 >>>>>>>>>>>>>> seconds) SIP requests using the same token = are >>>>>>>>>>>>>> legal >>>>>>>>>>>>>> and subject to replay in many cases. An SDP = body's >>>>>>>>>>>>>> mky may not be present and if present its use = is >>>>>>>>>>>>>> optional. Some sort of mandatory new or = existing >>>>>>>>>>>>>> signed sequence, random # or request ID = (e.g., >>>>>>>>>>>>>> Call-ID >>>>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>>>> receiving end >>>>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>>>> (e.g., >>>>>>>>>>>>>> INVITE vs MESSAGE) might be handled by = different >>>>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>>>> difficulties >>>>>>>>>>>>>> with 'it's been used already' coordination = allow a >>>>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>>>> This might >>>>>>>>>>>>>> include an mkey from a captured INVITE. So = it >>>>>>>>>>>>>> may be >>>>>>>>>>>>>> possible to DOS, spam or text-bomb a = recipient >>>>>>>>>>>>>> using a >>>>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>>>> distributed >>>>>>>>>>>>>> implementations may make the enforcement = difficult, >>>>>>>>>>>>>> there is little cost to signing and decoding = a >>>>>>>>>>>>>> method >>>>>>>>>>>>>> and possibly a numeric ID. Some sort of = '1-use' >>>>>>>>>>>>>> practice should at least be discussed while = perhaps >>>>>>>>>>>>>> not required. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> NITS >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> The verifier MUST inspect any optional = "ppt" >>>>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Identity request. If no "ppt" parameter = is >>>>>>>>>>>>>> present, then the >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> verifier proceeds normally below. If a = "ppt" >>>>>>>>>>>>>> parameter value is >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>>>> parameter value is present, >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>>>> including the variations >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> described in Step 5. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> 3 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> = >>>>>>>>>>>>> 447 >>>>>>>>>>>>>> 4bi >>>>>>>>>>>>>> s-10%20- >>>> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>>>> Ses >> sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >>>> 3>. >>>>>>>>>>>>>> Background >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> [...] >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>>>> ], problems such as >>>>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>>>> applications and services >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>>>> requests. An >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>>>> either as part of a user >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>>>> is a component of a network >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>>>> originating user agents send >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>>>> message has been >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>>>> use end-user SIP identity in an interdomain or = intradomain >>>> context. >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>>>> typically obviously >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>>>> own credentials; if they >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>>>> authentication services. However, >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Regards, >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> Alex >>>>>>>>>>>>>> * * >>>>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>> _______________________________________________ >>>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> = ----------------------------------------------------------- >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> - >>>>>>>>>>>>>> - >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> ------- >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> This e-mail may contain Sprint proprietary = information >>>>>>>>>>>>>> intended for the sole use of the recipient(s). = Any >>>>>>>>>>>>>> use by >>>>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>>>> all copies >>>>>>>>>>>>>> of the message. >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>=20 >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>=20 >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> ________________________________ >>>>>>>>=20 >>>>>>>> This e-mail may contain Sprint proprietary information intended >>>>>>>> for the sole use of the recipient(s). Any use by others is = prohibited. >>>>>>>> If you are not the intended recipient, please contact the = sender >>>>>>>> and delete all copies of the message. >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >=20 From nobody Tue Aug 9 12:27:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0035112D1D3 for ; Tue, 9 Aug 2016 12:27:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t4s6Fx7xScVd for ; Tue, 9 Aug 2016 12:27:22 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43DCA12D0C8 for ; Tue, 9 Aug 2016 12:27:22 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79JRObe021676 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 9 Aug 2016 12:27:24 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470770844; bh=CRAG2zQjUBGHGJBOayc0M0FRddheL1WZNOoDVGsY68E=; h=Subject:To:References:From:Reply-To:Date:In-Reply-To:From; b=aTXZTxgspoZAXmjAFibfMm06Nxh1tIYejGHwmgS5NFFLRqPHH3c7ZKrcgw2wC6nCZ U9K3YcQeE7/jeG2YQ+PV/luFmSztt3kjoFOL6KcXZH0/UpEi2XFvFoXtCOU/lBOTzN b2zxgV00IPR8rXxEZ3icexOepq9sXw9tqd0w8flc= To: "Peterson, Jon" , "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> Date: Tue, 9 Aug 2016 12:26:55 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 19:27:23 -0000 On 8/9/2016 7:55 AM, Peterson, Jon wrote: > I don't know how to start a working group discussion about "many and > serious problems." Like I said, my first response to your stir-passport > review covered what I considered to be its most significant issues, which > were largely about the fundamental architecture and the document > organization (that is, the modularity with other specifications). > > I just read the whole thing again. The remainder of your comments are > overwhelmingly stylistic, editorial or philosophical. Jon, Let's start with a rather simple exercise. My review of passport has more than 70 questions in it. (I stopped counting after that, and I haven't counted the number in -4474bis, though it too is substantial.) While indeed, some of those pertain only to stylistic points many/most do not. So the simple exercise is to ask you to please respond publicly to the questions I ask in my reviews. And yes, it's fine to skip the obviously minor stuff. If I think you missed something important, there's a reasonable chance I'll note it... If you find yourself wanting more of a challenge, look for the various places that I note that something claiming to be (or to refer to) a specification does not actually supply specification detail or that the specification is wrong (eg, doesn't work) and then respond publicly to the substance. Thanks. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 12:29:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 937D612D1D3 for ; Tue, 9 Aug 2016 12:29:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Anxs5tx4CMnP for ; Tue, 9 Aug 2016 12:29:21 -0700 (PDT) Received: from resqmta-ch2-11v.sys.comcast.net (resqmta-ch2-11v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7687912B060 for ; Tue, 9 Aug 2016 12:29:21 -0700 (PDT) Received: from resomta-ch2-14v.sys.comcast.net ([69.252.207.110]) by resqmta-ch2-11v.sys.comcast.net with SMTP id XChVbcpaRlSxsXCiGbbNYm; Tue, 09 Aug 2016 19:29:20 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id XCi1bkP53IfRoXCi1bbxaz; Tue, 09 Aug 2016 19:29:20 +0000 To: "Gorman, Pierce A [CTO]" , Alex Bobotek , "Peterson, Jon" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> <0ce62665-ccb8-4668-71f4-ae59f4d7f698@alum.mit.edu> From: Paul Kyzivat Message-ID: Date: Tue, 9 Aug 2016 15:29:04 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: base64 X-CMAE-Envelope: MS4wfEf3B6A8fCUJKyn1HZQIYlBoL4lsm+su+rtG8vZCTKvbbfl5eWaUjX2Ynr8iV5L83FoED/br90075K9CbEcVBnpUnEmhZOAQLDATWfhXkHHnm26gJFTL 3h23j2xP3SX4btvTPQqYRAjpiyQk+InQHyN4Japfg41LIGtPFzK4KTj8AptRI6wdgTSuznVP44Dh63bYUosmyaY4Wbc28ZKpfh8HWuFJ4TitYZjm5/ZqPuui L9UC6wK6vMjxhIh2l1lD4Ajc8ksEpOut+Ipd5fLb3gq7HK9hj7QTmwjAgFqxpGqRU759pABhOCXeCYUHOEpz8sDy+1BkkPOqu3TByu+8d9fwwFoW0RIfMKCK I8UWDJloZGdciU8sasmONk8tQW+JQrYcT3fNPUJFMWqrNiNAyib3ecJBmA1rtnb7uB2Sqp6/GV50YI36mIl5CaBZ93Sg2gff8KL0CKPCjM21lk3JRww= Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 19:29:25 -0000 T24gOC85LzE2IDE6MzYgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gd3JvdGU6DQo+IEkg ZGlkLiAgU2ltaWxhciBpcyBhIHdlYXNlbCB3b3JkIHRvbyBpc24ndCBpdD8NCg0KWWVzIDot KQ0KDQo+ICIgVGhpcyBpcyBzaW1pbGFyIHRvIHRoZSBpc3N1ZSBvZiBsaWFiaWxpdHkgZm9y IGZyYXVkdWxlbnQgY3JlZGl0IGNhcmQNCj4gY2hhcmdlcy4gUmV0YWlsZXJzIHNvbWV0aW1l cyBhY2NlcHQgYSBjYXJkIHdpdGhvdXQgYSBzaWduYXR1cmUsIGJlY2F1c2UNCj4gaXQgbWFr ZXMgY3VzdG9tZXJzIGhhcHB5IGFuZCBzcGVlZHMgdHJhbnNhY3Rpb25zLiBCdXQgaW4gZG9p bmcgc28gdGhleQ0KPiBhY2NlcHQgdGhlIHJlc3BvbnNpYmlsaXR5IGZvciB0aGUgY2hhcmdl IGlmIHRoZSB0cmFuc2FjdGlvbiB0dXJucyBvdXQgdG8NCj4gYmUgZnJhdWR1bGVudC4iDQo+ DQo+IEl0J3Mgbm90IGF0IGFsbCB0aGUgc2FtZS4gIFRoZSByZXRhaWxlciBpcyBsaWFibGUg Zm9yIGVhdGluZyB0aGUgY29zdCBvZiB0aGF0IHdoaWNoIHRoZXkgdGhvdWdodCB0aGV5IHNv bGQuICBJbnN0ZWFkLCBhcHBseWluZyB0aGUgbG9naWMgb2YgbWFraW5nIHRoZSBvcGVyYXRv ciBsaWFibGUgZm9yIGNhbGxpbmcgbnVtYmVyIHZlcmlmaWNhdGlvbiBpcyB0aGUgc2FtZSBh cyBhc2tpbmcgdGhlIHJldGFpbGVyIHRvIGJlIGxpYWJsZSBmb3IgdGhlIGZyYXVkIGNvbW1p dHRlZCBieSB0aGUgY3JpbWluYWwuDQo+DQo+IExldCdzIG5vdCBmb3JnZXQgdGhhdCBhIGNy aW1pbmFsIGNhbiBnZXQgYSBwaG9uZSB0aGF0IGlzIGF1dGhlbnRpY2F0ZWQgdG8gdGhlIG5l dHdvcmsgYW5kIHdob3NlIGNhbGxpbmcgbnVtYmVycyBpcyBzaWduZWQsIGVpdGhlciBieSB0 aGUgb3BlcmF0b3IsIG9yIGJ5IHRoZSBTSVAgc3RhY2sgb24gdGhlIHBob25lLCBhbmQgc3Rp bGwgY29tbWl0IGNyaW1lLg0KPg0KPiBJZiB5b3Ugd2FudCB0aGUgb3BlcmF0b3JzIHRvIGVh dCB0aGUgY29zdCBvZiB0cmFuc3BvcnRpbmcgYW5kIHByb2Nlc3NpbmcgdGhlIHBob25lIGNh bGwgd2hlcmUgdGhlIG9yaWdpbmF0aW5nIG51bWJlciB3YXMgZnJhdWR1bGVudGx5IHByb3Zp ZGVkLCBJJ20gcHJldHR5IHN1cmUgaXQgd2lsbCBmYWlsIGluIGNvdXJ0LCBidXQgaXQgcHJv YmFibHkgd291bGRuJ3QgYmUgdmVyeSBvZmZlbnNpdmUgdG8gb3BlcmF0b3JzLg0KPg0KPiBX aGF0IEkgdGhpbmsgeW91J3JlIGFza2luZyBmb3IgaXMgb3BlcmF0b3JzIHRvIGJlIHBvbGlj ZSwgYm90aCBkZXRlY3RpdmVzIGFuZCB0cmFmZmljIGNvcHMsIGFuZCB0byBiZSBsaWFibGUg KHNvdW5kcyBlZXJpbHkgbGlrZSBvdGhlciBjdXJyZW50IGV2ZW50cykuDQoNCkkgYWdyZWUg aXQgaXNuJ3QgY29tcGFyYWJsZSwgYW5kIHRoYXQgaXQgaXMgdW5yZWFzb25hYmxlIGZvciB0 aGUgDQpvcGVyYXRvcnMgdG8gYmUgbGlhYmxlIGZvciB0aGUgYmFkIGRlZWRzIG9mIHRoZWly IGN1c3RvbWVycy4NCg0KQnV0IHRoZXJlIG5lZWRzIHRvIGJlICpzb21lKiBuZWdhdGl2ZSBj b25zZXF1ZW5jZSBmb3IgZmFpbGluZyB0byBwZXJmb3JtIA0KZHVlIGRpbGlnZW5jZSB3aGVu IHNpZ25pbmcuIEV4YWN0bHkgd2hhdCB0aGF0IGNvbnNlcXVlbmNlIGlzIGlzIG91dCBvZiAN Cm91ciBoYW5kcywgYnV0IEkgaG9wZSB3ZSBjYW4gY291bnQgb24gdGhlcmUgYmVpbmcgb25l Lg0KDQpHZXR0aW5nIGJsYWNrbGlzdGVkIGFzIGFuIHVudHJ1c3RlZCBzaWduZXIgaXMgb25l IHBvc3NpYmlsaXR5Lg0KDQoJVGhhbmtzLA0KCVBhdWwNCg0KPiBQaWVyY2UNCj4NCj4gLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogUGF1bCBLeXppdmF0IFttYWlsdG86 cGt5eml2YXRAYWx1bS5taXQuZWR1XQ0KPiBTZW50OiBBdWd1c3QgMDksIDIwMTYgMTI6MTEg UE0NCj4gVG86IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50 LmNvbT47IEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldD47IFBldGVyc29uLCBKb24g PGpvbi5wZXRlcnNvbkBuZXVzdGFyLmJpej47IER3aWdodCwgVGltb3RoeSBNIChUaW0pIDx0 aW1vdGh5LmR3aWdodEB2ZXJpem9uLmNvbT47IERPTExZLCBNQVJUSU4gQyA8bWQzMTM1QGF0 dC5jb20+DQo+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLIDxwYXVsLnJvc2Jv dGhhbUB2b2RhZm9uZS5jb20+OyBSaWNoYXJkIFNob2NrZXkgPHJpY2hhcmRAc2hvY2tleS51 cz47IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2VuIDxickBicmlhbnJvc2VuLm5ldD4NCj4g U3ViamVjdDogUmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4NCj4gU2Vl IHRoZSByZXBseSBJIGp1c3Qgc2VudCB0byBBbGV4Lg0KPg0KPiBPbiA4LzkvMTYgMTowNCBQ TSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSB3cm90ZToNCj4+ICIgSWYgeW91IHNpZ24gdGhl IG1lc3NhZ2UgeW91IGFyZSB0YWtpbmcgcmVzcG9uc2liaWxpdHkgZm9yIHRoZSBhc3NlcnRp b24gdGhhdCBpdCBpcyBmcm9tIE5OTi4gSWYgeW91IGNob29zZSB0byBkbyBzbyB3aXRob3V0 IGtub3dpbmcgd2hvIGl0IGlzIGZyb20gdGhlbiB0aGF0IGlzIHlvdXIgcHJvYmxlbS4iDQo+ Pg0KPj4gUGF1bCwNCj4+DQo+PiBGb2xsb3dpbmcgdGhpcyBzdGFuZGFyZCBvZiBsaWFiaWxp dHksIGV2ZXJ5IElTUCBzaG91bGQgYmUgZm9yY2VkIHRvIHNpZ24gSVAgcGFja2V0cyBhbmQg YmUgbGlhYmxlIGZvciBoYWNraW5nIGF0dGVtcHRzIHdoaWNoIG9yaWdpbmF0ZSBvbiB0aGVp ciBJUCBuZXR3b3Jrcy4NCj4+DQo+PiBKdXN0IGFzIHJldmVyc2UgdW5pY2FzdCBwYXRoIGZv cndhcmRpbmcgaXMgbm90IG9mdGVuIChldmVyPykgdXNlZCBpbiB0aGUgSW50ZXJuZXQgYmFj a2JvbmUgb3IgSVNQIG5ldHdvcmtzIHRvIGVuc3VyZSBJUCBwYWNrZXRzIGRvbid0IGNvbWUg ZnJvbSBuZXR3b3JrcyB0aGV5IGNhbid0IGhhdmUgb3JpZ2luYXRlZCBmcm9tLCBuZWl0aGVy IGRvIGFsbCB0ZWxlcGhvbmUgbmV0d29ya3MgImNoZWNrIiBlYWNoIG9yaWdpbmF0aW5nIHRl bGVwaG9uZSBudW1iZXIgdG8gZGV0ZXJtaW5lIHdoZXRoZXIgdGhleSBzaG91bGQgaGF2ZSBi ZWVuIGFibGUgdG8gb3JpZ2luYXRlIGZyb20gYSBwYXJ0aWN1bGFyIGNhcnJpZXIgb3IgZW50 ZXJwcmlzZSBhbmQgZm9yIHRoZSBzYW1lIHJlYXNvbnMgLSBpdCBpcyBkaWZmaWN1bHQsIGlt cGVyZmVjdCwgYW5kIGV4cGVuc2l2ZS4gIEp1c3QgYXMgaXQgaXMgd2l0aCB0aGUgSW50ZXJu ZXQgYmFja2JvbmUsIGl0J3MgYWN0dWFsbHkgcmVhc29uYWJseSBjaGFsbGVuZ2luZyBqdXN0 IGRlbGl2ZXJpbmcgdGhlIGNhbGxzIChvciBJUCBwYWNrZXRzKSB0byB0aGUgbnVtYmVyIHRo YXQgaXQgaXMgYWRkcmVzc2VkIHRvLCB3aXRob3V0IGFsc28gaGF2aW5nIHRvIGFsc28gd29y cnkgYWJvdXQgd2hlcmUgaXQgc3VwcG9zZWRseSBjYW1lIGZyb20uDQo+Pg0KPj4gSSdtIHRl bGxpbmcgeW91IHdlIGNhbiBkaWZmZXJlbnRpYXRlIHRoZSB0cnVzdHdvcnRoeS1uZXNzIChs aWtlIFN0ZXBoZW4gQ29sYmVydCdzICJ0cnV0aC1pbmVzcyIpIG9mIGNhbGxzLiAgV2UgY2Fu IHRlbGwgaWYgYSBjYWxsIG9yaWdpbmF0ZWQgZnJvbSBhIHN1YnNjcmliZXIgdXNpbmcgYSBk ZXZpY2Ugd2hpY2ggaGFzIHRvIGF1dGhlbnRpY2F0ZSB0byB0aGUgbmV0d29yayBiZWZvcmUg aXQncyBwZXJtaXR0ZWQgdG8gcGxhY2UgY2FsbHMgKGV4Y2VwdCBtYW51YWwgcm9hbWluZyBh bmQgc29tZSBFOTExIGNhbGxzKS4gIEFuZCB3ZSBjYW4gdGVsbCBpZiBhIGNhbGwgb3JpZ2lu YXRlZCAob3Igd2FzIHN1YmplY3RlZCB0byBtaWQtY2FsbCAzcmQgcGFydHkgY2FsbCBjb250 cm9sIGZyb20gYW4gZW50ZXJwcmlzZSBvciBtb2JpbGUgdmlydHVhbCBuZXR3b3JrIG9wZXJh dG9yIHBhcnRuZXIgZm9yIGV4YW1wbGUpIGFuZCBpcyB0aGVyZWZvcmUgbm90IGFzIHRydXN0 d29ydGh5IGFzIHRoZSBkaXJlY3RseS1jb25uZWN0ZWQgYW5kIGF1dGhlbnRpY2F0ZWQgbW9i aWxlIHN1YnNjcmliZXIgKGZvciBleGFtcGxlKS4gIFdlIGNhbiBwYXNzIHRoYXQgcmVsYXRp dmUgdHJ1c3R3b3J0aGluZXNzIGluZm9ybWF0aW9uIGFsb25nIGluIHNpZ25hbGluZyBhbmQg aXQgY2FuIGJlIHVzZWQgdG8gdXNlZnVsbHkgZGlmZmVyZW50aWF0ZSB0cmVhdG1lbnQsIHVs dGltYXRlbHksIGJ5IHRoZSBjb25zdW1lci4NCj4+DQo+PiBXaGF0IHlvdSB3YW50IGlzIHRo YXQgdGhlIGNhbGxpbmcgbnVtYmVyIGlzIGFsd2F5cywgdW5pdmVyc2FsbHksIG9ubHkgZXZl ciB0cnVzdHdvcnRoeS4gIE15IG9waW5pb24gaXMgdGhhdCBpcyB1bnJlYWxpc3RpYyBhbmQg dW5yZWFzb25hYmxlLg0KPj4NCj4+IFBpZXJjZQ0KPj4NCj4+IC0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQo+PiBGcm9tOiBQYXVsIEt5eml2YXQgW21haWx0bzpwa3l6aXZhdEBhbHVt Lm1pdC5lZHVdDQo+PiBTZW50OiBBdWd1c3QgMDksIDIwMTYgMTA6NDQgQU0NCj4+IFRvOiBB bGV4IEJvYm90ZWsgPGFsZXhAYm9ib3Rlay5uZXQ+OyBQZXRlcnNvbiwgSm9uIDxqb24ucGV0 ZXJzb25AbmV1c3Rhci5iaXo+OyBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29y bWFuQHNwcmludC5jb20+OyBEd2lnaHQsIFRpbW90aHkgTSAoVGltKSA8dGltb3RoeS5kd2ln aHRAdmVyaXpvbi5jb20+OyBET0xMWSwgTUFSVElOIEMgPG1kMzEzNUBhdHQuY29tPg0KPj4g Q2M6IFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUsgPHBhdWwucm9zYm90aGFtQHZvZGFm b25lLmNvbT47IFJpY2hhcmQgU2hvY2tleSA8cmljaGFyZEBzaG9ja2V5LnVzPjsgc3RpckBp ZXRmLm9yZzsgQnJpYW4gUm9zZW4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4gU3ViamVjdDog UmU6IFtzdGlyXSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+DQo+PiBPbiA4LzkvMTYg NTowMyBBTSwgQWxleCBCb2JvdGVrIHdyb3RlOg0KPj4+IEpvbiwNCj4+Pg0KPj4+IFRoYW5r cyBtdWNoIGZvciB5b3VyIHRob3VnaHRmdWwgcmVzcG9uc2UgdG8gdGhlIG9yaWdpbmFsIHBv aW50cy4gIFllcywgdGhpbmdzIGdvdCBzb21ld2hhdCBzaWRldHJhY2tlZC4NCj4+Pg0KPj4+ IE9uIHRoZSBmaXJzdCBwb2ludCAoc2lnbmluZyB3aXRob3V0IGF1dGhlbnRpY2F0aW9uKSwg SSBkbyBub3QgcmVhZCA2LjENCj4+PiBhcyBwZXJtaXR0aW5nICJJJ20gc2lnbmluZyB0byBh c3NlcnQgdGhhdCBJJ3ZlIGF1dGhvcml6ZWQgdXNlIG9mIHRoaXMNCj4+PiBwaG9uZSBudW1i ZXIgd2l0aG91dCBhdXRoZW50aWNhdGluZyB0aGUgY2FsbGVyIGFuZC9vciBjb21wbGV0aW5n IGENCj4+PiBudW1iZXIgZGVsZWdhdGlvbiBhdXRob3JpdHkgY2hlY2siLA0KPj4NCj4+IEkn bSBub3Qgc3VyZSBJIHVuZGVyc3RhbmQuIElzIHRoaXMgdGhlIGFzc2VydGlvbiB5b3UgYXJl IGFza2luZyBmb3I/DQo+Pg0KPj4gIkkgKEFjbWUgQ29ycCksIGhhdmluZyBhZG1pbmlzdHJh dGl2ZSBhdXRob3JpdHkgb3ZlciBudW1iZXIgTk5OLCBjZXJ0aWZ5IHRoYXQgdGhpcyBtZXNz YWdlIGlzICJmcm9tIiBOTk4sIHRob3VnaCBJIGhhdmUgbm8gaWRlYSB3aG8gYWN0dWFsbHkg b3JpZ2luYXRlZCB0aGlzIG1lc3NhZ2UuIg0KPj4NCj4+IFRoaXMgaXMgYSBnb29kIHRoaW5n Pz8/DQo+Pg0KPj4gSWYgeW91IHNpZ24gdGhlIG1lc3NhZ2UgeW91IGFyZSB0YWtpbmcgcmVz cG9uc2liaWxpdHkgZm9yIHRoZSBhc3NlcnRpb24gdGhhdCBpdCBpcyBmcm9tIE5OTi4gSWYg eW91IGNob29zZSB0byBkbyBzbyB3aXRob3V0IGtub3dpbmcgd2hvIGl0IGlzIGZyb20gdGhl biB0aGF0IGlzIHlvdXIgcHJvYmxlbS4gWW91IHNob3VsZCBiZSBsZWdhbGx5IGxpYWJsZS4g QXQgdGhlIHZlcnkgbGVhc3QgeW91ciByZXB1dGF0aW9uIGFzIGEgc2lnbmVyIHNob3VsZCBi ZSBkaW1pbmlzaGVkIGFzIGZyYXVkdWxlbnQgY2FsbHMgeW91IGhhdmUgc2lnbmVkIGFyZSBk ZXRlY3RlZC4gRXZlbnR1YWxseSB5b3Ugd2lsbCBiZSBwdXQgb24gYmxhY2tsaXN0cyBhcyBh biB1bnRydXN0d29ydGh5IHNpZ25lci4NCj4+DQo+PiBJIGd1ZXNzIHdlIGNvdWxkIHNwZWVk IHRoZSBibGFja2xpc3RpbmcgYnkgYWxsb3dpbmcgc2lnbmVycyB0byBwcmUtZGVjbGFyZSB0 aGF0IHRoZXkgYXJlIHVudHJ1c3R3b3J0aHkuIChUaGF0IHNlZW1zIHRvIGJlIHdoYXQgeW91 IGFyZSBhc2tpbmcgZm9yLikNCj4+DQo+Pj4gYSB1c2UgY2FzZSB0aGF0IHJlZmxlY3RzIHRo ZSBjdXJyZW50bHktd2lkZXNwcmVhZCBwcmFjdGljZSBvZiBhdXRob3JpemF0aW9uIHdpdGhv dXQgYXV0aGVudGljYXRpb24uDQo+Pg0KPj4gTm8gd29uZGVyIHdlIGhhdmUgYSBwcm9ibGVt IHdpdGggc3Bvb2ZlZCBjYWxscy4NCj4+DQo+PiBUaGFua3MsDQo+PiBQYXVsDQo+Pg0KPj4+ IE15IHJlYWQgb2Ygc2VjdGlvbiA2LjEgaXMgdGhhdCBpdCBhbGxvd3MgYW5vbnltaXR5IHJh dGhlciB0aGFuIHNpZ25lci1hdHRyaWJ1dGlvbiB3aXRoIHVuYXV0aGVudGljYXRlZCAobm9u LWFub255bW91cykgY2FsbGVyIGlkZW50aXR5LiAgS25vd2luZyB0aGUgdHJpcGxlIG9mIHB1 cnBvcnRlZCBjYWxsaW5nIHBob25lIG51bWJlciB0aGF0IGZsYXNoZXMgb24gYSByZWNpcGll bnQncyBwaG9uZSwgdGhlIHRlcm1pbmF0aW5nIHBob25lIG51bWJlciBhbmQgYSB0aW1lc3Rh bXAgaXMgaW1wb3J0YW50IGluIHJlcG9ydGluZy90cmFjaW5nL21pdGlnYXRpbmcgYWJ1c2l2 ZSBjYWxscy4gIFtPbiBhIHNpZGUgbm90ZSwgSSByZXJlYWQgU2VjdGlvbiAxMSwgYnV0IGhh ZCB0cm91YmxlIHdpdGggdGhlIGRlZmluaXRpb24gb2YgInByaXZhdGUgVVJJIiAobm90ZTog ICJwcml2YXRlIFVSSSIgYW5kICJwcml2YXRlIFNJUCBVUkkiIGVhY2ggb2NjdXIgZXhhY3Rs eSBvbmNlIGVhY2ggaW4gdGhlIGRvYyBhbmQgY291bGQgYmVuZWZpdCBmcm9tIGEgZGVmaW5p dGlvbiBvciB0d28pLl0gICBBZGRpdGlvbmFsbHksIEJyaWFuIFJvc2VuJ3MgY29tbWVudCBv biA4LzQgc2VlbXMgdG8gY29ycm9ib3JhdGUgbXkgcmVhZGluZyBvZiBhIGJhbiBvbiBhdXRo b3JpemF0aW9uIHdpdGhvdXQgYXV0aGVudGljYXRpb24gaW4gdGhlIG5vbi1hbm9ueW1vdXMg Y2FzZSAoaS5lLiwgdGhhdCB1c2luZyBzb21lb25lIGVsc2UncyBwaG9uZSBudW1iZXIgcmVx dWlyZXMgdGhhdCAidGhlIGVudGl0eSB0aGF0IGlzIGFzc2lnbmVkIHRoZSBUTiBleHBsaWNp dGx5IGF1dGhvcml6ZXMgY2FsbHMgcGxhY2VkIHVzaW5nIGl0J3MgVE4iKS4NCj4+Pg0KPj4+ IEluIHN1bW1hcnksIHRoZXJlIGlzIGEgaGlnaCB2YWx1ZSBpbiBhbGxvd2luZyBzaWduaW5n L2F1dGhvcml6YXRpb24gaW4gdGhlIGNhdGVnb3JpZXMgYW5kIHVzZSBjYXNlcyBQaWVyY2Ug b3V0bGluZWQuICBJbiBteSBvcGVyYXRpb25hbCBleHBlcmllbmNlLCBpdCByZWFsbHkgaGVs cHMgdG8ga25vdyB3aGljaCBjb21wYW55IHRvIGNvbnRhY3QgdG8gZ2V0IHRoZSBjYWxsZXJz IGtpY2tlZCBvZmYgYSBuZXR3b3JrLiAgQW5kIHNpZ25lciBhdHRyaWJ1dGlvbiBldmVuIHdp dGhvdXQgY2FsbGVyIGF1dGhlbnRpY2F0aW9uIGlzIGEgaHVnZSB3aW4gZm9yIHRoZSBwdWJs aWMuDQo+Pj4NCj4+Pg0KPj4+DQo+Pj4gT24gdGhlIHNlY29uZCBwb2ludCwgdGhhbmtzIGZv ciBwb2ludGluZyBvdXQgdGhhdCAxMi4xIHJlcXVpcmVzIHNlcnZlcnMgdG8ga2VlcCB0aGUg c3RhdGUgb2YgcmVjZW50bHkgcmVjZWl2ZWQgcmVxdWVzdHMuICBUaGlzIGlzIGEgcG9pbnQg dGhhdCBJIG1pc3NlZCBpbiBteSByZWFkaW5nIG9mIHRoZSBkcmFmdCwgYW5kIHRoaXMgZmVh dHVyZSBhcyB5b3UgaGF2ZSBkZXNjcmliZWQgaXQgZGVmZWF0cyBtb3N0IGNvbmNlaXZhYmxl IHJlcGxheSBhdHRhY2tzLiAgTXkgYmFkIGZvciBtaXNzaW5nIHRoaXMsIGJ1dCBhcyB5b3Ug c3VnZ2VzdCwgdGhlcmUgbWF5IGJlIHNvbWUgcG90ZW50aWFsIGZvciBlbXBoYXNpemluZyB0 aGlzIHBvaW50LiAgQnV0IHRoZXJlJ3MgYW5vdGhlciBwYXJ0IG9mIHRoZSBpc3N1ZSAtLSBj cm9zcyBtZXRob2QgcmVwbGF5LiAgRm9yIGV4YW1wbGUsIGl0IG1heSBiZSBkaWZmaWN1bHQg dG8gZXhwZWN0IGEgbWVzc2FnaW5nIG5vZGUgKHdoaWNoIGhhbmRsZXMgU0lQIE1FU1NBR0Up IGFuZCBhIHZvaWNlLWNhcGFibGUgSU1TIG5vZGUgKGhhbmRsaW5nIFNJUCBJTlZJVEUpIHRv IGNvb3JkaW5hdGUgdGhlaXIgYW50aS1yZXBsYXkgY2FjaGVzLCBhbGxvd2luZyBhbiBhdHRh Y2tlciB0aGF0IG9ic2VydmVzIGEgU0lQIGludml0ZSBmb3IgYSB2b2ljZSBjYWxsIHRvIHBp Z2d5YmFjayBhIHNwYW0gdGV4dCBtZXNzYWdlLiAgQXMgaXQncyBjb21tb24gdG8gdXNlIHRo ZSBzYW1lICJUbyIgYWRkcmVzcyBmb3IgbXVsdGlwbGUgc2VydmljZXMgdGhhdCBtYXkgYmUg c2VydmVkIGJ5IHZlcnkgZGlmZmVyZW50IGluZnJhc3RydWN0dXJlIGNvbXBvbmVudHMsIGl0 IHdvdWxkIGJlIGJlbmVmaWNpYWwgdG8gYWxsb3cgc2lnbmF0dXJlcyB0byBjb3ZlciBtb3Jl IHRoYW4gIlRvIiwgIkZyb20vUEFJIiBhbmQgIlRpbWVzdGFtcCIuICAgSSBkbyBub3Qgc2Vl IHRoaXMgaXNzdWUgYXMgbWVyaXRpbmcgc2lnbmlmaWNhbnQgZGVsYXkgb2YgYSBTVElSIFJG QyBpZiB0aGVyZSdzIG5vIHF1aWNrIGZpeC4NCj4+Pg0KPj4+IFJlZ2FyZHMsDQo+Pj4NCj4+ PiBBbGV4DQo+Pj4NCj4+Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4gRnJv bTogc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFBl dGVyc29uLCBKb24NCj4+Pj4gU2VudDogTW9uZGF5LCBBdWd1c3QgOCwgMjAxNiAxMjo0NiBQ TQ0KPj4+PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJp bnQuY29tPjsgUGF1bCBLeXppdmF0DQo+Pj4+IDxwa3l6aXZhdEBhbHVtLm1pdC5lZHU+OyBE d2lnaHQsIFRpbW90aHkgTSAoVGltKQ0KPj4+PiA8dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5j b20+OyBET0xMWSwgTUFSVElOIEMgPG1kMzEzNUBhdHQuY29tPg0KPj4+PiBDYzogUm9zYm90 aGFtLCBQYXVsLCBWb2RhZm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsN Cj4+Pj4gUmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBzdGlyQGlldGYu b3JnOyBCcmlhbiBSb3Nlbg0KPj4+PiA8YnJAYnJpYW5yb3Nlbi5uZXQ+DQo+Pj4+IFN1Ympl Y3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+DQo+Pj4+DQo+ Pj4+IEp1c3Qgc28gSSdtIGNsZWFyLCBJJ20gbm90IGhlYXJpbmcgYW4gYXNrIGhlcmUgaW4g dGVybXMgb2YgY2hhbmdpbmcNCj4+Pj4gdGhlIHRleHQgb2YgcmZjNDQ3NGJpcy0xMCwgd2hp Y2ggZG9lcyBhbGxvdyBzaWduaW5nIFBBSSBpbnN0ZWFkIG9mDQo+Pj4+IEZyb20gZm9yIHBy ZWNpc2VseSB0aGUgcmVhc29ucyBvdXRsaW5lZCBpbiB0aGlzIGxlbmd0aHkgdGhyZWFkLiBU bw0KPj4+PiBBbGV4J3Mgb3JpZ2luYWwgcG9pbnQgYWJvdXQgcHJvdmlkaW5nIGF1dGhvcml6 YXRpb24gd2l0aG91dA0KPj4+PiBhdXRoZW50aWNhdGlvbiwgcmZjNDQ3NGJpcyBoYXMgYSBs b3Qgb2YgdGV4dCBhYm91dCBzaWduaW5nIG5vbi1UTg0KPj4+PiBpZGVudGlmaWVycywgaW5j bHVkaW5nIGZvciBwcmVzZXJ2aW5nIGFub255bWl0eTsgc2VlIHRoZSBlbmQgb2YNCj4+Pj4g c2VjdGlvbiA2LjEsIGFuZCB0aGVuIHRoZSBQcml2YWN5IENvbnNpZGVyYXRpb25zIGluIHNl Y3Rpb24gMTEgZm9yDQo+Pj4+IG1vcmUuIFRob3NlIHNob3VsZCBzdWZmaWNlIHRvIHByb3Zp ZGUgdGhpcyBwcm9wZXJ0eTogaXQgd2lsbCBpZGVudGlmeSB0aGUgc2VydmljZSBwcm92aWRl ciB3aG8gc2lnbmVkIHdpdGhvdXQgYXR0ZXN0aW5nIGFuIHNwZWNpZmljIHVzZXIgaWRlbnRp dHkuDQo+Pj4+DQo+Pj4+IEkgYWxzbyB3YW50ZWQgdG8gbWFrZSBzdXJlIHdlIGRpZG4ndCBk cm9wIHRoZSBvdGhlciBiYWxsIHRoYXQgQWxleA0KPj4+PiBtZW50aW9uZWQgYXQgdGhlIHN0 YXJ0IG9mIHRoaXMgdGhyZWFkLCB3aGljaCBpcyB0aGUgaXNzdWUgb2YNCj4+Pj4gcHJveGlt YXRlIHJlcGxheSB3aXRoaW4gdGhlIDYwIHNlY29uZCBEYXRlIHdpbmRvdy4gVGhpcyBpcyBh ZGRyZXNzZWQNCj4+Pj4gaW4gU2VjdGlvbiAxMi4xIG9mIHJmYzQ0NzRiaXMtMTAsIHdoaWNo DQo+Pj4+IHJlYWRzOiAiTm90ZSB0aGF0IHBlciBiYXNlbGluZSBbUkZDMzI2MV0gYmVoYXZp b3IsIHNlcnZlcnMga2VlcCBzdGF0ZQ0KPj4+PiBvZiByZWNlbnRseSByZWNlaXZlZCByZXF1 ZXN0cywgYW5kIHRodXMgaWYgYW4gSWRlbnRpdHkgaGVhZGVyIGlzDQo+Pj4+IHJlcGxheWVk IGJ5IGFuIGF0dGFja2VyIHdpdGhpbiB0aGUgRGF0ZSBpbnRlcnZhbCwgdmVyaWZpZXJzIGNh bg0KPj4+PiBkZXRlY3QgdGhhdCBpdCBpcyBzcG9vZmVkIGJlY2F1c2UgYSBtZXNzYWdlIHdp dGggYW4gaWRlbnRpY2FsIERhdGUNCj4+Pj4gZnJvbSB0aGUgc2FtZSBzb3VyY2UgaGFkIHJl Y2VudGx5IGJlZW4gcmVjZWl2ZWQuIiBUaGlzIHJlZmVycyB0byB0aGUNCj4+Pj4gdGV4dCBv Zg0KPj4+PiBSRkMzMjYxIHNlY3Rpb24gMjMuNC4yLCB0aG91Z2ggbW9yZSBwcm9wZXJseSB0 aGUgRGF0ZS1yZWxhdGVkDQo+Pj4+IGJlaGF2aW9yIGlzIGJldHRlciBkZXRhaWxlZCBpbiBS RkMzODkzIFNlY3Rpb24gMTAsIHdoaWNoIGludHJvZHVjZWQNCj4+Pj4gdGhlIGZpcnN0IHZl cnNpb24gb2YgdGhlIHBhcnRpYWwgc2lnbmF0dXJlIG1lY2hhbmlzbSB0aGF0IHVsdGltYXRl bHkNCj4+Pj4gaW5zcGlyZWQgUkZDNDQ3NC4gSSdsbCB1cGRhdGUgdGhlIHRleHQgaGVyZSBz byBpdCBpcyBjbGVhcmVyIGFib3V0IGV4YWN0bHkgaG93IHRvIGRldGVjdCBwcm94aW1hdGUg cmVwbGF5Lg0KPj4+Pg0KPj4+PiBKb24gUGV0ZXJzb24NCj4+Pj4gTmV1c3RhciwgSW5jLg0K Pj4+Pg0KPj4+PiBPbiA4LzgvMTYsIDExOjM4IEFNLCAic3RpciBvbiBiZWhhbGYgb2YgR29y bWFuLCBQaWVyY2UgQSBbQ1RPXSINCj4+Pj4gPHN0aXItYm91bmNlc0BpZXRmLm9yZyBvbiBi ZWhhbGYgb2YgUGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPiB3cm90ZToNCj4+Pj4NCj4+Pj4+ IFBhdWwsDQo+Pj4+Pg0KPj4+Pj4gQXMgeW91IGtub3csIFNJUCBpbnRlci13b3JraW5nIGlz IG9mdGVuIGNoYWxsZW5naW5nIGJlY2F1c2Ugb2YNCj4+Pj4+IHZhcmlhYmlsaXR5IGluIGlt cGxlbWVudGF0aW9uIGluY2x1ZGluZyBwcm9wcmlldGFyeSBoZWFkZXJzICh3aXRob3V0DQo+ Pj4+PiBhbg0KPj4+Pj4gWC0pIGFuZCBzdXBwb3J0IG9yIGxhY2sgdGhlcmVvZiBmb3Igbm9u LW1hbmRhdG9yeSAocGVyIFJGQyAzMjYxKQ0KPj4+Pj4gaGVhZGVycyBzdWNoIGFzIFAtQXNz ZXJ0ZWQtSWRlbnRpdHksIChhbmQgdGhpbmdzIGxpa2UgQjJCVUEgc3RhY2tzDQo+Pj4+PiBz dHJpcHBpbmcgdGhpbmdzIGxpa2UgZGlzcGxheSBuYW1lIGluIEZyb20gYnV0IHRoYXQncyBh bm90aGVyIHN0b3J5KS4NCj4+Pj4+IEkgY291bGQgYXJndWUgdGhhdCBmcm9tIGEgY2xlYW5s aW5lc3Mgb2YgcHJvdG9jb2wgaW1wbGVtZW50YXRpb24sDQo+Pj4+PiAoYW5kIGlmIEkgd2Fu dGVkIHRvIGJlIHBlZGFudGljKSwgSSB3b3VsZCBzdHJpcCBQQUkgb3V0Ym91bmQgdW5sZXNz DQo+Pj4+PiByZXF1aXJlZCBvdGhlcndpc2UuICBCdXQgdGhlIHBvaW50IGlzIG1vb3QuICBB cyBJIG1lbnRpb25lZCBpbiB0aGUNCj4+Pj4+IGVhcmxpZXIgZS1tYWlsLCB0aGF0IGlzIG5v dCBvdXIgcHJhY3RpY2UgYW5kIEknbSBub3QgcmVxdWVzdGluZyBpdCB0byBiZSBzby4NCj4+ Pj4+DQo+Pj4+PiBQaWVyY2UNCj4+Pj4+DQo+Pj4+Pg0KPj4+Pj4gLS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0NCj4+Pj4+IEZyb206IFBhdWwgS3l6aXZhdCBbbWFpbHRvOnBreXppdmF0 QGFsdW0ubWl0LmVkdV0NCj4+Pj4+IFNlbnQ6IEF1Z3VzdCAwOCwgMjAxNiAxMjowMyBQTQ0K Pj4+Pj4gVG86IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50 LmNvbT47IER3aWdodCwNCj4+Pj4gVGltb3RoeQ0KPj4+Pj4gTQ0KPj4+Pj4gKFRpbSkgPHRp bW90aHkuZHdpZ2h0QHZlcml6b24uY29tPjsgRE9MTFksIE1BUlRJTiBDDQo+Pj4+IDxtZDMx MzVAYXR0LmNvbT4NCj4+Pj4+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLIDxw YXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+Ow0KPj4+PiBSaWNoYXJkDQo+Pj4+PiBTaG9j a2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3Nlbg0K Pj4+Pj4gPGJyQGJyaWFucm9zZW4ubmV0Pg0KPj4+Pj4gU3ViamVjdDogUmU6IFtzdGlyXSBT VElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+DQo+Pj4+PiBPbiA4LzgvMTYgMTI6MTEg UE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10gd3JvdGU6DQo+Pj4+Pj4gVGhhbmtzIGZvciB0 aGUgYWRkZWQgY29tbWVudHMgVGltLg0KPj4+Pj4+DQo+Pj4+Pj4gSSBhZ3JlZSB0aGF0IHBh c3NpbmcgUC1Bc3NlcnRlZC1JZGVudGl0eSBiZXR3ZWVuIHRydXN0ZWQgbmV0d29ya3MNCj4+ Pj4+PiBpcyBhcHByb3ByaWF0ZSAoYW5kIHRoZSBjb252ZXJzZSBpcyB0cnVlIGFzIHdlbGwp LiAgUGFydCBvZiBteQ0KPj4+Pj4+IGlzc3VlIGlzIEkgaGF2ZSBiZWVuIGNvbmRpdGlvbmVk IGZyb20gdGhlIHZlcnkgZWFybGllc3QNCj4+Pj4+PiBpbXBsZW1lbnRhdGlvbiBvZiBTcHJp bnQncyBWb0lQIG5ldHdvcmsgdGhhdCBvdGhlciBjYXJyaWVycycgSVANCj4+Pj4+PiBuZXR3 b3JrcyBhcmUgaW5oZXJlbnRseSB1bnRydXN0ZWQuICBJJ3ZlIGJlZW4gYnJvd3NpbmcgVFMg MjkuMTY1DQo+Pj4+Pj4gYW5kIGV2ZW4gdGhlcmUgSSBmaW5kIGxhbmd1YWdlIHRoYXQgaW1w bGllcyB0cnVzdCBpcyBlc3RhYmxpc2hlZCBieQ0KPj4+Pj4+IGFncmVlbWVudCwgbm90IGJ5 IHN0YW5kYXJkLiAgKEV2ZW4gcm9hbWluZyBpbXBsaWVzIGFncmVlbWVudC4pDQo+Pj4+Pg0K Pj4+Pj4gSSB1bmRlcnN0YW5kIHdoeSAqc29tZSogc3R1ZmYgbmVlZHMgdG8gYmUgcmVtb3Zl ZCB3aGVuIGZvcndhcmRpbmcgdG8NCj4+Pj4gYW4NCj4+Pj4+IHVudHJ1c3RlZCBwYXJ0eS4g Rm9yIGluc3RhbmNlLCBpZiB0aGUgY2FsbCBoYXMgcmVxdWVzdGVkIHByaXZhY3ksDQo+Pj4+ PiB0aGVuIFAtQS1JRCBuZWVkcyB0byBiZSByZW1vdmVkLg0KPj4+Pj4NCj4+Pj4+IEJ1dCB3 aGVuIHByaXZhY3kgaXMgbm90IGEgY29uY2VybiwgdHJ1c3QgaXMgcmVhbGx5IG1vcmUgb2Yg YSBjb25jZXJuDQo+Pj4+PiBvbiB0aGUgaW5ncmVzcyBzaWRlLCBub3QgZWdyZXNzLiBJZiBJ IGRvbid0IHRydXN0IHlvdSB0aGVuIEkgd29uJ3QNCj4+Pj4+IHRydXN0IGEgUC1BLUlEIHlv dSBzZW50IHRvIG1lLCBhbmQgc28gKkkqIHdpbGwgcmVtb3ZlIGl0LiBCdXQgaWYgSQ0KPj4+ Pj4gdHJ1c3QgeW91LCBidXQgeW91IGRvbid0IHRydXN0IG1lLCB0aGVuIHdoYXQgaXMgdGhl IGRvd25zaWRlIGZvcg0KPj4+Pj4gcGFzc2luZyBhbG9uZyB0aGUgUC1BLUlEPw0KPj4+Pj4N Cj4+Pj4+ICAgICBUaGFua3MsDQo+Pj4+PiAgICAgUGF1bA0KPj4+Pj4NCj4+Pj4+PiBSZWdh cmRsZXNzLCB0aGlzIGRpc2N1c3Npb24gaGFzIGJlZW4gaGVscGZ1bCBhbmQgZWR1Y2F0aW9u YWwgKHRvIG1lDQo+Pj4+Pj4gYXQgbGVhc3QpLiAgQW5kLCBJIGNvbmZpcm1lZCB3aXRoIG15 IG9wZXJhdGlvbnMgY291bnRlcnBhcnQgd2UNCj4+Pj4+PiBnZW5lcmFsbHkgc2VuZCBQQUkg dG9kYXkuICBJJ3ZlIGFsc28gbWFkZSBub3RlIHRoYXQgd2hlcmUgc3RhbmRhcmRzDQo+Pj4+ Pj4gYW5kDQo+Pj4+IElDQQ0KPj4+Pj4+IHJlcXVpcmUgaXQsIHdlIHdpbGwgaW5jbHVkZSBQ QUkuICAgVGhhbmtzIGFnYWluLg0KPj4+Pj4+DQo+Pj4+Pj4gQmVzdCByZWdhcmRzLA0KPj4+ Pj4+DQo+Pj4+Pj4gUGllcmNlDQo+Pj4+Pj4NCj4+Pj4+PiAtLS0tLU9yaWdpbmFsIE1lc3Nh Z2UtLS0tLQ0KPj4+Pj4+IEZyb206IER3aWdodCwgVGltb3RoeSBNIChUaW0pIFttYWlsdG86 dGltb3RoeS5kd2lnaHRAdmVyaXpvbi5jb21dDQo+Pj4+Pj4gU2VudDogQXVndXN0IDA4LCAy MDE2IDEwOjQ3IEFNDQo+Pj4+Pj4gVG86IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJj ZS5Hb3JtYW5Ac3ByaW50LmNvbT47IERPTExZLA0KPj4+PiBNQVJUSU4NCj4+Pj4+PiBDIDxt ZDMxMzVAYXR0LmNvbT4NCj4+Pj4+PiBDYzogUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBV SyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsNCj4+Pj4+PiBSaWNoYXJkIFNob2Nr ZXkgPHJpY2hhcmRAc2hvY2tleS51cz47IFBhdWwgS3l6aXZhdA0KPj4+Pj4+IDxwa3l6aXZh dEBhbHVtLm1pdC5lZHU+OyBzdGlyQGlldGYub3JnOyBCcmlhbiBSb3Nlbg0KPj4+Pj4+IDxi ckBicmlhbnJvc2VuLm5ldD4NCj4+Pj4+PiBTdWJqZWN0OiBSRTogW3N0aXJdIFNUSVIgNDQ3 NGJpcy0xMCBjb21tZW50cw0KPj4+Pj4+DQo+Pj4+Pj4gUGllcmNlLA0KPj4+Pj4+DQo+Pj4+ Pj4gTXkgYXNzdW1wdGlvbiBpcyB0aGF0IE1hcnRpbiBtb3JwaGVkIDIgc3BlY3MsIDNHUFAg VFMgMjkuMTY1IGFuZA0KPj4+PiBHU01BDQo+Pj4+Pj4gSVIuOTUuICBUaGUgbGF0dGVyIHJl ZmVyZW5jZXMgYW5kIHByb2ZpbGVzIHRoZSBmb3JtZXIuICBTZWN0aW9uDQo+Pj4+Pj4gNC40 LjEgb2YNCj4+Pj4+PiBJUi45NSByZWNvbW1lbmRzIHRoYXQgTU5PLXRvLU1OTyBvciBNTk8t dG8tSVBYIGludGVyY29ubmVjdHMgYmUNCj4+Pj4+PiBjb25zaWRlcmVkIHRydXN0ZWQsIGFu ZCB0YWJsZSAzIGluIHRoYXQgc2VjdGlvbiByZWNvbW1lbmRzIHRoYXQNCj4+Pj4+PiBQLUFz c2VydGVkLUlkZW50aXR5IChQQUkpIGJlIGV4Y2hhbmdlZCBhdCBhIHRydXN0ZWQgaW50ZXJj b25uZWN0Lg0KPj4+Pj4+IEl0IGFsc28gc3RhdGVzIHRoYXQgUEFJIGlzIG1hbmRhdG9yeSBh dCBhIHJvYW1pbmcgTk5JLg0KPj4+Pj4+DQo+Pj4+Pj4gVGltDQo+Pj4+Pj4NCj4+Pj4+Pg0K Pj4+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+Pj4+Pj4gRnJvbTogc3RpciBb bWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEdvcm1hbiwNCj4+ Pj4+PiBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4+IFNlbnQ6IE1vbmRheSwgQXVndXN0IDA4LCAy MDE2IDg6NTIgQU0NCj4+Pj4+PiBUbzogRE9MTFksIE1BUlRJTiBDDQo+Pj4+Pj4gQ2M6IFJv c2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUgVUs7IFJpY2hhcmQgU2hvY2tleTsgUGF1bCBLeXpp dmF0Ow0KPj4+Pj4+IHN0aXJAaWV0Zi5vcmc7IEJyaWFuIFJvc2VuDQo+Pj4+Pj4gU3ViamVj dDogW0VdIFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4NCj4+ Pj4+PiBNYXJ0aW4sDQo+Pj4+Pj4NCj4+Pj4+PiBZb3UgcmVmZXJlbmNlZCBUUyAyOS4xOTUu ICBJJ20gbm90IGZhbWlsaWFyIHdpdGggdGhhdCBzcGVjLiAgSGFzIGl0DQo+Pj4+Pj4gYmVl biBkZXByZWNhdGVkPyAgSXQncyBub3Qgc2hvd2luZyB1cCBvbiB0aGUgM0dQUCBzaXRlLg0K Pj4+Pj4+DQo+Pj4+Pj4gSSByZWZlcmVuY2VkIDNHUFAgVFMgMjQuNjA3LiAgSW4gU2VjdGlv biA0LjMuMiAiUmVxdWlyZW1lbnRzIG9uIHRoZQ0KPj4+Pj4+IG9yaWdpbmF0aW5nIHNpZGUi IE5vdGUgNCBpdCBzdGF0ZXMsICIgSXQgaXMgYXNzdW1lZCB0aGF0IHRoZSBJQkNGDQo+Pj4+ Pj4gaXMgcmVzcG9uc2libGUgZm9yIHN0cmlwcGluZyB0aGUgUC1Bc3NlcnRlZC1JZGVudGl0 eSBmcm9tIHRoZSBTSVANCj4+Pj4+PiBoZWFkZXIgd2hlbiBpbnRlcndvcmtpbmcgd2l0aCB1 bnRydXN0ZWQgbmV0d29ya3MuIg0KPj4+Pj4+DQo+Pj4+Pj4gWW91ciByZW1hcmsgaXMgY29u c2lzdGVudCB3aXRoIE5vdGUgNCwgYnV0IG9ubHkgaWYgd2UgYWdyZWUgdGhhdCwNCj4+Pj4+ PiBmb3IgaW5zdGFuY2UsIHRoZSBBVCZUIG5ldHdvcmsgYW5kIHRoZSBTcHJpbnQgbmV0d29y ayBhcmUgInRydXN0ZWQNCj4+Pj4+PiBuZXR3b3JrcyIuICBJbiByZWFsaXR5LCB0aGlzIGlz IG5vdCB0aGUgY2FzZSBvciB0aGVyZSB3b3VsZCBiZSBubw0KPj4+Pj4+IGZpcmV3YWxscyBv ciBTZXNzaW9uIEJvcmRlciBDb250cm9sbGVycyB1c2VkIGZvciBpbnRlcndvcmtpbmcgYW5k DQo+Pj4+Pj4gc2VjdXJpdHkuICBNeSBvcGluaW9uIGlzIHRoZSBvbmx5IGNhcnJpZXIgbmV0 d29ya3MgdGhhdCBhcmUgdHJ1c3RlZA0KPj4+Pj4+IGFyZSB0aGUgU1M3IG5ldHdvcmssIGFu ZCB0aGUgSW50ZXJuZXQgYmFja2JvbmUuDQo+Pj4+Pj4NCj4+Pj4+PiBXaGF0IGl0IHJlYWxs eSBjb21lcyBkb3duIHRvIGlzIHRoYXQgUEFJIGlzIGxlZnQgaW4gc2lnbmFsaW5nDQo+Pj4+ Pj4gZWl0aGVyIHRocm91Z2ggZm9ybWFsIHNwZWNpZmljYXRpb24gYXMgYSBwYXJ0IG9mIGFu IGludGVyLWNhcnJpZXINCj4+Pj4+PiBpbnRlci1jb25uZWN0aW9uIGFncmVlbWVudCwgb3Ig YnkgY3VzdG9tIChvciBldmVuIGJ5IGFjY2lkZW50KS4gIEkNCj4+Pj4+PiB0aGluayB0aGlz IGlsbHVzdHJhdGVzIFBhdWwgUm9zYm90aGFtJ3Mgb2JzZXJ2YXRpb24gaXMgdHJ1ZS4NCj4+ Pj4+Pg0KPj4+Pj4+IFBpZXJjZQ0KPj4+Pj4+DQo+Pj4+Pj4gLS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS0NCj4+Pj4+PiBGcm9tOiBET0xMWSwgTUFSVElOIEMgW21haWx0bzptZDMxMzVA YXR0LmNvbV0NCj4+Pj4+PiBTZW50OiBBdWd1c3QgMDUsIDIwMTYgMTI6NTUgUE0NCj4+Pj4+ PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29t Pg0KPj4+Pj4+IENjOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLIDxwYXVsLnJvc2Jv dGhhbUB2b2RhZm9uZS5jb20+Ow0KPj4+PiBCcmlhbg0KPj4+Pj4+IFJvc2VuIDxickBicmlh bnJvc2VuLm5ldD47IHN0aXJAaWV0Zi5vcmc7IFBhdWwgS3l6aXZhdA0KPj4+Pj4+IDxwa3l6 aXZhdEBhbHVtLm1pdC5lZHU+OyBSaWNoYXJkIFNob2NrZXkgPHJpY2hhcmRAc2hvY2tleS51 cz4NCj4+Pj4+PiBTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50 cw0KPj4+Pj4+DQo+Pj4+Pj4gUEFJIGlzIG5vdCBzdHJpcHBlZCBhdCB0aGUgbmV0d29yayBi b3VuZGFyeSBiZXR3ZWVuIHRydXN0ZWQNCj4+Pj4+PiBuZXR3b3JrcyAzR1BQIFRTIDI5LjE5 NSBBdGlzIHNwZWNzIEdTTUEgQXRpcyBzaXAgZm9ydW0gdGFzayBmb3JjZQ0KPj4+Pj4+IElU VSBBbmQgdGhlIGxpc3QgZ29lcyBvbg0KPj4+Pj4+DQo+Pj4+Pj4gTWFydGluIEMgRG9sbHkN Cj4+Pj4+PiBMZWFkIE1lbWJlciBvZiBUZWNobmljYWwgU3RhZmYNCj4+Pj4+PiBDb3JlICYg R292ZXJubWVudC9SZWd1bGF0b3J5IFN0YW5kYXJkcyBBVCZUDQo+Pj4+Pj4gQ2VsbDogNjA5 LTkwMy0zMzYwDQo+Pj4+Pj4gRW1haWw6IG1kMzEzNUBhdHQuY29tDQo+Pj4+Pj4NCj4+Pj4+ Pj4gT24gQXVnIDUsIDIwMTYsIGF0IDE6MDQgUE0sIEdvcm1hbiwgUGllcmNlIEEgW0NUT10N Cj4+Pj4+Pj4gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4gd3JvdGU6DQo+Pj4+Pj4+DQo+ Pj4+Pj4+IFdoaWNoIGhlYWRlciB0aGUgY2FycmllciBjaG9vc2VzIHRvIGRpc3BsYXkgaXMg bW9vdCBpZiB0aGUgaGVhZGVyDQo+Pj4+Pj4+IGlzIHN0cmlwcGVkIGJldHdlZW4gY2Fycmll cnMgYXMgcGVyIGF0IGxlYXN0IG9uZSBzdGFuZGFyZC4gIEkNCj4+Pj4+Pj4gdGhpbmsgUGF1 bCBSb3Nib3RoYW0ncyBvYnNlcnZhdGlvbiB3ZSdyZSBsaWtlbHkgdG8gZW5jb3VudGVyICJz b21lDQo+Pj4+Pj4+IGludGVyZXN0aW5nIGludGVyd29ya2luZyBjaGFsbGVuZ2VzIiB3YXMg cGVyaGFwcyB0aGUgdW5kZXJzdGF0ZW1lbnQgb2YgdGhlIHllYXIuDQo+Pj4+Pj4+DQo+Pj4+ Pj4+IFBpZXJjZQ0KPj4+Pj4+Pg0KPj4+Pj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LQ0KPj4+Pj4+PiBGcm9tOiBQYXVsIEt5eml2YXQgW21haWx0bzpwa3l6aXZhdEBhbHVtLm1p dC5lZHVdDQo+Pj4+Pj4+IFNlbnQ6IEF1Z3VzdCAwNSwgMjAxNiAxMTo1OCBBTQ0KPj4+Pj4+ PiBUbzogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29t PjsgUmljaGFyZA0KPj4+Pj4+PiBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM+OyBSb3Ni b3RoYW0sIFBhdWwsIFZvZGFmb25lIFVLDQo+Pj4+Pj4+IDxwYXVsLnJvc2JvdGhhbUB2b2Rh Zm9uZS5jb20+OyBCcmlhbiBSb3NlbiA8YnJAYnJpYW5yb3Nlbi5uZXQ+DQo+Pj4+Pj4+IENj OiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+IFN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUiA0NDc0 YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+DQo+Pj4+Pj4+IElmIFBBSSBpcyBwcmVzZW50IGFu ZCBzaWduZWQsIGFuZCBGcm9tIGlzIGFsc28gc2lnbmVkLCBJIHdvdWxkDQo+Pj4+Pj4+IGV4 cGVjdCBpdCB0byBiZSB1cCB0byB0aGUgVUEgdG8gZGVjaWRlIHdoYXQgdG8gZGlzcGxheSwg bm90IHRoZSBjYXJyaWVyLg0KPj4+Pj4+Pg0KPj4+Pj4+PiBPZiBjb3Vyc2UgdGhpcyB3aWxs IHdvcmsgZGlmZmVyZW50bHkgaWYgdGhlcmUgaXMgYSBkaWZmZXJlbnQNCj4+Pj4+Pj4gc2ln bmFsaW5nIHJlZ2ltZSBiZXR3ZWVuIHRoZSBjYXJyaWVyIGFuZCB0aGUgdXNlciBkZXZpY2Ug KGUuZy4NCj4+Pj4+Pj4gYmxhY2sNCj4+Pj4gcGhvbmUpLg0KPj4+Pj4+Pg0KPj4+Pj4+PiAg ICBUaGFua3MsDQo+Pj4+Pj4+ICAgIFBhdWwNCj4+Pj4+Pj4NCj4+Pj4+Pj4+IE9uIDgvNS8x NiAxMToyNiBBTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSB3cm90ZToNCj4+Pj4+Pj4+IFAt QXNzZXJ0ZWQtSWRlbnRpdHkgaXMgc3VwcG9zZWQgdG8gb3BlcmF0ZSAiYW1vbmcgdHJ1c3Rl ZCBTSVANCj4+Pj4+Pj4+IGVudGl0aWVzIiBhbmQgdGhlcmVmb3JlIHNvbWUgc3BlY2lmaWNh dGlvbnMgKGUuZy4sIDNHUFAgVFMNCj4+Pj4+Pj4+IDI0LjYwNykgYXNzdW1lIFAtQXNzZXJ0 ZWQtSWRlbnRpdHkgaXMgc3RyaXBwZWQgYnkgYm9yZGVyDQo+Pj4+Pj4+PiBjb250cm9sbGVy IGZ1bmN0aW9ucyBhbmQgaXMgbm90IHRvIGJlIHVzZWQgaW4gaW50ZXItY2Fycmllcg0KPj4+ Pj4+Pj4gaW50ZXItY29ubmVjdGlvbiAoYWx0aG91Z2ggaXQgY29tbW9ubHkgc2hvd3MgdXAg YW55d2F5KS4gIE15IG9waW5pb24gaXMgdGhlICJGcm9tIg0KPj4+Pj4+Pj4gaGVhZGVyIGlz IGxpa2VseSB1c2VkIG1vcmUgb2Z0ZW4gZm9yIHByZXNlbnRhdGlvbi4NCj4+Pj4+Pj4+DQo+ Pj4+Pj4+PiBQaWVyY2UNCj4+Pj4+Pj4+DQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCj4+Pj4+Pj4+IEZyb206IFJpY2hhcmQgU2hvY2tleSBbbWFp bHRvOnJpY2hhcmRAc2hvY2tleS51c10NCj4+Pj4+Pj4+IFNlbnQ6IEF1Z3VzdCAwNSwgMjAx NiA5OjM3IEFNDQo+Pj4+Pj4+PiBUbzogUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSw0K Pj4+PiA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPjsNCj4+Pj4+Pj4+IFBhdWwgS3l6 aXZhdCA8cGt5eml2YXRAYWx1bS5taXQuZWR1PjsgQnJpYW4gUm9zZW4NCj4+Pj4+Pj4+IDxi ckBicmlhbnJvc2VuLm5ldD4NCj4+Pj4+Pj4+IENjOiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+ PiBTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0KPj4+Pj4+ Pj4NCj4+Pj4+Pj4+DQo+Pj4+Pj4+PiBIdW1tIHRoaXMgaXMgZ2V0dGluZyBpbnRlcmVzdGlu Zy4gIEl0cyBteSB1bmRlcnN0YW5kaW5nIHRoYXQgdGhlDQo+Pj4+Pj4+PiBkaXNwbGF5IG51 bWJlciBha2EgInByZXNlbnRhdGlvbiBudW1iZXIiIGluIHRoZSBVUyBjb250ZXh0IGlzIHRo ZQ0KPj4+Pj4+Pj4gb25lIGNhcnJpZWQgaW4gdGhlIFBBSS4gIE1hcnRpbiwgUGllcmNlPw0K Pj4+Pj4+Pj4NCj4+Pj4+Pj4+DQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4NCj4+Pj4+Pj4+IE9uIDgv NS8xNiwgMzo0NiBBTSwgInN0aXIgb24gYmVoYWxmIG9mIFJvc2JvdGhhbSwgUGF1bCwgVm9k YWZvbmUgVUsiDQo+Pj4+Pj4+PiA8c3Rpci1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBv ZiBwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20+DQo+Pj4+IHdyb3RlOg0KPj4+Pj4+Pj4N Cj4+Pj4+Pj4+ICAgIEp1bXBpbmcgaW4gbm93IHRoYXQgd2UncmUgb24gRXVyb3BlYW4gd29y a2luZyB0aW1lLCArMSBvbg0KPj4+Pj4+Pj4gUGF1bCdzIG9ic2VydmF0aW9uLg0KPj4+Pj4+ Pj4NCj4+Pj4+Pj4+ICAgIEhlcmUgaW4gdGhlIFVLLCB3ZSd2ZSBnb3QgMiBudW1iZXJzIGNh cnJpZWQgYXMgY2FsbGluZyBsaW5lDQo+Pj4+Pj4+PiBJRHMuLi4ub25lICh3ZSB0ZXJtIHRo ZSBOZXR3b3JrIE51bWJlciwgY2FycmllZCBpbiBQQUlEKSB1bmlxdWVseQ0KPj4+Pj4+Pj4g aWRlbnRpZmllcyB0aGUgbGluZSwgdGhlIG90aGVyICh3ZSB0ZXJtIFByZXNlbnRhdGlvbiBO dW1iZXIsDQo+Pj4+Pj4+PiBjYXJyaWVkIGluIEZyb20pIGlzIHVzZWQgZm9yIGRpc3BsYXkg cHVycG9zZXMuDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gICAgT25seSB0aGUgY2FycmllciBoYXMg dGhlIGF1dGhvcml0eSB0byBzZXQgdGhlIE5ldHdvcmsgTnVtYmVyDQo+Pj4+Pj4+PiBzbyBv bmx5IHRoZXkgY291bGQgc2lnbiBpdC4NCj4+Pj4+Pj4+DQo+Pj4+Pj4+PiAgICBCdXQgLSBz dWJqZWN0IHRvIHJlZ3VsYXRvcnkgcmVzdHJpY3Rpb25zIHdoaWNoIGFyZSB3ZWxsDQo+Pj4+ Pj4+PiBkb2N1bWVudGVkDQo+Pj4+Pj4+PiAtIHRoZSBudW1iZXIgc2VudCBmb3IgZGlzcGxh eSBwdXJwb3NlcyBiZWxvbmdzIHRvIHRoZSBjdXN0b21lci4NCj4+Pj4+Pj4+IEZvciBibHVl LWNoaXAgY3VzdG9tZXJzLCBJIGNhbiBhbGxvdyB0aGVtIHRvIHNlbmQgdGhlaXINCj4+Pj4+ Pj4+IFByZXNlbnRhdGlvbiBOdW1iZXJzIGludG8gdGhlIG5ldHdvcmssIGFuZCBjYW4ndCBy ZWFkaWx5IGNoZWNrIGF0DQo+Pj4+Pj4+PiBhIG5ldHdvcmsgbGV2ZWwgdGhhdCB0aGV5J3Jl IHRoZWlycyAoSSBkbyBoYXZlIGNvbnRyYWN0dWFsDQo+Pj4+Pj4+PiBzYWZlZ3VhcmRzKS4g IFRoZSBudW1iZXIgbWF5IGhhdmUgYmVlbiBhbGxvY2F0ZWQgYnkgbWUsIG9yIGNvdWxkDQo+ Pj4+Pj4+PiBiZSBhbGxvY2F0ZWQgYnkgYSB0aGlyZCBwYXJ0eSBwcm92aWRlci4gIElmIGl0 J3MgYSBjYWxsLWNlbnRyZQ0KPj4+Pj4+Pj4gdGhleSdsbCBiZSBtYWtpbmcgb3V0Ym91bmQg Y2FsbHMgZm9yIGxvdHMgb2YgZGlmZmVyZW50IGN1c3RvbWVycw0KPj4+Pj4+Pj4gd2hpY2gg d2lsbCBjaGFuZ2Ugb24gZGF5LWJ5LWRheQ0KPj4+PiBiYXNpcy4NCj4+Pj4+Pj4+IFRoaXMg aXMgYnVzaW5lc3MgYXMgdXN1YWwuICBJIGRvbid0IGxpa2UgdGhlIHRlcm0gImF1dGhvcmlz ZWQNCj4+Pj4+Pj4+IHNwb29maW5nIiBiZWNhdXNlIGl0IGltcGxpZXMgdGhhdCB0aGUgQ0xJ IGlzIGluIHNvbWUgd2F5IGJlaW5nIHJpZ2dlZDoNCj4+Pj4+Pj4+IGl0J3Mgbm90LCBpdCdz IHRoZSBjb3Jwb3JhdGUgY3VzdG9tZXIgb3IgdGhlaXIgc3ViY29udHJhY3Rvcg0KPj4+Pj4+ Pj4gdXNpbmcgdGhlIG51bWJlciB0aGF0J3MgYmVlbiBhc3NpZ25lZCAoc28gaW4gaW50ZXJu ZXQgdGVybXMNCj4+Pj4+Pj4+IGRlbGVnYXRlZCkgdG8gdGhlbSB2aWEgYSBjaGFpbiBvZiB0 cnVzdCBmcm9tIHRoZSByZWd1bGF0b3IuDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gICAgV2hhdCBJ IHdhbnQgaXMgdGhlIGFiaWxpdHkgZm9yIGN1c3RvbWVycyB0byB1c2UgdGhlaXINCj4+Pj4+ Pj4+IGNyZWRlbnRpYWxzICB0byBzaWduIHRoZSBDTElzIHRoZXkgc2VuZCBtZSBzbyB0aGF0 IGF0IHRoZQ0KPj4+Pj4+Pj4gdGVybWluYXRpbmcgZW5kIGl0IGNhbiAgYmUgY2hlY2tlZCAo b3IgaW5kZWVkIHNvbWV3aGVyZSBlbi1yb3V0ZQ0KPj4+Pj4+Pj4gaWYgdGhhdCdzIHRoZSBi dXNpbmVzcyBtb2RlbCkuDQo+Pj4+Pj4+PiBJIGNhbiBhbmQgd291bGQgc2lnbiBmb3IgY3Vz dG9tZXJzIG9uIG15IG1vYmlsZSBidXNpbmVzcyBzaW5jZQ0KPj4+Pj4+Pj4gSSdtIGRyaXZp bmcgd2hhdCBudW1iZXIgaXMgcHJlc2VudGVkLCBidXQgdGhhdCdzIGJ5LXRoZS1ieQ0KPj4+ Pj4+Pj4gYmVjYXVzZSB0aGV5IGFyZW4ndCB0aGUgb25lcyB3aG8gZ2VuZXJhdGUgbWlsbGlv bnMgb2YgbnVpc2FuY2UNCj4+Pj4+Pj4+IGNhbGxzLiAgSWYgdGhlIHNpZ25pbmcgb25seSBv Y2N1cnMgYXQgdGhlIG9yaWdpbmF0aW5nIGNhcnJpZXINCj4+Pj4+Pj4+IGxldmVsIGZvciBj b3Jwb3JhdGUvY2FsbC1jZW50cmUgY3VzdG9tZXJzIHRoYXQncyBubyB1c2UgYmVjYXVzZQ0K Pj4+Pj4+Pj4gSSdtIG5vdCBpbiBhIHBvc2l0aW9uIHRvIGRvIHRoYXQgZm9yIHRoZXNlIHR5 cGUgb2YNCj4+Pj4+Pj4+IGN1c3RvbWVycy4uLmFuZCB0aGUgd2hvbGUgc3lzdGVtIGJlY29t ZXMgYSB3YXN0ZSBvZiB0aW1lLiBJJ2QNCj4+Pj4+Pj4+IGFsc28gaGlnaGxpZ2h0IHRoZXJl IGFyZSBtYW55IG1vcmUgb2YgbXkgbGFyZ2UgY3VzdG9tZXJzIHRoYXQgSSdkDQo+Pj4+Pj4+ PiB0cnVzdCBtb3JlIHRoYW4gYSBmYXIgZW5kIG9yaWdpbmF0aW5nIGNhcnJpZXIgdGhhdCBj b3VsZCBiZQ0KPj4+Pj4+Pj4gYW55d2hlcmUgaW4gdGhlIHdvcmxkICh0aG91Z2ggd2UgaGF2 ZSBubyBzaG9ydGFnZSBvZiBzbWFsbA0KPj4+Pj4+Pj4gY2FycmllcnMgdGhhdCBJIHdvdWxk bid0IGtub3cgZnJvbSBBZGFtIG1vcmUgbG9jYWxseSBpbiB0aGUNCj4+Pj4+Pj4+IFVLLi4u LikNCj4+Pj4+Pj4+DQo+Pj4+Pj4+PiAgICBSZWdhcmRzDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4g ICAgUGF1bA0KPj4+Pj4+Pj4NCj4+Pj4+Pj4+ICAgIC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t LS0tDQo+Pj4+Pj4+PiAgICBGcm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYu b3JnXSBPbiBCZWhhbGYgT2YgUGF1bCBLeXppdmF0DQo+Pj4+Pj4+PiAgICBTZW50OiAwNCBB dWd1c3QgMjAxNiAyMzoxMg0KPj4+Pj4+Pj4gICAgVG86IEJyaWFuIFJvc2VuDQo+Pj4+Pj4+ PiAgICBDYzogc3RpckBpZXRmLm9yZw0KPj4+Pj4+Pj4gICAgU3ViamVjdDogUmU6IFtzdGly XSBTVElSIDQ0NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4gICAgT24g OC80LzE2IDY6MDIgUE0sIEJyaWFuIFJvc2VuIHdyb3RlOg0KPj4+Pj4+Pj4+IEkgdGhpbmsg aXQncyBub3QgYSBkZWxlZ2F0aW9uLiAgVGhlIG1vYmlsZSBwaG9uZSBpcyBub3QgYmVpbmcN Cj4+Pj4+Pj4+PiBkZWxlZ2F0ZWQgdGhlIFROLCBpdCdzIGJlaW5nIGF1dGhvcml6ZWQgdG8g cGxhY2UgY2FsbHMgdGhhdCBhcmUNCj4+Pj4+Pj4+PiBub3QNCj4+Pj4+Pj4+ID5mcm9tIHRo YXQgVE4sIGJ1dCBhcHBlYXIgdG8gYmUuDQo+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+PiBUaGUgbWVj aGFuaXNtIHRvIGhhbmRsZSB0aGUgY3JlZGVudGlhbCBpcyBleGFjdGx5IHRoZSBzYW1lIGFz IGENCj4+Pj4+Pj4+PiBkZWxlZ2F0aW9uLCBzbyBpZiB5b3Ugd2FudCB0byBjYWxsIGl0IGRl bGVnYXRpb24sIGdvIGFoZWFkLCBidXQNCj4+Pj4+Pj4+PiBJIHByZWZlciB0byBjYWxsIGl0 IGF1dGhvcml6ZWQgc3Bvb2ZpbmcuDQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gICAgSUlVQyB0aGUg ZGVsZWdhdGlvbiBpcyB0byBhIHJlc3BvbnNpYmxlIGVudGl0eSAoc29tZXRoaW5nIHRoYXQN Cj4+Pj4+Pj4+IGNhbiBiZSBoZWxkIGxlZ2FsbHkgYWNjb3VudGFibGUgLSBlLmcuIGEgcGVy c29uKSwgbm90IHRvIGEgZGV2aWNlLg0KPj4+Pj4+Pj4gVGhlIGVudGl0eSBjYW4gdGhlbiAi dXNlIiB0aGUgY3JlZGVudGlhbCB2aWEgYW55IGRldmljZShzKSBpdA0KPj4+Pj4+Pj4gY2hv b3Nlcy4gSW4gdGhlIGNhc2Ugb2YgdGhlIG1vYmlsZSwgdGhlIGRldmljZSB0aGVuIGJlY29t ZXMgYQ0KPj4+Pj4+Pj4gdHdvLWxpbmUNCj4+Pj4gcGhvbmUuDQo+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4gICAgVGhhbmtzLA0KPj4+Pj4+Pj4gICAgUGF1bA0KPj4+Pj4+Pj4NCj4+Pj4+Pj4+PiBC cmlhbg0KPj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+IE9uIEF1ZyA0LCAyMDE2LCBhdCA1OjUxIFBN LCBQYXVsIEt5eml2YXQNCj4+Pj4+Pj4+Pj4gPHBreXppdmF0QGFsdW0ubWl0LmVkdT4NCj4+ Pj4+Pj4+Pj4gd3JvdGU6DQo+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+IE9uIDgvNC8xNiA1OjQz IFBNLCBCcmlhbiBSb3NlbiB3cm90ZToNCj4+Pj4+Pj4+Pj4+IEluIG15IGphcmdvbiBhbiAi YXV0aG9yaXplZCBzcG9vZmVyIiBpcyB0aGUgZG9jdG9yIHdobyBpcw0KPj4+Pj4+Pj4+Pj4g Y2FsbGluZyAgZnJvbSBoaXMgbW9iaWxlLCBidXQgc2VuZGluZyB0aGUgVE4gb2YgaGlzIG9m ZmljZQ0KPj4+Pj4+Pj4+Pj4gcGhvbmUgYXMgY2FsbGluZyBwYXJ0eS4NCj4+Pj4+Pj4+Pj4+ IFRoZSBkZWxlZ2F0aW9uIHRvIGhpcyBvZmZpY2UgcGhvbmUgd2FzIG1hZGUgYnkgaGlzIGxh bmRsaW5lDQo+Pj4+Pj4+Pj4+PiBjYXJyaWVyIHRvIGhpbS4gIEhlIHRoZW4gY3JlYXRlcyBh bm90aGVyIGNyZWRlbnRpYWwsIHdoaWNoIGhlDQo+Pj4+Pj4+Pj4+PiBzaWducyB3aXRoIGhp cyBvZmZpY2UgcGhvbmUgY3JlZGVudGlhbCB0aGF0IGF1dGhvcml6ZXMgaGlzDQo+Pj4+Pj4+ Pj4+PiBtb2JpbGUgdG8gc2VuZCBjYWxscyBmcm9tIGhpcyBvZmZpY2UgbnVtYmVyLiAgSGUg aXMgc3Bvb2ZpbmcNCj4+Pj4+Pj4+Pj4+IChiZWNhdXNlIHRoZSBjYWxsIGlzIGNvbWluZyBm cm9tIGhpcyBtb2JpbGUncyBUTiBidXQgY2xhaW1zIHRvDQo+Pj4+Pj4+Pj4+PiBiZSBmcm9t IGhpcyBvZmZpY2UpLCBidXQgaXQncyBhdXRob3JpemVkIHNwb29maW5nLiAgVGhlIGRvYw0K Pj4+Pj4+Pj4+Pj4gY291bGQgZ2l2ZSB0aGUgY3JlZGVudGlhbCB0byBoaXMgbW9iaWxlIFNQ IGlmIHRoZXkgc2lnbiBvbiBoaXMgYmVoYWxmLg0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+PiBJ IGRvbid0IHVuZGVyc3RhbmQgaG93IHRoYXQgaXMgZGlmZmVyZW50IGZyb20gcmVndWxhciBk ZWxlZ2F0aW9uLg0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+PiBXaGVuIGhpcyBsYW5kbGluZSBj YXJyaWVyIGdhdmUgaGltIGEgZGVsZWdhdGVkIGNlcnRpZmljYXRlIGZvcg0KPj4+Pj4+Pj4+ PiBoaXMgbGFuZGxpbmUgbnVtYmVyLCBoZSBzaG91bGQgYmUgYWJsZSB0byBpbnN0YWxsIHRo YXQgaW4NCj4+Pj4+Pj4+Pj4gd2hhdGV2ZXIgZGV2aWNlcyBoZSB3YW50cyAtIGhpcyBsYW5k bGluZSBVQSwgaGlzIG1vYmlsZSBwaG9uZSwNCj4+Pj4+Pj4+Pj4gZXRjLiBJdCBpcyBzdGls bCBkZWxlZ2F0ZWQgZnJvbSBoaXMgbGFuZGxpbmUgY2FycmllciwgZXZlbiB3aGVuDQo+Pj4+ Pj4+Pj4+IHVzZWQgd2l0aCBjYWxscyB2aWEgaGlzIG1vYmlsZSBjYXJyaWVyLg0KPj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+PiBUaGFua3MsDQo+Pj4+Pj4+Pj4+IFBhdWwNCj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+IFNvbWUgZm9sa3MgZG9uJ3QgbGlrZSBhdHRhY2hpbmcgdGhlICJzcG9v ZmluZyIgbGFiZWwgdG8gYQ0KPj4+Pj4+Pj4+Pj4gbGVnaXRpbWF0ZSB1c2UuDQo+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4gQnV0IHRoYXQncyBob3cgSSBkZXNjcmliZSBpdC4NCj4+Pj4+ Pj4+Pj4+DQo+Pj4+Pj4+Pj4+PiBCcmlhbg0KPj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiBP biBBdWcgNCwgMjAxNiwgYXQgNTozNyBQTSwgUGF1bCBLeXppdmF0DQo+Pj4+Pj4+Pj4+Pj4g PHBreXppdmF0QGFsdW0ubWl0LmVkdSA8bWFpbHRvOnBreXppdmF0QGFsdW0ubWl0LmVkdT4+ IHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gKzEsIGJ1dCB3aXRoIG9uZSBx dWVzdGlvbiBiZWxvdzoNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiBPbiA4LzQvMTYg NToxNCBQTSwgQnJpYW4gUm9zZW4gd3JvdGU6DQo+Pj4+Pj4+Pj4+Pj4+IEkgdGhpbmsgYWxs IHdlIG5lZWQgaXMgdG8gaGF2ZSBjcmVkZW50aWFscyBmb2xsb3cgdGhlDQo+Pj4+Pj4+Pj4+ Pj4+IGRlbGVnYXRpb24gcGF0aCwNCj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+PiBwbHVz IHRoZSBvcHRpb24gdG8gYWRkIGFub3RoZXIgbGV2ZWwgKG5vdCBkZWxlZ2F0aW9uKSBmb3IN Cj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXplZCBzcG9vZmVycy4NCj4+Pj4+Pj4+Pj4+Pg0KPj4+ Pj4+Pj4+Pj4+IEkgZG9uJ3QgdW5kZXJzdGFuZCAiYXV0aG9yaXplZCBzcG9vZmVycyIgaW4g dGhpcyBjb250ZXh0LCBhcw0KPj4+Pj4+Pj4+Pj4+IGNvbnRyYXN0ZWQgdG8gInNwb29mZXJz IiB3aG8gaGF2ZSBiZWVuIGRlbGVnYXRlZCB0aGVpcg0KPj4+PiBhdXRob3JpdHkuDQo+Pj4+ Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+PiBUaGFua3MsDQo+Pj4+Pj4+Pj4+Pj4gUGF1bA0KPj4+ Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IEkgZG9uJ3QgdGhpbmsgaXQgbWF0dGVycyB3aG8g dGhlIGRlbGVnYXRvciBvciBkZWxlZ2F0ZWUgYXJlDQo+Pj4+Pj4+Pj4+Pj4+IGFzIGxvbmcg YXMgdGhlIGRlbGVnYXRvciBpcyB3aWxsaW5nIHRvIHRha2UgdGhlIGhlYXQgZm9yDQo+Pj4+ Pj4+Pj4+Pj4+IGRlbGVnYXRpbmcgdG8gc29tZW9uZSB3aG8gc2VuZHMgYSBsb3Qgb2YgYmFk IGNhbGxzLiAgVGhleQ0KPj4+Pj4+Pj4+Pj4+PiBjYW4gcGFzcyB0aGUgYnVjayAoIkkgZGVs ZWdhdGVkIHRoZSBUTiB0byBoaW0sIGFuZCBub3cgSSdtDQo+Pj4+Pj4+Pj4+Pj4+IG5vdCBy ZXNwb25zaWJsZSIpLCBidXQgb25seSBpZiB0aGUgU1Aga25vd3Mgd2hvIHRoZXkNCj4+Pj4+ Pj4+Pj4+Pj4gZGVsZWdhdGVkIHRvLCBzbyBhdXRob3JpdGllcyBjYW4gZm9sbG93IHRoZSBk ZWxlZ2F0aW9uIHBhdGguDQo+Pj4+Pj4+Pj4+Pj4+IFRoZXJlIGFyZSBwbGVudHkgb2YgY2Vy dGlmaWNhdGVkIGNhcnJpZXJzIHdobyBhcmUgd2lsbGluZyB0bw0KPj4+Pj4+Pj4+Pj4+PiBu b3QgY2FyZSB3aG8gdGhleSBkZWxlZ2F0ZSB0by4gIFRoZSBmYWN0IHRoYXQgdGhlcmUgYXJl IHNvbWUNCj4+Pj4+Pj4+Pj4+Pj4gd2hvIGRvIGRvZXNuJ3QgY2hhbmdlIG11Y2guDQo+Pj4+ Pj4+Pj4+Pj4+IE1ha2luZyBzdGlyIHdvcmsgbWVhbnMga25vd2luZyB3aG8geW91IGFyZSBk ZWxlZ2F0aW5nIHRvLCBzbw0KPj4+Pj4+Pj4+Pj4+PiB0aGF0IHlvdSBjYW4gcGFzcyB0aGUg aG90IHBvdGF0by4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gSXQncyBwZXJmZWN0 bHkgcmVhc29uYWJsZSBmb3IgYSBjYXJyaWVyIHRvIGJlIGFibGUgdG8gc2lnbg0KPj4+Pj4+ Pj4+Pj4+PiBmb3IgYW55IGNhbGxzIHBsYWNlZCBvbiBpdHMgbmV0d29yayBvbiBhbnkgbnVt YmVyIGl0IGhhcw0KPj4+Pj4+Pj4+Pj4+PiBiZWVuIGRlbGVnYXRlZC4NCj4+Pj4+Pj4+Pj4+ Pj4gSWYgaXQgZG9lcywgaXQncyBhc3NlcnRpbmcgdGhhdCB0aGUgY2FsbHMgYXJlIGZyb20g d2hvIHRoZXkNCj4+Pj4+Pj4+Pj4+Pj4gYXJlIHN1cHBvc2VkIHRvIGJlIGZyb20uDQo+Pj4+ Pj4+Pj4+Pj4+IFRoYXQgc2hvdWxkIGJlIHN0cmFpZ2h0Zm9yd2FyZCwgYnV0IHdlIGtub3cg aXQncyBub3QgYWx3YXlzLA0KPj4+Pj4+Pj4+Pj4+PiBhbmQgdGhhdCByZXByZXNlbnRzIHRo ZSBoYXJkIHBhcnQgb2YgZGVwbG95bWVudCBpbiBteSBvcGluaW9uLg0KPj4+Pj4+Pj4+Pj4+ PiBCdXQgb25jZSB0aGV5IGRlbGVnYXRlLCB0aGV5IGNhbiBoYW5kIHJlc3BvbnNpYmlsaXR5 IHRvIHNpZ24NCj4+Pj4+Pj4+Pj4+Pj4gdG8gIHRoZSBkZWxlZ2F0ZWUuICBCdXQsIHRoYXQg b25seSB3b3JrcyBpZiB0aGV5IGtub3cgd2hvDQo+Pj4+Pj4+Pj4+Pj4+IHRoZXkgYXJlIGRl bGVnYXRpbmcgdG8uDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IFRoZSByb290IG9m IHRoZSB3aG9sZSBtb2RlbCBpcyB0aGF0IHRoZXJlIGlzIGEgZm9ybWFsIG9yDQo+Pj4+Pj4+ Pj4+Pj4+IGluZm9ybWFsIGRlbGVnYXRpb24gcGF0aCBmb3IgdGVsZXBob25lIG51bWJlcnMg aW4gZXZlcnkNCj4+Pj4+Pj4+Pj4+Pj4gY291bnRyeSwgYW5kIHdlIGNhbiBidWlsZCBhIGNo YWluIG9mIHRydXN0IGZyb20gdGhhdA0KPj4+Pj4+Pj4+Pj4+PiBkZWxlZ2F0aW9uIHBhdGgu ICBJZiB5b3UgcHJvcG9zZSB0byBhbHRlciB0aGF0IG1vZGVsLCB0aGVuDQo+Pj4+Pj4+Pj4+ Pj4+IHdlIGdldCBpbnRvDQo+Pj4+Pj4+Pj4+Pj4+IChwb2xpY3kpIGlzc3VlcyBvZiB3aGlj aCBjYXJyaWVycy9lbnRpdGllcyB3ZSB0cnVzdCBhbmQNCj4+Pj4+Pj4+Pj4+Pj4gd2hpY2gg d2UgZG9uJ3QuDQo+Pj4+Pj4+Pj4+Pj4+IE91ciBtb2RlbCBpcyB0aGF0IHlvdSBrbm93IHdo byB5b3UgZGVsZWdhdGUgdG8sIGFuZCBvbmNlIHlvdQ0KPj4+Pj4+Pj4+Pj4+PiBkbyB0aGF0 IGRlbGVnYXRpb24sIGl0J3MgdGhlaXIgcHJvYmxlbS4NCj4+Pj4+Pj4+Pj4+Pj4gVGhhdCdz IHByZXR0eSBhcHBlYWxpbmcgSSB0aGluaywgZXZlbiBpZiBpdCdzIGEgY2hhbmdlIGluDQo+ Pj4+Pj4+Pj4+Pj4+IHNvbWUgYnVzaW5lc3MgcHJhY3RpY2VzLg0KPj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+PiBUaGUgbWVjaGFuaXNtIGlzIGNoYWluaW5nIGNyZWRlbnRpYWxzIGlu IGEgZm9ybSBvZiBhIFBLSSBhbmQNCj4+Pj4+Pj4+Pj4+Pj4gaGF2aW5nIGEgd2F5IHRvIGtu b3cgd2hpY2ggVE5zIGFyZSBjb3ZlcmVkIGJ5IGEgY3JlZGVudGlhbC4NCj4+Pj4+Pj4+Pj4+ Pj4gVGhhdCdzIHdoYXQgd2UgaGF2ZSwgYW5kIEknbSBsb2F0aCB0byBjaGFuZ2UgaXQuDQo+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+IEJyaWFuDQo+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiBPbiBBdWcgNCwgMjAxNiwgYXQgNDo1MyBQTSwg R29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4+Pj4+Pj4+Pj4gPFBpZXJjZS5Hb3JtYW5A c3ByaW50LmNvbQ0KPj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+ Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4+Pj4+ Pj4+Pj4+Pj4+IHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+IE9LLCB5 b3UgdGFsa2VkIG1lIGludG8gaW5kdWxnaW5nIGluIG9uZSBtb3JlIG1lc3NhZ2Ugb24NCj4+ Pj4+Pj4+Pj4+Pj4+IHBvbGljeSBhbmQgdXNlIGNhc2VzLg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+ Pj4+Pj4+Pj4+Pj4+IEkgYWdyZWUgdGhhdCB0aGUgU1RJUi9QQVNTcG9yVCBtZWNoYW5pc21z IGNvdWxkIGJlIGRlcGxveWVkDQo+Pj4+Pj4+Pj4+Pj4+PiBvbiAgaW5kaXZpZHVhbCBkZXZp Y2VzIGFzIHdlbGwgYXMgbXVsdGktZGV2aWNlIGFuZA0KPj4+Pj4+Pj4+Pj4+Pj4gbXVsdGkt bnVtYmVyIHBsYXRmb3Jtcy4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiBOdW1i ZXIgZGVsZWdhdGlvbiAoYW5kIHN1Yi1kZWxlZ2F0aW9uKSwgYW5kIGJ1c2luZXNzDQo+Pj4+ Pj4+Pj4+Pj4+PiByZWxhdGlvbnNoaXBzIGFyZSB0d28gYWRkaXRpb25hbCBmYWN0b3JzIHdo aWNoIGFmZmVjdA0KPj4+Pj4+Pj4+Pj4+Pj4gdHJ1c3R3b3J0aGluZXNzIG9mIGEgZ2l2ZW4g Y2FsbGluZyBudW1iZXIgYXV0aGVudGljYXRpb24uDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+ Pj4+Pj4+Pj4gSW5oZXJlbnQgdmFyaWFibGUgdHJ1c3R3b3J0aGluZXNzIG9mIGEgY2FsbGlu ZyBudW1iZXIgd2FzDQo+Pj4+Pj4+Pj4+Pj4+PiBteSByZWFzb24gZm9yIHN1Z2dlc3Rpbmcg YSB3YXkgdG8gcXVhbGlmeSB0aGUgc2lnbmF0dXJlIHRvDQo+Pj4+Pj4+Pj4+Pj4+PiByZWZs ZWN0IHRoYXQgdmFyaWFiaWxpdHkuDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4g T3JpZ2luYXRpbmcgY2FycmllcnMgYXJlIGluIGEgcG9zaXRpb24gdG8ga25vdyBpZiBhIGNh bGwgaXMNCj4+Pj4+Pj4+Pj4+Pj4+IGNvbWluZyBmcm9tIGEgZGV2aWNlIGFzc2lnbmVkIGEg c2luZ2xlIG51bWJlciwgb3IgZnJvbQ0KPj4+Pj4+Pj4+Pj4+Pj4gInRydW5rIGdyb3VwIiB3 aGljaCBjb3VsZCBvcmlnaW5hdGUgY2FsbHMgdXNpbmcgbXVsdGlwbGUNCj4+Pj4+Pj4+Pj4+ Pj4+IG51bWJlcnMsIGFuZCBjYW4gcXVhbGlmeSB0byBzb21lIGRlZ3JlZSB0aGUgdHJ1c3R3 b3J0aGluZXNzDQo+Pj4+Pj4+Pj4+Pj4+PiBvZiBudW1iZXIgYXV0aGVudGljaXR5IGFjY29y ZGluZ2x5Lg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+IE15IHN1Z2dlc3Rpb24g d2FzIHF1YWxpZnlpbmcgY2FsbGluZyBudW1iZXIgYXV0aGVudGljaXR5DQo+Pj4+Pj4+Pj4+ Pj4+PiBpbnRvIGNhdGVnb3JpZXMgb2YgY2Fycmllci1zaWduZWQgKG9yIG5vdCksIGFuZA0K Pj4+Pj4+Pj4+Pj4+Pj4gdW5hdXRoZW50aWNhdGVkLCBzZW1pLWF1dGhlbnRpY2F0ZWQsIGFu ZA0KPj4+Pj4+Pj4+Pj4+Pj4gbW9zdC1hdXRoZW50aWNhdGVkLiAgVGhlcmUgY2FuIGJlDQo+ Pj4+IG1vcmUNCj4+Pj4+Pj4+Pj4+Pj4+IGdyYW51bGFyaXR5LCBidXQgaXQgaW1wbGllcyBh ZGRpdGlvbmFsIG9wZXJhdGlvbmFsDQo+Pj4+Pj4+Pj4+Pj4+PiBjb21wbGV4aXR5IChib3Ro IGZvciB0aGUgY2FycmllcnMgYW5kIHRoZSBjb25zdW1lcnMpIGFuZCBJDQo+Pj4+Pj4+Pj4+ Pj4+PiBhc3N1bWUgZGltaW5pc2hlcyB2YWx1ZS4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+PiBNeSByZWFzb24gZm9yIGFkZGluZyB0aGUgYXV0aGVudGljaXR5IG9mIHRoZSBv cmlnaW5hdGluZw0KPj4+Pj4+Pj4+Pj4+Pj4gY2FycmllciBpcyB0eXBpY2FsIHRydXN0d29y dGhpbmVzcyBvZiBhIGNhcnJpZXIgYnVzaW5lc3MNCj4+Pj4+Pj4+Pj4+Pj4+IHJlbGF0aW9u c2hpcCB3aXRoIHR5cGljYWwgY29uc3VtZXJzIGFkZHMgdG8gdGhlDQo+Pj4+Pj4+Pj4+Pj4+ PiB0cnVzdHdvcnRoaW5lc3MgYXNzZXNzbWVudCBhbmQgcGFydGlhbGx5IGJlY2F1c2UgY2Fy cmllcnMNCj4+Pj4+Pj4+Pj4+Pj4+IGFyZSBhIHJlZ3VsYXRlZCBwb2ludCBvZiBmb3JlbnNp YyBpbnF1aXJ5IGZvciBDQUxFQSBhbmQgZnJhdWQuDQo+Pj4+Pj4+Pj4+Pj4+PiBBZGRpdGlv bmFsbHksIG1vc3QgY2FsbHMgb3JpZ2luYXRlIGFuZCB0ZXJtaW5hdGUgYmV0d2Vlbg0KPj4+ Pj4+Pj4+Pj4+Pj4gbW9iaWxlIGNvbnN1bWVycyB3aGVyZSB0aGVpciBjYXJyaWVycyBhcmUg YWJsZSB0byB1c2VmdWxseQ0KPj4+Pj4+Pj4+Pj4+Pj4gYXV0aGVudGljYXRlIHRoZWlyIGRl dmljZSBhbmQgaGF2ZSBhIGhpZ2ggZGVncmVlIG9mDQo+Pj4+Pj4+Pj4+Pj4+PiBjb25maWRl bmNlIG9mIHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIGNhbGxpbmcgbnVtYmVyLg0KPj4+Pj4+ Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+IEkgdGhpbmsgYmlsbGlvbnMgb2YgcGVyLVROIGNl cnRzIG9mIHZhcnlpbmcgdXNhYmlsaXR5DQo+Pj4+Pj4+Pj4+Pj4+PiAocmV2b2tlZCwgbm90 DQo+Pj4+Pj4+Pj4+Pj4+PiByZXZva2VkKSBmb3IgYXV0aGVudGljYXRpbmcgY2FsbGluZyBu dW1iZXIgd2lsbCBub3Qgd29yayB3ZWxsLg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4+IENvbnZlcnNlbHksIEkgdGhpbmsgYmlsbGlvbnMgb2YgcGVyLVROIGNlcnRzIHdpbGwg d29yaw0KPj4+Pj4+Pj4+Pj4+Pj4gd2VsbCwgaWYgdGhlIGNhbGxpbmcgcGFydHkgaGFzIHRv IHNpZ24gYSBjYWxsIHdpdGggYSBwZXItVE4NCj4+Pj4+Pj4+Pj4+Pj4+IGNlcnQgcHJvdmlk ZWQgYnkgdGhlIGNhbGxlZCBwYXJ0eS4gIE5vIGNhbGxlZCBwYXJ0eSBjZXJ0IHRvIGluY2x1 ZGU/DQo+Pj4+Pj4+Pj4+Pj4+PiBUaGVuIHRoZSBjYWxsaW5nIHBhcnR5IGRvZXMgbm90IGhh dmUgYSB0cnVzdGVkIHJlbGF0aW9uc2hpcA0KPj4+Pj4+Pj4+Pj4+Pj4gd2l0aCB0aGUgY2Fs bGVkIHBhcnR5LCBhbmQgdGhlIGNhbGwgY2FuIGJlDQo+Pj4+Pj4+Pj4+Pj4+PiBhdXRob3Jp emVkL3RyZWF0ZWQgYWNjb3JkaW5nbHkuDQo+Pj4+Pj4+Pj4+Pj4+PiAoSSd2ZSBtYWRlIHNp bWlsYXIsIG1vc3RseSBpZ25vcmVkIGNvbW1lbnRzIGluIE1PREVSTi4pDQo+Pj4+Pj4+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gUGllcmNlDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+Pj4gKkZyb206KiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0K Pj4+Pj4+Pj4+Pj4+Pj4gKlNlbnQ6KiBBdWd1c3QgMDQsIDIwMTYgMjowMyBQTQ0KPj4+Pj4+ Pj4+Pj4+Pj4gKlRvOiogR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1hbkBz cHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50 LmNvbT4NCj4+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29t Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5l dA0KPj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0PiA8bWFpbHRvOmFs ZXhAYm9ib3Rlay5uZXQ+PjsNCj4+Pj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0 bzpzdGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQo+Pj4+Pj4+Pj4+Pj4+ PiAqU3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJUiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gV2VsbCwgdGhlIG1lY2hhbmlzbXMgYXJlIGRl c2lnbmVkIHNvIHRoYXQgdGhleSBjb3VsZCBiZQ0KPj4+Pj4+Pj4+Pj4+Pj4gZGVwbG95ZWQg b24gZGV2aWNlcyBhbmQgUEJYcy4gIFdoZXRoZXIgdGhleSB3aWxsIGJlIGlzIGENCj4+Pj4+ Pj4+Pj4+Pj4+IHBvbGljeSBpc3N1ZS4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ PiBUaGUgbm90aW9uIG9mIGNyZWRlbnRpYWxzIHRoYXQgYXJlIHRyYWNlYWJsZSB0byBhDQo+ Pj4+Pj4+Pj4+Pj4+PiBkZWxlZ2F0aW9uIG9mIGEgVE4gaXMgYSBtZWNoYW5pc20gdGhhdCBp cyBwYXJ0IG9mIHRoZQ0KPj4+Pj4+Pj4+Pj4+Pj4gZGVzaWduIG9mIHN0aXIsIGFuZCB0aGUg ZGVzaWduIGFsbG93cyBkZWxlZ2F0aW9uIG9mIG9uZSBUTg0KPj4+Pj4+Pj4+Pj4+Pj4gKHRv IG9uZSBkZXZpY2UsIGFsdGhvdWdoIGEgZGV2aWNlIGxpa2UgYSBQQlggd291bGQgaGF2ZQ0K Pj4+Pj4+Pj4+Pj4+Pj4gbW9yZSB0aGFuIG9uZSBUTiBwZXIgImRldmljZSIsIGFuZCBzb21l dGhpbmcgbGlrZSBhIGR1YWwNCj4+Pj4+Pj4+Pj4+Pj4+IE5BTSBwaG9uZSBjb3VsZCBoYXZl DQo+Pj4+IG1vcmUNCj4+Pj4+Pj4+Pj4+Pj4+IHRoYW4gb25lIGNyZWRlbnRpYWwuICBGb3Ig dGhlIHVzZSBjYXNlIHdlJ3ZlIGRpc2N1c3NlZCwgYQ0KPj4+Pj4+Pj4+Pj4+Pj4gbW9iaWxl IHBob25lIG1heSBhbHNvIGhhdmUgYSBjcmVkZW50aWFsIGZvciwgc2F5LCBhIFROIHRoYXQN Cj4+Pj4+Pj4+Pj4+Pj4+IGlzIGRlbGVnYXRlZCB0byBhIGxhbmRsaW5lLCB0byBjb3ZlciB0 aGUgZXhhbXBsZSBjYXNlIG9mIGENCj4+Pj4+Pj4+Pj4+Pj4+IGRvY3RvciBwbGFjaW5nIGEg Y2FsbCBvbiBoaXMgbW9iaWxlLCBidXQgZ2V0dGluZyBoaXMgb2ZmaWNlDQo+Pj4+Pj4+Pj4+ Pj4+PiBudW1iZXIgdG8gc2hvdyB1cCBhcyB0aGUgY2FsbGluZyBwYXJ0eS4gIFVzZSBvZiBz dWNoIG1lY2hhbmlzbXMgaXMgcG9saWN5Lg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4+IEJyaWFuDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4+ICBPbiBBdWcgNCwgMjAxNiwgYXQgMjo1MiBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RP XQ0KPj4+Pj4+Pj4+Pj4+Pj4gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0KPj4+PiA8bWFp bHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86 UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4+Pj4+Pj4+Pj4+Pj4+IHdyb3RlOg0KPj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICBUaGFua3MgQnJpYW4uICBJJ20gYWZyYWlk IHdlJ3JlIHN0cmF5aW5nIGludG8gYSBwb2xpY3kNCj4+Pj4+Pj4+Pj4+Pj4+IGRpc2N1c3Np b24uICBSZWdhcmRsZXNzLCBJIGRvIGFwcHJlY2lhdGUgeW91ciBleHBsYW5hdGlvbi4NCj4+ Pj4+Pj4+Pj4+Pj4+IEkgd291bGQgbGlrZSB0byBjb250aW51ZSB0aGUgZGlzY3Vzc2lvbiwg YnV0IEknbSBwcmV0dHkNCj4+Pj4+Pj4+Pj4+Pj4+IHN1cmUgdGhpcyBpc24ndCB0aGUgcmln aHQgZm9ydW0uDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gIFBpZXJjZQ0KPj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAqRnJvbToqIEJyaWFuIFJvc2VuIFttYWls dG86YnJAYnJpYW5yb3Nlbi5uZXRdDQo+Pj4+Pj4+Pj4+Pj4+PiAgKlNlbnQ6KiBBdWd1c3Qg MDQsIDIwMTYgMTozNCBQTQ0KPj4+Pj4+Pj4+Pj4+Pj4gICpUbzoqIEdvcm1hbiwgUGllcmNl IEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0KPj4+Pj4+Pj4+Pj4+Pj4gPG1h aWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+DQo+Pj4+Pj4+Pj4+Pj4+PiA8bWFpbHRv OlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgKkNjOiogQWxl eCBCb2JvdGVrIDxhbGV4QGJvYm90ZWsubmV0DQo+Pj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOmFs ZXhAYm9ib3Rlay5uZXQ+IDxtYWlsdG86YWxleEBib2JvdGVrLm5ldD4+Ow0KPj4+Pj4+Pj4+ Pj4+Pj4gc3RpckBpZXRmLm9yZyA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IDxtYWlsdG86c3Rp ckBpZXRmLm9yZz4NCj4+Pj4+Pj4+Pj4+Pj4+ICAqU3ViamVjdDoqIFJlOiBbc3Rpcl0gU1RJ UiA0NDc0YmlzLTEwIGNvbW1lbnRzDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4g IE9mIGNvdXJzZSBJIHdhbnQgUEJYcyB0byBzaWduIGNhbGxzLiAgQXMgd2VsbCBhcyBzbWFy dA0KPj4+Pj4+Pj4+Pj4+Pj4gcGhvbmVzIGFuZCAgYW55IG90aGVyIGRldmljZXMgdGhhdCBj YW4gYmUgcHJvZ3JhbW1lZCB0byBkbw0KPj4+PiBzby4NCj4+Pj4+Pj4+Pj4+Pj4+ICBUaGV5 IHdpbGwgYmUgZ2l2ZW4gY3JlZGVudGlhbHMgdGhhdCBvbmx5IGFyZSB2YWxpZCBmb3IgdGhl DQo+Pj4+Pj4+Pj4+Pj4+PiBUTnMgdGhleSBhcmUgYXV0aG9yaXplZCB0byBzaWduIGZvci4g IFRoZXkgY2FuIHRyeSB0byBzaWduDQo+Pj4+Pj4+Pj4+Pj4+PiBhbnkgY2FsbCwgIGJ1dCB0 aGUgdmFsaWRpdHkgb2YgdGhlIGNyZWRlbnRpYWwgd291bGQgbWFrZQ0KPj4+Pj4+Pj4+Pj4+ Pj4gc3VjaCBhIHNpZ25hdHVyZSAgZmFpbCB0aGUgY2hlY2tpbmcuDQo+Pj4+Pj4+Pj4+Pj4+ Pg0KPj4+Pj4+Pj4+Pj4+Pj4gIEdldHRpbmcgc2VydmljZSBwcm92aWRlcnMgdG8gc2lnbiBv biBiZWhhbGYgb2YgZGV2aWNlcyBpcw0KPj4+Pj4+Pj4+Pj4+Pj4gYSByZWFzb25hYmxlIHdh eSB0byBkZXBsb3kgcXVpY2tseSwgYnV0IEkgZXhwZWN0IG1hbnkgU1BzDQo+Pj4+Pj4+Pj4+ Pj4+PiB3aWxsIHdhbnQgIHRvIGdldCBvdXQgb2YgdGhlIGxpYWJpbGl0eSBvZiBzaWduaW5n IG9uIGJlaGFsZg0KPj4+Pj4+Pj4+Pj4+Pj4gb2YgdGhlaXIgY3VzdG9tZXJzLiAgSWYgdGhl eSBjYW4gcHVzaCBvZiB0aGF0DQo+Pj4+Pj4+Pj4+Pj4+PiByZXNwb25zaWJpbGl0eSB0byB0 aGVpciBjdXN0b21lciwgb25seSBiZWluZyByZXNwb25zaWJsZQ0KPj4+Pj4+Pj4+Pj4+Pj4g Zm9yIGdldHRpbmcgdGhlIGN1c3RvbWVyIGFuIGFwcHJvcHJpYXRlIGNyZWRlbnRpYWwgd2hl bg0KPj4+Pj4+Pj4+Pj4+Pj4gdGhleSBhc3NpZ24gVE5zLCB0aGVuIEkgd291bGQgZXhwZWN0 ICB0aGVtIHRvIHdhbnQgdG8gZG8NCj4+Pj4+Pj4+Pj4+Pj4+IHNvLiAgVGhhdCBtZWFucyB0 aGUgZGV2aWNlcyBoYXZlIHRvIGJlIGFibGUgdG8gIHNpZ24sIGJ1dCBJDQo+Pj4+Pj4+Pj4+ Pj4+PiB1bmRlcnN0YW5kIG1hbnkgb2YgdGhlIFBCWCB2ZW5kb3JzIHRoaW5rIHRoYXQncyAg c29tZXRoaW5nDQo+Pj4+Pj4+Pj4+Pj4+PiB0aGV5IGNvdWxkIHByb3ZpZGUgaW4gYSBmdXR1 cmUgcmVsZWFzZS4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgQnJpYW4NCj4+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICBPbiBB dWcgNCwgMjAxNiwgYXQgMjoyMiBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4+ Pj4+Pj4+Pj4gICAgICA8UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tDQo+Pj4+Pj4+Pj4+Pj4+ PiA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4+Pj4+Pj4+Pj4+Pj4+IDxt YWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAg d3JvdGU6DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICBZb3Ugd2FudCBJ UCBQQlhlcyB0byBzaWduIGNhbGxzPyAgV29uJ3QgdGhhdCBtYWtlIGl0DQo+Pj4+Pj4+Pj4+ Pj4+PiAgICAgIGV4dHJhb3JkaW5hcmlseSBlYXN5IHRvIGNvbW1pdCBmcmF1ZCB3aXRoDQo+ Pj4+Pj4+Pj4+Pj4+PiBhdXRoZW50aWNhdGVkIG51bWJlcnM/DQo+Pj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgKkZyb206KiBCcmlhbiBSb3Nl biBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0XQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAqU2Vu dDoqIEF1Z3VzdCAwNCwgMjAxNiAxMjoyNCBQTQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAqVG86 KiBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dIDxQaWVyY2UuR29ybWFuQHNwcmludC5jb20NCj4+ Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86UGllcmNlLkdvcm1hbkBzcHJpbnQuY29tPg0KPj4+Pj4+ Pj4+Pj4+Pj4gICAgICA8bWFpbHRvOlBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+DQo+Pj4+ Pj4+Pj4+Pj4+PiAgICAgICpDYzoqIEFsZXggQm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0K Pj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzphbGV4QGJvYm90ZWsubmV0Pg0KPj4+Pj4+Pj4+Pj4+ Pj4gICAgICA8bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+Pjsgc3RpckBpZXRmLm9yZw0KPj4+ Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpzdGlyQGlldGYub3JnPiA8bWFpbHRvOnN0aXJAaWV0Zi5v cmc+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICpTdWJqZWN0OiogUmU6IFtzdGlyXSBTVElSIDQ0 NzRiaXMtMTAgY29tbWVudHMNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAg IEZpcnN0IG9mIGFsbCwgd2Ugd291bGQgd2FudCB0aGUgUEJYIHRvIGdlbmVyYXRlIHRoZQ0K Pj4+Pj4+Pj4+Pj4+Pj4gc2lnbmF0dXJlLA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICBidXQgdGhl IHNlcnZpY2UgcHJvdmlkZXIgY2FuIGRvIHRoYXQuICBJdCBzaG91bGQgbm90IGFkZCBhDQo+ Pj4+Pj4+Pj4+Pj4+PiAgICAgIHZhbGlkIHNpZ25hdHVyZSB0byBhIGNhbGwgZnJvbSBhIG51 bWJlciBpdCBkaWQgbm90DQo+Pj4+Pj4+Pj4+Pj4+PiBhc3NpZ24gdG8NCj4+Pj4+Pj4+Pj4+ Pj4+ICAgICAgdGhlIHRydW5rIGdyb3VwIGNvbm5lY3RpbmcgdG8gdGhlIFBCWCwgYWx0aG91 Z2ggaXQgY291bGQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgc3VwcG9ydCB0aGUgZXh0cmEgZGVs ZWdhdGlvbiByZXF1aXJlZCB0byBzdXBwb3J0DQo+Pj4+Pj4+Pj4+Pj4+PiAiYXV0aG9yaXpl ZA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICBzcG9vZmluZyIuICBUaGUgY29tcGFuaW9uIGRldmlj ZXMgSSdtIGF3YXJlIG9mIGFsd2F5cyBzZW5kDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgIGNhbGxz IGZyb20gdGhlIHNhbWUgc2VydmljZSBwcm92aWRlciBhbmQgc2hvdWxkIG5vdCBwcmVzZW50 DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgIGFueSBpc3N1ZS4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+ Pj4+Pj4+Pj4+PiAgICAgIEV2ZXJ5b25lIHdpbGwgaGF2ZSB0byBkbyB3b3JrIHRoZXkgZG9u J3QgZG8gbm93IHRvDQo+Pj4+Pj4+Pj4+Pj4+PiBpbXBsZW1lbnQNCj4+Pj4+Pj4+Pj4+Pj4+ ICAgICAgc3RvcCBzcG9vZmVkIGNhbGxzLiBUQU5TVEFBRkwNCj4+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+PiAgICAgIEJyaWFuDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIE9uIEF1ZyA0LCAyMDE2LCBhdCAxMjo0MSBQ TSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgPFBp ZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbQ0KPj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpQaWVyY2Uu R29ybWFuQHNwcmludC5jb20+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICA8bWFpbHRvOlBp ZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4+IHdyb3RlOg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgIEZyYXVkIGZyb20gY29tcHJvbWlzZWQgUEJYZXMgaXMgY29t bW9uLiAgQW5kIGV2ZW4NCj4+Pj4+Pj4+Pj4+Pj4+IHdoZXJlIGENCj4+Pj4+Pj4+Pj4+Pj4+ ICAgICAgICAgIFBCWCBpcyBub3QgY29tcHJvbWlzZWQsIGEgY2FycmllciBoYXMgbm8gcHJh Y3RpY2FsDQo+Pj4+Pj4+Pj4+Pj4+PiB3YXkgb2YNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAg IGtub3dpbmcgd2hldGhlciB0aGUgY2FsbGluZyBudW1iZXIgaXMgcHJvcGVybHkgYXNzaWdu ZWQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGFuZCB2YWxpZCBmcm9tIHRoZSBwZXJzcGVj dGl2ZSBvZiB0aGUgRW50ZXJwcmlzZS4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFRoZXJl Zm9yZSwgY2hlY2tpbmcgd2hldGhlciB0aGUgY2FsbGluZyBudW1iZXIgd2FzDQo+Pj4+Pj4+ Pj4+Pj4+ID5mcm9tIGFuDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBhc3NpZ25lZCByYW5n ZSBtaWdodCBiZSBwb3NzaWJsZSAoYW5kIGZyYXVnaHQgd2l0aA0KPj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgYWRtaW5pc3RyYXRpdmUgY2hhbGxlbmdlcyksIGJ1dCBvZiBsaW1pdGVkIHZh bHVlLg0KPj4+Pj4+Pj4+Pj4+Pj4gQW5kIGluDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICB0 aGUgY29uc3VtZXIgbWFya2V0LCB0aGVyZSBhcmUgY2FsbGluZyBwcm9kdWN0cyB3aGljaA0K Pj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc3VwcG9ydCBhIHBhcmVudCBzdWJzY3JpYmVyIG51 bWJlciBhbmQgImNvbXBhbmlvbiINCj4+Pj4+Pj4+Pj4+Pj4+IGRldmljZXMNCj4+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIChlLmcuLCB0YWJsZXRzKSB3aGljaCBjYW4gcGxhY2UgYSBjYWxs IHVzaW5nIHRoZSBNRE4gb2YNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHRoZSBwYXJlbnQg c3Vic2NyaWJlci4gIFRoZXNlIGFyZSBleGFtcGxlcyBvZiB3aGVyZSB0aGUNCj4+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIGF1dGhlbnRpY2l0eSBvZiB0aGUgY2FsbGluZyBudW1iZXIgd29u J3QNCj4+Pj4+Pj4+Pj4+Pj4+IG5lY2Vzc2FyaWx5IG1lYW4NCj4+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgIHRoZSBzYW1lIHRoaW5nIGFzIHRoZSBhdXRoZW50aWNpdHkgb2YgYSBjYWxsIGZy b20NCj4+Pj4+Pj4+Pj4+Pj4+IGEgc2luZ2xlDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBz dWJzY3JpYmVyIHdpdGggYSBzaW5nbGUgTUROIHJlZ2FyZGxlc3Mgb2YgImxheGl0eSIgb2YN Cj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHNwb29mIGNoZWNraW5nLg0KPj4+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIEluIGFub3RoZXIgZm9ydW0gYW5kIGFudGlj aXBhdGluZyBjYWxsaW5nIG51bWJlcg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgYXV0aGVu dGljYXRpb24gbWFuZGF0ZXMgZnJvbSBDb25ncmVzcyBhbmQvb3IgRkNDLCBJDQo+Pj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICBzdWdnZXN0ZWQgdXNpbmcgY2Fycmllci1zcGVjaWZpYyBjZXJ0 cyBhbmQgZW5jb2RpbmcNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHNwZWNpZmljaXR5IG9m IGF1dGhlbnRpY2l0eSwgYW5kIGNhbGxpbmcgbnVtYmVyLiAgVGhpcw0KPj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgcHJvdmlkZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBvcmlnaW5hdGluZyBj YXJyaWVyLCBzb21lDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBpZGVhIGFzIHRvIHRoZSBh Y2N1cmFjeSBvciBzcGVjaWZpY2l0eSBvZiB0aGUgY2FsbGluZw0KPj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgbnVtYmVyLCBhbmQgdmFsaWR0eSBvZiB0aGUgY2FsbGluZyBudW1iZXINCj4+ Pj4+Pj4+Pj4+Pj4+IChhc3N1bWluZyBub25jZQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg YW5kIHJlcGxheSBpc3N1ZXMgY2FuIGJlIGFkZHJlc3NlZCBhcyByZWFzb25hYmx5DQo+Pj4+ Pj4+Pj4+Pj4+PiBzdWdnZXN0ZWQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGJlbG93IGJ5 IEFsZXgpLg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFRoZSBy ZXByZXNlbnRhdGlvbiBvZiBvcmlnLWNhcnJpZXIgYW5kIHRydXN0d29ydGhpbmVzcw0KPj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgY291bGQgYmUgYXMgZm9sbG93czoNCj4+Pj4+Pj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAqUmVndWxhdGVkL21hbmRhdGVkIENhcnJp ZXIgQ2xhc3MgVXNlIENhc2U6Kg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICowMCAtIE5vIENyZWRlbnRpYWxzKg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg VXNlIGNhc2UgZXhhbXBsZShzKTogUHJlLUlNUywgbGVnYWN5IGNpcmN1aXQtc3dpdGNoZWQN Cj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG5ldHdvcmtzIHRoYXQgZG9uJ3QgbmF0aXZlbHkg c3VwcG9ydCBTSVAgb3Igd2hpY2ggZG9uJ3QNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGNo b29zZSB0byBzaWduIGNhbGxzLiAgRS5nLiwgaW50ZXJuYXRpb25hbCBjYXJyaWVycy4NCj4+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFRydXN0IEVzdGltYXRlOiAgR29vZCBsdWNrLiAgQ2Fy cmllcl9vcmlnIGFuZCBDZ1BODQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBlbnRpcmVseSB1 bnRydXN0d29ydGh5Lg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAg ICowMSAtIENhcnJpZXIgc2lnbmVkLCBubyBhdXRoZW50aWNhdGlvbiBvZiBDZ1BOKg0KPj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgVXNlIGNhc2UgZXhhbXBsZShzKTogRTkxMSBvbiB2aXNp dGVkIG5ldHdvcmsgdy9vDQo+Pj4+Pj4+Pj4+Pj4+PiByb2FtaW5nDQo+Pj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICBhZ3JlZW1lbnQsIG1hbnVhbCByb2FtaW5nLg0KPj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgVHJ1c3QgRXN0aW1hdGU6ICBDYXJyaWVyX29yaWcgdHJ1c3R3b3J0aHksIENn UE4NCj4+Pj4+Pj4+Pj4+Pj4+IGVudGlyZWx5DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICB1 bnRydXN0d29ydGh5DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg KjEwIC0gQ2FycmllciBzaWduZWQsIHNlbWktYXV0aGVudGljYXRlZCBDZ1BOKg0KPj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgVXNlIGNhc2UgZXhhbXBsZShzKTogTnVtYmVyIGJsb2NrIGRl bGVnYXRlZCBmcm9tDQo+Pj4+Pj4+Pj4+Pj4+PiBPQ04sIGJ1dA0KPj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgbm8gcGVyLVROIHNjcmVlbiAoU0lQIHRydW5rcykuDQo+Pj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICBUcnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwg Q2dQTg0KPj4+Pj4+Pj4+Pj4+Pj4gbGVzcyB0aGFuDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICBtb3N0IHRydXN0d29ydGh5IGJ1dCBub3QgZW50aXJlbHkgdW50cnVzdHdvcnRoeS4NCj4+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAqMTEgLSBDYXJyaWVyIHNp Z25lZCwgYXV0aGVudGljYXRlZCBDZ1BOKg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgVXNl IGNhc2UgZXhhbXBsZShzKTogQnJlYWQtYW5kLWJ1dHRlciA5NSUrIG9mDQo+Pj4+Pj4+Pj4+ Pj4+PiBjYWxscyBmcm9tDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBzdWJzY3JpYmVyIGxp bmVzIChJTVMtYmFzZWQgYW5kIG90aGVyd2lzZSkuDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICBUcnVzdCBFc3RpbWF0ZTogIENhcnJpZXJfb3JpZyB0cnVzdHdvcnRoeSwgQ2dQTiBtb3N0 DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICB0cnVzdHdvcnRoeQ0KPj4+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpQdWJsaWMgVXNlIENhc2U6Kg0KPj4+Pj4+Pj4+ Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFVuZGVmaW5lZCBidXQgYXNzdW1lZCB0 byB1c2UgcHVibGljIG9yIGNvbW1lcmNpYWxseQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg YXZhaWxhYmxlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2VzIHJlc291cmNlcy4gIGUuZy4sDQo+ Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBub21vcm9iby1saWtlIGNyb3dkLXNvdXJjZWQgYWNj ZXB0L2RlbnkgbGlzdHMsIGV0DQo+Pj4+Pj4+Pj4+Pj4+PiBjZXRlcmEuDQo+Pj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICBDb3VsZC93b3VsZCBwYXNzIGNyZWRlbnRpYWxzIGRvd24gdG8gU0lQ LWF3YXJlIGRldmljZXMNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIHdoaWNoIHdvdWxkIHBy b2Nlc3MgdGhlbSBhY2NvcmRpbmcgdG8gdGhlIHJ1bGVzIG9mIHRoZQ0KPj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgUHVibGljIENsYXNzIGFwcGxpY2F0aW9uKHMpLg0KPj4+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIFBpZXJjZQ0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpGcm9tOiogQnJpYW4gUm9zZW4gW21haWx0bzpickBi cmlhbnJvc2VuLm5ldF0NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpTZW50OiogQXVndXN0 IDA0LCAyMDE2IDk6MDIgQU0NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpUbzoqIEFsZXgg Qm9ib3RlayA8YWxleEBib2JvdGVrLm5ldA0KPj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzphbGV4 QGJvYm90ZWsubmV0Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgPG1haWx0bzphbGV4QGJv Ym90ZWsubmV0Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICpDYzoqIHN0aXJAaWV0Zi5v cmcgPG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+Pj4gPG1haWx0bzpzdGly QGlldGYub3JnPg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgKlN1YmplY3Q6KiBSZTogW3N0 aXJdIFNUSVIgNDQ3NGJpcy0xMCBjb21tZW50cw0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIFRoZXJlIGFyZSByZWFzb25hYmxlIGNpcmN1bXN0YW5jZXMgd2hl cmUgYSBwYXJ0eQ0KPj4+Pj4+Pj4+Pj4+Pj4gcGxhY2luZyBhDQo+Pj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICBjYWxsIGlzIG5vdCB0aGUgYXV0aG9yaXplZCBlbnRpdHkgYXNzaWduZWQgdGhl DQo+Pj4+Pj4+Pj4+Pj4+PiB0ZWxlcGhvbmUNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG51 bWJlciB1c2VkIGluIEZyb20vUEFJLCBhbmQgaW4gc3VjaCBjaXJjdW1zdGFuY2VzIHRoZQ0K Pj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgc2VydmljZSBwcm92aWRlciBzZXJ2aWNpbmcgdGhl IGVudGl0eSBwbGFjaW5nIHRoZQ0KPj4+Pj4+Pj4+Pj4+Pj4gY2FsbCBtYXkNCj4+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIG9yIG1heSBub3QgYmUgdGhlIHNhbWUgYXMgdGhlIHNlcnZpY2Ug cHJvdmlkZXINCj4+Pj4+Pj4+Pj4+Pj4+IHNlcnZpbmcgdGhlDQo+Pj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICBlbnRpdHkgdGhhdCBpcyBhc3NpZ25lZCB0aGUgVE4uICBJbiBhbGwgc3VjaCBj YXNlcywgdGhlDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBlbnRpdHkgdGhhdCBpcyBhc3Np Z25lZCB0aGUgVE4gZXhwbGljaXRseQ0KPj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXplcyBjYWxs cw0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgcGxhY2VkIHVzaW5nIGl0J3MgVE4uICBUaGUg ZGVzaWduIGFjY29tbW9kYXRlcyBzdWNoIHVzZQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg Y2FzZXMuICBJdCdzIG5vdCBhIGJsYW5rZXQgYXV0aG9yaXphdGlvbiB3aXRob3V0DQo+Pj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICBhdXRoZW50aWNhdGlvbi4gICBXZSdyZSBub3QgYXdhcmUg b2YgYW55IGNhc2VzIHdoZXJlDQo+Pj4+Pj4+Pj4+Pj4+PiB0aGVyZQ0KPj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgaXMgYW4gYWN0dWFsIHJlcXVpcmVtZW50IGZvciBsZWdpdGltYXRlIGNh bGxpbmcgd2l0aG91dA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgZXhwbGljaXQgYXV0aG9y aXphdGlvbiBmcm9tIHRoZSBhc3NpZ25lZCBlbnRpdHksDQo+Pj4+Pj4+Pj4+Pj4+PiBhbHRo b3VnaA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgd2UgY2VydGFpbmx5IGFyZSBhd2FyZSB0 aGF0IHZhcmlvdXMgcGFydHMgb2YgdmFyaW91cw0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAg c2VydmljZSBwcm92aWRlcnMgZG9uJ3QgYm90aGVyIHRvIGNoZWNrLiBBdCB0aGlzDQo+Pj4+ Pj4+Pj4+Pj4+PiBwb2ludCwgYXQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIGxlYXN0IGlu IHNvbWUgY291bnRyaWVzLCB0aGVyZSBpcyBhIHJlYWxpemF0aW9uDQo+Pj4+Pj4+Pj4+Pj4+ PiB0aGF0IHRoZQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgbGF4aXR5IG9mIGFsbG93aW5n IHVuY2hlY2tlZCBzcG9vZmluZyBpcyBub3QgYWNjZXB0YWJsZQ0KPj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgYW55IG1vcmUuDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgQnJpYW4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgIE9uIEF1ZyAzLCAyMDE2LCBhdCA4OjM1IEFNLCBBbGV4IEJv Ym90ZWsNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICA8YWxleEBib2JvdGVrLm5ldCA8 bWFpbHRvOmFsZXhAYm9ib3Rlay5uZXQ+DQo+Pj4+Pj4+Pj4+Pj4+PiA8bWFpbHRvOmFsZXhA Ym9ib3Rlay5uZXQ+PiB3cm90ZToNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgMS4gICAgICAgUGVybWl0IGF1dGhvcml6YXRpb24gd2l0aG91dA0KPj4+ Pj4+Pj4+Pj4+Pj4gYXV0aGVudGljYXRpb24NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAg ICBJbiB0aGUgY3VycmVudCB0ZWxlcGhvbnkgbmV0d29yayBwcmFjdGljZSwgc29tZQ0KPj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHNlcnZpY2UgcHJvdmlkZXIgaW1wbGVtZW50YXRp b25zIGNob29zZSBub3QgdG8NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBhdXRoZW50 aWNhdGUgaWRlbnRpdHksIGJ1dCBzaW1wbHkgZmFjaWxpdGF0ZQ0KPj4+Pj4+Pj4+Pj4+Pj4g dGhlIHVzZQ0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIG9mIGFuIGFyYml0cmFyeSBv ciBzZWxlY3RlZCB1c2VyLXByb3ZpZGVkIGlkZW50aXR5Lg0KPj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgIEFyZSB0aGVyZSBsZWdpdGltYXRlIHVzZSBjYXNlcyBmb3IgdGhpcz8gIEhh cw0KPj4+Pj4+Pj4+Pj4+Pj4gYW55b25lDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg ZXN0YWJsaXNoZWQgdGhhdCB0aGVyZSBhcmUgbm90PyAgSG93IGNhbiB0aGUNCj4+Pj4+Pj4+ Pj4+Pj4+IGluZHVzdHJ5DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgcmVhc29uYWJs eSBleHBlY3QgdG8gZW5kIHRoaXMgKG9mdGVuIGJhZCkgcHJhY3RpY2U/DQo+Pj4+Pj4+Pj4+ Pj4+PiAgICAgICAgICAgICAgSWYgaXQgY2FuJ3QgYmUgZW5kZWQsIHRoZXJlJ3MgdmFsdWUg aW4gYXQgbGVhc3QNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBpZGVudGlmeWluZyB0 aGUgb3JpZ2luYXRpbmcgc2VydmljZSBwcm92aWRlcg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAg ICAgICAgIChpLmUuLCB0aGUgc2lnbmVyL2F1dGhvcml6ZXIpLiAgR2l2ZW4gdGhlDQo+Pj4+ Pj4+Pj4+Pj4+PiBwcmV2YWxlbmNlDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgb2Yg YWJ1c2UgdXNpbmcgdGVsZXBob25lIG51bWJlcnMgYXNzaWduZWQgdG8gYQ0KPj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgIHNvbWV0aW1lcy1hbm9ueW1vdXMgYWJ1c2VyLCBpdCBiZWNv bWVzIGNyaXRpY2FsbHkNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBpbXBvcnRhbnQg dG8gaWRlbnRpZnkgdGhlIHNlcnZpY2UgcHJvdmlkZXIocykNCj4+Pj4+Pj4+Pj4+Pj4+IGNs b3Nlc3QNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0byB0aGUgYWJ1c2VyLiAgQmFz ZWQgb24gdGhlIGFzc3VtcHRpb24gdGhhdCBpdCdzDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgYmV0dGVyIHRvIElEIHNlcnZpY2UgcHJvdmlkZXJzIHRoYW4gdW5yZWFzb25hYmx5 DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgZXhwZWN0IGEgYmFuIG9mIHRoZSB1c2Ug b2YgdW5hdXRoZW50aWNhdGVkIChhbmQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0 aGVyZWZvcmUgdW5zaWduZWQpIFNJUCByZXF1ZXN0cywgU1RJUiBzaWduaW5nDQo+Pj4+Pj4+ Pj4+Pj4+PiBzaG91bGQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzdXBwb3J0IGF1 dGhvcml6YXRpb24gd2l0aG91dCBhdXRoZW50aWNhdGlvbi4gIFRoZQ0KPj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgICAgIHByYWN0aWNlIG9mIGF1dGhvcml6aW5nIHVuYXV0aGVudGljYXRl ZCB1c2UgZXhpc3RzLA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGFuZCB0aGVyZSBp cyBiZW5lZml0IHRvIHNpZ25pbmcgaW4gdGhlc2UgY2FzZXMNCj4+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICAoc2VydmljZSBwcm92aWRlciBpZGVudGlmaWNhdGlvbikuICBUaGUgbGFu Z3VhZ2Ugb2YNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB0aGUgSUQgc2hvdWxkIHBl cm1pdCB0aGlzIHVzZS4gIDQ0NzRiaXMtMTANCj4+Pj4+Pj4+Pj4+Pj4+IHNob3VsZCBOT1QN Cj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICByZXF1aXJlIG9yIGFzc3VtZSB0aGF0ICB0 aGF0IGF1dGhlbnRpY2F0aW9uIHdpbGwNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBw cmVjZWRlIGF1dGhvcml6YXRpb24uIE9mIGNvdXJzZSB0aGVyZSBtYXkgYmUgb3RoZXINCj4+ Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICB1c2UgY2FzZXMgd2hlcmUgc2lnbmluZyBpbmNs dWRlcyBhdXRoZW50aWNhdGlvbiBhbmQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBt YXkgbm90IGluY2x1ZGUgYSBzcGVjaWZpYyBzZXJ2aWNlIHByb3ZpZGVyJ3MNCj4+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgICAgICBhdXRob3JpemF0aW9uLg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgMi4gICAgICAgSW1w cm92ZSByZXBsYXkgcHJldmVudGlvbg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFBy b3hpbWF0ZSByZXBsYXkgaXMgcG9zc2libGUgd2hpbGUgY29tcGx5aW5nDQo+Pj4+Pj4+Pj4+ Pj4+PiB3aXRoIHRoaXMNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzcGVjLiAgRmly c3QsIG9uZSBvciBtb3JlIHByb3hpbWF0ZSAoZS5nLiwNCj4+Pj4+Pj4+Pj4+Pj4+IHdpdGhp bg0KPj4+Pj4+Pj4+Pj4+Pj4gNjANCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzZWNv bmRzKSBTSVAgcmVxdWVzdHMgdXNpbmcgdGhlIHNhbWUgdG9rZW4gYXJlDQo+Pj4+Pj4+Pj4+ Pj4+PiBsZWdhbA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGFuZCBzdWJqZWN0IHRv IHJlcGxheSBpbiBtYW55IGNhc2VzLiAgQW4gU0RQIGJvZHkncw0KPj4+Pj4+Pj4+Pj4+Pj4g ICAgICAgICAgICAgIG1reSBtYXkgbm90IGJlIHByZXNlbnQgYW5kIGlmIHByZXNlbnQgaXRz IHVzZSBpcw0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIG9wdGlvbmFsLiAgU29tZSBz b3J0IG9mIG1hbmRhdG9yeSBuZXcgb3IgZXhpc3RpbmcNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICAgICBzaWduZWQgc2VxdWVuY2UsIHJhbmRvbSAjIG9yIHJlcXVlc3QgSUQgKGUuZy4s DQo+Pj4+Pj4+Pj4+Pj4+PiBDYWxsLUlEDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg b3IgQ1NlcSkgYW5kIGEgMS10aW1lIHVzZSBwb2xpY3kgb24gdGhlDQo+Pj4+Pj4+Pj4+Pj4+ PiByZWNlaXZpbmcgZW5kDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgb2YgdGhlIHJl cXVlc3QgKGUuZy4sIHRva2VucyBvbmx5IGdvb2QgZm9yIDENCj4+Pj4+Pj4+Pj4+Pj4+ICAg ICAgICAgICAgICB1c2UpIGNvdWxkIHByZXZlbnQgcmVwbGF5LiAgRGlmZmVyZW50IG1ldGhv ZHMNCj4+Pj4+Pj4+Pj4+Pj4+IChlLmcuLA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg IElOVklURSB2cyBNRVNTQUdFKSBtaWdodCBiZSBoYW5kbGVkIGJ5IGRpZmZlcmVudA0KPj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHJlY2VpdmluZyBpbmZyYXN0cnVjdHVyZSwgYW5k IHRoZXJlZm9yZQ0KPj4+Pj4+Pj4+Pj4+Pj4gZGlmZmljdWx0aWVzDQo+Pj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICAgICAgd2l0aCAnaXQncyBiZWVuIHVzZWQgYWxyZWFkeScgY29vcmRpbmF0 aW9uIGFsbG93IGENCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBmYWtlZCBNRVNTQUdF IGJhc2VkIG9uIGEgY2FwdHVyZWQgcmVxdWVzdC4NCj4+Pj4+Pj4+Pj4+Pj4+IFRoaXMgbWln aHQNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBpbmNsdWRlIGFuIG1rZXkgZnJvbSBh IGNhcHR1cmVkIElOVklURS4gICBTbyBpdA0KPj4+Pj4+Pj4+Pj4+Pj4gbWF5IGJlDQo+Pj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgcG9zc2libGUgdG8gRE9TLCBzcGFtIG9yIHRleHQt Ym9tYiBhIHJlY2lwaWVudA0KPj4+Pj4+Pj4+Pj4+Pj4gdXNpbmcgYQ0KPj4+Pj4+Pj4+Pj4+ Pj4gICAgICAgICAgICAgIGNhcHR1cmVkIGlkZW50aXR5LiAgV2hpbGUgbGFyZ2Utc2NhbGUg b3INCj4+Pj4+Pj4+Pj4+Pj4+IGRpc3RyaWJ1dGVkDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgaW1wbGVtZW50YXRpb25zIG1heSBtYWtlIHRoZSBlbmZvcmNlbWVudCBkaWZmaWN1 bHQsDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgdGhlcmUgaXMgbGl0dGxlIGNvc3Qg dG8gc2lnbmluZyBhbmQgZGVjb2RpbmcgYQ0KPj4+Pj4+Pj4+Pj4+Pj4gbWV0aG9kDQo+Pj4+ Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgYW5kIHBvc3NpYmx5IGEgbnVtZXJpYyBJRC4gICBT b21lIHNvcnQgb2YgJzEtdXNlJw0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHByYWN0 aWNlIHNob3VsZCBhdCBsZWFzdCBiZSBkaXNjdXNzZWQgd2hpbGUgcGVyaGFwcw0KPj4+Pj4+ Pj4+Pj4+Pj4gICAgICAgICAgICAgIG5vdCByZXF1aXJlZC4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFNwZWNpZmljIG1h cmt1cCBzdWdnZXN0aW9uczoNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+ Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIE5JVFMNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIFRoZSB2ZXJpZmllciBN VVNUIGluc3BlY3QgYW55IG9wdGlvbmFsICJwcHQiDQo+Pj4+Pj4+Pj4+Pj4+PiBwYXJhbWV0 ZXIgYXBwZWFyaW5nICppbip0aGUNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgICAgSWRlbnRpdHkgcmVxdWVzdC4gIElmIG5vICJwcHQiIHBhcmFtZXRl ciBpcw0KPj4+Pj4+Pj4+Pj4+Pj4gcHJlc2VudCwgdGhlbiB0aGUNCj4+Pj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgdmVyaWZpZXIgcHJvY2VlZHMgbm9y bWFsbHkgYmVsb3cuICBJZiBhICJwcHQiDQo+Pj4+Pj4+Pj4+Pj4+PiBwYXJhbWV0ZXIgdmFs dWUgaXMNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAg cHJlc2VudCwgYW5kIHRoZSB2ZXJpZmllciBkb2VzIG5vdCBzdXBwb3J0DQo+Pj4+Pj4+Pj4+ Pj4+PiBpdCwgaXQgTVVTVCBpZ25vcmUgdGhlDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgICAgIElkZW50aXR5IGhlYWRlci4gIElmIGEgc3VwcG9ydGVk ICJwcHQiDQo+Pj4+Pj4+Pj4+Pj4+PiBwYXJhbWV0ZXIgdmFsdWUgaXMgcHJlc2VudCwNCj4+ Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgdGhlIHZlcmlm aWVyIGZvbGxvd3MgdGhlIHByb2NlZHVyZXMgYmVsb3csDQo+Pj4+Pj4+Pj4+Pj4+PiBpbmNs dWRpbmcgdGhlIHZhcmlhdGlvbnMNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICAgICAgICAgZGVzY3JpYmVkIGluIFN0ZXAgNS4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+ Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+ Pj4+Pj4+PiAgICAgICAgICAgICAgICAgIDMNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+ Pj4+PiA8ZmlsZTovLy9DOi9Vc2Vycy9hYjM3NzgvRG9jdW1lbnRzL0lFVEYvZHJhZnQtaWV0 Zi1zdGlyLXJmYw0KPj4+Pj4+Pj4+Pj4+Pj4gNDQ3DQo+Pj4+Pj4+Pj4+Pj4+PiA0YmkNCj4+ Pj4+Pj4+Pj4+Pj4+IHMtMTAlMjAtDQo+Pj4+ICUyMEF1dGhlbnRpY2F0ZWQlMjBJZGVudGl0 eSUyME1hbmFnZW1lbnQlMjBpbiUyMHRoZSUyMA0KPj4+Pj4+Pj4+Pj4+Pj4gU2VzIHNpb24l MjBJbml0aWF0aW9uJTIwUHJvdG9jb2wlMjAlMjhTSVAlMjkuaHRtI3NlY3Rpb24tDQo+Pj4+ IDM+Lg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgICBCYWNrZ3JvdW5kDQo+Pj4+ Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIFsuLi5dDQo+Pj4+Pj4+ Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ PiAgICAgICAgICAgICAgICAgUGVyIFtSRkM3MzQwDQo+Pj4+Pj4+Pj4+Pj4+PiA8aHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzczNDA+XSwgcHJvYmxlbXMgc3VjaCBhcw0KPj4+ Pj4+Pj4+Pj4+Pj4gcm9ib2NhbGxpbmcsIHZvaWNlbWFpbCBoYWNraW5nLCBhbmQNCj4+Pj4+ Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgc3dhdHRpbmcgYXJl IGVuYWJsZWQgYnkgYW4gYXR0YWNrZXIncw0KPj4+Pj4+Pj4+Pj4+Pj4gYWJpbGl0eSB0byBp bXBlcnNvbmF0ZSBzb21lb25lDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAg ICAgICAgICAgICAgIGVsc2UuICBUaGUgc2VjdXJlIG9wZXJhdGlvbiBvZiBtb3N0IFNJUA0K Pj4+Pj4+Pj4+Pj4+Pj4gYXBwbGljYXRpb25zIGFuZCBzZXJ2aWNlcw0KPj4+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBkZXBlbmRzIG9uIGF1dGhlbnRp Y2F0aW5nIGFuZC9vcg0KPj4+Pj4+Pj4+Pj4+Pj4gYXV0aG9yaXppbmcgdGhlIHNvdXJjZSBv ZiBjb21tdW5pY2F0aW9ucyBhcyBpdCBpcw0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+ Pj4+ICAgICAgICAgICAgICAgICByZXByZXNlbnRlZCBpbiBhIFNJUCByZXF1ZXN0Lg0KPj4+ Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+ Pj4+Pj4gICAgICAgICAgICAgICAgIFRoaXMgaWRlbnRpdHkgYXJjaGl0ZWN0dXJlIGZvciBT SVAgZGVwZW5kcw0KPj4+Pj4+Pj4+Pj4+Pj4gb24gaW5jbHVkZXMgcHJvdmlzaW9ucyBmb3Ig YSBsb2dpY2FsDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAg ICAgICJhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIiB3aGljaCB2YWxpZGF0ZXMNCj4+Pj4+Pj4+ Pj4+Pj4+IGNhbGxlciBpZGVudGl0eSBhdCBvciBuZWFyIG9yaWdpbmF0aW9uLiAgb3V0Z29p bmcNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICByZXF1ZXN0cy4gIEFuDQo+Pj4+Pj4+ Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAgIGF1dGhlbnRpY2F0aW9u IHNlcnZpY2UgbWF5IGJlIGltcGxlbWVudGVkDQo+Pj4+Pj4+Pj4+Pj4+PiBlaXRoZXIgYXMg cGFydCBvZiBhIHVzZXINCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgICAgYWdlbnQgb3IgYXMgYSBwcm94eSBzZXJ2ZXI7IHR5cGljYWxseSwgaXQNCj4+ Pj4+Pj4+Pj4+Pj4+IGlzIGEgY29tcG9uZW50IG9mIGEgbmV0d29yaw0KPj4+Pj4+Pj4+Pj4+ Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBpbnRlcm1lZGlhcnkgbGlrZSBh IHByb3h5IHRvIHdoaWNoDQo+Pj4+Pj4+Pj4+Pj4+PiBvcmlnaW5hdGluZyB1c2VyIGFnZW50 cyBzZW5kDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAg IHVuc2lnbmVkIHJlcXVlc3RzLiAgT25jZSB0aGUgc2VuZGVyIG9mIHRoZQ0KPj4+Pj4+Pj4+ Pj4+Pj4gbWVzc2FnZSBoYXMgYmVlbg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgICAgICAgICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIG1lYW5zIG9mIHNoYXJpbmcN Cj4+Pj4+Pj4+Pj4+Pj4+IGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2UNCj4+Pj4+Pj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgb2YgYXV0aGVudGljaXR5IG9m IGFuZC9vciBhdXRob3JpemF0aW9uIHRvDQo+Pj4+Pj4+Pj4+Pj4+PiB1c2UgZW5kLXVzZXIg U0lQIGlkZW50aXR5IGluIGFuIGludGVyZG9tYWluIG9yIGludHJhZG9tYWluDQo+Pj4+IGNv bnRleHQuDQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgICAg IEl0IHJlbGllcyBvbiB0aGUgYXV0aGVudGljYXRpb24gc2VydmljZQ0KPj4+Pj4+Pj4+Pj4+ Pj4gY29uc3RydWN0aW5nIHRva2VucyBiYXNlZCBvbiBbLi4uXQ0KPj4+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgICAgVG8gbWF4aW1pemUg ZW5kLXRvLWVuZCBzZWN1cml0eSwgaXQgaXMNCj4+Pj4+Pj4+Pj4+Pj4+IHR5cGljYWxseSBv YnZpb3VzbHkNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAg ICAgcHJlZmVyYWJsZSBmb3IgZW5kLXVzZXJzIHRvIGFjcXVpcmUgdGhlaXINCj4+Pj4+Pj4+ Pj4+Pj4+IG93biBjcmVkZW50aWFsczsgaWYgdGhleQ0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+ Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBkbywgdGhlaXIgdXNlciBhZ2VudHMgY2FuIGFj dCBhcw0KPj4+Pj4+Pj4+Pj4+Pj4gYXV0aGVudGljYXRpb24gc2VydmljZXMuICBIb3dldmVy LA0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICAgICBmb3Ig c29tZSBkZXBsb3ltZW50cywgWy4uLl0NCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+ Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBSZWdhcmRz LA0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBBbGV4DQo+ Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICAgICAgKiAqDQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAg ICAgICAgKkFsZXggQm9ib3RlayoNCj4+Pj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+Pg0K Pj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgICAgICBzdGlyIG1haWxp bmcgbGlzdA0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIHN0aXJAaWV0Zi5vcmcNCj4+ Pj4+Pj4+Pj4+Pj4+IDxtYWlsdG86c3RpckBpZXRmLm9yZz4gPG1haWx0bzpzdGlyQGlldGYu b3JnPg0KPj4+Pj4+Pj4+Pj4+Pj4gICAgICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+ DQo+Pj4+Pj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4+IC0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t DQo+Pj4+Pj4+Pj4+Pj4+PiAtLQ0KPj4+Pj4+Pj4+Pj4+Pj4gLQ0KPj4+Pj4+Pj4+Pj4+Pj4g LQ0KPj4+Pj4+Pj4+Pj4+Pj4gLS0NCj4+Pj4+Pj4+Pj4+Pj4+IC0tLS0tLS0NCj4+Pj4+Pj4+ Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4+PiAgICAgICAgICBUaGlzIGUtbWFpbCBtYXkgY29udGFp biBTcHJpbnQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24NCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAg ICAgIGludGVuZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55 DQo+Pj4+Pj4+Pj4+Pj4+PiB1c2UgYnkNCj4+Pj4+Pj4+Pj4+Pj4+ICAgICAgICAgIG90aGVy cyBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQNCj4+Pj4+Pj4+ Pj4+Pj4+ICAgICAgICAgIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBh bmQgZGVsZXRlDQo+Pj4+Pj4+Pj4+Pj4+PiBhbGwgY29waWVzDQo+Pj4+Pj4+Pj4+Pj4+PiAg ICAgICAgICBvZiB0aGUgbWVzc2FnZS4NCj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4N Cj4+Pj4+Pj4+Pj4+Pj4NCj4+Pj4+Pj4+Pj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+Pj4+Pj4gc3RpciBtYWlsaW5nIGxp c3QNCj4+Pj4+Pj4+Pj4+Pj4gc3RpckBpZXRmLm9yZyA8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+ DQo+Pj4+Pj4+Pj4+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3Rpcg0KPj4+Pj4+Pj4+Pj4+DQo+Pj4+Pj4+Pj4+Pj4gX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+Pj4+PiBzdGlyIG1haWxpbmcg bGlzdA0KPj4+Pj4+Pj4+Pj4+IHN0aXJAaWV0Zi5vcmcgPG1haWx0bzpzdGlyQGlldGYub3Jn Pg0KPj4+Pj4+Pj4+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3Rpcg0KPj4+Pj4+Pj4+Pg0KPj4+Pj4+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KPj4+Pj4+Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0K Pj4+Pj4+Pj4+PiBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+Pj4+IGh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+Pj4+Pj4NCj4+Pj4+Pj4+ICAgIF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4+Pj4+PiAg ICBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+Pj4gICAgc3RpckBpZXRmLm9yZw0KPj4+Pj4+ Pj4gICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+Pj4+ Pj4+Pg0KPj4+Pj4+Pj4gICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCj4+Pj4+Pj4+ICAgIHN0aXIgbWFpbGluZyBsaXN0DQo+Pj4+Pj4+PiAg ICBzdGlyQGlldGYub3JnDQo+Pj4+Pj4+PiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+Pj4+DQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4NCj4+Pj4+ Pj4+DQo+Pj4+Pj4+Pg0KPj4+Pj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCj4+Pj4+Pj4+DQo+Pj4+Pj4+PiBUaGlzIGUtbWFpbCBtYXkgY29udGFpbiBTcHJpbnQg cHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gaW50ZW5kZWQNCj4+Pj4+Pj4+IGZvciB0aGUgc29s ZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55IHVzZSBieSBvdGhlcnMgaXMgcHJvaGli aXRlZC4NCj4+Pj4+Pj4+IElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQs IHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXINCj4+Pj4+Pj4+IGFuZCBkZWxldGUgYWxsIGNv cGllcyBvZiB0aGUgbWVzc2FnZS4NCj4+Pj4+Pj4NCj4+Pj4+Pj4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4gc3RpciBtYWlsaW5n IGxpc3QNCj4+Pj4+Pj4gc3RpckBpZXRmLm9yZw0KPj4+Pj4+PiBodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+Pg0KPj4+Pj4+DQo+Pj4+Pj4gX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+PiBz dGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4+IHN0aXJAaWV0Zi5vcmcNCj4+Pj4+PiBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4+Pj4+Pg0KPj4+Pj4NCj4+ Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ Pj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+Pj4gc3RpckBpZXRmLm9yZw0KPj4+Pj4gaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+Pj4+DQo+Pj4+DQo+ Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ Pj4+IHN0aXIgbWFpbGluZyBsaXN0DQo+Pj4+IHN0aXJAaWV0Zi5vcmcNCj4+Pj4gaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQo+Pj4NCj4+DQo+Pg0KPj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+DQo+PiBUaGlzIGUtbWFpbCBt YXkgY29udGFpbiBTcHJpbnQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gaW50ZW5kZWQgZm9y IHRoZSBzb2xlIHVzZSBvZiB0aGUgcmVjaXBpZW50KHMpLiBBbnkgdXNlIGJ5IG90aGVycyBp cyBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBw bGVhc2UgY29udGFjdCB0aGUgc2VuZGVyIGFuZCBkZWxldGUgYWxsIGNvcGllcyBvZiB0aGUg bWVzc2FnZS4NCj4+DQo+DQo+DQoNCg== From nobody Tue Aug 9 13:07:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E460712D7FB for ; Tue, 9 Aug 2016 13:07:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yngt_ZqLq6UV for ; Tue, 9 Aug 2016 13:07:25 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 9E89012D7EE for ; Tue, 9 Aug 2016 13:07:25 -0700 (PDT) Received: (qmail 25321 invoked by uid 0); 9 Aug 2016 20:07:25 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy2.mail.unifiedlayer.com with SMTP; 9 Aug 2016 20:07:25 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id V82N1t00b1MNPNq0182RHa; Tue, 09 Aug 2016 14:02:25 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=Q0f3NKQWUI96QroxOPcA:9 a=bEMFIiwXZkFhgkXT:21 a=uDCuZ7v6CasGO0pa:21 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=eMHREqPpWv6l1jXI0ARtDnhGFTS6gHXJHF3aPplX4Kg=; b=XtoxK3I6PBD2HOVGUxahdvCg25 pETyQyx20uPxildT2QsI+bl1sqfKiwy9U/Ufo5T4/kH9xTmj9JwjU7qg84tJnaDQhVD0OuJj4kUk2 Nbn9D6fWiJDapV2OcEPylrovX; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:53865 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bXDEE-0004Fd-PH; Tue, 09 Aug 2016 14:02:22 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Tue, 09 Aug 2016 16:02:20 -0400 From: Richard Shockey To: , "stir@ietf.org" Message-ID: Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> In-Reply-To: <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bXDEE-0004Fd-PH X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:53865 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 20:07:28 -0000 Well let me take this opportunity to totally reject Dave=E2=80=99s comments and t= he implication that we have not followed proper IETF process and procedures. To make myself clear. One, I support the continuing last call on these documents. I believe that = these documents and the underlying protocols described are =E2=80=9Cfit for purpos= e=E2=80=9D and in fact provide a valuable solution the problems described in the c= harter. In addition, it is manifestly self-evident that the underlying JWT = based passport structure is a valuable tool to describe and validate other =E2= =80=9Cclaims=E2=80=9D that may be relevant in the future. Purportedly we develop tool= s around here and not single purpose constructs. The 4474bis concept is a m= uch more extensible and economically viable protocol than the other alternat= ives such as issuing a 509 for every TN on the planet. Not going to happen. = The initial problem in SIP are claims surrounding E 164 caller ID. That the= authors envision validating claims using other real time communications nam= ing constructs, like WEBRTC is all well and good and we certainly expect to = see more documentation on that in the future. Second. My issue with the documents, is overall text clarity and lack of im= plementable examples to enable the supplier community to establish commercia= lly viable roadmaps based on the eventual requirements flowing out of the se= rvice provider community. Where do you put the claims in the INVITE guys???= ? There are endless political policy issues that have to be resolved but th= ey will not, nor will they ever be solved in the IETF. If you hate Telepho= ny SP=E2=80=99s fine, its really easy to demonize them. Done all the time. But t= o get this thing off the ground we have to start somewhere and that means th= e circle of trust has to begin with the circle of authority and the delegati= on model here in every know nation state is virtually the same. The authorit= y over the numbering plan and the integrity of the numbering plan is a natio= n state issue. =20 If these are your real concerns you are welcome to join some of us in DC, L= ondon, Ottawa and other pleasant HQ=E2=80=99s for NRA=E2=80=99s. Write your congresscri= tter, MP whatever. If you want to go see the FCC btw send me a private note= . The staff on 12th street here in DC are very very nice people and are quit= e happy to take technically informed meetings. I can even tell you how to f= ile an ex parte record of the meeting etc.=20 Third, Dave=E2=80=99s objections here are fundamental. He is rejecting the entire= JWT construct in 4474bis that has been put forward. It is almost inconceiv= able to me that at this late stage he is essentially asking us to issue a =E2=80= =98full stop=E2=80=9D and start over in favor of DKIM based construct or whatever. = That is unacceptable. NO. NO WAY. We have no ID or anything before us to c= ompare the merits of a DKIM approach to the one the consensus of the WG has = chosen to adopt. Spitballs from the peanut gallery do not count. Write a d= raft Dave. =20 Now I=E2=80=99ll let you return to your regularly scheduled programming.=20 On 8/9/16, 10:12 AM, "stir on behalf of Dave Crocker" wrote: On 8/9/2016 6:52 AM, Peterson, Jon wrote: > and I promise that Chris and I will go through and implement > them where appropriate. =20 =20 This is the nugget of the process problem I was anticipating and seekin= g=20 to resolve: =20 This is a working group, not a cheerleading section for some=20 authors. In the IETF work is supposed to reflect the understanding and= =20 agreement of the working group. The nature and extent of the problems=20 I'm seeing with these documents suggests a significant lack of that=20 shared effort. =20 In some cases, a document really comes from and remains primarily=20 the souls of the authors and the wg simply provides a surrounding sanit= y=20 check. That's fine, when the sanity check is meaningful. But these=20 documents don't have that kind of history or nature. =20 A process in which the authors take extensive comments and go into = a=20 back room and decide on their own what to do with them is a deviation=20 from the pure IETF model. It is supported as an IETF process efficienc= y=20 hack only when there is rock solid working group synchronicity with the= =20 authors. Based on the nature and extent of the problems I'm seeing wit= h=20 these documents, that synchronicity is lacking. =20 =20 =20 In sum: The reviews I am doing are noting many and serious problems.=20 They need working group discussion, not back-room author filtering, wit= h=20 selective public comments by the authors. =20 =20 =20 d/ =20 --=20 =20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Tue Aug 9 13:17:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F1AB12D85B for ; Tue, 9 Aug 2016 13:17:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id my23xqicVC67 for ; Tue, 9 Aug 2016 13:17:08 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B33CE12D54C for ; Tue, 9 Aug 2016 13:17:08 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79KHB8Z024122 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 9 Aug 2016 13:17:11 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470773831; bh=dI30+aeY5SrdEIwfFk0znpxt5+jYrSO0VVD2gt4biL8=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=izEMxHBu/JKTKkqH5gYnoTIEEMSvGji7snK+WlnGlTMT1E2bpCSkO0FwIp3zMj8Ck oQ30q3Y47KAP4mG+xUPPSENVjCz0lAZeKIZ5cSgobv1ymSmMzKgJtgJb9nuisoUG5M dxxBiosqZyFUCyZOiaGKe/zkw4KNsALNYFZhnHlQ= To: Richard Shockey , "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Tue, 9 Aug 2016 13:16:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 20:17:09 -0000 On 8/9/2016 1:02 PM, Richard Shockey wrote: > Well let me take this opportunity to totally reject Dave’s comments and the implication that we have not followed proper IETF process and procedures. Forgive me, but I did not intend -- and believe I did not assert -- any such implication of prior process problems. To the extent that any such implications seemed apparent, I apologize for the confusion. My concern was/is about the way my comments would be handled, wanting to make sure that what should be discussed openly would be. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 13:23:32 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32C8C12D7CF for ; Tue, 9 Aug 2016 13:23:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jBUvMouQMXmK for ; Tue, 9 Aug 2016 13:23:30 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9CCA12D090 for ; Tue, 9 Aug 2016 13:23:30 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79KNXTL024265 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 9 Aug 2016 13:23:33 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470774213; bh=5ggR+nwnUslwuG+eglM8sGdG/tHKgy4go9S54O53J2o=; h=Subject:To:References:From:Reply-To:Date:In-Reply-To:From; b=nFXsAjb0VgIX4fCugxSq3cDWbpRBzwn9X4dX5vNEmGViNsn83B8xRUExg7ffx7/PW Z3/MpkD8xsmmUIub0tRBKqEMuHbwGQ8SncAfyFVknC4YisE0alUqMOc5yixJ4sUCgc miswYatoQefazhJoRCtQFarqQyyTkjHsANOE4Kgc= To: Richard Shockey , "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Tue, 9 Aug 2016 13:23:04 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 20:23:31 -0000 On 8/9/2016 1:02 PM, Richard Shockey wrote: > Third, Dave’s objections here are fundamental. He is rejecting the > entire JWT construct in 4474bis that has been put forward. It is > almost inconceivable to me that at this late stage he is essentially > asking us to issue a ‘full stop” and start over in favor of DKIM > based construct or whatever. Rich, Yes, late-stage concerns are always discomfiting. But I'll again note that that I did not raise a concern about JWT/JSON in my Passport review. And I raised concern about it in my 4474bis review only after trying to work through the actual use, within the context of these specifications. What I found was considerable additional reading and technical complexity, with no immediate benefit for the task at hand. So while the model is appealing, it actually seems to be a net negative, in this case. I believe I also found serious errors, resulting from the complexity, but this is an example of one of those items in the review that need public response and discussion. So I await clarifications that make clear that I misread the document... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 14:21:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A3F212D89E for ; Tue, 9 Aug 2016 14:21:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CfHUE8DNjMJs for ; Tue, 9 Aug 2016 14:21:10 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEF5412D137 for ; Tue, 9 Aug 2016 14:21:10 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u79LDUoH010598; Tue, 9 Aug 2016 17:21:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=6Q/zeuSfTn/y1tUU3iPZ/yAmOCBmH4cDEUo1eJtBl1E=; b=DNVfDpcVZA5pjpiZw67GE5r/uw3oNpvDQ1K2CuGSqywYjO+9vLQPpg/b+V0owqIGC//d H4kzcnjjNVqvJNJ2ba+S0uuuyoJzO+m3qRNuGTAptrmes74kTVoBSThvifPL42MOV6+P DDyny/5pUPzNUTwoI6sueZ7+hH+5xovKucKXa758T0vmY0eJtwt8mqYpTvxG+qw1f5aZ soRIKL+GZwFvGPVKcQHmy9+nj0Jcg5ekgYe7X8LkdbqkxN0LhgdFa50/a3wdOEhD1qlT sfwSQDytfNzMrhX5xcB0xAjES7JjyUFimT37UEHmmelNTOWuIxD3MuSE6gYdy1zoCaCZ Ag== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24qm95gh7w-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 09 Aug 2016 17:21:07 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Tue, 9 Aug 2016 17:21:06 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBAhpWA///ttYCAAHrsAP//lqEAgADBT4D//6qHAA== Date: Tue, 9 Aug 2016 21:21:06 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> In-Reply-To: <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <0A47AD7EA7381C488B17C61BC5423E12@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090219 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 21:21:12 -0000 While I hear your ask, I'm not sure I think giving individual answers to the 70+ questions in your review are warranted. I'll be looking to the chairs and the rest of the working group for guidance on this issue though - if the prevailing sentiment is that I should answer them all, then I will.=20 In some cases, you pose questions related to a single incidental word choice. "difference -> different?" is a question that doesn't require the consideration of the entire working group. In a stir-passport passage referring to "two new custom headers corresponding to the two parties" you pose five questions: "corresponding? referring? describing? identifying? addressing?" I think your point here isn't a question - or five questions - at all, you're just unhappy with the use of the term "corresponding." As it happens, I don't feel the usage of "corresponding" in this sentence is a problem, but this is merely an editorial matter that I think can be resolved without working group discussion. Others of your questions are simply forms of mild emphasis that have been disguised as questions for rhetorical effect. When we give an example of a JWT header, for example, your review comment is "How is reader to know what that long string means? Is the doc only for the cognoscenti? if so, which cognoscenti?" I'm not sure the question of identifying the cognoscenti for which this document was putatively written is something that requires the attention of the working group. The first question, how the reader is supposed to know what that long string means, is answered in the next three sections of the document - one limitation of doing line-by-line reviews like this in real time is that they tend to pose questions that are answered in the document immediately afterward. A lot of your questions are one-word "why?" questions which are surely rhetorical. Also, for those questions that do have some technical meat, we may have already touched on them here on the list. Early on in the review, for example, in response to the line in stir-passport reading "Tokens are a convenient way of encapsulating information with," you interrupt, "Why? What are the alternatives? Why is this the starting point?" You are making rhetorical points here, that in your opinion using tokens for this purpose has not been sufficiently motivated. We've talked about that quite a bit on the list following your review about why we chose to use a token. As such, I feel like answering many of these question would just be busywork that will not in fact lead to any new list discussions or working group insights or changes to what will get sent over the wire. I don't think I have any obligation in our consensus process to vet issues that I don't think warrant the attention of the working group - though again, if the chairs and/or the group on the whole feel differently about these issues, I will go with the group on this. Jon Peterson Neustar, Inc. On 8/9/16, 12:26 PM, "Dave Crocker" wrote: >On 8/9/2016 7:55 AM, Peterson, Jon wrote: >> I don't know how to start a working group discussion about "many and >> serious problems." Like I said, my first response to your stir-passport >> review covered what I considered to be its most significant issues, >>which >> were largely about the fundamental architecture and the document >> organization (that is, the modularity with other specifications). >> >> I just read the whole thing again. The remainder of your comments are >> overwhelmingly stylistic, editorial or philosophical. > > >Jon, > >Let's start with a rather simple exercise. > >My review of passport has more than 70 questions in it. (I stopped >counting after that, and I haven't counted the number in -4474bis, >though it too is substantial.) While indeed, some of those pertain only >to stylistic points many/most do not. > >So the simple exercise is to ask you to please respond publicly to the >questions I ask in my reviews. > >And yes, it's fine to skip the obviously minor stuff. If I think you >missed something important, there's a reasonable chance I'll note it... > >If you find yourself wanting more of a challenge, look for the various >places that I note that something claiming to be (or to refer to) a >specification does not actually supply specification detail or that the >specification is wrong (eg, doesn't work) and then respond publicly to >the substance. > >Thanks. > >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Tue Aug 9 14:46:50 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1F4D12D7FE for ; Tue, 9 Aug 2016 14:46:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p5khCUraC1Rh for ; Tue, 9 Aug 2016 14:46:49 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C6AF12D5AE for ; Tue, 9 Aug 2016 14:46:49 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79Lkp6Q027599 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 9 Aug 2016 14:46:51 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470779212; bh=SBXyYQa7bYooRBFEkbXIP3RYfi1ZoQIsKo+V4xiGbG0=; h=Subject:To:References:From:Reply-To:Date:In-Reply-To:From; b=Hht7nkjggyDgGVqGPGGQJdS77ucZrmZEgOMxyZD/kEiaQNIx9i4Q4Yui6YWTPH5Ae IW5u2tjHbq/KggV4aY8wvxG9K+xcLpImRzoqx9xc485SPPXD4hP6BsSvWjOr7pV9lo MfdOL5y4kHKCZkzCiuH2VhA9V/T+Ri1npY8PQz9c= To: "Peterson, Jon" , "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <956a5b73-f0e5-01a6-4924-646b073b8510@dcrocker.net> Date: Tue, 9 Aug 2016 14:46:22 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 21:46:50 -0000 Jon, On 8/9/2016 2:21 PM, Peterson, Jon wrote: > While I hear your ask, I'm not sure I think giving individual answers to > the 70+ questions in your review are warranted. I'll be looking to the > chairs and the rest of the working group for guidance on this issue though > - if the prevailing sentiment is that I should answer them all, then I > will. The idea that authors would seek working group consensus about whether to respond in detail to a detailed review is outside of my IETF experience. I'm astonished at the very idea of it. > In some cases, you pose questions related to a single incidental word That why I made a point of acknowledging that there were minor issues and that eliding them is fine. Similarly, conflating a series of question to formulate a single response is likely to be fine. I'm not clear what the point of raising something I already accounted for is. > Others of your questions are simply forms of mild emphasis that have been > disguised as questions for rhetorical effect. When we give an example of a > JWT header, for example, your review comment is "How is reader to know > what that long string means? Is the doc only for the cognoscenti? if so, In fact item was raising a serious and basic question, and it's not about cognoscenti. > A lot of your questions are one-word "why?" questions which are surely > rhetorical. Few if any of them were asked rhetorically. > Also, for those questions that do have some technical meat, we may have > already touched on them here on the list. Early on in the review, for > example, in response to the line in stir-passport reading "Tokens are a > convenient way of encapsulating information with," you interrupt, "Why? > What are the alternatives? Why is this the starting point?" You are making > rhetorical points here, that in your opinion using tokens for this purpose The document doesn't explain what it means by token. Yet it simply asserts their authority. No context. No justification. Not even any definition. So again, this wasn't a rhetorical query. > As such, I feel like answering many of these question would just be > busywork That's a profoundly dysfunctional assessment. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 15:01:38 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FE4612D61C for ; Tue, 9 Aug 2016 15:01:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SEDw6CCA2dtn for ; Tue, 9 Aug 2016 15:01:36 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0174B12B069 for ; Tue, 9 Aug 2016 15:01:35 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u79Lqpew023903; Tue, 9 Aug 2016 18:01:34 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=yAyW5Ggr3469r0uIsDbVoGm9nxIgq9ty+ed4Pg9stw8=; b=m/SEhWtAYzHBHXsXlb3sJ6CukdW472NBVE+YTUA3RKJK2TMz5yyn18bXC+SNv/P4VJXz 4ouL6z5ayLw50w0pRbW/DyLiOEJy9IuogRnKCSQitXr5jPQAk1O59sVQxhVwUSbIUf94 htq6OT3ILV1CMQieB/sOrEMypeXwFBDKAOdY6rQJQwabODtGgRL+YTkRVr81ARRKLl6y r8cA9Me3U9bDGvQxVXnBN7t4uFYtBWIJw+5AKv14tpY6zHQQumzRpNZDjmn2E5o2bBXw t5Dt+xUOFIXnAs23p4Su6g/aJSacdCwxEi2PjmQ7BDVT8wo47KVvN4Qm1C/Z2GxRbDZb vQ== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24qm958pdx-7 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 09 Aug 2016 18:01:34 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Tue, 9 Aug 2016 18:01:23 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBAhpWA///ttYCAAHrsAP//lqEAgADBT4D//6qHAAAPjgEA//+O1QA= Date: Tue, 9 Aug 2016 22:01:22 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> <956a5b73-f0e5-01a6-4924-646b073b8510@dcrocker.net> In-Reply-To: <956a5b73-f0e5-01a6-4924-646b073b8510@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <6A04DD6E6FE99249BB9E579CECF4B050@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090226 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 22:01:37 -0000 >The idea that authors would seek working group consensus about whether >to respond in detail to a detailed review is outside of my IETF >experience. I'm astonished at the very idea of it. It is not at all outside of my experience to ask a working group if it thinks that a set of objections (cast as questions or no) merit further consideration.=20 I will stress again that, from my initial response to your stir-passport review, I immediately agreed that you had made some helpful comments in there and that we would implement fixes for those. I am not going back on that at all. Obviously, the working group will have the opportunity to review a draft containing those fixes. All that we're discussing now is the amount and character of discussion that needs to occur before that step can be taken. If people feel like there's more discussion needed before the editors can proceed, then by all means, let's have it. If not, I see no reason to delay. Jon Peterson Neustar, Inc. From nobody Tue Aug 9 15:18:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 432F912D146 for ; Tue, 9 Aug 2016 15:18:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B4pc_Dq7bwhx for ; Tue, 9 Aug 2016 15:18:38 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94EE812B03F for ; Tue, 9 Aug 2016 15:18:38 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u79MIeSO029388 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 9 Aug 2016 15:18:41 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1470781121; bh=MP/Dq6N+6EMFGfsAZmG3yGpjmPMaxlMrJ6m1UYjrCoo=; h=Subject:To:References:From:Reply-To:Date:In-Reply-To:From; b=AhTGE6yP8fpUnw9+FyWUyIP0G806sAck3YkE4M4IEMggEghImdFebf/QQ7w895OkR x4qIrObBRxVNNHpMHcpn4IeT5QcDk4p6XmdKSjKLxw2dhrlKHUusMLBttBXWY8CZPx zFKcpUDfQ2bijmXldZNd0NTrn/uJxSsqfaASfcfo= To: "Peterson, Jon" , "stir@ietf.org" References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> <956a5b73-f0e5-01a6-4924-646b073b8510@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <24c8bb8c-7c0b-8cdb-90f5-992a7f3a7790@dcrocker.net> Date: Tue, 9 Aug 2016 15:18:11 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 22:18:39 -0000 On 8/9/2016 3:01 PM, Peterson, Jon wrote: >> The idea that authors would seek working group consensus about whether >> to respond in detail to a detailed review is outside of my IETF >> experience. I'm astonished at the very idea of it. > > It is not at all outside of my experience to ask a working group if it > thinks that a set of objections (cast as questions or no) merit further > consideration. That's not quite what you are doing, Jon. You are, instead, asking whether they are worth /any/ explicit, public consideration. Really, that's a process point of an entirely different color. > I will stress again that, from my initial response to your stir-passport > review, I immediately agreed that you had made some helpful comments in Yes you did. So it's unfortunate that that fact is entirely irrelevant to the current discussion, since it has nothing to do with the question of have /any/ detailed public response to details of a review. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 9 15:36:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17C4D12D8AF for ; Tue, 9 Aug 2016 15:35:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XQOuNYJiFPqT for ; Tue, 9 Aug 2016 15:35:58 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9F1012D618 for ; Tue, 9 Aug 2016 15:35:57 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u79MX9rF006719; Tue, 9 Aug 2016 18:35:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=L+pcmm1OLIklf+fm65aW6C//ej9gtxNkH/HsjjalHpc=; b=rHIRJGqkly8Rjabb6wXPGCIr0fiXBH0IgAGC4AF3EjjLoIGh9nbBRqQckN8Jxxbix6+j pOu8A/Ky85fTajvtiUDQOdRI6VmOXIzJ9/qNcWk5Dl7TfJ1lcq9BySg+u5BWH2jNNvmT qQ1u7WCeNeNY/Ks9eGJlN4UgPHSq1c08rLoTfQyGEO5NG2B7Ri7+dOwdpA1jj7AYs0v+ RTRMeGYLBujEiD43SitHrSm2eUzFUtUyNrFdpNY+W8inT3JZIK8c9J65TwbuyM96IaUc m0dClPnanfhCHA7OZfwH8bI+/Xi2wP1aHiep5X7ikOr7bDTdO5ixH/+yrQWKzCAEN6rs ig== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24qm95h3vd-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 09 Aug 2016 18:35:54 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Tue, 9 Aug 2016 18:35:54 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBAhpWA///ttYCAAHrsAP//lqEAgADBT4D//6qHAAAPjgEA//+O1QCAAHoOgP//j5eA Date: Tue, 9 Aug 2016 22:35:53 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> <6ddb77b3-2b14-e4a7-ed09-cc5c2f5bcde7@dcrocker.net> <956a5b73-f0e5-01a6-4924-646b073b8510@dcrocker.net> <24c8bb8c-7c0b-8cdb-90f5-992a7f3a7790@dcrocker.net> In-Reply-To: <24c8bb8c-7c0b-8cdb-90f5-992a7f3a7790@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.28] Content-Type: text/plain; charset="us-ascii" Content-ID: <819D1F8A3050BC4ABA8C2D8F328E85B2@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-09_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608090234 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 22:35:59 -0000 Your comments went out to this public list, and the process of asking the working group here whether or not people want further discussion is, inescapably, public consideration. If you want to encourage discussion of particular points that you think are vital for the working group to consider, I would ask, yet again, that you identify what those points are and discuss them. If the group agrees that more consideration is needed, it will become clear pretty quickly, I imagine. Jon Peterson Neustar, Inc. On 8/9/16, 3:18 PM, "Dave Crocker" wrote: >On 8/9/2016 3:01 PM, Peterson, Jon wrote: >>> The idea that authors would seek working group consensus about whether >>> to respond in detail to a detailed review is outside of my IETF >>> experience. I'm astonished at the very idea of it. >> >> It is not at all outside of my experience to ask a working group if it >> thinks that a set of objections (cast as questions or no) merit further >> consideration. > >That's not quite what you are doing, Jon. You are, instead, asking >whether they are worth /any/ explicit, public consideration. Really, >that's a process point of an entirely different color. > > >> I will stress again that, from my initial response to your stir-passport >> review, I immediately agreed that you had made some helpful comments in > >Yes you did. So it's unfortunate that that fact is entirely irrelevant >to the current discussion, since it has nothing to do with the question >of have /any/ detailed public response to details of a review. > > >d/ > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Tue Aug 9 15:38:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0341F12D115 for ; Tue, 9 Aug 2016 15:38:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vfvrzr6A40gD for ; Tue, 9 Aug 2016 15:38:33 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id 24D2F12D0C7 for ; Tue, 9 Aug 2016 15:38:33 -0700 (PDT) Received: (qmail 28375 invoked by uid 0); 9 Aug 2016 22:38:32 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy4.mail.unifiedlayer.com with SMTP; 9 Aug 2016 22:38:32 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id VAZU1t00G1MNPNq01AZXEm; Tue, 09 Aug 2016 16:33:31 -0600 X-Authority-Analysis: v=2.1 cv=KaJB72oD c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=m7mwjqgD-lhMxblObj0A:9 a=8S5oEimCJZw9ycBg:21 a=g8TIjKFO6ykH8ihW:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=0A6Pq3V89z6mpCAfBmLt3NJTnxAQegNPE2tEhSSM7t0=; b=T+Eyt9T8AfFSukHcYBJK+VfkjS 9P/1tF4RaVAQAMNsNCt0GMgj9hqsobNHHLnYmRyAxeKnNHcBZef3L5uVPkiE8/xOV9I60Et4EBl2N 1ozhiKfim3ZG2F/1DqWomIvw0; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:53945 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bXFaU-0008CL-05; Tue, 09 Aug 2016 16:33:30 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Tue, 09 Aug 2016 18:33:28 -0400 From: Richard Shockey To: , "stir@ietf.org" Message-ID: <6BDCB26B-CDE7-45FF-A843-6502844008DD@shockey.us> Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bXFaU-0008CL-05 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:53945 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 22:38:35 -0000 Apology accepted. =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 On 8/9/16, 4:16 PM, "stir on behalf of Dave Crocker" wrote: On 8/9/2016 1:02 PM, Richard Shockey wrote: > Well let me take this opportunity to totally reject Dave=E2=80=99s comments= and the implication that we have not followed proper IETF process and proce= dures. =20 Forgive me, but I did not intend -- and believe I did not assert -- any= =20 such implication of prior process problems. To the extent that any suc= h=20 implications seemed apparent, I apologize for the confusion. =20 My concern was/is about the way my comments would be handled, wanting t= o=20 make sure that what should be discussed openly would be. =20 d/ =20 --=20 =20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Tue Aug 9 15:51:54 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46AFE12D8D7 for ; Tue, 9 Aug 2016 15:51:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yYSkNJ31kXk6 for ; Tue, 9 Aug 2016 15:51:51 -0700 (PDT) Received: from qproxy5-pub.mail.unifiedlayer.com (qproxy5-pub.mail.unifiedlayer.com [69.89.21.30]) by ietfa.amsl.com (Postfix) with SMTP id 85FAD12D8D4 for ; Tue, 9 Aug 2016 15:51:51 -0700 (PDT) Received: (qmail 7029 invoked by uid 0); 9 Aug 2016 22:51:49 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by qproxy5.mail.unifiedlayer.com with SMTP; 9 Aug 2016 22:51:49 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by CMOut01 with id VAmk1t00E1MNPNq01AmnM2; Tue, 09 Aug 2016 16:46:48 -0600 X-Authority-Analysis: v=2.1 cv=AL9Ak13q c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=m7mwjqgD-lhMxblObj0A:9 a=SzhSZKVG_vx5BCgI:21 a=hAR29G8oaJPlhQNS:21 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=kXanyvUddvfqkXBdc2rI0NKBfHBxOCBCKx/3V9TDE64=; b=DlGgB8japZ8plv1CdsrVPTvoQf rJLrMaQ5Eu3jA9mD6irQbuQiO27QfuotVJrua9Ybamlxub1fy3ZFmcXCE/iv7J88lIsv1UZcthUTP 3PjjYmKsIEhbtE8af6ac3BDx5; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:53991 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bXFnJ-0006kd-7E; Tue, 09 Aug 2016 16:46:45 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Tue, 09 Aug 2016 18:46:43 -0400 From: Richard Shockey To: , "stir@ietf.org" Message-ID: <69C5763D-5F8B-4150-840A-03775B140A2D@shockey.us> Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 References: <4B1956260CD29F4A9622F00322FE053101285D016E32@BOBO1A.bobotek.net> <1dbc154e-1ffc-689a-6f4f-45321e1149f6@dcrocker.net> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bXFnJ-0006kd-7E X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:53991 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Aug 2016 22:51:53 -0000 Do you or do you not want a full stop? Are you willing to go to the IESG = and say these documents have not received full WG review?=20 Put up or =E2=80=A6 On 8/9/16, 4:16 PM, "stir on behalf of Dave Crocker" wrote: On 8/9/2016 1:02 PM, Richard Shockey wrote: > Well let me take this opportunity to totally reject Dave=E2=80=99s comments= and the implication that we have not followed proper IETF process and proce= dures. =20 Forgive me, but I did not intend -- and believe I did not assert -- any= =20 such implication of prior process problems. To the extent that any suc= h=20 implications seemed apparent, I apologize for the confusion. =20 My concern was/is about the way my comments would be handled, wanting t= o=20 make sure that what should be discussed openly would be. =20 d/ =20 --=20 =20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Wed Aug 10 05:41:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E63312B076 for ; Wed, 10 Aug 2016 05:41:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ANlv9_LtGd5w for ; Wed, 10 Aug 2016 05:41:38 -0700 (PDT) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E863A12D1C0 for ; Wed, 10 Aug 2016 05:41:37 -0700 (PDT) Received: by mail-it0-x234.google.com with SMTP id n191so5690742ith.1 for ; Wed, 10 Aug 2016 05:41:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Gs+L4rXCo7cUX2uAyDRt4z0YYCljQe9ICnaw0Fpb6Qw=; b=x544551OZDqjKsm/ZTPg1JQ3ctcIoB15vXBxsxfHmaooqoqfII7WbkxFe06zM83Vp8 Iv/PAQ5YOVxJCA8Sw7X8ZKwMIfhF4JQQbB6DBKYtZXWsvOqmjk19LQzA2h2WZq29wFFX yYJXxWKIpu/TZOIzQviEQ3Nlt8+jkVTEdsAQajUXiibZD9u9wfr+ZlSbKPIydP74S2vp BVqSv4BrMOkMhhH/Qb30NkllxGMFofr05d5nlXOYI157ZVz0Mfy7+x1OPjV91Ai/l5aP U0sj7vL6aHfeBo35hcWqsPz4CmsCwno/EPOuCPA7QW82/Qn4IhTF1kUP/gW5rkVcQjn2 yksg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Gs+L4rXCo7cUX2uAyDRt4z0YYCljQe9ICnaw0Fpb6Qw=; b=Kmhx2Zaw2tbiDaI90BmLc44Xa52Eyl1q67FVqNoiESLHvWXJ4WJ1yg13mIqGsOi7XA 6Qfv7wB5cb7uE3hCsxuuHbxkjic5WOjkjLzeRO6m+OrErsrXKHKQNBEDbvvRkZINZRAs L/O0tkC9uKm9UF4HGgfGAlC+trB4iVClc43hUTF4TxO7wzLxhkF2rKz7w+oyyrdBZ2LY TbnjjptPRvP198VIMzvjAGDmCsnNhVlv6eNqjJ8Wpyh7Lg4kPG/P5Q+NrSOrVxPBgmfr L7YQhI01cvHgRWsPXnBmly0fHOi/sGZCmNVF3Nis4W0ZsNTyaatZGC8oxyqO2PoYU5aq zAqg== X-Gm-Message-State: AEkoouu0EB9kD2p63zwB87wWwFKwl0ngGDqc8b24iwDwXP/OPXos2n1HIO8jhUW+XYTobhtYz2eLsEsoIqx0DQ== X-Received: by 10.36.208.143 with SMTP id m137mr3146038itg.32.1470832897135; Wed, 10 Aug 2016 05:41:37 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.0.26 with HTTP; Wed, 10 Aug 2016 05:41:36 -0700 (PDT) In-Reply-To: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> From: Andy Hutton Date: Wed, 10 Aug 2016 13:41:36 +0100 Message-ID: To: Richard Shockey Content-Type: multipart/alternative; boundary=001a11479d905b9b770539b6f805 Archived-At: Cc: stir@ietf.org, Paul Kyzivat Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 12:41:40 -0000 --001a11479d905b9b770539b6f805 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Also as Dave Crocker pointed out what happens at the callee is also important if no validation is possible at the callee's device then surely there is no real benefit to the consumer. Regards Andy On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey wrote: > > > On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" < > stir-bounces@ietf.org on behalf of pkyzivat@alum.mit.edu> wrote: > > On 8/9/16 12:25 PM, Richard Shockey wrote: > > > > +1 it has to start some where. > > > > The circles of trust start first with the circles of authority and > then can be delegated as requirements dictate. The integrity numbering > plan is a direct and plenary responsibility of NRA=E2=80=99s period full = stop. > > > > I=E2=80=99m less confident we will ever get to the device level..at= least > not for the foreeable future aka my lifetime. > > If the SPs have an incentive to *not* delegate then it will be very > hard > to get there. > > RS> Not our concern. Way beyond our scope of competence here. Don=E2=80= =99t > forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80=99s Silver = Hammer=E2=80=9D and you can be > sure they can use it if delegation or lack thereof is perceived to be ant= i > competitive. > > > OTOH, if they have an incentive then the chances are better. > > Brian and Paul R outlined some possible incentives to delegate. That > gives some hope. > > Thanks, > Paul > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --001a11479d905b9b770539b6f805 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Also as Dave Crocker pointed out what = happens at the callee is also important if no validation is possible at the= callee's device then surely there is no real benefit to the consumer.<= /div>

Regards
Andy

On Tue, Aug 9, 2016 at 6:09 PM, R= ichard Shockey <richard@shockey.us> wrote:


On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of pkyzivat@alum.mit.edu> wrote:=

=C2=A0 =C2=A0 On 8/9/16 12:25 PM, Richard Shockey wrote:
=C2=A0 =C2=A0 >
=C2=A0 =C2=A0 > +1 it has to start some where.
=C2=A0 =C2=A0 >
=C2=A0 =C2=A0 > The circles of trust start first with the circles of aut= hority and then can be delegated as requirements dictate.=C2=A0 The integri= ty numbering plan is a direct and plenary responsibility of NRA=E2=80=99s p= eriod full stop.
=C2=A0 =C2=A0 >
=C2=A0 =C2=A0 > I=E2=80=99m less confident we will ever get to the devic= e level..at least not for the foreeable future aka my lifetime.

=C2=A0 =C2=A0 If the SPs have an incentive to *not* delegate then it will b= e very hard
=C2=A0 =C2=A0 to get there.

RS> Not our concern.=C2=A0 =C2=A0Way beyond our scope of competen= ce here. Don=E2=80=99t forget the NRA=E2=80=99s have the real =E2=80=9CMaxw= ell=E2=80=99s Silver Hammer=E2=80=9D and you can be sure they can use it if= delegation or lack thereof is perceived to be anti competitive.


=C2=A0 =C2=A0 OTOH, if they have an incentive then the chances are better.<= br>
=C2=A0 =C2=A0 Brian and Paul R outlined some possible incentives to delegat= e. That
=C2=A0 =C2=A0 gives some hope.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Thanks,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Paul




____________________________= ___________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

--001a11479d905b9b770539b6f805-- From nobody Wed Aug 10 06:02:13 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E49C12D7E1 for ; Wed, 10 Aug 2016 06:02:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CLR_wjs8uS19 for ; Wed, 10 Aug 2016 06:02:10 -0700 (PDT) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB35112D559 for ; Wed, 10 Aug 2016 06:02:09 -0700 (PDT) Received: by mail-qt0-x22a.google.com with SMTP id w38so20189508qtb.0 for ; Wed, 10 Aug 2016 06:02:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=ISAyy/ryFbou/4dgwVHzJXNvVURTpkEC/1nTCoFK/Jk=; b=eYdt4GrMGXjScv1tzQ9mlnlbK3Gez5WtmC4Za/3wHwz6gGyA21saqSOJtkPjTXlvuf czkvHkPBa40Xr4uzDSZ5jx/RsbpQMXDRry5xIUgFXNQTD+CeeunPuaV5blzlqAHYqCR5 8camXqPcmlKvJzN1IXWVfOAHM+neaqM0IMqfLpqCH3bc8giW7Tw+t2hXKAm4osUwlwXx +m/IDtRPjGWrbHxYl3roOr52eVoEerNLz4tmBUqRNNDmmw2I2pVUC6EdIwmjBoDph5gI WUIfHrk48Zvdz79o4Il9ju7tT2mK339O61ZcmsrRQwcfQVlgd3hNktEtaFa2/joJdix7 m2Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=ISAyy/ryFbou/4dgwVHzJXNvVURTpkEC/1nTCoFK/Jk=; b=M4tyHiYIqNKSWo6SuQ+HjSV3EgfLGWKPAIorhgWt2/jg31naecvG6h++ucyY5tjbmX KAm4O+XzRUdnyB6dIaCRjkxqSvCpXzzPnGGHn3kOHMLsNOGoSgDlMKDC57Vu8szlAkOn fVyOWcfHSWHE4rpJ5nOiu/cYlW9acIOYoHk5HWhCGdJN2Zzjj7LI4XsQK3U8DZTnqwwz 6GCRN8C964qFko9Ua2PH6aeWRH5Y3tQAXroC+Cf6fkcuu6mzNzGjOhlkkD2Tpvc59xvp /sq7YfSBlIf5Vb36OghSjTRWGFLjhqE512LnROA0/Vq7N18jVTI5fDqNCHRs2tCGK6Yd QuwA== X-Gm-Message-State: AEkoouvCGK78uQQRc5CqVC4ExjiWloDVs7UgXCg8sdkgNhElmy4/UiP97+jN0DXGErNdBQ== X-Received: by 10.200.56.253 with SMTP id g58mr4184325qtc.28.1470834128373; Wed, 10 Aug 2016 06:02:08 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id 55sm23252764qtp.32.2016.08.10.06.02.06 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 10 Aug 2016 06:02:07 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_D522F9A5-9868-4511-A563-F4A292FFBF20" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Wed, 10 Aug 2016 09:02:03 -0400 Message-Id: <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> To: Andy Hutton X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 13:02:12 -0000 --Apple-Mail=_D522F9A5-9868-4511-A563-F4A292FFBF20 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I don=E2=80=99t think that is at all true. If validation is done at, = say a transit network interconnect, and the transit network refuses to = accept the call without a valid signature (assuming it does not run = afoul of its local regulations in doing so), then there is value to the = consumer. If the termination network does the same, value. If the = termination network modifies the signaling towards the consumer so that = the display name is =E2=80=9Csuspicious call=E2=80=9D or =E2=80=9Cunknown= caller=E2=80=9D, that is of great value to the consumer. If it offers = an option to the consumer to send calls with bad signatures or no = signatures direct to voicemail, that is of great value. So, while I really, really do want to do the validation on the device = (because the consumer will have more options available of that is what = happens), I think the mechanism can help consumers way before it shows = up on the device and the device is able to do something with it. Brian > On Aug 10, 2016, at 8:41 AM, Andy Hutton = wrote: >=20 >=20 > Also as Dave Crocker pointed out what happens at the callee is also = important if no validation is possible at the callee's device then = surely there is no real benefit to the consumer. >=20 > Regards > Andy >=20 > On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: >=20 >=20 > On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" = on behalf of = pkyzivat@alum.mit.edu > wrote: >=20 > On 8/9/16 12:25 PM, Richard Shockey wrote: > > > > +1 it has to start some where. > > > > The circles of trust start first with the circles of authority = and then can be delegated as requirements dictate. The integrity = numbering plan is a direct and plenary responsibility of NRA=E2=80=99s = period full stop. > > > > I=E2=80=99m less confident we will ever get to the device = level..at least not for the foreeable future aka my lifetime. >=20 > If the SPs have an incentive to *not* delegate then it will be = very hard > to get there. >=20 > RS> Not our concern. Way beyond our scope of competence here. = Don=E2=80=99t forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80= =99s Silver Hammer=E2=80=9D and you can be sure they can use it if = delegation or lack thereof is perceived to be anti competitive. >=20 >=20 > OTOH, if they have an incentive then the chances are better. >=20 > Brian and Paul R outlined some possible incentives to delegate. = That > gives some hope. >=20 > Thanks, > Paul >=20 >=20 >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_D522F9A5-9868-4511-A563-F4A292FFBF20 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I don=E2=80=99t think that is at all true.  If = validation is done at, say a transit network interconnect, and the = transit network refuses to accept the call without a valid signature = (assuming it does not run afoul of its local regulations in doing so), = then there is value to the consumer.  If the termination network = does the same, value.  If the termination network modifies the = signaling towards the consumer so that the display name is =E2=80=9Csuspic= ious call=E2=80=9D or  =E2=80=9Cunknown caller=E2=80=9D, that is of = great value to the consumer.  If it offers an option to the = consumer to send calls with bad signatures or no signatures direct to = voicemail, that is of great value.

So, while I really, really do want to = do the validation on the device (because the consumer will have more = options available of that is what happens), I think the mechanism can = help consumers way before it shows up on the device and the device is = able to do something with it.

Brian

On = Aug 10, 2016, at 8:41 AM, Andy Hutton <andyhutton.ietf@gmail.com> wrote:


Also as = Dave Crocker pointed out what happens at the callee is also important if = no validation is possible at the callee's device then surely there is no = real benefit to the consumer.

Regards
Andy

On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey = <richard@shockey.us> wrote:


On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org= on behalf of pkyzivat@alum.mit.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has to start some where.
    >
    > The circles of trust start first with the circles of = authority and then can be delegated as requirements dictate.  The = integrity numbering plan is a direct and plenary responsibility of = NRA=E2=80=99s period full stop.
    >
    > I=E2=80=99m less confident we will ever get to the = device level..at least not for the foreeable future aka my lifetime.

    If the SPs have an incentive to *not* delegate then it = will be very hard
    to get there.

RS> Not our concern.   Way beyond our scope of = competence here. Don=E2=80=99t forget the NRA=E2=80=99s have the real = =E2=80=9CMaxwell=E2=80=99s Silver Hammer=E2=80=9D and you can be sure = they can use it if delegation or lack thereof is perceived to be anti = competitive.


    OTOH, if they have an incentive then the chances are = better.

    Brian and Paul R outlined some possible incentives to = delegate. That
    gives some hope.

        Thanks,
        Paul




_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir = mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_D522F9A5-9868-4511-A563-F4A292FFBF20-- From nobody Wed Aug 10 06:11:38 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A988112D5C4 for ; Wed, 10 Aug 2016 06:11:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LzEJcU-2hOnb for ; Wed, 10 Aug 2016 06:11:36 -0700 (PDT) Received: from mail-io0-x236.google.com (mail-io0-x236.google.com [IPv6:2607:f8b0:4001:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E58A212B05F for ; Wed, 10 Aug 2016 06:11:35 -0700 (PDT) Received: by mail-io0-x236.google.com with SMTP id m101so40742998ioi.2 for ; Wed, 10 Aug 2016 06:11:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=SYtf4L2vvo99UzUGwL70JpyRagoco+rPHXzWvObY23w=; b=ukKC6ammSFxsjbGtrcLVnt6HA3A9EKcen7xM4ttmaQvM+oi1XHBfXk9sxDgad0tEv2 sFX0YUHgX+RdK7c83XbUo8rkDeGSsJrN+sq6/sZcOpz6g3093p5VLvY09DvxAAY+yIMb HS1qxs4uCo/M7fbvVM+tZ6G2FpZiqoe1Ox5rhBwuY23xeEawhi/YoHcxbadPtV9O1+dL 98LxlOR1DtXiUZC5kROuhlTp4z+UTemCkVTnEGLayah0MKN/wb+1z9Pmpo6TL83xq9Vg CFXhq9xm90yDU7Z1D+YWuYMP3aJak4sUlQkwQctJV34IiHw3jkS6/wQRXnc58E6fc2g2 oRoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=SYtf4L2vvo99UzUGwL70JpyRagoco+rPHXzWvObY23w=; b=LQkTGdRheHc1zN3I8l67Auy3U7Qu/Gbusp0vxCBEmhrJ9oviA1tYtgqmdVa99aZVM0 vahzxoJZQobHyGvFc6OEg6Wj20jviSv3CZ3RllulTOQ4BQkknOx4GYSTvE8E4iftuA3N 0GXxgeQNPeJjvrfklFaRuz409suLm/mh5KA9u+6upkwiHJ7Zjy69bdrbXyt6UWNNYARB jD0Q8351NFJlpM1796XXeQ5pegP6EuVe8v+h4QU6Yp6QVs1e6k6PGdqbTHgS6CqsFpEk 7PiyLt6jo+ZbaHnVgpc6EUcwAPHV1bPaIzn8C/qau0opmfi2w8cqE4JDU9lko9CHvIDp rO1w== X-Gm-Message-State: AEkoouuGEkCwtnGZHslkwXL1ZcrmlTwdKvXT2OdjedRUAUdc4ssVvtTMC8j6ZztjpbPNDqC8fnKwZtU9htsc+Q== X-Received: by 10.107.55.70 with SMTP id e67mr5198179ioa.51.1470834695285; Wed, 10 Aug 2016 06:11:35 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.0.26 with HTTP; Wed, 10 Aug 2016 06:11:34 -0700 (PDT) In-Reply-To: <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> From: Andy Hutton Date: Wed, 10 Aug 2016 14:11:34 +0100 Message-ID: To: Brian Rosen Content-Type: multipart/alternative; boundary=001a114a6d7689307e0539b763eb Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 13:11:38 -0000 --001a114a6d7689307e0539b763eb Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable OK understood but if the callee device or could be an enterprise network is going to make decisions based on this don't we need to specify the information/signalling on which they make that decision? Andy On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen wrote: > I don=E2=80=99t think that is at all true. If validation is done at, say= a > transit network interconnect, and the transit network refuses to accept t= he > call without a valid signature (assuming it does not run afoul of its loc= al > regulations in doing so), then there is value to the consumer. If the > termination network does the same, value. If the termination network > modifies the signaling towards the consumer so that the display name is > =E2=80=9Csuspicious call=E2=80=9D or =E2=80=9Cunknown caller=E2=80=9D, t= hat is of great value to the > consumer. If it offers an option to the consumer to send calls with bad > signatures or no signatures direct to voicemail, that is of great value. > > So, while I really, really do want to do the validation on the device > (because the consumer will have more options available of that is what > happens), I think the mechanism can help consumers way before it shows up > on the device and the device is able to do something with it. > > Brian > > On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: > > > Also as Dave Crocker pointed out what happens at the callee is also > important if no validation is possible at the callee's device then surely > there is no real benefit to the consumer. > > Regards > Andy > > On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: > >> >> >> On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" < >> stir-bounces@ietf.org on behalf of pkyzivat@alum.mit.edu> wrote: >> >> On 8/9/16 12:25 PM, Richard Shockey wrote: >> > >> > +1 it has to start some where. >> > >> > The circles of trust start first with the circles of authority and >> then can be delegated as requirements dictate. The integrity numbering >> plan is a direct and plenary responsibility of NRA=E2=80=99s period full= stop. >> > >> > I=E2=80=99m less confident we will ever get to the device level..a= t least >> not for the foreeable future aka my lifetime. >> >> If the SPs have an incentive to *not* delegate then it will be very >> hard >> to get there. >> >> RS> Not our concern. Way beyond our scope of competence here. Don=E2= =80=99t >> forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80=99s Silver= Hammer=E2=80=9D and you can be >> sure they can use it if delegation or lack thereof is perceived to be an= ti >> competitive. >> >> >> OTOH, if they have an incentive then the chances are better. >> >> Brian and Paul R outlined some possible incentives to delegate. That >> gives some hope. >> >> Thanks, >> Paul >> >> >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > --001a114a6d7689307e0539b763eb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
OK understood but if the callee device or could be an ente= rprise network is going to make decisions based on this don't we need t= o specify the information/signalling on which they make that decision?
=
Andy

On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen <br@brianrosen.= net> wrote:
I don=E2=80=99t think that is at all true.=C2=A0 If va= lidation is done at, say a transit network interconnect, and the transit ne= twork refuses to accept the call without a valid signature (assuming it doe= s not run afoul of its local regulations in doing so), then there is value = to the consumer.=C2=A0 If the termination network does the same, value.=C2= =A0 If the termination network modifies the signaling towards the consumer = so that the display name is =E2=80=9Csuspicious call=E2=80=9D or =C2=A0=E2= =80=9Cunknown caller=E2=80=9D, that is of great value to the consumer.=C2= =A0 If it offers an option to the consumer to send calls with bad signature= s or no signatures direct to voicemail, that is of great value.

So, while I really, really do want to do the validation on the devi= ce (because the consumer will have more options available of that is what h= appens), I think the mechanism can help consumers way before it shows up on= the device and the device is able to do something with it.

Brian
=

= On Aug 10, 2016, at 8:41 AM, Andy Hutton <andyhutton.ietf@gmail.com> wrote:

Also as Dave Crocker poin= ted out what happens at the callee is also important if no validation is po= ssible at the callee's device then surely there is no real benefit to t= he consumer.

Regards
Andy

On Tue, Aug 9, 2016 = at 6:09 PM, Richard Shockey <richard@shockey.us> wrote:
=


On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of = pkyzivat@alum.mit.edu> wrote:

=C2=A0 =C2=A0 On 8/9/16 12:25 PM, Richard Shockey wrote:
=C2=A0 =C2=A0 >
=C2=A0 =C2=A0 > +1 it has to start some where.
=C2=A0 =C2=A0 >
=C2=A0 =C2=A0 > The circles of trust start first with the circles of aut= hority and then can be delegated as requirements dictate.=C2=A0 The integri= ty numbering plan is a direct and plenary responsibility of NRA=E2=80=99s p= eriod full stop.
=C2=A0 =C2=A0 >
=C2=A0 =C2=A0 > I=E2=80=99m less confident we will ever get to the devic= e level..at least not for the foreeable future aka my lifetime.

=C2=A0 =C2=A0 If the SPs have an incentive to *not* delegate then it will b= e very hard
=C2=A0 =C2=A0 to get there.

RS> Not our concern.=C2=A0 =C2=A0Way beyond our scope of competen= ce here. Don=E2=80=99t forget the NRA=E2=80=99s have the real =E2=80=9CMaxw= ell=E2=80=99s Silver Hammer=E2=80=9D and you can be sure they can use it if= delegation or lack thereof is perceived to be anti competitive.


=C2=A0 =C2=A0 OTOH, if they have an incentive then the chances are better.<= br>
=C2=A0 =C2=A0 Brian and Paul R outlined some possible incentives to delegat= e. That
=C2=A0 =C2=A0 gives some hope.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Thanks,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Paul




_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing liststir@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/stir" target=3D"_blank">htt= ps://www.ietf.org/mailman/listinfo/stir


--001a114a6d7689307e0539b763eb-- From nobody Wed Aug 10 06:15:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7F5912D559 for ; Wed, 10 Aug 2016 06:14:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yObhvAJUn3TV for ; Wed, 10 Aug 2016 06:14:58 -0700 (PDT) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C17F612B05F for ; Wed, 10 Aug 2016 06:14:57 -0700 (PDT) Received: by mail-qt0-x22f.google.com with SMTP id w38so20380406qtb.0 for ; Wed, 10 Aug 2016 06:14:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=I1NDEnPT4zQu5xgofKtsapQYiLBJkx/uW43SVPzixW8=; b=L+E3PIkJlhloFVRROUEcM/PGSpgWxgtHQH3RqXr2IHkwJ5W+4jmUAu+r6qM6ctHt0r zgNGTR43vyyNwWLNkw2uP4pL9GTRUgqAsAfFmewiGxZtQC+Lwknm2sO3jGN107ar4H9f CHIhp29d+IcCQbnlEWJbdqOdc3zl6oG7+JzBd+mRPE2+Gp/dT/sq9qTpVGxvvPQWVCfq JdtdfsYUWGb2aQb/XX9KZVoZUgcqObNCTq5ARU/Zc08KfFnxCDhJ2eWdFoAtgMYinfhO BSjyXXk/QImm3QQu8oAoXPzn6uaOM07u826fxFcS7vc4W6TZMRT7MbCpTNI6BT/7APT0 XKVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=I1NDEnPT4zQu5xgofKtsapQYiLBJkx/uW43SVPzixW8=; b=mdbR4K5SPyLkM2CcktL3HhNihG6m7HTp6qnD67PepE0yStXZEU5mhxAePpospnZ1Bl uaCVMVYFVzpMGpONK0QmecrbxyvDJxbYiTB7NC2RFPRW7/EyrporRMInLayfhFevdff0 tyYgu7pJ1Qr+jw2o5HQSdjmUAfvj2/vqma6daYkPRSSv8Zv9uuoUCN2C3LYrjgoAfA29 CU0We+qrWBbb/PO7A620F20KqjtGVY79uzT4Qs+kwc3hfsvwsgPfS9u904JMaJcTMAvo DEQZA5cyNDgpLU+gemblOwZtFyKWOQzA5Sx5VkuRakD3eMpxLM9fYtYnuYcgjXi032Ur f9lQ== X-Gm-Message-State: AEkoouu3SujJcbBp7TddyqEXk3slvA5m1Yepouit3AAZ9HNNxpgPCsrUu4hz1AMcePAgNw== X-Received: by 10.200.54.185 with SMTP id a54mr4224575qtc.63.1470834896910; Wed, 10 Aug 2016 06:14:56 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id v60sm23262263qtd.22.2016.08.10.06.14.55 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 10 Aug 2016 06:14:55 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_84AEECFF-D40C-4118-BA54-E084EF373400" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Wed, 10 Aug 2016 09:14:52 -0400 Message-Id: <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> To: Andy Hutton X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 13:15:00 -0000 --Apple-Mail=_84AEECFF-D40C-4118-BA54-E084EF373400 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Maybe I don=E2=80=99t understand the question, but I certainly want to = see the Identity header and the JWT sent to the device/enterprise. I = certainly hope the device/enterprise will have access to the PKI and = OCSP service to validate. Then it can decide what to do with the call. If the network drops the call then clearly the enterprise can=E2=80=99t = do anything. If the display name is changed, maybe it could. Brian > On Aug 10, 2016, at 9:11 AM, Andy Hutton = wrote: >=20 > OK understood but if the callee device or could be an enterprise = network is going to make decisions based on this don't we need to = specify the information/signalling on which they make that decision? >=20 > Andy >=20 > On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: > I don=E2=80=99t think that is at all true. If validation is done at, = say a transit network interconnect, and the transit network refuses to = accept the call without a valid signature (assuming it does not run = afoul of its local regulations in doing so), then there is value to the = consumer. If the termination network does the same, value. If the = termination network modifies the signaling towards the consumer so that = the display name is =E2=80=9Csuspicious call=E2=80=9D or =E2=80=9Cunknown= caller=E2=80=9D, that is of great value to the consumer. If it offers = an option to the consumer to send calls with bad signatures or no = signatures direct to voicemail, that is of great value. >=20 > So, while I really, really do want to do the validation on the device = (because the consumer will have more options available of that is what = happens), I think the mechanism can help consumers way before it shows = up on the device and the device is able to do something with it. >=20 > Brian >=20 >> On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: >>=20 >>=20 >> Also as Dave Crocker pointed out what happens at the callee is also = important if no validation is possible at the callee's device then = surely there is no real benefit to the consumer. >>=20 >> Regards >> Andy >>=20 >> On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: >>=20 >>=20 >> On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" = on behalf of = pkyzivat@alum.mit.edu > wrote: >>=20 >> On 8/9/16 12:25 PM, Richard Shockey wrote: >> > >> > +1 it has to start some where. >> > >> > The circles of trust start first with the circles of authority = and then can be delegated as requirements dictate. The integrity = numbering plan is a direct and plenary responsibility of NRA=E2=80=99s = period full stop. >> > >> > I=E2=80=99m less confident we will ever get to the device = level..at least not for the foreeable future aka my lifetime. >>=20 >> If the SPs have an incentive to *not* delegate then it will be = very hard >> to get there. >>=20 >> RS> Not our concern. Way beyond our scope of competence here. = Don=E2=80=99t forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80= =99s Silver Hammer=E2=80=9D and you can be sure they can use it if = delegation or lack thereof is perceived to be anti competitive. >>=20 >>=20 >> OTOH, if they have an incentive then the chances are better. >>=20 >> Brian and Paul R outlined some possible incentives to delegate. = That >> gives some hope. >>=20 >> Thanks, >> Paul >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir = >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir = >=20 >=20 --Apple-Mail=_84AEECFF-D40C-4118-BA54-E084EF373400 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Maybe I don=E2=80=99t understand the question, but I = certainly want to see the Identity header and the JWT sent to the = device/enterprise.  I certainly hope the device/enterprise will = have access to the PKI and OCSP service to validate.  Then it can = decide what to do with the call.

If the network drops the call then clearly the enterprise = can=E2=80=99t do anything.  If the display name is changed, maybe = it could.

Brian

On Aug 10, 2016, at 9:11 AM, = Andy Hutton <andyhutton.ietf@gmail.com> wrote:

OK understood but if the callee device or could be an = enterprise network is going to make decisions based on this don't we = need to specify the information/signalling on which they make that = decision?

Andy

On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen <br@brianrosen.net> wrote:
I don=E2=80=99t think that is = at all true.  If validation is done at, say a transit network = interconnect, and the transit network refuses to accept the call without = a valid signature (assuming it does not run afoul of its local = regulations in doing so), then there is value to the consumer.  If = the termination network does the same, value.  If the termination = network modifies the signaling towards the consumer so that the display = name is =E2=80=9Csuspicious call=E2=80=9D or  =E2=80=9Cunknown = caller=E2=80=9D, that is of great value to the consumer.  If it = offers an option to the consumer to send calls with bad signatures or no = signatures direct to voicemail, that is of great value.
So, while I really, really do want to = do the validation on the device (because the consumer will have more = options available of that is what happens), I think the mechanism can = help consumers way before it shows up on the device and the device is = able to do something with it.

Brian

On Aug 10, 2016, at 8:41 AM, Andy Hutton = <andyhutton.ietf@gmail.com> wrote:

Also as Dave Crocker pointed out what = happens at the callee is also important if no validation is possible at = the callee's device then surely there is no real benefit to the = consumer.

Regards
Andy

On Tue, = Aug 9, 2016 at 6:09 PM, Richard Shockey <richard@shockey.us> wrote:


On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of pkyzivat@alum.mit.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has to start some where.
    >
    > The circles of trust start first with the circles of = authority and then can be delegated as requirements dictate.  The = integrity numbering plan is a direct and plenary responsibility of = NRA=E2=80=99s period full stop.
    >
    > I=E2=80=99m less confident we will ever get to the = device level..at least not for the foreeable future aka my lifetime.

    If the SPs have an incentive to *not* delegate then it = will be very hard
    to get there.

RS> Not our concern.   Way beyond our scope of = competence here. Don=E2=80=99t forget the NRA=E2=80=99s have the real = =E2=80=9CMaxwell=E2=80=99s Silver Hammer=E2=80=9D and you can be sure = they can use it if delegation or lack thereof is perceived to be anti = competitive.


    OTOH, if they have an incentive then the chances are = better.

    Brian and Paul R outlined some possible incentives to = delegate. That
    gives some hope.

        Thanks,
        Paul




_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir



= --Apple-Mail=_84AEECFF-D40C-4118-BA54-E084EF373400-- From nobody Wed Aug 10 06:53:17 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 612B912D59F for ; Wed, 10 Aug 2016 06:53:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ybH6RXuHEHwa for ; Wed, 10 Aug 2016 06:53:14 -0700 (PDT) Received: from mail1.bemta14.messagelabs.com (mail1.bemta14.messagelabs.com [193.109.254.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3E1812D53D for ; Wed, 10 Aug 2016 06:53:13 -0700 (PDT) Received: from [193.109.255.99] by server-9.bemta-14.messagelabs.com id 52/1B-10182-7C13BA75; Wed, 10 Aug 2016 13:53:11 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrDKsWRWlGSWpSXmKPExsVy+MWXNt1jhqv DDR5eULC4tG4rk8XT+9PYLFZsOMBqMeOHgcXytduYHFg9/r7/wORx/9tfdo+ds+6yeyxZ8pPJ Y+LHM8wBrFGsmXlJ+RUJrBm/N39hLXi1lrHi2tRetgbGPasZuxi5OIQE9jBK9J95yQLhrGKU+ LLyPZDDCeSsYJL49iQFInGYUWL78m9QLZsYJbrmHmYHqWITcJKYv3sdE4gtIuAj0dd6hhnEZh YokXg/eTKQzcEhLGAtse96DkSJjcT8x31sEHaWxL/JVxlBbBYBVYkLD1eALeYVCJWYe3YKG8S ubhaJda09TCBzOIF2ndspAFLDKCAr8aVxNdQqcYlbT+aDnSAhICCxZM95ZghbVOLl43+sEDV5 EodfLWWCmC8ocXLmE5YJjKKzkLTPQlI2C0nZLKDNzAKaEut36UOUKEpM6X7IDmFrSLTOmcuOL L6AkX0Vo0ZxalFZapGuoZleUlFmekZJbmJmjq6hoYlebmpxcWJ6ak5iUrFecn7uJkZgLNczMD DuYPx62vMQoyQHk5Ior7fq6nAhvqT8lMqMxOKM+KLSnNTiQ4wyHBxKErw7DYBygkWp6akVaZk 5wKQCk5bg4FES4T0KkuYtLkjMLc5Mh0idYlSUEuddCpIQAElklObBtcES2SVGWSlhXkYGBgYh noLUotzMElT5V4ziHIxKwhBTeDLzSuCmvwJazAS0OEl1BcjikkSElFQDo9CxxWUc3bsfqApvi pxue1B16jKWV3ceGbP/sM/g2NpQ9jfozd8pek4TrGRC+7LY+zds83rcdcn5ThmLZmvOEu6/97 au7oqq3F7FmHLO6Y3gy4pVT88Y7nrcVRF+SFZEQ+Ag901lb67SpXeLf1TJNHiJacy+qvWk9f+ LBSuly9QclcL3zrdqUmIpzkg01GIuKk4EAAws7r5fAwAA X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-15.tower-48.messagelabs.com!1470837190!63645450!1 X-Originating-IP: [195.232.244.134] X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 8466 invoked from network); 10 Aug 2016 13:53:10 -0000 Received: from mailout02.vodafone.com (HELO mailout02.vodafone.com) (195.232.244.134) by server-15.tower-48.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 10 Aug 2016 13:53:10 -0000 Received: from mailint03.vodafone.com (mailint03.vodafone.com [195.232.244.200]) by mailout02.vodafone.com (Postfix) with ESMTP id 3s8XfY3DRCzbdMV; Wed, 10 Aug 2016 15:53:09 +0200 (CEST) Received: from mailint03.vodafone.com (localhost [127.0.0.1]) by mailint03.vodafone.com (Postfix) with ESMTP id 3s8XfY20Kcz16Lxw; Wed, 10 Aug 2016 15:53:09 +0200 (CEST) Received: from VOEXC02W.internal.vodafone.com (voexc02w.dc-ratingen.de [145.230.101.22]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint03.vodafone.com (Postfix) with ESMTPS id 3s8XfY1VLZz16M0P; Wed, 10 Aug 2016 15:53:09 +0200 (CEST) Received: from VOEXC07W.internal.vodafone.com (145.230.101.27) by VOEXC02W.internal.vodafone.com (145.230.101.22) with Microsoft SMTP Server (TLS) id 14.3.224.2; Wed, 10 Aug 2016 15:53:09 +0200 Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by VOEXC07W.internal.vodafone.com ([145.230.101.27]) with mapi id 14.03.0224.002; Wed, 10 Aug 2016 15:53:08 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Brian Rosen , Andy Hutton Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8lBj1t5W5xui1EmlbeWYjdSbSqBAnICAgAASkwCAAAk/gIAAAxqAgAFHfACAAAW3gIAAAqgAgAAA7ACAACmZwA== Date: Wed, 10 Aug 2016 13:53:06 +0000 Message-ID: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> In-Reply-To: <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_A5D2A283BA581C40B2B81191A1361230C836B5AFVOEXM39Winterna_" MIME-Version: 1.0 Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 13:53:16 -0000 --_000_A5D2A283BA581C40B2B81191A1361230C836B5AFVOEXM39Winterna_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmWQgYWdyZWUgaGVyZS4NCg0KQXQgdGhlIG9yaWdpbmF0aW5nL3NpZ25pbmcgZW5kLCB0aGVy ZSBhcmUgZ29vZCByZWFzb25zIHRvIGludm9sdmUgdGhlIGVudGVycHJpc2UgKGlmIG5vdCBpbml0 aWFsbHksIHRoZW4gY2VydGFpbmx5IGFzIGEgbG9uZ2VyIHRlcm0gc29sdXRpb24pLg0KDQpBdCB0 aGUgdGVybWluYXRpbmcvY2hlY2tpbmcgZW5kLCBJIGRvbuKAmXQg4oCcZ2V04oCdIHdoYXQgaGF2 aW5nIGFuIGVudGVycHJpc2UgZG8gdGhlaXIgb3duIGNoZWNraW5nIGdhaW5zLCBjb21wYXJlZCB0 byBpdCBoYXBwZW5pbmcgYXMgYSBzZXJ2aWNlIGluIHRoZSBuZXR3b3JrLiAgSeKAmW0gbm90IHBo aWxvc29waGljYWxseSBvcHBvc2VkLCBqdXN0IGRvbuKAmXQgc2VlIHRoZSBiZW5lZml0Lg0KDQoo SW5jaWRlbnRhbGx5LCBhbHRob3VnaCB0cmFuc2l0IG5ldHdvcmtzIGNvdWxkIGRvIHRoZSBjaGVj a2luZywgSSBzZWUgaXQgbW9yZSBvY2N1cnJpbmcgYXQgdGhlIHRlcm1pbmF0aW5nIGVuZC4gIFRo ZSB0ZXJtaW5hdGluZyBuZXR3b3JrIG93bnMgdGhlIGNvbW1lcmNpYWwgcmVsYXRpb25zaGlwIHdp dGggdGhlIGVuZCBjdXN0b21lciB0aGF04oCZcyBiZWluZyBpbmNvbnZlbmllbmNlZCBieSBudWlz YW5jZSBjYWxsczsgaXTigJlzIHRoZXkgdGhhdCBjYW4gZGVyaXZlIGNvbW1lcmNpYWwvcHVibGlj LXBvbGljeSBnYWluIG9yIG1ha2UgdGhlaXIgcmVsYXRpb25zaGlwIG1vcmUg4oCcc3RpY2t54oCd IGJ5IGhlbHBpbmcgcHJldmVudCB0aGVzZSkNCg0KQ2hlZXJzDQoNClBhdWwNCg0KRnJvbTogc3Rp ciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJyaWFuIFJvc2Vu DQpTZW50OiAxMCBBdWd1c3QgMjAxNiAxNDoxNQ0KVG86IEFuZHkgSHV0dG9uDQpDYzogSUVURiBT VElSIE1haWwgTGlzdDsgUGF1bCBLeXppdmF0OyBSaWNoYXJkIFNob2NrZXkNClN1YmplY3Q6IFJl OiBbc3Rpcl0gU1RJUidzIGJhc2ljIG9wZXJhdGlvbmFsIG1vZGVsIHdpdGggU0lQDQoNCk1heWJl IEkgZG9u4oCZdCB1bmRlcnN0YW5kIHRoZSBxdWVzdGlvbiwgYnV0IEkgY2VydGFpbmx5IHdhbnQg dG8gc2VlIHRoZSBJZGVudGl0eSBoZWFkZXIgYW5kIHRoZSBKV1Qgc2VudCB0byB0aGUgZGV2aWNl L2VudGVycHJpc2UuICBJIGNlcnRhaW5seSBob3BlIHRoZSBkZXZpY2UvZW50ZXJwcmlzZSB3aWxs IGhhdmUgYWNjZXNzIHRvIHRoZSBQS0kgYW5kIE9DU1Agc2VydmljZSB0byB2YWxpZGF0ZS4gIFRo ZW4gaXQgY2FuIGRlY2lkZSB3aGF0IHRvIGRvIHdpdGggdGhlIGNhbGwuDQoNCklmIHRoZSBuZXR3 b3JrIGRyb3BzIHRoZSBjYWxsIHRoZW4gY2xlYXJseSB0aGUgZW50ZXJwcmlzZSBjYW7igJl0IGRv IGFueXRoaW5nLiAgSWYgdGhlIGRpc3BsYXkgbmFtZSBpcyBjaGFuZ2VkLCBtYXliZSBpdCBjb3Vs ZC4NCg0KQnJpYW4NCg0KT24gQXVnIDEwLCAyMDE2LCBhdCA5OjExIEFNLCBBbmR5IEh1dHRvbiA8 YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNv bT4+IHdyb3RlOg0KDQpPSyB1bmRlcnN0b29kIGJ1dCBpZiB0aGUgY2FsbGVlIGRldmljZSBvciBj b3VsZCBiZSBhbiBlbnRlcnByaXNlIG5ldHdvcmsgaXMgZ29pbmcgdG8gbWFrZSBkZWNpc2lvbnMg YmFzZWQgb24gdGhpcyBkb24ndCB3ZSBuZWVkIHRvIHNwZWNpZnkgdGhlIGluZm9ybWF0aW9uL3Np Z25hbGxpbmcgb24gd2hpY2ggdGhleSBtYWtlIHRoYXQgZGVjaXNpb24/DQoNCkFuZHkNCg0KT24g V2VkLCBBdWcgMTAsIDIwMTYgYXQgMjowMiBQTSwgQnJpYW4gUm9zZW4gPGJyQGJyaWFucm9zZW4u bmV0PG1haWx0bzpickBicmlhbnJvc2VuLm5ldD4+IHdyb3RlOg0KSSBkb27igJl0IHRoaW5rIHRo YXQgaXMgYXQgYWxsIHRydWUuICBJZiB2YWxpZGF0aW9uIGlzIGRvbmUgYXQsIHNheSBhIHRyYW5z aXQgbmV0d29yayBpbnRlcmNvbm5lY3QsIGFuZCB0aGUgdHJhbnNpdCBuZXR3b3JrIHJlZnVzZXMg dG8gYWNjZXB0IHRoZSBjYWxsIHdpdGhvdXQgYSB2YWxpZCBzaWduYXR1cmUgKGFzc3VtaW5nIGl0 IGRvZXMgbm90IHJ1biBhZm91bCBvZiBpdHMgbG9jYWwgcmVndWxhdGlvbnMgaW4gZG9pbmcgc28p LCB0aGVuIHRoZXJlIGlzIHZhbHVlIHRvIHRoZSBjb25zdW1lci4gIElmIHRoZSB0ZXJtaW5hdGlv biBuZXR3b3JrIGRvZXMgdGhlIHNhbWUsIHZhbHVlLiAgSWYgdGhlIHRlcm1pbmF0aW9uIG5ldHdv cmsgbW9kaWZpZXMgdGhlIHNpZ25hbGluZyB0b3dhcmRzIHRoZSBjb25zdW1lciBzbyB0aGF0IHRo ZSBkaXNwbGF5IG5hbWUgaXMg4oCcc3VzcGljaW91cyBjYWxs4oCdIG9yICDigJx1bmtub3duIGNh bGxlcuKAnSwgdGhhdCBpcyBvZiBncmVhdCB2YWx1ZSB0byB0aGUgY29uc3VtZXIuICBJZiBpdCBv ZmZlcnMgYW4gb3B0aW9uIHRvIHRoZSBjb25zdW1lciB0byBzZW5kIGNhbGxzIHdpdGggYmFkIHNp Z25hdHVyZXMgb3Igbm8gc2lnbmF0dXJlcyBkaXJlY3QgdG8gdm9pY2VtYWlsLCB0aGF0IGlzIG9m IGdyZWF0IHZhbHVlLg0KDQpTbywgd2hpbGUgSSByZWFsbHksIHJlYWxseSBkbyB3YW50IHRvIGRv IHRoZSB2YWxpZGF0aW9uIG9uIHRoZSBkZXZpY2UgKGJlY2F1c2UgdGhlIGNvbnN1bWVyIHdpbGwg aGF2ZSBtb3JlIG9wdGlvbnMgYXZhaWxhYmxlIG9mIHRoYXQgaXMgd2hhdCBoYXBwZW5zKSwgSSB0 aGluayB0aGUgbWVjaGFuaXNtIGNhbiBoZWxwIGNvbnN1bWVycyB3YXkgYmVmb3JlIGl0IHNob3dz IHVwIG9uIHRoZSBkZXZpY2UgYW5kIHRoZSBkZXZpY2UgaXMgYWJsZSB0byBkbyBzb21ldGhpbmcg d2l0aCBpdC4NCg0KQnJpYW4NCg0KT24gQXVnIDEwLCAyMDE2LCBhdCA4OjQxIEFNLCBBbmR5IEh1 dHRvbiA8YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86YW5keWh1dHRvbi5pZXRmQGdt YWlsLmNvbT4+IHdyb3RlOg0KDQoNCkFsc28gYXMgRGF2ZSBDcm9ja2VyIHBvaW50ZWQgb3V0IHdo YXQgaGFwcGVucyBhdCB0aGUgY2FsbGVlIGlzIGFsc28gaW1wb3J0YW50IGlmIG5vIHZhbGlkYXRp b24gaXMgcG9zc2libGUgYXQgdGhlIGNhbGxlZSdzIGRldmljZSB0aGVuIHN1cmVseSB0aGVyZSBp cyBubyByZWFsIGJlbmVmaXQgdG8gdGhlIGNvbnN1bWVyLg0KDQpSZWdhcmRzDQpBbmR5DQoNCk9u IFR1ZSwgQXVnIDksIDIwMTYgYXQgNjowOSBQTSwgUmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNo b2NrZXkudXM8bWFpbHRvOnJpY2hhcmRAc2hvY2tleS51cz4+IHdyb3RlOg0KDQoNCk9uIDgvOS8x NiwgMTI6NTggUE0sICJzdGlyIG9uIGJlaGFsZiBvZiBQYXVsIEt5eml2YXQiIDxzdGlyLWJvdW5j ZXNAaWV0Zi5vcmc8bWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIHBr eXppdmF0QGFsdW0ubWl0LmVkdTxtYWlsdG86cGt5eml2YXRAYWx1bS5taXQuZWR1Pj4gd3JvdGU6 DQoNCiAgICBPbiA4LzkvMTYgMTI6MjUgUE0sIFJpY2hhcmQgU2hvY2tleSB3cm90ZToNCiAgICA+ DQogICAgPiArMSBpdCBoYXMgdG8gc3RhcnQgc29tZSB3aGVyZS4NCiAgICA+DQogICAgPiBUaGUg Y2lyY2xlcyBvZiB0cnVzdCBzdGFydCBmaXJzdCB3aXRoIHRoZSBjaXJjbGVzIG9mIGF1dGhvcml0 eSBhbmQgdGhlbiBjYW4gYmUgZGVsZWdhdGVkIGFzIHJlcXVpcmVtZW50cyBkaWN0YXRlLiAgVGhl IGludGVncml0eSBudW1iZXJpbmcgcGxhbiBpcyBhIGRpcmVjdCBhbmQgcGxlbmFyeSByZXNwb25z aWJpbGl0eSBvZiBOUkHigJlzIHBlcmlvZCBmdWxsIHN0b3AuDQogICAgPg0KICAgID4gSeKAmW0g bGVzcyBjb25maWRlbnQgd2Ugd2lsbCBldmVyIGdldCB0byB0aGUgZGV2aWNlIGxldmVsLi5hdCBs ZWFzdCBub3QgZm9yIHRoZSBmb3JlZWFibGUgZnV0dXJlIGFrYSBteSBsaWZldGltZS4NCg0KICAg IElmIHRoZSBTUHMgaGF2ZSBhbiBpbmNlbnRpdmUgdG8gKm5vdCogZGVsZWdhdGUgdGhlbiBpdCB3 aWxsIGJlIHZlcnkgaGFyZA0KICAgIHRvIGdldCB0aGVyZS4NCg0KUlM+IE5vdCBvdXIgY29uY2Vy bi4gICBXYXkgYmV5b25kIG91ciBzY29wZSBvZiBjb21wZXRlbmNlIGhlcmUuIERvbuKAmXQgZm9y Z2V0IHRoZSBOUkHigJlzIGhhdmUgdGhlIHJlYWwg4oCcTWF4d2VsbOKAmXMgU2lsdmVyIEhhbW1l cuKAnSBhbmQgeW91IGNhbiBiZSBzdXJlIHRoZXkgY2FuIHVzZSBpdCBpZiBkZWxlZ2F0aW9uIG9y IGxhY2sgdGhlcmVvZiBpcyBwZXJjZWl2ZWQgdG8gYmUgYW50aSBjb21wZXRpdGl2ZS4NCg0KDQog ICAgT1RPSCwgaWYgdGhleSBoYXZlIGFuIGluY2VudGl2ZSB0aGVuIHRoZSBjaGFuY2VzIGFyZSBi ZXR0ZXIuDQoNCiAgICBCcmlhbiBhbmQgUGF1bCBSIG91dGxpbmVkIHNvbWUgcG9zc2libGUgaW5j ZW50aXZlcyB0byBkZWxlZ2F0ZS4gVGhhdA0KICAgIGdpdmVzIHNvbWUgaG9wZS4NCg0KICAgICAg ICBUaGFua3MsDQogICAgICAgIFBhdWwNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQpzdGlyIG1haWxpbmcgbGlzdA0Kc3RpckBpZXRmLm9yZzxt YWlsdG86c3RpckBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vc3Rpcg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0Kc3RpciBtYWlsaW5nIGxpc3QNCnN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCg0KDQoNCg== --_000_A5D2A283BA581C40B2B81191A1361230C836B5AFVOEXM39Winterna_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5ob2VuemINCgl7bXNvLXN0eWxl LW5hbWU6aG9lbnpiO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6 IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQg NzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYi IC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl bGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0K PC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0i RU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rp b24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztj b2xvcjojMUY0OTdEIj5J4oCZZCBhZ3JlZSBoZXJlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+QXQgdGhlIG9yaWdpbmF0 aW5nL3NpZ25pbmcgZW5kLCB0aGVyZSBhcmUgZ29vZCByZWFzb25zIHRvIGludm9sdmUgdGhlIGVu dGVycHJpc2UgKGlmIG5vdCBpbml0aWFsbHksIHRoZW4gY2VydGFpbmx5IGFzIGEgbG9uZ2VyIHRl cm0gc29sdXRpb24pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2Vy aWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+QXQgdGhlIHRlcm1pbmF0aW5nL2NoZWNraW5nIGVuZCwg SSBkb27igJl0IOKAnGdldOKAnSB3aGF0IGhhdmluZyBhbiBlbnRlcnByaXNlIGRvIHRoZWlyIG93 biBjaGVja2luZyBnYWlucywgY29tcGFyZWQgdG8gaXQgaGFwcGVuaW5nIGFzIGEgc2VydmljZSBp biB0aGUgbmV0d29yay4mbmJzcDsNCiBJ4oCZbSBub3QgcGhpbG9zb3BoaWNhbGx5IG9wcG9zZWQs IGp1c3QgZG9u4oCZdCBzZWUgdGhlIGJlbmVmaXQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj4oSW5jaWRlbnRhbGx5LCBh bHRob3VnaCB0cmFuc2l0IG5ldHdvcmtzIGNvdWxkIGRvIHRoZSBjaGVja2luZywgSSBzZWUgaXQg bW9yZSBvY2N1cnJpbmcgYXQgdGhlIHRlcm1pbmF0aW5nIGVuZC4mbmJzcDsgVGhlIHRlcm1pbmF0 aW5nIG5ldHdvcmsgb3ducyB0aGUgY29tbWVyY2lhbA0KIHJlbGF0aW9uc2hpcCB3aXRoIHRoZSBl bmQgY3VzdG9tZXIgdGhhdOKAmXMgYmVpbmcgaW5jb252ZW5pZW5jZWQgYnkgbnVpc2FuY2UgY2Fs bHM7IGl04oCZcyB0aGV5IHRoYXQgY2FuIGRlcml2ZSBjb21tZXJjaWFsL3B1YmxpYy1wb2xpY3kg Z2FpbiBvciBtYWtlIHRoZWlyIHJlbGF0aW9uc2hpcCBtb3JlIOKAnHN0aWNreeKAnSBieSBoZWxw aW5nIHByZXZlbnQgdGhlc2UpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fu cy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5DaGVlcnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPlBhdWw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2Vy aWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBw dDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+RnJvbTo8L3NwYW4+PC9iPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+IHN0aXIgW21haWx0bzpzdGly LWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkJyaWFuIFJvc2VuPGJyPg0K PGI+U2VudDo8L2I+IDEwIEF1Z3VzdCAyMDE2IDE0OjE1PGJyPg0KPGI+VG86PC9iPiBBbmR5IEh1 dHRvbjxicj4NCjxiPkNjOjwvYj4gSUVURiBTVElSIE1haWwgTGlzdDsgUGF1bCBLeXppdmF0OyBS aWNoYXJkIFNob2NrZXk8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtzdGlyXSBTVElSJ3MgYmFz aWMgb3BlcmF0aW9uYWwgbW9kZWwgd2l0aCBTSVA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5NYXliZSBJIGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUgcXVlc3Rp b24sIGJ1dCBJIGNlcnRhaW5seSB3YW50IHRvIHNlZSB0aGUgSWRlbnRpdHkgaGVhZGVyIGFuZCB0 aGUgSldUIHNlbnQgdG8gdGhlIGRldmljZS9lbnRlcnByaXNlLiAmbmJzcDtJIGNlcnRhaW5seSBo b3BlIHRoZSBkZXZpY2UvZW50ZXJwcmlzZSB3aWxsIGhhdmUgYWNjZXNzIHRvIHRoZSBQS0kgYW5k IE9DU1Agc2VydmljZSB0byB2YWxpZGF0ZS4gJm5ic3A7VGhlbiBpdA0KIGNhbiBkZWNpZGUgd2hh dCB0byBkbyB3aXRoIHRoZSBjYWxsLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SWYgdGhlIG5ldHdvcmsgZHJvcHMgdGhlIGNhbGwgdGhlbiBjbGVhcmx5IHRo ZSBlbnRlcnByaXNlIGNhbuKAmXQgZG8gYW55dGhpbmcuICZuYnNwO0lmIHRoZSBkaXNwbGF5IG5h bWUgaXMgY2hhbmdlZCwgbWF5YmUgaXQgY291bGQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJyaWFuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBdWcgMTAsIDIwMTYsIGF0IDk6MTEg QU0sIEFuZHkgSHV0dG9uICZsdDs8YSBocmVmPSJtYWlsdG86YW5keWh1dHRvbi5pZXRmQGdtYWls LmNvbSI+YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T0sgdW5kZXJzdG9vZCBidXQgaWYg dGhlIGNhbGxlZSBkZXZpY2Ugb3IgY291bGQgYmUgYW4gZW50ZXJwcmlzZSBuZXR3b3JrIGlzIGdv aW5nIHRvIG1ha2UgZGVjaXNpb25zIGJhc2VkIG9uIHRoaXMgZG9uJ3Qgd2UgbmVlZCB0byBzcGVj aWZ5IHRoZSBpbmZvcm1hdGlvbi9zaWduYWxsaW5nIG9uIHdoaWNoIHRoZXkgbWFrZSB0aGF0IGRl Y2lzaW9uPzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5k eTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P biBXZWQsIEF1ZyAxMCwgMjAxNiBhdCAyOjAyIFBNLCBCcmlhbiBSb3NlbiAmbHQ7PGEgaHJlZj0i bWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0IiB0YXJnZXQ9Il9ibGFuayI+YnJAYnJpYW5yb3Nlbi5u ZXQ8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5JIGRvbuKAmXQgdGhpbmsgdGhhdCBpcyBhdCBhbGwgdHJ1ZS4mbmJzcDsgSWYgdmFsaWRh dGlvbiBpcyBkb25lIGF0LCBzYXkgYSB0cmFuc2l0IG5ldHdvcmsgaW50ZXJjb25uZWN0LCBhbmQg dGhlIHRyYW5zaXQgbmV0d29yayByZWZ1c2VzIHRvIGFjY2VwdCB0aGUgY2FsbCB3aXRob3V0IGEg dmFsaWQgc2lnbmF0dXJlIChhc3N1bWluZyBpdCBkb2VzIG5vdCBydW4gYWZvdWwgb2YgaXRzIGxv Y2FsIHJlZ3VsYXRpb25zIGluIGRvaW5nDQogc28pLCB0aGVuIHRoZXJlIGlzIHZhbHVlIHRvIHRo ZSBjb25zdW1lci4mbmJzcDsgSWYgdGhlIHRlcm1pbmF0aW9uIG5ldHdvcmsgZG9lcyB0aGUgc2Ft ZSwgdmFsdWUuJm5ic3A7IElmIHRoZSB0ZXJtaW5hdGlvbiBuZXR3b3JrIG1vZGlmaWVzIHRoZSBz aWduYWxpbmcgdG93YXJkcyB0aGUgY29uc3VtZXIgc28gdGhhdCB0aGUgZGlzcGxheSBuYW1lIGlz IOKAnHN1c3BpY2lvdXMgY2FsbOKAnSBvciAmbmJzcDvigJx1bmtub3duIGNhbGxlcuKAnSwgdGhh dCBpcyBvZiBncmVhdCB2YWx1ZSB0bw0KIHRoZSBjb25zdW1lci4mbmJzcDsgSWYgaXQgb2ZmZXJz IGFuIG9wdGlvbiB0byB0aGUgY29uc3VtZXIgdG8gc2VuZCBjYWxscyB3aXRoIGJhZCBzaWduYXR1 cmVzIG9yIG5vIHNpZ25hdHVyZXMgZGlyZWN0IHRvIHZvaWNlbWFpbCwgdGhhdCBpcyBvZiBncmVh dCB2YWx1ZS48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNv LCB3aGlsZSBJIHJlYWxseSwgcmVhbGx5IGRvIHdhbnQgdG8gZG8gdGhlIHZhbGlkYXRpb24gb24g dGhlIGRldmljZSAoYmVjYXVzZSB0aGUgY29uc3VtZXIgd2lsbCBoYXZlIG1vcmUgb3B0aW9ucyBh dmFpbGFibGUgb2YgdGhhdCBpcyB3aGF0IGhhcHBlbnMpLCBJIHRoaW5rIHRoZSBtZWNoYW5pc20g Y2FuIGhlbHAgY29uc3VtZXJzIHdheSBiZWZvcmUgaXQgc2hvd3MgdXAgb24gdGhlIGRldmljZSBh bmQgdGhlDQogZGV2aWNlIGlzIGFibGUgdG8gZG8gc29tZXRoaW5nIHdpdGggaXQuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6Izg4ODg4OCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPkJyaWFu PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBdWcgMTAsIDIwMTYsIGF0IDg6NDEgQU0sIEFuZHkgSHV0 dG9uICZsdDs8YSBocmVmPSJtYWlsdG86YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmFuZHlodXR0b24uaWV0ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsc28gYXMg RGF2ZSBDcm9ja2VyIHBvaW50ZWQgb3V0IHdoYXQgaGFwcGVucyBhdCB0aGUgY2FsbGVlIGlzIGFs c28gaW1wb3J0YW50IGlmIG5vIHZhbGlkYXRpb24gaXMgcG9zc2libGUgYXQgdGhlIGNhbGxlZSdz IGRldmljZSB0aGVuIHN1cmVseSB0aGVyZSBpcyBubyByZWFsIGJlbmVmaXQgdG8gdGhlIGNvbnN1 bWVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5SZWdhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5BbmR5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIFR1ZSwgQXVnIDksIDIwMTYgYXQgNjowOSBQTSwgUmljaGFyZCBTaG9ja2V5ICZs dDs8YSBocmVmPSJtYWlsdG86cmljaGFyZEBzaG9ja2V5LnVzIiB0YXJnZXQ9Il9ibGFuayI+cmlj aGFyZEBzaG9ja2V5LnVzPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCjxicj4NCk9uIDgv OS8xNiwgMTI6NTggUE0sICZxdW90O3N0aXIgb24gYmVoYWxmIG9mIFBhdWwgS3l6aXZhdCZxdW90 OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPnN0aXItYm91bmNlc0BpZXRmLm9yZzwvYT4gb24gYmVoYWxmIG9mDQo8YSBocmVmPSJtYWls dG86cGt5eml2YXRAYWx1bS5taXQuZWR1IiB0YXJnZXQ9Il9ibGFuayI+cGt5eml2YXRAYWx1bS5t aXQuZWR1PC9hPiZndDsgd3JvdGU6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBPbiA4LzkvMTYg MTI6MjUgUE0sIFJpY2hhcmQgU2hvY2tleSB3cm90ZTo8YnI+DQombmJzcDsgJm5ic3A7ICZndDs8 YnI+DQombmJzcDsgJm5ic3A7ICZndDsgJiM0MzsxIGl0IGhhcyB0byBzdGFydCBzb21lIHdoZXJl Ljxicj4NCiZuYnNwOyAmbmJzcDsgJmd0Ozxicj4NCiZuYnNwOyAmbmJzcDsgJmd0OyBUaGUgY2ly Y2xlcyBvZiB0cnVzdCBzdGFydCBmaXJzdCB3aXRoIHRoZSBjaXJjbGVzIG9mIGF1dGhvcml0eSBh bmQgdGhlbiBjYW4gYmUgZGVsZWdhdGVkIGFzIHJlcXVpcmVtZW50cyBkaWN0YXRlLiZuYnNwOyBU aGUgaW50ZWdyaXR5IG51bWJlcmluZyBwbGFuIGlzIGEgZGlyZWN0IGFuZCBwbGVuYXJ5IHJlc3Bv bnNpYmlsaXR5IG9mIE5SQeKAmXMgcGVyaW9kIGZ1bGwgc3RvcC48YnI+DQombmJzcDsgJm5ic3A7 ICZndDs8YnI+DQombmJzcDsgJm5ic3A7ICZndDsgSeKAmW0gbGVzcyBjb25maWRlbnQgd2Ugd2ls bCBldmVyIGdldCB0byB0aGUgZGV2aWNlIGxldmVsLi5hdCBsZWFzdCBub3QgZm9yIHRoZSBmb3Jl ZWFibGUgZnV0dXJlIGFrYSBteSBsaWZldGltZS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7IElm IHRoZSBTUHMgaGF2ZSBhbiBpbmNlbnRpdmUgdG8gKm5vdCogZGVsZWdhdGUgdGhlbiBpdCB3aWxs IGJlIHZlcnkgaGFyZDxicj4NCiZuYnNwOyAmbmJzcDsgdG8gZ2V0IHRoZXJlLjxicj4NCjxicj4N ClJTJmd0OyBOb3Qgb3VyIGNvbmNlcm4uJm5ic3A7ICZuYnNwO1dheSBiZXlvbmQgb3VyIHNjb3Bl IG9mIGNvbXBldGVuY2UgaGVyZS4gRG9u4oCZdCBmb3JnZXQgdGhlIE5SQeKAmXMgaGF2ZSB0aGUg cmVhbCDigJxNYXh3ZWxs4oCZcyBTaWx2ZXIgSGFtbWVy4oCdIGFuZCB5b3UgY2FuIGJlIHN1cmUg dGhleSBjYW4gdXNlIGl0IGlmIGRlbGVnYXRpb24gb3IgbGFjayB0aGVyZW9mIGlzIHBlcmNlaXZl ZCB0byBiZSBhbnRpIGNvbXBldGl0aXZlLjxicj4NCjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsg T1RPSCwgaWYgdGhleSBoYXZlIGFuIGluY2VudGl2ZSB0aGVuIHRoZSBjaGFuY2VzIGFyZSBiZXR0 ZXIuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBCcmlhbiBhbmQgUGF1bCBSIG91dGxpbmVkIHNv bWUgcG9zc2libGUgaW5jZW50aXZlcyB0byBkZWxlZ2F0ZS4gVGhhdDxicj4NCiZuYnNwOyAmbmJz cDsgZ2l2ZXMgc29tZSBob3BlLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyBUaGFua3MsPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFBhdWw8YnI+DQo8YnI+ DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188 YnI+DQpzdGlyIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+c3RpckBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXIiIHRhcmdldD0iX2JsYW5rIj5odHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpzdGlyIG1haWxpbmcgbGlzdDxi cj4NCjxhIGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+c3RpckBp ZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3N0aXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3N0aXI8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A5D2A283BA581C40B2B81191A1361230C836B5AFVOEXM39Winterna_-- From nobody Wed Aug 10 07:00:57 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3462E12D73C for ; Wed, 10 Aug 2016 07:00:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKzN6ndg3TYG for ; Wed, 10 Aug 2016 07:00:53 -0700 (PDT) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73F1212D0CD for ; Wed, 10 Aug 2016 07:00:53 -0700 (PDT) Received: by mail-qk0-x22a.google.com with SMTP id l2so43989751qkf.3 for ; Wed, 10 Aug 2016 07:00:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=Fuezv3tP923WKMUc2x3kXy0ONcNr8bbeHy8NrTavO+A=; b=kZxSXYeYh5jcOhSJ0owutk3l4mVmmlvpT2ZlRnOki7br10Fi7GLBioeSxF6YpqyG5x O+3CxLGRPmUTjQWkdc6ooPE3AiyEOxqh7f9uPhvjL6MXtttW/KfeTtHBEyG8SPUCkw9t y+o8EfxGT+9z2NCVpVJ85ad9JhUkRedeSMjsUzSfs4oIwbVq94Nk/kmodLRtL+BjPPDi p2FI+lg49Mwk5LgKHyxT/520wc61Dm4PGbUd9ijo57bQu542wRvNA7/lAr17jplocsCX ke2XLirk0h40xs+rpHfsDbJaebO4C5KqckSiuUDmcfBMeHD6r+2PxJmZKiI0hHcB41jy Ig2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=Fuezv3tP923WKMUc2x3kXy0ONcNr8bbeHy8NrTavO+A=; b=amH7mektG0yMJRQ7Rky/6NT7BZ03mgO/Co69fLvJ79V63QaH6WpUgkaL1mLq9EjQ2D wyWFEWq0HGFeQEnJAgsXINiqx8qwLDI5EZTlBs/+JjDTsuE7s/G8s98QqN4x5pKHFdQ5 tIurLpKFxKHh5TC5D+fDjuGm/eIfG9hsqjQ62xHAtIEC/usQMCP2mFgbS0aS+GEFpfE3 bwMZ+TQA3in06qWE0LPbDLtGOubQrkO0xmVYf8LJnMvUh+dCFcgHjJevFZGailq/NA8m dewMdDm1yr2wRIk+HhtVuH+82wyghok9R2i0uXfXHCNXpAVfCLDuKgrgBaFA7nVSU0hx Jwtg== X-Gm-Message-State: AEkoouvaxFjZ2PArqPleqKjOZ3IGk8SMZTQaz/jGrRuF8FA5Uw0xAswEw2pJgizZgofU8A== X-Received: by 10.55.17.211 with SMTP id 80mr4285016qkr.208.1470837652493; Wed, 10 Aug 2016 07:00:52 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id 73sm23245542qtc.16.2016.08.10.07.00.50 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 10 Aug 2016 07:00:51 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_9045D1C1-ECC6-4F26-8EC1-627ECFB874A9" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Wed, 10 Aug 2016 10:00:48 -0400 Message-Id: <7718437B-A5CF-4B7F-B5DB-F201CA1DF469@brianrosen.net> References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> To: "Rosbotham, Paul, Vodafone UK" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Andy Hutton , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:00:56 -0000 --Apple-Mail=_9045D1C1-ECC6-4F26-8EC1-627ECFB874A9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I will give you an argument for checking at a transit network = interconnect: Today, the majority of robocalls are originated on a VoIP network, and = terminated on a network that has some non SIP connection between that = VoiP network and the termination network. We=E2=80=99re rapidly = changing that so that the interconnects will be sip, but there are still = going to be too many non-sip interconnects in the time frame we could = deploy stir. If the transit network changed its interconnect agreements = so that they stated on such and such a date, some percentage of calls it = accepts must be validly signed, and it ratcheted up that percentage over = time, we would cut out =E2=80=9Cbad=E2=80=9D calls close to the source = and not depend on a SIP call path all the way to the termination = network. I think that would be a reasonable, implementable, and meaningful = deployment strategy. It would force the =E2=80=9Cpink=E2=80=9D service = providers to clean up their act.=20 Brian > On Aug 10, 2016, at 9:53 AM, Rosbotham, Paul, Vodafone UK = wrote: >=20 > I=E2=80=99d agree here. > =20 > At the originating/signing end, there are good reasons to involve the = enterprise (if not initially, then certainly as a longer term solution). > =20 > At the terminating/checking end, I don=E2=80=99t =E2=80=9Cget=E2=80=9D = what having an enterprise do their own checking gains, compared to it = happening as a service in the network. I=E2=80=99m not philosophically = opposed, just don=E2=80=99t see the benefit. > =20 > (Incidentally, although transit networks could do the checking, I see = it more occurring at the terminating end. The terminating network owns = the commercial relationship with the end customer that=E2=80=99s being = inconvenienced by nuisance calls; it=E2=80=99s they that can derive = commercial/public-policy gain or make their relationship more = =E2=80=9Csticky=E2=80=9D by helping prevent these) > =20 > Cheers > =20 > Paul > =20 > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen > Sent: 10 August 2016 14:15 > To: Andy Hutton > Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey > Subject: Re: [stir] STIR's basic operational model with SIP > =20 > Maybe I don=E2=80=99t understand the question, but I certainly want to = see the Identity header and the JWT sent to the device/enterprise. I = certainly hope the device/enterprise will have access to the PKI and = OCSP service to validate. Then it can decide what to do with the call. > =20 > If the network drops the call then clearly the enterprise can=E2=80=99t = do anything. If the display name is changed, maybe it could. > =20 > Brian > =20 > On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: > =20 > OK understood but if the callee device or could be an enterprise = network is going to make decisions based on this don't we need to = specify the information/signalling on which they make that decision? > =20 > Andy > =20 > On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: > I don=E2=80=99t think that is at all true. If validation is done at, = say a transit network interconnect, and the transit network refuses to = accept the call without a valid signature (assuming it does not run = afoul of its local regulations in doing so), then there is value to the = consumer. If the termination network does the same, value. If the = termination network modifies the signaling towards the consumer so that = the display name is =E2=80=9Csuspicious call=E2=80=9D or =E2=80=9Cunknown= caller=E2=80=9D, that is of great value to the consumer. If it offers = an option to the consumer to send calls with bad signatures or no = signatures direct to voicemail, that is of great value. > =20 > So, while I really, really do want to do the validation on the device = (because the consumer will have more options available of that is what = happens), I think the mechanism can help consumers way before it shows = up on the device and the device is able to do something with it. > =20 > Brian > =20 > On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: > =20 > =20 > Also as Dave Crocker pointed out what happens at the callee is also = important if no validation is possible at the callee's device then = surely there is no real benefit to the consumer. > =20 > Regards > Andy > =20 > On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: >=20 >=20 > On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" = on behalf = ofpkyzivat@alum.mit.edu > wrote: >=20 > On 8/9/16 12:25 PM, Richard Shockey wrote: > > > > +1 it has to start some where. > > > > The circles of trust start first with the circles of authority = and then can be delegated as requirements dictate. The integrity = numbering plan is a direct and plenary responsibility of NRA=E2=80=99s = period full stop. > > > > I=E2=80=99m less confident we will ever get to the device = level..at least not for the foreeable future aka my lifetime. >=20 > If the SPs have an incentive to *not* delegate then it will be = very hard > to get there. >=20 > RS> Not our concern. Way beyond our scope of competence here. = Don=E2=80=99t forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80= =99s Silver Hammer=E2=80=9D and you can be sure they can use it if = delegation or lack thereof is perceived to be anti competitive. >=20 >=20 > OTOH, if they have an incentive then the chances are better. >=20 > Brian and Paul R outlined some possible incentives to delegate. = That > gives some hope. >=20 > Thanks, > Paul >=20 >=20 >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_9045D1C1-ECC6-4F26-8EC1-627ECFB874A9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I will give you an argument for checking at a transit network = interconnect:

Today, = the majority of robocalls are originated on a VoIP network, and = terminated on a network that has some non SIP connection between that = VoiP network and the termination network.  We=E2=80=99re rapidly = changing that so that the interconnects will be sip, but there are still = going to be too many non-sip interconnects in the time frame we could = deploy stir.  If the transit network changed its interconnect = agreements so that they stated on such and such a date, some percentage = of calls it accepts must be validly signed, and it ratcheted up that = percentage over time, we would cut out =E2=80=9Cbad=E2=80=9D calls close = to the source and not depend on a SIP call path all the way to the = termination network.

I think that would be a reasonable, implementable, and = meaningful deployment strategy.  It would force the =E2=80=9Cpink=E2=80= =9D service providers to clean up their act. 

Brian


On = Aug 10, 2016, at 9:53 AM, Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com> wrote:

I=E2=80=99d agree here.
 
At the = originating/signing end, there are good reasons to involve the = enterprise (if not initially, then certainly as a longer term = solution).
 
At the = terminating/checking end, I don=E2=80=99t =E2=80=9Cget=E2=80=9D what = having an enterprise do their own checking gains, compared to it = happening as a service in the network.  I=E2=80=99m not = philosophically opposed, just don=E2=80=99t see the benefit.
 
(Incidentally, although = transit networks could do the checking, I see it more occurring at the = terminating end.  The terminating network owns the commercial = relationship with the end customer that=E2=80=99s being inconvenienced = by nuisance calls; it=E2=80=99s they that can derive = commercial/public-policy gain or make their relationship more = =E2=80=9Csticky=E2=80=9D by helping prevent these)
 
Cheers
 
Paul
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf = Of Brian Rosen
Sent: 10 August 2016 14:15
To: Andy Hutton
Cc: IETF = STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic = operational model with SIP
 
Maybe I don=E2=80=99t understand the question, but I = certainly want to see the Identity header and the JWT sent to the = device/enterprise.  I certainly hope the device/enterprise will = have access to the PKI and OCSP service to validate.  Then it can = decide what to do with the call.
 
If the network drops the call then clearly the = enterprise can=E2=80=99t do anything.  If the display name is = changed, maybe it could.
 
Brian
 
On Aug 10, 2016, at = 9:11 AM, Andy Hutton <andyhutton.ietf@gmail.com> wrote:
 
OK understood but if the callee device or = could be an enterprise network is going to make decisions based on this = don't we need to specify the information/signalling on which they make = that decision?
 
Andy
 
On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen <br@brianrosen.net> = wrote:
I don=E2=80=99t think that is at all true.  If = validation is done at, say a transit network interconnect, and the = transit network refuses to accept the call without a valid signature = (assuming it does not run afoul of its local regulations in doing so), = then there is value to the consumer.  If the termination network = does the same, value.  If the termination network modifies the = signaling towards the consumer so that the display name is =E2=80=9Csuspic= ious call=E2=80=9D or  =E2=80=9Cunknown caller=E2=80=9D, that is of = great value to the consumer.  If it offers an option to the = consumer to send calls with bad signatures or no signatures direct to = voicemail, that is of great value.
 
So, while I really, really do want to do the = validation on the device (because the consumer will have more options = available of that is what happens), I think the mechanism can help = consumers way before it shows up on the device and the device is able to = do something with it.
 
Brian
 
On Aug 10, 2016, at = 8:41 AM, Andy Hutton <andyhutton.ietf@gmail.com> wrote:
 
 
Also as Dave Crocker pointed out what happens at the = callee is also important if no validation is possible at the callee's = device then surely there is no real benefit to the consumer.
 
Regards
Andy
 
On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey <richard@shockey.us>= wrote:



On 8/9/16, 12:58 PM, "stir on = behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf ofpkyzivat@alum.mit.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has = to start some where.
    >
 =   > The circles of trust start first with the circles of = authority and then can be delegated as requirements dictate.  The = integrity numbering plan is a direct and plenary responsibility of = NRA=E2=80=99s period full stop.
    >
    > I=E2=80=99m less confident we will ever = get to the device level..at least not for the foreeable future aka my = lifetime.

    If the SPs have an = incentive to *not* delegate then it will be very hard
 =   to get there.

RS> Not our = concern.   Way beyond our scope of competence here. Don=E2=80=99= t forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80=99s = Silver Hammer=E2=80=9D and you can be sure they can use it if delegation = or lack thereof is perceived to be anti competitive.


    OTOH, if they have an incentive = then the chances are better.

    = Brian and Paul R outlined some possible incentives to delegate. That
    gives some hope.

        Thanks,
  =       Paul



_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_9045D1C1-ECC6-4F26-8EC1-627ECFB874A9-- From nobody Wed Aug 10 07:01:47 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 071BA12D7EC for ; Wed, 10 Aug 2016 07:01:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.447 X-Spam-Level: X-Spam-Status: No, score=-5.447 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fccoffice.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WDJTwJ9F5aVc for ; Wed, 10 Aug 2016 07:01:43 -0700 (PDT) Received: from DC-IP-2.fcc.gov (dc-ip-2.fcc.gov [192.104.54.91]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3410412D7E4 for ; Wed, 10 Aug 2016 07:01:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fccoffice.onmicrosoft.com; s=selector1-fcc-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=4oD4sQeeDwGkpXrFB3iCME09LEDl5ppAjAihxgf+qGo=; b=jugmCkwzO/E93z7ksUpxYORrZboDmnNMiKHPlrBxgzuTl41AWBrU2T4TVJiZQOSC2BpJ4ziGTjDz0sN4qSqJuJyc06f1C3Uhu/B47EMSwzKqy0IvPFvYwnK/XJbmPI6eHF6gMKgoPUZAgj0evlKF9uh4aZYdJ0T1vmfgucvvoIM= From: Henning Schulzrinne To: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , Andy Hutton Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8lByzi5gOxmQhU6LJZEE+/NGLKBAvgeAgAASkwCAAAk/gIAAAxqAgAFHfACAAAW3gIAAAqgAgAAA7ACAAAqvAIAAAHL8 Date: Wed, 10 Aug 2016 14:01:36 +0000 Message-ID: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Henning.Schulzrinne@fcc.gov; x-ms-office365-filtering-correlation-id: d23fca89-9689-4e5f-ad0d-08d3c126d841 x-microsoft-exchange-diagnostics: 1; CY1PR09MB0636; 6:yLMXnlbGyPB+b9QplIbq9p4rX7jyjVS/z6FJ4IOvRFoaui+/hw4zJcCW2kvpw3HVrvFGfPyS/jGbreJjOyc6j4j4/wy/GQXegLXM1/IQYCaQji9bV0jVQaqXSvLOGtaGWEaqL4IN0pm2stSOK4FRLLhK0K+9mbIKJpgkAtzjfU/G8zkISfjOhysLO/1b/aJRXWsbUn4yxUnw/HjdLUXq0xDYvYvsxBNz21XGRHzggTp79VgZLf0sWvbgWNh5bTotltWly+MUvO4d4GKaPfLo6KoEKPR1WymtX8ogcOlVOR0=; 5:ViPBgpeX14IQ5/DbjEU/PUudwWqJzi5oEBZvSoEeD48Y0ymD2X3r8D8/Y8gpgRdhwNH/aLWz10V9Wpla0Q6RSoSTxoT/uphMvllr/qg3uzMYn8elWFtVteosAu4WSOQtwMPVgodZJskJBzlfsmmQvw==; 24:p/CBw8vWILSzeTyrh2c3C7V7nK9p8KYGBVVKPENnPwVnN0R/yWtC2C3AlqvizKkSo0eamtSG/XAEWxCghSP9CVujlZP285t5oCka/MnF9rI=; 7:/eHP3U8EZRrACKUQMASYLjPT3xRiAKhD/fkR9Bt+bH5ZJPvXIqEcjgelYAD4ObUxN/VluM025FVmT6uN/aRigVn4wpAMKVesf/K+OcFZlPdI/BQIXxPaQcuuB3bJ3eHnp4Osh5oNHmGEAs7PK5B73Z5mmtB2bhxzm9ifKqdXMZupZGKM+mcOD0SBr1jERRvkABNyFV2EF6wKatYb3+X+7tgLRGO9gpjFgTe0gJc/fQNVefJ/uyKIIcCAVdyognHC x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY1PR09MB0636; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(67444318432085)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046); SRVR:CY1PR09MB0636; BCL:0; PCL:0; RULEID:; SRVR:CY1PR09MB0636; x-forefront-prvs: 0030839EEE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(377454003)(24454002)(189002)(199003)(3846002)(3660700001)(2906002)(86362001)(8936002)(6116002)(790700001)(8676002)(102836003)(3280700002)(7906003)(9686002)(76176999)(8666005)(99286002)(81166006)(81156014)(7736002)(7696003)(7846002)(4326007)(74316002)(68736007)(586003)(54356999)(92566002)(76576001)(105586002)(50986999)(19625215002)(189998001)(15975445007)(77096005)(2900100001)(2950100001)(19617315012)(122556002)(19627405001)(106356001)(106116001)(97736004)(33656002)(101416001)(16236675004)(5001770100001)(93886004)(5002640100001)(19580405001)(87936001)(19580395003)(10400500002)(19300405004)(66066001)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR09MB0636; H:CY1PR09MB0634.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: fcc.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR09MB0634D5DDDD2DCE5215A503D7EA1D0CY1PR09MB0634namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Aug 2016 14:01:36.9291 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72970aed-3669-4ca8-b960-dd016bc72973 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR09MB0636 X-OriginatorOrg: fcc.gov Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:01:46 -0000 --_000_CY1PR09MB0634D5DDDD2DCE5215A503D7EA1D0CY1PR09MB0634namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable There are three facets: * checking * marking (translating the checking result into something else, whether tha= t's caller-ID-related information or some SIP header) * call handling (call rejection, voice mail, etc.) based on either authenti= cation status or call origin Unless the terminating carrier performs all three or possibly checking and = marking, the enterprise will need to do that, e.g., to implement a unauthen= ticated-to-voicemail or failed-to-reject policy. Since we currently don't h= ave a good standards-based way to do marking (and it isn't clear that this = offers significant value compared to just doing the checking again), I susp= ect that means that either carriers have to implement both checking and cal= l policy, or the end system has to do both. Some policy options, such as ro= uting to voicemail, seem much easier to do at the enterprise level. Henning ________________________________ From: stir on behalf of Rosbotham, Paul, Vodafone U= K Sent: Wednesday, August 10, 2016 9:53:06 AM To: Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP I=92d agree here. At the originating/signing end, there are good reasons to involve the enter= prise (if not initially, then certainly as a longer term solution). At the terminating/checking end, I don=92t =93get=94 what having an enterpr= ise do their own checking gains, compared to it happening as a service in t= he network. I=92m not philosophically opposed, just don=92t see the benefi= t. (Incidentally, although transit networks could do the checking, I see it mo= re occurring at the terminating end. The terminating network owns the comm= ercial relationship with the end customer that=92s being inconvenienced by = nuisance calls; it=92s they that can derive commercial/public-policy gain o= r make their relationship more =93sticky=94 by helping prevent these) Cheers Paul From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: 10 August 2016 14:15 To: Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP Maybe I don=92t understand the question, but I certainly want to see the Id= entity header and the JWT sent to the device/enterprise. I certainly hope = the device/enterprise will have access to the PKI and OCSP service to valid= ate. Then it can decide what to do with the call. If the network drops the call then clearly the enterprise can=92t do anythi= ng. If the display name is changed, maybe it could. Brian On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: OK understood but if the callee device or could be an enterprise network is= going to make decisions based on this don't we need to specify the informa= tion/signalling on which they make that decision? Andy On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: I don=92t think that is at all true. If validation is done at, say a trans= it network interconnect, and the transit network refuses to accept the call= without a valid signature (assuming it does not run afoul of its local reg= ulations in doing so), then there is value to the consumer. If the termina= tion network does the same, value. If the termination network modifies the= signaling towards the consumer so that the display name is =93suspicious c= all=94 or =93unknown caller=94, that is of great value to the consumer. I= f it offers an option to the consumer to send calls with bad signatures or = no signatures direct to voicemail, that is of great value. So, while I really, really do want to do the validation on the device (beca= use the consumer will have more options available of that is what happens),= I think the mechanism can help consumers way before it shows up on the dev= ice and the device is able to do something with it. Brian On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: Also as Dave Crocker pointed out what happens at the callee is also importa= nt if no validation is possible at the callee's device then surely there is= no real benefit to the consumer. Regards Andy On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" on behalf of pkyzivat@alum.mit.edu> wrote: On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and th= en can be delegated as requirements dictate. The integrity numbering plan = is a direct and plenary responsibility of NRA=92s period full stop. > > I=92m less confident we will ever get to the device level..at least n= ot for the foreeable future aka my lifetime. If the SPs have an incentive to *not* delegate then it will be very har= d to get there. RS> Not our concern. Way beyond our scope of competence here. Don=92t for= get the NRA=92s have the real =93Maxwell=92s Silver Hammer=94 and you can b= e sure they can use it if delegation or lack thereof is perceived to be ant= i competitive. OTOH, if they have an incentive then the chances are better. Brian and Paul R outlined some possible incentives to delegate. That gives some hope. Thanks, Paul _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_CY1PR09MB0634D5DDDD2DCE5215A503D7EA1D0CY1PR09MB0634namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

There are three facets:

* checking

* marking (translating the checking result into something else, whether = that's caller-ID-related information or some SIP header)

* call handling (call rejection, voice mail, etc.) based on either authe= ntication status or call origin


Unless the terminating carrier performs all three or possibly checking a= nd marking, the enterprise will need to do that, e.g., to implement a unaut= henticated-to-voicemail or failed-to-reject policy. Since we currently don'= t have a good standards-based way to do marking (and it isn't clear that this offers significant value compa= red to just doing the checking again), I suspect that means that either car= riers have to implement both checking and call policy, or the end system ha= s to do both. Some policy options, such as routing to voicemail, seem much easier to do at the enterprise lev= el.


Henning

From: stir <stir-bounces= @ietf.org> on behalf of Rosbotham, Paul, Vodafone UK <paul.rosbotham@= vodafone.com>
Sent: Wednesday, August 10, 2016 9:53:06 AM
To: Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP
 

I=92d agree here.

 <= /p>

At the originating/signin= g end, there are good reasons to involve the enterprise (if not initially, = then certainly as a longer term solution).

 <= /p>

At the terminating/checki= ng end, I don=92t =93get=94 what having an enterprise do their own checking= gains, compared to it happening as a service in the network.  I=92m not philosophically opposed, just don=92t see the benefit.

 <= /p>

(Incidentally, although t= ransit networks could do the checking, I see it more occurring at the termi= nating end.  The terminating network owns the commercial relationship with the end customer that=92s being inconvenienced by nuisan= ce calls; it=92s they that can derive commercial/public-policy gain or make= their relationship more =93sticky=94 by helping prevent these)<= /span>

 <= /p>

Cheers<= /p>

 <= /p>

Paul

 <= /p>

From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen
Sent: 10 August 2016 14:15
To: Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

Maybe I don=92t understand the question, but I certa= inly want to see the Identity header and the JWT sent to the device/enterpr= ise.  I certainly hope the device/enterprise will have access to the P= KI and OCSP service to validate.  Then it can decide what to do with the call.

 

If the network drops the call then clearly the enter= prise can=92t do anything.  If the display name is changed, maybe it c= ould.

 

Brian

 

On Aug 10, 2016, at 9:11 AM, Andy Hutton <andyhutton.ietf@gmail.com> wro= te:

 

OK understood but if the callee device or could be a= n enterprise network is going to make decisions based on this don't we need= to specify the information/signalling on which they make that decision?

 

Andy

 

On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen <br@brianrosen.net&g= t; wrote:

I don=92t think that is at all true.  If valida= tion is done at, say a transit network interconnect, and the transit networ= k refuses to accept the call without a valid signature (assuming it does no= t run afoul of its local regulations in doing so), then there is value to the consumer.  If the termination network= does the same, value.  If the termination network modifies the signal= ing towards the consumer so that the display name is =93suspicious call=94 = or  =93unknown caller=94, that is of great value to the consumer.  If it offers an option to the consumer to send calls w= ith bad signatures or no signatures direct to voicemail, that is of great v= alue.

 

So, while I really, really do want to do the validat= ion on the device (because the consumer will have more options available of= that is what happens), I think the mechanism can help consumers way before= it shows up on the device and the device is able to do something with it.

 

Brian

 

On Aug 10, 2016, at 8:41 AM, Andy Hutton <andyhutton.ietf@gma= il.com> wrote:

 

 

Also as Dave Crocker pointed out what happens at the= callee is also important if no validation is possible at the callee's devi= ce then surely there is no real benefit to the consumer.

 

Regards

Andy

 

On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey <= richard@shockey.us<= /a>> wrote:



On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of pkyzivat@alum.mi= t.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has to start some where.
    >
    > The circles of trust start first with the circles of aut= hority and then can be delegated as requirements dictate.  The integri= ty numbering plan is a direct and plenary responsibility of NRA=92s period = full stop.
    >
    > I=92m less confident we will ever get to the device leve= l..at least not for the foreeable future aka my lifetime.

    If the SPs have an incentive to *not* delegate then it will b= e very hard
    to get there.

RS> Not our concern.   Way beyond our scope of competence here= . Don=92t forget the NRA=92s have the real =93Maxwell=92s Silver Hammer=94 = and you can be sure they can use it if delegation or lack thereof is percei= ved to be anti competitive.


    OTOH, if they have an incentive then the chances are better.<= br>
    Brian and Paul R outlined some possible incentives to delegat= e. That
    gives some hope.

        Thanks,
        Paul



_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

 

 

--_000_CY1PR09MB0634D5DDDD2DCE5215A503D7EA1D0CY1PR09MB0634namp_-- From nobody Wed Aug 10 07:07:20 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E5FD12D7A3 for ; Wed, 10 Aug 2016 07:07:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JrbX4qcPkB3a for ; Wed, 10 Aug 2016 07:07:16 -0700 (PDT) Received: from mail1.bemta3.messagelabs.com (mail1.bemta3.messagelabs.com [195.245.230.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3081012D79E for ; Wed, 10 Aug 2016 07:07:15 -0700 (PDT) Received: from [195.245.230.51] by server-1.bemta-3.messagelabs.com id A8/0D-17152-1153BA75; Wed, 10 Aug 2016 14:07:13 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrAKsWRWlGSWpSXmKPExsVy+MWXdl0B09X hBj8f61pcWreVyeLp/WlsFis2HGC1mPHDwGL52m1MDqwef99/YPK4/+0vu8fOWXfZPZYs+cnk MfHjGeYA1ijWzLyk/IoE1oy7tw6xFMz9ylixZMtO9gbGHx8Zuxi5OIQE9jJK7Fw5lbmLkRPIW cUosW1nKkRiBZNE46ozbBDOJkaJ+5ub2UGq2AScJObvXscEYosIKEvsvNXJDlLELDCPUWJy90 WgURwcwgLWEvuu50DU2EjMf9zHBmGXSVxbsYkRxGYRUJXY2buDBcTmFQiVuLZqDgvEFb2sEt+ OlIHYnEC7dp+7wgpiMwrISnxpXA12KbOAuMStJ/PBbpAQEJBYsuc8M4QtKvHy8T9WiJo8iTNL YeYLSpyc+YRlAqPILCTts5CUzUJSNgvoA2YBTYn1u/QhShQlpnQ/ZIewNSRa58xlRxZfwMi+i lGjOLWoLLVI19hAL6koMz2jJDcxM0fX0MBYLze1uDgxPTUnMalYLzk/dxMjMGbrGRgYdzB2nv A7xCjJwaQkyuutujpciC8pP6UyI7E4I76oNCe1+BCjDAeHkgRvvzFQTrAoNT21Ii0zB5g8YNI SHDxKIrxhIGne4oLE3OLMdIjUKUZFKXHeF0ZACQGQREZpHlwbLGFdYpSVEuZlZGBgEOIpSC3K zSxBlX/FKM7BqCTMWwEyniczrwRu+iugxUxAi5NUV4AsLklESEk1MMqF7zj9d/HnRssjf3VOH Tv/ab+wwFqBo8dVOB6564paLXF+Okk8lHlzt/Ryy7p/QVqLl0gW27xY3/B9/sOPt7csMl4RH6 46J9P4ucTE8+63Vlo96WycLpcnOF1YftOlusI7D5TOH0qM3dzOer7pi9GpyXf7WDvz6uNj+A6 Jp/K1ZrEdbgyesEeJpTgj0VCLuag4EQAW/q9tUwMAAA== X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-12.tower-33.messagelabs.com!1470838032!51295453!1 X-Originating-IP: [195.232.244.135] X-StarScan-Received: X-StarScan-Version: 8.84; banners=-,-,- X-VirusChecked: Checked Received: (qmail 6065 invoked from network); 10 Aug 2016 14:07:12 -0000 Received: from mailout03.vodafone.com (HELO mailout03.vodafone.com) (195.232.244.135) by server-12.tower-33.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 10 Aug 2016 14:07:12 -0000 Received: from mailint03.vodafone.com (mailint03.vodafone.com [195.232.244.200]) by mailout03.vodafone.com (Postfix) with ESMTP id 3s8Xym3ZGmz17HLv; Wed, 10 Aug 2016 16:07:12 +0200 (CEST) Received: from mailint03.vodafone.com (localhost [127.0.0.1]) by mailint03.vodafone.com (Postfix) with ESMTP id 3s8Xym2DQBz16QRT; Wed, 10 Aug 2016 16:07:12 +0200 (CEST) Received: from VOEXC01W.internal.vodafone.com (voexc01w.dc-ratingen.de [145.230.101.21]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint03.vodafone.com (Postfix) with ESMTPS id 3s8Xym1mzrz16Pk2; Wed, 10 Aug 2016 16:07:12 +0200 (CEST) Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by VOEXC01W.internal.vodafone.com ([145.230.101.21]) with mapi id 14.03.0224.002; Wed, 10 Aug 2016 16:07:03 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Brian Rosen Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8lBj1t5W5xui1EmlbeWYjdSbSqBAnICAgAASkwCAAAk/gIAAAxqAgAFHfACAAAW3gIAAAqgAgAAA7ACAACmZwP//4z0AgAAimSA= Date: Wed, 10 Aug 2016 14:07:01 +0000 Message-ID: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> <7718437B-A5CF-4B7F-B5DB-F201CA1DF469@brianrosen.net> In-Reply-To: <7718437B-A5CF-4B7F-B5DB-F201CA1DF469@brianrosen.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_A5D2A283BA581C40B2B81191A1361230C836B651VOEXM39Winterna_" MIME-Version: 1.0 Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Andy Hutton , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:07:18 -0000 --_000_A5D2A283BA581C40B2B81191A1361230C836B651VOEXM39Winterna_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWgg4oCTIHRoYXTigJlzIHdoZXJlIHdlIGRpZmZlciAoYXMgaW4gZnJvbSBjb3VudHJ5IHRvIGNv dW50cnksIHJhdGhlciB0aGFuIGluIG9waW5pb24pIOKAkyBieSB0aGUgdGltZSB3ZSBnZXQgdGhl IGR1Y2tzIGluIGEgbGluZSBvbiBTVElSIGltcGxlbWVudGF0aW9uIG9uIHRoaXMgc2lkZSBvZiB0 aGUgcG9uZCwgdGhlIGJ1bGsgb2Ygb3VyIGludGVyY29ubmVjdHMgcHJvYmFibHkgd2lsbCBiZSBT SVDigKYuIOKYug0KDQpGcm9tOiBCcmlhbiBSb3NlbiBbbWFpbHRvOmJyQGJyaWFucm9zZW4ubmV0 XQ0KU2VudDogMTAgQXVndXN0IDIwMTYgMTU6MDENClRvOiBSb3Nib3RoYW0sIFBhdWwsIFZvZGFm b25lIFVLDQpDYzogQW5keSBIdXR0b247IElFVEYgU1RJUiBNYWlsIExpc3Q7IFBhdWwgS3l6aXZh dDsgUmljaGFyZCBTaG9ja2V5DQpTdWJqZWN0OiBSZTogW3N0aXJdIFNUSVIncyBiYXNpYyBvcGVy YXRpb25hbCBtb2RlbCB3aXRoIFNJUA0KDQpJIHdpbGwgZ2l2ZSB5b3UgYW4gYXJndW1lbnQgZm9y IGNoZWNraW5nIGF0IGEgdHJhbnNpdCBuZXR3b3JrIGludGVyY29ubmVjdDoNCg0KVG9kYXksIHRo ZSBtYWpvcml0eSBvZiByb2JvY2FsbHMgYXJlIG9yaWdpbmF0ZWQgb24gYSBWb0lQIG5ldHdvcmss IGFuZCB0ZXJtaW5hdGVkIG9uIGEgbmV0d29yayB0aGF0IGhhcyBzb21lIG5vbiBTSVAgY29ubmVj dGlvbiBiZXR3ZWVuIHRoYXQgVm9pUCBuZXR3b3JrIGFuZCB0aGUgdGVybWluYXRpb24gbmV0d29y ay4gIFdl4oCZcmUgcmFwaWRseSBjaGFuZ2luZyB0aGF0IHNvIHRoYXQgdGhlIGludGVyY29ubmVj dHMgd2lsbCBiZSBzaXAsIGJ1dCB0aGVyZSBhcmUgc3RpbGwgZ29pbmcgdG8gYmUgdG9vIG1hbnkg bm9uLXNpcCBpbnRlcmNvbm5lY3RzIGluIHRoZSB0aW1lIGZyYW1lIHdlIGNvdWxkIGRlcGxveSBz dGlyLiAgSWYgdGhlIHRyYW5zaXQgbmV0d29yayBjaGFuZ2VkIGl0cyBpbnRlcmNvbm5lY3QgYWdy ZWVtZW50cyBzbyB0aGF0IHRoZXkgc3RhdGVkIG9uIHN1Y2ggYW5kIHN1Y2ggYSBkYXRlLCBzb21l IHBlcmNlbnRhZ2Ugb2YgY2FsbHMgaXQgYWNjZXB0cyBtdXN0IGJlIHZhbGlkbHkgc2lnbmVkLCBh bmQgaXQgcmF0Y2hldGVkIHVwIHRoYXQgcGVyY2VudGFnZSBvdmVyIHRpbWUsIHdlIHdvdWxkIGN1 dCBvdXQg4oCcYmFk4oCdIGNhbGxzIGNsb3NlIHRvIHRoZSBzb3VyY2UgYW5kIG5vdCBkZXBlbmQg b24gYSBTSVAgY2FsbCBwYXRoIGFsbCB0aGUgd2F5IHRvIHRoZSB0ZXJtaW5hdGlvbiBuZXR3b3Jr Lg0KDQpJIHRoaW5rIHRoYXQgd291bGQgYmUgYSByZWFzb25hYmxlLCBpbXBsZW1lbnRhYmxlLCBh bmQgbWVhbmluZ2Z1bCBkZXBsb3ltZW50IHN0cmF0ZWd5LiAgSXQgd291bGQgZm9yY2UgdGhlIOKA nHBpbmvigJ0gc2VydmljZSBwcm92aWRlcnMgdG8gY2xlYW4gdXAgdGhlaXIgYWN0Lg0KDQpCcmlh bg0KDQoNCk9uIEF1ZyAxMCwgMjAxNiwgYXQgOTo1MyBBTSwgUm9zYm90aGFtLCBQYXVsLCBWb2Rh Zm9uZSBVSyA8cGF1bC5yb3Nib3RoYW1Adm9kYWZvbmUuY29tPG1haWx0bzpwYXVsLnJvc2JvdGhh bUB2b2RhZm9uZS5jb20+PiB3cm90ZToNCg0KSeKAmWQgYWdyZWUgaGVyZS4NCg0KQXQgdGhlIG9y aWdpbmF0aW5nL3NpZ25pbmcgZW5kLCB0aGVyZSBhcmUgZ29vZCByZWFzb25zIHRvIGludm9sdmUg dGhlIGVudGVycHJpc2UgKGlmIG5vdCBpbml0aWFsbHksIHRoZW4gY2VydGFpbmx5IGFzIGEgbG9u Z2VyIHRlcm0gc29sdXRpb24pLg0KDQpBdCB0aGUgdGVybWluYXRpbmcvY2hlY2tpbmcgZW5kLCBJ IGRvbuKAmXQg4oCcZ2V04oCdIHdoYXQgaGF2aW5nIGFuIGVudGVycHJpc2UgZG8gdGhlaXIgb3du IGNoZWNraW5nIGdhaW5zLCBjb21wYXJlZCB0byBpdCBoYXBwZW5pbmcgYXMgYSBzZXJ2aWNlIGlu IHRoZSBuZXR3b3JrLiAgSeKAmW0gbm90IHBoaWxvc29waGljYWxseSBvcHBvc2VkLCBqdXN0IGRv buKAmXQgc2VlIHRoZSBiZW5lZml0Lg0KDQooSW5jaWRlbnRhbGx5LCBhbHRob3VnaCB0cmFuc2l0 IG5ldHdvcmtzIGNvdWxkIGRvIHRoZSBjaGVja2luZywgSSBzZWUgaXQgbW9yZSBvY2N1cnJpbmcg YXQgdGhlIHRlcm1pbmF0aW5nIGVuZC4gIFRoZSB0ZXJtaW5hdGluZyBuZXR3b3JrIG93bnMgdGhl IGNvbW1lcmNpYWwgcmVsYXRpb25zaGlwIHdpdGggdGhlIGVuZCBjdXN0b21lciB0aGF04oCZcyBi ZWluZyBpbmNvbnZlbmllbmNlZCBieSBudWlzYW5jZSBjYWxsczsgaXTigJlzIHRoZXkgdGhhdCBj YW4gZGVyaXZlIGNvbW1lcmNpYWwvcHVibGljLXBvbGljeSBnYWluIG9yIG1ha2UgdGhlaXIgcmVs YXRpb25zaGlwIG1vcmUg4oCcc3RpY2t54oCdIGJ5IGhlbHBpbmcgcHJldmVudCB0aGVzZSkNCg0K Q2hlZXJzDQoNClBhdWwNCg0KRnJvbTogc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9y Z10gT24gQmVoYWxmIE9mIEJyaWFuIFJvc2VuDQpTZW50OiAxMCBBdWd1c3QgMjAxNiAxNDoxNQ0K VG86IEFuZHkgSHV0dG9uDQpDYzogSUVURiBTVElSIE1haWwgTGlzdDsgUGF1bCBLeXppdmF0OyBS aWNoYXJkIFNob2NrZXkNClN1YmplY3Q6IFJlOiBbc3Rpcl0gU1RJUidzIGJhc2ljIG9wZXJhdGlv bmFsIG1vZGVsIHdpdGggU0lQDQoNCk1heWJlIEkgZG9u4oCZdCB1bmRlcnN0YW5kIHRoZSBxdWVz dGlvbiwgYnV0IEkgY2VydGFpbmx5IHdhbnQgdG8gc2VlIHRoZSBJZGVudGl0eSBoZWFkZXIgYW5k IHRoZSBKV1Qgc2VudCB0byB0aGUgZGV2aWNlL2VudGVycHJpc2UuICBJIGNlcnRhaW5seSBob3Bl IHRoZSBkZXZpY2UvZW50ZXJwcmlzZSB3aWxsIGhhdmUgYWNjZXNzIHRvIHRoZSBQS0kgYW5kIE9D U1Agc2VydmljZSB0byB2YWxpZGF0ZS4gIFRoZW4gaXQgY2FuIGRlY2lkZSB3aGF0IHRvIGRvIHdp dGggdGhlIGNhbGwuDQoNCklmIHRoZSBuZXR3b3JrIGRyb3BzIHRoZSBjYWxsIHRoZW4gY2xlYXJs eSB0aGUgZW50ZXJwcmlzZSBjYW7igJl0IGRvIGFueXRoaW5nLiAgSWYgdGhlIGRpc3BsYXkgbmFt ZSBpcyBjaGFuZ2VkLCBtYXliZSBpdCBjb3VsZC4NCg0KQnJpYW4NCg0KT24gQXVnIDEwLCAyMDE2 LCBhdCA5OjExIEFNLCBBbmR5IEh1dHRvbiA8YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbTxtYWls dG86YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KDQpPSyB1bmRlcnN0b29kIGJ1 dCBpZiB0aGUgY2FsbGVlIGRldmljZSBvciBjb3VsZCBiZSBhbiBlbnRlcnByaXNlIG5ldHdvcmsg aXMgZ29pbmcgdG8gbWFrZSBkZWNpc2lvbnMgYmFzZWQgb24gdGhpcyBkb24ndCB3ZSBuZWVkIHRv IHNwZWNpZnkgdGhlIGluZm9ybWF0aW9uL3NpZ25hbGxpbmcgb24gd2hpY2ggdGhleSBtYWtlIHRo YXQgZGVjaXNpb24/DQoNCkFuZHkNCg0KT24gV2VkLCBBdWcgMTAsIDIwMTYgYXQgMjowMiBQTSwg QnJpYW4gUm9zZW4gPGJyQGJyaWFucm9zZW4ubmV0PG1haWx0bzpickBicmlhbnJvc2VuLm5ldD4+ IHdyb3RlOg0KSSBkb27igJl0IHRoaW5rIHRoYXQgaXMgYXQgYWxsIHRydWUuICBJZiB2YWxpZGF0 aW9uIGlzIGRvbmUgYXQsIHNheSBhIHRyYW5zaXQgbmV0d29yayBpbnRlcmNvbm5lY3QsIGFuZCB0 aGUgdHJhbnNpdCBuZXR3b3JrIHJlZnVzZXMgdG8gYWNjZXB0IHRoZSBjYWxsIHdpdGhvdXQgYSB2 YWxpZCBzaWduYXR1cmUgKGFzc3VtaW5nIGl0IGRvZXMgbm90IHJ1biBhZm91bCBvZiBpdHMgbG9j YWwgcmVndWxhdGlvbnMgaW4gZG9pbmcgc28pLCB0aGVuIHRoZXJlIGlzIHZhbHVlIHRvIHRoZSBj b25zdW1lci4gIElmIHRoZSB0ZXJtaW5hdGlvbiBuZXR3b3JrIGRvZXMgdGhlIHNhbWUsIHZhbHVl LiAgSWYgdGhlIHRlcm1pbmF0aW9uIG5ldHdvcmsgbW9kaWZpZXMgdGhlIHNpZ25hbGluZyB0b3dh cmRzIHRoZSBjb25zdW1lciBzbyB0aGF0IHRoZSBkaXNwbGF5IG5hbWUgaXMg4oCcc3VzcGljaW91 cyBjYWxs4oCdIG9yICDigJx1bmtub3duIGNhbGxlcuKAnSwgdGhhdCBpcyBvZiBncmVhdCB2YWx1 ZSB0byB0aGUgY29uc3VtZXIuICBJZiBpdCBvZmZlcnMgYW4gb3B0aW9uIHRvIHRoZSBjb25zdW1l ciB0byBzZW5kIGNhbGxzIHdpdGggYmFkIHNpZ25hdHVyZXMgb3Igbm8gc2lnbmF0dXJlcyBkaXJl Y3QgdG8gdm9pY2VtYWlsLCB0aGF0IGlzIG9mIGdyZWF0IHZhbHVlLg0KDQpTbywgd2hpbGUgSSBy ZWFsbHksIHJlYWxseSBkbyB3YW50IHRvIGRvIHRoZSB2YWxpZGF0aW9uIG9uIHRoZSBkZXZpY2Ug KGJlY2F1c2UgdGhlIGNvbnN1bWVyIHdpbGwgaGF2ZSBtb3JlIG9wdGlvbnMgYXZhaWxhYmxlIG9m IHRoYXQgaXMgd2hhdCBoYXBwZW5zKSwgSSB0aGluayB0aGUgbWVjaGFuaXNtIGNhbiBoZWxwIGNv bnN1bWVycyB3YXkgYmVmb3JlIGl0IHNob3dzIHVwIG9uIHRoZSBkZXZpY2UgYW5kIHRoZSBkZXZp Y2UgaXMgYWJsZSB0byBkbyBzb21ldGhpbmcgd2l0aCBpdC4NCg0KQnJpYW4NCg0KT24gQXVnIDEw LCAyMDE2LCBhdCA4OjQxIEFNLCBBbmR5IEh1dHRvbiA8YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNv bTxtYWlsdG86YW5keWh1dHRvbi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KDQoNCkFsc28gYXMg RGF2ZSBDcm9ja2VyIHBvaW50ZWQgb3V0IHdoYXQgaGFwcGVucyBhdCB0aGUgY2FsbGVlIGlzIGFs c28gaW1wb3J0YW50IGlmIG5vIHZhbGlkYXRpb24gaXMgcG9zc2libGUgYXQgdGhlIGNhbGxlZSdz IGRldmljZSB0aGVuIHN1cmVseSB0aGVyZSBpcyBubyByZWFsIGJlbmVmaXQgdG8gdGhlIGNvbnN1 bWVyLg0KDQpSZWdhcmRzDQpBbmR5DQoNCk9uIFR1ZSwgQXVnIDksIDIwMTYgYXQgNjowOSBQTSwg UmljaGFyZCBTaG9ja2V5IDxyaWNoYXJkQHNob2NrZXkudXM8bWFpbHRvOnJpY2hhcmRAc2hvY2tl eS51cz4+IHdyb3RlOg0KDQoNCk9uIDgvOS8xNiwgMTI6NTggUE0sICJzdGlyIG9uIGJlaGFsZiBv ZiBQYXVsIEt5eml2YXQiIDxzdGlyLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnN0aXItYm91bmNl c0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mcGt5eml2YXRAYWx1bS5taXQuZWR1PG1haWx0bzpwa3l6 aXZhdEBhbHVtLm1pdC5lZHU+PiB3cm90ZToNCg0KICAgIE9uIDgvOS8xNiAxMjoyNSBQTSwgUmlj aGFyZCBTaG9ja2V5IHdyb3RlOg0KICAgID4NCiAgICA+ICsxIGl0IGhhcyB0byBzdGFydCBzb21l IHdoZXJlLg0KICAgID4NCiAgICA+IFRoZSBjaXJjbGVzIG9mIHRydXN0IHN0YXJ0IGZpcnN0IHdp dGggdGhlIGNpcmNsZXMgb2YgYXV0aG9yaXR5IGFuZCB0aGVuIGNhbiBiZSBkZWxlZ2F0ZWQgYXMg cmVxdWlyZW1lbnRzIGRpY3RhdGUuICBUaGUgaW50ZWdyaXR5IG51bWJlcmluZyBwbGFuIGlzIGEg ZGlyZWN0IGFuZCBwbGVuYXJ5IHJlc3BvbnNpYmlsaXR5IG9mIE5SQeKAmXMgcGVyaW9kIGZ1bGwg c3RvcC4NCiAgICA+DQogICAgPiBJ4oCZbSBsZXNzIGNvbmZpZGVudCB3ZSB3aWxsIGV2ZXIgZ2V0 IHRvIHRoZSBkZXZpY2UgbGV2ZWwuLmF0IGxlYXN0IG5vdCBmb3IgdGhlIGZvcmVlYWJsZSBmdXR1 cmUgYWthIG15IGxpZmV0aW1lLg0KDQogICAgSWYgdGhlIFNQcyBoYXZlIGFuIGluY2VudGl2ZSB0 byAqbm90KiBkZWxlZ2F0ZSB0aGVuIGl0IHdpbGwgYmUgdmVyeSBoYXJkDQogICAgdG8gZ2V0IHRo ZXJlLg0KDQpSUz4gTm90IG91ciBjb25jZXJuLiAgIFdheSBiZXlvbmQgb3VyIHNjb3BlIG9mIGNv bXBldGVuY2UgaGVyZS4gRG9u4oCZdCBmb3JnZXQgdGhlIE5SQeKAmXMgaGF2ZSB0aGUgcmVhbCDi gJxNYXh3ZWxs4oCZcyBTaWx2ZXIgSGFtbWVy4oCdIGFuZCB5b3UgY2FuIGJlIHN1cmUgdGhleSBj YW4gdXNlIGl0IGlmIGRlbGVnYXRpb24gb3IgbGFjayB0aGVyZW9mIGlzIHBlcmNlaXZlZCB0byBi ZSBhbnRpIGNvbXBldGl0aXZlLg0KDQoNCiAgICBPVE9ILCBpZiB0aGV5IGhhdmUgYW4gaW5jZW50 aXZlIHRoZW4gdGhlIGNoYW5jZXMgYXJlIGJldHRlci4NCg0KICAgIEJyaWFuIGFuZCBQYXVsIFIg b3V0bGluZWQgc29tZSBwb3NzaWJsZSBpbmNlbnRpdmVzIHRvIGRlbGVnYXRlLiBUaGF0DQogICAg Z2l2ZXMgc29tZSBob3BlLg0KDQogICAgICAgIFRoYW5rcywNCiAgICAgICAgUGF1bA0KDQoNCg0K DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0Kc3RpciBt YWlsaW5nIGxpc3QNCnN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQpodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0DQpzdGlyQGll dGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9zdGlyDQoNCg== --_000_A5D2A283BA581C40B2B81191A1361230C836B651VOEXM39Winterna_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAgMDt9 DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3Nl LTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNv Tm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l O30NCnAuTXNvQWNldGF0ZSwgbGkuTXNvQWNldGF0ZSwgZGl2Lk1zb0FjZXRhdGUNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJCYWxsb29uIFRleHQgQ2hhciI7DQoJ bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjguMHB0Ow0K CWZvbnQtZmFtaWx5OiJUYWhvbWEiLCJzYW5zLXNlcmlmIjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRl ZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5C YWxsb29uVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkJhbGxvb24gVGV4dCBDaGFyIjsNCglt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkJhbGxvb24gVGV4dCI7DQoJ Zm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMtc2VyaWYiO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwi c2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4w cHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1 b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5BaCDigJMgdGhhdOKAmXMgd2hlcmUg d2UgZGlmZmVyIChhcyBpbiBmcm9tIGNvdW50cnkgdG8gY291bnRyeSwgcmF0aGVyIHRoYW4gaW4g b3Bpbmlvbikg4oCTIGJ5IHRoZSB0aW1lIHdlIGdldCB0aGUgZHVja3MgaW4gYSBsaW5lIG9uIFNU SVIgaW1wbGVtZW50YXRpb24gb24gdGhpcw0KIHNpZGUgb2YgdGhlIHBvbmQsIHRoZSBidWxrIG9m IG91ciBpbnRlcmNvbm5lY3RzIHByb2JhYmx5IHdpbGwgYmUgU0lQ4oCmLiA8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5 N0QiPko8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fu cy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERG IDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48 L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4gQnJpYW4gUm9zZW4g W21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCjxicj4NCjxiPlNlbnQ6PC9iPiAxMCBBdWd1c3Qg MjAxNiAxNTowMTxicj4NCjxiPlRvOjwvYj4gUm9zYm90aGFtLCBQYXVsLCBWb2RhZm9uZSBVSzxi cj4NCjxiPkNjOjwvYj4gQW5keSBIdXR0b247IElFVEYgU1RJUiBNYWlsIExpc3Q7IFBhdWwgS3l6 aXZhdDsgUmljaGFyZCBTaG9ja2V5PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbc3Rpcl0gU1RJ UidzIGJhc2ljIG9wZXJhdGlvbmFsIG1vZGVsIHdpdGggU0lQPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB3aWxsIGdpdmUgeW91IGFuIGFyZ3VtZW50IGZv ciBjaGVja2luZyBhdCBhIHRyYW5zaXQgbmV0d29yayBpbnRlcmNvbm5lY3Q6PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ub2RheSwgdGhlIG1ham9yaXR5IG9m IHJvYm9jYWxscyBhcmUgb3JpZ2luYXRlZCBvbiBhIFZvSVAgbmV0d29yaywgYW5kIHRlcm1pbmF0 ZWQgb24gYSBuZXR3b3JrIHRoYXQgaGFzIHNvbWUgbm9uIFNJUCBjb25uZWN0aW9uIGJldHdlZW4g dGhhdCBWb2lQIG5ldHdvcmsgYW5kIHRoZSB0ZXJtaW5hdGlvbiBuZXR3b3JrLiAmbmJzcDtXZeKA mXJlIHJhcGlkbHkgY2hhbmdpbmcgdGhhdCBzbyB0aGF0IHRoZSBpbnRlcmNvbm5lY3RzDQogd2ls bCBiZSBzaXAsIGJ1dCB0aGVyZSBhcmUgc3RpbGwgZ29pbmcgdG8gYmUgdG9vIG1hbnkgbm9uLXNp cCBpbnRlcmNvbm5lY3RzIGluIHRoZSB0aW1lIGZyYW1lIHdlIGNvdWxkIGRlcGxveSBzdGlyLiAm bmJzcDtJZiB0aGUgdHJhbnNpdCBuZXR3b3JrIGNoYW5nZWQgaXRzIGludGVyY29ubmVjdCBhZ3Jl ZW1lbnRzIHNvIHRoYXQgdGhleSBzdGF0ZWQgb24gc3VjaCBhbmQgc3VjaCBhIGRhdGUsIHNvbWUg cGVyY2VudGFnZSBvZiBjYWxscyBpdCBhY2NlcHRzDQogbXVzdCBiZSB2YWxpZGx5IHNpZ25lZCwg YW5kIGl0IHJhdGNoZXRlZCB1cCB0aGF0IHBlcmNlbnRhZ2Ugb3ZlciB0aW1lLCB3ZSB3b3VsZCBj dXQgb3V0IOKAnGJhZOKAnSBjYWxscyBjbG9zZSB0byB0aGUgc291cmNlIGFuZCBub3QgZGVwZW5k IG9uIGEgU0lQIGNhbGwgcGF0aCBhbGwgdGhlIHdheSB0byB0aGUgdGVybWluYXRpb24gbmV0d29y ay48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SSB0aGluayB0aGF0IHdvdWxkIGJlIGEgcmVhc29uYWJsZSwgaW1wbGVtZW50YWJsZSwgYW5kIG1l YW5pbmdmdWwgZGVwbG95bWVudCBzdHJhdGVneS4gJm5ic3A7SXQgd291bGQgZm9yY2UgdGhlIOKA nHBpbmvigJ0gc2VydmljZSBwcm92aWRlcnMgdG8gY2xlYW4gdXAgdGhlaXIgYWN0LiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ccmlh bjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBBdWcgMTAsIDIwMTYsIGF0IDk6NTMgQU0sIFJvc2JvdGhhbSwgUGF1bCwgVm9kYWZvbmUg VUsgJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsLnJvc2JvdGhhbUB2b2RhZm9uZS5jb20iPnBhdWwu cm9zYm90aGFtQHZvZGFmb25lLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2Nv bG9yOiMxRjQ5N0QiPknigJlkIGFncmVlIGhlcmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1 b3Q7O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztj b2xvcjojMUY0OTdEIj5BdCB0aGUgb3JpZ2luYXRpbmcvc2lnbmluZyBlbmQsIHRoZXJlIGFyZSBn b29kIHJlYXNvbnMgdG8gaW52b2x2ZSB0aGUgZW50ZXJwcmlzZSAoaWYgbm90IGluaXRpYWxseSwg dGhlbiBjZXJ0YWlubHkgYXMgYSBsb25nZXIgdGVybSBzb2x1dGlvbikuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtz YW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1z ZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5BdCB0aGUgdGVybWluYXRpbmcvY2hlY2tpbmcgZW5k LCBJIGRvbuKAmXQg4oCcZ2V04oCdIHdoYXQgaGF2aW5nIGFuIGVudGVycHJpc2UgZG8gdGhlaXIg b3duIGNoZWNraW5nIGdhaW5zLCBjb21wYXJlZCB0byBpdCBoYXBwZW5pbmcgYXMgYSBzZXJ2aWNl IGluIHRoZSBuZXR3b3JrLiZuYnNwOw0KIEnigJltIG5vdCBwaGlsb3NvcGhpY2FsbHkgb3Bwb3Nl ZCwganVzdCBkb27igJl0IHNlZSB0aGUgYmVuZWZpdC48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7 O2NvbG9yOiMxRjQ5N0QiPihJbmNpZGVudGFsbHksIGFsdGhvdWdoIHRyYW5zaXQgbmV0d29ya3Mg Y291bGQgZG8gdGhlIGNoZWNraW5nLCBJIHNlZSBpdCBtb3JlIG9jY3VycmluZyBhdCB0aGUgdGVy bWluYXRpbmcgZW5kLiZuYnNwOyBUaGUgdGVybWluYXRpbmcgbmV0d29yayBvd25zIHRoZSBjb21t ZXJjaWFsDQogcmVsYXRpb25zaGlwIHdpdGggdGhlIGVuZCBjdXN0b21lciB0aGF04oCZcyBiZWlu ZyBpbmNvbnZlbmllbmNlZCBieSBudWlzYW5jZSBjYWxsczsgaXTigJlzIHRoZXkgdGhhdCBjYW4g ZGVyaXZlIGNvbW1lcmNpYWwvcHVibGljLXBvbGljeSBnYWluIG9yIG1ha2UgdGhlaXIgcmVsYXRp b25zaGlwIG1vcmUg4oCcc3RpY2t54oCdIGJ5IGhlbHBpbmcgcHJldmVudCB0aGVzZSk8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkNoZWVyczwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fu cy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2Vy aWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+UGF1bDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4w cHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEm cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+c3Rpcg0KIFs8YSBocmVmPSJtYWlsdG86c3Rp ci1ib3VuY2VzQGlldGYub3JnIj5tYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3JnPC9hPl08c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24gQmVoYWxm IE9mPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5C cmlhbiBSb3Nlbjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj4xMCBBdWd1c3QgMjAxNiAxNDoxNTxicj4NCjxiPlRvOjwvYj48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+QW5keSBIdXR0 b248YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPklFVEYgU1RJUiBNYWlsIExpc3Q7IFBhdWwgS3l6aXZhdDsgUmljaGFyZCBTaG9j a2V5PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPlJlOiBbc3Rpcl0gU1RJUidzIGJhc2ljIG9wZXJhdGlvbmFsIG1vZGVs IHdpdGggU0lQPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TWF5YmUgSSBkb27igJl0IHVuZGVyc3RhbmQg dGhlIHF1ZXN0aW9uLCBidXQgSSBjZXJ0YWlubHkgd2FudCB0byBzZWUgdGhlIElkZW50aXR5IGhl YWRlciBhbmQgdGhlIEpXVCBzZW50IHRvIHRoZSBkZXZpY2UvZW50ZXJwcmlzZS4gJm5ic3A7SSBj ZXJ0YWlubHkgaG9wZSB0aGUgZGV2aWNlL2VudGVycHJpc2Ugd2lsbCBoYXZlIGFjY2VzcyB0byB0 aGUgUEtJIGFuZCBPQ1NQIHNlcnZpY2UgdG8gdmFsaWRhdGUuICZuYnNwO1RoZW4gaXQNCiBjYW4g ZGVjaWRlIHdoYXQgdG8gZG8gd2l0aCB0aGUgY2FsbC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHRo ZSBuZXR3b3JrIGRyb3BzIHRoZSBjYWxsIHRoZW4gY2xlYXJseSB0aGUgZW50ZXJwcmlzZSBjYW7i gJl0IGRvIGFueXRoaW5nLiAmbmJzcDtJZiB0aGUgZGlzcGxheSBuYW1lIGlzIGNoYW5nZWQsIG1h eWJlIGl0IGNvdWxkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gQXVnIDEwLCAyMDE2LCBhdCA5OjExIEFNLCBBbmR5IEh1dHRv biAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFuZHlodXR0b24uaWV0ZkBnbWFpbC5jb20iPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmFuZHlodXR0b24uaWV0ZkBnbWFpbC5jb208L3NwYW4+PC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PSyB1bmRlcnN0b29kIGJ1dCBpZiB0aGUgY2Fs bGVlIGRldmljZSBvciBjb3VsZCBiZSBhbiBlbnRlcnByaXNlIG5ldHdvcmsgaXMgZ29pbmcgdG8g bWFrZSBkZWNpc2lvbnMgYmFzZWQgb24gdGhpcyBkb24ndCB3ZSBuZWVkIHRvIHNwZWNpZnkgdGhl IGluZm9ybWF0aW9uL3NpZ25hbGxpbmcgb24gd2hpY2ggdGhleSBtYWtlIHRoYXQgZGVjaXNpb24/ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5BbmR5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdl ZCwgQXVnIDEwLCAyMDE2IGF0IDI6MDIgUE0sIEJyaWFuIFJvc2VuICZsdDs8YSBocmVmPSJtYWls dG86YnJAYnJpYW5yb3Nlbi5uZXQiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5ickBicmlhbnJvc2VuLm5ldDwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGRvbuKA mXQgdGhpbmsgdGhhdCBpcyBhdCBhbGwgdHJ1ZS4mbmJzcDsgSWYgdmFsaWRhdGlvbiBpcyBkb25l IGF0LCBzYXkgYSB0cmFuc2l0IG5ldHdvcmsgaW50ZXJjb25uZWN0LCBhbmQgdGhlIHRyYW5zaXQg bmV0d29yayByZWZ1c2VzIHRvIGFjY2VwdCB0aGUgY2FsbCB3aXRob3V0IGEgdmFsaWQgc2lnbmF0 dXJlIChhc3N1bWluZyBpdCBkb2VzIG5vdCBydW4gYWZvdWwgb2YgaXRzIGxvY2FsIHJlZ3VsYXRp b25zIGluIGRvaW5nDQogc28pLCB0aGVuIHRoZXJlIGlzIHZhbHVlIHRvIHRoZSBjb25zdW1lci4m bmJzcDsgSWYgdGhlIHRlcm1pbmF0aW9uIG5ldHdvcmsgZG9lcyB0aGUgc2FtZSwgdmFsdWUuJm5i c3A7IElmIHRoZSB0ZXJtaW5hdGlvbiBuZXR3b3JrIG1vZGlmaWVzIHRoZSBzaWduYWxpbmcgdG93 YXJkcyB0aGUgY29uc3VtZXIgc28gdGhhdCB0aGUgZGlzcGxheSBuYW1lIGlzIOKAnHN1c3BpY2lv dXMgY2FsbOKAnSBvciAmbmJzcDvigJx1bmtub3duIGNhbGxlcuKAnSwgdGhhdCBpcyBvZiBncmVh dCB2YWx1ZSB0bw0KIHRoZSBjb25zdW1lci4mbmJzcDsgSWYgaXQgb2ZmZXJzIGFuIG9wdGlvbiB0 byB0aGUgY29uc3VtZXIgdG8gc2VuZCBjYWxscyB3aXRoIGJhZCBzaWduYXR1cmVzIG9yIG5vIHNp Z25hdHVyZXMgZGlyZWN0IHRvIHZvaWNlbWFpbCwgdGhhdCBpcyBvZiBncmVhdCB2YWx1ZS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlNvLCB3aGlsZSBJIHJlYWxseSwgcmVhbGx5IGRvIHdhbnQgdG8gZG8g dGhlIHZhbGlkYXRpb24gb24gdGhlIGRldmljZSAoYmVjYXVzZSB0aGUgY29uc3VtZXIgd2lsbCBo YXZlIG1vcmUgb3B0aW9ucyBhdmFpbGFibGUgb2YgdGhhdCBpcyB3aGF0IGhhcHBlbnMpLCBJIHRo aW5rIHRoZSBtZWNoYW5pc20gY2FuIGhlbHAgY29uc3VtZXJzIHdheSBiZWZvcmUgaXQgc2hvd3Mg dXAgb24gdGhlIGRldmljZSBhbmQgdGhlDQogZGV2aWNlIGlzIGFibGUgdG8gZG8gc29tZXRoaW5n IHdpdGggaXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPkJyaWFuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBdWcgMTAsIDIwMTYs IGF0IDg6NDEgQU0sIEFuZHkgSHV0dG9uICZsdDs8YSBocmVmPSJtYWlsdG86YW5keWh1dHRvbi5p ZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PmFuZHlodXR0b24uaWV0ZkBnbWFpbC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbHNvIGFzIERhdmUgQ3JvY2tlciBw b2ludGVkIG91dCB3aGF0IGhhcHBlbnMgYXQgdGhlIGNhbGxlZSBpcyBhbHNvIGltcG9ydGFudCBp ZiBubyB2YWxpZGF0aW9uIGlzIHBvc3NpYmxlIGF0IHRoZSBjYWxsZWUncyBkZXZpY2UgdGhlbiBz dXJlbHkgdGhlcmUgaXMgbm8gcmVhbCBiZW5lZml0IHRvIHRoZSBjb25zdW1lci48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5keTxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBUdWUsIEF1ZyA5LCAyMDE2IGF0IDY6MDkgUE0sIFJpY2hhcmQgU2hvY2tl eSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJpY2hhcmRAc2hvY2tleS51cyIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJpY2hhcmRAc2hvY2tleS51czwvc3Bhbj48L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQo8YnI+DQpPbiA4LzkvMTYsIDEyOjU4 IFBNLCAmcXVvdDtzdGlyIG9uIGJlaGFsZiBvZiBQYXVsIEt5eml2YXQmcXVvdDsgJmx0OzxhIGhy ZWY9Im1haWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5zdGlyLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5vbiBiZWhhbGYgb2Y8 YSBocmVmPSJtYWlsdG86cGt5eml2YXRAYWx1bS5taXQuZWR1IiB0YXJnZXQ9Il9ibGFuayI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGt5eml2YXRAYWx1bS5taXQuZWR1PC9zcGFuPjwvYT4m Z3Q7DQogd3JvdGU6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBPbiA4LzkvMTYgMTI6MjUgUE0s IFJpY2hhcmQgU2hvY2tleSB3cm90ZTo8YnI+DQombmJzcDsgJm5ic3A7ICZndDs8YnI+DQombmJz cDsgJm5ic3A7ICZndDsgJiM0MzsxIGl0IGhhcyB0byBzdGFydCBzb21lIHdoZXJlLjxicj4NCiZu YnNwOyAmbmJzcDsgJmd0Ozxicj4NCiZuYnNwOyAmbmJzcDsgJmd0OyBUaGUgY2lyY2xlcyBvZiB0 cnVzdCBzdGFydCBmaXJzdCB3aXRoIHRoZSBjaXJjbGVzIG9mIGF1dGhvcml0eSBhbmQgdGhlbiBj YW4gYmUgZGVsZWdhdGVkIGFzIHJlcXVpcmVtZW50cyBkaWN0YXRlLiZuYnNwOyBUaGUgaW50ZWdy aXR5IG51bWJlcmluZyBwbGFuIGlzIGEgZGlyZWN0IGFuZCBwbGVuYXJ5IHJlc3BvbnNpYmlsaXR5 IG9mIE5SQeKAmXMgcGVyaW9kIGZ1bGwgc3RvcC48YnI+DQombmJzcDsgJm5ic3A7ICZndDs8YnI+ DQombmJzcDsgJm5ic3A7ICZndDsgSeKAmW0gbGVzcyBjb25maWRlbnQgd2Ugd2lsbCBldmVyIGdl dCB0byB0aGUgZGV2aWNlIGxldmVsLi5hdCBsZWFzdCBub3QgZm9yIHRoZSBmb3JlZWFibGUgZnV0 dXJlIGFrYSBteSBsaWZldGltZS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7IElmIHRoZSBTUHMg aGF2ZSBhbiBpbmNlbnRpdmUgdG8gKm5vdCogZGVsZWdhdGUgdGhlbiBpdCB3aWxsIGJlIHZlcnkg aGFyZDxicj4NCiZuYnNwOyAmbmJzcDsgdG8gZ2V0IHRoZXJlLjxicj4NCjxicj4NClJTJmd0OyBO b3Qgb3VyIGNvbmNlcm4uJm5ic3A7ICZuYnNwO1dheSBiZXlvbmQgb3VyIHNjb3BlIG9mIGNvbXBl dGVuY2UgaGVyZS4gRG9u4oCZdCBmb3JnZXQgdGhlIE5SQeKAmXMgaGF2ZSB0aGUgcmVhbCDigJxN YXh3ZWxs4oCZcyBTaWx2ZXIgSGFtbWVy4oCdIGFuZCB5b3UgY2FuIGJlIHN1cmUgdGhleSBjYW4g dXNlIGl0IGlmIGRlbGVnYXRpb24gb3IgbGFjayB0aGVyZW9mIGlzIHBlcmNlaXZlZCB0byBiZSBh bnRpIGNvbXBldGl0aXZlLjxicj4NCjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgT1RPSCwgaWYg dGhleSBoYXZlIGFuIGluY2VudGl2ZSB0aGVuIHRoZSBjaGFuY2VzIGFyZSBiZXR0ZXIuPGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwOyBCcmlhbiBhbmQgUGF1bCBSIG91dGxpbmVkIHNvbWUgcG9zc2li bGUgaW5jZW50aXZlcyB0byBkZWxlZ2F0ZS4gVGhhdDxicj4NCiZuYnNwOyAmbmJzcDsgZ2l2ZXMg c29tZSBob3BlLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBUaGFua3Ms PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFBhdWw8YnI+DQo8YnI+DQo8YnI+DQo8 YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fPGJyPg0Kc3RpciBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86c3RpckBpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnN0aXJAaWV0 Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vc3RpciIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcjwvc3Bhbj48L2E+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188YnI+DQpzdGlyIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9 Im1haWx0bzpzdGlyQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+c3RpckBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9zdGlyPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A5D2A283BA581C40B2B81191A1361230C836B651VOEXM39Winterna_-- From nobody Wed Aug 10 07:12:41 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD22212D575 for ; Wed, 10 Aug 2016 07:12:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4qgthoIB2yag for ; Wed, 10 Aug 2016 07:12:37 -0700 (PDT) Received: from mail1.bemta14.messagelabs.com (mail1.bemta14.messagelabs.com [193.109.254.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01FA512D130 for ; Wed, 10 Aug 2016 07:12:36 -0700 (PDT) Received: from [193.109.255.99] by server-12.bemta-14.messagelabs.com id FA/75-28536-3563BA75; Wed, 10 Aug 2016 14:12:35 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrFKsWRWlGSWpSXmKPExsVy+MWXNt0gs9X hBq83iVhcWreVyeLp/WlsFj+P7Ga1WLHhAKvFjB8GFsvXbmNyYPP4+/4Dk8f9b3/ZPW7ffsPm sXPWXXaPJUt+MnlM/HiGOYAtijUzLym/IoE1Y+bBZ0wFTQcYK55OucjSwPhnJWMXIxeHkMAeR omH3e9YIJxVjBLn3tyDyqxgknj2ZS8bhHOEUaL/4Ayoss2MEj0LtgBlODnYBJwk5u9exwSSEB FoYJRYPXkHK0iCWaBE4v3kycxdjBwcwgLWEvuu54CERQRsJOY/7mODsMskLh5ZwwhiswioShy c/wfM5hUIlTh6aT07xLLlrBJrrq0Gm8kpECvR8mADC4jNKCAr8aVxNTPELnGJW0/mM4HYEgIC Ekv2nGeGsEUlXj7+B3VPnsSplrVsEAsEJU7OfMIygVF0FpL2WUjKZiEpg4jrSCzY/YkNwtaWW LbwNTOMfebAYyZk8QWM7KsYNYpTi8pSi3SNTPSSijLTM0pyEzNzdA0NTfRyU4uLE9NTcxKTiv WS83M3MQLjvJ6BgXEH489LfocYJTmYlER5vVVXhwvxJeWnVGYkFmfEF5XmpBYfYpTh4FCS4GU wBcoJFqWmp1akZeYAEw5MWoKDR0mE97sJUJq3uCAxtzgzHSJ1ilFRSpyXEaRPACSRUZoH1wZL cpcYZaWEeRkZGBiEeApSi3IzS1DlXzGKczAqCfNKgUzhycwrgZv+CmgxE9DiJNUVIItLEhFSU g2Mp62TDln3Tnh/jlE8rUXiSsrfVbydEUdW/suc4fk2ccOJh4885nrOTeu+s6pj64Y9kZ0PzJ nzImc8uaW+bN3Esif7BeZ92GKicvVFRsfFRpb7/y6YOi7pPBoyY2KW9Pzg/kcG/7ha0h6q9YR PUtSbJmGr5bhb9q+m37Ig60Tpc7buNZ922t18q8RSnJFoqMVcVJwIANKrvNZtAwAA X-Env-Sender: paul.rosbotham@vodafone.com X-Msg-Ref: server-6.tower-48.messagelabs.com!1470838353!63526100!1 X-Originating-IP: [195.232.244.134] X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 21096 invoked from network); 10 Aug 2016 14:12:34 -0000 Received: from mailout02.vodafone.com (HELO mailout02.vodafone.com) (195.232.244.134) by server-6.tower-48.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 10 Aug 2016 14:12:34 -0000 Received: from mailint03.vodafone.com (mailint03.vodafone.com [195.232.244.200]) by mailout02.vodafone.com (Postfix) with ESMTP id 3s8Y4x2NPFzbdsL; Wed, 10 Aug 2016 16:12:33 +0200 (CEST) Received: from mailint03.vodafone.com (localhost [127.0.0.1]) by mailint03.vodafone.com (Postfix) with ESMTP id 3s8Y3P5XxXz16QLx; Wed, 10 Aug 2016 16:11:13 +0200 (CEST) Received: from VOEXC03W.internal.vodafone.com (voexc03w.dc-ratingen.de [145.230.101.23]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailint03.vodafone.com (Postfix) with ESMTPS id 3s8Y3P5DqWz16QVm; Wed, 10 Aug 2016 16:11:13 +0200 (CEST) Received: from AVOEXH04W.internal.vodafone.com (145.230.15.136) by VOEXC03W.internal.vodafone.com (145.230.101.23) with Microsoft SMTP Server (TLS) id 14.3.224.2; Wed, 10 Aug 2016 16:11:12 +0200 Received: from VOEXM39W.internal.vodafone.com ([169.254.7.40]) by AVOEXH04W.internal.vodafone.com ([145.230.15.136]) with mapi id 14.03.0224.002; Wed, 10 Aug 2016 16:11:12 +0200 From: "Rosbotham, Paul, Vodafone UK" To: Henning Schulzrinne , Brian Rosen , Andy Hutton Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8lBj1t5W5xui1EmlbeWYjdSbSqBAnICAgAASkwCAAAk/gIAAAxqAgAFHfACAAAW3gIAAAqgAgAAA7ACAACmZwP//43YAgAAjLaA= Date: Wed, 10 Aug 2016 14:11:10 +0000 Message-ID: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net>, In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_A5D2A283BA581C40B2B81191A1361230C836B675VOEXM39Winterna_" MIME-Version: 1.0 Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:12:40 -0000 --_000_A5D2A283BA581C40B2B81191A1361230C836B675VOEXM39Winterna_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Fair point Henning. I guess my focus is that most of the victims at present (here at least) are= resi/mobile; not to say that enterprises don't receive nuisance calls but = it's not those which are causing our government ministers' inboxes to fill = up with irate letters. I'm not saying I'm against enterprises doing their = own checking, more that it's an edge case (unlike enterprises signing, whic= h is absolutely core to the issues around nuisance calls). Perhaps it's di= fferent in the US market. From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov] Sent: 10 August 2016 15:02 To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP There are three facets: * checking * marking (translating the checking result into something else, whether tha= t's caller-ID-related information or some SIP header) * call handling (call rejection, voice mail, etc.) based on either authenti= cation status or call origin Unless the terminating carrier performs all three or possibly checking and = marking, the enterprise will need to do that, e.g., to implement a unauthen= ticated-to-voicemail or failed-to-reject policy. Since we currently don't h= ave a good standards-based way to do marking (and it isn't clear that this = offers significant value compared to just doing the checking again), I susp= ect that means that either carriers have to implement both checking and cal= l policy, or the end system has to do both. Some policy options, such as ro= uting to voicemail, seem much easier to do at the enterprise level. Henning ________________________________ From: stir > on behalf = of Rosbotham, Paul, Vodafone UK > Sent: Wednesday, August 10, 2016 9:53:06 AM To: Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP I'd agree here. At the originating/signing end, there are good reasons to involve the enter= prise (if not initially, then certainly as a longer term solution). At the terminating/checking end, I don't "get" what having an enterprise do= their own checking gains, compared to it happening as a service in the net= work. I'm not philosophically opposed, just don't see the benefit. (Incidentally, although transit networks could do the checking, I see it mo= re occurring at the terminating end. The terminating network owns the comm= ercial relationship with the end customer that's being inconvenienced by nu= isance calls; it's they that can derive commercial/public-policy gain or ma= ke their relationship more "sticky" by helping prevent these) Cheers Paul From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: 10 August 2016 14:15 To: Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP Maybe I don't understand the question, but I certainly want to see the Iden= tity header and the JWT sent to the device/enterprise. I certainly hope th= e device/enterprise will have access to the PKI and OCSP service to validat= e. Then it can decide what to do with the call. If the network drops the call then clearly the enterprise can't do anything= . If the display name is changed, maybe it could. Brian On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: OK understood but if the callee device or could be an enterprise network is= going to make decisions based on this don't we need to specify the informa= tion/signalling on which they make that decision? Andy On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: I don't think that is at all true. If validation is done at, say a transit= network interconnect, and the transit network refuses to accept the call w= ithout a valid signature (assuming it does not run afoul of its local regul= ations in doing so), then there is value to the consumer. If the terminati= on network does the same, value. If the termination network modifies the s= ignaling towards the consumer so that the display name is "suspicious call"= or "unknown caller", that is of great value to the consumer. If it offer= s an option to the consumer to send calls with bad signatures or no signatu= res direct to voicemail, that is of great value. So, while I really, really do want to do the validation on the device (beca= use the consumer will have more options available of that is what happens),= I think the mechanism can help consumers way before it shows up on the dev= ice and the device is able to do something with it. Brian On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: Also as Dave Crocker pointed out what happens at the callee is also importa= nt if no validation is possible at the callee's device then surely there is= no real benefit to the consumer. Regards Andy On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" on behalf of pkyzivat@alum.mit.edu> wrote: On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and th= en can be delegated as requirements dictate. The integrity numbering plan = is a direct and plenary responsibility of NRA's period full stop. > > I'm less confident we will ever get to the device level..at least not= for the foreeable future aka my lifetime. If the SPs have an incentive to *not* delegate then it will be very har= d to get there. RS> Not our concern. Way beyond our scope of competence here. Don't forge= t the NRA's have the real "Maxwell's Silver Hammer" and you can be sure the= y can use it if delegation or lack thereof is perceived to be anti competit= ive. OTOH, if they have an incentive then the chances are better. Brian and Paul R outlined some possible incentives to delegate. That gives some hope. Thanks, Paul _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_A5D2A283BA581C40B2B81191A1361230C836B675VOEXM39Winterna_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Fair point Henning.<= /o:p>

 <= /p>

I guess my focus is that = most of the victims at present (here at least) are resi/mobile; not to say = that enterprises don’t receive nuisance calls but it’s not those which are causing our government ministers’ inboxes to fill up= with irate letters.  I’m not saying I’m against enterpris= es doing their own checking, more that it’s an edge case (unlike ente= rprises signing, which is absolutely core to the issues around nuisance calls).  Perhaps it’s different in the US market.=

 <= /p>

From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.g= ov]
Sent: 10 August 2016 15:02
To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

There are three facets:

* checking

* marking (translating the checking r= esult into something else, whether that's caller-ID-related information&nbs= p;or some SIP header)

* call handling (call rejection, voic= e mail, etc.) based on either authentication status or call origin

 

Unless the terminating carrier perfor= ms all three or possibly checking and marking, the enterprise will need to = do that, e.g., to implement a unauthenticated-to-voicemail or failed-to-reject policy. Since we currently don't have a good standards= -based way to do marking (and it isn't clear that this offers significant v= alue compared to just doing the checking again), I suspect that means that = either carriers have to implement both checking and call policy, or the end system has to do both. Some poli= cy options, such as routing to voicemail, seem much easier to do at the ent= erprise level.

 

Henning

From: stir <stir-bo= unces@ietf.org> on behalf of Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 9:53:06 AM
To: Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP <= o:p>

 

I’d agree here.

 <= /p>

At the originating/signin= g end, there are good reasons to involve the enterprise (if not initially, = then certainly as a longer term solution).

 <= /p>

At the terminating/checki= ng end, I don’t “get” what having an enterprise do their = own checking gains, compared to it happening as a service in the network.&n= bsp; I’m not philosophically opposed, just don’t see the benefit.

 <= /p>

(Incidentally, although t= ransit networks could do the checking, I see it more occurring at the termi= nating end.  The terminating network owns the commercial relationship with the end customer that’s being inconvenienced by nu= isance calls; it’s they that can derive commercial/public-policy gain= or make their relationship more “sticky” by helping prevent th= ese)

 <= /p>

Cheers<= /p>

 <= /p>

Paul

 <= /p>

From: stir [mailto= :stir-bounces@ietf.org] On Behalf Of Brian Rosen
Sent: 10 August 2016 14:15
To: Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

Maybe I don’t understand the question, but I c= ertainly want to see the Identity header and the JWT sent to the device/ent= erprise.  I certainly hope the device/enterprise will have access to t= he PKI and OCSP service to validate.  Then it can decide what to do with the call.

 

If the network drops the call then clearly the enter= prise can’t do anything.  If the display name is changed, maybe = it could.

 

Brian

 

On Aug 10, 2016, at 9:11 AM, Andy Hutton <andyhutton.ietf@gmail.com> wro= te:

 

OK understood but if the callee device or could be a= n enterprise network is going to make decisions based on this don't we need= to specify the information/signalling on which they make that decision?

 

Andy

 

On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen <br@brianrosen.net&g= t; wrote:

I don’t think that is at all true.  If va= lidation is done at, say a transit network interconnect, and the transit ne= twork refuses to accept the call without a valid signature (assuming it doe= s not run afoul of its local regulations in doing so), then there is value to the consumer.  If the termination network= does the same, value.  If the termination network modifies the signal= ing towards the consumer so that the display name is “suspicious call= ” or  “unknown caller”, that is of great value to the consumer.  If it offers an option to the consumer to send calls w= ith bad signatures or no signatures direct to voicemail, that is of great v= alue.

 

So, while I really, really do want to do the validat= ion on the device (because the consumer will have more options available of= that is what happens), I think the mechanism can help consumers way before= it shows up on the device and the device is able to do something with it.

 

Brian

 

On Aug 10, 2016, at 8:41 AM, Andy Hutton <andyhutton.ietf@gma= il.com> wrote:

 

 

Also as Dave Crocker pointed out what happens at the= callee is also important if no validation is possible at the callee's devi= ce then surely there is no real benefit to the consumer.

 

Regards

Andy

 

On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey <= richard@shockey.us<= /a>> wrote:



On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of pkyzivat@alum.mi= t.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has to start some where.
    >
    > The circles of trust start first with the circles of aut= hority and then can be delegated as requirements dictate.  The integri= ty numbering plan is a direct and plenary responsibility of NRA’s per= iod full stop.
    >
    > I’m less confident we will ever get to the device = level..at least not for the foreeable future aka my lifetime.

    If the SPs have an incentive to *not* delegate then it will b= e very hard
    to get there.

RS> Not our concern.   Way beyond our scope of competence here= . Don’t forget the NRA’s have the real “Maxwell’s S= ilver Hammer” and you can be sure they can use it if delegation or la= ck thereof is perceived to be anti competitive.


    OTOH, if they have an incentive then the chances are better.<= br>
    Brian and Paul R outlined some possible incentives to delegat= e. That
    gives some hope.

        Thanks,
        Paul


_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

 

 

--_000_A5D2A283BA581C40B2B81191A1361230C836B675VOEXM39Winterna_-- From nobody Wed Aug 10 07:18:48 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72A0B12D7EB for ; Wed, 10 Aug 2016 07:18:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.447 X-Spam-Level: X-Spam-Status: No, score=-5.447 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fccoffice.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h3GRaDLhDY-J for ; Wed, 10 Aug 2016 07:18:45 -0700 (PDT) Received: from DC-IP-2.fcc.gov (dc-ip-2.fcc.gov [192.104.54.91]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A9AD12B04A for ; Wed, 10 Aug 2016 07:18:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fccoffice.onmicrosoft.com; s=selector1-fcc-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wE4EXeWG4xj0IRv6ORLTi87dgcwL9Js64fR65Adrbvs=; b=f7kvGTvvopmj2WADZAIP45LvHYJ9IhAlTl9KVNnD9PjtygUcyYBz3yRsoXXVNPfPeLqOgGthI7mnsNEk1Ajk4fAl7pZvUh4waa3ttw1AcxoQouSoYbH1WcULA4ySOKOAbmD8oc9EW1vW6XKrQ0+m+5Ss0LMIaFdIE4lrZw3iKb0= From: Henning Schulzrinne To: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , Andy Hutton Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8lByzi5gOxmQhU6LJZEE+/NGLKBAvgeAgAASkwCAAAk/gIAAAxqAgAFHfACAAAW3gIAAAqgAgAAA7ACAAAqvAIAAAHL8gAAEmgCAAADKHA== Date: Wed, 10 Aug 2016 14:18:39 +0000 Message-ID: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net>, , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Henning.Schulzrinne@fcc.gov; x-ms-office365-filtering-correlation-id: c3099f85-8832-4456-2fb9-08d3c12939fe x-microsoft-exchange-diagnostics: 1; CY1PR09MB0636; 6:uofx75HSjOEOx3B9oeNgIAKvu1gd2GfZotzIgqbK5+obGGmDG1G/mWDdFbT5V6uOTANAO+I+hJkX5zWSs8IE/DkjTt36GnlnOqKA4gRZ/ArxTF8HTz19fsEf5iykxer4p6xaCG1eymoo0p28grVa1u/5m8SLGxFhoU7KrclrmH2uSzpV9/Bb80F5TMAgu5bQ3ckumVtFb0l08yt7Pwux6EHsled4SM7auYA8qjbxmznYy/eGPr5ade5gxpajrQ6F5kN//RlKj5Ltim0UJEa7f1rFeEGrPIOtp92wUERf7l8=; 5:bcm90hToyg4AmBgZCXx22hCU4mV9mFxrqMvvh3XEaOWEojJgawib8c0moCgozCbI2YU77ILYlF1cLFJd62hlUDV0gTq/h+aJ1dOitI/2rg/1dHeBHdIbaPVuK1bK295qj+E2Den4/zm/iufGfhvqKw==; 24:p5Fzj/7mlrh/AdYfwxEJsoqmMBUJd8/WFIzxq2ufYT/803LmkTBnVPjIlHysW06eqQ3gFzd7ODL6vUlkFJPdO0i3TYR86TZS8S3F83UBZtI=; 7:OsEG3UPUfyQRTTMCGPx9ZkD2MbJ/ZSfRxo2aUN88JMbzWoEwqZUWTrNRYBXGwKv0lpZLZ+7awNSmuU5KoY0XiQ3Iiw0T8u7wqGoEAECR9RvaNXBUblKTZjd9kZ+p4FDwUBweBG91xoO6/5h+9ChlmAM3vnNBR9LXxDQ0olRNr2667OAdQeLnU9hv8q2+6v3j3GsYKguGwqZpXhJkZKK7RDsezYiTbyCUguUgbF3dL36ibC2hzl+5pkR++LXjFW1X x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY1PR09MB0636; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(67444318432085)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046); SRVR:CY1PR09MB0636; BCL:0; PCL:0; RULEID:; SRVR:CY1PR09MB0636; x-forefront-prvs: 0030839EEE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(199003)(189002)(377454003)(24454002)(106116001)(19627405001)(106356001)(16236675004)(5001770100001)(97736004)(101416001)(33656002)(77096005)(2950100001)(2900100001)(19625215002)(189998001)(15975445007)(19617315012)(122556002)(19300405004)(66066001)(10400500002)(93886004)(87936001)(19580405001)(19580395003)(5002640100001)(7906003)(9686002)(6116002)(8936002)(790700001)(8676002)(102836003)(3280700002)(7736002)(7696003)(7846002)(81156014)(8666005)(76176999)(81166006)(99286002)(3660700001)(3846002)(86362001)(2906002)(76576001)(92566002)(54356999)(50986999)(105586002)(4326007)(74316002)(586003)(68736007)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR09MB0636; H:CY1PR09MB0634.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: fcc.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR09MB0634BF15E231E5F36E7BD465EA1D0CY1PR09MB0634namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Aug 2016 14:18:39.6748 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72970aed-3669-4ca8-b960-dd016bc72973 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR09MB0636 X-OriginatorOrg: fcc.gov Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:18:47 -0000 --_000_CY1PR09MB0634BF15E231E5F36E7BD465EA1D0CY1PR09MB0634namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Don't know about telemarketing-style nuisance calls (although I have been o= ffered cruises on my FCC work phone...), but TDOS is a big issue for health= care and hospitality companies. Also, financial institutions would benefit = from knowing whether the claimed number is real. They wouldn't reject unaut= henticated calls, but would apply different customer validation procedures,= such as warning the customer service representative or having fraud contro= l monitor the interaction in real-time. ________________________________ From: Rosbotham, Paul, Vodafone UK Sent: Wednesday, August 10, 2016 10:11:10 AM To: Henning Schulzrinne; Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: RE: [stir] STIR's basic operational model with SIP Fair point Henning. I guess my focus is that most of the victims at present (here at least) are= resi/mobile; not to say that enterprises don=92t receive nuisance calls bu= t it=92s not those which are causing our government ministers=92 inboxes to= fill up with irate letters. I=92m not saying I=92m against enterprises do= ing their own checking, more that it=92s an edge case (unlike enterprises s= igning, which is absolutely core to the issues around nuisance calls). Per= haps it=92s different in the US market. From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov] Sent: 10 August 2016 15:02 To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP There are three facets: * checking * marking (translating the checking result into something else, whether tha= t's caller-ID-related information or some SIP header) * call handling (call rejection, voice mail, etc.) based on either authenti= cation status or call origin Unless the terminating carrier performs all three or possibly checking and = marking, the enterprise will need to do that, e.g., to implement a unauthen= ticated-to-voicemail or failed-to-reject policy. Since we currently don't h= ave a good standards-based way to do marking (and it isn't clear that this = offers significant value compared to just doing the checking again), I susp= ect that means that either carriers have to implement both checking and cal= l policy, or the end system has to do both. Some policy options, such as ro= uting to voicemail, seem much easier to do at the enterprise level. Henning ________________________________ From: stir > on behalf = of Rosbotham, Paul, Vodafone UK > Sent: Wednesday, August 10, 2016 9:53:06 AM To: Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP I=92d agree here. At the originating/signing end, there are good reasons to involve the enter= prise (if not initially, then certainly as a longer term solution). At the terminating/checking end, I don=92t =93get=94 what having an enterpr= ise do their own checking gains, compared to it happening as a service in t= he network. I=92m not philosophically opposed, just don=92t see the benefi= t. (Incidentally, although transit networks could do the checking, I see it mo= re occurring at the terminating end. The terminating network owns the comm= ercial relationship with the end customer that=92s being inconvenienced by = nuisance calls; it=92s they that can derive commercial/public-policy gain o= r make their relationship more =93sticky=94 by helping prevent these) Cheers Paul From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: 10 August 2016 14:15 To: Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP Maybe I don=92t understand the question, but I certainly want to see the Id= entity header and the JWT sent to the device/enterprise. I certainly hope = the device/enterprise will have access to the PKI and OCSP service to valid= ate. Then it can decide what to do with the call. If the network drops the call then clearly the enterprise can=92t do anythi= ng. If the display name is changed, maybe it could. Brian On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: OK understood but if the callee device or could be an enterprise network is= going to make decisions based on this don't we need to specify the informa= tion/signalling on which they make that decision? Andy On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: I don=92t think that is at all true. If validation is done at, say a trans= it network interconnect, and the transit network refuses to accept the call= without a valid signature (assuming it does not run afoul of its local reg= ulations in doing so), then there is value to the consumer. If the termina= tion network does the same, value. If the termination network modifies the= signaling towards the consumer so that the display name is =93suspicious c= all=94 or =93unknown caller=94, that is of great value to the consumer. I= f it offers an option to the consumer to send calls with bad signatures or = no signatures direct to voicemail, that is of great value. So, while I really, really do want to do the validation on the device (beca= use the consumer will have more options available of that is what happens),= I think the mechanism can help consumers way before it shows up on the dev= ice and the device is able to do something with it. Brian On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: Also as Dave Crocker pointed out what happens at the callee is also importa= nt if no validation is possible at the callee's device then surely there is= no real benefit to the consumer. Regards Andy On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" on behalf of pkyzivat@alum.mit.edu> wrote: On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and th= en can be delegated as requirements dictate. The integrity numbering plan = is a direct and plenary responsibility of NRA=92s period full stop. > > I=92m less confident we will ever get to the device level..at least n= ot for the foreeable future aka my lifetime. If the SPs have an incentive to *not* delegate then it will be very har= d to get there. RS> Not our concern. Way beyond our scope of competence here. Don=92t for= get the NRA=92s have the real =93Maxwell=92s Silver Hammer=94 and you can b= e sure they can use it if delegation or lack thereof is perceived to be ant= i competitive. OTOH, if they have an incentive then the chances are better. Brian and Paul R outlined some possible incentives to delegate. That gives some hope. Thanks, Paul _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_CY1PR09MB0634BF15E231E5F36E7BD465EA1D0CY1PR09MB0634namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Don't know about telemarketing-style nuisance calls (although I hav= e been offered cruises on my FCC work phone...), but TDOS is a big issue fo= r healthcare and hospitality companies. Also, financial institutions would = benefit from knowing whether the claimed number is real. They wouldn't reject unauthenticated calls, but would appl= y different customer validation procedures, such as warning the custom= er service representative or having fraud control monitor the interaction i= n real-time.

From: Rosbotham, Paul, Voda= fone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 10:11:10 AM
To: Henning Schulzrinne; Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: RE: [stir] STIR's basic operational model with SIP
 

Fair point Henning.<= /o:p>

 <= /p>

I guess my focus is that = most of the victims at present (here at least) are resi/mobile; not to say = that enterprises don=92t receive nuisance calls but it=92s not those which are causing our government ministers=92 inboxes to fill up wit= h irate letters.  I=92m not saying I=92m against enterprises doing the= ir own checking, more that it=92s an edge case (unlike enterprises signing,= which is absolutely core to the issues around nuisance calls).  Perhaps it=92s different in the US market.

 <= /p>

From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.g= ov]
Sent: 10 August 2016 15:02
To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

There are three facets:

* checking

* marking (translating the checking r= esult into something else, whether that's caller-ID-related information&nbs= p;or some SIP header)

* call handling (call rejection, voic= e mail, etc.) based on either authentication status or call origin

 

Unless the terminating carrier perfor= ms all three or possibly checking and marking, the enterprise will need to = do that, e.g., to implement a unauthenticated-to-voicemail or failed-to-reject policy. Since we currently don't have a good standards= -based way to do marking (and it isn't clear that this offers significant v= alue compared to just doing the checking again), I suspect that means that = either carriers have to implement both checking and call policy, or the end system has to do both. Some poli= cy options, such as routing to voicemail, seem much easier to do at the ent= erprise level.

 

Henning

From: stir <stir-bo= unces@ietf.org> on behalf of Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 9:53:06 AM
To: Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP <= o:p>

 

I=92d agree here.

 <= /p>

At the originating/signin= g end, there are good reasons to involve the enterprise (if not initially, = then certainly as a longer term solution).

 <= /p>

At the terminating/checki= ng end, I don=92t =93get=94 what having an enterprise do their own checking= gains, compared to it happening as a service in the network.  I=92m not philosophically opposed, just don=92t see the benefit.

 <= /p>

(Incidentally, although t= ransit networks could do the checking, I see it more occurring at the termi= nating end.  The terminating network owns the commercial relationship with the end customer that=92s being inconvenienced by nuisan= ce calls; it=92s they that can derive commercial/public-policy gain or make= their relationship more =93sticky=94 by helping prevent these)<= /span>

 <= /p>

Cheers<= /p>

 <= /p>

Paul

 <= /p>

From: stir [mailto= :stir-bounces@ietf.org] On Behalf Of Brian Rosen
Sent: 10 August 2016 14:15
To: Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

Maybe I don=92t understand the question, but I certa= inly want to see the Identity header and the JWT sent to the device/enterpr= ise.  I certainly hope the device/enterprise will have access to the P= KI and OCSP service to validate.  Then it can decide what to do with the call.

 

If the network drops the call then clearly the enter= prise can=92t do anything.  If the display name is changed, maybe it c= ould.

 

Brian

 

On Aug 10, 2016, at 9:11 AM, Andy Hutton <andyhutton.ietf@gmail.com> wro= te:

 

OK understood but if the callee device or could be a= n enterprise network is going to make decisions based on this don't we need= to specify the information/signalling on which they make that decision?

 

Andy

 

On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen <br@brianrosen.net&g= t; wrote:

I don=92t think that is at all true.  If valida= tion is done at, say a transit network interconnect, and the transit networ= k refuses to accept the call without a valid signature (assuming it does no= t run afoul of its local regulations in doing so), then there is value to the consumer.  If the termination network= does the same, value.  If the termination network modifies the signal= ing towards the consumer so that the display name is =93suspicious call=94 = or  =93unknown caller=94, that is of great value to the consumer.  If it offers an option to the consumer to send calls w= ith bad signatures or no signatures direct to voicemail, that is of great v= alue.

 

So, while I really, really do want to do the validat= ion on the device (because the consumer will have more options available of= that is what happens), I think the mechanism can help consumers way before= it shows up on the device and the device is able to do something with it.

 

Brian

 

On Aug 10, 2016, at 8:41 AM, Andy Hutton <andyhutton.ietf@gma= il.com> wrote:

 

 

Also as Dave Crocker pointed out what happens at the= callee is also important if no validation is possible at the callee's devi= ce then surely there is no real benefit to the consumer.

 

Regards

Andy

 

On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey <= richard@shockey.us<= /a>> wrote:



On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of pkyzivat@alum.mi= t.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has to start some where.
    >
    > The circles of trust start first with the circles of aut= hority and then can be delegated as requirements dictate.  The integri= ty numbering plan is a direct and plenary responsibility of NRA=92s period = full stop.
    >
    > I=92m less confident we will ever get to the device leve= l..at least not for the foreeable future aka my lifetime.

    If the SPs have an incentive to *not* delegate then it will b= e very hard
    to get there.

RS> Not our concern.   Way beyond our scope of competence here= . Don=92t forget the NRA=92s have the real =93Maxwell=92s Silver Hammer=94 = and you can be sure they can use it if delegation or lack thereof is percei= ved to be anti competitive.


    OTOH, if they have an incentive then the chances are better.<= br>
    Brian and Paul R outlined some possible incentives to delegat= e. That
    gives some hope.

        Thanks,
        Paul


_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

 

 

--_000_CY1PR09MB0634BF15E231E5F36E7BD465EA1D0CY1PR09MB0634namp_-- From nobody Wed Aug 10 07:32:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4551A12D74D for ; Wed, 10 Aug 2016 07:32:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Rhqz0zf50kT for ; Wed, 10 Aug 2016 07:32:06 -0700 (PDT) Received: from resqmta-ch2-09v.sys.comcast.net (resqmta-ch2-09v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94C8212D664 for ; Wed, 10 Aug 2016 07:32:06 -0700 (PDT) Received: from resomta-ch2-01v.sys.comcast.net ([69.252.207.97]) by resqmta-ch2-09v.sys.comcast.net with SMTP id XUXQbtWtC1XXBXUY9bZbJa; Wed, 10 Aug 2016 14:32:05 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by comcast with SMTP id XUY8bkf8bXOkgXUY8bHXCe; Wed, 10 Aug 2016 14:32:05 +0000 To: Henning Schulzrinne , "Rosbotham, Paul, Vodafone UK" , Brian Rosen , Andy Hutton References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> From: Paul Kyzivat Message-ID: Date: Wed, 10 Aug 2016 10:32:03 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfLGl/xfSiy0f05QoQedKVYFEWBNxbeJQjg4a/dZxrtoUXT0oZvTTNOblijgJOQQVoiwhdELLv/q/WLz8rJ1Ki3+43RERBzEA6qW0OEZ50MPSmpLIWCm9 CfBlV9NvPlHo4HyRrp1BM2LK7CU0afg42m9PogCIn6wUT3fHTPiTMQ3J/aum43ADXwj191gZChVrs+4GtojVpPzi+aQdGL6cqFYqXG74zq8s4jiSYe2oNn06 LLgSSEWa19fBy01/5UgQuC3wZM714s2uT+FsxkSasu+MzYEpZQ57i4h+nM4lHDN+2apnYC0Gf7lJPvkrteBXRLWzCW2pPEaaVuQxCs1Iw5UShsuEJDwu3jgP 1NqD5Id0/PyrHsmw8JMhJEUeMXV7nw== Archived-At: Cc: IETF STIR Mail List , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:32:08 -0000 +1 If you count on the terminating provider to do the call handling, then the customer can only choose from among call handling policies that the provider offers. If the call handling is left to the customer then he is free to try all sorts of new innovative policies. Also, the "send to voicemail" policy can only be done by the provider if the provider is managing the voicemail. (Conversely, if the provider *is* managing the voicemail, then *that* call handling policy needs to be handled by the provider.) While we could find a way to do the marking, I agree with Henning that it is probably more straightforward to let the customer redo the checking. Certainly the provider could provide the marking as a service, and the customer can decide to use it or not. For end user landline service handling by the provider is probably the only option. But end user mobile service, typically terminated by smartphones, is fertile ground for innovative new handling options by the end device. Thanks, Paul On 8/10/16 10:01 AM, Henning Schulzrinne wrote: > There are three facets: > > * checking > > * marking (translating the checking result into something else, whether > that's caller-ID-related information or some SIP header) > > * call handling (call rejection, voice mail, etc.) based on either > authentication status or call origin > > > Unless the terminating carrier performs all three or possibly checking > and marking, the enterprise will need to do that, e.g., to implement a > unauthenticated-to-voicemail or failed-to-reject policy. Since we > currently don't have a good standards-based way to do marking (and it > isn't clear that this offers significant value compared to just doing > the checking again), I suspect that means that either carriers have to > implement both checking and call policy, or the end system has to do > both. Some policy options, such as routing to voicemail, seem much > easier to do at the enterprise level. > > > Henning > > ------------------------------------------------------------------------ > *From:* stir on behalf of Rosbotham, Paul, > Vodafone UK > *Sent:* Wednesday, August 10, 2016 9:53:06 AM > *To:* Brian Rosen; Andy Hutton > *Cc:* IETF STIR Mail List; Paul Kyzivat; Richard Shockey > *Subject:* Re: [stir] STIR's basic operational model with SIP > > > Id agree here. > > > > At the originating/signing end, there are good reasons to involve the > enterprise (if not initially, then certainly as a longer term solution). > > > > At the terminating/checking end, I dont get what having an enterprise > do their own checking gains, compared to it happening as a service in > the network. Im not philosophically opposed, just dont see the benefit. > > > > (Incidentally, although transit networks could do the checking, I see it > more occurring at the terminating end. The terminating network owns the > commercial relationship with the end customer thats being > inconvenienced by nuisance calls; its they that can derive > commercial/public-policy gain or make their relationship more sticky > by helping prevent these) > > > > Cheers > > > > Paul > > > > *From:*stir [mailto:stir-bounces@ietf.org] *On Behalf Of *Brian Rosen > *Sent:* 10 August 2016 14:15 > *To:* Andy Hutton > *Cc:* IETF STIR Mail List; Paul Kyzivat; Richard Shockey > *Subject:* Re: [stir] STIR's basic operational model with SIP > > > > Maybe I dont understand the question, but I certainly want to see the > Identity header and the JWT sent to the device/enterprise. I certainly > hope the device/enterprise will have access to the PKI and OCSP service > to validate. Then it can decide what to do with the call. > > > > If the network drops the call then clearly the enterprise cant do > anything. If the display name is changed, maybe it could. > > > > Brian > > > > On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: > > > > OK understood but if the callee device or could be an enterprise > network is going to make decisions based on this don't we need to > specify the information/signalling on which they make that decision? > > > > Andy > > > > On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: > > I dont think that is at all true. If validation is done at, say a > transit network interconnect, and the transit network refuses to > accept the call without a valid signature (assuming it does not run > afoul of its local regulations in doing so), then there is value to > the consumer. If the termination network does the same, value. If > the termination network modifies the signaling towards the consumer > so that the display name is suspicious call or unknown caller, > that is of great value to the consumer. If it offers an option to > the consumer to send calls with bad signatures or no signatures > direct to voicemail, that is of great value. > > > > So, while I really, really do want to do the validation on the > device (because the consumer will have more options available of > that is what happens), I think the mechanism can help consumers way > before it shows up on the device and the device is able to do > something with it. > > > > Brian > > > > On Aug 10, 2016, at 8:41 AM, Andy Hutton > > > wrote: > > > > > > Also as Dave Crocker pointed out what happens at the callee is > also important if no validation is possible at the callee's > device then surely there is no real benefit to the consumer. > > > > Regards > > Andy > > > > On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > > wrote: > > > > On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" > on behalf > of pkyzivat@alum.mit.edu > wrote: > > On 8/9/16 12:25 PM, Richard Shockey wrote: > > > > +1 it has to start some where. > > > > The circles of trust start first with the circles of > authority and then can be delegated as requirements dictate. > The integrity numbering plan is a direct and plenary > responsibility of NRAs period full stop. > > > > Im less confident we will ever get to the device > level..at least not for the foreeable future aka my lifetime. > > If the SPs have an incentive to *not* delegate then it will > be very hard > to get there. > > RS> Not our concern. Way beyond our scope of competence here. > Dont forget the NRAs have the real Maxwells Silver Hammer > and you can be sure they can use it if delegation or lack > thereof is perceived to be anti competitive. > > > OTOH, if they have an incentive then the chances are better. > > Brian and Paul R outlined some possible incentives to > delegate. That > gives some hope. > > Thanks, > Paul > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > > > > > From nobody Wed Aug 10 07:37:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C52A12D599 for ; Wed, 10 Aug 2016 07:37:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n4n88Q3Wu0z1 for ; Wed, 10 Aug 2016 07:37:53 -0700 (PDT) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7B2F12D0E6 for ; Wed, 10 Aug 2016 07:37:52 -0700 (PDT) Received: by mail-it0-x22d.google.com with SMTP id x130so40029729ite.1 for ; Wed, 10 Aug 2016 07:37:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=6kMGeF8tdKQHJD2omrFtiOCs0RHp7j0fpcH8Vh85TQI=; b=tl+tkPWjVfnXNOzmb5TZN0cRRtrRgm35xHbXMv8tdoLs61Icu0sX6RbbTtg/LRwiwS 5aI+6kbj7LSGwm6A7FlEUSHc5aCc3dF1j0cZjG6MY1066SY8aUXMgKUba6jI0cGGBBYx qUefIWYJtBdP5q3Vp7CK3lQJA/NTTR9ZePPwwRYHJIolaa98fcc6lcHvEvkK15yORq/P 61t7lhRLWDkX8Rcj7K+BVHK6w9eX9ZGVeiHE5GGtNijyJsGEB/yZfpGZKE3m7tn1plvw lpFDPAGV/VAw4YARX+uWlWL+aPnJDAZeN+xorUq5oFe7tj+dUx1Eeae38GAnv1gcmIPG qurQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=6kMGeF8tdKQHJD2omrFtiOCs0RHp7j0fpcH8Vh85TQI=; b=kAlA4lwRvKDy3yCmyU3DaEVUyst/pzuodutF63Rmsxkc8ZP4ARp3MQSoJa9N4JsbT3 pQAPbWBvTIs+fQH7H0NTPDKPyCYDn78k0Z5eVDOie1JUyEK5aGj9icXHEzawL6u+EslB WRw0HJv6tfX1QpGVxGYNkG9h6BGg3J7g7yaLM/dSylprmzywrMAJ9B5kfarZWjhaI7Ii 0dhr2qcfwpgzQiyjN3TOLsZdBVP+5Ks1rvoE0ERn0u27khvhy0RU2UrNN0jVb2kQ89+c 5V0p7LuG/kkQf+Q5+WP6KzULcYs/2abwxTYxSp9vVNeE5BDJhaR/1eCjGhGHvOJzJDlM 6Aug== X-Gm-Message-State: AEkoouty0jz2bYWNLY8pZHUcNvwx6wOODHn95XYtko8ZAqihxj84UVRr6hRYjzEwBXG5LYcUsd7RCpICJyoY9g== X-Received: by 10.36.200.131 with SMTP id w125mr3826672itf.33.1470839872220; Wed, 10 Aug 2016 07:37:52 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.0.26 with HTTP; Wed, 10 Aug 2016 07:37:51 -0700 (PDT) In-Reply-To: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> From: Andy Hutton Date: Wed, 10 Aug 2016 15:37:51 +0100 Message-ID: To: Henning Schulzrinne Content-Type: multipart/alternative; boundary=94eb2c05ab581af89f0539b898c8 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Richard Shockey , Paul Kyzivat , IETF STIR Mail List , Brian Rosen Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:37:54 -0000 --94eb2c05ab581af89f0539b898c8 Content-Type: text/plain; charset=UTF-8 On Wed, Aug 10, 2016 at 3:18 PM, Henning Schulzrinne < Henning.Schulzrinne@fcc.gov> wrote: > > Don't know about telemarketing-style nuisance calls (although I have been offered cruises on my FCC work phone...), but TDOS is a big issue for healthcare and hospitality companies. Also, financial institutions would benefit from knowing whether the claimed number is real. They wouldn't reject unauthenticated calls, but would apply different customer validation procedures, such as warning the customer service representative or having fraud control monitor the interaction in real-time. > +1 and add Emergency Services to the list of callee's for which this information is potentially very important. --94eb2c05ab581af89f0539b898c8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Aug 10, 2016 at 3:18 PM, Henning Schulzrin= ne <Henning.Schulzrinne@f= cc.gov> wrote:
>
> Don't know about telemarketing-st= yle nuisance calls (although I have been offered cruises on my FCC work pho= ne...), but TDOS is a big issue for healthcare and hospitality companies. A= lso, financial institutions would benefit from knowing whether the claimed = number is real. They wouldn't reject unauthenticated calls, but would a= pply different customer validation procedures, such as warning the customer= service representative or having fraud control monitor the interaction in = real-time.
>

+1 and add Emergency Services to the list of call= ee's for which this information is potentially very important.

=

--94eb2c05ab581af89f0539b898c8-- From nobody Wed Aug 10 07:54:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3933E12D771 for ; Wed, 10 Aug 2016 07:54:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bemx6Klm1BCc for ; Wed, 10 Aug 2016 07:54:34 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0102.outbound.protection.outlook.com [104.47.42.102]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E611C12D5CA for ; Wed, 10 Aug 2016 07:54:33 -0700 (PDT) Received: from BN1AFFO11FD051.protection.gbl (10.58.52.30) by BN1AFFO11HUB035.protection.gbl (10.58.52.146) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Wed, 10 Aug 2016 14:54:32 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.82) smtp.mailfrom=sprint.com; shockey.us; dkim=none (message not signed) header.d=none;shockey.us; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.82 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.82; helo=preapdm3.corp.sprint.com; Received: from preapdm3.corp.sprint.com (144.230.32.82) by BN1AFFO11FD051.mail.protection.outlook.com (10.58.53.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Wed, 10 Aug 2016 14:54:32 +0000 Received: from pps.filterd (preapdm3.corp.sprint.com [127.0.0.1]) by preapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7AEm0Bj014960; Wed, 10 Aug 2016 10:54:32 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm3.corp.sprint.com with ESMTP id 24na56egu2-2 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 10 Aug 2016 10:54:31 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 10 Aug 2016 09:54:30 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Wed, 10 Aug 2016 09:54:30 -0500 From: "Gorman, Pierce A [CTO]" To: Henning Schulzrinne , "Rosbotham, Paul, Vodafone UK" , Brian Rosen , Andy Hutton Thread-Topic: [stir] STIR's basic operational model with SIP Thread-Index: AQHR8xIiQ2hZGd8cME+5dbRENmlO+aBCPyRw Date: Wed, 10 Aug 2016 14:54:30 +0000 Message-ID: <432034f731e64270b5bc54acd54d6538@PLSWE13M08.ad.sprint.com> References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net>, , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.46] Content-Type: multipart/alternative; boundary="_000_432034f731e64270b5bc54acd54d6538PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.82; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(377454003)(24454002)(189002)(199003)(790700001)(30436002)(2950100001)(8936002)(6116002)(97736004)(2900100001)(108616004)(19580405001)(3846002)(54356999)(2906002)(8676002)(19625215002)(76176999)(4326007)(5001770100001)(189998001)(81156014)(84326002)(50986999)(81166006)(4546004)(15975445007)(19300405004)(102836003)(16236675004)(92566002)(106466001)(260700001)(5250100002)(19617315012)(86362001)(11100500001)(512954002)(33646002)(68736007)(7696003)(19580395003)(106116001)(7736002)(24736003)(7846002)(8666005)(7906003)(87936001)(586003)(93886004)(356003)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB035; H:preapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD051; 1:LReWriYH9koh9dTj61Jk/B6nCZrUUdOcOsW4DvAYAnUWB+DJEWfw6X3wl5uib+sczDgXo2qzGYgtK2yZE+FUEK3XvIZcEqm/Ds34lXql4j0lkmcPClgyRIhnNb3/VHNPn5orTM56UPajHHbAdpx8laYE6LQe3VY1eTFxV4XJAo4KVnhbceE4ltWMzRMDz2TYYzJ4Bho1ex73RZ+gb3YNA8muUPdrHX4FOqJkIoAjcrzAkMtTM6/YJn4t9UXWYJkkyPNocOLnbb2f40fwtbaIRDPLBwmD+O+ba6mygNxO1sGPNmelyYf9Lk8XDeQkpZH3r9bgDEPHRpaBUOzSYqXq0jNhF93xeqO0fGYJV1kP6+3Wy/PoJczI7OflMLKjRAFS8sz8YdC6//2ZGVFWmWpjNb1I6XO3KrSd1IuTmvsQZO57m1lRpmldctZYSXTWZIoFLbSrT/1YGQoLPi/qK36TPKX2UEWjPCL2QYpWZXjxFkoWEFOJfDkPQo7V1h0abGa0jfEy0Gp55I7roU8m/KPEARspx8Dn8972gLbQMik/yEWxLF17Jz9rlozHphcuQbL42iwdYuhgTJOyphkoo+hnQA== X-MS-Office365-Filtering-Correlation-Id: 6d2a702d-d41c-4743-22b0-08d3c12e3ce8 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB035; 2:TCtsX3BLDMysdQpaRl0VE+XpCeGB8NCQ5Sa2xe5SPtvIMrn5zQNZB8WlUBQflcVE922nVnhFKvgzwzHTU4K8DRPnB30LjK3oB++d5wotKHRibzavT5MksvqNXEGH/5hxaYjWvkAUTxQOzys5j/JD4AockXtZA9noys73hztwuxivg+Dld9RAdOE2ayDxvvS9; 3:QD8UwWCNlE1OM6U5w3tM084Eb4yh3kB470QT7p/3mj36yragze+mW8IvKXmnQ7pNgmj5ZpgnDyQ0kYKfra+b7vf87MsOHal81hl8iSrhWDGZgnxxL7VXZ1X9h5MH4DH6toCsXfQ9PNkNDDKrj1UM0o29v8HdDrHZUoiCFTf0Tno2UFzd6oCyScQHjX7Z19jLDro8UfJn2S99wq8Kne5JRDaKXw7vHvgNNnhFneI1Xsq/0j6eI1Ky7fSUhyLh9xHlgYDfodIwyF4/K/JENk97Rg==; 25:RxPiNJIf+q8KUTZTOObi2k6RkY5bCNkbQPwNTo1pZPMxGWV28zsrWb79idhZe9XI1KGB64sVYbcwhbQSesHbif1jkDQuFbd/sXMOy9r8DoHgZsYP8rDMTun+sS+wYMiX1M+rCTeDpYJ9JQ5xaZqgJgNDpEXrJ2aofeggAuvUglrb9IXq/psazi6C2tuKrMj2dJ/TQxXFU2eLjgpRdf0HpwX31PuW/KGKxZxVYXLI0ZtQ8xzk2imGh5ffS0xN0/6eZyJbh8Df1OC4w3yW1ZhdKzyg/4HxI4NpClb+ziPe7yEf1vE82rVUPbqu7NH8RRVjPxEA48IVlGW7KUvTrOVQJE8oXC8iY9eyeJ0DhH2X3hmxzhb2F2xN63ZqmIBPnF/oiAriz+ZF6bJnK98OFndg+lpH2gmMKzc07U61+c5GDfvJYQeggBC5mgp1zGzSUixZ X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB035; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB035; 31:2qLw0I1l9cKsGS76LAqk+B7k+O5wBEkbvgbD9Y8APgr3lvLXZYiTqfx+KTYZg75QrhbWIHYtAVh7tMKq++tlgGt5KMbEeInP7ROo2YPm6nMFR05OrrjHn7MEQLMYNI3+2ISl5BbVAOM2GFPMDIl5J1m5fgpecfAoIF0E7h5PBkzsNG6tVBAEEpLfNNHfJVamr946IDNOP8kYXCMlTrEcqvJ3ba4xvj7Hinw6nnetu6I=; 20:w+EpWgClHs62DxWbud+MqxhJAFz7fC1YzAFZ5+pTg177GWfN2Pn0U6tcKrbMUA6Fsk7h6oEAj0iNWbtmSJqtO2SAdKBMdDSvbeczJlucnNq/19f5paJkdhYFLOBcrSS0kfm4w89oNs6lCu4uABMti6ExRTsw6+ovQcB4xjh86ZALBqVS3PAKUOueSCyvsmxu2WmljyH96wOlsSMtX4G1G2d9XwAatDsqeuZePrOwoqDWMJFf3uBXwJPfVzZPaNV4qk+idhaTRYJsfDyY+7L9/MjsZxyM+/KMhY5uCOutgHjfzq5q9nfrxEX58vTCtYaurorRPnNhUFtf9iRqW9CToiyP7y33SpFjDv9LhS1+UffCQTZKkhZEZWoJC1Z8NwxaIcIYY0YPHOtV5AYgwJJXRumda8me2GnCkBtGsHpa9X4= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040166)(601004)(2401047)(13015025)(13017025)(13023025)(13024025)(13018025)(8121501046)(5005006)(10201501046)(3002001)(6055026); SRVR:BN1AFFO11HUB035; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB035; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB035; 4:k82/+BMTI/gAZKJQl0KOPZ1zeTxHABb+N+Zd9r9kPazE5U0Z1R8M3TRmAGU7oodoMFF3kOZ/bdTIDFCy+li4PQur0hbzQKbHuqUWnKsiCtWsxPJQJBYBImnQMM8K+KGLIwrgcCW3LBLmC1Qadxdyj+ATcPDKkW5El6uN8YLZTY2Qj/rk0eU2lLzKTxhG7K8rVR9HSSj7Xpi4yQx7VJ7cLo2v5GSmXt3jbQgAa3bJ11dLlyn1qfDPrDbiLOEEeEYpijIGot12VeQjRU94Wgk9ynJ6PeXWziAaMDH/QKwi+AaJn0SqALq+sptSyviNFp/pT425Xpa3VeZzzYHSv60t7y/LE3bBdwz/aQsR9TciH+gew6GQCvxPSaut6/1WdV3w0KfAvyKDY+N+fbJZ3Pj4+BoBoocxfU5O07U+ch9hhbkcejJ7zUAgSiwxY77Jgf81NasYZ9APbAS8iYwZDHtQE0PXVGBbMH2GPv5L8otVoYU+IworWmEWsEiqVvlkR5NbGkmfR8l4i/QmNxj9ADlkJib9PbRMpFSxcvZ8Lou1Ckg44CD8RAvIaBa+KowSEpxZkw2amY+CMw7DaTO2k+CLOQ== X-Forefront-PRVS: 0030839EEE X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB035; 23:GnfXGdL0eaoGSLo/jhCQdEp0drL73RJaOaVb71k?= =?us-ascii?Q?8W/EL3L68/x058+crbge4qn+XvqV+jvkLNETqDr5jWjvU8gPUHncpDpUdnlC?= =?us-ascii?Q?+rQReChAPkHrBySJPOs2NaCI/iegV14u6eNsRusmfRKBqTb4lqg00hIXeMQo?= =?us-ascii?Q?hXHlCJ4afYI7GT4GkIWFsx/o64zqfQ7gvtnp9b/zX5bUZDyDQf9MOLCmn1CN?= =?us-ascii?Q?KgT1gBctkFKsa6X5ymqWSAuTelPM9393E9rRT/n6cP+IMWIZsECzA55GF/Tx?= =?us-ascii?Q?Fj/HO8dG/1S5I81X9a1CYFHDqwg0366n5v8eeNFQ+tqW/RN+7fsGqhRfuV6A?= =?us-ascii?Q?A3ModYVjAm0fs+VFdlGmqtCw0eqz/RcOBrysttGkYUKvmZVd/8MPo1yFLPZ5?= =?us-ascii?Q?FOzkL2H9GHaP0pp7GR4CR6EbcaJ/jysFocwfQ2lMaMBlim8brWaoAYY1aqnc?= =?us-ascii?Q?cFnXavQwyJyVgbZxD70lZ2j3Farw9XmWfLpLCzsn97bwazVUw2x0cG9x0kaH?= =?us-ascii?Q?QFX3ro7lduozqJsnXjZiT4XMPDX4h1W+GaFQqJzn7lrVzqP68vAGqmCDrlKO?= =?us-ascii?Q?JRdgANqiC/3cfMUhJ6c7dL5KrYEyNQw55PZNW4EAROFuwM3V+M4zggZdNJUU?= =?us-ascii?Q?xggF5GJ/8JYBIINfueJ/oRQCJssqxP/mL/wR50hWs14rDI2OyLls/Dk//Dh9?= =?us-ascii?Q?xQYuHKFxwK0L3aUtf+1u6yYm+T4DDr+0FaBjJ0WHdymu4cVyp6/ufMmPiPpN?= =?us-ascii?Q?TxQaUP3w8ThG33z+yO2H3bYltwiIWXe3mwom+SolBte8sTGOh5tJ9QTzCQyx?= =?us-ascii?Q?DR0s8m+J+W16IxqTIEbSnzbWzUkVdlhWRz3kxqU8dmZmZ6Lv7dcIV2V7nvfr?= =?us-ascii?Q?Ml3y6MU5MYUWdirJCdrLs3Nn8T+OcrhYIzbwm8/DZ1V8dEyVP+vi5IP9a+lG?= =?us-ascii?Q?4nDn2EZBpnkxNn4BQ/TNQ5gg/+N7VXteyuto/JlUTbRLiE3vHETfEyVa2gyZ?= =?us-ascii?Q?3cY8y3mnKUtWrGSQcHxvIfRRZQ5NaEkyycn2+rDpgkdh5thrRL/i4+UdlbMt?= =?us-ascii?Q?TvVymAcvkpfr9uXJqoR4jg3r/Dr89XQX+7NJCijDQ4u7re6pzZBhfzsNFRXP?= =?us-ascii?Q?5fFVfNRyqADiXUANXNXFzdp61hutkiM/TzYPj+LVtEw2Uh/0TP0kahdLmNQg?= =?us-ascii?Q?ehYaInJGNiCLUPhMp7VpJGEsSGVCwswJeADNdw92ALpD2DOff8Keg1WeJVuU?= =?us-ascii?Q?pL+GR6zgtGToXqDAbLaHRTD9JsdvTUrojeytMQkyt5umuCaP5VY73RwVob/Q?= =?us-ascii?Q?XaaZX2v+xK/dR9SolNFmMTZ9mErG594PPmCiGVVPba6UcLlJjPukNnLQsbbg?= =?us-ascii?Q?hzxeKAVBSjDeu8qA4B2MSjsu0gDiw3dXfcBkzpKzl1PL6cuMD/MrMtdD0HDJ?= =?us-ascii?Q?ikhFUsuvm2Q=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB035; 6:j75sL78yTJg0UsQQUu8yRRAOoH1YOMZmtz2v5YZ4vsWKI70/y96bfLsK7st+N++CCfnzMnKrlrmEJhXt4jxRD1REE3x2OuP8sshsh8GLlQ+JPqaBO13kuu6hFN/zRmVjn+zyn88B3cuvCR41VO+lXwh2PEv/MVMKpXtuZrJGf0zkA7OClrgCf5qzo7dZkO3e4oZG8jdZL3uUy74E233MC7C8bsumIt3yQvT9q5ankJIHhir64BLsKydvMN+9R9y1jp4/QgTadlrjeScIEAIP09DYoGxx5PhCaGmm48KWx/a+zIYSDnFihcoLREkdCqPtFO3h8gmvYOwwRquI6RQ2xA==; 5:0MFzO6P2vserZnUeKt5WNRMFbvNRwI6nehTcm+GyOUonaMIqavIUtN6UknPsLo6b+SnMefH0RVhFwuhgSKODPE/ew7H5JwbokDAmKDsOWRy5Et7iOZURY+pfwnCTNj6xPiQz0pekH3JNpENM5Rc2ag==; 24:hRXurwGeFNfS2DobsGOu9KohMbMd3gAK88hPn2vYGBzQLc282YNvVDXbpmU5iZzw+AVQmrl1Rei742l+5oGki0YdgcdiKX1psFxU033yWnM=; 7:H90mnl9IvypKKsmzcLFUGqQ477SJ6TGfxTsbUP4oPPEOjvTliAf9zAfkzNfRBFgTwoHhOWV1yqD5q8I79tk+64vH1FY8PE9cw3j+/WdQZutG7lvp/3XOb9Iko8Y377aCJzaInxyWvYIn5LZ1N2+KnurKrmsvSTa5EqYrMiezJeBu8jhzQROpPM12MR9BYDk85yaxg0wXvgVkIYFSTzPO0rmxlTbKPySdGHDcFaIJERABElNSBkjuVdDmyk48IqkH SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2016 14:54:32.3094 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.82]; Helo=[preapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB035 Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat , Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:54:39 -0000 --_000_432034f731e64270b5bc54acd54d6538PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable >From a practical getting-started perspective I hope it is agreeable that or= iginating carriers (not end points such as phones or PBXes) need to sign th= e calls and only because it's a lot less physical SIP-enabled things to tou= ch and so the effort to reach a valuable critical mass of authentication ac= tions should be less and faster. And the termination side of the equation = is the same. I think this implies carrier-based certs, a relatively small = number of them per carrier and maybe only a couple of CAs to start with. It is interesting to contemplate how certs could be delegated to enterprise= s and other endpoints enabled with signing technology, and how to encourage= them to sign. Using only that approach I think it could be very difficult= to achieve a critical mass of signed calls and I assume would take a longe= r time than starting with carriers. Also, since endpoints can mis-sign eith= er through fault or intention, and that there are so many of them of varyin= g brand and quantity, it will introduce signal noise. I assume mobile devices may be more easily enabled (then enterprises) and w= e could expect most signing within 10 years (assuming we still have 2+ year= s of standards, development, testing, and deployment and the usual 4 to 6 y= ear cycle of device upgrade/replacement). I assume WebRTC will be more cha= llenging with respect to adoption/usage. I'm with Paul Rosbatham in that I'm not sure we as consumers really want or= even benefit much from endpoint signing and interpretation. I'm not funda= mentally against it, but it introduces additional challenges, and I'm not a= ble to easily foresee what the mish-mash of results of that approach will l= ook like. Since we think we can get anti-robocalling value from adding (variable) aut= henticity to calling numbers, and we want it sooner rather than later, I th= ink you want the carriers managing the start-up of the technology and you w= ant it to operate within the network (mostly) to start. Pierce From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov] Sent: August 10, 2016 9:19 AM To: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; Andy Hutton Cc: IETF STIR Mail List ; Paul Kyzivat ; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP Don't know about telemarketing-style nuisance calls (although I have been o= ffered cruises on my FCC work phone...), but TDOS is a big issue for health= care and hospitality companies. Also, financial institutions would benefit = from knowing whether the claimed number is real. They wouldn't reject unaut= henticated calls, but would apply different customer validation procedures,= such as warning the customer service representative or having fraud contro= l monitor the interaction in real-time. ________________________________ From: Rosbotham, Paul, Vodafone UK > Sent: Wednesday, August 10, 2016 10:11:10 AM To: Henning Schulzrinne; Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: RE: [stir] STIR's basic operational model with SIP Fair point Henning. I guess my focus is that most of the victims at present (here at least) are= resi/mobile; not to say that enterprises don't receive nuisance calls but = it's not those which are causing our government ministers' inboxes to fill = up with irate letters. I'm not saying I'm against enterprises doing their = own checking, more that it's an edge case (unlike enterprises signing, whic= h is absolutely core to the issues around nuisance calls). Perhaps it's di= fferent in the US market. From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov] Sent: 10 August 2016 15:02 To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP There are three facets: * checking * marking (translating the checking result into something else, whether tha= t's caller-ID-related information or some SIP header) * call handling (call rejection, voice mail, etc.) based on either authenti= cation status or call origin Unless the terminating carrier performs all three or possibly checking and = marking, the enterprise will need to do that, e.g., to implement a unauthen= ticated-to-voicemail or failed-to-reject policy. Since we currently don't h= ave a good standards-based way to do marking (and it isn't clear that this = offers significant value compared to just doing the checking again), I susp= ect that means that either carriers have to implement both checking and cal= l policy, or the end system has to do both. Some policy options, such as ro= uting to voicemail, seem much easier to do at the enterprise level. Henning ________________________________ From: stir > on behalf = of Rosbotham, Paul, Vodafone UK > Sent: Wednesday, August 10, 2016 9:53:06 AM To: Brian Rosen; Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP I'd agree here. At the originating/signing end, there are good reasons to involve the enter= prise (if not initially, then certainly as a longer term solution). At the terminating/checking end, I don't "get" what having an enterprise do= their own checking gains, compared to it happening as a service in the net= work. I'm not philosophically opposed, just don't see the benefit. (Incidentally, although transit networks could do the checking, I see it mo= re occurring at the terminating end. The terminating network owns the comm= ercial relationship with the end customer that's being inconvenienced by nu= isance calls; it's they that can derive commercial/public-policy gain or ma= ke their relationship more "sticky" by helping prevent these) Cheers Paul From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: 10 August 2016 14:15 To: Andy Hutton Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey Subject: Re: [stir] STIR's basic operational model with SIP Maybe I don't understand the question, but I certainly want to see the Iden= tity header and the JWT sent to the device/enterprise. I certainly hope th= e device/enterprise will have access to the PKI and OCSP service to validat= e. Then it can decide what to do with the call. If the network drops the call then clearly the enterprise can't do anything= . If the display name is changed, maybe it could. Brian On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: OK understood but if the callee device or could be an enterprise network is= going to make decisions based on this don't we need to specify the informa= tion/signalling on which they make that decision? Andy On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: I don't think that is at all true. If validation is done at, say a transit= network interconnect, and the transit network refuses to accept the call w= ithout a valid signature (assuming it does not run afoul of its local regul= ations in doing so), then there is value to the consumer. If the terminati= on network does the same, value. If the termination network modifies the s= ignaling towards the consumer so that the display name is "suspicious call"= or "unknown caller", that is of great value to the consumer. If it offer= s an option to the consumer to send calls with bad signatures or no signatu= res direct to voicemail, that is of great value. So, while I really, really do want to do the validation on the device (beca= use the consumer will have more options available of that is what happens),= I think the mechanism can help consumers way before it shows up on the dev= ice and the device is able to do something with it. Brian On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: Also as Dave Crocker pointed out what happens at the callee is also importa= nt if no validation is possible at the callee's device then surely there is= no real benefit to the consumer. Regards Andy On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" on behalf of pkyzivat@alum.mit.edu> wrote: On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and th= en can be delegated as requirements dictate. The integrity numbering plan = is a direct and plenary responsibility of NRA's period full stop. > > I'm less confident we will ever get to the device level..at least not= for the foreeable future aka my lifetime. If the SPs have an incentive to *not* delegate then it will be very har= d to get there. RS> Not our concern. Way beyond our scope of competence here. Don't forge= t the NRA's have the real "Maxwell's Silver Hammer" and you can be sure the= y can use it if delegation or lack thereof is perceived to be anti competit= ive. OTOH, if they have an incentive then the chances are better. Brian and Paul R outlined some possible incentives to delegate. That gives some hope. Thanks, Paul _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. --_000_432034f731e64270b5bc54acd54d6538PLSWE13M08adsprintcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

From a practical getting-started perspe= ctive I hope it is agreeable that originating carriers (not end points such= as phones or PBXes) need to sign the calls and only because it’s a lot less physical SIP-enabled things to touch an= d so the effort to reach a valuable critical mass of authentication actions= should be less and faster.  And the termination side of the equation = is the same.  I think this implies carrier-based certs, a relatively small number of them per carrier and maybe only a coup= le of CAs to start with.

 

It is interesting to contemplate how ce= rts could be delegated to enterprises and other endpoints enabled with sign= ing technology, and how to encourage them to sign.  Using only that approach I think it could be very difficult to achieve a c= ritical mass of signed calls and I assume would take a longer time than sta= rting with carriers. Also, since endpoints can mis-sign either through faul= t or intention, and that there are so many of them of varying brand and quantity, it will introduce signal no= ise.

 

I assume mobile devices may be more eas= ily enabled (then enterprises) and we could expect most signing within 10 y= ears (assuming we still have 2+ years of standards, development, testing, and deployment and the usual 4 to 6 year cycle of de= vice upgrade/replacement).  I assume WebRTC will be more challenging w= ith respect to adoption/usage.

 

I’m with Paul Rosbatham in that I= ’m not sure we as consumers really want or even benefit much from end= point signing and interpretation.  I’m not fundamentally against it, but it introduces additional challenges, and I’m not able to eas= ily foresee what the mish-mash of results of that approach will look like.<= o:p>

 

Since we think we can get anti-robocall= ing value from adding (variable) authenticity to calling numbers, and we wa= nt it sooner rather than later, I think you want the carriers managing the start-up of the technology and you want it to op= erate within the network (mostly) to start.

 

Pierce

 

From: Henning Schulzrinne [mailto:He= nning.Schulzrinne@fcc.gov]
Sent: August 10, 2016 9:19 AM
To: Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>= ; Brian Rosen <br@brianrosen.net>; Andy Hutton <andyhutton.ietf@gm= ail.com>
Cc: IETF STIR Mail List <stir@ietf.org>; Paul Kyzivat <pkyz= ivat@alum.mit.edu>; Richard Shockey <richard@shockey.us>
Subject: Re: [stir] STIR's basic operational model with SIP

 

Do= n't know about telemarketing-style nuisance calls (although I have bee= n offered cruises on my FCC work phone...), but TDOS is a big issue for hea= lthcare and hospitality companies. Also, financial institutions would benefit from knowing whether the claimed number is real= . They wouldn't reject unauthenticated calls, but would apply different cus= tomer validation procedures, such as warning the customer service repr= esentative or having fraud control monitor the interaction in real-time.

From: Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 10:11:10 AM
To: Henning Schulzrinne; Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: RE: [stir] STIR's basic operational model with SIP

 

Fair point Henning.

 

I guess my focus is th= at most of the victims at present (here at least) are resi/mobile; not to s= ay that enterprises don’t receive nuisance calls but it’s not those which are causing our government ministers’= inboxes to fill up with irate letters.  I’m not saying I’= m against enterprises doing their own checking, more that it’s an edg= e case (unlike enterprises signing, which is absolutely core to the issues around nuisance calls).  Perhaps it’s different in the U= S market.

 

From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov]
Sent: 10 August 2016 15:02
To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

There are three facets:=

* checking

* marking (translating the checkin= g result into something else, whether that's caller-ID-related information&= nbsp;or some SIP header)

* call handling (call rejection, v= oice mail, etc.) based on either authentication status or call origin<= /o:p>

 

Unless the terminating carrier per= forms all three or possibly checking and marking, the enterprise will need = to do that, e.g., to implement a unauthenticated-to-voicemail or failed-to-reject policy. Since we currently don't have a good standards= -based way to do marking (and it isn't clear that this offers significant v= alue compared to just doing the checking again), I suspect that means that = either carriers have to implement both checking and call policy, or the end system has to do both. Some poli= cy options, such as routing to voicemail, seem much easier to do at the ent= erprise level.

 

Henning

From: stir <s= tir-bounces@ietf.org> on behalf of Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 9:53:06 AM
To: Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

I’d agree here.<= o:p>

 

At the originating/sig= ning end, there are good reasons to involve the enterprise (if not initiall= y, then certainly as a longer term solution).

 

At the terminating/che= cking end, I don’t “get” what having an enterprise do the= ir own checking gains, compared to it happening as a service in the network.  I’m not philosophically opposed, just don’t see= the benefit.

 

(Incidentally, althoug= h transit networks could do the checking, I see it more occurring at the te= rminating end.  The terminating network owns the commercial relationship with the end customer that’s being inconveni= enced by nuisance calls; it’s they that can derive commercial/public-= policy gain or make their relationship more “sticky” by helping= prevent these)

 

Cheers

 

Paul=

 

From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen
Sent: 10 August 2016 14:15
To: Andy Hutton
Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic operational model with SIP

 

Maybe I don’t understand = the question, but I certainly want to see the Identity header and the JWT s= ent to the device/enterprise.  I certainly hope the device/enterprise = will have access to the PKI and OCSP service to validate.  Then it can decide what to do with the call.

 

If the network drops the call t= hen clearly the enterprise can’t do anything.  If the display na= me is changed, maybe it could.

 

Brian

 

On Aug 10, 2016, at 9:11 AM, An= dy Hutton <andyhutton.ietf@= gmail.com> wrote:

 

OK understood but if the callee= device or could be an enterprise network is going to make decisions based = on this don't we need to specify the information/signalling on which they m= ake that decision?

 

Andy

 

On Wed, Aug 10, 2016 at 2:02 PM= , Brian Rosen <br= @brianrosen.net> wrote:

I don’t think that is at = all true.  If validation is done at, say a transit network interconnec= t, and the transit network refuses to accept the call without a valid signa= ture (assuming it does not run afoul of its local regulations in doing so), then there is value to the consumer.  If th= e termination network does the same, value.  If the termination networ= k modifies the signaling towards the consumer so that the display name is &= #8220;suspicious call” or  “unknown caller”, that is of great value to the consumer.  If it offers an option to the con= sumer to send calls with bad signatures or no signatures direct to voicemai= l, that is of great value.

 

So, while I really, really do w= ant to do the validation on the device (because the consumer will have more= options available of that is what happens), I think the mechanism can help= consumers way before it shows up on the device and the device is able to do something with it.

&n= bsp;

Brian

 

On Aug 10, 2016, at 8:41 AM, An= dy Hutton <andyhutton.ietf@gmail.com> wrote:

 

 

Also as Dave Crocker pointed ou= t what happens at the callee is also important if no validation is possible= at the callee's device then surely there is no real benefit to the consume= r.

 

Regards

Andy

 

On Tue, Aug 9, 2016 at 6:09 PM,= Richard Shockey <richard@shockey.us> wrote:

=

On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf of pkyzivat@alum.mi= t.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has to start some where.
    >
    > The circles of trust start first with the circles of aut= hority and then can be delegated as requirements dictate.  The integri= ty numbering plan is a direct and plenary responsibility of NRA’s per= iod full stop.
    >
    > I’m less confident we will ever get to the device = level..at least not for the foreeable future aka my lifetime.

    If the SPs have an incentive to *not* delegate then it will b= e very hard
    to get there.

RS> Not our concern.   Way beyond our scope of competence here= . Don’t forget the NRA’s have the real “Maxwell’s S= ilver Hammer” and you can be sure they can use it if delegation or la= ck thereof is perceived to be anti competitive.


    OTOH, if they have an incentive then the chances are better.<= br>
    Brian and Paul R outlined some possible incentives to delegat= e. That
    gives some hope.

        Thanks,
        Paul

_______________________________= ________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

_______________________________= ________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 

 

 



This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message.
 --_000_432034f731e64270b5bc54acd54d6538PLSWE13M08adsprintcom_-- From nobody Wed Aug 10 08:09:07 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3F5012D103 for ; Wed, 10 Aug 2016 08:09:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DLsZVhki9CDX for ; Wed, 10 Aug 2016 08:09:03 -0700 (PDT) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DF88127078 for ; Wed, 10 Aug 2016 08:09:02 -0700 (PDT) Received: by mail-qt0-x232.google.com with SMTP id 52so22197164qtq.3 for ; Wed, 10 Aug 2016 08:09:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=47uoHu7e2J4wpGHv29MhGEOQ7hUIkrF4ehvGUWvq2Wc=; b=TO5RlCbFf9IoIKrgi+eMtWVAMOUPmek7EodQc/EY81LZFW9sXaTy4c5w5tvHFw+920 HXhpWPC/Ifltk1ATazFlULBB58hzK822iZf9kycFF9YZT/Srn7RjK0ovMoekSOE15zgJ 3EU4tEtg4NsqG2lMTqLGPdW+yOmG+1ZRidKIL8h0rkz8xqEobnEM6Na2MjX9iwmPI3B+ lY+IHM26vAZCJIA+UUrWIwEel9YWJhYUBS9CMqUHRYfJ80itf4D0k88R8Sidce3a2Mdz r3MSt/neCCjw+SK8q6j+oizA+b3153t3opfjl4X6AJKVRHsaY6yJtw2SzqGIPjSt/VUs h3HA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=47uoHu7e2J4wpGHv29MhGEOQ7hUIkrF4ehvGUWvq2Wc=; b=J/MbaLkMraVFLzNXymiWOng5CIZJilAH0AsE07EgZuPt7iVUO+Gja5e8sRLbRhGzLy /euaTxPp2bmIJI+zFY80WNufezC+x59VZBHcUJlI3JYGv3qU74Xb1eJnVY9F+hpoQTRV K7Xq88L64NnDnxPixzDPx5E/yACherg2MhB6hUwuoglvKJaiE3rV7qHVwAGTGep/p4ns 3TvWm+QZVhZUy/127WR65b9Dr8nVdhcU7hzmSlM9c9UGz4JfNyyUGP7Ra6PxeJoaQqZS EkWSNZITS1pjzfZj3I9CQnrOjFoJyls0pKsjQIl2Z1bN0CiCLE4NTm3LPd0woyPOOdma 6u6Q== X-Gm-Message-State: AEkooutDXHAWC/OwU+3Cn3O6lfkljZnbAzWtOECZskXmKVsjPN4H7uOJuvv8g1oFw5pfaw== X-Received: by 10.200.55.137 with SMTP id d9mr4980214qtc.46.1470841741543; Wed, 10 Aug 2016 08:09:01 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id p70sm11209894qke.1.2016.08.10.08.08.59 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 10 Aug 2016 08:09:00 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_F1A9FD60-DB86-43B2-96FC-A90140C18F62" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <432034f731e64270b5bc54acd54d6538@PLSWE13M08.ad.sprint.com> Date: Wed, 10 Aug 2016 11:08:56 -0400 Message-Id: References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> <37E3C7D0-544C-4804-911B-E918A186D45B@brianrosen.net> <432034f731e64270b5bc54acd54d6538@PLSWE13M08.ad.sprint.com> To: "Gorman, Pierce A [CTO]" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Andy Hutton , "Rosbotham, Paul, Vodafone UK" , Paul Kyzivat , Richard Shockey , IETF STIR Mail List , Henning Schulzrinne Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 15:09:06 -0000 --Apple-Mail=_F1A9FD60-DB86-43B2-96FC-A90140C18F62 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 +1 I think Henning pointed out the value for consumers of devices = validating. I think the advantage to devices and enterprises signing is relieving = the carrier of liability, but I agree with you that we have to start = with carriers signing and validating. I also think your observations that it gets a lot simpler to deploy if = there are only a few certs to issue is correct, although I wonder if it = is really the right thing for carriers to share secret keys among all = the replicated parts of their infrastructure. It may be that a carrier = gets a small set of keys that are used by a Sub CA the carrier operates = to issue individual keys to each box that signs. Since the key has to be associated with all the numbers the carrier is = delegated, it is not entirely clear if you want one, or a bunch of keys = per carrier. =20 There isn=E2=80=99t any standards issue with any variation here. It=E2=80= =99s all deployment decisions, and so we don=E2=80=99t have to deal with = those issues here or really in any other body. It=E2=80=99s obvious = that the carrier gets keys for numbers it has been delegated by the = numbering authority. How many keys it gets, and which keys go with = which TNs is up to it. What it does with them (use the keys directly to = sign, or operate a CA that issues keys to the boxes that sign) is up to = it. Where it might get complicated is if the carrier ever obtains numbers in = a resale arrangement with another carrier. In those cases, it would get = a cert from that carrier along with the numbers, and then has to use = those keys (directly or indirectly) to sign for calls from those = numbers. If all of the numbers it signs for come from the NRA, it=E2=80=99= s easy. Brian > On Aug 10, 2016, at 10:54 AM, Gorman, Pierce A [CTO] = wrote: >=20 > =46rom a practical getting-started perspective I hope it is agreeable = that originating carriers (not end points such as phones or PBXes) need = to sign the calls and only because it=E2=80=99s a lot less physical = SIP-enabled things to touch and so the effort to reach a valuable = critical mass of authentication actions should be less and faster. And = the termination side of the equation is the same. I think this implies = carrier-based certs, a relatively small number of them per carrier and = maybe only a couple of CAs to start with. > =20 > It is interesting to contemplate how certs could be delegated to = enterprises and other endpoints enabled with signing technology, and how = to encourage them to sign. Using only that approach I think it could be = very difficult to achieve a critical mass of signed calls and I assume = would take a longer time than starting with carriers. Also, since = endpoints can mis-sign either through fault or intention, and that there = are so many of them of varying brand and quantity, it will introduce = signal noise. > =20 > I assume mobile devices may be more easily enabled (then enterprises) = and we could expect most signing within 10 years (assuming we still have = 2+ years of standards, development, testing, and deployment and the = usual 4 to 6 year cycle of device upgrade/replacement). I assume WebRTC = will be more challenging with respect to adoption/usage. > =20 > I=E2=80=99m with Paul Rosbatham in that I=E2=80=99m not sure we as = consumers really want or even benefit much from endpoint signing and = interpretation. I=E2=80=99m not fundamentally against it, but it = introduces additional challenges, and I=E2=80=99m not able to easily = foresee what the mish-mash of results of that approach will look like. > =20 > Since we think we can get anti-robocalling value from adding = (variable) authenticity to calling numbers, and we want it sooner rather = than later, I think you want the carriers managing the start-up of the = technology and you want it to operate within the network (mostly) to = start. > =20 > Pierce > =20 > From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov]=20 > Sent: August 10, 2016 9:19 AM > To: Rosbotham, Paul, Vodafone UK ; Brian = Rosen ; Andy Hutton > Cc: IETF STIR Mail List ; Paul Kyzivat = ; Richard Shockey > Subject: Re: [stir] STIR's basic operational model with SIP > =20 > Don't know about telemarketing-style nuisance calls (although I have = been offered cruises on my FCC work phone...), but TDOS is a big issue = for healthcare and hospitality companies. Also, financial institutions = would benefit from knowing whether the claimed number is real. They = wouldn't reject unauthenticated calls, but would apply different = customer validation procedures, such as warning the customer service = representative or having fraud control monitor the interaction in = real-time. > From: Rosbotham, Paul, Vodafone UK > > Sent: Wednesday, August 10, 2016 10:11:10 AM > To: Henning Schulzrinne; Brian Rosen; Andy Hutton > Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey > Subject: RE: [stir] STIR's basic operational model with SIP > =20 > Fair point Henning. > =20 > I guess my focus is that most of the victims at present (here at = least) are resi/mobile; not to say that enterprises don=E2=80=99t = receive nuisance calls but it=E2=80=99s not those which are causing our = government ministers=E2=80=99 inboxes to fill up with irate letters. = I=E2=80=99m not saying I=E2=80=99m against enterprises doing their own = checking, more that it=E2=80=99s an edge case (unlike enterprises = signing, which is absolutely core to the issues around nuisance calls). = Perhaps it=E2=80=99s different in the US market. > =20 > From: Henning Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov = ]=20 > Sent: 10 August 2016 15:02 > To: Rosbotham, Paul, Vodafone UK; Brian Rosen; Andy Hutton > Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey > Subject: Re: [stir] STIR's basic operational model with SIP > =20 > There are three facets: > * checking > * marking (translating the checking result into something else, = whether that's caller-ID-related information or some SIP header) > * call handling (call rejection, voice mail, etc.) based on either = authentication status or call origin > =20 > Unless the terminating carrier performs all three or possibly checking = and marking, the enterprise will need to do that, e.g., to implement a = unauthenticated-to-voicemail or failed-to-reject policy. Since we = currently don't have a good standards-based way to do marking (and it = isn't clear that this offers significant value compared to just doing = the checking again), I suspect that means that either carriers have to = implement both checking and call policy, or the end system has to do = both. Some policy options, such as routing to voicemail, seem much = easier to do at the enterprise level. > =20 > Henning > From: stir > on = behalf of Rosbotham, Paul, Vodafone UK > > Sent: Wednesday, August 10, 2016 9:53:06 AM > To: Brian Rosen; Andy Hutton > Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey > Subject: Re: [stir] STIR's basic operational model with SIP > =20 > I=E2=80=99d agree here. > =20 > At the originating/signing end, there are good reasons to involve the = enterprise (if not initially, then certainly as a longer term solution). > =20 > At the terminating/checking end, I don=E2=80=99t =E2=80=9Cget=E2=80=9D = what having an enterprise do their own checking gains, compared to it = happening as a service in the network. I=E2=80=99m not philosophically = opposed, just don=E2=80=99t see the benefit. > =20 > (Incidentally, although transit networks could do the checking, I see = it more occurring at the terminating end. The terminating network owns = the commercial relationship with the end customer that=E2=80=99s being = inconvenienced by nuisance calls; it=E2=80=99s they that can derive = commercial/public-policy gain or make their relationship more = =E2=80=9Csticky=E2=80=9D by helping prevent these) > =20 > Cheers > =20 > Paul > =20 > From: stir [mailto:stir-bounces@ietf.org = ] On Behalf Of Brian Rosen > Sent: 10 August 2016 14:15 > To: Andy Hutton > Cc: IETF STIR Mail List; Paul Kyzivat; Richard Shockey > Subject: Re: [stir] STIR's basic operational model with SIP > =20 > Maybe I don=E2=80=99t understand the question, but I certainly want to = see the Identity header and the JWT sent to the device/enterprise. I = certainly hope the device/enterprise will have access to the PKI and = OCSP service to validate. Then it can decide what to do with the call. > =20 > If the network drops the call then clearly the enterprise can=E2=80=99t = do anything. If the display name is changed, maybe it could. > =20 > Brian > =20 > On Aug 10, 2016, at 9:11 AM, Andy Hutton > wrote: > =20 > OK understood but if the callee device or could be an enterprise = network is going to make decisions based on this don't we need to = specify the information/signalling on which they make that decision? > =20 > Andy > =20 > On Wed, Aug 10, 2016 at 2:02 PM, Brian Rosen > wrote: > I don=E2=80=99t think that is at all true. If validation is done at, = say a transit network interconnect, and the transit network refuses to = accept the call without a valid signature (assuming it does not run = afoul of its local regulations in doing so), then there is value to the = consumer. If the termination network does the same, value. If the = termination network modifies the signaling towards the consumer so that = the display name is =E2=80=9Csuspicious call=E2=80=9D or =E2=80=9Cunknown= caller=E2=80=9D, that is of great value to the consumer. If it offers = an option to the consumer to send calls with bad signatures or no = signatures direct to voicemail, that is of great value. > =20 > So, while I really, really do want to do the validation on the device = (because the consumer will have more options available of that is what = happens), I think the mechanism can help consumers way before it shows = up on the device and the device is able to do something with it. > =20 > Brian > =20 > On Aug 10, 2016, at 8:41 AM, Andy Hutton > wrote: > =20 > =20 > Also as Dave Crocker pointed out what happens at the callee is also = important if no validation is possible at the callee's device then = surely there is no real benefit to the consumer. > =20 > Regards > Andy > =20 > On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey > wrote: >=20 >=20 > On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" = on behalf = ofpkyzivat@alum.mit.edu > wrote: >=20 > On 8/9/16 12:25 PM, Richard Shockey wrote: > > > > +1 it has to start some where. > > > > The circles of trust start first with the circles of authority = and then can be delegated as requirements dictate. The integrity = numbering plan is a direct and plenary responsibility of NRA=E2=80=99s = period full stop. > > > > I=E2=80=99m less confident we will ever get to the device = level..at least not for the foreeable future aka my lifetime. >=20 > If the SPs have an incentive to *not* delegate then it will be = very hard > to get there. >=20 > RS> Not our concern. Way beyond our scope of competence here. = Don=E2=80=99t forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80= =99s Silver Hammer=E2=80=9D and you can be sure they can use it if = delegation or lack thereof is perceived to be anti competitive. >=20 >=20 > OTOH, if they have an incentive then the chances are better. >=20 > Brian and Paul R outlined some possible incentives to delegate. = That > gives some hope. >=20 > Thanks, > Paul >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > =20 > =20 >=20 >=20 > This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. --Apple-Mail=_F1A9FD60-DB86-43B2-96FC-A90140C18F62 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 +1

I = think Henning pointed out the value for consumers of devices = validating.

I = think the advantage to devices and enterprises signing is relieving the = carrier of liability, but I agree with you that we have to start with = carriers signing and validating.

I also think your observations that it = gets a lot simpler to deploy if there are only a few certs to issue is = correct, although I wonder if it is really the right thing for carriers = to share secret keys among all the replicated parts of their = infrastructure.  It may be that a carrier gets a small set of keys = that are used by a Sub CA the carrier operates to issue individual keys = to each box that signs.

Since the key has to be associated with all the numbers the = carrier is delegated, it is not entirely clear if you want one, or a = bunch of keys per carrier.  

There isn=E2=80=99t any standards issue = with any variation here.  It=E2=80=99s all deployment decisions, = and so we don=E2=80=99t have to deal with those issues here or really in = any other body.  It=E2=80=99s obvious that the carrier gets keys = for numbers it has been delegated by the numbering authority.  How = many keys it gets, and which keys go with which TNs is up to it. =  What it does with them (use the keys directly to sign, or operate = a CA that issues keys to the boxes that sign) is up to it.

Where it might get = complicated is if the carrier ever obtains numbers in a resale = arrangement with another carrier.  In those cases, it would get a = cert from that carrier along with the numbers, and then has to use those = keys (directly or indirectly) to sign for calls from those numbers. =  If all of the numbers it signs for come from the NRA, it=E2=80=99s = easy.

Brian

On Aug 10, 2016, at 10:54 AM, = Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

=46rom a practical getting-started perspective I = hope it is agreeable that originating carriers (not end points such as = phones or PBXes) need to sign the calls and only because it=E2=80=99s a = lot less physical SIP-enabled things to touch and so the effort to reach = a valuable critical mass of authentication actions should be less and = faster.  And the termination side of the equation is the = same.  I think this implies carrier-based certs, a relatively small = number of them per carrier and maybe only a couple of CAs to start = with.
 
It is interesting to = contemplate how certs could be delegated to enterprises and other = endpoints enabled with signing technology, and how to encourage them to = sign.  Using only that approach I think it could be very difficult = to achieve a critical mass of signed calls and I assume would take a = longer time than starting with carriers. Also, since endpoints can = mis-sign either through fault or intention, and that there are so many = of them of varying brand and quantity, it will introduce signal = noise.
 
I assume mobile devices = may be more easily enabled (then enterprises) and we could expect most = signing within 10 years (assuming we still have 2+ years of standards, = development, testing, and deployment and the usual 4 to 6 year cycle of = device upgrade/replacement).  I assume WebRTC will be more = challenging with respect to adoption/usage.
 
I=E2=80= =99m with Paul Rosbatham in that I=E2=80=99m not sure we as consumers = really want or even benefit much from endpoint signing and = interpretation.  I=E2=80=99m not fundamentally against it, but it = introduces additional challenges, and I=E2=80=99m not able to easily = foresee what the mish-mash of results of that approach will look = like.
 
Since we think we can get = anti-robocalling value from adding (variable) authenticity to calling = numbers, and we want it sooner rather than later, I think you want the = carriers managing the start-up of the technology and you want it to = operate within the network (mostly) to start.
 
Pierce
 
From: Henning = Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov] 
Sent: August 10, 2016 9:19 AM
To: Rosbotham, Paul, Vodafone = UK <paul.rosbotham@vodafone.com>; Brian Rosen <br@brianrosen.net>; = Andy Hutton <andyhutton.ietf@gmail.com>
Cc: IETF = STIR Mail List <stir@ietf.org>; Paul Kyzivat <pkyzivat@alum.mit.edu>; Richard Shockey <richard@shockey.us>
Subject: Re: [stir] STIR's basic = operational model with SIP
 
Don't know about telemarketing-style nuisance calls = (although I have been offered cruises on my FCC work phone...), but = TDOS is a big issue for healthcare and hospitality companies. Also, = financial institutions would benefit from knowing whether the claimed = number is real. They wouldn't reject unauthenticated calls, but would = apply different customer validation procedures, such as warning the = customer service representative or having fraud control monitor the = interaction in real-time.
From: Rosbotham, = Paul, Vodafone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 = 10:11:10 AM
To: Henning Schulzrinne; Brian = Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul = Kyzivat; Richard Shockey
Subject: RE: [stir] STIR's basic = operational model with SIP
 
Fair point Henning.
 
I = guess my focus is that most of the victims at present (here at least) = are resi/mobile; not to say that enterprises don=E2=80=99t receive = nuisance calls but it=E2=80=99s not those which are causing our = government ministers=E2=80=99 inboxes to fill up with irate = letters.  I=E2=80=99m not saying I=E2=80=99m against enterprises = doing their own checking, more that it=E2=80=99s an edge case (unlike = enterprises signing, which is absolutely core to the issues around = nuisance calls).  Perhaps it=E2=80=99s different in the US = market.
 
From: Henning = Schulzrinne [mailto:Henning.Schulzrinne@fcc.gov] 
Sent: 10 = August 2016 15:02
To: Rosbotham, Paul, Vodafone = UK; Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul = Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic = operational model with SIP
 
There are three facets:
* checking
* marking = (translating the checking result into something else, whether that's = caller-ID-related information or some SIP header)
* call handling = (call rejection, voice mail, etc.) based on either authentication status = or call origin
 
Unless the = terminating carrier performs all three or possibly checking and marking, = the enterprise will need to do that, e.g., to implement a = unauthenticated-to-voicemail or failed-to-reject policy. Since we = currently don't have a good standards-based way to do marking (and it = isn't clear that this offers significant value compared to just doing = the checking again), I suspect that means that either carriers have to = implement both checking and call policy, or the end system has to do = both. Some policy options, such as routing to voicemail, seem much = easier to do at the enterprise level.
 
Henning
From: stir <stir-bounces@ietf.org> on = behalf of Rosbotham, Paul, Vodafone UK <paul.rosbotham@vodafone.com>
Sent: Wednesday, August 10, 2016 = 9:53:06 AM
To: Brian Rosen; Andy Hutton
Cc: IETF STIR Mail List; Paul = Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic = operational model with SIP
 
I=E2=80=99d agree here.
 
At = the originating/signing end, there are good reasons to involve the = enterprise (if not initially, then certainly as a longer term = solution).
 
At the = terminating/checking end, I don=E2=80=99t =E2=80=9Cget=E2=80=9D what = having an enterprise do their own checking gains, compared to it = happening as a service in the network.  I=E2=80=99m not = philosophically opposed, just don=E2=80=99t see the benefit.
 
(Incidentally, = although transit networks could do the checking, I see it more occurring = at the terminating end.  The terminating network owns the = commercial relationship with the end customer that=E2=80=99s being = inconvenienced by nuisance calls; it=E2=80=99s they that can derive = commercial/public-policy gain or make their relationship more = =E2=80=9Csticky=E2=80=9D by helping prevent these)
 
Cheers
 
Paul
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf = Of Brian Rosen
Sent: 10 August 2016 14:15
To: Andy Hutton
Cc: IETF = STIR Mail List; Paul Kyzivat; Richard Shockey
Subject: Re: [stir] STIR's basic = operational model with SIP
 
Maybe I don=E2=80=99t = understand the question, but I certainly want to see the Identity header = and the JWT sent to the device/enterprise.  I certainly hope the = device/enterprise will have access to the PKI and OCSP service to = validate.  Then it can decide what to do with the call.
 
If the = network drops the call then clearly the enterprise can=E2=80=99t do = anything.  If the display name is changed, maybe it could.
 
Brian
 
On Aug 10, 2016, at 9:11 AM, Andy Hutton <andyhutton.ietf@gmail.com> = wrote:
 
OK = understood but if the callee device or could be an enterprise network is = going to make decisions based on this don't we need to specify the = information/signalling on which they make that decision?
 
Andy
 
On Wed, Aug 10, 2016 = at 2:02 PM, Brian Rosen <br@brianrosen.net> wrote:
I don=E2=80=99t think that is = at all true.  If validation is done at, say a transit network = interconnect, and the transit network refuses to accept the call without = a valid signature (assuming it does not run afoul of its local = regulations in doing so), then there is value to the consumer.  If = the termination network does the same, value.  If the termination = network modifies the signaling towards the consumer so that the display = name is =E2=80=9Csuspicious call=E2=80=9D or  =E2=80=9Cunknown = caller=E2=80=9D, that is of great value to the consumer.  If it = offers an option to the consumer to send calls with bad signatures or no = signatures direct to voicemail, that is of great value.
 
So, while = I really, really do want to do the validation on the device (because the = consumer will have more options available of that is what happens), I = think the mechanism can help consumers way before it shows up on the = device and the device is able to do something with it.
 
Brian
 
On Aug 10, 2016, at 8:41 AM, Andy Hutton = <andyhutton.ietf@gmail.com> wrote:
 
 
Also as Dave Crocker pointed out what happens at the callee = is also important if no validation is possible at the callee's device = then surely there is no real benefit to the consumer.
 
Regards
Andy
 
On Tue, Aug 9, 2016 = at 6:09 PM, Richard Shockey <richard@shockey.us> wrote:



On = 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" <stir-bounces@ietf.org on behalf ofpkyzivat@alum.mit.edu> wrote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
    >
    > +1 it has = to start some where.
    >
 =   > The circles of trust start first with the circles of = authority and then can be delegated as requirements dictate.  The = integrity numbering plan is a direct and plenary responsibility of = NRA=E2=80=99s period full stop.
    >
    > I=E2=80=99m less confident we will ever = get to the device level..at least not for the foreeable future aka my = lifetime.

    If the SPs have an = incentive to *not* delegate then it will be very hard
 =   to get there.

RS> Not our = concern.   Way beyond our scope of competence here. Don=E2=80=99= t forget the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80=99s = Silver Hammer=E2=80=9D and you can be sure they can use it if delegation = or lack thereof is perceived to be anti competitive.


    OTOH, if they have an incentive = then the chances are better.

    = Brian and Paul R outlined some possible incentives to delegate. That
    gives some hope.

        Thanks,
  =       Paul

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
 
 


This e-mail may contain Sprint proprietary information = intended for the sole use of the recipient(s). Any use by others is = prohibited. If you are not the intended recipient, please contact the = sender and delete all copies of the = message.

= --Apple-Mail=_F1A9FD60-DB86-43B2-96FC-A90140C18F62-- From nobody Wed Aug 10 08:11:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A9DF12D599 for ; Wed, 10 Aug 2016 08:11:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bU98f_yLHDeg for ; Wed, 10 Aug 2016 08:11:49 -0700 (PDT) Received: from smtp-fr.alcatel-lucent.com (fr-hpida-esg-02.alcatel-lucent.com [135.245.210.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BDD8127078 for ; Wed, 10 Aug 2016 08:11:48 -0700 (PDT) Received: from fr712umx4.dmz.alcatel-lucent.com (unknown [135.245.210.45]) by Websense Email Security Gateway with ESMTPS id B2E2FC45680DD; Wed, 10 Aug 2016 15:11:43 +0000 (GMT) Received: from fr712usmtp2.zeu.alcatel-lucent.com (fr712usmtp2.zeu.alcatel-lucent.com [135.239.2.42]) by fr712umx4.dmz.alcatel-lucent.com (GMO-o) with ESMTP id u7AFBi5q023243 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 10 Aug 2016 15:11:45 GMT Received: from FR712WXCHHUB03.zeu.alcatel-lucent.com (fr712wxchhub03.zeu.alcatel-lucent.com [135.239.2.74]) by fr712usmtp2.zeu.alcatel-lucent.com (GMO) with ESMTP id u7AFBeHN014641 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 10 Aug 2016 17:11:42 +0200 Received: from FR712WXCHMBA11.zeu.alcatel-lucent.com ([169.254.7.217]) by FR712WXCHHUB03.zeu.alcatel-lucent.com ([135.239.2.74]) with mapi id 14.03.0195.001; Wed, 10 Aug 2016 17:10:50 +0200 From: "Drage, Keith (Nokia - GB)" To: "Dwight, Timothy M (Tim)" , "Gorman, Pierce A [CTO]" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ybRDRyEXgtj+E6K9Rb6evlIXKA6W8IAgAAZW4CAAAHSAIAADhUAgARzW4CAAB/9AIAAzz8Q Date: Wed, 10 Aug 2016 15:10:50 +0000 Message-ID: <949EF20990823C4C85C18D59AA11AD8BADF44EB8@FR712WXCHMBA11.zeu.alcatel-lucent.com> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu>, <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> In-Reply-To: <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.239.27.38] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Richard Shockey , Paul Kyzivat , "stir@ietf.org" , Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 15:11:53 -0000 Be careful. I think you will find it is mandatory to be supported, not mandatory to be = carried. It is perfectly applicable to reach the edge of the trust domain and not pr= ovide it between two networks. At least from the 3GPP specifications, the trust domain for PAI, comes back= down to RFC 3325, so in that respect there is no such thing as implicit tr= ust. While there might be emphasis on supporting trust between network oper= ators, if you cannot trust the sender to provide your own quality of checks= , and you cannot trust the receiver to apply your own quality of privacy, t= hen it should be ignored on receipt, and not be sent. Keith -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Dwight, Timothy M (T= im) Sent: 08 August 2016 16:47 To: Gorman, Pierce A [CTO]; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK; Brian Rosen; stir@ietf.org; Paul Kyzivat;= Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments Pierce, My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA IR.95= . The latter references and profiles the former. Section 4.4.1 of IR.95 r= ecommends that MNO-to-MNO or MNO-to-IPX interconnects be considered trusted= , and table 3 in that section recommends that P-Asserted-Identity (PAI) be = exchanged at a trusted interconnect. It also states that PAI is mandatory = at a roaming NNI. Tim -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce A [CT= O] Sent: Monday, August 08, 2016 8:52 AM To: DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; stir@ietf.= org; Brian Rosen Subject: [E] Re: [stir] STIR 4474bis-10 comments Martin, You referenced TS 29.195. I'm not familiar with that spec. Has it been de= precated? It's not showing up on the 3GPP site. I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the origina= ting side" Note 4 it states, " It is assumed that the IBCF is responsible f= or stripping the P-Asserted-Identity from the SIP header when interworking = with untrusted networks." Your remark is consistent with Note 4, but only if we agree that, for insta= nce, the AT&T network and the Sprint network are "trusted networks". In re= ality, this is not the case or there would be no firewalls or Session Borde= r Controllers used for interworking and security. My opinion is the only c= arrier networks that are trusted are the SS7 network, and the Internet back= bone. What it really comes down to is that PAI is left in signaling either throug= h formal specification as a part of an inter-carrier inter-connection agree= ment, or by custom (or even by accident). I think this illustrates Paul Ro= sbotham's observation is true. Pierce -----Original Message----- From: DOLLY, MARTIN C [mailto:md3135@att.com] Sent: August 05, 2016 12:55 PM To: Gorman, Pierce A [CTO] Cc: Rosbotham, Paul, Vodafone UK ; Brian Rosen= ; stir@ietf.org; Paul Kyzivat ; = Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments PAI is not stripped at the network boundary between trusted networks 3GPP T= S 29.195 Atis specs GSMA Atis sip forum task force ITU And the list goes on Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: 609-903-3360 Email: md3135@att.com > On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] wrote: > > Which header the carrier chooses to display is moot if the header is stri= pped between carriers as per at least one standard. I think Paul Rosbotham= 's observation we're likely to encounter "some interesting interworking cha= llenges" was perhaps the understatement of the year. > > Pierce > > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 05, 2016 11:58 AM > To: Gorman, Pierce A [CTO] ; Richard Shockey=20 > ; Rosbotham, Paul, Vodafone UK=20 > ; Brian Rosen > Cc: stir@ietf.org > Subject: Re: [stir] STIR 4474bis-10 comments > > If PAI is present and signed, and From is also signed, I would expect it = to be up to the UA to decide what to display, not the carrier. > > Of course this will work differently if there is a different signaling re= gime between the carrier and the user device (e.g. black phone). > > Thanks, > Paul > >> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >> P-Asserted-Identity is supposed to operate "among trusted SIP entities" = and therefore some specifications (e.g., 3GPP TS 24.607) assume P-Asserted-= Identity is stripped by border controller functions and is not to be used i= n inter-carrier inter-connection (although it commonly shows up anyway). M= y opinion is the "From" header is likely used more often for presentation. >> >> Pierce >> >> >> -----Original Message----- >> From: Richard Shockey [mailto:richard@shockey.us] >> Sent: August 05, 2016 9:37 AM >> To: Rosbotham, Paul, Vodafone UK ; Paul=20 >> Kyzivat ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> >> Humm this is getting interesting. Its my understanding that the display= number aka "presentation number" in the US context is the one carried in t= he PAI. Martin, Pierce? >> >> >> >> >> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" wrote: >> >> Jumping in now that we're on European working time, +1 on Paul's obse= rvation. >> >> Here in the UK, we've got 2 numbers carried as calling line IDs....on= e (we term the Network Number, carried in PAID) uniquely identifies the lin= e, the other (we term Presentation Number, carried in From) is used for dis= play purposes. >> >> Only the carrier has the authority to set the Network Number so only = they could sign it. >> >> But - subject to regulatory restrictions which are well documented - = the number sent for display purposes belongs to the customer. For blue-chi= p customers, I can allow them to send their Presentation Numbers into the n= etwork, and can't readily check at a network level that they're theirs (I d= o have contractual safeguards). The number may have been allocated by me, = or could be allocated by a third party provider. If it's a call-centre the= y'll be making outbound calls for lots of different customers which will ch= ange on day-by-day basis. This is business as usual. I don't like the ter= m "authorised spoofing" because it implies that the CLI is in some way bein= g rigged: it's not, it's the corporate customer or their subcontractor usin= g the number that's been assigned (so in internet terms delegated) to them = via a chain of trust from the regulator. >> >> What I want is the ability for customers to use their credentials=20 >> to sign the CLIs they send me so that at the terminating end it can=20 >> be checked (or indeed somewhere en-route if that's the business model). >> I can and would sign for customers on my mobile business since I'm=20 >> driving what number is presented, but that's by-the-by because they=20 >> aren't the ones who generate millions of nuisance calls. If the=20 >> signing only occurs at the originating carrier level for=20 >> corporate/call-centre customers that's no use because I'm not in a=20 >> position to do that for these type of customers...and the whole=20 >> system becomes a waste of time. I'd also highlight there are many=20 >> more of my large customers that I'd trust more than a far end=20 >> originating carrier that could be anywhere in the world (though we=20 >> have no shortage of small carriers that I wouldn't know from Adam=20 >> more locally in the >> UK....) >> >> Regards >> >> Paul >> >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat >> Sent: 04 August 2016 23:12 >> To: Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >> >>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>> I think it's not a delegation. The mobile phone is not being delegated= the TN, it's being authorized to place calls that are not from that TN, bu= t appear to be. >>> >>> The mechanism to handle the credential is exactly the same as a delegat= ion, so if you want to call it delegation, go ahead, but I prefer to call i= t authorized spoofing. >> >> IIUC the delegation is to a responsible entity (something that can be= held legally accountable - e.g. a person), not to a device. The entity can= then "use" the credential via any device(s) it chooses. In the case of the= mobile, the device then becomes a two-line phone. >> >> Thanks, >> Paul >> >>> Brian >>> >>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat wrote= : >>>> >>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20 >>>>> from his mobile, but sending the TN of his office phone as calling pa= rty. >>>>> The delegation to his office phone was made by his landline=20 >>>>> carrier to him. He then creates another credential, which he=20 >>>>> signs with his office phone credential that authorizes his mobile=20 >>>>> to send calls from his office number. He is spoofing (because the=20 >>>>> call is coming from his mobile's TN but claims to be from his=20 >>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>> credential to his mobile SP if they sign on his behalf. >>>> >>>> I don't understand how that is different from regular delegation. >>>> >>>> When his landline carrier gave him a delegated certificate for his lan= dline number, he should be able to install that in whatever devices he want= s - his landline UA, his mobile phone, etc. It is still delegated from his = landline carrier, even when used with calls via his mobile carrier. >>>> >>>> Thanks, >>>> Paul >>>> >>>>> Some folks don't like attaching the "spoofing" label to a legitimate = use. >>>>> >>>>> But that's how I describe it. >>>>> >>>>> Brian >>>>> >>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>> > wrote: >>>>>> >>>>>> +1, but with one question below: >>>>>> >>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>> I think all we need is to have credentials follow the delegation=20 >>>>>>> path, >>>>>> >>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>> authorized spoofers. >>>>>> >>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>> contrasted to "spoofers" who have been delegated their authority. >>>>>> >>>>>> Thanks, >>>>>> Paul >>>>>> >>>>>>> I don't think it matters who the delegator or delegatee are as=20 >>>>>>> long as the delegator is willing to take the heat for delegating=20 >>>>>>> to someone who sends a lot of bad calls. They can pass the buck=20 >>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20 >>>>>>> only if the SP knows who they delegated to, so authorities can=20 >>>>>>> follow the delegation path. There are plenty of certificated=20 >>>>>>> carriers who are willing to not care who they delegate to. The fac= t that there are some who do doesn't change much. >>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>> that you can pass the hot potato. >>>>>>> >>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20 >>>>>>> any calls placed on its network on any number it has been delegated= . >>>>>>> If it does, it's asserting that the calls are from who they are sup= posed to be from. >>>>>>> That should be straightforward, but we know it's not always, and=20 >>>>>>> that represents the hard part of deployment in my opinion. But=20 >>>>>>> once they delegate, they can hand responsibility to sign to the=20 >>>>>>> delegatee. But, that only works if they know who they are delegati= ng to. >>>>>>> >>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>> informal delegation path for telephone numbers in every country,=20 >>>>>>> and we can build a chain of trust from that delegation path. If=20 >>>>>>> you propose to alter that model, then we get into (policy)=20 >>>>>>> issues of which carriers/entities we trust and which we don't. >>>>>>> Our model is that you know who you delegate to, and once you do tha= t delegation, it's their problem. >>>>>>> That's pretty appealing I think, even if it's a change in some=20 >>>>>>> business practices. >>>>>>> >>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>> having a way to know which TNs are covered by a credential. >>>>>>> That's what we have, and I'm loath to change it. >>>>>>> >>>>>>> Brian >>>>>>> >>>>>>> >>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> OK, you talked me into indulging in one more message on policy=20 >>>>>>>> and use cases. >>>>>>>> >>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20 >>>>>>>> individual devices as well as multi-device and multi-number platfo= rms. >>>>>>>> >>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>> relationships are two additional factors which affect=20 >>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>> >>>>>>>> Inherent variable trustworthiness of a calling number was my=20 >>>>>>>> reason for suggesting a way to qualify the signature to reflect=20 >>>>>>>> that variability. >>>>>>>> >>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>> coming from a device assigned a single number, or from "trunk=20 >>>>>>>> group" which could originate calls using multiple numbers, and=20 >>>>>>>> can qualify to some degree the trustworthiness of number authentic= ity accordingly. >>>>>>>> >>>>>>>> My suggestion was qualifying calling number authenticity into=20 >>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>> semi-authenticated, and most-authenticated. There can be more=20 >>>>>>>> granularity, but it implies additional operational complexity=20 >>>>>>>> (both for the carriers and the consumers) and I assume diminishes = value. >>>>>>>> >>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>> relationship with typical consumers adds to the trustworthiness=20 >>>>>>>> assessment and partially because carriers are a regulated point=20 >>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most=20 >>>>>>>> calls originate and terminate between mobile consumers where=20 >>>>>>>> their carriers are able to usefully authenticate their device=20 >>>>>>>> and have a high degree of confidence of the authenticity of the ca= lling number. >>>>>>>> >>>>>>>> I think billions of per-TN certs of varying usability (revoked,=20 >>>>>>>> not >>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>> >>>>>>>> Conversely, I think billions of per-TN certs will work well, if=20 >>>>>>>> the calling party has to sign a call with a per-TN cert=20 >>>>>>>> provided by the called party. No called party cert to include? >>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>> with the called party, and the call can be authorized/treated acco= rdingly. >>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>> deployed on devices and PBXs. Whether they will be is a policy is= sue. >>>>>>>> >>>>>>>> The notion of credentials that are traceable to a delegation of=20 >>>>>>>> a TN is a mechanism that is part of the design of stir, and the=20 >>>>>>>> design allows delegation of one TN (to one device, although a=20 >>>>>>>> device like a PBX would have more than one TN per "device", and=20 >>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>> credential. For the use case we've discussed, a mobile phone=20 >>>>>>>> may also have a credential for, say, a TN that is delegated to=20 >>>>>>>> a landline, to cover the example case of a doctor placing a=20 >>>>>>>> call on his mobile, but getting his office number to show up as th= e calling party. Use of such mechanisms is policy. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO]=20 >>>>>>>> =20 >>>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> Thanks Brian. I'm afraid we're straying into a policy=20 >>>>>>>> discussion. Regardless, I do appreciate your explanation. I=20 >>>>>>>> would like to continue the discussion, but I'm pretty sure this=20 >>>>>>>> isn't the right forum. >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> =20 >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek =20 >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20 >>>>>>>> and any other devices that can be programmed to do so. >>>>>>>> They will be given credentials that only are valid for the TNs=20 >>>>>>>> they are authorized to sign for. They can try to sign any=20 >>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>> signature fail the checking. >>>>>>>> >>>>>>>> Getting service providers to sign on behalf of devices is a=20 >>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20 >>>>>>>> want to get out of the liability of signing on behalf of their=20 >>>>>>>> customers. If they can push of that responsibility to their=20 >>>>>>>> customer, only being responsible for getting the customer an=20 >>>>>>>> appropriate credential when they assign TNs, then I would=20 >>>>>>>> expect them to want to do so. That means the devices have to=20 >>>>>>>> be able to sign, but I understand many of the PBX vendors=20 >>>>>>>> think that's something they could provide in a future release. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>> > >>>>>>>> wrote: >>>>>>>> >>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>> extraordinarily easy to commit fraud with authenticated numbe= rs? >>>>>>>> >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* Alex Bobotek >>>>>>>> >; stir@ietf.org=20 >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> First of all, we would want the PBX to generate the signature= , >>>>>>>> but the service provider can do that. It should not add a >>>>>>>> valid signature to a call from a number it did not assign to >>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>> support the extra delegation required to support "authorized >>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>> calls from the same service provider and should not present >>>>>>>> any issue. >>>>>>>> >>>>>>>> Everyone will have to do work they don't do now to implement >>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>> > wrote: >>>>>>>> >>>>>>>> Fraud from compromised PBXes is common. And even where a >>>>>>>> PBX is not compromised, a carrier has no practical way of >>>>>>>> knowing whether the calling number is properly assigned >>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>> Therefore, checking whether the calling number was from a= n >>>>>>>> assigned range might be possible (and fraught with >>>>>>>> administrative challenges), but of limited value. And in >>>>>>>> the consumer market, there are calling products which >>>>>>>> support a parent subscriber number and "companion" device= s >>>>>>>> (e.g., tablets) which can place a call using the MDN of >>>>>>>> the parent subscriber. These are examples of where the >>>>>>>> authenticity of the calling number won't necessarily mean >>>>>>>> the same thing as the authenticity of a call from a singl= e >>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>> spoof checking. >>>>>>>> >>>>>>>> In another forum and anticipating calling number >>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>> specificity of authenticity, and calling number. This >>>>>>>> provides the identity of the originating carrier, some >>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>> number, and validty of the calling number (assuming nonce >>>>>>>> and replay issues can be addressed as reasonably suggeste= d >>>>>>>> below by Alex). >>>>>>>> >>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>> could be as follows: >>>>>>>> >>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>> >>>>>>>> *00 - No Credentials* >>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>> networks that don't natively support SIP or which don't >>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>> entirely untrustworthy. >>>>>>>> >>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>> Use case example(s): E911 on visited network w/o roaming >>>>>>>> agreement, manual roaming. >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN entirely >>>>>>>> untrustworthy >>>>>>>> >>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>> Use case example(s): Number block delegated from OCN, but >>>>>>>> no per-TN screen (SIP trunks). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less than >>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>> >>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls from >>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>> trustworthy >>>>>>>> >>>>>>>> *Public Use Case:* >>>>>>>> >>>>>>>> Undefined but assumed to use public or commercially >>>>>>>> available authentication services resources. e.g., >>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et cetera. >>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>> which would process them according to the rules of the >>>>>>>> Public Class application(s). >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>> *To:* Alex Bobotek >>>>>>> >>>>>>>> > >>>>>>>> *Cc:* stir@ietf.org >>>>>>>> >>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> There are reasonable circumstances where a party placing = a >>>>>>>> call is not the authorized entity assigned the telephone >>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>> service provider servicing the entity placing the call ma= y >>>>>>>> or may not be the same as the service provider serving th= e >>>>>>>> entity that is assigned the TN. In all such cases, the >>>>>>>> entity that is assigned the TN explicitly authorizes call= s >>>>>>>> placed using it's TN. The design accommodates such use >>>>>>>> cases. It's not a blanket authorization without >>>>>>>> authentication. We're not aware of any cases where ther= e >>>>>>>> is an actual requirement for legitimate calling without >>>>>>>> explicit authorization from the assigned entity, although >>>>>>>> we certainly are aware that various parts of various >>>>>>>> service providers don't bother to check. At this point, a= t >>>>>>>> least in some countries, there is a realization that the >>>>>>>> laxity of allowing unchecked spoofing is not acceptable >>>>>>>> any more. >>>>>>>> >>>>>>>> Brian >>>>>>>> >>>>>>>> >>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>> >>>>>>> > wrote: >>>>>>>> >>>>>>>> 1. Permit authorization without authentication >>>>>>>> In the current telephony network practice, some >>>>>>>> service provider implementations choose not to >>>>>>>> authenticate identity, but simply facilitate the use >>>>>>>> of an arbitrary or selected user-provided identity. >>>>>>>> Are there legitimate use cases for this? Has anyone >>>>>>>> established that there are not? How can the industry >>>>>>>> reasonably expect to end this (often bad) practice? >>>>>>>> If it can't be ended, there's value in at least >>>>>>>> identifying the originating service provider >>>>>>>> (i.e., the signer/authorizer). Given the prevalence >>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>> important to identify the service provider(s) closest >>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>> better to ID service providers than unreasonably >>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>> therefore unsigned) SIP requests, STIR signing should >>>>>>>> support authorization without authentication. The >>>>>>>> practice of authorizing unauthenticated use exists, >>>>>>>> and there is benefit to signing in these cases >>>>>>>> (service provider identification). The language of >>>>>>>> the ID should permit this use. 4474bis-10 should NOT >>>>>>>> require or assume that that authentication will >>>>>>>> precede authorization. Of course there may be other >>>>>>>> use cases where signing includes authentication and >>>>>>>> may not include a specific service provider's >>>>>>>> authorization. >>>>>>>> >>>>>>>> >>>>>>>> 2. Improve replay prevention >>>>>>>> Proximate replay is possible while complying with thi= s >>>>>>>> spec. First, one or more proximate (e.g., within 60 >>>>>>>> seconds) SIP requests using the same token are legal >>>>>>>> and subject to replay in many cases. An SDP body's >>>>>>>> mky may not be present and if present its use is >>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>> signed sequence, random # or request ID (e.g., Call-I= D >>>>>>>> or CSeq) and a 1-time use policy on the receiving end >>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>> use) could prevent replay. Different methods (e.g., >>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>> receiving infrastructure, and therefore difficulties >>>>>>>> with 'it's been used already' coordination allow a >>>>>>>> faked MESSAGE based on a captured request. This might >>>>>>>> include an mkey from a captured INVITE. So it may b= e >>>>>>>> possible to DOS, spam or text-bomb a recipient using = a >>>>>>>> captured identity. While large-scale or distributed >>>>>>>> implementations may make the enforcement difficult, >>>>>>>> there is little cost to signing and decoding a method >>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>> practice should at least be discussed while perhaps >>>>>>>> not required. >>>>>>>> >>>>>>>> >>>>>>>> Specific markup suggestions: >>>>>>>> >>>>>>>> >>>>>>>> NITS >>>>>>>> >>>>>>>> >>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>> parameter appearing *in*the >>>>>>>> >>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>> present, then the >>>>>>>> >>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>> parameter value is >>>>>>>> >>>>>>>> present, and the verifier does not support it,=20 >>>>>>>> it MUST ignore the >>>>>>>> >>>>>>>> Identity header. If a supported "ppt" >>>>>>>> parameter value is present, >>>>>>>> >>>>>>>> the verifier follows the procedures below,=20 >>>>>>>> including the variations >>>>>>>> >>>>>>>> described in Step 5. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> 3 >>>>>>>> . >>>>>>>> Background >>>>>>>> >>>>>>>> [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Per [RFC7340 >>>>>>>> ], problems such as=20 >>>>>>>> robocalling, voicemail hacking, and >>>>>>>> >>>>>>>> swatting are enabled by an attacker's ability=20 >>>>>>>> to impersonate someone >>>>>>>> >>>>>>>> else. The secure operation of most SIP=20 >>>>>>>> applications and services >>>>>>>> >>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>> the source of communications as it is >>>>>>>> >>>>>>>> represented in a SIP request. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This identity architecture for SIP depends on=20 >>>>>>>> includes provisions for a logical >>>>>>>> >>>>>>>> "authentication service" which validates caller=20 >>>>>>>> identity at or near origination. outgoing >>>>>>>> requests. An >>>>>>>> >>>>>>>> authentication service may be implemented=20 >>>>>>>> either as part of a user >>>>>>>> >>>>>>>> agent or as a proxy server; typically, it is a=20 >>>>>>>> component of a network >>>>>>>> >>>>>>>> intermediary like a proxy to which originating=20 >>>>>>>> user agents send >>>>>>>> >>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>> message has been >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This document specifies a means of sharing a=20 >>>>>>>> cryptographic assurance >>>>>>>> >>>>>>>> of authenticity of and/or authorization to use=20 >>>>>>>> end-user SIP identity in an interdomain or intradomain context. >>>>>>>> >>>>>>>> It relies on the authentication service=20 >>>>>>>> constructing tokens based on [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>> typically obviously >>>>>>>> >>>>>>>> preferable for end-users to acquire their own=20 >>>>>>>> credentials; if they >>>>>>>> >>>>>>>> do, their user agents can act as authentication=20 >>>>>>>> services. However, >>>>>>>> >>>>>>>> for some deployments, [...] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Regards, >>>>>>>> >>>>>>>> Alex >>>>>>>> * * >>>>>>>> *Alex Bobotek* >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> --------------------------------------------------------------- >>>>>>>> -- >>>>>>>> ------- >>>>>>>> >>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>> intended for the sole use of the recipient(s). Any use by >>>>>>>> others is prohibited. If you are not the intended >>>>>>>> recipient, please contact the sender and delete all copie= s >>>>>>>> of the message. >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org =20 >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> >> >> >> >> ________________________________ >> >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 10 08:24:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D187512D0B4 for ; Wed, 10 Aug 2016 08:24:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fie6X4X0c8sP for ; Wed, 10 Aug 2016 08:24:26 -0700 (PDT) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43DAA12D7F1 for ; Wed, 10 Aug 2016 08:24:25 -0700 (PDT) Received: by mail-qk0-x234.google.com with SMTP id l2so46861839qkf.3 for ; Wed, 10 Aug 2016 08:24:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vMV0tXwO9nLboubfp2UieEKT9cMD2D9MzOhrW5Nv9Mk=; b=qAsbuxsdpOPJvleX5Jaah6dF3SBKjacapMTEA7kzus77CaZv65W7DT3Msqbc2RsQqa gZBQlTNe9IDEZ/GLjCoMdqjlGo4MSOBoK3bvKNC0QmcdA4pSUIshznk8jxO/MSqJKPAb 6O2b5bvJxVcWkaxVSCc6UIWEjW8gowrgMhsIwSSrvtlv3IfsQtiUKR8RUb7dDTJXf2zM GPTbdUisIp/ipPfxJ/sFaEeLt8ioAETgp8j88lJPltJx1ehtXV3vm+uVLlmGUQ2nrbr8 roTBZkZE3Al9BmIYK38xvokfItyueFy0pvJFi7anybmqWWRAp9yYHOqvqJlwiff3+WSy a/bA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vMV0tXwO9nLboubfp2UieEKT9cMD2D9MzOhrW5Nv9Mk=; b=czvl2irRd5fepH+z7bqWVSDi3hgTEqW6CXvVxe+9+WoApSrpoB1ArdJvBAezfi59lh /CZKf4kNEVWvKB7+xJIYOUn/T2RIgSqLvz5M+d8CrNRreQwEL2Lp61WQwNFShXAHh24e 11VWAWgxh6+jynw6qfGTRnbJin8YBmVyu1rrHSvEuzyDEaOxuRixKo4Qp5KMeJOQlE8d u5Io5ijLPPngY8dLj+9PUjE+6GU8v+i5BZ3Y4i58Vjq/+innZcHmO2KPDc3irgZU74JF ElJXHVRmQ/MbbegT8nV0VGCN8nzPqQ4fWFilm3ioWcCx2iwFxoqW1pXgDpkBIuKKN7h8 qDDg== X-Gm-Message-State: AEkoousOCNn2/+9l0aUz8n2PdE6gJ81/cJzWRXdmNgzwAFgQ2TG//zXwAdNcRHv2TbQcvw== X-Received: by 10.55.46.133 with SMTP id u127mr5044614qkh.43.1470842664052; Wed, 10 Aug 2016 08:24:24 -0700 (PDT) Received: from [10.33.192.77] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id l42sm23460213qtb.43.2016.08.10.08.24.22 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 10 Aug 2016 08:24:23 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <949EF20990823C4C85C18D59AA11AD8BADF44EB8@FR712WXCHMBA11.zeu.alcatel-lucent.com> Date: Wed, 10 Aug 2016 11:24:19 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <8944AE90-346B-4B57-9CF1-FE1C27D3DCFB@brianrosen.net> References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <61386a070cd14ccba7099f3951e81c9f@PLSWE13M08.ad.sprint.com> <17C9A535-D7BF-413A-9E9B-A5A2F0B4B6A3@brianrosen.net> <595a825401b04d198dfc137546fba535@PLSWE13M08.ad.sprint.com> <837ed8129f6a4b14ba524f7e154540b9@PLSWE13M08.ad.sprint.com> <44d13575-0651-4ba8-ad2a-1cccfd45a869@alum.mit.edu> <630DA1B0-8FD6-427D-8519-6F68A570F790@brianrosen.net> <8722f53f-b3fb-154f-87e3-21275dd7c2e6@alum.mit.edu> <3B8B22BC-2F04-4648-8B8E-6B0CAF62F302@brianrosen.net> <25123940-a11a-9cf8-fa5e-eaea675de038@alum.mit.edu> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <949EF20990823C4C85C18D59AA11AD8BADF44EB8@FR712WXCHMBA11.zeu.alcatel-lucent.com> To: "Drage, Keith (Nokia - GB)" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , "DOLLY, MARTIN C" , Paul Kyzivat , Richard Shockey , "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" , "Dwight, Timothy M \(Tim\)" Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 15:24:39 -0000 Remember that although we are discussing signature based on PAI in this = part of this thread, the =46rom really should have the same TN. If PAI is stripped, but Identity is not, the end device could use the = information in =46rom to validate. If the numbers were the same, the = check would work, because the canonicalization of the TN is the same. Where the =46rom and PAI differ, this won=E2=80=99t work of course. Brian > On Aug 10, 2016, at 11:10 AM, Drage, Keith (Nokia - GB) = wrote: >=20 > Be careful. >=20 > I think you will find it is mandatory to be supported, not mandatory = to be carried. >=20 > It is perfectly applicable to reach the edge of the trust domain and = not provide it between two networks. >=20 > At least from the 3GPP specifications, the trust domain for PAI, comes = back down to RFC 3325, so in that respect there is no such thing as = implicit trust. While there might be emphasis on supporting trust = between network operators, if you cannot trust the sender to provide = your own quality of checks, and you cannot trust the receiver to apply = your own quality of privacy, then it should be ignored on receipt, and = not be sent. >=20 > Keith >=20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Dwight, Timothy = M (Tim) > Sent: 08 August 2016 16:47 > To: Gorman, Pierce A [CTO]; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK; Brian Rosen; stir@ietf.org; Paul = Kyzivat; Richard Shockey > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > Pierce, >=20 > My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and GSMA = IR.95. The latter references and profiles the former. Section 4.4.1 of = IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be = considered trusted, and table 3 in that section recommends that = P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. It = also states that PAI is mandatory at a roaming NNI. >=20 > Tim >=20 >=20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, Pierce = A [CTO] > Sent: Monday, August 08, 2016 8:52 AM > To: DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; = stir@ietf.org; Brian Rosen > Subject: [E] Re: [stir] STIR 4474bis-10 comments >=20 > Martin, >=20 > You referenced TS 29.195. I'm not familiar with that spec. Has it = been deprecated? It's not showing up on the 3GPP site. >=20 > I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the = originating side" Note 4 it states, " It is assumed that the IBCF is = responsible for stripping the P-Asserted-Identity from the SIP header = when interworking with untrusted networks." >=20 > Your remark is consistent with Note 4, but only if we agree that, for = instance, the AT&T network and the Sprint network are "trusted = networks". In reality, this is not the case or there would be no = firewalls or Session Border Controllers used for interworking and = security. My opinion is the only carrier networks that are trusted are = the SS7 network, and the Internet backbone. >=20 > What it really comes down to is that PAI is left in signaling either = through formal specification as a part of an inter-carrier = inter-connection agreement, or by custom (or even by accident). I think = this illustrates Paul Rosbotham's observation is true. >=20 > Pierce >=20 > -----Original Message----- > From: DOLLY, MARTIN C [mailto:md3135@att.com] > Sent: August 05, 2016 12:55 PM > To: Gorman, Pierce A [CTO] > Cc: Rosbotham, Paul, Vodafone UK ; Brian = Rosen ; stir@ietf.org; Paul Kyzivat = ; Richard Shockey > Subject: Re: [stir] STIR 4474bis-10 comments >=20 > PAI is not stripped at the network boundary between trusted networks = 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force ITU And the = list goes on >=20 > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards > AT&T > Cell: 609-903-3360 > Email: md3135@att.com >=20 >> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] = wrote: >>=20 >> Which header the carrier chooses to display is moot if the header is = stripped between carriers as per at least one standard. I think Paul = Rosbotham's observation we're likely to encounter "some interesting = interworking challenges" was perhaps the understatement of the year. >>=20 >> Pierce >>=20 >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: August 05, 2016 11:58 AM >> To: Gorman, Pierce A [CTO] ; Richard = Shockey=20 >> ; Rosbotham, Paul, Vodafone UK=20 >> ; Brian Rosen >> Cc: stir@ietf.org >> Subject: Re: [stir] STIR 4474bis-10 comments >>=20 >> If PAI is present and signed, and =46rom is also signed, I would = expect it to be up to the UA to decide what to display, not the carrier. >>=20 >> Of course this will work differently if there is a different = signaling regime between the carrier and the user device (e.g. black = phone). >>=20 >> Thanks, >> Paul >>=20 >>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>> P-Asserted-Identity is supposed to operate "among trusted SIP = entities" and therefore some specifications (e.g., 3GPP TS 24.607) = assume P-Asserted-Identity is stripped by border controller functions = and is not to be used in inter-carrier inter-connection (although it = commonly shows up anyway). My opinion is the "From" header is likely = used more often for presentation. >>>=20 >>> Pierce >>>=20 >>>=20 >>> -----Original Message----- >>> From: Richard Shockey [mailto:richard@shockey.us] >>> Sent: August 05, 2016 9:37 AM >>> To: Rosbotham, Paul, Vodafone UK ; Paul=20= >>> Kyzivat ; Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>>=20 >>>=20 >>> Humm this is getting interesting. Its my understanding that the = display number aka "presentation number" in the US context is the one = carried in the PAI. Martin, Pierce? >>>=20 >>>=20 >>>=20 >>>=20 >>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone UK" = wrote: >>>=20 >>> Jumping in now that we're on European working time, +1 on Paul's = observation. >>>=20 >>> Here in the UK, we've got 2 numbers carried as calling line = IDs....one (we term the Network Number, carried in PAID) uniquely = identifies the line, the other (we term Presentation Number, carried in = From) is used for display purposes. >>>=20 >>> Only the carrier has the authority to set the Network Number so = only they could sign it. >>>=20 >>> But - subject to regulatory restrictions which are well documented = - the number sent for display purposes belongs to the customer. For = blue-chip customers, I can allow them to send their Presentation Numbers = into the network, and can't readily check at a network level that = they're theirs (I do have contractual safeguards). The number may have = been allocated by me, or could be allocated by a third party provider. = If it's a call-centre they'll be making outbound calls for lots of = different customers which will change on day-by-day basis. This is = business as usual. I don't like the term "authorised spoofing" because = it implies that the CLI is in some way being rigged: it's not, it's the = corporate customer or their subcontractor using the number that's been = assigned (so in internet terms delegated) to them via a chain of trust = from the regulator. >>>=20 >>> What I want is the ability for customers to use their credentials=20= >>> to sign the CLIs they send me so that at the terminating end it can=20= >>> be checked (or indeed somewhere en-route if that's the business = model). >>> I can and would sign for customers on my mobile business since I'm=20= >>> driving what number is presented, but that's by-the-by because they=20= >>> aren't the ones who generate millions of nuisance calls. If the=20 >>> signing only occurs at the originating carrier level for=20 >>> corporate/call-centre customers that's no use because I'm not in a=20= >>> position to do that for these type of customers...and the whole=20 >>> system becomes a waste of time. I'd also highlight there are many=20 >>> more of my large customers that I'd trust more than a far end=20 >>> originating carrier that could be anywhere in the world (though we=20= >>> have no shortage of small carriers that I wouldn't know from Adam=20 >>> more locally in the >>> UK....) >>>=20 >>> Regards >>>=20 >>> Paul >>>=20 >>> -----Original Message----- >>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul = Kyzivat >>> Sent: 04 August 2016 23:12 >>> To: Brian Rosen >>> Cc: stir@ietf.org >>> Subject: Re: [stir] STIR 4474bis-10 comments >>>=20 >>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>> I think it's not a delegation. The mobile phone is not being = delegated the TN, it's being authorized to place calls that are not from = that TN, but appear to be. >>>>=20 >>>> The mechanism to handle the credential is exactly the same as a = delegation, so if you want to call it delegation, go ahead, but I prefer = to call it authorized spoofing. >>>=20 >>> IIUC the delegation is to a responsible entity (something that can = be held legally accountable - e.g. a person), not to a device. The = entity can then "use" the credential via any device(s) it chooses. In = the case of the mobile, the device then becomes a two-line phone. >>>=20 >>> Thanks, >>> Paul >>>=20 >>>> Brian >>>>=20 >>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat = wrote: >>>>>=20 >>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>> In my jargon an "authorized spoofer" is the doctor who is calling=20= >>>>>> from his mobile, but sending the TN of his office phone as = calling party. >>>>>> The delegation to his office phone was made by his landline=20 >>>>>> carrier to him. He then creates another credential, which he=20 >>>>>> signs with his office phone credential that authorizes his mobile=20= >>>>>> to send calls from his office number. He is spoofing (because = the=20 >>>>>> call is coming from his mobile's TN but claims to be from his=20 >>>>>> office), but it's authorized spoofing. The doc could give the=20 >>>>>> credential to his mobile SP if they sign on his behalf. >>>>>=20 >>>>> I don't understand how that is different from regular delegation. >>>>>=20 >>>>> When his landline carrier gave him a delegated certificate for his = landline number, he should be able to install that in whatever devices = he wants - his landline UA, his mobile phone, etc. It is still delegated = from his landline carrier, even when used with calls via his mobile = carrier. >>>>>=20 >>>>> Thanks, >>>>> Paul >>>>>=20 >>>>>> Some folks don't like attaching the "spoofing" label to a = legitimate use. >>>>>>=20 >>>>>> But that's how I describe it. >>>>>>=20 >>>>>> Brian >>>>>>=20 >>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>> > wrote: >>>>>>>=20 >>>>>>> +1, but with one question below: >>>>>>>=20 >>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>> I think all we need is to have credentials follow the = delegation=20 >>>>>>>> path, >>>>>>>=20 >>>>>>>> plus the option to add another level (not delegation) for=20 >>>>>>>> authorized spoofers. >>>>>>>=20 >>>>>>> I don't understand "authorized spoofers" in this context, as=20 >>>>>>> contrasted to "spoofers" who have been delegated their = authority. >>>>>>>=20 >>>>>>> Thanks, >>>>>>> Paul >>>>>>>=20 >>>>>>>> I don't think it matters who the delegator or delegatee are as=20= >>>>>>>> long as the delegator is willing to take the heat for = delegating=20 >>>>>>>> to someone who sends a lot of bad calls. They can pass the = buck=20 >>>>>>>> ("I delegated the TN to him, and now I'm not responsible"), but=20= >>>>>>>> only if the SP knows who they delegated to, so authorities can=20= >>>>>>>> follow the delegation path. There are plenty of certificated=20= >>>>>>>> carriers who are willing to not care who they delegate to. The = fact that there are some who do doesn't change much. >>>>>>>> Making stir work means knowing who you are delegating to, so=20 >>>>>>>> that you can pass the hot potato. >>>>>>>>=20 >>>>>>>> It's perfectly reasonable for a carrier to be able to sign for=20= >>>>>>>> any calls placed on its network on any number it has been = delegated. >>>>>>>> If it does, it's asserting that the calls are from who they are = supposed to be from. >>>>>>>> That should be straightforward, but we know it's not always, = and=20 >>>>>>>> that represents the hard part of deployment in my opinion. But=20= >>>>>>>> once they delegate, they can hand responsibility to sign to the=20= >>>>>>>> delegatee. But, that only works if they know who they are = delegating to. >>>>>>>>=20 >>>>>>>> The root of the whole model is that there is a formal or=20 >>>>>>>> informal delegation path for telephone numbers in every = country,=20 >>>>>>>> and we can build a chain of trust from that delegation path. = If=20 >>>>>>>> you propose to alter that model, then we get into (policy)=20 >>>>>>>> issues of which carriers/entities we trust and which we don't. >>>>>>>> Our model is that you know who you delegate to, and once you do = that delegation, it's their problem. >>>>>>>> That's pretty appealing I think, even if it's a change in some=20= >>>>>>>> business practices. >>>>>>>>=20 >>>>>>>> The mechanism is chaining credentials in a form of a PKI and=20 >>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>=20 >>>>>>>> Brian >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO]=20 >>>>>>>>> =20 >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>>=20 >>>>>>>>> OK, you talked me into indulging in one more message on policy=20= >>>>>>>>> and use cases. >>>>>>>>>=20 >>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed on=20= >>>>>>>>> individual devices as well as multi-device and multi-number = platforms. >>>>>>>>>=20 >>>>>>>>> Number delegation (and sub-delegation), and business=20 >>>>>>>>> relationships are two additional factors which affect=20 >>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>=20 >>>>>>>>> Inherent variable trustworthiness of a calling number was my=20= >>>>>>>>> reason for suggesting a way to qualify the signature to = reflect=20 >>>>>>>>> that variability. >>>>>>>>>=20 >>>>>>>>> Originating carriers are in a position to know if a call is=20 >>>>>>>>> coming from a device assigned a single number, or from "trunk=20= >>>>>>>>> group" which could originate calls using multiple numbers, and=20= >>>>>>>>> can qualify to some degree the trustworthiness of number = authenticity accordingly. >>>>>>>>>=20 >>>>>>>>> My suggestion was qualifying calling number authenticity into=20= >>>>>>>>> categories of carrier-signed (or not), and unauthenticated,=20 >>>>>>>>> semi-authenticated, and most-authenticated. There can be more=20= >>>>>>>>> granularity, but it implies additional operational complexity=20= >>>>>>>>> (both for the carriers and the consumers) and I assume = diminishes value. >>>>>>>>>=20 >>>>>>>>> My reason for adding the authenticity of the originating=20 >>>>>>>>> carrier is typical trustworthiness of a carrier business=20 >>>>>>>>> relationship with typical consumers adds to the = trustworthiness=20 >>>>>>>>> assessment and partially because carriers are a regulated = point=20 >>>>>>>>> of forensic inquiry for CALEA and fraud. Additionally, most=20= >>>>>>>>> calls originate and terminate between mobile consumers where=20= >>>>>>>>> their carriers are able to usefully authenticate their device=20= >>>>>>>>> and have a high degree of confidence of the authenticity of = the calling number. >>>>>>>>>=20 >>>>>>>>> I think billions of per-TN certs of varying usability = (revoked,=20 >>>>>>>>> not >>>>>>>>> revoked) for authenticating calling number will not work well. >>>>>>>>>=20 >>>>>>>>> Conversely, I think billions of per-TN certs will work well, = if=20 >>>>>>>>> the calling party has to sign a call with a per-TN cert=20 >>>>>>>>> provided by the called party. No called party cert to = include? >>>>>>>>> Then the calling party does not have a trusted relationship=20 >>>>>>>>> with the called party, and the call can be authorized/treated = accordingly. >>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>=20 >>>>>>>>> Pierce >>>>>>>>>=20 >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> =20 >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek =20= >>>>>>>>> >; stir@ietf.org=20 >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>=20 >>>>>>>>> Well, the mechanisms are designed so that they could be=20 >>>>>>>>> deployed on devices and PBXs. Whether they will be is a = policy issue. >>>>>>>>>=20 >>>>>>>>> The notion of credentials that are traceable to a delegation = of=20 >>>>>>>>> a TN is a mechanism that is part of the design of stir, and = the=20 >>>>>>>>> design allows delegation of one TN (to one device, although a=20= >>>>>>>>> device like a PBX would have more than one TN per "device", = and=20 >>>>>>>>> something like a dual NAM phone could have more than one=20 >>>>>>>>> credential. For the use case we've discussed, a mobile phone=20= >>>>>>>>> may also have a credential for, say, a TN that is delegated to=20= >>>>>>>>> a landline, to cover the example case of a doctor placing a=20 >>>>>>>>> call on his mobile, but getting his office number to show up = as the calling party. Use of such mechanisms is policy. >>>>>>>>>=20 >>>>>>>>> Brian >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO]=20 >>>>>>>>> =20 >>>>>>>>> > >>>>>>>>> wrote: >>>>>>>>>=20 >>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy=20 >>>>>>>>> discussion. Regardless, I do appreciate your explanation. I=20= >>>>>>>>> would like to continue the discussion, but I'm pretty sure = this=20 >>>>>>>>> isn't the right forum. >>>>>>>>>=20 >>>>>>>>> Pierce >>>>>>>>>=20 >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> =20 >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek =20= >>>>>>>>> >; stir@ietf.org=20 >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>=20 >>>>>>>>> Of course I want PBXs to sign calls. As well as smart phones=20= >>>>>>>>> and any other devices that can be programmed to do so. >>>>>>>>> They will be given credentials that only are valid for the TNs=20= >>>>>>>>> they are authorized to sign for. They can try to sign any=20 >>>>>>>>> call, but the validity of the credential would make such a=20 >>>>>>>>> signature fail the checking. >>>>>>>>>=20 >>>>>>>>> Getting service providers to sign on behalf of devices is a=20 >>>>>>>>> reasonable way to deploy quickly, but I expect many SPs will=20= >>>>>>>>> want to get out of the liability of signing on behalf of = their=20 >>>>>>>>> customers. If they can push of that responsibility to their=20= >>>>>>>>> customer, only being responsible for getting the customer an=20= >>>>>>>>> appropriate credential when they assign TNs, then I would=20 >>>>>>>>> expect them to want to do so. That means the devices have to=20= >>>>>>>>> be able to sign, but I understand many of the PBX vendors=20 >>>>>>>>> think that's something they could provide in a future = release. >>>>>>>>>=20 >>>>>>>>> Brian >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>> = > >>>>>>>>> wrote: >>>>>>>>>=20 >>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>> extraordinarily easy to commit fraud with authenticated = numbers? >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>> >; stir@ietf.org=20 >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>=20 >>>>>>>>> First of all, we would want the PBX to generate the = signature, >>>>>>>>> but the service provider can do that. It should not add a >>>>>>>>> valid signature to a call from a number it did not assign = to >>>>>>>>> the trunk group connecting to the PBX, although it could >>>>>>>>> support the extra delegation required to support = "authorized >>>>>>>>> spoofing". The companion devices I'm aware of always send >>>>>>>>> calls from the same service provider and should not = present >>>>>>>>> any issue. >>>>>>>>>=20 >>>>>>>>> Everyone will have to do work they don't do now to = implement >>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>=20 >>>>>>>>> Brian >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>> >>>>>>>>> > wrote: >>>>>>>>>=20 >>>>>>>>> Fraud from compromised PBXes is common. And even = where a >>>>>>>>> PBX is not compromised, a carrier has no practical way = of >>>>>>>>> knowing whether the calling number is properly = assigned >>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>> Therefore, checking whether the calling number was = from an >>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>> administrative challenges), but of limited value. And = in >>>>>>>>> the consumer market, there are calling products which >>>>>>>>> support a parent subscriber number and "companion" = devices >>>>>>>>> (e.g., tablets) which can place a call using the MDN = of >>>>>>>>> the parent subscriber. These are examples of where = the >>>>>>>>> authenticity of the calling number won't necessarily = mean >>>>>>>>> the same thing as the authenticity of a call from a = single >>>>>>>>> subscriber with a single MDN regardless of "laxity" of >>>>>>>>> spoof checking. >>>>>>>>>=20 >>>>>>>>> In another forum and anticipating calling number >>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>> specificity of authenticity, and calling number. This >>>>>>>>> provides the identity of the originating carrier, some >>>>>>>>> idea as to the accuracy or specificity of the calling >>>>>>>>> number, and validty of the calling number (assuming = nonce >>>>>>>>> and replay issues can be addressed as reasonably = suggested >>>>>>>>> below by Alex). >>>>>>>>>=20 >>>>>>>>> The representation of orig-carrier and trustworthiness >>>>>>>>> could be as follows: >>>>>>>>>=20 >>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>=20 >>>>>>>>> *00 - No Credentials* >>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switched >>>>>>>>> networks that don't natively support SIP or which = don't >>>>>>>>> choose to sign calls. E.g., international carriers. >>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>> entirely untrustworthy. >>>>>>>>>=20 >>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>> Use case example(s): E911 on visited network w/o = roaming >>>>>>>>> agreement, manual roaming. >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN = entirely >>>>>>>>> untrustworthy >>>>>>>>>=20 >>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>> Use case example(s): Number block delegated from OCN, = but >>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN less = than >>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>=20 >>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>> Use case example(s): Bread-and-butter 95%+ of calls = from >>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN most >>>>>>>>> trustworthy >>>>>>>>>=20 >>>>>>>>> *Public Use Case:* >>>>>>>>>=20 >>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>> available authentication services resources. e.g., >>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et = cetera. >>>>>>>>> Could/would pass credentials down to SIP-aware devices >>>>>>>>> which would process them according to the rules of the >>>>>>>>> Public Class application(s). >>>>>>>>>=20 >>>>>>>>> Pierce >>>>>>>>>=20 >>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>> *To:* Alex Bobotek >>>>>>>> >>>>>>>>> > >>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>> >>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>=20 >>>>>>>>> There are reasonable circumstances where a party = placing a >>>>>>>>> call is not the authorized entity assigned the = telephone >>>>>>>>> number used in From/PAI, and in such circumstances the >>>>>>>>> service provider servicing the entity placing the call = may >>>>>>>>> or may not be the same as the service provider serving = the >>>>>>>>> entity that is assigned the TN. In all such cases, = the >>>>>>>>> entity that is assigned the TN explicitly authorizes = calls >>>>>>>>> placed using it's TN. The design accommodates such = use >>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>> authentication. We're not aware of any cases where = there >>>>>>>>> is an actual requirement for legitimate calling = without >>>>>>>>> explicit authorization from the assigned entity, = although >>>>>>>>> we certainly are aware that various parts of various >>>>>>>>> service providers don't bother to check. At this = point, at >>>>>>>>> least in some countries, there is a realization that = the >>>>>>>>> laxity of allowing unchecked spoofing is not = acceptable >>>>>>>>> any more. >>>>>>>>>=20 >>>>>>>>> Brian >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>> >>>>>>>> > wrote: >>>>>>>>>=20 >>>>>>>>> 1. Permit authorization without = authentication >>>>>>>>> In the current telephony network practice, some >>>>>>>>> service provider implementations choose not to >>>>>>>>> authenticate identity, but simply facilitate the = use >>>>>>>>> of an arbitrary or selected user-provided = identity. >>>>>>>>> Are there legitimate use cases for this? Has = anyone >>>>>>>>> established that there are not? How can the = industry >>>>>>>>> reasonably expect to end this (often bad) = practice? >>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>> identifying the originating service provider >>>>>>>>> (i.e., the signer/authorizer). Given the = prevalence >>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>> sometimes-anonymous abuser, it becomes critically >>>>>>>>> important to identify the service provider(s) = closest >>>>>>>>> to the abuser. Based on the assumption that it's >>>>>>>>> better to ID service providers than unreasonably >>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>> therefore unsigned) SIP requests, STIR signing = should >>>>>>>>> support authorization without authentication. The >>>>>>>>> practice of authorizing unauthenticated use = exists, >>>>>>>>> and there is benefit to signing in these cases >>>>>>>>> (service provider identification). The language = of >>>>>>>>> the ID should permit this use. 4474bis-10 should = NOT >>>>>>>>> require or assume that that authentication will >>>>>>>>> precede authorization. Of course there may be = other >>>>>>>>> use cases where signing includes authentication = and >>>>>>>>> may not include a specific service provider's >>>>>>>>> authorization. >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> 2. Improve replay prevention >>>>>>>>> Proximate replay is possible while complying with = this >>>>>>>>> spec. First, one or more proximate (e.g., within = 60 >>>>>>>>> seconds) SIP requests using the same token are = legal >>>>>>>>> and subject to replay in many cases. An SDP = body's >>>>>>>>> mky may not be present and if present its use is >>>>>>>>> optional. Some sort of mandatory new or existing >>>>>>>>> signed sequence, random # or request ID (e.g., = Call-ID >>>>>>>>> or CSeq) and a 1-time use policy on the receiving = end >>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>> use) could prevent replay. Different methods = (e.g., >>>>>>>>> INVITE vs MESSAGE) might be handled by different >>>>>>>>> receiving infrastructure, and therefore = difficulties >>>>>>>>> with 'it's been used already' coordination allow a >>>>>>>>> faked MESSAGE based on a captured request. This = might >>>>>>>>> include an mkey from a captured INVITE. So it = may be >>>>>>>>> possible to DOS, spam or text-bomb a recipient = using a >>>>>>>>> captured identity. While large-scale or = distributed >>>>>>>>> implementations may make the enforcement = difficult, >>>>>>>>> there is little cost to signing and decoding a = method >>>>>>>>> and possibly a numeric ID. Some sort of '1-use' >>>>>>>>> practice should at least be discussed while = perhaps >>>>>>>>> not required. >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> Specific markup suggestions: >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> NITS >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>> parameter appearing *in*the >>>>>>>>>=20 >>>>>>>>> Identity request. If no "ppt" parameter is=20 >>>>>>>>> present, then the >>>>>>>>>=20 >>>>>>>>> verifier proceeds normally below. If a "ppt" >>>>>>>>> parameter value is >>>>>>>>>=20 >>>>>>>>> present, and the verifier does not support it,=20= >>>>>>>>> it MUST ignore the >>>>>>>>>=20 >>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>> parameter value is present, >>>>>>>>>=20 >>>>>>>>> the verifier follows the procedures below,=20 >>>>>>>>> including the variations >>>>>>>>>=20 >>>>>>>>> described in Step 5. >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> 3 >>>>>>>>> = . >>>>>>>>> Background >>>>>>>>>=20 >>>>>>>>> [...] >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> Per [RFC7340 >>>>>>>>> ], problems such as=20 >>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>=20 >>>>>>>>> swatting are enabled by an attacker's ability=20= >>>>>>>>> to impersonate someone >>>>>>>>>=20 >>>>>>>>> else. The secure operation of most SIP=20 >>>>>>>>> applications and services >>>>>>>>>=20 >>>>>>>>> depends on authenticating and/or authorizing=20 >>>>>>>>> the source of communications as it is >>>>>>>>>=20 >>>>>>>>> represented in a SIP request. >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> This identity architecture for SIP depends on=20= >>>>>>>>> includes provisions for a logical >>>>>>>>>=20 >>>>>>>>> "authentication service" which validates caller=20= >>>>>>>>> identity at or near origination. outgoing >>>>>>>>> requests. An >>>>>>>>>=20 >>>>>>>>> authentication service may be implemented=20 >>>>>>>>> either as part of a user >>>>>>>>>=20 >>>>>>>>> agent or as a proxy server; typically, it is a=20= >>>>>>>>> component of a network >>>>>>>>>=20 >>>>>>>>> intermediary like a proxy to which originating=20= >>>>>>>>> user agents send >>>>>>>>>=20 >>>>>>>>> unsigned requests. Once the sender of the=20 >>>>>>>>> message has been >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> This document specifies a means of sharing a=20 >>>>>>>>> cryptographic assurance >>>>>>>>>=20 >>>>>>>>> of authenticity of and/or authorization to use=20= >>>>>>>>> end-user SIP identity in an interdomain or intradomain = context. >>>>>>>>>=20 >>>>>>>>> It relies on the authentication service=20 >>>>>>>>> constructing tokens based on [...] >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> To maximize end-to-end security, it is=20 >>>>>>>>> typically obviously >>>>>>>>>=20 >>>>>>>>> preferable for end-users to acquire their own=20= >>>>>>>>> credentials; if they >>>>>>>>>=20 >>>>>>>>> do, their user agents can act as authentication=20= >>>>>>>>> services. However, >>>>>>>>>=20 >>>>>>>>> for some deployments, [...] >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> Regards, >>>>>>>>>=20 >>>>>>>>> Alex >>>>>>>>> * * >>>>>>>>> *Alex Bobotek* >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> _______________________________________________ >>>>>>>>> stir mailing list >>>>>>>>> stir@ietf.org >>>>>>>>> >>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>>=20 >>>>>>>>> = --------------------------------------------------------------- >>>>>>>>> -- >>>>>>>>> ------- >>>>>>>>>=20 >>>>>>>>> This e-mail may contain Sprint proprietary information >>>>>>>>> intended for the sole use of the recipient(s). Any use = by >>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>> recipient, please contact the sender and delete all = copies >>>>>>>>> of the message. >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org =20 >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org =20 >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>=20 >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>>=20 >>>=20 >>>=20 >>>=20 >>> ________________________________ >>>=20 >>> This e-mail may contain Sprint proprietary information intended for = the sole use of the recipient(s). Any use by others is prohibited. If = you are not the intended recipient, please contact the sender and delete = all copies of the message. >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 10 10:11:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C597D12D12B for ; Wed, 10 Aug 2016 10:11:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2btempx0ME02 for ; Wed, 10 Aug 2016 10:11:22 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0118.outbound.protection.outlook.com [104.47.40.118]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37F6212D0DB for ; Wed, 10 Aug 2016 10:11:22 -0700 (PDT) Received: from BY2FFO11FD032.protection.gbl (10.1.14.34) by BY2FFO11HUB006.protection.gbl (10.1.14.164) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Wed, 10 Aug 2016 17:11:19 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.39) smtp.mailfrom=sprint.com; brianrosen.net; dkim=none (message not signed) header.d=none;brianrosen.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.39 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.39; helo=plsapdm3.corp.sprint.com; Received: from plsapdm3.corp.sprint.com (144.230.172.39) by BY2FFO11FD032.mail.protection.outlook.com (10.1.14.210) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Wed, 10 Aug 2016 17:11:19 +0000 Received: from pps.filterd (plsapdm3.corp.sprint.com [127.0.0.1]) by plsapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7AGorlp020040; Wed, 10 Aug 2016 12:11:18 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm3.corp.sprint.com with ESMTP id 24nd59pve0-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 10 Aug 2016 12:11:18 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 10 Aug 2016 12:11:17 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Wed, 10 Aug 2016 12:11:17 -0500 From: "Gorman, Pierce A [CTO]" To: Paul Kyzivat , Alex Bobotek , "Peterson, Jon" , "Dwight, Timothy M (Tim)" , "DOLLY, MARTIN C" Thread-Topic: [stir] STIR 4474bis-10 comments Thread-Index: AQHR7ljK7fowUOltt0S1W8SpYo1u7QA3LKKAAAWRJoAAAX9oAAACCpWAAABpDgAAAKK4AAAAWieAAAPgt4AAALpEgAAAy/8AAAA1f4AAAEbIAAAAZjkAAABSQQAAFBF5gAAOVnSAAAG+lwAAAytegAAAOkMAAAHCnQAAjmtqgAAD/5AAAADbMoAAAc19AAADVf2A//+dhAD//vySsKA6NsqA//+0l1AADG7kAAAKcEfQ///TNACAAE12wA== Date: Wed, 10 Aug 2016 17:11:17 +0000 Message-ID: References: <4B1956260CD29F4A9622F00322FE053101285D016E24@BOBO1A.bobotek.net> <84b71080-8125-24c3-3410-c505e699939b@alum.mit.edu> <07998079465c41cebfbe3e30eaa97225@PLSWE13M08.ad.sprint.com> <5e35dc7090f04130a75ea83e5ae84013@PLSWE13M08.ad.sprint.com> <2B0F677F0B95454297753F58D4A07FA302CC491390@FHDP1LUMXC7V31.us.one.verizon.com> <8f7532f487ec4ef98c5d1dd315868d6a@PLSWE13M08.ad.sprint.com> <4B1956260CD29F4A9622F00322FE053101285D016E33@BOBO1A.bobotek.net> <30807610-aaf7-a7e8-8004-81efdecc89a6@alum.mit.edu> <1fdbf8d22f014fbaa11e0ff40bf706d5@PLSWE13M08.ad.sprint.com> <0ce62665-ccb8-4668-71f4-ae59f4d7f698@alum.mit.edu> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.46] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.39; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(377454003)(189002)(199003)(252514010)(13464003)(24454002)(51914003)(43784003)(15975445007)(5890100001)(5250100002)(356003)(19580405001)(97756001)(102836003)(6116002)(325944008)(23726003)(76176999)(68736007)(7846002)(2950100001)(31430400001)(19580395003)(305945005)(2900100001)(7696003)(7736002)(551934003)(8666005)(54356999)(50986999)(5001770100001)(97736004)(24736003)(106116001)(586003)(4326007)(189998001)(93886004)(33646002)(86362001)(108616004)(106466001)(3846002)(87936001)(11100500001)(47776003)(81166006)(46406003)(81156014)(50466002)(2906002)(92566002)(2171001)(8676002)(8936002)(8746002)(626004)(7059030)(579004)(559001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB006; H:plsapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11FD032; 1:hsl4BRecfB9GYInWkVh6Z4ejTuaBPL3sbKSdKETMf1TFpRoS99DhMf/gBDRqm8eubsTF4A4rHEBDdn2NIb3AcFC3GT8J24ci/BblA8Tv/0egTq5MxCW7H9hcf/h62QD51kaGn7dZphA5qQotSatDZGYM+C0QI1t2uXxqipDTEGXl73Sfon8Uz7PEMIvZvtpltEQ1toa3esOmh8zO4ouyuLFzxfhtoBGQGhC32gWsKI1ZoMhoYgJUupa0m2wDKY5lVsHIeEl6EKgVEZd4EDwu9TwqL7PulVenMtxgHmagLrodL7caftqBQ7sgrrZHgFLNoSZQdiYwWXYwre4K8SIzh3Ftg3ojcCFN8cX97yMyThjqpryX2X7IcRgDbFC0pwxXe6Bfq9xCLOeBP2aEqCCZQAMTRXr2A385x6/CNyL8nMjswzZR/svxRbURIg5pvHtrdfrKgCxTLrts1VtoiAZnz2sdLx8Nmw8Ylj+ZBfUREKil+DqT8YJ1KyaZKOmo4CVO+PVALG3mOh9iyh7VSzk7i1brIQHnrogkBjmdfT3+5puyQyZWUUmEXfSaAmkP/uJPEvY5q7fPFImGU451r7IEKw== X-MS-Office365-Filtering-Correlation-Id: 142d3c7f-0a72-4f60-7d17-08d3c14158a8 X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB006; 2:lHeEHU3ivrLKnlbu1FOQJZ7V655zz3h3/Qwiwx3Dmutt2/RI8wFkSs5pZcME+JgQl3Z4VKXarlcUvbaTKwXhSEyTrhR7iU4Wsys8776VpuLxE7/x6rISUeCNsXNWmdZQiZsAOKCeGvRtkg5uIortQ9w6P5a2p2TRBwUpcL8kTRakCDWXfKOWbIFGDey2rpnF; 3:mBR6n9RN04PU6EwHCbrX7t0rdwP9iV62txnenLbtjsmqHD5C96k/iDL9BpE2UMp/+wY169eFDb0NwdITH4Ab8jgXCtuGqNQEE9g+/s+5NPj2h8OfgljaRNHAGdwFbcLWbwIFUq8bOoQuSW2FO3s6k7PHlf5HQicvgorxvZXvlOwx416A7HVRro7FZnc91zQxtTXvHv8u1jFdImTKX0ENhFiaSnEXfsK3/FyoRXl+DSjw52Lr1HyoccMLxj+A8AY0qkNOPXVND7eHeY9p21IH0Q==; 25:joTV1XS4m//h1qp/884GiulAaMpjitqWwDafEUQ/u2j925TeSYcDVtV+kdsCNMSr9+gkdNZiLCDGbHeDqE/MfDYvPZQXWLAODrc0+/2705JispWZYG58FAIx3gUi8rgaSRlpiBy/RLbLa9mr05nnJSrzuMPc/lktNXNKuAd3bAJn77jZ+2Puu8iskqnoYnla9Drxt6blyE0WCda0nVpUrhGyIM9Y7EZvQtfFYpfC597+QI5l7/dR9v/bNO1yQ8FkssHsMzEOuWlbZ6TvrvlVjgfk8x+o0xQb0ECtIDwfK+roX+2WWI1v3EWARDgdv/4t/0u6LZ7Rb8MMwpBsqGiUBw7FWmDNlCEJ8AcaSDmMhRckEvL6tscos5Nwb/fB1Yf5PrSKnVUf5u3TYfg0IcgwEjAh4D+g8dSqZtEAMaLOIqib6Xd29h7d+MveqUFGDMIU X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BY2FFO11HUB006; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB006; 31:bcpLM79HAK0NUjyXxUkcc6V5nj/srL+QWuXP7qyZkaiOO17aym/I4sPNGtuXJSiCoiZ4qQoZ2JjuKunmrpFp3eCFm0ckbzAa0K7svKI4fpZGdYygz5aNJQ5HMDXSf8BFQCey/NOOazG89S1+2iTylEERAaiWM/bgnfc0FtYnWDUW9u4F0TR3lI8/kncWInmCKU93tk+dRvh2C+5JJwwM/TQAygBh/4eUiE4N+Y7LGk4=; 20:KLE2gDz1Ntpw666Rkmv8OJ6P15lEp/hQ7nqbwcrFUGrDz/lCECX+eirvyWEunFESNURt0UA6ME4jYHDgIEy6jZ7QbLdV8haV4XWy8827psyVGJSvX0AQwdzLz+cZ6OEvefwDHdPL4+0zrhqi049+571eXasNjC+DLycDcbl5XqayFz2pS3SSBeoG+SyslDWncFvd6Wg+nxh1QjpmidR1VHwXMtmPLD18zlfD0hid2B4+nj3kKDcdNloWB3OC9hf/sRC9qqgTj4amIhiQu5tr75E2y6pJJiBszkKUEfs+9CdX79Agllnk377H33aXTWB07B7g0IFWdROj8SCov5NdJb1SXdY8A1A2kGRa2ksp6a/XaJzW4f7NVQ/1M+EdE6MOyzncbOQJKrY1/zdzPzWv47w6mIjdF7Xm0zvIfqpzJ0g= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(67444318432085)(158342451672863)(278428928389397)(192374486261705)(18430343700868)(97927398514766)(211171220733660)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040166)(601004)(2401047)(13018025)(13024025)(13015025)(13017025)(13023025)(8121501046)(5005006)(3002001)(10201501046)(6055026); SRVR:BY2FFO11HUB006; BCL:0; PCL:0; RULEID:; SRVR:BY2FFO11HUB006; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB006; 4:09pDkalkLuxl7hzJPVmeMYc2bjEyxaHnkAnT36Llci15t/CCXeLYeuRdEvCEqHbXIsAjGlrfxYgqlTwrSu3ZX36PiwwRJNziAWhTAIyOUQy3OepFWznKqWAYpGTlFHOzWyOj/wvn/PQy/C7Ko5NAycqF15NajqLHn2A9ASa1fbWK9Gd7iWlsSHH8qw90HEPykGPo/ai7W8/OF1iYfVO9tDZ8kLGIllAZzWiVG7M21QZeyn5oYF1/08uDFCphmHQ8EGrvkM6/3zpHFQQxISYAGL0YtUl99XrCPeinKYI+umSRGT/4S/ACQN91GVY2qYgt4ZL3eyfcMwVV9PCGPEqsxFDKNpa51VfBcHZYAJLILc11yAMJxPK89S0jThPP9wIY4wkZxNN8t9Gk82ERzRudzvz5ox34uqN5ZsH3wp0J1zBrMowPWQgDUDSFRx/zaUNz6sMuu5uE6NEoHRlx0rnPsja3FLwvJNcfwTdTCNXqLHItMCfZbl3eTmkIqoLv+UVWClzdNIVsrAVhHCl3QuJQ06K96L229n3kzGBHfmicIumUiEz51HA4iIA1A3dq3d+oEKMbF3NARKHSbAB/HhoRfL6fCQajpN3zeFMPckpYNV1ZexY6F2LI9rzuOJ+3sWJXxslnpJqZTGyCyt5saSj0nEl/9XjnQ8arj08moy85baAxobm/5Gk7HeIBqO+SUvupjQYakeQLc/OtfRcI1qjqIJO5oyjuBfBufUyuYHP8vovh2chafs3Re/DwniCFnRfUd7VPngXTsgf94nMd2OJlVg== X-Forefront-PRVS: 0030839EEE X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2FFO11HUB006; 23:CX7ulEVlfcVS3xrLBdXEotfzA1uBffHpRSC9akPO?= =?us-ascii?Q?u02LRhzwnWkVW1KaFAO75waBVCJ6lEQeRcfVDmpGeDprTFnsXxnHSlLkzAha?= =?us-ascii?Q?vZ0UBrNe7hS/UEyzOS6V+tnt8/n5gwkMxySYClEEmHbocVvZQUp7Apq4YcLe?= =?us-ascii?Q?MCIqsGyhvanqz0Kz3ilPZFqLa22ooZveK7BHbPzSNHTCfYy/ZbBY1lKLkuJJ?= =?us-ascii?Q?adXz/eD4OphgMjLBlv8GGlNPxiz7Odn5GT8Hc4c68e4g5Q9LIL15WJY2FZ0i?= =?us-ascii?Q?nBpPybFbqBPc9Kt2acHsnX077m4J+QoCRSaL60gGZoXYbJfY2y4o35voKUcO?= =?us-ascii?Q?bdUoi2qAjf4yWLZupnvpRXs/WX0H/p3grxJKvXElO9HriI45GlTQ255YwWDB?= =?us-ascii?Q?QTVcibJ7xodQcdbYAdiBLP+MOVqBhcSf1MgkV0cf2kYexc7TTN6jgF9FBYf/?= =?us-ascii?Q?EFAoVD0tCgjN7Et1630zqJ47lxOqVAnNw2GfTChKIrp/XuGgsV8zZ7jtYQ/5?= =?us-ascii?Q?fBIEIFroy/jghpbrWN5SKNAxSVTlinZyI3u0jP/qAJv78cUL7S+xnBUjiB85?= =?us-ascii?Q?xeId6hUClndRBH/cSCT20D2G7+QeZJCLFe5Pug39n6rldqf3KQkrilj/Ejt6?= =?us-ascii?Q?36fc6otKQnRkpTtHBjDD6t5excyNBqS8hVxZnMrvjdFExUePJWzERLjBPWgo?= =?us-ascii?Q?UEM9hb4gUscov5nAH0VLoVZ8QN8ZPYmC7He/epeCMpbiVbDRkM37457lTnoi?= =?us-ascii?Q?CQ8RE6oAtAcvZnF0JEFDvx7pTcP3IkG7dGcli6FwLh9euBgnGB7n4eiZV8MX?= =?us-ascii?Q?I81qMrrQ3aoDuOFjw6sXTuye8nCvjXo0Z6w6wOR/xpEy6npvtBSB1X2gM1Om?= =?us-ascii?Q?72UqV18iz6y5tMd8+IlLTQvaY6FvxAOfTgFzeK7GycOgqSK0Aa3YH3l4CWjE?= =?us-ascii?Q?aenEo9d2SO1BkWhhqdkdAx6RszowOmF9KJ7Dykh6fqRUDGOxV0pNIzORZkCX?= =?us-ascii?Q?wuQQ5GqBYw23Nz+GbkHf3MSd51vaJl8i7g4EXryBhSvJOLex4g05lUeYXBrs?= =?us-ascii?Q?qxLxFookfnG8f9SVhkhDg9r0vX1fiDsorgiz8q4UMFeOUDKGlN8Q5ww9Kjel?= =?us-ascii?Q?yhSj5DlcYEs4LqADyiH9umJlIHWnug33ubybh8+JSzZMcuxrfXgb1y2Z+lO1?= =?us-ascii?Q?BY2uK6Ww73fyuaOSiaN2+Z6cpiHSwUppk28ETDJEc46qyW4TPBq9gY2PYcwG?= =?us-ascii?Q?O8SPHsVLsfAo0RtOr3kXAo+giT0e3eeAJtdBHHmkR3b3FD5HPuGOewzCHJ/s?= =?us-ascii?Q?eMpbE4kR2+UJvInSEPkKzDLfvbkyQoYaBhphXNi9BoWuOypi/gdmaBOCzNI+?= =?us-ascii?Q?84BDbOE/FSfDEoRcxp/egzNJnHt9NSVa1VcoYhUpLsvuQQnUdqzAXwTw/20j?= =?us-ascii?Q?qP6QRxbNfrIsC6ZtpgKGWRjNiPoi3mrBPpnIVQ5CaML0XFUVxxx7yHGgDi3K?= =?us-ascii?Q?jOH7YjtEweXoko98FZok0DN5PpbR0Jk6MTFJIWaqNekBy/Fguvrl1JviHCTy?= =?us-ascii?Q?iG57t3XTlMFVDOvI4PPpwMqnMy0etnw/jtGOTTg=3D?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB006; 6:UsjYpg/FmutKow6DjW9VkkoDVSFJ5vQEbUaikpqly/979+E6b+mQn6p81Oouz3nS9HIWammrjrHIy9O7yT3yYZnTNEdL1vKd3BRJzXw4BpNeJfp+68qdH49GECwwa6KIIlQc4a/ZutLXh6USZ4EcDVmTyOLqBt4i+FivBPxsNEbbCGBoT18obGvK+fFy38TNKEyIpvzpyh5E4xi3VXLyH8LYb/B+tTN7Kk+krnoEcxIg3jl6igKT/coM23/r/JJyapofht9B3U84x+BzcgdGeSA6IU1nnIO81rwYyxIX4sZm8LgaDIU/KXTvQlikZPPXj6LlnMavQpDEbmjBslu7gg==; 5:dwr+PwML2EUG5NE+R0sn/55l5O8g6zhQELtvX9YGPS8iH5gI34rpGZuxWUeQ2jDgAOptYYi6MXUry7HL7dLh9ZbM1SPQkFdaDiwjidi4z2R7djLV1m6i3MMRwlBU7WQSD6rfM/hkKJ9uIRZUrWYKaw==; 24:ibzxr5cZyB5v8XD7pboogrhATdsG6iWg9pFXGUcWsOuFLZeNs8yXU7LaILAP7pESry2m4+O5o7l3Af/ynRATQ5CGEFupVpKfpmlXxQkK2e4=; 7:QiROtdRud4vyExZirsDMMjQTLNhf2Fz4ds0pznfj/mmcDTvBxl+AzgIvg13JG425lvUwqCEccRSsdtuDGtGUHGXCzCqTS6Jffs5nQ0pmtR0S8K+G0bxoACqkYzmLXkqcWjUe7j3Wz6Qz5wiqzUcYTo7/0n/8kWxKStPvbA64NyA1PS5sBjWUoXZrisoHy0RYGuv6Kl6gEyd3/T95M+d/+TBLfCE49PvpKUGh1In0f0kZYRSxoNKDtVYoZSeW2ixJ SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2016 17:11:19.1972 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.39]; Helo=[plsapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2FFO11HUB006 Archived-At: Cc: "Rosbotham, Paul, Vodafone UK" , Brian Rosen , "stir@ietf.org" , Richard Shockey Subject: Re: [stir] STIR 4474bis-10 comments X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 17:11:28 -0000 "...there needs to be *some* negative consequence for failing to perform du= e diligence when signing. Exactly what that consequence is is out of our h= ands, but I hope we can count on there being one." The definition of "due diligence" is the key point. For better or worse, m= ost calls do not, and some calls cannot have their calling numbers verified= . One (albeit minor) example is manual roaming. We're talking here about a fundamental change in logic (and to some degree = capacity/peformance) in most carrier switches and SIP application servers, = and it's not simple and straight-forward, and it's a large-scale issue beca= use were talking about many thousands of calls per second during the busy h= ours. "A good plan today is better than a perfect plan tomorrow." - G.S. = Patton Placing bad actors on a deny list (and/or other palliative actions) is more= possible if/when we get to some critical mass of signing, even with some q= uantity of lower quality number vetting. I believe it is possible to get u= seful and therefore valuable authenticity information without having to hav= e overly rigorous or burdensome "due diligence". You're sending me a call = you signed and you didn't provide thorough vetting? OK, just let me know t= hat you did that and I can take actions accordingly. Perhaps I'll record t= he fact and keep score of the consequences. Given all-VoIP networks signaling with SIP, and the great majority of calls= (which are benign) are signed with high-quality authenticity (which will b= e the case), then the remainder of calls and their sources will be easier t= o monitor/manage even though they could have lower quality authenticity. A= nd, having the originating carrier sign the call provides a mechanism for f= orensic investigation and enforcement (against perpetrators and their assoc= iates). =20 Pierce -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu]=20 Sent: August 09, 2016 2:29 PM To: Gorman, Pierce A [CTO] ; Alex Bobotek ; Peterson, Jon ; Dwight, Timothy M (T= im) ; DOLLY, MARTIN C Cc: Rosbotham, Paul, Vodafone UK ; Richard Sho= ckey ; stir@ietf.org; Brian Rosen Subject: Re: [stir] STIR 4474bis-10 comments On 8/9/16 1:36 PM, Gorman, Pierce A [CTO] wrote: > I did. Similar is a weasel word too isn't it? Yes :-) > " This is similar to the issue of liability for fraudulent credit card > charges. Retailers sometimes accept a card without a signature, because > it makes customers happy and speeds transactions. But in doing so they > accept the responsibility for the charge if the transaction turns out to > be fraudulent." > > It's not at all the same. The retailer is liable for eating the cost of = that which they thought they sold. Instead, applying the logic of making t= he operator liable for calling number verification is the same as asking th= e retailer to be liable for the fraud committed by the criminal. > > Let's not forget that a criminal can get a phone that is authenticated to= the network and whose calling numbers is signed, either by the operator, o= r by the SIP stack on the phone, and still commit crime. > > If you want the operators to eat the cost of transporting and processing = the phone call where the originating number was fraudulently provided, I'm = pretty sure it will fail in court, but it probably wouldn't be very offensi= ve to operators. > > What I think you're asking for is operators to be police, both detectives= and traffic cops, and to be liable (sounds eerily like other current event= s). I agree it isn't comparable, and that it is unreasonable for the=20 operators to be liable for the bad deeds of their customers. But there needs to be *some* negative consequence for failing to perform=20 due diligence when signing. Exactly what that consequence is is out of=20 our hands, but I hope we can count on there being one. Getting blacklisted as an untrusted signer is one possibility. Thanks, Paul > Pierce > > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] > Sent: August 09, 2016 12:11 PM > To: Gorman, Pierce A [CTO] ; Alex Bobotek ; Peterson, Jon ; Dwight, Timothy M = (Tim) ; DOLLY, MARTIN C > Cc: Rosbotham, Paul, Vodafone UK ; Richard S= hockey ; stir@ietf.org; Brian Rosen > Subject: Re: [stir] STIR 4474bis-10 comments > > See the reply I just sent to Alex. > > On 8/9/16 1:04 PM, Gorman, Pierce A [CTO] wrote: >> " If you sign the message you are taking responsibility for the assertio= n that it is from NNN. If you choose to do so without knowing who it is fro= m then that is your problem." >> >> Paul, >> >> Following this standard of liability, every ISP should be forced to sign= IP packets and be liable for hacking attempts which originate on their IP = networks. >> >> Just as reverse unicast path forwarding is not often (ever?) used in the= Internet backbone or ISP networks to ensure IP packets don't come from net= works they can't have originated from, neither do all telephone networks "c= heck" each originating telephone number to determine whether they should ha= ve been able to originate from a particular carrier or enterprise and for t= he same reasons - it is difficult, imperfect, and expensive. Just as it is= with the Internet backbone, it's actually reasonably challenging just deli= vering the calls (or IP packets) to the number that it is addressed to, wit= hout also having to also worry about where it supposedly came from. >> >> I'm telling you we can differentiate the trustworthy-ness (like Stephen = Colbert's "truth-iness") of calls. We can tell if a call originated from a= subscriber using a device which has to authenticate to the network before = it's permitted to place calls (except manual roaming and some E911 calls). = And we can tell if a call originated (or was subjected to mid-call 3rd par= ty call control from an enterprise or mobile virtual network operator partn= er for example) and is therefore not as trustworthy as the directly-connect= ed and authenticated mobile subscriber (for example). We can pass that rel= ative trustworthiness information along in signaling and it can be used to = usefully differentiate treatment, ultimately, by the consumer. >> >> What you want is that the calling number is always, universally, only ev= er trustworthy. My opinion is that is unrealistic and unreasonable. >> >> Pierce >> >> -----Original Message----- >> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >> Sent: August 09, 2016 10:44 AM >> To: Alex Bobotek ; Peterson, Jon ; Gorman, Pierce A [CTO] ; Dwight, Timothy M= (Tim) ; DOLLY, MARTIN C >> Cc: Rosbotham, Paul, Vodafone UK ; Richard = Shockey ; stir@ietf.org; Brian Rosen >> Subject: Re: [stir] STIR 4474bis-10 comments >> >> On 8/9/16 5:03 AM, Alex Bobotek wrote: >>> Jon, >>> >>> Thanks much for your thoughtful response to the original points. Yes, = things got somewhat sidetracked. >>> >>> On the first point (signing without authentication), I do not read 6.1 >>> as permitting "I'm signing to assert that I've authorized use of this >>> phone number without authenticating the caller and/or completing a >>> number delegation authority check", >> >> I'm not sure I understand. Is this the assertion you are asking for? >> >> "I (Acme Corp), having administrative authority over number NNN, certify= that this message is "from" NNN, though I have no idea who actually origin= ated this message." >> >> This is a good thing??? >> >> If you sign the message you are taking responsibility for the assertion = that it is from NNN. If you choose to do so without knowing who it is from = then that is your problem. You should be legally liable. At the very least = your reputation as a signer should be diminished as fraudulent calls you ha= ve signed are detected. Eventually you will be put on blacklists as an untr= ustworthy signer. >> >> I guess we could speed the blacklisting by allowing signers to pre-decla= re that they are untrustworthy. (That seems to be what you are asking for.) >> >>> a use case that reflects the currently-widespread practice of authoriza= tion without authentication. >> >> No wonder we have a problem with spoofed calls. >> >> Thanks, >> Paul >> >>> My read of section 6.1 is that it allows anonymity rather than signer-a= ttribution with unauthenticated (non-anonymous) caller identity. Knowing t= he triple of purported calling phone number that flashes on a recipient's p= hone, the terminating phone number and a timestamp is important in reportin= g/tracing/mitigating abusive calls. [On a side note, I reread Section 11, = but had trouble with the definition of "private URI" (note: "private URI" = and "private SIP URI" each occur exactly once each in the doc and could ben= efit from a definition or two).] Additionally, Brian Rosen's comment on 8= /4 seems to corroborate my reading of a ban on authorization without authen= tication in the non-anonymous case (i.e., that using someone else's phone n= umber requires that "the entity that is assigned the TN explicitly authoriz= es calls placed using it's TN"). >>> >>> In summary, there is a high value in allowing signing/authorization in = the categories and use cases Pierce outlined. In my operational experience= , it really helps to know which company to contact to get the callers kicke= d off a network. And signer attribution even without caller authentication= is a huge win for the public. >>> >>> >>> >>> On the second point, thanks for pointing out that 12.1 requires servers= to keep the state of recently received requests. This is a point that I m= issed in my reading of the draft, and this feature as you have described it= defeats most conceivable replay attacks. My bad for missing this, but as = you suggest, there may be some potential for emphasizing this point. But t= here's another part of the issue -- cross method replay. For example, it m= ay be difficult to expect a messaging node (which handles SIP MESSAGE) and = a voice-capable IMS node (handling SIP INVITE) to coordinate their anti-rep= lay caches, allowing an attacker that observes a SIP invite for a voice cal= l to piggyback a spam text message. As it's common to use the same "To" ad= dress for multiple services that may be served by very different infrastruc= ture components, it would be beneficial to allow signatures to cover more t= han "To", "From/PAI" and "Timestamp". I do not see this issue as meriting= significant delay of a STIR RFC if there's no quick fix. >>> >>> Regards, >>> >>> Alex >>> >>>> -----Original Message----- >>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon >>>> Sent: Monday, August 8, 2016 12:46 PM >>>> To: Gorman, Pierce A [CTO] ; Paul Kyzivat >>>> ; Dwight, Timothy M (Tim) >>>> ; DOLLY, MARTIN C >>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard Shockey ; stir@ietf.org; Brian Rosen >>>> >>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>> >>>> >>>> Just so I'm clear, I'm not hearing an ask here in terms of changing >>>> the text of rfc4474bis-10, which does allow signing PAI instead of >>>> From for precisely the reasons outlined in this lengthy thread. To >>>> Alex's original point about providing authorization without >>>> authentication, rfc4474bis has a lot of text about signing non-TN >>>> identifiers, including for preserving anonymity; see the end of >>>> section 6.1, and then the Privacy Considerations in section 11 for >>>> more. Those should suffice to provide this property: it will identify = the service provider who signed without attesting an specific user identity= . >>>> >>>> I also wanted to make sure we didn't drop the other ball that Alex >>>> mentioned at the start of this thread, which is the issue of >>>> proximate replay within the 60 second Date window. This is addressed >>>> in Section 12.1 of rfc4474bis-10, which >>>> reads: "Note that per baseline [RFC3261] behavior, servers keep state >>>> of recently received requests, and thus if an Identity header is >>>> replayed by an attacker within the Date interval, verifiers can >>>> detect that it is spoofed because a message with an identical Date >>>> from the same source had recently been received." This refers to the >>>> text of >>>> RFC3261 section 23.4.2, though more properly the Date-related >>>> behavior is better detailed in RFC3893 Section 10, which introduced >>>> the first version of the partial signature mechanism that ultimately >>>> inspired RFC4474. I'll update the text here so it is clearer about exa= ctly how to detect proximate replay. >>>> >>>> Jon Peterson >>>> Neustar, Inc. >>>> >>>> On 8/8/16, 11:38 AM, "stir on behalf of Gorman, Pierce A [CTO]" >>>> wrote: >>>> >>>>> Paul, >>>>> >>>>> As you know, SIP inter-working is often challenging because of >>>>> variability in implementation including proprietary headers (without >>>>> an >>>>> X-) and support or lack thereof for non-mandatory (per RFC 3261) >>>>> headers such as P-Asserted-Identity, (and things like B2BUA stacks >>>>> stripping things like display name in From but that's another story). >>>>> I could argue that from a cleanliness of protocol implementation, >>>>> (and if I wanted to be pedantic), I would strip PAI outbound unless >>>>> required otherwise. But the point is moot. As I mentioned in the >>>>> earlier e-mail, that is not our practice and I'm not requesting it to= be so. >>>>> >>>>> Pierce >>>>> >>>>> >>>>> -----Original Message----- >>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>> Sent: August 08, 2016 12:03 PM >>>>> To: Gorman, Pierce A [CTO] ; Dwight, >>>> Timothy >>>>> M >>>>> (Tim) ; DOLLY, MARTIN C >>>> >>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Richard >>>>> Shockey ; stir@ietf.org; Brian Rosen >>>>> >>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>> >>>>> On 8/8/16 12:11 PM, Gorman, Pierce A [CTO] wrote: >>>>>> Thanks for the added comments Tim. >>>>>> >>>>>> I agree that passing P-Asserted-Identity between trusted networks >>>>>> is appropriate (and the converse is true as well). Part of my >>>>>> issue is I have been conditioned from the very earliest >>>>>> implementation of Sprint's VoIP network that other carriers' IP >>>>>> networks are inherently untrusted. I've been browsing TS 29.165 >>>>>> and even there I find language that implies trust is established by >>>>>> agreement, not by standard. (Even roaming implies agreement.) >>>>> >>>>> I understand why *some* stuff needs to be removed when forwarding to >>>> an >>>>> untrusted party. For instance, if the call has requested privacy, >>>>> then P-A-ID needs to be removed. >>>>> >>>>> But when privacy is not a concern, trust is really more of a concern >>>>> on the ingress side, not egress. If I don't trust you then I won't >>>>> trust a P-A-ID you sent to me, and so *I* will remove it. But if I >>>>> trust you, but you don't trust me, then what is the downside for >>>>> passing along the P-A-ID? >>>>> >>>>> Thanks, >>>>> Paul >>>>> >>>>>> Regardless, this discussion has been helpful and educational (to me >>>>>> at least). And, I confirmed with my operations counterpart we >>>>>> generally send PAI today. I've also made note that where standards >>>>>> and >>>> ICA >>>>>> require it, we will include PAI. Thanks again. >>>>>> >>>>>> Best regards, >>>>>> >>>>>> Pierce >>>>>> >>>>>> -----Original Message----- >>>>>> From: Dwight, Timothy M (Tim) [mailto:timothy.dwight@verizon.com] >>>>>> Sent: August 08, 2016 10:47 AM >>>>>> To: Gorman, Pierce A [CTO] ; DOLLY, >>>> MARTIN >>>>>> C >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>>>> Richard Shockey ; Paul Kyzivat >>>>>> ; stir@ietf.org; Brian Rosen >>>>>> >>>>>> Subject: RE: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Pierce, >>>>>> >>>>>> My assumption is that Martin morphed 2 specs, 3GPP TS 29.165 and >>>> GSMA >>>>>> IR.95. The latter references and profiles the former. Section >>>>>> 4.4.1 of >>>>>> IR.95 recommends that MNO-to-MNO or MNO-to-IPX interconnects be >>>>>> considered trusted, and table 3 in that section recommends that >>>>>> P-Asserted-Identity (PAI) be exchanged at a trusted interconnect. >>>>>> It also states that PAI is mandatory at a roaming NNI. >>>>>> >>>>>> Tim >>>>>> >>>>>> >>>>>> -----Original Message----- >>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Gorman, >>>>>> Pierce A [CTO] >>>>>> Sent: Monday, August 08, 2016 8:52 AM >>>>>> To: DOLLY, MARTIN C >>>>>> Cc: Rosbotham, Paul, Vodafone UK; Richard Shockey; Paul Kyzivat; >>>>>> stir@ietf.org; Brian Rosen >>>>>> Subject: [E] Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> Martin, >>>>>> >>>>>> You referenced TS 29.195. I'm not familiar with that spec. Has it >>>>>> been deprecated? It's not showing up on the 3GPP site. >>>>>> >>>>>> I referenced 3GPP TS 24.607. In Section 4.3.2 "Requirements on the >>>>>> originating side" Note 4 it states, " It is assumed that the IBCF >>>>>> is responsible for stripping the P-Asserted-Identity from the SIP >>>>>> header when interworking with untrusted networks." >>>>>> >>>>>> Your remark is consistent with Note 4, but only if we agree that, >>>>>> for instance, the AT&T network and the Sprint network are "trusted >>>>>> networks". In reality, this is not the case or there would be no >>>>>> firewalls or Session Border Controllers used for interworking and >>>>>> security. My opinion is the only carrier networks that are trusted >>>>>> are the SS7 network, and the Internet backbone. >>>>>> >>>>>> What it really comes down to is that PAI is left in signaling >>>>>> either through formal specification as a part of an inter-carrier >>>>>> inter-connection agreement, or by custom (or even by accident). I >>>>>> think this illustrates Paul Rosbotham's observation is true. >>>>>> >>>>>> Pierce >>>>>> >>>>>> -----Original Message----- >>>>>> From: DOLLY, MARTIN C [mailto:md3135@att.com] >>>>>> Sent: August 05, 2016 12:55 PM >>>>>> To: Gorman, Pierce A [CTO] >>>>>> Cc: Rosbotham, Paul, Vodafone UK ; >>>> Brian >>>>>> Rosen ; stir@ietf.org; Paul Kyzivat >>>>>> ; Richard Shockey >>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>> >>>>>> PAI is not stripped at the network boundary between trusted >>>>>> networks 3GPP TS 29.195 Atis specs GSMA Atis sip forum task force >>>>>> ITU And the list goes on >>>>>> >>>>>> Martin C Dolly >>>>>> Lead Member of Technical Staff >>>>>> Core & Government/Regulatory Standards AT&T >>>>>> Cell: 609-903-3360 >>>>>> Email: md3135@att.com >>>>>> >>>>>>> On Aug 5, 2016, at 1:04 PM, Gorman, Pierce A [CTO] >>>>>>> wrote: >>>>>>> >>>>>>> Which header the carrier chooses to display is moot if the header >>>>>>> is stripped between carriers as per at least one standard. I >>>>>>> think Paul Rosbotham's observation we're likely to encounter "some >>>>>>> interesting interworking challenges" was perhaps the understatement= of the year. >>>>>>> >>>>>>> Pierce >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu] >>>>>>> Sent: August 05, 2016 11:58 AM >>>>>>> To: Gorman, Pierce A [CTO] ; Richard >>>>>>> Shockey ; Rosbotham, Paul, Vodafone UK >>>>>>> ; Brian Rosen >>>>>>> Cc: stir@ietf.org >>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>> >>>>>>> If PAI is present and signed, and From is also signed, I would >>>>>>> expect it to be up to the UA to decide what to display, not the car= rier. >>>>>>> >>>>>>> Of course this will work differently if there is a different >>>>>>> signaling regime between the carrier and the user device (e.g. >>>>>>> black >>>> phone). >>>>>>> >>>>>>> Thanks, >>>>>>> Paul >>>>>>> >>>>>>>> On 8/5/16 11:26 AM, Gorman, Pierce A [CTO] wrote: >>>>>>>> P-Asserted-Identity is supposed to operate "among trusted SIP >>>>>>>> entities" and therefore some specifications (e.g., 3GPP TS >>>>>>>> 24.607) assume P-Asserted-Identity is stripped by border >>>>>>>> controller functions and is not to be used in inter-carrier >>>>>>>> inter-connection (although it commonly shows up anyway). My opini= on is the "From" >>>>>>>> header is likely used more often for presentation. >>>>>>>> >>>>>>>> Pierce >>>>>>>> >>>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: Richard Shockey [mailto:richard@shockey.us] >>>>>>>> Sent: August 05, 2016 9:37 AM >>>>>>>> To: Rosbotham, Paul, Vodafone UK >>>> ; >>>>>>>> Paul Kyzivat ; Brian Rosen >>>>>>>> >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>> >>>>>>>> Humm this is getting interesting. Its my understanding that the >>>>>>>> display number aka "presentation number" in the US context is the >>>>>>>> one carried in the PAI. Martin, Pierce? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On 8/5/16, 3:46 AM, "stir on behalf of Rosbotham, Paul, Vodafone U= K" >>>>>>>> >>>> wrote: >>>>>>>> >>>>>>>> Jumping in now that we're on European working time, +1 on >>>>>>>> Paul's observation. >>>>>>>> >>>>>>>> Here in the UK, we've got 2 numbers carried as calling line >>>>>>>> IDs....one (we term the Network Number, carried in PAID) uniquely >>>>>>>> identifies the line, the other (we term Presentation Number, >>>>>>>> carried in From) is used for display purposes. >>>>>>>> >>>>>>>> Only the carrier has the authority to set the Network Number >>>>>>>> so only they could sign it. >>>>>>>> >>>>>>>> But - subject to regulatory restrictions which are well >>>>>>>> documented >>>>>>>> - the number sent for display purposes belongs to the customer. >>>>>>>> For blue-chip customers, I can allow them to send their >>>>>>>> Presentation Numbers into the network, and can't readily check at >>>>>>>> a network level that they're theirs (I do have contractual >>>>>>>> safeguards). The number may have been allocated by me, or could >>>>>>>> be allocated by a third party provider. If it's a call-centre >>>>>>>> they'll be making outbound calls for lots of different customers >>>>>>>> which will change on day-by-day >>>> basis. >>>>>>>> This is business as usual. I don't like the term "authorised >>>>>>>> spoofing" because it implies that the CLI is in some way being rig= ged: >>>>>>>> it's not, it's the corporate customer or their subcontractor >>>>>>>> using the number that's been assigned (so in internet terms >>>>>>>> delegated) to them via a chain of trust from the regulator. >>>>>>>> >>>>>>>> What I want is the ability for customers to use their >>>>>>>> credentials to sign the CLIs they send me so that at the >>>>>>>> terminating end it can be checked (or indeed somewhere en-route >>>>>>>> if that's the business model). >>>>>>>> I can and would sign for customers on my mobile business since >>>>>>>> I'm driving what number is presented, but that's by-the-by >>>>>>>> because they aren't the ones who generate millions of nuisance >>>>>>>> calls. If the signing only occurs at the originating carrier >>>>>>>> level for corporate/call-centre customers that's no use because >>>>>>>> I'm not in a position to do that for these type of >>>>>>>> customers...and the whole system becomes a waste of time. I'd >>>>>>>> also highlight there are many more of my large customers that I'd >>>>>>>> trust more than a far end originating carrier that could be >>>>>>>> anywhere in the world (though we have no shortage of small >>>>>>>> carriers that I wouldn't know from Adam more locally in the >>>>>>>> UK....) >>>>>>>> >>>>>>>> Regards >>>>>>>> >>>>>>>> Paul >>>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyz= ivat >>>>>>>> Sent: 04 August 2016 23:12 >>>>>>>> To: Brian Rosen >>>>>>>> Cc: stir@ietf.org >>>>>>>> Subject: Re: [stir] STIR 4474bis-10 comments >>>>>>>> >>>>>>>>> On 8/4/16 6:02 PM, Brian Rosen wrote: >>>>>>>>> I think it's not a delegation. The mobile phone is not being >>>>>>>>> delegated the TN, it's being authorized to place calls that are >>>>>>>>> not >>>>>>>> >from that TN, but appear to be. >>>>>>>>> >>>>>>>>> The mechanism to handle the credential is exactly the same as a >>>>>>>>> delegation, so if you want to call it delegation, go ahead, but >>>>>>>>> I prefer to call it authorized spoofing. >>>>>>>> >>>>>>>> IIUC the delegation is to a responsible entity (something that >>>>>>>> can be held legally accountable - e.g. a person), not to a device. >>>>>>>> The entity can then "use" the credential via any device(s) it >>>>>>>> chooses. In the case of the mobile, the device then becomes a >>>>>>>> two-line >>>> phone. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Paul >>>>>>>> >>>>>>>>> Brian >>>>>>>>> >>>>>>>>>> On Aug 4, 2016, at 5:51 PM, Paul Kyzivat >>>>>>>>>> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>> On 8/4/16 5:43 PM, Brian Rosen wrote: >>>>>>>>>>> In my jargon an "authorized spoofer" is the doctor who is >>>>>>>>>>> calling from his mobile, but sending the TN of his office >>>>>>>>>>> phone as calling party. >>>>>>>>>>> The delegation to his office phone was made by his landline >>>>>>>>>>> carrier to him. He then creates another credential, which he >>>>>>>>>>> signs with his office phone credential that authorizes his >>>>>>>>>>> mobile to send calls from his office number. He is spoofing >>>>>>>>>>> (because the call is coming from his mobile's TN but claims to >>>>>>>>>>> be from his office), but it's authorized spoofing. The doc >>>>>>>>>>> could give the credential to his mobile SP if they sign on his = behalf. >>>>>>>>>> >>>>>>>>>> I don't understand how that is different from regular delegation= . >>>>>>>>>> >>>>>>>>>> When his landline carrier gave him a delegated certificate for >>>>>>>>>> his landline number, he should be able to install that in >>>>>>>>>> whatever devices he wants - his landline UA, his mobile phone, >>>>>>>>>> etc. It is still delegated from his landline carrier, even when >>>>>>>>>> used with calls via his mobile carrier. >>>>>>>>>> >>>>>>>>>> Thanks, >>>>>>>>>> Paul >>>>>>>>>> >>>>>>>>>>> Some folks don't like attaching the "spoofing" label to a >>>>>>>>>>> legitimate use. >>>>>>>>>>> >>>>>>>>>>> But that's how I describe it. >>>>>>>>>>> >>>>>>>>>>> Brian >>>>>>>>>>> >>>>>>>>>>>> On Aug 4, 2016, at 5:37 PM, Paul Kyzivat >>>>>>>>>>>> > wrote: >>>>>>>>>>>> >>>>>>>>>>>> +1, but with one question below: >>>>>>>>>>>> >>>>>>>>>>>>> On 8/4/16 5:14 PM, Brian Rosen wrote: >>>>>>>>>>>>> I think all we need is to have credentials follow the >>>>>>>>>>>>> delegation path, >>>>>>>>>>>> >>>>>>>>>>>>> plus the option to add another level (not delegation) for >>>>>>>>>>>>> authorized spoofers. >>>>>>>>>>>> >>>>>>>>>>>> I don't understand "authorized spoofers" in this context, as >>>>>>>>>>>> contrasted to "spoofers" who have been delegated their >>>> authority. >>>>>>>>>>>> >>>>>>>>>>>> Thanks, >>>>>>>>>>>> Paul >>>>>>>>>>>> >>>>>>>>>>>>> I don't think it matters who the delegator or delegatee are >>>>>>>>>>>>> as long as the delegator is willing to take the heat for >>>>>>>>>>>>> delegating to someone who sends a lot of bad calls. They >>>>>>>>>>>>> can pass the buck ("I delegated the TN to him, and now I'm >>>>>>>>>>>>> not responsible"), but only if the SP knows who they >>>>>>>>>>>>> delegated to, so authorities can follow the delegation path. >>>>>>>>>>>>> There are plenty of certificated carriers who are willing to >>>>>>>>>>>>> not care who they delegate to. The fact that there are some >>>>>>>>>>>>> who do doesn't change much. >>>>>>>>>>>>> Making stir work means knowing who you are delegating to, so >>>>>>>>>>>>> that you can pass the hot potato. >>>>>>>>>>>>> >>>>>>>>>>>>> It's perfectly reasonable for a carrier to be able to sign >>>>>>>>>>>>> for any calls placed on its network on any number it has >>>>>>>>>>>>> been delegated. >>>>>>>>>>>>> If it does, it's asserting that the calls are from who they >>>>>>>>>>>>> are supposed to be from. >>>>>>>>>>>>> That should be straightforward, but we know it's not always, >>>>>>>>>>>>> and that represents the hard part of deployment in my opinion= . >>>>>>>>>>>>> But once they delegate, they can hand responsibility to sign >>>>>>>>>>>>> to the delegatee. But, that only works if they know who >>>>>>>>>>>>> they are delegating to. >>>>>>>>>>>>> >>>>>>>>>>>>> The root of the whole model is that there is a formal or >>>>>>>>>>>>> informal delegation path for telephone numbers in every >>>>>>>>>>>>> country, and we can build a chain of trust from that >>>>>>>>>>>>> delegation path. If you propose to alter that model, then >>>>>>>>>>>>> we get into >>>>>>>>>>>>> (policy) issues of which carriers/entities we trust and >>>>>>>>>>>>> which we don't. >>>>>>>>>>>>> Our model is that you know who you delegate to, and once you >>>>>>>>>>>>> do that delegation, it's their problem. >>>>>>>>>>>>> That's pretty appealing I think, even if it's a change in >>>>>>>>>>>>> some business practices. >>>>>>>>>>>>> >>>>>>>>>>>>> The mechanism is chaining credentials in a form of a PKI and >>>>>>>>>>>>> having a way to know which TNs are covered by a credential. >>>>>>>>>>>>> That's what we have, and I'm loath to change it. >>>>>>>>>>>>> >>>>>>>>>>>>> Brian >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 4:53 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> OK, you talked me into indulging in one more message on >>>>>>>>>>>>>> policy and use cases. >>>>>>>>>>>>>> >>>>>>>>>>>>>> I agree that the STIR/PASSporT mechanisms could be deployed >>>>>>>>>>>>>> on individual devices as well as multi-device and >>>>>>>>>>>>>> multi-number platforms. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Number delegation (and sub-delegation), and business >>>>>>>>>>>>>> relationships are two additional factors which affect >>>>>>>>>>>>>> trustworthiness of a given calling number authentication. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Inherent variable trustworthiness of a calling number was >>>>>>>>>>>>>> my reason for suggesting a way to qualify the signature to >>>>>>>>>>>>>> reflect that variability. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Originating carriers are in a position to know if a call is >>>>>>>>>>>>>> coming from a device assigned a single number, or from >>>>>>>>>>>>>> "trunk group" which could originate calls using multiple >>>>>>>>>>>>>> numbers, and can qualify to some degree the trustworthiness >>>>>>>>>>>>>> of number authenticity accordingly. >>>>>>>>>>>>>> >>>>>>>>>>>>>> My suggestion was qualifying calling number authenticity >>>>>>>>>>>>>> into categories of carrier-signed (or not), and >>>>>>>>>>>>>> unauthenticated, semi-authenticated, and >>>>>>>>>>>>>> most-authenticated. There can be >>>> more >>>>>>>>>>>>>> granularity, but it implies additional operational >>>>>>>>>>>>>> complexity (both for the carriers and the consumers) and I >>>>>>>>>>>>>> assume diminishes value. >>>>>>>>>>>>>> >>>>>>>>>>>>>> My reason for adding the authenticity of the originating >>>>>>>>>>>>>> carrier is typical trustworthiness of a carrier business >>>>>>>>>>>>>> relationship with typical consumers adds to the >>>>>>>>>>>>>> trustworthiness assessment and partially because carriers >>>>>>>>>>>>>> are a regulated point of forensic inquiry for CALEA and frau= d. >>>>>>>>>>>>>> Additionally, most calls originate and terminate between >>>>>>>>>>>>>> mobile consumers where their carriers are able to usefully >>>>>>>>>>>>>> authenticate their device and have a high degree of >>>>>>>>>>>>>> confidence of the authenticity of the calling number. >>>>>>>>>>>>>> >>>>>>>>>>>>>> I think billions of per-TN certs of varying usability >>>>>>>>>>>>>> (revoked, not >>>>>>>>>>>>>> revoked) for authenticating calling number will not work wel= l. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Conversely, I think billions of per-TN certs will work >>>>>>>>>>>>>> well, if the calling party has to sign a call with a per-TN >>>>>>>>>>>>>> cert provided by the called party. No called party cert to = include? >>>>>>>>>>>>>> Then the calling party does not have a trusted relationship >>>>>>>>>>>>>> with the called party, and the call can be >>>>>>>>>>>>>> authorized/treated accordingly. >>>>>>>>>>>>>> (I've made similar, mostly ignored comments in MODERN.) >>>>>>>>>>>>>> >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 2:03 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> Well, the mechanisms are designed so that they could be >>>>>>>>>>>>>> deployed on devices and PBXs. Whether they will be is a >>>>>>>>>>>>>> policy issue. >>>>>>>>>>>>>> >>>>>>>>>>>>>> The notion of credentials that are traceable to a >>>>>>>>>>>>>> delegation of a TN is a mechanism that is part of the >>>>>>>>>>>>>> design of stir, and the design allows delegation of one TN >>>>>>>>>>>>>> (to one device, although a device like a PBX would have >>>>>>>>>>>>>> more than one TN per "device", and something like a dual >>>>>>>>>>>>>> NAM phone could have >>>> more >>>>>>>>>>>>>> than one credential. For the use case we've discussed, a >>>>>>>>>>>>>> mobile phone may also have a credential for, say, a TN that >>>>>>>>>>>>>> is delegated to a landline, to cover the example case of a >>>>>>>>>>>>>> doctor placing a call on his mobile, but getting his office >>>>>>>>>>>>>> number to show up as the calling party. Use of such mechani= sms is policy. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 2:52 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> Thanks Brian. I'm afraid we're straying into a policy >>>>>>>>>>>>>> discussion. Regardless, I do appreciate your explanation. >>>>>>>>>>>>>> I would like to continue the discussion, but I'm pretty >>>>>>>>>>>>>> sure this isn't the right forum. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 1:34 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >; >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> Of course I want PBXs to sign calls. As well as smart >>>>>>>>>>>>>> phones and any other devices that can be programmed to do >>>> so. >>>>>>>>>>>>>> They will be given credentials that only are valid for the >>>>>>>>>>>>>> TNs they are authorized to sign for. They can try to sign >>>>>>>>>>>>>> any call, but the validity of the credential would make >>>>>>>>>>>>>> such a signature fail the checking. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Getting service providers to sign on behalf of devices is >>>>>>>>>>>>>> a reasonable way to deploy quickly, but I expect many SPs >>>>>>>>>>>>>> will want to get out of the liability of signing on behalf >>>>>>>>>>>>>> of their customers. If they can push of that >>>>>>>>>>>>>> responsibility to their customer, only being responsible >>>>>>>>>>>>>> for getting the customer an appropriate credential when >>>>>>>>>>>>>> they assign TNs, then I would expect them to want to do >>>>>>>>>>>>>> so. That means the devices have to be able to sign, but I >>>>>>>>>>>>>> understand many of the PBX vendors think that's something >>>>>>>>>>>>>> they could provide in a future release. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 2:22 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> You want IP PBXes to sign calls? Won't that make it >>>>>>>>>>>>>> extraordinarily easy to commit fraud with >>>>>>>>>>>>>> authenticated numbers? >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 12:24 PM >>>>>>>>>>>>>> *To:* Gorman, Pierce A [CTO] >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> >; stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> First of all, we would want the PBX to generate the >>>>>>>>>>>>>> signature, >>>>>>>>>>>>>> but the service provider can do that. It should not ad= d a >>>>>>>>>>>>>> valid signature to a call from a number it did not >>>>>>>>>>>>>> assign to >>>>>>>>>>>>>> the trunk group connecting to the PBX, although it coul= d >>>>>>>>>>>>>> support the extra delegation required to support >>>>>>>>>>>>>> "authorized >>>>>>>>>>>>>> spoofing". The companion devices I'm aware of always s= end >>>>>>>>>>>>>> calls from the same service provider and should not pre= sent >>>>>>>>>>>>>> any issue. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Everyone will have to do work they don't do now to >>>>>>>>>>>>>> implement >>>>>>>>>>>>>> stop spoofed calls. TANSTAAFL >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 4, 2016, at 12:41 PM, Gorman, Pierce A [CTO] >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> Fraud from compromised PBXes is common. And even >>>>>>>>>>>>>> where a >>>>>>>>>>>>>> PBX is not compromised, a carrier has no practical >>>>>>>>>>>>>> way of >>>>>>>>>>>>>> knowing whether the calling number is properly assi= gned >>>>>>>>>>>>>> and valid from the perspective of the Enterprise. >>>>>>>>>>>>>> Therefore, checking whether the calling number was >>>>>>>>>>>>> >from an >>>>>>>>>>>>>> assigned range might be possible (and fraught with >>>>>>>>>>>>>> administrative challenges), but of limited value. >>>>>>>>>>>>>> And in >>>>>>>>>>>>>> the consumer market, there are calling products whi= ch >>>>>>>>>>>>>> support a parent subscriber number and "companion" >>>>>>>>>>>>>> devices >>>>>>>>>>>>>> (e.g., tablets) which can place a call using the MD= N of >>>>>>>>>>>>>> the parent subscriber. These are examples of where= the >>>>>>>>>>>>>> authenticity of the calling number won't >>>>>>>>>>>>>> necessarily mean >>>>>>>>>>>>>> the same thing as the authenticity of a call from >>>>>>>>>>>>>> a single >>>>>>>>>>>>>> subscriber with a single MDN regardless of "laxity"= of >>>>>>>>>>>>>> spoof checking. >>>>>>>>>>>>>> >>>>>>>>>>>>>> In another forum and anticipating calling number >>>>>>>>>>>>>> authentication mandates from Congress and/or FCC, I >>>>>>>>>>>>>> suggested using carrier-specific certs and encoding >>>>>>>>>>>>>> specificity of authenticity, and calling number. T= his >>>>>>>>>>>>>> provides the identity of the originating carrier, s= ome >>>>>>>>>>>>>> idea as to the accuracy or specificity of the calli= ng >>>>>>>>>>>>>> number, and validty of the calling number >>>>>>>>>>>>>> (assuming nonce >>>>>>>>>>>>>> and replay issues can be addressed as reasonably >>>>>>>>>>>>>> suggested >>>>>>>>>>>>>> below by Alex). >>>>>>>>>>>>>> >>>>>>>>>>>>>> The representation of orig-carrier and trustworthin= ess >>>>>>>>>>>>>> could be as follows: >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Regulated/mandated Carrier Class Use Case:* >>>>>>>>>>>>>> >>>>>>>>>>>>>> *00 - No Credentials* >>>>>>>>>>>>>> Use case example(s): Pre-IMS, legacy circuit-switch= ed >>>>>>>>>>>>>> networks that don't natively support SIP or which d= on't >>>>>>>>>>>>>> choose to sign calls. E.g., international carriers= . >>>>>>>>>>>>>> Trust Estimate: Good luck. Carrier_orig and CgPN >>>>>>>>>>>>>> entirely untrustworthy. >>>>>>>>>>>>>> >>>>>>>>>>>>>> *01 - Carrier signed, no authentication of CgPN* >>>>>>>>>>>>>> Use case example(s): E911 on visited network w/o >>>>>>>>>>>>>> roaming >>>>>>>>>>>>>> agreement, manual roaming. >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> entirely >>>>>>>>>>>>>> untrustworthy >>>>>>>>>>>>>> >>>>>>>>>>>>>> *10 - Carrier signed, semi-authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Number block delegated from >>>>>>>>>>>>>> OCN, but >>>>>>>>>>>>>> no per-TN screen (SIP trunks). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN >>>>>>>>>>>>>> less than >>>>>>>>>>>>>> most trustworthy but not entirely untrustworthy. >>>>>>>>>>>>>> >>>>>>>>>>>>>> *11 - Carrier signed, authenticated CgPN* >>>>>>>>>>>>>> Use case example(s): Bread-and-butter 95%+ of >>>>>>>>>>>>>> calls from >>>>>>>>>>>>>> subscriber lines (IMS-based and otherwise). >>>>>>>>>>>>>> Trust Estimate: Carrier_orig trustworthy, CgPN mos= t >>>>>>>>>>>>>> trustworthy >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Public Use Case:* >>>>>>>>>>>>>> >>>>>>>>>>>>>> Undefined but assumed to use public or commercially >>>>>>>>>>>>>> available authentication services resources. e.g., >>>>>>>>>>>>>> nomorobo-like crowd-sourced accept/deny lists, et >>>>>>>>>>>>>> cetera. >>>>>>>>>>>>>> Could/would pass credentials down to SIP-aware devi= ces >>>>>>>>>>>>>> which would process them according to the rules of = the >>>>>>>>>>>>>> Public Class application(s). >>>>>>>>>>>>>> >>>>>>>>>>>>>> Pierce >>>>>>>>>>>>>> >>>>>>>>>>>>>> *From:* Brian Rosen [mailto:br@brianrosen.net] >>>>>>>>>>>>>> *Sent:* August 04, 2016 9:02 AM >>>>>>>>>>>>>> *To:* Alex Bobotek >>>>>>>>>>>>> >>>>>>>>>>>>>> > >>>>>>>>>>>>>> *Cc:* stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> *Subject:* Re: [stir] STIR 4474bis-10 comments >>>>>>>>>>>>>> >>>>>>>>>>>>>> There are reasonable circumstances where a party >>>>>>>>>>>>>> placing a >>>>>>>>>>>>>> call is not the authorized entity assigned the >>>>>>>>>>>>>> telephone >>>>>>>>>>>>>> number used in From/PAI, and in such circumstances = the >>>>>>>>>>>>>> service provider servicing the entity placing the >>>>>>>>>>>>>> call may >>>>>>>>>>>>>> or may not be the same as the service provider >>>>>>>>>>>>>> serving the >>>>>>>>>>>>>> entity that is assigned the TN. In all such cases,= the >>>>>>>>>>>>>> entity that is assigned the TN explicitly >>>>>>>>>>>>>> authorizes calls >>>>>>>>>>>>>> placed using it's TN. The design accommodates such= use >>>>>>>>>>>>>> cases. It's not a blanket authorization without >>>>>>>>>>>>>> authentication. We're not aware of any cases wher= e >>>>>>>>>>>>>> there >>>>>>>>>>>>>> is an actual requirement for legitimate calling wit= hout >>>>>>>>>>>>>> explicit authorization from the assigned entity, >>>>>>>>>>>>>> although >>>>>>>>>>>>>> we certainly are aware that various parts of variou= s >>>>>>>>>>>>>> service providers don't bother to check. At this >>>>>>>>>>>>>> point, at >>>>>>>>>>>>>> least in some countries, there is a realization >>>>>>>>>>>>>> that the >>>>>>>>>>>>>> laxity of allowing unchecked spoofing is not accept= able >>>>>>>>>>>>>> any more. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Brian >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Aug 3, 2016, at 8:35 AM, Alex Bobotek >>>>>>>>>>>>>> >>>>>>>>>>>>>> > wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> 1. Permit authorization without >>>>>>>>>>>>>> authentication >>>>>>>>>>>>>> In the current telephony network practice, some >>>>>>>>>>>>>> service provider implementations choose not to >>>>>>>>>>>>>> authenticate identity, but simply facilitate >>>>>>>>>>>>>> the use >>>>>>>>>>>>>> of an arbitrary or selected user-provided ident= ity. >>>>>>>>>>>>>> Are there legitimate use cases for this? Has >>>>>>>>>>>>>> anyone >>>>>>>>>>>>>> established that there are not? How can the >>>>>>>>>>>>>> industry >>>>>>>>>>>>>> reasonably expect to end this (often bad) pract= ice? >>>>>>>>>>>>>> If it can't be ended, there's value in at least >>>>>>>>>>>>>> identifying the originating service provider >>>>>>>>>>>>>> (i.e., the signer/authorizer). Given the >>>>>>>>>>>>>> prevalence >>>>>>>>>>>>>> of abuse using telephone numbers assigned to a >>>>>>>>>>>>>> sometimes-anonymous abuser, it becomes critical= ly >>>>>>>>>>>>>> important to identify the service provider(s) >>>>>>>>>>>>>> closest >>>>>>>>>>>>>> to the abuser. Based on the assumption that it= 's >>>>>>>>>>>>>> better to ID service providers than unreasonabl= y >>>>>>>>>>>>>> expect a ban of the use of unauthenticated (and >>>>>>>>>>>>>> therefore unsigned) SIP requests, STIR signing >>>>>>>>>>>>>> should >>>>>>>>>>>>>> support authorization without authentication. = The >>>>>>>>>>>>>> practice of authorizing unauthenticated use exi= sts, >>>>>>>>>>>>>> and there is benefit to signing in these cases >>>>>>>>>>>>>> (service provider identification). The languag= e of >>>>>>>>>>>>>> the ID should permit this use. 4474bis-10 >>>>>>>>>>>>>> should NOT >>>>>>>>>>>>>> require or assume that that authentication wil= l >>>>>>>>>>>>>> precede authorization. Of course there may be o= ther >>>>>>>>>>>>>> use cases where signing includes authentication= and >>>>>>>>>>>>>> may not include a specific service provider's >>>>>>>>>>>>>> authorization. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> 2. Improve replay prevention >>>>>>>>>>>>>> Proximate replay is possible while complying >>>>>>>>>>>>>> with this >>>>>>>>>>>>>> spec. First, one or more proximate (e.g., >>>>>>>>>>>>>> within >>>>>>>>>>>>>> 60 >>>>>>>>>>>>>> seconds) SIP requests using the same token are >>>>>>>>>>>>>> legal >>>>>>>>>>>>>> and subject to replay in many cases. An SDP bo= dy's >>>>>>>>>>>>>> mky may not be present and if present its use i= s >>>>>>>>>>>>>> optional. Some sort of mandatory new or existi= ng >>>>>>>>>>>>>> signed sequence, random # or request ID (e.g., >>>>>>>>>>>>>> Call-ID >>>>>>>>>>>>>> or CSeq) and a 1-time use policy on the >>>>>>>>>>>>>> receiving end >>>>>>>>>>>>>> of the request (e.g., tokens only good for 1 >>>>>>>>>>>>>> use) could prevent replay. Different methods >>>>>>>>>>>>>> (e.g., >>>>>>>>>>>>>> INVITE vs MESSAGE) might be handled by differen= t >>>>>>>>>>>>>> receiving infrastructure, and therefore >>>>>>>>>>>>>> difficulties >>>>>>>>>>>>>> with 'it's been used already' coordination allo= w a >>>>>>>>>>>>>> faked MESSAGE based on a captured request. >>>>>>>>>>>>>> This might >>>>>>>>>>>>>> include an mkey from a captured INVITE. So it >>>>>>>>>>>>>> may be >>>>>>>>>>>>>> possible to DOS, spam or text-bomb a recipient >>>>>>>>>>>>>> using a >>>>>>>>>>>>>> captured identity. While large-scale or >>>>>>>>>>>>>> distributed >>>>>>>>>>>>>> implementations may make the enforcement diffic= ult, >>>>>>>>>>>>>> there is little cost to signing and decoding a >>>>>>>>>>>>>> method >>>>>>>>>>>>>> and possibly a numeric ID. Some sort of '1-us= e' >>>>>>>>>>>>>> practice should at least be discussed while per= haps >>>>>>>>>>>>>> not required. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Specific markup suggestions: >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> NITS >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> The verifier MUST inspect any optional "ppt" >>>>>>>>>>>>>> parameter appearing *in*the >>>>>>>>>>>>>> >>>>>>>>>>>>>> Identity request. If no "ppt" parameter is >>>>>>>>>>>>>> present, then the >>>>>>>>>>>>>> >>>>>>>>>>>>>> verifier proceeds normally below. If a "ppt= " >>>>>>>>>>>>>> parameter value is >>>>>>>>>>>>>> >>>>>>>>>>>>>> present, and the verifier does not support >>>>>>>>>>>>>> it, it MUST ignore the >>>>>>>>>>>>>> >>>>>>>>>>>>>> Identity header. If a supported "ppt" >>>>>>>>>>>>>> parameter value is present, >>>>>>>>>>>>>> >>>>>>>>>>>>>> the verifier follows the procedures below, >>>>>>>>>>>>>> including the variations >>>>>>>>>>>>>> >>>>>>>>>>>>>> described in Step 5. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> 3 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>> 447 >>>>>>>>>>>>>> 4bi >>>>>>>>>>>>>> s-10%20- >>>> %20Authenticated%20Identity%20Management%20in%20the%20 >>>>>>>>>>>>>> Ses sion%20Initiation%20Protocol%20%28SIP%29.htm#section- >>>> 3>. >>>>>>>>>>>>>> Background >>>>>>>>>>>>>> >>>>>>>>>>>>>> [...] >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Per [RFC7340 >>>>>>>>>>>>>> ], problems such as >>>>>>>>>>>>>> robocalling, voicemail hacking, and >>>>>>>>>>>>>> >>>>>>>>>>>>>> swatting are enabled by an attacker's >>>>>>>>>>>>>> ability to impersonate someone >>>>>>>>>>>>>> >>>>>>>>>>>>>> else. The secure operation of most SIP >>>>>>>>>>>>>> applications and services >>>>>>>>>>>>>> >>>>>>>>>>>>>> depends on authenticating and/or >>>>>>>>>>>>>> authorizing the source of communications as it is >>>>>>>>>>>>>> >>>>>>>>>>>>>> represented in a SIP request. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> This identity architecture for SIP depends >>>>>>>>>>>>>> on includes provisions for a logical >>>>>>>>>>>>>> >>>>>>>>>>>>>> "authentication service" which validates >>>>>>>>>>>>>> caller identity at or near origination. outgoing >>>>>>>>>>>>>> requests. An >>>>>>>>>>>>>> >>>>>>>>>>>>>> authentication service may be implemented >>>>>>>>>>>>>> either as part of a user >>>>>>>>>>>>>> >>>>>>>>>>>>>> agent or as a proxy server; typically, it >>>>>>>>>>>>>> is a component of a network >>>>>>>>>>>>>> >>>>>>>>>>>>>> intermediary like a proxy to which >>>>>>>>>>>>>> originating user agents send >>>>>>>>>>>>>> >>>>>>>>>>>>>> unsigned requests. Once the sender of the >>>>>>>>>>>>>> message has been >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> This document specifies a means of sharing >>>>>>>>>>>>>> a cryptographic assurance >>>>>>>>>>>>>> >>>>>>>>>>>>>> of authenticity of and/or authorization to >>>>>>>>>>>>>> use end-user SIP identity in an interdomain or intradomain >>>> context. >>>>>>>>>>>>>> >>>>>>>>>>>>>> It relies on the authentication service >>>>>>>>>>>>>> constructing tokens based on [...] >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> To maximize end-to-end security, it is >>>>>>>>>>>>>> typically obviously >>>>>>>>>>>>>> >>>>>>>>>>>>>> preferable for end-users to acquire their >>>>>>>>>>>>>> own credentials; if they >>>>>>>>>>>>>> >>>>>>>>>>>>>> do, their user agents can act as >>>>>>>>>>>>>> authentication services. However, >>>>>>>>>>>>>> >>>>>>>>>>>>>> for some deployments, [...] >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Regards, >>>>>>>>>>>>>> >>>>>>>>>>>>>> Alex >>>>>>>>>>>>>> * * >>>>>>>>>>>>>> *Alex Bobotek* >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>> _______________________________________________ >>>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>>> >>>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> ----------------------------------------------------------- >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> - >>>>>>>>>>>>>> - >>>>>>>>>>>>>> -- >>>>>>>>>>>>>> ------- >>>>>>>>>>>>>> >>>>>>>>>>>>>> This e-mail may contain Sprint proprietary informat= ion >>>>>>>>>>>>>> intended for the sole use of the recipient(s). Any >>>>>>>>>>>>>> use by >>>>>>>>>>>>>> others is prohibited. If you are not the intended >>>>>>>>>>>>>> recipient, please contact the sender and delete >>>>>>>>>>>>>> all copies >>>>>>>>>>>>>> of the message. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> stir mailing list >>>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>>>> >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> stir mailing list >>>>>>>>>>>> stir@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>>>> >>>>>>>>>> _______________________________________________ >>>>>>>>>> stir mailing list >>>>>>>>>> stir@ietf.org >>>>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> stir mailing list >>>>>>>> stir@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> ________________________________ >>>>>>>> >>>>>>>> This e-mail may contain Sprint proprietary information intended >>>>>>>> for the sole use of the recipient(s). Any use by others is prohibi= ted. >>>>>>>> If you are not the intended recipient, please contact the sender >>>>>>>> and delete all copies of the message. >>>>>>> >>>>>>> _______________________________________________ >>>>>>> stir mailing list >>>>>>> stir@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> stir mailing list >>>>>> stir@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/stir >>>>>> >>>>> >>>>> _______________________________________________ >>>>> stir mailing list >>>>> stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>> >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> >> ________________________________ >> >> This e-mail may contain Sprint proprietary information intended for the = sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies = of the message. >> > > From nobody Wed Aug 10 12:57:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0679D12B04B for ; Wed, 10 Aug 2016 12:57:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cUBRw3fOgLpD for ; Wed, 10 Aug 2016 12:57:35 -0700 (PDT) Received: from qproxy1-pub.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id 9066712D0B3 for ; Wed, 10 Aug 2016 12:57:35 -0700 (PDT) Received: (qmail 5346 invoked by uid 0); 10 Aug 2016 19:57:32 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy1.mail.unifiedlayer.com with SMTP; 10 Aug 2016 19:57:32 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id VXsU1t00m1MNPNq01XsXVg; Wed, 10 Aug 2016 13:52:32 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=M0OflfRGAAAA:8 a=HLLxP2VMAAAA:8 a=pGLkceISAAAA:8 a=48vgC7mUAAAA:8 a=h-sXjZp9n5SqkSxe7T4A:9 a=df5f4K9NEhm3VrW8:21 a=icWvjc1XmxlvJVfG:21 a=QEXdDO2ut3YA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=ONCuO51ud02Kl9e9azAA:9 a=yEsC2vKTknWlYOJ_:21 a=XT1TtnKZXoHwabyw:21 a=I7pwPLVKm0WnmpVm:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=6yl0mh0s51TKORVA8GqK:22 a=5oret6oapBRfLy7jekVI:22 a=6kGIvZw6iX1k4Y-7sg4_:22 a=w1C3t2QeGrPiZgrLijVG:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date; bh=lasLYCEJDqq2FK7eC9+Pgow1GCCN4ppR9YvP8bX6ZrQ=; b=jEbn sXyiN90QRQ6gjwhVEVYAaMwDtm6Ly4skQVaXg0w5JQzWA3P/TM5AbefQS8gpNuQd/ST7XWpg/brpu kjLkdjgvH+3rSUs/ExnxZhwi9ivgX7MZKAN7ZNgrOxCGZvI; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:49990 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bXZYC-0003as-JE; Wed, 10 Aug 2016 13:52:28 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Wed, 10 Aug 2016 15:52:26 -0400 From: Richard Shockey To: Brian Rosen , Andy Hutton Message-ID: Thread-Topic: [stir] STIR's basic operational model with SIP References: <3e59df1a-741a-9d3a-71fc-203015efbe0b@dcrocker.net> <4C001BD1-4879-4F8E-8A7B-038103A72A85@brianrosen.net> <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> In-Reply-To: <9800E7EE-3888-45D0-AC50-F7A69D5BBD14@brianrosen.net> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3553689148_1851025030" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bXZYC-0003as-JE X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:49990 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF STIR Mail List , Paul Kyzivat Subject: Re: [stir] STIR's basic operational model with SIP X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 19:57:39 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3553689148_1851025030 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 Thank you Brian=E2=80=A6 That is exactly what some of us have in mind ..Call Vali= dation Display Framework derived from the Network Validation process.=20 =20 http://www.sipforum.org/component/option,com_docman/task,doc_download/gid,8= 19/Itemid,261/ =20 We can argue about whether the validation should be done at the device or w= ithin the network, but the consumer need to see what is going on.=20 =20 From: Brian Rosen Date: Wednesday, August 10, 2016 at 9:02 AM To: Andy Hutton Cc: Richard Shockey , IETF STIR Mail List , Paul Kyzivat Subject: Re: [stir] STIR's basic operational model with SIP =20 I don=E2=80=99t think that is at all true. If validation is done at, say a trans= it network interconnect, and the transit network refuses to accept the call = without a valid signature (assuming it does not run afoul of its local regul= ations in doing so), then there is value to the consumer. If the terminatio= n network does the same, value. If the termination network modifies the sig= naling towards the consumer so that the display name is =E2=80=9Csuspicious call=E2=80= =9D or =E2=80=9Cunknown caller=E2=80=9D, that is of great value to the consumer. If it o= ffers an option to the consumer to send calls with bad signatures or no sign= atures direct to voicemail, that is of great value. =20 So, while I really, really do want to do the validation on the device (beca= use the consumer will have more options available of that is what happens), = I think the mechanism can help consumers way before it shows up on the devic= e and the device is able to do something with it. =20 Brian =20 On Aug 10, 2016, at 8:41 AM, Andy Hutton wrote: =20 =20 Also as Dave Crocker pointed out what happens at the callee is also importa= nt if no validation is possible at the callee's device then surely there is = no real benefit to the consumer. =20 Regards Andy =20 On Tue, Aug 9, 2016 at 6:09 PM, Richard Shockey wrote: On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" wrote: On 8/9/16 12:25 PM, Richard Shockey wrote: > > +1 it has to start some where. > > The circles of trust start first with the circles of authority and th= en can be delegated as requirements dictate. The integrity numbering plan i= s a direct and plenary responsibility of NRA=E2=80=99s period full stop. > > I=E2=80=99m less confident we will ever get to the device level..at least n= ot for the foreeable future aka my lifetime. If the SPs have an incentive to *not* delegate then it will be very har= d to get there. RS> Not our concern. Way beyond our scope of competence here. Don=E2=80=99t for= get the NRA=E2=80=99s have the real =E2=80=9CMaxwell=E2=80=99s Silver Hammer=E2=80=9D and you can be= sure they can use it if delegation or lack thereof is perceived to be anti = competitive. OTOH, if they have an incentive then the chances are better. Brian and Paul R outlined some possible incentives to delegate. That gives some hope. Thanks, Paul _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 --B_3553689148_1851025030 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Thank you Brian… That= is exactly what some of us have in mind ..Call Validation Display Framework= derived from the Network Validation process.

 

http://www.sipforum.= org/component/option,com_docman/task,doc_download/gid,819/Itemid,261/

 

We can argue abou= t whether the validation should be done at the device or within the network,= but the consumer need to see what is going on.

 

From: Brian Ros= en <br@brianrosen.net>
Date: Wednesday, August 10, 2016 at 9= :02 AM
To: Andy Hutton <andyhutton.ietf@gmail.com>
Cc:= Richard Shockey <richard@shockey.us>, IETF STIR Mail List <sti= r@ietf.org>, Paul Kyzivat <pkyzivat@alum.mit.edu>
Subject: Re: [stir] STIR's basic operational model with SIP

 

I don’t think that is at all true.  If validation is done= at, say a transit network interconnect, and the transit network refuses to = accept the call without a valid signature (assuming it does not run afoul of= its local regulations in doing so), then there is value to the consumer. &n= bsp;If the termination network does the same, value.  If the terminatio= n network modifies the signaling towards the consumer so that the display na= me is “suspicious call” or  “unknown caller”, t= hat is of great value to the consumer.  If it offers an option to the c= onsumer to send calls with bad signatures or no signatures direct to voicema= il, that is of great value.

 = ;

So, while I really, really do want = to do the validation on the device (because the consumer will have more opti= ons available of that is what happens), I think the mechanism can help consu= mers way before it shows up on the device and the device is able to do somet= hing with it.

 <= /p>

Brian

 

On Aug 10, 2016, at 8:41 AM, Andy Hutt= on <andyhutton.ietf@gmail.com<= /a>> wrote:

 

<= div>

 

Also as Dave Crocker pointed out what happens at the callee is also = important if no validation is possible at the callee's device then surely th= ere is no real benefit to the consumer.

 

Regards

Andy

 

On Tue, Aug 9, 20= 16 at 6:09 PM, Richard Shockey <richard@shockey.us> wrote:



On 8/9/16, 12:58 PM, "stir on behalf of Paul Kyzivat" = <stir-bounces@ietf.org on beha= lf of pkyzivat@alum.mit.edu> w= rote:

    On 8/9/16 12:25 PM, Richard Shockey wrote:
&nb= sp;   >
    > +1 it has to start some where.
&nbs= p;   >
    > The circles of trust start first with t= he circles of authority and then can be delegated as requirements dictate.&n= bsp; The integrity numbering plan is a direct and plenary responsibility of = NRA’s period full stop.
&n= bsp;   >
    &= gt; I’m less confident we will ever get to the device level..at least = not for the foreeable future aka my lifetime.

    If the SP= s have an incentive to *not* delegate then it will be very hard
  &n= bsp; to get there.

RS> Not our concern.   Way beyond our= scope of competence here. Don’t forget the NRA’s have the real = “Maxwell’s Silver Hammer” and you can be sure they can use= it if delegation or lack thereof is perceived to be anti competitive.


    = OTOH, if they have an incentive then the chances are better.

<= span class=3Dim>    Brian and Paul R outlined some possible incentiv= es to delegate. That
    gives some hope.=

        Thanks,
=         Paul



<= /o:p>

______________________________________= _________
stir mailing list
stir@ietf.o= rg
https://www.ietf.org/mailman/listinfo/stir

=

 

_______________________________________________
stir mailing list=
stir@ietf.org
https://www.ietf.org= /mailman/listinfo/stir

 

--B_3553689148_1851025030-- From nobody Fri Aug 12 08:51:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2119A12D5BD for ; Fri, 12 Aug 2016 08:51:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p_K16WtpRbNF for ; Fri, 12 Aug 2016 08:51:52 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3999712D727 for ; Fri, 12 Aug 2016 08:51:50 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7CFpro5005392 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 12 Aug 2016 08:51:54 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471017114; bh=dHcydgWA/am0hiEq7ny6jkEZiSqAixc0PrnMdkF1SkM=; h=From:Subject:Reply-To:To:Date:From; b=WmRbdQapFvHXGt+ACTzf0gSTCGWFLF9K6fLgt1s0lvf167sj4G8/ZsGX0SI1YDIKI a0C5q36kBnZNUoe7u8XYRjk3YeWyg0ofyaGqynqXTFNFRXfztwpiaMmO6mp/RfqeF6 eqOqcKXEAV/pedSYB/Of2AyNasBXHaBkKBATPQkk= From: Dave Crocker Organization: Brandenburg InternetWorking To: "stir@ietf.org" Message-ID: <0351fc4a-dd81-c62b-ad8e-78c9969d6d04@dcrocker.net> Date: Fri, 12 Aug 2016 08:51:19 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Review: draft-ietf-stir-certificates-07 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Aug 2016 15:51:55 -0000 Review of: Secure Telephone Identity Credentials: Certificates I-D: draft-ietf-stir-certificates-07.txt Review date: 12 July 2016 Reviewed by: D. Crocker Summary: An inter-organization crypto-based authentication service, such as is needed for telephone caller-id verification, needs a mechanism for finding and validating the public key used for verification. A common, core component of such systems are credentials based on X.509 certificates. This document deals with that topic, for STIR-based services. The Abstract only promises "description" of such services, rather than specification. It mostly only delivers some discussion. There are some very small segments of unanchored and incomplete specification. However the document does not specify or even describe a STIR-based certificate mechanism. Rather, the document is a mix of discussions /about/ STIR-based certificate-related issues, mostly at a rather abstract level. The document also contains a variety of recommendations about choices, in spite of having no specific specification of services that are referenced. That is, the recommendations are based on concepts rather than actualities. In addition to the basic and extensive problems within the document itself, the details of creating a workable cert system for a service such as this border on being an open research task. There is a long history of problematic cert use. There is a storied history of problems with inter-provider phone-number-based query services. But the STIR effort needs a working service that does both. However there is /no/ history of a public phone-number-based query service at scale and with adequate privacy protection. And yet the current task requires solving at least two of these and maybe all three... This document says that it is intended for Standards Track. However it is not a specification and thus is entirely unsuited for standards track. Neither does it contain material appropriate for BCP. Overall, the document is extremely incomplete, even for what it appears to be attempting to provide. This document is very far from being ready for publication. d/ > Abstract > > In order to prevent the impersonation of telephone numbers on the > Internet, some kind of credential system needs to exist that > cryptographically proves authority over telephone numbers. This > document describes the use of certificates in establishing authority > over telephone numbers, as a component of a broader architecture for > managing telephone numbers as identities in protocols like SIP. It mostly does not 'describe the use'. It has bits of discussion, about bits of use, but gives no integrated description. It also contains a few bits of incomplete specification. > Status of This Memo > > This Internet-Draft is submitted in full conformance with the > provisions of BCP 78 and BCP 79. > > Internet-Drafts are working documents of the Internet Engineering > Task Force (IETF). Note that other groups may also distribute > working documents as Internet-Drafts. The list of current Internet- > Drafts is at http://datatracker.ietf.org/drafts/current/. > > Internet-Drafts are draft documents valid for a maximum of six months > and may be updated, replaced, or obsoleted by other documents at any > time. It is inappropriate to use Internet-Drafts as reference > material or to cite them other than as "work in progress." > > This Internet-Draft will expire on January 9, 2017. > > Copyright Notice > > Copyright (c) 2016 IETF Trust and the persons identified as the > document authors. All rights reserved. > > This document is subject to BCP 78 and the IETF Trust's Legal > Provisions Relating to IETF Documents > (http://trustee.ietf.org/license-info) in effect on the date of > publication of this document. Please review these documents > carefully, as they describe your rights and restrictions with respect > to this document. Code Components extracted from this document must > include Simplified BSD License text as described in Section 4.e of > > > > Peterson & Turner Expires January 9, 2017 [Page 1] > > Internet-Draft STIR Certs July 2016 > > > the Trust Legal Provisions and are provided without warranty as > described in the Simplified BSD License. > > Table of Contents > > 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 > 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 > 3. Authority for Telephone Numbers in Certificates . . . . . . . 3 > 4. Certificate Usage . . . . . . . . . . . . . . . . . . . . . . 5 > 5. Enrollment and Authorization using the TN Authorization List 6 > 5.1. Levels Of Assurance . . . . . . . . . . . . . . . . . . . 7 > 5.2. Certificate Extension Scope and Structure . . . . . . . . 8 > 6. Provisioning Private Keying Material . . . . . . . . . . . . 8 > 7. Acquiring Credentials to Verify Signatures . . . . . . . . . 9 > 8. Verifying Certificate Scope with TN Authorization List . . . 10 > 9. Certificate Freshness and Revocation . . . . . . . . . . . . 11 > 9.1. Choosing a Verification Method . . . . . . . . . . . . . 12 > 9.2. Using OCSP with TN Auth List . . . . . . . . . . . . . . 13 > 9.2.1. OCSP Extension Specification . . . . . . . . . . . . 13 > 9.3. Acquiring TN Lists By Reference . . . . . . . . . . . . . 15 > 10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 > 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 > 12. Security Considerations . . . . . . . . . . . . . . . . . . . 17 > 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 18 > Appendix A. ASN.1 Module . . . . . . . . . . . . . . . . . . . . 20 > Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 22 > > 1. Introduction > > The STIR problem statement [RFC7340] identifies the primary enabler > of robocalling, vishing, swatting and related attacks as the > capability to impersonate a calling party number. The starkest > examples of these attacks are cases where automated callees on the > PSTN rely on the calling number as a security measure, for example to > access a voicemail system. Robocallers use impersonation as a means > of obscuring identity; while robocallers can, in the ordinary PSTN, > block (that is, withhold) their caller identity, callees are less > likely to pick up calls from blocked identities, and therefore > appearing to calling from some number, any number, is preferable. > Robocallers however prefer not to call from a number that can trace > back to the robocaller, and therefore they impersonate numbers that > are not assigned to them. > > One of the most important components of a system to prevent > impersonation is the implementation of credentials which identify the > parties who control telephone numbers. With these credentials, Credentials normally are for validation, not identification. Typically, the user already has the identifier. So identification of the owner, per se, is not the goal. In any event, are these credentials really that usage-specific? Normally, credentials are simply a means of validating some information associated with an identifier, but they aren't so tightly coupled with a particular application. > parties can prove that they are in fact authorized to use telephony > numbers, and thus distinguish themselves from impersonators unable to > > > > Peterson & Turner Expires January 9, 2017 [Page 2] > > Internet-Draft STIR Certs July 2016 > > > present such credentials. For that reason the STIR threat model > [RFC7375] stipulates, "The design of the credential system envisioned > as a solution to these threats must, for example, limit the scope of > the credentials issued to carriers or national authorities to those > numbers that fall under their purview." This document describes The quoted text is meant to provide an underpinning to the current specification. Unfortunately there is no obvious meaning to "limit the scope of the credentials". For example, it might refer to limitations in the semantics, or it might refer to the distribution of the credential. The reader can't tell. > credential systems for telephone numbers based on X.509 version 3 > certificates in accordance with [RFC5280]. While telephone numbers > have long been a part of the X.509 standard, this document provides > ways to determine authority more aligned with telephone network > requirements, including extending X.509 with a Telephone Number > Authorization List which binds certificates to authority for > particular telephone numbers, or potentially telephone number blocks > or ranges. > > In the STIR in-band architecture specified in > [I-D.ietf-stir-rfc4474bis], two basic types of entities need access > to these credentials: authentication services, and verification > services (or verifiers). An authentication service must be operated > by an entity enrolled with the certification authority (CA, see > Section 5), whereas a verifier need only trust the trust anchor of > the authority, and have a means to access and validate the public > keys associated with these certificates. Although the guidance in > this document is written with the STIR in-band architecture in mind, > the credential system described in this document could be useful for > other protocols that want to make use of certificates to prove > authority over telephone numbers on the Internet. > > This document specifies only the credential syntax and semantics > necessary to support this architecture. It does not assume any > particular CA or deployment environment. We anticipate that some > deployment experience will be necessary to determine optimal > operational models. > > 2. Terminology > > The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", > "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and > "OPTIONAL" in this document are to be interpreted as described in RFC > 2119 [RFC2119]. > > 3. Authority for Telephone Numbers in Certificates > > At a high level, this specification details two non-exclusive 'non-exclusive' is distracting and doesn't add the clarity it intends. There is no default assumption that adding one set of enhancements now precludes adding others later. > approaches that can be employed to determine authority over telephone I suspect these are not 'approaches' but rather are specific capabilities. > numbers with certificates. 'can be'... This appears to be saying that this specification does not provide a clear and interoperable solution for the use of certificates to validate telephone numbers. That is, by defining two, the two parties to use of a cert could each make different choices and fail to interoperate. After some re-reading, I'm suspecting that what this paragraph intends to mean is something like: This specification defines two enhancements to common X.509 certificates. One indicates the subject of the certificate But unfortunately I think it does not actually define either of them as complete and implementable. > > The first approach is to leverage the subject of the certificate to " > ascertain that the holder of the certificate is authorized to claim > > > > Peterson & Turner Expires January 9, 2017 [Page 3] > > Internet-Draft STIR Certs July 2016 > > > authority over a telephone number. The subject might be represented > as a domain name in the SubjectAltName, such as an "example.net" > where that domain is known to relying parties as a carrier, or This appears to be saying that the consumer of a certificate must have significant, independent knowledge of the semantics and use of the certificate's contents. That's likely to be a serious issue. How will they obtain this? What will ensure that certificates are, in fact, interoperably useful? > represented with other identifiers related to the operation of the > telephone network including Service Provider Identifiers (SPIDs) > could serve as a subject as well. A relying party could then employ > an external data set or service that determines whether or not a > specific telephone number is under the authority of the carrier > identified as the subject of the certificate, and use that to > ascertain whether or not the carrier should have authority over a How is this sort of hypothetical useful for providing concrete specification detail? If, ultimately, this is saying that the specification here is merely providing some common syntax, but that complete specification of the semantics is out of scope for the document, then it needs to say that early and clearly. It probably also should explain why. However, of course, this opens the question for where that additional information is specified. And how is the reader to know? > telephone number. Potentially, a certificate extension to convey the > URI of such an information service trusted by the issuer of the > certificate could be developed (though this specification does not > propose one). Alternatively, some relying parties could form > bilateral or multilateral trust relationships with peer carriers, > trusting one another's assertions just as telephone carriers in the > SS7 network today rely on transitive trust when displaying the > calling party telephone number received through SS7 signaling. Again, this explores hypotheticals rather than giving specification. While possibly useful for a general overview of this architecture and its possible application, it doesn't help with the current explanation. > The second approach is to extend the syntax of certificates to > include a new attribute, defined here as TN Authorization List, which > contains a list of telephone numbers defining the scope of authority > of the certificate. Relying parties, if they trust the issuer of the > certificate as a source of authoritative information on telephone > numbers, could therefore use the TN Authorization List instead of the > subject of the certificate to make a decision about whether or not > the signer has authority over a particular telephone number. The TN > Authorization List could be provided in one of two ways: as a literal > value in the certificate, or as a network service that allows relying > parties to query in real time to determine that a telephone number is > in the scope of a certificate. Using the TN Authorization list > rather than the certificate subject makes sense when, for example, > for privacy reasons, the certificate owner would prefer not to be > identified, or in cases where the holder of the certificate does not > participate in the sort of traditional carrier infrastructure taht > the first approach assumes. > > The first approach requires little change to existing Public Key > Infrastructure (PKI) certificates; for the second approach, we must > define an appropriate enrollment and authorization process. For the > purposes of STIR, the over-the-wire format specified in > [I-D.ietf-stir-rfc4474bis] accommodates either of these approaches: > the methods for canonicalizing, signing, for identifying and > accessing the certificate and so on remain the same; it is only the > verifier behavior and authorization decision that will change > depending on the approach to telephone number authority taken by the > certificate. So the verifier must support both, since they won't know which the signer chose. What is the compelling benefit in defining these two different mechanisms? > exclusive, and in fact a certificate issued to a traditional > > > > Peterson & Turner Expires January 9, 2017 [Page 4] > > Internet-Draft STIR Certs July 2016 > > > telephone network service provider could contain a TN Authorization > List or not, depending on the CA issuing the credential. Regardless Sounds like good opportunity for conflicting information. > of which approach is used, certificates that assert authority over > telephone numbers are subject to the ordinary operational procedures > that govern certificate use per [RFC5280]. This means that > verification services must be mindful of the need to ensure that they > trust the trust anchor that issued the certificate, and that they "must be mindful of the need to ensure that they trust the trust anchor" huh? This is a specification and I have no idea what the above text is specifying. > have some means to determine the freshness of the certificate (see > Section 9). > > 4. Certificate Usage This section has nothing to do with /using/ certificates. It provides some discussion -- but no specification -- of issues concerning the /creation/ of them. > [I-D.ietf-stir-rfc4474bis] requires that all credential systems used > for signing the Identity header in SIP detail the following: > > 1. The URI schemes permitted in the SIP Identity header "info" > parameter, as well as any special procedures required to > dereference the URIs. While normative text is given below in > Section 7, this mechanism permits the HTTP, CID and SIP URI > schemes to appear in the "info" parameter. > > 2. Procedures required to extract keying material from the resources > designated by the URI. Implementations perform no special > procedures beyond dereferencing the "info" URI. See Section 7. > > 3. Procedures used by the verification service to determine the > scope of the credential. This specification effectively proposes > two methods, as outlined in Section 3: one where the subject (or > more properly subjectAltName) of the certificate indicates the > scope of authority through a domain name, and relying parties > either trust the subject entirely or have some direct means of > determining whether or not a number falls under a subject's > authority; and another where an extension to the certificate as > described in Section 8 identifies the scope of the certificate. > > 4. The cryptographic algorithms required to validate the > credentials. For this specification, that means the signature > algorithms used to sign certificates. This specification > REQUIRES that implementations support both ECDSA with the P-256 > curve (see [RFC4754]) and RSA PKCS#1 v1.5 (see [RFC3447] > Section 8.2) for certificate signatures. Implementers are > advised that RS256 is mandated only as a transitional mechanism, > due to its widespread use in existing PKI, but we anticipate that > this mechanism will eventually be deprecated. > > 5. Finally, note that all certificates compliant with this > specification: > > > > > Peterson & Turner Expires January 9, 2017 [Page 5] > > Internet-Draft STIR Certs July 2016 > > > * MUST provide cryptographic keying material sufficient to > generate the ECDSA using P-256 and SHA-256 signatures > necessary to support the ES256 hashed signatures required by > PASSporT [I-D.ietf-stir-passport], which in turn follows JSON > Web Token (JWT) [RFC7519]. > > * MUST support both ECDSA with P-256 and RSA PKCS#1 v1.5 for > certificate signature verification. > > This document also includes additional certificate-related > requirements: > > o See Section 5.1 for requirements related to the certificate > policies extension. > > o See Section 7 for requirements related to the TN Query certificate > extension. > > o See Section 9.2 and Section 9.3 for requirements related to the > Authority Information Access (AIA) certificate extension. > > o See Section 9.2.1 for requirements related to the authority key > identifier and subject key identifier certificate extensions. > > 5. Enrollment and Authorization using the TN Authorization List This entire section contains no specification. It describes a variety of things, and cites and summarizes a variety of things, but it provides no technical specification content. > This document assumes a threefold model for certificate enrollment > when using the TN Authorization List extension. I don't know what a 'threefold model' is. From the rest of the context, I suspect what is meant is something like: Certificates used as telephone identity credentials can follow any of three different certification models. But really, that's just a guess at what's meant. But I'm not clear what the benefit of this section's discussion is, since it neither specifies nor constrains anything. So, for example, there's nothing that prevents having a twofold model or a fourfold model... For that matter, the details of creating a workable cert system for this service border on being an open research task, which makes this section that much more marginal. There is a long history of problematic cert use. There is a storied history of problems with inter-provider phone-number-based query services. But the current effort needs a working service that does both. However there is /no/ history of a public phone-number-based query service at scale and with adequate privacy protection. And yet the current task requires solving at least two of these and maybe all three... > > The first enrollment model is one where the CA acts in concert with > national numbering authorities to issue credentials to those parties > to whom numbers are assigned. In the United States, for example, > telephone number blocks are assigned to Local Exchange Carriers > (LECs) by the North American Numbering Plan Administrator (NANPA), > who is in turn directed by the national regulator. LECs may also > receive numbers in smaller allocations, through number pooling, or > via an individual assignment through number portability. LECs assign > numbers to customers, who may be private individuals or organizations > - and organizations take responsibility for assigning numbers within > their own enterprise. This model requires top-down adoption of the > model from regulators through to carriers. > > The second enrollment model is a bottom-up approach where a CA > requires that an entity prove control by means of some sort of test, > which, as with certification authorities for web PKI, might either be > automated or a manual administrative process. As an example of an > automated process, an authority might send a text message to a > telephone number containing a URL (which might be dereferenced by the > > > > Peterson & Turner Expires January 9, 2017 [Page 6] > > Internet-Draft STIR Certs July 2016 > > > recipient) as a means of verifying that a user has control of > terminal corresponding to that number. Checks of this form are > frequently used in commercial systems today to validate telephone > numbers provided by users. This is comparable to existing enrollment > systems used by some certificate authorities for issuing S/MIME > credentials for email by verifying that the party applying for a > credential receives mail at the email address in question. > > The third enrollment model is delegation: that is, the holder of a > certificate (assigned by either of the two methods above) might > delegate some or all of their authority to another party. In some > cases, multiple levels of delegation could occur: a LEC, for example, > might delegate authority to a customer organization for a block of > 100 numbers used by an IP PBX, and the organization might in turn > delegate authority for a particular number to an individual employee. > This is analogous to delegation of organizational identities in > traditional hierarchical PKIs who use the name constraints extension > [RFC5280]; the root CA delegates names in sales to the sales > department CA, names in development to the development CA, etc. As > lengthy certificate delegation chains are brittle, however, and can > cause delays in the verification process, this document considers > optimizations to reduce the complexity of verification. > > Future versions of this specification may also discuss methods of > partial delegation, where certificate holders delegate only part of > their authority. For example, individual assignees may want to > delegate to a service authority for text messages associated with > their telephone number, but not for other functions. > > 5.1. Levels Of Assurance > > This specification supports different level of assurance (LOA). The Where and how does it support this? Where is it actually specified? > LOA indications, which are Object Identifiers (OIDs) included in the > certificate's certificate policies extension [RFC5280], allow CAs to > differentiate those enrolled from proof-of-possession versus > delegation. A Certification Policy and a Certification Practice > Statement [RFC3647] are produced as part of the normal PKI > bootstrapping process (i.e., the CP is written first and then the CAs > say how they conform to the CP in the CPS). OIDs are used to > reference the CP and if the CA wishes it can also include a reference > to the CPS with the certificate policies extension. CAs that wish to > express different LOAs MUST include the certificate policies > extension in issued certificates. See Section 11 for additional > information about the LOA registry. > > > > > > > > Peterson & Turner Expires January 9, 2017 [Page 7] > > Internet-Draft STIR Certs July 2016 > > > 5.2. Certificate Extension Scope and Structure > > This specification places no limits on the number of telephone > numbers that can be associated with any given certificate. Some > service providers may be assigned millions of numbers, and may wish > to have a single certificate that is capable of signing for any one > of those numbers. Others may wish to compartmentalize authority over > subsets of the numbers they control. I suspect that certificates don't do signing. I suspect what is meant is that the certificates can be applied to the signing of... or somesuch. > > Moreover, service providers may wish to have multiple certificates > with the same scope of authority. For example, a service provider > with several regional gateway systems may want each system to be > capable of signing for each of their numbers, but not want to have > each system share the same private key. > > The set of telephone numbers for which a particular certificate is > valid is expressed in the certificate through a certificate > extension; the certificate's extensibility mechanism is defined in > [RFC5280] but the TN Authorization List extension is specified in > this document. > > The subjects of certificates containing the TN Authorization List > extension are typically the administrative entities to whom numbers > are assigned or delegated. For example, a LEC might hold a > certificate for a range of telephone numbers. In some cases, the > organization or individual issued such a certificate may not want to > associate themselves with a certificate; for example, a private > individual with a certificate for a single telephone number might not > want to distribute that certificate publicly if every verifier > immediately knew their name. The certification authorities issuing > certificates with the TN Authorization List extensions may, in > accordance with their policies, obscure the identity of the subject, > though mechanisms for doing so are outside the scope of this > document. > > 6. Provisioning Private Keying Material > Another non-specification section. > In order for authentication services to sign calls via the procedures > described in [I-D.ietf-stir-rfc4474bis], they must hold a private key > corresponding to a certificate with authority over the calling > number. This specification does not require that any particular > entity in a SIP deployment architecture sign requests, only that it > be an entity with an appropriate private key; the authentication > service role may be instantiated by any entity in a SIP network. For > a certificate granting authority only over a particular number which > has been issued to an end user, for example, an end user device might > hold the private key and generate the signature. In the case of a > > > > > Peterson & Turner Expires January 9, 2017 [Page 8] > > Internet-Draft STIR Certs July 2016 > > > service provider with authority over large blocks of numbers, an > intermediary might hold the private key and sign calls. > > The specification recommends distribution of private keys through > PKCS#8 objects signed by a trusted entity, for example through the > CMS package specified in [RFC5958]. Why is this here? It is such a generic 'recommendation' and so detached from the rest of the private key management issues, that it serves no useful purpose. > > 7. Acquiring Credentials to Verify Signatures > > This specification documents multiple ways that a verifier can gain Where is this documented? > access to the credentials needed to verify a request. As the > validity of certificates does not depend on the method of their > acquisition, there is no need to standardize any single mechanism for Well, this is an interesting assertion to make, given that it is fundamentally wrong. Interoperability requires common conventions to be followed by both sides of an interaction, such as providing a credential and finding a credential. Absent at least one common mechanism for this, there can be no guarantee of interoperability. > this purpose. All entities that comply with > [I-D.ietf-stir-rfc4474bis] necessarily support SIP, and consequently > SIP itself can serve as a way to acquire certificates. On what basis is it acceptable for the supplier of a request to provide their own credential??? What other security services operate useful with such a model? > [I-D.ietf-stir-rfc4474bis] provides an "info" parameter of the Don't repeat the technical details written elsewhere. > Identity header which contains a URI where the credential used to > generate the Identity header, and requires documents which define > credential systems to list the URI schemes that may be present in the > "info" parameter. For implementations compliant with this > specification, three URI schemes are REQUIRED: the CID URI, the SIP > URI, and the HTTP URI. Why? > > The simplest way for a verifier to acquire the certificate needed to > verify a signature is for the certificate be conveyed in a SIP > request along with the signature itself. In SIP, for example, a > certificate could be carried in a multipart MIME body [RFC2046], and Since this isn't being specified in enough detail, and as a requirement, then it appears to expect the verifier to guess that the information might be in some MIME body-part, somewhere in the object??? Again: this is commentary about technical issues. It isn't an actual spec. > the URI in the Identity header "info" parameter could specify that > body with a CID URI [RFC2392]. However, in many environments this is > not feasible due to message size restrictions or lack of necessary > support for multipart MIME. > > More commonly, the Identity header "info" parameter in a SIP request "commonly"? for something that has no field experience and isn't even mandatory? > may contain a URI that the verifier dereferences with a network call. "network" call? > Implementations of this specification are required to support the use > of SIP for this function (via the SUBSCRIBE/NOTIFY mechanism), as > well as HTTP, via the Enrollment over Secure Transport mechanisms > described in RFC 7030 [RFC7030]. > > Note well that as an optimization, a verifier may have access to a > service, a cache or other local store that grants access to > certificates for a particular telephone number. However, there may > be multiple valid certificates that can sign a call setup request for > a telephone number, and as a consequence, there needs to be some > discriminator that the signer uses to identify their credentials. > The Identity header "info" parameter itself can serve as such a > > > > > Peterson & Turner Expires January 9, 2017 [Page 9] > > Internet-Draft STIR Certs July 2016 > > > discriminator, provided implementations use that parameter as a key > when accessing certificates from caches or other sources. > > 8. Verifying Certificate Scope with TN Authorization List I don't see an algorithm for "verifying certificate scope". For that matter, it's not entirely clear what this means, although I assume it equates to "discovering what the range of caller-ids covered by the cert is". > The subjects of certificates containing the TN Authorization List > extension are the administrative entities to whom numbers are > assigned or delegated. When a verifier is validating a caller's > identity, local policy always determines the circumstances under > which any particular subject may be trusted, but the purpose of the > TN Authorization List extension particular is to allow a verifier to > ascertain when the CA has designed that the subject has authority > over a particular telephone number or number range. "Local policy always determines the circumstances under which any particular subject may be trusted, " This is quite a profound statement, for a specification about an inter-organization certificate service. While of course there is always the option or even requirement that the verifier retain a final authority over whether to treat a validation as credible, this statement mostly means that there is nothing in the design of the certification service that ensures or even encourages that belief. Given that the cert system is the core of this entire service, that's sort of wild west model is problematic... > > The Telephony Number (TN) Authorization List certificate extension is > identified by the following object identifier: This sort of detail is usually provided either as an independent section about format, or during the specification of the /creation/ or /signing/ processes. Having it be an independent format section works better, IMO, because then all three (signing, packaging, verifying) can refer to it equally, as needed. The formal meta-syntax here needs to be introduced and cited. What is the meta-syntax language being used? Since apparently this is meant as an extension, where is the ruleset it plugs into? And all of the rules that aren't defined here need to be explicitly defined or a citation given for their important. > id-ce-TNAuthList OBJECT IDENTIFIER ::= { id-ce TBD } This rule appears to be unanchored to anything in this document and contains no pointer to any other. Same for the two rules contained in it (id-ce and TBD). > The TN Authorization List certificate extension has the following > syntax: > > TNAuthorizationList ::= SEQUENCE SIZE (1..MAX) OF TNAuthorization > > TNAuthorization ::= SEQUENCE SIZE (1..MAX) OF TNEntry > > TNEntry ::= CHOICE { > spid [0] ServiceProviderIdentifierList, > range [1] TelephoneNumberRange, > one E164Number } > > ServiceProviderIdentifierList ::= SEQUENCE SIZE (1..3) OF > OCTET STRING This rule appears to be unanchored to anything in this document and contains no point to any other. And note that the intro to this meta-syntax only said it would supply the "Telephony Number (TN) Authorization List certificate extension". > -- When all three are present: SPID, Alt SPID, and Last Alt SPID > > TelephoneNumberRange ::= SEQUENCE { > start E164Number, > count INTEGER } > > E164Number ::= IA5String (SIZE (1..15)) (FROM ("0123456789")) > > The TN Authorization List certificate extension indicates the > authorized phone numbers for the call setup signer. It indicates one > or more blocks of telephone number entries that have been authorized > for use by the call setup signer. There are three ways to identify > the block: > > > > > Peterson & Turner Expires January 9, 2017 [Page 10] > > Internet-Draft STIR Certs July 2016 > > > 1. A Service Provider Identifier (SPID) can be used to indirectly > name all of the telephone numbers associated with that service > provider, Where does this identifier come from? cite it. > > 2. Telephone numbers can be listed in a range, and What is the format of the numbers? cite it. > 3. A single telephone number can be listed. > > Note that because large-scale service providers may want to associate > many numbers, possibly millions of numbers, with a particular > certificate, optimizations are required for those cases to prevent > certificate size from becoming unmanageable. In these cases, the TN > Authorization List may be given by reference rather than by value, > through the presence of a separate certificate extension that permits > verifiers to either securely download the list of numbers associated > with a certificate, or to verify that a single number is under the > authority of this certificate. This optimization will be detailed in > future version of this specification. If you aren't going to specify it here, don't describe it. Make a reservation for the entry and don't say any more. Describing the future is almost always wrong. > > 9. Certificate Freshness and Revocation > > Regardless of which of the approaches in Section 3 is followed for > using certificates, some sort of certificate verification mechanism No. "some sort" isn't required. Rather, an explicit, specific and interoperable sort is required. > is required. However, the traditional problem of certificate > freshness gains a new wrinkle when using the TN Authorization List > extension, because verifiers must establish not only that a > certificate remains valid, but also that the certificate's scope > contains the telephone number that the verifier is validating. It isn't really a wrinkle. It's just one more component in the cert that needs to be covered by the validity management mechanisms. > Dynamic changes to number assignments can occur due to number > portability, for example. So even if a verifier has a valid cached > certificate for a telephone number (or a range containing the > number), the verifier must determine that the entity that signed is > still a proper authority for that number. This sounds more like a fundamental issue with caching behavior vs. 'freshness' enforcement. > > To verify the status of the certificate, the verifier needs to > acquire the certificate if necessary (via the methods described in > Section 7), and then would need to either: > > (a) Rely on short-lived certificates and not check the certificate's > status, or This option is not an 'either/or' choice. It is merely a choice of lifetime by the creator of the credential. If the cert is short-lived, the verifier-side problem presumably doesn't exist, as indeed later text here seems also to suggest. > > (b) Rely on status information from the authority What does 'rely on status information' mean? What status information? Where is this specified? How is interoperability ensured? > > The tradeoff between short lived certificates and using status > information is the former's burden is on the front end (i.e., > enrollment) and the latter's burden is on the back end (i.e., former = who? latter = who? > verification). Both impact call setup time, but it is assumed that > performing enrollment for each call is more of an impact that using What is meant by "performing enrollment for each call" and where is this specified? > > > Peterson & Turner Expires January 9, 2017 [Page 11] > > Internet-Draft STIR Certs July 2016 > > > status information. This document therefore recommends relying on > status information. Recommending between two unspecified mechanisms makes no sense. There isn't enough detail here to justify making a recommendation. > 9.1. Choosing a Verification Method This section appears to basically cite some technology (not service) specifications and then discuss their use. So we are back to not specifying the details of an interoperable credential service. > There are three common certificate verification mechanisms employed > by CAs: > > 1. Certificate Revocation Lists (CRLs) [RFC5280] > > 2. Online Certificate Status Protocol (OCSP) [RFC6960], and > > 3. Server-based Certificate Validation Protocol (SCVP) [RFC5055]. > > When relying on status information, the verifier needs to obtain the > status information - but before that can happen, the verifier needs > to know where to locate it. Placing the location of the status > information in the certificate makes the certificate larger, but it > eases the client workload. The CRL Distribution Point certificate > extension includes the location of the CRL and the Authority > Information Access certificate extension includes the location of > OCSP and/or SCVP servers; both of these extensions are defined in > [RFC5280]. In all cases, the status information location is provided > in the form of an URI. > > CRLs are an obviously attractive solution because they are supported > by every CA. CRLs have a reputation of being quite large (10s of > MBytes), because CAs maintain and issue one monolithic CRL with all > of their revoked certificates, but CRLs do support a variety of > mechanisms to scope the size of the CRLs based on revocation reasons > (e.g., key compromise vs CA compromise), user certificates only, and > CA certificates only as well as just operationally deciding to keep > the CRLs small. However, scoping the CRL introduces other issues > (i.e., does the RP have all of the CRL partitions). > > CAs in the STIR architecture will likely all create CRLs for audit > purposes, but it NOT RECOMMENDED that they be relying upon for status Again: making a recommendation in the absence of detail. This is actually counter-productive. > information. Instead, one of the two "online" options is preferred. > Between the two, OCSP is much more widely deployed and this document > therefore recommends the use of OCSP in high-volume environments > (HVE) for validating the freshness of certificates, based on > [RFC6960], incorporating some (but not all) of the optimizations of > [RFC5019]. CRLs MUST be signed with the same algorithm as the > certificate. > > > > > > > > Peterson & Turner Expires January 9, 2017 [Page 12] > > Internet-Draft STIR Certs July 2016 > > > 9.2. Using OCSP with TN Auth List > > Certificates compliant with this specification therefore SHOULD A normative requirement of this type, here, makes no sense, since there is no OCSP service that is specified. ... -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 12 09:44:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E80812D5D1 for ; Fri, 12 Aug 2016 09:44:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.122 X-Spam-Level: X-Spam-Status: No, score=-0.122 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kw0VHMO3Cjvh for ; Fri, 12 Aug 2016 09:44:12 -0700 (PDT) Received: from qproxy5-pub.mail.unifiedlayer.com (qproxy5-pub.mail.unifiedlayer.com [69.89.21.30]) by ietfa.amsl.com (Postfix) with SMTP id 60A7512D7DC for ; Fri, 12 Aug 2016 09:44:10 -0700 (PDT) Received: (qmail 29421 invoked by uid 0); 12 Aug 2016 16:44:07 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy5.mail.unifiedlayer.com with SMTP; 12 Aug 2016 16:44:07 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id WGf31t01E1MNPNq01Gf6Lv; Fri, 12 Aug 2016 10:39:07 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=S1OLuhrgiL725h1u3IAA:9 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=P7WYajy3bUMA:10 a=9SSbkt2r4EkA:10 a=k6FithMx-LAIfSMtYYIA:9 a=n3BslyFRqc0A:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:Message-ID:To:From:Subject:Date; bh=5cmUc25HEqa+75l5vXGCyhlypReIqPuMUbVW6KgqzAQ=; b=hH2tE6pkEChDPf61rY6CmJ/mET Adh0/oD8w3UiUqCXNaZ/6KxKH+RLlGCAjDUbh6/oiMN+ghU5GftEk7qFZWjq54VzIHW7g7vEo6N8m SeMKq0pIBvqvL3z67G1JcjTtZ; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:56472 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bYFU7-000218-PY for stir@ietf.org; Fri, 12 Aug 2016 10:39:04 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 12 Aug 2016 12:39:02 -0400 From: Richard Shockey To: IETF STIR Mail List Message-ID: <361C443C-5591-43A4-82D7-DFD99DA1BC2E@shockey.us> Thread-Topic: In case you didnt get the memo Mime-version: 1.0 Content-type: multipart/mixed; boundary="B_3553850343_1373758491" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bYFU7-000218-PY X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:56472 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: [stir] In case you didnt get the memo X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Aug 2016 16:44:13 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3553850343_1373758491 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 --B_3553850343_1373758491 Content-type: application/pdf; name="DA-16-917A1.pdf" Content-disposition: attachment; filename="DA-16-917A1.pdf" Content-transfer-encoding: base64 JVBERi0xLjMKJeLjz9MKMSAwIG9iago8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFI+Pgpl bmRvYmoKMiAwIG9iago8PC9JVFhUKDIuMS43KS9UeXBlL1BhZ2VzL0NvdW50IDIvS2lkc1sz IDAgUiA0IDAgUl0+PgplbmRvYmoKMyAwIG9iago8PC9QYXJlbnQgMiAwIFIvQ29udGVudHNb NSAwIFIgNiAwIFJdL1R5cGUvUGFnZS9SZXNvdXJjZXM8PC9YT2JqZWN0PDwvSW0xMCA3IDAg Uj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXS9Db2xvclNwYWNl PDwvQ1MzWy9QYXR0ZXJuL0RldmljZUNNWUtdL0NTMVsvUGF0dGVybi9EZXZpY2VHcmF5XS9D UzJbL1BhdHRlcm4vRGV2aWNlUkdCXT4+L0ZvbnQ8PC9GMTQgOCAwIFIvRjE1IDkgMCBSL0Y5 IDEwIDAgUi9GMTYgMTEgMCBSPj4+Pi9NZWRpYUJveFswIDAgNjEyIDc5Ml0vUm90YXRlIDA+ PgplbmRvYmoKNSAwIG9iago8PC9MZW5ndGggNjczL0ZpbHRlci9GbGF0ZURlY29kZT4+c3Ry ZWFtCnichVTbahwxDH0PzD/4uRBH8t1QCnuFNk+hC/2ApaEku1u2L/39SrbsmdlLw6CxPSPJ OkfHPg+ogJ763h8H0A6CAm1TpHcES++cg3q/++d5OA3L3fC0zcolpXavPWUGFSFrSGp3HB5B A3r6v1efAcCyfVG7t+6NGHRwkwgKoA1bgCPzZIEskiWyLIkWZEuy1eT7uiTf7IYzPaDq89xn 71R1CCrkpJ06DhZBJ1kd2orgHIpTmfwaXj8NL/ScKTRabcjdkZsB4Lof0eho1J+f6oc6jZQg anAzVmpocuzdeIkd5oZsC4AgI02QdkArUAkaEhXoxYgOJDqQYGMW34Wsnfxb3olN9V+x7t9o qzgNVRsb0qDNJc6Xj5FGo7Ejha4AXImta3VIyHFbdudsQecwS4ZAnzhd1BhaOtuJY9AGevh1 MSwvf1VO15dByUEEGiGbv5W143Em1grNJy5JchnsuZw0Ysk1CbnUCOOlOdKYvk+o+3CDysh0 UPNNrPQUW031jOob2RsdkUiE/q2C9KxUS306Dt5GRsnLwNr9Xtp5+xRY8uXQlHigWOfpEMjy 0Jb0trxs3m3dT0XXQbpk3mYoxcSs7chWV/yiKt2kUakmj6egkCekQCOykYii5Buqn5G4lbyS v+iO9GZWs6Z6jEzXWCi0hq7nfgbYYQ7Iju2XtvFo4izSWaMTsRlBj4d/pELg4WJy+KPMWZsb gQECl79t63eGVixNzAhVuVpZ+0qRhXlhAbUh6AH43LUejdf1qprFVsU8OmEhpEc34nBz4ed1 DBO/a25d4it4XseE2lWzeUMAyy11tf9l48Cxav+X3bKU1jdl8WF2kcWd7CyJkn3bL7pymk8P DpkVTlJnpA66ViJ4BrU/Pjx9PSKo9e+Hf8KjhwgKZW5kc3RyZWFtCmVuZG9iagoxMCAwIG9i ago8PC9EZXNjZW5kYW50Rm9udHNbMTIgMCBSXS9CYXNlRm9udC9DQ0hJV1crQXJpYWwsQm9s ZC9UeXBlL0ZvbnQvRW5jb2RpbmcvSWRlbnRpdHktSC9TdWJ0eXBlL1R5cGUwL05hbWUvRjkv VG9Vbmljb2RlIDEzIDAgUj4+CmVuZG9iago3IDAgb2JqCjw8L1R5cGUvWE9iamVjdC9TdWJ0 eXBlL0ltYWdlL0NvbG9yU3BhY2VbL0luZGV4ZWQvRGV2aWNlQ01ZSyAyNTU8Njg2M2I0ZmYw MDAwMDAwMDAxMDEwMTAwMzUyZjMzMTQ2NDVmNjM2ODU1NTI1Y2MxNmU2YTZmOGY0MjNiNDAy MjA0MDQwNDAwNTc1MDU0NDMxODE0MTYwMzA4MDcwODAwNmE2NzZlYWI1NTUxOTRmZTY4NjI2 NjczNWQ1ODViNTU0YjQ4ODNmZDYwNWQ2NWI2MmEyNDI2MGMxMDBlMTAwMjQ2M2Y0NDI4MjMx ZDFmMDgwMjAyMDMwMDMwMmU1MmZiMWIxNzE5MDUyMTFiMWQwODVmNWFhNWZmNGE0NDQ4MmU2 ZDY4NmQ4OTZjNjY2Yjg0MjcyNTQxZmEzZDM4M2MxZDE0MTExMzAyNjk2NDY3NzkxZTFiMmNm NTU4NTI1NjQ3MTIwZjExMDI2YjY1Njk3ZTQ0M2Q0MjI1MGYwYzBlMDIyZjJhMmQxMDJjMjYy OTBkNjY2MTY0NmQxNjEyMTQwMzZkNmE3MGEzM2QzYjZiZmMzMTJjMmYxMTJlMjgyYjBmMWQx ODFhMDYzYTM5NDZkYTI4MjIyNTBiNWY1YTVkNTk2MTViNWY1ZTM4MzIzNjE4MjUxZjIxMDkz NjMxMzUxNjRlNDc0YzM0MGIwYTBiMDE1MjRjNTAzYzNjMzYzYTFjMDkwODBhMDAyMzIyMzFl ZTBkMGIwZDAxNWE1NDU4NGM2ZTZiNzE5YjVjNTY1YTUwMjIyMDM3ZjcyZDJjM2FlNTNhMzQz ODFhNGI0ODU0Y2I0MzQxNGRkMjUwNGE0ZTM4MWYxYTFjMDcxZjFkMmRmMjE5MTUxNzA0NjM1 ZDYxNjMwNjA1MDYwMDRjNDU0OTMxMzMyZDMxMTM0ODQxNDUyYjU1NGU1MjNmNzA2YjcxOTUy NzIxMjMwYTNmM2EzZTIwMjcyNjM1ZWEzNDMzNDBlMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA+XS9OYW1lL0ltMTAv V2lkdGggMTg2L0JpdHNQZXJDb21wb25lbnQgOC9MZW5ndGggNDc2Ny9IZWlnaHQgMTg2L0Zp bHRlclsvRmxhdGVEZWNvZGUvUnVuTGVuZ3RoRGVjb2RlXT4+c3RyZWFtCnicVVnpU2PZdT/n Pj3pSeIhCSEJnoSQBEISaGMHbQiEhARqVun/SVccf0hVKk4lccr5kHzKUkmV49TYM44nFXu8 lJdZPLbH9tge9/T0dPf09D4NNM1a+V0QTfsD8N67v3PuuWc/l+v8Y77e+fk6m4ViUs0W7ZDZ avlPfp1Zs52wZu/Sux3dTpd2zEoPkfuETfbuXo/3dYmw+k5YmHx9Zyz6DT8QgYHgIIhC4QiR a0gZ/g7/L3N05JSFQiGgYob/hDmeABcb9YwOHLJ5zEgmjZR4UyIHkkCOURrIDGX3WXWM86BT O2K1nyaYbWfMk1Pf5R+wmDbPADprxAAVzrkzuYH7OZvnnYPspsQRixHDDuFE8Byv5EjPA1Qw Bk+ZXQPnG/QdM9u1Mzb7aTCbLU4eMXePH7PwUOK7/FPmUuiUrVky04KXOVAG4WIEhG7CES1p ckNDS8VT4qAAo+IkKHNO7ZTV+Zzqytl+KllUBk7YWlycdpYLPGgUQL1MJfyuVsUpWxaDgjlv hM4/eyBtiZbBqjZwylo2mDI5XLQi3gYfYaEsZLEWRb1RXMUhQFGniTPWMrTWZJ7Vr0E141Go RHPmwChOfSfnkp6xUohUhoFf16+9zT9njkFE4W1gD6uHPFzqSqWTUh+asXHKXb1GUI2QA3L1 0AxMNVADn82UwO9BcgNmNSRna0p7h9/HDrrl5Fy6M7aJopXZO0k1eU6udcPGoRGHxbbPImvB plzeOpYM5V7BNWhrm+rvQCIx0PBKwSMDUsPFU1Z2dJoFi3TiNnMOypaHOpP4BKgmqP+Eqf+X krJOF9tLB/RIFYmZxeyHLBLkOfeIYeD9NI/vO5T/Ff+GRdNRP3m5Y3BRes9S7heQcFJcOJ30 mRZsrbhTlJMkSjdVmqdyrx3oI1yFkNcsb7Owp4aAHaEMsOZi+wK7E0yt4WtA8udy8oesWWhO Y9getjEt00QLB2Fv/EOATW7K0Sw499HmmTzFzg/YogRTaoOi8Eo1Fpziojz3pu7+Hf+BqQmN 1jZGU2OnbLZSwFGlhbfY1EwPWWEpW7RRAJy5bvg/5D+yIlZS03DGjaS95YI0Jn/EGZh4g+0K ZeCtG+ytVYUE6oWioY/amVeNWF3f/C8W88FRbA/InN73W/6IdY8x1W71M7cG2U8934A2gzCx qbixqs+dsDKWT2sfQ0D9mu6ZMvycG2CxtdT8BkvNm4p+tYb91Wmj5St6bvInTIUT7hLJdjPt 21o3ClyK/wcrxaJRR0jYU2H2Wp19n/AtFmlnBsnEDT24y0uG8m8sirQJ9Q4TAp4HtiRIqRl6 GvGYoXXYWp8FyFrxnrF1jFltI3B7DQkzrafKEqcu+IaZC//CBBXb6kadZ8iP6G5LkCpqm92G AoNq4y7vP7NtoYFAWNRtPL3+CQRX46mSyYBW2bbzT0hFbZlRfFs3+DNmD7xSVa1iipa/Bsmp H2vdJD7me2yqp6gMhzT3OEvsoPzX2BxtzHBzfPwGVh3DxZSZyjPMXUPMjpr4RzZra1SJOLcl Y91dHJ8wYX1bjyFd/QMr9ZWV0B/5LlvdrXZpbMpIFh3X+SHfYS3Wbsd42GGMy/fbbCmNt5Ck hmPy9SEOlc1qMFdpvDh8nT/nR2y+liJyOko48HzVJa7zfX7MmlVfqfcs6kEkWC6EJPKJjK4e oMZqTs91cH4C7YeR7ucrbVDdke9LI0cyfvo7r40hvNpJuXgVpuD8sbRbZ1kJOV0FmUYqAqa3 Z7PrZ3llOZt1/xgCWBPOxiz0PkKJr6NMWCZV33NSDbXbPyNuMoeyTyG6pa9KyFTGIJJ2bOG3 KpXusNKcDS89JEXf6o3dZUtzo0GUsmq7/IBNiUVHzgas1vgNitg9hEcm7LxDojxov89avUiB nfU5X3SXd1HK8spTpsyvAbyPLLHTuknCZy09guqd7T4ZsPr0Hu+zyTtKNADoiIQ+BNQf/IiE PunGiautArLdZFUClaHUukwvwlrYZ9qQ6EfM68UPSTj92jMWNlIg26yxx89RBIxlGVQp1fu8 A4Y+x8ofEFcykK6HhoGdc55jl32oPaJu7FxCnyLXOH9BvKjtS31vY3XMuSax7G+jtJu7L5HP 4E3d7xGPjwG5lfTKNBu2n3NVjJCsheFL6C4cvvUOsTP9nFWbzzXbM/sEOKUZ7EJOEt7IxiVy D4EQ/CkR5FH7XEQR+1N5/oxeiaMSeSdThUvkPnPG+RlR9VQl+XcTH2K2x7zHmmecGqa1iJ65 VBaEV4yHZGqtLWcLR9B7VrFWHxA5PuFnrGZMqmrq2+tgD8BXf0xi3A9diMLy1iOi3C4Sy45Z p3GL9wV/DOQuNr7toMILyOt8QjyahaVjQ6knRIP7bI0HadzhiFJYHF7Cc39gdi89JRS1u+C7 on9BbMQPcDbqqsvCo+evsB/B0aoA1GZuwWGjePINH8LnKl1eOMXK+KtImsRyzvsx7J96Ruzy Hkl/mMHvfpo/egn8IzwSy0s9u2y19eTz/nw+nRXQ91j1GbQHeJbcR7JMha6IbiCCI7vErRCs FesNpA5IJHNZ6LMZAFU/vMNuTIBqxel9lYqmQFQtQZfp5FMSlZ0mFOVdw2IZjhEIgG7dGLo6 BYTvM/ZwXjtw8fZDEsERaJqiWOw5lnl21MaF+BaVtVeJKAmaRgxuORy4R9yewVOztgfbYJeM 75REZOTKYLmbTAkQpFYBi/vukjDmBIChJVCswy0K6/78zP6rcPCn2UOmuVvEAbSRtL2nkunz lxDUohlA1gBx3ITu5z94dal7H70d/I2GbmBNuwGHz86unryEwLbz+j48BpDej4iid9B/ZvNz U6rvjGShugLSCHhVZZ/oMXahnejKWV5srBVhhN7PGP0LWWoBR34zQnN/QpYE+zSoCkUcvLvn BXLPUAqs9Po9hOsMOkdTTxeZVo9fEn2KvtV4jlyBzWgR0OQqnKQwdb7/HcBdxtTY4StwODzi 9VjW/+dEfiSQRBAP+c/YFFd1x/DBq1gTOBtIbGQ6wMP6Y1BF8FQUnyPJUXJ4H/ErSmnvkyuS IpjBYdhtHBApD9Gg6HiY/Zy1dJWoPbqRiB1Jqh6a71Bt3GaKQag89pkDduE+U/zAQct3Weub Hir7aMmcPgUNT+uPr0jiIBkDSeUFTq99j9XVxGaDRs+BG5FXgHOQKALgKniv/4hNwuIot+Bs 7a3ec/CQ2gGHb+dJBTgK8OALecwfsjlYHVjMT9gO+YztBdXlcIzkE9kxU0DSIPNtSuW8IFr5 JgCmkqNL9R0TTXVW5ZGqWO3/Jr9gtZSdQRR3lhAnlDqEacU3zzWOTxgJSAO6/X102llt//I7 OnCkLqLk92FicK+cqYQWH3m80BvvsIOfUuwCo7iz2Z7TvBIl2cEfoB9ZQ4PdwaEdJjtwrv9D vzAd9lHyWvOMj9CDLLsosoJCdQ5DISHjkCj4Flu2V6oUWUvDDU7YHNoMGlFn/MEFbB2wFrjF fsCmsr7l7zuAFrRCgFr+EjeUDgqTIgWAUoCa80VyY+eoMWrFMcu08g8utN+6rRIqP2FUoBzQ A99nc3O6TF15+5HEe6cHDH0gX7F08ApMuwC8C/gErGWE4APDcw2naeKEj1EBZqM61UbOT9SB L0t3RgljzYkNTD9kzB15s5LNbowTRlGYqLkedl5Yr0NS378wVTecZxuOWYJjXrvH5AOD2qm0 QTN+7QrPwgmRrCDIIE4i8/B/rwukQ2DlPs3yBMaHTnwpCJYyBGpg2GLRBrxqf9SJNAwAKMIF 8eQKugJBZo4vzlAtIWy9JqmsD2W97fe3sq9APYCaEIKiCuxSApXfJp9SsXsIy9gulGN153vd cQzt5bErOhZLUj8YosiD9DOAuiFiCzLjbXzGllHyuRw7E8je6NETTiJfo5ouXCr31nnyoQWk xs1dUtQND2YAZXVwQJYJlxfJZSxvDbTOSAEXLMGTqqrbO0SeB1ccPDLThY6lylCj28ZTWUfR hmvZZeuAeiKJlnqhFqPnkghZu41tB2RX2ELW1rd/DRS7VjAvqBuvoEaQ9uOyeESQ9430BxI1 GUaPPjnKWv+g5+lLKDeDsg64JbiFOuJMfMrKtGMSrRzGjsEi22e6U+2z89R5QYPCM4dTJmVx KiVvw6J1FJjZvTyhA9UmadwMh8vapeJQrqEDU3XK4mk+eUnOhSDEW0SZEyt3ofjC4QXHVOl8 al5HYqkHyblzBA6q5lrMZ8X9DnHHlzZQh/u67iNlpVGG4/iyAmEmt3DAZquxvmLYXlYMkLC3 godBlPt4F1qn4o4G8roTOwYRalz1gyxnZPHUe8xfMC+sfNGhRavQgxp2DZ7RP4Q6rDi7MwJ8 Ek6s9h6yWd1Eh6IPQf3lc1qRa4hnHWK0NJNoaRa9+6zbLI6kCieqqlNo89ELLqNO8jjaBbs1 2G+rBAsots6JY7SdlvlJTNSrtH3Fh5st2ToNo99pruFJt71Ach4nMjLcHN6StRAZLbEDvfsU yFKdvKRFp9avg8I3C7X3t784b12t3ni+j7lGwfqRJBwJYsMpeUnSG8Q4cUGJgXwZDtnVhyAv rT1FtUDXn07DrEfcFTPizBOYbVH24pcUv0dMwI9NWdTumDX1VDYVtxkn3OqGpSODmJ+C3Vdg FmEYY2u9+QjFcU0H5fg8+s2+IcfIF5Jq2Ymhfai2GKSG/5Lqd7AlOl4l1b0c2sOol16MPJIt FpJ+Qm+oQ5LQWnBOr640aGnRc2nGD6GYwH1SIkmH5TgvHIGKdJ3QgWzxpzBMK33XFEwjLzC4 6pQaTbzMQ7+VbeFP0PiVnstbAVQONaMjBWsHACvpgfXmww7y10zWnxGX7bBt9ygcqs/pCo0F 8y/bC+UD1HPnu8QL3j22R8Owd6uNE44uHMBv1MKIWQ2k9zvYX8Grau/DPzPP2GzR84lKSl4O JnsPMBFYRlLU5SiT9XkH/Uscb+GXxFtuMPKGMfMmYMuEgQPusrJG0TG8zlLioIN/H8Hj+g30 pjxCMsjHeH5z0Qlue/JOaQ4xaKqJFx3se5A68ntMfbkmtNk8RNeUWpoTEswDKlrrkD57iX0X Pdtg5QamyU30OmLR1f9AwpKLRxiC1Yr3sIP7GYbD5C303SMoAKZ4hcKhRxK4uCXjvTdoOJqX 0J/AlfzVe+iUrfXPcbgRn261PwHY1kdwYZFHBzR2ea4fsTI8u9Z6SspSeAR+qxYWjaDF+wW0 YAkHeL1C5r5LDb/FKnrZnMN8oqpdjoX8NoLLFApTJf4McNVmjFOXvLIU4TjqQ2k3S4W/g8kw fCgz1UZzF3YQU7XMIYvJoPs6mz0q0VLODmzoGdbILp2rnRR/zlrGCOTzYWrUH2JS51LPmZyw V76Ek6VyKBr1irP+CCvCkpJ22jG2/4LFZhtVUplvVbyPGdVWXnAGqvBUES0WvszcBZWKCUo8 5ies7wRLkCyywNwT8XmwqnYjtaZ65WJXs70lmLeNzCYl3WC84IwdyyvlZckXciD3mYaQPsWX MEGlzm8tZvXSY3kFsWN4MLM1tq+fD7jb8k7Wt/KIH7IaKJpoYP7L+JCcP2VtpkU1x4AxKuSi Mh/RLWAWWnLJy2Jt0Kyapx/Ik3v6ZFOKn+ZXcGrfgPcW38YpjHWMl+kl21eQ+3XTLf6UtZyR liNxQPsqsowUSZGt9mfM10qILKsenzai3q+yHYK7Via8zIOy8b3HSqE1Pi8PpFPU+/fcteoL ThVJN29kc6TcAQOru1ibZ85Tt/dvuWtb7xbDO+gJlww9c5fvsmW4US0Mkkn8DYu4sXjKpn7/ Vst2l++wGmq0sPDX8p7YfwOCK2ORKfFXLK7R4MeQmdx/CY83Mjf5Os6qiLC845M3TuzN33z5 b4jLn3eB/2+m+Xf5PRjB5X0NrW1NvMc/Z7U/Su2twhusbqtFGrH/nBGt7jLq7+y30CydEUfF +6BSanDib7GySdT9nnzvUjLLeF9Yn1yU71TA1hYPuowxdG/u9/gNFl5n76cs1qj3W/KtTh4o 3r6UwWjZjOdnY5ihy2HD87pcHJE3/fAwmMs8E3SqS8YKcmxFmWrMv4F1DnfBKnNBOKkmIlOa VGkC7aQzbm8FxLclYgkDIm8Fzq/FJk5BMYJyOU917jf83+Zvy8/oDYVIyf+riEayf48tq+Tm bJex/T9yPYMGUk79M6hQ9QoFozuYvrUERZf0QC1S+o7EKGQHZsOJgq5uryQp0of8v+yUPuEO lsWbEtMnL9uFGI8ip8hDDY+XER5zlRN5jbnyJmS1mPShibrJ6EdQ+ZcEhO2NADKZRGtW197k 11nNu4ga6UPWVimHeGq6wgAEwq/xa0xIhhaLEQlHgy03viaGX+N/RWe+4XDMav/+J2b/s/8H w0xURwplbmRzdHJlYW0KZW5kb2JqCjYgMCBvYmoKPDwvTGVuZ3RoIDI3MDcvRmlsdGVyL0Zs YXRlRGVjb2RlPj5zdHJlYW0KeJzNWsuu47gR/YL7D14HGIUvURQwCGD5sclqgPsHQWaRwWSR /1+ERVUVq0hKtruzCBq6dlsUWY9Tb/329e+v7fvrr08bLtZdLt+/f9mLyf/sJaR5iuESzTy5 dPn+8+sXMxnr85p/XH41xoR8zfny+Yr5Wv52+f4XPz3bZVqdeNrQc0mvc3ZKSayDJStueVVL Q16zxsu82imMCNrydcvXHT8f+Xru323+sPDH6x3nNFm5I2xoecPMnXX58vsnbGZD5djC/bj/ v3xfhpJY4mTSZY4e+NzPMIbOsClf636Vfa752vD7bf9u7/vv5TdY/9iZVb9n2oBEuMoeeY3L DDuH97f92fId74EGnRf75DUuKNp9cFOGhSB+rEUfzph0806YIeFtO0EuImHrLmyHl2mIKgQv uAcJYcN7K/xeiMkgni/WTiYoHC+Zfr+CngkyHYSL0oApxN5VoGlFRPmKKJBdQZZGk53D5OVh JCxr9broptjStDAiHB7qEXlhJ6h8RiSMEBcrcYC+IpgZBUpEbztzjJQNEXLDzzsi/YH3DZrM E6+A9CRUwIx7JiGgOH62rIl4yfUeEYhoprOLEm6az5b+guiEdPM6bXFZCS5Oc+ydRKHsWqGl VO7308lmupPpfsBPUyW3c6DVnMyUwiElbq5WXGQbtY6KHO/Volmfc5UhUV90KfBRntNeyKUV yKjUEDidtmS3ejAgsU65q0cFTyGAAIQEOCJsa9yDgWDQiCKxHS4CVsQWQsqNIEW2LykheyXH me+5a3WGRWFrq/AONtZDiEEKHetKEAGbsHMidJANJDpUIyHYycdm8+yriP2Iuz9QiwfWJVmU VBCbZe0mPMJNuNArciHuE5JIhGxZj/qMpb3QCxSrnetZUgUEhEP7AD6eePY79hTHdPK5BMYn PncXVtTZdqdqYycXev97RoWMuK13KBQGxEjQ0iNN8lrSeGhsvPFAhDtCAe0v9+6w+UCJEfdb 5YERQ+clYSSEgrAH28PYYWQArL8zgsnYin9v0q15Cq3g2ciUG54Fc8rFajMws4C1CjCtukNK kM326hbsKvYonJFvwpBDYOMwRqyTOEIVmQIpqetWKDPTktaLmebsa4HGP7pf/l5dsnNTz4FX 3hM9IgDAAaAe+1XkeTM1dY1I/bPeAwCU9U8E47YD0D6R0mBipsunJf9djM9/1+zG/ji8Uyn3 bhlQzo4PxMXO6DSUGU5cCxTnJn0heD8rR0exoZjWTehyFOgPQ3ORyOM7F029AllNyxRyMWXm S+Y2lxX/+efX7385EWMpwCRSlxmCJUkrcOwdJQVt5LvuenSrkABFzFSdTnEmD2HoJFGSzNXU xO1DR1TChBH3RAijpI8k/nbYGIQBjvLk9G6aH3Z+jRNya86+q5AP8qDgPVQ0jTK4dHhJtPTy Z3H92VTNAcDTU7d72s6pzWaKPVKKD2qkzN9FbuXtTlgJVw9TU3y4h3ZCRHdpaBsaTPWDr1J/ 1s4qEClQoxKeNjd8qxzAXA/R3EcHM0z0pWxeFQqj8oXCPu9PIX81jaV2ivRpkBe2rK4H6hKh x8oAuhqlvvK5VnGy6u7jPIqN1lW8k8t8JzSOQ6EuDHJFsETJvlMWdjcfgUu6I09BhRQwTg1C Lk2Ckn+1cVOdZJF5IIemd1hyVcMqZIO960XJQVklz0myz6QcG6YVPmB60cPFQSLVZVClwYVN K06w5eaNg3ICCAUYbTmj+h9NcbtCLaMJ4ZzKmlrKH9jKCEDavnVZmj0iyE+e59b3a2mNOjtP gnbYapGwYz/07ARvDESFzuP6WCHOye+oaBBxto3LZq0aass3lpKMh9Kbtd74xHu5O3XL4qBb ZrNU/RLgZ4nmQM+E0TM5ZNVnQDKGnZhL1Re7vhCz+bGMo/5EtzV489CI1KdUU3W3HfUOnQbl szK/KG7yud8DkZUssfaED7qHbi49i+ZglZQR6sjEShJCnut/0MHjsHIViuxaGbUnIKtB2T7l uCDPT7vQyrkJAYiC89SS7X2QDcvFRwvtThJJPHJnXV6I6RDbQFv3bfV7qWcEWw6dP4ca0Qrg KkGw5ZcztrRTyMWpE0wx9J8vzcXL2cVrS/FqoBJHlgKZWVGjPcOmzUEl76Q3VNHg3YzM+xfZ DvkbSgEIsk3F7JNRFZrHlIX8oGorCej7K14SmkvlPYKTUMMpb0BP0FgUGNSzoOVMdjkSQ0+u UcbSRhQOk6ES+97YoJlyzVAK1tNqmjC2rVxLjprGMIHg7gRiG2RWrqbpuMKUoW70Pp7dWhKa d/Fclw8dPwjstZu1i4dpSN2rGYr8nwwt/E3jW2EZoeCk637V4jztNpiDmr+Di8vRcZSVkFW3 LUkZdJxR2QOnz1i5Owo6TbPXW23VwyKD24/a05olU8s0fwDMecHx4nvA5OU6OyUKKQ69Ac5S pTT7WQnOUQn60azpk0nODHOlSs3RJCen6Nk3aqpFeGhGOZ9BVSs0GvDPjXxqO+KT6VYzAfyx zvRLIHkLrbqPElzxTBajQlMR1x2zE5oRv4es1YAp8Na/6L0Vk1q51sAj+kmRSxy1CrAtpfp7 b3RGBhR443N8aQioDvtn2ycC/+xwnxoPzNhVPMdx++M2ewgLlBiaI1dFautVyghn+I2LUTtd U/fTrXTIIFIYIfd51pRmpgzE1SXBwx+0pc9syOQi+gNnzMvfr9yK0s3ei3TkrcNuYw473Vja H1Vvu7iaw+tcl8L0oAH4Iw3Ed8pv9vaijD9uFPZ7n5p220ki67mKMynVGKVEirYuzYCUch31 m6m9tuljOftP9bdCmixsQ32OPZMk7UBsxLp8J4D3p8qfxLdV8XLWJvvMB10aJ8R2NE9SIVJ2 fnBKUtyEIzXpnmCMueJshBpl1FRTfTo4VXx1xNC4b6C7ZMZTV4KXeIujbEOBVoyppY5K4Kbf Uf4UnFXFbppo0/XU7DwPWyvOCzTIbuRcwS81xs5Y5vLUazvJ/+VEkKknZ77qc4bzK+pjxEob 9+pEj+8V4hzxSs8O+OR3bITBttbG52xGDek5ozdG9WBU6JR9x4hrqS4R44TjObsNTlbknBCc ucsf0p5HvBFmD5IKHgtI+z17oYQqSkrCRVLKti3nyUbQtFVeuHnQ0Fgk6Sq96vWRhk6WgUQK +sRujj2SkdQ+yVnPsqXm3FoTHxEjCwNqcXIwnVTr5St2wlucYpM0QR6d0ry76VuWTVCWuauy EcnxTTwrSjIutULV/Etam/n1YdoqkMxTFRmZDiIfaZA9aNAa53buGe8tMl1DK8um03w20z43 mnXQlIazq0vHGBsgP8WtDkpSa1N5N6KeV4sdBnGqom0Gpp9k83Z2U8ld+ShXc06RukPnrHTR QPOPs7T+p1N45xZIwqW0o3SP6kWK0UtPg3H72QsZHl2Ob1+LwUDAWYRwXez+vEhd5IiOXh2g M2V9Ri5OzhhopqF7GGEN0Co4R0tYS4sWF/266wg6w0HnUbMtCURdh/sclESMjFxQZfTnIvbH 3tOxJkyDURS3ZGn04Pcix1FuJl6mAGF10x8tqcxvPenIrGYPDPCyY1HlQwrvYmW71+LhXS3F nAmKuSsyt1Tm+P2zBZniovS3r/8CCRMAuwplbmRzdHJlYW0KZW5kb2JqCjggMCBvYmoKPDwv RGVzY2VuZGFudEZvbnRzWzE0IDAgUl0vQmFzZUZvbnQvQ0NISVdXK1RpbWVzTmV3Um9tYW4s Qm9sZC9UeXBlL0ZvbnQvRW5jb2RpbmcvSWRlbnRpdHktSC9TdWJ0eXBlL1R5cGUwL05hbWUv RjE0L1RvVW5pY29kZSAxNSAwIFI+PgplbmRvYmoKOSAwIG9iago8PC9EZXNjZW5kYW50Rm9u dHNbMTYgMCBSXS9CYXNlRm9udC9DQ0hJV1crVGltZXNOZXdSb21hbi9UeXBlL0ZvbnQvRW5j b2RpbmcvSWRlbnRpdHktSC9TdWJ0eXBlL1R5cGUwL05hbWUvRjE1L1RvVW5pY29kZSAxNyAw IFI+PgplbmRvYmoKMTEgMCBvYmoKPDwvRGVzY2VuZGFudEZvbnRzWzE4IDAgUl0vQmFzZUZv bnQvQ0NISVdXK1N5bWJvbC9UeXBlL0ZvbnQvRW5jb2RpbmcvSWRlbnRpdHktSC9TdWJ0eXBl L1R5cGUwL05hbWUvRjE2L1RvVW5pY29kZSAxOSAwIFI+PgplbmRvYmoKNCAwIG9iago8PC9Q YXJlbnQgMiAwIFIvQ29udGVudHNbMjAgMCBSXS9UeXBlL1BhZ2UvUmVzb3VyY2VzPDwvUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldL0NvbG9yU3BhY2U8PC9DUzNb L1BhdHRlcm4vRGV2aWNlQ01ZS10vQ1MxWy9QYXR0ZXJuL0RldmljZUdyYXldL0NTMlsvUGF0 dGVybi9EZXZpY2VSR0JdPj4vRm9udDw8L0YxNCA4IDAgUi9GMTUgOSAwIFI+Pj4+L01lZGlh Qm94WzAgMCA2MTIgNzkyXS9Sb3RhdGUgMD4+CmVuZG9iagoyMCAwIG9iago8PC9MZW5ndGgg NDY0L0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFtCniclVTNTsMwDH6CvkPOSATbcfMjIaRt tBdOSH0DBAcQSPD+B5zE7ZKxTUKTO6WxP3+f7fp7QAPyq8+XzwEsgzdgXQzyDODkmZI3Hxdv noavYb8MdzOyQbTAxixvG2wgE5yzzGb5HG7BAnm5fzH3ABjF9gCQzdUzuXrGndhBztDcT3LG Pg5n+R/Vf6rvs0/xT8dzvi9+SX3xwSzvmfR4hrQEW3/CGzferHj4KMaC68VCxc95na/v8z1o Plh1Piq3rOtQ72H1n4+42afgpVqHgjvXGNo1fukYV7D2qnPSPGJE1Qpe1LjM2ZUatJ0iaSxt isOquFW0VZIbNU3HNmYtC1VbmM4amyqb0uFRmce+Kudii49Xa/0vVA2DTkzo1DpMthUMKpVi 70ZkfWz8cjWyQsnC0Lu6ZJ3vXU/RmGzkNqsVHe334PbKOKmawzoPBUjiYpLvbpSBzZAff948 HZOFZEd/0lPYesp0ZYqlzsSXp9hNOlWg/ct92a3TqUz/v0dW5hyjRX+mOTAX7GmRlfO3FKtg 6exIBiHKNyyaOZqf1+Ht5gqlssDW7JTQ+DRa7nt4Yb9R4pxhC8gbDrsNl2uXrm4bDJZaiH4U Re3z8At99x4bCmVuZHN0cmVhbQplbmRvYmoKMTIgMCBvYmoKPDwvQmFzZUZvbnQvQ0NISVdX K0FyaWFsLEJvbGQvQ0lEU3lzdGVtSW5mbzw8L09yZGVyaW5nKElkZW50aXR5KS9SZWdpc3Ry eShBZG9iZSkvU3VwcGxlbWVudCAwPj4vV1swWzc1MCAwIDI3OCAyNzggNjY3IDcyMiA3MjIg NjExIDI3OCA3MjIgNzIyIDc3OCA2MTEgNjY3IDYxMSA1NTYgNjExIDM4OSA1NTYgMjc4IDYx MSA4ODkgNjExIDYxMSAyNzggNTU2IDMzMyA1NTYgNTU2IDU1NiA1NTYgNTU2IDYxMSA2Njcg Mjc4IDI3OCA5NDQgNjExIDcyMiA1NTYgNzc4IDgzMyAzMzMgMjc4IDU1NiAzMzMgMzMzIDYx MSA1NTYgNjY3IDU1Nl1dL1R5cGUvRm9udC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9Gb250RGVz Y3JpcHRvciAyMSAwIFIvRFcgNDc5L0NJRFRvR0lETWFwL0lkZW50aXR5Pj4KZW5kb2JqCjEz IDAgb2JqCjw8L0xlbmd0aCA0NTIvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0KeJxdlNFu mzAUQL+Af/Bj91CBbWJaqaqUkkbKQ7dp2bRnAk6KtAByyEP+fo7PXaoOKUGHe+17fLHJ681q M/Szyr+Hsd36We37oQv+NJ5D69XOH/oh00Z1fTsLpf/22ExZHgdvL6fZHzfDflSWrO48SWb+ I95Oc7iou2U37vwX1fl9ln8LnQ/9cFB3v+qtPNuep+mPP/phVkV64oeOSP3WTF+bo1d5muN+ 08Wkfr7cx8EfGT8vk1cG/v02dl6m0ai08clpalofmuHgs6ciXs/qaR2v52up/+KlZdhu3743 4Zaebon0JzKfyCYyQmWihdACWkAuUWmgCqqhB+gReoQsVDNLCa0TOebUeDpiGs+KChpPpyE8 HfU0nm4N4elWEJ6VVMDTvUJ4Ojw1ng5PvWScuLxAxIx4PkB4LiSGp6GCkX7iaaSfFSSeQtJP 6hk8LZ03eFaSKf1kfQZP5yA8DZ0w9NqK54qYjHsltoR4DxX1LOurmNPK+uiSZX3Wpq0ne6z8 t+M+dihaBT4l3SgwKChdyitBUhOz0m9SNFrRgGJMf93y1xN8O1ztOYR4rtIBTgcqi6enH/zt SzCNUzqT8Zf9BdOwCSQKZW5kc3RyZWFtCmVuZG9iagoyMSAwIG9iago8PC9NaXNzaW5nV2lk dGggNDc5L1R5cGUvRm9udERlc2NyaXB0b3IvU3RlbVYgMTIwL0Rlc2NlbnQgMjEyL0xlYWRp bmcgMTA4OC9TdGVtSCAwL0F2Z1dpZHRoIDQ3OS9Gb250QkJveFstNjI4IC0zNzYgMjAwMCAx MDE4XS9DYXBIZWlnaHQgNTAwL01heFdpZHRoIDI2MjgvRm9udEZpbGUyIDIyIDAgUi9GbGFn cyAzMi9YSGVpZ2h0IDI1MC9Gb250TmFtZS9DQ0hJV1crQXJpYWwsQm9sZC9Bc2NlbnQgOTA1 L0l0YWxpY0FuZ2xlIDA+PgplbmRvYmoKMjIgMCBvYmoKPDwvTGVuZ3RoMSAyMyAwIFIvTGVu Z3RoIDE3MDIzL0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFtCnicrbwJfJTV1Th873322fc1 k5nJJDNJJhvJhBCI5AkkEYiYsJpBIwkQIAohYdcqxA0QVLAqoGKJVgHBypCwJCw1LnWptVJX tLXmbbGolVfevhQ3MvM/95kJwlv7/r7/930zOffc7dz13HPOXSYII4S0SPksbG2Zl/ShPwGM XAgRySC2gJO5aMnc4fAocE4ublndkQwTERzf3JXLfalwNkLCrI6lral06W6EjO8sWHTL/GTY 3YhQWebCxctXJ8NTbwPnd/M7FixOhqdNQIj7cO7ilhR9FMrFOzqWLFueDM86DuFn66cVFifD NywEZ2Z7y+LWVHgAnPcQ7Rtn+Vk4evih2fqKf4qSqKQ+9dcKD8VvTKqp//77i0MGJGZCXgkA J7sHrR8bvxaNN6Dvv//+VgNKxf/4KUnhRVcCroC+pyHEQH+ZQYRYaBf3FJTWjZC4B8ZhLMBF hFTbEdI8DQP/MEI6GAPDOoB/wBj9BSHzVoQsaxCyAq1NhZC9FiEHjJv7OYTSXkUoHcY+/SgM dzNCfoAA9DUQh+lpRygYQyj7PoRyViKUeytCeVBWwZcIFQIUyQiN+DNCxXkAUF/JnQhFPkCo 9Hd0LpQelqB/oAq0GfGIIAMqRDOg5RXkJcQhwh1FaQrsRmlsEEEfE6eHId6WOE3TKCZQE/Yk IfXpQc+hD3E29qFe/D2yo2+xE49AExGLvkEM2o+G0CPIgqajrdiEMpENap2IWcgTRvfhxxMr E1+gq9DP0VOJI/jOxF5I34xeRd9CC/7MYlSGroX8M1Ar+oL5DEUTjyERrUdqNAZNxTbUgj6A 7z+hDQ+hh9Gv8W2Jb6FWC7oTyqtAVagq8WLiIspF97FbuFPSIfQgOob5xNxEG0pHGWgjCSc+ SHyKgiiKfomegzaF8QA7AfnRzegetB07mVfB9wh6GsWxhjQx47kXoKaJaCZqR6vQRrQX/Rab cAN3ijuX+FniDIyqGWVDm9rQF7gUTybPsJrE2MTH6HrUj16H/tLvAHs9u5u7Pl6ZeCLxErKi I1iFj+MXuWLugaE7Ek8mnkcaaM8IGJFroZ456C70InoD/Rf6B1mbWIsmoGlQ82+wB/twEEb8 A+Ika8ga5l1UAL1tgtauQDtRDGbkKDqGTsDY/BENos+wBbvxJDwHP4j/QTRkHnmbeZw5yLzH YvZZGO8AyoIxWo6eQYfR79Bb6G3MQflFuAHfhJfgbfgJPEhi5CvyDSuyd7E/sENcMD4Y/yFx beKfyIFc6Bp0K1oLY/tL1IsOot+j94HL/htdwAY8Ci/ET+IYHsRfEYlkkHrSQbaSZ8ivmGuZ B5kX2VJ2HHsz+xb7MbeO2yS0CPGLu+IPxX8V/0PiSOIPwDs6KD+IamFE7wCueAa9gN6F0j9C n6C/UP6B8sfgWfhGqGUZ3oAfxr/Cv8F/wF9CL5HyzSBjSDXUuoQshXG6kzxEHoba34bvSfIx +YT8nfyT4ZgMZiTTyTzJxJg+5iTzN9bABtkCdgRbz85iEzAzxdzV3DRuD7ePe4k7x1fw8/gO /nPhTuFu8XdDuUN/jqP4wngs3gu8KwIn3Qoj8Qv0FPD9QZiD38KI/h5aPIjOwyy4sB+HoN3l uBbX4cn4OnwDbsV34vX453g7fhw/hZ+HHkAfiABtD5MqMo20kFZyN1lP7icH4XuUvEE+IKfI WWi5nQkwYWYEM5GZxVzPtEMfljNrmLthZB9k9jJvM+8yZ5jPmbMwa3Y2nV3B3so+yu5mD7J/ 4K7hFsP3Ke4FboD7A3eRu8gT3sWn8YX8Tfwe/i8CL4wUGoR7hfeE/xY7cBrOhZb7LhePxAlr MJ3sJRZ2LT4LER7MIj30PAzzMA1WxX+jSiYO86Kj6dA2K3GyZkrJyyzIMLIcH0Ol+DdoLU8Y kEzsIOrBfyKD7MvkKvQ+bsZOdjfTzv2W+NE+kEZbyHFyDI9DB0kFmUl2MAh/hvegz4DfV6OH 8c14GdqHz+LR+HZchtei94iNmYbvRhWJpwiLJTwRn0PQAnQHOw/diP7XDy4HzfhF/Beslr0N 5FMf2goz+hz6FD+Lvsdc4iuQbgxIoxaQMvcBv9+DqNRrgnW2FtajEyTIIv5tdBDzIFfL+LHs regc+g59wR0FjhoHkvRMvI39BfvXRFkiH1YYrDK0B9bdQnQ1rJjPgEtOQJiGboCVrgJZUgyr ugHNQvPQ7SD1HkzEEjsSdyVuSSxBbwLt9zgPf4+7YUX0AUUFeh2+m9FHeBOsw6v/937+u098 HhpAX2IHzsLFsB7Ociu5Ldxe7iD3a+4tfgSM9t3oceDovwA3q6AHc9Ef0JfoGyzC3DhRHopA e0dB2xvRIhJlTqDx2IU6YM1mgxwfl+rJMijlThi9HbCeT8DaOAdy4gb0a3QKE2yHHs2F+kUo pw7GeTbk3gUzeBfuhZh5ILVz0d+h3zo8iiyH+mQoaStIrQFo05/Q32C0E0q78kAuVOOZUNY3 6Do0D2oYiRrwAZiBw6gcJGs18zsY70xsQONwBn4a6JphheqQB5Vzf8UE5cWvTYwibcwJ0DEJ iO8G7eVGV+FOaIUe+jGErLgelcanQhvexQwbw+8orXiUtCbWM6vii9Cb6FmYE5ldKVQjdGB6 V5WWeQ7tBwDFC64PoBuAQTLzXK+gLZb7AJssCu6xhYv7EwPgGV2ixOc/XNx1nNkHw1EC0ft6 ZtDofb1ydbGCS8YkceEIBfeIyWTBUuytcgFZIQBB+pSvHmAzwE6AFwB4aNA+9ClAAoBh9jBP 9dR6oYRnoCB9lYV5BkwHGdy3ARIADLT+GejLM+jrVAwLrfplr6Sh1f9SoXIzvwQqPbgGgC6A /QBvA3BoCbg7ARIADPhAVAIQ5inmyR6D11ClYn6B1gIQ5jGkxxh5ofTtvQZlbB7t1ZuL5SoD 8whqACAoxkxGAwAEin0QyB5EBLLX9eSPUIawrlelKzZA/k3Q6E3QkE1QZTe4WAnLADT/pl6z jRZ/V4/eqND9rKcokvT0GhzFDTAKqxFmWpl2UJZeELLtwIpeZi5gD+A5zDwwsWk75V69obgL 6quE7JUgc3IguYqxwUr2MtWMC7iIZlvRo0vWs6InO7cYejyecShZ9IwWFpGXERmhp9jrO8bI yuBv6JXUtH0begzW4hPMPYwARo6X6YJcdq/+BKOCmVUpPZneK2mLt1RpmOnQzekwLF5oI4ZR blcKau+BgqqMTA2TBorfy9zMeMAI8TK1TLqCdzNPgrr1Mk/0BtO8A8eYhxSqn9NCofqxSdYa 26vVFQ9UScxYSI0xD8AEPKBUvqU3OApEVpDJRkUABMZ4LfjWKky/EXwbYdY2wkxthJnaCI3a CNyHmHsh5V7IU8jcijqYVWgLwE7wU7ay9sCA9iuezOzifsbJOGBgDMdgKDHEunolHW2Zo8dk VrI5ejW64soTzDLg82VQpsws77U7ipccY3KVruT1OtyUoKMH2PUEqFBlaoDQRqfkBJMGA0EH xsOk91i9sSovhCkjexEmvyUn6SCRd8n7dLqpFaHgN1P4rRT+fRInBsjJ5KIg71A8WJVGPoPC ZpNP0E7wEXKMvIyKgOBj0kdbQT4i/agS8CkIzwPcD7gE8NEe/+vePtLXCwja/niP1kY7S17u CRemPN6slMfuTnlMtuKqLPISeREsaS/5EHAm4BfJAFi+XvICYAfgAZCjrwM+RErBpvaChZHE r5DjlMXJEXIYJLqX9PboaBNiPQJF+3t4ip7vQclQQ6H3OHme7ANj0Et+1RN0Qeye3mCmV38M ysNgcy3v8XhNVSryJG7E5yFTN8h7wMhEnuopo4Vs6Tnu8/aTLWSL7CiTs+R8eRdTlFWUX7SL 8WX58n1lvl2+KgN5AATITgLrl2wCtwz5CHAPgAywhdzbw5bFqoagT7RfBHWB2634msHtUHxg eyDDpdRziq+S3IPqAQiUsQZgLUAXwB2g57eQWwF+BnAbwO1KzHKAFQCrQJp0AEUHUHQARYdC 0QEUHUDRARQdCkWHUvsKAErRDBTNQNEMFM0KRTNQNANFM1A0KxS0vc1A0axQNABFA1A0AEWD QtEAFA1A0QAUDQpFA1A0AEWDQiEDhQwUMlDICoUMFDJQyEAhKxQyUMhAISsURUBRBBRFQFGk UBQBRRFQFAFFkUJRBBRFQFGkUPiAwgcUPqDwKRQ+oPABhQ8ofAqFDyh8QOFTKAxAYQAKA1AY FAoDUBiAwgAUBoXCoMzPCgBKMQgUg0AxCBSDCsUgUAwCxSBQDCoUg0AxCBSDZNUB5mTVb4Dk JJCcBJKTCslJIDkJJCeB5KRCchJITgLJyVTXlyuDQYBt1gCsBegCoLQDQDsAtANAO6DQDijs tQKA0saAIgYUMaCIKRQxoIgBRQwoYgpFDChiQBFTKLqBohsouoGiW6HoBopuoOgGim6Folth 3BUAlOL/nin/r6eG3IEbRdC1pAvnKHgt+krBa9ApBd+ODij4NrRLwT9Ddyr4VlSm4FUoqGAo T8HLkVfEPd4yfZUNREA9wGyAJQA7AfYDvAAgKL63AT4FSJBSOYPVC/XCTmG/8ILA7RcGBaLn 6/md/H7+BZ7bzw/yxFflJlpFjoJoQZsVdy24XwOAEgG3UvFVkgjUGwE5WwrfCInIxrO+r3Px 27n4hVy8PxdvzsVVErkadi5U0vlQGYGG40ZZExzrPQVQFgyNBcn0wOGv7N6e4EhvHz6eRDly GPBXAAcAdgHcCVAGUAyQD5AF4FXiciF/o5yRKvI4QAjAD+CjVSCbDcxuk1GU+4kW7+r9jRZJ tJ5QNtAd6wkVAerrCdUDOtITmuOtkvBhFKJWET4EM7cP8P4e72lI/lUSPdfjPQZoT483Aqip J1QA6Pqe0FveKi2egbwsJZ2ewtOg3xRP7fHOhGxTerw5gMI9oSDNnQsVZUFqDm5EpwFnpagy kzUFerxjAGX0eMtpbhGF6MTD3idfaR4HQDHTCw36uh83slhWe896H/J+BeR/h4EF9vjI18cC ejurD8+UVd7j+b+AzFXenioVzQ/64UAKxyg+5N2Vda/3cSgLZx32Puot8D6Q3ydC9P3Q7nuV Knq8d/r6yD7Z7O3yFnmX55/2LvNO8rZ4p3qbsiC+x3uD9zhtJoriRrLvsLcBCpwIvcjq8V6d 1ac0sdZ7i1f2hrzlvuN0fNGoZLll+cfpCKDiZO15ML65WX2Ux2eU9WGjnCucE7YI1wvjhDFC QMgQ0gWPYBFNokHUiRpRJYoiL7IiEZFo6UsMymF65mjhlaNHnqUuq/gNhLoEKUeSBIsETUIx M1NH6qaNw3Wxgbmobo4vdmFaoA+rpsyKcYFxOGaqQ3XTx8VGhev6hMTUWFm4LiY0XN94AOMH ohAbIxv6MJre2IcTNOoed8w0HhLRPfe7+xHGznvuj0aRw7ay0lFpGmssr63+Cac55YZ//Dgu 93piW+umNcb2eqKxYupJeKJ1sTum+W5o7Cd6oq2p7ic6iqKN/WwH0ddMpfFsR3UUsp1WsgE3 6yAbClEE2cRxyEezgTwZR7PBHCXzBYEc8vkpgnwqLQoq+YIqrZKPxTTfgVO+muoDPp+SJwuh U0qeU1nosjzAMUBbfSAYVHIFfLiR5sKNAZ/SsBylIK8XsuR7lSwY7DqlIC9WKosV/pglK5Wl 9FKWUqUuBv+Yx5vMY8kezmPJhjzh/4+f1nFh3DtixZqXa1oDNc2BmlaA5timlQsdsa45Pt+B NStogi/GBJvnzF1IcUtrbEWgtTq2JlDtOzDi5Z9IfpkmjwhUH0Av10xvPPCy3FrdM0IeURNo qY72VlY0Vl1R172X6mqs+InCKmhhjbSuyqqfSK6iyZW0ripaVxWtq1KuVOqqaaN839B4QETj ouNvSOJeolYBDze7/dFxNkPHWMrQ/WP8jjXuoyzCe5A6HI1pAuNiWgCalF+VX0WTYJ3RJB1E 61NJjjVj/O6jeE8qyQDRxsA4NDy0iGaqi5VOqYv5p81qpKwSk1t+es6W0Y+S7EA1bdXwB+Hl CsD38pxo2U9+lv/UZ8WKFcuosyK8DKG6WO60utjIKdASQYCqmqujEFcwHMcwStwBSarpSwxA YhgagZfT6qgvjMMwgrIKdl0C6ea7BUK3Cst7XZ7iJSdAg68FgH0cWdVTqGyfyarejCy6f1ne W1iaxLBdpbjH5S+GGnrLgJTirCSWjfng2ZK1JX9LWXdWd353GQ+xh3dBpHcXVaU9hbsYtDy8 bHggwLs8CoMNzaL1PdmT5lEq7qaecDgaXoaV8frXwcbDg35pYJelSl2mFL98eEKS8ctShcBM JGtfMUy2IkWkJK5QiJKFJEOXnB8/EKJHoMrlE3zB3BLQuIMEx3mhj1TKZsSxcQapBDaOkVPk uThhjuMgknAMO5AjbLhQMVRxreF8xeShClQJfsNFcEYU+Y1+YxY4oAnQRR8zcFHm0A/Ixw5A XegRhNhvuaNIj9xolZzFc/2WfgdzNYcXcB9wxGTM0up0yG3IIpjokWgL7RewQCdGUkegUffJ Nq+nyNPs6fB0eTiPQe/DPth5EtRHNvWmjZjmCEN7mmiDJhs6L4Q7J5+FhtGmmcoLlbahpk7c VGL0++w2m9XC8wIfCDhJSfHIkaWRYCgYeAT/Eeumrtk7Z9u1N73x4lP7V46/cUJpN3fU5v9k //q+NqN16EP2pXhzwZyqhoVaFai2hxJnuEzojxNtlEcJoiAJBrtok64Wr5aE66SZhq2Gbcbt 1sdtuw1HbB9aP+Mv8GqtRgOKUcgySxq1T/u2Duug9XKG7G5wN7uZDneXm/jcRe5u94CbdWOw 53zOIueAk3HSTrpGrLi8k02dSy80JSfgbGVFhQG6iJs6zX6jBTqodAsmw6AjgYwgdK/0IZyt Nm++bU2XC2cX3XHq+Xc+WmPxcEcv/u3EqFmLF2x9nglfjMe//XhrtOXxGWsuUI7YCrwxB/pn Rj6Uh07Jlaty8ULd6ty/sRdYVvJbJT47z59lM3mt9VZSZN1vJVarJZCRZTKLPksW9NMd6uC7 eMLXZYf2a7AmNZcaOpf+ogK5oKGguaCjoKtgS0F3gegrKCogBZYM6LO5yEzMtMf5V05rU3Je zzedVXiOgrG8sKmTrjxkTXT1eMqtUEmPi6KuA+ZyYPQoZMJGUzkCgAGqi6lB0OipoFH5RkVx E2oy+4vTCTCEMMwWnB8bS4rLhvmCMfpTgWBgK5n0/L71s5bMXrel6cmVk+KfxbU4+6Vf5V5z Xd2kvD/sxabu8Lhp8i2/5Y56bnh09oLnwqHja+ed6NSKhH01/itOuu7q6hkSN9QfXy1pmq4d d0MuNZGegHXxDPc8LMOrZFeDgIH/WSaLQyLLuQTCXM7n/Ij+HwfkWkOcLr7JdCTo3ANvG/3W J3A2GeSe/2HiN7Ts+8A5CHPIoCX9iIMJKI5EODoRgSwFy5UWewRxMtfAdXGDHOflmrkO7hzH dnG0HQwSCfMRSIkYGkTMADqHCG3MSQixqJ0dsTPZms6lKUGQbEjnUhh42pr7cDZ39PtaaEcL rJUbuXeRC30gX7tOutdyr20n2s6/Jr3HvKf+JyNlSdmabG2OJce2glshreNEwSzY7Wa7PYfk wlgI2dyj3DbpDeY3aq4S10PTphoQHqTtQbQ3RkdEwSotYDxLtjvyWVEn60wRXd1sPa7XY71s dUT0fThbzjDlqxj917qZ6GukFOUqSsNp1lC3gPWCVygSGCptet1rUrwHHHetoelCEzAe8N3Q +XBT5+kwxdTTROUKbmpqwhzPBnzIaEBUwNg5YJYM3migC5GtxN5x8be+iv8pvgHfiiNYu2de cfyPrmdW/vLN17tX7iXu6899gTfjWbgdP7Lzxljt0ru/jH8f//KrrXQGt8MqDMAMSvj3sk5i eNHJ2EXWBPPC9CVQr0ldydCeX98UoVjOnTY9whQLokUQREYkRGAklhAJAqwMeVgZ0tli/m0O c1T0OGV1g7pZzXSou9SkWz2gJj51kZqoRSlVKMWybtq0iFSs8OEAsBLlRNVlwigcpotzWB5B SOEEuurKEcD6Aqpx1t/+ygGejJ8OS5WBvYOkC0VEHzi01UckbUSUwVH0W3RE0XglV9dhdanY pS5VOnaVqyAiTgOHY2xMMSMzbC1zj7hF7BZ7xNMM/wrztvixyPiYQjHCjBHrxZ8zO8VuZr8Y Y14Q1VSPyFJJaYTI4Ah086ItLI4QH3UESynEbJMlf0GETAdHyV2b7oMQOCIRBAdh7EIeCQlj SIlwLZGFG8hMQbIQtzCZ1AiPCfuEN8lH5HNyRviOqEMkW5gkrBY2CM8Rnq6GpT8aTU3JxRGO IrpcMV2x2Lgd+0gjNsc/HDoAAjmfeff7Wub4xWqqM6Owbs7AuqE68yl5xjZum7hds13HiljQ iXrBEXKsllaZhFXG1dZ17L3ivZp1untM91o2WDfYNzjWuTSCCTjBZTW5LC6H1SWY87WSM19g QLmqMFIZVD4Vo6Ly2FfkkVO6tdvD+zznPMRjCHUjrIftYpEy5/f1pq15+dKSUKRxk6Jlz1ae pau+qRNkaQQkZdnIktRCQNhiggUAohMWQ3R88a8W3NuLq/E98TXxE/H++Bo84m8HDvz1kyNH Bsl7g9s7esKj4+3xx+JPxJfAclj4XTyRSFz89ge6CvJARvbDKhDQUjlQKBWxRVyD1CF1SVsk gcccyWIZIiBRsttd7FrK2zhfVvGCDxchenRPg0ZG10A6SBfZQljiFIeeS/albkrjASKPilZM Bl4eqgCnprX6dMp2qFDkGUxSqd/qN+JP45PZ++PXsi99++0P9OKAWjTnoFVqtEW+SuRYQczi TV4OF3H7OcJxEsNSY0YlZamRKPB1DJmgQmqsdvm0RVpZy2hZ6XLhrrlc2ykiB9pUcb7iJ5Qd SHJQdiDAu0DZcVcoO4Yz0FYDd1n9KXiErbz4BRkc8jEl3NFv48e+iXd+A63fBq2/m0oWGNNK aD3PZQk+sUh8QfxUZAthaRFRRMkuSND+Sr4edPlUBqxG4kpKiSvbr/qp9jdV/GiGNXX+VPu2 MWeHxpB5Qzto2575duhByvdVic/ZEDsWWVAa/mU/MiS+lWvV5Y9Kj2m3GvZwu1XHpGPaPpco WvAEcjVfq6pP36M9zB92vaZ6XfOB6pTmW+EbrTZNn2aV3Z6IVdYZI3rrC9a3rQw1EHr16ZUK 1tkBk/tljV5natA164jOYcLU2ne6I7jEpKgUjy+pWjJykjicn8SONAXLep0+0k0POgzQ7Nkm E91hsGqTA7CcqRaQHxda/fVg6bkK02enL0nfmc6m6/2irNVHRKenrUoZsvAVOuYs3eFYHHK2 pdIhp+vBcRvASTNWKqKjckjhARM0AnKYaGMgk4IhH8U9w1lhqSpyRyFAkACGEE23UxTrlVRj lWCVv1LZWkRPh0FoNynV62QYJR2tVEerB2Vqr0yKZzCnw2GQYiDhSxR1j5rCoP74gA/MTAMq KUaMX7FAzVQJCrydfI8dI7/YH//7PW3Y8u5ZbOKHZObOlnGzQszqmTdUVGA8tfCxJw89+AkW cTj+WvzE7Zsm4EW3rh0/fhnlhenACy3KviEN1lm+KcpHVVHTTNtMRzRtu/Co9K0kdaR3pZPR TEQz2hpxTmKqNZOs1c5HJclC93mc2kUnQ6cWdHqYKJU9R6cNYnoEqtcj1+Z0nG7ww1Q0VihT QWei80LF5LNDFX9TWDcp30DLdzaNb5S1bXybqs003zbf0ZbGN0X9/lLoeQbIO5B0dpDmYH1f EnlsS/yHqgOzjsR/iL/Ucyd2DpkKq29t2XD3gnnrd1wfxSHorw47HyaGix17r2l/5ukjT+6E Bq4H47sMeN+A9sjZ2zgs6fA0bj63gmMKTY26hboOE6uS9BqvhmzWJDSkUlOvIWBUr5JzBAG6 xxBelY0kg1QEApKVXGtNO01ktmmtab/ppIk1GVAQM7TzakK6cDfYP05jZT9OQ0rvO0GTnzUo yxfEu3PyaeRIjgHorfJiOtuwjYLtun0aPVCgVnTxKNBlfrqUR46EERBov3kj7o6fwdz4m6ub o9ddfdWYqYVscNvN1aX/LKjaG/8vmNOJMKcF0McAKsad8kLBJaZxHptrkntC2sSsPxo+NUoj nbXO64LznQuC64I/dz7k2uXqd7/met2t4Xmt1cY7bSE+xxp1riLryC7+EP8qr3kh8pGBeDKL RxjztJlyuCCSKWdkg+P0RJZkXswkmbUeumCLYMFe5cHIY/DEPN95WI8nD5cgGWKpriNohp8y vZ8yvV92uCJ+YJ5DrKDRqvLoEoO0vNRSUzDkyKPsJVvU6SOCYo6UrY16NTs1xKvBCdj1yDpb ROOqj+BIM8ztA0UY45Ic/2w7/tSO6+2z7UvsjN1ZkpIDMMogAjrPNlFpEE6GTis7PFh4MA2w 8MLnm8KnFWEaTtpTPYUe3Bk9O2xcZYI5BTJveua8TNIUjjYBBaxpRmdIKrNOOoE4ROcK9juM xWb3wyYnRHk4WBqhyrssybuYboWsFhvdCZWNLMWtifA7bx/vq2PcWfEv1QaBmfB009MnZj7+ 899c07Ckbjq+ceSXmWWN1dfUlBjU5C8Fjz0cvfdIvO++e65JK3OKtbU9G2bdX5eW5UubUjMm /o6p2BGqGDOzOFiW2Up30qDin1N2KdMU3SbnGFWVdE9CurgYN8Cd5L5Obk3Wct0QwREMWVWE CWJFBEv+zAhyspXJBRy+fC/S2bRU2Yk8hJ3KToSgqcB5jwHnaWHfvk2e8Dk+I35j/sbKvkY+ 54jJyTklEjXMNM+0RR3byHZ+u7hN0ye9T/7I/Ul6XwPGGP+51rBbfJP8jn9ZfFXDrRDv5e8W GSMVNCq1nXKChRUs5YKr2d3hJm6dHzldjVWXiZZLJhPqhJ1DJ8gUqc0wHyRKm4PFTVG6nTBH TDA/yGpBgYzMYJblR4kydePQjv/CkfgbX/08/s1G7Nva3v7II+3tW0nGfZjfGH/t6/+Kv3x3 Ys8v9uzp3rFnD7Wc1iDEb4f+hvCYfpQDo9UEYwvSWmPlbZoIExEjjkigmtSINY7qgAbs55xp UnNOV87OnKf53cIuzSH+kCaWczJnMEeHcgpzGiDhhZxPc/gc2ZUWqYRwl5LICX5WcHlsyjgI dM3I6axgMBpD7rS0YAisTV5vCJqM8qzSZiNeYsQwYrWy3uUOetIgbkkaboZdGMQdzAoGQ1Q6 9yAUUpS1VEmxPBLaHYKsIbkKoAIgMxQJyaOvihSG3g59GmL0IW+oK8SgkC9UFEqE2JAz+68V w8sqZYCnxBtYrmGwRS50NlGkMEuFQfnSqbnsvGBpmC4YHDaDeIMVY1fWjd1mBZaKhBRRp3iD w941mNk0MH9rUe1TN6x4KtsTP+MJTRmzsCB+Jr1yZNXC/PgZNvjgs9NnzJg++4bq7UNRMvsX BRUTNm2NE1L7+Ky82rsfHboIc3Y/8Og0NohsaIdsv864wLiVYyTeyVeQCmMdqTOeIYKejrCR VduQymqxqCTebAlarYgKdp1N9mVG9ttwwoZtLgcdO1tGZmSLo9tBOhznHORrB3ao1EFJVOwX yNst4nMiFp321BKC4UrZcOC7ADD5bIVBGSc6QhUpfdiUVH3BID1osvx45sRcO/pE2817r8FO 79TKCUtzsXPnjDk37t1KuuOOwdYx9StO44EfPqa8CaYeGwXetKGdskMw282zxIUi28di4EpD tVit/8LA8bSjHqOg0/IatRr0G8FBG1J6iHACCvlfeqjRUT7SajWXOqrB50AmX9nRSwov2deU +Li8p51Uwf04yUaFGdKJlY3Gz2ROKZ+4PEy13aZ3mx6r95L051pHNdzdE/eywR0Hxy+8+2fU hvlRwgloVT+S6MkLlXFSg0S6pJg0IJ2UvpY4r9QsrZW6IYJjeAFxLAMWi6yctzCoCcQez/EC qyJCELPDko91iv8i+cDgBmNbMbUNFcNy0Awtx0lZCM11socxG7/4wyQ2CJOB0QzguUqYCyf6 D3lKoz5qitoW6ttMbbbbHbc4t5FtmlcNrzo+NHzg+IL/QvzC/IX1W948yjzKOsk0yVbriGra NMJoU5mtzMGs4lbp13Pr9Pc695h22/pNh22STtGU7gjFh0yWiK5ES2Oc6REF640R7VHMwtwu l01GNZIhK5IhHyrZAvryKMaIhSSfXcA0FvtRoZZ6tEnD2i34LVcIWWpIh8+fDdPjmqbT4eRp DeDkITCI3eTxjKLdRpZxKQMOLFcbOyL+d93c+rbb197cMN+KLeHzb30R/zu2nX3pM/JV8bTp D+49seP6JYW/fgnDDGABZ+2mfOxNfE4e5J6AsXtLzvEhHw6ocvSjdZN0Ub3gtCIHY7Miu8ls wXYTsWAHIwkqQePow1jWI3u3PWZnmgENgCXQh9keqJZuIpCVnsWD3apRS4WqQoQK8Wyw1iCH nO1ggnbTDGulZadlv4VptnRZtlhOWs5ZOGQxWHyWIgsLA7K6e1j41cXKwF4bA/ZaP7IkBuhm 92Jyr2s476Qm3lnlDB+yngaxZyzRw4faetgaSC7sMjufOkY2BkpLSrOM5NYBdSgtNMkx57Zr bi1XS3fcgV1scDA+/c5wmvvj3JIpNSMewW8Pvvt0/F4YnyLgLQPwVi55SR7gjXxADNmN9sB2 03bLttAjuZJgqbUQ0zFtv+41/2eBb7UXMvgc7Qxtq/YR9TbT7ox+jVAVkDOrgwsy5gXXm9Zb 1mXclSmVBWv4WvUkbb2+1j8uQ8jIDAXLNKX+0ozSQGmmwKs4o+R3aEOajIyMgJCZIect06y2 3GJdmbMid4P17tzHrI/kHsw4GNB24c32+xyP5j6bG8vj7X6b7A9EbHKaN+K14U9BgpaI/oas zVkkS3Z4IlkuavTJdli7DXm4KA8X5uG8dH+RARtKgC1T+ip5JqmqTFon9FzLGV7dR2fjIugg xcJLyRvlPJtqp7MoacDJpTzGPLbhYMZIf61/Oo7a5+E2+wWswnbCuvwZJNus1ZBs12wWs7XZ 6gYXdtWahcqhJvgzmuzlw9DU6e5HGYk3e7NzwYRN4oy+xGBveiYND/Z6M5Nhp0sJy27w3KzF IzNqM7ZrH854JeO9DN6fodGyrIv24xDsiVEJ3R332vMrcWr7qIQzsiIUyx6wCBAuwjJuwGwz 7sLnMIOwAULNsFhoTrMNcgLbT0Ysns2eYwntgk2Gom0ldhnKtctQqF0uLYvYqQVvl7NywIFy 9XavYiyz9hkuGWS93oUbXAkXSXW+k5rFyoeezTZ10lPapclgcjCSidGkBdwJn6YmZVOcmXhD ltSmSn02ODAOXx3WlmssmnLq7dGUwwh9eUBdjlLXdVGw2cxZyooAgwzsZmA6sJqpTcAlN7tW 2P+xdnqTAAumCLtM7XMXl2VZrBPjz12/5uPPPn4vO/6NcXbjkiJfWhC/GG08//VHQ7gwPHVG dlqhz2ox1o2d+ejG4w9sGjF2nNcWSLemzZ9Ut+7n78RAhwRBW1ZzA0gFtuuncrnGpy2XNE5N WDNNc7PmLxr+rBbzrI3NYrO1E7TXa3drj2hf1UqYiEjDawVOpdYKSKPRavvw87KLYS0MwzJE w2oZLWFVSJC1A9qTEDiGs5GICD54GLEsEIBN0XiQ26zCqj5MZJNB2Cm8IDCCS19J1hJCnLqj +Bo8Qdk+nu6kolc5R0OVlYbzoIWUY2B6EKyg9VxBmL3d8ArIlxS7q/M1V2kma97SfKLhUFNU OUhETWF65IZLjCUggLARkzVDe8htXx0+HD8X349DF5hfXrzxm/hHJB3/M64G+XJ94gxbyu1C HmyQc0SdT1NmqjFNdD6q/YVum+ljnWQymk1+Y8B0j4kDxtOqYBRMRjBAu2WbTmvR6bQmlcWn MC7TgLcoQnbmIQPrA/6kp9MmW4Td5QYrgsyStV5VoYqoZIhT7bJQrldbbBEqcmULY+nD+2SL 0eg1FBpIoaHSUG9gDDSrgdZl1ut1rN4wKJw6aceyHdtdXrBP/LJJuwofP0n1/E60H/S8M/3d fnw1unTUev401WjUQ5W7YQhYuwIiwkPhztOV1GnqNCaHVgdDi43KWCfN12FuTe4ehJAZxlVI bi0EYNDM67FDs3Jy4623tNzSfHoLOTP0n3k3zjmG2bbN8TfBtrrFM3vJ5i3r19/sJz/Ev/uu MH7uo0MPvESthacQYoLAixKaKUs3k5+RTYSBwcI5vbOVm4Ubj4gSh5FGQsdwI/AuJk2yFgbf C4MaY1nWqTqKd+NuNHxgeGHYDD/fdLacqmkwuHihdGRmWQkTjJ957A/tmBSdZgNbahKZb6yj OrcEVoMGWuDBlfLsQ47Drn73b9nXHCcdJ50nXeJ49/i08Z6ZzsfZRxx72V1pIu/yoWy+zDWB He8Y7xzvEjMdmc5MF2MLsjPZDY4d7h1pOzx70/Z6RBM9GfB5RnhWeu72bPF84BGVYwObxRrx EING7zEgX/IaTKbn4iDVYIJRH3myl2CNnj4CC3g1hRqioROv2WXmpFM2G66nlqpXf8qwisD8 vpQ0Vc5TW6WzgpqgSJlJUMN0dmHysLEknJRQnsRAj7GctqFHryBZZyhnRUM5JxoBG8tTom14 QUluJ+w7zZj+VinJCMllVTel8QRyJwZRGoAnMThq1KgoMEhTE9iEI03KJl/ZYgpZIzNBoNEb UZ4Fa1NzMWTo/urX4dGt0caFYvxzJxZf/ejbqyeXxC9cbcNc/IeHsfTHA5XXzbix9aafpX3+ 2y+fn9s7p+p8Q5DO0s+phQ92rw31yGE99uJyXEJKDOPwOOOf8XdYEjgbl0kajQuNHMbEbDGa zIyFYGV342EESaWyWFU2hNSqoCgpRr+EExKW/p3RjyxBm/WStW/F56zY+u+3NZfsZWXjV15u tCsHJWJF8qALG5Nm/hU7PCPet+FEy4562Nv5plxV214SP8MdHfps54SODZuHHiQjds8qrb53 3dBX0Gno/6TE39h/cO+iPHxSvqrf2Oc5nP1qHiuYBavdbLc6wq1ca/ZyfrV2efZHmg8Cmqhq hm5GRjSwUDPftMDflr0gb5VnnWerX2MKKKrbG6FYbgVVPSVjSuDFjBcDbGdGZ+COjDsC/5Hx HwE+rMrVZmZkBsq1kUCdqk5bnTE+cJO2NXCL9taMe7UbM3apdmv3ZJgllaTlM/iAU+XU2sB2 Cqi0LLbPdMhOX2SJAy9x7HQQx1HSCvwyIGtc5V43dudbGDRB0fMTXb5IUss3g7TsxjE8gEX8 n6zsKjeAVZKfKzm+ToB8k832iL1OCAVdBd5QtyFmIIY6/LUxeWPgzH8ndV1QN63xAJJHRZWb fVgQgMNL6YJQlPrpJF4aPk31uKLVlWWRAePh9oyF8TiZwn/tMVN9PQgIQm/0mGjopKw3lWt9 pnKVAnoa9znY1BCnLVc5KJjLr3iVM7yQrKNVo7XUmqxTTdSOz6gN7FI9m6FSdJTylORHyRpS vvT0rMTHXmEIKE8K6L3wJOxz7Vy/+cGrron0/2fz+rVfP4thNyDET5lvv/2OiYV5o3Ds7RX3 JdAL8S/jH+BP0h7ccMuUyES3qWDMzFue73h5/j9+q+2cW5pRHskqnL/4xKY1f7oZ9kTDJ2fY CYIoU7aSUbCDCtJTTDrELHKyC1Ymh3jyEKqcfFa5daHbP7oBpNQr4v34GUx/B1l5SBLVvEro w+mym9+BR6lVqqU4KGReVprmUmmnh87S8s4PKcqmHAS22a+8nQiNHFkWuA87c1fMKpsxgWzA zjduvb/Dtzxtzgxan4CQsAkWhgYnZFOYCfM+dYmaRTxWy67REb4v0dULmLkM9zhLpb7EGVly eSIqJzia4RCiIY6uhqjNE2F94AiSpOI1LmSVclCWJHyhOqP5RvpO9Y2Ge417Q/Wa5mP0nvSR 6gPNl+gzSdrH/pLbp3pGc4zt5Y6pDmleZ6UCNoMrVPk0j7MPcY+rHtGISU44KGKdllfui/zJ S3YJPGoZHIjd0StqaewO2Qoe9TwaUvNg9wqscm+WlC/UCE09+qLX4u6DL6lZzteXKOrlVRLg YvkGBml8iCHEh5EFJlfFc1yxWmVRq1USLwg+UbKIosSqNZripO0GlTAasNNYDQO2nSCJvCgI HMeyhGCiUakkqFxnt7sKRSz24SJZ5eNPqE/IhQw9/i+SNT5q8RDs1N44NzmtLufkoSaXY2jI 5Rxqclxb01pNL0CUQ7HU4ZgheakPf8bypFFnB7tjcgG93F9f4PhXlDK5QckMW+CKJd3Z5Md+ M/ZjM2DY4LfGn8KFn2ANyBP8Hzg3viP+avxP8U+4oxeNzNcXgfe+r2Un/NBH74LiU9hm5d6g EF8rz1nlWe8hJo22Y8Q6bdcIFjbeJMAUURXDyHg8Gc9cr49aolkzc2aGo4U36781fms2jdGW 2MZkl+SBcLTVZVfnndMM2VUPaLBGrdGqczXakM5mt+ZrNbB8HZk4tfPBJYqm1xmVC7NetSaJ YU+FUq9pFDwikrwUlKxu5bh/NkfPQ736EEU6VT5Va2qr4HDyuTnqICgxnCNLTqfLtXkEHgFW Z5+sQiWZfpOz6NJt1PnUfRQ9pVKupc/Cd+h86kBz+NQfKY1TKu+RNBHlKg9TpqMmALUBygWR vhC7dOasbdO3WdqyFuTMD7cV8vTY2c7Z7MOn/aVgHKYu8+ylfqNFRwI+EHDmy06ib8FVoid7 ZntZllm7ZuCD2+dg/MJvurAwtuPY5vg//nLxruYFD2xY2HpXbWiUNd1vGxG48fHnDm1+H6ux 61ePXLz6+NGbKvof0JG7nn3iyV880/0EzO3DCHH0ns8AImetXJLNZauutreyrRou115un2CL 2hbauHL7SPd696PcVjXnNdJHZmZTlt4gOv/ltaC5y499/iI/8RtNPuQzFIH2obfUvp98U3bp jn1YuPuL7TabiZrJ9BtIPgkbS+grsFAw8DDxHGm+o685v2z+5LvmPD30Ls7+5LayCbMrKhZN G3uIO5oWfCl+5veH7uqeW5frZV+6WKozzfzN3r2H55t09DRwJuxXdGC76kC0PiTXrVZtUO3G e4W90m7dEel1SZxpjNqirpneBcaFtoWuBV6xnJTzI6WR2olkIl8j1Wp3S2+SN/hXpFe0H5E/ 8u9J72mNBocPdDZlviywOx27RK1XX6gnemqF6nchznOqHnSzK8NySu30Dxugiv2pXEiEOykk 7Z4mDJ03GoTksVjZSDsYhfQtk3JaNtJoCAZJ8furN29Z9f4H8e/BLWkA4VtfkkTcwPaD8dnx 5sNb8US8C//i8NYvqqYvjsPnRblq+iL6quzFKuU/mSB+FBsEXfCJPAKpsQrxRCVwkhvZSDpr 5FyCRUpXGTUaRVEE1OVMOT+BmcBvZ7bzynmivCrv6ogKqVmWYyW1itW4kYu1cRbJqbJqNAGU zYa4fClbFdKMQGXcWKkWXU2u5iYIE6VVaDW7ilstrVat0qxHG9j13AZpg2q95iP0Efs+9z7o iPdBR3zJnuZOS1+qTmu+Q9+xF7hvhQugTC5o8v+nVpBSWsEqUa1AQ8Pyn5dgs365/L9S+E9O Cf9r5GIq/P83gc4nBbqqUFepI1Sqi1USpuzDk8VIDQB7Eaw76ANx/ko/diX3VVSgp+R5Upw3 /T+Q58MiuzOM6P7joFrWlkM3v+3RlkMvvz2sLVfLGhpzrkdDYyjiqdWlpqHB4cMSxZKizEQl vZn+YT/D4Gg8ho2vHcH6A29ia3xf/B9HDrLBoQmkj8IPH5N9QzOS9wK8k9oJxCGr1UxQDKoZ luqtRJcspY2OqHyjx9CXaYO9KSw/nVYAseDwkqj6q/SVimVh72AmaaxB8qoCJI/1SYWqBWQh 2yrdpFpFVrNPS3tVh6SjqgvS9yrbTnaLtFP1qvSG6kNyiv0AOOAM+Zz9DGZfuwrY5C5yH3uX dJ9qCxEa1a3kJnaBtFC1ktzCCtWkjq2W6lTXiddJjSrBARMUIaPZiDRGVakT6PEKD0aJlbhY uySkDEsvYRmVxGkEoZjXaYphJ21giNhArYeGpC3RJevU9EWcLkTNjFDSvDBQj1pkMALDQlAp lgXM5I+WRRMuPGt47yyNcPclxsj5UIuPFSUpZTAQsOmKGQJeAsUwGuArhasE0UsfImNtr8Bz 7FGwIrnk2z/lgah92vQIVyzIwlqwI06shVk4ofapNaSPjJJNYIPSV4WIvipExV76yBeK0dK3 gbDdOhsOGyr+01DhchqGOoc6K1wOw1A4DBGG052XONFkV44uLrMZoso7XfM0UGsiZSgf3ag2 KZ/kmR4CA4K+nsP0uTkYEMYH8TGswgI+Hj8b/yT+1/ifwXJwMJ+D1XDnD2soAE85QPD+DXZi NtQnF49kcS7rM/iMUbbLwYnsCw5itRmJxWQz6sx6ZNCZ6a+YLJKoV+PZ6oSaqKnmVvHYqE9e qyn3m/THTufob5/MFpVUUinWwyQyYrah0DjbSIz0oF6rMweJZTbqtg3YiI2+LALlbHPaV/eT tuQaDXcmz+IvNlWcb3Imn1vQd1IA9ByzvDh1Fk+vIc0lyh4j9cjCaqWnY35jwLGj/NEVq5cF x4+9qvSdd+JndrDBhnV3T8t8xVA+pe6Ti0eYidDOxFDiDBkD/WfQKNmDMJ5IYKNNmORVOv47 cXHM32HH8NCiHzVD6gk9nZ7bDa+MKBJwCWbwze/GH3RyX31voW/Ep8H+1s7R32FnoiKsPVQk eryRIMgJeRF4XjO+Zv6Q+1BgVxhWWu42MEGUqxmJxmhq0TWadnauCPrNuiq0PrRNu93xtPZZ x7OuXem7Q7vyni3qdx1Jt68yrzOvs6wPsduAsbbBQKcVbAdfWKL+LKaAqrbKgvoCUnCUPIDS gFkNNkekI60rjXSn4bQ03pStGGOQrShbzibZfeQBWWvSVmbUZ5AMSp1BY1w85z0lrQqfos+E XcXOU8yqrFM254hLSvJ8Sk0qb7PC9KA9bFDe4oXPNikivYkCtbSayptSJ8xNIOyDqbPh4cfl rGJURUZebkYxl/nxhMVzP3v3D2duar51bXzow9fveWJl/+z6hubZ105pdq2KXrd0eXRBK2Mv eLL56Q8+eHr+ztwRx3/2ZrzttlOrXsNTpt84e3r97Oahq5bfefvKBbc/QPdbVXg9aSPdME/F sp/u2AkuU8SNjykCgVrNGZS9HQPz/owy76ebJhtASxSehW7Q68Iqko3XJ3eLBL0BRf4FNDa9 wyyQ3cwozIMGV0n7YdPCB7GPK+IIt198ax/9fQg9AzZUXEg9dRi+enwjefXIaCm++N/DJW+K L2K3KS+e0tBjcsEo8wQzMUWYcm25OeKuZiZqJ5qr3d+5pZn8zEsvvy4I37lFWHsu5YmXQK/M ZJtabdDr7H7R1ZGO0405Op0+aDAoT73UHaiLnjp4KpPXhJ3JK23D6eEnGUnDevjkh1rI8/n5 l7/0or8UUN440avCQEYwRB97/Th5mzBf8vxN/ZjEL/Y3bq6HbtoemD/nznVzF2xggzsa5sX/ HB+KX4h/VDtj6Aumv3ffE727n6KvvdQIsbNgVNXYLVu5bFdhRKAOTx2ROiD8T/UCVi58fbAv fgwMC1AEokqjtmIrMTEuyaXKQPnq19Qa2ACck20eHxhGnNqCnOoslKuOoNHq9UhK2S0qrNUo Zakle4QFQwzz1EqhmqQ8ZaDIJjVSsbDxlKjpAX6pnN7Tyo607Iha61Ver7JasEIMqkpVvfKE uEhWs6RczVay9SwDSqQIRE6XrNeUIuyj5+rYqXml2xF2Uss77Jh8tgm2M03OpFVCw4qkoRrB VI6hCcpFTZjeBCR/JEWtCDt9nAR2BD4Sn45Dr4+28zrDb7E/DqM39JdDNbb8fJKuvCtIDMFO ohHsBxH9ph+xiV/LY9WlAyoMDeMYAcxFhkv6fQSDDMRKjI8X6AkGZgUG7C4WM4SRWMSpRDwT 9hMLZDUPG3JQnQSJqmPEDmXzxH5IEEQfAl1oP4IvvYSd3yvRLTVdA07DadB5SXSajrFidV04 nbwUMSoGlzGlAUWQsYAdiofu1taLVOgCO4YVLUcVHbENncHX4yieimcMfUbamClDx0n1xV8N PQqcNBl2FW6QxTnoI7l4vfUNK/lZ2qY0sot5ltttOcwc5Q5bPnZ84hRtFny/7X478au0YErY zTa/V2vQqPpwpqyp12JZu1lLtFrQcZjIeq+50EzMVFaad7m5Ky9G5GLlZiSkjWkGNESjsRlO rfVu9u707ve+4OW8g8Kp+kyc6QrbTtlX4VPImfuvErXpLBWkqcNv6ihyVXmBc+keg8pVRapS FXj5dUaZ7dKR9VgCahFErCJn6aupydigXTrlulVLp46s8y5d3Thxwnx1fMi9+OVb3r59wbtr tsX/9s5r8e/xPf6F7Xd33HSb9TOm7bpJjfOa8+7Zef3diza8uMx9/J4X4+c+41P/VpGUJ4Gb iR7hXkMPAWxl/4qegLj7wN8CsJ0vR1GIy6N5AG9jl6EqwNMZD1oP/omQ9yEITxU8aA3g+wEe VOKWoRlkL/ICLgIIAlwP8BRACeT5OZQ3ieYDWCHcjwRaJtT3MKTPhDolfi+Usxc5SHliCOKm gX8ZwBuQbxOE1dxMJX4y7L/kyrFXVYwZXT6qrDRSUjyiqLAgPy+cm5MdCmZlBjL8Pm+6J83t cjroWJpNRpCmWg3IAZFahtRWyKsJ1Db7YsHmGBsMTJiQT8OBFohouSyiOeaDqNor88R8zUo2 35U5Zcg5/3/klJM55Us5scFXgSry83w1AV/sreqArw/PmtII/vurA1Ff7Kzin6z4tyh+Lfj9 fiDw1TgWVvtiuNlXE6tduXBjTXM1FHdArRofGN+qys9DB1Rq8KrBF7MHOg5g+1iseIi9ZvQB WOtaaFTMFaiuiTkD1bQFMSarpmVerGFKY0212++P5ufF8Pi5gTkxRH+RG1ayoPFKNTF+fExQ qvG10d6gTb4DeQMb7+szoDnNYc28wLyWGxpjTEuU1mEMQ73VMfutpx0/BqFw0/jG9ZenupmN NY42Hw1u3LjeFxuY0nh5qp+60SiUAbQkq7Z5Yy1UfR8MYh39CXeM3BNtjOF7oEof7QntVbJ/ yZ80ZzXf5ItJgXGBhRtvaoapcW2Moam3+HtcLrk/MYhcNb6N0xsD/lilOxBtqU47YEEbp97S 65R9zitT8vMOGIzJgT2g06c8Gu3lntZLaYpPyU59dVMvjSymLQpMBIaI+eb6oCWNAejTKOq0 jkIb546CbPCJYqCKzYMZaYtJ45s3GkbTeEof47IMAd/GfyLggMDZr66MaUnF8FmGfyLqpXxy idUgfdgfC4djubmURYTxMKfQxrFKuDQ/b2UfGRnoMPgAwfChBhjblujoQhh+v59O8KY+Gc2B QKxrSmMy7ENz3D1ILgxHY6SZpgwMp1hn0JSu4ZRL5M0B4OSDihyyxsTgpT+9wWauWTg6hm3/ S3JrMr1uWqBuyqxGX83G5tTY1k2/IpRMH3UpLeWLmcc3Mm6S8hE3o6QCU95wKTMNNGpibBb8 8QpTz4sxwJRKBPbVxgzNE5JuVOX3/1uaPkG8jAjMGEqloB/JUq2MjQ5fGR5zRfiK1mk2MtBe Nkjqps/auFF1RVotCKCNG2sDvtqNzRtbYNs9J+AzBDb2k91k98aOmubhCe1LHN3kjtXeF4VO LMSjgVkJGncggDdMOSDjDdNmNfbDTtC3YXpjD8FkfPO46IFMSGvs98HuWIkll2JpyEdDqA4D o/cQUUly98sIdSmprBKhhOf2YaTEicNxGM3tI8k4gxIHn3zlnz6CVU45QAMafQvgZiQjDoz7 5If+fjcfFaBCsFCKUQkqRaPQaDQOjUfVqBZNRNegyageNaBpaDqaga5DUdSC5qJ5qBXNRwvQ QtSGFqHFqB0tQR1oKVqGlqMVaCValUhc+qeLl9cwAmqIXFZDTaqGa/9f1oARSfw18Q1CifOJ i4lvEmcTicTn4D+feCXxauIvidcTLySOJf6UOJ44mPh9oi8RS7yVOJU4kDiceC6xF/L8GuL2 J3Yn9iSeTTwDeXeCb1fiycTRxIF/+Z/J//9/SBIlQujDn0wvgU0Zg1nMYR4LWMQSVmE11mAt 1mE9NmAjNmEztmArtmE7dmAndmE3TsMenI69YFv7cQYO4EychYM4hLNxDs7FYZyH83EBLsRF eAQuhm17RChoX7J8Xut8rqB9xaJFhvYl7Ytblt7c1r5gaevyFUvbuWUdLXNb+dbVcxe1LBY7 VyxZ3jpvziJV+4rFc1qXLmtb0M7PW7JoUctSoaN16dzW9uVSy2LwLWtpn6dWMi+Dkha1Sh0t S1vbF7XOX65SfEvbFixcLrYsW966tG3ZzWzHohXLuLlLFi9u4Rfe0rGwtZ2HMtqWzOOWLWpZ tpC9tXXpEmZJeyuzfNUSbvnCpa2t7PwlK5ay89tWtjLL2lZzy1pXtrZzrbRQtr2tvRXKWrSk XVrWurhN8bGLWpct41o7V7QsEqBfLVAtdKV12fK2Je2kZTmuwuPweFyNa3AtvhpPwBPxJFyH r8GT8bW4ns4FZt4jx2HdiNxjXAkE3UnM/AHNJyaRI2qBJfTDov/x37anTx7vgzXgS1zk3o1P wSXCWNxzRR4euB9WKCslT6JSfqL8d+Ckn1H+T3DSz4J/bMrPgX9mys+Dvx3W1Hg0AdbUdfAN oypYL22wmhahqbCaFsC6WQShpf8217+LnwnUdOW1wRpsh76MgNVcBN9/k///ALmHBpEKZW5k c3RyZWFtCmVuZG9iagoyMyAwIG9iagoyMzk1NgplbmRvYmoKMTQgMCBvYmoKPDwvQmFzZUZv bnQvQ0NISVdXK1RpbWVzTmV3Um9tYW4sQm9sZC9DSURTeXN0ZW1JbmZvPDwvT3JkZXJpbmco SWRlbnRpdHkpL1JlZ2lzdHJ5KEFkb2JlKS9TdXBwbGVtZW50IDA+Pi9XWzBbNzc4IDAgMjUw IDI1MCA3MjIgNzIyIDUwMCA1MDAgMzMzIDUwMCA1MDAgNzIyIDQ0NCAyNzggNTAwIDM4OSA1 NTYgMzMzIDU1NiA1MDAgMzMzIDUwMCAyNTAgNTAwIDYxMSA3MjIgNjY3IDc3OCA3NzggNTU2 IDM4OSA5NDQgNjY3IDcyMiA3NzggNzIyIDcyMiA2NjcgNjY3IDc3OCAxMDAwIDU1NiA1NTYg NTAwIDYxMSA1NTYgMjc4IDQ0NCA1MDAgNDQ0IDgzM11dL1R5cGUvRm9udC9TdWJ0eXBlL0NJ REZvbnRUeXBlMi9Gb250RGVzY3JpcHRvciAyNCAwIFIvRFcgNDI3L0NJRFRvR0lETWFwL0lk ZW50aXR5Pj4KZW5kb2JqCjE1IDAgb2JqCjw8L0xlbmd0aCA0NTcvRmlsdGVyL0ZsYXRlRGVj b2RlPj5zdHJlYW0KeJxdlNFumzAUQL+Af/Bj91BRG2NaqaqUkkbKQ7dp6bRnAk6GtAByyEP+ fsbnKlOHlKADvtc+177k9Xa9HfpZ5d/D2O78rA790AV/Hi+h9Wrvj/2QaaO6vp2F0n97aqYs j8G763n2p+1wGFXBqO4yycj8R7yd53BVd6tu3PsvqvOHLP8WOh/64ajuftY7eba7TNMff/LD rB7SEz90vKnfm+lrc/IqTznut10c1M/X+xj8b8THdfLKwL/ex85LGs1S2vjkPDWtD81w9Nnz Q7xe1PMmXi/LVP+9LyVsf2h/N+E2PN0S6U9kPlGRyAjZRNZCJaQhl6gQqiAHPZJlDT3x7gla QRX0mqg0UJ3IldAaqqE3SObbJKqKRBo/xzo1fsUKwq8ip8bPMbvGr5I4/ArWovEzzK7Fj7po /Cy2Gj8ra8GvlJz42Q2En32E8CslDj9LlTR+lgoa/CwOBj/7BuFnMTL4lTISv5KcRvYPI4Of xdbgZ18h/ErJiZ9j1QY/J7MvfmYpa0axUhxVMrJ/MoPsn6wFP0dcIftHlQr8KuIK/Nw6HXU5 08uhX3r41l7tJYTYWamFU0tlsX/6wd++BdM4pa6Mv+wv+WcFBQplbmRzdHJlYW0KZW5kb2Jq CjI0IDAgb2JqCjw8L01pc3NpbmdXaWR0aCA0MjcvVHlwZS9Gb250RGVzY3JpcHRvci9TdGVt ViAxMjAvRGVzY2VudCAyMTYvTGVhZGluZyAxMDQzL1N0ZW1IIDAvQXZnV2lkdGggNDI3L0Zv bnRCQm94Wy01NTggLTMwNyAyMDAwIDEwMjZdL0NhcEhlaWdodCA1MDAvTWF4V2lkdGggMjU1 OC9Gb250RmlsZTIgMjUgMCBSL0ZsYWdzIDMyL1hIZWlnaHQgMjUwL0ZvbnROYW1lL0NDSElX VytUaW1lc05ld1JvbWFuLEJvbGQvQXNjZW50IDg5MS9JdGFsaWNBbmdsZSAwPj4KZW5kb2Jq CjI1IDAgb2JqCjw8L0xlbmd0aDEgMjYgMCBSL0xlbmd0aCAyMTc5Mi9GaWx0ZXIvRmxhdGVE ZWNvZGU+PnN0cmVhbQp4nMS8eWBU1dkwfs65c2df7ux77sydfSaTSWYme0huEsIeCOICyAiC IJuQAIJoFXDDpRWsCwIuuG9tCRPBQVziUrXVFrpqqxXaUqvWKG+LtFUy83vOnQlg3/6+P75/ vgznec52zz3Ls55zLggjhHRI+lu6+NLLyjH0IYSGpZBRTmILgODK1YvG0k0Ajlxx6VX95TRR AvAtWr/OV0lHEVKG+9csrpSr+xAyd16+cuOSctp7N0K9Hy+9Yt1V5fSK7wB4d0n/5VeU0ysn IcT+fdEVl1aeX9MG73yxf/XadeX02n9BemjGrFS6nL7yBwAuXHXpFYvL6fUyqc90bCzZNll9 4NB8Q9tXSpVSKn3kz/UTKH51xnvTv7l19LscUtZDXRUEXB4eQgp/sQddxKFvbv36KIcq+Wf/ MhW88tsBn0aIeQoh2dXw4rchFKGldpgLeLEamtH8CCEt9NXwGEKm4whZPkPIuhwh+1KEXFoI MC6PCOE1hKrugymFcft/jpBwDKEQvCIM7Ud/iVDsRYQSgwgltyOUWoVQHbwvI0coewKh+r8j 1Aj1m08i1PYgQh0wF53fhQBtdkN8PDw/QY3QRHjn5DhCU35O10IaYQb9HbWhbUiOCOJQCl0I PZ9E3kAsIuwdiGenScHD3I3cCJX+CAHGUPqkOKV0ml2BAsXlpWOMGWYhWA6VvxC6EQXRJ+he 9ArKoXcIg3pwDZqNZNiBnIjgZjQVc8iOWKxGURRAU1EfsqIp6C9Yh/aiOvQZnoC24BCage5H ApqObKgT3Yn24ImlT9EW9Cu8DD0LTz+FRRRB0/Ck0lE0E/WVnod3INSKdqBdWI94KFHjQOkj aGEt2opeQL9FJTQX3cfugVb60HloVel5NA/9As/FF5c8aDJaha5D96GH0UvoOL4FD8vY0gJU jxaiNViBzTjKXF96CjWx76v2l94oHYHZWgV1X0Cfk4RsQukLJKJPZLi0FDHIDLOagdJH0AH0 IXbgeqYb6VEW3pVD30F7mSj0cRK6Fcb2Ar4G72X0pcdgNI1oEdqEjuGr8DDxs++zJ0pXIxOM Lws9vQ09hl5Fr6O/QWsT8PnMFcWO0nRYPyVKoB54043oZvQjmLnX4PcGNmA/ngwtv4o/wn9k VjEfQ8tPohF0Cv0LR/EyfB3pINez6dEtpf0oDCMUoY3J6CKg5h/gMBbxxfDs/WQDuY5sYg4w H8qisi9LTaXXgUZSUPd69AyM6+foV+g9WK8JuBf/llzHDLE3l66B/qbQUhjFjehxdBB9hVms wlpswT6cwY0wsmvwMP4j8ZIAmc0sZPay3y1tLH0P+YFWcmgxPLkc3YBuQs+jw+hP6G9oBLvg yRQ82YH78PfwNvwGOcxcxMxj7pWJsntlz8pek51mjexrxV8Uj8Gs03ZqUS/8cmgJuhrmugC/ 19HvMYPduApaGoenQEvz8RL8Hbwd34MfxU/gA/gtfAR/ir/E/yYO8l1yNzlEfkwOkyOMl4kz 45mHmHdlftnvZd8oLh31Fl8pflnSlBKlTGl76f7SB6URaRU8QPEdqBuoawXaDKPfju5BD8Cc P4d+hn4DdHdU+h1HJ2ANvsFyoCYn9EjAARzB1TC6i/BsvAHfhu/Cj+E38R/xcXyaIKIlAvzi pIFMIfPI9eRzcppRMwGmk7mK2cH8kvlatpFNw+9Zdj97Qn5cEVK+e3r36EdFVFxWvLe4u1QP tCgHyjMDz2VRF9DcFFjly9AA/Nag9WgDzNHVMOP3A+XsRXl0CL2N3oW5P4w+AG1A+0t/n8JK nESjqIgJrCeLlfAr970WVqYbqGUBXgxrW/5dg6/Ht+L74LcbP4gfhvn9Bf4l/hU+iv+Mv4Ix IZIknWQijKiPXExy8JtPFpEt5HbyHPx+Tn5LPiB/Il8zHGNkeCbC9DCXM7cwtzGDzHPMr5nf yMKyTtkk2QrZW7JfwMgnsZPZ+ewi9nb2YfZR9jX2p+xxtiS/S/6IvCD/RKFWNCj6FOcrblU8 rTik+FBRUkaAnnqh97Fz5Ppd+GJZimzHJVKAcb9M1jHvkLvxs+eKfvY26MFlaD4pMC+RB76z nfkT8wNyPcj88VLxOJBi76IX0bvsr2RW9hP0FnGhL0Ae3s1cSl4mO4kDNzCtsptk74LU2Qj9 fJQcJQqyF2r8DVZjProAO9HfZReiL2H+D7O3wZxOIB/hZ8mbZApQ8vvoMXII7UR70GLcCL27 DO1HX6M78UHGhw8A3W1CR9Dn6NjZ3spSo12kQ+4g6+UtsEIH8czSWyRW+htw/R/xTegD5mug /QvxdJxCT6A/w6r/BmcxLyvK3OgXIPmq0G6g2r+iIeDBn8qCwEFfoYNMFs2VHYM1T43+pDie XcfcgE+RTlhOuyS5Z1BpDDL4PpBVVI7q0V6gBJAiEkf/Df0MCzCLv5L/Hu0CXfMCY0Uh5nGy mZSYt2U+9H10jJkGb70W5JMHZ6GlK9AyGIev9HHxMWhhOWpCTXghnovGQ8kkVFW6Anr+BMgi sTSvtJOdwybQz/E0bEWvgPRywCzey6qKI1DzOeDDD9AkfDsaKl6GhkGvOHAIp4GaRtj17Hb2 GfY59mX2Z/I6dBVw7W5YxT+hk6A1fHgRzMVn6J9A613APdXAP53Qi0mgw1aSOcxLqBu7UD/I wCjI7S6Yg7mwkmuhlevRd4GfHgcd8nN0AnN4HnoZvQ+cYwc+XwTvV0I7U9EFsOpr0RMgHW/A Q5BzGapCcZinr7EeN5F18D4qZ+8FOTsMffoQfQySoyT1qxq34vGweovQPykvwxsaUB/eBzr5 AGoGTTmeeRf9BQVBu3YBjz4Gzy0A2tAjL2pm/4wJqi5OLzWRZcxL2AbaUA9UdT5o9nF4AHph gHGMIiuegeqLE6G1Z0GW9bGPg/ZNgGawEqvsIvYC6PfvQZP9HK0pzca7FMAB+873FWTaIa0+ TXHebE8XZJqhqI83dHIyE9oMgSADwA4I8yEwEsRIlJnyV2XEAqA1ZbSqjJaX0fkZ8UWoOAVl SsMy05DdkabZQ2ptejPFShVNG/NzM2KnSmYE04XWM6JZZZzvy0jFvbQVI5pYzh0a31N+qquc 3V6p3JLhO4OQ9kEQIfRD2AvhBAQ59N6IUhC2QyhBkEkpWm8ThG0Q9kA4RutKrSkzhk63jIMS Tho7h3gIKQgMWiCjVuegBA0yJcyKEs2A8JBMgWQydR6t5A9CI8xQj9RTZihRI+F8NJaWCvIu T/olGUN2gnHAQwbO29xSCcp3dVUiDU3lyFA8mT7aqQYb8EsIRAYWGJCs9NRQtCZ94hVIY6aI DBjTXOb0EGeBtzGjQwZzWuzkmH+jPggEDTL70DAEglYzX6FNEAhU35tP1tEXMXuH1Po0B/W/ RD4ImyEwaA9ALKVFCLT+l0NmG23+r3mDUXruaL42W44McY50X6eF+RD68xPml2AU8iBmfwmM wTNvAfYCfpN5GxwX2s/HhgxcejO871Go/iizEcWg+HHmapQG/BRzHdA0rfa7vL78nt/lo/F0 p5p5kvmOVGUtMwAszTMrmRX5NO87xDxG6ZH5fEilof37PM9Z0y8xnzIrkAVqHYdadt7wErMK pSDQkRSGVLr09k4tU4BhFmBaeOgjRg9JUGR+mYeG4H1PM5uBfXjmMLMFxCTPPMNcn7fyw4eY f0rVTtFW4H2PAMVQNKTTp4c7VcwjlEKYv8OM/11628mhcFMadYaZ76JaCAQm9c8Q+zM12pkv IPYFLNMXsDRfwNJ8Ab34AogWMSNQMgJ1UsxHqJ/5AG2H8BDEZdDkxjzM4EEpEoymDzLXMt+B meAOwdxhyL1uSKWnPftO3mSWqn2HMnjHS8x7aAYEAp1/n3Lk6kPMHdJQtg853PSBX+dVWpi6 a8prAQ9eTdfgJWYzc700E1ukGRh8GZJA/8wN0sOlIa0xvQlW/3xIrga4DcIRCF9CkEG182EM 56P5EBio3jekN6QNh5i50sOT8/oM/xIzCYY+SZqtSXmrIPV5YiUiM+TdVemXaQQlwetJy/Qy eT7FzzzETAX6mcFMz1/GQ99n5qFd+uD0oaaWdO0hZro0F9PzfKCcnTc7pciEvKpMV91DaiPt yXipYiKv1EvZiQpLMvEhiz3NA522SKPNUJ+LaYTla4SlaQQ+yUiLkR7iTED9lzFpaURptADC HgiDEGSwxmmonoY1ToOqTEsz0gDDbUAlCAysbQM6AQFEDVOHOiBsg/AKhGMQWCl3AQQC+bXw hgUAt0Mg0GIK0hxAEcICCJsh7IEwDOEEBAU6zCThPUmoXQtwM4RBCEchyGCtqqEf1VBmYnxo FHxeHm0iO8UWvAltwpvAgdgk28Ru4jYZlWJ9qDotLqeghoIogMYFqn7VZhVTqxJVfSqGU/lU pFAazitaMoBEk7wl8/vez3q/7mVMjdvl2xXkcKcWG9FRCF9CYNBhUHRHIXyJOXErc7j9aPuX 7czh3qO9X/Yyhz86+tGXHzGHk0eTXyYZsdfdkm6cj1fjTeBIyHjwBjrwDCybz6xmNjHbGBnP pJgOoAXZAk2/ZrOGqdWImj4Nw2l8GrJds0czqBnWHNGwg/Jh+RH5MfkJOdsnXyDvl2+Wb5fv kct5RUrRoRDlshOd3eQDmNQ9AAchELQZ4HYpxkklwwCPSOntUnoBwH4pLQLsk2IBgLU0BiEA bf0e6m0GuB0CrUfTAYC1NA0hANL9d5DXD3A7BEJ+J3qE2qAYJFzQFyRgEpwI4iPBY0EyGBwO kuHOFvK+1Mv3oZfvS718H558X3r3+9AuxCAEoLfvSfXeg3rvSfXeg3o09t/yFgDsl2IiwD4p FgBYS2PkvXyg0dBpJ7uhxfkAH4JwFAKDUgA7IKyWUjytQXYDFMmuoUg1KHyyKx8GGQlIKKOq MvJIaMjpSs/vNJBd0OQuaHIXNEJTPIQOmioNk5358bTuzvy4MmrJHO1sBC1Ku7IT7YVA0AyA D0mxFMAOKbZXqmM4kx4EeEyK9QPcc+a5+VKMBzj2LEN2wW8nxAzkasi9WtQQZLOBjW4yKk0F 8kJ+mYkvkOfyUQ7QUBnlKeo0EwbmXoe/kOCPJPiQBO+W4EUSNIiagO7fAd2PA7onA7pONTgM Qcg+IcFPJbhc1Ad1nwR1bwZ1jwZ1jwR1h/CfkQAFftEl6P4i6P4g6J4XdM8IursE3TxBN1PQ TRNoU1HkQzripRBfIkGPaPfpTvt0f/Tp3vHp3vbpHvbp5vh0LT6ojv8O+lQHBj+FOyRY/3xW x2d13qzuBQKSCV+cNyDVIULwxUjHqPPxdr7AqCRE/PneECBPvrcTkDvfex4gV753DSBzvvcu vlNFDHgfGCs80eN9Soq1+fgWKNaUkTIfvwQQm4838wVczMcDgL7JL/EC+jq/pArQqfySLKCv KHoR/wMtIdAM/p/8kgehefwZitJm8V9RmDwLuJDv7YDaz5ffjp9D7TgE2Xmw+mi1H+Tj0Dn8 VD4eBfRkPh4E9EQZPZqP84Aezi+pAfRgfsldgB7ILzkOaFc+upK2txNFpXbuQ2EJr833uqF4 IN9LW+jP96YArc731gNakW//GaBl+fbj9NHL8T4MlI2XoLjU00vzS+JQPL8ykByKSsXzUL3U 8sR8L52SCbSRTh3uqQxkPLiZtLgL75NaEfPxWqjWno+HAY0rz1xbfkkCUFM+CnOMG/PRB2Hm GioviNH1eREHoRu0oUA+/ixU4vNLYoCq8kt6ALnpk9Apc+WtJtQudcqYj9NaXD7u41/GGrRE alGNwnjXAX4U2v2mvYAvzPNfiwUlzvP/jAI6wH/eu5D/W28BLF7+M2DhZw/wR6HqR+0QFTX8 h/Hj/AdLBP6ncaghuvmfxGv418Mb+UL0ED/UW8Xvg44NLlnI710itfCjMDyW55+KFgiGp/cs mcbfF0/wO8IF2ofvQ+Wt9B3Q0E3xjfz14S38lUAK63pv5dfGvXx/9BJ+eZS+yM4vi5/HL4WB XA7PLF5yOX9p/C5+Qb3U40viP+Nn1UtjmLpEGtHkdqlg0pLz+AnQAyjooAXQg1agyzQ8WlN/ iM4RWCrdQz/jL2h8kYAWxpshrBFrFC8prlMsVJyv6AJ9E1GEFH5FlcKiNCk5pV6pVaqVSqVc KVMSJVIiYimUjokJupVtkUs72nK6SY5kUpwjFJLy3jfBSgKO1qCZmUqmzuoabExMLShK5w02 JaYOKvsunr0P4zvm4KmDw4vQ1IW+wVOzAgWsnjl3kA104UHTVDT1/C4HVB4ktxQwOn92AZfo Eze5B03dsw8ijKtv+p6b4gk3fW/OHGRb3+HoMLUbmyeM/y9gQQX2jE+c/XMkEt9KeQfvnTpr 9uAz3jmDaRopeedMHYzN8s2bfZCsJMt7xh8kKyiaM/sgXkpW9pxH8/HS8XOgWqtUDbWTFVAN 9VIE1cg81E6rQf68c6qBb93eM35fe3u50gy8j1YCppkhVZpbrtR9biXmdtwtVepmbpcqPVh+ YRz6AS8UKYJq7EoUl14YZ1dK1Ry02r5wGFpaEqZV9qXDUGFfOC0VzzxbHC0X/7Bc/ENaXMD4 bHl9uNzbKApLbwiTKNRJ/D/8W9z1f/EQHhq3ftXsnsWBngWBnsUQFgzevn6pY3DzQp9v36r1 tMA3yIQXLFy0lOJLFw+uDyweP7gqMN63b9zs/1I8mxaPC4zfh2b3nD9732xx8fj8OHFcT+DS 8XOGpm9pGvjWu249866mLf+lsS20sSb6rukD/6V4gBZPp+8aoO8aoO+aLk6X3jX1vC48tW/2 PiXqmtM9r4yHiEYN3LLA7Z/TZeP62yXWafU7rnO/IEP4KaRJzBnUBroGdRBoUbIz2UmLgKVp kR6yDZUix3WtfvcL+KlKEQfZxkAXWufoWTYe/q2Fv3XrroQ/mOO1a8tz7SgXrEv0SOVQYR3E 1kl/UBPiNKyVcivl69CVZ/8SiXJdtDbRPXtfb2+PY9l4NxjxQ9TuTsxZixKJ8gsTCQTvhFFL hr5NMvQ1clvmN71/6f2qlxmWLPwjEI5JFv4wWPdHIBwDC7+KGW4/0n6snRnuPdJ7DOp+dOSj Yx8xw8kjyWNJprHSA/qqORh6ePZ3ZWLtlTQ7gaXRSuOmHYFOQ4SOemwa1koF66SJgb9yvvRo AhpKnHk8cTaytlx4pfRIOXftWRqGAtr8uisT//uvkisdn2IPQqyHBfcQXK6u5wh+Xa4oMErR jFjZ6wxSK2SvY+RUytnXCfMi7kQqHMIXIkeCO9U22jadO9nWO9qGOiDOnQZQV+s3+o0hANgj Q6d9zPBpkUXfIJ9sGN5Fz/LYAXYa4ATWiPNcm1XqbIACjoIEBZeblzouD+2KFaLs5cZlkNhh vM/2mFm+SK/weZEgKH1evRDw1Bj0RKh3u5HSlPQYvLyXeNuVtQrcp8CKa6vH7XckoG+5Aehd rq2X654tcijMhUm4F1k4S62FsTScyvV+mnMfCPfWWrCUGpkD4+BGOtpGEom62qmzNu67RNm9 UZwSSHAuk9loJvJoJBaJRxj52RSR26x2q8PqtMrkwVCCC4dwnIKAC0DE7KEgAXmJkFUIoQTX BqRApz5O/7ZsQTmco8lMfSbd0NhQb8yGw4FAvT9tt5msFj1RyAOM0WKz2zLpxgYjFwlHwu5k a4dBZetuTpL5/7h7/6F533/ltnE3zOXM7syTs686r3PJpFDIZ13GfGdpNhLqmlksHN72Pw/M d2llpW8+Oj+sNqzZBSYYe//V1bx08orYQXYpPcHCteJdAqcxdSzh1nMbAlu5mwPP6J7nFPfq hnQEBwMECYGAX63XeNV2v8Nr16iwiii9KpvR6rXhoBoJtrUBA+cLID/nJ/4A8SeNnMVo5AIk 4CdRvcGi1xvIej3Wq682Yr+RM8hsAb9RT2TYHjAIwSjYAxgf50TOwNhtNrVapTTYsO0FfD0K 4Box4FM7a8P94c3hPeEj4WNheYgL+8JiuA9ytocHw4ptV8CSD3C5k05X7+hIDjlgLeHX0ebi gARG24zNRpO9GVOQMzXnmrfqaxLKa7k3ADtoJPdGwtjcDP8ciBvB3HAZ5s5NKLi2NkUb0Dhd NpzAfoXcarHb7FZ/fUNDI85gWzlBF6s+C4sVYRjm/KK/2VPjXl4cN/mSHvwXM/50QlJoH+13 z/DZ5MSz/KdH8PU3diWa3ZwyFNIs2i1r+eapB2M8GwrZuCqTWdX1D/yrYhJspa3Aootgrezo hheRHv8Q1yMlfvyAMF+xWkEwWNg0R4H/DQ6aDT8Ofs8/kRVybISIeoMSsUqFFjJ5TDC4PyKn 1/cZVhv2GhjOgA1Oh/5lsMiU5E3kIHZ8VOLv45SDKPfA/AFndJiavxo5jb9KAMnW1WIgS1sm I422oUK4giISIrttE3r50YbgRVNcpjpfZrIJ/4Nd+s2z1/ZUh0LRCZvJK5ek/L7gcSoNppWO M69JI4qgw6LKwuAltvU2oi6U/iVaTZZsnAla37IyHUpWcDh4VhW2vkR+ClRyD8gtFd61Pxzm EAvWvPo5Tid8qC3gPw4hV8xRID/Zb3DxLuIqMGpRYxHN1qzFGf3qfySZkOgdyY1M5071nhpB HSMwqNQIN3LcaGo2UeJorqsFlq9xh9TmYNjj9rqJ3BTSh0NqYSGuMroWIp8BYgFNeCF2m/mF yK8DIAl4SbDGE5SnYYZy2ArcCyydSdusFrk8IIRJfdYUxEAxJsrODfXAzQGBeW3/B5sC1d7O rvveWfXTtdf+esMH+K7iT5T1Nf5kzaTuxOQou9RTc+fhnVUqyx9eufnY1bdi5e7j+NZPR1fd Jt5WLGZDKx7DlmXjgT7SeDXZSNpBjrtELfkAIReLnbIffo+O+jj3MUr1jsCy+ev9ZOPoQTIR rz5M16AD1uB5WAMbiqJh0a1mXEycYe5TPaUqqN7WysYrWXuAVdr5CD4kzbsS7xqKRBCddVFr YJHO/gvk5JzESefaZHbFAx9qfoHplGNn7MyUn5RmfDR3HHV0jJSn/NsznnaFVSZ/SBc2htwu j8vrYuShsE8fWIiqOOdCHFZBTNDyC7HLBCCojpwz63EIZVFqr28njdJk12cb6NSDEAX5UmZG Sp9yK0cnv+OJv251t19Uu+tnq3++esOvr/tZcTmOqeOOlDOa9kS6EpMjHk/47t/f4XN+9OrN R6+5pVh8/LfFq0bILf0XHHjgopgt0fpE8W8w6TDrPTB/h0GjqdG9ogapnCyRKxUqtRr8b9Eg XWbCaowYlQIrFQV8UtSafOQVQhDhCCEFLBxQqZQypJUXyDuiWuXSbgf9dUrz1UF8J+XBj3N0 3uistQEX5sB4ES1E9Bg7iOjmANj1AGy6DjoNc46byuJta00C5BoGUQbrnWOxH8atCJj9GK/A A8W/Pj6rJRxeyESLzR7Z/ETVLPz41/dRSgiDLvgdjCQADuBVYscFrjWu+6yMMuAITHVN9EwU LvUsEhQmxCI5x3JyWW3qcvcG9wbhlsC77ncCR1LKnbZfu/7t+Mb5jYtNKbUF8pvnvApBwFJE LgR0EBGbvSbQ3W7k5tzEnQwIlkBA2BS4HVQEinv87s3CceGkwHBCn3BEYI4IWLDHPUIgHKpx F/CfRHsAIXkwWWM2m4jvl36/IMjlCqXPX8CsqNKiOBcn8Y/sBQamRBsMhVBF3CW12j4d1l1b M+4gdkqSLUdnU1IPHKgKTjJgpNQInec2INC2EdAYZfocWJNrpsqjOUdVRk4Pc0udQolsfZFq i8sacoajoWpLPIUjLgAJWzKFY45wCrncZxR+hULpEh5EURBwGm1zQqlt9jjM1nackEzHHNSQ xCpI1TNCFYwBG4gQWMKKesGMURK52XCA+Nzjc6NTLul2AybrTx3fvrLnO3iC6I41FC8oTp3T fPttM+58mCwv3riqWQiFAk2rmH4aG//8NfcubOeL9XNsPBMiy8nO0R9lblqx+25KBzOAonPM 68iKfLhenC03TbXkLKstS62LHRstipD6SfIm+YnxF+QXzPu6963/YP6lU2+yYoGy/IXMEma1 sIHZJNzA3Kz/TPeJVRVXlmxYqVIlkJJT+pSMMsf6bAhPsBVw9Dl32KxgC7hqSKtR2SR7PO3s sIlOIWtbhiB9AJLARDQ6pNFnKRYdxnrkSgkdwnzhS0Em+GLlRU5ztBLUl3CVqYzDtVmKRa1W nz3CYc7pb7qjbBnSJaECaTqXO5VIDIBWSCTaqEIYOTlKKeFk7jjmfjIgrXKVscobctiddiL3 mPgq5LLYqkAbuKuw3QoASUsMoh8UIxrI4QHslyy2hkY7lUUREEYmkEWK7JgMsjK50ZJqbs+l bQubhGmFjUdWXDj6zB2/+CIQsgay/lb81QsrZ3VfZNu9Zc+WVz7D1k8fefgq3pSZszsAUwFG OwkCl3IgrT2mzUZ7xwITHjRhEMVyxPHAmRwn1wR5eQF/8ZyAgzxLIwFtkOcgItoC8KScVVdY I67ViNCEhrpELfUUDSWzWQn7AhIWA2Z7dlCDt2kw0nAaormGN+0xDZqYlKnDtM00bDpmYk20 fl02S/GBZE3WOH0YuCyRyA2cyuUGJOpvq9gQbVRo56hcGkhQWpdsp7LhG6nHQzXdRUV7laWm i532zfpFjbJgkAj2RczbCxtlIUqb80r/YD4C2qxDbWSKaIWxNst8XHNabBufvb3+LsXueqad dvrSqfUHmvF1iieSP2h7Pvlm8n3/e8n36z9OquoVPYop5in2yfWz7UuU96Dd9Y/jA/iAUptR 4M3tO2W7kvfXyVB7X/si24L2NfZ7rXvx4y2v4GPtaqWtr31dKzNJSawmK2mlb3nD3vxlK05n lCqlIlEdTVSHEtWxtsyzmUMZRpYZl+nNXJv5XuahzA8zL2V+nvlDZiSj6c/gTKtF6VcuVl6p lBFlq3Ka8mrlrcqHlE8o31b+TqnSKN3KfiVjMSkZhy7MJ6DF2JJU6ySS3oFyqRRxiLFE1uDg HfMdqx0POfY6XnEojjo+d5x2MA6HqOeyDsIriMZQzVenqjuqZdXjY92GEB8ioc8QSqk6VJtU r6hkPkAEqTgVURXwIZET2ze3E7F9QTtpf8qKrdR/FqN90Y6SG7sTqJFrJI1pVgyEsqvZEyyp ZUW2j13AyljnuKYLHAVcd1PZ2wIuGjg5kHg1x+UGwHRcQ8XsqeM5UF+m5kQKyiljge7nRk8e BwsALPGBNSYKQFdRUdvM/UTJtenb2qgNtWafnHSfP/s5rcPrICg3p2wnNLV4AmqOkRlC3rA/ pAk3h/XAnkjrU1VhIdDCNFYhzqOrwmoBQJOstapiJ1BBXJHDW7bgNQM5tIayKjAs5IUqJkOo vmzGSmY9mG1nDQlISpI5XebpcMQoL9fKpMnkZ2/pW17A9XYx2hl3ecKTWzsuWPPuqpt22/Vq i87lrkqvGN83V72xNeJ3JtO37Vg2Y8Wzd1yyvDHmNTmsfCJa1zMtM+mGCQNd8R3Fe0Q/F3JM 6Z56D26eOLOhsSbgplbGzNJx8mug+zR5RpynqbVyHTJOF7Nw3phMbrFZ3gy9Gf4d9xn3b04R 40LxJq4hvlVzT+Ce4NOaRwMFzXMBDatldcqYVTtRM1UrFzVgIJrSPNpNeIxFi7YDi+D4PQT+ VwH3gOe/25SCjGzqHwkH79zt5l0uytlQZbsLuwp4hVjl3G37h8nEhhMKU1XYpDGVxYloArPv YpO/UDr2nMoiv4BGwKqxkAvKTqEk4jWGbDkl6Gm6BWQ2D16hy5DFqeyM7Pzs6uym7N6sPGtS +mgjFJILDEpeSZQiPFyOCa5YdExDRDGNggmgz0admaaBstEJ1Hh8JAeI7vnsV/rAYFLSanZ4 RCla/B3KNmsAgC0ESRhbmTzmgEIYOLWGegljj/p9MEPSUFTQhv8SeJ6OZAiakDC0ImFoiOL8 mbbAJEsMUJvNicWoAyYZDDcscm4AejsAna1ccQ7oHfqiqqoqQ0dVofSnIa2ljKEGxXmoLlWU 6h1EbGm/aIK6bBVUZKugFmsZq8J9fhK6jrmRkyOI+5wOQDSkRLWxIyWqDABgLLQarVSuRd8c SkLXQNwfGSpjGKrT0BFKgn0JqV+JKoiEkmBohgql/xmy8xQff97h69B6nP4OdGZjaQ4CjUl1 YC6HEtgcoNwksYms4gVJGjDAZGySC0Q1IlWPwGFlhUnuNgjjbuiMtVh8OJybfseF3f1VGr/N zwnJBybUjmtbujPZdc/3pk10G002B/Nq8dU7ljYG3c7YW7dfOP3evrgmjftuvLE1Xjth4vKm 8xat3BsyGAIVm0bWA1qzCmzbq8XAfbqndAd1z9tkJlOjEjyMKmLnkyql4xG+6scBgwIEqIJq TfyInIfIxc8rEzdqtUoNPewSnfaN/rBFAU0hatIQZRw5OAdxxDElLj2lRzwDk0FgJleKksPU eoqGWsdlKYb512f7UkdSpD+1J0VSfBiHRclGsdJHOVzLiVwfd4STcc6api2OM4IVPIHcGpji U+XUSFmfwvrRPStO8sxzCUbPtcEf1bAgLKNCXGcOhgIhcGLD5d0qfUgwhyMorgMQMvojOGJI RFDZggETJr5lS/dsMdWv6zf3C/3xwdRwSt6v32Rab98U6I9dk7zZflvyPt0O2+7qJ2zPVr9Q rd9suNVIpAWfI1FmCkYKFCGNGMhDmgAgFyzRBrVu7TbQ+Wz9mGFUFq5G8M/A0jVLshfopbzh xfxSrkw2Fa+cuHrC0NLzl+5f2r20VaWt7do6ZUXIEUplk/bo7OlgKLx7hcXvk/l7776wfc/1 L+348upsJ3atsHk98dGb77Dw9z+875mw+TZ6oF76Kz7NvIY0yI7SB5ETJt1pMmflk5FCO9mk MTCTVdWvgPpzOt4/XJ743pOjZaMQLJYETp/VCeZz4vjCnksv7YEwfsKlCylmXpOSEEbXLCzH FlIpDr62rI55Egn4+wdREN7+xNT6vuCRIFFp3dq4drJW1qzd5XnaU/DIvlR8oSSCqNFl/RSA dWcG284sO6rAJQWmZl0gYAjy5kCgKsgLgQALNp1zsUqj1iBBsFjMciSPV0y8KrnYMzErF8fV y8VuCM0tkKitAxCJAhCCABJJAFU8AM6YPSzHBjn2yQ/LCfh6ciKnJoI6KPo7O4Jie32Qri00 ImFoR8LVNRLOx8vF0LKEoUmKRSc4B8NBzAcHgyQV7A+SoIWHiY4bqAoYgoYl3NiSlXCqTsLQ mKQhzN5g9oQep/TD+iN6Ru8MTD/DFpJpSbd4QWivOSOFwPQ4J0Vtz5ExD6+jrW2kQ7IFcgOS HZqQTHbgrDFrVFLv4bJB6q/o/IZGKcm8Gx1XvKH75lkzrolH2vG15pg76I02RdqZJ0eDK+oV wWv7Jl96/SN47fKsMjS65bKWKrNrBj5JU4hBvcUJzAegw2vRODQNvyvODHEaQ0d1aKvqluRd sf2yg6p87EDNieBX49XqjKpe3ixv9U1nlUDqMVWMb+In8d9V3hTfrXoy+WS3RpwU7PLrYg4O MS2KoKU9pktpJcvXBa5Pu2hqbhfDkWw7XdN20erI1rZjWjxkcmTbC4xMtFrK22Lexh1arTdF GBEmnSkwHlELPkbdjpSiJ+w1TJIcL1MHxaIaeuubhCdNcrSAopDEla4Ft6QdaxQEr+EVOKXA igIjF2PVXVSfAgB904UNXXwX6Zrk52gmJ2Vy2MDxHOEKDCtawtlaaIpksSHLZ0lW9IcT1fR9 PORWi9FYtpoanobq1dXbqpm+6iPVpHpDL5id1I+nFHC8bYRaliM5UGgVOJobON3GHR+RsmGF JbeubTRBXfrUCLVFK7alReT92cSckYTkDybKuQdROww7BNNHidDLZ0F2UeO0sh/QXAnGZmkj eIBqOr81YLOPqTiq8WyZxrSUoSiTU7ahsQzK2k5RrpOWdqYYyeAcS4XJA7h1qM7sWP3KFPma 5LjG9h/+csbA0gu2PHXdkbk9l1y/fO3NVx0bzE1p6ZvR0NaX9F25xN+8/tHbHzK4r2DuX1UX bWi97K5ZbGssWENqxJsuuN1fV3dRbc1kp7im5/rauj3Lbv1J+5WFe1avemios/ab/zHy9ZlZ U7qdxioblVDh0j/IvbJR5ET3ifptmm1aIgGNFjkL+ADYMTKLhbHeQLDcp6H31BjNGtVivYYw BawXvazmgNblxjIZMrA8S9i42WbdCMJIBCvFTJeU8wrZlHnYfMTMmJ2u6ReMueJtvdxJaUsG OJRueI1AEnWMHs/RcyXJG28DZxy4dQANYGPGGjhji1NTHJg1IG3AFz76yBDmOluqZh6Yc41R ffV1+7pko8VnFo2+MjPlXWQbXjROuBf/OzDnjY10rGmEmPvZpciDPhGDt5AfkR8wTER7D0PU IEUxYt2mPbbnbMTmIcSO1Rqlp4AXHDCl7IN2Yi9gIY9NSok9dFllgQk+p2exlqE7fG7EcjD4 D02/MnjwKx7scVUZMH4F7AGn9wU8G29H0o5sboDSLyiY8qaoZKiZlXQzT0m39ZQiGGBKUddc NupGyxtHdmpm6jrs9MVQScJgk1KcB8utbHMaz5BqzthM6bRZmrscyvn99chEN44ERUTSvNLG EvanYfYyTN/pP+HVD1x/ya4LQg0fbr/8mQVTFhd/gEMrO+NC0Ib345rty27fpRsuLHhy8k23 HizuNyV66Dx2FXfil3CGfkkmGv9NsEIlw6+hd02TtWrZVGsBTxA1OMMbsKHTQTejYcFPjtKt 95MjY1uU5voGifSp9i+r1PKu+ZJ1yxQKhVzrTbRedNnEC6/+YXFndfqhWUZwt43z2rsuu2nd to+odTeldJzZL+1hJ/AU0alyy3l5SBWzKxxuq88acsRUCiXeoPQWsDpvYiOAhuQ6k53uWIeQ GAxnkZioAZBpAAB2moj60B66j540GQReIAKtqd+mwzoqM3XO6vK+9qnEGjDEwF6yC2IwkhVo IwJtRKCNrBbwQMWhOCVFeke6KysIlaWVg/oShkco3g9PLbBXnqpYHWDFLcRxn5/3E7lBz+mJ PBgIBYhco1VrVVqlVia32iw2Inc6XA63g5ETzGAZZuTxRCxB5FVGYSEKKwB4zPaFOMoC8Ou9 C3FAG1mIHDaIJTDEEolzjyXpySTw2QC2KPREYjBqqTVW/GCWG9tLlxs5e0U9MvubhbXfv3Dh g+Oq/Yn2zJF1639W2118V6YOO5sSzpDLYmiqSTvjcvLEO4Mrb5t5WW78wM5H/3Bw56MP33Lo Q3xZ6+11Pkdg3+iXxWMLJ9b6mq6kdFWDkOwJsNmrsV/sVchU6mpG0EzRgKUjV4dJmAnLwuqw JqydwUxQz9AsUa9X36zWXx3bXrNftl/9puxN9ceyj9Wn2FNqtd7ntQgBr89rFYTwzOrqAomK yyPesEGJlTO12ndUXiUC3TWTkHfkXkWVzxsUAkqFIky0M3RkBg6/EsIh12ANrkFYZ9DzeqJv 9xoQPT9tr6ryOpMWa3U0SMAL1ep0QYve20wzQigaChKrMlnzIibIj8ZhBTB+gm7l0x2QtpOS MmobkRJYOkjn6F40CME2uilJD94+5j6WKlFH7XPEfZX7D0x3oXGuLBQlHjZSjytwztFc47mn yrQUlo5kInPXzNAGAuanV0Ts3c3J0dZka9Cl19BDZdlVMf3aK9oekRVHf9Ww+YrRi169pngp PUoOWfWCY0n5WLl4za03ug3SvsQf2YvYFSiIvQeRrbR5SKXOegplLK9gHWBxDkS0LpW7wdzr utl2u2ub+1aPcoVxhWmjcaPpVuOT8qd0j9vfsr/jVsttKNxt6/Rstt1kv9l9o+d52aEqdSq8 lN8gX69b777Z/IJB0ag3moJeNJd46Y6FRYSo/2mjSc8u9zL65VYVnp8yYqOrH3wrU2jVQZyW RC5wqsqg5tVE3et0nqSH/0Pl2MgcacLpOQswHQglcKErDvRPyhcB0vQiQNDmkeu0YXtIqVKo iNwd1tnUIST3ANA49CGkcrEhPOZJJbZsoSsDVqbEXMayK0wVvUnydK3UVAhKZ4Jjzi97UaT6 xH2bfl3XMe+N+zf/Zv2afz7+u+Le59/Bc17b9tA8py+lYFcU44U3vr9+x8EDxd/s7L/1yg0r foQnFF7D84bbg6kM5ZopCLFa4Bof+sFBJFAvzJUVqO5t5UxZnyAKfcKwIKuFCMF/UChOwxQ6 fF5OEFQ+r0EI8H9wuU5XeXmFK4p8hDMoUb+0KxQXBaVBxauIqt3JObDP0efY7mAcPo7HPr6P 38Rv52X8Cxh8YfKjIf+q2dQ6o9cvwC6nW78nK7u/o21lyh1NVEh6lCr1XGWCIv+NdgPS6ZWR 1QZ908eH5y+2d7ckR1sowRo0C29tv8geZqcV79y02m/65rOzdCqztcy8F6+m2qEPaPQE0KgO VeFnxcxSbqn5PvV7pvec77ve97zn/atJpXAoquzEobW77J4IFzFHLFGXuopeRrFTYK0QsuEc gqZYSQn7MkrptBamwLQD30t2yncq79Xu0D1BntC+xb6letP7Hn5PpyMyhVKukqvtGAwIrV1n 86qWOJd4rmI3aNc713t3GA44Dnjfc59Qai7U6+sRY6tXqEwaJ08nE8RDL5Cvs3xw1isymHGl fB0+4jOYeBMxATFTEh6gRC0avlXB1DtSLhoZ0ymUoGdSgm7DVVzIG7aEVSE27HQ5XKBjdKYQ zJM7hK1KiNnlEDNq9SGs8xCA2Ky2hZBLBgCsNvidOYBN0OMPcKXATHlOKTc1s4XSSTD4m4nD 1KyFQAqlT/LGZm2h9DkglqZ0zSpI7dM1n9k/moPHYkAUOIiMnIL4fZGwkUMskIGRK1+EMdVz IP/teDy+Z8fbxbuK33/7QbwbN71w6YyrL9h5ec/shZftZudri6uKvywW3yie/tcbWIdr8F3T Xr6/+GHx8SfWpUXs/BPkaVah8omK3AIc0407RFO3EEB+H+fzKgXBIZo0HQ5pV6fR00F3efY4 GJ/P6yiQ3z0vpH3euCC0SA4q1GsRoY6hhW/Z28J0+bwtUOeAoKAtKM60oOAUexQM9nkVtIWA 0ee1C4HYWAsxqYUYH9sbYwI+bwzqiJcEMj5vsxAQ/NFuRFVOB72mFY/FHA47aWluVioVygDq 4sDBak8bMhj+zc/gzLWoZ0EPEXv6evb0DPbIenzlrYB2I+Iw/OvjMHft+HHrK170msolKXpc U0mc8ZYpNDWvSQHn0oMbaWlyiW9FGY6lNnrbt++EfEvxWCUmlluN/v+V859PkNr/1Ejkx2Vm x0dt45uryRvVbQFI0fhoWzlOvluc958qqhwvbsabz6ZO33g2jh+ja7+8dEzmB9nQjJNis6P2 otgGPyPXY5VBkZDXOgz2RNKQ4GLGlOBLBKsb4g2Jy2O3xm6NP50txF/ImpvPqKDJohXNNTTw DaTh6Tqvt2quz8v7eMwX8FXihKq5yMW5iOtpayxhUIYNGoPBo/EYZOsN62O7DY9r9mveMMgT MYNGFmDr65hAvVU1A499MMTii8oX1wqYE/UmVyvdDmot74FD1nN8XY2zpYCb91WkxHG6UZgA FypHz12oOqOnLJLf2oy4z3MnR3Jje8O5ipYre72ij9EwBhKKhRPLNcsMV2s2Gm6O3ZS4x/AD zSHNTzU/NehAmc2hLu8Azp27tVv+WS0yyVSkSi5gPLO/G47UkMr+rqTjmNc0Me+fb1yyweoV U898Meu84j/fFddcWMu7WkyhUPU3d/bflFl648FHLvpif1d7aqvbVaUDpdf2zOErJiYDqRr/ +VcuXXrzM1+5gpZojKD3/3z1zNq5Mzsv3vzg/EeOc9pO3zi6qjEQ+1/Q/0EE3SYm/ZSt1D4v EQSXz2sSBLfPi4WAxuc1CgGTkRCsdBncPIjVdo1aOmCeEOg4psa1alHdrx5Wy+YDIGqnTzq9 cLu92WN+3O8f9pNav+if79/sH4SEXOImuu0kcVRijIukA09qpSVC/we2oExAvvhvRA/MEPov dC1RcnmkiqUw0gY8Q1xTRW/vaaqwquqaKlLb1NPQ1/QkehuxIU8D3oA2eDZ4b0ZbPVu9O71P eT/zfu3V9jcdayK8iTfzFi7IhViDyWA2WFAQhVQN8nOnrKbFGxaE8pTxLd6QEEj5vPVCoFC6 RexGXo8PIxT1uC0ejxs1NCCU9FZZgAsQbvB6GB67UEM9wSQc8npMRiVCjU1uzoVd7erDmqMa onE1Sac3nqqs1KEmqlZVVlu2qYqPpmpomZGW1RyrIcM1R2pIjbOxqYDPH/LDnBdw9U2JxPST OWnKwXBOrElQ0xlm30lNZwesAf2jkDKByd6s3FqTYK/l3gDskCJjd/ypLZ1bQ402NJDA+P9f RuFAeSNbyrM1nLukzBHcT6LVbUHnWRFF46P/coyeYHUX5Yq1+uT0qIZAYYLE8c+Z62BF/Y7F p68/R4KNfJOQvXu65zJ7uiMUwnw2pbmYmXt5JhKqULfsa1jzOjxdHLHJnCriy9Rm+jPbM0/Z 37O8Z//Y/k+7aqN6nfU7Nbcy37ewt6rvY+5T32V9inlKLfdZeqxipi+zkWHVjFpNMvQ86G7Z /arHZD9SPWFhtRgpqEuk9CqophOExMy6uj9WexPymRi/w3rlftBMQgDLkVahQ1bOSqy2hMVq Y+wKu23IVOOoi8ZwjVbriBGHUq4wKGYoSAeAbYq9isOKowq5gd5WVKQzexOvJEgq0ZGYkZif WJ3YlNiWeCihTNzA2fpt222MzSWCHkMGHa8juna/z5muXOmVlrZirucGjNLpcapNOmGmt8q4 kZG2yj3P5hzdpDM1j1maY5ZnBUtqS9rBSwzk4K/iRFEfqoZUzFCaZM5hW8nzPceRqnFvWceF w9reJZeasy0zX/5LOjTum5VlLmbV7nBXUrY67F22oGkXuFPvP/LgaMu6uzPF6/vTvsHnijPH 2HqeNWD2hIqr79pcRf93Ai/Yqztgff14IG+iZ6n/AkuJInGDtpnzeAycx+s16FqoieKmJoRA WrwKgZoTtmmV27fg6/o5jx0bvN728iU0r1tARoMeY6/dD1aDAhG7DSx6TG/m6vB8ej+qL4AD nDHqQW7c58bIvRpk4rVCxUwYyFHLgFoJp8ox6siO2QfSdEuTTa9IbZVd+waCTEf5Bi1lra1c 27VvbOXewNK9qdkHESoNiglzPTJwhka0xtfv3+zb7L8TbTds9233P4ee8+tkPpk/LotoBHPc JecKpYvz5npAT4CtRL8v4yyY47bjPZ5BbtCjRDnJZEzQQ6j9nNLiptd/jokqk6MDKfXmDlQo naikDJYOMOT/OgR1AP+eHq2WrU7pChami6wA0awnViNl8zLn08tYkTC9olIkDwRqB/Dwha1+ 4fSKFT2+It8/25voamennX6eTLw60UJCIU1gxoJvdsiWnX7kyvOAgeeuZF4KNggkBKs7q3RM HmRXogxeKdrUHBtkQvrYVfwt/I3BG0Pfi90SVwcq7oX2P/zoOJWL3RBZqliq2aDZEDzIvCwr yJ8PPh9+Pq4eH5gQE+NbYzfH2Z3hHfEn5Y8qntL8OPROTDFF76CXBfsduOptr2OeYJdOISFn kx0b36YmaOYcV1pAc2ufTlTxmON1dodDYOsTjK5eUIEtbiTGdlzlqi+ftXPZelPUma1/Ec9C frQKH6O7G9Opm3Kg7ChSX2SfSnKuE6fawCCRzBG6nUEJxiSZIxULRDIkpWvFiDonPdQ5Sfvi coMG5jwUCUYYuSKkDahCSO/nusDjNHDyOKTUEV0IGXy6LqSMSb63dNFDOt4p38SVfEt6xEP9 yyDYJmTM/z6jg+WSiJdT64Xuc3HIP2arsDeFuosnH7rvp+fP+9n36i5vsPXUBchdU1s51fXF v+54tfR64wQM7vfimdU/NnlqLWCnCG+8+2zx5w+/Xvz9bVYLdvWlwqEQywfNU4oft7Que3bF bc/iNH6CU06NNVNJXls6xj4GnF6DGfFhh8EpEIc6IsQD1wS+p78jsDfws0ApoJK+lWPAYicc 0w/KZZNtk/2g/u3o+9FPono2YNVzgs8fDtT55wqK1/xfBcgT+gN6klEqqJkj8JIQj/tqvEgI lh0Oh92OoU3t8qAKuN23icfz+RJP+Gtra8Xavtr+2j21bK2yfAreHov1xXH82tSYs1C+DS5J gYGyFBgpC4HE2JVIcFVUBnU4HNKHNCFlCkWiugCXwoJfFdGmkEEAQJ3/tsqNHLpKA2swBDNV uPKKuq1cf4yEy2ZSWQ2XD42ls7mwopa8GJjR6my8bsGq3b1hb/I8/BtP8zSjruPkrwYX3LDS JV7ITgv5W9aNLj2wfvqiH71PYhdPN9hDoZoa36zR0S9/nU+Jbz9N7ruyWcB0LUzSlxDTUBJf TM9mP6G3OwJUajyla+ZD1fZqRzyYCLEWh8XJB5eHZbeFH2cfCR5gC44DwUJ4MPXXoKrZOSEg pi6vuiywIbA+uDGiDMmCbDAcrg4nG8BCS8uU1mDC0Z9iEIu9yObz6qcJCS/2Bqu8oG29umkB zoM9DrfXwyVxMlztTQZDhhAOJe0Oiz0UtjuAmqJy1iIPBeVsKCS3o2TS6/UQnV5ZG8bgIDQM iSxmC0QnquTBdbxjhoOAgRQWrXa5wl5ZUGQTQcMO2mS2F8gn9Lhe1BlM2WMpXJNa6affUCRy YECN5Mp3IEdoyKExSY8lm2qrEgwneg1WipQvxH7ra4lc4lwk7fBQBUt53CqnF1n/t0VFZau0 0OBRmM3lC9v17GB3ML2y+HtbZ8O0UcVEydcrvjp/eie5zdua6vvq5MUu4WJYZVVV/FDRWiws y5zx7jjS84NxOBQSzME7ix145711bpOTlewnes9ZBysdQtvEhoV4A74m0B+RbQ9sDz4RZM5a vdMq9i5IDcYdCCIU4kL9oc2hPSE2VMAHRc7njxLwHzA4YqFfogdwgewVbWddCWe4NiJG9kSY cdQzy1Usl5MnR0FxSreMgZmo4rQ3S5wjfVLC/J9cBLtkkIBY0mW+mXaOp/CrVslTcAScCwZW bl+Wwh8Wg//FY9iztFmvmvYYPddIwAzopa+wgmBFXiDeeZ8dmxa715P1tU86nq1+oeqF6ncV Hyb/nVJHcROehCe7LyBz3IvJzeTG2qfwW9W/rv646hPhVNW/hH/VGicpwyFPMBjR+7wqQTBI W+21oSomiGp8tXVxFKoKehBSWTw1oZDKEqyxWi0kXqOk/0Gmj/MR30fOB0wyVyZYZ4jwERJJ GvTOdKaAZWDez5Y0Slv5mu4pqllQDQf2v6RZakCznJRoU7q1PSId7Ur0OWaLVOx9aETB6duo sUfVSiLpD9gcrMIeEsL2kDxcHQrYfCCfKEgoalLY7whSEIC8QJKNp9A5n22NXSCkq0UP7ExX 136aJOHqRG2zMKf65urfKuS0iF51kXxihdz/v69yy9ny9e2wwmhUWGyVy9xhZtur0/uv2VE8 NjqjcqH7tk9f679j9I93bJ008cbv48aGvq2TZu8ih5PixXfuvGzj2evcsx7PLdxpEtfNnbu2 DY/eX+wF5TVx66z5O9oq5yjyPljtVnzpQTSuNDwkRLPjqA6/nzNmlVit06Q0rZPxZN0q3Xq0 Fe3Cu3R7xhXwS9qC7vnWwXGnkWnPOKyosde04nbdrNT5rcvx5TVKpG9tNRgMrTU1qaRBgRU6 pXRyYhOEpM8bnic0tjZ5G+UYPAbO57XOC4AiArfR0IAbUvXehrdSOFXz41ZcEzW0WqAV+j+C 0v+xKqnXWfR6HWrV0XMxcMSle7ZNNJKqMeh1GCnHcWeitsaGcIjYrAq5Uu4Sx+FxyfK1gnZ+ TxWucraNe5GcL528OMu2ycCY8/Cx5BXSMPZJWCKh3Npbud0v2zom1nJjci2ROOczsEoixynb lG0SaVUuAgCR0GWvGIzZCFaM3eb/T66uMHXly5SyFcJcgP+weHJ962h7d2Re8Sdpx/ipo+ef w+eP9gCba/E/lyVsFxHjxJnfZ3pGn70u6QNNUGWLr8Nb48U7lmf/Y7fAovc7Ly/OxTsuyIRt GgbMkdh6qu1Kf1TQHZI6IheHtqn+FSOTHcucTzsKjrednzo/jSmaHVhRbQcZ2YBmpOen+zIr wHJOcxnqO/ZnNoOzuSczmFG9hg+n/4z+gUppdq1qrXNd9CbVDc496EnrIHodqRzOGKj/VKYZ TfZNqFuD1mAV4sDw3IywyulUqFRqp9Phcik1IIkI+osMtGLZzLSbvEZfFLwYBHaP1uDleFeV l6+L13rrRFlMhjSF0o1DDo3aVyhdIy6Lga3jKt/FUyZjUUssFtWW76prkg67xeGwq9QqpTrq cELcKVcoorE4VIrbtRq1jIu6nCqlQu6QXwCGTiweg7TDrlXJ1Zo6H28EotSolQpVxm53oU41 fgn5UIy0IRE5SAfEudLwAWAjjsoscvkQ1aBjWxIJl7N31OUYdTlHHdN7Fo8/S3RlsjM1r2kG 6U8/2AHKo+TGbi1/iliO6Ok3iWdjYMVKMq3Z9a0PFP/LZ4rlxFe5rZRAqdvVBqZ1eZPv+bhP pcv6ohiU8RxpvyM3MCDdhJbsYAUOYPgXrpAk6GJsjoA3TFPSxTyqm6Vrm/WKL8JZi7y5eFGk OFi8I1TsGt8gkmkTU3VY/ZummnRnB7mzp8rqSP7zDwGuaQYoaSYY0m775mFm+el7ZbOenCAP hUjEG75mdBUh29fPEMBNUiv8Vvv60etIz9wuTyxFJG09ASFZk3QKfPQgkpdO5DXN0pZQamp9 lp1ASB/dEVKwrNwmD8tlBh0SUDWv4wSuWm7aq39FT8CTNQd5fYF8IBqFCL0sJ6iCvC4Q8AR5 f4H8XlwUiAb56kAAg4dcjRxLZArB7wchpFbyKqyKW8z04puZ3qEzi+PqzWI3hOYWSNTWAYhE ASSSAIQggCoeAL1DZ8YGM/aZD5sJZ8ZmeoPONFyD+ZrBGpKq6ad3c9rrayo36WoqN+lqKlfn aipX52oqN+ukAevN1mwNMnh4D/HEoxEpCzp2IoJTkeHIkQgTqVyhi1Su0EkYOiVVVXn92Ygz Wbk5l5Duv1VuzlXUGljg/3FvbuyjDekkAHSssVm6jJJgqMjD5QspfnqnTCPdexZVFm2HXizf lR4WzTYdpOx6AE4DAOB76VKf3zJ2O5p+8URpcA3dg0EJbKxcSfn2ZyHSjrJx7DPbM5+KvN67 uWf2tbHouGI47TSZEu7otGqDubUYbnUaI+CMj/55ZvdlW/cU76L38oIKv2sxfnhdq7+xp6i5 zCkog0G5z7aCOSDdzStTWSPzOkoQGaWyT/ZrmlVynJSUz9T6viRmgcJCcuZ35LfMb1yMVV4P tMf8Fh91E5NBDzomwes5P5fYa3jFoMRujyXIG8oUFwYqCwhqoECJ4nyU4qwBoMNEIOD3+QwG vdq5hGVkCncBzx86Qg9bS/vFCx31eCMYHnK1RINgM1EitAD9GSzYZzlsIRZKkBYgRgslRotY 3wAAaMhCidFCydJCKdJCKdJCKZKzYAslQwOfHEySVLI/SZJAg8kKDUoYGklWaDFZob1khSaT FZqU5sQAtJj0lK9AxCOR8BliDONUeDh8JMyEK8QYrhBjuEyEwWzYWX2WCCUa5M4hwgT9buQs AdL7fW2Vz4/pjf4R6frmGX/zW5ToK1Oib4wSDZQSfWOUaKCUaKCUaKCUaPhPSgQNvoZ+uZVb Q78IwdZzPvr4Ni0q/tdHS69PunHaxVdZuEh7MVJv50wJ14VTIvXFiESIzJMbp09cPLX5keLd KyVCDDkX4T1r2/zXFDXLmhQSGa4knESGCJe+xA/IOGIDG90t6kDBFMsf8U7pGfuIt2PsI14Z 981RmR8/sBGWIAvU+zjISBfY84fpTPwrr2320R3DeZrmGWG8w3HKfsr3b0EWV3oQ1vqk7zJ9 0keZdHs/4K4xoRqPR242ETClOD/2f7TAttn2kI2x3ZYCz9Jd+Y5Sh7SclvT9f709a3Abx3m7 B+DwJHEEHyAA4u6Aw4MgCL4EiU+ZxwcgShQpUqJtkrEqQCQo0ibBtxLJdanUcqzC8sh2Z+w0 SWs1k8Yzqjs6Sh6bkj1jdlzZderWbJxGbtMfnFozqdNqEs/E/ZEZEf1270iLcab1nxbk3ffa 3bvb1327+317tpSNsT0RDO2yayFT8NvriGQvBXXQqE7Kbi8Sqs50glTiVp3ppBJfLRbccPKX gs4tOvlazRRd2xqBEL/DIVJUDSt1Rdoik8REPIlHdtTmIziw9YPn0j/3FZ09f/5JZmLrwm7v x43vnX/LX858+97rzPPffukisRGI5u/oPZCDThTGg7LdkTQhJ+dkcLmrKCA4ieOcRwqd1xn5 kNVauGC3c1YnKKx+7JeNbkdEtfKnC7lNrfvjA5GNCFMXkSMDkbnI5YgSWY8YI4WFyO4SXIyr qsghb1v5r3MbnIFzVfbPq9astCJzqgk9p5nQc5oJPamlpENurqV+ADRoRA0a0YJG7gv6X9vD 9jtk1k11DNDcAhrcQX2BIRgIEU9rhjWHQIXU+8PYa3PxqKBQsAAusaEwdhfwPPKZ+PAuHypq 29I1LEtPGObMc+JK4EXTK4Yfmt7Qm/7Q9JSZWdGvWFaEleCLhpcCLDUJGIGeXbU1VF2njBK1 94emo66iNGxb/+Grpy+mrqTOfvDk4dPN3/UbLdE9+DxrOdy652D9vnDnQ9Cr3zs7v3HhT37z ZN2+jP4vBosrPEzw3g+2UitS68GWVzdvD7SQ0qyCk2SYRlZUgX4ml/HES9JehByoAhQ6B1fB OgOCg/pHFgSEIuofWR4QKt6km96xZL0pvi9+lcWsDK2lgnUUWcykbCuAq/rMybqIzaauTVSV O4kHpVP1oHRqnpMUFjsplGtjdXHFiS85Ma1UzsdlfoBnBD7FX+YVXl/Lt/OXAFnnN3nWS10n 4TW8y3OSI946tDjb72oL719ySPhSvxTqGP2aLI+OfvCFU+U0Zcjy17Za73l23CsZ/xhxr8So P39HdwLeghL6TJ75nMUBMx4x/5C/xdySPsa/wP/GGC0mXM1UlTwsTJhPCafNpy0L/EvFrxa/ WrLG3Cx5nb8p3eI/DBYhXFqMdIUVG2gTSmMDb2JGj0ugB/EVl5a7yn9VhIv+ozxkNfp69FZ7 IS6MYs13l7rQeMxFcTvGl7ECMdxXg78MMkFV7WkwauEIfL0yGt8gFuea55fRFdB8e4kxt+ov Qw3E++4s0Jnnu/NcG93h4/h88zwd9GlmsaD9LswHqV8fQ+wc92xn686mAapDyj6dLHTemn1z c+Lxj5//y0RTa5+ZdTqFOn986GBjb/3wZ+W/fwa73337+asvjDZ394+3u1x7+l4+/1lrtGbb SvUNyN0C5MNDcvl7bhy2YcfDpsIQjGWNzpDRbLJ6Zf22F5FeDkXjdj3WuyW1f6HggAraKbje vD9OoByAvFiXNiQGSbKUkghqkKWXJUZSzYPkDSu2anlHISRN4OuQb1YXWcc991p4L3Gc234x q/mnaYPEfrXvLlJfvm2qVWo39nFQMAIv8gxbUlxazLBsyFPhrnBV6IgVURie0svjMrODR+VG b5hYEYUxryvkcbHFyaMKgzN8n91ptIp0K9Cr1FfiZnwQH+TO2Axz7IpthZtznWMv2S5x51x/ y7wrWFaMcwVz9pXyS8ZzBefsl8pNxLB5foQYDGn2zLQYHU4/HbBoBqr76GQy3jr745nM2dsf 3fn0wz0HnYXWnpoYHy4oCQXdunf+4N9z733r+7jynfdx9EDfJz967PiBQy7//hPYd2XFW0rG Ir0I6bJQghEcli3WkLXZWmLj1AwFVctKVpU8QjyqeUMDPHdN2EtJL6+y7RyFcrikLM5F8YvW 56KM1VUAFd6LeBQRvBzPRVhcWuZ0Iv/3BZ52Us53BS/tpKSAECHvIq9kabDLfBvoMhWN7fZT RH1EEZb3WuzHkeUmPoH0+MQbzxk3jJtGnXEN35StKGJ3CtD3VEl+tTb5qZ4Xp7aB1z2iaiNY 4iiLr/vxnB8jP+dn/P9S1a/6Wah9EXRFv/718bt3uTtqX9RGdkoib3cjdTsjnRKo8Vq/RRfU NEVquzlpk5mlTtUNTF1X094F7x+/2NHU1VGzt99oKfC6I6UiNtpqm7aM+6MmS6hO98pPnj+R aO861K1ny/zt6eXbTc2cx6ULBAzNZxnDQFmF20D6sMMIsctQRkmmXxYOMNjhEGQL32iyF6M2 lBSKQXdMsnhfoysgQKd1+zV/LCBUAiKX+DsCQpvkV72q5DD2B4TwGvPxG5LcihsDQivgcpXU GRCSkmT0x/b5jFjPtzVM6PkJiwUKIMm2tVaGS4otPTI0M+oy8yDvj6Oeyz1Kz3qPvsfpdBfa 7YKdsVe5XaDKu4iq/rLrbdeHLp3sugS6wac+f1VNDEQxKoq9HfswppNjl0BV/xTZG4VGprGq s4O6+Xj98VTHZgdzuUPpWO/Q1cJpo0PX4TrQs8Ycu+4jOjbRybZNUWhP2HZvGx5vozMS88Qe WbOPaCf2x2QaVV08p+txqpWXpmXTZh+orfd4rQUGti5UEao31PCYNXqtbh7bCmrZBh57bLy6 IcL2Ag+dLT04dEZ2CKLJLIIyYRDMvjASfSYjpoo8UtWJQKpns4dhbQFb3Cb3/NRqOGI4Yuo3 H7Gu9xiamCPsEdtvWD1RCucXVFfDHuIL4aUZfZ0rbWdB370OKj+FMBCwreV/tQOLClQ+QErb rSpt1+ScFg8goVetX9gk0h6KTOhqY4L/fZD6ALM9VmC/PFp4v+/J/tGzvoE/HkgvxmDI4G32 OEqi3uhwrMjZsVURjtlLaj2Vvtq9IOO1IcTjQ11DD40OjPzRi1vfnI7D2NUQ9qTxC090+9rb tywZUOfgRS7VH8UvrMiBUqF3yzLWzu4eWrDNZJ83RLfdJIfhPeSBg9Mj9DQch5krqEGvfsAp AfyQ7ll0hIFMAPoRnRcN6heBvoKuAiRh+gAPAWyAtDoBHtJ/gmog3qDhIXSIbUYDLIm7iB6F uBHjsygC/AjIvcA/BrAODgfwQnBEgVdjQsgB4ZP0QPlfQnpxwKNwD1VwL/3kGgB72SvosNz5 4JDc/sD+ttaW5qbGvfE9DfV1tTWx6mhVpDIcCgYkv08UeG+Fh8zkQd9T7Cji7IUFNquFTPQZ 9DoGo+qElEyJSiil6ENST0+M0FIaGOn7GClFBFZydxhFTNFg4u6QMoSc+K2QshpS3gmJObEN tcWqxYQkKn/fLYlreHRwGPBnu6URUblL8T6KP0fxAsB9PoggJsonu0UFp8SEkjw9mUukuiG5 VaulS+rKWGLVaNViBdQKmOKU5lax8wFMEcaZaFllkKkAbkpxS90JxSV1kztQdMFEelwZGBxO dHt8vpFYtYK7xqSTCiIbOkZpENRFL6OwXYqRXkacIk+DnhFXq9dzF9c4dDIVtY1L4+lHhhVd eoRcoygK1+1WnGfvlH9BQuKOruGn75d6dLlE+ZRIyFzuaVG5PDh8v9RHziMjkAbEZYLJVC4J l74ImdhLthtVmKdGhhX8FFxSJE9Cnkp9PnVDzGDqUVExS53SZO7RFBSNO6ego2d819xu+UZ+ E7kTYm5oWPIp7R5pJN1dsVqCckfPXHfJomu3JFa9yhWpGbtaaNcQW8H9SGZHRjEanGC9R3dy FpM7kg5ChVDEMRHuZFiCZ2oip0wTyo01QTD4jWCIpYxDiUwp5q5UjmshfBJfMQQ5Scx9jqAG SHf/czcnrXHYIPc5IiipJztVDeTbuBKNKlVVpIoYu6BM4R4foPTeWPXpNeZlaY4TAUD2oQHI 2/RISy1kv89HCviZNRmdBEI5Nzis0iI66bmG5NroiMKkiGR9W1L6IJGc25bsRE9JUJNfo19/ K1VMoZ1/O1dWnJhsUXDZ/yDOqPLeY1Lv4OiwmMiltLztHdpFqfKmHZmGKcVdwzoPo2GMR0el UCkf2QlMiGGbog/CP0sr9fia0QS1knKwmFS4VI96HrH4fF8xErxNSCwKvoim3abSEt1Nt+6i d92eLaeDG9aHmN6h0VzOskuWhB4ol0tKYjKXyqVB7zwpiZyUu6EL68K5uURqu0TX8jef8SjJ iyPwEJO4BWorgzpXJXxhcFXGF46NDt/gEBIvDA1fYzDTleocWQ2AbPiGiJBMucwOl1AioVAv hpp+jTFRkeeGjNA5KtVTBqXH1jCiPNM2D6OxNUblcZQHP9LQu4aG7y9C2i5GYtqXEnW0cthA u1UATiIZGVCl9vEpEVWjGKpD9agB7UONqBm1oA7UibpQN0qgJDqAetBB0OAPoz7Uj47Q7/Ad Q0PoQfQwGkFpdBKNoXGUQacg3Sk0jWZQFs2iBbSIltCyWJzP73zm6v/jShgx+U/yv8j/LP/z /D8B9o/5j/Ib+dv5v8nfyf80vw78H8PxE5D9a/6fAf8o/wFgN/I/yr+b/wcI/Xf5v4Ljg/yr +Vfg+Ov8rfyfw/EWYG/nv5e/nP/TzfIvfWfy/+7HqCDvQ+/8TvkerLotGjCLjdiEzdiCrdiG C3AhtmMOF2EHLsYluBSXYScuxy7sxh5cgb2YxwIWsY9+FS6AgziEw7gSR3AVjuJqHMM1uBbX 4XrcgPfguHE5O1UHPw12c9nZ7Ex64bGp7KmFzNLyQtawOJcey7CZb4xNp2dM88uzS5nxk9OW 7PLMyczC4tSpLDs+Oz2dXjDOZRbGMtklc3oGsMV0dtxKAy9CStMZ81x6IZOdzkwsWSi2MHVq csmUXlzKLEwtPqafm15eNIzNzsyk2ckzc5OZLAtpTM2OGxan04uT+rOZhVndbDajW/r6rGFp ciGT0U/MLi/oJ6ZOZ3SLU98wLGZOZ7KGDElUn53KZiCt6dmseTEzM0Ux/XRmcdGQmV9OTxvh udJwWXiUzOLS1GyWSS/hDtyJu3A3TuAkPkCMO/Ah3IsP4z7zqWm4n/r65kZ8BGqg7lHmLWhf JsN3DMSxLKhC3WU0wTiwgWFMOqPBwOj06Le+WDrU1yVCGxHJdzq3kniP0Yff3BWGhVYBLZl+ h4q0XhVnUCFQKq4DbJ+G6wH/PQ03oHL0LQ1ngf9n0Oa6aGt7GP6i0MamoDVloCX1w/nr0O5m gU5D+zpK29sytLY0tLSvGuurhnsIaNJ+p4CThWevRzXQP9R91fj/DUfGZn0KZW5kc3RyZWFt CmVuZG9iagoyNiAwIG9iagozMDQ4OAplbmRvYmoKMTYgMCBvYmoKPDwvQmFzZUZvbnQvQ0NI SVdXK1RpbWVzTmV3Um9tYW4vQ0lEU3lzdGVtSW5mbzw8L09yZGVyaW5nKElkZW50aXR5KS9S ZWdpc3RyeShBZG9iZSkvU3VwcGxlbWVudCAwPj4vV1swWzc3OCAwIDI1MCAyNTAgOTQ0IDQ0 NCAzODkgNTAwIDI3OCA1MDAgNTAwIDI3OCA1MDAgMjUwIDcyMiAyNTAgNjY3IDUwMCA3MjIg NzIyIDUwMCA1MDAgNTAwIDUwMCA1MDAgNTAwIDQ0NCA1NTYgNTAwIDMzMyAyNzggNzc4IDQ0 NCA3MjIgMzMzIDY2NyA1MDAgNTU2IDUwMCA1MDAgMzMzIDUwMCA1MDAgNjExIDMzMyAyNzgg Mjc4IDUwMCAzMzMgNTU2IDcyMiA4ODkgNzc4IDYxMSA2NjcgNTAwIDcyMiA1MDAgNTAwIDUw MCA2MTEgMzMzIDkyMSA3MjIgNTAwIDM4OSAyNzhdXS9UeXBlL0ZvbnQvU3VidHlwZS9DSURG b250VHlwZTIvRm9udERlc2NyaXB0b3IgMjcgMCBSL0RXIDQwMS9DSURUb0dJRE1hcC9JZGVu dGl0eT4+CmVuZG9iagoxNyAwIG9iago8PC9MZW5ndGggNTI1L0ZpbHRlci9GbGF0ZURlY29k ZT4+c3RyZWFtCnicXZTLbtswEEW/QP/AZboIZD5ENUAQwJFjwIu0Rd2ia1miHQGxJMjywn9f mmfqIBVgC5ec1+GIk1eb1abvZpX/mIZmG2a17/p2CqfhPDVB7cKh6zNtVNs1s6j03xzrMcuj 8/ZymsNx0+8HZbFqz6NY5j/j6zRPF3W3bIdd+KLasM/y71Mbpq4/qLvf1VbWtudxfA/H0M9q kVZC37JTvdbjt/oYVJ5i3G/aaNTNl/vo/GHx6zIGZdB/Xoc2SBhNKU1cOY11E6a6P4TscRGf J/W4js/TNdV/+17cdvvmrZ5u5umVlP6kzCdlkzKiXFJFiSqS8hrlkyot6oG9F9QSJX7PWDpU xd4atSJfhXpJyonlmj1iahgc+fSVwSy0KBgcMTUMjjo1DGWBgsHKHgz2AVWiDOoripPQ8FmP Ej6JCZ+TPeGDQcNXEtPA4Kna0IeSUzIweKIYGArxg8GLgqGQKDD4ZxQMJUQGBrNCwVBCZGAo JR8MBVUbGKJ7hntiX6LokeGsDT0qsbTwGbJb+AryWekR3bTSIyqz8BlqsfA5TtfC52C30iPY LXxOsgsfvbUwOL4sC4OTyuQ7k8pgcPTBwWCJ6WBwsDvp0TJdO7lf9t9t+7idFLmgOk8kTU5N Mi9l0QTL6cdjIC6Rrjf7OqhuM6Q5T1McH2lOpbmRxSHR9eE28MZhTKMn/rK/dFk2CQplbmRz dHJlYW0KZW5kb2JqCjI3IDAgb2JqCjw8L01pc3NpbmdXaWR0aCA0MDEvVHlwZS9Gb250RGVz Y3JpcHRvci9TdGVtViA3MC9EZXNjZW50IDIxNi9MZWFkaW5nIDEwNTkvU3RlbUggMC9BdmdX aWR0aCA0MDEvRm9udEJCb3hbLTU2OCAtMzA3IDIwMDAgMTAwN10vQ2FwSGVpZ2h0IDUwMC9N YXhXaWR0aCAyNTY4L0ZvbnRGaWxlMiAyOCAwIFIvRmxhZ3MgMzIvWEhlaWdodCAyNTAvRm9u dE5hbWUvQ0NISVdXK1RpbWVzTmV3Um9tYW4vQXNjZW50IDg5MS9JdGFsaWNBbmdsZSAwPj4K ZW5kb2JqCjI4IDAgb2JqCjw8L0xlbmd0aDEgMjkgMCBSL0xlbmd0aCAzMjkxNS9GaWx0ZXIv RmxhdGVEZWNvZGU+PnN0cmVhbQp4nKy8B3gc1bkwfM7M7Mxsn+19d1bbtSvtqmttwY4suUky ErhJBiG5YVMtyQUwNhbVNs0KEMAhwSbEQDC5luWCbEIQXENojp0LIcAN2OQ6iUlQ4hCHUCzp f8/ZFZh77/c/3/88/45OP3PmlLfPO0IYIaRH9Ldy+eJl+Rz6HYTqlVCRL2IrROFrVi2dLNdC kK5dfENPvszMgkheum6NXCivREj4oKdveaFd04iQcfqKa268Il923YPQPW0rr11zQ768C56H dVf0rLg2X37yNEJ82dJrFxfu/5kXxgz3rFq9Jl/eo0DZ0zo3XZ4v770MogXXLb52eaG8n86Z rE3FbEsOf7Cxy1j3T1Et0tYf/5fvZZK+1PrbqV+vGbtHQqIBimroj/PLg9kHx6ejhRL6es1X JyRUqP/211BI1303cC0IiTNgQzUISVMQMp9ByN6OkBtSH9QHhmCb2hAKwvOL3AiFHoTwFmwt rDcGay2GfS7+AqHUzQiVXoRQuh+hzFcIVX4Ax3EXQllY51TYuwtgf6fB2hsHEJr1GULN8OyL 7Ai1LUJo7jyEFv4CoUUbILyLUOePEeo+jtCSKIRnEFoK81r6LJw2zGflawhdBXO55hxCq2Ce vTD26sthKbcidEM3Qut/gNCGswjdzCO06X6E+p9G6JY3ELod7r/zSYS2HEboLgM5S7pDDegz VId+hATEIAml0QLY/t9zf0EqxKjug3wLCkDwsg8iD0ITH0M4BeH0eNPEOdXVKDR+1cRJ1kKO uxAQiqCH0A4URmdwGXoZjaAm9CSqR23oQTQTHUN7kAHdiN9EHAqhRvQ0iuAAPHkGcmAV2o7e R5ehPvQHdBLFUTP6CJthnOmoB9lRduITiJvRlolD0EsD8/43dBhfg+fCnBvQLCaFk/DkbRMj yIHiE0cn3oPSj9AfcHhiL5oFuT8iE4qhTeh7yIyuQm9MnCPYgZagp/AG/AkKom50N1fJ3TVx NZqKDqDf4GbIzUE3qt5TH0DXwF1PYAcemTgx8Sf0Cw6j5TDSrWgLzHgIjTClbINqJ5JRFF2A LkKLofUm9D624DJWmYhNTJvYDrVPoc+YJPMqK8A8kmg26kL3osdhN95Fp9A/sRZX4R/h3XD9 Gv9V9R7MrRmtRetRP8z8Sbj3WXQIl+EyxsE4YLccKIHmQ9s2tAuevw8dx824A4/gl9hdqsx4 bsI6YZv408QEKkbtMMMd6CV4xlmcgT7wBLaIXcP5uTWq8rFbYIXL0A/RcfRrmMdHsO//RF/g Yrg+Zm5mNk0snHh64g8wFxEFUC26GC1CqwBjrkc/hlN9GR1Bf8dfM2roeYx7RbVedWbiftjb KJoGc2+F3nNh7LvhlIbQMFzvwipNWIZV1OKL8CV4Bd6GH8LD+H38PsMzQaaX+TM7yL7J/o6r VqkmpsBIduSH54bQQrQSTuBm2O37Yb1Po1fQ69iGo7gEVvQu3P85M5VphOsJ5hjzEXsHu407 p7pz/OT4X8a/nrgL4LoR4K4ddvMZ2IW/YTvMIYGvwqvxf8HMB5j9rIGV2BBbxdaz89gOdgv7 IPsa+yuuj9vNfaCarVqs2i0sHr9u/NcTzRO3UzrDw7xiKIUqUQ3AzxUATVfD/Hrg6kMb0C3o LnQfwMv9aCfaDet+Eb2OfoM+RJ/CCSAchDlfCU+/FqDuDnwfXNvxs/gl/Ap+HX+MPycXUwRX nKlmckwDM4NZwdwB14PMceZd5jTrZZeym9h+uB5jD7Lvc4jjuAlVOVyzVHernuLfFOLCLGGJ +Na50bHisY6xj8bRuHv80vGHxl8a/9PEgokbYf4RVIJKYaabYZbbAQZ3wfUMQOJB9Cp6C/2W zvUzzGAVQLwThwAaUnBqOTwTz4ZrDr4YrvlwLcSL4FqMl+CVcG3C/fhWfBu+Hd+Lv0+vR2Bt u/BP8UG4nsOH4foNPoH/iP+MP2MAiBkWoDnCxJg0k4WVNjAzmVbmErhWMKvg6mH6mHVwQk8x +5hDzLushY2wJexitpfdzv4b+zL7Dvslx3ApLs3VcQu4Fdxt3DHu19x73NeqgGq6aqXqMdXL vIev5OfzV/GP8Hv40/w5gRfahCXCBuEdYUKMALX6Jaz7wHd4RJo/hlerrNwNzAnACyfbo9qM 58OO8cw89hr2PvY/VFfgM6yMP8B3sVeyV088wc5gvmBX4QXMi7iIDaimsFege9AE3s18zJxl /sTZ8DzmExznvoefY1axDQxPHqJ6m7Nxt6mAfzC/RVOYjXiEeYW9jb1t4gU0RfUYPqF6jPk1 krmTjAWdAKzezDwMN/2KuZK5G7Vzlaqv0ZWw7z9V3QD7fSGzBRez73CPoT+wIeYf+Ax+CKjG UdzEhZnLmSzeDRR3DPvRKO5FPfj7SMHP4w/xMML4afYp3MLo4LQGGT2uAVZwlA3id1gN6qDs NMrYcBtzhpnP/pw/zlZhDFTiP9B6zOIMwM7kbxxdBxjwIBMDmjYdqMnbuBw50cNA78+O/5xQ bNV7qrsBzh5nU+gSlEGdzJtoCuDGH+BqR3eicnQYYHALyjCPoA0T/XgZ0P05QD8ZNIyvQmms BWrpgLltAn5hZ4qAFnbBU78A+v8GUP1m/Fd0PZYBs0ZQnCMt93DTgTJ1A/29G65lqBNKP0T3 8wdUb6NW7ABuL48/BlD+O3Q58Jz/gue7gft9Dyjb41wKZi0DZe6FO344PgspcN2J3sQM2ghz vhDwvI2bBZT3oYmrYIVXAo9qAZ74Orpy4mHUAGd3ycRtE3ejronHJy5DK9DciaeB/q6bGELV aLOqg1mgSnKVQGNfx0eAH/0nvhvo9iz0AdCjCHaiP8P1bzD/C1XPo7u43wLtzE3cM/EbZIP9 KIIdWgJc9BS6Fv0V9m0WO4Iqxi9i9k7MYHuAQ51AF088NRHAGrRy4hqgvD9HuwQV0J5+5Fft Ati9m7uCycB8E8iO01B7mWoHQofQPPbTfWxxIFdvY0+hbvYTtIP9AzoBgUMS1EiQy0HogfwE BNXECPvxvunTy5VhSJOlNB2KJ8oPkYYht7f8BfZj5lmgjAGoODFk99CWj4amTStkqmvzmX3F JeUn6jXsR+hvEBj2I/YErJLetS9eWn6mXg8VmL0ZGQHoAmgn+yEahMAghf1gXzhavuNF9i1o f4N9HQ6Y3Pb6kN5UDgP+kn0O2EYACOOBQsuBfQZTOapfzd4LdG8E4uMQTkI4A4FDq9in0CYI 2yDsgcAhI8QBCGkIraSG3c3uhnnugvuNEKchrIKwDQIHW/gM1F9NYvZp9io4qQB7D0hKNkjv Zh+g6U8gdUP6Y6gHfsY+DmWS7iiUH4WUtP+gUL8dynZIHymkD0O9B9KHqAQWYL9fKK9j19L7 1hTSnezqIX9AqvdDuwwhA4GF3IOQexC27kEoIYgxUJpr6JP2QloO6bX5FLZr41AwRM9o4z6H q3wnbOlG2PqNsHMbYec2Ig6aNkz22ZDvU8JugD4boM8G6LMBdiXDrobnrYYDQxBLEGQILOz7 ath3Uj8I8QiE47T+dogHIOwkJfZ62McEzGore9VQPABAtmJfVinPPQ+EFcOwV+xz+cq3fVtS awggQmoopEbSdzltXb5PrSO1y/e5ffkUel1db2CXopsgMMgKcRhCJYRGCBy7dCicDhxmL0LX ikgxBDYxm9hN3CYVl2nE5hfZctQG2kgAmdkSVAcdEoGuOlzTre5R96tZSS2rM2pF3aZWrQIe vY1lA2yazbGtbBerGp4YGRKmVECizOSnVAxod2oHtSPa41rVID/CH+dP8md4lcxneIVv47v5 Hr6fH+B38uoBfkBgurU92n4tK2llbUaraNu0qoCAd9bfwS4hEjzEEoQeCAMQONjjLqiX2csh dMFpdMFWXA71CGIEJQnCccifhFQFJSP0M0I/I9QaodYItQhi0tIGoRtCT6GV/6Zl8h7S/wxp gRCDVgPUGmBvT0J8huQgNEFJDyU9lPTQ6zhzDmYoQSxDaIPA0rqTEABqIJ5syxTauyHwtP0M 7TPZppB7mXPK4thIAg8m8M4EHkhgpS5XX64UQWQ2m7tCXZGueNcublVoVWRVfNUurjXUGmmN t+7icqFcJBfP7eLSoXQkHU/v4gKhQCQQD+zitrXsaXmx5VgL19WyqmVTC1sDR7dvKJkpp2lR hKQHhlzu8hpj/VRmDyynC+IdEE5AYFEA4jSEHIRVEDhmD8QB5mdQ+zOo/RlqhdAFQQV3/IyQ F4gDhTZSv4O2kRxpZ77TzsLCnx2aUtFa3wQktwvCDggsjP0stD9Le+dze2j9IMQnaX1rof9O Wh+AePIeFgjcIkrmFgH6LQLivwh1QeiBoELH2IXAHBaSkSEOQOiBsAcCxy6CayG7kPkZXM8y z7IpRV9mCyA7KLfIbBKleonRAQzo8dM0foTGW2mco3FYMTTpP2/S/6JJf2eTPgYZJg7MWI8f pHFQ0dbr99frW+v1iXo9jOYAfU3P2GjMkxj/hcYX0TilWIP6L4P6fwT1fw/qfxTU9wb1FwTJ fV7AXT1jpbGWxCAtkbiJxlFFG9C/GtAvDOhrAvp6PX4Mw9PRNBr7aewhMf5sv7HRiNTP489A t9AzeKguERhmEE3wxFBdPSTjQ3UzIRkbqnsMkq+G6h4I/Bx/iSlLw58PhU8F6m34LJ7NkfI/ Cunf8Wzg2wGQ4maDBBHAT6I6HIH0J0N1t5D+T8D9P4Dyj1GRSPo/DhIJSXeAXE7qf1S474dD qSXw1EeHUjfCU3+AUvSpDw+lTkHtA0OprZDcP5S6BpJtQxEywauG6ooD9Sa8AoUZ0ncpijBk Ji2FJ86Cka+BdGb+5ulDKXJXI3nAMG4YCpVBEiOz/DkOoTb6uMBQiC7Sh0J0CC8K0Ul7UISm Bmykk9ejIpqKQ6FbYBR+f+RU4F91z5OFg8poHHos8F8/h/UtgOLv8eyh3YFfHyLbNRQ4lhrG kYOBX4WeD7wSHsYLhgIjqWERGl5MDTP4QGAvbPIg9GXwwcCe1IrAz0K0dVcIWuGod9SVBB4N LQpsj0B5KHBL6udkGuhaWPECaO5IXRhoqdsdmBEZxtCs1MHDFE1gSqgvkIXq2mE8e9/uQFl4 mEwlA2PsPhgohidGQ3Qq82sOM1VIwGuVlLAGlI4FwsXCVKFCKBFkwSd4BatoFiXRIOpEjSiK vMiJjIhE6/DESSVJlEwrTy1YPEdijuYlhsRM3tbFYJEB3Bm0sM1M89xpeNDcjJrnTRusSTYP CxOXDNYmmwfFtkvb92J8XweUBpktwxjNawcAJVV3eAbNDe2HQA9I33Gvh6Qb7ri3owM3D44s Rc1L5MHP58I6NBcvGlSFpjmRfV3OmTNfaMrOaPxfou5CnPz250ye/3P6Bh9qnts++IyvY7Cc ZCZ8Hc2DM+fKl7UfAsV/1fTGQ6DvQdLRfgivZ3qnX0Lq8frGjm+6oSKmB7qhOpKQbvtQEemG ivA+2q2FdgMwLZreuLeoKN/pZTybdALweZl2WpEfKwyPgLHaSALdGD8K07HCjJ90A3jID2Y8 fzAdwkY6mFGH6GBe0mlvJAJdUhHSZW9NBDrsjdTQ5t3fNoci+el0oAh9TgR30Odg/G2feL4P QEGhDyNCn+T/n7/l0/4/dMb7Fv9u2dLpy0PTu0PTl0PoHrx73UrnYP8SWd677HekQR5ko91L lq4k6eLlg78LLW8cXBZqlPcuXvq/NC8lzYtDjXvR0unz2vcuVZY3Di1WFk8PLW7s2Pfkpobm 7zxr6zfPatj0vwy2iQzWQJ71ZPP/0txMmp8kz2omz2omz3pSeZI+q/mSabi5rX2viKZ1NFyW T/cxWg3gQ7cn2DHNLvVcSJFjatB5s+cwh4BtaZMdg7rQtEE9BNJUUl9ST5oAO0mTAaqNhSbn zVODnsP46UKTBNWm0DRQj53Tr2z85m/16tVrSFi7NgnxmrVOWrcGkDY4t3lwxsWL2gfrBuum DyrdjR2YHMfawq+hXZFerDtWx6yq21S3rW5H3Z461dq1HVBtfrHoWBHTVbSqaFPRtqIdRXuK eNJwWftBpW5H0d+K2LUATXgN/KY30meuhRT+SHHN2tXkh+ABqyHkH5dcm2xory9CS0HaxSCZ lyALhBCECghzIajQv0P8NoT/gvAPCBy6DeIHIDwBYR+pYUvYkunOKxvJEzuShOg42fJ9mary 2mFIF1+RT+cuyqfTL8qndfXlTkiHchWaeiMI3hgdhvgNCB9A+DOEryCo2HK2nA6+Ng+1HavR 6iSG6SMorCHR6uQanIQMJtu9ZnUyiUggAA4nAF2T+Ltwj/DqtQi2Ag4EEuhEa1eT29aSdPJH GuhrE2BsSOUlIjMS0Jy9DH6e+QXIqgLz4hBSccPML/azSCOQzAGMXCKvehHaGcTiBFLjq/Hl yJmUPq8bq7tIOls3Z6wO5SAvnYOoLBM0BU0RiLCXQ+dkduScokJfI5kbge3wTHwsbFS1oCzr 38swDfPaD6pxbSJqNQ2zv1eM5iwTY7zqjIfTmhmtiNLpnNmRzeWksePwG8HpsoxHcal5vQAM SC1oNBk+K5gNTktWB8FDhFxRXQlpP0m9kCqnIVOtrko3qTu4dvVTaj7KJ8WUNq6LW+LuhKc4 Hiur5rPuysxMvlFo1s7yzOPbhXaxQ9Oua3e3Z+aVXckvE67RrnSv9FxdsY5bx68T1mlu0N6k u8l9g2ej9wZ5bfoO7h7xLu+W9JbM1rL7he3aBywPOLe7H/E8GP9++sHM0+Iz6me0z7if9vzU +4zvqfQ+YZ/4nGbYvT/zy8yX4pfac74v5aaV6eWZlWVb1Vyt5xr/qsB1JdxyYbm4Us02q1sC s+LNaa7DszB9cYZtE9rERVqWE5CG1Wq99nSxNxEoE7Ja9V6ebKfiQ+apUzwZtZfTmvI76zGL ghZrxWzMzMAx1eU666SxV8jPBJuLTeZs1qOk1F6vqFZrvF6Pz+8XEQ8Cj8Vt9Vji6YQnbtbB KDF/1BPLltV6ssMTPfs8Wo08PLFKsWZEQdZptUUe6O1xe71+tUYzzLyu2DxeqPCmfaJYlElb M5l0GS8IpMWbKYNimcUci8ezWTMCKgbShKCe+hi/qwzObEipKiOa5xSaKNGSTGWmrL9soIxt Lesq6y7roYWTZWfKxLLT4p/Ul2g9B9zaw4yM3PgrRavo2nTHdazuqSlTh5mr9gWvvgvY+ued o6dc0imnNHb2bGcvIMLYH2EvJLhgRyR6bVaVJjcbNh6B1HleRixkDBulIyATIGkUSyP/77Eg GepEuASprqMsgzsLP9RJEJpgLpA3xRqP2/U5P4nkDEQBp1mbox2SHbizA9uKeIEXcAjDXzQW jYaqgrZQEW+zOrAlFovmr/MqcXVVJa0RNlZN81uT43fGx98cPxoev7ZEZ50+FX/urKpNYe3H cdnm1ltcLkuCkcK1lSWYw0zKZ49eoGqJRCtDt3/9PLv03I+4K252RCORSKYodPOYwGzuu7Q8 atGbRR6qEhWbxgLMXzZkHHHREAFagmZPjLJb2T2oHF3Azs7jtSLnFL2emZ9TLBZmvs0jlEZE rZaZH9GR2gjSVQxPnFG0ZjMzv8JOukD5o/2SRDNnFZvRCDnatyIr0FQoKSXgIKvhltIK5OcS qUylTlHDoDrF5yOxCZp0wxPvKH7SSafjNjmxk9Y6aQ+nFPELdSkOpUdzo3CaneZsmlDFo+kx ggbvJI/iNBQopRwZ+TCZPCK9c7Qsk0x6lFVa710VjHluNTbLgWx/7mn1QQ1rTpo3oo0Vd6K7 tXdX8T6zfYqU689xam+LqoWfLk8vapmi5Lb6RI1BkFHRbNysma2dXdVc0zBl9gULtSu0d6hv 19yuNc6z32ZnArmuHNMtVqDKutJESeXzgIA6pJsYOajO6uLarI6s3T2lSgLoZgiId+tYmSbr dJyuzjk88Z6S0GZbnV3OVU427dzkZJw3ByRMVpypU+oYWHZPSX8JU1IF+zbMzlBMnLZ0pASX dEdQhV6nq6yEjT8HJ8DPr3ieaFQoQp5oyKJIINIfGYhwSuRMhOmP4IhEOkWeZxqAddgAUQNZ 2zBeofg96WyZoBiystAm9AusJOAzAm4TsNBwYcN1ziSwis7evr7knNGzo0lpLAmFZN1YsoB+ 0uedwEXOjp3qlEZ7c6N9Y4Cmpizpk0ym88RtiNVh1NkxCmdFjqss03CjMrNqqjekstTUVtcy vBrUEoYPFslFDF+lzcrI5LN4kdliDOi9uCg0VZX1olqxUsZVlVqzV/JiQxFEU/g6L2GtMAnA PojgL1lcXHzLLbfgPtyLenFvH+psaB/KmQlidiZRHyDw/jJYKUDkySGJJgcN2RoZ1j48cXpI R5KTilabdcrarAOCl0C7W5vVwFHWxEmqgVQDqRpSdRb9Nzm2A9YZAQIQKopWVdZUV9cAcoeK BN7msObrqivKHXaH3Way2u0V5TXVNTZSHzPBPUAOoIqZeW+4+oKum/yJNz9dODcXiTLpaCQ9 uGP9RVO9Zo3DKOlsdT1XlE3BD6daGxfUttx+rcl161UNZY03LAhvvaKoKDWltLyyZMFAIjAt ecf467dNtQr6utqHGh/AnXWuVHd2VhfR6JZNnGJ+A5hfxlUW8D5WQTG+QiHYzmAnQWnsJOiM jR63GNOR+ljQCBtE0d1I0L2ctBvLBDFmDHLmpArfqMLXqLAqksYYFwuu6/14qR/7I7Ibd7t7 3IzbrEW5I52do52daUgh6SSCAmAvQd+j7xyV3oEcxdwCXywPGmMiV2z3m0tVTHGZkB/GZW5W 4atVN6kYVaRYaPTjZf41fsYfMWsxmeFniluv5+cbjRXlbtFAsmLMTJJYrKLcRIjH0eSRfHoE 5WAWJEhHjnTmpCMURmFSRGRJqFOuFGM2lyrabApO32nt0C2KPio9GFZpBACFRHdFT0V/BW+s GMayslnfWf2m/k3DkfCRyG9D74bfT/2R+2Poj+FPUlpzLtWZuq5kY2ob3sZsY/tt/e5+T793 a8m2Ur0RGxkNq9bxXk3qtaLXQ6KXtVvNXrvPlfCktqu3ax6VHwg9ENaak/p4qinVWtFVcUPi htSdhqdDeypOs3/06hJimR+9wPhxAKcxg4dxcgi9UDqM3Yqp2Ol3veDxuwNuLLll2DnS6HrB ThqLzOZwSK/ljDGaqPz4l6g0XVwGAiZsqvtml8tJ6I3VniYby7xlxth8LHgi+LcgGxxmrYq2 x4i7jT3GASNrHMbViivmdpUGRCymdsRwd6wn1h9j5VgmxsQOYxmVY3lv8yQxmTPadxakmc7e MYKfE0HAz2wakHNoAkN2FM7kFLQDsScE5pQ0WpB4HFnQPDThUCis11r1eu1mQynl7x3A3j89 O9rZhyWgUfk8zeaBaH+prNZXomQHpTzeeCIgS4BwAVPQi/mE6EWy5PciIa7y4jwjv4WQEJiZ ov5a+Fz63PR1nAMC0od6CTlRXDvwDmYHu0P7A/2AbcA94Bnwbi96OLSjRNfZ0ZkEwgOkD7pp 06F0+O7Uo+FHU6pOohkpprjsyqrjrixWNFkGApF8hzRZN+ERLk22FKpSNADvkPzmnEEmEZCg IU+WJq5smNApSzaUT4C7nD5oyaYKUvSQOT8WCORYAaEcQko2k3vOKEYjdDNmWUkPz9GTAc4o Zj08Rw99IDhNNPx3gvbf1PQ8hevAphBINlSAsTuAmhHiFiOELmSqIHSNyDTh2CS5g3INMxCM Xn/ZjAVyoOv+N19YO++aoM2hDwa9jy2ZvnDx+EclJY/eVD2nwiSZdeye8dceuKqppDaeKJ25 9Mcbt/s1bjzznvsuzk6/fGBKdmHvIw6jwQk0TA9K0D9U96FqZluBhvlqFSKYSBqTRiSih8YZ JmWnmxSA1X6xn9ArJ6HxOkLDnAZC8pzR4Yk/KwFSEQ1WVsVKcJDT6Zj5QTpGsMRJxigZnvhq P6mFzOf7SQNkztLxIPOpYiS3l9DxSrDMGes17O+RGUIEQhxCDFUSValKUcO9VdUoZvKlQB3I jYKy9GFyVBod/fRTYI44L8UkQYgZkY68Wg7Ca74GKJZ0BCjjJGFsrzQTdl5FY3hirBIGJUOa YhqG1Gl4oxFiHaF7GietctIqJ61yOmtrcJBWB2l1kFYHYTVnqDQBmc/2kwbInHuOtJWU1NaY 8qLXh0TSKuSPEj0WVjGa+/Bonr9jInmla5XiKk1tN1BFY8QY7a8dqOUGa0dqj9eySR631XbX 9pAqpRbLojPhB03SqJiKShL+WFORJuGXmkLBhD86zBqU0lBVrLS+0l/ViOVYNaKrBMnaZJI0 LmdYPaDBgxps1PRodmiOaTjQYl5QIiUoGC4NlLSVdJf0lHD9JQMlzGAJRiVSyUjJ8RKupLvm yU1EFe4EakRU4LF8OqlcjObqTNnsP0fP4X+SzaeEw+r2qkCQ9kS9KpcXC6Jb8HlBLSBSB1AM KmxgoqMQ9KgGwM+zeQfggy1YRXCguspUSdFGoNwfakEAmKwUYhE8Z9Wt9Rf1eCwGTUYZv9Cm lGvYQGOm7KomW3bG+JQLQlanMeC2pQ3YrLpvbMn66QsuU54Z//lC2ekNA7ZJF+HGhy5PV7aO ey8vDYTDFk3tAvaCH81yS6EeIu3XQSQAvmhREVOQ9g+hMJALHwFns56Cuz5IOX+Qcv6gxcmq hyf+up+AtZpwftIFMu9SwIfMrw6S3mq9kyADRabhid/vL6DbyUl0e/cAxTaZGAscrcFVwU3A QopWAQ5385hXSC8e6NZzZAC+iLegdO5dkPKPdkofdo7igqhPY0CJZFJKHiEwNokJepniQJDG ZJz9zc2FTH19PqO4amr4+QqPEb+TZ8hDEZKDRYKFLO9zxUvuVKuBDVJ80DME7PUUH8jK8vjg JIhP8QdqnsujUDh0Hg7kBQqY+4dHc0fzAnABFVwDYdwd7gkPhHeGz4RVcrgtzCgkChPTR3l5 JU1rp+RT0JtpGorQVCl1uSsBQSxNRfqE3wxoEXPVy/5go86lswzAUrIIFekEi1kzoMbqLEv4 QEMVS/lAroq9WqfTu/Rhp5LMOqkuUj2lcsCJ25y429njHHDudJ5xqpxDoaEnKDqQaVOuexbS PkAHuEb7YGlSARnokggr6OztxH0A6+V58k+IveUbuKZgHZuE60Tx1KnFxXVTb3aV1Y83NJR6 1ILf7Y0bsFV1H2moKy6eOh4ckxdkAZDddfPx4u+nZJcx3AMQogMq/y+QVCuYtwtU3lFFqXyG kvAyGhtEoz1EqHgpKYV84YRIoVnkCGyJPCHcop0yAztlBnYdgTX7JAm3TyqxkPmrEiXd7chH b/bRgXx0CF+C8oIEJfMJghjkngSBENI1MckaIPOVoiF3JJCXCWcI3KvLFDWZb7n+F8ANJAhF ee6gqMPGcLngTjGEG+TSacoKJOAJpu/yg+RIIU+ATQJuQCMiLH+DCpen7QRUydbw88tonk6g LD++MSxSoBYpmIuU7It2hlTZaZVdJFV2e1Ul8tGePlrho40+ulBSm5jECch89hzpkUhUVf7f sgZAiClVwBvEKsIbMlVtVd1VPVUDVaoSDis03w+lwSp+sOp4FTNYhbuhYqSK9Yn2hN+YZxOJ hD/cVCQm/IamkC/hD+XZRFmsuD7jL2v0olB5BV0xyIpGo0HjsIeFAREPitgo9og7xGMiJxI2 4UlU+MLFgURbojvRk+D6EwOJwQSLElKCSRBkUVvtlYnuyjyrSP7fswqz08XyXMTFOrxYxTtV 7klGQeTKXvgDVtFHOcX/kU8A5pxf+S2XqMDNj9/ffI1sN2jLpo1PtSgVGq5+zvXrtIay5vGp 1hllwCO8MSO2JpnRl5sX1G0Yv3FhwEU5hLEVX7+x99ZxX6fd5wmHZy7D83bNchM8Y9EF4zPY /wQ8m4pmow72YeVWs73t4ej2ahZ45qXMuuJ1cxlUzJfyl9wtc7ma1ktX1ayN9ly6jdumus1x u3Nb1V0X3jZ9W/Odrd93fN+5vXWYO6Ta79jvfL3y9eaRS49fevLSM5d63LKtQqqyVgcuVT0l NlXnPMjOVgebPMjVYDZJRoNep9Wo1RaLVS32R7A5QpDSbGXmRwg1tOpyJFW0Zm1uR2RP5MUI GxnGjx1oT/YHcRC6KnrS17wjuCf4ItFQ8vfQFG4JQl/FOdCEmxSobVKgqilFkLmpzYqtw1hU LKtEvAm0F8UEw4hV/PYG3DDMlik6V5Mm7cJtrn4X43qB+Q/EIzU7B9VBk4YXXBfji1Mp45xf sBmUQX6Is2gOmwFxMoNXZbZldmTYjNMoMQWczFRlS9n+eXgeWZseaAZk3tgvWWnmI4pT84hk rtEDUs2LBOI4ThZtd7grt8Vxa7wnPhI/HufiBtIzPkm+4oRqmQktiq+VL81cqly6E/ZcdSm5 1avVVV5q2PbQDDyD2n9mlMl2bLT32I/ZWTtRlU2U7ulMJhJTIkAww7I9h3NlGbaNZdpYjFiJ ZQhL2efyVdIURmUneT7JPEfWyF656NLD+AYUxJq9W4n1liAEYMto3xjNjCb7TknJ3s9pIdk3 Spp7pVPAajr7QAKWiOLXlxv7ozTa2ZuTRvuACXV2QkL6Q2dQvvYTBZTp7Ej2gYqXJHrW/mOR ExGo6SPISFREQmcgUAP5pLVpffPCKdPDVV6fw4lV0Uh5WUVZZRnL10dbo6WR4uiCyDwv9k4F JbC5ao6MpuGcjC5Q5byorWSOF12SnCfjRucML54fW+jFCxb6pnigu2cqailrknFzU1W1wjTI wKsu5Oq8+KL0xV40N3GxjKY7GryIKlTUOPVt9N23QMVU3yRGq04EPLWXmqkUTakEMFolmYmV 6sxeM9XMOnC0oFTlyYZV4PlQqKB/UQOSg160hahkxAgFF70L5/U1qp3Fopg/vwTlqnmLju68 rfvlpIHlVawxeX3tkV2NM1OBYMbb86sLOldd9cOvX7qjWWuqEroqk1lsa1rWWNnWsmR6xfgX 6cyUZS/s311R+YOP8UWJBzq2HFFUvNrh1qj4WT39B63RrNUkCxyrUut7Luldev/C8mqnMzJN vTRQFghdzmxet/6xhdP61u9YNO3cLRXtkUz4wk2zKu12jieuCRN/Z+q4l5AHjxX4f8SnmAHq fAoBXK2OsmSdzYJVFpq1UO5smdT2LARKCVO2ELyi0oJFK6aMdis3jD1DCETB3NGx40fTo0cK vPbDEenV9HetUC5HHjNobDsvD1r3aYq17smMCzKKleR6tFhr9GDblVY8G2gMeZzixTw8W+vB KspSVZS9qiirVVnyAgVPZ0olTch8RSVNi8XnPY+9Hj9KJIWx452dIxKIxJ2TMhmAiOcQ0sME 6nXZLtzFMDnfdtN214u2F+3DrtMuYYcPb3XjVl2rvkvXpf+nE3iTzRlzsnab0+VmMYmsnp2Y tWUKs2UzDIN5XRWZtP2Y7YTtbzbWttzqeQtph/GnSkrWYV1p2jfoY3wIY45Tha1tFtxvwcgi WQYtI5bjlpMW3tLt3b21IF4SDkquzrOdBOXPEuvx2CngpVCCplPY5MgiCGbAXIoOgBV9VKeq sIVMVmpMqOCJwBmtMoWqqgl446Z3362IBy80xUL9jaXtxd+rWV3iSHAvjb89Y+zfOi5MxJcs rehayqwM2q+cFV1OdKHpE6fYQ8DtjMjH6Apw5bXqeAIeOh2BGx19eaGTiNlT5+YIFJFGklEs pJKj3ThHRNRKEURlt7yuUlBVyjKT0KMm7aSfm9zsIQfq5qz00K06iRy0TiIFHUffrZAsx/l1 uoCfnLkJjl0iopR0NEkfQiyT0839NvyU/aD9Ffy6+ojvfTVv/pMGz1JPty+03YHvUW81vu8R Akp5FRdoACFrRwC/anvdzSgBPFucnI2ZI/whCVSmFQQvDh8ncRvXzfVwA9wgx3Of6gibVHQ7 dIyuwd+Qt96R9wBEaU42D8bnNg+2Xbxor84/e2+Am33JovYXyJsP4rhLHHxra2s7Gtp/jtxs OeKQlS3/RPrEc14RDryjsCAg0dXYZ44YokzEG9VE+KjJaJWRD7tlbFdDzilAzqKXZOxhIbJp HTJyqSAqWKUmf9TyD5IVyFi4oV0xrWXW8us16w3rzTfY1zrXesXOjk7USeir2iuZsh4INkJe tXnyStQZas4qEM/qakcRoZPmAplk0PGbr153bNOx9Ss2vjW36uppO25dfPOVM9k9j23ec9O5 /l13/+zmL6+vzz224bXxj3b++9l7uomt/brx3fgR9BpyoLlKrIPpcByxs2pHt+u4i1VjJHCc UTSjg2ZFp+WmGG0BWz+g2DAuVrQBY5eRMbqcP/xJ3m46Z6yTmkbNeVsoeUWJey2AAmRq5C3D 5BsGsoLrVvSqBUEbMVvLpjRXT1uxbXx3qmhbm0WvtqqnVJTNWN21Yi/BhBBCqhtVLcgOXJtV OrQere9O6fvSbyTVOmmddbP0iGW77XXP6753JNFpMlt9flaw4c3uLX4mLvIBDwItOuDRB0OO oCsQNxj0jCtutyPRW9dqxsgsmWVzxqyYVWYQbw5SO8PsEAG7C3NVSgjLIdwT2hk6GWJDQQdP 6LaDYpWDIp8DlkQJNk8reaq58Y8VLV5K94O8+pkzRmOJACQI6H1zRolYPkoCCOUFadzr9htt UsQa9Ru9C7DbBpHPFFiAPRbXAlQAn1tuQSCY93X2VlSR1zJUew2FqoIyZ7ZJAh+MAeFBJgkR G2fFgrDdG5tTwcRxBl/w0rMvja/9z00LTuPy8V+dWbQ6UhNczV6zSU5F7hr/xdvjf/jFO0u8 eAZ2YBdu9BF4+N7EKbwKvYy0KKl4kcJrWUUNGpFayVV1qfEO9R41o75Dd9V6QjCpOo4IikTO 07MxSiv1paX19S/TuDStkHGbJj5WGVVXozBmlGlqfxqnmTSbDjxk3O5/wviE+aDxObNW9GO7 A29kb7LdYL+Xvcv+I/Yh97Ps86xaxxo4xjeL7WBVaVEyhT1oGKsOMB6MD6Nhtvmg/ANV3Mvi YebEAVNyUMLSMFt/YJt+h57RD7NpJW1VM88CB8Dl0rN7TDhgypkYk1uJ4qi6TnZiozPgZJz0 UJ2zI8sK50eO6yKp8/O+3jmjZ3thmWO9ZzvP/jE3+unZUWq+l16n5yfbPLxOiLij2qg9wnvU JUhng0h0qUqwxqEvQegbGkDscMAvgG9Y8hZqBpCX8gwHz4VkgtPmcN4mDXyD+3UgcOEfH9/8 wcZ1o4/c/saNgSvGzzw/vufQXQdx7oUHthWbPVa3VnX1eMWxg1vH3zkxPP7ZQO/T1gNPf3X4 3Jt43vOz7BZPBnZ+4q/4Fc7EGECL8h1CDBtTNAi5VXgFN3MWHOIfLpI+R+k5cIY4WBXkTF9/ yIXwK7MB92bBid0AJ6ZDHrRXKXvY/LTwU81PJe56fKOwGW8RuAZRH0esLc6rnXXEv58hgrjM ZliFVbGzfdSek6uSfQrwX1Md+SaAMaoDAD+zvYVNJns8R+pNfp7HjUlqW449xog26o5aogad qQSkK2cJtgqQs6sgJ2n0JdjFQGQWbSXIwUH0HUoLamwnlglCBElcU01w1SSRfQVVDgjlKBbx bePrx/8yfnr8tt+9+K+D122979p9L3659TrYz1Xj74y/Ob4S34frcMNbe2dvfnr85+P7923B xbgeX7Z7C6JfByPVIOyNFwUYZ4FDm3HAz/h9yAuSui+A/V7GSowpDggCBA0xL4qM188aRa/d hwI9uB8zGItGRkTpHPDSzqMg6KUJ8ZRGR//6KU7nf9LGzUeOSBAIa/WIBqNRL2n86kBbkLcZ LZLb5PZ4vE4fT5TJoUgV1Skz7ZU0TZbSdCiRr5aj+Wq3P1/toNVDNpooD0uWSr1RC4NnjU3G GdJsf2uww7hQmm9t919lXCGt9K+T+rnNhruMm6XN5q3+LYFHjY9K202P+g8ZD0kvuA/53zS+ Ib3me8P/n8b3pL8YT0un/V8av5C+9H3pT6mNzR4m4Mdkk5DP7/eqDRqP2u51eOwiI3hEm8nq sd3gN0rkdZe3yCRZTT0mTBRvA3HvMTF+K8P4A75dCOU3bhgfUHSiZGRtdrsoqkXvMP5KURvh HmaXQTENM5l9rX7sH2Y+VQyyYmgznDGwhqdk4rgDop7LDezK6Qa5rnP0G58dIu9JY3XkxZ1q o3Rkc6eB+OqoNh75P3vobJY2HqkT6uAPEKi389t3UX2dHTgoUKXHFqyicmAFtucLhCVqGfan Y/+4rGjqkvH5810VF+IPQ/i9bOfcsU8uzsav++On+NV3W2OBtBCJGJ2ZB7jLvn5ky8WqSIQr Daa6sJ4Jj/2OekCDpDjGPogiTKYAhfYYtT+KmFoGsVaOk6I8PHFO0RI+JftJPZRPKRbCvWQ3 7eg2e0k/86RiYiZvlChHBKmQGsjN4cN5aFYMzgivlQ1O3pcyaAWRfP1BjIeiBqU/TB4FLAbF FhTkTwu28fwropEPk+e/IFooKGK32COyokYra52GcMQBo+aH1GKRvjbSEOETU0kUy26OlNwc VWc0VEo1i2JUpjqKzJMKWY6ayWsh0sU8aQ8nGaqlmM2xaEFLIUIriSRqqyTRCCE+OVBXqCEw 92EnEZCVKhwjRkA5Rt4XD8a4Sm1NYIo8KzBLVrlFS6vfGQsFW/2RWEiM4XrBLzbK2ohPHMbT FYsGRSIuF12PQaPVaLVBmXizGNAgxkbcg3fgY5jD9GWQ2eUOm81tlgEL0w/RoIUl6olcUFBA PYm+vGny1TQIE3kbHygqALKT4gS5qEH2GzM4UFHJ4zWavEa3F0kmj+TzImrkI6IE7qQqS97J w6EKVU1qLJXRqFAVLOgxUIpVsUuNQXsgZhj/a8m6DdPn9Ka8NbNwfUcueW1zdhH74Nhvdsz0 mkK9L/dP67inH2+vL/fgyNij/W3VLYxwUQ0TARg9gxDo7CtBhntYsSrObudO50knh5yKk1mH 7kSMod6Cr8T1SI13oiLE0rwIeZD98BfIiK9EdqhB+DPFgAE01QxWqUUdw6LD+F/QfbZiNhiM iqkqY9xkHDDuNHJGl+MwE8anUH7XiAQ2eopuVq6O2l6y6Jt9gs3o7bREKshmENy8kPnm1cAZ 3BS01F02znTX2jXA4CPTuF8+/vXmvlo/E4kwvrL1zO8eLJb9AcIPLgY8fBrW6EAxrFMqboq9 r/pt0fsxbiV3o2qjuF59ve4G/Y2W6+W7xdssGrW4LcFMFVUxZzDmVLH+CIcE1WG8FDmxsj9G XJuGcYOiTkdWReBJyD+M+SGDCgjePfsdDqR3HsYXIjc2PpcXYFnzMF6umFFCSfQnWCXRndiZ OJngEvgwVkBqNj6naF7UMBpX/DD249OFPZkDG9LZ+3nn2Kk8CI0S9kNMWnk3qIIHJwWjYk9Y NOmiEqg+oWhAH1yCfEb3EhwWISdr/UuwxwRRkTqyhFqTJplwXtbpdAC1M9dMehxVUP2FAV2A OhZOvqQHaLvm1pO/Tvxo07a3rrjp1aeuv/+jVx//BVNhnnbjnI47O+q7Sm/2Rpi1OLxn+YfP Dd3907t2f/378RtvuYo5dOtFiz++Yedjb1+/IAWQlgJI2w2n4McrlVsFpzbrcHovqHQqELlI ZPTb7QmhTpgt/FTgFflSbpF4qWOR82pxjWmN+YfaHxm2m57VPmt4XfW64zXn+473nSflL7kv HTYb9nEulcfmsrscPqegdmidWl+la6Zrq2ObLDhdDONwu3QuXs+6GBXvpKYvC6cfhmmo1cSi 26/G6mG2QtFJKvc2F97h2uNiXIfZCgDfe/dhRgdHfK+iR/zvWy1dllWWTRbOMowFxaLAotxI VuR+me2Wd8qM7HoefwmSnB4rirWLWcVsYrYxLzLHmBPM3xiRcQUOg9iCJw/5VB2RYOGY51Bz Bhz1KCEdIMnmqfBz29T4RfUxNQPaRUfyVME+SY+ekQreKRtd97qgvcNQt1kCTmggLzeJ1aMT U5MOZoNVCFE/Ml4IVefVO4EXGCFYXl1dw+7uOncSL8byY9ct2xGNuI49uuvDTNOTX16Il1yz cIYbq8a/juBp+JGf3vLk2t5Dr74zsGLFjw+Mn6mVykoAq5omTrPPwXlKKIwODy0WZYIJKpWN JHq9exgbFbPajaJKlFGi3dGd0ZNRLmoi1YYutAptQtvQTqRCrggB/W92Jb8n58ubLTgcCheF GZ7BLGZ4IeL1+Dx+D8tbokQOdbocLoYH2XgJCvAA+lYD5Ow6ggRYBvgXITJLtiXIpYHoG0m0 mIbi4lssleY86JusDFXda6S820m1iRo3iXLMNN2zZlH3Dzc8uuXtJS/fcu2R6dne6jX+0kw4 m5jSWDWrknnsNG69pH7HK+N7Ph0/+P0/vPSv8dN7v7+471mcPf3o6kzwgrnjP4Qda4cd2ws7 5kRxdE4pXqtep7necKv6/cgnEZ5nQbVaz6233+Hg6sQ4r2JDrriLZ+UuEBaA4hyUQSGKGoHO 3LvPiVRks/cZ9RgROhIiW611o2KlmFGKu4t3Fp8s5opdhBJ5SFOeY2UsCjCwnRbB4kp8u+Xn OueMnSrs+dk6sut1BXIz6TdVADUt7+EJqNEzSXkjarMPZGmGN0X00Yg6tAQHJM8SFDRALqyJ LsFes7wEFenk8wlPMeVvoGHZDKwwCY1kz02gWlVX4LwVOu8DBCDLPnT7U09cHR743t1vrdjw 1t2Lf3E/Nn5x9dhb5pkzKmYv3LplY3ShamVE3/rjX25denLwmXueuWwf9h3Es8bbxxo3z+3+ eFr6J4/s/kqGnW8BDjCXHURW5GM3FmSxuGi32pCOvHxABpoYqJZpsGUAs2WUIV+wSeQfPEyM 7LdYoRcRw03kZQdCWk/EJCBBAlQizeRukjlA+gkc8XIgOci88RyR3LgyrRb2NpkkHsiUnkPa mXdQ+DA5kj468q3Jz2frB8QYRCyZgkI+hieTyD9RJA9RwkSGkgRZGBRYJHQL/cJOgRPu537M DXEseZQASyP2wii1E1oDflgnycJqQegiq4XEYCdVBkPeVJh3G8r7IVAbceeRzs5keZ73dOYl Lpe5y9np6kbd1ndZlUv2Zh0Q7Io3GyCz0jQ0VYrUZEiK++LxSlo9t7i00sO71O2Wy+1dQM8v dQuYVfMCSAkq22x+K3MPv1l3l3SH7wlmt/OA5R3mfeMH0lnmH6zF3C2AEAqr26p+SXjNeEYQ OSzob2dY9eGJk4ifOKk0VatnMDPVrYF5zDz1EqaP2WrZ6tpu+Yn6J5ph8YB6UPNL5k/MSd1Z jVU8LmAkHBeYXpKSvRuATRsEWriRs6KM3UamajFnzV22TbYdthM2zmbzvM1hOMHjQ9Ysl/eZ 44jL9SxzluzxZR5MTkR4S7THPVmjHa+yb7Jvs7P2s1Zrv4gz4oDIZMRt4gmRlcS8OD0onhR5 8RmDjUNbCVyxKcWcMRDth0UGySAb2DMGbKAvj2EvDd/YTZO9fX1zxnqpaAkcgrziShZeeJH3 YH0gLBNfyFU23NmRJEbys8TKSo18qLaWWMIb2vfzCDNMbwf1LaEGf/Kq6BASyHvRUFanlGT1 EIi+MBTPCvmE+L8MefIlT76tUNLkS5p8SU1LikGdtUmurEs2ZfUy9QekHzR9++vo6LDwjoJN BRCfqao0EyoQCdLPHYr4D/CyZZsX3VESsL3xyK6//P3gD14d24yfVkmupdVzb2OmvrVmzdIb rFs/xvj9v2DhzWemtIdrlVuADQcR4sh//yrBxXvj6WHsV2oiy6rVnFozmGYfSR5Ovpp8n307 +Qn3ieZr7muNukfVw28SNon9qn5+m7BNFAWNuhi4ok43jKOKXvQIvoDHESzigwxDahIqD28I eOzBkD/giQZDyVRcI+o4FcPgEGCWowSFoiguxZn4MPO2EonFoozdIcaS8WdRAqNEBsS/HpD6 Bng+IOBWAb9IxcgDSikyUNOlgVopC/SnyO+jpksfrfRR06XvsdL/YbqkKgd5MULlRJAU/9oJ +gfgK4BA3l+eCAtwCKDtIWlsMs2/GwEQwib6QsQUKmVCIeIwACeTdxkoGDHzZkwLacdP/Gt+ qz4SwbHpjf/Sa+RUpmzscGZe1KnXBEBQZ/+uD7mnL79KxYz9pXnVeFVrU2R8wYqgy+yMRMrk 9ew1+fz4u10dcSKRN06c4lSq+1AAlTDNBXocTdO3cgneSW21IrXb5m24SPbZNdT3RisTumai WjP1w5GdBY35C4Vul0x90GQvUYd95FMKspEBM3GjkSyK2sDMt1hB+1MLqRRLvwkhHpSgGRd8 xagmLFFvmaPnKcSXmOEuEKhZltzq7fFhxdftY3wBLQyjtVPiaqfaL8yQvsGTqUYsM3nVN12a oH3o4vj5PJ8uLfiSF5TeEdBzCfP9EEgt0FwHaLmE5B5CaSClM2dWpgl+TUuWVnanN3AbVHdx /ek96ZG0oKT70wxK24ttyfmq+eK85EOCMEvAcrpGM1OzQPMI91TxzrQwkj6TZGQZyUFCObVA OafXya3y5fIVmmvk9fIOtEN+RjgkvFqsjYqWmK7e7Lc02nwxe73X72sMwG1aLmWjuxZI4VQq wGoDSBvUUaXZbOu299v32NmAfcDO2P+SaOMp+S+tpH55M6v4htKGTQXQnTM61tdJtGP4EYEX CFjO5Cg4iKF8QgUMdzTJibFIVEzIKMlBFBciMi5WpeRJiy0RJWrhRxSZXtxHrDsdHRE+r8wA VXFUfeP1cp4ubQJYLhIKn0v8sqG/6aGTX/z7ja1G2elO6rGpBPRpT4l2/EwpX7c03T790sFr Ll0x44KvX3kFz5zz07w/5NcfPk616tfxe4092daVr73x27xHMfMcuwfF8YFJ+aKYfhXBBxym GHUHizkD2ETtOSZaNlHHMFNg0hUjMOkDFiA+GdS3ImAlkB6gr6UD31iJAlhinXbX8wDiThQl Np/W2KrYphgbiwtOHSug3NE0QNKoNDbyP/zAiBek9F134BAZLgr3rlJvUjNqGMDJw0wpwJoo UJM5fkXdtyDzZ2q5IZnnSFsgUJz49v0yjI/SuaNHO7/x2vIoq0AzMpYz5UaFUYy3coJSjLuK cSDhd8aKTAm/485QLCbXR/2xRqTRFpussoQ5J1HKspIO6zpYkHGcDk0XjxUe86WBYlyMTOFA ICDjfnlAZpAsyYPyiHxcVsndiSev+641pu9Ub94VURrtG+00FXRndJ5LYl8vdUu3FV5+AfwQ CPnWg4pY+8/3tG1ZfWPNrMpwaKHNbCvJWPTTLhxPzihyaVRAAgMxDbaxe371q4ZUrHq6NXH5 +OyWmCccDtulkKkNL915gZe4TAG8XADwYgQKaMPfm/SndUx8nventep4LBRMhBRSMIUUrCP2 MwIKOnIKpEo36TKrIyInfQM9PPHRAfoSWvUCwIdI7NvIAjCitVip/zjIvAJxNE2Sl6iTVI9Y 2QAopFfPA4uYhXrFWik5s8BtCAkFex91QMBc3gI46dCny8MxzeSdXHU60KrO9+bLUapG/Fqf G3CMOM44WAehFbkZlSRVpmSnVmLHkH5ZdZsDK442R7ejxzHg2AkdBV3CLzQV4YSfj4WsMX29 xW9thCkJvAbhsF5XGCb/yVzV1MoBHW7T4W5dj25At1N3RqfSDdnPc1PN++Dl6r6FAlBL6Hea 1C/1u76okwd/k6ty5nguV+o2BJzuuAmbVPd9Xb+g1kf9Tlnl0Zl5b2mMTAjxGaAFC9lv/E47 qN23g34f6SgQgfktmUnUz5ADJcdHahQjOeNMkvZKltXMmOw1Y7IXqVGCpNeM+pn1tF89BZR6 Cij1LZRstEze1zJJWFomB2ghXqYu0rdFQ4ZpSdLbk/T2ZA31JSAVNRK5rYZ8X6kl99VQO3QN /eiBdK1haDtDxqj5DlUjH8UVbNqZAod+OT+GXFyweX+gaElXmSm0A3WjHN3uSpdPn0U4tjxz 3nyF9EnPx63zV83fNJ+dv4CfWeaMpLRCXUqV95xIk88gQFk5CvSO/CbpHQG6/5ktgHqS+sEm afoq9Qr/1mWnDoaH0bWCSpg3f4HgLJtpohBvkik1lJPU+zVJ65I19bRUT0v1LTKhi3mm315D 7PWkuiZvuKeZz2hrTU17C/HZIZUtkxgEmS9oa0tLR/v51nAaE1M4DbAERNd8NJcjri8AvYP6 5nntL6IZE6fRdAhpCJmJ0wfcTpfT6azN/zo8irdSON7xNzvbDyDeQYznwPMGOrAsykCMh5lz +4tqEv4yyCjaopaEf2YTpc/DrGF/KJnwZ4ZZ/f5QfcI/AzLKhaH5sTn18/zzG8VEzRwlm4iL SIjMXLCQHEwkpdNoBZ5TCTNnlGWAenc4HG7JFA5mZNwD1JoB0aFKMdYkSpPh2kwN7qkZrGFq SJ19zsL6cEtLYE7bHKZ/zsAcBs2R5jBzAK8PWu2Vc7rbO4aZRfuCT25yDuNldySTF51NfkPr zxIXoVP5pO6i6csbyQff5Jejf3NGiTl+0n6KvnG7nfxGoyisM+ojoWhYF/Rig7HIEDn/G40+ RD7QIpwC2AF1vf1fPtQosIoYNbgJjm/pyDfVwnlfcHzH070Cty0zl6ysWLDBtuK+5tm9Qbte U33BeJ1latCh4TyxBVVXtzCMbcqM8bKWrFYVTLVWV80tcRHH3Vy5m3rF5z13P11mjBYv67qh uXn+lA3j6xbI9kA47KD8566eUqVqljY53ky/8giHTZdAXZniS9WM2xZVA6PyTJ2PL384FSx4 0M+YOMU2ASUL4n8OgfY9+Z034/6OcwVVW3h7xKgWuoM9QSZILSGAykEfUA5qCYHMGwcJ3vvK iNhNDCGduSMFpyfy7nSvmfp2rC4uqUQhYkRw6BeqGK9lHjdXNZefJ7R72r3CCtU6VT/qD+73 vALs/iT6g0pdg2fiBc753q5Qt7Pbu87Z573LfJ9lwDTgfBL/hNkT2odfwr8Ufun6RDzl/bN8 Fjt5psm80Hx34G65P3QmJJhk/HOQiWUIgYmTQ8iHyIeLGSmIu4P9QQYFpaAcbAuSdQ0EdwYH gyPB48GTwTNBffAK3wkjNv7SDmIxLO+9IWuWJEqtOQuL1AbfCuhwq26bjtGlJWrJ6UY9aAAN ohF0EqlJBYOeWe2+zc20ufEON3YPY51iPkM+NJH4/H/YU/ENRQ2HmO/ljaPE16Gzr3estxNk mlFqTsqNjvZSYeeUuUC7NHN9S32rfewDPkzsxiCAERmZSsmdAMN99D8R7EeSk3z1d+agJauS pCwmSrxEvmAe2StlC0ZSgPReXNDS0aRsBNCah2IqQQO4s02R92774WmM92/+t7LUVL9JGwpd uOyCix/fuuSimkp82YF/x/yJ97Bh25xoOmpbF/A3LXn8J183lJL/76ufOKXazz6IUuzRwn8G iQb9JgOTIrTfgNRRp8jFIwHeyCMe5XK5dBpUhfP+L0h+yYdQFFhNI/2qxks/UaCxk7osi/nY GVVzKE4HvxE0GLQ2giPatXEc1+ZHT6VKgsHSkoLPHHlWrjNHPiGiD8t7TFFKAXBK/yWBN1dl j4HgaYrE5NKu0ivVPaWfRD6JfxH5Iq4jHYYsVbTfa55AZbC0NLGs2udyBTwhqZTTRH3RVDQb ne94yvGU86moqI3UhGtiragFzxFmizPDM2Jz4nMSW4R+qd90b2RLfEuiv/QH0oOkc+R56VDk UPzF0tcir8Xfj7wfP14aQCoOjoNzqCNCTB3nE1WOBqnB1Ka6RFjgvCSxVbtN2uLc6toa2hLZ Eu0vdWxW3+nYHGX16g58vXS9iVOrRTjTSESDBcaPJYfJL8mhoF9GiZQfGTUGvzHg8vtB3L9z nxiPAYhsVBRnJCyLgqgWwom4NZGIA0xEYhlRbRVFtdPmdNnCmohVo4mEwuGM02V1Ol2JaMgF bEAtCho4h+fxp0hGfvzpvgA2mkhJQgb8qaIxGiUJBHsZMaQSoxR0AXxwPo+vQhEk4icVY1yB yYbDca18zrhcg4fx3v0jaHkiRPzwbYon3ebCO134Bdcx1wkX67o/nAZG4XlONkawBIde8D+P PI8lFAXhe4WiUzTprihWov1RJjqMP92v3hhLi4exBx7nUTSgeeL++P9T3JuHR3Gc+8JV3bOv PYtmpmftnpmeRbNKMyM0QqBmkVgEltglbBkJEAizaEFgwOYgO8YY2Q7E8W4HSGI7XoMAA8I4 tuzYPslJOCG5ieM4J49Jgh1vSpwc7CygmVtVPcPim3tPnuf74xN0V3X1Mr1Uvfv7q8+wZQcR NXRq5JASq72u1igcwrYdJspFxehIdCx6NqqMdiYuR6uOY87EOscnzl8Y7+h3XHCOszhwqd+J GtBux3nnOHMBL+UQBxzvgM3vqCgDJEj1cSmLGaOV4JTlPTjwQYUr8nKl3PIvo5VgrBKCU9IP O6SEkhjswKTheIix6hpw2i9OgbBgsANP3n5VYcXFZ0fteQEXFWTrSEX+cngPtvHxFSRC3GIh kCU5tKmUtglgCdmGARqjnITCejiU401vvJl1hG318MXZXqvq7GvWcB7yy6KF/4y+X/hcKLzr qa2n7xdkXrcvPvFn+MKeeruBFgQacTVrxcRf4MUazoL9vvp1lz6h5kycpKk5GT2WxFsAoHfI 7wExSlWOAE8QK1OCZA4miDzuQkzeoIAqQ7Skc5kNWMA1Y3ZlMBOTnGSeU2CjkhrRJo0qKHjt ABijRhwIblbgGKHxMWas4cxlpWrsN1gZRrIl+ndNptUpYCTnABwm7YkqguhKqmhJsyKyZEm/ wrfxjhTTayDtaPtdonMbDIl42XBEtHqic5cDfKfezT1S8UiInknP1M1md9O7dfJHZTCV2MVj kNaDqoPqA8wB00hCzSgYJbWickWMcqsML3pV9/nhi17lKK0SfQHvQe+rXsprCgp2GGtlIJOu jJpNCjR+GRd0jcKFx/YlYGKU+uIorIyNQkbUR6LQbDQx9xmNMIiN2Mc6O7OkrKuTyoYGqQxW kVK0ufnsfgPEpu8Vhj7DmOGsQWFg4y/RClpZcgdKxur540i2IwOiHhUfdJyXNPr6+omB+oYJ U74jVc6dEsJWW0ioCAm2iBuErUE3LNmKsIEIx/YR5e6ynRMLYIFcBgfrSs5vEmlBpDdFRUWm Aj7lFqYumvhNNDKdPXq07Xj/ura6rNeemevzhZKi+1N63sRTQ/44okYzV1LLZ9fvfWXLzESt N8dvtFiq1r49fXY5SrZHPg9EQJaixKNBkh4rkB61xw/Nu0NvBt5M0HOC30lQDp89uSZIq6Fa CAmzQBvspXqDt8BbqM2+zdxW/zZhGO7hHk48B58TToZeThSDFQruDnhP8I7wo8EnkbjzVPBw 4tXEO+k/JYoJvRnYoJMyR5xpZ1Vdsi69JrgupalUUW43rPC5jLwfCBFE5HwuAx+w+VxuPiBS cURZ/RS0UhQMPk9xlLIy+iRxOdnx7SoZZauyU0lj1wmlBK7n3dlR+DXRWB3xeNyU0WCAEKjM JGitTQpaa2zJAf4wT7Ug0YnijzM1UKzpqzlbQ9dkVcTwrSLvQUUkSJXfVkHEygrSWEEM3xUH cl2nIAu+ZPtmOgYIqBNGaUvRiY9cpMBB4eVosXE0Es35joFUDGcNsIi4EiqJiCQ0550OpEdh ShgjfnOkouBY30SVN+ATEoFUBlZ50Srpj2dAIJjmqjMQlHNvrvQl4j8REEnUYQHqM0QZIxgU xpqnGBZXPzvO5NOMEclThDgCDPIUi/E8lGBbrF82t2NjezXOv0HU0Wazw+rLnlClvKfwYCGX 4fRexh2al5s4nVkqVOA4YvjHd87s+/Zz0NE53HtpisWtfv3Ng1+pW0XtoCAsbB3yxQWh1jdI b8C1hme27BwNFW65s01H3Q+fvn3XQQvqn8WLOJ9B/lVgA0H4M4lKHvHKsYWBwR9DbtUBBzG+ O3SjxQ/K9qdLZbPTJWJiwMYfUS+lQDjsQEapLViIM122ObkEtZZvl/JUic2d6GEpyS5Zzpop K+AhdAkaXQKdh8/B53rl8pAASvgDEiKBDmvVxM6ENGlCF3W6kHCtM/NM6ffOmEq4LNuZEHxC cUJxXPmxTyYPYU2DC22ht8rupPfInqKfUylnKWGdqmxicth1QOayAaQPXL6TKp98v5zqlA/J D8tp+Sc6GwCOoE7H6Fv1ffr9etkQWo3oaaBn9Jw+japj+rN6pR5bw+tz+k7h9ZJX77Leih17 A1LEwwA2h18xg0dYjtYqQxzt5aBT43AD1qHVuVVoyyfjOchqXW7gUbi4ko+d5IgR03g/xiyS kqyv+NlRp7tiEzfZrnQvBZy8+9F7f/atu59rfXKpkXO4Kw3QkshszF//jW+szuUi1Ben/vzT Cw8M1dXRxx8nRvCJyMR/VWd+8OrI91x4JqSh4m9lcvl6UEstE1nzA3GIkWm0NDDKIiAqj7XA FkptqhuFTeLZmtoaJ+2SrXCsYFc4V7gUcr3cACrH6mSD2kH9oGGrsc/b5+tL9aX3qu7U7tHv Mdxh3BN7WvZ0hjHrM/qsPufJeLKeHA5RT8g4L+eLRhOZqXAq1SBLs2lv2pfmp2Sn5GbrZ1cu 1i7VL2OWRpfGPD7oo1wZX85Vs9ixmF3sbK++IXND9obcDTXLJxlorTZq0bqiAS1XNzmarhsw D1j2Bh9WPpx6JP10aizyWuVbsbG6z+qs16lqXaCXch2GP4EU3AVLEe6iPvdoldvl6fW5vN6X PLglyz5qrUR0Smew6nSGmK7SIAupSaEIwAkAFJEqOhDBke9Q9PqzEPpCEEmfAZFJmV41Ue+Z IGc6bHrPRJtGqT0nfc97YwyOUkIH+A4m4avJPyWLSTopzsqJyZ+gDRokuWQ6OZaUJV+GTSAP m6CjxEI7YhJmDg4uGpgYQIND6mn1V0HjlMFwJCyca5Bw+lFdSrIJppWWSEgbV2dA1BjKwKAF rZRptKlJ6DJAq4vHwkxlBhoN0UrBHMgAVUqB6eZV6YuwHHyG6CfByFmlXaNfy6yKyTracbpW jMDk3NAm6rQOY16WNuYzaWMpe5G4KUuwMV6qrIySwCZTxktJfTkcCoauho6hnxPMHc/f0HNX bOpHr9zd/KeXJ2d933eyHqUgONuOb9j5tUl14cITX5937oUN22vtTl4jX1+I7Tl0464FUzPN O9dsvH/Bo++p5Q3eFPzpfV/rvGN59Zq49/uD9yy+73/lWF+qZOuV6RD1nES/WpIwY07CxFiy 5ghnM5E1JGvUgh07NrwO4cw/3IgrYkyCkakJJ32wBCBDLKo8sajySeIFStqwWJosW3STZRtv sgwpgCoFkSFNDDT5ZCGN3SlEyA/hdF/sNAqBHKLN5hpCm2smgRBbylhDJPuEWqcn+Bz0745o FNjIMB4rwcxMxMbGxq6Q7ZJD6S3mjbew4lGVllz9BLXilDHvy1NmBQPR/6+rH9Ds1+7XPWZ8 1PSY+VHfwfwxjSbP5p0rmBWmFb4NTK+p1/cYpf7EO+6jhtS3Gd6i3zJ+RH1kHDf9yaxqMDU4 Gny1XEO+yTig2WJUpahKhhO4UCpfC2sZZQWzBC5kFnOyALMMLjN+wHzOyOeYZvteV7+u+b1G blfbGJ/H52ukphsVWpPRonfqPEavwadYRC+RLZK3M4tNiy0K1ujxeH2LKFmJA6VqHMTUCxla E86hd3SrDupuQUNQo2DDOh366RL+DQml4ZOYM+LtZDn/MlnOv0wm87VX+cdwFcManOko+chI MhZ6ZUsYI6RMZouFYX1OL5uMesNhv4ZSezUYyyYcqAmnpuW8NTNBCmgtDBPkfFYOUpwPacxp SFkhIkgc4HwWKAtTRg3DODSTALDjTMt5Dt2PtVqNAg0XlnVotGndkI76TAfP6s7pqD7dGLZQ 2e0HHdDh9OVhng8mQTCVAkkmOYIoytmkvDUJh5L7k1SyszY/Crcd47GTLXbdhf6BDhy9y4xf xwx8gauI2nT0118lg2F9lsWPjBOqUcdBEjyRwogaqypVADrAUXLISUKZFLyP972hVGI8zYGB fmzAGigBayIy0U+kLwYnzJq1Db6IOQ/R4hFRx4sY8xSWQbV5LS5MeaNUqKUC+4iOmPIlmaxk 68IofyZivS0pqAql0kLyoTPlnABYjkL+skOw5aO5OhUfgl9duHHaJ5+s9KeD7NTCjJArUvgD m5xfSDYFKrRGA+esqDRBRv7VS32/mGnW6aweiuOo5ORfFX55C58yaIJBWGGxZ+Dawtn2WgcM Bk1aO7+Ann5wlssUIGgmhSb6An0/qKb8JUpjVatjlTTYFoZhj1lhJZEPVjyGTaSKAXZPUKRK 4Wo1qVbjkQ1KI/tT9K8hdaaDDOor8pdXHQMeq4naUQ2rAdJUFYEd+DeMVmsGgGzmspnsNx1v NDQQK9mY5OwdYZoXt30PuIp/A2zxM+AsfnZEw5ScD8+pcVa6IfZAlLJkk7bVNV+R71ZQarXc rGJVTnXM6gypg+agMxSrhTXmnGuWuUfdo1nHrnGucvXEt6m2a7azNzsHXdviezV72YfBw+qH nA/GToOz2fcVAbVaFYvFKys1UEV5oYW1ei0gXu0FZo3Jaw6pONbpTFdqrOiAeCwWVKus6M2h UyqdaplGFUclq1GrVAGL2Yx0GEWYRDOhuw2nAnmPMWu3O1lsX3Lt08D3NJ9pqE5Nn+ZPGlqz s0Hdol6hptU7VaPQIHpibxs5aOQOchS3b0UcpuINcSrOZrLPYIcFHjIdA/PPd/Sfn7jQgWO0 JkpOivkT52PSoLnMkVVX2XqwzoLHyP9szoH9WOqLEROMxCyJzaWEJasg8LKKq9AkMY+cBCVk WR18riKR4N87Y1Kq/DFYKUQcarZwd83hBZPnTUrz+YjGOys4rXDSyLOMPUPfL4Q94cZCNfxH NGJWa/WCIHPwhoZLm3bfNTNembEZp7YfpI75kgEdo0O9dxEcotooJNaDBpGj5EOe1TW75BCS OXZoQDGwFXbC/fAQPAsVcBRmj4Mh2eLl2JQ20YFzKVIYWQg/Ygw9Gr+Ikk9cpOwPYf3l74W5 9Ev0YRAG+csjIzqZxF5UaypxgeHMMKKbhQUcHbUQ1mrhCAQtV86k4cqaDHdZk+HoSMwsMyic 5dQarYN1JAVDTbtCGSa4PIDg8gCItBrEIBvGU+MEguca1QbpNm8wb6SuiSc6BaqLl45j7lCt wb5WEhSk0UyuQ3dHNBwLYS4WTmLzCnxTfxRdhCNx6KiIwhAGkDWgm9Hiu8E3QPQcRoq6gJeV oLOlkM4Y1n3+TTMZ6zt5Zg5zPbPXJLszDifHGyY3x6+P32S6Kb5Ztd20PX6H6knlR6q/q/Xp yW2Z9uyGrEycDFMqOhI1W7iol73Tb8GRGwEQ5lvCXjCTMscitCyJVHt8J5QS3xPrMFRX+TT7 8UAZ0hxGA+UTjrIQsynHtWIX0RAPsWtFcqfI+c46rBRJSf5SDg3WhzBADkaQsl9GkKINDPbn SamdqZxSrxKyIV0oLeSU1RxM6dEqo67hYJU2yX0ptZMgZKCRQQuZirK5Rwo+DpcdchnbVZhq csmth5XzkuOOgs7QrH0twzf039X37NyaSLU931zg2ElhSwUT8DoEmFUbNi5aPXXBDWJbOhWk 8wNvb+/acMfPxx/bVWFMFD66MeMVBGjTVq2mV7anHYZdhWd7A3Vt16059bP+6xxmIk0iXXwc 0XiOeq2Mla4GTkTbca6iCS0cWqgyAR//9NMGxFmvptxVDo3apVKr/Tw6T2slME5Wi8JUSfzX ZgVFWiio4EiFw9c5E7vyX4oZTP3mDEPiz0S1eZGmzXE9S7PYw6XN+TFl7KrIWVmrM6D2a3gT Zw46OJZz1qnzmjpEpHJsnXOuao56pqbR0cjOca5TPa56RP0N56Oug/5nwNOqJ9XfYr/lfNr1 iuq4+oTmhOMk+5LztGvM/wvHF5ovHBediYNq6CfYZp1ZUsaqpNIblcpZs6QyHJbKQEAqTSZS iiLrzhr9t4IBOED1yW/lbpPvNu3zq+tUWU3WkXe9pRjj33Eq79Lsdexh6Unm2Q7K4sDswsWV 2MVo8U4xrnaynINl02oN4rIal9NJmIZapVTIZTLCYyRW4WS1jlHoEc0rNJDRBDUHNSc0P9fI NTvVLtzfGVGROqQ6pfpPFa3aqWa3ODHIMwfU6H6N5qy6BItDJJPqHC5O6nJAPaamkK736gnG D4f80ttAR+HyhNGS5bGLgWViSLG7QHIanROOD1gkfJV8DB0DjnEp5Im4EDAqxp4SN7mMav5P eIkEW95ftuOTRLQYxFHCxzWcTd+gQjrESVSqg1oMB3fuqCWvwXCYGktexVnyLrSUZCpY9gL8 ExYkAZxjI2vYBA+7w9GKX7xtV2mRChzLWgPuwulo4ZQt4jNVIwYT4gLpgoLS13oMaqMWMRiT t+nSH2l5TYpRqzBmDtK9RvC8v+DPYt1yuJxa7lnuXQ/XU+s9672qFN/At/APyx9yPS1/yqWk oMdr87kY3q/G1s+A0hEAPooxqvhRaky0qGEMiHZDg9mILtcKDgMZGKUiolOlJnZKNTFJqoma pPbbbb6Yl8gI+AzgZbwrvIe8Mu9LVATYip9KcS4ltDh09WPc6g6CAha70IENll4snOa8REY1 ZtHLip1n6kshvVgrBqI2h5byrg/Ix5yox5G8P8R57cRlYwmQmOnAl+yImFAhldgi+6YxpLX4 1i5+1RVqSU28ll4atH17RSQ7Vxli5PMKry8O1k26eGGnr1IQstyATGewbLgBTsU0aHFhLnUr 0mgtoE4MPGj6jom6U7fXRGkeVpvAw9ACAdConzb4WxVQMWRdfCMh2+OlhEfigcA9B1agu6Ny DJiEpA6krSOVnbr1oe79j8PqL245cB3vnLuz0CvMW/M1OPxzWAOLmypnflp48M23Dw9/51Es ExTPw/30CNACO5h+BBEfKIge/dqa/ewhllKIQInhRYxiBS2qs/srDlVQFS9DATjAz9DdkRu6 ICFC4dtB3fgaoMGrwRB4DIGAlnhq2nRc0iMSKkJy2oRlulSbjt8JXTxPTUXvhAYL0eeR/8i3 tgZAOEqHRT1FWykKiTCAglowCn2iFSfZd9J99CH6HK2gT8MXqB/JRmHvkffwnY1f6JAGJ/bm 7SRxmBjun5paqGiFn8i/+o+l8mfxL7oAoP+AOEEt/ZeSTKMLaRzZkCwB3L54CokfLyYsDFWL BXuQ8JokFzkSPyaQME5WprJQL+4xN2rgPv0+wz7TntCe7Nvat+3vht/NqI3JkEbQBnVIrdZ+ UK101yWNy2tkyQZ5A9Ngqg01RPLZdN0cbQvTYmryzgnNizRnxbql7FKhtW6Lcpd2F7PLtMu2 y/6A8iBz0PQdx+mQ1yA3MkaTMe5jfCZfPKqJ2lN1GqZuiXp5TWtdWbcOovvejnR3/CBbUzCV DGUdGhlI4mfwJj2efDJZly/rGEhVbiBJ90TLkNb4mb4VcjhYxKDD2WxOo9XpMojxKZVsKJvL ZnKCeZ8tZYKmHBqvNp1nJ9vqhd6U0BvYFaAC+wIwwApILc8k/hKNhjN4dvGdOZiTy5UCq1QG c4I1lxN0tnA4ndFZMxkdUgkdap09ExZYbW0q5NDQuqwyZ3RDtw99iVQSfwbEOkwmzA+SsgRM JLxej0Y3ChuP99qgLSkg3eAYx0IWkwwdkxPZEfYc+xkrww2YD7CnqRqQAUq49mguGUaaxjGQ gZnT1GsgD+qo+cf4M3ulCS0uYCtMR6y/1IswFlKZzuOgaoYMww7MwgkUUsm0R2a2MJSmuIAO c35nyvEpc74Dv+Pz5EWb8x2pDtTCkE3m1k9RTali6g1IXWfqd77xBi7eUL2hRIUKtRKdvIOY mMuquLb42VEN1rj/dlKdt2P0aVT/8BgqK7BxS+02NeiRCNvgwK1oA5eiBdFPOUYKUuKpMGpw rQ4zQVRGkRqvxSEqxrzAGTGreeeoEaebnENFNXa06NEOPWnBqNUhDi8m1GbC5yFhhbCno2ap MEnMyqXPM+gFmNBiF815hjHmTWiJixV5i+TPtkmFmUAvYEzsz0RLRb5GVZGPpK35KFpMKhu2 JaCL2fJR0YSWinw1XtAv2/Gvo8V8lZHh//z7MlI2vGYHYZ1lgGxikShzTqXlsgUCcdTwNQAG kzA3cMHDUT6gtU1rnu0PwZqqYNWSnecXz84XWhOsRbzz6zMTicIvgq7Q8rHvzl0wBbFYt91R zfh7elY5KzyCQDv8A98pjG6vooNBq8Fu73jjjetNjjAVDMqtnpuLlzZMQmMlifjDUsIf8mIw KqtUzZbTiDGYEIOwIKKo1iDmIIUv0YqhirYn/k8GATssOZvdZq5ggBJnIKNnSVLJh7v3PV74 yV9vOTifZ5tvla+ubF5zX+HmXxT+owA3CY2fwPVv/mJk+CnMHfyI78cI34/DbadAEo2qr9fl UsktjkHXoPvWSF/yAbdyu+Nk8KXIr12/dr8bVLBhJhkJ5YV8eHIknVweXhfuSw4ltW8B6HRH 3c3uX7K/dsmfjsD/CP7K/m7wV+F3Ip8EFW4x4ImoDD6XivdDn0vJB4w+VwUfAB4uXumJNARa EDUJKCsqIzZbBaVSqszAyTjTTtHZ55Q75yRLWEUgCcXkSJI6SIxpdDIOiUQBiUQh2YSh32iQ wGilQAMiORgOJJKj8OZjPE78wXGOX8Ys6piPhYmQ5P0MlbyfDRLWQKpjnGAYloMb3cGo3e0Q IqGoHZvu3WgVZiszUHAFMlfhGM1ZvF1kvH7eF5gs83u5yYDnfAAS2z2IkZzx/gFIwKpj8P/l wMS+prJ/CetO8Al3aH6WuC2tLuy2/POJn+3/9Q+qBqblFnp6Hpp9x+JMK3VLYcu1Dsvmozue OmuYpdF8c6jtoWbUuYrvFz+WP4u+fBi+JjYPm6F5H4SU2JLbR0Gzh4JhKmGptWyzPEy9RxUp pcXvNzM+l4ZHD+Ry8X7a51LzAavP5eQDZrMJUpTf7LeazX7/KPyWaAw/DzVqNaRcTpVZTVMY 2ERnXmQycUyaERmawajUOPuTKdvccYUAUzEHCOQr05ATo5DDk7uei1JRi5VMisTzaT8cQ2I8 +cJ+Ypr3S0Cd6FQ/G+n6Vtm53dFPHIJlTCrUgOof4Fj1kjg/Pr5HQj8BSFHLk7kLldgsAjoG kOAYUZtZcxQ2gLy5Bcw1rwDLzb3gJvMO82PwGXgaHjf/CP4Dmv9EQfwB20F/DEqkmyo+jek0 NpoeQwK+Gc8MgGQH0Y3J2IdHS4WLFCfYPFQ5cPUdTHXNNnOeYiqIy9siUV0Kp0yS4m/HrXlK vDIxALxC5dpBB83DcqepIBGFpsCX+xSJxXDBPnqKW2hNwXewEBu8dDuSaNOFSGpZ0DZ5ymTP ZPm8S0raUBZlL+6Vzbz0vfIWfbgxblEjqoVohuIvqOek4Q/FD40OaAAqu4HVR4xRY6UsrTRP gVNS7Y5e2OPYmNrueAg+mvqR413Hh/ATh17vgBq7It2UpmscNelZDtqWDjtCaVrhkKftdjoG omhrMqizY+U3l26obqnuATvAVsd2djA9DPY6dqcfAQ+lnwFPpQ9Vj1T/2P5Dx1j1f9l/5Thb PW7/2PExe676C/AP+1/Twmw4x96UWg7b7UtTN9m3sW853ky/7Xg7/b7j/bTBiHuvn8O915/0 uSK8n8KkKcCQvETUw8N8wO5w+AG0AgcLIOtw4P43Fc/E5bCnUw4kaqF7tztZ1k6pVSoA0ulw RJW+HomubCrp57ir4lsV/AGxGlZDMgr0jJEzoo5vPFDV9V9SX8UTwKFuiq3+iLIjQa0ALs+q JQkk2JBJzJjysq0fV0rTbUqhZ+gPkDAK0ZXCUWdQWjF5h8OUdzDmPEA9zY6603F73o4YLyxx SEDmywId/D+hQZhXQljuUdfuhnTTxAWX0Io6D+5JVkPzIjgEP4Xn4RDuTLiPTYyllwVsE5/L tlzaerkPbV0e8YSFi7+Wkc1Lw5d3DF+8G8+m11z8rfyifD2oAlPAHNguhkDzuWaKaYYKg9ql 5WwGF8dOU8yq7HX1RnozvdN3uBSyathMYIZtWVyKcYM5GxUz4XTzjPBKZae7M9pZ3T2lr3pw yrucTqePWRRTq6dF3To9ValQjMJ5on+q2zp1qpuWxZOJdEoJM+5KRTw21TJNra56GFAPI1l0 lF7wYm1TgFaPUruQSjrrJzYbo60CGJwpfQw0hhTfg98EU+G/AxZEqbdOuht8zXa7Uz8KvyJa WOyPvq0TicWnJx/p9fX5KN8oTIiumfUr2F52F7uPxTAZr5Ioyz+xGpad24zOO8Zjky02c8/H EuoFDFoi2bjnMxdwpCPzxUQZGAfjmlwgJdZTSpJqydJdwuHNS8ou+uA4YXWgH2ITNqW0XUkg DoXL1myCUzuplMOltNklaFqhpgQlgAQlSygULk2UVCOrgE8sWzSyqf2eWY2dVkF4YuPCZ1bf +u/9T77+3c9S/n9bufPmB782umt4xGuLFm6/9Zb26cva/WfuWDNl2/bhLQ1b6HWCsqHw+nDP ouY5rnvvbL9p05KRHdv/fFvP7inPLW+6d+1Nh1b87uWf7U8GXXLt5AdvmH3j9rqq7RPsi0/d 0vhU1/pvVWP9rhLJMC8iepSBNWKDmFvrvtn9WPoZx/Pp0+lzOdVStk/Rp9yl2qUeUgwp96n2 qdVBn8vD+wWfK8YHVCSGUcUbDD61S8IE4HGLkqcon8KldDMuCgYMRqMnA56MJfHUFVQCZybz 8XgMaeNPelwfut0elfp5lUrxfINyl5LCSfEtShpd6wOxlVxra/L5eMyXSKFTNzif51yi6z0X 7VrUmuvLHcrROcAQMYYhEgtDxBjGLwQJkwuSxiARY4IHsudOwT1AMoDE6kvhW1iZ6Tg/8QVG aa4n6CfMp4j1oaJAYL6kNGbcGUjW8uel7OXPYyVcIKTk8NgRlzFJdhCeGHEJbsekDC2N+CtS CUb0QzX4PKwcDGcVgmAwmBcuKbzNRGo/2NyTnjotsuXiJ+l0jLM7g4vTsgpjuCJTHemWUxMf BpKDhcgqdyBSmLY8bOdSU3cWnhfsjLiK7r/NGxEKv1zfWmHEVABLpR+gL+oFMVBL7RTTy8Fy 715wl3dv5hHnN8LPO58Pf+T8OPyHlK4W7Ahvzzxa/UjmyeCzmXec7yB5UyOrG6X+cMy4tgYr QMfc/iwuxd9X2LMZ9NnQivVmq8VABK1cnuzM4Exhr/NX8O3gu5n3BaUsCAV9NUNXKFxOq9cW tEUq0snqxuDc7DLYxi4PP0iZGID0cLg82FnXVzdUd6hOhSTV6lZAM0pn0BthUzIFRXvt3pbM XcFHg7/KKLk6sa61bhW1iu6Udyo6lZ3prYrNzs2uPu9gcHN4R+QOxZ2uO737MkN1/5F6N/VJ 8B9Btl0l8SiJI2WCAFEnkIv5grQ/WhvP0El/JJdT26IRu91GJSMYF24/DnshEz+SYjouho41 TMvizWMzmkgpWlH7vBVuqPGm3ZR7iSzmq42TiSKZxpxZlB2SUQCtzsloAkur0ZuyQAY5jN4A fyoKcdJR46RPxklHjSMpzIAxO4wc3jQeyNe9DH8KeNBFwmaIsF0/H2Mr4CnpOvqxnF0lydlV WM6OYS8ENrQSGPLYwBXgUNRtxwlQD1okT15JAJ+WygYiDi9UOl2si1IoQkGBEjKhiANJ4ill VQYGvKEMnYVVGTrsimZgWp7MAMHjzwBvNZ3LIHKOZPD6q3XFSmmqqX44MDAABvovQ9sAbB20 laBovyydE3xvhUBIaCn4y3RFTlco6aP3NnUNvff+xFBmiWD3YKTSuU+sevDArRO3CCvy9339 utdfWt062H/8laWv75va5qJe9E6/YXf3qSVCTWCA3vBvfFxwBE/evOabRqWy4fb5Nz9tu9jr +va2lvsWy+SY6i0qfkgvlfeAajjvFNCQ0Els9Bbrdflp6kZNk7bZL/uJGkajtVEx25n9SfZc 9q8aJcjCaepdgR3JZ4Ongi8lf5h8L/Ce8Ovkx/6PBN0cVXQU3nMsEmHAKHX+2Nk0TI/S2eO0 nLFB2yg8eNwjxlJZzyiccYzRRyOnYQ+wAjX1e1Hbyg1x1H6C2zRKZ46N6KBuFO5H7XjKxP2J Q5hk0pnjKzB1VI5S74saMQsPZceyVBaMwqknRcurFsrCZq5B7pKAu8Y7+i/g1XmGQOrEcJ47 VshSpVCqZMob0hhlCj+S24K8wMsUcsEQCmm4lTAlS6yEXiOq8drwSqSQJBXpldCn96wkkVRX gHRKUDoDSIyPWS47tCT4dv6yg9d2FUw77gFTKemj99QduePby6a/tHOo777CJ3tXpXjWadpm FyrXPBRw+mIPXse1HJx9W+djPbK5ex+4qWX5/QeqTtwyctvTM8OeuEreoNAe 2NDSXOuJTPNq bryjZe2up/DXxZHO30AUsBHeLNksT84iAfZAGC1+QRLChCxO8zTjapZwhywZlVkLnkrHQsDX kZ6ESz8ZqH5sJJL0JnKg3zkNT3/iQUscLSm0JIFOisoHDWipx27aKSAYTE6hkm4NBRpSBL3z jDQzCl5JntkxCfnwN7Ex7JYV+/tmHZp1dta5WTLLrANusaYVVSmzz6Xl/X4cG+3P+lxJ3t/o c00lcreGD1iwThlADDnBB3I+1xQ+gN5AIBh0TZ0yRavVUMlEwu12qcwWPyX64Xt+yPnT/j7/ If9Z/zm/wj9KcaKTmdU5a2wWzc2CsxoFf64V9Xkqe6AJS9lIYhrAwjWDvTzXzBoiBQoQ/lim BZKVG4NaXsHtICKwJANfIwXz/3eoj9Ip8Elqq17DxdJpaiZhinqNL55OT7ycXhRiJ4bJrqqJ 0yX4D7SHakQv0eegfgnv6JFAP+zMtNWXHriCAAK/UVh1FR7I+qsOI3gghbkyQB8GHhCDPy/Z u50h0gVCFTYSB66ASm8pP8OAewXBAClZSkiPMZSnlzRgzZPYUeQvSSnwIqP0KIxec0BwKKLt Zq3SIPnLJSjMK0nwY8RTLznLx1yVOI7LVYn97y7iP3Uand6lDA0TJHWWc4RbE5SIqMUTkUMJ WdqZ5hsqa2MtjOgU+ZbK2bE2Y6uz3dvKL69cEetlVjpX8r2VtzL9zl3efn5XbLfz3tjjxged j3sf5B+uPBB72vaU8zn3C7FTtlfQHbwb+zR2MVbJJTYLmyP7LA9ZHrKOJZSL0OhQGaJeZbiU Ce9yGL0+OuCMQvxYAcHjUCoVBpcL+HwG7H5MAR/cD6lOpOYchnQJufOTUBVT0VpBvVrxE4LJ T1LkKmbEyygdOF50ItYxIMHIpIhRabxhYoAg65fYmSMYsdiD9hAHIha0EmwBDoatGKxDmgQR EhC6/oHaGE45jF1JqS/JZSWxHZA82km0qQw3iKkVvd6RmVuottR6rI7r75qz+6fQ+v18Z6gu 95Xw6oa+Q9/ePPkG+vDFNW3VbkFgtPmFcHhDy19+9BEUOM4dnEjB7zYvrX/ltVNjGdyzOCSa nUIcRwP04JdixKaHRtCoF420aISVOlihhJQC0mq5Asp0Wj2Q6fQynM86Ct2iWamyKpUqFS1T KnQq4NND/Wn4OFAALTwo6uVQoVYpFCq5TKeTnYZzkASogmtErVptpOFB+jCe9AT+VXTABgIT iOe7PGQ8Z6SNClEJlazhKizA/nrCNernX8DoTh8wxOCTT5UywCYGkH5NhAnsxpWVVCSj0Yjk 4AEM5DMAKwKmgInPQSQMIyX31IknJ16ntmx6shCEF75aeBSuGaJvv3QP9c0JMn/rSsSDMWo7 D73ijCdk0NzuXefdJd+l2OW5R3avR5mjcvwSegm3jF/v3irf7t5DDTuH3d+mn1ZjtHUjRptj TGZLhc2usuopmsavysTxVo6WcbzT5aaVDpkctR48xnG85SX4d+CgLSJ6p/B3gPodzwMZkJDp Zh0fIokko/BzxFsDUAx0BqgAYtp/P8FQh3jI44uIak5kDjEUw/pfgg/Aj8gbO9+Bww478Nsh 7Pb8ZY2SMFloypdjqORSfGEZxU7U46iAAe52eDt1O6cgcHYkNRYbIbTrZb3m1d4+eZ9Hjif9 hUpeKZPkqKvw8cv4dIhmQnr7dYWedqh+bPeyOxZs3r6jNxlwhlPN87ccOXD3xpehTD7v2RPh A3eNrj8xFJ60qNodY/jskV23/KIuoaSM+FtEkc5wEn0LDoyILiSh4xBOKPqXUWupm6lh7hHu Ge4Up4P+UfhVMWNYXbOEusFLqX0umvfbJrlMU/wa7NEOcL4yVtwf3CaGcgcoWgWehxuoUeoN MWX7Z/D4arWG8FUNadUQOqo5wHd1XEm0YSSXNMlPxNLt+Y68ZE+GA4jXQDv9JeGyIlRiN0QP q5E9yA9e/KCcqEKt2bCMY3TVX1n1+L/1wJuVhf1CLTdIr8dg9wKsFLdfen6Rr8Ka3ILeCh64 24h9/zWxlye6Lk8ECV6M5Fi+y7S6RuVzUbzf4XOZeT/rc0E+gN6KiQ+YTRQFVQ6WIFKwBEOK leFTWb+6TzWkOqeiixicrVXVqaJXqMZUZ1V0aaY38gpUOKeEJCbhMGoPUbO7uD5+iD/H02mS CE5jCxlFDGFo7JF3hVQEnMtB3hchlxJPxmvh/8Jly3yZ2vYlRopYLGGwwjXIWbh+6X5Sx1St q9CkjMu/CqaDxfA34k1PgaemfTqNBixwM2yFu5Vd4t5qU0IGRD4EH087t/SLRllb61MVT9nO LpVxrdwCbuEKh4xHXQ3Jvi2yHtBNrfXsAbLtYBhcnEYfUU2bPj0zHbQsrJo+DWlWWpmzsmVa hpLNcIFRerqoZqbCqT2AzHE1/eR0Y1MITFe6T9PT0e+76FnH591W422yj9ILxBplUzJbo1m4 VlZbVbVkqbapssH5AufCSOm0y7k0X2ucMzSHmvO0pQ7LRqK/1S/zs0uWjsJfHeMfv9ExCift LlmTJjrGr2O+wGYlomNNvI/nDcfe0A+Y9xErZz7vmOh4n3i8JYRcbDf44R7GIIWKTZ7ZPGmK PD1rdtPsxtm0YnJdfR2liIfUQkWIE0xCMBQR9KGZU+YMguZJczxAkZJ5gCqhHYQ2n2UUbjkG HB4nKk9Ct4t1MgJuEz3AEEZHzK6bMQjn1s7zAHla6QGamHIQWHk7OYt1S6U5YETlcaiLGgfh Zd8fjJXzda76k6Yg7ydRzrW1eF4JumyzMueyVDDgl+FpCWQZDlgyFOD9QSrHmBEblZkrCH4p toKVQbCIOcw+SYlBJ0oXkSKc5UNbprlj3Jwz9z1Z+F8n/lAY/MOPYN/PoRI+M1i3vBAq/PSP hZ7f/Q2+evEncP53v31p77z55vuPzpy16XuPb75+RjvDv948v7918qx43dA9XO0c+pVC/7lt QS5+H5x99Dnof+zzQvZvHxTueg06obHwx8Lzv4Xf+BtUwR9C+Fzh5KmThUeemD2t9vpjN+26 6Wuwp39RY+MmS8vgm/vbGlraTt5wcPX06xANwPMbPCtfj1S/DnGxRtaUpNiwM0IxDoaluBqx prNmm6rP0cduq9zv2M+OOEZYbSK1VbtHSztqks7Wmr6ae2QvyM7VyHT0ndqxGnq2yutzOf7b b8a4foEsmaPiGJmjAh5DIkKzOKPq0Tg2nysicdoQ8athzOclcqWXUEivApMHr99kajXvN1NG c4uZwhDPu8xFs8wsIxjs5tHi+RIsO/U3Uaupbw1BY8iH88qLn0k5GSECqBOak1s9XCK0HQPz J75AuogU+ogpyHkgyaap+svZOCWpK8vFlIxKiISj4cowrdCFgoKRN02GnI8xKWOaBNAH0Irh DJOBOqxIQK1gSIBrulqlBP1MorswHES/FEcU4HAHMZeRxUNXqBTqS1x5LrAy95sk+wjRscXb XylM7Ol/8L+Hmu+Z5pu2kNKz13msm8/tLdz840eWrjn6wI/mbu+ttVhctHx9YfGhBVvOvPCn 1wtjD4QEeNeaBj4UygobC11T6y5976/Hnvj+umWOaEUgg1jYrUg+GUYSGwtCIAN3iC+1Q6jO +DKV4d7MDv+QdkiHZ0C/XRgKDWeecTzp/I5wTPei82TodPhNzZvaX+ptSqCBCj3lVIdtertT 0AuGZngP/Ip+t+EZgN5MHWwGzXBOZAW8PnxD5iZwE1xHrQ3dFO7J3AJvDW+N35rBMxMOKYdU t5tuN++z7rM9LHtQdb/pQfNjtqdCL4RfyIzKTqg+0n6s+8jwUfij6qhSrw7XgTysrZbPVAGd MywjK8ZOEJEV8gQuLHrPNDWSPdVQJEsa1RkkLzIgJ+YoPHflody5nCwXeBntoJF8VAmNoiZt F+377bSdzb4E/1gSfohxnQg+4+cvSEFOhPDZJUTw6lgK9VKbTFUh8PLASuBTelbCuLVyJUia 0yuhX8athF4MihyzJVaClCkhAfRezs2SoMFxhmt5wriSRb0MAILarjar2y1lAkWmhtv7zY4f P/PEDzY8N5Kf9+6R1zYs3Q6rtolb16wZylXVLGq9d+OG20OzqOfuOLT0jlePDsw7sP6u69b0 7/vR9q7Ny4+8vWFny7qbt7Zke1KFPzQ92XnbYzuWzc7fhK3lxd/SJiQRBMBH4uRGM1xhWWGl Vtv77Lt1zxnHBLnZAdOCKFBOlSQYeIhIYHO4GRtLQSptFa0UmayR1hxnI3q1x43jvvHodped uW6CqYVHpxsJR2mVqNqnOqg6rJK/qnpPVURSAlUSCz7GU7ThOWGJvOAU3mMgcy4ojFJVx/hz 38LWw/MdzBeXvbmSTDCOpyWsl6T4sg7FOF0anVPnngy1GpeWnVyeAkBC8O63XJEUFFcg2kvy Z0ma+DERGBwznhi8cQPLx7lM2B50pYj8IA8ToWFi3SOv3NtRX8X6Kq+vmb6YPlCWIYqrCk1w n3wf0IIofKOkc2sjFiJuWXx4duMLL2IdW12eBU9dnpZZjZ2/Fmn2ZmnmZw1u1vuQzEROQZVP y0iG/1XGNnwHCQ448w0ooiR6Xhch0fORqM31nwxIjZ/BKJzM22fKE1PEytM2x95C+viJx51Q wcIYthY2TMrpY0eRDi7GWmP7Y08bnvYciik4tDEUoxnUcjZGOzFYybSwNzKTxY+kWGJxqitZ FxfVKW04VUPPAKBTol82HrRAEppeXylNgizOytHJmN3u1OlKczoToDv8pGgd9Pn24xQPiBHf P+NojiNx1KPFz5GEiiP1j1bGfspjqDliRS7l+OJOcB1DHGEXYuMDzHgHmdJCUkpGFGdcL5LZ mMcH2rEduaTtmWMlkCqpt7i9BqNHcBt9bug1uPDskLCcjU48ZF+eTvmqNA/J2nvVrMqRWH19 rLK+fugHh65vq0Jam6mLdyRtV+ZW3kd2V8bqC9ylNZ+cnx4IVOuVy4RlX6PueShG0KEUeYju AQuj0qK8Fwl/94I5tAeslgGgp/KgHpU6tExBdSsqG9Fxm+T/DgKo/Jp8KZgrA8U/ou3ZaGHQ fgotn6FlAVriaEH7QRu65jzZZsCj+kzqWXLdKYo8MKH2JnSeHrW1oGsF0LUuouOG0HEm/Luo fRFq+zvZ/j2YirYXo3NH0EKjNhfaTqLj/fJ/L76PBDc/umYzOq4SXcuP9i/C94l/Ey0cWlai fVF0TkZ5I+jC94zabkXPWknli6vE6UsWiw1Tp9RPrsvXYgkrU12VTiUT8VhlNBIOCUhs4zmf 1+N2OVmH3Wa1XJmzlgSU0xQE8cZAUyc3EuockYUCs2cn8HagCzV0XdXQOcKhpqZrjxnhOslh 3LVHiujINV86UpSOFC8fCRmuHtQn4lxjgBs5MzOAWNbyBW2ofu/MQDs3Mk7q80l9P6nrUZ3n 0Qlco6NnJjeCxkHjSNPWnuHGzpnocke0mhmBGd2aRBwc0WhRVYtqI/ZA3xFonwpJhbI31h2h gEqPbmrEGZjZOMIGZuI7GKGFxq7VI60L2hpnuni+PREfgTNWBVaOgMD0EWOMHAJmkJ8ZUcwY UZKf4dbhpwF3c0fiY8P3jDJgZWdMtzqwuuuGthG6qx3/himGfnfmiH3HeceVTXRx84y2PVfv ddHDjY51HN4cHt7DjRxa0Hb1Xh6v29vRNUYooalzuAn98D3oFTYv4tBvUbvb20bgbvSDHH4O /EzS03UHGnFL503ciDowPdAzfFMn+jDO4RGwcDt/1OkUTxXPAWcjN7y4LcCPNLgC7V0z3Ues YHjh9mOsyLHX7knEjzAm6bUeMRhLFZ3+6kr35X2kRg7HteaFl98rxHcUmIO6wwi3ikN30hZA z1SLV921YHhVLToM/bVDdNbIavQ91o2oZ3QOM3WoncHnj8gFJsANfw7Q9w+Mf3ptS1epRSEw nwNcxb3kckdD+8v1kVhspLISdxDlDPRF0T1OJdu5RHzrKDUS6GM4VKDXB1rRu+1qr0uhl8/z +PPePSqClWhjZGhBm7TNgZWuo0BMxdpHqE68Z6y8p2IJ3jNU3nP59M4A6scvIukCgIoRVejy fyNjszT21I1A2/9jd7e0v3lRoHnB8jaucbiz9G6bF1+zJe2vvbyvVIPSDvTCR2QCelNzAqjr LVzehhvQf7nQFGhc1zkbDTV0jyOWGW20i2qXapSLJpdC/feGy1fGG206fC2ZoCD9f/WoUoU6 MGmBXNMI0zlbWrdreP5fPAmpLfgsUlw5rfRMI3Wxa7cnX7N9ze3phml0w7IQ1bx4+fCw5pp9 TYhYDQ83Bbim4c7hrtHi0MoAxwSGT9FtdNtwX2Nn+fOPFl+62zXSdE87eogeWIe6NgWmHwnA uxYcEeFdi5a3nUIsnbtrcdtRJPHN6JzefiSI9rWd4gAQSSuFW3Ej3uDwBtID0Kg4SqnI8a5T IgBDZK+MNJDtVaMQkDZVuQ2CVaOU1MaU2yjUJpPaRNKG/zClQPz96j5ABlZ7ApA/iLQd3L10 QEYhkQzcDoaAgjBT/Mch/ScCoiAOEiAJUiANqkA1yIAcqAG1ODAciGAamA5mgJmgETSBWWA2 mAPmgnlgPrgOtIBWsBAsAovBMtAFVoJVYDXoBmvAWrAO3ATWg41gE+gFfaAfDIDNYBBsAVvB zWAb2M5ZikUA/od7yP5/vIcecg8b/od7wDOo/R4YgAwoi78tXkRLsfhh8XzxfdSiQHtUxd8U /7tYKP6seKF4pvgfxc+Kvyj+Da0vFP+K1h+gI7+Pzvkp2v/L4gvFJ4qvF79XHC0eL75c/Hbx YPGd4uni0eJjxW8UTxV/UHyu+PXiQ6j1xeKzxZPF775XIF/m/++/Ul8o8ujN/bO/GRBPiiOD ckgQo6EaaqAW6qAeGqARMtAEzdACrbAC2qAdOiALndAF3dADvdAHOchDPwzAIBRgCIZhBEZh JYzBOEzAJEzBNKyC1TADszAHa+AkWAvzsA5OhvVwCpwKG6AIp8HpcAacqdyyaV0a/ZXKmcym 3k0buwbWr9u0dqB7cMvAJvnmvq5V3Yrubas2dG1U9W/pHexevXKDZtOWjSu7BzavW7tJsbp3 w4auAWVf98Cq7k2D6q6NqLa5a9NqLTl4M7rShm51X9dA96YN3WsGNaQ2sG5tz6Cqa/Ng98C6 zetlfRu2bJav6t24sUvRs72vp3uTAl1jXe9q+eYNXZt7ZDu6B3rp3k3d9ODNvfLBnoHubtma 3i0DsjXrtnbTm9dtk2/u3tq9Sd6NLyrbtG5TN7rWht5N6s3dG9eRmmxD9+bN8u7+LV0blOi5 utDPokfp3jy4rncT1TVYfhmwETbBWXA2nAPnwmY4D86H18EW2AoXwIVwEVwMl8ClcBlsg+1w uXblQNeq9d2D+JnUK1GV3Kqu1EqeT9u1edW6davWDazaslGzZdNq9FpW9Q50o9FB5+B+IAcq +aPyDNoUpJI+BNZQZiinKAUtl8kpLOxe25cXz5/BoXHLFS/J70E6YEbJw9PXHKNAYxdRJhmO m40AUKpTaCRGSnUa1WpKdRmq31iqy4ED3FmqK1D7AUQZZhCasAz9iyFKsA5Rnm402q9D65sR dehF212IDixE22sRBdiAtgb+5bP+1eOWom1MY9ahlk2IqlUhapZG//7F8/83fpRmTgplbmRz dHJlYW0KZW5kb2JqCjI5IDAgb2JqCjQ1NzY4CmVuZG9iagoxOCAwIG9iago8PC9CYXNlRm9u dC9DQ0hJV1crU3ltYm9sL0NJRFN5c3RlbUluZm88PC9PcmRlcmluZyhJZGVudGl0eSkvUmVn aXN0cnkoQWRvYmUpL1N1cHBsZW1lbnQgMD4+L1dbMFs2MDAgMCAxMjIgMjUwIDQ2MF1dL1R5 cGUvRm9udC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9Gb250RGVzY3JpcHRvciAzMCAwIFIvRFcg NjAwL0NJRFRvR0lETWFwL0lkZW50aXR5Pj4KZW5kb2JqCjE5IDAgb2JqCjw8L0xlbmd0aCAy NTMvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0KeJxdUU1LxDAQ/QX5D3PcPSxpu4qXZUEr Qg+rYhXPaTKtgW0Spumh/940CZV1IBne5M2bj/C6eW6M9sDfycoWPfTaKMLJziQROhy0YWUF SkufUbzlKBzjIbldJo9jY3oLx8RSs8tM/hHc5GmB3aOyHe5BYc/4GykkbQbYfdVtjrWzc1cc 0XgoYgSNSi/1RbhXMSLwqHFoVCBpvxxC8h/jc3EIVcLfF6swy5SpFRkikxMSSZgB2akIdobT S7DzWurf+33K6nr5I2hjRxdReYOqG3RcdYsqo7uInh5ilay31lvXt00mZ6IwVNxenIaF1rXB 7RucdXEh4bBfdKqHnwplbmRzdHJlYW0KZW5kb2JqCjMwIDAgb2JqCjw8L01pc3NpbmdXaWR0 aCA2MDAvVHlwZS9Gb250RGVzY3JpcHRvci9TdGVtViA3MC9EZXNjZW50IDIyMC9MZWFkaW5n IDEwNTkvU3RlbUggMC9BdmdXaWR0aCA2MDAvRm9udEJCb3hbMCAtMjIwIDExMTMgMTAwNV0v Q2FwSGVpZ2h0IDUwMC9NYXhXaWR0aCAxMTEzL0ZvbnRGaWxlMiAzMSAwIFIvRmxhZ3MgNC9Y SGVpZ2h0IDI1MC9Gb250TmFtZS9DQ0hJV1crU3ltYm9sL0FzY2VudCAxMDA1L0l0YWxpY0Fu Z2xlIDA+PgplbmRvYmoKMzEgMCBvYmoKPDwvTGVuZ3RoMSAzMiAwIFIvTGVuZ3RoIDMwODUv RmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0KeJyNGAtwVNX13Hvf2/fyI5sQQj5g3vpIYrIJ IYAQkphskt2ALIT8gF1A3c0mJCCQFAKSQm1GBsUF4lYdsNoKKv5gqm+D6MYqRKyfmUrr6Jjp CFp+RcaKMlaxKtnXc98ukVDs9J7ce8/v3vO5n303QAAgAYzS0eZtjWBwAuuMDmRESJKCzaRV nb4rdAk28au9G7uitB0bxbehW4nSOI8odK1ti8pNHQBsXfuqnuUROobP39+xuntjhI4NYJOy vKt9dZTeh+P3+FZ7o+PNfP55XZ3ruqM0129Y0FQ0NUqfxWbRGu/qtgidVG7EwGMTAQoeyJx7 R2L5t3KCbEifmvNaGe/fmD1L1PVwhfyZHIdknKFvuA8gx4UrsF0UPnB5svzZiORKwVlhahTc UTvtBheAghmKYCFiX4p7DOXboFicB1lYJ7CHIRNAPxWtZ8Nu/YJ4J6jhlfqJ3ERUfilaI8UL 2XA75MFcOAoX4TDJh3oY1N8HH7joXVCI/AfgFRiET8EOrWg5g2wGRf8d7IAc2AJ7YZaQoR+C eXBeToRUmASlpBNMMA59fZycgFvBiXOUwWy4H9Zi24D870gJ4ZmLhdvQ+sPwGByGv8DfIR1n nAxDRCLf6X+EGmhCHzbBAHwqVovbYSz8Bp6F5+EN+AeZTPaRz9mX+iH9Pf2fOCoPimEGLIUW hAfhCdR7Fv5MVfaUnqFv0p/T34UJ6P0BjPoNeAttXSIKWUR89BnWE/5BX6Mf4HsNfUbvEaow mjrohqdRcwh+JDEI91CFVlJfOEkfDxJkgQJW9G8hrIa7YRvsxCgehT3wIpwnlaSDHCNf0gTa S4+I9VKdVBdzZPgjfbZ+CW3EgwW9XQx3wkYc+SA8BLtw5BNo608IF2GYzCBlpILcShrJA+Re 8jT5N7XS4/RHNoYlsgLmZh62mZ1m38vi8ILw7vD7er2+EXNJMOexuJI1GGczLIMuWAd3wWbo Re/6EAKYvQMIGubzCMKb8AmcQTgH5+ELQomIMcaSfIQpCGXERuaSheQO0k7Wkd3kZRIih8lb 5HPyDZ1OZ9BZdAFtpO20i3bTANVokB6hZ+m/0MtS5mDr2K/ZAXaUvcs+YB8LIMwVvMIKYb3w sKAJHwkXhW+EsAiiijBZ9Ip7h58MO8NL9Ry9TG/Rd+oBhPOY4xswmhzIxXjqcVV9sBx3ThfC LxB6MHdbMaJd8DjmjmfvZQjBa7hLj+L6vg3vw8cY3ydwGr6D7zE5PL5xxEIKSTHm9xYyG2EJ rtMGspn0kj7yKOY5SA4hDJITGGUYI1xE3fR2uoFupjvpbvoYHaCDdAhXQmcmXIk0Nps52WK2 lN3Outku9gj7LXuc7WEhNsjeFqhQKtQLa4UtQkB4UnhReEf4UDghThHLRD+CJh4SXxfPmZJN mabppiZTSDLJPXhDhOEgvANBOHTNTQBkGzGTIPyBfMYE1kvfoy4aR4fIPcJfSS6uQDkBsQ/W wNfo4UTyAZ1JFjMfWYL5u4csJ0vh92wCe5LNhffENaSJ1ePN2STshsvim+AV/bSfUdHPhsn3 9AB0QB+9c/h53U3GQBPZR5/BHfMrKIc8IQOG6CxhgGTTPHpEeoGEoEIysVmsVE5Eah87g242 yYnkc/Cy03h+TuHZaqTP4J1wjpyQFqB3w+xF1PkVVJB94SR4XnRTD5lA95F5w1uG/8Ye0/eQ dHoaYDhpuIrW4I5bqO+nh+Er2B3+XjgJh+lxWIi3hs84OV/j2bsLb5pFcJkm4HlqwnukK9ic XJVCcxFyaA50klQ8FHcY7QKjrTTaIt7Sov6irKwQndy/l3cF/RPzsJtkizuVkVWcm5xVnsvp 8bayVXlZJ/enZ53CeiB3ata28qlZW7AWYd2ANNfL3Z+X1Znbubrz3s77hJmQmopRJifJthA5 8/LClJiUmJmBEDlimyUFXpcCB6VAuxRolQKLpUCtFJghBSZLAasUyJYCk6QUOVk2y2PkeDlW lmWTLMhUBjklpJ+0WfkvRorJzDuTwFvBwM2UtzTyg0KJTPG61sYyJ3U2VROnNugDZ4uiXWpS QyS2YYkmqtVES3aCs7k6TSuxOkOS3qjNtDo1qX6pK0hInxu5Gt0WItDsChGds7Zmask1rgEg RN+6MzPau92QuqEyrTK5ImlWrf06jSfaWn8qadari7O+5zXIIuv5bUq6D0pZD0mc24TcgMEN cG7A4KZN1HY5m1za/olubSpH9IlucrDqkG2To011eFRHG1aPtn1DR5rW26IoQdshLlA0luNp 8XXw3tumHVLb7JpNtSvBqk3XEW/i4irVHoRNjmZXcJOtzd5fZatyqF67ewDqSEswv2+Uufuv mBuAfNLy3zOGSAufMp9brOu7jsU+Lq7jFvu4xT5usc5WZ1h0rOALWO8KylDtrlkW6Q/SuFhc C0+mxV2dau6qMBamzJJ2d+arApDnIM7q1uLVai0BKxcVVhVWcRFuGC4ag+zEqCjt7jJL5qvk uajIjOwktRqs663XlHW8QJpjhZ1X9GRAH6S9/clZU61uK/8SaQcQ2vGzhOGaldluMEk+iveR 4GMQaxJ9jNGMGEnwEUiX80rSrHXmb8rnD5fXmS+VzzcPl0Nl+XA5r8VTpiVZkrItSZZ2AS4r bPCyTYQfQREGja0NH9Lj7AX8frIMACMv2cbESJCRYEqPT/jKwqe11p01n4PK+ReKp5AUk3pj zs3TZ0ybmkqPD+1+ZGjokd1DtCrSD6G3x7jPWH4A4+TgvCtttubKilvKy0pnlcy8efq0qcVT iiYXFljz827KzcmepN5oUbJumDghMyM9bXzquJSxyUnmxDEJ8XGxMbJkEgWGERc41FqPouV4 NCFHnTOnkNOqFxneqxgeTUFW7WgdTfEYaspoTRtqLr9G0xbRtI1oErNSDuWFBYpDVbRjdlUJ kSUNLsR32lW3ol0w8PkGLuQYRAISFguOUBxpHXZFIx7FodVu6PA7PHacLxgXW6PWtMUWFkAw Ng7ROMS08WpXkIyvIAZCxztKgxTkBPRKy1DtDi1dtXMXNJbt8LZq9Q0uhz3TYnEXFmikxqe2 aMA3ntVQgRrDjGaq0STDjLKChwPblWDBoH9HyAwtHmt8q9rqXebSmNfNbSRZ0a5dG//Ls2k/ kTg57uP7rpZmMr8jbYXCSb//PkXb2+C6WmrhrduNc+BYml3r8dei6R2YRWeTgtboVrdLI1vR pMIj4VFF4ouc3GzPSkWLUavVDv9KD65Nhl+Dxh5Lf0aGbUA/CRkOxd/sUi1aZabq9tonBFPA 39hzMN2mpI+WFBYEzUmRxAbHJEaR+ISrkbYRmYEZ6hxzNo5klnCP1FtxR2iKT0FPXCrGVMKb thLw+0pQDYub4CitFVdkhRZT4/GbSzmfj9fEbLOq+L8F3AHqhS9Gc7xRjinb/C1wlO+Tkb2G 8iu4ZrVq+fl8i0g1uKboY4VB31xYsCFEq9Qus4Idpg/qMbded2kRpt9i4Qu8PWSDFiS03gZX hFagJbMfbEV4H1EPlwxekYxbyCW9VyQjwz0q7uSXjAtinCbnjPwlmlPHOjpKNZL6P8RtEbmz SXU2LHEpDr8nmltn8ygqIi8ZkUUxbWyNi2XSKEYzmSHFTblsRJkTrnhNyMY/k7GpW0OSjLvS 4BClVjN75kRad6zF8n8OCukX+Sij+2lY1E2t1DqaLhtFj3Iv3s/QYSGHOpuX+P2xo2R4wKuD KtnWELSRbU1LXAP4uaFsa3b1U0JrPNXu4CSUuQbwMW4zuHSEyymFU+AkuGH7qWyIMgdsAL2G VDAYBu3DLw2DJ1/hEfCFaIRnNnhYCiMvZmbc2vH4c2Yzehmvb+GicvGVyFeyrgNcTSWeSZwP kc+j0W9rGtWwQCtcr4j4XmBEwDeDSZq8prO7tW35tb24rsvrazO1bfSt8hr/UCDCMRLA17ks PipOQzI70rO9sJwmxzORzymZqChda6x5fo0CNvQ7LO4I15Jpchw52nu1ggnfohi5EINRZPCf KwOnMAapCM4QuymKC4hXR3ER0vAlGMFNyO/G12ENzME3+WIE/n7twfdrC3TCKmiENvxVXI+Y F9/pP6/385JFOMNafHWuQGoNvo+L8S0/BeFnR/wHblh31gplbmRzdHJlYW0KZW5kb2JqCjMy IDAgb2JqCjQ2MzIKZW5kb2JqCjMzIDAgb2JqCjw8L1Byb2R1Y2VyKEFteXVuaSBQREYgQ29u dmVydGVyIHZlcnNpb24gNC4wLjEuMjsgbW9kaWZpZWQgdXNpbmcgaVRleHQgMi4xLjcgYnkg MVQzWFQpL01vZERhdGUoRDoyMDE2MDgxMjE2MDAwMFopPj4KZW5kb2JqCnhyZWYKMCAzNAow MDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMDAwMTUgMDAwMDAgbiAKMDAwMDAwMDA2MCAwMDAw MCBuIAowMDAwMDAwMTI5IDAwMDAwIG4gCjAwMDAwMTE1NDQgMDAwMDAgbiAKMDAwMDAwMDQ0 MSAwMDAwMCBuIAowMDAwMDA4MzM4IDAwMDAwIG4gCjAwMDAwMDEzMjIgMDAwMDAgbiAKMDAw MDAxMTExMyAwMDAwMCBuIAowMDAwMDExMjYyIDAwMDAwIG4gCjAwMDAwMDExODEgMDAwMDAg biAKMDAwMDAxMTQwNiAwMDAwMCBuIAowMDAwMDEyMzM5IDAwMDAwIG4gCjAwMDAwMTI3NDIg MDAwMDAgbiAKMDAwMDAzMDY1NCAwMDAwMCBuIAowMDAwMDMxMDY2IDAwMDAwIG4gCjAwMDAw NTM3NjAgMDAwMDAgbiAKMDAwMDA1NDIzMCAwMDAwMCBuIAowMDAwMDg4MTA5IDAwMDAwIG4g CjAwMDAwODgzMjQgMDAwMDAgbiAKMDAwMDAxMTgwNyAwMDAwMCBuIAowMDAwMDEzMjYyIDAw MDAwIG4gCjAwMDAwMTM1MjQgMDAwMDAgbiAKMDAwMDAzMDYzMiAwMDAwMCBuIAowMDAwMDMx NTkxIDAwMDAwIG4gCjAwMDAwMzE4NjEgMDAwMDAgbiAKMDAwMDA1MzczOCAwMDAwMCBuIAow MDAwMDU0ODIzIDAwMDAwIG4gCjAwMDAwNTUwODcgMDAwMDAgbiAKMDAwMDA4ODA4NyAwMDAw MCBuIAowMDAwMDg4NjQ1IDAwMDAwIG4gCjAwMDAwODg4OTkgMDAwMDAgbiAKMDAwMDA5MjA2 OCAwMDAwMCBuIAowMDAwMDkyMDg5IDAwMDAwIG4gCnRyYWlsZXIKPDwvUm9vdCAxIDAgUi9J RCBbPDdlYjJkN2EzZTlhYzk0YWU3M2ZlMTZkZDAzNTY5YjE5PjxhZDgxMWVkYTE5YTUzNGQx NmQ0MjY3ZDZiMTZjMmVjYT5dL0luZm8gMzMgMCBSL1NpemUgMzQ+PgpzdGFydHhyZWYKOTIy MjEKJSVFT0YK --B_3553850343_1373758491-- From nobody Fri Aug 12 10:05:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5252A12D7D9 for ; Fri, 12 Aug 2016 10:05:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2p0lxLGdvp0b for ; Fri, 12 Aug 2016 10:05:34 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51D1212D7F6 for ; Fri, 12 Aug 2016 10:05:34 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7CH5cUI009622 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 12 Aug 2016 10:05:38 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471021538; bh=G4vhYcJFgDD5UviE6f84if4SEYYWMRNl5GGKGq8rPiA=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=SmkemLO7SJDBUahzTb8hPqftFTdz8+AW4wg0yKshSj6yZpy974JKJvUV7INR20Fzb Hx9/U0jS2cI/2b/WhrjgAWGAV4tJ/ILWL/IpygSGRqQIm4decb24j/TCwN48GCZRGf JCVQyMZyyCX5ruYrVzDF3lJ/nxDJ36yTmeF+D2cw= To: Richard Shockey , IETF STIR Mail List References: <361C443C-5591-43A4-82D7-DFD99DA1BC2E@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 12 Aug 2016 10:05:03 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <361C443C-5591-43A4-82D7-DFD99DA1BC2E@shockey.us> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] In case you didnt get the memo X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Aug 2016 17:05:35 -0000 > Public Session: Friday, August 19, 2016, beginning promptly at 10:00am EST > and concluding at approximately 10:30am EST. A 30-minute public session? So the goal is just to say hello to everyone? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 12 16:26:02 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56C7D12D877 for ; Fri, 12 Aug 2016 16:26:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SJevMykkoLNt for ; Fri, 12 Aug 2016 16:25:59 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 403C412D85C for ; Fri, 12 Aug 2016 16:25:59 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7CNQ3GQ026954 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 12 Aug 2016 16:26:03 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471044363; bh=goQQMH4n4OH1ryc4odre0dS44z0Q8QWB7exru38gGIY=; h=From:Subject:References:To:Reply-To:Date:In-Reply-To:From; b=FDT9PzlDRxlfPqMgIBrAlQi0AjlySXoOv6B0IEnWnhZy1bgWv04pZuy6N4FyjpNpo sF7nBBRMbT2sq6NAFl6JdsCbCbVjkhklTGhKFQVD4I3agX58WRIBGAhhVpGpRZnC7f sHnw0c/7BlEJQ0ttCfVcBiw/T89ylra4RH6dRlTA= From: Dave Crocker References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> Organization: Brandenburg InternetWorking To: "stir@ietf.org" Message-ID: Date: Fri, 12 Aug 2016 16:25:27 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Aug 2016 23:26:00 -0000 Greetings, I've done self-initiated reviews on the three documents that were put into the STIR Working Group Last Call: * Secure Telephone Identity Credentials: Certificates draft-ietf-stir-certificates-07.txt "The use of certificates in establishing authority over telephone numbers" * Persona Assertion Token draft-ietf-stir-passport-05 "A token format for verifying with non-repudiation the sender of and authorization" * Authenticated Identity Management in the Session Initiation Protocol (SIP) draft-ietf-stir-rfc4474bis-10.txt "A mechanism for securely identifying originators of SIP requests" This note is a summary of the core comments and conclusions in those reviews, with some further thoughts. The summary of all that follows is quite simple: These documents are in need of extensive additional work and after that is done, they still will not specify a coherent capability. The worked need to turn this into a coherent capability is substantial and possibly risky. My specific reviews are: Review of: draft-ietf-stir-passport-05 https://mailarchive.ietf.org/arch/msg/stir/vypQUp6ILfCitdB2PEWo_2bZmZw Review of: draft-ietf-stir-rfc4474bis-10 https://mailarchive.ietf.org/arch/msg/stir/N334mEfCpWowtSnXNrx2ElPGr84 Review: draft-ietf-stir-certificates-07 https://mailarchive.ietf.org/arch/msg/stir/VkB0HMs5JrHRLcOrDmMukdIzD3A Separately, I posted a comment about the choice of JWT/JSON: https://mailarchive.ietf.org/arch/msg/stir/8S0DnRRY6rb368Rt-k4zqQkbd90 Since I'm not a phone guy, I should preface with some information about my background that is relevant to the following comments, beyond noting that I have done technical work for quite a few decades and that I have extensive and varied IETF experience: I've built and run a couple of national email services. I'm a Senior Technical Advisor to M3AAWG , which is an Internet anti-abuse trade association. I'm also a co-author of the current specification for DKIM, which provides an authenticated identifier for email. Further I participate in a number ad hoc industry consortia that develop anti-abuse-related enhancements that are based on the use of DKIM and SPF. I participated in the the STIR effort as it was chartered. None of this guarantees that anything that follows is correct, but it should provide some context for my views about efforts to design technical services used to mitigate abuse... Telephone spam is a serious, urgent, global problem, and has been for some years. Efforts to mitigate it would be greatly aided by reliable, accurate caller-id authentication, similar to the benefits that already accrue for email anti-abuse efforts based on authentication. The primary benefit will be to allow development of accurate reputation information for the caller-id, because then there is assurance that it has only been used by an authorized actor. In general, this promotes identification of calls from good actors, rather than directly serving to identify bad actors -- absent additional mechanisms, such as ones ensuring a semantic of exclusivity, with a guarantee that /all/ calls using the caller-id will be validated.(cf, DMARC) However given some essential operational differences between telephony and email, this assurance is probably more easily made for telephony than it is for email. Discussions to pursue a standardized telephony authentication mechanism began approximately 5 years ago. The IETF's STIR working group began 3 years ago. The technical aspects of global telephony probably preclude ever achieving a solution that will cover all phone service, everywhere. The mix of telephone administrations is challenging, but the considerable mix of telephony technologies is the major impediment: differences in their underlying semantics and limitations to their extensibility make a comprehensive, hybrid solution highly problematic, if not impossible. The STIR working group nonetheless originally pursued a set of hybrid solutions, only more recently gravitating toward a narrower effort, targeting a SIP-only initial capability for authenticated calls. Telephony is increasingly using SIP and there already is a significant global infrastructure using it. In technical terms, SIP is more amenable to this kind of authentication enhancement, than are the legacy technologies, especially given that its use of header-fields for parameters and meta-data is almost identical to that of email, even to the point of having a "From" header field. The nature of the basic tasks for this type of authentication service include: * Deciding where to get the caller-id from. The legitimate technical challenges here are that the SIP phone world has several forms of caller-id strings and several places they can occur. So defining a deterministic algorithm is not necessarily straightforward. However resolving the details in obtaining and processing the variations in caller-id appears to primarily be a matter of defining a precise and reliable algorithm. The specifications have text that I believe is intended to provide this detail, but I was unable to converge on an understanding of what the deterministic behavior and results would be. It appears to talk about possibilities, rather than provide a clear, reasonable and deterministic algorithm. * Deciding on the authentication algorithms and data packaging -- data to hash, hashing algorithm, crypto algorithm, where to to put the result, etc. This is quite a bit of detail and needs to be done correctly, but rarely involves creativity or any interesting debates. However, here too the specification seems to provide for alternatives rather than a single, simple, clear, interoperable solution, absent additional, unstated private agreements. * Deciding how the public key is to be associated with the relevant 'identity' and deciding how it will be found and validated. That is, a key query service. In most crypto services, this involves a 'certificate' with an authority hierarchy. For common certs, these involve an independent public key cert infrastructure (PKI). For DANE, the hierarchy matches the domain name hierarchy for the name having the key, which is stored in the DNS. For DKIM, the key is self-certified: this key also is stored with the name and can (presumably) only be put there by the domain owner. Use of the 'common' PKI service is widely viewed as highly problematic, particularly in terms of making serious reliance on proper authentication, for more than mitigating man-in-the-middle attacks. DKIM has extensive deployment and operational experience, however its authority hierarchy only aligns nicely with domain names. The DANE model does not have significant deployment penetration or operational experience. Also as with DKIM, it's authority alignment is with domain names, not telephone number administration. OAuth is a recent capability that might provide a reasonable cert model that can be applied here, but I don't know enough yet to be sure. Caller-ids based on classic telephone numbers, however, are problematic. Especially due to number portability, the authority hierarchy for numbers does not align at all well with the string of numbers. In effect, any next number in a sequence can be administered by a different entity. Worse, a prior attempt at an inter-organization query service based on telephone number (ENUM) was not successful. In other words, the requirement to have an inter-organization query and validation capability for keys associated with caller-ids should be viewed as both difficult and discouraging, essentially at the level of a open research task: We have no global experience with a successful version of a comparable inter-provider service, or at least not at the necessary scale. But we do have examples of failure... In any event nothing in the current specification specifies how to find and validate the associated key. All that is supplied is very general commentary. And this fact is worth repeating: The trio of documents do not attempt to specify the highest-risk component to the authentication service: a complete and interoperable key query mechanism. Based on the discussions on the working group mailing list and from various private discussions, it appears that folk think that what remains to be done are mere details, or policies, rather than development of core technologies or mechanisms, and that these will be settled elsewhere (ATIS-SIP Forum, or the like). But the work remaining includes basic functional capabilities, not mere administrative or operational (policy) details. Perhaps these will indeed get resolved in those later discussions, but it will require quite a bit of additional effort and time. I suspect it will require far more effort than is currently appreciated. My sense is that the folk intending to pursue use of this work have an underlying expectation that there will be a set of bilateral and/or multilateral provider-based agreements that determine the remaining details, rather than there being an integrated public service. This has been, after all, common in the telephone industry. However it is at odds with the IETF's approach to the definition of open, interoperable services that work at scale. Further, the IETF's publishing the current specifications will mean that the IETF is blessing a set of documents that do not offer a coherent, usable technical capability. I believe that is somewhere between unusual and unprecedented. The proffered drafts do not include any coherent description of the integrated service that is being specified. Simple architectural charts that show the components and how they are functionally connected, with descriptions of their roles and interactions, go quite a long way towards developing a shared, community understanding of what is being done. An essential example here is to delineate relevant administrative trust boundaries. Note that even very recent discussions on the list demonstrate a basic lack of this shared understanding, such as where validation will be done and what will be done with the result. And this example has profound import to the service model, since validation at end-user devices requires a key query service that will operate over the open Internet, whereas validation only amongst 'authorized' providers won't. Some individuals seem to have a clear model for this. However the group does not. The design has chosen use of a JSON/JWT for a "Passport" abstraction of a common "token" collecting together identity, key and other 'claims' information. In terms of computer science design, it looks reasonable; it is modular, based on some standardized technologies, and appears to be extensible. And my original reaction to it was that while it was not necessary to the immediate task, it might have some long-term appeal. However the more I have slogged through the specifications and tried to discuss issues with individuals, it has become clear to me that it is adding quite a bit of complexity to the reading and probably to the software, for literally /no/ immediate benefit. In fact, it is not merely additional overhead: my sense is that it has made it more difficult to find various errors in the detail of the specifications. There is no JSON already in the SIP environment that is being signed; the extensibility is easily obtained more directly; and the aggregate specifications are significantly more difficult to comprehend. The certificate draft is not a specification. It is a discussion, often about basic concepts or about a hypothetical future. Hence, the highest-risk component to the proposed capability remains entirely unspecified. For all three documents, the writing often is bloated and opaque and error-prone, where the reader apparently is expected to have quite a bit of very detailed background that is not stated in the documents. One of the drafts had not even been processed through a spelling corrector, although this was a Las Call Verion. Also, non-trivial algorithms are written as complex prose rather than simple algorithms. I suspect these have errors but can't be sure. It often was not clear to me what was meant -- or it was clear that the text had not specified what it claimed to specify. The specifications are also often incomplete, with respect to the scope of the document. That is, they simply don't cover what they say they will (and which they need to cover.) The documents purport to provide modularity, but contain enough cross-references, cross-discussion and bi-directional dependencies to defeat this. All of the above suggests a working group that did not seek to specify a complete capability, did not diligently participate in the specification and review of these documents, and does not have a precise and workable shared understanding of what the target service will be nor how that service will be achieved. The difference between being able to validate at the callee's independent SIP implementation, versus requiring validation to be done by a service provider, is merely one of many examples of these problems with the working group effort.. I should also make at least a quick comment about the process problems that have been so clearly demonstrated on the list during my review effort: In roughly 30 years of participating in the IETF and doing reviews of working group documents, I have never before seen an almost complete lack of public engagement in dealing with a review. Disagreement is common. Silence is not. The authors have refused to engage in substantive, public discussion about these reviews, promising instead to make back-room decisions as they see fit. The rest of the working group has so far been almost completely silent on the substance of the reviews. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 13 00:40:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9141212D093 for ; Sat, 13 Aug 2016 00:40:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gZ4crFMluoOV for ; Sat, 13 Aug 2016 00:40:33 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8CB512D096 for ; Sat, 13 Aug 2016 00:40:32 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u7D7Y0FI004228; Sat, 13 Aug 2016 03:40:29 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=RxiRVXQTKKHWjl0hLSf9eHHN5HyMmD399GecrEHCSNQ=; b=feroMyyYe+bFnkcM5lpm94S/7pLV7Y26pa0U5jdNg1O8qloCgpXHJnzsFLiMK8li2LQb Q9lvvfD8YYdOe/puBs7cYjf8pEjOJWqfQ0LHAc1nqM33CKCOWOWun96JkcHWd6JX41lp VsNtzJ2fBdR5YbO/XDnOdAJGIyfe8tfnuGVuUkDuSBjLPRWHDgYHfIok046zHGvqKXrj +2/pcbShHYj0O94Zpc4m2jUkjPNzLZOsAiDqPp+IbSj8urokVOD0SqG3ap7oCj0eQCv9 SdJXMYiHmIXWccwF2QH3/5gN+azcMsHv7lIYA51a/gN0AjdDWR8ggQIGqPygFDJWxhZZ Cw== Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24qm989c42-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Sat, 13 Aug 2016 03:40:28 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Sat, 13 Aug 2016 03:40:25 -0400 From: "Peterson, Jon" To: "stir@ietf.org" , "dcrocker@bbiw.net" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBGVbYA Date: Sat, 13 Aug 2016 07:40:24 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.59] Content-Type: multipart/mixed; boundary="_002_D3D412101A72E4jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-13_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608130090 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Aug 2016 07:40:39 -0000 --_002_D3D412101A72E4jonpetersonneustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-ID: <30C9781F75A4B741B157FA765F1DE741@neustar.biz> Content-Transfer-Encoding: quoted-printable I finally had a chance to go through these comments, and I did want to provide a few responses on Dave's review of rfc4474bis here. >Taken on its own and also when taken with its companion documents, the >specifications are confusing and incomplete. It is quite far from being >ready for publication. Having looked through Dave's specific concerns, I don't think he makes his case for this criticism. >Terminology is used inconsistently. It often is introduced with no >background or citation. Many uses of 'header' are probably supposed to >be 'header field'. My sense is that quite a bit of terminology is used >equally loosely. I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field value," no denying that. If people think this is a big deal, I will fix it. But the suggestion that because this is true, terminology is loosely used to a point where it would hamper implementation, that I think his comments don't really substantiate. >There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit >together. In fact is appears that the document itself gets confused on >this matter. I'm not sure what an "integrative architectural description" would entail, but there are a number of sections that provide overviews of operations and related examples of how the architectural piece come together. I don't think anything in the review comments genuinely substantiates that the document itself is confused about its own architecture. >Algorithms are all offered only as prose and often in a form mitigating >comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what I >can tell, the algorithms often are incomplete, but serious analysis is >difficult. Algorithms are offered in steps with normative language, if that's what you mean by "prose form". RFCs are typically composed of prose. The review does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF. >The documents appear to rely on a reader's having quite a bit of prior >knowledge and are certainly not usable by an implementer who is not >already deeply embedded in the community that produced these >specifications. My impression is that being embedded won't suffice >either, both from my assessment of the documents' deficiencies and given >back-channel comments I have heard about the expectation of the work to >be done after these specifications are published. We do expect basic SIP literacy, and a willingness to follow references and read external specifications and sections that are cited. Readers that are unwilling to do this will probably find a lot of things confusing in there. >Overall, the writing impedes comprehension and the document needs a very >diligent pass by a technical editor. I suspect this will uncover quite >a number of semantic deficiencies in the text. You did catch some good typos, and I caught a few more following your notes through the text. I'm not sure that yielded the semantic difficulties you speculate about here though. >There is a possible tendency to support more alternative behavior than >appropriate. Successful interoperability usually benefits from fewer >choices, not more. Common, mandatory canonicalization is an example. Common, mandatory canonicalization of telephone numbers is unfortunately only slightly more reliable than common, mandatory normalization of internationalized domain names. At least it's just numbers. The algorithm we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap. >Credentials: the specification neither defines nor references a standard >for the specification of credentials, here. That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve. This is a showstopper, in terms of >specification completeness for the service. Well, it does reference a standard for the specification of credentials: stir-certs. I agree it would be a showstopper if we didn't have the stir-certs work. >How is the recipient to know what credential 'standard' is used? How >does this ensure interoperability between two participants who have not >interacted before? There is in practice only one at the moment. I'm content to worry about interop problems when we have another one. >At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and >elsewhere. By way of example, there are few if any cross-organization >key management services on the Internet that demonstrate the utility >needed here. I am pretty sure that Web certs don't qualify. We know >that DKIM's operation does, of course. However DKIM strictly uses >domain names as identifiers and they conveniently align with their >administrative authorities, whereas telephone numbers do not... I'd say that, by design, rfc4474bis is pretty tightly confined to specifying the SIP over-the-wire protocol behavior. It takes a lot of spec just to do that.=20 And your praise of DKIM as a model is once again noted. I would respond again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in our path. > [[[ The mailing list just had an extensive regurgitation of >critical commentary about ENUM. What appears to be getting missed is >that whatever mechanism is going to be used for finding and validating >keys is going to have no operational history of reliability, safety or >efficacy. ]]] HTTP has none of those qualities, apparently. >There is remarkably little of the original RFC 4474 substance still in >this document. Calling it a bis is a bit like tearing all of a building >except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it. It will allow some of the text >to be notably simpler and clearer. I think enough of the concepts and protocol mechanisms of the original are retained to warrant keeping this as a bis. >The document is heavy with forward references. These force the reader >to stop what they are in the middle of, try to hold that place, and look >forward to understand what they've just been interrupted from reading. >As a literary style, forward references create useful tension. In >specifications they just interrupt the flow. The document should be >reorganization so that integrative text comes /after/ the text >describing the pieces being integrated. And opening overview, design >summary, or the like can give a non-normative description of the >architecture and the service, so the reader has a basic sense of the big >picture, before diving into the detail of those to-be-integrated pieces. Dave does make a number of organizational suggestions about the spec. The spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is however unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions that seemed to me like a substantial improvement. Overall, there are a handful of changes (beyond the typos, which again are appreciated) I'd make based on the substance of Dave's review. Some of the suggestions to rename sections seem harmless to me. Like some other people who come to mind, he would like to see some more precise specification and examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity headers in there, and we probably do need an indication of what future work might use that feature. In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the signature is correct, and that we have enough confidence that intermediaries won't break it, and that when it is broken, the verifier behavior makes sense. I think we've focused a lot of attention on those questions, but I'm happy to talk more about that if people think there's room for improvement. Also, he suggests that we might need a better pointer than RFC3986 Section 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead. Otherwise, I think we've got this covered. Anyone who's interested in further details can see the attached. Jon Peterson Neustar, Inc. --_002_D3D412101A72E4jonpetersonneustarbiz_ Content-Type: text/plain; name="crocker-review-notes.txt" Content-Description: crocker-review-notes.txt Content-Disposition: attachment; filename="crocker-review-notes.txt"; size=97624; creation-date="Sat, 13 Aug 2016 07:40:24 GMT"; modification-date="Sat, 13 Aug 2016 07:40:24 GMT" Content-ID: Content-Transfer-Encoding: base64 DQoNClRoZSBjb21tZW50cyBjb25zaXN0IG9mIG92ZXIgMTYwIGlubGluZSBlZGl0cyBpbnNlcnRl ZCBpbnRvIHRoZSByZmM0NDc0YmlzLTEwIHRleHQuIFJlc3BvbnNlcyB0byB0aGVzZSBjb21tZW50 cyBoYXZlIGhlcmUgYmVlbiBicm9rZW4gZG93biBpbnRvIGZvdXIgY2F0ZWdvcmllcy4gRWFjaCBp bmRpdmlkdWFsIGVkaXQgbWFrZXMgb25lIG9yIG1vcmUgcG9pbnRzLCBhbmQgaW4gc29tZSBjYXNl cywgdGhlIGNvbnRlbnRzIG9mIGEgc2luZ2xlIGVkaXQgaGF2ZSBiZWVuIHNwbGl0IGludG8gbXVs dGlwbGUgY2F0ZWdvcmllcyBoZXJlLiBSZXNwb25zZXMgdXN1YWxseSBkZWFsIHdpdGggb25seSBv bmUgZWRpdCwgYnV0IHNvbWV0aW1lcyBlZGl0cyBpbiBzdWNjZXNzaW9uIGFyZSByZWxhdGVkIGFu ZCBhZGRyZXNzaW5nIHRoZW0gaW4gb25lIHJlc3BvbnNlIG1ha2VzIHNlbnNlIGZvciByZWFkYWJp bGl0eS4gQWxzbywgaW4gc29tZSBjYXNlcyBhIGNvbW1lbnQgb24gdGhlIHNhbWUgc3ViamVjdCBp cyBtYWRlIGluIG11bHRpcGxlIHBsYWNlcyBpbiB0aGUgZG9jdW1lbnQsIGFuZCBpdCBtYWtlcyBz ZW5zZSB0byBjb25zb2xpZGF0ZSB0aGVtIGFsbCBpbiBvbmUgcmVzcG9uc2UuIFNvIHRoZSBudW1i ZXIgb2YgcmVzcG9uc2VzIHdvbid0IGV4YWN0bHkgYWRkIHVwIHRvIHRoZSBudW1iZXIgb2YgaW50 ZXJqZWN0aW9uIGVkaXRzLg0KDQpBKSBXb3JkIGNob2ljZSwgRGVmaW5pdGlvbnMgYW5kIFNwZWNt YW5zaGlwIChhYm91dCA1MiByZXNwb25zZXMpLCByb3VnaGx5IDEwIG9mIHdoaWNoIGNvbnRhaW4g dHlwb3MuIFRob3NlIHR5cG8gZWRpdHMgYXJlIGFwcHJlY2lhdGVkLCBhbmQgd2lsbCBiZSBmaXhl ZC4gVGhlcmUgaXMgYWxzbyBhIGJyb2FkIHNldCBvZiBjb21tZW50cyBhYm91dCB0aGUgdXNlIG9m IGhlYWRlciB2cy4gaGVhZGVyIGZpZWxkIChhbmQgd2UgbWlnaHQgYWRkLCB2cy4gaGVhZGVyIGZp ZWxkIHZhbHVlKSB0aGF0IGFyZSBjb25zaWRlcmVkIGJlbG93IGFzIG9uZSByZXNwb25zZS4gQXNp ZGUgZnJvbSB0aGVzZSwgdGhlcmUgYXJlIGZvdXIgY29tbWVudHMgaW4gdGhpcyBjYXRlZ29yeSB3 aGVyZSBJIGp1ZGdlIGEgY2hhbmdlIG1pZ2h0IGJlIGhlbHBmdWwuIFRoZXJlIGFyZSBhIGNvdXBs ZSBvdGhlciBwbGFjZXMgd2hlcmUgSSB3b3VsZG4ndCBzdHJlbnVvdXNseSBvYmplY3QgdG8gYSBj aGFuZ2UsIGJ1dCBJIGRvbid0IHNlZSBhbnkgcmVhbCB2YWx1ZSBpbiBvbmUgZWl0aGVyLg0KDQpC KSBEb2N1bWVudCBvcmdhbml6YXRpb24sIHdoaWNoIGluY2x1ZGVzIHF1ZXN0aW9ucyBhYm91dCB3 aGF0IGJlbG9uZ3Mgd2hlcmUgaW4gcmZjNDQ3NGJpcywgd2hhdCBzaG91bGQgb3Igc2hvdWxkIG5v dCBiZSBkZWZlcnJlZCB0byBhbiBleHRlcm5hbCBzcGVjaWZpY2F0aW9uLCBzZWN0aW9uIHRpdGxl cyBhbmQgdGhlaXIgcmVsYXRpb25zaGlwIHRvIHRoZSBjb250ZW50cywgYW5kIGNvbXBsYWludHMg YWJvdXQgcmVkdW5kYW5jeSAoYWJvdXQgMzggcmVzcG9uc2VzKS4gVGhlcmUgYXJlIHR3byBjYXNl cyBoZXJlIHdoZXJlIEkgZG9uJ3QgbWluZCBtYWtpbmcgYSByZWNvbW1lbmRlZCBjaGFuZ2UsIHRo b3VnaCBJJ20ga2luZCBvZiBsdWtld2FybSBvbiB0aGVtLiBNYXliZSBhIGNvdXBsZSBvdGhlcnMg d2hlcmUgSSdtIHNsaWdodGx5IGNvb2xlciB0aGFuIGx1a2V3YXJtIGFuZCB3aXRoIHNvbWUgYXJt LXR3aXN0aW5nIGZyb20gc29tZW9uZSBlbHNlIHdobyBjYXJlcyBJIGNvdWxkIGJlIHByZXZhaWxl ZCB1cG9uIHRvIG1ha2UgZnVydGhlciBjaGFuZ2VzLg0KDQpDKSBUaGluZ3MgdGhhdCBkbyBvciBk b24ndCBiZWxvbmcgaW4gc3BlY2lmaWNhdGlvbnMgKGFib3V0IDE0IG9mIHRoZXNlKS4gVGhlc2Ug Y29tbWVudHMgY29udGFpbiB2ZXJ5IGJyb2FkIHN0YXRlbWVudHMgYWJvdXQgdGVjaG5pY2FsIHNw ZWNpZmljYXRpb25zIGFuZCB0aGUgcHJvcGVyIG1hdGVyaWFsIHRvIGluY2x1ZGUgaW4gdGhlbS4g VGhpcyBiZWdhbiBhcyBqdXN0IGEgcGFydCBvZiBCLCBidXQgSSd2ZSBzcGxpdCBpdCBvdXQgaW50 byBpdHMgb3duIGNhdGVnb3J5LCBhcyBpdCBtYWtlcyBmb3Iga2luZCBvZiBpbnRlcmVzdGluZyBy ZWFkaW5nIG9uIGl0cyBvd24uIEknbSBub3QgcGxhbm5pbmcgb24gbWFraW5nIGFueSBlZGl0cyBi YXNlZCBvbiB0aGVzZSBjb21tZW50cy4NCg0KRCkgUGhpbG9zb3BoaWNhbCBvciB0ZWNobmljYWwg Y29tbWVudHMsIChhYm91dCA0OSBjb21tZW50cykuIEkgaGVzaXRhdGVkIHRvIHRyeSB0byB0ZWFz ZSBhcGFydCB0aGUgdGVjaG5pY2FsIGFuZCBwaGlsb3NvcGhpY2FsIGhlcmUsIHRob3VnaCB0aGlz IGNhdGVnb3J5IGlzIGEgYml0IG9mIGEgY2F0Y2gtYWxsIGZvciBldmVyeXRoaW5nIGZyb20gIndo eSBpcyB0aGlzIGEgU0hPVUxEIGFuZCBub3QgYSBNVVNUPyIgc29ydCBvZiBxdWVzdGlvbnMgdG8g dmFyaW91cyBtb3RpdmF0aW9uYWwgb3Igb3Blbi1lbmRlZCAid2h5PyIgcXVlc3Rpb25zIHRvIG1v cmUgY29tcGxleCB0ZWNobmljYWwgb2JqZWN0aW9ucyBvciBjYXV0aW9ucy4gTWFueSBvZiB0aGVz ZSB0b3VjaCBvbiBpc3N1ZXMgdGhhdCB0aGUgd29ya2luZyBncm91cCBoYXMgc3BlbnQgc29tZSB0 aW1lIGNvbnNpZGVyaW5nLiBPZiB0aGVzZSwgdGhlcmUgdGhyZWUgcGxhY2VzIHdoZXJlIEkgdGhp bmsgYSBjaGFuZ2UgaXMgaW4gb3JkZXIsIHR3byBvZiB3aGljaCB3ZXJlIHRoaW5ncyB3ZSBhbHJl YWR5IHdlcmUgcGxhbm5pbmcgdG8gZml4Lg0KDQpJIGRvbid0IHRoaW5rIGFueSBvZiB0aGVzZSBj aGFuZ2VzIHdvdWxkIGltcGFjdCBpbXBsZW1lbnRhdGlvbiBpbiBhbnkgd2F5LCBhbmQgb25seSBh IHZlcnkgc21hbGwgbnVtYmVyIG9mIHRoZSBjb21tZW50cyBpbiBjYXRlZ29yeSBEIGV2ZW4gc3Vn Z2VzdCB0aGluZ3MgdGhhdCBtaWdodC4gRm9yIHRoZSBtb3N0IHBhcnQsIHRoZXNlIGNvbW1lbnRz IGNvbmNlcm4gdGhlIGNvbXByZWhlbnNpYmlsaXR5IG9mIHRoZSBzcGVjaWZpY2F0aW9uIGFuZCB0 aGUgZGl2aXNpb24gb2YgbGFib3IgYmV0d2VlbiByZmM0NDc0YmlzIGFuZCBpdHMgcmVsYXRlZCBz cGVjcyAoYW5kIHRvIGh5cG90aGV0aWNhbCBvdGhlciBzcGVjcyB0aGF0IHRoZSByZXZpZXcgcHJv cG9zZXMgdG8gc3BsaXQgb3V0IGZyb20gaXQpLiBBcm91bmQgdGVuIHBlcmNlbnQgb2YgdGhlc2Ug Y29tbWVudHMgYXJlIGFsc28sIHdlbGwsIGNvbW1lbnRzIHRoYXQgYXJlIHByZXR0eSBvYnZpb3Vz bHkgYW5zd2VyZWQgYnkgdGhlIHBhcnQgb2YgdGhlIHRleHQgdGhhdCBpcyBiZWluZyBjb21tZW50 ZWQgdXBvbi4gT24gdGhlIHdob2xlLCBpdCdzIGEgbG90IG9mIHdvcmsgdG8gc2lmdCB0aHJvdWdo IGNvbW1lbnRzIGRvbmUgaW4gdGhpcyBsaW5lLWJ5LWxpbmUgZmFzaGlvbiwgZm9yIGNvbXBhcmF0 aXZlbHkgbGl0dGxlIHJld2FyZC4NCg0KLS0gQSkgV29yZCBDaG9pY2UvU3BlY21hbnNoaXANCg0K VGhlIHZlcnkgZmlyc3QgaW50ZXJqZWN0aW9uIGluIHRoZSBsaW5lLWJ5LWxpbmUgcmV2aWV3IHJl amVjdHMgdGhlIGFzc2VydGlvbiBpbiB0aGUgQWJzdHJhY3QgdGhhdCB0aGUgc2VjdXJpdHkgbWVj aGFuaXNtcyBvZiBTSVAgYXJlICJpbmFkZXF1YXRlIGZvciBjcnlwdG9ncmFwaGljYWxseSBhc3N1 cmluZyB0aGUgaWRlbnRpdHkgb2YgZW5kIHVzZXJzLCIgaW5zdGVhZCBhcmd1aW5nIHRoYXQgd2Ug c2hvdWxkIHN1YnN0aXR1dGUgImFkZXF1YXRlbHkiIGZvciAiY3J5b3RvZ3JhcGhpY2FsbHkiLiBU aGlzIHdvdWxkIGhvd2V2ZXIgcmVzdWx0IGluIHRleHQgdGhhdCByZWFkcyAiaW5hZGVxdWF0ZSBm b3IgYWRlcXVhdGVseSBhc3N1cmluZyB0aGUgaWRlbnRpdHkgb2YgZW5kIHVzZXJzLiIgSSB0aGlu ayAiaW5hZGVxdWF0ZSBmb3IgYWRlcXVhdGVseSIgaXMgYSBwb29yIGNoYW5nZS4gVGhpcyBpcyBh IHByZXR0eSBnb29kIGluZGljYXRpb24gb2YgdGhlIG1ham9yIGxpbWl0YXRpb24gb2YgdGhlIHJl dmlldyBvdmVyYWxsIC0gdGhlc2UgbGluZS1ieS1saW5lIGNvbW1lbnRzIG9mdGVuIGNvbnNpZGVy IG9ubHkgb25lIGF0b20gb2YgdGhlIHNwZWMgaW4gaXNvbGF0aW9uIGZyb20gaXRzIHN1cnJvdW5k aW5nIGNvbnRleHQsIGFuZCB0aHVzIHBvc2UgZGlmZmljdWx0aWVzIHRoYXQgZG9uJ3QgYWN0dWFs bHkgZXhpc3QgYW5kIHByb3Bvc2UgcmVtZWRpZXMgdGhhdCBkbyBub3QgZml0IHZlcnkgd2VsbCBp bnRvIGxvY2FsIHN1cnJvdW5kaW5ncyBvciBvdmVyYWxsIHBsYW4uIFskXQ0KDQoxICJJIHN1c3Bl Y3QgaXQgZG9lcyBub3QgJ2VuaGFuY2UnIGV4aXN0aW5nIG1lY2hhbmlzbXMgYXMgbXVjaCBhcyBh ZGQgYSBuZXcgb25lLiIgQmFjayBpbiB0aGUgZGF5cyBvZiBSRkM0NDc0LCB3ZSBjYWxsZWQgdGhp cyBhbiAiZW5oYW5jZW1lbnQsIiBpbiBmYWN0IHRoYXQgaXMgYnVpbHQgaW50byB0aGUgdmVyeSB0 aXRsZSBvZiBSRkM0NDc0LiBVbHRpbWF0ZWx5LCBieSBzYXlpbmcgaXQgZW5oYW5jZXMgZXhpc3Rp bmcgIm1lY2hhbmlzbXMiIHBsdXJhbCwgaXQgaXMgcHJldHR5IGNsZWFyIHRoYXQgdGhpcyBvZmZl cnMgYSBjYXBhYmlsaXR5IHRoYXQgdHJhbnNjZW5kcyBhIG1lcmUgaW1wcm92ZW1lbnQgdG8gYW55 IGluZGl2aWR1YWwgZXhpc3RpbmcgbWVjaGFuaXNtLCBidXQgaXMgaW5zdGVhZCBhIHByb3RvY2wg ZW5oYW5jZW1lbnQuDQoNCjIgVGhlIHJldmlldyBwcm9wb3NlcyBjaGFuZ2luZyAicHJvdmlkZXMg YSBzdHJvbmcgaWRlbnRpdHkgc3lzdGVtIGZvciBkZXRlY3RpbmciIHRvICJlbmFibGVzIGFuIGF1 dGhlbnRpY2F0aW9uIGNhcGFiaWxpdHkgZm9yIHByb3RlY3RpbmcgYWdhaW5zdCIuIEJ1dCBkZXRl Y3RpbmcgaXMgYWxsIHlvdSBnZXQsIHlvdSBjYW4ndCAicHJvdGVjdCBhZ2FpbnN0IiBpbXBlcnNv bmF0aW9uOiBhIHNpZ25hdHVyZSBvbmx5IHNob3dzIHdoZW4gaXQgaGFzIGJlZW4gdmlvbGF0ZWQu DQoNCjIgIndvcnRoIGJyZWFraW5nIHRoaXMgc2VudGVuY2UgaW50byB0d28sIGZvciBiZXR0ZXIg Y2xhcml0eS4iIEkgdGhpbmsgaXQgcmVhZHMgZmluZS4NCg0KKiAyICJob3dldmVyLi4uaG93ZXZl ciIgKHZhbGlkIHR5cG8pDQoNCiogMyAidGhvc2UgSlNPTiBvYmplY3QiID8gKHZhbGlkIHR5cG8p DQoNCiMgMyAgImhlYWRlciAvZmllbGQvPyIgVGhpcyBpcyB0aGUgZmlyc3Qgb2YgbWFueSBwbGFj ZXMgd2hlcmUgdGhlIHJldmlldyBtZW50aW9ucyB0aGlzLiBUaGVyZSdzIGFub3RoZXIgaW4gNS4x ICgiaGVhZGVyPyBvciBoZWFkZXIgZmllbGQ/IiksIHNvbWUgaW4gNS4yICgiaGVhZGVycz8gaGVh ZGVyIGZpZWxkcz8iIGFuZCBhIGZldyBoaW50cyBvZiAiaGVhZGVyIFtmaWVsZCIpLCBhdCB0aGUg YmVnaW5uaW5nIG9mIFNlY3Rpb24gOCAoImhlYWRlciAqZmllbGQqIikgYW5kIHNvIG9uLiBUbyBi ZSBjbGVhciwgdGhlIHJldmlldyBpcyBhYnNvbHV0ZWx5IGNvcnJlY3QgdGhhdCB0aGVyZSBpcyBh IGRpc3RpbmN0aW9uIGJldHdlZW4gYSBoZWFkZXIsIGEgaGVhZGVyIGZpZWxkLCBhbmQgYSBoZWFk ZXIgZmllbGQgdmFsdWUsIGFuZCB0aGF0IHRoZSB0ZXh0IGluIHJmYzQ0NzRiaXMgaGFuZGxlcyB0 aGF0IGRpc3RpbmN0aW9uIHByZXR0eSBsb29zZWx5LiBJdCBpcyBmdWxsIG9mIGNvbnN0cnVjdGlv bnMgbGlrZSB0aGUgZm9sbG93aW5nICh0YWtlbiBmcm9tIDUuMSk6DQoNCiAgIEFuIGF1dGhlbnRp Y2F0aW9uIHNlcnZpY2UgTVVTVCBhZGQgYSBEYXRlIGhlYWRlciBmaWVsZCB0byBTSVANCiAgIHJl cXVlc3RzIHRoYXQgZG8gbm90IGhhdmUgb25lLiAgVGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2Ug TVVTVA0KICAgZW5zdXJlIHRoYXQgYW55IHByZWV4aXN0aW5nIERhdGUgaGVhZGVyIGluIHRoZSBy ZXF1ZXN0IGlzIGFjY3VyYXRlLg0KDQpJbiBvbmUgY2FzZSB0aGVyZSwgaXQgdXNlcyB0aGUgZnVs bCBjb25zdHJ1Y3Rpb24gIkRhdGUgaGVhZGVyIGZpZWxkIiwgYW5kIHRoZW4gaW4gbGl0ZXJhbGx5 IHRoZSBuZXh0IHNlbnRlbmNlLCBpdCBjYXN1YWxseSB1c2VzICJEYXRlIGhlYWRlciIgaW5zdGVh ZC4gRnJvbSBhIHF1aWNrIGdsYW5jZSBhdCB0aGUgdXNhZ2Ugb2YgImhlYWRlciIgdnMuICJoZWFk ZXIgZmllbGQgdmFsdWUiIGluIHJmYzQ0NzRiaXMsIGl0IGxvb2tzIGxpa2UgImhlYWRlciIgYXBw ZWFycyBhcm91bmQgMjQwIHRpbWVzLCBhbmQgImhlYWRlciBmaWVsZCIgb25seSBhIGZldyBtb3Jl IHRoYW4gNzAuIFN1cmVseSBtb3N0IG9mIHRob3NlIHVzYWdlcyBvZiAiaGVhZGVyIiBzaG91bGQg YWN0dWFsbHkgYmUgImhlYWRlciBmaWVsZCIsIGFzIGluIHRoZSBxdW90ZSBmcm9tIDUuMSBhYm92 ZS4gUHJvYmFibHkgbWFueSBtb3JlIHNob3VsZCBiZSAiaGVhZGVyIGZpZWxkIHZhbHVlIiAod2hp Y2ggYXBwZWFycyBvbmx5IGEgZG96ZW4gdGltZXMpLiBIb3dldmVyLi4uIFNJUCBoYXMgbmV2ZXIg YmVlbiByZWFsIGdvb2QgYWJvdXQgdGhpcy4gT2gsIEkgcmVtZW1iZXIgZHVyaW5nIFJGQzMyNjEg aG93IGRpbGlnZW50IHdlIHdlcmUgaW4gdHJ5aW5nIHRvIGtlZXAgdGhlc2Ugc3RyYWlnaHQuIEJ1 dCBpZiB5b3UgbG9vayBhdCBzdWJzZXF1ZW50IGhlYWRlciBzcGVjaWZpY2F0aW9ucyBmb3IgU0lQ LCBsaWtlIHNheSBSZXBsYWNlcyAoUkZDMzg5MSkgb3IgSGlzdG9yeS1JbmZvIChSRkM0MjQ0KSwg d2UgbmV2ZXIgcmVhbGx5IGxvY2tlZCB0aGlzIGRvd24uIFRoZSBudW1iZXJzIG9mICJoZWFkZXIi IHZzLiAiaGVhZGVyIGZpZWxkIiB2cy4gImhlYWRlciBmaWVsZCB2YWx1ZSIgZm9yIHRoZSBvcmln aW5hbCBSRkM0NDc0IGFyZSBwcmV0dHkgc2ltaWxhciB0byB3aGF0IHdlIHNlZSBpbiByZmM0NDc0 YmlzLiBJIHRoaW5rIHRoZSByZWFzb24gd2h5IHdlIGNvbnRpbnVlIHRvIHVzZSBpdCBwcmV0dHkg Y2FzdWFsbHkgaXMsIHdlbGwsIGJlY2F1c2UgYXMgdGhhdCBxdW90ZSBhYm92ZSBmcm9tIDUuMSBp bGx1c3RyYXRlcywgdGhlcmUgaXNuJ3QgYW55IGRhbWFnaW5nIGFtYmlndWl0eSBhYm91dCB0aGlz LiBUaGUgc2Vjb25kIHNlbnRlbmNlIHJlYWxseSBpcyB0YWxraW5nIGFib3V0IHRoZSAiaGVhZGVy IGZpZWxkIHZhbHVlIiwgYXMgaXQgaXMgbm90IHRoZSAiaGVhZGVyIGZpZWxkIiB0aGF0IGlzICJh Y2N1cmF0ZSIgb3Igbm90LiBJIHN1c3BlY3QgdGhlIHJlYXNvbiB3aHkgd2UgU0lQIGZvbGtzIGhh dmUgYmVlbiBsYXggYWJvdXQgdGhpcyBpcyBiZWNhdXNlIHRoZSBjb25zdHJ1Y3Rpb24gIkRhdGUg aGVhZGVyIiBpbiBzZW50ZW5jZXMgbGlrZSB0aGUgYWJvdmUgaXMgbm90IGFjdHVhbGx5IHVuY2xl YXIgaW4gYW55IG1lYW5pbmdmdWwgd2F5LCBpdCBpcyBwZXJmZWN0bHkgb2J2aW91cyB3aGF0IGl0 IG1lYW5zLiBBbGwgdGhhdCBzYWlkLCBpdCBpc24ndCBhIGh1Z2UgYW1vdW50IG9mIHdvcmsgdG8g YmUgcHJlY2lzZSBhYm91dCB0aGlzIC0gaWYgYW55b25lIHdvdWxkIGxpa2UgdG8gbWFrZSB0aGUg Y2FzZSB0aGF0IHRoZXJlJ3MgYWN0dWFsbHkgYSBwcmFjdGljYWwgcHJvYmxlbSBoZXJlIHJhdGhl ciB0aGFuIGEgbWVyZWx5IHBlZGFudGljIGV4ZXJjaXNlIGludm9sdmVkLiBUaGUgY2FzdWFsIHVz ZSBvZiAiaGVhZGVyIiBjZXJ0YWlubHkgaGFzbid0IHByZXZlbnRlZCB0aGUgcHVibGljYXRpb24g b2YgbWFueSBwcmV2aW91cyBTSVAgaGVhZGVyIHNwZWNpZmljYXRpb24gUkZDcy4NCg0KNS4xICJU aGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIHJvbGUgZm9yIFNJUCBlbnRpdGllcyBjYWxsZWQgYW4g YXV0aGVudGljYXRpb24gc2VydmljZS4iIFJldmlldyByZWFkczogImRlbGV0ZSBmaXJzdCBzZW50 ZW5jZS4gIGl0IGFkZHMgbm8gdXNlZnVsIGluZm9ybWF0aW9uLiIgQSBzaW1pbGFyIGNvbW1lbnQg aXMgbWFkZSBhYm91dCB0aGUgZmlyc3Qgc2VudGVuY2UgaW4gNS4yLiBJIGRvIG5vdCBiZWxpZXZl IGl0IGlzIGEgcHJvYmxlbSBmb3Igc2VjdGlvbnMgb2YgYSBzcGVjaWZpY2F0aW9uIHRvIGJlZ2lu IHdpdGggYW4gaW50cm9kdWN0b3J5IHNlbnRlbmNlIHRoYXQgcXVldWVzIHVwIHRoZSB0b3BpYyBh Ym91dCB0byBiZSBkaXNjdXNzZWQuIEkgY29tbWVudCBtb3JlIGFib3V0IHRoaXMgYXMgYSBkb2N1 bWVudCBvcmdhbml6YXRpb24gbWF0dGVyLCBhcyB0aGF0IGlzIGhvdyBpdCBpcyByYWlzZWQgaW4g NS4yIC0gYXMgYSBxdWVzdGlvbiBvZiByZWR1bmRhbmN5Lg0KDQo1LjEgIkNvbnN0YW50IHJlZmVy ZW5jZXMgdG8gaW1wbGVtZW50YXRpb24gKGFuZCAnaW5zdGFudGlhdGlvbicpIHBvc3NpYmlsaXRp ZXMgZGlzdHJhY3RzIGZyb20gdGhlIHJlcXVpcmVkIHRhc2sgb2YgZGVmaW5pbmcgdGhlIGFyY2hp dGVjdHVyZSBhbmQgZnVuY3Rpb25zIG9mIHRoZSBzZXJ2aWNlLiIgVGhlIGlkZWEgdGhhdCB0aGVy ZSBhcmUgYWJzdHJhY3QgInJvbGVzIiB3aGljaCBhcmUgaW5zdGFudGlhdGVkIGJ5IGVudGl0aWVz IGluIGEgU0lQIGFyY2hpdGVjdHVyZSBmb3IgdGhlIHB1cnBvc2VzIG9mIGV2ZW4gYSBzaW5nbGUg dHJhbnNhY3Rpb24gaXMgYSBjb3JlIFNJUCBjb25jZXB0IChzZWUgdGhlIFVBQyBvciBVQVMgcm9s ZXMsIG9yIFJGQzMyNjEgMTAuMSBvbiB0aGUgYWJzdHJhY3QgImxvY2F0aW9uIHNlcnZpY2UiKSwg YW5kIGlzIGZvdW5kYXRpb25hbCB0byBob3cgdGhlIG1lY2hhbmlzbSBpbiB0aGlzIGRvY3VtZW50 IGlzIHRvIGJlIHVuZGVyc3Rvb2QuIFRoaXMgc3BlY2lmaWNhdGlvbiBpcyBvbmx5IGRlZmluaW5n IGFuICJhcmNoaXRlY3R1cmUiIGluIHNvIGZhciBhcyBpdCBkZWZpbmVzIHRoZSBhdXRoZW50aWNh dGlvbiBhbmQgdmVyaWZpY2F0aW9uIHNlcnZpY2Ugcm9sZXMuDQoNCjUuMSBXaGVyZSBzcGVjIHJl YWRzLCAicHJpdmF0ZSBrZXkgb2Ygb25lIG9yIG1vcmUgY3JlZGVudGlhbHMiLCB0aGUgcmV2aWV3 IGNvdW50ZXJzLCAibm90IHN1cmUgd2hhdCB0aGlzIG1lYW5zPyBPbmUga2V5IGNhbiBoYXZlIG1v cmUgdGhhbiBvbmUgY3JlZGVudGlhbD8gT24gdGhlIHNpZ25pbmcgc2lkZSwgSSdkIGV4cGVjdCB0 aGUgcHJvY2VzcyB0byBzdGFydCBieSBjaG9vc2luZyBhIGNyZWRlbnRpYWwgYW5kIHRoZW4gdXNp bmcgaXRzIGFzc29jaWF0ZWQga2V5LiIgTm8sIGFuIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgbWF5 IGhhdmUgbXVsdGlwbGUgY3JlZGVudGlhbHMgYXNzb2NpYXRlZCB3aXRoIGRpZmZlcmVudCBuYW1l cywgd2hlcmUgZWFjaCBjcmVkZW50aWFsIGhhcyBhbiBhc3NvY2lhdGVkIHB1YmxpYyBhbmQgcHJp dmF0ZSBrZXkuIFJldmlldyBwcm9wb3NlcyB0aGUgd29yZGluZyAiVGhlIGF1dGhlbnRpY2F0aW9u IHNlcnZpY2UgcG9zc2Vzc2VzIHRoZSBwcml2YXRlLi4uIiBidXQgdGhpcyBpcyByZWplY3RlZCwg YmVjYXVzZSB0aGF0IGxvc2VzIHRoZSBzZW5zZSB0aGF0IHRoZXJlIG1heSBiZSBtdWx0aXBsZSBw cml2YXRlIGtleXMgZHVlIHRvIGhhdmluZyBhdXRob3JpdHkgb3ZlciBtdWx0aXBsZSBuYW1lcy4N Cg0KNS4xIFdoZXJlIHRoZSBzcGVjIHJlYWRzLCAidGhhdCBjYW4gYmUgdXNlZCB0byBzaWduIGZv ciBhIGRvbWFpbiBvciBhIHRlbGVwaG9uZSBudW1iZXIiLCB0aGUgcmV2aWV3IHByb3Bvc2VzICJj YW4gYmUgdXNlZCB0byBzaWduIHRoZSBGcm9tIGlkZW50aXR5LiIgVGhlIHNjb3BlIG9mIHRoZSBj cmVkZW50aWFsIGlzIG92ZXIgdGhlIGRvbWFpbiBvciB0ZWxlcGhvbmUgbnVtYmVyLCBhbmQgdGhl IGNyZWRlbnRpYWwgY291bGQgYmUgdXNlZCBvdXRzaWRlIHRoZSBTSVAgY29udGV4dCAtIHRoZXJl J3Mgbm8gc2Vuc2UgaW4gd2hpY2ggdGhlIGNyZWRlbnRpYWwgaXMgc3BlY2lmaWMgdG8gdGhlIGlk ZW50aXR5IGFwcGVhcmluZyBpbiBhIEZyb20gaGVhZGVyIGZpZWxkLiBUaGUgdmFsdWUgb2YgdGhp cyBwcm9wb3NlZCBlZGl0IGlzIHRodXMgdmVyeSBkdWJpb3VzLiANCg0KNS4xICAib25lIG9yIG1v cmUgU0lQIHVzZXJzIC0+IHVzZXJzIiBXaGlsZSB0aGlzIHByb3Bvc2VkIGVkaXQgaXMgc2hvcnRl ciwgaXQgZG9lcyBub3Qgb2ZmZXIgYW55IG90aGVyIG9idmlvdXMgYmVuZWZpdC4NCg0KNS4xIFRo ZSByZXZpZXcgc2F5cyB0aGF0ICJ0aGUgd29yZCBpZGVudGl0eSBoYXNuJ3QgYmVlbiB1c2VkIGlu IHRoaXMgcGFyYWdyYXBoLCBiZWZvcmUgdGhpcywgc28gdGhlIHJlZmVyZW50IGlzIHVuY2xlYXIu IiBJZGVudGl0eSBpcyBhIGZ1bmRhbWVudGFsIGNvbmNlcHQgaW4gdGhpcyBkb2N1bWVudCwgdGhl cmUgaXMgbm8gbmVlZCB0byByZWZyZXNoIGl0IGhlcmUuIA0KDQo1LjEgIkFuZCwgYnkgdGhlIHdh eSwgd2hhdCBoZWFkZXIgZmllbGQgaXMgdGhhdD8iIFRoZSBwcmV2aW91cyBzZW50ZW5jZSByZWFk cyAiQW4gYXV0aGVudGljYXRpb24gc2VydmljZSBhZGRzIHRoZSBJZGVudGl0eSBoZWFkZXIgdG8g U0lQIHJlcXVlc3RzLiIgIFRoZXJlIGlzIG5vIGNvbXByZWhlbnNpYmlsaXR5IHByb2JsZW0gaGVy ZS4gWyRdDQoNCjUuMSAiW29yIG5vdF0gcmVtb3ZlIi4gQSBzaW1pbGFyIGNvbW1lbnQgYWxzbyBh cHBlYXJzIGluIFNlY3Rpb24gNy4gSSdkIHJhdGhlciBrZWVwIHRoZSAib3Igbm90IiB3aXRoIHRo ZSAid2hldGhlci4iIENvbnN1bHRpbmcgdGhlIHJlbGV2YW50IGVudHJ5IG9uICJ3aGV0aGVyIiB2 cy4gIndoZXRoZXIgb3Igbm90IiBpbiBhbiBFbmdsaXNoIHVzYWdlIGRpY3Rpb25hcnkgKE1lcnJp YW0gV2Vic3RlcikgaXQgbm90ZXMgdGhhdCAidGhlIHVzZSBvZiAnb3Igbm90JyBpcyBtb3JlIHRo YW4gMzAwIHllYXJzIG9sZCBhbmQgaXMgY29tbW9uIGFtb25nIGVkdWNhdGVkIEVuZ2xpc2ggc3Bl YWtlcnMgYW5kIHdyaXRlcnMuIEl0IGlzLCBpbiBzaG9ydCwgcGVyZmVjdGx5IGdvb2QsIGlkaW9t YXRpYyBFbmdsaXNoLiIgTW9yZSB0byB0aGUgcG9pbnQsIEkgYW0gcmVhbGx5IHVuc3VyZSB3aGF0 IHRoZSB2YWx1ZSB3b3VsZCBiZSBpbiB0YWdnaW5nIHN0eWxpc3RpYyBkZWNpc2lvbnMgbGlrZSB0 aGlzIHRoYXQgY2FuIGVhc2lseSBnbyBlaXRoZXIgd2F5IGluIGEgcmV2aWV3IG9mIGEgdGVjaG5p Y2FsIHNwZWNpZmljYXRpb24gLSBvdGhlciB0aGFuIGluIHNvIGZhciBhcyBpdCBtYWtlcyB0aGUg cmV2aWV3IGp1c3QgYSBsaXR0bGUgbG9uZ2VyIGFuZCBnaXZlcyB0aGUgcGVyc29uIGFuc3dlcmlu ZyBpdCBqdXN0IGEgbGl0dGxlIG1vcmUgd29yayB0byBkby4gVGhhdCBnb2VzIGRvdWJsZSBmb3Ig ZmxhZ2dpbmcgdGhpcyBhcyBhbiAiaXNzdWUiIHR3aWNlLg0KDQo1LjEgInNlbmRlcjogY2FsbGlu ZyB1c2VyPywgY2FsbGluZyB1YT8sIG9yaWdpbmF0aW5nIG9wZXJhdG9yPyBpbnRlcm1lZGlhcnk/ IEFsdGhvdWdoIHRoZSB3b3JkIGlzIHVzZWQgZnJlcXVlbnRseSBpbiB0aGUgU0lQIHNwZWMsIGl0 IGlzIG5vdCBkZWZpbmVkLiIgV2VsbCwgaWYgaXQncyBmbGFnZ2VkIGhlcmUsIHdoeSBub3QgZmxh ZyBpdCBiYWNrIGluIHNlY3Rpb24gMywgZm9yIHRoZSBzZW50ZW5jZSwgIlNpbmNlIHRoZSBwcmlt YXJ5IGlkZW50aWZpZXIgb2YgdGhlIHNlbmRlciBvZiBhIFNJUCByZXF1ZXN0LCB0aGUgRnJvbSBo ZWFkZXIgZmllbGQsIGNhbiBiZSBwb3B1bGF0ZWQgYXJiaXRyYXJpbHkgYnkgdGhlIGNvbnRyb2xs ZXIgb2YgYSB1c2VyIGFnZW50LCBpbXBlcnNvbmF0aW9uIGlzIHZlcnkgc2ltcGxlIHRvZGF5IGlu IG1hbnkgZW52aXJvbm1lbnRzLiIgVGhlIHNlbmRlciBvZiBhIFNJUCByZXF1ZXN0IGlzIHRoZSBl bnRpdHkgdGhhdCBpbnN0YW50aWF0ZXMgKGxlYXJuIHRvIGxvdmUgaXQpIHRoZSB1c2VyIGFnZW50 IGNsaWVudCByb2xlIGluIGEgU0lQIHRyYW5zYWN0aW9uLiBQcmFjdGljYWxseSBzcGVha2luZywg dGhhdCBjb3VsZCBiZSBhbiBpbnRlcm1lZGlhcnkgaW4gc29tZSBjYXNlcywgYnV0IGl0IGlzIG1v c3QgY29tbW9ubHkgYW4gZW5kcG9pbnQgdW5kZXIgdGhlIGNvbnRyb2wgb2YgYSBjYWxsaW5nIHVz ZXIuIEFueXdheSwgSSBkb24ndCB0aGluayB0aGVyZSdzIGFueSBhbWJpZ3VpdHkgYWJvdXQgd2hh dCAic2VuZGVyIiBtZWFucyBoZXJlLCBlc3BlY2lhbGx5IGdpdmVuIHRoZSBlYXJsaWVyIHVzYWdl IGluIFNlY3Rpb24gMy4gSXQgaXMgYXMgeW91IG5vdGUgcHJldHR5IGNvbW1vbiBpbiBTSVAgc3Bl Y3MuIA0KDQoqIDUuMSAiJ2NoZWNraW5nJyBhbmQgJ2NvbnZlcnRpbmcnIGFyZSB2ZXJ5IGRpZmZl cmVudCBhY3Rpb25zLiIgKHZhbGlkIHR5cG8pIE5vIGlkZWEgd2hlcmUgImNvbnZlcnRpbmciIGNh bWUgZnJvbS4NCg0KKiA1LjEgImEgY29ycmVzcG9uZGluZyBhbiA/LT4/IGEgY29ycmVzcG9uZGlu ZyIgKHZhbGlkIHR5cG8pDQoNCiogNS4xICJiYXNlbGluZSBQQVNTcG9yVCBvYmplY3RzIGhlYWRl cnMgLT4gYSBiYXNlbGluZSBQQVNTcG9yVCBvYmplY3RzIGhlYWRlciIsIHRoYXQgaXMgYSB0eXBv LCBidXQgc2hvdWxkIGJlICJiYXNlbGluZSBQQVNTcG9yVCBvYmplY3QgaGVhZGVycyIgYWN0dWFs bHkuDQoNCjUuMSAiV2hlbiBob3dldmVyIj8gTWF5YmUgIldoZW4sIGhvd2V2ZXIsIGFuIGF1dGhl bnRpY2F0aW9uIHNlcnZpY2UuLi4iIEkgdGhpbmsgd2UgZ2V0IHRoZSBwb2ludCB3aXRob3V0IHRo YXQsIGJ1dCBJJ20gb25seSBzbGlnaHRseSBjb2xkZXIgdGhhbiBsdWtld2FybSBvbiBjaGFuZ2lu ZyB0aGlzLg0KDQo1LjEgIFRoZSByZXZpZXcgaW50ZXJydXB0cyB0aGUgc3BlYyB0ZXh0IHJlYWRp bmcgIkFsc28sIGluIHNvbWUgY2FzZXMsIGEgcmVxdWVzdCBzaWduZWQgYnkgYW4gYXV0aGVudGlj YXRpb24gc2VydmljZSIgd2l0aCBhIHBlcmVtcHRvcnkgIidpbiBzb21lIGNhc2VzJz8gIFRoaXMg aXMgYSBzcGVjaWZpY2F0aW9uLiAgV2hlcmUgaXMgdGhlIGNsZWFyIGRldGFpbD8iIElmIHdlIGxl dCB0aGUgc2VudGVuY2UgY29udGludWUsIGl0IHdpbGwgY2xhcmlmeSB0aGF0IGl0IHJlZmVycyB0 byB0aG9zZSBjYXNlcyB3aGVyZSB0aGUgdGhlIHJlcXVlc3QgIndpbGwgYmUgcmVqZWN0ZWQgYnkg dGhlIHZlcmlmaWNhdGlvbiBzZXJ2aWNlIG9uIHRoZSByZWNlaXZpbmcgc2lkZSIgd2l0aCBhIDR4 eCBzdGF0dXMgY29kZSwgYWZ0ZXIgd2hpY2ggaXQgZ2l2ZXMgc29tZSBndWlkYW5jZSBhYm91dCB3 aGF0IGlzIHRvIGJlIGRvbmUgaW4gdGhvc2UgY2FzZXMuIFRob3VnaCBvZiBjb3Vyc2UsIHRoZSBz ZW50ZW5jZSBjYW4ndCBmaW5pc2ggaXRzIHRob3VnaHQsIGFzIHRoZSByZXZpZXcgaW50ZXJydXB0 cyB5ZXQgYWdhaW4gYWZ0ZXIgInRoZSByZWNlaXZpbmcgc2lkZSIgd2l0aCB0aGUgaW5zaXN0YW5j ZSB0aGF0ICInb24gdGhlIHJlY2VpdmluZyBzaWRlJyBpcyByZWR1bmRhbnQuIFJlbW92ZSBpdC4g V2hlcmUgZWxzZSBpcyB0aGVyZSBhIHZlcmlmaWNhdGlvbiBzZXJ2aWNlPyIgYW5kIHRoZW4gb2Yg Y291cnNlIGFnYWluIGJlZm9yZSB0aGUgZW5kIG9mIHRoZSBzZW50ZW5jZSB0byBjb21wbGFpbiB0 aGF0IHRoZSB0ZXh0IGhlcmUgaXMgImRlc2NyaXB0aXZlIiBhbmQgd29uZGVyaW5nICJ3aGVyZSBp cyB0aGlzIFNJUCBiZWhhdmlvciBkb2N1bWVudGVkIGluIHRoZSBzcGVjPyIgVW5zdXJwcmlzaW5n bHksIHRoZSB0ZXh0IGFzc29jaWF0ZWQgd2l0aCBzZW5kaW5nIGEgNDM4IGluIHRoZSBiYWNrd2Fy ZHMgZGlyZWN0aW9uIGlzIHRvIGJlIGZvdW5kIGluIHRoZSB2ZXJpZmljYXRpb24gc2VydmljZSBi ZWhhdmlvciAoNS4yLCBTdGVwIDUgaXMgYSBnb29kIHBsYWNlIHRvIHN0YXJ0KSwgdGhvdWdoIHRo ZSBmb3JtYWwgZGVmaW50aW9ucyBvZiB0aGUgZXJyb3IgY29kZXMgYXJlIGluIDEzLjMuIEJ1dCB0 aGUgcmV2aWV3IGhlcmUgd291bGQgYmVuZWZpdCBmcm9tIGxldHRpbmcgYSBzZW50ZW5jZSBlbmQg YmVmb3JlIG9iamVjdGluZyB0byBpdC4gWyRdDQoNCjUuMiBXaGVyZSB0aGUgc3BlYyByZWFkcyAi dGhlIHZlcmlmaWVycyBNVVNUIGluc3BlY3QgYW55IG9wdGlvbmFsICJwcHQiIHBhcmFtZXRlciIg dGhlIHJldmlldyByZWNvbW1lbmRzIHJlbW92aW5nICJvcHRpb25hbCwiICJFc3BlY2lhbGx5IGdp dmVuIHRoZSBNVVNULiBJdCBkb2Vzbid0IG1hdHRlciB3aGV0aGVyIHRoZSBwcHQgd2FzIG9wdGlv bmFsIGZvciB0aGUgc2lnbmVyLiIgSSBkb24ndCB0aGluayBpdCBpcyBoYXJtZnVsIGhlcmUgdG8g cmVpbmZvcmNlIHRoYXQgdGhlIHBhcmFtZXRlciBpcyBvcHRpb25hbCwgYnV0IHRoYXQgbm9uZXRo ZWxlc3MsIGlmIHByZXNlbnQsIGl0IE1VU1QgYmUgaW5zcGVjdGVkLiBUaGUgcmV2aWV3IGZ1cnRo ZXJtb3JlIGFza3Mgb2YgIidhbnknIGNhbiB0aGVyZSBiZSBtb3JlIHRoYW4gb25lPyAgSWYgb25s eSBvbmUgdGhlbiBwZXJoYXBzOiIgVGhlIHJldmlldyBoZXJlIGRvZXNuJ3QgbGlrZSAidGhlIHZl cmlmaWVyIE1VU1QgaW5zcGVjdCBhbnkgb3B0aW9uYWwgJ3BwdCcgcGFyYW1ldGVyLCIgYXMgdGhl IHVzZSBvZiAiYW55IiBoZXJlIG9ubHkgY29ubm90ZXMgdGhlIHBvc3NpYmlsaXR5IG9mICJwcHQi J3MgYWJzZW5jZSwgcmF0aGVyIHRoYW4gYSBwb3RlbnRpYWwgcGx1cmFsaXR5LiBJIGRvbid0IHRo aW5rIHRoZXJlJ3MgYW55IGNvbmZ1c2lvbiBpbiB0aGUgRW5nbGlzaCB1c2FnZSB0aGVyZS4NCg0K NS4yICInbm9ybWFsbHknIGltcGxpZXMgdGhlIGFsdGVybmF0aXZlIGlzIGFibm9ybWFsLiAgYWxz bywgJ2JlbG93JyB3aGVyZT8iIFdoaWxlIEkgaGlnaGx5IGRvdWJ0IHRoaXMgaXMgdW5jbGVhciwg Zm9yICJiZWxvdyIgd2UgY2FuIHNheSAid2l0aCBTdGVwIDIiLiBUaGUgImFibm9ybWFsIiB0aGlu ZyB0aGF0IGhhcHBlbnMgaXMgdGhhdCB5b3UgaGF2ZSBzcGVjaWFsIGhhbmRsaW5nIGZvciB0aGUg cHJlc2VuY2Ugb2YgYSBzdXBwb3J0ZWQgb3IgdW5zdXBwb3J0ZWQgInBwdC4iIFdlIGNvdWxkIHRy eSBpbnN0ZWFkIG9mICJub3JtYWwiIHNvbWV0aGluZyBsaWtlICJkZWZhdWx0IiBvciAiYmFzZWxp bmUiIG9yIHdoYXRldmVyLCBidXQgSSB0aGluayAibm9ybWFsIiBpcyBmaW5lLiBUaGlzIGNvbnRl bnRpb24gb3ZlciB3aGF0IGlzICJub3JtYWwiIGNvbnRpbnVlcyB3aXRoIHRoZSByZXZpZXcncyBj bGFpbSB0aGF0ICJpdCBhcHBlYXJzIHRoYXQgcHB0IGRvZXMgbm90IGFmZmVjdCBwcm9jZXNzaW5n LCBhcyBsb25nIGFzIHRoZSBwcHQgaXMgJ3N1cHBvcnRlZCcuIiBUaGlzIGNvbW1lbnRzIG9uIGEg c2VudGVuY2UgdGhhdCBtZW50aW9ucyB0aGF0IHdoZW4gYSBzdXBwb3J0ZWQgJ3BwdCcgcGFyYW1l dGVyIHZhbHVlIGlzIHByZXNlbnQsIHlvdSBkbyB0aGUgInZhcmlhdGlvbnMiIGluIFN0ZXAgNS4g U3RlcCA1IGhhcyBjbGVhciBpZi10aGVuIGhhbmRsaW5nIGZvciBhIHN1cHBvcnRlZCBwcHQ6DQoN CiAgIElmIGEgInBwdCIgcGFyYW1ldGVyIGlzIHByZXNlbnQgKGFuZCBwZXINCiAgIFN0ZXAgMSwg aXMgdW5kZXJzdG9vZCksIHRoZSB2ZXJpZmllciBmb2xsb3dzIHRoZSBwcm9jZWR1cmVzIGZvciB0 aGF0DQogICAicHB0IiAoc2VlIFNlY3Rpb24gOSkuICANCg0KVGhhdCBpcyB0aGUgInZhcmlhdGlv biIgYWxsdWRlZCB0byBhYm92ZS4gSG93IHRoaXMgYWRkcyB1cCB0byB0aGUgY2xhaW0gdGhhdCBh IHN1cHBvcnRlZCAicHB0IiBkb2VzIG5vdCBhZmZlY3QgcHJvY2Vzc2luZyBpcyBiZXlvbmQgbWUu IA0KDQo1LjIuMSBUaGUgaW50cm9kdWN0b3J5IHNlbnRlbmNlIG9mIHRoaXMgc2VjdGlvbiBiZWdp bnMgIklmIHRoZSBvcHRpb25hbCAnY2Fub24nIHBhcmFtZXRlciBvZiB0aGUgSWRlbnRpdHkgaGVh ZGVyIGlzIHByZXNlbnQuIiBUaGUgcmV2aWV3IGludGVycnVwdHMgdG8gcmVjb21tZW5kIHJlbW92 aW5nIHRoZSAib3B0aW9uYWwsIiBhcyAiaXQncyByZWR1ZG5hbnQgd2l0aCAnaWYnIi4gSSBkb24n dCB0aGluayBpdCBpcyBoYXJtZnVsIHRvIHJlaW5mb3JjZSB0aGF0IHRoZSAiY2Fub24iIHBhcmFt ZXRlciBpcyBvcHRpb25hbC4gVGhlIHJldmlldyB0aGVuIGdvZXMgb24gdG8gYWxzbyByZWNvbW1l bmQgcmVtb3ZpbmcgIm9mIHRoZSBJZGVudGl0eSBoZWFkZXIiIGFzICJ0aGVyZSBpcyBubyBvdGhl ciBjYW5vbiBwYXJhbWV0ZXIiIHRoYW4gdGhlIG9uZSBhc3NvY2lhdGVkIHdpdGggdGhhdCBoZWFk ZXIuIEkgZm9yIG9uZSBkbyBub3QgZmVlbCB0aGF0IGluIHRoZSBpbnRyb2R1Y3Rvcnkgc2VudGVu Y2Ugb2YgYSBzZWN0aW9uLCBwcm92aWRpbmcgYSBiaXQgb2YgYnJvYWRlciBjb250ZXh0IGFuZCBy ZWluZm9yY2luZyB3aGF0IHdlIGhvcGVmdWxseSBhbHJlYWR5IGtub3cgZm9yIHRoZSBiZW5lZml0 IG9mIHBlb3BsZSB3aG8gc2tpcHBlZCB0byB0aGlzIHNlY3Rpb24gdmlhIGEgcG9pbnRlciBmcm9t IGVsc2V3aGVyZSBvciB3aGF0IGhhdmUgeW91IGlzIGhhcm1mdWwgLSBJIHRoaW5rIGl0IGlzIGFj dHVhbGx5IGdvb2Qgc3BlY21hbnNoaXAuIFRoZSByZXZpZXcgaG93ZXZlciByZWFsbHkgZG91Ymxl cyBkb3duIG9uIHRoaXM6ICJCdXQgcmVhbGx5IEkgc3VzcGVjdCB0aGF0IGV2ZW4gdGhlICdpZicg aXMgdW5uZWNlc3NhcnkuIFRoZSBvcHRpb25hbGl0eSBoYXMgYmVlbiBlc3RhYmxpc2hlZCBlbHNl d2hlcmUuIFRoZSB0YXNrIGhlcmUgaXMgbWVyZWx5IHRvIHNwZWNpZnkgd2hhdCBpcyBpbiBhIGNh bm9uLiIgU28gdGhlIHJldmlldyBwcm9wb3NlcyB0aGF0IDUuMi4xIGluc3RlYWQgc3RhcnQgd2l0 aCAiVGhlICdjYW5vbicgcGFyYW1ldGVyIGNvbnRhaW5zIGEgYmFzZTY0IGVuY29kaW5nIG9mIHRo ZSBoZWFkZXIgYW5kIGNsYWltLi4uIiBldGMuIENvbXBhcmluZyB0aGF0IHRvIHRoZSBleGlzdGlu ZyB0ZXh0LCBJIHRoaW5rIHRoZSBjb250ZXh0IHRoYXQgdGhlIGV4aXN0aW5nIHRleHQgcHJvdmlk ZXMgaXMgdmFsdWFibGUgZW5vdWdoIHRvIHdhcnJhbnQgcmV0YWluaW5nIGl0LCBvdmVyIHRoZXNl IGZvcmNlZnVsIG9iamVjdGlvbnMuDQoNCiogNS4yLjEgInRoaXMgLT4gdGh1cyA/IiAodmFsaWQg dHlwbykNCg0KNS4yLjEgQXMgdGhlIHNwZWMgcmVmZXJzIHRvICJhbnkgY2Fub25pY2FsIHRlbGVw aG9uZSBudW1iZXIgZm9ybWF0cyIsIHRoZSByZXZpZXcgbXVzdCBpbnF1aXJlICJ0aGVyZSBhcmUg bXVsdGlwbGUgY2Fub24gZm9ybWF0cz8gIHRoYXQgZG9lc24ndCBzb3VuZCB2ZXJ5IGNhbm9uaWNh bC4iIEknbSBwdXR0aW5nIHRoaXMgdW5kZXIgdGhlICJXb3JkIENob2ljZSIgc2VjdGlvbiBiZWNh dXNlIHRoaXMgaXMgZXNzZW50aWFsbHkgYSBncmFtbWF0aWNhbCBjb21wbGFpbnQuIFRoZXJlIGFy ZSBub3QgbXVsdGlwbGUgImZvcm1hdHMsIiBidXQgYXBwbHlpbmcgdGhlIGNhbm9uaWNhbGl6YXRp b24gYWxnb3JpdGhtIHRvIHRlbGVwaG9uZSBudW1iZXIgcmVwcmVzZW50YXRpb25zIHdpbGwgeWll bGQgcmVzdWx0cyB0aGF0IGNvdWxkIGJlIHZhcmlhYmxlLCBiZWNhdXNlIG9mIG1hdHRlcnMgb2Yg bG9jYWwgcG9saWN5IGRlc2NyaWJlZCBpbiBTZWN0aW9uIDcuMi4gU28gaWYgdGhlcmUncyBhIHBy b2JsZW0gd2l0aCB0aGF0LCBpdCdzIGluIDcuMiwgbm90IGluIHRoaXMgc2VjdGlvbiAtIHRoZSBw bHVyYWxpemF0aW9uIG9mICJmb3JtYXRzIiBpcyBqdXN0IGFuIGFydGlmYWN0IG9mIHRoZSAiYW55 IiBpbiB0aGUgc2VudGVuY2UgY29uc3RydWN0aW9uLg0KDQo1LjIuMSAiW3VubmVjZXNzYXJ5XSBy ZW1vdmUuIiBJIHRoaW5rIHRoZSBkaXN0aW5jdGlvbiBiZXR3ZWVuIGEgc2VjdXJpdHkgdmlvbGF0 aW9uLCB3aGljaCBpcyBhIG5lY2Vzc2FyeSB2ZXJpZmljYXRpb24gZmFpbHVyZSwgYW5kIHNvbWUg b3BlcmF0aW9uYWwgaGlqaW54IGxpa2UgaW50ZXJtZWRpYXJpZXMgdGlua2VyaW5nIHdpdGggdGhl IERhdGUgaGVhZGVyIHdoZW4gcmVnZW5lcmF0aW5nIGEgU0lQIHJlcXVlc3QsIHdoaWNoIGlzIGFu IHVubmVjZXNzYXJ5IHZlcmlmaWNhdGlvbiBmYWlsdXJlLCBpcyB3b3J0aCBwcmVzZXJ2aW5nLg0K DQoqIDYuMSAiW3BvdGVudGlhbGx5XSByZW1vdmUuIiBUaGUgbm90aW9uIHRoYXQgYSBjcmVkZW50 aWFsJ3Mgc2NvcGUgbWlnaHQgY292ZXIgYSBzaW5nbGUgZG9tYWluIG9yICJwb3RlbnRpYWxseSIg YSBzZXQgb2YgZG9tYWlucyBzdWdnZXN0cyB0aGF0IHRoZSBmb3JtZXIgaXMgY29tbW9uIGFuZCB3 ZWxsIHVuZGVyc3Rvb2QgYW5kIHRoZSBsYXR0ZXIgaXMgc29tZXRoaW5nIHdlJ3JlIGVuZG9yc2lu ZyBhIGJpdCBsZXNzIGhlYXJ0aWx5LiBBbHRob3VnaCB0aGUgcmV2aWV3IHNwZWN1bGF0ZXMgYSBi aXQgYWJvdXQgd2hldGhlciBhICJzZXQgb2YgZG9tYWlucyIgbWVhbnMgc3ViLWRvbWFpbnMgdW5k ZXIgYSBoaWdoZXItbGV2ZWwgZG9tYWluLCB0aGF0IGlzbid0IHJlYWxseSBtYXRlcmlhbCB0byB0 aGUgbGFuZ3VhZ2UgaGVyZS4gVGFraW5nIGEgc3RlcCBiYWNrLCBJIGNhbiBzZWUgaG93IHRoaXMg bWlnaHQgYmUgY29uZnVzaW5nLCB0aG91Z2ggLSBjb3VsZCBiZSB3b3J0aCBhIHF1aWNrIGZpeC4N Cg0KNi4xIFdoZXJlIHRoZSBvcmlnaW5hbCB0ZXh0IHJlYWRzLCAiU2ltaWxhcmx5LCBhIGNyZWRl bnRpYWwgbWF5IHJlcHJlc2VudCBhdXRob3JpdHkgb3ZlciBhIHNpbmdsZSB0ZWxlcGhvbmUgbnVt YmVyIG9yIGEgcmFuZ2Ugb2YgdGVsZXBob25lIG51bWJlcnMsIiB0aGUgcmV2aWV3IHByb3Bvc2Vz IHJlcGxhY2luZyB0aGlzIHdpdGggIlNpbWlsYXJseSBmb3IgdGVsZXBob25lIG51bWJlcnMsIGEg Y3JlZGVudGlhbCBjYW4gcmVwcmVzZW50IG9uZSBvciBhIHJhbmdlIG9mIG51bWJlcnMuIiBXaGls ZSB0aGUgbGF0dGVyIGlzIHNsaWdodGx5IHNob3J0ZXIsIHRoZSB2YWx1ZSBvZiB0aGlzIHNvcnQg b2Ygd29yZHNtaXRoaW5nIGlzIHVuY2xlYXIuIEl0IGxvc2VzIHRoZSBjb25ub3RhdGlvbiB0aGF0 IGEgY3JlZGVudGlhbCAicmVwcmVzZW50cyBhdXRob3JpdHkgb3ZlciIgdGhvc2UgdGVsZXBob25l IG51bWJlcnMuIFRoZSBjcmVkZW50aWFsIGRvZXNuJ3QgInJlcHJlc2VudCIgdGhvc2UgdGVsZXBo b25lIG51bWJlcnMuIA0KDQo2LjIgImZvciAtPiBmcm9tID8iIFVtLiBZb3Uga25vdyBJIHRoaW5r IGVpdGhlciByZWFkcyBva2F5LCBzdHJhbmdlbHkgZW5vdWdoLiBJIHRoaW5rIEkgbWF5YmUgbGlr ZSAiZm9yIiBiZXR0ZXIsIHRoZSBjcmVkZW50aWFscyBhcmUgImZvciIgdGhvc2UgYXV0aG9yaXRp ZXMsIHJhdGhlciB0aGFuIG1lcmVseSByZWNlaXZlZCAiZnJvbSIgdGhlbS4gTWF5YmUgImNvcnJl c3BvbmRpbmcgdG8iIHdvdWxkIGJlIGJldHRlci4NCg0KNi4zIFRoZSByZXZpZXcgaGVyZSBpcyBj b25jZXJuZWQgYWJvdXQgdGhlIG5hdHVyZSBvZiAiaGFuZGxpbmciLiBJdCBhcmd1ZXMgdGhhdCB0 aGUgbmFtZSBvZiB0aGUgc2VjdGlvbiBkb2VzIG5vdCBjb3JyZXNwb25kIHRvIGl0cyBjb250ZW50 cywgYW5kIHRoYXQgdGhlIGluZm9ybWF0aW9uIGluIDYuMyBpcyAiZGVmaW5pbmcgdGhlIGNvbnRl bnRzIiBvZiB0aGUgJ2luZm8nIHBhcmFtZXRlciByYXRoZXIgdGhhbiBkZXNjcmliaW5nIHRoZSAi aGFuZGxpbmciIG9mIGluZm8uIFNpbmNlIHRoaXMgc2VjdGlvbiBwcmltYXJpbHkgZGlzY3Vzc2Vz IHRoZSBjb25kaXRpb25zIGluIHdoaWNoIHRoZSBVUkkgZm91bmQgaW4gYW4gJ2luZm8nIHBhcmFt ZXRlciBjYW4gYmUgZGVmZXJlbmNlZCwgdGhpcyBjYW4gaGFyZGx5IGJlIGNvbnNpZGVyZWQgImRl ZmluaW5nIiBpdHMgY29udGVudHMsIHdoaWNoIGhhdmUgbG9uZyBzaW5jZSBiZWVuIGRlZmluZWQg KGluIHBhcnRpY3VsYXIgaW4gcGxhY2VzIGxpa2UgNS4xIFN0ZXAgNCwgYXQgbGVhc3QgdW50aWwg d2UgZ2V0IHRoZSBmaW5hbCB3b3JkIGluIFNlY3Rpb24gOCkuDQoNCjYuNCBUaGUgcmV2aWV3IGFz a3MgIldoYXQgZG9lcyBbdGhlXSBzY29wZSBvZiB0aGUgY3JlZGVudGlhbCBbbWVhbl0/IiBUaGUg c2NvcGUgb2YgYSBjcmVkZW50aWFsIGlzIHRoZSBzY29wZSBvZiBpdHMgYXV0aG9yaXR5OiBpbiB0 aGlzIGNvbnRleHQgdGhlIGlkZW50aWZpZXJzIGZvciB3aGljaCB0aGUgY3JlZGVudGlhbCBpcyBh dXRob3JpemVkIHRvIHNpZ24uIFNjb3BlIGlzIGRpc2N1c3NlZCBlYXJsaWVyIGluIDYuMiBhbmQg dGhlIGZpcnN0IHBhcmFncmFwaCBvZiA2LjEgKHByb2JhYmx5IHRoZSBiZXN0IHBsYWNlIHRvIGxv b2spLg0KDQoqIDYuNCBUaGUgcmV2aWV3IGhlcmUgYWxzbyB3b25kZXJzIGlmIHRoZSBmaXJzdCBw YXJhZ3JhcGggYWZ0ZXIgdGhlIGJ1bGxldGVkIGxpc3QgaXMgaW4gZmFjdCAiYW5vdGhlciBidWxs ZXQgZm9yIHRoZSBhYm92ZSwgaW5kZW50ZWQgbGlzdD8iIEl0IGNvdWxkIGJlLCBzdXJlLiBUaGF0 J3MgcHJvYmFibHkgYSBnb29kIGlkZWEuDQoNCjcuMSAiJ2Vucm9sbCc/Pz8iIFllcywgdGhlcmUg aXMgc29tZXRoaW5nIGNhbGxlZCBjZXJ0aWZpY2F0ZSBlbnJvbGxtZW50LiANCg0KNy4yIFRoZSBy ZXZpZXcgYXNrcyAiQW5kIHdoYXQgYWJvdXQgdGVsZXBob25lIG51bWJlcnMgdGhhdCBhcmUgbm90 IHBhcnQgb2YgYSBVUkk/IiBUaGUgVG8gYW5kIEZyb20gaGVhZGVyIGZpZWxkIHZhbHVlcyAoYW5k IHRoZSBzbmVha3kgUC1Bc3NlcnRlZC1JZGVudGl0eSBoZWFkZXIgZmllbGQgdmFsdWUgdG9vKSBv ZiBTSVAgY29udGFpbiBVUklzLiBUaGUgb25seSBtZWFuaW5nZnVsIGRpc3RpbmN0aW9uIGhlcmUg aXMgYmV0d2VlbiBhIFNJUCBVUkkgYW5kIGEgVEVMIFVSSS4gQnV0IHlvdSdyZSBhbHdheXMgZ29p bmcgdG8gYmUgZXh0cmFjdGluZyBhIHRlbGVwaG9uZSBudW1iZXIgZnJvbSBzb21lIHNvcnQgb2Yg VVJJLg0KDQo3LjIgSGVyZSB0aGUgcmV2aWV3IGFza3MgIklmIGEgJ251bWJlciBzdHJpbmcnIGhh cyBiZWVuIGlkZW50aWZpZWQsIHRoZW4gd2hhdCBkb2VzIGl0IG1lYW4gdG8gJ2NvbnN0cnVjdCBh IG51bWJlciBzdHJpbmcnPyBJIHRoaW5rIHdoYXQncyBtZWFudCBpcyB0aGF0IGl0IGlzIG5lY2Vz c2FyeSB0byBwdXQgdGhlIG51bWJlciBpbnRvIGEgY2Fub25pY2FsIGZvcm0uIEluIGFueSBjYXNl LCBwbGVhc2UgY2xhcmlmeSB3aGF0IGlzIG1lYW50LiIgT2YgY291cnNlLCBzaW5jZSB0aGUgbmV4 dCBzZW50ZW5jZSByZWFkcyAiVGhhdCByZXF1aXJlcyBwZXJmb3JtaW5nIHRoZSBmb2xsb3dpbmcg c3RlcHMsIiBjbGVhcmx5IHBlcmZvcm1pbmcgdGhvc2Ugc3RlcHMgaXMgd2hhdCBpdCBtZWFucyB0 byAiY29uc3RydWN0IGEgbnVtYmVyIHN0cmluZy4iIEJ1dCBtb3JlIGltcG9ydGFudGx5LCB0aGUg cmV2aWV3IHF1ZXN0aW9uIGFzc3VtZXMgdGhhdCBhICJudW1iZXIgc3RyaW5nIiBoYXMgYWxyZWFk eSBiZWVuIGlkZW50aWZpZWQsIHdoZXJlYXMgdGhlIHNwZWMgdGV4dCByZWFkcyAib25jZSBhbiBp bXBsZW1lbnRhdGlvbiBoYXMgaWRlbnRpZmllZCBhIHRlbGVwaG9uZSBudW1iZXIuIiBUaGUgZGlz dGluY3Rpb24gaGVyZSBpcyBiZXR3ZWVuIGEgInRlbGVwaG9uZSBudW1iZXIiIGFuZCBhICJudW1i ZXIgc3RyaW5nLiIgVGhlIHJldmlldyB0aG91Z2ggbmVhdGx5IHR3aXN0cyB0aGlzIGFyb3VuZCB0 byBtYWtlIGl0IHNvdW5kIGxpa2UgdGhhdCBkaXN0aW5jdGlvbiBpcyBub3Qgb2J2aW91cyBpbiB0 aGUgc2VudGVuY2UuIFskXQ0KDQoqIDcuMiAiV2hhdCBpcyB0aGUgZGVmaW5pdGlvbiBvZiBhICdj b21wbGV0ZSB0bic/ICBDaXRlIGl0LiIgVW0sIHdlJ2xsIGZpeCB0aGF0IGFzICJFLjE2NCIsIHRo b3VnaCBwcm9iYWJseSB0aGUgcmVmIGhlcmUgaXMgdG8gUkZDMzk2Ni4NCg0KKiA3LjIgVGhlIHJl dmlldyBpcyBza2VwdGljYWwgdGhhdCB0aGUgY2Fub25pY2FsIGZvcm0gb2YgdGhlIFROIGlzIHVz ZWQgImZvciB0aGUgcHVycG9zZSBvZiBjcmVhdGluZyBhbmQgc2lnbmluZyIgdGhlIHNpZ25lZC1p ZGVudGl0eS1zdHJpbmcgdmFsdWUuICJJIHN1c3BlY3QgaXQgaXMgL25vdC8gdXNlZCAiZm9yIHNp Z25pbmciIGJ1dCBpcyBpbiBmYWN0IHVzZWQgdG8gY3JlYXRlIHBhcnQgb2YgdGhlIGNvbnRlbnQg dGhhdCBpcyBzaWduZWQuIFRoYXQncyBkaWZmZXJlbnQuIiBUaGF0J3MgY29ycmVjdC4gSSdtIHdp bGxpbmcgdG8gZGl0Y2ggImFuZCBzaWduaW5nIi4NCg0KNy4zIFRoZSB0aXRsZSAiQXV0aG9yaXR5 IGZvciBEb21haW4gTmFtZXMiIG9mIHRoaXMgc2VjdGlvbiBlbGljaXRzIHRoZSByZXZpZXcgY29t bWVudCwgIkF1dGhvcml0eSBmb3IgZG9tYWluIG5hbWVzIGNvbWVzIGZyb20gSUNBTk4uIFVuZm9y dHVuYXRlbHksIEknbSBub3QgY2xlYXIgZW5vdWdoIGFib3V0IHRoZSBzcGVjaWZpYyBwdXJwb3Nl IG9mIHRoaXMgc2VjdGlvbiwgYnV0IGl0IG5lZWRzIGEgdGl0bGUgdGhhdCBpcyBtb3JlIHNwZWNp ZmljIGFuZCBjbGVhci4iIFRoZSB0aXRsZSBvYnZpb3VzbHkgbWlycm9ycyB0aGUgdGl0bGUgb2Yg Ny4xLCAiQXV0aG9yaXR5IGZvciBUZWxlcGhvbmUgTmFtZXMsIiBhbmQgYm90aCByZWZlciB0byB0 aGUgYXV0aG9yaXR5IHRoYXQgY3JlZGVudGlhbHMgcHJvdmlkZSBvdmVyIHRoZSByZXNwZWN0aXZl IGlkZW50aWZpZXJzLiBVbHRpbWF0ZWx5LCB3ZSBjb3VsZCBzYXkgdGhhdCB0aGlzIGF1dGhvcml0 eSBkZXZvbHZlcyBmcm9tIElDQU5OLCBpbiB0aGUgZG9tYWluIG5hbWUgY2FzZSwgYW5kIHRyaWNr bGVzIGRvd24gdGhyb3VnaCB0aGUgVExEIG9wZXJhdG9ycyB0byB0aGUgb3duZXJzIG9mIHNlY29u ZCBsZXZlbCBkb21haW5zIHdobyBnbyBnZXQgY3JlZGVudGlhbHMgZnJvbSBjZXJ0aWZpY2F0ZSBh dXRob3JpdGllcyB0b2RheS4gU28gYWN0dWFsbHksIEknbSBub3Qgc3VyZSB0aGUgc3ViamVjdCBv ZiB0aGlzIHNlY3Rpb24gaXMgc28gZGl2b3JjZWQgZnJvbSB0aGUgcmV2aWV3ZXIncyByZWFkaW5n IGFzIGhlIHN1cHBvc2VzLg0KDQo3LjMgV2hlbiB0aGUgc3BlYyBzYXlzIHRoYXQgIkEgdmVyaWZp ZXIgTVVTVCBldmFsdWF0ZSB0aGUgY29ycmVzcG9uZGVuY2UgYmV0d2VlbiB0aGUgdXNlcidzIGlk ZW50aXR5IGFuZCB0aGUgc2lnbmluZyBjcmVkZW50aWFsLCIgdGhlIHJldmlldyBjb3VudGVycywg IldoYXQgZG9lcyAnbXVzdCBldmFsdWF0ZScgbWVhbj8gV2hhdCBzcGVjaWZpYyAnZXZhbHVhdGlv bicgYWN0aW9ucyBhcmUgYmVpbmcgcmVxdWlyZWQ/IiBUaGUgZW5kIG9mIHRoZSBzcGVjIHNlbnRl bmNlIGhlcmUgc2F5cywgaW5ldml0YWJseSwgImJ5IGZvbGxvd2luZyB0aGUgcHJvY2VkdXJlcyBk ZWZpbmVkIGluIFJGQyAyODE4IFtSRkMyODE4XSwgU2VjdGlvbiAzLjEuIiBTbyBwcmVzdW1hYmx5 IHRoZSAiZXZhbHVhdGlvbiIgYWN0aW9ucyBkZXNjcmliZWQgdGhlcmUgYXJlIHRoZSBvbmVzIHRo YXQgdGhlIHZlcmlmaWVyIHRha2VzIGluIHRoaXMgY2FzZS4gVGhhdCBzZWN0aW9uIGFsc28gZ2l2 ZXMgdGhlICJhY3Rpb25zIGFyZSB0byBiZSB0YWtlbiBpbiByZXNwb25zZSB0byB0aGUgZXZhbHVh dGlvbiIuIEFnYWluLCBleHRlbmRpbmcgYSBkb2N1bWVudCB0aGUgY291cnRlc3kgb2YgcmVhZGlu ZyB0aGUgZW50aXJlIHNlbnRlbmNlIGlzIHVzdWFsbHkgYSBnb29kIGlkZWEgd2hlbiB3cml0aW5n IGEgcmV2aWV3IG9mIHRoaXMga2luZC4gWyRdDQoNCiogNy40ICJ0cmFuc2Zvcm1hdGlvbiAgLT4g dHJhbnNmb3JtYXRpb25zIiAodmFsaWQgdHlwbykNCg0KKiA4ICJ0byAtPiB0byB0aGUiICh2YWxp ZCB0eXBvKSBbSW4gYWRkaXRpb24gdG8gImluZm8iIHBhcmFtZXRlcl0NCg0KOCBXaGVuIHRoZSBz cGVjIGRlc2NyaWJlcyAiYSBwYWlyIG9mIEpTT04gb2JqZWN0cyIgYW5kIGJlZ2lucyB0YWxraW5n IGFib3V0IHRoZSAiZmlyc3QsIiB0aGUgcmV2aWV3IGludGVyamVjdHMsICJXaGF0IGlzIG1lYW50 IGJ5ICJ0aGUgZmlyc3QgcGFzc3BvcnQgb2JqZWN0Ij8gV2hlcmUgaXMgdGhlcmUgc3BlY2lmaWNh dGlvbiBvZiBtdWx0aXBsZSBvZiB0aGVtIGFuZCBob3cgaXMgdGhlaXIgb3JkZXJpbmcgZGV0ZXJt aW5lZD8iIE9mIGNvdXJzZSwgdGhpcyBpbnRlcnJ1cHRzIGEgc2VudGVuY2UsIGFuZCB0aGUgcmVt YWluZGVyIG9mIHRoZSBzZW50ZW5jZSByZWFkcywgInRoZSBmaXJzdCBQQVNTcG9yVCBvYmplY3Qg Y29udGFpbnMgaGVhZGVyIGluZm9ybWF0aW9uLCBhbmQgdGhlIHNlY29uZCBjb250YWlucyBjbGFp bXMsIGZvbGxvd2luZyB0aGUgY29udmVudGlvbnMgb2YgSldUIFtSRkM3NTE5XS4iIEhhdmUgSSBt ZW50aW9uZWQgdGhhdCB0aGUgcXVlc3Rpb25zIHRoYXQgbWlnaHQgb2NjdXIgdG8gdXMgYWJvdXQg dGhlIGZpcnN0IGZldyB3b3JkcyBvZiBhIHNlbnRlbmNlIGFyZSBvZnRlbiByZXNvbHZlZCBieSB0 aGUgcmVtYWluZGVyIG9mIGl0PyBBZnRlciByZWFkaW5nIHRoZSByZXN0IG9mIHRoZSBzZW50ZW5j ZSwgdGhlIHJldmlldyB0aGVuIGNvbnRpbnVlcywgIkkndmUgZ29uZSBiYWNrIGFuZCBsb29rZWQg YXQgdGhlIFBhc3Nwb3J0IHJlZmVyZW5jZXMgdG8gIm9iamVjdCIgYW5kIGRvIG5vdCBzZWUgYW55 IGNsZWFyIGluZGljYXRpb24gdGhhdCB0aGVyZSBhcmUgdHdvLCBpbiB0aGUgc3R5bGUgYmVpbmcg c3VtbWFyaXplZCBoZXJlLiIgT2J2aW91c2x5LCAib2JqZWN0IiBpcyB0aGUgIk8iIGluICJKU09O LCIgYW5kIGluZGVlZCB0aGUgSldUIHNwZWNpZmljYXRpb24gcmVmZXJzIChmb3IgZXhhbXBsZSkg aW4gU2VjdGlvbiAzIHRvIGhvdyAiSldUcyByZXByZXNlbnQgYSBzZXQgb2YgY2xhaW1zIGFzIGEg SlNPTiBvYmplY3QiLCB3aGljaCBpcyBjb21iaW5lZCB3aXRoIGEgSk9TRSBoZWFkZXIgKGEgc2Vw YXJhdGUgSlNPTiBvYmplY3QsIGFzIDMuMSBtYWtlcyBjbGVhciBieSByZWZlcnJpbmcgdG8gaXQg YXMgInRoZSBKU09OIG9iamVjdCBhYm92ZSIpIC0gaW4gb3RoZXIgd29yZHMsIG9uZSBtaWdodCBz YXkgdGhleSBhcmUgdHdvIG9iamVjdHMuIA0KDQpXaGlsZSB0aGUgcmV2aWV3IG9iamVjdHMgdGhh dCAiSSd2ZSBnb25lIGJhY2sgYW5kIGxvb2tlZCBhdCB0aGUgUGFzc3BvcnQgcmVmZXJlbmNlcyB0 byAnb2JqZWN0JyIsIHdoYXQgdGhlIHNwZWMgdGV4dCBoZXJlIHNheXMgaXMgImZvbGxvd2luZyB0 aGUgY29udmVudGlvbnMgb2YgSldUIFtSRkM3NTE5XSwiIG5vdCBQQVNTcG9yVC4gVGhlIHJldmll d2VyIHdvdWxkIGhhdmUgZm91bmQgdGhlIGFuc3dlciB0byB0aGlzIHF1ZXN0aW9uIGJ5IGFjdHVh bGx5IGxvb2tpbmcgd2hlcmUgdGhlIHRleHQgc3VnZ2VzdGVkLCBidXQgdGhlIHJldmlld2VyIHNl ZW1zIGRlZmlhbnQgYWJvdXQgbG9va2luZyB0aGVyZTogIkkgbmF0dXJhbGx5IGFzc3VtZSB0aGF0 IHNvbWUgcG9ydGlvbiBvZiB0aGlzIGlzIGluaGVyaXRlZCBmcm9tIEpTT04gYW5kL29yIEpXVCwg d2hpY2ggaXMgYSBuaWNlIGV4YW1wbGUgb2YgdGhlIHNpZ25pZmljYW50LCBhZGRpdGlvbmFsIG92 ZXJoZWFkIGJlaW5nIGJlaW5nIGludHJvZHVjZWQgd2l0aCB0aGVpciB1c2UuIEFuZCBpbiB0aGlz IGNhc2UsIGFwcGFyZW50bHkgY29uZnVzaW9uLiIgVGhlcmUgaXMgbm8gbmVlZCB0byBtYWtlIGFu eSBhc3N1bXB0aW9uIGhlcmUsIHRoZSBzcGVjIGFjdHVhbGx5IGluc3RydWN0ZWQgeW91IHRvIHJl ZmVyIHRvIEpXVC4gVGhlIG5vdGlvbiB0aGF0IHRoZXJlIGlzIGFueXRoaW5nIHRvIGJlIGNvbmZ1 c2VkIGFib3V0IGhlcmUgaXMgYSBidW5jaCBvZiBzbW9rZSBhbmQgbWlycm9ycy4gWyRdDQoNCjgg V2hlbiB0aGUgc3BlYyB0cmllcyB0byBibHVydCBvdXQgInRoZSBmb2xsb3dpbmcgZWxlbWVudHMg bWVzc2FnZSBNVVNUIGJlIHBsYWNlZCBhcyB0aGUiIHRoZSByZXZpZXcgaW50ZXJqZWN0cyAicGxh Y2VkIHdoZXJlPyIgSWYgd2UgbGV0IHRoZSBzcGVjIGNvbnRpbnVlcywgaXQgc2F5cywgInBsYWNl ZCBhcyB0aGUgdmFsdWVzIGNvcnJlc3BvbmRpbmcgdG8gdGhlIGRlc2lnbmF0ZWQgSlNPTiBrZXlz LiIgVGhlcmUgaXMgbm8gY2hhbmdlIHJlcXVpcmVkIGFzIGEgcmVzdWx0IG9mIHRoaXMgaGFzdHkg cmV2aWV3IGNvbW1lbnQuIFRoZSByZXZpZXcgdGhlbiBhc2tzIHVzIHRvICJEZWxldGUgdGhlIG9w ZW5pbmcgY2xhdXNlLCIgcHJlc3VtYWJseSByZWZlcnJpbmcgdG8gdGhlIGVudGlyZSBzZW50ZW5j ZS4gV2h5IHRoaXMgc2VudGVuY2UgY291bGQgcG9zc2libHkgYmUgYSBzb3VyY2Ugb2YgY29uZnVz aW9uIG9yIGhhcm0gdG8gdGhlIHJlYWRlciBpcyBhYnNvbHV0ZWx5IGJleW9uZCBtZS4gWyRdDQoN CjggVGhlIHJldmlldyBpcyBza2VwdGljYWwgYWJvdXQgdGhlIHVzZSBvZiB0aGUgd29yZCAibW9y ZSIgaW4gdGhlIHNwZWMgcGhyYXNlICJGb3IgbW9yZSBpbmZvcm1hdGlvbiBvbiB0aGUgc2VjdXJp dHkgcHJvcGVydGllcyBvZiB0aGVzZSBTSVAgbWVzc2FnZSBlbGVtZW50cywiIGFza2luZyAiaXMg dGhlcmUgc2VjdXJpdHkgaW5mb3JtYXRpb24gaGVyZT8gd2hlcmU/IiBJZiB3ZSB3ZXJlIGZlZWxp bmcgZ2VuZXJvdXMsIHdlIG1pZ2h0IHJlYWQgdGhlIG9yaWdpbmFsIHRleHQgIGFzICJmb3IgbW9y ZSBpbmZvcm1hdGlvbiwgaW5mb3JtYXRpb24gb24gdGhlIHNlY3VyaXR5IHByb3BlcnRpZXMgb2Yg dGhlc2UgU0lQIG1lc3NhZ2UgZWxlbWVudHMuIiBJIHNlZSBubyBzZXJpb3VzIHJpc2sgb2YgdGhp cyBjb25mdXNpbmcgcmVhZGVycyBhbmQgaW1wbGVtZW50ZXJzLiBUaGUgcmV2aWV3IGNvbnRpbnVl cyB0aGF0ICJBbmQgc2luY2UgZXZlcnkgUkZDIGNvbnRhaW5zIGEgc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgc2VjdGlvbiwgYSBnZW5lcmljIHJlZmVyZW5jZSBsaWtlIHRoaXMsIGhlcmUsIGlzIG9m IG5vIG9idmlvdXMgdmFsdWUuIEl0J3MganVzdCBtb3JlIHRleHQuIiBUaGUgZmFjdCB0aGF0IHRo ZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBjb250YWlucyBzcGVjaWZpYyBhbmFseXNpcyB0aGF0 IHRha2VzIGVhY2ggb2YgdGhlc2UgU0lQIG1lc3NhZ2UgZmllbGRzIGFuZCBub3RlcyB0aGVpciBz ZWN1cml0eSBwcm9wZXJ0aWVzIGlzIHdoeSB0aGV5IHdhcnJhbnQgYSBtZW50aW9uIGhlcmUgLSBh cyB0aGUgc3BlYyBzYXlzLCB3aGVuIGl0IG5vdGVzIHRoYXQgdGhlIHNlY3Rpb24gYW5zd2VycyAi d2h5IHRoZWlyIGluY2x1c2lvbiBtaXRpZ2F0ZXMgcmVwbGF5IGF0dGFja3MiIGZvciBleGFtcGxl LiBSZXZpZXdzIHRoYXQgaWdub3JlIHdoYXQgdGhlIHRleHQgYWN0dWFsbHkgc2F5cyBhbmQgaW5z dGVhZCBjcml0aXF1ZSBhIGdlbmVyaWMgc3RyYXdtYW4gYXJlIHVubGlrZWx5IHRvIGNvbnRyaWJ1 dGUgbXVjaCB2YWx1ZS4NCg0KKiA5ICJ3aXRoIG5vdyBjbGFpbXMiPyBzaG91bGQgYmUgIndpdGgg bmV3IGNsYWltcyIgKHZhbGlkIHR5cG8pDQoNCiogOSBUaGUgcmV2aWV3IGNvcnJlY3RseSBub3Rl cyB0aGF0IHRoZSBmaW5hbCBzZW50ZW5jZSBpbiBTZWN0aW9uIDkgaXMgbWFsZm9ybWVkLiAodmFs aWQgdHlwbykNCg0KMTEgVGhlIHJldmlldyBoZXJlIHN1Z2dlc3RzIHRoYXQgcmF0aGVyIHRoYW4g c2F5aW5nIHRoYXQgInRoZSBwdXJwb3NlIG9mIHRoaXMgbWVjaGFuaXNtIGlzIHRvIHByb3ZpZGUg YSBzdHJvbmcgaWRlbnRpZmljYXRpb24gb2YgdGhlIG9yaWdpbmF0b3Igb2YgYSBTSVAgcmVxdWVz dCwiIHdlIHNob3VsZCBpbnN0ZWFkIHVzZSAidGhlIHVzdWFsIHRlcm1zIiBzdWNoIGFzICJzdHJv bmcgYXV0aGVudGljYXRpb24iIG9yICJzdHJvbmcgc2VjdXJpdHksIiBhcyAiJ1N0cm9uZyBpZGVu dGlmaWNhdGlvbicgYXBwZWFycyB0byBoYXZlIG5vIGNvbW1vbiBtZWFuaW5nLiIgSSB0aGluayBp dCBoYXMgYSBjb21tb24gbWVhbmluZyBvZiBiZWluZyBhIHN0cm9uZyBpZGVudGlmaWNhdGlvbiBv ZiB0aGUgb3JpZ2luYXRvci4gVGhpcyBpc24ndCBhIHRlcm0gb2YgYXJ0Lg0KDQoxMSBIZXJlIHRo ZSByZXZpZXcgdGFrZXMgdXAgdGhlIHRlcm0gInByaXZhY3kgc2VydmljZSIsIHNheWluZywgIkkg dGhpbmsgdGhhdCBJIGRvbid0IGtub3cgd2hhdCBpdCBtZWFucyB0byBiZSBhICdwcml2YWN5IHNl cnZpY2UnLiBXaGF0IGZ1bmN0aW9uYWxpdHkgZG9lcyB0aGlzIHJlZmVyZW5jZSBoZXJlIGFuZCBo b3cgaXMgdGhlIHJlYWRlciB0byBrbm93PyIgUGVyaGFwcyBieSBsb29raW5nIGF0IHRoZSBwcmlv ciBzZW50ZW5jZSwgd2hpY2ggcmVmZXJzIHRvICJ0aGUgc3RhbmRhcmQgU0lQIHByYWN0aWNlcyBm b3IgcHJpdmFjeSBkZXNjcmliZWQgaW4gW1JGQzMzMjNdIi4gVGhlIGFic3RyYWN0IG9mIHRoYXQg c3BlY2lmaWNhdGlvbiBpbmRpY2F0ZXMgdGhhdCBpdCBpcyB3aGVyZSBhICJwcml2YWN5IHNlcnZp Y2UiIGlzIGRlZmluZWQuIEl0IGlzIG5vdCBhIHN0cmV0Y2ggdG8gZXhwZWN0IHRoYXQgYW4gaW50 ZXJlc3RlZCByZWFkZXIgd291bGQgbWFrZSB0aGlzIGRlZHVjdGlvbi4gWyRdDQoNCjExIFR3byBz ZW50ZW5jZXMgbGF0ZXIsIHRoZSByZXZpZXcgYWdhaW4gaW50ZXJqZWN0cyB3aXRoIGJhZmZsZW1l bnQsICJUaGlzIHNlbnRlbmNlIHNvdW5kcyBhcyBpZiBpdCBpcyBzaWduYWxpbmcgYW4gaW1wb3J0 YW50IHBvaW50LCBidXQgdGhlIHRleHQgZG9lcyBub3QgbWFrZSBjbGVhciB3aGF0IHRoYXQgaW1w b3J0IGlzLiBNeSBndWVzcyBpcyB0aGF0IGl0IG5lZWRzIHRvIGJlIHByZWNlZGVkIGJ5IGEgc2Vu dGVuY2UgdGhhdCBleHBsYWlucyB3aGF0IHByb2JsZW0gdGhlIHJlYWRlciBtaWdodCB0aGluayBl eGlzdHMuIFRoZW4gdGhpcyB0ZXh0IGV4cGxhaW5zIHRoYXQgaXQgZG9lc24ndC4iIFRoZSBwcmVj ZWRpbmcgc2VudGVuY2Ugbm90ZXMgdGhhdCBhIGNlcnRhaW4gdHlwZSBvZiBTSVAgaW50ZXJtZWRp YXJ5LCBhIHByb3h5IHNlcnZlciwgY2FuIGFjdCBhcyBib3RoIGFuIGF1dGhlbnRpY2F0aW9uIHNl cnZpY2UgYW5kIGEgcHJpdmFjeSBzZXJ2aWNlLiBUaGUgcHJlY2VkaW5nIHBhcmFncmFwaCBnYXZl IHNvbWUgaW5kaWNhdGlvbiBvZiB0aGUgbmF0dXJlIG9mIHRoZSBwZXJzb25hbCBpbmZvcm1hdGlv biB0aGF0IG1pZ2h0IGJlIHJldmVhbGVkIGJ5IHRoZSBpZGVudGl0eSBhc3NlcnRlZCBpbiBhIFNJ UCByZXF1ZXN0LCB3aGljaCBjb3VsZCBpbmNsdWRlICJ0aGUgbmFtZSBvZiBhIGh1bWFuIGJlaW5n LCB0aGVpciBwbGFjZSBvZiB3b3JrIG9yIHNlcnZpY2UgcHJvdmlkZXIsIGFuZCBwb3NzaWJseSBm dXJ0aGVyIGRldGFpbHMuIiBTbyB3ZSd2ZSBlc3RhYmxpc2hlZCB0aGF0IHRoZXJlIGlzIGEgY2Vy dGFpbiB0ZW5zaW9uIGJldHdlZW4gb3B0aW1pemluZyBmb3IgcHJpdmFjeSBhbmQgYXNzZXJ0aW5n IGlkZW50aXR5LiBTbywgd2hlbiB0aGUgY3VycmVudCBzZW50ZW5jZSBleHBsYWlucyB0aGF0IHBy aXZhdGUgU0lQIFVSSXMgY291bGQgYmUgc2lnbmVkIGJ5IGFuIGF1dGhlbnRpY2F0aW9uIHNlcnZp Y2UsIGl0IGlzIHBlcmhhcHMgc2F5aW5nIHNvbWV0aGluZyBjb3VudGVyaW50dWl0aXZlLiBJJ20g bm90IHN1cmUgdGhpcyBpcyBhbiBpbXBvcnRhbnQgcG9pbnQsIHNvIG11Y2ggYXMgcGVyaGFwcyBh IG5vbi1vYnZpb3VzIG9uZS4gSSB0aGluayBpdHMgaW1wb3J0IGlzIG9idmlvdXMsIGRlc3BpdGUg dGhlIHJldmlld2VyJ3MgYmFmZmxlbWVudC4NCg0KMTEgVGhlIHJldmlldyBvYmplY3RzIHRvIHRo ZSBwcmVzZW5jZSBvZiAiaG93ZXZlciIgaW4gYSBzZW50ZW5jZSB0aGF0IHdpbGwgdWx0aW1hdGVs eSBleHBsYWluIHRoYXQgeW91IGNhbid0IGhhdmUgYSBjZXJ0aWZpY2F0ZSBhc3NvY2lhdGVkIHdp dGggYW4gaW52YWxpZCBkb21haW4gbmFtZSBsaWtlICJhbm9ueW1vdXMuaW52YWxpZCIsIHdoaWNo IGlzIHJlY29tbWVuZGVkIGZvciB1c2UgaW4gUkZDMzMyMy4gVGhlICJob3dldmVyIiBkaXN0aW5n dWlzaGVzIHRoYXQgeW91IGNhbid0IGhhdmUgYW4gYXV0aGVudGljYXRpb24gc2VydmljZSBzaWdu IHRoZXNlIFVSSXMgbGlrZSB5b3UgY2FuIFVSSXMgZm9yIHZhbGlkIGRvbWFpbnMgbGlrZSAiYW5v bnltb3VzLmV4YW1wbGUuY29tIi4gU2luY2UgdGhlIHJldmlldyByZXF1ZXN0cyB0aGF0IHdlIGNp dGUgd2hlcmUgImFub255bW91cy5pbnZhbGlkIiBpcyBkb2N1bWVudGVkLCB0aGF0IHdvdWxkIGJl IFJGQzMzMjMuIFdoaWNoIGlzIGFscmVhZHkgY2l0ZWQgaGVyZS4gQXMgaXRzIGxhc3QgYml0IG9m IHdvcmRzbWl0aGluZywgdGhlIHJldmlldyBmaW5hbGx5IG9iamVjdHMgdG8gdGhlIHVzZSBvZiAi bGlrZSIgaW4gdGhlIGNvbnN0cnVjdGlvbiAidXNpbmcgZG9tYWlucyBsaWtlICdhbm9ueW1vdXMu aW52YWxpZCciLiAiaG93IGlzIG9uZSB0byB0ZWxsIHdoYXQgb3RoZXIgZG9tYWlucyBhcmUgJ2xp a2UgaXQ/IiBXZWxsLCB0aGUgaW1wb3J0YW50IHByb3BlcnR5IHN1Y2ggZG9tYWlucyB3b3VsZCBo YXZlIGlzIHRoYXQgdGhleSBoYXZlIGludmFsaWQgZG9tYWluIG5hbWVzLCBwcmVzdW1hYmx5ICh0 aG91Z2ggbm90IGV4Y2x1c2l2ZWx5KSBpbiB0aGUgLmludmFsaWQgVExELiBbJF0NCg0KLS0gMikg RG9jdW1lbnQgT3JnYW5pemF0aW9uICh3aGF0IGlzIGluIHRoZSBkb2N1bWVudCB3aGVyZSwgcmVk dW5kYW5jeSwgYW5kIHdoYXQgYmVsb25ncyBlbHNld2hlcmUpDQoNCjEgVGhlIHJldmlldzogIk1v dmUgZGVmaW5pdGlvbnMgdG8gYW4gZXhwbGljaXQgdGVybWlub2xvZ3kgc2VjdGlvbiwgcmF0aGVy IHRoYW4gcHV0dGluZyB0aGVtIGludG8gYW4gSW50cm9kdWN0aW9uLiIgQXQgYSBoaWdoIGxldmVs LCBJIGRvbid0IG9iamVjdCB0byB0aGUgZXhpc3RlbmNlIG9mIGEgdGVybWlub2xvZ3kgc2VjdGlv biwgYnV0IGFzLCB0byBteSBrbm93bGVkZ2UsIG9ubHkgdGhyZWUgdGVybXMgZGVmaW5lZCBoZXJl IC0gaWRlbnRpdHksIGF1dGggc2VydmljZSBhbmQgdmVyaWZpY2F0aW9uIHNlcnZpY2UgLSBJIGtp bmQgb2YgdGhpbmsgaXQncyBvdmVya2lsbC4gQWxzbywgYWxsIHRocmVlIG9mIHRob3NlIHRlcm1z IGluIHRoZWlyIGN1cnJlbnQgc2Vuc2UgY2Fycnkgb3ZlciBmcm9tIFJGQzQ0NzQsIHdoaWNoIG1h ZGUgaXQgdG8gUkZDIHdpdGhvdXQgYSB0ZXJtaW5vbG9neSBzZWN0aW9uLg0KDQoxIFRoZSByZXZp ZXcgcHJvcG9zZXMgdG8gbW92ZSB0aGUgbGFzdCBwYXJhZ3JhcGggb2YgdGhlIEludHJvIHRvIGEg Imhpc3RvcnkiIHNlY3Rpb24uIEJ1dCBpdCBiZWxvbmdzIHdoZXJlIGl0IGRvZXMgYmVjYXVzZSB0 aGlzIGlzIGFuIHVwZGF0ZSB0byBhIHByaW9yIFJGQywgYW5kIHRoZSByZWxhdGlvbnNoaXAgdG8g dGhhdCBSRkMgc2hvdWxkIGJlIGRlc2NyaWJlZCB1cCBmcm9udC4gSXQgYWxzbyBjb250YWlucyBz b21lIGltcG9ydGFudCBpbmZvIGFib3V0IHRoZSBvYmplY3RpdmVzIG9mIHRoZSByZXZpc2VkIG1l Y2hhbmlzbSwgaW5jbHVkaW5nIHJlZHVjaW5nIHNpZ25hdHVyZSBicmVha2FnZS4NCg0KMiBUaGUg cmV2aWV3IHByb3Bvc2VzIHRoYXQgdGhlIHNlY3Rpb24gY2FsbGVkICJCYWNrZ3JvdW5kIiBzaG91 bGQgcmVuYW1lZCBhbmQvb3Igc3BsaXQgaW50byBtdWx0aXBsZSBzZWN0aW9ucyBiZWNhdXNlIGl0 IGNvbnRhaW5zICJhIHN1bW1hcnkgZGVzY3JpcHRpb24gb2YgdGhlIG1lY2hhbmlzbSBiZWluZyBk ZWZpbmVkIGhlcmUuIiBXaGlsZSBJIGRvbid0IHRoaW5rIHRoaXMgY291bGQgcmVhbGlzdGljYWxs eSBnaXZlIHJpc2UgdG8gYW55IGNvbmZ1c2lvbiB0aGF0IHdvdWxkIGltcGFjdCBpbXBsZW1lbnRl cnMsIG9yIGltcHJvdmUgdGhlIHJlYWRhYmlsaXR5IG9mIHRoZSBzcGVjLCBpdCBpc24ndCBhIGNo YW5nZSBJJ2QgcnVsZSBvdXQuIEkgZG9uJ3Qgc2VlIGFueSBncmVhdCB1cmdlbmN5IHRvIGRvIGl0 LCBlaXRoZXIuDQoNCjMgSGVyZSB0aGUgcmV2aWV3IGludGVydmVuZXMgd2l0aCwgIk5vdGUgdGhh dCB0aGUgcHJlY2VkaW5nIGRpc2N1c3Npb24gbWFrZXMgbm8gbWVudGlvbiBvZiAnU0lQIFVSSScu IElmIG9uZSByZWFkcyBiYWNrIGFuZCBjb25uZWN0cyBzb21lIGRvdHMsIHRoZSByZWFkZXIgbWln aHQgZ3Vlc3MgdGhhdCB0aGUgYWxpY2VAIGRpc2N1c3Npb24gaXMgZm9yIGEgU0lQIFVSSSwgYnV0 IHRoZSB0ZXh0IHNob3VsZCBtYWtlIHRoaXMgZXhwbGljaXQuIiBCdXQgYWN0dWFsbHkgdGhlIHRl eHQgc2F5czoNCg0KICAgSWRlbnRpdGllcyBhcmUgaXNzdWVkIHRvIHVzZXJzIGJ5IGF1dGhvcml0 aWVzLiBXaGVuIGEgbmV3IHVzZXINCiAgIGJlY29tZXMgYXNzb2NpYXRlZCB3aXRoIGV4YW1wbGUu Y29tLCB0aGUgYWRtaW5pc3RyYXRvciBvZiB0aGUgU0lQDQogICBzZXJ2aWNlIGZvciB0aGF0IGRv bWFpbiBjYW4gaXNzdWUgdGhlbSBhbiBpZGVudGl0eSBpbiB0aGF0IG5hbWVzcGFjZSwNCiAgIHN1 Y2ggYXMgYWxpY2VAZXhhbXBsZS5jb20uIEFsaWNlIG1heSB0aGVuIHNlbmQgUkVHSVNURVIgcmVx dWVzdHMgdG8NCiAgIGV4YW1wbGUuY29tIHRoYXQgbWFrZSBoZXIgdXNlciBhZ2VudHMgZWxpZ2li bGUgdG8gcmVjZWl2ZSByZXF1ZXN0cw0KICAgZm9yIHNpcDphbGljZUBleGFtcGxlLmNvbS4NCg0K Li4uIHNvIGl0IHNheXMgc2lwOmFsaWNlQCwgbm90IG1lcmVseSBhbGljZUAsIGFuZCBpbiBmYWN0 IGEgc2VhcmNoIHdpbGwgc2hvdyB0aGF0IGV4YWN0IHN0cmluZyAiU0lQIFVSSSIgZG9lcyBhcHBl YXIgaW4gU2VjdGlvbiAzLiANCg0KMyAiSSBzdXNwZWN0IHRoZSBhYm92ZSBzZW50ZW5jZSBpcyBz ZXJpb3VzbHkgcmVkdW5kYW50LiBJZiBpdCBpc24ndCwgaXQgbmVlZHMgdG8gYmUgcXVpdGUgYSBi aXQgc29vbmVyLCBzaW5jZSBpdCBpcyBmdW5kYW1lbnRhbC4gQ2VydGFpbmx5IGl0IGlzIG5vdCAn YmFja2dyb3VuZCcuIiBUaGUgcmV2aWV3IGhlcmUgZG9lcyBub3QgbGlrZSB0aGUgcHJlc2VudGF0 aW9uIG9mIHRoaXMgbWF0ZXJpYWwgaW4gYSBzZWN0aW9uIGNhbGxlZCAiQmFja2dyb3VuZC4iIEl0 IGlzIGhhcmQgdG8gc2VlIGhvdyBtdWNoIHNvb25lciBpbiB0aGUgc3BlY2lmaWNhdGlvbiBzdGF0 ZW1lbnRzIGNhbiBiZSBtYWRlIHRoYW4gaGVyZS4NCg0KMyBBZnRlciBhIGNhc3VhbCBtZW50aW9u IG9mIFBBU1Nwb3JUIGhlcmUsIHRoZSByZXZpZXcgYXNrcywgIkFsc28sIHdoZXJlIGlzIHRoZSBv YmplY3Q/ICBIb3cgaXMgaXQgY3JlYXRlZD8gSG93IGlzIGl0IGNvbnZleWVkPyIgVGhpcyBpcyBh IHNlY3Rpb24gb24gYmFja2dyb3VuZCwgaXQgaXMgZG9lcyBub3QgZGV0YWlsIHRoZSBwcm90b2Nv bCdzIG9wZXJhdGlvbnMuIFRoaXMgcmV2aWV3IGlzIHZlcnkgY3JpdGljYWwgb2YgZm9yd2FyZCBy ZWZlcmVuY2VzLCBhbmQgeWV0IGVxdWFsbHkgY3JpdGljYWwgb2YgYW55IHNlY3Rpb24gdGhhdCBs YWNrcyB0aGVtLiBJbmZvcm1hdGlvbiBoYXMgdG8gYmUgY29tbXVuaWNhdGVkIGluIHNvbWUgb3Jk ZXIuIEdpdmluZyBhIGJpZyBwaWN0dXJlIHVwIGZyb250IHdpdGhvdXQgc3VjaCBkZXRhaWxzIGlz IGhlbHBmdWwuDQoNCjQgIk9uIHJlZmxlY3Rpb24sIHRoaXMgc2VjdGlvbiBpc24ndCBhbiAnb3Zl cnZpZXcnLiBJdCdzIGFuIGV4YW1wbGUgc2NlbmFyaW8uIFRoZSBlc3NlbnRpYWwgZGlmZmVyZW5j ZSBpcyB0aGF0IHRoaXMgbWFrZXMgc3BlY2lmaWMgY2hvaWNlcywgc3VjaCBhcyB1c2Ugb2YgYSBw cm94eSwgd2hpY2ggbWlnaHQgbm90IGFwcGx5IGluIHNvbWUgdmFsaWQgc2NlbmFyaW9zLiBBcyBz b21lIGludGVncmF0aXZlIHBlZGFnb2d5LCB0aGF0J3MgZmluZS4gU28gSSBzdWdnZXN0IHJlPWxh YmVsaW5nIHRoZSBzZWN0aW9uIHJhdGhlciB0aGFuIGNoYW5naW5nIGl0J3Mgc3Vic3RhbmNlLiIg VGhlICJvdmVydmlldyBvZiBvcGVyYXRpb24iIGhlcmUgZm9sbG93cyB0aGUgc2VjdGlvbiAgb2Yg dGhlIHNhbWUgbmFtZSwgd2hpY2ggYWxzbyBoYXBwZW5zIHRvIGJlIHNlY3Rpb24gNCwgaW4gUkZD MzI2MS4gT2theSwgdGhlIG5hbWUgb2YgdGhlIHNlY3Rpb24gdGhlcmUgaXMgc2luZ3VsYXIgYW5k IG5vdCBwbHVyYWwgLSBidXQgaXQgaXMgYWxzbyBiYXNpY2FsbHkgYSBjb25jcmV0ZSBleGFtcGxl Lg0KDQoqIFRoYXQgbXVjaCBzYWlkLCBJJ2QgYmUgd2lsbGluZyB0byBjaGFuZ2UgdGhlICJCYWNr Z3JvdW5kIiBzZWN0aW9uIHRvICJPdmVydmlldyIgYW5kIG1vdmUgdGhlICJPdmVydmlldyBvZiBP cGVyYXRpb25zIiBzZWN0aW9uIGludG8gYW4gImV4YW1wbGUiIHN1YnNlY3Rpb24gb2YgIk92ZXJ2 aWV3IiwgaWYgdGhhdCBoZWxwcy4gQWdhaW4sIEkgZG9uJ3QgdGhpbmsgaXQnbGwgaGVscCBtdWNo LCBpZiBhdCBhbGwsIGJ1dCBpdCdzIGVhc3kgdG8gZG8uDQoNCjQgVGhlIHNwZWMgbWVudGlvbnMg Y2Fub24gaW4gdGhpcyBvdmVydmlldyBvZiBvcGVyYXRpb24ocykgYW5kIHRoZSByZXZpZXcgY2Fs bHMgb3V0ICJ3aHk/IHdoZW4/IFRvc3NpbmcgaW4gdmFndWUgcmVmZXJlbmNlcyBhYm91dCBvcHRp b25hbCBiZWhhdmlvciB0aGF0IGlzIG5laXRoZXIgbW90aXZhdGVkIG5vciBleHBsYWluZWQgdXN1 YWxseSBwcm92ZXMgbW9yZSBvZiBhIGRpc3RyYWN0aW9uIHRoYW4gYSBoZWxwLCB3aGVuIHdyaXRp bmcgYW4gJ292ZXJ2aWV3JyBvciBhbiBleGFtcGxlLiIgV2VsbCwgSSBkaXNhZ3JlZS4gSGF2aW5n IGEgbm9uLW5vcm1hdGl2ZSBvdmVydmlldyBvZiBob3cgdGhlIG1lY2hhbmlzbSB3b3JrcyBpcyB2 YWx1YWJsZSBwcmVjaXNlbHkgYmVjYXVzZSBpdCBpcyBub3QgbXVkZGxlZCBieSB0aGUgbW90aXZh dGlvbiBvciB0aGUgc3BlY2lmaWNhdGlvbi4gDQoNCjUuMSAiZm9yd2FyZCByZWZlcmVuY2UuICBi ZXR0ZXIgdG8gcHV0IHRoYXQgbWF0ZXJpYWwgYmVmb3JlIHRoaXMuIiBUaGUgcmV2aWV3IGhlcmUg cmVmZXJzIHRvIHdoZXRoZXIgdGhlIGhlYWRlciBzeW50YXggKFNlY3Rpb24gOCkgc2hvdWxkIGdv IGJlZm9yZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGJlaGF2aW9yIChTZWN0aW9uIDUuMSkuIFRo ZXJlIGlzIG5vIGZyZWUgbHVuY2ggaGVyZTsgbmVpdGhlciBiZWxvbmdzIGJlZm9yZSB0aGUgb3Ro ZXIsIG9uZSB3aWxsIGhhdmUgdG8gcmVmZXIgdG8gdGhlIG90aGVyLiBXZSBjYW4ndCBkbyBldmVy eXRoaW5nIGF0IG9uZSB0aW1lLiBDb21wbGFpbnRzIGxpa2UgdGhpcyBhcmUgZWFzeSB0byBsb2Rn ZSwgYnV0IHRoYXQgZG9lc24ndCBtYWtlIHRoZW0gcGVyc3Vhc2l2ZS4NCg0KNS4xICJBbHNvLCB0 aGlzIHJlcXVpcmVtZW50IGZvciBhdXRoZW50aWNhdGlvbiBhcHBlYXJzIHRvIGJlIHJlZHVuZGFu dCB3aXRoIHRoZSBsYXRlciBzcGVjaWZpY2F0aW9uIGZvciBhdXRoZW50aWNhdGlvbiBpbiBTdGVw IDIuIiBUaGlzIHRleHQgaW4gdGhlIGludHJvZHVjdG9yeSBwYXJhZ3JhcGggc3RhdGVzLCBhcyBh IHByZXJlcXVpc3RlIGZvciBvcGVyYXRpb25zLCAiSW50ZXJtZWRpYXJpZXMgdGhhdCBpbnN0YW50 aWF0ZSB0aGlzIHJvbGUgTVVTVCBiZSBjYXBhYmxlIG9mIGF1dGhlbnRpY2F0aW5nIG9uZSBvciBt b3JlIFNJUCB1c2VycyB3aG8gY2FuIHJlZ2lzdGVyIGZvciB0aGF0IGlkZW50aXR5LiIgVGhlIHRl eHQgaW4gc3RlcCAyIHN0YXRlcyB0aGF0IGR1cmluZyBvcGVyYXRpb25zLCAiVGhlIGF1dGhlbnRp Y2F0aW9uIHNlcnZpY2UgTVVTVCB0aGVuIGRldGVybWluZSB3aGV0aGVyIG9yIG5vdCB0aGUgc2Vu ZGVyIG9mIHRoZSByZXF1ZXN0IGlzIGF1dGhvcml6ZWQgdG8gY2xhaW0gdGhlIGlkZW50aXR5IGdp dmVuIGluIHRoZSBpZGVudGl0eSBmaWVsZC4iIFRoZSBkaXN0aW5jdGlvbiBoZXJlIGlzIGJldHdl ZW4gc3RhdGluZyBhIHByZXJlcXVpc3RlIGZvciBhbnkgYWN0aXZpdHkgYW5kIHRoZW4gbWFuZGF0 aW5nIHBlcmZvcm1pbmcgdGhlIGFjdGl2aXR5IGFzIGEgY29tcG9uZW50IG9mIG5vcm1hdGl2ZSBt ZXNzYWdpbmcgcHJvY2Vzc2luZy4gSXQgaXMgbm90IHJlZHVuZGFudC4NCg0KNS4xIEFmdGVyICJB biBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGFkZHMgdGhlIElkZW50aXR5IGhlYWRlciB0byBTSVAg cmVxdWVzdHMsIiB0aGUgcmV2aWV3IHJlYWRzLCAiTm90ZSB0aGF0IHdlJ3ZlIHJlYWQgdGhpcyBi ZWZvcmUuICBTbyBJJ20gcmFpc2luZyBhIHJlZHVuZGFuY3kgZmxhZy4iIEkgZG9uJ3QgdGhpbmsg dGhlcmUgaXMgYW55IGhhcm0gaW4gYmVnaW5uaW5nIGEgcGFyYWdyYXBoIHRoYXQgZGVzY3JpYmVz IHRoZSBzdGVwcyB0YWtlbiB0byBhZGQgYW4gSWRlbnRpdHkgaGVhZGVyIHRvIGEgcmVxdWVzdCB3 aXRoIGEgdG9waWMgc2VudGVuY2UgdGhhdCBzdGF0ZXMgd2hhdCBhbiBhdXRoZW50aWNhdGlvbiBz ZXJ2aWNlIGRvZXMgYXQgYSBoaWdoIGxldmVsLg0KDQo1LjEgIkluIGFueSBldmVudCwgZG9uJ3Qg bWFrZSBmb3J3YXJkIHJlZmVyZW5jZXMgbGlrZSB0aGlzLiBQdXQgaXQgYWZ0ZXIgdGhlIHJlbGV2 YW50IGRldGFpbHMsIHNvIHRoYXQgdGhlcmUgYWxyZWFkeSBpcyBjb250ZXh0IGFuZCB0aGlzIGp1 c3QgZW5oYW5jZXMgaXQuLi4gRnJvbSB3aGF0IEkgY2FuIHRlbGwsIHRoaXMgZW50aXJlIHBhcmFn cmFwaCBzaG91bGQgYmUgbW92ZWQgdG93YXJkIHRoZSBlbmQgb2YgdGhpcyBzZWN0aW9uLiIgVGhp cyBpcyBqdXN0IGludHJvZHVjdG9yeSBtYXRlcmlhbCB0aGF0IHNldHMgdGhlIHN0YWdlIGZvciB0 aGUgc3RlcHMgdGhhdCB3aWxsIGZvbGxvdywgdGhlcmUgaXMgbm8gb3JkZXIgcHJvYmxlbSBoZXJl LiANCg0KNS4xICJUaGlzIGNhbm9uaWNhbGl6YXRpb24gdGV4dCBzZWVtcyBlbnRpcmVseSBvdXQg b2YgcGxhY2UsIGluIHRoZSBtaWRkbGUgb2Ygc3BlY2lmaWNhdGlvbiBhYm91dCBhdXRob3JpdHku IiBJdCBpcyBub3Qgb3V0IG9mIHBsYWNlIGluIHRoZSBwcm9jZXNzIHRoYXQgYXV0aGVudGljYXRp b24gc2VydmljZXMgbXVzdCBjb21wbGV0ZSwgaXQgaXMgZ2l2ZW4gYXQgZXhhY3RseSB0aGUgcG9p bnQgd2hlcmUgaXQgbmVlZHMgdG8gaGFwcGVuLiBCZWZvcmUgeW91IGNhbiBhc2NlcnRhaW4gd2hl dGhlciBvciBub3QgeW91IGFyZSBhdXRob3JpdGF0aXZlIGZvciBhbiBpZGVudGl0eSwgeW91IG5l ZWQgdG8gaGF2ZSB0aGUgaWRlbnRpdHkgaW4gYSBjYW5vbmljYWwgZm9ybS4NCg0KNS4xIFJlZ2Fy ZGluZyBhZGRpbmcgYSBEYXRlIGhlYWRlciwgIldoeT8gKFByb2JhYmx5IG9ubHkgbmVlZCB0byBj aXRlIHRoZSBlYXJsaWVyIGRpc2N1c3Npb24gYWJvdXQgaXRzIHVzZSBmb3IgcmVwbGF5IG1pdGln YXRpb24uIEJ1dCBtZXJlbHkgY2l0ZTsgZG9uJ3QgZHVwbGljYXRlLikiIFRoZSBlbmQgb2YgdGhp cyBzdGVwIHJlYWRzICJTZWUgU2VjdGlvbiAxMiBmb3IgaW5mb3JtYXRpb24gb24gaG93IHRoZSBE YXRlIGhlYWRlciBmaWVsZCBhc3Npc3RzIHZlcmlmaWVycy4iIFRoYXQgYW5zd2VycyAid2h5PyIg SXQgd291bGQgYmUgbmljZSBpZiB0aGUgbGluZS1ieS1saW5lIHJldmlldyBoZXJlIGNvdWxkIGtl ZXAgc3RhdGUgZm9yIGhhbGYgYSBtaW51dGUgYW5kIGdvIGJhY2sgYW5kIHJlbW92ZSBjb21tZW50 cyB3aGVuIHRoZXkgYXJlIGFuc3dlcmVkIGltbWVkaWF0ZWx5IGFmdGVyd2FyZHMuIFskXQ0KDQo1 LjEgIklzbid0IHRoaXMgdGV4dCByZXBlYXRpbmcgc3BlY2lmaWNhdGlvbiB0ZXh0IHRoYXQgaXMg ZWxzZXdoZXJlIGluIHRoZSBkb2N1bWVudD8gSWYgc28sIHJlbW92ZSBpdC4iIFRoaXMgcmVmZXJz IHRvIHRoZSBwcmVzZW5jZSBvZiB0aGUgInBwdCIgbWVjaGFuaXNtIGluIHRoZSBub3JtYXRpdmUg YmVoYXZpb3Igc3RlcHMgZm9yIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlLCBhbmQgaW5kZWVk IHRoZSBzZW50ZW5jZSBjb250YWluaW5nIHRoaXMgZ3VpZGFuY2Ugc2F5cyAiKHNlZSBTZWN0aW9u IDkpIiBhdCBlbmQgb2YgaXQuIEl0IGlzIHJlZmVycmluZyB0byBzcGVjaWZpY2F0aW9uIHRleHQg ZWxzZXdoZXJlIGluIHRoZSBkb2N1bWVudCwgYnV0IGhlcmUgaW4gdGhlc2Ugc3RlcHMsIHdlIGRv IGdpdmUgc29tZSBoaWdoIGxldmVsIG5vdGlvbiBvZiB3aGF0IHlvdSdyZSBzdXBwb3NlZCB0byBk byBpbiBhZGRpdGlvbiB0byBnaXZpbmcgYSBwb2ludGVyIHRvIHdoZXJlIHRoZSBiZWhhdmlvciBp cyBmdWxseSBkZXRhaWxlZC4gDQoNCjUuMSAiYW5vdGhlciBmb3J3YXJkIHJlZmVyZW5jZSwgdGhp cyB0aW1lIHdpdGhvdXQgZXZlbiBhIHNwZWNpZmljIHBvaW50ZXIuIiBPbmNlIGFnYWluLCBhIGxp bmUtYnktbGluZSByZXZpZXcgbmVlZHMgdG8gYmUgYWJsZSB0byByZWFkIGxpdGVyYWxseSB0aGUg bmV4dCBzZW50ZW5jZSwgd2hpY2ggY29udGFpbnMgdGhlICJzcGVjaWZpYyBwb2ludGVyIiB0byBT ZWN0aW9uIDguIFskXQ0KDQo1LjIgVGhpcyBzZWN0aW9uLCBjYWxsZWQsICJWZXJpZmllciBCZWhh dmlvciIsIGJlZ2lucyB3aXRoIHRoZSBzZW50ZW5jZSAiVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMg YSBsb2dpY2FsIHJvbGUgZm9yIFNJUCBlbnRpdGllcyBjYWxsZWQgYSB2ZXJpZmljYXRpb24gc2Vy dmljZSwgb3IgdmVyaWZpZXIuIiBUaGUgcmV2aWV3IGludGVycnVwdHMgdGhlIHNlbnRlbmNlIGhh bGZ3YXkgdGhyb3VnaCB3aXRoICJyZWR1bmRhbnQgZGV0YWlsLiIgSSBkb24ndCB0aGluayBhIGhp Z2gtbGV2ZWwgaW50cm9kdWN0b3J5IHN0YXRlbWVudCBjb3VudHMgYXMgImRldGFpbCIuIElzIGl0 IHJlZHVuZGFudCB0byBiZWdpbiBhIHNlY3Rpb24gb24gIlZlcmlmaWVyIEJlaGF2aW9yIiB3aXRo IGEgc2VudGVuY2UgbWFraW5nIGl0IGNsZWFyIHRoYXQgd2UncmUgbm93IGludG8gdGhlbiBidXNp bmVzcyBvZiBkZWZpbmluZyB0aGUgbG9naWNhbCByb2xlIG9mIHRoZSB2ZXJpZmllciwgb3IgaXMg aXQgc2ltcGx5IHNldHRpbmcgdGhlIHN0YWdlIGZvciBwZW9wbGUgd2hvIGhhcHBlbiB0byBza2lw IHRvIHRoZSB0b3Agb2YgdGhhdCBzZWN0aW9uIGFuZCBzdGFydCByZWFkaW5nPyBJIGRvbid0IHNl ZSBhIG5lZWQgZm9yIGFueSBjaGFuZ2UgdGhlcmUsIGFueSBtb3JlIHRoYW4gSSBkbyBhdCB0aGUg c3RhcnQgb2YgU2VjdGlvbiA0LCB3aGljaCBpcyB0aXRsZWQgIk92ZXJ2aWV3IG9mIE9wZXJhdGlv bnMiIGFuZCBiZWdpbnMgd2l0aCB0aGUgc2VudGVuY2UgIlRoaXMgc2VjdGlvbiBwcm92aWRlcyBh biBpbmZvcm1hdGl2ZSAobm9uLW5vcm1hdGl2ZSkgaGlnaC1sZXZlbCBvdmVydmlldyBvZiB0aGUg bWVjaGFuaXNtcyBkZXNjcmliZWQgaW4gdGhpcyBkb2N1bWVudC4iIE9yIHRoYXQgdGhlIHNlY3Rp b24gdGl0bGVkLCAiQ2hhbmdlcyBmcm9tIFJGQzQ0NzQiIGhhcyBhIHN0YXJ0aW5nIHNlbnRlbmNl IHRoYXQgcmVhZHMgInRoZSBmb2xsb3dpbmcgYXJlIHRoZSBzYWxpZW50IGNoYW5nZXMgZnJvbSB0 aGUgb3JpZ2luYWwgUkZDNDQ3NC4iIFRoaXMgaXMgbm9ybWFsIHNwZWNtYW5zaGlwLCBhbmQgaGFy ZGx5IGEgbWF0dGVyIHRoYXQgd2FycmFudHMgYmVpbmcgZmxhZ2dlZCBpbiBhIHJldmlldy4NCg0K NS4yIE9uIFN0ZXAgMiwgdGhlIHJldmlldyBub3RlcyB0aGF0IHRoZSBiZWhhdmlvciBmb3Jrczog aWYgeW91J3JlIGRlYWxpbmcgd2l0aCB0ZWxlcGhvbmUgbnVtYmVycywgeW91IGRvIHRoZSBiZWhh dmlvciBpbiA3LjIsIGJ1dCBpZiB5b3UncmUgZGVhbGluZyB3aXRoIGRvbWFpbiBuYW1lcywgeW91 IGRvIHRoZSBiZWhhdmlvciBpbiA3LjMuIFNvIGl0IGFza3MgIlRob3NlIHR3byBmdW5jdGlvbnMg YXJlIHdpbGRseSBkaWZmZXJlbnQuIFdoeSBhcmUgdGhleSBwYXJ0IG9mIHRoZSBzYW1lIHByb2Nl c3M/IiBUaGUgYW5zd2VyIGlzIHRoYXQgeW91J3JlIGdvaW5nIHRvIGRvIGVpdGhlciBvbmUgb3Ig dGhlIG90aGVyLCBidXQgbm90IGJvdGgsIGJldHdlZW4gU3RlcCAxIGFuZCBTdGVwIDMuIFllcywg dGVsZXBob25lIG51bWJlcnMgYW5kIGRvbWFpbiBuYW1lcyBhcmUgZGlmZmVyZW50LCBidXQgZGVh bGluZyB3aXRoIG9uZSBvciB0aGUgb3RoZXIgaXMgd2hhdCB5b3UgZG8gYXQgdGhpcyBzdGFnZSBv ZiB0aGUgcHJvY2VzczogaXQgaXMgdGhlIHNhbWUgcHJvY2VzcyBvdGhlcndpc2UuIEkgY2FuJ3Qg c2VlIGFueSBvdGhlciB1c2VmdWwgd2F5IHRvIG9yZ2FuaXplIG9yIHNwZWNpZnkgdGhpcyBiZWhh dmlvci4gSSBhbHNvIGRvbid0IHNlZSB3aGF0IHBvc3NpYmxlIHByb2JsZW0gc29tZW9uZSBtaWdo dCBoYXZlIHdpdGggdGhpcy4gIldoeT8iIHF1ZXN0aW9ucyBsaWtlIHRoaXMgYWJvdXQgc3BlYyBv cmdhbml6YXRpb24gYXJlIHZlcnkgZWFzeSB0byBhc2ssIHRha2UgYSBsb3Qgb2YgdGhvdWdodCB0 byBhbnN3ZXIsIGFuZCB1bHRpbWF0ZWx5IGhhdmUgbm8gaW1wYWN0IG9uIHRoZSB0ZWNobm9sb2d5 IHdlIGFyZSBzcGVjaWZ5aW5nIGhlcmUuDQoNCjUuMiBPbiBTdGVwIDQsIHRoZSByZXZpZXcgY29t cGxhaW5zLCAiVGhlcmUgd2FzIGVhcmxpZXIgZGlzY3Vzc2lvbiBvZiB1c2luZyBhIGRhdGUgd2lu ZG93IHZhbGlkYXRpb24gdG8gbWl0aWdhdGUgYWdhaW5zdCBzb21lIGF0dGFja3MuIFRoZXJlIGRv ZXNuJ3QgbmVlZCB0byBiZSB5ZXQtYW5vdGhlciByZWZlcmVuY2UgaGVyZS4gSnVzdCBjaXRlIHRo ZSBlYXJsaWVyIGRpc2N1c3Npb24uIiBXZWxsLCB0aGVyZSB3YXMgYW4gZWFybGllciBkaXNjdXNz aW9uIG9mIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgYmVoYXZpb3IuIFRoaXMgaXMgYSBkaXNjdXNz aW9uIG9mIHZlcmlmaWNhdGlvbiBzZXJ2aWNlIGJlaGF2aW9yLiBUaGV5IGFyZW4ndCB0aGUgc2Ft ZSBkaXNjdXNzaW9uLiBUaGluZ3MgdGhhdCB0aGUgcmV2aWV3IGZsYWdnZWQgYXMgbWlzc2luZyBm cm9tIHRoYXQgcGFydCBhcmUgcHJlc2VudCBoZXJlLCBiZWNhdXNlIHdlIGFyZSBkZXNjcmliaW5n IHRoZSBiZWhhdmlvciBvZiBhIGRpZmZlcmVudCBjb21wb25lbnQgb2YgdGhlIGFyY2hpdGVjdHVy ZS4NCg0KNS4yIE9uIFN0ZXAgNSwgdGhlIHJldmlldyBwcm9wb3NlcyAiYnJlYWtpbmcgdGhpcyBz dGVwIGludG8gdHdvIHBhcnRzOiBzaWduYXR1cmUgcmVnZW5lcmF0aW9uIGFuZCBzaWduYXR1cmUg dmFsaWRhdGlvbi4iIFdoZXRoZXIgd2UgY29uc2lkZXIgdGhlIHByb2Nlc3Mgb2YgZ2VuZXJhdGlu ZyBhbmQgdmFsaWRhdGluZyB0aGUgc2lnbmF0dXJlIHRvIGJlIG9uZSBzdGVwIG9yIHR3byBzZWVt cyBsaWtlIGEgdmVyeSBtaW5vciBxdWVzdGlvbiB0byBtZTogdGhlcmUncyBubyBhbWJpZ3VpdHkg dGhhdCB5b3UgZ2VuZXJhdGUgYW5kIHRoZW4gdmFsaWRhdGUsIHJlZ2FyZGxlc3Mgb2Ygd2hldGhl ciBmcm9tIGFuIG9yZ2FuaXphdGlvbmFsIHBlcnNwZWN0aXZlIHdlIGNhbGwgdGhhdCBvbmUgc3Rl cCBvciB0d28uIExvdHMgb2YgdGhlIG90aGVyIHN0ZXBzIGFyZSBhbHNvIGNvbXBvc2VkIG9mIG11 bHRpcGxlIGRpc2NyZXRlIGFuZCBzZXBhcmFibGUgYWN0aW9ucy4gT24gbWF0dGVycyB0aGlzIHNt YWxsIGl0J3MgaGFyZCB0byBqdXN0aWZ5IGNoYW5naW5nIGl0IG9yIGtlZXBpbmcgaXQuIChGb3Ig dGhlIHRlY2huaWNhbCBxdWVzdGlvbiBwb3NlZCBpbiB0aGlzIHNhbWUgaW50ZXJqZWN0aW9uLCBz ZWUgdGhlIHRlY2huaWNhbCByZXNwb25zZXMgYmVsb3cpLg0KDQoqIDUuMiBwb3N0IFN0ZXAgNSwg Ikkgc3VzcGVjdCB0aGUgYWJvdmUgcGFyYWdyYXBoIGJlbG9uZ3MgZWxzZXdoZXJlIGFuZCBzb29u ZXIuIEl0IGlzbid0IHBhcnQgb2YgdGhlIHN0ZXAgc2VxdWVuY2UuIiBUaGlzIHRleHQgaXMgZ2l2 aW5nIGd1aWRhbmNlIG9uIHdoYXQgaGFwcGVucyBhdCB0aGUgZW5kIG9mIHRoaXMgcHJvY2Vzcy4g SSBkaXNhZ3JlZSB0aGF0IGl0IGJlbG9uZ3MgZWFybGllciwgYnV0IEkgY2FuIHNlZSB0aGF0IGl0 IGlzbid0IGEgcGFydCBvZiBTdGVwIDUgYXMgc3VjaC4gTWF5YmUgSSdsbCBwdXQgaW4gc29tZSBj bGVhciBkaXZpZGVyIHRvIGluZGljYXRlIHdoZXJlIFN0ZXAgNSBlbmRzLg0KDQo1LjIuMSBUaGUg cmV2aWV3IGludGVycnVwdHMgdGhlIGZpcnN0IHNlbnRlbmNlIG1lbnRpb24gdGhhdCB0aGUgJ2Nh bm9uJyBwYXJhbWV0ZXIgImNvbnRhaW5zIGEgYmFzZTY0IGVuY29kaW5nIG9mIHRoZSBoZWFkZXIg YW5kIGNsYWltIGNvbXBvbmVudCIgb2YgYSBQQVNTcG9yVCBvYmplY3QuICJUaGlzIGFwcGVhcnMg dG8gYmUgYSByZS1zcGVjaWZpY2F0aW9uIG9mIGNhbm9uLCIgdGhlIHJldmlldyBzYXlzLiAiRG9u J3QgZG8gdGhhdC4gQ2l0ZSBpdHMgc3BlYyBhbmQgdGhlIHNpbXBseSB1c2UgaXQuIiBJIGRvIG5v dCBmZWVsIHRoYXQgbWVudGlvbmluZyB0aGUgZmFjdCB0aGF0ICdjYW5vbicgY29udGFpbnMgYSBi YXNlNjQgZW5jb2Rpbmcgb2YgdGhlIFBBU1Nwb3JUIGhlYWRlciBhbmQgY2xhaW1zIGlzIGluIGFu eSBtZWFuaW5nZnVsIHNlbnNlIGEgInJlLXNwZWNpZmljYXRpb24iIG9mIGNhbm9uLiBBIHJlc3Bl Y2lmaWNhdGlvbiB3b3VsZCBzYXksIGxpa2UsIHdoYXQgdGhvc2UgaGVhZGVycyBhbmQgY2xhaW1z IGFyZSBhbmQgaG93IHlvdSBidWlsZCB0aGVtLiBQcm92aWRpbmcgYmFzaWMgYW5kIGVzc2VudGlh bCBoaWdoLWxldmVsIGNvbnRleHQgaXMgbm90IGEgcmVwcmltYW5kLXdvcnRoeSBvZmZlbnNlLiAg DQoNCjUuMi4xICJUaGlzIGlzIHRoZSB3cm9uZyBwbGFjZSB0byBzdGF0ZSB3aGF0IGNhbm9uIGlz IGZvci4iIEkgdGhpbmsgdGhpcyBpcyBhIGdvb2QgcGxhY2UgdG8gc2F5IHdoYXQgY2Fub24gaXMg Zm9yOyBpdCBpcyB0aGUgImNhbm9uIiBzZWN0aW9uLCB0aGUgb25seSBvbmUgZGVkaWNhdGVkIHRv IGl0IGluIHRoZSBkb2N1bWVudC4gUHJldmlvdXNseSwgNS4xIHNhaWQgdGhhdCAiVGhlIGluZm9y bWF0aW9uIGluICJjYW5vbiIgaXMgdXNlZnVsIG9uIHRoZSB2ZXJpZmljYXRpb24gc2lkZSBmb3Ig ZGVidWdnaW5nIGVycm9ycywiIGFuZCBoZXJlIGluIHRoZSB2ZXJpZmljYXRpb24gc2lkZSBpdCBt YWtlcyBzZW5zZSB0byBzdGF0ZSB3aGF0IHVzZSB0aGVyZSBpcyB0byBiZSBtYWRlIG9mIGl0LiBH aXZlbiB0aGUgd2F5IHRoZSBzcGVjIGlzIG9yZ2FuaXplZCBub3csIHB1dHRpbmcgYSBzdGF0ZW1l bnQgdG8gdGhpcyBlZmZlY3QgaGVyZSBtYWtlcyBtb3JlIHNlbnNlIHRoYW4gcGxhY2luZyB0aGlz IGFueXdoZXJlIGluIHNlY3Rpb24gNywgc2F5LCBzaW5jZSB0aGF0IHJlYWxseSBvbmx5IGRlYWxz IHdpdGggY2Fub25pY2FsaXppbmcgdGhlIGlkZW50aWZpZXJzLiANCg0KNi4xIFRoZSBzcGVjIGhl cmUgY29uZmVzc2VzIHRoYXQgInRoZSB3YXkgdGhhdCB0aGUgc2NvcGUgb2YgYSBjcmVkZW50aWFs IGlzIGV4cHJlc3NlZCBpcyBzcGVjaWZpYyB0byB0aGUgY3JlZGVudGlhbCBtZWNoYW5pc20uIiBU aGUgcmV2aWV3IHRodXMgbm90ZXMgIlNvLCB0aGVyZSBpcyBubyBzdGFuZGFyZCBmb3IgdGhlIHNw ZWNpZmljYXRpb24gb2YgY3JlZGVudGlhbHMsIGhlcmUuIFRoYXQgbWVhbnMgdGhhdCB0aGUgdGVj aG5pY2FsIGRldGFpbHMgLS0gYXMgZGlzdGluY3QgZnJvbSB0aGUgb3BlcmF0aW9uYWwgcG9saWNp ZXMgLS0gb2YgY3JlZGVudGlhbHMgYXJlIG91dCBvZiBzY29wZSwgYWx0aG91Z2ggdGhleSBhcmUg ZnVuZGFtZW50YWwgdG8gcHJvcGVyIG9wZXJhdGlvbiBvZiB0aGlzIHNlcnZlLiBUaGlzIGlzIGEg c2hvd3N0b3BwZXIsIGluIHRlcm1zIG9mIHNwZWNpZmljYXRpb24gY29tcGxldGVuZXNzIGZvciB0 aGUgc2VydmljZS4iIEl0IHdvdWxkIGJlLCB3aGljaCBpcyB3aHkgd2UgaGF2ZSBhIHN0aXItY2Vy dHMgc3BlY2lmaWNhdGlvbiB0aGF0IGdpdmVzIGEgY3JlZGVudGlhbCBzeXN0ZW0gdGhhdCB3ZSBp bnRlbmQgdG8gdXNlIGZvciBpbml0aWFsIGltcGxlbWVudGF0aW9uLiBSRkM0NDc0YmlzIGlzIHBy ZXR0eSBjbGVhciB0aGF0IHRoZSBhZ2dyZWdhdGUgb2YgaXQsIHN0aXItcGFzc3BvcnQsIGFuZCBz dGlyLWNlcnRzIGlzIHJlcXVpcmVkIGZvciBpbXBsZW1lbnRhdGlvbi4gSGlzdG9yaWNhbGx5LCB0 aG9zZSB0d28gc3BlY2lmaWNhdGlvbnMgZWZmZWN0aXZlbHkgc3BsaXQgb3V0IG9mIFJGQzQ0NzRi aXMgKHRob3VnaCBzdGlyLXBhc3Nwb3J0IGZpcnN0IG1lcmdlZCBpbiBmcm9tIHRoZSB2ZXJpZmll ZC10b2tlbiBkcmFmdCwgaXQgdGhlbiBtZXJnZWQgb3V0IGFnYWluKS4NCg0KNi4yIFRoZSBzcGVj IG5vdGVzIHRoYXQgc29tZXRoaW5nIGlzICJkZXNjcmliZWQgaW4gdGhlIG5leHQgc2VjdGlvbiIg YW5kIHRodXMgaXMgcmVwcmltYW5kZWQgd2l0aCBhICJmb3J3YXJkIHJlZmVyZW5jZSIgc2xhcCBv biB0aGUgd3Jpc3QgaGVyZSBieSB0aGUgcmV2aWV3LiBJIGRvbid0IHRoaW5rIGEgcGFyZW50aGV0 aWNhbCBtZW50aW9uIHRoYXQgdGhlICJpbmZvIiBwYXJhbWV0ZXIgaXMgZGVzY3JpYmVkIGluIHRo ZSBuZXh0IHNlY3Rpb24gaGFybXMgdGhlIGNvbXByZWhlbnNpYmlsaXR5IG9mIHRoZSBkb2N1bWVu dCBpbiBhbnkgd2F5Lg0KDQo2LjMgVGhlIHJldmlldyBoZXJlIG5vdGVzIHRoYXQgInRoZXNlIGFy ZSBtb3JlIGZvcndhcmQgcmVmZXJlbmNlcy4gSW4gdGhpcyBjYXNlLCBpdCdzIGdpdmluZyBkZXRh aWwgYWJvdXQgc29tZXRoaW5nIHRoYXQgaGFzbid0IGV2ZW4gYmVlbiBkZWZpbmVkIHlldC4iIEkn bSBub3QgYXdhcmUgdGhlcmUgYXJlIGFueSBmb3J3YXJkIHJlZmVyZW5jZXMgaW4gNi4zLg0KDQo2 LjQgVGhlIHN1Z2dlc3Rpb24gaW4gdGhlIHJldmlldyBoZXJlIGlzICJyZW1vdmluZyB0aGUgc2Vj dGlvbiBhbmQgc2ltcGx5IHN0YXRlIHRoYXQgdGhlIGRldGFpbHMgb2YgdGhlIGNyZWRlbnRpYWxp bmcgc3lzdGVtIGFyZSBvdXRzaWRlIHRoZSBzY29wZSBvZiB0aGlzIHNwZWNpZmljYXRpb24uIiBX aGlsZSB0aGlzIHNlY3Rpb24gc2F5cyBsaXR0bGUsIHRoZSBsaXR0bGUgaXQgZG9lcyBzYXkgY29u c3RyYWlucyBleHRlcm5hbCBjcmVkZW50aWFsIHN5c3RlbXMgZW5vdWdoIHRoYXQgaXQgaXMgd29y dGggcmV0YWluaW5nLiBUaGUgcmVxdWlyZW1lbnRzIGhlcmUgYXJlLCBmb3IgZXhhbXBsZSwgZGlz Y3Vzc2VkIGluIHRoZSBzdGlyLWNlcnRzIGRvY3VtZW50LiBUaGUgcmV2aWV3IHJpZ2h0bHkgbm90 ZXMgdGhhdCAidGhlIGVudGlyZSB0b3BpYyBhcHBlYXJzIHRvIGJlIGxhcmdlciB0aGFuIHRoaXMg c3BlY2lmaWNhdGlvbiwiIGFuZCB0aGlzIHNwZWNpZmljYXRpb24gZG9lc24ndCBzdWdnZXN0IG90 aGVyd2lzZS4gDQoNCjYuNCBUaGUgcmV2aWV3IGhlcmUgcHJvcG9zZXMgdGhlIHRleHQgIlVzZSBv ZiBhIGNyZWRlbnRpYWxpbmcgbWVjaGFuaXNtIG11c3QgYmUgc3VwcG9ydGVkIHdpdGhpbiBhIHNj b3BlIHN1ZmZpY2llbnQgdG8gaW5jbHVkZSB0aGUgYXV0aGVudGljYXRpb24gc2VydmljZSwgdGhl IHZlcmlmeWluZyBzZXJ2aWNlIGFuZCB0aGUgY3JlZGVudGlhbGluZyBzZXJ2aWNlIiBhcyBhIHN1 YnN0aXR1dGUgZm9yIHRoZSBleGlzdGluZyB0ZXh0LCB3aGljaCByZWZlcnMgdG8gdGhlIGNsYXNz aWMgU0lQICJ1bmFudGljaXBhdGVkIHJlc3BvbmRlbnQiIHByb2JsZW0gdGhhdCAiU0lQIGVudGl0 aWVzIGNhbm5vdCByZWxpYWJseSBwcmVkaWN0IHdoZXJlIFNJUCByZXF1ZXN0cyB3aWxsIHRlcm1p bmF0ZS4iIEkgdGhpbmsgdGhlIGV4aXN0aW5nIHRleHQgaXMgbXVjaCBtb3JlIHNwZWNpZmljIHRo YW4gdGhlIHByb3Bvc2VkIGVkaXQsIGFuZCB3aGlsZSB0aGUgZWRpdCBtYXkgYmUgbW9yZSBjb25j aXNlLCBpdCBkb2VzIG5vdCBhdHRlc3QgdGhlIHBvc3NpYmlsaXR5IHRoYXQgImJ1c2luZXNzIGFy cmFuZ2VtZW50cyBvciBzaW1pbGFyIGNvbnN0cmFpbnRzIiBtYXkgYmUgcmVxdWlyZWQgdG8gZW5m b3JjZSBhIHRydXN0IGFuY2hvciBpbiBzb21lIGRlcGxveW1lbnRzLiANCg0KNyBUaGUgcmV2aWV3 IGNvbXBsYWlucyB0aGF0IHJmYzQ0NzRiaXMtMTAgbWlzY2hhcmFjdGVyaXplcyBpdHNlbGYgd2hl biBpdCBzYXlzIHRoYXQgaXQgImZvY3VzZXMgcHJpbWFyaWx5IiBvbiB0ZWxlcGhvbmUgbnVtYmVy cywgcmF0aGVyIHRoYW4gIlVSSSBmb3Jtcy4iIFNUSVIgaXRzZWxmIHByaW1hcmlseSBmb2N1c2Vz IG9uIHRlbGVwaG9uZSBudW1iZXJzIGFuZCB0aGUgcHJvYmxlbXMgb2YgaW1wZXJzb25hdGlvbiBy ZWxhdGVkIHRvIHRoZW0uIFdlIHdlbnQgYmFjayBhbmQgZm9ydGggb24gdGhlIGNoYXJ0ZXIgYWJv dXQgd2hldGhlciB0byBldmVuIGFsbG93IHRoaXMgc3BlYyB0byBjb3ZlciByZWd1bGFyIFNJUCBV UklzIGFzIHdlbGwuIFVsdGltYXRlbHksIGl0IGRvZXMsIHRob3VnaCB0aGV5IGhhdmUgYmVlbiBz ZWNvbmQtY2xhc3MgY2l0aXplbnMgdGhyb3VnaG91dCB0aGUgc3BlYydzIGRldmVsb3BtZW50LiBU aGUgcmVjZW50IHJlc3RydWN0dXJpbmcgb2YgU2VjdGlvbiA3IGFuZCB0aGUgaW50cm9kdWN0aW9u IG9mIHRoZSBVUkkgbm9ybWFsaXphdGlvbiBzZWN0aW9uIHdlcmUgaW50ZW5kZWQgdG8gcmVjdGlm eSB0aGF0IGEgYml0LiBTbyBwZXJoYXBzIGl0IGlzbid0IGFzIHRydWUgYW55bW9yZS4gQnV0IGlu IHRlcm1zIG9mIFNUSVIncyBvdmVyYWxsIGdvYWwsIHRlbGVwaG9uZSBudW1iZXJzIGFyZSBkZWZp bml0ZWx5IHRoZSBwcmltYXJ5IGZvY3VzLg0KDQo3IFRoZSByZXZpZXcgaGVyZSBpcyBjb25jZXJu ZWQgYWJvdXQgdGhlIHVzZSBvZiB0aGUgdGVybSAiZ3JlZW5maWVsZCIgZm9yIFNJUCBVUklzIHRo YXQgZG8gbm90IGNvbnRhaW4gdGVsZXBob25lIG51bWJlcnMsIGNvbnRyYXN0aW5nIHdpdGggdGhl IGxlZ2FjeSB0ZWxlcGhvbmUgbnVtYmVyIGlkZW50aWZpZXIuIEV2ZW4gaW4gdGhlIHNwZWMsICJn cmVlbmZpZWxkIiBpcyBnaXZlbiBpbiBxdW90ZXMgdG8gc2V0IGl0IGFwYXJ0LiBXaGlsZSBpdCdz IHRydWUgdGhhdCB0aGUgdGVybSBkb2VzIG5vdCBhcHBlYXIgZWxzZXdoZXJlIGluIHRoZSBzcGVj aWZpY2F0aW9uLCBhbmQgY291bGQgYmUgZGlzY2FyZGVkIHdpdGhvdXQgZG9pbmcgYW55IGhhcm0g dG8gcmVhZGFiaWxpdHksIGl0cyBwcmVzZW5jZSBkb2VzIG5vdCBzdHJpa2UgbWUgYXMgYSBwcm9i bGVtIGVpdGhlci4NCg0KNyBUaGUgc3BlYyBoZXJlIHJlZmVycyB0byAiVGhlIGd1aWRhbmNlIGlu IHRoaXMgc2VjdGlvbiwiIGFuZCB0aGUgcmV2aWV3IGNvdW50ZXJzICJndWlkYW5jZSB2cy4gc3Bl Y2lmaWNhdGlvbj8iIEkgdGhpbmsgdGhlIHRlcm0gImd1aWRhbmNlIiBpcyBhZGVxdWF0ZSBhbmQg bm90IGFtYmlndW91cy4NCg0KNy4xICJJZiB0aGV5IGFyZSBvdXRzaWRlIHRoZSBzY29wZSwgdGhl biBkb24ndCBwcm92aWRlIGRldGFpbHMgc3VjaCBhcyBhYm91dCBlbnJvbGxpbmcuIEF0IHRoZSBs ZWFzdCwgZG9uJ3QgcmVwZWF0IGluZm9ybWF0aW9uIHByb3ZpZGVkIGVsc2V3aGVyZSBpbiB0aGUg ZG9jdW1lbnQuIiBUaGlzIGlzIGEgY29tbWVudCBvbiBhIHR3by1zZW50ZW5jZSwgb25lIHBhcmFn cmFwaCBzZWN0aW9uIHdoaWNoIGV4aXN0cyB0byBnaXZlIGFuIGV4dGVybmFsIHBvaW50ZXIgdG8g c3Rpci1jZXJ0cy4gSXQgc2F5cyB0aGF0IHRoaXMgc3R1ZmYgaXMgIm91dHNpZGUgdGhlIHNjb3Bl IG9mIHRoZSBkb2N1bWVudC4iIFRoZXJlIGFyZSBubyAiZGV0YWlscyIgYWJvdXQgZW5yb2xsaW5n IGluIHRoaXMgc2VjdGlvbiwgbm9yIGRvZXMgaXQgcmVwZWF0IGluZm9ybWF0aW9uIHByb3ZpZGVk IGluIDYuNCAtIGl0IG9ubHkgbWVudGlvbnMgdGhhdCB0aGVyZSBpcyBpbmZvcm1hdGlvbiBpbiA2 LjQuIFRoaXMgcmV2aWV3IGNvbW1lbnQgZG9lcyBub3QgZXZlbiBpZGVudGlmeSBhbnkgcmVhbCBp c3N1ZS4NCg0KNy4zIFRoZSByZXZpZXcgaGVyZSBwcm9wb3NlcyBmb3IgdGhpcyBzZWN0aW9uICJz cGxpdHRpbmcgdGhlIGRpc2N1c3Npb24gdG8gYW4gZWFybGllciwgbm9uLW5vcm1hdGl2ZSBzZWN0 aW9uLCBhbmQgYSBzZWN0aW9uIGhlcmUgdGhhdCBzaW1wbHkgc3BlY2lmaWVzIHRlY2huaWNhbCBk ZXRhaWwgdG8gcGVyZm9ybS4iIFNvdW5kcyBsaWtlIHRoYXQgd291bGQgdGFrZSBzb21lIHdvcmss IGJ1dCB0aGUgYmVuZWZpdCBvZiB0aGF0IHNwbGl0IHdvdWxkIGJlIHVuY2xlYXIuIA0KDQo3LjQg IlRoZSBhYm92ZSB0ZXh0IGJlbG9uZ3MgaW4gYW4gZWFybGllciBkaXNjdXNzaW9uIG9mIGlzc3Vl cywgc28gdGhhdCB0aGUgc3BlY2lmaWNhdGlvbiBzZWN0aW9uIGNhbiBmb2N1cyBvbiBzcGVjaWZ5 aW5nLiIgVGhpcyBpcyBhbHNvIGEgIndoYXQgZG9lc24ndCBiZWxvbmcgaW4gc3BlY3MiIGlzc3Vl LCBidXQgaGVyZSBwcmVzZW50ZWQgb3JnYW5pemF0aW9uYWxseSwgYXMgaWYgYW4gUkZDIGlzIGRp dmlkZWQgaW50byBzZWN0aW9ucyBhYm91dCAic3BlY2lmaWNhdGlvbiIgYW5kIHRoZW4gbm9uLW5v cm1hdGl2ZSBzZWN0aW9ucy4gV2hlcmUgdGhpcyBpcyBjb21pbmcgZnJvbSBpcywgYXMgdXN1YWws IGJleW9uZCBtZS4gVGhlIHNwZWMgdGV4dCBpbiB0aGlzIHNlY3Rpb24gaXMgdGhlIG9ubHkgcGxh Y2UgaW4gdGhlIGRvY3VtZW50IHRoYXQgd2UgYWRkcmVzcyBlaXRoZXIgdGhlIG5vcm1hdGl2ZSBv ciBpbmZvcm1hdGl2ZSBkaW1lbnNpb25zIG9mIFVSSSBub3JtYWxpemF0aW9uLg0KDQo4IEF0IHRo ZSBzdGFydCBvZiB0aGUgc2VjdGlvbiwgd2hpY2ggaXMgdGl0bGVkICJIZWFkZXIgU3ludGF4LCIg dGhlIHJldmlldyBwcm9mZXNzZXMsICJJJ20gcXVpdGUgY29uZnVzZWQuIFRoaXMgc2VjdGlvbiBh cHBlYXJzIHRvIGJlIHNpbXVsdGFuZW91c2x5IHNwZWNpZnlpbmcgYSBTSVAgSWRlbnRpdHkgaGVh ZGVyIGZpZWxkIGFzIHdlbGwgYXMgaG93IHRvIHBvcHVsYXRlIGFuIGFzc29jaWF0ZSBQYXNzb3J0 IGVudGl0eS4iIFNpbmNlIGNvbnN0cnVjdGluZyBhIFBBU1Nwb3JUIGVudGl0eSBpcyBhIHN0ZXAg aW4gY29uc3RydWN0aW5nIHRoZSBTSVAgSWRlbnRpdHkgaGVhZGVyLCB0aGlzIGlzIG5vdCBzdWNo IGEgY29uZnVzaW5nIG1hdHRlciB0byBtZS4gQnV0IEknbGwgdGFrZSB0aGlzIGFzIHlldCBhbm90 aGVyIG9yZ2FuaXphdGlvbmFsIHN1Z2dlc3Rpb24gdGhhdCB0aGVyZSBzaG91bGQgYmUgYSBzdWJz ZWN0aW9uIG9yIHdoYXQgaGF2ZSB5b3UgdG8gY29udGFpbiB0aGUgUEFTU3BvclQtcmVsYXRlZCB0 ZXh0LiBJdCdzIG5vdCBhbiBhd2Z1bCBpZGVhLCBidXQgbm9yIHdvdWxkIGl0IHNvbHZlIGFueSBw YXJ0aWN1bGFyIHByb2JsZW0uIEh5cG90aGV0aWNhbCBjaGFuZ2VzIGxpa2UgdGhpcyBhcmUgdW5s aWtlbHkgdG8gaGF2ZSBhbnkgaW1wYWN0IG9uIGltcGxlbWVudGF0aW9uLg0KDQo4IEluIGNvbnN0 cnVjdGluZyB0aGUgIm9yaWciIGZpZWxkIHdpdGggYSAidG4iIG9yICJ1cmkiIGtleSwgdGhlIHJl dmlldyBzdWdnZXN0cyB0aGF0ICJ0aGlzIGFwcGVhcnMgdG8gYmUgcXVpdGUgYSBiaXQgb2YgZGV0 YWlsIHRoYXQgaXMgcmVkdW5kYW50IHdpdGggc3BlY2lmaWNhdGlvbnMgZWxzZXdoZXJlLiIgQWN0 dWFsbHkgdGhlICJkZXRhaWwiIGhlcmUgY29uc2lzdHMgb2Ygb25lIHNlbnRlbmNlIGFib3V0IHRl bGVwaG9uZSBudW1iZXJzIGFuZCBvbmUgYWJvdXQgVVJJcywgdGhlIGZvcm1lciBvZiB3aGljaCBj b250YWlucyBhIHBvaW50ZXIgdG8gdGhlIHRlbGVwaG9uZSBudW1iZXIgc2VjdGlvbiAoNy4yKSBh bmQgdGhlIGxhdHRlciBvZiB3aGljaCBjb250YWlucyBhIHBvaW50ZXIgdG8gdGhlIFVSSSBzZWN0 aW9uICg3LjQpLiBUaGVyZSBpcyBubyBvcmdhbml6YXRpb25hbCBvciByZWR1bmRhbmN5IHByb2Js ZW0gaGVyZS4NCg0KOSBUaGUgcmV2aWV3IHN1Z2dlc3RzIHRoYXQgZ3VpZGFuY2UgdG8gYXV0aGVu dGljYXRpb24gc2VydmljZXMgYWJvdXQgbm90IGFzc3VtaW5nIHZlcmlmaWVycyB3aWxsIHVuZGVy c3RhbmQgYW55IGdpdmVuIGV4dGVuc2lvbiBpcyAibGlrZWx5IHJlZHVuZGFudCBpbmZvcm1hdGlv bi4iIFRoaXMgY2FsbHMgb3V0IGEgYmxvY2sgb2YgaW5mb3JtYXRpdmUgdGV4dCBpbiBhIHNlY3Rp b24gZGVkaWNhdGVkIHRvIGV4dGVuc2liaWxpdHksIHRoYXQsIGFsdGhvdWdoIHJlZmxlY3RlZCBp biB0aGUgbm9ybWF0aXZlIGJlaGF2aW9yIG9mIHRoZSBhdXRoZW50aWNhdGlvbiBhbmQgdmVyaWZp Y2F0aW9uIHNlcnZpY2VzIGluIFNlY3Rpb24gNSwgbm9uZXRoZWxlc3MgbWVyaXRzIGEgcmVtaW5k ZXIuIA0KDQoxMSAiVGhlIGNvbnN0cnVjdGlvbiBvZiB0aGUgSWRlbnRpdHkgaGVhZGVyIGlzIHRo ZSBzYW1lIGZvciBwcml2YXRlIFVSSXMgYXMgaXQgaXMgZm9yIGFueSBvdGhlciBzb3J0IG9mIFVS SXMsIiB0aGUgc3BlYyByZWFkcy4gIkhvdyBpcyB0aGF0IGEgcHJpdmFjeSBtYXR0ZXI/IiB0aGUg cmV2aWV3IGNvdW50ZXJzLCBwZXJoYXBzIHF1ZXN0aW9uaW5nIHdoeSB0aGlzIHRleHQgYXBwZWFy cyBpbiBhIHNlY3Rpb24gYWJvdXQgcHJpdmFjeSwgb3IgaG93IGl0IHJlbGF0ZXMgdG8gcHJpdmFj eS4gSXQgcmVsYXRlcyB0byBwcml2YWN5IGJlY2F1c2UgaXQgaXMgbWFraW5nIGEgc3RhdGVtZW50 IGFib3V0IHByaXZhdGUgVVJJcyBmcm9tIFJGQzMzMjMuIA0KDQotLSAzKSBXaGF0IGRvZXNuJ3Qg YmVsb25nIGluIHNwZWNzDQoNCjMgV2hlcmUgdGhlIHNwZWMgcmVhZHMsICJGdXR1cmUgd29yayBt aWdodCBzcGVjaWZ5IHdheXMgdGhhdCBhIFNJUCBpbXBsZW1lbnRhdGlvbiBjb3VsZCBnYXRld2F5 IFBBU1Nwb3JUIG9iamVjdHMgdG8gb3RoZXIgcHJvdG9jb2xzLCIgdGhlIHJldmlldyBjb3VudGVy cywgIkFuZCBpdCBtaWdodCBub3QuIFRvIHRoZSBleHRlbnQgdGhhdCB5b3UgaGF2ZSB0byBzYXkg c29tZXRoaW5nIGFib3V0IHdvcmsgdGhhdCBtaWdodCBvciBtaWdodCBub3QgYmUgZG9uZSwganVz dCBjaXRlIHRoZSB0b3BpYyBhbmQgdGhhdCBpdCBpc24ndCBjb3ZlcmVkIGhlcmUuIiBJIHRoaW5r IGl0IGlzIHByZXR0eSBjbGVhciBmcm9tIGEgY2FzdWFsIGdsYW5jZSBhdCB0aGUgUkZDIHNlcmll cyB0aGF0IHN0YXRlbWVudHMgYWJvdXQgZGlyZWN0aW9ucyBmb3IgZnV0dXJlIHdvcmsgYXJlIGNv bW1vbiBpbiBSRkNzLCBhbmQgdGhhdCB0aGVyZSBpcyBubyBiYXIgYWdhaW5zdCB0aGVtLg0KDQo1 LjEgVGhlIHNwZWMgcmVhZHMgIkl0IGlzIGFsc28gcG9zc2libGUgdGhhdCB0aGUgYXV0aGVudGlj YXRpb24gc2VydmljZSByb2xlIG1pZ2h0IGJlIGluc3RhbnRpYXRlZCBieSBhbiBlbnRpdHkgdGhh dCBhY3RzIGFzIGEgcmVkaXJlY3Qgc2VydmVyLCBidXQgdGhhdCBpcyBsZWZ0IGFzIGEgdG9waWMg Zm9yIGZ1dHVyZSB3b3JrLiIgSGVyZSwgdGhlIHJldmlldyBwdXJwb3J0cywgIk5vdCBvbmx5IGlz IHRoZSBhYm92ZSwgbGFzdCBzZW50ZW5jZSBhYm91dCBmdXR1cmUgd29yazsgaXQgYXBwZWFycyB0 byBiZSBlbnRpcmVseSBpcnJlbGV2YW50IHRvIHRoaXMgc3BlY2lmaWNhdGlvbi4gUmVtb3ZlIGl0 LiIgTm8sIHRoZSBwdXJwb3NlIG9mIHN0YXRlbWVudHMgbGlrZSB0aGlzIGluIHNwZWNpZmljYXRp b25zIGlzIHRvIHNheSAiaGV5LCB3ZSB0aG91Z2h0IG9mIGFuIGlkZWEgdGhhdCBtaWdodCBiZSB1 c2VmdWwgc29tZWRheSwgYW5kIHdoaWxlIHdlIGRpZG4ndCB3YW50IHRvIHNwZWMgaXQgbm93LCB3 ZSBkaWQgd2FudCB0byBjYXB0dXJlIGl0IGFuZCB0cnkgdG8gc3RydWN0dXJlIHRoZSBtZWNoYW5p c20gaW4gYSB3YXkgdGhhdCB3b3VsZG4ndCBwcmVjbHVkZSBpdCwgaW4gY2FzZSBzb21lYm9keSBm ZWVscyBsaWtlIGZsZXNoaW5nIHRoaXMgb3V0IHNvbWV0aW1lLiIgVGhlIGNvbnRlbnRpb24gdGhh dCBzdGF0ZW1lbnRzIGxpa2UgdGhpcyBhcmUgYWJub3JtYWwgaW4gSUVURiBzcGVjaWZpY2F0aW9u cyB3b3VsZCBub3Qgd2l0aHN0YW5kIGV2ZW4gY2FzdWFsIHNjcnV0aW55Lg0KDQo1LjEgUmV2aWV3 OiAiUmVtb3ZlIHRoZSBwZWRhZ29neSBhZnRlciB0aGUgZmlyc3Qgc2VudGVuY2UuIFRoZSBjaG9p Y2VzIGFyZSBvdXRzaWRlIG9mIHRoaXMgc3BlY2lmaWNhdGlvbiBhbmQgdGhlIHNwZWMgaXMgbm90 IGVuaGFuY2VkIGJ5IHBlZGFnb2d5IGFib3V0IHRlY2huaWNhbCBtYXR0ZXJzIG91dHNpZGUgb2Yg aXRzIHNjb3BlLiIgVGhpcyByZXF1ZXN0cyB0aGUgcmVtb3ZhbCBvZiBzb21lIG5vbi1ub3JtYXRp dmUgdGV4dCB0aGF0IGdpdmVzIGV4YW1wbGVzIG9mIGhvdyBhbiBhdXRoZW50aWNhdGlvbiAgc2Vy dmljZSBtaWdodCBhdXRoZW50aWNhdGUgdGhlIHNlbmRlciBvZiBhIG1lc3NhZ2UuIFdoeSB0aGlz IHRleHQgc2hvdWxkIGJlICJwZWRhZ29naWNhbCIgaXMgYSBiaXQgb2JzY3VyZSB0byBtZSwgYXMg aXMgd2h5IGl0IHdvdWxkIGJlIGEgYmFkIHRoaW5nIGlmIGl0IHdlcmUgLSB0aGUgZXhhbXBsZXMg dGhhdCBmb2xsb3cgYXJlIHRoZSB3YXlzIHRoYXQgdGhpcyBzdGVwIHdpbGwgcHJvYmFibHkgYmUg YWNjb21wbGlzaGVkLCB0aG91Z2ggd2UgZG9uJ3Qgd2FudCB0byBtYW5kYXRlIGFueSBvbmUgaW4g cGFydGljdWxhci4NCg0KNS4xICJQcm9jZWR1cmFsIGRldGFpbCBzaG91bGQgYmUgaW4gYSBwcm9j ZWR1cmFsIGZvcm0uIEV4dGVuZGVkIHByb3NlIGxpa2UgdGhpcyBpc24ndCBhcyBlYXNpbHkgZ3Jv a2tlZC4gVGhhdCBpbnZpdGVzIGJvdGggd3JpdGluZyBhbmQgcmVhZGluZyBlcnJvcnMgdG8gdGhl IGFsZ29yaXRobS4iIEhlcmUgdGhlIGNvbXBsYWludCBpcyBhYm91dCAiZW50aXRpZXMgaW5zdGFu dGlhdGluZyB0aGUgYXV0aGVudGljYXRpb24gc2VydmljZSByb2xlIHBlcmZvcm0gdGhlIGZvbGxv d2luZyBzdGVwcyIgdnMuIHByb3Bvc2VkIGVkaXQgInRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNl IHBlcmZvcm1zIHRoZSBmb2xsb3dpbmcgc3RlcHMuIiBXZSBlbmRlZCB1cCB3aXRoIHRoZSBvcmln aW5hbCB0ZXh0IGJlY2F1c2UgdG9vIG1hbnkgcGVvcGxlIHdlcmUgcmVhZGluZyAidGhlIGF1dGhl bnRpY2F0aW9uIHNlcnZpY2UiIHRvIG1lYW4gImEgcHJveHkgc2VydmVyIG9yIG90aGVyIGludGVy bWVkaWFyeSIsIGFuZCBieSB1c2luZyB0aGUgbG9uZ2VyIGNvbnN0cnVjdGlvbiwgd2UgYXJlIHJl bWluZGluZyByZWFkZXJzIHRoYXQgdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2Ugcm9sZSBtYXkg YmUgaW5zdGFudGlhdGVkIGJ5IHZhcmlvdXMgZW50aXRpZXMgaW4gdGhlIGFyY2hpdGVjdHVyZS4g SSBkb24ndCBiZWxpZXZlIHRoaXMgY29uc3RydWN0aW9uIGFzIGdpdmVuIGhlcmUgaXMgdG9vIGRp ZmZpY3VsdCB0byAiZ3JvayI7IGl0IGlzIG5vdCByZXBlYXRlZCBpbiB0aGUgc3RlcHMgYmVsb3cs IGFuZCBpcyBvbmx5IGhlcmUgdG8gZW1waGFzaXplIHRoZSBmbGV4aWJpbGl0eSBvZiB0aGUgcm9s ZS4NCg0KNi4xIFdoZXJlIHRoZSBzcGVjIHNheXMgdGhhdCAiQXV0aG9yaXphdGlvbiBvZiB0aGUg dXNlIG9mIGEgcGFydGljdWxhciB1c2VybmFtZSBvciB0ZWxlcGhvbmUgbnVtYmVyIGluIHRoZSBp ZGVudGl0eSBmaWVsZCBpcyBhIG1hdHRlciBvZiBsb2NhbCBwb2xpY3kgZm9yIHRoZSBhdXRoZW50 aWNhdGlvbiBzZXJ2aWNlLCIgdGhlIHJldmlldyBjYW4gb25seSBzYXkgIkh1aD8gQnV0IHJlYWxs eSwgd2hlbiBhIHNwZWNpZmljYXRpb24gc2F5cyBzb21ldGhpbmcgaXMgb3V0IG9mIHNjb3BlIGFu ZCBpcyBhIG1hdHRlciBmb3IgbG9jYWwgcG9saWN5LCB0aGUgc3BlY2lmaWNhdGlvbiBzaG91bGQg bm90IHRoZW4gZ28gb24gdG8gc3BlY2lmeSBleGFtcGxlcyBvZiBsb2NhbCBwb2xpY3kuIEluIHRo b3NlIGNhc2VzIHdoZXJlIHRoZXJlIGlzIGEgY29tcGVsbGluZyBiZW5lZml0IHRvIGluY2x1ZGUg c3VjaCBleGFtcGxlcywgcHV0IHRoZW0gaW4gYW4gYXBwZW5kaXguIEJ1dCBwbGVhc2UsIHRoZW4s IGV4cGxhaW4gdGhhdCBjb21wZWxsaW5nIGJlbmVmaXQuIiBJIHdvdWxkIHRoaW5rIHRoYXQgdGhv c2UgZXhhbXBsZXMgbWlnaHQgaGVscCB0byBpbmZvcm0gaW1wbGVtZW50ZXJzIHdobyBhcmUgdHJ5 aW5nIHRvIGRlY2lkZSB3aGF0IGtpbmQgb2YgdG9vbHMgdG8gcHJvdmlkZSB0byBvcGVyYXRvcnMs IGF0IGxlYXN0IHdoYXQgc29ydHMgb2YgYnVpbGRpbmcgYmxvY2tzIG1pZ2h0IGJlIGluIHBsYXkg aW4gZXhwcmVzc2luZyB0aGF0IHBvbGljeSwgb3Igd2hhdCBwcm90b2NvbCB0b29scyB3b3VsZCBi ZSBuZWVkZWQgdG8gZXh0cmFjdCBlbGVtZW50cyB0aGF0IHRoZSBwb2xpY3kgY291bGQgYWN0IHVw b24uIE9yIG1heWJlIHdlIGFzIHNwZWNpZmllcnMgdGhvdWdodCB0aGF0IHRoaXMgd291bGQgYmUg YSBzb3VuZCBmb3VuZGF0aW9uIGZvciBhIHBvbGljeSwgYW5kIHdoaWxlIHdlIGRvbid0IHdhbnQg dG8gZ2l2ZSBpdCBub3JtYXRpdmUgZm9yY2UsIHdlIHdhbnQgdG8gcHV0IGl0IG91dCB0aGVyZSBz byB0aGF0IGltcGxlbWVudGVycyBhbmQgb3BlcmF0b3JzIG1pZ2h0IGNvbnNpZGVyIGl0IGFzIGEg cHJhY3RpY2UsIGlmIGl0IGhhcHBlbnMgdG8gZml0IHdpdGggdGhlaXIgZXhpc3RpbmcgbW9kZWwu IFdlIG1pZ2h0IGFsc28gdGhpbmsgaXQgaXMgd29ydGggbWVudGlvbmluZyBjb3JuZXIgY2FzZXMg KGxpa2UgYW5vbnltaXR5KSB0aGF0IHBlb3BsZSBtaWdodCBvdmVybG9vayBpbiBpbXBsZW1lbnRh dGlvbiBvdGhlcndpc2UuIEJ1dC4uLiBJIHJlYWxseSBkb24ndCB0aGluayB0aGVyZSdzIGFueSBy ZWFzb24gdGhhdCB0aGUgaW5jbHVzaXZlIG9mIGEgbm9uLW5vcm1hdGl2ZSBleGFtcGxlIHJlcXVp cmVzIGEgZGVmZW5zZSBsaWtlIHRoaXMsIG5vciBkbyBJIHRoaW5rIHRoYXQgdGhlIHJlcXVpcmVt ZW50IHRoZSByZXZpZXcgZXhwcmVzc2VzIGhlcmUgaXMgYSB2YWxpZCBvbmUgZm9yIElFVEYgc3Bl Y2lmaWNhdGlvbnMuDQoNCjYuMiBUaGUgcmV2aWV3IGhlcmUgYWRkcyAiZ3JhdGl0dW91cyBpbXBs ZW1lbnRhdGlvbiBhZHZpY2UiIHRvIHRoZSBsaXN0IG9mIHRoaW5ncyB0aGF0IHNob3VsZCBub3Qg YmUgaW4gc3BlY2lmaWNhdGlvbnMuIEl0IGFkdmlzZXMgdGhhdCAiSWYgdGhlcmUgaXMgYSBjb21w ZWxsaW5nIGRlc2lyZSB0byBnaXZlIGltcGxlbWVudGF0aW9uIGFkdmljZSwgbW92ZSBpdCB0byBh IHNlcGFyYXRlIGRvY3VtZW50IGFuZCBtYWtlIGl0IG1vcmUgY29tcGxldGUuIiBUaGlzIGNvbW1l bnRhcnkgaXMgaW5zZXJ0ZWQgaW50byBhIHNlbnRlbmNlIGRpcmVjdGx5IGJlZm9yZSB0aGUgb25l IHJlYWRpbmcgIkZ1cnRoZXIgY29uc2lkZXJhdGlvbiBvZiBob3cgdG8gY2FjaGUgY3JlZGVudGlh bHMgaXMgZGVmZXJyZWQgdG8gdGhlIGNyZWRlbnRpYWwgbWVjaGFuaXNtIHNwZWNpZmljYXRpb25z LiINCg0KNi40IEhlcmUgdGhlIHJldmlldyBmdXJ0aGVyIHN0aXB1bGF0ZXMgdGhhdCAiQSByZXZp ZXcgb2YgY3VycmVudCwgZXh0ZXJuYWwgc2VydmljZXMgYW5kIGh5cG90aGV0aWNhbCBjYXBhYmls aXRpZXMgaXMgbm90IGFwcHJvcHJpYXRlIGZvciBpbmNsdXNpb24gaW5zaWRlIGEgdGVjaG5pY2Fs IHNwZWNpZmljYXRpb24uIE1vdmUgaXQgdG8gYSBzZXBhcmF0ZSBkb2N1bWVudC4iIEFzIHRoZSB0 ZXh0IGhlcmUgcG9pbnRzIHRvIGV4aXN0aW5nIFJGY3MgaW4gdGhpcyBzcGFjZSwgYW5kIGRyYWZ0 cyB0YWlsb3JlZCB0byBwcm92aWRlIHRoaXMgc3BlY2lmaWMgY2FwYWJpbGl0eSBmb3IgU1RJUiwg aXQgaXMgYmFmZmxpbmcgd2h5IHRoZSByZXZpZXcgYWxsZWdlcyB0aGF0IHRoaXMgaXMgIm5vdCBh cHByb3ByaWF0ZSBmb3IgaW5jbHVzaW9uIGluc2lkZSBhIHRlY2huaWNhbCBzcGVjaWZpY2F0aW9u LCIgbm9yIHdoeSBtb3Zpbmcgc3VjaCBtYXRlcmlhbCB0byBhIHNlcGFyYXRlIGRvY3VtZW50IHdv dWxkIG1vcmUgdXNlZnVsIHRoYW4ga2VlcGluZyBpdCBoZXJlLg0KDQo3IE9uY2UgYWdhaW4gdGhl IHJldmlldyBoZXJlIGluc2lzdHMgdGhhdCAiQXMgc29vbiBhcyBhIGRvY3VtZW50IHNheXMgJ2xv Y2FsIHBvbGljeScgaXQgbmVlZHMgdG8gc3RvcCBzcGVjaWZ5aW5nIGRldGFpbCwgc2luY2UgaXQg aXMgYm90aCBvdXRzaWRlIG9mIHRoZSBzY29wZSBvZiB0aGUgZG9jdW1lbnQgYW5kIGl0IGlzIGRp c3RyYWN0aW5nIGZyb20gdGhlIGRldGFpbHMgb2YgdGhlIHNwZWNpZmljYXRpb24uIiBFc3BlY2lh bGx5IGhlcmUsIHRoaXMgaXMgbm9uc2Vuc2UuIFdoYXQgaXMgbG9jYWwgcG9saWN5LCBhcyB0aGUg c3BlYyBzYXlzLCBpcyB0aGUgZGVjaXNpb24gb2Ygd2hldGhlciB5b3UgZXh0cmFjdCB0aGUgaWRl bnRpdHkgZnJvbSBQQUkgb3IgdGhlIEZyb20uIFRoZXJlJ3Mgc3RpbGwgcGxlbnR5IHRvIGJlIHNh aWQgYWJvdXQgd2hhdCB5b3UgZG8gb25jZSB0aGF0IHBvbGljeSBkZWNpc2lvbiBoYXMgYmVlbiBt YWRlIG9uZSB3YXkgb3IgYW5vdGhlci4gVGhlIG5vdGlvbiB0aGF0IGFzIHNvb24gYXMgdGhlIHdv cmRzICJsb2NhbCBwb2xpY3kiIGFwcGVhciBpbiBhIHNwZWMgdGhlbiB5b3UgY2FuJ3Qgc2F5IGZ1 cnRoZXIgcmVsYXRlZCB0byB0aGUgc3ViamVjdCBpcyBhIHJ1bGUgd2l0aCBubyBiYXNpcyBpbiBw cmFjdGljZSBvciByZWFsaXR5LiBBZ2FpbiwgdGhlIHJldmlldyB1cmdlcyB0aGF0ICJUbyB0aGUg ZXh0ZW50IHRoZXJlIGlzIGEgY29tcGVsbGluZyBuZWVkIHRvIHNwZWNpZnkgdGhpcyBhbHRlcm5h dGl2ZSBtZWNoYW5pc20sIGRvIGl0IGluIGEgc2VwYXJhdGUgc3BlY2lmaWNhdGlvbi4iIE5vIHRo YW5rcywgaXQncyBmaW5lIGhlcmUuIE9uIHNpbWlsYXIgZ3JvdW5kcywgdGhlIHJldmlldyBnb2Vz IG9uIHRvIHN1Z2dlc3QgdGhhdCBhbm90aGVyIGhlbHBmdWwgcGFyYWdyYXBoIG9mIG1lY2hhbmlz bSBiZSByZW1vdmVkIGJlY2F1c2UgaXQgbWVudGlvbnMgImxvY2FsIHBvbGljeSIgaW4gY29ubmVj dGlvbiB3aXRoIHRoZSAiY2Fub24iIHBhcmFtZXRlci4gTm8gdGhhbmtzLg0KDQo3IFRoZSByZXZp ZXcgYWxzbyBzYXlzIGhlcmUgdGhhdCAiJ21vc3QgY29tbW9ubHknIHN1Z2dlc3RzIHRoYXQgdGhp cyBpcyBkaXNjdXNzaW9uLCBub3Qgc3BlY2lmaWNhdGlvbi4iIFNwZWNpZmljYXRpb25zIGFyZSBh cHBhcmVudGx5IGZvcmJpZGRlbiBmcm9tIHN1Z2dlc3RpbmcgdGhhdCBzb21ldGhpbmcgaXMgcmFy ZSBvciBwZXJ2YXNpdmUuIFRoZXJlIGFyZSB0d28gd2F5cyB0aGF0IGEgdGVsZXBob25lIG51bWJl ciBjYW4gYXBwZWFyIGluIHRoZSB1c2VyIHBhcnQgb2YgYSBTSVAgVVJJLCBhbmQgdGhhdCBvbmUg aXMgbW9yZSBjb21tb24gdGhhbiB0aGUgb3RoZXIgaW4gY29udGVtcG9yYXJ5IG9wZXJhdGlvbnMu IEl0IGlzIHRydWUgdGhhdCB0aGlzIGluZm9ybWF0aW9uIHdvdWxkIG9ubHkgYmUgb2YgbGl0dGxl IHVzZSB0byBpbXBsZW1lbnRlcnMsIGJlY2F1c2UgdGhlIHNjaGVtZSBpdHNlbGYgd2lsbCB0ZWxs IHlvdSB3aGV0aGVyIG9yIG5vdCB0aGUgbGVzcyBjb21tb24gb2YgdGhlc2UgYXBwcm9hY2hlcyBp cyBpbiB1c2UuIEFuZCBtYXliZSBvdmVyIHRpbWUgaXQgd291bGQgbm8gbG9uZ2VyIGJlIHRydWUu IEJ1dCBpcyBpdCBldmVuIHdvcnRoIGFueW9uZSdzIHRpbWUgdG8gc3VnZ2VzdCByZW1vdmluZyBp dD8gV2lsbCBhbnkgaW1wbGVtZW50ZXIgZG8gc29tZXRoaW5nIHdyb25nIGJlY2F1c2UgdGhvc2Ug d29yZHMgYXJlIHRoZXJlPyBXaWxsIGFueW9uZSBiZSBjb25mdXNlZCBvciB1bmRlcnN0YW5kIHRo ZSBhaW0gb2YgdGhlIHNwZWNpZmljYXRpb24gbGVzcz8gDQoNCjcuMiBIZXJlIHRoZSByZXZpZXcg cHVzaGVzIGJhY2sgbW9yZSBzdHJvbmdseSB0aGFuIHByZXZpb3VzbHkgb24gdGhlIHdob2xlIGlk ZWEgb2YgdXNpbmcgc3RlcHMgdG8gZGVzY3JpYmUgYmVoYXZpb3IuIFRoZSByZXZpZXcgcmVkYXMs ICJ0aGUgYWxnb3JpdGhtIHNob3VsZCBiZSBzcGVjaWZpZWQgaW4gdGhlIGZvcm0gb2YgYW4gYWxn b3JpdGhtLCByYXRoZXIgdGhhbiBhcyBub3JtYXRpdmUgcHJvc2UsIiBhbmQgZ29lcyBvbiByZWFk aW5nIHRoZSBzdGVwcyB0byBhZGQsICJhZ2FpbiwgdGhpcyBpc24ndCByZWFsbHkgYSBzcGVjaWZp Y2F0aW9uLCIgInRoaXMga2luZCBvZiBsYW5ndWFnZSBpcyBub3QgcmVhbGx5IGEgc3BlY2lmaWNh dGlvbiwiIGFuZCB0aGVuICJ0aGUgYWJvdmUgdGV4dCBhbHNvIGlzIG5vdCBhIHNwZWNpZmljYXRp b24uIiBCdXQgaW4gb3RoZXIgcGxhY2VzLCB0aGUgcmV2aWV3IHNlZW1zIHRvIGFja25vd2xlZGdl IHRoYXQgdGhlc2Ugc3RlcHMgZG8gZGVzY3JpYmUgYW4gYWxnb3JpdGhtLCBhbmQgaXQgbWVyZWx5 IHN1Z2dlc3RzIG1vdmluZyAiY29tbWVudGFyeSBhYm91dCB0aGUgYWxnb3JpdGhtIC0tIHN1Y2gg YXMgJ3RoZXNlIHdpbGwgYXBwZWFyLi4uJyB0byBiZSBvdXRzaWRlIG9mIHRoZSBhbGdvcml0aG0g c3BlY2lmaWNhdGlvbi4iIA0KDQpPbmUgb2YgdGhlIHN5bXB0b21zIG9mIGJlaW5nICJjb21tZW50 YXJ5IiBpbnN0ZWFkIG9mIHNwZWNpZmljYXRpb24gaXMgbGFuZ3VhZ2UgbGlrZSAibWF5IGludm9s dmUsIiBhcHBhcmVudGx5LiBUaGUgc3BlYyBoZXJlIGhhcyBhIG5vcm1hdGl2ZSBzdGF0ZW1lbnQg YWJvdXQgdHJhbnNmb3JtaW5nIHRoZSBudW1iZXIgaW50byBhbiBFLjE2NCBmb3JtYXQsIHdoaWNo LCBhIHNlcGFyYXRlIGNsYXVzZSByZWFkcywgIm1heSBpbnZvbHZlIHRyYW5zZm9ybWluZyB0aGUg bnVtYmVyIGZyb20gYSBkaWFsIHN0cmluZyAoc2VlIFJGQzM5NjYpIiBvciB2YXJpb3VzIG90aGVy IGZvcm1hdHMuIFRoZSBzcGVjIHRleHQgaGVyZSBpcyBhIHRydWUgYW5kIHVzZWZ1bCBzdGF0ZW1l bnQ6IHRoZSBudW1iZXIgbWF5IGJlIGEgZGlhbCBzdHJpbmcgKHBlciBSRkMzOTY2KSBhbmQgbWF5 IG5lZWQgdG8gYmUgdHJhbnNmb3JtZWQgaW50byBFLjE2NCBmb3JtYXQuIEl0IHdvbid0IGFsd2F5 cywgb3IgZXZlbiB1c3VhbGx5IChjb21tb25seSEpIGJlIHRydWUgdGhhdCB5b3UgbmVlZCB0byBk byB0aGF0LCBidXQgeW91IG1pZ2h0LiBMaXN0aW5nIHRoaXMgaW4gdGhlIHN0ZXAgaXMgdXNlZnVs LiBXaGF0ZXZlciBwcm9oaWJpdGlvbiB0aGUgcmV2aWV3ZXIgaW1hZ2luZXMgdGhhdCBkaXZpZGVz ICJjb21tZW50YXJ5IiBmcm9tICJzcGVjaWZpY2F0aW9uIiBpbiB0aGlzIGZhc2hpb24gd291bGQg YmUgYW4gb25lcm91cyBhbmQgY291bnRlcnByb2R1Y3RpdmUgY29uc3RyYWludCBvbiBJRVRGIHNw ZWNpZmljYXRpb25zLiBJdCBpcyBwcm9iYWJseSBhIGdvb2Qgd2FybmluZyB0aG91Z2ggdGhhdCAi bGFuZ3VhZ2UgbGlrZSAiZXhjZXB0IG9ubHkiIGVuY291cmFnZXMgY29kaW5nIGVycm9ycy4iDQoN CjcuNCBUaGUgZW5kIG9mIHRoaXMgc2VjdGlvbiBjb250YWlucyBhIGZldyBzdGF0ZW1lbnRzIGFi b3V0IGZ1dHVyZSB3b3JrLCB3aGljaCB5aWVsZHMgYSBmYW1pbGlhciBjb21tZW50OiAiRGlzY3Vz c2lvbiBhYm91dCBmdXR1cmUgaHlwb3RoZXRpY2FscywgYWdhaW4uICBSZW1vdmUuIiBXaHkgaXMg dGhpcyBpbmZvcm1hdGlvbiBoZXJlPyBCZWNhdXNlIHdlIHdhbnQgdG8gd2FybiBpbXBsZW1lbnRl cnMgYWJvdXQgdGhlIHBvdGVudGlhbCBmb3IgaWRlbnRpZmllcnMgd2l0aG91dCBwcm90b2NvbCBz Y2hlbWVzLCBpbmNsdWRpbmcgcmZjODIyIGlkZW50aWZpZXJzLCB3aGljaCB3ZSBleHBlY3QgbWln aHQgY29tZSBmcm9tIFdlYlJUQyBpbnRlcmFjdGlvbiAobGlrZSBTSVAgLT4gV2ViUlRDIGdhdGV3 YXlpbmcpLg0KDQo4IEFuIGludHJvZHVjdG9yeSBtZW50aW9uIGluIHRoaXMgc2VjdGlvbiBvZiB0 aGUgcHJldmlvdXMgc3BlY2lmaWNhdGlvbiBvZiB0aGUgSWRlbnRpdHkgaGVhZGVyIGluIFJGQzQ0 NzQgaXMgbWV0IGJ5IHRoZSByZXZpZXcgaGVyZSB3aXRoLCAiUmVmZXJlbmNlIHRvIHRoZSBwcmV2 aW91cyA0NDc0IGNvbnRlbnQgaXMgdW5wcm9kdWN0aXZlIGFuZCBkaXN0cmFjdGluZy4gUmVtb3Zl IGFsbCBvZiBpdC4gVGhpcyBpcyBhIG5ldyBzcGVjaWZpY2F0aW9uLiIgVGhlIGlkZWEgdGhhdCBh IGJpcyBvZiBhbiBleGlzdGluZyBSRkMgc2hvdWxkIG5vdCByZWZlcmVuY2UgdGhhdCBSRkMgaXMg cHJldHR5IHJlbW92ZWQgZnJvbSBteSBleHBlcmllbmNlIGF0IHRoZSBJRVRGLiBUaGUgcmV2aWV3 IGluc3RlYWQgcHJvcG9zZXMgdGhhdCAidGhpcyBzZWN0aW9uIHNob3VsZCBtZXJlbHkgZGVmaW5l IHdoYXQgaXQgZGVmaW5lcyBhbmQgbm90IHB1dCBpdCBpbiB0ZXJtcyBvZiB0aGUgZWFybGllciBk b2N1bWVudC4iIEkgZG9uJ3QgdGhpbmsgdGhlIHRleHQgaGVyZSBhY3R1YWxseSBkb2VzIHB1dCBh bnl0aGluZyAiaW4gdGVybXMgb2YgdGhlIGVhcmxpZXIgZG9jdW1lbnQsIiBpdCBqdXN0IGhhcyBh IG9uZS1wYXJhZ3JhcGggaW50cm9kdWN0b3J5IHdhcm5pbmcgdGhhdCB0aGlzIGhlYWRlciBzeW50 YXggaXMgcmV2aXNpbmcgYW4gZXhpc3RpbmcgYml0IG9mIGdyYW1tYXIuDQoNCjggT25jZSBhZ2Fp biB0aGUgcmV2aWV3IGhlcmUgaXMgY29uY2VybmVkIGFib3V0ICJhbm90aGVyIGFsZ29yaXRobSBu ZWVkaW5nIHRvIGJlIHNwZWNpZmllZCBhcyBhbiBhbGdvcml0aG0iLCIgd2hlcmUgImFsbCBvZiB0 aGVzZSAnbXVzdCcgZm9ybWF0aW9ucyBhcmUgb3ZlcmtpbGwuIE5vcm1hbGx5LCBhbGdvcml0aG1z IGFyZSBzcGVjaWZpZWQgaW4gYSBzaW1wbGUsIGRlY2xhcmF0aXZlIG1hbm5lci4iIEkgZG9uJ3Qg YmVsaWV2ZSB0aGUgZGl2aXNpb24gb2YgYW4gb3BlcmF0aW9uIGludG8gc3RlcHMgY29udGFpbmlu ZyBub3JtYXRpdmUgTVVTVHMgaXMgYW4gb3V0bGllciBpbiBJRVRGIHNwZWNpZmljYXRpb25zLg0K DQo4IFRoZSByZXZpZXcgYWdhaW4gcmV0dXJucyB0byB0aGUgZmFtaWxpYXIgY29uZGVtbmF0aW9u IG9mICJGdXR1cmUgcmVmZXJlbmNlIHRvIGh5cG90aGV0aWNhbHMuIiBJbiB0aGlzIGNhc2UsIGl0 IGlzIHRvIHRoZSBzdGF0ZW1lbnQgdGhhdCBmdXR1cmUgZXh0ZW5zaW9ucyB0byBQQVNTcG9yVCBt aWdodCBhbHRlciB0aGUgc2VjdXJpdHkgcHJvcGVydGllcyBwcm92aWRlZCBieSB0aGUgc2lnbmF0 dXJlIGJ5IGNvdmVyaW5nIG5ldyBpbmZvcm1hdGlvbi4gVGhpcyBpcyBhIHVzZWZ1bCB0aGluZyB0 byBub3RlIGluIHRoaXMgY2FzZSwgYW5kIG5vIGNoYW5nZSBzaG91bGQgYmUgbWFkZSBhcyBhIHJl c3VsdCBvZiB0aGlzIHJldmlldyBjb21tZW50Lg0KDQoxMCBUaGUgcmV2aWV3IGhlcmUgcHJvcG9z ZXMgdG8gZGVsZXRlIHRoZSBzZWN0aW9uIG9uIGJhY2t3YXJkcyBjb21wYXRpYmlsaXR5LiBUaGlz IHNlY3Rpb24gd2FzIG9mIGNvdXJzZSBhZGRlZCBvbmx5IGluIHRoaXMgbGF0ZXN0IHJldmlzaW9u LCBhdCB0aGUgcmVxdWVzdCBvZiB0aGUgY2hhaXJzLiBUaGUgcmV2aWV3IGhvd2V2ZXIgYXJndWVz IHRoYXQgIkluIGZhY3QgdGhlcmUgaXMgc28gbGl0dGxlIG92ZXJsYXAgb2Ygc3Vic3RhbnRpdmUg dGV4dCwgdGhpcyByZWFsbHkgaXMgYW4gZW50aXJlbHkgbmV3IGRvY3VtZW50IGFuZCBub3QgYSBi aXMuIiBJdCBpcyBhIGJpdCBoYXJkIHRvIHNlZSB0aGF0IGFyZ3VtZW50IGluIGxpZ2h0IG9mIHRo ZSBmYWN0IHRoYXQgdGhlIElkZW50aXR5IGhlYWRlciwgdGhlIGFzc29jaWF0ZWQgcmVzcG9uc2Ug Y29kZXMsIHRoZSBjb25jZXB0cyBvZiB0aGUgYXV0aGVudGljYXRpb24gYW5kIHZlcmlmaWNhdGlv biBzZXJ2aWNlLCBhbmQgbWFueSBvdGhlciByZWxhdGVkIGVsZW1lbnRzIHdlcmUgcHJlc2VudCBp biBSRkM0NDc0Lg0KDQotLSA0KSBQaGlsb3NvcGhpY2FsIG9yIHRlY2huaWNhbCBjaGFsbGVuZ2Vz Og0KDQoNCjMgVGhlIHNwZWMgcmVhZHM6ICJUaGlzIGlkZW50aXR5IGFyY2hpdGVjdHVyZSBmb3Ig U0lQIGRlcGVuZHMgb24gYSBsb2dpY2FsICdhdXRoZW50aWNhdGlvbiBzZXJ2aWNlJyB3aGljaCB2 YWxpZGF0ZXMgb3V0Z29pbmcgcmVxdWVzdHMuIiBCdXQgdGhlIHJldmlldyBvYmplY3RzLCAiSXQg bGlrZWx5IHdpbGwgdmFsaWRhdGUgdGhlbSBpbiBtdWx0aXBsZSBwbGFjZXMsIGluY2x1ZGluZyBp bmNvbWluZyByZXF1ZXN0cy4iIEFzIGRlc2NyaWJlZCBpbiB0aGlzIHNwZWNpZmljYXRpb24sIGFu IGF1dGhlbnRpY2F0aW9uIHdpbGwgbm90IGRvIHRoYXQuIA0KDQozIFRoZSByZXZpZXcgYWRkcywg IkFsc28gJ1RoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlJyBtaWdodCByZWZlciB0byB0aGUgc2ln bmluZyBzaWRlIG9yIHRvIHRoZSB2ZXJpZnlpbmcgc2lkZS4gSG93IGlzIHRoZSByZWFkZXIgdG8g a25vdyBmb3IgY2VydGFpbj8gQSBkaWFncmFtIG9mIHRoZSBvdmVyYWxsIHNlcnZpY2UgYW5kIGl0 cyBjb21wb25lbnRzIGNvdWxkIGJlIHF1aXRlIGhlbHBmdWwuIiBObywgdGhlICJhdXRoZW50aWNh dGlvbiBzZXJ2aWNlIiBhcyBkZXNjcmliZWQgaGVyZSBiZWhhdmVzIGRpZmZlcmVudGx5LCBhbmQg ZG9lcyBub3QgYXBwZWFyIG9uIHRoZSB2ZXJpZnlpbmcgc2lkZS4gQSBkaWFncmFtIGlzbid0IG91 dCBvZiB0aGUgcXVlc3Rpb24sIGJ1dCB0aGUgZGlmZmljdWx0eSBpcyB0aGF0IHRoZSBhdXRoZW50 aWNhdGlvbiBzZXJ2aWNlIGlzIGEgbG9naWNhbCByb2xlIHRoYXQgbWlnaHQgYmUgcGxheWVkIGJ5 IGVsZW1lbnRzIGluIGRpZmZlcmVudCBjb21wb25lbnRzIG9mIGEgY2FsbCBmbG93LCBzbyBpdCB3 b3VsZCBhbHdheXMgYmUganVzdCBhbiBleGFtcGxlIGluc3RhbnRpYXRpb24gcmF0aGVyIHRoYW4g YSBjb21wbGV0ZSBwaWN0dXJlLg0KDQozICIoT2RkIHRob3VnaHQ6IEdpdmVuIHRoYXQgSlNPTiBp c24ndCBuYXRpdmUgdG8gU0lQIGFuZCB0aGF0IHRoZXJlIG11c3QgYmUgc29tZSB0cmFuc2xhdGlv bi9lbmNvZGluZyBvZiB0aGUganNvbiBvYmplY3QgdG8gd29yayB3aXRoIFNJUCwgdGhhdCBlZmZl Y3RpdmVseSBtZWFucyB0aGF0IHRoaXMgL2lzLyBhIGdhdGV3YXlpbmcgYXBwbGljYXRpb24gb2Yg dGhlIG9iamVjdC4uLikuIiBBcyBmYXIgYXMgb2RkIHRob3VnaHRzIGdvLCB0aGF0J3Mgbm90IGZh ciBmcm9tIGhvdyB3ZSBzZWUgaXQuIFdlIGltYWdpbmUgdGhlcmUgd2lsbCBiZSBob3BlZnVsbHkg c2VhbWxlc3MgZ2F0ZXdheWluZyB0byBhIGxvdCBvZiBub24tU0lQIGFwcGxpY2F0aW9ucy4gQ3Vs bGVuJ3MgZHJhZnQgYWJvdXQgV2ViUlRDIGdhdGV3YXlpbmcgaXMgYSBnb29kIHBsYWNlIHRvIGxv b2sgYXQgd2hhdCBzb21lIG9mIHRoZSBwcmFjdGljYWwgY2hhbGxlbmdlcyBhcmUgdG8gZ2V0dGlu ZyB0aGlzIHRvIHdvcmsuDQoNCjMgVGhlIHNwZWMgcmVhZHMsICJUbyBtYXhpbWl6ZSBlbmQtdG8t ZW5kIHNlY3VyaXR5LCBpdCBpcyBvYnZpb3VzbHkgcHJlZmVyYWJsZSBmb3IgZW5kLXVzZXJzIHRv IGFjcXVpcmUgdGhlaXIgb3duIGNyZWRlbnRpYWxzIj8gVGhlIHJldmlldyByZXBsaWVzLCAgIkkn bSBub3QgZXhhY3RseSBzdXJlIHdoYXQgdGhpcyBtZWFucyBvciBpcyBzdXBwb3NlZCB0byBtZWFu LCBidXQgSSBzdXNwZWN0IGl0J3MgaW5jb3JyZWN0LiIgV2VsbCwgd2hhdCBpdCBtZWFucyBpcyBl eHBsYWluZWQgaWYgeW91IGRvbid0IHRha2UgdGhpcyBwaHJhc2UgaW4gaXNvbGF0aW9uIGFuZCBw cmV0ZW5kIGxpa2UgaXQgaXMgc29tZXRoaW5nIHdpdGggbm8gY29udGV4dC4gVGhlIHByaW9yIHNl bnRlbmNlIGJlZ2lucyBieSBzdGF0aW5nIHRoYXQgdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2Ug ZnVuY3Rpb24gY2FuIGV4aXN0IGF0IGVpdGhlciBhIHVzZXIgYWdlbnQgb3IgYSBwcm94eSBzZXJ2 ZXIuIE9uZSBvZiB0aG9zZSBpcyBhbiBlbmRwb2ludCBhbmQgb25lIGlzIGFuIGludGVybWVkaWFy eS4gRm9yIHNvbWV0aGluZyB0byBiZSAiZW5kLXRvLWVuZCIsIGl0IHdpbGwgZXh0ZW5kIGZyb20g ZW5kcG9pbnQgdG8gZW5kcG9pbnQuIEFzIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGRvZXMg c2lnbmluZywgaXQgcmVxdWlyZXMgY3JlZGVudGlhbHMgdG8gcGVyZm9ybSB0aGUgc2lnbmF0dXJl LiBJbiBvcmRlciBmb3IgYW4gZW5kIHVzZXIncyBlbmRwb2ludCB0byBhY3QgYXMgYW4gYXV0aGVu dGljYXRpb24gc2VydmljZSwgdGhlIGVuZCB1c2VyIHRodXMgbmVlZHMgdG8gYmUgYWJsZSB0byBh Y3F1aXJlIGNyZWRlbnRpYWxzLiBUaGUgcmVzdCBvZiB0aGlzIHBhcmFncmFwaCBpcyBhYm91dCB3 aHkgdGhhdCBpc24ndCBzbyBlYXN5LiBJIGRvbid0IHRoaW5rIHRoaXMgaXMgZWl0aGVyIGluY29y cmVjdCBvciBwYXJ0aWN1bGFybHkgaGFyZCB0byBmb2xsb3cgZnJvbSB0aGUgdGV4dCB0aGF0IGlz IGFscmVhZHkgdGhlcmUuDQoNCjQgIkhvdyBpcyByZWZlcmVuY2UgdG8gVExTIG1lYW5pbmdmdWwg aGVyZT8iIFRoZSB1c2Ugb2YgVExTIHRvIHByb3RlY3QgdGhlIGZpcnN0IGhvcCBmcm9tIHRoZSB1 c2VyIGFnZW50IHRvIGFuIGludGVybWVkaWFyeS1iYXNlZCBhdXRoZW50aWNhdGlvbiBzZXJ2aWNl IGhhcyBzZWN1cml0eSBwcm9wZXJ0aWVzIHRoYXQgYXJlIGRpc2N1c3NlZCBsYXRlciBpbiB0aGUg ZG9jdW1lbnQsIGluIHBhcnRpY3VsYXIgaW4gU2VjdGlvbiAxMi40LiBCdXQgZm9yIHRoZSBwdXJw b3NlcyBvZiB0aGlzIG92ZXJ2aWV3IGhlcmUsIGl0IGlzIG1lcmVseSBleGVtcGxhcnkuDQoNCjQg VGhlIHNwZWMgcmVhZHMsICJUaGlzIHZhbHVlIGNvdWxkIGJlIEFsaWNlJ3MgQW9SLCBidXQgaW4g b3RoZXIgY2FzZXMgaXQgY291bGQgYmUgc29tZSBkaWZmZXJlbnQgdmFsdWUgdGhhdCB0aGUgYXV0 aGVudGljYXRpb24gc2VydmljZSBoYXMgYXV0aG9yaXR5IG92ZXIuIiBUbyB0aGlzIHRoZSByZXZp ZXcgc2F5cywgIlRoYXQgYml0IG9mIHZhZ3VlbmVzcyBpc24ndCBoZWxwZnVsLCBnaXZlbiB0aGUg bW90aXZhdGlvbiBmb3IgZG9pbmcgdGhpcyB3b3JrLiBJdCByZWR1Y2VzIHRvOiBzb21ldGhpbmcg d2lsbCBnZXQgYXV0aGVudGljYXRlZCwgYnV0IHdlIHdvbid0IHNheSB3aGF0IGFuZCB3ZSB3b24n dCBzYXkgd2hlcmUgdG8gZmluZCBvdXQuIiBCdXQgdGhlbiBpZiB5b3UgbGV0IHRoZSBzZW50ZW5j ZSBmaW5pc2gsIGl0IHJlYWRzLCAic3VjaCBhcyBhIHRlbGVwaG9uZSBudW1iZXIuIiBMaW5lLWJ5 LWxpbmUgcmV2aWV3cyBuZWVkIHRvIGJlIGFibGUgdG8ga2VlcCBlbm91Z2ggc3RhdGUgdG8gcmVh Y2ggdGhlIGVuZCBvZiB0aGUgc2VudGVuY2UuIFskXQ0KDQo0IE9uICJpbmZvPSIsIHRoZSByZXZp ZXcgcmVhZHMsICJBIHNjaGVtZSB0aGF0IGhhcyBhbiB1bnRydXN0ZWQgb2JqZWN0IGNhcnJ5aW5n IGluZm9ybWF0aW9uIGFib3V0IHdoZXJlIHRvIGZpbmQgdHJ1c3QgaW5mb3JtYXRpb24gZm9yIHRo ZSBvYmplY3Qgc291bmRzICBsaWtlIGEgc2VyaW91cyBzZWN1cml0eSBob2xlLiBXaHkgc2hvdWxk IHRoZSBwb2ludGVyIGJlIHRydXN0ZWQ/IiBUaGlzIGlzIGEgY29tbWVudCB0aGUgcmV2aWV3ZXIg aGFzIHJhaXNlZCBiZWZvcmUsIHdpbGwgcmFpc2UgYWdhaW4gYmVsb3cgaW4gdGhlIGNvbW1lbnRz IG9uIDYuMi4gVGhlIHNob3J0IGFuc3dlciBpcyB0aGF0IHRoZXJlIGlzIG5vIHNlY3VyaXR5IGhv bGUsIGJ1dCBhIGxvbmcgcmVzcG9uc2Ugd2lsbCB3YWl0IGZvciA2LjIgKGlmIHdlIGNhbiB1c2Ug YSBmb3J3YXJkIHJlZmVyZW5jZSBoZXJlKS4gVGhpcyBpcyBqdXN0IGEgc2VjdGlvbiBzYXlpbmcg aG93IHRoZSBtZWNoYW5pc20gb3BlcmF0ZXMsIG5vdCB3aHkgdGhlIG1lY2hhbmlzbSBvcGVyYXRl cyB0aGUgd2F5IGl0IGRvZXMuDQoNCjQgIkh1Z2Ugb3BlcmF0aW9uYWwgdHJhbnNpdGlvbiBxdWVz dGlvbjogSG93IGlzIHRoZSBhYnNlbmNlIG9mIHRoZSBzaWduYXR1cmUgdHJlYXRlZD8gVG9kYXks IHRoZXJlIGFyZSBubyBzaWduYXR1cmVzLiBUb21vcnJvdyB0aGVyZSBtaWdodCBiZSBzb21lLCBi b3RoIGl0IHdvbid0IGJlIHRydWUgdGhhdCAvYWxsLyBpbmNvbWluZyByZXF1ZXN0cyBhcmUgc2ln bmVkLiBTbyBob3cgaXMgdGhlIHJlY2VpdmVyIHN1cHBvc2VkIHRvIGhhbmRsZSB0aGUgYWJzZW5j ZSBvZiBhIHNpZ25hdHVyZT8iIFRoZSBhY3R1YWwgcG9saWNpZXMgdGhhdCBTSVAgZW50aXRpZXMg YXBwbHkgdG8gcmVxdWVzdHMgaW4gdGhlIHByZXNlbmNlIG9yIGFic2VuY2Ugb2YgdGhlIElkZW50 aXR5IGhlYWRlciBhcmUgb3V0c2lkZSB0aGUgc2NvcGUgb2YgdGhpcyBzcGVjaWZpY2F0aW9uLCBh cyBpcyBjbGVhcmx5IHN0YXRlZCBhdCB0aGUgZW5kIG9mIDUuMi4gVGhlIHNob3J0IGFuc3dlciBp cyB0aGF0IHRoaXMgaXMgYW4gb3Zlci10aGUtd2lyZSBwcm90b2NvbCBzcGVjLCBhbmQgdGhhdCBh cyBzdWNoLCBpdCBpcyBhbHJlYWR5IGNvbXBsZXggZW5vdWdoIHdpdGhvdXQgZGlwcGluZyBpbnRv IHRob3NlIG1hdHRlcnMuIEJ1dCBhZ2FpbiwgU2VjdGlvbiA0IHByb2JhYmx5IHdvdWxkbid0IGJl IHRoZSByaWdodCBwbGFjZSB0byBleHBsb3JlIHRoYXQgcXVlc3Rpb24gYW55d2F5Lg0KDQo0ICJJ cyBldmVyeW9uZSBjZXJ0YWluIHRoYXQgdHJhbnNpdCBvZiB0aGUgcmVxdWVzdCB3aWxsIC9uZXZl ci8gYnJlYWsgdGhlIHNpZ25hdHVyZT8gV2hhdCBpcyB0aGUgYmFzaXMgZm9yIHRoYXQgYXNzZXNz bWVudD8gQW5kIGlmIGEgc2lnbmF0dXJlIC9jYW4vIGJyZWFrLCB0aGVuIHRoZSBpbnRlcnByZXRh dGlvbiBvZiBhbiBpbnZhbGlkIHNpZ25hdHVyZSBjb3VsZCBtZWFuIGVpdGhlciBzcG9vZmluZyBv ciBvcGVyYXRpb25hbCBlcnJvci4iIFdlIGFyZSBjZXJ0YWluIHRoYXQsIHdpdGggc29tZSBleGNl cHRpb25zIGRldGFpbGVkIGluIHRoZSBkb2N1bWVudCwgd2Ugd2FudCB0byB0cmVhdCB0aGUgYnJl YWtpbmcgb2YgdGhlIHNpZ25hdHVyZSBpbiB0cmFuc2l0IGFzIGEgc2VjdXJpdHkgdmlvbGF0aW9u LCByZWdhcmRsZXNzIG9mIHdoeSBpdCBoYXBwZW5zLiBDaXJjdW1zdGFuY2VzIGluIHdoaWNoIHRo ZSBzaWduYXR1cmUgbWlnaHQgYmUgYnJva2VuIGFyZSBkaXNjdXNzZWQgdGhyb3VnaG91dCB0aGUg c3BlY2lmaWNhdGlvbi4gSW4gZmFjdCwgdGhlIG1lbnRpb24gb2YgdGhpcyBpbiB0aGUgbGFzdCBw YXJhZ3JhcGggb2YgU2VjdGlvbiAxIGlzIG9uZSBvZiB0aGUgcmVhc29ucyB3aHkgdGhhdCB0ZXh0 IG5lZWRzIHRvIHN0YXkgaW4gdGhlIHNwZWNpZmljYXRpb24uIFRoaXMgZW50aXJlIGVmZm9ydCwg YXMgdGhlIFNUSVIgcHJvYmxlbSBzdGF0ZW1lbnQgKFJGQzczNDApIHNheXMsIHdhcyBsYXJnZWx5 IG1vdGl2YXRlZCBieSB0cnlpbmcgdG8gbWluaW1pemUgc2lnbmF0dXJlIGJyZWFrYWdlLiBJdCBp cyBuaWNlIHRoYXQgdGhlIG92ZXJ2aWV3IG9mIG9wZXJhdGlvbnMgYXQgbGVhc3QgaW5zcGlyZXMg dGhlc2UgcXVlc3Rpb25zLCB3aGljaCBhcmUgdGhlIHJpZ2h0IHNvcnRzIG9mIHF1ZXN0aW9ucyB0 byBiZSBhc2tpbmcgYWJvdXQgYSBtZWNoYW5pc20gbGlrZSB0aGlzLiBTdWZmaWNlIGl0IHRvIHNh eSB0aGF0IHdlJ3ZlIHRob3VnaHQgYWJvdXQgdGhlIHBhc3QgdGhyZWUgcXVlc3Rpb25zIGEgbG90 IG92ZXIgdGhlIHllYXJzIC0gdGhlc2UgYXJlbid0IGV4YWN0bHkgbmV3IGlzc3VlcyBiZWluZyBy YWlzZWQuIA0KDQo1LjEgImhvdyBpcyBpdHMgbm90IGJlaW5nIGEgdGVsZXBob25lIG51bWJlciBk ZXRlcm1pbmVkIGRldGVybWluaXN0aWNhbGx5IGFuZCBjb3JyZWN0bHk/IiBCeSBmb2xsb3dpbmcg dGhlIHByb2NlZHVyZXMgaW4gU2VjdGlvbiA3LiANCg0KNS4xICJUaGVuIHdoZXJlIGRvZXMgdGhl IG5vbi1yZXB1ZGlhdGlvbiBmZWF0dXJlIG9mIFNUSVIgY29tZSBmcm9tPyIgVGhpcyByZXBsaWVz IHRvIHRleHQgYWJvdXQgaG93ICJ0aGUgSWRlbnRpdHkgaGVhZGVyIGlzIG5vdCBpbnRlbmRlZCB0 byBwcm92aWRlIGEgc291cmNlIG9mIG5vbi1yZXB1ZGlhdGlvbiBvciBhIHBlcmZlY3QgcmVjb3Jk IG9mIHdoZW4gbWVzc2FnZXMgYXJlIHByb2Nlc3NlZC4iIFRoaXMgaXMgdGhlIG9ubHkgdXNlIG9m IHRoZSB0ZXJtICJub24tcmVwdWRpYXRpb24iIGluIHJmYzQ0NzRiaXMtMTAsIGFuZCB0aGUgdGVy bSBkb2VzIG5vdCBhcHBlYXIgaW4gUkZDNzM3NSBvciBSRkM3MzQwLCBhcyBub24tcmVwdWRpYXRp b24gaXMgbm90IGEgcmVxdWlyZW1lbnQgbmVlZGVkIHRvIGFkZHJlc3MgdGhlIHRocmVhdHMgZm9y IHdoaWNoIFNUSVIgd2FzIGRlc2lnbmVkLiBXaGlsZSBQQVNTcG9yVCBjb250YWlucyBzb21lIGxh bmd1YWdlIGFib3V0IGl0cyBwb3RlbnRpYWwgdXNlIGZvciBub24tcmVwdWRpYXRpb24sIGRvIG5v dGUgdGhlIGZpcnN0IHBhcmFncmFwaCBvZiBTZWN0aW9uIDcuMiBvZiBQQVNTcG9yVC4gU28gaW4g c2hvcnQsIEknbSBub3QgYXdhcmUgdGhhdCBTVElSIGhhcyBvciBoYXMgZXZlciBpbnRlbmRlZCB0 byBoYXZlIHRoYXQgImZlYXR1cmUiLg0KDQo1LjEgIlRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNl IGRvZXMgc2VuZGluZz8gSSB0aGluayBpdCBkb2Vzbid0LCBhbmQgdGhlIGRlZmluaXRpb24gb2Yg aXRzIHJvbGVzIGltcGxpZXMgdGhhdCBpdCBkb2Vzbid0LCBidXQgcmF0aGVyIHRoYXQgaXQgaXMg cGFydCBvZiBvbmUgb3IgYW5vdGhlciBtb2R1bGUgdGhhdCBkb2VzLiIgVGhpcyBpcyB3aHksIHdo ZW4gd2UncmUgc3BlYWtpbmcgc3RyaWN0bHksIHdlIHNheSB0aGluZ3MgbGlrZSAidGhlIGVudGl0 eSB3aGljaCBpbnN0YW50aWF0ZXMgdGhlIHJvbGUgb2YgdGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZp Y2UiIGluc3RlYWQgb2YgInRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlLiIgSWYgdGhhdCBlbnRp dHkgaXMgYSBwcm94eSBzZXJ2ZXIsIHRoZW4geWVzLCBpbiBjZXJ0YWluIFNJUCBjYXNlcywgZXZl biB0aG91Z2ggaXQgaXMgYW4gaW50ZXJtZWRpYXJ5LCBpdCBjYW4gcmVzZW5kIGEgcmVxdWVzdCBp biByZXNwb25zZSB0byBjZXJ0YWluIGZhaWxlZCByZXNwb25zZSBjb2RlcyBpdCByZWNlaXZlcy4g U28gd2hlbiB0aGUgcmV2aWV3IHNheXMgImhlbmNlIGl0IGRvZXNuJ3QgZG8gcmV0cmllcy4gQWxs IG9mIHRoaXMgbmVlZHMgdG8gYmUgcmVjYXN0IGluIHRlcm1zIHRoYXQgbWF0Y2ggdGhlIHNwZWNp ZmllZCBhcmNoaXRlY3R1cmUiLCBpdCBkb2VzIGRvIHJldHJpZXMgYW5kIGl0IGRvZXMgbWF0Y2gg dGhlIGFyY2hpdGVjdHVyZS4gVGhpcyBiZWhhdmlvciBlbnRlcmVkIHRoZSBzcGVjaWZpY2F0aW9u IGFzIGEgcmVzdWx0IG9mIHNwZWNpZmljIGlzc3VlcyBzZWVuIHRoZSB3aWxkIHdpdGggZWFybHkg ZGVwbG95bWVudHMgb2YgdGhpcyBjb2RlLCBhbmQgd2hpbGUgdGhlIHJldmlldyBvYmplY3RzLCAi VGhpcyBpcyBqdXN0IGd1ZXNzaW5nLiBQcm90b2NvbHMgdGhhdCBkbyBndWVzc2luZyBkb24ndCB3 b3JrIHZlcnkgd2VsbCIgYW5kIHRoYXQgIlRoaXMgaW50ZXJhY3Rpb24gbmVlZHMgdG8gYmUgcmUt c3BlY2lmaWVkIHRvIGJlIGRldGVybWluaXN0aWMiLCBpdCBpcyBiZWxpZXZlZCB0aGF0IHRoaXMg YmVoYXZpb3Igd29ya3MgYW5kIHRoYXQgaXQgaXMgc3BlY2lmaWVkIHRpZ2h0bHkgZW5vdWdoLiBU aGUgc2FtZSBwcm9ibGVtIHdpdGggInRoZSBlbnRpdHkgd2hpY2ggaW5zdGFudGlhdGVzIHRoZSBy b2xlIG9mIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIiB2cy4gInRoZSBhdXRoZW50aWNhdGlv biBzZXJ2aWNlIiBpcyB3aHkgdGhlIG9iamVjdGlvbiBpbiB0aGUgcmV2aWV3IHRvIHRoZSB0ZXh0 IHRoYXQgInRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIE1VU1QgZm9yd2FyZCB0aGUgbWVzc2Fn ZSIgaXMgc2ltaWxhcmx5IG1pc2d1aWRlZC4NCg0KNS4yIEVhcmx5IGluIHRoZSBzZWN0aW9uLCB0 aGUgcmV2aWV3IHBvc3R1bGF0ZXMgdGhhdCwgIlN0ZXAgNSwgYmVsb3csIHNwZWNpZmllcyBhIGJl aGF2aW9yIHRoYXQgaXMgd2l0aGluIHNjb3BlIiB0byBjb3VudGVyIHRoZSBwcmV2aW91cyBzcGVj IHRleHQgcmVmZXJyaW5nIHRvICJhbiBhdXRob3JpemF0aW9uIHByb2Nlc3MgdGhhdCBpcyBvdXRz aWRlIHRoZSBzY29wZSBvZiB0aGlzIGRvY3VtZW50LiIgTmljZSB0byBzZWUgYSBiaXQgb2Ygc3Rh dGUgcmF0aGVyIHRoYW4gdGhlIHVzdWFsIGxpbmUtYnktbGluZSBjb21tZW50cy4gQnV0IGFjdHVh bGx5LCB3aGF0IFN0ZXAgNSBzYXlzIGlzIHRoYXQgInRoZSB2ZXJpZmljYXRpb24gb2YgYW4gSWRl bnRpdHkgaGVhZGVyIGRvZXMgbm90IGVudGFpbCBhbnkgcGFydGljdWxhciB0cmVhdG1lbnQgb2Yg dGhlIHJlcXVlc3QiLCB0aGF0ICJ0aGlzIHNwZWNpZmljYXRpb24gZG9lcyBub3QgcHJvcG9zZSBh bnkgYXV0aG9yaXphdGlvbiBwb2xpY3kiIGFuZCB0aGF0ICJsb2NhbCBwb2xpY3kiIGlzIHJlc3Bv bnNpYmxlIGZvciBkZWNpZGluZyB3aGF0IGlzIGF1dGhvcml6ZWQuIFN0ZXAgNSBkb2VzIHRhbGsg YSBiaXQgYWJvdXQgY2lyY3Vtc3RhbmNlcyBpbiB3aGljaCBhbiBJZGVudGl0eSBoZWFkZXIgZmll bGQgdmFsdWUgaXMgImludmFsaWQiIC0gYnV0IHRoZSB0ZXh0IGlzIGFsc28gY2xlYXIgdGhhdCBp dCBwcm9wb3NlcyBubyBhdXRob3JpemF0aW9uIGRlY2lzaW9uIGJhc2VkIG9uICJ0aGUgcHJlc2Vu Y2Ugb2YgYW4gaW52YWxpZCBJZGVudGl0eSBoZWFkZXIuIiANCg0KNS4yIFJldmlldyBhc2tzLCAi V2hhdCBkb2VzIGl0IG1lYW4gdG8gJ25vdCBzdXBwb3J0IGFuIElkZW50aXR5IGhlYWRlciBbZmll bGRdJz8iIGJ5IGN1dHRpbmcgb2ZmIHRoZSBzZW50ZW5jZSwgYXMgdXN1YWwuIFRoZSBzZW50ZW5j ZSBpbiBmdWxsIHJlYWRzICJub3Qgc3VwcG9ydCBhbiBJZGVudGl0eSBoZWFkZXIgcHJlc2VudCBp biBhIHJlcXVlc3QgZHVlIHRvIHRoZSBwcmVzZW5jZSBvZiBhbiB1bnN1cHBvcnRlZCAncHB0JyBw YXJhbWV0ZXIuIiBJbnRlcmplY3RpbmcgIndoYXQgZG9lcyB0aGlzIG1lYW4iIGluIHRoZSBtaWRk bGUgb2YgYSBzZW50ZW5jZSB3aGVuIHRoZSBjb250aW51YXRpb24gb2YgYSBzZW50ZW5jZSB0ZWxs cyB5b3Ugd2hhdCBpdCBtZWFucyBpcyBhIGNvdW50ZXJwcm9kdWN0aXZlIG1ldGhvZCBvZiByZXZp ZXcsIGluc3RhbmNlcyBvZiB3aGljaCBvY2N1ciBoZXJlIHdpdGggbW91bnRpbmcgZnJlcXVlbmN5 LiBZb3UgZG9uJ3Qgc3VwcG9ydCBhbiBJZGVudGl0eSBoZWFkZXIgKGZpZWxkIHZhbHVlLCByZWFs bHkpIGlmIGl0IGNvbnRhaW5zIGEgInBwdCIgeW91IGRvbid0IHN1cHBvcnQuIFskXQ0KDQoqIDUu MiBUaGUgcmV2aWV3IGFza3MsICJXaHkgbWlnaHQgdGhlcmUgYmUgbXVsdGlwbGUgSWRlbnRpdHkg aGVhZGVyIFtmaWVsZHNdPyBIb3cgbWlnaHQgdGhleSBkaWZmZXI/IiBJJ2xsIGFncmVlIHRoYXQg dGhpcyBpc24ndCBtb3RpdmF0ZWQgaW4gUkZDNDQ3NGJpcy0xMC4gSXQgaXMgdGhlcmUgZm9yIGZv cndhcmQgY29tcGF0aWJpbGl0eTsgd2UgaW1hZ2luZSB0aGF0IGV4dGVuc2lvbnMgKGRpZmZlcmVu dCAicHB0InMpIG1pZ2h0IGJlIGluY2x1ZGVkIGluIGEgbWVzc2FnZSBieSBkaWZmZXJlbnQgYXV0 aGVudGljYXRpb24gc2VydmljZXMsIG9yIHRoYXQgZGlmZmVyZW50IHRydXN0IGFuY2hvcnMgbWln aHQgcHJvdmlkZSBJZGVudGl0eSBoZWFkZXJzIHRoYXQgd291bGQgYmUgdHJ1c3RlZCBieSBkaWZm ZXJlbnQgcmVjaXBpZW50cy4gV2UncmUgbm90IHJlYWxseSBnb2luZyBkb3duIHRob3NlIHBhdGhz IGF0IHRoZSBtb21lbnQsIHdlIGp1c3QgZGlkbid0IHdhbnQgdG8gY2xvc2UgdGhlIGRvb3Igb24g dGhlbS4gU3RpbGwsIEkgY2FuIHNlZSBpdCBtaWdodCBiZSBoZWxwZnVsIHRvIGhhdmUgYSBwYXJh Z3JhcGggb2YgKGdhc3ApIGZvd2FyZC1sb29raW5nIG1vdGl2YXRpb24gYWJvdXQgZnV0dXJlIHdv cmsgZm9yIHRoaXMgc29tZXdoZXJlIGluIHRoZSBzcGVjIC0gcHJvYmFibHkgaW4gU2VjdGlvbiA5 IChvbiBleHRlbnNpYmlsaXR5KS4gDQoNCjUuMiBPbiBTdGVwIDMsIHRoZSByZXZpZXcgZGVub3Vu Y2VzIHRoZSBzb2Z0IGd1aWRhbmNlIGluIHRoZSBzcGVjIHRoYXQgYSB2ZXJpZmllciBtZXJlbHkg InNob3VsZCIgY29uc2lkZXIgYSBjcmVkZW50aWFsIGZvciB0aGlzIGhlYWRlciB1bnN1cHBvcnRl ZCBpZiBpdCBkb2VzIG5vdCBzdXBwb3J0IHRoZSBjcmVkZW50aWFsIGRlc2NyaWJlZCBpbiB0aGUg ImluZm8iIHBhcmFtZXRlci4gIk9ubHkgc2hvdWxkPyBXaHk/Pz8iIFdlbGwsIGFzIHRoZSByZWZl cmVuY2UgdG8gNi4yIGluIHRoZSBwcmV2aW91cyBzZW50ZW5jZSB3b3VsZCByZXZlYWwgaWYgZm9s bG93ZWQsIHZlcmlmaWVycyBtYXkgaGF2ZSBhbHRlcm5hdGl2ZSBtZWFucyB0byBnYWluIGFjY2Vz cyB0byBjcmVkZW50aWFscyBhc3NvY2lhdGVkIHdpdGggYW4gaWRlbnRpdHkgdGhhbiB0aGUgY29u dGVudHMgb2YgdGhlICJpbmZvIiBwYXJhbWV0ZXIsICJzdWNoIGFzIGFuIG9mZmxpbmUgc3RvcmUg b2YgcGVyaW9kaWNhbGx5LXVwZGF0ZWQgY3JlZGVudGlhbHMiIG9yIHNvbWV0aGluZy4gU28gZGlz Y292ZXJpbmcgdGhlIGNyZWRlbnRpYWwgdGhvdWdoICJpbmZvIiBpcyBvbmx5IGEgU0hPVUxEIGlu IHNlY3Rpb24gNi4yLCB3aGljaCB0cmlja2xlcyBkb3duIHRvIGhlcmUuIExpbmUtYnktbGluZSBp cyBub3QgaGVscGluZyBoZXJlLiBbJF0NCg0KNS4yIFN0ZXAgMyAidmVyaWZpZXIgcmV0dXJucyBy ZXNwb25zZXM/IiBXZWxsLCB5ZXMsIGluIHRoZSBzZW5zZSB0aGF0ICJ0aGUgZW50aXR5IHRoYXQg aW5zdGFudGlhdGVzIHRoZSB2ZXJpZmljYXRpb24gc2VydmljZSByb2xlIiByZXR1cm5zIHJlc3Bv bnNlcy4gTm90ZSB0aGF0IHdlIGhhdmUgdGhlIHNhbWUgbGFuZ3VhZ2UgaGVyZSBpbiA1LjIgYXMg d2UgZGlkIGluIDUuMSByaWdodCBiZWZvcmUgdGhlIHN0ZXBzIHN0YXJ0IHRvIHJlbWluZCByZWFk ZXJzIG9mIHRoaXMuDQoNCjUuMiBTdGVwIDUsIHRoZSByZXZpZXcgZXhjbGFpbXMsICJJdCBhcHBl YXJzIHRoYXQgdGhlIHNwZWNpZmljYXRpb24gaXMgY2FsbGluZyBmb3IgdHdvIChvciBtb3JlPz8/ KSBkaWZmZXJlbnQgbWV0aG9kcyBvZiBkb2luZyBzaWduYXR1cmUgdmFsaWRhdGlvbiwgZGVwZW5k aW5nIHVwb24gd2hldGhlciBwcHQgaXMgcHJlc2VudC4gVGhpcyBzZWVtcyBsaWtlIGFuIG91dHN0 YW5kaW5nbHkgYmFkIGlkZWEuIEl0IGNyZWF0ZXMgY29tcGxleGl0eSBhbmQgcG9zc2libHkgZXZl biBvdXRyaWdodCBjb25mdXNpb24uIiBJZiAicHB0IiBpcyBwcmVzZW50LCBhbGwgdGhhdCB3aWxs IG1lYW4gaXMgdGhhdCBwb3RlbnRpYWxseSBhZGRpdGlvbmFsbHkgaGVhZGVycyAoSldUIGhlYWRl cnMgdGhhdCBpcykgd2lsbCBiZSBwcmVzZW50LCB3aGljaCBjb3JyZXNwb25kIHRvIGNvbXBvbmVu dHMgb2YgYSBTSVAgcmVxdWVzdC4gQW55IFBBU1Nwb3JUIHdpbGwgYWx3YXlzIGJlIGEgc3VwZXJz ZXQgb2YgdGhlICJiYXJlIG1pbmltdW0iIGhlYWRlcnMgYW5kIGNsYWltcywgc28gcmVhbGx5IHdo YXQgdGhlICJwcHQiIG1lYW5zIGlzIHRoYXQgc29tZXRoaW5nIGluIGFkZGl0aW9uIHRvIHRob3Nl IGhhcyBiZWVuIHNpZ25lZC4gSXQgd291bGQgYmUgYXMgaWYsIHNheSwgREtJTSBhbGxvd2VkIG9u ZSB0byBzcGVjaWZ5IGEgbGlzdCBvZiBoZWFkZXIgZmllbGRzIHRoYXQgd2VyZSBzaWduZWQgaW4g YW4gImg9IiBwYXJhbWV0ZXIsIHdoaWNoIHRoZW4gbGlzdGVkIHRoZSBlbWFpbCBoZWFkZXJzIGlu IHF1ZXN0aW9uLiBFeGNlcHQgaW4gb3VyIGNhc2UsIGl0IGFzc3VtZXMgYSBiYXNlbGluZSBzZXQg b2YgaGVhZGVycywgYW5kIHRoZSAicHB0IiBpcyBlZmZlY3RpdmVseSBhIHByb2ZpbGUgdGhhdCBp bXBsaWVzIHdoYXQgYWRkaXRpb25hbCBoZWFkZXJzIGhhdmUgYmVlbiBpbmNsdWRlZCBpbiB0aGUg c2NvcGUgb2YgdGhlIHNpZ25hdHVyZS4gSSB1bmRlcnN0YW5kIHdoeSBpdCBtaWdodCBzZWVtIGxp a2UgImFuIG91dHN0YW5kaW5nbHkgYmFkIGlkZWEiIGFuZCBpbiBmYWN0IGZvciB5ZWFycyAtIG1h eWJlIG1vcmUgdGhhbiBhIGRlY2FkZSAtIEkgaGVsZCBvdXQgYWdhaW5zdCBoYXZpbmcgYW55dGhp bmcgYnV0IGEgZml4ZWQgc2lnbmF0dXJlLiBPdXIgImJhcmUgbWluaW11bSIgaXMgdGhlIGNvbXBy b21pc2UgdGhhdCBhbGxvd2VkIHVzIHRvIG1vdmUgZm9yd2FyZCwgd2hpbGUgYWNjb21tb2RhdGlu ZyBzb21lIGltcG9ydGFudCBhcHBsaWNhdGlvbnMgdGhhdCBwYXJ0aWNpcGFudHMgaW4gdGhlIHdv cmtpbmcgZ3JvdXAgd2FudCB0byBhcHBseSB0aGlzIHRvIHdpdGggInBwdCIgZXh0ZW5zaW9ucy4g SSB3b3VsZCBwcmVmZXIgYSAic2luZ2xlIGFsZ29yaXRobSIsIGFuZCBpbmRlZWQgSSB0aGluayB3 ZSBkbyBoYXZlIG9uZSBhcyB5b3Ugc3VnZ2VzdCwgb25lIHdoZXJlICJjb21wb25lbnRzIG9mIHRo ZSBhbGdvcml0aG0gaGF2ZSBicmFuY2hlcy4iICJwcHQiIGlzIGp1c3Qgb25lIG9mIHRob3NlIGJy YW5jaGVzLiANCg0KNS4yIHBvc3QgU3RlcCA1LCAiU28gaXQncyBvayB0byBoYXZlIG5vIElkZW50 aXR5IGhlYWRlciBmaWVsZHMgYnV0IGl0J3Mgbm90IG9rIHRvIGhhdmUgaWRlbnRpdHksIHdoZXJl IG5vbmUgdmFsaWRhdGUuIFRoaXMgbWVhbnMgdGhhdCB0aGUgZW50aXJlIHRyYW5zZmVyIGVudmly b25tZW50IGlzIGV4cGVjdGVkIGFuZCByZXF1aXJlZCB0byBjb252ZXkgSWRlbnRpdHkgZmllbGRz IHBlcmZlY3RseSwgYWxsIHRoZSB0aW1lLiIgSXQgbWVhbnMgdGhhdCB0aGVyZSBpcyBhIHZlcnkg cmVhbCBzZWN1cml0eSBkaWZmZXJlbmNlIGJldHdlZW4gSWRlbnRpdHkgbm90IGJlaW5nIHVzZWQg YXQgYWxsICh3aGljaCBtZWFucyB5b3UgaGF2ZSBubyBhc3N1cmFuY2UgZWl0aGVyIHdheSkgYW5k IElkZW50aXR5IGZpZWxkcyBiZWluZyBwcmVzZW50IGJ1dCBicm9rZW4gKHdoaWNoIG1lYW5zIHNv bWVvbmUgaXMgdHJ5aW5nIHRvIHVzZSB0aGUgbWVjaGFuaXNtLCBhbmQgZWl0aGVyIGFuIG9wZXJh dGlvbmFsIG9yIHNlY3VyaXR5IHByb2JsZW0gaGFzIGFyaXNlbikuIFdoeSBvbiBlYXJ0aCB0aGlz IHdvdWxkIGVudGFpbCB0aGF0ICJ0aGUgZW50aXJlIHRyYW5zZmVyIGVudmlyb25tZW50IGlzIGV4 cGVjdGVkIGFuZCByZXF1aXJlZCB0byBjb252ZXkgSWRlbnRpdHkgZmllbGRzIHBlcmZlY3RseSwg YWxsIHRoZSB0aW1lIiBpcyBiZXlvbmQgbWUuIElkZW50aXR5IGhlYWRlcnMgd2lsbCBiZSBkcm9w cGVkIGJ5IHNvbWUgZXhpc3RpbmcgZGV2aWNlcyB0b2RheSB3aGljaCBzdHJpcCBhbnkgaGVhZGVy cyB0aGV5IGRvbid0IHJlY29nbml6ZSwgZm9yIGV4YW1wbGUuIEFuZCAiY2Fub24iIHdpbGwgZmls bCBpbiBnYXBzIGluIHNvbWUgb3RoZXIgY2FzZXMuDQoNCjUuMi4xIFRoZSByZXZpZXcgaW50ZXJq ZWN0cyB3aXRoIHNvdW5kIGFuZCBmdXJ5IHdoZW4gdGhlIHNwZWMgcmVhZHMgdGhhdCAidGhlIHZl cmlmaWNhdGlvbiBzZXJ2aWNlIE1BWSBjb21wdXRlIGl0cyBvd24gY2Fub25pY2FsaXphdGlvbiBv ZiB0aGUgbnVtYmVycyIuICInTUFZJz8/PyIgdGhlIHJldmlldyBjcmllcyBpbmNyZWR1bG91c2x5 LiAiSSBkb24ndCB1bmRlcnN0YW5kIG1ha2luZyBjYW5vbmljYWxpemF0aW9uIG9wdGlvbmFsLCBl aXRoZXIgZHVyaW5nIHNpZ25pbmcgb3IgZHVyaW5nIHZlcmlmaWNhdGlvbi4iIEl0IHJlYWxseSBo ZWxwcyBpZiB5b3UgcmVhZCB0aGUgcmVzdCBvZiB0aGUgc2VudGVuY2UuIFdoYXQgaXQgc2F5cyBp cyB0aGF0IHlvdSBNQVkgY29tcHV0ZSBpdCAiLWJlZm9yZS0gcGVyZm9ybWluZyBhbnkgY3J5cHRv Z3JhcGhpYyBmdW5jdGlvbnMgaW4gb3JkZXIgdG8gYXNjZXJ0YWluIHdoZXRoZXIgb3Igbm90IHRo ZSB0d28gZW5kcyBhZ3JlZSBvbiB0aGUgY2Fub25pY2FsIGZvcm0uIiBDbGVhcj8gV2hhdCBpbXBs ZW1lbnRhdGlvbnMgTUFZIGRvIGlzIHRvIHBlcmZvcm0gdGhhdCBjb21wYXJpc29uIC1iZWZvcmUt IGFueSBoYXJkIG51bWJlciBjcnVuY2hpbmcuIFJhdGhlciB0aGFuIGRvaW5nIGl0IGFmdGVyLiBS ZWFkaW5nIHRoZSB3aG9sZSBzZW50ZW5jZSBoZWxwcy4gWyRdDQoNCiMgNS4yLjEgV2hlbiB0aGUg c3BlYyBub3RlcyBob3cgdGhlICJjYW5vbiIgcmVzZW5kIHRyaWNrICJ3aWxsIHByZXZlbnQgc29t ZSB1bm5lY2Vzc2FyeSB2ZXJpZmljYXRpb24gZmFpbHVyZXMsIiB0aGUgcmV2aWV3IGNvdW50ZXJz LCAiQnV0IGl0IHdvbid0IHByZXZlbnQgb3RoZXJzLiBUaGlzIG1lYW5zIHRoYXQgc2lnbmF0dXJl cyB0aGF0IHdlcmUgdmFsaWQgd2lsbCBicmVhay4gQW5kIHRoaXMgb3VnaHQgdG8gbWl0aWdhdGUg dGhlIGhhbmRsaW5nIG9mIGJyb2tlbiBzaWduYXR1cmVzLiIgSW5kZWVkLCBhcyB0aGUgbGFzdCBw YXJhZ3JhcGggb2YgU2VjdGlvbiAxIHN0YXRlcywgdGhlICJyZXZpc2l0ZWQiIGluICJTVElSIiBk ZXJpdmVkIGZyb20gdGhlIGZhY3QgdGhhdCAiUkZDIDQ0NzQgYWxzbyBwcm92aWRlZCBhIHNpZ25h dHVyZSBvdmVyIG1hdGVyaWFsIHRoYXQgaW50ZXJtZWRpYXJpZXMgaW4gZXhpc3RpbmcgZGVwbG95 bWVudHMgY29tbW9ubHkgYWx0ZXJlZCwiIHdoaWNoIGxlZCB0byB1bm5lY2Vzc2FyeSB2ZXJpZmlj YXRpb24gZmFpbHVyZXMsIGFuZCBmb3IgdXMgdG8gcmV2aXNpdCB0aGUgc2lnbmF0dXJlIHNjb3Bl LiBUaGUgc2lnbmF0dXJlIHNjb3BlIHdlIGhhdmUgbm93IGlzIHRoZSBiZXN0IG9uZSB3ZSB0aGlu ayB3ZSBjYW4gcHJvcG9zZS4gV2UgZG8gYmVsaWV2ZSB0aGF0ICJjYW5vbiIgaGVscHMgdG8gbWl0 aWdhdGUgdGhlIG1lYW5pbmdmdWwgY2F1c2VzIG9mIHVubmVjZXNzYXJ5IGZhaWx1cmVzLiBUaGUg b3ZlcmFsbCBtZWNoYW5pc20gaGFzIGdvbmUgdGhyb3VnaCBhIGdyZWF0IGRlYWwgb2Ygd29ya2lu ZyBncm91cCBzY3J1dGlueSBhbmQgYWxzbyBpbXBsZW1lbnRhdGlvbiBhbmQgZGVwbG95bWVudCB0 ZXN0aW5nLiBJJ3ZlIHBlcnNvbmFsbHkgcnVuIGl0IG92ZXIgbGl2ZSBTSVAgbmV0d29ya3MuIENh c3RpbmcgdmFndWUgZG91YnQgb24gaXQsIHdoaWxlIGl0IGlzIGVhc3kgdG8gZG8gYW5kIGl0IHBh ZHMgb3V0IHRoZSBsaXN0IG9mIGNvbW1lbnRzLCBpcyBub3QgcGVyc3Vhc2l2ZS4gVGhpcyBpcyBJ IHRoaW5rIHRoZSBvbmx5IHBsYWNlIHNvIGZhciBpbiB0aGlzIHJldmlldyB3aGVyZSBJIGhhdmUg YXNrZWQgZm9yIG1vcmUgaW5mb3JtYXRpb24sIGJ1dCBpZiB5b3UgYWN0dWFsbHkgaGF2ZSBzb21l dGhpbmcgc3Vic3RhbnRpdmUgdG8gc2F5IGFib3V0IHRoaXMsIHBsZWFzZSBzYXkgaXQsIHJhdGhl ciB0aGFuIGp1c3QgZGFya2x5IGhpbnRpbmcgYXQgc3R1ZmYgeW91IGtub3cgdGhhdCB3ZSBwcmVz dW1hYmx5IGRvbid0Lg0KDQo2LjIgVGhlIHJldmlldyBoZXJlIGluc2lzdHMsICJJIC9yZWFsbHkv IGRvbid0IHVuZGVyc3RhbmQgdGhlIHRydXN0IG1vZGVsIHRoYXQgaGFzIGEgc2VjdXJpdHkgc2No ZW1lIHdoZXJlIHRoZSBvYmplY3QgZ2l2aW5nIGEgcG9pbnRlciB0byBpdHMgb3duIGNyZWRlbnRp YWwuIE9yIHJhdGhlciwgSSBmZWFyIHRoYXQgSSBkbyB1bmRlcnN0YW5kIGl0LCBidXQgZG9uJ3Qg dW5kZXJzdGFuZCB3aHkgaXRzIGNvbnNpZGVyZWQgY3JlZGlibGUuIiBBcyBJIHJlbWVtZWJlciBk aXNjdXNzaW5nIHRoaXMgd2l0aCB0aGUgcmV2aWV3ZXIgb24gYXQgbGVhc3Qgb25lIHByZXZpb3Vz IG9jY2FzaW9uLCBJIGRvIGdhdGhlciB0aGlzIGlzIGEgc3ViamVjdCBvZiBzb21lIGNvbmZ1c2lv bi4gUmVseWluZyBwYXJ0aWVzIHRydXN0IHRoZXNlIGNyZWRlbnRpYWxzIGJlY2F1c2UgdGhleSB0 cnVzdCB0aGUgdHJ1c3QgYW5jaG9yIHRoYXQgaXNzdWVkIHRoZXNlIGNyZWRlbnRpYWxzLiBUaGV5 IGRvIG5vdCB0cnVzdCB0aGVtIGJlY2F1c2Ugb2YgdGhlIHBvaW50ZXIgdGhleSB1c2VkIHRvIHJl dHJpZXZlIHRoZSBjcmVkZW50aWFsLCB3aGljaCBtYXkgaW4gZmFjdCBiZSB0byBhbiB1bnRydXN0 ZWQgc2VydmljZS4gV2hvIGNhcmVzPyBJZiB5b3UgZmluZCBhIGNlcnRpZmljYXRlIG9uIGEgY3J1 bXBsZWQgdXAgcGllY2Ugb2YgcGFwZXIgaW4gYSBidXMgc3RhdGlvbiBhbmQgbWFudWFsbHkgdHlw ZSBpdCBpbnRvIHlvdXIgY29tcHV0ZXIsIHlvdSB0cnVzdCB0aGluZ3Mgc2lnbmVkIHdpdGggaXQg KG9yIG5vdCkgYmFzZWQgb24geW91ciB0cnVzdCBmb3IgdGhlIGFuY2hvciB0aGF0IGlzc3VlZCB0 aGUgY3JlZGVudGlhbCBhbmQgdGhlIHNjb3BlIG9mIHRoZSBhdXRob3JpdHkgdGhhdCB0aGUgYW5j aG9yIGFzc2lnbmVkIHRvIHRoZSBjcmVkZW50aWFsLiBJIHNlZW0gdG8gcmVjYWxsIHRoZSByZXZp ZXdlciBiZWluZyBxdWlja2x5IGNvbnZpbmNlZCBvZiB0aGlzIHRoZSBsYXN0IHRpbWUgd2UgZGlz Y3Vzc2VkIGl0LCBhbmQgSSBjYW4gb25seSBhc3N1bWUgdGhpcyByZWxhcHNlIGlzIGR1ZSB0byB0 aGUgZmFjdCB0aGF0IGNyZWRlbnRpYWwgdHJ1c3QgaXNzdWVzIGhlcmUgYXJlIGRlZmVycmVkIHRv IHN0aXItY2VydHMgcmF0aGVyIHRoYW4gaW5jbHVkZWQgaW4gcmZjNDQ3NGJpcy4gQWx0aG91Z2gg dGhlIHJldmlldyBnb2VzIG9uIHRvIHNheSB0aGF0ICJBIGNvbXBsZXRlIHNwZWNpZmljYXRpb24g b2YgYSBTVElSIHNlcnZpY2UgbmVlZHMgdG8gaW5jbHVkZSBhIHB1YmxpY2x5LXVzYWJsZSBrZXkg Y2VydGlmaWNhdGlvbiBtZWNoYW5pc20sIGEgbGEgREFORSBvciBES0lNIG9yIHRoZSBsaWtlLCIg dGhhdCBpcyByZWFsbHkgYSBkb2N1bWVudCBvcmdhbml6YXRpb24gcXVlc3Rpb24sIGFzIHN0aXIt Y2VydHMgaXMgaW50ZW5kZWQgdG8gcHJvdmlkZSB0aGF0Lg0KDQo2LjIgVGhlIHNwZWMgaGVyZSBh c3NlcnRzIGEgY29yb2xsYXJ5IHRvIHRoZSB0ZXh0IGF0IHRoZSBlbmQgb2YgU3RlcCA1IG9mIDUu MiwgbmFtZWx5LCB0aGF0ICJUaGlzIHNwZWNpZmljYXRpb24gZG9lcyBub3QgcHJvcG9zZSBhbnkg cGFydGljdWxhciBwb2xpY3kgZm9yIGEgdmVyaWZpY2F0aW9uIHNlcnZpY2UgdG8gZGV0ZXJtaW5l IHdoZXRoZXIgb3Igbm90IHRoZSBob2xkZXIgb2YgYSBjcmVkZW50aWFsIGlzIHRoZSBhcHByb3By aWF0ZSBwYXJ0eSB0byBzaWduIGZvciBhIGdpdmVuIFNJUCBpZGVudGl0eS4iIFRoZSByZXZpZXcg YWRhbWFudGx5IGNhbGxzIHRoaXMgImEgZnVuZGFtZW50YWwgZmxhdyBpbiB0aGlzIHNwZWNpZmlj YXRpb24uIEl0IHJlZHVjZXMgdG8gc2F5aW5nIHRoYXQgdGhlIGRvY3VtZW50IGlzIHNwZWNpZnlp bmcgYSB2YWxpZGF0aW9uIHNlcnZpY2UgdGhhdCBkb2VzIG5vdCBwcm92aWRlIGEgZGV0ZXJtaW5p c3RpYyBtZWFucyBmb3IgYXNzZXNzaW5nIHZhbGlkYXRpb24uIiBObywgaXQgaXMgc2F5aW5nIHRo YXQgdGhpcyBkb2N1bWVudCB0ZWxscyB5b3UgaG93IHRvIHZhbGlkYXRlIHdoYXQgZ29lcyBvdmVy IHRoZSB3aXJlLCBidXQgdGhhdCBpdCBpcyBhIG1hdHRlciBvZiBsb2NhbCBwb2xpY3kgd2hvIHlv dSB0cnVzdCBhbmQgd2h5LiBXZSdyZSBub3QgaGVyZSB0byBzYXkgImFsbCBpbXBsZW1lbnRhdGlv bnMgb2YgU1RJUiBzaGFsbCB0cnVzdCB0aGUgZm9sbG93aW5nIHRydXN0IGFuY2hvciIgb3Igd2hh dCBoYXZlIHlvdS4gSXQgaXMgdXAgdGhlIGNvbnNjaWVuY2Ugb2YgdGhlIGluZGl2aWR1YWwgY2h1 cmNoZ29lci4gVGhpcyBpcyBubyBkaWZmZXJlbnQgdGhhbiBpdCBpcyBmb3Igd2ViIFBLSS4gVGhl cmUgaXMgYSBsb3Qgb2YgZGl2ZXJzaXR5IG9mIG9waW5pb24gYWJvdXQgd2hvIHdpbGwgaXNzdWUg dGhvc2UgY3JlZGVudGlhbHMgYW5kIHdoYXQgdGhlaXIgc2NvcGUgd2lsbCBiZSwgYW5kIHRoZSBz dGlyLWNlcnRzIHNwZWMgZ2l2ZXMgc29tZSBndWlkYW5jZSBvbiBob3cgdGhvc2Ugc2NvcGVzIHdv dWxkIGJlIG1hbmFnZWQgZm9yIGEgY291cGxlIG9mIGluaXRpYWxseSBlbnZpc2lvbmVkIGFyY2hp dGVjdHVyZXMuIEJ1dCB0aGUgcG9pbnQgaXMsIHRoZSBmaWVsZHMgdGhhdCBnbyBpbiBQQVNTcG9y VCBhbmQgdGhlIHNlbWFudGljcyBvZiB0aGUgU0lQIElkZW50aXR5IGhlYWRlciBmaWVsZCB2YWx1 ZSB3aWxsIG5vdCBiZSBhbnkgZGlmZmVyZW50IGFzIGEgcmVzdWx0IG9mIHRob3NlIGRpZmZlcmVu dCBhcmNoaXRlY3R1cmVzLiBUaGlzIGlzIHNpbXBsZSBtYXR0ZXIgb2YgZGVzaWduIG1vZHVsYXJp dHkuIEkgZG91YnQgdGhlcmUgaXMgc29tZSBsdXJraW5nIGZsYXcgaGVyZSwgdGhpcyBoYXMgcHJv YmFibHkgYmVlbiB0aGUgc2luZ2xlIG1vc3QgdmV0dGVkIGFuZCBzY3J1dGluaXplZCBhc3BlY3Qg b2YgdGhlIGRlc2lnbi4NCg0KKiA2LjMgVGhlIHJldmlldyBhbGxlZ2VzIGluIHRoaXMgc2VjdGlv biB0aGF0IHRoZXJlIGlzIG5vIHNwZWNpZmljYXRpb24gZm9yIHRoZSAnaW5mbycgcGFyYW1ldGVy LCBhbmQgdGhhdCB0aGVyZSBhcmUgIm1hbnkgcmVmZXJlbmNlcyB0byB0aGUgSWRlbnRpdHktSW5m byBoZWFkZXIgZmllbGQuIiBUbyBteSBjaGFncmluLCB0aGUgbGF0dGVyIGlzIGF0IGxlYXN0IHBh cnRseSB0cnVlLiBUaGVyZSByZW1haW4gc29tZSByZWZlcmVuY2VzIHRvIHRoZSBJZGVudGl0eS1J bmZvIGhlYWRlciB0aGF0IHN0aWxsIG5lZWQgdG8gYmUgcmlwcGVkIG91dDogdHdvIGluIDYuMyBh bmQgb25lIGluIDcuMy4gQSBtZW50aW9uIGluIDYuMiBzdGlsbCBnaXZlcyBhIHJlYXNvbiBjb2Rl IGZvciA0MzYgYXMgIkJhZCBJZGVudGl0eS1JbmZvIiBhcyB3ZWxsLiBJJ2QgYmUgd2lsbGluZyB0 byBjb25jZWRlIHRoYXQgY291bnRzIGFzICJtYW55LiIgSSBhbSBob3dldmVyIGxlc3MgcGVyc3Vh ZGVkIHRoYXQgdGhlICdpbmZvJyBwYXJhbWV0ZXIgaXMgbm90IHNwZWNpZmllZC4gSXQgaXMgaW50 cm9kdWNlZCBpbiBTZWN0aW9uIDMsIGluc3RydWN0aW9ucyBvbiBob3cgdG8gaW5jbHVkZSBpdCBh cmUgZ2l2ZW4gaW4gU2VjdGlvbiA1LjEgU3RlcCA0LCBpbnN0cnVjdGlvbnMgb24gaG93IHRvIHBy b2Nlc3MgaXQgYXJlIGdpdmVuIGluIFNlY3Rpb24gNS4yIFN0ZXAgMyB3aXRoIGEgaGVscGZ1bCBm b3J3YXJkIHJlZmVyZW5jZSB0byA2LjIuIFRoZSBndWlkYW5jZSBvbiAnaW5mbycgZ2l2ZW4gaW4g Ni4zIHNlZW1zIHBlcmZlY3RseSBhZGVxdWF0ZSwgYW5kIGl0cyBhYm5mIGlzIGluZGVlZCBnaXZl biBpbiBTZWN0aW9uIDguIFRoZSBhbGxlZ2F0aW9uIGluIHRoZSByZXZpZXcgb2YgNi4zIHRoYXQg dGhlcmUgaXMgc29tZSBkZWZpY2llbmN5IGluIHRoZSBzcGVjaWZpY2F0aW9uIG9mICdhbGcnIGFu ZCAncHB0JyBpcywgYXMgZmFyIGFzIEkgY2FuIHRlbGwsIGJhc2VsZXNzIC0gJ2FsZycgaGFzIG5v dCBldmVuIGJlZW4gbWVudGlvbmVkIGluIHRoZSBzcGVjaWZpY2F0aW9uIHlldCBieSBzZWN0aW9u IDYuMyBpbiBhbnkgY29udGV4dC4gQnV0IGRlZmluaXRlbHkgd2UgbmVlZCB0byByZW1vdmUgdGhv c2UgZXh0cmFuZW91cyByZWZlcmVuY2VzIHRvIElkZW50aXR5LUluZm8uDQoNCjYuMyBBZnRlciBy ZWFkaW5nIGFib3V0IHRoZSBuZWVkIHRvIGRpZmZlcmVudGlhdGUgcG90ZW50aWFsIHNpZ25pbmcg Y3JlZGVudGlhbHMsIHRoZSByZXZpZXcgY29uY2x1ZGVzLCAiSXQgc291bmRzIGFzIGlmIHRoZSBy ZWFsIG5lZWQgaXMgdG8gaGF2ZSBhbiBleHRlcm5hbCByZWdpc3RyeSBvZiBhdXRob3JpemVkIGNy ZWRlbnRpYWxpbmcgc2VydmljZXMgYW5kIHRoZW4gcmVmZXIgdG8gdGhlIG9uZSB0aGF0IGlzIHVz ZWQgYnkgbmFtZS4gVGhhdCBwcm92aWRlcyBpbmRlcGVuZGVudCB2ZXR0aW5nIGFuZCBsaW1pdHMg dGhlICd2b2NhYnVsYXJ5JyBvZiBjcmVkZW50aWFsIHNlcnZpY2UgcmVmZXJlbmNlcyB0aGUgbWVz c2FnZSBjYW4gY2l0ZS4iIFRoYXQgd291bGQgY2VydGFpbmx5IHNpbXBsaWZ5IHRoZSBhcmNoaXRl Y3R1cmUsIGFuZCBpbiBwcmFjdGljYWwgZGVwbG95bWVudHMsIHRoYXQgbWF5IGVmZmVjdGl2ZWx5 IGJlIGRlY2lkZWQgYnkgZmlhdC4gVGhlIHN1Z2dlc3Rpb24gdGhvdWdoIHRoYXQgdGhpcyBpcyB0 aGUgInJlYWwgbmVlZCIgaXMgYW4gdW5uZWNlc3NhcnkgbGltaXRhdGlvbi4gTGF0ZXIgaW4gNi4z IHRoaXMgcmV0dXJucyBhcyAiTG9va3MgbGlrZSB0aGlzIG5lZWRzIHRvIGRlZmluZSBhIFNUSVIg Q3JlZGVudGlhbCBSZWdpc3RyeS4iIFdoaWxlIEkgd291bGRuJ3QgbWluZCBpZiBvbmUgb2YgdGhv c2UgZXhpc3RlZCwgaXQgaXMgbm90IG5lY2Vzc2FyeSBmb3IgdGhlIGRlcGxveW1lbnQgb2YgU1RJ UiwgYW5kIHNob3VsZCBub3QgYmUgaW50cm9kdWNlZCBhcyBhIHJlcXVpcmVkIGNvbXBvbmVudCBv ZiB0aGUgYXJjaGl0ZWN0dXJlLg0KDQo2LjQgVGhlIHJldmlldyB3YXJpbHkgYXNrcywgImNyZWRl bnRpYWxzIHN1cHBvcnRpbmcgc2lnbmluZyBhbGdvcml0aG1zPyBJIGRvbid0IHVuZGVyc3RhbmQg dGhpcy4gVGhlIHNpZ25pbmcgYWxnb3JpdGhtcyBhcmUgZm9yIHRoZSBwYXlsb2FkIHVzaW5nIHRo ZSBrZXkgL2Zyb20vIHRoZSBjcmVkZW50aWFsLiBTbyB3aGF0IGRvZXMgdGhpcyByZXF1aXJlbWVu dCBtZWFuLCBhbmQgd2h5PyIgVGhpcyBpcyBpbiByZXNwb25zZSB0byBzb21lIHRleHQgYWJvdXQg aG93IHRoZSAiYXNzb2NpYXRlZCBjcmVkZW50aWFscyB3aWxsIHN1cHBvcnQgdGhlIG1hbmRhdG9y eSBzaWduaW5nIGFsZ29yaXRobShzKSByZXF1aXJlZCBieSBQQVNTcG9yVC4iIFRoaXMgaXMgc2lt cGx5IGEgcmVmZXJlbmNlIHRvIHRoZSBrZXlpbmcgbWF0ZXJpYWwgYXNzb2NpYXRlZCB3aXRoIHRo ZSBjcmVkZW50aWFsIGFjdHVhbGx5IHN1cHBvcnRpbmcgRUNEU0EgYXMgcmVxdWlyZWQgYnkgUEFT U3BvclQuIElmIHlvdSBoYXZlIGEgY3JlZGVudGlhbCB3aXRoIGFuIFJTQSBrZXksIGxpa2UgYW4g b2xkIGZhc2hpb25lZCBjZXJ0aWZpY2F0ZSwgeW91IHdpbGwgbm90IGJlIGNvbXBsaWFudC4NCg0K NyBUaGUgcmV2aWV3IGhlcmUgc3F1aW50cyBhdCBQLUFzc2VydGVkLUlkZW50aXR5IGFuZCBhc2tz LCAiSHVoPyAgSG93IGlzIHRoZSB2ZXJpZmllciBzdXBwb3NlZCB0byBrbm93IHdoZXJlIHRvIGRy YXcgdGhlIHZhbHVlcyBmcm9tPyIgVGhlIGFuc3dlciB0byB0aGF0IGlzIHNvIG9idmlvdXMgdGhh dCBwZXJoYXBzIGl0IGlzIGVhc3kgdG8gbWlzcy4gSWYgeW91ciBlbnZpcm9ubWVudCB1c2VzIFBB SSwgdGhlbiB5b3UgdGFrZSB0aGUgaWRlbnRpdHkgdmFsdWUgZnJvbSB0aGVyZS4gSWYgaXQgZG9l c24ndCwgeW91IGRvbid0LiBUaGlzIG1heSBzb3VuZCBnbGliLCBidXQgaXQgaXMgYWN0dWFsbHkg cHJvZm91bmRseSBzb3VuZCBhZHZpY2UgZm9yIHRoZSBlbnZpcm9ubWVudHMgdGhhdCBhY3R1YWxs eSBkbyB1c2UgUEFJLiBUaGlzIGhhcyBiZWVuIG11Y2ggZGlzY3Vzc2VkIG9uIHRoZSBsaXN0LCBl dmVuIHZlcnkgcmVjZW50bHkuIFdlIHRoaW5rIHRoZSBndWlkYW5jZSBoZXJlIGlzIHN1ZmZpY2ll bnQuDQoNCjcgV2hlbiB0aGUgc3BlYyBkZXNjcmliZXMgdGhlIHByb2NlZHVyZXMgZm9yIGlkZW50 aWZ5aW5nIHRlbGVwaG9uZSBudW1iZXJzLCB0aGUgcmV2aWV3IGlzIHZlcnkgc2tlcHRpY2FsLiBU aGUgc3BlYyBpcyB1cGZyb250IGFib3V0IHRoZSBmYWN0IHRoYXQgIml0IG1heSBub3QgYmUgdHJp dmlhbCB0byB0ZWxsIGlmIGEgZ2l2ZW4gVVJJIGNvbnRhaW5zIGEgdGVsZXBob25lIG51bWJlciwi IGJ1dCB0aGUgcmV2aWV3IGNvbnNpZGVycyB0aGF0IGVpdGhlciBhIHN0YXRlbWVudCB0aGF0ICJ3 ZSd2ZSBnb3QgYSBiYXNpYyBwcm9ibGVtIiB0aGF0IGNhbid0IGJlIHNvbHZlZCwgb3IgdGhhdCAi dGhlIHNlbnRlbmNlIHNheXMgbm90aGluZyB1c2VmdWwuIiBPZiBjb3Vyc2UsIHRoZSBuZXh0IHNl bnRlbmNlIGdvZXMgb24gdG8gc3RhcnQgZXhwbGFpbmluZyB3aGF0IHlvdSBkbywgd2l0aCBzb21l IG5pY2Ugbm9ybWF0aXZlIHRleHQuIFNpbWlsYXJseSwgdGhlIHJldmlldyB0aGVuIG9yZGVycywg IklmIHRoZXJlIGlzIGFuIGFsZ29yaXRobSB0byBmb2xsb3csIHNwZWNpZnkgaXQgYXMgYW4gYWxn b3JpdGhtLiBPdGhlcndpc2UsIHRoaXMgaXMgbm9uLW5vcm1hdGl2ZSBkaXNjdXNzaW9uIGFuZCBp c24ndCB2ZXJ5IGhlbHBmdWwgaGVyZS4iIEFuZCB0aGUgdmVyeSBuZXh0IHNlbnRlbmNlIGdpdmVz IHRoZSBmaXJzdCBzdGVwIGluIGFuIGFsZ29yaXRobS4NCg0KNyBUaGUgcmV2aWV3IGhlcmUgc3Vn Z2VzdHMgc2VwYXJhdGluZyAidGhlIGRldGVybWluaXN0aWMgc3R1ZmYgcGFydCBvZiB0aGUgc3Bl Y2lmaWNhdGlvbiBhbmQgdGhlIGhldXJpc3RpY3MgcGFydCBvZiBhbiBleHRlcm5hbCBkb2N1bWVu dCBkaXNjdXNzaW5nIHJlYWwtd29ybGQgaW1wbGVtZW50YXRpb24sIG9yIHNvbWVzdWNoLiIgSSdt IG5vdCBhd2FyZSB0aGF0IHRoZXJlIGlzIGFueSAiaGV1cmlzdGljcyBwYXJ0IiBvZiB0aGlzIG1l Y2hhbmlzbSB0byBleGlsZSBlbHNld2hlcmUuIFRoZXJlIGlzIG9uZSBzZW50ZW5jZSB0aGF0IHRh bGtzIGFib3V0IGp1c3QgdHJlYXRpbmcgYSBudW1lcmljIHN0cmluZyBsaWtlIGEgdGVsZXBob25l IG51bWJlciBhbmQgc2VlaW5nIGlmIGl0IHdvcmtzIC0gaWYgdGhhdCdzIHRoZSBoZXVyaXN0aWNz IHBhcnQsIHRoZW4gSSB0aGluayBpdCBkb2Vzbid0IHRha2UgdXAgYSBsb3Qgb2YgdGhlIHJlYWRl cidzIHRpbWUuIA0KDQo3LjIgQmV5b25kIHRoZSBjb25jZXJucyB0aGUgcmV2aWV3IGV4cHJlc3Nl cyBhYm91dCB3aGF0IGlzIGEgInNwZWNpZmljYXRpb24iIGFuZCB3aGF0IGlzICJjb21tZW50YXJ5 IiBpbiB0aGUgdGVsZXBob25lIG51bWJlciBjYW5vbmljYWxpemF0aW9uIGFsZ29yaXRobSAod2hp Y2ggYXJlIGRpc2N1c3NlZCBhYm92ZSksIHRoZSByZXZpZXcgYWxzbyBzdGF0ZXMgdGhhdCB0aGUg bWVjaGFuaXNtICJpc24ndCBpbnRlcm9wZXJhYmxlLiBJdCBzYXlzICd0aGUgZm9sa3MgZW5jb2Rp bmcgdGhlIHN0cmluZ3Mgd2lsbCBkbyB3aGF0ZXZlciBsb2NhbCBzdHVmZiB0aGV5IGZlZWwgbGlr ZSBhbmQgdGhlIGZvbGtzIGF0IHRoZSB2ZXJpZmljYXRpb24gc2lkZSB3b24ndCBrbm93IHdoYXQg aXQgd2FzIGFuZCB3b24ndCBiZSBhYmxlIHRvIHJlcGxpY2F0ZSBpdC4nIFNvIGNhbm9uaWNhbGl6 YXRpb24gd29uJ3QgYmUgYSBzdGFuZGFyZCwgZ2xvYmFsIHNlcnZpY2UuIiBJdCBpcyB0cnVlIHRo YXQgd2UgYWNrbm93bGVkZ2UgaXQgd2lsbCBiZSBwb3NzaWJsZSBmb3IgZGlmZmVyZW50IGVudGl0 aWVzIHRvIGNhbm9uaWNhbGl6ZSBudW1iZXJzIGRpZmZlcmVudCB3YXlzLiBUaGlzIHdpbGwgaGFw cGVuIGluIGNhc2VzIHdpdGggcHJpdmF0ZSBudW1iZXJpbmcgcGxhbnMsIHZhcmlvdXMgc3RyYW5n ZSBuYXRpb25hbGx5LXNwZWNpZmljIG51bWJlcnMgKGxpa2UgZW1lcmdlbmN5IHNlcnZpY2UgbnVt YmVycyksIGFuZCBzb21lIG90aGVyIGNvcm5lciBjYXNlcy4gSXQgaXMganVzdCBvdXIgYXNzZXNz bWVudCB0aGF0IHRoZXNlIHdpbGwgbm90IGJlIHZlY3RvcnMgZm9yIGVuYWJsaW5nIGltcGVyc29u YXRpb24gb2YgY2FsbGluZyBwYXJ0eSBudW1iZXJzLCBhbmQgdGhhdCB0aGV5IHdpbGwgYmUgcmFy ZSAoYXMgaW4sIG5vdCAiY29tbW9uIikgZW5vdWdoIHRoYXQgaXQgd29uJ3QgaW1wYWN0IG9wZXJh dGlvbnMgc2lnbmlmaWNhbnRseS4gT3ZlcndoZWxtaW5nbHksIG5ldHdvcmtzIHdpbGwgY2Fycnkg bnVtYmVycyBpbiBFLjE2NCBmb3JtYXQsIGFuZCB0aGUgY2Fub25pY2FsaXphdGlvbiBwYXNzIHdp bGwgYmUgdmVyeSBsaWdodCBhbmQgc3RyYWlnaHRmb3J3YXJkLiBPdXIgY29uZmlkZW5jZSBpbiB0 aGF0IG9wZXJhdGlvbmFsIHJlYWxpdHkgaXMgdGhlIGJhc2lzIGZvciB0aGUgbWVjaGFuaXNtIHRo YXQgd2UgcHJvcG9zZS4gSXQgaGFzIGJlZW4gc2NydXRpbml6ZWQgYnksIHdlbGwsIHRoZSBwZW9w bGUgdGhhdCBhY3R1YWxseSBvcGVyYXRlIHRoZXNlIHN5c3RlbXMuIEFsc28sIGJlY2F1c2Ugb2Yg ImNhbm9uLCIgdGhlIHR3byBuZXR3b3JrcyB3aWxsIGF0IGxlYXN0IGJlIGFibGUgdG8gc3BvdCBk ZWJ1Z2dpbmcgZXJyb3JzIGhlcmUuDQoNCjcuMiBBbHNvLCBhcyBhIG1pbm9yIHBvaW50IG9mIG1l Y2hhbmlzbSBvbiB0aGUgY2Fub25pY2FsaXphdGlvbiBhbGdvcml0aCwgdGhlIHJldmlldyB3b25k ZXJzIGlmIHdlIHN0cmlwIG9ubHkgYSBsZWFkaW5nICIrIiBvciBhbiBpbnRlcm5hbCAiKyIuIEl0 J3MgdHJ1ZSB0aGF0IGFzIHRoZSB0ZXh0IHJlYWRzIG5vdywgd2Ugb25seSBzdHJpcCBhIGxlYWRp bmcgIisiLiBJJ20gbm90IGF3YXJlIHRoYXQgdGhlcmUgaXMgYW55IGlzc3VlIHdpdGggYW4gaW50 ZXJuYWwgIisiLiBUaGUgcmV2aWV3IGdvZXMgb24gdG8gcHJvcG9zZSB0aGF0IHdlIHNpbXBseSBy ZXBsYWNlIGFsbCB0aGUgZmFuY3kgY2Fub25pY2FsaXphdGlvbiBzdHVmZiB3aXRoIGEgc2ltcGxl IHN0YXRlbWVudCB0aGF0IG9uZSBzaG91bGQgIlRha2UgdGhlIG9yaWdpbmFsIHN0cmluZyBhbmQg cmVtb3ZlIGFueSBjaGFyYWN0ZXJzIHRoYXQgZG8gbm90IGNvbmZvcm0gdG8gdGhlIGFib3ZlIGZv cm1hdC4iIFRoaXMgaXNuJ3QgcmVhbGx5IHRoYXQgZmFyIGZyb20gd2hhdCB3ZSByZWNvbW1lbmQs IGV4Y2VwdCBmb3IgY2FzZXMgd2hlcmUgeW91IGFyZSBjb252ZXJ0aW5nIGZyb20gYSBkaWFsIHN0 cmluZyBvciBzaW1pbGFyIG9wZXJhdGlvbiAtIHdoaWNoIGJhc2ljYWxseSBpcyBhIGNhc2Ugd2hl cmUsIGFzIHRoZSByZXZpZXcgc2F5cywgeW91ICJ0d2VhayB0aGF0IHRyZXh0IGZvciBhbnkgY2Fz ZXMgdGhhdCBuZWVkIHRvIGFkZCBjaGFyYWN0ZXJzLCIgYXMgeW91IHR5cGljYWxseSBqdXN0IHBy ZXBlbmQgY2hhcmFjdGVycyB3aGVuIGNvbnZlcnRpbmcgZnJvbSBhIGRpYWwgc3RyaW5nICh0aG91 Z2ggeW91IG1heSBhZGQgc29tZSBmaXJzdCwgZGVwZW5kcyBvbiB0aGUgc3RyaW5nKS4NCg0KNy4y IFRoZSByZXZpZXcgYXNrcywgd2hlbiB0aGUgc3BlYyBub3RlcyB0aGF0IHRoZSBjYW5vbmljYWxp emF0aW9uIHJlc3VsdCB3b3VsZCBhcHBlYXIgaW4gdGhlICJjYW5vbiIgcGFyYW1ldGVyLCAiV2h5 IGlzIHRoaXMgc2lnbmlmaWNhbnQ/IEhvdyBkb2VzIGl0IGFmZmVjdCBwcm9jZXNzaW5nPyIgSXQg aXMgc2lnbmlmaWNhbnQgYmVjYXVzZSBjYW5vbiBoZWxwcyB0byBkZWJ1ZyBvcGVyYXRpb25hbCBl cnJvcnMgdGhhdCBhcmlzZSBmcm9tIGNhbm9uaWNhbGl6YXRpb24gcHJvYmxlbXMuIA0KDQo3LjIg VG93YXJkcyB0aGUgZW5kLCB0aGUgcmV2aWV3IGhlcmUgbm90ZXMgdGhhdCB3aGVuIGl0IGNvbWVz IHRvIHRyZWF0aW5nIGEgVVJJIGFzIGEgImdyZWVuZmllbGQiIGlkZW50aWZpZXIgcmF0aGVyIHRo YW4gYSBUTiAiaGF2aW5nIGEgU0hPVUxEIHJhdGhlciB0aGFuIGEgTVVTVCBzZWVtcyBsaWtlbHkg dG8gcHJvZHVjZSBub24taW50ZXJvcGVyYWJpbGl0eSwgc2luY2Ugc2lnbmVyIGFuZCB2YWxpZGF0 b3IgYXJlIGFsbG93ZWQgdG8gYmVoYXZlIGRpZmZlcmVudGx5LCB0aGVyZWJ5IG1ha2luZyBpdCBs aWtlbHkgdGhleSB3aWxsIHByb2R1Y2UgZGlmZmVyZW50IHJlc3VsdHMuIiBBZ2Fpbiwgd2UgZG9u J3QgdGhpbmsgdGhlcmUgaXMgYSBwcmFjdGljYWwgcHJvYmxlbSBoZXJlLiBJbiBjYXNlcyB3aGVy ZSBhbnkgZm9ybSBvZiBtZWFuaW5nZnVsIGludGVyLW5ldHdvcmsgaW50ZXJvcGVyYWJpbGl0eSBp cyBwb3NzaWJsZSwgZGlmZmVyZW50IHNpZGVzIG9mIHRoZSBjYWxsIHBhdGggd2lsbCBhcnJpdmUg YXQgdGhlIHNhbWUgZGVjaXNpb25zIGhlcmUsIGFuZCBpbiBjYXNlcyB3aGVyZSB0aGV5IGNhbid0 IGFncmVlIG9uIHdoYXQgYSBudW1iZXIgaXMsIHRoZXkgcHJvYmFibHkgY2FuJ3QgbWVhbmluZ2Z1 bGx5IGV2ZW4gcm91dGUgY2FsbHMgdG8gZWFjaCBvdGhlciwgbGV0IGFsb25lIHNpZ24gY2FsbGlu ZyBwYXJ0eSBpbmZvcm1hdGlvbi4NCg0KNy4zIFRoZSByZXZpZXcgaGVyZSBhc2tzICJCdXQgc2lu Y2UgY3JlZGVudGlhbHMgYXJlIGEgbW9kdWxhcml6ZWQgY29uc3RydWN0LCBvdXRzaWRlIG9mIHRo aXMgc3BlY2lmaWNhdGlvbiwgd2h5IGlzIHRoaXMgc3BlY2lmaWNhdGlvbiBnb2luZyBpbnRvIHRo aXMgc29ydCBvZiBkZXRhaWwgYWJvdXQgdGhlbT8iIFRoZSBhbnN3ZXIgaXMgdGhhdCB0aGUgc3Bl YyB0ZXh0IHRoaXMgaGlnaGxpZ2h0cyB0YWxrcyBub3QgYWJvdXQgY3JlZGVudGlhbHMsIGJ1dCBh Ym91dCB0aGUgd2F5IHRoYXQgU0lQIHNlcnZlcnMgdXNlIGlkZW50aWZpZXJzLCBhbmQgaG93IGRv bWFpbiBuYW1lcyBhcmUgZW5jb2RlZCB3aXRoaW4gU0lQIFVSSXMgaW4gcGFydGljdWxhci4gVGhl IGRpc2N1c3Npb24gdGhhdCB0aGlzIGNvbW1lbnQgZm9sbG93cyBpcyBhYm91dCBuYW1lIHN1Ym9y ZGluYXRpb24gaW4gU0lQLCBub3QgaW4gY3JlZGVudGlhbHMuIEl0IGlzIG5lY2Vzc2FyeSB0byBn aXZlIHNvbWUgU0lQIGd1aWRhbmNlIHJlbGF0ZWQgdG8gbmFtZSBzdWJvcmRpbmF0aW9uIGFzIGl0 IG1heSBoYXZlIGltcGxpY2F0aW9ucyBmb3IgdGhlIHVzZSBvZiBjcmVkZW50aWFscyBhbmQgdGhl IHNjb3BlIG9mIGF1dGhvcml0eSB0aGF0IHdvdWxkIG5vdCBvdGhlcndpc2UgYmUgb2J2aW91cy4g VGhlIHJldmlldyBnb2VzIHRvIHJlaXRlcmF0ZSB0aGF0ICJJIHN1c3BlY3QgYWxsIG9mIHRoZSBh Ym92ZSBkZXRhaWwgaXMgb3V0IG9mIHNjb3BlLCBnaXZlbiB0aGUgd2F5IHRoZXNlIHNwZWNpZmlj YXRpb25zIGhhdmUgYmVlbiBwYXJ0aXRpb25lZCwiIGJ1dCB0aGUgcmVsZXZhbmNlIG9mIHRoZSBk aXNjdXNzaW9uIG9mIE5BUFRSIGFuZCBTUlYgcHJvY2Vzc2luZyB0byB0aGUgZG9tYWluIG5hbWVz IGF0dGVzdGVkIGJ5IGNyZWRlbnRpYWxzIGlzIHByZXR0eSBvYnZpb3VzLCBJIHRoaW5rLiANCg0K Ny40IFRoZSByZXZpZXcgaGVyZSBpcyBhbGFybWVkIGJ5IHRoZSBtZW50aW9uIG9mIEFCTkYgaW4g U0lQLCBhc2tpbmcgaW4gd2hpY2ggc2VjdGlvbiBvZiBSRkMzMjYxIGl0IGFwcGVhcnMgaW4gIldo YXQgYWJvdXQgdGhlIEFCTkYgcmVxdWlyZXMgYW55IG9mIHdoYXQgaXMgYXNzZXJ0ZWQgaGVyZT8i IEl0IGlzIHRydWUgdGhhdCB3ZSBkb24ndCBnaXZlIHRoZSBzZWN0aW9uLCBidXQgdGhlIHRleHQg aXMgY2xlYXIgd2UgYXJlIHRhbGtpbmcgYWJvdXQgdGhlIEFCTkYgb2YgdGhlICJTSVAgYW5kIFNJ UFMgVVJJIiwgYW5kIHRoZSByZXN0IG9mIHRoZSBzZW50ZW5jZSBzcGVjaWZpY2FsbHkgcmVmZXJl bmNlcyB0aGUgc3RydWN0dXJlIG9mIHRoYXQgQUJORiwgaW5jbHVkaW5nIHRoZSAiaG9zdHBvcnQi IGNvbXBvbmVudCBhbmQgdGhlIHJlbWFpbmluZyBlbGVtZW50cy4gUmVhZGluZyB0byB0aGUgZW5k IG9mIHRoZSBzZW50ZW5jZSBmcmVxdWVudGx5IHJlc29sdmVzIHRoaW5ncyB0aGF0IG1pZ2h0IGFw cGVhciBhbWJpZ3VvdXMgYXQgdGhlIGJlZ2lubmluZyBvZiBhIHNlbnRlbmNlLiBUaGUgcmV2aWV3 IG1ha2VzIGl0IHRvIHRoZSBlbmQgb2YgdGhlIHNlbnRlbmNlLCBhY3R1YWxseSwgYW5kIGxvY2F0 ZXMgdGhlIHByb3BlciBBQk5GLCBiZWNhdXNlIHRoZW4gdGhlIHJldmlldyBjb21wbGFpbnMgYWJv dXQgdGhlIHVzZSBvZiAiaW5jbHVkaW5nIiB3aGVuIGl0IHByZWNlZGVzIHRoZSByZXF1aXJlbWVu dCB0byByZW1vdmUgdGhlIHVyaS1wYXJhbWV0ZXJzIGFuZCBoZWFkcywgYXMgIkJ5IG15IHJlYWRp bmcgdGhlcmUgaXNuJ3QgYW55dGhpbmcgb3RoZXIgdGhhbiB0aG9zZSB0d28gcnVsZXMuIiBHaXZl biB0aGF0IHRoZSByZXZpZXcgaGFkIG5vIGRpZmZpY3VsdHkgbG9jYXRpbmcgdGhlIEFCTkYgYW5k IHRoZSBlbGVtZW50cyBpbiBxdWVzdGlvbiwgd2h5IGFzayAiV2hhdCBhYm91dCB0aGUgQUJORiBy ZXF1aXJlcyBhbnkgb2Ygd2hhdCBpcyBhc3NlcnRlZCBoZXJlPyIgV2h5IHByZXRlbmQgdGhhdCB0 aGlzIHdhcyB1bmNsZWFyIG9yIGFtYmlndW91cz8gWyRdDQoNCjcuNCBBbHNvIHByb3Bvc2VzIGEg Y29uZGVuc2VkIHJlc3RhdGVtZW50IG9mIHRoZSBhbGdvcml0aG0gaGVyZS4gSSBkb24ndCBiZWxp ZXZlIGl0IGlzIG1vcmUgY2xlYXIgb3IgaGVscGZ1bCB0aGFuIHRoZSBzcGVjIHRleHQgYXMgd3Jp dHRlbi4NCg0KNy40IFRoZSByZXZpZXcgYXNrcywgIldoYXQgaXMgdGhlIHB1cnBvc2Ugb2YgcmV0 YWluaW5nIHRoZSBzaXAvc2lwcyBkaXN0aW5jdGlvbiwgd2l0aGluIHRoaXMgY29udGV4dD8iIFdl IGhhZCBjb25zaWRlcmVkIHVzaW5nIGp1c3QgcmZjODIyIHN0eWxlIGlkZW50aWZpZXJzIGhlcmUs IGFuZCBkaXNjYXJkaW5nIHRoZSBzY2hlbWUgZW50aXJlbHkuIElmIHByZXNlbnQsIFNJUFMgaW1w bGllcyBzb21ldGhpbmcgdmFsdWFibGUgYWN0dWFsbHksIGVzcGVjaWFsbHkgd2hlbiB0aGUgVVJJ IGFwcGVhcnMgaW4gdGhlIFRvIGhlYWRlciBmaWVsZCB2YWx1ZSAtIGl0IHdvdWxkIGJlIGFuIGlu dGVyZXN0aW5nIHNlY3VyaXR5IHZpb2xhdGlvbiBpZiBhbiBpbnRlcm1lZGlhcnkgZG93bmdyYWRl ZCB0aGF0IGZyb20gU0lQUyB0byBTSVAgaW4gdHJhbnNpdCwgYXMgdGhhdCBoYXMgaW1wbGljYXRp b25zIGZvciB0aGUgaG9wLWJ5LWhvcCB1c2Ugb2YgVExTLiBUaGF0IG11Y2ggc2FpZCwgdGhpcyBz b3J0IG9mIGludGVybWVkaWFyeSBtZWRkbGluZyBpcyBub3Qgc3BlY2lmaWNhbGx5IGluIHRoZSBz Y29wZSBvZiBTVElSLCBpdCBpcyBtZXJlbHkgYSBzaWRlIGVmZmVjdCBvZiBvdXIgd29yaywgYnV0 IG9uZSB3b3J0aCBwcmVzZXJ2aW5nLg0KDQojIDcuNCBUaGUgcmV2aWV3IGhlcmUgbm90ZXMgdGhh dCBSRkMzOTg2IFNlY3Rpb24gIjYuMi4yIGRvZXMgbm90IGFjdHVhbGx5IHNwZWNpZnkgbm9ybWFs aXphdGlvbi4gUmF0aGVyLCBpdCB0YWxrcyBhYm91dCBhbiBhcHByb2FjaCB0byBub3JtYWxpemF0 aW9uLCB3aXRob3V0IGdpdmluZyBwcmVjaXNlIGRldGFpbHMuIiBJZiB0aGVyZSdzIHNvbWV0aGlu ZyBiZXR0ZXIgdG8gY2l0ZSBoZXJlLCBJJ20gaGFwcHkgdG8gY2l0ZSBpdC4gV2UncmUgbm90IGdv aW5nIHRvIHJlaW52ZW50IHRoZSB3aGVlbC4gTWF5YmUgSSdsbCBhc2sgdGhpcyBxdWVzdGlvbiBt b3JlIGJyb2FkbHkuIFRoaXMgdGV4dCBpcyBhbW9uZyB0aGUgbmV3ZXN0IGluIHJmYzQ0NzRiaXMs IHNvIGl0J3MgZ29vZCB0byBoYXZlIHNvbWUgZXllcyBvbiBpdC4NCg0KNy40IFRoZSByZXZpZXcg cnVlZnVsbHkgbm90ZXMgYWZ0ZXIgdGhlIGludGVybmF0aW9uYWxpemF0aW9uIG1lbnRpb24gdGhh dCAidGhlIGFib3ZlIGxhc3Qgc2VudGVuY2UgcmVkdWNlcyB0bzogZG8gbm9ybWFsaXphdGlvbiBi dXQgZG9uJ3QgcmVseSBvbiBpdCB3b3JraW5nLiIgSW5kZWVkLCB0aGVyZSBhcmUgc29tZSBpbnRl cm5hdGlvbmFsaXplZCBlbnZpcm9ubWVudHMgd2hlcmUgd2UgZXhwZWN0IG5vcm1hbGl6YXRpb24g d29uJ3QgaGVscCwganVzdCBhcyB0aGVyZSBhcmUgc29tZSBvZGRiYWxsIHRlbGVwaG9uZSBlbnZp cm9ubWVudHMgd2hlcmUgY2Fub25pY2FsaXphdGlvbiBpcyB1bmxpa2VseSB0byBoZWxwLiBXZSBq dXN0IHRoaW5rIHRoYXQgdGhlcmUgYXJlIG9wZXJhdGlvbmFsIGVudmlyb25tZW50cyB3aGVyZSB0 aGlzIHdpbGwgYWxsIHdvcmsgd2l0aG91dCBhbnkgcHJvYmxlbXMuIEZvciB0aGUgcmV2aWV3LCB0 aG91Z2gsICJUaGlzIGFnYWluIHJhaXNlcyB0aGUgcXVlc3Rpb24gb2YgdHJlYXRpbmcgYSBicm9r ZW4gc2lnbmF0dXJlIHRoZSBzYW1lIGFzIG5vIHNpZ25hdHVyZSBwcmVzZW50LiIgSGVyZSBJIGNh biBvbmx5IHBvaW50IG9uY2UgYWdhaW4gdG8gdGhlIHRleHQgb2YgcmZjNDQ3NGJpcy0xMCBzZWN0 aW9uIDUuMiwgaW4gdGhlIGxhc3QgcGFyYWdyYXBoLCB3aGljaCBzdGF0ZXMgdGhhdCAiVGhpcyBz cGVjaWZpY2F0aW9uIGRvZXMgbm90IHByb3Bvc2UgYW55IGF1dGhvcml6YXRpb24gcG9saWN5IGZv ciB1c2VyIGFnZW50cyBvciBwcm94eSBzZXJ2ZXJzIHRvIGZvbGxvdyBiYXNlZCBvbiB0aGUgcHJl c2VuY2Ugb2YgYSB2YWxpZCBJZGVudGl0eSBoZWFkZXIsIHRoZSBwcmVzZW5jZSBvZiBhbiBpbnZh bGlkIElkZW50aXR5IGhlYWRlciwiIGV0Yy4gQXQgYSBwcm90b2NvbCBsZXZlbCwgd2UgYmVsaWV2 ZSBpdCBpcyBoZWxwZnVsIHRvIHNlbmQgYSA0Mzggd2hlbiB0aGVyZSBhcmUgb25seSBpbnZhbGlk IElkZW50aXR5IGhlYWRlcnMgaW4gYSBtZXNzYWdlLCBzbyB3ZSBtYWtlIHRoYXQgYSBNVVNULiBC dXQgZm9yIHRoZSB0ZXJtaW5hdGluZyBzaWRlLCB0aGF0IGlzIG5vdCBhIHF1ZXN0aW9uIG9mIG9w ZXJhdGlvbmFsIHBvbGljeSwgdGhhdCBpcyBhIHF1ZXN0aW9uIG9mIGdldHRpbmcgdGhlIGZ1bGwg ImNhbm9uIiBmb3IgZGVidWdnaW5nIHB1cnBvc2VzLiBGb3IgdGhlIG9yaWdpbmF0aW5nIHNpZGUs IHdobyBpcyBnb2luZyB0byB0aGUgdHJvdWJsZSBvZiBzaWduaW5nIHRoZXNlIHRoaW5ncyBpbiB0 aGUgZmlyc3QgcGxhY2UsIG1lcmVseSBpZ25vcmluZyBhbiBpbnZhbGlkIHNpZ25hdHVyZSBzaWxl bnRseSBhbmQgcHJvY2VlZGluZyBhcyBpZiBubyBJZGVudGl0eSB3YXMgcHJvdmlkZWQgaXMgbm90 IHBhcnRpY3VsYXJseSBoZWxwZnVsIC0gdGhleSBzaG91bGQgd2FudCB0byBrbm93IHRoYXQgdGhl cmUgaXMgYSBmYWlsdXJlLCBiZSBpdCBzaW1wbHkgc29tZSBzb3J0IG9mIG1pc2NvbmZpZ3VyYXRp b24gb3Igc29tZXRoaW5nIHVudG93YXJkIGdvaW5nIG9uLg0KDQo4IFRoZSByZXZpZXcgaXMgdmVy eSBjb25jZXJuZWQgd2l0aCB0aGUgQUJORiBvZiB0aGUgSWRlbnRpdHkgaGVhZGVyIHRoYXQgIjx0 b2tlbj4gaXNuJ3QgZGVmaW5lZCEhISIgYW5kIHRoYXQgIjxnZW5lcmljLXBhcmFtPiBpc24ndCBk ZWZpbmVkIiBhbmQgdGhhdCAiTEFRVU9ULCBFUVVBTCwgUkFRVU9ULCBhYnNvbHV0ZVVSSSBhcmUg YWxsIHVuZGVmaW5lZC4gUnVsZXMgbGlrZSB0aGVzZSBhcmUgdXN1YWxseSBpbmhlcml0ZWQgZnJv bSBhbm90aGVyIGRvY3VtZW50LiBJZiB0aGF0J3MgdGhlIGNhc2UgaGVyZSwgY2l0ZSBpdC4iIFRo ZSBmYWN0IHRoYXQgYmVmb3JlIHRoZSBBQk5GIG9mIHRoZSBoZWFkZXIgdGhlcmUgaXMgYSBjbGVh ciBzdGF0ZW1lbnQgdGhhdCB0aGlzIGlzICJmb2xsb3dpbmcgdGhlIEFCTkYgW1JGQzQyMzRdIGlu IFJGQyAzMjYxIFtSRkMzMjYxXSIsIHdoaWNoIGRlZmluZXMgYWxsIG9mIHRob3NlIGVsZW1lbnRz LCBpcyBjbGVhcmx5IGxvc3Qgb24gdGhlIHJldmlld2VyLiBbJF0NCg0KKiA4IEhlcmUgdGhlIHJl dmlldyBvYnNlcnZlcyB0aGF0IHN0aXItcGFzc3BvcnQgImRvZXMgbm90IGNvbnRhaW4gdGhlIHN0 cmluZyAnc2lnbmVkIGhhc2gnLiIgVGhhdCdzIHRydWUuIFRoZXJlIHdhcyBhIHJlbGF0aXZlbHkg bGVuZ3RoeSBleGNoYW5nZSBvbiB0aGUgbGlzdCBhYm91dCB0aGUgbmVlZCBmb3IgaW5jcmVhc2Vk IHNwZWNpZmljaXR5IChhbmQgZXhhbXBsZXMpIG9mIGV4YWN0bHkgd2hhdCBjb21wb25lbnQgb2Yg dGhlIFBBU1Nwb3JUIG9iamVjdCBnb2VzIGludG8gdGhlIHNpZ25lZC1pZGVudGl0eS1kaWdlc3Qu IFNvIHRoaXMgd2FzIG9uIG91ciBoaXQgbGlzdCB0byBmaXggaGVyZSBhbHJlYWR5LiBCdXQganVz dCBiZWNhdXNlIHlvdSB3ZXJlbid0IHRoZSBmaXJzdCBvbmUgdG8gYmUgcmlnaHQgYWJvdXQgdGhp cyBkb2Vzbid0IG1lYW4gdGhhdCBpdCBpc24ndCBhIHZhbGlkIHBvaW50IHRoYXQgd2UgbmVlZCB0 byBmaXguIFlvdSBhcmUgcXVpdGUgY29ycmVjdCB0aGF0ICJTcGVjaWZpYyByZWZlcmVuY2UgdG8g YSBzcGVjaWZpYyB2YWx1ZSB0aGF0IGNhbiBiZSBpbnRlcm9wZXJhYmx5IGdlbmVyYXRlZCBpcyBu ZWVkZWQuIg0KDQo4IFRoZSByZXZpZXcgaGVyZSBvYnNlcnZlcyB0aGF0IHRoZSBzdGVwIGluIHRo ZSBQQVNTcG9yVCBoZWFkZXIgY29uc3RydWN0aW9uIHdoaWNoIHNheXMgdGhhdCAicGVyIGJhc2Vs aW5lIFtJLUQuaWV0Zi1zdGlyLXBhc3Nwb3J0XSwgdGhlIEpTT04ga2V5ICJ0eXAiIGtleSBNVVNU IGhhdmUgdGhlIHZhbHVlICJwYXNzcG9ydCIgImFwcGVhcnMgdG8gYmUgaW50cm9kdWNpbmcgYSBy ZWR1bmRhbmN5IGJldHdlZW4gdGhpcyBzcGVjIGFuZCB0aGUgUGFzc3BvcnQgc3BlYy4gVGhlcmUg bmVlZHMgdG8gYmUgbGFuZ3VhZ2UgaW4gb25lIHRoYXQgbWVyZWx5IGNpdGVzIHRoZSBvdGhlciwg cmF0aGVyIHRoYW4gcmVzcGVjaWZ5aW5nIGl0LiIgSXQgaXMgdHJ1ZSwgdGhpcyBpcyBlZmZlY3Rp dmVseSByZWl0ZXJhdGluZyB0aGUgZ3VpZGFuY2Ugb2Ygc3Rpci1wYXNzcG9ydC4gSSBkb24ndCBo b3dldmVyIHRoaW5rIHRoaXMgaW50cm9kdWNlcyBhbnkgcHJhY3RpY2FsIHByb2JsZW0uDQoNCjgg V2F4aW5nIHBoaWxvc29waGljYWwsIHRoZSByZXZpZXcgYXNrcyBhZnRlciBhbiBleGFtcGxlIG9m IHRoZSBQQVNTcG9yVCBoZWFkZXIgb2JqZWN0IGlzIGdpdmVuLCAiV2hhdCBpcyB0aGlzIGV4YW1w bGUgZGVtb25zdHJhdGluZz8gIEhvdyBpcyB0aGUgcmVhZGVyIHRvIGtub3c/IiBHaXZlbiB0aGF0 IGl0IGlzIGFuIGV4YW1wbGUgb2YgYSBoZWFkZXIgb2JqZWN0IGNvbnRhaW5pbmcgdGhlIHRocmVl IG1hbmRhdG9yeSBKU09OIGtleXMgd2l0aCB2YWx1ZXMgdGhhdCB3ZXJlIGp1c3QgZGVzY3JpYmVk IGluIHRoZSBhbGdvcml0aG0gYWJvdmUsIHRoZSByZWFkZXIgd291bGQgcHJlc3VtYWJseSBrbm93 IHdoYXQgdGhpcyBpcyBhbiBleGFtcGxlIG9mIGJ5IHZpcnR1ZSBvZiBoYXZpbmcganVzdCByZWFk IHRoZSB3b3JkcyBkaXJlY3RseSBhYm92ZSBpdCBpbiB0aGUgc3BlY2lmaWNhdGlvbi4gVGhlIGV4 YW1wbGUgaXMgYW4gZXhhbXBsZSBvZiBob3cgdGhlIFBBU1Nwb3JUIGhlYWRlciBvYmplY3Qgd291 bGQgbG9vay4gSXQgZGVtb25zdHJhdGVzLi4uIGhvdyB0aGUgUEFTU3BvclQgaGVhZGVyIG9iamVj dCB3b3VsZCBsb29rLiBXaGF0IGlzIHRoaXMgcmV2aWV3IGNvbW1lbnQgYXNraW5nPyBIb3cgaXMg dGhlIHRhcmdldCBvZiB0aGUgcmV2aWV3IHRvIGtub3c/IFdobyBjb3VsZCBwb3NzaWJseSB0aGlu ayBhc2tpbmcgdGhpcyBxdWVzdGlvbiBpcyBhIG1lYW5pbmdmdWwgY29udHJpYnV0aW9uIHRvIG91 ciBzdGFuZGFyZHMgcHJvY2VzcyBhbmQgdGhhdCBpdCByZXF1aXJlcyB0aGUgYXR0ZW50aW9uIG9m IHRoZSBkb2N1bWVudCBhdXRob3JzIG9yIHRoZSB3b3JraW5nIGdyb3VwPw0KDQo4IEluIGFub3Ro ZXIgcGhpbG9zb3BoaWNhbCBhc2lkZSwgdGhlIHJldmlldyBhc2tzICJXaGF0IGlzIHRoZSBpbXBv cnQgb2YgdGhpcyBvYnNlcnZhdGlvbj8iIHdoZW4gdGhlIHNwZWNpZmljYXRpb24gbWVudGlvbnMg dGhhdCB0aGUgIm9yaWciIGFuZCAiZGVzdCIgYXJyYXlzICJtYXkgY29udGFpbiBpZGVudGlmaWVy cyBvZiBoZXRlcm9nZW5lb3VzIHR5cGUuIiBUaGUgcmV2aWV3IHdhbnRzIHRvIGtub3csICJJcyB0 aGVyZSBzb21ldGhpbmcgaW4gdGhlIHNwZWNpZmljYXRpb24gdGhhdCBhcHBlYXJzIHRvIGNvbnN0 cmFpbiB0aGUgY2hvaWNlcz8iIFRoZSBhbnN3ZXIgaXMgbm8sIHRoZXJlIGlzbid0IHNvbWV0aGlu ZyB0aGF0IGFwcGVhcnMgdG8gY29uc3RyYWluIHRoZSBjaG9pY2VzLCBidXQgaW1wbGVtZW50ZXJz IG1pZ2h0IGJlIHRlbXB0ZWQgdG8gdGhpbmsgdGhhdCBhIGNhbGwgdG8gYSB0ZWxlcGhvbmUgbnVt YmVyIGFsd2F5cyBjb21lcyBmcm9tIGEgdGVsZXBob25lIG51bWJlciBvciB2aWNlIHZlcnNhLCBh bmQgdGh1cyBjcmVhdGUgY29kZSB0aGF0IHdvdWxkIG5vdCBhY2NvbW1vZGF0ZSB0aGUgaGV0ZXJv Z2VuZW91cyBjYXNlLiANCg0KOCBUaGUgcmV2aWV3IGlzIGNvbmNlcm5lZCB0aGF0IHRoZSByZWZl cmVuY2UgdG8gUEFTU3BvclQgU2VjdGlvbiAzLjMgaGVyZSBmb3IgdGhlIHNpZ25pbmcgcHJvY2Vk dXJlcyBpcyBpbnN1ZmZpY2VudCwgYXMgInRoYXQgZG9lc24ndCBsb29rIGxpa2UgYW4gaW1wbGVt ZW50YWJsZSBzcGVjaWZpY2F0aW9uIHRvIG1lLiIgSW5kZWVkLCBTZWN0aW9uIDMuMyBqdXN0IGRl ZmVycyB0byBKV1MsIGFzIHRoZSBwYXJ0IHRoYXQgcmVhZHMgImFzIHNwZWNpZmllZCBieSBKV1Mi IHNob3VsZCBpbmRpY2F0ZS4gU28gc3Rpci1wYXNzcG9ydCBqdXN0IHBhc3NlcyB0aGUgYnVjayAt IGJ1dCBzdXJlbHkgdGhhdCdzIHdoYXQgc3Rpci1wYXNzcG9ydCBzaG91bGQgZG8sIGFsYmVpdCBp dCBzaG91bGQgZG8gc28gd2l0aCBhIGJpdCBtb3JlIHByZWNpc2lvbi4gSSB3b24ndCBkaXNhZ3Jl ZSB0aGF0IHRoaXMgY291bGQgYmUgYmVlZmVkIHVwIGluIHN0aXItcGFzc3BvcnQsIGJ1dCBJIHRo aW5rIHJmYzQ0NzRiaXMgc2hvdWxkIGRlZmVyIHRvIHRoZSBzdGlyLXBhc3Nwb3J0IHRleHQuDQoN CjggV2l0aCByZWdhcmRzIHRvIHRoZSBJZGVudGl0eSBoZWFkZXIgZXhhbXBsZSwgdGhlIHJldmll dyBhbHNvIGFza3MgZm9yICJhIGRldGFpbCwgaW5jcmVtZW50YWwgZXhhbXBsZSB0aGF0IHNob3dz IGhvdyBlYWNoIG9mIHRoZSBiaXRzIGFyZSBjcmVhdGVkIGFuZCB0aGVuIGFzc2VtYmxlZCIuIFdl IHBsYW4gdG8gaGF2ZSBhIHNlcGFyYXRlIHNwZWMgdG8gZG8gdGhhdCwgYWN0dWFsbHkuDQoNCjgg RXhhY3RseSBob3cgcmFkaWNhbCB0aGUgImRlcGFydHVyZSBmcm9tIEpXVCBwcmFjdGljZSIgYXQg dGhlIGVuZCBvZiBTZWN0aW9uIDggd2FzIGEgcmVjZW50IHN1YmplY3Qgb2Ygd29ya2luZyBncm91 cCBkaXNjdXNzaW9uLCBpbiBsaWdodCBvZiB2YXJ5aW5nIGludGVycHJldGF0aW9ucyBvZiB0aGUg SldTIFJGQyAoZXNwZWNpYWxseSBBcHBlbmRpeCBGIG9uICJEZXRhdGNoZWQgQ29udGVudCIpLiBI ZXJlIHRoZSByZXZpZXcgaXMgb2YgY291cnNlIGNvcnJlY3Qgd2hlbiBpdCBwb2ludHMgb3V0IHRo ZSB1bmxpa2VsaWhvb2QgdGhhdCAiSldUIG5vcm1hbGx5IGNhbGxzIGZvciBpbmNsdWRpbmcgdGhl IGVuY29kZWQgdmVyc2lvbiBvZiBKU09OIG9iamVjdHMgaW4gdGhlIElkZW50aXR5IGhlYWRlciAo ZmllbGQpPyIgT3VyIGludGVycHJldGF0aW9uIG9mIEpXVCBhbmQgSldTIHdhcyBtdWNoIG9mIHdo YXQgd2UgZGlzY3Vzc2VkIGF0IHRoZSBsYXN0IG1lZXRpbmcsIGFuZCB3ZSBleHBlY3QgdGhhdCBz dGlyLXBhc3Nwb3J0IHdpbGwgYmUgY3Jpc3BlciBvbiB0aGlzIHBvaW50LiBUaGVyZSBtYXkgYmUg c29tZSByZmM0NDc0YmlzIHRleHQgdGhhdCBmYWxscyBvdXQgZnJvbSB0aGF0LCB3ZSdsbCBzZWUu DQoNCjkgRXZlciBtb3JlIHBoaWxvc29waGljYWwgdG93YXJkcyB0aGUgZW5kLCB0aGUgcmV2aWV3 IGFza3MgIkFuZCB3aGF0IGlzIHRoZSBiZW5lZml0IG9mIGhhdmluZyB0aGlzIGRpcmVjdGl2ZT8i IHdoZW4gdGhlIGJlZ2lubmluZyBvZiBTZWN0aW9uIDkgZ2FtZWx5IG5vdGVzIHRoYXQgdGhlIGV4 dGVuc2liaWxpdHkgb2YgUEFTU3BvclQgb2JqZWN0IGlzIGNvdmVyZWQgaW4gU2VjdGlvbiA0IG9m IHN0aXItcGFzc3BvcnQuIFRoZSBiZW5lZml0IG9mIGhhdmluZyB0aGlzIGRpcmVjdGl2ZSBpcyB0 aGF0IGl0IGRpcmVjdHMgeW91IHRvIHRoZSBwbGFjZSB3aGVyZSBleHRlbnNpYmlsaXR5IG9mIFBB U1Nwb3JUIG9iamVjdHMgaXMgY292ZXJlZC4gDQoNCjkgVGhlIHJldmlldyBoZXJlIGFza3MgdHdv IHF1ZXN0aW9ucyBhYm91dCB0aGUgInBwdCIgcGFyYW1ldGVyOiBmaXJzdCwgaWYgInRoZXkgd2ls bCBvbmx5IGJlIGFibGUgdG8gdXNlIG9uZSBleHRlbnNpb24/IiBhbmQgc2Vjb25kLCAid2hhdCBp cyB0aGUgdXRpbGl0eSBvZiBoYXZpbmcgdGhpcyBpbmZvcm1hdGlvbiBpbiB0aGUgU0lQIElkZW50 aXR5IGhlYWRlciBmaWVsZD8iIC0gd2hlcmUgdGhlIGxhdHRlciBwcmVzdW1hYmx5IGlzIGFza2lu ZyB3aHkgaGF2ZSAicHB0IiBhcyBhIHBhcmFtZXRlciBvZiBJZGVudGl0eSByYXRoZXIgdGhhbiBq dXN0IHJlYWRpbmcgaXQgZnJvbSB0aGUgSk9TRSBoZWFkZXIgb2YgdGhlIFBBU1Nwb3JUIG9iamVj dC4gVGhlIGFuc3dlciB0byB0aGUgc2Vjb25kIGlzIHRoYXQgaXQgaXMgbmVjZXNzYXJ5IGZvciB2 ZXJpZmljYXRpb24gc2VydmljZXMsIGFzIGluIHRoZSBhYnNlbmNlIG9mICJjYW5vbiwiIHRoYXQg aXMgdGhlIG9ubHkgaW5kaWNhdGlvbiBwcmVzZW50IHRoYXQgYW4gZXh0ZW5zaW9uIGlzIGluIHVz ZSAoYW5kICJjYW5vbiIsIHBlciB0aGUgbGFzdCBwYXJhZ3JhcGggaGVyZSwgaXMgcmVxdWlyZWQg b25seSBpZiB0aGUgbmV3IGNsYWltcyBjb3ZlciBlbGVtZW50cyBub3QgaW4gdGhlIFNJUCByZXF1 ZXN0KS4gRXZlbiB3aGVuICJjYW5vbiIgZG9lcyBhcHBlYXIsIGl0IGlzIGFsc28gYSBuaWNlIHBy b2Nlc3Npbmcgb3B0aW1pemF0aW9uLCBhcyB0aGUgdmVyaWZpZXIgb25seSBuZWVkcyB0byByZWFk IHRoaXMgcGFyYW1ldGVyIHRvIGtub3cgd2hldGhlciBvciBub3QgdGhlIGhlYWRlciBpcyBzdXBw b3J0ZWQsIGl0IGRvZXNuJ3QgaGF2ZSB0byBjcmFjayB0aGUgb2JqZWN0IG9wZW4uIFRvIHRoZSBm aXJzdCBxdWVzdGlvbjogeWVzLCB3ZSBhcmUgY3VycmVudGx5IHRoaW5raW5nIHRoYXQgZWFjaCBJ ZGVudGl0eSBoZWFkZXIgd2lsbCBjb250YWluIGEgUEFTU3BvclQgb2JqZWN0IHdpdGggYXQgbW9z dCBvbmUgZXh0ZW5zaW9uLiBUaGlzIGlzIG1vc3RseSB0byBrZWVwIGl0IHNpbXBsZSBoZXJlIGF0 IHRoZSBzdGFydC4gV2UgaGF2ZSBwbGF5ZWQgYXJvdW5kIHdpdGggYSBmZXcgYWx0ZXJuYXRpdmUg bW9kZWxzLCBidXQgdGhpcyBpcyB0aGUgb25lIHRoYXQgc3R1Y2suIA== --_002_D3D412101A72E4jonpetersonneustarbiz_-- From nobody Sat Aug 13 00:55:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F9C812D0C5 for ; Sat, 13 Aug 2016 00:55:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n7thGKHlYO76 for ; Sat, 13 Aug 2016 00:55:05 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 745CF128B44 for ; Sat, 13 Aug 2016 00:55:05 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7D7rvvm013312 for ; Sat, 13 Aug 2016 03:55:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=5S0fZOkguHVwhjTOD6w6ZVVcTMD8DLCnMkOUFlPlkUs=; b=CrT+2Z6TXBATJEKixWmFYnejP3SwY64G5jfCE16xuL5CTbDCpdZkw7wYoYLdvlBTffdn saFaZ6G6NAutd6D+DwfsYxmxqcO6vSfVbxc2I8Fjd2hPbKEwABmWZSVK9ou5dxqTDiBx ejkiLXzd6aoOCaplx5wFL1lvhU17ng/lkPw7sITJAgS4MOjgJhywbMI9uOAdUhqI18dF df65jpvH8UhvWAceWPmm7RopMCCMMSUv5NoOYs6CItqWc6Flsy3fstMTo72spOQBxxlY qTceC1FG0qb7Uqu0OgUmr1i5WL6AnwZcHdtz8N4shp7JpDlWAX5jg6Gswz7uBvZKPb3Z YQ== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24sxbh0285-4 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT) for ; Sat, 13 Aug 2016 03:55:04 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Sat, 13 Aug 2016 03:54:49 -0400 From: "Peterson, Jon" To: "stir@ietf.org" Thread-Topic: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call Thread-Index: AQHR9Tf3V1guYa6yTUecma5LAMcQRA== Date: Sat, 13 Aug 2016 07:54:49 +0000 Message-ID: References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.59] Content-Type: text/plain; charset="us-ascii" Content-ID: <4D7B05A99ADC86498EFD4738919EEDA0@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-13_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608130096 Archived-At: Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Aug 2016 07:55:07 -0000 >I should also make at least a quick comment about the process problems >that have been so clearly demonstrated on the list during my review >effort: In roughly 30 years of participating in the IETF and doing >reviews of working group documents, I have never before seen an almost >complete lack of public engagement in dealing with a review. >Disagreement is common. Silence is not. The authors have refused to >engage in substantive, public discussion about these reviews, promising >instead to make back-room decisions as they see fit. The rest of the >working group has so far been almost completely silent on the substance >of the reviews. I've only participated in the IETF for half as long as you, but I can say I've never before seen someone decide to burst into a working group at the last minute, dump 150+ objections on a document that is in last call into a single mail, tap their feet impatiently at the lack of a timely public vetting of those issues, and expect this all to lead to some kind of productive result. The authors (well, I at least, and I seem to recall some mail from Chris as well) have been willing to engage with you, just apparently not on the terms you feel you are entitled to. From my perspective, it is you who have refused to identify what you believe the substantive issues are, instead hiding behind a claim that there are "many and serious issues" buried deep in a mound of imposing comments. The comments are objectively many, yes. Serious is a matter of opinion. The list has hardly been silent since you dispatched your reviews, though you may be frustrated that working group participants have mostly concerned themselves with other issues. I don't want to speak for other participants, at least one of whom said they found value in your comments, but the lack of wider discussion may hinge on the way you've structured your participation. Then again, it's also August. Chris, who is holding the pen on stir-passport, is on vacation at the moment. I'm sure he'll have some more notes when he gets back. Suggesting that this lack of receptivity is a "process problem" rather than a problem with the way you have chosen to engage with this working group is just one diagnosis. I might seek a second opinion. Jon Peterson Neustar, Inc. >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Sun Aug 14 07:52:09 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D571812D1D5 for ; Sun, 14 Aug 2016 07:52:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.149 X-Spam-Level: X-Spam-Status: No, score=0.149 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z7ZgqjbB-emC for ; Sun, 14 Aug 2016 07:52:07 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E9A812D0E0 for ; Sun, 14 Aug 2016 07:52:07 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7EEqBRA030845 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sun, 14 Aug 2016 07:52:12 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471186332; bh=gOO8zfbvh7ZjVrej8Ixip0KbfnKYv3rMJol4MW+ftf0=; h=Subject:To:References:From:Cc:Reply-To:Date:In-Reply-To:From; b=PutnnrJ19hm1jqxyniUzFVeJVJqcmE0HM/2N8QdnMMxv9TaytlGlcCVC5l0cZC/vm 1impFJjRXojdy9+mcKUn/rxSjAbhEZj8cBOUxn7h9cXgNGkZgS8PjjBvAc+EH92srN 0EC/4bKmcFMTyXldFBHBFbco3RYZFJmjb8c1tR0c= To: "Peterson, Jon" References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Sun, 14 Aug 2016 07:51:33 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2016 14:52:08 -0000 Jon, On 8/13/2016 12:54 AM, Peterson, Jon wrote: > I've only participated in the IETF for half as long as you, but I can say > I've never before seen someone decide to burst into a working group at the > last minute, dump 150+ objections on a document that is in last call into > a single mail, tap their feet impatiently at the lack of a timely public You have again indulged in ad hominems, seeking to marginalize my postings, but mostly sounding more like the coarse frustrations of a plaintive child.[*] Professional discourse really is a much healthier approach to these situations. I encourage you to experiment with that alternative. As for my bursting in on the scene: You are well aware that I was quite active during the formation of this working group, including providing text for the charter, as well has my having extensive related experience to the problem being addressed here. But even if I had had no prior contact, you sound as if you have never before experienced a diligent, cross-area review or the fine-grained inspection of an IESG member during the final approval process. How odd. In any event, you are also aware that at that time the effort was getting started I noted that the working group should focus on authenticating the SIP header, but you folk were insistent that you had to take a multi-pronged approach, in spite of very clear warnings that it would not be viable. I also noted the need for a clear and concrete understanding of precisely how this work would get used and which entities would have what roles. So here we are, 3 years later, with a proposal for authenticating the SIP header, exactly as I had recommended. Better still is that it is quite clear that the group still does not yet have a solid and detailed agreement on the way this technology will get used. Predictably, you've made a point of developing these specifications without trying to benefit from the 10 years of experience that has been gained in doing /exactly/ the same task for email. The reviews I've done here are in the same form as I've been doing for years. And yes, they took an extremely large amount of time to perform, so really, your thanks for my community-minded effort are greatly appreciated. Sometimes, my reviews uncover basic and extensive problems. You are not the first to be upset by them. But, again, welcome to the world of open participation and late-stage cross-review. Typically, the result of my reviews is significant improvement to the specifications. Sometimes the authors respond constructively from the start, but not always. It sometimes requires less emotional heads to rule. > vetting of those issues, and expect this all to lead to some kind of > productive result. The authors (well, I at least, and I seem to recall > some mail from Chris as well) have been willing to engage with you, just > apparently not on the terms you feel you are entitled to. From my You are trying to confuse 'interact' with 'engage'. They are quite different. Your postings on the list have been generic, with platitudes and challenges seeking to make me do more work. They have not contained significant substance, until yesterday. So no, you did /not/ engage. Any foot-tapping of mine you might have heard was not impatience but rather frustration with your aggressive efforts to avoid engaging in public discussion of the reviews' substance. > perspective, it is you who have refused to identify what you believe the > substantive issues are, instead hiding behind a claim that there are "many > and serious issues" buried deep in a mound of imposing comments. The > comments are objectively many, yes. Serious is a matter of opinion. Jon, when someone puts the kind of very considerable time I've put into reviewing these documents and then posts it publicly, there is no hiding. Or at least, not by me. That you sought to impose an artificial burden back on me, as a way of limiting your public engagement with the details of the reviews, is your problem, not mine. d/ [*] For reference, I filed a private complaint with the Chairs and AD, after Jon's second ad hominem posting in this sequence, but Robert chose merely to send a pro forma "let's do better" to both of us. I noted to him it would not alter Jon's behavior, as indeed we now see it did not. -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Aug 14 11:32:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E38012D11B for ; Sun, 14 Aug 2016 11:32:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YaTmE1vQ3CdR for ; Sun, 14 Aug 2016 11:32:55 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id D4AD612D782 for ; Sun, 14 Aug 2016 11:32:55 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id 6606439; Sun, 14 Aug 2016 18:32:55 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id 2D61158090; Sun, 14 Aug 2016 18:25:14 +0000 (UTC) References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> To: dcrocker@bbiw.net, "Peterson, Jon" From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <84919859-6332-5f96-9794-19b868f4c5c2@yaanatech.com> Date: Sun, 14 Aug 2016 14:32:53 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------93E1441547C809AF4B776518" Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2016 18:32:57 -0000 This is a multi-part message in MIME format. --------------93E1441547C809AF4B776518 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit In 30 some years of Dave Crocker nastygrams, this is about the worst I've seen. You need to hold up a mirror to yourself Dave. Jon, Rich, Brian, and many others have been laboring productively here, and the "dump 150+ objections in a last call mail, and tap their feet impatiently" seems spot on. --tony On 2016-08-14 10:51 AM, Dave Crocker wrote: > You have again indulged in ad hominems, seeking to marginalize my > postings, but mostly sounding more like the coarse frustrations of a > plaintive child.[*] Professional discourse really is a much healthier > approach to these situations. I encourage you to experiment with that > alternative. --------------93E1441547C809AF4B776518 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit In 30 some years of Dave Crocker nastygrams, this is about
the worst I've seen. You need to hold up a mirror to yourself
Dave. Jon, Rich, Brian, and many others have been laboring
productively here, and the "dump 150+ objections in a last
call mail, and tap their feet impatiently" seems spot on.

--tony

On 2016-08-14 10:51 AM, Dave Crocker wrote:
You have again indulged in ad hominems, seeking to marginalize my postings, but mostly sounding more like the coarse frustrations of a plaintive child.[*] Professional discourse really is a much healthier approach to these situations. I encourage you to experiment with that alternative.

--------------93E1441547C809AF4B776518-- From nobody Sun Aug 14 12:31:02 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9784F12D7AE for ; Sun, 14 Aug 2016 12:31:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OR4jxWjQgGQx for ; Sun, 14 Aug 2016 12:30:56 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0091.outbound.protection.outlook.com [104.47.41.91]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52AAD12D7A6 for ; Sun, 14 Aug 2016 12:30:56 -0700 (PDT) Received: from BY2FFO11FD051.protection.gbl (10.1.14.32) by BY2FFO11HUB047.protection.gbl (10.1.15.227) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8; Sun, 14 Aug 2016 19:30:54 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.82) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.82 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.82; helo=preapdm3.corp.sprint.com; Received: from preapdm3.corp.sprint.com (144.230.32.82) by BY2FFO11FD051.mail.protection.outlook.com (10.1.15.188) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Sun, 14 Aug 2016 19:30:54 +0000 Received: from pps.filterd (preapdm3.corp.sprint.com [127.0.0.1]) by preapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7EJRLG9037717; Sun, 14 Aug 2016 15:30:53 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm3.corp.sprint.com with ESMTP id 24swt6e97g-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Sun, 14 Aug 2016 15:30:53 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 14 Aug 2016 14:30:52 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Sun, 14 Aug 2016 14:30:52 -0500 From: "Gorman, Pierce A [CTO]" To: "tony@yaanatech.com" , "dcrocker@bbiw.net" , "Peterson, Jon" Thread-Topic: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call Thread-Index: AQHR9l4VkZN+dfBFDESxtFgcJ9xfhaBI1b3g Date: Sun, 14 Aug 2016 19:30:51 +0000 Message-ID: <693f66a8d52645778e82cc06b7c292d6@PLSWE13M08.ad.sprint.com> References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> <84919859-6332-5f96-9794-19b868f4c5c2@yaanatech.com> In-Reply-To: <84919859-6332-5f96-9794-19b868f4c5c2@yaanatech.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.29] Content-Type: multipart/alternative; boundary="_000_693f66a8d52645778e82cc06b7c292d6PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.82; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(199003)(189002)(149574003)(377454003)(377424004)(24454002)(87936001)(68736007)(81166006)(93886004)(8676002)(81156014)(16236675004)(92566002)(86362001)(19580395003)(5001770100001)(24736003)(19580405001)(30436002)(2501003)(2950100001)(4546004)(189998001)(8936002)(512954002)(230783001)(97736004)(586003)(5250100002)(106466001)(3846002)(33646002)(108616004)(54356999)(106116001)(2900100001)(4326007)(356003)(6116002)(102836003)(76176999)(50986999)(260700001)(7846002)(790700001)(2906002)(626004)(19625215002)(84326002)(15975445007)(7736002)(7696003)(11100500001)(19300405004); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB047; H:preapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11FD051; 1:fGa2Ku65ltDzgsuKBgC4ZvUz+25ubA2JcOkSppxFthKMlDz9+iBqWHqP6jPKZfnVTvrRMTPd+jKiRAdwFNfHbVVA1P8N1Lb6Wm9tovR2WqnmdAmvFbtZWvQTEWHB9nDqk0qrtzYXFmGumSYh88z6qMCxzZA4yJZUvyEK1/skHHBE5CWXKIg/z7wnd09S+tz9sar4s91bJqAKJ0BMaiUcXJcpQFhKcpUMfJmGwUKLrQ7D7ixe7R8C9iL+wkhx/KLOEq5mtrOQNUNeQn8QTrH6rMKYSaC4sVJJ39ZRaUAfBP9bL7vn2EUfRvYwljKJUTBGPlPMXI+vOZdYmGPuWumPQE1hGn00pASSXvZJLcwdrDwMS6ddscVTkL2xCw9vXlu3lqMM5lBOpN66gsQD7YFRy6D2ipJoG3xMXN9K3lg8/OT6xpIo9LllKfnSo/NDnj8OGwSh6fupaGZS++KoJTLNC4pk4wj1Nn4v6P8FyvAwNRoi5hNUjUdlHCk193mo3o0GqESJ5dEEO1XCEZ1BS4cgbcs85Cz2OlGf+rPd3oqER9wfwJ1uVlD3Z/1PmDAWeYq3 X-MS-Office365-Filtering-Correlation-Id: c5f4c978-a5cb-487b-fade-08d3c479827e X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB047; 2:bnWuF2dWi44g2pf6HnZlCEjs5byz4cIFzsRwvcTNFDWUZjQg2Cc5vB6KEZLAO29ATfMnyplWUAiFzti7vd3Pzg36t8LjegyL20oaB3zcj6CZbE+/6ZdUdQdXrv0q6uw5RMeyH5/edJ0lSZcS1TB2J1BZ5G5r6Lj5TlxogFikdj9kkxa+uT8vcfPk0ZjKuJRd; 3:7wKt6HGf1zI6k/N4powUFYYM3ND7LBLJ6lB4+jTSn/p66x5Lgc9dtv7r9uZ60zLwkiw2FGBw8vQ3rWqc/uJeaIHrjhxWvpaOnn0VexotzhkaHHeuC/AhOxgJyP/A2QK5bZ4UmqObVwZ2/2HDmOw9QJGhQXpX7Rp2DtonGkjurGydCQ8hIoksTj/zvUHRG5Cb5UZOgAfemQ2PQp6/HfpUBRkpEWpgMk0aPG4x9Usysstb7l+WiPIXbP/g8P+jb68WmSBPgnhAAMK0zB8k1a9M2A== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BY2FFO11HUB047; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2FFO11HUB047; 25:CAKrtGF1B4xVWZzEIw/piQbo8qFNmP47FJh3lU9D?= =?us-ascii?Q?TYqpryH4wcJeTmjBnorlynKYFoQv2yHzPduv5OTMmMbzNLn7dTT7lugXGw7C?= =?us-ascii?Q?U4DJeZvaSBryFTz0c/vuBrssDlwb4JbPwzn4yhn8380GIehUHBajKA8NdL61?= =?us-ascii?Q?aFV6ny+Nl9HLVkspDnOi6UfFCTv/+wBYWFKgyg14eSxD55obM0LrTJoPtwJG?= =?us-ascii?Q?PoBXCXJRXoAoSD32pdTfNOnc4yHuZF6ORPUB/dn2/hemQoYxEsshFzjdvcnV?= =?us-ascii?Q?w5/4CD5kNvxsvUqjVAQ8LLYYSlw8XONorznZhR5gzcvMVymFFpQ8ppDbtL4A?= =?us-ascii?Q?k6wd1bQhPSwcM3H19Kgp9FsYxjS0DZc1WRNJImPmyTnetKiUNUWsZYw2qAjo?= =?us-ascii?Q?w/bMLfIihwk7ICLGPXxG5ne4KxLtSa9Z3x1ylwbWzSVU0XuaNLc8+w9QLxWq?= =?us-ascii?Q?IwHABKkhgz+HG7MMzp49tWhO4YHETdjv5Y/t0KPXCpsOFIr8biJzoLMesI6e?= =?us-ascii?Q?zO3aIWVMQHcXW8gTf3SxZgRh3ODnlA0eYyLo6xLSh/I24h/jSh5E83mkuROF?= =?us-ascii?Q?NCxhi/qqMq/Nicr6x3ysTBBaZ/TgvUymagxEvl7Mjx+XElGkff4Lx0BdK9bL?= =?us-ascii?Q?s75f/I6lOh2QxX8c2tmVgA5MJLKXl5e7DIbYBI4PlXy8q1w55v1WwGGFPSWE?= =?us-ascii?Q?+PmKrc/imbKUCEN+hzrFGP/QR3Dv3mgXTMdX7u8N5WWZSjr3vpZRQWp33T/y?= =?us-ascii?Q?H13nmDtxe5gG3cjuZm+LSxQk62hjKHXcpt9ECS5+PnGdYrp1CwoBw56DchGn?= =?us-ascii?Q?aP46CvByBRUZJkpjHXOnJ0UMsQ0bOpYklIQKrpQF8wWeE5GaKzrp1P6CGvI5?= =?us-ascii?Q?K7fcY/cp2vxHF91HFlaIz5ppN3wfTj9OeFFU+jEWvbVe09kHBwwULGDkW/YY?= =?us-ascii?Q?xWJsuFz+PTF+AE+voaz4akbvPmBh0EJpKVm6ebmaqA=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB047; 31:jKZuOr4HvjMn+yK6BwjwA4iMPhUMox+MhRULd32So9J+UkvexMmlVhcQWQ/iejf8xNt+y+MFP/FshG2lZOLiVfcjv1x64NZh95E+R8lO8Rx2uYST4kfb4Cnbt+Jb/cwn3jeuLa92zmWaMrMMv6asc+qWxOxeZpYV1+CgkOXAGbaM3uknF2mc6rk8bfxs9A5rs5vMcpr8/YN5vCh2h59LhJsxRP/d1m1vnT9uc3p1bOU=; 20:XIOq7dtKQNphw+wqNmZ2xtgOAslECLzaR8ME57DkME2E9a7u/PbWJFibm0XfDoNP6ViaXLyr6yHuwgwqi2TPGGGf8Ty0uX7sO5WALviI6ddWU/njnUAMEeQ5WaOUHsalMvVYcpgaUx1MowQoiUDdT7jaUKJrNyaA7fDcrwCNFmeip923Qk1qrsx1Bk8/K6aocZdl6RJk2vs0hZjdPhLqLjn5E2IiDJbBeZ6Tpl/8s6TWJunQiY4mRI1A3/MecGyNA6EBx9qhwmb2+dTWy1sBW3+xzpDvFhe9Vcmfw9V1qIk9DT0yEQzzK6ZhW2/5XBRxJZQAjM103wFz6a2Lkrza0kSsaUmeChB1wYA0lmh/l7x6scYco5rJtAm/b5p6xmJo9rLV+nP/t/4yfezeVAwxBwPmGaIWxA8U66DVYmPVo/Q= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(13018025)(13015025)(13024025)(13023025)(13017025)(10201501046)(3002001)(6055026); SRVR:BY2FFO11HUB047; BCL:0; PCL:0; RULEID:; SRVR:BY2FFO11HUB047; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB047; 4:L0IS7hYlyix1lBR63yGlKPXkgMO7Fhhep686DZi+Pq5Zb5Lt9P3C/GYjyyTPpbUVnF3AAIyPqoasvOV6R/nddQPJjzLvEWUDdqGyeGzlgZx0xqR+qQNm9+nNkKWu8blmVlfaEl2bTqmXORqgxn++zMxwa0+LQdjMPx18NC9FsPMcgYuYiTPhck/BpfYy4dU/gmaqLxSye0nvaLpPBXYnyzOxqu3QYBlaAr/rwURzmGorA8/kwFwd/IrDHprI4WKjCSOWSgEaDBppDxnfQEXy8bb4ctkZSgctX7uCQjmr8xv4FYBLIQJYmdKgOf0h7kJ6JqXlLV7DQzqKFxKBY4vZY4emR0K7pPgOENx5R3wodVmWisaFWP03UrrDSqyXt5DaXvQ4YqfY2HGhGPxbzHKTo0xAJO5FEmirBgYEQkPv6s1f2vV5bFUCS4ZBuLTi9ShUNQXs0jwF43xjLwAVdU/EDZWX2MElJj7nP9V+xg/0p18S758t+JqKORvzJsUlRcfe6E55sv/hlgyJcTO5EpWXpBUNzrg/3FrwafyOGaFTwfo= X-Forefront-PRVS: 00342DD5BC X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2FFO11HUB047; 23:ZDBKzWZlPwOthpNhay1q87asaFIWJEvmMaqiuzmg?= =?us-ascii?Q?HQanoRnPuZ7bYZb/2GI3QivH/MFRNqyLLjZBVWklg44oIpGpJuvoSYExM5GS?= =?us-ascii?Q?1BH14z2FTOd5LUCztckGmMWunUX2arIdzgYfx2a3A57JCSC/nzZjMm8EEcT9?= =?us-ascii?Q?nWm3+Kbtt7Jrx/QJrCyKvGcK2a2PStYrGborZHNWd8X5Hlfnb7gsI/8Duxye?= =?us-ascii?Q?m0jxXtG/jSAd/KQtLvMuxqByj9VxU1+xyLS3vpxgm2q7p35qODYqomw9R/D3?= =?us-ascii?Q?5/scAAL83TjSVy4Q0n+3x1MAMrtpikgk5JmsXEfjEbNcQ8Y/3UOXz+5MGCUi?= =?us-ascii?Q?Vq6KuxHkZ+9wXnVJ4GwttC5HB5uUFV055OCw7M8uq3pel1jcDrzYyT22Ocew?= =?us-ascii?Q?nYFQmiotVKQtlEvqqQZgIzsG3rfqiLDNhu+93B06mdMoLyF4U28DSyWSsv+f?= =?us-ascii?Q?JClm9vTioh/DUn2tKsfd8HHu0LGPAhMjzcCbNRe8Ms5IuN9DVn/I1iYGrD4S?= =?us-ascii?Q?ERE3i+narJu6ec7NTVV+5c7U8D+iGtj1X6PLBLpikkuTzTUdn8uQNA+cmLQW?= =?us-ascii?Q?0MQKUFFyqWWuG6wc4NQ8BHqf5XFygVr6dyAMb8kQuMwbFn25OY2hcDy97xv9?= =?us-ascii?Q?r2xwNHJrYjdptSMVfJ7cGZNWLokhJ3XBPWbWnrsDJV9vwdsRqurt0sJT9f95?= =?us-ascii?Q?k4ZIrK5G6DOhOnBarr2z31xf/9oXXEnIZ2YSkxhusJBaBQf0nobv8uXRBKLc?= =?us-ascii?Q?fVvdU38ZK/HcVD+rNK8hHVY7DWcXpRUcYatXaBtAriGGsHBUd5IljuHutndv?= =?us-ascii?Q?qPRRxELR7hyGfAJ71WSNbzgw6vTFrhyjjNG0KKkgiyJuIElwk90yQTmq+zJc?= =?us-ascii?Q?PvsaJtsmAelT8BUJad8qJwt/igO3hUOjXb6iKYx13PmBsbUmZ8Mt0WY/SdKF?= =?us-ascii?Q?NYQtKg5s37QasRP4eGNSovqBeqM7KOar7UVOv5QQMRGTrfWKFrtdOwI2XhNj?= =?us-ascii?Q?B6vcv5deW7O5b0YIbvjdtcCptwabWeFnuzLvvjF7rkS1FwH7kDXv4g5hyFrw?= =?us-ascii?Q?j2c0yKTg9bvqkExsyZu0XR5BTS0oXmEyvNKiKLk/dp5UtBxwy62cShKeGHxp?= =?us-ascii?Q?LjM+hrD7KfueZRD9cd2Sq/0O7Hk+rv3lzQyJB/LU+DlfPxnq0zwoSnLh7TPO?= =?us-ascii?Q?rP5DMY9OEz4c7eJEZQKEfV8JZIXenSXzlrcceZ0EhOxr2HHvz2lkO2MN0sDA?= =?us-ascii?Q?VlU2FXKZPhtBCw72GuK/FBYO4+FSgg6GqPu+mD+zUaX0difq/g6yR1fXpAO2?= =?us-ascii?Q?WbRYMrVcXF+M69L7mGvgIAphIKaxg3/6o3Yq6xiUfBNTeUavdF4+gVS9wU20?= =?us-ascii?Q?PYIpW36MR/8xmAkFyxPoI6L39YQoIbAC+osiohk0GvQH+I5k76oN8ITj4+a9?= =?us-ascii?Q?yQoIUerX1KxFGsFBlU9wDz46TvMQgac=3D?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB047; 6:Ag9RmiOVLo669Xjwgi5bZrqCeU00AaxxWkyp72pmfeMSz4bUOsIotH2Se0TRvR2qh0REkRtCUBVNMmaVX6kYLogebCGWiSDtc5z5CIFJ0Q5N0/WIDtrCKUtbBxQ7qKk/or+Mo/Jofx0qSQukNMiTlSWsmxD/ZWGOZkB0J5hefoF5dHBTblaXM0Z9FBSzU1abKbNw4X+XyNgNmQIE9ZLb5InC5a7YMyM6+7ku+5w8sGoRfgl3JFfRzYok7hIdJSjgX41RhtCJZQB9KgfbixR9MN3YGLvDzZta35itZnCBFSA+4Ked3YQCV2t+Z81ZP58gg5BEGvUvbT0wX3W8tSLqYQ==; 5:Qngwt68uJAYXUXotMouy6KVUS2WH7Xygr5FVTW+noylAMPcwSuSqOcU5a120QfmRyoYplaZOE250BcbXDtrY35XlKhlv0DlTNzwxu0lIF7hSL2OG09BDUu1ux+Z24nOVOO3si9THiUslo3paDYSAOg==; 24:lu5mRprwp3sa0WPRMiF1Amu0O6DSuOqHBPD+sGytxvRcp2vFw4fNfnkBcfj6SdZduUnObl8bmunlarD1LG+qzzMEIRzgbOQYDtGVFWwk91s=; 7:d1VZoSBkB14SQUrTDXdabR53RompF3/9R4slZAi+AJsDl8fXzXq2OE6qtpI9UzeeNbGlybZY+zYfJNGK97PP3Zq4NnFp9UTX1HnCe3KfLvmyfbRAfcfuCzLSNQBJDK5JwahckcW72JSCwuSoyIviZus897OnO+Hau7DXI7cgYZW9pYoNX9pbpjUYewpmi29J3hTpSi5M8iasa3T7oB7yosBZzftNTuU8djglNBcGLt9vpd+4WN1enrE94jzNYRJ2 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Aug 2016 19:30:54.6478 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.82]; Helo=[preapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2FFO11HUB047 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2016 19:31:00 -0000 --_000_693f66a8d52645778e82cc06b7c292d6PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Respectfully, and without regard to timing or tenor, are any of Dave's obje= ctions material? I'm not an expert on the material being discussed, but I = have some responsibility for their commercial instantiation in my company a= nd I'm concerned there is an emotional reaction which perhaps obfuscates re= al value in Dave's review. No disrespect intended to Jon, Chris, et al, bu= t if there is going to be a mauling over STIR, I'd prefer it be a short-liv= ed one for the authors and their process rather than a long-lived one endur= ed by the users. Pierce From: Tony Rutkowski [mailto:tony@yaanatech.com] Sent: August 14, 2016 1:33 PM To: dcrocker@bbiw.net; Peterson, Jon Cc: stir@ietf.org Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at = WG Last Call In 30 some years of Dave Crocker nastygrams, this is about the worst I've seen. You need to hold up a mirror to yourself Dave. Jon, Rich, Brian, and many others have been laboring productively here, and the "dump 150+ objections in a last call mail, and tap their feet impatiently" seems spot on. --tony On 2016-08-14 10:51 AM, Dave Crocker wrote: You have again indulged in ad hominems, seeking to marginalize my postings,= but mostly sounding more like the coarse frustrations of a plaintive child= .[*] Professional discourse really is a much healthier approach to these s= ituations. I encourage you to experiment with that alternative. ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. --_000_693f66a8d52645778e82cc06b7c292d6PLSWE13M08adsprintcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Respectfully, and without regard to tim= ing or tenor, are any of Dave’s objections material?  I’m = not an expert on the material being discussed, but I have some responsibility for their commercial instantiation in my company and I̵= 7;m concerned there is an emotional reaction which perhaps obfuscates real = value in Dave’s review.  No disrespect intended to Jon, Chris, e= t al, but if there is going to be a mauling over STIR, I’d prefer it be a short-lived one for the authors and their p= rocess rather than a long-lived one endured by the users.=

 

Pierce

 

From: Tony Rutkowski [mailto:tony@yaanatech.com]
Sent: August 14, 2016 1:33 PM
To: dcrocker@bbiw.net; Peterson, Jon <jon.peterson@neustar.biz>= ;
Cc: stir@ietf.org
Subject: Re: [stir] Summary comments on draft-ietf-stir-* document t= rio at WG Last Call

 

In 30 some years of D= ave Crocker nastygrams, this is about
the worst I've seen.  You need to hold up a mirror to yourself
Dave.  Jon, Rich, Brian, and many others have been laboring
productively here, and the "dump 150+ objections in a last
call mail, and tap their feet impatiently" seems spot on.

--tony

On 2016-08-14 10:51 AM, Dave Crocker wrote:

You have again indulged in ad hominems, seeking to m= arginalize my postings, but mostly sounding more like the coarse frustratio= ns of a plaintive child.[*]  Professional discourse really is a much h= ealthier approach to these situations.  I encourage you to experiment with that alternative.

 



This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message.
 --_000_693f66a8d52645778e82cc06b7c292d6PLSWE13M08adsprintcom_-- From nobody Sun Aug 14 14:29:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B044A12D7E5 for ; Sun, 14 Aug 2016 14:29:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m1p27-yp0P61 for ; Sun, 14 Aug 2016 14:29:38 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id ED15E12D12B for ; Sun, 14 Aug 2016 14:29:37 -0700 (PDT) Received: (qmail 30412 invoked by uid 0); 14 Aug 2016 21:29:30 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy4.mail.unifiedlayer.com with SMTP; 14 Aug 2016 21:29:30 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id X9QR1t00v1MNPNq019QUWD; Sun, 14 Aug 2016 15:24:30 -0600 X-Authority-Analysis: v=2.1 cv=TIHWFTVa c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=FRid492KAnsWCsXHZr8A:9 a=wiTA9H2bvMg1VP2G:21 a=pMcUkL8X7-NBMFYe:21 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=AVI2YprpBhzxslhsp60tDBYGLZrT6g2yDTGIGXmQ35o=; b=AomePkDsrKmQITNqt8DNDt3Qt7 ZoGpuieIWneXBX5BSlQEBBgfwRouzWVVtEehrZo6EDLCYZeYemsXONX+MiK5eFRV5ZHOxq7z6aJVt RgCfc9a+MTfsgnbm6Wa5iobx2; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:64437 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bZ2tN-0004wz-OK; Sun, 14 Aug 2016 15:24:25 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sun, 14 Aug 2016 17:24:23 -0400 From: Richard Shockey To: , "Peterson, Jon" Message-ID: <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> Thread-Topic: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bZ2tN-0004wz-OK X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:64437 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2016 21:29:41 -0000 Again .. it should come as no suprise that I am in agreement with Jon=E2=80=99s c= omments here. In addition, if Jon seems rather rude or sarcastic in dismiss= ing your comments /concerns I believe he accurately represents the consensus= of many of us on this list. I prefer to reserve my rude / sarcastic commen= ts for one WG at at time aka MODERN. Even then my rudeness there is based on= the observation within the telecom industry that tactically MODERN is barki= ng up the wrong tree. Right idea, wrong application to start with.=20 Dave if this is your attempt to build a case to demand a full stop during I= ESG review then some of us have to document the counter argument right now.=20 First. I restate. The proposed protocol construct is in fact =E2=80=9Cfit for pur= pose=E2=80=9D. In fact its better than =E2=80=9Cfit for purpose=E2=80=9D. It is clearly and = demonstrably more flexable and extensible than DKIM for a good reason. SIP = is not SMTP. Your fundamental objection is a classic case of false equilive= ncy. Just because DKIM works for SMTP does not imply that it would/should w= ork for SIP. I catagorically reject the notion that they are the same. I = will go a bit farther. This is Telephony, not the Internet. The delegations= of authority in both naming and addressing (E.164), SIP being realtime, an= d the primary nature of nation state regulatory oversight are very very diff= erent than in general case of Internet protocols, though in the US with Titl= e II reclassification you can make the argument that the Internet is now Tel= ephony and not the other way around. I=E2=80=99ll save that discussion for anothe= r policy panel at another time and place. Second, though the immediate needs as defined in the charter were to valida= te claims about the Caller-ID (E.164) and potentially Calling Name within SI= P headers it was clear to most of us that there would be addititional claims= put forward about the session by various parties that would not and could n= ot be accmodiated by the DKIM protocols. What those claims might be do not = need to be identified at this time. Nor does the WG need to address how the = protocols could be used in different naming and addressing schemes. Jon is = more than capable of sharing with us his views on how this could work for WE= BRTC at the appropriate time. We build tools and keeping the protocol constr= uct to the minimum level in order to permit application providers maximum fl= exibility in how to apply those tools is a =E2=80=9Cgood thing=E2=80=9D tm.=20 I have certainly made clear my objections to the drafts but those are clear= ly editorial and not fundamentally archiectural. Third given the unique issues of nation state plenary authority in the E.16= 4 namespace it is not necessary nor is it proper to define the underlying Ce= rtificate Management construct or how either the public or private keys need= to be distributed. There is no way the North Americian Telecom industry is = going to permit the kind of shenanigans we have seen in the general WEB PKI = space. As far as telephone numbers go, for the time being we know how that d= elegation model works and what the industry agrees to _may_ generally match = that model. I dbout DNS/DANE will ever be considered, but in any event it w= ill not be decided here.=20 https://datatracker.ietf.org/doc/draft-iab-web-pki-problems/ Dave you are absolutely correct in several assertions. =E2=80=9CTelephone spam is= a serious, urgent, global problem, and has been for some years.=E2=80=9D =E2=80=9CThe technical aspects of global telephony probably preclu= de ever achieving a solution that will cover all phone service, everywhere.=E2= =80=9D=20 What I reject is the characterization of the proposed solution as some hybr= id Medusa that needs to be decapitated by the brave Ulysses before it threat= ens western civilization or 140 Billion dollars of US Telecom revenue. ( Ok = that was a bit over the top even by my standards).=20 Its August. We should know more in the upcoming days and weeks as the powe= rs that be gather. So I=E2=80=99ll leave Jon with the following thoughts as if I = were channeling Chairman Wheeler =E2=80=9CExamples, Examples, Examples=E2=80=9D. =20 I submit we have rough consensus and after the next SIPit we may even have = running code.=20 On 8/14/16, 10:51 AM, "stir on behalf of Dave Crocker" wrote: Jon, =20 On 8/13/2016 12:54 AM, Peterson, Jon wrote: > I've only participated in the IETF for half as long as you, but I can= say > I've never before seen someone decide to burst into a working group a= t the > last minute, dump 150+ objections on a document that is in last call = into > a single mail, tap their feet impatiently at the lack of a timely pub= lic =20 You have again indulged in ad hominems, seeking to marginalize my=20 postings, but mostly sounding more like the coarse frustrations of a=20 plaintive child.[*] Professional discourse really is a much healthier=20 approach to these situations. I encourage you to experiment with that=20 alternative. =20 As for my bursting in on the scene: You are well aware that I was quit= e=20 active during the formation of this working group, including providing=20 text for the charter, as well has my having extensive related experienc= e=20 to the problem being addressed here. But even if I had had no prior=20 contact, you sound as if you have never before experienced a diligent,=20 cross-area review or the fine-grained inspection of an IESG member=20 during the final approval process. How odd. =20 In any event, you are also aware that at that time the effort was=20 getting started I noted that the working group should focus on=20 authenticating the SIP header, but you folk were insistent that you had= =20 to take a multi-pronged approach, in spite of very clear warnings that=20 it would not be viable. I also noted the need for a clear and concrete= =20 understanding of precisely how this work would get used and which=20 entities would have what roles. =20 So here we are, 3 years later, with a proposal for authenticating the=20 SIP header, exactly as I had recommended. Better still is that it is=20 quite clear that the group still does not yet have a solid and detailed= =20 agreement on the way this technology will get used. =20 Predictably, you've made a point of developing these specifications=20 without trying to benefit from the 10 years of experience that has been= =20 gained in doing /exactly/ the same task for email. =20 The reviews I've done here are in the same form as I've been doing for=20 years. And yes, they took an extremely large amount of time to perform= ,=20 so really, your thanks for my community-minded effort are greatly=20 appreciated. =20 Sometimes, my reviews uncover basic and extensive problems. You are no= t=20 the first to be upset by them. But, again, welcome to the world of ope= n=20 participation and late-stage cross-review. Typically, the result of m= y=20 reviews is significant improvement to the specifications. Sometimes th= e=20 authors respond constructively from the start, but not always. It=20 sometimes requires less emotional heads to rule. =20 =20 > vetting of those issues, and expect this all to lead to some kind of > productive result. The authors (well, I at least, and I seem to recal= l > some mail from Chris as well) have been willing to engage with you, j= ust > apparently not on the terms you feel you are entitled to. From my =20 You are trying to confuse 'interact' with 'engage'. They are quite=20 different. =20 Your postings on the list have been generic, with platitudes and=20 challenges seeking to make me do more work. They have not contained=20 significant substance, until yesterday. So no, you did /not/ engage. =20 Any foot-tapping of mine you might have heard was not impatience but=20 rather frustration with your aggressive efforts to avoid engaging in=20 public discussion of the reviews' substance. =20 =20 > perspective, it is you who have refused to identify what you believe = the > substantive issues are, instead hiding behind a claim that there are = "many > and serious issues" buried deep in a mound of imposing comments. The > comments are objectively many, yes. Serious is a matter of opinion. =20 Jon, when someone puts the kind of very considerable time I've put into= =20 reviewing these documents and then posts it publicly, there is no=20 hiding. Or at least, not by me. =20 That you sought to impose an artificial burden back on me, as a way of=20 limiting your public engagement with the details of the reviews, is you= r=20 problem, not mine. =20 =20 d/ =20 =20 =20 [*] For reference, I filed a private complaint with the Chairs and AD,=20 after Jon's second ad hominem posting in this sequence, but Robert chos= e=20 merely to send a pro forma "let's do better" to both of us. I noted to= =20 him it would not alter Jon's behavior, as indeed we now see it did not. =20 =20 --=20 =20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Sun Aug 14 14:59:51 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34B7C12D80D for ; Sun, 14 Aug 2016 14:59:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.359 X-Spam-Level: X-Spam-Status: No, score=0.359 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZAOEUvH-t9i for ; Sun, 14 Aug 2016 14:59:49 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F86512D1DC for ; Sun, 14 Aug 2016 14:59:49 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7ELxsrJ016054 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sun, 14 Aug 2016 14:59:54 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471211994; bh=vrUrH+AwjynKPCcpmhpvax8FPrMZXmvREbeo7hXBBR4=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=Iseg38QeMPrKYdCkJGvqFv8s19kI+qdpr73X6dSbfLTAaqPAqMtbnvY+i2q8HAF5d gmzbXQXCwmdty9SCLSqumMJsqKkcluZ8PW3Gc9KnxvvaKskCrwJ8DRafvxqy4olZHh cJ+0dtW+dDzpKUcC5rRmbT4Bzq1jg369OhzKvnDM= To: Richard Shockey , "Peterson, Jon" References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Sun, 14 Aug 2016 14:59:15 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: [stir] Conduct (was - Re: Summary comments on draft-ietf-stir-* document trio at WG Last Call) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2016 21:59:50 -0000 On 8/14/2016 2:24 PM, Richard Shockey wrote: > if Jon seems rather rude or sarcastic in dismissing your comments > /concerns I believe he accurately represents the consensus of many of > us on this list. Richard, You appear to be saying the it is acceptable to indulge in disrespectful and unprofessional behavior as long as (some) others agree with you. Forgive me but I don't find support for that view in RFC 7154 or RFC 7776. In fact, such an effort at bullying a participant is at the core of creating a hostile work environment. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Aug 14 15:30:17 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3524012D111 for ; Sun, 14 Aug 2016 15:30:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EpFg-NnlnWq8 for ; Sun, 14 Aug 2016 15:30:14 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id A451912D0A7 for ; Sun, 14 Aug 2016 15:30:14 -0700 (PDT) Received: (qmail 24708 invoked by uid 0); 14 Aug 2016 22:30:12 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy2.mail.unifiedlayer.com with SMTP; 14 Aug 2016 22:30:12 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id XAR81t00w1MNPNq01ARBuf; Sun, 14 Aug 2016 16:25:11 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=8Rh57XSXeM-jAOUkJQMA:9 a=xSA8oyzbD_MI43i9:21 a=gjJZaI63w2_3aJTq:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=qzVEV2H95/QZ7Mf2eWmXAtmtywuGQ4Bszld+Jp1xqEU=; b=F1/4FmTv2RMRUvMB6EspL14Ovx 4z+dQXpc3hzJqvh5PoOG4Gwq2OkYJOJsWftO1Sa7sKFEUZbjpQ4VHU52UnAbexNZeFifTfqVG7EBH 1uKKp/QMjt8e4Let15WycmAap; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:65395 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bZ3q8-0006Xd-TM; Sun, 14 Aug 2016 16:25:09 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sun, 14 Aug 2016 18:25:06 -0400 From: Richard Shockey To: , "Peterson, Jon" Message-ID: <63087567-E053-40B1-8887-51C63E82DE93@shockey.us> Thread-Topic: [stir] Conduct (was - Re: Summary comments on draft-ietf-stir-* document trio at WG Last Call) References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bZ3q8-0006Xd-TM X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:65395 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Conduct (was - Re: Summary comments on draft-ietf-stir-* document trio at WG Last Call) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Aug 2016 22:30:16 -0000 So Dave what are you doing? =20 There is a reasonable argument that your position, at this stage of the pro= cess, is an attempt at bullying the consensus of the WG into believing that = we have made a fundamental mistake in protocol design and architecture. =20 I=E2=80=99ve stated my case in a reasonable rational manner but at some point you= r false assertions can=E2=80=99t hide behind political correctness.=20 As you have correctly noted this is a very very serious business. The lives= and wellbeing of our fellow citizens in the US, UK and elsewhere are at ris= k. It should not be surprising that emotions are running a little high so c= hill out please.=20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 On 8/14/16, 5:59 PM, "stir on behalf of Dave Crocker" wrote: On 8/14/2016 2:24 PM, Richard Shockey wrote: > if Jon seems rather rude or sarcastic in dismissing your comments > /concerns I believe he accurately represents the consensus of many of > us on this list. =20 =20 Richard, =20 You appear to be saying the it is acceptable to indulge in disrespectfu= l and unprofessional behavior as long as (some) others agree with you. =20 Forgive me but I don't find support for that view in RFC 7154 or RFC 77= 76. =20 In fact, such an effort at bullying a participant is at the core of creating a hostile work environment. =20 =20 d/ =20 --=20 =20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Sun Aug 14 17:06:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B830112D62D for ; Sun, 14 Aug 2016 17:05:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.359 X-Spam-Level: X-Spam-Status: No, score=0.359 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yyw0EuwrQcHS for ; Sun, 14 Aug 2016 17:05:58 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 367D112B064 for ; Sun, 14 Aug 2016 17:05:58 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7F0622Q021324 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sun, 14 Aug 2016 17:06:03 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471219563; bh=DCDbBVVvs8DtNzeHrEau6AYBT27sblxpgCVHuriPMDc=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=WtYw5ziY95Ji0wAeHKPb3UsZBhXrg8cBXitrz//+hYMbHVXndqYbAgLUL/wif/XKY OTkmNQf9pEMKRBTG9G4MzFfzJ+mG+kfz90qVaFyC1gRHeHDprkYvmqmkO093R6ZkND GqNKJtlIZJsEvuaTgeyW55vruV95Gi/udqAGiagM= To: Richard Shockey , "Peterson, Jon" References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <2a4bafcb-8727-64bd-8aa9-eca709d288b1@dcrocker.net> Date: Sun, 14 Aug 2016 17:05:23 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Summary comments on draft-ietf-stir-* document trio at WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 00:05:58 -0000 On 8/14/2016 2:24 PM, Richard Shockey wrote: > First. I restate. The proposed protocol construct is in fact “fit for > purpose”. In fact its better than “fit for purpose”. It is clearly > and demonstrably more flexable and extensible than DKIM for a good As you will see, if you read my reviews, the specs are profoundly deficient. Feel free to respond to the substance of those reviews, rather than proffer summary rejections like this. As for what STIR can do, there is nothing in its application here that is seeking to accomplish anything more than DKIM does, albeit here it is for caller-ID. That one difference does mandate significant specific technical differences, but that's very targeted work. > reason. SIP is not SMTP. Your fundamental objection is a classic DKIM has nothing to do with SMTP. If you are going to make assertions about technologies, please do so carefully. As for the technical reference that /does/ suit for DKIM, it pertains to the message header and body (RFC 5322). The SIP header was carefully modeled after that very same email header. So when you declare incompatibility, please be specific. In what ways exactly, beyond the one you discuss, below? > The delegations of authority in both > naming and addressing (E.164), SIP being realtime, Where SIP is using domain names, it appears to permit STIR equivalence to DKIM. I carefully noted that telephone /numbers/ pose a special challenge. But you folks haven't solved that either, in spite of have text that you are claiming does... As for realtime, please explain what there is in STIR that provides differential performance from DKIM. I don't see it. (I actually suspect it will be slower than DKIM, but maybe not.) > Second, though the immediate needs as defined in the charter were to > validate claims about the Caller-ID (E.164) and potentially Calling > Name within SIP headers it was clear to most of us that there would > be addititional claims put forward about the session by various > parties that would not and could not be accmodiated by the DKIM It is easy to argue fantasies. They are usually far more appealing than the drawbacks of cold, hard reality, and they never suffer the need to be concrete. The fact of that matter, however, is that the current specifications have no need for that general a model and there are no specifications drafted that do. Hence 'fantasy'. The IETF has periodically had similarly high-minded, but untested, generalities built into its protocols, in anticipation of eventually making enhancements. (e.g., SNMP Security field; TCP QOS) They proved useless by the time folks got around to trying to use them. > Third given the unique issues of nation state plenary authority in > the E.164 namespace it is not necessary nor is it proper to define > the underlying Certificate Management construct or how either the > public or private keys need to be distributed. There are many details that can be deferred, no doubt. But what has been done here is to specify nothing concrete about the mechanics of the query/validation service. This essentially seems to pretend that everything about such a service is policy, when it clearly isn't. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Aug 14 18:42:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2666D12D17E for ; Sun, 14 Aug 2016 18:42:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.247 X-Spam-Level: X-Spam-Status: No, score=-3.247 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zipdx.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VJg9z94NL0Vv for ; Sun, 14 Aug 2016 18:42:31 -0700 (PDT) Received: from xdev1sjc.zipdx.com (sjc-e-66.zipdx.com [166.88.23.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7781712D513 for ; Sun, 14 Aug 2016 18:42:31 -0700 (PDT) Received: from DPFyoga (c-73-15-29-134.hsd1.ca.comcast.net [73.15.29.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: dfrankel) by xdev1sjc.zipdx.com (Postfix) with ESMTPSA id 311D51B80294 for ; Sun, 14 Aug 2016 18:42:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=zipdx.com; s=default; t=1471225351; bh=Ja7fYXbPLqFxeLuGTzjwcLhe3ernSN4Jt6lCr6UNPGI=; h=From:To:Subject:Date:From; b=Deluyu6asr+7OyR/KTpxpe4EDGxcXbI1pcn5PB/Aom6urTv4zF6p0QWgmJrKXFZEj nhceLzrvGu4Q0Bv7U1jAfdRGOoEJQLl5zRW9zemLjUPMpQxtP9LTPhb0gzyd+I3hwm mi/SwRuJS3irgSTqWAGG9m1h5UfYsAUoopmr2+Ew= From: "David Frankel" To: Date: Sun, 14 Aug 2016 18:42:31 -0700 Organization: ZipDX LLC Message-ID: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_02D3_01D1F65B.9D693670" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdH2kOvvHKrcv2s6SpOm/pgnCc3k8w== Content-Language: en-us Archived-At: Subject: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 01:42:35 -0000 This is a multipart message in MIME format. ------=_NextPart_000_02D3_01D1F65B.9D693670 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I am writing this note to share a perspective on several aspects of STIR and its related specifications. I was prompted to do this by the numerous notes from Dave Crocker and the discussions that have ensued. My comments here are not specifically directed to Dave's issues. Rather, I noted that Dave was asking the group to live up to a level of rigor that, I think, was higher than where we've been operating. And I wanted to highlight some other areas that haven't been fully addressed and probably hold future pitfalls for this effort. Being rigorous and explicit about these issues might help us reach the end goals more quickly and pragmatically than ignoring them. There seems to be a lot of confusion, at least outside the group, about how STIR will be deployed and what the effect will be. I discuss below three of the most significant areas where I observe this: I) Specifications vs. Network Realities II) The (massive) nuances of Caller-Name vs. Caller-ID III) Expectations regarding Robocalls I'm not an "expert" on all things telecom, but I do have several decades of experience with legacy and current telephony, mostly in the United States. I'm hopeful that my comments are useful, at least to some. If they are out of place for this list, I'm sure people will let me know, and I'll ask you to forgive me and just ignore and/or delete this note if it isn't helpful. I'm sure at least some of you will read this and say, "Yeah, we knew all that already." And maybe it's all been sufficiently considered and doesn't need additional attention. I'll share anyway. I) Specifications vs. Network Realities: When writing "specifications" for the handling of telephone calls, a couple of important realities come to mind. One is that there are numerous "authorities" for how telephone networks (as we know, it isn't just one network; it's a network of networks) "must" or "should" work. A second is that even if you could gather those various specs and directives and regulations, you would find that the actual implementation is full of deviations - some large and some small; some on purpose and some accidental; some rare and some commonplace. In the beginning (depending on where you define the starting line), there were specs from the Bell System, published in modern times by Bellcore which became Telcordia. (Again, you'll see that I am mostly USA-centric, so you can assume that's what I'm talking about unless I mention otherwise.) When (the old) AT&T was the dominant carrier, most operators around the edges used these specs at least as their starting point for implementing and running their networks; equipment manufacturers conformed in order to place their gear with those operators. But even back then, as the networks were digitized and computerized (SS7, ISDN, SONET, ATM, SCPs, STPs, TCAP, PABXs, Feature Group D, etc.), manufacturers and operators purposefully deviated from the specs. Sometimes this was to differentiate a product or a service to gain a market advantage; sometimes it was to overcome a technical hurdle; sometimes it was to address a physical, political, economic or legal circumstance not anticipated by the specs. Regulators (not just the FCC, but even individual states) imposed rules that imposed limitations or deviations to the specs. Other organizations (e.g., ATIS) also published specifications. Any given operator's specific implementation ended up being guided by materials from several "standards" bodies, plus regulators and equipment suppliers, and ultimately even (big) customers. Ultimately, they implemented what they felt like implementing. Applying internet technology to the transport and delivery of telephone calls showed obvious promise and SIP went to the tip of everybody's tongue. But again, while we had RFCs suggesting how this "should" (or "must") work, in fact those RFCs are in practice only a "guide" to the implementers. Here are a few examples that are relevant, in varying degrees, to STIR: RE-ORIGINATION: In theory, an end-to-end SIP call would be passed from originator to destination relatively unchanged; each network hop would add a VIA header showing the path the call took. But in fact, for the billions of calls moving through the PSTN, this isn't how it works. Unless the call starts and ends on the same network, it will necessarily be passed between networks, often using one or more intermediary networks to get from start to finish. Each of those networks has specific economic interest in the call (they are going to get paid for it, or pay somebody for it, or both). Each network re-originates the call, making its own decisions about what headers to include (or not). The source of the call (upstream network) is purposefully obfuscated, because for competitive reasons, operators do not want their neighbors to know who is feeding them calls. The engineers on this list would of course prefer that not be done, but we don't get to make that rule. Even if we could convince SOME operators to do it our way, monetary interests will overrule in many other cases. (There's a further discussion about how the DIVERSION header should be used for re-originated calls, but we'll save that for another day.) INTERWORKING: Only a tiny fraction of calls today are end-to-end SIP. Most involve some interworking with SS7 or at least ISUP. And while there are RFCs that specify how that interworking "SHOULD" or "MUST" be done, in fact the gateway vendors and the network operators do it the way they want to do it. Some honor and use P-CHARGE-INFO; others do not. Some deliver X-CHARGE-NUM to the destination user; others do not. ISUP-OLI is sometimes passed in the FROM header; sometimes not. To be fully interoperable, systems that can benefit when these fields are available must be designed so they fail soft/safe when not available. While I realize STIR is intended only for the end-to-end SIP environment and thus avoids this level of interworking, there may be lessons that can be learned from how things do (or do not) actually function in the legacy world. And note how variable the performance is across operators. CALLER-ID SCREENING: Even at the dawn of legacy caller-ID, there was the notion of whether that number was "authenticated" or not. The ISUP Calling Party Number information element includes a "screening" indicator with several possible values: "network provided" means that the operator (presumably a "trusted" entity, whatever that meant then or now) determined what number to send based on subscriber account information; "user provided, network screened" means that the end-user customer (probably the owner of a PABX) provided the number, but the (trusted) operator made sure, somehow, that the number was "owned" by the end-user; and "user provided, not screened" meaning that we're just passing along whatever we got from the customer and don't know its validity. In theory, the screening indicator, which would be delivered to the call recipient, could be used just as we are discussing today in STIR to influence call handling at the receiving end. But guess what: despite being in the spec, and even implemented in lots of equipment, the "screening" indicator gets little use. For almost all calls, the calling party number is "user provided, not screened". Presumably it got too cumbersome to maintain the screening lists. Operators, interested in bringing on new customers, just turned off screening to expedite the onboarding process. NATIONAL CONSIDERATIONS: Richard Shockey in particular has been good about highlighting where the RFCs must stop and defer to national regulatory authority (or local practice). But that means that to actually implement anything, you have to not only follow the RFC, but you also have to understand the national considerations particular to your circumstance. And it's difficult to evaluate the practicality of a proposed RFC without also understanding how it would be deployed in the specific nationalities where you want to operate. In USA, we have the number portability database, the local exchange routing guide, the toll-free (SMS/800) database, and others. In fact, even an end-to-end internetwork SIP call can't complete without consulting the (legacy) number portability database. In parallel with the STIR RFCs, should somebody (ATIS?) be writing a STIR implementation spec for USA/North America? Reviewing 4474bis, there are numerous references to "outside the scope" and "deferred for future work". This is no doubt all for good reason, but you can't actually deploy anything until some of those items are addressed. Summary? They say you can lead a horse to water but you can't make him drink. And you can write specs all day long and mandate this or that, but at the end of the day, the implementers are going to decide how it really works, and forces stronger than our specs are likely going to be at work here. The ideal spec is written with enough knowledge and enough appreciation of the technical and economic realities where it will be deployed that implementers CHOOSE to fully adopt it. The spec adds value if adopting it is less painful than some other alternative. To flourish, the spec must, of course, be technically correct and, when followed, deliver on its stated objective(s). It should be well-enough thought through and sufficiently constrained that conforming to the spec is more efficient (in terms of both development and operation) than other approaches. Clearly in our environment INTEROPERATION is key - a huge advantage to following a spec should be that you are assured of interoperability with others that follow the spec. And the spec should TEACH. I think Dave Crocker has been trying to address all of these things. But even if we succeed on all that, remember that in the telecom environment, the spec must survive in an ecosystem where other forces are hard at work. II) Caller-ID Number and Caller-Name: A short time after caller-ID was introduced decades ago, we got Caller Name (CNAM). This functioned then not by sending the name along with the number from the origination point. Instead, we rely only on the number being sent to the destination. Then, a database lookup is performed ("CNAM dip") and the name associated with the number is displayed to the end-user. In the beginning, a carrier could only provide name information if the call both originated and terminated on its own network; the carriers that owned phone numbers maintained their own CNAM databases. Then they decided to give each other access to their database, but demanded compensation from the terminating carrier for each dip. (Tiny carriers used aggregators to maintain their databases and handle collection and disbursement of dip charges.) Over time, the CNAM databases have evolved. There are a few large operators still mostly conforming to the original notion. But other databases are available that use hybrid information (some entries from public records, others licensed or stolen from the official sources). And of course what's most popular on mobile phones: using the end-user's own contact list (stored in the phone) as the database. Most mobile operators do not, by default, deliver a call-by-call CNAM to the subscriber device over the air. A few offer to do a database lookup and deliver the result, usually for an extra monthly fee (since they incur a cost for doing the dips). As usual, economics drives the reality here. Most consumers care more about the name than the number; some telephone displays show only the name if it is available; the number is shown only if the name is not known. There are some more modern proposals for how the name information might be sourced (and even authenticated; see draft-peterson-stir-cnam-00) but I haven't seen substantive discussion of that here (and 12.6 of 4474bis mostly says it is out of scope). Private SIP-to-SIP calls of course use the display name in the FROM header. For Public Network calls, either an "authenticated name" could be displayed, or for an authenticated number, a dip into one of the various databases will be done to fetch a name. But how any validity is assigned to that name is an exercise for the reader (or left for a future version of the spec). Today, many service providers let customers specify any name they want for the database entries associated with their numbers. That name can often be set via a web portal or an API and can be "Alex Hamilton" or "Bill Clinton" or "FBI" or "Bank of America" even if the owner of the number is "Joe Fraudster". My point here is that we can kick the CNAM problem down the road, but it really is what most end-users care the most about. STIR as is may be a critical stepping stone to getting there, but we should set expectations regarding what the (intermediate) result is going to be. III) Expectations Regarding Robocalls - Speaking of setting expectations, there are high expectations that STIR will go a long way to dealing with the massive robocall problem. Last month, FCC Chairman Wheeler said: ""I am also calling on the carriers and standards groups to accelerate the development and deployment of technical standards that would prevent spoofing of caller ID and thus make blocking technologies more effective, as was done in the battle against spam years ago." If he believes that STIR as proposed is going to make any measurable dent, within the next five years, in mitigating the level of actual fraud facilitated by illegal robocalls, he is sadly mistaken. I think it's acknowledged that STIR only applies to end-to-end SIP calls, and then only when all intermediate carriers propagate the necessary headers. Those calls are likely to be a tiny fraction of all calls for the next several years. One theory says that the illegal robocallers will be the last ones to authenticate their calls (because they are, in fact, not authentic). So the theory is that we'll authenticate all OTHER (legitimate) calls, and then the illegal robocalls will stand out as the ones that aren't authenticated. But that's preposterous. In the US, there are hundreds of millions of endpoints that can originate calls; even if we managed to get 90% of them using STIR, there would still be tens of millions of (legitimate) endpoints originating unauthenticated calls. Now, the actual count of endpoints isn't so critical; more important is the volume of calls originated from authenticated endpoints versus non-authenticated. Lots of business-to-consumer calls are originated from PABXs and other systems connected via legacy PRI or even legacy analog lines and trunks. It seems unlikely that consumers will want to put all those (unauthenticated) calls through some CAPTCHA or similar system. It isn't clear to me what the game plan is for dealing with what will still be the large fraction of calls that that will remain unauthenticated for some time. (How the endpoint handles such calls are outside the scope of the spec, so how Wheeler knows that it is the savior to robocalls is beyond me.) Alternatively, there will probably be some illegal robocallers, and their enablers, that will jump on the STIR bandwagon if it comes to pass. There will be service providers that will solicit customers to sign up over the web, relatively anonymously, to get "authenticated" phone numbers (perhaps thousands or maybe even a million of them). They'll be able to set their CNAM to whatever they want. They'll place hundreds of millions of authenticated calls and then move on. The good news is that STIR will let us know who the service providers are that are making the authenticated credentials available to these robocallers, but it isn't clear what the next steps are. I've seen mention of (again, out of scope) potential "reputation" metrics for providers. But it isn't clear how a call recipient would determine the reputation of the provider, or what they would do when an authenticated call was received from somebody using credentials issued by a less-than-fully-reputable provider. And all of that assumes a level of sophistication on the part of the call recipient to actually deploy some feature or filter that acts on the authentication (and reputation?) information. Robocallers almost by definition do not prey on the sophisticated; they prey on the elderly and disadvantaged and desperate, who typically don't have the latest smartphone or the coolest VoIP service. (Yes, robocalls annoy all of us, but I promise you that nobody on this mailing list is their target.) We should certainly learn everything we can from the email spam battle, but the analogy isn't 100% applicable by any means. Email has the SIGNIFICANT advantage that filters have access not just to the headers (which include, importantly, a SUBJECT line), but also to the ENTIRE CONTENT of the message. (This is also true for SMS.) With voice calls, we have far less information available, and certainly no clue as to what the content will be. "Doing for voice calls what we did for email" is a technical fantasy. So members of this list are being disingenuous if they are telling Mr. Wheeler and others to expect a dramatic near-term drop in robocall complaints once STIR (as currently envisioned) is deployed. CONCLUSION? I'm not for (or against) major revisions to the document. But I do think that expectations need to be properly set. 4474bis 12.2 says in part: ".preventing the simple unauthorized claiming of an identity for the purposes of robocalling, voicemail hacking, or swatting, which is the primary scope of the current document." The document lays some groundwork that will be useful, in part, in ultimately limiting robocalling, but nobody has connected all the dots for me on how it will actually, pragmatically be deployed to achieve that objective (same for swatting). Some of you, no doubt, will tell me THAT is beyond the scope of the document(s). If nothing else, the document could enumerate the out-of-scope dependencies upon which we are dependent before realizing any actual utility (or deployability) of the spec. And even then, the utility to the end-user is going to be severely limited until deployment reaches some critical mass and additional fundamental limitations are addressed. David Frankel ZipDXR LLC Monte Sereno, CA USA ------=_NextPart_000_02D3_01D1F65B.9D693670 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I am writing this note to share a perspective on = several aspects of STIR and its related specifications. I was prompted = to do this by the numerous notes from Dave Crocker and the discussions = that have ensued.

 

My comments = here are not specifically directed to Dave’s issues. Rather, I = noted that Dave was asking the group to live up to a level of rigor = that, I think, was higher than where we’ve been operating. And I = wanted to highlight some other areas that haven’t been fully = addressed and probably hold future pitfalls for this effort. Being = rigorous and explicit about these issues might help us reach the end = goals more quickly and pragmatically than ignoring = them.

 

There seems to be a lot of confusion, at least outside = the group, about how STIR will be deployed and what the effect will be. = I discuss below three of the most significant areas where I observe = this:

I) Specifications vs. Network = Realities

II) The (massive) nuances = of Caller-Name vs. Caller-ID

III) = Expectations regarding Robocalls

 

I’m = not an “expert” on all things telecom, but I do have several = decades of experience with legacy and current telephony, mostly in the = United States. I’m hopeful that my comments are useful, at least = to some. If they are out of place for this list, I’m sure people = will let me know, and I’ll ask you to forgive me and just ignore = and/or delete this note if it isn’t helpful.

 

I’m = sure at least some of you will read this and say, “Yeah, we knew = all that already.” And maybe it’s all been sufficiently = considered and doesn’t need additional attention. I’ll share = anyway.

 

I) Specifications vs. Network Realities: When writing = “specifications” for the handling of telephone calls, a = couple of important realities come to mind. One is that there are = numerous “authorities” for how telephone networks (as we = know, it isn’t just one network; it’s a network of networks) = “must” or “should” work. A second is that even = if you could gather those various specs and directives and regulations, = you would find that the actual implementation is full of deviations = – some large and some small; some on purpose and some accidental; = some rare and some commonplace.

 

In the = beginning (depending on where you define the starting line), there were = specs from the Bell System, published in modern times by Bellcore which = became Telcordia. (Again, you’ll see that I am mostly USA-centric, = so you can assume that’s what I’m talking about unless I = mention otherwise.) When (the old) AT&T was the dominant carrier, = most operators around the edges used these specs at least as their = starting point for implementing and running their networks; equipment = manufacturers conformed in order to place their gear with those = operators.

 

But even back then, as the networks were digitized and = computerized (SS7, ISDN, SONET, ATM, SCPs, STPs, TCAP, PABXs, Feature = Group D, etc.), manufacturers and operators purposefully deviated from = the specs. Sometimes this was to differentiate a product or a service to = gain a market advantage; sometimes it was to overcome a technical = hurdle; sometimes it was to address a physical, political, economic or = legal circumstance not anticipated by the specs.

 

Regulators = (not just the FCC, but even individual states) imposed rules that = imposed limitations or deviations to the specs. Other organizations = (e.g., ATIS) also published specifications. Any given operator’s = specific implementation ended up being guided by materials from several = “standards” bodies, plus regulators and equipment suppliers, = and ultimately even (big) customers. Ultimately, they implemented what = they felt like implementing.

 

Applying = internet technology to the transport and delivery of telephone calls = showed obvious promise and SIP went to the tip of everybody’s = tongue. But again, while we had RFCs suggesting how this = “should” (or “must”) work, in fact those RFCs = are in practice only a “guide” to the implementers. =

 

Here are a few examples that are relevant, in varying = degrees, to STIR:

 

RE-ORIGINATION: In theory, an end-to-end SIP call = would be passed from originator to destination relatively unchanged; = each network hop would add a VIA header showing the path the call took. = But in fact, for the billions of calls moving through the PSTN, this = isn’t how it works. Unless the call starts and ends on the same = network, it will necessarily be passed between networks, often using one = or more intermediary networks to get from start to finish. Each of those = networks has specific economic interest in the call (they are going to = get paid for it, or pay somebody for it, or both).

 

Each network = re-originates the call, making its own decisions about what headers to = include (or not). The source of the call (upstream network) is = purposefully obfuscated, because for competitive reasons, operators do = not want their neighbors to know who is feeding them calls. The = engineers on this list would of course prefer that not be done, but we = don’t get to make that rule. Even if we could convince SOME = operators to do it our way, monetary interests will overrule in many = other cases. (There’s a further discussion about how the DIVERSION = header should be used for re-originated calls, but we’ll save that = for another day.)

 

INTERWORKING: Only a tiny fraction of calls today are = end-to-end SIP. Most involve some interworking with SS7 or at least = ISUP. And while there are RFCs that specify how that interworking = “SHOULD” or “MUST” be done, in fact the gateway = vendors and the network operators do it the way they want to do it. Some = honor and use P-CHARGE-INFO; others do not. Some deliver X-CHARGE-NUM to = the destination user; others do not. ISUP-OLI is sometimes passed in the = FROM header; sometimes not. To be fully interoperable, systems that can = benefit when these fields are available must be designed so they fail = soft/safe when not available. While I realize STIR is intended only for = the end-to-end SIP environment and thus avoids this level of = interworking, there may be lessons that can be learned from how things = do (or do not) actually function in the legacy world. And note how = variable the performance is across operators.

 

CALLER-ID = SCREENING: Even at the dawn of legacy caller-ID, there was the notion of = whether that number was “authenticated” or not. The ISUP = Calling Party Number information element includes a = “screening” indicator with several possible values: = “network provided” means that the operator (presumably a = “trusted” entity, whatever that meant then or now) = determined what number to send based on subscriber account information; = “user provided, network screened” means that the end-user = customer (probably the owner of a PABX) provided the number, but the = (trusted) operator made sure, somehow, that the number was = “owned” by the end-user; and “user provided, not = screened” meaning that we’re just passing along whatever we = got from the customer and don’t know its validity.  In = theory, the screening indicator, which would be delivered to the call = recipient, could be used just as we are discussing today in STIR to = influence call handling at the receiving end.

 

But guess = what: despite being in the spec, and even implemented in lots of = equipment, the “screening” indicator gets little use. For = almost all calls, the calling party number is “user provided, not = screened”. Presumably it got too cumbersome to maintain the = screening lists. Operators, interested in bringing on new customers, = just turned off screening to expedite the onboarding = process.

 

NATIONAL CONSIDERATIONS: Richard Shockey in particular = has been good about highlighting where the RFCs must stop and defer to = national regulatory authority (or local practice). But that means that = to actually implement anything, you have to not only follow the RFC, but = you also have to understand the national considerations particular to = your circumstance. And it’s difficult to evaluate the practicality = of a proposed RFC without also understanding how it would be deployed in = the specific nationalities where you want to operate. In USA, we have = the number portability database, the local exchange routing guide, the = toll-free (SMS/800) database, and others. In fact, even an end-to-end = internetwork SIP call can’t complete without consulting the = (legacy) number portability database. In parallel with the STIR RFCs, = should somebody (ATIS?) be writing a STIR implementation spec for = USA/North America?

 

Reviewing = 4474bis, there are numerous references to “outside the = scope” and “deferred for future work”. This is no = doubt all for good reason, but you can’t actually deploy anything = until some of those items are addressed.

 

Summary? = They say you can lead a horse to water but you can’t make him = drink. And you can write specs all day long and mandate this or that, = but at the end of the day, the implementers are going to decide how it = really works, and forces stronger than our specs are likely going to be = at work here. The ideal spec is written with enough knowledge and enough = appreciation of the technical and economic realities where it will be = deployed that implementers CHOOSE to fully adopt it. The spec adds value = if adopting it is less painful than some other alternative. To flourish, = the spec must, of course, be technically correct and, when followed, = deliver on its stated objective(s). It should be well-enough thought = through and sufficiently constrained that conforming to the spec is more = efficient (in terms of both development and operation) than other = approaches. Clearly in our environment INTEROPERATION is key – a = huge advantage to following a spec should be that you are assured of = interoperability with others that follow the spec. And the spec should = TEACH. I think Dave Crocker has been trying to address all of these = things. But even if we succeed on all that, remember that in the telecom = environment, the spec must survive in an ecosystem where other forces = are hard at work.

 

II) = Caller-ID Number and Caller-Name: A short time after caller-ID was = introduced decades ago, we got Caller Name (CNAM). This functioned then = not by sending the name along with the number from the origination = point. Instead, we rely only on the number being sent to the = destination. Then, a database lookup is performed (“CNAM = dip”) and the name associated with the number is displayed to the = end-user.

 

In the beginning, a carrier could only provide name = information if the call both originated and terminated on its own = network; the carriers that owned phone numbers maintained their own CNAM = databases. Then they decided to give each other access to their = database, but demanded compensation from the terminating carrier for = each dip. (Tiny carriers used aggregators to maintain their databases = and handle collection and disbursement of dip charges.) Over time, the = CNAM databases have evolved. There are a few large operators still = mostly conforming to the original notion. But other databases are = available that use hybrid information (some entries from public records, = others licensed or stolen from the official sources). And of course = what’s most popular on mobile phones: using the end-user’s = own contact list (stored in the phone) as the database. =

 

Most mobile operators do not, by default, deliver a = call-by-call CNAM to the subscriber device over the air. A few offer to = do a database lookup and deliver the result, usually for an extra = monthly fee (since they incur a cost for doing the dips). As usual, = economics drives the reality here.

 

Most = consumers care more about the name than the number; some telephone = displays show only the name if it is available; the number is shown only = if the name is not known. There are some more modern proposals for how = the name information might be sourced (and even authenticated; see = draft-peterson-stir-cnam-00) but I haven’t seen substantive = discussion of that here (and 12.6 of 4474bis mostly says it is out of = scope). Private SIP-to-SIP calls of course use the display name in the = FROM header. For Public Network calls, either an “authenticated = name” could be displayed, or for an authenticated number, a dip = into one of the various databases will be done to fetch a name. But how = any validity is assigned to that name is an exercise for the reader (or = left for a future version of the spec). Today, many service providers = let customers specify any name they want for the database entries = associated with their numbers. That name can often be set via a web = portal or an API and can be “Alex Hamilton” or “Bill = Clinton” or “FBI” or “Bank of America” = even if the owner of the number is “Joe = Fraudster”.

 

My point = here is that we can kick the CNAM problem down the road, but it really = is what most end-users care the most about. STIR as is may be a critical = stepping stone to getting there, but we should set expectations = regarding what the (intermediate) result is going to = be.

 

III) Expectations Regarding Robocalls – Speaking = of setting expectations, there are high expectations that STIR will go a = long way to dealing with the massive robocall problem. Last month, FCC = Chairman Wheeler said: ““I am also calling on the carriers = and standards groups to accelerate the development and deployment of = technical standards that would prevent spoofing of caller ID and thus = make blocking technologies more effective, as was done in the battle = against spam years ago.” If he believes that STIR as proposed is = going to make any measurable dent, within the next five years, in = mitigating the level of actual fraud facilitated by illegal robocalls, = he is sadly mistaken.

 

I think = it’s acknowledged that STIR only applies to end-to-end SIP calls, = and then only when all intermediate carriers propagate the necessary = headers. Those calls are likely to be a tiny fraction of all calls for = the next several years. One theory says that the illegal robocallers = will be the last ones to authenticate their calls (because they are, in = fact, not authentic). So the theory is that we’ll authenticate all = OTHER (legitimate) calls, and then the illegal robocalls will stand out = as the ones that aren’t authenticated.

 

But = that’s preposterous. In the US, there are hundreds of millions of = endpoints that can originate calls; even if we managed to get 90% of = them using STIR, there would still be tens of millions of (legitimate) = endpoints originating unauthenticated calls. Now, the actual count of = endpoints isn’t so critical; more important is the volume of calls = originated from authenticated endpoints versus non-authenticated. Lots = of business-to-consumer calls are originated from PABXs and other = systems connected via legacy PRI or even legacy analog lines and trunks. = It seems unlikely that consumers will want to put all those = (unauthenticated) calls through some CAPTCHA or similar system. It = isn’t clear to me what the game plan is for dealing with what will = still be the large fraction of calls that that will remain = unauthenticated for some time. (How the endpoint handles such calls are = outside the scope of the spec, so how Wheeler knows that it is the = savior to robocalls is beyond me.)

 

Alternatively, there will probably be some illegal = robocallers, and their enablers, that will jump on the STIR bandwagon if = it comes to pass. There will be service providers that will solicit = customers to sign up over the web, relatively anonymously, to get = “authenticated” phone numbers (perhaps thousands or maybe = even a million of them). They’ll be able to set their CNAM to = whatever they want. They’ll place hundreds of millions of = authenticated calls and then move on. The good news is that STIR will = let us know who the service providers are that are making the = authenticated credentials available to these robocallers, but it = isn’t clear what the next steps are. I’ve seen mention of = (again, out of scope) potential “reputation” metrics for = providers. But it isn’t clear how a call recipient would determine = the reputation of the provider, or what they would do when an = authenticated call was received from somebody using credentials issued = by a less-than-fully-reputable provider.

 

And all of = that assumes a level of sophistication on the part of the call recipient = to actually deploy some feature or filter that acts on the = authentication (and reputation?) information. Robocallers almost by = definition do not prey on the sophisticated; they prey on the elderly = and disadvantaged and desperate, who typically don’t have the = latest smartphone or the coolest VoIP service. (Yes, robocalls annoy all = of us, but I promise you that nobody on this mailing list is their = target.)

 

We should certainly learn everything we can from the = email spam battle, but the analogy isn’t 100% applicable by any = means. Email has the SIGNIFICANT advantage that filters have access not = just to the headers (which include, importantly, a SUBJECT line), but = also to the ENTIRE CONTENT of the message. (This is also true for SMS.) = With voice calls, we have far less information available, and certainly = no clue as to what the content will be. “Doing for voice calls = what we did for email” is a technical fantasy.

 

So members = of this list are being disingenuous if they are telling Mr. Wheeler and = others to expect a dramatic near-term drop in robocall complaints once = STIR (as currently envisioned) is deployed.

 

CONCLUSION? = I’m not for (or against) major revisions to the document. But I do = think that expectations need to be properly set. 4474bis 12.2 says in = part: “…preventing the simple unauthorized claiming of an = identity for the purposes of robocalling, voicemail hacking, or = swatting, which is the primary scope of the current document.” The = document lays some groundwork that will be useful, in part, in = ultimately limiting robocalling, but nobody has connected all the dots = for me on how it will actually, pragmatically be deployed to achieve = that objective (same for swatting). Some of you, no doubt, will tell me = THAT is beyond the scope of the document(s). If nothing else, the = document could enumerate the out-of-scope dependencies upon which we are = dependent before realizing any actual utility (or deployability) of the = spec. And even then, the utility to the end-user is going to be severely = limited until deployment reaches some critical mass and additional = fundamental limitations are addressed.

 

David Frankel

ZipDX® LLC

Monte Sereno, CA = USA

------=_NextPart_000_02D3_01D1F65B.9D693670-- From nobody Mon Aug 15 07:13:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 016A012DE27 for ; Mon, 15 Aug 2016 07:13:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.721 X-Spam-Level: X-Spam-Status: No, score=-2.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cooperw.in header.b=cTmpisiW; dkim=pass (1024-bit key) header.d=messagingengine.com header.b=B6nP2q+u Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TD5mUCVRqnYD for ; Mon, 15 Aug 2016 07:13:40 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41A4312DE2D for ; Mon, 15 Aug 2016 07:13:40 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id B30BB20493 for ; Mon, 15 Aug 2016 10:13:39 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute3.internal (MEProxy); Mon, 15 Aug 2016 10:13:39 -0400 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=cooperw.in; h= content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=zeT 7EAd6SzdRdVfuWwBs98doH18=; b=cTmpisiWAi53nCosNnY65Q9eNelS9p3pqNf FGgETj0UeILD7m48eqiqtoY6pC0fMoZH7LjwKDwlpQRUqev+heacSgYfTh1xXYh/ BvuyJLm2XDb/dJ1WmVXLs+LOq/hFB4mqD+01Caqo4VGZfZrA0GHNUf7Q2+P3A3aD cuE6WtP8= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-sasl-enc :x-sasl-enc; s=smtpout; bh=zeT7EAd6SzdRdVfuWwBs98doH18=; b=B6nP2 q+uk5PL8MUMKVglUxqYNaaHSDxLOFcH4y5NPCs1KvWluX48zbMcgxCVCLVrlLTU+ MOTjdWOnHFD0dHDRS51FvU0hAaNp6cZw1SoJTSlH7STfYZ4K1ECKlCKidZQWet1D nEy4p/jEK4AcglBXKw7D0WqYOV4g4b9NBWrVrs= X-Sasl-enc: Trdr9uoXp+2Syme9mT674REZ+BzPFeSoD1pONYOIyx74 1471270419 Received: from dhcp-10-150-9-170.cisco.com (unknown [173.38.117.72]) by mail.messagingengine.com (Postfix) with ESMTPA id 6A39FCCE75 for ; Mon, 15 Aug 2016 10:13:39 -0400 (EDT) From: Alissa Cooper Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: <53A05C18-6660-4B0C-8BEA-5A79D4F90F76@cooperw.in> Date: Mon, 15 Aug 2016 10:13:38 -0400 To: stir@ietf.org Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [stir] A note about August X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 14:13:42 -0000 Hi all, Perhaps you have noticed that the chairs and I have not intervened in = list discussions as of late. That is because we have all been on = vacation or otherwise away from work. We will engage as we return, but = that will likely take some time (I am back but the chairs may not be for = awhile, and I=E2=80=99d like to respect their autonomy as chairs). In the meantime, I would like to ask everyone posting this list to = refrain from personal commentary of any sort about other participants. I = know that is a stricter limitation than any that is usually set for IETF = mailing lists. I know many of you have known each other for a long time. = You may have read mail in recent days that you found personally = offensive; you may have written mail that offended somebody else. In any = case, making personal comments on this list is not helping the Internet = work better, nor is reacting to personal commentary. Please stick to = substantive technical discussion to the extent that you believe you can = constructively engage in such. If not, please await the return of chairs = (and authors) from vacation so that a productive way forward can be = defined. Thanks, Alissa= From nobody Mon Aug 15 07:22:13 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A4F412D50A for ; Mon, 15 Aug 2016 07:22:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fxG2Mkc1Iu3i for ; Mon, 15 Aug 2016 07:22:04 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0127.outbound.protection.outlook.com [104.47.36.127]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35D8312DE67 for ; Mon, 15 Aug 2016 07:22:04 -0700 (PDT) Received: from BN1BFFO11FD049.protection.gbl (10.58.144.32) by BN1BFFO11HUB028.protection.gbl (10.58.144.175) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Mon, 15 Aug 2016 14:22:01 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.39) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.39 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.39; helo=plsapdm3.corp.sprint.com; Received: from plsapdm3.corp.sprint.com (144.230.172.39) by BN1BFFO11FD049.mail.protection.outlook.com (10.58.145.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Mon, 15 Aug 2016 14:22:01 +0000 Received: from pps.filterd (plsapdm3.corp.sprint.com [127.0.0.1]) by plsapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7FEHSBA004724; Mon, 15 Aug 2016 09:22:00 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm3.corp.sprint.com with ESMTP id 24t0t9917x-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 09:22:00 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 15 Aug 2016 09:21:59 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 15 Aug 2016 09:21:59 -0500 From: "Gorman, Pierce A [CTO]" To: David Frankel , "stir@ietf.org" Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMw Date: Mon, 15 Aug 2016 14:21:58 +0000 Message-ID: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> In-Reply-To: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.38] Content-Type: multipart/alternative; boundary="_000_fcf7475b38cc4766b6e28f34962e1eb1PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.39; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(189002)(377454003)(199003)(586003)(2906002)(54356999)(50986999)(5250100002)(106466001)(356003)(84326002)(92566002)(106116001)(2501003)(19625215002)(3846002)(6116002)(76176999)(790700001)(102836003)(7846002)(81156014)(11100500001)(512954002)(19300405004)(24736003)(8676002)(81166006)(4546004)(19580405001)(97736004)(108616004)(5001770100001)(7696003)(8936002)(19580395003)(7736002)(626004)(2900100001)(86362001)(260700001)(189998001)(16236675004)(107886002)(87936001)(33646002)(2950100001)(68736007)(15975445007)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1BFFO11HUB028; H:plsapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11FD049; 1:lhkQErxzqHXf6kpE1lw4FmXMB6jYb78Z/wra83ky0y4CYwsBgupjpkNbN9Yjvy1CUlELJle7Gcm9NHgnIJyNvkQvIZVDiUHMBTQCBSJ17aYxsD9jJDcitkQBGgpSHCH0IM/D3h3+CgQJa4XTph77dmn5G8/mbqOoHl0SsZNwEXRM4V2FZj4pNAFsQvZvl8eDgAt2lY3af0d/AxRUbI0GFYUWqQmYFWJgIyVJ+bwVUGK17z8UWJCCYxF9pwP64LgFXZaQ78nLA+j/Jg0tp+8OGE0zXqKUccH9Ip/w5jhd0Gb8pfUaJP4MBNjjXHdCgznnwygxr9roMOYDaIfxSuFSx/eXOjk8IvLZ7/JPk5M9CDhdFmT2BaDQF6axKFhRcf308oiULxldHblY0Vcx0r0NViTiXZslrHMnec9qzsz1JRD+BcfHDdxbSc9jeoW4Omx8xF/u9M2LBxcJnjIBPx4J0D4sK18nwWTSCKrKudGjOGjvXy/00OQ30ep077HoPOT/v0rFyKMely8zUoddJlW8cpo0eiwssdQBzXMTAmsozqcNuFxIOl7hVk1uy2J/Itog X-MS-Office365-Filtering-Correlation-Id: b99c49e8-2529-4438-37f0-08d3c5178619 X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB028; 2:PGIxggZBXdkifYxXsRsz2FIFHI82ztn+4B6ib8d2zvXswT1E8oq9Q5twKo4hl5IqUpTuBoa7hNLiDDlNLcHkf6K/Y2QveOAZH54mHulTBJ0lie6d7GgGwm6+Up9cS1czLo2CU4QmCgV3gmzPo9KrqXOx5JSebCOeQKawb/B//opJNKJlet7sBXc8+A+O33aL; 3:IrqK04OykgXykAYPVQxqFe7dl5n6zkFm5K4bUK3lrqbd2/iZeY+yLwHZDHfFZ0OUiaBjylw4LflKnTo1+9MGPIC7sGJS+5DpXqOzAFwPZtdq4iZ+6ETrJ2i4DSkJBuUHChwzo16VW0knVtLJFnLUpEVDdqe562TZWGrO4IzledSCBIRtzcJ10u74GDdmrmgGM2B1JqhVBNUZ0aI7iK3A076dYkmXBHV6Q3TVKK83loDNkl5wjJmIybXi9CLwl4aNoOGjz+ei1+/raLXHwsdI9Q==; 25:Y4YWCooTBPI4pGNOxUVdLcrl6qXzqBKuXFND7y59TOisU9/6c3bPCxclkZn1edXA43cP3qe6KN9dcXb9QTte9Jo4meeTKB0a2Et9NQV1FXFhrAeFLzQu/MXvFtbQeE023nLJfeD4uu8GEzZa593e4ldkfvK29bb5OuAy+BVQK3EsaB7c993xuklyR//7br/JcqhJS+xWV0AlLrgXadLd2eXIxdxu5gk2wtXmuomaqfTdH+XOZq0/Xwj3JfeS9H4//nW8fF/iGaqcNmrytzqXeIdgBnFv/IKsf76SPy89Py/aKZf58zrySZgx417vtOjrRfCzRTVmnyxv3C1A81m+ASjM0qx5OMWTLGT4Sn3mg+b6+lTJIdJ583DSZKfyyLZae1kHP1RONR2KYybvdAHoONx9phyeQmQJL3QalgMXUgM274XVNhiJVPovK0wRUlFG X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1BFFO11HUB028; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB028; 31:B0CmGT4Jj7DcLCFObx+eu8+SL9bGLEV0pNuBhYYKUa2VE7lSNa6rVXS5t+awF8jtcbfbauMoeIaxJy4hUNUVfodTtfLj69U94TLpb+e5c9dfNnX/uw7QzVpfUgbBd6wQVHowNJ3gaADp+VYDgfSWDvM7eYbzJoA4r6/o6mMQAYSYHMDgZhUHjVRjFTO7anmYCFvYBNOwW3HxZ1u//3LvgcHR0cLEnD7LWjWuzGUKGmU=; 20:PUdU5dcORLAkhoZUT2+DBRwa9V6XlhuqKT5bk2hbt5L+5dvRP1XsGERWimgJwRZn1US7J1nFyqSjXWf/zLju2AfGejWo6V/MxopNyMhYV+fKgzCR6HUz8R8lsEbhEY8FUxp88AMSQTaRiIaPWAn5UfhlofEkuDZUegnUxY3gbtaBQq/XeY/+iQhDtut11nPGroI8lAdJwbiUBWv9915brmZdswvWMZ16ovosZDHc8WNz/bAlBcdxxet4LjjJfOaCdj30TKyJvM0jLdhIdfNLDFFCbYlagygUoIiUZfeBUiOENr3WIaKU1w9raTXloUY82M3U+tbekejRdnEBiksVqDQk8w2xoiBdkrxy0gbV1T5wGNI4EC2yepXEmJiur3LgPRYvwYkFNUf2UjPYaW4dcha+YnI95/AB5lL5hP9B7Vw= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(190756311086443)(21748063052155)(275809806118684); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(13024025)(13018025)(13015025)(13017025)(13023025)(10201501046)(3002001)(6055026); SRVR:BN1BFFO11HUB028; BCL:0; PCL:0; RULEID:; SRVR:BN1BFFO11HUB028; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB028; 4:7IFX2ifVGMr9nSn/OntBP/UMkRIl+aL4QGB/K8fkajgHSi5qKLIjNxfHIp+pnqFFAvg2Bxc7futunzOSgldXkhefeE2//CHGXrrx3M/SuXPzo3wBN70Zp+o+RH+fswXVLYFFO7dZxxEKdihbJ1ECOHxIzenDXKiE51B3O+7hnozVdv8/akrDC8TSHFJf7P+yKOz5dXum7e5If6XUD/9DGanUs7J8fO+2ZUCC7U9Tj06uWG5H8qWiNpnEO8JurevHAFjgLK1DXsCa/SA3bxINBeTuC2cQyr8o+fWuyfBfT8EXw94dEtefcMzg/2Wz8QA3nkPk4pfrBvzGSAMGps50FEoKd5u6Hf9V+/WUzzbrJKEQ+i7q/tm6Yoo4qGrF/j3zgtq0FJu02p2NbwwW+iQVpIZrUXb5WdFkl84+KObH6Fb206lf6F5GlSaLzoEH3kgtVUjG7k7PzXXtvDsJZ6kfBGEidix6rr2sq2x+8yfw8NdPo5+Dh+t1zVZeX2GZmajdxhNNm0NwQNnV7hua8BX7/GsHgK3UanTLZxNr9bFrxp9c5LKG1+3wQW3ijdkKf4KpiBDLLL3W8jWN8tbtcUdaHXDX8BdUp/w/7hwoe+RHT7U= X-Forefront-PRVS: 0035B15214 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1BFFO11HUB028; 23:5VRUQMHVI67vpniDapGcljfCwr/C+Y039rtEA2g?= =?us-ascii?Q?RkRbNkio5OID8R5WZrlfU1pvXVhHXquyQrrpCRJIteh01WGPot3IZgYP3Lqe?= =?us-ascii?Q?iRLKcLQbv7fmilGGQHTH0/+pt6BJ/qHoSZHIU77YbA1z+mW0zTVjijDfl3oS?= =?us-ascii?Q?5n1p9hv9Nyzxu3CFZ5r1SaCIuAd5Km39bTIZdRIzI4CFWrTlgXFNqwKUEMWi?= =?us-ascii?Q?kyzq7TFt+x+I7o0ChR7o0mSd2gO9hXb4JgvaAOiIHjSehq5BBsFV4cpEVHj7?= =?us-ascii?Q?/qGRM5f9c8mHO3o1S8TsRd6gcBD77ROBav6meeUgOlQNHpAiGEGzmmTXDtqm?= =?us-ascii?Q?neAWBXoSSHk9z6OqnW0aAtkkIXyCc73l1GhJ46fJ9tNBZ7nPoNfQVTjnJzEZ?= =?us-ascii?Q?Fp2lMwaA4hCB+IoVa/5qhRV2IBmLVDAsaVo02LGmfTZK9ulR65ZkAn+mWtOJ?= =?us-ascii?Q?+HSD5X+aGpk9mi4U4qcpDy/y7m2VrOTbX/+bKtN7zqisfCS3cwnV0XaC7dWm?= =?us-ascii?Q?RjobmR87zAqVBsopx3ykjq8VploiCQrwOZb5eD7866SN+YxuYHTloeeZDaUY?= =?us-ascii?Q?16H0vOSQBLK1sS/ZOy0BHuIyN/CawaW8Iil48w83ei9qEz2yyjbueCk7T5+S?= =?us-ascii?Q?8eKAaFF5IEyuhIPr9F9hqKMMO1mkMhGFpwd98kiyZgWXkIYCyKM7w9h/OlhQ?= =?us-ascii?Q?//3jY4NPQ7tPQLEfbJYEur4vcPO5f7u7pL3/6MtldrBcdOC97e2A4XbO+gzd?= =?us-ascii?Q?1nF92/RhyzmoB/0akIWH04U/CXJWIv4YfNEzZ3glG29LbeJNEnRcKQShK/t1?= =?us-ascii?Q?dBqEsMeJLp3qIIvFNLSWbgLyyIlmWkKc8z1YbbInD67P3Jjl3F07eiGAJ2c1?= =?us-ascii?Q?OVhYi+dOrY90m3h1D1MlVvM+V9CyaLKAlMaNuXCmRqvoUW6vjjfk9N0aWKfk?= =?us-ascii?Q?7h/YpqHZOzOLP6ZiS1KDqe8mhw1HisCjfF+sQ3wuGULgDKEcdAH9qxUH2tkC?= =?us-ascii?Q?g26H79aJV5LeL9psRc28Vpj9WLuTzDPdvsi1GG7bPwMNFp2gPNKR5x1MiYS5?= =?us-ascii?Q?V2LTOJufwg8mIY4tx06Enem/QUUHpGHT7GxHI3S4lOy3HixfrEfrzrrbOHam?= =?us-ascii?Q?b7+SBIYxXuF/f3c6HKgpz3hxjxbs0nHvXFhQpZmHZhPP5pRFqhj7Jpi8y68w?= =?us-ascii?Q?Kg9oz1u1rkcG8iCjMdZs6L9Clyctr7RcSMmCC/Q6A+JPDvsa5Zp4pa0OsLr4?= =?us-ascii?Q?y0X8wFj+6L5lL59Gsef3VPOmlAM66k07NVJeGqrC0WdvMDqRcVTJT/iQcQgV?= =?us-ascii?Q?/r9sCtn+Ud+0fuwHef09OLGr1iyCoWLwh8w3YbalV6D+b?= X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11HUB028; 6:KmsUa/LeDbTI8EP0zUMSjmGsm29KyHbwFLi8mael9BexSh2FfV4rScph8t9eKs7+A6Yfz8P8N+zxQrlMVwmnfMu6Em1EDHW47WwvYl03qyLBAkkhEXjr17qg6Qwq7lcLPDYkPJsXpB5Co3h/p8UESLTimptCvrRZFwD3r2Jx4fFuxmD8FW+B26rqEpQQFndfXEAjvpDRxXhT/YUp6R8xWOUqdqMOeTfssjhnIUbMiWH8vyiAWeA0zxT+sBTjzHvQXbQ2WJFM/NHiTcWBk5B+8DpsCe/ACR6YH2Zhuqiygz1eqobsGTOl7ucEPD/T4dOrphnYoH+Yyl4Tbz88y2HgKQ==; 5:3yjoLmFdyF7qeVlS17SfiXB2xEB71CRsZQHsJYbh/cpsJg2PSGXXlOynrEReUD88ZmuDveHHupqf7d70quCy/WzWugNWwq4mte2LF1sf6mSm4kJMe/7J986cvC48T1vviCPlLyoVTrYSDfwyVzv83A==; 24:i+Y2wnjEwT2+qoxWELWE7a16bRXFibYjqXmu3lrT/Ro1fbkNw9KogqZMNq/ObOpb7g52uDDO9VKzNpyAGvkrcRc2xUB13/WVgO2MFF4490k=; 7:jqwwF2CkIizUjpqoDvg4TVdsYAbn4TKJV4XqAeEAa2uvMtni+Xwn2vogcF+9SlkAXqQYL68YaD+s8MDJ8uCfJWMpD1ZRWBBa6ilYkzJPp2HRtLuoM79mC7934B8urSTW8M2o4zRDnA9GqecGC/OAqp2nV5jQJhS9XPhks/4H4chDwVGPklPdOmyjwb88CuaBHXvy20Rc+yw+H/gGTpVHv2nr/b3v7lwAlLYy1wMGRAVnKJRyPqYf2Z0CA6mKSWe6 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Aug 2016 14:22:01.2375 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.39]; Helo=[plsapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1BFFO11HUB028 Archived-At: Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 14:22:10 -0000 --_000_fcf7475b38cc4766b6e28f34962e1eb1PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Your suggestion to "enumerate the out-of-scope dependencies" is a good requ= est. I hope the authors will make some attempt, as well as an example or two. (= Ironically the word "example" appears 54 times but not in relation to an ac= tual example.) My personal view agrees with yours that there seems to be an expectation th= at STIR will operate on endpoints in an end-to-end fashion when in fact, to= have any hope of nearer term deployment of anything hopefully approaching = critical mass (and even then there are very big challenges), the carriers w= ill be required to do the key management, the signing, and the interpretati= on of signatures. What is signed and how it is interpreted are critical pieces of information= and need to be kept extremely simple or, IMHO, this will be as big mess as= you've tried to warn. And of course these critical pieces will not be pro= vided here. As far as "out-of-scope dependencies" I'll suggest that how keys are manage= d, what is signed, and how the signatures should be interpreted are the big= 3 that occur to me. I am hopeful that the SHAKEN Framework being crafted in the ATIS/SIP Forum = IP NNI Joint Task Force will be able to accomplish the "what" is signed and= how key management (for North American carrier implementations) should ope= rate. I suspect carrier key management may be a subject of regulation but = don't know for sure. I am also hopeful that 3GPP will define "how" the SHAKEN signature is to be= interpreted, especially for corner-case requirements such as E911 when roa= ming on a carrier with whom the subscriber's carrier does not have a roamin= g relationship, and manual roaming. Outside of carrier implementation, I have very little idea what endpoint de= velopers will want to do, but am willing to let the market figure that out = for itself. Pierce From: David Frankel [mailto:dfrankel@zipdx.com] Sent: August 14, 2016 8:43 PM To: stir@ietf.org Subject: [stir] Setting Expectations regarding STIR Deployment Realities I am writing this note to share a perspective on several aspects of STIR an= d its related specifications. I was prompted to do this by the numerous not= es from Dave Crocker and the discussions that have ensued. My comments here are not specifically directed to Dave's issues. Rather, I = noted that Dave was asking the group to live up to a level of rigor that, I= think, was higher than where we've been operating. And I wanted to highlig= ht some other areas that haven't been fully addressed and probably hold fut= ure pitfalls for this effort. Being rigorous and explicit about these issue= s might help us reach the end goals more quickly and pragmatically than ign= oring them. There seems to be a lot of confusion, at least outside the group, about how= STIR will be deployed and what the effect will be. I discuss below three o= f the most significant areas where I observe this: I) Specifications vs. Network Realities II) The (massive) nuances of Caller-Name vs. Caller-ID III) Expectations regarding Robocalls I'm not an "expert" on all things telecom, but I do have several decades of= experience with legacy and current telephony, mostly in the United States.= I'm hopeful that my comments are useful, at least to some. If they are out= of place for this list, I'm sure people will let me know, and I'll ask you= to forgive me and just ignore and/or delete this note if it isn't helpful. I'm sure at least some of you will read this and say, "Yeah, we knew all th= at already." And maybe it's all been sufficiently considered and doesn't ne= ed additional attention. I'll share anyway. I) Specifications vs. Network Realities: When writing "specifications" for = the handling of telephone calls, a couple of important realities come to mi= nd. One is that there are numerous "authorities" for how telephone networks= (as we know, it isn't just one network; it's a network of networks) "must"= or "should" work. A second is that even if you could gather those various = specs and directives and regulations, you would find that the actual implem= entation is full of deviations - some large and some small; some on purpose= and some accidental; some rare and some commonplace. In the beginning (depending on where you define the starting line), there w= ere specs from the Bell System, published in modern times by Bellcore which= became Telcordia. (Again, you'll see that I am mostly USA-centric, so you = can assume that's what I'm talking about unless I mention otherwise.) When = (the old) AT&T was the dominant carrier, most operators around the edges us= ed these specs at least as their starting point for implementing and runnin= g their networks; equipment manufacturers conformed in order to place their= gear with those operators. But even back then, as the networks were digitized and computerized (SS7, I= SDN, SONET, ATM, SCPs, STPs, TCAP, PABXs, Feature Group D, etc.), manufactu= rers and operators purposefully deviated from the specs. Sometimes this was= to differentiate a product or a service to gain a market advantage; someti= mes it was to overcome a technical hurdle; sometimes it was to address a ph= ysical, political, economic or legal circumstance not anticipated by the sp= ecs. Regulators (not just the FCC, but even individual states) imposed rules tha= t imposed limitations or deviations to the specs. Other organizations (e.g.= , ATIS) also published specifications. Any given operator's specific implem= entation ended up being guided by materials from several "standards" bodies= , plus regulators and equipment suppliers, and ultimately even (big) custom= ers. Ultimately, they implemented what they felt like implementing. Applying internet technology to the transport and delivery of telephone cal= ls showed obvious promise and SIP went to the tip of everybody's tongue. Bu= t again, while we had RFCs suggesting how this "should" (or "must") work, i= n fact those RFCs are in practice only a "guide" to the implementers. Here are a few examples that are relevant, in varying degrees, to STIR: RE-ORIGINATION: In theory, an end-to-end SIP call would be passed from orig= inator to destination relatively unchanged; each network hop would add a VI= A header showing the path the call took. But in fact, for the billions of c= alls moving through the PSTN, this isn't how it works. Unless the call star= ts and ends on the same network, it will necessarily be passed between netw= orks, often using one or more intermediary networks to get from start to fi= nish. Each of those networks has specific economic interest in the call (th= ey are going to get paid for it, or pay somebody for it, or both). Each network re-originates the call, making its own decisions about what he= aders to include (or not). The source of the call (upstream network) is pur= posefully obfuscated, because for competitive reasons, operators do not wan= t their neighbors to know who is feeding them calls. The engineers on this = list would of course prefer that not be done, but we don't get to make that= rule. Even if we could convince SOME operators to do it our way, monetary = interests will overrule in many other cases. (There's a further discussion = about how the DIVERSION header should be used for re-originated calls, but = we'll save that for another day.) INTERWORKING: Only a tiny fraction of calls today are end-to-end SIP. Most = involve some interworking with SS7 or at least ISUP. And while there are RF= Cs that specify how that interworking "SHOULD" or "MUST" be done, in fact t= he gateway vendors and the network operators do it the way they want to do = it. Some honor and use P-CHARGE-INFO; others do not. Some deliver X-CHARGE-= NUM to the destination user; others do not. ISUP-OLI is sometimes passed in= the FROM header; sometimes not. To be fully interoperable, systems that ca= n benefit when these fields are available must be designed so they fail sof= t/safe when not available. While I realize STIR is intended only for the en= d-to-end SIP environment and thus avoids this level of interworking, there = may be lessons that can be learned from how things do (or do not) actually = function in the legacy world. And note how variable the performance is acro= ss operators. CALLER-ID SCREENING: Even at the dawn of legacy caller-ID, there was the no= tion of whether that number was "authenticated" or not. The ISUP Calling Pa= rty Number information element includes a "screening" indicator with severa= l possible values: "network provided" means that the operator (presumably a= "trusted" entity, whatever that meant then or now) determined what number = to send based on subscriber account information; "user provided, network sc= reened" means that the end-user customer (probably the owner of a PABX) pro= vided the number, but the (trusted) operator made sure, somehow, that the n= umber was "owned" by the end-user; and "user provided, not screened" meanin= g that we're just passing along whatever we got from the customer and don't= know its validity. In theory, the screening indicator, which would be del= ivered to the call recipient, could be used just as we are discussing today= in STIR to influence call handling at the receiving end. But guess what: despite being in the spec, and even implemented in lots of = equipment, the "screening" indicator gets little use. For almost all calls,= the calling party number is "user provided, not screened". Presumably it g= ot too cumbersome to maintain the screening lists. Operators, interested in= bringing on new customers, just turned off screening to expedite the onboa= rding process. NATIONAL CONSIDERATIONS: Richard Shockey in particular has been good about = highlighting where the RFCs must stop and defer to national regulatory auth= ority (or local practice). But that means that to actually implement anythi= ng, you have to not only follow the RFC, but you also have to understand th= e national considerations particular to your circumstance. And it's difficu= lt to evaluate the practicality of a proposed RFC without also understandin= g how it would be deployed in the specific nationalities where you want to = operate. In USA, we have the number portability database, the local exchang= e routing guide, the toll-free (SMS/800) database, and others. In fact, eve= n an end-to-end internetwork SIP call can't complete without consulting the= (legacy) number portability database. In parallel with the STIR RFCs, shou= ld somebody (ATIS?) be writing a STIR implementation spec for USA/North Ame= rica? Reviewing 4474bis, there are numerous references to "outside the scope" and= "deferred for future work". This is no doubt all for good reason, but you = can't actually deploy anything until some of those items are addressed. Summary? They say you can lead a horse to water but you can't make him drin= k. And you can write specs all day long and mandate this or that, but at th= e end of the day, the implementers are going to decide how it really works,= and forces stronger than our specs are likely going to be at work here. Th= e ideal spec is written with enough knowledge and enough appreciation of th= e technical and economic realities where it will be deployed that implement= ers CHOOSE to fully adopt it. The spec adds value if adopting it is less pa= inful than some other alternative. To flourish, the spec must, of course, b= e technically correct and, when followed, deliver on its stated objective(s= ). It should be well-enough thought through and sufficiently constrained th= at conforming to the spec is more efficient (in terms of both development a= nd operation) than other approaches. Clearly in our environment INTEROPERAT= ION is key - a huge advantage to following a spec should be that you are as= sured of interoperability with others that follow the spec. And the spec sh= ould TEACH. I think Dave Crocker has been trying to address all of these th= ings. But even if we succeed on all that, remember that in the telecom envi= ronment, the spec must survive in an ecosystem where other forces are hard = at work. II) Caller-ID Number and Caller-Name: A short time after caller-ID was intr= oduced decades ago, we got Caller Name (CNAM). This functioned then not by = sending the name along with the number from the origination point. Instead,= we rely only on the number being sent to the destination. Then, a database= lookup is performed ("CNAM dip") and the name associated with the number i= s displayed to the end-user. In the beginning, a carrier could only provide name information if the call= both originated and terminated on its own network; the carriers that owned= phone numbers maintained their own CNAM databases. Then they decided to gi= ve each other access to their database, but demanded compensation from the = terminating carrier for each dip. (Tiny carriers used aggregators to mainta= in their databases and handle collection and disbursement of dip charges.) = Over time, the CNAM databases have evolved. There are a few large operators= still mostly conforming to the original notion. But other databases are av= ailable that use hybrid information (some entries from public records, othe= rs licensed or stolen from the official sources). And of course what's most= popular on mobile phones: using the end-user's own contact list (stored in= the phone) as the database. Most mobile operators do not, by default, deliver a call-by-call CNAM to th= e subscriber device over the air. A few offer to do a database lookup and d= eliver the result, usually for an extra monthly fee (since they incur a cos= t for doing the dips). As usual, economics drives the reality here. Most consumers care more about the name than the number; some telephone dis= plays show only the name if it is available; the number is shown only if th= e name is not known. There are some more modern proposals for how the name = information might be sourced (and even authenticated; see draft-peterson-st= ir-cnam-00) but I haven't seen substantive discussion of that here (and 12.= 6 of 4474bis mostly says it is out of scope). Private SIP-to-SIP calls of c= ourse use the display name in the FROM header. For Public Network calls, ei= ther an "authenticated name" could be displayed, or for an authenticated nu= mber, a dip into one of the various databases will be done to fetch a name.= But how any validity is assigned to that name is an exercise for the reade= r (or left for a future version of the spec). Today, many service providers= let customers specify any name they want for the database entries associat= ed with their numbers. That name can often be set via a web portal or an AP= I and can be "Alex Hamilton" or "Bill Clinton" or "FBI" or "Bank of America= " even if the owner of the number is "Joe Fraudster". My point here is that we can kick the CNAM problem down the road, but it re= ally is what most end-users care the most about. STIR as is may be a critic= al stepping stone to getting there, but we should set expectations regardin= g what the (intermediate) result is going to be. III) Expectations Regarding Robocalls - Speaking of setting expectations, t= here are high expectations that STIR will go a long way to dealing with the= massive robocall problem. Last month, FCC Chairman Wheeler said: ""I am al= so calling on the carriers and standards groups to accelerate the developme= nt and deployment of technical standards that would prevent spoofing of cal= ler ID and thus make blocking technologies more effective, as was done in t= he battle against spam years ago." If he believes that STIR as proposed is = going to make any measurable dent, within the next five years, in mitigatin= g the level of actual fraud facilitated by illegal robocalls, he is sadly m= istaken. I think it's acknowledged that STIR only applies to end-to-end SIP calls, a= nd then only when all intermediate carriers propagate the necessary headers= . Those calls are likely to be a tiny fraction of all calls for the next se= veral years. One theory says that the illegal robocallers will be the last = ones to authenticate their calls (because they are, in fact, not authentic)= . So the theory is that we'll authenticate all OTHER (legitimate) calls, an= d then the illegal robocalls will stand out as the ones that aren't authent= icated. But that's preposterous. In the US, there are hundreds of millions of endpo= ints that can originate calls; even if we managed to get 90% of them using = STIR, there would still be tens of millions of (legitimate) endpoints origi= nating unauthenticated calls. Now, the actual count of endpoints isn't so c= ritical; more important is the volume of calls originated from authenticate= d endpoints versus non-authenticated. Lots of business-to-consumer calls ar= e originated from PABXs and other systems connected via legacy PRI or even = legacy analog lines and trunks. It seems unlikely that consumers will want = to put all those (unauthenticated) calls through some CAPTCHA or similar sy= stem. It isn't clear to me what the game plan is for dealing with what will= still be the large fraction of calls that that will remain unauthenticated= for some time. (How the endpoint handles such calls are outside the scope = of the spec, so how Wheeler knows that it is the savior to robocalls is bey= ond me.) Alternatively, there will probably be some illegal robocallers, and their e= nablers, that will jump on the STIR bandwagon if it comes to pass. There wi= ll be service providers that will solicit customers to sign up over the web= , relatively anonymously, to get "authenticated" phone numbers (perhaps tho= usands or maybe even a million of them). They'll be able to set their CNAM = to whatever they want. They'll place hundreds of millions of authenticated = calls and then move on. The good news is that STIR will let us know who the= service providers are that are making the authenticated credentials availa= ble to these robocallers, but it isn't clear what the next steps are. I've = seen mention of (again, out of scope) potential "reputation" metrics for pr= oviders. But it isn't clear how a call recipient would determine the reputa= tion of the provider, or what they would do when an authenticated call was = received from somebody using credentials issued by a less-than-fully-reputa= ble provider. And all of that assumes a level of sophistication on the part of the call r= ecipient to actually deploy some feature or filter that acts on the authent= ication (and reputation?) information. Robocallers almost by definition do = not prey on the sophisticated; they prey on the elderly and disadvantaged a= nd desperate, who typically don't have the latest smartphone or the coolest= VoIP service. (Yes, robocalls annoy all of us, but I promise you that nobo= dy on this mailing list is their target.) We should certainly learn everything we can from the email spam battle, but= the analogy isn't 100% applicable by any means. Email has the SIGNIFICANT = advantage that filters have access not just to the headers (which include, = importantly, a SUBJECT line), but also to the ENTIRE CONTENT of the message= . (This is also true for SMS.) With voice calls, we have far less informati= on available, and certainly no clue as to what the content will be. "Doing = for voice calls what we did for email" is a technical fantasy. So members of this list are being disingenuous if they are telling Mr. Whee= ler and others to expect a dramatic near-term drop in robocall complaints o= nce STIR (as currently envisioned) is deployed. CONCLUSION? I'm not for (or against) major revisions to the document. But I= do think that expectations need to be properly set. 4474bis 12.2 says in p= art: "...preventing the simple unauthorized claiming of an identity for the= purposes of robocalling, voicemail hacking, or swatting, which is the prim= ary scope of the current document." The document lays some groundwork that = will be useful, in part, in ultimately limiting robocalling, but nobody has= connected all the dots for me on how it will actually, pragmatically be de= ployed to achieve that objective (same for swatting). Some of you, no doubt= , will tell me THAT is beyond the scope of the document(s). If nothing else= , the document could enumerate the out-of-scope dependencies upon which we = are dependent before realizing any actual utility (or deployability) of the= spec. And even then, the utility to the end-user is going to be severely l= imited until deployment reaches some critical mass and additional fundament= al limitations are addressed. David Frankel ZipDX(r) LLC Monte Sereno, CA USA ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. --_000_fcf7475b38cc4766b6e28f34962e1eb1PLSWE13M08adsprintcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Your suggestion to “enumerate the out-of-sc= ope dependencies” is a good request.

 

I hope the authors will make some attempt, as well as an= example or two.  (Ironically the word “example” appears 5= 4 times but not in relation to an actual example.)

 

My personal view agrees with yours that there seems to b= e an expectation that STIR will operate on endpoints in an end-to-end fashi= on when in fact, to have any hope of nearer term deployment of anything hopefully approaching critical mass (and even then = there are very big challenges), the carriers will be required to do the key= management, the signing, and the interpretation of signatures.<= /span>

 

What is signed and how it is interpreted are critical pi= eces of information and need to be kept extremely simple or, IMHO, this wil= l be as big mess as you’ve tried to warn.  And of course these critical pieces will not be provided here.

 

As far as “out-of-scope dependencies” I&#= 8217;ll suggest that how keys are managed, what is signed, and how the sign= atures should be interpreted are the big 3 that occur to me.

 

I am hopeful that the SHAKEN Framework being crafted in = the ATIS/SIP Forum IP NNI Joint Task Force will be able to accomplish the &= #8220;what” is signed and how key management (for North American carrier implementations) should operate.  I suspect c= arrier key management may be a subject of regulation but don’t know f= or sure.

 

I am also hopeful that 3GPP will define “how”= ; the SHAKEN signature is to be interpreted, especially for corner-case req= uirements such as E911 when roaming on a carrier with whom the subscriber’s carrier does not have a roaming relationship, and m= anual roaming.

 

Outside of carrier implementation, I have very little id= ea what endpoint developers will want to do, but am willing to let the mark= et figure that out for itself.

 

Pierce

 

 

From: David Frankel [mailto:dfrankel@zipdx.co= m]
Sent: August 14, 2016 8:43 PM
To: stir@ietf.org
Subject: [stir] Setting Expectations regarding STIR Deployment Reali= ties

 

I am writing this note to share a perspective on sev= eral aspects of STIR and its related specifications. I was prompted to do t= his by the numerous notes from Dave Crocker and the discussions that have e= nsued.

 

My comments here are not specifically directed to Da= ve’s issues. Rather, I noted that Dave was asking the group to live u= p to a level of rigor that, I think, was higher than where we’ve been= operating. And I wanted to highlight some other areas that haven’t been fully addressed and probably hold future pit= falls for this effort. Being rigorous and explicit about these issues might= help us reach the end goals more quickly and pragmatically than ignoring t= hem.

 

There seems to be a lot of confusion, at least outsi= de the group, about how STIR will be deployed and what the effect will be. = I discuss below three of the most significant areas where I observe this:

I) Specifications vs. Network Realities

II) The (massive) nuances of Caller-Name vs. Caller-= ID

III) Expectations regarding Robocalls

 

I’m not an “expert” on all things = telecom, but I do have several decades of experience with legacy and curren= t telephony, mostly in the United States. I’m hopeful that my comment= s are useful, at least to some. If they are out of place for this list, I’m sure people will let me know, and I’ll ask you = to forgive me and just ignore and/or delete this note if it isn’t hel= pful.

 

I’m sure at least some of you will read this a= nd say, “Yeah, we knew all that already.” And maybe it’s = all been sufficiently considered and doesn’t need additional attentio= n. I’ll share anyway.

 

I) Specifications vs. Network Realities: When writin= g “specifications” for the handling of telephone calls, a coupl= e of important realities come to mind. One is that there are numerous ̶= 0;authorities” for how telephone networks (as we know, it isn’t just one network; it’s a network of networks) “= must” or “should” work. A second is that even if you coul= d gather those various specs and directives and regulations, you would find= that the actual implementation is full of deviations – some large an= d some small; some on purpose and some accidental; some rare and some common= place.

 

In the beginning (depending on where you define the = starting line), there were specs from the Bell System, published in modern = times by Bellcore which became Telcordia. (Again, you’ll see that I a= m mostly USA-centric, so you can assume that’s what I’m talking about unless I mention otherwise.) Whe= n (the old) AT&T was the dominant carrier, most operators around the ed= ges used these specs at least as their starting point for implementing and = running their networks; equipment manufacturers conformed in order to place their gear with those operators.

 

But even back then, as the networks were digitized a= nd computerized (SS7, ISDN, SONET, ATM, SCPs, STPs, TCAP, PABXs, Feature Gr= oup D, etc.), manufacturers and operators purposefully deviated from the sp= ecs. Sometimes this was to differentiate a product or a service to gain a market advantage; sometimes it was to ove= rcome a technical hurdle; sometimes it was to address a physical, political= , economic or legal circumstance not anticipated by the specs.

 

Regulators (not just the FCC, but even individual st= ates) imposed rules that imposed limitations or deviations to the specs. Ot= her organizations (e.g., ATIS) also published specifications. Any given ope= rator’s specific implementation ended up being guided by materials from several “standards” bodies, = plus regulators and equipment suppliers, and ultimately even (big) customer= s. Ultimately, they implemented what they felt like implementing.

 

Applying internet technology to the transport and de= livery of telephone calls showed obvious promise and SIP went to the tip of= everybody’s tongue. But again, while we had RFCs suggesting how this= “should” (or “must”) work, in fact those RFCs are in practice only a “guide” to the implementers. =

 

Here are a few examples that are relevant, in varyin= g degrees, to STIR:

 

RE-ORIGINATION: In theory, an end-to-end SIP call wo= uld be passed from originator to destination relatively unchanged; each net= work hop would add a VIA header showing the path the call took. But in fact= , for the billions of calls moving through the PSTN, this isn’t how it works. Unless the call starts an= d ends on the same network, it will necessarily be passed between networks,= often using one or more intermediary networks to get from start to finish.= Each of those networks has specific economic interest in the call (they are going to get paid for it, or pay somebody f= or it, or both).

 

Each network re-originates the call, making its own = decisions about what headers to include (or not). The source of the call (u= pstream network) is purposefully obfuscated, because for competitive reason= s, operators do not want their neighbors to know who is feeding them calls. The engineers on this list would of cou= rse prefer that not be done, but we don’t get to make that rule. Even= if we could convince SOME operators to do it our way, monetary interests w= ill overrule in many other cases. (There’s a further discussion about how the DIVERSION header should be used for re-= originated calls, but we’ll save that for another day.)

 

INTERWORKING: Only a tiny fraction of calls today ar= e end-to-end SIP. Most involve some interworking with SS7 or at least ISUP.= And while there are RFCs that specify how that interworking “SHOULD&= #8221; or “MUST” be done, in fact the gateway vendors and the network operators do it the way they want to do it. Some h= onor and use P-CHARGE-INFO; others do not. Some deliver X-CHARGE-NUM to the= destination user; others do not. ISUP-OLI is sometimes passed in the FROM = header; sometimes not. To be fully interoperable, systems that can benefit when these fields are available mu= st be designed so they fail soft/safe when not available. While I realize S= TIR is intended only for the end-to-end SIP environment and thus avoids thi= s level of interworking, there may be lessons that can be learned from how things do (or do not) actually fun= ction in the legacy world. And note how variable the performance is across = operators.

 

CALLER-ID SCREENING: Even at the dawn of legacy call= er-ID, there was the notion of whether that number was “authenticated= ” or not. The ISUP Calling Party Number information element includes = a “screening” indicator with several possible values: “network provided” means that the operator (presumably= a “trusted” entity, whatever that meant then or now) determine= d what number to send based on subscriber account information; “user = provided, network screened” means that the end-user customer (probabl= y the owner of a PABX) provided the number, but the (trusted) operator made = sure, somehow, that the number was “owned” by the end-user; and= “user provided, not screened” meaning that we’re just pa= ssing along whatever we got from the customer and don’t know its validity.  In theory, the screening indicator, which would be deliver= ed to the call recipient, could be used just as we are discussing today in = STIR to influence call handling at the receiving end.

 

But guess what: despite being in the spec, and even = implemented in lots of equipment, the “screening” indicator get= s little use. For almost all calls, the calling party number is “user= provided, not screened”. Presumably it got too cumbersome to maintain the screening lists. Operators, interested in bringing on new = customers, just turned off screening to expedite the onboarding process.

 

NATIONAL CONSIDERATIONS: Richard Shockey in particul= ar has been good about highlighting where the RFCs must stop and defer to n= ational regulatory authority (or local practice). But that means that to ac= tually implement anything, you have to not only follow the RFC, but you also have to understand the national c= onsiderations particular to your circumstance. And it’s difficult to = evaluate the practicality of a proposed RFC without also understanding how = it would be deployed in the specific nationalities where you want to operate. In USA, we have the number portability database= , the local exchange routing guide, the toll-free (SMS/800) database, and o= thers. In fact, even an end-to-end internetwork SIP call can’t comple= te without consulting the (legacy) number portability database. In parallel with the STIR RFCs, should somebody (ATI= S?) be writing a STIR implementation spec for USA/North America?=

 

Reviewing 4474bis, there are numerous references to = “outside the scope” and “deferred for future work”.= This is no doubt all for good reason, but you can’t actually deploy = anything until some of those items are addressed.

 

Summary? They say you can lead a horse to water but = you can’t make him drink. And you can write specs all day long and ma= ndate this or that, but at the end of the day, the implementers are going t= o decide how it really works, and forces stronger than our specs are likely going to be at work here. The ideal spe= c is written with enough knowledge and enough appreciation of the technical= and economic realities where it will be deployed that implementers CHOOSE = to fully adopt it. The spec adds value if adopting it is less painful than some other alternative. To flour= ish, the spec must, of course, be technically correct and, when followed, d= eliver on its stated objective(s). It should be well-enough thought through= and sufficiently constrained that conforming to the spec is more efficient (in terms of both development and= operation) than other approaches. Clearly in our environment INTEROPERATIO= N is key – a huge advantage to following a spec should be that you ar= e assured of interoperability with others that follow the spec. And the spec should TEACH. I think Dave Crocker has = been trying to address all of these things. But even if we succeed on all t= hat, remember that in the telecom environment, the spec must survive in an = ecosystem where other forces are hard at work.

 

II) Caller-ID Number and Caller-Name: A short time a= fter caller-ID was introduced decades ago, we got Caller Name (CNAM). This = functioned then not by sending the name along with the number from the orig= ination point. Instead, we rely only on the number being sent to the destination. Then, a database lookup is pe= rformed (“CNAM dip”) and the name associated with the number is= displayed to the end-user.

 

In the beginning, a carrier could only provide name = information if the call both originated and terminated on its own network; = the carriers that owned phone numbers maintained their own CNAM databases. = Then they decided to give each other access to their database, but demanded compensation from the terminating c= arrier for each dip. (Tiny carriers used aggregators to maintain their data= bases and handle collection and disbursement of dip charges.) Over time, th= e CNAM databases have evolved. There are a few large operators still mostly conforming to the original notion. = But other databases are available that use hybrid information (some entries= from public records, others licensed or stolen from the official sources).= And of course what’s most popular on mobile phones: using the end-user’s own contact list (stored in t= he phone) as the database.

 

Most mobile operators do not, by default, deliver a = call-by-call CNAM to the subscriber device over the air. A few offer to do = a database lookup and deliver the result, usually for an extra monthly fee = (since they incur a cost for doing the dips). As usual, economics drives the reality here.

 

Most consumers care more about the name than the num= ber; some telephone displays show only the name if it is available; the num= ber is shown only if the name is not known. There are some more modern prop= osals for how the name information might be sourced (and even authenticated; see draft-peterson-stir-cnam-00)= but I haven’t seen substantive discussion of that here (and 12.6 of = 4474bis mostly says it is out of scope). Private SIP-to-SIP calls of course= use the display name in the FROM header. For Public Network calls, either an “authenticated name” could= be displayed, or for an authenticated number, a dip into one of the variou= s databases will be done to fetch a name. But how any validity is assigned = to that name is an exercise for the reader (or left for a future version of the spec). Today, many service providers let = customers specify any name they want for the database entries associated wi= th their numbers. That name can often be set via a web portal or an API and= can be “Alex Hamilton” or “Bill Clinton” or “FBI” or “Bank of America” even = if the owner of the number is “Joe Fraudster”.

 

My point here is that we can kick the CNAM problem d= own the road, but it really is what most end-users care the most about. STI= R as is may be a critical stepping stone to getting there, but we should se= t expectations regarding what the (intermediate) result is going to be.

 

III) Expectations Regarding Robocalls – Speaki= ng of setting expectations, there are high expectations that STIR will go a= long way to dealing with the massive robocall problem. Last month, FCC Cha= irman Wheeler said: ““I am also calling on the carriers and standards groups to accelerate the development and dep= loyment of technical standards that would prevent spoofing of caller ID and= thus make blocking technologies more effective, as was done in the battle = against spam years ago.” If he believes that STIR as proposed is going to make any measurable dent, within the nex= t five years, in mitigating the level of actual fraud facilitated by illega= l robocalls, he is sadly mistaken.

 

I think it’s acknowledged that STIR only appli= es to end-to-end SIP calls, and then only when all intermediate carriers pr= opagate the necessary headers. Those calls are likely to be a tiny fraction= of all calls for the next several years. One theory says that the illegal robocallers will be the last ones to auth= enticate their calls (because they are, in fact, not authentic). So the the= ory is that we’ll authenticate all OTHER (legitimate) calls, and then= the illegal robocalls will stand out as the ones that aren’t authenticated.

 

But that’s preposterous. In the US, there are = hundreds of millions of endpoints that can originate calls; even if we mana= ged to get 90% of them using STIR, there would still be tens of millions of= (legitimate) endpoints originating unauthenticated calls. Now, the actual count of endpoints isn’t so critical; more im= portant is the volume of calls originated from authenticated endpoints vers= us non-authenticated. Lots of business-to-consumer calls are originated fro= m PABXs and other systems connected via legacy PRI or even legacy analog lines and trunks. It seems unlikely that = consumers will want to put all those (unauthenticated) calls through some C= APTCHA or similar system. It isn’t clear to me what the game plan is = for dealing with what will still be the large fraction of calls that that will remain unauthenticated for some tim= e. (How the endpoint handles such calls are outside the scope of the spec, = so how Wheeler knows that it is the savior to robocalls is beyond me.)=

 

Alternatively, there will probably be some illegal r= obocallers, and their enablers, that will jump on the STIR bandwagon if it = comes to pass. There will be service providers that will solicit customers = to sign up over the web, relatively anonymously, to get “authenticated” phone numbers (perhaps tho= usands or maybe even a million of them). They’ll be able to set their= CNAM to whatever they want. They’ll place hundreds of millions of au= thenticated calls and then move on. The good news is that STIR will let us know who the service providers are that are making the au= thenticated credentials available to these robocallers, but it isn’t = clear what the next steps are. I’ve seen mention of (again, out of sc= ope) potential “reputation” metrics for providers. But it isn’t clear how a call recipient would determine the reputati= on of the provider, or what they would do when an authenticated call was re= ceived from somebody using credentials issued by a less-than-fully-reputabl= e provider.

 

And all of that assumes a level of sophistication on= the part of the call recipient to actually deploy some feature or filter t= hat acts on the authentication (and reputation?) information. Robocallers a= lmost by definition do not prey on the sophisticated; they prey on the elderly and disadvantaged and desperat= e, who typically don’t have the latest smartphone or the coolest VoIP= service. (Yes, robocalls annoy all of us, but I promise you that nobody on= this mailing list is their target.)

 

We should certainly learn everything we can from the= email spam battle, but the analogy isn’t 100% applicable by any mean= s. Email has the SIGNIFICANT advantage that filters have access not just to= the headers (which include, importantly, a SUBJECT line), but also to the ENTIRE CONTENT of the message. (This is a= lso true for SMS.) With voice calls, we have far less information available= , and certainly no clue as to what the content will be. “Doing for vo= ice calls what we did for email” is a technical fantasy.

 

So members of this list are being disingenuous if th= ey are telling Mr. Wheeler and others to expect a dramatic near-term drop i= n robocall complaints once STIR (as currently envisioned) is deployed.=

 

CONCLUSION? I’m not for (or against) major rev= isions to the document. But I do think that expectations need to be properl= y set. 4474bis 12.2 says in part: “…preventing the simple unaut= horized claiming of an identity for the purposes of robocalling, voicemail hacking, or swatting, which is the primary scope of= the current document.” The document lays some groundwork that will b= e useful, in part, in ultimately limiting robocalling, but nobody has conne= cted all the dots for me on how it will actually, pragmatically be deployed to achieve that objective (same for sw= atting). Some of you, no doubt, will tell me THAT is beyond the scope of th= e document(s). If nothing else, the document could enumerate the out-of-sco= pe dependencies upon which we are dependent before realizing any actual utility (or deployability) of the sp= ec. And even then, the utility to the end-user is going to be severely limi= ted until deployment reaches some critical mass and additional fundamental = limitations are addressed.

 

David Frankel

ZipDX® LLC

Monte Sereno, CA USA



This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message.
 --_000_fcf7475b38cc4766b6e28f34962e1eb1PLSWE13M08adsprintcom_-- From nobody Mon Aug 15 07:44:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3158212DAAA for ; Mon, 15 Aug 2016 07:44:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EZHaj9zETp92 for ; Mon, 15 Aug 2016 07:44:16 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D68112DAA6 for ; Mon, 15 Aug 2016 07:44:16 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7FEiLpv030401 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 15 Aug 2016 07:44:21 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471272261; bh=bpaDe0Owoa2i7DPKGvnbrGufMuq9gnSGVbMbME21pp8=; h=Subject:To:References:From:Reply-To:Cc:Date:In-Reply-To:From; b=pXn4Us357QClHlj5n5+68ZTs4wdqdXV2v7d7ZNK0iLTJXsBIlLVpy8jk19B+SZm15 5T1aHA0TF/cSFwuz85f1SCXSGB6m6EWFd/9gF/px5iDnr41QaKn04vaptK8o/MHLo6 CKJ2i6x9VdDMQLcht9kOmHum/whWgpGYWi/dPzt0= To: "Gorman, Pierce A [CTO]" References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> Date: Mon, 15 Aug 2016 07:44:09 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 14:44:17 -0000 On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: > My personal view agrees with yours that there seems to be an expectation > that STIR will operate on endpoints in an end-to-end fashion when in > fact, to have any hope of nearer term deployment of anything hopefully > approaching critical mass (and even then there are very big challenges), > the carriers will be required to do the key management, the signing, and > the interpretation of signatures. There is a difference between an architecture that /requires/ operation within the infrastructure, versus one that permits the choice of operation at the end-points and/or within the infrastructure. For example, the current discussions I've heard about the operational of the key query/validation mechanism for STIR is that it will operate within the inter-provider infrastructure, with no direct access allowed for end-systems (that are not controlled by a participating provider.) That's a major architectural choice and precludes the long-term option of direct participation by those independent user agents. Instead it requires them to be slaved to their provider. By contrast, DKIM allows signing and/or verifying by any entity in the sequence, even though actual operation is (currently) entirely within the MTA infrastructure. > What is signed and how it is interpreted are critical pieces of > information and need to be kept extremely simple or, IMHO, this will be > as big mess as youve tried to warn. And of course these critical > pieces will not be provided here. Specification of the core information to be signed is something that profoundly affects the security properties of the service. That's a technical point. To the extent the specification defers this choice, it needs to make very clear statements about the choices and the effects of those choices. > As far as out-of-scope dependencies Ill suggest that how keys are > managed, what is signed, and how the signatures should be interpreted > are the big 3 that occur to me. You believe there should be no standardized technical specification for the key management infrastructure? This is the highest-risk component of the service and it needs to be interoperable at a global scale. How else will that interoperability be achieved? Also, what do you mean "how the signatures should be interpreted"? If you mean the direct semantics of a signature, such as meaning that the request is valid vs. the request was processed by the signer, I'll strongly urge you to reconsider, since that's an essential technical point and needs to be standardized. Failure to have the semantic of the signature -- it's 'meaning' -- be clear in the technical specification has demonstrably caused serious operational problems. If you mean "how the results of a validation are used by the verifying entity", then yes indeed, that's an entirely separate area of work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 15 08:04:53 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BFE112B010 for ; Mon, 15 Aug 2016 08:04:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3273DA-WX30Z for ; Mon, 15 Aug 2016 08:04:49 -0700 (PDT) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED35C12B01F for ; Mon, 15 Aug 2016 08:04:48 -0700 (PDT) Received: by mail-qt0-x229.google.com with SMTP id x25so22196517qtx.2 for ; Mon, 15 Aug 2016 08:04:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=p5pkesxs/yNFYM1liDb1EfJyex+nH38gzkginCv6SQ4=; b=TdlYXZGLNqPY20rDyZl76IJ1Y6Tqv8d1oWbPuecnU6J7RPGOqiqFv5xZRFB6xZHSDy FH+BL43HD2i+Y8E8F+PgzQ19DUryJOnwoemtdQWH5igyzUp8s/YB/2rBMfrkq7Ihn3F5 hw0Tjy2RM9a/iqKDRPpDQzn+Fp/QlmStyQCfVW0NaCluADYpPwayrb859EknUA8mG3NH 6IsyQ4DhoWezwgOW2lF0uVtOTa2xfn9vGjv6/uZYn/YA+vuQCZZnoI/TeoYt3PMVDKuP hXdNaECsB3L67t7m5cvuuPyYyFUECFbpAylNaAYDH81p/oo9K9WloqywusUxVMXPfJhk JpBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=p5pkesxs/yNFYM1liDb1EfJyex+nH38gzkginCv6SQ4=; b=XH0KzE6QZqI8P+wgNQmazBs2OGNzf0Brwpk8gZydrGSDdgvlzXM6LVKNRi/YZK9FBO Pi89goteI3fG95GfAc5S6qLZuitfTxtOtC/iceECBdtRIcZ4GvoHO2MenAL8EKlnD0SA n9FmP033iW5PT/K2i1/IT1Yp0szC/1UiPnLoFUJS6Jr1mD4yph8H1APPt+sGFkYY6htN arlOuuD2WzF9HVnrjPnkYHuA47JHlmRbY2bKGNaHWp8wTnycib3EPGkvmc4bvI4IVTDX 8L/rXydJMsVwPp8MunznAKEdxM59DqbfdTsvhmiJkdVuMhkKi7imCgV/iiq9gIor6QO2 16UA== X-Gm-Message-State: AEkoouteMBg/q2LHu+bpum8SW5BMnwab7KRdkCZdkgtnIqQift0MFzx51d+lqtQHRVIWHQ== X-Received: by 10.200.48.193 with SMTP id w1mr33634873qta.8.1471273487995; Mon, 15 Aug 2016 08:04:47 -0700 (PDT) Received: from [10.33.192.45] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id n128sm11301089qkc.36.2016.08.15.08.04.47 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Aug 2016 08:04:47 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> Date: Mon, 15 Aug 2016 11:04:45 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:04:52 -0000 I don=92t think there is any disagreement on how we=92re going to deploy = stir, nor is there any specification that limits or even influences it. We=92re going to start deployment at the service provider. We=92re = going to evolve to deployment on the device. There are some = participants who think deployment on the device is never going to = happen, but they don=92t oppose it, they are just skeptical it will = happen. All the documents we have allow generation by any entity that has a = certificate valid for the TN the call is claiming to be from. Any = entity on the path can check, making an assumption that the header/body = won=92t be stripped (which could be a bad assumption, but there are no = protocol police). If anyone thinks there is text in any of our documents that they believe = doesn=92t allow that, please specify where, and I=92m sure we can fix = it. The mechanism is designed to allow the origination network, or the = origination device, to generate a valid signature. It=92s designed to = let any element on the path check the signature (and thus the = certificate used to sign it) for validity. I have suggested that a useful way to deploy it is to have = interconnection agreements between service providers modified to require = a certain percentage of validly signed calls by a certain date, = ratcheting up the percentage over time. If that included checking at = transit network interconnects, even if the path downstream of that = network had SS7 links, we would gain most of the benefit of stir.=20 Please note that while we do want to get the call treatment modified = depending on the outcome of verification of the signature, the greatest = value comes from the ability of the authorities to track the source of = calls back to the originator. By requiring calls to have valid = signatures at network interconnections, we provide a tracking mechanism = back to the origination network, and that will really help quite a bit. = It=92s my opinion that if a large number of =93bad=94 calls come from = networks that permit call origination from essentially anonymous = customers, that the authorities will take steps to rein in such = networks, but that=92s just an opinion. Brian > On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: >=20 > On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >> My personal view agrees with yours that there seems to be an = expectation >> that STIR will operate on endpoints in an end-to-end fashion when in >> fact, to have any hope of nearer term deployment of anything = hopefully >> approaching critical mass (and even then there are very big = challenges), >> the carriers will be required to do the key management, the signing, = and >> the interpretation of signatures. >=20 > There is a difference between an architecture that /requires/ = operation within the infrastructure, versus one that permits the choice = of operation at the end-points and/or within the infrastructure. >=20 > For example, the current discussions I've heard about the operational = of the key query/validation mechanism for STIR is that it will operate = within the inter-provider infrastructure, with no direct access allowed = for end-systems (that are not controlled by a participating provider.) = That's a major architectural choice and precludes the long-term option = of direct participation by those independent user agents. Instead it = requires them to be slaved to their provider. >=20 > By contrast, DKIM allows signing and/or verifying by any entity in the = sequence, even though actual operation is (currently) entirely within = the MTA infrastructure. >=20 >=20 >> What is signed and how it is interpreted are critical pieces of >> information and need to be kept extremely simple or, IMHO, this will = be >> as big mess as you=92ve tried to warn. And of course these critical >> pieces will not be provided here. >=20 > Specification of the core information to be signed is something that = profoundly affects the security properties of the service. That's a = technical point. To the extent the specification defers this choice, it = needs to make very clear statements about the choices and the effects of = those choices. >=20 >=20 >> As far as =93out-of-scope dependencies=94 I=92ll suggest that how = keys are >> managed, what is signed, and how the signatures should be interpreted >> are the big 3 that occur to me. >=20 > You believe there should be no standardized technical specification = for the key management infrastructure? This is the highest-risk = component of the service and it needs to be interoperable at a global = scale. How else will that interoperability be achieved? >=20 > Also, what do you mean "how the signatures should be interpreted"? >=20 > If you mean the direct semantics of a signature, such as meaning that = the request is valid vs. the request was processed by the signer, I'll = strongly urge you to reconsider, since that's an essential technical = point and needs to be standardized. Failure to have the semantic of the = signature -- it's 'meaning' -- be clear in the technical specification = has demonstrably caused serious operational problems. >=20 > If you mean "how the results of a validation are used by the verifying = entity", then yes indeed, that's an entirely separate area of work. >=20 >=20 >=20 > d/ >=20 >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 15 08:15:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3347212D123 for ; Mon, 15 Aug 2016 08:15:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.466 X-Spam-Level: X-Spam-Status: No, score=-5.466 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GtiCd0dgpDa1 for ; Mon, 15 Aug 2016 08:15:34 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FF2312B010 for ; Mon, 15 Aug 2016 08:15:34 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u7FFFWpE004460 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 15 Aug 2016 15:15:32 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id u7FFFVeU021274 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 15 Aug 2016 15:15:32 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0121.oracle.com (8.13.8/8.13.8) with ESMTP id u7FFFPkY026762; Mon, 15 Aug 2016 15:15:30 GMT Received: from dhcp-adc-twvpn-3-vpnpool-10-154-104-192.vpn.oracle.com (/10.154.104.192) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 15 Aug 2016 08:15:24 -0700 Content-Type: multipart/signed; boundary="Apple-Mail=_87858B33-CD49-486B-8625-19398057CCFB"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Travis Russell In-Reply-To: <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> Date: Mon, 15 Aug 2016 11:15:23 -0400 Message-Id: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> To: Brian Rosen X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:15:37 -0000 --Apple-Mail=_87858B33-CD49-486B-8625-19398057CCFB Content-Type: multipart/alternative; boundary="Apple-Mail=_F9801D19-BC25-4549-8DB7-F111B9DA85E1" --Apple-Mail=_F9801D19-BC25-4549-8DB7-F111B9DA85E1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Just a quick question as this sentence caught my eye: "By requiring calls to have valid signatures at network = interconnections, we provide a tracking mechanism back to the = origination network, and that will really help quite a bit. It=92s my = opinion that if a large number of =93bad=94 calls come from networks = that permit call origination from essentially anonymous customers, that = the authorities will take steps to rein in such networks, but that=92s = just an opinion." We currently have a situation in the industry where there are a number = of CSPs that are selling interconnect access to anyone, and are = complicit with the true purposes of these purchased interconnects = (eavesdropping and location tracking have been the most widely = published). When messages are received from the rogue actors,it appears = as if the control message (in this case SS7) are coming from a = legitimate, trusted CSP. Is there a proposed mechanism that would = identify when these CSPs provide SIP connectivity fully certified? =20 Travis Russell | Director, Cyber Security, Service Provider Networks |=20= +1919.205.6857 (o) | +1919.412.1167 (c) https://www.linkedin.com/in/travisrussell1 5200 Paramount Pkwy Morrisville, NC 27560 USA Oracle is committed to developing practices and products that help = protect the environment > On Aug 15, 2016, at 11:04 AM, Brian Rosen wrote: >=20 > I don=92t think there is any disagreement on how we=92re going to = deploy stir, nor is there any specification that limits or even = influences it. >=20 > We=92re going to start deployment at the service provider. We=92re = going to evolve to deployment on the device. There are some = participants who think deployment on the device is never going to = happen, but they don=92t oppose it, they are just skeptical it will = happen. >=20 > All the documents we have allow generation by any entity that has a = certificate valid for the TN the call is claiming to be from. Any = entity on the path can check, making an assumption that the header/body = won=92t be stripped (which could be a bad assumption, but there are no = protocol police). >=20 > If anyone thinks there is text in any of our documents that they = believe doesn=92t allow that, please specify where, and I=92m sure we = can fix it. >=20 > The mechanism is designed to allow the origination network, or the = origination device, to generate a valid signature. It=92s designed to = let any element on the path check the signature (and thus the = certificate used to sign it) for validity. >=20 > I have suggested that a useful way to deploy it is to have = interconnection agreements between service providers modified to require = a certain percentage of validly signed calls by a certain date, = ratcheting up the percentage over time. If that included checking at = transit network interconnects, even if the path downstream of that = network had SS7 links, we would gain most of the benefit of stir.=20 >=20 > Please note that while we do want to get the call treatment modified = depending on the outcome of verification of the signature, the greatest = value comes from the ability of the authorities to track the source of = calls back to the originator. By requiring calls to have valid = signatures at network interconnections, we provide a tracking mechanism = back to the origination network, and that will really help quite a bit. = It=92s my opinion that if a large number of =93bad=94 calls come from = networks that permit call origination from essentially anonymous = customers, that the authorities will take steps to rein in such = networks, but that=92s just an opinion. >=20 > Brian >=20 >> On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: >>=20 >> On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >>> My personal view agrees with yours that there seems to be an = expectation >>> that STIR will operate on endpoints in an end-to-end fashion when in >>> fact, to have any hope of nearer term deployment of anything = hopefully >>> approaching critical mass (and even then there are very big = challenges), >>> the carriers will be required to do the key management, the signing, = and >>> the interpretation of signatures. >>=20 >> There is a difference between an architecture that /requires/ = operation within the infrastructure, versus one that permits the choice = of operation at the end-points and/or within the infrastructure. >>=20 >> For example, the current discussions I've heard about the operational = of the key query/validation mechanism for STIR is that it will operate = within the inter-provider infrastructure, with no direct access allowed = for end-systems (that are not controlled by a participating provider.) = That's a major architectural choice and precludes the long-term option = of direct participation by those independent user agents. Instead it = requires them to be slaved to their provider. >>=20 >> By contrast, DKIM allows signing and/or verifying by any entity in = the sequence, even though actual operation is (currently) entirely = within the MTA infrastructure. >>=20 >>=20 >>> What is signed and how it is interpreted are critical pieces of >>> information and need to be kept extremely simple or, IMHO, this will = be >>> as big mess as you=92ve tried to warn. And of course these critical >>> pieces will not be provided here. >>=20 >> Specification of the core information to be signed is something that = profoundly affects the security properties of the service. That's a = technical point. To the extent the specification defers this choice, it = needs to make very clear statements about the choices and the effects of = those choices. >>=20 >>=20 >>> As far as =93out-of-scope dependencies=94 I=92ll suggest that how = keys are >>> managed, what is signed, and how the signatures should be = interpreted >>> are the big 3 that occur to me. >>=20 >> You believe there should be no standardized technical specification = for the key management infrastructure? This is the highest-risk = component of the service and it needs to be interoperable at a global = scale. How else will that interoperability be achieved? >>=20 >> Also, what do you mean "how the signatures should be interpreted"? >>=20 >> If you mean the direct semantics of a signature, such as meaning that = the request is valid vs. the request was processed by the signer, I'll = strongly urge you to reconsider, since that's an essential technical = point and needs to be standardized. Failure to have the semantic of the = signature -- it's 'meaning' -- be clear in the technical specification = has demonstrably caused serious operational problems. >>=20 >> If you mean "how the results of a validation are used by the = verifying entity", then yes indeed, that's an entirely separate area of = work. >>=20 >>=20 >>=20 >> d/ >>=20 >>=20 >> --=20 >>=20 >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_F9801D19-BC25-4549-8DB7-F111B9DA85E1 Content-Type: multipart/related; type="text/html"; boundary="Apple-Mail=_9A3D3F60-EC08-4170-BA0A-45DFC80146C1" --Apple-Mail=_9A3D3F60-EC08-4170-BA0A-45DFC80146C1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252
Just a quick question as this sentence caught = my eye:

"By requiring calls to have valid signatures at network = interconnections, we provide a tracking mechanism back to the = origination network, and that will really help quite a bit.  It=92s = my opinion that if a large number of =93bad=94 calls come from networks = that permit call origination from essentially anonymous customers, that = the authorities will take steps to rein in such networks, but that=92s = just an opinion."

We currently have a situation in the industry where = there are a number of CSPs that are selling interconnect access to anyone, and = are complicit with the true purposes of these purchased interconnects = (eavesdropping and location tracking have been the most widely = published). When messages are received from the rogue actors,it appears as if the control = message (in this case SS7) are coming from a legitimate, trusted CSP. Is there a proposed = mechanism that would identify when these CSPs provide SIP connectivity = fully certified?  

=

Travis Russell | Director, Cyber = Security, Service Provider Networks | 
+1919.205.6857 (o) = | +1919.412.1167 = (c)
https://www.linkedin.com/in/travisrussell1

5200 Paramount Pkwy
Morrisville, NC = 27560
USA



Oracle is committed to = developing practices and products that help protect the environment




On Aug 15, 2016, at 11:04 AM, Brian Rosen <br@brianrosen.net> = wrote:

I don=92t think there is any disagreement on how we=92re = going to deploy stir, nor is there any specification that limits or even = influences it.

We=92re going to start = deployment at the service provider.  We=92re going to evolve to = deployment on the device.  There are some participants who think = deployment on the device is never going to happen, but they don=92t = oppose it, they are just skeptical it will happen.

All the documents we have allow generation by any entity that = has a certificate valid for the TN the call is claiming to be from. =  Any entity on the path can check, making an assumption that the = header/body won=92t be stripped (which could be a bad assumption, but = there are no protocol police).

If anyone = thinks there is text in any of our documents that they believe doesn=92t = allow that, please specify where, and I=92m sure we can fix it.

The mechanism is designed to allow the = origination network, or the origination device, to generate a valid = signature.  It=92s designed to let any element on the path check = the signature (and thus the certificate used to sign it) for = validity.

I have suggested that a useful = way to deploy it is to have interconnection agreements between service = providers modified to require a certain percentage of validly signed = calls by a certain date, ratcheting up the percentage over time. =  If that included checking at transit network interconnects, even = if the path downstream of that network had SS7 links, we would gain most = of the benefit of stir.

Please note that = while we do want to get the call treatment modified depending on the = outcome of verification of the signature, the greatest value comes from = the ability of the authorities to track the source of calls back to the = originator.  By requiring calls to have valid signatures at network = interconnections, we provide a tracking mechanism back to the = origination network, and that will really help quite a bit.  It=92s = my opinion that if a large number of =93bad=94 calls come from networks = that permit call origination from essentially anonymous customers, that = the authorities will take steps to rein in such networks, but that=92s = just an opinion.

Brian

On Aug 15, 2016, at = 10:44 AM, Dave Crocker <dhc@dcrocker.net> wrote:

On= 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote:
My personal view agrees = with yours that there seems to be an expectation
that STIR = will operate on endpoints in an end-to-end fashion when in
fact, to have any hope of nearer term deployment of anything = hopefully
approaching critical mass (and even then there = are very big challenges),
the carriers will be required to = do the key management, the signing, and
the interpretation = of signatures.

There is a = difference between an architecture that /requires/ operation within the = infrastructure, versus one that permits the choice of operation at the = end-points and/or within the infrastructure.

For example, the current discussions I've heard about the = operational of the key query/validation mechanism for STIR is that it = will operate within the inter-provider infrastructure, with no direct = access allowed for end-systems (that are not controlled by a = participating provider.) That's a major architectural choice and = precludes the long-term option of direct participation by those = independent user agents.  Instead it requires them to be slaved to = their provider.

By contrast, DKIM allows = signing and/or verifying by any entity in the sequence, even though = actual operation is (currently) entirely within the MTA = infrastructure.


What is signed and how it is interpreted are = critical pieces of
information and need to be kept = extremely simple or, IMHO, this will be
as big mess as = you=92ve tried to warn.  And of course these critical
pieces will not be provided here.

Specification of the core = information to be signed is something that profoundly affects the = security properties of the service.  That's a technical point. =  To the extent the specification defers this choice, it needs to = make very clear statements about the choices and the effects of those = choices.


As far as =93out-of-scope dependencies=94 I=92ll = suggest that how keys are
managed, what is signed, and how = the signatures should be interpreted
are the big 3 that = occur to me.

You believe there = should be no standardized technical specification for the key management = infrastructure?  This is the highest-risk component of the service = and it needs to be interoperable at a global scale.  How else will = that interoperability be achieved?

Also, = what do you mean "how the signatures should be interpreted"?

If you mean the direct semantics of a = signature, such as meaning that the request is valid vs. the request was = processed by the signer, I'll strongly urge you to reconsider, since = that's an essential technical point and needs to be standardized. =  Failure to have the semantic of the signature -- it's 'meaning' -- = be clear in the technical specification has demonstrably caused serious = operational problems.

If you mean "how the = results of a validation are used by the verifying entity", then yes = indeed, that's an entirely separate area of work.



d/


--

Dave = Crocker
Brandenburg InternetWorking
bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_9A3D3F60-EC08-4170-BA0A-45DFC80146C1 Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=oracle-email-sig-198324.gif Content-Type: image/gif; name="oracle-email-sig-198324.gif" Content-Id: R0lGODlhcgAaAMQAAP8QEP/w8P/Q0P/g4P8wMP9gYP8gIP+goP9QUP+QkP+wsP9wcP+AgP9AQP/A wP8AAP///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAA AAAALAAAAAByABoAAAX/ICSOZGmeaKqubOu+cCzPdC0GCqPvvBKUDp5wp1gFdIPVIDfcOQa6A8yR aO4gweQoUHh4v2Bw4SdihM9egyBF8ALIpkEXDR44vA2XwkD/IgYGAAZbbX1nBGRmhl8AWiUJYicC AIsPDFh4LXOGjQ4NAAhrEIUPBQcOqKmoB5sEZV4JqqoHhQVxlGAOJQG4AAunsqg/dw95KwdfBgzB qKIEBMaQDwCiKpOwEIq6KANuJg14igZwEHPULMTGKbxetjF8D1ItxK7aKl8lCl8DAfALW1+2rUi3 QtqgGN2mwYCXzYvAON624LoEQZ9DEfRcEFSBIE2DjyBDfnyIqRgMcA8a/z5AZQWXOxEdHxwUgfIg sX/zMqlAWclVCQFefLpAqdJBAFJn3owgtpJEQkslEWjUmYLnomokcDlS4s0eFzQNqvXDEyzmAwFP yaXYmGJBuxlzELWIacueiE0AFGyF4HbaNTquUEpFRxUFUC9YXQzARYAkEJSNipKQ9kDu0i9SKKNZ 9iXswMIoYgI4oJYFskpgzkkmcdrviELqmPVt1HpRAaaLqCE1lBgjvEpqRtgl8Tevygd7TcCuiKvP m8OVEkAIYLYPThSsRIpEQJr1x94QBIT09FH6QJC6AiRAoB1kEb7tRb4MvyB+AwSlbejfz7+///8A BijggAQWaOCBCCao4A+CDDbo4IMQRijhhBQKGAIAOw== --Apple-Mail=_9A3D3F60-EC08-4170-BA0A-45DFC80146C1 Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=green-sig-275518.gif Content-Type: image/gif; name="green-sig-275518.gif" Content-Id: <9205649A-F045-4CC3-93C6-49AB1FCCB58E@us.oracle.com> R0lGODlhLAAcAMQAAP///0x9RHmec9Pf0aa+oleFULHGrmKNW+nv6I+uivT39N7n3W6VZ7zPuZu2 lsjXxYSmfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAA AAAALAAAAAAsABwAQAXhICCOZGmeaDoaReC+sKAMR7GopIA6boIvLgPAVSAgALxjSYdrOp/Q6NPg YqIEPkTBV2taTwgGbEw+PAZo3FfKbqMQQfeJ8DoY0Hg0wxhAKBgHCl5XLgMqDwFCAAIFPIYDgidr OUQGkSh0cQMJAQyXOXKhoqOkpaanI2aoIwMErq+uCY0BMlANKpxkYwQGBH82TpMicD0pAgQACToD AchqhAG3KQ4HIlQNnErG0IYqB9EAiEQvwEsozC43hy0CAeXMwsLDLS8MAvf497ruCZ+gOA0gfNt3 AIK0J/JWKVzIsEQIADs= --Apple-Mail=_9A3D3F60-EC08-4170-BA0A-45DFC80146C1-- --Apple-Mail=_F9801D19-BC25-4549-8DB7-F111B9DA85E1-- --Apple-Mail=_87858B33-CD49-486B-8625-19398057CCFB Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMUzCCBg8w ggT3oAMCAQICED2JPyS/yqQMNSg7P/rkCRgwDQYJKoZIhvcNAQELBQAwgaYxCzAJBgNVBAYTAlVT MR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3Qg TmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRl YyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1MB4XDTE2MDYwNzAwMDAwMFoX DTE3MDIyNTIzNTk1OVowgawxLjAsBgNVBAMMJVBlcnNvbmEgTm90IFZhbGlkYXRlZCAtIDE0NjUz Mjk3OTM2NDIxKDAmBgkqhkiG9w0BCQEWGXRyYXZpcy5ydXNzZWxsQG9yYWNsZS5jb20xDzANBgNV BAsMBlMvTUlNRTEeMBwGA1UECwwVUGVyc29uYSBOb3QgVmFsaWRhdGVkMR8wHQYDVQQLDBZTeW1h bnRlYyBUcnVzdCBOZXR3b3JrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4FxsK5d3 j3hO8899/Sn+KlssnVzzvG5NNvRV6i5zgiR18X+61U3+gum7dmljCw22DWTQUjIgu5ZxbqujDbgm 0eCQeMt9DztwK67qV0ugHg5AtFCKhqI1EkjZw/yMvF4rKlwSdnpYQezDCEnbL6AjIAAhSl1h1aXw HYzuHOT1vNZNjVUV664WtVqxfTvP/RdaPVgn6n9B6N/G3Eh6sUD35Io3RwLKqOnajcAEK0c7apHM GpeUWwT0hiLQA4HrhtwJReB/4+tcV2RQowol5L/eKWAmpBvDkiLDsjaf7yUy+5kUEVmzr2ROlA+r xCGzeZ/A7oI4gY06qapfX3Lv5DF0FwIDAQABo4ICLzCCAiswDAYDVR0TAQH/BAIwADAOBgNVHQ8B Af8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMB0GA1UdDgQWBBRjeq3Z QtNirEkH/lxf1USNN3cu1zAkBgNVHREEHTAbgRl0cmF2aXMucnVzc2VsbEBvcmFjbGUuY29tMGwG A1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRo LmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwXQYDVR0f BFYwVDBSoFCgToZMaHR0cDovL3BraS1jcmwuc3ltYXV0aC5jb20vY2FfNTdkZTdhMjM4ZDQ1ZDhk NGZjNzFmOGE1YzZiODFjOTMvTGF0ZXN0Q1JMLmNybDBOBggrBgEFBQcBAQRCMEAwPgYIKwYBBQUH MAKGMmh0dHA6Ly9jYWNlci5zeW1hdXRoLmNvbS9tcGtpL3N5bWNjMWluZHN1YmNhZzUuY3J0MB8G A1UdIwQYMBaAFGcZtj2lebszYNgtU9OMCT0HrBhwMCsGCmCGSAGG+EUBEAMEHTAbBhJghkgBhvhF ARABAgIEAa3ukhMWBTEwOTIyMDkGCmCGSAGG+EUBEAUEKzApAgEAFiRhSFIwY0hNNkx5OXdhMmt0 Y21FdWMzbHRZWFYwYUM1amIyMD0wDQYJKoZIhvcNAQELBQADggEBACzJVUuamWCrPkEFDBwdQDgg sdbr3iBndLtD8sfL5AOyDo279fIBAeCIg/2EfrohDMEwlG9dQTTS5ugwBJ6iuKn1OZ9sh+JpWrNm 698IhzmgDB74G0zALwJbAyKZddXkfRX0C+pKBRJ0VP0iM14mHP7sGy14jB+2t2kunwyydMoTLSNd SBTjAGawF0jsREePfoWxyG0hdznvVgvnERKAoueSdgK4PqqKcD5qLynXnOA9L0HPk0+pc+dgMNsm eQIc0U2wQWQf4yy1qS2Y9uZBxEy9SYSYmudYblRL7eXi0akaO4ST3MDgYimlgHTZljTWGf7KViAp ZlW5Gf2xwTNLEfUwggY8MIIFJKADAgECAhAHAqIahbhLZZ4YCm7m9aNlMA0GCSqGSIb3DQEBCwUA MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9y IGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDEgUHVibGljIFBy aW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xNTEwMDEwMDAwMDBaFw0yNTA5 MzAyMzU5NTlaMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24x HzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIg Q0EgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANb7DTFJIsAMuu9OLRe4tDDl NNKsCe7JiQBd9K4TEbMTjlXPIhioIAam/SXLaJS0oIKQDm6WkkTuFbm07PrPeT1p1Jwf3CCaDijV DbXGnjrx1GUZwIQzTY7aivHWJ7kDoNH6KJyCk2z3DYV9W+lOmWL+k0LS7j6zcVeGl0bL3w3hxoRa sw2P9fQQigVdn2hG7AiwWEKC9r4tEEamJAsn/pgUU4OTgtvqwD9PolhhtUtyaRJfM1n2+bNMAGTO hcWGkgxuHOsoz3GpkKl0mXQk60jhDl1oEqgBZujumrIv+D3Nt3gkzqVgfOgWPUnxB7ozvjIrwmej FsdvwNJalATCa0UCAwEAAaOCAj4wggI6MDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0 cDovL3BraS1vY3NwLnN5bWF1dGguY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwbAYDVR0gBGUwYzBh BgtghkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAo BggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTAvBgNVHR8EKDAmMCSgIqAg hh5odHRwOi8vcy5zeW1jYi5jb20vcGNhMS1nMy5jcmwwDgYDVR0PAQH/BAQDAgEGMCkGA1UdEQQi MCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0yLTIxNzAdBgNVHQ4EFgQUZxm2PaV5uzNg2C1T 04wJPQesGHAwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZl cmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEo YykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQD EzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBCwUAA4IBAQBGGeQndTu+r+LaohRg jx5EkIFpK2NJNY3pdrqfmI8TgdfL/GUb+A5j3pQodPvjb9jJKnoOVKaDrilK9itR/T04ErvdY0X7 ZMw+VIZ/TkJtI7cdC/36zA2OkzXK5UX5zy9/eT1jGMdHI0r2qRQArX5ZVRqJJ9uUoJE4xv5AlaNg 9l24yMUW7ZxmaRRGEErKcCpv0VDgJhrTUrRHcotF0r0DuaXc2QjzkKt0cKvKoE7wwE7k4L5PkBFg JwwrHN/nbMp1tCXnkUiqkrRRdV8pm0cXHL3J6s91rXUjz/LF31qrt2vKu7heq9WjcNRo8xd6mwug FDz76IFWaOjPXXxzuC68MYID5DCCA+ACAQEwgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRT eW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwG A1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIElu ZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1AhA9iT8kv8qkDDUoOz/65AkYMAkGBSsOAwIaBQCg ggH9MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE2MDgxNTE1MTUy M1owIwYJKoZIhvcNAQkEMRYEFNJU0aIGvfkCPkhdh6NmGhFRCYkYMIHMBgkrBgEEAYI3EAQxgb4w gbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UE CxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVk MTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1 AhA9iT8kv8qkDDUoOz/65AkYMIHOBgsqhkiG9w0BCRACCzGBvqCBuzCBpjELMAkGA1UEBhMCVVMx HTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBO ZXR3b3JrMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVj IENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzUCED2JPyS/yqQMNSg7P/rkCRgw DQYJKoZIhvcNAQEBBQAEggEAJ3rtyH3BsgG8N0+4Q/VPRn+463CrrSUz9y6MyjcOm0SZXvbP5c34 si0SmQRrmAvogeLRzyC9d1qTFYxsbNr8Lmc0YqGKOxO2dgeJiYHevNXmElUlfD4Ol3IG8lEr8acH CpKSRv5+ZF8LtzqfY5wPNFbVreT4prhiKGkkkVKe2LIMxPyip3HP/JKhSkS/uOJZj31ROjbnfcIc X6apYocndQzSAzJJHIZ4Suh/LvnG589YWeF383t3JPUC4vUQoc5XoRV+NCkc3Y9UIVH93pPVydsE PBLrOQqvqlQHcqNji1ZyqOLhGhI5/TuZrFhBox0QxuXacemE5alEhLLf14DzuQAAAAAAAA== --Apple-Mail=_87858B33-CD49-486B-8625-19398057CCFB-- From nobody Mon Aug 15 08:22:13 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36B0812D18F for ; Mon, 15 Aug 2016 08:22:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7S3D2Rtjc9E8 for ; Mon, 15 Aug 2016 08:22:09 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0097.outbound.protection.outlook.com [104.47.42.97]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 629A212D190 for ; Mon, 15 Aug 2016 08:22:08 -0700 (PDT) Received: from BL2FFO11FD028.protection.gbl (10.173.160.31) by BL2FFO11HUB029.protection.gbl (10.173.161.53) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Mon, 15 Aug 2016 15:22:07 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BL2FFO11FD028.mail.protection.outlook.com (10.173.161.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Mon, 15 Aug 2016 15:22:03 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7FEocOg018306; Mon, 15 Aug 2016 11:22:03 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24svjt26mr-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 11:22:03 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 15 Aug 2016 10:22:01 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 15 Aug 2016 10:22:01 -0500 From: "Gorman, Pierce A [CTO]" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMwgABfV4D//6/WUA== Date: Mon, 15 Aug 2016 15:22:00 +0000 Message-ID: <7649280da9424627bc9a1532c91f0eb1@PLSWE13M08.ad.sprint.com> References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> In-Reply-To: <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.38] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(377454003)(199003)(24454002)(189002)(13464003)(110136002)(189998001)(97736004)(86362001)(97756001)(8676002)(46406003)(2900100001)(305945005)(2950100001)(68736007)(7696003)(3846002)(106466001)(102836003)(19580405001)(19580395003)(33646002)(87936001)(47776003)(106116001)(92566002)(2351001)(76176999)(54356999)(50466002)(50986999)(5250100002)(11100500001)(2501003)(356003)(108616004)(8936002)(7736002)(7846002)(6116002)(586003)(626004)(23726003)(5640700001)(2906002)(81156014)(4326007)(8746002)(24736003)(1730700003)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2FFO11HUB029; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD028; 1:Spt9n4Lt2/hpLBfCi+wkj/6bU9pXDg+eZJXTo3ryE3PP7NbmpfKNBefv8TB2BZ9tNAS+eaNFWMiuYQZG5xVNa2xoM8X0Ht01SwyCuOTKgl6YHEOk6rpl7gRlhDOHyOmBEo8JkkXK/9vGpCti9mOpFWRhRWWTV7fWqzADnYQcK1Oqs1qk/iN4/55aJiPCoaEgb4b1WMi21F9nmPImE8kkRAgnFRLGwPzWTG4jRVON9Nenw7x/Hwq0dlnSstH1Oz0S2sEi4bj1/N5v5/PkCypdAfBAgZ2WiSAL/zi8IhVzEAg2VpOZ3q1kpCbgkNN5Tz6khxDfBKNs3QDvsi7ouXZ7q288q30J1OYyX11lFzm0nDTot9xxO/2q4vonfhgGw4+mPaWLa5NVTSCdmsmJzdXIq59v6If5vLEEQFz3OckBd2YF/KXkLzUhbnKzwn0tvieNNuNEPDa1BfxlgjWYxKD0+deW3VVwtXc0bOBoKVRl713oW3Y3YUWiRNlmQEoQRlajM1n/n7O4Ut15pmzqLx1xCnU+zkutn7HkZ0qHSJbu7/X63m5dCY5HTjDbuW9jQLzl X-MS-Office365-Filtering-Correlation-Id: 117b9f93-720f-4c89-7ea3-08d3c51fe93a X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 2:C4I2JF37nDzu2+B2S1seTIlUB5DK6kL61igr+eyXpzm2StF4yXZFpf8lOBlLBZw52wKif1L3nWd9W4aUnRIa1vXlsx9ZBKVu+w5htvDjG7k2vWFA+s8dZ4ZO1W4qivQlmDj8yWVPLY/jSWGBKPySwEETy8G1A/OfxW6dx1mK9pRxrkVKzc0IlBvcLn2L5qQ6; 3:7CmHjlysAQqokXn+gGtiyc+UEEkx8uswraRV4nBG3HvK5bHTEBYyLc8SRTVUlFRJ+sum4scRCos9BWgnPqjWb4vgwbY04alna+thCEttVbiLxyHdi/OHYzElYms3LbV6ko4mccXoIjDN8TMbp5WmcJoi+v83y2bfLg2SxOOVfjEw6RU3qMUF65sCPcIQcH7QyYEhbE3ZSAseHQ1xFrKmFX8322OH/Ae1QVNRSPenScSnuI4xHCPlgCYMthU+g+Ipb6+9r796ML1z4MIfLbyz0Q==; 25:2SGXYjZ1tb9cmOjpbW5kU4lIEB/O84kTB4bnWk+ld+2caQ2RjNJcKS+AhCYcqmMWwkQPllGhptWf+/ubY1w1lA5/VW7+ZSFkn5w4B/3iAUAUDa05Efs0/9WG4XubfJrWdazowsXhYXZc/9XPdOCahek3DJNp/dd7Cp3ln+//g4wqYl5fqclyLY+/V+Hjlk5Kl52ozWPUMPKTPj4ByAtE85xkdpMwrPILIHzKbRbNuhkTzq2Daa6junEKcQ0nBNLLknAzNqjbzrMOvseK5K7tSuKsOFTPkfR+kGaRBEqSV+SvK19EDYt9/brexZbyB+nsZw4ZowIQbz1WahFWvq2+kpDWi7XzhnfMfr3i4qtx1FtF6KLiOIEAvwA5F6Xxp+wJQsFgsd4x19qriz5FciMPJoMcclu8yGU69L+C0xlmKSyQzCWDoM/iVSZB44LnEgQx X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BL2FFO11HUB029; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 31:nA6H4HDEBuRSBPbdoMqtr5v6bpQp3+jX8bheO4CF+vFEBFHbhML9XOWvtBZBawh6yPeeBYw+v/Zeu1wxJ/eH9oE/guaKQeSfaluOZI9xPbLP5yAmlPFq/R7teMdpBs9IdFPqWaumBi/bJa1gvLOuVMk7omJHlbHYhnpjk50Km7y3y4chcmQnv+M9PgZkuiaw/x4VotLDpU2F7p0t2NALwcN23zbBQJhIMlDIccdAkr8=; 20:lsnvnwmAXYKu+xmST6hArONzWcwJrCm72jgZywgUEJo2UCg1qlF3QxWj02zRPlfAR2gvUQGSmr1M9UZYaMJYqzrjawLnDh1Lih3PK2gbxCRGXaJrrzyJ7CxuSdGtbVFj3zz8n3AH4OPF2gumebxuJ+Ipo9+Rsge9K9Hyoe0lMcKwf7YM0F08uHqG0hf0w7yjLkwZuKeYfAYewkcrf3dH4+tTPIVnYFa3AlVyU2vBzZHiXdORbrmL63UnKuezFwJzeIGVrQwsExZpCKDkLgLd9CJeIWWgqx06u7vjR2ml6DLo4sI6u6nflfSS/PyvZaibdiCNHyRtWtfMhMNjl1ZR9TFb56lh8b8DmEKl7oKEjzZieUmIbOy63s1y7Fk7X7eGIiSh4PN8CsT9/4z3GPIS/B7Rg2i+cWMln3MLX/DeIjI= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(18430343700868); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(13024025)(13023025)(13015025)(13017025)(13018025)(10201501046)(3002001)(6055026); SRVR:BL2FFO11HUB029; BCL:0; PCL:0; RULEID:; SRVR:BL2FFO11HUB029; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 4:/9e3ANUN2h81awnMa2KLIenVafYUsAmPZNhAbzizIWKSD01KTlP6tQnYompqiVfv4VR2pTXkSY7VltL4WR02R7xbJ3U+nfHJHCcadapji1171iCplK305gMy4d6Tj/+MgxwSjmXBHjoZMdpD34YTgXOhSoUSSitkTCCgMEs0XEdbnvxP71q24kallgLLEHjo3oCWluJnpiHFu+4RvAQa25s3Iu/Chni2pY+GiqsTTIT3kqDIYzmE/UnzAVa1n391Hg7uWm4FxJSg6Cvw8vw40o8kmSfH3n9Xr3OVYTfbY6GGZdteJolin85fkhltdm+GyTElmyjjxWEe3bwyB/eBQGnszQ4qhNy5QVmqGC3/X4SeZaqP5eTI76MTz7cXxFco8mP66+SxOaU4wEAeWcgqgYyZ80iNk2PBg5ytZnoHgk46NCAN5bkS2yaAv8356EJlY0+PNlfvmWuv7jNw5nhbRxG99slIqZaRC2ADxof6uogrElshFEEZNhv1msK9R6SG8WjgryxhVmvoKqUEQ0bRWRvFFuRrCUD48Qq500vOiMBjY3Uld4RyoLhR9aPQ47RZ7SwqCBVh/zUDmyIZ287OHQ== X-Forefront-PRVS: 0035B15214 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2FFO11HUB029; 23:7LdjkJL6b3k7Jwo1oMj7hkGE30/OEbza7b4u075A?= =?us-ascii?Q?YP0SzYi/H/QdSi+4/YA5zdenRUhgA2qGxWJ/6/x74jkuqwBmSBnjJTvrv5dk?= =?us-ascii?Q?oaFlVbfSOe5JtGUWcx5wlrfay28As22EL9zjyYpM4sAJkpU0dNWCYtwmWcoR?= =?us-ascii?Q?Ynkr5FevlmjHZkiTBSHNOJGFclDa51DRxxIGmVAufjnwmmfdKfaKsXs3NAaX?= =?us-ascii?Q?v4Ax0qUdJ9WAAFc0Ys+yVeaWZqIJkAXxGCI2sVxh+QJKcixoQOGIz/4wBQ7X?= =?us-ascii?Q?gbehwhy4yhiHQ1vrpE93iY8is0S1R/Ydd9oBvYEDPAW9MZhaahti29eOtFbn?= =?us-ascii?Q?OUMsjYPzcJCbk4xkGsr7pO8hU1R0yIPZn2GHwZWcKKGOhiznwCp7ms84kC7V?= =?us-ascii?Q?7nqqX+WekOYs28JVDHGI6Leu5W5WMn/jaOu5DReJvB2vW7SuTH+h4GTgCTWv?= =?us-ascii?Q?iywRQ/tFQTCP4W/24AKF9AQqmv5xMR+T6o4NfzfQjWKsVVsgfNUEkMR5GX4U?= =?us-ascii?Q?KqwLywaru/WQvsxpns6RAuSTDA2r1VRgtQ/iVRPAwjM5jl21cvjnLgDyl/x7?= =?us-ascii?Q?s1oGuc1Yy4Jgf+kVHUNtdThHsrXE8pz8sT/8Kd80Aj7VOoR+TgpIuJYbWy5k?= =?us-ascii?Q?xiwoVTemf8nD3NsqdR9TfL82YL9bYnCCGTJNjRZlJBlu1FchQ3rsel6dUOqQ?= =?us-ascii?Q?k3EVlm5jOdWgg9w6xu5rtWVEGq0PeB/hXm8xFUMEoEP4hTfPuFzN4shrt9Kz?= =?us-ascii?Q?sa2yihvdTMIwcRhhDSJRQmAIfFmNKPbGt5vjo7eExEG4VmoVLgkkcM+tPqs3?= =?us-ascii?Q?ZmZq6c85splENMGs+BJgsusSZoZ5WzCguYxBMQFovtGRYjYKsBAVS7dEc0bK?= =?us-ascii?Q?WN6T2f9P2cnI1zrpVhcmh1tDCvFDEp74KcKbDtP+nihlzgxh3EvPp+RNgRDM?= =?us-ascii?Q?9mN4hk3q+KAwPD+ywSP1aLLzVdRtpa1i7mHw1B0bvxe/PMQiczOe8yHBdvuG?= =?us-ascii?Q?VWNvvwfqO/kgcByhY6fUaJOgCNZuGxb6eNFBy2gsDhgCKcMVt1I8M7CISdEB?= =?us-ascii?Q?/6JT1HFOcX2+SlWQtBVmkM04xl5nKfCRldPPGfwQmjZeUvHg/nTLYT+Ggpy9?= =?us-ascii?Q?7NUCljz0hePvFP1QLyBt6coTIbutVVhqM0iyV2QM8Mu2FKD4+SjLeezwV7ZM?= =?us-ascii?Q?7Wco9/KBt8X1kkzqhULKp/s43i+mHVbJ7ZU1OwGPsDKcZbHvvmfD5AWDFBFf?= =?us-ascii?Q?uQxuHqGFj8TbMkdZKmf51ktbj+cjJwmNWY0ko0l+zbsAB5oUP8qnmsjqgbFs?= =?us-ascii?Q?E3LFw0W4+i0cmRj7hFkapHa6LK1+DUDMfdhKx1I2HLcs7Ns+iQHmE60YhGG/?= =?us-ascii?Q?Fm8ptg=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB029; 6:iSWeLga1gLjOT5ArgUaVwxXkC9aH8X5At9jzPIRUn4Ci+GA6YGbsPPPov87Hufh0cOo6Z1oN55dD0oYtWOrgsMW9Fq/MjOy6Z8p+pfaiDm5Jf9yYaCPC8N8Bx0ktN8iGIcvDMuB0Z9wvvn21tAmg/8yrwclUqI3aolX4n/HyFBm5U51QVQgILvWRvZlXq4n9oyO7/dlaxtT3WJzC+tTTLybCAmaalGDiTgquMSa4qlHvnLBP3cVQ0FCMGJRDNy45mJ9qaOC5ZHqjCMCsRac+X7rnWklc5XfvKndS4k/smK+/SkXx76f+uZG+GUDTpAhdT9APL48HYgjeLW1Xqt1c7w==; 5:xAAYj7mIo6tgnNEsqVmxrVl1tKHVs5q1SJQl3hhsGOvVV5snS5mTP3ywDOGoWU8WtHFNntLZ7v3jlIsDpCkwQS0e1RDb0WQIcdccaBaAPi6aVqq+ZuOlCTE0rcoGFdcF/uBwdZ2oPkoov3nRlaN9aQ==; 24:cido2SRBffgLWkO5blp/qclP93oj7jGf1GwN9aqNiBdGLykkvmrLU2/t88DmYwj59uh1Hv53wOMljfqcoljU3bLOp2BvLiX0TxGoGhSNAEY=; 7:j+/5YbbpisXm0/3TSOHEZePc/aQKZLMzZavVbC38kDSC4/QC8jKzc+zD1E7XxOBCP/o3Efg8Ka1Z8aL+05m8gC6IZytDb4hNb28PVPNz2yso76cR0j3SnB5D/Yu+7n97Fa2Fu8Y+rqz1P5d2DT8lHyqv/ShK+MqHT2a0FfwmgJqiYa6ygHr4/sCdwbx9ibd4SvPICay+drg6s5ZmvrF9esZ+BiZkc9XCy3Tw+psEOmA+Vx1OjAbtKa0KIoKdo1Wv SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Aug 2016 15:22:03.6330 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2FFO11HUB029 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:22:12 -0000 Dave, I was of the opinion that STIR will permit choice of operation at the endpo= ints and/or within the infrastructure. As far as what's been proposed, I = do think it is supposed it will be a closed carrier infrastructure to begin= with. One of the things I've wondered about is how could it be open, and = what does that look like? I don't have any good answers, but just a willin= gness to be open-minded that non-carrier-only implementations are desirable= too. With respect to key management, I've assumed X.509 certificates and I was s= pecifically referring to ordinary operational considerations with respect t= o CA/CRL and certs. i.e., one or a few or many? regulated? per-carrier?del= egation, et cetera. My comment about signature interpretation was with respect to ""how the res= ults of a validation" [should be] "used by the verifying entity ". I also think knowing, with certainty, that a calling party number is authen= tic and authorized for any given origination of any call type is going to a= pproach impossible (call it a quasi-NP-Complete problem), and so I've advoc= ated for truth-iness in signature and interpretation but a very strictly li= mited set of truth-iness. (I know this weasel language is anethema but I'l= l just beg forgiveness rather than permission.) I don't think it is practical to assume that carriers can know in every cir= cumstance whether a calling number signature should represent "fully" authe= nticated. A "partial" authentication (i.e., a carrier signature) is still = possible and valuable, if for nothing else, forensic and legal relief purpo= ses (against perpetrators, not carriers, unless they collude). With regard to the SHAKEN Framework I've proposed the following (roughly): 00 =3D Unsigned and wholly untrusted 01 =3D Carrier signed, but no calling number signature (for various standar= d or best practice reasons) =3D somewhat more trusted because the carrier c= an be identified 10 =3D Carrier signed, but calling number signature is not of the highest p= ossible quality (for various or best practice reasons) =3D more trusted tha= n 00 and 01. 11 =3D Carrier signed, calling number signature is of the highest possible = quality (most likely because it's mobile, the device authenticated to the n= etwork, and we know location, and subscriber) =3D most trusted Categories 00 through 10 can be automatically filtered for real-time analyt= ical robocall treatment. Category 11 might only get post-processing analyt= ics. Category 11 should be a large majority (I think). It's nice that I've offered this very limited interpretation, but the reaso= ns or best practices for assigning any given interpretration are details th= at remain to be standardized (and wish us all luck too please). Pierce -----Original Message----- From: Dave Crocker [mailto:dhc@dcrocker.net] Sent: August 15, 2016 9:44 AM To: Gorman, Pierce A [CTO] Cc: stir@ietf.org Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realitie= s On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: > My personal view agrees with yours that there seems to be an > expectation that STIR will operate on endpoints in an end-to-end > fashion when in fact, to have any hope of nearer term deployment of > anything hopefully approaching critical mass (and even then there are > very big challenges), the carriers will be required to do the key > management, the signing, and the interpretation of signatures. There is a difference between an architecture that /requires/ operation wit= hin the infrastructure, versus one that permits the choice of operation at = the end-points and/or within the infrastructure. For example, the current discussions I've heard about the operational of th= e key query/validation mechanism for STIR is that it will operate within th= e inter-provider infrastructure, with no direct access allowed for end-syst= ems (that are not controlled by a participating provider.) That's a major a= rchitectural choice and precludes the long-term option of direct participat= ion by those independent user agents. Instead it requires them to be slave= d to their provider. By contrast, DKIM allows signing and/or verifying by any entity in the sequ= ence, even though actual operation is (currently) entirely within the MTA i= nfrastructure. > What is signed and how it is interpreted are critical pieces of > information and need to be kept extremely simple or, IMHO, this will > be as big mess as you've tried to warn. And of course these critical > pieces will not be provided here. Specification of the core information to be signed is something that profou= ndly affects the security properties of the service. That's a technical po= int. To the extent the specification defers this choice, it needs to make = very clear statements about the choices and the effects of those choices. > As far as "out-of-scope dependencies" I'll suggest that how keys are > managed, what is signed, and how the signatures should be interpreted > are the big 3 that occur to me. You believe there should be no standardized technical specification for the= key management infrastructure? This is the highest-risk component of the = service and it needs to be interoperable at a global scale. How else will = that interoperability be achieved? Also, what do you mean "how the signatures should be interpreted"? If you mean the direct semantics of a signature, such as meaning that the r= equest is valid vs. the request was processed by the signer, I'll strongly = urge you to reconsider, since that's an essential technical point and needs= to be standardized. Failure to have the semantic of the signature -- it's= 'meaning' -- be clear in the technical specification has demonstrably caus= ed serious operational problems. If you mean "how the results of a validation are used by the verifying enti= ty", then yes indeed, that's an entirely separate area of work. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. From nobody Mon Aug 15 08:22:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32A8E12D18F for ; Mon, 15 Aug 2016 08:22:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7BupuI5AbAVq for ; Mon, 15 Aug 2016 08:22:32 -0700 (PDT) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11EA112D18B for ; Mon, 15 Aug 2016 08:22:22 -0700 (PDT) Received: by mail-qk0-x22c.google.com with SMTP id v123so45269599qkh.2 for ; Mon, 15 Aug 2016 08:22:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=ewr7YPfcvbENYnueRNP2ELjBpXimM4R4b1CqOifAyeY=; b=EMcgvblMkscLLyeR69tRVXU7zjWDczekBbll9Q0AtdyvgDubriLuDb5GpA6c5VB7Pe m1CpyMsLqWDx4kemac8RMb170E0S6dGB6Cfsy1ddqTLl5kthC4Y6HV6BGPV+DC5ZjHFN +YY4fPtl9Tt0KX514p25hWd1FVI3hwtsHis8d5BJxdQ5aOg6e9rNYvan4i8jMDsT4q0i B/uglEduf+wH9MzIm01/HYzSwHubBJCXPaUKubNlv/ajilkgi/dWq8XZ4ag/YHN0HPk9 /XLI3tA7C9cndZ2iwIH2ENPqExFMzPV6R/hSZRO+naRSgTCzkRNrzw4AilLuOuRRHNo6 CInA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=ewr7YPfcvbENYnueRNP2ELjBpXimM4R4b1CqOifAyeY=; b=ifaOYktZSu4i65ZrQkAwQF1tznwfJYAxTA54uRX8g633VhZrmWUXfhbjXIx6Y1i13H fLdVXpx7vqgi/w81qyUSXoGPtVQwzWPu1FVew4JqtFndxA5t2qE2C9+1N25ieUQbfv6E oW1V3D8IfNdvNXuiPVQsCoE9Mytuc/rdhpng0+CnnYFBZFxiyQ+3t+3gcNRGmQKvw7Jn wuj0aKajz4HUC2RUvDfcCFc2IxXv9QHlcDvk3oAQl6Vxbd4sjMLAawxSBZoQGCoZum3H iZy0f4mBlva9kr28bNQuvWJCqg0F+DjYWEFjEj4d4HE8Jnh8NR+Z6Q1leLQ2qDmsrmki CMnQ== X-Gm-Message-State: AEkoousJeUuE3PbNGXhgSwcJeKGsvdLUMHkx6Qs09Cqpv/tySRDIZHVE5ULwO8MU53uFFA== X-Received: by 10.55.20.90 with SMTP id e87mr31017328qkh.260.1471274541181; Mon, 15 Aug 2016 08:22:21 -0700 (PDT) Received: from [10.33.192.45] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id 6sm11404101qke.5.2016.08.15.08.22.20 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Aug 2016 08:22:20 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_C6325EBD-FBB4-4B3B-AEE9-7AFE9E69A555" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Mon, 15 Aug 2016 11:22:17 -0400 Message-Id: <2F3D4FE3-E4CB-492E-B4E4-94C746D72703@brianrosen.net> References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> To: Travis Russell X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:22:35 -0000 --Apple-Mail=_C6325EBD-FBB4-4B3B-AEE9-7AFE9E69A555 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 This is a SIP mechanism, so, as currently defined, it doesn=92t help any = calls originated on an SS7 network. If checking was implemented at an SS7 gateway, it could help stop bad = calls that originate on a SIP network but transit one or more SS7 hops = en route to the destination. We have discussed and have postponed = working on an =93out of band=94 mechanism that may be able to assist in = getting a valid signature on these and some other hybrid situations to = the termination network/device if they too were SIP based or had = upgradeable software. Brian > On Aug 15, 2016, at 11:15 AM, Travis Russell = wrote: >=20 > Just a quick question as this sentence caught my eye: >=20 > "By requiring calls to have valid signatures at network = interconnections, we provide a tracking mechanism back to the = origination network, and that will really help quite a bit. It=92s my = opinion that if a large number of =93bad=94 calls come from networks = that permit call origination from essentially anonymous customers, that = the authorities will take steps to rein in such networks, but that=92s = just an opinion." >=20 > We currently have a situation in the industry where there are a number = of CSPs that are selling interconnect access to anyone, and are = complicit with the true purposes of these purchased interconnects = (eavesdropping and location tracking have been the most widely = published). When messages are received from the rogue actors,it appears = as if the control message (in this case SS7) are coming from a = legitimate, trusted CSP. Is there a proposed mechanism that would = identify when these CSPs provide SIP connectivity fully certified? =20 >=20 > >=20 > Travis Russell | Director, Cyber Security, Service Provider Networks |=20= > +1919.205.6857 (o) | +1919.412.1167 (c) > https://www.linkedin.com/in/travisrussell1 = >=20 > 5200 Paramount Pkwy > Morrisville, NC 27560 > USA >=20 > >=20 > Oracle is committed to developing practices and products that help = protect the environment >=20 >=20 >=20 >=20 >> On Aug 15, 2016, at 11:04 AM, Brian Rosen > wrote: >>=20 >> I don=92t think there is any disagreement on how we=92re going to = deploy stir, nor is there any specification that limits or even = influences it. >>=20 >> We=92re going to start deployment at the service provider. We=92re = going to evolve to deployment on the device. There are some = participants who think deployment on the device is never going to = happen, but they don=92t oppose it, they are just skeptical it will = happen. >>=20 >> All the documents we have allow generation by any entity that has a = certificate valid for the TN the call is claiming to be from. Any = entity on the path can check, making an assumption that the header/body = won=92t be stripped (which could be a bad assumption, but there are no = protocol police). >>=20 >> If anyone thinks there is text in any of our documents that they = believe doesn=92t allow that, please specify where, and I=92m sure we = can fix it. >>=20 >> The mechanism is designed to allow the origination network, or the = origination device, to generate a valid signature. It=92s designed to = let any element on the path check the signature (and thus the = certificate used to sign it) for validity. >>=20 >> I have suggested that a useful way to deploy it is to have = interconnection agreements between service providers modified to require = a certain percentage of validly signed calls by a certain date, = ratcheting up the percentage over time. If that included checking at = transit network interconnects, even if the path downstream of that = network had SS7 links, we would gain most of the benefit of stir.=20 >>=20 >> Please note that while we do want to get the call treatment modified = depending on the outcome of verification of the signature, the greatest = value comes from the ability of the authorities to track the source of = calls back to the originator. By requiring calls to have valid = signatures at network interconnections, we provide a tracking mechanism = back to the origination network, and that will really help quite a bit. = It=92s my opinion that if a large number of =93bad=94 calls come from = networks that permit call origination from essentially anonymous = customers, that the authorities will take steps to rein in such = networks, but that=92s just an opinion. >>=20 >> Brian >>=20 >>> On Aug 15, 2016, at 10:44 AM, Dave Crocker > wrote: >>>=20 >>> On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >>>> My personal view agrees with yours that there seems to be an = expectation >>>> that STIR will operate on endpoints in an end-to-end fashion when = in >>>> fact, to have any hope of nearer term deployment of anything = hopefully >>>> approaching critical mass (and even then there are very big = challenges), >>>> the carriers will be required to do the key management, the = signing, and >>>> the interpretation of signatures. >>>=20 >>> There is a difference between an architecture that /requires/ = operation within the infrastructure, versus one that permits the choice = of operation at the end-points and/or within the infrastructure. >>>=20 >>> For example, the current discussions I've heard about the = operational of the key query/validation mechanism for STIR is that it = will operate within the inter-provider infrastructure, with no direct = access allowed for end-systems (that are not controlled by a = participating provider.) That's a major architectural choice and = precludes the long-term option of direct participation by those = independent user agents. Instead it requires them to be slaved to their = provider. >>>=20 >>> By contrast, DKIM allows signing and/or verifying by any entity in = the sequence, even though actual operation is (currently) entirely = within the MTA infrastructure. >>>=20 >>>=20 >>>> What is signed and how it is interpreted are critical pieces of >>>> information and need to be kept extremely simple or, IMHO, this = will be >>>> as big mess as you=92ve tried to warn. And of course these = critical >>>> pieces will not be provided here. >>>=20 >>> Specification of the core information to be signed is something that = profoundly affects the security properties of the service. That's a = technical point. To the extent the specification defers this choice, it = needs to make very clear statements about the choices and the effects of = those choices. >>>=20 >>>=20 >>>> As far as =93out-of-scope dependencies=94 I=92ll suggest that how = keys are >>>> managed, what is signed, and how the signatures should be = interpreted >>>> are the big 3 that occur to me. >>>=20 >>> You believe there should be no standardized technical specification = for the key management infrastructure? This is the highest-risk = component of the service and it needs to be interoperable at a global = scale. How else will that interoperability be achieved? >>>=20 >>> Also, what do you mean "how the signatures should be interpreted"? >>>=20 >>> If you mean the direct semantics of a signature, such as meaning = that the request is valid vs. the request was processed by the signer, = I'll strongly urge you to reconsider, since that's an essential = technical point and needs to be standardized. Failure to have the = semantic of the signature -- it's 'meaning' -- be clear in the technical = specification has demonstrably caused serious operational problems. >>>=20 >>> If you mean "how the results of a validation are used by the = verifying entity", then yes indeed, that's an entirely separate area of = work. >>>=20 >>>=20 >>>=20 >>> d/ >>>=20 >>>=20 >>> --=20 >>>=20 >>> Dave Crocker >>> Brandenburg InternetWorking >>> bbiw.net >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 --Apple-Mail=_C6325EBD-FBB4-4B3B-AEE9-7AFE9E69A555 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 This is a SIP mechanism, so, as currently defined, it doesn=92t= help any calls originated on an SS7 network.

If checking was implemented at an SS7 = gateway, it could help stop bad calls that originate on a SIP network = but transit one or more SS7 hops en route to the destination.  We = have discussed and have postponed working on an =93out of band=94 = mechanism that may be able to assist in getting a valid signature on = these and some other hybrid situations to the termination network/device = if they too were SIP based or had upgradeable software.

Brian


On = Aug 15, 2016, at 11:15 AM, Travis Russell <travis.russell@oracle.com> wrote:

Just a quick question as this sentence caught my = eye:

"By = requiring calls to have valid signatures at network interconnections, we = provide a tracking mechanism back to the origination network, and that = will really help quite a bit.  It=92s my opinion that if a large = number of =93bad=94 calls come from networks that permit call = origination from essentially anonymous customers, that the authorities = will take steps to rein in such networks, but that=92s just an = opinion."

We currently have a situation in the industry where = there are a number of CSPs that are selling interconnect access to anyone, and = are complicit with the true purposes of these purchased interconnects = (eavesdropping and location tracking have been the most widely = published). When messages are received from the rogue actors,it appears as if the control = message (in this case SS7) are coming from a legitimate, trusted CSP. Is there a proposed = mechanism that would identify when these CSPs provide SIP connectivity = fully certified?  

= <oracle-e= mail-sig-198324.gif>

Travis Russell | Director, Cyber = Security, Service Provider Networks | 
+1919.205.6857 (o) | +1919.412.1167 (c)
https://www.linkedin.com/in/travisrussell1

5200 Paramount Pkwy
Morrisville, NC 27560
USA

<green-si= g-275518.gif>

Oracle is committed to = developing practices and products that help protect the environment




On Aug 15, 2016, at 11:04 AM, Brian Rosen = <br@brianrosen.net> wrote:

I = don=92t think there is any disagreement on how we=92re going to deploy = stir, nor is there any specification that limits or even influences = it.

We=92re going to start deployment at = the service provider.  We=92re going to evolve to deployment on the = device.  There are some participants who think deployment on the = device is never going to happen, but they don=92t oppose it, they are = just skeptical it will happen.

All the = documents we have allow generation by any entity that has a certificate = valid for the TN the call is claiming to be from.  Any entity on = the path can check, making an assumption that the header/body won=92t be = stripped (which could be a bad assumption, but there are no protocol = police).

If anyone thinks there is text in = any of our documents that they believe doesn=92t allow that, please = specify where, and I=92m sure we can fix it.

The mechanism is designed to allow the origination network, = or the origination device, to generate a valid signature.  It=92s = designed to let any element on the path check the signature (and thus = the certificate used to sign it) for validity.

I have suggested that a useful way to deploy it is to have = interconnection agreements between service providers modified to require = a certain percentage of validly signed calls by a certain date, = ratcheting up the percentage over time.  If that included checking = at transit network interconnects, even if the path downstream of that = network had SS7 links, we would gain most of the benefit of stir.

Please note that while we do want to get the = call treatment modified depending on the outcome of verification of the = signature, the greatest value comes from the ability of the authorities = to track the source of calls back to the originator.  By requiring = calls to have valid signatures at network interconnections, we provide a = tracking mechanism back to the origination network, and that will really = help quite a bit.  It=92s my opinion that if a large number of = =93bad=94 calls come from networks that permit call origination from = essentially anonymous customers, that the authorities will take steps to = rein in such networks, but that=92s just an opinion.

Brian

On Aug 15, 2016, at 10:44 AM, Dave Crocker <dhc@dcrocker.net> = wrote:

On 8/15/2016 7:21 AM, Gorman, Pierce = A [CTO] wrote:
My = personal view agrees with yours that there seems to be an expectation
that STIR will operate on endpoints in an end-to-end fashion = when in
fact, to have any hope of nearer term deployment = of anything hopefully
approaching critical mass (and even = then there are very big challenges),
the carriers will be = required to do the key management, the signing, and
the = interpretation of signatures.

There is a difference between an architecture that /requires/ = operation within the infrastructure, versus one that permits the choice = of operation at the end-points and/or within the infrastructure.

For example, the current discussions I've = heard about the operational of the key query/validation mechanism for = STIR is that it will operate within the inter-provider infrastructure, = with no direct access allowed for end-systems (that are not controlled = by a participating provider.) That's a major architectural choice and = precludes the long-term option of direct participation by those = independent user agents.  Instead it requires them to be slaved to = their provider.

By contrast, DKIM allows = signing and/or verifying by any entity in the sequence, even though = actual operation is (currently) entirely within the MTA = infrastructure.


What is signed and how it is interpreted are = critical pieces of
information and need to be kept = extremely simple or, IMHO, this will be
as big mess as = you=92ve tried to warn.  And of course these critical
pieces will not be provided here.

Specification of the core = information to be signed is something that profoundly affects the = security properties of the service.  That's a technical point. =  To the extent the specification defers this choice, it needs to = make very clear statements about the choices and the effects of those = choices.


As far as =93out-of-scope dependencies=94 I=92ll = suggest that how keys are
managed, what is signed, and how = the signatures should be interpreted
are the big 3 that = occur to me.

You believe there = should be no standardized technical specification for the key management = infrastructure?  This is the highest-risk component of the service = and it needs to be interoperable at a global scale.  How else will = that interoperability be achieved?

Also, = what do you mean "how the signatures should be interpreted"?

If you mean the direct semantics of a = signature, such as meaning that the request is valid vs. the request was = processed by the signer, I'll strongly urge you to reconsider, since = that's an essential technical point and needs to be standardized. =  Failure to have the semantic of the signature -- it's 'meaning' -- = be clear in the technical specification has demonstrably caused serious = operational problems.

If you mean "how the = results of a validation are used by the verifying entity", then yes = indeed, that's an entirely separate area of work.



d/


--

Dave = Crocker
Brandenburg InternetWorking
bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


= --Apple-Mail=_C6325EBD-FBB4-4B3B-AEE9-7AFE9E69A555-- From nobody Mon Aug 15 08:23:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BAC412D18F for ; Mon, 15 Aug 2016 08:23:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.248 X-Spam-Level: X-Spam-Status: No, score=-3.248 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zipdx.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yFSI832RLk71 for ; Mon, 15 Aug 2016 08:23:55 -0700 (PDT) Received: from xdev1sjc.zipdx.com (sjc-e-66.zipdx.com [166.88.23.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78B2C12D18B for ; Mon, 15 Aug 2016 08:23:55 -0700 (PDT) Received: from DPFyoga (c-73-15-29-134.hsd1.ca.comcast.net [73.15.29.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: dfrankel) by xdev1sjc.zipdx.com (Postfix) with ESMTPSA id E8C7A1B800FE; Mon, 15 Aug 2016 08:23:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=zipdx.com; s=default; t=1471274635; bh=7IqPvxcVEw1L98yjRs/u+BrufiIqivlIz7z/uE3+kIU=; h=From:To:Cc:References:In-Reply-To:Subject:Date:From; b=oV916EzfhqSL6y6x4WWKU4VD02sGx4nBsFut95nCsHYwIt5LCpFQ8HSHk3qpmEVii YAxC+YzagaaSeqAVPNx+7xJlX2grOhUjTWsCXNAgMtWkXOse+aP8YxXcD/0lGWinbV +TYqcSp0JKvDD/af3QnYgMERDp9RCtH1hGiEmYXQ= From: "David Frankel" To: "'Brian Rosen'" , References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> In-Reply-To: <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> Date: Mon, 15 Aug 2016 08:23:54 -0700 Organization: ZipDX LLC Message-ID: <041401d1f709$09511490$1bf33db0$@zipdx.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQLlRhxa6l1OJal1tbwToFmirYTSogIuxjrFAjpdFgsCp5gh9J3q/Hfw Content-Language: en-us Archived-At: Cc: stir@ietf.org, "'Gorman, Pierce A \[CTO\]'" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:23:57 -0000 Thanks for that clarification, Brian. You say you "don't think there is any disagreement on how we're going to deploy stir" but part of my challenge (and for others too, I think) is that many of us don't know the details of that "how" because, while the documents don't LIMIT what's done, they also are necessarily incomplete (thanks to things like country-specific deployment issues being out of scope). Let me ask for your help with this example; correct me if I am wrong on any of the below: My telephone number is +1-212-555-1234 and my service provider is AT&T. Presumably there is some USA-specific mechanism that says that AT&T is the authority for the certificate for my number (based, I would think, on the number portability database and/or the LERG). When I place an outbound call under "normal" circumstances, AT&T will sign that call for me and send it on its way. Anybody in the call path can see that the call claims to be from +1-212-555-1234, do a number portability look-up to see that it's an AT&T number, and then somehow know to go to AT&T's certificate authority API to do what it takes to verify the signature? (Or maybe there is a consolidated place where AT&T deposits that information, along with other carriers, and providers along the call path can just go there to check?) In any case, for this part of the example, anybody along the path, including the termination point, can know that the call is legit. Now, I can engage a call center to make some outbound calls on my behalf. (I know this use case has been raised many times.) The call center I have chosen uses Verizon as their outbound carrier. So I go to AT&T and ask them for the certificate for my number; they give that to me and I pass it to my call center. So now they place calls, via Verizon, and either the call center (probably) or Verizon (less likely) uses my certificate to authenticate the outbound calls they make on my behalf, claiming (legitimately) to be from +1-212-555-1234. Again, anybody in the call path can authenticate the call, seeing that it is an authorized use of my AT&T number. When the call arrives at the terminating end, they see that the call is legit. And although it is an AT&T number, they have no clue that it was originated on Verizon's network. Is that all close to correct? David Frankel ZipDXR LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: Monday, August 15, 2016 8:05 AM To: dcrocker@bbiw.net Cc: stir@ietf.org; Gorman, Pierce A [CTO] Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities I don't think there is any disagreement on how we're going to deploy stir, nor is there any specification that limits or even influences it. We're going to start deployment at the service provider. We're going to evolve to deployment on the device. There are some participants who think deployment on the device is never going to happen, but they don't oppose it, they are just skeptical it will happen. All the documents we have allow generation by any entity that has a certificate valid for the TN the call is claiming to be from. Any entity on the path can check, making an assumption that the header/body won't be stripped (which could be a bad assumption, but there are no protocol police). If anyone thinks there is text in any of our documents that they believe doesn't allow that, please specify where, and I'm sure we can fix it. The mechanism is designed to allow the origination network, or the origination device, to generate a valid signature. It's designed to let any element on the path check the signature (and thus the certificate used to sign it) for validity. I have suggested that a useful way to deploy it is to have interconnection agreements between service providers modified to require a certain percentage of validly signed calls by a certain date, ratcheting up the percentage over time. If that included checking at transit network interconnects, even if the path downstream of that network had SS7 links, we would gain most of the benefit of stir. Please note that while we do want to get the call treatment modified depending on the outcome of verification of the signature, the greatest value comes from the ability of the authorities to track the source of calls back to the originator. By requiring calls to have valid signatures at network interconnections, we provide a tracking mechanism back to the origination network, and that will really help quite a bit. It's my opinion that if a large number of "bad" calls come from networks that permit call origination from essentially anonymous customers, that the authorities will take steps to rein in such networks, but that's just an opinion. Brian > On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: > > On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >> My personal view agrees with yours that there seems to be an >> expectation that STIR will operate on endpoints in an end-to-end >> fashion when in fact, to have any hope of nearer term deployment of >> anything hopefully approaching critical mass (and even then there are >> very big challenges), the carriers will be required to do the key >> management, the signing, and the interpretation of signatures. > > There is a difference between an architecture that /requires/ operation within the infrastructure, versus one that permits the choice of operation at the end-points and/or within the infrastructure. > > For example, the current discussions I've heard about the operational of the key query/validation mechanism for STIR is that it will operate within the inter-provider infrastructure, with no direct access allowed for end-systems (that are not controlled by a participating provider.) That's a major architectural choice and precludes the long-term option of direct participation by those independent user agents. Instead it requires them to be slaved to their provider. > > By contrast, DKIM allows signing and/or verifying by any entity in the sequence, even though actual operation is (currently) entirely within the MTA infrastructure. > > >> What is signed and how it is interpreted are critical pieces of >> information and need to be kept extremely simple or, IMHO, this will >> be as big mess as you've tried to warn. And of course these critical >> pieces will not be provided here. > > Specification of the core information to be signed is something that profoundly affects the security properties of the service. That's a technical point. To the extent the specification defers this choice, it needs to make very clear statements about the choices and the effects of those choices. > > >> As far as "out-of-scope dependencies" I'll suggest that how keys are >> managed, what is signed, and how the signatures should be interpreted >> are the big 3 that occur to me. > > You believe there should be no standardized technical specification for the key management infrastructure? This is the highest-risk component of the service and it needs to be interoperable at a global scale. How else will that interoperability be achieved? > > Also, what do you mean "how the signatures should be interpreted"? > > If you mean the direct semantics of a signature, such as meaning that the request is valid vs. the request was processed by the signer, I'll strongly urge you to reconsider, since that's an essential technical point and needs to be standardized. Failure to have the semantic of the signature -- it's 'meaning' -- be clear in the technical specification has demonstrably caused serious operational problems. > > If you mean "how the results of a validation are used by the verifying entity", then yes indeed, that's an entirely separate area of work. > > > > d/ > > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 15 08:24:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7396B12D8C1 for ; Mon, 15 Aug 2016 08:24:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0sISnAdBpYZb for ; Mon, 15 Aug 2016 08:24:02 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0125.outbound.protection.outlook.com [104.47.41.125]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 796C112D733 for ; Mon, 15 Aug 2016 08:24:02 -0700 (PDT) Received: from BN1AFFO11FD012.protection.gbl (10.58.52.33) by BN1AFFO11HUB038.protection.gbl (10.58.52.149) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Mon, 15 Aug 2016 15:24:01 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.81) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.81 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.81; helo=preapdm2.corp.sprint.com; Received: from preapdm2.corp.sprint.com (144.230.32.81) by BN1AFFO11FD012.mail.protection.outlook.com (10.58.52.72) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Mon, 15 Aug 2016 15:24:01 +0000 Received: from pps.filterd (preapdm2.corp.sprint.com [127.0.0.1]) by preapdm2.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7FFGBZY041723; Mon, 15 Aug 2016 11:24:00 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm2.corp.sprint.com with ESMTP id 24svjt270q-7 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 11:24:00 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 15 Aug 2016 10:23:58 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 15 Aug 2016 10:23:58 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen , "dcrocker@bbiw.net" Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMwgABfV4CAAAXCgP//sYFA Date: Mon, 15 Aug 2016 15:23:57 +0000 Message-ID: <1ad33c45beb640b5a62d837047cdfb40@PLSWE13M08.ad.sprint.com> References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> In-Reply-To: <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.38] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.81; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(377454003)(24454002)(189002)(199003)(13464003)(8936002)(3846002)(4326007)(97756001)(47776003)(586003)(8746002)(11100500001)(87936001)(92566002)(626004)(6116002)(106466001)(8676002)(68736007)(2950100001)(76176999)(54356999)(19580405001)(19580395003)(50986999)(2900100001)(5001770100001)(97736004)(15975445007)(356003)(5250100002)(189998001)(106116001)(7846002)(50466002)(7736002)(7696003)(23726003)(93886004)(33646002)(46406003)(102836003)(2501003)(81156014)(305945005)(108616004)(24736003)(81166006)(2906002)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB038; H:preapdm2.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD012; 1:6vI+hKZ4DSTSPv6sVczosoOEvRC0phiXdPBD8w37IeDCfDk6JSq/m49YeIsWXnzAFmVcUGHZK+Y/vQK+lA8XsIheJLdE320mJrlfoWudjaRSV3vkOf3TtiGI1L/xqd7w3AZ5t5XpThNpfREuYJy8co/w6HLZFFQwIYhkTIWX8iLq5NqW/uET4ItP1dq3QtzuJcipOEbOtjm3SKXGXHO/ZOt2MyOXg6TOuoNcQ5+eKNxfgXXBiGu4oQ+grRW6KG7P/7b+M4NTwVK4OvQOCGPBibDkxLaShet5JwmG+9t+tFDewZe3tSnmOjQAoZ1lFJwQRev00iN+mGXVzD4yXNAFyk/hs2mZzHrAPZzXjnYoqvfQ9BIYtcUzzPKXNmFpyyL0LzHTcoF7Nq51pleQP/cGcl4j6k7VOncgaQ57ogbQDltaQ1IgTAUV1JkkxZMadB7l5l83q5JYYtBuwFW2Pof3s4OfzndOILPiDgkhJwHFd4IZfRLi92lB2l0m7ljwtHVOjTyBij2QwnlDDaau9tf0ychg07iGxUr1FVkkRL8BAvMkDA7Z8rGqVK7KDecH2xQr X-MS-Office365-Filtering-Correlation-Id: 83beb569-9cf0-42a7-b9d2-08d3c5202f68 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB038; 2:PWvuFWmeReVfa1yK2IYRD5x5wCjWhjMz05+T8yFqmCWbU3FvuFzSpstSu7NNAt5qP/zmTBVTzCVGQZdDJFc4nsC/UEBA/tvDU3eDoNtpPPJL4C2liS8P2WWB4tgnLgCzz9mtucXbuqX1fOCSZWmBc1DzBMXonoUwz6hBTVg+m3htJoW0UezRwNSRXDKfbomB; 3:Wv//CAdw1fIGpLcmVl/KKc0SPTMVBLWgpt8MNuaf5HxJNunlAIlIdekJp0a8vAvQevxTOt6Ih+PMtuEIwe01abA6KaOGqfgITb9oHVpk0IHqzXfwyQT29UsZmsCZt4wPXYPZ5MKR9mpjrc7bGvIc0TUIJtzOiIzUplyzzp8qx6XimUNDou/jObt6e32v3eMRZ2+kK3HLQv7ssDHTkHMqZKkotgMd6pMm5m9t4ZtHZTWQpJtVLrSLOOiGS46N47k/c7ZTXS/4FQtLHPJcogcP0Q==; 25:fjYYon631GZ7U94jxePFxQ1EzTrQqer4oLmc2ryWNndlKH1EZ/3nwg1D/htbX00iVjx7JzgIe9ZRr2aYIRn3XZ5/3n44WH4gaEHqSRDv4SVMonXUfThsy6N9mOvy2Qsca7F0kC2lPi0AfVXhNJxPspoIzLL+tMOIi3GgrBCBDgfEHvyBzxUhwdhxZupLlvgEsx430YWRkscZbqqFO1fO5+oGxOqsLdgJroQi+evBaqurhJzfgu4LPIN+N6oCEsi71g+N7A0dkMT857I5TpsXFzTYPzXi1pXz3JuPlgHZAYK/7up+/7IQwZbcdBMAdv4UK8k4ULG8yFYgw6I+vLb0Goj1NQVUbZrjEsC3M2J/ht3EAVFAFunfNtIth63PFhKDozay0BuR8YGLfZLFGAzOi/ehcxGmJu8RiXDdi4aSay3sHtMWWiHT/SFoQuQXg9Ss X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB038; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB038; 31:gfReSDLa18xrjyuQ+tYEUlFfSQ74l/dWpJGc34rK5GqeTtbN0yARInw8cJbmirQhyYFiFvUMjAIAaOK2YIb7WbroORk48+l22TVIET56Bplmm2wNIEhL4ndz7JVWURPdeXNMqfeezbiTyQFHGIuITL3NE55fUXmj8GrdC3fpYSzA6uWE1f4De1MNIKV3CVFxhO84YVvO5unsmD7gJ2kx7ZX20hNeXCtjiel5cpmyzGk=; 20:jn7ZK10b4l7ujgy1QiyNv3eGgCYzUWPjiViPXKLUO3M5TTswTBzGKjusIn9aP4kzFqlvrZEPe7Gb5UNigEIr4DvLXLjViOlxQmPnxiq95OHXO+u6PEZEuN3uRPUrqvp/HeCO17z/PxWgo20GLvp+bS3sqgTaJbegA7qeYm9nmCj6yA45hctyE8282fIhLG3oFdh1KCjlETX5JSysA2x2/22V4p/UliQDz2ybDauHhie8f/oqhKMJ0AIv60DUfs7w3TQZ1ml20d6oAjQoNz23oddiC8TtExEP/ZLTi6HgRsDBSVXl95+M1EvcgFMRB4+3gvrA3GX2FE7PeKhZtiQPwSsPLZLQuiY7ZqbU4pz3iRmEMHIRqzuaSfackrZm8u1ytOrwQRx/b5NFKoz+0upe3DsE5kER04m1MgJCzJYoVxU= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(18430343700868); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(13024025)(13018025)(13015025)(13017025)(13023025)(10201501046)(3002001)(6055026); SRVR:BN1AFFO11HUB038; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB038; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB038; 4:n09Vvuf48H6pQj54hH9WevTrBurNp2snf4FuOBS58LyqhF5wlcOp64y7EcuyvvqWLBptnT6GIfU0JkowYXq1Zf50/KuiiNKXQz6YjczP9n4VdfpvBQ9ntaq85m4Z77IQeqO0Iwh75DpyNeCZIuGR4Lqju/NL/IXlrcYFclG4MujnAeO53n1/lcVvPwNagEzUMddsThuOkoGjBY6SLledzva56WVXHEllNNOZanJI824/w9uQkd3lLl1HTaJqjNB55EiiHdxYkiaK0xU5TF54GLx0id8m0Zlf1u70JNYZzk1FUBgToHVwTohHXBVaC1TZ/gHWLMesKy69POSDqhPKHbp73Jx3fbwLINbquG1dnjcENqJFVhGqd2k7SLgZKIPfQhpyg+WKy4WGuJzSN4I0novTzP865OpqTXXunonoGwi26HtBCXIx3VJ0i2saA1BcEOwFakc5oCl2vG9kIWCDYt6QFRzP478mYBraI4xMob6DlonsYOrOGdQZyZNNZM6d6Ri0SI480bZ8cO1gjVPzu9Wd439NxUndJGVG3yN8d42Fsy/5MWUg9+Vpkqb2mghja8QGqibj3RWMRHQ0h4WAsQ== X-Forefront-PRVS: 0035B15214 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB038; 23:j0JP8yMokWXwn6vfczQNAC3KCkP0/sFA+YPjOJ7?= =?us-ascii?Q?MPmseAY3jxV0KGXKZ7ojz3B4klHYOPj+9Rl6711ygEeCbAcBU2ON/mbjT8zB?= =?us-ascii?Q?a6c7oah9oJ+M0NfaDtylyT1zQnvMFo94+pyszgAkOQ66SBNYMHsP0VjcV6JV?= =?us-ascii?Q?Ib23X5cZsqEkqT/ZbYW1QllkfkGeMAcudUUo7YhBXCADUZQUeHhq60cvSz7Y?= =?us-ascii?Q?UeZS5f8DOrsSs78EJ+8CBkl/vTgfInaJ5OONGFuju3APT5jFCsJDMNNROThX?= =?us-ascii?Q?9rGWbovUZBkSaEjSgdzWKyi7gqBgiT987bNorqNwOtaWN+JzPUc29PVdcCT9?= =?us-ascii?Q?k8jnIKgHDv84O0+FUa+p8l0B7zZ+nSXYSoe3dtjCTDm2sfJB/T9MectF+Cdj?= =?us-ascii?Q?LgI1CIifQt0xSLdBFYWZydSTrQL95fYiDfXKtNGENa1IDD2HFWXXgPGzu/nK?= =?us-ascii?Q?OD3bMqcRKSwqyFvtvcIk+MUyINYFtSTCkaPXt0/SOPV4XP1YZfaZmFMXoLz5?= =?us-ascii?Q?KJ0miRLMhJbL6R9QMFO8pswd3leS33fNE+bMIYBxiHCGrTGSHLs05YFz/86O?= =?us-ascii?Q?/Jw3Yvgpn3LkVeP9oTtkGf1VxvQvPmz4FiVwZvbIEfe03XMHHbfK26/Kmqaq?= =?us-ascii?Q?cRHsD7GVWMrw+ncDd0MnhNWeGGkvarMs+/2jT82o+u1geZhplfxLrnPRSY7s?= =?us-ascii?Q?8v3+ahfdde1p1lleDqk/68OLV/ZgkSOa9CmNC3nrNaYIxvVtg5s6mT1/u/Ma?= =?us-ascii?Q?s0Zk06J/IWy93Lk8ljilVrJuiK8DNv8Mz6Upih5HKpgoEasSDZC5S0khu6b8?= =?us-ascii?Q?TikI9OiKo/yvj8RfNUFZsaL0tehhizy9tc9coH+4iPd+e9YLKtoA1ojM2L+8?= =?us-ascii?Q?nFkstoAtcZDEhB0WCzhDPNkDRzyoF1fsh0YZUi76OHEYcPRe904nxJRG0/uE?= =?us-ascii?Q?Vm1uS93stdi+QX37DMwoPsBGEoq4hHTwQ04U3P4LY+YC/vJnh3hqkQIGZ2Hb?= =?us-ascii?Q?5+7vK8GKva4CLfdsRn4ldOlIm/zp4eS1aHJYkjZ9giHstHUm4qRgJ5td7e1d?= =?us-ascii?Q?qwGcv0igS61KSzPVaBwiRqPpi+Nzyc03wj47+krmNHEc08f1qZawT9oubR3z?= =?us-ascii?Q?xaFgtx23WGRjfAr1SY1v31NlhQaE72dS99UDRiQpJMZ+t4ALE+54tOqlIQQ+?= =?us-ascii?Q?OiGrkj187LiDfnUrpfSOkul5yDM2J11uGMcQyHknuOTYCZCYhJ0iQP/HzhTI?= =?us-ascii?Q?Q5hluzung6UUF++mt/YoAkQvwiSx6sRzuZgWGWuOTvZ02qVMRYZ7AJEbcEhQ?= =?us-ascii?Q?hknI6bkHsfjyJv0WIe9dfCN571HQ5d5fNuW3hEhJx1Fh4?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB038; 6:NUy8yTYUd0NFdu0YTwgKYFDFxbCbdZP/cgdnU/hXEnb1h8OjtLvFCTjwMfOoqyXKCMx5epWFHgN+aobyc29FA8oJyd1VVmigyHVB69ctX9vuJmGjVCPcQtWFtI10IETzJbzd96tYRbLXu87fFiQom58ZMeK1osVPlgKkNgmtDwWIs9njRBU7cpqSBZiJiNGdmOUjryiV90JMd5aZ7H+HledjJaJB+kNGq6y3g6x5THSaqzLBUS9+uVBXa5R6q0TEIOAtWjd+97ofrupEKHx6ucfGshMUmyrG6zMh2JHNMHrsl/HOwPLJBv6Zb7YOQMiDy1t1h98AXvS4tmImwWyerA==; 5:Tm2TrzI1G4B51fwe6ZuhrLauvmJGGfP+l3A+8esUtsa0a7CSn6Tq9OX3hkVZvO8OXp4Ft32VvQz1PXtT0ibBtuKYa3gauIdZUpLIQ1C06he5WT0/VGn9ciqSrF6r1fcZUeia2C4Cfs/Ozx+ddB9C2w==; 24:W/ZJ2oULmRlA6YNmIbrLRzgQ9q0ag3ee1O0Tgj1NdJDux76F03dIo4Xda68pZkokRAo2UXXJ0j7xEpxkIcAyWucaiCDLJXYQ9R5e+EAasx4=; 7:wRF/q2/UM3M1s0DEuFADN/yQyTRYVPGcY1dIl3jYq02rDVe2YYrYuYmjm7LZLSQJKP7Sy+LosAZcdbh9mI7muQWX0srMYgGyd7nNKcn2UMXKH3K/3HzM8D8303vCBR9piWSyHvRLaGW4hl3DpUtSAGnyYlo59uhZQAB7xzqELpJfCgacm85iqb6ogQmVbGX5jhQh/C8REQtr0pB1jR5xcfvJw+I6oxOqLNLfyfomNJvHvACNzajdYjsWXhPUVDrS SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Aug 2016 15:24:01.3765 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.81]; Helo=[preapdm2.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB038 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:24:17 -0000 +1 Pierce -----Original Message----- From: Brian Rosen [mailto:br@brianrosen.net] Sent: August 15, 2016 10:05 AM To: dcrocker@bbiw.net Cc: Gorman, Pierce A [CTO] ; stir@ietf.org Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realitie= s I don't think there is any disagreement on how we're going to deploy stir, = nor is there any specification that limits or even influences it. We're going to start deployment at the service provider. We're going to ev= olve to deployment on the device. There are some participants who think de= ployment on the device is never going to happen, but they don't oppose it, = they are just skeptical it will happen. All the documents we have allow generation by any entity that has a certifi= cate valid for the TN the call is claiming to be from. Any entity on the p= ath can check, making an assumption that the header/body won't be stripped = (which could be a bad assumption, but there are no protocol police). If anyone thinks there is text in any of our documents that they believe do= esn't allow that, please specify where, and I'm sure we can fix it. The mechanism is designed to allow the origination network, or the originat= ion device, to generate a valid signature. It's designed to let any elemen= t on the path check the signature (and thus the certificate used to sign it= ) for validity. I have suggested that a useful way to deploy it is to have interconnection = agreements between service providers modified to require a certain percenta= ge of validly signed calls by a certain date, ratcheting up the percentage = over time. If that included checking at transit network interconnects, eve= n if the path downstream of that network had SS7 links, we would gain most = of the benefit of stir. Please note that while we do want to get the call treatment modified depend= ing on the outcome of verification of the signature, the greatest value com= es from the ability of the authorities to track the source of calls back to= the originator. By requiring calls to have valid signatures at network in= terconnections, we provide a tracking mechanism back to the origination net= work, and that will really help quite a bit. It's my opinion that if a lar= ge number of "bad" calls come from networks that permit call origination fr= om essentially anonymous customers, that the authorities will take steps to= rein in such networks, but that's just an opinion. Brian > On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: > > On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >> My personal view agrees with yours that there seems to be an >> expectation that STIR will operate on endpoints in an end-to-end >> fashion when in fact, to have any hope of nearer term deployment of >> anything hopefully approaching critical mass (and even then there are >> very big challenges), the carriers will be required to do the key >> management, the signing, and the interpretation of signatures. > > There is a difference between an architecture that /requires/ operation w= ithin the infrastructure, versus one that permits the choice of operation a= t the end-points and/or within the infrastructure. > > For example, the current discussions I've heard about the operational of = the key query/validation mechanism for STIR is that it will operate within = the inter-provider infrastructure, with no direct access allowed for end-sy= stems (that are not controlled by a participating provider.) That's a major= architectural choice and precludes the long-term option of direct particip= ation by those independent user agents. Instead it requires them to be sla= ved to their provider. > > By contrast, DKIM allows signing and/or verifying by any entity in the se= quence, even though actual operation is (currently) entirely within the MTA= infrastructure. > > >> What is signed and how it is interpreted are critical pieces of >> information and need to be kept extremely simple or, IMHO, this will >> be as big mess as you've tried to warn. And of course these critical >> pieces will not be provided here. > > Specification of the core information to be signed is something that prof= oundly affects the security properties of the service. That's a technical = point. To the extent the specification defers this choice, it needs to mak= e very clear statements about the choices and the effects of those choices. > > >> As far as "out-of-scope dependencies" I'll suggest that how keys are >> managed, what is signed, and how the signatures should be interpreted >> are the big 3 that occur to me. > > You believe there should be no standardized technical specification for t= he key management infrastructure? This is the highest-risk component of th= e service and it needs to be interoperable at a global scale. How else wil= l that interoperability be achieved? > > Also, what do you mean "how the signatures should be interpreted"? > > If you mean the direct semantics of a signature, such as meaning that the= request is valid vs. the request was processed by the signer, I'll strongl= y urge you to reconsider, since that's an essential technical point and nee= ds to be standardized. Failure to have the semantic of the signature -- it= 's 'meaning' -- be clear in the technical specification has demonstrably ca= used serious operational problems. > > If you mean "how the results of a validation are used by the verifying en= tity", then yes indeed, that's an entirely separate area of work. > > > > d/ > > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. From nobody Mon Aug 15 08:24:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F95D12D6B9 for ; Mon, 15 Aug 2016 08:24:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.466 X-Spam-Level: X-Spam-Status: No, score=-5.466 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.247, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P8UbP7vmE7wE for ; Mon, 15 Aug 2016 08:24:17 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7382F12D89D for ; Mon, 15 Aug 2016 08:24:07 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u7FFO53L016390 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 15 Aug 2016 15:24:05 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.13.8) with ESMTP id u7FFO4u5001980 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 15 Aug 2016 15:24:05 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id u7FFO45X009868; Mon, 15 Aug 2016 15:24:04 GMT Received: from dhcp-adc-twvpn-3-vpnpool-10-154-104-192.vpn.oracle.com (/10.154.104.192) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 15 Aug 2016 08:24:03 -0700 Content-Type: multipart/signed; boundary="Apple-Mail=_A821B79A-3339-42B7-A710-CFFC94BE7753"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Travis Russell In-Reply-To: <2F3D4FE3-E4CB-492E-B4E4-94C746D72703@brianrosen.net> Date: Mon, 15 Aug 2016 11:24:02 -0400 Message-Id: <6847E0DD-E910-476D-AA9F-D17E73145754@oracle.com> References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <2F3D4FE3-E4CB-492E-B4E4-94C746D72703@brianrosen.net> To: Brian Rosen X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:24:22 -0000 --Apple-Mail=_A821B79A-3339-42B7-A710-CFFC94BE7753 Content-Type: multipart/alternative; boundary="Apple-Mail=_8A7E6873-E7BB-4763-8934-C969D979E7AF" --Apple-Mail=_8A7E6873-E7BB-4763-8934-C969D979E7AF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Thanks Brian,=20 But I was thinking more along the lines of a SIP service provided by a = rogue CSP where they would be complicit with rogue actors (as they are = today in the SS7 domain). Hence providing certified SIP identities that = should not be certified (if that makes sense?). Travis Russell | Director, Cyber Security, Service Provider Networks |=20= +1919.205.6857 (o) | +1919.412.1167 (c) https://www.linkedin.com/in/travisrussell1 5200 Paramount Pkwy Morrisville, NC 27560 USA Oracle is committed to developing practices and products that help = protect the environment > On Aug 15, 2016, at 11:22 AM, Brian Rosen wrote: >=20 > This is a SIP mechanism, so, as currently defined, it doesn=92t help = any calls originated on an SS7 network. >=20 > If checking was implemented at an SS7 gateway, it could help stop bad = calls that originate on a SIP network but transit one or more SS7 hops = en route to the destination. We have discussed and have postponed = working on an =93out of band=94 mechanism that may be able to assist in = getting a valid signature on these and some other hybrid situations to = the termination network/device if they too were SIP based or had = upgradeable software. >=20 > Brian >=20 >=20 >> On Aug 15, 2016, at 11:15 AM, Travis Russell = > wrote: >>=20 >> Just a quick question as this sentence caught my eye: >>=20 >> "By requiring calls to have valid signatures at network = interconnections, we provide a tracking mechanism back to the = origination network, and that will really help quite a bit. It=92s my = opinion that if a large number of =93bad=94 calls come from networks = that permit call origination from essentially anonymous customers, that = the authorities will take steps to rein in such networks, but that=92s = just an opinion." >>=20 >> We currently have a situation in the industry where there are a = number of CSPs that are selling interconnect access to anyone, and are = complicit with the true purposes of these purchased interconnects = (eavesdropping and location tracking have been the most widely = published). When messages are received from the rogue actors,it appears = as if the control message (in this case SS7) are coming from a = legitimate, trusted CSP. Is there a proposed mechanism that would = identify when these CSPs provide SIP connectivity fully certified? =20 >>=20 >> >>=20 >> Travis Russell | Director, Cyber Security, Service Provider Networks = |=20 >> +1919.205.6857 (o) | +1919.412.1167 (c) >> https://www.linkedin.com/in/travisrussell1 = >>=20 >> 5200 Paramount Pkwy >> Morrisville, NC 27560 >> USA >>=20 >> >>=20 >> Oracle is committed to developing practices and products that help = protect the environment >>=20 >>=20 >>=20 >>=20 >>> On Aug 15, 2016, at 11:04 AM, Brian Rosen > wrote: >>>=20 >>> I don=92t think there is any disagreement on how we=92re going to = deploy stir, nor is there any specification that limits or even = influences it. >>>=20 >>> We=92re going to start deployment at the service provider. We=92re = going to evolve to deployment on the device. There are some = participants who think deployment on the device is never going to = happen, but they don=92t oppose it, they are just skeptical it will = happen. >>>=20 >>> All the documents we have allow generation by any entity that has a = certificate valid for the TN the call is claiming to be from. Any = entity on the path can check, making an assumption that the header/body = won=92t be stripped (which could be a bad assumption, but there are no = protocol police). >>>=20 >>> If anyone thinks there is text in any of our documents that they = believe doesn=92t allow that, please specify where, and I=92m sure we = can fix it. >>>=20 >>> The mechanism is designed to allow the origination network, or the = origination device, to generate a valid signature. It=92s designed to = let any element on the path check the signature (and thus the = certificate used to sign it) for validity. >>>=20 >>> I have suggested that a useful way to deploy it is to have = interconnection agreements between service providers modified to require = a certain percentage of validly signed calls by a certain date, = ratcheting up the percentage over time. If that included checking at = transit network interconnects, even if the path downstream of that = network had SS7 links, we would gain most of the benefit of stir.=20 >>>=20 >>> Please note that while we do want to get the call treatment modified = depending on the outcome of verification of the signature, the greatest = value comes from the ability of the authorities to track the source of = calls back to the originator. By requiring calls to have valid = signatures at network interconnections, we provide a tracking mechanism = back to the origination network, and that will really help quite a bit. = It=92s my opinion that if a large number of =93bad=94 calls come from = networks that permit call origination from essentially anonymous = customers, that the authorities will take steps to rein in such = networks, but that=92s just an opinion. >>>=20 >>> Brian >>>=20 >>>> On Aug 15, 2016, at 10:44 AM, Dave Crocker > wrote: >>>>=20 >>>> On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >>>>> My personal view agrees with yours that there seems to be an = expectation >>>>> that STIR will operate on endpoints in an end-to-end fashion when = in >>>>> fact, to have any hope of nearer term deployment of anything = hopefully >>>>> approaching critical mass (and even then there are very big = challenges), >>>>> the carriers will be required to do the key management, the = signing, and >>>>> the interpretation of signatures. >>>>=20 >>>> There is a difference between an architecture that /requires/ = operation within the infrastructure, versus one that permits the choice = of operation at the end-points and/or within the infrastructure. >>>>=20 >>>> For example, the current discussions I've heard about the = operational of the key query/validation mechanism for STIR is that it = will operate within the inter-provider infrastructure, with no direct = access allowed for end-systems (that are not controlled by a = participating provider.) That's a major architectural choice and = precludes the long-term option of direct participation by those = independent user agents. Instead it requires them to be slaved to their = provider. >>>>=20 >>>> By contrast, DKIM allows signing and/or verifying by any entity in = the sequence, even though actual operation is (currently) entirely = within the MTA infrastructure. >>>>=20 >>>>=20 >>>>> What is signed and how it is interpreted are critical pieces of >>>>> information and need to be kept extremely simple or, IMHO, this = will be >>>>> as big mess as you=92ve tried to warn. And of course these = critical >>>>> pieces will not be provided here. >>>>=20 >>>> Specification of the core information to be signed is something = that profoundly affects the security properties of the service. That's = a technical point. To the extent the specification defers this choice, = it needs to make very clear statements about the choices and the effects = of those choices. >>>>=20 >>>>=20 >>>>> As far as =93out-of-scope dependencies=94 I=92ll suggest that how = keys are >>>>> managed, what is signed, and how the signatures should be = interpreted >>>>> are the big 3 that occur to me. >>>>=20 >>>> You believe there should be no standardized technical specification = for the key management infrastructure? This is the highest-risk = component of the service and it needs to be interoperable at a global = scale. How else will that interoperability be achieved? >>>>=20 >>>> Also, what do you mean "how the signatures should be interpreted"? >>>>=20 >>>> If you mean the direct semantics of a signature, such as meaning = that the request is valid vs. the request was processed by the signer, = I'll strongly urge you to reconsider, since that's an essential = technical point and needs to be standardized. Failure to have the = semantic of the signature -- it's 'meaning' -- be clear in the technical = specification has demonstrably caused serious operational problems. >>>>=20 >>>> If you mean "how the results of a validation are used by the = verifying entity", then yes indeed, that's an entirely separate area of = work. >>>>=20 >>>>=20 >>>>=20 >>>> d/ >>>>=20 >>>>=20 >>>> --=20 >>>>=20 >>>> Dave Crocker >>>> Brandenburg InternetWorking >>>> bbiw.net >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir = >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir = >>=20 >=20 --Apple-Mail=_8A7E6873-E7BB-4763-8934-C969D979E7AF Content-Type: multipart/related; type="text/html"; boundary="Apple-Mail=_41BCE3C0-C102-47FD-B40D-01936750B7C5" --Apple-Mail=_41BCE3C0-C102-47FD-B40D-01936750B7C5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 Thanks Brian, 

But I was thinking more along the lines of a SIP service = provided by a rogue CSP where they would be complicit with rogue actors = (as they are today in the SS7 domain). Hence providing certified SIP = identities that should not be certified (if that makes = sense?).



Travis Russell | Director, Cyber = Security, Service Provider Networks | 
+1919.205.6857 (o) = | +1919.412.1167 = (c)
https://www.linkedin.com/in/travisrussell1

5200 Paramount Pkwy
Morrisville, NC = 27560
USA



Oracle is committed to = developing practices and products that help protect the environment




On Aug 15, 2016, at 11:22 AM, Brian Rosen <br@brianrosen.net> = wrote:

This is a SIP = mechanism, so, as currently defined, it doesn=92t help any calls = originated on an SS7 network.

If checking was implemented at an SS7 gateway, it could help = stop bad calls that originate on a SIP network but transit one or more = SS7 hops en route to the destination.  We have discussed and have = postponed working on an =93out of band=94 mechanism that may be able to = assist in getting a valid signature on these and some other hybrid = situations to the termination network/device if they too were SIP based = or had upgradeable software.

Brian


On Aug = 15, 2016, at 11:15 AM, Travis Russell <travis.russell@oracle.com> wrote:

Just a quick question as this sentence caught my = eye:

"By = requiring calls to have valid signatures at network interconnections, we = provide a tracking mechanism back to the origination network, and that = will really help quite a bit.  It=92s my opinion that if a large = number of =93bad=94 calls come from networks that permit call = origination from essentially anonymous customers, that the authorities = will take steps to rein in such networks, but that=92s just an = opinion."

We currently have a situation in the industry where = there are a number of CSPs that are selling interconnect access to anyone, and = are complicit with the true purposes of these purchased interconnects = (eavesdropping and location tracking have been the most widely = published). When messages are received from the rogue actors,it appears as if the control = message (in this case SS7) are coming from a legitimate, trusted CSP. Is there a proposed = mechanism that would identify when these CSPs provide SIP connectivity = fully certified?  

= <oracle-email-sig-198324.gif>

Travis Russell | Director, Cyber = Security, Service Provider Networks | 
+1919.205.6857 (o) | +1919.412.1167 (c)
https://www.linkedin.com/in/travisrussell1

5200 Paramount Pkwy
Morrisville, NC 27560
USA

<green-sig-275518.gif>

Oracle is committed to developing = practices and products that help protect the environment




On Aug 15, 2016, at 11:04 AM, Brian Rosen = <br@brianrosen.net> wrote:

I = don=92t think there is any disagreement on how we=92re going to deploy = stir, nor is there any specification that limits or even influences = it.

We=92re going to start deployment at = the service provider.  We=92re going to evolve to deployment on the = device.  There are some participants who think deployment on the = device is never going to happen, but they don=92t oppose it, they are = just skeptical it will happen.

All the = documents we have allow generation by any entity that has a certificate = valid for the TN the call is claiming to be from.  Any entity on = the path can check, making an assumption that the header/body won=92t be = stripped (which could be a bad assumption, but there are no protocol = police).

If anyone thinks there is text in = any of our documents that they believe doesn=92t allow that, please = specify where, and I=92m sure we can fix it.

The mechanism is designed to allow the origination network, = or the origination device, to generate a valid signature.  It=92s = designed to let any element on the path check the signature (and thus = the certificate used to sign it) for validity.

I have suggested that a useful way to deploy it is to have = interconnection agreements between service providers modified to require = a certain percentage of validly signed calls by a certain date, = ratcheting up the percentage over time.  If that included checking = at transit network interconnects, even if the path downstream of that = network had SS7 links, we would gain most of the benefit of stir.

Please note that while we do want to get the = call treatment modified depending on the outcome of verification of the = signature, the greatest value comes from the ability of the authorities = to track the source of calls back to the originator.  By requiring = calls to have valid signatures at network interconnections, we provide a = tracking mechanism back to the origination network, and that will really = help quite a bit.  It=92s my opinion that if a large number of = =93bad=94 calls come from networks that permit call origination from = essentially anonymous customers, that the authorities will take steps to = rein in such networks, but that=92s just an opinion.

Brian

On Aug 15, 2016, at 10:44 AM, Dave Crocker <dhc@dcrocker.net> = wrote:

On 8/15/2016 7:21 AM, Gorman, Pierce = A [CTO] wrote:
My = personal view agrees with yours that there seems to be an expectation
that STIR will operate on endpoints in an end-to-end fashion = when in
fact, to have any hope of nearer term deployment = of anything hopefully
approaching critical mass (and even = then there are very big challenges),
the carriers will be = required to do the key management, the signing, and
the = interpretation of signatures.

There is a difference between an architecture that /requires/ = operation within the infrastructure, versus one that permits the choice = of operation at the end-points and/or within the infrastructure.

For example, the current discussions I've = heard about the operational of the key query/validation mechanism for = STIR is that it will operate within the inter-provider infrastructure, = with no direct access allowed for end-systems (that are not controlled = by a participating provider.) That's a major architectural choice and = precludes the long-term option of direct participation by those = independent user agents.  Instead it requires them to be slaved to = their provider.

By contrast, DKIM allows = signing and/or verifying by any entity in the sequence, even though = actual operation is (currently) entirely within the MTA = infrastructure.


What is signed and how it is interpreted are = critical pieces of
information and need to be kept = extremely simple or, IMHO, this will be
as big mess as = you=92ve tried to warn.  And of course these critical
pieces will not be provided here.

Specification of the core = information to be signed is something that profoundly affects the = security properties of the service.  That's a technical point. =  To the extent the specification defers this choice, it needs to = make very clear statements about the choices and the effects of those = choices.


As far as =93out-of-scope dependencies=94 I=92ll = suggest that how keys are
managed, what is signed, and how = the signatures should be interpreted
are the big 3 that = occur to me.

You believe there = should be no standardized technical specification for the key management = infrastructure?  This is the highest-risk component of the service = and it needs to be interoperable at a global scale.  How else will = that interoperability be achieved?

Also, = what do you mean "how the signatures should be interpreted"?

If you mean the direct semantics of a = signature, such as meaning that the request is valid vs. the request was = processed by the signer, I'll strongly urge you to reconsider, since = that's an essential technical point and needs to be standardized. =  Failure to have the semantic of the signature -- it's 'meaning' -- = be clear in the technical specification has demonstrably caused serious = operational problems.

If you mean "how the = results of a validation are used by the verifying entity", then yes = indeed, that's an entirely separate area of work.



d/


--

Dave = Crocker
Brandenburg InternetWorking
bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir



= --Apple-Mail=_41BCE3C0-C102-47FD-B40D-01936750B7C5 Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=oracle-email-sig-198324.gif Content-Type: image/gif; name="oracle-email-sig-198324.gif" Content-Id: R0lGODlhcgAaAMQAAP8QEP/w8P/Q0P/g4P8wMP9gYP8gIP+goP9QUP+QkP+wsP9wcP+AgP9AQP/A wP8AAP///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAA AAAALAAAAAByABoAAAX/ICSOZGmeaKqubOu+cCzPdC0GCqPvvBKUDp5wp1gFdIPVIDfcOQa6A8yR aO4gweQoUHh4v2Bw4SdihM9egyBF8ALIpkEXDR44vA2XwkD/IgYGAAZbbX1nBGRmhl8AWiUJYicC AIsPDFh4LXOGjQ4NAAhrEIUPBQcOqKmoB5sEZV4JqqoHhQVxlGAOJQG4AAunsqg/dw95KwdfBgzB qKIEBMaQDwCiKpOwEIq6KANuJg14igZwEHPULMTGKbxetjF8D1ItxK7aKl8lCl8DAfALW1+2rUi3 QtqgGN2mwYCXzYvAON624LoEQZ9DEfRcEFSBIE2DjyBDfnyIqRgMcA8a/z5AZQWXOxEdHxwUgfIg sX/zMqlAWclVCQFefLpAqdJBAFJn3owgtpJEQkslEWjUmYLnomokcDlS4s0eFzQNqvXDEyzmAwFP yaXYmGJBuxlzELWIacueiE0AFGyF4HbaNTquUEpFRxUFUC9YXQzARYAkEJSNipKQ9kDu0i9SKKNZ 9iXswMIoYgI4oJYFskpgzkkmcdrviELqmPVt1HpRAaaLqCE1lBgjvEpqRtgl8Tevygd7TcCuiKvP m8OVEkAIYLYPThSsRIpEQJr1x94QBIT09FH6QJC6AiRAoB1kEb7tRb4MvyB+AwSlbejfz7+///8A BijggAQWaOCBCCao4A+CDDbo4IMQRijhhBQKGAIAOw== --Apple-Mail=_41BCE3C0-C102-47FD-B40D-01936750B7C5 Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=green-sig-275518.gif Content-Type: image/gif; name="green-sig-275518.gif" Content-Id: <9205649A-F045-4CC3-93C6-49AB1FCCB58E@us.oracle.com> R0lGODlhLAAcAMQAAP///0x9RHmec9Pf0aa+oleFULHGrmKNW+nv6I+uivT39N7n3W6VZ7zPuZu2 lsjXxYSmfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAA AAAALAAAAAAsABwAQAXhICCOZGmeaDoaReC+sKAMR7GopIA6boIvLgPAVSAgALxjSYdrOp/Q6NPg YqIEPkTBV2taTwgGbEw+PAZo3FfKbqMQQfeJ8DoY0Hg0wxhAKBgHCl5XLgMqDwFCAAIFPIYDgidr OUQGkSh0cQMJAQyXOXKhoqOkpaanI2aoIwMErq+uCY0BMlANKpxkYwQGBH82TpMicD0pAgQACToD AchqhAG3KQ4HIlQNnErG0IYqB9EAiEQvwEsozC43hy0CAeXMwsLDLS8MAvf497ruCZ+gOA0gfNt3 AIK0J/JWKVzIsEQIADs= --Apple-Mail=_41BCE3C0-C102-47FD-B40D-01936750B7C5-- --Apple-Mail=_8A7E6873-E7BB-4763-8934-C969D979E7AF-- --Apple-Mail=_A821B79A-3339-42B7-A710-CFFC94BE7753 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMUzCCBg8w ggT3oAMCAQICED2JPyS/yqQMNSg7P/rkCRgwDQYJKoZIhvcNAQELBQAwgaYxCzAJBgNVBAYTAlVT MR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3Qg TmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRl YyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1MB4XDTE2MDYwNzAwMDAwMFoX DTE3MDIyNTIzNTk1OVowgawxLjAsBgNVBAMMJVBlcnNvbmEgTm90IFZhbGlkYXRlZCAtIDE0NjUz Mjk3OTM2NDIxKDAmBgkqhkiG9w0BCQEWGXRyYXZpcy5ydXNzZWxsQG9yYWNsZS5jb20xDzANBgNV BAsMBlMvTUlNRTEeMBwGA1UECwwVUGVyc29uYSBOb3QgVmFsaWRhdGVkMR8wHQYDVQQLDBZTeW1h bnRlYyBUcnVzdCBOZXR3b3JrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4FxsK5d3 j3hO8899/Sn+KlssnVzzvG5NNvRV6i5zgiR18X+61U3+gum7dmljCw22DWTQUjIgu5ZxbqujDbgm 0eCQeMt9DztwK67qV0ugHg5AtFCKhqI1EkjZw/yMvF4rKlwSdnpYQezDCEnbL6AjIAAhSl1h1aXw HYzuHOT1vNZNjVUV664WtVqxfTvP/RdaPVgn6n9B6N/G3Eh6sUD35Io3RwLKqOnajcAEK0c7apHM GpeUWwT0hiLQA4HrhtwJReB/4+tcV2RQowol5L/eKWAmpBvDkiLDsjaf7yUy+5kUEVmzr2ROlA+r xCGzeZ/A7oI4gY06qapfX3Lv5DF0FwIDAQABo4ICLzCCAiswDAYDVR0TAQH/BAIwADAOBgNVHQ8B Af8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMB0GA1UdDgQWBBRjeq3Z QtNirEkH/lxf1USNN3cu1zAkBgNVHREEHTAbgRl0cmF2aXMucnVzc2VsbEBvcmFjbGUuY29tMGwG A1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRo LmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwXQYDVR0f BFYwVDBSoFCgToZMaHR0cDovL3BraS1jcmwuc3ltYXV0aC5jb20vY2FfNTdkZTdhMjM4ZDQ1ZDhk NGZjNzFmOGE1YzZiODFjOTMvTGF0ZXN0Q1JMLmNybDBOBggrBgEFBQcBAQRCMEAwPgYIKwYBBQUH MAKGMmh0dHA6Ly9jYWNlci5zeW1hdXRoLmNvbS9tcGtpL3N5bWNjMWluZHN1YmNhZzUuY3J0MB8G A1UdIwQYMBaAFGcZtj2lebszYNgtU9OMCT0HrBhwMCsGCmCGSAGG+EUBEAMEHTAbBhJghkgBhvhF ARABAgIEAa3ukhMWBTEwOTIyMDkGCmCGSAGG+EUBEAUEKzApAgEAFiRhSFIwY0hNNkx5OXdhMmt0 Y21FdWMzbHRZWFYwYUM1amIyMD0wDQYJKoZIhvcNAQELBQADggEBACzJVUuamWCrPkEFDBwdQDgg sdbr3iBndLtD8sfL5AOyDo279fIBAeCIg/2EfrohDMEwlG9dQTTS5ugwBJ6iuKn1OZ9sh+JpWrNm 698IhzmgDB74G0zALwJbAyKZddXkfRX0C+pKBRJ0VP0iM14mHP7sGy14jB+2t2kunwyydMoTLSNd SBTjAGawF0jsREePfoWxyG0hdznvVgvnERKAoueSdgK4PqqKcD5qLynXnOA9L0HPk0+pc+dgMNsm eQIc0U2wQWQf4yy1qS2Y9uZBxEy9SYSYmudYblRL7eXi0akaO4ST3MDgYimlgHTZljTWGf7KViAp ZlW5Gf2xwTNLEfUwggY8MIIFJKADAgECAhAHAqIahbhLZZ4YCm7m9aNlMA0GCSqGSIb3DQEBCwUA MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9y IGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDEgUHVibGljIFBy aW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xNTEwMDEwMDAwMDBaFw0yNTA5 MzAyMzU5NTlaMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24x HzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIg Q0EgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANb7DTFJIsAMuu9OLRe4tDDl NNKsCe7JiQBd9K4TEbMTjlXPIhioIAam/SXLaJS0oIKQDm6WkkTuFbm07PrPeT1p1Jwf3CCaDijV DbXGnjrx1GUZwIQzTY7aivHWJ7kDoNH6KJyCk2z3DYV9W+lOmWL+k0LS7j6zcVeGl0bL3w3hxoRa sw2P9fQQigVdn2hG7AiwWEKC9r4tEEamJAsn/pgUU4OTgtvqwD9PolhhtUtyaRJfM1n2+bNMAGTO hcWGkgxuHOsoz3GpkKl0mXQk60jhDl1oEqgBZujumrIv+D3Nt3gkzqVgfOgWPUnxB7ozvjIrwmej FsdvwNJalATCa0UCAwEAAaOCAj4wggI6MDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0 cDovL3BraS1vY3NwLnN5bWF1dGguY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwbAYDVR0gBGUwYzBh BgtghkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAo BggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTAvBgNVHR8EKDAmMCSgIqAg hh5odHRwOi8vcy5zeW1jYi5jb20vcGNhMS1nMy5jcmwwDgYDVR0PAQH/BAQDAgEGMCkGA1UdEQQi MCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0yLTIxNzAdBgNVHQ4EFgQUZxm2PaV5uzNg2C1T 04wJPQesGHAwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZl cmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEo YykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQD EzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBCwUAA4IBAQBGGeQndTu+r+LaohRg jx5EkIFpK2NJNY3pdrqfmI8TgdfL/GUb+A5j3pQodPvjb9jJKnoOVKaDrilK9itR/T04ErvdY0X7 ZMw+VIZ/TkJtI7cdC/36zA2OkzXK5UX5zy9/eT1jGMdHI0r2qRQArX5ZVRqJJ9uUoJE4xv5AlaNg 9l24yMUW7ZxmaRRGEErKcCpv0VDgJhrTUrRHcotF0r0DuaXc2QjzkKt0cKvKoE7wwE7k4L5PkBFg JwwrHN/nbMp1tCXnkUiqkrRRdV8pm0cXHL3J6s91rXUjz/LF31qrt2vKu7heq9WjcNRo8xd6mwug FDz76IFWaOjPXXxzuC68MYID5DCCA+ACAQEwgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRT eW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwG A1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIElu ZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1AhA9iT8kv8qkDDUoOz/65AkYMAkGBSsOAwIaBQCg ggH9MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE2MDgxNTE1MjQw MlowIwYJKoZIhvcNAQkEMRYEFONub49rkQxk86KyW+VN8MJLF8E5MIHMBgkrBgEEAYI3EAQxgb4w gbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UE CxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVk MTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1 AhA9iT8kv8qkDDUoOz/65AkYMIHOBgsqhkiG9w0BCRACCzGBvqCBuzCBpjELMAkGA1UEBhMCVVMx HTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBO ZXR3b3JrMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVj IENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzUCED2JPyS/yqQMNSg7P/rkCRgw DQYJKoZIhvcNAQEBBQAEggEA3JjqFgqBeeCdQZ4K6BNcQVZvlhoI2hbzrwoNMUizmFGgRniPJvL4 ytKGBW/nt3peMDu18tN0o/0LNeNAwbRDhtIQbj/VWoL4TFPMVXQnhUjhuDDhMSZtzHyrscGR15rA d62AuZpdOcJ73LbHBIZDBrvP0ZbSn8NeUFPoAc+r7HIShO7+sXAzhPw9upqsaQUAlhJ8vSb5/8Tq L8Avq8Ic+dXbHbVJViwrqK2518SDi8O0gqa5VaDAaFP1sppBnQLOKkzBh2PLGQYuj7sDUoagdNZc Gt3HT1Xd8GutdV0MeauE0ewP+anT3/F4RS0OQLlWPbGOWdkvO0Du6n4r372VjgAAAAAAAA== --Apple-Mail=_A821B79A-3339-42B7-A710-CFFC94BE7753-- From nobody Mon Aug 15 08:30:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3A8312D8D3 for ; Mon, 15 Aug 2016 08:30:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3MhPItQgowHe for ; Mon, 15 Aug 2016 08:30:30 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8BB912D69E for ; Mon, 15 Aug 2016 08:30:30 -0700 (PDT) Received: from pps.filterd (m0049459.ppops.net [127.0.0.1]) by m0049459.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7FFTKTi021766; Mon, 15 Aug 2016 11:30:26 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049459.ppops.net-00191d01. with ESMTP id 24uf55m109-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 11:30:25 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7FFUOfJ008037; Mon, 15 Aug 2016 11:30:25 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7FFUG2k007968 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 15 Aug 2016 11:30:20 -0400 Received: from MISOUT7MSGHUBAB.ITServices.sbc.com (MISOUT7MSGHUBAB.itservices.sbc.com [130.9.129.146]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Mon, 15 Aug 2016 15:29:56 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAB.ITServices.sbc.com ([130.9.129.146]) with mapi id 14.03.0301.000; Mon, 15 Aug 2016 11:29:55 -0400 From: "DOLLY, MARTIN C" To: David Frankel , "'Brian Rosen'" , "dcrocker@bbiw.net" Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMwgABOlICAAAXBgIAABVoA//++IUA= Date: Mon, 15 Aug 2016 15:29:55 +0000 Message-ID: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> In-Reply-To: <041401d1f709$09511490$1bf33db0$@zipdx.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.232.130] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: NUMBER PORTABILITY, public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-15_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608150170 Archived-At: Cc: "stir@ietf.org" , "'Gorman, Pierce A \[CTO\]'" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:30:33 -0000 David, It you want to understand how it is going to be deployed look at the ATIS P= TSC/NGIIF and ATIS - SIP Forum documents. Regards, Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of David Frankel Sent: Monday, August 15, 2016 11:24 AM To: 'Brian Rosen' ; dcrocker@bbiw.net Cc: stir@ietf.org; 'Gorman, Pierce A [CTO]' Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realitie= s Thanks for that clarification, Brian. You say you "don't think there is any= disagreement on how we're going to deploy stir" but part of my challenge (= and for others too, I think) is that many of us don't know the details of t= hat "how" because, while the documents don't LIMIT what's done, they also a= re necessarily incomplete (thanks to things like country-specific deploymen= t issues being out of scope). Let me ask for your help with this example; correct me if I am wrong on any= of the below: My telephone number is +1-212-555-1234 and my service provider is AT&T. Presumably there is some USA-specific mechanism that says that AT&T is the = authority for the certificate for my number (based, I would think, on the n= umber portability database and/or the LERG). When I place an outbound call under "normal" circumstances, AT&T will sign = that call for me and send it on its way. Anybody in the call path can see t= hat the call claims to be from +1-212-555-1234, do a number portability loo= k-up to see that it's an AT&T number, and then somehow know to go to AT&T's= certificate authority API to do what it takes to verify the signature? (Or= maybe there is a consolidated place where AT&T deposits that information, = along with other carriers, and providers along the call path can just go th= ere to check?) In any case, for this part of the example, anybody along the path, includin= g the termination point, can know that the call is legit. Now, I can engage a call center to make some outbound calls on my behalf. (= I know this use case has been raised many times.) The call center I have ch= osen uses Verizon as their outbound carrier. So I go to AT&T and ask them f= or the certificate for my number; they give that to me and I pass it to my = call center. So now they place calls, via Verizon, and either the call cent= er (probably) or Verizon (less likely) uses my certificate to authenticate = the outbound calls they make on my behalf, claiming (legitimately) to be from +1-212-555-1234. Again, anybody in the call path can authenticate the call, seeing that it i= s an authorized use of my AT&T number. When the call arrives at the terminating end, they see that the call is leg= it. And although it is an AT&T number, they have no clue that it was origin= ated on Verizon's network. Is that all close to correct? David Frankel ZipDXR LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: Monday, August 15, 2016 8:05 AM To: dcrocker@bbiw.net Cc: stir@ietf.org; Gorman, Pierce A [CTO] Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realitie= s I don't think there is any disagreement on how we're going to deploy stir, = nor is there any specification that limits or even influences it. We're going to start deployment at the service provider. We're going to ev= olve to deployment on the device. There are some participants who think de= ployment on the device is never going to happen, but they don't oppose it, = they are just skeptical it will happen. All the documents we have allow generation by any entity that has a certifi= cate valid for the TN the call is claiming to be from. Any entity on the p= ath can check, making an assumption that the header/body won't be stripped = (which could be a bad assumption, but there are no protocol police). If anyone thinks there is text in any of our documents that they believe do= esn't allow that, please specify where, and I'm sure we can fix it. The mechanism is designed to allow the origination network, or the originat= ion device, to generate a valid signature. It's designed to let any elemen= t on the path check the signature (and thus the certificate used to sign it= ) for validity. I have suggested that a useful way to deploy it is to have interconnection = agreements between service providers modified to require a certain percenta= ge of validly signed calls by a certain date, ratcheting up the percentage = over time. If that included checking at transit network interconnects, eve= n if the path downstream of that network had SS7 links, we would gain most = of the benefit of stir.=20 Please note that while we do want to get the call treatment modified depend= ing on the outcome of verification of the signature, the greatest value com= es from the ability of the authorities to track the source of calls back to= the originator. By requiring calls to have valid signatures at network in= terconnections, we provide a tracking mechanism back to the origination net= work, and that will really help quite a bit. It's my opinion that if a lar= ge number of "bad" calls come from networks that permit call origination fr= om essentially anonymous customers, that the authorities will take steps to= rein in such networks, but that's just an opinion. Brian > On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: >=20 > On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >> My personal view agrees with yours that there seems to be an=20 >> expectation that STIR will operate on endpoints in an end-to-end=20 >> fashion when in fact, to have any hope of nearer term deployment of=20 >> anything hopefully approaching critical mass (and even then there are=20 >> very big challenges), the carriers will be required to do the key=20 >> management, the signing, and the interpretation of signatures. >=20 > There is a difference between an architecture that /requires/=20 > operation within the infrastructure, versus one that permits the choice of operation = at the end-points and/or within the infrastructure. >=20 > For example, the current discussions I've heard about the operational=20 > of the key query/validation mechanism for STIR is that it will operate within = the inter-provider infrastructure, with no direct access allowed for end-sy= stems (that are not controlled by a participating provider.) That's a major= architectural choice and precludes the long-term option of direct particip= ation by those independent user agents. Instead it requires them to be sla= ved to their provider. >=20 > By contrast, DKIM allows signing and/or verifying by any entity in the sequence, even though actual operation is (currently) entirely within the M= TA infrastructure. >=20 >=20 >> What is signed and how it is interpreted are critical pieces of=20 >> information and need to be kept extremely simple or, IMHO, this will=20 >> be as big mess as you've tried to warn. And of course these critical=20 >> pieces will not be provided here. >=20 > Specification of the core information to be signed is something that profoundly affects the security properties of the service. That's a techni= cal point. To the extent the specification defers this choice, it needs to= make very clear statements about the choices and the effects of those choi= ces. >=20 >=20 >> As far as "out-of-scope dependencies" I'll suggest that how keys are=20 >> managed, what is signed, and how the signatures should be interpreted=20 >> are the big 3 that occur to me. >=20 > You believe there should be no standardized technical specification=20 > for the key management infrastructure? This is the highest-risk component of t= he service and it needs to be interoperable at a global scale. How else wi= ll that interoperability be achieved? >=20 > Also, what do you mean "how the signatures should be interpreted"? >=20 > If you mean the direct semantics of a signature, such as meaning that=20 > the request is valid vs. the request was processed by the signer, I'll strongly= urge you to reconsider, since that's an essential technical point and need= s to be standardized. Failure to have the semantic of the signature -- it'= s 'meaning' -- be clear in the technical specification has demonstrably cau= sed serious operational problems. >=20 > If you mean "how the results of a validation are used by the verifying entity", then yes indeed, that's an entirely separate area of work. >=20 >=20 >=20 > d/ >=20 >=20 > -- >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 15 08:49:48 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93B7012D8C3 for ; Mon, 15 Aug 2016 08:49:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fUdMV6Xrg-Wl for ; Mon, 15 Aug 2016 08:49:44 -0700 (PDT) Received: from mail-qt0-x22d.google.com (mail-qt0-x22d.google.com [IPv6:2607:f8b0:400d:c0d::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6054412D8BE for ; Mon, 15 Aug 2016 08:49:44 -0700 (PDT) Received: by mail-qt0-x22d.google.com with SMTP id x25so22781699qtx.2 for ; Mon, 15 Aug 2016 08:49:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=FH1pBz+37nzTabhvZl+qhlOnPtCUw/VoNRO1Wp+BvJM=; b=PqpMDqvev5pK87b2ts6EUS+Gb4HhPd8qCw4tm9XeMnSAVy2g8zP03e0d5RhL4hcFso CFdFJzexBb2G13g7kSGjZ55y7nHqjETgRaWz6BjDSe4iHdP1NNmPeNvHgPs5oFIPIESb ANwy0YHC14WElroS/Ulvv+6g8glk/MUYj+xPiqXB/iPlRddwzXY0KNTYyDI9lOuEDGdh pNbCbIWEpGK4VhIiOCriq6R4o4hhoaiHsJMrfugqI0kWKOkT+YtHx4MO41XWlmucRJsO 748YZfHnHEP+Z+mc4UHjKsepufRCrZIpwfxu09Yzx3h2KgsxdShHLripXSgV/grUyZZG SKIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=FH1pBz+37nzTabhvZl+qhlOnPtCUw/VoNRO1Wp+BvJM=; b=V7TIABQKp2BC6FB0v2eVsFIgQCaE8AQOtYQ+SqZEc1Zf4M4ioMmtSpdQ3qh6gTL+Ir uby7rvmZIof78b7UGMYGO/jINFehC8Myc+/i09hsentFhAxofel16iSFBJsB9bak1SJo y85NKlHS5FIQsuXWauLGVJEX7hah4MYi2NOZTRiVT8EWUM7UYlv2D9JwyHZFD7yFTlvh b3sHW4Iazi3AAv3GPifW1ZXPXk417vA+3dJ0t1kHBzUttdj9gP0AO1jFb68GV3V0avNk Myfg87oWyACikrLXdozsOvh9F2Aho6GJgZywOTRbXssqAYHFrF00PEqbhJM/4bc8mMek dxxA== X-Gm-Message-State: AEkoouvjaM37TA2m2Ir5zhLu2SY7Ia4ICvn0K3Q/sGEzaH3I3EwoG32w/JIxfO7uvQSBxg== X-Received: by 10.237.35.76 with SMTP id i12mr33020781qtc.41.1471276183394; Mon, 15 Aug 2016 08:49:43 -0700 (PDT) Received: from [10.33.192.45] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id k20sm11435958qkl.2.2016.08.15.08.49.42 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Aug 2016 08:49:42 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <041401d1f709$09511490$1bf33db0$@zipdx.com> Date: Mon, 15 Aug 2016 11:49:35 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> To: David Frankel X-Mailer: Apple Mail (2.3124) Archived-At: Cc: stir@ietf.org, "Gorman, Pierce A \[CTO\]" , dcrocker@bbiw.net Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:49:47 -0000 > On Aug 15, 2016, at 11:23 AM, David Frankel = wrote: >=20 > Thanks for that clarification, Brian. You say you "don't think there = is any > disagreement on how we're going to deploy stir" but part of my = challenge > (and for others too, I think) is that many of us don't know the = details of > that "how" because, while the documents don't LIMIT what's done, they = also > are necessarily incomplete (thanks to things like country-specific > deployment issues being out of scope). >=20 > Let me ask for your help with this example; correct me if I am wrong = on any > of the below: >=20 > My telephone number is +1-212-555-1234 and my service provider is = AT&T. > Presumably there is some USA-specific mechanism that says that AT&T is = the > authority for the certificate for my number (based, I would think, on = the > number portability database and/or the LERG). This really is country specific, but stir is based on the notion that in = every country, there is a delegation process for telephone numbers, and = whether that is entirely controlled by the regulator, or has some = informal mechanisms as well, delegation happens in a way that we can = exploit, by issuing or modifying a credential when that delegation = happens. So, if AT&T was delegated a block of numbers from the regulator, and = delegated that number to you, then it would have a credential for your = number, and, hopefully, at least at some point, so will you. >=20 > When I place an outbound call under "normal" circumstances, AT&T will = sign > that call for me and send it on its way. Anybody in the call path can = see > that the call claims to be from +1-212-555-1234, do a number = portability > look-up to see that it's an AT&T number, and then somehow know to go = to > AT&T's certificate authority API to do what it takes to verify the > signature? (Or maybe there is a consolidated place where AT&T deposits = that > information, along with other carriers, and providers along the call = path > can just go there to check?) Again, part of this is country specific because of the ways delegation = is done, but the idea is that you can determine from the credential used = to sign the call whether that certificate is good for that number. You = can query the signer of the cert, and it can tell you if that cert is = valid for that number. And of course since it is a PKI, you can do the = same with the signer of the CA=E2=80=99s cert, and track back to the = root CA for the country the number is part of. >=20 > In any case, for this part of the example, anybody along the path, = including > the termination point, can know that the call is legit. Yes, as long as by =E2=80=9Clegit=E2=80=9D you mean that the signaling = contains a signature using a credential valid for the TN the call claims = to be from. >=20 > Now, I can engage a call center to make some outbound calls on my = behalf. (I > know this use case has been raised many times.) The call center I have > chosen uses Verizon as their outbound carrier. So I go to AT&T and ask = them > for the certificate for my number; they give that to me and I pass it = to my > call center. So now they place calls, via Verizon, and either the call > center (probably) or Verizon (less likely) uses my certificate to > authenticate the outbound calls they make on my behalf, claiming > (legitimately) to be from +1-212-555-1234. If we get to where we want to get to, you ask AT&T for a cert valid for = the number they delegated to you, and then you sign a cert for the call = center using your cert, or maybe you ask the CA that issued your cert to = do that. As a practical matter, you ask AT&T to issue (or cause to be issued) a = credential to the call center that they use to send calls on the Verizon = network. >=20 > Again, anybody in the call path can authenticate the call, seeing that = it is > an authorized use of my AT&T number. Yes >=20 > When the call arrives at the terminating end, they see that the call = is > legit. And although it is an AT&T number, they have no clue that it = was > originated on Verizon's network. Yes, assuming that the call center signed the call, rather than Verizon = on behalf of the call center. I think that most networks probably = won=E2=80=99t want to sign for the call center, but they probably will = accept, possibly check, and forward the Identity header and body from = the call center. >=20 > Is that all close to correct? Uh huh >=20 > David Frankel > ZipDXR LLC > Monte Sereno, CA USA > Tel: 1-800-FRANKEL (1-800-372-6535) > Watch Our Video! >=20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen > Sent: Monday, August 15, 2016 8:05 AM > To: dcrocker@bbiw.net > Cc: stir@ietf.org; Gorman, Pierce A [CTO] > Subject: Re: [stir] Setting Expectations regarding STIR Deployment = Realities >=20 > I don't think there is any disagreement on how we're going to deploy = stir, > nor is there any specification that limits or even influences it. >=20 > We're going to start deployment at the service provider. We're going = to > evolve to deployment on the device. There are some participants who = think > deployment on the device is never going to happen, but they don't = oppose it, > they are just skeptical it will happen. >=20 > All the documents we have allow generation by any entity that has a > certificate valid for the TN the call is claiming to be from. Any = entity on > the path can check, making an assumption that the header/body won't be > stripped (which could be a bad assumption, but there are no protocol > police). >=20 > If anyone thinks there is text in any of our documents that they = believe > doesn't allow that, please specify where, and I'm sure we can fix it. >=20 > The mechanism is designed to allow the origination network, or the > origination device, to generate a valid signature. It's designed to = let any > element on the path check the signature (and thus the certificate used = to > sign it) for validity. >=20 > I have suggested that a useful way to deploy it is to have = interconnection > agreements between service providers modified to require a certain > percentage of validly signed calls by a certain date, ratcheting up = the > percentage over time. If that included checking at transit network > interconnects, even if the path downstream of that network had SS7 = links, we > would gain most of the benefit of stir.=20 >=20 > Please note that while we do want to get the call treatment modified > depending on the outcome of verification of the signature, the = greatest > value comes from the ability of the authorities to track the source of = calls > back to the originator. By requiring calls to have valid signatures = at > network interconnections, we provide a tracking mechanism back to the > origination network, and that will really help quite a bit. It's my = opinion > that if a large number of "bad" calls come from networks that permit = call > origination from essentially anonymous customers, that the authorities = will > take steps to rein in such networks, but that's just an opinion. >=20 > Brian >=20 >> On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: >>=20 >> On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >>> My personal view agrees with yours that there seems to be an=20 >>> expectation that STIR will operate on endpoints in an end-to-end=20 >>> fashion when in fact, to have any hope of nearer term deployment of=20= >>> anything hopefully approaching critical mass (and even then there = are=20 >>> very big challenges), the carriers will be required to do the key=20 >>> management, the signing, and the interpretation of signatures. >>=20 >> There is a difference between an architecture that /requires/ = operation > within the infrastructure, versus one that permits the choice of = operation > at the end-points and/or within the infrastructure. >>=20 >> For example, the current discussions I've heard about the operational = of > the key query/validation mechanism for STIR is that it will operate = within > the inter-provider infrastructure, with no direct access allowed for > end-systems (that are not controlled by a participating provider.) = That's a > major architectural choice and precludes the long-term option of = direct > participation by those independent user agents. Instead it requires = them to > be slaved to their provider. >>=20 >> By contrast, DKIM allows signing and/or verifying by any entity in = the > sequence, even though actual operation is (currently) entirely within = the > MTA infrastructure. >>=20 >>=20 >>> What is signed and how it is interpreted are critical pieces of=20 >>> information and need to be kept extremely simple or, IMHO, this will=20= >>> be as big mess as you've tried to warn. And of course these = critical=20 >>> pieces will not be provided here. >>=20 >> Specification of the core information to be signed is something that > profoundly affects the security properties of the service. That's a > technical point. To the extent the specification defers this choice, = it > needs to make very clear statements about the choices and the effects = of > those choices. >>=20 >>=20 >>> As far as "out-of-scope dependencies" I'll suggest that how keys are=20= >>> managed, what is signed, and how the signatures should be = interpreted=20 >>> are the big 3 that occur to me. >>=20 >> You believe there should be no standardized technical specification = for > the key management infrastructure? This is the highest-risk component = of > the service and it needs to be interoperable at a global scale. How = else > will that interoperability be achieved? >>=20 >> Also, what do you mean "how the signatures should be interpreted"? >>=20 >> If you mean the direct semantics of a signature, such as meaning that = the > request is valid vs. the request was processed by the signer, I'll = strongly > urge you to reconsider, since that's an essential technical point and = needs > to be standardized. Failure to have the semantic of the signature -- = it's > 'meaning' -- be clear in the technical specification has demonstrably = caused > serious operational problems. >>=20 >> If you mean "how the results of a validation are used by the = verifying > entity", then yes indeed, that's an entirely separate area of work. >>=20 >>=20 >>=20 >> d/ >>=20 >>=20 >> -- >>=20 >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir >=20 From nobody Mon Aug 15 08:51:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CDF912D8FE for ; Mon, 15 Aug 2016 08:51:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AdU_Op-a8N2g for ; Mon, 15 Aug 2016 08:51:01 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id 9C52C12D8F3 for ; Mon, 15 Aug 2016 08:51:01 -0700 (PDT) Received: (qmail 5125 invoked by uid 0); 15 Aug 2016 15:50:58 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy4.mail.unifiedlayer.com with SMTP; 15 Aug 2016 15:50:58 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id XTls1t01V1MNPNq01Tlvuy; Mon, 15 Aug 2016 09:45:56 -0600 X-Authority-Analysis: v=2.1 cv=KaJB72oD c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=izV7ms69AAAA:8 a=9fpc_yjdAAAA:8 a=rLyo6Eephth-2sPMevoA:9 a=qc_BaKGnh63oy2Ut:21 a=SRK5l2hPwOcs7_6_:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=4fCw6yO-TCUsj2M7CMQA:9 a=J0qmjnLUU_jQc1jM:21 a=aHOF3F-FB5sMzG-6:21 a=5q7pXUKQjXQQ2JAv:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=jg1oa_xp17rrhcbVgaY4:22 a=pIvAo3swFcmB_yUFupqo:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:To: From:Subject:Date; bh=3iiRiHJBHLJvKNyJf5Ue+qRegcOXlon3zGfmm2/4uik=; b=OG1Ufuq WgGoj2ZlbPq/3zAoHfeE4fMzUAVww8hgAVvQdgwhxwY5LY7dlGMnfO1S4f5ltgC4ZS73/DdweRJ+b /cpFF5CrExsjTWmPQYX4eEmKnIueamDYSEFv6Lwsw2Sq; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:52941 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bZK5K-0007ac-CA; Mon, 15 Aug 2016 09:45:54 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Mon, 15 Aug 2016 11:45:52 -0400 From: Richard Shockey To: "Gorman, Pierce A [CTO]" , David Frankel , "stir@ietf.org" Message-ID: <7D89A621-A3DB-4729-BF29-D674E771D4AB@shockey.us> Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3554106354_1610508620" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bZK5K-0007ac-CA X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:52941 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 15:51:07 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3554106354_1610508620 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 Let me add a few points in line here and BTW David thanks for your thoughtf= ul and informed insights.=C2=A0 Good to hear from you.=20 =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 =20 =20 From: stir on behalf of "Pierce.Gorman@sprint.com" = Date: Monday, August 15, 2016 at 10:21 AM To: David Frankel , "stir@ietf.org" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realitie= s =20 Your suggestion to =E2=80=9Cenumerate the out-of-scope dependencies=E2=80=9D is a good = request. =20 I hope the authors will make some attempt, as well as an example or two. (= Ironically the word =E2=80=9Cexample=E2=80=9D appears 54 times but not in relation to an= actual example.) =20 RS>=C2=A0 Where have I heard that broken record before.=C2=A0=20 =20 My personal view agrees with yours that there seems to be an expectation th= at STIR will operate on endpoints in an end-to-end fashion when in fact, to = have any hope of nearer term deployment of anything hopefully approaching cr= itical mass (and even then there are very big challenges), the carriers will= be required to do the key management, the signing, and the interpretation o= f signatures. =20 =20 RS> Agreed. Certainly some people think the STIR mechanism will operate in = an end to end fashion, and it may well in the distant future but that repres= ented a level of complexity and cost that no one wants to impose on the indu= stry at this time.=C2=A0 As you well know the industry has a legitimate allergy = to large numbering databases. Not to mention we=E2=80=99ve seen a variety of issue= s with WEB PKI deployments that simply cannot be permitted under the circums= tances.=C2=A0 Phone numbers are not domain names. =C2=A0We are dealing with a first = order level of deployments, that as you point out, in large measure will req= uire carriers to do the key management signing etc.=C2=A0 That is the world as i= t is now, not as some wish it were. =C2=A0The important thing now is for the aut= hors to clarify what the construct looks like on the wire and avoid any disc= ussion of Layer 8-10 issues that are outside the scope of the charter. =C2=A0The= current documents represent the appropriate level of tools necessary to des= ign an appropriate implementable system.=20 =20 =20 =20 What is signed and how it is interpreted are critical pieces of information= and need to be kept extremely simple or, IMHO, this will be as big mess as = you=E2=80=99ve tried to warn. And of course these critical pieces will not be pro= vided here. =20 As far as =E2=80=9Cout-of-scope dependencies=E2=80=9D I=E2=80=99ll suggest that how keys are = managed, what is signed, and how the signatures should be interpreted are th= e big 3 that occur to me. =20 I am hopeful that the SHAKEN Framework being crafted in the ATIS/SIP Forum = IP NNI Joint Task Force will be able to accomplish the =E2=80=9Cwhat=E2=80=9D is signed = and how key management (for North American carrier implementations) should o= perate. I suspect carrier key management may be a subject of regulation but= don=E2=80=99t know for sure. =20 =20 RS> That is our joint desire and the NNI TF will be meeting this month to r= eview ongoing requirements and deliverables, especially in light of the conc= lave on the 19 at Commission HQ.=20 =20 =20 I am also hopeful that 3GPP will define =E2=80=9Chow=E2=80=9D the SHAKEN signature is t= o be interpreted, especially for corner-case requirements such as E911 when = roaming on a carrier with whom the subscriber=E2=80=99s carrier does not have a ro= aming relationship, and manual roaming. =20 RS> Agreed and preliminary outreach has gone out to the relevant 3GPP commi= ttees.=20 =20 =20 Outside of carrier implementation, I have very little idea what endpoint de= velopers will want to do, but am willing to let the market figure that out f= or itself. =20 Pierce =20 =20 From: David Frankel [mailto:dfrankel@zipdx.com]=20 Sent: August 14, 2016 8:43 PM To: stir@ietf.org Subject: [stir] Setting Expectations regarding STIR Deployment Realities =20 I am writing this note to share a perspective on several aspects of STIR an= d its related specifications. I was prompted to do this by the numerous note= s from Dave Crocker and the discussions that have ensued. =20 My comments here are not specifically directed to Dave=E2=80=99s issues. Rather, = I noted that Dave was asking the group to live up to a level of rigor that, = I think, was higher than where we=E2=80=99ve been operating. And I wanted to highl= ight some other areas that haven=E2=80=99t been fully addressed and probably hold = future pitfalls for this effort. Being rigorous and explicit about these iss= ues might help us reach the end goals more quickly and pragmatically than ig= noring them. =20 There seems to be a lot of confusion, at least outside the group, about how= STIR will be deployed and what the effect will be. I discuss below three of= the most significant areas where I observe this: I) Specifications vs. Network Realities II) The (massive) nuances of Caller-Name vs. Caller-ID III) Expectations regarding Robocalls =20 I=E2=80=99m not an =E2=80=9Cexpert=E2=80=9D on all things telecom, but I do have several deca= des of experience with legacy and current telephony, mostly in the United St= ates. I=E2=80=99m hopeful that my comments are useful, at least to some. If they a= re out of place for this list, I=E2=80=99m sure people will let me know, and I=E2=80=99l= l ask you to forgive me and just ignore and/or delete this note if it isn=E2=80=99= t helpful. =20 I=E2=80=99m sure at least some of you will read this and say, =E2=80=9CYeah, we knew al= l that already.=E2=80=9D And maybe it=E2=80=99s all been sufficiently considered and doe= sn=E2=80=99t need additional attention. I=E2=80=99ll share anyway. =20 I) Specifications vs. Network Realities: When writing =E2=80=9Cspecifications=E2=80=9D = for the handling of telephone calls, a couple of important realities come to= mind. One is that there are numerous =E2=80=9Cauthorities=E2=80=9D for how telephone ne= tworks (as we know, it isn=E2=80=99t just one network; it=E2=80=99s a network of network= s) =E2=80=9Cmust=E2=80=9D or =E2=80=9Cshould=E2=80=9D work. A second is that even if you could gathe= r those various specs and directives and regulations, you would find that th= e actual implementation is full of deviations =E2=80=93 some large and some small;= some on purpose and some accidental; some rare and some commonplace. =20 In the beginning (depending on where you define the starting line), there w= ere specs from the Bell System, published in modern times by Bellcore which = became Telcordia. (Again, you=E2=80=99ll see that I am mostly USA-centric, so you = can assume that=E2=80=99s what I=E2=80=99m talking about unless I mention otherwise.) Wh= en (the old) AT&T was the dominant carrier, most operators around the edges = used these specs at least as their starting point for implementing and runni= ng their networks; equipment manufacturers conformed in order to place their= gear with those operators. =20 But even back then, as the networks were digitized and computerized (SS7, I= SDN, SONET, ATM, SCPs, STPs, TCAP, PABXs, Feature Group D, etc.), manufactur= ers and operators purposefully deviated from the specs. Sometimes this was t= o differentiate a product or a service to gain a market advantage; sometimes= it was to overcome a technical hurdle; sometimes it was to address a physic= al, political, economic or legal circumstance not anticipated by the specs. =20 Regulators (not just the FCC, but even individual states) imposed rules tha= t imposed limitations or deviations to the specs. Other organizations (e.g.,= ATIS) also published specifications. Any given operator=E2=80=99s specific implem= entation ended up being guided by materials from several =E2=80=9Cstandards=E2=80=9D bod= ies, plus regulators and equipment suppliers, and ultimately even (big) cust= omers. Ultimately, they implemented what they felt like implementing. =20 Applying internet technology to the transport and delivery of telephone cal= ls showed obvious promise and SIP went to the tip of everybody=E2=80=99s tongue. B= ut again, while we had RFCs suggesting how this =E2=80=9Cshould=E2=80=9D (or =E2=80=9Cmust=E2=80=9D)= work, in fact those RFCs are in practice only a =E2=80=9Cguide=E2=80=9D to the implemen= ters.=20 =20 Here are a few examples that are relevant, in varying degrees, to STIR: =20 RE-ORIGINATION: In theory, an end-to-end SIP call would be passed from orig= inator to destination relatively unchanged; each network hop would add a VIA= header showing the path the call took. But in fact, for the billions of cal= ls moving through the PSTN, this isn=E2=80=99t how it works. Unless the call start= s and ends on the same network, it will necessarily be passed between networ= ks, often using one or more intermediary networks to get from start to finis= h. Each of those networks has specific economic interest in the call (they a= re going to get paid for it, or pay somebody for it, or both).=20 =20 Each network re-originates the call, making its own decisions about what he= aders to include (or not). The source of the call (upstream network) is purp= osefully obfuscated, because for competitive reasons, operators do not want = their neighbors to know who is feeding them calls. The engineers on this lis= t would of course prefer that not be done, but we don=E2=80=99t get to make that r= ule. Even if we could convince SOME operators to do it our way, monetary int= erests will overrule in many other cases. (There=E2=80=99s a further discussion ab= out how the DIVERSION header should be used for re-originated calls, but we=E2= =80=99ll save that for another day.) =20 INTERWORKING: Only a tiny fraction of calls today are end-to-end SIP. Most = involve some interworking with SS7 or at least ISUP. And while there are RFC= s that specify how that interworking =E2=80=9CSHOULD=E2=80=9D or =E2=80=9CMUST=E2=80=9D be done, in = fact the gateway vendors and the network operators do it the way they want t= o do it. Some honor and use P-CHARGE-INFO; others do not. Some deliver X-CHA= RGE-NUM to the destination user; others do not. ISUP-OLI is sometimes passed= in the FROM header; sometimes not. To be fully interoperable, systems that = can benefit when these fields are available must be designed so they fail so= ft/safe when not available. While I realize STIR is intended only for the en= d-to-end SIP environment and thus avoids this level of interworking, there m= ay be lessons that can be learned from how things do (or do not) actually fu= nction in the legacy world. And note how variable the performance is across = operators. =20 CALLER-ID SCREENING: Even at the dawn of legacy caller-ID, there was the no= tion of whether that number was =E2=80=9Cauthenticated=E2=80=9D or not. The ISUP Calling= Party Number information element includes a =E2=80=9Cscreening=E2=80=9D indicator with = several possible values: =E2=80=9Cnetwork provided=E2=80=9D means that the operator (pre= sumably a =E2=80=9Ctrusted=E2=80=9D entity, whatever that meant then or now) determined = what number to send based on subscriber account information; =E2=80=9Cuser provide= d, network screened=E2=80=9D means that the end-user customer (probably the owner = of a PABX) provided the number, but the (trusted) operator made sure, someho= w, that the number was =E2=80=9Cowned=E2=80=9D by the end-user; and =E2=80=9Cuser provided, no= t screened=E2=80=9D meaning that we=E2=80=99re just passing along whatever we got from t= he customer and don=E2=80=99t know its validity. In theory, the screening indicat= or, which would be delivered to the call recipient, could be used just as we= are discussing today in STIR to influence call handling at the receiving en= d. =20 But guess what: despite being in the spec, and even implemented in lots of = equipment, the =E2=80=9Cscreening=E2=80=9D indicator gets little use. For almost all cal= ls, the calling party number is =E2=80=9Cuser provided, not screened=E2=80=9D. Presumabl= y it got too cumbersome to maintain the screening lists. Operators, interest= ed in bringing on new customers, just turned off screening to expedite the o= nboarding process. =20 NATIONAL CONSIDERATIONS: Richard Shockey in particular has been good about = highlighting where the RFCs must stop and defer to national regulatory autho= rity (or local practice). But that means that to actually implement anything= , you have to not only follow the RFC, but you also have to understand the n= ational considerations particular to your circumstance. And it=E2=80=99s difficult= to evaluate the practicality of a proposed RFC without also understanding h= ow it would be deployed in the specific nationalities where you want to oper= ate. In USA, we have the number portability database, the local exchange rou= ting guide, the toll-free (SMS/800) database, and others. In fact, even an e= nd-to-end internetwork SIP call can=E2=80=99t complete without consulting the (leg= acy) number portability database. In parallel with the STIR RFCs, should som= ebody (ATIS?) be writing a STIR implementation spec for USA/North America? =20 Reviewing 4474bis, there are numerous references to =E2=80=9Coutside the scope=E2=80=9D= and =E2=80=9Cdeferred for future work=E2=80=9D. This is no doubt all for good reason, b= ut you can=E2=80=99t actually deploy anything until some of those items are addres= sed. =20 Summary? They say you can lead a horse to water but you can=E2=80=99t make him dr= ink. And you can write specs all day long and mandate this or that, but at t= he end of the day, the implementers are going to decide how it really works,= and forces stronger than our specs are likely going to be at work here. The= ideal spec is written with enough knowledge and enough appreciation of the = technical and economic realities where it will be deployed that implementers= CHOOSE to fully adopt it. The spec adds value if adopting it is less painfu= l than some other alternative. To flourish, the spec must, of course, be tec= hnically correct and, when followed, deliver on its stated objective(s). It = should be well-enough thought through and sufficiently constrained that conf= orming to the spec is more efficient (in terms of both development and opera= tion) than other approaches. Clearly in our environment INTEROPERATION is ke= y =E2=80=93 a huge advantage to following a spec should be that you are assured of= interoperability with others that follow the spec. And the spec should TEAC= H. I think Dave Crocker has been trying to address all of these things. But = even if we succeed on all that, remember that in the telecom environment, th= e spec must survive in an ecosystem where other forces are hard at work. =20 II) Caller-ID Number and Caller-Name: A short time after caller-ID was intr= oduced decades ago, we got Caller Name (CNAM). This functioned then not by s= ending the name along with the number from the origination point. Instead, w= e rely only on the number being sent to the destination. Then, a database lo= okup is performed (=E2=80=9CCNAM dip=E2=80=9D) and the name associated with the number i= s displayed to the end-user. =20 In the beginning, a carrier could only provide name information if the call= both originated and terminated on its own network; the carriers that owned = phone numbers maintained their own CNAM databases. Then they decided to give= each other access to their database, but demanded compensation from the ter= minating carrier for each dip. (Tiny carriers used aggregators to maintain t= heir databases and handle collection and disbursement of dip charges.) Over = time, the CNAM databases have evolved. There are a few large operators still= mostly conforming to the original notion. But other databases are available= that use hybrid information (some entries from public records, others licen= sed or stolen from the official sources). And of course what=E2=80=99s most popula= r on mobile phones: using the end-user=E2=80=99s own contact list (stored in the p= hone) as the database.=20 =20 Most mobile operators do not, by default, deliver a call-by-call CNAM to th= e subscriber device over the air. A few offer to do a database lookup and de= liver the result, usually for an extra monthly fee (since they incur a cost = for doing the dips). As usual, economics drives the reality here. =20 Most consumers care more about the name than the number; some telephone dis= plays show only the name if it is available; the number is shown only if the= name is not known. There are some more modern proposals for how the name in= formation might be sourced (and even authenticated; see draft-peterson-stir-= cnam-00) but I haven=E2=80=99t seen substantive discussion of that here (and 12.6 = of 4474bis mostly says it is out of scope). Private SIP-to-SIP calls of cour= se use the display name in the FROM header. For Public Network calls, either= an =E2=80=9Cauthenticated name=E2=80=9D could be displayed, or for an authenticated num= ber, a dip into one of the various databases will be done to fetch a name. B= ut how any validity is assigned to that name is an exercise for the reader (= or left for a future version of the spec). Today, many service providers let= customers specify any name they want for the database entries associated wi= th their numbers. That name can often be set via a web portal or an API and = can be =E2=80=9CAlex Hamilton=E2=80=9D or =E2=80=9CBill Clinton=E2=80=9D or =E2=80=9CFBI=E2=80=9D or =E2=80=9CBank of = America=E2=80=9D even if the owner of the number is =E2=80=9CJoe Fraudster=E2=80=9D. =20 My point here is that we can kick the CNAM problem down the road, but it re= ally is what most end-users care the most about. STIR as is may be a critica= l stepping stone to getting there, but we should set expectations regarding = what the (intermediate) result is going to be. =20 III) Expectations Regarding Robocalls =E2=80=93 Speaking of setting expectations,= there are high expectations that STIR will go a long way to dealing with th= e massive robocall problem. Last month, FCC Chairman Wheeler said: =E2=80=9C=E2=80=9CI a= m also calling on the carriers and standards groups to accelerate the develo= pment and deployment of technical standards that would prevent spoofing of c= aller ID and thus make blocking technologies more effective, as was done in = the battle against spam years ago.=E2=80=9D If he believes that STIR as proposed i= s going to make any measurable dent, within the next five years, in mitigati= ng the level of actual fraud facilitated by illegal robocalls, he is sadly m= istaken. =20 I think it=E2=80=99s acknowledged that STIR only applies to end-to-end SIP calls,= and then only when all intermediate carriers propagate the necessary header= s. Those calls are likely to be a tiny fraction of all calls for the next se= veral years. One theory says that the illegal robocallers will be the last o= nes to authenticate their calls (because they are, in fact, not authentic). = So the theory is that we=E2=80=99ll authenticate all OTHER (legitimate) calls, and= then the illegal robocalls will stand out as the ones that aren=E2=80=99t authent= icated. =20 But that=E2=80=99s preposterous. In the US, there are hundreds of millions of end= points that can originate calls; even if we managed to get 90% of them using= STIR, there would still be tens of millions of (legitimate) endpoints origi= nating unauthenticated calls. Now, the actual count of endpoints isn=E2=80=99t so = critical; more important is the volume of calls originated from authenticate= d endpoints versus non-authenticated. Lots of business-to-consumer calls are= originated from PABXs and other systems connected via legacy PRI or even le= gacy analog lines and trunks. It seems unlikely that consumers will want to = put all those (unauthenticated) calls through some CAPTCHA or similar system= . It isn=E2=80=99t clear to me what the game plan is for dealing with what will st= ill be the large fraction of calls that that will remain unauthenticated for= some time. (How the endpoint handles such calls are outside the scope of th= e spec, so how Wheeler knows that it is the savior to robocalls is beyond me= .) =20 Alternatively, there will probably be some illegal robocallers, and their e= nablers, that will jump on the STIR bandwagon if it comes to pass. There wil= l be service providers that will solicit customers to sign up over the web, = relatively anonymously, to get =E2=80=9Cauthenticated=E2=80=9D phone numbers (perhaps th= ousands or maybe even a million of them). They=E2=80=99ll be able to set their CNA= M to whatever they want. They=E2=80=99ll place hundreds of millions of authenticat= ed calls and then move on. The good news is that STIR will let us know who t= he service providers are that are making the authenticated credentials avail= able to these robocallers, but it isn=E2=80=99t clear what the next steps are. I=E2=80= =99ve seen mention of (again, out of scope) potential =E2=80=9Creputation=E2=80=9D metrics= for providers. But it isn=E2=80=99t clear how a call recipient would determine th= e reputation of the provider, or what they would do when an authenticated ca= ll was received from somebody using credentials issued by a less-than-fully-= reputable provider. =20 And all of that assumes a level of sophistication on the part of the call r= ecipient to actually deploy some feature or filter that acts on the authenti= cation (and reputation?) information. Robocallers almost by definition do no= t prey on the sophisticated; they prey on the elderly and disadvantaged and = desperate, who typically don=E2=80=99t have the latest smartphone or the coolest V= oIP service. (Yes, robocalls annoy all of us, but I promise you that nobody = on this mailing list is their target.) =20 We should certainly learn everything we can from the email spam battle, but= the analogy isn=E2=80=99t 100% applicable by any means. Email has the SIGNIFICANT= advantage that filters have access not just to the headers (which include, = importantly, a SUBJECT line), but also to the ENTIRE CONTENT of the message.= (This is also true for SMS.) With voice calls, we have far less information= available, and certainly no clue as to what the content will be. =E2=80=9CDoing f= or voice calls what we did for email=E2=80=9D is a technical fantasy. =20 So members of this list are being disingenuous if they are telling Mr. Whee= ler and others to expect a dramatic near-term drop in robocall complaints on= ce STIR (as currently envisioned) is deployed. =20 CONCLUSION? I=E2=80=99m not for (or against) major revisions to the document. But= I do think that expectations need to be properly set. 4474bis 12.2 says in = part: =E2=80=9C=E2=80=A6preventing the simple unauthorized claiming of an identity for t= he purposes of robocalling, voicemail hacking, or swatting, which is the pri= mary scope of the current document.=E2=80=9D The document lays some groundwork tha= t will be useful, in part, in ultimately limiting robocalling, but nobody ha= s connected all the dots for me on how it will actually, pragmatically be de= ployed to achieve that objective (same for swatting). Some of you, no doubt,= will tell me THAT is beyond the scope of the document(s). If nothing else, = the document could enumerate the out-of-scope dependencies upon which we are= dependent before realizing any actual utility (or deployability) of the spe= c. And even then, the utility to the end-user is going to be severely limite= d until deployment reaches some critical mass and additional fundamental lim= itations are addressed. =20 David Frankel ZipDX=C2=AE LLC Monte Sereno, CA USA =20 This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not t= he intended recipient, please contact the sender and delete all copies of th= e message. _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir=20 --B_3554106354_1610508620 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Let me add a few points in line here and BTW David thanks for yo= ur thoughtful and informed insights.=C2=A0 Good to hear from you.

 

— 

Richard= Shockey

Shockey Consulting LLC

Chairman= of the Board SIP Forum

<= span style=3D'font-size:10.5pt;color:black'>www.shockey.us

w= ww.sipforum.org

richard<at>shockey.us

Skype-Linkedin-Facebook rshockey101

PSTN +1 703-593-26= 83

 

=

 

From: stir <stir-b= ounces@ietf.org> on behalf of "Pierce.Gorman@sprint.com" <Pi= erce.Gorman@sprint.com>
Date: Monday, August 15, 2016 at 10:21 = AM
To: David Frankel <dfrankel@zipdx.com>, "stir@ietf.o= rg" <stir@ietf.org>
Subject: Re: [stir] Setting Expecta= tions regarding STIR Deployment Realities

 

Your sug= gestion to “enumerate the out-of-scope dependencies” is a good request.

 = ;

I hope the authors will make some attempt, as well as an example= or two.  (Ironically the word “example” appears 54 times b= ut not in relation to an actual example.)

 =

RS>=C2= =A0 Where have I heard that broken record before.=C2=A0

 

My personal view agrees with yours that there seems to be an expectation t= hat STIR will operate on endpoints in an end-to-end fashion when in fact, to= have any hope of nearer term deployment of anything hopefully approaching c= ritical mass (and even then there are very big challenges), the carriers wil= l be required to do the key management, the signing, and the interpretation = of signatures.

 

 

RS> Agreed. Ce= rtainly some people think the STIR mechanism will operate in an end to end f= ashion, and it may well in the distant future but that represented a level o= f complexity and cost that no one wants to impose on the industry at this ti= me.=C2=A0 As you well know the industry has a legitimate allergy to large number= ing databases. Not to mention we’ve seen a variety of issues with WEB = PKI deployments that simply cannot be permitted under the circumstances.=C2=A0 P= hone numbers are not domain names. =C2=A0We are dealing with a first order level= of deployments, that as you point out, in large measure will require carrie= rs to do the key management signing etc.=C2=A0 That is the world as it is now, n= ot as some wish it were. =C2=A0The important thing now is for the authors to cla= rify what the construct looks like on the wire and avoid any discussion of L= ayer 8-10 issues that are outside the scope of the charter. =C2=A0The current do= cuments represent the appropriate level of tools necessary to design an appr= opriate implementable system.

 

 

 

What is signed and how it is interpre= ted are critical pieces of information and need to be kept extremely simple = or, IMHO, this will be as big mess as you’ve tried to warn.  And = of course these critical pieces will not be provided here.=

 <= /span>

As far as “out-of-scope dependencies” I’ll suggest that how keys are ma= naged, what is signed, and how the signatures should be interpreted are the = big 3 that occur to me.

 

I am hopeful that the SHA= KEN Framework being crafted in the ATIS/SIP Forum IP NNI Joint Task Force wi= ll be able to accomplish the “what” is signed and how key manage= ment (for North American carrier implementations) should operate.&nbs= p; I suspect carrier key management may be a subject of regulation but don&#= 8217;t know for sure.

 

 

RS> Tha= t is our joint desire and the NNI TF will be meeting this month to review on= going requirements and deliverables, especially in light of the conclave on = the 19 at Commission HQ.

 = ;

=  

I am also hopeful that 3GPP will define “how” t= he SHAKEN signature is to be interpreted, especially for corner-case require= ments such as E911 when roaming on a carrier with whom the subscriber’= s carrier does not have a roaming relationship, and manual roaming.

 

RS> Agreed and preliminary outreach has gone out to th= e relevant 3GPP committees.

&n= bsp;

 

Outside of carrier implementation, I have very little id= ea what endpoint developers will want to do, but am willing to let the marke= t figure that out for itself.

 

Pierce<= /o:p>

&n= bsp;

 

= From: David Frankel [mailto:dfrankel@zipdx.com]
Sent: August = 14, 2016 8:43 PM
To: stir@ietf.org
Subject: [stir] Setti= ng Expectations regarding STIR Deployment Realities

 

I am writing th= is note to share a perspective on several aspects of STIR and its related sp= ecifications. I was prompted to do this by the numerous notes from Dave Croc= ker and the discussions that have ensued.

&= nbsp;

My comments here are not specifically= directed to Dave’s issues. Rather, I noted that Dave was asking the g= roup to live up to a level of rigor that, I think, was higher than where we&= #8217;ve been operating. And I wanted to highlight some other areas that hav= en’t been fully addressed and probably hold future pitfalls for this e= ffort. Being rigorous and explicit about these issues might help us reach th= e end goals more quickly and pragmatically than ignoring them.

 

There seems to b= e a lot of confusion, at least outside the group, about how STIR will be dep= loyed and what the effect will be. I discuss below three of the most signifi= cant areas where I observe this:

I) Specifi= cations vs. Network Realities

II) The (mass= ive) nuances of Caller-Name vs. Caller-ID

I= II) Expectations regarding Robocalls

 =

I’m not an “expert” on a= ll things telecom, but I do have several decades of experience with legacy a= nd current telephony, mostly in the United States. I’m hopeful that my= comments are useful, at least to some. If they are out of place for this li= st, I’m sure people will let me know, and I’ll ask you to forgiv= e me and just ignore and/or delete this note if it isn’t helpful.=

 

I’= ;m sure at least some of you will read this and say, “Yeah, we knew al= l that already.” And maybe it’s all been sufficiently considered= and doesn’t need additional attention. I’ll share anyway.<= /o:p>

 

I) Speci= fications vs. Network Realities: When writing “specifications” f= or the handling of telephone calls, a couple of important realities come to = mind. One is that there are numerous “authorities” for how telep= hone networks (as we know, it isn’t just one network; it’s a net= work of networks) “must” or “should” work. A second = is that even if you could gather those various specs and directives and regu= lations, you would find that the actual implementation is full of deviations= – some large and some small; some on purpose and some accidental; som= e rare and some commonplace.

 

In the beginning (depending on where you define th= e starting line), there were specs from the Bell System, published in modern= times by Bellcore which became Telcordia. (Again, you’ll see that I a= m mostly USA-centric, so you can assume that’s what I’m talking = about unless I mention otherwise.) When (the old) AT&T was the dominant = carrier, most operators around the edges used these specs at least as their = starting point for implementing and running their networks; equipment manufa= cturers conformed in order to place their gear with those operators.

 

But even b= ack then, as the networks were digitized and computerized (SS7, ISDN, SONET,= ATM, SCPs, STPs, TCAP, PABXs, Feature Group D, etc.), manufacturers and ope= rators purposefully deviated from the specs. Sometimes this was to different= iate a product or a service to gain a market advantage; sometimes it was to = overcome a technical hurdle; sometimes it was to address a physical, politic= al, economic or legal circumstance not anticipated by the specs.<= /p>

 

Regulators (no= t just the FCC, but even individual states) imposed rules that imposed limit= ations or deviations to the specs. Other organizations (e.g., ATIS) also pub= lished specifications. Any given operator’s specific implementation en= ded up being guided by materials from several “standards” bodies= , plus regulators and equipment suppliers, and ultimately even (big) custome= rs. Ultimately, they implemented what they felt like implementing.

 

Applying int= ernet technology to the transport and delivery of telephone calls showed obv= ious promise and SIP went to the tip of everybody’s tongue. But again,= while we had RFCs suggesting how this “should” (or “must&= #8221;) work, in fact those RFCs are in practice only a “guide” = to the implementers.

 

=

Here are a few examples that are relevant, in varying deg= rees, to STIR:

 

RE-ORIGINATION: In theory, an end-to-end SIP call would be passe= d from originator to destination relatively unchanged; each network hop woul= d add a VIA header showing the path the call took. But in fact, for the bill= ions of calls moving through the PSTN, this isn’t how it works. Unless= the call starts and ends on the same network, it will necessarily be passed= between networks, often using one or more intermediary networks to get from= start to finish. Each of those networks has specific economic interest in t= he call (they are going to get paid for it, or pay somebody for it, or both)= .

 

= Each network re-originates the call, making its own decisions about what hea= ders to include (or not). The source of the call (upstream network) is purpo= sefully obfuscated, because for competitive reasons, operators do not want t= heir neighbors to know who is feeding them calls. The engineers on this list= would of course prefer that not be done, but we don’t get to make tha= t rule. Even if we could convince SOME operators to do it our way, monetary = interests will overrule in many other cases. (There’s a further discus= sion about how the DIVERSION header should be used for re-originated calls, = but we’ll save that for another day.)

 

INTERWORKING: Only a tiny fraction = of calls today are end-to-end SIP. Most involve some interworking with SS7 o= r at least ISUP. And while there are RFCs that specify how that interworking= “SHOULD” or “MUST” be done, in fact the gateway ven= dors and the network operators do it the way they want to do it. Some honor = and use P-CHARGE-INFO; others do not. Some deliver X-CHARGE-NUM to the desti= nation user; others do not. ISUP-OLI is sometimes passed in the FROM header;= sometimes not. To be fully interoperable, systems that can benefit when the= se fields are available must be designed so they fail soft/safe when not ava= ilable. While I realize STIR is intended only for the end-to-end SIP environ= ment and thus avoids this level of interworking, there may be lessons that c= an be learned from how things do (or do not) actually function in the legacy= world. And note how variable the performance is across operators.

 

CALLER-ID SC= REENING: Even at the dawn of legacy caller-ID, there was the notion of wheth= er that number was “authenticated” or not. The ISUP Calling Part= y Number information element includes a “screening” indicator wi= th several possible values: “network provided” means that the op= erator (presumably a “trusted” entity, whatever that meant then = or now) determined what number to send based on subscriber account informati= on; “user provided, network screened” means that the end-user cu= stomer (probably the owner of a PABX) provided the number, but the (trusted)= operator made sure, somehow, that the number was “owned” by the= end-user; and “user provided, not screened” meaning that weR= 17;re just passing along whatever we got from the customer and don’t k= now its validity.  In theory, the screening indicator, which would be d= elivered to the call recipient, could be used just as we are discussing toda= y in STIR to influence call handling at the receiving end.

 

But guess what: desp= ite being in the spec, and even implemented in lots of equipment, the “= ;screening” indicator gets little use. For almost all calls, the calli= ng party number is “user provided, not screened”. Presumably it = got too cumbersome to maintain the screening lists. Operators, interested in= bringing on new customers, just turned off screening to expedite the onboar= ding process.

 

NATIONAL CONSIDERATIONS: Richard Shockey in particular has been g= ood about highlighting where the RFCs must stop and defer to national regula= tory authority (or local practice). But that means that to actually implemen= t anything, you have to not only follow the RFC, but you also have to unders= tand the national considerations particular to your circumstance. And itR= 17;s difficult to evaluate the practicality of a proposed RFC without also u= nderstanding how it would be deployed in the specific nationalities where yo= u want to operate. In USA, we have the number portability database, the loca= l exchange routing guide, the toll-free (SMS/800) database, and others. In f= act, even an end-to-end internetwork SIP call can’t complete without c= onsulting the (legacy) number portability database. In parallel with the STI= R RFCs, should somebody (ATIS?) be writing a STIR implementation spec for US= A/North America?

 

Reviewing 4474bis, there are numerous references to “out= side the scope” and “deferred for future work”. This is no= doubt all for good reason, but you can’t actually deploy anything unt= il some of those items are addressed.

 = ;

Summary? They say you can lead a horse to= water but you can’t make him drink. And you can write specs all day l= ong and mandate this or that, but at the end of the day, the implementers ar= e going to decide how it really works, and forces stronger than our specs ar= e likely going to be at work here. The ideal spec is written with enough kno= wledge and enough appreciation of the technical and economic realities where= it will be deployed that implementers CHOOSE to fully adopt it. The spec ad= ds value if adopting it is less painful than some other alternative. To flou= rish, the spec must, of course, be technically correct and, when followed, d= eliver on its stated objective(s). It should be well-enough thought through = and sufficiently constrained that conforming to the spec is more efficient (= in terms of both development and operation) than other approaches. Clearly i= n our environment INTEROPERATION is key – a huge advantage to followin= g a spec should be that you are assured of interoperability with others that= follow the spec. And the spec should TEACH. I think Dave Crocker has been t= rying to address all of these things. But even if we succeed on all that, re= member that in the telecom environment, the spec must survive in an ecosyste= m where other forces are hard at work.

&nbs= p;

II) Caller-ID Number and Caller-Name: A = short time after caller-ID was introduced decades ago, we got Caller Name (C= NAM). This functioned then not by sending the name along with the number fro= m the origination point. Instead, we rely only on the number being sent to t= he destination. Then, a database lookup is performed (“CNAM dip”= ) and the name associated with the number is displayed to the end-user.=

 

In the = beginning, a carrier could only provide name information if the call both or= iginated and terminated on its own network; the carriers that owned phone nu= mbers maintained their own CNAM databases. Then they decided to give each ot= her access to their database, but demanded compensation from the terminating= carrier for each dip. (Tiny carriers used aggregators to maintain their dat= abases and handle collection and disbursement of dip charges.) Over time, th= e CNAM databases have evolved. There are a few large operators still mostly = conforming to the original notion. But other databases are available that us= e hybrid information (some entries from public records, others licensed or s= tolen from the official sources). And of course what’s most popular on= mobile phones: using the end-user’s own contact list (stored in the p= hone) as the database.

 

Most mobile operators do not, by default, deliver a cal= l-by-call CNAM to the subscriber device over the air. A few offer to do a da= tabase lookup and deliver the result, usually for an extra monthly fee (sinc= e they incur a cost for doing the dips). As usual, economics drives the real= ity here.

 

Most consumers care more about the name than the number; some telepho= ne displays show only the name if it is available; the number is shown only = if the name is not known. There are some more modern proposals for how the n= ame information might be sourced (and even authenticated; see draft-peterson= -stir-cnam-00) but I haven’t seen substantive discussion of that here = (and 12.6 of 4474bis mostly says it is out of scope). Private SIP-to-SIP cal= ls of course use the display name in the FROM header. For Public Network cal= ls, either an “authenticated name” could be displayed, or for an= authenticated number, a dip into one of the various databases will be done = to fetch a name. But how any validity is assigned to that name is an exercis= e for the reader (or left for a future version of the spec). Today, many ser= vice providers let customers specify any name they want for the database ent= ries associated with their numbers. That name can often be set via a web por= tal or an API and can be “Alex Hamilton” or “Bill Clinton&= #8221; or “FBI” or “Bank of America” even if the own= er of the number is “Joe Fraudster”.

 

My point here is that we can k= ick the CNAM problem down the road, but it really is what most end-users car= e the most about. STIR as is may be a critical stepping stone to getting the= re, but we should set expectations regarding what the (intermediate) result = is going to be.

 

III) Expectations Regarding Robocalls – Speaking of setti= ng expectations, there are high expectations that STIR will go a long way to= dealing with the massive robocall problem. Last month, FCC Chairman Wheeler= said: ““I am also calling on the carriers and standards groups = to accelerate the development and deployment of technical standards that wou= ld prevent spoofing of caller ID and thus make blocking technologies more ef= fective, as was done in the battle against spam years ago.” If he beli= eves that STIR as proposed is going to make any measurable dent, within the = next five years, in mitigating the level of actual fraud facilitated by ille= gal robocalls, he is sadly mistaken.

 =

I think it’s acknowledged that STIR = only applies to end-to-end SIP calls, and then only when all intermediate ca= rriers propagate the necessary headers. Those calls are likely to be a tiny = fraction of all calls for the next several years. One theory says that the i= llegal robocallers will be the last ones to authenticate their calls (becaus= e they are, in fact, not authentic). So the theory is that we’ll authe= nticate all OTHER (legitimate) calls, and then the illegal robocalls will st= and out as the ones that aren’t authenticated.

 

But that’s preposter= ous. In the US, there are hundreds of millions of endpoints that can origina= te calls; even if we managed to get 90% of them using STIR, there would stil= l be tens of millions of (legitimate) endpoints originating unauthenticated = calls. Now, the actual count of endpoints isn’t so critical; more impo= rtant is the volume of calls originated from authenticated endpoints versus = non-authenticated. Lots of business-to-consumer calls are originated from PA= BXs and other systems connected via legacy PRI or even legacy analog lines a= nd trunks. It seems unlikely that consumers will want to put all those (unau= thenticated) calls through some CAPTCHA or similar system. It isn’t cl= ear to me what the game plan is for dealing with what will still be the larg= e fraction of calls that that will remain unauthenticated for some time. (Ho= w the endpoint handles such calls are outside the scope of the spec, so how = Wheeler knows that it is the savior to robocalls is beyond me.)

 

Alternatively, = there will probably be some illegal robocallers, and their enablers, that wi= ll jump on the STIR bandwagon if it comes to pass. There will be service pro= viders that will solicit customers to sign up over the web, relatively anony= mously, to get “authenticated” phone numbers (perhaps thousands = or maybe even a million of them). They’ll be able to set their CNAM to= whatever they want. They’ll place hundreds of millions of authenticat= ed calls and then move on. The good news is that STIR will let us know who t= he service providers are that are making the authenticated credentials avail= able to these robocallers, but it isn’t clear what the next steps are.= I’ve seen mention of (again, out of scope) potential “reputatio= n” metrics for providers. But it isn’t clear how a call recipien= t would determine the reputation of the provider, or what they would do when= an authenticated call was received from somebody using credentials issued b= y a less-than-fully-reputable provider.

&nb= sp;

And all of that assumes a level of soph= istication on the part of the call recipient to actually deploy some feature= or filter that acts on the authentication (and reputation?) information. Ro= bocallers almost by definition do not prey on the sophisticated; they prey o= n the elderly and disadvantaged and desperate, who typically don’t hav= e the latest smartphone or the coolest VoIP service. (Yes, robocalls annoy a= ll of us, but I promise you that nobody on this mailing list is their target= .)

 

= We should certainly learn everything we can from the email spam battle, but = the analogy isn’t 100% applicable by any means. Email has the SIGNIFIC= ANT advantage that filters have access not just to the headers (which includ= e, importantly, a SUBJECT line), but also to the ENTIRE CONTENT of the messa= ge. (This is also true for SMS.) With voice calls, we have far less informat= ion available, and certainly no clue as to what the content will be. “= Doing for voice calls what we did for email” is a technical fantasy.

 

So m= embers of this list are being disingenuous if they are telling Mr. Wheeler a= nd others to expect a dramatic near-term drop in robocall complaints once ST= IR (as currently envisioned) is deployed.

&= nbsp;

CONCLUSION? I’m not for (or aga= inst) major revisions to the document. But I do think that expectations need= to be properly set. 4474bis 12.2 says in part: “…preventing the= simple unauthorized claiming of an identity for the purposes of robocalling= , voicemail hacking, or swatting, which is the primary scope of the current = document.” The document lays some groundwork that will be useful, in p= art, in ultimately limiting robocalling, but nobody has connected all the do= ts for me on how it will actually, pragmatically be deployed to achieve that= objective (same for swatting). Some of you, no doubt, will tell me THAT is = beyond the scope of the document(s). If nothing else, the document could enu= merate the out-of-scope dependencies upon which we are dependent before real= izing any actual utility (or deployability) of the spec. And even then, the = utility to the end-user is going to be severely limited until deployment rea= ches some critical mass and additional fundamental limitations are addressed= .

 

<= span style=3D'color:#1F497D'>David Frankel

ZipDX=C2=AE LLC<= /p>

Monte Sereno, CA USA

 


Thi= s e-mail may contain Sprint proprietary information intended for the sole us= e of the recipient(s). Any use by others is prohibited. If you are not the i= ntended recipient, please contact the sender and delete all copies of the me= ssage.

________________________________________= _______ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinf= o/stir

--B_3554106354_1610508620-- From nobody Mon Aug 15 09:05:48 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B5E812D923 for ; Mon, 15 Aug 2016 09:05:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M99zMKbjDNmq for ; Mon, 15 Aug 2016 09:05:37 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0114.outbound.protection.outlook.com [104.47.32.114]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0DC012D1F0 for ; Mon, 15 Aug 2016 09:05:36 -0700 (PDT) Received: from BN1AFFO11FD020.protection.gbl (10.58.52.30) by BN1AFFO11HUB037.protection.gbl (10.58.52.148) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Mon, 15 Aug 2016 16:05:35 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.39) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.39 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.39; helo=plsapdm3.corp.sprint.com; Received: from plsapdm3.corp.sprint.com (144.230.172.39) by BN1AFFO11FD020.mail.protection.outlook.com (10.58.52.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Mon, 15 Aug 2016 16:05:35 +0000 Received: from pps.filterd (plsapdm3.corp.sprint.com [127.0.0.1]) by plsapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7FFno9n041544; Mon, 15 Aug 2016 11:05:34 -0500 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by plsapdm3.corp.sprint.com with ESMTP id 24t0t99rdd-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 11:05:34 -0500 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 15 Aug 2016 11:05:33 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 15 Aug 2016 11:05:33 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen , David Frankel Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMwgAAd3sqAAACuMA== Date: Mon, 15 Aug 2016 16:05:32 +0000 Message-ID: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.38] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.39; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(189002)(199003)(51444003)(24454002)(13464003)(377454003)(11905935001)(106116001)(81156014)(189998001)(47776003)(86362001)(87936001)(23676002)(76176999)(92566002)(54356999)(108616004)(33646002)(50986999)(5250100002)(19580405001)(19580395003)(11100500001)(106466001)(93886004)(2906002)(356003)(50466002)(97736004)(2900100001)(5001770100001)(81166006)(8676002)(8936002)(15974865002)(15975445007)(626004)(2950100001)(7736002)(4326007)(24736003)(6116002)(586003)(102836003)(68736007)(3846002)(7696003)(7846002)(305945005); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB037; H:plsapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD020; 1:PGoAgsXlpvaeOrdx/apWk2L6l4/ftqZbyJGBD3pyERkNqaQ66zUboDZQZuwXsM/d2MTPXr1hzktb1rgUUM005XmU4mviXFCXlo2mnlzjI+lcCDBf0j5RdWW00Fmqd6Ng1S09ZK8tCoOMTf1HCPO4TO8ofGvkIcn69VXXM+DZlDHy6MEkVcWdqqF1mrAwR+QwAp9t8G667+FRxMqjXMo/AeABkXZmJ3vMJ0otd7E9obXQRZs1LrwAOQL1C96C5wZtkqcPEv+eVQScYLzOQs5SeOfad8h7Fe4LQ3+ISR1Uc+v8RhELOg6XPBXJZOAGEI7yX4Hn9TeWotzZbuQhFmMCsOluiYbfF0XYrLdw38AcxsgGL+9E4ps+AIhiB9thBCmnJtnzDRTEut6EoNGSqvcOoYvq/eCPLowTOPDRyOsEOC1W98cvlDMS/yDu/SyaQVL0H4dr01Z/X/3NPYKjBV1ILC4Wp2Jnd/sxNtAT++Z8MU4CkJonRPl+JM/2gUulmnzk9aMkqyHcDbvMEkV7TRMjBHOaj05o9jbNQz6v1QecNmWScYH2x7nBhk8nCvzoAiil X-MS-Office365-Filtering-Correlation-Id: 10efca81-8079-4a91-9c8c-08d3c525fe04 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB037; 2:csmJ50IydbWl1L+WNDrLixRFcRQzZ84MlcgeAU7/D7xTP52he2rKqbvNGPZCrc3JDkx/nIHr3mEpqDDpzkYwkOT9PWAotkwRY1BbEzIlZi7UM85aTvsVGnjnSMU8k8VL1jpwRVH4JDhNRU/WhZEZPtqMvcWx1cGwaQKrOgTFBgbPHm+ZnXFyRqduQVe/ptCM; 3:t2HynqQcEefvjPa9MtLR+ABzbd8JX6fypfJfMbu1AioOX2lKO28Z3AGyttMLT3S+Ynv9fPtbfhH94Nw6uo6z97evZ+tNP+QE3+haFFnjI9DQjaRDWC0Kho0bBk0fdVAulOoOhQShj4HfluimhJMmS4SMZdyj33soYLJR/s6Y60zHzwprngNcpUMwgBlwQRimaKYjLL0Ot4usH3ZBAtZaq+q8QuVl3noM+Xs3eJoeBviC9eMXzeM9ZEBOlHDwY7fgnE1h1UoacPspEbA+K4ho0g== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB037; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB037; 25:kBk9GlUdlAfHIJvFiLXdJEYrt6ayshUKj9xdFPyy/ED3uJCVBM99DPQUebG/gCimltGLiLu0eZglE4WwEzUa4Ds97LfwVx8DvZy5pZaiB5mysO0OaQBfwNOnKaXKJbofcNe9sLNQE/lY1QvSNzsv5MvUmPeqd8hnJLyP4tls1+7/Wz5bIgqPMLSqQGB3c0zJdl9XTmUoiQTxBOgcdxVDCSQg2qP0kAfsZgGNDByAi8TCSJNhFh39IDzHLegCexxksf09A47jCSX7+GGrOdzDnS1ktHYlJh29euuSVHYh0X7rFzZz19q93qFFB52nzNnDsTsriX7KSqRlkIM7AYZ0xnHVb0oNtZ2ZJqrHMm+BrHwnpO/odhtBanHIRt1ZTcnpZScOQlqVIANpTvepPfy3gD/O0NsHxi6ock9nKCGJsEMjGG3yPxKH+e+DbysWRwdpICV/cZ31g+q2bHND4dZ5VTgzcifK4Z5NzQcuSDlQIAkkfyXvnAaA3j4fTVxQGa9hCgO1o4OR+m1DFD+X5wv1q4vmDNSOSxdt41fuRPinIHs9nyNCinqLlxucSicqnprrRU8M693Db1chmNpX+NhXkLrBZntiJiT7H7iSAmzxJsrO2SfacdaOJj+L9WQel3xgpkPrUrrKI4MmDwnxsmSDEAXOcZ7cgrohzU1mwMTL28Z42zfc45ea0BKjSUwkszdUza+zs9R2bN5kNyr0IGWMVqw2EmKE+gXoZWZSkrTSrD+JfelxliYkMZKNkHXA7mJXzLe6BEo7fbmv3034pg4eThBJMd34juPRyUK1IlH7+7e4+tVJ7rakwEwSgklBeCzC9DHOEKawotDXQHQrx8Ohuf350xO13GCLV6FOk15zEpi8x9K9jkn3VHoY6DeZMbiajaqGkvt8abQTVsdPOSoNO+QRm1ljHHlvG4bgHZrU/yit6WRAU0ylMnbFoljxkl52 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB037; 31:97WkKkM4aBWQ8jVZvYxeiexpq3s4QOA2EfKUGRbF7XMr6miL9PUt9/1we9Gydqw/VvvsHg6aGhZoXKyo6Jd5sOIhcGNizzBrnEWEDJa+XSP19KX3K6BQQu005hWcbDxqnPSv7vx3PqGL5GRQ8B6ljYBEDRiC66K7VJFy1hAf45yk1FmUzW8Bl4Uo7cziGpIvM5REt0obvU5STIxXNKsS0Bs3qcdDJ9//7vfsVau6c0Y=; 20:UMC9EfPzedu1sS2GrGB3XWhvluzBYsdwn9p1be14LHt6rOxr91bMfoSFr15lHS2xw18OwR7xK5E65fvy+KLdfaONbMbGFPzwnGhEP/3uA8fghmzE4ZF1Nw44fMBP7e0rti+ssM1PZIxJgvPfyTexK4QzxAUTqwZnEDIK7EBkYKfLWtwfpWuEm+YKNCyNe890ZE2L5NMqMkn90vp5JvodItLU6JWC4UU+0Vr7joq2VpgJ5j7yEgmVracpKatCVQpO3s9ljRUpQ+d8VHi29oy5LBqYqF+k+dQkLUDEL4omrwXe8pt3BC48szKtGTB/wcZEzJD3UqtfIuXifAURVTN9LFNGCJrpvM6whsQhy378uLWI2LiQzGMKLJyaLeNf3X0u0weYhQSaTvqR8zKEHUnuQ+GNwQ2vmLuNgyfrsAKoXAA= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(260524479936436)(18430343700868); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(13015025)(13017025)(13024025)(13018025)(13023025)(3002001)(10201501046)(6055026); SRVR:BN1AFFO11HUB037; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB037; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB037; 4:ru7W8QVVur2cC6tivsq6xdI6IFIVYL4U0qPU46VRNhubRe0YhMg4nj3s/4L0PPBBeYkgdaoqy+WgMRYVXDg67lyWSjc0yGZkesSTiwaBI1hqf6ZORNHMLxIGl9UzCx4brQfEwzZ7ZechZ9pxsbNntjlpELOJGZYnnIH9GKRoStmjKCTLEiwGs//YJawlZ49iAYJs+HcYzI1/cm+14ib7xhI1IoYRvRGAI/P4olQCcPrLzoQsJ0kkeUlRAPwKzcDE4DW9Cf9ILA+MHhdR1RtSxP3TGdCfrjWsceaAkID5cHkYz2NrWp+4QxMgkB23/DZHxwgfnwR5QhdxA4XrTtHnFdW5OnWDe2HUu45n/RQkVPhWWfJCuagKaj8ltEoPuen1k/pdAGPFwTdZChP4cKcCDyySYZVn+lKON6IxnWzQNuDI/IVvPOYyFFzvAYj5FzuD3iTCbGaJL1OKww9q8ysadzt+e7lC4KgWnPlx8A/CjmTNyzVWae/FbjUfq+m7+x2eR4maOHIsX07MRvCOhPOGQNaQCgXsdikw3ZbDv3jv3S/9bXxX3jBniPiGKBOqYUfazujJnIiD9lgHb5+hcJzRIBxeAezqPF3EjYBdRqSR7bI= X-Forefront-PRVS: 0035B15214 X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjFBRkZPMTFIVUIwMzc7MjM6MnRoQ2xnU1N4UHcvd1JKL2ZDOElWa0hl?= =?utf-8?B?dk9KeVlhZHNva0ZLYmZRdmI3QVJJbzdCT3NxSTJ3THlSS0srKzdOdXJUa1N6?= =?utf-8?B?cmNrT2swMzU5WUNpa0FCcTY3LzVKTGs4VlpIWUsrVXhDWlk2N3hXR2F2R0pL?= =?utf-8?B?a0hJRVhxZTJnVXlCUmpoUEZIMEFEU2VpRncrenY3NXpTLzZkVi8rUkJxcEFR?= =?utf-8?B?WmNIUmNZbDBkSys1aEgrVWNBcnJDektoWnpEMk5UYjVkWlN0WWFaZXZORGNV?= =?utf-8?B?R2I5ejdwUmJLV29kb3BPMG1qMUJ3eUlXOWV3NzNad09LeUNYZTRhejVLekor?= =?utf-8?B?b3hRRVFkK1Zyb29hUzlITTFQNENSa3lMQTY5b1d0L1hFcnAwLzV6VWZ4WEtF?= =?utf-8?B?REg3VmkzN04vM1crRk9NWWR0cXJ0cGduWFYxVnZlc25IV2lROEpUMytMR29N?= =?utf-8?B?NlljL21lYjd6UU9WYzI2YzlxQlE1MVhiVXFvY244TXk3aHBzdE1YRHZlQjBv?= =?utf-8?B?NDdxaGFUUUkrVU1GcnNxVXlUQ3V4ZU51cklvZXJ2ckV0WE1JMHNFNkJmd0pW?= =?utf-8?B?Q1NBcDRHdko1N0RBV3JKcW9wWEJBOGM1OEZwY3BvRlhKb055akd1TmE1N2VS?= =?utf-8?B?Y2REV0phdWo3bkp4UXVEUjRsTkp0MFZRWmhCcHpiNklYcmxVa3k5eWdHZ3g1?= =?utf-8?B?RHlGREtLemRZbDU4d25KVElrVjRxeGdpOUhsT1ZDbkdRWlBZSXJGSFVQN2dh?= =?utf-8?B?V203cjZHU3BDcjk5T0RtR2NWNFdHSEdtWmx2dlh6SWNVeEM1U3ZOdzI3aWt4?= =?utf-8?B?YldWaEM4Q1dWSVZvTU4wVVp0QWZ3cFkvQlIrT0VTM3hvS3ppOWU2WDBCY3Y4?= =?utf-8?B?WmlkNmdiSTl5RzM2Q3BobXo3a3RDOVFRT295YlIyeCttMWJUcEF1OWZIQWt6?= =?utf-8?B?YmVMeFA3TGVSZUtqbzhJWTE4S2hNNCtkZVdIN3NRZEpZZnJrbk5CRFYxemhx?= =?utf-8?B?Mkltc2FmajJVMXBtalh6YmpGLzZlRXM3OG1Uai9hNHB4YlJTS3BGSUYvdHRw?= =?utf-8?B?TzhkZml6WkJqSk5JRlJvcHRuY2RkT2tkWHYxUHMwZDNucE9ZdWl3elRYbWRF?= =?utf-8?B?a3gwRk9NcTVHWFMrSGdWa0NpZXpwZFpncUlkSW9XWS91YUc4Mm9ZQ2hWOW1H?= =?utf-8?B?b1hmdlZTaHQxa1VxczRVUlJwS0FIQjZqcys5VFRVTmd6R3pzWWRvaVVZdmth?= =?utf-8?B?ZjZmbmJBbnBJZEQ0ZlZCOFQwb0tycmJ4bDNwbDJJUER2NlZNSWtYQkU2U3VZ?= =?utf-8?B?MDUzMGYraDVGMFBhV0RsenQvbWc4eVg2cUo5cjZuZmU0NVFobWNCMnd4ZzFT?= =?utf-8?B?RUxuaHhyN0ZjeHhZNGtRNnJSaElSRE9BVDdsYjNxQy9BQStOMVV2eUhxTTJY?= =?utf-8?B?eVFnNEkzRG9EbXpRSHg1ZWNMNGVQemtFVjF3bVRXTkR6NVh1UFlVOGdmUk01?= =?utf-8?B?WXJlZURCYXV2WGh4azNpMG1FTFcvYnA0OTZoTW9lRDhWbmdhY0MvYm5vVG9O?= =?utf-8?B?QVk2c2k1LzYrazlsU1F5M3dWWTVTeTNGTHRieEJxTjZkcDdBRzZsQ0h6K1ZP?= =?utf-8?B?Nk1nMi96Z1FqMXdJVzhyUU02NkkwQmJwQmRlc3lsT0FDN292ejdLOGppaDVq?= =?utf-8?B?M1cyb3Z5V3I2cXRFK2F5K1lMOHhVS0RSdUlXNGZBeXU2UzdNUis2bDB6bFlZ?= =?utf-8?B?UnZFT2YyaCs0d1dlT3ZIWld4Sld0Z0JTRE9XTGNTVXV4dkQ4SSt0V0JrWWRJ?= =?utf-8?Q?hdPrUgaCMNbXVWT?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB037; 6:MsN7oMsnnFbmOPFH8oIOTbN2SbgeP6XaR7cvm02nQE9fAo/BP8CcA4DnY9fZpuqFzRdOuBBrCL08ZFpM6xIccLD1xTzr8lwQzmNa4qy1BHeLy7Bfmbwg/2rYcVhqNXKZmAzx3QgUZUrEGFSgcVkJWeiaZaXZz6X1hiZWwM7E0e5YtCSufiVdkZd42r71dwRLy8a195oJTDr88DskYlbhAdiv524GwkSpkGeI+CUoODLggwUir8XcenlWy8owJ9xtgLmsBs68BArQlRsrfRmA2KnlqBERAWKqGiYTqiiJivlg5GBFhfT/Ytntw08gPvXA1rm6qWMFwciqZQcoeXXtfw==; 5:tRAjr6GMo4dbNuvegn22AI/D2XyLq9tEbeCKMtP2QPIklC/9xAdyLdIS/QdJx1X5B5q+MLUAs1xFZbhZpghPMaKyM7ViFEk+0bidRQytrfhNpkByoNxF8O8r4x2TBJXHFF8Vfb588HBTb6B3akHZ8w==; 24:9bOZWMNPbscEyof5pM6MfJtyivLzNiTntcqHY0C2bZoYMmKLuffuxF8PmeZUxh8Hql218eT0WrVqrdEB8xxEQy85KqL/s+0EDj3DoJtrgZQ=; 7:Yri/BtOkBX/dGCGiKZcB3a62BIrl3IZ+E88IOU575sKuH7jWdanIzSy8JCULnrW0pILsqqT3eFuTvrTeVBALvz43znPpSuYKvDV7u8cHxr0TdH32kSiR0kbwK3PMYgtG27qemuG9hzzMKowQfQ7HX8rvqK+6PHEsryKo12yCOgCsXjfHXH5qMrkTgAa0UEpvnO1pHaOCOsp39QZqIZpNPpI8gsppFuUiNU4w+baAVTiwvG500KAqTPu4k9J0Xzms SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Aug 2016 16:05:35.3832 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.39]; Helo=[plsapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB037 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 16:05:40 -0000 SU1ITyBwZXItVE4gY2VydHMgYXJlIG5vdCBjYWNoZWFibGUsIGFuZCBDUkxzIHdvdWxkL3dpbGwg YmUgdW51c2FibGUgYW5kIHRoZSByZXN1bHQgd291bGQvd2lsbCBiZSBob3JyaWJsZS4NCg0KRnJv bTogIHd3dy5pbmZvd29ybGQuY29tL2FydGljbGUvMzAwMDU3NC9zZWN1cml0eS90aGUtc29ycnkt c3RhdGUtb2YtY2VydGlmaWNhdGUtcmV2b2NhdGlvbi5odG1sDQoNCiJUbyBtb3N0IHVzZXJzLCBv bmUgb2YgdGhlIGJpZ2dlc3QgcHJvYmxlbXMgd2l0aCBQS0kgaXMgaW52aXNpYmxlOiB0aGUgYnJv a2VuIGNlcnRpZmljYXRlIHJldm9jYXRpb24gcHJvY2Vzcy4gRGlnaXRhbCBjZXJ0aWZpY2F0ZXMg YXJlIHN1cHBvc2VkIHRvIGJlIHJldm9rZWQgd2hlbiB0aGVpciBwcml2YXRlIGtleXMgYmVjb21l IGNvbXByb21pc2VkIG9yIGZvciBzb21lIG90aGVyIHJlYXNvbiBzaG91bGRuJ3QgYmUgdHJ1c3Rl ZCBvciB1c2VkLCBhcyBkZXRlcm1pbmVkIGJ5IHRoZSBjZXJ0aWZpY2F0aW9uIGF1dGhvcml0eSAo Q0EpIHRoYXQgYXV0aG9yaXplZCB0aGUgY2VydGlmaWNhdGUuIEEgcmV2b2tlZCBjZXJ0aWZpY2F0 ZSBpcyBzdXBwb3NlZCB0byBiZSB0aGUgc2FtZSBhcyBubyBjZXJ0aWZpY2F0ZS4NCg0KQnV0IHdo YXQgYWN0dWFsbHkgaGFwcGVucyBpcyB0aGF0IG1vc3QgQ0EgYWRtaW5zIG5ldmVyIHJldm9rZSBj ZXJ0aWZpY2F0ZXMsIGV2ZW4gd2hlbiB0aGV5IHNob3VsZC4gQWx0ZXJuYXRpdmVseSwgcGVvcGxl IGtlZXAgdXNpbmcgcmV2b2tlZCBjZXJ0aWZpY2F0ZXMgYW5kIG5vIG9uZSBub3RpY2VzLiBFdmVu IG1vcmUgY29tbW9uLCB0aGUgY2VydGlmaWNhdGUgZ2V0cyByZXZva2VkLCBidXQgdGhlIHNvZnR3 YXJlIChvciB0aGUgdXNlcikgZG9lc24ndCBib3RoZXIgdG8gY2hlY2suIFdvcnNlIHN0aWxsLCB0 aGUgc29mdHdhcmUgbG9va3MgdG8gc2VlIGlmIHRoZSBjZXJ0aWZpY2F0ZSBpcyByZXZva2VkLCBj YW4ndCB2YWxpZGF0ZSBpdCBvbmUgd2F5IG9yIGFub3RoZXIsIHRoZW4gZmFpbHMgb3BlbiBhcyBp ZiB0aGUgY2VydGlmaWNhdGUgaXMgZ29vZCBhbmQgdmFsaWQgKHdoZW4gdGhlIG9wcG9zaXRlIGlz IHN1cHBvc2VkIHRvIGhhcHBlbikuIg0KDQpXaGF0IHNlZW1zIHdvcmthYmxlIHRvIG1lIGlzIHBl ci1jYXJyaWVyIGNlcnRzIHdpdGggZmV3IENBcyAodHdvPykgYW5kIGxpbWl0ZWQgZGVsZWdhdGlv biwgYW5kIGxpbWl0ZWQvdmFyaWFibGUgYXBwbGljYXRpb24gZGVwZW5kaW5nIHVwb24gdGhlIGxl dmVsIG9mIHRydXN0d29ydGhpbmVzcyBvZiB0aGUgY2FsbGluZyBudW1iZXIgYXMgZGV0ZXJtaW5l ZCBieSBzdGFuZGFyZCBhbmQvb3IgaW5kdXN0cnkgYmVzdCBwcmFjdGljZS4gIElmIGEgc3Vic2Ny aWJlcidzIGRldmljZSBjYW4gYmUgYXV0aGVudGljYXRlZCB0byB0aGUgbmV0d29yayB3aXRoIGEg aGlnaC1kZWdyZWUgb2YgY2VydGFpbnR5LCB0aGVuIGl0J3MgY2FsbGluZyBudW1iZXIocykgc2hv dWxkIHJlY2VpdmUgdGhlIGhpZ2hlc3QgImxldmVsIiBvZiBhdXRoZW50aWNpdHkgYW5kIG5vdCBv dGhlcndpc2UuDQoNCklzIGl0IHBvc3NpYmxlLCB1c2luZyBTVElSLCB0byBhcHBseSBtdWx0aXBs ZSBzaWduYXR1cmVzPyAgSXQgc2VlbXMgcG9zc2libGUgYSB0ZXJtaW5hdGluZyAob3IgZXZlbiB0 cmFuc2l0KSBjYXJyaWVyIG1pZ2h0IHdhbnQgdG8gY2hhbmdlIG9yIGF0IGxlYXN0IGFwcGx5IGEg ZGlmZmVyZW50IGxldmVsIG9mIGF1dGhlbnRpY2l0eSwgd2hpbGUgc3RpbGwgcHJlc2VydmluZyB0 aGUgb3JpZ2luYXRpbmcgY2FycmllciBpZGVudGl0eS4NCg0KUGllcmNlDQoNCg0KLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nl bi5uZXRdDQpTZW50OiBBdWd1c3QgMTUsIDIwMTYgMTA6NTAgQU0NClRvOiBEYXZpZCBGcmFua2Vs IDxkZnJhbmtlbEB6aXBkeC5jb20+DQpDYzogZGNyb2NrZXJAYmJpdy5uZXQ7IHN0aXJAaWV0Zi5v cmc7IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NClN1 YmplY3Q6IFJlOiBbc3Rpcl0gU2V0dGluZyBFeHBlY3RhdGlvbnMgcmVnYXJkaW5nIFNUSVIgRGVw bG95bWVudCBSZWFsaXRpZXMNCg0KDQo+IE9uIEF1ZyAxNSwgMjAxNiwgYXQgMTE6MjMgQU0sIERh dmlkIEZyYW5rZWwgPGRmcmFua2VsQHppcGR4LmNvbT4gd3JvdGU6DQo+DQo+IFRoYW5rcyBmb3Ig dGhhdCBjbGFyaWZpY2F0aW9uLCBCcmlhbi4gWW91IHNheSB5b3UgImRvbid0IHRoaW5rIHRoZXJl DQo+IGlzIGFueSBkaXNhZ3JlZW1lbnQgb24gaG93IHdlJ3JlIGdvaW5nIHRvIGRlcGxveSBzdGly IiBidXQgcGFydCBvZiBteQ0KPiBjaGFsbGVuZ2UgKGFuZCBmb3Igb3RoZXJzIHRvbywgSSB0aGlu aykgaXMgdGhhdCBtYW55IG9mIHVzIGRvbid0IGtub3cNCj4gdGhlIGRldGFpbHMgb2YgdGhhdCAi aG93IiBiZWNhdXNlLCB3aGlsZSB0aGUgZG9jdW1lbnRzIGRvbid0IExJTUlUDQo+IHdoYXQncyBk b25lLCB0aGV5IGFsc28gYXJlIG5lY2Vzc2FyaWx5IGluY29tcGxldGUgKHRoYW5rcyB0byB0aGlu Z3MNCj4gbGlrZSBjb3VudHJ5LXNwZWNpZmljIGRlcGxveW1lbnQgaXNzdWVzIGJlaW5nIG91dCBv ZiBzY29wZSkuDQo+DQo+IExldCBtZSBhc2sgZm9yIHlvdXIgaGVscCB3aXRoIHRoaXMgZXhhbXBs ZTsgY29ycmVjdCBtZSBpZiBJIGFtIHdyb25nDQo+IG9uIGFueSBvZiB0aGUgYmVsb3c6DQo+DQo+ IE15IHRlbGVwaG9uZSBudW1iZXIgaXMgKzEtMjEyLTU1NS0xMjM0IGFuZCBteSBzZXJ2aWNlIHBy b3ZpZGVyIGlzIEFUJlQuDQo+IFByZXN1bWFibHkgdGhlcmUgaXMgc29tZSBVU0Etc3BlY2lmaWMg bWVjaGFuaXNtIHRoYXQgc2F5cyB0aGF0IEFUJlQgaXMNCj4gdGhlIGF1dGhvcml0eSBmb3IgdGhl IGNlcnRpZmljYXRlIGZvciBteSBudW1iZXIgKGJhc2VkLCBJIHdvdWxkIHRoaW5rLA0KPiBvbiB0 aGUgbnVtYmVyIHBvcnRhYmlsaXR5IGRhdGFiYXNlIGFuZC9vciB0aGUgTEVSRykuDQpUaGlzIHJl YWxseSBpcyBjb3VudHJ5IHNwZWNpZmljLCBidXQgc3RpciBpcyBiYXNlZCBvbiB0aGUgbm90aW9u IHRoYXQgaW4gZXZlcnkgY291bnRyeSwgdGhlcmUgaXMgYSBkZWxlZ2F0aW9uIHByb2Nlc3MgZm9y IHRlbGVwaG9uZSBudW1iZXJzLCBhbmQgd2hldGhlciB0aGF0IGlzIGVudGlyZWx5IGNvbnRyb2xs ZWQgYnkgdGhlIHJlZ3VsYXRvciwgb3IgaGFzIHNvbWUgaW5mb3JtYWwgbWVjaGFuaXNtcyBhcyB3 ZWxsLCBkZWxlZ2F0aW9uIGhhcHBlbnMgaW4gYSB3YXkgdGhhdCB3ZSBjYW4gZXhwbG9pdCwgYnkg aXNzdWluZyBvciBtb2RpZnlpbmcgYSBjcmVkZW50aWFsIHdoZW4gdGhhdCBkZWxlZ2F0aW9uIGhh cHBlbnMuDQoNClNvLCBpZiBBVCZUIHdhcyBkZWxlZ2F0ZWQgYSBibG9jayBvZiBudW1iZXJzIGZy b20gdGhlIHJlZ3VsYXRvciwgYW5kIGRlbGVnYXRlZCB0aGF0IG51bWJlciB0byB5b3UsIHRoZW4g aXQgd291bGQgaGF2ZSBhIGNyZWRlbnRpYWwgZm9yIHlvdXIgbnVtYmVyLCBhbmQsIGhvcGVmdWxs eSwgYXQgbGVhc3QgYXQgc29tZSBwb2ludCwgc28gd2lsbCB5b3UuDQoNCj4NCj4gV2hlbiBJIHBs YWNlIGFuIG91dGJvdW5kIGNhbGwgdW5kZXIgIm5vcm1hbCIgY2lyY3Vtc3RhbmNlcywgQVQmVCB3 aWxsDQo+IHNpZ24gdGhhdCBjYWxsIGZvciBtZSBhbmQgc2VuZCBpdCBvbiBpdHMgd2F5LiBBbnli b2R5IGluIHRoZSBjYWxsIHBhdGgNCj4gY2FuIHNlZSB0aGF0IHRoZSBjYWxsIGNsYWltcyB0byBi ZSBmcm9tICsxLTIxMi01NTUtMTIzNCwgZG8gYSBudW1iZXINCj4gcG9ydGFiaWxpdHkgbG9vay11 cCB0byBzZWUgdGhhdCBpdCdzIGFuIEFUJlQgbnVtYmVyLCBhbmQgdGhlbiBzb21laG93DQo+IGtu b3cgdG8gZ28gdG8gQVQmVCdzIGNlcnRpZmljYXRlIGF1dGhvcml0eSBBUEkgdG8gZG8gd2hhdCBp dCB0YWtlcyB0bw0KPiB2ZXJpZnkgdGhlIHNpZ25hdHVyZT8gKE9yIG1heWJlIHRoZXJlIGlzIGEg Y29uc29saWRhdGVkIHBsYWNlIHdoZXJlDQo+IEFUJlQgZGVwb3NpdHMgdGhhdCBpbmZvcm1hdGlv biwgYWxvbmcgd2l0aCBvdGhlciBjYXJyaWVycywgYW5kDQo+IHByb3ZpZGVycyBhbG9uZyB0aGUg Y2FsbCBwYXRoIGNhbiBqdXN0IGdvIHRoZXJlIHRvIGNoZWNrPykNCkFnYWluLCBwYXJ0IG9mIHRo aXMgaXMgY291bnRyeSBzcGVjaWZpYyBiZWNhdXNlIG9mIHRoZSB3YXlzIGRlbGVnYXRpb24gaXMg ZG9uZSwgYnV0IHRoZSBpZGVhIGlzIHRoYXQgeW91IGNhbiBkZXRlcm1pbmUgZnJvbSB0aGUgY3Jl ZGVudGlhbCB1c2VkIHRvIHNpZ24gdGhlIGNhbGwgd2hldGhlciB0aGF0IGNlcnRpZmljYXRlIGlz IGdvb2QgZm9yIHRoYXQgbnVtYmVyLiAgWW91IGNhbiBxdWVyeSB0aGUgc2lnbmVyIG9mIHRoZSBj ZXJ0LCBhbmQgaXQgY2FuIHRlbGwgeW91IGlmIHRoYXQgY2VydCBpcyB2YWxpZCBmb3IgdGhhdCBu dW1iZXIuICBBbmQgb2YgY291cnNlIHNpbmNlIGl0IGlzIGEgUEtJLCB5b3UgY2FuIGRvIHRoZSBz YW1lIHdpdGggdGhlIHNpZ25lciBvZiB0aGUgQ0HigJlzIGNlcnQsIGFuZCB0cmFjayBiYWNrIHRv IHRoZSByb290IENBIGZvciB0aGUgY291bnRyeSB0aGUgbnVtYmVyIGlzIHBhcnQgb2YuDQoNCj4N Cj4gSW4gYW55IGNhc2UsIGZvciB0aGlzIHBhcnQgb2YgdGhlIGV4YW1wbGUsIGFueWJvZHkgYWxv bmcgdGhlIHBhdGgsDQo+IGluY2x1ZGluZyB0aGUgdGVybWluYXRpb24gcG9pbnQsIGNhbiBrbm93 IHRoYXQgdGhlIGNhbGwgaXMgbGVnaXQuDQpZZXMsIGFzIGxvbmcgYXMgYnkg4oCcbGVnaXTigJ0g eW91IG1lYW4gdGhhdCB0aGUgc2lnbmFsaW5nIGNvbnRhaW5zIGEgc2lnbmF0dXJlIHVzaW5nIGEg Y3JlZGVudGlhbCB2YWxpZCBmb3IgdGhlIFROIHRoZSBjYWxsIGNsYWltcyB0byBiZSBmcm9tLg0K DQo+DQo+IE5vdywgSSBjYW4gZW5nYWdlIGEgY2FsbCBjZW50ZXIgdG8gbWFrZSBzb21lIG91dGJv dW5kIGNhbGxzIG9uIG15DQo+IGJlaGFsZi4gKEkga25vdyB0aGlzIHVzZSBjYXNlIGhhcyBiZWVu IHJhaXNlZCBtYW55IHRpbWVzLikgVGhlIGNhbGwNCj4gY2VudGVyIEkgaGF2ZSBjaG9zZW4gdXNl cyBWZXJpem9uIGFzIHRoZWlyIG91dGJvdW5kIGNhcnJpZXIuIFNvIEkgZ28NCj4gdG8gQVQmVCBh bmQgYXNrIHRoZW0gZm9yIHRoZSBjZXJ0aWZpY2F0ZSBmb3IgbXkgbnVtYmVyOyB0aGV5IGdpdmUg dGhhdA0KPiB0byBtZSBhbmQgSSBwYXNzIGl0IHRvIG15IGNhbGwgY2VudGVyLiBTbyBub3cgdGhl eSBwbGFjZSBjYWxscywgdmlhDQo+IFZlcml6b24sIGFuZCBlaXRoZXIgdGhlIGNhbGwgY2VudGVy IChwcm9iYWJseSkgb3IgVmVyaXpvbiAobGVzcw0KPiBsaWtlbHkpIHVzZXMgbXkgY2VydGlmaWNh dGUgdG8gYXV0aGVudGljYXRlIHRoZSBvdXRib3VuZCBjYWxscyB0aGV5DQo+IG1ha2Ugb24gbXkg YmVoYWxmLCBjbGFpbWluZw0KPiAobGVnaXRpbWF0ZWx5KSB0byBiZSBmcm9tICsxLTIxMi01NTUt MTIzNC4NCklmIHdlIGdldCB0byB3aGVyZSB3ZSB3YW50IHRvIGdldCB0bywgeW91IGFzayBBVCZU IGZvciBhIGNlcnQgdmFsaWQgZm9yIHRoZSBudW1iZXIgdGhleSBkZWxlZ2F0ZWQgdG8geW91LCBh bmQgdGhlbiB5b3Ugc2lnbiBhIGNlcnQgZm9yIHRoZSBjYWxsIGNlbnRlciB1c2luZyB5b3VyIGNl cnQsIG9yIG1heWJlIHlvdSBhc2sgdGhlIENBIHRoYXQgaXNzdWVkIHlvdXIgY2VydCB0byBkbyB0 aGF0Lg0KDQpBcyBhIHByYWN0aWNhbCBtYXR0ZXIsIHlvdSBhc2sgQVQmVCB0byBpc3N1ZSAob3Ig Y2F1c2UgdG8gYmUgaXNzdWVkKSBhIGNyZWRlbnRpYWwgdG8gdGhlIGNhbGwgY2VudGVyIHRoYXQg dGhleSB1c2UgdG8gc2VuZCBjYWxscyBvbiB0aGUgVmVyaXpvbiBuZXR3b3JrLg0KDQoNCj4NCj4g QWdhaW4sIGFueWJvZHkgaW4gdGhlIGNhbGwgcGF0aCBjYW4gYXV0aGVudGljYXRlIHRoZSBjYWxs LCBzZWVpbmcgdGhhdA0KPiBpdCBpcyBhbiBhdXRob3JpemVkIHVzZSBvZiBteSBBVCZUIG51bWJl ci4NClllcw0KDQo+DQo+IFdoZW4gdGhlIGNhbGwgYXJyaXZlcyBhdCB0aGUgdGVybWluYXRpbmcg ZW5kLCB0aGV5IHNlZSB0aGF0IHRoZSBjYWxsDQo+IGlzIGxlZ2l0LiBBbmQgYWx0aG91Z2ggaXQg aXMgYW4gQVQmVCBudW1iZXIsIHRoZXkgaGF2ZSBubyBjbHVlIHRoYXQgaXQNCj4gd2FzIG9yaWdp bmF0ZWQgb24gVmVyaXpvbidzIG5ldHdvcmsuDQpZZXMsIGFzc3VtaW5nIHRoYXQgdGhlIGNhbGwg Y2VudGVyIHNpZ25lZCB0aGUgY2FsbCwgcmF0aGVyIHRoYW4gVmVyaXpvbiBvbiBiZWhhbGYgb2Yg dGhlIGNhbGwgY2VudGVyLiAgSSB0aGluayB0aGF0IG1vc3QgbmV0d29ya3MgcHJvYmFibHkgd29u 4oCZdCB3YW50IHRvIHNpZ24gZm9yIHRoZSBjYWxsIGNlbnRlciwgYnV0IHRoZXkgcHJvYmFibHkg d2lsbCBhY2NlcHQsIHBvc3NpYmx5IGNoZWNrLCBhbmQgZm9yd2FyZCB0aGUgSWRlbnRpdHkgaGVh ZGVyIGFuZCBib2R5IGZyb20gdGhlIGNhbGwgY2VudGVyLg0KDQo+DQo+IElzIHRoYXQgYWxsIGNs b3NlIHRvIGNvcnJlY3Q/DQpVaCBodWgNCg0KPg0KPiBEYXZpZCBGcmFua2VsDQo+IFppcERYUiBM TEMNCj4gTW9udGUgU2VyZW5vLCBDQSBVU0ENCj4gVGVsOiAxLTgwMC1GUkFOS0VMICgxLTgwMC0z NzItNjUzNSkNCj4gV2F0Y2ggT3VyIFZpZGVvIQ0KPg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2Ut LS0tLQ0KPiBGcm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhh bGYgT2YgQnJpYW4gUm9zZW4NCj4gU2VudDogTW9uZGF5LCBBdWd1c3QgMTUsIDIwMTYgODowNSBB TQ0KPiBUbzogZGNyb2NrZXJAYmJpdy5uZXQNCj4gQ2M6IHN0aXJAaWV0Zi5vcmc7IEdvcm1hbiwg UGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3JtYW5Ac3ByaW50LmNvbT4NCj4gU3ViamVjdDogUmU6 IFtzdGlyXSBTZXR0aW5nIEV4cGVjdGF0aW9ucyByZWdhcmRpbmcgU1RJUiBEZXBsb3ltZW50DQo+ IFJlYWxpdGllcw0KPg0KPiBJIGRvbid0IHRoaW5rIHRoZXJlIGlzIGFueSBkaXNhZ3JlZW1lbnQg b24gaG93IHdlJ3JlIGdvaW5nIHRvIGRlcGxveQ0KPiBzdGlyLCBub3IgaXMgdGhlcmUgYW55IHNw ZWNpZmljYXRpb24gdGhhdCBsaW1pdHMgb3IgZXZlbiBpbmZsdWVuY2VzIGl0Lg0KPg0KPiBXZSdy ZSBnb2luZyB0byBzdGFydCBkZXBsb3ltZW50IGF0IHRoZSBzZXJ2aWNlIHByb3ZpZGVyLiAgV2Un cmUgZ29pbmcNCj4gdG8gZXZvbHZlIHRvIGRlcGxveW1lbnQgb24gdGhlIGRldmljZS4gIFRoZXJl IGFyZSBzb21lIHBhcnRpY2lwYW50cw0KPiB3aG8gdGhpbmsgZGVwbG95bWVudCBvbiB0aGUgZGV2 aWNlIGlzIG5ldmVyIGdvaW5nIHRvIGhhcHBlbiwgYnV0IHRoZXkNCj4gZG9uJ3Qgb3Bwb3NlIGl0 LCB0aGV5IGFyZSBqdXN0IHNrZXB0aWNhbCBpdCB3aWxsIGhhcHBlbi4NCj4NCj4gQWxsIHRoZSBk b2N1bWVudHMgd2UgaGF2ZSBhbGxvdyBnZW5lcmF0aW9uIGJ5IGFueSBlbnRpdHkgdGhhdCBoYXMg YQ0KPiBjZXJ0aWZpY2F0ZSB2YWxpZCBmb3IgdGhlIFROIHRoZSBjYWxsIGlzIGNsYWltaW5nIHRv IGJlIGZyb20uICBBbnkNCj4gZW50aXR5IG9uIHRoZSBwYXRoIGNhbiBjaGVjaywgbWFraW5nIGFu IGFzc3VtcHRpb24gdGhhdCB0aGUNCj4gaGVhZGVyL2JvZHkgd29uJ3QgYmUgc3RyaXBwZWQgKHdo aWNoIGNvdWxkIGJlIGEgYmFkIGFzc3VtcHRpb24sIGJ1dA0KPiB0aGVyZSBhcmUgbm8gcHJvdG9j b2wgcG9saWNlKS4NCj4NCj4gSWYgYW55b25lIHRoaW5rcyB0aGVyZSBpcyB0ZXh0IGluIGFueSBv ZiBvdXIgZG9jdW1lbnRzIHRoYXQgdGhleQ0KPiBiZWxpZXZlIGRvZXNuJ3QgYWxsb3cgdGhhdCwg cGxlYXNlIHNwZWNpZnkgd2hlcmUsIGFuZCBJJ20gc3VyZSB3ZSBjYW4gZml4IGl0Lg0KPg0KPiBU aGUgbWVjaGFuaXNtIGlzIGRlc2lnbmVkIHRvIGFsbG93IHRoZSBvcmlnaW5hdGlvbiBuZXR3b3Jr LCBvciB0aGUNCj4gb3JpZ2luYXRpb24gZGV2aWNlLCB0byBnZW5lcmF0ZSBhIHZhbGlkIHNpZ25h dHVyZS4gIEl0J3MgZGVzaWduZWQgdG8NCj4gbGV0IGFueSBlbGVtZW50IG9uIHRoZSBwYXRoIGNo ZWNrIHRoZSBzaWduYXR1cmUgKGFuZCB0aHVzIHRoZQ0KPiBjZXJ0aWZpY2F0ZSB1c2VkIHRvIHNp Z24gaXQpIGZvciB2YWxpZGl0eS4NCj4NCj4gSSBoYXZlIHN1Z2dlc3RlZCB0aGF0IGEgdXNlZnVs IHdheSB0byBkZXBsb3kgaXQgaXMgdG8gaGF2ZQ0KPiBpbnRlcmNvbm5lY3Rpb24gYWdyZWVtZW50 cyBiZXR3ZWVuIHNlcnZpY2UgcHJvdmlkZXJzIG1vZGlmaWVkIHRvDQo+IHJlcXVpcmUgYSBjZXJ0 YWluIHBlcmNlbnRhZ2Ugb2YgdmFsaWRseSBzaWduZWQgY2FsbHMgYnkgYSBjZXJ0YWluDQo+IGRh dGUsIHJhdGNoZXRpbmcgdXAgdGhlIHBlcmNlbnRhZ2Ugb3ZlciB0aW1lLiAgSWYgdGhhdCBpbmNs dWRlZA0KPiBjaGVja2luZyBhdCB0cmFuc2l0IG5ldHdvcmsgaW50ZXJjb25uZWN0cywgZXZlbiBp ZiB0aGUgcGF0aCBkb3duc3RyZWFtDQo+IG9mIHRoYXQgbmV0d29yayBoYWQgU1M3IGxpbmtzLCB3 ZSB3b3VsZCBnYWluIG1vc3Qgb2YgdGhlIGJlbmVmaXQgb2Ygc3Rpci4NCj4NCj4gUGxlYXNlIG5v dGUgdGhhdCB3aGlsZSB3ZSBkbyB3YW50IHRvIGdldCB0aGUgY2FsbCB0cmVhdG1lbnQgbW9kaWZp ZWQNCj4gZGVwZW5kaW5nIG9uIHRoZSBvdXRjb21lIG9mIHZlcmlmaWNhdGlvbiBvZiB0aGUgc2ln bmF0dXJlLCB0aGUNCj4gZ3JlYXRlc3QgdmFsdWUgY29tZXMgZnJvbSB0aGUgYWJpbGl0eSBvZiB0 aGUgYXV0aG9yaXRpZXMgdG8gdHJhY2sgdGhlDQo+IHNvdXJjZSBvZiBjYWxscyBiYWNrIHRvIHRo ZSBvcmlnaW5hdG9yLiAgQnkgcmVxdWlyaW5nIGNhbGxzIHRvIGhhdmUNCj4gdmFsaWQgc2lnbmF0 dXJlcyBhdCBuZXR3b3JrIGludGVyY29ubmVjdGlvbnMsIHdlIHByb3ZpZGUgYSB0cmFja2luZw0K PiBtZWNoYW5pc20gYmFjayB0byB0aGUgb3JpZ2luYXRpb24gbmV0d29yaywgYW5kIHRoYXQgd2ls bCByZWFsbHkgaGVscA0KPiBxdWl0ZSBhIGJpdC4gIEl0J3MgbXkgb3BpbmlvbiB0aGF0IGlmIGEg bGFyZ2UgbnVtYmVyIG9mICJiYWQiIGNhbGxzDQo+IGNvbWUgZnJvbSBuZXR3b3JrcyB0aGF0IHBl cm1pdCBjYWxsIG9yaWdpbmF0aW9uIGZyb20gZXNzZW50aWFsbHkNCj4gYW5vbnltb3VzIGN1c3Rv bWVycywgdGhhdCB0aGUgYXV0aG9yaXRpZXMgd2lsbCB0YWtlIHN0ZXBzIHRvIHJlaW4gaW4gc3Vj aCBuZXR3b3JrcywgYnV0IHRoYXQncyBqdXN0IGFuIG9waW5pb24uDQo+DQo+IEJyaWFuDQo+DQo+ PiBPbiBBdWcgMTUsIDIwMTYsIGF0IDEwOjQ0IEFNLCBEYXZlIENyb2NrZXIgPGRoY0BkY3JvY2tl ci5uZXQ+IHdyb3RlOg0KPj4NCj4+IE9uIDgvMTUvMjAxNiA3OjIxIEFNLCBHb3JtYW4sIFBpZXJj ZSBBIFtDVE9dIHdyb3RlOg0KPj4+IE15IHBlcnNvbmFsIHZpZXcgYWdyZWVzIHdpdGggeW91cnMg dGhhdCB0aGVyZSBzZWVtcyB0byBiZSBhbg0KPj4+IGV4cGVjdGF0aW9uIHRoYXQgU1RJUiB3aWxs IG9wZXJhdGUgb24gZW5kcG9pbnRzIGluIGFuIGVuZC10by1lbmQNCj4+PiBmYXNoaW9uIHdoZW4g aW4gZmFjdCwgdG8gaGF2ZSBhbnkgaG9wZSBvZiBuZWFyZXIgdGVybSBkZXBsb3ltZW50IG9mDQo+ Pj4gYW55dGhpbmcgaG9wZWZ1bGx5IGFwcHJvYWNoaW5nIGNyaXRpY2FsIG1hc3MgKGFuZCBldmVu IHRoZW4gdGhlcmUNCj4+PiBhcmUgdmVyeSBiaWcgY2hhbGxlbmdlcyksIHRoZSBjYXJyaWVycyB3 aWxsIGJlIHJlcXVpcmVkIHRvIGRvIHRoZQ0KPj4+IGtleSBtYW5hZ2VtZW50LCB0aGUgc2lnbmlu ZywgYW5kIHRoZSBpbnRlcnByZXRhdGlvbiBvZiBzaWduYXR1cmVzLg0KPj4NCj4+IFRoZXJlIGlz IGEgZGlmZmVyZW5jZSBiZXR3ZWVuIGFuIGFyY2hpdGVjdHVyZSB0aGF0IC9yZXF1aXJlcy8NCj4+ IG9wZXJhdGlvbg0KPiB3aXRoaW4gdGhlIGluZnJhc3RydWN0dXJlLCB2ZXJzdXMgb25lIHRoYXQg cGVybWl0cyB0aGUgY2hvaWNlIG9mDQo+IG9wZXJhdGlvbiBhdCB0aGUgZW5kLXBvaW50cyBhbmQv b3Igd2l0aGluIHRoZSBpbmZyYXN0cnVjdHVyZS4NCj4+DQo+PiBGb3IgZXhhbXBsZSwgdGhlIGN1 cnJlbnQgZGlzY3Vzc2lvbnMgSSd2ZSBoZWFyZCBhYm91dCB0aGUgb3BlcmF0aW9uYWwNCj4+IG9m DQo+IHRoZSBrZXkgcXVlcnkvdmFsaWRhdGlvbiBtZWNoYW5pc20gZm9yIFNUSVIgaXMgdGhhdCBp dCB3aWxsIG9wZXJhdGUNCj4gd2l0aGluIHRoZSBpbnRlci1wcm92aWRlciBpbmZyYXN0cnVjdHVy ZSwgd2l0aCBubyBkaXJlY3QgYWNjZXNzDQo+IGFsbG93ZWQgZm9yIGVuZC1zeXN0ZW1zICh0aGF0 IGFyZSBub3QgY29udHJvbGxlZCBieSBhIHBhcnRpY2lwYXRpbmcNCj4gcHJvdmlkZXIuKSBUaGF0 J3MgYSBtYWpvciBhcmNoaXRlY3R1cmFsIGNob2ljZSBhbmQgcHJlY2x1ZGVzIHRoZQ0KPiBsb25n LXRlcm0gb3B0aW9uIG9mIGRpcmVjdCBwYXJ0aWNpcGF0aW9uIGJ5IHRob3NlIGluZGVwZW5kZW50 IHVzZXINCj4gYWdlbnRzLiAgSW5zdGVhZCBpdCByZXF1aXJlcyB0aGVtIHRvIGJlIHNsYXZlZCB0 byB0aGVpciBwcm92aWRlci4NCj4+DQo+PiBCeSBjb250cmFzdCwgREtJTSBhbGxvd3Mgc2lnbmlu ZyBhbmQvb3IgdmVyaWZ5aW5nIGJ5IGFueSBlbnRpdHkgaW4NCj4+IHRoZQ0KPiBzZXF1ZW5jZSwg ZXZlbiB0aG91Z2ggYWN0dWFsIG9wZXJhdGlvbiBpcyAoY3VycmVudGx5KSBlbnRpcmVseSB3aXRo aW4NCj4gdGhlIE1UQSBpbmZyYXN0cnVjdHVyZS4NCj4+DQo+Pg0KPj4+IFdoYXQgaXMgc2lnbmVk IGFuZCBob3cgaXQgaXMgaW50ZXJwcmV0ZWQgYXJlIGNyaXRpY2FsIHBpZWNlcyBvZg0KPj4+IGlu Zm9ybWF0aW9uIGFuZCBuZWVkIHRvIGJlIGtlcHQgZXh0cmVtZWx5IHNpbXBsZSBvciwgSU1ITywg dGhpcyB3aWxsDQo+Pj4gYmUgYXMgYmlnIG1lc3MgYXMgeW91J3ZlIHRyaWVkIHRvIHdhcm4uICBB bmQgb2YgY291cnNlIHRoZXNlDQo+Pj4gY3JpdGljYWwgcGllY2VzIHdpbGwgbm90IGJlIHByb3Zp ZGVkIGhlcmUuDQo+Pg0KPj4gU3BlY2lmaWNhdGlvbiBvZiB0aGUgY29yZSBpbmZvcm1hdGlvbiB0 byBiZSBzaWduZWQgaXMgc29tZXRoaW5nIHRoYXQNCj4gcHJvZm91bmRseSBhZmZlY3RzIHRoZSBz ZWN1cml0eSBwcm9wZXJ0aWVzIG9mIHRoZSBzZXJ2aWNlLiAgVGhhdCdzIGENCj4gdGVjaG5pY2Fs IHBvaW50LiAgVG8gdGhlIGV4dGVudCB0aGUgc3BlY2lmaWNhdGlvbiBkZWZlcnMgdGhpcyBjaG9p Y2UsDQo+IGl0IG5lZWRzIHRvIG1ha2UgdmVyeSBjbGVhciBzdGF0ZW1lbnRzIGFib3V0IHRoZSBj aG9pY2VzIGFuZCB0aGUNCj4gZWZmZWN0cyBvZiB0aG9zZSBjaG9pY2VzLg0KPj4NCj4+DQo+Pj4g QXMgZmFyIGFzICJvdXQtb2Ytc2NvcGUgZGVwZW5kZW5jaWVzIiBJJ2xsIHN1Z2dlc3QgdGhhdCBo b3cga2V5cyBhcmUNCj4+PiBtYW5hZ2VkLCB3aGF0IGlzIHNpZ25lZCwgYW5kIGhvdyB0aGUgc2ln bmF0dXJlcyBzaG91bGQgYmUNCj4+PiBpbnRlcnByZXRlZCBhcmUgdGhlIGJpZyAzIHRoYXQgb2Nj dXIgdG8gbWUuDQo+Pg0KPj4gWW91IGJlbGlldmUgdGhlcmUgc2hvdWxkIGJlIG5vIHN0YW5kYXJk aXplZCB0ZWNobmljYWwgc3BlY2lmaWNhdGlvbg0KPj4gZm9yDQo+IHRoZSBrZXkgbWFuYWdlbWVu dCBpbmZyYXN0cnVjdHVyZT8gIFRoaXMgaXMgdGhlIGhpZ2hlc3QtcmlzayBjb21wb25lbnQNCj4g b2YgdGhlIHNlcnZpY2UgYW5kIGl0IG5lZWRzIHRvIGJlIGludGVyb3BlcmFibGUgYXQgYSBnbG9i YWwgc2NhbGUuDQo+IEhvdyBlbHNlIHdpbGwgdGhhdCBpbnRlcm9wZXJhYmlsaXR5IGJlIGFjaGll dmVkPw0KPj4NCj4+IEFsc28sIHdoYXQgZG8geW91IG1lYW4gImhvdyB0aGUgc2lnbmF0dXJlcyBz aG91bGQgYmUgaW50ZXJwcmV0ZWQiPw0KPj4NCj4+IElmIHlvdSBtZWFuIHRoZSBkaXJlY3Qgc2Vt YW50aWNzIG9mIGEgc2lnbmF0dXJlLCBzdWNoIGFzIG1lYW5pbmcgdGhhdA0KPj4gdGhlDQo+IHJl cXVlc3QgaXMgdmFsaWQgdnMuIHRoZSByZXF1ZXN0IHdhcyBwcm9jZXNzZWQgYnkgdGhlIHNpZ25l ciwgSSdsbA0KPiBzdHJvbmdseSB1cmdlIHlvdSB0byByZWNvbnNpZGVyLCBzaW5jZSB0aGF0J3Mg YW4gZXNzZW50aWFsIHRlY2huaWNhbA0KPiBwb2ludCBhbmQgbmVlZHMgdG8gYmUgc3RhbmRhcmRp emVkLiAgRmFpbHVyZSB0byBoYXZlIHRoZSBzZW1hbnRpYyBvZg0KPiB0aGUgc2lnbmF0dXJlIC0t IGl0J3MgJ21lYW5pbmcnIC0tIGJlIGNsZWFyIGluIHRoZSB0ZWNobmljYWwNCj4gc3BlY2lmaWNh dGlvbiBoYXMgZGVtb25zdHJhYmx5IGNhdXNlZCBzZXJpb3VzIG9wZXJhdGlvbmFsIHByb2JsZW1z Lg0KPj4NCj4+IElmIHlvdSBtZWFuICJob3cgdGhlIHJlc3VsdHMgb2YgYSB2YWxpZGF0aW9uIGFy ZSB1c2VkIGJ5IHRoZQ0KPj4gdmVyaWZ5aW5nDQo+IGVudGl0eSIsIHRoZW4geWVzIGluZGVlZCwg dGhhdCdzIGFuIGVudGlyZWx5IHNlcGFyYXRlIGFyZWEgb2Ygd29yay4NCj4+DQo+Pg0KPj4NCj4+ IGQvDQo+Pg0KPj4NCj4+IC0tDQo+Pg0KPj4gRGF2ZSBDcm9ja2VyDQo+PiBCcmFuZGVuYnVyZyBJ bnRlcm5ldFdvcmtpbmcNCj4+IGJiaXcubmV0DQo+Pg0KPj4gX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+IHN0aXIgbWFpbGluZyBsaXN0DQo+PiBzdGly QGlldGYub3JnDQo+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXIN Cj4NCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4g c3RpciBtYWlsaW5nIGxpc3QNCj4gc3RpckBpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4NCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KDQpUaGlzIGUtbWFpbCBtYXkgY29udGFpbiBTcHJpbnQgcHJvcHJpZXRhcnkgaW5m b3JtYXRpb24gaW50ZW5kZWQgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgcmVjaXBpZW50KHMpLiBB bnkgdXNlIGJ5IG90aGVycyBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5k ZWQgcmVjaXBpZW50LCBwbGVhc2UgY29udGFjdCB0aGUgc2VuZGVyIGFuZCBkZWxldGUgYWxsIGNv cGllcyBvZiB0aGUgbWVzc2FnZS4NCg== From nobody Mon Aug 15 09:15:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8090012D0EF for ; Mon, 15 Aug 2016 09:15:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rw4JxpBvZOza for ; Mon, 15 Aug 2016 09:15:35 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id D9BAC12D0F5 for ; Mon, 15 Aug 2016 09:15:31 -0700 (PDT) Received: (qmail 2253 invoked by uid 0); 15 Aug 2016 16:15:31 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy4.mail.unifiedlayer.com with SMTP; 15 Aug 2016 16:15:31 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id XUAU1t01g1MNPNq01UAX1J; Mon, 15 Aug 2016 10:10:31 -0600 X-Authority-Analysis: v=2.1 cv=LOD1Hvm9 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=9fpc_yjdAAAA:8 a=k7Ga1wGzAAAA:8 a=izV7ms69AAAA:8 a=b8OvNEjoAAAA:8 a=7dcrYEKpQsBCm1KSAfgA:9 a=AbpaGIT2a46Il2TU:21 a=FIED0aZ7aQPIophb:21 a=QEXdDO2ut3YA:10 a=JVdSDjBteiwA:10 a=L_4-vVooG6gA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=pIvAo3swFcmB_yUFupqo:22 a=ijMaxGghyylP-n2pFjDB:22 a=jg1oa_xp17rrhcbVgaY4:22 a=xfJ8-ueq0pyqlCF7aVox:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=+7X5B3sKt3omUlFDUQlMQA8GaDGWirKBbsR+yy00F+Y=; b=dU8YJ0KnE93tqI9rcmfnQuyq/E lc70xk4H3ToC4TxxGN4u4TUJTD+XktRmtVpI6lcItLjF9gWrOoQJPGosZLKaLAnnRPUhXAT/pLFZ0 S/9N+QgTCC84pXSJNhVZd9Flj; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:52997 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bZKT6-0004kc-KW; Mon, 15 Aug 2016 10:10:28 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Mon, 15 Aug 2016 12:10:26 -0400 From: Richard Shockey To: David Frankel , 'Brian Rosen' , Message-ID: <90A461F8-03C5-46AB-82A1-3305E6D7C6E2@shockey.us> Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> In-Reply-To: <041401d1f709$09511490$1bf33db0$@zipdx.com> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bZKT6-0004kc-KW X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:52997 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: stir@ietf.org, "'Gorman, Pierce A \[CTO\]'" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 16:15:38 -0000 On 8/15/16, 11:23 AM, "stir on behalf of David Frankel" wrote: Thanks for that clarification, Brian. You say you "don't think there is= any disagreement on how we're going to deploy stir" but part of my challeng= e (and for others too, I think) is that many of us don't know the details= of that "how" because, while the documents don't LIMIT what's done, they a= lso are necessarily incomplete (thanks to things like country-specific deployment issues being out of scope). =20 Let me ask for your help with this example; correct me if I am wrong on= any of the below: =20 My telephone number is +1-212-555-1234 and my service provider is AT&T. Presumably there is some USA-specific mechanism that says that AT&T is = the authority for the certificate for my number (based, I would think, on t= he number portability database and/or the LERG). RS> We are not there yet but the mechanisms are in place right now that can= identify any TN and its underlying LRN to the service provider of authority= . OCN whatever. That=E2=80=99s how LEA=E2=80=99s trace calls. Binding that to a private= key will be the task at hand for the industry to agree to. In general, tha= t generally holds true for numbers assigned to 2nd parties in the wholesale = carrier market. That is how SKYPE and others get numbers. Vonage is differe= nt in the US it has direct access to the NANP by Report and Order of the FCC= and the procedure for non-facilities based carriers to get NANP numbers is = now a routine administrative procedure. Don=E2=80=99t even get me started about = 800 toll free. Who gets phone numbers and why is the exclusive plenary auth= ority of nation states. I can quote you chapter and verse of the relevant st= atutes. =20 Dave you know all of this =E2=98=BA but it=E2=80=99s a useful reminder to those that = are fundamentally unaware of how the phone system is fundamentally different= from other internet protocols.=20 =20 When I place an outbound call under "normal" circumstances, AT&T will s= ign that call for me and send it on its way. Anybody in the call path can s= ee that the call claims to be from +1-212-555-1234, do a number portabilit= y look-up to see that it's an AT&T number, and then somehow know to go to AT&T's certificate authority API to do what it takes to verify the signature? (Or maybe there is a consolidated place where AT&T deposits = that information, along with other carriers, and providers along the call pa= th can just go there to check?) RS> TBD but we do think that many of the public keys will be cached under m= utually acceptable terms and conditions. TTL etc. =20 In any case, for this part of the example, anybody along the path, incl= uding the termination point, can know that the call is legit. RS> Correct. =20 Now, I can engage a call center to make some outbound calls on my behal= f. (I know this use case has been raised many times.) The call center I have chosen uses Verizon as their outbound carrier. So I go to AT&T and ask = them for the certificate for my number; they give that to me and I pass it t= o my call center. So now they place calls, via Verizon, and either the call center (probably) or Verizon (less likely) uses my certificate to authenticate the outbound calls they make on my behalf, claiming (legitimately) to be from +1-212-555-1234. RS> You are going too far too fast. How that scenario might be enabled is= an operational profile yet to be determined. It=E2=80=99s understood but we are = trying to build rings of defense here. It is not necessary to outline every = single corner case on Day 1 and in any event none of those decisions will NO= T be made in the IETF. First lets get the core protocols wrapped up then ho= pefully hit PAUSE so we can get some operational experience here. =20 Again, anybody in the call path can authenticate the call, seeing that = it is an authorized use of my AT&T number. =20 When the call arrives at the terminating end, they see that the call is legit. And although it is an AT&T number, they have no clue that it was originated on Verizon's network. =20 Is that all close to correct? =20 David Frankel ZipDXR LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! =20 -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: Monday, August 15, 2016 8:05 AM To: dcrocker@bbiw.net Cc: stir@ietf.org; Gorman, Pierce A [CTO] Subject: Re: [stir] Setting Expectations regarding STIR Deployment Real= ities =20 I don't think there is any disagreement on how we're going to deploy st= ir, nor is there any specification that limits or even influences it. =20 We're going to start deployment at the service provider. We're going t= o evolve to deployment on the device. There are some participants who th= ink deployment on the device is never going to happen, but they don't oppos= e it, they are just skeptical it will happen. =20 All the documents we have allow generation by any entity that has a certificate valid for the TN the call is claiming to be from. Any enti= ty on the path can check, making an assumption that the header/body won't be stripped (which could be a bad assumption, but there are no protocol police). =20 If anyone thinks there is text in any of our documents that they believ= e doesn't allow that, please specify where, and I'm sure we can fix it. =20 The mechanism is designed to allow the origination network, or the origination device, to generate a valid signature. It's designed to le= t any element on the path check the signature (and thus the certificate used = to sign it) for validity. =20 I have suggested that a useful way to deploy it is to have interconnect= ion agreements between service providers modified to require a certain percentage of validly signed calls by a certain date, ratcheting up the percentage over time. If that included checking at transit network interconnects, even if the path downstream of that network had SS7 link= s, we would gain most of the benefit of stir.=20 =20 Please note that while we do want to get the call treatment modified depending on the outcome of verification of the signature, the greatest value comes from the ability of the authorities to track the source of = calls back to the originator. By requiring calls to have valid signatures at network interconnections, we provide a tracking mechanism back to the origination network, and that will really help quite a bit. It's my op= inion that if a large number of "bad" calls come from networks that permit ca= ll origination from essentially anonymous customers, that the authorities = will take steps to rein in such networks, but that's just an opinion. =20 Brian =20 > On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: >=20 > On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >> My personal view agrees with yours that there seems to be an=20 >> expectation that STIR will operate on endpoints in an end-to-end=20 >> fashion when in fact, to have any hope of nearer term deployment of=20 >> anything hopefully approaching critical mass (and even then there ar= e=20 >> very big challenges), the carriers will be required to do the key=20 >> management, the signing, and the interpretation of signatures. >=20 > There is a difference between an architecture that /requires/ operati= on within the infrastructure, versus one that permits the choice of operat= ion at the end-points and/or within the infrastructure. >=20 > For example, the current discussions I've heard about the operational= of the key query/validation mechanism for STIR is that it will operate wit= hin the inter-provider infrastructure, with no direct access allowed for end-systems (that are not controlled by a participating provider.) That= 's a major architectural choice and precludes the long-term option of direct participation by those independent user agents. Instead it requires th= em to be slaved to their provider. >=20 > By contrast, DKIM allows signing and/or verifying by any entity in th= e sequence, even though actual operation is (currently) entirely within t= he MTA infrastructure. >=20 >=20 >> What is signed and how it is interpreted are critical pieces of=20 >> information and need to be kept extremely simple or, IMHO, this will= =20 >> be as big mess as you've tried to warn. And of course these critica= l=20 >> pieces will not be provided here. >=20 > Specification of the core information to be signed is something that profoundly affects the security properties of the service. That's a technical point. To the extent the specification defers this choice, i= t needs to make very clear statements about the choices and the effects o= f those choices. >=20 >=20 >> As far as "out-of-scope dependencies" I'll suggest that how keys are= =20 >> managed, what is signed, and how the signatures should be interprete= d=20 >> are the big 3 that occur to me. >=20 > You believe there should be no standardized technical specification f= or the key management infrastructure? This is the highest-risk component = of the service and it needs to be interoperable at a global scale. How el= se will that interoperability be achieved? >=20 > Also, what do you mean "how the signatures should be interpreted"? >=20 > If you mean the direct semantics of a signature, such as meaning that= the request is valid vs. the request was processed by the signer, I'll stro= ngly urge you to reconsider, since that's an essential technical point and n= eeds to be standardized. Failure to have the semantic of the signature -- i= t's 'meaning' -- be clear in the technical specification has demonstrably c= aused serious operational problems. >=20 > If you mean "how the results of a validation are used by the verifyin= g entity", then yes indeed, that's an entirely separate area of work. >=20 >=20 >=20 > d/ >=20 >=20 > -- >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Mon Aug 15 09:17:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D4E312D0EF for ; Mon, 15 Aug 2016 09:17:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VsjuET1DEco0 for ; Mon, 15 Aug 2016 09:17:06 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9212D12D522 for ; Mon, 15 Aug 2016 09:16:57 -0700 (PDT) Received: from pps.filterd (m0049295.ppops.net [127.0.0.1]) by m0049295.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7FG9GUt034108; Mon, 15 Aug 2016 12:16:55 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049295.ppops.net-00191d01. with ESMTP id 24uf4uykqy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 12:16:54 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7FGGqah030067; Mon, 15 Aug 2016 12:16:53 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7FGGiGj029772 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 15 Aug 2016 12:16:46 -0400 Received: from MISOUT7MSGHUBAE.ITServices.sbc.com (MISOUT7MSGHUBAE.itservices.sbc.com [130.9.129.149]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Mon, 15 Aug 2016 16:16:31 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAE.ITServices.sbc.com ([130.9.129.149]) with mapi id 14.03.0301.000; Mon, 15 Aug 2016 12:16:31 -0400 From: "DOLLY, MARTIN C" To: "Gorman, Pierce A [CTO]" Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMwgABOlICAAAXBgIAABVoAgAAHLYCAAAR1AP//wANw Date: Mon, 15 Aug 2016 16:16:30 +0000 Message-ID: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_E2FBCBCA1DA14A44B58BA8FB95727BA3attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-15_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608150177 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , David Frankel , Brian Rosen Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 16:17:07 -0000 --_000_E2FBCBCA1DA14A44B58BA8FB95727BA3attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable IP-NNI SHAKEN uses a pool of certs per operator, not cert per TN I believe there may be certain TBD use cases that may warrant cert for thos= e TNs Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 15, 2016, at 12:11 PM, Gorman, Pierce A [CTO] > wrote: identity. --_000_E2FBCBCA1DA14A44B58BA8FB95727BA3attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
IP-NNI SHAKEN uses a pool of certs per operator, not cert per TN

I believe there may be certain TBD use cases= that may warrant cert for those TNs 

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 15, 2016, at 12:11 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

identity.
--_000_E2FBCBCA1DA14A44B58BA8FB95727BA3attcom_-- From nobody Mon Aug 15 09:37:46 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE43712D900 for ; Mon, 15 Aug 2016 09:37:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fZMOLnUz9dUV for ; Mon, 15 Aug 2016 09:37:42 -0700 (PDT) Received: from qproxy1-pub.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id E7FA812D967 for ; Mon, 15 Aug 2016 09:37:32 -0700 (PDT) Received: (qmail 16228 invoked by uid 0); 15 Aug 2016 16:37:31 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy1.mail.unifiedlayer.com with SMTP; 15 Aug 2016 16:37:31 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id XUYT1t00i1MNPNq01UYWsE; Mon, 15 Aug 2016 10:32:30 -0600 X-Authority-Analysis: v=2.1 cv=KaJB72oD c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=48vgC7mUAAAA:8 a=izV7ms69AAAA:8 a=W3Fe57fLAAAA:8 a=HLLxP2VMAAAA:8 a=9fpc_yjdAAAA:8 a=k7Ga1wGzAAAA:8 a=b8OvNEjoAAAA:8 a=2bxCgvBtNtNnhoKxqIIA:9 a=1Z6iFkFfkiLifujG:21 a=jvPD6SbdLZGA3PEh:21 a=QEXdDO2ut3YA:10 a=JVdSDjBteiwA:10 a=L_4-vVooG6gA:10 a=uWIDhNom1z4A:10 a=w1C3t2QeGrPiZgrLijVG:22 a=jg1oa_xp17rrhcbVgaY4:22 a=sPnIFPdooxIL6hyxNEsT:22 a=5oret6oapBRfLy7jekVI:22 a=pIvAo3swFcmB_yUFupqo:22 a=ijMaxGghyylP-n2pFjDB:22 a=xfJ8-ueq0pyqlCF7aVox:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=QMSFust0VLImMLSoh5nkj7oFXOFuEfOT1ohrCZVQ0qM=; b=EtPfT9W9mbvh4y7RZ/0HYXkpYB pTzebQWJK6AYsSEG69VDfLutQsjVoXcSwlcciPa0eKKUrTGr/aVFUY1cze4qZ9+I9fJBytrk/AV4P tkG0G/qEbEBCYA8j6QDxd3Dsk; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:53074 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bZKoP-0000V9-3x; Mon, 15 Aug 2016 10:32:29 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Mon, 15 Aug 2016 12:32:26 -0400 From: Richard Shockey To: "Gorman, Pierce A [CTO]" , Brian Rosen , David Frankel Message-ID: Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bZKoP-0000V9-3x X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:53074 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 16:37:46 -0000 On 8/15/16, 12:05 PM, "stir on behalf of Gorman, Pierce A [CTO]" wrote: IMHO per-TN certs are not cacheable, and CRLs would/will be unusable an= d the result would/will be horrible. =20 From: www.infoworld.com/article/3000574/security/the-sorry-state-of-ce= rtificate-revocation.html RS> +1 =20 =20 "To most users, one of the biggest problems with PKI is invisible: the = broken certificate revocation process. Digital certificates are supposed to = be revoked when their private keys become compromised or for some other reas= on shouldn't be trusted or used, as determined by the certification authorit= y (CA) that authorized the certificate. A revoked certificate is supposed to= be the same as no certificate. =20 But what actually happens is that most CA admins never revoke certifica= tes, even when they should. Alternatively, people keep using revoked certifi= cates and no one notices. Even more common, the certificate gets revoked, bu= t the software (or the user) doesn't bother to check. Worse still, the softw= are looks to see if the certificate is revoked, can't validate it one way or= another, then fails open as if the certificate is good and valid (when the = opposite is supposed to happen)." =20 What seems workable to me is per-carrier certs with few CAs (two?) and = limited delegation, and limited/variable application depending upon the leve= l of trustworthiness of the calling number as determined by standard and/or = industry best practice. If a subscriber's device can be authenticated to th= e network with a high-degree of certainty, then it's calling number(s) shoul= d receive the highest "level" of authenticity and not otherwise. RS> You are absolutely correct. And that vision is exactly what some of us = think will happen. How that will happen will require a whole bunch of us en= gineers to suit up, lawyer up and sit down with our regulatory friends. Ther= e are any number structural vehicles that could work and of course it=E2=80=99s co= mplicated due to the nature of the NANP itself. What our Canadian Caribbean= friends want to do is entirely up to them. How the UK wants to participate= is again entirely up to Her Majesties Government and its duly constituted N= RA.=20 =20 Is it possible, using STIR, to apply multiple signatures? It seems pos= sible a terminating (or even transit) carrier might want to change or at lea= st apply a different level of authenticity, while still preserving the origi= nating carrier identity. RS> There are some highly unique corner cases where multiple claims can be= applied to the same number by multiple entities, which is just one more rea= son the STIR construct is superior to any form of DKIM/DANE. =20 =20 Pierce =20 =20 -----Original Message----- From: Brian Rosen [mailto:br@brianrosen.net] Sent: August 15, 2016 10:50 AM To: David Frankel Cc: dcrocker@bbiw.net; stir@ietf.org; Gorman, Pierce A [CTO] Subject: Re: [stir] Setting Expectations regarding STIR Deployment Real= ities =20 =20 > On Aug 15, 2016, at 11:23 AM, David Frankel wrot= e: > > Thanks for that clarification, Brian. You say you "don't think there > is any disagreement on how we're going to deploy stir" but part of my > challenge (and for others too, I think) is that many of us don't know > the details of that "how" because, while the documents don't LIMIT > what's done, they also are necessarily incomplete (thanks to things > like country-specific deployment issues being out of scope). > > Let me ask for your help with this example; correct me if I am wrong > on any of the below: > > My telephone number is +1-212-555-1234 and my service provider is AT&= T. > Presumably there is some USA-specific mechanism that says that AT&T i= s > the authority for the certificate for my number (based, I would think= , > on the number portability database and/or the LERG). This really is country specific, but stir is based on the notion that i= n every country, there is a delegation process for telephone numbers, and wh= ether that is entirely controlled by the regulator, or has some informal mec= hanisms as well, delegation happens in a way that we can exploit, by issuing= or modifying a credential when that delegation happens. =20 So, if AT&T was delegated a block of numbers from the regulator, and de= legated that number to you, then it would have a credential for your number,= and, hopefully, at least at some point, so will you. =20 > > When I place an outbound call under "normal" circumstances, AT&T will > sign that call for me and send it on its way. Anybody in the call pat= h > can see that the call claims to be from +1-212-555-1234, do a number > portability look-up to see that it's an AT&T number, and then somehow > know to go to AT&T's certificate authority API to do what it takes to > verify the signature? (Or maybe there is a consolidated place where > AT&T deposits that information, along with other carriers, and > providers along the call path can just go there to check?) Again, part of this is country specific because of the ways delegation = is done, but the idea is that you can determine from the credential used to = sign the call whether that certificate is good for that number. You can que= ry the signer of the cert, and it can tell you if that cert is valid for tha= t number. And of course since it is a PKI, you can do the same with the sig= ner of the CA=E2=80=99s cert, and track back to the root CA for the country the nu= mber is part of. =20 > > In any case, for this part of the example, anybody along the path, > including the termination point, can know that the call is legit. Yes, as long as by =E2=80=9Clegit=E2=80=9D you mean that the signaling contains a s= ignature using a credential valid for the TN the call claims to be from. =20 > > Now, I can engage a call center to make some outbound calls on my > behalf. (I know this use case has been raised many times.) The call > center I have chosen uses Verizon as their outbound carrier. So I go > to AT&T and ask them for the certificate for my number; they give tha= t > to me and I pass it to my call center. So now they place calls, via > Verizon, and either the call center (probably) or Verizon (less > likely) uses my certificate to authenticate the outbound calls they > make on my behalf, claiming > (legitimately) to be from +1-212-555-1234. If we get to where we want to get to, you ask AT&T for a cert valid for= the number they delegated to you, and then you sign a cert for the call cen= ter using your cert, or maybe you ask the CA that issued your cert to do tha= t. =20 As a practical matter, you ask AT&T to issue (or cause to be issued) a = credential to the call center that they use to send calls on the Verizon net= work. =20 =20 > > Again, anybody in the call path can authenticate the call, seeing tha= t > it is an authorized use of my AT&T number. Yes =20 > > When the call arrives at the terminating end, they see that the call > is legit. And although it is an AT&T number, they have no clue that i= t > was originated on Verizon's network. Yes, assuming that the call center signed the call, rather than Verizon= on behalf of the call center. I think that most networks probably won=E2=80=99t = want to sign for the call center, but they probably will accept, possibly ch= eck, and forward the Identity header and body from the call center. =20 > > Is that all close to correct? Uh huh =20 > > David Frankel > ZipDXR LLC > Monte Sereno, CA USA > Tel: 1-800-FRANKEL (1-800-372-6535) > Watch Our Video! > > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen > Sent: Monday, August 15, 2016 8:05 AM > To: dcrocker@bbiw.net > Cc: stir@ietf.org; Gorman, Pierce A [CTO] > Subject: Re: [stir] Setting Expectations regarding STIR Deployment > Realities > > I don't think there is any disagreement on how we're going to deploy > stir, nor is there any specification that limits or even influences i= t. > > We're going to start deployment at the service provider. We're going > to evolve to deployment on the device. There are some participants > who think deployment on the device is never going to happen, but they > don't oppose it, they are just skeptical it will happen. > > All the documents we have allow generation by any entity that has a > certificate valid for the TN the call is claiming to be from. Any > entity on the path can check, making an assumption that the > header/body won't be stripped (which could be a bad assumption, but > there are no protocol police). > > If anyone thinks there is text in any of our documents that they > believe doesn't allow that, please specify where, and I'm sure we can= fix it. > > The mechanism is designed to allow the origination network, or the > origination device, to generate a valid signature. It's designed to > let any element on the path check the signature (and thus the > certificate used to sign it) for validity. > > I have suggested that a useful way to deploy it is to have > interconnection agreements between service providers modified to > require a certain percentage of validly signed calls by a certain > date, ratcheting up the percentage over time. If that included > checking at transit network interconnects, even if the path downstrea= m > of that network had SS7 links, we would gain most of the benefit of s= tir. > > Please note that while we do want to get the call treatment modified > depending on the outcome of verification of the signature, the > greatest value comes from the ability of the authorities to track the > source of calls back to the originator. By requiring calls to have > valid signatures at network interconnections, we provide a tracking > mechanism back to the origination network, and that will really help > quite a bit. It's my opinion that if a large number of "bad" calls > come from networks that permit call origination from essentially > anonymous customers, that the authorities will take steps to rein in = such networks, but that's just an opinion. > > Brian > >> On Aug 15, 2016, at 10:44 AM, Dave Crocker wrote: >> >> On 8/15/2016 7:21 AM, Gorman, Pierce A [CTO] wrote: >>> My personal view agrees with yours that there seems to be an >>> expectation that STIR will operate on endpoints in an end-to-end >>> fashion when in fact, to have any hope of nearer term deployment of >>> anything hopefully approaching critical mass (and even then there >>> are very big challenges), the carriers will be required to do the >>> key management, the signing, and the interpretation of signatures. >> >> There is a difference between an architecture that /requires/ >> operation > within the infrastructure, versus one that permits the choice of > operation at the end-points and/or within the infrastructure. >> >> For example, the current discussions I've heard about the operationa= l >> of > the key query/validation mechanism for STIR is that it will operate > within the inter-provider infrastructure, with no direct access > allowed for end-systems (that are not controlled by a participating > provider.) That's a major architectural choice and precludes the > long-term option of direct participation by those independent user > agents. Instead it requires them to be slaved to their provider. >> >> By contrast, DKIM allows signing and/or verifying by any entity in >> the > sequence, even though actual operation is (currently) entirely within > the MTA infrastructure. >> >> >>> What is signed and how it is interpreted are critical pieces of >>> information and need to be kept extremely simple or, IMHO, this wil= l >>> be as big mess as you've tried to warn. And of course these >>> critical pieces will not be provided here. >> >> Specification of the core information to be signed is something that > profoundly affects the security properties of the service. That's a > technical point. To the extent the specification defers this choice, > it needs to make very clear statements about the choices and the > effects of those choices. >> >> >>> As far as "out-of-scope dependencies" I'll suggest that how keys ar= e >>> managed, what is signed, and how the signatures should be >>> interpreted are the big 3 that occur to me. >> >> You believe there should be no standardized technical specification >> for > the key management infrastructure? This is the highest-risk componen= t > of the service and it needs to be interoperable at a global scale. > How else will that interoperability be achieved? >> >> Also, what do you mean "how the signatures should be interpreted"? >> >> If you mean the direct semantics of a signature, such as meaning tha= t >> the > request is valid vs. the request was processed by the signer, I'll > strongly urge you to reconsider, since that's an essential technical > point and needs to be standardized. Failure to have the semantic of > the signature -- it's 'meaning' -- be clear in the technical > specification has demonstrably caused serious operational problems. >> >> If you mean "how the results of a validation are used by the >> verifying > entity", then yes indeed, that's an entirely separate area of work. >> >> >> >> d/ >> >> >> -- >> >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > =20 =20 ________________________________ =20 This e-mail may contain Sprint proprietary information intended for the= sole use of the recipient(s). Any use by others is prohibited. If you are n= ot the intended recipient, please contact the sender and delete all copies o= f the message. _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Mon Aug 15 09:44:33 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D40C212D5D3 for ; Mon, 15 Aug 2016 09:44:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ldhQj93NnWgu for ; Mon, 15 Aug 2016 09:44:30 -0700 (PDT) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A73A12D0A8 for ; Mon, 15 Aug 2016 09:44:30 -0700 (PDT) Received: by mail-qk0-x22c.google.com with SMTP id l2so47382790qkf.3 for ; Mon, 15 Aug 2016 09:44:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=pjowcl0XASvVJam0nEiINSsV9AQXA+nXEX0seuXUL90=; b=Nfw6Ys1KFketywUXvbOQ8RQp4wmuijVujw+FqPABL1h9MQ/nsmId3T+SXngYv3kV55 sss9184oFfXTU8ALdtIZarAZL2FkBwLIChsSuwDo0Gj9D18DSweDhbSOWdF7JbZ1mM40 UDPtMF5owAZ5zryi0aLgiuzIAssAs/aryevTlOvXBYGkYtqKZR94P/a47PgnhL+kcpS/ M2kfg4xIryfpf3BHDMqYNC+CylU7NNajKjKzx+HJPqIajIKOqwQ5HSyDNFcs+AR6WP15 TKF7CWVxkOHFtHQlH8yToDaocX4fsMSBOoP431zblGdmssGwwys+zv5ZGV6o3MD6rBel aqAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=pjowcl0XASvVJam0nEiINSsV9AQXA+nXEX0seuXUL90=; b=ZSG0FI0OSgJcz/x0oYzfhH7tnex8KQlEXIMolGsVCRzC46VHAqpO859j5WKnBxPX/6 aDoBJvYOVLG1E+QiLSi5ATs6zRTi4ur3sTaVu1k54LccgVq7Ec2JCvUBIWpNqp9SauDU I/j2FCCWkzw+fOEnUXqxpmBb6Fdakrx+sSSiJeBQ7KUUnOFAphcliCcNcZM4yme6XLzP dhelixmFuiagqjUpI7SRTkabZFkcXtUjgwnWnz8etv5Ce72JKp40cRqD7uXJdlq/gtUQ W8iyIRKVFL2Q2GRSlRV6v6BEEzF/4w5qTNsj0rjNTWsm1+Mwr9KEPHfE2dnGLiMtIAwh ielA== X-Gm-Message-State: AEkoouuDIAxBbNlJc9umbJxDDKWK+NhLj410s5VHWBg2KZvaoOAkp6QqxW2nLIPDYv5W/Q== X-Received: by 10.55.5.17 with SMTP id 17mr32448973qkf.283.1471279469269; Mon, 15 Aug 2016 09:44:29 -0700 (PDT) Received: from [10.33.192.45] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id v22sm12789071qtc.19.2016.08.15.09.44.28 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Aug 2016 09:44:28 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_A90DA2E0-50E1-486F-85C6-3F511905F4B4" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Mon, 15 Aug 2016 12:44:25 -0400 Message-Id: <548AB7FF-05FE-4B38-92C0-E60F6B64816D@brianrosen.net> References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> To: "DOLLY, MARTIN C" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "Gorman, Pierce A \[CTO\]" , David Frankel , "dcrocker@bbiw.net" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 16:44:32 -0000 --Apple-Mail=_A90DA2E0-50E1-486F-85C6-3F511905F4B4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 +1 The design of the mechanism lets the holder of the cert decide how many = TNs are associated with it. A carrier could have one, or it could have one per TN, or it could have = something in between that. It=E2=80=99s most likely the latter, and = dependent on how the network is built. Note that this doesn=E2=80=99t matter to anyone other that the carrier = and whoever gives the carrier the certs. We are relying on OCSP to tell us whether a cert is currently valid for = a specific TN. Here, we are much more concerned about change in delegation that = compromise of keys. We have to have procedures to manage compromise of = keys, but change in delegation will happen all the time, and key = compromise is, albeit non-zero, at least fairly rare. Another variable that is also outside of IETF work is the lifetime of = the keys. Given the level of automation that will be required to make = the mechanism work well, it=E2=80=99s probably possible to have a = relatively short cert expiration, which limits the damage key compromise = engenders. Brian > On Aug 15, 2016, at 12:16 PM, DOLLY, MARTIN C wrote: >=20 > IP-NNI SHAKEN uses a pool of certs per operator, not cert per TN >=20 > I believe there may be certain TBD use cases that may warrant cert for = those TNs=20 >=20 > Martin C. Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards > AT&T > Cell: +1.609.903.3360 > Email: md3135@att.com > =20 >=20 > On Aug 15, 2016, at 12:11 PM, Gorman, Pierce A [CTO] = > wrote: >=20 >> identity. --Apple-Mail=_A90DA2E0-50E1-486F-85C6-3F511905F4B4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 +1

The = design of the mechanism lets the holder of the cert decide how many TNs = are associated with it.

A carrier could have one, or it could have one per TN, or it = could have something in between that.  It=E2=80=99s most likely the = latter, and dependent on how the network is built.

Note that this doesn=E2=80= =99t matter to anyone other that the carrier and whoever gives the = carrier the certs.

We are relying on OCSP to tell us whether a cert is currently = valid for a specific TN.

Here, we are much more concerned about change in delegation = that compromise of keys.  We have to have procedures to manage = compromise of keys, but change in delegation will happen all the time, = and key compromise is, albeit non-zero, at least fairly rare.

Another variable that is = also outside of IETF work is the lifetime of the keys.  Given the = level of automation that will be required to make the mechanism work = well, it=E2=80=99s probably possible to have a relatively short cert = expiration, which limits the damage key compromise engenders.


Brian

On Aug 15, 2016, at 12:16 PM, = DOLLY, MARTIN C <md3135@att.com> wrote:

IP-NNI SHAKEN uses a pool of certs per operator, not = cert per TN

I believe there may be certain TBD use cases that may = warrant cert for those TNs 

Martin C. Dolly
Lead = Member of Technical Staff
Core = & Government/Regulatory Standards
AT&T
Cell: +1.609.903.3360
 

On Aug 15, 2016, at 12:11 PM, Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com> wrote:

identity.

= --Apple-Mail=_A90DA2E0-50E1-486F-85C6-3F511905F4B4-- From nobody Mon Aug 15 09:46:20 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 054A312D66B for ; Mon, 15 Aug 2016 09:46:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XiPtraKtAAlH for ; Mon, 15 Aug 2016 09:46:16 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0120.outbound.protection.outlook.com [104.47.34.120]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E06812D639 for ; Mon, 15 Aug 2016 09:46:15 -0700 (PDT) Received: from BL2FFO11OLC008.protection.gbl (10.173.160.31) by BL2FFO11HUB006.protection.gbl (10.173.160.226) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Mon, 15 Aug 2016 16:46:14 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.80) smtp.mailfrom=sprint.com; bbiw.net; dkim=none (message not signed) header.d=none;bbiw.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.80 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.80; helo=preapdm1.corp.sprint.com; Received: from preapdm1.corp.sprint.com (144.230.32.80) by BL2FFO11OLC008.mail.protection.outlook.com (10.173.160.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Mon, 15 Aug 2016 16:46:14 +0000 Received: from pps.filterd (preapdm1.corp.sprint.com [127.0.0.1]) by preapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7FGcFxO011023; Mon, 15 Aug 2016 12:46:14 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm1.corp.sprint.com with ESMTP id 24t01e23jx-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 15 Aug 2016 12:46:14 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 15 Aug 2016 11:46:13 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Mon, 15 Aug 2016 11:46:13 -0500 From: "Gorman, Pierce A [CTO]" To: Brian Rosen , "DOLLY, MARTIN C" Thread-Topic: [stir] Setting Expectations regarding STIR Deployment Realities Thread-Index: AQHR9pZQjXO65bdRqkGl4ndoqdtheaBKDkMwgAAd3sqAAACuMIAADp58gAAAaPA= Date: Mon, 15 Aug 2016 16:46:12 +0000 Message-ID: References: <02d201d1f696$49c50130$dd4f0390$@zipdx.com> <44656fb3-a8ce-887d-1aea-919548168cd0@dcrocker.net> <0D20505B-14F5-4E77-A31B-9E5FE4D108ED@brianrosen.net> <041401d1f709$09511490$1bf33db0$@zipdx.com> <548AB7FF-05FE-4B38-92C0-E60F6B64816D@brianrosen.net> In-Reply-To: <548AB7FF-05FE-4B38-92C0-E60F6B64816D@brianrosen.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.38] Content-Type: multipart/alternative; boundary="_000_c962728da9ea477693cb2c5b07c1cfa0PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.80; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(252514010)(24454002)(377454003)(189002)(199003)(4546004)(50986999)(81156014)(8676002)(19580395003)(3846002)(11100500001)(92566002)(626004)(54356999)(2950100001)(2900100001)(106116001)(4326007)(86362001)(2906002)(8936002)(97736004)(33646002)(106466001)(87936001)(108616004)(68736007)(356003)(189998001)(76176999)(325944008)(7846002)(7736002)(81166006)(7696003)(5001770100001)(512874002)(19580405001)(586003)(93886004)(19300405004)(16236675004)(6116002)(24736003)(19625215002)(102836003)(84326002)(790700001)(15975445007)(5250100002); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2FFO11HUB006; H:preapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11OLC008; 1:wCiYmVi3UF0mjXWTTzg+d8tGXUrG1/xVLLEu/t4kRLPJT8t8yEtJGZqU0YA1zajtEl7GjHCyp/8s38DDiAYLKYt1fZHstuu8yBYlrczb2Frbj/12JxDVWNjOr8fi9MFbpJRizyLI0qyffWyiU/EQexid2lijoDwheTr3S2CeGaFblG4EQH1E5N7gkE1cKb8PgiLQZ6cXrUinPJoNKOd3EeQdDqqunO5J5HOKga1nHGtfcag1OTQMESwkHpGCD6+2QlONaio0086nSYstZF/TzuqeLzq56GiFU3quNqaj/+L03B1wpbV08CaiTzblBIMZuJsIE/wSmAKkK7WmBNwAn7sZRBlOKm3ymq9VuOOeJ1Z8oIoINBi4tIMbA2jQiCGaMtURZ8SniDJXXcPZv2hiJCNpqqJnjBTdN5VJ346WAj03MhSJvmGqK0EE/kBltnJgsBToV1mNVuWcVzNSNCe7YndKXZUTkFVwY2KyoWlNwc7alBmRmVwPgT8jcWJnjSOtfrcBJcOfFnLaPXNtDB85daXwSZqOGtLu8T8KYYYEgYObn7cIeRa86+sML4/TLBpF X-MS-Office365-Filtering-Correlation-Id: 4859b137-9f66-4ab9-82c8-08d3c52bac06 X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB006; 2:K/DYnJAnBlLVdljcJcbqNsPp+4oi8MKOqlq86hlrqsq3W1HuEzRO42BUigb0njLta+iw/yHuJu3wH8WU1uHzXmcDxezbbW4gAbfnm4Mx/iixSGm0xB22OoWrGvUSWCWa3K+pgHIlQ6CLIVRH4H7tX1f08Pks5JHsfw1Hru9zPXc2ic2RDxJzufbGFk5OUsJz; 3:SBFYKea7CiUf4j2l4RRme7xIprQakmkOZ+9Kt58pwMY38r/Jx1VLstUaNwYkm5tbpjQ9LIbo/56B/S41ZYZPy1AhR71AKs7EGk5qFacJkak7B6SDriB555uWn/jq/cqrwehOav6pxSvblSgXcvwULXS+6N0hI7Opym3a8swK0L7SyvqbXpHDL/uW8scefmqpfI3xtruGyXadYgpk2+srVBS5rcDwN7bYhS5Fj1fEoVa6K3XjEvVUp16RZbX6mY7zyL7YW0NUfWSH86DWzYBypA==; 25:1FlFhWyUUaZBQc8/TD189QQsdGOV/w5YvJQeWykqQgTrsKAmpBYyxguFU2PsezR6Vjwu98LJI/YX6ZA3Syau9OOt7Z/pLnlAiVB6RjXVilu8IH+tFI3kLqSMZrxF5o51vrZaf90z9aHN+OlkqKNNlGIadmc1TA14I+gXiK1r2y3J4LKcay3cxxaUPPZMZvRoXNYiBgo6x33kA9YcJTOmbE4fqRXX0tmRmRSZKWDi5SCZTJoe7BqYgaeBK6X7o0+fXP5cUt/hIc37fiOaUDMNn7pErPzEopNpqwcfdfrQ9kHMjBO8Vvz/rWBFSD3nfEYIJRvaYruiRLbNvOBhFqN60HEwCezpiyRlTPn/NODChnF9VBMYPwtGyOv8Kxby8FeKV6wbHoqk0ISWZjVEl/zO5sOrqj54PCrgSOdbBzwAZ+u9EfDj+Xso+3q+bf4CzVUS X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BL2FFO11HUB006; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB006; 31:DFWYsO0Q7My4+iQIqQhfwWLhymlV7TvE5TmmHfUsyl5H8Jg0H+RV2Vw5d9EXqWkbrnPBy+TxS3k+RlaExQ+bmhv/uVhLdjxhGkqQ2q7AOG69cOYHarJGmzVUPiWCmIkYgSAsmVSd45TdJOKGKelyN39OXqbi2qanCC/MMovQLg2c4csEFEpYTyQotnd2PdFJjFjqwmDHZmdpgMxNBHOkGHYHGl1hEOBzCciDhSX+NPQ=; 20:snvDyUKlrBDiDUPvLMkw4ohsZwBxZlyX1IZaE8BqezQ6F/4KJMW1rquEpNRKLJmBo8DIZxRlFRqtzVtTqmFbjaz6sTakUUaSaHjYulrNA6wsPBbu9ThBQ9Y/a7Cijp56g5MLm2eY8n5FuWo7sOKz+xalbprIHuU0tBTZaddA5aArIj1ZPR6Ch4NIzbv2TJEyaovOgEs2iN/MQM5EkfjOGrlwTBeS2kUkHcTkO02vEUs4eshL8BVIAhxCFSePzPeMbAVcbefBnq7T28egN9GoatHpPRadgceuUpMe+DSKM7Nj8ClzLnurPnwcHLOVkEy2zL3WdeEgjBV615+FpSCrx3BFFfr5MouX32bPWFlaBXD2dWpQqKAUNsa1CuQ36y9OV1wAwDmM1Z5Y5YUReR5Wo6HFC5ylrPmBVGT9dXHXNng= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(18430343700868)(97927398514766)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(13018025)(13024025)(13017025)(13023025)(8121501046)(13015025)(5005006)(3002001)(10201501046)(6055026); SRVR:BL2FFO11HUB006; BCL:0; PCL:0; RULEID:; SRVR:BL2FFO11HUB006; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB006; 4:xuI07CK7WV+MfhJ1k8i7ksCJmDsT4KtEvGncm91OgQ57fxkpK2Ce2mDFgyTffSLQ994yUZhniBQihsSCBL9rWOS584U5BAquMJ8xkw09macPMmrU2QL6RklOaBpCZ4PdVC6BkC79d3ulUQangmwaerdiX7I4wDIQn7NFpmyrpNG35M8wnYKCGx51SQzLo2rBCJclBB18VwecmgNEm/z0o0l4lr+DCvInOPQKERreDbhn8MM9CXemkYLMT2MPlsgJMvQFkk4Qi1ZprLysrL64zH/XCBthxpRZUxMHrSEvxctXrv1YYtw4qoWqiE6oJUEaPzXpBRvRfnxe9OrkBfxLVpqIV4u7xWOrVFdfb4feKgaytX+Yf9AjW2PelH0yyEnE+UD5xQbkNmt1GpGpah8DsOBP78C0mQnkiGAI49QaQGjD2DjCLDaZVeTskENOE7jA9XoxUIzV00tDKoAb6dVJV619aboT1h8pNlt7oEiF6CD+BkO4sfPJ6Ioeh9nxbiZsS1EqiWYnwmtWvJReK5suBT1/5Mh02nuTzliISKegUKvTams5YiYG+2zscJnCJ1Pg64Oc+rF0s/IQQ7bNGNuZNOMEMt1UpEndbzmagFfdQXw= X-Forefront-PRVS: 0035B15214 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2FFO11HUB006; 23:tL6BrWTMbvA6SEPMyJR067K+489eQrhUmXh1h8+X?= =?us-ascii?Q?PaTxyLEkgWhTAU0rprt0P423UWGzSYJLypM5yNLbhe2zo6NqJ4C1O9jJFi+L?= =?us-ascii?Q?PwVFrqPw1nweLZB6eQSj/ECsQBKNIW8jk1fP3B2byeMhd8PLSB405f3iGK3i?= =?us-ascii?Q?NrrpPq6bqmk2vZUlOJGiNnBYwoWVwK7JUGiG/GMMeccV7Oir2+zPmzLlTFtM?= =?us-ascii?Q?osOw4mo1Z6V1RQH5pTN/j1gxER5ZUzxJ/Xu1IJbnCc6D0CW9besUMLAn3/Cv?= =?us-ascii?Q?xtf631/SSq3XhesXo++vvNT+vp5+EIbwd5qszMUUrMwvZS5rbEJDisaHNCm5?= =?us-ascii?Q?XYlco6FoQ+117pHTl/6Im2l1lvG/7XZnj7iTuoXbL1NFwHt3H92apdPez6NS?= =?us-ascii?Q?PxjPj9dkaMopdwLvncl5caLxu4fQWjpIS/UYlbJr9dkzJiYJbblbmitIvJt/?= =?us-ascii?Q?fIyHWf/E/6xwPfPXn7Lh9o3Qy3Gzi83Hpo0SkY/YcAnJeorBIZ5jXFGGzN7r?= =?us-ascii?Q?aJbqnaxfPnslJE3wHvNI8LNqZKLLrlPevcyo/44UtVJHYQANQdnBA8b1oBmC?= =?us-ascii?Q?nXvNrd0yB2wLJ4aW9JHuG1WOtBElizORc+4aAyspXhW+aQulJjTkoEKk83Pf?= =?us-ascii?Q?uvfcgb4VUMFplpbP+opzt3q2xunWcSDRBbU7p9r8Dd1DwRy3j/paDstcWL71?= =?us-ascii?Q?Dj1sAFDJkyST9T29QUHHDKJtUA3twbeJhPPNoD6pgkEXZumNlMwQH0WZ4pF2?= =?us-ascii?Q?xfKBNE2NjjomY4Ekfmh7mjsBwwZIbpGADak6EF1z9na1FJVZ856jgZesgme6?= =?us-ascii?Q?5IefpNwadIL+UCxq2TmsyAwRCzm4dccKZhbu9IFZ1+5+wlhPBE2xAy+KrUlU?= =?us-ascii?Q?V1+Io1upnYPCh5dNdj/HjSA5r2zU4ZT51DH4095GvbjFVzRf+O1Pa1YpAaDd?= =?us-ascii?Q?+CSyQKo9dbizzdR4g4YMgPqU8rQDaqTQHjpuX2bpbZIJ//GxqqaE8yiguJoQ?= =?us-ascii?Q?gitComvpJRffi+8HP4FvCI2OGtZ+MHABl2/S32jakKAKIB+fTteATBChCVZM?= =?us-ascii?Q?VDkIhL/mWcqDxQWf/J9PxayVTj5J78KwJjbLbUaJY4u8xzPL3bgwiUpsRWGZ?= =?us-ascii?Q?3j51qRp9Ec/jJg5PU22CULNqd/irAp7CfQZ7URsjTm2+O8KGjAvTAfLdyaXB?= =?us-ascii?Q?WL/e8oCTWawNeefOV3wkZnI6DianaOQkv5r//7lNYvwd3xy75HFDcynHaa/S?= =?us-ascii?Q?0iN3H5ZryUofERcgXyKFfSMIcO514a6Xsk7VrBinTjBjnmQi/xCSPZflTraa?= =?us-ascii?Q?yMw29RQ2DRH5mzbtPPryqszX4Mq63S0UDFf2RgomTbfnHlT9He9lOf90rQdH?= =?us-ascii?Q?aO4s/g=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB006; 6:1ixTCJKCNh2AtEs0c8s+X01NG3t224n5Zy+s4Wi4tqLxjJy1cjU8iInQLO+JKZpNDgkjzPFqAy4lty2LD/Qs8B5mmD/RYenC2aSvsdQYsHr05F7AbYxItmRk37IINtWpMH3JnHpjWwtjQdzhYHJqlvCL7b47iF8hsaEq8UnlRuUzO/VWiego4tLSc2l/TnBqOrxT+As736dh2CwAbjX98H28JZMCw3kRdEAtW1D4wFQlSZcIM9jEr/CVPCmFNyu01/rNhIKaFxWwNZRxOpxSW/pTtG5J1mnKtv+dBjjSEJawefSEbq+04jLqP5JvSKuouXbhm+TT07rcvAcamBjXVA==; 5:RFcgCS7X6toYG9tAifyOOE+AukemOq4GFJXzz6aWH+ypYvJSBtkfoRiVe6DE62iwAjgSSAnjYx5G+yo4OseUaSi1M1Xb1LXvPrfqrtBDWuzJ3NFItmoD5IY2lVm8nBVdrDFBm2l3Me5Yl/l4/oR8aA==; 24:5Aav4uEE48FcRnaRD9QlixKX+1uUomMD9l4AhI4GjS1ICH61uE5LJgSOuA8cazW49zYKOnLufuxIw40rThu0JpiwfnbiLWhqlqTNdTTqeMA=; 7:NS+2tPhl9agUuGqM7+T/MUMAT4dOs/Dc4r+j82YDUPFVqTO/w5iLkEJoZeCf63rxNAcgT/cS0dRi2qBq6EwBdkqtuEVHtn6y1qF7jIZaKvqwlTLI5WyjEzIQllMs/RZ85DsQndJTuucQr4wOoXCpU1wV/2KFFI5selwyQqSrpMtwrWNQSX9zmj5iNcs2xL7S8CMrw8TR65TyltGXzweIkYdAqwTE3pA/z7an7EUaRh8vidLjSqFiUQotIjArmmww SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Aug 2016 16:46:14.9121 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.80]; Helo=[preapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2FFO11HUB006 Archived-At: Cc: "stir@ietf.org" , David Frankel , "dcrocker@bbiw.net" Subject: Re: [stir] Setting Expectations regarding STIR Deployment Realities X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 16:46:19 -0000 --_000_c962728da9ea477693cb2c5b07c1cfa0PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KzENCg0KUGllcmNlDQoNCkZyb206IEJyaWFuIFJvc2VuIFttYWlsdG86YnJAYnJpYW5yb3Nlbi5u ZXRdDQpTZW50OiBBdWd1c3QgMTUsIDIwMTYgMTE6NDQgQU0NClRvOiBET0xMWSwgTUFSVElOIEMg PG1kMzEzNUBhdHQuY29tPg0KQ2M6IEdvcm1hbiwgUGllcmNlIEEgW0NUT10gPFBpZXJjZS5Hb3Jt YW5Ac3ByaW50LmNvbT47IERhdmlkIEZyYW5rZWwgPGRmcmFua2VsQHppcGR4LmNvbT47IHN0aXJA aWV0Zi5vcmc7IGRjcm9ja2VyQGJiaXcubmV0DQpTdWJqZWN0OiBSZTogW3N0aXJdIFNldHRpbmcg RXhwZWN0YXRpb25zIHJlZ2FyZGluZyBTVElSIERlcGxveW1lbnQgUmVhbGl0aWVzDQoNCisxDQoN ClRoZSBkZXNpZ24gb2YgdGhlIG1lY2hhbmlzbSBsZXRzIHRoZSBob2xkZXIgb2YgdGhlIGNlcnQg ZGVjaWRlIGhvdyBtYW55IFROcyBhcmUgYXNzb2NpYXRlZCB3aXRoIGl0Lg0KDQpBIGNhcnJpZXIg Y291bGQgaGF2ZSBvbmUsIG9yIGl0IGNvdWxkIGhhdmUgb25lIHBlciBUTiwgb3IgaXQgY291bGQg aGF2ZSBzb21ldGhpbmcgaW4gYmV0d2VlbiB0aGF0LiAgSXTigJlzIG1vc3QgbGlrZWx5IHRoZSBs YXR0ZXIsIGFuZCBkZXBlbmRlbnQgb24gaG93IHRoZSBuZXR3b3JrIGlzIGJ1aWx0Lg0KDQpOb3Rl IHRoYXQgdGhpcyBkb2VzbuKAmXQgbWF0dGVyIHRvIGFueW9uZSBvdGhlciB0aGF0IHRoZSBjYXJy aWVyIGFuZCB3aG9ldmVyIGdpdmVzIHRoZSBjYXJyaWVyIHRoZSBjZXJ0cy4NCg0KV2UgYXJlIHJl bHlpbmcgb24gT0NTUCB0byB0ZWxsIHVzIHdoZXRoZXIgYSBjZXJ0IGlzIGN1cnJlbnRseSB2YWxp ZCBmb3IgYSBzcGVjaWZpYyBUTi4NCg0KSGVyZSwgd2UgYXJlIG11Y2ggbW9yZSBjb25jZXJuZWQg YWJvdXQgY2hhbmdlIGluIGRlbGVnYXRpb24gdGhhdCBjb21wcm9taXNlIG9mIGtleXMuICBXZSBo YXZlIHRvIGhhdmUgcHJvY2VkdXJlcyB0byBtYW5hZ2UgY29tcHJvbWlzZSBvZiBrZXlzLCBidXQg Y2hhbmdlIGluIGRlbGVnYXRpb24gd2lsbCBoYXBwZW4gYWxsIHRoZSB0aW1lLCBhbmQga2V5IGNv bXByb21pc2UgaXMsIGFsYmVpdCBub24temVybywgYXQgbGVhc3QgZmFpcmx5IHJhcmUuDQoNCkFu b3RoZXIgdmFyaWFibGUgdGhhdCBpcyBhbHNvIG91dHNpZGUgb2YgSUVURiB3b3JrIGlzIHRoZSBs aWZldGltZSBvZiB0aGUga2V5cy4gIEdpdmVuIHRoZSBsZXZlbCBvZiBhdXRvbWF0aW9uIHRoYXQg d2lsbCBiZSByZXF1aXJlZCB0byBtYWtlIHRoZSBtZWNoYW5pc20gd29yayB3ZWxsLCBpdOKAmXMg cHJvYmFibHkgcG9zc2libGUgdG8gaGF2ZSBhIHJlbGF0aXZlbHkgc2hvcnQgY2VydCBleHBpcmF0 aW9uLCB3aGljaCBsaW1pdHMgdGhlIGRhbWFnZSBrZXkgY29tcHJvbWlzZSBlbmdlbmRlcnMuDQoN Cg0KQnJpYW4NCg0KT24gQXVnIDE1LCAyMDE2LCBhdCAxMjoxNiBQTSwgRE9MTFksIE1BUlRJTiBD IDxtZDMxMzVAYXR0LmNvbTxtYWlsdG86bWQzMTM1QGF0dC5jb20+PiB3cm90ZToNCg0KSVAtTk5J IFNIQUtFTiB1c2VzIGEgcG9vbCBvZiBjZXJ0cyBwZXIgb3BlcmF0b3IsIG5vdCBjZXJ0IHBlciBU Tg0KDQpJIGJlbGlldmUgdGhlcmUgbWF5IGJlIGNlcnRhaW4gVEJEIHVzZSBjYXNlcyB0aGF0IG1h eSB3YXJyYW50IGNlcnQgZm9yIHRob3NlIFROcw0KTWFydGluIEMuIERvbGx5DQpMZWFkIE1lbWJl ciBvZiBUZWNobmljYWwgU3RhZmYNCkNvcmUgJiBHb3Zlcm5tZW50L1JlZ3VsYXRvcnkgU3RhbmRh cmRzDQpBVCZUDQpDZWxsOiArMS42MDkuOTAzLjMzNjA8dGVsOisxLjYwOS45MDMuMzM2MD4NCkVt YWlsOiBtZDMxMzVAYXR0LmNvbTxtYWlsdG86bWQzMTM1QGF0dC5jb20+DQoNCg0KT24gQXVnIDE1 LCAyMDE2LCBhdCAxMjoxMSBQTSwgR29ybWFuLCBQaWVyY2UgQSBbQ1RPXSA8UGllcmNlLkdvcm1h bkBzcHJpbnQuY29tPG1haWx0bzpQaWVyY2UuR29ybWFuQHNwcmludC5jb20+PiB3cm90ZToNCmlk ZW50aXR5Lg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNClRoaXMgZS1t YWlsIG1heSBjb250YWluIFNwcmludCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbiBpbnRlbmRlZCBm b3IgdGhlIHNvbGUgdXNlIG9mIHRoZSByZWNpcGllbnQocykuIEFueSB1c2UgYnkgb3RoZXJzIGlz IHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFz ZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSBhbGwgY29waWVzIG9mIHRoZSBtZXNzYWdl Lg0K --_000_c962728da9ea477693cb2c5b07c1cfa0PLSWE13M08adsprintcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQXJpYWwiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzAwMDBDQzsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1z dHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQouTXNvQ2hwRGVmYXVs dA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2 OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZd LS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj4mIzQzOzE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDAwQ0MiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMDBDQyI+UGllcmNlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAwMENDIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4gQnJpYW4gUm9zZW4gW21haWx0bzpickBicmlhbnJvc2VuLm5ldF0NCjxicj4NCjxiPlNl bnQ6PC9iPiBBdWd1c3QgMTUsIDIwMTYgMTE6NDQgQU08YnI+DQo8Yj5Ubzo8L2I+IERPTExZLCBN QVJUSU4gQyAmbHQ7bWQzMTM1QGF0dC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBHb3JtYW4sIFBp ZXJjZSBBIFtDVE9dICZsdDtQaWVyY2UuR29ybWFuQHNwcmludC5jb20mZ3Q7OyBEYXZpZCBGcmFu a2VsICZsdDtkZnJhbmtlbEB6aXBkeC5jb20mZ3Q7OyBzdGlyQGlldGYub3JnOyBkY3JvY2tlckBi Yml3Lm5ldDxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW3N0aXJdIFNldHRpbmcgRXhwZWN0YXRp b25zIHJlZ2FyZGluZyBTVElSIERlcGxveW1lbnQgUmVhbGl0aWVzPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+JiM0MzsxPG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgZGVzaWduIG9mIHRoZSBtZWNoYW5pc20gbGV0 cyB0aGUgaG9sZGVyIG9mIHRoZSBjZXJ0IGRlY2lkZSBob3cgbWFueSBUTnMgYXJlIGFzc29jaWF0 ZWQgd2l0aCBpdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+QSBjYXJyaWVyIGNvdWxkIGhhdmUgb25lLCBvciBpdCBjb3VsZCBoYXZlIG9uZSBw ZXIgVE4sIG9yIGl0IGNvdWxkIGhhdmUgc29tZXRoaW5nIGluIGJldHdlZW4gdGhhdC4gJm5ic3A7 SXTigJlzIG1vc3QgbGlrZWx5IHRoZSBsYXR0ZXIsIGFuZCBkZXBlbmRlbnQgb24gaG93IHRoZSBu ZXR3b3JrIGlzIGJ1aWx0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Ob3RlIHRoYXQgdGhpcyBkb2VzbuKAmXQgbWF0dGVyIHRvIGFueW9uZSBv dGhlciB0aGF0IHRoZSBjYXJyaWVyIGFuZCB3aG9ldmVyIGdpdmVzIHRoZSBjYXJyaWVyIHRoZSBj ZXJ0cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+V2UgYXJlIHJlbHlpbmcgb24gT0NTUCB0byB0ZWxsIHVzIHdoZXRoZXIgYSBjZXJ0IGlzIGN1 cnJlbnRseSB2YWxpZCBmb3IgYSBzcGVjaWZpYyBUTi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGVyZSwgd2UgYXJlIG11Y2ggbW9yZSBjb25j ZXJuZWQgYWJvdXQgY2hhbmdlIGluIGRlbGVnYXRpb24gdGhhdCBjb21wcm9taXNlIG9mIGtleXMu ICZuYnNwO1dlIGhhdmUgdG8gaGF2ZSBwcm9jZWR1cmVzIHRvIG1hbmFnZSBjb21wcm9taXNlIG9m IGtleXMsIGJ1dCBjaGFuZ2UgaW4gZGVsZWdhdGlvbiB3aWxsIGhhcHBlbiBhbGwgdGhlIHRpbWUs IGFuZCBrZXkgY29tcHJvbWlzZSBpcywgYWxiZWl0IG5vbi16ZXJvLCBhdA0KIGxlYXN0IGZhaXJs eSByYXJlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Bbm90aGVyIHZhcmlhYmxlIHRoYXQgaXMgYWxzbyBvdXRzaWRlIG9mIElFVEYgd29yayBp cyB0aGUgbGlmZXRpbWUgb2YgdGhlIGtleXMuICZuYnNwO0dpdmVuIHRoZSBsZXZlbCBvZiBhdXRv bWF0aW9uIHRoYXQgd2lsbCBiZSByZXF1aXJlZCB0byBtYWtlIHRoZSBtZWNoYW5pc20gd29yayB3 ZWxsLCBpdOKAmXMgcHJvYmFibHkgcG9zc2libGUgdG8gaGF2ZSBhIHJlbGF0aXZlbHkgc2hvcnQg Y2VydCBleHBpcmF0aW9uLCB3aGljaA0KIGxpbWl0cyB0aGUgZGFtYWdlIGtleSBjb21wcm9taXNl IGVuZ2VuZGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5CcmlhbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T24gQXVnIDE1LCAyMDE2LCBhdCAxMjoxNiBQTSwgRE9MTFksIE1BUlRJ TiBDICZsdDs8YSBocmVmPSJtYWlsdG86bWQzMTM1QGF0dC5jb20iPm1kMzEzNUBhdHQuY29tPC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SVAtTk5JIFNIQUtFTiB1c2VzIGEgcG9vbCBvZiBjZXJ0cyBwZXIgb3BlcmF0b3Is IG5vdCBjZXJ0IHBlciBUTjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkkgYmVsaWV2ZSB0aGVy ZSBtYXkgYmUgY2VydGFpbiBUQkQgdXNlIGNhc2VzIHRoYXQgbWF5IHdhcnJhbnQgY2VydCBmb3Ig dGhvc2UgVE5zJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+TWFydGluIEMuIERvbGx5PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+TGVhZCBNZW1iZXIgb2YgVGVjaG5pY2FsIFN0YWZmPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db3JlICZhbXA7 IEdvdmVybm1lbnQvUmVndWxhdG9yeSBTdGFuZGFyZHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFUJmFtcDtUPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DZWxsOiZuYnNwOzxhIGhyZWY9InRlbDom IzQzOzEuNjA5LjkwMy4zMzYwIj4mIzQzOzEuNjA5LjkwMy4zMzYwPC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RW1haWw6Jm5ic3A7PHU+PGEg aHJlZj0ibWFpbHRvOm1kMzEzNUBhdHQuY29tIj5tZDMxMzVAYXR0LmNvbTwvYT48L3U+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBBdWcgMTUsIDIwMTYsIGF0IDEy OjExIFBNLCBHb3JtYW4sIFBpZXJjZSBBIFtDVE9dICZsdDs8YSBocmVmPSJtYWlsdG86UGllcmNl Lkdvcm1hbkBzcHJpbnQuY29tIj5QaWVyY2UuR29ybWFuQHNwcmludC5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5pZGVudGl0 eS48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxicj4NCjxocj4NCjxmb250IGZhY2U9IkFyaWFsIiBjb2xvcj0i R3JheSIgc2l6ZT0iMSI+PGJyPg0KVGhpcyBlLW1haWwgbWF5IGNvbnRhaW4gU3ByaW50IHByb3By aWV0YXJ5IGluZm9ybWF0aW9uIGludGVuZGVkIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIHJlY2lw aWVudChzKS4gQW55IHVzZSBieSBvdGhlcnMgaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3Qg dGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3QgdGhlIHNlbmRlciBhbmQgZGVs ZXRlIGFsbCBjb3BpZXMgb2YgdGhlIG1lc3NhZ2UuPGJyPg0KPC9mb250Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_c962728da9ea477693cb2c5b07c1cfa0PLSWE13M08adsprintcom_-- From nobody Mon Aug 15 11:38:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DECD12D669 for ; Mon, 15 Aug 2016 11:38:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=broadsoft-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dm5YfO9ELmHz for ; Mon, 15 Aug 2016 11:38:25 -0700 (PDT) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA2C812D67F for ; Mon, 15 Aug 2016 11:38:22 -0700 (PDT) Received: by mail-wm0-x230.google.com with SMTP id i5so120254517wmg.0 for ; Mon, 15 Aug 2016 11:38:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadsoft-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:thread-index:date:message-id:subject:to; bh=M2sSp0r8zH9A0KkBOZ5BR/mukd4k6Fx/nj9Kb5o8/T0=; b=khO1L8+87OB1HG3KrTzlv9fz5CGxVaszYqCUwACiJL2g//2O4mw3vPPOJMgeGHGV1H DcXhlH8oAw7vqD96uL5ILYMUQ0fxySnPGc23+vY2zuKzEoSgBp+efF9lmf4wdqmXGOev AO7UUCAQ21hHxa5IUzVy+lAZbVxGerjrqnF3JLZMYGRAfnRkqt/Zw0uJaWrdn8aDLHdS t5xtOmDWqmFwz7LS+YFPONlZtwZDgGbnVX+eeRDIJtNiImehREtg+8gGpx4ifU8Io0L7 aCHCZHvPcuIeaZ86RL//+D3UCb6AzZKa9r7NxUMzVND7OPWHHFm2ra1ZHoTbU6hrsG6J BOZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:mime-version:thread-index:date:message-id :subject:to; bh=M2sSp0r8zH9A0KkBOZ5BR/mukd4k6Fx/nj9Kb5o8/T0=; b=B2YkZrrZqxg/CnF3LFOrSs8qU4AyTCz9BNd1JXsubfvifkoZRv4bKmQLATk3j0TzVD XdBg10UYzTv32VwNbWtS+c+EgIi/D3gwXPSBH7QtfOF3K6VBjFyJjDBCERbNkrYiUwks KfEzRUOK7GWVnFLqCg42V+VIh+GDo2t7pvhdWF4nM6+0HHz15qS8ZanXo9xS+ZSzX+3u FG+ZYSdczlNo9UEfrb/aE2D9N9/li927xb4MKlQEPHAQvWr616ss0jxbygG6zTrLuT6t C7MzH9e+62mwnp570SriVSGBYTLcFYJz3lodzveonXYJz3twcMuXURmVASegiNEZHh03 BLqA== X-Gm-Message-State: AEkooutMCZXy1iS1pakdgmeeCow2LUaBVYq5o47gGDMhdM/yxqHf93GUNFtBjb9FDzqs1t3DOxFNZ+AaIoBUwgM8 X-Received: by 10.46.5.6 with SMTP id 6mr5050602ljf.66.1471286301113; Mon, 15 Aug 2016 11:38:21 -0700 (PDT) From: Brett Tate MIME-Version: 1.0 X-Mailer: Microsoft Outlook 14.0 Thread-Index: AdH3JB8v4FcEoF/7QNyC2F8bIIasbw== Date: Mon, 15 Aug 2016 14:38:19 -0400 Message-ID: To: draft-ietf-stir-rfc4474bis@tools.ietf.org, stir@ietf.org Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [stir] draft-ietf-stir-rfc4474bis-10: comment X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 18:38:27 -0000 Hi, Concerning draft-ietf-stir-rfc4474bis-10 section 8 last paragraph, the use of "MAY NOT" should potentially be changed to lower case or something else since "MAY NOT" is not mentioned in section 2 or RFC 2119 (or RFC 6919). I should also mention that I liked the reference to RFC 6919. :) Thanks, Brett From nobody Mon Aug 15 12:41:41 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 892E712D0FB for ; Mon, 15 Aug 2016 12:41:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Fzk8AJLfFj7 for ; Mon, 15 Aug 2016 12:41:39 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA42F12D0F8 for ; Mon, 15 Aug 2016 12:41:39 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7FJfjlD009015 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 15 Aug 2016 12:41:45 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471290105; bh=L+v+7Uz1wHta6r+zzKoWGYmZbjFAligN5LnNuzBN080=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=pRxbleiKts8UcHTaHmVW06X+mhZ4BWrt1PHNV+sA55iMKsL3fY/m7f8SDod3V9Ull z4523S/b51di15tBscsOE/eAHd+swGwLpP4leYIhoKt2c1yMO0ZCMQkdtG9sfJb61O vrGxZUGhmhLiZrSEJWvDz5RTjEWmb/PBoXplCEfs= To: Richard Shockey References: <17A4057909C5124FBCA624CD7B0C43A20121B4A6A890@HQ1-MAILMB-V1.trade.ftc.gov> <465A9984-002B-4D8C-8DB8-195F54F067D2@shockey.us> <63087567-E053-40B1-8887-51C63E82DE93@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <3cc655bf-9565-f6be-c8e2-7d5dddc4997e@dcrocker.net> Date: Mon, 15 Aug 2016 12:41:33 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <63087567-E053-40B1-8887-51C63E82DE93@shockey.us> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Conduct (was - Re: Summary comments on draft-ietf-stir-* document trio at WG Last Call) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 19:41:40 -0000 On 8/14/2016 3:25 PM, Richard Shockey wrote: > ...but at some point your false assertions can’t hide behind political correctness. Richard, First, I cannot tell what statements of mine you are claiming are false, nevermind why you think they are false. But your assertion is quite serious, so I will ask you to document your claim carefully and in context. I also have absolutely no idea what you are referring to, when you suggest someone (me?) is hiding behind political correctness. Again, please explain careful and, since this is an assertion about someone's behavior, document it concretely. Thanks. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Aug 17 12:03:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CDF812D150 for ; Wed, 17 Aug 2016 12:03:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.699 X-Spam-Level: X-Spam-Status: No, score=-102.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DK0D3z5Air1m for ; Wed, 17 Aug 2016 12:03:37 -0700 (PDT) Received: from mail-oi0-x236.google.com (mail-oi0-x236.google.com [IPv6:2607:f8b0:4003:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C45E012B039 for ; Wed, 17 Aug 2016 12:03:36 -0700 (PDT) Received: by mail-oi0-x236.google.com with SMTP id c15so149611654oig.0 for ; Wed, 17 Aug 2016 12:03:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=QuIC3eO1U96xbkOrqDnJq/23b4s7AwKU1UzHfVAoxQs=; b=uHLUzPf3RhERwLQBxgF9C2CnpWUUGSKFOMkvNp4k4bybVQ10R4to4l8xzjPO60k619 Y76gkkdl5Y6ovNPY+SL9sIFAX7rANjVikzKjFj+bPuAJJ1wGCLwDAMK7zaSWova8jVkg TntPzVHiXjcLksPy9eVk0JSnNV4zz1MyhVGYaGzFZ7BpeSHrUWlQeUaxHJE676lwvxc1 HHNa+cHsm7dUmMN689LLCGkJ0BoZCoz1lpW8Qk+tQ81/MM/+96HmI6IxOhHXobYg1aoM T0wSmZT2nHXSRrK2IC8DOPLdRFuGeewBvTkb9t1vtC9QQtLY4UGtduU51wD/efnvOeX9 0NQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=QuIC3eO1U96xbkOrqDnJq/23b4s7AwKU1UzHfVAoxQs=; b=ZQcsrP8R3TULyisiumdhWHkdrFEQ+dL4vfH3WQZTG0+c1v2XT7OzayrTqid72TM8yt FGiLlVfAtisGbjETfLH9R6jJ397/XaZL51VV2g0z65N3kZy2XBKJGFwqywjbaFfJUUfb 3UCN1mGYFrSKLTCXEfLtATAxJb92UPLjf9nVVzI2iE7oyL0WUDLiXKHVKLJvriOjR15O k8fMkUXZ1OwPsz4cHIszkYdcAnvTMqkrdqQxHFGk7Tgo+N24QlA4rJ2UlEMFsZVZU+46 Sm/JB/guy/EnCsXKsmYpwDA3M1tAfkb3NxRJVCfUzgfFvdwjxNboV2TP2VoxX3dhxlIm nLzA== X-Gm-Message-State: AEkoousffSHESNMXD1sfNbhvy0zWb9mtNwroMvgYNDY76o5bg4TwWJgizgPTOlhedgHG+VZdTg4o7ksrXjwrBg== X-Received: by 10.202.56.85 with SMTP id f82mr3082172oia.107.1471460616072; Wed, 17 Aug 2016 12:03:36 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.47.70 with HTTP; Wed, 17 Aug 2016 12:03:34 -0700 (PDT) In-Reply-To: References: From: Mary Barnes Date: Wed, 17 Aug 2016 14:03:34 -0500 Message-ID: To: "Peterson, Jon" Content-Type: multipart/alternative; boundary=001a113cc2665273c3053a491f4f Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Aug 2016 19:03:41 -0000 --001a113cc2665273c3053a491f4f Content-Type: text/plain; charset=UTF-8 Jon, Thanks for responding to Dave's comments - I found that quite helpful. I have some comments/responses below [MB]. As a caveat to my responses, I did not read all the details in Dave's review. Regards, Mary. On Sat, Aug 13, 2016 at 2:40 AM, Peterson, Jon wrote: > > I finally had a chance to go through these comments, and I did want to > provide a few responses on Dave's review of rfc4474bis here. > > >Taken on its own and also when taken with its companion documents, the > >specifications are confusing and incomplete. It is quite far from being > >ready for publication. > > Having looked through Dave's specific concerns, I don't think he makes his > case for this criticism. > > >Terminology is used inconsistently. It often is introduced with no > >background or citation. Many uses of 'header' are probably supposed to > >be 'header field'. My sense is that quite a bit of terminology is used > >equally loosely. > > I think the use of terminology in the specification has proper background > and citations. Certainly Dave is correct that the text is pretty lax with > "header" vs. "header field" vs. "header field value," no denying that. If > people think this is a big deal, I will fix it. But the suggestion that > because this is true, terminology is loosely used to a point where it > would hamper implementation, that I think his comments don't really > substantiate. > [MB] As pendantic as it might seem, in my experience, the expectation is that we are precise with terminology in the specs, so that qualifying 'header' as 'header field' and 'parameter' as 'header field parameter' is a reasonable expectation. I've had to do that with the RFCs that I've authored and in re-reading this document recently, I think it adds to the readability/understanding in particular since the ABNF comes later. [/MB] > > >There is no integrative architectural description, so the reader has > >difficulty understanding what all of the pieces are or how they fit > >together. In fact is appears that the document itself gets confused on > >this matter. > > I'm not sure what an "integrative architectural description" would entail, > but there are a number of sections that provide overviews of operations > and related examples of how the architectural piece come together. I don't > think anything in the review comments genuinely substantiates that the > document itself is confused about its own architecture. > > >Algorithms are all offered only as prose and often in a form mitigating > >comprehension, such as tending towards negation or disjunction, which > >humans process less well than affirmatives and conjunctions. From what I > >can tell, the algorithms often are incomplete, but serious analysis is > >difficult. > > Algorithms are offered in steps with normative language, if that's what > you mean by "prose form". RFCs are typically composed of prose. The review > does reveal some very striking views about specmanship and algorithms in > particular which are foreign to my experience in the IETF. > > >The documents appear to rely on a reader's having quite a bit of prior > >knowledge and are certainly not usable by an implementer who is not > >already deeply embedded in the community that produced these > >specifications. My impression is that being embedded won't suffice > >either, both from my assessment of the documents' deficiencies and given > >back-channel comments I have heard about the expectation of the work to > >be done after these specifications are published. > > We do expect basic SIP literacy, and a willingness to follow references > and read external specifications and sections that are cited. Readers that > are unwilling to do this will probably find a lot of things confusing in > there. > [MB] I think the challenge is that 'basic SIP literacy' isn't such a basic thing anymore and it does require *a lot* of background to parse this document, but I don't know a way around that. [/MB] > > >Overall, the writing impedes comprehension and the document needs a very > >diligent pass by a technical editor. I suspect this will uncover quite > >a number of semantic deficiencies in the text. > > You did catch some good typos, and I caught a few more following your > notes through the text. I'm not sure that yielded the semantic > difficulties you speculate about here though. > > >There is a possible tendency to support more alternative behavior than > >appropriate. Successful interoperability usually benefits from fewer > >choices, not more. Common, mandatory canonicalization is an example. > > Common, mandatory canonicalization of telephone numbers is unfortunately > only slightly more reliable than common, mandatory normalization of > internationalized domain names. At least it's just numbers. The algorithm > we have is good enough to cover the common operational case, and where it > fails, hopefully "canon" will help to close the gap. > > >Credentials: the specification neither defines nor references a standard > >for the specification of credentials, here. That means that the > >technical details -- as distinct from the operational policies -- of > >credentials are out of scope, although they are fundamental to proper > >operation of this serve. This is a showstopper, in terms of > >specification completeness for the service. > > Well, it does reference a standard for the specification of credentials: > stir-certs. I agree it would be a showstopper if we didn't have the > stir-certs work. > > >How is the recipient to know what credential 'standard' is used? How > >does this ensure interoperability between two participants who have not > >interacted before? > > There is in practice only one at the moment. I'm content to worry about > interop problems when we have another one. > > >At base, these specifications appear intended to roughly chart out a > >system structure, leaving most of the difficult work for later and > >elsewhere. By way of example, there are few if any cross-organization > >key management services on the Internet that demonstrate the utility > >needed here. I am pretty sure that Web certs don't qualify. We know > >that DKIM's operation does, of course. However DKIM strictly uses > >domain names as identifiers and they conveniently align with their > >administrative authorities, whereas telephone numbers do not... > > I'd say that, by design, rfc4474bis is pretty tightly confined to > specifying the SIP over-the-wire protocol behavior. It takes a lot of spec > just to do that. > > And your praise of DKIM as a model is once again noted. I would respond > again that we are unlikely to abandon our years of work on this mechanism > and switch to DKIM at this point, no matter how many comments you place in > our path. > > > [[[ The mailing list just had an extensive regurgitation of > >critical commentary about ENUM. What appears to be getting missed is > >that whatever mechanism is going to be used for finding and validating > >keys is going to have no operational history of reliability, safety or > >efficacy. ]]] > > HTTP has none of those qualities, apparently. > > >There is remarkably little of the original RFC 4474 substance still in > >this document. Calling it a bis is a bit like tearing all of a building > >except its fireplace or its front door and calling that a remodeling. > >The previous document does not have an installed base, so I strongly > >suggest removing all references to it. It will allow some of the text > >to be notably simpler and clearer. > > I think enough of the concepts and protocol mechanisms of the original are > retained to warrant keeping this as a bis. > [MB] I'm not sure on this one, in particular given that it deprecates the header fields defined in RFC 4474 (per section 8). And, unlike other -bis specs there is no summary section in this document of the differences between the two. Also, currently this draft doesn't indicate what impact it has on 4474 in the header page. There is the sentence at the end of section 1 stating that this document "revises RFC 4474" but that's not particularly meaningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with RFC 4244, I really think that this draft should be documented as obsoleting RFC 4474. [/MB] > > >The document is heavy with forward references. These force the reader > >to stop what they are in the middle of, try to hold that place, and look > >forward to understand what they've just been interrupted from reading. > >As a literary style, forward references create useful tension. In > >specifications they just interrupt the flow. The document should be > >reorganization so that integrative text comes /after/ the text > >describing the pieces being integrated. And opening overview, design > >summary, or the like can give a non-normative description of the > >architecture and the service, so the reader has a basic sense of the big > >picture, before diving into the detail of those to-be-integrated pieces. > > > Dave does make a number of organizational suggestions about the spec. The > spec has an overview, a design summary, before it gets down to specifying > things. The virtue of the "integrative" approach he describes is however > unclear to me. I think whether you define the auth service behavior first > or define the header syntax first, one of those sections is going to end > up pointing to the other. There wasn't much in his reorg suggestions that > seemed to me like a substantial improvement. > [MB] As another RFC 4244 example, we did find that moving the syntax early in the document in RFC 7044 made it more readable. From a developer's perspective, I think it's helpful to have the syntax in mind as one reads all the details of the processing.[/MB] > > Overall, there are a handful of changes (beyond the typos, which again are > appreciated) I'd make based on the substance of Dave's review. Some of the > suggestions to rename sections seem harmless to me. Like some other people > who come to mind, he would like to see some more precise specification and > examples of how you break off the signature from JWT. He pointed out that > we really don't have any motivation for including multiple Identity > headers in there, and we probably do need an indication of what future > work might use that feature. > [MB] I would 3rd the need for examples. That has been a usual practice for other RFCs defining new SIP header fields (and header field parameters). [/MB] > > In terms of topics for discussion that might warrant the attention of the > working group, he did suggest we need to be sure we think the scope of the > signature is correct, and that we have enough confidence that > intermediaries won't break it, and that when it is broken, the verifier > behavior makes sense. I think we've focused a lot of attention on those > questions, but I'm happy to talk more about that if people think there's > room for improvement. > > Also, he suggests that we might need a better pointer than RFC3986 Section > 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows > of one, I'd be happy to cite it instead. > > Otherwise, I think we've got this covered. Anyone who's interested in > further details can see the attached. > > Jon Peterson > Neustar, Inc. > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > --001a113cc2665273c3053a491f4f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Jon,

Thanks for responding to Dave'= s comments - I found that quite helpful.=C2=A0 I have some comments/respons= es below [MB].=C2=A0 As a caveat to my responses, I did not read all the de= tails in Dave's review. =C2=A0

Regards,
<= div>Mary.

On= Sat, Aug 13, 2016 at 2:40 AM, Peterson, Jon <jon.peterson@neustar= .biz> wrote:

I finally had a chance to go through these comments, and I did want to
provide a few responses on Dave's review of rfc4474bis here.

>Taken on its own and also when taken with its companion documents, the<= br> >specifications are confusing and incomplete.=C2=A0 It is quite far from= being
>ready for publication.

Having looked through Dave's specific concerns, I don't thin= k he makes his
case for this criticism.

>Terminology is used inconsistently. It often is introduced with no
>background or citation.=C2=A0 Many uses of 'header' are probabl= y supposed to
>be 'header field'.=C2=A0 My sense is that quite a bit of termin= ology is used
>equally loosely.

I think the use of terminology in the specification has proper backg= round
and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

[MB] As pendantic as it m= ight seem, in my experience, the expectation is that we are precise with te= rminology in the specs, so that qualifying 'header' as 'header = field' and 'parameter' as 'header field parameter' is a= reasonable expectation. I've had to do that with the RFCs that I'v= e authored and in re-reading this document recently, I think it adds to the= readability/understanding in particular since the ABNF comes later. [/MB]<= /div>
=C2=A0

>There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit
>together.=C2=A0 In fact is appears that the document itself gets confus= ed on
>this matter.

I'm not sure what an "integrative architectural description= " would entail,
but there are a number of sections that provide overviews of operations
and related examples of how the architectural piece come together. I don= 9;t
think anything in the review comments genuinely substantiates that the
document itself is confused about its own architecture.

>Algorithms are all offered only as prose and often in a form mitigating=
>comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what = I
>can tell, the algorithms often are incomplete, but serious analysis is<= br> >difficult.

Algorithms are offered in steps with normative language, if that'= ;s what
you mean by "prose form". RFCs are typically composed of prose. T= he review
does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF.

>The documents appear to rely on a reader's having quite a bit of pr= ior
>knowledge and are certainly not usable by an implementer who is not
>already deeply embedded in the community that produced these
>specifications.=C2=A0 My impression is that being embedded won't su= ffice
>either, both from my assessment of the documents' deficiencies and = given
>back-channel comments I have heard about the expectation of the work to=
>be done after these specifications are published.

We do expect basic SIP literacy, and a willingness to follow referen= ces
and read external specifications and sections that are cited. Readers that<= br> are unwilling to do this will probably find a lot of things confusing in there.
[MB] =C2=A0I think the challenge is that 'b= asic SIP literacy' isn't such a basic thing anymore and it does req= uire *a lot* of background to parse this document, but I don't know a w= ay around that. [/MB]

>Overall, the writing impedes comprehension and the document needs a ver= y
>diligent pass by a technical editor.=C2=A0 I suspect this will uncover = quite
>a number of semantic deficiencies in the text.

You did catch some good typos, and I caught a few more following you= r
notes through the text. I'm not sure that yielded the semantic
difficulties you speculate about here though.

>There is a possible tendency to support more alternative behavior than<= br> >appropriate. Successful interoperability usually benefits from fewer >choices, not more.=C2=A0 Common, mandatory canonicalization is an examp= le.

Common, mandatory canonicalization of telephone numbers is unfortuna= tely
only slightly more reliable than common, mandatory normalization of
internationalized domain names. At least it's just numbers. The algorit= hm
we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap.

>Credentials: the specification neither defines nor references a standar= d
>for the specification of credentials, here.=C2=A0 That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve.=C2=A0 This is a showstopper, in terms of
>specification completeness for the service.

Well, it does reference a standard for the specification of credenti= als:
stir-certs. I agree it would be a showstopper if we didn't have the
stir-certs work.

>How is the recipient to know what credential 'standard' is used= ?=C2=A0 How
>does this ensure interoperability between two participants who have not=
>interacted before?

There is in practice only one at the moment. I'm content to worr= y about
interop problems when we have another one.

>At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and
>elsewhere.=C2=A0 By way of example, there are few if any cross-organiza= tion
>key management services on the Internet that demonstrate the utility >needed here.=C2=A0 I am pretty sure that Web certs don't qualify.= =C2=A0 We know
>that DKIM's operation does, of course.=C2=A0 However DKIM strictly = uses
>domain names as identifiers and they conveniently align with their
>administrative authorities, whereas telephone numbers do not...

I'd say that, by design, rfc4474bis is pretty tightly confined t= o
specifying the SIP over-the-wire protocol behavior. It takes a lot of spec<= br> just to do that.

And your praise of DKIM as a model is once again noted. I would respond
again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in<= br> our path.

>=C2=A0 =C2=A0 =C2=A0 [[[ The mailing list just had an extensive regurgi= tation of
>critical commentary about ENUM.=C2=A0 What appears to be getting missed= is
>that whatever mechanism is going to be used for finding and validating<= br> >keys is going to have no operational history of reliability, safety or<= br> >efficacy. ]]]

HTTP has none of those qualities, apparently.

>There is remarkably little of the original RFC 4474 substance still in<= br> >this document.=C2=A0 Calling it a bis is a bit like tearing all of a bu= ilding
>except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it.=C2=A0 It will allow some of the = text
>to be notably simpler and clearer.

I think enough of the concepts and protocol mechanisms of the origin= al are
retained to warrant keeping this as a bis.

<= div>[MB] I'm not sure on this one, in particular given that it deprecat= es the header fields defined in RFC 4474 (per section 8).=C2=A0 And, unlike= other -bis specs there is no summary section in this document of the diffe= rences between the two.=C2=A0 Also, currently this draft doesn't indica= te what impact it has on 4474 in the header page. There is the sentence at = the end of section 1 stating that this document "revises RFC 4474"= ; but that's not particularly meaningful. Given that when we produced R= FC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible = with RFC 4244, I really think that this draft should be documented as obsol= eting RFC 4474. [/MB]

>The document is heavy with forward references.=C2=A0 These force the re= ader
>to stop what they are in the middle of, try to hold that place, and loo= k
>forward to understand what they've just been interrupted from readi= ng.
>As a literary style, forward references create useful tension.=C2=A0 In=
>specifications they just interrupt the flow.=C2=A0 The document should = be
>reorganization so that integrative text comes /after/ the text
>describing the pieces being integrated.=C2=A0 And opening overview, des= ign
>summary, or the like can give a non-normative description of the
>architecture and the service, so the reader has a basic sense of the bi= g
>picture, before diving into the detail of those to-be-integrated pieces= .


Dave does make a number of organizational suggestions about the spec= . The
spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is = however
unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions th= at
seemed to me like a substantial improvement.
[MB] As a= nother RFC 4244 example, we did find that moving the syntax early in the do= cument in RFC 7044 made it more readable.=C2=A0 From a developer's pers= pective, I think it's helpful to have the syntax in mind as one reads a= ll the details of the processing.[/MB]

Overall, there are a handful of changes (beyond the typos, which again are<= br> appreciated) I'd make based on the substance of Dave's review. Some= of the
suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.
[MB] I would 3rd the need= for examples.=C2=A0 That has been a usual practice for other RFCs defining= new SIP header fields (and header field parameters). [/MB]=C2=A0

In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the<= br> signature is correct, and that we have enough confidence that
intermediaries won't break it, and that when it is broken, the verifier=
behavior makes sense. I think we've focused a lot of attention on those=
questions, but I'm happy to talk more about that if people think there&= #39;s
room for improvement.

Also, he suggests that we might need a better pointer than RFC3986 Section<= br> 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead.

Otherwise, I think we've got this covered. Anyone who's interested = in
further details can see the attached.

Jon Peterson
Neustar, Inc.


_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


--001a113cc2665273c3053a491f4f-- From nobody Wed Aug 17 13:52:57 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD97112D73A for ; Wed, 17 Aug 2016 13:52:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t3KtvflikQ4T for ; Wed, 17 Aug 2016 13:52:51 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B1B512D6B5 for ; Wed, 17 Aug 2016 13:52:51 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 5B6033004CA for ; Wed, 17 Aug 2016 16:52:49 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id afw47uKYC8xx for ; Wed, 17 Aug 2016 16:52:44 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 99B77300289 for ; Wed, 17 Aug 2016 16:52:44 -0400 (EDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> Date: Wed, 17 Aug 2016 16:52:56 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> To: IETF STIR Mail List X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Aug 2016 20:52:55 -0000 It is not fun for a WG Chair to take a vacation and then return to find = that WG Last Call discussion has escalated from a straight forward = document review to accusations of bad acts on the list. Well, that is = where I find myself, so I=92d like to take a step back and try to focus = this energy in a productive direction. First, I think that recounting a = bit of history may be helpful. Well before the STIR BOF, there was consensus that the solution needed = two parts. First, there needed to be a digital signature that covered = the claimed source telephone number and some other things to prevent = replay. Second, there needed to be credentials to provide the public = key to validate that signature. During the STIR WG chartering discussion we talked about where that = signature might be carried. We got direction from the Area Director = that we should focus on in-band mechanisms before looking at out-of-band = mechanisms. The STIR WG charter gives direction: As its priority mechanism work item, the working group will specify a=20= SIP header-based mechanism for verification that the originator of a = SIP=20 session is authorized to use the claimed source telephone number, = where=20 the session is established with SIP end to end. The WG decided that a replacement to RFC 4474 was the best way to = accomplish this, and the first WG draft on that topic was adopted in = June 2014. Before the STIR BOF, there was discussion about the type of credential = that would best scale to represent the telephone number space. The WG = recognized that using certificates for the credential meant that some = aspects of the public key infrastructure associated would need to be = left to the regulators in each country. This is a political reality = associated with telephone numbers. This was discussed and understood. = See the hum results regarding credential format at IETF 90 in July 2014: https://www.ietf.org/proceedings/90/minutes/minutes-90-stir The WG decided on certificates for the credential format, and the first = WG draft on that topic was adopted in October 2014. In most of 2015, the WG was making slow progress. Frankly, I was a bit = frustrated; with these fundamental decisions behind us, we could have = made faster progress. But then, we saw renewed energy starting in the = Summer of 2015. One recent example of this can been seen in the blog = post from last month by FCC Chairman Wheeler: https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls As part of the renewed energy, there was a suggestion to use the = signature format specified by the JOSE WG instead of a bespoke design. = The result was PASSporT, and the first WG draft on that topic was = adopted in February 2016. Now, all three of these documents are in WG Last Call. It seems that = some of the fundamental decisions that were made almost two years ago = are being called into question. If there is a technical problem, let=92s = identify it and fix it. If there is a lack of clarity, let=92s fix that = too. However, WG Last Call is not the time to revisit each decision = that brought the WG to this point. If you are the author of a review that raises a large technical problem, = I ask you to provide a concise description of the problem in a message = of its own. I am trying to separate the discussion of any such problems = from the resolution of other document comments. I ask the authors of each document to review the comments that have been = posted and offer a way forward. Thanks, Russ From nobody Wed Aug 17 14:00:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BE3612D0BF for ; Wed, 17 Aug 2016 14:00:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p3vfW8XEbl5k for ; Wed, 17 Aug 2016 14:00:30 -0700 (PDT) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AE1012B02D for ; Wed, 17 Aug 2016 14:00:30 -0700 (PDT) Received: by mail-qk0-x229.google.com with SMTP id t7so30028901qkh.1 for ; Wed, 17 Aug 2016 14:00:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=EVXpm3S/M8h23SylXbksQLEP501wo5isNK7ttvBTVrc=; b=fMCTqFwEbM8s8t5SqDzapXFPtduohhiW+icad3CvzA2adJN2mllEivKJev6lkVl+yc JdHycI3mnzgiaxBhak/jwg3i+56jgQGb7oCv4qVpFCKggH1bWvZYbYLBbo7axg66DqlH 2EDgWbmen2lmtTMg9DeISjA001SI+5yjupvmBdr/JhHvK0keBFVevTZcM2Cta1eQS2M1 NIf6T/tcPCJuNIO1z92XQAvPCt2wlvqP5V96PDAw6Qlq17CDpa1SPFNba+n08+7/tYf9 MwO2aUAjvWLSTdIXU1KOcwGFtgVp5i39s1kH8RRigZPA2aKVDHIzRlLXh7maNgTp69Qr LzZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=EVXpm3S/M8h23SylXbksQLEP501wo5isNK7ttvBTVrc=; b=dSPO9gBxnmNJVpWWAlrlqNJUnqjsI+j9N6uDPIu0VW76VWTI5ct1MaWXgDv/75RFLk ef53x4kQ5wAQGXxuKkXDPLkhnOfjh31XPXGQzmdsVkDsrJLF3gdo6tNVE+4dui6idOyZ apNksx59pSlxh9FMoHh36easQ6ClCyrXoPrideJZLA91h7GRYYo3pg+Zayn1QEPkiq4c qKyW8eyam++OMYs4gSzjsaEP/n2i5RE0K/PI5SbFcGZJRLs1MEw7O1Y7/ssIesuZ02Tz y/tg4rSVirTMdpWNBNvqneFQIFPu0LZsjL0Kz5HpPj9p4HWLViL9I7A1SZrKj9Ip9pPf 2ukg== X-Gm-Message-State: AEkoouu5JZ0Q05liNPfgBysalqO2pXpYGmnaNtLLxRtjPmZbjjWwehETCm1lmFKh6wyPgw== X-Received: by 10.55.16.78 with SMTP id a75mr48748533qkh.231.1471467627751; Wed, 17 Aug 2016 14:00:27 -0700 (PDT) Received: from [10.33.192.45] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id u23sm18811275qte.30.2016.08.17.14.00.26 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 17 Aug 2016 14:00:27 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Wed, 17 Aug 2016 17:00:24 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> To: Russ Housley X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Aug 2016 21:00:35 -0000 Thanks for this. May I offer a suggestion? Let=92s ask the authors to submit updates to = their drafts that resolve as many of the comments they see as worthy to = fix that can be done quickly. Then let=92s ask commenters to look at = the diff, identify changes that were NOT made, and use the issue tracker = to document them. That way we can avoid a lot of simple issues in the tracker, and have = separate threads for each issue remaining open. Brian > On Aug 17, 2016, at 4:52 PM, Russ Housley = wrote: >=20 > It is not fun for a WG Chair to take a vacation and then return to = find that WG Last Call discussion has escalated from a straight forward = document review to accusations of bad acts on the list. Well, that is = where I find myself, so I=92d like to take a step back and try to focus = this energy in a productive direction. First, I think that recounting a = bit of history may be helpful. >=20 > Well before the STIR BOF, there was consensus that the solution needed = two parts. First, there needed to be a digital signature that covered = the claimed source telephone number and some other things to prevent = replay. Second, there needed to be credentials to provide the public = key to validate that signature. >=20 > During the STIR WG chartering discussion we talked about where that = signature might be carried. We got direction from the Area Director = that we should focus on in-band mechanisms before looking at out-of-band = mechanisms. The STIR WG charter gives direction: >=20 > As its priority mechanism work item, the working group will specify = a=20 > SIP header-based mechanism for verification that the originator of a = SIP=20 > session is authorized to use the claimed source telephone number, = where=20 > the session is established with SIP end to end. >=20 > The WG decided that a replacement to RFC 4474 was the best way to = accomplish this, and the first WG draft on that topic was adopted in = June 2014. >=20 > Before the STIR BOF, there was discussion about the type of credential = that would best scale to represent the telephone number space. The WG = recognized that using certificates for the credential meant that some = aspects of the public key infrastructure associated would need to be = left to the regulators in each country. This is a political reality = associated with telephone numbers. This was discussed and understood. = See the hum results regarding credential format at IETF 90 in July 2014: >=20 > https://www.ietf.org/proceedings/90/minutes/minutes-90-stir >=20 > The WG decided on certificates for the credential format, and the = first WG draft on that topic was adopted in October 2014. >=20 > In most of 2015, the WG was making slow progress. Frankly, I was a = bit frustrated; with these fundamental decisions behind us, we could = have made faster progress. But then, we saw renewed energy starting in = the Summer of 2015. One recent example of this can been seen in the = blog post from last month by FCC Chairman Wheeler: >=20 > https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls >=20 > As part of the renewed energy, there was a suggestion to use the = signature format specified by the JOSE WG instead of a bespoke design. = The result was PASSporT, and the first WG draft on that topic was = adopted in February 2016. >=20 > Now, all three of these documents are in WG Last Call. It seems that = some of the fundamental decisions that were made almost two years ago = are being called into question. If there is a technical problem, let=92s = identify it and fix it. If there is a lack of clarity, let=92s fix that = too. However, WG Last Call is not the time to revisit each decision = that brought the WG to this point. >=20 > If you are the author of a review that raises a large technical = problem, I ask you to provide a concise description of the problem in a = message of its own. I am trying to separate the discussion of any such = problems from the resolution of other document comments. >=20 > I ask the authors of each document to review the comments that have = been posted and offer a way forward. >=20 > Thanks, > Russ >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 17 14:57:11 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 634C712D67C for ; Wed, 17 Aug 2016 14:57:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1iFQDa4A0Z_g for ; Wed, 17 Aug 2016 14:57:05 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0112.outbound.protection.outlook.com [104.47.34.112]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E3E212D7A0 for ; Wed, 17 Aug 2016 14:48:38 -0700 (PDT) Received: from BL2FFO11FD009.protection.gbl (10.173.160.31) by BL2FFO11HUB025.protection.gbl (10.173.161.49) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Wed, 17 Aug 2016 21:48:36 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.82) smtp.mailfrom=sprint.com; bbiw.net; dkim=none (message not signed) header.d=none;bbiw.net; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.82 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.82; helo=preapdm3.corp.sprint.com; Received: from preapdm3.corp.sprint.com (144.230.32.82) by BL2FFO11FD009.mail.protection.outlook.com (10.173.161.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.567.7 via Frontend Transport; Wed, 17 Aug 2016 21:48:36 +0000 Received: from pps.filterd (preapdm3.corp.sprint.com [127.0.0.1]) by preapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7HLBZJQ020737; Wed, 17 Aug 2016 17:48:36 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm3.corp.sprint.com with ESMTP id 24vxsdrhc8-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 17 Aug 2016 17:48:36 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 17 Aug 2016 16:48:35 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Wed, 17 Aug 2016 16:48:35 -0500 From: "Gorman, Pierce A [CTO]" To: Mary Barnes , "Peterson, Jon" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR+MlawFWovp1VakirtcyY4idXt6BNqBdg Date: Wed, 17 Aug 2016 21:48:34 +0000 Message-ID: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.32] Content-Type: multipart/alternative; boundary="_000_6bd1e4bc946a4a02a1f4fdac385984b9PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.82; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(24454002)(377454003)(189002)(199003)(2950100001)(106466001)(30436002)(87936001)(2900100001)(54356999)(19300405004)(76176999)(5890100001)(19625215002)(106116001)(92566002)(4546004)(50986999)(68736007)(5640300001)(7846002)(5001770100001)(626004)(2906002)(15975445007)(7736002)(230783001)(97736004)(86362001)(356003)(189998001)(19580395003)(108616004)(7906003)(512874002)(19580405001)(586003)(4326007)(5250100002)(24736003)(3846002)(7696003)(8936002)(33646002)(8676002)(81156014)(16236675004)(81166006)(102836003)(19617315012)(790700001)(84326002)(11100500001)(6116002); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2FFO11HUB025; H:preapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD009; 1:HEYr0BcPcbcP27WLyDlPtmhardiuEKaiY46JuMa5gnHx5UJZSSkFOxA+uAI+I9PzNaSgOXT3JtrHupmVmLmslVJQplebc1X0DOqT3L2fCNrPMMsvIG4tX2fVhmjhcmEuWWCYMrWyn6G2SBPHJuM595bU7dAaYVoBndixwWmn7GPTkrFgtVmw9HoUBSpE9mK0N6ZWQeapoDYJx0NZzwegqAEtkryRTSwSFypka40dnmV6NHQesQiACRhv+YmCm+66ZsNlfvQLFwTsUBhQFzSZmO4IJNS4ojwMFSySgTQCJxI1lSqkyre6+5xajU41ml3mblxxZG9N6jN9jMrog9Kkt63sxCRPAJnCVsQhMx1T0GelEBfN3nasPYkhB0r1oWDvsWSa7p3QVGUI2lfrlx9y1TQbRGatreGUDihcejvTsMBnMiMh5lzq6JgI0YkNgnW2PWgsFpt2+cEtc+yqgIjmIYxEFD3UConjpgbWckXJL0SInzp8Vg4JTO417fq5BhqN/Q0gDI6aa9SMB+xgWL6EiObzgVGZBmY3+gx+2g8Dhny6Kn+yE/s5xqNXaoU8W4z7ii8mPXZiYXDTTbRxLEmaOVYUlTA+Zr2lSDCo0l72hdM= X-MS-Office365-Filtering-Correlation-Id: 302d4473-5ec6-405b-d18a-08d3c6e83e15 X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB025; 2:G0XX31inEgljrzyFKsapMqWGMvxPiurMej5vHxcDgPQjdOPRYBAuqZCxG5K3cbVGcHCPmanDmcElmyZxt5KCZIt/XLGjWp9reov4qdwqKh+dLX2ZdVr1wVSWUk0QWEBfiYH3qEFi18QC5pgGTd83NIt54a+cVLYwCxgWa56WcvAIaEx/iPN+BnF8KM3ucyIU; 3:2Wn+mKrIxUhdoJQDY15kwpMTHq8L7ZdOWH7ww9ow8894Snn+hKXPV30Jxazchq5B/QLXaRRQ27DKVeayTZX2WN6Wh8GhlzC6X+tY3Ueo2ZpOKdZkwQQyCsOOOtSlwTxhdjG42WfH7BWXwQdHARb/kYkJU/gn6nusgaUBuN61S6m1jdPmUScQqJ4yuUyu68n5jEa9sGi2+LlYtg662z/N8b677/1j4t28+MXzPGV94NhDq5zb/2TwnMTXpLlUNzaBjkDcYQdWrN+4XAF4K5M2yA== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BL2FFO11HUB025; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2FFO11HUB025; 25:mFU4MX4WGo9NMMqqU9ZaCTqJELF21UcVtgyQMewA?= =?us-ascii?Q?wOQZKq+1CkS+XbEgs92BSGhrvI8T9gn2UhsIKXFul5eS0s0WouvH4/JXJZ5f?= =?us-ascii?Q?2n6zJ2YFZE/VjsfVuQo7vjRolh8sMj7Bdydkn6bQ5aMSqRUSDS8XX3mS8Z9E?= =?us-ascii?Q?J6UmJRENnVm+oeRM4rAFvwjfKNnIiu5HY413CGRLgwtqX2etiQsG7ViK+Blu?= =?us-ascii?Q?HFlUXte2yse0gc/CAQWh0QbCkcNI4SBf7VJCn5BPrd0ozEqU9j4xx9uAJk4/?= =?us-ascii?Q?LVmlyANx1WxrzP5KywEvDBdJfsIM1hI6R2TYmYgKP7NC11wQf+7/r3uTTuRV?= =?us-ascii?Q?AwBk1Ed0G9qDtAcrWq9LQyhsOFCzrDgVy5Hyiehm+fYHKKsrVUR0sGULkG1B?= =?us-ascii?Q?M8J8fsKaStz8aoq3JYqe9KXIp131YbPHnFY9DQ0UysKKGAa6Mok0o62kwXYG?= =?us-ascii?Q?gdVmKv0iUtVyTS65KKa7NghD3iAj1iZLdYFrkwwoIXRExKEAoa3CNth5BHT3?= =?us-ascii?Q?2tEemUmQoMEvS9OyWIrTxZxDGQ5S+8bNSv7QEnTnNsQRBn91ZBzZA5eJaGzk?= =?us-ascii?Q?J9+Eg7xckNKO5Q0EjqTuWFGPxFGVXGMAepyXEU592J93+xdND01VYcWR+5X1?= =?us-ascii?Q?fERqLtxkNBDV37okdZHKUxQyc49rR/2Z34IMVwUlQT8WhfvTj2XAWlxKSybH?= =?us-ascii?Q?hCH8qr6hCEyViumtLlsmnw5S3QTN+LYzIFkI0Zofmvz08Hi1ZbZ3sjZ1/DpM?= =?us-ascii?Q?JnCJmusYBekJIoT2YqVuriTi4pCG8XCqjNC2SMvX/8GfcYe1+G7PduZL/Dmk?= =?us-ascii?Q?LkZTcnVZcVMyZgZQh4vWcoDdnbVtmkBiCFz+D/ragUBVTpKmrXtjzpLXzXzB?= =?us-ascii?Q?pW+b4MRwUk6xl2VHLsRZPLxo09lxP0OYXYnd+n52otnQ9xiKu2AeeYsBDX5h?= =?us-ascii?Q?7bX1HBoFyCWvs7jzuyqM1Oe9rzXzSfPTswcwqOl09wZfOcV6znjTR13YMuUz?= =?us-ascii?Q?pWX4X0TopnKXcx3S6flmX8z+IzacZBlYRyxyowE4qPPFl35aRbtgKKlkDP32?= =?us-ascii?Q?oNyKkCWWcVN43ENiHDMuEztz+f0itTltx8t/LLGiRP8yboiV5Q=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB025; 31:AYfpDJQ7JgmlNoiGZAAizs5bqxwtEEOtUT8w13XLudfdK2mBXntL/RSak0nhP0XjMA5OdCTnIsrYm2ohPDyHE9EDNNNatOpIzmkSYECkDZ8Rjjmo5oWqml6WUq7tdanPbqTuCWHdbQldfRU1RUwXhuqzzWfjUCcdKe3I4QrLnBmWchV+swT+3nUmDCrdWYGBy36RfwrZu+/uaJir2i7rNF5Ogw01BZ4lMxC7eJnRb7c=; 20:9n/xWkxnQFmCCDlRDqoFTvr0C0VYIOGx4iAL2sZW1w2XL+kxPAz7zx73Zm19N3U3DOSDPtLpGF2fmtyqsy4RiTnFACQcuc9Tpk+/Hs7W2e/ELrk+TiDeSgdlx13zw5RrPratpdHo0PXNUSpY5Ljo082eX2lfP2zwQ/fGYy/6Cgy6WhmGAwMBAgJU8WGD2oIPs7h2twI+2Elp0mHlzBXegeAFZSLsvhGgvduYk+iW2XQrEJG+HrBD0BLmN5n1iBn4/GjWVwm8QOe46L877P71sOjMPTKBCAaHR8bEsua0rq9Tg8Heql/DETRQJIuHRYJWUA6Yd1X9IR1rk6Xe315HC+twLLQRvzYThx7s8rQbBllRS19j3q3zceXTXc+aI/tl97tlrsmZ7Ki8Gx5utymoKwBnAKj/EMGQf/5xDe4K4SQ= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(278428928389397)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(13018025)(13015025)(13023025)(13017025)(13024025)(3002001)(10201501046)(6055026); SRVR:BL2FFO11HUB025; BCL:0; PCL:0; RULEID:; SRVR:BL2FFO11HUB025; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB025; 4:qiQWFnkGRzxJhl4m820i3b8UqTETwZadIX9AaAf7CjfbmQ7sxnEfzKdHO2p1NbcUxqw05LuRbPzam41H9xJovwaOr1ZrY+yV2GKQ8p6CL/nk3CbPyjhzPjQOy29zcZ+2S5NMeopvQFGkdQ+orp+09sSTleNxx8NE4RtqQciKIh7CKwz7QWNgP5HODWaPiwxy19PTT4bX5//dnct/TnKslIfpRC25XRqWHmu1pDjh4NiBBmNYurQ6Jonc4V6GYqPYNKBJknD75i5oLI0v4OCBztoLDnbrhOA8aPhhcf2ePPAarD6Vn+07bQFURyqkr3x5kLQJmNmBbnFGJBKydRg9dAAqZflvUb5Onn5H8PM3FWoDQTVJkktQRFTaBF8eBEB1/PDgRXCAtArof8FLFiUR3E154S/194lFQKbZLnrw7SspWW1WCeT5K+rcX/fO9hWALF7tJhrd7HI2v5Rz+j27sB4BvbMMNrl7oUZ83MPjItgHOBNzM4n++Ta6l0D3+Su8j00bcjs3wbb1M2hXg9KXUzprcL1cHV9n6AX8ZPxrScpszIHSM1z2VCjtMWiLm2nuOqXKXsJLTheojWVMNWwe5w== X-Forefront-PRVS: 0037FD6480 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2FFO11HUB025; 23:6V0ugsEKw+7puU6ITx8Ljq4hx+vaZqy9xRPFX1FQ?= =?us-ascii?Q?srJP0TA7Z6ZnnARzaYrDLj0EmojAldVii8oXgc31ypfjXfW8UjBs4hL47yU7?= =?us-ascii?Q?3rP+DtVCU+6/pnRfCiUc1n1WniED5+KF1srx/1LTfawJdM5H4s07/wJ9gYIq?= =?us-ascii?Q?XulPLTxrI4T2IB/Oxm1X6GR+k04sJKAkDYmsogTfPCA8vibtMFGK4em/XmO/?= =?us-ascii?Q?oykYi5KXmj2I5p4mdBx1nhRwIdGATcZociEZE3jE5LHNMouRLB24a5AwW0D+?= =?us-ascii?Q?C9eY997d63sbwKyK3CAD/x/1i3MdEgCulLsXtOMtsA/w7JTiN9npNRNsllqd?= =?us-ascii?Q?TPpq9smw2xiHIiqCOoyFM578Qioz58xD7kUVAP2bqfqfP2Y9fLMlq3in9v6K?= =?us-ascii?Q?fq54xTtCmMrDyn+8xo9o2KuJdJ00RNP1pfH7DRHXxiivVR3xVWC3hOAbn9KH?= =?us-ascii?Q?NGXWy4a5nV4osFDTkSJxuyS5PWNyUy5RS11M6/W2s8ZtdmSDT83ZtRZiSmu9?= =?us-ascii?Q?W2sWaFPa1US5qAH1daf4vrS/GP/IBllujGV/isxhlqr9GOJA5AhGJC2/11GV?= =?us-ascii?Q?IfEbql0zsoZEc0nwFQtqH7rrh3IFQPsAUba6vZyekJOGfYSuG2hpS4xucUXe?= =?us-ascii?Q?20LPelzjGXgGpOlGs0McUBL74W+SmechI7NCGScvRxogA1+9EiBBpd1BQtRq?= =?us-ascii?Q?6unQovr9YCcTSA2aUa2w+W85Z97Q8mJl0Jjfa0bXzfcCq7yabjoRwOgNgWaM?= =?us-ascii?Q?1mM46vAktRjSoaIWSWt5GLr1qm9VjlmUw2SE+A6ytNklR8z2rxOzO+OydsAG?= =?us-ascii?Q?IuJxopLwHaNyXvH/ormEwWSeH66IMdtZHhagaGcCTC8Xq2nXrwH603XTU9z6?= =?us-ascii?Q?7Nc7rqxdIGCaLV5Tpbm/n+jOg2VDZJGuwbRY0x8kWKET8LegfDP0HlJz4KuO?= =?us-ascii?Q?nkF2y6v6nH3KLwrZtTAPd0EKX336C7GzJa1ZBrOOtOsCS/1wPY4TNBmSVgAQ?= =?us-ascii?Q?jmL+HY5xnLPFVVGX0DGKPSgd+g5OaQW+XZYyZnhk7klhFd5RW3MAIX3DhlNn?= =?us-ascii?Q?oN+oRxGGWn4sCvL8E3pQang6zKYQwCsY6V2bi1QFpLKXdYAd8frFdjcJVCgQ?= =?us-ascii?Q?K59ceJKafHzWr9sTkZMUMNaCwTruOlgagsMPweYJq9tSDZNs+9+TV/EEcKPM?= =?us-ascii?Q?fpjJUZI1sg6v5S2HtoeEMkE4GaU/E8Fj4a7tIrLeQ4x6LjNbq3pKh37mabFX?= =?us-ascii?Q?/h8qgvB7XtpR9XhdJZYgx+uw9Vqt8FEllY2D3uwmbyfCvlhROutldo8otTze?= =?us-ascii?Q?Gh2hXenltFBxClatvNfv/6ltMmOtw4dXj+onVeKCBDT7Besc8iq3vgvIWKQC?= =?us-ascii?Q?wJyTla7vCq5p05teNArvLovQtzk1a9UujslwaK4H8HyDNvV20UkF1cgXvP0A?= =?us-ascii?Q?C+hVOnHNUg=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11HUB025; 6:nZLjD0XuUM9ylolWr68d1sOFuB8NVhnPAJJ70Gx/NT75LSsobV83GtoJ6E2RD6qY3J+wl2pMIo9PRcE139ruvLDKVvqu2EhWhvEozToGP1KnmyKsdjQhOd1jzhbEK7K7AHKpC12Rcg5PTn0+lCV5HJYl9Z7Kh/lsxv1SEvEaxgnOw75B9eTV7ledpWW0ez/Ha4odClHFHxheaW3VgxTo4dU3ruVXJF8aBmi/R/m38elhKkGinwLeRUl7y1Mq5wTDtWv91xBouxQ3J78vatEV3/F5cA/D4cbsi2Cb5Td0DK+MvxAChTApNAgwwnFRLWgRKyQP39mRE1CcdSfUw5VDSw==; 5:qHvi1gAsMiqNKc+eMtfmBQB5ogYT4NYMnUWGrHkHhhrL+qpGJ1Urz2dw+BiI9SIuO0xhjx7jS/ywdDcoNQtYpGWH7/mPJzlB2CBi8p5EkM0QpV3JCrVIbqLNvk7BkPcC5KAhBM4F/6M/65qpYR12PA==; 24:kN3j960mpZD17kIGBugU5IjOziHy0jIA7yqP9ugxkJeKs+5oBVQPXrJ96ltfJP2sTHDs11EIkhsqFubDz2Limi6cobOeTtYrb+6HEYfSezc=; 7:J58KXpAhiR39rC2kdQqOouhHyGPu4kpSqqoEpvfkzs1PCH5u7hIsTYcOhrTVfYy+PLLIwnDaZsNm44YEIXiBCUAJoU3qgdIQyO3A/4GIlu0ofYeWY6bFD8YAjjIYEN34yypOhNWLvYi57stDfSl2rrIAyLAGOh7P1kRKsKyViUAZo/rervg0S8jXZNn8FO9xSoWKLkxvQmGzp1USHT+Drt0kOAqPDYzPoIwJa9v7KyFndV/wyZN8QTmipLA2fsIH SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Aug 2016 21:48:36.4921 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.82]; Helo=[preapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2FFO11HUB025 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Aug 2016 21:57:08 -0000 --_000_6bd1e4bc946a4a02a1f4fdac385984b9PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U29ycnkuICBOb3QgcmVzcG9uZGluZyB0byBNYXJ54oCZcyBleGNlbGxlbnQgY29tbWVudHMuIEkg ZGlkbuKAmXQgc2VlIEpvbuKAmXMgZS1tYWlsIGFuZCBkb27igJl0IHdhbnQgdG8gZ28gbG9vayBm b3IgaXQsIHNvIEnigJltIHJlcGx5aW5nIHRvIEpvbuKAmXMgZS1tYWlsIHRoYXQgTWFyeSB3YXMg cmVzcG9uZGluZyB0by4gIChzbWlsZXkgZW1vdGljb24pDQoNCkluIHJlYWRpbmcgTWFyeeKAmXMg cmVtYXJrcyBJIHNhdyB0aGF0IEpvbiBzYWlkLCDigJxbRGF2ZV0gcG9pbnRlZCBvdXQgdGhhdCB3 ZSByZWFsbHkgZG9uJ3QgaGF2ZSBhbnkgbW90aXZhdGlvbiBmb3IgaW5jbHVkaW5nIG11bHRpcGxl IElkZW50aXR5IGhlYWRlcnMgaW4gdGhlcmUsIGFuZCB3ZSBwcm9iYWJseSBkbyBuZWVkIGFuIGlu ZGljYXRpb24gb2Ygd2hhdCBmdXR1cmUgd29yayBtaWdodCB1c2UgdGhhdCBmZWF0dXJlLuKAnQ0K DQpJdCBoYXMgb2NjdXJyZWQgdG8gbWUgYmVmb3JlIHRoYXQgbXVsdGlwbGUgc2lnbmF0dXJlcyBt aWdodCBiZSBoYW5keS4gIEludGVudGlvbmFsbHkgYW5kIGlsbGVndGltYXRlbHkgYXV0aGVudGlj YXRpbmcgc3Bvb2ZlZCBjYWxsaW5nIG51bWJlcnMgaXMgcG9zc2libGUuICBBIHByb3h5IHdoaWNo IGhhZCBpbmZvcm1hdGlvbiBhYm91dCBhbiB1bnRydXN0d29ydGh5IHNvdXJjZSBtaWdodCBsaWtl IHRvIGFkZCBhIHNpZ25hdHVyZSB3aGljaCBpbiBlZmZlY3Qgc2F5cywg4oCceW91IGNhbiB0cnVz dCB0aGUgY2FsbCBjYW1lIGZyb20gdGhlIG9yaWdpbmF0b3Igb3duaW5nIHRoZSBjZXJ0aWZpY2F0 ZSwgYnV0IHlvdSBjYW5ub3QgdHJ1c3QgdGhhdCB0aGUgY2VydCBvd25lciB1c2VkIGl0IGxlZ2l0 aW1hdGVseeKAnS4gIEl0IHdvdWxkIGJlIGEgd2F5IHRvIHByZXNlcnZlIHRoZSBvcmlnaW5hdGlu ZyBhdXRoZW50aWNhdGlvbiBpbmZvcm1hdGlvbiB3aGljaCBpcyB1c2VmdWwsIGJ1dCBkZXByZWNh dGluZyBpdCB0b28uDQoNCkkgc3VwcG9zZSB0aGVyZSBjb3VsZCBiZSBIaXN0b3J5LUluZm8gc29y dHMgb2YgYXBwbGljYXRpb25zIHRvby4NCg0KUGllcmNlDQoNCkZyb206IE1hcnkgQmFybmVzIFtt YWlsdG86bWFyeS5pZXRmLmJhcm5lc0BnbWFpbC5jb21dDQpTZW50OiBBdWd1c3QgMTcsIDIwMTYg MjowNCBQTQ0KVG86IFBldGVyc29uLCBKb24gPGpvbi5wZXRlcnNvbkBuZXVzdGFyLmJpej4NCkNj OiBzdGlyQGlldGYub3JnOyBkY3JvY2tlckBiYml3Lm5ldA0KU3ViamVjdDogUmU6IFtzdGlyXSBS ZXZpZXcgb2Y6IGRyYWZ0LWlldGYtc3Rpci1yZmM0NDc0YmlzLTEwDQoNCkpvbiwNCg0KVGhhbmtz IGZvciByZXNwb25kaW5nIHRvIERhdmUncyBjb21tZW50cyAtIEkgZm91bmQgdGhhdCBxdWl0ZSBo ZWxwZnVsLiAgSSBoYXZlIHNvbWUgY29tbWVudHMvcmVzcG9uc2VzIGJlbG93IFtNQl0uICBBcyBh IGNhdmVhdCB0byBteSByZXNwb25zZXMsIEkgZGlkIG5vdCByZWFkIGFsbCB0aGUgZGV0YWlscyBp biBEYXZlJ3MgcmV2aWV3Lg0KDQpSZWdhcmRzLA0KTWFyeS4NCg0KT24gU2F0LCBBdWcgMTMsIDIw MTYgYXQgMjo0MCBBTSwgUGV0ZXJzb24sIEpvbiA8am9uLnBldGVyc29uQG5ldXN0YXIuYml6PG1h aWx0bzpqb24ucGV0ZXJzb25AbmV1c3Rhci5iaXo+PiB3cm90ZToNCg0KSSBmaW5hbGx5IGhhZCBh IGNoYW5jZSB0byBnbyB0aHJvdWdoIHRoZXNlIGNvbW1lbnRzLCBhbmQgSSBkaWQgd2FudCB0bw0K cHJvdmlkZSBhIGZldyByZXNwb25zZXMgb24gRGF2ZSdzIHJldmlldyBvZiByZmM0NDc0YmlzIGhl cmUuDQoNCj5UYWtlbiBvbiBpdHMgb3duIGFuZCBhbHNvIHdoZW4gdGFrZW4gd2l0aCBpdHMgY29t cGFuaW9uIGRvY3VtZW50cywgdGhlDQo+c3BlY2lmaWNhdGlvbnMgYXJlIGNvbmZ1c2luZyBhbmQg aW5jb21wbGV0ZS4gIEl0IGlzIHF1aXRlIGZhciBmcm9tIGJlaW5nDQo+cmVhZHkgZm9yIHB1Ymxp Y2F0aW9uLg0KDQpIYXZpbmcgbG9va2VkIHRocm91Z2ggRGF2ZSdzIHNwZWNpZmljIGNvbmNlcm5z LCBJIGRvbid0IHRoaW5rIGhlIG1ha2VzIGhpcw0KY2FzZSBmb3IgdGhpcyBjcml0aWNpc20uDQoN Cj5UZXJtaW5vbG9neSBpcyB1c2VkIGluY29uc2lzdGVudGx5LiBJdCBvZnRlbiBpcyBpbnRyb2R1 Y2VkIHdpdGggbm8NCj5iYWNrZ3JvdW5kIG9yIGNpdGF0aW9uLiAgTWFueSB1c2VzIG9mICdoZWFk ZXInIGFyZSBwcm9iYWJseSBzdXBwb3NlZCB0bw0KPmJlICdoZWFkZXIgZmllbGQnLiAgTXkgc2Vu c2UgaXMgdGhhdCBxdWl0ZSBhIGJpdCBvZiB0ZXJtaW5vbG9neSBpcyB1c2VkDQo+ZXF1YWxseSBs b29zZWx5Lg0KDQpJIHRoaW5rIHRoZSB1c2Ugb2YgdGVybWlub2xvZ3kgaW4gdGhlIHNwZWNpZmlj YXRpb24gaGFzIHByb3BlciBiYWNrZ3JvdW5kDQphbmQgY2l0YXRpb25zLiBDZXJ0YWlubHkgRGF2 ZSBpcyBjb3JyZWN0IHRoYXQgdGhlIHRleHQgaXMgcHJldHR5IGxheCB3aXRoDQoiaGVhZGVyIiB2 cy4gImhlYWRlciBmaWVsZCIgdnMuICJoZWFkZXIgZmllbGQgdmFsdWUsIiBubyBkZW55aW5nIHRo YXQuIElmDQpwZW9wbGUgdGhpbmsgdGhpcyBpcyBhIGJpZyBkZWFsLCBJIHdpbGwgZml4IGl0LiBC dXQgdGhlIHN1Z2dlc3Rpb24gdGhhdA0KYmVjYXVzZSB0aGlzIGlzIHRydWUsIHRlcm1pbm9sb2d5 IGlzIGxvb3NlbHkgdXNlZCB0byBhIHBvaW50IHdoZXJlIGl0DQp3b3VsZCBoYW1wZXIgaW1wbGVt ZW50YXRpb24sIHRoYXQgSSB0aGluayBoaXMgY29tbWVudHMgZG9uJ3QgcmVhbGx5DQpzdWJzdGFu dGlhdGUuDQoNCltNQl0gQXMgcGVuZGFudGljIGFzIGl0IG1pZ2h0IHNlZW0sIGluIG15IGV4cGVy aWVuY2UsIHRoZSBleHBlY3RhdGlvbiBpcyB0aGF0IHdlIGFyZSBwcmVjaXNlIHdpdGggdGVybWlu b2xvZ3kgaW4gdGhlIHNwZWNzLCBzbyB0aGF0IHF1YWxpZnlpbmcgJ2hlYWRlcicgYXMgJ2hlYWRl ciBmaWVsZCcgYW5kICdwYXJhbWV0ZXInIGFzICdoZWFkZXIgZmllbGQgcGFyYW1ldGVyJyBpcyBh IHJlYXNvbmFibGUgZXhwZWN0YXRpb24uIEkndmUgaGFkIHRvIGRvIHRoYXQgd2l0aCB0aGUgUkZD cyB0aGF0IEkndmUgYXV0aG9yZWQgYW5kIGluIHJlLXJlYWRpbmcgdGhpcyBkb2N1bWVudCByZWNl bnRseSwgSSB0aGluayBpdCBhZGRzIHRvIHRoZSByZWFkYWJpbGl0eS91bmRlcnN0YW5kaW5nIGlu IHBhcnRpY3VsYXIgc2luY2UgdGhlIEFCTkYgY29tZXMgbGF0ZXIuIFsvTUJdDQoNCg0KPlRoZXJl IGlzIG5vIGludGVncmF0aXZlIGFyY2hpdGVjdHVyYWwgZGVzY3JpcHRpb24sIHNvIHRoZSByZWFk ZXIgaGFzDQo+ZGlmZmljdWx0eSB1bmRlcnN0YW5kaW5nIHdoYXQgYWxsIG9mIHRoZSBwaWVjZXMg YXJlIG9yIGhvdyB0aGV5IGZpdA0KPnRvZ2V0aGVyLiAgSW4gZmFjdCBpcyBhcHBlYXJzIHRoYXQg dGhlIGRvY3VtZW50IGl0c2VsZiBnZXRzIGNvbmZ1c2VkIG9uDQo+dGhpcyBtYXR0ZXIuDQoNCkkn bSBub3Qgc3VyZSB3aGF0IGFuICJpbnRlZ3JhdGl2ZSBhcmNoaXRlY3R1cmFsIGRlc2NyaXB0aW9u IiB3b3VsZCBlbnRhaWwsDQpidXQgdGhlcmUgYXJlIGEgbnVtYmVyIG9mIHNlY3Rpb25zIHRoYXQg cHJvdmlkZSBvdmVydmlld3Mgb2Ygb3BlcmF0aW9ucw0KYW5kIHJlbGF0ZWQgZXhhbXBsZXMgb2Yg aG93IHRoZSBhcmNoaXRlY3R1cmFsIHBpZWNlIGNvbWUgdG9nZXRoZXIuIEkgZG9uJ3QNCnRoaW5r IGFueXRoaW5nIGluIHRoZSByZXZpZXcgY29tbWVudHMgZ2VudWluZWx5IHN1YnN0YW50aWF0ZXMg dGhhdCB0aGUNCmRvY3VtZW50IGl0c2VsZiBpcyBjb25mdXNlZCBhYm91dCBpdHMgb3duIGFyY2hp dGVjdHVyZS4NCg0KPkFsZ29yaXRobXMgYXJlIGFsbCBvZmZlcmVkIG9ubHkgYXMgcHJvc2UgYW5k IG9mdGVuIGluIGEgZm9ybSBtaXRpZ2F0aW5nDQo+Y29tcHJlaGVuc2lvbiwgc3VjaCBhcyB0ZW5k aW5nIHRvd2FyZHMgbmVnYXRpb24gb3IgZGlzanVuY3Rpb24sIHdoaWNoDQo+aHVtYW5zIHByb2Nl c3MgbGVzcyB3ZWxsIHRoYW4gYWZmaXJtYXRpdmVzIGFuZCBjb25qdW5jdGlvbnMuIEZyb20gd2hh dCBJDQo+Y2FuIHRlbGwsIHRoZSBhbGdvcml0aG1zIG9mdGVuIGFyZSBpbmNvbXBsZXRlLCBidXQg c2VyaW91cyBhbmFseXNpcyBpcw0KPmRpZmZpY3VsdC4NCg0KQWxnb3JpdGhtcyBhcmUgb2ZmZXJl ZCBpbiBzdGVwcyB3aXRoIG5vcm1hdGl2ZSBsYW5ndWFnZSwgaWYgdGhhdCdzIHdoYXQNCnlvdSBt ZWFuIGJ5ICJwcm9zZSBmb3JtIi4gUkZDcyBhcmUgdHlwaWNhbGx5IGNvbXBvc2VkIG9mIHByb3Nl LiBUaGUgcmV2aWV3DQpkb2VzIHJldmVhbCBzb21lIHZlcnkgc3RyaWtpbmcgdmlld3MgYWJvdXQg c3BlY21hbnNoaXAgYW5kIGFsZ29yaXRobXMgaW4NCnBhcnRpY3VsYXIgd2hpY2ggYXJlIGZvcmVp Z24gdG8gbXkgZXhwZXJpZW5jZSBpbiB0aGUgSUVURi4NCg0KPlRoZSBkb2N1bWVudHMgYXBwZWFy IHRvIHJlbHkgb24gYSByZWFkZXIncyBoYXZpbmcgcXVpdGUgYSBiaXQgb2YgcHJpb3INCj5rbm93 bGVkZ2UgYW5kIGFyZSBjZXJ0YWlubHkgbm90IHVzYWJsZSBieSBhbiBpbXBsZW1lbnRlciB3aG8g aXMgbm90DQo+YWxyZWFkeSBkZWVwbHkgZW1iZWRkZWQgaW4gdGhlIGNvbW11bml0eSB0aGF0IHBy b2R1Y2VkIHRoZXNlDQo+c3BlY2lmaWNhdGlvbnMuICBNeSBpbXByZXNzaW9uIGlzIHRoYXQgYmVp bmcgZW1iZWRkZWQgd29uJ3Qgc3VmZmljZQ0KPmVpdGhlciwgYm90aCBmcm9tIG15IGFzc2Vzc21l bnQgb2YgdGhlIGRvY3VtZW50cycgZGVmaWNpZW5jaWVzIGFuZCBnaXZlbg0KPmJhY2stY2hhbm5l bCBjb21tZW50cyBJIGhhdmUgaGVhcmQgYWJvdXQgdGhlIGV4cGVjdGF0aW9uIG9mIHRoZSB3b3Jr IHRvDQo+YmUgZG9uZSBhZnRlciB0aGVzZSBzcGVjaWZpY2F0aW9ucyBhcmUgcHVibGlzaGVkLg0K DQpXZSBkbyBleHBlY3QgYmFzaWMgU0lQIGxpdGVyYWN5LCBhbmQgYSB3aWxsaW5nbmVzcyB0byBm b2xsb3cgcmVmZXJlbmNlcw0KYW5kIHJlYWQgZXh0ZXJuYWwgc3BlY2lmaWNhdGlvbnMgYW5kIHNl Y3Rpb25zIHRoYXQgYXJlIGNpdGVkLiBSZWFkZXJzIHRoYXQNCmFyZSB1bndpbGxpbmcgdG8gZG8g dGhpcyB3aWxsIHByb2JhYmx5IGZpbmQgYSBsb3Qgb2YgdGhpbmdzIGNvbmZ1c2luZyBpbg0KdGhl cmUuDQpbTUJdICBJIHRoaW5rIHRoZSBjaGFsbGVuZ2UgaXMgdGhhdCAnYmFzaWMgU0lQIGxpdGVy YWN5JyBpc24ndCBzdWNoIGEgYmFzaWMgdGhpbmcgYW55bW9yZSBhbmQgaXQgZG9lcyByZXF1aXJl ICphIGxvdCogb2YgYmFja2dyb3VuZCB0byBwYXJzZSB0aGlzIGRvY3VtZW50LCBidXQgSSBkb24n dCBrbm93IGEgd2F5IGFyb3VuZCB0aGF0LiBbL01CXQ0KDQo+T3ZlcmFsbCwgdGhlIHdyaXRpbmcg aW1wZWRlcyBjb21wcmVoZW5zaW9uIGFuZCB0aGUgZG9jdW1lbnQgbmVlZHMgYSB2ZXJ5DQo+ZGls aWdlbnQgcGFzcyBieSBhIHRlY2huaWNhbCBlZGl0b3IuICBJIHN1c3BlY3QgdGhpcyB3aWxsIHVu Y292ZXIgcXVpdGUNCj5hIG51bWJlciBvZiBzZW1hbnRpYyBkZWZpY2llbmNpZXMgaW4gdGhlIHRl eHQuDQoNCllvdSBkaWQgY2F0Y2ggc29tZSBnb29kIHR5cG9zLCBhbmQgSSBjYXVnaHQgYSBmZXcg bW9yZSBmb2xsb3dpbmcgeW91cg0Kbm90ZXMgdGhyb3VnaCB0aGUgdGV4dC4gSSdtIG5vdCBzdXJl IHRoYXQgeWllbGRlZCB0aGUgc2VtYW50aWMNCmRpZmZpY3VsdGllcyB5b3Ugc3BlY3VsYXRlIGFi b3V0IGhlcmUgdGhvdWdoLg0KDQo+VGhlcmUgaXMgYSBwb3NzaWJsZSB0ZW5kZW5jeSB0byBzdXBw b3J0IG1vcmUgYWx0ZXJuYXRpdmUgYmVoYXZpb3IgdGhhbg0KPmFwcHJvcHJpYXRlLiBTdWNjZXNz ZnVsIGludGVyb3BlcmFiaWxpdHkgdXN1YWxseSBiZW5lZml0cyBmcm9tIGZld2VyDQo+Y2hvaWNl cywgbm90IG1vcmUuICBDb21tb24sIG1hbmRhdG9yeSBjYW5vbmljYWxpemF0aW9uIGlzIGFuIGV4 YW1wbGUuDQoNCkNvbW1vbiwgbWFuZGF0b3J5IGNhbm9uaWNhbGl6YXRpb24gb2YgdGVsZXBob25l IG51bWJlcnMgaXMgdW5mb3J0dW5hdGVseQ0Kb25seSBzbGlnaHRseSBtb3JlIHJlbGlhYmxlIHRo YW4gY29tbW9uLCBtYW5kYXRvcnkgbm9ybWFsaXphdGlvbiBvZg0KaW50ZXJuYXRpb25hbGl6ZWQg ZG9tYWluIG5hbWVzLiBBdCBsZWFzdCBpdCdzIGp1c3QgbnVtYmVycy4gVGhlIGFsZ29yaXRobQ0K d2UgaGF2ZSBpcyBnb29kIGVub3VnaCB0byBjb3ZlciB0aGUgY29tbW9uIG9wZXJhdGlvbmFsIGNh c2UsIGFuZCB3aGVyZSBpdA0KZmFpbHMsIGhvcGVmdWxseSAiY2Fub24iIHdpbGwgaGVscCB0byBj bG9zZSB0aGUgZ2FwLg0KDQo+Q3JlZGVudGlhbHM6IHRoZSBzcGVjaWZpY2F0aW9uIG5laXRoZXIg ZGVmaW5lcyBub3IgcmVmZXJlbmNlcyBhIHN0YW5kYXJkDQo+Zm9yIHRoZSBzcGVjaWZpY2F0aW9u IG9mIGNyZWRlbnRpYWxzLCBoZXJlLiAgVGhhdCBtZWFucyB0aGF0IHRoZQ0KPnRlY2huaWNhbCBk ZXRhaWxzIC0tIGFzIGRpc3RpbmN0IGZyb20gdGhlIG9wZXJhdGlvbmFsIHBvbGljaWVzIC0tIG9m DQo+Y3JlZGVudGlhbHMgYXJlIG91dCBvZiBzY29wZSwgYWx0aG91Z2ggdGhleSBhcmUgZnVuZGFt ZW50YWwgdG8gcHJvcGVyDQo+b3BlcmF0aW9uIG9mIHRoaXMgc2VydmUuICBUaGlzIGlzIGEgc2hv d3N0b3BwZXIsIGluIHRlcm1zIG9mDQo+c3BlY2lmaWNhdGlvbiBjb21wbGV0ZW5lc3MgZm9yIHRo ZSBzZXJ2aWNlLg0KDQpXZWxsLCBpdCBkb2VzIHJlZmVyZW5jZSBhIHN0YW5kYXJkIGZvciB0aGUg c3BlY2lmaWNhdGlvbiBvZiBjcmVkZW50aWFsczoNCnN0aXItY2VydHMuIEkgYWdyZWUgaXQgd291 bGQgYmUgYSBzaG93c3RvcHBlciBpZiB3ZSBkaWRuJ3QgaGF2ZSB0aGUNCnN0aXItY2VydHMgd29y ay4NCg0KPkhvdyBpcyB0aGUgcmVjaXBpZW50IHRvIGtub3cgd2hhdCBjcmVkZW50aWFsICdzdGFu ZGFyZCcgaXMgdXNlZD8gIEhvdw0KPmRvZXMgdGhpcyBlbnN1cmUgaW50ZXJvcGVyYWJpbGl0eSBi ZXR3ZWVuIHR3byBwYXJ0aWNpcGFudHMgd2hvIGhhdmUgbm90DQo+aW50ZXJhY3RlZCBiZWZvcmU/ DQoNClRoZXJlIGlzIGluIHByYWN0aWNlIG9ubHkgb25lIGF0IHRoZSBtb21lbnQuIEknbSBjb250 ZW50IHRvIHdvcnJ5IGFib3V0DQppbnRlcm9wIHByb2JsZW1zIHdoZW4gd2UgaGF2ZSBhbm90aGVy IG9uZS4NCg0KPkF0IGJhc2UsIHRoZXNlIHNwZWNpZmljYXRpb25zIGFwcGVhciBpbnRlbmRlZCB0 byByb3VnaGx5IGNoYXJ0IG91dCBhDQo+c3lzdGVtIHN0cnVjdHVyZSwgbGVhdmluZyBtb3N0IG9m IHRoZSBkaWZmaWN1bHQgd29yayBmb3IgbGF0ZXIgYW5kDQo+ZWxzZXdoZXJlLiAgQnkgd2F5IG9m IGV4YW1wbGUsIHRoZXJlIGFyZSBmZXcgaWYgYW55IGNyb3NzLW9yZ2FuaXphdGlvbg0KPmtleSBt YW5hZ2VtZW50IHNlcnZpY2VzIG9uIHRoZSBJbnRlcm5ldCB0aGF0IGRlbW9uc3RyYXRlIHRoZSB1 dGlsaXR5DQo+bmVlZGVkIGhlcmUuICBJIGFtIHByZXR0eSBzdXJlIHRoYXQgV2ViIGNlcnRzIGRv bid0IHF1YWxpZnkuICBXZSBrbm93DQo+dGhhdCBES0lNJ3Mgb3BlcmF0aW9uIGRvZXMsIG9mIGNv dXJzZS4gIEhvd2V2ZXIgREtJTSBzdHJpY3RseSB1c2VzDQo+ZG9tYWluIG5hbWVzIGFzIGlkZW50 aWZpZXJzIGFuZCB0aGV5IGNvbnZlbmllbnRseSBhbGlnbiB3aXRoIHRoZWlyDQo+YWRtaW5pc3Ry YXRpdmUgYXV0aG9yaXRpZXMsIHdoZXJlYXMgdGVsZXBob25lIG51bWJlcnMgZG8gbm90Li4uDQoN CkknZCBzYXkgdGhhdCwgYnkgZGVzaWduLCByZmM0NDc0YmlzIGlzIHByZXR0eSB0aWdodGx5IGNv bmZpbmVkIHRvDQpzcGVjaWZ5aW5nIHRoZSBTSVAgb3Zlci10aGUtd2lyZSBwcm90b2NvbCBiZWhh dmlvci4gSXQgdGFrZXMgYSBsb3Qgb2Ygc3BlYw0KanVzdCB0byBkbyB0aGF0Lg0KDQpBbmQgeW91 ciBwcmFpc2Ugb2YgREtJTSBhcyBhIG1vZGVsIGlzIG9uY2UgYWdhaW4gbm90ZWQuIEkgd291bGQg cmVzcG9uZA0KYWdhaW4gdGhhdCB3ZSBhcmUgdW5saWtlbHkgdG8gYWJhbmRvbiBvdXIgeWVhcnMg b2Ygd29yayBvbiB0aGlzIG1lY2hhbmlzbQ0KYW5kIHN3aXRjaCB0byBES0lNIGF0IHRoaXMgcG9p bnQsIG5vIG1hdHRlciBob3cgbWFueSBjb21tZW50cyB5b3UgcGxhY2UgaW4NCm91ciBwYXRoLg0K DQo+ICAgICAgW1tbIFRoZSBtYWlsaW5nIGxpc3QganVzdCBoYWQgYW4gZXh0ZW5zaXZlIHJlZ3Vy Z2l0YXRpb24gb2YNCj5jcml0aWNhbCBjb21tZW50YXJ5IGFib3V0IEVOVU0uICBXaGF0IGFwcGVh cnMgdG8gYmUgZ2V0dGluZyBtaXNzZWQgaXMNCj50aGF0IHdoYXRldmVyIG1lY2hhbmlzbSBpcyBn b2luZyB0byBiZSB1c2VkIGZvciBmaW5kaW5nIGFuZCB2YWxpZGF0aW5nDQo+a2V5cyBpcyBnb2lu ZyB0byBoYXZlIG5vIG9wZXJhdGlvbmFsIGhpc3Rvcnkgb2YgcmVsaWFiaWxpdHksIHNhZmV0eSBv cg0KPmVmZmljYWN5LiBdXV0NCg0KSFRUUCBoYXMgbm9uZSBvZiB0aG9zZSBxdWFsaXRpZXMsIGFw cGFyZW50bHkuDQoNCj5UaGVyZSBpcyByZW1hcmthYmx5IGxpdHRsZSBvZiB0aGUgb3JpZ2luYWwg UkZDIDQ0NzQgc3Vic3RhbmNlIHN0aWxsIGluDQo+dGhpcyBkb2N1bWVudC4gIENhbGxpbmcgaXQg YSBiaXMgaXMgYSBiaXQgbGlrZSB0ZWFyaW5nIGFsbCBvZiBhIGJ1aWxkaW5nDQo+ZXhjZXB0IGl0 cyBmaXJlcGxhY2Ugb3IgaXRzIGZyb250IGRvb3IgYW5kIGNhbGxpbmcgdGhhdCBhIHJlbW9kZWxp bmcuDQo+VGhlIHByZXZpb3VzIGRvY3VtZW50IGRvZXMgbm90IGhhdmUgYW4gaW5zdGFsbGVkIGJh c2UsIHNvIEkgc3Ryb25nbHkNCj5zdWdnZXN0IHJlbW92aW5nIGFsbCByZWZlcmVuY2VzIHRvIGl0 LiAgSXQgd2lsbCBhbGxvdyBzb21lIG9mIHRoZSB0ZXh0DQo+dG8gYmUgbm90YWJseSBzaW1wbGVy IGFuZCBjbGVhcmVyLg0KDQpJIHRoaW5rIGVub3VnaCBvZiB0aGUgY29uY2VwdHMgYW5kIHByb3Rv Y29sIG1lY2hhbmlzbXMgb2YgdGhlIG9yaWdpbmFsIGFyZQ0KcmV0YWluZWQgdG8gd2FycmFudCBr ZWVwaW5nIHRoaXMgYXMgYSBiaXMuDQoNCltNQl0gSSdtIG5vdCBzdXJlIG9uIHRoaXMgb25lLCBp biBwYXJ0aWN1bGFyIGdpdmVuIHRoYXQgaXQgZGVwcmVjYXRlcyB0aGUgaGVhZGVyIGZpZWxkcyBk ZWZpbmVkIGluIFJGQyA0NDc0IChwZXIgc2VjdGlvbiA4KS4gIEFuZCwgdW5saWtlIG90aGVyIC1i aXMgc3BlY3MgdGhlcmUgaXMgbm8gc3VtbWFyeSBzZWN0aW9uIGluIHRoaXMgZG9jdW1lbnQgb2Yg dGhlIGRpZmZlcmVuY2VzIGJldHdlZW4gdGhlIHR3by4gIEFsc28sIGN1cnJlbnRseSB0aGlzIGRy YWZ0IGRvZXNuJ3QgaW5kaWNhdGUgd2hhdCBpbXBhY3QgaXQgaGFzIG9uIDQ0NzQgaW4gdGhlIGhl YWRlciBwYWdlLiBUaGVyZSBpcyB0aGUgc2VudGVuY2UgYXQgdGhlIGVuZCBvZiBzZWN0aW9uIDEg c3RhdGluZyB0aGF0IHRoaXMgZG9jdW1lbnQgInJldmlzZXMgUkZDIDQ0NzQiIGJ1dCB0aGF0J3Mg bm90IHBhcnRpY3VsYXJseSBtZWFuaW5nZnVsLiBHaXZlbiB0aGF0IHdoZW4gd2UgcHJvZHVjZWQg UkZDIDcwNDQsIHdlIG9ic29sZXRlZCBSRkMgNDI0NCBkZXNwaXRlIFJGQyA3MDQ0IGJlaW5nIGJh Y2t3YXJkcyBjb21wYXRpYmxlIHdpdGggUkZDIDQyNDQsIEkgcmVhbGx5IHRoaW5rIHRoYXQgdGhp cyBkcmFmdCBzaG91bGQgYmUgZG9jdW1lbnRlZCBhcyBvYnNvbGV0aW5nIFJGQyA0NDc0LiBbL01C XQ0KDQo+VGhlIGRvY3VtZW50IGlzIGhlYXZ5IHdpdGggZm9yd2FyZCByZWZlcmVuY2VzLiAgVGhl c2UgZm9yY2UgdGhlIHJlYWRlcg0KPnRvIHN0b3Agd2hhdCB0aGV5IGFyZSBpbiB0aGUgbWlkZGxl IG9mLCB0cnkgdG8gaG9sZCB0aGF0IHBsYWNlLCBhbmQgbG9vaw0KPmZvcndhcmQgdG8gdW5kZXJz dGFuZCB3aGF0IHRoZXkndmUganVzdCBiZWVuIGludGVycnVwdGVkIGZyb20gcmVhZGluZy4NCj5B cyBhIGxpdGVyYXJ5IHN0eWxlLCBmb3J3YXJkIHJlZmVyZW5jZXMgY3JlYXRlIHVzZWZ1bCB0ZW5z aW9uLiAgSW4NCj5zcGVjaWZpY2F0aW9ucyB0aGV5IGp1c3QgaW50ZXJydXB0IHRoZSBmbG93LiAg VGhlIGRvY3VtZW50IHNob3VsZCBiZQ0KPnJlb3JnYW5pemF0aW9uIHNvIHRoYXQgaW50ZWdyYXRp dmUgdGV4dCBjb21lcyAvYWZ0ZXIvIHRoZSB0ZXh0DQo+ZGVzY3JpYmluZyB0aGUgcGllY2VzIGJl aW5nIGludGVncmF0ZWQuICBBbmQgb3BlbmluZyBvdmVydmlldywgZGVzaWduDQo+c3VtbWFyeSwg b3IgdGhlIGxpa2UgY2FuIGdpdmUgYSBub24tbm9ybWF0aXZlIGRlc2NyaXB0aW9uIG9mIHRoZQ0K PmFyY2hpdGVjdHVyZSBhbmQgdGhlIHNlcnZpY2UsIHNvIHRoZSByZWFkZXIgaGFzIGEgYmFzaWMg c2Vuc2Ugb2YgdGhlIGJpZw0KPnBpY3R1cmUsIGJlZm9yZSBkaXZpbmcgaW50byB0aGUgZGV0YWls IG9mIHRob3NlIHRvLWJlLWludGVncmF0ZWQgcGllY2VzLg0KDQoNCkRhdmUgZG9lcyBtYWtlIGEg bnVtYmVyIG9mIG9yZ2FuaXphdGlvbmFsIHN1Z2dlc3Rpb25zIGFib3V0IHRoZSBzcGVjLiBUaGUN CnNwZWMgaGFzIGFuIG92ZXJ2aWV3LCBhIGRlc2lnbiBzdW1tYXJ5LCBiZWZvcmUgaXQgZ2V0cyBk b3duIHRvIHNwZWNpZnlpbmcNCnRoaW5ncy4gVGhlIHZpcnR1ZSBvZiB0aGUgImludGVncmF0aXZl IiBhcHByb2FjaCBoZSBkZXNjcmliZXMgaXMgaG93ZXZlcg0KdW5jbGVhciB0byBtZS4gSSB0aGlu ayB3aGV0aGVyIHlvdSBkZWZpbmUgdGhlIGF1dGggc2VydmljZSBiZWhhdmlvciBmaXJzdA0Kb3Ig ZGVmaW5lIHRoZSBoZWFkZXIgc3ludGF4IGZpcnN0LCBvbmUgb2YgdGhvc2Ugc2VjdGlvbnMgaXMg Z29pbmcgdG8gZW5kDQp1cCBwb2ludGluZyB0byB0aGUgb3RoZXIuIFRoZXJlIHdhc24ndCBtdWNo IGluIGhpcyByZW9yZyBzdWdnZXN0aW9ucyB0aGF0DQpzZWVtZWQgdG8gbWUgbGlrZSBhIHN1YnN0 YW50aWFsIGltcHJvdmVtZW50Lg0KW01CXSBBcyBhbm90aGVyIFJGQyA0MjQ0IGV4YW1wbGUsIHdl IGRpZCBmaW5kIHRoYXQgbW92aW5nIHRoZSBzeW50YXggZWFybHkgaW4gdGhlIGRvY3VtZW50IGlu IFJGQyA3MDQ0IG1hZGUgaXQgbW9yZSByZWFkYWJsZS4gIEZyb20gYSBkZXZlbG9wZXIncyBwZXJz cGVjdGl2ZSwgSSB0aGluayBpdCdzIGhlbHBmdWwgdG8gaGF2ZSB0aGUgc3ludGF4IGluIG1pbmQg YXMgb25lIHJlYWRzIGFsbCB0aGUgZGV0YWlscyBvZiB0aGUgcHJvY2Vzc2luZy5bL01CXQ0KDQpP dmVyYWxsLCB0aGVyZSBhcmUgYSBoYW5kZnVsIG9mIGNoYW5nZXMgKGJleW9uZCB0aGUgdHlwb3Ms IHdoaWNoIGFnYWluIGFyZQ0KYXBwcmVjaWF0ZWQpIEknZCBtYWtlIGJhc2VkIG9uIHRoZSBzdWJz dGFuY2Ugb2YgRGF2ZSdzIHJldmlldy4gU29tZSBvZiB0aGUNCnN1Z2dlc3Rpb25zIHRvIHJlbmFt ZSBzZWN0aW9ucyBzZWVtIGhhcm1sZXNzIHRvIG1lLiBMaWtlIHNvbWUgb3RoZXIgcGVvcGxlDQp3 aG8gY29tZSB0byBtaW5kLCBoZSB3b3VsZCBsaWtlIHRvIHNlZSBzb21lIG1vcmUgcHJlY2lzZSBz cGVjaWZpY2F0aW9uIGFuZA0KZXhhbXBsZXMgb2YgaG93IHlvdSBicmVhayBvZmYgdGhlIHNpZ25h dHVyZSBmcm9tIEpXVC4gSGUgcG9pbnRlZCBvdXQgdGhhdA0Kd2UgcmVhbGx5IGRvbid0IGhhdmUg YW55IG1vdGl2YXRpb24gZm9yIGluY2x1ZGluZyBtdWx0aXBsZSBJZGVudGl0eQ0KaGVhZGVycyBp biB0aGVyZSwgYW5kIHdlIHByb2JhYmx5IGRvIG5lZWQgYW4gaW5kaWNhdGlvbiBvZiB3aGF0IGZ1 dHVyZQ0Kd29yayBtaWdodCB1c2UgdGhhdCBmZWF0dXJlLg0KW01CXSBJIHdvdWxkIDNyZCB0aGUg bmVlZCBmb3IgZXhhbXBsZXMuICBUaGF0IGhhcyBiZWVuIGEgdXN1YWwgcHJhY3RpY2UgZm9yIG90 aGVyIFJGQ3MgZGVmaW5pbmcgbmV3IFNJUCBoZWFkZXIgZmllbGRzIChhbmQgaGVhZGVyIGZpZWxk IHBhcmFtZXRlcnMpLiBbL01CXQ0KDQpJbiB0ZXJtcyBvZiB0b3BpY3MgZm9yIGRpc2N1c3Npb24g dGhhdCBtaWdodCB3YXJyYW50IHRoZSBhdHRlbnRpb24gb2YgdGhlDQp3b3JraW5nIGdyb3VwLCBo ZSBkaWQgc3VnZ2VzdCB3ZSBuZWVkIHRvIGJlIHN1cmUgd2UgdGhpbmsgdGhlIHNjb3BlIG9mIHRo ZQ0Kc2lnbmF0dXJlIGlzIGNvcnJlY3QsIGFuZCB0aGF0IHdlIGhhdmUgZW5vdWdoIGNvbmZpZGVu Y2UgdGhhdA0KaW50ZXJtZWRpYXJpZXMgd29uJ3QgYnJlYWsgaXQsIGFuZCB0aGF0IHdoZW4gaXQg aXMgYnJva2VuLCB0aGUgdmVyaWZpZXINCmJlaGF2aW9yIG1ha2VzIHNlbnNlLiBJIHRoaW5rIHdl J3ZlIGZvY3VzZWQgYSBsb3Qgb2YgYXR0ZW50aW9uIG9uIHRob3NlDQpxdWVzdGlvbnMsIGJ1dCBJ J20gaGFwcHkgdG8gdGFsayBtb3JlIGFib3V0IHRoYXQgaWYgcGVvcGxlIHRoaW5rIHRoZXJlJ3MN CnJvb20gZm9yIGltcHJvdmVtZW50Lg0KDQpBbHNvLCBoZSBzdWdnZXN0cyB0aGF0IHdlIG1pZ2h0 IG5lZWQgYSBiZXR0ZXIgcG9pbnRlciB0aGFuIFJGQzM5ODYgU2VjdGlvbg0KNi4yLjIgZm9yIFVS SSBub3JtYWxpemF0aW9uIHByb2NlZHVyZXMuIElmIGFueW9uZSAoaW5jbHVkaW5nIERhdmUhKSBr bm93cw0Kb2Ygb25lLCBJJ2QgYmUgaGFwcHkgdG8gY2l0ZSBpdCBpbnN0ZWFkLg0KDQpPdGhlcndp c2UsIEkgdGhpbmsgd2UndmUgZ290IHRoaXMgY292ZXJlZC4gQW55b25lIHdobydzIGludGVyZXN0 ZWQgaW4NCmZ1cnRoZXIgZGV0YWlscyBjYW4gc2VlIHRoZSBhdHRhY2hlZC4NCg0KSm9uIFBldGVy c29uDQpOZXVzdGFyLCBJbmMuDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0DQpzdGlyQGlldGYub3JnPG1haWx0bzpz dGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGly DQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KVGhpcyBlLW1haWwgbWF5 IGNvbnRhaW4gU3ByaW50IHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIGludGVuZGVkIGZvciB0aGUg c29sZSB1c2Ugb2YgdGhlIHJlY2lwaWVudChzKS4gQW55IHVzZSBieSBvdGhlcnMgaXMgcHJvaGli aXRlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRh Y3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIGFsbCBjb3BpZXMgb2YgdGhlIG1lc3NhZ2UuDQo= --_000_6bd1e4bc946a4a02a1f4fdac385984b9PLSWE13M08adsprintcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZp bml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXtt YXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29I eXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93 ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJBcmlhbCIsc2Fucy1zZXJpZjsNCgljb2xvcjoj MDAwMENDOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0ZXh0 LWRlY29yYXRpb246bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQot LT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4 dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpl eHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+ DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U29ycnku Jm5ic3A7IE5vdCByZXNwb25kaW5nIHRvIE1hcnnigJlzIGV4Y2VsbGVudCBjb21tZW50cy4gSSBk aWRu4oCZdCBzZWUgSm9u4oCZcyBlLW1haWwgYW5kIGRvbuKAmXQgd2FudCB0byBnbyBsb29rIGZv ciBpdCwgc28gSeKAmW0gcmVwbHlpbmcgdG8gSm9u4oCZcyBlLW1haWwgdGhhdCBNYXJ5IHdhcyBy ZXNwb25kaW5nIHRvLiZuYnNwOyAoc21pbGV5IGVtb3RpY29uKTxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5JbiByZWFkaW5nIE1hcnnigJlzIHJlbWFya3MgSSBzYXcgdGhhdCBKb24gc2FpZCwg4oCc W0RhdmVdIHBvaW50ZWQgb3V0IHRoYXQgd2UgcmVhbGx5IGRvbid0IGhhdmUgYW55IG1vdGl2YXRp b24gZm9yIGluY2x1ZGluZyBtdWx0aXBsZSBJZGVudGl0eSBoZWFkZXJzIGluIHRoZXJlLCBhbmQg d2UgcHJvYmFibHkgZG8gbmVlZCBhbiBpbmRpY2F0aW9uIG9mIHdoYXQgZnV0dXJlIHdvcmsgbWln aHQgdXNlIHRoYXQgZmVhdHVyZS7igJ08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXQgaGFzIG9j Y3VycmVkIHRvIG1lIGJlZm9yZSB0aGF0IG11bHRpcGxlIHNpZ25hdHVyZXMgbWlnaHQgYmUgaGFu ZHkuJm5ic3A7IEludGVudGlvbmFsbHkgYW5kIGlsbGVndGltYXRlbHkgYXV0aGVudGljYXRpbmcg c3Bvb2ZlZCBjYWxsaW5nIG51bWJlcnMgaXMgcG9zc2libGUuJm5ic3A7IEEgcHJveHkgd2hpY2gg aGFkIGluZm9ybWF0aW9uIGFib3V0IGFuIHVudHJ1c3R3b3J0aHkgc291cmNlIG1pZ2h0IGxpa2Ug dG8gYWRkIGENCiBzaWduYXR1cmUgd2hpY2ggaW4gZWZmZWN0IHNheXMsIOKAnHlvdSBjYW4gdHJ1 c3QgdGhlIGNhbGwgY2FtZSBmcm9tIHRoZSBvcmlnaW5hdG9yIG93bmluZyB0aGUgY2VydGlmaWNh dGUsIGJ1dCB5b3UgY2Fubm90IHRydXN0IHRoYXQgdGhlIGNlcnQgb3duZXIgdXNlZCBpdCBsZWdp dGltYXRlbHnigJ0uJm5ic3A7IEl0IHdvdWxkIGJlIGEgd2F5IHRvIHByZXNlcnZlIHRoZSBvcmln aW5hdGluZyBhdXRoZW50aWNhdGlvbiBpbmZvcm1hdGlvbiB3aGljaCBpcyB1c2VmdWwsDQogYnV0 IGRlcHJlY2F0aW5nIGl0IHRvby48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBzdXBwb3NlIHRo ZXJlIGNvdWxkIGJlIEhpc3RvcnktSW5mbyBzb3J0cyBvZiBhcHBsaWNhdGlvbnMgdG9vLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5QaWVyY2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMDBDQyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gTWFyeSBCYXJuZXMgW21haWx0bzptYXJ5LmlldGYu YmFybmVzQGdtYWlsLmNvbV0NCjxicj4NCjxiPlNlbnQ6PC9iPiBBdWd1c3QgMTcsIDIwMTYgMjow NCBQTTxicj4NCjxiPlRvOjwvYj4gUGV0ZXJzb24sIEpvbiAmbHQ7am9uLnBldGVyc29uQG5ldXN0 YXIuYml6Jmd0Ozxicj4NCjxiPkNjOjwvYj4gc3RpckBpZXRmLm9yZzsgZGNyb2NrZXJAYmJpdy5u ZXQ8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtzdGlyXSBSZXZpZXcgb2Y6IGRyYWZ0LWlldGYt c3Rpci1yZmM0NDc0YmlzLTEwPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Sm9uLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtz IGZvciByZXNwb25kaW5nIHRvIERhdmUncyBjb21tZW50cyAtIEkgZm91bmQgdGhhdCBxdWl0ZSBo ZWxwZnVsLiZuYnNwOyBJIGhhdmUgc29tZSBjb21tZW50cy9yZXNwb25zZXMgYmVsb3cgW01CXS4m bmJzcDsgQXMgYSBjYXZlYXQgdG8gbXkgcmVzcG9uc2VzLCBJIGRpZCBub3QgcmVhZCBhbGwgdGhl IGRldGFpbHMgaW4gRGF2ZSdzIHJldmlldy4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NYXJ5LjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gU2F0LCBBdWcgMTMsIDIwMTYgYXQgMjo0 MCBBTSwgUGV0ZXJzb24sIEpvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmpvbi5wZXRlcnNvbkBuZXVz dGFyLmJpeiIgdGFyZ2V0PSJfYmxhbmsiPmpvbi5wZXRlcnNvbkBuZXVzdGFyLmJpejwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pjxicj4NCkkgZmluYWxseSBoYWQgYSBjaGFuY2UgdG8gZ28gdGhyb3VnaCB0aGVzZSBjb21tZW50 cywgYW5kIEkgZGlkIHdhbnQgdG88YnI+DQpwcm92aWRlIGEgZmV3IHJlc3BvbnNlcyBvbiBEYXZl J3MgcmV2aWV3IG9mIHJmYzQ0NzRiaXMgaGVyZS48YnI+DQo8YnI+DQomZ3Q7VGFrZW4gb24gaXRz IG93biBhbmQgYWxzbyB3aGVuIHRha2VuIHdpdGggaXRzIGNvbXBhbmlvbiBkb2N1bWVudHMsIHRo ZTxicj4NCiZndDtzcGVjaWZpY2F0aW9ucyBhcmUgY29uZnVzaW5nIGFuZCBpbmNvbXBsZXRlLiZu YnNwOyBJdCBpcyBxdWl0ZSBmYXIgZnJvbSBiZWluZzxicj4NCiZndDtyZWFkeSBmb3IgcHVibGlj YXRpb24uPGJyPg0KPGJyPg0KSGF2aW5nIGxvb2tlZCB0aHJvdWdoIERhdmUncyBzcGVjaWZpYyBj b25jZXJucywgSSBkb24ndCB0aGluayBoZSBtYWtlcyBoaXM8YnI+DQpjYXNlIGZvciB0aGlzIGNy aXRpY2lzbS48YnI+DQo8YnI+DQomZ3Q7VGVybWlub2xvZ3kgaXMgdXNlZCBpbmNvbnNpc3RlbnRs eS4gSXQgb2Z0ZW4gaXMgaW50cm9kdWNlZCB3aXRoIG5vPGJyPg0KJmd0O2JhY2tncm91bmQgb3Ig Y2l0YXRpb24uJm5ic3A7IE1hbnkgdXNlcyBvZiAnaGVhZGVyJyBhcmUgcHJvYmFibHkgc3VwcG9z ZWQgdG88YnI+DQomZ3Q7YmUgJ2hlYWRlciBmaWVsZCcuJm5ic3A7IE15IHNlbnNlIGlzIHRoYXQg cXVpdGUgYSBiaXQgb2YgdGVybWlub2xvZ3kgaXMgdXNlZDxicj4NCiZndDtlcXVhbGx5IGxvb3Nl bHkuPGJyPg0KPGJyPg0KSSB0aGluayB0aGUgdXNlIG9mIHRlcm1pbm9sb2d5IGluIHRoZSBzcGVj aWZpY2F0aW9uIGhhcyBwcm9wZXIgYmFja2dyb3VuZDxicj4NCmFuZCBjaXRhdGlvbnMuIENlcnRh aW5seSBEYXZlIGlzIGNvcnJlY3QgdGhhdCB0aGUgdGV4dCBpcyBwcmV0dHkgbGF4IHdpdGg8YnI+ DQomcXVvdDtoZWFkZXImcXVvdDsgdnMuICZxdW90O2hlYWRlciBmaWVsZCZxdW90OyB2cy4gJnF1 b3Q7aGVhZGVyIGZpZWxkIHZhbHVlLCZxdW90OyBubyBkZW55aW5nIHRoYXQuIElmPGJyPg0KcGVv cGxlIHRoaW5rIHRoaXMgaXMgYSBiaWcgZGVhbCwgSSB3aWxsIGZpeCBpdC4gQnV0IHRoZSBzdWdn ZXN0aW9uIHRoYXQ8YnI+DQpiZWNhdXNlIHRoaXMgaXMgdHJ1ZSwgdGVybWlub2xvZ3kgaXMgbG9v c2VseSB1c2VkIHRvIGEgcG9pbnQgd2hlcmUgaXQ8YnI+DQp3b3VsZCBoYW1wZXIgaW1wbGVtZW50 YXRpb24sIHRoYXQgSSB0aGluayBoaXMgY29tbWVudHMgZG9uJ3QgcmVhbGx5PGJyPg0Kc3Vic3Rh bnRpYXRlLjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+W01CXSBBcyBwZW5kYW50aWMgYXMgaXQgbWlnaHQgc2VlbSwgaW4gbXkgZXhw ZXJpZW5jZSwgdGhlIGV4cGVjdGF0aW9uIGlzIHRoYXQgd2UgYXJlIHByZWNpc2Ugd2l0aCB0ZXJt aW5vbG9neSBpbiB0aGUgc3BlY3MsIHNvIHRoYXQgcXVhbGlmeWluZyAnaGVhZGVyJyBhcyAnaGVh ZGVyIGZpZWxkJyBhbmQgJ3BhcmFtZXRlcicgYXMgJ2hlYWRlciBmaWVsZCBwYXJhbWV0ZXInIGlz IGEgcmVhc29uYWJsZSBleHBlY3RhdGlvbi4NCiBJJ3ZlIGhhZCB0byBkbyB0aGF0IHdpdGggdGhl IFJGQ3MgdGhhdCBJJ3ZlIGF1dGhvcmVkIGFuZCBpbiByZS1yZWFkaW5nIHRoaXMgZG9jdW1lbnQg cmVjZW50bHksIEkgdGhpbmsgaXQgYWRkcyB0byB0aGUgcmVhZGFiaWxpdHkvdW5kZXJzdGFuZGlu ZyBpbiBwYXJ0aWN1bGFyIHNpbmNlIHRoZSBBQk5GIGNvbWVzIGxhdGVyLiBbL01CXTxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+ DQomZ3Q7VGhlcmUgaXMgbm8gaW50ZWdyYXRpdmUgYXJjaGl0ZWN0dXJhbCBkZXNjcmlwdGlvbiwg c28gdGhlIHJlYWRlciBoYXM8YnI+DQomZ3Q7ZGlmZmljdWx0eSB1bmRlcnN0YW5kaW5nIHdoYXQg YWxsIG9mIHRoZSBwaWVjZXMgYXJlIG9yIGhvdyB0aGV5IGZpdDxicj4NCiZndDt0b2dldGhlci4m bmJzcDsgSW4gZmFjdCBpcyBhcHBlYXJzIHRoYXQgdGhlIGRvY3VtZW50IGl0c2VsZiBnZXRzIGNv bmZ1c2VkIG9uPGJyPg0KJmd0O3RoaXMgbWF0dGVyLjxicj4NCjxicj4NCkknbSBub3Qgc3VyZSB3 aGF0IGFuICZxdW90O2ludGVncmF0aXZlIGFyY2hpdGVjdHVyYWwgZGVzY3JpcHRpb24mcXVvdDsg d291bGQgZW50YWlsLDxicj4NCmJ1dCB0aGVyZSBhcmUgYSBudW1iZXIgb2Ygc2VjdGlvbnMgdGhh dCBwcm92aWRlIG92ZXJ2aWV3cyBvZiBvcGVyYXRpb25zPGJyPg0KYW5kIHJlbGF0ZWQgZXhhbXBs ZXMgb2YgaG93IHRoZSBhcmNoaXRlY3R1cmFsIHBpZWNlIGNvbWUgdG9nZXRoZXIuIEkgZG9uJ3Q8 YnI+DQp0aGluayBhbnl0aGluZyBpbiB0aGUgcmV2aWV3IGNvbW1lbnRzIGdlbnVpbmVseSBzdWJz dGFudGlhdGVzIHRoYXQgdGhlPGJyPg0KZG9jdW1lbnQgaXRzZWxmIGlzIGNvbmZ1c2VkIGFib3V0 IGl0cyBvd24gYXJjaGl0ZWN0dXJlLjxicj4NCjxicj4NCiZndDtBbGdvcml0aG1zIGFyZSBhbGwg b2ZmZXJlZCBvbmx5IGFzIHByb3NlIGFuZCBvZnRlbiBpbiBhIGZvcm0gbWl0aWdhdGluZzxicj4N CiZndDtjb21wcmVoZW5zaW9uLCBzdWNoIGFzIHRlbmRpbmcgdG93YXJkcyBuZWdhdGlvbiBvciBk aXNqdW5jdGlvbiwgd2hpY2g8YnI+DQomZ3Q7aHVtYW5zIHByb2Nlc3MgbGVzcyB3ZWxsIHRoYW4g YWZmaXJtYXRpdmVzIGFuZCBjb25qdW5jdGlvbnMuIEZyb20gd2hhdCBJPGJyPg0KJmd0O2NhbiB0 ZWxsLCB0aGUgYWxnb3JpdGhtcyBvZnRlbiBhcmUgaW5jb21wbGV0ZSwgYnV0IHNlcmlvdXMgYW5h bHlzaXMgaXM8YnI+DQomZ3Q7ZGlmZmljdWx0Ljxicj4NCjxicj4NCkFsZ29yaXRobXMgYXJlIG9m ZmVyZWQgaW4gc3RlcHMgd2l0aCBub3JtYXRpdmUgbGFuZ3VhZ2UsIGlmIHRoYXQncyB3aGF0PGJy Pg0KeW91IG1lYW4gYnkgJnF1b3Q7cHJvc2UgZm9ybSZxdW90Oy4gUkZDcyBhcmUgdHlwaWNhbGx5 IGNvbXBvc2VkIG9mIHByb3NlLiBUaGUgcmV2aWV3PGJyPg0KZG9lcyByZXZlYWwgc29tZSB2ZXJ5 IHN0cmlraW5nIHZpZXdzIGFib3V0IHNwZWNtYW5zaGlwIGFuZCBhbGdvcml0aG1zIGluPGJyPg0K cGFydGljdWxhciB3aGljaCBhcmUgZm9yZWlnbiB0byBteSBleHBlcmllbmNlIGluIHRoZSBJRVRG Ljxicj4NCjxicj4NCiZndDtUaGUgZG9jdW1lbnRzIGFwcGVhciB0byByZWx5IG9uIGEgcmVhZGVy J3MgaGF2aW5nIHF1aXRlIGEgYml0IG9mIHByaW9yPGJyPg0KJmd0O2tub3dsZWRnZSBhbmQgYXJl IGNlcnRhaW5seSBub3QgdXNhYmxlIGJ5IGFuIGltcGxlbWVudGVyIHdobyBpcyBub3Q8YnI+DQom Z3Q7YWxyZWFkeSBkZWVwbHkgZW1iZWRkZWQgaW4gdGhlIGNvbW11bml0eSB0aGF0IHByb2R1Y2Vk IHRoZXNlPGJyPg0KJmd0O3NwZWNpZmljYXRpb25zLiZuYnNwOyBNeSBpbXByZXNzaW9uIGlzIHRo YXQgYmVpbmcgZW1iZWRkZWQgd29uJ3Qgc3VmZmljZTxicj4NCiZndDtlaXRoZXIsIGJvdGggZnJv bSBteSBhc3Nlc3NtZW50IG9mIHRoZSBkb2N1bWVudHMnIGRlZmljaWVuY2llcyBhbmQgZ2l2ZW48 YnI+DQomZ3Q7YmFjay1jaGFubmVsIGNvbW1lbnRzIEkgaGF2ZSBoZWFyZCBhYm91dCB0aGUgZXhw ZWN0YXRpb24gb2YgdGhlIHdvcmsgdG88YnI+DQomZ3Q7YmUgZG9uZSBhZnRlciB0aGVzZSBzcGVj aWZpY2F0aW9ucyBhcmUgcHVibGlzaGVkLjxicj4NCjxicj4NCldlIGRvIGV4cGVjdCBiYXNpYyBT SVAgbGl0ZXJhY3ksIGFuZCBhIHdpbGxpbmduZXNzIHRvIGZvbGxvdyByZWZlcmVuY2VzPGJyPg0K YW5kIHJlYWQgZXh0ZXJuYWwgc3BlY2lmaWNhdGlvbnMgYW5kIHNlY3Rpb25zIHRoYXQgYXJlIGNp dGVkLiBSZWFkZXJzIHRoYXQ8YnI+DQphcmUgdW53aWxsaW5nIHRvIGRvIHRoaXMgd2lsbCBwcm9i YWJseSBmaW5kIGEgbG90IG9mIHRoaW5ncyBjb25mdXNpbmcgaW48YnI+DQp0aGVyZS48bzpwPjwv bzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bTUJd ICZuYnNwO0kgdGhpbmsgdGhlIGNoYWxsZW5nZSBpcyB0aGF0ICdiYXNpYyBTSVAgbGl0ZXJhY3kn IGlzbid0IHN1Y2ggYSBiYXNpYyB0aGluZyBhbnltb3JlIGFuZCBpdCBkb2VzIHJlcXVpcmUgKmEg bG90KiBvZiBiYWNrZ3JvdW5kIHRvIHBhcnNlIHRoaXMgZG9jdW1lbnQsIGJ1dCBJIGRvbid0IGtu b3cgYSB3YXkgYXJvdW5kIHRoYXQuIFsvTUJdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0 OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQomZ3Q7T3ZlcmFsbCwgdGhlIHdyaXRp bmcgaW1wZWRlcyBjb21wcmVoZW5zaW9uIGFuZCB0aGUgZG9jdW1lbnQgbmVlZHMgYSB2ZXJ5PGJy Pg0KJmd0O2RpbGlnZW50IHBhc3MgYnkgYSB0ZWNobmljYWwgZWRpdG9yLiZuYnNwOyBJIHN1c3Bl Y3QgdGhpcyB3aWxsIHVuY292ZXIgcXVpdGU8YnI+DQomZ3Q7YSBudW1iZXIgb2Ygc2VtYW50aWMg ZGVmaWNpZW5jaWVzIGluIHRoZSB0ZXh0Ljxicj4NCjxicj4NCllvdSBkaWQgY2F0Y2ggc29tZSBn b29kIHR5cG9zLCBhbmQgSSBjYXVnaHQgYSBmZXcgbW9yZSBmb2xsb3dpbmcgeW91cjxicj4NCm5v dGVzIHRocm91Z2ggdGhlIHRleHQuIEknbSBub3Qgc3VyZSB0aGF0IHlpZWxkZWQgdGhlIHNlbWFu dGljPGJyPg0KZGlmZmljdWx0aWVzIHlvdSBzcGVjdWxhdGUgYWJvdXQgaGVyZSB0aG91Z2guPGJy Pg0KPGJyPg0KJmd0O1RoZXJlIGlzIGEgcG9zc2libGUgdGVuZGVuY3kgdG8gc3VwcG9ydCBtb3Jl IGFsdGVybmF0aXZlIGJlaGF2aW9yIHRoYW48YnI+DQomZ3Q7YXBwcm9wcmlhdGUuIFN1Y2Nlc3Nm dWwgaW50ZXJvcGVyYWJpbGl0eSB1c3VhbGx5IGJlbmVmaXRzIGZyb20gZmV3ZXI8YnI+DQomZ3Q7 Y2hvaWNlcywgbm90IG1vcmUuJm5ic3A7IENvbW1vbiwgbWFuZGF0b3J5IGNhbm9uaWNhbGl6YXRp b24gaXMgYW4gZXhhbXBsZS48YnI+DQo8YnI+DQpDb21tb24sIG1hbmRhdG9yeSBjYW5vbmljYWxp emF0aW9uIG9mIHRlbGVwaG9uZSBudW1iZXJzIGlzIHVuZm9ydHVuYXRlbHk8YnI+DQpvbmx5IHNs aWdodGx5IG1vcmUgcmVsaWFibGUgdGhhbiBjb21tb24sIG1hbmRhdG9yeSBub3JtYWxpemF0aW9u IG9mPGJyPg0KaW50ZXJuYXRpb25hbGl6ZWQgZG9tYWluIG5hbWVzLiBBdCBsZWFzdCBpdCdzIGp1 c3QgbnVtYmVycy4gVGhlIGFsZ29yaXRobTxicj4NCndlIGhhdmUgaXMgZ29vZCBlbm91Z2ggdG8g Y292ZXIgdGhlIGNvbW1vbiBvcGVyYXRpb25hbCBjYXNlLCBhbmQgd2hlcmUgaXQ8YnI+DQpmYWls cywgaG9wZWZ1bGx5ICZxdW90O2Nhbm9uJnF1b3Q7IHdpbGwgaGVscCB0byBjbG9zZSB0aGUgZ2Fw Ljxicj4NCjxicj4NCiZndDtDcmVkZW50aWFsczogdGhlIHNwZWNpZmljYXRpb24gbmVpdGhlciBk ZWZpbmVzIG5vciByZWZlcmVuY2VzIGEgc3RhbmRhcmQ8YnI+DQomZ3Q7Zm9yIHRoZSBzcGVjaWZp Y2F0aW9uIG9mIGNyZWRlbnRpYWxzLCBoZXJlLiZuYnNwOyBUaGF0IG1lYW5zIHRoYXQgdGhlPGJy Pg0KJmd0O3RlY2huaWNhbCBkZXRhaWxzIC0tIGFzIGRpc3RpbmN0IGZyb20gdGhlIG9wZXJhdGlv bmFsIHBvbGljaWVzIC0tIG9mPGJyPg0KJmd0O2NyZWRlbnRpYWxzIGFyZSBvdXQgb2Ygc2NvcGUs IGFsdGhvdWdoIHRoZXkgYXJlIGZ1bmRhbWVudGFsIHRvIHByb3Blcjxicj4NCiZndDtvcGVyYXRp b24gb2YgdGhpcyBzZXJ2ZS4mbmJzcDsgVGhpcyBpcyBhIHNob3dzdG9wcGVyLCBpbiB0ZXJtcyBv Zjxicj4NCiZndDtzcGVjaWZpY2F0aW9uIGNvbXBsZXRlbmVzcyBmb3IgdGhlIHNlcnZpY2UuPGJy Pg0KPGJyPg0KV2VsbCwgaXQgZG9lcyByZWZlcmVuY2UgYSBzdGFuZGFyZCBmb3IgdGhlIHNwZWNp ZmljYXRpb24gb2YgY3JlZGVudGlhbHM6PGJyPg0Kc3Rpci1jZXJ0cy4gSSBhZ3JlZSBpdCB3b3Vs ZCBiZSBhIHNob3dzdG9wcGVyIGlmIHdlIGRpZG4ndCBoYXZlIHRoZTxicj4NCnN0aXItY2VydHMg d29yay48YnI+DQo8YnI+DQomZ3Q7SG93IGlzIHRoZSByZWNpcGllbnQgdG8ga25vdyB3aGF0IGNy ZWRlbnRpYWwgJ3N0YW5kYXJkJyBpcyB1c2VkPyZuYnNwOyBIb3c8YnI+DQomZ3Q7ZG9lcyB0aGlz IGVuc3VyZSBpbnRlcm9wZXJhYmlsaXR5IGJldHdlZW4gdHdvIHBhcnRpY2lwYW50cyB3aG8gaGF2 ZSBub3Q8YnI+DQomZ3Q7aW50ZXJhY3RlZCBiZWZvcmU/PGJyPg0KPGJyPg0KVGhlcmUgaXMgaW4g cHJhY3RpY2Ugb25seSBvbmUgYXQgdGhlIG1vbWVudC4gSSdtIGNvbnRlbnQgdG8gd29ycnkgYWJv dXQ8YnI+DQppbnRlcm9wIHByb2JsZW1zIHdoZW4gd2UgaGF2ZSBhbm90aGVyIG9uZS48YnI+DQo8 YnI+DQomZ3Q7QXQgYmFzZSwgdGhlc2Ugc3BlY2lmaWNhdGlvbnMgYXBwZWFyIGludGVuZGVkIHRv IHJvdWdobHkgY2hhcnQgb3V0IGE8YnI+DQomZ3Q7c3lzdGVtIHN0cnVjdHVyZSwgbGVhdmluZyBt b3N0IG9mIHRoZSBkaWZmaWN1bHQgd29yayBmb3IgbGF0ZXIgYW5kPGJyPg0KJmd0O2Vsc2V3aGVy ZS4mbmJzcDsgQnkgd2F5IG9mIGV4YW1wbGUsIHRoZXJlIGFyZSBmZXcgaWYgYW55IGNyb3NzLW9y Z2FuaXphdGlvbjxicj4NCiZndDtrZXkgbWFuYWdlbWVudCBzZXJ2aWNlcyBvbiB0aGUgSW50ZXJu ZXQgdGhhdCBkZW1vbnN0cmF0ZSB0aGUgdXRpbGl0eTxicj4NCiZndDtuZWVkZWQgaGVyZS4mbmJz cDsgSSBhbSBwcmV0dHkgc3VyZSB0aGF0IFdlYiBjZXJ0cyBkb24ndCBxdWFsaWZ5LiZuYnNwOyBX ZSBrbm93PGJyPg0KJmd0O3RoYXQgREtJTSdzIG9wZXJhdGlvbiBkb2VzLCBvZiBjb3Vyc2UuJm5i c3A7IEhvd2V2ZXIgREtJTSBzdHJpY3RseSB1c2VzPGJyPg0KJmd0O2RvbWFpbiBuYW1lcyBhcyBp ZGVudGlmaWVycyBhbmQgdGhleSBjb252ZW5pZW50bHkgYWxpZ24gd2l0aCB0aGVpcjxicj4NCiZn dDthZG1pbmlzdHJhdGl2ZSBhdXRob3JpdGllcywgd2hlcmVhcyB0ZWxlcGhvbmUgbnVtYmVycyBk byBub3QuLi48YnI+DQo8YnI+DQpJJ2Qgc2F5IHRoYXQsIGJ5IGRlc2lnbiwgcmZjNDQ3NGJpcyBp cyBwcmV0dHkgdGlnaHRseSBjb25maW5lZCB0bzxicj4NCnNwZWNpZnlpbmcgdGhlIFNJUCBvdmVy LXRoZS13aXJlIHByb3RvY29sIGJlaGF2aW9yLiBJdCB0YWtlcyBhIGxvdCBvZiBzcGVjPGJyPg0K anVzdCB0byBkbyB0aGF0Ljxicj4NCjxicj4NCkFuZCB5b3VyIHByYWlzZSBvZiBES0lNIGFzIGEg bW9kZWwgaXMgb25jZSBhZ2FpbiBub3RlZC4gSSB3b3VsZCByZXNwb25kPGJyPg0KYWdhaW4gdGhh dCB3ZSBhcmUgdW5saWtlbHkgdG8gYWJhbmRvbiBvdXIgeWVhcnMgb2Ygd29yayBvbiB0aGlzIG1l Y2hhbmlzbTxicj4NCmFuZCBzd2l0Y2ggdG8gREtJTSBhdCB0aGlzIHBvaW50LCBubyBtYXR0ZXIg aG93IG1hbnkgY29tbWVudHMgeW91IHBsYWNlIGluPGJyPg0Kb3VyIHBhdGguPGJyPg0KPGJyPg0K Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7IFtbWyBUaGUgbWFpbGluZyBsaXN0IGp1c3QgaGFkIGFu IGV4dGVuc2l2ZSByZWd1cmdpdGF0aW9uIG9mPGJyPg0KJmd0O2NyaXRpY2FsIGNvbW1lbnRhcnkg YWJvdXQgRU5VTS4mbmJzcDsgV2hhdCBhcHBlYXJzIHRvIGJlIGdldHRpbmcgbWlzc2VkIGlzPGJy Pg0KJmd0O3RoYXQgd2hhdGV2ZXIgbWVjaGFuaXNtIGlzIGdvaW5nIHRvIGJlIHVzZWQgZm9yIGZp bmRpbmcgYW5kIHZhbGlkYXRpbmc8YnI+DQomZ3Q7a2V5cyBpcyBnb2luZyB0byBoYXZlIG5vIG9w ZXJhdGlvbmFsIGhpc3Rvcnkgb2YgcmVsaWFiaWxpdHksIHNhZmV0eSBvcjxicj4NCiZndDtlZmZp Y2FjeS4gXV1dPGJyPg0KPGJyPg0KSFRUUCBoYXMgbm9uZSBvZiB0aG9zZSBxdWFsaXRpZXMsIGFw cGFyZW50bHkuPGJyPg0KPGJyPg0KJmd0O1RoZXJlIGlzIHJlbWFya2FibHkgbGl0dGxlIG9mIHRo ZSBvcmlnaW5hbCBSRkMgNDQ3NCBzdWJzdGFuY2Ugc3RpbGwgaW48YnI+DQomZ3Q7dGhpcyBkb2N1 bWVudC4mbmJzcDsgQ2FsbGluZyBpdCBhIGJpcyBpcyBhIGJpdCBsaWtlIHRlYXJpbmcgYWxsIG9m IGEgYnVpbGRpbmc8YnI+DQomZ3Q7ZXhjZXB0IGl0cyBmaXJlcGxhY2Ugb3IgaXRzIGZyb250IGRv b3IgYW5kIGNhbGxpbmcgdGhhdCBhIHJlbW9kZWxpbmcuPGJyPg0KJmd0O1RoZSBwcmV2aW91cyBk b2N1bWVudCBkb2VzIG5vdCBoYXZlIGFuIGluc3RhbGxlZCBiYXNlLCBzbyBJIHN0cm9uZ2x5PGJy Pg0KJmd0O3N1Z2dlc3QgcmVtb3ZpbmcgYWxsIHJlZmVyZW5jZXMgdG8gaXQuJm5ic3A7IEl0IHdp bGwgYWxsb3cgc29tZSBvZiB0aGUgdGV4dDxicj4NCiZndDt0byBiZSBub3RhYmx5IHNpbXBsZXIg YW5kIGNsZWFyZXIuPGJyPg0KPGJyPg0KSSB0aGluayBlbm91Z2ggb2YgdGhlIGNvbmNlcHRzIGFu ZCBwcm90b2NvbCBtZWNoYW5pc21zIG9mIHRoZSBvcmlnaW5hbCBhcmU8YnI+DQpyZXRhaW5lZCB0 byB3YXJyYW50IGtlZXBpbmcgdGhpcyBhcyBhIGJpcy48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPltNQl0gSSdtIG5vdCBzdXJlIG9u IHRoaXMgb25lLCBpbiBwYXJ0aWN1bGFyIGdpdmVuIHRoYXQgaXQgZGVwcmVjYXRlcyB0aGUgaGVh ZGVyIGZpZWxkcyBkZWZpbmVkIGluIFJGQyA0NDc0IChwZXIgc2VjdGlvbiA4KS4mbmJzcDsgQW5k LCB1bmxpa2Ugb3RoZXIgLWJpcyBzcGVjcyB0aGVyZSBpcyBubyBzdW1tYXJ5IHNlY3Rpb24gaW4g dGhpcyBkb2N1bWVudCBvZiB0aGUgZGlmZmVyZW5jZXMgYmV0d2VlbiB0aGUgdHdvLiZuYnNwOw0K IEFsc28sIGN1cnJlbnRseSB0aGlzIGRyYWZ0IGRvZXNuJ3QgaW5kaWNhdGUgd2hhdCBpbXBhY3Qg aXQgaGFzIG9uIDQ0NzQgaW4gdGhlIGhlYWRlciBwYWdlLiBUaGVyZSBpcyB0aGUgc2VudGVuY2Ug YXQgdGhlIGVuZCBvZiBzZWN0aW9uIDEgc3RhdGluZyB0aGF0IHRoaXMgZG9jdW1lbnQgJnF1b3Q7 cmV2aXNlcyBSRkMgNDQ3NCZxdW90OyBidXQgdGhhdCdzIG5vdCBwYXJ0aWN1bGFybHkgbWVhbmlu Z2Z1bC4gR2l2ZW4gdGhhdCB3aGVuIHdlIHByb2R1Y2VkIFJGQyA3MDQ0LA0KIHdlIG9ic29sZXRl ZCBSRkMgNDI0NCBkZXNwaXRlIFJGQyA3MDQ0IGJlaW5nIGJhY2t3YXJkcyBjb21wYXRpYmxlIHdp dGggUkZDIDQyNDQsIEkgcmVhbGx5IHRoaW5rIHRoYXQgdGhpcyBkcmFmdCBzaG91bGQgYmUgZG9j dW1lbnRlZCBhcyBvYnNvbGV0aW5nIFJGQyA0NDc0LiBbL01CXTxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KJmd0O1RoZSBkb2N1 bWVudCBpcyBoZWF2eSB3aXRoIGZvcndhcmQgcmVmZXJlbmNlcy4mbmJzcDsgVGhlc2UgZm9yY2Ug dGhlIHJlYWRlcjxicj4NCiZndDt0byBzdG9wIHdoYXQgdGhleSBhcmUgaW4gdGhlIG1pZGRsZSBv ZiwgdHJ5IHRvIGhvbGQgdGhhdCBwbGFjZSwgYW5kIGxvb2s8YnI+DQomZ3Q7Zm9yd2FyZCB0byB1 bmRlcnN0YW5kIHdoYXQgdGhleSd2ZSBqdXN0IGJlZW4gaW50ZXJydXB0ZWQgZnJvbSByZWFkaW5n Ljxicj4NCiZndDtBcyBhIGxpdGVyYXJ5IHN0eWxlLCBmb3J3YXJkIHJlZmVyZW5jZXMgY3JlYXRl IHVzZWZ1bCB0ZW5zaW9uLiZuYnNwOyBJbjxicj4NCiZndDtzcGVjaWZpY2F0aW9ucyB0aGV5IGp1 c3QgaW50ZXJydXB0IHRoZSBmbG93LiZuYnNwOyBUaGUgZG9jdW1lbnQgc2hvdWxkIGJlPGJyPg0K Jmd0O3Jlb3JnYW5pemF0aW9uIHNvIHRoYXQgaW50ZWdyYXRpdmUgdGV4dCBjb21lcyAvYWZ0ZXIv IHRoZSB0ZXh0PGJyPg0KJmd0O2Rlc2NyaWJpbmcgdGhlIHBpZWNlcyBiZWluZyBpbnRlZ3JhdGVk LiZuYnNwOyBBbmQgb3BlbmluZyBvdmVydmlldywgZGVzaWduPGJyPg0KJmd0O3N1bW1hcnksIG9y IHRoZSBsaWtlIGNhbiBnaXZlIGEgbm9uLW5vcm1hdGl2ZSBkZXNjcmlwdGlvbiBvZiB0aGU8YnI+ DQomZ3Q7YXJjaGl0ZWN0dXJlIGFuZCB0aGUgc2VydmljZSwgc28gdGhlIHJlYWRlciBoYXMgYSBi YXNpYyBzZW5zZSBvZiB0aGUgYmlnPGJyPg0KJmd0O3BpY3R1cmUsIGJlZm9yZSBkaXZpbmcgaW50 byB0aGUgZGV0YWlsIG9mIHRob3NlIHRvLWJlLWludGVncmF0ZWQgcGllY2VzLjxicj4NCjxicj4N Cjxicj4NCkRhdmUgZG9lcyBtYWtlIGEgbnVtYmVyIG9mIG9yZ2FuaXphdGlvbmFsIHN1Z2dlc3Rp b25zIGFib3V0IHRoZSBzcGVjLiBUaGU8YnI+DQpzcGVjIGhhcyBhbiBvdmVydmlldywgYSBkZXNp Z24gc3VtbWFyeSwgYmVmb3JlIGl0IGdldHMgZG93biB0byBzcGVjaWZ5aW5nPGJyPg0KdGhpbmdz LiBUaGUgdmlydHVlIG9mIHRoZSAmcXVvdDtpbnRlZ3JhdGl2ZSZxdW90OyBhcHByb2FjaCBoZSBk ZXNjcmliZXMgaXMgaG93ZXZlcjxicj4NCnVuY2xlYXIgdG8gbWUuIEkgdGhpbmsgd2hldGhlciB5 b3UgZGVmaW5lIHRoZSBhdXRoIHNlcnZpY2UgYmVoYXZpb3IgZmlyc3Q8YnI+DQpvciBkZWZpbmUg dGhlIGhlYWRlciBzeW50YXggZmlyc3QsIG9uZSBvZiB0aG9zZSBzZWN0aW9ucyBpcyBnb2luZyB0 byBlbmQ8YnI+DQp1cCBwb2ludGluZyB0byB0aGUgb3RoZXIuIFRoZXJlIHdhc24ndCBtdWNoIGlu IGhpcyByZW9yZyBzdWdnZXN0aW9ucyB0aGF0PGJyPg0Kc2VlbWVkIHRvIG1lIGxpa2UgYSBzdWJz dGFudGlhbCBpbXByb3ZlbWVudC48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bTUJdIEFzIGFub3RoZXIgUkZDIDQyNDQgZXhhbXBsZSwg d2UgZGlkIGZpbmQgdGhhdCBtb3ZpbmcgdGhlIHN5bnRheCBlYXJseSBpbiB0aGUgZG9jdW1lbnQg aW4gUkZDIDcwNDQgbWFkZSBpdCBtb3JlIHJlYWRhYmxlLiZuYnNwOyBGcm9tIGEgZGV2ZWxvcGVy J3MgcGVyc3BlY3RpdmUsIEkgdGhpbmsgaXQncyBoZWxwZnVsIHRvIGhhdmUgdGhlIHN5bnRheCBp biBtaW5kIGFzIG9uZSByZWFkcyBhbGwgdGhlIGRldGFpbHMNCiBvZiB0aGUgcHJvY2Vzc2luZy5b L01CXTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYu MHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGJyPg0KT3ZlcmFsbCwgdGhlcmUgYXJlIGEgaGFuZGZ1bCBvZiBjaGFuZ2VzIChiZXlv bmQgdGhlIHR5cG9zLCB3aGljaCBhZ2FpbiBhcmU8YnI+DQphcHByZWNpYXRlZCkgSSdkIG1ha2Ug YmFzZWQgb24gdGhlIHN1YnN0YW5jZSBvZiBEYXZlJ3MgcmV2aWV3LiBTb21lIG9mIHRoZTxicj4N CnN1Z2dlc3Rpb25zIHRvIHJlbmFtZSBzZWN0aW9ucyBzZWVtIGhhcm1sZXNzIHRvIG1lLiBMaWtl IHNvbWUgb3RoZXIgcGVvcGxlPGJyPg0Kd2hvIGNvbWUgdG8gbWluZCwgaGUgd291bGQgbGlrZSB0 byBzZWUgc29tZSBtb3JlIHByZWNpc2Ugc3BlY2lmaWNhdGlvbiBhbmQ8YnI+DQpleGFtcGxlcyBv ZiBob3cgeW91IGJyZWFrIG9mZiB0aGUgc2lnbmF0dXJlIGZyb20gSldULiBIZSBwb2ludGVkIG91 dCB0aGF0PGJyPg0Kd2UgcmVhbGx5IGRvbid0IGhhdmUgYW55IG1vdGl2YXRpb24gZm9yIGluY2x1 ZGluZyBtdWx0aXBsZSBJZGVudGl0eTxicj4NCmhlYWRlcnMgaW4gdGhlcmUsIGFuZCB3ZSBwcm9i YWJseSBkbyBuZWVkIGFuIGluZGljYXRpb24gb2Ygd2hhdCBmdXR1cmU8YnI+DQp3b3JrIG1pZ2h0 IHVzZSB0aGF0IGZlYXR1cmUuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+W01CXSBJIHdvdWxkIDNyZCB0aGUgbmVlZCBmb3IgZXhhbXBs ZXMuJm5ic3A7IFRoYXQgaGFzIGJlZW4gYSB1c3VhbCBwcmFjdGljZSBmb3Igb3RoZXIgUkZDcyBk ZWZpbmluZyBuZXcgU0lQIGhlYWRlciBmaWVsZHMgKGFuZCBoZWFkZXIgZmllbGQgcGFyYW1ldGVy cykuIFsvTUJdJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCkluIHRl cm1zIG9mIHRvcGljcyBmb3IgZGlzY3Vzc2lvbiB0aGF0IG1pZ2h0IHdhcnJhbnQgdGhlIGF0dGVu dGlvbiBvZiB0aGU8YnI+DQp3b3JraW5nIGdyb3VwLCBoZSBkaWQgc3VnZ2VzdCB3ZSBuZWVkIHRv IGJlIHN1cmUgd2UgdGhpbmsgdGhlIHNjb3BlIG9mIHRoZTxicj4NCnNpZ25hdHVyZSBpcyBjb3Jy ZWN0LCBhbmQgdGhhdCB3ZSBoYXZlIGVub3VnaCBjb25maWRlbmNlIHRoYXQ8YnI+DQppbnRlcm1l ZGlhcmllcyB3b24ndCBicmVhayBpdCwgYW5kIHRoYXQgd2hlbiBpdCBpcyBicm9rZW4sIHRoZSB2 ZXJpZmllcjxicj4NCmJlaGF2aW9yIG1ha2VzIHNlbnNlLiBJIHRoaW5rIHdlJ3ZlIGZvY3VzZWQg YSBsb3Qgb2YgYXR0ZW50aW9uIG9uIHRob3NlPGJyPg0KcXVlc3Rpb25zLCBidXQgSSdtIGhhcHB5 IHRvIHRhbGsgbW9yZSBhYm91dCB0aGF0IGlmIHBlb3BsZSB0aGluayB0aGVyZSdzPGJyPg0Kcm9v bSBmb3IgaW1wcm92ZW1lbnQuPGJyPg0KPGJyPg0KQWxzbywgaGUgc3VnZ2VzdHMgdGhhdCB3ZSBt aWdodCBuZWVkIGEgYmV0dGVyIHBvaW50ZXIgdGhhbiBSRkMzOTg2IFNlY3Rpb248YnI+DQo2LjIu MiBmb3IgVVJJIG5vcm1hbGl6YXRpb24gcHJvY2VkdXJlcy4gSWYgYW55b25lIChpbmNsdWRpbmcg RGF2ZSEpIGtub3dzPGJyPg0Kb2Ygb25lLCBJJ2QgYmUgaGFwcHkgdG8gY2l0ZSBpdCBpbnN0ZWFk Ljxicj4NCjxicj4NCk90aGVyd2lzZSwgSSB0aGluayB3ZSd2ZSBnb3QgdGhpcyBjb3ZlcmVkLiBB bnlvbmUgd2hvJ3MgaW50ZXJlc3RlZCBpbjxicj4NCmZ1cnRoZXIgZGV0YWlscyBjYW4gc2VlIHRo ZSBhdHRhY2hlZC48YnI+DQo8c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJyPg0KSm9uIFBl dGVyc29uPGJyPg0KTmV1c3RhciwgSW5jLjxicj4NCjxicj4NCjwvc3Bhbj48YnI+DQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCnN0aXIgbWFpbGlu ZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5zdGlyQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vc3RpciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vc3RpcjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8YnI+DQo8aHI+DQo8Zm9udCBmYWNlPSJBcmlhbCIgY29sb3I9 IkdyYXkiIHNpemU9IjEiPjxicj4NClRoaXMgZS1tYWlsIG1heSBjb250YWluIFNwcmludCBwcm9w cmlldGFyeSBpbmZvcm1hdGlvbiBpbnRlbmRlZCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSByZWNp cGllbnQocykuIEFueSB1c2UgYnkgb3RoZXJzIGlzIHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90 IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYW5kIGRl bGV0ZSBhbGwgY29waWVzIG9mIHRoZSBtZXNzYWdlLjxicj4NCjwvZm9udD4NCjwvYm9keT4NCjwv aHRtbD4NCg== --_000_6bd1e4bc946a4a02a1f4fdac385984b9PLSWE13M08adsprintcom_-- From nobody Wed Aug 17 16:58:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D87E412D800 for ; Wed, 17 Aug 2016 16:58:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RRGf8xlrygK9 for ; Wed, 17 Aug 2016 16:58:37 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5540C12B044 for ; Wed, 17 Aug 2016 16:58:37 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7HNwgH5002690 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Wed, 17 Aug 2016 16:58:42 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471478323; bh=jS7zEjebhgQT98uhGKAQfW82ityrwW0qZpU4FLp3R0A=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=hdUfJyUL8BqU/fyELeJaa29PoEQ2Hnimf364zn1GU4PqeJTmVGUL8PNVTcHHMyagJ wpC1xMZqZNHB9H77H81HSem8o+EPWRgM+D3XAgmbXu01XWER36VnIn0HTabVufMh2J vuhReT7RIHxXmszvrba16rP4XgPddzjo3cK+kPvM= To: Brian Rosen , Russ Housley References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> Date: Wed, 17 Aug 2016 16:58:25 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Aug 2016 23:58:38 -0000 On 8/17/2016 2:00 PM, Brian Rosen wrote: > May I offer a suggestion? Lets ask the authors to submit updates to their drafts that resolve as many of the comments they see as worthy to fix that can be done quickly. Then lets ask commenters to look at the diff, identify changes that were NOT made, and use the issue tracker to document them. That's often a good suggestion, but I will suggest not in this case. For each of the documents -- but especially the cert and 4474bis ones -- the problems are profound enough to require careful discussion and resolution, before changes are safe to make. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Aug 17 17:32:56 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06C7B12D60D for ; Wed, 17 Aug 2016 17:32:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dk1OOShBEhnc for ; Wed, 17 Aug 2016 17:32:53 -0700 (PDT) Received: from mail-ua0-x232.google.com (mail-ua0-x232.google.com [IPv6:2607:f8b0:400c:c08::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5411612D5B9 for ; Wed, 17 Aug 2016 17:32:49 -0700 (PDT) Received: by mail-ua0-x232.google.com with SMTP id k90so5887071uak.1 for ; Wed, 17 Aug 2016 17:32:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=AAGUwBLGfo6yWQC5meFKxNX183kSvTLH8FlPaYytzqk=; b=GR/PNLgJ1faQdH3GCPmpnelmAb3CJ5ncfa4N+/WEaHt/zFz8JePec8l/6xes3QPM3H 9WmqgN/zRw2kIbe5ZdkOEQjm+JYjnJbzprdqCSPMbxj9qTjLwfnYLTcpBifjyNdS0E9x Nx8XgRSeQSO9BLLdA3LVfbU9yOxNGBPdDhuLd6/11KZepWa/7TbB6rlGsTTNC5+zPpr/ Zf4hhq0gsA3k/XDpqxee6/muoqLswnmBtoAgo1onj8ZfvZGaVbrBJ+E/ZZzAztiSLaww LVsxadvAGuF/t+rJWkIcRX+5lgBZr0B21K6vmXh3iUO3u7GZpHcgncz1Lyk54VfJQAt0 /67g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=AAGUwBLGfo6yWQC5meFKxNX183kSvTLH8FlPaYytzqk=; b=IzhY1qBOX+r3Fd2Eyrq0IQsqATMH2PlV+xDd3tc1Z52z23N5L1vVVSp49frkIHpmms x8TOp0JM70LTGDWX2qyQevDDXc2dGsC0onkL2dy5Bvt/9RRCZQQqi5mHqUiDmUkwQOvV +G7bx5fCHp9MrYpXx262Vf9Gvw7xa5bRMXXqEJlvHuHBWFUal9MBhyBoMlO7y8CWGoZK oN2P6lbzrORUHHO/KwtxpdDqcih5lV84cZ79G1dCjergnTRjDhQXkmjl6Ry6yQ0shL8M JHtI85yVreSom7pkdGuRFgsr21FLLVpxH9UWOm95w+6bu7Kvf5m7HOz3CGUNWKwPwEO+ XA/Q== X-Gm-Message-State: AEkoouv0h8KrbvNq1hhSkHQCwuAPgICgEQDqzf5T4uDVYk1a+Evk2t8Q6HAn5oRd/z18i3PT3rFGiCHtVY8+0g== X-Received: by 10.31.188.203 with SMTP id m194mr21497077vkf.120.1471480368447; Wed, 17 Aug 2016 17:32:48 -0700 (PDT) MIME-Version: 1.0 Received: by 10.31.157.144 with HTTP; Wed, 17 Aug 2016 17:32:47 -0700 (PDT) X-Originating-IP: [24.154.119.181] In-Reply-To: <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> From: Brian Rosen Date: Wed, 17 Aug 2016 20:32:47 -0400 Message-ID: To: "dcrocker@bbiw.net" Content-Type: multipart/alternative; boundary=001a1143a044a8089f053a4db8a8 Archived-At: Cc: IETF STIR Mail List , Russ Housley Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 00:32:55 -0000 --001a1143a044a8089f053a4db8a8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I thought what I suggested would save all of us a lot of time. I guess that means you should put each of your comments in the tracker then, one issue per item, small or large and we can discuss each of them one at a time. Brian On Wednesday, August 17, 2016, Dave Crocker wrote: > On 8/17/2016 2:00 PM, Brian Rosen wrote: > >> May I offer a suggestion? Let=E2=80=99s ask the authors to submit updat= es to >> their drafts that resolve as many of the comments they see as worthy to = fix >> that can be done quickly. Then let=E2=80=99s ask commenters to look at = the diff, >> identify changes that were NOT made, and use the issue tracker to docume= nt >> them. >> > > > That's often a good suggestion, but I will suggest not in this case. > > For each of the documents -- but especially the cert and 4474bis ones -- > the problems are profound enough to require careful discussion and > resolution, before changes are safe to make. > > d/ > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --001a1143a044a8089f053a4db8a8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I thought what I suggested would save all of us a lot of time. I guess that= means you should put each of your comments in the tracker then, one issue = per item, small or large and we can discuss each of them one at a time.=C2= =A0

Brian

On Wednesday, August = 17, 2016, Dave Crocker <dhc@dcrocker= .net> wrote:
On 8/17/2016 2:00 PM,= Brian Rosen wrote:
May I offer a suggestion?=C2=A0 Let=E2=80=99s ask the authors to submit upd= ates to their drafts that resolve as many of the comments they see as worth= y to fix that can be done quickly.=C2=A0 Then let=E2=80=99s ask commenters = to look at the diff, identify changes that were NOT made, and use the issue= tracker to document them.


That's often a good suggestion, but I will suggest not in this case.
For each of the documents -- but especially the cert and 4474bis ones -- th= e problems are profound enough to require careful discussion and resolution= , before changes are safe to make.

d/

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbiw.net
--001a1143a044a8089f053a4db8a8-- From nobody Wed Aug 17 17:40:35 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF24312D827 for ; Wed, 17 Aug 2016 17:40:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlSqza5cK4ts for ; Wed, 17 Aug 2016 17:40:31 -0700 (PDT) Received: from sc9-admin2.yaanatech.net (63-128-177-42-static.dzbja.com [63.128.177.42]) by ietfa.amsl.com (Postfix) with ESMTP id A4C0312D75D for ; Wed, 17 Aug 2016 17:40:31 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin2.yaanatech.net (Postfix) with ESMTP id 4BB3F1B8; Thu, 18 Aug 2016 00:40:31 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id CACF758090; Thu, 18 Aug 2016 00:40:26 +0000 (UTC) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> To: Brian Rosen , Russ Housley From: Tony Rutkowski Organization: Yaana Technologies Message-ID: Date: Wed, 17 Aug 2016 20:40:29 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> Content-Type: multipart/alternative; boundary="------------A919657BD77E8C596017C3A7" Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 00:40:34 -0000 This is a multi-part message in MIME format. --------------A919657BD77E8C596017C3A7 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit +1 (alternatively just do it under FCC auspices or another venue, e.g., 3GPP SA3, where one person cannot waste everyone's time.) On 2016-08-17 5:00 PM, Brian Rosen wrote: > Thanks for this. > > May I offer a suggestion? Lets ask the authors to submit updates to their drafts that resolve as many of the comments they see as worthy to fix that can be done quickly. Then lets ask commenters to look at the diff, identify changes that were NOT made, and use the issue tracker to document them. > > That way we can avoid a lot of simple issues in the tracker, and have separate threads for each issue remaining open. > > Brian > >> On Aug 17, 2016, at 4:52 PM, Russ Housley wrote: >> >> It is not fun for a WG Chair to take a vacation and then return to find that WG Last Call discussion has escalated from a straight forward document review to accusations of bad acts on the list. Well, that is where I find myself, so Id like to take a step back and try to focus this energy in a productive direction. First, I think that recounting a bit of history may be helpful. >> >> Well before the STIR BOF, there was consensus that the solution needed two parts. First, there needed to be a digital signature that covered the claimed source telephone number and some other things to prevent replay. Second, there needed to be credentials to provide the public key to validate that signature. >> >> During the STIR WG chartering discussion we talked about where that signature might be carried. We got direction from the Area Director that we should focus on in-band mechanisms before looking at out-of-band mechanisms. The STIR WG charter gives direction: >> >> As its priority mechanism work item, the working group will specify a >> SIP header-based mechanism for verification that the originator of a SIP >> session is authorized to use the claimed source telephone number, where >> the session is established with SIP end to end. >> >> The WG decided that a replacement to RFC 4474 was the best way to accomplish this, and the first WG draft on that topic was adopted in June 2014. >> >> Before the STIR BOF, there was discussion about the type of credential that would best scale to represent the telephone number space. The WG recognized that using certificates for the credential meant that some aspects of the public key infrastructure associated would need to be left to the regulators in each country. This is a political reality associated with telephone numbers. This was discussed and understood. See the hum results regarding credential format at IETF 90 in July 2014: >> >> https://www.ietf.org/proceedings/90/minutes/minutes-90-stir >> >> The WG decided on certificates for the credential format, and the first WG draft on that topic was adopted in October 2014. >> >> In most of 2015, the WG was making slow progress. Frankly, I was a bit frustrated; with these fundamental decisions behind us, we could have made faster progress. But then, we saw renewed energy starting in the Summer of 2015. One recent example of this can been seen in the blog post from last month by FCC Chairman Wheeler: >> >> https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls >> >> As part of the renewed energy, there was a suggestion to use the signature format specified by the JOSE WG instead of a bespoke design. The result was PASSporT, and the first WG draft on that topic was adopted in February 2016. >> >> Now, all three of these documents are in WG Last Call. It seems that some of the fundamental decisions that were made almost two years ago are being called into question. If there is a technical problem, lets identify it and fix it. If there is a lack of clarity, lets fix that too. However, WG Last Call is not the time to revisit each decision that brought the WG to this point. >> >> If you are the author of a review that raises a large technical problem, I ask you to provide a concise description of the problem in a message of its own. I am trying to separate the discussion of any such problems from the resolution of other document comments. >> >> I ask the authors of each document to review the comments that have been posted and offer a way forward. >> >> Thanks, >> Russ >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --------------A919657BD77E8C596017C3A7 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit +1 (alternatively just do it under FCC auspices
or another venue, e.g., 3GPP SA3, where one
person cannot waste everyone's time.)

On 2016-08-17 5:00 PM, Brian Rosen wrote:
Thanks for this.

May I offer a suggestion?  Lets ask the authors to submit updates to their drafts that resolve as many of the comments they see as worthy to fix that can be done quickly.  Then lets ask commenters to look at the diff, identify changes that were NOT made, and use the issue tracker to document them.

That way we can avoid a lot of simple issues in the tracker, and have separate threads for each issue remaining open.

Brian


On Aug 17, 2016, at 4:52 PM, Russ Housley <housley@vigilsec.com> wrote:

It is not fun for a WG Chair to take a vacation and then return to find that WG Last Call discussion has escalated from a straight forward document review to accusations of bad acts on the list.  Well, that is where I find myself, so Id like to take a step back and try to focus this energy in a productive direction.  First, I think that recounting a bit of history may be helpful.

Well before the STIR BOF, there was consensus that the solution needed two parts.  First, there needed to be a digital signature that covered the claimed source telephone number and some other things to prevent replay.  Second, there needed to be credentials to provide the public key to validate that signature.

During the STIR WG chartering discussion we talked about where that signature might be carried.  We got direction from the Area Director that we should focus on in-band mechanisms before looking at out-of-band mechanisms.  The STIR WG charter gives direction:

  As its priority mechanism work item, the working group will specify a 
  SIP header-based mechanism for verification that the originator of a SIP 
  session is authorized to use the claimed source telephone number, where 
  the session is established with SIP end to end.

The WG decided that a replacement to RFC 4474 was the best way to accomplish this, and the first WG draft on that topic was adopted in June 2014.

Before the STIR BOF, there was discussion about the type of credential that would best scale to represent the telephone number space.  The WG recognized that using certificates for the credential meant that some aspects of the public key infrastructure associated would need to be left to the regulators in each country.  This is a political reality associated with telephone numbers.  This was discussed and understood.  See the hum results regarding credential format at IETF 90 in July 2014:

  https://www.ietf.org/proceedings/90/minutes/minutes-90-stir

The WG decided on certificates for the credential format, and the first WG draft on that topic was adopted in October 2014.

In most of 2015, the WG was making slow progress.  Frankly, I was a bit frustrated; with these fundamental decisions behind us, we could have made faster progress.  But then, we saw renewed energy starting in the Summer of 2015.  One recent example of this can been seen in the blog post from last month by FCC Chairman Wheeler:

  https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls

As part of the renewed energy, there was a suggestion to use the signature format specified by the JOSE WG instead of a bespoke design.  The result was PASSporT, and the first WG draft on that topic was adopted in February 2016.

Now, all three of these documents are in WG Last Call.  It seems that some of the fundamental decisions that were made almost two years ago are being called into question.  If there is a technical problem, lets identify it and fix it.  If there is a lack of clarity, lets fix that too.  However, WG Last Call is not the time to revisit each decision that brought the WG to this point.

If you are the author of a review that raises a large technical problem, I ask you to provide a concise description of the problem in a message of its own.  I am trying to separate the discussion of any such problems from the resolution of other document comments.

I ask the authors of each document to review the comments that have been posted and offer a way forward.

Thanks,
Russ

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

--------------A919657BD77E8C596017C3A7-- From nobody Wed Aug 17 17:41:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFCF812D832 for ; Wed, 17 Aug 2016 17:41:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yf9xc0DoF0A9 for ; Wed, 17 Aug 2016 17:41:47 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59CBE12D831 for ; Wed, 17 Aug 2016 17:41:47 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7I0frPs004709 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Wed, 17 Aug 2016 17:41:53 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471480913; bh=NqarQTofA8VxhT94K5Es23ynFFmUHWnjle2b0RmP0lQ=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=Or92HhLxqABWo9xV/5zVmy7T7YQIarr35qiLQb0aKx3Lwyc36mGkbRSHPfnOjdRe8 A3GnftxsFyd0yAp0S/Lb2NH+WOOy87Nr2rxwBPMh1STfKAZDOiwaVXssleZU/goD9c 9NnnHFOth4ycunAYld7F97cUVcLXWz6hsptihaDo= To: Brian Rosen References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> Date: Wed, 17 Aug 2016 17:41:36 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 00:41:48 -0000 On 8/17/2016 5:32 PM, Brian Rosen wrote: > I thought what I suggested would save all of us a lot of time. I > guess that means you should put each of your comments in the tracker > then, one issue per item, small or large and we can discuss each of > them one at a time. If a document requires a major rework, then an author's making small changes without the benefit of knowing what the rework will not be a good use of their time. Neither is asking them to guess at the major changes. As for your second sentence, it seems a non-sequitur to me. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Aug 17 18:04:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B95812D135 for ; Wed, 17 Aug 2016 18:04:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gqj6dtJslwVj for ; Wed, 17 Aug 2016 18:04:19 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91D7E12D539 for ; Wed, 17 Aug 2016 18:04:19 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7I13jNt030356; Wed, 17 Aug 2016 21:04:17 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049287.ppops.net-00191d01. with ESMTP id 24vx1hu1rg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 17 Aug 2016 21:04:16 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7I14F10009237; Wed, 17 Aug 2016 21:04:15 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7I147DH009124 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 17 Aug 2016 21:04:09 -0400 Received: from MISOUT7MSGHUBAC.ITServices.sbc.com (MISOUT7MSGHUBAC.itservices.sbc.com [130.9.129.147]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Thu, 18 Aug 2016 01:03:57 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAC.ITServices.sbc.com ([130.9.129.147]) with mapi id 14.03.0301.000; Wed, 17 Aug 2016 21:03:57 -0400 From: "DOLLY, MARTIN C" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Setting Direction for the STIR WG Last Call Thread-Index: AQHR+Mlane7/Lh5+oEOg5PSRbp1156BN5joAgAAxvYCAAAmagIAAAnYA///DMYk= Date: Thu, 18 Aug 2016 01:03:56 +0000 Message-ID: <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> , <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> In-Reply-To: <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_437A953E7F034FD8B36040C82D194DCBattcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-17_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608180015 Archived-At: Cc: IETF STIR Mail List , Brian Rosen Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 01:04:21 -0000 --_000_437A953E7F034FD8B36040C82D194DCBattcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dave No disrespect sir, but who other than you see that a major rework is requir= ed. Addressing addition of examples plus addressing Christer's comments works f= or me Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 17, 2016, at 8:41 PM, Dave Crocker > wrote: On 8/17/2016 5:32 PM, Brian Rosen wrote: I thought what I suggested would save all of us a lot of time. I guess that means you should put each of your comments in the tracker then, one issue per item, small or large and we can discuss each of them one at a time. If a document requires a major rework, then an author's making small changes without the benefit of knowing what the rework will not be a good use of their time. Neither is asking them to guess at the major changes. As for your second sentence, it seems a non-sequitur to me. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_437A953E7F034FD8B36040C82D194DCBattcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Dave

No disrespect sir, but who other than you se= e that a major rework is required. 

Addressing addition of examples plus address= ing Christer's comments works for me

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 17, 2016, at 8:41 PM, Dave Crocker <dhc@dcrocker.net> wrote:

On 8/17/2016 5:32 PM, Brian Rosen wrote:
I thought what I suggested would save all o= f us a lot of time. I
guess that means you should put each of you= r comments in the tracker
then, one issue per item, small or large an= d we can discuss each of
them one at a time.


If a document requires a major rework, then an author's making small<= /span>
changes without the benefit of knowing what the rework will not be a<= /span>
good use of their time.  Neither is asking them to guess at the = major
changes.

As for your second sentence, it seems a non-sequitur to me.
d/

--

 Dave Crocker
 Brandenburg InternetWorking
 bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_437A953E7F034FD8B36040C82D194DCBattcom_-- From nobody Wed Aug 17 18:21:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFA0D12D0FD for ; Wed, 17 Aug 2016 18:21:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G2-JeIjEJN2R for ; Wed, 17 Aug 2016 18:21:19 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5386B12B04B for ; Wed, 17 Aug 2016 18:21:19 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7I1LN63006602 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Wed, 17 Aug 2016 18:21:23 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471483284; bh=VlvP+Sbine3h5fYCKTW1eEMne+s3Pi3BThIEm3/oshI=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=rgVSIso28NuytWUcDrpuyUnNst2nag+TLnGbTzAKytK8t1Ui76oJT95k/X+Cx72+F LffcK5Tg7XSG6XQrJ11FONYtvk137mg6IQ5MLBiTcyaZhto11GfjSCnlZ1NriS1Udw wNzlRExlGh5YLf2EXG+qwPlCKBwjfdv8RVTNmB9g= To: "DOLLY, MARTIN C" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <388ce8e2-c1ff-f281-9471-a18595481f9e@dcrocker.net> Date: Wed, 17 Aug 2016 18:21:06 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List , Brian Rosen Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 01:21:20 -0000 On 8/17/2016 6:03 PM, DOLLY, MARTIN C wrote: > > No disrespect sir, but who other than you see that a major rework is > required. Martin, A number of folk who chose to comment privately. I wonder why they don't feel comfortable posting their thoughts publicly? This is such an inviting environment for candid technical exchange. In fact from what I can tell, these documents have received precious little diligent, in-depth review, with a serious concern for their intelligibility and comprehensiveness to developers new to these documents. So I'll suggest that some of you take the time to look carefully at my comments. Feel free to filter your reading and only look for whatever you consider to be 'major' objections. And then respond thoughtfully on the list with informed analyses of why those objections are not correct or, at least, not worthy of further consideration. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 18 06:14:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E73FC12DDE2 for ; Thu, 18 Aug 2016 06:14:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ln0MRBj6I0QU for ; Thu, 18 Aug 2016 06:14:20 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B399B12DDDA for ; Thu, 18 Aug 2016 06:14:20 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 798673005A7 for ; Thu, 18 Aug 2016 09:14:18 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id fWcEcXvaga7p for ; Thu, 18 Aug 2016 09:14:17 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 8AFA9300086; Thu, 18 Aug 2016 09:14:17 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> Date: Thu, 18 Aug 2016 09:14:18 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <8AD08CD0-1FA3-4DAA-B8F7-AAA98104457C@vigilsec.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> To: Dave Crocker X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 13:14:22 -0000 Dave: > On 8/17/2016 5:32 PM, Brian Rosen wrote: >> I thought what I suggested would save all of us a lot of time. I >> guess that means you should put each of your comments in the tracker >> then, one issue per item, small or large and we can discuss each of >> them one at a time. >=20 >=20 > If a document requires a major rework, then an author's making small > changes without the benefit of knowing what the rework will not be a > good use of their time. Neither is asking them to guess at the major > changes. I disagree. I just looked again at your comments, and many of them are = very easy to handle and they do not have broad impact. I think the = authors can clearly distinguish the two. Russ From nobody Thu Aug 18 06:17:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71FB312DE13 for ; Thu, 18 Aug 2016 06:17:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.899 X-Spam-Level: X-Spam-Status: No, score=-101.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OdroT_WKxmRU for ; Thu, 18 Aug 2016 06:17:05 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CB8212DE02 for ; Thu, 18 Aug 2016 06:11:48 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 816643005C7 for ; Thu, 18 Aug 2016 09:11:46 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id kTmc1xFFnxU7 for ; Thu, 18 Aug 2016 09:11:44 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id EFF5030050E; Thu, 18 Aug 2016 09:11:43 -0400 (EDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_7BB7901D-B384-4413-8DD0-1946B125EF3E" Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: Date: Thu, 18 Aug 2016 09:11:44 -0400 Message-Id: <01C6DD45-E4EE-4092-8B52-CCA04212D90C@vigilsec.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> To: tony@yaanatech.com X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 13:17:08 -0000 --Apple-Mail=_7BB7901D-B384-4413-8DD0-1946B125EF3E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Tony: This message is adding a lot of heat, but no light. Please stop posting = personal attacks. Russ On Aug 17, 2016, at 8:40 PM, Tony Rutkowski wrote: > +1 (alternatively just do it under FCC auspices > or another venue, e.g., 3GPP SA3, where one > person cannot waste everyone's time.) >=20 > On 2016-08-17 5:00 PM, Brian Rosen wrote: >> Thanks for this. >>=20 >> May I offer a suggestion? Let=92s ask the authors to submit updates = to their drafts that resolve as many of the comments they see as worthy = to fix that can be done quickly. Then let=92s ask commenters to look at = the diff, identify changes that were NOT made, and use the issue tracker = to document them. >>=20 >> That way we can avoid a lot of simple issues in the tracker, and have = separate threads for each issue remaining open. >>=20 >> Brian >>=20 >>> On Aug 17, 2016, at 4:52 PM, Russ Housley = wrote: >>>=20 >>> It is not fun for a WG Chair to take a vacation and then return to = find that WG Last Call discussion has escalated from a straight forward = document review to accusations of bad acts on the list. Well, that is = where I find myself, so I=92d like to take a step back and try to focus = this energy in a productive direction. First, I think that recounting a = bit of history may be helpful. >>>=20 >>> Well before the STIR BOF, there was consensus that the solution = needed two parts. First, there needed to be a digital signature that = covered the claimed source telephone number and some other things to = prevent replay. Second, there needed to be credentials to provide the = public key to validate that signature. >>>=20 >>> During the STIR WG chartering discussion we talked about where that = signature might be carried. We got direction from the Area Director = that we should focus on in-band mechanisms before looking at out-of-band = mechanisms. The STIR WG charter gives direction: >>>=20 >>> As its priority mechanism work item, the working group will = specify a=20 >>> SIP header-based mechanism for verification that the originator of = a SIP=20 >>> session is authorized to use the claimed source telephone number, = where=20 >>> the session is established with SIP end to end. >>>=20 >>> The WG decided that a replacement to RFC 4474 was the best way to = accomplish this, and the first WG draft on that topic was adopted in = June 2014. >>>=20 >>> Before the STIR BOF, there was discussion about the type of = credential that would best scale to represent the telephone number = space. The WG recognized that using certificates for the credential = meant that some aspects of the public key infrastructure associated = would need to be left to the regulators in each country. This is a = political reality associated with telephone numbers. This was discussed = and understood. See the hum results regarding credential format at IETF = 90 in July 2014: >>>=20 >>> https://www.ietf.org/proceedings/90/minutes/minutes-90-stir >>>=20 >>> The WG decided on certificates for the credential format, and the = first WG draft on that topic was adopted in October 2014. >>>=20 >>> In most of 2015, the WG was making slow progress. Frankly, I was a = bit frustrated; with these fundamental decisions behind us, we could = have made faster progress. But then, we saw renewed energy starting in = the Summer of 2015. One recent example of this can been seen in the = blog post from last month by FCC Chairman Wheeler: >>>=20 >>> https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls >>>=20 >>> As part of the renewed energy, there was a suggestion to use the = signature format specified by the JOSE WG instead of a bespoke design. = The result was PASSporT, and the first WG draft on that topic was = adopted in February 2016. >>>=20 >>> Now, all three of these documents are in WG Last Call. It seems = that some of the fundamental decisions that were made almost two years = ago are being called into question. If there is a technical problem, = let=92s identify it and fix it. If there is a lack of clarity, let=92s = fix that too. However, WG Last Call is not the time to revisit each = decision that brought the WG to this point. >>>=20 >>> If you are the author of a review that raises a large technical = problem, I ask you to provide a concise description of the problem in a = message of its own. I am trying to separate the discussion of any such = problems from the resolution of other document comments. >>>=20 >>> I ask the authors of each document to review the comments that have = been posted and offer a way forward. >>>=20 >>> Thanks, >>> Russ >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_7BB7901D-B384-4413-8DD0-1946B125EF3E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 Tony:

This message is adding a = lot of heat, but no light.  Please stop posting personal = attacks.

Russ


<= div>On Aug 17, 2016, at 8:40 PM, Tony Rutkowski <tony@yaanatech.com> = wrote:

=20 =20
+1 (alternatively just do it under FCC auspices
or another venue, e.g., 3GPP SA3, where one
person cannot waste everyone's time.)

On 2016-08-17 5:00 PM, Brian Rosen wrote:
Thanks for this.

May I offer a suggestion?  Let=92s ask the authors to submit updates to =
their drafts that resolve as many of the comments they see as worthy to =
fix that can be done quickly.  Then let=92s ask commenters to look at =
the diff, identify changes that were NOT made, and use the issue tracker =
to document them.

That way we can avoid a lot of simple issues in the tracker, and have =
separate threads for each issue remaining open.

Brian


On Aug 17, 2016, at 4:52 PM, Russ Housley <housley@vigilsec.com> =
wrote:

It is not fun for a WG Chair to take a vacation and then return to find =
that WG Last Call discussion has escalated from a straight forward =
document review to accusations of bad acts on the list.  Well, that is =
where I find myself, so I=92d like to take a step back and try to focus =
this energy in a productive direction.  First, I think that recounting a =
bit of history may be helpful.

Well before the STIR BOF, there was consensus that the solution needed =
two parts.  First, there needed to be a digital signature that covered =
the claimed source telephone number and some other things to prevent =
replay.  Second, there needed to be credentials to provide the public =
key to validate that signature.

During the STIR WG chartering discussion we talked about where that =
signature might be carried.  We got direction from the Area Director =
that we should focus on in-band mechanisms before looking at out-of-band =
mechanisms.  The STIR WG charter gives direction:

  As its priority mechanism work item, the working group will specify a=20=

  SIP header-based mechanism for verification that the originator of a =
SIP=20
  session is authorized to use the claimed source telephone number, =
where=20
  the session is established with SIP end to end.

The WG decided that a replacement to RFC 4474 was the best way to =
accomplish this, and the first WG draft on that topic was adopted in =
June 2014.

Before the STIR BOF, there was discussion about the type of credential =
that would best scale to represent the telephone number space.  The WG =
recognized that using certificates for the credential meant that some =
aspects of the public key infrastructure associated would need to be =
left to the regulators in each country.  This is a political reality =
associated with telephone numbers.  This was discussed and understood.  =
See the hum results regarding credential format at IETF 90 in July 2014:

  https=
://www.ietf.org/proceedings/90/minutes/minutes-90-stir

The WG decided on certificates for the credential format, and the first =
WG draft on that topic was adopted in October 2014.

In most of 2015, the WG was making slow progress.  Frankly, I was a bit =
frustrated; with these fundamental decisions behind us, we could have =
made faster progress.  But then, we saw renewed energy starting in the =
Summer of 2015.  One recent example of this can been seen in the blog =
post from last month by FCC Chairman Wheeler:

  https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls

As part of the renewed energy, there was a suggestion to use the =
signature format specified by the JOSE WG instead of a bespoke design.  =
The result was PASSporT, and the first WG draft on that topic was =
adopted in February 2016.

Now, all three of these documents are in WG Last Call.  It seems that =
some of the fundamental decisions that were made almost two years ago =
are being called into question.  If there is a technical problem, let=92s =
identify it and fix it.  If there is a lack of clarity, let=92s fix that =
too.  However, WG Last Call is not the time to revisit each decision =
that brought the WG to this point.

If you are the author of a review that raises a large technical problem, =
I ask you to provide a concise description of the problem in a message =
of its own.  I am trying to separate the discussion of any such problems =
from the resolution of other document comments.

I ask the authors of each document to review the comments that have been =
posted and offer a way forward.

Thanks,
Russ

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/m=
ailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/m=
ailman/listinfo/stir

_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/ma= ilman/listinfo/stir

= --Apple-Mail=_7BB7901D-B384-4413-8DD0-1946B125EF3E-- From nobody Thu Aug 18 09:17:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 455DF12D7E9 for ; Thu, 18 Aug 2016 09:17:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FmgvTKuLSuTU for ; Thu, 18 Aug 2016 09:17:11 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF42912D0B7 for ; Thu, 18 Aug 2016 09:17:10 -0700 (PDT) X-AuditID: c1b4fb30-ea88e980000009f9-ac-57b5df84c71a Received: from ESESSHC024.ericsson.se (Unknown_Domain [153.88.183.90]) by (Symantec Mail Security) with SMTP id 6E.A9.02553.48FD5B75; Thu, 18 Aug 2016 18:17:08 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC024.ericsson.se ([153.88.183.90]) with mapi id 14.03.0301.000; Thu, 18 Aug 2016 18:16:56 +0200 From: Christer Holmberg To: Russ Housley , Dave Crocker Thread-Topic: [stir] Setting Direction for the STIR WG Last Call Thread-Index: AQHR+MlXexqvCyEVrEuuKHw9sW8aGaBNgaUAgAAxvYCAAAmagIAAAnYAgADSTgCAAFNGUA== Date: Thu, 18 Aug 2016 16:16:55 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC22A12@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <8AD08CD0-1FA3-4DAA-B8F7-AAA98104457C@vigilsec.com> In-Reply-To: <8AD08CD0-1FA3-4DAA-B8F7-AAA98104457C@vigilsec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpnkeLIzCtJLcpLzFFi42KZGbE9Srfl/tZwgxUz9S1+f/rAZvHqxU12 i+VrtzE5MHtc2nmSzWPJkp9MHqvufGENYI7isklJzcksSy3St0vgyni+8gZbwWzuiqNbG1ka GL9zdDFyckgImEica5rE3MXIxSEksJ5RYtLc6VDOEkaJ5rMLgBwODjYBC4nuf9ogDSICnhK3 pn5hB7GZBdQlXjx6A2YLC9hLTLr6lBGixkFizdGp7BB2mMTdX+vYQGwWAVWJryeawWp4BXwl 7rd1sEDsmsYs8efkZmaQBCdQ86OXO8CaGQXEJL6fWsMEsUxc4taT+UwQVwtILNlznhnCFpV4 +fgfK4StJNG45AkrRL2OxILdn9ggbG2JZQtfM0MsFpQ4OfMJywRG0VlIxs5C0jILScssJC0L GFlWMYoWpxYn5aYbGemlFmUmFxfn5+nlpZZsYgRGz8Etvw12ML587niIUYCDUYmHN2H/1nAh 1sSy4srcQ4wSHMxKIryKd4BCvCmJlVWpRfnxRaU5qcWHGKU5WJTEef1fKoYLCaQnlqRmp6YW pBbBZJk4OKUaGFvP6E3+viixmHdPdci1H/zhepeXP5M8s4Qpzvzx1MiA2c5ahxVzf9bVz3CX u7JsJk+yT9KtLYEV+sdn8oVlR76veaRzju3rjKplRe0OP+f9XPfmTcPqkvN5ykszVnV2MNo8 UP703XFvfWLvB4PtLvsc1qTlVXcH7d/88+UXjemvNIL7z0mrCSixFGckGmoxFxUnAgC7Ud61 mgIAAA== Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 16:17:13 -0000 I agree with Brian and Russ, We should not spend a single second discussing whether we e.g. shall use co= nsistent terminology - we shall just do it. GenART, IESG and/or the RFC edi= tor would most likely ask for it anyway, so let's get it done with. Regards, Christer -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Russ Housley Sent: 18 August 2016 16:14 To: Dave Crocker Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call Dave: > On 8/17/2016 5:32 PM, Brian Rosen wrote: >> I thought what I suggested would save all of us a lot of time. I=20 >> guess that means you should put each of your comments in the tracker=20 >> then, one issue per item, small or large and we can discuss each of=20 >> them one at a time. >=20 >=20 > If a document requires a major rework, then an author's making small=20 > changes without the benefit of knowing what the rework will not be a=20 > good use of their time. Neither is asking them to guess at the major=20 > changes. I disagree. I just looked again at your comments, and many of them are ver= y easy to handle and they do not have broad impact. I think the authors ca= n clearly distinguish the two. Russ _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Thu Aug 18 09:45:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E958712DD4A for ; Thu, 18 Aug 2016 09:44:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.7 X-Spam-Level: X-Spam-Status: No, score=-102.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id weL31Rbdpy0P for ; Thu, 18 Aug 2016 09:44:57 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC13712DD1C for ; Thu, 18 Aug 2016 09:44:57 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u7IGhLHX006893; Thu, 18 Aug 2016 12:44:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=k4yuwABkNZ2rWP271sytGkmi7FhQb4RnnALIk12xx78=; b=P4zkNmS0LO/7ZRI7KSUuMO4VMx9dN+0aod5kYslJyfI2h+py+WhLi5UVFHLC7WLphKYq bBi49o39SOAw0qnhDWFVliDE2Mxgssk3cRUZbSKIJWJmRNOzekLXQQU0M9A/i66Cfcbb Pn3XuiwS6bIh/nmsXk0uA1wiI1Wg/TTK2aqng1nYLQzyIRy/nQS9pszGjT9hPretvpfU 7dLFFuj7jUQWzBzodY+2tEQ6215pQVIJrmsF9Oum98TzFNMKzVWRyb1XqDYwVNicNBpm GBfQrndI5nIhk/LfwhC7bhNV30fqD0aXpxYD1Xi+w5RiSqgqfp1qPDyPTA3/Zg+jlt9U Vg== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24vsm3bpxf-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 18 Aug 2016 12:44:54 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Thu, 18 Aug 2016 12:43:00 -0400 From: "Peterson, Jon" To: Mary Barnes Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBGVbYAgAd9kQCAAPWxAA== Date: Thu, 18 Aug 2016 16:43:00 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.89] Content-Type: multipart/alternative; boundary="_000_D3DB2F211A7B5Fjonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-18_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608180216 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 16:45:00 -0000 --_000_D3DB2F211A7B5Fjonpetersonneustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Mary, I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field value," no denying that. If people think this is a big deal, I will fix it. But the suggestion that because this is true, terminology is loosely used to a point where it would hamper implementation, that I think his comments don't really substantiate. [MB] As pendantic as it might seem, in my experience, the expectation is th= at we are precise with terminology in the specs, so that qualifying 'header= ' as 'header field' and 'parameter' as 'header field parameter' is a reason= able expectation. I've had to do that with the RFCs that I've authored and = in re-reading this document recently, I think it adds to the readability/un= derstanding in particular since the ABNF comes later. [/MB] If people really feel like it needs to be fixed, I can fix it - but I do fe= el justified in pointing out that our track record with this in SIP documen= ts isn't real strong. The original RFC4474 used "header" informally quite a= bit. So does RFC4244, actually, if you scroll through that. So does the Re= places header spec. So I'm not sure we really do have much of an expectatio= n about being precise with this. The reason why, I imagine, is because the = common and casual way we use it isn't actually ambiguous - no one who sees = the phrase "Date header" is confused about whether we mean a header or a he= ader field. But like I said, it isn't a huge deal to fix it - it's just that any pervas= ive edits like this can give rise to errors, and it's not clear that fixing= this solves any real problem. I think enough of the concepts and protocol mechanisms of the original are retained to warrant keeping this as a bis. [MB] I'm not sure on this one, in particular given that it deprecates the h= eader fields defined in RFC 4474 (per section 8). And, unlike other -bis s= pecs there is no summary section in this document of the differences betwee= n the two. Also, currently this draft doesn't indicate what impact it has = on 4474 in the header page. There is the sentence at the end of section 1 s= tating that this document "revises RFC 4474" but that's not particularly me= aningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despi= te RFC 7044 being backwards compatible with RFC 4244, I really think that t= his draft should be documented as obsoleting RFC 4474. [/MB] There is a summary of changes in the document; it's Section 15 "Changes fro= m RFC4474". And well, the bis doesn't deprecate both the headers as such, i= t deprecates one header field and changes the syntax of the other. But more= importantly, it keeps all the guts: the concept of an authentication and v= erification service, all the response codes, all the associated SIP behavio= r. The only real semantic change is the scope of protection of the signatur= e itself, which has been reduced overall, and then with respects to the ide= ntities in particular has been honed to deal with telephone numbers better.= Obsoleting the Identity-Info header and moving it into an "info" parameter= of the Identity header is a just a syntactic change. Although we created s= ome architectural modularity around credentials, the stir-certs mechanism s= till has the same properties as certs did in the original architecture. All= owing the Identity header to appear multiple times just removes a limitatio= n in the original spec that doesn't seem useful in retrospect (and the way = Identity-Info was originally done didn't allow it) rather than a change to = how the header is to be understood. All that said, I do agree it probably should obsolete RFC4474, not merely u= pdate it. Or at least that's how I remember the process is supposed to work= . I'll defer to chairs/Ads on this one. Overall, there are a handful of changes (beyond the typos, which again are appreciated) I'd make based on the substance of Dave's review. Some of the suggestions to rename sections seem harmless to me. Like some other people who come to mind, he would like to see some more precise specification and examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity headers in there, and we probably do need an indication of what future work might use that feature. [MB] I would 3rd the need for examples. That has been a usual practice for= other RFCs defining new SIP header fields (and header field parameters). [= /MB] There will be more examples! Jon Peterson Neustar, Inc. --_000_D3DB2F211A7B5Fjonpetersonneustarbiz_ Content-Type: text/html; charset="us-ascii" Content-ID: <80B9CAD8D88BB841AE6AE48ADB5A138C@neustar.biz> Content-Transfer-Encoding: quoted-printable
Hi Mary,

I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

[MB] As pendantic as it might seem, in my experience, the expectation = is that we are precise with terminology in the specs, so that qualifying 'h= eader' as 'header field' and 'parameter' as 'header field parameter' is a r= easonable expectation. I've had to do that with the RFCs that I've authored and in re-reading this documen= t recently, I think it adds to the readability/understanding in particular = since the ABNF comes later. [/MB]

If people really feel like it needs to be fixed, I can fix it - but I = do feel justified in pointing out that our track record with this in SIP do= cuments isn't real strong. The original RFC4474 used "header" inf= ormally quite a bit. So does RFC4244, actually, if you scroll through that. So does the Replaces header spec. So I'm not s= ure we really do have much of an expectation about being precise with this.= The reason why, I imagine, is because the common and casual way we use it = isn't actually ambiguous - no one who sees the phrase "Date header" is confused about whether we m= ean a header or a header field.

But like I said, it isn't a huge deal to fix it - it's just that any p= ervasive edits like this can give rise to errors, and it's not clear that f= ixing this solves any real problem.

<snip>
I think enough of the concepts and protocol mechanisms of the original are<= span>
retained to warrant keeping this as a bis.

[MB] I'm not sure on this one, in particular given that it deprecates = the header fields defined in RFC 4474 (per section 8).  And, unlike ot= her -bis specs there is no summary section in this document of the differen= ces between the two.  Also, currently this draft doesn't indicate what impact it has on 4474 in the header page.= There is the sentence at the end of section 1 stating that this document &= quot;revises RFC 4474" but that's not particularly meaningful. Given t= hat when we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with RFC 4244, I real= ly think that this draft should be documented as obsoleting RFC 4474. [/MB]=

There is a summary of changes in the document; it's Section 15 "C= hanges from RFC4474". And well, the bis doesn't deprecate both the hea= ders as such, it deprecates one header field and changes the syntax of the = other. But more importantly, it keeps all the guts: the concept of an authentication and verification service, all t= he response codes, all the associated SIP behavior. The only real semantic = change is the scope of protection of the signature itself, which has been r= educed overall, and then with respects to the identities in particular has been honed to deal with telephone numb= ers better. Obsoleting the Identity-Info header and moving it into an "= ;info" parameter of the Identity header is a just a syntactic change. = Although we created some architectural modularity around credentials, the stir-certs mechanism still has the same properties= as certs did in the original architecture. Allowing the Identity header to= appear multiple times just removes a limitation in the original spec that = doesn't seem useful in retrospect (and the way Identity-Info was originally done didn't allow it) rather tha= n a change to how the header is to be understood.

All that said, I do agree it probably should obsolete RFC4474, not mer= ely update it. Or at least that's how I remember the process is supposed to= work. I'll defer to chairs/Ads on this one.

Overall, there are a handful of changes (beyond the typos, which again are<= br> appreciated) I'd make based on the substance of Dave's review. Some of the<= br> suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.
[MB] I would 3rd the need for examples.  That has been a usual pr= actice for other RFCs defining new SIP header fields (and header field para= meters). [/MB] 

There will be more examples!

Jon Peterson
Neustar, Inc.
--_000_D3DB2F211A7B5Fjonpetersonneustarbiz_-- From nobody Thu Aug 18 09:48:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E469F12DBBC for ; Thu, 18 Aug 2016 09:48:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.7 X-Spam-Level: X-Spam-Status: No, score=-102.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fV1PtuIvKGu4 for ; Thu, 18 Aug 2016 09:48:27 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75D8F12DE99 for ; Thu, 18 Aug 2016 09:48:27 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7IGhZ8Y025956; Thu, 18 Aug 2016 12:48:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=P3tnPIBI1mZHSqRuNO8jA/OOcxCIp2I/+ElEutPMHt0=; b=jfoCoFAsjzA6BkmljX8hGzPIH5XkvD8gRvnofqfquDTQpIP9t1ePy95wts8AAfPCGbVi bEdIAzq1dkqkYjLx3F3x3oseltUfwSJPfIDPbGhipaBP9acQnhJKuq0EKiqPRKQioQZE /5yIO1r7ZXcT5TJDd1UST1t8w+7Ql6sVX/YI5WotRoDwuVr1SRa1KBiT46l6tg6JxU0b eRUTZDRXLz/OPA9siKzOz7XELB4m3IWFuzI53ClP4EJfzSAe+fFXBYuNIHBh66XjfpfC 7vvvhvKTNLRX+I02aka4hlb8XHnBTNBgFjscPS/pXQ0xm6onnVejadLl3eUkiH/yo1/9 gg== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24vsmnus7b-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 18 Aug 2016 12:48:25 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Thu, 18 Aug 2016 12:48:25 -0400 From: "Peterson, Jon" To: "Gorman, Pierce A [CTO]" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBGVbYAgAd9kQCAAC4aAIAAyRaA Date: Thu, 18 Aug 2016 16:48:24 +0000 Message-ID: References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> In-Reply-To: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.89] Content-Type: multipart/alternative; boundary="_000_D3DB2EE91A7B59jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-18_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608180216 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 16:48:39 -0000 --_000_D3DB2EE91A7B59jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Oh, we've allowed for multiple Identity headers for some time - the problem= is we don't really give any reason why we allow them or any sense of what = it might mean to have more than one. We need to say at least something abou= t that, though largely this is a matter of forward compatibility with some = future use cases that we know are under consideration that we don't want to= rule out. Jon Peterson Neustar, Inc. From: "Gorman, Pierce A [CTO]" > Date: Wednesday, August 17, 2016 at 2:48 PM To: Mary Barnes >, Jon Peterson > Cc: "stir@ietf.org" >, "dcrocker@bbiw.net" > Subject: RE: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Sorry. Not responding to Mary=92s excellent comments. I didn=92t see Jon= =92s e-mail and don=92t want to go look for it, so I=92m replying to Jon=92= s e-mail that Mary was responding to. (smiley emoticon) In reading Mary=92s remarks I saw that Jon said, =93[Dave] pointed out that= we really don't have any motivation for including multiple Identity header= s in there, and we probably do need an indication of what future work might= use that feature.=94 It has occurred to me before that multiple signatures might be handy. Inte= ntionally and illegtimately authenticating spoofed calling numbers is possi= ble. A proxy which had information about an untrustworthy source might lik= e to add a signature which in effect says, =93you can trust the call came f= rom the originator owning the certificate, but you cannot trust that the ce= rt owner used it legitimately=94. It would be a way to preserve the origin= ating authentication information which is useful, but deprecating it too. I suppose there could be History-Info sorts of applications too. Pierce From: Mary Barnes [mailto:mary.ietf.barnes@gmail.com] Sent: August 17, 2016 2:04 PM To: Peterson, Jon > Cc: stir@ietf.org; dcrocker@bbiw.net Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Jon, Thanks for responding to Dave's comments - I found that quite helpful. I h= ave some comments/responses below [MB]. As a caveat to my responses, I did= not read all the details in Dave's review. Regards, Mary. On Sat, Aug 13, 2016 at 2:40 AM, Peterson, Jon > wrote: I finally had a chance to go through these comments, and I did want to provide a few responses on Dave's review of rfc4474bis here. >Taken on its own and also when taken with its companion documents, the >specifications are confusing and incomplete. It is quite far from being >ready for publication. Having looked through Dave's specific concerns, I don't think he makes his case for this criticism. >Terminology is used inconsistently. It often is introduced with no >background or citation. Many uses of 'header' are probably supposed to >be 'header field'. My sense is that quite a bit of terminology is used >equally loosely. I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field value," no denying that. If people think this is a big deal, I will fix it. But the suggestion that because this is true, terminology is loosely used to a point where it would hamper implementation, that I think his comments don't really substantiate. [MB] As pendantic as it might seem, in my experience, the expectation is th= at we are precise with terminology in the specs, so that qualifying 'header= ' as 'header field' and 'parameter' as 'header field parameter' is a reason= able expectation. I've had to do that with the RFCs that I've authored and = in re-reading this document recently, I think it adds to the readability/un= derstanding in particular since the ABNF comes later. [/MB] >There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit >together. In fact is appears that the document itself gets confused on >this matter. I'm not sure what an "integrative architectural description" would entail, but there are a number of sections that provide overviews of operations and related examples of how the architectural piece come together. I don't think anything in the review comments genuinely substantiates that the document itself is confused about its own architecture. >Algorithms are all offered only as prose and often in a form mitigating >comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what I >can tell, the algorithms often are incomplete, but serious analysis is >difficult. Algorithms are offered in steps with normative language, if that's what you mean by "prose form". RFCs are typically composed of prose. The review does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF. >The documents appear to rely on a reader's having quite a bit of prior >knowledge and are certainly not usable by an implementer who is not >already deeply embedded in the community that produced these >specifications. My impression is that being embedded won't suffice >either, both from my assessment of the documents' deficiencies and given >back-channel comments I have heard about the expectation of the work to >be done after these specifications are published. We do expect basic SIP literacy, and a willingness to follow references and read external specifications and sections that are cited. Readers that are unwilling to do this will probably find a lot of things confusing in there. [MB] I think the challenge is that 'basic SIP literacy' isn't such a basic= thing anymore and it does require *a lot* of background to parse this docu= ment, but I don't know a way around that. [/MB] >Overall, the writing impedes comprehension and the document needs a very >diligent pass by a technical editor. I suspect this will uncover quite >a number of semantic deficiencies in the text. You did catch some good typos, and I caught a few more following your notes through the text. I'm not sure that yielded the semantic difficulties you speculate about here though. >There is a possible tendency to support more alternative behavior than >appropriate. Successful interoperability usually benefits from fewer >choices, not more. Common, mandatory canonicalization is an example. Common, mandatory canonicalization of telephone numbers is unfortunately only slightly more reliable than common, mandatory normalization of internationalized domain names. At least it's just numbers. The algorithm we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap. >Credentials: the specification neither defines nor references a standard >for the specification of credentials, here. That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve. This is a showstopper, in terms of >specification completeness for the service. Well, it does reference a standard for the specification of credentials: stir-certs. I agree it would be a showstopper if we didn't have the stir-certs work. >How is the recipient to know what credential 'standard' is used? How >does this ensure interoperability between two participants who have not >interacted before? There is in practice only one at the moment. I'm content to worry about interop problems when we have another one. >At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and >elsewhere. By way of example, there are few if any cross-organization >key management services on the Internet that demonstrate the utility >needed here. I am pretty sure that Web certs don't qualify. We know >that DKIM's operation does, of course. However DKIM strictly uses >domain names as identifiers and they conveniently align with their >administrative authorities, whereas telephone numbers do not... I'd say that, by design, rfc4474bis is pretty tightly confined to specifying the SIP over-the-wire protocol behavior. It takes a lot of spec just to do that. And your praise of DKIM as a model is once again noted. I would respond again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in our path. > [[[ The mailing list just had an extensive regurgitation of >critical commentary about ENUM. What appears to be getting missed is >that whatever mechanism is going to be used for finding and validating >keys is going to have no operational history of reliability, safety or >efficacy. ]]] HTTP has none of those qualities, apparently. >There is remarkably little of the original RFC 4474 substance still in >this document. Calling it a bis is a bit like tearing all of a building >except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it. It will allow some of the text >to be notably simpler and clearer. I think enough of the concepts and protocol mechanisms of the original are retained to warrant keeping this as a bis. [MB] I'm not sure on this one, in particular given that it deprecates the h= eader fields defined in RFC 4474 (per section 8). And, unlike other -bis s= pecs there is no summary section in this document of the differences betwee= n the two. Also, currently this draft doesn't indicate what impact it has = on 4474 in the header page. There is the sentence at the end of section 1 s= tating that this document "revises RFC 4474" but that's not particularly me= aningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despi= te RFC 7044 being backwards compatible with RFC 4244, I really think that t= his draft should be documented as obsoleting RFC 4474. [/MB] >The document is heavy with forward references. These force the reader >to stop what they are in the middle of, try to hold that place, and look >forward to understand what they've just been interrupted from reading. >As a literary style, forward references create useful tension. In >specifications they just interrupt the flow. The document should be >reorganization so that integrative text comes /after/ the text >describing the pieces being integrated. And opening overview, design >summary, or the like can give a non-normative description of the >architecture and the service, so the reader has a basic sense of the big >picture, before diving into the detail of those to-be-integrated pieces. Dave does make a number of organizational suggestions about the spec. The spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is however unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions that seemed to me like a substantial improvement. [MB] As another RFC 4244 example, we did find that moving the syntax early = in the document in RFC 7044 made it more readable. From a developer's pers= pective, I think it's helpful to have the syntax in mind as one reads all t= he details of the processing.[/MB] Overall, there are a handful of changes (beyond the typos, which again are appreciated) I'd make based on the substance of Dave's review. Some of the suggestions to rename sections seem harmless to me. Like some other people who come to mind, he would like to see some more precise specification and examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity headers in there, and we probably do need an indication of what future work might use that feature. [MB] I would 3rd the need for examples. That has been a usual practice for= other RFCs defining new SIP header fields (and header field parameters). [= /MB] In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the signature is correct, and that we have enough confidence that intermediaries won't break it, and that when it is broken, the verifier behavior makes sense. I think we've focused a lot of attention on those questions, but I'm happy to talk more about that if people think there's room for improvement. Also, he suggests that we might need a better pointer than RFC3986 Section 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead. Otherwise, I think we've got this covered. Anyone who's interested in further details can see the attached. Jon Peterson Neustar, Inc. _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. --_000_D3DB2EE91A7B59jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: <881519DCB0CD2F4EA8D0AF1C2CABDC6E@neustar.biz> Content-Transfer-Encoding: quoted-printable

Oh, we've allowed for multiple Identity headers for some time - the pr= oblem is we don't really give any reason why we allow them or any sense of = what it might mean to have more than one. We need to say at least something= about that, though largely this is a matter of forward compatibility with some future use cases that we kn= ow are under consideration that we don't want to rule out.

Jon Peterson
Neustar, Inc.

From: "Gorman, Pierce A [CTO]&= quot; <Pierce.Gorman@sprint.= com>
Date: Wednesday, August 17, 2016 at= 2:48 PM
To: Mary Barnes <mary.ietf.barnes@gmail.com>, Jon Pete= rson <jon.peterson@neustar.b= iz>
Cc: "stir@ietf.org" <stir@i= etf.org>, "dcrocker@bbiw.n= et" <dcrocker@bbiw.net= >
Subject: RE: [stir] Review of: draf= t-ietf-stir-rfc4474bis-10

Sorry.  Not responding to Mary=92s excellent co= mments. I didn=92t see Jon=92s e-mail and don=92t want to go look for it, s= o I=92m replying to Jon=92s e-mail that Mary was responding to.  (smil= ey emoticon)

 

In reading Mary=92s remarks I saw that Jon said, =93= [Dave] pointed out that we really don't have any motivation for including m= ultiple Identity headers in there, and we probably do need an indication of= what future work might use that feature.=94

 

It has occurred to me before that multiple signature= s might be handy.  Intentionally and illegtimately authenticating spoo= fed calling numbers is possible.  A proxy which had information about = an untrustworthy source might like to add a signature which in effect says, =93you can trust the call came from the or= iginator owning the certificate, but you cannot trust that the cert owner u= sed it legitimately=94.  It would be a way to preserve the originating= authentication information which is useful, but deprecating it too.

 

I suppose there could be History-Info sorts of appli= cations too.

 

Pierce

 

From: Mary Barnes [mailto:mary.ietf.barnes@gmail.com]
Sent: August 17, 2016 2:04 PM
To: Peterson, Jon <jo= n.peterson@neustar.biz>
Cc: stir@ietf.org; dcrocker@bbiw.net
Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10

 

Jon,

 

Thanks for responding to Dave's comments - I found t= hat quite helpful.  I have some comments/responses below [MB].  A= s a caveat to my responses, I did not read all the details in Dave's review= .  

 

Regards,

Mary.

 

On Sat, Aug 13, 2016 at 2:40 AM, Peterson, Jon <<= a href=3D"mailto:jon.peterson@neustar.biz" target=3D"_blank">jon.peterson@n= eustar.biz> wrote:


I finally had a chance to go through these comments, and I did want to
provide a few responses on Dave's review of rfc4474bis here.

>Taken on its own and also when taken with its companion documents, the<= br> >specifications are confusing and incomplete.  It is quite far from= being
>ready for publication.

Having looked through Dave's specific concerns, I don't think he makes his<= br> case for this criticism.

>Terminology is used inconsistently. It often is introduced with no
>background or citation.  Many uses of 'header' are probably suppos= ed to
>be 'header field'.  My sense is that quite a bit of terminology is= used
>equally loosely.

I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

 

[MB] As pendantic as it might seem, in my experience= , the expectation is that we are precise with terminology in the specs, so = that qualifying 'header' as 'header field' and 'parameter' as 'header field= parameter' is a reasonable expectation. I've had to do that with the RFCs that I've authored and in re-reading thi= s document recently, I think it adds to the readability/understanding in pa= rticular since the ABNF comes later. [/MB]

 


>There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit
>together.  In fact is appears that the document itself gets confus= ed on
>this matter.

I'm not sure what an "integrative architectural description" woul= d entail,
but there are a number of sections that provide overviews of operations
and related examples of how the architectural piece come together. I don't<= br> think anything in the review comments genuinely substantiates that the
document itself is confused about its own architecture.

>Algorithms are all offered only as prose and often in a form mitigating=
>comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what = I
>can tell, the algorithms often are incomplete, but serious analysis is<= br> >difficult.

Algorithms are offered in steps with normative language, if that's what
you mean by "prose form". RFCs are typically composed of prose. T= he review
does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF.

>The documents appear to rely on a reader's having quite a bit of prior<= br> >knowledge and are certainly not usable by an implementer who is not
>already deeply embedded in the community that produced these
>specifications.  My impression is that being embedded won't suffic= e
>either, both from my assessment of the documents' deficiencies and give= n
>back-channel comments I have heard about the expectation of the work to=
>be done after these specifications are published.

We do expect basic SIP literacy, and a willingness to follow references
and read external specifications and sections that are cited. Readers that<= br> are unwilling to do this will probably find a lot of things confusing in there.

[MB]  I think the challenge is that 'basic SIP = literacy' isn't such a basic thing anymore and it does require *a lot* of b= ackground to parse this document, but I don't know a way around that. [/MB]=


>Overall, the writing impedes comprehension and the document needs a ver= y
>diligent pass by a technical editor.  I suspect this will uncover = quite
>a number of semantic deficiencies in the text.

You did catch some good typos, and I caught a few more following your
notes through the text. I'm not sure that yielded the semantic
difficulties you speculate about here though.

>There is a possible tendency to support more alternative behavior than<= br> >appropriate. Successful interoperability usually benefits from fewer >choices, not more.  Common, mandatory canonicalization is an examp= le.

Common, mandatory canonicalization of telephone numbers is unfortunately only slightly more reliable than common, mandatory normalization of
internationalized domain names. At least it's just numbers. The algorithm we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap.

>Credentials: the specification neither defines nor references a standar= d
>for the specification of credentials, here.  That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve.  This is a showstopper, in terms of
>specification completeness for the service.

Well, it does reference a standard for the specification of credentials: stir-certs. I agree it would be a showstopper if we didn't have the
stir-certs work.

>How is the recipient to know what credential 'standard' is used?  = How
>does this ensure interoperability between two participants who have not=
>interacted before?

There is in practice only one at the moment. I'm content to worry about
interop problems when we have another one.

>At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and
>elsewhere.  By way of example, there are few if any cross-organiza= tion
>key management services on the Internet that demonstrate the utility >needed here.  I am pretty sure that Web certs don't qualify. = We know
>that DKIM's operation does, of course.  However DKIM strictly uses=
>domain names as identifiers and they conveniently align with their
>administrative authorities, whereas telephone numbers do not...

I'd say that, by design, rfc4474bis is pretty tightly confined to
specifying the SIP over-the-wire protocol behavior. It takes a lot of spec<= br> just to do that.

And your praise of DKIM as a model is once again noted. I would respond
again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in<= br> our path.

>      [[[ The mailing list just had an extensive regurgi= tation of
>critical commentary about ENUM.  What appears to be getting missed= is
>that whatever mechanism is going to be used for finding and validating<= br> >keys is going to have no operational history of reliability, safety or<= br> >efficacy. ]]]

HTTP has none of those qualities, apparently.

>There is remarkably little of the original RFC 4474 substance still in<= br> >this document.  Calling it a bis is a bit like tearing all of a bu= ilding
>except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it.  It will allow some of the = text
>to be notably simpler and clearer.

I think enough of the concepts and protocol mechanisms of the original are<= br> retained to warrant keeping this as a bis.

 

[MB] I'm not sure on this one, in particular given t= hat it deprecates the header fields defined in RFC 4474 (per section 8).&nb= sp; And, unlike other -bis specs there is no summary section in this docume= nt of the differences between the two.  Also, currently this draft doesn't indicate what impact it has on 4474 in = the header page. There is the sentence at the end of section 1 stating that= this document "revises RFC 4474" but that's not particularly mea= ningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with RFC= 4244, I really think that this draft should be documented as obsoleting RF= C 4474. [/MB]


>The document is heavy with forward references.  These force the re= ader
>to stop what they are in the middle of, try to hold that place, and loo= k
>forward to understand what they've just been interrupted from reading.<= br> >As a literary style, forward references create useful tension.  In=
>specifications they just interrupt the flow.  The document should = be
>reorganization so that integrative text comes /after/ the text
>describing the pieces being integrated.  And opening overview, des= ign
>summary, or the like can give a non-normative description of the
>architecture and the service, so the reader has a basic sense of the bi= g
>picture, before diving into the detail of those to-be-integrated pieces= .


Dave does make a number of organizational suggestions about the spec. The spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is = however
unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions that seemed to me like a substantial improvement.

[MB] As another RFC 4244 example, we did find that m= oving the syntax early in the document in RFC 7044 made it more readable.&n= bsp; From a developer's perspective, I think it's helpful to have the synta= x in mind as one reads all the details of the processing.[/MB]


Overall, there are a handful of changes (beyond the typos, which again are<= br> appreciated) I'd make based on the substance of Dave's review. Some of the<= br> suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.

[MB] I would 3rd the need for examples.  That h= as been a usual practice for other RFCs defining new SIP header fields (and= header field parameters). [/MB] 


In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the<= br> signature is correct, and that we have enough confidence that
intermediaries won't break it, and that when it is broken, the verifier
behavior makes sense. I think we've focused a lot of attention on those
questions, but I'm happy to talk more about that if people think there's room for improvement.

Also, he suggests that we might need a better pointer than RFC3986 Section<= br> 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead.

Otherwise, I think we've got this covered. Anyone who's interested in
further details can see the attached.

Jon Peterson
Neustar, Inc.


_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 



This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message.
 --_000_D3DB2EE91A7B59jonpetersonneustarbiz_-- From nobody Thu Aug 18 10:03:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EE2512D898 for ; Thu, 18 Aug 2016 10:03:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KIVRKMOP1M3B for ; Thu, 18 Aug 2016 10:03:35 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0097.outbound.protection.outlook.com [104.47.37.97]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E0C212DA93 for ; Thu, 18 Aug 2016 10:03:11 -0700 (PDT) Received: from BN1AFFO11FD035.protection.gbl (10.58.52.30) by BN1AFFO11HUB019.protection.gbl (10.58.52.129) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.567.7; Thu, 18 Aug 2016 17:03:10 +0000 Authentication-Results: spf=pass (sender IP is 144.230.32.80) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.32.80 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.32.80; helo=preapdm1.corp.sprint.com; Received: from preapdm1.corp.sprint.com (144.230.32.80) by BN1AFFO11FD035.mail.protection.outlook.com (10.58.52.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.577.8 via Frontend Transport; Thu, 18 Aug 2016 17:03:09 +0000 Received: from pps.filterd (preapdm1.corp.sprint.com [127.0.0.1]) by preapdm1.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7IGxHpM025085; Thu, 18 Aug 2016 13:03:09 -0400 Received: from plswe13m07.ad.sprint.com (plswe13m07.corp.sprint.com [144.229.214.26]) by preapdm1.corp.sprint.com with ESMTP id 24wgw882qu-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 18 Aug 2016 13:03:09 -0400 Received: from PLSWE13M08.ad.sprint.com (2002:90e5:d61b::90e5:d61b) by PLSWE13M07.ad.sprint.com (2002:90e5:d61a::90e5:d61a) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 18 Aug 2016 12:02:53 -0500 Received: from PLSWE13M08.ad.sprint.com ([fe80::ac2b:5efb:6c96:db7d]) by PLSWE13M08.ad.sprint.com ([fe80::5db1:e508:58c7:c6ed%24]) with mapi id 15.00.1210.000; Thu, 18 Aug 2016 12:02:53 -0500 From: "Gorman, Pierce A [CTO]" To: "Peterson, Jon" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR+MlawFWovp1VakirtcyY4idXt6BNqBdggAGa0wD//68i4A== Date: Thu, 18 Aug 2016 17:02:52 +0000 Message-ID: References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.32] Content-Type: multipart/alternative; boundary="_000_be3246a8cfdd45b9a2e8255f647dbcc0PLSWE13M08adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.32.80; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(438002)(189002)(377454003)(24454002)(199003)(4326007)(626004)(24736003)(3846002)(68736007)(102836003)(84326002)(33646002)(54356999)(50986999)(2950100001)(8936002)(19580405001)(512954002)(19580395003)(19617315012)(2906002)(87936001)(108616004)(92566002)(76176999)(11100500001)(4546004)(86362001)(19625215002)(16236675004)(106466001)(110136002)(81156014)(189998001)(93886004)(8676002)(97736004)(260700001)(106116001)(6116002)(230783001)(15975445007)(7846002)(5250100002)(7736002)(586003)(81166006)(7696003)(356003)(790700001)(7906003)(19300405004)(2900100001)(5890100001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1AFFO11HUB019; H:preapdm1.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD035; 1:RHanJgEuKCJEb0wTZ31p2TDkRwJES83kdK89WZFVvZySumBw6JSs/EMfC/ZphbUkuw58EysKJEnR1vLbpUbX3claxPE0YJ8R+HopCQDssgUCLNYBirqkXp1idNeTXv/BRucN0EZqVDv5KrjtISwUTG6ldbbVIAM21c47LBzHZ6KHULiDxLMzCFvfXJUqRs5qujpTl6mshjdHwx9gK6CQM2yCvYMPLmy3u1wFlon9rf9v+8anJGPeJ8uIzI1zJgSxUbCl0U6h83DlRCg/ldIUnx4tFncMrq44GJLMigooqQkRoyrzmHuWJpGuIY27QjaIYlp+uqJYANwrDSHIjXnS+OMUohLtHm48MLgurPs4lqra0m+FzkGnGQMiPeFIwBwRIF58NjRMJeG177CivbtMfwWutBMYyMTXqoiGRXXeNPWEVjI7Y1R/xbxhzNLjiJgs2gjAsPatC0a8VxxBzuIPiCSETkqwxbQn0dqbg019QXITldMCX9ZflNTkOhLVyBVpIxb+Oyu2295Tre4YE3YtKMBjiNSVjNfH3vXDJ49uPAQFUtjJ29r7zHK1OSQjugCH X-MS-Office365-Filtering-Correlation-Id: c7e6e0a0-60ba-4979-984d-08d3c7898848 X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB019; 2:Mk/xLJKuucapfCw6j+xQcTGpJTm6snhi1n+jSH6KgrvGAU/+Spd74Ai/+lu8IEYhGBakXXFrn7CccFOWZMGIBAYzGDD5zVEDifpD1WwKiIh/L9DiDcbu1GCOSQGf94FbvJd1R7aokj/O+Op4uy1/oaS9el8o0iJDEqh58zn2kd6N249+ANZ5PzTrVdlFW7Yu; 3:OrCwP5HH1vPTdTvcAXZC8BBmOQ/gueVH7/Rsrt1WbNj6zZuSbppWO9kHKRUTqKscRgJ+uQC1rn17OpSbcuLP/suYjmxV7O2nLDphb3KLIj+GrvVtW9oH2X23yOlpv+cYSQ5ztvTC1ewYcL1Uxjad9p2dJkK2R2EriCBRmqQ6v9eWDtkSUBJxJV0ilgSmbj1m0Q3qeiaqi4Tchw1EC7geQya1e/iOoVz96U5JkDWWRytQ7eVEPr19MmvoX+yfv1eVkcBLu07F/S+1elTe+xxOgg== X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BN1AFFO11HUB019; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB019; 25:Ir5KMYLOKyWVPJ2yWnoHkvA6NjUQ/j1AAqgKna0?= =?us-ascii?Q?XE5eGbCdJ3F7354DpiPfLDnEh58CKGW2P/b3aIgTHG1j6iEGqAclJwkAltjG?= =?us-ascii?Q?CzPgqKQKGGeMOzo+CKeImQc/yDMKS2pFHnLxtH+AGxD3/raxdgjfWIYcQLeC?= =?us-ascii?Q?tnarZoFBqTxRNwh9r4Xgxaq4BPwMFiZljuh6SZsK5V/u3KlnhLHul7Y5TXVC?= =?us-ascii?Q?tcS1Co/XKVCYmd/4VQWVPbbYRjlyAwBKqud1M58CGfSAIyP5o39gTLe9lvtO?= =?us-ascii?Q?ZcOrFWY+EcobRsXP00qe96Ie2XL61YssyZhyn0kLZP5azFUWN7pI9Na/dMBM?= =?us-ascii?Q?HpeJmuKNU96YmUUE9WVE7kP03Mpe1ErGwk663+YsFoxcf/0XTYHJ73gEtSIj?= =?us-ascii?Q?3seRdl0wJTRHKHzckcmv+0NZTQXje0Vmf0NpkeCLDV5eCpzgobbFtome9KI3?= =?us-ascii?Q?Q54GeC5b79p7+gqhtRmbn+ETSB7g39kxuqKcbt3NnTkJyBUaTU5UXWgFIQE/?= =?us-ascii?Q?YA0eqW1crekYK43EF1vGeqEC6dEaEcEkEN5ER7ap/1+iHZEaKVieOwdcjW/+?= =?us-ascii?Q?kOqeXuZXQ+LqTPRPqxcyIBfcYN/8EwTlb3D6YG/bKvyJuuYLUx8EsrdnQoL0?= =?us-ascii?Q?d2RLpIo+ErYU+AGjMSQXHpEV5tiGyjXLxuM6oqVLoaSDEqiRoNpWRxMA9/D+?= =?us-ascii?Q?CCbyzFr8io4vxJPHQTgQPB8B+qHgEJidZwqoWfCLJUx/qsq80S2si3T9MLd5?= =?us-ascii?Q?ac4RLue+woaVN5aFLw338o34/mALBlw36ToMzWjkujBVgs8JVBp9a21Rjrna?= =?us-ascii?Q?99usiKUCpFPlbVh6LC0NRZMirM6/8pyiGmcpqXTMqswcE4na5uWJMWWr5+ea?= =?us-ascii?Q?Wo8CSg7iDVKEXvGzwO9dzrGcLPH70r8HcD1HqzlzYGH4e+AH0iAdFteLNoAf?= =?us-ascii?Q?kPRgk6Lo6NCdtvOGLhA1ufb75yzM9iHV+voMvHsl2b/6QyNbTPrsffQSKzx9?= =?us-ascii?Q?Q95KwbqkPZFsIYA5SAhKXWHs8e5VkMafIE8VFOzFBbwOPBj7jeQZVaxAKZBZ?= =?us-ascii?Q?jtGCxsavLi2H79SLI7iiCnXZkNPd7vHiw+y/2fsDyX17zw2rvZw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB019; 31:Zyeowlj/429pEYr7qC0IE24Sg7RNEof1UdW4vNKx06bUaeD28TXEDCZWLw5BxbBsAnf9WqXwbApp/6SeEC9YDfjy9XmdJSbSXHCTrWJGT92LQ43I6z7vOmrKCHf7AJg4znoLy8lFaOX9E8ckeRmzDG50fBYl54xsSRR+/E9aABsI9tamXYKgZGvgiloa9ocrVoEtVeXf7IAjWDR1RWO2xuj/fwXnZYeUmb8vDuXsjuk=; 20:iDn8MBnTy6vLxrZ/5CojbAYfsWjTnANoL2ojBFiONVm1ZOroozWmfTwDWF6ghWK5I7dvUUfLjjbx1kslKu4ZzVlK4IcSDW21CH9PhuAcV2c5S0cv1hMJCxu/IE13vWhM43Ml0BvBh4PYDyX7g9oR17rf4JqytMGUnq4/DDpHmixA3lFZ/xvdGypkOkv+Saj6ZaF1S2hVlnLaEjjhq22hAha5oS11tziGxHwkdMdTgZGdXnkf5zNF53uNz4OYY1BkPj+uX69Ss/G3YGHASon/Ru9UhscY765yLpagLtRx7tI8b/4EMUvfKx8n/ifqEgy0iazq1W2W7bbNiwyxFgCFb6rqp77ZmWQ7kOSzZ54LmDNGW8cyF/XBfs9+s+9GuNboh+1FNPFRJd7jsYULAx7cwkEvymJDRiSM7CkE7+N2gWE= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(278428928389397)(18430343700868)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(13015025)(13018025)(13024025)(13023025)(8121501046)(13017025)(5005006)(3002001)(10201501046)(6055026); SRVR:BN1AFFO11HUB019; BCL:0; PCL:0; RULEID:; SRVR:BN1AFFO11HUB019; X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB019; 4:bO9eRwEdGKRBpxVp01b4I3HQsD9gg+wtOEDwDMfaC7essg0SCCEpRH/HufwQqm6TNLGZfVzmx3uovFBW6TKdATAuwU7dqtVnIf0Z3wymgNsoGXKwy++XAVYLyT5/KrVcuuMoRHPFFb4Yb7+F6LgxNr1BweY0NbBoAPksvhNLiZK9PKExxuTUbpxLn1WXhw1IXpJUvl6DtvtU5UOez5YWrh1PR+aigqcK+/xpN8RZCoD9EDbrFILAH6dpPSyXJ3Z6IYQi8meW+CRju0vzwQ+ReIW3uK7B5ZwAARe+f+ckxm3Uf5rlgujeEL7+RuJ0ILsY26c5aJ9eT3/VV2vfPWpjZaGjALb5LCYaFxUsHuEr+ZKhJywzu1pE6pU2QlAjrEXs7DKyNZI2IbDQ3pweno2p1wkbKeShezFWKOHdWRFVp5DNi2+minzgkLFhujazLdlO82KmCBO+iYhW1TVP0dkw2XaJj9IilvzL8R6zQLhOC28/5MakHjbCFVh1sWKOKC+NpjulS8WKPQhBCh8rr+aFLukLBbcwt1oZErG8Sxt+p0WV40Pu0TSzfIRB04k3JDyPNNi2vYbJ4JE3pMYv6LK3B42bcp8+JJv80TqDiXVhCXQ= X-Forefront-PRVS: 0038DE95A2 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN1AFFO11HUB019; 23:ykRwsij1wq+mBysI6cUKmeakzf7LlYW8KAIvN3P?= =?us-ascii?Q?3IpKIjRb0KtvOLxZOaQhHhC8yua51uu1bw4CXCH/Qlo/tJjuii+A2vs0AYoR?= =?us-ascii?Q?4YBUtG6sotmWvhmtEACUHsTgQgaWnigKxlgrfkEyO8gIaG4qWx5dxkgQA6GL?= =?us-ascii?Q?+OqEj70w/tDPIg0YqvoXywHo3r+Q1YvR2m0qIuJrOaOO5XYDy7/uM/o6vHc0?= =?us-ascii?Q?/yLXMa98y9fWqaHkXdAs8L8iGR/OBiWv3q22916hFPgiw4eeetONdKE/Aw1b?= =?us-ascii?Q?eeMEEVRWKSqBhc19fouxkxVOv8lOo0rrVaYTfMtWdUZGUPz+hsK/SKOXzO9h?= =?us-ascii?Q?jQzaQHH0QaPfqwV86SqdJ9E1KsxBv5Nov8vFDb+WJGNAYmKA809AyLt/6HeV?= =?us-ascii?Q?GQ24n60FsaQFDAQ6qmz/9rFdX5Xt2iJkQU4Lo7oDYhiDg5B6WQSQUstreBtc?= =?us-ascii?Q?8EDVv5wyw+o4IZFgVc1oojEtzFN7U2w9NvugBaA3KCHKVKS5xnOyXxgLk1YW?= =?us-ascii?Q?oNGc/b0NXw5ezy+jVy0IJRComQPphkWrBYMFEX5ec98bmITVY+B/PdVj0/zD?= =?us-ascii?Q?Q+ualNcmTCdTXowIh5LcTRCSuJ80tEQe0dpPoQcf9qrygQ5XHOUlmKl04bWI?= =?us-ascii?Q?6LTXkBYhDxF29XzggweRaJYBNpEadRy4Ijpo0Nws/9xbFP8t9A5Sg0H5tt6F?= =?us-ascii?Q?kAfeIYaYbOYqB06g3ijLhtAIqv3H4KvFpdgUolE2NLe7XYAEfuRjSwnkrxQ0?= =?us-ascii?Q?rIdiuuJp+bjrLOwdvoaibnuWUDH985eJGuz00jWNptBSXYZN/JPN+HeOF321?= =?us-ascii?Q?s8aM5IVZ9z0cnf7s0qOSoNtZrInXojGhmJ3hl0Y+UfgiLX3ILD591MzEsD8X?= =?us-ascii?Q?aXZ2LDqJia6MxZuwPyPRtInjExTjqiGE4Lp1OJnnuNTIointZkSfHalBoOjm?= =?us-ascii?Q?JzlypMJwKHMtulp6rlezTwamGzepkh/SF7/csEmPbiqOEjI5mUr9OTCBxoLe?= =?us-ascii?Q?TlfnWerJriM1X/0OixeszEsLZ4IElEVcokSB0m/fB43gTpcq2VYmYvjPMBfj?= =?us-ascii?Q?E5tsm9WCLCxOyij6Esv46Uaxfxuqe81Hux8M0lCZraGbvrB9A7ITmWmYv+/2?= =?us-ascii?Q?lTvky1hkIABPb69NAzI07i6/70uFtyQ++vhmAxjWFGooRYDTVAGNdYknKqQ2?= =?us-ascii?Q?98HypCmRKdikfCJz85GRQGPmv1liJink6/Rmj+Pct6Ajnuf/v4jUmI4CYHd8?= =?us-ascii?Q?pZH6BJWA0u/4FNSgZaqeLEanUQCyP+egwwldGalV+10EAMjzYzYa/67K9nXn?= =?us-ascii?Q?2jaEuFS95Sepp5eV1F/mJ9Z//TtXEk5CP1GKHACg+JiQRRQr72Kt7qBIwMxp?= =?us-ascii?Q?+YcAADBT7jXL7mPyMphfJpfb5DlpjWGC9F++NbC4Uuo/QbYEW?= X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11HUB019; 6:dC+ZFMZCsdK3h17fRCZnKAC+tyJw9/oYzLlZJV4VY5JbjQjGYcy5su+clIj78DWI1xQODQ5l3nlozvYe9ApqUnqp5907RN4Ewb6QHvjiTRIM8FIda3WkHIvvEkOJgwzuozzxY+NX+4AZ9I7zdoh5FKP6dP9v3qKz10fyRQxPg84VvqMZ9MfDkc3Vk+kS4lOn2p6IPRsnJckq64pROAvJWkP20pkvZio7E0Ah+HtctNUYyJg0lUgyVmboA4bzfDI1DSp4wqgIigN2q0u7Mcky5i0tVdQi/bajl9F0e+CYlmMQB//KTwn6T2AFpM7i7wgn4psbu1A/zEWfJKMAGkFLlw==; 5:A83xvbqeeCChFTV5PvixgPG5hLskXdBL3wnpMFWHjLIttimqwFApu2QHBUOeG7oP0XX0TkpiaH+S8oiQHsEVu5H7U90f3bW+OfinTcCjV8I5zde4mhbjv1N73hs2+U9uv/TaEGh0nfmJp6SZH2ZgZw==; 24:8b5ezrZxMBbwum8HiGbkHePvFg3i2/Q1Njk27CjTNISOy4MAVa0C9r9dMLagjrbQ03nYsE9cqx+BNcMVhkvbHlF0W3JYzEZH9XRSkyc/ueE=; 7:K7FJzaNtrQRt9hHfx/doAf/ffARSwq3TZzwg+KEtOn1+zhu72lRs68TBwM57oEO9HrPPJ3e9/VtXMAs+nPGArfKHNIQnNxE4P7mdHTrf1f8ejRkn5cT6dUgRrt21laH8kfjyvimloC9UZEsC9sAT1u2fV2AlM4oYKtg1QJMq+xTroQRWIP5xysGhdS5NBa13L4qSuota1ds9W9IZbEMvsWqVPD/a5AlOgXFSwoXq+4NaoZD4Dg5UpySTJvt2sl4y SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Aug 2016 17:03:09.9341 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.32.80]; Helo=[preapdm1.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1AFFO11HUB019 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 17:03:55 -0000 --_000_be3246a8cfdd45b9a2e8255f647dbcc0PLSWE13M08adsprintcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Agree. There might be other ways to deal with multiple Identity headers, b= ut a push/pop stack is what comes to mind. I would want some way to tell w= hich Identity header was applied first, second, et cetera. Pierce From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: August 18, 2016 11:48 AM To: Gorman, Pierce A [CTO] Cc: stir@ietf.org Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Oh, we've allowed for multiple Identity headers for some time - the problem= is we don't really give any reason why we allow them or any sense of what = it might mean to have more than one. We need to say at least something abou= t that, though largely this is a matter of forward compatibility with some = future use cases that we know are under consideration that we don't want to= rule out. Jon Peterson Neustar, Inc. From: "Gorman, Pierce A [CTO]" > Date: Wednesday, August 17, 2016 at 2:48 PM To: Mary Barnes >, Jon Peterson > Cc: "stir@ietf.org" >, "dcrocker@bbiw.net" > Subject: RE: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Sorry. Not responding to Mary's excellent comments. I didn't see Jon's e-m= ail and don't want to go look for it, so I'm replying to Jon's e-mail that = Mary was responding to. (smiley emoticon) In reading Mary's remarks I saw that Jon said, "[Dave] pointed out that we = really don't have any motivation for including multiple Identity headers in= there, and we probably do need an indication of what future work might use= that feature." It has occurred to me before that multiple signatures might be handy. Inte= ntionally and illegtimately authenticating spoofed calling numbers is possi= ble. A proxy which had information about an untrustworthy source might lik= e to add a signature which in effect says, "you can trust the call came fro= m the originator owning the certificate, but you cannot trust that the cert= owner used it legitimately". It would be a way to preserve the originatin= g authentication information which is useful, but deprecating it too. I suppose there could be History-Info sorts of applications too. Pierce From: Mary Barnes [mailto:mary.ietf.barnes@gmail.com] Sent: August 17, 2016 2:04 PM To: Peterson, Jon > Cc: stir@ietf.org; dcrocker@bbiw.net Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Jon, Thanks for responding to Dave's comments - I found that quite helpful. I h= ave some comments/responses below [MB]. As a caveat to my responses, I did= not read all the details in Dave's review. Regards, Mary. On Sat, Aug 13, 2016 at 2:40 AM, Peterson, Jon > wrote: I finally had a chance to go through these comments, and I did want to provide a few responses on Dave's review of rfc4474bis here. >Taken on its own and also when taken with its companion documents, the >specifications are confusing and incomplete. It is quite far from being >ready for publication. Having looked through Dave's specific concerns, I don't think he makes his case for this criticism. >Terminology is used inconsistently. It often is introduced with no >background or citation. Many uses of 'header' are probably supposed to >be 'header field'. My sense is that quite a bit of terminology is used >equally loosely. I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field value," no denying that. If people think this is a big deal, I will fix it. But the suggestion that because this is true, terminology is loosely used to a point where it would hamper implementation, that I think his comments don't really substantiate. [MB] As pendantic as it might seem, in my experience, the expectation is th= at we are precise with terminology in the specs, so that qualifying 'header= ' as 'header field' and 'parameter' as 'header field parameter' is a reason= able expectation. I've had to do that with the RFCs that I've authored and = in re-reading this document recently, I think it adds to the readability/un= derstanding in particular since the ABNF comes later. [/MB] >There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit >together. In fact is appears that the document itself gets confused on >this matter. I'm not sure what an "integrative architectural description" would entail, but there are a number of sections that provide overviews of operations and related examples of how the architectural piece come together. I don't think anything in the review comments genuinely substantiates that the document itself is confused about its own architecture. >Algorithms are all offered only as prose and often in a form mitigating >comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what I >can tell, the algorithms often are incomplete, but serious analysis is >difficult. Algorithms are offered in steps with normative language, if that's what you mean by "prose form". RFCs are typically composed of prose. The review does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF. >The documents appear to rely on a reader's having quite a bit of prior >knowledge and are certainly not usable by an implementer who is not >already deeply embedded in the community that produced these >specifications. My impression is that being embedded won't suffice >either, both from my assessment of the documents' deficiencies and given >back-channel comments I have heard about the expectation of the work to >be done after these specifications are published. We do expect basic SIP literacy, and a willingness to follow references and read external specifications and sections that are cited. Readers that are unwilling to do this will probably find a lot of things confusing in there. [MB] I think the challenge is that 'basic SIP literacy' isn't such a basic= thing anymore and it does require *a lot* of background to parse this docu= ment, but I don't know a way around that. [/MB] >Overall, the writing impedes comprehension and the document needs a very >diligent pass by a technical editor. I suspect this will uncover quite >a number of semantic deficiencies in the text. You did catch some good typos, and I caught a few more following your notes through the text. I'm not sure that yielded the semantic difficulties you speculate about here though. >There is a possible tendency to support more alternative behavior than >appropriate. Successful interoperability usually benefits from fewer >choices, not more. Common, mandatory canonicalization is an example. Common, mandatory canonicalization of telephone numbers is unfortunately only slightly more reliable than common, mandatory normalization of internationalized domain names. At least it's just numbers. The algorithm we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap. >Credentials: the specification neither defines nor references a standard >for the specification of credentials, here. That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve. This is a showstopper, in terms of >specification completeness for the service. Well, it does reference a standard for the specification of credentials: stir-certs. I agree it would be a showstopper if we didn't have the stir-certs work. >How is the recipient to know what credential 'standard' is used? How >does this ensure interoperability between two participants who have not >interacted before? There is in practice only one at the moment. I'm content to worry about interop problems when we have another one. >At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and >elsewhere. By way of example, there are few if any cross-organization >key management services on the Internet that demonstrate the utility >needed here. I am pretty sure that Web certs don't qualify. We know >that DKIM's operation does, of course. However DKIM strictly uses >domain names as identifiers and they conveniently align with their >administrative authorities, whereas telephone numbers do not... I'd say that, by design, rfc4474bis is pretty tightly confined to specifying the SIP over-the-wire protocol behavior. It takes a lot of spec just to do that. And your praise of DKIM as a model is once again noted. I would respond again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in our path. > [[[ The mailing list just had an extensive regurgitation of >critical commentary about ENUM. What appears to be getting missed is >that whatever mechanism is going to be used for finding and validating >keys is going to have no operational history of reliability, safety or >efficacy. ]]] HTTP has none of those qualities, apparently. >There is remarkably little of the original RFC 4474 substance still in >this document. Calling it a bis is a bit like tearing all of a building >except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it. It will allow some of the text >to be notably simpler and clearer. I think enough of the concepts and protocol mechanisms of the original are retained to warrant keeping this as a bis. [MB] I'm not sure on this one, in particular given that it deprecates the h= eader fields defined in RFC 4474 (per section 8). And, unlike other -bis s= pecs there is no summary section in this document of the differences betwee= n the two. Also, currently this draft doesn't indicate what impact it has = on 4474 in the header page. There is the sentence at the end of section 1 s= tating that this document "revises RFC 4474" but that's not particularly me= aningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despi= te RFC 7044 being backwards compatible with RFC 4244, I really think that t= his draft should be documented as obsoleting RFC 4474. [/MB] >The document is heavy with forward references. These force the reader >to stop what they are in the middle of, try to hold that place, and look >forward to understand what they've just been interrupted from reading. >As a literary style, forward references create useful tension. In >specifications they just interrupt the flow. The document should be >reorganization so that integrative text comes /after/ the text >describing the pieces being integrated. And opening overview, design >summary, or the like can give a non-normative description of the >architecture and the service, so the reader has a basic sense of the big >picture, before diving into the detail of those to-be-integrated pieces. Dave does make a number of organizational suggestions about the spec. The spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is however unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions that seemed to me like a substantial improvement. [MB] As another RFC 4244 example, we did find that moving the syntax early = in the document in RFC 7044 made it more readable. From a developer's pers= pective, I think it's helpful to have the syntax in mind as one reads all t= he details of the processing.[/MB] Overall, there are a handful of changes (beyond the typos, which again are appreciated) I'd make based on the substance of Dave's review. Some of the suggestions to rename sections seem harmless to me. Like some other people who come to mind, he would like to see some more precise specification and examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity headers in there, and we probably do need an indication of what future work might use that feature. [MB] I would 3rd the need for examples. That has been a usual practice for= other RFCs defining new SIP header fields (and header field parameters). [= /MB] In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the signature is correct, and that we have enough confidence that intermediaries won't break it, and that when it is broken, the verifier behavior makes sense. I think we've focused a lot of attention on those questions, but I'm happy to talk more about that if people think there's room for improvement. Also, he suggests that we might need a better pointer than RFC3986 Section 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead. Otherwise, I think we've got this covered. Anyone who's interested in further details can see the attached. Jon Peterson Neustar, Inc. _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. --_000_be3246a8cfdd45b9a2e8255f647dbcc0PLSWE13M08adsprintcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Agree.  There might be other ways = to deal with multiple Identity headers, but a push/pop stack is what comes = to mind.  I would want some way to tell which Identity header was applied first, second, et cetera. 

 

Pierce=

 

From: Peterson, Jon [mailto:jon.pete= rson@neustar.biz]
Sent: August 18, 2016 11:48 AM
To: Gorman, Pierce A [CTO] <Pierce.Gorman@sprint.com>
Cc: stir@ietf.org
Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10

 

 

Oh, we've allowed for multiple Identity= headers for some time - the problem is we don't really give any reason why= we allow them or any sense of what it might mean to have more than one. We need to say at least something about that, thoug= h largely this is a matter of forward compatibility with some future use ca= ses that we know are under consideration that we don't want to rule out.

 

Jon Peterson

Neustar, Inc.

 

From: "Gorman, Pierce A [CTO]" <Pierce.Gorman@sprint.com>
Date: Wednesday, August 17, 2016 at 2:48 PM
To: Mary Barnes <ma= ry.ietf.barnes@gmail.com>, Jon Peterson <jon.peterson@neustar.biz>
Cc: "stir@ietf.org" &= lt;stir@ietf.org>, "dcrocker@bbiw.net" <dcrocker@bbiw.net>
Subject: RE: [stir] Review of: draft-ietf-stir-rfc4474bis-10

 

Sorry.  Not respond= ing to Mary’s excellent comments. I didn’t see Jon’s e-ma= il and don’t want to go look for it, so I’m replying to JonR= 17;s e-mail that Mary was responding to.  (smiley emoticon)=

 =

In reading Mary’s = remarks I saw that Jon said, “[Dave] pointed out that we really don't= have any motivation for including multiple Identity headers in there, and = we probably do need an indication of what future work might use that feature.”

 =

It has occurred to me be= fore that multiple signatures might be handy.  Intentionally and illeg= timately authenticating spoofed calling numbers is possible.  A proxy = which had information about an untrustworthy source might like to add a signature which in effect says, “you can trust t= he call came from the originator owning the certificate, but you cannot tru= st that the cert owner used it legitimately”.  It would be a way= to preserve the originating authentication information which is useful, but deprecating it too.

 =

I suppose there could be= History-Info sorts of applications too.

 =

Pierce=

 

From: Mary B= arnes [mailto:mary.ietf.barne= s@gmail.com]
Sent: August 17, 2016 2:04 PM
To: Peterson, Jon <jo= n.peterson@neustar.biz>
Cc: stir@ietf.org; dcrocker@bbiw.net
Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10<= span style=3D"color:black">

 =

Jon,

 =

Thanks for responding to= Dave's comments - I found that quite helpful.  I have some comments/r= esponses below [MB].  As a caveat to my responses, I did not read all = the details in Dave's review.  

 =

Regards,

Mary.<= /p>

 =

On Sat, Aug 13, 2016 at = 2:40 AM, Peterson, Jon <jon.peterson@neustar.biz> wrote:


I finally had a chance to go through these comments, and I did want to
provide a few responses on Dave's review of rfc4474bis here.

>Taken on its own and also when taken with its companion documents, the<= br> >specifications are confusing and incomplete.  It is quite far from= being
>ready for publication.

Having looked through Dave's specific concerns, I don't think he makes his<= br> case for this criticism.

>Terminology is used inconsistently. It often is introduced with no
>background or citation.  Many uses of 'header' are probably suppos= ed to
>be 'header field'.  My sense is that quite a bit of terminology is= used
>equally loosely.

I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

 =

[MB] As pendantic as it = might seem, in my experience, the expectation is that we are precise with t= erminology in the specs, so that qualifying 'header' as 'header field' and = 'parameter' as 'header field parameter' is a reasonable expectation. I've had to do that with the RFCs that I've a= uthored and in re-reading this document recently, I think it adds to the re= adability/understanding in particular since the ABNF comes later. [/MB]

 =


>There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit
>together.  In fact is appears that the document itself gets confus= ed on
>this matter.

I'm not sure what an "integrative architectural description" woul= d entail,
but there are a number of sections that provide overviews of operations
and related examples of how the architectural piece come together. I don't<= br> think anything in the review comments genuinely substantiates that the
document itself is confused about its own architecture.

>Algorithms are all offered only as prose and often in a form mitigating=
>comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what = I
>can tell, the algorithms often are incomplete, but serious analysis is<= br> >difficult.

Algorithms are offered in steps with normative language, if that's what
you mean by "prose form". RFCs are typically composed of prose. T= he review
does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF.

>The documents appear to rely on a reader's having quite a bit of prior<= br> >knowledge and are certainly not usable by an implementer who is not
>already deeply embedded in the community that produced these
>specifications.  My impression is that being embedded won't suffic= e
>either, both from my assessment of the documents' deficiencies and give= n
>back-channel comments I have heard about the expectation of the work to=
>be done after these specifications are published.

We do expect basic SIP literacy, and a willingness to follow references
and read external specifications and sections that are cited. Readers that<= br> are unwilling to do this will probably find a lot of things confusing in there.

[MB]  I think the c= hallenge is that 'basic SIP literacy' isn't such a basic thing anymore and = it does require *a lot* of background to parse this document, but I don't k= now a way around that. [/MB]


>Overall, the writing impedes comprehension and the document needs a ver= y
>diligent pass by a technical editor.  I suspect this will uncover = quite
>a number of semantic deficiencies in the text.

You did catch some good typos, and I caught a few more following your
notes through the text. I'm not sure that yielded the semantic
difficulties you speculate about here though.

>There is a possible tendency to support more alternative behavior than<= br> >appropriate. Successful interoperability usually benefits from fewer >choices, not more.  Common, mandatory canonicalization is an examp= le.

Common, mandatory canonicalization of telephone numbers is unfortunately only slightly more reliable than common, mandatory normalization of
internationalized domain names. At least it's just numbers. The algorithm we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap.

>Credentials: the specification neither defines nor references a standar= d
>for the specification of credentials, here.  That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve.  This is a showstopper, in terms of
>specification completeness for the service.

Well, it does reference a standard for the specification of credentials: stir-certs. I agree it would be a showstopper if we didn't have the
stir-certs work.

>How is the recipient to know what credential 'standard' is used?  = How
>does this ensure interoperability between two participants who have not=
>interacted before?

There is in practice only one at the moment. I'm content to worry about
interop problems when we have another one.

>At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and
>elsewhere.  By way of example, there are few if any cross-organiza= tion
>key management services on the Internet that demonstrate the utility >needed here.  I am pretty sure that Web certs don't qualify. = We know
>that DKIM's operation does, of course.  However DKIM strictly uses=
>domain names as identifiers and they conveniently align with their
>administrative authorities, whereas telephone numbers do not...

I'd say that, by design, rfc4474bis is pretty tightly confined to
specifying the SIP over-the-wire protocol behavior. It takes a lot of spec<= br> just to do that.

And your praise of DKIM as a model is once again noted. I would respond
again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in<= br> our path.

>      [[[ The mailing list just had an extensive regurgi= tation of
>critical commentary about ENUM.  What appears to be getting missed= is
>that whatever mechanism is going to be used for finding and validating<= br> >keys is going to have no operational history of reliability, safety or<= br> >efficacy. ]]]

HTTP has none of those qualities, apparently.

>There is remarkably little of the original RFC 4474 substance still in<= br> >this document.  Calling it a bis is a bit like tearing all of a bu= ilding
>except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it.  It will allow some of the = text
>to be notably simpler and clearer.

I think enough of the concepts and protocol mechanisms of the original are<= br> retained to warrant keeping this as a bis.

 =

[MB] I'm not sure on thi= s one, in particular given that it deprecates the header fields defined in = RFC 4474 (per section 8).  And, unlike other -bis specs there is no su= mmary section in this document of the differences between the two.  Also, currently this draft doesn't indicate what im= pact it has on 4474 in the header page. There is the sentence at the end of= section 1 stating that this document "revises RFC 4474" but that= 's not particularly meaningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwar= ds compatible with RFC 4244, I really think that this draft should be docum= ented as obsoleting RFC 4474. [/MB]


>The document is heavy with forward references.  These force the re= ader
>to stop what they are in the middle of, try to hold that place, and loo= k
>forward to understand what they've just been interrupted from reading.<= br> >As a literary style, forward references create useful tension.  In=
>specifications they just interrupt the flow.  The document should = be
>reorganization so that integrative text comes /after/ the text
>describing the pieces being integrated.  And opening overview, des= ign
>summary, or the like can give a non-normative description of the
>architecture and the service, so the reader has a basic sense of the bi= g
>picture, before diving into the detail of those to-be-integrated pieces= .


Dave does make a number of organizational suggestions about the spec. The spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is = however
unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions that seemed to me like a substantial improvement.

[MB] As another RFC 4244= example, we did find that moving the syntax early in the document in RFC 7= 044 made it more readable.  From a developer's perspective, I think it= 's helpful to have the syntax in mind as one reads all the details of the processing.[/MB]


Overall, there are a handful of changes (beyond the typos, which again are<= br> appreciated) I'd make based on the substance of Dave's review. Some of the<= br> suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.

[MB] I would 3rd the nee= d for examples.  That has been a usual practice for other RFCs definin= g new SIP header fields (and header field parameters). [/MB] 


In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the<= br> signature is correct, and that we have enough confidence that
intermediaries won't break it, and that when it is broken, the verifier
behavior makes sense. I think we've focused a lot of attention on those
questions, but I'm happy to talk more about that if people think there's room for improvement.

Also, he suggests that we might need a better pointer than RFC3986 Section<= br> 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead.

Otherwise, I think we've got this covered. Anyone who's interested in
further details can see the attached.

Jon Peterson
Neustar, Inc.


_______________________________________________
stir mailing list
stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

 =

 


This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message.

--_000_be3246a8cfdd45b9a2e8255f647dbcc0PLSWE13M08adsprintcom_-- From nobody Thu Aug 18 10:06:02 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B87E12DAC1 for ; Thu, 18 Aug 2016 10:06:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.988 X-Spam-Level: X-Spam-Status: No, score=-0.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bCiwk6fmtKKW for ; Thu, 18 Aug 2016 10:06:00 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2EEB12DA66 for ; Thu, 18 Aug 2016 10:05:59 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7IH66Ul014753 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 18 Aug 2016 10:06:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471539967; bh=/41cOVbe5l6n5tVLYc6nuYuV1MhtS3V+EbsFwkaaiVA=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=qTva6ixeZgM9GTLqvXYoC5a+ag+sPG9wxUNZFQ/3N6EhLG6tbS3FL27xK9Gl4fjA4 rHVUK6enJcfNtX6QswMqsdl3fNjuoIlw3MxZHZvuKEH9QwaFPh4uIk/EIl6Cov/929 RMv3+dJSVlCooIsITlKG6LM1sZZLRBFLYeTjTuR8= To: "Peterson, Jon" , "Gorman, Pierce A [CTO]" References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Thu, 18 Aug 2016 10:05:48 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 17:06:01 -0000 On 8/18/2016 9:48 AM, Peterson, Jon wrote: > Oh, we've allowed for multiple Identity headers for some time - the > problem is we don't really give any reason why we allow them or any > sense of what it might mean to have more than one. We need to say at > least something about that, though largely this is a matter of forward > compatibility with some future use cases that we know are under > consideration that we don't want to rule out. 1. In the abstract, there could be different identifiers that are authenticated. That's probably not supposed to be allowed for a SIP environment, but since there apparently can be different identifiers used as input to validation, perhaps it is allowed. 2. There can be different authorities used to create the authentication. This permits trust assessment of a combination of entities making validity assertions. 3. There can be different technical details to the signature. Different canonicalizations, different crypto algorithms, different keys. All of these might affect survival through transit and/or ability of the recipient to process. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 18 10:48:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92BDE12D733 for ; Thu, 18 Aug 2016 10:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NdVGE8gr4Bzu for ; Thu, 18 Aug 2016 10:47:12 -0700 (PDT) Received: from mail-ua0-x22a.google.com (mail-ua0-x22a.google.com [IPv6:2607:f8b0:400c:c08::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DEC212DAFE for ; Thu, 18 Aug 2016 10:45:14 -0700 (PDT) Received: by mail-ua0-x22a.google.com with SMTP id 97so40175120uav.3 for ; Thu, 18 Aug 2016 10:45:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=2LDD/LIku5y+2bvQfEO7ibbdzwHHZHvKIqHA2AYqk7w=; b=B1ZVIBewinHyfxZEeCK5Cqii8z3jqJpM0rl9e+5bnqWnLJ+OvmtAqJLoQOg46ALiu8 3med1uxvmderu2ja6szbSikCsUGbTKOf8V1jHTwKOSP2TsCeICMEJuDUwFZ+HJvhZtfR e/r5hW0j1ARowLnX0H1SoEIaAtDNf1oofCbWHW5oS7wZhOEsiTzUspTpTcSDPOYcjFiO 1HTyark99X61zGZMdqAgR8agpaQQ/4OY6af649LBgiEUbQfbSLcihhssGaTr6m91CGgf pwG2QDSA4WXGKjsNg1BZdz+5CB4xVtK+LnZZKVAXQWthwWRjiH6MphW+I8dz67TKEJYf 9KrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=2LDD/LIku5y+2bvQfEO7ibbdzwHHZHvKIqHA2AYqk7w=; b=NjzwHsCEfFRhaZS+JbzRIqfdZFcazk+Pc71gRhKTh5XjBe/30NyHqr5hcE2wylyzUX I6SJcL+JRXP7CXv20kM4oNuEONRtCAuQ1V1Oux+HPcFpvfLSrLHkQslxWqubDeKSMtil aoyhe0FZ6p/mEnhKnSQXbUmp6Kt68CrLXjwXr/46B5uI5wuaRtksCMoZ1CMJXw3493Tt RMv4LEJlzE7lvR0GP6R54zwiu5UV78TCoprdjwPUKJ6rD9wunS9F4I6AnrJrASDIUkGm IxFNrA5Ad6Wzaai3YEILMmsXXTnoQa+9LdLI+FP6xBbLlOn7Hcolwf5vK3rer/L16aUg PfRQ== X-Gm-Message-State: AEkoouuLZqbyXlEU8lG52GQMmsOZFceqVt5EKKkW0J2BYmL/rABcb1B/jj1/Xrw5FWMWXO3cX1oAKM+AIFDusg== X-Received: by 10.31.2.209 with SMTP id 200mr1506316vkc.58.1471542313460; Thu, 18 Aug 2016 10:45:13 -0700 (PDT) MIME-Version: 1.0 Received: by 10.176.82.184 with HTTP; Thu, 18 Aug 2016 10:44:52 -0700 (PDT) In-Reply-To: References: From: Bernard Aboba Date: Thu, 18 Aug 2016 10:44:52 -0700 Message-ID: To: Mary Barnes Content-Type: multipart/alternative; boundary=001a113f7f9cdda9e2053a5c24b8 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , "Peterson, Jon" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 17:47:33 -0000 X-List-Received-Date: Thu, 18 Aug 2016 17:47:33 -0000 --001a113f7f9cdda9e2053a5c24b8 Content-Type: text/plain; charset=UTF-8 Mary Barnes said: "I'm not sure on this one, in particular given that it deprecates the header fields defined in RFC 4474 (per section 8). And, unlike other -bis specs there is no summary section in this document of the differences between the two. Also, currently this draft doesn't indicate what impact it has on 4474 in the header page. There is the sentence at the end of section 1 stating that this document "revises RFC 4474" but that's not particularly meaningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with RFC 4244, I really think that this draft should be documented as obsoleting RFC 4474." [BA] Agree that the document should include Obsoletes: 4474 in the header. The Abstract and Introduction could also set the context somewhat better. Section 15 is a bit terse and could probably be expanded. However, if the context for RFC 4474bis is properly set, I don't think we need to go overboard on that. On Wed, Aug 17, 2016 at 12:03 PM, Mary Barnes wrote: > Jon, > > Thanks for responding to Dave's comments - I found that quite helpful. I > have some comments/responses below [MB]. As a caveat to my responses, I > did not read all the details in Dave's review. > > Regards, > Mary. > > On Sat, Aug 13, 2016 at 2:40 AM, Peterson, Jon > wrote: > >> >> I finally had a chance to go through these comments, and I did want to >> provide a few responses on Dave's review of rfc4474bis here. >> >> >Taken on its own and also when taken with its companion documents, the >> >specifications are confusing and incomplete. It is quite far from being >> >ready for publication. >> >> Having looked through Dave's specific concerns, I don't think he makes his >> case for this criticism. >> >> >Terminology is used inconsistently. It often is introduced with no >> >background or citation. Many uses of 'header' are probably supposed to >> >be 'header field'. My sense is that quite a bit of terminology is used >> >equally loosely. >> >> I think the use of terminology in the specification has proper background >> and citations. Certainly Dave is correct that the text is pretty lax with >> "header" vs. "header field" vs. "header field value," no denying that. If >> people think this is a big deal, I will fix it. But the suggestion that >> because this is true, terminology is loosely used to a point where it >> would hamper implementation, that I think his comments don't really >> substantiate. >> > > [MB] As pendantic as it might seem, in my experience, the expectation is > that we are precise with terminology in the specs, so that qualifying > 'header' as 'header field' and 'parameter' as 'header field parameter' is a > reasonable expectation. I've had to do that with the RFCs that I've > authored and in re-reading this document recently, I think it adds to the > readability/understanding in particular since the ABNF comes later. [/MB] > > >> >> >There is no integrative architectural description, so the reader has >> >difficulty understanding what all of the pieces are or how they fit >> >together. In fact is appears that the document itself gets confused on >> >this matter. >> >> I'm not sure what an "integrative architectural description" would entail, >> but there are a number of sections that provide overviews of operations >> and related examples of how the architectural piece come together. I don't >> think anything in the review comments genuinely substantiates that the >> document itself is confused about its own architecture. >> >> >Algorithms are all offered only as prose and often in a form mitigating >> >comprehension, such as tending towards negation or disjunction, which >> >humans process less well than affirmatives and conjunctions. From what I >> >can tell, the algorithms often are incomplete, but serious analysis is >> >difficult. >> >> Algorithms are offered in steps with normative language, if that's what >> you mean by "prose form". RFCs are typically composed of prose. The review >> does reveal some very striking views about specmanship and algorithms in >> particular which are foreign to my experience in the IETF. >> >> >The documents appear to rely on a reader's having quite a bit of prior >> >knowledge and are certainly not usable by an implementer who is not >> >already deeply embedded in the community that produced these >> >specifications. My impression is that being embedded won't suffice >> >either, both from my assessment of the documents' deficiencies and given >> >back-channel comments I have heard about the expectation of the work to >> >be done after these specifications are published. >> >> We do expect basic SIP literacy, and a willingness to follow references >> and read external specifications and sections that are cited. Readers that >> are unwilling to do this will probably find a lot of things confusing in >> there. >> > [MB] I think the challenge is that 'basic SIP literacy' isn't such a > basic thing anymore and it does require *a lot* of background to parse this > document, but I don't know a way around that. [/MB] > >> >> >Overall, the writing impedes comprehension and the document needs a very >> >diligent pass by a technical editor. I suspect this will uncover quite >> >a number of semantic deficiencies in the text. >> >> You did catch some good typos, and I caught a few more following your >> notes through the text. I'm not sure that yielded the semantic >> difficulties you speculate about here though. >> >> >There is a possible tendency to support more alternative behavior than >> >appropriate. Successful interoperability usually benefits from fewer >> >choices, not more. Common, mandatory canonicalization is an example. >> >> Common, mandatory canonicalization of telephone numbers is unfortunately >> only slightly more reliable than common, mandatory normalization of >> internationalized domain names. At least it's just numbers. The algorithm >> we have is good enough to cover the common operational case, and where it >> fails, hopefully "canon" will help to close the gap. >> >> >Credentials: the specification neither defines nor references a standard >> >for the specification of credentials, here. That means that the >> >technical details -- as distinct from the operational policies -- of >> >credentials are out of scope, although they are fundamental to proper >> >operation of this serve. This is a showstopper, in terms of >> >specification completeness for the service. >> >> Well, it does reference a standard for the specification of credentials: >> stir-certs. I agree it would be a showstopper if we didn't have the >> stir-certs work. >> >> >How is the recipient to know what credential 'standard' is used? How >> >does this ensure interoperability between two participants who have not >> >interacted before? >> >> There is in practice only one at the moment. I'm content to worry about >> interop problems when we have another one. >> >> >At base, these specifications appear intended to roughly chart out a >> >system structure, leaving most of the difficult work for later and >> >elsewhere. By way of example, there are few if any cross-organization >> >key management services on the Internet that demonstrate the utility >> >needed here. I am pretty sure that Web certs don't qualify. We know >> >that DKIM's operation does, of course. However DKIM strictly uses >> >domain names as identifiers and they conveniently align with their >> >administrative authorities, whereas telephone numbers do not... >> >> I'd say that, by design, rfc4474bis is pretty tightly confined to >> specifying the SIP over-the-wire protocol behavior. It takes a lot of spec >> just to do that. >> >> And your praise of DKIM as a model is once again noted. I would respond >> again that we are unlikely to abandon our years of work on this mechanism >> and switch to DKIM at this point, no matter how many comments you place in >> our path. >> >> > [[[ The mailing list just had an extensive regurgitation of >> >critical commentary about ENUM. What appears to be getting missed is >> >that whatever mechanism is going to be used for finding and validating >> >keys is going to have no operational history of reliability, safety or >> >efficacy. ]]] >> >> HTTP has none of those qualities, apparently. >> >> >There is remarkably little of the original RFC 4474 substance still in >> >this document. Calling it a bis is a bit like tearing all of a building >> >except its fireplace or its front door and calling that a remodeling. >> >The previous document does not have an installed base, so I strongly >> >suggest removing all references to it. It will allow some of the text >> >to be notably simpler and clearer. >> >> I think enough of the concepts and protocol mechanisms of the original are >> retained to warrant keeping this as a bis. >> > > [MB] I'm not sure on this one, in particular given that it deprecates the > header fields defined in RFC 4474 (per section 8). And, unlike other -bis > specs there is no summary section in this document of the differences > between the two. Also, currently this draft doesn't indicate what impact > it has on 4474 in the header page. There is the sentence at the end of > section 1 stating that this document "revises RFC 4474" but that's not > particularly meaningful. Given that when we produced RFC 7044, we obsoleted > RFC 4244 despite RFC 7044 being backwards compatible with RFC 4244, I > really think that this draft should be documented as obsoleting RFC 4474. > [/MB] > >> >> >The document is heavy with forward references. These force the reader >> >to stop what they are in the middle of, try to hold that place, and look >> >forward to understand what they've just been interrupted from reading. >> >As a literary style, forward references create useful tension. In >> >specifications they just interrupt the flow. The document should be >> >reorganization so that integrative text comes /after/ the text >> >describing the pieces being integrated. And opening overview, design >> >summary, or the like can give a non-normative description of the >> >architecture and the service, so the reader has a basic sense of the big >> >picture, before diving into the detail of those to-be-integrated pieces. >> >> >> Dave does make a number of organizational suggestions about the spec. The >> spec has an overview, a design summary, before it gets down to specifying >> things. The virtue of the "integrative" approach he describes is however >> unclear to me. I think whether you define the auth service behavior first >> or define the header syntax first, one of those sections is going to end >> up pointing to the other. There wasn't much in his reorg suggestions that >> seemed to me like a substantial improvement. >> > [MB] As another RFC 4244 example, we did find that moving the syntax early > in the document in RFC 7044 made it more readable. From a developer's > perspective, I think it's helpful to have the syntax in mind as one reads > all the details of the processing.[/MB] > >> >> Overall, there are a handful of changes (beyond the typos, which again are >> appreciated) I'd make based on the substance of Dave's review. Some of the >> suggestions to rename sections seem harmless to me. Like some other people >> who come to mind, he would like to see some more precise specification and >> examples of how you break off the signature from JWT. He pointed out that >> we really don't have any motivation for including multiple Identity >> headers in there, and we probably do need an indication of what future >> work might use that feature. >> > [MB] I would 3rd the need for examples. That has been a usual practice > for other RFCs defining new SIP header fields (and header field > parameters). [/MB] > >> >> In terms of topics for discussion that might warrant the attention of the >> working group, he did suggest we need to be sure we think the scope of the >> signature is correct, and that we have enough confidence that >> intermediaries won't break it, and that when it is broken, the verifier >> behavior makes sense. I think we've focused a lot of attention on those >> questions, but I'm happy to talk more about that if people think there's >> room for improvement. >> >> Also, he suggests that we might need a better pointer than RFC3986 Section >> 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows >> of one, I'd be happy to cite it instead. >> >> Otherwise, I think we've got this covered. Anyone who's interested in >> further details can see the attached. >> >> Jon Peterson >> Neustar, Inc. >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> >> > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > --001a113f7f9cdda9e2053a5c24b8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Mary Barnes said:=C2=A0

"I'm not sure on this one, in particular given t= hat it deprecates the header fields defined in RFC 4474 (per section 8).=C2= =A0 And, unlike other -bis specs there is no summary section in this docume= nt of the differences between the two.=C2=A0 Also, currently this draft doe= sn't indicate what impact it has on 4474 in the header page. There is t= he sentence at the end of section 1 stating that this document "revise= s RFC 4474" but that's not particularly meaningful. Given that whe= n we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwa= rds compatible with RFC 4244, I really think that this draft should be docu= mented as obsoleting RFC 4474."

[BA] = =C2=A0Agree that the document should include Obsoletes: 4474 in the header.= =C2=A0 The Abstract and Introduction could also set the context somewhat be= tter.=C2=A0

Section 15 is a bit terse and could pr= obably be expanded. However, if the context for RFC 4474bis is properly set= , I don't think we need to go overboard on that.=C2=A0

On Wed, Aug 17, 2016 a= t 12:03 PM, Mary Barnes <mary.ietf.barnes@gmail.com> wrote:
Jon,

Thanks for responding to Dave's comments - I found that quite = helpful.=C2=A0 I have some comments/responses below [MB].=C2=A0 As a caveat= to my responses, I did not read all the details in Dave's review. =C2= =A0

Regards,
Mary.

On Sat, Aug 13, = 2016 at 2:40 AM, Peterson, Jon <jon.peterson@neustar.biz> wrote:

I finally had a chance to go through these comments, and I did want to
provide a few responses on Dave's review of rfc4474bis here.

>Taken on its own and also when taken with its companion documents, the<= br> >specifications are confusing and incomplete.=C2=A0 It is quite far from= being
>ready for publication.

Having looked through Dave's specific concerns, I don't thin= k he makes his
case for this criticism.

>Terminology is used inconsistently. It often is introduced with no
>background or citation.=C2=A0 Many uses of 'header' are probabl= y supposed to
>be 'header field'.=C2=A0 My sense is that quite a bit of termin= ology is used
>equally loosely.

I think the use of terminology in the specification has proper backg= round
and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

[MB] As pendantic = as it might seem, in my experience, the expectation is that we are precise = with terminology in the specs, so that qualifying 'header' as '= header field' and 'parameter' as 'header field parameter= 9; is a reasonable expectation. I've had to do that with the RFCs that = I've authored and in re-reading this document recently, I think it adds= to the readability/understanding in particular since the ABNF comes later.= [/MB]
=C2=A0

>There is no integrative architectural description, so the reader has >difficulty understanding what all of the pieces are or how they fit
>together.=C2=A0 In fact is appears that the document itself gets confus= ed on
>this matter.

I'm not sure what an "integrative architectural description= " would entail,
but there are a number of sections that provide overviews of operations
and related examples of how the architectural piece come together. I don= 9;t
think anything in the review comments genuinely substantiates that the
document itself is confused about its own architecture.

>Algorithms are all offered only as prose and often in a form mitigating=
>comprehension, such as tending towards negation or disjunction, which >humans process less well than affirmatives and conjunctions. From what = I
>can tell, the algorithms often are incomplete, but serious analysis is<= br> >difficult.

Algorithms are offered in steps with normative language, if that'= ;s what
you mean by "prose form". RFCs are typically composed of prose. T= he review
does reveal some very striking views about specmanship and algorithms in particular which are foreign to my experience in the IETF.

>The documents appear to rely on a reader's having quite a bit of pr= ior
>knowledge and are certainly not usable by an implementer who is not
>already deeply embedded in the community that produced these
>specifications.=C2=A0 My impression is that being embedded won't su= ffice
>either, both from my assessment of the documents' deficiencies and = given
>back-channel comments I have heard about the expectation of the work to=
>be done after these specifications are published.

We do expect basic SIP literacy, and a willingness to follow referen= ces
and read external specifications and sections that are cited. Readers that<= br> are unwilling to do this will probably find a lot of things confusing in there.
[MB] =C2=A0I think the challenge is= that 'basic SIP literacy' isn't such a basic thing anymore and= it does require *a lot* of background to parse this document, but I don= 9;t know a way around that. [/MB]

>Overall, the writing impedes comprehension and the document needs a ver= y
>diligent pass by a technical editor.=C2=A0 I suspect this will uncover = quite
>a number of semantic deficiencies in the text.

You did catch some good typos, and I caught a few more following you= r
notes through the text. I'm not sure that yielded the semantic
difficulties you speculate about here though.

>There is a possible tendency to support more alternative behavior than<= br> >appropriate. Successful interoperability usually benefits from fewer >choices, not more.=C2=A0 Common, mandatory canonicalization is an examp= le.

Common, mandatory canonicalization of telephone numbers is unfortuna= tely
only slightly more reliable than common, mandatory normalization of
internationalized domain names. At least it's just numbers. The algorit= hm
we have is good enough to cover the common operational case, and where it fails, hopefully "canon" will help to close the gap.

>Credentials: the specification neither defines nor references a standar= d
>for the specification of credentials, here.=C2=A0 That means that the >technical details -- as distinct from the operational policies -- of >credentials are out of scope, although they are fundamental to proper >operation of this serve.=C2=A0 This is a showstopper, in terms of
>specification completeness for the service.

Well, it does reference a standard for the specification of credenti= als:
stir-certs. I agree it would be a showstopper if we didn't have the
stir-certs work.

>How is the recipient to know what credential 'standard' is used= ?=C2=A0 How
>does this ensure interoperability between two participants who have not=
>interacted before?

There is in practice only one at the moment. I'm content to worr= y about
interop problems when we have another one.

>At base, these specifications appear intended to roughly chart out a >system structure, leaving most of the difficult work for later and
>elsewhere.=C2=A0 By way of example, there are few if any cross-organiza= tion
>key management services on the Internet that demonstrate the utility >needed here.=C2=A0 I am pretty sure that Web certs don't qualify.= =C2=A0 We know
>that DKIM's operation does, of course.=C2=A0 However DKIM strictly = uses
>domain names as identifiers and they conveniently align with their
>administrative authorities, whereas telephone numbers do not...

I'd say that, by design, rfc4474bis is pretty tightly confined t= o
specifying the SIP over-the-wire protocol behavior. It takes a lot of spec<= br> just to do that.

And your praise of DKIM as a model is once again noted. I would respond
again that we are unlikely to abandon our years of work on this mechanism and switch to DKIM at this point, no matter how many comments you place in<= br> our path.

>=C2=A0 =C2=A0 =C2=A0 [[[ The mailing list just had an extensive regurgi= tation of
>critical commentary about ENUM.=C2=A0 What appears to be getting missed= is
>that whatever mechanism is going to be used for finding and validating<= br> >keys is going to have no operational history of reliability, safety or<= br> >efficacy. ]]]

HTTP has none of those qualities, apparently.

>There is remarkably little of the original RFC 4474 substance still in<= br> >this document.=C2=A0 Calling it a bis is a bit like tearing all of a bu= ilding
>except its fireplace or its front door and calling that a remodeling. >The previous document does not have an installed base, so I strongly >suggest removing all references to it.=C2=A0 It will allow some of the = text
>to be notably simpler and clearer.

I think enough of the concepts and protocol mechanisms of the origin= al are
retained to warrant keeping this as a bis.

<= /div>
[MB] I'm not sure on this one, in particular given that= it deprecates the header fields defined in RFC 4474 (per section 8).=C2=A0= And, unlike other -bis specs there is no summary section in this document = of the differences between the two.=C2=A0 Also, currently this draft doesn&= #39;t indicate what impact it has on 4474 in the header page. There is the = sentence at the end of section 1 stating that this document "revises R= FC 4474" but that's not particularly meaningful. Given that when w= e produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards= compatible with RFC 4244, I really think that this draft should be documen= ted as obsoleting RFC 4474. [/MB]

>The document is heavy with forward references.=C2=A0 These force the re= ader
>to stop what they are in the middle of, try to hold that place, and loo= k
>forward to understand what they've just been interrupted from readi= ng.
>As a literary style, forward references create useful tension.=C2=A0 In=
>specifications they just interrupt the flow.=C2=A0 The document should = be
>reorganization so that integrative text comes /after/ the text
>describing the pieces being integrated.=C2=A0 And opening overview, des= ign
>summary, or the like can give a non-normative description of the
>architecture and the service, so the reader has a basic sense of the bi= g
>picture, before diving into the detail of those to-be-integrated pieces= .


Dave does make a number of organizational suggestions about the spec= . The
spec has an overview, a design summary, before it gets down to specifying things. The virtue of the "integrative" approach he describes is = however
unclear to me. I think whether you define the auth service behavior first or define the header syntax first, one of those sections is going to end up pointing to the other. There wasn't much in his reorg suggestions th= at
seemed to me like a substantial improvement.
[M= B] As another RFC 4244 example, we did find that moving the syntax early in= the document in RFC 7044 made it more readable.=C2=A0 From a developer'= ;s perspective, I think it's helpful to have the syntax in mind as one = reads all the details of the processing.[/MB]

Overall, there are a handful of changes (beyond the typos, which again are<= br> appreciated) I'd make based on the substance of Dave's review. Some= of the
suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.
[MB] I would 3rd t= he need for examples.=C2=A0 That has been a usual practice for other RFCs d= efining new SIP header fields (and header field parameters). [/MB]=C2=A0

In terms of topics for discussion that might warrant the attention of the working group, he did suggest we need to be sure we think the scope of the<= br> signature is correct, and that we have enough confidence that
intermediaries won't break it, and that when it is broken, the verifier=
behavior makes sense. I think we've focused a lot of attention on those=
questions, but I'm happy to talk more about that if people think there&= #39;s
room for improvement.

Also, he suggests that we might need a better pointer than RFC3986 Section<= br> 6.2.2 for URI normalization procedures. If anyone (including Dave!) knows of one, I'd be happy to cite it instead.

Otherwise, I think we've got this covered. Anyone who's interested = in
further details can see the attached.

Jon Peterson
Neustar, Inc.


_____________________________________________= __
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir



_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


--001a113f7f9cdda9e2053a5c24b8-- From nobody Thu Aug 18 10:54:25 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0302F12D733 for ; Thu, 18 Aug 2016 10:54:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z2FWlsbkUtBP for ; Thu, 18 Aug 2016 10:53:36 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88CE712DB28 for ; Thu, 18 Aug 2016 10:51:27 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7IHhIgu021717; Thu, 18 Aug 2016 13:51:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=pTtqUkOtNP9kXPtWnbpjm8Nfk7FtGcgxBrRUyViozoM=; b=hYtax1rs4mlclpogkUh1MFqM0FppP2jNVal5AsmvPGGR0QLfKDzzeIs6VebcuFyiJ0XZ eQIY9uqAT/t32YA3q4dDTVxuw6m/3FyN9Nwg+bXpW9Rq6ID5zES8Pty+lzEdfJwkAEeg OjpGMCM++Am8/27BT8Ueh0Uw6Sogw5xGZb37kbWC2ok7iLLPx8vDQyGE563lYKr0+OV9 T5ThcKV1p6xeo8+ekGqM8To9GhUkx+pehPB8qf359jpslWpqNv7RGL+DQ+3g/sKqEHLc TOocQ2mcuvzhq8Q3JatE5f2Cb29y+OK2PLDmKjEroVH5xViFmd9DE4EnR/TFxTaX/NcD Rw== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24vs8tm2kc-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 18 Aug 2016 13:51:25 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Thu, 18 Aug 2016 13:51:24 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , "Gorman, Pierce A [CTO]" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBGVbYAgAd9kQCAAC4aAIAAyRaAgAB6PQD//5dgAA== Date: Thu, 18 Aug 2016 17:51:24 +0000 Message-ID: References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.89] Content-Type: text/plain; charset="us-ascii" Content-ID: <2B6F41CCB2B1234DAAB396FE381F7E13@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-18_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608180230 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 17:54:11 -0000 The most common uses we envision look like 2 or 3: either cases where some specialized authority signs for an identity, one who is not necessarily an authority for the telephone number in question but will be trusted by relying parties for some other reason; or cases where you are adding some new field to the scope of protection, like say the display-name or some non-SIP field. But yes, 1 could also be the case for some of the interworking with WebRTC IdPs we've considered. For the purposes of this spec, though, we just want some very high-level motivation. Jon Peterson Neustar, Inc. On 8/18/16, 10:05 AM, "stir on behalf of Dave Crocker" wrote: >On 8/18/2016 9:48 AM, Peterson, Jon wrote: >> Oh, we've allowed for multiple Identity headers for some time - the >> problem is we don't really give any reason why we allow them or any >> sense of what it might mean to have more than one. We need to say at >> least something about that, though largely this is a matter of forward >> compatibility with some future use cases that we know are under >> consideration that we don't want to rule out. > > >1. In the abstract, there could be different identifiers that are >authenticated. That's probably not supposed to be allowed for a SIP >environment, but since there apparently can be different identifiers >used as input to validation, perhaps it is allowed. > >2. There can be different authorities used to create the authentication. >This permits trust assessment of a combination of entities making >validity assertions. > >3. There can be different technical details to the signature. Different >canonicalizations, different crypto algorithms, different keys. All of >these might affect survival through transit and/or ability of the >recipient to process. > >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Thu Aug 18 11:07:09 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97C4512D97E for ; Thu, 18 Aug 2016 11:07:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lOB5FdLlQX3I for ; Thu, 18 Aug 2016 11:07:05 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9162712DA38 for ; Thu, 18 Aug 2016 10:58:32 -0700 (PDT) X-AuditID: c1b4fb30-ad3ff700000009f9-79-57b5f7467a7a Received: from ESESSHC006.ericsson.se (Unknown_Domain [153.88.183.36]) by (Symantec Mail Security) with SMTP id F7.E3.02553.647F5B75; Thu, 18 Aug 2016 19:58:31 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC006.ericsson.se ([153.88.183.36]) with mapi id 14.03.0301.000; Thu, 18 Aug 2016 19:58:29 +0200 From: Christer Holmberg To: "Peterson, Jon" , Mary Barnes Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fClJR3BIvXI5kmNHREQUzAfuKBGZn4AgAcINACAAWsOAIAANc6w Date: Thu, 18 Aug 2016 17:58:28 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC231EA@ESESSMB209.ericsson.se> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BC231EAESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprDIsWRmVeSWpSXmKPExsUyM2K7iq77963hBvfCLc40WFp83r+f2WL5 2m1MDsweO2fdZfdYsuQnk8eOhufMAcxRXDYpqTmZZalF+nYJXBl3rrxgLji1iLGideVpxgbG nT2MXYycHBICJhKzv09m6mLk4hASWM8ocfDQd7CEkMASRom2Gd5djBwcbAIWEt3/tEHCIgJR EmuO7WYHCTMLKEv8220PYgoL2EjsfiAJUWEr8ePBRzYI201iddcfZhCbRUBVYv3OO0wgNq+A r8S67zOhtj5glLj55C8LSIJTwFzi3KZNYBcwCohJfD+1BqyBWUBc4taT+UwQJwtILNlznhnC FpV4+fgfK4StJNG45AkrRH2+xKfts9khlglKnJz5hGUCo8gsJKNmISmbhaQMIq4jsWD3JzYI W1ti2cLXzDD2mQOPmZDFFzCyr2IULU4tTspNNzLSSy3KTC4uzs/Ty0st2cQIjLODW34b7GB8 +dzxEKMAB6MSD2/C/q3hQqyJZcWVuYcYJTiYlUR4H70DCvGmJFZWpRblxxeV5qQWH2KU5mBR Euf1f6kYLiSQnliSmp2aWpBaBJNl4uCUamBcrje3+pivUP/q8swovwv9S148uf+payvLvZUH ksJ2zdrp3PbsWEhZJVO3iWVbZ8uxpSYLN1yL+HVoEfOa33KL+23PbuZRMfVbMOOXxJQLljsX 7px29ncAG9P7jze+rb4cvsD3jptBoQrDqXWz5T4uZU24LmTPHTpfXsgranmZPWu+hfyf2dO4 lFiKMxINtZiLihMBOfDYMK8CAAA= Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 18:07:07 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BC231EAESESSMB209erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, >From my experience as GenART reviewer, I can say that usage of consistent t= erminology is something that the whole IETF suffers from. But, it's getting= better :) There are also cases where we DO use consistent terminology, but where peop= le have a different understanding of what it means. "Codec" is a very good = (and unfortunately very often occurring) example. So, while the authors, or= even everyone in the WG, have a common understanding of what something mea= ns, we need to make sure others will too. Regards, Christer From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: 18 August 2016 19:43 To: Mary Barnes Cc: stir@ietf.org Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Hi Mary, I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field value," no denying that. If people think this is a big deal, I will fix it. But the suggestion that because this is true, terminology is loosely used to a point where it would hamper implementation, that I think his comments don't really substantiate. [MB] As pendantic as it might seem, in my experience, the expectation is th= at we are precise with terminology in the specs, so that qualifying 'header= ' as 'header field' and 'parameter' as 'header field parameter' is a reason= able expectation. I've had to do that with the RFCs that I've authored and = in re-reading this document recently, I think it adds to the readability/un= derstanding in particular since the ABNF comes later. [/MB] If people really feel like it needs to be fixed, I can fix it - but I do fe= el justified in pointing out that our track record with this in SIP documen= ts isn't real strong. The original RFC4474 used "header" informally quite a= bit. So does RFC4244, actually, if you scroll through that. So does the Re= places header spec. So I'm not sure we really do have much of an expectatio= n about being precise with this. The reason why, I imagine, is because the = common and casual way we use it isn't actually ambiguous - no one who sees = the phrase "Date header" is confused about whether we mean a header or a he= ader field. But like I said, it isn't a huge deal to fix it - it's just that any pervas= ive edits like this can give rise to errors, and it's not clear that fixing= this solves any real problem. I think enough of the concepts and protocol mechanisms of the original are retained to warrant keeping this as a bis. [MB] I'm not sure on this one, in particular given that it deprecates the h= eader fields defined in RFC 4474 (per section 8). And, unlike other -bis s= pecs there is no summary section in this document of the differences betwee= n the two. Also, currently this draft doesn't indicate what impact it has = on 4474 in the header page. There is the sentence at the end of section 1 s= tating that this document "revises RFC 4474" but that's not particularly me= aningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despi= te RFC 7044 being backwards compatible with RFC 4244, I really think that t= his draft should be documented as obsoleting RFC 4474. [/MB] There is a summary of changes in the document; it's Section 15 "Changes fro= m RFC4474". And well, the bis doesn't deprecate both the headers as such, i= t deprecates one header field and changes the syntax of the other. But more= importantly, it keeps all the guts: the concept of an authentication and v= erification service, all the response codes, all the associated SIP behavio= r. The only real semantic change is the scope of protection of the signatur= e itself, which has been reduced overall, and then with respects to the ide= ntities in particular has been honed to deal with telephone numbers better.= Obsoleting the Identity-Info header and moving it into an "info" parameter= of the Identity header is a just a syntactic change. Although we created s= ome architectural modularity around credentials, the stir-certs mechanism s= till has the same properties as certs did in the original architecture. All= owing the Identity header to appear multiple times just removes a limitatio= n in the original spec that doesn't seem useful in retrospect (and the way = Identity-Info was originally done didn't allow it) rather than a change to = how the header is to be understood. All that said, I do agree it probably should obsolete RFC4474, not merely u= pdate it. Or at least that's how I remember the process is supposed to work= . I'll defer to chairs/Ads on this one. Overall, there are a handful of changes (beyond the typos, which again are appreciated) I'd make based on the substance of Dave's review. Some of the suggestions to rename sections seem harmless to me. Like some other people who come to mind, he would like to see some more precise specification and examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity headers in there, and we probably do need an indication of what future work might use that feature. [MB] I would 3rd the need for examples. That has been a usual practice for= other RFCs defining new SIP header fields (and header field parameters). [= /MB] There will be more examples! Jon Peterson Neustar, Inc. --_000_7594FB04B1934943A5C02806D1A2204B4BC231EAESESSMB209erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 = ;

From my ex= perience as GenART reviewer, I can say that usage of consistent terminology= is something that the whole IETF suffers from. But, it’s getting better :)

 = ;

There are = also cases where we DO use consistent terminology, but where people have a = different understanding of what it means. “Codec” is a very good (and unfortunately very often occurring) example. So, while= the authors, or even everyone in the WG, have a common understanding of wh= at something means, we need to make sure others will too.=

 = ;

Regards,

 = ;

Christer

 

From: = stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon
Sent: 18 August 2016 19:43
To: Mary Barnes <mary.ietf.barnes@gmail.com>
Cc: stir@ietf.org
Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10

 

Hi Mary,

 

I think the use of terminology in the s= pecification has proper background
and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

 

[MB] As pendantic as it might seem, in = my experience, the expectation is that we are precise with terminology in t= he specs, so that qualifying 'header' as 'header field' and 'parameter' as 'header field parameter' is a reasonable expecta= tion. I've had to do that with the RFCs that I've authored and in re-readin= g this document recently, I think it adds to the readability/understanding = in particular since the ABNF comes later. [/MB]

 

If people really feel like it needs to = be fixed, I can fix it - but I do feel justified in pointing out that our t= rack record with this in SIP documents isn't real strong. The original RFC4474 used "header" informally quite a bi= t. So does RFC4244, actually, if you scroll through that. So does the Repla= ces header spec. So I'm not sure we really do have much of an expectation a= bout being precise with this. The reason why, I imagine, is because the common and casual way we use it isn't actually a= mbiguous - no one who sees the phrase "Date header" is confused a= bout whether we mean a header or a header field.

 

But like I said, it isn't a huge deal t= o fix it - it's just that any pervasive edits like this can give rise to er= rors, and it's not clear that fixing this solves any real problem.

 

<snip>

I think enough of the concepts and prot= ocol mechanisms of the original are
retained to warrant keeping this as a bis.

 

[MB] I'm not sure on this one, in parti= cular given that it deprecates the header fields defined in RFC 4474 (per s= ection 8).  And, unlike other -bis specs there is no summary section in this document of the differences between the two.=   Also, currently this draft doesn't indicate what impact it has on 44= 74 in the header page. There is the sentence at the end of section 1 statin= g that this document "revises RFC 4474" but that's not particularly meaningful. Given that when we produced RFC 70= 44, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with = RFC 4244, I really think that this draft should be documented as obsoleting= RFC 4474. [/MB]

 

There is a summary of changes in the do= cument; it's Section 15 "Changes from RFC4474". And well, the bis= doesn't deprecate both the headers as such, it deprecates one header field and changes the syntax of the other. But more importantly= , it keeps all the guts: the concept of an authentication and verification = service, all the response codes, all the associated SIP behavior. The only = real semantic change is the scope of protection of the signature itself, which has been reduced overall, and= then with respects to the identities in particular has been honed to deal = with telephone numbers better. Obsoleting the Identity-Info header and movi= ng it into an "info" parameter of the Identity header is a just a syntactic change. Although we created some= architectural modularity around credentials, the stir-certs mechanism stil= l has the same properties as certs did in the original architecture. Allowi= ng the Identity header to appear multiple times just removes a limitation in the original spec that doesn't= seem useful in retrospect (and the way Identity-Info was originally done d= idn't allow it) rather than a change to how the header is to be understood.=

 

All that said, I do agree it probably s= hould obsolete RFC4474, not merely update it. Or at least that's how I reme= mber the process is supposed to work. I'll defer to chairs/Ads on this one.

 

Overall, there are a handful of changes= (beyond the typos, which again are
appreciated) I'd make based on the substance of Dave's review. Some of the<= br> suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.

[MB] I would 3rd the need for examples.=   That has been a usual practice for other RFCs defining new SIP heade= r fields (and header field parameters). [/MB] 

 

There will be more examples!=

 

Jon Peterson

Neustar, Inc.

--_000_7594FB04B1934943A5C02806D1A2204B4BC231EAESESSMB209erics_-- From nobody Thu Aug 18 11:19:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8D0312D830 for ; Thu, 18 Aug 2016 11:19:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D2SG4cP0wf4V for ; Thu, 18 Aug 2016 11:19:54 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 867D312D8F9 for ; Thu, 18 Aug 2016 11:19:51 -0700 (PDT) X-AuditID: c1b4fb30-ea88e980000009f9-a7-57b5fc45d2fa Received: from ESESSHC020.ericsson.se (Unknown_Domain [153.88.183.78]) by (Symantec Mail Security) with SMTP id AA.06.02553.54CF5B75; Thu, 18 Aug 2016 20:19:49 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC020.ericsson.se ([153.88.183.78]) with mapi id 14.03.0301.000; Thu, 18 Aug 2016 20:19:11 +0200 From: Christer Holmberg To: Christer Holmberg , "Peterson, Jon" , Mary Barnes Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fClJR3BIvXI5kmNHREQUzAfuKBGZn4AgAcINACAAWsOAIAANc6wgAAGdvA= Date: Thu, 18 Aug 2016 18:19:11 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC2338A@ESESSMB209.ericsson.se> References: <7594FB04B1934943A5C02806D1A2204B4BC231EA@ESESSMB209.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BC231EA@ESESSMB209.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BC2338AESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLIsWRmVeSWpSXmKPExsUyM2K7n67rn63hBqe+W1ucabC0+Lx/P7PF 8rXbmByYPXbOusvusWTJTyaPHQ3PmQOYo7hsUlJzMstSi/TtErgyenZfYCs4MJux4t6vo0wN jDvbGLsYOTkkBEwk/j5/zg5iCwmsZ5T4+LGwi5ELyF7CKHHgVBtTFyMHB5uAhUT3P22QuIhA H6PElO5fjCBxZgFliX+77UFMYQEbid0PJEHGiAjYSvx48JENwvaT2HHlOiuIzSKgKvHt5UQW EJtXwFfi98m3bBBrlzBJ/JhpCGJzAtWf3DcdLM4oICbx/dQaJhCbWUBc4taT+UwQJwtILNlz nhnCFpV4+fgfK4StJNG45AkrRH2+xIqJq6B2CUqcnPmEZQKjyCwko2YhKZuFpAwiriOxYPcn NghbW2LZwtfMMPaZA4+ZkMUXMLKvYhQtTi1Oyk03MtJLLcpMLi7Oz9PLSy3ZxAiMtINbfhvs YHz53PEQowAHoxIPb8L+reFCrIllxZW5hxglOJiVRHgfvQMK8aYkVlalFuXHF5XmpBYfYpTm YFES5/V/qRguJJCeWJKanZpakFoEk2Xi4JRqYKySTdjvtfGaRKF0yI6TjWHcgU8cM+2Pz1o/ d9+lU4Vxi3ZM2ZIr2ZLxv06jM3rOcZbjEfxfLu3iPXuUzex19yRt84PBD4VKbbmP9Oak2dut mLLgWLjdfV2dA+u+5xpY80om1sR9/Lzm8muuO69NbYXuJ3I8Xbhu2wHuVfdEd3pqf30w/85u 9wolluKMREMt5qLiRACMof5OsAIAAA== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 18:19:58 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BC2338AESESSMB209erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable >From my experience as GenART reviewer, I can say that usage of consistent = >terminology is something that the whole IETF suffers from. But, it's getti= ng better :) The usage of inconsistent terminology, that is. From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: 18 August 2016 19:43 To: Mary Barnes > Cc: stir@ietf.org Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Hi Mary, I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field value," no denying that. If people think this is a big deal, I will fix it. But the suggestion that because this is true, terminology is loosely used to a point where it would hamper implementation, that I think his comments don't really substantiate. [MB] As pendantic as it might seem, in my experience, the expectation is th= at we are precise with terminology in the specs, so that qualifying 'header= ' as 'header field' and 'parameter' as 'header field parameter' is a reason= able expectation. I've had to do that with the RFCs that I've authored and = in re-reading this document recently, I think it adds to the readability/un= derstanding in particular since the ABNF comes later. [/MB] If people really feel like it needs to be fixed, I can fix it - but I do fe= el justified in pointing out that our track record with this in SIP documen= ts isn't real strong. The original RFC4474 used "header" informally quite a= bit. So does RFC4244, actually, if you scroll through that. So does the Re= places header spec. So I'm not sure we really do have much of an expectatio= n about being precise with this. The reason why, I imagine, is because the = common and casual way we use it isn't actually ambiguous - no one who sees = the phrase "Date header" is confused about whether we mean a header or a he= ader field. But like I said, it isn't a huge deal to fix it - it's just that any pervas= ive edits like this can give rise to errors, and it's not clear that fixing= this solves any real problem. I think enough of the concepts and protocol mechanisms of the original are retained to warrant keeping this as a bis. [MB] I'm not sure on this one, in particular given that it deprecates the h= eader fields defined in RFC 4474 (per section 8). And, unlike other -bis s= pecs there is no summary section in this document of the differences betwee= n the two. Also, currently this draft doesn't indicate what impact it has = on 4474 in the header page. There is the sentence at the end of section 1 s= tating that this document "revises RFC 4474" but that's not particularly me= aningful. Given that when we produced RFC 7044, we obsoleted RFC 4244 despi= te RFC 7044 being backwards compatible with RFC 4244, I really think that t= his draft should be documented as obsoleting RFC 4474. [/MB] There is a summary of changes in the document; it's Section 15 "Changes fro= m RFC4474". And well, the bis doesn't deprecate both the headers as such, i= t deprecates one header field and changes the syntax of the other. But more= importantly, it keeps all the guts: the concept of an authentication and v= erification service, all the response codes, all the associated SIP behavio= r. The only real semantic change is the scope of protection of the signatur= e itself, which has been reduced overall, and then with respects to the ide= ntities in particular has been honed to deal with telephone numbers better.= Obsoleting the Identity-Info header and moving it into an "info" parameter= of the Identity header is a just a syntactic change. Although we created s= ome architectural modularity around credentials, the stir-certs mechanism s= till has the same properties as certs did in the original architecture. All= owing the Identity header to appear multiple times just removes a limitatio= n in the original spec that doesn't seem useful in retrospect (and the way = Identity-Info was originally done didn't allow it) rather than a change to = how the header is to be understood. All that said, I do agree it probably should obsolete RFC4474, not merely u= pdate it. Or at least that's how I remember the process is supposed to work= . I'll defer to chairs/Ads on this one. Overall, there are a handful of changes (beyond the typos, which again are appreciated) I'd make based on the substance of Dave's review. Some of the suggestions to rename sections seem harmless to me. Like some other people who come to mind, he would like to see some more precise specification and examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity headers in there, and we probably do need an indication of what future work might use that feature. [MB] I would 3rd the need for examples. That has been a usual practice for= other RFCs defining new SIP header fields (and header field parameters). [= /MB] There will be more examples! Jon Peterson Neustar, Inc. --_000_7594FB04B1934943A5C02806D1A2204B4BC2338AESESSMB209erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 = ;

>From m= y experience as GenART reviewer, I can say that usage of consistent >ter= minology is something that the whole IETF suffers from. But, it’s getting better :)

 = ;

The usage = of inconsistent terminology, that is.

 = ;

 = ;

From: = stir [mailto:stir-bounces@ietf.org= ] On Behalf Of Peterson, Jon
Sent: 18 August 2016 19:43
To: Mary Barnes <ma= ry.ietf.barnes@gmail.com>
Cc: stir@ietf.org
Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10

 

Hi Mary,

 

I think the use of terminology in the s= pecification has proper background
and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

 

[MB] As pendantic as it might seem, in = my experience, the expectation is that we are precise with terminology in t= he specs, so that qualifying 'header' as 'header field' and 'parameter' as 'header field parameter' is a reasonable expecta= tion. I've had to do that with the RFCs that I've authored and in re-readin= g this document recently, I think it adds to the readability/understanding = in particular since the ABNF comes later. [/MB]

 

If people really feel like it needs to = be fixed, I can fix it - but I do feel justified in pointing out that our t= rack record with this in SIP documents isn't real strong. The original RFC4474 used "header" informally quite a bi= t. So does RFC4244, actually, if you scroll through that. So does the Repla= ces header spec. So I'm not sure we really do have much of an expectation a= bout being precise with this. The reason why, I imagine, is because the common and casual way we use it isn't actually a= mbiguous - no one who sees the phrase "Date header" is confused a= bout whether we mean a header or a header field.

 

But like I said, it isn't a huge deal t= o fix it - it's just that any pervasive edits like this can give rise to er= rors, and it's not clear that fixing this solves any real problem.

 

<snip>

I think enough of the concepts and prot= ocol mechanisms of the original are
retained to warrant keeping this as a bis.

 

[MB] I'm not sure on this one, in parti= cular given that it deprecates the header fields defined in RFC 4474 (per s= ection 8).  And, unlike other -bis specs there is no summary section in this document of the differences between the two.=   Also, currently this draft doesn't indicate what impact it has on 44= 74 in the header page. There is the sentence at the end of section 1 statin= g that this document "revises RFC 4474" but that's not particularly meaningful. Given that when we produced RFC 70= 44, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with = RFC 4244, I really think that this draft should be documented as obsoleting= RFC 4474. [/MB]

 

There is a summary of changes in the do= cument; it's Section 15 "Changes from RFC4474". And well, the bis= doesn't deprecate both the headers as such, it deprecates one header field and changes the syntax of the other. But more importantly= , it keeps all the guts: the concept of an authentication and verification = service, all the response codes, all the associated SIP behavior. The only = real semantic change is the scope of protection of the signature itself, which has been reduced overall, and= then with respects to the identities in particular has been honed to deal = with telephone numbers better. Obsoleting the Identity-Info header and movi= ng it into an "info" parameter of the Identity header is a just a syntactic change. Although we created some= architectural modularity around credentials, the stir-certs mechanism stil= l has the same properties as certs did in the original architecture. Allowi= ng the Identity header to appear multiple times just removes a limitation in the original spec that doesn't= seem useful in retrospect (and the way Identity-Info was originally done d= idn't allow it) rather than a change to how the header is to be understood.=

 

All that said, I do agree it probably s= hould obsolete RFC4474, not merely update it. Or at least that's how I reme= mber the process is supposed to work. I'll defer to chairs/Ads on this one.

 

Overall, there are a handful of changes= (beyond the typos, which again are
appreciated) I'd make based on the substance of Dave's review. Some of the<= br> suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.

[MB] I would 3rd the need for examples.=   That has been a usual practice for other RFCs defining new SIP heade= r fields (and header field parameters). [/MB] 

 

There will be more examples!=

 

Jon Peterson

Neustar, Inc.

--_000_7594FB04B1934943A5C02806D1A2204B4BC2338AESESSMB209erics_-- From nobody Thu Aug 18 14:15:22 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 576A912D6AF for ; Thu, 18 Aug 2016 14:15:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.699 X-Spam-Level: X-Spam-Status: No, score=-102.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BzGROj8jgmg6 for ; Thu, 18 Aug 2016 14:15:18 -0700 (PDT) Received: from mail-oi0-x22f.google.com (mail-oi0-x22f.google.com [IPv6:2607:f8b0:4003:c06::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B4D712D612 for ; Thu, 18 Aug 2016 14:15:18 -0700 (PDT) Received: by mail-oi0-x22f.google.com with SMTP id f189so39216269oig.3 for ; Thu, 18 Aug 2016 14:15:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=0N3///HNmkbv/oJ051G30z+dVas2aAh7ArarqDBi3Go=; b=h2J1l0eDxJukShHczGxUtFY0SPdZEeebd6p21USmq+c9D/k+ikUg51wmLFxIvWEP7T N5/biO99df0wUQkWqHE8Ogfb3PvZMWe9f13ZBqaBP/tl4RGe8f55TP3JFISNjbE3tuYr TECJtdMJWYGqUV7W/23FDNT9KD8vf7V0wCq9OrrxLKiGtdosE1foBrfkVX+xV/EPg82F NQADQKe+eLV1u4spGJ+Ffy6LD9eIFh4GqcszbzxAwd99Vkqj8PACuC1k3843CtLQo22A dd78HsGDEWJsIBQr/EmRX86U1/62sQFjBnTBWfj38zNNCEnG3FwSlh3n63YEIZPImCo+ HrrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=0N3///HNmkbv/oJ051G30z+dVas2aAh7ArarqDBi3Go=; b=U++dG8RLgvkicJnygkVv6sytVUJ99zZxYsHMzQFWVjffSCYltLAfhdogC9hH+SO28n XWdZK0ZcCGzasx1O14Lu2b0cry6Nf01NI3D1BkOxM5I4THVPR4H92iJB0CnoHkFPPoOS OjT+ssvbHBsXXuiRjNHXT89Bvis3FxOyi6mCt8qexJQXC5LLNATj5tsuj5tQINHBQmZl cumK4BbV17E1ub2S9th9h+aH8PfwdFirywW1luhJUmCoWwswGUA3QvWAK/YAfldeNnd1 gasz8/ZPNn/9HLYWBgzC1JwtSH6jEfqrr/8mlBIIuVUcAkYYncbZIgxtKdorDew25JkE wY6Q== X-Gm-Message-State: AEkoousRNikJiuZAPO9Q7fiz8darSnpM21H6RU+m3sxvLPbSRVxqPcQOdzhMG481h3rBcIKiTd/7Lx8PVR7fgg== X-Received: by 10.202.102.98 with SMTP id a95mr2514547oic.77.1471554917866; Thu, 18 Aug 2016 14:15:17 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.47.70 with HTTP; Thu, 18 Aug 2016 14:15:16 -0700 (PDT) In-Reply-To: References: From: Mary Barnes Date: Thu, 18 Aug 2016 16:15:16 -0500 Message-ID: To: "Peterson, Jon" Content-Type: multipart/alternative; boundary=001a114100e825a211053a5f1460 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 21:15:21 -0000 --001a114100e825a211053a5f1460 Content-Type: text/plain; charset=UTF-8 Hi Jon, More responses inline below [MB]. Mary. On Thu, Aug 18, 2016 at 11:43 AM, Peterson, Jon wrote: > Hi Mary, > > I think the use of terminology in the specification has proper background >> and citations. Certainly Dave is correct that the text is pretty lax with >> "header" vs. "header field" vs. "header field value," no denying that. If >> people think this is a big deal, I will fix it. But the suggestion that >> because this is true, terminology is loosely used to a point where it >> would hamper implementation, that I think his comments don't really >> substantiate. >> > > [MB] As pendantic as it might seem, in my experience, the expectation is > that we are precise with terminology in the specs, so that qualifying > 'header' as 'header field' and 'parameter' as 'header field parameter' is a > reasonable expectation. I've had to do that with the RFCs that I've > authored and in re-reading this document recently, I think it adds to the > readability/understanding in particular since the ABNF comes later. [/MB] > > > If people really feel like it needs to be fixed, I can fix it - but I do > feel justified in pointing out that our track record with this in SIP > documents isn't real strong. The original RFC4474 used "header" informally > quite a bit. So does RFC4244, actually, if you scroll through that. So does > the Replaces header spec. So I'm not sure we really do have much of an > expectation about being precise with this. The reason why, I imagine, is > because the common and casual way we use it isn't actually ambiguous - no > one who sees the phrase "Date header" is confused about whether we mean a > header or a header field. > [MB] I don't disagree in general and specifically about RFC 4244, but we went to a fair amount of effort for 4244bis (i.e., RFC 7044) to be more precise and I do believe it improves readability and makes it more understandable on a first read, in particular for folks that haven't been involved in SIP standardization for 20 years. Also, given the ordering of the sections (i.e., ABNF towards the end), I find it really helps for "canon" and "ppt" to be qualified as "header field parameters". [/MB] > > But like I said, it isn't a huge deal to fix it - it's just that any > pervasive edits like this can give rise to errors, and it's not clear that > fixing this solves any real problem. > [MB] I don't disagree that there is a risk of introducing errors, but I think, while tedious, this change is fairly straightforward in doing a find and replaces (I personally usually don't do global changes as I'd rather eyeball things to avoid the possibility of introducing the sorts of errors you note). Also, per Christer's later comment, I do think making the spec more readable will be helpful for the gen-art reviewer. My personal preference is to fix things in the WG as it avoids others raising similar issues down the road. Of course, as you note, if I'm the only one that has this concern, then fine. [/MB] > > > > I think enough of the concepts and protocol mechanisms of the original are >> retained to warrant keeping this as a bis. >> > > [MB] I'm not sure on this one, in particular given that it deprecates the > header fields defined in RFC 4474 (per section 8). And, unlike other -bis > specs there is no summary section in this document of the differences > between the two. Also, currently this draft doesn't indicate what impact > it has on 4474 in the header page. There is the sentence at the end of > section 1 stating that this document "revises RFC 4474" but that's not > particularly meaningful. Given that when we produced RFC 7044, we obsoleted > RFC 4244 despite RFC 7044 being backwards compatible with RFC 4244, I > really think that this draft should be documented as obsoleting RFC 4474. > [/MB] > > > There is a summary of changes in the document; it's Section 15 "Changes > from RFC4474". And well, the bis doesn't deprecate both the headers as > such, it deprecates one header field and changes the syntax of the other. > But more importantly, it keeps all the guts: the concept of an > authentication and verification service, all the response codes, all the > associated SIP behavior. The only real semantic change is the scope of > protection of the signature itself, which has been reduced overall, and > then with respects to the identities in particular has been honed to deal > with telephone numbers better. Obsoleting the Identity-Info header and > moving it into an "info" parameter of the Identity header is a just a > syntactic change. Although we created some architectural modularity around > credentials, the stir-certs mechanism still has the same properties as > certs did in the original architecture. Allowing the Identity header to > appear multiple times just removes a limitation in the original spec that > doesn't seem useful in retrospect (and the way Identity-Info was originally > done didn't allow it) rather than a change to how the header is to be > understood. > > All that said, I do agree it probably should obsolete RFC4474, not merely > update it. Or at least that's how I remember the process is supposed to > work. I'll defer to chairs/Ads on this one. > > Overall, there are a handful of changes (beyond the typos, which again are >> appreciated) I'd make based on the substance of Dave's review. Some of the >> suggestions to rename sections seem harmless to me. Like some other people >> who come to mind, he would like to see some more precise specification and >> examples of how you break off the signature from JWT. He pointed out that >> we really don't have any motivation for including multiple Identity >> headers in there, and we probably do need an indication of what future >> work might use that feature. >> > [MB] I would 3rd the need for examples. That has been a usual practice > for other RFCs defining new SIP header fields (and header field > parameters). [/MB] > > > There will be more examples! > > Jon Peterson > Neustar, Inc. > --001a114100e825a211053a5f1460 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Jon,

More responses inline below [MB= ].

Mary.

On Thu, Aug 18, 2016 at 11:43 AM, Peterson, Jon <jon.peterson@neustar.biz> wrote:
Hi Mary,

I think the use of terminology in the specification has proper background and citations. Certainly Dave is correct that the text is pretty lax with "header" vs. "header field" vs. "header field valu= e," no denying that. If
people think this is a big deal, I will fix it. But the suggestion that
because this is true, terminology is loosely used to a point where it
would hamper implementation, that I think his comments don't really
substantiate.

[MB] As pendantic as it might seem, in my experience, the expectation = is that we are precise with terminology in the specs, so that qualifying &#= 39;header' as 'header field' and 'parameter' as 'he= ader field parameter' is a reasonable expectation. I've had to do that with the RFCs that I've authored and in re-reading this doc= ument recently, I think it adds to the readability/understanding in particu= lar since the ABNF comes later. [/MB]

If people really feel like it needs to be fixed, I can fix it -= but I do feel justified in pointing out that our track record with this in= SIP documents isn't real strong. The original RFC4474 used "heade= r" informally quite a bit. So does RFC4244, actually, if you scroll through that. So does the Replaces header spec. So I'm n= ot sure we really do have much of an expectation about being precise with t= his. The reason why, I imagine, is because the common and casual way we use= it isn't actually ambiguous - no one who sees the phrase "Date header" is confused about whether we m= ean a header or a header field.
[MB] I don'= ;t disagree in general and specifically about RFC 4244, but we went to a fa= ir amount of effort for 4244bis (i.e., RFC 7044) to be more precise and I d= o believe it improves readability and makes it more understandable on a fir= st read, in particular for folks that haven't been involved in SIP stan= dardization for 20 years. =C2=A0 Also, given the ordering of the sections (= i.e., ABNF towards the end), I find it really helps for "canon" a= nd "ppt" to be qualified as "header field parameters". = =C2=A0 [/MB]

But like I said, it isn't a huge deal to fix it - it's just th= at any pervasive edits like this can give rise to errors, and it's not = clear that fixing this solves any real problem.
[MB] I don't disagree that there is a risk of introducing errors, but= I think, while tedious, this change is fairly straightforward in doing a f= ind and replaces (I personally usually don't do global changes as I'= ;d rather eyeball things to avoid the possibility of introducing the sorts = of errors you note). =C2=A0

Also, per Christer'= ;s later comment, I do think making the spec more readable will be helpful = for the gen-art reviewer.=C2=A0 My personal preference is to fix things in = the WG as it avoids others raising similar issues down the road.=C2=A0 Of c= ourse, as you note, if I'm the only one that has this concern, then fin= e. [/MB]=C2=A0

<snip>
I think enough of the concepts and protocol mechanisms of the original are<= span>
retained to warrant keeping this as a bis.

[MB] I'm not sure on this one, in particular given that it depreca= tes the header fields defined in RFC 4474 (per section 8).=C2=A0 And, unlik= e other -bis specs there is no summary section in this document of the diff= erences between the two.=C2=A0 Also, currently this draft doesn't indicate what impact it has on 4474 in the header p= age. There is the sentence at the end of section 1 stating that this docume= nt "revises RFC 4474" but that's not particularly meaningful.= Given that when we produced RFC 7044, we obsoleted RFC 4244 despite RFC 7044 being backwards compatible with RFC 4244, I real= ly think that this draft should be documented as obsoleting RFC 4474. [/MB]=

There is a summary of changes in the document; it's Section= 15 "Changes from RFC4474". And well, the bis doesn't depreca= te both the headers as such, it deprecates one header field and changes the= syntax of the other. But more importantly, it keeps all the guts: the concept of an authentication and verification service, all t= he response codes, all the associated SIP behavior. The only real semantic = change is the scope of protection of the signature itself, which has been r= educed overall, and then with respects to the identities in particular has been honed to deal with telephone numb= ers better. Obsoleting the Identity-Info header and moving it into an "= ;info" parameter of the Identity header is a just a syntactic change. = Although we created some architectural modularity around credentials, the stir-certs mechanism still has the same properties= as certs did in the original architecture. Allowing the Identity header to= appear multiple times just removes a limitation in the original spec that = doesn't seem useful in retrospect (and the way Identity-Info was originally done didn't allow it) rather= than a change to how the header is to be understood.

All that said, I do agree it probably should obsolete RFC4474, not mer= ely update it. Or at least that's how I remember the process is suppose= d to work. I'll defer to chairs/Ads on this one.

Overall, there are a handful of changes (beyond the typos, which again are<= br> appreciated) I'd make based on the substance of Dave's review. Some= of the
suggestions to rename sections seem harmless to me. Like some other people<= br> who come to mind, he would like to see some more precise specification and<= br> examples of how you break off the signature from JWT. He pointed out that we really don't have any motivation for including multiple Identity
headers in there, and we probably do need an indication of what future
work might use that feature.
[MB] I would 3rd the need for examples.=C2=A0 That has been a usual pr= actice for other RFCs defining new SIP header fields (and header field para= meters). [/MB]=C2=A0

There will be more examples!

Jon Peterson
Neustar, Inc.

--001a114100e825a211053a5f1460-- From nobody Fri Aug 19 08:49:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C453612DB96 for ; Fri, 19 Aug 2016 08:49:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 60qr94afNlQh for ; Fri, 19 Aug 2016 08:49:42 -0700 (PDT) Received: from resqmta-ch2-11v.sys.comcast.net (resqmta-ch2-11v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B424512DB94 for ; Fri, 19 Aug 2016 08:49:42 -0700 (PDT) Received: from resomta-ch2-10v.sys.comcast.net ([69.252.207.106]) by resqmta-ch2-11v.sys.comcast.net with SMTP id am1kbsvhTlSxsam3Bb7SRo; Fri, 19 Aug 2016 15:49:41 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-10v.sys.comcast.net with SMTP id am3Abxkk9duaCam3Bb3gaR; Fri, 19 Aug 2016 15:49:41 +0000 To: stir@ietf.org References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> From: Paul Kyzivat Message-ID: <8b99c0c3-67af-9eec-e6c0-6fad56413318@alum.mit.edu> Date: Fri, 19 Aug 2016 11:49:39 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfPZGQ+StMKQTnp7SCR+Cp+GbPS8qa4N9I78ecqiDJHMYBaZS/jD4lREWdHirES8gkEPDVVSZu+4A2sV1KzCimmdFhhjNR4feG89WY7dU+odUXSWU3t2z p5KUNcSJz94ZwOSz+O59cjMs+5DW/pyE7P2ru3r991WjYcjU564l0RaWc9AbMKWBSyT9AZKQJx5yLQ== Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 15:49:44 -0000 On 8/18/16 1:05 PM, Dave Crocker wrote: > On 8/18/2016 9:48 AM, Peterson, Jon wrote: >> Oh, we've allowed for multiple Identity headers for some time - the >> problem is we don't really give any reason why we allow them or any >> sense of what it might mean to have more than one. We need to say at >> least something about that, though largely this is a matter of forward >> compatibility with some future use cases that we know are under >> consideration that we don't want to rule out. > > > 1. In the abstract, there could be different identifiers that are > authenticated. That's probably not supposed to be allowed for a SIP > environment, but since there apparently can be different identifiers > used as input to validation, perhaps it is allowed. > > 2. There can be different authorities used to create the authentication. > This permits trust assessment of a combination of entities making > validity assertions. > > 3. There can be different technical details to the signature. Different > canonicalizations, different crypto algorithms, different keys. All of > these might affect survival through transit and/or ability of the > recipient to process. I think all of these are plausible and valid possibilities. What this means is that any *prioritization* of these needs to be a decision made by the validator (perhaps differently for different validators in the same call), and not by the signers. Thanks, Paul From nobody Fri Aug 19 08:55:20 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08D2A12DB65 for ; Fri, 19 Aug 2016 08:55:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xt0x_AFeDubl for ; Fri, 19 Aug 2016 08:55:17 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20BF512DBA1 for ; Fri, 19 Aug 2016 08:55:16 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7JFtLDf025663 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 19 Aug 2016 08:55:21 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471622121; bh=1jB8gv0ABtYm/MXiB95iqnbk7P/RWJe0Pn15jpsAah8=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=p727AxoKZEnEu/60p4FMvmbRnCgjYF70s2C6y5MFuwsqVbplvqZlfBIrqSl02jt9B +bzzBBTQd1DUvZvxh8iz9ZLakK9qEDTpqeK7dTWc4djry31wHK7MM88pOYHQIKIZ74 dMRcuMXCdGAknykVxkWfzadAzK2pNchQvTh4zp5Q= To: Paul Kyzivat , stir@ietf.org References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> <8b99c0c3-67af-9eec-e6c0-6fad56413318@alum.mit.edu> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 19 Aug 2016 08:55:00 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <8b99c0c3-67af-9eec-e6c0-6fad56413318@alum.mit.edu> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 15:55:18 -0000 On 8/19/2016 8:49 AM, Paul Kyzivat wrote: > What this means is that any *prioritization* of these needs to be a > decision made by the validator (perhaps differently for different > validators in the same call), and not by the signers. Paul, As you have phrased it, this seems likely to produce non-interoperability. Some -- and maybe all -- of the details concerning the basic mechanics and semantics of multiple signatures need to be specified for consonant behavior between signers and validators. Otherwise, the signer won't know how the validator will interpret the signatures. And the validator won't know what the signer(s) meant. (This is, of course, separate from any policies the receiving side might choose to have for the /use/ of the results of that interpretation.) d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 19 09:13:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CEEC12D09B for ; Fri, 19 Aug 2016 09:13:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HdQE6wGVja7w for ; Fri, 19 Aug 2016 09:13:09 -0700 (PDT) Received: from resqmta-ch2-06v.sys.comcast.net (resqmta-ch2-06v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60C5A12B04C for ; Fri, 19 Aug 2016 09:13:09 -0700 (PDT) Received: from resomta-ch2-19v.sys.comcast.net ([69.252.207.115]) by resqmta-ch2-06v.sys.comcast.net with SMTP id amPsbT4352NhqamPsbuHJN; Fri, 19 Aug 2016 16:13:08 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-19v.sys.comcast.net with SMTP id amPrbSSaKvDp9amPsbxHPe; Fri, 19 Aug 2016 16:13:08 +0000 To: stir@ietf.org References: <7594FB04B1934943A5C02806D1A2204B4BC231EA@ESESSMB209.ericsson.se> <7594FB04B1934943A5C02806D1A2204B4BC2338A@ESESSMB209.ericsson.se> From: Paul Kyzivat Message-ID: <58d5ff69-8135-69f6-4191-52f33c6029d5@alum.mit.edu> Date: Fri, 19 Aug 2016 12:13:06 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BC2338A@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfH11AUDEqqhE3s5/9rwBa75mPgNTiuYBmwDqBupDihZTlhwC68VoVHc5G3C5sgRENlOQhUZrhDf4zL+Z4lAF+eDG1l95CE0kM8z1A6Jle/uY7NY53Z2O +hUdkfTnFZ+UQ/eLg1Vq3tEKlCwu+o0WJJ4p+5ZjpV+hjHYVOVydOHXk2b3GriHO18CHYcPyKa9QGA== Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 16:13:10 -0000 On 8/18/16 2:19 PM, Christer Holmberg wrote: > > >>From my experience as GenART reviewer, I can say that usage of consistent >terminology is something that the whole IETF suffers from. But, its getting better :) > > The usage of inconsistent terminology, that is. +1 For the specific case of header vs. header field vs. header field parameter, these have long been used in a sloppy way. (And I admit to being a frequent offender.) Also note that while "header field" is used widely in 3261 it is never defined. By context it is clear that it means the same as the abnf rule "message-header". Nor is there any definition of "header" in an unqualified form in 3261, nor (afaik) any use of that. In informal conversation it is common to use "header" in lieu of "message-header"/"header field", and I would be shocked if its use ever causes any confusion. I am in favor of cleaning up usage for consistency, using "header field" or "header field parameter" when appropriate. But I consider this an editorial issue, not a semantic issue. Thanks, Paul From nobody Fri Aug 19 09:17:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC88412B054 for ; Fri, 19 Aug 2016 09:17:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bF383sKS6mWZ for ; Fri, 19 Aug 2016 09:17:21 -0700 (PDT) Received: from resqmta-po-03v.sys.comcast.net (resqmta-po-03v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:162]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B39D512B04C for ; Fri, 19 Aug 2016 09:17:21 -0700 (PDT) Received: from resomta-po-12v.sys.comcast.net ([96.114.154.236]) by resqmta-po-03v.sys.comcast.net with SMTP id amTmbd72Fzd8UamTxbppLD; Fri, 19 Aug 2016 16:17:21 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-po-12v.sys.comcast.net with SMTP id amTwbZIWOBaz3amTwbm0RJ; Fri, 19 Aug 2016 16:17:21 +0000 To: dcrocker@bbiw.net, stir@ietf.org References: <6bd1e4bc946a4a02a1f4fdac385984b9@PLSWE13M08.ad.sprint.com> <8b99c0c3-67af-9eec-e6c0-6fad56413318@alum.mit.edu> From: Paul Kyzivat Message-ID: <0a892a38-d748-6f60-b953-b3c31fe1e6a3@alum.mit.edu> Date: Fri, 19 Aug 2016 12:17:19 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfOhoI/brWogALcYZRbNh1wdq6yqazB7/GameMPJ4TOWUGExaxKddYrlDpsCz+TA0HO6oWEI5RtF42VlidIg+iTdVjRoAuPzT1q1P0fHjbQReRUCCDyts lMcTi5nuoXznN7dopUGWqV3aRmoIz1lBRmgpSOozPrREXScW8fjrOaJvrXGA9Ro6x/d2yur+FJxGXr1jsUIzt0dT49CZzfuFlIs= Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 16:17:23 -0000 On 8/19/16 11:55 AM, Dave Crocker wrote: > On 8/19/2016 8:49 AM, Paul Kyzivat wrote: >> What this means is that any *prioritization* of these needs to be a >> decision made by the validator (perhaps differently for different >> validators in the same call), and not by the signers. > > > Paul, > > As you have phrased it, this seems likely to produce non-interoperability. > > Some -- and maybe all -- of the details concerning the basic mechanics > and semantics of multiple signatures need to be specified for consonant > behavior between signers and validators. Otherwise, the signer won't > know how the validator will interpret the signatures. And the validator > won't know what the signer(s) meant. > > (This is, of course, separate from any policies the receiving side might > choose to have for the /use/ of the results of that interpretation.) The latter is what I was talking about. One validator may trust a particular signer, while another has that signer on a blacklist. I think this is unavoidable, and in fact can be considered a *feature*. Thanks, Paul From nobody Fri Aug 19 13:10:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CA8B12D66C for ; Fri, 19 Aug 2016 13:10:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.602 X-Spam-Level: X-Spam-Status: No, score=-0.602 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9DVpWLHpzO6Z for ; Fri, 19 Aug 2016 13:10:30 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 927FC12D746 for ; Fri, 19 Aug 2016 13:01:00 -0700 (PDT) Received: (qmail 25462 invoked by uid 0); 19 Aug 2016 20:00:56 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy2.mail.unifiedlayer.com with SMTP; 19 Aug 2016 20:00:56 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id Z7vr1t00V1MNPNq017vu4C; Fri, 19 Aug 2016 13:55:55 -0600 X-Authority-Analysis: v=2.1 cv=aqYhV0pV c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=JqEG_dyiAAAA:8 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=MpYY71g5riJgUjGje-0A:9 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=UX02XNS4fzsA:10 a=024b30zIY-QA:10 a=2hfT2BMxNXQA:10 a=_tStwUOuA4oA:10 a=U04FSIGNRx3ScUM3zguK:22 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:Message-ID: To:From:Subject:Date; bh=ZHeTBYEbPnUErhO18sreBM4KxMGrkQsPOGDAG5nMXho=; b=c3oq mapA6e2OxBkzYo5qAQSgRpOGv8Je2P134fqZtiLsHhw9ghk70MW9USqWliNjV2OdLC4gFkqri1Qed 9Yv2cDT85jJqd308egwh6yIzclrgqQm+i/1vsAq9XcXcikH; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:60903 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1baptR-0000h3-1Z for stir@ietf.org; Fri, 19 Aug 2016 13:55:53 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 19 Aug 2016 15:55:52 -0400 From: Richard Shockey To: "stir@ietf.org" Message-ID: <5C3A7BF6-3016-4014-A8EF-1D5B83F69AD1@shockey.us> Thread-Topic: Nice shout out from this AM here in DC. Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1baptR-0000h3-1Z X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:60903 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: [stir] Nice shout out from this AM here in DC. X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 20:10:32 -0000 >From Commissioner Pai [R] of the FCC https://twitter.com/AjitPaiFCC/status/766668659003682816 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 From nobody Fri Aug 19 13:26:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F6C812D60D for ; Fri, 19 Aug 2016 13:26:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X0NX1X15CIRw for ; Fri, 19 Aug 2016 13:26:18 -0700 (PDT) Received: from sc9-admin2.yaanatech.net (63-128-177-42-static.dzbja.com [63.128.177.42]) by ietfa.amsl.com (Postfix) with ESMTP id AB5A612B047 for ; Fri, 19 Aug 2016 13:26:18 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin2.yaanatech.net (Postfix) with ESMTP id 80D61390; Fri, 19 Aug 2016 20:26:18 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id CA23858090; Fri, 19 Aug 2016 20:26:10 +0000 (UTC) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> To: "DOLLY, MARTIN C" From: Tony Rutkowski Organization: Yaana Technologies Message-ID: Date: Fri, 19 Aug 2016 16:26:16 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> Content-Type: multipart/alternative; boundary="------------F9360B848ECB9A4E0395465B" Archived-At: Cc: IETF STIR Mail List Subject: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 20:26:20 -0000 This is a multi-part message in MIME format. --------------F9360B848ECB9A4E0395465B Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Hi Martin, Congratulations on your getting the Strike Force meeting and the combined industry effort underway today. This engagement will certainly significantly shape what ensues in stir as well as the sector. http://www.attpublicpolicy.com/fcc/fcc-hosts-first-robocall-strike-force-meeting-atts-stephenson-to-chair-industry-led-group/ Could you provide guidance on: 1) repositories of strike force related material? 2) which industry bodies will be engaged in this effort? 3) how the various industry standard bodies will be coordinated? thanks, tony --------------F9360B848ECB9A4E0395465B Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hi Martin,

Congratulations on your getting the Strike
Force meeting and the combined industry
effort underway today. This engagement
will certainly significantly shape what
ensues in stir as well as the sector.

http://www.attpublicpolicy.com/fcc/fcc-hosts-first-robocall-strike-force-meeting-atts-stephenson-to-chair-industry-led-group/

Could you provide guidance on:
1) repositories of strike force related material?
2) which industry bodies will be engaged in
this effort?
3) how the various industry standard bodies
will be coordinated?

thanks,
tony

--------------F9360B848ECB9A4E0395465B-- From nobody Fri Aug 19 13:48:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8D0F12D0EE for ; Fri, 19 Aug 2016 13:48:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id opT3FZWkJYA8 for ; Fri, 19 Aug 2016 13:48:04 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id 46EFD12D0C5 for ; Fri, 19 Aug 2016 13:48:04 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id 1C94E3BF; Fri, 19 Aug 2016 20:48:04 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id AA57F58090; Fri, 19 Aug 2016 20:47:55 +0000 (UTC) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> To: "DOLLY, MARTIN C" From: Tony Rutkowski Organization: Yaana Technologies Message-ID: Date: Fri, 19 Aug 2016 16:48:02 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/mixed; boundary="------------526E5E713A1BD152F5EE3B3B" Archived-At: Cc: IETF STIR Mail List , Paul Najarian Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 20:48:06 -0000 This is a multi-part message in MIME format. --------------526E5E713A1BD152F5EE3B3B Content-Type: multipart/alternative; boundary="------------34580C5BC07BBB3639C4E71A" --------------34580C5BC07BBB3639C4E71A Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable Hi Martin et al., It is worth noting that for the upcoming SG17 meeting, China's MIIT, China Unicom, and China mobile have proposed a new work item that is substantially related to stir work. Indeed, the proposal contains a useful comprehensive overview of related SDO activities, including stir, and a gap analysis. I expect that the usdel to the meeting would appreciate any views from the Task Force and stir participants on the contribution. In addition, how does stir and the IETF anticipate collaborating with SG17 and the other SDOs going forward? The NWI seems almost certain to get approved, and may well be before WTSA 2016. best, --tony On 2016-08-19 4:26 PM, Tony Rutkowski wrote: > Could you provide guidance on: > 1) repositories of strike force related material? > 2) which industry bodies will be engaged in > this effort? > 3) how the various industry standard bodies > will be coordinated? --------------34580C5BC07BBB3639C4E71A Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hi Martin et al.,

It is worth noting that for the
upcoming SG17 meeting, China's
MIIT, China Unicom, and China mobile
have proposed a new work item that
is substantially related to stir work.
Indeed, the proposal contains a useful
comprehensive overview of related
SDO activities, including stir, and
a gap analysis.

I expect that the usdel to the meeting
would appreciate any views from the
Task Force and stir participants on
the contribution. In addition, how does
stir and the IETF anticipate collaborating
with SG17 and the other SDOs going forward?
The NWI seems almost certain to get approved,
and may well be before WTSA 2016.

best,
--tony

On 2016-08-19 4:26 PM, Tony Rutkowski wrote:
Could you provide guidance on:
1) repositories of strike force related material?
2) which industry bodies will be engaged in
this effort?
3) how the various industry standard bodies
will be coordinated?

--------------34580C5BC07BBB3639C4E71A-- --------------526E5E713A1BD152F5EE3B3B Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document; name="T13-SG17-C-0605!!MSW-E.docx" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="T13-SG17-C-0605!!MSW-E.docx" UEsDBBQABgAIAAAAIQBjM6eh2AEAAOAIAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIo oAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0lstq4zAUhvcDfQejbYmVzmIoQ5wu5rKc KTSF2SrScSKqG9JJ27x9j+zEDGlqtzXeGOJwvv8/N8mLm2drikeISXtXsatyzgpw0ivtNhW7 X/2eXbMioXBKGO+gYntI7GZ58WWx2gdIBUW7VLEtYvjOeZJbsCKVPoCjf2ofrUD6GTc8CPkg NsC/zuffuPQOweEMM4MtF3/JQNQKilsR8Y+wpMOffFS89h6dR0gl4Vjxo43L0hUTIRgtBZJx /ujUiejM17WWoLzcWZIqMy5ELyElSs2askNfZjRfLn5CLXYGi1/P5K0tR3CbE1FtcxL5PUWc sy13Cb39Zw3XCPY2+pCuRpvvoJkHETWkHtcRTDqxPVCrQ3NKimzqmbY69Cn0N+NQz3PVaZra 9aQf84medmQrtDtW6E0fbmfXEGkaRvfn1XB16EETCfdmivFuuYPy4NRE+3Uk91mgfjUbwmk+ RzcB8t4qUDNa85MleXMEEiDSAExwvBzJ70q/3e/RFWgxH8k/H4IQxx9QrxagBfcl3xwFSPcF 8OY53kSDGZSs6Q5ZibWB0eU+k/QBPWjiCdZ3k43ef/BBI1sQapIBaMF9+t3ySx8/0YzjnZWj z4w8b75Pli8AAAD//wMAUEsDBBQABgAIAAAAIQCZVX4FBAEAAOECAAALAAgCX3JlbHMvLnJl bHMgogQCKKAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArJLPSsNAEMbvgu+wzL2ZtIqI NOlFhN5E4gMMu9MkmP3D7lTbt3ctiAZq0oPHnfnmm9987HpzsIN655h67ypYFiUodtqb3rUV vDZPi3tQScgZGrzjCo6cYFNfX61feCDJQ6nrQ1LZxaUKOpHwgJh0x5ZS4QO73Nn5aEnyM7YY SL9Ry7gqyzuMvz2gHnmqrakgbs0NqOYY8uZ5b7/b9Zofvd5bdnJmBfJB2Bk2ixAzW5Q+X6Ma ii1LBcbr51xOSCEUGRvwPNHqcqK/r0XLQoaEUPvI0zxfiimg5eVA8xGNFT/pfPhoMEd0ynaK 5vY/afQ+ibcz8Zw030g4+pj1JwAAAP//AwBQSwMEFAAGAAgAAAAhABJgIrpoAQAA0wYAABwA CAF3b3JkL19yZWxzL2RvY3VtZW50LnhtbC5yZWxzIKIEASigAAEAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArJXLTsMwEEX3SPxD5D1xUqA81LQbhNQtFImtG08e IrYjewr07xkaNXWhmI03keZamTm6c+PMFp+qS97ButboguVpxhLQpZGtrgv2snq8uGWJQ6Gl 6IyGgm3BscX8/Gz2BJ1Aesk1be8S6qJdwRrE/p5zVzaghEtND5pOKmOVQCptzXtRvoka+CTL ptz6Pdj8qGeylAWzS0nzV9ueJv/f21RVW8KDKTcKNJ4YwVtFs6mhsDVgwRTIVgxinva6Zvw0 w2VMBofbjkwcIYY6JZ/+Gn8TczxoqQ36AHslhJBPYjIgxcNbw67ku2cegojKoDdqDZZiftjE KIUg8phGlBuHRr3S6sc4pCkfVd4iqKAl05g0lTH4IxujFLQkqieV0bgS684LyCiFKK5jWvEB 62dApHh4X6onhkByukPjXVnfGwB7yMdQB0NxFXO++2XDXgl5cBcToQEhfQuGerSAH/2K5l8A AAD//wMAUEsDBBQABgAIAAAAIQDyPd2ffUQAABoeAgARAAAAd29yZC9kb2N1bWVudC54bWzs fdty40ia3r0j/A4I3Xh6ow48U9JsYYMHqbZ2q6vKkrpn7YmNDZCEJHSRBBcApVJfzb19t1d2 eCP6CfwE65t+lAn7el/B358HMBNIgCAFgKzpmojpkkgI+ed/zv+Uf/03XxZz68ENQs9fvjlp vmqcWO5y6s+85d2bkx9uLl+enlhh5Cxnztxfum9Ontzw5G/s//gf/vrxfOZP1wt3GVl4xTI8 f8C391G0On/9OpzeuwsnfOWv3CW+vPWDhRPh1+Du9cIJPq9XL6f+YuVE3sSbe9HT61aj0TsR r/HfnKyD5bl4xcuFNw380L+N6E/O/dtbb+qKf+RfBEXW5X85FiCzFV8H7hww+Mvw3luF8m2L fd+GLd7LlzzkbeJhMZfPPa6KrDYLnEfQYzHnYD/6wWwV+FM3DPHpmH8Zv7HZyFtbIJBeEf9F ERD0NSUkC8dbxq8h7kjQPybeKxDvNV/7Nb1qsxHgwgYvTfzZE/0bTebin0+B+OEP1uP545uT s7NW+wQ/Rk8rLDT74py8Fg+8d578dRR/det9cWfxlyN3Pv/eYe+au7f0FN7V7RveFHh399nf v2awKW8DpO99/zNe+ODM35w08D9alD8XA/828GYE5h3+Hflzvnyz0+xzALWPIQWGT9vtnunj zqnp07P+mekVnVO2HodNghQFgAZyP7si6Nv9TrN7SWhhH32CUEEoL7rtDsMVfXjDPmtetoaX bUa0KOD7nDrL6HoFSRb7Fx9HU0agqUDGVBCS7R7rJAj58L0b3Ln4nKEzcKF0gkhiVLxjJcHL hDixjbF766znUfrxT8pHBOUEpCTVdE2rYhVvhgcIG0tnAXZ7twzdIHrv3/kcvabHm5vHZ+Ed /TL155deEGJ59h1+fe/w3xjrml7SUl4SOZO566z1FS+Wsxg89pYAvyokEwigPQkyTNhjS/9T 4Pu37OfwZ/wNQ3O7x98+d5Z38jN3+fKHawLDBbCD0HPenPx8/3L0gZ4EB4m3Cp2EdVbn3nLu LV1r5oXRDUMb/TSMf3of/0ScRpyzOne/RGQ5pl/enPT7zW6re2JNn96cnLZPpRTgmdtbdxpd 8CchYs2zRhc0IWqeWODFM/ZnE/qVtrUig/QpsIh0wDcn3CdvGq0D18IHMzec4q+8aP3Sn3MF sTqffnh4Gzire296GYDSxKoOhHXzyXt/+jkUpgmYSCg4g4FLKGuuIpf+6B4odgfhClsi+Bgy 89d/7qrKVsZO5FjrwNtjAyuOQZANP53j/wIs/PTsty0fPnlMtOnVIIWgHshbgHryb/gbHAKN EyuNbCv+KAj8x3vXmYWSBvpbXtOvGlSTube69OawSs45/WwF5+5i4oLHgncz+EZT6KkIGmIV eEumrpzzMJhegcqgMH6OAjea3tOPt3iL+Py18gVbcrMKARCugIjJ4/f+DC921pEP5DvnX26D Bf0LM2pBbIAkCAxjfYfEKUeWsJz84xXU0VvXX1j0A/YAONnLnYf3IVPfwKN4hNZa+rR3tpP5 0iIrTDKX+GbhRW5gzT14TqdkBgVMhGZoK/bHkePN+c+AZb6EIpH7FD/iV/wUix7xq/o7fo71 DP18Hqsf0kjskxX7r7Q5pP8iYTUiaXm6jeYZKbaE5SEjfL1ysD+uFDtC08m/r87qgM4EqFCp G7XcYiiUyhb/ygcBYq6uz3oF9my/+3BzcfVhcPPu44fBe+vm4v3F6OP33//w4d2IfWbhp48f mP/CMFkYq23yLpJYBczF0ae7GVf5Rvti1Oo1h+DBGCur6+hpHnsOcPGXa0hoIKhoRp1YkrEJ KTTInDNlYuzC0j+4JzaQY2nYAOol+iF3jeGgNb5k5lqhiPJaQdTg0l9GIf7wHvrhzYm0qcxi nQuzKz80GtrIbvbz4IDxbJ8x/8IMBzuepbdn/flP/5K7P+N7W7328GzEkB/ZozywGqPGaJQE S/nz0tBjpl7u1qoAw270Gt08hKh+844wa844Y1mbqHehLUdaIlaBJH5MtRRw8hWP0eTQ05v+ 1hVnI+40drtSQwoqSq27i6fPHKAdlESZnj07SHIXYzaD+Sb1tXHWmVDHznqLi6rJWe/Q34nX QOfob2G8H7+FOXybY8bGixeeoEI70pyMyEnz1Wl0YPTxtX4CTpqvNge4nPNUo98adC5oVaZd 8lWzwklS63KOmIDY2PwoZP8qRoodP8CsjI+Ig4VBlOtxzhdA0DsEwxV7IVBlp+ycJjSKTn/u UpOAbS6yr28GH8aDq/G7/8rt6vXF6ObjlbYsl1VsV+6TDEqCwTV45HP5+D+7aHfHLdU0CnSF C2c+HzmrFP6L+Rlp/Csk1F4BjJt12/XND+P/Yn26uHr3cZyrm8Ue5IY1LCgMkAOA3Wo02y/x n54B56QYhXSZZazTQyRyq4wxpcDexRl2OyET1FUI2Rj2GiOmkUjEWGCiOW53xpcqISlo9gcc SwEaDzdxIf9pKj9g0Sv+4TYZOeWPbXc+FIFUUD/JEubC7yW5HKzv1mGkUUgRRpKH5kWz3R0w JIgd5fpSpYBlZl4rxUxJUDf0OjSoGka5nhE8T/9U5hP0eTiSrSG9AKOA5Ub/uAadDsHsyEjQ 30/8KMJpVXA9xbvnzFqHP+MAzwy1cNyZZYS59RHicejIjHexjccvY789X1x1QS4SR0RsK3YT /IDEjj4o6G9sPAVm17GJjZe30WUS5SLEuo+n8PXjXjoPHBmZ+sDocxTE6w7WgYgT816pjAxh GMy9uzheMUUkNT7uFjl1K8Ynn5sFRve3MkArU4iEXk4WpoEKWSj5t2QtLiD3Xnhv+cv5k0HD FfGk9J1uCTKIh0kDHQ0OPsLEe0tnfm4JbBgQAZyRe0P/VKbq28ieCeUq6Cg9qoQWavaQ5oKm 23JeKdOX0omcVM6SBdMKQvIa/hUPmc57zDMU573JfO2uvOVnXZXnHvrU3BJDjHjVwnUjGDb9 TbmH0I1RYLFK07mSHdEVN4U70gpfG2RQYoEk7j+vkYFDbvx34Xfn2YzG2Y3+m6A9y1omaU9s KR58jsPcbjYucczB22OHudNsNTs8KKgqmFyHcbv/S3jIjeno7HbFcTxEeLIhY2SvNdwp9GAh xH7/tMWYSgndaX/ezPtzsWmBB9PqeuCQmDuOEGVSrnPWKXICkt5IKQTVcs8ZUmswQlJatY0R kx1e92VUKyRjNdIXqQiLilikzNjGawBXpjXiY4HgtMT/Rv+oKg7JsdjtjbyI++0br1c67Dwl zqIIm/dsFJxIUEt1vPlCVFAEOvsXVnDmkx4PU7y9+vjDp9woxbDZ7zQuTjJOxcCLwCiC9wUk uMBrdElW9MiOet28bZYMGH38cHP1bvgDJYhyN79j+Fx3xItp3VQw/QhF/C/OvWG5UeGThP46 mCbi4rnOzUYwRRhoX8G0r9nS+zgdp20qI4T+zw+Ql5nf1W0wN13cPVHODkIZbGf9jULlFswe IWvoWD8sPdTP5SqSXqvbLB4r2w4JuT4vLLZ83rqng+Zg1FP1YAkul1jX+t5HeairLf+VqwFy uqqJCQAxFfkQikUVPgRF3HBegaA5twg8UCBOJgFyDk9NZvCFemH+gNQnRWrkNupFFDjurV5u yBWpWrscCaHP2j1YKVKJyezdsN9qd+NvmN7qn7a67TMmy4KMe+gt6aepjmCTrcMp//H9xT+9 f/fh7/EZCzgan2dnu8TzIg2bIDtKQfpxPQIKHFd+6Mwt1JtbjrV0Hy2kTT5bKE9KKU/F5crR WJAq6ciZHafzpKMk97Ph1+ROlW+Se6Iz4ajRHA2oxIo08I07vYfud+aaElS8P/qLs8t+qzuK icwdQvEhe40ZdIsVPDIEEb5G/pqiiCTXN+7cXd2j2p8eWc/y1lZ4RiAqB5tFjhTYdQa4Ghgm O0AqkFePp4kgMJ3+AlqJ8aEWjzgd9PoX4wRGe60GHesNsqQ/zmRJfKT4ABulOXGBb5QaxRXc KF6n+tn3D1Qermb3BEp1B5rlOOIH43q7IsglrPGTHnMvilCstLWJnZuvrKEz/XwXgNd0tuL0 BHgSvcTYpxedix47RSa1V+u000GZoXg4A+Nie5n4Cn8eUV0WQ3hLxNG2O0Z74LBkCJhiuNfE ARpBUWjlr2cWSVR8uw/u3F+xJiC0CFnOCl0AU9ZTY/m30MAR0y8RqTGk5u48N7QcVGMv/YiF 8q0JKRzSOVN/+eAuPbQeuVbkW9G9m9Ss6Hjxby+CACTj/j2qtBfMzHAJrhYD9hplgWEC6UaQ oN/rAMhMkhfWBJ0wzjz0rcD957XH9DkDnbBK5HmyQn/hWt6SN2Uhwms5E2qfAco9Kp5HMslD kxUj4ivrEqbBW4ZoAJu6LyyUTi8ZbfgriZRryskSMakDILz3VwiK372gh55Af3dG6wJPD3ix WIIMe/jCcmYzNHmE9COIHznTSAXqhYWy6Ve/t5yQvwoLykUmzvIzrUl1mmgGw98Tt3CIzCuu QDofmZPE7oAsvMpyplOyfRYxMMONj/fRrmMM/R4bx0lkA8mCnUxUdgcUmavMfSEStELq5daC 1dZNXEExd/bK+sjEALtSgCAyPRybVNy5yRKO45MJ6kuZzv3QnXFOuSWnJoSvE1oL5wn//8y4 hxSWx7kAh23UtEO7Td0V5UBeaXK/o61q91ujjXv2m7NVczQRXbnLmRu4s0/OnTsMXOczrzWw hxpeqzZitovyKqkucpiAtMnc9+EBz2GuTGbs6YV1S1xDT8I5n7vBn//0P0KL+8y8+JxpkxV6 P7B1UoETaE/oE8v94ixWc/wy9cMI3bNBrMZoJYdrJDq+QC17AVOq4EY0J2BNvAbyttF2WNSK AlRRFeDPi8vGuG30Xn/j/IlDVr1ceA/v9+7eiuJDFnGQMGIaV4afidSL0J0/gA/RPeBbD07g +Wv8olnppFtCLhLzmFmO8aIzQlPoAdxD4ldSoR6sFkkKt9AkBPgNrsYCJ8ynpIeBr54gG5Ap +APxXxGnb8zrxjDjCY7Nd3R2hbtp4e3cwi7c6N6fkVlWhdCKnC8QNGoih/rHw8wDmEKCPxMJ 0Cu8WRQ/OQyGJ+azekvrDroLn2BJNGbCg4FoY4P+k/I3ye1pvGW0HP12bzRi5QDJU47+zaEs h2QmHlcQMB2Anf7gRZAa8JF66IDOJEEig72mQAlZa3nseAGHipKcc1Kd+LuNxDExs7wQypu7 r9Svug7AC3AniW2nUKrwkoPwP1kzdK49obmNZJAIfg+PVCMqZE2i6LDyRpuBv50F3KHpt4AN A2nuQCMoBN7bG77aGdzc+FL5J1/7HY4lIeCmaQtOAFH3LRTGoDObytEcaBccXChCZ90eHvE2 tTDLiN6u4NSMWPP5Fao/DkMm5JVOn970HjK7hGA7dKCbQDJ33WYFLALT7CIYEempKkUvZIne caAc7gfTj87sAXMc4KIzp1cQ4gjQuwCx0cIf6l7uV4Pem3vojzgPYT2inzoOiHzTH/sFYREC 3Fl/6OxjdMWGvc6ox6r1mSvGxTbxoVI7rX9zEP/MuI3+qNXqxvWRV3wb2ekL/XG2DfHRt/QF qT+RR4js1itrgCjiU+jpJy4jEYb83CVdQ06E1mVrcHYh8xZaDToOaa2B/Cafl3hOpmRDRpsQ uSEjzIrHn2u2KgEuU95br5qZHoDijR/ljuxBlnHdAfKq0G0LRkfQXTk4UajC4kEKDXajBPQv +pebwKfK7Lps5DN7dWxelKNLhoCn73gMCHkGlwUX2OFIhCzgjCHKAP9rzhNqTzjxIrqxQCUY O97SKVT4RCzxhhPJxlXOohDUmLLf8reUYY6X/qMzc550fanDkqtN6gL0RUqLHABbONggwxMw f1wWfpC0iTMdP/5ocqc4waQzEhInjh1cDJX9HAXGCx7jdthW+bxibz3Z7QDeUWAdqeE9Dns7 7LICIsjzX5LzFY4uf9UMfYajHLqigMOFx4ZvJmGSjsZhMVbgqKM7/d+M88bNN1P+BgFkaZ9F 0Jmn+zYGN2GmuQFHWn/mUfHDjGdwkgxTKRPbKL9BfvsnP7mqyqaXvd4pKkErBcSM0wCxPETO /ABlQedwNCWGKeDKSoZYXFVi3aO8KTk8QOUEcVge9k/abWP5gVolVPfWbYyIRGzQD8IXCSoY Qd1UD9UNqJlGLDIoalZCcPiMkiygwAqTk6k+hnJoStUXIl3Mp40zd8KPDdyVj7mqzHXFlFX2 1k2yk9J7PG1eQHOdddpjGhcKiUU+X0Q3sg/WHfSE9OL0GjtriDcQx8sjLz/57mRG1oCA1Q6K oRSspmGn+kHjFhQ5LM9j2BNWOqr8LsG1cbJLi2goUNeBxMx4QPO7pEKI4SWTLHTdV4H4cRbi d9hITbSwtfPpnCvoWO9p+zBGCowinfhQibvq3zCRFvKviLSHU/IjZq5imOl7lCZi/G5AM195 1XD88ZuTFmaqMdH9Cy4XNqv2l0VERRHs8tTRdi1JmidXAMbDfrffr9ZrkWydmddTJFHB005C VwgVZvqxwtWALmqgpDRZ3Mkc1fVITEdw+lBuCy/JmSFshA/ggVDWfeauMN6cnCg9IlOGVOq6 tURDux1FSuxaoUPd/JoK5yqwlM8TNiuMhgcdwH2mWqZba4WyJIznfvBR3YQvcEoVJdK8/iVW yHEJvrNGjVTg/QyF/Sira9gcOV7q4uN1VK6BCzJYUcy9O+WeG9Vrg4dozdjRY8WIek3bK+vm fp1yezWDPB50m+2KxThDeljYlEdVXR7TToRRRU3eBm00fAhFnPO5/8j2nS1chIwZbkBJdLkk wnW16LAX8bE0V40dkBB0KNB8hEOgiSJ9aHhf8aJDXiCmR9UhE2gUyNC3osNhtu/5RXdp1HCM /s03ZwdOXf64bLO45zs7aUms23gcj7NDbgMZD/IrJvAnNNEsw1EQyBaHsN+go1Bv24NZHnQa W+E6xA0MrLacB2Jg/NABg0AcOqpDD+XO5AHIPCQavaiHTJh/o7LMLuwkp7ndaY6GnYq9d4Rs RXaVQYumQYonauwMS1Opk2bGPcoXQ1xKpLvgCaNXB4YyoFPSz/fufKVQfWMQeewuZbYrRaYd rlH+ifLryTp8Ihyu4JhSi5y1ADY9RIeZ3npJSuvguLW/eQI7dpqXf0Qy83e+J5CWu6PyBNLg 1YU2EeJjUYWkDpXxVFLtnbP+eFxxOsl2eHXS8i4PksPhapPeSBwpyada4FYnXT0ZnSqBR4la Jfypf3ME/lNdLAiDjnQSbDocjyThFctTt8BKr4iIa/KFJNFzQK4Lgyyz6lu3FBynyI0EnUcH pddPHIqsNW7fC2geAwwu5ji46Pw37Y6HipZ0wyvq2tnUGB56QusVavatAT2waXt1mI1G2yvz MuBfigYs+JMorJhSaAqPEAAUFqBsLxthIPv82DGd18FhuQnaApy1SDEi0464FLX4otOYvFV8 cI/Wepp4EHu3r6wxbsGjiCl2L7QI30GSOlLwSKf1G91OS5v2WBfB0JjGRxqB5SV5QoZZakGe w/1x5g6ysPQdSlPuWdEgNh76aBpF+SA+82nCw8aP522LtP3EjlPpaFxVOJ9npc7rQImNije4 nAhfFwLVnDqvA1Czo6GQAxKFmRogCJzVyFu435zDgzuH9ssEU2lx6TTX1G1VcgNCafDKV0hx 9ksNCE2RRkXDI5Qy09ZkKfQTtdGX0WOYomQj8aHi4Ijd/XYDRJdJ1lS8m/IJbdZevE1fMZ3C +nNLw6w3Ljxn/Zg8VmhiDUqhsOp0VnS6QKUQ3a58G+BGF2IkVkKpOA3cEtN4sBW3aCwI9SiN GtwQcJ4eiKJgpb+YIMkpjLoOBvJiKKqGtQvg0CDvSbfcwyaKQAJNJEAggUqTEvGqMti4M+o0 RuyKOCpU+ha5hzznR+6PXSX/mBTLun1Em2d2+XQMmnTA6+mmGBIMl2/lomkA7Dz175YeZW01 cEvh6Kpq6b6OFH/OKCOzDs0aWQElSCPWPBxh6EAD/XnHBt+lScgozM4qIlXPW4BwGshOPiez /bwQWR1zhby/D+WN45ZhRVlvC8XND0h8estnzGVBF/OMJtGw09MDpprNMR4DF4tLfTrFyQtZ A9QkYNSWxn1VB9ptlEG4qPB6gcoXj6WuVogCUy97AVdbV9T7VJSKN5CZ/lZRuk3LH2tFqd36 zhqbKhm3Vz1rvG7UtAkeU7xdQ4FyenpsncWJdXmY47iYXEOfrirqPnalprgcwPWm+YSJwLHw UrWye1zqCmeah9y0EnwxIAnhBnjH7yiERpOx4CavHExYxdQj5lDTcCQ5mmsTIFO8fPKoRTIY WjX4zN/Hp3iR48H9bm4dmBlgNWQs18o9bqTo2FUOIcYn8RmL0ttGXPAPNEqUXivWIM2NX2iM CvUUiIYBMUzP/TKlUaI0LsOVMUv8jqigi5jX3GBtVNeshxrfxkFGoO0TZkvF4ZJzbuvemk1H PpQYJqQ0BSeLF8ZBuNTXtI34Wy3Ycjj6CN4TEsEjyKgNXxBvsQCyo8gDzopgTKOouEEBN2Nw 1kEr7okkn2IC9G/YSVF89EyPYie/WgLGGztGvdZpe1xtiYbZax7MUZVKIxJZU3yC62LGyYKy boMBZSqSFLtCWpedlcMCQsRcUAM+oUwOpBN5BVKpUORKZ12yR+3Y0G3mmNRZQ7IyJW8EI8uP svimfGrY0P6owKcy7DXl0njci7I3NMUzqU63Yrp8ADOQOfcw/FiUfRN7zALnkdXU8NTRI0IN rAX61kGZOQ6DYgReKqEU70ihguJN1S2oieIlpELDdWZJdI1cQlXyyIPS+Rxn60gfNUiV9t5y 7fL6fHg7OOSyIM8dzthw0HbVOTUjPYPDdoW6fNa3ca94epoo43Z3Nfef2GAVRFn4mEpyk4We l8MIdHuvFO9lcc5xY55E9KLdv8Qt7oqIVoD3H8DPesZIwZ0ZiuPA3NJ/PDzbmuXpBe7TsHgX srT1bEwtjDwVAXBPlo4ioYeqAMw8XsOfRzP2nUM3O+QazzRP1EwNO6G2j5UGifyRwtRHrRBu qEYaffyYZs3LvTMH3SYQL29SYvUh8K28GZpr2yf4Sb+3qyOaa7e5XzWzlVmQNsN8E7uNXZm9 iLn9FEbtrqnIUybKoh3m/KaPcTmYRuRSBBqzxmseAC/TEtdUNmjvfW7LQWCRS7gyZxeUqYiL sVy+bpUijqDNRsB5q3wmawr2qQpFe82ATotAMexQaq7AWOf066vavXl4V4ni8Xhevsdn1rTS naYY864bKB9G2+zVGxM5bW1Qq9qpqX/Donh1J3LMEJ91h/14tOzW9Gavi9v14unB+duoZPoo baLgJNpK1idj3HrVsq7QzU4T0a3r8Uc0dGcGbOjU0r1sDpSrCrmboAwlKaIXq9pMhgRmid0O 26kKYpvuVHhADUuRRgkj6jvjTo+7o8lLVYaXrW4jjsIz9hYPK7H21XX0hHYyeTnkCbN6yEVx tsQpKnlTJ757R1aSDYRqt+kPwMbxX+C+iJBej3/lQ7hzxgnIX0Yc9s1J/4w5yvgb+ajgmJKV XaZsKTgowqslg0Ui9+7mh5c3GlMSsIwowBIjI7Fm46IzaMXqSdW/l6fdRie+LpRRVjysULZy tNJah8GgWc4ZWq3rt1azn2lpCa/pJFyuG1MBA+Qq2DR4FUAQIaGOgIkMs9JFGCxV8hMuo9I4 UzneE+4Gw16jze9sPibS59I7DXMFCP3zn/5XHt4SssytZuOs3z8dqmHImBE35aP/73//t//7 f/6F6+VC3rxZOG7iMcvSA2QJsQU+RqlEiOmGS9VTZTG0Fa6hBZNQUlyWwqHCgk/npooJcedt ukctlRFnCfOsBpsacWP/6L+/uUgQygytOYFfEy/9awLEOCpDMojJbmeNlpFtUB4bvTmRzMOZ pgJm//d/++95AKY1WMzXNQGYGcA26/8KUHSPnHOsXjGvKqAkNDJx5xriith9ris63X77wnif hi4++c5ATAfJIm9OdtMvmV7VZbc5hrNp8gn2XYtcJURtLX9CVokyU/6WyKFAUslAmBUqSrKQ y9SoCVtZfOn0dUDArbCpkX2dfLF0DDVuKGk18wbXuEKbTSGmtEoSnEpXvmK3HLpLlNpR6X9y 7fpRwT3Lf3jVbHW6ZYPzDJsO/kuUrlOZoBOZ23yLk+wZIBlY5ZnkKgSMTb0gC6SyqZp0ek/3 Y2JwPRQP2qY5NmJHJ8lNJaPFzvTt95TcQvs3S3CKVcvea5Q5bv0AmxVlC2j02LitcQtHMb91 B/VdiCz2Q5LbahEG6p1KLlwy6QsyXB3bNYNC18tUzv+Z5R31s79vSC+UTHM7MzJQ/3ZxDK2c uikZOhw3P/jztdEXKpvEyY4l89lYPcmXDcE+J/SyYfjO8o7rpIGT4wwTYrzoSY4i9JZweCin SNEZut57ufQjGgQTBbjRG1Gb0J3C+cFIGHTGUDTHYAGpHrNiO2EnLpBUwon1K43KNcZ1fGZK ovVwqsPCHOfpOuWVli0yifzVXzSdzR4H2nFpavbxUB5HZxJ8qHCciZj1QKSWPkmAuF3H18G9 zwrNHkCXsO7A3N7vZwfbKACGAzU6AR+g/Il0iwTp4rjwARDAZpsQO2FCzueig+qeEwvkbZxb WwFqDQLqh000zSUJVLKeNaueA0VdzMA8OgFTPJU76Obl0abjzFDMgo6dJC1qUWPQsUrjpMof SXBKZo2jijzB6ax4u2bq49oX9LRsr7WrU0nAvk7dGYtEsl4cQ0i7ZFYw48Zg+muxH7ZIFB+E IVJsWIcSMOOfBnaypPtBEHEw6pOjdJAdH4T0NqPy7mGUOtjSZnM02BiNBEHMR4B0CUSVbqb9 XQKo0qPxL5IL1IF0sy6wnFsEZFIcWrIdsNEGz2JE/nK2xixLNMEfEQp4shIa0Zk/hchlkuek 5m6SoJqQY6onKZSaySDLH5v/mFy2DiYpcoeCXs6rloOKehsBaH4de8mlLko9SFHylAwBqxJJ 0kyBpfzlzKxD1SBQo1Sqgg733FAQK0LivQeVAmqjpx4zGOhKxHR4rtKVzSiiGkMm4SJojaNa gnBmO5SRbiifsnvFoCpFpE0xekyJvUsF6qVaMlfllo+bDJKSW7nR4HTw31Sg8PHthtDQdjLX vbu9KF83kBkkUESK9TYDu3ziDdI/qKBil6GyCDCyRTT3AZlx75adkWWFzAvcp+pPP5OrsPnI wSQsTOTYfMT+WLYKUmGWCCfLPyFWZeFmpgNZ1gEeh4dyJL3MfGeZrxvPXzEzvLLesbvMaNxB AJePjb3zJVXZdbhUM6awDFV2f6MIum1wXzZrfkoXZj6v11lEPzCwdbLGzBtkacUIQ3HVnNCS bM447gTBrTn4D6bkuoEzzzyxkNbvXzbPOgcZ9sc1AWM0th+xkwQbxcGlukwU/J0FkiUYtxiC 75GLg97B7SB5YNWBQzuzkKQuxGQYDrLdMBagHto/bsX8v02nPK8sgHpAIQGux0ECCm2iQLFs /NAHAxlL2S97HVy3eyIVuAgfZHYs6o9/61i80hCmOJpxatF0/i3f97Pbbz990sSoCLWVsY+i ZUXwwaFOqDob5rTRmLOU5ePVLJeE7KRJNsbC6iG+GcjrQTsFo8SvWa3VzbOexrBKQYoZvPKp ay9EAwW8YM0DTgAmp49oA4bYbRr6gKE+90+MjzMdqz9+yh+v3Qqb+cXKaZDkWu4I5NG+ubLa 7Ven7VaCREcnfueZwnc8yLyO1jPUKy6td99fWxdL9JkiDWpdixDviLpKP/HSFnnBB82kZ5VK CfRLlkdCAjqGDeAS07YM33SPiu///Kd/TRcJHZeizG2WrKXh9RnNkq3L7rDbjz1MxefQv2E+ h/iIHCkxd4Wuh4RpwOWJ6Jt9eXYmeEcMZbnETNIQ35v9gcko5MMvWNfelki46RX4k7jhj4dO MPUUfvYMBZt0VE9IgVEJmd77eK6DhhB5hlLG1Jf5mqLDrC7w3cXNpXV98+6Krj9h0SB+QRWb UYJ7MgMkrUKUkwa4ypLNw2Weijzfsi9YYAFSTmcHducmLzyksBO7liXu0xJTd6EdHu8dHInR IT7Fy3EM2UChr7u58pFqn9FPS2FtxJeWiGcwQEjNsKpnKpOm99HNM3ydAkcVnV3U9Ir+zTEy koHg9mCGC2qgWEGIJ44f1hnnz/27DXZivNMxXrlTFCR2ZjM4LTQ4GydAOilu6PIHwR1v2fVl jx5IjcJzXqHO7n4kcofQ/nQPpLwxB1UAD+hLInohssHYgnfm8ZIdNoY2nhiNp6Zz/D2ij7+T URM2rBkvjPzvCjRR60TbmZzxPJutE3CYuYEkx38hx9psm4ADqcyakdNsnjW5Jsp+pHsqHLzs R85OJXB4hk3lCXFXECEVDMNmYcIVJtXJktGYaomZuCwEdlCtaGLmv7KufIfaHTSVaDyEfiP8 SfMvhfA7X0P2V9aQblmG3sJFLLgpTmMXGP0AraEXAR2JoqeV++YkNZfEFGMpaGJtBNyXZDUL LbqprXnOkq8/Df9BW66ISPATQrffb41HeztOsbr7piDrdhvNCnJ0TYkd8oGQ70cAnDV8xAZ1 O5M0W+1xl401Ts6RE0cACE18u2fmtMfttTfEoYe/Elkfv4adKVJYfiTI7H2rFSPi/sFZUmOR qooHwgnTpoCaG1Pjh4CCyavs6nEKlyWMKtcgOeAUVZlKuZcV8yo5nOBjjWWBhbowYSZW+hBf DRkyC/SIDBfN/qjTOVFW3o3GcMvjQCT9yKd+5iE6vWJ5LGdGdK4EpMHZCQHmFUPRXJ2e5qOy XHrpqjGBs3CSNPtS3rxxdqRLpZiVNareYWp/KsLHp/2zVvFRgyUwAh1bcdJd1iXrs2rJ64Xo +6UDfHIZFcs5StyUXtpu36kec7rniiazAX8hDpLhRnNEGRD3QVyDB6JSicmEoeh0OqeDjVfD DZf48FgYvX5wROFWHpVygEpRCfxk4pXy/ah8J2UXkFmYo3wAzXpWeDlfH7pz5fho0U2h568P 16sCIEvFfTw5vjh/VwB6k749nC4xiyoC4shjzOf+Y2pihkQ+OeLisGzakUkTFrOa//5v/1PD ojGWo1fSqHFt/QDP0hSKC6Xlu3Dxaxi9R4BsdI+b5BH47bIwcPzxm5N2T4SChe3dvoM9zvXb X5qZuXqZK+E5Tk1RhkvB9pPz8u8+UXhcdUh+1AiW8D2Mh+b+uH/aMHu1KdD0xcwMS7XcnqGT TOVW/Z6LK6499gfEnrjUV4YLrw+++/hmN7oqmzW4UQKyAFgmyU3hP8OvKcYamQOklHhKISh0 LrDhz1NyVdujWVNkBvSeoylQJQ20KJoCN45rSfMUdn6+fzn6oArOoTVFIaw/i/bvxLAujUjQ DoVW1ultlvqU9iv05ufsyQyH+yWiYmtk8akqYN/tGkKURm376eUA51m6uOClEcNGMRAV3th7 gbi2Ug4ug9Q8Vl3yUWEPESgZAjqmp4LgEkmkohRUCB+gAgjUEHh2wxCCwayvRWlnRDmJH0ao bADrrWInNDYHt4GzRiwHAU7W7S76DdGbxm5bJ/1JWfDYjpHX9+ji2IB/qdSBqlTuljyFQkEh LAyNt2BxB9n1RC9xgxDXJcWVD7LYxPpb/xEjm4L4psndej5Yd4XaV2Fua8BIv8rr91uD3uCs FycJhefA+04ks6glV9rjvFKGf0T6qRaJMuoA3eAJB2gw6jXGxut1uuP+5VlcU8a2IR5WtvHb uzhJwYHQCLnx4QrUxdvr7weakTFSuz9ut5vGzLaBsJmZzJLBPw6Nn0Jg4siSVvo1k9jsZqQ8 C6l7ajNUsAAR3SGtcd9XjjyuzYVMKA5kyZxPnsYls8dkSq9pLC0VaLLiwTx0tnHRYKOnJjuP nxdbo/awd3FAmO3k5CEtbX5wlNqXg+u3eUQ/OALNCui7dEqwdhX0eO9N78kVzVVE9Qm1GVOo wIbni9s3wvWEVY/nqszDM+SWq6wODyCc/DyBEQBKbuTkT0Ndvk7PIP/OsNZif0QH8/ypAHiK JTwOg8MPs2yYR04y/+CCvxtq62LIyF9504P7j2ZhMdwfJuWYHNs6pNiO8127ka9mybALdHzk aUKJViVWoT/ODvkKwmuJVSjnh/r0tskXH+HurDVdmsULa353eT3ShzEaz9k6BkVUJfHhrgjn nSdxekHmJ7dmHUpWJ8ppXbJOFoVk3VnJEGRmPv9+6T/O3dmda4VI3lIYM0tysyAuH1L7pXWL xqK5F4GDAJG3RDpAhEvp0DdxwwhhWur6QgeY+4XunMUGELt1LBSr04+3v/4S9+7Rn4gILmnv 8NWvv2h7LM6N4jghaZjPjQcIBUnAaiTVDYLGCy9kSRtRB2Y4nSc0Apz5l7wXlN85GFObB6Hv HHipxIsvELsW0zyJiDOs4/L7gkFrrKYyBroVHIABzkBUykJmx596PMK+cBcThNbBNhENSeW5 3RdoIF06dy4tMZMxf84mencntOrRuXA3lOjgCNQ4+TAWAH1KaL0UIoZOS9a5iaQHWmqZ+IZT 3DThspReTFmGdalxqIcTKRQMqYI4U/IvDu/EMixfG/76i/tlBeagZ2e//jJ5+vUXikL++oug chY+WJr84OGUF5RkSR1hj42/Uo1uqgRUoO45vSWJBefkEbI37LTG2qiyuh3Io6chcpRLaqMO 3FsX47aoz9nyIThO5Ad5wFdAXuQ0k8Q8No5Xcrs5oFaAG8b6OUvWzNfmg6U0j/lRy4tBuz/U uomOAnjq9yd3AqMCQoxLzHRvyUCILehu1KjXOm2PDxiENxNF+L8IjSbZR4KfuaODR8Xt3Go2 IxXSMFcgjYGzcGlWCfkqXx9WzXyCEP+aZmTQQWpTwcL0ju7oGo9BebSQfKYcg/THWRQk8xhU vLKvOGTZRRgGyJQCBBGf+S0UYRQ1vdvJQ5lYmuKiSYqRVoN2p99pxnU/CsPo3/Cw2ajVGjSY vtXDZtshosV3bAbf/tLM0AmbYKNtXjl/kfLtjjqNy9PCluMZoHhZswFTxqFc8qvzmfIwcdnq XTbb5WIicclFAvfpFZ+BXutKjj53pvceMpJs8vWeGy61LjxD55cFGoqHC1bTmgGhAdQixYwj SHo0eGBix1IRlNZQGQGd1Kp64bT96y9Xl6NE5LDoq2ApC/XxGMuU++1OY096Flo0VVBPej3V xi2NPem1cmUra288iNnsNrtDs/dtopiBW437S9mtoqQ0S4RpDbNEWOAiq9/ud7O2bUZw7lHq OZptNzCesRKFWfMWG3X6fQyMOYxCULl7F0CK6Yh93/4stdFut2rnsYRJNvqCbe7eSZyIVEWr 0b0cmhxE/fFqHMRCXG3rfm6Gvthb45q1haELxog4RWqKbUZ13JTBmqGcXZKUVGWB56siG2Hw 5AKlbMuMRG3YpD6KdFcoSti7krNy9LY7sJTEAhmB/rjVuihesFqI7mYEZeplTTjLZQGTAZa7 z1q20BazHLVtLy+BtHme2nP3lOTUcqnxx9SE8hrQ9Y+4R2jJS0QQoBV98hSmirVQkTIdoznR P1TiDYXMiR4GGorZqckmFbP7Gf4MzGEM8puTlpgpnuLalJevhC0SaOf7MNG6vNXJ3X+ZZK/D wOFMhEPFdrw/DPhLkyHehzaEHUOj6O81hO3g6HzjzOJy8Y0zlVHxKa1B2Ll+98mSvcu/p5qK b2wpY8fVqetjY0vAY/brfkTWR86st94tH3B5GZnXT9c3H5Iu3/ZRxvtrYxYy2Vf3XrkIuToT KgZMVtubYd5MQj4MxGZSWL/78d2nK70KVvH3hXe4g7kv2cQVsGd6Bk0dFWRwqkrI+qXQ85sJ BZr8PZM/k/IsTWFI+49tzShkBC7M/mSxFbbccV4N3TLkLLlXXQl0eu1+m+cWi9mHQggwg4Kh RulCOh2cOjGzdSQ010Gdbr99YW45fQ6L0AHP/YLqXFaGIC51RgWvGocKKUGEaePyohF5MWSS pCbxeA5seeVwJUQFClRZNE5bjeZlHP7UrIHkGOUQqz+eX2VRcpWMclQtRIYMM5USK6N3a4oR FVq1WFi+0KuetQFTDL7UVU0K36yNUAgauk6AUuwZlVgXkan9Tc7K9PoMJzXwHnDxUgogyfYU CR0N+2OMjTFhbn8YM9tgufQNOp2Lnrl2w6RrIBfCoGRsU062wkQgn03a2QFFdMorOhBrf4Qs d4DIjViZnOkvknZ1f4BSs+uJATLQKwZ5pdioXJ7xTBvOgEjMbLMevQgoqBiwVDolB1XBOqSL zkxbKY92KWaS8vxc6bI56x3eZp81260eu1Y1OQiuc9ocDdlcw80FJ6ed4QWvYliJAjX+T8oQ pjT6Fou7v3iZrKuk0tdfhGCLgW6oPpoiy0CX+5HdIz8U0XlvFg9fyxy8pjaG0UhCOe6NtTdt 4irJ4W7OGmsgrcG7Xws4fyLPJ1G/zfnTH+fO3/O5yxjBvsTY3vEmKy9E97I7ahjHYbVPe93R hfRi8yGjQP/jeWXOqbzHVbsDmQ2e0y81boncjvF5NrIt8XxLDCdNUIvvXDE2leyPipvC6Mpd 4tICd/YJ3YvDwHU+M1RG9ltnZQ1Eu6Sm3I20HY26fYwWkvtQThennJvEN5yMwzYugWMOmFBf P03xPUtzTfzoXiCl6tmWEljOiKedzmVXqwwrmZ0ozps50zILhtwDY/kAmp199bCtsYISU2OO NWcChW9rBt9OdCRkAXvU2MbRas7ujk1Cfzi8mtnC6LNLoSJ+ON3IeRFXsC52NrjPKtRClR0O 2/b1+GOS9vkAlo8529BlmQ9DzaJuZkkMyqV+qyzsHYnc22yYMPzHLDiPQpmaMZyJ2z18/ArY NnWQU5l2CIey01IDPxVAIG72ltFmujgwj8xpmGoWJHuJOS1+Lt7SBfo1w5jBinzUhv+AIxRu 8vYxFIJdIo6zEgb8ydLTVztybAUsMeQ9w3HM1FLbfixqamHztFerOUCfzLENn903yS6+p+vn 8cTCx38w0oKmF/IhI/Hfib843BxuwR9S1BTnX/+GOf8KMx3S+VfMe/kUN/PrDfzoOGwe0sCZ dzc/vLxh5JXj5dOxdHNZAjuJinNSpVuxf/Tf31wkNJgZpk2pRKUQmZHLwiskEhiDjKuuMcsJ 6VKSI7reTEzYTzt+5o18Q64zxfXjK2LW4ME9saUxC19YYv7B0ze1dZCYRaWSZac1FN1gmVRQ W24/7p91Rpda51X5CtZ+ZQHWJ3nNRiIqC8Z94KXg+165gQFUmzs3kiFZrKbdt5EZ8n1lDROK M6iUfmbNyJ0PLrBJcKTJJue9f9puNpuqd3wUXp4zD9NTVipFo/11e2On3eZl49QUim13OoNR nGM6plCsQs+amc7eeulEHeoM0ZZQ9Q3JkZk4dDsyHEI+z2wT2iR9Q3VPcF7g+i9YnVM8i4tu /EEUf84CIbnintpXzZg3a6v841odtsUMFzM3NDcUNHEyj5Q8wKRM6hVxzwosoHHKHWt3qmw+ YpKdDie1ZhodL++wi71I05DQrnwSbMVJmbkYHjrjpTy4FAwHefTQTt0VNbNxj9uLMK10toRw R1Y8nAVyjkQBnXPkqdJCg+9qPZl74f3my01MBCwjBlLhYHS39uYY44czaaw7Mtma3IPmoNkc V5wfM5MVwCY5T/NbUoqsAmlTqOXcOcnCHWO+l5lgnu/9p7f+0Jl+5ud1+TCOy9iGN8MFt6fi JF/7tnBWNpqXsEihAce7hFmJ+ggtLb5hfoaiuI+lYsXMbFTGkmI3RdFtr7DJLCo7khISOjnt dmcgZhs/0fDPPClsNdqDs4F6engGpnBHy1NqtXKI4N7e4ipeERxSpLqCvdl+ai5hOXtIoUbK IOnpPQlhxxYHQR43pCwG3MwnVijKjMR06tBUbrqCEiFp+oh5ICj+wyxs8leBTFy3OmMV+T6x y50POi6pKRuxTjSO0YMwUBNn+dma4nbKzyEOyDid4qjtgMXYNG3E6jC9O3phoQwEw7WxFi+y 8uPlnQleywYfY01aF7YTF22yxwGiFjN3PhM065AmuFuYVhv6KGhJX4h5c78O50/qfZjkQVN3 wZSFENHohlgidiw8blaECc8cQ+7xforXu9N7uqBgjhb06N6fFdCe3WGr1xubTmn6N/yUllWR VbKlMxcHlryIsQ5GEYyajyE2YsTrhbVegf55SuBi3ByjHO1wgJrt1f6lwBWQNT6jfoWI5A4z HPMt1RdpPqgAkVuqL9Iw1Cw0Zl4Mcw1TGugKEEflH18h8+WPwhYllMemenDlH2xfEtuHg9LW SwCSgKlO0pFiNNZBSdgPiNQF+pPWQW4NSx2hATtVoXI4nJi1X0oSjorhbJ4bp6ENrj7WI1HE m1bTNduW/GGhxyq5SYlViX94lKYaulTw9Ar9q2MpksTNNkqTN9V6+cs7nw50skB6m7E/eEYz rbSOH+8Zyo2l2ANck3VMBw4zrAg00CXEKX2sGIwKPE/UeZorKZVla9akZvRQDGYTsOC3aaWM 61fLp1T+5TrQFanYm7qldJDsOEiTZUW4Tu63e6NR/4AhCBs3JaJAldJLDoJh7MZEBL0yUZ0F dgXiF6e2cu5ayQLnOGiffbHKC0vcro5gKCKTFMWcIDS7K7NUgHW6au+OmmF3heU4UI4IN4vr OrMHBxfX3yF4TMWi/IabXbdUAXrF2atINm6Q2Uf7W4gn/4AO6dT046MzvEv/MZ+p0neDlc9U ZqfgBd1lJrIZguuseyRmkPHAeZGyIEjoUAok9HCARBJnPZ+7SN0gF0455OS2Dof63VpAD4fw 7FoVbqXSkB2Fyryhq+9gYpGBQ00KXYGHQpUwdJCvBY+Y3YMkc0hHbK+NFsoqZ18Il1ozsot7 DjvRBLk0UfyVMdElJTQ14GVaIi2UDdrxnXAlvr/g3StmfZZCblGNVIy/4kQXT4Jn7Zry8cNx Z3h2yMtlzQhK6B851MFQnNTLLFvq829WknFpu6enrbNGO85rc3lrXDYbZ8Zkt/44S3YP+612 l9eh66VCJdtCmeyWW9e2IYCQO+Pb6LUaQ/OsEv3xjG3g6BQSG+JfvJdNu0AZhBMQslAT+OYE RVIco8oTc/c2ih/o9RnKAbF8F8bD+NcrtOuML9jcjs3vH9jv/jpCrbD7/gEFwXzJhqg149M1 JuypyShk/2ZieLtUSGxC6xUVtdLWpoqC1I0DJig2o9berufegmOiEBjYntTm+lR50zKmIUqF Vimo8uxPrIg0cd+HkY8vz/p98004zXa72Yin8TCWFR/RlmqRPCXzwAVMAaC6wulUT44u5GkY jsLxks0ArPwJxcDhdB1SPZbRD8uzR91u42J4fPboFgeKbSGNYyUNTUn6OZ0Jl3zFvIBR72zc SpjFIf9QUSGZCjj8eYSGtC03gaSGvZFipEMbRp5TsA7z26mmDeV2SKaww5y/zmMVoTwqhc/s nQRTVrJHMCZcrfxKCYFRiXmuVWpBM+azuXd+4P3MChCpKhEZCF4NyPGNpJVLUSYl9h64/7z2 An77J2YCTP1AVk/Sxj+jv5HF6f25f+fx0JQBIUwXUKUlMmMvrJ/WszuquOQjAqAm4Fh41Eeg lyQqmpe4M03oo9B5KSde0tUMcwXCM9hNPI4Ca1y2YRgKwC4RygVlp/Nt6eP2oKzMymC3qILC G/ruDp8NzsyT7ABzBUxeJACyA4RHIQQyiE/lAikLslM2ZYedV0CbrQmWHcA7DsIYcy5/KapK ZbsS9lQBQ+2QUhLutlGLyg+Vri/98eM4UA6Hvdbg+Ir2U6ZZcbFrllKa+RFH9JMsq4BVPiua jT1LKsRNssgphEgzrVcpjEkGrDFw4CDZ8cgHDHqRu0ApVBJfEihFKSsorJmyZvxmIlKBWW6D 4zbtN5XPC/ZN3EF1qboj1ijOLFg3OECt7qnrCo+sc2tYW+NOr7UZgZG1j5oJUuQ6a12JilrM dqfRxdxCSZZ8nXuM4XMF4kKRchH8Kx51NsY+9aXUG8b0bzLC9Zv5TjTx3Q14tFiAxsO5xQHU w+Lb/+7xfBKA3tHTigZxoTKFVqcgNPvvirSKlq9oXvT6o2TapX3av0DqycQ32uM1IUDCIVQ2 B0HRj0Vxmj+3/JmapApOKoedm63GBRJECSz+f/aubTdtIIj+SsR7pUAwlwciAbkobZVWJD/A xSRuwa6CKVW/vjPrMeyYNRCV3WAzr6wB72XOzsyZC/9QEzT+eKKOJQ+rw5PQP7w18XCanPFV MIlW/QjaHEQzxQuFy3nyPAR/ZIkkGHvAQgZJk2LFLsEarr+RElV5lNZezqtabVNV/byfqHot KqCQ+0S75ZEApe+DHrPpLFp9X4bjOH194sY2JNpt7shjdmTyAxqhDIKX1/hBFXZQ60E/uACG Di1RkGoVPAElH2o0FKiHoZ7YIv4KRF0fPLXABNLgBoIUDaj2Ivb/xN1Z8JIkVtO6Y60g5PmS /aPztr7ehotxEHQqz8EcvIiPoMMMIkiaxpP02g0X5pExvEX2C+r/f0JOd2bu2804mbuaJkOg p9bFDz/d92hH1Nui2CVHDGFPtUAhmNic2QJOCx3wT3laorMJ4kaDI6FTSfnP5JjY2Umc8hhK yrBZG1GVI9SALUd6CATQUlljgQDQPkMAbQuf8JwLoIW2pXvARFujkpgEa4rd0S8i54DmT8FJ Ap2feJ6MoNomNEnUtOGsUxE1DeCA9Lg7MCAwZqEA2ifqLDdnh2pmB6E/DUIVMZCp5iFgJ2CH d7rYpJdkuNjUcCya2gh2uXEt5VXhRiOoCh+oPp3v1+LEDBUztJCaTYn9av2zU9iuo5D6WgiC gXtaTE4xOevGahjHMjld+5nMFtk3oKp+B0DbQG2CPMzD6I0rz2s0eqVakJ3Z3EaLtN2HHMTD WdL2bf2mlsmC2jBOREkJSyos6WmzpHSMbVqkrrHweo9+52DKlo1wnpS1C9kJ1Mq0vearDjLT IJduEfyXfiuYrnkqhSg2I/fpE8UOAM45pn/JQ7nE7+hgypYx/bCcTbYKZjWW6aUUG8OBTQ9o 5SMq2E9byyOosRSCJ8F+6vwMJdgPyO4aVSs5XrCfdmZtscjOIW8Pr+xgypYhD0pRUPq5wNqm sg8P15MY5nMOjnEg485h7TMT9q0gQAdTtgxrVEiDTdOoqvW8Rh0SEGAHtLD1ervZbRhTb2hl 6HGlqtHDaN6LqiZ5GSjLJx/GXHgBz3FAMXn/CFhzjuRnoKCmRZDY5hrBPJOTosX9cESXfDrK 3pJ8umLl02m6hi0T265iZsbtp/htOY6hT5mJJC8TbwK5dUvMRjcUNmLotnV1lXTjL6aYwIuN idn0jeDOIZycqpkPdyO+toiiqYumXghNXTuzxUT863s/9N+gz9AiBXkRdXE0SrEEcBdliiUU X9QHaabtxTya+LylzyF3ulzfcCepEhucgJAwkKKGgRRfpu9SDT1prjb/BTXcIDX43Ze4JtvN Xr3lraN8LTjRqWaNxDtIvMPfFFGPEe9QKldEboQuZiM4wC3nrvK164Vhl6aGaROHl9vmA21u /0e43bA/IPZ/A28UWxKjqsarLurha3xEwTl9pHGiZLyO1Dz3V1DEV8BKFCf0KtpBoXjHq2rz 8vCGvqN/AAAA///sV91u2zYUfhVCVyuwpLJk2bEwB3AcefCWpoLlDQOKYqBletYiixpJ202v NuxqK4pd7LYYuhdor3a5DeizNH6OHVI/kVSl9tIsWIf5IojIw8PDw/N95+Pdw4/Wdoijr9Da JpiLHg9wV3s83+ufajB3d20zl0kbcTgiM8JI5BM5KpI59TeW8zE4YDyYjrqarusdvWd0tGzo mMzwMhRy5qhtmFYjm3GVsWm1TF1TTtK98ISrPfEEXKxw2NX8kGAml8WUd7V2pymjgzAuLUIy E7lBq22l4YOF8pUeY/tR4XBxEgbL4neZjNM8aDudjoozdcYGNBIcrOZBBKfL8peEtn0nmcUH pWSu7QmlZwvMzjyBmQDPwbSrNVQmI7wgXW04/mzz47ebZy83PzzZvPjt4qenF798f/Hsj9d/ /rr57mWy823E3bgibieaXkatrug2onlYieYW9sSTFB6yDPP9ZJ20O9bBkaPqRKBHi9DmMfbh 6mJGOGEroh3CJe6N0Rf7DaNpoT3kLeM4JAsSCUQjNCb+PAp8HKIFFNQSFiEMSV3AMI4CvpA2 Pl1GgrAAYCvmBPGY0hmZIlgUoiBSYzC9CCIspE1ExJqyM0RnqJKomMFKh8n4xXkMQfKYhKEq vkotVU92+Dk9GTs7uYOaeLuzm4PTfikgCWVFK3C8nJvMvmH0dC0bKnBTeUZxUzqknPzj3JTT SUYkXe3ixZPXv/+cZG87oRSoS1VlEvH2dXVEpEj/5i7GKF0MXEchwHc+t4z/DQq44Q0U3uVG Q2c8QKNBH7XNpm4jzSM+gBRgG5J4TiOChlNAciDOkcvoBHCNAE4igbcE8oh8swyY+ubah8gj MUxOCEOG3mj+X79p6y3c3r+ifs3/Yv22LRu9rYDHc0awQPfolIRQqvd9Qf9GoZal3igVUVey L+jCjtnKeFmxb7+lH5sD1UkzSbYrpdVTYc401xZs9Q39QfMhUj/zY9et9thcHCQZaEh1bKhD Vem1nvd9GlLpQ+lg0NbwSxoCf9yX4lONG6kg3g0s4xEyzf0DcydWrsvVzcdUn1j7PUimJ5bT c6nKhvc85ESg0nzQYl6qyfpSk7mMrGRTACPZAo6JIL78KpFKvVo5apit/L2UgqiCrKKEMXRr cPQ+IMZKEVNKwa66AKq+rirfKP6v8d4nrgQL5DYFW9LAr7Vrxc+r56ACXj2/lqt3OoBpGpZ9 rW3LJ6iHHNIqruuepIYS0MmT9P6J8+XJ8PTTRsJKteaqgsvmRmJeYcdes+m0DnZmx+K9uixY gdBCziNBIg7o4khQ9RbyCJffaBgFIoAnEfwL2kxQYDH0gTd076AZMOxp+krqcXimCYBwLuTW gYByQ2O25HI8NeRX5OnyCQxZgoxfPuoLM2myWEHn5M2prg0UDwqt+JSuMtGoG9tE418AAAD/ /2SR3W7CMAyFXwXlBUhoKbSilfbHtItJFTzAVBK3ZCqkSs0q9vSzU8EY602snO84x66QMn6J 1rMnMRky31uzeYa6OrWYkxI9qihRF6XkK7mcy4dEFKsh60rPx6cm51fV5kLDEcGLabGaXtWA YPFx/zGCASSCcW7Vg8bSX4Lwc3+zbUkPuaL5Op2HEHuoDPgN1ODhqIG8eO4gF2acQkx8Zk0u /JtJOdiQ1c5RyP+G2voeb3AlR75rtt/UdciFUqlc8DL2VCfL+Aq8V5wZXUf3sQqIt82eoioV xezYOUR3+JVbqG/UcYZcLGaS4TEhv5GGXs0JKTHNPQbSru2J6rtK05zsCXOhxRbKJtTG6Vdv DVGtPUJpUVPkaJYwSbse1xzKnTPnUJDldKD/V/wAAAD//wMAUEsDBBQABgAIAAAAIQAz0WQe ywsAAENbAAAQAAAAd29yZC9mb290ZXIxLnhtbOxcW3PiOBZ+36r9Dypep0lscw01YZomMJPZ 7t5Ukq7dnZcpY0Rwt7EpWYSkf/0eXUwkIxuDgb6EVFcDtiwdnfsnWefX355mAXrEJPaj8LJi n1kVhEMvGvvhw2Xl0/2w2q6gmLrh2A2iEF9WnnFc+a37z3/8uuxMKEHwdBh3HuHGlNJ55/w8 9qZ45sZn0RyHcHMSkZlL4Sd5OJ+55MtiXvWi2dyl/sgPfPp87lhWsyK7iS4rCxJ2ZBfVme+R KI4mlD3SiSYT38PyI3mCFBlXPHkVeYsZDikf8ZzgAGiIwnjqz+Okt9muvcEUp0knj3mTeJwF SbvlvMhoY+IuQRSzQJC9jMh4TiIPxzFcvRI3Vz3aVt7YkoGsi9UTRUjQx0wombl+uOqGKUZK /ivhnYHwzsXY56yrl4kAL7qgRnQUyI8bIr/8By07y8vKxYVTq8BX+jyHAcZPbuWcNfjswbVH N7iseCBPTMRV6Oa9+xwt6OqBif+Ex6ubfRwEH1w+QoAnrBWM0GgZ+if+wzT7/jmnWOmNDRxF XxKaLPhjg4p2qyn9TvwxI/4BPvtRIIa3m3ZLEKhdrjXqNcPleqvJL4uekw7BCJcdMN/x7WXF slp2vV3rsUnxSzdgIJZVa9XtxjC5eM+v9ZoNx64JARBBpeeG9G4OVsm5TMkfWDKC89qx6oIm E/sZSbIX6nEhenLmnpQlnyqQlZIl9d6BToD74Q9Fc2jBR2PqHWBGcvz1slLnX+auB2oADmrZ 8aIggmm4CxoJokYRpdFst6cZ8S9k8F+CeEZNPmebtt1/d5Vw9vYKT9xFQNcFcaNcYjOdiwEk y0ac4aN+zD/jr8k0HEdMLnDDh+QaDquf7thloJM/Dp+ytxFoIfOxd9QlTH/98WUFuoBvoTtj BuRFIXU9mnDM0Jqbm9Ia7MuW/B76JIaZJT/fu+IXJ5nAGIq+Sa6wie5jhiCebl+Q3uFmJSbP /58LQ5M6Z9Q8bk1A4A+reQPLagxX5nsrbHo4cByHC4MzXtE8vTnXPHlpXfM26FpcHdz9TYk7 DiFsLTsYZN6Lffey8nVa7X80ayH3sFLsZAhii+HJqR+C7iTPCwXc29hMP/5chJ99jP7ruwYN AQtJFFSxw+TSJn7qLjXDkmNwTuCyoM8RhpyH+ylhGsLSt5is0bZTFialr1jY8VjdB2G66FPo Q2Dfkdn20Hk35L4mrbyFmC216yfi6c3Z7Rnnq4GhPCAJz2b0bzwtAMX7Yf2bLnPp37aKrMOL +qDl8GRGj6wbVCQ7lqbsbT2ipXtOwjFzRvc40AMVxEHFVNOPLjtqgPdp9fpeda3QI8NHHeZi wK/MCY4xecSVLtKURR+jhDsQBIBCJe7a4O7ZLH/JGT49RZU77SayrZxndyN9A7HV9ICJ92cB YXhl13oDrj4ZrkWlv9luXbC/vB5rvXqj0VR7PMysWo5Vy6JDxLVtNHdEeMii3QGgu3UVTliW 1fEhplhQ8xPSuDSFM0guCWrtujPoN1SBpFV0ZYUbNOnJdz9/drKYrhCgWPwhONN967FAvOBx +MwLNYpAX18yY/hBuf85QUUmkxNUhFChW8e6kxhxT7AjJGXR4QTYGGJSQPEJsDEPJeMr7Q4x oKXf3cjgtk5wLX8FqDgq54ZYHq5tlYvLbJ552sPk4t8S+55wWnpteSvd2D9OM6558uVisYr5 7/eDv99ff/yXI9fZje0bzFWn2rfFItXGQHmI1M6c9DJUeYJ8zK9IuLwhUV+DfEpCnk7+1chU BN8pC6oyoh1CD7rVllPXAqSSuTGkcSSYWRpiFhMZh59MElxQeva0nqEehOG7Ad8cbTKbctqM E680CMcwbb5vIzfbDHcaKc90RMj54EYTyNvseu7ih/TyugD3FbU3GP3bPHNRws8hrTYHl6fs 18ipvS1VFNE9MLeNCwWW3XAuBik4s5c95Vqbb5Wbt/SBtJ99T9nI2eyMSm/Od6LaPftqKNa1 9Gy7FIBnWiF3qHUrXnfDpcZ57QsFcuE54bGyiSsju7zDRa2sUkvh7HHTEQbK8ayKPihJ1G4R mL/egbfDsB/dEP3pw1sQmncXviu1WpBi6abNXb354fn8c23u6g7pVtsYMCh1IWbLyJzOqVYp pNCfwjt3+8o7dlHbV71aUF43MmPbvnRjPZrt5tJyPCdEOHMadkLzqbfb8pnYPSSaPxKMBjRf a2kRTIEDmu9Ugmymrufy67uH0sdbvTCbXxqBr9b5FMKSCCZEI/1ZadHQ7meWyYR2q+wGbr3p NOz0eqwJl8mGjPQEUeW/61t3XjcuM3I2G5fpzU+47Id/41YXqPpat34nX9SZrltJYY+Nu3je nD8oA+W9MATI9dd0oYUrI+DSOSIxQPZmt96cM1DxrPsHtj8X4NK5J5md/Tat3jyD2VsArnzF UVYJ9NB5wmBs8fQbnFnR5S/VZas4tr7otEldcvLSTAUpCcSgX0nVNmBL19GSGEAh4ft4MVYl aN/YScmBDwGY+bZn5huWRYHSCwMOCIZeBtn1pdl0kqD0uCVyEYxZ1+OcEbpfpws3rJUGIo2m 07sosEE0vKpZrSF/C7cgELEvxG7nKz10WDdxNseBa815vFdYnmzpiJ2dUhs3oKVJb7obXffk pcZ57RtEKfkrG0T6nXxRpz2AaS0dxFgocsPp82gyIGy9RBw4iudwsJofORWWKt7ekLuHJc7/ FUQq/3PDka+//A66aSQS3q74FiRmuPG/poX2s3Q5a1B0C2PfpwaslspEwOnbLbvd5j59U2pY GPcys7+Bt7xCdqTyFs47ucSbIj+MqU8XFKNogvq96/79G/Th+voerZ+cW1tYPQyVemZROi3a hj9mrWI7TplLm4eV17oQWJDYfDz7hz++mLJQjctJcPwOHPeRzJbva/3SbtoWaratmmO1Mt9g 1DilGE95ZwWHfEhylK3Kz7Khr8zdPvNg8dZzKdnlxJQRTu9nwf2157mmrYycPFdrzpOfzM3i UvnnKc9ldnn4E3Mpy8p3l5miLu84FHkrDmm3RY5tonm3P8XpJHblsNmW5Hr+cniizCkG7AoU SlwlxcUi4M8pUlYn40MEhc6wto2iJKeKaBNGHTwqgo7rb9grRBxV6c36lZvCKqQeg19wjJWd ntOk91qyWi3Eyq2DbJvW78jliFVVhWStqFAtnALAX3HTR1EDs6YaX+FK6GGaakQG9avmYFhX 8XIJTz4h1eFtBcbMWbthYLrdrNrW2jaAgdb9OICiZDWc5kWz2W5Xa5bT0KxM8ZEHd4jAILOA BxI7pCibQjlCEvjhF0T4WR1yPeaFuKZ+TCPyzGqkcTYa2JtcEnMaNOx3V5oq8D1CaMRzB1ZJ UNQSZFXw+qyOFr8OZb+UXW0mXg5uoPBm+Nabjf0zfgBlxgMPq76okQ+ms6KfUWk4YCSrzhnu JOUHX2A9dFeqtoRET4wSqKN4QwZP8qtSYPGlXKNtQTVSaKnXg1TqNZoaMBJHwao/8XM1klyz 0t+H2m23IaNcJSvteDeH1ymk+GRpR6XkIBC4e+VDyR2uGcesmggWqpaH3G5oJoSXkovsx75K c4qOeP8i2mwu/aYjeHWJVa9MxaOaorBbv6xi80PFQBtXOvhM4iKohlIpQhlCamcWhtU7BDZ2 e5RCzUYobLtWgGrTGC/gaa1Xs3dE9+DwEPwLI4pcNF+MAh9WVmBsNHPHGLmPUETIHQUY0QjR KZYt3qAR1GjVfNKasy/DATA0KDaISegG6Pr+U/UeJZV/tx1ze46wgcMxHqMoDJ4R1AFEixij 0TOf/gc8G2GCYKuE4pgtYQN1wIxnSeUd9iB6INEqRlBxGfXiOPJ81vwN/w1M9AmC+l9zaOs/ YlaYeTLhtyBwAK8j4kIfIJSQjQhtYQhoD6WOgSYovvvlDF1TFE/dIOBSG+F1UYmhgO4x0MZ+ PKMIOiMIgl4MBZMREMlUjPowi6VPp6zkLhcv8eHWkvhMBRHUGo2hmZxn9f5M4z7T/dXSMDNW QCTsQ5QC/u5NdkX+BAj/PwAAAP//AwBQSwMEFAAGAAgAAAAhACmGpDZqAgAAzAYAABAAAAB3 b3JkL2hlYWRlcjEueG1spFXLjtowFN1X6j9YXlaChDcTTRjxnE3RIKCLSt2YxIGo8UO2ee3m H/qH/ZJe51UYBkSnKye+vueee+5x8vh0YAnaUaVjwX1cq7oYUR6IMOZrH39bTipdjLQhPCSJ 4NTHR6rxU+/zp8e9twkVgmyuvR0ENsZIz3F0sKGM6KqQlEMwEooRA69q7TCifm5lJRBMEhOv 4iQ2R6fuum2cwwgfbxX3cogKiwMltIiMTfFEFMUBzZciQ91TN8sciWDLKDdpRUfRBDgIrjex 1AUa+ygatLgpQHa3mtixpDi3l/dUCxXZwyhYktHeCxVKJQKqNeyOsmCJWHNv1c4FtBBlxj0U zmsWTBiJeQljjfFm/uXwqjA8J6vtWKi/jYAWPbCRRHsP7BfOfey6nVqz2+jjYmsGA3bdRqdZ a03KzRGNyDYxl8dnJ4dT5JlKl4U5JhQgdyTxMelgx+6qLJgQvi5C0lQGcxt18jCsMjum3mVk cYw1r6clCUAEqaimakdxr4Isismw0noFgiXZ7LcbtUHafpSEww2x+PnT8igBaUXXIHDO5SJ/ 0m+3ull+zLVRS3q4wgPN+s9jhH58QdPx/Hk8eZlP+8uUW5n4YY6aSqKIoVdp1tuNwcMwbTOX m4uZEiI60diK1L5TqxsgV2SkPHyX3Zmx7rXD1WGjylkD1jYW83+cnTskN03q7NaD269Psjtz y9nWi/B1gFQSGQo3qN50rQj/6nmQdBEzmV6d1Cw+Rovl96/j+XiCEHxP+ZatqLowVzbvU7vf 64PhyxTVOuj36y80RIfDIX0av9W25JUaF5QGveFf1PsDAAD//wMAUEsDBBQABgAIAAAAIQCX 33jU3AAAAFABAAAbAAAAd29yZC9fcmVscy9mb290ZXIxLnhtbC5yZWxzhNDBSgQxDAbgu+A7 lNydznoQWaazHlTYgxdZHyC2mbZsmwxtlV2f3l4EFwSPIcmXn0y7U07qk0qNwgY2wwiK2IqL 7A28HZ5v7kHVhuwwCZOBM1XYzddX0yslbH2phrhW1RWuBkJr61bragNlrIOsxL2zSMnYelm8 XtEe0ZO+Hcc7XX4bMF+Yau8MlL3bgDqc1375f1uWJVp6FPuRidsfJ3ToUkmRjx3F4qkZyBhT k+1XQPY9Nj/Y7OJgQ2TM8h4TDVbyz/iLuJ7k6dSoMCbQ86Qv/jB/AwAA//8DAFBLAwQUAAYA CAAAACEAAji7lGkBAAC5AwAAEgAAAHdvcmQvZm9vdG5vdGVzLnhtbKSSS27DIBCG95V6B4u9 A26lqLViZxPlAH0cgGIcoxoGAbab23f8bBpFUdRusJnHN/8ws9l+6TpqpfMKTEaSFSORNAIK ZQ4ZeX/bx08k8oGbgtdgZEaO0pNtfn+36dISIBgI0kfIMD5t0V2FYFNKvaik5n4FVhp0luA0 D3h1B6q5+2xsLEBbHtSHqlU40gfG1mTCQEYaZ9IJEWslHHgoQ5+SQlkqIafPnOFuqTtm7kA0 WpowVKRO1qgBjK+U9TNN/5WGLVYzpL3WRKvrOa6zt1QrHO9wILoeZXfgCutASO/RuhudCzFh 12pPD9gjloxbJPyuOSvRXJkF06/H2fyX4a1weHSsTXvUTyP4FvnJMkVdGo4WSV5a7ngAR9Ck iozEyRBo8YrbWrxkhLHH5zVb7/uIwbSTJW/qcOLp0a4/FhzNN3Sw4WmH/3mPL8oQYIIyzbAm r+eS2H8UXSRfU4eCZ6k+/wYAAP//AwBQSwMEFAAGAAgAAAAhADpb6MFpAQAAswMAABEAAAB3 b3JkL2VuZG5vdGVzLnhtbKST227DIAyG7yftHSLuU8gmVVvUpDdVH2CHB2CENGgBIyDJ+vZz jt2qqqq2GxJs/Pk3Npvtl66jVjqvwGQkWTESSSOgUOaQkfe3ffxEIh+4KXgNRmbkKD3Z5vd3 my6VpjAQpI8QYXzaorcKwaaUelFJzf0KrDToLMFpHnDrDlRz99nYWIC2PKgPVatwpA+MrcmE gYw0zqQTItZKOPBQhj4khbJUQk6fOcLdkneM3IFotDRhyEidrFEDGF8p62ea/isNS6xmSHut iFbX87nO3pKtcLzDfuh6lN2BK6wDIb1H6250LsSEXcs9XWCPWCJukfA756xEc2UWTD8dZ/1f mrfC5tExN+1Rp0LwLvLTLEVdGo4WQV5a7ngAR9CkiozEyXDO4hZntXjJCGOPz2u23vcnBtNO lrypww9PT3b9suBovqGDDVc7/E9TfEmEABOUaYYZeT0XxP6j5yL5ijZUO7+2/BsAAP//AwBQ SwMEFAAGAAgAAAAhAJa1reKWBgAAUBsAABUAAAB3b3JkL3RoZW1lL3RoZW1lMS54bWzsWU9v 2zYUvw/YdyB0b2MndhoHdYrYsZstTRvEboceaYmW2FCiQNJJfRva44ABw7phhxXYbYdhW4EW 2KX7NNk6bB3Qr7BHUpLFWF6SNtiKrT4kEvnj+/8eH6mr1+7HDB0SISlP2l79cs1DJPF5QJOw 7d0e9i+teUgqnASY8YS0vSmR3rWN99+7itdVRGKCYH0i13Hbi5RK15eWpA/DWF7mKUlgbsxF jBW8inApEPgI6MZsablWW12KMU08lOAYyN4aj6lP0FCT9DZy4j0Gr4mSesBnYqBJE2eFwQYH dY2QU9llAh1i1vaAT8CPhuS+8hDDUsFE26uZn7e0cXUJr2eLmFqwtrSub37ZumxBcLBseIpw VDCt9xutK1sFfQNgah7X6/W6vXpBzwCw74OmVpYyzUZ/rd7JaZZA9nGedrfWrDVcfIn+ypzM rU6n02xlsliiBmQfG3P4tdpqY3PZwRuQxTfn8I3OZre76uANyOJX5/D9K63Vhos3oIjR5GAO rR3a72fUC8iYs+1K+BrA12oZfIaCaCiiS7MY80QtirUY3+OiDwANZFjRBKlpSsbYhyju4ngk KNYM8DrBpRk75Mu5Ic0LSV/QVLW9D1MMGTGj9+r596+eP0XHD54dP/jp+OHD4wc/WkLOqm2c hOVVL7/97M/HH6M/nn7z8tEX1XhZxv/6wye//Px5NRDSZybOiy+f/PbsyYuvPv39u0cV8E2B R2X4kMZEopvkCO3zGBQzVnElJyNxvhXDCNPyis0klDjBmksF/Z6KHPTNKWaZdxw5OsS14B0B 5aMKeH1yzxF4EImJohWcd6LYAe5yzjpcVFphR/MqmXk4ScJq5mJSxu1jfFjFu4sTx7+9SQp1 Mw9LR/FuRBwx9xhOFA5JQhTSc/yAkArt7lLq2HWX+oJLPlboLkUdTCtNMqQjJ5pmi7ZpDH6Z VukM/nZss3sHdTir0nqLHLpIyArMKoQfEuaY8TqeKBxXkRzimJUNfgOrqErIwVT4ZVxPKvB0 SBhHvYBIWbXmlgB9S07fwVCxKt2+y6axixSKHlTRvIE5LyO3+EE3wnFahR3QJCpjP5AHEKIY 7XFVBd/lbobod/ADTha6+w4ljrtPrwa3aeiINAsQPTMR2pdQqp0KHNPk78oxo1CPbQxcXDmG Avji68cVkfW2FuJN2JOqMmH7RPldhDtZdLtcBPTtr7lbeJLsEQjz+Y3nXcl9V3K9/3zJXZTP Zy20s9oKZVf3DbYpNi1yvLBDHlPGBmrKyA1pmmQJ+0TQh0G9zpwOSXFiSiN4zOq6gwsFNmuQ 4OojqqJBhFNosOueJhLKjHQoUcolHOzMcCVtjYcmXdljYVMfGGw9kFjt8sAOr+jh/FxQkDG7 TWgOnzmjFU3grMxWrmREQe3XYVbXQp2ZW92IZkqdw61QGXw4rxoMFtaEBgRB2wJWXoXzuWYN BxPMSKDtbvfe3C3GCxfpIhnhgGQ+0nrP+6hunJTHirkJgNip8JE+5J1itRK3lib7BtzO4qQy u8YCdrn33sRLeQTPvKTz9kQ6sqScnCxBR22v1VxuesjHadsbw5kWHuMUvC51z4dZCBdDvhI2 7E9NZpPlM2+2csXcJKjDNYW1+5zCTh1IhVRbWEY2NMxUFgIs0Zys/MtNMOtFKWAj/TWkWFmD YPjXpAA7uq4l4zHxVdnZpRFtO/ualVI+UUQMouAIjdhE7GNwvw5V0CegEq4mTEXQL3CPpq1t ptzinCVd+fbK4Ow4ZmmEs3KrUzTPZAs3eVzIYN5K4oFulbIb5c6vikn5C1KlHMb/M1X0fgI3 BSuB9oAP17gCI52vbY8LFXGoQmlE/b6AxsHUDogWuIuFaQgquEw2/wU51P9tzlkaJq3hwKf2 aYgEhf1IRYKQPShLJvpOIVbP9i5LkmWETESVxJWpFXtEDgkb6hq4qvd2D0UQ6qaaZGXA4E7G n/ueZdAo1E1OOd+cGlLsvTYH/unOxyYzKOXWYdPQ5PYvRKzYVe16szzfe8uK6IlZm9XIswKY lbaCVpb2rynCObdaW7HmNF5u5sKBF+c1hsGiIUrhvgfpP7D/UeEz+2VCb6hDvg+1FcGHBk0M wgai+pJtPJAukHZwBI2THbTBpElZ02atk7ZavllfcKdb8D1hbC3ZWfx9TmMXzZnLzsnFizR2 ZmHH1nZsoanBsydTFIbG+UHGOMZ80ip/deKje+DoLbjfnzAlTTDBNyWBofUcmDyA5LcczdKN vwAAAP//AwBQSwMECgAAAAAAAAAhANuvootDFwAAQxcAABUAAAB3b3JkL21lZGlhL2ltYWdl MS5wbmeJUE5HDQoaCgAAAA1JSERSAAAAawAAAHgIAwAAAMIj/AsAAAMAUExURaLE2YeVxOzx 8oq20sTW37zT3dzm6dXh5ZiEp2SOvKzK2pG61Rs3j/r6+qWyz+pnhfLF0ChElpajyeRUdnWl yLHN23eJu/Hz+DhTnml8tPT19sbZ4K1ojsPL4oejxs3d4mqXwe+xwNDe5J3B2Upgp7jS4+jt 71lureTr7ODo6u2Rp4Szz+Tu9N7n6uvv8LO92OLq7FV+tOQmUvKfstjj5tPY6csqV8ja4fP0 9cDW37rM2t0NPefX3rbQ3O/y8+br7aS30Ja91/b3+Oc/ZqQMS+MQQPvg5l11r5qvyy5MmlyF t0NaoTldorPG18rU3+p+l051r9bk6r5GcGMcaOLl8Zm/2ERipt/r8n6Tvs+Zr8isvazD1rzH 2kduq8aAncvc4+Pm7T9lp1Fqqc/g6tgYR5Kvzc7e5r03ZbvF1e/j59nf6rLA1cnc5cre66m9 0p6tzMfc6c/a4/Hz86fH2v3w89HX56Ww0/3v8qfJ3ePs72BXmOEAM3+xzg4rif///wAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAM25c8QAAACAdFJOU/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////8AOAVLZwAAAAFiS0dEf0i/ceUA AAAMY21QUEpDbXAwNzEyAAAAA0gAc7wAABNNSURBVGhDvZrtQ9rYEsYDCFQgahDDiciLQImI ICouUgsivTWGRCpdtdytrCu+tFddbXHXyhrCv37nJAESxLb3g3ewQgPyyzMzZ86ckxAd1bYm tBfP+ERo302ubD0jRf3qLqvz+h353LAeq/NuVn5mWJ+19ebb/40lv5t8Zi/2dXUm3q48rzAd Sx5/+7y5qGN1vj08rxf1rM67h5XnzEUDa2v5Wb1oYMnzD2/+er78MLA6W6cP88/nRSMLIvbw fEV4gPVt+TteJElvyvzHHlgq5ZVL/7OzB1jyysPD+DAvbmz4b0wMy3Isyzbwb5q+81/8b7gB VgeEPQwUYZK8WKxFBZY2uYuHn/2Vr5XDz5djbppuCNGa/2/ypyvbIKsz+/CwrC8fqQs3y7Om y9WNmLnZNJvNsVgshX9a8UyFbgsCY7qY/jl9j1jf3jzoysfeIsu76Mp0qQDfD7YxB5ZOx8GS Nls8zrGHgUaUOyz8DO0RSwZhWuKX9kxRqs2uNpsqSKUBToEl062Y2SaYCvZX4GHTxo9d+YjV IUHYW5z4q6YowyB3qbS21lxrNpvw1GwWCqkUprViMf9YwBSouV61bEn7dkNw7/1I22NWZ2Id QvYt5UZM5VIYu6jcmGo0BwapV3OP+b9mzNPNpj0QRXAqDEtRDfoyvJApNpB7+vt1YAhLHgcv TtbZSuyzi2KFKMvUgFEsKkzIvQZbKxYFdiwD8pLxMCDRgcmXDG4LDf93HTmE1dl6C7CZj7Tg argvK3+QMjxKJBi8aMYrn9200G7Tl/a5VMtmS28L9hGTgEzBqo9Gte85chiriYU9/GOihTmy NA0hAoNQNQv4ZXO6VCoIpkM6KnA32dScLdOotWzBbXRwXQ1/FITK09KGsMia61/AWt6qu0up lFnhrCmGU6NgTk1fCxupZuzQ1EBc0WYuokomDKKo2tHJUY1ffLJ4PWbFuDb1Hgv7FK02VRRg psG0RDSTNN2E1Dc3459pJAS+sjVbOFxtXYtMLngyhkzeJxLyEetCaDMjc5D3Dw/vSbOCmlZI Cg0rM8ucu4lHdTo9F7PfRAUBhVvBy+0A10Zso4HajdjwfBxkVXjqGurPLOT9w/pKCVBYU0k1 DUbStWYspgzpdKw0d4Pa0Yag5CtPBc4C26wwvIwMsCpUYzU1F2+ZlfRYnyiZdagujHSz00q5 ipnTOwGucYDaLs5qD56fWAUanqycMNSNRtbfPB1vxePpdPo1zvuH5dekqgpnPEkqsLXC2ioK m1MF89wlLSDWdP01LNANFDgJZ893qMBVznpVHqrMwLrga7F4Elhzc+Z5zHp4kyr1URqsWSix tJw6pA8EZiycTKVtczRXdfONS3v2JICsOWsuxwqxxwmiZ8UEJh23KaxWSk2Ph3EcJ1VVV1iz QFaQiUVMMW2GymHLZDJ+tJMcYaiaLzgi1M6t1nyeYx9PNDoW2UAZm01lzW14JxQvPrwraTVD Vlil6TWStNdcbfdFszkH9d4GLLuNpW326jYSPlYDQi4HLIdgejSo+yyZdh3GAZaEcM3NtRbU 9ID5RVEkg6kw+YJG3CLLrKUwClgAs40hXzhYzTFU4JVwDaypfIRaHMz8PuuwTafhrzRWLDVd xNUDbEXHIhWSnyQziEmleqzMV2GsGswenQR4Ttj2AWsqH+BXB0LWY11QVAWfYdeHqcJXFx5k kPmzWJEiSy6YEFcpkVCnKgKbTCm6wIf2FsPZg9ls1r5z0D67wizHSwYNZH6XRTIuJm3vs2Ix 80bjvRqy0wnMwbhF1PDLJeg6UqlCkkOH5jnoBDArWRSywPL5gjsuqujL56cc9w6xZhTWZRUF NGbrsj6YF6CJIQNLk6oX3yow+Q8OFUlyrQnlN5WKFVI1nrab4wrLHhaKYYW1LTDUmU9hnbn+ NsA0VgGZDip2jdV6vTIx8fo///n8z2/QwanKQNQdojdkaAhwqccNyEbzsIFMmZgNs2wcUwUf BnOIPqnxtdyU4/b2fjRqqPkqS65x2w34C+xDWzKdWV4/XQZbP1WdiJUtcOizTE7D9K+xNuZg eI1FUe1VJh2v2twH1XP7ybXQyPmyAVfNCiyCQHd6YSprj7cGmDBmASweX1CLht5O/6FTslZ8 FRdC7YXim0qOsahRu9mpvOKvX21zFJPz5ay+ABXKA+o+ZCgfCktmmBbNgC5FGIxlm+Y7PW0F +0+bLbELAYWbxLnYKzcnRBFy8dCXFo9GclawABWYIsAO3DphCmuP32kxNHa7logL0NY/snel kjIva9FSukSchsm07av18yuGtebOgyNQNaBsWGuugIOIEB6ka0AwS4bSaWPoKjhRg32wqdXQ aOMFmM8wCmRBtNSRDG63Z+xhOwQse+Tzaax8fpS33EYi+8d3/eqBWXvo8qha4+AP+sKUyXLQ Jl/DTK2herKUjA8H7R/RTo8FQ3lqF+0TkUhI6JdFYMl3bDBbNXHhsAJTym9yQauGRtzyBHQ7 Sr4r0VJcqLFOXqHrI1UWlA2Hw0GgOhHZd6LFXsSAZY6ehbN2d0NjYVg83no9JD2gXs2bvQva /G9ABY/sjUAQs3CVB9btvZMaJTb3y4yetYpGYBDuIKsCU9Ie5pUhea9onHxtVpYPBlXhYPCo yjDBETVc4EIYXfc1Soo4JdQrwaCrRtt9vmxQ2Aa3KxFTi31LK1CDQVteWVhQFyp9D4aDR1l7 jVV0YVnAgoS/30WbTiffcyLRIaPbENPsCRQZnReT8Q8Tp0PSQ5WmqeoGC6Oy4cABDC5NFmZF Ik5+CVhct9wTHb+Qs0Gn4v16WGo2vbD68cYzMS+e+SdWhtv8BFlKJZNmrT/1Fppes/kke42U 0ZW3LbRarQ+KjYxVCdGV0iJGdIqcbwHPun3bsDeNB4b8b9pmKxkOV32v0A7UJ2veazjuOG53 qz0hc4FcTHbjtb368Mtpe0F/oPtG/5l1y2uYVcP7AvjBVuTqiA8RmDVVInvHGxfyfd3VncaI vWhxZEFm2z27kdPhgv5A/63eqwawMtMy6h1YxCzhLItbjRLJ94775YAocl0frjamrAsyM8jS HRjKamaABcswze7kTG4k6s7ihC+R/eOHcsNVRlrpIPwHVmtML+PuJ3SxcjNjN+qyj/gO3NDV 5B0lsq/XL3MuSfSrwggT47O2jLriwYLMDVHTPySoLL0uO9alsfS6aJdUv9FYdMiXbxl1xY/M 8g3LMhw8GKbv/DZilCMccyMX7IO6crloADc190ZdjXa5TGusRiAHLEO8MAuWxvgH/pn6ckxK R6ocV1gGXVZg5aBk3Orj5Zfpulg2aazomXVqQJctOOe/S8E6D5qpkkzrWWuFC/dNjDQX0uGw MV4nGstx6zXEi/DwS6yaHAQq5oFl0GU7OkK0LYiLYzgm1/SsuP3rDaz57TaonWsGXSdWK+jC ldCYh4QkHjeUKnVBIGLqkS67SQjDl+FSHDPqitvt6bAbaCM2+5phfJ3kgWWFtpAwxouQlvio 0ggsYpYjbtSVHEFuexCzwuGUUdcH3ABV7e4DxHw0xus8bz0IWGHeIryG8UVIIVdD2WhcBZYD WLq6cSeba4IvCAao4ICu2eoJPgNbGFo1v0HXeT6PtvG8FTHqikiSS1A3NQkUcdwmjbqyKGDP Hik0YBni9Wb8T4AFg+fV8KukIV7nU1N8ceoWWNNGXR4LxWss6sxxO6CLEUZgPsoeHR0FjzaM 8XrzMFk5CcI78AGvMV65InJAajyOV0JEGstVmyIGdEVRLugDGOCyrQFdsIT+fILPJOvzGnRd B2j+7CzgqbF7uuOHMuFJ1LusdhmzDPGCRbcVpmoFlx7UBZsDv/2JVyS+gkEXLVKUANsqYn3P OL4kYKkNKUEd30YGdF3mBAGUYZjvsS5YSPz7zyuFpa8bV1PcbsRZ3CegRunrIehaiqpdACG4 nIO6qr4RUIZhPt8QXdBxjPuufCPGeH3JR0chWETEOVA3pESvbjDtEFE15qHd6oMNimvorjDL mIdauzP5+QvM5lHd/JUlUOAWms99YBl0SVLdpPbZBO2qR6rGeEFp811x/Fh4xDdi1EXCNRDV ln/7op9haXnhTG3gnffyhat3DhekU0rsduv8HeKlAV1Q2qwjVzQVgJ45btSV+b0LW//9g24K cO3Jl8ebkf1N571XDvRQVKxkgdzozl8X4nH9g1EXlBuwKzdFj/iSxjy0+37vLSrGZX+/LHMl 2XwCDXZSlg/7R1n5gyRJQndeXo2GqJfGeJ1PKTDfNTrYWTDqOsl9+a0LO93SJXdbOFRbtT1T 34Ntt/xSkjy8tl1EeBsewW3UdTSVh9Va3urLc/yiUdc5bGx1F+wP72S3vlMQaPeNiaV0hxBJ WiRLudHto+TarmdsoB5CrcG4fC5XCxh1wb6W9cu1toRZ3vpBa7cof5GkhKilBtwPsHjg/NOo K3vrwDRFXcao6wifgnVHW1aMy3t6GYPtkEk2Q2Z4+n0vrCo9A3noA5ZKm5qyGXVdYdZU3jGj puOKvNd4quFyuWUSJpTEMdVdMsOaiC1XZd1f3Mg5AqYGjAOrGnVlMR/OI6+m4zpsDtzoGi0d l1mVSwSgRttMd0MFWHfoBPbzXJRmd8AiMO1eZZl678CZ+rRTcNz/W10xjX+TS4cMr8s94Lng Qo4s2zYh3yW+vailBr5/Y4F/aVyI5CIqDMTdVgfegm0mxz2cB3F/84sCO53fgo9c3MEFxihY g6Pdfmj55A8OTAIP9ncdgFXiAt4F8/mqF+94XeyZzS8jGIbtlvgC6zFYX8FP0r/aJHPKKeBF I3F/rVwxgLI/OT8xsGqyvYRIKShUp3ubDnjPoYKkhHOU8mw6N51iiNjfj4BpNFUflkiM8mIt MgWlXDH4xMeZ7rBef/tmfP5PvLqrfsk59hMKSEpIx7wHaUUD11745xXKiYSlzktOZ0IMRTY3 N/dVXg+oaHREaJ5fOru9h3KumaZM1ffLC6gR8OiaJcQjqXzQ32pT9oiu+YSUSIh8ArP2nU4d zcC7j3gOqIOQhbgn4Fy2X3zqFmL1ef2TqQeSLNKuqy4l+DHjvk2nhEYBJomiJYEwC8M290Fd RJXXM4jSWRnxx6HEvntmyNJ9/X1A9V5CWqL4kCVR1m3bqPcRyXe84l5elMSQ02IBmsrDzhyw yH1E4tCvv/TKvVHb6UwAohWqU/wofGEC6mk347v3LJEQMYB5EEKYBTQdr89U2E73zLCNsR7y dIYTqeMQ1mYpi/pNem1fdJGCs8BubIeckCeqKfIMtul+8f4pRX1967/WLGoq8od9Vb17sWS2 blHdSIGXe7RB3OZMd1PW6LmB/52+wF8GEzI3ZL8XFixUCJ8KjHNqFE4K47ryFI8qD0C/eGoz RyfrPQ4ZLoW88Uppd89cDuD0gMmmXKZ2sT8xTidQc6vFeWYYU4/lrb9/AZFSfeQ2XuXoXXco NbAXLfW6M0SJCgx/XAWqTOUZjvSqxRA/rr83aUUDXNQYuHrTv56yR5Vhwt49hnQU+VHF4X1T OZqZ1Kr72E5nXvQ+ZCnz3X0oXZ3XXsp+CBlkKZazhIe8kaYHS8Ok/fIealTPLCHKkINKL9pP StnNe6CGeQBi8fAg7WmaNFCe1j/NvDCcXMLDBx5djNVf1yvRIIpX81HapeqeAUcapRkS8sXg iVH9qaSnxnC90sscW8QlLS9CIrX0PUcGDAk5Y4iuhJghl+oNLNhmFpdETU0iMUqhMtTrp8zy j74mflKrrpq+Yq/HGFI3uoe8LE/1ZiBcrGEGeCJsliVqVF/rT7s5CAOL/onryx25wLSXnP1s 8uxSYhmX0UFLJJZcoUTCpMvIddWPCQ81VJUhD1VtJRoqYt8dFs8STMaewdAnErsUzHlgpvd9 T/4CAxkyufbEnQ7GeCmwOxe0BH0d4EkEc4RuLCudBNXN0oSpnySnM9Iu737qDo7HrA5cqT42 pLtFCh1T/G5IgjKlnAMefngYdnNBp+1f/zwawsNzvnv0ghlIiYTFUz7m0e4o4CB6owNlJSEF tMuo0C++e/JG0CG6sB/HQJoxIyyAE3lK3PV46lTZiSVq5VwpzFLtk3Y5+mF54gnacBbMZzS/ OzC2EpAyoSWx7WqjpdFRDx4aUPyhT/OEynVRpFy/vtFm0smJoXdMPsXqkH4WT2TGbE9YQsd8 ubwrQmPCg4miCL8RL9Z3RZ67ImfHVdryUEc+yerIXriku+TBaro5kPAc4yqJ1XhATWh0aakc CoHC0K7ILpbkDklOvFtWxgC0+fqSobx+moUb4kNOEKH3wurgF2RjP4raPIpDNSqKjL9XKbZm J5WyvDw7SPsuC2h/wybo7ijExgOjrA6jTDfwICckz2idj5r29KOX/LaliHv7ZpY0zCs/YIE4 smKKHoh8G6IH3Y2uJ5BC5WPxIGq6GHILCojDTeTkrP5+8h+zAGdeLdKsyIvHu+XyaAjiVF7a PYaMYN03F0/dVLa1Na/cFzdruDb6KIbDDsDNKYdwxyjNNKLRA5ZmTHeHF96S/L175Uhyax5G QX8A/JSunzqboR/agrx8Oz6hevKZWZ3OX3/Nji+Pz/4FWfLsLCwIMmUesuT/wgJ1W7Ozf/0X vHEVdKRHia0AAAAASUVORK5CYIJQSwMEFAAGAAgAAAAhAIXgsdlnEwAAJ1QAABEAAAB3b3Jk L3NldHRpbmdzLnhtbJxcWXMcx5F+34j9Dww8L8W6qwshylGnLa+kVRj2OmLfGpgmMaG5YmZA iPr1+/Ucggh95fX6iWDndFVWVt6ZnV//4ef16s2naX9Ybjfvb+RX4ubNtHnYLpabj+9v/vbX 9na4eXM4jpvFuNpupvc3n6fDzR+++fd/+/r59jAdj/jZ4Q2W2Bxut+9vnvab28PD47QeD2/X y4f99rD9cHz7sF3fbj98WD5Ml39uLm/s3988Ho+723fvLi99td1NG6z2Ybtfj8fDV9v9x3fn N8v24Wk9bY7vlBDu3X5ajUcgfHhc7g7X1db/6mrY6vG6yKd/dIhP69X1d89S/KNfXo77vN0v fn3jn0FvfmG33z5MhwMou16dj7sel5vrMofVP7POmZ7fLe/34/7zbxb5Btf2y3a7fvN8u5v2 DyAo7lyJm3czYLdfbo5tPz7MpB1X+XGc/572f18ujo+nX0zr+2lx9/lwnNZtuzkeTg/vgTP4 p2x/2B7vnvb77dNm8adpxLMuuG23WPcEnnf7NP19v5xZ6e74eTUBt3G3+2Fcg9u+v/v7iYTP t6txZsjF9LbUG/zi07RZbPfflvc3Yf7vYrX67ysPW6nmR2DDh59OC76/uRzw/7fX7vg2/eXL veTv99Kv95JXYm63H+6O43E+z2E3rVYniXpYTSPu8vn2435cr0dIwPnJiRaH+fg/jpupnfi/ LVegEn77acSl6yYuSy+mD+PT6vjX8f7uuN1d4db5886Pn3eP0+YkH/8Dkb3CjbJn+GK+qD9d fjTlcXe+xsV+fAaKf9wvF3/a7pe/4H7H1d1ufMDD6xq/sspieditxs8vPywvb1dok8/XNy6U v/wed3RcPoyr/+vXJ1Z6BAvNhCjjcTyRZ7P98WnzcHw6He0/p/0GmJ0AD1dOvaCbgft+u7ri cDpw3q53e4jVhUaL/d3juJvKmZSHb77e3h7mBxfaHt58up1+hnBMi+URCnC3XKzHn9/fKGEG NS/x7vn28XdrPN9+AGNvwNs/7meBuv4PiCwX72/eXu7v1eMTibDe9fH5XfD3y0KX/7xa58un 12W+eBGqdzceZ1yeDlOr342ft0/HM/ovIOj+BSjwfDv/8Rec4Eo4IbxTVdQzzWboC0QIoe3l dl9DTHKBv+OtuHDhq3ekVYHvo1xpfB9tWr6Q9NVq2jrN3zHCKI6bUTpyDIwTOdLzWOlt5hDV oqEQL0wZOERFwzHwPvoT253v6De3MCghG11tsCI6DnHRcwyCiB3qBBUsP0/QsXM/wWrLbzu6 FjnWCbTWFOsscue2s9WFUyc76/nNFV0j54NqrObvVBMV36dalfnNNSlCoedpKjhKHSlEEHQf KaTXlG6A1EZlQQr1q2X4UkokBDh19nGS36nES5ryjpQyl8ROKqXzrQfJV+fjFW4QrErpBhNU A+VEqXSxlHek1lJwDLTNiWoKaaQ0HAPoA01vWxpfAr8Fq3QP4r3kFAXvGs4h1teB4wbUGtVI 0mm4zvR+nLGB7+Ns8Z13fBqolMjBpsIhQWjBby5IlzhfB5krp3UUTXAaRClLB6JwqZQG0TTL sY42Gk7RJMXAsU7SN0f3SUbqi5/2iuOzUpJjnXXHBstsSkfmiopnR+W1xZBFm8KxLlYpjkHx paMpqtQdulWVEl+t6kFxWlfjB85v1Q4dKanOc4shq+vYLNlUalxTNJU7GraZmDjWzcqO/DQ3 CE7r5oOhuhf23HDfRQkdA8VACWcQFp184S+5Simd+HmUVtFL+g78KkO5V2kbdAfiXKJaTBkX Bio/ygopqVZWVrrcgfiON6ic8IHeqYLmqxwDp1PoQjKVUzUIaTkNBuksvW01GMN1rwrSVv4O NF+H1kGZwjEIWjoqPypq06Fo1EPmGER4dvwWopFc76jo4N9SroouBo51kpZLlkIcYTlXJW+u 4fArjk++WS4LWSfXgZge1tkO3LNT2fnKOST7IXEaFNGxp6qI1jlpmR0eStGiTOIYFOMUp1ux Hd9fFec7eqfKprlkVR06Gqk6qznvNBV5pKeglQXXb80my0/a5giVUUcjQK0UAw09yiM9eImN RxIa/mizdB8lLJcSrWTiXppWBpqUr2YRmFAIkCv8HcTh3HPQ2jZumbT2Hd9fG2G5ZdJG2kYt OiCZc7w2JmYqC9q4qKj90Ra6itPawnWh+hqBJgwQpRt8ZW7NtBdloFylvQqByg8gmUf82muT +P34mXAUN2/CQHWiHpxqHIPBWa6RdAAVOHWCTTwO1sEJx3ELPmRFsY6iOH6nUVdu6zUiGW41 dbTe8ZNGlzu8k6R2nHeSqZHzAexC41hnUTucCJ88Unuqs/KC3xy8de456OwD93sBydxqIrFR Jd+neBgGej9VKB6XaHjegmpyJJc7PrluMnZOCjurOG7NiUQhMNrqmof+0m5D7Qguc4BkHs8Z 4WKjEmyEN5retpFKGsohRjq4SYyiBvqa5yngqrtr3v3VebRy3MoAsaQL3WcODvl5jBk6uBmv B8oHxiAwotxrrCrcdzEWNKBaDB6FldQyGed0a/Q8XiIy4RBlOjc3wJZwrJGdTNQumGCzo7rK BK+5hwJI5FlqQDKP3gEpheodE0Xi3rqJsvK4xESNjAilTnSaR0YmiTZwDBLiXU6DpE3kN5d8 lhyDrALPJ5psBNfKMNpQL/Q82RXNccPzxLkXPmwHt+LswHm0asTvFINqoBV7kI5sVz94LqcN GUW+T3OOU8ei8MB9PoukaqarIQxGwpdhbZWsXFMg0Wi5D2shwJ5Ko9VSGcpVgAwDtc4WmspT abTGK8nPY+GS05uzFkqZn9SCr/g+1svOSZ1RXPdaByuTKEUdaNqBOK84bkCgUcmyXlmuKexc Y6HaErmVwrnKBgc3iWIdXScHaaOrPC8Gx985ytcWss29TluEalROcczMfXKwIewmxbqojqaw BVqRU7S4FDmPFt8CtZrwTwaeC7Dwdyy/bfg73B+1qNh0uLe5oClfO4GojeodpKtMpT6Sk8py rnIKaSS+jzID16Mw24gy2C045XWkdIP1kdzWOwSOvArnjAnc855FjuduIXIDjzWRPSjcu3VQ L47TDTVfrq+dc4ZnQeG8dTIYyIYUrpWdt1CKlKJIRvB423mXO3ww9LLhDrThOSEXoEcp97oA F5LzW4AFolrZQbvw3IYLXvAcPiCZ63hAmuT8FkXl+TeHSI9XSV0SgudQXJKJe94uKc11CCAD z4u5hPQKxzrpTuXOJaN4RsYV6Xj1xRWfefTuqupEU64iIcLlFLqK+/6uabQMUB5t3lrOIQ1+ L6WBF7rweomfk0XULnipB34LXpoeRIF5KW7wKEyhtgSGNllqFzySdpGvhiQXl0avkXOgdPNI 8HRWQzKcR67eIr9C7TbuQPPcE1RI4j5svxfHz5UHajX9oIAD4wM/zEqeQ6AtO6s5lKTpO0E2 XpVHUSbxOjoqYLnDVcj6c2vmo7QD54NkBt6h4hMSfVTzeeR3uCx4+Ds8+vDwarjd9gVtBnyf YlCUoHRDLMNr/B7xCtf+gMA00NUq6lmcOtUE7tX4atFwwlcD0vw86Grp3Bx0P/c2fMNxqN3G LoieGQaD8ElxCAIwrg8gCoZ7TwOiEt73BCEZLPWIB+UU79Y6iQ+9hUEr7znWBt0zVBph6n1n H4POBI6bcQPPhwwW7TvUQ4GIKM4hg53tGb2FQRQefQyD6mQwACk8pzoMyATz8wwm8Z6fYUAD HMct4FKprhqiQExJzxOR6OOrRRkz5dEhItKjEjyg4tnBOvpOF+KQROFxyQA/hNsSlBQFl5+h qMbjkqHAG+TnqVLxPMVQ0eHKeRQ5FK5DBugQntsYmkAFld1CQCaY56sAydy7DQJxML3tIEXl sXOAS8FzkEFDX1PqANIy1Ylof0BOhp5Hw1elnlAwyOJT3kGDZIhUXwckfkKj+zhZOa2DM4nb RjghnnefARK51Qxz0x6nDrIh3IsOHvV/qvmQhlW8tzUMaIflFMVLhdMtCsErKSE6FOYp3dDt wrPUIcmhUJ8vJD9kqqtCRlxCtQsgKVGrGYpCypniVtGax2lQe9m8gF4pnpUCpHCrGVB7535v aBYJbIpbg4dNzxPRzselEQUj7Sn3RvgahkowICVSTQGXz0h6PyggZ96xhkZdz3UIIJHnAiIa ZSuVYEAyr5dELTKX06iRCuAn1drx/AGadJB2Z7cACKrIFGJ05R0D0SIEo5o8IgLkMXp0c4Mv 3cdJ3AOHoK2TSn10yDhz3pmzrZ194AhxGsyBK9UH0aN+SuU0DkLwzoQ44JMDjsGAqI3TbYAf z08KLcbrjXEwlfshMUh4/5SiwdSO/OCCuJzGJCXXiYBUXl2OyfQ4Hn34muOWXSd2jsjY8b60 iHwIj6qhjmIP4gduSyK6UbkfHyv8N35zFW4il8ZqS0fmqmuS6wPEPzz6iA0cwjkRsZSgspCE ytxmJcgir5ImYSrvmUsCtp7vI9FHTGmQ0HJqqGyjkdlwrybNYTClTkKdSVN9DYjhfd5Ji8az eSirBkP1QUIDD6/TAqJ4d3oyGsLAZA6QwCOwZJDn43QzqEl0VoNGopoiQYl1VrNoMeMntc5w i5GgDjpc5dA3QfVbcgbfxVAaONSgONZoOuLRIZKwiWsKQNDXwvfx6A+kEI+WYE4DeDs8z5cA 4fogeZSQ+Xk8MmOOYhBEJ3pPUZWm6DsR+SqONepzgXPIbGq5lOBbL24bU4JFp9oFkKHDVckh MKFYJ1c6koWMGfeVU4b4UA2bMtoQuZRkG3muM2UHp5jiVtBMx/ep6FTiNKhGdqS+GvRe0X0q Ooio15mg/XnsnJpEFp+u1uav0zsQy78ESM0gDOXv2E6WIDU0G1K6ZcTOPFeTBYSEylwW3vJ4 IUvXuM+XJT5aonQDxPIKOz71ypJyItKwgvtigBieH80aiTm+2twwRjkxG3Av1QfZoJmBasts ReFRaLZ4hUr97CL1IDJybzA7+C6d1WTiGTM0PQ28kwwKHgUlxlU5QH74zQV4kJwGUXU6mXPU aCCl+ySReK0gJ3wlx9/BdfOaRM7oleI3BwiX7YwL4h5KLrLT34siLVqm6XmKhULoQIrn52nC 8z6UIkzjvftF2MK/4SjCVb5PkcgWUdku0jQujfisoNN7jAJH49xb0DjCJQulD/TbM+oAgmZD CpmbDSlFC2oi3KcoTqLdkK4GF4nniBFk5Uo1bMFxuNUsqPFzrYyrBidQDJBc51YTbeaBR66A lJrpagHfpHCsUR3LVIKRpu943oAMPEdckL/mX7Pikz/PbWPBV4y8l7rAueQRS0ne8o61kiWK oZQGWWUe00IlO55BL1VYXhMvFQ4Xp2iTKvUgnW+GSjOBa/LSnOG19yrwrUhjJ61QFFyLVWRQ eGyGpGEH64rsDu/SQYvBMFA9WpUPPI9UEZtx36WiO5BXUir6hHi/GBKa+MKe0kD7JKnNqliM 2/qKriMetQGSeNcEihWt0Gi3IimlqE9eYdG5nauw27zWhnbcgX+1hOBn4FFBRcMN79+B6ke+ iNINsQzPX1dY+g5uARqWylwN1vPOxRoVGq0pBhFXxyka0W1ItX9NaFykFqMm6XhdsyIuqdQ6 A5IStSU1K8TIFOuMT1apJq9FFt6lUwsKUJ13kCWgmrwiYpKcbviCnVetatPZ8dUaHDuqQxos MNdvgHTirCZQz6LnQYrLctuI5mfPPZSGj1m5f9AwfoBXSREywRVi99OUdPwLvqaQmaO33VBi 4T31DVqM57zb3PpFJQsQy/u4EBoK/gUsPp3GBxn0PEiG84wmPiBP/Jt8hF8ImuhqqPZ1aI2P wXkMiOZ0tAbQ1dDi1YFAg/AZEA0TZgw/KbQLz+GjSajySTZo4e3k1jFIB/1nFGvULnl82lB6 4HauIbvCK9ItKcGn0rSkM/9mtc3fFFPN17IZeO9+y1ZWTreMOQtcGovsTCdqBTaY6tEZwmPA hkkP3AY3dB1xP75VOLccN3QF8Ni5VQ81T28O4lg6EHxAcdJ8GIk1f1KFyVTr23lE3zwX6/zX PHvuzfo8Fi2P6/v9cnzz/TzEDxMQ1rf3+5/ScnOF308YJjj9FnL3dH8Fvn17BhzW42o1T767 AjC/7wyZB5dhSNhp4dX34/7jy8on9Ne3e/oUc8T+/Otq85y9af9HTMbbnVd93o+7bzcLPL5u KDEh4AzDDL7vluvr88PT/d31rQ1m+f0G9LRZ/Nen/fzSuxcCPd8eMX4Rc9OwCibmXSdFTZu3 f7ubx85N4+EYD8vx/c0vj2/zD/PbGJW32t/NUxun78fd7jzu7f6jfH+zWn58PJ5m3h3xv8W4 /+n0n/uP6gI7Ddo74n8z7PSf8WE+LH59+WPe8/wnfnX54+WZvj47TdE7g831mXn5nb0+sy/P 3PWZm59h6N20x4i9nzAd8frn/PzDdrXaPk8LzLu7wn/36EyE05S4bzcPq6fFBBZZbB8O327m AX6X8XjzTLr4dNxeB8n9uHw4PmGi3ImCp9lx//IwucvsOQzUw3S2LybPzXPp5tFzuy+evllg JB4GN57u/ouXT4PpXiGD6YjTwxIcfvd5ff8yFe+r87FXy8Pxbtph1ONxuwfBTrMG/+O08suE z2/+VwAAAAD//wMAUEsDBBQABgAIAAAAIQBxIa5IcR0AAHbgAAAPAAAAd29yZC9zdHlsZXMu eG1s7F1JjyPJdb4b8H8geDCkQ09zL3KsGqHWqYa7a2qqajS2LoUkmVVMNZnJyUxOdfdZsCDo 4IMA+WDDsKyLD9bAgOGDYXl+jadt/wu/eLFkREYEM4JMVlePeg5TzVziRbzle0ss+aMfv1rM G1+HaRYl8X6z/VGr2QjjSTKN4rv95hfXp0+GzUaWB/E0mCdxuN98HWbNH3/yp3/yo/uPs/z1 PMwa0ECcfZzuN2d5vvz46dNsMgsXQfZRsgxjuHebpIsgh5/p3dPk9jaahMfJZLUI4/xpp9Ua PE3DeZAD8WwWLbMma+3epbX7JJ0u02QSZhn0djGn7S2CKG5+At2bJpPj8DZYzfOM/EwvUvaT /cI/p0mcZ437j4NsEkX7zetoASM6D+8bl8kiiJtwJwyy/CCLgmsYFYx/EcVJesKukfuzgzgz vznJ9AafEqrzIL6DN78O5vvNMH7yxZVMZ7/5Zvbk6JxcGkdTaDlIn1wdNOHFpzgI/lcazFIM jT5VGjnwF7h9RaUFfAlvnyeTl+H0Kocb+02QOF784tlFGiVplL8url2Fi+gsmk5Dohv8uXgW TcMvZ2H8RRZOi+ufn6Kk2cuTZBXn+83OYA+FMc+mJ68m4ZJIGsjFAeHlOXlhTprNJDrYn1WJ CF78ilNoE3YAH02NzsKAKG8Du7uDdjs76m93R+32dtRuf0ftDnbU7h5p10uDAPk83xg5vxHE cQLmR6whD1/l5L1VVNjfaLRGwycBmtEmtNLwNkwB30Mvgs+jLG+crxbjMCXvORiV3TyxLVed rGjGVQXtzVxH+Rx54TAmV2W4Wo3zXTQbzFdUY7aWwTHg/taNHCbT141r0N3GaZSCfjyLwUug Ijvw0i6Rs9fLMJ1H8UsvDb3K0yS+M49JMqsOgvfmvuVksZwFWQRhiskKZEJbOjHqGRs/+DIc /9CLEWfXL543LsDM0Rfn4dTr7etgPA8bn6aR9lp3HSBdzINJOEvm0zBFjTDQJPimuXS7Fpwn jatlMAE/Xslq9PN6267W+jy6m+WNqxkGDZXEBha52kdC2yeoV924ZShVjXN56XYnaeTAovr2 xl+E02i14KyxxVMyCQxhdFE4k7CEVjKJHuqWhyaxUaDbsYSEcvvoUjYYArbv0H+MbjZon8jY RQQY5WzavkP/MSbatH1LiCvzHyMon/aPg/Rlw8m89rxt9yiZJ+ntas5toNKC97wtWJBwG4K3 EYv2nUBiz9uCFfhsHEwmEAO46Km3LAoc9aDiLQ5KBY3NfSzeQikjq8eIvAVUotXxoLUd1noQ 8gbdy/DriBSs0BlI8AFpk2eggbh9EaTBXRosZ5UG3rXwxDXa+HyV2EJvaRgdyzBcqTyLoeCT hQ03al2LLbpSkz2sj3pt5wo91Gs7n+hBaDvn6EHIoh/2QEt4SXci27tLD1reQC38GhqwM1bv eWO1IOTnFGrypA4RmcV67bqge1IHKt4C0j2pAxVv6ZS8W5urnAOt2jypAy2L17DLSMZUn0F5 e1KZkABvhxHVA94OhOoBbwdC9YC3A6HtwbuaSH3g7UDLGxsEpsrg7UAIH/FJDgUhGbwdCHlj A0U7VkXiIIStrC/K1ADeDlS8BaSDtwMVb+nYwNuBFj7iowklWgLqHGjVA94OhOoBbwdC9YC3 A6F6wNuBUD3g7UBoe/CuJlIfeDvQ8sYGgakyeDsQ8oYHQUgGbwdC+IgPNhjBG61+5+DtQMVb QDp4O1Dxlk4JUEWQ6kDLW0AlWgK8HWjhIz7KwGihcvsMqh7wdhhRPeDtQKge8HYgVA94OxDa HryridQH3g60vLFBYKoM3g6EvOFBEJLB24GQNzYYwRuNcefg7UDFW0A6eDtQ8ZZOCVAFzjnQ 8hZQiZYAbwdaqC9bg7cDIXxkU0I+I6oHvB1GVA94OxCqB7wdCG0P3tVE6gNvB1re2CAwVQZv B0Le8CAIyeDtQMgbG4zgjTayc/B2oOItIB28Hah4S6cEqAK8HWh5C6hES0CdA616wNuBECrm 1uDtQAgf2YAQWpGPmOoBb4cR1QPeDoS2B+9qIvWBtwMtb2wQmCqDtwMhb3gQhGTwdiDkjQ1k nTOsFnVeE9u2KIHrOgO+qsGZYMciJFeCbICX8pr5tX6puyVBPkIPihb1cB3iYZK8bKxZBC8t SulaFMSZVDSeRwkus3ldXrfT3Vuz3eH6s6PGGd3Uo72HKqVu6oBdUvKGJ7JPCDeqQT9zWFu+ 31zKq31gMxTZIcZ2MeGDz2BPU4CblsguJXgN92mxvUo4ZcsI4r9h49yUPwPb2Q47w86QDgZ2 ZRHieTDG/Wfwlz83D29zMpRlAjvE9kY9+rztgXZ7xPY7WZ/oDxlN6xOjYZ9QAebAI9ifBDb9 3c6T+4tVPMl5z1q0K8EqT8j66/D4xHrnvHxn+rNVll+S5dSwFaB0M6OLueHqmCxNBym0O4wW 2f5yMI/uYrIlkL82DrIQNgGErM+MlbCFD8X5hj/WYawrbaj79JBwl2/c43vs6PCxDWADirpC OYQ6tDV1KHaZoRaQ/k4/IzvbUFkCysaY7I5QL3mpzsswXJ5DG0iC/HgOLMnwl87QLqxNx1sR cp/oGFUu6MEMNhzihk6hbMkqJ/x9/vWcdxDfBsaovB5Dk3BxI651rFzr0J6WuMa0fFuu6azp 9Bhr9FEjTT5qX7XoWgfYfdgBtrns9QEiqzcdYM86QGZ4JQmyYW8rQQ5REppN5mGQemBmC5w/ VV3emGwWbXJbtgu8gNajcxAHtSkH+1YOIh4DHqrIwfi6LQf1UWDDm45iYB3FwKjoNY2Ci86q B4XY7I8w7wlD580pmkBcp6IJwpfqPOQuFCESGvTyIXQftBxScB/Cgp+SJjDO1q8J2PCmmjC0 agKLQB5qFMi0TUcxso6CbXN7qFEg06pHMZlBzDrJ6fZbW8ja0gbFjghoiPXtDXLcAbXYYrcx DwCY+y0yHMRDtd5BIdWi92BfdDOtrYd6GMX2OV7jm5SeSDl4v/he6KqOib3a2E4+nrP4ezyn 8SicKYHLrWgWMH0VUEbAg0fhfP4iSDFaT5ZA1/Ioiano3XYLUaPU1DjJ82Rhfz/FvYbYvKkB 0AO5M/QnGQT8y8LyGDdls22SNrbrcRhsryRlCJsmuHLc3i8lx5pAXpAsrsj5E+U86yAGfDtP 6H5pwn8ZH/HmDfT1z4LF8s8b9CEUbsk8mSQNUFmZnXmF2L0hiyN/NuHKSfY7gVlSu9BDZxBc kaxwY68IphVjX8e75RIkrhn9wXJ5Q64bGcX6b2cLS7HS6nNRLOeeULKUH/UNFDY0GwdKrm8y 0Bo0dwnH20wju/Ky+y76q1gBDsdDle1DcVakNDcqUpq/J4rkjDZpzmIuXZlgsPyeUaGomnnI RWTSej76MDjiwZXzxMgQuFwzL3YIt3AqCiuN7A5x09wIRKA77xCI0tziPqFb795nitrLTn2m s65fnetB6MHV+Ucs+DUHFnZ3yTw+zyzhrwgMKgsWaknDWOUtPSJSUyudNqvzYrLLu6KUm/tw IBcatdSG8kC7DZtc1z+x12LssrXR6QwqCtKdYZcVQGxtdHstVia0PjEasHTN9kSv32VptO2J frvFilbWJwYwsQj8AD8Lj2DpXEd0/oQaAZajqKNklUZwRgqcL4c1B3pynHyVwi3+P04u0iS5 xX9LQSSnVBFbuRrEUTCfa9iPF2lX1OrUQwXaop4pl2pY7RrkoHI5gp7CxboYMguWBnd4BJch lHuP/OEYBbiFV3RWIWCN2QMh0/5YXJASbWO6jhOJ+hwBpA1w9lvYgJCBncVmNDWWqpWqHnZX xDI3mNWj02kc/bMVHKiVTdJoifl+fZYSQvFhHn6t+1NxwzguakL2cTDj1jGWJ99lTICBlue3 OEbAX0vhxFW52Vj0Eoq4YRqkyoHKscojwjhAHlJ3tEmpc03dgHXOpJgoUPPclTpevyGxuKU+ qZx8tcKzEzXPJW6YpMK8V2XfuZuXIoJSIGaakS89smGsxupJoAC4OKA3FNPkRWiJZUQSQOAj owE9mw24SzteP5vn4R2AlpXZN+z+TnkuZq5rl4rKzvawjeGvYCdAiLZ4wQRFGHrLhstj8frk cRrdrdJQkwO7vIb9m5QtvFJ1kuXB2INbKIZKazvW5XzAli2xmY7bopz0Zh2quYYRlUixO60t wY2+vkfXWoCSQkYUV7husvBZLle3HcvVrp6UCsRW62fi2n2xf90Smg20WDCOhNvAzZqyEM6s w0uLtUMucgM336XNkypmoU9iPdc6mxfcYmlJfQy7JjOImGoYWIY3aS3sXTNtc5btQsFsDGPW iLdtHFM4jnq4jZcBRcKVczzrES6XuRRWMud4BX9rcR73UT6DdR40Ry3PPzIusGd2V0utGZIc eVOkqPoqr9sEElSc1dQWKNUWRD+0a1xTEh319YqnGhVqQbYpKuSlObU8JSow5oJemy/Hqc1z wGHcp1R+ukIX94yeg7Fh+wypb2KpGrIYWKosScYOSguRS7/P6W9l0TFe0uMevvrTuNKYUCBu lCOL4qJKqMQkqFyF9+qSHArt8wvd4+ONG7iDA/z+z1GMWvochWqPw72hXvpXHzHol64aZpMl rlYOheHYeKohFZK2lAD1NaAEX3dYA4S6QMQ+tIJOlc2BFLMIdcf2ENXraSle3EZjdXHRvJub qrej05exCkHgRzhMnS1G4VyJZfhP8sbCtRtSRWXardPnq0v5k3JVkNwF2BF1zuJpJObIiTVF Qfyyjj4TxC6bGAOzpmwW0O4u0F4ghNgGMYs4xbyC9vsWp4AsuQboBsDCY6cca3fmfkZ3Y401 T8Vu3IzXeapt0gRURJ0tbL6QA4Pw4QTI4WIFbLtWMNjoIuuwo0cy7A1mRIWVtfVlxABE4Ss4 1N2EAiwdMMjUES4doUv0D+pW5bCW9g99tC1d2bx/YrZZgePhVptC4MRt8xjMUy9b89g4hv6A Zx41uRC6lhvzdXM+TR+4wSd2k03ryMB2xXFksGubJXbT9zssg7uwQdddmy2CYbTNK9q74IpD F0GaG5YokMuPYYkCOHtWtOHTJE7uSuTJhd+iO2mBYTUBOOGQaQEfcs66go9K2YAgNgkLc1sz c6BraseFW/Uoj9k8kQv0liPSaxaP79XMFmVmyYlJivtX8riapzQuw8mUfEqtDOZw/QZvvDM+ 8ggS/vLYW62+PHT1DRSX96lAA5qwA5Pgrlo0IxGMIjnHDHwp7+1fk+58vgozkiEbxcdv2mXI BY+9lJHBzyK2t2boiMETEP17x2vVHAsrNRskl5yBJ/yWjTGUk5pAWexlw7SaJGiYs6IytE2+ 2ENCW0+FhXk5Jb+dCg/gwrkYzxMDz/jNNZOjKGY+cSpb7kMI2hR7EDl7hB7weOFZtpE1R+PH 7SHWbK/bIMl1cAgmEQm1sskJhCJuyTrFX6yWWC04Yg7riII9uqhOHFZSBANrRD0uRwM7chtm BnIpruEi8FhisUkFhH7YbNauAUpmukaFCTQYtkkS+W+9H5RIAHpYUx52Cfuo4VgbQ9x8e2Mt xFcAtPBvcp2GRLly2ZxFvTCSmmoeZCT4rWc9BYCh4B3UXfOcnawonCf4uE1JxCD19NHPU9ct z6UxkL4MYSsySZBMPCDqKu7JnHj4GNq04YP03RJDQ8/5HbnfFQpqN3DXpAW6ZAx7aFdtoSL2 9h1FPEsCe7ppLK0RD3SWvIL6IvMWhlgoi806auGwzZyXa8wZei3ZeqnfYjy77HZmsb/sHdqf u9/KzH4LOs91oYyfFTVWUQEq78C7jhZhRvbfNS6TRYDfD93+HAN3+80MiellmD0+oIGOGvIr 2tXHCDSZGWiyDYCGmtJaN1wH0ED5CU5PNYBjtiHQIAt23O0rAnRJrG/5Yjdu2kZXzzyjDIwV zlIEOo85TdWDsAE/kNI5rQFVqimoZiLQd6px2fhOkNr81XsqG7+DCOqtLjARGNCfC4cHlGVH p4dCrpbjXed7vPN2jElmxOQclCKwaib65RhC47fg6eOaubqCkwgmuvdhl03pmgHDN2SiDptD dY6v5bPKaYyd3d2c8dUynETB3LKimt2Fc/XsC+a3WFStrBB8ZCd3gOfizrnwdnAC3oxAFtxU J/TI1ACfiWTi3Ww1tWtWcU02BN2m4VdaiIV3bvCWUdFdcwuqeZNknqR8ZNJi8pq8OnaWHExl GQbeMg6jJs/BZQx/+SgfaiZZ0f7OUN+joTxQaR7DfpvyRBqK0oLDyTc9unLavpekXcfZOP0+ i9VsPXU4PQfOEVg/WofzdQZDtnLc1o8uO4FHwgIDust73lwWuYjsnVqYhO01rwK4Jhhh2T+M 9+rYPgy8K5///8GAPhgQPbxhrQHxrY/okDSPumOzgH0PxgIFtYvN9mnju4XHqkwwvcJtMqVY pDB+25EJ0ACD6/TZxgIaZ56thGYIsvEVFAWv4fuxTcfj/haMYis8auaVqXhHWSWK59UpXf2M 8tYnYAuuU8e1a+S4Y9BHwzdn1szh0kGY5kYpP7aeHc0/eKPi0zvtD+GcEgCv9UZj9uEeJVen W2sf0jcRp6TXn6/JZcsWFbmo8b0oQduDp8ocyCHFqSOBYYd7gl5wvNHdkHrYijnGESkny8nr dz9Eb/SSOVUnc8Ec77FM0kOdavANpK/6qW20r+adQ3iPDcOjryIB06o2MIq6giQyGv3kCToa luqXnD7eYwOVR8OEYY+LsMuwNazWKC9PJvo2LrjYYLpa6rwhtGtXdpzV0LgRwd+HrsGoqSo/ 0kxBoIpt95pz2EAMYvcfsKy8nISwnDHSzHLHjYiiYkmyjrX7tlWePPROCoX3ivseDewlMjiN ekqOZpsmRfhT1yEKYmZNXno3gEoPKCsqx36T1N7gl9i/Tu5Sa/RZiCfUAL7eZVIDM2BzM/PV A91l8eKVPM52n371UwyNlRm52jvivhgatGYamhnf6UfOIOsIF9FZNJ2GMZaCbUjo2xeI7kx9 MaMzdByJ76gvfXNf2CHiJcunYenO+AIJtIkvrFj6sH2Bw8lNfWEHqDxsX8A+TH3B1drazuza ZARekX52SthQoH/f65o81CCfRKZaWmJMwJRX/yoWPVwVgEz5zuuo1T46PKRN+Xxp6jBJAYZp PRi/NIXns2TwASc2hDf7TVyyTMAHvpaEGIpTTPBNWnZSEXzfln6HaqN3xTeqNnob4ZzHIL7d jmLgYXi23es/2ex1gD6Qk8z+9/mzX8qKw0LtA838+FnjVXWjeRS/5Iw9go/NUc1Wdb6712v3 T+kdFpjqLlJx6yKPkGrV/IGKNMJ1mhc7Wwad7/7127f/9s9vf/OLt3//L41iOGWbZ4G6PPYg qBo5yyV29MXhNaXB42TCTh0oD7e4gw64PEzTiPqj1kFHlWUxiW/fljumHt77AzsWfdUPkDmE z1EkSdy4JiXQNaORZUYEzESpKmyr1+kenNBmPBVWWzcczGC9MIaw9KMd1+LCBL7hzX6VuEOP 9iPbmI/E2gfX4/589F/3um9/+R/EAH771xvZwNikMTIzmQ3smEnkO+7xHUelMH5S12e91xhZ MNEg9O03/27iR+d4sAfnuKDImXIRB31F/LbHV9NpKnEbwcGMJOckugz61IElUDBwcZleQVqF mVrX2pTl8t03v/rv//o1abD4JDq7VtJY8dHkCnS22LO+SOUwmb6WjFmu2vBPVpdNmUViqikb uF34HjZPSqb8YIzQHgROXcpB8uNyRb47Gb6CD6gScfHETDgnwa5K7rDEp1otQVMppQo++li5 nhe+/f3viH1v4uZYFGxnctnEH543Fh3TFy2C+1st4DOcjRfBktqj2QOWFa1DH1Z5MBr090Zc BekHZIV+BNkkivab7ubEFwspDsBx76qPaugFbKIUv/3d//znr9/+w8+/+7tvPYMgtmHvnXBm Z6hfhMn6ljTyMdziK8nrlMiQIDJU+ArPSswRUVXOtbvddgsRQdQY76Npcn8EH2NOkzn3cMyZ PLpiL0md2Kzxjg7oZSN39YU9AHpks+4LoasQOR7Mo7sYIYGdKs5TZzv2o21fz8IFuIpFFCfp GYnzRMBnvDPJ4HOi4oXDaMrO/3sZpjEXKgMZKQFi4CJjAj1fVtP8L65Un/1m9uTonIwchlHh WBTwXBPv/PRai3fgkkGHjwat466aMNymwSK8SGGk92mw3G/GSX4YkgyfcW0yS6DgvAjSuwg3 2r1Gsew3i43+8KbdDgr/Tj06my8sPHqQPydeqawK9uylDOQHKSzsVllcYDvbFkifQYaM8f+F JPlnEqvDARCkv9QEXp1dv3iuSYlcbFzA8pgkXQR5HjKHXu35yIskyqRs0+GMf/tb++57uQR2 ctzrHB/RZlgAzGEC/nL9f7RzJTw5k/qqTKa0h11mu7YnOns9Vtm0PdEdrJmRod936vM5BVsb /d6I1ZVtTwx67Yqe7nXpSXr2qaNhp8fcmI3KSHyT0fZEu9Xaq+hquzUaVfQV1i23Ktja7kB3 qeJZ+wLFqsKfcmVUBdwb9LG7D+bftnFNa8NOGB+DqwK/SFlCTfKKIgTnXgm5tvA3rtGqQJ9y DQvx7P/+6ef/+823b//xD9/94W/8QlbyehWiqUGZDF/lZKc60HfjONc7zm/F56MGV3tyV87+ 9Piz8+sXnx0/O/0rzVnI96grK33WlZmKyqGDYat1yHuJ3ogIDf8BA6PrGp17Z+sZu27qldbr HXbv8uTT84MXJzrn+A1TB4N62CYcfXCrV/LOXsPXO0nmSrW77N9ZD7Zw461uf8DrWMwOsjyN XpK1qzhFxEhMjVeV3U+tdm9veMjMkL8eJzFLJ8PbW9g+Xr5ebQFKLCsxSy+I0A2JjR98GY5/ aOZXFUaUJq8rg6DhQfv4tE9bfaxB0O79G3h+EkbTFaIHUAVlsTt8CZBc5/U5+hT+Kj2E1rWd e/x0NY8WajAvLjHnKH4T30h/IGEdlitTsZfJk7+4JGKvVl8IUUrT00/6Gs48j+5meQPLEAcT kiA1mFKVDZ5lj7rBD3jRSpmnHvZ7nRFbOyLPU1+R1emXyf1hEE+vojfC2Fkj8Cg+cZTM7U88 i6cg3Hs2SU39wfRVQI2hNNlqm+seEokRbSnNdfcOD46OBuQmptjQD5JLBsgaxhn7JPgWja6b Hd+i2TXT5hu3Ssz6fZvRxi6jZmHdgOoMznKALqJRMBAtkn++7BwRhiGJVOfXqwK27zmNqQs/ yvCv4rhO8b+yto2Dycu7NFnFU7QKbuk4hosUW8kntESczYgpoLsUCS9SYKs24OZtNJ/D2g5V r0/xoqTWRKjYJpUuYxWJu7hJSoybQ/XjYfm2jgf5RF5dURj8NFlxAITFLWjTHwx+Ew6gbgge e2kKmhiAKJoYi/Jke+ByJY0y6KeKXfwiUAyx6H6TaF1NTY3B+7R/Ah+sx34BrZJZ2VRKXXi0 MYKCl7cupNqi0ffMhxRm66VSKLuzJH3zQXYqpoNtaLHKrvx/texAphmJ9fTU3ZZW6ZOJQQyl /QA/KEdidBrglQNTerU8x8pCTz1cdS4zt056B3x+pFynKSalD4Mc1oqwPqirRlyL766ljCMo nuu7cNiKm9/84rvf/61f6Sq4ZRVRO5PUwoc/R4o5C16JYpW/goGwvGYjRqFyPZtCnHOrM0VS HJipCNMwhjOHMHCyj7Uy5TYMvxjfQ8y4L7InaQ4TL3GeQeb0xLAXQX+Cxp4uVbf+8d7piK3e 5vWYYr0dK8YoGStekzy4xd4V/ZbEpu/BuoJZaW5MZTO3Fpy4jdqnwbun7YMWmyBYH4N4jkBP p08Wy1mQRZkZquxjYHe8xkA/VRJhXlEtBQV110zMnvwl+tUYplh5ZgGXjGpEr6oY0T3qdA7Y aFhK9ci3NZHgY9erDICTvBbFp92UrTx7rQ5JAsVWHml/uNeqggKP6EqF+tTiUC96wqU1aiE7 5MM28V2O6sKFIc2widQWpy4fet/bI1CQ/gDTAqEfxZlUO1YPBbvXoAaTcHly7bAthSSqRlBt mCeTl+EU1ciOIwyzS5OGHotyQYKI7Nkn/y8AAAAA//8DAFBLAwQUAAYACAAAACEACjbfluEA AABVAQAAGAAoAGN1c3RvbVhtbC9pdGVtUHJvcHMxLnhtbCCiJAAooCAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAACckE1LxDAQhu+C/6HMPZt+pN3u0nRhrcJeRcFrNp22gSYp SSqK+N9N8bQePQ3PDDPPyzSnDz0n7+i8soZDtkshQSNtr8zI4fXlidSQ+CBML2ZrkIOxcGrv 75reH3sRhA/W4SWgTmJDxXrpOHxlxUPJHrOa7M+HirDyzEidF4ykWb7PGevKQ1V8QxLVJp7x HKYQliOlXk6ohd/ZBU0cDtZpESK6kdphUBI7K1eNJtA8TSsq16jXb3qGdsvzu/2Mg7/FLdrq 1H8tV3WdlR2dWKZPoG1D/6g2vnlF+wMAAP//AwBQSwMEFAAGAAgAAAAhALz7UgMWFQAAWAwB ABIAAAB3b3JkL251bWJlcmluZy54bWzsXc2O47aW3g8w79AwYGBmkSqJkiyrkUogy/ZFBklw kenBrF1V6i5j/FOwXV3p2aW3s5yHuJsgiwtcZDVvM7PuV5hDUrIoUToSJUpmcN2LVKpIyebH c8jz8/Hw629/3m7efIwPx/V+dzeyb6zRm3j3sH9c7z7cjf7t3fKr6ejN8bTaPa42+118N/oU H0fffvOP//D169vdy/Y+PkDHN/CO3fHtR2h+Op2e397eHh+e4u3qeLN/jnfQ+H5/2K5O8Ovh w+12dfiPl+evHvbb59Vpfb/erE+fbollTUbJa/Z3o5fD7m3yiq+264fD/rh/f6KPvN2/f79+ iJMf6ROHJp/Ln5zvH1628e7EPvH2EG/gO+x3x6f18zF927bt22CIT+lLPmKD+LjdpP1en5t8 2uNh9Qo4bzf8a7/uD4/Ph/1DfDzCX+e88fxG28I+OwGQvuL8RJOvkP/M9JtsV+vd+TVUPArz f568G5i8W/7Zt/RV2UAAi29AmFb3x9Nh9XD68WX7Jvfbd493I4t12R3Xj9D2cbW5G4XuzLcW ERnd0oe3L5vT+vv4Y7x59+k5Tvs8fbo/rB9/oG0b2sb7nrbPm7SHlfzjLZuPtGENP+gnwv+e njcPd6Nl8o99B1CFwyl93ObPgR4st+c/3r9sNvHp/MZ38c/npi+//Hr++788pG/ZxO+T7s9/ PtDRnACL5GfaBz6CfqHn/fFu5BKLvuU267jeUVzoe3gr/PK02n1gKpz1Tt5+4B9yWO53pyP0 XB0f1uu70b9Db6r0oAbwdAhYF/+23sHrH+P3KwA0+QLsXfBFADL6hUUAbV0A/hTnMGdjZx+V R/Y3DchOXQxZ2moCsmRgZP+mAVmbTDBoWbMJ2DoDY6tjPbAnUxRb2mwCtu7A2OpYEYhtYdiy ZhOw9QbGVseaQDx0I2PNJmALhqkeU6DhTqZjTSABupWxZhOw9QfGVsea4DjoXsaaTcAWHLdB 5VbHmuD46F7Gmi+DLVi5gotCrV3hV/hKwm/UY7Elj2UxteYLN0x8hj+Ix/KVBtuvRl1AmcQZ zXrj/sq79TY+vvkxfn3z0367Aif09W28Op7C43p1N/q/3/7rf//nv9l7uSdT0vsBXKmSPz9d 3Zz8hFzKgby6OXRV6cc5v7o5/WF7dXP6w/bq5vSH7dXN6Q/bq5vTH7ZXN0cntopuDpHcHJ4s 8SPuOJS7OTRrtYlZvoZ3E3My0TyKImvJwm75lALPAuWyAaUZmMf4Yb1dJekeyEmIiYKxfaPB pbHdgGWeKnIwrBlm5ZyEKTg1acZEEWynCux5e7AD37VJND1jAt86TYBRH9cIsIkV0O9XBTZt 1g+2WwX2ojXYE98m4SQwGuyATBCsaat+qL0qqJetoXYcEgU+j92buohMXAeBmrbqh3pSATWP ulUl0tH12iL2NFx4HaQay5h//p3LACzj7TPmHZfr17cVOfN//bS93wOV45wwF/5QF0ZSXPv9 qolD44noxDmuswidWYeNtv+J67b0mzBx06qJQ6kr6MQFfhgCcYUt1O0Wt94nrtM2YsK0BVXT xtbsVgvlbOFO/UXknhc0WDfUbK3ep63TlmTCtNkyU4w7JNNkf2rhkNiuQ6yp2bZE5mCk5DGR E0Zb9dsStpzjSrBm5norHfEmdjSfBSYvbZ2gNkJHqpz25Qyzt5nmVPAoF+EEfHaSuEYiDVCP z35eMtvbgKDE9C0VTiRtFTUk612RhVROE2rxpseJ0dDJGvZ8zMWjrSISWW89SHDh6xxXGJOb cbIVdwLDRzlItFUEI+utBwwe0dEDxs04syzaq8l0wt5SoSa0VcQj660HDx500YbHzdjTsHIA BZAZDxWYsGYRFKG/HlR4fEQnKjfjbIdtLyu27WFrKmvOAZP11wMMj2ZoBuZm7OsQGsKNmCqh oc05bLL+erDhAQP92NyMs0hPB9FxUX6iTZtz8GT99cDD3fJe4LkZJ/Zvp43J9qbYSsyacwhl /dsiBLIqsNjqKW5yPsJyZkt/mka4y32t+lM5S9+LXI9ktg6MM3WU4X/5qZypNyWuNYmYn14/ j4jr3IjjJrpTE5fxEKqyO5U2fgnbLKWsvYPjcnB6arve7Q+LhMbGFGA4+prlWgFElTg1CE7I wcE4eqCPO3mdAP7ySyParQixbZM8xgaw0BKAOAdFM0CNuLM5gLyCEF4KIIFKlgDET35pBqgR KT4HUDAxQ4IEPphRKkacqRkAcYViRy2NUjEytcwASGBmGaViDjFkkRboVUapmFO0FC61SAsc KaNUDAy4S6mYqrEr80GsaAb2ko0ynbCgqT0nobuwkuf1B00bEZ3ELbMmTSDbtUMEQdfH7z9s 2CF/QKjA5GoWDhWHWAzoZcH8tk5TPgHbNLq52b/GB35whY0NH2XDUKc4UJsmrHL+IaSwkgC4 nqG2il3WjrNhFBMdqu4obauoZJORNoxPioOVTsXauue1VbSx4Wgbxh1zA54Wjq9rH3CrKGLz ATeMJ4pjhlWpoLy6w1+tooNKY24YJ8wNOyjkqVkYkCft9KxZraJ+qsNuGP8TR+4WazSw5bvb yFUNHJmFaS2WAbEXKHMCM3AsBwJKwTRLNQhxvGbpUCRq90ULMzDbKsp4E8rWQnJcT6AB8vid 8IciLxA41v8JuLCiRudcZG1dHa3Rlb2OfEe2QpUhKQX0aw2vBMpo/3JYxwd60FeIhxb/2hVU ftZUK6hfPv9FA6zEhiWRrwNlsLJm0cprCqt6tSdVOe0jjqwHUmpQIJAW7Q1zIOWRRAOllNkr 1ZCyZjOllMceDYSUcg4RKWXNZkLKo5UGQupB6AuBlDWbCSmPb5oIqY9uT8Ady/sx5qylPCJq IKQTF92eWLMpUqrqYsinj+Ds4dxynSXVyyrCMOZiTKa2NVtEl42hppYZ/ISZYZZ8vl4nY6EB WGnHnOsn5VDS3hUub2IYl5AJkqqdZS2ygXzPEF+nX5itjDkbL2WfoL5IMzeu5kAucDn5/Hci zHgTxtuqgJm2imqT9a6Amce2U35Gsm8gWDSN/NZjMXZ0wOGjh2ZpqwhH1rsxHK9vqQgB3Ago rWLEZXF+iIBDZFgHLlOPnZirEBPaKuKS9W6MC45Iq1gygsjY0wFKgB5np60iKFlvTaC0Cjnj oIwnOnCxbSddBsvWbtYsIiP01wRNq+B0LTRjXws6BD1JYNPmHDpZf03otApjN0FnPNUCkGuj zHHanAMo668JoFYB74YAjQMtGHkeWt2BNucwyvq3xgiWaCWiq3z4mvhLxwtn6EG3eqJrELrE iUhGqIaBSkTXAGgCcwfOLzaztZCQuTLRlbprIvZN3bcSCzQ1pK5EV5hioVy/gUXljWIImVgZ PgHIEJ5rMXV4KY6ZsTxXOI+VW8UuBZCxPFdah11c5i8FkKk8VxOrpSdrUB9ZNvXTGiaWPDdq F/sD1S3ndqZ41RKZB5Dc545wVYy23tZ1rIhAART8UJc398NJ6DR1enXaul7hxKEGW/du9MNq 8+Fl9+ZP+9PT+oGtsX+n57mCAonPhT2ZRw8rnLgkyq3OU8DDb0JRcaMWCNsxBCC+oYiHcQwx c+nFEDkj5UISZK6ZawhA5pq5hgBkrplrCEDGHucyZZE29TiXbOYOtkirhnTl+n6O4wKZwE6K CrWtXTB352Q5nYfnhHZZSHdGXEIWYVKHq+ntocrhWxtu1c3vmaDgTawuJH57N5qt4DbgDwMb s+HCcv0Z1E5sFgRHk+xa2AZQyibFsjQzKMVUGmoCCn1JYzXno+x+o9qEvWQf2zM60yd1olTx hFsxqVRKcjisPzyduOokfkEKLvyE7yFxa+wAnwbajFiNsGrA96IyBT/OmirbwMuWIKByqIXO QHCeKGtWBkCycW2Wg2shBS/Pz/Hh+/h0ig/nFTF3iFMLfYHgxzhYszIIkh3bmyqUUhWUVcGB 5T5Z3VOlERNNrFkZBNlW7UUVtNARHHxJZs3KAEi2aH+qoIVy4OALImtWBkGyN3tThVJKgbIq qJLnC9GodFdQtClB/ehOIoZOnXARkHDW0aacRAt34dm4TRl6JAyXjo56q/80tv/5vFojNd5y y4sqVUC5dgBILa/8xQN3rfWQGSbYlkSUB1+TxE/lKW9lGGdqidNZl3YvH5JRhlNuODVJ8vLh 6DODamXOU5a5uqvHy4dknFEjzpJU26CQiC4fklEmSm449A7u3F57NtCYc1M+HH0GR63QTZWF ri7RWz4k48wHcZbkmFX5LMHQVDiDRC6O7yztqbPwFnxrbRtgihzXskOf0ZLzGwoTtsIW2Sxc Uisp6vZAqy2Rp5qE5JNJm3y7LdHsXb7VtmjsLt9uSzR7l5fiiOWrU34lMHuXb7UtGrvLt9sS zd7lpVx7E6EzepcHS7KRLaa6yycpnOP6EQw9Fp12Z4FvT7zEWW+7ywMJKgxhpz+74fB66WQA XN0ZhmS54GGH3tJIbQ9xl2Qr0lMAV2YUzOcmfn+C+tqSZDbMFP3dUKOKxdAK0Tq5LGVP3DHZ 7jGDGgUCVFjbLiRBkiVlSDF5uCfADIAku4wXmG6RV0OYr19+US4mD5WuzQBItvLMUDFIspoB kGQ3GqJiwJY2AyDJCjVExWAJuhRAqjatfK2Lu5y7ThB0TGMt5k7ohovScpBgDomRK2vekOiD rYOf/3q2nhsmsQLC9Ev5YhfdppgUBzNEy23XygNUCNAPZopJUTVDtNyeFiToUgAZa6sS1wwJ MtZWnRQKFV1Kgky1VR1raoYEGWureoYs0myacrs6X5XUuaTYLt/itGpxm7+UihlrqzoXW6RV bVVOCBcpVx5UHXeXEZplxSoKBhaxAtsttVKbZVNR0q+to2YOTnetqVoOEJdwntv62ehg9TDt u1UWLx8uNyDVVyJ0uKWUdhrl5X5IM0Z7x4rf5cNtu/Ciw9XDX+9Wjbt8uNy40zy7WpjqLE7C T2GUkrSLYZTCKfTy4XJTTfNwS0npqsKsSsRtNFxueGkerhYGescK0+Wzy80ozcPVwjVn5Z2r hbmu+nP5cLlRpHm4pbRyVWHuWJk5HS78VCKSyfeyeD7x/CUvd9u+IIfleROHBDirnExsMrd8 nmLudAmw8ulFuhZAWFA5GIeknfsrPgfZ+dqzdaZG9WqoetegHilI4qX8RVODenYNjXAwCTI2 qHctQTeSdluRhF3H/B9MgkwN6l1L0N3hElRHwxxMgkwN6tWdc+gRIFWLV74mZOJNrGUEWVAw sjpYvJCDp//OaeEyUuUy+achAf3Lr+dPQhLQaRygosJBZmykHcWFk7aKRnLWe9i6aoJt2w3A n+Kcl5HNlVg14EuzoH8KWAWy1O6t9l4NtIoHQbYReawGWXZUphraupM0PS5F+XMSgkE9CLY6 1gNmbCPYGmiLD4LtbxrWWnaAqBrbuvNFg8mtkJsfBFsdawIz8RFsaw46DYat4AEMgq2ONYF5 Bwi2NSeuBsNWYAQMgq2ONYE5FtXYmuh3DIKtjjWB+SQItjXn0HqUW1WXRb4hBlwW31tG7E66 KpcF4yG4EbHmUdCBh4CxZj7/rmG77ERDqJw84a706+Xp/IgYZUCIXl4hTVoJZfGadI5n8a/y 3ZBqN9K35VKg8nm9PL1N0cX+Ie1G16iUVHUGfe6u0tSRR66ibMsJ6R1SUOb066dutRjhYc1t lL9/SNvyTnqHtCPt5IJS2pbb0jukHaktF4S0LX+mf0ivl6f/fIKVjZVN+PJZx47fkaIzqJSq uhjyxTw+FBG3LR91Meov5pnNZpOFH2SRdpgSqdREclkKL2qVi9Db3JGAC8+X2/NsYrrTLCsi boGmhOKFJEeCR9P7rVE8GkUpRDyMiZ8bewzPlCC4kGA4axCol+4D/41iiKIEGRPJNpaxY0o4 Wgj1JxLUh9XdomSEKTFlIV5vlIoZExgWgu7nXauHNUh5F7sgISWfBTaVsQNcjnzYbzhyh6pt Kt+m47uLuT8PI24dti2DFkXWdGERvNjpbLEMl7Nl00sjsTNN18rnkI1h2oEQlkRDosY0Bzkq OWsomY29XSdQeiJPvk5AHFGdcV0+JNnQW9KIfQtDDxPPcbMjd7nh1JjC5cORzLL+CvFeK59D EcA6/nP5LMmmTy9C1+xonCh0dWzl8uFIhkp/QnetfA5CV2eApbMEP1UOrCVXkIhn8n1/7lmB s+xmDDj+Ymota2qiWsRZ+KTxRXFIYEb5wFpQMNcaZ2lXm/X9YU33i/r6qFHW+eF4eoq38d1o u97tD7P1I3tF13tVTCk1RYvfAiLn43+XqvopGSumlJryDQFINn3a1pJAlPGLetSYQLUyIyRI MqYMUTFSvPL+Uir2x4lxnTP1w56ukA09M1QMrsw1Q8Uk09EQFXNMWaSNjXFdbpFWNWvlC338 qeu5JEBLTdXnX8GkJeHSw2NcVmBFXhSU3H+cPNc4/9qE9yn6cjXVpCpT5hmNMzNqS0ozJPcX Z73Lri2mdmCRpQjTh7C9ylK17eIxiFGyV8XS7pXISZGr43biqA1j6zZjeogyyGpiic5AU9dK nQOHAzSMrduMnJ0DiNIy2wCU6Z2kiIoaN4iVq6xxrdmTRUUqpU5317hhTF91jWMMyjYCpVvj hjF91TWO8SHbAKRP4wYxepU1rq7qV6XBMJDGDWMJq2scoy62EajuGqdqCcuXXvnzyLLdWcds r2NFi/l8Oj2bVQCHxESchLNwvrCihvUZsHTaNdt7zfbW1PYC1ShJYMtmYC+Jt2u2l6ZGa2pn lc+QZFf1RjEorZOKUwyu2d7N3UiyXq7Z3ow/zy5k/mm/Xe3Oe6FY/2ZcWs8UF7r22V4ILcFG DP/97hGuK2T7rpAP/u5886VN6JcFfYSulEWUe47bDOrPcYa9+nM8Uqb+HK+2qv4cZ5+VP8eO SFTgwg+Olz4XIHDywyCljzHzqeLTOE+v9DF2iqTiMduqnnV2QL3qOUxa0kOPZdICokQlqPSL eggsNiIuLFBa9UURcWFFx6qeQ8QF0wYbERcUF0RcMCmzEXkh6AwiEkMwSYO6ZJUzaGNTQRCZ OV9DXCYzBJEZB5sMggiNjakF8FIrx0gwMYXGygdBhJFVFJEbzpKtEFS4lqryE2H8yCcikgNS hTyISA5QhKofTPhDpboPc4w8iEgOKBzyICI5YJUgDyKSQ9AHMcnBFNlBJMdBH8QkBxNyB5Ec OyfkXPTu48N69+Gb/xcAAAD//wMAUEsDBBQABgAIAAAAIQB0Pzl6wgAAACgBAAAeAAgBY3Vz dG9tWG1sL19yZWxzL2l0ZW0xLnhtbC5yZWxzIKIEASigAAEAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAhM/BigIxDAbgu+A7lNydzngQkel4WRa8ibjgtXQyM8Vp U5oo+vYWTyss7DEJ+f6k3T/CrO6Y2VM00FQ1KIyOeh9HAz/n79UWFIuNvZ0pooEnMuy75aI9 4WylLPHkE6uiRDYwiaSd1uwmDJYrShjLZKAcrJQyjzpZd7Uj6nVdb3T+bUD3YapDbyAf+gbU +ZlK8v82DYN3+EXuFjDKHxHa3VgoXMJ8zJS4yDaPKAa8YHi3mqrcC7pr9cd/3QsAAP//AwBQ SwMEFAAGAAgAAAAhAG5AQQlQAwAA2w0AABIAAAB3b3JkL2ZvbnRUYWJsZS54bWzUlk9v0zAY xu9IfIcod1bH7fpP66a2W3eCAyvi7KZuaymxKztZtzNHjsBX4Ig4wA2+DVyY+A68jpOmaxw1 GX8kEm3aXieO/cvzPG9Ozm7CwLmmUjHBB653hFyHcl/MGV8O3BfTyZOu66iI8DkJBKcD95Yq 9+z08aOTTX8heKQcuJ+rvhy4qyha9xsN5a9oSNSRWFMOYwshQxLBv3LZEIsF8+m58OOQ8qiB EWo3JA1IBM9WK7ZWbjrbpspsGyHnayl8qhQsNgzMfCFh3D1NV+ds+pyEsOqXcIXekkqG1oQL RT0YvSbBwEXHqHC4DT2HvyJS0Wh7ITblBQlZcJtVSRwJU1+zyF9l5WsiGZkF1AwptoSBWM0Q PC89XFPxAPv9Ci5c07xf8ZN5ujt3QQXm2c4Mq2+YF1RAMWUhVc4zunGei5AYVvtAMMKojZoA pgU/GP5q2YEgGxCZzJsArEjkAhaOh5NJTmQMlU635aWVnEgvrViJJPv3zDzViXz/8Prb1zeJ MkgQPQPBZO/wioVXMU9f7p5oMPKAEQI2XnZaGXXbNkYPFU0zR4S73Yne8D4ir30AUQtuSsBW R3R1G85EUGKeY9i/ptEBHhj00rFyQFbz1NeK3rI+chD/0j1jEUtGpfaPlQYGCk3UAw6aBAb/ 1HFOKOZUpnrjIprKmE5v17RopQW7oXOD2ZIsOyIxrLa0ch9l/Mp9VFskT0mwjLlzKaIV80vo jIBKE7joQ/+20+l6Ns+oDVPKDFTMlV7ymOFOrqDeeacznowKpsEHTKPDtqZpRgT65tKWK3cf 3/589S7dSiFXmkmuwOOy01y414zsjPJc+Q39ZKmrO0rPLKbA65B+kuak76oeMmMSsJlkJcqZ JH7SvmolCrIrB5SeuOV+i66vHN2REN7tSDo1h+NtJXdSRqvcSV4vUWB1ElOygh5aAmIEb0Qj 0M25pXFY5fHHQEC64ovttkESujW30XHBQvhQawY9123NQ/iGsrcdjAwHLQhz/mUOWg+2T5Qs bHNBHOIAzq7L4TIOWGhLkh+fP929/1KWJBqRPh6SJDud+X+MkhCSpMxB+qPW+Ed/5NZz0A6W ik3IHiWotfVUrpxDoQpv8mCUpN/96vQXAAAA//8DAFBLAwQUAAYACAAAACEAC8pOxDACAACa BAAAEAAIAWRvY1Byb3BzL2FwcC54bWwgogQBKKAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAACkVMuO0zAU3SPxD1FWsJg6aUuZqVyPUEdoRmKYSk1n1sa5aS0c 27Ldasq3sGALvwYfwXXSZlJALCCr+8q5x8cnoZePtUp24Lw0epbmgyxNQAtTSr2epavi7dl5 mvjAdcmV0TBL9+DTS/b8GV04Y8EFCT5BCO1n6SYEOyXEiw3U3A+wrbFTGVfzgKlbE1NVUsCV EdsadCDDLJsQeAygSyjPbAeYtojTXfhX0NKIyM/fF3uLhBktoLaKB2DvIx01KE2oKemqtDCB q0LWwM5HF9joUrrga/BsQkkb0AfjSs+G2TijpI3pfMMdFwFFZHk+GQ0p6VXoG2uVFDygwOxW Cme8qUJy10iRRARK+iMU5VmC2DoZ9gx39FP6Tmokc4Fs2gjZOb523G6Q0uvIsUvpUnAFc1SB VVx5oOSpQK+BxxtecImc6S5MdyCCcYmXn/COx2nygXuI2s3SHXeS64AaxrE2aWJlfXCskEEh NvbavAn7Y/1YjlneDGDw18EW68eXz9+/ff1/8MiuPSBuPT16Q9/fVShc+IMSw74SDalWh95Z D+GpAL1+t/iXVbdco7McuylWZwUlx5TOTW253rMbjYbSjW24SgpQIExdb/XBSslKo6GSF/j6 S/Tb4aVokI9+ZQtzFc1+uPjTYs+uDzJslpYL9FQ+moxf9Y3b69ElGhxKdOIR8alAr9ElTsW1 aHq9hvI483sjfgr37a+G5cNBhk/j/WMN/dv9A9hPAAAA//8DAFBLAwQUAAYACAAAACEAUvTQ Wn0CAABbBAAAEQAIAWRvY1Byb3BzL2NvcmUueG1sIKIEASigAAEAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfJRhb9owEIa/T9p/OOXTJi3EgQZQBKkoAQmplAqC tvVL5TpXsJo4mW2g/PtdAmR0miZFkew7P/e+50sGt+95BnvURhZq6Pgt5gAqUaRSbYbOOpm6 fQeM5SrlWaFw6BzROLfR508DUYai0PioixK1lWiASMqEohw6W2vL0POM2GLOTYsyFAVfC51z S0u98Uou3vgGvTZjXS9Hy1NuuVcB3bIhOmdkKhpkudNZDUiFhxnmqKzx/Jbv/cm1qHPzzwN1 5Cozl/ZYkqez3Gt2Kk7BJvvdyCbxcDi0Dp1aBun3vR/z+1Vt1ZWq6pVAJxqkIrTSZhhVHSoM z4D8AweFBzgU+g2kxTyEFYqdJh2wxF87qU+OgPoNU81zrDOrg3dyAzH1CEaKZ0cjDUgF8+JF ZggzRc4UWoLpvRRoBl5TvdIhNHJb6Gi8lYrDWklR5N9gkqGwuqCVqesl1E8K5Dva4ZbGwZAm g1yLLVUwZGZnEb5MkuXsa13ggq1G4Q2PJDU1Uc/zewPveqdSkKIRWpYVNUom95PxYj5fP8zG o2S2eIBVMnqIR8t49nReT8bJYknb6/gnPE6Ws0UMbeZ3XHp1AaaFDuH5nTGWPseF2FVDADQ/ GMK8VktpwTm+4ntM4eUIs2Qd+DRs/U4PuAXfD4NeGNxAoaAdeKzj+UFt6lppZSzjxs7pc3iV mN4dP7SwtvlXvDqicS+rzynyg26d02xcgI9a0pWlEQltu/SwTuK3Q9YNGXtqqJck6l89uKdr JDc0iuFpcC+R751xnEydihcQzG0Hic8qgzXvklXfF1VtgPnZ1/+JXZf1Xb+bsF540/9IvACi WvTH30H0GwAA//8DAFBLAwQUAAYACAAAACEAUDpnScsAAAA2AQAAEwAoAGN1c3RvbVhtbC9p dGVtMS54bWwgoiQAKKAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArI9BasMw EEX3hdxBzD6Wm0Uoxk4IpFkmBbdddSPLY1sgzRhpEpzbV4S2J+jyM483/9f7JXh1w5gcUwPP RQkKyXLvaGzg4/20fgGVxFBvPBM2QAz73eqp7qqWr9FiUi16tIJ9K3efga/D26F1i0yvvZMs vQyDs3gh7wiLJXlQD/BsQoYzC+rz9/sWVG5DqeoamETmSutkJwwmFTwj5dvAMRjJMY6aH+Ij 22tAEr0py63uXOcdj9HM0/1H9i+qXa3/Buf13wAAAP//AwBQSwMEFAAGAAgAAAAhAItToJpv AgAAURoAABQAAAB3b3JkL3dlYlNldHRpbmdzLnhtbOxZTW/iMBC9r7T/Afm+jSe2YwcBldiq pz11uz8gJAYiJXFku7Dtr18ngSa0IMGBIq18Shh/MH7PHr+ZTO7/lsVoI7XJVTVFcIfRSFap yvJqNUV/nh9/CDQyNqmypFCVnKJXadD97Pu3yXa8lYvf0lrX04zcLJUZ6ylaW1uPg8Cka1km 5k7VsnJtS6XLxLqfehWo5TJP5YNKX0pZ2SDEOAq0LBLrPDDrvDZoN9v2nNm2Sme1Vqk0xjlS Ft18ZZJXaOZ8zPKN2T1H23GeTRGjnGAaE9a2L1T2+pBvXNsmKdz6UdD0LhP9Sy7t3orfrU/5 an3E/Kzqz33nylpVfrA7f+aZbv7D9mMqhyxyHc3bFDn83UudpA7r9j1VhXK4Ji9WdW4UA88u G7k48OiysXq48kuGBi0Ju0U3dPxc50V2yAmPOVAiBGk58eh/4vyq6AMVAgsKPPbwHz9y14Wf MYoFBuAe/hvAzwmHiFEWevRvgD6QOCQkpiLy8N8AfsIw4yGBTgz5i/drL94QQogwYQz85r/B 5qdu8wPh9Ojmhzg8rvrj6N0+kP0Dq9f9baJyju4nglNgGLzwPJHrXVd4EhpxHO1TYR/9rxL9 u3Mwm3TPffb7f1nbFN/VLZr6CocwdJqadnr6rPpK3JddnoZlhoF9EGr7aoyPtB8j7X5bDQkB cAJbQMS7/PI8Rk5dfr3dM3K6SNfR0Na8jjJCGaEYorDTfWcx0u/6gyPSmz0fZ/HRlYSP1CAZ iyESwIXX4jfQ4kABc9LkQx7+68G/D0bd8yIt0hTsVW3zMn+Tj0rPtdoaqd3XEjfX4EPQ7B8A AAD//wMAUEsDBBQABgAIAAAAIQC3Rv7+tAEAAFoEAAATAAgBZG9jUHJvcHMvY3VzdG9tLnht bCCiBAEooAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALSUUavT MBiG7wX/Q8iVgj1NO7udjXaHnbYHCm491E7Qu9hmbbBJSvJ1xyH+dzPP1PbCG2U3ge9LeJ8n IUl491V06Mi04UpG2LshGDFZqZrLJsL78sG5xcgAlTXtlGQRPjGD79YvX4SPWvVMA2cG2Qhp ItwC9CvXNVXLBDU3dlramYPSgoItdeOqw4FXLFHVIJgE1ydk7laDASWc/nccfs5bHeFfI2tV ne3Mh/LUW911eAk/oYMAXkf4WxLESRKQwPHTZex4xLt3lrPlwiG3hPj3fvyw3KTfMerPi32M JBV269ZbDsLGHWHV9U8G9LpM36Vxvt3ud1m8KbN8h96Xm12yKZLs06VO4zIvbHuffESPaZHl CfKJN3PsMA/dP1Gh+8vyP31nI9+aApsIb6mu2rNAcBX22xFb6Y7KZkJPZdNx0yIluxPKNW+4 pN0KXdpXMQpGRp+7gfVcfpk4LVxvcRXyfESumYEJ9SrExYhIB2iVnjDj1h432kteKfEGpR2r QCtbGWSfNyqZbSghBtuhYH8Dgwpm2M/7kkkDHAZg6FVaFtnrv9m752f3/CmsfwAAAP//AwBQ SwECLQAUAAYACAAAACEAYzOnodgBAADgCAAAEwAAAAAAAAAAAAAAAAAAAAAAW0NvbnRlbnRf VHlwZXNdLnhtbFBLAQItABQABgAIAAAAIQCZVX4FBAEAAOECAAALAAAAAAAAAAAAAAAAABEE AABfcmVscy8ucmVsc1BLAQItABQABgAIAAAAIQASYCK6aAEAANMGAAAcAAAAAAAAAAAAAAAA AEYHAAB3b3JkL19yZWxzL2RvY3VtZW50LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAPI93Z99 RAAAGh4CABEAAAAAAAAAAAAAAAAA8AkAAHdvcmQvZG9jdW1lbnQueG1sUEsBAi0AFAAGAAgA AAAhADPRZB7LCwAAQ1sAABAAAAAAAAAAAAAAAAAAnE4AAHdvcmQvZm9vdGVyMS54bWxQSwEC LQAUAAYACAAAACEAKYakNmoCAADMBgAAEAAAAAAAAAAAAAAAAACVWgAAd29yZC9oZWFkZXIx LnhtbFBLAQItABQABgAIAAAAIQCX33jU3AAAAFABAAAbAAAAAAAAAAAAAAAAAC1dAAB3b3Jk L19yZWxzL2Zvb3RlcjEueG1sLnJlbHNQSwECLQAUAAYACAAAACEAAji7lGkBAAC5AwAAEgAA AAAAAAAAAAAAAABCXgAAd29yZC9mb290bm90ZXMueG1sUEsBAi0AFAAGAAgAAAAhADpb6MFp AQAAswMAABEAAAAAAAAAAAAAAAAA218AAHdvcmQvZW5kbm90ZXMueG1sUEsBAi0AFAAGAAgA AAAhAJa1reKWBgAAUBsAABUAAAAAAAAAAAAAAAAAc2EAAHdvcmQvdGhlbWUvdGhlbWUxLnht bFBLAQItAAoAAAAAAAAAIQDbr6KLQxcAAEMXAAAVAAAAAAAAAAAAAAAAADxoAAB3b3JkL21l ZGlhL2ltYWdlMS5wbmdQSwECLQAUAAYACAAAACEAheCx2WcTAAAnVAAAEQAAAAAAAAAAAAAA AACyfwAAd29yZC9zZXR0aW5ncy54bWxQSwECLQAUAAYACAAAACEAcSGuSHEdAAB24AAADwAA AAAAAAAAAAAAAABIkwAAd29yZC9zdHlsZXMueG1sUEsBAi0AFAAGAAgAAAAhAAo235bhAAAA VQEAABgAAAAAAAAAAAAAAAAA5rAAAGN1c3RvbVhtbC9pdGVtUHJvcHMxLnhtbFBLAQItABQA BgAIAAAAIQC8+1IDFhUAAFgMAQASAAAAAAAAAAAAAAAAACWyAAB3b3JkL251bWJlcmluZy54 bWxQSwECLQAUAAYACAAAACEAdD85esIAAAAoAQAAHgAAAAAAAAAAAAAAAABrxwAAY3VzdG9t WG1sL19yZWxzL2l0ZW0xLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAG5AQQlQAwAA2w0AABIA AAAAAAAAAAAAAAAAcckAAHdvcmQvZm9udFRhYmxlLnhtbFBLAQItABQABgAIAAAAIQALyk7E MAIAAJoEAAAQAAAAAAAAAAAAAAAAAPHMAABkb2NQcm9wcy9hcHAueG1sUEsBAi0AFAAGAAgA AAAhAFL00Fp9AgAAWwQAABEAAAAAAAAAAAAAAAAAV9AAAGRvY1Byb3BzL2NvcmUueG1sUEsB Ai0AFAAGAAgAAAAhAFA6Z0nLAAAANgEAABMAAAAAAAAAAAAAAAAAC9QAAGN1c3RvbVhtbC9p dGVtMS54bWxQSwECLQAUAAYACAAAACEAi1Ogmm8CAABRGgAAFAAAAAAAAAAAAAAAAAAv1QAA d29yZC93ZWJTZXR0aW5ncy54bWxQSwECLQAUAAYACAAAACEAt0b+/rQBAABaBAAAEwAAAAAA AAAAAAAAAADQ1wAAZG9jUHJvcHMvY3VzdG9tLnhtbFBLBQYAAAAAFgAWAJwFAAC92gAAAAA= --------------526E5E713A1BD152F5EE3B3B-- From nobody Fri Aug 19 14:06:57 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECBD312D608 for ; Fri, 19 Aug 2016 14:06:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 61pHbZqjMOaT for ; Fri, 19 Aug 2016 14:06:53 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id 7807C12D5D3 for ; Fri, 19 Aug 2016 14:06:53 -0700 (PDT) Received: (qmail 11568 invoked by uid 0); 19 Aug 2016 21:06:50 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy4.mail.unifiedlayer.com with SMTP; 19 Aug 2016 21:06:50 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id Z91m1t01R1MNPNq0191pQ2; Fri, 19 Aug 2016 15:01:50 -0600 X-Authority-Analysis: v=2.1 cv=PJecp5aC c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=48vgC7mUAAAA:8 a=scBmumm3AAAA:8 a=zQP7CpKOAAAA:8 a=VSIRsOEfAAAA:8 a=8C4zjoV0fnBTkdM1mbkA:9 a=QEXdDO2ut3YA:10 a=V94yKsZkkUoA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=1a7E4KP2hwp2IXpbatAA:9 a=-ZGq0Sh2bgX4ADvD:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=ef56qr_8hkesV0SKvPxj:22 a=obGFCI3_7AGB19sD6zJV:22 a=xV46cmrD53ikDHoZcr6-:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date; bh=5h2u59DUrphXAVfV+xudL9YbjjtlxxNqRL+afodQAjs=; b=mMRB CX/kBDs7CKFJksRGk03j5SAAADenPag7cS+sUi8IzWMiDEZfrasTAqrQnlGzlC9Tv4vLIUunSMnUA YP80a0+kDbJbopfIsQ2hEh75xjKV3QJg0Kh7bZ8GwReekzT; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:61350 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1baqvC-00071L-Mj; Fri, 19 Aug 2016 15:01:46 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 19 Aug 2016 17:01:46 -0400 From: Richard Shockey To: , "DOLLY, MARTIN C" Message-ID: Thread-Topic: [stir] Robocall Strike Force References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3554470906_1071888085" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1baqvC-00071L-Mj X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:61350 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 21:06:56 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3554470906_1071888085 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: 7bit Details Details .. J From: stir on behalf of Tony Rutkowski Organization: Yaana Technologies Reply-To: Date: Friday, August 19, 2016 at 4:26 PM To: "DOLLY, MARTIN C" Cc: IETF STIR Mail List Subject: [stir] Robocall Strike Force Hi Martin, Congratulations on your getting the Strike Force meeting and the combined industry effort underway today. This engagement will certainly significantly shape what ensues in stir as well as the sector. http://www.attpublicpolicy.com/fcc/fcc-hosts-first-robocall-strike-force-meeting-atts-stephenson-to-chair-industry-led-group/ Could you provide guidance on: 1) repositories of strike force related material? 2) which industry bodies will be engaged in this effort? 3) how the various industry standard bodies will be coordinated? thanks, tony _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --B_3554470906_1071888085 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Details Details= ..

 

J<= span style=3D'font-size:10.5pt;font-family:Calibri;color:black'>

 

 

From: stir <stir-bounces@ietf.org> on = behalf of Tony Rutkowski <tony@yaanatech.com>
Organization: = Yaana Technologies
Reply-To: <tony@yaanatech.com>
Date= : Friday, August 19, 2016 at 4:26 PM
To: "DOLLY, MARTIN C= " <md3135@att.com>
Cc: IETF STIR Mail List <stir@iet= f.org>
Subject: [stir] Robocall Strike Force<= /p>

 

Hi Martin,

Congratulations = on your getting the Strike
Force meeting and the combined industry
eff= ort underway today.  This engagement
will certainly significantly s= hape what
ensues in stir as well as the sector.

http://www.attpublicpolicy.com/fc= c/fcc-hosts-first-robocall-strike-force-meeting-atts-stephenson-to-chair-ind= ustry-led-group/

Could you provide guidance on:
1) repositorie= s of strike force related material?
2) which industry bodies will be enga= ged in
this effort?
3) how the various industry standard bodies
wil= l be coordinated?

thanks,
tony

_______________________________________________ stir mailing list = stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--B_3554470906_1071888085-- From nobody Fri Aug 19 14:32:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D415B12D1CB for ; Fri, 19 Aug 2016 14:32:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TCmVsMVexYZB for ; Fri, 19 Aug 2016 14:32:24 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id 7E89A12D615 for ; Fri, 19 Aug 2016 14:32:23 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id 424AE247; Fri, 19 Aug 2016 21:32:23 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id 530D158090; Fri, 19 Aug 2016 21:32:15 +0000 (UTC) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> To: Richard Shockey , "DOLLY, MARTIN C" From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <989d66c0-4403-5dd7-7c33-d905eb047faa@yaanatech.com> Date: Fri, 19 Aug 2016 17:32:21 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------41F87B445926E3D63AF89B17" Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 21:32:27 -0000 This is a multi-part message in MIME format. --------------41F87B445926E3D63AF89B17 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit You are not in Kansas (just stir) anymore. There is a broad international industry, legal, and institutional constellation in play, and things are likely to begin moving quickly. It's challenging, but Martin seems the right guy to be leading it. --tony On 2016-08-19 5:01 PM, Richard Shockey wrote: > > Details Details .. > > J > > *From: *stir on behalf of Tony Rutkowski > > *Organization: *Yaana Technologies > *Reply-To: * > *Date: *Friday, August 19, 2016 at 4:26 PM > *To: *"DOLLY, MARTIN C" > *Cc: *IETF STIR Mail List > *Subject: *[stir] Robocall Strike Force > > Hi Martin, > > Congratulations on your getting the Strike > Force meeting and the combined industry > effort underway today. This engagement > will certainly significantly shape what > ensues in stir as well as the sector. > > http://www.attpublicpolicy.com/fcc/fcc-hosts-first-robocall-strike-force-meeting-atts-stephenson-to-chair-industry-led-group/ > > Could you provide guidance on: > 1) repositories of strike force related material? > 2) which industry bodies will be engaged in > this effort? > 3) how the various industry standard bodies > will be coordinated? > > thanks, > tony > > _______________________________________________ stir mailing list > stir@ietf.org https://www.ietf.org/mailman/listinfo/stir > --------------41F87B445926E3D63AF89B17 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit You are not in Kansas (just stir) anymore.
There is a broad international industry,
legal, and institutional constellation in play,
and things are likely to begin moving quickly.
It's challenging, but Martin seems the right
guy to be leading it.
--tony

On 2016-08-19 5:01 PM, Richard Shockey wrote:

 

Details Details ..

 

J

 

 

From: stir <stir-bounces@ietf.org> on behalf of Tony Rutkowski <tony@yaanatech.com>
Organization: Yaana Technologies
Reply-To: <tony@yaanatech.com>
Date: Friday, August 19, 2016 at 4:26 PM
To: "DOLLY, MARTIN C" <md3135@att.com>
Cc: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] Robocall Strike Force

 

Hi Martin,

Congratulations on your getting the Strike
Force meeting and the combined industry
effort underway today.  This engagement
will certainly significantly shape what
ensues in stir as well as the sector.

http://www.attpublicpolicy.com/fcc/fcc-hosts-first-robocall-strike-force-meeting-atts-stephenson-to-chair-industry-led-group/

Could you provide guidance on:
1) repositories of strike force related material?
2) which industry bodies will be engaged in
this effort?
3) how the various industry standard bodies
will be coordinated?

thanks,
tony

_______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir


--------------41F87B445926E3D63AF89B17-- From nobody Fri Aug 19 14:54:54 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88CC112D66A for ; Fri, 19 Aug 2016 14:54:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.177 X-Spam-Level: X-Spam-Status: No, score=-0.177 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MISSING_HEADERS=1.021, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fyg8MmxpuArE for ; Fri, 19 Aug 2016 14:54:44 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 476EE12D612 for ; Fri, 19 Aug 2016 14:54:44 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7JLspTf008131 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 19 Aug 2016 14:54:51 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471643692; bh=6/yvzHFQ0ZV2UhfeVvtXWhVgfYD841lrFvvX8yhJ54o=; h=From:Subject:References:Cc:Reply-To:Date:In-Reply-To:From; b=AYkq6nVboFwi2ZU/q0jj5YEJEhEOqn4WNZ0vE+yxJInVQfTy5gCTZElZl7pFROYfx m1/tlHCwOvWuttC3TJmiPHunamradA7090dkaYKWVUXjxlxYI2Re/yXWcgK8HsZf4P Rxh36CUivHe+67OzOicdcB/FTJY3pKLaMsUFXyCI= From: Dave Crocker References: Organization: Brandenburg InternetWorking Cc: "stir@ietf.org" Message-ID: <7021ff80-371f-759c-c2a9-3b914a7ee397@dcrocker.net> Date: Fri, 19 Aug 2016 14:54:29 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 21:54:53 -0000 Folks, This note responds to Jon's responses to my review. (I'll be responding to Russ's request separately.) Correlating Jon's responses with the actual review (and therefore also to the full specification), to get a more complete context, proved to be an excessive burden, as well as making it essentially impossible to determine what was skipped. So I've integrated: > Jon's responses into >> my original review note, to eliminate that burden. I'll apologize now, for the inevitable miscorrelations that are sure to have occurred. Also, I'd advised Jon that skipping the small stuff would be fine, but he seems not to have done that, except sometimes... (In a meager effort to abbreviate things, however slightly, I've deleted text of Jon's, at the beginning of each his response entries, meant to provide context for the response, since the context will now be readily evident. I realize that readers will miss his colorful annotations used to introduce my comments, with really spiffy choices like: warily asks, squints, alleges, interjects with sound and fury, exclaims, denounces, condemnation, confesses, defiant, blurt out, gamely notes, and well gosh so many more clever choices. But my favorite was "interjects with bafflement"; that was really creative.) I've put "{{ No response from Jon. }}" as needed. Again, for the minor stuff, in a normal review discussion, I wouldn't worry about such omissions. Alas, given the realities of this particular exchange, it seems worth marking things explicitly for the record. I'm also sorry that I think it necessary to include all of the original material. Again, in a normal exchange I'd elide as much as possible, but am afraid it would be risky here. > On 8/8/2016 8:46 PM, Dave Crocker wrote: >> Review of: Authenticated Identity Management in the Session Initiation >> Protocol (SIP) >> ID: draft-ietf-stir-rfc4474bis-10.txt >> Date: 8 August 2016 >> Reviewer: D. Crocker >> >> >> >> >> Summary >> ------- >> >> SIP needs to support a mechanism that validates the identifier used for >> the originator of the request. That is, to ensure that the entity that >> placed the identification value into the field was authorized by its >> owner to do so. This specifications is part of a collection of >> specifications intended to enable such validation. >> >> >> Taken on its own and also when taken with its companion documents, the >> specifications are confusing and incomplete. It is quite far from being >> ready for publication. >> >> >> >> Terminology is used inconsistently. It often is introduced with no >> background or citation. Many uses of 'header' are probably supposed to >> be 'header field'. My sense is that quite a bit of terminology is used >> equally loosely. >> >> There is no integrative architectural description, so the reader has >> difficulty understanding what all of the pieces are or how they fit >> together. In fact is appears that the document itself gets confused on >> this matter. >> >> Algorithms are all offered only as prose and often in a form mitigating >> comprehension, such as tending towards negation or disjunction, which >> humans process less well than affirmatives and conjunctions. From what I >> can tell, the algorithms often are incomplete, but serious analysis is >> difficult. >> >> The documents appear to rely on a reader's having quite a bit of prior >> knowledge and are certainly not usable by an implementer who is not >> already deeply embedded in the community that produced these >> specifications. My impression is that being embedded won't suffice >> either, both from my assessment of the documents' deficiencies and given >> back-channel comments I have heard about the expectation of the work to >> be done after these specifications are published. >> >> >> Overall, the writing impedes comprehension and the document needs a very >> diligent pass by a technical editor. I suspect this will uncover quite >> a number of semantic deficiencies in the text. >> >> >> There is a possible tendency to support more alternative behavior than >> appropriate. Successful interoperability usually benefits from fewer >> choices, not more. Common, mandatory canonicalization is an example. >> >> Credentials: the specification neither defines nor references a standard >> for the specification of credentials, here. That means that the >> technical details -- as distinct from the operational policies -- of >> credentials are out of scope, although they are fundamental to proper >> operation of this serve. This is a showstopper, in terms of >> specification completeness for the service. >> >> How is the recipient to know what credential 'standard' is used? How >> does this ensure interoperability between two participants who have not >> interacted before? >> >> At base, these specifications appear intended to roughly chart out a >> system structure, leaving most of the difficult work for later and >> elsewhere. By way of example, there are few if any cross-organization >> key management services on the Internet that demonstrate the utility >> needed here. I am pretty sure that Web certs don't qualify. We know >> that DKIM's operation does, of course. However DKIM strictly uses >> domain names as identifiers and they conveniently align with their >> administrative authorities, whereas telephone numbers do not... >> >> [[[ The mailing list just had an extensive regurgitation of >> critical commentary about ENUM. What appears to be getting missed is >> that whatever mechanism is going to be used for finding and validating >> keys is going to have no operational history of reliability, safety or >> efficacy. ]]] >> >> There is remarkably little of the original RFC 4474 substance still in >> this document. Calling it a bis is a bit like tearing all of a building >> except its fireplace or its front door and calling that a remodeling. >> The previous document does not have an installed base, so I strongly >> suggest removing all references to it. It will allow some of the text >> to be notably simpler and clearer. >> >> The document is heavy with forward references. These force the reader >> to stop what they are in the middle of, try to hold that place, and look >> forward to understand what they've just been interrupted from reading. >> As a literary style, forward references create useful tension. In >> specifications they just interrupt the flow. The document should be >> reorganization so that integrative text comes /after/ the text >> describing the pieces being integrated. And opening overview, design >> summary, or the like can give a non-normative description of the >> architecture and the service, so the reader has a basic sense of the big >> picture, before diving into the detail of those to-be-integrated pieces. {{ No response from Jon. }} >> Detail Comments >> --------------- >> >>> Abstract >>> >>> The baseline security mechanisms in the Session Initiation Protocol >>> (SIP) are inadequate for cryptographically assuring the identity of >>> the end users that originate SIP requests, especially in an >> >> an end user originating a SIP request >> >> cryptographically -> adequately >> >> 'cryptographically' is not the issue here That is, it is a means, not >> an end. > The very first interjection in the line-by-line review rejects the > assertion in the Abstract that the security mechanisms of SIP are > "inadequate for cryptographically assuring the identity of end > users," instead arguing that we should substitute "adequately" for > "cryptographically". This would however result in text that reads > "inadequate for adequately assuring the identity of end users." I > think "inadequate for adequately" is a poor change. This is a pretty > good indication of the major limitation of the review overall - these > line-by-line comments often consider only one atom of the spec in > isolation from its surrounding context, and thus pose difficulties > that don't actually exist and propose remedies that do not fit very > well into local surroundings or overall plan. One would have thought that the summary comments, at the beginning, would have sufficiently served in terms of the larger picture. And while yes, I didn't catch the redundant vocabulary, you seem to have missed my point entirely. So I'll say it more fully: Overview text, for anything that is not defining new cryptography, but which starts by citing cryptography, is usually failing to focus on what is primary: necessary goals and functionality, which are the why and what, and is instead being distracted by the underlying mechanics, which are the how. In this case, that means it should not be citing crypto but should, for example, authentication. Cryptography and the use of cryptography are not a primary goal and so the summary text should instead focus on the primary goals. >> >> >>> interdomain context. This document defines a mechanism for securely >> >> 'interdomain' might suffice, but I suspect it's worth pressing the >> issue, with language like "especially across trust boundaries" or somesuch. {{ No response from Jon. }} >> >>> identifying originators of SIP requests. It does so by defining a >>> SIP header field for conveying a signature used for validating the >>> identity, and for conveying a reference to the credentials of the >>> signer. >> ... >> >>> 1. Introduction >>> >>> This document provides enhancements to the existing mechanisms for >>> authenticated identity management in the Session Initiation Protocol >>> (SIP, [RFC3261]). An identity, for the purposes of this document, is >>> defined as either a SIP URI, commonly a canonical address-of-record >>> (AoR) employed to reach a user (such as >>> 'sip:alice@atlanta.example.com'), or a telephone number, which can be >>> represented as either a TEL URI [RFC3966] or as the user portion of a >>> SIP URI. >> >> I suspect it does not 'enhance' existing mechanisms as much as add a new >> one. If the claim is actual enhancement, then what mechanism is >> enhanced and how does authenticating origin constitute enhancement of >> it? My point is that I believe the existing mechanisms will operate the >> same in the future as they have been. This spec doesn't change them. >> >> Move definitions to an explicit terminology section, rather than putting >> them into an Introduction. Also, does this document use the term >> differently than elsewhere than SIP??? Then why is 'for the purposes of >> this document' included? > At a high level, I > don't object to the existence of a terminology section, but as, to my > knowledge, only three terms defined here - identity, auth service and > verification service - I kind of think it's overkill. Also, all three > of those terms in their current sense carry over from RFC4474, which > made it to RFC without a terminology section. I don't understand the rationale behind citing a failed RFC as precedent. In any event my point was simple: When there are terms of art used in a document, they should be defined. A terminology section is a common way of doing that, especially since the document already has one. The benefits are to first to introduce the reader to the terms, before they are needed, and second to make referencing back to the definition easy. As for whether there are only 3 terms in the document that need to be explicitly defined, I didn't do an audit, but I believe the actual number is significantly higher. >> >>> [RFC3261] specifies several places within a SIP request where users >>> can express an identity for themselves, most prominently the user- >>> populated From header field. However, the recipient of a SIP request >>> has no way to verify that the From header field has been populated >>> appropriately, in the absence of some sort of cryptographic >>> authentication mechanism. This leaves SIP vulnerable to a category >>> of abuses, including impersonation attacks that enable robocalling >>> and related problems as described in [RFC7340]. Ideally, a >>> cryptographic approach to identity can provide a much stronger and >>> less spoofable assurance of identity than the Caller ID services that >>> the telephone network provides today. >>> >>> [RFC3261] encourages user agents (UAs) to implement a number of >>> potential authentication mechanisms, including Digest authentication, >>> Transport Layer Security (TLS), and S/MIME (implementations may >>> support other security schemes as well). However, few SIP user >>> agents today support the end-user certificates necessary to >>> authenticate themselves (via S/MIME, for example), and for its part >>> Digest authentication is limited by the fact that the originator and >>> destination must share a prearranged secret. Practically speaking, >>> originating user agents need to be able to securely communicate their >>> users' identity to destinations with which they have no previous >>> association. >>> >>> As an initial attempt to address this gap, [RFC4474] specified a >>> means of signing portions of SIP requests in order to provide an >>> identity assurance. However, RFC 4474 was in several ways misaligned >>> with deployment realities (see [I-D.rosenberg-sip-rfc4474-concerns]). >>> Most significantly, RFC 4474 did not deal well with telephone numbers >>> as identifiers, despite their enduring use in SIP deployments. RFC >>> 4474 also provided a signature over material that intermediaries in >>> existing deployments commonly altered. This specification therefore >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 3] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> revises RFC 4474 in light of recent reconsideration of the problem >>> space to align with the threat model in [RFC7375], and aligns the >>> signature format with PASSporT [I-D.ietf-stir-passport]. >> >> This kind of review of history is best relegated to a minor location in >> the document. If the current spec is successful, history like this will >> be distracting, 10 years from now.... > [I]t belongs where it does because this is an > update to a prior RFC, and the relationship to that RFC should be > described up front. It also contains some important info about the > objectives of the revised mechanism, including reducing signature > breakage. A specification is not an historical narrative. It's job is to specify. To the extent that historical narrative is necessary -- which it is not, in this case, given the lack of any installed base that cares about the history -- that should go into a separate section that can be ignored by developers. When historical narrative does have relevance, it needs to be quite brief; when it isn't, the text is a distraction. >>> 2. Terminology >>> >>> In this document, the key words "MUST", "MUST NOT", "REQUIRED", >>> "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT >>> RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as >>> described in RFC 2119 [RFC2119] and RFC 6919 [RFC6919]. >>> >>> 3. Background >> >> This section includes far more than background. It also provides a >> summary description of the mechanism being defined here. I suggest >> having this section only give background on sip and the problem, with a >> separate section for the design summary. Or else call this >> Introduction, but really it would be better to split them. > While I > don't think this could realistically give rise to any confusion that > would impact implementers, or improve the readability of the spec, it > isn't a change I'd rule out. I don't see any great urgency to do it, > either. Yeah. Clearer organization, designed to facilitate initial reading and later consultation, probably isn't all that helpful. >>> Per [RFC7340], problems such as robocalling, voicemail hacking, and >>> swatting are enabled by an attacker's ability to impersonate someone >>> else. The secure operation of most SIP applications and services >>> depends on authorizing the source of communications as it is >>> represented in a SIP request. Such authorization policies can be >>> automated or be a part of human operation of SIP devices. An example >>> of the former would be a voicemail service that compares the identity >>> of the caller to a whitelist before determining whether it should >>> allow the caller access to recorded messages. An example of the >>> latter would be an Internet telephone application that displays the >>> calling party number (and/or Caller-ID) of a caller, which a human >>> may review to make a policy decision before answering a call. In >>> both of these cases, attackers might attempt to circumvent these >>> authorization policies through impersonation. Since the primary >>> identifier of the sender of a SIP request, the From header field, can >>> be populated arbitrarily by the controller of a user agent, >>> impersonation is very simple today in many environments. The >> >> add: Hence the foundation to accurate authorization is valid >> authentication. {{ No response from Jon. }} >>> mechanism described in this document provides a strong identity >>> system for detecting attempted impersonation in SIP requests. >> >> "provides a strong identity system for detecting" could mean >> many things, whereas the goal here is quite specific. >> >> So replace it with: >> >> ...enables an authentication capability for protecting against... {{ No response from Jon. }} >> >>> This identity architecture for SIP depends on a logical >>> "authentication service" which validates outgoing requests. An >> >> It likely will validate them in multiple places, including incoming >> requests. > As described in this > specification, an authentication will not do that. On reflection, the more interesting issue is reference to an 'architecture' which is not defined (or depicted) in the document... Worse, from various postings over the last few weeks, it's clear that different people have a different sense of what the purported architecture is. >>> authentication service may be implemented either as part of a user >>> agent or as a proxy server; typically, it is a component of a network >>> intermediary like a proxy to which originating user agents send >>> unsigned requests. Once the sender of the message has been >>> authenticated, the authentication service then computes and adds >> >> sender? Does that mean the caller? the caller's ua? the caller's >> operator? the term is ambiguous. {{ No response from Jon. }} >> >>> cryptographic information (including a digital signature over some >>> components of messages) to requests to communicate to other SIP >>> entities that the sending user has been authenticated and its claim >> >> worth breaking this sentence into two, for better clarity. {{ No response from Jon. }} >>> of a particular identity has been authorized. A "verification >>> service" on the receiving end then validates this signature and >>> enables policy decisions to be made based on the results of the >>> verification. >>> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 4] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> Identities are issued to users by authorities. When a new user >>> becomes associated with example.com, the administrator of the SIP >>> service for that domain can issue them an identity in that namespace, >>> such as alice@example.com. Alice may then send REGISTER requests to >>> example.com that make her user agents eligible to receive requests >>> for sip:alice@example.com. In some cases, Alice may be the owner of >>> the domain herself, and may issue herself identities as she chooses. >>> But ultimately, it is the controller of the SIP service at >>> example.com that must be responsible for authorizing the use of names >>> in the example.com domain. Therefore, for the purposes of baseline >>> SIP, the credentials needed to prove a user is authorized to use a >>> particular From header field must ultimately derive from the domain >>> owner: either a user agent gives requests to the domain name owner in >>> order for them to be signed by the domain owner's credentials, or the >>> user agent must possess credentials that prove in some fashion that >>> the domain owner has given the user agent the right to a name. >>> >>> The situation is however more complicated for telephone numbers, >>> however. Authority over telephone numbers does not correspond >> >> however...however {{ No response from Jon. }} >> >>> directly to Internet domains. While a user could register at a SIP >>> domain with a username that corresponds to a telephone number, any >>> connection between the administrator of that domain and the >>> assignment of telephone numbers is not currently reflected on the >>> Internet. Telephone numbers do not share the domain-scope property >>> described above, as they are dialed without any domain component. >>> This document thus assumes the existence of a separate means of >>> establishing authority over telephone numbers, for cases where the >>> telephone number is the identity of the user. As with SIP URIs, the >>> necessary credentials to prove authority for a name might reside >>> either in the endpoint or at some intermediary. >> >> Note that the preceding discussion makes no mention of "SIP URI". If >> one reads back and connects some dots, the reader might guess that the >> alice@ discussion is for a SIP URI, but the text should make this explicit. > But > actually the text says: > > Identities are issued to users by authorities. When a new user > becomes associated with example.com, the administrator of the SIP > service for that domain can issue them an identity in that > namespace, such as alice@example.com. Alice may then send REGISTER > requests to example.com that make her user agents eligible to receive > requests for sip:alice@example.com. > > ... so it says sip:alice@, not merely alice@, and in fact a search > will show that exact string "SIP URI" does appear in Section 3. The alice@ string was a shorthand. Actually Section 1. *This* is Section 3. >> The following paragraph really is the design summary for the specification: >> >>> This document specifies a means of sharing a cryptographic assurance >>> of end-user SIP identity in an interdomain or intradomain context. >> >> I suspect the above sentence is seriously redundant. If it isn't, it >> needs to be quite a bit sooner, since it is fundamental. Certainly it >> is not 'background'. > The review here does not like the > presentation of this material in a section called "Background." It is > hard to see how much sooner in the specification statements can be > made than here. A statement of the purpose of a document should come sooner than Section 3. >>> It relies on the authentication service constructing tokens based on >>> the PASSporT [I-D.ietf-stir-passport] format, a JSON [RFC7159] object >>> comprising values copied from certain header field values in the SIP >>> request. The authentication service then computes a signature over >>> those JSON object in a manner following PASSporT. That signature is >> >> "those JSON object" ? >> >> Also, where is the object? How is it created? How is it conveyed? > This is > a section on background, it is does not detail the protocol's > operations. This review is very critical of forward references, and > yet equally critical of any section that lacks them. Information has > to be communicated in some order. Giving a big picture up front > without such details is helpful. Alas, talking about Passport and JSON is not 'background'. "Background" normally means setting the stage about problems, needs, and maybe prior work. Yet this references text is about the *technical substance of this document*. That's 'fore'ground. >> Also 'The authentication service' might refer to the signing side or to >> the verifying side. How is the reader to know for certain? A diagram >> of the overall service and its components could be quite helpful. > No, the "authentication service" as > described here behaves differently, and does not appear on the > verifying side. A diagram isn't out of the question, but the > difficulty is that the authentication service is a logical role that > might be played by elements in different components of a call flow, > so it would always be just an example instantiation rather than a > complete picture. The term is used as if it is a term of art. But no definition is given here or later and, as you note, it has no precise meaning. It could be this or that, here or there. >>> then placed in a SIP Identity header. In order to assist in the >> >> header /field/? > This is the first of many places where the > review mentions this. There's another in 5.1 ("header? or header > field?"), some in 5.2 ("headers? header fields?" and a few hints of > "header [field"), at the beginning of Section 8 ("header *field*") > and so on. To be clear, the review is absolutely correct that there > is a distinction between a header, a header field, and a header field > value, and that the text in rfc4474bis handles that distinction > pretty loosely. It is full of constructions like the following (taken > from 5.1): > > An authentication service MUST add a Date header field to SIP > requests that do not have one. The authentication service MUST > ensure that any preexisting Date header in the request is accurate. > > In one case there, it uses the full construction "Date header field", > and then in literally the next sentence, it casually uses "Date > header" instead. From a quick glance at the usage of "header" vs. > "header field value" in rfc4474bis, it looks like "header" appears > around 240 times, and "header field" only a few more than 70. Surely > most of those usages of "header" should actually be "header field", > as in the quote from 5.1 above. Probably many more should be "header > field value" (which appears only a dozen times). However... SIP has > never been real good about this. Oh, I remember during RFC3261 how > diligent we were in trying to keep these straight. But if you look at > subsequent header specifications for SIP, like say Replaces (RFC3891) > or History-Info (RFC4244), we never really locked this down. The > numbers of "header" vs. "header field" vs. "header field value" for > the original RFC4474 are pretty similar to what we see in rfc4474bis. > I think the reason why we continue to use it pretty casually is, > well, because as that quote above from 5.1 illustrates, there isn't > any damaging ambiguity about this. The second sentence really is > talking about the "header field value", as it is not the "header > field" that is "accurate" or not. I suspect the reason why we SIP > folks have been lax about this is because the construction "Date > header" in sentences like the above is not actually unclear in any > meaningful way, it is perfectly obvious what it means. All that said, > it isn't a huge amount of work to be precise about this - if anyone > would like to make the case that there's actually a practical problem > here rather than a merely pedantic exercise involved. The casual use > of "header" certainly hasn't prevented the publication of many > previous SIP header specification RFCs. I'm not sure what the point of a lengthy history about other inconsistent uses of the terms is, unless they are supposed to somehow make inconsistent use acceptable here. They don't. Really, I was making only the simplest of points: These terms have definition and this document is a specification. It should define (or cite definitions of terms of art and it should use them carefully and correctly. >>> validation of the Identity header, this specification also describes >>> some metadata fields associated with the header that can be used by >>> the recipient of a request to recover the credentials of the signer. >>> Note that the scope of this document is limited to providing this >>> identity assurance for SIP requests; solving this problem for SIP >>> responses is outside the scope of this work (see [RFC4916]). Future >>> work might specify ways that a SIP implementation could gateway >>> PASSporT objects to other protocols. >> >> And it might not. To the extent that you have to say something about >> work that might or might not be done, just cite the topic and that it >> isn't covered here. Such as: >> >> Gatewaying Passport objects to other services is outside the >> scope of this specification. >> > I think it is pretty > clear from a casual glance at the RFC series that statements about > directions for future work are common in RFCs, and that there is no > bar against them. Some RFCs are written well; some are not. This appears to take the view that the very large body of problematic RFC content serves as precedent to allow the continued writing of bad RFCs. Forgive me for taking the view that the goal should be writing RFCs well and noting that RFCs that are clear about the boundaries of the spec -- including explicitly noting items that are outside of scope -- tend to be the better sort of writing, as do RFCs that refrain from predicting the future, especially since they are almost always wrong. >> (Odd thought: Given that JSON isn't native to SIP and that there must >> be some translation/encoding of the json object to work with SIP, that >> effectively means that this /is/ a gatewaying application of the object...) > As far as odd thoughts go, that's not far from > how we see it. We imagine there will be hopefully seamless gatewaying > to a lot of non-SIP applications. Cullen's draft about WebRTC > gatewaying is a good place to look at what some of the practical > challenges are to getting this to work. Hence my point that JSON/JWT aren't native to this work. While I'm a fan of a core, canonical representation when there is a gatewaying model, the nature of gatewaying that is interesting is semantic mapping and the fact of the matter is that anything other than trivial encoding-translation gatewaying loses information... Always. (My graduate work was on email gatewaying, which was popular and necessary back then, so this technical aspects of gatewaying, as a special type of processing, is particularly significant topic to me.) (BTW, all I found was draft-ietf-rtcweb-gateways-02, which isn't by Cullen.) >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 5] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> This specification allows either a user agent or a proxy server to >>> provide the authentication service function and/or the verification >>> service function. To maximize end-to-end security, it is obviously >>> preferable for end-users to acquire their own credentials; if they >> >> "To maximize end-to-end security, it is obviously preferable for >> end-users to acquire their own credentials;? >> >> I'm not exactly sure what this means or is supposed to mean, but I >> suspect it's incorrect. > Well, what it means is > explained if you don't take this phrase in isolation and pretend like > it is something with no context. The prior sentence begins by stating > that the authentication service function can exist at either a user > agent or a proxy server. One of those is an endpoint and one is an > intermediary. For something to be "end-to-end", it will extend from > endpoint to endpoint. As the authentication service does signing, it > requires credentials to perform the signature. In order for an end > user's endpoint to act as an authentication service, the end user > thus needs to be able to acquire credentials. The rest of this > paragraph is about why that isn't so easy. I don't think this is > either incorrect or particularly hard to follow from the text that is > already there. That's the problem with having text that makes a very broad assertions without explaining them. There is a rather substantial body of experience that says that individual end-users tend to be really awful at doing all the stuff that serves as the basis for the simplistic assertion here. If the draft had said something more like "To maximize end-to-end security, it is obviously preferable for end-systems to acquire their own credentials", the problematic human factor would be removed and the valid technical point would remain. >> >>> do, their user agents can act as authentication services. However, >>> for some deployments, end-user credentials may be neither practical >>> nor affordable, given the potentially large number of SIP user agents >>> (phones, PCs, laptops, PDAs, gaming devices) that may be employed by >>> a single user. In such environments, synchronizing keying material >>> across multiple devices may be prohibitively complex and require >>> quite a good deal of additional endpoint behavior. Managing several >>> credentials for the various devices could also be burdensome. In >>> these cases, implementation the authentication service at an >>> intermediary may be more practical. This trade-off needs to be >>> understood by implementers of this specification. >>> >>> 4. Overview of Operations >>> >>> This section provides an informative (non-normative) high-level >>> overview of the mechanisms described in this document. >> >> described -> specified (or defined) >> >> But note that we've already been given a high-level overview... >> >> On reflection, this section isn't an 'overview'. It's an example >> scenario. The essential difference is that this makes specific choices, >> such as use of a proxy, which might not apply in some valid scenarios. >> As some integrative pedagogy, that's fine. So I suggest re=labeling the >> section rather than changing it's substance. > The > "overview of operation" here follows the section of the same name, > which also happens to be section 4, in RFC3261. Okay, the name of the > section there is singular and not plural - but it is also basically a > concrete example. > > * That much said, I'd be willing to change the "Background" section > to "Overview" and move the "Overview of Operations" section into an > "example" subsection of "Overview", if that helps. Again, I don't > think it'll help much, if at all, but it's easy to do. >>> Imagine a case where Alice, who has the home proxy of example.com and >>> the address-of-record sip:alice@example.com, wants to communicate >>> with Bob at sip:bob@example.org. They have no prior relationship, >>> and Bob implements best practices to prevent impersonation attacks. >>> >>> Alice generates an INVITE and places her identity, in this case her >>> address-of-record, in the From header field of the request. She then >>> sends an INVITE over TLS to an authentication service proxy for the >>> example.com domain. >> >> How is reference to TLS meaningful here? > The use of TLS to > protect the first hop from the user agent to an intermediary-based > authentication service has security properties that are discussed > later in the document, in particular in Section 12.4. But for the > purposes of this overview here, it is merely exemplary. I think that the problem is with the entire approach to the section. The title of the section does not match the content. The content is merely a specific example. Examples preclude alternatives. In this case it appears that the example also extends beyond the scope of the specification itself. So, for example, TLS comes in as a tidbit of detail, about a system component that is not covered in detail by the specification. Reference to TLS is appropriate for an overall system description that covers all of the pieces at all of the layers. Within a specification about a SIP Invitation Signing and Verifying protocol, it is a layer violation. >>> >>> The proxy authenticates Alice (possibly by sending a Digest >>> authentication challenge), and validates that she is authorized to >> >> Again, how is discussion of the internal, non-STIR aspects of SIP >> operationally relevant here? {{ No response from Jon. }} >> >>> assert the identity that she populated in the From header field. >>> This value could be Alice's AoR, but in other cases it could be some >>> different value that the authentication service has authority over, >> >> That bit of vagueness isn't helpful, given the motivation for doing this >> work. It reduces to: something will get authenticated, but we won't >> say what and we won't say where to find out. {{ No response from Jon. }} >> >>> such as a telephone number. The proxy authentication service then >>> constructs a PASSporT object which contains a JSON representations of >>> headers and claims which mirror certain parts of the SIP request, >>> including the identity in the From header field. As a part of >>> generating the PASSporT object, the authentication service signs a >>> hash of those headers and claims with the appropriate credential for >>> the identity (in this case, the certificate for example.com, which >>> covers the identity sip:alice@example.com), and the signature is >>> inserted by the proxy server into the Identity header field value of >>> the request. Optionally, the JSON headers and claims themselves may >>> also be included in the object, encoded in the "canon" parameter of >>> the Identity header. >> >> why? when? >> >> Tossing in vague references about optional behavior that is neither >> motivated nor explained usually proves more of a distraction than a >> help, when writing an 'overview' or an example. > Well, I disagree. Having a non-normative overview of > how the mechanism works is valuable precisely because it is not > muddled by the motivation or the specification. Perhaps the import of 'vague' and 'neither motivated nor explained' wasn't clear. I'll try harder: Text that is meant to explain things should explain things. Telling people about an action that is not explained introduces the alternative but gives the reader no understanding about it. It does not even tell them what the *range* of equivalent alternatives is. What's missing is a separate description of this service, independent of the specifications for its technical details. Hence the text here is conflating document goals and it's not being clear about that. >>> Peterson, et al. Expires January 8, 2017 [Page 6] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> The proxy, as the holder of the private key for the example.com >>> domain, is asserting that the originator of this request has been >>> authenticated and that she is authorized to claim the identity that >>> appears in the From header field. The proxy inserts an "info" >>> parameter into the Identity header that tells Bob how to acquire >>> keying material necessary to validate its credentials (a public key), >>> in case he doesn't already have it. >> >> A scheme that has an untrusted object carrying information about where >> to find trust information for the object sounds like a serious security >> hole. Why should the pointer be trusted? > This is a comment the reviewer has raised > before, will raise again below in the comments on 6.2. The short > answer is that there is no security hole, but a long response will > wait for 6.2 (if we can use a forward reference here). This is just a > section saying how the mechanism operates, not why the mechanism > operates the way it does. >> >>> When Bob's domain receives the request, it verifies the signature >>> provided in the Identity header, and thus can validate that the >>> authority over the identity in the From header field authenticated >>> the user, and permitted the user to assert that From header field >>> value. This same validation operation may be performed by Bob's user >>> agent server (UAS). As the request has been validated, it is >>> rendered to Bob. If the validation was unsuccessful, some other >>> treatment would be applied by the receiving domain. >> >> Huge operational transition question: How is the absence of the >> signature treated? Today, there are no signatures. Tomorrow there >> might be some, both it won't be true that */all/ incoming requests are >> signed. So how is the receiver supposed to handle the absence of a >> signature? > The actual policies that SIP entities apply to requests > in the presence or absence of the Identity header are outside the > scope of this specification, as is clearly stated at the end of 5.2. > The short answer is that this is an over-the-wire protocol spec, and > that as such, it is already complex enough without dipping into those > matters. But again, Section 4 probably wouldn't be the right place to > explore that question anyway. That response suggests a serious lack of attention to well-established operational issues for this topic: The handling of a missing signature and the handling of a broken signature are an essential part of a signature service, especially when the service is being added to an already-running service. The realities of call request transit are going to have serious complexities for a long time, possibly forever. Transit complexities are essentially certain to sometimes break otherwise-legitimate signatures. Their semantics for handling need to be standardized, lest the inevitable variations of 'local policy' undermine the the efficacy of the overall service. >> Related question: Is everyone certain that transit of the request will >> /never/ break the signature? What is the basis for that assessment? And >> if a signature /can/ break, then the interpretation of an invalid >> signature could mean either spoofing or operational error. > We are > certain that, with some exceptions detailed in the document, we want > to treat the breaking of the signature in transit as a security > violation, regardless of why it happens. *That's a mistake. If the infrastructure will sometimes break the signature, then penalizing the signer for actions not under their control will be problematic. That's why DKIM explicitly mandates treating a broken signature exactly the same an absent signature.* > Circumstances in which the > signature might be broken are discussed throughout the specification. Scattering this essential topic all over a document does not facilitate getting careful, focused consideration of it. Yet it is a discrete topic, entirely amenable to that focused attention. > In fact, the mention of this in the last paragraph of Section 1 is > one of the reasons why that text needs to stay in the specification. > This entire effort, as the STIR problem statement (RFC7340) says, was > largely motivated by trying to minimize signature breakage. It is > nice that the overview of operations at least inspires these > questions, which are the right sorts of questions to be asking about > a mechanism like this. Suffice it to say that we've thought about the > past three questions a lot over the years - these aren't exactly new > issues being raised. No they aren't. DKIM wrestled with them extensively roughly 10 years ago. To the extent that STIR came up with different answers, it is not possible to see that it did or why, but it should be. >>> 5. Signature Generation and Validation >>> >>> 5.1. Authentication Service Behavior >>> >>> This document specifies a role for SIP entities called an >> >> delete first sentence. it adds no useful information. > A similar comment is made about the > first sentence in 5.2. I do not believe it is a problem for sections > of a specification to begin with an introductory sentence that queues > up the topic about to be discussed. I comment more about this as a > document organization matter, as that is how it is raised in 5.2 - as > a question of redundancy. A continuing issue that I found significant enough to count as problematic is extreme redundancy and verbosity throughout the document. Overall, the document seems to have been written with the view that more words are always better, rather than that the right *balance* of words is best and that excessive text serves more as a distraction than as clarification. That's why I gave in to using the unpleasant word 'bloated' when commenting on the set of documents. The fact that IETF documents are free to include background and explanations is one of the things that make them so much better than the stilted over-structured documents done is some other SDOs, but this does not mean that constantly tossing in extended text is helpful. >>> authentication service. The authentication service role can be >>> instantiated, for example, by an intermediary such as a proxy server >> >> Constant references to implementation (and 'instantiation') >> possibilities distracts from the required task of defining the >> architecture and functions of the service. > The idea that there are > abstract "roles" which are instantiated by entities in a SIP > architecture for the purposes of even a single transaction is a core > SIP concept (see the UAC or UAS roles, or RFC3261 10.1 on the > abstract "location service"), and is foundational to how the > mechanism in this document is to be understood. This specification is > only defining an "architecture" in so far as it defines the > authentication and verification service roles. This appears to be a very basic disagreement about a very basic issue! *In point of fact, these specifications are attempting to define an authentication service overlay for SIP. That is, STIR is an additional layer of architecture ABOVE SIP. * An example of a comparable overlay is shown in Figure 1: DKIM Service Overview https://tools.ietf.org/html/rfc5585 DKIM is on top of RFC 5322, not part of it, just as STIR is on top of SIP and is not part of it. This really is quite an important architectural point, IMO. >>> or by a user agent. Any entity that instantiates the authentication >>> service role MUST possess the private key of one or more credentials >> >> "private key of one or more credentials" - not sure what this means? >> >> One key can have more than one credential? On the signing side, I'd >> expect the process to start by choosing a credential and then using its >> associated key. > No, an authentication service may have multiple credentials > associated with different names, where each credential has an > associated public and private key. Review proposes the wording "The > authentication service possesses the private..." but this is > rejected, because that loses the sense that there may be multiple > private keys due to having authority over multiple names. I'm not sure what "there may be multiple private keys due to having authority over multiple names" means exactly, but it probably doesn't matter for the immediate issue. A STIR-signed request comes in. The host doing the evaluation needs to find the key. They need a simple, efficient, reliable and secure means of locating that key. They are not going to search among multiple credentials, so in this context, it doesn't matter that there might be multiple. At the time of the lookup, they need to get to the one, correct credential needed at that time. Mostly, this discussion of credentials and keys is vague and confusing, but it needs to be extremely clear. >> Simpler wording: The authentication service possesses the private... >> >> >>> that can be used to sign for a domain or a telephone number (see >> >> can be used to sign the From identity. > The scope of the credential is over the domain or > telephone number, and the credential could be used outside the SIP > context - there's no sense in which the credential is specific to the > identity appearing in a From header field. The value of this proposed > edit is thus very dubious. First, text that has to constantly cite an 'or' condition, as above, is text that has not properly factored issues and references. As an example, the phone-number/domain-name distinction should be dealt with in some isolated sections and there should be a common name for the obtained value in the rest of the document. I keep using 'caller-id' because various folk thought it a workable choice, but I don't care what specific term is used. A common way to do this kind of abstracting of a set of technical choices is to define some ABNF that lists the alternatives and use the rulename for that ABNF in the rest of the document. In other cases what suffices is prose that defines a term, where the definition is the set of alternatives. The change in wording I was suggesting was trying to get to a single common term. I'm also fine if 'From' value is not the correct answer. But the document is constantly going back to underlying alternatives throughout rather than building things up into integrative constructs and labels for them. As for the explanation about credentials, I did not see anything in any of the three documents that specified/explained any of this well enough to provide or anticipate the above response. >>> Section 6.1). Intermediaries that instantiate this role MUST be >> >> forward reference. better to put that material before this. > The review here refers to whether the header syntax (Section 8) > should go before authentication service behavior (Section 5.1). There > is no free lunch here; neither belongs before the other, one will > have to refer to the other. We can't do everything at one time. > Complaints like this are easy to lodge, but that doesn't make them > persuasive. As I tried to explain: *The current approach places an extra burden on the reader. They are constantly presented with important terms and details that they do not yet understand. This forces them to interrupt their current reading, mark their place, and go search for the underlying detail, if they want to understand the current text. In contrast, a bottom-up model for such presentation of information ensures that the user can read in a smooth sequence, without the interruption.* The issue is not about the need for references, but about the reading process. >> >>> capable of authenticating one or more SIP users who can register for >> >> one or more SIP users -> users >> >> the word identity hasn't bee used in this paragraph, before this, so the >> referent is unclear. > Identity is a > fundamental concept in this document, there is no need to refresh it > here. Apparently the word 'referent' was not clear. Sorry. I meant that for the next use of identity (just below,) the 'that' isn't a clear reference to me. I was commenting on ambiguous writing, not the meaning of the term identity. >> Also, this requirement for authentication appears to be redundant with >> the later specification for authentication in Step 2. > This text in the introductory paragraph states, as a prerequiste for > operations, "Intermediaries that instantiate this role MUST be > capable of authenticating one or more SIP users who can register for > that identity." The text in step 2 states that during operations, > "The authentication service MUST then determine whether or not the > sender of the request is authorized to claim the identity given in > the identity field." The distinction here is between stating a > prerequiste for any activity and then mandating performing the > activity as a component of normative messaging processing. It is not > redundant. >> >>> that identity. Commonly, this role will be instantiated by a proxy >>> server, since these entities are more likely to have a static >>> hostname, hold corresponding credentials, and have access to SIP >>> registrar capabilities that allow them to authenticate users. It is >>> also possible that the authentication service role might be >>> instantiated by an entity that acts as a redirect server, but that is >>> left as a topic for future work. >> >> Not only is the above, last sentence about future work; it appears to be >> entirely irrelevant to this specification. Remove it. > No, the purpose of statements like this in > specifications is to say "hey, we thought of an idea that might be > useful someday, and while we didn't want to spec it now, we did want > to capture it and try to structure the mechanism in a way that > wouldn't preclude it, in case somebody feels like fleshing this out > sometime." The contention that statements like this are abnormal in > IETF specifications would not withstand even casual scrutiny. Fantasy is fun. Discussing enhancements is fun. But it isn't specification. And, again, it is rarely correct, especially when the fantasy asserts a future statistic, like 'commonly'. (Again, the fact that some RFCs indulge in poor practices ought not to serve as justification for doing more of the same. Precedence is good for something that is useful, not for something that is problematic) So move it out of the specification, into a carefully marked section or document that makes clear it is romping through fields of possibility that might or might not have anything to do with what actually will happen. Placed in the middle of technical specification, it serves as distraction for the developer. >>> An authentication service adds the Identity header to SIP requests. >> >> Note that we've read this before. So I'm raising a redundancy flag. > I don't think there is any harm in > beginning a paragraph that describes the steps taken to add an > Identity header to a request with a topic sentence that states what > an authentication service does at a high level. There is harm. It bloats the document. It bores the reader. It invites opportunities for making errors by virtue of creating text that might vary from its sibling (parent?) text, thereby creating conflicting content. It also makes revision more difficult, when every occurrence of something needs to be tracked down and modified. (By way of example, the reply to my review was done as a note entirely separated from my inline review, but included text at the beginning of each response that was intended to set context, usually by quoting my text and/or the draft's text. Periodically, those quotations had errors... >>> The procedures below define the steps that must be taken when each an >>> header is added. More than one may appear in a single request, and >> >> header -> header /field/ ? >> >> And, by the way, what header field is that? {{ No response from Jon. }} >> The "the procedures" sentence adds nothing and is redundant with the >> later "entities instantiating" sentence. >> >> In any event, don't make forward references like this. Put it after the >> relevant details, so that there already is context and this just >> enhances it. > This is just > introductory material that sets the stage for the steps that will > follow, there is no order problem here. (My review missed the typo: "when each an header") >> From what I can tell, this entire paragraph should be moved toward >> the end of this section. The 'recommendation for moving text was especially about the 'more than one' text. >>> an authentication service may add an Identity header to a request >>> that already contains one or more Identity headers. If the Identity >>> header added follows extended signing procedures beyond the baseline >>> given in Section 8, then it differentiates the header with a "ppt" >>> parameter per the fourth step below. >>> >>> >>> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 7] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> Entities instantiating the authentication service role perform the >>> following steps, in order, to generate an Identity header for a SIP >>> request: >> >> The authentication service performs the following steps in >> order, to... >> >> Procedural detail should be in a procedural form. Extended prose like >> this isn't as easily grokked. That invites both writing and reading >> errors to the algorithm. > We ended up with the original text > because too many people were reading "the authentication service" to > mean "a proxy server or other intermediary", and by using the longer > construction, we are reminding readers that the authentication > service role may be instantiated by various entities in the > architecture. I don't believe this construction as given here is too > difficult to "grok"; it is not repeated in the steps below, and is > only here to emphasize the flexibility of the role. Your explanation suggests deeper problems with reader comprehension. In any event: *The immediate problem is that the steps are part of the architecture, independent of implementation details. So by saying 'entities instantiating' the document is stepping into sounding like it is talking about implementation. There is a general challenge in the IETF, and elsewhere, in creating and maintaining clarity about networking architectures -- which are abstractions -- as distinct from the many ways they can be implemented. IETF specifications should encourage clarity, not add to the confusion.* >> >>> Step 1: >> >> >> Step 1: Authoritative for Identity >> >> >>> First, the authentication service must determine whether it is >>> authoritative for the identity of the sender of the request. In >>> ordinary operations, the authentication service decides this by >>> inspecting the URI value from the addr-spec component of From header >>> field; this URI will be referred to here as the 'identity field'. If >>> the identity field contains a SIP or SIP Secure (SIPS) URI, and the >>> user portion is not a telephone number, the authentication service >> >> how is its not being a telephone number determined deterministically and >> correctly? > By following the procedures in > Section 7. That's nice. A shame the citation isn't in the step, so the reader will have some clue. *Also, Section 7 does not define clear, complete and deterministic (interoperable) procedures.* Given the complexities of figuring out what identifier is to be validated, this step should be in two parts. The first is to get the identifier. The above text seems to indicate the identifier always comes from the From: header field, but I believe that is not correct, given comments elsewhere in the document and in this review exchange. The second is to assess 'authority' over it -- although I suspect that question is the wrong one, where the right one is *authorization* to validate the use of the identifier. And that's a significant difference. >>> MUST extract the hostname portion of the identity field and compare >>> it to the domain(s) for which it is responsible (following the >>> procedures in RFC 3261 [RFC3261], Section 16.4). If the identity >>> field uses the TEL URI scheme [RFC3966], or the identity field is a >>> SIP or SIPS URI with a telephone number in the user portion, the >>> authentication service determines whether or not it is responsible >>> for this telephone number; see Section 7.1 for more information. An >> >> This canonicalization text seems entirely out of place, in the middle of >> specification about authority. > It is not out of place in > the process that authentication services must complete, it is given > at exactly the point where it needs to happen. Before you can > ascertain whether or not you are authoritative for an identity, you > need to have the identity in a canonical form. Canonicalization is a relatively complex issue for this activity. (Among its complexities are the tradeoffs among loss of information, ease of use, and robustness against transit behaviors.) One can, of course, specify a series of steps that fully expand all the details inline. That's like programming without subroutines. However humans comprehend sequences better when they are presented with more coherence and brevity, versus presentation of all the fine-grained details in an extended sequence. That is, when the steps can be seen easily. One of the many downsides of expanding everything inline is that the reader is likely to lose their sense of the overall sequence. Move canonicalization to its own subsection and then just cite it here. >>> authentication service proceeding with a signature over a telephone >>> number MUST then follow the canonicalization procedures described in >>> Section 7.2. If the authentication service is not authoritative for >>> the identity in question, it SHOULD process and forward the request >>> normally unless the local policy is to block such requests. The >>> authentication service MUST NOT add an Identity header if the >>> authentication service does not have the authority to make the claim >>> it asserts. >>> >>> Step 2: >> >> Step 2: Authorization >> >>> >>> The authentication service MUST then determine whether or not the >> >> [or not] remove > A similar comment also appears in Section 7. > I'd rather keep the "or not" with the "whether." Consulting the > relevant entry on "whether" vs. "whether or not" in an English usage > dictionary (Merriam Webster) it notes that "the use of 'or not' is > more than 300 years old and is common among educated English speakers > and writers. It is, in short, perfectly good, idiomatic English." > More to the point, I am really unsure what the value would be in > tagging stylistic decisions like this that can easily go either way > in a review of a technical specification - other than in so far as it > makes the review just a little longer and gives the person answering > it just a little more work to do. That goes double for flagging this > as an "issue" twice. This is, of course, purely a stylistic point: But again, the issue is not whether something is legal or has precedent, but whether it is constructive to the document's purpose. In this case the question is whether the 'or not' adds information. In some usages it does. This is not one of those. (cf, bloat. I realize you have already seen a number of such comments from me, but I figure it can't do any harm to keep repeating it...) >> >>> sender of the request is authorized to claim the identity given in >> >> sender: calling user?, calling ua?, originating operator? >> intermediary? Although the word is used frequently in the SIP spec, it >> is not defined. > Well, if it's flagged here, why not flag it back That's an interesting model you seem to be asserting: A problem isn't a problem unless it is properly cited at its first occurrence or at all its occurrence or...? Really, Jon? This is where I noted it or where I finally decided it was worth commenting on, or... So please explain: What is the intended benefit of criticizing which occurrence got the comment? > in section 3, for the sentence, "Since the primary identifier of the > sender of a SIP request, the From header field, can be populated > arbitrarily by the controller of a user agent, impersonation is very > simple today in many environments." The sender of a SIP request is > the entity that instantiates (learn to love it) the user agent client > role in a SIP transaction. Practically speaking, that could be an > intermediary in some cases, but it is most commonly an endpoint under > the control of a calling user. Anyway, I don't think there's any > ambiguity about what "sender" means here, especially given the > earlier usage in Section 3. It is as you note pretty common in SIP > specs. There is a basic lack of semantic clarity with the word 'sender' in any store-and-forward networking environment. Everyone is a sender, except maybe the last guy in the sequence. As a consequence, the word 'sender' needs to be used only in very precise ways, such as calling a client a sender (unless it's a receiver...). In this case, the specific referent for the term was unclear to me. That raises the odds it will be unclear for some other readers. If you don't care about clarity for a broad base of readers, then sure, ignore my concern. >> >>> the identity field. In order to do so, the authentication service >>> MUST authenticate the sender of the message. Some possible ways in >>> which this authentication might be performed include: >> >> Remove the pedagogy after the first sentence. The choices are outside >> of this specification and the spec is not enhanced by pedagogy about >> technical matters outside of its scope. >> >> Also isn't the first sentence redundant with other text in the spec? > This requests the removal of some non-normative text that gives > examples of how an authentication service might authenticate the > sender of a message. Why this text should be "pedagogical" is a bit > obscure to me, as is why it would be a bad thing if it were - the > examples that follow are the ways that this step will probably be > accomplished, though we don't want to mandate any one in particular. Examples are pedagogy. The provide legal and/or plausible and/or relevant details to improve the reader's understand of the general point being described. Putting pedagogy in the middle of the specification of a sequence invites reader distraction. When pedagogy is needed, put it in the discussion about the sequence that normally comes after specification of the sequence. >>> If the authentication service is instantiated by a SIP >>> intermediary (proxy server), it may authenticate the request with >>> the authentication scheme used for registration in its domain >>> (e.g., Digest authentication). >>> >>> If the authentication service is instantiated by a SIP user agent, >>> a user agent may authenticate its own user through any system- >>> specific means, perhaps simply by virtue of having physical access >>> to the user agent. >>> >>> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 8] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> Authorization of the use of a particular username or telephone number >>> in the user part of the From header field is a matter of local policy >>> for the authentication service; see Section 6.1 for more information. >>> >>> Note that this check is performed only on the addr-spec in the >>> identity field (e.g., the URI of the sender, like >>> 'sip:alice@atlanta.example.com'); it does not convert the display- >>> name portion of the From header field (e.g., 'Alice Atlanta'). For >>> more information, see Section 12.6. >> >> 'checking' and 'converting' are very different actions. So 'it does >> not' does not flow from the preceding text in the sentence. {{ No response from Jon. }} >> >>> >>> Step 3: >> >> Step 3: Timestamp >> >> >>> >>> An authentication service MUST add a Date header field to SIP >> >> Why? (Probably only need to cite the earlier discussion about its use >> for replay mitigation. But merely cite; don't duplicate.) > The end of this step reads "See > Section 12 for information on how the Date header field assists > verifiers." That answers "why?" It would be nice if the line-by-line > review here could keep state for half a minute and go back and remove > comments when they are answered immediately afterwards. [$] Then cite section 12, so the reader can get easily linked to the explanation. However Section 12 is a long and varied section and a citation to all of it isn't very helpful. I suspect you mean Section 12.1. >> >>> requests that do not have one. The authentication service MUST >>> ensure that any preexisting Date header in the request is accurate. >>> Local policy can dictate precisely how accurate the Date must be; a >>> RECOMMENDED maximum discrepancy of sixty seconds will ensure that the >>> request is unlikely to upset any verifiers. If the Date header >>> contains a time different by more than one minute from the current >>> time noted by the authentication service, the authentication service >>> SHOULD reject the request. This behavior is not mandatory because a >>> user agent client (UAC) could only exploit the Date header in order >>> to cause a request to fail verification; the Identity header is not >>> intended to provide a source of non-repudiation or a perfect record >> >> Then where does the non-repudiation feature of STIR come from? > This is the only use of the term > "non-repudiation" in rfc4474bis-10, and the term does not appear in > RFC7375 or RFC7340, as non-repudiation is not a requirement needed to > address the threats for which STIR was designed. While PASSporT > contains some language about its potential use for non-repudiation, > do note the first paragraph of Section 7.2 of PASSporT. So in short, > I'm not aware that STIR has or has ever intended to have that > "feature". Oh boy... 1. First sentence in Passport: This document defines a token format for verifying with non- repudiation the sender of and authorization to send information related to the originator of personal communications. 2. 7.2. Solution Considerations It should be recognized that the use of this token should not, in it's own right, be considered a full solution for absolute non- repudiation of the persona being asserted. {{which implies that it *does* serve as a partial solution for non-repudiation. /d}} Passport was created for STIR. STIR uses Passport. STIR documents do not declare their use of a subset of passport, nevermind what that subset is. >>> of when messages are processed. Finally, the authentication service >>> MUST verify that both the Date header and the current time fall >>> within the validity period of its credential. >>> >>> See Section 12 for information on how the Date header field assists >>> verifiers. >>> >>> Step 4: >>> >>> Subsequently, the authentication service MUST form a PASSporT object >>> and add a corresponding an Identity header to the request containing >> >> a corresponding an ?->? a corresponding >> >> >>> this signature. For baseline PASSporT objects headers (without an >> >> baseline PASSporT objects headers >> -> >> a baseline PASSporT objects header >> >> >>> Identity header "ppt" parameter), this follows the procedures in >> >> header? or header field? >> >> >>> Section 8; if the authentication service is using an alternative >>> "ppt" format, it MUST add an appropriate "ppt" parameter and follow >> >> Isn't this text repeating specification text that is elsewhere in the >> document? If so, remove it. > indeed the sentence containing this > guidance says "(see Section 9)" at end of it. It is referring to > specification text elsewhere in the document, but here in these > steps, we do give some high level notion of what you're supposed to > do in addition to giving a pointer to where the behavior is fully > detailed. >> >>> the procedures associated with that extension (see Section 9). After >>> the Identity header has been added to the request, the authentication >>> service MUST also add a "info" parameter to the Identity header. The >>> "info" parameter contains a URI from which the authentication >>> service's credential can be acquired; see Section 6.3 for more on >>> credential acquisition. >>> >>> Step 5: >> >> >> Step 5: Canonicalization >> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 9] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> In the circumstances described below, an authentication service will >> >> another forward reference, this time without even a specific pointer. > Once again, a line-by-line review needs to be able to read > literally the next sentence, which contains the "specific pointer" to > Section 8. [$] Both a pointer *and* a redundant summary of what will be found at the pointer. But only syntax. No reference to semantics. >> >>> add a "canon" parameter to the Identity header. The syntax of >>> "canon" is given in Section 8; essentially, it contains a base64 >>> encoding of the JSON header and claims in the PASSporT object. The >>> presence of "canon" is OPTIONAL baseline PASSporT objects in SIP as a >>> because the information carried in the baseline PASSporT object's >>> headers and claims is usually redundant with information already >>> carried elsewhere in the SIP request. Omitting "canon" can >>> significantly reduce SIP message size, especially when the PASSporT >>> object contains media keys. >>> >>> When however an authentication service creates a PASSporT that uses >> >> "When however"? {{ No response from Jon. }} >> >>> extension claims beyond the baseline PASSporT object, including >>> "canon" is REQUIRED in order for the verification service to be >>> capable of validating the signature. See Section 9. >>> >>> Also, in some cases, a request signed by an authentication service >> >> "in some cases"? This is a specification. Where is the clear detail? > If we let the sentence continue, it will clarify that > it refers to those cases where the the request "will be rejected by > the verification service on the receiving side" with a 4xx status > code, after which it gives some guidance about what is to be done in > those cases. Though of course, the sentence can't finish its thought, > as the review interrupts yet again after "the receiving side" with > the insistance that "'on the receiving side' is redundant. Remove it. > Where else is there a verification service?" and then of course again > before the end of the sentence to complain that the text here is > "descriptive" and wondering "where is this SIP behavior documented in > the spec?" Unsurprisingly, the text associated with sending a 438 in > the backwards direction is to be found in the verification service > behavior (5.2, Step 5 is a good place to start), though the formal > defintions of the error codes are in 13.3. But the review here would > benefit from letting a sentence end before objecting to it. [$] The constant reference to my including a comment in a way that broke up the text and gosh if only I'd read a bit further I'd have seen the answer, suffers from several problems: 1) Of course I read the whole thing. 2) 'Letting the sentence continue" does not alter my assessment. 3) I've placed the comment in order to make its referent clear. Saying 'in some cases' requires very explicit indication of what those cases are. The text doesn't do that, though I understand the author thinks it does. This reader doesn't. If one experienced reader is confused about something, what do we think the odds are that other, less-experienced readers will be?... >>> will be rejected by the verification service on the receiving side, >> >> "on the receiving side" is redundant. Remove it. Where else is there a >> verification service? Just realized: we again have confusion about who is doing what. The STIR verification entity does not reject requests. If reports a failed verification to its client, which is probably the system component that *does* issue the rejection. >> >>> and the authentication service will receive a SIP 4xx status code in >>> the backwards direction, such as a 438 indicating a verification >> >> This is offered as descriptive text here. Where is this SIP behavior >> documented in this spec? {{ No response from Jon. }} >> >>> failure. If the authentication service did not originally send the >> >> The authentication service does sending? I think it doesn't, and the >> definition of its roles implies that it doesn't, but rather that it is >> part of one or another module that does. > This is why, when > we're speaking strictly, we say things like "the entity which > instantiates the role of the authentication service" instead of "the > authentication service." If that entity is a proxy server, then yes, > in certain SIP cases, even though it is an intermediary, it can > resend a request in response to certain failed response codes it > receives. So when the review says "hence it doesn't do retries. All > of this needs to be recast in terms that match the specified > architecture", it does do retries and it does match the architecture. > This behavior entered the specification as a result of specific > issues seen the wild with early deployments of this code, and while > the review objects, "This is just guessing. Protocols that do > guessing don't work very well" and that "This interaction needs to be > re-specified to be deterministic", it is believed that this behavior > works and that it is specified tightly enough. The same problem with > "the entity which instantiates the role of the authentication > service" vs. "the authentication service" is why the objection in the > review to the text that "the authentication service MUST forward the > message" is similarly misguided. The response again indicates confusion about the difference between the activities of a STIR architectural component, versus a range of ways that component might be implemented. >> >>> Identity header with the "canon" parameter, it SHOULD retry a request >> >> and hence it doesn't do retries. All of this needs to be recast in >> terms that match the specified architecture. {{ No response from Jon. }} >> >>> once after receiving a 438 response, this time including the "canon". >> >> Why? This is just guessing. Protocols that do guessing don't work very >> well. >> >> This interaction needs to be re-specified to be deterministic. {{ No response from Jon. }} >> >>> The information in "canon" is useful on the verification side for >>> debugging errors, and there are some known causes of verification >>> failures (such as the Date header changing in transit, see >>> Section 12.1 for more information) that can be resolved by the >>> inclusion of "canon". >>> >>> Finally, the authentication service MUST forward the message >>> normally. >> >> it doesn't do forwarding. {{ No response from Jon. }} >> >>> >>> 5.2. Verifier Behavior >>> >>> This document specifies a logical role for SIP entities called a >> >> redundant detail. > The review interrupts > the sentence halfway through with "redundant detail." I don't think a > high-level introductory statement counts as "detail". Is it redundant > to begin a section on "Verifier Behavior" with a sentence making it > clear that we're now into then business of defining the logical role > of the verifier, or is it simply setting the stage for people who > happen to skip to the top of that section and start reading? I don't > see a need for any change there, any more than I do at the start of > Section 4, which is titled "Overview of Operations" and begins with > the sentence "This section provides an informative (non-normative) > high-level overview of the mechanisms described in this document." Or > that the section titled, "Changes from RFC4474" has a starting > sentence that reads "the following are the salient changes from the > original RFC4474." This is normal specmanship, and hardly a matter > that warrants being flagged in a review. >> >>> verification service, or verifier. When a verifier receives a SIP >>> message containing one or more Identity headers, it inspects the >> >> headers? header fields? >> And, again, the verifier does not receive the SIP message... >>> signature(s) to verify the identity of the sender of the message. >>> The results of a verification are provided as input to an >>> authorization process that is outside the scope of this document. >> >> Step 5, below, specifies a behavior that is within scope. > actually, what Step 5 says is that > "the verification of an Identity header does not entail any > particular treatment of the request", that "this specification does > not propose any authorization policy" and that "local policy" is > responsible for deciding what is authorized. Step 5 does talk a bit > about circumstances in which an Identity header field value is > "invalid" - but the text is also clear that it proposes no > authorization decision based on "the presence of an invalid Identity > header." >> >>> A SIP request may contain zero, one, or more Identity headers. A >>> verification service performs the procedures above on each Identity >>> header that appears in a request. If the verifier does not support >> >> What does it mean to 'not support an Identity header [field]"? > The sentence > in full reads "not support an Identity header present in a request > due to the presence of an unsupported 'ppt' parameter." Interjecting > "what does this mean" in the middle of a sentence when the > continuation of a sentence tells you what it means is a > counterproductive method of review, instances of which occur here > with mounting frequency. You don't support an Identity header (field > value, really) if it contains a "ppt" you don't support. [$] So it's not the header field that isn't supported, it's one of it's parameters. And yes, that's an important semantic difference. Perhaps what is meant is that processing of the Identity header fails because a parameter in it is not supported? >> Why might there be multiple Identity header [fields]? How might they >> differ? > I'll agree that this isn't > motivated in RFC4474bis-10. It is there for forward compatibility; we > imagine that extensions (different "ppt"s) might be included in a > message by different authentication services, or that different trust > anchors might provide Identity headers that would be trusted by > different recipients. We're not really going down those paths at the > moment, we just didn't want to close the door on them. Still, I can > see it might be helpful to have a paragraph of (gasp) foward-looking > motivation about future work for this somewhere in the spec - > probably in Section 9 (on extensibility). >>> an Identity header present in a request due to the presence of an >>> unsupported "ppt" parameter, or if no Identity header is present, and >>> the presence of an Identity header is required by local policy (for >>> example, based on a per-sending-domain policy, or a per-sending-user >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 10] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> policy), then a 428 'Use Identity Header' response MUST be sent in >>> the backwards direction. For more on this and other failure >>> responses, see Section 13.3. >>> >>> In order to verify an Identity header in a message, an entity acting >>> as a verifier MUST perform the following steps, in the order here >>> specified. Note that when an Identity header contains the optional >>> "canon" parameter, the verifier MUST follow the additional procedures >>> in Section 5.2.1. >>> >>> Step 1: >> >> Step 1: PPT parameter >> >> >>> The verifier MUST inspect any optional "ppt" parameter appearing the >> >> [optional] remove. Especially given the MUST. It doesn't matter >> whether the ppt was optional for the signer. > I don't think it is harmful here to > reinforce that the parameter is optional, but that nonetheless, if > present, it MUST be inspected. The review furthermore asks of "'any' > can there be more than one? If only one then perhaps:" The review > here doesn't like "the verifier MUST inspect any optional 'ppt' > parameter," as the use of "any" here only connotes the possibility of > "ppt"'s absence, rather than a potential plurality. I don't think > there's any confusion in the English usage there. >> "any" can there be more than one? If only one then perhaps: >> >> MUST inspect the "ppt" parameter, if present in the Identity request. >> >> >>> Identity request. If no "ppt" parameter is present, then the >>> verifier proceeds normally below. If a "ppt" parameter value is >> >> 'normally' implies the alternative is abnormal. also, 'below' where? > While I highly doubt this is unclear, for "below" we can say > "with Step 2". The "abnormal" thing that happens is that you have > special handling for the presence of a supported or unsupported > "ppt." We could try instead of "normal" something like "default" or > "baseline" or whatever, but I think "normal" is fine. This contention > over what is "normal" continues with the review's claim that "it > appears that ppt does not affect processing, as long as the ppt is > 'supported'." This comments on a sentence that mentions that when a > supported 'ppt' parameter value is present, you do the "variations" > in Step 5. Step 5 has clear if-then handling for a supported ppt: > If a "ppt" parameter is present (and per Step 1, is understood), the > verifier follows the procedures for that "ppt" (see Section 9). > > That is the "variation" alluded to above. How this adds up to the > claim that a supported "ppt" does not affect processing is beyond me. >> >>> present, and the verifier does not support it, it MUST ignore the >>> Identity header. If a supported "ppt" parameter value is present, >>> the verifier follows the procedures below, including the variations >>> described in Step 5. >> >> is the 'below' here different from the one before it? {{ No response from Jon. }} >> From the above text, it appears that ppt does not affect processing, >> as long as the ppt is "supported". That is, an absent ppt and a valid >> ppt both produce the same sequence 'below'. {{ No response from Jon. }} >>> Step 2: >> >> Step 2: Signature Scope {{ No response from Jon. }} I'm noting this here, but he didn't comment on them anywhere, from what I've seen. So I'll clarify why the extra labeling matters: It provides a semantic tag to the step and makes it easier to look over the entire sequence of labels and quickly understand the overall process. >> >>> In order to determine whether the signature for the identity field >>> should be over the entire identity field URI or just a canonicalized >>> telephone number, the verification service MUST follow the >>> canonicalization process described in Section 7.2. That section also >>> describes the procedures the verification service MUST follow to >>> determine if the signer is authoritative for a telephone number. For >> >> Those two functions are wildly different. Why are they part of the same >> process? > The answer is that you're going to do either one > or the other, but not both, between Step 1 and Step 3. Yes, telephone > numbers and domain names are different, but dealing with one or the > other is what you do at this stage of the process: it is the same > process otherwise. I can't see any other useful way to organize or > specify this behavior. I also don't see what possible problem someone > might have with this. "Why?" questions like this about spec > organization are very easy to ask, take a lot of thought to answer, > and ultimately have no impact on the technology we are specifying > here. For starters, I don't see how the process in 7.2 determines between the two types of identifiers, nor do I see a process here that makes the selection, nor do I see directives about what to do with the different results. >> >>> domains, the verifier MUST follow the process described in >>> Section 7.3 to determine if the signer is authoritative for the >>> identity field. >>> >>> Step 3: >> >> Step 3: Obtain Key >> >> >>> The verifier must first ensure that it possesses the proper keying >>> material to validate the signature in the Identity header field, >>> which usually involves dereferencing a URI in the "info" parameter of >>> the Identity header. See Section 6.2 for more information on these >>> procedures. If the verifier does not support the credential >>> described in the "info" parameter, then it should consider the >> >> Only should? Why??? > 5.2 On Step 3, the review denounces the soft guidance in the spec > that a verifier merely "should" consider a credential for this header > unsupported if it does not support the credential described in the > "info" parameter. "Only should? Why???" Well, as the reference to 6.2 > in the previous sentence would reveal if followed, verifiers may have > alternative means to gain access to credentials associated with an > identity than the contents of the "info" parameter, "such as an > offline store of periodically-updated credentials" or something. So > discovering the credential though "info" is only a SHOULD in section > 6.2, which trickles down to here. Line-by-line is not helping here. "should" is not 'soft' guidance. or is 'should' not meant normatively? (It's so difficult to tell, sometimes.) >> >>> credential for this header unsupported. If a SIP request contains no >>> Identity headers with a supported credential, then the verifier MUST >>> return a 437 "Unsupported Credential" response >> >> Verifier returns responses? > 5.2 Step 3 "verifier returns responses?" Well, yes, in the sense that > "the entity that instantiates the verification service role" returns > responses. Note that we have the same language here in 5.2 as we did > in 5.1 right before the steps start to remind readers of this. >> >>> Step 4: >> >> Step 4: Date Window Enforcement >> >> >>> The verifier MUST furthermore ensure that the value of the Date >>> header of the request meets local policy for freshness (usually, >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 11] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> within sixty seconds) and that it falls within the validity period of >>> the credential used to sign the Identity header. For more on the >>> attacks this prevents, see Section 12.1. If the "canon" parameter is >> >> There was earlier discussion of using a date window validation to >> mitigate against some attacks. There doesn't need to be yet-another >> reference here. Just cite the earlier discussion. > Well, there was an earlier discussion of > authentication service behavior. This is a discussion of verification > service behavior. They aren't the same discussion. Things that the > review flagged as missing from that part are present here, because we > are describing the behavior of a different component of the > architecture. >> >>> present, the verifier should follow the Date-related behavior in >>> Section 5.2.1. >>> >>> Step 5: >> >> Step 5: Signature Validation >> >> >>> The verifier MUST validate the signature in the Identity header field >>> over the PASSporT object. For baseline PASSporT objects (with no >>> Identity header "ppt" parameter) the verifier MUST follow the >>> procedures for generating the signature over a PASSporT object >>> described in Section 8. If a "ppt" parameter is present (and per >>> Step 1, is understood), the verifier follows the procedures for that >>> "ppt" (see Section 9). If a verifier determines that the that the >>> signature in the Identity does not correspond to the reconstructed >>> signed-identity-digest, then the Identity header should be considered >>> invalid. >> >> I suggest breaking this step into two parts: signature regeneration and >> signature validation. >> >> It appears that the specification is calling for two (or more???) >> different methods of doing signature validation, depending upon whether >> ppt is present. This seems like an outstandingly bad idea. It creates >> complexity and possibly even outright confusion. > If "ppt" is present, all that will mean is that > potentially additionally headers (JWT headers that is) will be > present, which correspond to components of a SIP request. Any > PASSporT will always be a superset of the "bare minimum" headers and > claims, so really what the "ppt" means is that something in addition > to those has been signed. It would be as if, say, DKIM allowed one to > specify a list of header fields that were signed in an "h=" > parameter, which then listed the email headers in question. Except in > our case, it assumes a baseline set of headers, and the "ppt" is > effectively a profile that implies what additional headers have been > included in the scope of the signature. I understand why it might > seem like "an outstandingly bad idea" and in fact for years - maybe > more than a decade - I held out against having anything but a fixed > signature. Our "bare minimum" is the compromise that allowed us to > move forward, while accommodating some important applications that > participants in the working group want to apply this to with "ppt" > extensions. I would prefer a "single algorithm", and indeed I think > we do have one as you suggest, one where "components of the algorithm > have branches." "ppt" is just one of those branches. The response, here, is enlightening for just how complicated the model appears to be. Lots of dependencies and conditionals to process through. Or at least, that's how I read what it means... (For reference, DKIM's h= is always present; it doesn't depend on other meta-constructs being present. And while one can debate the efficacy, there's a minimum set of header fields required for h=, too.) By the way, I hope that the ppt profiles doesn't "imply" the set of headers fields that are signed, but that the profile actually and explicitly specifies them... >> There needs to be a single algorithm for validation, even if components >> of the algorithm have branches, such as depending on whether the >> 'address' is a URI or a telephone number. > Whether we > consider the process of generating and validating the signature to be > one step or two seems like a very minor question to me: there's no > ambiguity that you generate and then validate, regardless of whether > from an organizational perspective we call that one step or two. Lots > of the other steps are also composed of multiple discrete and > separable actions. On matters this small it's hard to justify > changing it or keeping it. (For the technical question posed in this > same interjection, see the technical responses below). OK. Why not make the entire algorithm one step? The answer is clarity. The suggestion I'm making is for explicitly distinguishing two portions of the sequence that have completely different details and semantics. >>> The presence of multiple Identity headers within a message raises the >>> prospect that a verification services could receive a message >>> containing some valid and some invalid Identity headers. If the >>> verifier determines all Identity headers within a message are >>> invalid, then a 438 'Invalid Identity Header' response MUST be >>> returned. >> >> So it's ok to have no Identity header fields but it's not ok to have >> identity, where none validate. This means that the entire transfer >> environment is expected and required to convey Identity fields >> perfectly, all the time. > It means that there is a > very real security difference between Identity not being used at all > (which means you have no assurance either way) and Identity fields > being present but broken (which means someone is trying to use the > mechanism, and either an operational or security problem has arisen). > Why on earth this would entail that "the entire transfer environment > is expected and required to convey Identity fields perfectly, all the > time" is beyond me. Identity headers will be dropped by some existing > devices today which strip any headers they don't recognize, for > example. And "canon" will fill in gaps in some other cases. The stated 'which means' interpretation here suggests a basic failure in the group's analysis of operational errors, as described in my comments earlier in this note. >> >>> The verification of an Identity header does not entail any particular >>> treatment of the request. The handling of the message after the >>> verification process depends on how the implementation service is >>> implemented and on local policy. This specification does not propose >>> any authorization policy for user agents or proxy servers to follow >>> based on the presence of a valid Identity header, the presence of an >>> invalid Identity header, or the absence of an Identity header, but it >>> is anticipated that local policies could involve making different >>> forwarding decisions in intermediary implementations, or changing how >>> the user is alerted, or how identity is rendered, in user agent >>> implementations. >> >> I suspect the above paragraph belongs elsewhere and sooner. It isn't >> part of the step sequence. > This text is giving > guidance on what happens at the end of this process. I disagree that > it belongs earlier, but I can see that it isn't a part of Step 5 as > such. Maybe I'll put in some clear divider to indicate where Step 5 > ends. >>> 5.2.1. Handling 'canon' parameters >>> >>> If the optional "canon" parameter of the Identity header is present, > I don't think it is harmful to reinforce that > the "canon" parameter is optional. The review then goes on to also > recommend removing "of the Identity header" as "there is no other > canon parameter" than the one associated with that header. I for one > do not feel that in the introductory sentence of a section, providing > a bit of broader context and reinforcing what we hopefully already > know for the benefit of people who skipped to this section via a > pointer from elsewhere or what have you is harmful - I think it is > actually good specmanship. The review however really doubles down on > this: "But really I suspect that even the 'if' is unnecessary. The > optionality has been established elsewhere. The task here is merely > to specify what is in a canon." So the review proposes that 5.2.1 > instead start with "The 'canon' parameter contains a base64 encoding > of the header and claim..." etc. Comparing that to the existing text, > I think the context that the existing text provides is valuable > enough to warrant retaining it, over these forceful objections. >> [optional] remove. it's redudnant with 'if' >> >> [of the Identity header] remove. there is no other canon parameter. >> >> But really I suspect that even the 'if' is unecessary. The optionality >> has been established elsewhere. The task here is merely to specify what >> is in a canon. {{ No response from Jon. }} >>> it contains a base64 encoding of the header and claim component of >> >> This appears to be a re-specification of canon. Don't do that. Cite >> its spec and then simply use it. > I do not feel that mentioning the fact > that 'canon' contains a base64 encoding of the PASSporT header and > claims is in any meaningful sense a "re-specification" of canon. A > respecification would say, like, what those headers and claims are > and how you build them. Providing basic and essential high-level > context is not a reprimand-worthy offense. Again: Each time a specification detail is repeated elsewhere in the document is an opportunity to get it wrong and a burden to search and find when the details change. >> >>> the PASSporT object constructed by the authentication service, and >>> this it conveys any canonical telephone number formats created by the >> >> this -> thus ? >> >> there are multiple canon formats? that doesn't sound very canonical. >> >> but again, stating what it conveys is redundant. > There are not multiple "formats," but applying the canonicalization > algorithm to telephone number representations will yield results that > could be variable, because of matters of local policy described in > Section 7.2. So if there's a problem with that, it's in 7.2, not in > this section - the pluralization of "formats" is just an artifact of > the "any" in the sentence construction. "canonical telephone number formats" does not mean multiple formats? I don't understand. Worse, the idea that a specification seeking standardization would include an algorithm that can produce variable results due to 'local policy' is a very basic error in the approach to doing standardization. *As soon as one says 'local policy' for anything other that a generic and non-normative discussion, one has stepped out of the sandbox in which the specification controls and, therefore, has stepped out of the specification. In other words, local policy for something like this needs to be out of scope.* >>> authentication service (see Section 7.2), as well as an "iat" claim >>> corresponding to the Date header that the authentication service >>> used. The "canon" is provided purely as an optimization and >>> debugging mechanism for the verification service. >> >> This is the wrong place to state what canon is for. > I think > this is a good place to say what canon is for; it is the "canon" > section, the only one dedicated to it in the document. Previously, > 5.1 said that "The information in "canon" is useful on the > verification side for debugging errors," and here in the verification > side it makes sense to state what use there is to be made of it. > Given the way the spec is organized now, putting a statement to this > effect here makes more sense than placing this anywhere in section 7, > say, since that really only deals with canonicalizing the > identifiers. That is a bit like saying that a section of how to drive a car is a good place to explain what a car is for. Or by having extensive discourse on concepts of nutrition in the middle of a recipe for making a dish. In other worse, it isn't at all a good idea. Discussion of purpose is different from discussing procedure. There should be coherent and integration discussions about purpose earlier, before later diving into the many details of procedures. >>> >>> Peterson, et al. Expires January 8, 2017 [Page 12] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> When "canon" is present, the verification service MAY compute its own >> >> 'MAY'??? I don't understand making canonicalization optional, either >> during signing or during verification. > It really helps if you read the rest of the > sentence. What it says is that you MAY compute it "-before- > performing any cryptographic functions in order to ascertain whether > or not the two ends agree on the canonical form." Clear? What > implementations MAY do is to perform that comparison -before- any > hard number crunching. Rather than doing it after. Reading the whole > sentence helps. [$] Interesting. The problem here is the cascading and backward dependency sequence in the way the sentence is constructed. It does lend itself to easy comprehension. >> >>> canonicalization of the numbers and compare them to the values in the >>> "canon" parameter before performing any cryptographic functions in >>> order to ascertain whether or not the two ends agree on the canonical >>> number form. Also, when "canon" is present, during Step 4 the >>> verification service SHOULD compare the "iat" value in the "canon" to >> >> This is talking about actions during Step 4. Move it to Step 4! {{ No response from Jon. }} >> >>> its Date header field value. If the two are different, and the "iat" >>> value is later but within verification service policy for freshness, >>> the verification service SHOULD perform the computation required by >>> Step 5 using the "iat" value instead of the Date value. As some >>> deployments in the field have been observed to change the Date header >>> in transit, this procedure will prevent some unnecessary verification >>> failures. >> >> [unnecessary] remove. > I think the distinction between a > security violation, which is a necessary verification failure, and > some operational hijinx like intermediaries tinkering with the Date > header when regenerating a SIP request, which is an unnecessary > verification failure, is worth preserving. >> But it won't prevent others. This means that signatures that were valid >> will break. And this ought to mitigate the handling of broken signatures. > Indeed, as the last paragraph of Section 1 states, the > "revisited" in "STIR" derived from the fact that "RFC 4474 also > provided a signature over material that intermediaries in existing > deployments commonly altered," which led to unnecessary verification > failures, and for us to revisit the signature scope. The signature > scope we have now is the best one we think we can propose. We do > believe that "canon" helps to mitigate the meaningful causes of > unnecessary failures. The overall mechanism has gone through a great > deal of working group scrutiny and also implementation and deployment > testing. I've personally run it over live SIP networks. Casting vague > doubt on it, while it is easy to do and it pads out the list of > comments, is not persuasive. This is I think the only place so far in > this review where I have asked for more information, but if you > actually have something substantive to say about this, please say it, > rather than just darkly hinting at stuff you know that we presumably > don't. "The signature scope we have now is the best one we think we can propose" is fine. I'm not expressing concern over the details of the algorithm here, but on the persistent view that receive-side failures will only be due to the intervention of a bad actor. >>> 6. Credentials >>> >>> 6.1. Credential Use by the Authentication Service >>> >>> In order to act as an authentication service, a SIP entity must have >>> access to the private keying material of one or more credentials that >>> cover domain names or telephone numbers. These credentials may >>> represent authority over an entire domain (such as example.com) or >>> potentially a set of domains enumerated by the credential. >> >> [potentially] remove {{ No response from Jon. }} >> The implication is that "a set of domains" is not "an entire domain", >> but I don't understand how the language says that. As written, this >> actually translates to something like: authority over one or more >> domains. Possibly what was meant is something like: authority over an >> entire domain, or some number of sub-domains under that higher-level >> domain. > The notion that a credential's scope > might cover a single domain or "potentially" a set of domains > suggests that the former is common and well understood and the latter > is something we're endorsing a bit less heartily. Although the review > speculates a bit about whether a "set of domains" means sub-domains > under a higher-level domain, that isn't really material to the > language here. Taking a step back, I can see how this might be > confusing, though - could be worth a quick fix. >>> Similarly, a credential may represent authority over a single >>> telephone number or a range of telephone numbers. The way that the >> >> Similarly for telephone numbers, a credential can represent one or >> a range of numbers. > While the latter is slightly shorter, the value of > this sort of wordsmithing is unclear. It loses the connotation that a > credential "represents authority over" those telephone numbers. The > credential doesn't "represent" those telephone numbers. The sentence covers only credentials pertaining to telephone numbers. This is a pivotal point to the scope of the sentence. But it's only implied by the original form while being made the predicate for the suggested text. So in fact clarity is exactly the point behind the suggestion. >> >>> scope of a credential is expressed is specific to the credential >>> mechanism. >> >> So, there is no standard for the specification of credentials, here. >> That means that the technical details -- as distinct from the >> operational policies -- of credentials are out of scope, although they >> are fundamental to proper operation of this serve. This is a >> showstopper, in terms of specification completeness for the service. > It would be, which is why we have a stir-certs > specification that gives a credential system that we intend to use > for initial implementation. RFC4474bis is pretty clear that the > aggregate of it, stir-passport, and stir-certs is required for > implementation. Historically, those two specifications effectively > split out of RFC4474bis (though stir-passport first merged in from > the verified-token draft, it then merged out again). Except that stir-certs is not a specification. And even if it were, it's not linked into the topic here properly. Instead, there's more pedagogy than specification, where the pedagogy is almost certainly redundant with was is, or should be, in stir-certs... >> >> The following paragraph is not about credentials. It is about signing >> policy. It belongs elsewhere. And since it isn't really specifying >> anything, that elsewhere probably is up towards introductory text. >> >> >>> Authorization of the use of a particular username or telephone number >>> in the identity field is a matter of local policy for the >>> authentication service, one that depends greatly on the manner in >> >> Huh? >> >> But really, when a specification says something is out of scope and is a >> matter for local policy, the specification should not then go on to >> specify examples of local policy. In those cases where there is a >> compelling benefit to include such examples, put them in an appendix. >> But please, then, explain that compelling benefit. > I would think that those examples might help to inform > implementers who are trying to decide what kind of tools to provide Interesting view. And it might work well, for a companion document talking about such issues. But this is a specification, not an implementation guide. Giving guidance about the implementation of details that are out of scope is doubly out of scope. > to operators, at least what sorts of building blocks might be in play > in expressing that policy, or what protocol tools would be needed to > extract elements that the policy could act upon. Or maybe we as > specifiers thought that this would be a sound foundation for a > policy, and while we don't want to give it normative force, we want > to put it out there so that implementers and operators might consider > it as a practice, if it happens to fit with their existing model. We > might also think it is worth mentioning corner cases (like anonymity) > that people might overlook in implementation otherwise. But... I > really don't think there's any reason that the inclusive of a > non-normative example requires a defense like this, nor do I think > that the requirement the review expresses here is a valid one for > IETF specifications. It shouldn't require a defense because text like that shouldn't be anywhere near text that is specifying an Internet protocol. >> >>> which authentication is performed. For non-telephone number user >>> parts, one policy might be as follows: the username given in the >>> 'username' parameter of the Proxy-Authorization header MUST >>> correspond exactly to the username in the From header field of the >>> SIP message. However, there are many cases in which this is too >>> limiting or inappropriate; a realm might use 'username' parameters in >>> Proxy-Authorization that do not correspond to the user-portion of SIP >>> From headers, or a user might manage multiple accounts in the same >>> administrative domain. In this latter case, a domain might maintain >>> a mapping between the values in the 'username' parameter of Proxy- >>> Authorization and a set of one or more SIP URIs that might >>> legitimately be asserted for that 'username'. For example, the >>> username can correspond to the 'private identity' as defined in Third >>> Generation Partnership Project (3GPP), in which case the From header >>> field can contain any one of the public identities associated with >>> this private identity. In this instance, another policy might be as >>> follows: the URI in the From header field MUST correspond exactly to >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 13] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> one of the mapped URIs associated with the 'username' given in the >>> Proxy-Authorization header. This is a suitable approach for >>> telephone numbers in particular. >>> >>> This specification could also be used with credentials that cover a >>> single name or URI, such as alice@example.com or >>> sip:alice@example.com. This would require a modification to >>> authentication service behavior to operate on a whole URI rather than >>> a domain name. Because this is not believed to be a pressing use >>> case, this is deferred to future work, but implementers should note >>> this as a possible future direction. >>> >>> Exceptions to such authentication service policies arise for cases >>> like anonymity; if the AoR asserted in the From header field uses a >>> form like 'sip:anonymous@example.com' (see [RFC3323]), then the >>> 'example.com' proxy might authenticate only that the user is a valid >>> user in the domain and insert the signature over the From header >>> field as usual. >>> >>> 6.2. Credential Use by the Verification Service >>> >>> In order to act as a verification service, a SIP entity must have a >>> way to acquire and retain credentials for authorities over particular >> >> for -> from ? > Um. You know I think either reads okay, strangely > enough. I think I maybe like "for" better, the credentials are "for" > those authorities, rather than merely received "from" them. Maybe > "corresponding to" would be better. The two words create fundamentally different meanings. If the actually intended meaning is both, then say that. Otherwise, choose the word that means precisely what is intended. >> >>> domain names and/or telephone numbers or number ranges. >>> Dereferencing the URI found in the "info" parameter of the Identity >>> header (as described in the next section) MUST be supported by all >> >> forward reference > I don't think a parenthetical mention that the > "info" parameter is described in the next section harms the > comprehensibility of the document in any way. >> >>> verification service implementations to create a baseline means of >> >> I /really/ don't understand the trust model that has a security scheme >> where the object giving a pointer to its own credential. Or rather, I >> fear that I do understand it, but don't understand why its considered >> credible. > As I rememeber > discussing this with the reviewer on at least one previous occasion, > I do gather this is a subject of some confusion. Relying parties > trust these credentials because they trust the trust anchor that > issued these credentials. They do not trust them because of the > pointer they used to retrieve the credential, which may in fact be to > an untrusted service. Who cares? If you find a certificate on a > crumpled up piece of paper in a bus station and manually type it into > your computer, you trust things signed with it (or not) based on your > trust for the anchor that issued the credential and the scope of the > authority that the anchor assigned to the credential. I seem to > recall the reviewer being quickly convinced of this the last time we > discussed it, and I can only assume this relapse is due to the fact > that credential trust issues here are deferred to stir-certs rather > than included in rfc4474bis. Although the review goes on to say that > "A complete specification of a STIR service needs to include a > publicly-usable key certification mechanism, a la DANE or DKIM or the > like," that is really a document organization question, as stir-certs > is intended to provide that. What is missing is a clear specification for this essential service component, including *very* clear explanations of the trust model -- presumably using the above as a basis. It then needs a very diligent vetting by security folks, in terms of precedence of use, to provide a basis for believing it will work, and expected scaling issues. In effect, the model appears to emulate something like WEB certs, which have demonstrated extremely poor operational properties, or maybe DNSSec, (or maybe DANE) which is expected to do better, but absent a precise technical specification for this model, it's all just conjecture. In any event, this is not something to bury with a few, terse references in the middle of this specification here. >> >>> credential acquisition. Provided that the credential used to sign a >>> message is not previously known to the verifier, SIP entities SHOULD >>> discover this credential by dereferencing the "info" parameter, >>> unless they have some more other implementation-specific way of >>> acquiring the needed keying material, such as an offline store of >>> periodically-updated credentials. If the URI in the "info" parameter >>> cannot be dereferenced, then a 436 'Bad Identity-Info' response MUST >>> be returned. >> >> Again, this much non-determinacy in such an essential mechanism ensures >> /non-/interoperability. I do understand the intent to have >> private/proprietary mechanism at work for use of this spec back in the >> regulated telecom space, but that does not mean it needs to distract the >> public specification. A complete specification of a STIR service needs >> to include a publicly-usable key certification mechanism, a la DANE or >> DKIM or the like. >> >> The application of STIR for other, non-open operations are always free >> to amend the specification through a separate profile that overrides one >> or another piece of the base STIR specifications. {{ No response from Jon. }} >> >>> >>> This specification does not propose any particular policy for a >>> verification service to determine whether or not the holder of a >>> credential is the appropriate party to sign for a given SIP identity. >> >> This is a fundamental flaw in this specification. It reduces to saying >> that the document is specifying a validation service that does not >> provide a deterministic means for assessing validation. > No, it is saying that this document > tells you how to validate what goes over the wire, but that it is a > matter of local policy who you trust and why. We're not here to say > "all implementations of STIR shall trust the following trust anchor" > or what have you. It is up the conscience of the individual > churchgoer. This is no different than it is for web PKI. There is a > lot of diversity of opinion about who will issue those credentials > and what their scope will be, and the stir-certs spec gives some > guidance on how those scopes would be managed for a couple of > initially envisioned architectures. But the point is, the fields that > go in PASSporT and the semantics of the SIP Identity header field > value will not be any different as a result of those different > architectures. This is simple matter of design modularity. I doubt > there is some lurking flaw here, this has probably been the single > most vetted and scrutinized aspect of the design. *The response shows a confusion about validation and trust. Validation is the task of STIR. Within the scope of establishing validation -- that is, within the standardized and interoperable details of an authentication mechanism like STIR -- there *must* be a semantic component provided which establishes the authority of the entity asserting validity to make that assertion.: The premise of an authentication mechanism is clarity about the authority of the entity vouching for the use of the key. This is entirely different from the trust component which assesses whether that entity is a good actor or not (or whether the authorized entity doing the signing is a good actor or not.)* >> >>> Guidance on this is deferred to the credential mechanism >>> specifications, which must meet the requirements in Section 6.4. >>> >>> Verification service implementations supporting this specification >>> may wish to have some means of retaining credentials (in accordance >>> with normal practices for credential lifetimes and revocation) in >>> order to prevent themselves from needlessly downloading the same >>> credential every time a request from the same identity is received. >>> Credentials cached in this manner may be indexed in accordance with >> >> This is gratuitous implementation advice. Remove it. >> >> If there is a compelling desire to give implementation advice, move it >> to a separate document and make it more complete. >> >> It is especially ironic to try to give implementation advice about a >> mechanism that isn't fully specified. > This commentary > is inserted into a sentence directly before the one reading "Further > consideration of how to cache credentials is deferred to the > credential mechanism specifications." Another good reason to remove it. >> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 14] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> local policy: for example, by their scope, or the URI given in the >>> "info" parameter value. Further consideration of how to cache >>> credentials is deferred to the credential mechanism specifications. >>> >>> 6.3. Handling 'info' parameter URIs >> >> >> I don't find a specification for the 'info' parameter. I find many >> references to the Identity-Info header field, but assume that's not what >> is meant here. > To my chagrin, the > latter is at least partly true. There remain some references to the > Identity-Info header that still need to be ripped out: two in 6.3 and > one in 7.3. A mention in 6.2 still gives a reason code for 436 as > "Bad Identity-Info" as well. I'd be willing to concede that counts as > "many." I am however less persuaded that the 'info' parameter is not > specified. It is introduced in Section 3, instructions on how to > include it are given in Section 5.1 Step 4, instructions on how to > process it are given in Section 5.2 Step 3 with a helpful forward > reference to 6.2. The guidance on 'info' given in 6.3 seems perfectly > adequate, and its abnf is indeed given in Section 8. The allegation > in the review of 6.3 that there is some deficiency in the > specification of 'alg' and 'ppt' is, as far as I can tell, baseless - > 'alg' has not even been mentioned in the specification yet by section > 6.3 in any context. But definitely we need to remove those extraneous > references to Identity-Info. > >> I also find abnf for an ident-info rule, which includes an "ident" >> literal string. I suspect this is the reference you intend? >> >> Please reference these more formally and properly cite their definition >> at first use. (If you want to rename rules, to make the use of the >> rulename more pleasant in the text, that's fine. But just make sure >> that a new reader can understand what type of reference is being made >> and where to go to find its definition. >> >> Ditto for "alg". >> >> Ditto for ppt. {{ No response*S* from Jon. }} >> And, of course, these are more forward references. In this case, it's >> giving detail about something that hasn't even been defined yet. > I'm not aware there are any forward references in 6.3. >> >>> An "info" parameter MUST contain a URI which dereferences to a >> >> This isn't about the handling of info. It's defining its contents. They >> need to be separate segments of text. > Since this section primarily discusses the conditions in which > the URI found in an 'info' parameter can be deferenced, this can > hardly be considered "defining" its contents, which have long since > been defined (in particular in places like 5.1 Step 4, at least until > we get the final word in Section 8). >>> resource that contains the public key components of the credential >>> used by the authentication service to sign a request. It is >>> essential that a URI in the "info parameter" be dereferencable by any >> >> Again, specification, not handling. Also, what do the instructions >> mean? How is the signer to know what is dereferenceable by the verifier? {{ No response from Jon. }} >> >>> entity that could plausibly receive the request. For common cases, >>> this means that the URI must be dereferencable by any entity on the >>> public Internet. In constrained deployment environments, a service >>> private to the environment might be used instead. >>> >>> Beyond providing a means of accessing credentials for an identity, >>> the "info" parameter further serves as a means of differentiating >>> which particular credential was used to sign a request, when there >>> are potentially multiple authorities eligible to sign. For example, >> >> It sounds as if the real need is to have an external registry of >> authorized credentialing services and then refer to the one that is used >> by name. That provides independent vetting and limits the 'vocabulary' >> of credential service references the message can cite. > That would certainly simplify the > architecture, and in practical deployments, that may effectively be > decided by fiat. The suggestion though that this is the "real need" > is an unnecessary limitation. Later in 6.3 this returns as "Looks > like this needs to define a STIR Credential Registry." While I > wouldn't mind if one of those existed, it is not necessary for the > deployment of STIR, and should not be introduced as a required > component of the architecture. *The operational history of certificate-based services is highly problematic. For a criticial infrastructure service like STIR, the technical design of the cert service is not something that can be deferred and treated merely as a matter of operational design.* >> >>> imagine a case where a domain implements the authentication service >>> role for a range of telephone and a user agent belonging to Alice has >>> acquired a credential for a single telephone number within that >>> range. Either would be eligible to sign a SIP request for the number >>> in question. Verification services however need a means to >>> differentiate which one performed the signature. The "info" >>> parameter performs that function. >>> >>> 6.4. Credential System Requirements >> >> Besides having extraneous material, this section is almost certainly >> incomplete and probably extremely incomplete. I suggest removing the >> section and simply state that the details of the credentialing system >> are outside the scope of this specification, except for specifying a >> registry that lists possible systems. > While this section says little, the > little it does say constrains external credential systems enough that > it is worth retaining. The requirements here are, for example, > discussed in the stir-certs document. The review rightly notes that > "the entire topic appears to be larger than this specification," and > this specification doesn't suggest otherwise. The section does indeed say little. Enough to give the impression that it is covering its topic, but too little to be of sufficient help. >> Also note that the claimed interest in authentication beyond SIP will >> also require credentialing systems. As such, the entire topic appears >> to be larger than this specification. {{ No response from Jon. }} >> >>> This document makes no recommendation for the use of any specific >>> credential system. Today, there are two primary credential systems >> >> A review of current, external services and hypothetical capabilities is >> not appropriate for inclusion inside a technical specification. Move it >> to a separate document. > As the text here points to existing RFcs in this space, > and drafts tailored to provide this specific capability for STIR, it > is baffling why the review alleges that this is "not appropriate for > inclusion inside a technical specification," nor why moving such > material to a separate document would more useful than keeping it > here. Because a specification is not a review document. And the review text about what exists 'today' is likely to quickly be out of date. It also seems odd to have a 'requirements' section this late in the document... >>> in place for proving ownership of domain names: certificates (e.g., >>> X.509 v3, see [RFC5280]) and the domain name system itself (e.g., >>> DANE, see [RFC6698]). It is envisioned that either could be used in >>> the SIP identity context: an "info" parameter could for example give >>> an HTTP URL of the Content-Type 'application/pkix-cert' pointing to a >>> certificate (following the conventions of [RFC2585]). The "info" >>> parameter may use the DNS URL scheme (see [RFC4501]) to designate >>> keys in the DNS. >>> >>> While no comparable public credentials exist for telephone numbers, >>> either approach could be applied to telephone numbers. A credential >>> system based on certificates is given in >>> [I-D.ietf-stir-certificates], but this specification can work with >>> other credential systems; for example, using the DNS was proposed in >>> [I-D.kaplan-stir-cider]. >> >> the above isn't 'requirements'. {{ No response from Jon. }} >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 15] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> In order for a credential system to work with this mechanism, its >>> specification must detail: >>> >>> which URIs schemes the credential will use in the "info" >>> parameter, and any special procedures required to dereference the >>> URIs >>> >>> how the verifier can learn the scope of the credential >> >> what does scope of the credential'? > The scope of a credential is the scope of its authority: in this > context the identifiers for which the credential is authorized to > sign. Scope is discussed earlier in 6.2 and the first paragraph of > 6.1 (probably the best place to look). then please say that. >> >>> any special procedures required to extract keying material from >>> the resources designated by the URI >>> >>> any algorithms required to validate the credentials (e.g. for >>> certificates, any algorithms used by certificate authorities to >>> sign certificates themselves) >> >> Looks like this needs to define a STIR Credential Registry. {{ No response from Jon. }} >> >>> It is furthermore required that all credential specifications >>> describe how the associated credentials will support the mandatory >>> signing algorithm(s) required by PASSporT [I-D.ietf-stir-passport]. >> >> So this really is another bullet for the above, indented list? >> >> Then again: credentials supporting signing algorithms? I don't >> understand this. The signing algorithms are for the payload using the >> key /from/ the credential. So what does this requirement mean, and why? > This is in response to some text about > how the "associated credentials will support the mandatory signing > algorithm(s) required by PASSporT." This is simply a reference to the > keying material associated with the credential actually supporting > ECDSA as required by PASSporT. If you have a credential with an RSA > key, like an old fashioned certificate, you will not be compliant. This is fun. A document that is supposed to be a protocol specification and is specifying neither the cert mechanism details nor the 'passport' mechanism details is making 'requirements' demands on both. That equates to having some specification of each of them buried in the middle of this document. >>> SIP entities cannot reliably predict where SIP requests will >>> terminate. When choosing a credential scheme for deployments of this >>> specification, it is therefore essential that the trust anchor(s) for >>> credentials be widely trusted, or that deployments restrict the use >>> of this mechanism to environments where the reliance on particular >>> trust anchors is assured by business arrangements or similar >>> constraints. >> >> replace above with: Use of a credentialing mechanism must be >> supported within a scope sufficient to include the authentication >> service, the verifying service and the credentialing service. > I think > the existing text is much more specific than the proposed edit, and > while the edit may be more concise, it does not attest the > possibility that "business arrangements or similar constraints" may > be required to enforce a trust anchor in some deployments. Oh yes. It /is/ more specific. That's the problem. It is diving into detail that isn't appropriate for the protocol specification task of this document. >>> Note that credential systems must address key lifecycle management >>> concerns: were a domain to change the credential available at the >>> Identity-Info URI before a verifier evaluates a request signed by an >>> authentication service, this would cause obvious verifier failures. >>> When a rollover occurs, authentication services SHOULD thus provide >>> new Identity-Info URIs for each new credential, and SHOULD continue >>> to make older key acquisition URIs available for a duration longer >>> than the plausible lifetime of a SIP transaction (a minute would most >>> likely suffice). >>> >>> 7. Identity Types >>> >>> This specification focuses primarily on cases where the called and >> >> Focuses primarily? What I've been reading in this spec covers both >> phone and uri forms. So I don't know what the 'primarily' refers to. > STIR itself primarily focuses on telephone numbers > and the problems of impersonation related to them. We went back and > forth on the charter about whether to even allow this spec to cover > regular SIP URIs as well. Ultimately, it does, though they have been > second-class citizens throughout the spec's development. The recent > restructuring of Section 7 and the introduction of the URI > normalization section were intended to rectify that a bit. So perhaps > it isn't as true anymore. But in terms of STIR's overall goal, > telephone numbers are definitely the primary focus. Actually, this specification does /not/ "focus" on telephone numbers. It attempts to deal with both forms of identifier, although the way it does that is confusing. To the extent that you think this document focuses on telephone numbers "and the problems of impersonation related to them" as distinct from other types of identifiers, please describe where and how this focus is established and maintained, because I really don't see it. In additional, such a focus is probably a tactical mistake and probably a strategic one, especially given the many and varied claims of interest in providing for longer-term enhancements... >> >>> calling parties identified in the To and From header field values use >>> telephone numbers, as this remains the dominant use case in the >>> deployment of SIP. However, this specification also works with >>> "greenfield" identifiers (of the form "sip:user@host"), and >>> potentially other identifiers when SIP interworks with another >>> protocol. >> >> What about these is 'greenfield'? What does it mean here? > Even in the spec, > "greenfield" is given in quotes to set it apart. While it's true that > the term does not appear elsewhere in the specification, and could be > discarded without doing any harm to readability, its presence does > not strike me as a problem either. The response doesn't answer my question. And my question made clear that I've no idea what the word is supposed to mean here or what justifies use of the word. >>> Peterson, et al. Expires January 8, 2017 [Page 16] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> The guidance in this section also applies to extracting the URI >> >> guidance vs. specification? > I think the term > "guidance" is adequate and not ambiguous. So, this section is only supposed to be a non-normative discussion of the topic? It isn't supposed to provide normative detail? >> >>> containing the originator's identity from the P-Asserted-Identity >>> header field value instead of the From header field value. In some >> >> Huh? How is the verifier supposed to know where to draw the values from? > The > answer to that is so obvious that perhaps it is easy to miss. If your > environment uses PAI, then you take the identity value from there. If > it doesn't, you don't. This may sound glib, but it is actually > profoundly sound advice for the environments that actually do use > PAI. This has been much discussed on the list, even very recently. We > think the guidance here is sufficient. >> >>> environments, the P-Asserted-Identity header field is used in lieu of >>> the From header field to convey the address-of-record or telephone >>> number of the sender of a request; while it is not envisioned that >>> many of those networks would or should make use of the Identity >>> mechanism described in this specification, where they do, local >>> policy might therefore dictate that the canonical identity derive >>> from the P-Asserted-Identity header field rather than the From. >> >> As soon as a document says 'local policy' it needs to stop specifying >> detail, since it is both outside of the scope of the document and it is >> distracting from the details of the specification. >> >> If you have to make reference to the possibility, then include something >> simple and brief, such as: >> >> Local policies might choose to use a value from fields other than >> To and From. The details for this are outside the scope of this >> specification. >> >> To the extent there is a compelling need to specify this alternative >> mechanism, do it in a separate specification. > Especially here, this is nonsense. > What is local policy, as the spec says, is the decision of whether > you extract the identity from PAI or the From. There's still plenty > to be said about what you do once that policy decision has been made > one way or another. The notion that as soon as the words "local > policy" appear in a spec then you can't say further related to the > subject is a rule with no basis in practice or reality. Again, the > review urges that "To the extent there is a compelling need to > specify this alternative mechanism, do it in a separate > specification." No thanks, it's fine here. On similar grounds, the > review goes on to suggest that another helpful paragraph of mechanism > be removed because it mentions "local policy" in connection with the > "canon" parameter. No thanks. *"What is local policy, as the spec says, is the decision of whether you extract the identity from PAI or the From" is a perfect example of failing to ensure interoperability. It is exactly the sort of thing that needs to have determinacy in sources of information. The concept of "local" policy for such an action is an explicit statement that a participant has stepped outside the four walls of the standardization process.* >> >>> Ultimately, in any case where local policy canonicalizes the idenity >>> into a form different from how it appears in the From header field, >>> the use of the "canon" parameter by authentication services is >>> RECOMMENDED, but because "canon" itself could then divulge >>> information about users or networks, implementers should be mindful >>> of the guidelines in Section 11. >> >> remove above paragraph. {{ No response from Jon. }} >>> >>> It may not be trivial to tell if a given URI contains a telephone >> >> If that means it isn't deterministic, we've got a basic problem, since >> protocol specs do not offer heuristics. >> >> If it just means there is complexity, then the sentence says nothing >> useful. > Of course, the next sentence goes on > to start explaining what you do, with some nice normative text. > Similarly, the review then orders, "If there is an algorithm to > follow, specify it as an algorithm. Otherwise, this is non-normative > discussion and isn't very helpful here." And the very next sentence > gives the first step in an algorithm. >> >>> number. In order to determine whether or not the user portion of a >> >> [or not] remove >> >> >>> SIP URI is a telephone number, authentication services and >>> verification services MUST perform the following procedure on any SIP >>> URI they inspect which contains a numeric user part. Note that the >>> same procedures are followed for creating the canonical form of URIs >>> found in the From header field as they are in the To header field or >>> the P-Asserted-Identity header field. >> >> If there is an algorithm to follow, specify it as an algorithm. >> Otherwise, this is non-normative discussion and isn't very helpful here. {{ No response from Jon. }} >> >>> First, implementations must look for obvious indications that the >>> user-portion of the URI constitutes a telephone number. Telephone >>> numbers most commonly appear in SIP header field values in the >> >> "most commonly" suggests that this is discussion, not specification. > Specifications are apparently > forbidden from suggesting that something is rare or pervasive. There > are two ways that a telephone number can appear in the user part of a > SIP URI, and that one is more common than the other in contemporary > operations. It is true that this information would only be of little > use to implementers, because the scheme itself will tell you whether > or not the less common of these approaches is in use. And maybe over > time it would no longer be true. But is it even worth anyone's time > to suggest removing it? Will any implementer do something wrong > because those words are there? Will anyone be confused or understand > the aim of the specification less? The essential point is confusing specification detail with operational detail, especially when the operational detail involves statistics and there is no data upon which to base the prediction. Conflating the two types of text confuses both of them. >> >>> username portion of a SIP URI (e.g., >>> 'sip:+17005551008@chicago.example.com;user=phone'). The user part of >>> that URI conforms to the syntax of the TEL URI scheme (RFC 3966 >>> [RFC3966]). It is also possible for a TEL URI to appear in the SIP >>> To or From header field outside the context of a SIP or SIPS URI >>> (e.g., 'tel:+17005551008'). Thus, in some environments, numbers will >>> be explicitly labeled by the use of TEL URIs or the 'user=phone' >>> parameter, or implicitly by the presence of the '+' indicator at the >>> start of the user-portion. Absent these indications, if there are >>> numbers present in the user-portion, implementations may also detect >>> that the user-portion of the URI contains a telephone number by >>> determining whether or not those numbers would be dialable or >>> routable in the local environment -- bearing in mind that the >>> telephone number may be a valid E.164 number, a nationally-specific >>> number, or even a private branch exchange number. Once a telephone >>> number has been detected, implementations should follow the >>> procedures in Section 7.2. >>> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 17] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> If the URI field does not contain a telephone number, URI >>> normalization procedures are invoked to canonicalize the URI before >>> it is included in a PASSporT object in, for example, an "uri" claim. >>> See Section 7.4 for that behavior. >> >> I suspect that the above topic is confusing what can/must be done as a >> deterministic specification, with what incremental value can be obtained >> by the addition of some non-normative heuristics. Separate these and >> make the deterministic stuff part of the specification and the >> heuristics part of an external document discussing real-world >> implementation, or somesuch. > I'm not aware > that there is any "heuristics part" of this mechanism to exile > elsewhere. There is one sentence that talks about just treating a > numeric string like a telephone number and seeing if it works - if > that's the heuristics part, then I think it doesn't take up a lot of > the reader's time. Given the style of the prose that apparently is attempting to specify an algorithm, I can't tell whether the outcome is deterministic and interoperable. >> >> >> >>> 7.1. Authority for Telephone Numbers >>> >>> In order for telephone numbers to be used with the mechanism >>> described in this document, authentication services must enroll with >>> an authority that issues credentials authoritative for telephone >>> numbers or telephone number ranges, and verification services must >>> trust the authority employed by the authentication service that signs >> >> "enroll"??? > 7.1 "'enroll'???" Yes, there is something called certificate > enrollment. Some quick research shows the term tied to Microsoft products and to SCEP. Google certainly does not produce results that shows it as ab otherwise-common term. So here we are again, with a term of art being used that does not have a definitional anchor in this document, but apparently significant intent in its use. So the reader is not safe to guess or ignore but is mostly being required to guess. After review, the situation might be more interesting than I'd realized, since I can't find a definition of "authentication services", so I'm not even clear what function entity in the STIR architecture is being referenced and what its job is. >> >>> a request. Per Section 6.4, enrollment procedures and credential >>> management are outside the scope of this document; approaches to >>> credential management for telephone numbers are discussed in >>> [I-D.ietf-stir-certificates]. >> >> If they are outside the scope, then don't provide details such as about >> enrolling. At the least, don't repeat information provided elsewhere in >> the document. > This is a comment on a two-sentence, one > paragraph section which exists to give an external pointer to > stir-certs. It says that this stuff is "outside the scope of the > document." There are no "details" about enrolling in this section, > nor does it repeat information provided in 6.4 - it only mentions > that there is information in 6.4. This review comment does not even > identify any real issue. >> >>> >>> 7.2. Telephone Number Canonicalization Procedures >>> >>> Once an implementation has identified a telephone number in the URI, >> >> Once a telephone number is identified... >> >> And what about telephone numbers that are not part of a URI? > The To and From header field values (and the sneaky > P-Asserted-Identity header field value too) of SIP contain URIs. The > only meaningful distinction here is between a SIP URI and a TEL URI. > But you're always going to be extracting a telephone number from some > sort of URI. Such a simple and even reasonable point. And yet this far into the document I had not understood that, in spite of extremely detailed reading of the draft. No doubt I'm the only reader who will suffer that confusion... >>> it must construct a number string. That requires performing the >>> following steps: >> >> If a 'number string' has been identified, then what does it mean to >> 'construct a number string'? I think what's meant is that it is >> necessary to put the number into a canonical form. In any case, please >> clarify what is meant. > Of course, since > the next sentence reads "That requires performing the following > steps," clearly performing those steps is what it means to "construct > a number string." But more importantly, the review question assumes > that a "number string" has already been identified, whereas the spec > text reads "once an implementation has identified a telephone > number." The distinction here is between a "telephone number" and a > "number string." The review though neatly twists this around to make > it sound like that distinction is not obvious in the sentence. [$] The point behind my question is that the phrasing creates confusion. At the least, the nature/purpose of the string to be constructed needs to be clarified. >> The algorithm should be specified in the form of an algorithm, rather >> than as normative prose, and language like "except only" encourages >> coding errors: >>> Implementations MUST drop any leading +'s, any internal dashes, >>> parentheses or other non-numeric characters, excepting only the >>> leading "#" or "*" keys used in some special service numbers >>> (typically, these will appear only in the To header field value). >>> This MUST result in an ASCII string limited to "#", "*" and digits >>> without whitespace or visual separators. >> >> So '+' is retained if it's internal? Why? > It's true that as the text reads now, we only strip a > leading "+". I'm not aware that there is any issue with an internal > "+". The review goes on to propose that we simply replace all the > fancy canonicalization stuff with a simple statement that one should > "Take the original string and remove any characters that do not > conform to the above format." This isn't really that far from what we > recommend, except for cases where you are converting from a dial > string or similar operation - which basically is a case where, as the > review says, you "tweak that trext for any cases that need to add > characters," as you typically just prepend characters when converting > from a dial string (though you may add some first, depends on the > string). >> Move commentary about the algorithm -- such as "these will appear..." -- >> to be outside of the algorithm specification. >> >>> Next, an implementation must assess if the number string is a >>> valid, globally-routable number with a leading country code. If >> >> How are they to do this? {{ No response from Jon. }} >>> not, implementations SHOULD convert the number into E.164 format, >>> adding a country code if necessary; this may involve transforming >>> the number from a dial string (see [RFC3966]), removing any >> >> So, again, this isn't really a specification. Language like 'may >> involve' makes this commentary. >> >> >>> national or international dialing prefixes or performing similar >>> procedures. It is only in the case that an implementation cannot >>> determine how to convert the number to a globally-routable format >> >> Again, this kind of language is not really a specification. > 7.2 Here the review pushes back more strongly than previously on the > whole idea of using steps to describe behavior. The review redas, > "the algorithm should be specified in the form of an algorithm, > rather than as normative prose," and goes on reading the steps to > add, "again, this isn't really a specification," "this kind of > language is not really a specification," and then "the above text > also is not a specification." But in other places, the review seems > to acknowledge that these steps do describe an algorithm, and it > merely suggests moving "commentary about the algorithm -- such as > 'these will appear...' to be outside of the algorithm specification." > > One of the symptoms of being "commentary" instead of specification is > language like "may involve," apparently. The spec here has a > normative statement about transforming the number into an E.164 > format, which, a separate clause reads, "may involve transforming the > number from a dial string (see RFC3966)" or various other formats. > The spec text here is a true and useful statement: the number may be > a dial string (per RFC3966) and may need to be transformed into E.164 > format. It won't always, or even usually (commonly!) be true that you > need to do that, but you might. Listing this in the step is useful. > Whatever prohibition the reviewer imagines that divides "commentary" > from "specification" in this fashion would be an onerous and > counterproductive constraint on IETF specifications. It is probably a > good warning though that "language like "except only" encourages > coding errors." (I've left Jon's entire comment -- including it's context-setting text -- to show that he covers multiple review comment entries. The placing here is for what I think is the last of the set.) >> >>> that this step may be skipped. This will be the case, for >>> example, for nationally-specific service numbers (e.g. 911, 112); >>> however, the routing procedures associated with those numbers will >>> likely make sure that the verification service understands the >>> context of their use. >>> >>> Other transformations during canonicalization MAY be made in >>> accordance with specific policies used within a local domain. For >>> example, one domain may only use local number formatting and need >>> to convert all To/From user portions to E.164 by prepending >> >> And the above text also is not a specification. It also isn't >> interoperable. It says "the folks encoding the strings will do whatever >> local stuff they feel like and the folks at the verification side won't >> know what it was and won't be able to replicate it. So canonicalization >> won't be a standard, global service. > It is true that we acknowledge it will be > possible for different entities to canonicalize numbers different > ways. This will happen in cases with private numbering plans, various > strange nationally-specific numbers (like emergency service numbers), > and some other corner cases. It is just our assessment that these > will not be vectors for enabling impersonation of calling party > numbers, and that they will be rare (as in, not "common") enough that > it won't impact operations significantly. Overwhelmingly, networks > will carry numbers in E.164 format, and the canonicalization pass > will be very light and straightforward. Our confidence in that > operational reality is the basis for the mechanism that we propose. > It has been scrutinized by, well, the people that actually operate > these systems. Also, because of "canon," the two networks will at > least be able to spot debugging errors here. This guarantees non-interoperability, since the verifying entity won't know what to do to produce the same result. >> The alternative model, is that 'local policy' will be the same for both >> ends, in which case, the spec is saying that there might be >> canonicalizations that are outside the specifications. But in that >> case, text referring to it is distracting rather than helpful. >> >> If a local environment is doing 'local policy' then it will document >> that separately. There is no utility in making vague statements about >> possibilities that are outside the spec. {{ No response from Jon. }} >> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 18] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> country-code and region code digits; another domain might prefix >>> usernames with trunk-routing codes and need to remove the prefix. >>> This specification cannot anticipate all of the potential >>> transformations that might be useful. >>> >>> The resulting canonical number string will be used as input to the >>> hash calculation during signing and verifying processes. >>> >>> The ABNF of this number string is: >>> >>> tn-spec = [ "#" / "*" ] 1*DIGIT >> >> I suspect that the entire topic of canonicalization merely needs core >> text that says somethg like: >> >> Take the original string and remove any characters that do not >> conform to the above format. >> >> Then tweak that text for any cases that need to add characters. {{ No response from Jon. }} >> >>> >>> If the result of this procedure forms a complete telephone number, >> >> What is the definition of a 'complete tn'? Cite it. > Um, > we'll fix that as "E.164", though probably the ref here is to > RFC3966. >> >>> that number is used for the purpose of creating and signing the >> >> for the purpose of creating and signing -> for creating >> >> I suspect it is /not/ used "for signing" but is in fact used to create >> part of the content that is signed. That's different. > That's correct. I'm willing to ditch "and signing". >> >>> signed-identity-string by both the authentication service and >>> verification service. Practically, entities that perform the >>> authentication service role will sometimes alter the telephone >>> numbers that appear in the To and From header field values, >>> converting them to this format (though note this is not a function >>> that [RFC3261] permits proxy servers to perform). The result of the >>> canonicalization process of the From header field value may also be >>> recorded through the use of the "canon" parameter of the Identity(see >>> Section 8). >> >> Why is this significant? How does it affect processing? > It is significant > because canon helps to debug operational errors that arise from > canonicalization problems. >>> >>> If the result of the canonicalization of the From header field value >>> does not form a complete and valid telephone number, the >>> authentication service and/or verification service SHOULD treat the >>> entire URI as a SIP URI, and apply the procedures in Section 7.4. >> >> Here, having a SHOULD rather than a MUST seems likely to produce >> non-interoperability, since signer and validator are allowed to behave >> differently, thereby making it likely they will produce different results. > Again, we don't think there is a practical > problem here. In cases where any form of meaningful inter-network > interoperability is possible, different sides of the call path will > arrive at the same decisions here, and in cases where they can't > agree on what a number is, they probably can't meaningfully even > route calls to each other, let alone sign calling party information. The response seems to be saying that choice of normative language doesn't matter here because there will be private agreements to cover it. In that case, remove the text from here, or include text that explicitly says the issue will be covered outside of the specification. (I don't think that's actually viable, in this case, for a public, interoperable protocols specification done in the IETF, but what the heck...) >>> >>> 7.3. Authority for Domain Names >> >> Authority for domain names comes from ICANN. Unfortunately, I'm not >> clear enough about the specific purpose of this section, but it needs a >> title that is more specific and clear. > The title obviously mirrors the title of 7.1, "Authority for > Telephone Names," and both refer to the authority that credentials > provide over the respective identifiers. Ultimately, we could say > that this authority devolves from ICANN, in the domain name case, and > trickles down through the TLD operators to the owners of second level > domains who go get credentials from certificate authorities today. So > actually, I'm not sure the subject of this section is so divorced > from the reviewer's reading as he supposes. >> It appears that this section is both trying to give background about >> various occurrences of domain names and (redundantly?) discuss the >> challenges of finding the right caller-id string. This suggests >> splitting the discussion to an earlier, non-normative section, and a >> section here that simply specifies technical detail to perform. > 7.3 The review here proposes for this section "splitting the > discussion to an earlier, non-normative section, and a section here > that simply specifies technical detail to perform." Sounds like that > would take some work, but the benefit of that split would be unclear. focus. clarity. >>> When a verifier processes a request containing an Identity-Info >>> header with a domain signature, it must compare the domain portion of >> >> must or MUST? {{ No response from Jon. }} >> >>> the URI in the From header field of the request with the domain name >>> that is the subject of the credential acquired from the "info" >>> parameter. While it might seem that this should be a straightforward >>> process, it is complicated by two deployment realities. In the first >>> place, credentials have varying ways of describing their subjects, >>> and may indeed have multiple subjects, especially in 'virtual >>> hosting' cases where multiple domains are managed by a single >>> application. Secondly, some SIP services may delegate SIP functions >>> to a subordinate domain and utilize the procedures in RFC 3263 >>> [RFC3263] that allow requests for, say, 'example.com' to be routed to >>> 'sip.example.com'. As a result, a user with the AoR >>> 'sip:jon@example.com' may process requests through a host like >>> 'sip.example.com', and it may be that latter host that acts as an >>> authentication service. >>> >> >> But since credentials are a modularized construct, outside of this >> specification, why is this specification going into this sort of detail >> about them? > The answer is that the > spec text this highlights talks not about credentials, but about the > way that SIP servers use identifiers, and how domain names are > encoded within SIP URIs in particular. The discussion that this > comment follows is about name subordination in SIP, not in > credentials. It is necessary to give some SIP guidance related to > name subordination as it may have implications for the use of > credentials and the scope of authority that would not otherwise be > obvious. The review goes to reiterate that "I suspect all of the > above detail is out of scope, given the way these specifications have > been partitioned," but the relevance of the discussion of NAPTR and > SRV processing to the domain names attested by credentials is pretty > obvious, I think. >> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 19] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> To meet the second of these problems, a domain that deploys an >>> authentication service on a subordinate host MUST be willing to >>> supply that host with the private keying material associated with a >>> credential whose subject is a domain name that corresponds to the >>> domain portion of the AoRs that the domain distributes to users. >>> Note that this corresponds to the comparable case of routing inbound >>> SIP requests to a domain. When the NAPTR and SRV procedures of RFC >>> 3263 are used to direct requests to a domain name other than the >>> domain in the original Request-URI (e.g., for 'sip:jon@example.com', >>> the corresponding SRV records point to the service >>> 'sip1.example.org'), the client expects that the certificate passed >>> back in any TLS exchange with that host will correspond exactly with >>> the domain of the original Request-URI, not the domain name of the >>> host. Consequently, in order to make inbound routing to such SIP >>> services work, a domain administrator must similarly be willing to >>> share the domain's private key with the service. This design >>> decision was made to compensate for the insecurity of the DNS, and it >>> makes certain potential approaches to DNS-based 'virtual hosting' >>> unsecurable for SIP in environments where domain administrators are >>> unwilling to share keys with hosting services. >> >> Really, I suspect all of the above detail is out of scope, given the way >> these specifications have been partitioned. {{ No response from Jon. }} >>> >>> A verifier MUST evaluate the correspondence between the user's >>> identity and the signing credential by following the procedures >>> defined in RFC 2818 [RFC2818], Section 3.1. While RFC 2818 [RFC2818] >>> deals with the use of HTTP in TLS and is specific to certificates, >>> the procedures described are applicable to verifying identity if one >>> substitutes the "hostname of the server" in HTTP for the domain >>> portion of the user's identity in the From header field of a SIP >>> request with an Identity header. >> >> What does 'must evaluate' mean? What specific 'evaluation' actions are >> being required? And actions are to be taken in response to the evaluation? > The end of > the spec sentence here says, inevitably, "by following the procedures > defined in RFC 2818 [RFC2818], Section 3.1." So presumably the > "evaluation" actions described there are the ones that the verifier > takes in this case. That section also gives the "actions are to be > taken in response to the evaluation". Again, extending a document the > courtesy of reading the entire sentence is usually a good idea when > writing a review of this kind. [$] Oh boy. The cited section refers to values with very specific names, which don't match parameter/value names in the current document. So the reference to using the procedures of Section 3.1 permits an approximation at best. In addition, Section 3.1 uses the term 'matching', not 'evaluating', which is a more precise and appropriate semantic. Next, Section 3.1 actually pints to RFC2459 for the meat of the work, which raises the question of why the current spec doesn't simply point to RFC2459. Lastly, I thought that the history of domain name matching with certs has shown far too much rigidity about the domain string and that there has recently been quite a bit of work to permit matching in the face of valid variations. Why isn't that recent work incorporated here? >>> 7.4. URI Normalization >> >> Canonicalization for phone numbers and Normalization for URI. Why the >> difference? {{ No response from Jon. }} >> >>> Just as telephone numbers may undergo a number of syntactic >>> transformation during transit, the same can happen to SIP and SIPS >> >> transformation -> transformations {{ No response from Jon. }} >> >>> URIs without telephone numbers as they traverse certain >>> intermediaries. Therefore, when generating a PASSporT object based >>> on a SIP request, any SIP and SIPS URIs must be transformed into a >>> canonical form which captures the address-of-record represented by >>> the URI before they are provisioned in PASSporT claims such as "uri". >> >> The above text belongs in an earlier discussion of issues, so that the >> specification section can focus on specifying. > This is also > a "what doesn't belong in specs" issue, but here presented > organizationally, as if an RFC is divided into sections about > "specification" and then non-normative sections. Where this is coming > from is, as usual, beyond me. The spec text in this section is the > only place in the document that we address either the normative or > informative dimensions of URI normalization. >> >>> The URI normalization procedures required are as follows. >>> >>> Following the ABNF of RFC3261, the SIP or SIPS URI in question MUST >> >> Which ABNF? Where in the document? Section 25.1? >> >> What about the ABNF requires any of what is asserted here? > It is true that we don't give > the section, but the text is clear we are talking about the ABNF of > the "SIP and SIPS URI", and the rest of the sentence specifically > references the structure of that ABNF, including the "hostport" > component and the remaining elements. Reading to the end of the > sentence frequently resolves things that might appear ambiguous at > the beginning of a sentence. The review makes it to the end of the > sentence, actually, and locates the proper ABNF, because then the > review complains about the use of "including" when it precedes the > requirement to remove the uri-parameters and heads, as "By my reading > there isn't anything other than those two rules." Given that the > review had no difficulty locating the ABNF and the elements in > question, why ask "What about the ABNF requires any of what is > asserted here?" Why pretend that this was unclear or ambiguous? [$] ad hominem. always a pleasure. Especially when the review comment was about nothing more than the lack of adequate precision in the reference, by repeating that referring to an entire document does not constitute a sufficiently narrow pointer. >> Again, algorithms need to be specified as algorithms, not just prose. >> >>> discard all elements after the "hostport" of the URI, including all >>> uri-parameters and headers, from its ayntax. Of the userinfo >> >> "including"? By my reading there isn't anything other than those two >> rules. {{ No response from Jon. }} >> >>> component of the SIP URI, only the user element will be retained: any >>> password (and any leading ":" before the password) MUST be removed, >>> and since this userinfo necessarily does not contain a telephone- >> >> I think the algorithm intended here is: >> >> 1. Parse the SIP/SIPS URI >> >> 2. Retain if present >> ; will not be present >> >> 3. Retain >> >> done. > I > don't believe it is more clear or helpful than the spec text as > written. Oh boy. >> >> >>> Peterson, et al. Expires January 8, 2017 [Page 20] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> subscriber component, no further parameters can appear in the user >>> portion. >>> >>> The hostport portion of the SIP or SIPS URI MUST similarly be >>> stripped of any trailing port along with the ":" that proceeds the >>> port, leaving only the host. >> >> In other words, just get {{ No response from Jon. }} >> >>> >>> The ABNF of this canonical URI form (following the syntax defined in >>> RFC3261) is: >>> >>> canon-uri = ( "sip" / "sips" ) ":" user "@" host >> >> What is the purpose of retaining the sip/sips distinction, within this >> context? > We had considered using just > rfc822 style identifiers here, and discarding the scheme entirely. If > present, SIPS implies something valuable actually, especially when > the URI appears in the To header field value - it would be an > interesting security violation if an intermediary downgraded that > from SIPS to SIP in transit, as that has implications for the > hop-by-hop use of TLS. That much said, this sort of intermediary > meddling is not specifically in the scope of STIR, it is merely a > side effect of our work, but one worth preserving. Every time language like "SIP or SIPS" or "SIP/SIPS" is used, there is no tailored language for one or the other. Rather there is merely repetition adding unnecessary verbosity and possible distraction. >> >>> Finally, the URI will be subject to syntax-based URI normalization >>> procedures of [RFC3986] Section 6.2.2, especially to perform case >> >> Except that 6.2.2 does not actually specify normalization. Rather, it >> talks about an approach to normalization, without giving precise details. > If there's something > better to cite here, I'm happy to cite it. We're not going to > reinvent the wheel. Maybe I'll ask this question more broadly. This > text is among the newest in rfc4474bis, so it's good to have some > eyes on it. When something doesn't do what is needed, it's not a case of doing 'better'. It is a case of doing what is needed. Either by citation or by direct exposition. >>> normalization and percent-encoding normalization. However, note that >>> normalization procedures face known challenges in some >>> internationalized environments (see [I-D.ietf-iri-comparison]) and >>> that perfect normalization of URIs may not be possible in those >>> environments. >> >> The above last sentence reduces to: do normalization but don't rely on >> it working. >> >> This again raises the question of treating a broken signature the same >> as no signature present. > Indeed, there are some internationalized > environments where we expect normalization won't help, just as there > are some oddball telephone environments where canonicalization is > unlikely to help. We just think that there are operational > environments where this will all work without any problems. For the Within the four walls of a protocol specification, there is a kind of perfection. The protocol works where it works. Where it doesn't work, it doesn't exist. Referring to the places a protocol won't work properly might be useful during an opening discussion about the applicable environments for using the protocol. But that does not include in the middle of the protocol's detailed specification. At base, the issue here is, again, failing to treat activities that are out of scope as outside of the specification, and/or failing to move discussion of operational consideration to a /separate/ discussion of operational issues. > review, though, "This again raises the question of treating a broken > signature the same as no signature present." Here I can only point > once again to the text of rfc4474bis-10 section 5.2, in the last > paragraph, which states that "This specification does not propose any > authorization policy for user agents or proxy servers to follow based > on the presence of a valid Identity header, the presence of an > invalid Identity header," etc. At a protocol level, we believe it is > helpful to send a 438 when there are only invalid Identity headers in > a message, so we make that a MUST. But for the terminating side, that > is not a question of operational policy, that is a question of > getting the full "canon" for debugging purposes. For the originating > side, who is going to the trouble of signing these things in the > first place, merely ignoring an invalid signature silently and > proceeding as if no Identity was provided is not particularly helpful > - they should want to know that there is a failure, be it simply some > sort of misconfiguration or something untoward going on. >> >>> >>> For future PASSporT applications, it may be desirable to provide an >>> identifier without an attached protocol scheme. Future >> >> Discussion about future hypotheticals, again. Remove. > Why is this information here? Because > we want to warn implementers about the potential for identifiers > without protocol schemes, including rfc822 identifiers, which we > expect might come from WebRTC interaction (like SIP -> WebRTC > gatewaying). This sort of 'warning' is almost certain to have no practical effect on programmer behavior. There are well-established reasons for this, at several levels. So it's text that makes the author feel like they'd been diligent, but they haven't actually accomplished anything useful. >> >>> specifications that define PASSporT claims for SIP as a using >>> protocol could use these basic procedures, but eliminate the scheme >>> component. A more exact definition is left to future specifications. >> >> Exactly. >> >> >>> >>> 8. Header Syntax >> >> >> I'm quite confused. This section appears to be simultaneously >> specifying a SIP Identity header field as well as how to populate an >> associate Passort entity. > Since constructing a > PASSporT entity is a step in constructing the SIP Identity header, > this is not such a confusing matter to me. But I'll take this as yet > another organizational suggestion that there should be a subsection > or what have you to contain the PASSporT-related text. It's not an > awful idea, but nor would it solve any particular problem. > Hypothetical changes like this are unlikely to have any impact on > implementation. >>> The Identity and Identity-Info headers that were previously defined >> >> header *field* >> >> >>> in RFC4474 are deprecated. >> >> Reference to the previous 4474 content is unproductive and distracting. >> Remove all of it. This is a new specification. >> >> It is not revising an installed base. So this section should merely >> define what it defines and not put it in terms of the earlier document. > The > idea that a bis of an existing RFC should not reference that RFC is > pretty removed from my experience at the IETF. The review instead > proposes that "this section should merely define what it defines and > not put it in terms of the earlier document." I don't think the text > here actually does put anything "in terms of the earlier document," > it just has a one-paragraph introductory warning that this header > syntax is revising an existing bit of grammar. The issue isn't 'reference' but rather concerns the distraction of 'discussion' and of auditing the differences. As for IETF experience with bis documents, the ones I've seen over the years were for documents that had a significant installed base. The RFC in question here doesn't fit that model. >> >>> This revised specification collapses the >>> grammar of Identity-Info into the Identity header via the "info" >>> parameter. Note that unlike the prior specification in RFC4474, the >>> Identity header is now allowed to appear more than one time in a SIP >>> request. The revised grammar for the Identity header is (following >>> the ABNF [RFC4234] in RFC 3261 [RFC3261]): >>> >>> Identity = "Identity" HCOLON signed-identity-digest SEMI ident-info >>> *( SEMI ident-info-params ) >>> signed-identity-digest = LDQUOT *base64-char RDQUOT >>> ident-info = "info" EQUAL ident-info-uri >>> ident-info-uri = LAQUOT absoluteURI RAQUOT >>> ident-info-params = ident-info-alg / ident-type / canonical-str / >>> ident-info-extension >>> ident-info-alg = "alg" EQUAL token >>> ident-type = "ppt" EQUAL token >>> canonical-str = "canon" EQUAL *base64-char >>> ident-info-extension = generic-param >>> >>> base64-char = ALPHA / DIGIT / "/" / "+" >> >> >> Note the use of ABNF here, rather than JSON. >> >> canon is optional. why doesn't the abnf show it as optional? I suspect >> the issue is that the abnf needs to distinguish between mandatory and >> optional components of the Identity header field. {{ No response from Jon. }} >> isn't defined!!! >> >> isn't defined. >> >> LAQUOT, EQUAL, RAQUOT, absoluteURI are all undefined. Rules like these >> are usually inherited from another document. If that's the case here, >> cite it. >> >> These sorts of rules (including base-64-char, which is defined >> syntactically but not semantically) need explicit ABNF rules with their >> names and then need prose text to explain their semantics. {{ No response from Jon. }} > The fact that before the > ABNF of the header there is a clear statement that this is "following > the ABNF [RFC4234] in RFC 3261 [RFC3261]", which defines all of those > elements, is clearly lost on the reviewer. [$] Yes it was. For one thing, it is usual when importing rules to state that rules are being important. Specifications that are especially polite explicitly list the names of rules that are imported. And again, citations should be as precise as possible, naming sections or sub-sections rather than entire documents. >> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 21] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> In addition to "info" parameter, and the "alg" parameter previously >> >> to -> to the >> >> >>> defined in RFC4474, this specification includes the optional "canon" >>> and "ppt" parameters. Note that in RFC4474, the signed-identity- >>> digest (see ABNF above) was given as quoted 32LHEX, whereas here it >>> is given as a quoted sequence of base64-char. Hmm. I'd missed the extraneous reference to RFC4474 here. It should be removed. >>> The 'absoluteURI' portion of ident-info-uri MUST contain a URI; see >>> Section 6.3 for more on choosing how to advertise credentials through >>> this parameter. >>> >>> The signed-identity-digest is the signed hash component of a PASSporT >>> object [I-D.ietf-stir-passport], a signature which PASSporT generates >> >> That document does not contain the string "signed hash". The word >> 'hash' only appears in 3.2.2.2 "mky". Worse, that section really does >> not specify its contents. Rather -- yet again -- we get discussion >> about purpose and possibility. >> >> Specific reference to a specific value that can be interoperably >> generated is needed. > That's true. There was a relatively lengthy > exchange on the list about the need for increased specificity (and > examples) of exactly what component of the PASSporT object goes into > the signed-identity-digest. So this was on our hit list to fix here > already. But just because you weren't the first one to be right about > this doesn't mean that it isn't a valid point that we need to fix. > You are quite correct that "Specific reference to a specific value > that can be interoperably generated is needed." >> >>> over a pair of JSON objects. The first PASSporT object contains >> >> What is meant by "the first passport object"? Where is there >> specification of multiple of them and how is their ordering determined? > Of course, this > interrupts a sentence, and the remainder of the sentence reads, "the > first PASSporT object contains header information, and the second > contains claims, following the conventions of JWT [RFC7519]." Have I > mentioned that the questions that might occur to us about the first > few words of a sentence are often resolved by the remainder of it? You have. It's a shame that such mentions were mostly wrong, by my original and continued reading of the text... There is nothing in the draft text that specifies in clear and simple terms what or where this 'first' object is, nor the 'second'. > After reading the rest of the sentence, the review then continues, > "I've gone back and looked at the Passport references to "object" and > do not see any clear indication that there are two, in the style > being summarized here." Obviously, "object" is the "O" in "JSON," and > indeed the JWT specification refers (for example) in Section 3 to how > "JWTs represent a set of claims as a JSON object", which is combined > with a JOSE header (a separate JSON object, as 3.1 makes clear by > referring to it as "the JSON object above") - in other words, one > might say they are two objects. How the heck is the reader to have guessed all this, nevermind be sure that that their guess was correct? > > While the review objects that "I've gone back and looked at the > Passport references to 'object'", what the spec text here says is > "following the conventions of JWT [RFC7519]," not PASSporT. The JWT is inherited through Passport. It has no life in this specification except through passport. Or at least, it's not supposed to. > reviewer would have found the answer to this question by actually > looking where the text suggested, but the reviewer seems defiant > about looking there: "I naturally assume that some portion of this is > inherited from JSON and/or JWT, which is a nice example of the > significant, additional overhead being being introduced with their > use. And in this case, apparently confusion." There is no need to > make any assumption here, the spec actually instructed you to refer > to JWT. The notion that there is anything to be confused about here > is a bunch of smoke and mirrors. [$] And of course, a series of indirections through multiple specifications is no risk of confusing any other reader, except one who is defiant, in spite of their explicitly iting efforts to follow those pointers, including the ones being noted in the reply, as noted just a bit further in the review comments... >> >>> header information, and the second contains claims, following the >>> conventions of JWT [RFC7519]; some header and claim values will >>> mirror elements of the SIP request. Once these two JSON objects have >> >> I've gone back and looked at the Passport references to "object" and do >> not see any clear indication that there are two, in the style being >> summarized here. Note that Passport's Section 3.1 does not say >> "object". Nor does the next section, 3.2. Yet, apparently, both should. Again: For all of the sturm und drang, the text says 'passport object' and the passport spec has no such terminology. >> But matters appear to be more confusing than that, in the Passport >> document, such as Section 3.2.2.1, which is titled 'claims' but makes >> references to objects. >> >> I naturally assume that some portion of this is inherited from JSON >> and/or JWT, which is a nice example of the significant, additional >> overhead being being introduced with their use. And in this case, >> apparently confusion. {{ No response from Jon. }} >> >>> been generated, they will be encoded, then hashed with a SHA-256 >>> hash. Those two hashes are then concatenated (header then claims) >>> into a string separated by a single "." per baseline PASSporT. >>> Finally, that string is signed to generate the signed-identity-digest >>> value of the Identity header. >> >> Another algorithm needing to be specified as an algorithm. >> >>> >>> For SIP implementations to populate the PASSporT header object from a >>> SIP request, the following elements message MUST be placed as the >> >> placed where? >> >> Or is this really a straight data copy from the JSON form to parameters >> in the SIP Identity header field? >> >>> values corresponding to the designated JSON keys: >> >> Delete the opening clause. > 8 When the spec tries to blurt out "the following elements message > MUST be placed as the" the review interjects "placed where?" If we > let the spec continues, it says, "placed as the values corresponding > to the designated JSON keys." There is no change required as a result > of this hasty review comment. The review then asks us to "Delete the > opening clause," presumably referring to the entire sentence. Why Yeah, because 'clause' is often used when 'sentence' is what is meant? > this sentence could possibly be a source of confusion or harm to the > reader is absolutely beyond me. [$] (context-setting retained.) (is anyone else as amused as I am by the idea that anyone would suggest that anything about my review process was 'hasty'?) I'm really sorry it's beyond the editor, but: "the following elements message MUST be placed as the values corresponding to the designated JSON keys:" does not make any obvious sense to me, and lacks clear specification information for resolving what is being referenced. >>> First, per baseline [I-D.ietf-stir-passport], the JSON key "typ" >>> key MUST have the value "passport". >> >> This appears to be introducing a redundancy between this spec and the >> Passport spec. There needs to be language in one that merely cites the >> other, rather than respecifying it. > It is true, this is effectively reiterating > the guidance of stir-passport. I don't however think this introduces > any practical problem. sigh. >>> Second, the JSON key "alg" MUST mirror the value of the optional >>> "alg" parameter in the SIP Identity header. Note if the "alg" >>> parameter is absent, the default value is "ES256". >>> >>> Third, the JSON key "x5u" MUST have a value equivalent to the >>> quoted URI in the "info" parameter. >>> >>> Fourth, the optional JSON key "ppt", if present, MUST have a value >>> equivalent to the quoted value of the "ppt" parameter of the >>> Identity header. If the "ppt" parameter is absent from the >>> header, the "ppt" key MUST NOT not appear in the JSON heaer >>> object. >> >> All of these 'must' formations are overkill. Normally, algorithms are >> specified in a simple, declarative manner. > 8 Once again the review here is concerned about "another algorithm > needing to be specified as an algorithm"," where "all of these 'must' > formations are overkill. Normally, algorithms are specified in a > simple, declarative manner." I don't believe the division of an > operation into steps containing normative MUSTs is an outlier in IETF > specifications. (Again, Jon's context-setting retained, since the response cover's multiple of my review comments.) >> >>> For example: >>> >>> { "typ":"passport", >>> "alg":"ES256", >>> "x5u":"https://www.example.com/cert.pkx" } >> >> What is this example demonstrating? How is the reader to know? > Given that it is an example of a header > object containing the three mandatory JSON keys with values that were > just described in the algorithm above, the reader would presumably > know what this is an example of by virtue of having just read the > words directly above it in the specification. The example is an > example of how the PASSporT header object would look. It > demonstrates... how the PASSporT header object would look. What is > this review comment asking? How is the target of the review to know? > Who could possibly think asking this question is a meaningful > contribution to our standards process and that it requires the > attention of the document authors or the working group? oh. so the goal is merely to show the reader what the appearance will be? no concern for maybe, you know, explaining the substance of the example? >> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 22] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> To populate the PASSporT claims JSON object from a SIP request, the >>> following elements MUST be placed as values corresponding to the >>> designated JSON keys: >>> >>> First, the JSON "orig" array MUST be populated. If the >>> originating identity is a telephone number, then the array MUST be >>> populated with a "tn" claim with a value set to the value of the >>> quoted originating identity, a canonicalized telephone number (see >>> Section 7.2). Otherwise, the array MUST be populated with a "uri" >>> claim, set to the value of the AoR of the UA sending the message >>> as taken from addr-spec of the From header field, per the >>> procedures in Section 7.4. >> >> Again, this appears to be quite a bit of detail that is redundant with >> specifications elsewhere. > Actually the "detail" > here consists of one sentence about telephone numbers and one about > URIs, the former of which contains a pointer to the telephone number > section (7.2) and the latter of which contains a pointer to the URI > section (7.4). There is no organizational or redundancy problem > here. >> >>> >>> Second, the JSON "dest" array MUST be populated. If the >>> destination identity is a telephone number, then the array MUST be >>> populated with a "tn" claim with a value set to the value of the >>> quoted destination identity, a canonicalized telephone number (see >>> Section 7.2). Otherwise, the array MUST be populated with a "uri" >>> claim, set to the value of the addr-spec component of the To >>> header field, which is the AoR to which the request is being sent, >>> per the procedures in Section 7.4. >>> >>> Third, the JSON key "iat" MUST appear, set to the value of a >>> quoted encoding of the value of the SIP Date header field as a >>> JSON NumericDate (as UNIX time, per [RFC7519] Section 2). >>> >>> Fourth, if the request contains an SDP message body, and if that >>> SDP contains one or more "a=fingerprint" attributes, then the JSON >>> key "mky" MUST appear with the algorithm(s) and value(s) of the >>> fingerprint attributes (if they differ), following the format >>> given in [I-D.ietf-stir-passport] Section 3.2.2.2. >>> >>> For example: >>> >>> { "orig":{"tn":"12155551212"}, >>> "dest":{"tn":"12155551213"}, >>> "iat":"1443208345" } >>> >>> For more information on the security properties of these SIP message >> >> 'more'? is there security information here? where? > If we were feeling generous, we might read the original text > as "for more information, information on the security properties of > these SIP message elements." I see no serious risk of this confusing Because readers won't see 'more' and think that it normally is a connector to related, /preceding/ material? Drop the 'more', and the sentence is fine. > readers and implementers. The review continues that "And since every > RFC contains a security considerations section, a generic reference > like this, here, is of no obvious value. It's just more text." The > fact that the Security Considerations contains specific analysis that > takes each of these SIP message fields and notes their security > properties is why they warrant a mention here - as the spec says, > when it notes that the section answers "why their inclusion mitigates > replay attacks" for example. Reviews that ignore what the text > actually says and instead critique a generic strawman are unlikely to > contribute much value. whereas comments like the above are the hallmark of professionalism. >> >>> elements, and why their inclusion mitigates replay attacks, see >>> Section 12 and [RFC3893]. Note that future extensions to the >> >> And since every RFC contains a security considerations section, a >> generic reference like this, here, is of no obvious value. It's just >> more text. {{ No response from Jon. }} >> >>> PASSporT object could introduce new claims, and that further SIP >> >> Future reference to hypotheticals. > In this case, it is to the statement > that future extensions to PASSporT might alter the security > properties provided by the signature by covering new information. > This is a useful thing to note in this case, and no change should be > made as a result of this review comment. Future extensions could do all sorts of things. The statement here does not affect implementation of the current spec or use of the current spec. >> >>> procedures could be required to extract further information from the >>> SIP request to populate the values of those claims; see Section 9. >>> >>> The "orig" and "dest" arrays may contain identifiers of heterogeneous >>> type; for example, the "orig" array might contain a "tn" claim, while >> >> What is the import of this observation? >> >> Is there something in the specification that appears to constrain the >> choices? > The answer is no, there isn't > something that appears to constrain the choices, but implementers > might be tempted to think that a call to a telephone number always > comes from a telephone number or vice versa, and thus create code > that would not accommodate the heterogeneous case. The specification of orig and dest might warrant a comment highlighting the opportunity for variety. A document discussing implementation and use might warrant some similar commentary. But there is not compelling reason for having the commentary here. >> >>> the "dest" contains a "uri" claim. Also note that in some cases, the >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 23] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> "orig" and "dest" arrays might be populated with more than one value. >>> This could for example occur when multiple "dest" identities are >>> specified in a meshed conference. Defining how a SIP implementation >>> would provision multiple originating or destination identities is >>> left as a subject for future specification. >>> >>> After these two JSON objects, the header and the claims, have been >>> constructed, they must each be hashed per [I-D.ietf-stir-passport] >>> Section 3.3. The signed value of those concatenated hashes then >> >> Except that Passport Section 3.3 says nothing more than: >> >> The signature of the PASSporT is created as specified by JWS using >> the private key corresponding to the X.509 public key certificate >> referenced by the "x5u" header parameter. >> >> and that doesn't look like an implementable specification to me. > Indeed, Section 3.3 just > defers to JWS, as the part that reads "as specified by JWS" should > indicate. So stir-passport just passes the buck - but surely that's > what stir-passport should do, albeit it should do so with a bit more > precision. I won't disagree that this could be beefed up in > stir-passport, but I think rfc4474bis should defer to the > stir-passport text. Because two levels of indirection always helps reader comprehension. And the text here refers to hashing, not signing, which is what the passport section says it is about... >> >>> becomes the signed-identity-string of the Identity header. The >>> hashing and signing algorithm is specified by the 'alg' parameter of >>> the Identity header and the mirrored "alg" parameter of PASSporT. >>> This specification inherits from the PASSporT specification one value >>> for the 'alg' parameter: 'ES256', as defined in [RFC7519], which >>> connotes an ECDSA P-256 digital signature. All implementations of >>> this specification MUST support the required signing algorithms of >>> PASSporT. >>> >>> The complete form of the Identity header will therefore look like the >>> following example: >>> >>> Identity: >>> "sv5CTo05KqpSmtHt3dcEiO/1CWTSZtnG3iV+1nmurLXV/HmtyNS7Ltrg9dlxkWzo >>> eU7d7OV8HweTTDobV3itTmgPwCFjaEmMyEI3d7SyN21yNDo2ER/Ovgtw0Lu5csIp >>> pPqOg1uXndzHbG7mR6Rl9BnUhHufVRbp51Mn3w0gfUs="; \ >>> info=;alg=ES256 >> >> It would be quite a bit more helpful to have a detail, incremental >> example that shows how each of the bits are created and then assembled. > We plan to have a separate spec to > do that, actually. >> >>> In a departure from JWT practice, the SIP usage of PASSporT MAY NOT >>> include the base64 encoded version of the JSON objects in the >> >> JWT normally calls for including the encoded version of JSON objects in >> the Identity header (field)? >> >> Really, it isn't clear what the exact exception is. If citing this is >> that important, please make the details clear including appropriate >> citations, such as to the relevant part of the JWT spec. > 8 Exactly how radical the "departure from JWT practice" at the end of > Section 8 was a recent subject of working group discussion, in light > of varying interpretations of the JWS RFC (especially Appendix F on > "Detatched Content"). Here the review is of course correct when it > points out the unlikelihood that "JWT normally calls for including > the encoded version of JSON objects in the Identity header (field)?" > Our interpretation of JWT and JWS was much of what we discussed at > the last meeting, and we expect that stir-passport will be crisper on > this point. There may be some rfc4474bis text that falls out from > that, we'll see. >> >>> Identity header: only the signature component of the PASSporT is >>> REQUIRED. Optionally, as a debugging measure or optimization, the >>> base64 encoded concatenation of the JSON header and claims may be >>> included as the value of a "canon" parameter of the Identity header. >>> Note that this may be lengthy string. >>> >>> 9. Extensibility >>> >>> For the extensibility of baseline PASSporT with now claims, see >>> [I-D.ietf-stir-passport] Section 4. >> >> "with now claims"? {{ No response from Jon. }} >> And what is the benefit of having this directive? > the beginning of > Section 9 gamely notes that the extensibility of PASSporT object is > covered in Section 4 of stir-passport. The benefit of having this > directive is that it directs you to the place where extensibility of > PASSporT objects is covered. So the idea motivating the text here is that a reader having a question about extensibility of passport won't naturally think of looking at the passport spec? >>> >>> As future requirements may warrant increasing the scope of the >>> Identity mechanism, this specification defines an optional "ppt" >>> parameter of the Identity header, which mirrors the "ppt" header key >> >> The term 'header key' does not occur in the Passport specifiction. >> Perhaps this is meant to refer to that doc's section 4.1 header parameter? {{ No response from Jon. }} >> >>> in PASSporT. The "ppt" parameter value MUST consist of a token >>> containing an extension specification, which denotes an extended set >>> of one or more signed claims per the type extensibility mechanism >>> specified in [I-D.ietf-stir-passport]. >> >> So they will only be able to use one extension? >> >> Also, what is the utility of having this information in the SIP Identity >> header field? > the latter presumably is asking why have "ppt" > as a parameter of Identity rather than just reading it from the JOSE > header of the PASSporT object. The answer to the second is that it is > necessary for verification services, as in the absence of "canon," > that is the only indication present that an extension is in use (and > "canon", per the last paragraph here, is required only if the new > claims cover elements not in the SIP request). Even when "canon" does > appear, it is also a nice processing optimization, as the verifier > only needs to read this parameter to know whether or not the header > is supported, it doesn't have to crack the object open. To the first > question: yes, we are currently thinking that each Identity header > will contain a PASSporT object with at most one extension. This is > mostly to keep it simple here at the start. We have played around > with a few alternative models, but this is the one that stuck. The text here contains normative language about ppt here, rather than where ppt is specified. Neither of the already-asked questions were answered. The 'presumably' interpretation is incorrect. The point behind the second question is that I had not understand that ppt is a way of invoking a pre-registered configuration profile for STIR (or is it for Passport)? I also don't see an IANA registered section for the needed ppt registry. >>> Peterson, et al. Expires January 8, 2017 [Page 24] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> An authentication service cannot assume that verifiers will >>> understand any given extension. Verifiers that do support an >>> extension may then trigger appropriate application-level behavior in >>> the presence of an extension; authors of extensions should provide >>> appropriate extension-specific guidance to application developers on >>> this point. >> >> This is likely redundant information. > This calls out a block of informative text in > a section dedicated to extensibility, that, although reflected in the > normative behavior of the authentication and verification services in > Section 5, nonetheless merits a reminder. >> >>> >>> If any claim in an extension contains a JSON value that does not >>> correspond to any field of the SIP request, but then the optional >>> "canon" parameter MUST be used for the Identity header containing >>> that extension. >> >> If...but then appears to be a non-sequitor or incompletely formulated >> sentence. {{ No response from Jon. }} >> >>> >>> 10. Backwards Compatibililty with RFC4474 >> >> Delete this section. > It is a bit hard > to see that argument in light of the fact that the Identity header, > the associated response codes, the concepts of the authentication and > verification service, and many other related elements were present in > RFC4474. Consider efficacy. No one benefits from the discussion of the previous document, because it has no installed operational base. >> >>> This specification introduces several significant changes from the >>> RFC4474 version of the Identity header. However, due to the problems >>> enumerated in [I-D.rosenberg-sip-rfc4474-concerns], it is not >>> believed that the original Identity header has seen any deployment, >>> or even implementation in deployed products. >>> >>> As such, this mechanism contains no provisions for signatures >>> generated with this specification to work with RFC4474-compliant >>> implementations, nor any related backwards-compatibility provisions. >>> Hypothetically, were an RFC4474-compliant implementation to receive >>> messages containing this revised version of the Identity header, it >>> would likely fail the request due to the absence of an Identity-Info >>> header with a 436 response code. Implementations of this >>> specification, for debugging purposes, might interpret a 436 with a >>> reason phrase of "Bad Identity-Info" as an indication that the >>> request has failed because it reached a (hypothetical) >>> RFC4474-compliant verification service. >> >> In fact there is so little overlap of substantive text, this really is >> an entirely new document and not a bis. {{ No response from Jon. }} >> >>> 11. Privacy Considerations >>> >>> The purpose of this mechanism is to provide a strong identification >> >> I think the usual terms are 'strong authentication' or 'strong security' >> (though 'security' has no clear technical meaning.) 'Strong >> identification' appears to have no common meaning. > I think it has a > common meaning of being a strong identification of the originator. > This isn't a term of art. Correct. But while a word like 'strong' is likely to evokes useful marketing emotion, it is unlikely to have a technical meaning that is clear and consistent across readers. This being a specification rather than a sales brochure, such effects should be concerning. >>> of the originator of a SIP request, specifically a cryptographic >>> assurance that an authority asserts the originator can claim the URI >>> given in the From header field. This URI may contain a variety of >>> personally identifying information, including the name of a human >>> being, their place of work or service provider, and possibly further >>> details. The intrinsic privacy risks associated with that URI are, >>> however, no different from those of baseline SIP. Per the guidance >>> in [RFC6973], implementers should make users aware of the privacy >>> trade-off of providing secure identity. >>> >>> The identity mechanism presented in this document is compatible with >>> the standard SIP practices for privacy described in [RFC3323]. A SIP >>> proxy server can act both as a privacy service and as an >> >> I think that I don't know what it means to be a 'privacy service'. What >> functionality does this reference here and how is the reader to know? > Perhaps by looking at the prior sentence, which refers to "the > standard SIP practices for privacy described in [RFC3323]". The > abstract of that specification indicates that it is where a "privacy > service" is defined. It is not a stretch to expect that an interested > reader would make this deduction. [$] Except that a term like "a privacy service" surprisingly is read as referring to, well, you know. A service. A thing that provides service. It does not refer to some practices within some other service. The term is introduced without explanation and with an intuitive, and a denotational, meaning that is simply wrong. >> >>> >>> >>> >>> Peterson, et al. Expires January 8, 2017 [Page 25] >>> >>> >>> Internet-Draft SIP Identity July 2016 >>> >>> >>> authentication service. Since a user agent can provide any From >>> header field value that the authentication service is willing to >>> authorize, there is no reason why private SIP URIs that contain >>> legitimate domains (e.g., sip:anonymous@example.com) cannot be signed >> >> This sentence sounds as if it is signaling an important point, but the >> text does not make clear what that import is. My guess is that it needs >> to be preceded by a sentence that explains what problem the reader might >> think exists. Then this text explains that it doesn't. > The preceding sentence notes that a certain type of SIP intermediary, > a proxy server, can act as both an authentication service and a > privacy service. The preceding paragraph gave some indication of the > nature of the personal information that might be revealed by the > identity asserted in a SIP request, which could include "the name of > a human being, their place of work or service provider, and possibly > further details." So we've established that there is a certain > tension between optimizing for privacy and asserting identity. So, > when the current sentence explains that private SIP URIs could be > signed by an authentication service, it is perhaps saying something > counterintuitive. I'm not sure this is an important point, so much as > perhaps a non-obvious one. I think its import is obvious, despite the > reviewer's bafflement. Having re-read the original text a few times and the response here a few times, I will unfortunately have to say that none of it accomplishes the apparent goal. That is, I'm not understanding the issue being addressed nor the meaning of what is intended to address it. Again, I'm sure no one else will suffer this comprehension failure. >>> by an authentication service. The construction of the Identity >>> header is the same for private URIs as it is for any other sort of >> >> How is that a privacy matter? > the review counters, perhaps questioning why > this text appears in a section about privacy, or how it relates to > privacy. It relates to privacy because it is making a statement about > private URIs from RFC3323. >> >>> URIs. Similar practices could be used to support opportunistic >>> signing of SIP requests for UA-integrated authentications services >>> with self-signed certificates, though that is outside the scope of >>> this specification and is left as a matter for future investigation. >>> >>> Note, however, that even when using anonymous SIP URIs, an >>> authentication service must possess a certificate corresponding to >>> the host portion of the addr-spec of the From header field of the >> >> The 'however' does not follow any statement that it matches against. >> Again, there's no stage that has been set, for which this resolves a >> concern. > 11 The review objects to the presence of "however" in a sentence that > will ultimately explain that you can't have a certificate associated > with an invalid domain name like "anonymous.invalid", which is > recommended for use in RFC3323. The "however" distinguishes that you > can't have an authentication service sign these URIs like you can > URIs for valid domains like "anonymous.example.com". Since the review > requests that we cite where "anonymous.invalid" is documented, that > would be RFC3323. Which is already cited here. As its last bit of > wordsmithing, the review finally objects to the use of "like" in the > construction "using domains like 'anonymous.invalid'". "how is one to > tell what other domains are 'like it?" Well, the important property > such domains would have is that they have invalid domain names, > presumably (though not exclusively) in the .invalid TLD. [$] The response mostly makes the case for why the opening 'however' is incorrect. The word is a connector with something said immediately before, not immediately after. That is, correct: a, however b. Incorrect: however b, a. Again: there is no established context to which the 'however' is responding. >>> request; accordingly, using domains like 'anonymous.invalid' will not >> >> if this is actually a domain value that is used, please cite where it is >> documented. For that matter, how is one to tell what other domains are >> 'like' it? If the string isn't in actual use then why doesn't it use >> the usual RFC choices for an example domain name? >> >> >>> be possible for privacy services that also act as authentication >>> services. The assurance offered by the usage of anonymous URIs with >>> a valid domain portion is "this is a known user in my domain that I >>> have authenticated, but I am keeping its identity private". >> >> ... -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 19 16:26:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7014B12D096 for ; Fri, 19 Aug 2016 16:25:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bbiw.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nnjCCGZm710Y for ; Fri, 19 Aug 2016 16:25:57 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3447B12B016 for ; Fri, 19 Aug 2016 16:25:57 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7JNQ4c2012205 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 19 Aug 2016 16:26:04 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=bbiw.net; s=default; t=1471649165; bh=lkh9XjuRjChA4wlKkAzkw0B/lrh/QTApD9MFdTulAL8=; h=Subject:To:References:From:Cc:Date:In-Reply-To:From; b=FdObRmEdUCofY4dA+FGdQRMtMoZcwpPt9xr2JOUd3f1ImXlMn+1hcBZ8IJVfYxXrp FkbCcA9TdZC91hQqJAmpbrn3Y7zSmsvkFbD4oCpnVBcdypBKLG0xPjBJR7kzAcVR7Q 6gJ8T1cMRBS+ZaVBefQ3Q2x5yNO7U/2fJ7rKnOmc= To: Russ Housley References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <366a7ee0-cce7-4bed-951c-05415676dd91@bbiw.net> Date: Fri, 19 Aug 2016 16:25:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 23:25:58 -0000 Russ, et al, On 8/17/2016 1:52 PM, Russ Housley wrote: > However, WG Last Call is not the time to revisit each decision that > brought the WG to this point. That depends on the nature of the concerns being raised, and it always has. The distinction that has always been made is between engineering aesthetics versus basic flaws. We don't get to reopen an issue if it's really just a matter of preference -- I think semicolons are /so/ much better than forward slashes, we really do have to change the syntax. Wrong. But if someone happens to assess a serious technical flaw -- of the type that includes language like "it won't work" -- it doesn't (and shouldn't) matter when they notice it. How the question of the flaw is resolved might matter, but that's a separate and later issue. > If you are the author of a review that raises a large technical > problem, I ask you to provide a concise description of the problem in > a message of its own. I am trying to separate the discussion of any > such problems from the resolution of other document comments. Speaking of basic flaws, there's a big one with that request. I've put in an enormous amount of effort formulating comments carefully. Twice. You are now requiring me to do even more, for that work to /maybe/ get consideration. That serves as an additional barrier to participation for me. Even without the considerable pattern of abuses, that kind of barrier is artificial and exclusionary, in spite of how reasonable it seems. And there is nothing preventing that extra effort to be done instead by the folk tasked with editing the documents. Or anyone else who is participating. I've offered quite a bit of summary text, along with the detailed text. So anyone actually wishing to engage in serious discussion can easily initiate an email thread for it. I'm going to post one or two, nonetheless, to test the waters. But so far there appears to be little (no?) significant engagement from the general working group to consider the basic issues I've raised. I'll respond to substantive comments -- and already have been -- but absent a change in participant engagement I won't be investing even more speculative energy on this. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 19 16:31:09 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABAEA12D0AB for ; Fri, 19 Aug 2016 16:31:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7f9JnCDdqOGx for ; Fri, 19 Aug 2016 16:31:06 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D5FB12B056 for ; Fri, 19 Aug 2016 16:31:06 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7JNVE6K012376 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 19 Aug 2016 16:31:14 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471649474; bh=ovxurqjnlc5AX8MexC+4wUcdpeKrMvp1wo8zs20kTjo=; h=To:From:Subject:Reply-To:Date:From; b=kTwBXYgJjR+/8cPxYrsL30kV3qXmhkwOd+iT2FCGk3M/6q67TXGi9jZC3eqgpbVhM /Cw7kEBBeMJ0lJm9GMhiCFvBbIhcE1bnOfp1KsMjHZXdwVm754tUnNvytw7a6Td0zO 4q7U97ceESsCXiG6j+JJ+2uls9hQU0AV24R/Ui7E= To: "stir@ietf.org" From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 19 Aug 2016 16:30:52 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Documenting STIR architecture and other basics X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2016 23:31:08 -0000 There is no comprehensive description of the STIR architecture, specifying functional components, specifying the nature of the interactions among them, and specifying the trust relationships that can/must be present. There is no comprehensive definition of terminology that is used. There is also no comprehensive description of overall system usage. The existing drafts -- as well as working group participants -- are vague and/or inconsistent in their architectural references and in their assertions about system behaviors. In terms of participants, it appears that various individuals have specific usage scenarios in mind, but there are inconsistencies among those individuals. Any claim of 'consensus' about such things goes against notes folk have been posting. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 05:05:35 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FAE512B05B for ; Sat, 20 Aug 2016 05:05:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.59 X-Spam-Level: X-Spam-Status: No, score=-2.59 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JkVoQpjLdeE4 for ; Sat, 20 Aug 2016 05:05:31 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7170127077 for ; Sat, 20 Aug 2016 05:05:31 -0700 (PDT) Received: from pps.filterd (m0049459.ppops.net [127.0.0.1]) by m0049459.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KC5MPP029700; Sat, 20 Aug 2016 08:05:30 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049459.ppops.net-00191d01. with ESMTP id 24xpg4thc7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 08:05:30 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KC5QXE001758; Sat, 20 Aug 2016 08:05:27 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KC5Ha1001586 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 08:05:22 -0400 Received: from MISOUT7MSGHUBAF.ITServices.sbc.com (MISOUT7MSGHUBAF.itservices.sbc.com [130.9.129.150]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 12:05:07 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAF.ITServices.sbc.com ([130.9.129.150]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 08:05:07 -0400 From: "DOLLY, MARTIN C" To: "tony@yaanatech.com" Thread-Topic: [stir] Robocall Strike Force Thread-Index: AQHR+lf0Ed/hh9UbOUG3iSxY8YLToqBRBFIAgAC1LRA= Date: Sat, 20 Aug 2016 12:05:06 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.216.163] Content-Type: multipart/alternative; boundary="_000_E42CCDDA6722744CB241677169E836563F625B9AMISOUT7MSGUSRDB_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200174 Archived-At: Cc: IETF STIR Mail List , Paul Najarian , "Calme, Jim \(EXT - US\)" Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 12:05:34 -0000 --_000_E42CCDDA6722744CB241677169E836563F625B9AMISOUT7MSGUSRDB_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Tony, For deployment in the USA, this ITU work would be totally useless. The ATIS - SIP Forum is has a profile of the IETF STIR RFC drafts in the SH= AKEN Framework document. Further, SHAKEN telecom industry framework - Signature-based Handling of As= serted Information using Tokens 1. Defines the architecture and NNI dependencies around the usage of t= he PASSporT and 4474bis based framework 2. Defines the security model around management and usage of certifica= tes used to sign and assert caller identity information In addition, there is a Display Framework document, that defines the requir= ements for signaling the verification information from the network to the u= ser device and the requirements for what is displayed on the user device in= dependent of technology. Service Requirements to support the above is being brought into the 3GPP SA= 1 meeting in San Francisco next week, 8/22-26 (Being led by Greg Schumacher= , Sprint). I will be bring in a discussion paper and CRs into the October CT1 meeting = in China with the support of Nokia and Ericsson (and hopefully the other US= A companies). WRT display on the user device, there will be a combination of vendors get= ting requirements based on the ATIS-SIP Forum Display Framework given to th= em as part of ecosystem participation in the FCC Strike Force and/or direct= requirements from carriers. In addition, further documentation to in GSMA,= Cable Labs, etc... specifications may/will occur. Up to now, the coordination has been with the ATIS-SIP Forum co-chairs/lead= ers and moving forward with the FCC Strike Force Authentication Committee (= co-chairs Chris Wendt and myself, so there the transition should be seamles= s) With the above work plan I do not see a role for the ITU on the Caller ID S= poofing. Regards, Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com From: Tony Rutkowski [mailto:tony@yaanatech.com] Sent: Friday, August 19, 2016 4:48 PM To: DOLLY, MARTIN C Cc: IETF STIR Mail List ; Paul Najarian Subject: Re: [stir] Robocall Strike Force Hi Martin et al., It is worth noting that for the upcoming SG17 meeting, China's MIIT, China Unicom, and China mobile have proposed a new work item that is substantially related to stir work. Indeed, the proposal contains a useful comprehensive overview of related SDO activities, including stir, and a gap analysis. I expect that the usdel to the meeting would appreciate any views from the Task Force and stir participants on the contribution. In addition, how does stir and the IETF anticipate collaborating with SG17 and the other SDOs going forward? The NWI seems almost certain to get approved, and may well be before WTSA 2016. best, --tony --_000_E42CCDDA6722744CB241677169E836563F625B9AMISOUT7MSGUSRDB_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Tony,

 

For deployment in the USA, this ITU w= ork would be totally useless.

 

The ATIS – SIP Forum is has a p= rofile of the IETF STIR RFC drafts in the SHAKEN Framework document.

Further, SHAKEN telecom industry fram= ework - Signature-based Handling of Asserted Information using Tokens<= /o:p>

1.   = ;   Defines the architecture and = NNI dependencies around the usage of the PASSporT and 4474bis based framewo= rk

2.   = ;   Defines the security model ar= ound management and usage of certificates used to sign and assert caller id= entity information

 

In addition, there is a Display Frame= work document, that defines the requirements for signaling the verification= information from the network to the user device and the requirements for what is displayed on the user device independent = of technology.

 

Service Requirements to support the a= bove is being brought into the 3GPP SA1 meeting in San Francisco next week,= 8/22-26 (Being led by Greg Schumacher, Sprint).

 

I will be bring in a discussion paper= and CRs into the October CT1 meeting in China with the support of Nokia an= d Ericsson (and hopefully the other USA companies).

 

WRT display  on the user device,= there will be a combination of vendors getting requirements based on the A= TIS-SIP Forum Display Framework given to them as part of ecosystem participation in the FCC Strike Force and/or direct requireme= nts from carriers. In addition, further documentation to in GSMA, Cable Lab= s, etc… specifications may/will occur.

 

Up to now, the coordination has been = with the ATIS-SIP Forum co-chairs/leaders and moving forward with the FCC S= trike Force Authentication Committee (co-chairs Chris Wendt and myself, so there the transition should be seamless)

 

With the above work plan I do not see= a role for the ITU on the Caller ID Spoofing.

 

Regards,

 

Martin C. Dolly

Lead Member of Technical Staff

Core & Government/Regulatory Standa= rds

AT&T

Cell: +1.609.903.3360<= /o:p>

Email: md3135@att.com=

 

 

From: Tony Rutkowski [mailto:tony@yaanatech.com]
Sent: Friday, August 19, 2016 4:48 PM
To: DOLLY, MARTIN C <md3135@att.com>
Cc: IETF STIR Mail List <stir@ietf.org>; Paul Najarian <Naj= arianPB@state.gov>
Subject: Re: [stir] Robocall Strike Force

 

Hi Martin et al.,

It is worth noting that for the
upcoming SG17 meeting, China's
MIIT, China Unicom, and China mobile
have proposed a new work item that
is substantially related to stir work. 
Indeed, the proposal contains a useful
comprehensive overview of related
SDO activities, including stir, and
a gap analysis.

I expect that the usdel to the meeting
would appreciate any views from the
Task Force and stir participants on
the contribution.  In addition, how does
stir and the IETF anticipate collaborating
with SG17 and the other SDOs going forward?
The NWI seems almost certain to get approved,
and may well be before WTSA 2016.

best,
--tony

 

--_000_E42CCDDA6722744CB241677169E836563F625B9AMISOUT7MSGUSRDB_-- From nobody Sat Aug 20 07:27:09 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AB8512D758 for ; Sat, 20 Aug 2016 07:27:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YfCVmn3zqTBu for ; Sat, 20 Aug 2016 07:27:06 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id 122D312D531 for ; Sat, 20 Aug 2016 07:27:05 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id AA6FB247; Sat, 20 Aug 2016 14:27:05 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id D23F458090; Sat, 20 Aug 2016 14:26:55 +0000 (UTC) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> To: "DOLLY, MARTIN C" From: Tony Rutkowski Organization: Yaana Technologies Message-ID: Date: Sat, 20 Aug 2016 10:27:03 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------B3F6997D4529B0B04CD33124" Archived-At: Cc: IETF STIR Mail List , Paul Najarian , "Calme, Jim \(EXT - US\)" Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 14:27:07 -0000 This is a multi-part message in MIME format. --------------B3F6997D4529B0B04CD33124 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Hi Martin, Congratulations again. This is a very useful overview. Your providing ample information at this point is especially useful for building a common direction. The "no role" seems like a non-starter. A better approach would seem to engage them and any other fora that emerge as part of the global constellation you paint. NFV is an example where everyone seems to have bought into that model. If nothing else, they can produce TRs that conveys a common model. It's particularly good to see Greg's SA1 engagement. Who is working this into GSMA? ETSI? 3GPP is probably the best global "centroid" there given its size and stature. Lastly, given the CA/B Forum's sector specific expansion of EVcert use, has anyone engaged them concerning the use of EVcerts? --tony On 2016-08-20 8:05 AM, DOLLY, MARTIN C wrote: > With the above work plan I do not see a role for the ITU on the Caller > ID Spoofing. --------------B3F6997D4529B0B04CD33124 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hi Martin,

Congratulations again.

This is a very useful overview. Your providing
ample information at this point is especially
useful for building a common direction.

The "no role" seems like a non-starter. A better
approach would seem to engage them and any
other fora that emerge as part of the global
constellation you paint. NFV is an example
where everyone seems to have bought into
that model. If nothing else, they can produce
TRs that conveys a common model.

It's particularly good to see Greg's SA1
engagement. Who is working this into GSMA?
ETSI? 3GPP is probably the best global "centroid"
there given its size and stature.

Lastly, given the CA/B Forum's sector
specific expansion of EVcert use, has anyone
engaged them concerning the use of EVcerts?

--tony




On 2016-08-20 8:05 AM, DOLLY, MARTIN C wrote:
With the above work plan I do not see a role for the ITU on the Caller ID Spoofing.

--------------B3F6997D4529B0B04CD33124-- From nobody Sat Aug 20 07:42:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4571512D5F6 for ; Sat, 20 Aug 2016 07:42:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.619 X-Spam-Level: X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nxo7bd8uhq56 for ; Sat, 20 Aug 2016 07:42:40 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEF9F12D11C for ; Sat, 20 Aug 2016 07:42:40 -0700 (PDT) Received: from pps.filterd (m0049295.ppops.net [127.0.0.1]) by m0049295.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KEcsY0005719; Sat, 20 Aug 2016 10:42:40 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049295.ppops.net-00191d01. with ESMTP id 24xrfdgtm6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 10:42:39 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KEgc2s011578; Sat, 20 Aug 2016 10:42:38 -0400 Received: from mlpi409.sfdc.sbc.com (mlpi409.sfdc.sbc.com [130.9.128.241]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KEgLJw011424 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 10:42:23 -0400 Received: from MISOUT7MSGHUBAG.ITServices.sbc.com (MISOUT7MSGHUBAG.itservices.sbc.com [130.9.129.151]) by mlpi409.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 14:42:04 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAG.ITServices.sbc.com ([130.9.129.151]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 10:42:03 -0400 From: "DOLLY, MARTIN C" To: "tony@yaanatech.com" Thread-Topic: [stir] Robocall Strike Force Thread-Index: AQHR+lf0Ed/hh9UbOUG3iSxY8YLToqBRBFIAgAC1LRCAAHK2gP//wSIT Date: Sat, 20 Aug 2016 14:42:02 +0000 Message-ID: <7CF15A14-68DC-41D8-B795-9C25FF8890D1@att.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7CF15A1468DC41D8B7959C25FF8890D1attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200202 Archived-At: Cc: IETF STIR Mail List , Paul Najarian , "Calme, Jim \(EXT - US\)" Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 14:42:42 -0000 --_000_7CF15A1468DC41D8B7959C25FF8890D1attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Let's take off STIR list for follow on discussions Reply later today Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 20, 2016, at 10:27 AM, Tony Rutkowski > wrote: Hi Martin, Congratulations again. This is a very useful overview. Your providing ample information at this point is especially useful for building a common direction. The "no role" seems like a non-starter. A better approach would seem to engage them and any other fora that emerge as part of the global constellation you paint. NFV is an example where everyone seems to have bought into that model. If nothing else, they can produce TRs that conveys a common model. It's particularly good to see Greg's SA1 engagement. Who is working this into GSMA? ETSI? 3GPP is probably the best global "centroid" there given its size and stature. Lastly, given the CA/B Forum's sector specific expansion of EVcert use, has anyone engaged them concerning the use of EVcerts? --tony On 2016-08-20 8:05 AM, DOLLY, MARTIN C wrote: With the above work plan I do not see a role for the ITU on the Caller ID S= poofing. --_000_7CF15A1468DC41D8B7959C25FF8890D1attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Let's take off STIR list for follow on discussions

Reply later today

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 20, 2016, at 10:27 AM, Tony Rutkowski <tony@yaanatech.com> wrote:

Hi Martin,

Congratulations again.

This is a very useful overview.  Your providing
ample information at this point is especially
useful for building a common direction.

The "no role" seems like a non-starter.    A bette= r
approach would seem to engage them and any
other fora that emerge as part of the global
constellation you paint.  NFV is an example
where everyone seems to have bought into
that model.  If nothing else, they can produce
TRs that conveys a common model.

It's particularly good to see Greg's SA1
engagement.  Who is working this into GSMA?
ETSI?  3GPP is probably the best global "centroid"
there given its size and stature.

Lastly, given the CA/B Forum's sector
specific expansion of EVcert use, has anyone
engaged them concerning the use of EVcerts?

--tony




On 2016-08-20 8:05 AM, DOLLY, MARTIN C wrote= :
With the above work plan I do not see a role for the ITU on = the Caller ID Spoofing.

--_000_7CF15A1468DC41D8B7959C25FF8890D1attcom_-- From nobody Sat Aug 20 08:18:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EB3D12D86C for ; Sat, 20 Aug 2016 08:17:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PAz7k-soGPfe for ; Sat, 20 Aug 2016 08:17:57 -0700 (PDT) Received: from resqmta-ch2-07v.sys.comcast.net (resqmta-ch2-07v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B976F12D870 for ; Sat, 20 Aug 2016 08:17:55 -0700 (PDT) Received: from resomta-ch2-08v.sys.comcast.net ([69.252.207.104]) by resqmta-ch2-07v.sys.comcast.net with SMTP id b81TbW1FZff8qb81zbghCU; Sat, 20 Aug 2016 15:17:55 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-08v.sys.comcast.net with SMTP id b81yb7l51eKs6b81ybD02D; Sat, 20 Aug 2016 15:17:55 +0000 To: stir@ietf.org References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> From: Paul Kyzivat Message-ID: Date: Sat, 20 Aug 2016 11:17:52 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfJIXP6crlRaZGLEw+7bN6uERHV2hZ71GU3BNTAwZe9ipY0aHvyPnAI15S/SECBVtydNjUkjUSy8gZ1lT8gb/kNhDHGLSvrsT8H63X0W6MrizCHraHQQY oC/O4xjWFweJVe+RSqsLta8Jvk3k1eIwaMH5Tu4DpRbYvvAm1x9zSqlq/dJcrn2+85Zo8mYdPNhS2Q== Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 15:17:59 -0000 Martin, Are these documents (both the SHAKEN stuff and the Display Framework) publicly available? I looked on the sip forum web site but didn't find them. Thanks, Paul On 8/20/16 8:05 AM, DOLLY, MARTIN C wrote: > Tony, > > > > For deployment in the USA, this ITU work would be totally useless. > > > > The ATIS SIP Forum is has a profile of the IETF STIR RFC drafts in the > SHAKEN Framework document. > > Further, SHAKEN telecom industry framework - Signature-based Handling of > Asserted Information using Tokens > > 1. Defines the architecture and NNI dependencies around the usage > of the PASSporT and 4474bis based framework > > 2. Defines the security model around management and usage of > certificates used to sign and assert caller identity information > > > > In addition, there is a Display Framework document, that defines the > requirements for signaling the verification information from the network > to the user device and the requirements for what is displayed on the > user device independent of technology. > > > > Service Requirements to support the above is being brought into the 3GPP > SA1 meeting in San Francisco next week, 8/22-26 (Being led by Greg > Schumacher, Sprint). > > > > I will be bring in a discussion paper and CRs into the October CT1 > meeting in China with the support of Nokia and Ericsson (and hopefully > the other USA companies). > > > > WRT display on the user device, there will be a combination of vendors > getting requirements based on the ATIS-SIP Forum Display Framework given > to them as part of ecosystem participation in the FCC Strike Force > and/or direct requirements from carriers. In addition, further > documentation to in GSMA, Cable Labs, etc specifications may/will occur. > > > > Up to now, the coordination has been with the ATIS-SIP Forum > co-chairs/leaders and moving forward with the FCC Strike Force > Authentication Committee (co-chairs Chris Wendt and myself, so there the > transition should be seamless) > > > > With the above work plan I do not see a role for the ITU on the Caller > ID Spoofing. > > > > Regards, > > > > *Martin C. Dolly* > > Lead Member of Technical Staff > > Core & Government/Regulatory Standards > > AT&T > > Cell: +1.609.903.3360 > > Email: _md3135@att.com _ > > > > > > *From:*Tony Rutkowski [mailto:tony@yaanatech.com] > *Sent:* Friday, August 19, 2016 4:48 PM > *To:* DOLLY, MARTIN C > *Cc:* IETF STIR Mail List ; Paul Najarian > > *Subject:* Re: [stir] Robocall Strike Force > > > > Hi Martin et al., > > It is worth noting that for the > upcoming SG17 meeting, China's > MIIT, China Unicom, and China mobile > have proposed a new work item that > is substantially related to stir work. > Indeed, the proposal contains a useful > comprehensive overview of related > SDO activities, including stir, and > a gap analysis. > > I expect that the usdel to the meeting > would appreciate any views from the > Task Force and stir participants on > the contribution. In addition, how does > stir and the IETF anticipate collaborating > with SG17 and the other SDOs going forward? > The NWI seems almost certain to get approved, > and may well be before WTSA 2016. > > best, > --tony > > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Sat Aug 20 08:42:12 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A906D12D872 for ; Sat, 20 Aug 2016 08:42:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r3t9WkelyYp9 for ; Sat, 20 Aug 2016 08:42:09 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A3DA12D77A for ; Sat, 20 Aug 2016 08:42:09 -0700 (PDT) Received: from pps.filterd (m0049297.ppops.net [127.0.0.1]) by m0049297.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KFY1Ah017423; Sat, 20 Aug 2016 11:42:08 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049297.ppops.net-00191d01. with ESMTP id 24xs2a93e2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 11:42:07 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KFg6je026205; Sat, 20 Aug 2016 11:42:06 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KFfwTP026159 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 11:42:03 -0400 Received: from MISOUT7MSGHUBAC.ITServices.sbc.com (MISOUT7MSGHUBAC.itservices.sbc.com [130.9.129.147]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 15:41:46 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAC.ITServices.sbc.com ([130.9.129.147]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 11:41:46 -0400 From: "DOLLY, MARTIN C" To: Paul Kyzivat , "stir@ietf.org" Thread-Topic: [stir] Robocall Strike Force Thread-Index: AQHR+lf0Ed/hh9UbOUG3iSxY8YLToqBRBFIAgAC1LRCAAIDoAP//wyaQ Date: Sat, 20 Aug 2016 15:41:46 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.216.163] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200212 Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 15:42:11 -0000 Being it is joint effort of ATIS and SIP Forum, if you are a member of eith= er, yes. SIP Forum is quite open. But documents are about to be updated. -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat Sent: Saturday, August 20, 2016 11:18 AM To: stir@ietf.org Subject: Re: [stir] Robocall Strike Force Martin, Are these documents (both the SHAKEN stuff and the Display Framework) publi= cly available? I looked on the sip forum web site but didn't find them. Thanks, Paul On 8/20/16 8:05 AM, DOLLY, MARTIN C wrote: > Tony, > > > > For deployment in the USA, this ITU work would be totally useless. > > > > The ATIS - SIP Forum is has a profile of the IETF STIR RFC drafts in=20 > the SHAKEN Framework document. > > Further, SHAKEN telecom industry framework - Signature-based Handling=20 > of Asserted Information using Tokens > > 1. Defines the architecture and NNI dependencies around the usage > of the PASSporT and 4474bis based framework > > 2. Defines the security model around management and usage of > certificates used to sign and assert caller identity information > > > > In addition, there is a Display Framework document, that defines the=20 > requirements for signaling the verification information from the=20 > network to the user device and the requirements for what is displayed=20 > on the user device independent of technology. > > > > Service Requirements to support the above is being brought into the=20 > 3GPP > SA1 meeting in San Francisco next week, 8/22-26 (Being led by Greg=20 > Schumacher, Sprint). > > > > I will be bring in a discussion paper and CRs into the October CT1=20 > meeting in China with the support of Nokia and Ericsson (and hopefully=20 > the other USA companies). > > > > WRT display on the user device, there will be a combination of=20 > vendors getting requirements based on the ATIS-SIP Forum Display=20 > Framework given to them as part of ecosystem participation in the FCC=20 > Strike Force and/or direct requirements from carriers. In addition,=20 > further documentation to in GSMA, Cable Labs, etc... specifications may/w= ill occur. > > > > Up to now, the coordination has been with the ATIS-SIP Forum=20 > co-chairs/leaders and moving forward with the FCC Strike Force=20 > Authentication Committee (co-chairs Chris Wendt and myself, so there=20 > the transition should be seamless) > > > > With the above work plan I do not see a role for the ITU on the Caller=20 > ID Spoofing. > > > > Regards, > > > > *Martin C. Dolly* > > Lead Member of Technical Staff > > Core & Government/Regulatory Standards > > AT&T > > Cell: +1.609.903.3360 > > Email: _md3135@att.com _ > > > > > > *From:*Tony Rutkowski [mailto:tony@yaanatech.com] > *Sent:* Friday, August 19, 2016 4:48 PM > *To:* DOLLY, MARTIN C > *Cc:* IETF STIR Mail List ; Paul Najarian=20 > > *Subject:* Re: [stir] Robocall Strike Force > > > > Hi Martin et al., > > It is worth noting that for the > upcoming SG17 meeting, China's > MIIT, China Unicom, and China mobile > have proposed a new work item that > is substantially related to stir work. > Indeed, the proposal contains a useful comprehensive overview of=20 > related SDO activities, including stir, and a gap analysis. > > I expect that the usdel to the meeting would appreciate any views from=20 > the Task Force and stir participants on the contribution. In=20 > addition, how does stir and the IETF anticipate collaborating with=20 > SG17 and the other SDOs going forward? > The NWI seems almost certain to get approved, and may well be before=20 > WTSA 2016. > > best, > --tony > > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Sat Aug 20 09:56:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C68912B020 for ; Sat, 20 Aug 2016 09:56:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.1 X-Spam-Level: X-Spam-Status: No, score=-0.1 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id edMKPlaM-27D for ; Sat, 20 Aug 2016 09:56:51 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 5437E12B00F for ; Sat, 20 Aug 2016 09:56:51 -0700 (PDT) Received: (qmail 28707 invoked by uid 0); 20 Aug 2016 16:56:51 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy2.mail.unifiedlayer.com with SMTP; 20 Aug 2016 16:56:51 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id ZUrn1t00P1MNPNq01UrqYW; Sat, 20 Aug 2016 10:51:51 -0600 X-Authority-Analysis: v=2.1 cv=PJecp5aC c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=zQP7CpKOAAAA:8 a=scBmumm3AAAA:8 a=81nxrH-BTWoPbMAG-msA:9 a=9LMh5HJJY5-a3mbV:21 a=hP38Mnj1QG746jLV:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=qM39cor4HRgA:10 a=K2lU_Ab98eoA:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=obGFCI3_7AGB19sD6zJV:22 a=ef56qr_8hkesV0SKvPxj:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=EoWlJruY4DR8kra2UZWrhogMQoD2lk1XTuSk+6VkbYo=; b=IhfRE8mmX9drtIWtVIMG4Umel0 eCSIQ699xldK8VL8hFD5vm9LwY4fWf93a2hbRCAq1DEYt/Zg6D8iU0NOWEvED6WHpZKi0VM7Qf+Zu 1vjcNzteR6Jggnb/3a58TXYd8; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:51226 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bb9Up-0002k6-7x; Sat, 20 Aug 2016 10:51:47 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sat, 20 Aug 2016 12:51:45 -0400 From: Richard Shockey To: "DOLLY, MARTIN C" , Paul Kyzivat , "stir@ietf.org" Message-ID: <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> Thread-Topic: [stir] Robocall Strike Force References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bb9Up-0002k6-7x X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:51226 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 16:56:54 -0000 +1 to Martin=E2=80=99s comments. The ATIS/SIP Forum NNI TF is going to meet next = week to get a debrief on the Strike Force meeting and review the ongoing wor= k plan and documentation. There are quite a few moving parts here but if this WG can move forward wit= hout any new roadblocks we should make considerable progress. Remember this is not just protocol. There will be protocol police here. C= hairman Wheeler made that abundantly clear. This is a highly regulated indus= try. One of the SF groups is specially chartered to look at the regulatory, = legislative and law enforcement constructs surrounding implementation.=20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 On 8/20/16, 11:41 AM, "stir on behalf of DOLLY, MARTIN C" wrote: Being it is joint effort of ATIS and SIP Forum, if you are a member of = either, yes. SIP Forum is quite open. But documents are about to be updated. =20 -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat Sent: Saturday, August 20, 2016 11:18 AM To: stir@ietf.org Subject: Re: [stir] Robocall Strike Force =20 Martin, =20 Are these documents (both the SHAKEN stuff and the Display Framework) p= ublicly available? =20 I looked on the sip forum web site but didn't find them. =20 Thanks, Paul =20 On 8/20/16 8:05 AM, DOLLY, MARTIN C wrote: > Tony, > > > > For deployment in the USA, this ITU work would be totally useless. > > > > The ATIS - SIP Forum is has a profile of the IETF STIR RFC drafts in=20 > the SHAKEN Framework document. > > Further, SHAKEN telecom industry framework - Signature-based Handling= =20 > of Asserted Information using Tokens > > 1. Defines the architecture and NNI dependencies around the usag= e > of the PASSporT and 4474bis based framework > > 2. Defines the security model around management and usage of > certificates used to sign and assert caller identity information > > > > In addition, there is a Display Framework document, that defines the=20 > requirements for signaling the verification information from the=20 > network to the user device and the requirements for what is displayed= =20 > on the user device independent of technology. > > > > Service Requirements to support the above is being brought into the=20 > 3GPP > SA1 meeting in San Francisco next week, 8/22-26 (Being led by Greg=20 > Schumacher, Sprint). > > > > I will be bring in a discussion paper and CRs into the October CT1=20 > meeting in China with the support of Nokia and Ericsson (and hopefull= y=20 > the other USA companies). > > > > WRT display on the user device, there will be a combination of=20 > vendors getting requirements based on the ATIS-SIP Forum Display=20 > Framework given to them as part of ecosystem participation in the FCC= =20 > Strike Force and/or direct requirements from carriers. In addition,=20 > further documentation to in GSMA, Cable Labs, etc... specifications m= ay/will occur. > > > > Up to now, the coordination has been with the ATIS-SIP Forum=20 > co-chairs/leaders and moving forward with the FCC Strike Force=20 > Authentication Committee (co-chairs Chris Wendt and myself, so there=20 > the transition should be seamless) > > > > With the above work plan I do not see a role for the ITU on the Calle= r=20 > ID Spoofing. > > > > Regards, > > > > *Martin C. Dolly* > > Lead Member of Technical Staff > > Core & Government/Regulatory Standards > > AT&T > > Cell: +1.609.903.3360 > > Email: _md3135@att.com _ > > > > > > *From:*Tony Rutkowski [mailto:tony@yaanatech.com] > *Sent:* Friday, August 19, 2016 4:48 PM > *To:* DOLLY, MARTIN C > *Cc:* IETF STIR Mail List ; Paul Najarian=20 > > *Subject:* Re: [stir] Robocall Strike Force > > > > Hi Martin et al., > > It is worth noting that for the > upcoming SG17 meeting, China's > MIIT, China Unicom, and China mobile > have proposed a new work item that > is substantially related to stir work. > Indeed, the proposal contains a useful comprehensive overview of=20 > related SDO activities, including stir, and a gap analysis. > > I expect that the usdel to the meeting would appreciate any views fro= m=20 > the Task Force and stir participants on the contribution. In=20 > addition, how does stir and the IETF anticipate collaborating with=20 > SG17 and the other SDOs going forward? > The NWI seems almost certain to get approved, and may well be before=20 > WTSA 2016. > > best, > --tony > > > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Sat Aug 20 11:31:35 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B138812D190 for ; Sat, 20 Aug 2016 11:31:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.183 X-Spam-Level: * X-Spam-Status: No, score=1.183 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id abPNs3lYq20U for ; Sat, 20 Aug 2016 11:31:34 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 270F9128874 for ; Sat, 20 Aug 2016 11:31:34 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KIVe7W027909 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 20 Aug 2016 11:31:41 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471717901; bh=0xU4WHIMIhgNE8BZPNxh+moJDKGDzS4dWQf0QdVqDiM=; h=Subject:To:References:Reply-To:Cc:From:Date:In-Reply-To:From; b=qjnf/g4zmXYmigSIFNwyhjsBmsqfr6gM4X77xXTPCyzPuw/ss1TNzh/lxoT4iil57 EUVZ9tMU2S4dRIkbRVrloe9n/UaKvhcq2HRbUH1Qpwanfv+U7Mpn23GlygQdGXSSvT 3LwYvqMxMhr2v+g25IlXrQ2VGmbV9XKJM46S21n8= To: "DOLLY, MARTIN C" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <85441df1-bd5c-3227-be9d-544db99c0029@dcrocker.net> Date: Sat, 20 Aug 2016 11:31:16 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 18:31:35 -0000 On 8/20/2016 8:41 AM, DOLLY, MARTIN C wrote: > Being it is joint effort of ATIS and SIP Forum, if you are a member of either, yes. SIP Forum is quite open. But documents are about to be updated. Martin, Unless i'm misunderstanding, that actually means no, they are not publicly available? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 11:32:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A84D212D190 for ; Sat, 20 Aug 2016 11:32:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.393 X-Spam-Level: * X-Spam-Status: No, score=1.393 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id emT6g9rRvZRK for ; Sat, 20 Aug 2016 11:32:14 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CED6128874 for ; Sat, 20 Aug 2016 11:32:14 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KIWJ1q027933 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 20 Aug 2016 11:32:19 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471717939; bh=Ddin5PJxUL8ogj4D2NrFnwnEE/ULt1KxWLVOkppmWPY=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=YqHoCNedLmehUY0KKdpAAdcHkBLkN4diq6YBu26UVrbk+3QsDVi4zO9zanyInK0bm hY4GVleTEmnj2ySOgR/rpOPvIZ0YSeVdbA3djKmReFIR3aRHZLG0y722KvNhTDyf4L 6Md1JABYknT6bqslLI6PjL0xLvXOXsrcVlPOynPc= To: Richard Shockey , "DOLLY, MARTIN C" , Paul Kyzivat , "stir@ietf.org" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <6ac924cd-fd70-967d-1345-0b4e623d95a8@dcrocker.net> Date: Sat, 20 Aug 2016 11:31:55 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 18:32:15 -0000 On 8/20/2016 9:51 AM, Richard Shockey wrote: > There will be protocol police here. Any idea who? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 11:36:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C535112D190 for ; Sat, 20 Aug 2016 11:36:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.183 X-Spam-Level: * X-Spam-Status: No, score=1.183 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V1wUpg0RnvCV for ; Sat, 20 Aug 2016 11:36:13 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A286128874 for ; Sat, 20 Aug 2016 11:36:13 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KIaL2A028067 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sat, 20 Aug 2016 11:36:21 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471718182; bh=yccr1st2lCsBBHeEC7xVa6agaM0izLs88qcAEqICjok=; h=To:Reply-To:From:Subject:Date:From; b=jI7XX4iwy4kwXOE8So853Ao+x44wrDGIAdqkqIikEgn1WWO1U55HZbZIJ9LVz18nO ahout8VjgAUMO7BSLyVU6uKO5cTF7RY5dH3BXW8EOq3YWMngFv4AS9djL8cs49QDdh EBeaoRWGDQqj5s8AbliUF6Lv0hq0jbYkGhOslPys= To: "stir@ietf.org" From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> Date: Sat, 20 Aug 2016 11:35:57 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 18:36:13 -0000 While it is possible to write relatively clear descriptions of algorithms using prose, the STIR documents' version of algorithm specifications are quite confusing and, I suspect, sometimes wrong. But the fact that I can't be sure is a mark of the problem. Rewrite them in a pseudo-code. This will tend to produce much clearer explication. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 11:40:47 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF91412D190 for ; Sat, 20 Aug 2016 11:40:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.719 X-Spam-Level: X-Spam-Status: No, score=-0.719 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RxZ3VnUGHgsr for ; Sat, 20 Aug 2016 11:40:44 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 963F9128874 for ; Sat, 20 Aug 2016 11:40:44 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KIcWVD016423; Sat, 20 Aug 2016 14:40:43 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049287.ppops.net-00191d01. with ESMTP id 24xv0e8mj4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 14:40:42 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KIZflG030055; Sat, 20 Aug 2016 14:35:41 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KIZV93029824 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 14:35:33 -0400 Received: from MISOUT7MSGHUBAG.ITServices.sbc.com (MISOUT7MSGHUBAG.itservices.sbc.com [130.9.129.151]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 18:35:14 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAG.ITServices.sbc.com ([130.9.129.151]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 14:35:13 -0400 From: "DOLLY, MARTIN C" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Robocall Strike Force Thread-Index: AQHR+lf0Ed/hh9UbOUG3iSxY8YLToqBRBFIAgAC1LRCAAIDoAP//wyaQgABy4wD//74N2g== Date: Sat, 20 Aug 2016 18:35:13 +0000 Message-ID: <7551C855-D025-4BFC-AFE7-577FA4DDBB49@att.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> , <85441df1-bd5c-3227-be9d-544db99c0029@dcrocker.net> In-Reply-To: <85441df1-bd5c-3227-be9d-544db99c0029@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7551C855D0254BFCAFE7577FA4DDBB49attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200244 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 18:40:46 -0000 --_000_7551C855D0254BFCAFE7577FA4DDBB49attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Correct sir Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 20, 2016, at 2:31 PM, Dave Crocker > wrote: On 8/20/2016 8:41 AM, DOLLY, MARTIN C wrote: Being it is joint effort of ATIS and SIP Forum, if you are a member of eith= er, yes. SIP Forum is quite open. But documents are about to be updated. Martin, Unless i'm misunderstanding, that actually means no, they are not publicly = available? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net --_000_7551C855D0254BFCAFE7577FA4DDBB49attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Correct sir

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 20, 2016, at 2:31 PM, Dave Crocker <dhc@dcrocker.net> wrote:

On 8/20/2016 8:41 AM, DOLLY, MARTIN C wrote:
Being it is joint effort of ATIS and SIP Fo= rum, if you are a member of either, yes. SIP Forum is quite open. But docum= ents are about to be updated.


Martin,

Unless i'm misunderstanding, that actually means no, they are not pub= licly available?

d/

--

 Dave Crocker
 Brandenburg InternetWorking
 bbiw.net
--_000_7551C855D0254BFCAFE7577FA4DDBB49attcom_-- From nobody Sat Aug 20 11:53:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70CEA12D1A3 for ; Sat, 20 Aug 2016 11:53:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.183 X-Spam-Level: * X-Spam-Status: No, score=1.183 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qXhb03Aex8sl for ; Sat, 20 Aug 2016 11:53:34 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8D80128874 for ; Sat, 20 Aug 2016 11:53:34 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KIrgm0028928 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sat, 20 Aug 2016 11:53:43 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471719223; bh=Fjo+u+enuOwf9HX41YMeOz70szmSHuvxuYowDLHEfEA=; h=To:From:Subject:Reply-To:Date:From; b=YEbXgKTHPXl17BuuiJXtVGOJHwZGWxDNZpO7Grt6e68Yh0QCkIaNcOHpYgsBu1h7i haDzsYUGTsrAS0dlPNHKESoz3h3Yzu4fN/1ps+H0taqz3HzNtMW9/+O9EG8t/QSIiu hixh1hg8g/CtiwGwWkQl+x2pXgaKpKzN0YROFj6c= To: "stir@ietf.org" From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Sat, 20 Aug 2016 11:53:19 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 18:53:35 -0000 The current status of the STIR technical specifications for the mechanism(s) to find, obtain, and validate keys is extremely incomplete. This is distinct from the operations and policy issues the build upon the technical specifications. 1. draft-ietf-stir-cert is a discussion piece, not a specification. And, yes, it really is that basic a problem with the document. It has a couple of brief meta-syntax segments intended to be specifications of a couple of things, but even these are inadequately documented, nevermind the rest of the surrounding mechanism(s). 2. CAs and X.509 are problematic. It appears that the group has viewed saying "CA" and "X.509" as sufficient technical detail to fill portion of the system specification that covers finding and validating keys. It doesn't, and not the least of which is because the extant CA usage has a long and storied history of very serious problems. While, yes, there are also examples of their substantive use, they are constrained. For serious reliance on certification semantic, I believe they are only successful in closed systems.[*] Is that the goal for STIR? To the extent that there is an operational target for STIR that is amenable to this track record, it hasn't been documented. 3. STIR's differential handling of SIP addressing, using domain names vs telephone numbers, is confusing at best. It needs to be substantially consolidated and clarified, with clean interfaces to that consolidation, so the rest of the documentation doesn't have to know or care about the difference. d/ [*] Use of certs for the web are famously problematic. First, the only serious reliance on them is to prevent MITM attacks. Second, are all of the operational problems with root CAs. Third are all the times sites do self-signing. -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 11:54:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A249012D1A3 for ; Sat, 20 Aug 2016 11:54:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.7 X-Spam-Level: X-Spam-Status: No, score=-0.7 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1gx908KwJ0da for ; Sat, 20 Aug 2016 11:54:07 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A82D128874 for ; Sat, 20 Aug 2016 11:54:07 -0700 (PDT) Received: from pps.filterd (m0083689.ppops.net [127.0.0.1]) by m0083689.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KImx98046144; Sat, 20 Aug 2016 14:54:04 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0083689.ppops.net-00191d01. with ESMTP id 24xn829jj0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 14:54:04 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KIs2YV014530; Sat, 20 Aug 2016 14:54:03 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KIruXW014446 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 14:54:01 -0400 Received: from MISOUT7MSGHUBAD.ITServices.sbc.com (MISOUT7MSGHUBAD.itservices.sbc.com [130.9.129.148]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 18:53:45 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAD.ITServices.sbc.com ([130.9.129.148]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 14:53:45 -0400 From: "DOLLY, MARTIN C" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Documenting algorithms Thread-Index: AQHR+xHB6IY+A+ovZUaoqSjCi0NO7KBSMjdr Date: Sat, 20 Aug 2016 18:53:45 +0000 Message-ID: References: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> In-Reply-To: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_C6EA512BB7D441B0B7F954E848908463attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200245 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 18:54:08 -0000 --_000_C6EA512BB7D441B0B7F954E848908463attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dave Please be specific on what is wrong sir? Thank you Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 20, 2016, at 2:36 PM, Dave Crocker > wrote: While it is possible to write relatively clear descriptions of algorithms u= sing prose, the STIR documents' version of algorithm specifications are qui= te confusing and, I suspect, sometimes wrong. But the fact that I can't be = sure is a mark of the problem. Rewrite them in a pseudo-code. This will tend to produce much clearer expli= cation. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_C6EA512BB7D441B0B7F954E848908463attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Dave

Please be specific on what is wrong sir?

Thank you

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 20, 2016, at 2:36 PM, Dave Crocker <dhc@dcrocker.net> wrote:

While it is possible to write relatively clear descriptions of a= lgorithms using prose, the STIR documents' version of algorithm specificati= ons are quite confusing and, I suspect, sometimes wrong. But the fact that = I can't be sure is a mark of the problem.

Rewrite them in a pseudo-code. This will tend to produce much clearer= explication.

d/
--

 Dave Crocker
 Brandenburg InternetWorking
 bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_C6EA512BB7D441B0B7F954E848908463attcom_-- From nobody Sat Aug 20 12:00:59 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9FC712D7DC for ; Sat, 20 Aug 2016 12:00:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.183 X-Spam-Level: * X-Spam-Status: No, score=1.183 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PWK4gGfXnVdP for ; Sat, 20 Aug 2016 12:00:56 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F18112D789 for ; Sat, 20 Aug 2016 12:00:53 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KJ105v029241 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 20 Aug 2016 12:01:00 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471719660; bh=QyF1vRO3fRKyq77Z6xC6ssG+Uq1nzA/N8qEGguy0H8E=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=Vo9qqqFgNrk6doAxay/FyeLoaelMm5rwhL/39zzXinI/5UuJts+bNngzlupa2z8tg uwPvM1fL0cS+TO4UxSRU7jLoQakpsdWPcbqE5yNbM+vVwfmBaygktPtXPkKt1dyyDf 3GwKEcQsRfL9klK+PEhPUsm9lTaEfQma1ggkjS5s= To: "DOLLY, MARTIN C" References: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <7a24296e-d959-d317-9081-0096be82a2dc@dcrocker.net> Date: Sat, 20 Aug 2016 12:00:36 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:00:57 -0000 On 8/20/2016 11:53 AM, DOLLY, MARTIN C wrote: > Please be specific on what is wrong sir? Martin, You think "confusing and probably error-prone" isn't specific enough? In that case, ask someone who has technical skills, but no special background in STIR work, to read the texts specifying the algorithms and then ask them to produce some pesudo-code that instantiates it. I think they won't be able to. I know I gave up. That's a basic fail, given the job of that text. This exercise could have a very nice upside: To the extent that I'm wrong, and they /are/ produce pseudo-code that the working group agrees is correct, then please include it in the documents... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 12:15:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49AF912D19B for ; Sat, 20 Aug 2016 12:15:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.7 X-Spam-Level: X-Spam-Status: No, score=-0.7 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SZ-FwYya7Rm1 for ; Sat, 20 Aug 2016 12:15:38 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E95BB12B051 for ; Sat, 20 Aug 2016 12:15:37 -0700 (PDT) Received: from pps.filterd (m0049458.ppops.net [127.0.0.1]) by m0049458.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KJDw8c016809; Sat, 20 Aug 2016 15:15:35 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049458.ppops.net-00191d01. with ESMTP id 24xvmq0h1g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 15:15:34 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KJFXjT010617; Sat, 20 Aug 2016 15:15:34 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KJFG1A010294 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 15:15:22 -0400 Received: from MISOUT7MSGHUBAD.ITServices.sbc.com (MISOUT7MSGHUBAD.itservices.sbc.com [130.9.129.148]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 19:15:08 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAD.ITServices.sbc.com ([130.9.129.148]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 15:15:08 -0400 From: "DOLLY, MARTIN C" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Documenting algorithms Thread-Index: AQHR+xHB6IY+A+ovZUaoqSjCi0NO7KBSMjdrgABE+AD//8EBLw== Date: Sat, 20 Aug 2016 19:15:07 +0000 Message-ID: <6926657C-5F26-4587-9324-7C42F2A37033@att.com> References: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> , <7a24296e-d959-d317-9081-0096be82a2dc@dcrocker.net> In-Reply-To: <7a24296e-d959-d317-9081-0096be82a2dc@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_6926657C5F26458793247C42F2A37033attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200250 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:15:39 -0000 --_000_6926657C5F26458793247C42F2A37033attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dave I am waiting to see an update version that: 1. Provides clear Examples of PAI and FROM 2. Extensibility examples, particularly a scenario of signing for the CgP b= y the originating carrier and signing of RPH by the NS/EP authentication ca= rrier 3. Christer comments addressed I believe this will occur Then SHAKEN handles the rest Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 20, 2016, at 3:00 PM, Dave Crocker > wrote: On 8/20/2016 11:53 AM, DOLLY, MARTIN C wrote: Please be specific on what is wrong sir? Martin, You think "confusing and probably error-prone" isn't specific enough? In that case, ask someone who has technical skills, but no special backgrou= nd in STIR work, to read the texts specifying the algorithms and then ask t= hem to produce some pesudo-code that instantiates it. I think they won't be able to. I know I gave up. That's a basic fail, given the job of that text. This exercise could have a very nice upside: To the extent that I'm wrong,= and they /are/ produce pseudo-code that the working group agrees is correc= t, then please include it in the documents... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net --_000_6926657C5F26458793247C42F2A37033attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Dave

I am waiting to see an update version that:<= /div>
1. Provides clear Examples of PAI and FROM
2. Extensibility examples, particularly a sc= enario of signing for the CgP by the originating carrier and signing of RPH= by the NS/EP authentication carrier
3. Christer comments addressed

I believe this will occur

Then SHAKEN handles the rest

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 20, 2016, at 3:00 PM, Dave Crocker <dhc@dcrocker.net> wrote:

On 8/20/2016 11:53 AM, DOLLY, MARTIN C wrote:
Please be specific on what is wrong sir?


Martin,

You think "confusing and probably error-prone" isn't specif= ic enough?

In that case, ask someone who has technical skills, but no special ba= ckground in STIR work, to read the texts specifying the algorithms and then= ask them to produce some pesudo-code that instantiates it.

I think they won't be able to.  I know I gave up.

That's a basic fail, given the job of that text.

This exercise could have a very nice upside:  To the extent that= I'm wrong, and they /are/ produce pseudo-code that the working group agree= s is correct, then please include it in the documents...


d/
--

 Dave Crocker
 Brandenburg InternetWorking
 bbiw.net
--_000_6926657C5F26458793247C42F2A37033attcom_-- From nobody Sat Aug 20 12:15:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E11A012D190 for ; Sat, 20 Aug 2016 12:15:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.121 X-Spam-Level: X-Spam-Status: No, score=-0.121 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LVjMaTWlhJ7m for ; Sat, 20 Aug 2016 12:15:51 -0700 (PDT) Received: from qproxy5-pub.mail.unifiedlayer.com (qproxy5-pub.mail.unifiedlayer.com [69.89.21.30]) by ietfa.amsl.com (Postfix) with SMTP id 50D2712B051 for ; Sat, 20 Aug 2016 12:15:48 -0700 (PDT) Received: (qmail 10784 invoked by uid 0); 20 Aug 2016 19:15:45 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by qproxy5.mail.unifiedlayer.com with SMTP; 20 Aug 2016 19:15:45 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by CMOut01 with id ZXAh1t00Z1MNPNq01XAkpG; Sat, 20 Aug 2016 13:10:44 -0600 X-Authority-Analysis: v=2.1 cv=FKmImYYs c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=OH-RAJdTuyQvBTNXy_cA:9 a=ch8z3ZX-bfKeTDNO:21 a=u3hMNE3-zj9DMGAk:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date; bh=1PRG5YWPj0gfGU0VmsisnmjZ938Rz368I5l3W08m1p0=; b=oJBxgu+Zuq8gSwAFlaIk2qaVaW czCIXFfkRnLOlxw949Cemmlb8HSvuRDeJ66KIgkMTXa8GgxydKX7mCObfQVsaDhUn1wfvZs3nQewH vFMI55AH4JJt6Q9czMbiKrGAi; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:57950 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bbBfG-0000jR-QM; Sat, 20 Aug 2016 13:10:42 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sat, 20 Aug 2016 15:10:40 -0400 From: Richard Shockey To: , "DOLLY, MARTIN C" , Paul Kyzivat , "stir@ietf.org" Message-ID: <9A43D0C6-9E01-4A06-A4CD-82DD6D823F4B@shockey.us> Thread-Topic: [stir] Robocall Strike Force References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> <6ac924cd-fd70-967d-1345-0b4e623d95a8@dcrocker.net> In-Reply-To: <6ac924cd-fd70-967d-1345-0b4e623d95a8@dcrocker.net> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bbBfG-0000jR-QM X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:57950 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:15:53 -0000 I can think of several US 3 letter agencies with statutory authority. The = FCC being the principal one.=20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 On 8/20/16, 2:31 PM, "stir on behalf of Dave Crocker" wrote: On 8/20/2016 9:51 AM, Richard Shockey wrote: > There will be protocol police here. =20 =20 Any idea who? =20 d/ =20 --=20 =20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Sat Aug 20 12:27:02 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B808512D1A5 for ; Sat, 20 Aug 2016 12:27:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.183 X-Spam-Level: * X-Spam-Status: No, score=1.183 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7xiTGJnU4_GG for ; Sat, 20 Aug 2016 12:27:00 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C9D612B051 for ; Sat, 20 Aug 2016 12:27:00 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KJR6ji031262 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 20 Aug 2016 12:27:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471721227; bh=Sq2+wp/IbczJioLDwtx3h7+ME6iIC9P1QPS6BbdS7X4=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=eUMhPNLCYy9QdEWZpiwUJTH5yp080Irvx9VjxHLdch7aNI91hH3ts+X6FeB8uxgbD 6JInJ4nv+9ZowlT8bohJdQloOwIR8a6TwrH1jBjrYUPHocivxRo2+NeNprBggQ2IFX bNAI6yqSbA4Qt3+JeApR133wdsiEoTxZKXRLInWs= To: "DOLLY, MARTIN C" References: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> <7a24296e-d959-d317-9081-0096be82a2dc@dcrocker.net> <6926657C-5F26-4587-9324-7C42F2A37033@att.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <92bf7c34-1029-e7d9-cbf9-fa60a0dcb12a@dcrocker.net> Date: Sat, 20 Aug 2016 12:26:43 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <6926657C-5F26-4587-9324-7C42F2A37033@att.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:27:01 -0000 On 8/20/2016 12:15 PM, DOLLY, MARTIN C wrote: > 1. Provides clear Examples of PAI and FROM > 2. Extensibility examples, particularly a scenario of signing for the > CgP by the originating carrier and signing of RPH by the NS/EP > authentication carrier > 3. Christer comments addressed > > I believe this will occur > > Then SHAKEN handles the rest How do you think Shaken will? Here's why it won't: Nothing in your list fixes the IETF documents. The IETF documents are 'specifications' of technical details. My informed reading of the segments intended to specify algorithms is that I find them difficult at best or impossible or deficient at worst. Shaken is not going to fix IETF documents. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 12:33:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3144612D0A3 for ; Sat, 20 Aug 2016 12:33:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.719 X-Spam-Level: X-Spam-Status: No, score=-0.719 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HtAc8NpE9W67 for ; Sat, 20 Aug 2016 12:33:26 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F131612B026 for ; Sat, 20 Aug 2016 12:33:25 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KJNYob016585; Sat, 20 Aug 2016 15:33:24 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049287.ppops.net-00191d01. with ESMTP id 24xv0e99qw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 15:33:24 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KJXMAI032262; Sat, 20 Aug 2016 15:33:23 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KJX9di031894 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 15:33:17 -0400 Received: from MISOUT7MSGHUBAB.ITServices.sbc.com (MISOUT7MSGHUBAB.itservices.sbc.com [130.9.129.146]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 19:32:56 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAB.ITServices.sbc.com ([130.9.129.146]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 15:32:56 -0400 From: "DOLLY, MARTIN C" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Documenting algorithms Thread-Index: AQHR+xHB6IY+A+ovZUaoqSjCi0NO7KBSMjdrgABE+AD//8EBL4AARkuA//++reE= Date: Sat, 20 Aug 2016 19:32:55 +0000 Message-ID: <2EEB29AB-1947-472D-930F-DDA2241E9F13@att.com> References: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> <7a24296e-d959-d317-9081-0096be82a2dc@dcrocker.net> <6926657C-5F26-4587-9324-7C42F2A37033@att.com>, <92bf7c34-1029-e7d9-cbf9-fa60a0dcb12a@dcrocker.net> In-Reply-To: <92bf7c34-1029-e7d9-cbf9-fa60a0dcb12a@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_2EEB29AB1947472D930FDDA2241E9F13attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200252 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:33:27 -0000 --_000_2EEB29AB1947472D930FDDA2241E9F13attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I respectfully disagree sir and I am done Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 20, 2016, at 3:27 PM, Dave Crocker > wrote: On 8/20/2016 12:15 PM, DOLLY, MARTIN C wrote: 1. Provides clear Examples of PAI and FROM 2. Extensibility examples, particularly a scenario of signing for the CgP by the originating carrier and signing of RPH by the NS/EP authentication carrier 3. Christer comments addressed I believe this will occur Then SHAKEN handles the rest How do you think Shaken will? Here's why it won't: Nothing in your list fixes the IETF documents. The IETF documents are = 'specifications' of technical details. My informed reading of the segments intended to specify algorithms is t= hat I find them difficult at best or impossible or deficient at worst. Shaken is not going to fix IETF documents. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net --_000_2EEB29AB1947472D930FDDA2241E9F13attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
I respectfully disagree sir and I am done

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 20, 2016, at 3:27 PM, Dave Crocker <dhc@dcrocker.net> wrote:

On 8/20/2016 12:15 PM, DOLLY, MARTIN C wrote:
1. Provides clear Examples of PAI and FROM<= /span>
2. Extensibility examples, particularly a s= cenario of signing for the
CgP by the originating carrier and signing = of RPH by the NS/EP
authentication carrier
3. Christer comments addressed

I believe this will occur

Then SHAKEN handles the rest


How do you think Shaken will?

Here's why it won't:

    Nothing in your list fixes the IETF documents= .  The IETF documents are 'specifications' of technical details.

    My informed reading of the segments intended = to specify algorithms is that I find them difficult at best or impossible o= r deficient at worst.

    Shaken is not going to fix IETF documents.

d/

--

 Dave Crocker
 Brandenburg InternetWorking
 bbiw.net
--_000_2EEB29AB1947472D930FDDA2241E9F13attcom_-- From nobody Sat Aug 20 12:41:46 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE93112D1A3 for ; Sat, 20 Aug 2016 12:41:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.183 X-Spam-Level: * X-Spam-Status: No, score=1.183 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q-iiw2czGbDy for ; Sat, 20 Aug 2016 12:41:44 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F77512B026 for ; Sat, 20 Aug 2016 12:41:44 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7KJfpUk031733 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 20 Aug 2016 12:41:51 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471722111; bh=6F8m06Ov4NPQtEjtTMgHpjbqsdEEJPl22MYovub2Fzg=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=QRlOgmbntLvGUQSGFmtfCDG9nkNFI3Z8zRwDWDLHjLxB7L2KXJpfvb7Doqn4k+IEx Y9htADstRolDMW1cQFvjLvjQggjnbRJPDoSy8iSb7v/lw+7qkfAkARpYyrOnJ48nf3 q5O0DAYVqXctQw5kOcvZ4NNymE8rX/2YDQ+tM7Yc= To: "DOLLY, MARTIN C" References: <71718716-32fe-6dbb-c1cb-e629cea008c5@dcrocker.net> <7a24296e-d959-d317-9081-0096be82a2dc@dcrocker.net> <6926657C-5F26-4587-9324-7C42F2A37033@att.com> <92bf7c34-1029-e7d9-cbf9-fa60a0dcb12a@dcrocker.net> <2EEB29AB-1947-472D-930F-DDA2241E9F13@att.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <8d9bf507-89ce-b8a9-e724-da051964655b@dcrocker.net> Date: Sat, 20 Aug 2016 12:41:27 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <2EEB29AB-1947-472D-930F-DDA2241E9F13@att.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Documenting algorithms X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:41:45 -0000 On 8/20/2016 12:32 PM, DOLLY, MARTIN C wrote: > I respectfully disagree sir and I am done Martin, In terms of engaging with the substance of what I said, you never started. You asked questions and then you made a pronouncement that had literally nothing to do with my responses. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 20 12:58:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A914112D1E3 for ; Sat, 20 Aug 2016 12:58:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nE_ldhmzf_y1 for ; Sat, 20 Aug 2016 12:58:21 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id BF5FE12D09C for ; Sat, 20 Aug 2016 12:58:21 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id 9186337D; Sat, 20 Aug 2016 19:58:21 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id C3ABA58090; Sat, 20 Aug 2016 19:58:11 +0000 (UTC) References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> <6ac924cd-fd70-967d-1345-0b4e623d95a8@dcrocker.net> <9A43D0C6-9E01-4A06-A4CD-82DD6D823F4B@shockey.us> To: Richard Shockey , dcrocker@bbiw.net, "DOLLY, MARTIN C" , Paul Kyzivat , "stir@ietf.org" From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <5f1f06a2-b1d0-01c9-6e21-d6c9553ec5fa@yaanatech.com> Date: Sat, 20 Aug 2016 15:58:20 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <9A43D0C6-9E01-4A06-A4CD-82DD6D823F4B@shockey.us> Content-Type: multipart/alternative; boundary="------------CA515CE5BEB59EBE259CB395" Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 19:58:22 -0000 This is a multi-part message in MIME format. --------------CA515CE5BEB59EBE259CB395 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Outside the U.S., equivalent domestic agencies in every national jurisdiction will do the same. Treaty provisions and operator agreements should suffice among jurisdictions for international communications. --tony On 2016-08-20 3:10 PM, Richard Shockey wrote: > I can think of several US 3 letter agencies with statutory authority. The FCC being the principal one. --------------CA515CE5BEB59EBE259CB395 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Outside the U.S., equivalent domestic agencies
in every national jurisdiction will do the same.
Treaty provisions and operator agreements
should suffice among jurisdictions for international
communications.

--tony


On 2016-08-20 3:10 PM, Richard Shockey wrote:
I can think of several US 3 letter agencies with statutory authority.  The FCC being the principal one.

--------------CA515CE5BEB59EBE259CB395-- From nobody Sat Aug 20 13:22:20 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60ED812B043 for ; Sat, 20 Aug 2016 13:22:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.719 X-Spam-Level: X-Spam-Status: No, score=-0.719 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lwb4uBmcEQCB for ; Sat, 20 Aug 2016 13:22:18 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61E0F12B01F for ; Sat, 20 Aug 2016 13:22:18 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7KKJMsP007633; Sat, 20 Aug 2016 16:22:15 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049287.ppops.net-00191d01. with ESMTP id 24xv0ea19h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Aug 2016 16:22:14 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KKMD1Z012345; Sat, 20 Aug 2016 16:22:13 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7KKM7D6012312 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Aug 2016 16:22:07 -0400 Received: from MISOUT7MSGHUBAD.ITServices.sbc.com (MISOUT7MSGHUBAD.itservices.sbc.com [130.9.129.148]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Sat, 20 Aug 2016 20:21:55 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAD.ITServices.sbc.com ([130.9.129.148]) with mapi id 14.03.0301.000; Sat, 20 Aug 2016 16:21:54 -0400 From: "DOLLY, MARTIN C" To: "tony@yaanatech.com" Thread-Topic: [stir] Robocall Strike Force Thread-Index: AQHR+lf0Ed/hh9UbOUG3iSxY8YLToqBRBFIAgAC1LRCAAIDoAP//wyaQgABXFYCAABv9gIAACtMAgAANUgD//8OHbA== Date: Sat, 20 Aug 2016 20:21:53 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> <6ac924cd-fd70-967d-1345-0b4e623d95a8@dcrocker.net> <9A43D0C6-9E01-4A06-A4CD-82DD6D823F4B@shockey.us>, <5f1f06a2-b1d0-01c9-6e21-d6c9553ec5fa@yaanatech.com> In-Reply-To: <5f1f06a2-b1d0-01c9-6e21-d6c9553ec5fa@yaanatech.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_FCAB2C6528B741DFBEDA409D6DEDF8E2attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-20_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608200260 Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat , Richard Shockey Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 20:22:19 -0000 --_000_FCAB2C6528B741DFBEDA409D6DEDF8E2attcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Eating into moose time What is important is what is signaled on the wire (to steal a phrase from M= r Shockey) To that end 3GPP CT1 will do it based on ATIS- SIP Forum Display Framework WRT, cross country treatment and enforcement, company/country agreements (Above my pay grade) Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 20, 2016, at 3:58 PM, Tony Rutkowski > wrote: Outside the U.S., equivalent domestic agencies in every national jurisdiction will do the same. Treaty provisions and operator agreements should suffice among jurisdictions for international communications. --tony On 2016-08-20 3:10 PM, Richard Shockey wrote: I can think of several US 3 letter agencies with statutory authority. The = FCC being the principal one. --_000_FCAB2C6528B741DFBEDA409D6DEDF8E2attcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Eating into moose time

What is important is what is signaled on the= wire (to steal a phrase from Mr Shockey)

To that end 3GPP CT1 will do it based on ATI= S- SIP Forum Display Framework

WRT, cross country treatment and enforcement= , company/country agreements
(Above my pay grade)

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 20, 2016, at 3:58 PM, Tony Rutkowski <tony@yaanatech.com> wrote:

Outside the U.S., equivalent domestic agencies
in every national jurisdiction will do the same.
Treaty provisions and operator agreements
should suffice among jurisdictions for international
communications.

--tony


On 2016-08-20 3:10 PM, Richard Shockey wrote= :
I can think of several US 3 letter agencies with statutory a=
uthority.  The FCC being the principal one.=20

--_000_FCAB2C6528B741DFBEDA409D6DEDF8E2attcom_-- From nobody Sat Aug 20 15:28:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24B2512D1D5 for ; Sat, 20 Aug 2016 15:28:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jocD4T0xCg_m for ; Sat, 20 Aug 2016 15:28:11 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 3A94912D0F7 for ; Sat, 20 Aug 2016 15:28:11 -0700 (PDT) Received: (qmail 12662 invoked by uid 0); 20 Aug 2016 22:28:09 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by qproxy2.mail.unifiedlayer.com with SMTP; 20 Aug 2016 22:28:09 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by CMOut01 with id ZaP51t00G1MNPNq01aP8zj; Sat, 20 Aug 2016 16:23:08 -0600 X-Authority-Analysis: v=2.1 cv=FKmImYYs c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=zQP7CpKOAAAA:8 a=scBmumm3AAAA:8 a=k7Ga1wGzAAAA:8 a=48vgC7mUAAAA:8 a=CwfYjZIqGabg7TlpZFUA:9 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=qM39cor4HRgA:10 a=K2lU_Ab98eoA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=eIYTjaVOsf8ucCfq-IIA:9 a=wqddGi7N1U2qeLAp:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=obGFCI3_7AGB19sD6zJV:22 a=ef56qr_8hkesV0SKvPxj:22 a=ijMaxGghyylP-n2pFjDB:22 a=w1C3t2QeGrPiZgrLijVG:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date; bh=rzZjbRrPi/VbaMdswcZfPSoPmUwxPfidtVPfxBNP/1E=; b=UYO2 JhvRT8ydhLlL1V6SNpBjsvHby9KOQnt21fkseb+kW1BNMrqY8oN79MoLz5GSzIvUWal6eogL21T+C 6cLNLj6QmkGZ7Akgz//jqudV8kExpH6F4UukN4z4L6ty53k; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:59998 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bbEfS-0004rM-CD; Sat, 20 Aug 2016 16:23:06 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sat, 20 Aug 2016 18:23:04 -0400 From: Richard Shockey To: "DOLLY, MARTIN C" , "tony@yaanatech.com" Message-ID: <6463FC48-9933-4BBB-8FC3-6AF4390C34D6@shockey.us> Thread-Topic: [stir] Robocall Strike Force References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> <74B746A9-B1EE-41C7-8CE7-1F113A6FC156@shockey.us> <6ac924cd-fd70-967d-1345-0b4e623d95a8@dcrocker.net> <9A43D0C6-9E01-4A06-A4CD-82DD6D823F4B@shockey.us> <5f1f06a2-b1d0-01c9-6e21-d6c9553ec5fa@yaanatech.com> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3554562186_1912170586" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bbEfS-0004rM-CD X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:59998 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" , "dcrocker@bbiw.net" , Paul Kyzivat Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 22:28:13 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3554562186_1912170586 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 ++1=C2=A0=C2=A0=20 =20 Shockey=E2=80=99s second law. =E2=80=9CThere is only one network, wireline. Everything = else is access.=E2=80=9D=C2=A0 You know what Shockey=E2=80=99s first law is. =20 =20 =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 =20 =20 From: "DOLLY, MARTIN C" Date: Saturday, August 20, 2016 at 4:21 PM To: "tony@yaanatech.com" Cc: Richard Shockey , "dcrocker@bbiw.net" , Paul Kyzivat , "stir@ietf.org" Subject: Re: [stir] Robocall Strike Force =20 Eating into moose time =20 What is important is what is signaled on the wire (to steal a phrase from M= r Shockey) =20 To that end 3GPP CT1 will do it based on ATIS- SIP Forum Display Framework =20 WRT, cross country treatment and enforcement, company/country agreements (Above my pay grade) Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com =20 On Aug 20, 2016, at 3:58 PM, Tony Rutkowski wrote: Outside the U.S., equivalent domestic agencies in every national jurisdiction will do the same. Treaty provisions and operator agreements should suffice among jurisdictions for international communications. --tony On 2016-08-20 3:10 PM, Richard Shockey wrote: I can think of several US 3 letter agencies with statutory authority.=C2=A0 The= FCC being the principal one.=20 =20 --B_3554562186_1912170586 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

++1=C2=A0=C2=A0

 

Shockey’s second law. “There is only one network, wirelin= e. Everything else is access.”=C2=A0 You know what Shockey’s first l= aw is.

 

 

 = ;

— 

<= div>

Richard Shockey

Shockey Cons= ulting LLC

Chairman of the Board SIP F= orum

www.shockey.us<= /p>

www.sipforum.org

r= ichard<at>shockey.us

Skype-Linke= din-Facebook rshockey101

= PSTN +1 703-5= 93-2683

 

 

From: "= DOLLY, MARTIN C" <md3135@att.com>
Date: Saturday, Augus= t 20, 2016 at 4:21 PM
To: "tony@yaanatech.com" <tony@= yaanatech.com>
Cc: Richard Shockey <richard@shockey.us>, = "dcrocker@bbiw.net" <dcrocker@bbiw.net>, Paul Kyzivat <pk= yzivat@alum.mit.edu>, "stir@ietf.org" <stir@ietf.org>
= Subject: Re: [stir] Robocall Strike Force

=

 

Eating into moose time

 

=

What is important is what is signaled on the wire (to ste= al a phrase from Mr Shockey)

=

 

To that end 3GPP CT1 will do it based on ATIS- SIP Forum Dis= play Framework

 

WRT, cross country treatment and enforcement, company/country agreements

(Above my pay grade)

M= artin C. Dolly

Lead Member of Technical= Staff

Core & Government/Regulatory Sta= ndards

AT&T

Cell: +1.609.903.3360

Email: md313= 5@att.com

 


On Aug 20, 2016, = at 3:58 PM, Tony Rutkowski <tony@yaan= atech.com> wrote:

Outside the U.S., equivalent domestic agencies
in every national juris= diction will do the same.
Treaty provisions and operator agreements
sh= ould suffice among jurisdictions for international
communications.
--tony

On 2016-08-20 3:10 PM,= Richard Shockey wrote:

I can think of several US 3 letter agencies wi=
th statutory authority.=C2=A0 The FCC being the principal one.
=

 

--B_3554562186_1912170586-- From nobody Sat Aug 20 15:52:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EABF112D66A for ; Sat, 20 Aug 2016 15:52:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q4wCGujPzIDS for ; Sat, 20 Aug 2016 15:52:35 -0700 (PDT) Received: from resqmta-ch2-10v.sys.comcast.net (resqmta-ch2-10v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76E1C12D642 for ; Sat, 20 Aug 2016 15:52:34 -0700 (PDT) Received: from resomta-ch2-14v.sys.comcast.net ([69.252.207.110]) by resqmta-ch2-10v.sys.comcast.net with SMTP id bF7wbhhmERingbF7ybDFLD; Sat, 20 Aug 2016 22:52:34 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-14v.sys.comcast.net with SMTP id bF7xbnqmoUWBnbF7xb2hrn; Sat, 20 Aug 2016 22:52:34 +0000 To: "DOLLY, MARTIN C" , "stir@ietf.org" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> From: Paul Kyzivat Message-ID: <102ff390-1e2f-2473-94fa-9bd11800c358@alum.mit.edu> Date: Sat, 20 Aug 2016 18:52:32 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfDrqm9a5iwnhuqQdvSiU7CWyW84aZdXwvoBKMPZ868iQYMokwOnez58gH1CzrAruUJzkf+5S8mz/EbsBSPzLOs6r2yV4kZCVZWMFW9ws/WZy4mdYPH8O D3A1Ht4RysZY3aoCdQMwyqAYa4vbD5ZchiNSKjQ6cbWDx+yhC8Asls91wonn7YCPYuwj7HJoAEFRefXT+nYzKwgf0u/EctNUu3I= Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Aug 2016 22:52:37 -0000 On 8/20/16 11:41 AM, DOLLY, MARTIN C wrote: > Being it is joint effort of ATIS and SIP Forum, if you are a member of either, yes. SIP Forum is quite open. But documents are about to be updated. I am. I didn't see these among the NNI documents, and didn't find any other likely place. Can you supply a URI to where they are? Thanks, Paul > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: Saturday, August 20, 2016 11:18 AM > To: stir@ietf.org > Subject: Re: [stir] Robocall Strike Force > > Martin, > > Are these documents (both the SHAKEN stuff and the Display Framework) publicly available? > > I looked on the sip forum web site but didn't find them. > > Thanks, > Paul > > On 8/20/16 8:05 AM, DOLLY, MARTIN C wrote: >> Tony, >> >> >> >> For deployment in the USA, this ITU work would be totally useless. >> >> >> >> The ATIS - SIP Forum is has a profile of the IETF STIR RFC drafts in >> the SHAKEN Framework document. >> >> Further, SHAKEN telecom industry framework - Signature-based Handling >> of Asserted Information using Tokens >> >> 1. Defines the architecture and NNI dependencies around the usage >> of the PASSporT and 4474bis based framework >> >> 2. Defines the security model around management and usage of >> certificates used to sign and assert caller identity information >> >> >> >> In addition, there is a Display Framework document, that defines the >> requirements for signaling the verification information from the >> network to the user device and the requirements for what is displayed >> on the user device independent of technology. >> >> >> >> Service Requirements to support the above is being brought into the >> 3GPP >> SA1 meeting in San Francisco next week, 8/22-26 (Being led by Greg >> Schumacher, Sprint). >> >> >> >> I will be bring in a discussion paper and CRs into the October CT1 >> meeting in China with the support of Nokia and Ericsson (and hopefully >> the other USA companies). >> >> >> >> WRT display on the user device, there will be a combination of >> vendors getting requirements based on the ATIS-SIP Forum Display >> Framework given to them as part of ecosystem participation in the FCC >> Strike Force and/or direct requirements from carriers. In addition, >> further documentation to in GSMA, Cable Labs, etc... specifications may/will occur. >> >> >> >> Up to now, the coordination has been with the ATIS-SIP Forum >> co-chairs/leaders and moving forward with the FCC Strike Force >> Authentication Committee (co-chairs Chris Wendt and myself, so there >> the transition should be seamless) >> >> >> >> With the above work plan I do not see a role for the ITU on the Caller >> ID Spoofing. >> >> >> >> Regards, >> >> >> >> *Martin C. Dolly* >> >> Lead Member of Technical Staff >> >> Core & Government/Regulatory Standards >> >> AT&T >> >> Cell: +1.609.903.3360 >> >> Email: _md3135@att.com _ >> >> >> >> >> >> *From:*Tony Rutkowski [mailto:tony@yaanatech.com] >> *Sent:* Friday, August 19, 2016 4:48 PM >> *To:* DOLLY, MARTIN C >> *Cc:* IETF STIR Mail List ; Paul Najarian >> >> *Subject:* Re: [stir] Robocall Strike Force >> >> >> >> Hi Martin et al., >> >> It is worth noting that for the >> upcoming SG17 meeting, China's >> MIIT, China Unicom, and China mobile >> have proposed a new work item that >> is substantially related to stir work. >> Indeed, the proposal contains a useful comprehensive overview of >> related SDO activities, including stir, and a gap analysis. >> >> I expect that the usdel to the meeting would appreciate any views from >> the Task Force and stir participants on the contribution. In >> addition, how does stir and the IETF anticipate collaborating with >> SG17 and the other SDOs going forward? >> The NWI seems almost certain to get approved, and may well be before >> WTSA 2016. >> >> best, >> --tony >> >> >> >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Sun Aug 21 06:22:46 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5C9412D0AF for ; Sun, 21 Aug 2016 06:22:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YCpNEVIFsfLG for ; Sun, 21 Aug 2016 06:22:43 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 092E3128B44 for ; Sun, 21 Aug 2016 06:22:43 -0700 (PDT) Received: from pps.filterd (m0049295.ppops.net [127.0.0.1]) by m0049295.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7LDIx2H026228; Sun, 21 Aug 2016 09:22:40 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049295.ppops.net-00191d01. with ESMTP id 24xxscaven-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 21 Aug 2016 09:22:40 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7LDMdbq007185; Sun, 21 Aug 2016 09:22:39 -0400 Received: from mlpi409.sfdc.sbc.com (mlpi409.sfdc.sbc.com [130.9.128.241]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7LDMWuG007153 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 21 Aug 2016 09:22:36 -0400 Received: from MISOUT7MSGHUBAH.ITServices.sbc.com (MISOUT7MSGHUBAH.itservices.sbc.com [130.9.129.152]) by mlpi409.sfdc.sbc.com (RSA Interceptor); Sun, 21 Aug 2016 13:22:18 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAH.ITServices.sbc.com ([130.9.129.152]) with mapi id 14.03.0301.000; Sun, 21 Aug 2016 09:22:18 -0400 From: "DOLLY, MARTIN C" To: Paul Kyzivat , "stir@ietf.org" Thread-Topic: [stir] Robocall Strike Force Thread-Index: AQHR+lf0Ed/hh9UbOUG3iSxY8YLToqBRBFIAgAC1LRCAAIDoAP//wyaQgAC74wCAAK8MMA== Date: Sun, 21 Aug 2016 13:22:17 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <2D7E9FF7-6121-4E0C-BBCA-FD730F252713@brianrosen.net> <9e8d2b2c-2735-d8db-0682-755ff294f9f8@dcrocker.net> <4cd5cefb-59a1-f8d8-5bcd-e49cdbad2132@dcrocker.net> <437A953E-7F03-4FD8-B360-40C82D194DCB@att.com> <102ff390-1e2f-2473-94fa-9bd11800c358@alum.mit.edu> In-Reply-To: <102ff390-1e2f-2473-94fa-9bd11800c358@alum.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.147.121] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-21_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608210151 Archived-At: Subject: Re: [stir] Robocall Strike Force X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 13:22:45 -0000 Paul, Documents can be found here https://access.atis.org/apps/org/workgroup/ipnn= i/documents.php , but please use this list to comment, nni@sipforum.org not= the STIR list. Thank you, Martin -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu]=20 Sent: Saturday, August 20, 2016 6:53 PM To: DOLLY, MARTIN C ; stir@ietf.org Subject: Re: [stir] Robocall Strike Force On 8/20/16 11:41 AM, DOLLY, MARTIN C wrote: > Being it is joint effort of ATIS and SIP Forum, if you are a member of ei= ther, yes. SIP Forum is quite open. But documents are about to be updated. I am. I didn't see these among the NNI documents, and didn't find any other= likely place. Can you supply a URI to where they are? Thanks, Paul > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: Saturday, August 20, 2016 11:18 AM > To: stir@ietf.org > Subject: Re: [stir] Robocall Strike Force > > Martin, > > Are these documents (both the SHAKEN stuff and the Display Framework) pub= licly available? > > I looked on the sip forum web site but didn't find them. > > Thanks, > Paul > > On 8/20/16 8:05 AM, DOLLY, MARTIN C wrote: >> Tony, >> >> >> >> For deployment in the USA, this ITU work would be totally useless. >> >> >> >> The ATIS - SIP Forum is has a profile of the IETF STIR RFC drafts in=20 >> the SHAKEN Framework document. >> >> Further, SHAKEN telecom industry framework - Signature-based Handling=20 >> of Asserted Information using Tokens >> >> 1. Defines the architecture and NNI dependencies around the usage >> of the PASSporT and 4474bis based framework >> >> 2. Defines the security model around management and usage of >> certificates used to sign and assert caller identity information >> >> >> >> In addition, there is a Display Framework document, that defines the=20 >> requirements for signaling the verification information from the=20 >> network to the user device and the requirements for what is displayed=20 >> on the user device independent of technology. >> >> >> >> Service Requirements to support the above is being brought into the=20 >> 3GPP >> SA1 meeting in San Francisco next week, 8/22-26 (Being led by Greg=20 >> Schumacher, Sprint). >> >> >> >> I will be bring in a discussion paper and CRs into the October CT1=20 >> meeting in China with the support of Nokia and Ericsson (and=20 >> hopefully the other USA companies). >> >> >> >> WRT display on the user device, there will be a combination of=20 >> vendors getting requirements based on the ATIS-SIP Forum Display=20 >> Framework given to them as part of ecosystem participation in the FCC=20 >> Strike Force and/or direct requirements from carriers. In addition,=20 >> further documentation to in GSMA, Cable Labs, etc... specifications may/= will occur. >> >> >> >> Up to now, the coordination has been with the ATIS-SIP Forum=20 >> co-chairs/leaders and moving forward with the FCC Strike Force=20 >> Authentication Committee (co-chairs Chris Wendt and myself, so there=20 >> the transition should be seamless) >> >> >> >> With the above work plan I do not see a role for the ITU on the=20 >> Caller ID Spoofing. >> >> >> >> Regards, >> >> >> >> *Martin C. Dolly* >> >> Lead Member of Technical Staff >> >> Core & Government/Regulatory Standards >> >> AT&T >> >> Cell: +1.609.903.3360 >> >> Email: _md3135@att.com _ >> >> >> >> >> >> *From:*Tony Rutkowski [mailto:tony@yaanatech.com] >> *Sent:* Friday, August 19, 2016 4:48 PM >> *To:* DOLLY, MARTIN C >> *Cc:* IETF STIR Mail List ; Paul Najarian=20 >> >> *Subject:* Re: [stir] Robocall Strike Force >> >> >> >> Hi Martin et al., >> >> It is worth noting that for the >> upcoming SG17 meeting, China's >> MIIT, China Unicom, and China mobile >> have proposed a new work item that >> is substantially related to stir work. >> Indeed, the proposal contains a useful comprehensive overview of=20 >> related SDO activities, including stir, and a gap analysis. >> >> I expect that the usdel to the meeting would appreciate any views=20 >> from the Task Force and stir participants on the contribution. In=20 >> addition, how does stir and the IETF anticipate collaborating with >> SG17 and the other SDOs going forward? >> The NWI seems almost certain to get approved, and may well be before=20 >> WTSA 2016. >> >> best, >> --tony >> >> >> >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Sun Aug 21 06:51:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B780B12D08D for ; Sun, 21 Aug 2016 06:51:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0dL4hwT5OM09 for ; Sun, 21 Aug 2016 06:51:07 -0700 (PDT) Received: from mail-yb0-x22d.google.com (mail-yb0-x22d.google.com [IPv6:2607:f8b0:4002:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8184128B44 for ; Sun, 21 Aug 2016 06:51:07 -0700 (PDT) Received: by mail-yb0-x22d.google.com with SMTP id z10so29617485ybh.2 for ; Sun, 21 Aug 2016 06:51:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=VazKPj2yfgqHjwrAMeCYrNuxXNFGRM0jYvt6tCqlT28=; b=Hb5ZOYSztBLtzJ/4mRVhMMrZ3u5kCuY5JoN1VU4ZHu/ztmAMaVrY2oYGfnfz6RL1ys yqTXl1Y9nXEdWo9Fs5M2LRnh8eZa4nQ40HWkvzhASWRVuzXMUo3JT9WCnZUMDlXoGH3I ZM53wmxFKvzLzLxnMehRN43vhZqmU+LPiXOFYKgHMt4IW1B/Y8rQ+uAQ2pSMs+WDMWcf iaIwRl/DuMUfq1cWWdX35agZUY5DjaQzckfOtHsOPYknUjs+u3JxhiT2dRSEKoUclJ4w 6wnlZ/whbikI69f+xSkBH0b3aqI1UuRP6+sCk0OBeklR0j4Tz2jEQdbQ3AjmlqRZbw+/ qv2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=VazKPj2yfgqHjwrAMeCYrNuxXNFGRM0jYvt6tCqlT28=; b=B43QCMqt/DscANNJOMkGPC73jyw7ODxPaAiGpNCCDJ6dazPrg+ITahbaDDeheZxgbw ObUmrivfDZDF/EthJO+EWEhLQ/l0CYDY2Yryzdx57Wc1RhnnCHoV5/J54hmX36q9J1g0 v/aClj/Gbfed4FezsmmHjkdgy7do5X8z/JgghYD2ngYvoZsQX5l5wyP6LomBAihIWa6C nAoy45XWZGzUMlSsqrpYTVdK3NvcXORQ4FiYY0ZQzm2d5lAIzPOyVCU+bzQYQ9vOHi6C RzUdy89GV8/GXKVJ08h8jwX9mfOV61odOOShArJevtocSzaMqZ0J7UxsFXNRYNhJnf9J RcUw== X-Gm-Message-State: AEkoouvjHVorydN9xW63dlSp/ZDjLqdDmOVvM/rzefdSv4h35luvLytpfnBUCV2ZVHd/JRa7VYNUTSsOjiSVAQ== X-Received: by 10.37.118.144 with SMTP id r138mr4314251ybc.146.1471787466910; Sun, 21 Aug 2016 06:51:06 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sun, 21 Aug 2016 06:50:26 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Sun, 21 Aug 2016 06:50:26 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=001a114bc32426a061053a9539d7 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 13:51:10 -0000 --001a114bc32426a061053a9539d7 Content-Type: text/plain; charset=UTF-8 On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker wrote: > > [*] Use of certs for the web are famously problematic. First, the only > serious reliance on them is to prevent MITM attacks. Second, are all of > the operational problems with root CAs. Third are all the times sites do > self-signing. I'm not sure I understand this argument. 1. I'm not quite sure what you mean when you say that the only serious reliance of Web certificates is to prevent MITM attacks. In general, the purpose of Web certificates is to authenticate the endpoints involved in the HTTPS connection, thus preventing attackers from impersonating one of those endpoints (whether the attacker then does an MITM attack or some other attack is kind of a detail; for instance an attacker might just impersonate a site without ever connecting to it). What purpose would you expect these certificates to serve that they are not serving? 2. It's certainly true that there have been a number of high-profile instances of misissuance by trust anchors, but I'm not sure that this speaks as much to inherent problems of PKI as to the scale of the Web PKI and the number of trust anchors in the system. 3. I'm not sure how self-signing comes into things; self-signing is largely a response to difficulty in obtaining valid certs. My understanding was that STIR was going to have a more straightforward (and initially less distributed) issuance story. More generally, if STIR authentication merely worked almost as well as the Web PKI, that seems like it would be pretty significant improvement over the current situation. -Ekr > > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --001a114bc32426a061053a9539d7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On S= at, Aug 20, 2016 at 11:53 AM, Dave Crocker <dhc@dcrocker.net>= wrote:
[*] Use of certs for the web are famously problematic.=C2=A0 First, the onl= y serious reliance on them is to prevent MITM attacks.=C2=A0 Second, are al= l of the operational problems with root CAs.=C2=A0 Third are all the times = sites do self-signing.

I'm not sure I u= nderstand this argument.

1. I'm not quite sure= what you mean when you say that the only serious reliance of Web certifica= tes is to prevent MITM attacks. In general, the purpose of Web certificates= is to authenticate the endpoints involved in the HTTPS connection, thus pr= eventing attackers from impersonating one of those endpoints (whether the a= ttacker then does an MITM attack or some other attack is kind of a detail; = for instance an attacker might just impersonate a site without ever connect= ing to it). What purpose would you expect these certificates to serve that = they are not serving?

2. It's certainly true t= hat there have been a number of high-profile instances of misissuance by tr= ust anchors, but I'm not sure that this speaks as much to inherent prob= lems of PKI as to the scale of the Web PKI and the number of trust anchors = in the system.

3. I'm not sure how self-signin= g comes into things; self-signing is largely a response to difficulty in ob= taining valid certs. My understanding was that STIR was going to have a mor= e straightforward (and initially less distributed) issuance story.

More generally, if STIR authentication merely worked almos= t as well as the Web PKI, that seems like it would be pretty significant im= provement over the current situation.

-Ekr




=C2=A0
=


--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

--001a114bc32426a061053a9539d7-- From nobody Sun Aug 21 08:37:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B71612D0A0 for ; Sun, 21 Aug 2016 08:37:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CVvw5RKjXJUQ for ; Sun, 21 Aug 2016 08:37:46 -0700 (PDT) Received: from mail-yb0-x229.google.com (mail-yb0-x229.google.com [IPv6:2607:f8b0:4002:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F13F12D526 for ; Sun, 21 Aug 2016 08:37:46 -0700 (PDT) Received: by mail-yb0-x229.google.com with SMTP id z10so30085084ybh.2 for ; Sun, 21 Aug 2016 08:37:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Vx1thjRw+R2CnIUGuJIxzsVqwkzMpZrKopqVGMwIuLc=; b=VqKVAIy2JjgiCHp+6WSTQ9xfte1uLPhElxr7rnUCN+b77CUYLlZDwvRbcoJsqF9Dxk GbCoOO++hHX51pQ6XA6R0loie2mV5svJcg2Lmua8uJ0GMRCFNaBgIqk6bbpOHzKeQmWO TdGCC/99uXnwCcI70+Gb3/lw7OgTk3Tt0CLiAKGMSve1aNimmMI+JZl8Y1t+awOkVS96 EpW45kBVB5+usybF12ZpZofJRQBucM/8rUvHeUhqJzQ4RNRSDF7QXvjTZNYGc5ywc/wW olMCtonqMAvql/WJH/nvGkE8bVRfFdMdsiwFYiUBGsapfZuJgGrUdAIrp3B+bPLr99wK 9c7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Vx1thjRw+R2CnIUGuJIxzsVqwkzMpZrKopqVGMwIuLc=; b=C5MAZEEjUugM1YGpYoFimW5+NMuoWqeEeGEDcFy/5zx85T14LLEyGI+BUsfgw34A57 DhaA1hk1DuPEK6Ip/6BgInMCsa7hV8SpsuMR36biqo52euKgXAc9G8/E1cfcpxXOAV/j N+QUhdFy6zcjS2s3cI1dC4WPBIjEGq67n6TuXqpk/xghyfFdfIx6UgW5ffoTi9bPVckD CIAavYgsLdKCTo8A4dq79YjbbzGszkxAbYaYBGC1fW1J+KUZloddmCoMU/Kvf3flq5ey 3v61+fw0bluNFFgGVrEsEzETQisNIqXDlEJncMljRLj0ultnudG4Aw1RzbgI8o+K7nUj TcGg== X-Gm-Message-State: AEkoouv9FLG7uk7Pm5WKl3SshyyAoY+obB9IWalQ1RXG5HtahwxCYafXE0Y0WS4qBG1Jk5x0pj//vj7adplytQ== X-Received: by 10.37.160.99 with SMTP id x90mr13462239ybh.130.1471793865253; Sun, 21 Aug 2016 08:37:45 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sun, 21 Aug 2016 08:37:04 -0700 (PDT) In-Reply-To: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Eric Rescorla Date: Sun, 21 Aug 2016 08:37:04 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=94eb2c19831e85981d053a96b682 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 15:37:48 -0000 --94eb2c19831e85981d053a96b682 Content-Type: text/plain; charset=UTF-8 Dave, Whenever we want to add some cryptographic functionality to a protocol [0] (especially when it's messaging/object security functionality) we have to ask whether it would be better to define something new, specific to the protocol, and hopefully simple, or reuse something pre-existing, generic, and presumably more complicated. In my experience, the history of those who take the former approach is that we find ourselves reinventing a bunch of stuff and that it's not as simple as we hoped [1][2] Given the difficulty of correctly specifying and implementing this kind of functionality, I'd far prefer to stick with a pre-existing component. It doesn't have to be JSON of course (for instance, I have no opinion on if COSE would be better) but I would not be in favor of defining something specific here. -Ekr [0] Or, I guess, in a bunch of other cases. [1] Indeed, JOSE is in some respects an attempt to apply this treatment to CMS. [2] Another example is the current HTTPBIS encryption spec, which has rather expanded from its simple origins. On Wed, Aug 3, 2016 at 1:25 PM, Dave Crocker wrote: > On 7/29/2016 2:11 PM, Dave Crocker wrote: > >> On 7/29/2016 10:46 AM, Peterson, Jon wrote: >> >>> I wouldn't say it's a correction to the STIR charter - the charter was >>> always clear that it was not limited to SIP (see the bits about "one or >>> more non-SIP hops" and "out-of-band mechanism" in the charter). But given >>> that our original signing mechanism was, as I said, a concatenation of >>> SIP >>> header field values, the intervention was that other protocols would need >>> something less bound to SIP. JWT turned out to be the solution that the >>> group had consensus to adopt. >>> >> >> JWT has nothing to do with SIP. So when applied to a SIP context, it's >> entirely artificial. And yes, I noted the views that thought it simpler >> or equivalent to the computed string, but could not see the explicit >> logic that made JWT a better choice, no does it seem obvious to me. >> Quite the contrary. >> >> Note that during the wg session in Berlin there was /still/ question >> about where to put the JWT information. >> > > > Folks, > > I'm citing the above text, for discussing the concern I rasied about > JWT/JSON use in Passport, because that was the first time I criticized it, > which was several rounds of postings after I sent my review. That is, it > was /not/ part of my review. I made a conscious choice to leave that > concern out, although I already saw it as likely problematic. > > On its face, yes it looks like a reasonable choice. It's pre-existing > technology and it looks clean. The concerns develop in its application, > not its concept. > > Look for JSON and JWT in SIP. You won't find it. That means that it is > an added layer of specification. Or, in this case, specifications. And > since JSON and JWT are their own environments, that means there is a > learning curve and other baggage to carry, before it is useful to SIP and > STIR. > > Even better is that even the STIR specification for SIP does not require > using JWT or JSON. Note that ppt is optional. This adds to the view that, > at best, JWT/JSON is really just an abstraction for STIR. > > But in fact the fact that ppt is optional really means that the SIP STIR > specification has added complexity, with very unclear benefit. > > As for the underlying justification for the Passport model, references to > broader applicability are always appealing, but lacking concrete > specifications and clear, documented intentions of use -- including a clear > explanation of the benefit to be gained by the abstraction -- they turn out > mostly to be a distraction from the immediate concern, namely added > complexity to the mainstream use. > > Again: JSON/JWT adds a layer (or two) of mechanism that almost certainly > is not needed and almost certainly adds problematic complexity to the > specification, probably to the point of impeding reader comprehension. > > As I've noted, the underlying task here is pretty straightforward: > > * Define a mechanism for finding and validating a public key. > > * Decide on scope and canonicalization of data to be signed. Define > a signing mechanism. > > * Define a validation mechanism. > > * Decide how to deal with partial adoption > > * Decide how to deal with broken signatures. > > > Maybe a little more than this, but not much. > > > d/ > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --94eb2c19831e85981d053a96b682 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Dave,

Whenever we want to add some cr= yptographic functionality to a protocol [0] (especially
when it's messaging/object security functionality) we have= to ask whether it would be
better to defin= e something new, specific to the protocol, and hopefully simple, or reuse
something pre-existing, generic, and presuma= bly more complicated. In my experience,
the= history of those who take the former approach is that we find ourselves re= inventing
a bunch of stuff and that it'= s not as simple as we hoped [1][2]

Given the difficulty of correctly specifying a= nd implementing this kind of functionality,
I'd far prefer to stick with a pre-existing component. It doesn't = have to be JSON of course
(for instance, I = have no opinion on if COSE would be better) but I would not be in favor
of defining something specific here.

-Ekr

[0] Or, I guess,= in a bunch of other cases.
[1] Indeed, JOS= E is in some respects an attempt to apply this treatment to CMS.
[2] Another example is the current HTTPBIS encryption= spec, which has rather expanded
from its s= imple origins.


On= Wed, Aug 3, 2016 at 1:25 PM, Dave Crocker <dhc@dcrocker.net>= wrote:
On 7/29/2016 2:11 PM, Dave Crocke= r wrote:
On 7/29/2016 10:46 AM, Peterson, Jon wrote:
I wouldn't say it's a correction to the STIR charter - the charter = was
always clear that it was not limited to SIP (see the bits about "one o= r
more non-SIP hops" and "out-of-band mechanism" in the charte= r). But given
that our original signing mechanism was, as I said, a concatenation of
SIP
header field values, the intervention was that other protocols would need something less bound to SIP. JWT turned out to be the solution that the
group had consensus to adopt.

JWT has nothing to do with SIP.=C2=A0 So when applied to a SIP context, it&= #39;s
entirely artificial.=C2=A0 And yes, I noted the views that thought it simpl= er
or equivalent to the computed string, but could not see the explicit
logic that made JWT a better choice, no does it seem obvious to me.
Quite the contrary.

Note that during the wg session in Berlin there was /still/ question
about where to put the JWT information.


Folks,

I'm citing the above text, for discussing the concern I rasied about JW= T/JSON use in Passport, because that was the first time I criticized it, wh= ich was several rounds of postings after I sent my review.=C2=A0 That is, i= t was /not/ part of my review.=C2=A0 I made a conscious choice to leave tha= t concern out, although I already saw it as likely problematic.

On its face, yes it looks like a reasonable choice.=C2=A0 It's pre-exis= ting technology and it looks clean.=C2=A0 The concerns develop in its appli= cation, not its concept.

Look for JSON and JWT in SIP.=C2=A0 You won't find it.=C2=A0 That means= that it is an added layer of specification.=C2=A0 Or, in this case, specif= ications.=C2=A0 And since JSON and JWT are their own environments, that mea= ns there is a learning curve and other baggage to carry, before it is usefu= l to SIP and STIR.

Even better is that even the STIR specification for SIP does not require us= ing JWT or JSON.=C2=A0 Note that ppt is optional.=C2=A0 This adds to the vi= ew that, at best, JWT/JSON is really just an abstraction for STIR.

But in fact the fact that ppt is optional really means that the SIP STIR sp= ecification has added complexity, with very unclear benefit.

As for the underlying justification for the Passport model, references to b= roader applicability are always appealing, but lacking concrete specificati= ons and clear, documented intentions of use -- including a clear explanatio= n of the benefit to be gained by the abstraction -- they turn out mostly to= be a distraction from the immediate concern, namely added complexity to th= e mainstream use.

Again: JSON/JWT adds a layer (or two) of mechanism that almost certainly is= not needed and almost certainly adds problematic complexity to the specifi= cation, probably to the point of impeding reader comprehension.

As I've noted, the underlying task here is pretty straightforward:

=C2=A0 =C2=A0*=C2=A0 Define a mechanism for finding and validating a public= key.

=C2=A0 =C2=A0*=C2=A0 Decide on scope and canonicalization of data to be sig= ned. Define
=C2=A0 =C2=A0 =C2=A0 a signing mechanism.

=C2=A0 =C2=A0*=C2=A0 Define a validation mechanism.

=C2=A0 =C2=A0*=C2=A0 Decide how to deal with partial adoption

=C2=A0 =C2=A0*=C2=A0 Decide how to deal with broken signatures.


Maybe a little more than this, but not much.


d/

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

--94eb2c19831e85981d053a96b682-- From nobody Sun Aug 21 08:53:16 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8244612D758 for ; Sun, 21 Aug 2016 08:53:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N3UXOX0NgTCF for ; Sun, 21 Aug 2016 08:53:14 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FA1312D177 for ; Sun, 21 Aug 2016 08:53:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 421A23005B6 for ; Sun, 21 Aug 2016 11:46:42 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id yTJtwSe3M6_D for ; Sun, 21 Aug 2016 11:46:41 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 4CA48300431; Sun, 21 Aug 2016 11:46:41 -0400 (EDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <366a7ee0-cce7-4bed-951c-05415676dd91@bbiw.net> Date: Sun, 21 Aug 2016 11:26:09 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <3769C5C0-4C08-4DA2-A1BF-2D3C91743750@vigilsec.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <366a7ee0-cce7-4bed-951c-05415676dd91@bbiw.net> To: Dave Crocker X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 15:53:15 -0000 Dave: > On 8/17/2016 1:52 PM, Russ Housley wrote: >> However, WG Last Call is not the time to revisit each decision that >> brought the WG to this point. >=20 > That depends on the nature of the concerns being raised, and it always = has. The distinction that has always been made is between engineering = aesthetics versus basic flaws. >=20 > We don't get to reopen an issue if it's really just a matter of = preference -- I think semicolons are /so/ much better than forward = slashes, we really do have to change the syntax. Wrong. >=20 > But if someone happens to assess a serious technical flaw -- of the = type that includes language like "it won't work" -- it doesn't (and = shouldn't) matter when they notice it. >=20 > How the question of the flaw is resolved might matter, but that's a = separate and later issue. Your quote dropped a lot of context. I said: If there is a technical problem, let=92s identify it and fix it. If = there is a lack of clarity, let=92s fix that too. However, WG Last Call = is not the time to revisit each decision that brought the WG to this = point. All: I have asked the the next version of all three documents to be posted. = I believe that will resolve the vast majority of the little things, and = then we can better focus on any unresolved technical problems and the = places where clarifications are needed. Russ From nobody Sun Aug 21 09:04:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E526A12D758 for ; Sun, 21 Aug 2016 09:03:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1rzYeFwomZ4 for ; Sun, 21 Aug 2016 09:03:55 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E254A12D1C2 for ; Sun, 21 Aug 2016 09:03:54 -0700 (PDT) X-AuditID: c1b4fb2d-917ff700000019a3-e6-57b9d0e75d7b Received: from ESESSHC005.ericsson.se (Unknown_Domain [153.88.183.33]) by (Symantec Mail Security) with SMTP id 28.1C.06563.7E0D9B75; Sun, 21 Aug 2016 18:03:52 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC005.ericsson.se ([153.88.183.33]) with mapi id 14.03.0301.000; Sun, 21 Aug 2016 18:03:51 +0200 From: Christer Holmberg To: Eric Rescorla , Dave Crocker Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR+8H73BrKAUToJka1ECibMJhuzKBTkYhg Date: Sun, 21 Aug 2016 16:03:50 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BC29AD9ESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprDIsWRmVeSWpSXmKPExsUyM2K7ou6LCzvDDW5P0rH4/ekDm8WK1+fY LZav3cbkwOxxaedJNo8lS34yeUx+3MYcwBzFZZOSmpNZllqkb5fAlTF9Dm/BtsOMFeumvGdv YFywj7GLkZNDQsBE4sico8xdjFwcQgLrGSXefnnJBJIQEljCKHF8h2MXIwcHm4CFRPc/bZCw iICTxJSLvWwgNrOAusSLR2/YQWxhgUCJpt42RoiaIInXB/+yQ9hGEne3XWUFsVkEVCWOrHrN DGLzCvhKrNwKUg+yt4lZYvehPrChnECDFp36CVbEKCAm8f3UGiaIZeISt57MZ4I4WkBiyZ7z zBC2qMTLx/9YIWwliRXbLzGC3MwskC/R9jMdYpegxMmZT1gmMIrMQjJpFkLVLCRVEGFNifW7 9CGqFSWmdD9kh7A1JFrnzGVHFl/AyL6KUbQ4tbg4N93IWC+1KDO5uDg/Ty8vtWQTIzDODm75 rbuDcfVrx0OMAhyMSjy8C2btCBdiTSwrrsw9xCjBwawkwhtwbGe4EG9KYmVValF+fFFpTmrx IUZpDhYlcV7/l4rhQgLpiSWp2ampBalFMFkmDk6pBka/7u87/9gH1W2pydxTqOf4RYT3M6PS 9LLIhlUyM2LsnrMq/e0KOWzsKDVb92wzM49HTcOTrEouvSJf+xfzq/afKTijVf/e++PFiq/a QXu4N/xL8lNcujHc0yY1b0MX6wP3Tv7J62uKpoSKOOzLEDGq7zX//qpf/N3BRes4Dlm3Tdqw gJ1JS4mlOCPRUIu5qDgRAO/AXqOvAgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 16:03:58 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BC29AD9ESESSMB209erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGF2ZSwNCg0KSSBhZ3JlZSB3aXRoIEVrciwgYW5kIGJlaW5nIGFibGUgdG8gdXNlIHNvbWV0 aGluZyBwcmUtZXhpc3RpbmcgaXMgdGhlIHJlYXNvbiBJIGFza2VkIHRoZSBwYXNzcG9ydCBhdXRo b3JzIHRvIGNvbnNpZGVyIEpXVC4gSWYgeW91IHRoaW5rIHRoZXJlIGlzIHNvbWV0aGluZyBiZXR0 ZXIgcHJlLWV4aXN0aW5nLCBwbGVhc2Ugc2F5IHNvLCBidXQgaWYgeW91IHdhbnQgdG8gZG8gc29t ZXRoaW5nIGZyb20gc2NyYXRjaCBJIHRoaW5rIHdl4oCZZCBuZWVkIHNvbWUgcmVhbGx5IGdvb2Qg anVzdGlmaWNhdGlvbiBmb3IgdGhhdC4gSSBkb27igJl0IGFncmVlIHdpdGggeW91ciBlYXJsaWVy IHN0YXRlbWVudHMgdGhhdCBKV1QgaXMgY29tcGxleCwgYW5kIHRoZXJlIGFyZSB0b25zIG9mIHRv b2xzIHRvIHRlc3QgYW5kIHZlcmlmeSBKV1RzLg0KDQpJbiBCZXJsaW4gSSBkaWQgcmFpc2UgYW4g aXNzdWUgb24gaG93IFNUSVIgdXNlcyBKV1QgaW4gU0lQICh0aGUgZW5jb2RlZCBvYmplY3QgaXMg 4oCcc3BsaXQgdXDigJ0sIGFuZCBkaWZmZXJlbnQgcGllY2VzIGFyZSBwbGFjZWQgaW4gZGlmZmVy ZW50IFNJUCBlbGVtZW50cyksIGJ1dCBKb24gcHJvbWlzZWQgdG8gbWFrZSBzdXJlIGl04oCZcyBj bGFyaWZpZWQgYW5kIHdlbGwgZXhwbGFpbmVkIGluIHRoZSBuZXh0IHZlcnNpb24gb2YgdGhlIGJp cyBkcmFmdCwgc28gSSB0aGluayB3ZSBzaG91bGQgZ2l2ZSBoaW0gYSBjaGFuY2UgdG8gZG8gdGhh dC4NCg0KUmVnYXJkcywNCg0KQ2hyaXN0ZXINCg0KRnJvbTogc3RpciBbbWFpbHRvOnN0aXItYm91 bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEVyaWMgUmVzY29ybGENClNlbnQ6IDIxIEF1Z3Vz dCAyMDE2IDE4OjM3DQpUbzogRGF2ZSBDcm9ja2VyIDxkY3JvY2tlckBiYml3Lm5ldD4NCkNjOiBJ RVRGIFNUSVIgTWFpbCBMaXN0IDxzdGlyQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtzdGlyXSBK V1QvSlNPTiAod2FzIC0gUmU6IFJldmlldyBvZjogZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LTA1 KQ0KDQpEYXZlLA0KDQpXaGVuZXZlciB3ZSB3YW50IHRvIGFkZCBzb21lIGNyeXB0b2dyYXBoaWMg ZnVuY3Rpb25hbGl0eSB0byBhIHByb3RvY29sIFswXSAoZXNwZWNpYWxseQ0Kd2hlbiBpdCdzIG1l c3NhZ2luZy9vYmplY3Qgc2VjdXJpdHkgZnVuY3Rpb25hbGl0eSkgd2UgaGF2ZSB0byBhc2sgd2hl dGhlciBpdCB3b3VsZCBiZQ0KYmV0dGVyIHRvIGRlZmluZSBzb21ldGhpbmcgbmV3LCBzcGVjaWZp YyB0byB0aGUgcHJvdG9jb2wsIGFuZCBob3BlZnVsbHkgc2ltcGxlLCBvciByZXVzZQ0Kc29tZXRo aW5nIHByZS1leGlzdGluZywgZ2VuZXJpYywgYW5kIHByZXN1bWFibHkgbW9yZSBjb21wbGljYXRl ZC4gSW4gbXkgZXhwZXJpZW5jZSwNCnRoZSBoaXN0b3J5IG9mIHRob3NlIHdobyB0YWtlIHRoZSBm b3JtZXIgYXBwcm9hY2ggaXMgdGhhdCB3ZSBmaW5kIG91cnNlbHZlcyByZWludmVudGluZw0KYSBi dW5jaCBvZiBzdHVmZiBhbmQgdGhhdCBpdCdzIG5vdCBhcyBzaW1wbGUgYXMgd2UgaG9wZWQgWzFd WzJdDQoNCkdpdmVuIHRoZSBkaWZmaWN1bHR5IG9mIGNvcnJlY3RseSBzcGVjaWZ5aW5nIGFuZCBp bXBsZW1lbnRpbmcgdGhpcyBraW5kIG9mIGZ1bmN0aW9uYWxpdHksDQpJJ2QgZmFyIHByZWZlciB0 byBzdGljayB3aXRoIGEgcHJlLWV4aXN0aW5nIGNvbXBvbmVudC4gSXQgZG9lc24ndCBoYXZlIHRv IGJlIEpTT04gb2YgY291cnNlDQooZm9yIGluc3RhbmNlLCBJIGhhdmUgbm8gb3BpbmlvbiBvbiBp ZiBDT1NFIHdvdWxkIGJlIGJldHRlcikgYnV0IEkgd291bGQgbm90IGJlIGluIGZhdm9yDQpvZiBk ZWZpbmluZyBzb21ldGhpbmcgc3BlY2lmaWMgaGVyZS4NCg0KLUVrcg0KDQpbMF0gT3IsIEkgZ3Vl c3MsIGluIGEgYnVuY2ggb2Ygb3RoZXIgY2FzZXMuDQpbMV0gSW5kZWVkLCBKT1NFIGlzIGluIHNv bWUgcmVzcGVjdHMgYW4gYXR0ZW1wdCB0byBhcHBseSB0aGlzIHRyZWF0bWVudCB0byBDTVMuDQpb Ml0gQW5vdGhlciBleGFtcGxlIGlzIHRoZSBjdXJyZW50IEhUVFBCSVMgZW5jcnlwdGlvbiBzcGVj LCB3aGljaCBoYXMgcmF0aGVyIGV4cGFuZGVkDQpmcm9tIGl0cyBzaW1wbGUgb3JpZ2lucy4NCg0K DQpPbiBXZWQsIEF1ZyAzLCAyMDE2IGF0IDE6MjUgUE0sIERhdmUgQ3JvY2tlciA8ZGhjQGRjcm9j a2VyLm5ldDxtYWlsdG86ZGhjQGRjcm9ja2VyLm5ldD4+IHdyb3RlOg0KT24gNy8yOS8yMDE2IDI6 MTEgUE0sIERhdmUgQ3JvY2tlciB3cm90ZToNCk9uIDcvMjkvMjAxNiAxMDo0NiBBTSwgUGV0ZXJz b24sIEpvbiB3cm90ZToNCkkgd291bGRuJ3Qgc2F5IGl0J3MgYSBjb3JyZWN0aW9uIHRvIHRoZSBT VElSIGNoYXJ0ZXIgLSB0aGUgY2hhcnRlciB3YXMNCmFsd2F5cyBjbGVhciB0aGF0IGl0IHdhcyBu b3QgbGltaXRlZCB0byBTSVAgKHNlZSB0aGUgYml0cyBhYm91dCAib25lIG9yDQptb3JlIG5vbi1T SVAgaG9wcyIgYW5kICJvdXQtb2YtYmFuZCBtZWNoYW5pc20iIGluIHRoZSBjaGFydGVyKS4gQnV0 IGdpdmVuDQp0aGF0IG91ciBvcmlnaW5hbCBzaWduaW5nIG1lY2hhbmlzbSB3YXMsIGFzIEkgc2Fp ZCwgYSBjb25jYXRlbmF0aW9uIG9mDQpTSVANCmhlYWRlciBmaWVsZCB2YWx1ZXMsIHRoZSBpbnRl cnZlbnRpb24gd2FzIHRoYXQgb3RoZXIgcHJvdG9jb2xzIHdvdWxkIG5lZWQNCnNvbWV0aGluZyBs ZXNzIGJvdW5kIHRvIFNJUC4gSldUIHR1cm5lZCBvdXQgdG8gYmUgdGhlIHNvbHV0aW9uIHRoYXQg dGhlDQpncm91cCBoYWQgY29uc2Vuc3VzIHRvIGFkb3B0Lg0KDQpKV1QgaGFzIG5vdGhpbmcgdG8g ZG8gd2l0aCBTSVAuICBTbyB3aGVuIGFwcGxpZWQgdG8gYSBTSVAgY29udGV4dCwgaXQncw0KZW50 aXJlbHkgYXJ0aWZpY2lhbC4gIEFuZCB5ZXMsIEkgbm90ZWQgdGhlIHZpZXdzIHRoYXQgdGhvdWdo dCBpdCBzaW1wbGVyDQpvciBlcXVpdmFsZW50IHRvIHRoZSBjb21wdXRlZCBzdHJpbmcsIGJ1dCBj b3VsZCBub3Qgc2VlIHRoZSBleHBsaWNpdA0KbG9naWMgdGhhdCBtYWRlIEpXVCBhIGJldHRlciBj aG9pY2UsIG5vIGRvZXMgaXQgc2VlbSBvYnZpb3VzIHRvIG1lLg0KUXVpdGUgdGhlIGNvbnRyYXJ5 Lg0KDQpOb3RlIHRoYXQgZHVyaW5nIHRoZSB3ZyBzZXNzaW9uIGluIEJlcmxpbiB0aGVyZSB3YXMg L3N0aWxsLyBxdWVzdGlvbg0KYWJvdXQgd2hlcmUgdG8gcHV0IHRoZSBKV1QgaW5mb3JtYXRpb24u DQoNCg0KRm9sa3MsDQoNCkknbSBjaXRpbmcgdGhlIGFib3ZlIHRleHQsIGZvciBkaXNjdXNzaW5n IHRoZSBjb25jZXJuIEkgcmFzaWVkIGFib3V0IEpXVC9KU09OIHVzZSBpbiBQYXNzcG9ydCwgYmVj YXVzZSB0aGF0IHdhcyB0aGUgZmlyc3QgdGltZSBJIGNyaXRpY2l6ZWQgaXQsIHdoaWNoIHdhcyBz ZXZlcmFsIHJvdW5kcyBvZiBwb3N0aW5ncyBhZnRlciBJIHNlbnQgbXkgcmV2aWV3LiAgVGhhdCBp cywgaXQgd2FzIC9ub3QvIHBhcnQgb2YgbXkgcmV2aWV3LiAgSSBtYWRlIGEgY29uc2Npb3VzIGNo b2ljZSB0byBsZWF2ZSB0aGF0IGNvbmNlcm4gb3V0LCBhbHRob3VnaCBJIGFscmVhZHkgc2F3IGl0 IGFzIGxpa2VseSBwcm9ibGVtYXRpYy4NCg0KT24gaXRzIGZhY2UsIHllcyBpdCBsb29rcyBsaWtl IGEgcmVhc29uYWJsZSBjaG9pY2UuICBJdCdzIHByZS1leGlzdGluZyB0ZWNobm9sb2d5IGFuZCBp dCBsb29rcyBjbGVhbi4gIFRoZSBjb25jZXJucyBkZXZlbG9wIGluIGl0cyBhcHBsaWNhdGlvbiwg bm90IGl0cyBjb25jZXB0Lg0KDQpMb29rIGZvciBKU09OIGFuZCBKV1QgaW4gU0lQLiAgWW91IHdv bid0IGZpbmQgaXQuICBUaGF0IG1lYW5zIHRoYXQgaXQgaXMgYW4gYWRkZWQgbGF5ZXIgb2Ygc3Bl Y2lmaWNhdGlvbi4gIE9yLCBpbiB0aGlzIGNhc2UsIHNwZWNpZmljYXRpb25zLiAgQW5kIHNpbmNl IEpTT04gYW5kIEpXVCBhcmUgdGhlaXIgb3duIGVudmlyb25tZW50cywgdGhhdCBtZWFucyB0aGVy ZSBpcyBhIGxlYXJuaW5nIGN1cnZlIGFuZCBvdGhlciBiYWdnYWdlIHRvIGNhcnJ5LCBiZWZvcmUg aXQgaXMgdXNlZnVsIHRvIFNJUCBhbmQgU1RJUi4NCg0KRXZlbiBiZXR0ZXIgaXMgdGhhdCBldmVu IHRoZSBTVElSIHNwZWNpZmljYXRpb24gZm9yIFNJUCBkb2VzIG5vdCByZXF1aXJlIHVzaW5nIEpX VCBvciBKU09OLiAgTm90ZSB0aGF0IHBwdCBpcyBvcHRpb25hbC4gIFRoaXMgYWRkcyB0byB0aGUg dmlldyB0aGF0LCBhdCBiZXN0LCBKV1QvSlNPTiBpcyByZWFsbHkganVzdCBhbiBhYnN0cmFjdGlv biBmb3IgU1RJUi4NCg0KQnV0IGluIGZhY3QgdGhlIGZhY3QgdGhhdCBwcHQgaXMgb3B0aW9uYWwg cmVhbGx5IG1lYW5zIHRoYXQgdGhlIFNJUCBTVElSIHNwZWNpZmljYXRpb24gaGFzIGFkZGVkIGNv bXBsZXhpdHksIHdpdGggdmVyeSB1bmNsZWFyIGJlbmVmaXQuDQoNCkFzIGZvciB0aGUgdW5kZXJs eWluZyBqdXN0aWZpY2F0aW9uIGZvciB0aGUgUGFzc3BvcnQgbW9kZWwsIHJlZmVyZW5jZXMgdG8g YnJvYWRlciBhcHBsaWNhYmlsaXR5IGFyZSBhbHdheXMgYXBwZWFsaW5nLCBidXQgbGFja2luZyBj b25jcmV0ZSBzcGVjaWZpY2F0aW9ucyBhbmQgY2xlYXIsIGRvY3VtZW50ZWQgaW50ZW50aW9ucyBv ZiB1c2UgLS0gaW5jbHVkaW5nIGEgY2xlYXIgZXhwbGFuYXRpb24gb2YgdGhlIGJlbmVmaXQgdG8g YmUgZ2FpbmVkIGJ5IHRoZSBhYnN0cmFjdGlvbiAtLSB0aGV5IHR1cm4gb3V0IG1vc3RseSB0byBi ZSBhIGRpc3RyYWN0aW9uIGZyb20gdGhlIGltbWVkaWF0ZSBjb25jZXJuLCBuYW1lbHkgYWRkZWQg Y29tcGxleGl0eSB0byB0aGUgbWFpbnN0cmVhbSB1c2UuDQoNCkFnYWluOiBKU09OL0pXVCBhZGRz IGEgbGF5ZXIgKG9yIHR3bykgb2YgbWVjaGFuaXNtIHRoYXQgYWxtb3N0IGNlcnRhaW5seSBpcyBu b3QgbmVlZGVkIGFuZCBhbG1vc3QgY2VydGFpbmx5IGFkZHMgcHJvYmxlbWF0aWMgY29tcGxleGl0 eSB0byB0aGUgc3BlY2lmaWNhdGlvbiwgcHJvYmFibHkgdG8gdGhlIHBvaW50IG9mIGltcGVkaW5n IHJlYWRlciBjb21wcmVoZW5zaW9uLg0KDQpBcyBJJ3ZlIG5vdGVkLCB0aGUgdW5kZXJseWluZyB0 YXNrIGhlcmUgaXMgcHJldHR5IHN0cmFpZ2h0Zm9yd2FyZDoNCg0KICAgKiAgRGVmaW5lIGEgbWVj aGFuaXNtIGZvciBmaW5kaW5nIGFuZCB2YWxpZGF0aW5nIGEgcHVibGljIGtleS4NCg0KICAgKiAg RGVjaWRlIG9uIHNjb3BlIGFuZCBjYW5vbmljYWxpemF0aW9uIG9mIGRhdGEgdG8gYmUgc2lnbmVk LiBEZWZpbmUNCiAgICAgIGEgc2lnbmluZyBtZWNoYW5pc20uDQoNCiAgICogIERlZmluZSBhIHZh bGlkYXRpb24gbWVjaGFuaXNtLg0KDQogICAqICBEZWNpZGUgaG93IHRvIGRlYWwgd2l0aCBwYXJ0 aWFsIGFkb3B0aW9uDQoNCiAgICogIERlY2lkZSBob3cgdG8gZGVhbCB3aXRoIGJyb2tlbiBzaWdu YXR1cmVzLg0KDQoNCk1heWJlIGEgbGl0dGxlIG1vcmUgdGhhbiB0aGlzLCBidXQgbm90IG11Y2gu DQoNCg0KZC8NCg0KLS0NCg0KICBEYXZlIENyb2NrZXINCiAgQnJhbmRlbmJ1cmcgSW50ZXJuZXRX b3JraW5nDQogIGJiaXcubmV0PGh0dHA6Ly9iYml3Lm5ldD4NCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0DQpzdGlyQGll dGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9zdGlyDQoNCg== --_000_7594FB04B1934943A5C02806D1A2204B4BC29AD9ESESSMB209erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLmhvZW56Yg0KCXttc28t c3R5bGUtbmFtZTpob2VuemI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFG NDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21w b3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3Rl eHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28t ZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIu MHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIx MDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIg Lz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxh bmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SGkgRGF2ZSw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkkgYWdyZWUgd2l0aCBFa3IsIGFuZCBiZWluZyBhYmxl IHRvIHVzZSBzb21ldGhpbmcgcHJlLWV4aXN0aW5nIGlzIHRoZSByZWFzb24gSSBhc2tlZCB0aGUg cGFzc3BvcnQgYXV0aG9ycyB0byBjb25zaWRlciBKV1QuIElmIHlvdSB0aGluaw0KIHRoZXJlIGlz IHNvbWV0aGluZyBiZXR0ZXIgcHJlLWV4aXN0aW5nLCBwbGVhc2Ugc2F5IHNvLCBidXQgaWYgeW91 IHdhbnQgdG8gZG8gc29tZXRoaW5nIGZyb20gc2NyYXRjaCBJIHRoaW5rIHdl4oCZZCBuZWVkIHNv bWUgcmVhbGx5IGdvb2QganVzdGlmaWNhdGlvbiBmb3IgdGhhdC4gSSBkb27igJl0IGFncmVlIHdp dGggeW91ciBlYXJsaWVyIHN0YXRlbWVudHMgdGhhdCBKV1QgaXMgY29tcGxleCwgYW5kIHRoZXJl IGFyZSB0b25zIG9mIHRvb2xzIHRvIHRlc3QNCiBhbmQgdmVyaWZ5IEpXVHMuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5JbiBCZXJsaW4gSSBkaWQgcmFpc2UgYW4gaXNz dWUgb24gaG93IFNUSVIgdXNlcyBKV1QgaW4gU0lQICh0aGUgZW5jb2RlZCBvYmplY3QgaXMg4oCc c3BsaXQgdXDigJ0sIGFuZCBkaWZmZXJlbnQgcGllY2VzIGFyZSBwbGFjZWQgaW4gZGlmZmVyZW50 DQogU0lQIGVsZW1lbnRzKSwgYnV0IEpvbiBwcm9taXNlZCB0byBtYWtlIHN1cmUgaXTigJlzIGNs YXJpZmllZCBhbmQgd2VsbCBleHBsYWluZWQgaW4gdGhlIG5leHQgdmVyc2lvbiBvZiB0aGUgYmlz IGRyYWZ0LCBzbyBJIHRoaW5rIHdlIHNob3VsZCBnaXZlIGhpbSBhIGNoYW5jZSB0byBkbyB0aGF0 LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+UmVnYXJkcyw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkNocmlzdGVyPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxFbmRDb21wb3NlIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9hPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4gc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZ10N CjxiPk9uIEJlaGFsZiBPZiA8L2I+RXJpYyBSZXNjb3JsYTxicj4NCjxiPlNlbnQ6PC9iPiAyMSBB dWd1c3QgMjAxNiAxODozNzxicj4NCjxiPlRvOjwvYj4gRGF2ZSBDcm9ja2VyICZsdDtkY3JvY2tl ckBiYml3Lm5ldCZndDs8YnI+DQo8Yj5DYzo8L2I+IElFVEYgU1RJUiBNYWlsIExpc3QgJmx0O3N0 aXJAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbc3Rpcl0gSldUL0pTT04g KHdhcyAtIFJlOiBSZXZpZXcgb2Y6IGRyYWZ0LWlldGYtc3Rpci1wYXNzcG9ydC0wNSk8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGF2ZSw8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hlbmV2ZXIgd2Ugd2Fu dCB0byBhZGQgc29tZSBjcnlwdG9ncmFwaGljIGZ1bmN0aW9uYWxpdHkgdG8gYSBwcm90b2NvbCBb MF0gKGVzcGVjaWFsbHk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPndoZW4gaXQncyBtZXNzYWdpbmcvb2JqZWN0IHNlY3VyaXR5IGZ1bmN0aW9uYWxp dHkpIHdlIGhhdmUgdG8gYXNrIHdoZXRoZXIgaXQgd291bGQgYmU8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmJldHRlciB0byBkZWZpbmUgc29tZXRo aW5nIG5ldywgc3BlY2lmaWMgdG8gdGhlIHByb3RvY29sLCBhbmQgaG9wZWZ1bGx5IHNpbXBsZSwg b3IgcmV1c2U8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPnNvbWV0aGluZyBwcmUtZXhpc3RpbmcsIGdlbmVyaWMsIGFuZCBwcmVzdW1hYmx5IG1vcmUg Y29tcGxpY2F0ZWQuIEluIG15IGV4cGVyaWVuY2UsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj50aGUgaGlzdG9yeSBvZiB0aG9zZSB3aG8gdGFrZSB0 aGUgZm9ybWVyIGFwcHJvYWNoIGlzIHRoYXQgd2UgZmluZCBvdXJzZWx2ZXMgcmVpbnZlbnRpbmc8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmEgYnVu Y2ggb2Ygc3R1ZmYgYW5kIHRoYXQgaXQncyBub3QgYXMgc2ltcGxlIGFzIHdlIGhvcGVkIFsxXVsy XTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5H aXZlbiB0aGUgZGlmZmljdWx0eSBvZiBjb3JyZWN0bHkgc3BlY2lmeWluZyBhbmQgaW1wbGVtZW50 aW5nIHRoaXMga2luZCBvZiBmdW5jdGlvbmFsaXR5LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSdkIGZhciBwcmVmZXIgdG8gc3RpY2sgd2l0aCBh IHByZS1leGlzdGluZyBjb21wb25lbnQuIEl0IGRvZXNuJ3QgaGF2ZSB0byBiZSBKU09OIG9mIGNv dXJzZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ KGZvciBpbnN0YW5jZSwgSSBoYXZlIG5vIG9waW5pb24gb24gaWYgQ09TRSB3b3VsZCBiZSBiZXR0 ZXIpIGJ1dCBJIHdvdWxkIG5vdCBiZSBpbiBmYXZvcjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+b2YgZGVmaW5pbmcgc29tZXRoaW5nIHNwZWNpZmlj IGhlcmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPi1Fa3I8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+WzBdIE9yLCBJIGd1ZXNzLCBpbiBhIGJ1bmNoIG9mIG90aGVyIGNhc2VzLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+WzFdIEluZGVlZCwg Sk9TRSBpcyBpbiBzb21lIHJlc3BlY3RzIGFuIGF0dGVtcHQgdG8gYXBwbHkgdGhpcyB0cmVhdG1l bnQgdG8gQ01TLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+WzJdIEFub3RoZXIgZXhhbXBsZSBpcyB0aGUgY3VycmVudCBIVFRQQklTIGVuY3J5cHRp b24gc3BlYywgd2hpY2ggaGFzIHJhdGhlciBleHBhbmRlZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ZnJvbSBpdHMgc2ltcGxlIG9yaWdpbnMuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIFdlZCwgQXVnIDMsIDIwMTYgYXQgMToyNSBQTSwgRGF2ZSBDcm9ja2VyICZsdDs8YSBo cmVmPSJtYWlsdG86ZGhjQGRjcm9ja2VyLm5ldCIgdGFyZ2V0PSJfYmxhbmsiPmRoY0BkY3JvY2tl ci5uZXQ8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBj bSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gNy8y OS8yMDE2IDI6MTEgUE0sIERhdmUgQ3JvY2tlciB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+T24gNy8yOS8yMDE2IDEwOjQ2IEFNLCBQZXRlcnNvbiwgSm9uIHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHdvdWxkbid0IHNheSBpdCdzIGEgY29ycmVjdGlv biB0byB0aGUgU1RJUiBjaGFydGVyIC0gdGhlIGNoYXJ0ZXIgd2FzPGJyPg0KYWx3YXlzIGNsZWFy IHRoYXQgaXQgd2FzIG5vdCBsaW1pdGVkIHRvIFNJUCAoc2VlIHRoZSBiaXRzIGFib3V0ICZxdW90 O29uZSBvcjxicj4NCm1vcmUgbm9uLVNJUCBob3BzJnF1b3Q7IGFuZCAmcXVvdDtvdXQtb2YtYmFu ZCBtZWNoYW5pc20mcXVvdDsgaW4gdGhlIGNoYXJ0ZXIpLiBCdXQgZ2l2ZW48YnI+DQp0aGF0IG91 ciBvcmlnaW5hbCBzaWduaW5nIG1lY2hhbmlzbSB3YXMsIGFzIEkgc2FpZCwgYSBjb25jYXRlbmF0 aW9uIG9mPGJyPg0KU0lQPGJyPg0KaGVhZGVyIGZpZWxkIHZhbHVlcywgdGhlIGludGVydmVudGlv biB3YXMgdGhhdCBvdGhlciBwcm90b2NvbHMgd291bGQgbmVlZDxicj4NCnNvbWV0aGluZyBsZXNz IGJvdW5kIHRvIFNJUC4gSldUIHR1cm5lZCBvdXQgdG8gYmUgdGhlIHNvbHV0aW9uIHRoYXQgdGhl PGJyPg0KZ3JvdXAgaGFkIGNvbnNlbnN1cyB0byBhZG9wdC48bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCkpXVCBoYXMgbm90aGluZyB0byBk byB3aXRoIFNJUC4mbmJzcDsgU28gd2hlbiBhcHBsaWVkIHRvIGEgU0lQIGNvbnRleHQsIGl0J3M8 YnI+DQplbnRpcmVseSBhcnRpZmljaWFsLiZuYnNwOyBBbmQgeWVzLCBJIG5vdGVkIHRoZSB2aWV3 cyB0aGF0IHRob3VnaHQgaXQgc2ltcGxlcjxicj4NCm9yIGVxdWl2YWxlbnQgdG8gdGhlIGNvbXB1 dGVkIHN0cmluZywgYnV0IGNvdWxkIG5vdCBzZWUgdGhlIGV4cGxpY2l0PGJyPg0KbG9naWMgdGhh dCBtYWRlIEpXVCBhIGJldHRlciBjaG9pY2UsIG5vIGRvZXMgaXQgc2VlbSBvYnZpb3VzIHRvIG1l Ljxicj4NClF1aXRlIHRoZSBjb250cmFyeS48YnI+DQo8YnI+DQpOb3RlIHRoYXQgZHVyaW5nIHRo ZSB3ZyBzZXNzaW9uIGluIEJlcmxpbiB0aGVyZSB3YXMgL3N0aWxsLyBxdWVzdGlvbjxicj4NCmFi b3V0IHdoZXJlIHRvIHB1dCB0aGUgSldUIGluZm9ybWF0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KRm9sa3MsPGJyPg0K PGJyPg0KSSdtIGNpdGluZyB0aGUgYWJvdmUgdGV4dCwgZm9yIGRpc2N1c3NpbmcgdGhlIGNvbmNl cm4gSSByYXNpZWQgYWJvdXQgSldUL0pTT04gdXNlIGluIFBhc3Nwb3J0LCBiZWNhdXNlIHRoYXQg d2FzIHRoZSBmaXJzdCB0aW1lIEkgY3JpdGljaXplZCBpdCwgd2hpY2ggd2FzIHNldmVyYWwgcm91 bmRzIG9mIHBvc3RpbmdzIGFmdGVyIEkgc2VudCBteSByZXZpZXcuJm5ic3A7IFRoYXQgaXMsIGl0 IHdhcyAvbm90LyBwYXJ0IG9mIG15IHJldmlldy4mbmJzcDsgSSBtYWRlIGENCiBjb25zY2lvdXMg Y2hvaWNlIHRvIGxlYXZlIHRoYXQgY29uY2VybiBvdXQsIGFsdGhvdWdoIEkgYWxyZWFkeSBzYXcg aXQgYXMgbGlrZWx5IHByb2JsZW1hdGljLjxicj4NCjxicj4NCk9uIGl0cyBmYWNlLCB5ZXMgaXQg bG9va3MgbGlrZSBhIHJlYXNvbmFibGUgY2hvaWNlLiZuYnNwOyBJdCdzIHByZS1leGlzdGluZyB0 ZWNobm9sb2d5IGFuZCBpdCBsb29rcyBjbGVhbi4mbmJzcDsgVGhlIGNvbmNlcm5zIGRldmVsb3Ag aW4gaXRzIGFwcGxpY2F0aW9uLCBub3QgaXRzIGNvbmNlcHQuPGJyPg0KPGJyPg0KTG9vayBmb3Ig SlNPTiBhbmQgSldUIGluIFNJUC4mbmJzcDsgWW91IHdvbid0IGZpbmQgaXQuJm5ic3A7IFRoYXQg bWVhbnMgdGhhdCBpdCBpcyBhbiBhZGRlZCBsYXllciBvZiBzcGVjaWZpY2F0aW9uLiZuYnNwOyBP ciwgaW4gdGhpcyBjYXNlLCBzcGVjaWZpY2F0aW9ucy4mbmJzcDsgQW5kIHNpbmNlIEpTT04gYW5k IEpXVCBhcmUgdGhlaXIgb3duIGVudmlyb25tZW50cywgdGhhdCBtZWFucyB0aGVyZSBpcyBhIGxl YXJuaW5nIGN1cnZlIGFuZCBvdGhlciBiYWdnYWdlIHRvIGNhcnJ5LA0KIGJlZm9yZSBpdCBpcyB1 c2VmdWwgdG8gU0lQIGFuZCBTVElSLjxicj4NCjxicj4NCkV2ZW4gYmV0dGVyIGlzIHRoYXQgZXZl biB0aGUgU1RJUiBzcGVjaWZpY2F0aW9uIGZvciBTSVAgZG9lcyBub3QgcmVxdWlyZSB1c2luZyBK V1Qgb3IgSlNPTi4mbmJzcDsgTm90ZSB0aGF0IHBwdCBpcyBvcHRpb25hbC4mbmJzcDsgVGhpcyBh ZGRzIHRvIHRoZSB2aWV3IHRoYXQsIGF0IGJlc3QsIEpXVC9KU09OIGlzIHJlYWxseSBqdXN0IGFu IGFic3RyYWN0aW9uIGZvciBTVElSLjxicj4NCjxicj4NCkJ1dCBpbiBmYWN0IHRoZSBmYWN0IHRo YXQgcHB0IGlzIG9wdGlvbmFsIHJlYWxseSBtZWFucyB0aGF0IHRoZSBTSVAgU1RJUiBzcGVjaWZp Y2F0aW9uIGhhcyBhZGRlZCBjb21wbGV4aXR5LCB3aXRoIHZlcnkgdW5jbGVhciBiZW5lZml0Ljxi cj4NCjxicj4NCkFzIGZvciB0aGUgdW5kZXJseWluZyBqdXN0aWZpY2F0aW9uIGZvciB0aGUgUGFz c3BvcnQgbW9kZWwsIHJlZmVyZW5jZXMgdG8gYnJvYWRlciBhcHBsaWNhYmlsaXR5IGFyZSBhbHdh eXMgYXBwZWFsaW5nLCBidXQgbGFja2luZyBjb25jcmV0ZSBzcGVjaWZpY2F0aW9ucyBhbmQgY2xl YXIsIGRvY3VtZW50ZWQgaW50ZW50aW9ucyBvZiB1c2UgLS0gaW5jbHVkaW5nIGEgY2xlYXIgZXhw bGFuYXRpb24gb2YgdGhlIGJlbmVmaXQgdG8gYmUgZ2FpbmVkIGJ5DQogdGhlIGFic3RyYWN0aW9u IC0tIHRoZXkgdHVybiBvdXQgbW9zdGx5IHRvIGJlIGEgZGlzdHJhY3Rpb24gZnJvbSB0aGUgaW1t ZWRpYXRlIGNvbmNlcm4sIG5hbWVseSBhZGRlZCBjb21wbGV4aXR5IHRvIHRoZSBtYWluc3RyZWFt IHVzZS48YnI+DQo8YnI+DQpBZ2FpbjogSlNPTi9KV1QgYWRkcyBhIGxheWVyIChvciB0d28pIG9m IG1lY2hhbmlzbSB0aGF0IGFsbW9zdCBjZXJ0YWlubHkgaXMgbm90IG5lZWRlZCBhbmQgYWxtb3N0 IGNlcnRhaW5seSBhZGRzIHByb2JsZW1hdGljIGNvbXBsZXhpdHkgdG8gdGhlIHNwZWNpZmljYXRp b24sIHByb2JhYmx5IHRvIHRoZSBwb2ludCBvZiBpbXBlZGluZyByZWFkZXIgY29tcHJlaGVuc2lv bi48YnI+DQo8YnI+DQpBcyBJJ3ZlIG5vdGVkLCB0aGUgdW5kZXJseWluZyB0YXNrIGhlcmUgaXMg cHJldHR5IHN0cmFpZ2h0Zm9yd2FyZDo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7KiZuYnNwOyBE ZWZpbmUgYSBtZWNoYW5pc20gZm9yIGZpbmRpbmcgYW5kIHZhbGlkYXRpbmcgYSBwdWJsaWMga2V5 Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsqJm5ic3A7IERlY2lkZSBvbiBzY29wZSBhbmQgY2Fu b25pY2FsaXphdGlvbiBvZiBkYXRhIHRvIGJlIHNpZ25lZC4gRGVmaW5lPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgYSBzaWduaW5nIG1lY2hhbmlzbS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 KiZuYnNwOyBEZWZpbmUgYSB2YWxpZGF0aW9uIG1lY2hhbmlzbS48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7KiZuYnNwOyBEZWNpZGUgaG93IHRvIGRlYWwgd2l0aCBwYXJ0aWFsIGFkb3B0aW9uPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwOyombmJzcDsgRGVjaWRlIGhvdyB0byBkZWFsIHdpdGggYnJv a2VuIHNpZ25hdHVyZXMuPGJyPg0KPGJyPg0KPGJyPg0KTWF5YmUgYSBsaXR0bGUgbW9yZSB0aGFu IHRoaXMsIGJ1dCBub3QgbXVjaC48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJyPg0KPGJy Pg0KPGJyPg0KPHNwYW4gY2xhc3M9ImhvZW56YiI+ZC88L3NwYW4+PGJyPg0KPGJyPg0KPHNwYW4g Y2xhc3M9ImhvZW56YiI+LS0gPC9zcGFuPjxicj4NCjxicj4NCjxzcGFuIGNsYXNzPSJob2VuemIi PiZuYnNwOyBEYXZlIENyb2NrZXI8L3NwYW4+PGJyPg0KPHNwYW4gY2xhc3M9ImhvZW56YiI+Jm5i c3A7IEJyYW5kZW5idXJnIEludGVybmV0V29ya2luZzwvc3Bhbj48YnI+DQo8c3BhbiBjbGFzcz0i aG9lbnpiIj4mbmJzcDsgPC9zcGFuPjwvc3Bhbj48YSBocmVmPSJodHRwOi8vYmJpdy5uZXQiIHRh cmdldD0iX2JsYW5rIj5iYml3Lm5ldDwvYT48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJy Pg0KPGJyPg0KPHNwYW4gY2xhc3M9ImhvZW56YiI+X19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188L3NwYW4+PGJyPg0KPHNwYW4gY2xhc3M9ImhvZW56YiI+c3Rp ciBtYWlsaW5nIGxpc3Q8L3NwYW4+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzdGlyQGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+c3RpckBpZXRmLm9yZzwvYT48c3BhbiBzdHlsZT0iY29s b3I6Izg4ODg4OCI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vc3RpciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vc3RpcjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_7594FB04B1934943A5C02806D1A2204B4BC29AD9ESESSMB209erics_-- From nobody Sun Aug 21 09:27:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B4B112D7B2 for ; Sun, 21 Aug 2016 09:27:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.701 X-Spam-Level: X-Spam-Status: No, score=0.701 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bbiw.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iqmsiIeFrJsS for ; Sun, 21 Aug 2016 09:27:07 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF5AA12D7B8 for ; Sun, 21 Aug 2016 09:27:06 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7LGRFsW025934 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sun, 21 Aug 2016 09:27:15 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=bbiw.net; s=default; t=1471796835; bh=TwrvWKFllZcpCbHIDQ6bzfYvrmPeJ+RAAdSWjhoW6RA=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=VY1PHQchesvq599UwYit/INrthpuXKi+KIQOslUIpRXwdbiXXN5y5rOynCqQOEkCJ jFkzS/D6GyWCW9slG9hRD6zPUwZhN8e3Uet+mPk0CtXgVpkzoOllW6HQ0nCwjaBHLQ TAyIwA309jitKBZg0+7Fgn5mHHqq9qKI6Wvz1fXY= To: Russ Housley References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <366a7ee0-cce7-4bed-951c-05415676dd91@bbiw.net> <3769C5C0-4C08-4DA2-A1BF-2D3C91743750@vigilsec.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Sun, 21 Aug 2016 09:26:48 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <3769C5C0-4C08-4DA2-A1BF-2D3C91743750@vigilsec.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 16:27:08 -0000 On 8/21/2016 8:26 AM, Russ Housley wrote: > Your quote dropped a lot of context. I said: Yes, quite intentionally, so that the focus would be on what I was choosing to respond to. > If there is a technical problem, lets identify it and fix it. If > there is a lack of clarity, lets fix that too. 1. You tasked detailed attention to my reviews as a background (behind the scenes) task for the editors. 2. You imposed an additional task on me, as I said. > However, WG Last > Call is not the time to revisit each decision that brought the WG to > this point. I responded to exactly this point. I'm not clear what the point of your repeating your original statement is, particularly since you seem not to be responding to the specifics of my note. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Aug 21 09:27:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86FA712D7B2 for ; Sun, 21 Aug 2016 09:27:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.701 X-Spam-Level: X-Spam-Status: No, score=0.701 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7qZk5aFpDA4Y for ; Sun, 21 Aug 2016 09:27:38 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C39D312D7A9 for ; Sun, 21 Aug 2016 09:27:38 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7LGRld2025953 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sun, 21 Aug 2016 09:27:47 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471796867; bh=b+LDkwKnj+/b9saQf9XHMAcgTP450WvwAnjqxOe2xBQ=; h=From:Subject:To:References:Cc:Reply-To:Date:In-Reply-To:From; b=iRitsMox9mern+q6ABgEfd4tbvVEDf9Z5l0Z6bGry0fX40akedut27lPZCmMKSjGZ 4kY6BQYuyuALGpWlZl8yT2mWFz/tDS7GTeC5+/KbucEXG8qi31o4X8yZD3DOJDPchD zLE0ZZmS4Tcxa0wtFs7hYduJOQNFM0wc8KEDAs00= From: Dave Crocker To: Russ Housley References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <366a7ee0-cce7-4bed-951c-05415676dd91@bbiw.net> <3769C5C0-4C08-4DA2-A1BF-2D3C91743750@vigilsec.com> Organization: Brandenburg InternetWorking Message-ID: <97855867-104b-7357-d0b0-e90c2b5cd22e@dcrocker.net> Date: Sun, 21 Aug 2016 09:27:21 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <3769C5C0-4C08-4DA2-A1BF-2D3C91743750@vigilsec.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Setting Direction for the STIR WG Last Call X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 16:27:39 -0000 On 8/21/2016 8:26 AM, Russ Housley wrote: > Your quote dropped a lot of context. I said: Yes, quite intentionally, so that the focus would be on what I was choosing to respond to. > If there is a technical problem, lets identify it and fix it. If > there is a lack of clarity, lets fix that too. 1. You tasked detailed attention to my reviews as a background (behind the scenes) task for the editors. 2. You imposed an additional task on me, as I said. > However, WG Last > Call is not the time to revisit each decision that brought the WG to > this point. I responded to exactly this point. I'm not clear what the point of your repeating your original statement is, particularly since you seem not to be responding to the specifics of my note. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Aug 21 09:30:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0161112D7B6 for ; Sun, 21 Aug 2016 09:30:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.701 X-Spam-Level: X-Spam-Status: No, score=0.701 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r_vMglBKPLEZ for ; Sun, 21 Aug 2016 09:29:59 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6819812D7B3 for ; Sun, 21 Aug 2016 09:29:59 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7LGU80i026000 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sun, 21 Aug 2016 09:30:08 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471797008; bh=759XVyMMke5BAUmNVuqes/r9E/hM8AyDw8nwiFxaR30=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=PE9xTDSjgWXX/xAc6hHZJmGybn9rJzEzE8VH5hzZZIBPBoNBpzJvukAsMPQUZD5S+ Iw+60SZwfp1MxMmrrFLxhjM2N81o11LFhfl5vaBQW2acjTVMcArFUy2zFIA5mITyrj RFFJn437cGVDFoKQziIFUaSFfoHNKKAl1setCVgQ= To: Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Sun, 21 Aug 2016 09:29:41 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 16:30:00 -0000 On 8/21/2016 8:37 AM, Eric Rescorla wrote: > Dave, > > Whenever we want to add some cryptographic functionality to a > protocol [0] (especially when it's messaging/object security > functionality) we have to ask whether it would be better to define > something new, specific to the protocol, and hopefully simple, or > reuse something pre-existing, generic, and presumably more > complicated. In my experience, the history of those who take the > former approach is that we find ourselves reinventing a bunch of > stuff and that it's not as simple as we hoped [1][2] We agree. I'm not sure what the point of saying here is, since it is highly consonant with points I have posted here more than once. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Aug 21 09:52:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9517F12B04B for ; Sun, 21 Aug 2016 09:52:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pPH5h5ZJQBaG for ; Sun, 21 Aug 2016 09:52:43 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id DF52C12D0B0 for ; Sun, 21 Aug 2016 09:52:42 -0700 (PDT) Received: (qmail 7364 invoked by uid 0); 21 Aug 2016 16:52:41 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy4.mail.unifiedlayer.com with SMTP; 21 Aug 2016 16:52:41 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id Zsnc1t01w1MNPNq01snfyF; Sun, 21 Aug 2016 10:47:40 -0600 X-Authority-Analysis: v=2.1 cv=aqYhV0pV c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=zQP7CpKOAAAA:8 a=9bOKTyGbAAAA:8 a=scBmumm3AAAA:8 a=eoAorcln8ZU_a4lfJj4A:9 a=X4GqvSjjyTSO01X2:21 a=3aKiqiPSUsFBJ3ZL:21 a=QEXdDO2ut3YA:10 a=qM39cor4HRgA:10 a=K2lU_Ab98eoA:10 a=uKItvRtXlKoA:10 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=obGFCI3_7AGB19sD6zJV:22 a=2MnCfuFsdWRFdRCRZFaS:22 a=ef56qr_8hkesV0SKvPxj:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:Message-ID: To:From:Subject:Date; bh=HX8dzo3ygPwg4RPJZvJgN7QfwN89ICqhxC204F5ZvUM=; b=GGSB 6ZVX7QAq8DGmHaqgi8BYe9lpSRujz1pIe3hl79QFipQxyGC22UfzDP5Ff+2k1xTMIix67UgK+ZNN2 yxtkuHYmCdAENbsbhiIdqDVaNa5HnmfVFE7aEMxT13hVXez; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:58444 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bbVuM-0002Ux-Mq for stir@ietf.org; Sun, 21 Aug 2016 10:47:38 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sun, 21 Aug 2016 12:47:36 -0400 From: Richard Shockey To: "stir@ietf.org" Message-ID: <25F993F2-43FC-45EA-B30E-08881DC27765@shockey.us> Thread-Topic: [stir] Robocall Strike Force and the SIP Forum Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bbVuM-0002Ux-Mq X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:58444 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Robocall Strike Force and the SIP Forum X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 16:52:45 -0000 The ATIS SIP Forum Task Force is JV between our respective organizations. = Work in progress is available to all relevant members of ATIS and the SIP F= orum which in our case is a =E2=80=9Cparticipant member=E2=80=9D that have signed up on = the SIP Forum web site. For the Forum there is no cost to participate.=20 http://www.sipforum.org/content/view/17/47/ ATIS is different as you all know.=20 After that you sign up to the NNI list and you get eventually access to the= document repository which ATIS has kindly agreed to host. =20 By joint agreement the TF operates under ATIS IPR rules and separately we b= allot our documents when consensus is reached. All the joint work product is eventually made fully public as we have done = with the Network to Network Interface profiles and all SIP Forum Recommendat= ions. In addition, the JV usually takes the liberty of filing the documents= with the FCC directly, in the normal ex parte manner, so they are on the pu= blic record as well.=20 On 8/21/16, 9:22 AM, "stir on behalf of DOLLY, MARTIN C" wrote: Paul, =20 Documents can be found here https://access.atis.org/apps/org/workgroup/= ipnni/documents.php , but please use this list to comment, nni@sipforum.org = not the STIR list. =20 Thank you, =20 Martin =20 -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@alum.mit.edu]=20 Sent: Saturday, August 20, 2016 6:53 PM To: DOLLY, MARTIN C ; stir@ietf.org Subject: Re: [stir] Robocall Strike Force =20 On 8/20/16 11:41 AM, DOLLY, MARTIN C wrote: > Being it is joint effort of ATIS and SIP Forum, if you are a member o= f either, yes. SIP Forum is quite open. But documents are about to be update= d. =20 I am. I didn't see these among the NNI documents, and didn't find any o= ther likely place. Can you supply a URI to where they are? =20 Thanks, Paul =20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Paul Kyzivat > Sent: Saturday, August 20, 2016 11:18 AM > To: stir@ietf.org > Subject: Re: [stir] Robocall Strike Force > > Martin, > > Are these documents (both the SHAKEN stuff and the Display Framework)= publicly available? > > I looked on the sip forum web site but didn't find them. > > Thanks, > Paul > > On 8/20/16 8:05 AM, DOLLY, MARTIN C wrote: >> Tony, >> >> >> >> For deployment in the USA, this ITU work would be totally useless. >> >> >> >> The ATIS - SIP Forum is has a profile of the IETF STIR RFC drafts in= =20 >> the SHAKEN Framework document. >> >> Further, SHAKEN telecom industry framework - Signature-based Handlin= g=20 >> of Asserted Information using Tokens >> >> 1. Defines the architecture and NNI dependencies around the usa= ge >> of the PASSporT and 4474bis based framework >> >> 2. Defines the security model around management and usage of >> certificates used to sign and assert caller identity information >> >> >> >> In addition, there is a Display Framework document, that defines the= =20 >> requirements for signaling the verification information from the=20 >> network to the user device and the requirements for what is displaye= d=20 >> on the user device independent of technology. >> >> >> >> Service Requirements to support the above is being brought into the=20 >> 3GPP >> SA1 meeting in San Francisco next week, 8/22-26 (Being led by Greg=20 >> Schumacher, Sprint). >> >> >> >> I will be bring in a discussion paper and CRs into the October CT1=20 >> meeting in China with the support of Nokia and Ericsson (and=20 >> hopefully the other USA companies). >> >> >> >> WRT display on the user device, there will be a combination of=20 >> vendors getting requirements based on the ATIS-SIP Forum Display=20 >> Framework given to them as part of ecosystem participation in the FC= C=20 >> Strike Force and/or direct requirements from carriers. In addition,=20 >> further documentation to in GSMA, Cable Labs, etc... specifications = may/will occur. >> >> >> >> Up to now, the coordination has been with the ATIS-SIP Forum=20 >> co-chairs/leaders and moving forward with the FCC Strike Force=20 >> Authentication Committee (co-chairs Chris Wendt and myself, so there= =20 >> the transition should be seamless) >> >> >> >> With the above work plan I do not see a role for the ITU on the=20 >> Caller ID Spoofing. >> >> >> >> Regards, >> >> >> >> *Martin C. Dolly* >> >> Lead Member of Technical Staff >> >> Core & Government/Regulatory Standards >> >> AT&T >> >> Cell: +1.609.903.3360 >> >> Email: _md3135@att.com _ >> >> >> >> >> >> *From:*Tony Rutkowski [mailto:tony@yaanatech.com] >> *Sent:* Friday, August 19, 2016 4:48 PM >> *To:* DOLLY, MARTIN C >> *Cc:* IETF STIR Mail List ; Paul Najarian=20 >> >> *Subject:* Re: [stir] Robocall Strike Force >> >> >> >> Hi Martin et al., >> >> It is worth noting that for the >> upcoming SG17 meeting, China's >> MIIT, China Unicom, and China mobile >> have proposed a new work item that >> is substantially related to stir work. >> Indeed, the proposal contains a useful comprehensive overview of=20 >> related SDO activities, including stir, and a gap analysis. >> >> I expect that the usdel to the meeting would appreciate any views=20 >> from the Task Force and stir participants on the contribution. In=20 >> addition, how does stir and the IETF anticipate collaborating with >> SG17 and the other SDOs going forward? >> The NWI seems almost certain to get approved, and may well be before= =20 >> WTSA 2016. >> >> best, >> --tony >> >> >> >> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Sun Aug 21 09:57:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0635C12B04B for ; Sun, 21 Aug 2016 09:57:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LmsgD0PZ-7bN for ; Sun, 21 Aug 2016 09:57:31 -0700 (PDT) Received: from mail-yb0-x22e.google.com (mail-yb0-x22e.google.com [IPv6:2607:f8b0:4002:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92C1612B040 for ; Sun, 21 Aug 2016 09:57:30 -0700 (PDT) Received: by mail-yb0-x22e.google.com with SMTP id d10so30416115ybi.1 for ; Sun, 21 Aug 2016 09:57:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=d4mvOLc9w6NiI3FGYQyltAfx2NNiMQAg5I/7OUXqWhM=; b=RElx5VZqokLY3qI0nzEBvrSovogTVVYx5+6Jl808GRxpgNbCzkaM9vHnGPUS87sP9Y 4fllSgFeYf7BrY6vmpzdVMCPDRUwzeeleRdQ4vY7OZHglcKp/5iym/pu8tNkQyhTmsAb 8kAsT48MGbtHn8HLnm5E38FP+65HzasDLUZMDZs551hH6svNNCYYiM2Rjhvut/6BQiuS Wv+D8/QRPgWzD/t+p4qAKLCbVTHIF4mxNjX9gZ+JI16IgKfuUaj2IJyD5If1Tvq/mUyt X7GTncOSqvb6eY0c6vs9Nkx+KXaIN7SFlLIF0vZ1LvrOTqX7eFr/hjuq93c1KGMf2d75 nIkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=d4mvOLc9w6NiI3FGYQyltAfx2NNiMQAg5I/7OUXqWhM=; b=dXcNea0jgG0qRe1eRgaGWvPv6wNlosnM/8QVlSsDgCCLeImHahqVGRQ76NWhsTKRtr CIwzerENAIESlvNm4m+wjU0Ls6RgfmE9BdZK+WfGZEUZtKQ3wiivvX6HkyqgtKm05h7+ e4gVwNOr02gwG5H1tDk1tCSJAUqrbDbCaW5PlCQBI4kiZOvx6ScJ4pKvjIKXDSOMn8km BanDhoP1hy43mjb7GfqU2E26XWRwWyBlWi8jJbf+OFzbpxjY1C60I/wZuFTYN8fDVWyS qOVd8G+GQhINeZCYhU7+2t6UyjpwPiuDZ5QQkQ+xaU4jsQw6KEv9w2xeK+/sbwY3yw2e Xvmw== X-Gm-Message-State: AEkoousMTYNo8QzeCiRc3WXe2jS2v/tJFm0pijuBeqqbQUIwBzqlsAXskLMCsOcOS+1cbxvxUYT8oieuVg9WJw== X-Received: by 10.37.32.134 with SMTP id g128mr13594661ybg.159.1471798649354; Sun, 21 Aug 2016 09:57:29 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sun, 21 Aug 2016 09:56:48 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Sun, 21 Aug 2016 09:56:48 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=001a1143f620ad3059053a97d343 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 16:57:38 -0000 --001a1143f620ad3059053a97d343 Content-Type: text/plain; charset=UTF-8 Hi Dave, Thanks for your thorough review. I'm going to mostly let Jon handle the first round (as you can see, he's done most of the work on this spec so far), especially as much of it seems to be detailed (and valuable) but straightforward comments. What wasn't clear to me was whether there were any major architectural or technical concerns in your review. I'm not asking you to write an entirely separate review or anything, but you obviously know what you think is important better than I do, so would it be possible for you to perhaps highlight anything you think is seriously architecturally/technically wrong by cutting-and-pasting into a separate message, or some other recourse? Thanks, -Ekr On Mon, Aug 8, 2016 at 8:46 PM, Dave Crocker wrote: > > > Review of: Authenticated Identity Management in the Session Initiation > Protocol (SIP) > ID: draft-ietf-stir-rfc4474bis-10.txt > Date: 8 August 2016 > Reviewer: D. Crocker > > > > > Summary > ------- > > SIP needs to support a mechanism that validates the identifier used for > the originator of the request. That is, to ensure that the entity that > placed the identification value into the field was authorized by its owner > to do so. This specifications is part of a collection of specifications > intended to enable such validation. > > > Taken on its own and also when taken with its companion documents, the > specifications are confusing and incomplete. It is quite far from being > ready for publication. > > > > Terminology is used inconsistently. It often is introduced with no > background or citation. Many uses of 'header' are probably supposed to be > 'header field'. My sense is that quite a bit of terminology is used > equally loosely. > > There is no integrative architectural description, so the reader has > difficulty understanding what all of the pieces are or how they fit > together. In fact is appears that the document itself gets confused on > this matter. > > Algorithms are all offered only as prose and often in a form mitigating > comprehension, such as tending towards negation or disjunction, which > humans process less well than affirmatives and conjunctions. From what I > can tell, the algorithms often are incomplete, but serious analysis is > difficult. > > The documents appear to rely on a reader's having quite a bit of prior > knowledge and are certainly not usable by an implementer who is not already > deeply embedded in the community that produced these specifications. My > impression is that being embedded won't suffice either, both from my > assessment of the documents' deficiencies and given back-channel comments I > have heard about the expectation of the work to be done after these > specifications are published. > > > Overall, the writing impedes comprehension and the document needs a very > diligent pass by a technical editor. I suspect this will uncover quite a > number of semantic deficiencies in the text. > > > There is a possible tendency to support more alternative behavior than > appropriate. Successful interoperability usually benefits from fewer > choices, not more. Common, mandatory canonicalization is an example. > > Credentials: the specification neither defines nor references a standard > for the specification of credentials, here. That means that the technical > details -- as distinct from the operational policies -- of credentials are > out of scope, although they are fundamental to proper operation of this > serve. This is a showstopper, in terms of specification completeness for > the service. > > How is the recipient to know what credential 'standard' is used? How does > this ensure interoperability between two participants who have not > interacted before? > > At base, these specifications appear intended to roughly chart out a > system structure, leaving most of the difficult work for later and > elsewhere. By way of example, there are few if any cross-organization key > management services on the Internet that demonstrate the utility needed > here. I am pretty sure that Web certs don't qualify. We know that DKIM's > operation does, of course. However DKIM strictly uses domain names as > identifiers and they conveniently align with their administrative > authorities, whereas telephone numbers do not... > > [[[ The mailing list just had an extensive regurgitation of critical > commentary about ENUM. What appears to be getting missed is that whatever > mechanism is going to be used for finding and validating keys is going to > have no operational history of reliability, safety or efficacy. ]]] > > There is remarkably little of the original RFC 4474 substance still in > this document. Calling it a bis is a bit like tearing all of a building > except its fireplace or its front door and calling that a remodeling. The > previous document does not have an installed base, so I strongly suggest > removing all references to it. It will allow some of the text to be > notably simpler and clearer. > > The document is heavy with forward references. These force the reader to > stop what they are in the middle of, try to hold that place, and look > forward to understand what they've just been interrupted from reading. As a > literary style, forward references create useful tension. In > specifications they just interrupt the flow. The document should be > reorganization so that integrative text comes /after/ the text describing > the pieces being integrated. And opening overview, design summary, or the > like can give a non-normative description of the architecture and the > service, so the reader has a basic sense of the big picture, before diving > into the detail of those to-be-integrated pieces. > > > > > Detail Comments > --------------- > > Abstract >> >> The baseline security mechanisms in the Session Initiation Protocol >> (SIP) are inadequate for cryptographically assuring the identity of >> the end users that originate SIP requests, especially in an >> > > an end user originating a SIP request > > cryptographically -> adequately > > 'cryptographically' is not the issue here That is, it is a means, not an > end. > > > interdomain context. This document defines a mechanism for securely >> > > 'interdomain' might suffice, but I suspect it's worth pressing the issue, > with language like "especially across trust boundaries" or somesuch. > > > identifying originators of SIP requests. It does so by defining a >> SIP header field for conveying a signature used for validating the >> identity, and for conveying a reference to the credentials of the >> signer. >> > ... > > 1. Introduction >> >> This document provides enhancements to the existing mechanisms for >> authenticated identity management in the Session Initiation Protocol >> (SIP, [RFC3261]). An identity, for the purposes of this document, is >> defined as either a SIP URI, commonly a canonical address-of-record >> (AoR) employed to reach a user (such as >> 'sip:alice@atlanta.example.com'), or a telephone number, which can be >> represented as either a TEL URI [RFC3966] or as the user portion of a >> SIP URI. >> > > I suspect it does not 'enhance' existing mechanisms as much as add a new > one. If the claim is actual enhancement, then what mechanism is enhanced > and how does authenticating origin constitute enhancement of it? My point > is that I believe the existing mechanisms will operate the same in the > future as they have been. This spec doesn't change them. > > Move definitions to an explicit terminology section, rather than putting > them into an Introduction. Also, does this document use the term > differently than elsewhere than SIP??? Then why is 'for the purposes of > this document' included? > > > [RFC3261] specifies several places within a SIP request where users >> can express an identity for themselves, most prominently the user- >> populated From header field. However, the recipient of a SIP request >> has no way to verify that the From header field has been populated >> appropriately, in the absence of some sort of cryptographic >> authentication mechanism. This leaves SIP vulnerable to a category >> of abuses, including impersonation attacks that enable robocalling >> and related problems as described in [RFC7340]. Ideally, a >> cryptographic approach to identity can provide a much stronger and >> less spoofable assurance of identity than the Caller ID services that >> the telephone network provides today. >> >> [RFC3261] encourages user agents (UAs) to implement a number of >> potential authentication mechanisms, including Digest authentication, >> Transport Layer Security (TLS), and S/MIME (implementations may >> support other security schemes as well). However, few SIP user >> agents today support the end-user certificates necessary to >> authenticate themselves (via S/MIME, for example), and for its part >> Digest authentication is limited by the fact that the originator and >> destination must share a prearranged secret. Practically speaking, >> originating user agents need to be able to securely communicate their >> users' identity to destinations with which they have no previous >> association. >> >> As an initial attempt to address this gap, [RFC4474] specified a >> means of signing portions of SIP requests in order to provide an >> identity assurance. However, RFC 4474 was in several ways misaligned >> with deployment realities (see [I-D.rosenberg-sip-rfc4474-concerns]). >> Most significantly, RFC 4474 did not deal well with telephone numbers >> as identifiers, despite their enduring use in SIP deployments. RFC >> 4474 also provided a signature over material that intermediaries in >> existing deployments commonly altered. This specification therefore >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 3] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> revises RFC 4474 in light of recent reconsideration of the problem >> space to align with the threat model in [RFC7375], and aligns the >> signature format with PASSporT [I-D.ietf-stir-passport]. >> > > This kind of review of history is best relegated to a minor location in > the document. If the current spec is successful, history like this will be > distracting, 10 years from now.... > > > 2. Terminology >> >> In this document, the key words "MUST", "MUST NOT", "REQUIRED", >> "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT >> RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as >> described in RFC 2119 [RFC2119] and RFC 6919 [RFC6919]. >> >> 3. Background >> > > This section includes far more than background. It also provides a > summary description of the mechanism being defined here. I suggest having > this section only give background on sip and the problem, with a separate > section for the design summary. Or else call this Introduction, but really > it would be better to split them. > > > > Per [RFC7340], problems such as robocalling, voicemail hacking, and >> swatting are enabled by an attacker's ability to impersonate someone >> else. The secure operation of most SIP applications and services >> depends on authorizing the source of communications as it is >> represented in a SIP request. Such authorization policies can be >> automated or be a part of human operation of SIP devices. An example >> of the former would be a voicemail service that compares the identity >> of the caller to a whitelist before determining whether it should >> allow the caller access to recorded messages. An example of the >> latter would be an Internet telephone application that displays the >> calling party number (and/or Caller-ID) of a caller, which a human >> may review to make a policy decision before answering a call. In >> both of these cases, attackers might attempt to circumvent these >> authorization policies through impersonation. Since the primary >> identifier of the sender of a SIP request, the From header field, can >> be populated arbitrarily by the controller of a user agent, >> impersonation is very simple today in many environments. The >> > > add: Hence the foundation to accurate authorization is valid > authentication. > > > mechanism described in this document provides a strong identity >> system for detecting attempted impersonation in SIP requests. >> > > "provides a strong identity system for detecting" could mean > many things, whereas the goal here is quite specific. > > So replace it with: > > ...enables an authentication capability for protecting against... > > > This identity architecture for SIP depends on a logical >> "authentication service" which validates outgoing requests. An >> > > It likely will validate them in multiple places, including incoming > requests. > > > authentication service may be implemented either as part of a user >> agent or as a proxy server; typically, it is a component of a network >> intermediary like a proxy to which originating user agents send >> unsigned requests. Once the sender of the message has been >> authenticated, the authentication service then computes and adds >> > > sender? Does that mean the caller? the caller's ua? the caller's > operator? the term is ambiguous. > > > cryptographic information (including a digital signature over some >> components of messages) to requests to communicate to other SIP >> entities that the sending user has been authenticated and its claim >> > > worth breaking this sentence into two, for better clarity. > > > of a particular identity has been authorized. A "verification >> service" on the receiving end then validates this signature and >> enables policy decisions to be made based on the results of the >> verification. >> >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 4] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> Identities are issued to users by authorities. When a new user >> becomes associated with example.com, the administrator of the SIP >> service for that domain can issue them an identity in that namespace, >> such as alice@example.com. Alice may then send REGISTER requests to >> example.com that make her user agents eligible to receive requests >> for sip:alice@example.com. In some cases, Alice may be the owner of >> the domain herself, and may issue herself identities as she chooses. >> But ultimately, it is the controller of the SIP service at >> example.com that must be responsible for authorizing the use of names >> in the example.com domain. Therefore, for the purposes of baseline >> SIP, the credentials needed to prove a user is authorized to use a >> particular From header field must ultimately derive from the domain >> owner: either a user agent gives requests to the domain name owner in >> order for them to be signed by the domain owner's credentials, or the >> user agent must possess credentials that prove in some fashion that >> the domain owner has given the user agent the right to a name. >> >> The situation is however more complicated for telephone numbers, >> however. Authority over telephone numbers does not correspond >> > > however...however > > > directly to Internet domains. While a user could register at a SIP >> domain with a username that corresponds to a telephone number, any >> connection between the administrator of that domain and the >> assignment of telephone numbers is not currently reflected on the >> Internet. Telephone numbers do not share the domain-scope property >> described above, as they are dialed without any domain component. >> This document thus assumes the existence of a separate means of >> establishing authority over telephone numbers, for cases where the >> telephone number is the identity of the user. As with SIP URIs, the >> necessary credentials to prove authority for a name might reside >> either in the endpoint or at some intermediary. >> > > Note that the preceding discussion makes no mention of "SIP URI". If one > reads back and connects some dots, the reader might guess that the alice@ > discussion is for a SIP URI, but the text should make this explicit. > > The following paragraph really is the design summary for the specification: > > This document specifies a means of sharing a cryptographic assurance >> of end-user SIP identity in an interdomain or intradomain context. >> > > I suspect the above sentence is seriously redundant. If it isn't, it > needs to be quite a bit sooner, since it is fundamental. Certainly it is > not 'background'. > > > It relies on the authentication service constructing tokens based on >> the PASSporT [I-D.ietf-stir-passport] format, a JSON [RFC7159] object >> comprising values copied from certain header field values in the SIP >> request. The authentication service then computes a signature over >> those JSON object in a manner following PASSporT. That signature is >> > > "those JSON object" ? > > Also, where is the object? How is it created? How is it conveyed? > > Also 'The authentication service' might refer to the signing side or to > the verifying side. How is the reader to know for certain? A diagram of > the overall service and its components could be quite helpful. > > > then placed in a SIP Identity header. In order to assist in the >> > > header /field/? > > > validation of the Identity header, this specification also describes >> some metadata fields associated with the header that can be used by >> the recipient of a request to recover the credentials of the signer. >> Note that the scope of this document is limited to providing this >> identity assurance for SIP requests; solving this problem for SIP >> responses is outside the scope of this work (see [RFC4916]). Future >> work might specify ways that a SIP implementation could gateway >> PASSporT objects to other protocols. >> > > And it might not. To the extent that you have to say something about work > that might or might not be done, just cite the topic and that it isn't > covered here. Such as: > > Gatewaying Passport objects to other services is outside the > scope of this specification. > > (Odd thought: Given that JSON isn't native to SIP and that there must be > some translation/encoding of the json object to work with SIP, that > effectively means that this /is/ a gatewaying application of the object...) > > > >> >> Peterson, et al. Expires January 8, 2017 [Page 5] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> This specification allows either a user agent or a proxy server to >> provide the authentication service function and/or the verification >> service function. To maximize end-to-end security, it is obviously >> preferable for end-users to acquire their own credentials; if they >> > > "To maximize end-to-end security, it is obviously preferable for end-users > to acquire their own credentials;? > > I'm not exactly sure what this means or is supposed to mean, but I suspect > it's incorrect. > > > do, their user agents can act as authentication services. However, >> for some deployments, end-user credentials may be neither practical >> nor affordable, given the potentially large number of SIP user agents >> (phones, PCs, laptops, PDAs, gaming devices) that may be employed by >> a single user. In such environments, synchronizing keying material >> across multiple devices may be prohibitively complex and require >> quite a good deal of additional endpoint behavior. Managing several >> credentials for the various devices could also be burdensome. In >> these cases, implementation the authentication service at an >> intermediary may be more practical. This trade-off needs to be >> understood by implementers of this specification. >> >> 4. Overview of Operations >> >> This section provides an informative (non-normative) high-level >> overview of the mechanisms described in this document. >> > > described -> specified (or defined) > > But note that we've already been given a high-level overview... > > On reflection, this section isn't an 'overview'. It's an example > scenario. The essential difference is that this makes specific choices, > such as use of a proxy, which might not apply in some valid scenarios. As > some integrative pedagogy, that's fine. So I suggest re=labeling the > section rather than changing it's substance. > > > Imagine a case where Alice, who has the home proxy of example.com and >> the address-of-record sip:alice@example.com, wants to communicate >> with Bob at sip:bob@example.org. They have no prior relationship, >> and Bob implements best practices to prevent impersonation attacks. >> >> Alice generates an INVITE and places her identity, in this case her >> address-of-record, in the From header field of the request. She then >> sends an INVITE over TLS to an authentication service proxy for the >> example.com domain. >> > > How is reference to TLS meaningful here? > > > >> The proxy authenticates Alice (possibly by sending a Digest >> authentication challenge), and validates that she is authorized to >> > > Again, how is discussion of the internal, non-STIR aspects of SIP > operationally relevant here? > > > assert the identity that she populated in the From header field. >> This value could be Alice's AoR, but in other cases it could be some >> different value that the authentication service has authority over, >> > > That bit of vagueness isn't helpful, given the motivation for doing this > work. It reduces to: something will get authenticated, but we won't say > what and we won't say where to find out. > > > such as a telephone number. The proxy authentication service then >> constructs a PASSporT object which contains a JSON representations of >> headers and claims which mirror certain parts of the SIP request, >> including the identity in the From header field. As a part of >> generating the PASSporT object, the authentication service signs a >> hash of those headers and claims with the appropriate credential for >> the identity (in this case, the certificate for example.com, which >> covers the identity sip:alice@example.com), and the signature is >> inserted by the proxy server into the Identity header field value of >> the request. Optionally, the JSON headers and claims themselves may >> also be included in the object, encoded in the "canon" parameter of >> the Identity header. >> > > why? when? > > Tossing in vague references about optional behavior that is neither > motivated nor explained usually proves more of a distraction than a help, > when writing an 'overview' or an example. > > > >> >> >> Peterson, et al. Expires January 8, 2017 [Page 6] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> The proxy, as the holder of the private key for the example.com >> domain, is asserting that the originator of this request has been >> authenticated and that she is authorized to claim the identity that >> appears in the From header field. The proxy inserts an "info" >> parameter into the Identity header that tells Bob how to acquire >> keying material necessary to validate its credentials (a public key), >> in case he doesn't already have it. >> > > A scheme that has an untrusted object carrying information about where to > find trust information for the object sounds like a serious security hole. > Why should the pointer be trusted? > > > When Bob's domain receives the request, it verifies the signature >> provided in the Identity header, and thus can validate that the >> authority over the identity in the From header field authenticated >> the user, and permitted the user to assert that From header field >> value. This same validation operation may be performed by Bob's user >> agent server (UAS). As the request has been validated, it is >> rendered to Bob. If the validation was unsuccessful, some other >> treatment would be applied by the receiving domain. >> > > Huge operational transition question: How is the absence of the signature > treated? Today, there are no signatures. Tomorrow there might be some, > both it won't be true that /all/ incoming requests are signed. So how is > the receiver supposed to handle the absence of a signature? > > Related question: Is everyone certain that transit of the request will > /never/ break the signature? What is the basis for that assessment? And if > a signature /can/ break, then the interpretation of an invalid signature > could mean either spoofing or operational error. > > > >> 5. Signature Generation and Validation >> >> 5.1. Authentication Service Behavior >> >> This document specifies a role for SIP entities called an >> > > delete first sentence. it adds no useful information. > > > authentication service. The authentication service role can be >> instantiated, for example, by an intermediary such as a proxy server >> > > Constant references to implementation (and 'instantiation') possibilities > distracts from the required task of defining the architecture and functions > of the service. > > > or by a user agent. Any entity that instantiates the authentication >> service role MUST possess the private key of one or more credentials >> > > "private key of one or more credentials" - not sure what this means? > > One key can have more than one credential? On the signing side, I'd > expect the process to start by choosing a credential and then using its > associated key. > > > Simpler wording: The authentication service possesses the private... > > > that can be used to sign for a domain or a telephone number (see >> > > can be used to sign the From identity. > > > Section 6.1). Intermediaries that instantiate this role MUST be >> > > forward reference. better to put that material before this. > > > capable of authenticating one or more SIP users who can register for >> > > one or more SIP users -> users > > the word identity hasn't bee used in this paragraph, before this, so the > referent is unclear. > > Also, this requirement for authentication appears to be redundant with the > later specification for authentication in Step 2. > > > that identity. Commonly, this role will be instantiated by a proxy >> server, since these entities are more likely to have a static >> hostname, hold corresponding credentials, and have access to SIP >> registrar capabilities that allow them to authenticate users. It is >> also possible that the authentication service role might be >> instantiated by an entity that acts as a redirect server, but that is >> left as a topic for future work. >> > > Not only is the above, last sentence about future work; it appears to be > entirely irrelevant to this specification. Remove it. > > > >> An authentication service adds the Identity header to SIP requests. >> > > Note that we've read this before. So I'm raising a redundancy flag. > > > The procedures below define the steps that must be taken when each an >> header is added. More than one may appear in a single request, and >> > > header -> header /field/ ? > > And, by the way, what header field is that? > > The "the procedures" sentence adds nothing and is redundant with the later > "entities instantiating" sentence. > > In any event, don't make forward references like this. Put it after the > relevant details, so that there already is context and this just enhances > it. > > From what I can tell, this entire paragraph should be moved toward > the end of this section. > > > an authentication service may add an Identity header to a request >> that already contains one or more Identity headers. If the Identity >> header added follows extended signing procedures beyond the baseline >> given in Section 8, then it differentiates the header with a "ppt" >> parameter per the fourth step below. >> >> >> >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 7] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> Entities instantiating the authentication service role perform the >> following steps, in order, to generate an Identity header for a SIP >> request: >> > > The authentication service performs the following steps in order, > to... > > Procedural detail should be in a procedural form. Extended prose like > this isn't as easily grokked. That invites both writing and reading errors > to the algorithm. > > > Step 1: >> > > > Step 1: Authoritative for Identity > > > First, the authentication service must determine whether it is >> authoritative for the identity of the sender of the request. In >> ordinary operations, the authentication service decides this by >> inspecting the URI value from the addr-spec component of From header >> field; this URI will be referred to here as the 'identity field'. If >> the identity field contains a SIP or SIP Secure (SIPS) URI, and the >> user portion is not a telephone number, the authentication service >> > > how is its not being a telephone number determined deterministically and > correctly? > > > MUST extract the hostname portion of the identity field and compare >> it to the domain(s) for which it is responsible (following the >> procedures in RFC 3261 [RFC3261], Section 16.4). If the identity >> field uses the TEL URI scheme [RFC3966], or the identity field is a >> SIP or SIPS URI with a telephone number in the user portion, the >> authentication service determines whether or not it is responsible >> for this telephone number; see Section 7.1 for more information. An >> > > This canonicalization text seems entirely out of place, in the middle of > specification about authority. > > > authentication service proceeding with a signature over a telephone >> number MUST then follow the canonicalization procedures described in >> Section 7.2. If the authentication service is not authoritative for >> the identity in question, it SHOULD process and forward the request >> normally unless the local policy is to block such requests. The >> authentication service MUST NOT add an Identity header if the >> authentication service does not have the authority to make the claim >> it asserts. >> >> Step 2: >> > > Step 2: Authorization > > >> The authentication service MUST then determine whether or not the >> > > [or not] remove > > > sender of the request is authorized to claim the identity given in >> > > sender: calling user?, calling ua?, originating operator? > intermediary? Although the word is used frequently in the SIP spec, it is > not defined. > > > the identity field. In order to do so, the authentication service >> MUST authenticate the sender of the message. Some possible ways in >> which this authentication might be performed include: >> > > Remove the pedagogy after the first sentence. The choices are outside of > this specification and the spec is not enhanced by pedagogy about technical > matters outside of its scope. > > Also isn't the first sentence redundant with other text in the spec? > > >> If the authentication service is instantiated by a SIP >> intermediary (proxy server), it may authenticate the request with >> the authentication scheme used for registration in its domain >> (e.g., Digest authentication). >> >> If the authentication service is instantiated by a SIP user agent, >> a user agent may authenticate its own user through any system- >> specific means, perhaps simply by virtue of having physical access >> to the user agent. >> >> >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 8] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> Authorization of the use of a particular username or telephone number >> in the user part of the From header field is a matter of local policy >> for the authentication service; see Section 6.1 for more information. >> >> Note that this check is performed only on the addr-spec in the >> identity field (e.g., the URI of the sender, like >> 'sip:alice@atlanta.example.com'); it does not convert the display- >> name portion of the From header field (e.g., 'Alice Atlanta'). For >> more information, see Section 12.6. >> > > 'checking' and 'converting' are very different actions. So 'it does not' > does not flow from the preceding text in the sentence. > > > >> Step 3: >> > > Step 3: Timestamp > > > >> An authentication service MUST add a Date header field to SIP >> > > Why? (Probably only need to cite the earlier discussion about its use for > replay mitigation. But merely cite; don't duplicate.) > > > requests that do not have one. The authentication service MUST >> ensure that any preexisting Date header in the request is accurate. >> Local policy can dictate precisely how accurate the Date must be; a >> RECOMMENDED maximum discrepancy of sixty seconds will ensure that the >> request is unlikely to upset any verifiers. If the Date header >> contains a time different by more than one minute from the current >> time noted by the authentication service, the authentication service >> SHOULD reject the request. This behavior is not mandatory because a >> user agent client (UAC) could only exploit the Date header in order >> to cause a request to fail verification; the Identity header is not >> intended to provide a source of non-repudiation or a perfect record >> > > Then where does the non-repudiation feature of STIR come from? > > > of when messages are processed. Finally, the authentication service >> MUST verify that both the Date header and the current time fall >> within the validity period of its credential. >> >> See Section 12 for information on how the Date header field assists >> verifiers. >> >> Step 4: >> >> Subsequently, the authentication service MUST form a PASSporT object >> and add a corresponding an Identity header to the request containing >> > > a corresponding an ?->? a corresponding > > > this signature. For baseline PASSporT objects headers (without an >> > > baseline PASSporT objects headers > -> > a baseline PASSporT objects header > > > Identity header "ppt" parameter), this follows the procedures in >> > > header? or header field? > > > Section 8; if the authentication service is using an alternative >> "ppt" format, it MUST add an appropriate "ppt" parameter and follow >> > > Isn't this text repeating specification text that is elsewhere in the > document? If so, remove it. > > > the procedures associated with that extension (see Section 9). After >> the Identity header has been added to the request, the authentication >> service MUST also add a "info" parameter to the Identity header. The >> "info" parameter contains a URI from which the authentication >> service's credential can be acquired; see Section 6.3 for more on >> credential acquisition. >> >> Step 5: >> > > > Step 5: Canonicalization > > >> >> >> Peterson, et al. Expires January 8, 2017 [Page 9] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> In the circumstances described below, an authentication service will >> > > another forward reference, this time without even a specific pointer. > > > add a "canon" parameter to the Identity header. The syntax of >> "canon" is given in Section 8; essentially, it contains a base64 >> encoding of the JSON header and claims in the PASSporT object. The >> presence of "canon" is OPTIONAL baseline PASSporT objects in SIP as a >> because the information carried in the baseline PASSporT object's >> headers and claims is usually redundant with information already >> carried elsewhere in the SIP request. Omitting "canon" can >> significantly reduce SIP message size, especially when the PASSporT >> object contains media keys. >> >> When however an authentication service creates a PASSporT that uses >> > > "When however"? > > > extension claims beyond the baseline PASSporT object, including >> "canon" is REQUIRED in order for the verification service to be >> capable of validating the signature. See Section 9. >> >> Also, in some cases, a request signed by an authentication service >> > > "in some cases"? This is a specification. Where is the clear detail? > > > will be rejected by the verification service on the receiving side, >> > > "on the receiving side" is redundant. Remove it. Where else is there a > verification service? > > > and the authentication service will receive a SIP 4xx status code in >> the backwards direction, such as a 438 indicating a verification >> > > This is offered as descriptive text here. Where is this SIP behavior > documented in this spec? > > > failure. If the authentication service did not originally send the >> > > The authentication service does sending? I think it doesn't, and the > definition of its roles implies that it doesn't, but rather that it is part > of one or another module that does. > > > Identity header with the "canon" parameter, it SHOULD retry a request >> > > and hence it doesn't do retries. All of this needs to be recast in terms > that match the specified architecture. > > > once after receiving a 438 response, this time including the "canon". >> > > Why? This is just guessing. Protocols that do guessing don't work very > well. > > This interaction needs to be re-specified to be deterministic. > > > The information in "canon" is useful on the verification side for >> debugging errors, and there are some known causes of verification >> failures (such as the Date header changing in transit, see >> Section 12.1 for more information) that can be resolved by the >> inclusion of "canon". >> >> Finally, the authentication service MUST forward the message >> normally. >> > > it doesn't do forwarding. > > > >> 5.2. Verifier Behavior >> >> This document specifies a logical role for SIP entities called a >> > > redundant detail. > > > verification service, or verifier. When a verifier receives a SIP >> message containing one or more Identity headers, it inspects the >> > > headers? header fields? > > > signature(s) to verify the identity of the sender of the message. >> The results of a verification are provided as input to an >> authorization process that is outside the scope of this document. >> > > Step 5, below, specifies a behavior that is within scope. > > > A SIP request may contain zero, one, or more Identity headers. A >> verification service performs the procedures above on each Identity >> header that appears in a request. If the verifier does not support >> > > What does it mean to 'not support an Identity header [field]"? > > Why might there be multiple Identity header [fields]? How might they > differ? > > > an Identity header present in a request due to the presence of an >> unsupported "ppt" parameter, or if no Identity header is present, and >> the presence of an Identity header is required by local policy (for >> example, based on a per-sending-domain policy, or a per-sending-user >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 10] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> policy), then a 428 'Use Identity Header' response MUST be sent in >> the backwards direction. For more on this and other failure >> responses, see Section 13.3. >> >> In order to verify an Identity header in a message, an entity acting >> as a verifier MUST perform the following steps, in the order here >> specified. Note that when an Identity header contains the optional >> "canon" parameter, the verifier MUST follow the additional procedures >> in Section 5.2.1. >> >> Step 1: >> > > Step 1: PPT parameter > > > The verifier MUST inspect any optional "ppt" parameter appearing the >> > > [optional] remove. Especially given the MUST. It doesn't matter whether > the ppt was optional for the signer. > > "any" can there be more than one? If only one then perhaps: > > MUST inspect the "ppt" parameter, if present in the Identity request. > > > Identity request. If no "ppt" parameter is present, then the >> verifier proceeds normally below. If a "ppt" parameter value is >> > > 'normally' implies the alternative is abnormal. also, 'below' where? > > > present, and the verifier does not support it, it MUST ignore the >> Identity header. If a supported "ppt" parameter value is present, >> the verifier follows the procedures below, including the variations >> described in Step 5. >> > > is the 'below' here different from the one before it? > > From the above text, it appears that ppt does not affect processing, > as long as the ppt is "supported". That is, an absent ppt and a valid ppt > both produce the same sequence 'below'. > > > >> Step 2: >> > > Step 2: Signature Scope > > > In order to determine whether the signature for the identity field >> should be over the entire identity field URI or just a canonicalized >> telephone number, the verification service MUST follow the >> canonicalization process described in Section 7.2. That section also >> describes the procedures the verification service MUST follow to >> determine if the signer is authoritative for a telephone number. For >> > > Those two functions are wildly different. Why are they part of the same > process? > > > domains, the verifier MUST follow the process described in >> Section 7.3 to determine if the signer is authoritative for the >> identity field. >> >> Step 3: >> > > Step 3: Obtain Key > > > The verifier must first ensure that it possesses the proper keying >> material to validate the signature in the Identity header field, >> which usually involves dereferencing a URI in the "info" parameter of >> the Identity header. See Section 6.2 for more information on these >> procedures. If the verifier does not support the credential >> described in the "info" parameter, then it should consider the >> > > Only should? Why??? > > > credential for this header unsupported. If a SIP request contains no >> Identity headers with a supported credential, then the verifier MUST >> return a 437 "Unsupported Credential" response >> > > Verifier returns responses? > > > Step 4: >> > > Step 4: Date Window Enforcement > > > The verifier MUST furthermore ensure that the value of the Date >> header of the request meets local policy for freshness (usually, >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 11] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> within sixty seconds) and that it falls within the validity period of >> the credential used to sign the Identity header. For more on the >> attacks this prevents, see Section 12.1. If the "canon" parameter is >> > > There was earlier discussion of using a date window validation to mitigate > against some attacks. There doesn't need to be yet-another reference > here. Just cite the earlier discussion. > > > present, the verifier should follow the Date-related behavior in >> Section 5.2.1. >> >> Step 5: >> > > Step 5: Signature Validation > > > The verifier MUST validate the signature in the Identity header field >> over the PASSporT object. For baseline PASSporT objects (with no >> Identity header "ppt" parameter) the verifier MUST follow the >> procedures for generating the signature over a PASSporT object >> described in Section 8. If a "ppt" parameter is present (and per >> Step 1, is understood), the verifier follows the procedures for that >> "ppt" (see Section 9). If a verifier determines that the that the >> signature in the Identity does not correspond to the reconstructed >> signed-identity-digest, then the Identity header should be considered >> invalid. >> > > I suggest breaking this step into two parts: signature regeneration and > signature validation. > > It appears that the specification is calling for two (or more???) > different methods of doing signature validation, depending upon whether ppt > is present. This seems like an outstandingly bad idea. It creates > complexity and possibly even outright confusion. > > There needs to be a single algorithm for validation, even if components of > the algorithm have branches, such as depending on whether the 'address' is > a URI or a telephone number. > > > >> The presence of multiple Identity headers within a message raises the >> prospect that a verification services could receive a message >> containing some valid and some invalid Identity headers. If the >> verifier determines all Identity headers within a message are >> invalid, then a 438 'Invalid Identity Header' response MUST be >> returned. >> > > So it's ok to have no Identity header fields but it's not ok to have > identity, where none validate. This means that the entire transfer > environment is expected and required to convey Identity fields perfectly, > all the time. > > > The verification of an Identity header does not entail any particular >> treatment of the request. The handling of the message after the >> verification process depends on how the implementation service is >> implemented and on local policy. This specification does not propose >> any authorization policy for user agents or proxy servers to follow >> based on the presence of a valid Identity header, the presence of an >> invalid Identity header, or the absence of an Identity header, but it >> is anticipated that local policies could involve making different >> forwarding decisions in intermediary implementations, or changing how >> the user is alerted, or how identity is rendered, in user agent >> implementations. >> > > I suspect the above paragraph belongs elsewhere and sooner. It isn't part > of the step sequence. > > > >> 5.2.1. Handling 'canon' parameters >> >> If the optional "canon" parameter of the Identity header is present, >> > > [optional] remove. it's redudnant with 'if' > > [of the Identity header] remove. there is no other canon parameter. > > But really I suspect that even the 'if' is unecessary. The optionality > has been established elsewhere. The task here is merely to specify what is > in a canon. > > > it contains a base64 encoding of the header and claim component of >> > > This appears to be a re-specification of canon. Don't do that. Cite its > spec and then simply use it. > > > the PASSporT object constructed by the authentication service, and >> this it conveys any canonical telephone number formats created by the >> > > this -> thus ? > > there are multiple canon formats? that doesn't sound very canonical. > > but again, stating what it conveys is redundant. > > > authentication service (see Section 7.2), as well as an "iat" claim >> corresponding to the Date header that the authentication service >> used. The "canon" is provided purely as an optimization and >> debugging mechanism for the verification service. >> > > This is the wrong place to state what canon is for. > > > >> >> >> Peterson, et al. Expires January 8, 2017 [Page 12] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> When "canon" is present, the verification service MAY compute its own >> > > 'MAY'??? I don't understand making canonicalization optional, either > during signing or during verification. > > > canonicalization of the numbers and compare them to the values in the >> "canon" parameter before performing any cryptographic functions in >> order to ascertain whether or not the two ends agree on the canonical >> number form. Also, when "canon" is present, during Step 4 the >> verification service SHOULD compare the "iat" value in the "canon" to >> > > This is talking about actions during Step 4. Move it to Step 4! > > > its Date header field value. If the two are different, and the "iat" >> value is later but within verification service policy for freshness, >> the verification service SHOULD perform the computation required by >> Step 5 using the "iat" value instead of the Date value. As some >> deployments in the field have been observed to change the Date header >> in transit, this procedure will prevent some unnecessary verification >> failures. >> > > [unnecessary] remove. > > But it won't prevent others. This means that signatures that were valid > will break. And this ought to mitigate the handling of broken signatures. > > > >> 6. Credentials >> >> 6.1. Credential Use by the Authentication Service >> >> In order to act as an authentication service, a SIP entity must have >> access to the private keying material of one or more credentials that >> cover domain names or telephone numbers. These credentials may >> represent authority over an entire domain (such as example.com) or >> potentially a set of domains enumerated by the credential. >> > > [potentially] remove > > The implication is that "a set of domains" is not "an entire domain", but > I don't understand how the language says that. As written, this actually > translates to something like: authority over one or more domains. Possibly > what was meant is something like: authority over an entire domain, or some > number of sub-domains under that higher-level domain. > > > Similarly, a credential may represent authority over a single >> telephone number or a range of telephone numbers. The way that the >> > > Similarly for telephone numbers, a credential can represent one or a > range of numbers. > > > scope of a credential is expressed is specific to the credential >> mechanism. >> > > So, there is no standard for the specification of credentials, here. That > means that the technical details -- as distinct from the operational > policies -- of credentials are out of scope, although they are fundamental > to proper operation of this serve. This is a showstopper, in terms of > specification completeness for the service. > > > The following paragraph is not about credentials. It is about signing > policy. It belongs elsewhere. And since it isn't really specifying > anything, that elsewhere probably is up towards introductory text. > > > Authorization of the use of a particular username or telephone number >> in the identity field is a matter of local policy for the >> authentication service, one that depends greatly on the manner in >> > > Huh? > > But really, when a specification says something is out of scope and is a > matter for local policy, the specification should not then go on to specify > examples of local policy. In those cases where there is a compelling > benefit to include such examples, put them in an appendix. But please, > then, explain that compelling benefit. > > > which authentication is performed. For non-telephone number user >> parts, one policy might be as follows: the username given in the >> 'username' parameter of the Proxy-Authorization header MUST >> correspond exactly to the username in the From header field of the >> SIP message. However, there are many cases in which this is too >> limiting or inappropriate; a realm might use 'username' parameters in >> Proxy-Authorization that do not correspond to the user-portion of SIP >> From headers, or a user might manage multiple accounts in the same >> administrative domain. In this latter case, a domain might maintain >> a mapping between the values in the 'username' parameter of Proxy- >> Authorization and a set of one or more SIP URIs that might >> legitimately be asserted for that 'username'. For example, the >> username can correspond to the 'private identity' as defined in Third >> Generation Partnership Project (3GPP), in which case the From header >> field can contain any one of the public identities associated with >> this private identity. In this instance, another policy might be as >> follows: the URI in the From header field MUST correspond exactly to >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 13] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> one of the mapped URIs associated with the 'username' given in the >> Proxy-Authorization header. This is a suitable approach for >> telephone numbers in particular. >> >> This specification could also be used with credentials that cover a >> single name or URI, such as alice@example.com or >> sip:alice@example.com. This would require a modification to >> authentication service behavior to operate on a whole URI rather than >> a domain name. Because this is not believed to be a pressing use >> case, this is deferred to future work, but implementers should note >> this as a possible future direction. >> >> Exceptions to such authentication service policies arise for cases >> like anonymity; if the AoR asserted in the From header field uses a >> form like 'sip:anonymous@example.com' (see [RFC3323]), then the >> 'example.com' proxy might authenticate only that the user is a valid >> user in the domain and insert the signature over the From header >> field as usual. >> >> 6.2. Credential Use by the Verification Service >> >> In order to act as a verification service, a SIP entity must have a >> way to acquire and retain credentials for authorities over particular >> > > for -> from ? > > > domain names and/or telephone numbers or number ranges. >> Dereferencing the URI found in the "info" parameter of the Identity >> header (as described in the next section) MUST be supported by all >> > > forward reference > > > verification service implementations to create a baseline means of >> > > I /really/ don't understand the trust model that has a security scheme > where the object giving a pointer to its own credential. Or rather, I fear > that I do understand it, but don't understand why its considered credible. > > > credential acquisition. Provided that the credential used to sign a >> message is not previously known to the verifier, SIP entities SHOULD >> discover this credential by dereferencing the "info" parameter, >> unless they have some more other implementation-specific way of >> acquiring the needed keying material, such as an offline store of >> periodically-updated credentials. If the URI in the "info" parameter >> cannot be dereferenced, then a 436 'Bad Identity-Info' response MUST >> be returned. >> > > Again, this much non-determinacy in such an essential mechanism ensures > /non-/interoperability. I do understand the intent to have > private/proprietary mechanism at work for use of this spec back in the > regulated telecom space, but that does not mean it needs to distract the > public specification. A complete specification of a STIR service needs to > include a publicly-usable key certification mechanism, a la DANE or DKIM or > the like. > > The application of STIR for other, non-open operations are always free to > amend the specification through a separate profile that overrides one or > another piece of the base STIR specifications. > > > >> This specification does not propose any particular policy for a >> verification service to determine whether or not the holder of a >> credential is the appropriate party to sign for a given SIP identity. >> > > This is a fundamental flaw in this specification. It reduces to saying > that the document is specifying a validation service that does not provide > a deterministic means for assessing validation. > > > Guidance on this is deferred to the credential mechanism >> specifications, which must meet the requirements in Section 6.4. >> >> Verification service implementations supporting this specification >> may wish to have some means of retaining credentials (in accordance >> with normal practices for credential lifetimes and revocation) in >> order to prevent themselves from needlessly downloading the same >> credential every time a request from the same identity is received. >> Credentials cached in this manner may be indexed in accordance with >> > > This is gratuitous implementation advice. Remove it. > > If there is a compelling desire to give implementation advice, move it to > a separate document and make it more complete. > > It is especially ironic to try to give implementation advice about a > mechanism that isn't fully specified. > > > >> Peterson, et al. Expires January 8, 2017 [Page 14] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> local policy: for example, by their scope, or the URI given in the >> "info" parameter value. Further consideration of how to cache >> credentials is deferred to the credential mechanism specifications. >> >> 6.3. Handling 'info' parameter URIs >> > > > I don't find a specification for the 'info' parameter. I find many > references to the Identity-Info header field, but assume that's not what is > meant here. > > I also find abnf for an ident-info rule, which includes an "ident" literal > string. I suspect this is the reference you intend? > > Please reference these more formally and properly cite their definition at > first use. (If you want to rename rules, to make the use of the rulename > more pleasant in the text, that's fine. But just make sure that a new > reader can understand what type of reference is being made and where to go > to find its definition. > > Ditto for "alg". > > Ditto for ppt. > > And, of course, these are more forward references. In this case, it's > giving detail about something that hasn't even been defined yet. > > > An "info" parameter MUST contain a URI which dereferences to a >> > > This isn't about the handling of info. It's defining its contents. They > need to be separate segments of text. > > resource that contains the public key components of the credential >> used by the authentication service to sign a request. It is >> essential that a URI in the "info parameter" be dereferencable by any >> > > Again, specification, not handling. Also, what do the instructions mean? > How is the signer to know what is dereferenceable by the verifier? > > > entity that could plausibly receive the request. For common cases, >> this means that the URI must be dereferencable by any entity on the >> public Internet. In constrained deployment environments, a service >> private to the environment might be used instead. >> >> Beyond providing a means of accessing credentials for an identity, >> the "info" parameter further serves as a means of differentiating >> which particular credential was used to sign a request, when there >> are potentially multiple authorities eligible to sign. For example, >> > > It sounds as if the real need is to have an external registry of > authorized credentialing services and then refer to the one that is used by > name. That provides independent vetting and limits the 'vocabulary' of > credential service references the message can cite. > > > imagine a case where a domain implements the authentication service >> role for a range of telephone and a user agent belonging to Alice has >> acquired a credential for a single telephone number within that >> range. Either would be eligible to sign a SIP request for the number >> in question. Verification services however need a means to >> differentiate which one performed the signature. The "info" >> parameter performs that function. >> >> 6.4. Credential System Requirements >> > > Besides having extraneous material, this section is almost certainly > incomplete and probably extremely incomplete. I suggest removing the > section and simply state that the details of the credentialing system are > outside the scope of this specification, except for specifying a registry > that lists possible systems. > > Also note that the claimed interest in authentication beyond SIP will also > require credentialing systems. As such, the entire topic appears to be > larger than this specification. > > > This document makes no recommendation for the use of any specific >> credential system. Today, there are two primary credential systems >> > > A review of current, external services and hypothetical capabilities is > not appropriate for inclusion inside a technical specification. Move it to > a separate document. > > > in place for proving ownership of domain names: certificates (e.g., >> X.509 v3, see [RFC5280]) and the domain name system itself (e.g., >> DANE, see [RFC6698]). It is envisioned that either could be used in >> the SIP identity context: an "info" parameter could for example give >> an HTTP URL of the Content-Type 'application/pkix-cert' pointing to a >> certificate (following the conventions of [RFC2585]). The "info" >> parameter may use the DNS URL scheme (see [RFC4501]) to designate >> keys in the DNS. >> >> While no comparable public credentials exist for telephone numbers, >> either approach could be applied to telephone numbers. A credential >> system based on certificates is given in >> [I-D.ietf-stir-certificates], but this specification can work with >> other credential systems; for example, using the DNS was proposed in >> [I-D.kaplan-stir-cider]. >> > > the above isn't 'requirements'. > >> >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 15] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> In order for a credential system to work with this mechanism, its >> specification must detail: >> >> which URIs schemes the credential will use in the "info" >> parameter, and any special procedures required to dereference the >> URIs >> >> how the verifier can learn the scope of the credential >> > > what does scope of the credential'? > > > any special procedures required to extract keying material from >> the resources designated by the URI >> >> any algorithms required to validate the credentials (e.g. for >> certificates, any algorithms used by certificate authorities to >> sign certificates themselves) >> > > Looks like this needs to define a STIR Credential Registry. > > > It is furthermore required that all credential specifications >> describe how the associated credentials will support the mandatory >> signing algorithm(s) required by PASSporT [I-D.ietf-stir-passport]. >> > > So this really is another bullet for the above, indented list? > > Then again: credentials supporting signing algorithms? I don't > understand this. The signing algorithms are for the payload using the key > /from/ the credential. So what does this requirement mean, and why? > > > >> SIP entities cannot reliably predict where SIP requests will >> terminate. When choosing a credential scheme for deployments of this >> specification, it is therefore essential that the trust anchor(s) for >> credentials be widely trusted, or that deployments restrict the use >> of this mechanism to environments where the reliance on particular >> trust anchors is assured by business arrangements or similar >> constraints. >> > > replace above with: Use of a credentialing mechanism must be > supported within a scope sufficient to include the authentication service, > the verifying service and the credentialing service. > > > >> Note that credential systems must address key lifecycle management >> concerns: were a domain to change the credential available at the >> Identity-Info URI before a verifier evaluates a request signed by an >> authentication service, this would cause obvious verifier failures. >> When a rollover occurs, authentication services SHOULD thus provide >> new Identity-Info URIs for each new credential, and SHOULD continue >> to make older key acquisition URIs available for a duration longer >> than the plausible lifetime of a SIP transaction (a minute would most >> likely suffice). >> >> 7. Identity Types >> >> This specification focuses primarily on cases where the called and >> > > Focuses primarily? What I've been reading in this spec covers both phone > and uri forms. So I don't know what the 'primarily' refers to. > > > calling parties identified in the To and From header field values use >> telephone numbers, as this remains the dominant use case in the >> deployment of SIP. However, this specification also works with >> "greenfield" identifiers (of the form "sip:user@host"), and >> potentially other identifiers when SIP interworks with another >> protocol. >> > > What about these is 'greenfield'? What does it mean here? > > > >> >> >> Peterson, et al. Expires January 8, 2017 [Page 16] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> The guidance in this section also applies to extracting the URI >> > > guidance vs. specification? > > > containing the originator's identity from the P-Asserted-Identity >> header field value instead of the From header field value. In some >> > > Huh? How is the verifier supposed to know where to draw the values from? > > > environments, the P-Asserted-Identity header field is used in lieu of >> the From header field to convey the address-of-record or telephone >> number of the sender of a request; while it is not envisioned that >> many of those networks would or should make use of the Identity >> mechanism described in this specification, where they do, local >> policy might therefore dictate that the canonical identity derive >> from the P-Asserted-Identity header field rather than the From. >> > > As soon as a document says 'local policy' it needs to stop specifying > detail, since it is both outside of the scope of the document and it is > distracting from the details of the specification. > > If you have to make reference to the possibility, then include something > simple and brief, such as: > > Local policies might choose to use a value from fields other than To > and From. The details for this are outside the scope of this specification. > > To the extent there is a compelling need to specify this alternative > mechanism, do it in a separate specification. > > > Ultimately, in any case where local policy canonicalizes the idenity >> into a form different from how it appears in the From header field, >> the use of the "canon" parameter by authentication services is >> RECOMMENDED, but because "canon" itself could then divulge >> information about users or networks, implementers should be mindful >> of the guidelines in Section 11. >> > > remove above paragraph. > > >> It may not be trivial to tell if a given URI contains a telephone >> > > If that means it isn't deterministic, we've got a basic problem, since > protocol specs do not offer heuristics. > > If it just means there is complexity, then the sentence says nothing > useful. > > > number. In order to determine whether or not the user portion of a >> > > [or not] remove > > > SIP URI is a telephone number, authentication services and >> verification services MUST perform the following procedure on any SIP >> URI they inspect which contains a numeric user part. Note that the >> same procedures are followed for creating the canonical form of URIs >> found in the From header field as they are in the To header field or >> the P-Asserted-Identity header field. >> > > If there is an algorithm to follow, specify it as an algorithm. Otherwise, > this is non-normative discussion and isn't very helpful here. > > > First, implementations must look for obvious indications that the >> user-portion of the URI constitutes a telephone number. Telephone >> numbers most commonly appear in SIP header field values in the >> > > "most commonly" suggests that this is discussion, not specification. > > > username portion of a SIP URI (e.g., >> 'sip:+17005551008@chicago.example.com;user=phone'). The user part of >> that URI conforms to the syntax of the TEL URI scheme (RFC 3966 >> [RFC3966]). It is also possible for a TEL URI to appear in the SIP >> To or From header field outside the context of a SIP or SIPS URI >> (e.g., 'tel:+17005551008'). Thus, in some environments, numbers will >> be explicitly labeled by the use of TEL URIs or the 'user=phone' >> parameter, or implicitly by the presence of the '+' indicator at the >> start of the user-portion. Absent these indications, if there are >> numbers present in the user-portion, implementations may also detect >> that the user-portion of the URI contains a telephone number by >> determining whether or not those numbers would be dialable or >> routable in the local environment -- bearing in mind that the >> telephone number may be a valid E.164 number, a nationally-specific >> number, or even a private branch exchange number. Once a telephone >> number has been detected, implementations should follow the >> procedures in Section 7.2. >> >> >> >> >> Peterson, et al. Expires January 8, 2017 [Page 17] >> >> >> Internet-Draft SIP Identity July 2016 >> >> >> If the URI field does not contain a telephone number, URI >> normalization procedures are invoked to canonicalize the URI before >> it is included in a PASSporT object in, for example, an "uri" claim. >> See Section 7.4 for that behavior. >> > > I suspect that the above topic is confusing what can/must be done as a > deterministic specification, with what incremental value can be obtained by > the addition of some non-normative heuristics. Separate these and make the > deterministic stuff part of the specification and the heuristics part of an > external document discussing real-world implementation, or somesuch. > > > > > 7.1. Authority for Telephone Numbers >> >> In order for telephone numbers to be used with the mechanism >> described in this document, authentication services must enroll with >> an authority that issues credentials authoritative for telephone >> numbers or telephone number ranges, and verification services must > > --001a1143f620ad3059053a97d343 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Dave,

Thanks for your thorough revie= w. I'm going to mostly let Jon handle the first round
(as you= can see, he's done most of the work on this spec so far), especially a= s much
of it seems to be detailed (and valuable) but straightforw= ard comments.

What wasn't clear to me was whet= her there were any major architectural or
technical concerns in y= our review. I'm not asking you to write an entirely separate
= review or anything, but you obviously know what you think is important bett= er
than I do, so would it be possible for you to perhaps highligh= t anything you think
is seriously architecturally/technically wro= ng by cutting-and-pasting into a separate
message, or some other = recourse?

Thanks,
-Ekr




On Mon, Aug 8, 2016 at 8:46 PM, Dave Crocker <dhc@dcrocker= .net> wrote:


Review of:=C2=A0 Authenticated Identity Management in the Session Initiatio= n
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Protocol (SIP)
ID:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-ietf-stir-rfc4474bis-10.txt=
Date:=C2=A0 =C2=A0 =C2=A0 =C2=A08 August 2016
Reviewer:=C2=A0 =C2=A0D. Crocker <dcrocker@bbiw.net>




Summary
-------

SIP needs to support a mechanism that validates the identifier used for the= originator of the request. That is, to ensure that the entity that placed = the identification value into the field was authorized by its owner to do s= o.=C2=A0 This specifications is part of a collection of specifications inte= nded to enable such validation.


Taken on its own and also when taken with its companion documents, the spec= ifications are confusing and incomplete.=C2=A0 It is quite far from being r= eady for publication.



Terminology is used inconsistently. It often is introduced with no backgrou= nd or citation.=C2=A0 Many uses of 'header' are probably supposed t= o be 'header field'.=C2=A0 My sense is that quite a bit of terminol= ogy is used equally loosely.

There is no integrative architectural description, so the reader has diffic= ulty understanding what all of the pieces are or how they fit together.=C2= =A0 In fact is appears that the document itself gets confused on this matte= r.

Algorithms are all offered only as prose and often in a form mitigating com= prehension, such as tending towards negation or disjunction, which humans p= rocess less well than affirmatives and conjunctions. From what I can tell, = the algorithms often are incomplete, but serious analysis is difficult.

The documents appear to rely on a reader's having quite a bit of prior = knowledge and are certainly not usable by an implementer who is not already= deeply embedded in the community that produced these specifications.=C2=A0= My impression is that being embedded won't suffice either, both from m= y assessment of the documents' deficiencies and given back-channel comm= ents I have heard about the expectation of the work to be done after these = specifications are published.


Overall, the writing impedes comprehension and the document needs a very di= ligent pass by a technical editor.=C2=A0 I suspect this will uncover quite = a number of semantic deficiencies in the text.


There is a possible tendency to support more alternative behavior than appr= opriate. Successful interoperability usually benefits from fewer choices, n= ot more.=C2=A0 Common, mandatory canonicalization is an example.

Credentials: the specification neither defines nor references a standard fo= r the specification of credentials, here.=C2=A0 That means that the technic= al details -- as distinct from the operational policies -- of credentials a= re out of scope, although they are fundamental to proper operation of this = serve.=C2=A0 This is a showstopper, in terms of specification completeness = for the service.

How is the recipient to know what credential 'standard' is used?=C2= =A0 How does this ensure interoperability between two participants who have= not interacted before?

At base, these specifications appear intended to roughly chart out a system= structure, leaving most of the difficult work for later and elsewhere.=C2= =A0 By way of example, there are few if any cross-organization key manageme= nt services on the Internet that demonstrate the utility needed here.=C2=A0= I am pretty sure that Web certs don't qualify.=C2=A0 We know that DKIM= 's operation does, of course.=C2=A0 However DKIM strictly uses domain n= ames as identifiers and they conveniently align with their administrative a= uthorities, whereas telephone numbers do not...

=C2=A0 =C2=A0 =C2=A0[[[ The mailing list just had an extensive regurgitatio= n of critical commentary about ENUM.=C2=A0 What appears to be getting misse= d is that whatever mechanism is going to be used for finding and validating= keys is going to have no operational history of reliability, safety or eff= icacy. ]]]

There is remarkably little of the original RFC 4474 substance still in this= document.=C2=A0 Calling it a bis is a bit like tearing all of a building e= xcept its fireplace or its front door and calling that a remodeling. The pr= evious document does not have an installed base, so I strongly suggest remo= ving all references to it.=C2=A0 It will allow some of the text to be notab= ly simpler and clearer.

The document is heavy with forward references.=C2=A0 These force the reader= to stop what they are in the middle of, try to hold that place, and look f= orward to understand what they've just been interrupted from reading. A= s a literary style, forward references create useful tension.=C2=A0 In spec= ifications they just interrupt the flow.=C2=A0 The document should be reorg= anization so that integrative text comes /after/ the text describing the pi= eces being integrated.=C2=A0 And opening overview, design summary, or the l= ike can give a non-normative description of the architecture and the servic= e, so the reader has a basic sense of the big picture, before diving into t= he detail of those to-be-integrated pieces.




Detail Comments
---------------

Abstract

=C2=A0 =C2=A0The baseline security mechanisms in the Session Initiation Pro= tocol
=C2=A0 =C2=A0(SIP) are inadequate for cryptographically assuring the identi= ty of
=C2=A0 =C2=A0the end users that originate SIP requests, especially in an

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0an end user originating a SIP request

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 cryptographically -> adequately

'cryptographically' is not the issue here=C2=A0 That is, it is a me= ans, not an end.


=C2=A0 =C2=A0interdomain context.=C2=A0 This document defines a mechanism f= or securely

'interdomain' might suffice, but I suspect it's worth pressing = the issue, with language like "especially across trust boundaries"= ; or somesuch.


=C2=A0 =C2=A0identifying originators of SIP requests.=C2=A0 It does so by d= efining a
=C2=A0 =C2=A0SIP header field for conveying a signature used for validating= the
=C2=A0 =C2=A0identity, and for conveying a reference to the credentials of = the
=C2=A0 =C2=A0signer.
...

1.=C2=A0 Introduction

=C2=A0 =C2=A0This document provides enhancements to the existing mechanisms= for
=C2=A0 =C2=A0authenticated identity management in the Session Initiation Pr= otocol
=C2=A0 =C2=A0(SIP, [RFC3261]).=C2=A0 An identity, for the purposes of this = document, is
=C2=A0 =C2=A0defined as either a SIP URI, commonly a canonical address-of-r= ecord
=C2=A0 =C2=A0(AoR) employed to reach a user (such as
=C2=A0 =C2=A0'sip:alice@atlanta.example.com'), or a telephone nu= mber, which can be
=C2=A0 =C2=A0represented as either a TEL URI [RFC3966] or as the user porti= on of a
=C2=A0 =C2=A0SIP URI.

I suspect it does not 'enhance' existing mechanisms as much as add = a new one.=C2=A0 If the claim is actual enhancement, then what mechanism is= enhanced and how does authenticating origin constitute enhancement of it?= =C2=A0 My point is that I believe the existing mechanisms will operate the = same in the future as they have been.=C2=A0 This spec doesn't change th= em.

Move definitions to an explicit terminology section, rather than putting th= em into an Introduction.=C2=A0 Also, does this document use the term differ= ently than elsewhere than SIP???=C2=A0 Then why is 'for the purposes of= this document' included?


=C2=A0 =C2=A0[RFC3261] specifies several places within a SIP request where = users
=C2=A0 =C2=A0can express an identity for themselves, most prominently the u= ser-
=C2=A0 =C2=A0populated From header field.=C2=A0 However, the recipient of a= SIP request
=C2=A0 =C2=A0has no way to verify that the From header field has been popul= ated
=C2=A0 =C2=A0appropriately, in the absence of some sort of cryptographic =C2=A0 =C2=A0authentication mechanism.=C2=A0 This leaves SIP vulnerable to = a category
=C2=A0 =C2=A0of abuses, including impersonation attacks that enable robocal= ling
=C2=A0 =C2=A0and related problems as described in [RFC7340].=C2=A0 Ideally,= a
=C2=A0 =C2=A0cryptographic approach to identity can provide a much stronger= and
=C2=A0 =C2=A0less spoofable assurance of identity than the Caller ID servic= es that
=C2=A0 =C2=A0the telephone network provides today.

=C2=A0 =C2=A0[RFC3261] encourages user agents (UAs) to implement a number o= f
=C2=A0 =C2=A0potential authentication mechanisms, including Digest authenti= cation,
=C2=A0 =C2=A0Transport Layer Security (TLS), and S/MIME (implementations ma= y
=C2=A0 =C2=A0support other security schemes as well).=C2=A0 However, few SI= P user
=C2=A0 =C2=A0agents today support the end-user certificates necessary to =C2=A0 =C2=A0authenticate themselves (via S/MIME, for example), and for its= part
=C2=A0 =C2=A0Digest authentication is limited by the fact that the originat= or and
=C2=A0 =C2=A0destination must share a prearranged secret.=C2=A0 Practically= speaking,
=C2=A0 =C2=A0originating user agents need to be able to securely communicat= e their
=C2=A0 =C2=A0users' identity to destinations with which they have no pr= evious
=C2=A0 =C2=A0association.

=C2=A0 =C2=A0As an initial attempt to address this gap, [RFC4474] specified= a
=C2=A0 =C2=A0means of signing portions of SIP requests in order to provide = an
=C2=A0 =C2=A0identity assurance.=C2=A0 However, RFC 4474 was in several way= s misaligned
=C2=A0 =C2=A0with deployment realities (see [I-D.rosenberg-sip-rfc4474-con<= wbr>cerns]).
=C2=A0 =C2=A0Most significantly, RFC 4474 did not deal well with telephone = numbers
=C2=A0 =C2=A0as identifiers, despite their enduring use in SIP deployments.= =C2=A0 RFC
=C2=A0 =C2=A04474 also provided a signature over material that intermediari= es in
=C2=A0 =C2=A0existing deployments commonly altered.=C2=A0 This specificatio= n therefore



Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 3]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0revises RFC 4474 in light of recent reconsideration of the pro= blem
=C2=A0 =C2=A0space to align with the threat model in [RFC7375], and aligns = the
=C2=A0 =C2=A0signature format with PASSporT [I-D.ietf-stir-passport].

This kind of review of history is best relegated to a minor location in the= document.=C2=A0 If the current spec is successful, history like this will = be distracting, 10 years from now....


2.=C2=A0 Terminology

=C2=A0 =C2=A0In this document, the key words "MUST", "MUST N= OT", "REQUIRED",
=C2=A0 =C2=A0"SHALL", "SHALL NOT", "SHOULD", = "SHOULD NOT", "RECOMMENDED", "NOT
=C2=A0 =C2=A0RECOMMENDED", "MAY", and "OPTIONAL" a= re to be interpreted as
=C2=A0 =C2=A0described in RFC 2119 [RFC2119] and RFC 6919 [RFC6919].

3.=C2=A0 Background

This section includes far more than background.=C2=A0 It also provides a su= mmary description of the mechanism being defined here.=C2=A0 I suggest havi= ng this section only give background on sip and the problem, with a separat= e section for the design summary.=C2=A0 Or else call this Introduction, but= really it would be better to split them.



=C2=A0 =C2=A0Per [RFC7340], problems such as robocalling, voicemail hacking= , and
=C2=A0 =C2=A0swatting are enabled by an attacker's ability to impersona= te someone
=C2=A0 =C2=A0else.=C2=A0 The secure operation of most SIP applications and = services
=C2=A0 =C2=A0depends on authorizing the source of communications as it is =C2=A0 =C2=A0represented in a SIP request.=C2=A0 Such authorization policie= s can be
=C2=A0 =C2=A0automated or be a part of human operation of SIP devices.=C2= =A0 An example
=C2=A0 =C2=A0of the former would be a voicemail service that compares the i= dentity
=C2=A0 =C2=A0of the caller to a whitelist before determining whether it sho= uld
=C2=A0 =C2=A0allow the caller access to recorded messages.=C2=A0 An example= of the
=C2=A0 =C2=A0latter would be an Internet telephone application that display= s the
=C2=A0 =C2=A0calling party number (and/or Caller-ID) of a caller, which a h= uman
=C2=A0 =C2=A0may review to make a policy decision before answering a call.= =C2=A0 In
=C2=A0 =C2=A0both of these cases, attackers might attempt to circumvent the= se
=C2=A0 =C2=A0authorization policies through impersonation.=C2=A0 Since the = primary
=C2=A0 =C2=A0identifier of the sender of a SIP request, the From header fie= ld, can
=C2=A0 =C2=A0be populated arbitrarily by the controller of a user agent, =C2=A0 =C2=A0impersonation is very simple today in many environments.=C2=A0= The

add:=C2=A0 Hence the foundation to accurate authorization is valid authenti= cation.


=C2=A0 =C2=A0mechanism described in this document provides a strong identit= y
=C2=A0 =C2=A0system for detecting attempted impersonation in SIP requests.<= br>

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 "provides a strong identity system = for detecting" could mean many things, whereas the goal here is quite = specific.

So replace it with:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ...enables an authentication capability = for protecting against...


=C2=A0 =C2=A0This identity architecture for SIP depends on a logical
=C2=A0 =C2=A0"authentication service" which validates outgoing re= quests.=C2=A0 An

It likely will validate them in multiple places, including incoming request= s.


=C2=A0 =C2=A0authentication service may be implemented either as part of a = user
=C2=A0 =C2=A0agent or as a proxy server; typically, it is a component of a = network
=C2=A0 =C2=A0intermediary like a proxy to which originating user agents sen= d
=C2=A0 =C2=A0unsigned requests.=C2=A0 Once the sender of the message has be= en
=C2=A0 =C2=A0authenticated, the authentication service then computes and ad= ds

sender?=C2=A0 Does that mean the caller?=C2=A0 the caller's ua?=C2=A0 t= he caller's operator?=C2=A0 the term is ambiguous.


=C2=A0 =C2=A0cryptographic information (including a digital signature over = some
=C2=A0 =C2=A0components of messages) to requests to communicate to other SI= P
=C2=A0 =C2=A0entities that the sending user has been authenticated and its = claim

worth breaking this sentence into two, for better clarity.


=C2=A0 =C2=A0of a particular identity has been authorized.=C2=A0 A "ve= rification
=C2=A0 =C2=A0service" on the receiving end then validates this signatu= re and
=C2=A0 =C2=A0enables policy decisions to be made based on the results of th= e
=C2=A0 =C2=A0verification.




Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 4]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0Identities are issued to users by authorities.=C2=A0 When a ne= w user
=C2=A0 =C2=A0becomes associated with example.com, the administrator of the SIP=
=C2=A0 =C2=A0service for that domain can issue them an identity in that nam= espace,
=C2=A0 =C2=A0such as alice@example.com.=C2=A0 Alice may then send REGISTER requests to
=C2=A0 =C2=A0example.com that make her user agents eligible to receive request= s
=C2=A0 =C2=A0for sip:alice@example.com.=C2=A0 In some cases, Alice may be the owner o= f
=C2=A0 =C2=A0the domain herself, and may issue herself identities as she ch= ooses.
=C2=A0 =C2=A0But ultimately, it is the controller of the SIP service at
=C2=A0 =C2=A0example.com that must be responsible for authorizing the use of n= ames
=C2=A0 =C2=A0in the example.com domain.=C2=A0 Therefore, for the purposes of b= aseline
=C2=A0 =C2=A0SIP, the credentials needed to prove a user is authorized to u= se a
=C2=A0 =C2=A0particular From header field must ultimately derive from the d= omain
=C2=A0 =C2=A0owner: either a user agent gives requests to the domain name o= wner in
=C2=A0 =C2=A0order for them to be signed by the domain owner's credenti= als, or the
=C2=A0 =C2=A0user agent must possess credentials that prove in some fashion= that
=C2=A0 =C2=A0the domain owner has given the user agent the right to a name.=

=C2=A0 =C2=A0The situation is however more complicated for telephone number= s,
=C2=A0 =C2=A0however.=C2=A0 Authority over telephone numbers does not corre= spond

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0however...however


=C2=A0 =C2=A0directly to Internet domains.=C2=A0 While a user could registe= r at a SIP
=C2=A0 =C2=A0domain with a username that corresponds to a telephone number,= any
=C2=A0 =C2=A0connection between the administrator of that domain and the =C2=A0 =C2=A0assignment of telephone numbers is not currently reflected on = the
=C2=A0 =C2=A0Internet.=C2=A0 Telephone numbers do not share the domain-scop= e property
=C2=A0 =C2=A0described above, as they are dialed without any domain compone= nt.
=C2=A0 =C2=A0This document thus assumes the existence of a separate means o= f
=C2=A0 =C2=A0establishing authority over telephone numbers, for cases where= the
=C2=A0 =C2=A0telephone number is the identity of the user.=C2=A0 As with SI= P URIs, the
=C2=A0 =C2=A0necessary credentials to prove authority for a name might resi= de
=C2=A0 =C2=A0either in the endpoint or at some intermediary.

Note that the preceding discussion makes no mention of "SIP URI".= =C2=A0 If one reads back and connects some dots, the reader might guess tha= t the alice@ discussion is for a SIP URI, but the text should make this exp= licit.

The following paragraph really is the design summary for the specification:=

=C2=A0 =C2=A0This document specifies a means of sharing a cryptographic ass= urance
=C2=A0 =C2=A0of end-user SIP identity in an interdomain or intradomain cont= ext.

I suspect the above sentence is seriously redundant.=C2=A0 If it isn't,= it needs to be quite a bit sooner, since it is fundamental.=C2=A0 Certainl= y it is not 'background'.


=C2=A0 =C2=A0It relies on the authentication service constructing tokens ba= sed on
=C2=A0 =C2=A0the PASSporT [I-D.ietf-stir-passport] format, a JSON [RFC7159]= object
=C2=A0 =C2=A0comprising values copied from certain header field values in t= he SIP
=C2=A0 =C2=A0request.=C2=A0 The authentication service then computes a sign= ature over
=C2=A0 =C2=A0those JSON object in a manner following PASSporT.=C2=A0 That s= ignature is

"those JSON object" ?

Also, where is the object?=C2=A0 How is it created? How is it conveyed?

Also 'The authentication service' might refer to the signing side o= r to the verifying side.=C2=A0 How is the reader to know for certain?=C2=A0= A diagram of the overall service and its components could be quite helpful= .


=C2=A0 =C2=A0then placed in a SIP Identity header.=C2=A0 In order to assist= in the

=C2=A0 =C2=A0 =C2=A0 =C2=A0 header /field/?


=C2=A0 =C2=A0validation of the Identity header, this specification also des= cribes
=C2=A0 =C2=A0some metadata fields associated with the header that can be us= ed by
=C2=A0 =C2=A0the recipient of a request to recover the credentials of the s= igner.
=C2=A0 =C2=A0Note that the scope of this document is limited to providing t= his
=C2=A0 =C2=A0identity assurance for SIP requests; solving this problem for = SIP
=C2=A0 =C2=A0responses is outside the scope of this work (see [RFC4916]).= =C2=A0 Future
=C2=A0 =C2=A0work might specify ways that a SIP implementation could gatewa= y
=C2=A0 =C2=A0PASSporT objects to other protocols.

And it might not.=C2=A0 To the extent that you have to say something about = work that might or might not be done, just cite the topic and that it isn&#= 39;t covered here.=C2=A0 Such as:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Gatewaying Passport objects to other ser= vices is outside the scope of this specification.

(Odd thought:=C2=A0 Given that JSON isn't native to SIP and that there = must be some translation/encoding of the json object to work with SIP, that= effectively means that this /is/ a gatewaying application of the object...= )




Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 5]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0This specification allows either a user agent or a proxy serve= r to
=C2=A0 =C2=A0provide the authentication service function and/or the verific= ation
=C2=A0 =C2=A0service function.=C2=A0 To maximize end-to-end security, it is= obviously
=C2=A0 =C2=A0preferable for end-users to acquire their own credentials; if = they

"To maximize end-to-end security, it is obviously preferable for end-u= sers to acquire their own credentials;?

I'm not exactly sure what this means or is supposed to mean, but I susp= ect it's incorrect.


=C2=A0 =C2=A0do, their user agents can act as authentication services.=C2= =A0 However,
=C2=A0 =C2=A0for some deployments, end-user credentials may be neither prac= tical
=C2=A0 =C2=A0nor affordable, given the potentially large number of SIP user= agents
=C2=A0 =C2=A0(phones, PCs, laptops, PDAs, gaming devices) that may be emplo= yed by
=C2=A0 =C2=A0a single user.=C2=A0 In such environments, synchronizing keyin= g material
=C2=A0 =C2=A0across multiple devices may be prohibitively complex and requi= re
=C2=A0 =C2=A0quite a good deal of additional endpoint behavior.=C2=A0 Manag= ing several
=C2=A0 =C2=A0credentials for the various devices could also be burdensome.= =C2=A0 In
=C2=A0 =C2=A0these cases, implementation the authentication service at an =C2=A0 =C2=A0intermediary may be more practical.=C2=A0 This trade-off needs= to be
=C2=A0 =C2=A0understood by implementers of this specification.

4.=C2=A0 Overview of Operations

=C2=A0 =C2=A0This section provides an informative (non-normative) high-leve= l
=C2=A0 =C2=A0overview of the mechanisms described in this document.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 described -> specified (or defined)
But note that we've already been given a high-level overview...

On reflection, this section isn't an 'overview'.=C2=A0 It's= an example scenario.=C2=A0 The essential difference is that this makes spe= cific choices, such as use of a proxy, which might not apply in some valid = scenarios. As some integrative pedagogy, that's fine.=C2=A0 So I sugges= t re=3Dlabeling the section rather than changing it's substance.


=C2=A0 =C2=A0Imagine a case where Alice, who has the home proxy of example.com and
=C2=A0 =C2=A0the address-of-record sip:alice@example.com, wants to communicate
=C2=A0 =C2=A0with Bob at sip:bob@example.org.=C2=A0 They have no prior relationship, =C2=A0 =C2=A0and Bob implements best practices to prevent impersonation att= acks.

=C2=A0 =C2=A0Alice generates an INVITE and places her identity, in this cas= e her
=C2=A0 =C2=A0address-of-record, in the From header field of the request.=C2= =A0 She then
=C2=A0 =C2=A0sends an INVITE over TLS to an authentication service proxy fo= r the
=C2=A0 =C2=A0example.com domain.

How is reference to TLS meaningful here?



=C2=A0 =C2=A0The proxy authenticates Alice (possibly by sending a Digest =C2=A0 =C2=A0authentication challenge), and validates that she is authorize= d to

Again, how is discussion of the internal, non-STIR aspects of SIP operation= ally relevant here?


=C2=A0 =C2=A0assert the identity that she populated in the From header fiel= d.
=C2=A0 =C2=A0This value could be Alice's AoR, but in other cases it cou= ld be some
=C2=A0 =C2=A0different value that the authentication service has authority = over,

That bit of vagueness isn't helpful, given the motivation for doing thi= s work.=C2=A0 It reduces to:=C2=A0 something will get authenticated, but we= won't say what and we won't say where to find out.


=C2=A0 =C2=A0such as a telephone number.=C2=A0 The proxy authentication ser= vice then
=C2=A0 =C2=A0constructs a PASSporT object which contains a JSON representat= ions of
=C2=A0 =C2=A0headers and claims which mirror certain parts of the SIP reque= st,
=C2=A0 =C2=A0including the identity in the From header field.=C2=A0 As a pa= rt of
=C2=A0 =C2=A0generating the PASSporT object, the authentication service sig= ns a
=C2=A0 =C2=A0hash of those headers and claims with the appropriate credenti= al for
=C2=A0 =C2=A0the identity (in this case, the certificate for example.com, whic= h
=C2=A0 =C2=A0covers the identity sip:alice@example.com), and the signature is
=C2=A0 =C2=A0inserted by the proxy server into the Identity header field va= lue of
=C2=A0 =C2=A0the request.=C2=A0 Optionally, the JSON headers and claims the= mselves may
=C2=A0 =C2=A0also be included in the object, encoded in the "canon&quo= t; parameter of
=C2=A0 =C2=A0the Identity header.

why? when?

Tossing in vague references about optional behavior that is neither motivat= ed nor explained usually proves more of a distraction than a help, when wri= ting an 'overview' or an example.





Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 6]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0The proxy, as the holder of the private key for the example.com =C2=A0 =C2=A0domain, is asserting that the originator of this request has b= een
=C2=A0 =C2=A0authenticated and that she is authorized to claim the identity= that
=C2=A0 =C2=A0appears in the From header field.=C2=A0 The proxy inserts an &= quot;info"
=C2=A0 =C2=A0parameter into the Identity header that tells Bob how to acqui= re
=C2=A0 =C2=A0keying material necessary to validate its credentials (a publi= c key),
=C2=A0 =C2=A0in case he doesn't already have it.

A scheme that has an untrusted object carrying information about where to f= ind trust information for the object sounds like a serious security hole.= =C2=A0 Why should the pointer be trusted?


=C2=A0 =C2=A0When Bob's domain receives the request, it verifies the si= gnature
=C2=A0 =C2=A0provided in the Identity header, and thus can validate that th= e
=C2=A0 =C2=A0authority over the identity in the From header field authentic= ated
=C2=A0 =C2=A0the user, and permitted the user to assert that From header fi= eld
=C2=A0 =C2=A0value.=C2=A0 This same validation operation may be performed b= y Bob's user
=C2=A0 =C2=A0agent server (UAS).=C2=A0 As the request has been validated, i= t is
=C2=A0 =C2=A0rendered to Bob. If the validation was unsuccessful, some othe= r
=C2=A0 =C2=A0treatment would be applied by the receiving domain.

Huge operational transition question:=C2=A0 How is the absence of the signa= ture treated?=C2=A0 Today, there are no signatures.=C2=A0 Tomorrow there mi= ght be some, both it won't be true that /all/ incoming requests are sig= ned.=C2=A0 So how is the receiver supposed to handle the absence of a signa= ture?

Related question:=C2=A0 Is everyone certain that transit of the request wil= l /never/ break the signature?=C2=A0 What is the basis for that assessment?= And if a signature /can/ break, then the interpretation of an invalid sign= ature could mean either spoofing or operational error.



5.=C2=A0 Signature Generation and Validation

5.1.=C2=A0 Authentication Service Behavior

=C2=A0 =C2=A0This document specifies a role for SIP entities called an

=C2=A0 =C2=A0 =C2=A0 =C2=A0delete first sentence.=C2=A0 it adds no useful i= nformation.


=C2=A0 =C2=A0authentication service.=C2=A0 The authentication service role = can be
=C2=A0 =C2=A0instantiated, for example, by an intermediary such as a proxy = server

Constant references to implementation (and 'instantiation') possibi= lities distracts from the required task of defining the architecture and fu= nctions of the service.


=C2=A0 =C2=A0or by a user agent.=C2=A0 Any entity that instantiates the aut= hentication
=C2=A0 =C2=A0service role MUST possess the private key of one or more crede= ntials

=C2=A0 =C2=A0 =C2=A0 =C2=A0"private key of one or more credentials&quo= t; - not sure what this means?

One key can have more than one credential?=C2=A0 On the signing side, I'= ;d expect the process to start by choosing a credential and then using its = associated key.


Simpler wording:=C2=A0 =C2=A0The authentication service possesses the priva= te...


=C2=A0 =C2=A0that can be used to sign for a domain or a telephone number (s= ee

=C2=A0 =C2=A0 =C2=A0 =C2=A0 can be used to sign the From identity.


=C2=A0 =C2=A0Section 6.1).=C2=A0 Intermediaries that instantiate this role = MUST be

forward reference.=C2=A0 better to put that material before this.


=C2=A0 =C2=A0capable of authenticating one or more SIP users who can regist= er for

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0one or more SIP users -> users

the word identity hasn't bee used in this paragraph, before this, so th= e referent is unclear.

Also, this requirement for authentication appears to be redundant with the = later specification for authentication in Step 2.


=C2=A0 =C2=A0that identity.=C2=A0 Commonly, this role will be instantiated = by a proxy
=C2=A0 =C2=A0server, since these entities are more likely to have a static<= br> =C2=A0 =C2=A0hostname, hold corresponding credentials, and have access to S= IP
=C2=A0 =C2=A0registrar capabilities that allow them to authenticate users.= =C2=A0 It is
=C2=A0 =C2=A0also possible that the authentication service role might be =C2=A0 =C2=A0instantiated by an entity that acts as a redirect server, but = that is
=C2=A0 =C2=A0left as a topic for future work.

Not only is the above, last sentence about future work; it appears to be en= tirely irrelevant to this specification.=C2=A0 Remove it.



=C2=A0 =C2=A0An authentication service adds the Identity header to SIP requ= ests.

Note that we've read this before.=C2=A0 So I'm raising a redundancy= flag.


=C2=A0 =C2=A0The procedures below define the steps that must be taken when = each an
=C2=A0 =C2=A0header is added.=C2=A0 More than one may appear in a single re= quest, and

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0header -> header /field/ ?

And, by the way, what header field is that?

The "the procedures" sentence adds nothing and is redundant with = the later "entities instantiating" sentence.

In any event, don't make forward references like this.=C2=A0 Put it aft= er the relevant details, so that there already is context and this just enh= ances it.

=C2=A0 =C2=A0 =C2=A0From what I can tell, this entire paragraph should be m= oved toward the end of this section.


=C2=A0 =C2=A0an authentication service may add an Identity header to a requ= est
=C2=A0 =C2=A0that already contains one or more Identity headers.=C2=A0 If t= he Identity
=C2=A0 =C2=A0header added follows extended signing procedures beyond the ba= seline
=C2=A0 =C2=A0given in Section 8, then it differentiates the header with a &= quot;ppt"
=C2=A0 =C2=A0parameter per the fourth step below.






Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 7]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0Entities instantiating the authentication service role perform= the
=C2=A0 =C2=A0following steps, in order, to generate an Identity header for = a SIP
=C2=A0 =C2=A0request:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The authentication service performs the f= ollowing steps in order, to...

Procedural detail should be in a procedural form.=C2=A0 Extended prose like= this isn't as easily grokked.=C2=A0 That invites both writing and read= ing errors to the algorithm.


=C2=A0 =C2=A0Step 1:


=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Step 1:=C2=A0 Authoritative for Identity<= br>

=C2=A0 =C2=A0First, the authentication service must determine whether it is=
=C2=A0 =C2=A0authoritative for the identity of the sender of the request.= =C2=A0 In
=C2=A0 =C2=A0ordinary operations, the authentication service decides this b= y
=C2=A0 =C2=A0inspecting the URI value from the addr-spec component of From = header
=C2=A0 =C2=A0field; this URI will be referred to here as the 'identity = field'.=C2=A0 If
=C2=A0 =C2=A0the identity field contains a SIP or SIP Secure (SIPS) URI, an= d the
=C2=A0 =C2=A0user portion is not a telephone number, the authentication ser= vice

how is its not being a telephone number determined deterministically and co= rrectly?


=C2=A0 =C2=A0MUST extract the hostname portion of the identity field and co= mpare
=C2=A0 =C2=A0it to the domain(s) for which it is responsible (following the=
=C2=A0 =C2=A0procedures in RFC 3261 [RFC3261], Section 16.4).=C2=A0 If the = identity
=C2=A0 =C2=A0field uses the TEL URI scheme [RFC3966], or the identity field= is a
=C2=A0 =C2=A0SIP or SIPS URI with a telephone number in the user portion, t= he
=C2=A0 =C2=A0authentication service determines whether or not it is respons= ible
=C2=A0 =C2=A0for this telephone number; see Section 7.1 for more informatio= n.=C2=A0 An

This canonicalization text seems entirely out of place, in the middle of sp= ecification about authority.


=C2=A0 =C2=A0authentication service proceeding with a signature over a tele= phone
=C2=A0 =C2=A0number MUST then follow the canonicalization procedures descri= bed in
=C2=A0 =C2=A0Section 7.2.=C2=A0 If the authentication service is not author= itative for
=C2=A0 =C2=A0the identity in question, it SHOULD process and forward the re= quest
=C2=A0 =C2=A0normally unless the local policy is to block such requests.=C2= =A0 The
=C2=A0 =C2=A0authentication service MUST NOT add an Identity header if the<= br> =C2=A0 =C2=A0authentication service does not have the authority to make the= claim
=C2=A0 =C2=A0it asserts.

=C2=A0 =C2=A0Step 2:

=C2=A0 =C2=A0 =C2=A0 Step 2:=C2=A0 Authorization


=C2=A0 =C2=A0The authentication service MUST then determine whether or not = the

[or not] remove


=C2=A0 =C2=A0sender of the request is authorized to claim the identity give= n in

=C2=A0 =C2=A0 =C2=A0 =C2=A0sender:=C2=A0 calling user?, calling ua?, origin= ating operator? intermediary?=C2=A0 Although the word is used frequently in= the SIP spec, it is not defined.


=C2=A0 =C2=A0the identity field.=C2=A0 In order to do so, the authenticatio= n service
=C2=A0 =C2=A0MUST authenticate the sender of the message.=C2=A0 Some possib= le ways in
=C2=A0 =C2=A0which this authentication might be performed include:

Remove the pedagogy after the first sentence.=C2=A0 The choices are outside= of this specification and the spec is not enhanced by pedagogy about techn= ical matters outside of its scope.

Also isn't the first sentence redundant with other text in the spec?

=C2=A0 =C2=A0 =C2=A0 If the authentication service is instantiated by a SIP=
=C2=A0 =C2=A0 =C2=A0 intermediary (proxy server), it may authenticate the r= equest with
=C2=A0 =C2=A0 =C2=A0 the authentication scheme used for registration in its= domain
=C2=A0 =C2=A0 =C2=A0 (e.g., Digest authentication).

=C2=A0 =C2=A0 =C2=A0 If the authentication service is instantiated by a SIP= user agent,
=C2=A0 =C2=A0 =C2=A0 a user agent may authenticate its own user through any= system-
=C2=A0 =C2=A0 =C2=A0 specific means, perhaps simply by virtue of having phy= sical access
=C2=A0 =C2=A0 =C2=A0 to the user agent.





Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 8]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0Authorization of the use of a particular username or telephone= number
=C2=A0 =C2=A0in the user part of the From header field is a matter of local= policy
=C2=A0 =C2=A0for the authentication service; see Section 6.1 for more infor= mation.

=C2=A0 =C2=A0Note that this check is performed only on the addr-spec in the=
=C2=A0 =C2=A0identity field (e.g., the URI of the sender, like
=C2=A0 =C2=A0'sip:alice@atlanta.example.com'); it does not conve= rt the display-
=C2=A0 =C2=A0name portion of the From header field (e.g., 'Alice Atlant= a').=C2=A0 For
=C2=A0 =C2=A0more information, see Section 12.6.

'checking' and 'converting' are very different actions.=C2= =A0 So 'it does not' does not flow from the preceding text in the s= entence.



=C2=A0 =C2=A0Step 3:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Step 3:=C2=A0 Timestamp



=C2=A0 =C2=A0An authentication service MUST add a Date header field to SIP<= br>

Why?=C2=A0 (Probably only need to cite the earlier discussion about its use= for replay mitigation. But merely cite; don't duplicate.)


=C2=A0 =C2=A0requests that do not have one.=C2=A0 The authentication servic= e MUST
=C2=A0 =C2=A0ensure that any preexisting Date header in the request is accu= rate.
=C2=A0 =C2=A0Local policy can dictate precisely how accurate the Date must = be; a
=C2=A0 =C2=A0RECOMMENDED maximum discrepancy of sixty seconds will ensure t= hat the
=C2=A0 =C2=A0request is unlikely to upset any verifiers.=C2=A0 If the Date = header
=C2=A0 =C2=A0contains a time different by more than one minute from the cur= rent
=C2=A0 =C2=A0time noted by the authentication service, the authentication s= ervice
=C2=A0 =C2=A0SHOULD reject the request.=C2=A0 This behavior is not mandator= y because a
=C2=A0 =C2=A0user agent client (UAC) could only exploit the Date header in = order
=C2=A0 =C2=A0to cause a request to fail verification; the Identity header i= s not
=C2=A0 =C2=A0intended to provide a source of non-repudiation or a perfect r= ecord

Then where does the non-repudiation feature of STIR come from?


=C2=A0 =C2=A0of when messages are processed.=C2=A0 Finally, the authenticat= ion service
=C2=A0 =C2=A0MUST verify that both the Date header and the current time fal= l
=C2=A0 =C2=A0within the validity period of its credential.

=C2=A0 =C2=A0See Section 12 for information on how the Date header field as= sists
=C2=A0 =C2=A0verifiers.

=C2=A0 =C2=A0Step 4:

=C2=A0 =C2=A0Subsequently, the authentication service MUST form a PASSporT = object
=C2=A0 =C2=A0and add a corresponding an Identity header to the request cont= aining

=C2=A0 =C2=A0 =C2=A0 =C2=A0 a corresponding an ?->? a corresponding


=C2=A0 =C2=A0this signature.=C2=A0 For baseline PASSporT objects headers (w= ithout an

=C2=A0 =C2=A0 =C2=A0 =C2=A0 baseline PASSporT objects headers
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ->
=C2=A0 =C2=A0 =C2=A0 =C2=A0 a baseline PASSporT objects header


=C2=A0 =C2=A0Identity header "ppt" parameter), this follows the p= rocedures in

header?=C2=A0 or header field?


=C2=A0 =C2=A0Section 8; if the authentication service is using an alternati= ve
=C2=A0 =C2=A0"ppt" format, it MUST add an appropriate "ppt&q= uot; parameter and follow

Isn't this text repeating specification text that is elsewhere in the d= ocument?=C2=A0 If so, remove it.


=C2=A0 =C2=A0the procedures associated with that extension (see Section 9).= =C2=A0 After
=C2=A0 =C2=A0the Identity header has been added to the request, the authent= ication
=C2=A0 =C2=A0service MUST also add a "info" parameter to the Iden= tity header.=C2=A0 The
=C2=A0 =C2=A0"info" parameter contains a URI from which the authe= ntication
=C2=A0 =C2=A0service's credential can be acquired; see Section 6.3 for = more on
=C2=A0 =C2=A0credential acquisition.

=C2=A0 =C2=A0Step 5:


=C2=A0 =C2=A0 =C2=A0 Step 5: Canonicalization




Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [Page 9]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0In the circumstances described below, an authentication servic= e will

another forward reference, this time without even a specific pointer.


=C2=A0 =C2=A0add a "canon" parameter to the Identity header.=C2= =A0 The syntax of
=C2=A0 =C2=A0"canon" is given in Section 8; essentially, it conta= ins a base64
=C2=A0 =C2=A0encoding of the JSON header and claims in the PASSporT object.= =C2=A0 The
=C2=A0 =C2=A0presence of "canon" is OPTIONAL baseline PASSporT ob= jects in SIP as a
=C2=A0 =C2=A0because the information carried in the baseline PASSporT objec= t's
=C2=A0 =C2=A0headers and claims is usually redundant with information alrea= dy
=C2=A0 =C2=A0carried elsewhere in the SIP request.=C2=A0 Omitting "can= on" can
=C2=A0 =C2=A0significantly reduce SIP message size, especially when the PAS= SporT
=C2=A0 =C2=A0object contains media keys.

=C2=A0 =C2=A0When however an authentication service creates a PASSporT that= uses

"When however"?


=C2=A0 =C2=A0extension claims beyond the baseline PASSporT object, includin= g
=C2=A0 =C2=A0"canon" is REQUIRED in order for the verification se= rvice to be
=C2=A0 =C2=A0capable of validating the signature.=C2=A0 See Section 9.

=C2=A0 =C2=A0Also, in some cases, a request signed by an authentication ser= vice

"in some cases"?=C2=A0 This is a specification.=C2=A0 Where is th= e clear detail?


=C2=A0 =C2=A0will be rejected by the verification service on the receiving = side,

"on the receiving side" is redundant. Remove it.=C2=A0 Where else= is there a verification service?


=C2=A0 =C2=A0and the authentication service will receive a SIP 4xx status c= ode in
=C2=A0 =C2=A0the backwards direction, such as a 438 indicating a verificati= on

This is offered as descriptive text here. Where is this SIP behavior docume= nted in this spec?


=C2=A0 =C2=A0failure.=C2=A0 If the authentication service did not originall= y send the

The authentication service does sending?=C2=A0 I think it doesn't, and = the definition of its roles implies that it doesn't, but rather that it= is part of one or another module that does.


=C2=A0 =C2=A0Identity header with the "canon" parameter, it SHOUL= D retry a request

and hence it doesn't do retries.=C2=A0 All of this needs to be recast i= n terms that match the specified architecture.


=C2=A0 =C2=A0once after receiving a 438 response, this time including the &= quot;canon".

Why?=C2=A0 This is just guessing.=C2=A0 Protocols that do guessing don'= t work very well.

This interaction needs to be re-specified to be deterministic.


=C2=A0 =C2=A0The information in "canon" is useful on the verifica= tion side for
=C2=A0 =C2=A0debugging errors, and there are some known causes of verificat= ion
=C2=A0 =C2=A0failures (such as the Date header changing in transit, see
=C2=A0 =C2=A0Section 12.1 for more information) that can be resolved by the=
=C2=A0 =C2=A0inclusion of "canon".

=C2=A0 =C2=A0Finally, the authentication service MUST forward the message =C2=A0 =C2=A0normally.

it doesn't do forwarding.



5.2.=C2=A0 Verifier Behavior

=C2=A0 =C2=A0This document specifies a logical role for SIP entities called= a

redundant detail.


=C2=A0 =C2=A0verification service, or verifier.=C2=A0 When a verifier recei= ves a SIP
=C2=A0 =C2=A0message containing one or more Identity headers, it inspects t= he

headers?=C2=A0 header fields?


=C2=A0 =C2=A0signature(s) to verify the identity of the sender of the messa= ge.
=C2=A0 =C2=A0The results of a verification are provided as input to an
=C2=A0 =C2=A0authorization process that is outside the scope of this docume= nt.

Step 5, below, specifies a behavior that is within scope.


=C2=A0 =C2=A0A SIP request may contain zero, one, or more Identity headers.= =C2=A0 A
=C2=A0 =C2=A0verification service performs the procedures above on each Ide= ntity
=C2=A0 =C2=A0header that appears in a request.=C2=A0 If the verifier does n= ot support

What does it mean to 'not support an Identity header [field]"?

Why might there be multiple Identity header [fields]?=C2=A0 How might they = differ?


=C2=A0 =C2=A0an Identity header present in a request due to the presence of= an
=C2=A0 =C2=A0unsupported "ppt" parameter, or if no Identity heade= r is present, and
=C2=A0 =C2=A0the presence of an Identity header is required by local policy= (for
=C2=A0 =C2=A0example, based on a per-sending-domain policy, or a per-sendin= g-user



Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 10]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0policy), then a 428 'Use Identity Header' response MUS= T be sent in
=C2=A0 =C2=A0the backwards direction.=C2=A0 For more on this and other fail= ure
=C2=A0 =C2=A0responses, see Section 13.3.

=C2=A0 =C2=A0In order to verify an Identity header in a message, an entity = acting
=C2=A0 =C2=A0as a verifier MUST perform the following steps, in the order h= ere
=C2=A0 =C2=A0specified.=C2=A0 Note that when an Identity header contains th= e optional
=C2=A0 =C2=A0"canon" parameter, the verifier MUST follow the addi= tional procedures
=C2=A0 =C2=A0in Section 5.2.1.

=C2=A0 =C2=A0Step 1:

=C2=A0 =C2=A0 =C2=A0 =C2=A0Step 1:=C2=A0 PPT parameter


=C2=A0 =C2=A0The verifier MUST inspect any optional "ppt" paramet= er appearing the

[optional] remove.=C2=A0 Especially given the MUST.=C2=A0 It doesn't ma= tter whether the ppt was optional for the signer.

"any" can there be more than one?=C2=A0 If only one then perhaps:=

=C2=A0 =C2=A0 =C2=A0 MUST inspect the "ppt" parameter, if present= in the Identity request.


=C2=A0 =C2=A0Identity request.=C2=A0 If no "ppt" parameter is pre= sent, then the
=C2=A0 =C2=A0verifier proceeds normally below.=C2=A0 If a "ppt" p= arameter value is

'normally' implies the alternative is abnormal.=C2=A0 also, 'be= low' where?


=C2=A0 =C2=A0present, and the verifier does not support it, it MUST ignore = the
=C2=A0 =C2=A0Identity header.=C2=A0 If a supported "ppt" paramete= r value is present,
=C2=A0 =C2=A0the verifier follows the procedures below, including the varia= tions
=C2=A0 =C2=A0described in Step 5.

is the 'below' here different from the one before it?

=C2=A0 =C2=A0 From the above text, it appears that ppt does not affect proc= essing, as long as the ppt is "supported".=C2=A0 That is, an abse= nt ppt and a valid ppt both produce the same sequence 'below'.



=C2=A0 =C2=A0Step 2:

=C2=A0 =C2=A0 =C2=A0 =C2=A0Step 2:=C2=A0 Signature Scope


=C2=A0 =C2=A0In order to determine whether the signature for the identity f= ield
=C2=A0 =C2=A0should be over the entire identity field URI or just a canonic= alized
=C2=A0 =C2=A0telephone number, the verification service MUST follow the
=C2=A0 =C2=A0canonicalization process described in Section 7.2.=C2=A0 That = section also
=C2=A0 =C2=A0describes the procedures the verification service MUST follow = to
=C2=A0 =C2=A0determine if the signer is authoritative for a telephone numbe= r.=C2=A0 For

Those two functions are wildly different.=C2=A0 Why are they part of the sa= me process?


=C2=A0 =C2=A0domains, the verifier MUST follow the process described in
=C2=A0 =C2=A0Section 7.3 to determine if the signer is authoritative for th= e
=C2=A0 =C2=A0identity field.

=C2=A0 =C2=A0Step 3:

=C2=A0 =C2=A0 =C2=A0 Step 3:=C2=A0 Obtain Key


=C2=A0 =C2=A0The verifier must first ensure that it possesses the proper ke= ying
=C2=A0 =C2=A0material to validate the signature in the Identity header fiel= d,
=C2=A0 =C2=A0which usually involves dereferencing a URI in the "info&q= uot; parameter of
=C2=A0 =C2=A0the Identity header.=C2=A0 See Section 6.2 for more informatio= n on these
=C2=A0 =C2=A0procedures.=C2=A0 If the verifier does not support the credent= ial
=C2=A0 =C2=A0described in the "info" parameter, then it should co= nsider the

Only should?=C2=A0 Why???


=C2=A0 =C2=A0credential for this header unsupported.=C2=A0 If a SIP request= contains no
=C2=A0 =C2=A0Identity headers with a supported credential, then the verifie= r MUST
=C2=A0 =C2=A0return a 437 "Unsupported Credential" response

Verifier returns responses?


=C2=A0 =C2=A0Step 4:

=C2=A0 =C2=A0 =C2=A0 =C2=A0Step 4:=C2=A0 Date Window Enforcement


=C2=A0 =C2=A0The verifier MUST furthermore ensure that the value of the Dat= e
=C2=A0 =C2=A0header of the request meets local policy for freshness (usuall= y,



Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 11]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0within sixty seconds) and that it falls within the validity pe= riod of
=C2=A0 =C2=A0the credential used to sign the Identity header.=C2=A0 For mor= e on the
=C2=A0 =C2=A0attacks this prevents, see Section 12.1.=C2=A0 If the "ca= non" parameter is

There was earlier discussion of using a date window validation to mitigate = against some attacks.=C2=A0 There doesn't need to be yet-another refere= nce here.=C2=A0 Just cite the earlier discussion.


=C2=A0 =C2=A0present, the verifier should follow the Date-related behavior = in
=C2=A0 =C2=A0Section 5.2.1.

=C2=A0 =C2=A0Step 5:

=C2=A0 =C2=A0 =C2=A0 =C2=A0Step 5: Signature Validation


=C2=A0 =C2=A0The verifier MUST validate the signature in the Identity heade= r field
=C2=A0 =C2=A0over the PASSporT object.=C2=A0 For baseline PASSporT objects = (with no
=C2=A0 =C2=A0Identity header "ppt" parameter) the verifier MUST f= ollow the
=C2=A0 =C2=A0procedures for generating the signature over a PASSporT object=
=C2=A0 =C2=A0described in Section 8.=C2=A0 If a "ppt" parameter i= s present (and per
=C2=A0 =C2=A0Step 1, is understood), the verifier follows the procedures fo= r that
=C2=A0 =C2=A0"ppt" (see Section 9).=C2=A0 If a verifier determine= s that the that the
=C2=A0 =C2=A0signature in the Identity does not correspond to the reconstru= cted
=C2=A0 =C2=A0signed-identity-digest, then the Identity header should be con= sidered
=C2=A0 =C2=A0invalid.

I suggest breaking this step into two parts:=C2=A0 signature regeneration a= nd signature validation.

It appears that the specification is calling for two (or more???) different= methods of doing signature validation, depending upon whether ppt is prese= nt.=C2=A0 This seems like an outstandingly bad idea.=C2=A0 It creates compl= exity and possibly even outright confusion.

There needs to be a single algorithm for validation, even if components of = the algorithm have branches, such as depending on whether the 'address&= #39; is a URI or a telephone number.



=C2=A0 =C2=A0The presence of multiple Identity headers within a message rai= ses the
=C2=A0 =C2=A0prospect that a verification services could receive a message<= br> =C2=A0 =C2=A0containing some valid and some invalid Identity headers.=C2=A0= If the
=C2=A0 =C2=A0verifier determines all Identity headers within a message are<= br> =C2=A0 =C2=A0invalid, then a 438 'Invalid Identity Header' response= MUST be
=C2=A0 =C2=A0returned.

So it's ok to have no Identity header fields but it's not ok to hav= e identity, where none validate.=C2=A0 This means that the entire transfer = environment is expected and required to convey Identity fields perfectly, a= ll the time.


=C2=A0 =C2=A0The verification of an Identity header does not entail any par= ticular
=C2=A0 =C2=A0treatment of the request.=C2=A0 The handling of the message af= ter the
=C2=A0 =C2=A0verification process depends on how the implementation service= is
=C2=A0 =C2=A0implemented and on local policy.=C2=A0 This specification does= not propose
=C2=A0 =C2=A0any authorization policy for user agents or proxy servers to f= ollow
=C2=A0 =C2=A0based on the presence of a valid Identity header, the presence= of an
=C2=A0 =C2=A0invalid Identity header, or the absence of an Identity header,= but it
=C2=A0 =C2=A0is anticipated that local policies could involve making differ= ent
=C2=A0 =C2=A0forwarding decisions in intermediary implementations, or chang= ing how
=C2=A0 =C2=A0the user is alerted, or how identity is rendered, in user agen= t
=C2=A0 =C2=A0implementations.

I suspect the above paragraph belongs elsewhere and sooner.=C2=A0 It isn= 9;t part of the step sequence.



5.2.1.=C2=A0 Handling 'canon' parameters

=C2=A0 =C2=A0If the optional "canon" parameter of the Identity he= ader is present,

[optional]=C2=A0 remove. it's redudnant with 'if'

[of the Identity header] remove.=C2=A0 there is no other canon parameter.
But really I suspect that even the 'if' is unecessary.=C2=A0 The op= tionality has been established elsewhere.=C2=A0 The task here is merely to = specify what is in a canon.


=C2=A0 =C2=A0it contains a base64 encoding of the header and claim componen= t of

This appears to be a re-specification of canon.=C2=A0 Don't do that.=C2= =A0 Cite its spec and then simply use it.


=C2=A0 =C2=A0the PASSporT object constructed by the authentication service,= and
=C2=A0 =C2=A0this it conveys any canonical telephone number formats created= by the

=C2=A0 =C2=A0 =C2=A0this -> thus ?

there are multiple canon formats?=C2=A0 that doesn't sound very canonic= al.

but again, stating what it conveys is redundant.


=C2=A0 =C2=A0authentication service (see Section 7.2), as well as an "= iat" claim
=C2=A0 =C2=A0corresponding to the Date header that the authentication servi= ce
=C2=A0 =C2=A0used.=C2=A0 The "canon" is provided purely as an opt= imization and
=C2=A0 =C2=A0debugging mechanism for the verification service.

This is the wrong place to state what canon is for.





Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 12]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0When "canon" is present, the verification service MA= Y compute its own

'MAY'???=C2=A0 I don't understand making canonicalization optio= nal, either during signing or during verification.


=C2=A0 =C2=A0canonicalization of the numbers and compare them to the values= in the
=C2=A0 =C2=A0"canon" parameter before performing any cryptographi= c functions in
=C2=A0 =C2=A0order to ascertain whether or not the two ends agree on the ca= nonical
=C2=A0 =C2=A0number form.=C2=A0 Also, when "canon" is present, du= ring Step 4 the
=C2=A0 =C2=A0verification service SHOULD compare the "iat" value = in the "canon" to

This is talking about actions during Step 4.=C2=A0 Move it to Step 4!


=C2=A0 =C2=A0its Date header field value.=C2=A0 If the two are different, a= nd the "iat"
=C2=A0 =C2=A0value is later but within verification service policy for fres= hness,
=C2=A0 =C2=A0the verification service SHOULD perform the computation requir= ed by
=C2=A0 =C2=A0Step 5 using the "iat" value instead of the Date val= ue.=C2=A0 As some
=C2=A0 =C2=A0deployments in the field have been observed to change the Date= header
=C2=A0 =C2=A0in transit, this procedure will prevent some unnecessary verif= ication
=C2=A0 =C2=A0failures.

[unnecessary] remove.

But it won't prevent others.=C2=A0 This means that signatures that were= valid will break.=C2=A0 And this ought to mitigate the handling of broken = signatures.



6.=C2=A0 Credentials

6.1.=C2=A0 Credential Use by the Authentication Service

=C2=A0 =C2=A0In order to act as an authentication service, a SIP entity mus= t have
=C2=A0 =C2=A0access to the private keying material of one or more credentia= ls that
=C2=A0 =C2=A0cover domain names or telephone numbers.=C2=A0 These credentia= ls may
=C2=A0 =C2=A0represent authority over an entire domain (such as example.com) o= r
=C2=A0 =C2=A0potentially a set of domains enumerated by the credential.

[potentially] remove

The implication is that "a set of domains" is not "an entire= domain", but I don't understand how the language says that.=C2=A0= As written, this actually translates to something like: authority over one= or more domains.=C2=A0 Possibly what was meant is something like:=C2=A0 au= thority over an entire domain, or some number of sub-domains under that hig= her-level domain.


=C2=A0 =C2=A0Similarly, a credential may represent authority over a single<= br> =C2=A0 =C2=A0telephone number or a range of telephone numbers.=C2=A0 The wa= y that the

=C2=A0 =C2=A0 =C2=A0 Similarly for telephone numbers, a credential can repr= esent one or a range of numbers.


=C2=A0 =C2=A0scope of a credential is expressed is specific to the credenti= al
=C2=A0 =C2=A0mechanism.

So, there is no standard for the specification of credentials, here. That m= eans that the technical details -- as distinct from the operational policie= s -- of credentials are out of scope, although they are fundamental to prop= er operation of this serve.=C2=A0 This is a showstopper, in terms of specif= ication completeness for the service.


The following paragraph is not about credentials.=C2=A0 It is about signing= policy.=C2=A0 It belongs elsewhere.=C2=A0 And since it isn't really sp= ecifying anything, that elsewhere probably is up towards introductory text.=


=C2=A0 =C2=A0Authorization of the use of a particular username or telephone= number
=C2=A0 =C2=A0in the identity field is a matter of local policy for the
=C2=A0 =C2=A0authentication service, one that depends greatly on the manner= in

Huh?

But really, when a specification says something is out of scope and is a ma= tter for local policy, the specification should not then go on to specify e= xamples of local policy.=C2=A0 In those cases where there is a compelling b= enefit to include such examples, put them in an appendix. But please, then,= explain that compelling benefit.


=C2=A0 =C2=A0which authentication is performed.=C2=A0 For non-telephone num= ber user
=C2=A0 =C2=A0parts, one policy might be as follows: the username given in t= he
=C2=A0 =C2=A0'username' parameter of the Proxy-Authorization header= MUST
=C2=A0 =C2=A0correspond exactly to the username in the From header field of= the
=C2=A0 =C2=A0SIP message.=C2=A0 However, there are many cases in which this= is too
=C2=A0 =C2=A0limiting or inappropriate; a realm might use 'username'= ; parameters in
=C2=A0 =C2=A0Proxy-Authorization that do not correspond to the user-portion= of SIP
=C2=A0 =C2=A0From headers, or a user might manage multiple accounts in the = same
=C2=A0 =C2=A0administrative domain.=C2=A0 In this latter case, a domain mig= ht maintain
=C2=A0 =C2=A0a mapping between the values in the 'username' paramet= er of Proxy-
=C2=A0 =C2=A0Authorization and a set of one or more SIP URIs that might
=C2=A0 =C2=A0legitimately be asserted for that 'username'.=C2=A0 Fo= r example, the
=C2=A0 =C2=A0username can correspond to the 'private identity' as d= efined in Third
=C2=A0 =C2=A0Generation Partnership Project (3GPP), in which case the From = header
=C2=A0 =C2=A0field can contain any one of the public identities associated = with
=C2=A0 =C2=A0this private identity.=C2=A0 In this instance, another policy = might be as
=C2=A0 =C2=A0follows: the URI in the From header field MUST correspond exac= tly to



Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 13]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0one of the mapped URIs associated with the 'username' = given in the
=C2=A0 =C2=A0Proxy-Authorization header.=C2=A0 This is a suitable approach = for
=C2=A0 =C2=A0telephone numbers in particular.

=C2=A0 =C2=A0This specification could also be used with credentials that co= ver a
=C2=A0 =C2=A0single name or URI, such as alice@example.com or
=C2=A0 =C2=A0s= ip:alice@example.com.=C2=A0 This would require a modification to
=C2=A0 =C2=A0authentication service behavior to operate on a whole URI rath= er than
=C2=A0 =C2=A0a domain name.=C2=A0 Because this is not believed to be a pres= sing use
=C2=A0 =C2=A0case, this is deferred to future work, but implementers should= note
=C2=A0 =C2=A0this as a possible future direction.

=C2=A0 =C2=A0Exceptions to such authentication service policies arise for c= ases
=C2=A0 =C2=A0like anonymity; if the AoR asserted in the From header field u= ses a
=C2=A0 =C2=A0form like 'sip:anonymous@example.com' (see [RFC3323]), then = the
=C2=A0 =C2=A0'example.com' proxy might authenticate only that the use= r is a valid
=C2=A0 =C2=A0user in the domain and insert the signature over the From head= er
=C2=A0 =C2=A0field as usual.

6.2.=C2=A0 Credential Use by the Verification Service

=C2=A0 =C2=A0In order to act as a verification service, a SIP entity must h= ave a
=C2=A0 =C2=A0way to acquire and retain credentials for authorities over par= ticular

=C2=A0 =C2=A0 =C2=A0for -> from=C2=A0 ?


=C2=A0 =C2=A0domain names and/or telephone numbers or number ranges.
=C2=A0 =C2=A0Dereferencing the URI found in the "info" parameter = of the Identity
=C2=A0 =C2=A0header (as described in the next section) MUST be supported by= all

forward reference


=C2=A0 =C2=A0verification service implementations to create a baseline mean= s of

I /really/ don't understand the trust model that has a security scheme = where the object giving a pointer to its own credential.=C2=A0 Or rather, I= fear that I do understand it, but don't understand why its considered = credible.


=C2=A0 =C2=A0credential acquisition.=C2=A0 Provided that the credential use= d to sign a
=C2=A0 =C2=A0message is not previously known to the verifier, SIP entities = SHOULD
=C2=A0 =C2=A0discover this credential by dereferencing the "info"= parameter,
=C2=A0 =C2=A0unless they have some more other implementation-specific way o= f
=C2=A0 =C2=A0acquiring the needed keying material, such as an offline store= of
=C2=A0 =C2=A0periodically-updated credentials.=C2=A0 If the URI in the &quo= t;info" parameter
=C2=A0 =C2=A0cannot be dereferenced, then a 436 'Bad Identity-Info'= response MUST
=C2=A0 =C2=A0be returned.

Again, this much non-determinacy in such an essential mechanism ensures /no= n-/interoperability.=C2=A0 I do understand the intent to have private/propr= ietary mechanism at work for use of this spec back in the regulated telecom= space, but that does not mean it needs to distract the public specificatio= n.=C2=A0 A complete specification of a STIR service needs to include a publ= icly-usable key certification mechanism, a la DANE or DKIM or the like.

The application of STIR for other, non-open operations are always free to a= mend the specification through a separate profile that overrides one or ano= ther piece of the base STIR specifications.



=C2=A0 =C2=A0This specification does not propose any particular policy for = a
=C2=A0 =C2=A0verification service to determine whether or not the holder of= a
=C2=A0 =C2=A0credential is the appropriate party to sign for a given SIP id= entity.

This is a fundamental flaw in this specification.=C2=A0 It reduces to sayin= g that the document is specifying a validation service that does not provid= e a deterministic means for assessing validation.


=C2=A0 =C2=A0Guidance on this is deferred to the credential mechanism
=C2=A0 =C2=A0specifications, which must meet the requirements in Section 6.= 4.

=C2=A0 =C2=A0Verification service implementations supporting this specifica= tion
=C2=A0 =C2=A0may wish to have some means of retaining credentials (in accor= dance
=C2=A0 =C2=A0with normal practices for credential lifetimes and revocation)= in
=C2=A0 =C2=A0order to prevent themselves from needlessly downloading the sa= me
=C2=A0 =C2=A0credential every time a request from the same identity is rece= ived.
=C2=A0 =C2=A0Credentials cached in this manner may be indexed in accordance= with

This is gratuitous implementation advice.=C2=A0 Remove it.

If there is a compelling desire to give implementation advice, move it to a= separate document and make it more complete.

It is especially ironic to try to give implementation advice about a mechan= ism that isn't fully specified.



Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 14]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0local policy: for example, by their scope, or the URI given in= the
=C2=A0 =C2=A0"info" parameter value.=C2=A0 Further consideration = of how to cache
=C2=A0 =C2=A0credentials is deferred to the credential mechanism specificat= ions.

6.3.=C2=A0 Handling 'info' parameter URIs


I don't find a specification for the 'info' parameter.=C2=A0 I = find many references to the Identity-Info header field, but assume that'= ;s not what is meant here.

I also find abnf for an ident-info rule, which includes an "ident"= ; literal string.=C2=A0 I suspect this is the reference you intend?

Please reference these more formally and properly cite their definition at = first use.=C2=A0 (If you want to rename rules, to make the use of the rulen= ame more pleasant in the text, that's fine.=C2=A0 But just make sure th= at a new reader can understand what type of reference is being made and whe= re to go to find its definition.

Ditto for "alg".

Ditto for ppt.

And, of course, these are more forward references.=C2=A0 In this case, it&#= 39;s giving detail about something that hasn't even been defined yet.

=C2=A0 =C2=A0An "info" parameter MUST contain a URI which derefer= ences to a

This isn't about the handling of info.=C2=A0 It's defining its cont= ents. They need to be separate segments of text.

=C2=A0 =C2=A0resource that contains the public key components of the creden= tial
=C2=A0 =C2=A0used by the authentication service to sign a request.=C2=A0 It= is
=C2=A0 =C2=A0essential that a URI in the "info parameter" be dere= ferencable by any

Again, specification, not handling.=C2=A0 Also, what do the instructions me= an?=C2=A0 How is the signer to know what is dereferenceable by the verifier= ?


=C2=A0 =C2=A0entity that could plausibly receive the request.=C2=A0 For com= mon cases,
=C2=A0 =C2=A0this means that the URI must be dereferencable by any entity o= n the
=C2=A0 =C2=A0public Internet.=C2=A0 In constrained deployment environments,= a service
=C2=A0 =C2=A0private to the environment might be used instead.

=C2=A0 =C2=A0Beyond providing a means of accessing credentials for an ident= ity,
=C2=A0 =C2=A0the "info" parameter further serves as a means of di= fferentiating
=C2=A0 =C2=A0which particular credential was used to sign a request, when t= here
=C2=A0 =C2=A0are potentially multiple authorities eligible to sign.=C2=A0 F= or example,

It sounds as if the real need is to have an external registry of authorized= credentialing services and then refer to the one that is used by name.=C2= =A0 That provides independent vetting and limits the 'vocabulary' o= f credential service references the message can cite.


=C2=A0 =C2=A0imagine a case where a domain implements the authentication se= rvice
=C2=A0 =C2=A0role for a range of telephone and a user agent belonging to Al= ice has
=C2=A0 =C2=A0acquired a credential for a single telephone number within tha= t
=C2=A0 =C2=A0range.=C2=A0 Either would be eligible to sign a SIP request fo= r the number
=C2=A0 =C2=A0in question.=C2=A0 Verification services however need a means = to
=C2=A0 =C2=A0differentiate which one performed the signature.=C2=A0 The &qu= ot;info"
=C2=A0 =C2=A0parameter performs that function.

6.4.=C2=A0 Credential System Requirements

Besides having extraneous material, this section is almost certainly incomp= lete and probably extremely incomplete.=C2=A0 I suggest removing the sectio= n and simply state that the details of the credentialing system are outside= the scope of this specification, except for specifying a registry that lis= ts possible systems.

Also note that the claimed interest in authentication beyond SIP will also = require credentialing systems.=C2=A0 As such, the entire topic appears to b= e larger than this specification.


=C2=A0 =C2=A0This document makes no recommendation for the use of any speci= fic
=C2=A0 =C2=A0credential system.=C2=A0 Today, there are two primary credenti= al systems

A review of current, external services and hypothetical capabilities is not= appropriate for inclusion inside a technical specification.=C2=A0 Move it = to a separate document.


=C2=A0 =C2=A0in place for proving ownership of domain names: certificates (= e.g.,
=C2=A0 =C2=A0X.509 v3, see [RFC5280]) and the domain name system itself (e.= g.,
=C2=A0 =C2=A0DANE, see [RFC6698]).=C2=A0 It is envisioned that either could= be used in
=C2=A0 =C2=A0the SIP identity context: an "info" parameter could = for example give
=C2=A0 =C2=A0an HTTP URL of the Content-Type 'application/pkix-cert'= ; pointing to a
=C2=A0 =C2=A0certificate (following the conventions of [RFC2585]).=C2=A0 Th= e "info"
=C2=A0 =C2=A0parameter may use the DNS URL scheme (see [RFC4501]) to design= ate
=C2=A0 =C2=A0keys in the DNS.

=C2=A0 =C2=A0While no comparable public credentials exist for telephone num= bers,
=C2=A0 =C2=A0either approach could be applied to telephone numbers.=C2=A0 A= credential
=C2=A0 =C2=A0system based on certificates is given in
=C2=A0 =C2=A0[I-D.ietf-stir-certificates], but this specification can work = with
=C2=A0 =C2=A0other credential systems; for example, using the DNS was propo= sed in
=C2=A0 =C2=A0[I-D.kaplan-stir-cider].

the above isn't 'requirements'.




Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 15]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0In order for a credential system to work with this mechanism, = its
=C2=A0 =C2=A0specification must detail:

=C2=A0 =C2=A0 =C2=A0 which URIs schemes the credential will use in the &quo= t;info"
=C2=A0 =C2=A0 =C2=A0 parameter, and any special procedures required to dere= ference the
=C2=A0 =C2=A0 =C2=A0 URIs

=C2=A0 =C2=A0 =C2=A0 how the verifier can learn the scope of the credential=

what does scope of the credential'?


=C2=A0 =C2=A0 =C2=A0 any special procedures required to extract keying mate= rial from
=C2=A0 =C2=A0 =C2=A0 the resources designated by the URI

=C2=A0 =C2=A0 =C2=A0 any algorithms required to validate the credentials (e= .g. for
=C2=A0 =C2=A0 =C2=A0 certificates, any algorithms used by certificate autho= rities to
=C2=A0 =C2=A0 =C2=A0 sign certificates themselves)

Looks like this needs to define a STIR Credential Registry.


=C2=A0 =C2=A0It is furthermore required that all credential specifications<= br> =C2=A0 =C2=A0describe how the associated credentials will support the manda= tory
=C2=A0 =C2=A0signing algorithm(s) required by PASSporT [I-D.ietf-stir-passp= ort].

So this really is another bullet for the above, indented list?

Then again:=C2=A0 credentials supporting signing algorithms?=C2=A0 I don= 9;t understand this.=C2=A0 The signing algorithms are for the payload using= the key /from/ the credential.=C2=A0 So what does this requirement mean, a= nd why?



=C2=A0 =C2=A0SIP entities cannot reliably predict where SIP requests will =C2=A0 =C2=A0terminate.=C2=A0 When choosing a credential scheme for deploym= ents of this
=C2=A0 =C2=A0specification, it is therefore essential that the trust anchor= (s) for
=C2=A0 =C2=A0credentials be widely trusted, or that deployments restrict th= e use
=C2=A0 =C2=A0of this mechanism to environments where the reliance on partic= ular
=C2=A0 =C2=A0trust anchors is assured by business arrangements or similar =C2=A0 =C2=A0constraints.

=C2=A0 =C2=A0 =C2=A0replace above with:=C2=A0 Use of a credentialing mechan= ism must be supported within a scope sufficient to include the authenticati= on service, the verifying service and the credentialing service.



=C2=A0 =C2=A0Note that credential systems must address key lifecycle manage= ment
=C2=A0 =C2=A0concerns: were a domain to change the credential available at = the
=C2=A0 =C2=A0Identity-Info URI before a verifier evaluates a request signed= by an
=C2=A0 =C2=A0authentication service, this would cause obvious verifier fail= ures.
=C2=A0 =C2=A0When a rollover occurs, authentication services SHOULD thus pr= ovide
=C2=A0 =C2=A0new Identity-Info URIs for each new credential, and SHOULD con= tinue
=C2=A0 =C2=A0to make older key acquisition URIs available for a duration lo= nger
=C2=A0 =C2=A0than the plausible lifetime of a SIP transaction (a minute wou= ld most
=C2=A0 =C2=A0likely suffice).

7.=C2=A0 Identity Types

=C2=A0 =C2=A0This specification focuses primarily on cases where the called= and

Focuses primarily?=C2=A0 What I've been reading in this spec covers bot= h phone and uri forms.=C2=A0 So I don't know what the 'primarily= 9; refers to.


=C2=A0 =C2=A0calling parties identified in the To and From header field val= ues use
=C2=A0 =C2=A0telephone numbers, as this remains the dominant use case in th= e
=C2=A0 =C2=A0deployment of SIP.=C2=A0 However, this specification also work= s with
=C2=A0 =C2=A0"greenfield" identifiers (of the form "sip:user= @host"), and
=C2=A0 =C2=A0potentially other identifiers when SIP interworks with another=
=C2=A0 =C2=A0protocol.

What about these is 'greenfield'?=C2=A0 What does it mean here?





Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 16]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0The guidance in this section also applies to extracting the UR= I

guidance vs. specification?


=C2=A0 =C2=A0containing the originator's identity from the P-Asserted-I= dentity
=C2=A0 =C2=A0header field value instead of the From header field value.=C2= =A0 In some

Huh?=C2=A0 How is the verifier supposed to know where to draw the values fr= om?


=C2=A0 =C2=A0environments, the P-Asserted-Identity header field is used in = lieu of
=C2=A0 =C2=A0the From header field to convey the address-of-record or telep= hone
=C2=A0 =C2=A0number of the sender of a request; while it is not envisioned = that
=C2=A0 =C2=A0many of those networks would or should make use of the Identit= y
=C2=A0 =C2=A0mechanism described in this specification, where they do, loca= l
=C2=A0 =C2=A0policy might therefore dictate that the canonical identity der= ive
=C2=A0 =C2=A0from the P-Asserted-Identity header field rather than the From= .

As soon as a document says 'local policy' it needs to stop specifyi= ng detail, since it is both outside of the scope of the document and it is = distracting from the details of the specification.

If you have to make reference to the possibility, then include something si= mple and brief, such as:

=C2=A0 =C2=A0 =C2=A0Local policies might choose to use a value from fields = other than To and From.=C2=A0 The details for this are outside the scope of= this specification.

To the extent there is a compelling need to specify this alternative mechan= ism, do it in a separate specification.


=C2=A0 =C2=A0Ultimately, in any case where local policy canonicalizes the i= denity
=C2=A0 =C2=A0into a form different from how it appears in the From header f= ield,
=C2=A0 =C2=A0the use of the "canon" parameter by authentication s= ervices is
=C2=A0 =C2=A0RECOMMENDED, but because "canon" itself could then d= ivulge
=C2=A0 =C2=A0information about users or networks, implementers should be mi= ndful
=C2=A0 =C2=A0of the guidelines in Section 11.

remove above paragraph.


=C2=A0 =C2=A0It may not be trivial to tell if a given URI contains a teleph= one

If that means it isn't deterministic, we've got a basic problem, si= nce protocol specs do not offer heuristics.

If it just means there is complexity, then the sentence says nothing useful= .


=C2=A0 =C2=A0number.=C2=A0 In order to determine whether or not the user po= rtion of a

=C2=A0 =C2=A0 [or not] remove


=C2=A0 =C2=A0SIP URI is a telephone number, authentication services and
=C2=A0 =C2=A0verification services MUST perform the following procedure on = any SIP
=C2=A0 =C2=A0URI they inspect which contains a numeric user part.=C2=A0 Not= e that the
=C2=A0 =C2=A0same procedures are followed for creating the canonical form o= f URIs
=C2=A0 =C2=A0found in the From header field as they are in the To header fi= eld or
=C2=A0 =C2=A0the P-Asserted-Identity header field.

If there is an algorithm to follow, specify it as an algorithm. Otherwise, = this is non-normative discussion and isn't very helpful here.


=C2=A0 =C2=A0First, implementations must look for obvious indications that = the
=C2=A0 =C2=A0user-portion of the URI constitutes a telephone number.=C2=A0 = Telephone
=C2=A0 =C2=A0numbers most commonly appear in SIP header field values in the=

"most commonly" suggests that this is discussion, not specificati= on.


=C2=A0 =C2=A0username portion of a SIP URI (e.g.,
=C2=A0 =C2=A0'sip:+17005551008@chicago.example.com;user=3Dp= hone').=C2=A0 The user part of
=C2=A0 =C2=A0that URI conforms to the syntax of the TEL URI scheme (RFC 396= 6
=C2=A0 =C2=A0[RFC3966]).=C2=A0 It is also possible for a TEL URI to appear = in the SIP
=C2=A0 =C2=A0To or From header field outside the context of a SIP or SIPS U= RI
=C2=A0 =C2=A0(e.g., 'tel:+17005551008').=C2=A0 Thus, in some enviro= nments, numbers will
=C2=A0 =C2=A0be explicitly labeled by the use of TEL URIs or the 'user= =3Dphone'
=C2=A0 =C2=A0parameter, or implicitly by the presence of the '+' in= dicator at the
=C2=A0 =C2=A0start of the user-portion.=C2=A0 Absent these indications, if = there are
=C2=A0 =C2=A0numbers present in the user-portion, implementations may also = detect
=C2=A0 =C2=A0that the user-portion of the URI contains a telephone number b= y
=C2=A0 =C2=A0determining whether or not those numbers would be dialable or<= br> =C2=A0 =C2=A0routable in the local environment -- bearing in mind that the<= br> =C2=A0 =C2=A0telephone number may be a valid E.164 number, a nationally-spe= cific
=C2=A0 =C2=A0number, or even a private branch exchange number.=C2=A0 Once a= telephone
=C2=A0 =C2=A0number has been detected, implementations should follow the =C2=A0 =C2=A0procedures in Section 7.2.




Peterson, et al.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expires January 8, 2017= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[Page 17]


Internet-Draft=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP I= dentity=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0July 2016


=C2=A0 =C2=A0If the URI field does not contain a telephone number, URI
=C2=A0 =C2=A0normalization procedures are invoked to canonicalize the URI b= efore
=C2=A0 =C2=A0it is included in a PASSporT object in, for example, an "= uri" claim.
=C2=A0 =C2=A0See Section 7.4 for that behavior.

I suspect that the above topic is confusing what can/must be done as a dete= rministic specification, with what incremental value can be obtained by the= addition of some non-normative heuristics.=C2=A0 Separate these and make t= he deterministic stuff part of the specification and the heuristics part of= an external document discussing real-world implementation, or somesuch.



7.1.=C2=A0 Authority for Telephone Numbers

=C2=A0 =C2=A0In order for telephone numbers to be used with the mechanism =C2=A0 =C2=A0described in this document, authentication services must enrol= l with
=C2=A0 =C2=A0an authority that issues credentials authoritative for telepho= ne
=C2=A0 =C2=A0numbers or telephone number ranges, and verification services = must

--001a1143f620ad3059053a97d343-- From nobody Sun Aug 21 10:01:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BDE512B040 for ; Sun, 21 Aug 2016 10:01:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N1sLOc0p__BL for ; Sun, 21 Aug 2016 10:01:04 -0700 (PDT) Received: from mail-yb0-x230.google.com (mail-yb0-x230.google.com [IPv6:2607:f8b0:4002:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF9C2127735 for ; Sun, 21 Aug 2016 10:01:04 -0700 (PDT) Received: by mail-yb0-x230.google.com with SMTP id a88so4370614ybi.0 for ; Sun, 21 Aug 2016 10:01:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LEQp70w741i8MJKtb1lVVjUBw2LhdK3CwLoY1jXrhVw=; b=O/PsqRi7Y8B9AprR7jvMhnQFQS2qoosC45norlZTNAywZ1jlFOyr2RlPd9OOL6SIiH it+ifN7SY5fbuBle2uVLCfVo18BYuZX+J3xzWb+wl2f3ld1aK7jLj0LxOvBJXMdVfSVg WvH/WynBcqxqb10uQsgYsw4oGTgTUk2dWguSqrmzxzXDHfFO6Ssd76nxIC2YtGPTkLJd UDSvfkyP1Zhq7j9fW3ZF7UNVEmOtxtBUfb3iWuz1qUeQI7O002SKEebVZQi6DiRDJTIs ddx3/i3u172jnL8HwFbDWWUEPfieEllAZ6eu77Nq3NKA09EHKNIBxfL8YnW45kElDpvz HT7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LEQp70w741i8MJKtb1lVVjUBw2LhdK3CwLoY1jXrhVw=; b=AYYfmOZBp0Tx2zYnV9nsJ3Dz2jdSzYhXWC1xr5or0zXaMz2BpIZolqW+CFd8Fm3g19 3M/U+zU1PCsnf65x9mv1IiexXeVrbhlQzdG0HTfLzt7/aUWAK+n7/YR90JiBrYm3RMWb kIgp7tdingwwlMg1pzT1FUvnpZmDbVx3z7+HXKGgIP9xT1Zd5I2Lgo2FK9J5gfsi1Xt0 P4wYdICCWnqioCmsK9c5UhRp/bHe4xsVgdGjHX374VwG1ewKciVX2EbkRXRkw1ZyTWew bGdBQ9qocT1QwNiytaqUzX4gpeppQBDi61xf37Rvm0rysn30L6111AjCLKQ0Zk/R2wQi FmPA== X-Gm-Message-State: AEkooutLNI6ALUUhMTc7qlLw4VhLRu4dQlRiOA/1MW8GV3cmHOJ7JNX9tF0Cv1lfYDs6V1YXStxlDOwJrYrYrQ== X-Received: by 10.37.203.7 with SMTP id b7mr12516131ybg.162.1471798863171; Sun, 21 Aug 2016 10:01:03 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sun, 21 Aug 2016 10:00:22 -0700 (PDT) In-Reply-To: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Eric Rescorla Date: Sun, 21 Aug 2016 10:00:22 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=94eb2c05a3be6bd2bf053a97e0b8 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 17:01:07 -0000 --94eb2c05a3be6bd2bf053a97e0b8 Content-Type: text/plain; charset=UTF-8 On Sun, Aug 21, 2016 at 9:29 AM, Dave Crocker wrote: > On 8/21/2016 8:37 AM, Eric Rescorla wrote: > >> Dave, >> >> Whenever we want to add some cryptographic functionality to a >> protocol [0] (especially when it's messaging/object security >> functionality) we have to ask whether it would be better to define >> something new, specific to the protocol, and hopefully simple, or >> reuse something pre-existing, generic, and presumably more >> complicated. In my experience, the history of those who take the >> former approach is that we find ourselves reinventing a bunch of >> stuff and that it's not as simple as we hoped [1][2] >> > > > We agree. > > I'm not sure what the point of saying here is, since it is highly > consonant with points I have posted here more than once. Well, I'm still wading through the traffic on the list, so sorry if I missed them, but I took the message I was responding to be arguing that we should not use JOSE here but rather should define something specific. Did I misread you? If so, then I apologize and I would greatly appreciate it if you could restate what you are proposing. Thanks, -Ekr > > > > d/ > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --94eb2c05a3be6bd2bf053a97e0b8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Sun, Aug 21, 2016 at 9:29 AM, Dave Crocker <dhc@dcrocker.net>= wrote:
On 8/21/2= 016 8:37 AM, Eric Rescorla wrote:
Dave,

Whenever we want to add some cryptographic functionality to a
protocol [0] (especially when it's messaging/object security
functionality) we have to ask whether it would be better to define
something new, specific to the protocol, and hopefully simple, or
reuse something pre-existing, generic, and presumably more
complicated. In my experience, the history of those who take the
former approach is that we find ourselves reinventing a bunch of
stuff and that it's not as simple as we hoped [1][2]


 We agree.

I'm not sure what the point of saying here is, since it is highly conso= nant with points I have posted here more than once.

Well, I'm still wading through the traffic on the list, so sor= ry if I missed them, but I took the message I was responding to be arguing = that we should not use JOSE here but rather should define something specifi= c. Did I misread you? If so, then I apologize and I would greatly appreciat= e it if you could restate what you are proposing.

= Thanks,
-Ekr
=C2=A0



d/

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

--94eb2c05a3be6bd2bf053a97e0b8-- From nobody Sun Aug 21 10:17:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11F0912B039 for ; Sun, 21 Aug 2016 10:17:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.639 X-Spam-Level: X-Spam-Status: No, score=-0.639 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zipdx.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OtbRUAlpST8o for ; Sun, 21 Aug 2016 10:17:24 -0700 (PDT) Received: from xdev1sjc.zipdx.com (sjc-e-66.zipdx.com [166.88.23.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84C03126D74 for ; Sun, 21 Aug 2016 10:17:24 -0700 (PDT) Received: from DPFyoga (c-73-15-29-134.hsd1.ca.comcast.net [73.15.29.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: dfrankel) by xdev1sjc.zipdx.com (Postfix) with ESMTPSA id 5ACE51B80268 for ; Sun, 21 Aug 2016 10:17:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=zipdx.com; s=default; t=1471799843; bh=XjowfE9mIbsRlGI6nlXpnK3bHDePFJgeIr4Gdv23D7M=; h=From:To:Subject:Date:From; b=SAkLJu82DSQlYf6ADY41FtNuUb7fqeoWAuyD1xOGybWWXYCxi3v6q0rJlCoOVEcwU s/TmykbpWUZeVAOa6uGuvJTesM1RMBv0biLTQtK7eLxve8mzM+vlsNEvniup8EW0zS a9Fp8Kc6MMEawzEqkX92eM8L69s16TwEjz93kdSI= From: "David Frankel" To: Date: Sun, 21 Aug 2016 10:17:23 -0700 Organization: ZipDX LLC Message-ID: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_05E9_01D1FB95.355A8A40" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQ== Content-Language: en-us Archived-At: Subject: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 17:17:27 -0000 This is a multipart message in MIME format. ------=_NextPart_000_05E9_01D1FB95.355A8A40 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Since my last notes, I've gotten some constructive feedback here and privately. Now, hoping to also be constructive, I want to volunteer some comments about specific content in the 4474bis document. I'll preface this as follows: My interest is in how, and to what extent, the proposed functionality will address abuse of the public telephone network. By "public telephone network" I mean that evolving set of networks and technologies which permit any party to make a "telephone call" to any other party, from and to anywhere on the globe, using conventional telephone number addressing and involving either conventional (circa 1970, perhaps?) telephones, or something emulating such an instrument (mobile phone, smart phone, web phone, IP phone, etc.). If we could start over today, we'd no doubt design the system completely differently, but with an installed base of perhaps six or seven billion endpoints and associated addresses, and still growing, it seems likely that this network is still some distance from retirement. By "abuse" I mean (1) the use of the network to defraud, steal from, or deny service to a call recipient; (2) placing of programmatic unsolicited marketing-related and similar calls that, intentionally or not, annoy or harass a call recipient. I note that the prevalence of these abuses compromises the beneficial uses of the network by promoting suboptimal behaviors on the part of telephone subscribers (refusing to answer any call for fear it is an abusive call; sending all or most calls to voice-mail or CAPTCHA to avoid abusive calls; etc.); this impedes the flow and utility of good (non-abusive) calls. Rather than parsing the document section by section, I've structured my comments categorically since several of my suggestions touch in multiple places. OBJECTIVES / PURPOSE I want to reiterate some text from the SIP WG charter because I need to confirm that we are all on the same page regarding our goals. It states: "Since it has become fairly easy to present an incorrect source telephone number, a growing set of problems have emerged over the last decade. As with email, the claimed source identity of a SIP request is not verified, permitting unauthorized use of the source identity as part of deceptive and coercive activities, such as robocalling (bulk unsolicited commercial communications), vishing (voicemail hacking, and impersonating banks) and swatting (impersonating callers to emergency services to stimulate unwarranted large scale law enforcement deployments). In addition, use of an incorrect source telephone number facilitates wire fraud or can lead to a return call at premium rates." (Paragraph 1) And "As its priority mechanism work item, the working group will specify a SIP header-based mechanism for verification that the originator of a SIP session is authorized to use the claimed source telephone number, where the session is established with SIP end to end." (Paragraph 3) That strikes me as a noble undertaking and I'm reading the document in that context. 4474bis states at 3. Background: "Per [RFC7340], problems such as robocalling, voicemail hacking, and swatting are enabled by an attacker's ability to impersonate someone else." I don't agree that RFC7340 states that these abuses are "enabled" by the "ability to impersonate someone else." First, "enabled" implies that if there were no such ability, then these attacks would be "disabled" and it isn't that cut and dried. Impersonation "facilitates" (or as the charter states, is "part of") deceptive and coercive activities. Second, RFC7340 is explicit that both impersonation and obfuscation (or obscuration) contribute to the problems. At Page 4, it says: "In general, number spoofing is used in two ways: impersonation and anonymization." When explaining the context and how 4474bis fits, caution and precision are important. Here's my attempt at replacing the first paragraph of section 3: "Per [RFC7340], attackers often take advantage of the current ease with which calling telephone numbers can be spoofed, and the singular reliance some call recipients place on that value. This allows abuse, for example, of a voicemail service that compares the identity of the caller to a whitelist before determining whether it should allow the caller access to recorded messages. Another example: an Internet telephone application that displays the calling party number (and/or an associated name retrieved from a local database) of a caller, which a human may review to make a policy decision before answering a call. In both of these cases, attackers might attempt to circumvent these authorization policies through impersonation. If the calling party number could be verified - that is, if the receiving person or application could know with reasonable certainty that the calling number was not spoofed - then additional screening could be bypassed. The voicemail service could give the caller direct access to the mailbox without demanding a password; the Internet telephone application could tell the human that less stringent verbal verification procedures can be applied because we have confidence that the caller is who they claim to be." Obviously any well-designed use of current calling number information should recognize how readily this can be spoofed and should not operate without some additional form of verification. It is incorrect to say "The mechanism described in this document provides a strong identity system for detecting attempted impersonation in SIP requests." What is strong about this mechanism is detecting that that the caller is authorized to use the claimed phone number. Since most calls, for the foreseeable future, will lack the Identity header, the mechanism provides no real means of detecting attempted impersonation. Whether a call without an Identity header is or is not an impersonation cannot be determined. Certainly a call with an Identity header that does not verify can be assumed to be either an impersonation or a technical or operational failure, but it seems unlikely that impersonators would go to the trouble of sending an Identity header that will not verify. There is some related discussion currently in section 12.5, but I believe this needs to be brought forward and made more explicit because the "transition" will not be quick. We should also be careful not to assert that this mechanism universally protects the CALLER NAME that is presented for many public network calls. If the NAME is being retrieved from a LOCAL DATABASE (such as the user's contact list in a mobile phone) there is less concern. But if the name is retrieved, as it so often currently is in real-world deployments, from some network database populated by any number of different contributors (including abusers), this mechanism provides no vehicle to prevent a caller with a verified NUMBER from linking that number to a NAME like "Card Services" or "FBI" or "Frankel David" when they are in fact none of the above. The existing text says "the calling party number (and/or Caller-ID) of a caller" but "Caller-ID" is not defined and is ambiguous. Section 12.6 discusses signing of the Display Name; the text indicates this is out of scope but offers some thoughts. I think Display Name generally is out of scope (RFC7340 states: "This effort does not consider how the display name of the caller might be validated.") so 4474bis shouldn't indicate what action "should" or "could" be taken with respect to that field. Note that the Display Name field is only applicable for end-to-end SIP calls. I suggest replacing 12.6 paragraph two as follows: "Many current telephony deployments use the calling number to derive an alphanumeric Calling Name for display to the called party. Given the nature of many of these deployments, even a verified calling number could result in the display of a falsified or impersonated name. The verified calling number will be most useful when the name is derived from a local database (such as a mobile phone contact list) maintained and trusted by the call recipient." We still need a discussion of the other half of the problem (per RFC7340), which is ANONYMIZATION of the calling party. What I see today in 4474bis addresses forms such as "anonymous@example.com" where the caller explicitly declares anonymity. This is really related to privacy, which is why 4474bis has it in a section with that title. For abusive calls, the calling party generally achieves true anonymity either by spoofing somebody else's phone number (often, in fact, just using random numbers, or using a number similar to, but distinct from, the called number), or by using one or more numbers that they have acquired but which are challenging to identify (because when called, the number is not answered or yields only a vague voice-mail, and/or because the service provider responsible for the number doesn't know or won't reveal who the actual customer is). The 3. Background section of 4474bis should include some mention of the anonymity problem, just as it discusses impersonation. I suggest: "Today, because it is easy to originate calls with any value in the From header, abusive callers can populate the field with random telephone numbers. Abusive callers (and their enabling service providers) are likely to be the last adopters of the Identity header. Until the Identity header becomes prevalent across the universe of calls (and that will take some time, since it initially will only apply to end-to-end SIP calls, which are a tiny minority), the anonymity problem will remain because the abusive calls will be lost in the sea of normal (but unauthenticated) calls. Additionally, when a significant number of calls generally ARE authenticated, abusive callers may seek to obtain telephone numbers which they can authenticate, but which still are ambiguous as to their ownership. It will be incumbent upon service providers and the regimes in which they operate to prevent such abuses (through means outside the scope of this document). If it is easy and cheap for abusers to obtain quantities of telephone numbers and associated credentials without providing true identity information linked to those numbers, they will be able to remain anonymous even with valid Identity headers in their calls." As an aside, there are about six billion valid numbers in the North American (+1) Numbering Plan. There are currently probably on the order of one billion of those assigned to end-users. Of the remaining five billion, some fraction are allocated to service providers already (but unassigned to end-users); the rest are currently unallocated. Abusive callers have, and will probably continue to have, a variety of options for finding numbers they can use to keep themselves anonymous until all the loopholes are finally closed. DOMAIN vs. NUMBER AUTHENTICATION The Charter of the STIR Working Group states: "The STIR working group will specify Internet-based mechanisms that allow verification of the calling party's authorization to use a particular telephone number for an incoming call." (First Sentence) "The work of this group is limited to developing a solution for telephone numbers. Expansion of the authorization mechanism to identities using the user@domain or other name forms is out of scope." (Fifth Paragraph) Given this, 4474bis should not contain, to the extent that it does, references to authenticating From headers containing alice@example.com or jon@example.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) There is also text about "signing for a domain." This is explicitly outside of scope, and it distracts from the stated purpose of the WG. If nothing else, I think we want the document to read very clearly, to the greatest extent possible, how the spec is used to achieve the goal of authenticating telephone numbers. I suggest that other than to briefly reiterate that it is out of scope, all the references to authentication of domains be removed, and that all examples be restricted to that which is in scope (phone numbers). Certainly there is value in what has been (speculatively) documented regarding signing for a domain. This material could simply be archived for retrieval later, when we are ready to tackle that. If there is insistence that it be included here (despite the mandate in the charter that "expansion...using user@domain...is out of scope"), then it should be collected and placed in an appendix outside the primary flow of the document. I do realize the value of being forward-looking. At the same time, there is such urgency in getting STIR deployed for telephone numbers that I don't think we can afford the distraction. I must admit that I personally have had a terrible time reconciling how this all actually functions for telephone numbers. "Domain" appears 81 times in the document and I can't tell which, if any, of those occurrences is relevant to the telephone number use case. ERRATA In going through the document I encountered a handful of typos. If you search for each of the text snippets below I think the issue will be apparent. those JSON object in a manner following PASSporT implementation the authentication service at an which contains a JSON representations of and add a corresponding an Identity header to the request is OPTIONAL baseline PASSporT objects in SIP as authentication service creates a PASSporT that uses ["object" is missing] verification service performs the procedures above on each [should be "below"] verifier MUST inspect any optional "ppt" parameter appearing the Step 1, is understood), the verifier follows the procedures ["supported" instead of "understood"] prospect that a verification services could receive The verification of an Identity header does not entail [suggest "The successful verification"] encoding of the header and claim component of this it conveys any canonical telephone number formats canonicalization of the numbers and compare them ["numbers" plural?] unless they have some more other implementation-specific way role for a range of telephone and a user agent belonging to Alice included in a PASSporT object in, for example, an "uri" claim. correspond to any field of the SIP request, but then the optional legitimate request for one user is cut-and-pasted into a request consult some sort of directory that indications David Frankel ZipDXR LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! ------=_NextPart_000_05E9_01D1FB95.355A8A40 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Since my last notes, I’ve gotten some = constructive feedback here and privately. Now, hoping to also be = constructive, I want to volunteer some comments about specific content = in the 4474bis document.

 

I’ll = preface this as follows: My interest is in how, and to what extent, the = proposed functionality will address abuse of the public telephone = network.

 

By “public telephone network” I mean that = evolving set of networks and technologies which permit any party to make = a “telephone call” to any other party, from and to anywhere = on the globe, using conventional telephone number addressing and = involving either conventional (circa 1970, perhaps?) telephones, or = something emulating such an instrument (mobile phone, smart phone, web = phone, IP phone, etc.). If we could start over today, we’d no = doubt design the system completely differently, but with an installed = base of perhaps six or seven billion endpoints and associated addresses, = and still growing, it seems likely that this network is still some = distance from retirement.

 

By = “abuse” I mean (1) the use of the network to defraud, steal = from, or deny service to a call recipient; (2) placing of programmatic = unsolicited marketing-related and similar calls that, intentionally or = not, annoy or harass a call recipient. I note that the prevalence of = these abuses compromises the beneficial uses of the network by promoting = suboptimal behaviors on the part of telephone subscribers (refusing to = answer any call for fear it is an abusive call; sending all or most = calls to voice-mail or CAPTCHA to avoid abusive calls; etc.); this = impedes the flow and utility of good (non-abusive) = calls.

 

Rather than parsing the document section by section, = I’ve structured my comments categorically since several of my = suggestions touch in multiple places.

 

OBJECTIVES / = PURPOSE

 

I want to reiterate some text from the SIP WG charter = because I need to confirm that we are all on the same page regarding our = goals. It states: “Since it has become fairly easy to present an = incorrect source telephone number, a growing set of problems have = emerged over the last decade. As with email, the claimed source identity = of a SIP request is not verified, permitting unauthorized use of the = source identity as part of deceptive and coercive activities, such as = robocalling (bulk unsolicited commercial communications), vishing = (voicemail hacking, and impersonating banks) and swatting (impersonating = callers to emergency services to stimulate unwarranted large scale law = enforcement deployments). In addition, use of an incorrect source = telephone number facilitates wire fraud or can lead to a return call at = premium rates.” (Paragraph 1) And “As its priority mechanism = work item, the working group will specify a SIP header-based mechanism = for verification that the originator of a SIP session is authorized to = use the claimed source telephone number, where the session is = established with SIP end to end.” (Paragraph 3)

 

That strikes = me as a noble undertaking and I’m reading the document in that = context.

 

4474bis states at 3. Background: “Per [RFC7340], = problems such as robocalling, voicemail hacking, and swatting are = enabled by an attacker's ability to impersonate someone else.” I = don’t agree that RFC7340 states that these abuses are = “enabled” by the “ability to impersonate someone = else.” First, “enabled” implies that if there were no = such ability, then these attacks would be “disabled” and it = isn’t that cut and dried. Impersonation “facilitates” = (or as the charter states, is “part of”) deceptive and = coercive activities. Second, RFC7340 is explicit that both impersonation = and obfuscation (or obscuration) contribute to the problems. At Page 4, = it says: “In general, number spoofing is used in two ways: = impersonation and anonymization.”

 

When = explaining the context and how 4474bis fits, caution and precision are = important. Here’s my attempt at replacing the first paragraph of = section 3:

 

“Per [RFC7340], attackers often take advantage = of the current ease with which calling telephone numbers can be spoofed, = and the singular reliance some call recipients place on that value. This = allows abuse, for example, of a voicemail service that compares the = identity of the caller to a whitelist before determining whether it = should allow the caller access to recorded messages. Another example: an = Internet telephone application that displays the calling party number = (and/or an associated name retrieved from a local database) of a caller, = which a human may review to make a policy decision before answering a = call. In both of these cases, attackers might attempt to circumvent = these authorization policies through impersonation. If the calling party = number could be verified – that is, if the receiving person or = application could know with reasonable certainty that the calling number = was not spoofed – then additional screening could be bypassed. The = voicemail service could give the caller direct access to the mailbox = without demanding a password; the Internet telephone application could = tell the human that less stringent verbal verification procedures can be = applied because we have confidence that the caller is who they claim to = be.”

 

Obviously any well-designed use of current calling = number information should recognize how readily this can be spoofed and = should not operate without some additional form of = verification.

 

It is incorrect to say “The mechanism described = in this document provides a strong identity system for detecting = attempted impersonation in SIP requests.” What is strong about = this mechanism is detecting that that the caller is authorized to use = the claimed phone number. Since most calls, for the foreseeable future, = will lack the Identity header, the mechanism provides no real means of = detecting attempted impersonation. Whether a call without an Identity = header is or is not an impersonation cannot be determined. Certainly a = call with an Identity header that does not verify can be assumed to be = either an impersonation or a technical or operational failure, but it = seems unlikely that impersonators would go to the trouble of sending an = Identity header that will not verify.

 

There is = some related discussion currently in section 12.5, but I believe this = needs to be brought forward and made more explicit because the = “transition” will not be quick.

 

We should = also be careful not to assert that this mechanism universally protects = the CALLER NAME that is presented for many public network calls. If the = NAME is being retrieved from a LOCAL DATABASE (such as the user’s = contact list in a mobile phone) there is less concern. But if the name = is retrieved, as it so often currently is in real-world deployments, = from some network database populated by any number of different = contributors (including abusers), this mechanism provides no vehicle to = prevent a caller with a verified NUMBER from linking that number to a = NAME like “Card Services” or “FBI” or = “Frankel David” when they are in fact none of the above. The = existing text says “the calling party number (and/or Caller-ID) of = a caller” but “Caller-ID” is not defined and is = ambiguous.

 

Section 12.6 discusses signing of the Display Name; = the text indicates this is out of scope but offers some thoughts. I = think Display Name generally is out of scope (RFC7340 states: = “This effort does not consider how the display name of the caller = might be validated.”) so 4474bis shouldn’t indicate what = action “should” or “could” be taken with respect = to that field. Note that the Display Name field is only applicable for = end-to-end SIP calls. I suggest replacing 12.6 paragraph two as = follows:

         &= nbsp;    

“Many current telephony deployments use the = calling number to derive an alphanumeric Calling Name for display to the = called party. Given the nature of many of these deployments, even a = verified calling number could result in the display of a falsified or = impersonated name. The verified calling number will be most useful when = the name is derived from a local database (such as a mobile phone = contact list) maintained and trusted by the call = recipient.”

 

We still = need a discussion of the other half of the problem (per RFC7340), which = is ANONYMIZATION of the calling party. What I see today in 4474bis = addresses forms such as “anonymous@example.com” where the = caller explicitly declares anonymity. This is really related to privacy, = which is why 4474bis has it in a section with that title. =

 

For abusive calls, the calling party generally = achieves true anonymity either by spoofing somebody else’s phone = number (often, in fact, just using random numbers, or using a number = similar to, but distinct from, the called number), or by using one or = more numbers that they have acquired but which are challenging to = identify (because when called, the number is not answered or yields only = a vague voice-mail, and/or because the service provider responsible for = the number doesn’t know or won’t reveal who the actual = customer is).

 

The 3. Background section of 4474bis should include = some mention of the anonymity problem, just as it discusses = impersonation. I suggest: “Today, because it is easy to originate = calls with any value in the From header, abusive callers can populate = the field with random telephone numbers. Abusive callers (and their = enabling service providers) are likely to be the last adopters of the = Identity header. Until the Identity header becomes prevalent across the = universe of calls (and that will take some time, since it initially will = only apply to end-to-end SIP calls, which are a tiny minority), the = anonymity problem will remain because the abusive calls will be lost in = the sea of normal (but unauthenticated) calls. Additionally, when a = significant number of calls generally ARE authenticated, abusive callers = may seek to obtain telephone numbers which they can authenticate, but = which still are ambiguous as to their ownership. It will be incumbent = upon service providers and the regimes in which they operate to prevent = such abuses (through means outside the scope of this document). If it is = easy and cheap for abusers to obtain quantities of telephone numbers and = associated credentials without providing true identity information = linked to those numbers, they will be able to remain anonymous even with = valid Identity headers in their calls.”

 

As an aside, = there are about six billion valid numbers in the North American (+1) = Numbering Plan. There are currently probably on the order of one billion = of those assigned to end-users. Of the remaining five billion, some = fraction are allocated to service providers already (but unassigned to = end-users); the rest are currently unallocated. Abusive callers have, = and will probably continue to have, a variety of options for finding = numbers they can use to keep themselves anonymous until all the = loopholes are finally closed.

 

DOMAIN vs. = NUMBER AUTHENTICATION

 

The Charter = of the STIR Working Group states:

 

“The = STIR working group will specify Internet-based mechanisms that allow = verification of the calling party's authorization to use a particular = telephone number for an incoming call.” (First = Sentence)

 

“The work of this group is limited to developing = a solution for telephone numbers. Expansion of the authorization = mechanism to identities using the user@domain or other name forms is out = of scope.” (Fifth Paragraph)

 

Given this, = 4474bis should not contain, to the extent that it does, references to = authenticating From headers containing alice@example.com or = jon@example.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) = There is also text about “signing for a domain.” =

 

This is explicitly outside of scope, and it distracts = from the stated purpose of the WG. If nothing else, I think we want the = document to read very clearly, to the greatest extent possible, how the = spec is used to achieve the goal of authenticating telephone = numbers.

 

I suggest that other than to briefly reiterate that it = is out of scope, all the references to authentication of domains be = removed, and that all examples be restricted to that which is in scope = (phone numbers).

 

Certainly = there is value in what has been (speculatively) documented regarding = signing for a domain. This material could simply be archived for = retrieval later, when we are ready to tackle that.

 

If there is = insistence that it be included here (despite the mandate in the charter = that “expansion...using user@domain...is out of scope”), = then it should be collected and placed in an appendix outside the = primary flow of the document. I do realize the value of being = forward-looking. At the same time, there is such urgency in getting STIR = deployed for telephone numbers that I don’t think we can afford = the distraction.

 

I must admit = that I personally have had a terrible time reconciling how this all = actually functions for telephone numbers. “Domain” appears = 81 times in the document and I can’t tell which, if any, of those = occurrences is relevant to the telephone number use = case.

 

ERRATA

 

In going = through the document I encountered a handful of typos. If you search for = each of the text snippets below I think the issue will be = apparent.

 

those JSON object in a manner following = PASSporT

 

implementation the authentication service at = an

 

which contains a JSON representations = of

 

and add a corresponding an Identity header to the = request

 

is OPTIONAL baseline PASSporT objects in SIP = as

 

authentication service creates a PASSporT that uses = [“object” is missing]

 

verification = service performs the procedures above on each [should be = “below”]

 

verifier = MUST inspect any optional "ppt" parameter appearing = the

 

Step 1, is understood), the verifier follows the = procedures [“supported” instead of = “understood”]

 

prospect = that a verification services could receive

 

The = verification of an Identity header does not entail [suggest “The = successful verification”]

 

encoding of = the header and claim component of

 

this it = conveys any canonical telephone number formats

 

canonicalization of the numbers and compare them = [“numbers” plural?]

 

unless they = have some more other implementation-specific way

 

role for a = range of telephone and a user agent belonging to Alice

 

included in = a PASSporT object in, for example, an "uri" = claim.

 

correspond to any field of the SIP request, but then = the optional

 

legitimate request for one user is cut-and-pasted into = a request

 

consult some sort of directory that = indications

 

 

David Frankel

ZipDX® LLC

Monte Sereno, CA = USA

Tel: 1-800-FRANKEL = (1-800-372-6535)

Watch Our Video!

 

------=_NextPart_000_05E9_01D1FB95.355A8A40-- From nobody Sun Aug 21 13:57:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A45D612B038 for ; Sun, 21 Aug 2016 13:57:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dI8IUVw1a6JO for ; Sun, 21 Aug 2016 13:57:17 -0700 (PDT) Received: from sc9-admin2.yaanatech.net (63-128-177-42-static.dzbja.com [63.128.177.42]) by ietfa.amsl.com (Postfix) with ESMTP id 2DFB812B028 for ; Sun, 21 Aug 2016 13:57:17 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin2.yaanatech.net (Postfix) with ESMTP id 8BFE33F7; Sun, 21 Aug 2016 20:57:16 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id 0700A58090; Sun, 21 Aug 2016 20:57:04 +0000 (UTC) References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> To: David Frankel , stir@ietf.org From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <128dbfa7-9e2a-db98-5e45-23cce082da69@yaanatech.com> Date: Sun, 21 Aug 2016 16:57:15 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> Content-Type: multipart/alternative; boundary="------------BDE6B5572AA3893F1BD54FF1" Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 20:57:18 -0000 This is a multi-part message in MIME format. --------------BDE6B5572AA3893F1BD54FF1 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable Hi David, What you posit is not really a definition of what is regarded (or defined in law) as the public telephone network. The common first industry specifications were developed at the CCIF preparatory conference in 1923, and the first international legal provisions in the Paris Conference in 1925. The equivalent of the distributed global domain name system was developed after WWII, and specified today in Rec. ITU-T E.164. Use of those numbers and the associated routing is the subject of multiple provisions found in treaty instruments and national legislation, as well as what constitutes public telephone service. A recent Technical Report adopted at ETSI details eleven different categories of "compliance obligations" associated with the service. It is unlikely to be retired in part because of the trust levels associated with the legal constructs and provisions that result in relatively high trust levels - which is of course what threads through stir and being led by Martin and many other telecommunication industry colleagues. best, tony On 2016-08-21 1:17 PM, David Frankel wrote: > By =93public telephone network=94 I mean that evolving set of networks = and=20 > technologies which permit any party to make a =93telephone call=94 to a= ny=20 > other party, from and to anywhere on the globe, using conventional=20 > telephone number addressing and involving either conventional (circa=20 > 1970, perhaps?) telephones, or something emulating such an instrument=20 > (mobile phone, smart phone, web phone, IP phone, etc.). If we could=20 > start over today, we=92d no doubt design the system completely=20 > differently, but with an installed base of perhaps six or seven=20 > billion endpoints and associated addresses, and still growing, it=20 > seems likely that this network is still some distance from retirement. --------------BDE6B5572AA3893F1BD54FF1 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hi David,

What you posit is not really a definition of what
is regarded (or defined in law) as the public
telephone network. The common first industry
specifications were developed at the CCIF preparatory
conference in 1923, and the first international
legal provisions in the Paris Conference in 1925.

The equivalent of the distributed global domain name
system was developed after WWII, and specified today
in Rec. ITU-T E.164. Use of those numbers and the
associated routing is the subject of multiple provisions
found in treaty instruments and national legislation, as
well as what constitutes public telephone service. A
recent Technical Report adopted at ETSI details eleven
different categories of "compliance obligations" associated
with the service.

It is unlikely to be retired in part because of the trust
levels associated with the legal constructs and provisions
that result in relatively high trust levels - which is of
course what threads through stir and being led by
Martin and many other telecommunication industry
colleagues.

best,
tony

On 2016-08-21 1:17 PM, David Frankel wrote:
By public telephone network I mean that evolving set of networks and technologies which permit any party to make a telephone call to any other party, from and to anywhere on the globe, using conventional telephone number addressing and involving either conventional (circa 1970, perhaps?) telephones, or something emulating such an instrument (mobile phone, smart phone, web phone, IP phone, etc.). If we could start over today, wed no doubt design the system completely differently, but with an installed base of perhaps six or seven billion endpoints and associated addresses, and still growing, it seems likely that this network is still some distance from retirement.

--------------BDE6B5572AA3893F1BD54FF1-- From nobody Sun Aug 21 15:29:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA0DA12D0EF for ; Sun, 21 Aug 2016 15:28:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FZ8J2Lw1MepV for ; Sun, 21 Aug 2016 15:28:52 -0700 (PDT) Received: from qproxy1-pub.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id 64FBE12D0E9 for ; Sun, 21 Aug 2016 15:28:51 -0700 (PDT) Received: (qmail 5912 invoked by uid 0); 21 Aug 2016 22:28:48 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by qproxy1.mail.unifiedlayer.com with SMTP; 21 Aug 2016 22:28:48 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id ZyPl1t0071MNPNq01yPoja; Sun, 21 Aug 2016 16:23:48 -0600 X-Authority-Analysis: v=2.1 cv=Q9FBveGa c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=48vgC7mUAAAA:8 a=9fpc_yjdAAAA:8 a=A1X0JdhQAAAA:8 a=-438mS4q2AkVbBsoYqsA:9 a=DU5QUHafUWstOArl:21 a=WzUcxWb9NTdWwpjg:21 a=QEXdDO2ut3YA:10 a=L_4-vVooG6gA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=9u8HvbmbAAAA:8 a=FP9wA6rQpzT4uotD:21 a=EtUqEeaQwkHpulsi:21 a=-LEKwkbGVYnuAfJ8:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=MV-GFYrbDBadW76tFgAA:9 a=IKIoO-ieCDEA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=pIvAo3swFcmB_yUFupqo:22 a=Df3jFdWbhGDLdZNm0fyq:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 a=IjJxyoT8hOioF6UjSyFb:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:To: From:Subject:Date; bh=0ieWSGQz6cKuko6grkYBeJ/qy8XX32MYx3xBfbg3+uA=; b=lVeu435 AY3GktK/M8BpQ00F9DvF84iNsrpf5QliXjGisJMEpUegK5QELPuHrxvvHF5zW/GN4dTg5EV4wH8GU UjTN77/0JinODCHjeAtzzFKj+ZB5QvNrR7BsqMEQBVO/; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:59340 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bbb9b-0006BD-J1; Sun, 21 Aug 2016 16:23:45 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sun, 21 Aug 2016 18:23:41 -0400 From: Richard Shockey To: David Frankel , Message-ID: <24B61E30-571F-426A-BC0E-CA1936F42504@shockey.us> Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> In-Reply-To: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> Mime-version: 1.0 Content-type: multipart/mixed; boundary="B_3554648623_772130753" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bbb9b-0006BD-J1 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:59340 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2016 22:28:59 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3554648623_772130753 Content-type: multipart/alternative; boundary="B_3554648623_1187431873" --B_3554648623_1187431873 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 Dave once again, thank you for your deeply thoughtful comments. =C2=A0 =20 You are clearly taking out of your busy schedule as a C level executive to = think hard and fast about what is going on and more important you have skin = in the game because you actually are delivering a real product and real serv= ice. You are part of this industry. You like ATT, Comcast, Sprint and VZ and= others are going to have to live with some of this construct so your views = are clearly important. =20 Let me try and set some things now in context. =20 Right now a process is being put in motion that has multiple parts, multipl= e actors and the IETF is only one of them. In the US right not the principal= actor is the FCC Strike Force.=C2=A0 US National Policy will be driven out of t= hat body.=C2=A0 Protocol decisions will be determined in part out of the IETF an= d this WG but there are multiple actors.=C2=A0 Implementation issues may derive = from joint activity from the ATIS SIP Forum TF and other ATIS bodies but hig= hly critical issues may derive from the proposed work in 3GPP. =C2=A0They are IM= S after all. =C2=A0I have been convinced from the beginning of this process that= unless we give the consumer adequate signaling as to the results of the val= idation process we are not going to succeed.=20 =20 Attached is my Work in progress on what I think User Agent Validation Displ= ay should maybe look like.=20 =20 You ann assume BTW that this activity is being monitored by other NRA=E2=80=99s.=20 =20 My principal worry at this point is setting unrealistic expectations to the= FCC and other NRA=E2=80=99s =C2=A0on what SDO can do and how the vendor community can= implement solutions in a reasonable time frame.=C2=A0 As I have privately brief= ed the usual suspects there is not a =E2=80=9CSilver Bullet=E2=80=9D nor is there a =E2=80=9CM= agic Wand=E2=80=9D by which we as technical professionals can make this scourge go= away overnight. After all this process is now 4 years running for some of u= s. =C2=A0Anyone familiar with the modern phone networks knows there is a IP tran= sition in process and considerations of security, reliability is utmost in t= he minds of service providers and our regulators. =20 This is a multi-layered approach over time. First deal with the NANP E.164 = layered issues between SP=E2=80=99s that can be controlled.=C2=A0 That IMHO is where w= e can achieve first order success.=C2=A0 Let=E2=80=99s postulate Sprint trusts Comcast= and Comcast trusts Sprint.=C2=A0 That is what the JWT signed object can deliver= right now. How certificate =C2=A0credentials are created and passed among US ca= rriers are NOT THE BUSINESS OF THE IETF. That is high policy. =20 How Sprint gets the validation data to its UA is where 3GPP comes into play= .=C2=A0=C2=A0 How that data gets to IP PBX=E2=80=99s or hosted UA is something I think the= SIP Forum can take up at the appropriate time.=C2=A0 How this plays out in othe= r naming and addressing schemes like WEBRTC =C2=A0is for another time and place = and Jon and his folks will tell us when they are ready.=C2=A0=C2=A0=20 =20 We are no longer in the business of ending world hunger. We have a specific= challenge and a task laid out by Chairman Wheeler and Randall Stephenson an= d IMHO they have done exactly the right thing.=20 =20 BTW I also believe there are some unique business opportunities here.=C2=A0 Cle= arly there are some unique models for validation analytics here that no one = wants to actually talk about since that may involve real money J=20 =20 =20 =20 From: stir on behalf of David Frankel Organization: ZipDX LLC Date: Sunday, August 21, 2016 at 1:17 PM To: Subject: [stir] My Editorial Suggestions on RFC4474bis =20 Since my last notes, I=E2=80=99ve gotten some constructive feedback here and priv= ately. Now, hoping to also be constructive, I want to volunteer some comment= s about specific content in the 4474bis document. =20 I=E2=80=99ll preface this as follows: My interest is in how, and to what extent, = the proposed functionality will address abuse of the public telephone networ= k.=20 =20 By =E2=80=9Cpublic telephone network=E2=80=9D I mean that evolving set of networks and = technologies which permit any party to make a =E2=80=9Ctelephone call=E2=80=9D to any ot= her party, from and to anywhere on the globe, using conventional telephone n= umber addressing and involving either conventional (circa 1970, perhaps?) te= lephones, or something emulating such an instrument (mobile phone, smart pho= ne, web phone, IP phone, etc.). If we could start over today, we=E2=80=99d no doub= t design the system completely differently, but with an installed base of pe= rhaps six or seven billion endpoints and associated addresses, and still gro= wing, it seems likely that this network is still some distance from retireme= nt. =20 By =E2=80=9Cabuse=E2=80=9D I mean (1) the use of the network to defraud, steal from, or= deny service to a call recipient; (2) placing of programmatic unsolicited m= arketing-related and similar calls that, intentionally or not, annoy or hara= ss a call recipient. I note that the prevalence of these abuses compromises = the beneficial uses of the network by promoting suboptimal behaviors on the = part of telephone subscribers (refusing to answer any call for fear it is an= abusive call; sending all or most calls to voice-mail or CAPTCHA to avoid a= busive calls; etc.); this impedes the flow and utility of good (non-abusive)= calls. =20 Rather than parsing the document section by section, I=E2=80=99ve structured my c= omments categorically since several of my suggestions touch in multiple plac= es. =20 OBJECTIVES / PURPOSE =20 I want to reiterate some text from the SIP WG charter because I need to con= firm that we are all on the same page regarding our goals. It states: =E2=80=9CSin= ce it has become fairly easy to present an incorrect source telephone number= , a growing set of problems have emerged over the last decade. As with email= , the claimed source identity of a SIP request is not verified, permitting u= nauthorized use of the source identity as part of deceptive and coercive act= ivities, such as robocalling (bulk unsolicited commercial communications), v= ishing (voicemail hacking, and impersonating banks) and swatting (impersonat= ing callers to emergency services to stimulate unwarranted large scale law e= nforcement deployments). In addition, use of an incorrect source telephone n= umber facilitates wire fraud or can lead to a return call at premium rates.=E2= =80=9D (Paragraph 1) And =E2=80=9CAs its priority mechanism work item, the working gro= up will specify a SIP header-based mechanism for verification that the origi= nator of a SIP session is authorized to use the claimed source telephone num= ber, where the session is established with SIP end to end.=E2=80=9D (Paragraph 3) =20 That strikes me as a noble undertaking and I=E2=80=99m reading the document in th= at context. =20 4474bis states at 3. Background: =E2=80=9CPer [RFC7340], problems such as robocal= ling, voicemail hacking, and swatting are enabled by an attacker's ability t= o impersonate someone else.=E2=80=9D I don=E2=80=99t agree that RFC7340 states that thes= e abuses are =E2=80=9Cenabled=E2=80=9D by the =E2=80=9Cability to impersonate someone else.=E2=80=9D= First, =E2=80=9Cenabled=E2=80=9D implies that if there were no such ability, then these= attacks would be =E2=80=9Cdisabled=E2=80=9D and it isn=E2=80=99t that cut and dried. Imperson= ation =E2=80=9Cfacilitates=E2=80=9D (or as the charter states, is =E2=80=9Cpart of=E2=80=9D) decepti= ve and coercive activities. Second, RFC7340 is explicit that both impersonat= ion and obfuscation (or obscuration) contribute to the problems. At Page 4, = it says: =E2=80=9CIn general, number spoofing is used in two ways: impersonation a= nd anonymization.=E2=80=9D=20 =20 When explaining the context and how 4474bis fits, caution and precision are= important. Here=E2=80=99s my attempt at replacing the first paragraph of section = 3: =20 =E2=80=9CPer [RFC7340], attackers often take advantage of the current ease with w= hich calling telephone numbers can be spoofed, and the singular reliance som= e call recipients place on that value. This allows abuse, for example, of a = voicemail service that compares the identity of the caller to a whitelist be= fore determining whether it should allow the caller access to recorded messa= ges. Another example: an Internet telephone application that displays the ca= lling party number (and/or an associated name retrieved from a local databas= e) of a caller, which a human may review to make a policy decision before an= swering a call. In both of these cases, attackers might attempt to circumven= t these authorization policies through impersonation. If the calling party n= umber could be verified =E2=80=93 that is, if the receiving person or application = could know with reasonable certainty that the calling number was not spoofed= =E2=80=93 then additional screening could be bypassed. The voicemail service coul= d give the caller direct access to the mailbox without demanding a password;= the Internet telephone application could tell the human that less stringent= verbal verification procedures can be applied because we have confidence th= at the caller is who they claim to be.=E2=80=9D=20 =20 Obviously any well-designed use of current calling number information shoul= d recognize how readily this can be spoofed and should not operate without s= ome additional form of verification. =20 It is incorrect to say =E2=80=9CThe mechanism described in this document provides= a strong identity system for detecting attempted impersonation in SIP reque= sts.=E2=80=9D What is strong about this mechanism is detecting that that the calle= r is authorized to use the claimed phone number. Since most calls, for the f= oreseeable future, will lack the Identity header, the mechanism provides no = real means of detecting attempted impersonation. Whether a call without an I= dentity header is or is not an impersonation cannot be determined. Certainly= a call with an Identity header that does not verify can be assumed to be ei= ther an impersonation or a technical or operational failure, but it seems un= likely that impersonators would go to the trouble of sending an Identity hea= der that will not verify. =20 There is some related discussion currently in section 12.5, but I believe t= his needs to be brought forward and made more explicit because the =E2=80=9Ctransi= tion=E2=80=9D will not be quick. =20 We should also be careful not to assert that this mechanism universally pro= tects the CALLER NAME that is presented for many public network calls. If th= e NAME is being retrieved from a LOCAL DATABASE (such as the user=E2=80=99s contac= t list in a mobile phone) there is less concern. But if the name is retrieve= d, as it so often currently is in real-world deployments, from some network = database populated by any number of different contributors (including abuser= s), this mechanism provides no vehicle to prevent a caller with a verified N= UMBER from linking that number to a NAME like =E2=80=9CCard Services=E2=80=9D or =E2=80=9CFBI=E2= =80=9D or =E2=80=9CFrankel David=E2=80=9D when they are in fact none of the above. The exist= ing text says =E2=80=9Cthe calling party number (and/or Caller-ID) of a caller=E2=80=9D = but =E2=80=9CCaller-ID=E2=80=9D is not defined and is ambiguous. =20 Section 12.6 discusses signing of the Display Name; the text indicates this= is out of scope but offers some thoughts. I think Display Name generally is= out of scope (RFC7340 states: =E2=80=9CThis effort does not consider how the disp= lay name of the caller might be validated.=E2=80=9D) so 4474bis shouldn=E2=80=99t indica= te what action =E2=80=9Cshould=E2=80=9D or =E2=80=9Ccould=E2=80=9D be taken with respect to that fie= ld. Note that the Display Name field is only applicable for end-to-end SIP c= alls. I suggest replacing 12.6 paragraph two as follows: =20 =E2=80=9CMany current telephony deployments use the calling number to derive an a= lphanumeric Calling Name for display to the called party. Given the nature o= f many of these deployments, even a verified calling number could result in = the display of a falsified or impersonated name. The verified calling number= will be most useful when the name is derived from a local database (such as= a mobile phone contact list) maintained and trusted by the call recipient.=E2= =80=9D =20 We still need a discussion of the other half of the problem (per RFC7340), = which is ANONYMIZATION of the calling party. What I see today in 4474bis add= resses forms such as =E2=80=9Canonymous@example.com=E2=80=9D where the caller explicitly= declares anonymity. This is really related to privacy, which is why 4474bis= has it in a section with that title.=20 =20 For abusive calls, the calling party generally achieves true anonymity eith= er by spoofing somebody else=E2=80=99s phone number (often, in fact, just using ra= ndom numbers, or using a number similar to, but distinct from, the called nu= mber), or by using one or more numbers that they have acquired but which are= challenging to identify (because when called, the number is not answered or= yields only a vague voice-mail, and/or because the service provider respons= ible for the number doesn=E2=80=99t know or won=E2=80=99t reveal who the actual customer= is). =20 The 3. Background section of 4474bis should include some mention of the ano= nymity problem, just as it discusses impersonation. I suggest: =E2=80=9CToday, bec= ause it is easy to originate calls with any value in the From header, abusiv= e callers can populate the field with random telephone numbers. Abusive call= ers (and their enabling service providers) are likely to be the last adopter= s of the Identity header. Until the Identity header becomes prevalent across= the universe of calls (and that will take some time, since it initially wil= l only apply to end-to-end SIP calls, which are a tiny minority), the anonym= ity problem will remain because the abusive calls will be lost in the sea of= normal (but unauthenticated) calls. Additionally, when a significant number= of calls generally ARE authenticated, abusive callers may seek to obtain te= lephone numbers which they can authenticate, but which still are ambiguous a= s to their ownership. It will be incumbent upon service providers and the re= gimes in which they operate to prevent such abuses (through means outside th= e scope of this document). If it is easy and cheap for abusers to obtain qua= ntities of telephone numbers and associated credentials without providing tr= ue identity information linked to those numbers, they will be able to remain= anonymous even with valid Identity headers in their calls.=E2=80=9D =20 As an aside, there are about six billion valid numbers in the North America= n (+1) Numbering Plan. There are currently probably on the order of one bill= ion of those assigned to end-users. Of the remaining five billion, some frac= tion are allocated to service providers already (but unassigned to end-users= ); the rest are currently unallocated. Abusive callers have, and will probab= ly continue to have, a variety of options for finding numbers they can use t= o keep themselves anonymous until all the loopholes are finally closed. =20 DOMAIN vs. NUMBER AUTHENTICATION =20 The Charter of the STIR Working Group states: =20 =E2=80=9CThe STIR working group will specify Internet-based mechanisms that allow= verification of the calling party's authorization to use a particular telep= hone number for an incoming call.=E2=80=9D (First Sentence) =20 =E2=80=9CThe work of this group is limited to developing a solution for telephone= numbers. Expansion of the authorization mechanism to identities using the u= ser@domain or other name forms is out of scope.=E2=80=9D (Fifth Paragraph) =20 Given this, 4474bis should not contain, to the extent that it does, referen= ces to authenticating From headers containing alice@example.com or jon@examp= le.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) There is also = text about =E2=80=9Csigning for a domain.=E2=80=9D=20 =20 This is explicitly outside of scope, and it distracts from the stated purpo= se of the WG. If nothing else, I think we want the document to read very cle= arly, to the greatest extent possible, how the spec is used to achieve the g= oal of authenticating telephone numbers. =20 I suggest that other than to briefly reiterate that it is out of scope, all= the references to authentication of domains be removed, and that all exampl= es be restricted to that which is in scope (phone numbers). =20 Certainly there is value in what has been (speculatively) documented regard= ing signing for a domain. This material could simply be archived for retriev= al later, when we are ready to tackle that. =20 If there is insistence that it be included here (despite the mandate in the= charter that =E2=80=9Cexpansion...using user@domain...is out of scope=E2=80=9D), then i= t should be collected and placed in an appendix outside the primary flow of = the document. I do realize the value of being forward-looking. At the same t= ime, there is such urgency in getting STIR deployed for telephone numbers th= at I don=E2=80=99t think we can afford the distraction. =20 I must admit that I personally have had a terrible time reconciling how thi= s all actually functions for telephone numbers. =E2=80=9CDomain=E2=80=9D appears 81 time= s in the document and I can=E2=80=99t tell which, if any, of those occurrences is = relevant to the telephone number use case. =20 ERRATA =20 In going through the document I encountered a handful of typos. If you sear= ch for each of the text snippets below I think the issue will be apparent. =20 those JSON object in a manner following PASSporT =20 implementation the authentication service at an =20 which contains a JSON representations of =20 and add a corresponding an Identity header to the request =20 is OPTIONAL baseline PASSporT objects in SIP as =20 authentication service creates a PASSporT that uses [=E2=80=9Cobject=E2=80=9D is missin= g] =20 verification service performs the procedures above on each [should be =E2=80=9Cbe= low=E2=80=9D] =20 verifier MUST inspect any optional "ppt" parameter appearing the =20 Step 1, is understood), the verifier follows the procedures [=E2=80=9Csupported=E2=80= =9D instead of =E2=80=9Cunderstood=E2=80=9D] =20 prospect that a verification services could receive =20 The verification of an Identity header does not entail [suggest =E2=80=9CThe succ= essful verification=E2=80=9D] =20 encoding of the header and claim component of =20 this it conveys any canonical telephone number formats =20 canonicalization of the numbers and compare them [=E2=80=9Cnumbers=E2=80=9D plural?] =20 unless they have some more other implementation-specific way =20 role for a range of telephone and a user agent belonging to Alice =20 included in a PASSporT object in, for example, an "uri" claim. =20 correspond to any field of the SIP request, but then the optional =20 legitimate request for one user is cut-and-pasted into a request =20 consult some sort of directory that indications =20 =20 David Frankel ZipDX=C2=AE LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! =20 _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir=20 --B_3554648623_1187431873 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Dave once again, thank you for your deeply thoughtful comments. = =C2=A0

 

= You are clearly taking out of your busy schedule as a C level executive to t= hink hard and fast about what is going on and more important you have skin i= n the game because you actually are delivering a real product and real servi= ce. You are part of this industry. You like ATT, Comcast, Sprint and VZ and = others are going to have to live with some of this construct so your views a= re clearly important.

 

=

Let me try and set some things now in context.=

 

Right now a p= rocess is being put in motion that has multiple parts, multiple actors and t= he IETF is only one of them. In the US right not the principal actor is the = FCC Strike Force.=C2=A0 US National Policy will be driven out of that body.=C2=A0 Pr= otocol decisions will be determined in part out of the IETF and this WG but = there are multiple actors.=C2=A0 Implementation issues may derive from joint act= ivity from the ATIS SIP Forum TF and other ATIS bodies but highly critical i= ssues may derive from the proposed work in 3GPP. =C2=A0They are IMS after all. =C2= =A0I have been convinced from the beginning of this process that unless we giv= e the consumer adequate signaling as to the results of the validation proces= s we are not going to succeed.

 =

Attached is my Work in progress on what I think= User Agent Validation Display should maybe look like.

 

You ann assume BTW that= this activity is being monitored by other NRA’s.

 

My principal worry at = this point is setting unrealistic expectations to the FCC and other NRA̵= 7;s =C2=A0on what SDO can do and how the vendor community can implement solution= s in a reasonable time frame.=C2=A0 As I have privately briefed the usual suspec= ts there is not a “Silver Bullet” nor is there a “Magic Wa= nd” by which we as technical professionals can make this scourge go aw= ay overnight. After all this process is now 4 years running for some of us. = =C2=A0Anyone familiar with the modern phone networks knows there is a IP transit= ion in process and considerations of security, reliability is utmost in the = minds of service providers and our regulators.

 

This is a multi-layered approach= over time. First deal with the NANP E.164 layered issues between SP’s= that can be controlled.=C2=A0 That IMHO is where we can achieve first order suc= cess.=C2=A0 Let’s postulate Sprint trusts Comcast and Comcast trusts Sprin= t.=C2=A0 That is what the JWT signed object can deliver right now. How certifica= te =C2=A0credentials are created and passed among US carriers are NOT THE BUSINE= SS OF THE IETF. That is high policy.

&= nbsp;

How Sprint gets the validation data to its= UA is where 3GPP comes into play.=C2=A0=C2=A0 How that data gets to IP PBX’s = or hosted UA is something I think the SIP Forum can take up at the appropria= te time.=C2=A0 How this plays out in other naming and addressing schemes like WE= BRTC =C2=A0is for another time and place and Jon and his folks will tell us when= they are ready.=C2=A0=C2=A0

 

=

We are no longer in the business of ending world hunger. = We have a specific challenge and a task laid out by Chairman Wheeler and Ran= dall Stephenson and IMHO they have done exactly the right thing. =

 

BTW I also be= lieve there are some unique business opportunities here.=C2=A0 Clearly there are= some unique models for validation analytics here that no one wants to actua= lly talk about since that may involve real money J

 

 

 

From: stir <stir-bounces@ietf.org> on behalf of David = Frankel <dfrankel@zipdx.com>
Organization: ZipDX LLC
D= ate: Sunday, August 21, 2016 at 1:17 PM
To: <stir@ietf.org&= gt;
Subject: [stir] My Editorial Suggestions on RFC4474bis<= span style=3D'font-size:12.0pt;color:black'>

<= p class=3DMsoNormal> 

Since my last notes, I̵= 7;ve gotten some constructive feedback here and privately. Now, hoping to al= so be constructive, I want to volunteer some comments about specific content= in the 4474bis document.

 =

I’ll preface this as follows: My interest is in= how, and to what extent, the proposed functionality will address abuse of t= he public telephone network.

 

By “public telephone network” I mean = that evolving set of networks and technologies which permit any party to mak= e a “telephone call” to any other party, from and to anywhere on= the globe, using conventional telephone number addressing and involving eit= her conventional (circa 1970, perhaps?) telephones, or something emulating s= uch an instrument (mobile phone, smart phone, web phone, IP phone, etc.). If= we could start over today, we’d no doubt design the system completely= differently, but with an installed base of perhaps six or seven billion end= points and associated addresses, and still growing, it seems likely that thi= s network is still some distance from retirement.

 

By “abuse” I mean= (1) the use of the network to defraud, steal from, or deny service to a cal= l recipient; (2) placing of programmatic unsolicited marketing-related and s= imilar calls that, intentionally or not, annoy or harass a call recipient. I= note that the prevalence of these abuses compromises the beneficial uses of= the network by promoting suboptimal behaviors on the part of telephone subs= cribers (refusing to answer any call for fear it is an abusive call; sending= all or most calls to voice-mail or CAPTCHA to avoid abusive calls; etc.); t= his impedes the flow and utility of good (non-abusive) calls.

=

 

Rather than parsi= ng the document section by section, I’ve structured my comments catego= rically since several of my suggestions touch in multiple places.=

 

OBJECTIVES / = PURPOSE

 

I want to reiterate some text from the SIP WG charter because I need to= confirm that we are all on the same page regarding our goals. It states: &#= 8220;Since it has become fairly easy to present an incorrect source telephon= e number, a growing set of problems have emerged over the last decade. As wi= th email, the claimed source identity of a SIP request is not verified, perm= itting unauthorized use of the source identity as part of deceptive and coer= cive activities, such as robocalling (bulk unsolicited commercial communicat= ions), vishing (voicemail hacking, and impersonating banks) and swatting (im= personating callers to emergency services to stimulate unwarranted large sca= le law enforcement deployments). In addition, use of an incorrect source tel= ephone number facilitates wire fraud or can lead to a return call at premium= rates.” (Paragraph 1) And “As its priority mechanism work item,= the working group will specify a SIP header-based mechanism for verificatio= n that the originator of a SIP session is authorized to use the claimed sour= ce telephone number, where the session is established with SIP end to end.&#= 8221; (Paragraph 3)

 

That strikes me as a noble undertaking and I’m readin= g the document in that context.

 =

4474bis states at 3. Background: “Per [RF= C7340], problems such as robocalling, voicemail hacking, and swatting are en= abled by an attacker's ability to impersonate someone else.” I donR= 17;t agree that RFC7340 states that these abuses are “enabled” b= y the “ability to impersonate someone else.” First, “enabl= ed” implies that if there were no such ability, then these attacks wou= ld be “disabled” and it isn’t that cut and dried. Imperson= ation “facilitates” (or as the charter states, is “part of= ”) deceptive and coercive activities. Second, RFC7340 is explicit that= both impersonation and obfuscation (or obscuration) contribute to the probl= ems. At Page 4, it says: “In general, number spoofing is used in two w= ays: impersonation and anonymization.”

 

When explaining the context and h= ow 4474bis fits, caution and precision are important. Here’s my attemp= t at replacing the first paragraph of section 3:

 

“Per [RFC7340], attacker= s often take advantage of the current ease with which calling telephone numb= ers can be spoofed, and the singular reliance some call recipients place on = that value. This allows abuse, for example, of a voicemail service that comp= ares the identity of the caller to a whitelist before determining whether it= should allow the caller access to recorded messages. Another example: an In= ternet telephone application that displays the calling party number (and/or = an associated name retrieved from a local database) of a caller, which a hum= an may review to make a policy decision before answering a call. In both of = these cases, attackers might attempt to circumvent these authorization polic= ies through impersonation. If the calling party number could be verified = 211; that is, if the receiving person or application could know with reasona= ble certainty that the calling number was not spoofed – then additiona= l screening could be bypassed. The voicemail service could give the caller d= irect access to the mailbox without demanding a password; the Internet telep= hone application could tell the human that less stringent verbal verificatio= n procedures can be applied because we have confidence that the caller is wh= o they claim to be.”

 

Obviously any well-designed use of current calling = number information should recognize how readily this can be spoofed and shou= ld not operate without some additional form of verification.

<= p class=3DMsoNormal> 

It is incorrect to= say “The mechanism described in this document provides a strong ident= ity system for detecting attempted impersonation in SIP requests.” Wha= t is strong about this mechanism is detecting that that the caller is author= ized to use the claimed phone number. Since most calls, for the foreseeable = future, will lack the Identity header, the mechanism provides no real means = of detecting attempted impersonation. Whether a call without an Identity hea= der is or is not an impersonation cannot be determined. Certainly a call wit= h an Identity header that does not verify can be assumed to be either an imp= ersonation or a technical or operational failure, but it seems unlikely that= impersonators would go to the trouble of sending an Identity header that wi= ll not verify.

 

There is some related discussion currently in section 12.5, but = I believe this needs to be brought forward and made more explicit because th= e “transition” will not be quick.

 

We should also be careful not to = assert that this mechanism universally protects the CALLER NAME that is pres= ented for many public network calls. If the NAME is being retrieved from a L= OCAL DATABASE (such as the user’s contact list in a mobile phone) ther= e is less concern. But if the name is retrieved, as it so often currently is= in real-world deployments, from some network database populated by any numb= er of different contributors (including abusers), this mechanism provides no= vehicle to prevent a caller with a verified NUMBER from linking that number= to a NAME like “Card Services” or “FBI” or “F= rankel David” when they are in fact none of the above. The existing te= xt says “the calling party number (and/or Caller-ID) of a caller”= ; but “Caller-ID” is not defined and is ambiguous.

 

Section 12.6 dis= cusses signing of the Display Name; the text indicates this is out of scope = but offers some thoughts. I think Display Name generally is out of scope (RF= C7340 states: “This effort does not consider how the display name of t= he caller might be validated.”) so 4474bis shouldn’t indicate wh= at action “should” or “could” be taken with respect = to that field. Note that the Display Name field is only applicable for end-t= o-end SIP calls. I suggest replacing 12.6 paragraph two as follows:

        &nb= sp;     

“M= any current telephony deployments use the calling number to derive an alphan= umeric Calling Name for display to the called party. Given the nature of man= y of these deployments, even a verified calling number could result in the d= isplay of a falsified or impersonated name. The verified calling number will= be most useful when the name is derived from a local database (such as a mo= bile phone contact list) maintained and trusted by the call recipient.”= ;

 

W= e still need a discussion of the other half of the problem (per RFC7340), wh= ich is ANONYMIZATION of the calling party. What I see today in 4474bis addre= sses forms such as “anonymous@example.com” where the caller expl= icitly declares anonymity. This is really related to privacy, which is why 4= 474bis has it in a section with that title.

 

For abusive calls, the calling par= ty generally achieves true anonymity either by spoofing somebody else’= s phone number (often, in fact, just using random numbers, or using a number= similar to, but distinct from, the called number), or by using one or more = numbers that they have acquired but which are challenging to identify (becau= se when called, the number is not answered or yields only a vague voice-mail= , and/or because the service provider responsible for the number doesn’= ;t know or won’t reveal who the actual customer is).

 

The 3. Background se= ction of 4474bis should include some mention of the anonymity problem, just = as it discusses impersonation. I suggest: “Today, because it is easy t= o originate calls with any value in the From header, abusive callers can pop= ulate the field with random telephone numbers. Abusive callers (and their en= abling service providers) are likely to be the last adopters of the Identity= header. Until the Identity header becomes prevalent across the universe of = calls (and that will take some time, since it initially will only apply to e= nd-to-end SIP calls, which are a tiny minority), the anonymity problem will = remain because the abusive calls will be lost in the sea of normal (but unau= thenticated) calls. Additionally, when a significant number of calls general= ly ARE authenticated, abusive callers may seek to obtain telephone numbers w= hich they can authenticate, but which still are ambiguous as to their owners= hip. It will be incumbent upon service providers and the regimes in which th= ey operate to prevent such abuses (through means outside the scope of this d= ocument). If it is easy and cheap for abusers to obtain quantities of teleph= one numbers and associated credentials without providing true identity infor= mation linked to those numbers, they will be able to remain anonymous even w= ith valid Identity headers in their calls.”

 

As an aside, there are about = six billion valid numbers in the North American (+1) Numbering Plan. There a= re currently probably on the order of one billion of those assigned to end-u= sers. Of the remaining five billion, some fraction are allocated to service = providers already (but unassigned to end-users); the rest are currently unal= located. Abusive callers have, and will probably continue to have, a variety= of options for finding numbers they can use to keep themselves anonymous un= til all the loopholes are finally closed.

&= nbsp;

DOMAIN vs. NUMBER AUTHENTICATION=

 

The Cha= rter of the STIR Working Group states:

&nbs= p;

“The STIR working group will speci= fy Internet-based mechanisms that allow verification of the calling party's = authorization to use a particular telephone number for an incoming call.R= 21; (First Sentence)

 

<= p class=3DMsoNormal>“The work of this group is limited to developing a s= olution for telephone numbers. Expansion of the authorization mechanism to i= dentities using the user@domain or other name forms is out of scope.” = (Fifth Paragraph)

 

Given this, 4474bis should not contain, to the extent that it= does, references to authenticating From headers containing alice@example.co= m or jon@example.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) = There is also text about “signing for a domain.”

=

 

This is explicitl= y outside of scope, and it distracts from the stated purpose of the WG. If n= othing else, I think we want the document to read very clearly, to the great= est extent possible, how the spec is used to achieve the goal of authenticat= ing telephone numbers.

 

I suggest that other than to briefly reiterate that it i= s out of scope, all the references to authentication of domains be removed, = and that all examples be restricted to that which is in scope (phone numbers= ).

 

= Certainly there is value in what has been (speculatively) documented regardi= ng signing for a domain. This material could simply be archived for retrieva= l later, when we are ready to tackle that.

=  

If there is insistence that it be in= cluded here (despite the mandate in the charter that “expansion...usin= g user@domain...is out of scope”), then it should be collected and pla= ced in an appendix outside the primary flow of the document. I do realize th= e value of being forward-looking. At the same time, there is such urgency in= getting STIR deployed for telephone numbers that I don’t think we can= afford the distraction.

 <= /p>

I must admit that I personally have had a terrible tim= e reconciling how this all actually functions for telephone numbers. “= Domain” appears 81 times in the document and I can’t tell which,= if any, of those occurrences is relevant to the telephone number use case.<= o:p>

 

ERR= ATA

 

In going through the document I encountered a handful of typos. If you sear= ch for each of the text snippets below I think the issue will be apparent.

 

thos= e JSON object in a manner following PASSporT

 

implementation the authentication = service at an

 

which contains a JSON representations of

 

and add a corresponding an = Identity header to the request

 <= /o:p>

is OPTIONAL baseline PASSporT objects in SIP as<= o:p>

 

aut= hentication service creates a PASSporT that uses [“object” is mi= ssing]

 

verification service performs the procedures above on each [should be &#= 8220;below”]

 

verifier MUST inspect any optional "ppt" parameter= appearing the

 

Step 1, is understood), the verifier follows the procedures [= 220;supported” instead of “understood”]

 

prospect that a verif= ication services could receive

 <= /o:p>

The verification of an Identity header does not = entail [suggest “The successful verification”]

 

encoding of the head= er and claim component of

 =

this it conveys any canonical telephone number format= s

 

c= anonicalization of the numbers and compare them [“numbers” plura= l?]

 

unless they have some more other implementation-specific way

=

 

role for a range = of telephone and a user agent belonging to Alice

 

included in a PASSporT object = in, for example, an "uri" claim.

=  

correspond to any field of the SIP r= equest, but then the optional

 

legitimate request for one user is cut-and-pasted= into a request

 

consult some sort of directory that indications

<= p class=3DMsoNormal> 

 <= /p>

David Frankel<= /o:p>

ZipDX=C2=AE= LLC

Mon= te Sereno, CA USA

Tel: 1-800-FRANKEL (1-800-372-6535)

Watch Our Video!

 

_______________________________________________ stir = mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir <= /o:p>

--B_3554648623_1187431873-- --B_3554648623_772130753 Content-type: application/vnd.openxmlformats-officedocument.presentationml.presentation; name="Shockey Call Validation Display SIPNOC v2 2016.pptx"; x-mac-creator="50505433"; x-mac-type="50505458" Content-disposition: attachment; filename="Shockey Call Validation Display SIPNOC v2 2016.pptx" Content-transfer-encoding: base64 UEsDBBQABgAIAAAAIQAbww77agIAAPkWAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIo oAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADMmMuOmzAUhveV+g7I2yo4TNvptAqZRS+r XkaaqdStC4fErW/CTpq8fW2TZEhEBzKGMpsotvn/8xkOx8az6w1n0RpKTaVIURJPUQQikzkV ixR9v/s0uUKRNkTkhEkBKdqCRtfz589md1sFOrJqoVO0NEa9w1hnS+BEx1KBsCOFLDkxtlku sCLZb7IAfDGdXuJMCgPCTIzzQPPZByjIipno48Z2VyRWjqL31XUuVIqIUoxmxNhh7EZxo+6X gsWJkHIX2A80a5Rolrj+ZkUJTD+Atxb5yT2Y7OYfW6W/Ri+p0i/+PQ/gRSPTZuJGmjWGFs0i P2A13+yDLmkO0Q0pzVfC7QVYKYNVCdpKPFj88J1vmJosCppBLrMVt5K4bsbZUTPmhIr9pJtg spU2kv/gDFMD/KaUSifBQAdT5weloXC48R0ZLp4Aw8snwPDqfzO45NTMdn4h2tgiVW+EJ8ZJ pta8OzHtaIbhOIcgPD1DCcKTM5QgPDVDCV6PTnA5OsGb0QmuRid4OzpBMh0fYfyqmIxfFpNx 6qKQBvR+xaw1en8mNe82pqX9hJArs6c6avbOdeTeRua0fnczxM7XG7cRrCn8GYTgYNxGYOx3 G1S/4Q/D27RGJD8Z3Jotg95nXbPu9LJ+JlubLLtXtmoMU70q78cyDVPOwpiGqW9hTMPsBMOY htkbhjENs1vsxlSrN+Fp3a3e3EcMT9pOEf3ieFvtBu7/D7MGe+vHAfVeVkKBeq8poUC9F5Ru QFbt126cyRLOR9gfODr1RHU6bTlEtNbBcwZ3LplDfm7s6oSop4OmhuDYH1zP/wIAAP//AwBQ SwMEFAAGAAgAAAAhAPZglZIRAQAAdQMAAAsACAJfcmVscy8ucmVscyCiBAIooAACAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAACsk01LxDAQhu+C/yHkvk13/UCWTfciwt5E6g8Yk2kbbT5I prL77409qAulCvaYmXcengzJbn+0PXvHmIx3kq+LkjN0ymvjWsmf64fVHWeJwGnovUPJT5j4 vrq82D1hD5SHUmdCYpnikuQdUdgKkVSHFlLhA7rcaXy0QPkYWxFAvUGLYlOWtyL+ZPDqjMkO WvJ40Fec1aeA/2MLiwQaCITyEVch5ulIJt+F1RBbJMm1V4+5nMZEkclcTAtd/13IN41ReO/V YNHRlBceCZ1GPa8EIcwZ3SxppIZE3v6yojEzp7ReUuk88e0TAokQMeXimJ4T2iz7jKgb7IsD 009s56tXvAZsP4XE2WepPgAAAP//AwBQSwMEFAAGAAgAAAAhAA+KNv2XBAAAqAwAABYAAABw cHQvc2xpZGVzL3NsaWRlMTEueG1srFbbbuM2EH0v0H8g9O7oYlmWjXUWtuIsFkh3g8RboCj6 QFO0RSxFsiTtxC367x1Sku04l03a+EEck8PhOTPD4Xz4eF9ztKXaMCkmQXwWBYgKIksm1pPg 2+KylwfIWCxKzKWgk2BHTfDx/OefPqix4SWC3cKM8SSorFXjMDSkojU2Z1JRAWsrqWts4a9e h6XGd2C15mESRVlYYyaCdr9+zX65WjFCLyTZ1FTYxoimHFtAbiqmTGdNvcaa0tSAGb/7AaRz YEZueelGoxaaUieJ7SetbtW19stfttcasRL8FSCBa3BLELYLrZr/K7ZeCE+2rzsRj+9XunYj cEP3kwCcv3Pf0M3Re4tIM0kOs6T6+oQuqeZPaIfdAeHRoY5VA+4xnaSjs2CWUxTvWXV4jbqS 5LtBQgIfR7+ht9doOLtRVcjuFJiyzlSr1yx64QDmSU8k+TCJM0+xnyX9ePTQJ3mSjLKo5ZpF Xj4h3BhWY3s/k+XObV7C6AOCx9zYW7vj1P9R7uNBaPADxy7zqeh9uw1QybQ9eNk2R3jV5Y83 hJ0WFeU11vjmB8rK4+7wegovh2u4D5fzyzXHhFaSl1Sj7D0i5/wFl/+vSfDnBmtLdQCngvPj 9O3hjEZRlvhwxlkyivzxh3AO8iQa5FkTzn6eDvNBA/C94+nIwFWHxFn6y3sS33PkjrSHKL/R CjK1LTjF4sjkXFRYEFqiAnOOfsWclb7ooAtmFMc7dPz7/WY+vbr6Dc2mF17/j4eAmiRpP6/P qv/mkqfILCqKvlB7J/V3RLBASsstKykysqZoy8wGc1QxYQ2yEllQxhv4CssIszskV36OADGq z55nphzGLW+z9CXgcf5K4LeECqyZROlJhJ/z4sH6s3b/F+YX0XYurrC7sIhIsQIvQxYhJrwL DVsLyCSxRgrbCt1V8KxJCs84guTCCMPiDpxuQL9kBFtqkJLGsCVU9Ro2EiY3xgfiHcPwcgD2 iK0nZOAV10fwAPsOUmddIQ48uMuVkhmrN8Z2pB/DfVP4XiyyipG2BjJyWmbTrszCmt1oivr7 6tpqY7e/q68F3Pc1nRpFiX1QaPemj/uC/eSSM3XJOPeVDWSkx7ReUjhffy77QVsur4ztCudG s0nwd5JPo2iUzHrFICp6aTSc96ajdNgbRvNhGqV5XMTFP253nI43hgJIzC8U6xq3OH3ULNWM aGnkyp4RWbddV9e8QZ8UR23rtsX84FYA1I0eonv7gIR/eaymllROXAG/G3BLs2e/EB6zf/YN yeI8g9+zPUGS5sM4y9tHZJQl6UlTAFHSxn6iskZOAMcCFO9YvAXQbX60KkdvTtimh5/oGsKO qJfaWMxmcGqRz3qzOL3spRejYW96mQ16l4N+mhazfFr05y4WCmJBNPXPwOeuh1avDYWSd1Qr yXwP/DAaSQRuiUdp7jM09Ni6sQnLobclXP+C1detdzUcBu974aeUi3OjelCBK8NqWPCSaJkr 3NyUheia4XIDrTxcarpiglkaIOiyLfQOk0C46gQXSZZ00fSF9Y2UtsXpLbl72Zh2UnucczoA /hcAAP//AwBQSwMEFAAGAAgAAAAhAKA6qIP2AAAA8gEAACAAAABwcHQvc2xpZGVzL19yZWxz L3NsaWRlMy54bWwucmVsc6yRzU7DMAyA70i8Q+Q7SdcDQmjpLgNpElzQeAArcdtobVI5Hqxv T5iEWKUdOHD03+dP9npzGgf1QZxDihZWugJF0SUfYmfhff989wAqC0aPQ4pkYaYMm+b2Zv1G A0oZyn2YsiqUmC30ItOjMdn1NGLWaaJYKm3iEaWE3JkJ3QE7MnVV3Ru+ZECzYKqdt8A7vwK1 nyf6Czu1bXC0Te44UpQrK0wegqcXnNNRCha5I7Gg9WV+0VTrsgLMdbP6P836QuIhxMOv1zc2 F65HQeFyN2IdSNoz8bMzWQIb1yMLsfkZe02+GD2dSi7iWd0sPtV8AQAA//8DAFBLAwQUAAYA CAAAACEAS/U97L0AAAA3AQAAIAAAAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU0LnhtbC5yZWxz jM+9CsIwEAfwXfAdwu0m1UFEmrqIIDiJPsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97jIF6U2AWv YS0rEORNsM53Gu6302oHgjN6i0PwpGEihkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgyRPJl 0oY0Yi5l6lRE88CO1Kaqtip9G9DMTHG2GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcu LKaOsgYpv/uzpY0sEaCaWs3ebT4AAAD//wMAUEsDBBQABgAIAAAAIQDgw82mFwEAAB4CAAAg AAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTIueG1sLnJlbHOskUFrAkEMhe+F/odl7s6oh1KK q5e2sLSlIrZXSWeyu8PuToZMLPrvOxakCh568Jjk5XsvZLbYDX3xjZw8hVJN9FgVGCw5H5pS fayfR/eqSALBQU8BS7XHpBbz25vZCnuQvJRaH1ORKSGVqhWJD8Yk2+IASVPEkCc18QCSS25M BNtBg2Y6Ht8ZPmWo+RmzqFypuHITVaz3Ef/Dprr2Fh/JbgcMcsHCpN47fIU9bSVjgRuUUml9 2j8TTXW2UOZysuk1k7WZxL0P3V+uI1agw5Z6l5+kqbY0HJB625kvH4A9JjMAdygjBwIjxoTA tjXvB+nmk6rlZrV8qTYrjMSio6uPFm/kcvqnnSAH+D3TnH11/gMAAP//AwBQSwMEFAAGAAgA AAAhAF727IajAQAAiw0AAB8ACAFwcHQvX3JlbHMvcHJlc2VudGF0aW9uLnhtbC5yZWxzIKIE ASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvNfPb4IwFAfw +5L9D6T3UcAf00X0sizxsGTZXLJrB08gg5a01c3/fo1bEIx58fDSI8/y+IR+fdXF6qepgz1o UymZsjiMWAAyU3kli5S9b57uZiwwVshc1EpCyg5g2Gp5e7N4hVpYd5Mpq9YEros0KSutbR84 N1kJjTChakG6T7ZKN8K6S13wVmRfogCeRNGU634Pthz0DNZ5yvQ6n7Ngc2jhmt5qu60yeFTZ rgFpLzyCm7rKwTUUugCbsuPlf3Ucum6MX0YkEaWidK9T7eyzMBb0STMon62KUV1MqWs1mBet 3IZ0sq6EKhJKxb6C7zNFV0IVI0qFdff28nK8/CviGzImRYjPGt7soYbey+gVMUlMGlzk6zNB FaQBRRRTVEEaUERxjypIA4ooZqiCNKGIYo4qJp4UcYQypr4Y6NSI730xEpQx88UYoQzSg18q C+b8wO0VByvwXaJkZTtjVfPhntahwvBU5ZWFBj9pfGvQ6JCOtms0aIJIR9w1GvQnJP2oO49z rzhYgQbI2+jDEL4GHxpeX2Ovyywf/IVa/gIAAP//AwBQSwMEFAAGAAgAAAAhAAow0R7YAAAA vwEAACAAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlNS54bWwucmVsc6yQzWoDMQyE74W+g9E9 9mYhpZR4cymFQE4lfQBhy7um6x8sp2Tfvi69ZCGHHnrUSPpmmP3hGmbxRYV9ihq2sgNB0STr 46jh4/y2eQbBFaPFOUXSsBDDYXh82L/TjLU98eQzi0aJrGGqNb8oxWaigCxTptg2LpWAtY1l VBnNJ46k+q57UuWWAcOKKY5WQznaLYjzkukv7OScN/SazCVQrHcsFM/e0gmXdKkNi2WkqkHK W3111MtmAep+sv4/k/nQWlllCmQ9/uo7Wb1zPznUqvbhGwAA//8DAFBLAwQUAAYACAAAACEA zMPG6ysEAABsEQAAFgAAAHBwdC9zbGlkZXMvc2xpZGUxMy54bWzsWG1vGjkQ/n7S/Qdrv8O+ sMAuKkSBNiekXosC1X12vIa14rVd20tCT/ffb+xdoEdyDVGrJjrdF+z1y8w8j8fjGd5c3Fcc bak2TIpxEHejAFFBZMHEZhx8Wl11sgAZi0WBuRR0HOyoCS4mv/7yRo0MLxDsFmaEx0FprRqF oSElrbDpSkUFzK2lrrCFT70JC43vQGrFwySKBmGFmQja/fqc/XK9ZoS+laSuqLCNEE05tmC5 KZkye2nqHGlKUwNi/O5/mDQBZGTJC9catdKUup7Y/qbVUi20n/6wXWjECuArQAJXQEsQthPt Mv8ptr4Tnmzf7Lt4dL/WlWsBG7ofB0D+zv2GbozeW0SaQXIcJeXHR9aS8t0jq8O9gvArpQ5V Y9xDOMkezopZTlF8QLW316j3ktwaJCTgcfAbeIcVDWbXqhLZnQJR1olq1zWTvnM05lEm4l7W T/seYtLPBnHmVR1JydIsS+JhA3aQZNEwPUXcSFYjez+Vxc5tvoHWnwgecWOXdsep/1Dux1uh gQiOnetT0fm0DFDBtPV0IlPZGadYHDi3jT6/7+aZu8PDlkf3mS8AO4uib+ufrEqKLs1tt+vk 2aM1rwnKyxEYD54k8I8SW1Rgi1Eh0R1FmmLOd+gOC4sskEsgskC00chKZCi9QGhu3ISmCCOI IGvoCUIvTvj/FzBnGPVDYD1N68+yZOLpYgbYIlhrBkwaRQmDQI6YMTWFQGLRWd57VPiIGk0/ 10zD49I+VbpgX3xkv3iu8AOa76DyP3iOl+Dxjd9valZQzgT1FwFuzKaGJ1hq094af1EQqxSn 7pmmxSu7HJNTj3gVV+QrIndoreENvpP6Fpna5TwMePyfxXMdFIsdWsznSGo0W3yYN3HGOMf0 lNpSy3pTPggMPxPAK4gtPneoJPB1oyHrRUreQXCGJ5BggbBS8AoCYz52O++8odZS3X2d0fSF E5tnK3p5RFQUC6zx9RMmKp9H7/Nnn1J/u37oHeoHl6cvOCa0lLwAz0p+RCnh8vfGRz7XWIND BqAVioE0ydN8MEzy/rPrjF4+jAeJrzPyOO3l+UmZkSS5d0dXZsRJ3ov8gnPKDNcTUHBe1lau mUVrKeySYE5dRRM5mVwsFbmmRU1cqgLDkRtuz+kg42Gl8j2n55t9UQso3xvb9lCt2Tj4czrN B8ksm3amcXrVSd/mw87l1aDfuer30nQ2zS5nvXd/uSI5TkcE8mVn+nz/PwAMPqi9K0a0NHJt u0RWbREf+nCjJPN1fBy1fwZsMQeW02wwiPJh1msPE2zbt95a5yRtfU64/h2rj1tPFCgDl5j5 IQW5YOtPxyVABqtgwvdEi1zhxodXYl/QF7UeB0wUdM0EszSApxmySm3HgaBb53NCFnTV1LbV tZS2tdNLcow3ol2vVedIB4P/BgAA//8DAFBLAwQUAAYACAAAACEAHWHuttgAAAC+AQAAIAAA AHBwdC9zbGlkZXMvX3JlbHMvc2xpZGUxLnhtbC5yZWxzrJDNagMxDITvhb6D0T32ZgmllHhz KYVATiV9AGFrvabrHyynZN++Lr1kIYceetRI+maY/eEaZvFFhX2KGrayA0HRJOuj0/Bxfts8 g+CK0eKcImlYiOEwPD7s32nG2p548plFo0TWMNWaX5RiM1FAlilTbJsxlYC1jcWpjOYTHam+ 655UuWXAsGKKo9VQjnYL4rxk+gs7jaM39JrMJVCsdywUz97SCZd0qQ2LxVHVIOWtvjrqZbMA dT9Z/5/JfGitrDIFsh5/9Z3M0f3EUKvWh28AAAD//wMAUEsDBBQABgAIAAAAIQA2qdKT1wAA AL4BAAAgAAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTYueG1sLnJlbHOskL1qxDAQhPtA3kFs H8nn4jjCyW5C4CBV8D3AIq1tEesHrRzit49CmjNckSLlzu5+M8y5//KL+KTMLgYNB9mAoGCi dWHScB1en04guGCwuMRAGjZi6LvHh/M7LVjqE88usaiUwBrmUtKzUmxm8sgyJgp1M8bssdQx Tyqh+cCJVNs0R5VvGdDtmOJiNeSLPYAYtkR/YcdxdIZeolk9hXLHQvHiLL3hFtdSsZgnKhqk vNV3R62sFqDuJ2v/M5nztZVdJk/W4a9+lOTHnxhq13r3DQAA//8DAFBLAwQUAAYACAAAACEA S/U97L0AAAA3AQAAIAAAAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU3LnhtbC5yZWxzjM+9CsIw EAfwXfAdwu0m1UFEmrqIIDiJPsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97jIF6U2AWvYS0rEORN sM53Gu6302oHgjN6i0PwpGEihkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgyRPJl0oY0Yi5l 6lRE88CO1Kaqtip9G9DMTHG2GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcuLKaOsgYp v/uzpY0sEaCaWs3ebT4AAAD//wMAUEsDBBQABgAIAAAAIQAUazuFvQAAADcBAAAhAAAAcHB0 L3NsaWRlcy9fcmVscy9zbGlkZTEzLnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0m1UFEmrqIIDiJ PsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97jIF6U2AWvYS0rEORNsM53Gu6302oHgjN6i0PwpGEi hkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgyRPJl0oY0Yi5l6lRE88CO1Kaqtip9G9DMTHG2 GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcuLKaOsgYpv/uzpa0sEaCaWs3ebT4AAAD/ /wMAUEsDBBQABgAIAAAAIQBcb/6p4QAAAEkCAAAhAAAAcHB0L3NsaWRlcy9fcmVscy9zbGlk ZTEyLnhtbC5yZWxzvJLNSgMxEIDvQt8hzL3J7lZFpNleSqHgSeoDDMlkN7j5IUnFffsGBOlC BQ/icf6++Rhmu/t0E/uglG3wElreACOvgrZ+kPB2OqyfgOWCXuMUPEmYKcOuX91tX2nCUofy aGNmleKzhLGU+CxEViM5zDxE8rViQnJYapgGEVG940Cia5pHka4Z0C+Y7KglpKNugZ3mSL9h B2Oson1QZ0e+3Fgh8mQ1veAczqViMQ1UJHB+nV80dbyuAHHbrPtLM+vqVRZOjrTFr3x7z4s1 5ieRzf+JPHyLiMUD9BcAAAD//wMAUEsDBBQABgAIAAAAIQDxD1SU7AAAAFYCAAAhAAAAcHB0 L3NsaWRlcy9fcmVscy9zbGlkZTExLnhtbC5yZWxzrJLNSsQwFEb3gu8Q7t6k7YiITDobEQZc 6fgAl+Q2DdP8kGTEvr0ZXNjCIC5mmS835ztws919uYl9Uso2eAktb4CRV0FbbyR8HF7uHoHl gl7jFDxJmCnDrr+92b7RhKU+yqONmVWKzxLGUuKTEFmN5DDzEMnXmyEkh6UekxER1RENia5p HkRaMqBfMdleS0h73QI7zJH+ww7DYBU9B3Vy5MuFCpEnq+kV53AqFYvJUJHA+TJfDXW8VoC4 bNZd08yHQvn93LwS+42XI/d/aW2uqWVdXdbKyJG2+JO3Gx69OXuI1W/ovwEAAP//AwBQSwME FAAGAAgAAAAhALXDTtDsAAAAVgIAACEAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMTAueG1s LnJlbHOskstqwzAQRfeF/oOYfSXbgVBK5GxKIdBVm36AsMayqPVAo5T676vQRSwIpYssdTU6 98Bot/92M/vCRDZ4CS1vgKEfgrbeSPg4vjw8AqOsvFZz8ChhQYJ9f3+3e8NZ5fKIJhuJFYon CVPO8UkIGiZ0iniI6MvNGJJTuRyTEVENn8qg6JpmK9KaAX3FZActIR10C+y4RPwPO4yjHfA5 DCeHPl+pEDRbja9qCadcsCoZzBI4X+fVUMdLBYjrZt0tzXzISO/n5krsEq9HNn9pbW6pZV1Z VmXkUFv1m7cdj96cPUT1G/ofAAAA//8DAFBLAwQUAAYACAAAACEAeJFXswQBAADuAwAAIAAA AHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU5LnhtbC5yZWxzvNPfSsMwFAbwe8F3COfepK06Nlm6 mzEYeKXzAUJz0gabPySZ2Lc3ImgL2/Bi9DInyff9IGS9+TQ9+cAQtbMcSloAQds4qW3L4e2w u1sCiUlYKXpnkcOAETb17c36BXuR8qXYaR9JTrGRQ5eSf2IsNh0aEanzaPOOcsGIlJehZV40 76JFVhXFgoVxBtSTTLKXHMJe3gM5DB7/k+2U0g1uXXM0aNOJCqZN7s6BIrSYOFDKDEotfuZL 6m0L7DTjYTbGiiat1DnH42yOsrgIWcwHKS89THlNR+y1xGcxuGOaaEbzyaGK5opzsuqaMusS xtfv5gnsbzw+8stik19afwEAAP//AwBQSwMEFAAGAAgAAAAhABy/SFnrAAAAVQIAACAAAABw cHQvc2xpZGVzL19yZWxzL3NsaWRlOC54bWwucmVsc6ySzUrEMBRG94LvEO7epK2gIpPORgYG XOn4AJfmNg02PySZwb69GVzYwCAuZpkvN+c7cLPZftmZnSgm452EljfAyA1eGaclfBx2d0/A UkancPaOJCyUYNvf3mzeaMZcHqXJhMQKxSUJU87hWYg0TGQxcR/IlZvRR4u5HKMWAYdP1CS6 pnkQcc2AvmKyvZIQ96oFdlgC/Yftx9EM9OKHoyWXL1SINBtFr7j4Yy5YjJqyBM7XeTXU8VIB 4rJZd00z5zOl93NzJfYbr0fav7Tur6llbFlWZWRJGfzJH3lw+qwhqs/QfwMAAP//AwBQSwME FAAGAAgAAAAhAJkhbF6cBAAAvg4AABYAAABwcHQvc2xpZGVzL3NsaWRlMTIueG1svFffc+I2 EH7vTP+HHT+1D8FgY2OYIxkgP46ZS8MErtNXYYugOVtSJUGgnf7vXck2BC6X4ybJvdhrabW7 37eSV/vhYlPksKZKM8H7XqvR9IDyVGSMP/S9z7Prs8QDbQjPSC447Xtbqr2L819/+SB7Os8A V3PdI31vaYzs+b5Ol7QguiEk5Ti3EKogBj/Vg58p8ohWi9wPms3YLwjjXrVenbJeLBYspZci XRWUm9KIojkxGLleMqlra/IUa1JRjWbc6oOQzhFZOs0z+9Zypii1El/fKDmVE+Wm/1hPFLAM +fKAkwJp8fxqolJzn3ztBP9o+UMtkt5moQr7Rmyw6XtI/tY+fTtGNwbScjDdj6bLu2d00+XV M9p+7cB/4tSiKoP7Gk5Qw5kxk1No7VDV8Wr5SaRfNHCBeCz8Et5Oo8Rs33IJZivRlLGmKr1y 0gn7YJ5lIkg6QSt2EMM4CFvdQ06SIOjGzQpr3HTyEeDSsOyZzVBkW7t4jm+XENLLtZmabU7d h7QPF4RCHnJidz7lZ5+nHmRMmT3LpnThVOffX+DXWpRnE6LI/XeUpYu7jtdBeDldnV26LC+T nKR0KfKMKojfInOWLzz8//S9v1dEGao89Irkt9o/ns5mtxkHLp1RkEQdZ2GfziiMu51mUKYz TNqdJCoDPCGfVuJ4sAcrIxasStF+6tRMW5j4E8AtNXfH+ijz52DNmn3+f9AK6MKMckr4E5MD KXOWkjmeNCOA5DlMxxN/fDsFiX81+7PSB07LLVI/rOt1XmXyhD12HMGL1r6NrpVYdC/iGjlI KeGISVGSbVFdI6QtjBAk7s7xJQgOsz/3OBswWzINqVhhTZlTIFlGM2C8cUj7+8U8AC3ylS0G LvBHob7AIzNLIHxr0wJzojGiK47HQCqmKUyGf4HeakMLoKiIsO44TBQt7KRQ8FHgXPYuAKqY xydvyRMIwJqvpFCuHiLxuCHtRrynqIZ4Wm34DcKbyQR+h4uflZM7nuJOeMCi3GjAo9tRBhZs A5O72dRSPLu89afTTuP1p+SEiF53+l5t4G3DeSdwz5UvydKqurD0uICFdQHDObNSFIJd3aq0 iV1fV67REt3TgZY0NQclbGf66Y1rNzjPmbxmee5qBsqgerSYU/SvxpnziOXRKGrSpRUXqHqP HkpUuwn/qaFvFrqo3YnjJHGVLoia7SA6rHRhgPP1xSVA5ejo5oKAlTY3VBRgBYwRQ/HsOFl/ 0lVQtcqTwujvmH6J8OiYcFeIfyrh4TsSbm+Kobv77BkPulG3G4cl461uHERJeX95K8bdQN0n oFdcU0mwUqzv/TscotdRMjwbttrXZ+3LbudscB1HZ9dR2G6PhslgFF79Z/uOVruXYsG0v+Bx 3Vrh4FftTMFSJbRYmEYqiqov8qV4xNIkmGuNWs2qv1oTPMdJt91pdjthudNcaPXbBWtzWnU8 aa5uibxbO6rRF5a7kRuS2LpV6d+r4HFnBU44iVfAJSk33YzXLVK2wgaP8YwuGGeGeoC9l8Eb Zd/jdG2vlVxkdFZ2C8W9EKaK01my/5TStJUqd5ZzDPh/AAAA//8DAFBLAwQUAAYACAAAACEA d9Bfom0DAAC2EAAAFAAAAHBwdC9wcmVzZW50YXRpb24ueG1s7JfdbuMoGIbPV9p7sDhduTb+ d1Rn5LTj1UpdqZp0LoDaJLUGgwWkk3Y1976ASULiajTS7mGOgnnh5ePhJ3y3n/YD8V4xFz2j FYA3IfAwbVnX020Fvj41fgE8IRHtEGEUV+ANC/Bp+ftvt+Ni5FhgKpFUXT1lQ8UCVeBFynER BKJ9wQMSN2zEVGkbxgck1SffBh1H35X9QIIoDLNgQD0Ftj//lf5ss+lbfM/a3aCGn0w4JiYO 8dKP4uA2/oqbO4vzkAR6xevds8CyYVQKRQcs1bQF6f5GQmL+V/cg5EWN13cViGCSJ0WcFSnw +ELXKCUFwfI2+Kg7ZRKLn9WdTGBpXT7q86JWie3kz2tPXlFovT7up+I8L09TywtnTpl2OJdz R85ncpE4cjGXXWBmqufmpSNDE/65nrk6nNvHrh7N9MydG4zn/SNXT+Y6dHWz4Od66OofwHOn D+f0sjN/g2/aUO5Crd+9dl+BEiZJGKoB27cKpDCJU/0h30Z1hkXLMaYw21vEZjPZfllRwELN 3fQrozJTLlOrDm/QjsgnvJdr+Ubw8hbpusdHbktfHrlHkL43MPW/rk14bhPySuCo2gyIP1RA RYPIVt05BHiqzRN6Xr8fwlbTlMQ0weiBrvg3ffY8fcKp/VSS2rZbdY087mgrp7N5jEIoJ1ho n2+Y62tNnWqjC0b6rukJMR/6UsB3hHuvSI0m92bHBBetzKgG3Aa1Ct4fA/WJ1C3RAqMLAaNJ aMWF0IoTji8aR3DkYdFEJzRJmuuAr3wMFMsnPvE5QLjy0VAsn+TEB8Y5zK6ADlQsoNQBVESF if4KSFOxgLIToCgqMvPvcQWkqVhAuQMoT+LrHX2kYgEVJ0CazvWSPlKxgEoHUJbm10v6SMU8 ZedPzHGhyvZxq0rejvcV+OdzUzerKI79MIsbP4lWqa/erLlf3jdxk8JVDcP6h07WYKqfxH/u +g4rk0NaCNNZYjj0LWeCbeRNywabYQYj+475yHqTZMJoSgsn1622NK9ytSSM9yqDVJ6MvwNv ZDpVzCLNWjdtiVl9wbfPR8p1Use1SSCCYxNTMr6XQ0TWVP9p/QdTU3ZwGOQK6jnb6F6f3DTx k/Cu9pM6i/yyuYv9+89lncA8q+9W5YGtSRz+V7pTSmOCmn4Pcbpp+vJfAAAA//8DAFBLAwQU AAYACAAAACEAZ9FjVFsEAAB6DAAAFgAAAHBwdC9zbGlkZXMvc2xpZGUxMC54bWysVk1v4zYQ vRfofyB0d/RhWZaNdRaxkiwW2HaDJNseih5oiraJUiRL0o7dov+9Q4qyE6+TOG18sChxOHxv 3nA4Hz5uGo7WVBsmxSRKz5IIUUFkzcRiEn27v+6VETIWixpzKegk2lITfTz/8YcPamx4jWC1 MGM8iZbWqnEcG7KkDTZnUlEBc3OpG2zhVS/iWuMH8NrwOEuSIm4wE1FYr09ZL+dzRuilJKuG Cts60ZRjC8jNkinTeVOneFOaGnDjVz+BdA7MyB2v3dOoe02pG4n1J63u1I320z+vbzRiNcQr QgI3EJYoDhPBzL+KtR/EB8sX3RCPN3PduCdwQ5tJBMHfuv/YfaMbi0j7key/kuXXI7ZkeXXE Ou42iB9t6li14L6nk3V07pnlFKU7Vh1eo75I8odBQgIfR7+lt7NoObunWiK7VeDKOlfBrp30 gz2Yo5HIymGWFp5iv8j66ehpTMosGxVJ4FokfnxAuHWsxnYzlfXWLZ7B0wuCx9zYO7vl1L8o 9+dBaIgDxy7zqeh9u4tQzbTdR9m2W3jT2esL4s6KivoGa3z7irHyuDu8nsLLcg13crm43HBM 6FLymmpUvIdyLl5w+P+aRH+usLZUR7ArBD/N3y5nMkqKzMuZFtko8dvv5RyUWTIoi1bOfpkP y0EL8L31dGTgqEPizPzhPdD3HLkt7V7lN3pBprEVp1g8cnklllgQWqMKc45+wZzVvuigS2YU x1t08Pttilvb35+CaROk+3OQ1jzo+BLOtHQ4X0TogTWAhMiGormWDfoV8ogaDDUAEtcKqs+e x/Jcdh/ZfZfnJy99JcD/KygniHdHqMCaydPz4qjr4K1/4OUNkXtX4i9TZgsBSSoWBylh9cpY SGPVJgSarSxaM4wedqnCBNQIIoWgxCf4w5JqiqRmCybalCdYCGnRjKJ1ew5ofXYY2v+STsfK pmIkVDVGDgtnvyucMGdXADLb1ctgjd36rmJWcIIX9MIoIPakdO5cP77pdx9nnKlrxrmvVTBG ekybGYX99ee6H4UC+MXYrhSuNJtEf2flRZKMsmmvGiRVL0+GV72LUT7sDZOrYZ7kZVql1T9u dZqPV4YCSMwvFetasTT/rv1pGNHSyLk9AzlDH9W1Y9D5pEloxkCUfVgBUPf0EN1tBiT8XWI1 tWTphnPgdwthadfsJuLH7J+9FYps2PeKPnPLZ3k5TIsyXAujIssPrnlQSRv7iUJ6ugEEFqD4 wOI1gA75EUwe3SJxSA//oWvxOqJ+FLSYTmHXqpz2pml+3csvR8PexXUx6F0P+nleTcuLqn/l tFCgBdHUZ/nnritWp0qh5APVSjLf1T5VI03SQZEnWdIPWdfKskfrEjF0q4Trn7D6uvahhs3g NFb+k3I6t6Z7EzgyrIEJPxKBORxu7+ledO1tvYLmnImazplglkYI+mYLJWASCbp2LYGQNb1v O73mVkobcHpP7ly2rt0obOeCDoD/BQAA//8DAFBLAwQUAAYACAAAACEAdaiZcJQFAACIFwAA FQAAAHBwdC9zbGlkZXMvc2xpZGUxLnhtbOxYW2/bNhR+H7D/cKDXLdHFsi0bdbvYrYsC6RrE 6fbMSHRMlCI5knbiDvvvO6Qkx058S4N2w1Y/WBRFnst3Ljw8L17dlRwWVBsmxSCIT6MAqMhl wcTNIPh4NT7JAjCWiIJwKeggWFITvHr54w8vVN/wAnC3MH0yCGbWqn4YmnxGS2JOpaICv02l LonFV30TFprcItWSh0kUdcKSMBHU+/Ux++V0ynL6WubzkgpbEdGUE4uSmxlTpqGmjqGmNDVI xu/eEOklapZPeOGeRl1pSt1ILN5qNVEX2n/+dXGhgRWIVwCClAhLENYf6mX+VSz8IHyw/aYZ kv7dVJfuibrB3SBA8JfuP3Rz9M5CXk3m97P57MOWtfnszZbVYcMgXGPqtKqEe6xOq1HnillO IVlp1chr1LnMPxkQEvVx6lfqrVZUOrunmoFdKiRlHal6XfXRD+6F2YpEK4ujqFKxFUetNGlt gpIlSa/jFjhl07gbJdlDjSvKqm/vhrJYus3X+PQWIX1u7MQuOfUvyv15KTQCwYlzfSpOPk7Q 9T8PgiRzjAqmrQcWTGlHnBKxQt++HGuE7VbqT4A+BiPCOfxGOCu8e8FrZhQnSyed9TJ6Xtdf zDFcbd5JIfbg7JX5TFgGEyXlFKMSQi811etyhwCX8lrmTp33zLIbP328GgeEOKDGal8tLzxg fGDXFpUrnvukfras/wOuR7rXJctnRBcwmWHGoE9w/ud5zZHS1VLBCM+OObcuAs7PR/8yIUcz wvDEEjB5dwFjqeflPykg1dofeFsE1ZWtfzEVqqdzc1SsHgfDYU/+Zgb5KYZu1IJ2rwVJJ2t9 80z4Pad9ba5PZvQdx/8KjlQUF0STywMiKl9cNkWlrzP3F9Xpqqh2xesFJzmdSV5gqeVr2ufW 166orZLMH3OiLdUBcsUKOU6fVXQnca/d9SR2FN1x2ot63UrCI6puNxJ4/zqbWyw4a4Pdf3pc jx80xxZD+o17qvm9yf13V74zAUrLG7wcms1687nUJxavv+4sdxeEgpl8btyVG9RcK2moASn4 ZpF0BEd/tMQHjy28f+ScsJLqPlzNKIrAuXR3cZCKCXd9BqIp2BkKAnIKBNA7kQ8tfgZNFm4h nwss/nMgooBCon9aEDRHlIhmfAmaTjnNLZKg9zSRkntfFS+AmjNroKTlNXp/LktFBKPmFN7Y /BQo/j04UXf5wBa9HzrAF7rP00K7vTO0feR8tdD2ieNpod2LklbHh3aapNne63QSt3vRowbC E6/TO/DfC7RieY0Dyx9C3Wmgxm92jt7aXiFcryZuf4Mxls7ov2dGoVdugL0ivd6cWU1ec6bG jHOvHo5B952zIn/9rvDtEDSk1eiqMzec4tJL5FBptfoQrhPaaZJ21OklWeZtEmcxJtyaQWOU JEtbsTOaT7cxmijubVgFNdbGvqWyBDdAIVGWwM2TxbmppWqWrBkxXEG927WTddceyjvwGK78 FZzxnCtWs+tgHvBEVLvbSdK6tdOOk8wrtaF26vsfTu1W1MXfc7R2x46zRCXeLi+GW00wKo0L NBqAtnwkucsMVei6U2t8zKnloCH8BpNKbnWl157UnR5M3Ziu0deZc2mYML7A1DKcc07tUzLl Jps9IegfTcsT7YFw1iOYazYI/hwOe51klA1PhnE6Pklf97onZ+NO+2TcbqXpaJidjVpv/nIt 1Djt55r6ftG7pkuMk486syXLtTRyak/xOKhbvKGStxRPRea7vHFUt4oXBA3Sy7Ko2+l06oBG yZqnl9XFeN27zbl+T9SHhYcHWWH6HPkpPJ5u6nRwvwShYCV+8CNR661IFRRXomn2FnO8AzNR 0CmecdY5CjUWU/MgEHTh8rOQBb2q+p7lpZS2ltNTcnhXpN2oZucgR4H/BgAA//8DAFBLAwQU AAYACAAAACEAGrofh1wFAABpEQAAFQAAAHBwdC9zbGlkZXMvc2xpZGUyLnhtbMxYbW8aORD+ ftL9h9F+h+WthKCSqiGlhy5tEND2Y2V2DbvCa/tsL4SeTsrPuJOufy6/5GbMEvJKkoZKF0Ws Wdvjmcczz8zw+s15JmDBjU2V7ATVciUALiMVp3LWCT6Ne6VWANYxGTOhJO8EK26DN0e//vJa t62IAXdL22adIHFOt8PQRgnPmC0rzSXOTZXJmMOvZhbGhi1RaibCWqXSDDOWyqDYb56yX02n acRPVJRnXLq1EMMFc6i5TVJtN9L0U6Rpwy2K8btvqHSElkUjEdPT6rHhnEZy8d7okR4YP/1x MTCQxohXAJJlCEsQFhPFMv9VLvwgvLV9thmy9vnUZPRE2+C8EyD4K/oM6R0/dxCtX0bbt1Fy ds/aKHl3z+pwc0B47VCyaq3cXXNqG3PGdPhAsIgnSsTcQPXKwI3qVp+qaG5BKjSNkFhberVi bT49dQJupVHqRMUr9KZvneCPnBnHTYCnos7VerF5vcMPtsoWYLrzY9xOJ5MY/5K1hXUjtxLc f9EeNRkPmGFDtEgw8mEuS59GAcSpcddw0f6YjcxwA8rD0NSvoEmd4FDbBx6ORO3PdK+GuW04 wV1rVCrXIACbua7gTF75jzv6TS1xQQxLDjPuIOGGl4GQch4vL/shbO854gdRbjzogN5FfpoD Nnbfwj2hWm9VK2QxWntQrzdqXsI2aFu12mGT5ikY64eNSvWgeTsk15LvXi+NJFLV29ypaepg qqQbRUygAYe1VyRUyJGOhjzOI6IvBL9CuqzFb2U8x0OqrUc95AuHJZOOxxCpTHN03nTBYaGQ lCFjZs6RWQEXzZQDh7xbvuE9a294JEifoMkNOS+yZzAaf4RRfwAz5viSrSwmvhityzUwC8w5 Fs0xM0ZOGft/t2WccPg0glO2tKAkXF78Oza5SyCV0GVCYPz0Ty4vvgMzHONFclBTuiNgE7Xg O4zTpM9CFNG1U8nHKWZgFB6L/5cXf6foSNJdXvwDTkHMp4blMaSWKpEVSqFUnwtHk9ooy6Pc IR2RlYItgVtK3SkatgLBZ0yk3/DeyB5tGIZE9ByTdt7fA6S2pyvDy0gYxtCEcwnNUssbjm+l g0kqhPXXp+QMSxULQqk5lk/omGhpiqEGQ57xbIJ367woRI8BF9xzAkYhLVbyFon/vNvtdbvQ G3ehO8SPs1737AMslZnbRGlUtg9Loxz63db3DNfKEGfsT8G8E1g5u6YorU9EKuddkWI0mzYl GdOPffqmA9dM6Y6KgvFWwnv2eTeAefLhWF/PizyHxekU6ZVK1HI+DyepZCblNlwTbClmjpWo cmUmSsIzWvr1s+oPvg4Hv/e/Dj2iZR1P9+n+zwZ1K3Kf8QIfMArYjBMnkPukMs6tM6sy0sn3 ATlX5GCZYHisVO7jqkyMd7uG2aGDT607dXjP5QRbIei+O4MTtsBy6QsTNvnB5LD7vD0i99nn aOQH65BWkCWqtQoc45CIIlZCMAOT3KaSeAY5h+DFbMIipF4kFdzic0UU0bzGjosaqWcF7gtI 9gWidkK6r7z9aMPxst0/vuFu5e0fm44WK9VT64oR5CbtBH8eHx82a93Wcem42uiVGieHB6W3 vearUu9VvdHoHrfeduvv/qIOudpoR4b75rm/+REAX95pvLOUfEhNXRmZqujgQ62W3GjMT9TE VyvFLwELRnfcrDUPG/h3UBTkqNvm6bWlAr9oziNhPjB9tvCxgYdhOd/1rzRmvqIX2C5BMNIM J/xIFpZrtu4/xnLTzce56QRILXyaytTxALMUsrNxnUDyBfULUsV8vO7esqFSrtDTSyLE16Jp VBxHoKPC/wEAAP//AwBQSwMEFAAGAAgAAAAhANqsY4szBQAAMREAABUAAABwcHQvc2xpZGVz L3NsaWRlMy54bWzUV9ty2zYQfe9M/2GH7xYlW1YUTeSMrNiNJomtMZX2GSFBERUIIAAome30 37sLUr7EjqOoTjt9ESFcFnsO9vrq9XUpYc2tE1qNo16nGwFXqc6EWo6jj4vzg2EEzjOVMakV H0c1d9Hrk59/emVGTmaAp5UbsXFUeG9GcezSgpfMdbThCtdybUvm8a9dxpllG5Rayviw2x3E JRMqas/bXc7rPBcpf6PTquTKN0Isl8yj5q4Qxm2lmV2kGcsdigmn76l0gsjSRGb0dWZhOaeR Wv9iTWLmNixfrOcWRIZ8RaBYibREcbvQbgt/1ToM4i+OL7dDNrrObUlfxAbX4wjJr+k3pjl+ 7SFtJtPb2bS4fGRvWpw9sjveXhDfuZRQNco9hHO4hbOgy+eSpbzQMuMWejcAt6o7816nKwdK IzRiokF6s6OBT19TgK8NSv2ksxqt6Y9x9Lli1nMb4a2oc++oPdycCINbZVsy/fUpHqebSUyY ZCPpfOJrycMfE1hT2ZxZdoWIJCMb5urgYxJBJqy/w4sJ12xlxltSvk7N0Q01wksOh8/BhydR zwc9qGG/BE5094bd7h0KwJV+KjlTN/bjTxJ0hcqBziFZzK7i5O3k3dkFTJmU6LOAlPoafmVS ZMFjYHaGoWGymCVxMpvDubZVSbT6QG5Q5GsP8Yg+ez5J/6vWGuzph1lrf48no5HC8DOpvM6F h1wrn6RM4j3D4y6xIVVi0iueVSkRjL7YpemGmlsZz/zqv3FglsNS0yN7DamtjddLy0whUDtZ gxNLBb7ggO8czz4kwSQgwVkWLANjKnDMHzXQ/s49I2ge9RuOuYOm9+T8I7xTjWjnVnudagnb XOICCULBe+Z8A1A0oMnMO/AW80deERu+EA6BKvjEYYMsGZ5BZcAV2npZd2BHH9gNqaFja9la 65PIB99EfhcDr2EjEKQrKg+Z3ihgOdo3rjD/xAvurQ/tK9BaVlMp0hXYEXmvnWUhiNJFjW37 E0rbDvM2BhnmLUtX3HYE93nI2Jtl7LywcVoEb/yC6v3I2Vmz+Hui29Ov8SSn+0TN53CMRcEb i7ecSdhou0ITXwrlOgAXaNwFTEpuBZn+lFkrsGAELArhcrEAY/VaZDRTOQoJF5OLOaiq/ERT BVvzEFmwSKNNIEojOXldk0gcvrPHm7h7HsvbCSp5O+pPl2tUOONOWB6nuiyFJ9VI4YwbqdGl 7/v0j1MrqYyRDa+oHpP4EFkNzK2I0s8Vd6HOBaTMi5KjzfLmBaxmWcnM99D3HxoZQitZDYpj 4ESSMYw6XXIwGv2vbkMqUuAqa3WlqAsBCsdYllDo3Te9vPyhmECj41ioFFNugwizm+ciKyv0 JmSMDSFf8eBkFN/QWSggb30DE5FFZ5t9eHvZpFuswppUdKfqQk9LuXNN9FbaE388zzmWDOhl lZK0eCOt8b3AL7Y6jhOLpA2JV9wHJ/+9ypZoSDRF+Rs3OuoE/4U8/n+R80yn9z/wsCgOn21n irXve+fbEVRWjKM/T09fDg6nw9OD017//KD/5uWLg8n54Pjg/Pio35+eDifTo7O/qNPt9Ucp Bhoyrtm2mcfJBw10KVKrnc59B4Nk24nHRqO1GywdqRnvdduOfs0o0AwGRy+6x8PhoK2VUbft N2hLtXfbZKfSfmDmch3cEC/D3D4NUwa9vy3Tb7cgGaLEhTBSLXLDmtZgobZdeVbZcSRUxnOh hOcR5jXnsW4YR4qqVewcdMYXTRdWXmntWz2DJGK8EU2j9joiHRX+GwAA//8DAFBLAwQUAAYA CAAAACEAf+y8b44DAACOCwAAFQAAAHBwdC9zbGlkZXMvc2xpZGU0LnhtbLxW227jNhB9L9B/ IPTSl7XlW7KOsc4idjaLANuuETsfwFDjiAhFsuTYsbYo0N/o7/VLOqSkXJ3C67p9ESmScztz OJwPHzeFYmtwXho9TrrtTsJAC5NJfTtOrhcXrWHCPHKdcWU0jJMSfPLx9McfPtiRVxkjae1H fJzkiHaUpl7kUHDfNhY07S2NKzjSr7tNM8fvSWuh0l6nc5wWXOqklne7yJvlUgo4N2JVgMZK iQPFkTz3ubS+0WZ30WYdeFITpZ+5dEqRibnKwujtwgGEmV5/dnZuZy5u/7KeOSYzwithmhcE S5LWG/Wx+KvXcZK+EL9tpny0WboijBQb24wTAr8M3zSswQaZqBbF46rIv245K/JPW06njYH0 idEQVeXc63B6TTiLYHymuIDcqAwc6z4E2Lju7Rcj7jzThkILSFSRPpyowg+jzRmWlrTemKwk Nn0bJ7+uuENwCVkln7v9WriSiJNHZ2swcTMh8WA5qImLfKQ8zrFUEH9sRE1nM+74FUWkeOAw 6Nb1PGGZdPgEFxvNNDrTBpS3oek/QCNRAesdAg8Mqg4XenTDvQw8wN0ddjpPIGC+wKkCrh/4 g6eLHBwwGfxnBumH3fOSmSXzvKRbyzCXPgCHEb5o6i2ot1jcE/TBm3yMjPnP+DjYIylhpqnA nK3QLCVWET9u7c7UHRJWYfn9el6K7s4YcC5Wuy3MuTI3RnClXtLjX9HxHZuSSkr05TmbW0OI EgfpFSIeAqPSvVIYVmbEyjxuIfKQfU4k5mxa3tCLBmLlJJYk4oAjQxOFr7VEyNicSj/4YEbz jL9jn+OZCQnQI8AARftZOP8/4ltAuUTPMgNe/4T/jPXqrnV99lTtFmV//fHndyZsixJ2yJwj vwvJo3TJmHpt1qCkj5lbytsVpdassGEAtp8b3zdDh7pbe+k5kPT+Aq/rcRyatofK7heP9YzR dRonv00mJ8e96XDSmnQHF63B+cn71tnF8VHr4qg/GEwnw7Np/9PvoY3qDkYi3CrqsC6bTpEW X3VnhRTOeLPEtjBF3eal1tyDs0bGTq/bqdvFNVcE/PuTk6Nevzcc1mWafGvG6G0o+3UHJ5T7 mduv60hMMkZFfhqXLFWN+oV4PEJgyII24kzXkVtevUoL3bR82YqKodQZUFWiYpJEOtIDMk40 rMMrok0Gi+qJL66MwdrPqCkgXqkOs9pcAJ0c/hsAAP//AwBQSwMEFAAGAAgAAAAhAPvddjn/ BQAAARMAABUAAABwcHQvc2xpZGVzL3NsaWRlNS54bWzMWOtu2zYU/j9g73AgoD8T+R45qBvY blIYyxIjdlcMw37QEh0RoUiNpOx4w4C8xoDt5fokO4eSnEuTXrKkK2BYFEWe+/nOIV8eXGYS VtxYodUgaO42AuAq1olQ54Pg7fxoJwrAOqYSJrXig2DDbXDw6vvvXub7ViaAu5XdZ4MgdS7f D0MbpzxjdlfnXOG3pTYZc/hqzsPEsDVSzWTYajR6YcaECqr95nP26+VSxPy1jouMK1cSMVwy h5LbVOS2ppZ/DrXccItk/O5bIr1CzeKZTOhp87nhnEZq9cbks3xq/OeT1dSASNBeASiWoVmC sPpQLfOvauUH4Z3t5/WQ7V8uTUZP1A0uBwEaf0P/Ic3xSwdxORlfz8bp6T1r4/TwntVhzSC8 wZS0KoX7UJ1Wrc6cmE8li3mqZcINNLcK1qLb/FjHFxaURtXIEqWm2xWl+vTMU3CbHKkudLLB aPp9EPxWMOO4CZArytxsV5vLHX5wLWxlTHc5wu3Emcj4SbYvrZu5jeT+Jac/L5tBfSSjCOZq 5+0sgEQY560CNnNjyZnams69mqfCwlpICY5dcLA64+BExsl+zlvRE+UqmTLDzh6kXVo89wrU 0oa1uR82entrdOEkh9ZTWNoRqf/VqBNrC27BaVhwwFzTcsUTEApm88nZ7lcybefBePYR92zx 3Pm46e/J/HbUbDTKlN5rtzstT+EaA7pRr7UXtcrcbvd7e1HUvZvhJeUPfUojhcg3LJxeCgdL rdwsZhIViLqeqVSzPD7jSRETGiIMNGi6JH9N44lyjRJMFsQIFOdJHSKOW8eTXbgVGaXP6z9i tJKVax7JnTnAZM+NXrCF3ACD4Xwyg5MiW3CDxQnmKAaMKFIpfnfh1KUYLTEzRmCNBGY4SK0v aKlQKLlD7PgSoT8Z6XfFvkXtESqPsThyZQsLaPDXfMkKiZnwwwQOVWw2uffDL4fjcavb+/UA PqLJV5f8HfcBAuQXlH4JCV+iJugUghByo9IOPTgTCC0GRoWU3N1GlqeOn2PtvCTaR4VIOMPX wgG9olxDjA1H3/E9Q9BjEkNswRKQAuvKAuHnQgrrvihgHgO9WS459Ui+uaH8WmtzAVbqNcqD 8q6ZSewzJxoapHQRLCWzKcRoJm+lZ+WLMRMz5WDNPNCZspi/v/r7XGLGyy30vL/6B3zZx9+J Ni6FYYYAEDM4Esa6bzqjCULPNAbamBsnsCdmjgOCe6qNcBuvNcYfnAxPprcQ9mYRZvgZn0lh ndlg75NwWKFpMGTwNd5CRmLEiiuCy5hb+7yuIyAOZ5MpHGlTZNSKEcjiogQytkH51wLdhFqN UfC8cAf/AaqexAtlHSHDlM0jisjyXKI/FtjGEdqyDTTJ+Iozg5nXabwgcEBUKJ2DNVgiFsC7 FG38kz6eH4KoUxfdpAnVosaLbwiSJ65UlYDXY4r3yfR0PvsKhftOz3iHSnGx83b4CSrvr/76 OJHPEQW9nWLKcEjZCj0O09n8BOaGKSs83OIB9QLrEPyM3a8gMxV4TMbYUHh4pWCotiWUtTbn MWUwzbvCKKBu0Jvz0Q3yF6fAfR11LuKq4RXx3Z46qntq/IYyc9jbttLVakb762Z6nCJ7PiRN 3a2uekv65il5O7mQIj/CUPNtLI7B7HPs0ZC/mST+iIQduzPcxSkNl7j0DDmUWm0/hDcJPdh7 9xqNvUa/75vvZqPZ2evW0F51362o32/0OmX3jX14J+pGt7pv1BirxhuuM6ABComyBDTPVse2 kqpecqNZDytT+4n6qgG54p5qBIURg+CP0ajfa42j0c6o2Tna6bzu7+0Mj3rdnaNuu9MZj6Lh uH34J11dNDv7MTYeFImT+nYGJz+4EclEbLTVS7cb66y6WglzveYm18LfrjQb1RXNimHq9lr9 frfbi+qTDYpWP72w5NPq0iSW5keWn668qZEXnovGfipHQK/cf70Eo09k+MGPVKV4zsqgm6v6 liUpzCDAgsWXQgnHA6pmWKzQ1Iqv6OCldMLn5dk3o+pYyekpUYiXpGlUsSObo8D/AgAA//8D AFBLAwQUAAYACAAAACEAD3osicMEAAA0DgAAFQAAAHBwdC9zbGlkZXMvc2xpZGU2LnhtbMxX bW/qNhT+Pmn/wcqnTRpNCAkEdGkFabmqdF+qQvfdJIZY17E920DZNGl/Y39vv2THTsJLWyqm 9krjAzmxfV6e8+Jz8uHqsWRoTZSmgg+99kXgIcIzkVO+HHoPs0kr8ZA2mOeYCU6G3pZo7+ry xx8+yIFmOQJurgd46BXGyIHv66wgJdYXQhIOewuhSmzgVS39XOENSC2ZHwZB1y8x5V7Nr87h F4sFzci1yFYl4aYSogjDBizXBZW6kSbPkSYV0SDGcR+ZdAnIsinL7VPLmSLEUnz9UcmpvFNu +8v6TiGag788xHEJbvH8eqM+5l752hH+E/ZlQ+LB40KV9gnY0OPQA+dv7b9v18ijQVm1mO1X s+LrC2ez4uaF036jwD9QalFVxj2HEzZwZlb5HcMZKQTLiULtHcDGdC0/ieybRlwANOuJCunu RAXfPmWBzFaC1LnIt5BNvw+931ZYGaI80Ao2tzs1c8XhiL2xtTPN4xjYrWYrxi3iAdNmaraM uBfpvMbzO6zwPSBi2OYw4a2HqYdyqsyBX6RT08j0G6ecdk1n5xpqGEHhe/jDWFHvB92ZoU4C R7o0KSOY77LGXE5nt/coxYyhCRMbjaBCqtdfMaO5Kw50jQ1G11RLhrfWdcY50Cn7Xs6OTuah y5TvlofR68F4oWJ7naRfVWKv04lCJ2Bfup1uP4qjuCrJThL1kriy76AwK8HPg2wpDhfWaGXE ghoIDTfTDDOwvx/GAShlfCqze5KvMhsnMD+AXy1+L+MtJXIuw9PUOuJ+OS2t99uJhfFqgt6a Jyn3RNrqW+thdLa0f/76+3Vx/804jUxBgFMbpOmSQ8nwJSqERBuCCrwmKBM8I4prhOdiZS7Q T/HPR/qP/CStFWtWp/AbTRstIK2flXKBNZoTwhF0P9sMSf4L2hTYIFpBgZ64YgZBt7evvNrL Bal2OTEbob4huCPsK4DT0IoVHLg6H9WpXDoD1/tl1SRNnS/UipHcRivDHM0Z3CNAMabRhppi D9ASMCtcnEb5v0CVAghTUBtiMLmcU27BWSQ3vMCQiTlKv4w+vxKs94Lxtr4gaVZf2zR72hm6 TWeAPbNSBMW7hlCfxpa/aQkp4F6SkZYkM0e9YSf6cEbbLc4ZlRPKmLuNgUZqQMo5Af3qNg+9 +or/pE1z2a8UHXp/hMkoCPrhuJXGQdqKgt5Na9SPeq1ecNOLgihpp+30T8vdjgYrTcBIzK4l bYbodvRscC1ppoQWC3MBAa0n4GaQhpm1HdRj9BqzvVvBoObpTLTtAEC4ZmkUMVlhyQXguwe3 VDy7Df8Q/cm214G217ONDaIZJf04TI4bXxwHUbtXN74ojDth2D1qfBAlpc1HIkpkCXAsmOIc i9dgdJ0f9ZGDPunX6eEWmuG8AeqoOhbjcb8bpsm4NW5Hk1Z03e+1RpNu3JrEnShKx8ko7dzY WEiIRaaIux9vm+8ZeW4opNgQJQV13yPH0WjHQdLp94LdcFuFZW+tTcT6OyNj6jOWX9fO1aAM 7u7ULUkb5+ro/giUDC1hw1G8Ri5xVSkz3nyY5Cv4rKI8JwvKqSGevd0NjDtDj5O1nXm4yMms GkTLeyFMbaeTZOuyEm2pWp11Ohj8LwAAAP//AwBQSwMEFAAGAAgAAAAhAE91yNjOBQAA8hQA ABUAAABwcHQvc2xpZGVzL3NsaWRlOS54bWzUWFtv2zYUfh+w/0Do3bEo62rULWLZCQq0axCn G4ZhD7REx1wpUiNpJ96w/75DSrId5+Z0WYf5waJE8pzzfefCI715d1txtKZKMylGHj7xPURF IUsmrkfe56uzXuohbYgoCZeCjrwN1d67t99/96Yeal4i2C30kIy8pTH1sN/XxZJWRJ/ImgqY W0hVEQO36rpfKnIDUiveD3w/7leECa/dr47ZLxcLVtCJLFYVFaYRoignBizXS1brTlp9jLRa UQ1i3O47Jr0FZMWMl/aq6ytFqR2J9bmqZ/WFctM/rC8UYiXw5SFBKqDF67cT7TJ3K9Zu0D/Y ft0NyfB2oSp7BWzoduQB+Rv737fP6K1BRfOw2D0tlp8eWFsspw+s7ncK+ntKLarGuPtwgg7O FTOcIrxF1dmr6w+y+KKRkIDHwm/gbVc0mO21XiKzqUGUsaLadc2kG+yMeZCJIE0CHDuIgzgY 4OwuJ2kQZLHfYo19Nz4A3Aiuh+Z2LMuN3TyHq3MIGXJtZmbDqbup7Z8zQgEPnNjIp6L3eeah kimzY9k0KtzS+fMb+t0qKsoLosjlM4trZ3dnr4PgmGRFSywrDh026BwGc2alKAq2LmtXE7u/ c1q+BPX0VNe0MHe8txW9H7Lbh3PO6jPGucMNY6SGtJpT0K/elwOvdcwHbToXrRQbeX8G6anv Z8G4l0d+3gv9ZNo7zcKkl/jTJPTDFOc4/8vuxuFwpSkYSfikZl1NweG9PK5YoaSWC3NSyKot CF1dgRTGfltV1oTvaAWDuqsz0boFQLhwNoqaYmmHC8B3CbQ0e7YT/X30j0ZrjP0k9YNHwzUI 0wTHaROugywJo8w5ahuv4CWlzTmVFbIDIBZMccSSNRjdxke7ZC+8+9vweDypk21SW3MuOCno UvKSKhS/Rn7brIIj4o+R9/uKKEOVB1oBMw5fnvR+5scNizhKfJzeZTEKUz8adCziMIsyx/Mx WW9HAsr/6crIBTNoIYWZQbwBgCyIbCXhYlYXl7RcFfZIAAt8f1tUdjKOLRyWj8AKQHN3ShwU krfIim2CsRHwMilIVybnlIg9kVMB2V3QEuWEc/Qj4ax0pxuaMF1zskHd75dzKZtVv941o6lB z+LC6ZEWzQoqiGISBY+rqa2GNW9j7Xm1Typ0yKE0UI0WCnLJqJU2wIiWK1VQNCcaboCRnCjF IAGM3A7HrPeBQPQSjsg1HPq2x0DzlUGKtq2CRgRxek2KDRLU3Ej15eR4WI8dAQ8A2x4Gr+eI nyiYDNABr1ky8QXJBVozvQKwcAvI3AQF6oSG7kq17C3ttueQvoJ5kHXoZ8q5vEHnQL1490RY vmq8fCSbOT0+FQ8lUqUcuAck00r+xvRXS35A4gl6D46qpdZszunJCyh6QewdKv63Yvq/NvEZ aS9tw9LDNiz55m2YO21fr6NJoihNw6ahCaMQJwcvJTjA6QDj5izGfjAIsuiVO5qnCM8OCXet wjcl3MF9PcLtC80gforxKMIpDvYZd/3bN2IcNMb3XzZQSXUBRZAoAS04mrFrOFwtU6fKvMgj u0dKyZslJaV+LUfF/+cXFFW0EfWVkYbmNx9lCT4j0Pg6Ig7iLhyEfpw2HxOC2MdZ5N5M9jM9 CWPcdt0Y4wGO/1Hc2T7cWtgpueeVzM+m6TQNe2EQT8Erk0nv9CwPe/EZTqLJYJLnE9x5ZcnK kgor7p87xXEsoWvuIkmr63nOVeOsM/drge8t698142GHHqaae9B9WupWuVHLwXicxUGejntj HJ71wkmWAAdx1DuLBmGYj9PTfDC1HNSgvFDU9fnvu69x9bEc1PKGqloy9zXtbmziwE+g3MRZ l4MNpp21Ni3br2QFVx9J/WntchyUQRedu0e1JbhZulsCRyurYMKNRIu8Jk25uRLdZ7VyBWWF iZIumGCGetCHawPvlyNP0LV9yRQQ1lfNF6bqUkpXbiy/VpI9vxvRdtSqs6SDwX8DAAD//wMA UEsDBBQABgAIAAAAIQCvZndMnwUAACAQAAAVAAAAcHB0L3NsaWRlcy9zbGlkZTgueG1svFdb j9o4FH5faf+DN++QCyEEVFoBw8witVM00L6s9sEkBrx1bNc2MHS1/32PnQQGSlumaish4vhy /H3nlnNevHosGNoSpangfS9sBh4iPBM55au+925+20g9pA3mOWaCk763J9p79fL3317InmY5 gtNc93DfWxsje76vszUpsG4KSTisLYUqsIFXtfJzhXcgtWB+FASJX2DKveq8uua8WC5pRm5E tikIN6UQRRg2gFyvqdS1NHmNNKmIBjHu9Amkl8Asm7HcPrWcK0LsiG/vlJzJqXLL99upQjQH fXmI4wLU4vnVQrXNvfKtG/hnx1f1EPcel6qwT+CGHvseKH9v/307Rx4NysrJ7Dibrd9e2Jut xxd2+/UF/pNLLasS3Od0oprOnBpGUHhgVePV8rXIPmjEBfCx9Et6hx0lZ/uUa2T2EkQZK6ra Vy66wRHMRU1EaScKE0exlUStsHuqkzSKuklQcU0CNz4jXAqWPfM4FPneHl7A0xkE95g2M7Nn xL1I++dAKNADw9bzCW+8m3kop8octWzKK9zWxbcP+PUuwvMpVvjhG5ulw13jdRS+bq7OwVxW L1OGM7IWLCcKJT/CclZfEPyf+t7HDVaGKA9uBeWH8fPNGXSDJHLmDJOoG7jrj+Zstzppt5WW 5ozjOAni8o4r7GlHHAJ7sDFiSQ1aCm5mGWZAoBu1rY8wPpPZA8k3mQ12QBAEB3c5yrjWJaw+ IisALVz8n7nIS2TFmqOjPFMK0oUZMYL5E5FjvsY8IzkaYcbQe8xo7vIWuqFaMrxHb6VLgmip RIHMmiBOzE6oD030150Q5bm/T4GV/lb/WXhbVrnF1zCHLuq+jvaRagOJHr3T4Ik1RKoRowU1 wMIIFLbRaA0hkYFXocFsNJmA3RQa3Q/eIPjWOA4WtBUDoWP26H5TLIhqovkaJMFvt8YGaJJc W3krgfAO75u/iOKEo0IsKKTI9+L1fOzggolyTYzFhtFsMi3pD1bwkWk+Q/VfyhUXkB2yxvf5 6yVi92KHdgRlmKMcVMr3Zg0m+OPHqfUKDLOMcKwoOMlZJD1DNedyf54r1F4qnZc6xVUez4VB /2y0QYuNppxo7ZI1vBmE81zZCevqUhhwEQpi9uA4kmZmowjC4OEEgn2BNUQMhPoxB9gYycmW MKhqYAnEiSUazCez57jZT+KMGQQ0h+S0hRzkItZGp1TAMTMIajcjlIZ3usXZHmKYcASKkILb etNuzSCNQX0H3zf+cUMVJfpXxfS0Ank3ns/QBmJXI8hIY8ACIQxgpzAjOCeszLIKLICdFiD4 KdBUm2PKuvoT8HlEOyjfe/4Sr5Psif4Ex7qlSpt7SFVW2RTKBZuTIa2++slp6lJxA/5e1R40 Oy9vkrq8mVZB0T5UNdVubM/XdQ18UPiKDLQEK54UOAfRT+vxw+SCUXlLGXMVBYyR6hFQFtyv JnnLq8qU19rUBctG0b73b5QOgqAbDRujdjBqxEFn3Bh0406jE4w7cRCn4Sgc/WdPh3EPvAlA YnYjad0whfFnTUpBMyW0WJpmJoqq26mbJuhPwqBqmbaYHdUKgOqng2hLGiDhKj6jiMnWdrgE fg+glvLMYcF/yv6LtVsSBp00KIu3uJXEYXpavEVx2gmTqnhrdZMoPivGwUrgcHcEosYOQLEA xSkWbwF05R/Vlie1nl+5h5uoG7GaqBtVthgO4dZROmwMw/i2Ed90O43BbdJu3LZbcTwapoNR a2xtIcEWmSKudprUvau81hRS7IiSgrre89QaYZx20yBJuq5N8R22+lma5dhTZky9wfLt1qka LoOEOXJT0tq53HrcAiEDVRNfuRGvmEPedZLmvG5C8w200JTnZEk51FiezaoGIr/vcchTULhz kZN52Y8VD0KYCqeTZOOyFG1H1XVW6QD4fwAAAP//AwBQSwMEFAAGAAgAAAAhAEx/+fe0BQAA YyAAABUAAABwcHQvc2xpZGVzL3NsaWRlNy54bWzcWd1u2zYUvh+wdyB0UWzobPk/tlsnS1yn c5Glhu2kF8Mw0BJlEaVIlaT8s2FAX2MXe7k+yQ4pOU5Sx3McB3XiC4uiyMPznV+S5/XRLGJo QqSigrecYr7gIMI94VM+bjkXw9Nc3UFKY+5jJjhpOXOinKPD7797HTcV8xHM5qqJW06oddx0 XeWFJMIqL2LC4VsgZIQ1vMqx60s8BaoRc0uFQs2NMOVONl9uMl8EAfXIG+ElEeE6JSIJwxo4 VyGN1YJavAm1WBIFZOzsGywdAjJvwHzzVPFQEmJafPJWxoO4J+3n80lPIuqDvBzEcQRicdzs QzbMvvKJbbi3po8XTdycBTIyT8CGZi0HhD83/67pIzONvLTTW/Z64fsVY72ws2K0u1jAvbao QZUy9zWc0gLO0CzeY9gjoWA+kah4BXDBuorPhPdRIS4AmpFEivRqRArfPOMQ6XkMVEfCn4M1 /dlyPiVYaiIdWBV4LpazyekM21gymwlTz05gulnZkLGduMmUHug5I/YltlLjfg9L3AdEDBsb Jjx3MXCQT6W+JpfYLrOg6S6EcrdoyleioZoRVNqFPLQhtTvolg15J3CkIt1mBPMrq9GHH0Ks kY81RpwQXyEt0IggD0tJiY8oRzokQE5pFIoYdc8vu8MOgmCApiGRxAhSW3HapR9L9JU7rdLa zaNZZWW9alb4b7nRqBwUrWMeVIv1Ru2mJ9cL0FkopR5arlcO6tWUwWt+mlL+WuemxSF+HSda BFSjQHA98DADAI1StQDqZXwQe33iJ56JacB/AX4Z+SWNLTzmtuGkOtzM6DI7G4QigWwxJUiS RBFrVresZwvrHXR7qI0Zy3V5IO5JLyMREmwMSUjUk2JCTftYKQJm4O+Awa4PKYbq+YN4A580 Djm3QrO++nDGAimim76ttxSgIdKGBAxJWbodDu4TSwoavlBGlGPAj/BHbNeKQ9hBHN1e5mHm 96jGuz5imjAYiimKEi9Me6gC8/6UUEn8o61j4+LPjJywLITdxaqJWkXr/WuZfi/pGIL5kdFU AEbOPYLOyISwW9pYy8FdEFbwsAM5D2gUQ56dYEZ9u0lDGo+P0D34XSOx4g1ubViENbhNCAGk l5bTFgmkQEgFXoilInq5K8ObjPLU/48yENKYrA97uUXUyS1iRnMzf1yB54Y49wDcl8//9qn5 7CPIA95HAul2W2x7AOcF06+2Vg2R0p4a9kxFisZNmeroZ5XqKJ+o52KAL8b61atlJGnBGRY9 SiTZN+ArwsoTdrwHRMTM7fYAhCbsKavg5XOJCcWDQrnaKJdq9fL10PDcAjuEumvw/hB2I/hc dNj6bTab/f7skvE1fQVCPBtljbDc9Oy3v3CWHN/3ILqHPG9xLLskciRUdg8hJJx3AyLteXI0 Rxf97lZ3CDu40JiGsHtFU3vLlJ3BEYYpseHLXD5cHN88kn/bW4Q3RnygJBQlSpsr10QRPGJW ipgx5DEK2zWVR70EgFyKs2Hnp/tKaVV0y5Z/J+abJYG1INx3dER+6LcHP+6QtQ9k1B+2H84c KPzL538UItrbyibzT/ua6hc6DtkcXZpUggJw1POB2+khHMeMemnJLI/edoaDHaru3qJeqTdz rebBmQVTDgBOqVT6nOj8muPave/WHlmXT3q5TW/9vgW1hxSY7GNRzSUzfaZ01kKQN1vOXycn jVqpXT/JnRQrp7nKm8ZB7vi0Vs2dVsuVSvukftwud/421eFipelJYn2ouyiAQ+dXReeIelIo Eei8J6Kseu3GYkpkLKgtYBcLWRUcdnwtp3pQrddqhUZWdQLOFk/Lq6liZWVpj8lfcfx+Yt0L ltJEtm1XTPk4K3gth4AoaAQfbItnuGOcFtmGfFHH9hNwbMp9ElBONXEgjSqNJewjOJmYfQUX PhmmdcuoL4TO+LSUjLxT0qaVLWdEDgz/BwAA//8DAFBLAwQUAAYACAAAACEAahvRV6ECAABf BgAAHwAAAHBwdC9ub3Rlc1NsaWRlcy9ub3Rlc1NsaWRlMy54bWysVNtu4jAQfV9p/8HKe5oA IQVUqJIAq0rdFpX2A1zHkGgd22sbCrvqv+/YSaBXtVr1JZ6MPZdzxj5n57uKoS1VuhR87HVO Qg9RTkRe8vXYu7ud+wMPaYN5jpngdOztqfbOJ9+/nckRF4ZqBPFcj/DYK4yRoyDQpKAV1idC Ug57K6EqbOBXrYNc4QfIW7GgG4ZxUOGSe028+ky8WK1KQqeCbCrKTZ1EUYYN9K6LUuo2m/xM NqmohjQu+llLE8BGliy3q5a3ilJr8e0PJZdyodz21XahUJkDYx7iuAJivKDZaI65X751RvAi fN2aeLRbqcqugA3txh7Qv7ffwProziBSO8nRS4rrN86SYvbG6aAtEDwpalHVzb2G023hLFmZ U3RR4TVFC4YJLQTLqUKdA84WgZaXgvzSiAtAWBMiboRprKzAfE0TLSlxrpqNQ3hNkV1lgcxe QmXN8otq3Rysd51xbL7ltIbxPpheC+bK3dSnMLofw/i403uR7z2otDsef79fOTK7FAJsLRvo nHjEtFmaPaPuR7qp83yBFb4BEAzbV0i5f7dspild8jbTJziIng/0alPdA/ynVPS+ggoYGqQG qfgz9n5vsDJUtczUF/FLqFmx3IH6OxtGaTKdhX6a9ed+1I/nfnKaDP0knKbzOAtnUZI9eofe ADmH7mwK9YJWpCuTMYr54SWZSSe0VBtH+MrqwP8MxS2teMBLvtSmsdBGlYAhTYdxNxukftqJ AMN0eOon87jvz/u9KMrSQZL1Zo9WjDrRiCjqdOoibxWuE73SuKokSmixMidEVI1YBlI8UCVF 6fSyEzaiu8UMJhPH0SDuR3G/mRD01q6uWzvzRgcJUz+xvN66+wHFYL6Zc0kQ9OZ6HI/YIdsn N/kHAAD//wMAUEsDBBQABgAIAAAAIQAtH3MynwIAAFwGAAAfAAAAcHB0L25vdGVzU2xpZGVz L25vdGVzU2xpZGUxLnhtbKxU227iMBB9X2n/wcp7mgQCBVSokgCrSt0WlfYDXMeQaB3baxsK u+q/79hJoFe1WvUlnow9l3PGPmfnu4qhLVW6FHzsRSehhygnIi/5euzd3c79gYe0wTzHTHA6 9vZUe+eT79/O5IgLQzWCeK5HeOwVxshREGhS0ArrEyEph72VUBU28KvWQa7wA+StWNAJw35Q 4ZJ7Tbz6TLxYrUpCp4JsKspNnURRhg30rotS6jab/Ew2qaiGNC76WUsTwEaWLLerlreKUmvx 7Q8ll3Kh3PbVdqFQmQNjHuK4AmK8oNlojrlfvnVG8CJ83Zp4tFupyq6ADe3GHtC/t9/A+ujO IFI7ydFLius3zpJi9sbpoC0QPClqUdXNvYbTaeEsWZlTdFHhNUULhgktBMupQtEBZ4tAy0tB fmnEBSCsCRE3wjRWVmC+pomWlDhXzcYhvKbIrrJAZi+hsmb5RbVuDta7zjg233Jaw3gfTLcF c+Vu6lMYnY9hfNzpvcj3HlTaHY+/368cmV0KAbaWDXROPGLaLM2eUfcj3dR5vsAK3wAIhu0r pNy/WzbTlC55m+kTHMTPB3q1qe4B/lMqul9BBQwNUoNU/Bl7vzdYGapaZuqL+CXUrFjuQP2d DeM0mc5CP816cz/u9ed+cpoM/SScpvN+Fs7iJHv0Dr0Bcg7d2RTqBa1IVyZjFPPDSzKTgWXa OL5XVgb+ZyZuabUDHvKlNo2FNqoECGk67HeyQeqnUQwQpsNTP5n3e/68143jLB0kWXf2aLUo ikdEUSdTF3krcFH8SuKqkiihxcqcEFE1WhlI8UCVFKWTyyhsNHeLGdyMaBh2B8O4GQ901q6u VzvwRgQJUz+xvN66ywGlYLiZc0lQ8+ZuHI/YCdv3NvkHAAD//wMAUEsDBBQABgAIAAAAIQCz WVETdgYAAPAqAAAhAAAAcHB0L3NsaWRlTWFzdGVycy9zbGlkZU1hc3RlcjEueG1s7FprbttG EP5foHcg+LdQxJeeiBxYTpwacFIjdg6wIlci6+UusVwpdooCvUNv0Gv0X4/Sk3RmuJRoS1YU JE1ihDAgLmdnZ3ZnvnmQ9NNnN7lwVlyXmZIT13/iuQ6XsUoyuZi4b69OO0PXKQ2TCRNK8ol7 y0v32dGPPzwtxqVIXrHScO2ADFmO2cRNjSnG3W4Zpzxn5RNVcAlzc6VzZuBWL7qJZu9Adi66 gef1uznLpGvX60PWq/k8i/lzFS9zLk0lRHPBDOy/TLOirKUVh0grNC9BDK2+uyWa0Ss4se8e wWHjS5Hgdbaoft/wuZMlNzDtecjBxqSGnwjtrJiYuLOF73aPnnYtsx3h4rK40pzjSK5e6uKy uNCk4fXqQoNM1OhIloNqFEATlo1u5YoG3XvLF/WQjW/mOscr2MqBHYJLb/G3izR+Y5y4IsYb apz+soM3Tl/s4O7WCroNpXiqanPbxwnq41xlRnDnQrCYp0okABwyEfHWey+LcxVfl45UcDY0 RXXUNUd1frwWqWNuCxBrUKzlqyZpsNnYTqtEvQG4m47rh34/IE0b+wyDYNTHeTw38Pqj0Z3D s3GhS/OSq9zBwcTVPDaEA7Y6L03FWrPQjqp9FGNzM1XJLXLO4Ao2guiD9anS711HnMly4o78 KALVhm5oo66jmzOzOzNGnChBTmIyBjkTNzaa9iLV8dKoeWb3UynECVGaS3MrOJ25wB8ia9iO YBj6XHbeXkLo5+ZEcCbXmDBHJyKLrx2jHJ5kxrEZgHwAiQJEoiJD6kgkl8kF0+zNfclJpk0D UgXZqLYNmWs/qsI1qtBlTVAFnwNUaCrXRvinYGsQ+UFwL/buYCsc9sLI63374KrwpPODEVWg y1e0loifiDC0HgGsvIOwCjv3VdpoPljlJY+VTBzBV1wcIJ4g9hHir9JMHy49/Ejpp2qpTXqw +OhjxWfzndI/LbbpUhdC8C3g2o6cpc4m7m/T6agfnAynnakfnXai56NB5/i03+ucQrxEJ9Ph 8Un44neszX40jjWnGn6W1NXfj7bqf57FWpVqbp7EKreNRLdQ77guVEa9hO/Z6k8VPAj7kPYj LxjaBAB7q6+0W0whti2IhX7FCgeK/sQVBgq4uYFRcg2j2SJAWoC0AGkwYnEMbQdw2EFNCWrK miesKWFNiWpKVFN6NaVXU/o1pe86qcjkNRgDL64zV+LnilCPqmwJzdw5u1VLc5ZYTzQoVRn3 o0E0DPvDEWSFMVL0WWIL+AO8Ay9o8Nq8/JDcEWabmpdCYA+v3+AlPO/hbe6B8uwe3rDB27du 3zaNyXLoYWkkLalgVX26knULlyyhEGcy4fNMZoaDYA6NNGZjCaGkoXyphF9VHUz+Rilj1ZEk jJdKNI7W6tK5A7t5vcyp2qeJpuvcVNfE2JjDYKNkXFa7hdpMt5SnV8LHVMDEAoJcwCo+v2Kz y/cTtz/sDbEsQc4neZydy6m+ptNghy3tLaqGcIc9XSxlbKoWGatsPMVGl0YXsamiqE4Cm9nZ 8jU8SlByAd2YPEpQDgUTaw8pu+YaH0awhpI4JbLkNBOCbvRitm6ygxf4V2tostF+qZbPoTOY uMc6Y3DYgklVwq0XeFOv70Fwr/8gnIrMxOkpyzOBhRkIccp0yWuzQsJjDZE/5b92OLOtcvmZ dXVr49DQOs2iYePOggrwlm9zps/BfgM/6oFNEYMS5HZqwpdyPbp0l/vBfTsemCBjWt41x2x5 qqT57F4E+UAh8sT994+/KmoDiz51Z48FhfKLo5CGwQZpPegV/bCBNMinIRK+NtK+BHz+3IYP Nf8tfLbhg5ix8Ak38BkCfL7JRPWVso+HZ2/hsw0fxIyFT9Soc2Aj/7vFz3b6GbXZZzd8EDMW Pr0GfHpRSBH3HcLnn79b9ByKHoSMRU+/gZ7hsDdqi9emePU+iJ+H2v698EFfC3pEPhQEOBGX O12J/rOuHGxcGQQBOLN15aNyJfrPunLYcGVv4A9aVz4uV6L/rCtHDVeO/KjfuvJxuRL9V33x 3ryeKsbKpFyvX1bBiovK4fZ0zU8Ia6GW5e6brf/F+U0bhx98Avv6Nt79KiaMAurgWvvsftdQ G6G1zwMP014wHLQG2vO4GA6q18OtgR54IqLy3Bro4ecMrzeIWgPt6d7BOmFroD098SAK6RtD a6B1p9lsLum/TeoP4NUX/Oq/iI7+AwAA//8DAFBLAwQUAAYACAAAACEAJLMgcKECAABeBgAA HwAAAHBwdC9ub3Rlc1NsaWRlcy9ub3Rlc1NsaWRlMi54bWysVNtu4jAQfV9p/8HKexouIQVU qJIAq0rdFpX2A1zHIdE6ttc2FHbVf9+xk0CvarXqSzwZey7njH3OzncVQ1uqdCn4xOuedDxE ORFZydcT7+524Q89pA3mGWaC04m3p9o7n37/dibHXBiqEcRzPcYTrzBGjoNAk4JWWJ8ISTns 5UJV2MCvWgeZwg+Qt2JBr9OJggqX3Gvi1WfiRZ6XhM4E2VSUmzqJogwb6F0XpdRtNvmZbFJR DWlc9LOWpoCNrFhmVy1vFaXW4tsfSq7kUrntq+1SoTIDxjzEcQXEeEGz0Rxzv3zrjOBF+Lo1 8XiXq8qugA3tJh7Qv7ffwProziBSO8nRS4rrN86SYv7G6aAtEDwpalHVzb2G02vhrFiZUXRR 4TVFS4YJLQTLqELdA84WgZaXgvzSiAtAWBMiboRprLTAfE1jLSlxrpqNQ3hNkV1lgcxeQmXN sotq3Rysd51xbL7ltIbxPph+C+bK3dSnMHofw/i403uR7T2otDsef79fOTa7BAJsLRvonHjM tFmZPaPuR7qp82yJFb4BEAzbV0i5f7dqpild8jbTJzgInw/0alPdA/ynVPS/ggoYGqQGqfgz 8X5vsDJUtczUF/FLqMlZ5kD9nY/CJJ7NO36SDhZ+OIgWfnwaj/y4M0sWUdqZh3H66B16A+Qc urMp1Ataka5Myijmh5dkpiPLtHF851YG/mcmbmm1Ax7ypTaNhTaqBAhJMop66TDxk24IEGaj Uz9eRAN/MeiHYZoM47Q/f7Ra1A3HRFEnUxdZK3Dd8JXEVSVRQovcnBBRNVoZSPFAlRSlk8tu p9HcLWYwmGEvjKLTsDdsBgS9tavr1o68kUHC1E8sr7fuekAxGG/qXBL0vLkdxyN2xvbFTf8B AAD//wMAUEsDBBQABgAIAAAAIQA7U86k3QAAAEUCAAAsAAAAcHB0L3NsaWRlTGF5b3V0cy9f cmVscy9zbGlkZUxheW91dDEueG1sLnJlbHO8kc1KAzEQgO+C7xDmbrK7gog024sIPXiR+gBD MpsN3fyQSYt9ewMidKGCB/E4f998zGy2H2ERJyrsU9TQyw4ERZOsj07D+/7l7hEEV4wWlxRJ w5kYtuPtzeaNFqxtiGefWTRKZA1zrflJKTYzBWSZMsVWmVIJWFtYnMpoDuhIDV33oMolA8YV U+yshrKzPYj9OdNv2GmavKHnZI6BYr2yQvHiLb0iVyoNi8VR1SDlZX7V1Mu2AtR1s+EvzXxo V1k5BbIev/K9zNH9pHH/bxrDt4ZaPX/8BAAA//8DAFBLAwQUAAYACAAAACEAR7iia/UAAADA BAAALAAAAHBwdC9zbGlkZU1hc3RlcnMvX3JlbHMvc2xpZGVNYXN0ZXIxLnhtbC5yZWxzxNTB asQgEAbge6HvIHOvJtndtJQ1eymFhZ7K9gFEJ4k0UVG3NG9faSlsYJEeCl4ER+efDw/uD5/z RD7QB20Nh5pWQNBIq7QZOLydnu8egIQojBKTNchhwQCH7vZm/4qTiKkpjNoFklJM4DDG6B4Z C3LEWQRqHZp00ls/i5i2fmBOyHcxIGuqqmX+MgO6VSY5Kg7+qDZATovDv2TbvtcSn6w8z2ji lREsTFrhi1jsOaZY4QeMHCi9rK8ubWgaAey6bFtSts3JdiVlu5ysLSlrc7L7/5TF1Isr03fl Z61zjLrkA2VlTUlZ8ytjq3+n+wIAAP//AwBQSwMEFAAGAAgAAAAhAGxPAuOhAgAAXwYAAB8A AABwcHQvbm90ZXNTbGlkZXMvbm90ZXNTbGlkZTQueG1srFTbbuIwEH1faf/BynuaBAIFVKiS AKtK3RaV9gNcx5BoHdtrGwq76r/v2EmgV7Va9SWejD2Xc8Y+Z+e7iqEtVboUfOxFJ6GHKCci L/l67N3dzv2Bh7TBPMdMcDr29lR755Pv387kiAtDNYJ4rkd47BXGyFEQaFLQCusTISmHvZVQ FTbwq9ZBrvAD5K1Y0AnDflDhkntNvPpMvFitSkKngmwqyk2dRFGGDfSui1LqNpv8TDapqIY0 LvpZSxPARpYst6uWt4pSa/HtDyWXcqHc9tV2oVCZA2Me4rgCYryg2WiOuV++dUbwInzdmni0 W6nKroAN7cYe0L+338D66M4gUjvJ0UuK6zfOkmL2xumgLRA8KWpR1c29htNp4SxZmVN0UeE1 RQuGCS0Ey6lC0QFni0DLS0F+acQFIKwJETfCNFZWYL6miZaUOFfNxiG8psiuskBmL6GyZvlF tW4O1rvOODbfclrDeB9MtwVz5W7qUxidj2F83Om9yPceVNodj7/frxyZXQoBtpYNdE48Ytos zZ5R9yPd1Hm+wArfAAiG7Suk3L9bNtOULnmb6RMcxM8HerWp7gH+Uyq6X0EFDA1Sg1T8GXu/ N1gZqlpm6ov4JdSsWO5A/Z0N4zSZzkI/zXpzP+71535ymgz9JJym834WzuIke/QOvQFyDt3Z FOoFrUhXJmMU88NLMpMoslQbR/jK6sD/DMUtrXjAS77UprHQRpWAIU2H/U42SP00igHDdHjq J/N+z5/3unGcpYMk684erRhF8Ygo6nTqIm8VLopfaVxVEiW0WJkTIqpGLAMpHqiSonR6GYWN 6G4xg8nE/bDXPx102wlBb+3qurUzb3SQMPUTy+utux9QDOabOZcEQW+ux/GIHbJ9cpN/AAAA //8DAFBLAwQUAAYACAAAACEAO1POpN0AAABFAgAALAAAAHBwdC9zbGlkZUxheW91dHMvX3Jl bHMvc2xpZGVMYXlvdXQyLnhtbC5yZWxzvJHNSgMxEIDvgu8Q5m6yu4KINNuLCD14kfoAQzKb Dd38kEmLfXsDInShggfxOH/ffMxsth9hEScq7FPU0MsOBEWTrI9Ow/v+5e4RBFeMFpcUScOZ GLbj7c3mjRasbYhnn1k0SmQNc635SSk2MwVkmTLFVplSCVhbWJzKaA7oSA1d96DKJQPGFVPs rIaysz2I/TnTb9hpmryh52SOgWK9skLx4i29IlcqDYvFUdUg5WV+1dTLtgLUdbPhL818aFdZ OQWyHr/yvczR/aRx/28aw7eGWj1//AQAAP//AwBQSwMEFAAGAAgAAAAhADtTzqTdAAAARQIA ACwAAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0My54bWwucmVsc7yRzUoD MRCA74LvEOZusruCiDTbiwg9eJH6AEMymw3d/JBJi317AyJ0oYIH8Th/33zMbLYfYREnKuxT 1NDLDgRFk6yPTsP7/uXuEQRXjBaXFEnDmRi24+3N5o0WrG2IZ59ZNEpkDXOt+UkpNjMFZJky xVaZUglYW1icymgO6EgNXfegyiUDxhVT7KyGsrM9iP0502/YaZq8oedkjoFivbJC8eItvSJX Kg2LxVHVIOVlftXUy7YC1HWz4S/NfGhXWTkFsh6/8r3M0f2kcf9vGsO3hlo9f/wEAAD//wMA UEsDBBQABgAIAAAAIQA7U86k3QAAAEUCAAAsAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9z bGlkZUxheW91dDUueG1sLnJlbHO8kc1KAzEQgO+C7xDmbrK7gog024sIPXiR+gBDMpsN3fyQ SYt9ewMidKGCB/E4f998zGy2H2ERJyrsU9TQyw4ERZOsj07D+/7l7hEEV4wWlxRJw5kYtuPt zeaNFqxtiGefWTRKZA1zrflJKTYzBWSZMsVWmVIJWFtYnMpoDuhIDV33oMolA8YVU+yshrKz PYj9OdNv2GmavKHnZI6BYr2yQvHiLb0iVyoNi8VR1SDlZX7V1Mu2AtR1s+EvzXxoV1k5BbIe v/K9zNH9pHH/bxrDt4ZaPX/8BAAA//8DAFBLAwQUAAYACAAAACEAO1POpN0AAABFAgAALAAA AHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ2LnhtbC5yZWxzvJHNSgMxEIDv gu8Q5m6yu4KINNuLCD14kfoAQzKbDd38kEmLfXsDInShggfxOH/ffMxsth9hEScq7FPU0MsO BEWTrI9Ow/v+5e4RBFeMFpcUScOZGLbj7c3mjRasbYhnn1k0SmQNc635SSk2MwVkmTLFVplS CVhbWJzKaA7oSA1d96DKJQPGFVPsrIaysz2I/TnTb9hpmryh52SOgWK9skLx4i29IlcqDYvF UdUg5WV+1dTLtgLUdbPhL818aFdZOQWyHr/yvczR/aRx/28aw7eGWj1//AQAAP//AwBQSwME FAAGAAgAAAAhAOznoHjUAAAAvwEAACoAAABwcHQvbm90ZXNTbGlkZXMvX3JlbHMvbm90ZXNT bGlkZTEueG1sLnJlbHOskDFrAzEMhfdA/4PRXvsuQwkhviwlkKFLSH+AsXV3pneysZSS/Pua 0kIOMnToqPek7z2021/nSX1i4ZjIQqsbUEg+hUiDhffz4XkDisVRcFMitHBDhn33tNqdcHJS j3iMmVWlEFsYRfLWGPYjzo51ykjV6VOZndSxDCY7/+EGNOumeTHlngHdgqmOwUI5hhbU+Zbx L+zU99Hja/KXGUkeRBhKgvzmWLBUrCsDigWt7/XFUqtrBJjHzdb/2YynGHDR6Vv5MTa/Pczi 7d0XAAAA//8DAFBLAwQUAAYACAAAACEAy4KF+dQAAAC/AQAAKgAAAHBwdC9ub3Rlc1NsaWRl cy9fcmVscy9ub3Rlc1NsaWRlMi54bWwucmVsc6yQMWsDMQyF90L/g9Fe+y5DaEt8WUogQ5aQ /gBj6+5M72RjKaX59zGlhRxk6NBR70nfe2iz/Zon9YmFYyILrW5AIfkUIg0W3k+7p2dQLI6C mxKhhQsybLvHh80RJyf1iMeYWVUKsYVRJL8aw37E2bFOGak6fSqzkzqWwWTnP9yAZtU0a1Nu GdAtmGofLJR9aEGdLhn/wk59Hz2+JX+ekeROhKEkyAfHgqViXRlQLGh9qy+WWl0jwNxvtvrP ZjzFgItO38qP8fLbwyze3l0BAAD//wMAUEsDBBQABgAIAAAAIQAIUWnc1AAAAMABAAAqAAAA cHB0L25vdGVzU2xpZGVzL19yZWxzL25vdGVzU2xpZGUzLnhtbC5yZWxzrJAxawMxDIX3Qv+D 0R77LkMoJb4spZAhS0l/gLB1dyZ3srGckPz7mtJCDjJ06Kj3pO89tN1d50ldKEuIbKHVDShi F33gwcLn8X31AkoKsscpMlm4kcCue37aftCEpR7JGJKoSmGxMJaSXo0RN9KMomMirk4f84yl jnkwCd0JBzLrptmYfM+AbsFUe28h730L6nhL9Bd27Pvg6C2680xcHkQYjoXkgFIoVyzmgYoF re/1xVKrawSYx83W/9lMpuBp0elb+THa5reIWfy9+wIAAP//AwBQSwMEFAAGAAgAAAAhAC80 TF3TAAAAwAEAACoAAABwcHQvbm90ZXNTbGlkZXMvX3JlbHMvbm90ZXNTbGlkZTQueG1sLnJl bHOskDFrAzEMhfdC/4PRHvsuQyglviylkCFLSX+AsHV3JneysZyQ/PuaUkoOMnToqPek7z20 3V3nSV0oS4hsodUNKGIXfeDBwufxffUCSgqyxykyWbiRwK57ftp+0ISlHskYkqhKYbEwlpJe jRE30oyiYyKuTh/zjKWOeTAJ3QkHMuum2Zh8z4BuwVR7byHvfQvqeEv0F3bs++DoLbrzTFwe RBiOheSAUihXLOaBigWt7/XFUqtrBJjHzdb/2Uym4GnR6Vv5MdrfImbx9+4LAAD//wMAUEsD BBQABgAIAAAAIQC9SmOtKgYAAPQUAAAhAAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91 dDEueG1s1Fjrbts2FP4/YO9AaD8H17rZko0mha3EQ4F0DZoU+81IdESUIjWSduMWA/pa2+P0 SXZIir40dprFQYEhQHQskufy8TvnkHr56q5haEmkooKfBNGLMECEl6Ki/PYkeH896+UBUhrz CjPByUmwIip4dfrzTy/bsWLVBV6JhUagg6sxPglqrdtxv6/KmjRYvRAt4TA2F7LBGn7K234l 8UfQ3bB+HIbDfoMpD7r18jHrxXxOS3ImykVDuHZKJGFYg/+qpq3y2trHaGslUaDGrt51yY7I JUQcBWgB4hk4bhAKTiH08opViOMGhq+pZgQBQKgQXIMyO0G115IQI/Hlb7K9ai+lXff78lIi Wlmtbn3Q7wa6afYnX1qh/83yWy/i8d1cNuYJeKC7kwC2bWX+9807cqdR6V6Wm7dl/XbP3LI+ 3zO77w30t4y245aWnXe0vBdQ6COCQb2QBI3WoXXTsVFwIcoPCnFR1JjfkolqSakNHC7czWQH wi70HpL1lBtG2xllzOg2MpJj0twQcEe+ruKgA+NCaQ/LQtKT4HOcT8JwFE97xSAsemmYnfcm ozTrZeF5loZpHhVR8ZdZHaVjcABcxuyspZ7nUXqPWw0tpVBirl+UoulI6rkOtIrCjlZLzDYQ g0P+aV3suyCMr0pLosvaiHOI7x2A5NasB/rb0RvCPcCLNMuH6cjux4YdoyhNw7Db9WSQhWG8 s/WwW1Lp34hokBEAUnDCQoqX4K6b6qdYf5wP/TVPHqTLOgE8XSILy5F8OcgQJIX+g+r6qsat Teq9lEkADah2Gma0ktpc/t8ySJaGNQjAipNRPgoQ1NeexW3NIofWI2gUWxr51Z5BURpGw9QR KI2yMM6emUCqdfu6p3zGnj6u/lrP7ARfIFXrmQMFdIcwXpvhi6VpjfTKkEIbVQGqsSoWSovm Uoqm3SKbW2AFr+MAXkke2dRambo4GKbpLnB5HI+G69SLoiS3E7arrlPcjvXdVFQrS1Z4OmNc TBZazGkH4WaAKX2lV4xYecki0IEwu4XaySzuFZm/g1fqE+yo9e/GZ4ISjFa+kip5e1Mw6aiW xEmUOAS+mWaaLrfQzXEJ8E0kxQw6J+ZCwc8wDqfhMEzh6f+AKy0F3s1wQ5kJ3ZCnxlIRvWlI 6plV9n3cVuxgcfIWXDZnLIgSEGLYHH8I772/ClBFpbaNEalGF4xgvnZWnxaMlh/QtUDnFdXo DVaaSOQ4aXUbOy4xrXLCq0sssdmF/Ta6rLAc8Htv6fCdfEjW+QAkm4o7FNlqviY8MspMzrq3 27Xyu1w2Bc31kXwYZXm+S+YkHGWey3E0SB3Zn1oFDLsNwZxzh7IAfZQYkprDkRTqmmaFsEXR 5b1Jjtnh5LDO2+2ewyHOgPd5EE5mURQPemeTBKr5JMx6k2mU9qLwLB7OzoaDKINq3lUJBSlA +KKx1u6RxeRWbuD4QKQ5s8RG5gJKiZjf49D9zDPNgKxz7+b2UYn3a8N7THe7gr8ZIPhgXjnV smu1lhCGrF+//P3L1y//bJgLOD3E3XXIaxI/KS7TxtYWnpYF6XYSoEsGsdaCVZCRyXP0B8Ml F+6fCywh0QOwavvgMQ0iS5I0frBB5HB+G3jEvtshzG0O0qwW8lOA2GuuuqMe8Nf+SAdZDD/k 9sjNzshOPnG4Lj2+3Wx1mXsciWxED/P/MZ3nQEG3YvyQD89v2ZsDMfmxlr05ENMfa9mbA3Fw 2PIzGXMW9vVq09MaLC+AV1mSgzIE022FpRzqszbHVTdgM2t/az/Y0LVAZKuha5OYythXOw3d FamHPYqO9eiKlIJXiJElYf/Zenys9euayqcaT441PhMLqesnWk+Ptk7ne40fd4yzD/91yF/c rNTdLafT0TAu8mkPjiCzXno2gtPIbDjozQZJmhbTfFIk5+Zu2cLdspTEfrx6XfnPXo+9Wrbi I5GtoPYj2u7tcgQ323gAOdq1NXfL3Dhr2uSVORPAk8k3uH27tKg0NlkK+6o111Y3dTMFsKAN DFiJd4G32HXxa+4/jFULuKqarZtTTrU54RG4lJumxmEvpDlPVeTaXdmad0LYo4+5NRpNBnCn 2kidOYO5/1p5+i8AAAD//wMAUEsDBBQABgAIAAAAIQCBwFmFvQYAALYYAAAhAAAAcHB0L3Ns aWRlTGF5b3V0cy9zbGlkZUxheW91dDIueG1s1FnRbts2FH0fsH8gtMfBlSjJlmzULWwnLgqk bdC42DMt0ZFQidRI2klaDOhvbZ/TL9klKcl2HLtO4hUYClS0SB5eXp57eK/y8vVtWaAVFTLn bOjgF56DKEt4mrProfNpNu3EDpKKsJQUnNGhc0el8/rVr7+8rAaySC/IHV8qBBhMDsjQyZSq Bq4rk4yWRL7gFWXQt+CiJAp+ims3FeQGsMvC9T2v55YkZ049Xxwzny8WeULPeLIsKVMWRNCC KLBfZnklG7TqGLRKUAkwZva2SaZHrGDH2EFLaJ6B4dpDzivYenJVpIiRErpnuSoounHR1XKe UZIi8BWacKYA14yV1UxQqlts9UZUV9WlMBDvV5cC5alZwEI5bt1RDzM/2co03HvTr5smGdwu RKmf4Bp0O3TgBO/0/65+R28VSuzLZP02yT48MDbJzh8Y7TYLuBuLVoMqT2rr8mRnQ16zI+hU S0FRv91aPZxogAuefJaI8UlG2DUdyYomSrvDbnc92Dph+xQal7RD5kVeTfOi0Ni6jcSAlnMK 5oi3qe/UzriQqnHLUuRD56sfjzyv7487k6436YRedN4Z9cOoE3nnUeiFMZ7gyV96Ng4HYACY TIqzKm8oj8MdmpV5IrjkC/Ui4WXN14b2wDDs1QxbkWLtYjCoeRoTXbsJbatUgqok080F7O8j OMnOaTvczd1rwh3gRRjFvbBvzmPNjj4OQ8+rTz3oRp7nbx09nJaQ6g3lJdINcCkYYVxKVmCu HdoMMfZYG9yWJ7Kyx7jL/qjhykxbc1mQhGa8SKlAvZY0DdNl1VAGImGLKQ2uJoqhZ4bUXQWo c57egYJ9GTp/LolQVDiwKmwZBw7KiJwspeLlpeBltUE9i2IaDfAepwYxNo7TnvV6QdcgrB0b +36/1zjWx92+txNTFrgaqNsxmGrYC09wDmFJxkETEyWMqxkfLRVf5LW77SjdUUh1pe4Katqr AgMgKom4MEeesxSESDcN9PI9qLgxMaWLjzBQewb7rVn1/BrKX0MFoa+N/xFei6Kn1ijBGqUX d+PHoOipNUq4RsGeH0ePgdFza5juBkwQYXM4x8Louba94XEToxoUBrRSalYT+iXR9yhlnU9X DkpzoYysIlmqSUEJayeoV5MiTz4jxRFJUySXc6XvFb2YVQODSFl6SQTR5/YwcB2JhlgNoQzH fijZ7SXUSDY2aM/U7L0qjQRXf+Qqu8qIjlJ9qz4g2xCjCSQfCkZUIjf36f9WxUWilRuBs/yg H/cdBKHdqeWiVnLrrSOk3DeC08xuxAaHHu6FVmtCHHl+9NNEHPutipt0yFj2XOk2EXBqlcZe txeGB1Q6wDiIzYBjVPrRwkyKa4j6wvh9Q4J9Y9+8iQTJizxtshkprueTQliqBX6AA+uBe8N0 DsyM6xZwhw6dkchJAYksYVzCT8/3xl7PC+HZ/AOuVDnwbkrKvNBb1+TJiJDUiKFNCuWJId1m 39v3zUOq+mQVnXF0nuYKvSMSbnxkOWmwTyqoB+Ih2MxqxvwWYZNRtYRHGkzHrH27qZU/5LIW NJtxxD0cxfE2mQOvb+7GOuMILdmfqgKa3Zpg1ri9ucqNIBDUDO5N0DVVTLgRRRv3Ojim+4PD GG+OewE1lXbe1643mmLsdztnowDUfORFndEYhx3snfm96VmviyNQ81olJIQAZcvSrLZDFh1b JuP4TIWuG3SmAxoEUsIXOxzajTx9GdA29ubXRwXe7yXrFKo+FXKvg5K9cWWhRX3VGkJosn7/ 9vdv37/9s2Yu+OkQd9sttyR+0r70Ndau8LQoCPem9sF/mtpbxj/xgogCSHUPXhAx1FA20T8q j19RAWEGqfwXBxVvmazLLeCv+RF2Ix9+iM2e+VbPVjwxLsrjr5uNW2aHIzb3Pcz/Y26ePYK+ VQU8aMPpV75XdPzEle8VKj9x5Xu1zZ6VT7TY4QqoLquiIAawph5qq6tO3fHsAoluXO1Kh6jU lsitq93K1WHb8Olsu6IJZykq6IoWj7bDP50dsywXTzUjOJ0ZU74UKnuiHeEJ7cgXD5rxvMTP PJpvuk2pZ1p1NToe93v+JB53IGmZdsKzPuQv0163M+0GYTgZx6NJcK6r0Qqq0URQ8/X5bdp8 tz62GK34DRUVz81X8O16FJbxgtiPI/OdzzW2NU9bmNpP2OYOLsQ7Un1YGbeUJqom5lWlK107 dD0EnJGX0GFarN55RezFP2PN9+x0CdWtPsVFznKlk0IKdby+BxkchtApWEpntsorP3JusiVd aGok7XELrVv1ctrpzd8bXv0LAAD//wMAUEsDBBQABgAIAAAAIQCiB/eovAYAADkfAAAhAAAA cHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDMueG1s7Fndbts2FL4fsHcgtMvBtSjJtmzU KRwnLgqkbdC42zUj0bFQitRI2klaDOhrbY/TJ9khKfo3cd3EbTEgNxFjUuePH79zePT8xU3J 0JxKVQjeD/CzMECUZyIv+FU/eD8eNdIAKU14TpjgtB/cUhW8OPr1l+dVT7H8jNyKmUYgg6se 6QdTrates6myKS2JeiYqymFuImRJNPwrr5q5JNcgu2TNKAzbzZIUPKjfl/u8LyaTIqMnIpuV lGsnRFJGNNivpkWlvLRqH2mVpArE2LfXTbIzcg4e4wDNYHgChpsIBUfgenbBcsRJCdPja4GG gmsQg/6gUhcZYXaNqsaSUjPi85eyuqjOpX31zfxcoiK3gp2IoFlP1Mvsv3xuB82N16/8kPRu JrI0TwgJuukHsHO35m/T/EZvNMrcj9ny12z69o612fT0jtVNr6C5orTqVUVWW1dkWw4tPIJJ PZMUYSvKrXHriZFwJrIPCnExnBJ+RQeqopk28XD+LhevR2Hx4yUrqlHBmJFmxkj2aHlJwQL5 Ko+C2v8zpX0kZrLoB5+idBCG3ei4MWyFw0YSdk4bg27SaXTC004SJike4uHf5m2c9GDHwUjC TqrCoxsnW4gqi0wKJSb6WSbKGpoe4QAmHNZgmhO2jCoY5J/WxKZzwtiqtKQ6m5rhBPx7B2Fx 7ywmmqveG4ztgELSSdtJt7sOiC5OkjCsNzpudcIwWttt2B+p9EsqSmQGEFIwwoaUzMFct9Qv sfY4G5oLaKjKbdw24GMPD39ezhnJ6FSwnEpkzbCrPb5V5XEC+F+Dhxdt0GFBOUXqI+wOYZMA NN0sF7sVduBfuidmcYrDMLaB68S4FW0cpCSM0/Yibt12C3ecjpVj4iRXPX1zLPJbi054gvPA rxDJqZAfA8RecVVvQ4C0/SdpdUAdkqszl2szmg2FhZARyoHABjMtJkW9HU6LmWJKX+hbRu14 znDtak4n78AMRgypU954fxHYgGHrUV5IbU89UqUeMkq416QEK3J/0pS8uhwy6cAcRzGOfQBW ljW9MjtcMQGG0Q5rvqsNXjEM459lg1cMw+Rn2eAVw7C1jw0HUut0mfEKOi3fwQQqiTwDJHbi FIQhWG69L3gOBNEPGvWEPYvWYrkF5JVA2WX6aMiK7APSAtG80Og1URoIRpujrIx+ZYxxzOsM c8bssAg/1qILmgmeI0bnlH2z9uix2sfTQj5UefxY5SMxk3r6QO3Jo7UXkzuVA7Pz/JxIcj/8 61xnqd1TumX53Vku2ZXl4oNmOZe6vyXL2YTylOae0txTmntKc09p7inNPTjNwdXed0AKzeCq /7jMpm8rEKWNqABNiRrOlBbluRRltdIa+MbrnLsH47DVTpL1PJdGUXeZ5zCOU7vgB6c5RHgG cvpBpmWd8x6f8Q7Na07XfbxWM9kOtN7N9WsUNhbodIXCHKCsroOCeWfvKtrqXS0R/R16V0gK /WehpxdTYoBv2op3NLOAlTKliYYVlSy4a8T8T3tbMjP9LATBiuJu2oVzYMjOAaHub7lo7dHg iuzB9m/7Q42TELcTd6YT3Amjzg9rbeFFb2sM1hyLG4TXG1rIoNE3ptax8VUmMxvoOnppG3fS dN3rOOx2PJNFuJU4qnuo14aDTPCdcfdy4LUkQOlccLpZtqvKUNjofgqzxltITFhug/epFQ5G GEetxskgBvQOwk5jcIyTBg5PovboxNxCAL11jlBAVZTPSqttOzdCvZ+acHyg0rTrIzPmAhKJ mOxRcBrw0wVHXl7dQZDgCdEFt9ZM4GbXD34veYPpelfIxgQldZddrUwMZEFYLVrW1GIBYdju y+d/fvvy+d8l9UGcdpHfwuUdzL+HX+bYLjQ8sCZor56CtYtv+xDlgQGT8/evGZGQKny3Nz50 zZCE7bi1QS9rNQOctG649aHk3vPymERfF4wr1wW3w5ezN3D+rIl1HWAvuwbxTur2vbQWFSeR Mf5r8hZSNm6WtZR22rKw21fKxt3Q18FhlFr+2lfMxvXOi4k77pq/r5jd17WDlDVwMyN5jtTs 0ta1B6xl7MN/XvTJ1o7qeuD4uNuOhulxA2h01EhOusCoo3arMWrFSTI8TgfD+NTUAxXUA5mk 9gPoq9x/Ot23HKjENZWVKOyH2PWKAHcBiEmCu75H5UqDpbXmqF8YYoMnk69J9XZuw1LaGnBo f6pMreGWLpdAMIoSJuyI155XxFHRmPtPq/kMjpsBw6TghTZpikIlZSp3DrckaZJCTsfu1lG+ E8Lyt0n1RpKJuBNtRrU6E3T/yfvoPwAAAP//AwBQSwMEFAAGAAgAAAAhAI+WBSbnAAAAzAIA ACwAAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0NC54bWwucmVsc7ySz0oD MRCH74LvEOZusrsVEWm2FxF66EXqAwyb2Wzo5g+ZKO3bGxChC1U8SI+ZzHy/j2HWm6OfxQdl djFoaGUDgsIQjQtWw9v+5e4RBBcMBucYSMOJGDb97c36lWYsdYgnl1hUSmANUynpSSkeJvLI MiYK9WeM2WOpz2xVwuGAllTXNA8qnzOgXzDF1mjIW7MCsT8l+gs7jqMb6DkO755CuRChnK/Z FYjZUtEgpfJkHH7VVzIFC+qyxv3VNLrfNNr/1ODZGdohF8oLmbP6oqmVNeIns+5qC2q/F6QW N9h/AgAA//8DAFBLAwQUAAYACAAAACEATY6UsD8FAADwDQAAIQAAAHBwdC9zbGlkZUxheW91 dHMvc2xpZGVMYXlvdXQ2LnhtbNRX247bNhB9L9B/INTHQpEoy5ZsxBvY8jpYIGkWsYM+cyV6 TUQiCZJ21gkK5Lfaz8mXdEhKsr2XZFGgBfpijURyOHPmzCH98tVdU6M9VZoJPg3wizhAlJei Yvx2GnxYL8M8QNoQXpFacDoNDlQHry5+/umlnOi6ekMOYmcQ+OB6QqbB1hg5iSJdbmlD9Ash KYexjVANMfCqbqNKkU/gu6mjJI5HUUMYD9r16jnrxWbDSroQ5a6h3HgnitbEQPx6y6TuvMnn eJOKanDjVp+H5EbUHjLGAdqBuYDALULBBaReruoKcdLA8JqZmiIACK12N8a9vOP1wU3Tcq0o tRbfv1ZyJa+VW/3b/lohVjnf3ksQtQPtNPfK986I7i2/7Uwyuduoxj4BFXQ3DaB4B/sb2W/0 zqDSfyyPX8vtu0fmltvLR2ZH3QbRyaZyIlnZRsfK+wmNu4RgzOwURXmfWTub2PVvRPlRIy6K LeG3dKYlLY1Fw2d7nHyOQf/xpmZyyeraerM2UhPa3FDYX11VSdBm/0abDoedYtPgS5LP4nic zMNiGBdhGmeX4WycZmEWX2ZpnOa4wMUfdjVOJ1ByCJLUC8k6euP0AaUaViqhxca8KEXTcrOj OLAJxy2b9qQ+YgoBdU8XYuSTsLFqo6gpt9bcQH7vARa/ph+ITrO3DPsOEdIsH6Xj8TkdxjhN 47gt82CYxXFyVmuoj9LmNRUNsgZACkE4SMkewvVTuykuHh9D1BNDS1+4h3TPO3b4pnH1duMd n7XsmAF8PyNE58zywZFwi8xBgivXcgHaEl3stBHNtRKNPCGTX+CMzscToA1y7IABXHA8HKXp OXB5koxHPXAYD3I34bRJvGM5MXdzUR0cO+EJyYPAQkhboT4HqL7iui1DgIx7SYdZAi/qdOTm bMTUhXAUAqUpwc80KI1yVeFitjNiw9rK+A3tQK3Nyhxq6ux9jdukK7p5DxHVxAo85eGHFQj8 52mQuNwrpoxrf1cNUbOq6zOtbm+KWnkqD5IBHniEz6ZFnX9n9rta+yQaR3Vpg9h3bUEmLjh1 P7I+HqQbU9SU8H6BuShqVn5Ea4EuK2bQW6INVchTy+1l9/X95ZxTXl0TRR5k3+/RctuVsiuh q+qPVA/H92XPNd2/JXtICfM7M9vVltgOsEfSIzo4AKbCyW1ghlSM+x7+n8qiKq0UIgArGYxz OGSgAUKHWy+NHq1naGPiOrxb3XU3TmM8Sn1zpziLk+w/U0Xc3wLWEM1c3CHsMOl1D1ky2hj9 11Nu/FDSbAH9YZCPcJa74/iY9SAeZ52kJXiYes37p1lbMbLg++CeFMNPioC2c7hOngqbl3+r ZcuntcwF7yixgQuYBe/LMJ4tMU6G4WI2APbO4iyczXEa4niRjJaL0RBnwN72sNCgVJTvGrfb A7GxMphbOD5SZa96ibW5gBNFbB5o0EOBtOSnvUTe3D6ij5AJ3DW5i2ZDSojo14aHtWmrQu4N UNJez/TJwEwxUreuVSstjhBW7L59/fOXb1//Oiof4PQ97etT/o7wPyMv27b9Dk+rqHt0V+Ku z53VStF8Ph4lRT4PoYLLMF2MoZjL0TBcDgdpWszzWTG4tFIkQYpKRd29/arqbvzPVSIpPlEl BXP/H87FKMFj6IgU56NWlL0qHaO1Or2ymMKzVm+JfLd3JWjc6VO4T9LKnJ96nAJgsAYGnMXb zCXxWrDm3d+BagfSxjicoowzYzuEgojb2wOncIuwfKzo2t98mvdCOOpYlbGeLOLetbXa7Szo 3T+1i78BAAD//wMAUEsDBBQABgAIAAAAIQAmcLfNxgcAANYmAAAhAAAAcHB0L3NsaWRlTGF5 b3V0cy9zbGlkZUxheW91dDQueG1s7Frdjtu2Er4v0HcQ1MsDx6L+ZcRb2N51GiBNF1kXveZK 1FqIJKoU7eymKNDX6nmcPsmZoUR5ZXsdZ71JToG9sWmTmhkOv5lvSOrlj7dFbqyZqDNejk3y wjINVsY8ycqbsfnrYj4ITaOWtExozks2Nu9Ybf549v13L6tRnSdv6B1fSQNklPWIjs2llNVo OKzjJSto/YJXrIS+lIuCSvgpboaJoB9AdpEPbcvyhwXNSrN9XhzzPE/TLGbnPF4VrJSNEMFy KsH+eplVtZZWHSOtEqwGMerpvkmqR6xhxsQ0VtA8B8PRQ+YZTD2+yhOjpAV0Lz5wY8ZLCWKM n7jIPkKb5mrU9U3zeSnOXtJRzfMsmWd5rn6gTWyWC2NN87F5fUPM4dnL4dYolqYslm9qiX1a kmqg4LpaCMawVa5fieqqwl6w7e36UhhZoixvbETZqqMdpn6Wa9UYbj1+o5t0dJuKAr/B58bt 2ARo3OHnUJl2K424+TPe/Bsvf9kzNl5e7Bk91AqG95RWoyqLW+uyeGdCvp4RdMqVYAbxurm1 4ylKeMPj97VR8tmSljdsUlfgRvRHM9/N4L4Xuj+v86zSa4BtQ4xYcc3AAvE6sc12/rAu2hMr kY3NP+xwYlmRPR3MPGs2cK3gYjCJ3GAQWBeBa7khmZHZn/g0cUcAKTCS5udVpsOHuDuQLbJY 8Jqn8kXMixb7OoQArcRq0apApL0KBulvZeKwmYSCnRRMxktspjC/d+CWFna6A9HVzR4xdgAK bhD6bhT1ARER17WsdqEdL7Asu7fasD6ilq8YLwxsgEvBCOVSum6Rvhmi7GlsGHbQOIiQcAch wVdHiPOMEDPwIZkiDBAnoWf7gfLtBieEuE6HE9tx/LCfFU7HSV01y7cnMdoaJYtM5oCRDiI6 9dWVBgikxh4utDSEhULj0pB3FYiSKMo0lrSerWrJi0vBi+oeppoHVEPLeMB3Tki064jl+a7b 91xo25HfRRghTqgG3M+njeBqJG+nPLlTIIVvmD0wPZi05OKjaeSvy7qNV9OQ6ofrBTb8EPd7 rns9Mp9xhSSDljHIGZuxFGpZSj5ZSZ5m7dI0CrEjr+WVvMuZaq9z0k46Yek7sCinWGmwcvDr FVQaHwELau5JJqRiil3qFDfXHXE6tkOcPdw51PJVs9OK7XvWKMRXaMRaRwcdKePEtmWdPUZd yFnOaNk9IM9meRa/NxbcuEgyafxMa8mE0UBL6UK9TZgp4axMLqmgO7PvdLTgVkupl1Ct6ifT n7uT/pwvmf4MweVvmVxeLSmGABZHe/IhGBVDDSlhRCWysonif2l6FDGmRENizorCCCJibA7a 1NamyLZY+3SOtFWI66e7xOhaxEeXYeYkgWUrAvs6edHT8NEV7WVOY7bkeQKAVjz++CyJsb2k eWqCKpzm49Kio3wWOMSztyrR0HZ8z24dR0IYEfQrj6+TF5tUKIqnSYZEJfr9yedJM6Nq2ges +aI2aMXQdL6VDVoxNN1vZYNWDE3vGBueSG2j6yFyLKh4A0gMHIgpU1OlkZUJJAhMX03HAe58 kDElN9g9xpQYyjXqr3uM2XDhYYvIqRZdsZiXiZGzNcs/W7t9qvbFMhOPVe6cqnzOV0IuH6nd PVl7lu5Vfmqd9DDN2V35v4/mNgXTU9BcQ0GfSXPEjRTN2ZFl266/y3NOELU8F0Su6yqTn3nu meeeee6Z55557pnn2u1cdwGwAMRN+a1BlKyOugwUpvdi/a3+J0kK9+Pt6Z5PgjDsk5RjRUF3 uEc8tznDeuwmFpkGQ7ox7kFy+yAo0HPJS7ZNVHWFNDV/mKaU8Wr50zxRzvvDsyZzQmxvcD5x ZgN3YgWDyZS4A2Kd2/783PdIMPvTbA//akg6rFwVStsuGoDhQnTHeybwDsnGdskvBefpESn2 qLsivAIrlTUp1DJj8z9FOchluyp0q4PR9mamvtcxERnNW9GiPSlSgECw/vPX3z/889d/N8gF Px3CbjflAzn8iHnhKUyn4ZFR4OxEQf8k4/FR4AZhFOCZW3fIvXUmYTteiMcQ3yIO6t9XVJwS Cegamt8AKMXBVLez0qfDeYNAefbq4u108vYcL1lTDDIJKDUoUBiETyUyJqm4OzKh/h+BEhNA B8re/kOV+6deRuC6NvNFFEDRoU/dnKe+oXAt3/G2jjB7NxQA+8jaufF9ELynXCu0vH2vamtW +Hr1FkhBmdiWmWrPgWm4kbq7PWhFOa6Nxn9KXidlq8Bvpfihp2B3rJStEl2XI5YdKlI9VsxW la3FOEGz2zpWzOGq+UmuTqBApkli1KtrdYv2teqjYIcZ+sG3hxn674IcXS35VhCRliccl0Tq tYVNwAQkdH2/jRef+E2d9m8olx7mBEK+ICn88Gp6SfzPSPtb1nzJvK++9Ks5+g5Jtdprruk0 8u1ZOB1AOTkfuOcRVJZz3xvMPcd1Z9NwMnMu8JqrIu4oFky9nfQ60e81HXvLVfEPTFQ8U29J 9S+6HB9AZoeYwhuMNDdeG2uRXa6wwIPvXPxMq1/WysOF2sDO1F8VXqE1QzdDwBlZAR2qVbYz r2gTeItSv5aUrCDDY/5JszKTiD9WA48DskvYHwksjhO2aK7Vi3ecqzoWb7BQEnq8EY2tVh06 Xb+PdvY/AAAA//8DAFBLAwQUAAYACAAAACEAGwpABKkHAABHKQAAIQAAAHBwdC9zbGlkZUxh eW91dHMvc2xpZGVMYXlvdXQ1LnhtbOxa3W7rNhK+X2DfQdBeLnws6l9Bk8J24uIAp21wkmKv GYmOhCOJWpL2SVoU6GvtPk6fZGdISbbj2HHspO0CRoCIFqlvhsPhNxyNvvn2oSqtBROy4PW5 TT44tsXqlGdFfX9u/3Q7HcS2JRWtM1rymp3bj0za3178/W/fNGeyzD7RRz5XFmDU8oye27lS zdlwKNOcVVR+4A2roW/GRUUV/BT3w0zQr4BdlUPXccJhRYvabp8X+zzPZ7MiZZc8nVesVgZE sJIq0F/mRSM7tGYftEYwCTD66XWVdI9YwIyJfQGTTW/KzKppBTcmvGqoKCSvdY9sbgVj2KoX 34nmprkW+oEfFtfCKjIEaB+0h21HO0z/rBe6MXzy+H3XpGcPM1HhFaZuPZzbsEKP+H+I99iD slJzM13eTfMfnxmb5lfPjB52AoYrQpuzpkhb7Yp0Y0JeNyPoVHPBLOL2c2vHU0T4xNMv0qr5 JKf1PRvJhqUK7WHmuxy8boX+5l1ZNNOiLBEN25Y4Y9UdAw3Ex8y12/l/kqqzxFwU5/Yvbjxy nMQdDyaBMxn4TnQ1GCV+NIicq8h3/JhMyORXfJr4Z3PJQElaXjZF58XE3/CcqkgFl3ymPqS8 al2w82RwGuK0TrOg5dKqoFB31SoOzSRQV6kEU2mOzRnM7zOYxTzTdwxXZ48+tsMV/CgO/SRZ d4iE+L7jtAvtBZHj6CXqVxvWR0j1HeOVhQ0wKSihTUoXoK4Z2g3R+hgdhr1ryMYs3KbD9+5x i9pclzRlOS8zJqylm3TOLZvOScD513yjw0XX0B6ZW+qxAdQ7nj3aIOhhOdyM0Y3usS0m82KC pkC7BcT3Ao2wNJtPnMQPiTGbHyWxu2623g7NmXoYgyLaN+EKU6d1mnMgsTttxhpoZjRXfFa0 xjSjsKuU6kY9lky3FyUBQKui4pNe0KLOgJGwqaHnPwDtahUzNvsMA0uKzMzqwU83wMw/gw1i XOY7zTNfmEAWd/GOrNSkZLTuoCQvi6zbTlLc301KYTzWcz3iGVM+GYa8Wmuzz2ARz+2RKGgJ 5EhrLuGn4zpjJ3R8uHZ/PvQW4MJTWhUluh7cSHMqJNNzMsamK5D/rOoBoy1DyTeWNezMpput rVuzu0uze76boMlesr02d9Cb2whooVpUb4kaxoFemr1QvWADFaFaVH+JShw3jvaG1Z6wDotY LWywAutFJDwGFrFa2HAFNiK+NtihsIjVwkZLWNcJgMqPgEWsFjZegQVM7xhYxGphkxXYyPf0 4ENhEcu0V5hDRxIUAgP6raWliw2aWKECPUxdTMoi/WIpbrGsUNb3VCqgZ4U0KFGARGkmaBnJ jea+jvM0De4OAn4XBCa8VjDrtTjgHRcH0E45LWdtFDAUfWAUSBIfnHRHFPAixw3cbjVeDgNw mIYlhkjws22VH2vZxmLbUvqHH0Qu/BCrPXdrPaqccL2irw8jO+OE3t5ZIZQ++r1BfHiJXbdp 8646POHiP0WHJ8z9p+jwhOZf1OGNxBpZ26iqCwpeDGAdcfW0OGg73p3JdmtEjtXohqW8zqyS LVj5aunusdJv80IcKtw7VviUz4XKD5TuHy29mD0rHJi9zq6poNvdv014Xhvlgq2pjv92qQ6y 97/nVIBjtxFPx89XRTw/CGNt6W2JjwNhMAr+wonPk1xnN1+5V/j3+pB1SghOCcEpIXiXhCDc lRAExycE6wyp6fdghnw2KVhlyFNScEoKTknBKSk4JQWnpGCz4Of2WUGhSmZpjY9NBRRC2VZO 5WQuFa+uBa+alWraK19+mdIRcYLQ16FyGefg5J/oqKDjHCFebGLpHxvm+qQiVaKNeW8T8Vw9 97dmOCP18APZ86y/Rma33LpaITPjWlrWm7r1zsJv/1K3L/wu3+S+Q+HXElz9q1D5TU5xC5ik b6MSDPyUSkUVjGhEUZsq5v9pYVikWAy2wFiul8QJ7AikPeMIbXHYWGuP6rB5v9093W1v4jsk xEIZ5vkEjrHRH1YXJmtvS8b8wSLrb0ks9MaurLvuGy9yGi6gKYfHIYnieH3WnpPoHBln7ZLA N6R36KyRjdD4RrmtbPhVUCD3GnK6pwd42SCZTbeTmVZeu8SszLTxfgmc0ZQQNxhcjjzw3pET DUZj4g+Ic+mG08swIBF4bxstJFAVq+eVlrYZJYEH9ZuI1XpxzSGk8NkeR090ftZz5N39XqVj rPOW6vUFYAMtWmrRDoFs9/tv//nH77/9d0l9YKdd5NdPeQfz7zEv3La9hANPB/HGLtBbcNcu sICOxCXwCq5WH/Bf3BOhEyUmofVjzyeJzrKXm8INPRcpXW+KkIRk/YOgv/Cm2HL4w4SWvCah 3W/FW+dTF+GekfYZRd7T2/Sl+witiyq61Qa+8TgJ3Uk8HgBfTAf+ZQLUMQ2DwTTwfH8yjkcT 7woDXwOBLxVMfw73Mes+pNs37jX8KxMNL/Rneeuhz0uSiLhhHHSlWhMDl9riqeAGdzBcS/E9 bX5caAtX+rAz0bcaDKpm6HIIGKOooEO36nbmDTV77rbuPsDL5hBIMY+YFXWh0PUYHBnwsFpD YiCQ/TJ2aw7a1WfONVFhTEMktLiBxlYrDo3efQB58T8AAAD//wMAUEsDBAoAAAAAAAAAIQAN uMn63h0DAN4dAwAWAAAAcHB0L21lZGlhL2ltYWdlMTUudGlmZk1NACoAAxU4//////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7////+////8/f6//b6/f/5/f///P// //v////7////+/////z//////P////z////8/////P////z////8/////P////z////9//// /P////z////7////+v///vn///75///9+P7///3////+/////f7///3+///8/f//+/z///v8 //76+////v////7////+/////v////7////+/////v////7////+/P///vz////9/////f// //3////9/////f////3///78///+/P///vz///78///+/P///vz///78//7+/P/+/////P// //z////8/////P////z////8/////P////z////8/////P////z////8/////P////z////8 /////P////z////8/////P////z////8/////P////z////8/////P////z////8/////P// //z////8/////P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////7+/v/+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7////+////9vr9//j8///7/////P////v////7////+/////v+/////v////3////9//// /f////3////9/////f////3///75///8+f///vn///z5///++f///Pn///75///8+v////v/ //78/f///v////7////+/////v////7////+////+/z//fv8///7/P/9+/z///z9//78/f// /P3//vz9///+/P///vz///78/////f////3////9/////f////3///78///+/P///vz///78 ///+/P///vz///78//7+/P/+/////P////z////8/////P////z////8/////P////z////8 /////P////z////8/////P////z////8/////P////z////8/////P////z////8/////P// //z////8/////P////z////8/////P////z////8/////v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////v7+//7+/v/+/v7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7////+////+f3///v////8/////P////v////7 ////+P3///j7/////v////7////9/////v////3////+/////f////7///r3/v/6+f///Pn/ //z7/////P////7////9/////v//+ff6//n5+f/7+fr//f39///+//////////7///////// /v/////////+//////////3+//39/f/+/P3//Pz8//7+/v/+/v7//v7+//7+/v////////// /////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/////v////7////+ /////v////7////+/////v////7////+/////v////7////+/////v////7////+/////v// //7////+/////v////7////+/////v////7////+/////v////7////+/////v////7////+ /////v////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////+ /v7//v7+//7+/v/+/v7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7////+ /////P////z////8/////P////v////3/P//8/j8//H0+f/x8vf/8fL3//Lx9//x8vf/8vH3 //Hy9//y8ff/8fL3//f2/P/3+P3/+fj+//v8///+/f///v/////+///+/////v7///z+/f/9 /f3/+/38//v7+//5+/r/+vr6//j6+f///////v/////////+/////v7+//z+/f/8/Pz//Pz8 //39/f/9/f3//v7+//7+/v/+/v7//////////////////v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//f/+//7+/v/9//7//v7+//3//v/+/v7//f/+///////+//////// //7//////////v/////////+//////////7//////////v/////////+//////////7///// /////v/////////+//////////7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7+/v/+/v7//v7+//39/f/9/f3//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7////+/////P////z////8/////P////f8///x9vr/6/D0 /+jt8f/Y2+D/2Nvg/9rb4P/Y2+D/2tvg/9jb4P/a2+D/2Nvg/+rr8P/p7PH/7e7z/+3w9f/x 8vf/8vX6//b3/P/0+Pv//v////z////+/////P////3//v/7//7//P79//r+/f/8/v3/+v79 //v9/P/5/fz/+vz7//j8+//5+/r/+fv6//z9///8/f///P3///3+///9/v///f7///7////+ /////f7///3+///9/v///f7///3+///9/v///f7///7+///+/v7//v7+///9/v/+/v7///3+ //7+/v///f7//v7+///+//////////7//////////v/////////+//////////7///////// /v/////////+//////////7//////////v/////////+//////////7//////////v////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////v7+//7+/v/+/v7//f39 //39/f/9/f3//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////7////+/////P// //z////8////+Pz///H2+v/p7vL/4ufr/97j5//W29//1tvf/9fa3//W29//19rf/9bb3//X 2t//1tvf/9jb4P/Y3eH/2t3i/9rf4//d4OX/3eLm/9/i5//f5Of/6Ozt/+ju7P/r7+7/7PLw //D08//x9/X/9Pj3//T6+P/5/fz/+f/9//r+/f/6//7//P////v////8/////P////n9/v/7 /P7//P3///z9///9/v///f7///3+///9/v///f7///3+///9/v///f7///3+///9/v///f7/ //3+///9/f///vz9//78/f/+/P3//vz9//78/f/+/P3//vz9///+/////v////7////+//// /v////7////+/////v////7////+/////v////7////+/////v////7////+/////v////7/ ///+/////v////7////+/////v////7///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7+/v/+/v7//v7+//7+/v/9/f3//f39//z8/P/8/Pz//f39//39/f/9/f3//f39//39/f/9 /f3//f39//39/f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////7////+/////P////z////5/f//9Pj7/+vw9P/i5+v/2t/j/9bb3//d 4ub/2+Pm/93i5v/b4+b/3eLm/9vj5v/d4ub/2+Pm/9PY3P/R2dz/09jc/9HZ3P/T2Nz/0dnc /9PY3P/R2dv/09nZ/9Lb2v/W3Nz/1t/e/9rg4P/b5OP/3+Xl/93m5f/r8fH/6vPy/+709P/v +Pf/9Pr6//X+/f/5////+v////n9///5/f//+f3///r+///6/v//+/////v////7////+/// //v////7////+/////v////7////+/////3+///9/f///vz///78///+/P///vz///78///+ /P///vz////+/////v////7////+/////v////7////+/////v////7////+/////v////7/ ///+/////v////7////+/////v////7////+/////v////7////+/////v////7///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7+/v/+/v7//v7+//39/f/9/f3//Pz8//z8/P/8 /Pz//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////7////+/////P////v////3 +/7/8fX4/+fs8P/e4+f/1dre/9HW2v/V3eD/1d3g/9Xd4P/V3eD/1d3g/9Xd4P/V3eD/1d3g /9Xd4P/V3eD/1Nzf/9Pb3v/S2t3/0trd/9HZ3P/R2dz/1Nze/9Td3P/T3Nv/0tva/9Ha2f/R 2tn/0NnY/9DZ2P/O19b/0NnY/9Pc2//X4N//2+Tj/9/o5//i6+r/5O3s//j9///5/f//+f3/ //r+///6/v//+v7///v////7////+/////v////7////+/////v////7////+/////3+///9 /P///vz///78///+/P///vz///78///+/P///vz////+/////v////7////+/////v////7/ ///+/////v////7////+/////v////7////+/////v////7////+/////v////7////+//// /v////7////+/////v////7///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7+/v/+ /v7//f39//39/f/9/f3//Pz8//z8/P/8/Pz//f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f////////////////////////////////////////////////////////////////// //////////7////+////+f3///z////0+Pv/4+fq/9vg5P/g5en/4ufr/93i5v/S2t3/0tze /9Pd3//Y4uT/3ujq/87Y2v/S3N7/2uTm/9rk5v/O2Nr/1+Hj/8vV1//W4OL/4evt/9Pd3//Y 4uT/ydPU/9Te3//N19j/w83O/9vl5v/V3+D/zdfY/9nj5P/O2Nn/ztjZ/87Y2f/O2Nn/zdfY /83X2P/M1tf/zdXX/8/U2P/Q1dn/0tfb/9TZ3f/X3OD/2d7i/9vg5P/c4eX/7/T4//D1+f/y 9/v/9fr+//n+///7////+/////z//////v////3///r4/f/49vv/+/n+//78///9+///+vj9 ///+/////v////7////+/////v////7////+/////v////7////+/////f///fv///v5/v/5 9/z/9/X6//b0+f/+/P///vz///78///9+////fv///37///8+v///Pr9//39/f/+/v7///// /////////////////////////////////////////////////////////////v7+//39/f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////f39 //39/f/9/f3//f39//39/f/9/f3//f39//39/f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////39/f/9/f3//f39 //39/f/9/f3//f39//39/f/9/f3///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////f39 //39/f/9/f3//f39//39/f/9/f3//f39//39/f////////////////////////////////// //////////////////////////////////////////7////+////+v7///v////y9vn/4+fq /9vg5P/f5Oj/4ebq/9zh5f/O1tn/z9nb/+Ls7v8JExX/vMbI/+fx8/+YoqT/sry+/87Y2v/R 293/zdfZ/9zm6P/N19n/yNLU/9Pd3//V3+H/2+Xm/8bQ0f/j7e7/zdfY/8PNzv/W4OH/x9HS /83X2P/O2Nn/ztjZ/87Y2f/O2Nn/zdfY/83X2P/M1tf/zdXX/8rS1f/N0tb/z9TY/9HW2v/T 2Nz/1dre/9fc4P/Y3eH/0NXZ/9LX2//W29//2+Dk/+Dl6f/l6u7/6O3x/+vu8//7+v//+Pf8 //n3/P/8+/////7////+/////v////7////9///+/f///vz///38///9+///+/r///z6///7 +v///fv///38/////f////7////+/////v////7////+///8+v//+/r///37///9/P////3/ ///+/////v////////v7/f/7+/v/+/v7//z8/P/8/Pz//f39//39/f/9/f3///////////// /////////////////////v7+//39/f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f// //////////////////////////////////////////////////////////////////////// //7////+////+/////j8///v8/b/4ubp/9zh5f/f5Oj/3+To/9vg5P/T297/6PDz/9Tc3/93 f4L/dn6B/4OLjv8jKy7/ytLV/+Do6//Z4eT/3OTn/8zU1//d5ej/1t7h/7jAw//Hz9L/v8fJ /9DY2v/P19n/3ubo/+Xt7//X3+H/ytLU/9jg4v/P19n/z9fZ/8/X2f/P19n/ztbY/87W2P/N 1df/zdXX/8jQ0//J0Nb/ytHX/8zT2f/O1dv/z9bc/9HY3v/R2N7/0tnf/9LZ3//R2N7/0Nfd /8/W3P/O1dv/zdTa/8/U2P/S09f/z9DU/9bV2v/h4ub/6Ofs/+Xm6v/o5+z/7e7y//Tz+P/z 9Pj/9vX6//f4/P/7+v///P3///79///+////+vn+//n6/v/7+v//+/z///38///9/v////7/ //7//////v///v/////+///+//////7///7//////v////////////////////////////// /////////////////////////////////////////////////////v7+//7+/v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////f39//39/f/9 /f3//f39//39/f/9/f3//f39//39/f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////////////////////// //////////////////////////////////7////+/////P////X5/P/q7vH/4eXo/93i5v/e 4+f/3eLm/9rf4//o8PP/zdXY/+72+f+stLf/AAIF/yoyNf87Q0b/Nz9C/1piZf/L09b/rLS3 /4SMj/+lrbD/rbW4/xoiJf9+hon/iJCS/+vz9f/U3N7/3ubo/7zExv+xubv/3eXn/8zU1v/P 19n/z9fZ/8/X2f/P19n/ztbY/87W2P/N1df/zdXY/8vS2P/L0tj/zNPZ/83U2v/O1dv/0Nfd /9DX3f/R2N7/0Nfd/9DX3f/Q193/0Nfd/9HY3v/R2N7/0dje/9HY3v/R1Nn/ztLV/8zQ0//R 1dj/19ve/9fb3v/S1tn/zdHU/9jc3//a3uH/3uLl/+Pn6v/p7fD/7vL1//L2+f/1+fz/+v7/ //r+///7////+/////z////8/////P////z////8////+/////r+///4/P//9vr9//X5/P/z 9/r/9fb6/////////////////////////////////////////////v7+//7+/v/+/v7//v7+ ///////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////// //////////////////////////////////////////////////////////////////7////+ /////P////L2+f/l6ez/4OTn/97j5//d4ub/2t/j/9jd4f/R1tr/3+To/9Xa3v/d4ub/AAEF /3p/g/8GCw//bXJ2/yEmKv94fYH/SU5S/290eP8ABQn/fIGF/0dMUP9kaW3/mJ2h/4yRlf+t srb/0NXZ/3J3e/+Gi4//xcrO/+Hm6v/R1tr/0dba/9HW2v/R1tr/0NXZ/9DV2f/P1Nj/zdXY /9DX3f/P2N//z9jf/9DZ4P/Q2eD/0drh/9Ha4f/R2uH/zNXc/8zV3P/M1dz/zNXc/8vU2//L 1Nv/y9Tb/8zT2f/S2t3/1tvf/9LX2//IzdH/xcrO/8vQ1P/M0dX/yc7S/8fM0P/IzdH/y9DU /87T1//R1tr/1dre/9fc4P/Y3eH/3eLm/9/k6P/i5+v/5uvv/+vw9P/v9Pj/8vf7//T5/f/1 +v7/9vv///f8///4/f//+f7///r////6/////P////z9///9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//Pz8//z8/P/8/Pz//f39//7+/v/////////////////+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7////+/////P///+/z9v/h5ej/3+Pm/+Dl6f/c4eX/2N3h /9bb3//R1tr/2d7i/9HW2v+1ur7/GB0h/6Clqf9JTlL/k5ic/2Vqbv82Oz//ys/T/8PIzP8A Agb/gIWJ/2Blaf8mKy//jZKW/xofI/81Oj7/Y2hs/0hNUf+JjpL/aW5y/7S5vf/R1tr/0dba /9HW2v/R1tr/0NXZ/9DV2f/P1Nj/z9Ta/9Ha4f/R2uH/0drh/9Ha4f/R2uH/0drh/9Ha4f/R 2uH/1N3k/9Pc4//R2uH/ztfe/8vU2//I0dj/xs/W/8XO1f/J0Nb/0dnc/9be4f/S2t3/zNTX /8rS1f/N1dj/0Njb/9DY2//P19r/ztbZ/8zU1//L09b/ydHU/8jQ0//Hz9L/xs7R/8fP0v/I 0NP/ytLV/8zU1//O1tn/z9fa/9DY2//d5ej/3+fq/+Pr7v/o8PP/7vb5//T8///4////+/// //n6/P/7+/v//Pz8//39/f//////////////////////+fn5//r6+v/7+/v//Pz8//39/f// ///////////////9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////7////+/////P// /+3x9P/d4eT/3uLl/+Dl6f/c4eX/1tvf/9Xa3v/e4eb/3uHm/8bJzv/Iy9D/yczR/97h5v+G iY7/Wl1i/7i7wP+Mj5T/ODtA/yIlKv9DRkv/QURJ/5CTmP9CRUr/HyIn/5WYnf+ChYr/a25z /x8iJ/9BREn/eHuA/9fa3//S1dr/0tXa/9LV2v/S1dr/0dTZ/9HU2f/Q09j/z9Ta/9DZ4P/O 2OH/ztjh/83X4P/N1+D/zNbf/8zW3//M1t//ytTd/8vV3v/M1t//ztjh/9Da4//T3eb/1N7n /9Xg5v/Y4eb/wszO/7nDxf/Fz9H/y9XX/8XP0f/H0dP/093f/9Hb3f/Q2tz/z9nb/83X2f/M 1tj/y9XX/8nT1f/J09X/0Nrc/8/Z2//O2Nr/zNbY/8rU1v/I0tT/xtDS/8XP0f++yMr/wMrM /8TO0P/I0tT/zdfZ/9Hb3f/V3+H/19/h/+nq7P/r6+v/7e3t//Dw8P/09PT/9/f3//n5+f/7 +/v/9/f3//j4+P/5+fn/+/v7//39/f/////////////////9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//f39//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////v////7////8/////P///+vv8v/b3+L/3eLl/+Hm6v/Z4eT/09ve/9Pb3v/R 2t//1N3i/+Xs8v/b4OT/z9LX/9zg4//j5uv/y87T/9DV2//b4ur/s7rC/5+mrv+utb3/aXB4 /32Eiv+CiY//HCEn/9bb4f84PUP/goeN/zo/Rf8OExf/x8zQ/9DV2f/R1tr/0dba/9LV2v/S 1tn/0dXY/9PU2P/S09f/0NPY/87V3f/M1dz/zdTc/8vU3f/K09z/ydLb/8nS2//I0dr/zNXe /8zV3v/M1dz/zNXc/8zV3P/M1dr/zNXa/8zV2v/P2dv/h5GT/1dhY/9ncXP/gIqM/4ONj/+N l5n/pK6w/7vFx/+8xsj/vsjK/8HLzf/EztD/xtDS/8jS1P/J09X/ydHU/8rS1P/K0tT/ydPU /8vT1f/K1NX/ytTW/8vV1//J09X/ydPV/8nT1f/J09X/yNLU/8jS1P/I0tT/yNDS/8rOz//O 0M//0dPS/9XX1v/a3Nv/3t/h/+Hi5P/j5Ob/9fb4//b3+f/4+fv/+fr8//z9///+/////v// //7////6/v//+v7///r+///6/v///P3///z9///8/f///P3///7////+/////v////7////+ /////v////7////+//////////////////////////////////////////////////////// //////////////////////////////////7////+/////v////7////+/////v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////+/////v/////////////+/////v////7////8/////P///+br7v/e 4+b/3eXn/9be4f/U3uD/2ePl/9Ph5P/O4ef/z+Lp/8TT2P/R293/3uPm/97i4//d4eT/yM3T /8rT3P/I1OD/xtbl/8nZ6P/L2+j/z93o/9De5//S3+f/ydLb/9HY4v+osbj/kJmg/5umrP+G kZX/iZSY/8vU2f/S3N7/09ve/9TZ3P/T19j/1NXX/9PT1f/T0dT/0dHT/8/Q1f/P0tn/1NTc /9TX4P/V2OH/1Nfg/9HV4P/P097/0dXe/9HV3v/P1tz/0Njb/9DY2v/Q2dj/0drZ/9Da2f/B y8z/ucPE/9Hb3P/O2Nn/093f/7nDxf+krrD/naep/4yWmP90foD/cHl+/4uUmf9/iI3/iZKX /5ylqv+utrn/uL3A/8LIyP/Fy8v/w8zL/8/V1f/V3t3/z9fZ/8TMzv/Aysv/vcfI/8LNz//S 3d//x9LW/8zX2//Ez9P/yNPV/8nR0//J0tH/ydLR/8nS0f/J0tH/ydHT/8nR0//J0dP/ydHU /8rS1f/M09n/ztXb/9HY4P/T2uL/1dzk/9bd4//j7e//5O7v/+jy8//s9vf/8vr8//b+///5 ////+f////b+///3////+f7///n+///6////+v////z////8/////v///////////////v7/ //39///8/P7/+/v9//r6/P/+/v///v7///7+///+/v///v7///7+///9/f///P3///z////6 /v3/+Pz7//r+/f/8/////P////7////3+fj//v////7///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////+/////v/////////////+ /////v////z////8////+v///+Tp7P/c5Ob/3ubo/9Xf4f/U3uD/2OPl/9Lh5P/G3eP/yN/l /8ja3v/c6Oj/1tza/9TW1f/Y2dv/4+br/9Ha4//M2uX/yNro/8fa6P/H2ef/x9ji/8jX3v/J 1tz/yNLb/8/Z4v/N1+D/y9jg/9Dd4//D0tf/vczP/83b3v/H0tb/x9LU/8nR0//L0NP/zNDR /87P0f/Pz9H/z8/R/9va3//X2N3/09TZ/8/P1//Pz9f/0NPc/9TW4v/W2uX/0tbf/9LW3//S 193/z9fa/8/Y1//P2NX/ztfU/83Y1P++yMf/lqCh/42XmP+Rm5z/prCy/7K8vv/By83/3ujq /9Lc3v/N19n/vsjK/7fBw/++x8z/usTG/56oqv+YoqT/l52d/4GHh/9wdnb/dX59/4uRkf+f qKf/tr7A/8nT1P/G0NH/0Nrb/8zX2f/O2dv/wczQ/8bR1f+8ys3/x9LU/8jS0//I0tH/yNLR /8jS0f/I0tP/yNLT/8jS1P/I0tT/xs/U/8fQ1f/J0tn/y9Td/83W3//P2OH/0dnk/9Hb5P/L 1tr/ytjZ/8/a3P/S3d//1eDi/9nk5v/c5uj/3efp/+33+f/u+Pr/8fn8//T8///2/v//+f// //v////8/////v///////////////f3///v7/f/6+vz/+Pj6//j4+v/y8vT/8/P1//X19//3 9/n/+vr8//z8/v/+/v///v////n9/P/5//3/9/37//X7+f/7//7//P////z////2+vn//v// //7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////+/////v/////////////+/////v////z////8////9vv+/+Ln6v/b4+X/3ubo /9bg4v/V3+H/1+Lk/9Hg4//O4+j/oba7/3qIif+AiYj/l5mW/7m4tP+6ubf/wMDC/87T1//L 1Nv/ydbe/8rZ4P/L2uH/zdve/9Dc3P/S3N3/0t3h/8fS2P/P2uD/0d7k/8fW2//R4+f/2Oru /8XX2//M2+D/zNve/83Y3P/N19n/zNTX/8zR1f/Mz9T/zM/U/9XZ3P/U2Nv/1Njb/9HW2v/P 1Nr/zNDZ/8rO2f/Gzdf/0dji/9DZ4P/P2N//ztfc/83X2f/L1db/ytTV/8rU0//N19j/ydHT /87W2P/EzM7/q7O1/6Wtr/+ps7T/ytTV/3aAgf9ocnP/g42O/5Kcnf+KlZf/kJyc/5mlpf+3 wcL/2uTl/+Lq7P/h6ev/zdfY/7W9v/+gqqv/iJKU/3F7ff97hYf/rrm7/77Jy//J1Nb/zdjc /9Pe4v/G0dX/ztnb/8jS0//I0tH/yNLT/8jS0//I0tP/yNLT/8jS1P/I0tT/xM3S/8XO0//G z9b/yNHY/8rT3P/M1d7/zdbf/83Y3v/Ez9P/w9HS/8bR0//H0tT/ydTW/8rV1//M1tj/zdfZ /8fR0//L1df/0dnc/9nh5P/h6ez/6PDz//D1+f/0+Pv/8vP3//P09v/29/n/+vv9//7////+ /////v////7////+/////v////7////+/////v////7////+/////f7///z////3/fv/9Pr4 //f9+//8/////P////z////8/////v////7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////+/////v/////////////+/////v// //z////8////8vf6/9/k5//a4uT/3ubo/9fh4//V3+H/1+Lk/9Hf4v/J3OD/sMLG/5qmpv97 gHz/gH12/46Hf/+MhX//hYB8/4iIhv+Kjo//j5eZ/5mjpP+lr67/sbq1/7zDu//Ax8D/zNbX /8DLz//N2Nz/0d/i/8LR1P/G2Nr/yd3e/7LGx//E1tj/xNbY/8fW2f/J19r/zNfb/87X3P/Q 193/0Njb/8TNzP/I0dD/zdbV/9La3P/V3eD/09zh/9Lb4v/Q2eL/0Nni/87Y4f/N2N7/ytfd /8jW2f/H1db/xdPU/8fT0//L1df/1d3f/9jg4//T293/xMzO/9Hb3P+4wsP/sb29/3N9fv+T n5//0d3d/52pqf8yPj7/eIaG/7PCv/+isa7/sr2//7C7vf+xvMD/sLu//7bBxf/N2Nr/3ejs /9jj5f+VoKL/1eDi/8/a3P/Czc//wczQ/8fS1v/BzND/0dze/8jS0//I0tH/yNLT/8jS0//I 0tP/yNLT/8jS1P/I0tT/w8zR/8TN0v/FztX/xs/W/8fQ2f/I0dr/ydLb/8jT2f/J1Nj/x9XW /8nU1v/J1Nb/ydTW/8nU1v/K1Nb/ytTW/8XP0f/Fz9H/xs7R/8bO0f/Hz9L/x8/S/8nO0v/J ztL/0NTX/9PX2P/X29z/3ODh/+Hl5v/n6+z/6+/w/+3x8v/7////+/////v////7////+/// //v////7////+/////v////2/Pr/9fv5//v////8////+Pz7//f7+v/8/////v////7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///+/////v/////////////+/////v////z////8////7vP2/9zh5P/Z4eP/3+fp/9ji5P/W 4OL/1+Lk/9De3//H1tn/rbu8/6CmpP92dm7/enJn/25iVv+BdWf/gnhs/4eAdv+EgXj/goN7 /4GEe/+ChXr/g4V3/4WGdP+Ehnj/kZiR/4+ZmP+ZpaP/pbSx/6u7uv+yxcP/vdHQ/8ba2f/O 4uH/zeHi/8ze4P/J293/ydjd/8fU2v/H0tj/xtHV/8vW0v/J1M7/xdDM/8LMy//CzM7/xM/T /8fS2P/I1dv/ytff/8nW3v/J1t7/x9bb/8bV2v/F1Nf/xNPW/8XT1P+hrLD/qrS2/7K7wP+5 w8X/u8XH/9Hc3v+2wcP/qLa3/6m1tf/C0ND/ydfX/3aEhP8ACQb/cYF+/8vb2P/H19b/qLa5 /3yJj/95hoz/l6Sq/5ypr/+Nm57/h5Sa/4aUl/9ZZ2r/s8HE/8HM0P/F0NT/ztnb/83Y2v/B y83/yNLU/8jS0//I0tP/yNLT/8jS0//I0tT/yNLU/8jS1P/I0tT/xM3S/8TN0v/FztX/xc7V /8bP1v/Gz9b/xs/Y/8XQ1v/H0tb/xNLT/8bR0//F0NL/xM/R/8TP0f/EztD/xM7Q/87Y2v/N 19n/zNTX/8nR1P/GztH/xMzP/8TJzf/DyMz/zdLV/83S1f/M0dT/zNHU/8vQ0//L0NP/ys/S /8rP0v/S19r/1Nnc/9jd4P/e4+b/5Ons/+nu8f/u8/b/8Pb2//n//f/6//7/+/////v////8 /////P////r+/f/7//7//v////7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////+/////v/////////////+/////v////z////8 ////6u/y/9ne4f/Y4OL/3+fp/9nj5f/X4eP/1+Lk/9Hc3v+8ysv/l6Gg/5WXkv+4tKn/5djI /7uqmP+rmYX/j35q/39yYf98c2L/enRk/3h1Yv94dmH/enZd/3t2Wf94dl3/jpCC/4mPhf99 hHz/dX92/3aBef9ygnj/eIeA/4qblf+PoJr/kqWh/5ysq/+ouLf/tsTF/8LQ0f/N2Nz/0d3d /8nWz//I1cv/yNXM/8jU0P/J1dP/ytXX/8vW2v/K193/xNHX/8TT2v/E09r/xdTb/8XU2f/E 1tr/xNbY/8fW2f9yfYP/cHuB/4GMkv+Pmp7/i5aa/4SSlf91g4b/gJCQ/77Ozv/Y6Oj/yNra /8LV0/+Xqqj/v9LQ/77S0P+4zMv/tsjM/6W2vf+7ytH/2Ofu/8/e5f/Az9T/vsvR/7jFy/+E kZf/0N7h/8fS1v/BzND/xdDS/8bR0//J09X/1d/h/8jS0//I0tP/yNLT/8jS0//I0tT/yNLU /8jS1P/I0tT/x9DV/8fQ1f/Gz9b/xs/W/8bP1v/Gz9b/xs/W/8XQ1v/F09b/xdPU/8fS1P/G 0dP/xtHT/8XQ0v/G0NL/xtDS/8XP0f/Fz9H/yNDT/8rS1f/M1Nf/ztbZ/9HW2v/S19v/ztbY /8zW1//N1df/y9XW/8vT1f/J09T/ydHT/8jS0//AyMr/wcvM/8XNz//I0tP/ztbY/9Hb3P/V 3d//1t/e/93j4//1+/n/+/////j+/P/5/fz//P////z////x9fT//v////7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////+//// /v/////////////+/////v////z////8////5+zv/9fc3//X3+H/3+fp/9rk5v/X4eP/1+Lk /9Hc3v/G0NH/qrCu/5KPhv/Sybr/6NbC/8CokP+/pYr/uZ+E/8Ouk/+7qpD/saOJ/6SZff+Y jW3/jYNf/4Z6VP+AdlP/cmxS/3BvWv9wcl3/cXRh/3d7av9+h3b/gIh5/3eCdP94hHj/eIV7 /3qFff98h4H/f4qG/4KLiP+Fi4v/hI2I/6CsoP+ns6X/sr6y/7/Kwv/J1M7/ztrY/9Hd3f/Q 3t//v83Q/8DN0//BztT/w9LX/8XU2f/I19z/ytnc/8va3/8TICj/AAQM/wUSGv8gLzT/SFdc /1pscP9oen7/f5GV/3eKjv+pvb7/mq+w/52zsf+txsP/wtvY/7TNyv+HnJ3/hZie/52wt//H 2OD/0+Ts/8XW3v/P4Of/0+Lp/7TDyP99ipD/xdLY/8HM0P/K1dn/zNbY/8PNz/+/ycv/v8nL /8fS1P/H0tT/x9LU/8fS1P/H0tT/x9LU/8fS1v/H0tb/ydTY/8jT1//I09f/x9LW/8fS1v/G 0dX/xtHV/8XQ1P/H1db/x9XW/8nU1v/K1df/ytXX/8rV1//M1tj/zNbY/8nT1f/J09X/ydHU /8jQ0//Hz9L/xs7R/8fM0P/EzM//wMrL/8DMzP/CzM3/w8/P/8bQ0f/H09P/ydPU/8nV1f/L 1db/ydXV/8nT1P/H09P/x9HS/8TQ0P/Fz9D/xM7N/77Hxv/Y3tz/7/Xz//X7+f/6/v3//P// //z////0+Pf//v////7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+/////v/////////////+/////v////z////8////5ert /9bb3v/W3uD/3+fp/9rk5v/Y4uT/1+Lk/9Hb3P+stbT/qaum/4B6bv/Pv6//0bmh/7qdf/+/ nn3/vJt4/7SXdf+xmXf/rpp5/66ceP+unHT/rp1x/7Gcb/+unXH/l4lm/4F4Wf91bE3/ZF9B /2JeQf+BgWX/kZF5/3R4Yf9ucVz/bnNf/3F1Zv90eGr/eHpv/3t9cv9/f3f/f4F2/32EdP98 hXL/fYV2/4CIe/+FjIT/iZOL/4+Ylf+SnJv/vsjJ/7/Jy//Cy9D/xdDU/8jT1//M19n/z9rc /87c3//D0Nb/rr3E/6u6wf+Dkpn/aXh//0RVXP88TVT/RVhe/0BVWP9LYGP/UWlr/2d/f/9w iov/Y31+/4qkpf9thYf/ip2k/3eKkf98jZX/gZKa/4GSmv+YqbD/obC3/4CPlP+Uoaf/ztvh /8DLz//K1dn/ydPV/8LMzv/H0dP/xtHT/8fS1P/H0tT/x9LU/8fS1P/H0tT/x9LU/8fS1v/H 0tb/y9ba/8rV2f/K1dn/ydTY/8jT1//H0tb/x9LW/8bR1f/Azs//wc/Q/8TP0f/F0NL/xtHT /8fS1P/J09X/ytTW/8bQ0v/G0NL/yNDT/8jQ0//J0dT/ydHU/8vQ1P/K0tX/zdfY/8zY2P/M 2Nj/y9fX/8vX1//K1tb/ytbW/8rW1v/H09P/xtLS/8bS0v/F0dH/xNDQ/8PPz//Dz8//w83O /6+4t/+6wL7/193b//r//v/8////9fn4//L29f/8/////v////7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f////////// //////////////////////////////////////////////////////////////////////// /////f39//39/f/9/f3//v7+//7+/v////////////////////////////////////////// //////////////////////////////////7+/v/+/v7//f39//39/f/9/f3///////////// //////////////////////////////////////////////////////////////////////// //7+/v/+/v7///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////+/////v///Pz8 //f39//6/Pv//v////z////1+fr/3uPm/9jd4P/T293/3ubo/9fh4//R293/2eTm/8zW1/+j qaf/ra2l/392Z//Arpj/u52B/8ikgv+/mHH/vJVs/8Cac//BoHf/v6J6/7yhdv+9pXf/wap4 /72hb/+wlmX/ln9T/5SBV/+IdUv/bl82/4N1Tv/l3LX/+O7L/9rUsv/a07b/2NO2/8jCqv+Y knz/fHRh/2xkUf+Cdmb/fXZk/3t6Zf95fGf/en1q/3t+bf97fXD/enxx/3l6dP93eXb/gYOC /36Cgf9+goP/g4eI/4yQkf+XnZv/pKqo/6mysf+6xcn/vMnP/8HO1P/G1dr/yNfc/8bY3P/E 1tr/wtXZ/63Cx/+dsrf/gJic/2V9f/9PaGz/RV5i/0FdYP9GXmL/TF9l/0ZXXv88S1L/QVBX /2JxeP9/jpP/cn+F/09cYv+otbv/ucfK/8zX2//N2Nz/w87Q/7/KzP/J1Nb/1uHj/8LN0f/B z9L/wtDT/8PR1P/E0tX/xdPW/8bU1//H1dj/w9HU/8TS1f/H1db/ydfY/8rY2f/I1tf/xtTV /8TS0//E0tP/xdPU/9bh4//Ay83/zNfZ/6Ktr//P2dv/w83P/8jS1P/CzM7/1d3g/8bO0f/F zdD/xc3Q/9LX2//AyMv/zNbY/8TP0f/Ay83/y9bY/8bR0/++ycv/xM/R/8fS1P/I09X/yNPV /8fS1P/H0tT/x9LU/8bR0//G0dP/x9HS/9DZ2P+utLL/lpya/+ju7P/5/fz//P////j8+//8 /////v////7///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////f39//39/f/9/f3//f39 //39/f/9/f3//f39//39/f////////////////////////////////////////////////// /////////////////////////////////////f39//39/f/9/f3//v7+//7+/v////////// //////////////////////////////////////////////////////////////////7+/v/+ /v7//f39//39/f/9/f3///////////////////////////////////////////////////// //////////////////////////////////7+/v/+/v7///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////+/////v///Pz8//j4+P/6/Pv//v////z////z9/j/3eLl/9ne4f/T 293/3eXn/9fh4//S3N7/2OPl/8nT1P+lqqb/q6if/4J2Zv++qJD/upl6/8egef/ClWv/wpNn /8OYbf/GnXH/xJ9z/7+fcP/ConH/xaZw/76dZ/+xkFr/nX1K/5J2RP9+YjL/eWIw/9fBkP// 88T/3sug/+HQpf/t3rf/3s6q/829nP/PvqD/sZ2C/+3ZwP/LtZ3/ZFI6/1hONf9hW0P/c21X /4J7aP+IgXH/hHxv/3pzaf9zbGT/fHdz/396dv+CfXr/hYB8/4aDfv+Fgn3/hIF8/4B/e/96 fn3/e4SD/4KKjP+LlZb/lqCh/6Crrf+ptLb/rLq7/7vKzf/A0tT/ydvf/83g5P/J3uH/vdLV /63Fyf+lur//kJ+k/3J/hf9ZZmz/S1he/y89QP8PHSD/EB4h/yg2Of+7xsr/wMvP/8bR1f/J 1Nj/yNPV/8bR0//G0dP/xtHV/8fV2P/H1dj/xtTX/8XT1v/F09b/xNLV/8PR1P/D0dT/ydfa /8bU1//D0dL/wc/Q/8LQ0f/G1NX/y9na/87c3f/K2Nn/zdvc/7fCxP/U3+H/rLe5/yw3Of+g qqz/QkxO/0ZQUv9faWv/q7O2/8HJzP/Q2Nv/s7u+/66zt//M1Nf/xM7Q/8XQ0v/Ez9H/2OPl /8rV1//S3d//v8rM/83Y2v/I09X/yNPV/8fS1P/H0tT/x9LU/8bR0//G0dP/x9HS/9DZ2P+z ubf/l52b/8XLyf/4/Pv//P////v//v/7//7//v////7///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f////////////////// /////////////////////////////////////////////////////////////////////f39 //39/f/9/f3//v7+//7+/v////////////////////////////////////////////////// //////////////////////////7+/v/+/v7//f39//39/f/9/f3///////////////////// //////////////////////////////////////////////////////////////////7+/v/+ /v7///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////+/////v///f39//j4+P/6 /Pv//v////r+///w9PX/3OHk/9ne4f/S2tz/2+Pl/9bg4v/T3d//1+Lk/8TNzP+oqqX/pKCV /4h5Zv+4oIb/t5Nx/8aZcP/FkmX/x5Nj/8iVZv/Jm2r/x51t/8Sca//Gnmv/x59r/72WX/+v iE//lXE3/5FuNP+FYir/rY5X///wuv/53qn/3cOS/+fPn//nz6H/w6t//9W8lP/QtI///d+9 /8KjhP96WTr/bVAy/5mEaf+mlXv/vqyU/9PBq//byrj/1sW1/8q4qv/ArqL/pJOL/5yLg/+N f3b/gXNq/3psY/95a2D/fG5j/35yZv+QiX//iYZ9/4SBev9+fnb/fXx3/35/ev+Bg4D/goeD /3h+fP99hoX/iJKT/5Whof+hr7D/q7m6/7LAw/+2xMX/x9HS/8zU1v/Q2Nr/zNTW/7rExf+n sbL/o62v/6eytP/EztD/ws3P/8LN0f/Ez9P/xNLV/8TS1f/AztH/vMrN/8DN0//AzdP/wM3T /8HO1P/Cz9X/w9DW/8PR1P/D0dT/wM7P/8HP0P/C0NH/w9HS/8TS0v/E0tL/xNLS/8PR0f/E 0tP/y9na/9Pe4P+wu73/0dze/zQ/Qf8nMTP/lZ+h/xslJ/9TXV//a3N2/9Xd4P+3v8L/W2Nm /z5DR/+3v8L/bnh6/3F8fv/Ez9H/j5qc/8PO0P/G0dP/wMvN/8/a3P/I09X/yNPV/8fS1P/H 0tT/x9LU/8bR0//G0dP/x9HS/8/Y1/+9w8H/lZuZ/5edm//z9/b/+f38//z////6/v3//v// //7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v////////////////////////////////////////////////////////// /////////////////////////////f39//39/f/9/f3//v7+//7+/v////////////////// //////////////////////////////////////////////////////////7+/v/+/v7//f39 //39/f/9/f3///////////////////////////////////////////////////////////// //////////////////////////7+/v/+/v7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////9/v///v///f39//n5+f/7/fz//v////f7/P/s8PH/2+Dj/9ne4f/S2tz/2uLk /9bg4v/V3+H/1eDi/73Gxf+oq6T/nJaK/4+Aa/+0mX7/tY9r/8OUav/Fj2D/ypJh/8eSYP/L l2f/yZlo/8aYZ//Fmmf/xJlk/7qNVv+pf0X/lW0w/5BoK/+VbjP/7MiM///jqf/YuH//9teh /9W3g/+wkmD/07SF/8uqff//4Lb/1a+K/2pCHv97UzD/v5h3/8qojP/PsZX/3L6k/+fJsf/q zrn/6Mu5/+LFtf/dwLL/4sa4/9/Dt//Zv7L/0rip/8iun/++pJP/tZuK/6+ZhP+DcV3/f3Bb /31uW/97bl3/fG9f/31xY/9+dGj/gHdu/4R9df+Ef3n/hoN+/4aFgf+EhIL/gIKB/3t9fP94 enn/hoiF/5idmf+hpqL/n6Oi/6+zsv/L0c//0drZ/8TMzv/CzM3/xc/R/8fS1P/H0tb/w9HU /8PR1P/E0tX/xtPZ/8XS2v/F0tr/xtPZ/8bT2f/H1Nr/x9Ta/8fV2P/I1tn/w9HS/8XT1P/I 1tf/ytjZ/8nX1//F09P/wc/P/77MzP+3xcb/vMrL/7zHyf+4w8X/ydTW/0FMTv9LVVf/r7m7 /ykzNf9bZWf/lp6h/y42Of+0vL//ucHE/zI3O/92foH/W2Vn/0FMTv+Bi43/PUhK/x8pK/+p tLb/OkRG/3F8fv/J09X/yNPV/8jS1P/H0tT/yNLU/8bR0//H0dP/x9HS/8zV1P/Izsz/j5WT /3d9e//q7u3/+f38//z////6/v3//v////7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////// /////////////////////////////////////////////////////////////f39//39/f/9 /f3//v7+//7+/v////////////////////////////////////////////////////////// //////////////////7+/v/+/v7//f39//39/f/9/f3///////////////////////////// //////////////////////////////////////////////////////////7+/v/+/v7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////78/f///v///v7+//r6+v/7/fz//v// //T4+f/o7O3/2t/i/9rf4v/S2tz/2ODi/9bg4v/W4OL/097g/7W+vf+oq6T/k41//5uKdv+y l3r/uY5r/8WSZ//HjV3/zJBe/8eNW//MlGP/y5Vm/8eVZP/ElGP/wZJe/7OETv+hdDv/m3E1 /4xkJ/+thkv//9uf//DNk//hwYj/6smT/7OSXf+0k2D/zat7///pvP/lv5L/cUcf/5drRP/e sYr/672b/+W5nP/lvKD/572k/+rAqP/swqz/7cKv/+zDr//rwrD/5sCt/+W/rP/kvqv/4Lql /9m1nf/RrZP/yaWL/8Shhf/Ip4j/xKaE/7+ggf+1mHj/qI1w/5uBZv+QeGD/iHJd/3lkU/96 Z1j/fWtf/4FwaP+EdW7/iHl0/4p9d/+Jfnj/hH95/4CAeP+AgHj/fn95/3p7dv95e3b/goeD /42Tkf+bpKP/oKqr/6eytP+uub3/tMLF/7zL0P/F1Nn/y9rh/8HQ1//Az9b/wM/W/8DP1v+/ ztP/v87T/77N0P++zdD/x9fX/8TU1P+/z87/u8vK/7nJyP+6ysn/vMzJ/77Ozf/G1NX/1+Xm /77Jy//Z5Ob/zNfZ/5ynqf/G0NL/oKqs/4ONj//J09X/0trd/9be4f+utrn/CREU/32Chv9s cXX/gIeN/ygxNv8xOD7/lJ2i/xAXHf9ncHX/dXyC/yApLv/K0df/ydLX/8nQ1v/I0db/ydDW /8fQ1f/Iz9X/yNDT/8vR0f/N09H/ipCO/3V7ef/k6Of//P////j8+//7//7//v////7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////f39//39/f/9/f3//v7+//7+/v////////////////////////// //////////////////////////////////////////////////7+/v/+/v7//f39//39/f/9 /f3///////////////////////////////////////////////////////////////////// //////////////////7+/v/+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //37/P///v////////v7+//8/v3//P79//H19v/j5+j/2d7h/9rf4v/R2dv/1t7g/9Xf4f/Y 4uT/0t3f/663tv+oq6L/i4V1/6eXgP+3mnz/vpRu/8eSZv/JjF3/y41a/8iKWf/NkGH/zJRl /8eRYv/EkGD/voxb/656SP+ZajT/kGYs/5VuM//as3r/99OZ/+XCiv/ry5L/tpVf/7WUX//Z tYP/6MSS//PKnP+CVyz/mm1E/9Wlff/hsIj/5rSP/+Guj//ir5L/5bKX/+m1nf/rt6H/7bmj /+26pf/tuqX/5rag/+OznP/drZb/2KmP/9Sniv/Tpof/1aiJ/9aqhf/KnXP/zKBz/82hdP/L oHX/xpx0/7yUcP+0jWz/rYhr/6yIbv+demT/hWZS/29SQv9kRjv/Y0c8/2lMRP9qVEn/dmlg /3RuYv9+em//jIh//4mGf/96eXT/d3hz/4CCf/91e3n/cXp5/3B6e/9ygIP/eoeN/4GQlf+F lJv/hpWc/6i3vv+qucD/rr3E/7TDyv+5yM3/v87T/8PS1f/F1Nf/xdXV/8XV1f/E1NP/xNTT /8XV1P/G1tX/x9fU/8jY1f+7ycr/ytjZ/8jT1f+0v8H/xdDS/9/q7P+6xMb/xc/R/8fR0//G 0NL/wMjL/7/Hyv+xubz/kJib/2dscP+Kj5P/KTA2/3d+hP9WXWP/TlVb/zY9Q/+aoaf/JCsx /zlARv/K0df/ytHX/8nQ1v/J0Nb/ydDW/8jP1f/Iz9X/yNDT/8nPz//Izsz/jZOR/4mPjf/n 6+r//P////f7+v/7//7//v////7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////f39//39/f/9/f3//v7+ //7+/v////////////////////////////////////////////////////////////////// //////////7+/v/+/v7//f39//39/f/9/f3///////////////////////////////////// //////////////////////////////////////////////////7+/v/+/v7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////z6+////v////////z8/P/8/v3//P79/+/z9P/g 5OX/2N3g/9rf4v/R2dv/1Nze/9Xf4f/Z4+X/0Nvd/6ixsP+mqaD/hX9v/7OjjP+8n4H/xpp1 /8uVZ//KjFv/yotY/8eHV//Mjl//zJJk/8iPYv/DjV//u4dX/6p0Rf+VYzD/hl0n/6eESv/w zZX/89Oa/9y7hf/Gp3H/podR/9Kxfv/Xs4H//96u/3dOIv+keU7/9cif/+a2jv/ZqID/8ryY /+Kpi//lqY3/5qqQ/+iskv/qrpb/7bGZ/+2znf/utJ7/26OK/+Coj//nr5T/6rOV/+eykv/e qYf/0596/82Ybv/QmGX/0Jhf/8+WX//NlmD/yJNh/8SQYf/AjGT/vYtm/7KEY/+oe17/l2tS /4BWQP9pQC7/Uisa/0McDf82Fgn/MyET/zcuH/9AOCv/SUE2/1hRR/9nY1r/a2pl/2doY/+B hYT/foeG/3qEhf9ygIP/bnuB/2x7gv9uf4f/cYKK/2x6g/9vfYb/dIOK/3uKkf+CkZj/iZid /4+eof+RoKP/qbm5/6+/v/+3x8b/wNDP/8bW0//I2NX/yNjV/8jY1f/C0NH/vcvM/8XQ0v/M 19n/vMfJ/77Jy//CzM7/yNLU/8DKzP/O2Nr/09ve/8TMz//N1dj/t7/C/9ne4v/R1tr/xcrQ /9ne5P/Bxsz/h4yS/8PIzv95foT/P0RK/6uwtv/M0df/zNHX/8vQ1v/L0Nb/y9DW/8rP1f/K z9X/ys/T/8nPz/+7wb//mJ6c/6Opp//0+Pf/+Pz7//n9/P/6/v3//v////7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////f39//39/f/9/f3//v7+//7+/v////////////////////////////////// //////////////////////////////////////////7+/v/+/v7//f39//39/f/9/f3///// ///////////////////////////////////////+/////v////7////+/////v////7////+ /////v////7+/v/+/v7////////////////////9//////////////////////////////// //////////////////////////////////////////////////////////////////z6+/// //3///7///39/f/9/f3/+/z+/+/w8v/f4+b/2N3h/9rf4//R2dz/093f/9Xf4f/Z5Ob/0Nvd /6Wuq/+mqJ3/g3xq/7uqkP/Ao4P/y594/82Xaf/Kjlz/yYpX/8aGVv/LjV7/y5Bk/8eOY//E i17/uoRW/6lxQv+SXiz/k2kv/7uUWf/kwIb/+tef/9q5g/+be0j/wqRy/+DBkv/tzJ//iGY5 /6yFXP/Yrob/8MKe//XFof/nspD/5KyL//W4mf/zs5f/666S/+irj//nqZD/6q6W//C0nP/x t5//67GZ/+qxlv/qr5H/56yM/+Knhf/do33/2J52/9edb//Ul2D/0pRZ/8uOVf/GiVL/woZQ /8CGVP/CiFr/w4pf/7Z/WP+yfFj/q3ZW/5xpTP+HVTr/bz0m/1cnEf9FGgf/NxoI/zkkE/8/ LB3/QC4g/zsrHv82KB3/Nyoh/zYuI/8uJx3/Ojoy/0lOSv9MVlf/Sllg/1Jmcf9pgJL/fJeq /2qHmf9oh5n/aYaY/2iFl/9mg5X/ZYKU/2SBj/9lgY3/Yn+H/2WCiP9qh4v/c4+S/32ZnP+J paj/k6+y/5y0tv+uwMD/t8fG/8ra2v/N3d3/0uHk/8nY2//C0NP/v8rO/8XP0f+7w8X/wMXI /9DV2P+7wMP/ydHT/9PY3P/Bycz/y9PW/8LKzf/N1dj/4+jr/7vAxP/L09b/yNDT/73Gy//J 0tn/yNPZ/8jR2P/I0db/ydHU/8jQ0v/K0ND/ytDQ/8rQ0P+xt7f/oqio/7O5uf/8////8/f2 //7////7/fz//v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7////8 /////P////z////8/////P////z////8/////P////7//f/+//3//v/9//7//f/+//3//v/7 /////f////3//v////7////+/////v////7////+/////v////7////+/////v////7////+ /////v////7////+///////////+/f///vv///z7//v5+v///v////7//+7v9P/U19z/2N3j /9vg5v/X3uT/0tvg/9Pc4f/Q29//vcjK/6ewq/+dm4z/k4dv/7Oegf/DpYH/xZpw/8uXaP/E ilr/x4pb/8eNX//Gi1//woti/8KLYv/BiF3/t35R/6huQP+bZC7/nGws/+G2cv/50JL/8suQ /66NV//Fp3P/2r6P/+zRpv+Rc03/qIdk/9Kujv/zyqz/8MOk/92sjv/jrZH/+8Kl/+msjf/p rI3/56yO/+Wskf/lq5P/46uU/+Krlv/iq5b/3qiQ/96mi//dpIb/3aKA/9yge//bnnL/251u /9qca//Kjlr/y49b/82RXf/MkFz/yI9a/8KJVP+9g1H/uX9P/72FVv+2fVD/qnBI/59oQf+b Yz7/jlY1/2wzFf9HFAD/QBYA/zoWAP9AHQr/TSkZ/1EwIf9MKxz/RiUU/0MnEv8vFQD/NiQO /0g/MP82ODP/BBUd/xkzSv9tkbX/cJ3G/3iw1f9ysNX/cazU/22o0v9pos3/ZZ/H/2Scwf9k m7r/VYuj/1yUpf9TiJb/Wo6b/1uPnP9Pg5D/VYaV/1aBiv9pg4D/dYqD/3OJhv93j4//iaKm /5avtP+juL3/s8XJ/8HMzv+0urr/vcHA/9DSz//M0M//ytDQ/8vT1f/Ezs//y9fV/87a2P/E z8v/wMnE/87X1P/R3Nj/xNDQ/7nIy//A09n/v9Pa/8DT2f/B09f/xNLS/8fSzP/L0cf/y9DJ /8nSz/+jq63/mKCi/7m+wf/8/////f7///n4/f/////////////+/////v/////////////+ /////v////7///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7////8////+/////v////7/////P////z////8/////P// //z//f/8//3//v/9//7//f/+//v//v/7////+/////3//v////7////+/////v////7////+ /////v////7////+/////v////7////+/////v////7////+///////////++////vv///z7 //z6+////v///v3//+zs9P/U197/2dzl/9jf5//W3eX/0tvi/9Ld4f/O2d3/uMbH/6etqf+d l4f/lYVs/7CZef+/n3n/wZZr/8iVZv/Gjl//ypBg/8mQY//Fj2P/w4xj/8GMYv/Ahl7/tXpO /6dqPf+ZYCv/mGYn/9WoZf/xyIj/1LB0/7iZY//t0aH/8Nis/7Scdv+Ueln/x6qM//rYvf// 5cv//9e+//bGr//stp7/4aeP/+mukP/pro7/566Q/+auk//krpT/4q6W/+CtmP/grpf/3amT /96ojv/cpYb/2qJ//9qfd//Ym27/2Jho/9eYZf/Kjlz/yY9f/8qQXv/Jj13/xo1Y/8KJVP+9 hE//uYBL/72DUf+3fU3/rXNF/6VqPv+iZz3/llsz/3Y6Ff9VHQD/RhQA/z4RAP9BFgP/TiMS /1UpHP9SJxf/TiQO/00lDP86FwD/OiAF/0k6J/88PDT/ABAa/x08Wf9rlsP/aKHY/2mu5/9k r+n/Yqzt/1+p6v9epOn/XaLj/1yg3f9cn9T/ZqnU/2mrzv9kpcX/ZaXB/2Ghvf9ZlrX/VpK2 /1mMqf9kiJb/a4mR/2eJk/9kiJj/Zoue/2SJnP9lhpn/a4aX/3qOmf93ho3/i5aa/6Ovr/+n srT/qLi4/6y+wP+pvMD/tMjJ/7rOzf/A0M3/xdHN/8rVz//I08//wc/P/77Q0v+/1Nn/vdTa /73U2v+/1Nf/w9PQ/8fSyv/L0cP/zdDF/8nSz/+eqKr/mqKl/8PIzP/8////+vv///v5/v// /v////7////+/////v/////////////+/////P////z///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////7////8/////P// //z////8/////v////7////+/////v////7////+///////9/////f////3////9/////f// //3///////////////////////////////////////////////////////////////////// ///////////////////+/f///vv///z7//37/P///f//+vn+/+np8f/U197/2Nvk/9Xc5P/U 2+P/0tvi/9Ld4f/L1tr/tMLD/6Sqpv+Tjnv/kIBm/6SLbP+xj2r/totg/8KPYP/Gjl//y5Fh /8yTZv/Ikmb/xY5l/8GMYv+9g1v/sXZK/6FkN/+SWCb/p3k9/9aucP/mwob/w6Js/9O3hf/x 2av/1L6X/497WP/JtJX/9t7C///54f//7tj//9bA//THsv/otaD/2KKK/+qxlP/rsJD/6bCS /+iwlf/msJb/5LCY/+Owm//jsZr/36uV/9+pj//cpYb/2aF+/9ecdP/VmGz/0pRl/9CSYf/K jV7/y45f/8uPXf/Kjlz/x4tX/8OHU/++gk7/vIBM/72BT/+5fE3/sXRH/6tuQv+pa0L/n2E6 /4RGIf9kLAn/SBYA/zwPAP87EAD/RxwL/08lF/9PJRX/TSQQ/00oDv8+HAD/Nx0C/0AzIP9C Qz3/AAoW/yhJaP9wnMv/a6Pg/2Sn9f9gqP3/X6b//1+k//9eo///X6L9/1+h9/9govD/Z6fu /2en5f9vreb/bqvi/2yn3/9sp+H/Z6Hg/2ic1v9nlsT/apXA/2uayP9pm8z/Y5fJ/16Qwf9b irj/WIKq/2WJqf9ggJf/ZoOT/2qIk/9kgoz/YIKL/2SKk/9njJX/dZWg/4Gcpf+RqK7/nK6w /6KwsP+vu7n/v8vL/8jW1//B09f/wNPZ/7/U2f/A1NX/xNPQ/8fSyv/L0cf/y9HH/8jR0P+X oaP/nqap/9PY3P/8////9vf7//z6/////v////7////+/////v/////////////+/////P// //z///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////+/////v////7////+//////////7//////////v////////// ///////9/////f////3////9/////f///////v7+//7+///+/v///v7///7+///+/v///v7/ //7+/////////////////////////////////////////////////f///vr//v37//39/f/8 /P7/9PX5/+Tk7P/U197/1dni/9LZ4f/S2eH/09zh/9Ld4f/H0tT/rbu8/5+mn/+EfWv/h3Zc /5N4Wv+delT/qHtR/7WCU/+/h1j/xYtb/8+XaP/Jk2f/xY5l/8GKYf+7gVn/rXJG/51eMv+L UyL/onU+/7+bYf/NrHf/0rSC//HZq//bxZz/uaeD/8++oP/+7dH///Xc///34v//69b/9M+8 /+K3pP/hsqD/7Lii/+qzlf/rs5L/6rOV/+iylv/ms5j/5bGZ/+Sym//kspv/4KyU/96rkP/d pof/2KB9/9Wbdf/QlWn/zpFi/8yPYP/Ljl//y45f/8mNW//Hi1n/xIhU/8GFUf++gk7/vYFN /7yATv+6fkz/tHdI/65xRP+tb0b/p2lC/5FTLP90PBn/SxwA/zsRAP82CwD/PxYE/0ogEv9L JBP/TiUR/00pEf9CIAX/MRkA/zgtG/9HSUT/AAoZ/zhbe/91o9T/bKXo/2Ck+f9bo///XKT/ /16j//9fpP//YKT//2Ol//9kpv3/W5zs/1yc5P9rqu3/a6jp/2ij5/9xrPD/a6Xu/2We5f9r oOT/ap/j/26n7v9xrfX/a6ny/2qp7v9sp+n/aaDZ/2mZyf9olbz/Z5Ky/2KOp/9Yhp3/VISY /1WJnv9ZjKH/TXqR/1p+lP9lhZT/a4OP/3qLkv+erK3/vsrK/8XR0f/E0tP/w9LV/8HT1f/D 09P/xNPQ/8fSzP/K0cn/y9DK/8PMy/+TnZ//pq6x/+Po7P/6/v//9PX5//78/////v////7/ ///+/////v/////////////+/////P////z///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////7//////////v/////////+/////v////7////+/////v////7////+/////v///v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////////////// /////////////f/+/fn//v37///////7+/3/7u/z/9/f5//U197/1Njh/8/W3v/P1tz/1N3i /9Ld4f/Czc//qbS2/5ugmv93bl3/hG9U/4dqSv+QakP/nXFE/6t3R/+4gE//vYNT/86WZ//J k2f/xI1k/7+IX/+4flb/qm9D/5pbL/+IUB//lGs3/5h3Qv/Gp3j/79Sn/+jSqf/PvZn/0cCi ///94///+eD///Te///y3v//7dv/99TB/+C3pf/itKT/9MSu/+m0lf/ps5H/6bKU/+iylv/l spf/5bGZ/+Sym//jsZr/4a2V/9+skf/ep4n/2aF+/9acdv/Rlmz/zZNl/82QYf/Mj2D/yo1e /8iMWv/EiFb/wYVR/7+DT/++gkz/vYFL/7t/S/+7f03/t3pL/7F0R/+wc0f/q21E/5pcNf+B SST/VicJ/0AWAP8zCgD/OBIA/0QdDv9IIxH/TCYT/0wqEf9BIgb/KxUA/zIpGP9ITUn/ABIj /0ltj/94p9v/a6jr/12k9v9apf//W6X//1ym//9epv//Yaf//2Oo//9mqv3/Y6fy/2Wo7P90 tvP/c7Tu/2mp5v9xru3/b6zv/12Z3/9moe3/ZKHx/2Gi9P9eovf/W6H3/1mg8v9bnu3/XZ3k /2eh4P90qd//eq7d/3uw2v96sdj/cq7S/2eny/9lo8j/WpG4/2aYu/9oka3/Z4ec/4WbqP+0 w8r/x9HT/7zFxP/H0dL/xtLS/8TS0//E0tL/xtLQ/8fSzv/K0Mz/ytDM/7rCxP+TnZ//r7e6 //D1+f/3+/7/9PX5//78/////v////7////+/////v/////////////+/////P////z///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////v////7////+/////v////7////+/////v////7////+/////v////7/ ///+/////v////7////+/////v///f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f// /////////////////////////////////////////////f/8/Pr//f39//7////4+f3/5unu /9nc4//T2N7/09fg/8vS2v/M1dr/1N3i/9Ld3/++ysr/o6+v/5eclf93aln/jXVZ/4tqSf+R akP/onNH/6x4SP+5gU7/u4FR/8yUZf/GkGT/wYxi/72GX/+3fVX/q25C/5paLv+ITiD/iV8v /3xcLf/WuY3//+i//9O9mP/l0rH///fa///95P///OX///zm///24v//5NL/7su4/9+2pP/e sZ7/5bWf/+axkv/msY//5rGR/+Wwkf/jsJX/46+X/+Gvlv/hr5b/4a2V/+Kskv/fqIr/26WD /9egef/UmnL/0pdr/9CWaP/NkGP/yo1e/8aJWv/ChlT/v4NP/76CTv++gkz/voJM/7t/S/+9 gU3/uX1L/7J1Rv+wc0b/rG9D/55gN/+JUSz/ZDUX/0ggBv8zDQD/NA8A/0AbC/9GIxD/SyYT /0oqE/86HwT/JhIA/zEpHP9GT07/CiM3/1Z+ov93quH/aajr/16o8/9Zqvv/W6n8/1yq//9e qv//YKr//2Kq/P9krPb/Z67u/3K58f97wfX/hcn6/3q98f9/wPb/i8z//26r6v9rp+3/ca/6 /2Wo9/9co/X/Yqr+/12l+f9YnO3/YaPv/22o7v91rOz/bqXe/2qh1/9yq+D/crDj/2ep3f9h pNn/XJ3T/2+r3f9xosv/e6K//7HK3v/Y6fP/093f/8DGxv/K0M7/yNHO/8fR0P/H0dD/x9HS /8fR0P/I0c7/yNHQ/6y2t/+apKb/usLF//b7///2+v3/+Pn9//78/////v////7////+//// /v/////////////+/////P////z///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////+/////v////7////+/////v////7/ ///+/////f////3////+/////v////7////+/////v/////////+/////////f39//39/f/9 /f3//f39//39/f/9/f3//f39//39/f////////////////////////////////////////// ///////6/Pv//f/+//7////3+Pz/4uXq/9bZ4P/T1+D/0tbf/8nQ2P/K09j/1d7j/9Pd3/+8 xsf/nqqq/5WYkf+EdWL/oYZp/5t5Vv+ieFD/s4NV/7qFU//EjFn/w4lX/8iQYf/DjWH/volf /7uEXf+3fFT/rG1E/5xZL/+LTiL/dUkc/3dVKP/jw5r//eG6/+rSrv//7s////3h//7t0//8 6tL//+/X///l0P/uzrn/3rij/9uumf/crJb/3qqS/+Ouj//jroz/466O/+Guj//grZD/4K2S /9+skf/frJH/462T/+KskP/gqYr/3aeD/9ujfv/YoXj/155z/9eccP/NkGP/y41e/8aIWf/B g1L/voBN/76ATf+/gkz/wINN/7x/Sf+/gU7/u31M/7N1Rv+vcET/rG1C/6BhNv+OVC7/cUQj /1EpD/82EAD/NA8A/z4aCv9EIxL/SSYT/0gpFP80GgH/IBAA/y8rH/9ETlD/GjRL/1+Jsf9z quP/Zanq/16t7/9ar/L/W670/1ut9v9drPf/Xqz0/1+s8P9hren/X6vd/3XA6v93wej/i9T3 /4LK8P+FyvP/oeb//3i45v95tef/jcn//4C++f93uPj/hcj//3i7//9np+//d7P7/2mg4/9n mtz/T4HA/0N1tP9ZjM3/aqHi/2il6P9kp+v/U5zg/2Sq6P9noNX/hbHY/8nn///h8///z9fa /83Pzv/Nz8z/y9DM/8rQzv/I0dD/x9HS/8fR0v/H0dL/x9HS/6CqrP+irK7/w8vO//n+///1 +fz//P3///37/////f////7////+/////v/////////////+/////P////z///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///+/////v////3////+/////v////7////+/////f////7////+/////v////7////+//// /v////7////+///+/////f3///z+/f/9/f3//P79//39/f/8/v3//f39//z+/f///////v// ///////+//////////7//////////v////7////4/Pv//f7///z////1+P3/3+Tq/9PX4P/T 1+D/z9be/8fO1v/J0tf/1d/h/9Pd3v+6xMP/nKim/5SVjf+Rf2v/tJV4/6yFZP+yhVz/xJFi /8iQXf/Ql2L/y5Ff/8WNXv/Bi1//vIdd/7qDXP+3fFT/rG1E/51aMP+MTyP/f1Am/5hzR//0 0an/+tq0///62P//6sr/5tG0/93Irf/SvKT/3MKp/+TGrv/lwaf/4rad/+Cuk//krpT/57KT /+Gsiv/hrIr/362K/9+tjP/eq4z/4KuM/9+pjf/fqY3/5K2P/+Osjv/hq4n/4KiF/92lgP/b pH3/26F5/9yhd//NkGT/y4xg/8WHWP/AglH/vX9O/71/TP++gUv/wINN/72ASv+/gkz/vH5L /7N1RP+ucEH/qms//59gNP+OVCz/eUwr/1UwFf84FAD/MxAA/zwbCv9DIxT/RicT/0YqFP8v FgD/Hg8A/y8sI/9ATlH/IkBa/2OQuv9vqub/Yqjt/1+w8v9csfT/XLD4/1uv+P9brff/XKz1 /12s7/9drOf/Xare/3fE8P9yveT/idP4/3zE6v92vub/mt7//2en0/+DveP/odj//5HM+P+F w/b/lNX//329+/9em9z/bqfq/26j5f9pmtz/S3u9/z1tr/9Xic7/aqDo/2Wf6f9dn+v/Xav2 /2Wy+P9hn9r/hbbh/87t///V5/X/v8fK/9HT0P/Oz8n/zdDJ/8vQzP/K0ND/yNDS/8fR0//H 0dP/x9HT/5iipP+osrT/yNDT//n+///0+Pv//v////z6///+/P////7////+/////v////// ///////+/////P////z///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////9 /f3//f39//39/f/+/v7//v7+//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////+/////v3///39///9////+/3///7////+//// /v///Pr9//78/////v////7///7////9/v///P3///7+///8////8/T2//L29//3+Pr/+Pz9 //z9///8/////v////z////5+vz/9fn6//X2+P/y9vf/9vf5//f7/P/9/v///P////z////4 /v7/+f3///v////6////3eLo/8jM1f/N1Nz/2N/n/87V3f/Q2d7/w83P/8vV1v+xu7r/mKKh /4CAeP+6pZD/2baY/+C4lf/Ronj/yJRk/9CYZf/OlWD/wYhT/8WNXP/EjmD/w45k/8CJYv+9 f1j/s3JK/6plPP+fYDf/h1Qp/5NoPv/swpr//+C6///51v//48P/28Ci/6OKbP+dgmX/podr /8KdgP/br5L/4rGR/+iykP/mq4v/1pt5/9mjf//XpYD/26eC/9ynhf/cp4X/3KWG/9ukhf/a o4T/3KOF/96mhf/hqYj/5KmH/+Kog//do33/2J52/9WacP/Ii1//zI1h/8+RYv/OkF//yYta /8GDUP+6fUf/t3pD/6dqM/+xdD7/tXhC/69xPv+qbDv/qGo7/6JkNf+UXTT/bUIg/1MwFP8+ GwX/NRQB/zQUBf82GQn/PiEP/0cuGP8pFAD/LCEP/yUmHv8rPEP/LlBs/3io1v9rqOf/X6fx /1mq+f9Wq/z/WKr//1ip//9Zqf//W6j//1yp+/9dqfT/YKvu/3S/+f+Ayf7/eL/z/4vR//+B xv3/eL34/3Sz6P+MxOn/c6rJ/5/Z//+Rzvv/d7br/4/Q//9cmtf/aaPi/3as6v+Ju/r/kcH/ /1GDwv9Adbf/b6jt/2+r9P9oq/n/Waf5/1im8f9srOr/lMf2/8jq///T5vX/wsrN/8jKxf/O z8f/z9DI/9TW0f/O1NL/wsrM/8bQ0v/J1Nj/vsnN/5eho/+yvL7/2+Pm//v////5/f///v// //f1+v///v////7////+/////v/////////////+/////P////z///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////9/f3//f39//39/f/+/v7//v7+//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////+//// +/r///39///9/////v////7///78/f/7+fz/9vb4///+///9/v//+/z///r9///8/////P// //z////7////+/////v////7////+v////n+///5/v//+f7///n+///7////+/////v////7 ////+/////v////5/v//9/z///v////5////+/////n////3/P//2uHn/8zT2//T2uL/1t3l /9DX3f/N19n/xc/Q/8rU0/+st7P/mKOf/4GBd//awav/68Sl/+a6l//VpHv/zZdo/9OaZf/V mWP/zJNe/8OLWv/CjF7/wYxi/8CJYv+9f1j/tXRM/61oQf+kYzv/lmE5/45hOP++kmv/99Cp ///41P//6Mf/1biY/7CTdf+bfF//fVo8/4NaOv+sflz/x5Nu/9CWcP/amnT/2512/9Sfd//V oXn/16N8/9mjff/Zo3//2aF+/9mefP/YnXv/1pp4/9ebef/YnHj/2Z15/9icd//XnXX/1Ztz /9WacP/TlGn/1ZZq/9SVaf/PkWD/x4lY/8GETv+/gkz/v4JL/7Z5Qv+6fUb/t3pE/61wOv+n aTb/pGY1/5pcK/+IUib/bEEf/1EvE/88HAX/NBUB/zMWBv80GAr/OyAP/0IsF/8lEwD/KyQS /yQpI/8nO0T/OF16/3On1/9mp+n/Xqr4/1mp/v9Wqf//WKj//1io//9Zp///W6f//1yn//9d qPv/X6n0/1yl6f9fpuT/V53Z/2aq5/9fo+L/Z6ru/2+v7P9+t+L/hLzh/4TB7f+Nzf3/gcT7 /3C18P93ufb/YaHf/3Gt6/+AuPX/ib/9/1SMyf9FgcD/aqns/2ar8P9jrfb/WKn6/1mm9P9p qen/nc39/83s///N3u7/xMzP/8nLxv/Oz8f/zs/H/9HW0P/N09H/wcvM/8bQ0v/I09f/u8bK /5ulp/+vubv/4+vu//v////4/P///v////j2+////v////7////+/////v/////////////+ /////P////z///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////9/f3//f39 //39/f/+/v7//v7+//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+/////v3///z7///8+////v3///7////+/////////v// //b3/P/3+v//+v3///j9///0+P//7/b+//D3///y+f//3ebr/9bg4v/K1Nb/vcfJ/7K8vv+q tLb/prCy/6SusP+rtbf/tL7A/8TO0P/W4OL/5e/x//D6/P/2////+P////P9/v/0/v//+f// //j////p8Pb/zdbb/83W3f/a4+r/0tvg/9Lb4P/J09X/ydPU/8fR0P+lsKz/maSe/4aEeP/z 2cL/8cio/+Cyjv/UoXb/z5dm/9KWYv/Tl2H/0pli/8CIV/+/iVv/v4pg/76HYP++gFn/uHdP /7VtR/+taUL/ll84/6BwSv/ElnL//+K////31v/10rL/xaSF/7uae/+riGr/j2hJ/4FUM/+H VTL/ll84/7Z4T//TkGb/15Zs/9GYbf/PmnD/0p1z/9Wedf/WnHT/1Zpy/9SWb//SlG3/x4dj /8qKZv/OkGn/05Vu/9aYcf/VmnD/1Jlv/9SZb//Oj2T/0JBk/9OTZ//VlWX/1JRk/86PWv/E hVD/vH1H/8CCSf+9f0b/s3Q+/6lqNf+naDP/pWYz/5lZKf+ESx7/Zz8b/08tEf87HQX/MxcC /zMWBv8yFgj/Nx0M/zsmE/8hEgD/LScZ/yctK/8jOUb/SHGR/22l2P9ipev/X6z+/1mp//9Y qP//WKj//1in//9Zp///W6b//1ym//9dp/7/a7T//1qi6v9gp+n/X6Xj/2Wp6v9aneH/aqrx /3Cv9P9kodr/cK3k/2Sm4/9tsvP/brn9/1Ca4f9tt/7/UJne/2it8P9wtPP/e735/1ab1v9K ks3/YKzo/1mq6f9cr/P/Wqn2/1+n8/9ppeP/qtb//9Lw///D1eP/xc3P/8rNxv/N0Mf/zM/G /8/Wz//L1NH/wszN/8XQ0v/F0NT/tsHF/6Ksrv+strj/7/f6//n+///2+v3//v////v5/v// /v////7////+/////v/////////////+/////P////z///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////9/f3//f39//39/f/+/v7//v7+//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////3//fn4 //r29f///vz///7////////+/////P////n8///x9vr/7/T6//T7///1/P//3ufu/7O8xf+O mKH/fYiO/3SChf9odXv/W2ls/1NgZv9PXWD/T1xi/1BeYf9SX2X/SVda/z5LUf87SUz/SVZc /2Rydf+Cj5X/mKOn/9Tf4f/h6+z/9v////L8/v/k7fL/xs/U/8jR2P/V3uX/z9jd/9Te4P/G 0NL/zNbV/8HMyP+eqaP/lqGZ/4qIe//x0r3/5biZ/9OhfP/NmGz/zZNj/8uPWf/LkFj/zZRd /7+HVv++iFr/vYhe/72GX/+/gVr/vXlU/7xyTf+1b0v/oGhF/6Z4Vv/Up4b//+vL///ewf/Q rY//spB0/6iGav+VclT/lm9Q/5hrSv+PXTj/iU8p/6FiOf/Fglf/0ZFl/8yRZf/LlWf/zphq /9GYa//QlWn/zpFl/8qJX//Hhlz/vnpT/8F9Vv/CgVf/w4JY/7+AVf+5e1L/snRL/65wR/+k ZTr/pGM5/6lpPf+2dkj/xoZW/8yNWP/HiFP/v4BK/71/Rv+2eD//q2w2/6RlL/+naDP/qms2 /51eK/+HTiH/YzsX/0ssDf87HQX/NBkE/zMYB/8wFgf/MBkJ/zMgD/8eEQD/Lioe/ygyMf8j PUr/W4ap/2ej2f9epOz/Ya///1mp//9Yqf//WKj//1mn//9bp///XKb//12m//9fp/v/crr/ /2Go6v9qsO7/Zqvm/2On5P9cnd3/aars/2Sj5v9np+f/XZ7g/2uv9v9dp/L/X6z6/16t/P9a qfj/W6n0/2Ks8/9kr/L/brj3/1un4/9QoN3/V63q/02q5/9Wr/H/XKnx/2en7v9wpN7/tuD/ /9bx//+7zNb/xtDR/8jNxv/K0Mb/x8/E/8vVzf/J1ND/wc3N/8XQ0v/Czc//r7q8/6iytP+v ubv/+f////f8///1+fz//v////37/////v////7////+/////v/////////////+/////P// //z///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////9/f3//f39//39/f/+ /v7//v7+//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////7+vj//Pv3///+/P////3//f39//f5+P/w9Pf/7fL1//n////4 ////8vv//87Z3/+dp7D/d4SM/216g/9vfoX/aHd+/2Jxdv9ZaG//UWBl/01cY/9OXWL/UWBn /1RjaP9MW2L/TFtg/0xbYv9LWl//SVhf/0VUWf9BUFf/P05T/y45O/9QW13/hZCU/665vf/g 6/H/1eDm/8/Y3//N1t3/ztfc/9Lc3v/H0dP/ztjX/7vEwf+bpJ//kZuT/5KOgv/dvab/06WE /8mVbv/Mlmj/0ZVj/8qNV//HjFT/ypFa/76JVf++ilr/vode/7+FX//AgFz/v3tW/791UP+6 dFL/qXRV/5xwVf/ku5////PY/+LApf+JaVD/Y0Ut/0UnDf9TNBj/UC0P/21EJP+QYDz/lFw3 /5lbNP+1dEr/zo5i/8uRY//MlGX/z5Vl/9GUZf/OkGH/xoZY/8B8T/+7d0r/vHVJ/7ZvQ/+p ZDr/nVgu/5FOI/+HRhz/gUIX/39AFf+APxX/gD8V/4JCFv+KShz/mVkp/6xtOP+9fkn/yIlT /7p8Q/+0dj3/qmwz/6RmLf+naDL/qWo1/5tcJ/+ETB3/XzgR/0cqCv85HQX/NRoF/zIYCf8s FQX/KRQD/yoZB/8cEAD/Ly0h/yk1Nf8qRlT/aZe7/2Wi2/9bo+//YLH//1mq+f9Zqvn/War7 /1up/P9bqf7/XKn7/12p9/9fqfD/hM7//3rD+P9/x/n/b7bk/2yw3/9sruD/ebrw/2us5v9r q+v/XaDm/2uw+/9cqPb/VqT2/2e4//9Mne//X7D//16s9/9dqvL/ZLH1/12s7/9Vqu3/U6zw /0uq7v9VrvL/Yabr/26l5f98qt7/wuX//9bv//+3yND/xtDP/8XPx//H0cj/w8/F/8bTzP/F 1M//wM7O/8XR0f++ysr/qbO1/6q0tv+7xcf/+f////j9///2+v3//f7///78/////v////7/ ///+/////v/////////////+/////P////z///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////9/f3//f39//39/f/+/v7//v7+//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////f/7+vj////7/////f/5 +/j/8/X0//j8+//7////+f////j////R3OD/lJ+l/257gf9mc3v/Z3Z9/2Bud/9UZW3/VWZu /1Bjaf9LXGT/RFdd/0JTW/9BVFr/Q1Rc/0RXXf9JWmL/QlVb/ztMVP80R03/MkNL/zNGTP85 SlL/PU5V/0xaXf9HUlT/PUhM/0pVWf+rtrz/xtHX/9Pc4//d5u3/ztfc/8zW2P/L1df/ztjX /7S9uv+bpJ//iJKK/5uVif/NqpT/zJt7/8qUbv/RmGv/1Jhm/82QWf/Kj1f/zZRd/8KNWf/A jFz/v4hf/7+FX/+/f1v/v3tW/8F1Uf+7dlX/m2hN/592YP/81r///+XP/5x9aP84HAf/KxAA /z8lDv87Hwf/KgsA/zcQAP9aLQz/fEgj/51jPf+6e1L/woNX/86UZP/QlmT/05dl/9KUYf/M ilj/wX1M/7ZwP/+vZzf/sWk5/6VcL/+SSRz/gjsP/3o2Cf9+OxD/hkYa/41OI/+PTiT/l1Ys /51dMf+ZWSv/klIi/5VWIf+kZTD/snM9/7d5QP+3eUD/sXM6/6psM/+naDL/o2Qu/5NUH/97 QxT/WjQN/0UoCP85HQX/NRwG/zEaCv8pEwX/IxAA/yISAv8bEgP/LCwi/yc1Nv82U2P/caHH /2Wj3v9ZpfH/YLH//1mr9f9ZrPL/W6r1/1uq9/9cqfn/Xan1/1+p8P9gqun/j9j//5La//+a 4f//jNH6/47R+/+Lzvn/jtD//3++8/9urOX/ebn3/2Oo6/9rs/v/Xqv5/12r/f9UovT/V6X3 /16q+P9fqPX/Yav2/16s9v9Zq/f/VKv6/06r+/9Vq/b/Y6Ll/3Si3f+PteT/yef//9Tp/P+7 ytH/xNDO/8POxv/G0sj/wM3E/8HSzP/D09D/v8/O/8PR0f+8xsf/o62u/6mztf/P2dv/+f// //n+///3+/7/+vv///78/////v////7////+/////v/////////////+/////P////z///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////9/f3//f39//39/f/+/v7//v7+ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////f////3////7/////f/x8/D/8vb1//v////7////6PDy/5+orf+Hkpb/and9 /11sc/9fbXb/XW52/1Nkbv9GWGL/P1Fb/z5SWf8+UFr/PVFY/z9RW/8/U1r/QVNd/0FVXP85 S1X/OU1U/z1PWf89UVj/PlBa/ztPVv86TFb/OEtR/zNCRf85R0j/LTs+/0BOUf+/ytD/0dzi /8HM0v/BzNL/z9jd/8bQ0v/Q2tz/ztjX/622s/+dpqH/f4mB/6Kcjv/DoYj/zJp5/82VcP/P lGj/zJBc/8mMVf/Kj1f/z5de/8eSXv/EkGD/wYph/7+FX/+/f1v/vnpV/8F1Uf+7dlf/mGhS /7uYhf//4tH/5sm5/4luXf9lSzz/Vj8v/4dwXv9aQS3/PyML/y8LAP8wBwD/UB8A/4dRLf+v c07/sXNK/9Saav/VnGf/15tn/9SVYP/LiFT/vXdE/69lNP+lWyr/olgn/5pQIf+PRRb/iD8S /4hEFf+TUCP/n18x/6lpPf+wbUP/uHVL/8B9Uv+9ek3/snBA/6VjL/+eXCj/nFsl/6xrM/+z cjj/tnU9/7FwOP+rajT/pGMt/5RTHf98RBP/VzEK/0QnB/85HQX/Nh0H/zEaCv8nEQP/HwwA /x0NAP8cEwT/Kisj/yU0N/9BYHL/daXN/2Wm4P9ap/X/XrD//1mr9f9bq/L/XKr1/1yq9f9d qff/Xan1/1+p8P9gqun/cbrx/3jA8P+Ey/X/gcbt/47R+/+ExPD/gcHv/3y66f+Iw+3/n9r/ /3698P+Fx///gcj//2aw9/9stv//Yaj4/2Sn+P9lqPn/YqT4/1+l+v9cpv//Waj//1aq//9b p///Z57h/3eg1P+fwOv/zOf//8/i8f/Az9T/ws7K/8HOxf/D08n/vM3D/77Ry//A08//wNDP /8LQ0P+5w8L/n6ep/6Wvsf/i7O7/9/////v////5/f//+Pn9//37/////v////7////+//// /v/////////////+/////P////z///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////9/f3//f39//39/f/+/v7//v7+//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+//////////7//////////////v////r8+//v8/L/+v// //n////N1df/jZeZ/3B7f/9lcnj/WWhv/1BhaP9OX2f/TF9m/0lbZf9FWWL/Rlpj/0ZaY/9E WGH/QFRd/zxQWf83S1T/MkZP/y9DTP81SVL/NUdR/zNFT/8yRE7/MkRO/zJETv8yRE7/NEVN /zJBRv9GVFf/PEpN/0xXW//O2d3/2ePl/8TP0//M19n/z9re/8HMzv/T3d7/zdfW/6qwrP+i p6D/foF4/6qfjf/Cm3z/zplx/8+Wa//Gjl//voVQ/72ETf/EjFP/y5Rb/8qVX//HkmD/w41f /7+GW/+7gFj/unxX/7l3VP+zeFr/pXxm/+LDsf//9eP//+bR/+jPuf/x28P/d2FJ/1Y+Jv9y VkD/TS0W/zoVAP88EwD/QxQA/1spCP+GUi3/pG9H/9Wfc//Xn3D/151r/9SWY//Jh1P/uHVA /6liLv+dVSP/mVEh/5hPJP+WTyX/lFEn/5NUK/+WWC//mF0z/5pfN/+xc07/rm5K/69uSP+2 dU3/wX5T/758TP+wbDv/oV4p/5tYIf+qZzD/tXI7/7RzPf+ubTf/pWYx/5hZJP+GTh//WS8J /0QlCP84Hgf/NB8O/y4cEP8jEwb/GwsA/xgLAP8dEwf/KSok/yIzOv9HaoD/c6bT/2Wn5P9b qPb/Xq///1+p8v9iqO7/Yqjw/2Ko8P9iqPD/Y6fu/2Oo6/9kqeT/YKba/2Ck0/9hptD/YKPN /3i45P9srNj/crLi/4LA7/+RzPj/mtf//4/O//+Bw/3/iM3//2qw+P9lrPr/YKT1/2Ol+f9m qP7/YaP5/1yi+P9bpf7/XKn//1ys//9bpvn/Zpza/3egzv+oyu//zOb//8ze7P/G1Nf/wc3J /8DNxP/D08n/vM3F/73Qyv/A08//wNDP/8LRzv+4wsH/nKWk/6Orrf/w+Pr/9Pn8//z////8 /f//+Pj6//v6/////v////7////+/////v/////////////+/////v////7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////7//////////v/////////+/////v//+vj7///+/////v//9/X2///+/////v///vr5 ///+///+////9vn+//P2+//7////7/T6/7a9w/95gof/WWRq/1RjaP9RYmn/TWBm/0ldZP9G WmH/QVhe/z5VXf89VFz/PVFa/zxQWf86Tlf/OExV/zZIUv80RlD/MkRO/zFDTf8wQkz/MUJM /zFCTP8wQUv/MEFL/y9ASv8xP0r/MT9K/zRCS/8rOkH/ND9D/2lzdf/U3dz/z9jV/9zm5f/H 09H/x9XV/8rY2P/J1dX/wcrJ/6yuqf+hnpX/eHBl/7Wdhf/Mm3D/1Jdh/8+WYf/Lk2D/x5Je /8WSXf/EkVr/xZFY/8GNVP/FkVj/w45Y/76KWP+6h1r/vY5k/8eZdf/AmXr/rIx3//PYw/// +uD///TT///30P/34Lb/vKB4/5R0Tf9zTCv/fVE0/2k6IP9cLRP/TSAD/1InB/+FXTn/oHhU /9Sjgv/eqoX/46yD/92ldv/Lj1v/s3Q//55cKP+SUB7/l1Qp/5FQKv+ERST/cTga/2gzFP9o Nxn/bD8g/3FCJP+MVDv/n2NJ/6ptUf+paEr/qGZD/7BrRP+2b0P/tW09/7RsOv+hWib/pV8r /7RxPf+ycz7/qmw5/55iMP+NVCf/Xy8L/z8aAP8rFAT/IhUM/xMOCP8QCwX/GA4C/xYKAP8W DAD/OTk3/yAyQP9Pc5X/dK7g/2uy9P9lsv//Xqr4/2Sg6P9/tvn/jsX//4a9/v94r+//b6rm /2ij3f9fnNL/ZaPU/2qq2P9fn8v/ZqbS/2am1P9dn8//aavb/2Kk2P9got7/ZKjn/2uu9P9s sPn/aK37/2Oq/P9iqv//Y6r//2Cn//9apPv/YKr//1yp+f9RoO3/Wqz2/2O3//9fqu3/aqPY /3Wiy/+z1/n/0+///8HV4P+9y8z/w87K/8nUzP/F0Mr/ws/I/8XW0P/B0c7/vc3K/87a2P+g qqn/q7Gv/77Cw//+////9/j6//j5+///////9vb2//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+/////v////7////+/////v////7////+/////v////7/ //r4+////v////7///Tw8f/59fb///79//Lw8f/y8/j/+/////v////M09n/kpmh/2t0e/9b Zmz/U2Bm/0xbYv9JWmH/Rllg/0JWXf8/U1r/OlFX/zdOVv82TVX/Ok5X/zlNVv83S1T/NUlS /zRGUP8yRE7/MEJM/y9BS/8wQUv/MEFL/zJAS/8xP0r/MT9K/zA+Sf8xPUn/MD5J/zJAS/8u PEX/LzpA/3qEhf/U2tj/ztfS/9rj3v/J1dH/ztzc/8/d3f/N2dn/v8jF/6ytqP+gmY//fW9i /7eZf//Nl2j/05Va/8+TXf/Hklz/w5Fe/8CRXf/Bj1r/wY5X/8CMUv/IkVj/y5Rc/8qXYv/F l2b/wZhs/72adP+0l3n/tZ+K//nn0////eH///fT//7rwP/p06L/yqt8/8CZbv++kGz/vYpr /652Xf+faU//kGFD/45mQ/+gfVf/rIlj/92wkf/lspP/57OM/9qkdv/DiVf/qm44/5hbJf+Q UiH/klMq/35CIP9sMxb/ZzMb/2c5If9gNh3/UCsQ/0YeBP9ZJhH/aC8b/35BLP+VVTr/o2FB /61nQ/+2bUT/vHJF/7VrOv+jXCj/qGEt/7VyPv+ycz7/qmw5/6BkMv+OVSj/YC4L/0IaAf8q FAf/HxYR/w4ODP8MDQj/Fw8E/xcLAP8WDAL/Kysr/yU6Tf9ehaz/cazk/1mi5/9grfv/Vp7w /16V5/91pPT/hLX//4i6//+GuP//h7z+/47E//+Ryf//hr/2/4bC9v92sub/c7Hk/2yq3f9g n9L/Z6XY/12e1v9prez/Y6jt/2Ck6/9hpe7/ZKjz/2Oo9f9bovD/VJ3s/1ig8v9Un/D/W6b3 /1uo9v9WpO//XKz1/1ur9P9OmNn/aqTW/3mmzf+12vf/0e3//8DU3f++zM3/w87K/8nTy//F 0Mr/ws7K/8bV0v/B0c7/v87L/8vX1f+gq6f/rLKw/8TGxf/+/v7/+fn5//r6+v//////9/f3 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////+/////v////7/ ///+/////v////7///////////////7////+///8+v3///3////+/////v//+vj5//X19//8 ////6/L4/7nAyP94gYj/VV5l/1NeZP9RW2T/Q1BY/0FQV/8+T1b/PU5W/zlMU/82SFL/M0dQ /zFFTv8wRE3/NEhR/zNHUP8zRU//MUNN/y9BS/8uQEr/LT5I/y0+SP8uP0n/Lj9J/zA+Sf8w Pkn/MDxI/zA8SP8vO0f/LjxH/zA+S/8xP0j/KTQ6/5Wfof/S2Nj/zdbT/9Xe2//M2Nb/ztzd /83b3P/M2Nj/usC+/6uqpv+dlIv/iHhr/7mbgf/Hk2T/zpFa/8uSXf/HkmD/xJJh/8GRYP/C kF3/wo9a/8eQWP/Lk1r/0pli/9WgbP/SonL/xptw/7WPav+sjnL/zb2t///16f///uj///HU /+TSrP++p33/ooFW/6F3T/+vfVr/qXJU/65yWP+wd1z/uYZn/8SYc//BmnH/xJ91/+u9nP/w vp3/67eQ/9ehc/+5gU7/omYw/5lbKP+ZWyz/klMq/3c7Gf9fJgn/ViIK/00fB/89EwD/Mw4A /zcPAP86CgD/QAkA/1QaAv92OR3/kVAw/51ZNP+oYTf/s2s7/7VsOf+nYCr/rWYw/7d0Pf+0 cz3/rG85/6JmMP+QWCn/YjAN/0AbAf8qFAf/HhUQ/w4NC/8NDAj/GBAF/xcOAP8aEgf/MzQ2 /z9Vav9jjbX/Yp/Y/1ef5/9frPr/IWjA/xJNs/8jWML/NmvR/0d93/9OheD/VYvh/2GY6P9u pvD/aqHk/3at7f99tfL/jcX//5PL//+Ox/7/kMf//4XA+P94tvH/cbHu/2mq5P9ipdz/YaTb /2Oo3/9or+X/bLXs/2Co4/9cpuf/YKjw/2Cp9v9hqf3/Z7H//2Wu//9bnu//baTa/4Gt0v+5 3vv/zur//7/T3P+/zc7/w87K/8fRyf/F0Mr/ws7K/8XU0f/A0M//wM7O/8TQzv+iran/rrSy /83Pzv/+/v7/+/v7//v7+///////+Pj4//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////+/////v////7////+/////v////7/////////////+vr8///////3 9fj/7+3w///+/////v////7///7////d4ub/oaqv/2Jrcv9IU1n/UVxi/1diaP9HVFz/NUJK /zpJUP85SE//NkdP/zRFTf8yQ03/L0FL/y5ASv8tP0n/LkJL/y1BSv8tP0n/LD5I/ys9R/8q PEb/KjtF/yo7Rf8sPUf/LD1H/y48R/8tO0b/LjpG/y46Rv8tOUX/LTlF/y07SP8yQEv/KjQ9 /7G7vf/O1tj/zdbV/8/Z2P/N2dn/yNbZ/8TS1f/F0NL/rbOz/6WkoP+WjYT/lYN3/72fhf/C j2T/yZBb/8mUYv/Ll2f/ypps/8qaav/Mmmn/zJhm/9GaZP/Pk13/05dh/9KbZf/PnG3/vZBm /6eAWf+pi2//6+HV///88////+//+e/W/+zZuf/PtZD/uJJt/7WHY/+ZYkP/k1c7/6dqTv+y dlr/yJNz/+Cwiv/VrID/2bKH//HDof/zwaD/6bWN/9CabP+ze0j/oWgx/6NnM/+qbT7/gkQb /2gtC/9hKgz/dkMo/35QNv9jOh7/PBcA/ykCAP88DAD/OAQA/z0FAP9UGQD/cjMQ/4lIIP+e Wi3/rGYz/7NsNv+rZCz/sWwz/7l3Pf+1dDz/r3E4/6dqM/+TWyr/ZDIP/0EbBP8oFQf/HRQN /w0MCP8NDAf/GREE/xkQAf8jHBL/LzQ3/0Jdcv9olb7/Y6Hc/1+n7/9lsf//BU6q/w9OwP8H Qbz/ATyy/wQ9sP8DPaj/CEKm/x5Ws/82bsX/UIfZ/1KH0/9QhM3/VIbN/1qNz/9jlNb/b6Di /3Om5/9+ufX/hMH6/4vI//+OzP//icn5/33A7f9yteL/aq7d/3K47P9wtPH/aa7z/1+i8f9a nfb/YqT//2Sn//9lov3/cqXe/4y32v++4f3/y+b5/77Q2v/Bz9D/w87K/8XQyP/F0sv/wM/K /8PT0v+/z87/wc/P/7zIxv+kraz/sbe1/9nb2v/9/f3//f39//39/f//////+fn5//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////7////+/////v////7////+ /////v////7////+/////v////n6/v/+/f//+/v9//Hx8////////////97f4/9weX7/WGNp /0pVW/9LWF7/SVZe/ztIUP80QUn/OEVN/zZETf82RE3/NUNO/zRCTf8yQEv/L0BK/y4/Sf8u P0n/KjxG/yo8Rv8qPEb/KTtF/yo7Rf8pOkT/KTpE/yk6RP8sOkX/LDpF/yw4RP8sOET/KzdD /ys3Q/8rN0P/KzdD/yo4Rf8vO0n/N0FL/8XO0//P19r/zdXX/8zW1//N2Nr/ytjb/8LQ0//E z9H/oaen/5+bmP+LgXj/mYZ4/7eXgP+/jmX/yZFi/8yYaf/RnnH/06J5/9Wkef/Wo3b/2KJz /9qgbv/Qk13/zI9Z/8SIVP+9h1n/rHtS/5xwS/+zlXv///70//7/+//18+f/7uPR//Dcwf/t zrH/68Cg//C7nP/gpIj/2Zl+/+Skif/eo4X/466M/++/l//iuYv/6cCU//HBnf/tu5j/4KyE /8mTZf+0fEn/rHM8/7Z6Rv/BhFX/x4xi/611Uv+eaUr/nWtQ/49hR/9sQyf/UisO/0wlCP9M Hgb/QxQA/zcEAP84AQD/UxcA/3w9Ev+dWyn/q2Ux/7NsNP+wai7/uHQ3/7x6Pf+1dTj/snQ3 /6tvM/+XXyz/ZTUR/0EfBv8oFQf/GxQM/wwLBv8MDAT/GRMF/xoSBf8jIBf/ISst/zNRaf93 qNP/c7Px/1+n8f9ns///LHXT/ylr4/8fYOD/G1vZ/xxd1f8cWcz/GVXD/yNexv81bND/VIvo /1CD3v9KfNP/Q3PH/0Fuw/9Cb8L/RW/D/0Z0wv9il93/W5LT/1WMzP9Vjcj/XpnR/26r4f+A vfP/icj+/3+//P+Ew///e7v//2qo/f9fnvv/YqD//2Wk//9vp///dqff/5jB4f/E5v//xuHy /7zP1v/F0NL/w87K/8POyP/F0c3/wM/K/8LS0f++zs7/wtDQ/7TAvv+mr67/tbm4/+Xn5v/9 /f3/////////////////+/v7//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7////+/////v////7////+/////v////7////+/////v////r7///19vr//f7/ //7////09ff/uru//3l9gP9DTlL/QlFW/0VSWP9CUVb/PElR/zZDS/84RU3/PElR/zNBSv8y QEn/MkBL/zE/Sv8yPkr/MD5J/zA8SP8vPUj/KTpE/yg6RP8oOkT/KDpE/yk6RP8pOkT/KTpE /yk6RP8pN0L/KTdC/yo2Qv8qNkL/KTVB/yk1Qf8pNUH/KDRA/yg0RP8nM0H/TFZg/8/Y3//S 2t3/zdfZ/8vW2P/J19r/0uHm/8bT2f/H0tb/m5+g/5uWkv+Edm3/oIp9/7OTfP/Dk23/zZdp /9Gec//VpHv/16d//9inf//Yo3n/2aBz/9mcbf/IiVb/w4RP/7N1Qv+sdEX/nmtA/5ptRv/M rpL////0//z//f/18eb/59rJ/+TKs//owKb/77yh//a6oP//ybD//8Gp///BqP/zup3/7LqZ /+zAmf/owZb/7sib/+29mf/lsYz/1aB2/8ONXv+5gkz/uoNL/8aNWP/Rl2f/nmQ8/5tjQP+m cVL/uIZr/7qMcv+ne17/kmtM/4tkRf9xRSr/aToe/1QjA/9DDgD/UBYA/3Q1Cf+TUR3/nlwi /7NtMv+0bjD/vno7/8B8Pf+2dTX/tnY4/7BzNP+ZYiz/ZTcV/0AgCf8mFAb/GhML/wsLA/8M DAL/GhQG/xsVB/8mJx//SFVb/0hqhf95rdz/bK3t/12n8v9lrf//S5Tw/zN56f8xdu//Mnfu /zZ57P80dub/MG/Z/y9t1P80btL/Rnzg/0l+3v9ai+r/X43r/2CM7f9eiej/Unra/0141P8m Vqr/Om66/1CE0P9QhtD/QXfB/zVtt/84crv/QX3G/1GM2v9cmen/XJju/1iV7v9hnvv/aKf/ /2up//90rv//eqrb/6LJ6P/L6///w93s/7vM0//H09P/w87K/8HMxv/G0s7/wM/M/8LS0v+9 zc3/w9HS/623uP+nsK//uLy7//Dy8f/8/Pz//////////////////Pz8//7+/v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7////+/////v////7////+/////v// //z////8////+f3///z////w8/j/8fT5//P2+/+zt7r/XmFm/z5GSf9JV1r/QFJW/zhHTv8v QEf/N0ZN/0BPVv8+TFX/NEJL/y46Rv8uOkb/LjpG/y46Rv8wOUj/LTlH/y84R/8tOUf/KDlD /yc5Q/8pOkT/KTpE/yo7Rf8qO0X/LTtG/y07Rv8pNUH/KTVB/yg0QP8oNED/KjRA/ykzP/8p Mz//JzM//yczQ/8eKjj/ZG54/9DZ4P/V3OL/z9nb/8vW2v/G09n/0N/m/8LR2P/I0db/l5uc /6Kal/+LenD/tp+R/8Siif/LnXn/06B1/9WkfP/Xp4H/1qaA/9Gfev/OmXH/zpNn/8yMXv+9 e0n/vHpG/6prOP+kajz/mmU7/6J1Tv/szbD///fq//399f/78eX/7dbG/+TAqv/uvKP/+Lyi //q4oP/1sZr/87Kc/+irlv/ospr/5rmc/+bAnP/vzaf/8c6k/+y8mP/gqoT/y5Zs/7+JWv+/ iFL/x5BY/9KZZP/Ynm7/0JZu/611Uv+PWjv/kV9E/6h5Xf+zh2r/pXxc/5NqSv+VaUz/jmFC /4JRMP91QRr/dDsQ/4BDFP+TUhz/n10h/7NtMf+3cjH/w349/8J+Pf+3djT/t3c3/7N2N/+c ZS//ZjkY/0AhDP8lFQj/GRII/woKAP8MDAD/GRYF/xoYCf83PDX/hpmg/2OKqf9tpdb/XaLl /2St+v9dpff/VZ3y/1yi//9Umvz/Q4np/zN32P8tb8//MHHP/zV00f84c9H/P3fW/zlv0f9B ddj/PW7U/z9u1v9KduH/RnDc/0154v9Xh+n/Z5n4/2+h//9Xi+7/LGDG/wtAqv8FOqT/C0Gt /xdNuf8dVr3/G1W5/yViv/9Kh+D/YKH1/2Kj9f9ppun/fazW/6vQ6//Q7///wtrm/7rM0P/J 1dX/w87K/8DLxf/G0s7/wM/M/8HR0f+9zc3/xNLT/6exsv+rsbH/ur69//n7+v/8/Pz///// /////////////f39//39/f////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7////+/////v////7////+/////P////z////8////+v7///H2+f/7////8/j8/56jp/9N VVj/P0ZM/01WW/8yQUb/M0VJ/zZHTv82R07/MkNK/y4/Rv8sOkP/KzlC/yo2Qv8qNkL/LDZC /yw2Qv8sNUT/LDVE/yw1RP8qNkT/KDlD/yc5Q/8pOkT/KjtF/ys8Rv8rPEb/LjxH/y48R/8o NED/KDRA/yczP/8nMz//KTM//ygyPv8oMj7/KDI+/ygxQP8aIzL/dHyH/87X3v/X3uT/0Nrc /8zX3f/D0tf/w9Tb/7jHzv/DzNH/mJqZ/6qhnP+Yhnr/0LWk/9u3nf/SpID/16Z9/9iogP/X p4H/0qJ+/8uXcv/EjWb/woRb/8B9UP+zbz7/uXVE/6poNv+laDv/nWg8/6x8Vv//4sP///3s ///77//75tX/48Cs/9upkv/rr5X//Lad//qymv/4tJ3/97mk/+OsmP/pu6T/8Miv/+3Lr//5 3Lr/9NSu/+6+mv/fqIH/ypFm/7+HVv/DjFb/z5Zh/9eda//Zn3H/3qR+/9igf//Fj3P/pXJX /4hZPf+BVDX/iV48/5RpR/+fclP/nG5N/6BuS/+lcEj/oWg7/51fLv+nZi7/uHM4/7JsLv+5 dDP/xoE+/8N/Pv+5dTT/uHg4/7Z2OP+dZjD/ZDsb/z0iDf8lFQj/GBEH/woKAP8MDQD/GhcE /xgZCf9KU07/mbG7/1qHqP9npNr/Zavx/2i0//9Wne//bLD//1qe8f9lqfr/bK///2qt/P9q rf7/bK39/2Oh9P9UkeT/RoLY/z940f9Hf9z/P3XV/z5y1/9Fed//PG3W/0F03f8yZsz/NGjO /zht1/8+cuL/QHTq/zlt5/8rYd3/IFbS/yJa0/8aVsj/CEWv/xJTsf9Dhdv/Zaj2/2Wr8f9p p+D/gK7S/7HT7P/V8P//wtjj/7vKzf/K1tT/w87K/77Kxv/E09D/v8/O/7/R0/+8y87/xNLV /6Sur/+rsbH/u7++///////8/Pz//////////////////v7+//39/f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7////+/////v////7////8/////P////z////7 ////7vP3//n////k6/H/ho2T/0hPVf9HUFX/SVJZ/zQ/Rf81REn/MkNK/zBBSP8uP0b/LD1F /yo7Q/8rOUL/KjhB/yo2Qv8qNkL/LDVE/yw1RP8tNkX/LTZF/y43SP8sOEb/KDZB/yY3Qf8m N0H/JzhC/yk3Qv8qOEP/KjhD/yo4Q/8rN0P/KjZC/ys1Qf8qNED/KTM//ygyPv8oMD3/JjA8 /x8pNf8fKTX/p7C5/9fg5//Q2d7/ztnb/8jV2//L2t//yNng/8TT2P+2wML/nJyc/4d9dP+4 pZf//+PO/+zHrP/ZrIX/2Kd+/9CgeP/Hl3H/voxp/7aCXf+zeVP/s3RL/7p2Sf+wajn/r2k4 /6VjMf+maTz/oWxA/7eKY///9NL///Pb//Hbxv/hvaX/4a+W/+qqjv/tpoj/7qGF/+qehP/q po//46aT/9Sjkv/Rq5j/7M24///t1v//79P/9te4/+i2k//Nk2v/yY5i/8uRYf/Mk17/ypFc /8WLWf/TmWv/46mD/9+nhv/ZoYb/zZd9/7qHav+jclT/jmA+/4FVMv+db03/oXBP/6h0T/+v eE//tnxO/71+S//Bfkf/xX9D/795O/+7dDT/vXg3/7x4N/+2cjP/tXU3/6trLf+KVSH/Zj8g /zAXA/8OAAD/HRcL/xkXCv8HCAD/DAoA/2BjUv++ysb/aoiT/2qcwf9ur+f/Xafw/1+q+/9X nvD/X6Lx/2Wl7f9rqu//YaDl/2Oi5f9hoOX/YaDj/3Kx9v91tPn/cK/2/2Wl7f9ZmOX/X57t /2il+P9jn/X/U5Ho/z981/88dtf/OXLZ/zZv2v85ceL/Pnbt/0J69f8+ePX/OnTx/z568v8n Ztf/KmvT/zJ31P9aofH/Xafu/2ey8/9qrOD/kb7f/8no/P/E3u3/us7X/8TU1P/Bzcv/wczI /8TQzP+6yMj/wtLS/7/R0/+9z9H/v83Q/5Odn/+2u77/29/g//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7////0 9ff/9/j6//v8/v/z9/r//P////v////k7O7/+f///87Y2v99hov/TFVa/0JLUv9ET1X/P0pQ /zNASP8yQUj/L0BH/zA/Rv8sPUT/LDpD/yo4Qf8pN0D/KDY//yo2Qv8qNkL/KjZE/yo2RP8t NkX/KzdF/y43SP8sOEb/KjhF/yg5Q/8oOUP/KDlD/yo4Q/8rOUT/KzlE/ys5RP8qNkL/KjZC /yo0QP8oMj7/JS87/yMtOf8jKzj/Iio3/zA6RP8vOUP/t8DH/9fg5f/M1tj/yNPV/8LQ0//B 09f/xNXc/8XU2f+yvL3/np+a/46Eev/RvKv//+vU/+/GqP/To3v/0aB1/8uacv/DkWz/uohj /7V/W/+zd1L/tHNJ/7dwRP+waDj/sGo3/6hmNP+sckT/qHVK/9CjfP//9tL//+TI//DLsP/g r5H/4aKD/+idff/smXn/65h4/+aZe//YlXv/wIl0/8CVgv/Yt6T//+jV///v2v/138j/48So /96ph//PkWj/zo9j/8yOXf/Mjlv/y49b/8eLWf/TmGz/6KyH/+uwkP/utZr/77ee/+q0mP/g rY7/16WC/8+fe/+8imf/vYlk/76HYP+/hlv/woRV/8WDT//Jgkr/y4NI/8F6PP+7dDb/vHU3 /7p0Nv+0cDP/tHQ3/6lrMP+JUyT/aEUn/yYPAP8XCwD/HRcL/wgGAP8eHQv/Y2JN/7m9rP+P op7/XYGP/2Sbwv9mrOj/Y6/6/2i1//9ipvn/dbT//4nD//+Nxv//gLn+/363+v90r/H/ZaLh /2ak4f9cnNn/ZKTh/2qs6P9qruv/Zano/1uf4P9XnN3/Yabp/2qu9/9np/7/ZqL//2Gd//9a mP3/Uo/5/0eF8v88euf/NHTg/zR34P8wddr/QYfm/0yW6/9qtv//arf//2+9//9ws+j/lcDg /8rn9//F3en/u87U/8XT0//Bzcn/ws3H/8TQzP+7ycn/v9HT/77R1f++0NT/uMXL/5ulp/+0 ubz/4eLk//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7////5+/r//P79//7////5/f7/8/f6//b7/v/5////ztXb /3+Ijf8+R07/NkFH/z9JUv80QUn/LDlB/zE/SP8uO0T/LDpD/yw5Qv8qOEH/KjdA/yg1Pv8n Mz//JzM//yk3RP8pN0T/KTdE/yk3RP8rN0f/KjdH/yw4SP8rOUb/LDpH/yw6Rf8sOkX/LDpF /yw6Rf8rOUT/LDhE/yw4RP8qNED/KTM//ycxPf8lLzv/Iys4/yEpNv8fJzT/HiYx/zI8Rf87 Rkz/xM3S/9Hb3f/L1df/zNfZ/8rZ3P/I2tz/wtTY/8XU1/+tt7b/np+Z/4+Ddf/Ywq3//dvA /9uwjv/Il2z/yJVm/8OQZf++imL/uIJc/7Z8V/+0dk//tnNJ/7FqPv+vZzf/sGo3/6poNv+0 ekz/sYBV//DEnf//8s7/+cyr/+a0k//bnHn/3ZNu/+OOaf/ghmH/2oVg/9WJZ/+0dVb/pnRZ /8WfiP/u0rz///rk//njzv/kybT/2bWb/+Gphv/dmnD/1pZo/8aGVv/DhFH/zI1a/8+RYP/h pHj/46SB/+eqjf/wspn/9rqi//W8of/xupv/67WR/+exi//bo37/1p94/9GWbv/LjGD/yYVW /8mCTv/KgUr/zYJJ/8V6QP+8cTf/uHA1/7ZwNf+xbDP/sXA4/6ZnMf+ETyP/UC4T/yIPAP8i Fgr/GBIE/ysqGP9/fmr/ubmh/6Cplv9OZGH/UXiJ/2OgzP9irOv/Y7L//1Sg9P81ecz/RoPW /1WJ3/9omO3/cKP2/4a5//+Rx///jsf//5TQ//+Ny///hsf9/3e77P9psN7/ZKvZ/2av2v9m sdv/XqnT/1ih1P9rrvT/aqz6/2ao9v9jpfP/YaLy/2Om9f9orfv/a7L//2Oq+v9jrPv/arP/ /2Ov/f9rt///ZbL//2e0//9qrOn/ncbm/8vl8v/E2+P/vc/T/8TT0P/BzMb/wc7H/8HQy/+8 zMz/vM7Q/77R1//A0dj/rrvB/6avtP+0uLv/6Onr//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////n7+v/3+fj//v// //z////1+fr/+f////X9///W4OL/WWJn/0ZRVf87Rkz/OkdP/zdETP8rOUL/JzU+/yw6Q/8p Nj//KzU//yo0Pv8oNT7/JzQ9/yYzPP8mMj7/JTE9/yk3RP8pN0T/KTdE/yk3RP8qN0f/KDhH /yk5SP8pOUj/Lz1K/y48R/8uPEf/LTtG/yw6Rf8rOUT/KzdD/ys3Q/8lLzv/JS87/yQuOv8k Ljr/JCw5/yMrOP8jKzj/Iys2/zI7Qv9RXGD/0Nrc/83X2P/M1tf/zdnZ/8/f3//M3uD/xNjZ /8LS0v+nsq7/np6U/4V4Z//BqY//0q6O/7qOZ/+/jF3/v4tb/7yIWf+4g1f/tn9Y/7V6Uv+1 dk3/uHNJ/7FoO/+yaDf/smo4/6tpN/+4f1L/todd///btP//5MD/57WS/9qeev/WjGf/3Ihj /9yAV//NcEf/wGhA/7luRv+UWDP/soZj//LRsv//7dL///LZ/+XJsf/gvaf/47Wb/+iphv/m nnb/1JBj/7ZyQf+xbjr/vnxK/8iIWP/io3j/6KiF/+yskP/zs5r/9rif//W5nf/wtZf/6a6M /+SqhP/lqoL/36F4/9WUav/MiFv/xn5O/8Z6SP/HekT/yntD/8h5Qf+6bTX/tms0/7FqNP+t ZzT/rGo4/55eLv95RR3/MhIA/yMRA/8gFgr/KCUW/4SDb//JyLP/paeP/zpGMv8iPDn/TnuO /2io1v9bqev/W6z9/zmH3P8ISp7/FU6n/yVXuP82Y8j/NmfG/0Bxzf9Cdsr/Q3vI/1iR2P9e mtn/ca/o/26w5P94uur/er/p/4DI8P+J0ff/hM7z/4jR/v95u/j/d7f+/3Gy9v9oqev/YKTl /2Ck4/9lq+n/arHx/264+f9ttvr/abT4/2Gr9P9jr/v/Z7P//2q3//9xsfH/ps3s/8zk8P/E 2N//wM/S/8XRzf/Ay8X/ws/I/8DPyv++zs7/us3R/77R1//C09r/o7C4/7G6v/+3u77/8PHz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////n7+v/w8vH//P////n9/P/v8/T/+////9jg4/9faWv/MzxB/zhDSf82 Q0v/LDtC/yo4Qf8tPkj/LD1H/yg2Qf8oMjz/KTE8/ykxPP8oMjz/KDI+/ygyPv8mMkD/JjJA /yk3RP8pN0T/JzdG/yc3Rv8oOEf/JzlH/yg5Sf8oOkj/LT1K/y48R/8tO0b/LDpF/ys3Q/8q NkL/KjRA/yo0QP8fKTX/ICo2/yIqN/8jKzj/JS06/ycvPP8pLz3/KDA7/zM8Qf95g4T/3ebl /83X1v/M1tX/xdTR/8fX1v/B09P/w9fW/7jIx/+jraX/oKCU/4N0X/+pkHL/soxo/6+CWP+8 iFb/vIdR/7qFU/+3gVL/t35T/7d6Tv+4eEz/vHVJ/7ZsPf+2bDv/sWk3/6prOP+5g1X/u45k ///guP/706//2aOB/8+Na//QgF3/2YFb/9R0Sv+7XDD/pk8i/59VKP+PWS3/1qyC///60/// 8c//8dKz/9q1mP/ltpz/6rGU/9+Zd//flGz/zoVY/69nN/+rZTL/sW08/7RwQ//OimP/4Z99 /+alif/vrZX/9rSc//e3nP/ztJX/7q+M/+qqhP/ioXn/3Zhu/9WMYf/LgVT/xnhI/8V1RP/H dkH/yXhD/8Z1QP+5aTT/smYy/69lNP+nYzT/o2M3/49QJ/9jMQ7/LA0A/yERAv8ZEQT/WFVG /8vKtv+lpY3/Sk0y/yAtG/8hPjz/WYmd/2mt3P9Xp+z/Wqz+/0CN5f8WWK7/JV26/xNGs/8c S73/EUGv/w0+p/8IPJ//F0yo/0Z90P9hmeb/NXC2/zRwr/9Hg7//S4i//1aVyv9op9r/Z6bZ /3Oy6P+Avfz/g8D//4fE//+Jxv//hsb//4PD//9/wf7/e7/8/2et6/9kqer/XqXn/2Op7/9n r/f/brb//2ex+v9rqeT/sNXw/8zj6//D1tr/wtLR/8XRzf+/ysL/w9DJ/7/Oyf+8zs7/us3R /7zP1f/B1Nr/nKmx/7a/xP+/w8b/9/f5//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////z+/f/+////8vb1//L29f/7 ////09zb/211eP8uODr/P0pQ/zpHTf8wP0b/JTY+/yEyPP8jNT//JTdB/yY3Qf8oMDv/KS87 /ykvO/8pMTz/KTE+/ykzP/8pMkH/KDRC/yk3RP8nN0T/JzdG/yY4Rv8nOUf/JjlH/yc6Sf8n Okj/KztI/yw6Rf8rOUT/KTdC/yg0QP8mMj7/JjA8/yUvO/8cJjL/HCYy/x4mM/8gKDX/ISk2 /yIqN/8lKzn/JSw2/xwmKP+Vn57/2OHe/83Y1P/R3Nj/x9bR/8jY1f/C1dP/wNTS/6y8uf+f qaD/oJ6P/4x9Zv+ojW//r4li/7yNX/++iVP/v4hP/76HUf+8hFP/uoBS/7t8UP+8eUz/v3hK /7xyQf+7cj//sWk3/65uPv+9iVr/xptw//7ctv/zzan/0Zh6/8eAYP/Gc1H/0HRP/8dmPP+r TB7/m0UU/5lRH/+lcT//58GQ///yxP/427H/1K6H/9Wng//go4T/4Jt6/9GFYf/XiWL/04Za /8J4Sf/FfUv/vHZF/6pjN/+7dk//1I9u/9iVev/inof/6aWO/+ypj//ppon/46F+/+Gddv/d lmz/2o9l/9SHW//PflH/ynhI/8h1Q//KdEH/yXZC/8RxPf+2ZDL/sGIy/61jNv+kXzb/mVgy /309Gf9KFwD/JgkA/x8RBP8gGAv/fHlq/8/Ouf9paU//EhUA/zRBL/82VFL/YpWq/2uz5f9d sff/Yrf//1Ge9v81dcz/OHDP/zJn2f87b+f/Mmbc/y1h0f8mWsf/K2DG/1CF5f9jmfP/Y5fr /1CF1f9QhdP/PXG8/zltuP9EeMH/OW22/0N3wP9Jf8f/Rn7I/0iAyv9Ti9b/Y5vo/3Cp9v93 sP3/d7L+/3+9//9xsfn/ZaXt/3Cz+f9vsvb/brP0/2Sq6P9tqtn/ud3z/8rh5//C1Nb/xNLS /8XQyv++ycH/xNHK/77Nyv+8ztD/vdDW/7jM0/+/0tn/mqev/7S9wv/Oz9P/+vr8//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7//f/+//3/9vr5//L29f/b4eH/cnt6/yYuMf8+SEr/O0ZM/zNARv8wP0b/LT5G /yQ1P/8ZKzX/HS87/yk6RP8oMDv/Ky87/ywvPv8rMT//LDJA/yw0Qf8sNUT/KjZE/yk2Rv8n N0b/JjhG/yU4Rv8mOUj/JDpI/yU7Sf8nOkj/KTlG/yo4Q/8pNUH/JjI+/yQwPP8hLTn/ISs3 /yAqNv8cJDH/HCQx/xsjMP8ZIS7/GR8t/xcdK/8WHCr/FRwm/wAKC/+ptLD/zdbT/83Y0v/X 4tz/y9rV/8rd2f/G29b/vtPO/6S1r/+apJn/k5KA/5SEa/+zlnb/uJFo/8GRYP/FjlX/xY1Q /8OKU//BiFP/wINU/8CAUv/BfU7/w3tL/8N3Rf/AdEL/sGo3/7R2Rf/FkmP/166C//ras//3 07H/zpd5/753W/+3ZET/vmE//7ZVK/+hQhT/nEkX/6dhLf+8iVL/3LeA/+LCj//cuor/vZFk /8ySav/Lg1v/zX1Y/8NxS//Idk7/y3xR/86BU//akF//xn5O/6NcMP+xbEX/zodn/9ONc//c lX//45yG/+Wfhf/inX7/3Jh1/9uTbf/VimL/1YZb/9OCVf/Pe03/y3VG/8ZwP//EbDr/w2s5 /8FrOv+zYTH/rmAy/6xhN/+hXDX/kU8s/2sqCv8zAAD/HwQA/xcJAP8sJBn/iIV2/5uZhP9B QSf/FxoA/zxJNf9WdnX/ap60/2i05v9huP//ZLr//16r//9QkOf/Rn7d/zBp2v83cur/M27k /zt05/88dOX/O3He/0h95/9Ke+L/Y5P5/2GO9f9xnP//Unzi/zphyP89ZM3/PmPN/12E6f9d iuX/RXXK/yxbtf8hUrH/KlrA/zdoz/89btf/Om7U/1yS9v9Ujef/VI7g/3Kx+P9ysu//cbXm /26z3f+JxOL/wOTy/8vg5f/C0dT/xdTR/8TPyf+9yMD/xdLL/73Myf+7z9D/v9TZ/7XJ0P+9 0Nf/m6iw/7C5vv/a29///Pz+//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////f///v////////7////c4N///P///+rw8P9rcHP/LTU3 /z9JS/8xOj//MTxC/yg1Pf8mND3/KTpC/yc4Qv8fMTv/ITM//yw6Rf8pMT7/LDA8/ysxP/8s MkD/LjRC/y42Q/8uN0b/LDhG/yk2Rv8nN0b/JjhG/yU4Rv8mOUj/JjlI/yU7Sf8nOkj/JzdE /yg2Qf8nMz//JDE6/yEtOf8fLDX/Higy/x0nMf8dJTD/HCQv/xggK/8VHCb/EBch/wwTHf8L Dxr/Bw4W/wAFB/+/ycj/zNXS/9Ha1f/a497/yNXO/8LSz/+8z83/v9PR/6Kyr/+WoJj/hIJz /5SEa/+6nHr/vZJn/7qGVP/Kk1r/yZFU/8ePVv/Ei1b/xIZV/8KCUv/Df1D/xHxM/8R6Sf++ dkT/rms3/7h8Sv/Lm2v/5byO//vcsP//3bb/z5d2/7tyUv+rWDb/rVMw/6dKIf+aPxL/olIh /7VzP//Ek1v/yqNs/7yZY//KpXH/sX9O/79/U/+0ZTr/wGxA/61cL/+sXjD/smQ0/75yQf/T iVr/vnRH/5hPJv+pXzr/uXBQ/8B2W//JgWj/1I1x/9mScv/Zk2//2JBo/9eMZP/TgFj/1HxU /897T//Jd0j/w3E//7xrNv+3ZS3/tmEq/79qM/+0Xiv/sF4u/65hN/+gWjb/i0oq/1siB/8i AAD/JAkA/woAAP8uKh//jIyA/15gS/8WGgD/IyoL/0lYRf94l5r/cqXC/2St4v9esvj/Y7b/ /2y5//92tP3/aqPy/2qq//9fov//SYrw/0aF7P9FgOb/O3XZ/zlw1P8tYcb/QnPZ/zVkzP9J deL/Qm3d/0x16f9ii///VX32/2OO//9glPf/P3bT/xtQtv8LP6z/EEG3/xpIwP8ZRcD/Ej63 /xRGuf8bUbv/M3DN/2uq+v9sre3/aKjY/2Wkx/+KvNP/xubx/8zf4//A0tL/xdTR/8PPy/+8 yMT/w9LN/7zMy/+6zs//wNXY/7THzf+9ztX/naqw/620uv/g5Of//Pz+//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////v////7////+ /////v/////////////////////////9/Pr/9fTy/////f////3///78////+//69vX//f39 //D09//7////3OHl/2VtcP8lLDL/O0RJ/zY/RP8kLTT/KTQ6/yc0PP8mMzz/JDI7/yQyO/8j MTr/IjA7/yIwO/8mMDz/Jy88/ykxPv8pMz//KzVB/yw2Qv8rN0X/LDhG/zA+S/8uPEn/KztK /yk5SP8pOUj/KDpI/yg5Sf8pO0n/KzlE/yk3QP8mMzz/Ii83/x0qM/8YJS3/FyIo/xYfJv8S GR//HiUr/xAXHf8QFRn/CxAU/wYLD/8MDxT/AAIF/wsUGf/L1tj/0NbW/9LX0//L0Mz/zdPP /8/b2f/F1dX/vtHV/6S2uv+bpab/f391/52Ndv+ujWz/t4hc/8iTX//Dj1b/w49W/8aPV//I j1r/zI5d/8uLW//Khlf/x4NU/8eDVP+4eEj/wYVT/8aRX//WqHb/6cGN//TTnv//7br/v4JV /7FoPf+dSyP/gy4H/5M7Ff+vXDT/tmtB/8eJWv/PnWz/vpVh/6uDT/+1ilf/rnlH/7JwQP+o Vyr/qFYm/6daIv+nXyX/rmUu/7JpNv+pXzD/m1Am/5dLJ/+dUTH/o1Y4/8F0Vv/Zjm7/25Fs /9WMYf/TjVz/04xY/9OFVP/UdlD/13ZT/896Uf/JfUz/wHtC/7d2Nv+zbiv/s2gk/7dkIP+4 YCD/rFYd/6NRIv+RSyf/Zi0Q/zgLAP8kAwD/GgQA/xsPAP8dHBf/UVhR/0RPPv8GFAD/AA0A /5Chj/9tiZf/gq/Y/22x7v9puvz/X7Ht/2Wx5f9wrdr/dK7e/2yx8v9suf//cLr//3C4//93 u///e77//3Gx+f9fner/T4nb/0yF3P9Ef93/PXfb/zp04P87d+n/O3jt/zh36P8zfNv/MXzZ /zB54v8wc+b/L2vn/yxi4P8tWNj/KVXQ/yVX0P8IRLb/LHPd/1mj//9prvz/bqzp/3us1/+h xuD/0ur0/8jc3f+9z8//vdDO/77Rz/+7zsz/u8/N/7/T0v/A1NP/u8/Q/7jKzP+2xMf/oKmu /6+3uv/x9Pn//v////7+///+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////v////7////+/////v////////////////////////////3////9 //j39f////3//fn2//by7////vv/6enp//v////n7vT/bXR6/ztCSP9ASVD/KjM6/ys0O/8k LTT/KTM8/ygyO/8mMzz/JTI7/yUyO/8kMTr/IzE8/yIwO/8lMT3/JzE9/ygyPv8qNED/KjZC /ys3Q/8sOEb/LTlH/y89Sv8vPUr/LjtL/y06Sv8rO0r/KztK/yw8TP8uO0v/KTdC/yg1Pv8k MTn/IC01/xsoMP8YIyn/Fh8k/xQdIv8TGx7/ERkc/wcMD/8LEBP/BwsM/wMHCP8NERL/AAIF /y04PP/V4OT/09nZ/9XZ2P/S1NH/z9TQ/83X2P/G1Nf/vs/W/6Gyuf+Zo6T/f393/6iWgP+3 lXL/xJRk/9KbZf/Kl2D/yZZf/8qVX//Mk17/zpBf/82NXf/Milr/yohY/8ODVf+/gVL/zJRj /86aaP/XqXX/5r+I/967g///5q7/0JRg/7NrO/+XSh7/mkgg/59LJv+2Z0D/xX1V/9uccf/U oHH/16l4/8CSYf+mdEP/qmw9/8R7Tv+3YDX/jjgJ/30wAP+AOAD/jUQN/5tSH/+eUSP/l0og /5pKJf+hUS7/o1Mw/7hoRf/Mflj/04Zc/9CGV//Ng1L/y4JN/899Tf/Uck3/1nJQ/852Tv/D eUj/uHo//7B1Mf+ubib/sGge/7dlG/+5YBz/rlQY/6FPH/+MSCP/XCkO/ywJAP8bAQD/FQMA /xUJAP8aGhj/SlVR/zFCL/8PIgT/cYFd/5+yn/9hfI3/gq3a/3S19/9ruP7/bLz3/2Ov4f9r qNX/drDe/2qs5v9utfP/b7Xx/2es5/9lp+H/a6zm/2+w6v9wruv/b6/v/3Oz+v90tv//brL/ /2Gm//9Smvz/SJH3/0KO8P82htv/MYPX/yx83/8rdeL/Lm/l/zdt5/9BbuX/RnDm/zBl1/8r a9n/Spf//1+v//9eqfz/ZqPk/3+r2P+wzur/0unx/8ja2v+80M//vNDP/7zS0P+5z83/utDO /77U0v++0tH/vM7O/73Nzf+yvb//oqyu/7W9wP/1+P3/+f3///7+///+/v7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////v////7////+/////v// /////////////////////////////////////f/39vT///78/////f/39vT//////+vw9P99 hIr/MzxD/ys0O/80PUT/MjtC/yMtNv8fKTL/JzE6/ycxOv8lMjv/JTI7/yQyPf8kMj3/JDI9 /yQyPf8mMj7/JzM//yg0QP8qNkL/KzdD/y05Rf8uOkj/LztJ/y89Sv8wPkv/MD5L/zA+S/8x Pk7/MT5O/zA9Tf8wPkv/JTI7/yYwOf8iLDX/HScw/xkkKv8VHiX/ERof/xEYHv8SFxv/BgsP /wADBv8FCQz/AgMH/wMECP8ODxH/AAEE/15pbf/d6Oz/0dnb/9Xb2f/V2tb/z9XT/8vV1P/H 1db/vM7S/5+usf+XoJ3/gH5x/7OiiP/Bn3n/1KRz/9qmbf/Vomv/1KFs/9Kdaf/Rl2X/z5Nh /8+PX//Qjl7/0Y9f/8WFVf/Iiln/159s/9Wibf/arXb/5r2F/7yYXv//3KT/6LF7/7JwPv+M Qxb/ql0z/7prRP/Vh2H/45t1/+Cfd//lrIH/2qZ3/8WPYf+maTz/oVgt/6VSKP+xTyj/qUcg /5dDFf+KPAz/hjUI/4U0B/+GNQj/jDsO/55LH/+wXTH/pVIm/6tYLv+3Zjv/xnVK/8x6Uv/I dk7/w3RL/8dySf/PbUr/z21I/8dwRf++ckD/tHI2/65vLP+taSL/rmQb/7djHf+4Xx3/rFMZ /55NHv+FRSH/VSYM/ycIAP8WAwD/FAIA/xcNBP8TFBb/RE9L/0dWQf8zRyT/scGa/4qehf9j f43/hK/a/3Kz9/9ksf//ZrX//16r8/90sPn/kcf//3ev+f9+t/7/gLn+/3mw8f9wqOX/cKjj /3Kr4v9yq+L/bKje/2+u5P9ytO7/cLb0/2ey8/9grfH/X6/2/2Oz+P9uufr/a7b6/2Ou//9e o/7/W5b6/1eL8f9Wgef/UX3g/0yC5P9WmPn/ZrT//2O3//9eq/n/ZKTi/4Ov3P+11PD/z+bu /8XX1/+7z87/vNDP/73T0f+60M7/utDO/73T0f+7z87/vc/P/8DQ0P+ptLb/prCy/8DIy//7 /v//9fn8//7+///+/v7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////v////7////+/////v/////////////////////////8/Pz//Pz8/////f/z 8vD////9/////f/q6ef//v///4GGiv8uNTv/ND1E/zdAR/8nMDf/MzxD/ycxOv8hKzT/JjA5 /yQxOf8kMTr/JTI7/yQyPf8lMz7/JTM+/yUzPv8pNUH/KTVB/yo2Qv8sOET/LjpG/y87R/8w PEr/MT1L/zA+S/8xP0z/MkBN/zRCT/80QVH/Mj9P/zA9Tf8wPEr/Iiw2/yEqM/8eJzD/GSIr /xQdJP8RGCD/DRQa/w0SGP8JDhL/AQQJ/wIGCf8CBgn/AAAE/wQFCf8KCw3/AAEE/4qTmP/b 5ur/y9PV/9HX1//V29n/0NbU/8nT0v/J19f/uMjI/56qqP+SmZH/f3xp/7ilhf/CoXb/3K13 /96qcP/dqnP/3ap1/9umdP/Wnmv/0pZk/9CSYf/SkmL/1JRk/82NXf/Mjl3/1Z1q/9Geaf/e r3n/6r+I/6F6Qf/60pf//86Z/7t/Tf+STyL/olsx/7RqQ//EelX/5qF6/+Sje//SlG3/xIlf /8+RaP/OiWD/yXdR/6RGIv+mPhv/rkYj/5xCH/+SPhr/kz4Z/5lEG/+cSBr/nUka/6VSIP+w XSn/qFUj/6JPHf+nUyX/uWU5/8VwS//Ba0j/vWlH/8JpR//HZkP/xmY+/7xoOv+2aTX/r2ku /6pmJ/+rYh7/rV4b/7VeG/+2XB7/qlMd/5pNH/+BRiT/UykQ/ygOAP8bDQL/HQ8G/w8HBP8O DxP/Iiso/0NSO/+rvJj/fY9l/3uSeP9ykJv/g6/c/22t9f9lsf//Po7n/z+K5/9Wlfb/caf/ /3Sm//98rP//hbX//429//+Rwv//j8D//4e79f+Atev/drDi/2+r3f9pqdn/Zavc/2Ks3f9d qdv/Xa3g/2az5/9pseP/bLHq/2+09/9ytP//d7H//3mr//96p/r/dqX3/2yk9/9ssP//Y7X/ /1+0//9otv7/ba/p/4i13/+21u//y+Lq/8LU1P+7zc3/vdHQ/7/T0v+70c//uc/N/73R0P+6 zMz/v8/P/8HP0P+hrK7/rLS3/9HW2v/8////8/T4//7+///+/v7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+Pj4//b29v///////f39//7+/v/8/Pz/mZqc/yMoLv86Q0r/KDE4 /zI7Qv8xO0T/GyUu/yw2P/8qND3/Ii84/yMwOf8jLzv/IzE8/yUzPv8mND//JjQ//yc1QP8r N0P/LDhE/y05Rf8uOkb/MDxI/zI+Sv8zP0v/Mz9L/zE/Sv8zQUz/NUNO/zZET/80Qk//MT9M /yw6R/8rN0P/HSUw/xwjLf8ZICj/FBsj/w8WHv8NERr/CQ4U/wgLEv8AAgf/BQYL/w4PFP8F Bgv/AAAE/wgHDP8GBQr/AAAF/6Wus//S3eH/xMzP/8bO0P/Q2dj/ztfW/8nT0v/N2df/r767 /5ynn/+MkIH/fnhg/66adf+3l2j/0aRp/9SiZf/aqHP/3qp4/9+pev/bo3L/1Zhp/9CSY//S kmL/1pZm/9aWZv/JjVv/zJNe/8qVX//mtX3/676F/41lKv/qwIb//+Su/8aRX/+laz3/mFku /5ZSK/94NA//rWlE/9ybdf/Dg1//w4Jc/8+JZf/LfVn/1n1b/8djQ/+/UDL/qTwf/6ZGLf+e RCr/oUgq/6pSLv+vWCv/rFYj/61YIv+xXCP/r1oj/6JNF/+hSxr/sFku/7xkQP+7YkT/uV9H /71iR/+9Xzn/u2Az/7NfMP+sXyv/qV4l/6dcIv+qWhv/rFgY/7JYGv+0WSD/qFIh/5dOJf98 Ryf/Ty0U/ykYCP8iGg//GRAJ/wUAAP8FBgr/AAQA/5mnjv+esIr/mauB/1tzWf9/oa3/fq3b /2qq9P9tuP//E2PG/w5Yxf8WVM3/GE7I/zJl0v86atD/RXbV/1aF3/9jk+f/b6Ds/3us7/+B tfH/ksb//4W98P9/vOv/hsXx/4fK9f+Axe//esHt/37D7f9xsNz/b63e/2ip4/9opeb/bKLq /3Kk6/96p+r/ears/3m0+P9ssvj/Vqrz/1uz+/9tvP7/cLPo/4+85f+83PX/yNzl/7/R0f+6 zMz/vdHQ/8DU0/+80M//us7N/7zQz/+5y8v/vs7O/73LzP+eqav/sbm8/+Hm6v/8////8vP3 //7+///+/v7///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////v7+//v7+//+//////// //v9/P+ysrT/NDg7/y00Ov8tNj3/Ji82/yQtNP8fKTL/HScw/ygyO/8qNz//IC02/yEuN/8h Lzr/IzE8/yUzPv8nNUD/KDZB/yk3Qv8sOkX/LjpG/y87R/8xPUn/Mj5K/zRATP81QU3/NkJO /zNBTP80Qk3/NkRP/zZET/8yQEv/LDpF/yUzQP8jLTn/GSAq/xkdJv8XGiP/ERUe/w0QGf8I CxT/BQgP/wUFDf8AAAX/BwgN/xMUGf8GBwz/AQAF/wcGC/8EAwj/BwoP/7nAxv/L1tz/w8zR /8DKzP/L09X/zdfW/8jU0v/N2dX/p7Ks/56mmf+EhnH/fXRV/5iCWf+ggUv/uY1Q/8CQUv/Q nmv/2KV2/9+rfP/cpnf/1Jps/8+SY//QkmP/05Vk/9aYZ//FiVf/x5Ba/8qVX//uvYX/4LJ3 /3pQFP/OpGr//+25/8iYZ/+seEn/pGtA/6FmPv9XGQD/WhoA/6ZmQv++flv/vXlW/7hvTv+t XTz/tFk6/7dUNf+9UDP/skYs/7RUPP+oTjb/pkwx/65VM/+1XjP/t2Ew/7hlL/++bDT/rlwk /6RRG/+gShn/pU4j/61UMv+xVzz/s1lB/7VaP/+1WTD/sVkn/6lXJf+lVSD/oVQe/6NUHP+o Uxr/q1IY/7JVHP+yWCP/pFIj/5BMJf9yQyX/RSkT/yAXBv8eHBD/CwcA/w4LBv8AAAL/g4qD /7nFrf99jWn/XnNM/0BcRv+LrsH/fq7f/2qp9v9ut///D13C/wVOv/8KScr/BD/B/w1Dvf8O Q7X/D0Wy/xBFrf8TSKj/Jlmy/0p9zv9rn+r/Zpvf/12T0f9elND/bKXc/3Os4/9tqd//ca3j /3u36/+Pyfv/isb8/4TB//9+u/7/erP4/3ut8v96quj/dqrk/2+t6v9jrez/Uajr/122+P9m tvH/aqze/5fF6f/G5fr/xNjf/77Ozv+5y8v/v9HR/8HV1P+90dD/us7N/7vPzv+6zMz/vc3N /7TCw/+hq63/tLy///D1+f/+////9PX5//7+///+/v7///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////v// //7////+/////v////7////s8PH/9vf7/73Bwv9AQUX/Ky8y/0JJT/8VHiX/KzU+/x8pMv8U Hif/LDY//yAtNv8kMTr/Hys3/x8tOP8hLzr/IzE8/yMzQP8lNUL/JzdE/yg4Rf8sPEn/Lz1K /zA+S/8xP0z/M0FM/zVDTv82RE//NkRP/zZCTv83Q0//OEVO/zZDTP8wPUb/JzQ9/x0pNf8a Ii3/Fxsk/xYZIP8UFBz/DhEY/wsLE/8GBg7/AwML/wIBCf8AAAf/BgUN/w8OFP8GBQv/BgUL /wIBB/8GBQv/MTQ5/8nQ1v/N2N7/y9bc/8DLz//I0tT/zNjY/8jU0v/K1c//naee/6GllP9/ e2L/e25L/39pOv+IaC//mnEx/6d5O//AkmD/zJ1v/9mpe//bqHv/0pxw/8qRZP/KkGL/zpFi /82QYf/AhlT/z5hi/9eibP/3xoz/zJ5j/2g7AP+uhEr//+m2/9Kmd/+uflD/sX5T/8GMZP+D Syb/OwEA/4FFIf+3e1n/rm5L/6pjQ/+1aUn/rVY4/59CI/+YNRj/oD0g/48zGv+NNhv/mUIm /7BaOf+/bET/wG1B/7trOv+6ajf/qVkm/6ZWI/+eTB3/l0Qa/5tGIf+kTi3/qVI2/6pRL/+s Vif/qFUf/6NSHf+fThn/nk0Y/6BNGf+lThn/qU4Z/7BUIf+wWCj/nlEl/4ZII/9kOx3/NB4H /xELAP8PEQP/GBYH/w4MAP+DhH//tLew/42Wgf9SYUT/AAkA/0tpX/+IsMn/gLPo/2+v+f9q sf//O4Xk/yNs1f8qbOT/LW3r/yhq5f8kZuD/IGHX/xtazP8SUL3/F1K4/zRu0f9Wjer/WpDo /1mN4f9ikub/Z5fp/1qJ2/9FdMT/R3bI/1iJ2P9XkNf/XJjg/2Sj8v9wr///fLf//4S8//+K v///icH+/2Ci3v9erej/Va/u/1649v9drOT/a6vZ/6XQ8P/I5ff/wtXc/7zMzP+4ysr/v9HR /8LW1f+90dD/us7N/7vPzv+7zc3/vMzM/6q4uf+msLL/t7/C//v////7/P//9/j8//7+///+ /v7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////v////7////19vj//P////X5/P/8////1dnc/1BVWP8i JSr/Q0hM/xwlLP82P0b/GSMs/x0nMP81P0j/JjA5/x4rNP8gLTb/Hiw3/x8tOP8gLjn/IzE8 /yMzQP8mNkP/JzdE/yg4Rf8tPUr/Lj5L/zE/TP8yQE3/NEJN/zVDTv83RVD/N0VQ/zdDT/84 RU7/OUZP/zZDTP8uO0T/IzA4/xokLv8THCX/Fhkg/xYWHv8SEhr/Dg4W/wkJEf8EBAz/AgEJ /wAAB/8AAAf/AgEJ/wcGDP8FBAr/CgkP/wAABf8JCA7/VVhf/9Tb4f/T3uT/1eDm/8PO1P/E 0tX/y9na/8fT0f/H0sr/mZ+T/6OlkP97dFf/e2xD/3BWJf93Vxz/hV4d/5drLv+0iFf/xJdt /9anff/aqYD/0Z5z/8eSZv/EjmD/yJBh/8KKW/+/h1b/2KNv/+Owef/+zZX/vYxS/1stAP+Z bDP//9+u/+vAk/+5jGL/rYBW/8GRaf+vfVj/TRgA/5VfPf/ZoYD/wIRi/6NhQf+sY0P/p1g5 /6hVNf+WPyH/kzwe/486G/+EMQ//gzAO/409Gv+aSiX/nlAp/6BVLf+kWS//oFUr/6JXLf+b TiT/jT4V/4s8E/+ZRyH/oU8p/6BNIf+mVSD/o1Ia/59OGf+cShj/m0gW/59JGP+kSRr/p00b /7FWJ/+tWyz/mVIo/3xEH/9XNBb/JRMA/wMCAP8BBQD/CAgA/3Z1YP/Ixrr/iIp//zY6K/8C DwD/ABAA/1+Bg/93osT/gLTt/3m4//9ssf7/bLP//zuB1/84ed3/Pn7s/zV67/8yee//Nnvw /zx/8P81d+X/K2vV/y9s1v88d93/PnXa/02B5v9jlfj/ZZX5/0Jv1P8VQKj/CjOc/xdEqf8h WLX/Hl26/yJkxf8rbND/OHnX/0iG3f9XkN3/XJje/1qf4P9eru3/WLLx/1y29P9ap93/c7Dc /7PY9f/E2+3/wNPZ/7vLy/+5ycn/v9HR/8PV1f++0tH/us7N/7vNzf+/z8//vMrL/6axs/+q tLb/ur/D//z////3+P3/+vv///7+///+/v7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////9//Lx7////////v7+//r6+v//////+vv9//3+///z 9/r/8/f6//z////w9fn/XWJm/yEpLP85PkT/ICct/yMsM/8iLDX/Iiw1/yIsNf8gLTb/IC02 /yAtNv8gLTb/IjA7/yMxPP8jM0D/JjZD/yo6R/8tPUr/LkBO/y9BT/8sPkr/M0VR/ztLWP88 TFn/N0hS/zRFT/84RlH/PEpV/ztIUf8+S1T/PkhS/zI8Rf8iLDX/FyIo/xMcJf8TGiL/EREZ /w8OFP8LChD/BgUL/wQDCf8DAgj/BAML/wQDC/8DAgr/AAAH/wQEDP8AAAf/BAQM/w4OFv8A AAf/foGI/9Pa4P/O197/xM/V/8fU3P/E09j/xtXY/8rZ1v+0vrb/n6OU/6Sgh/9nWjj/gm1C /4htOP9+WyH/hV8g/4FZHv+gd0v/vZNt/9mtiP/cr4j/0aF5/8iXbv/Fkmf/wo9i/8WRYv/M mGj/4a55//vKkv/su4P/onE3/2w7Af9uPwn//9+w//PInf+4jmT/r4Vd/86kfv/Bl3H/ckYj /5loR//mtJP/8bqb/8uOcf/TknT/uXdX/4tGJf+fWDj/k0on/3QpAP9+MQX/eC0F/340D/+J QB3/fTYW/3ArDP92MRL/hD8g/5BLKv+YUi7/k0wi/41EF/+PRRT/k0cT/5JFDf+XSxH/l0gP /5ZFEP+WQxH/mEEU/5xDF/+gRRn/oEcb/51JHf+kVyv/hkUd/3lHIv9JKg3/HA4A/xMSAP8A BAD/i4tn/7u4lf9/emb/JSEV/wACAP8BDAT/AA4P/2GGmf96qdf/b6fk/2Wi4f9ytPH/dbjt /2ip4f9rp+3/Xpvu/1OT9f9GifH/N3jg/zZ33f84ed//M3LZ/z194f8ta9D/PXjg/zVu2f85 b9z/Qnfn/ztu4f8mWc7/IlPK/yte1P8bVsr/ElPH/wBEvf8AP7j/BUu9/w1Quf8PTqv/FFWn /w5Wov9YqO//Vq71/1Wt7f9psuf/eK/Y/6zL5//K2+v/vczT/73Nzf++zs7/vM7O/7zOzv+9 z8//vc/P/73Pz/+/z8//wtDR/6Crrf+0vsD/zNHV//z////5+v//+/r///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////v37//v6+P// /////f39//f39////////v////z////8////+f7///T5/f9ze37/LjU7/y82PP8qMTf/KDE4 /yIsNf8iLDX/Iy02/yMtNv8hLjf/IS43/yEuN/8gLjf/IzE8/yUzPv8lNUL/KDhF/ys7SP8u Pkv/MEJQ/zFDUf8vQU3/NUdT/ztLWP88TFn/OEhV/zdIUv88SlX/QU9Y/z9MVf9BTlb/N0FK /yMuNP8aJSv/HSgu/xkiKf8OFRv/EBEW/w4NE/8KCQ//BgUL/wMCCP8CAQf/AgEJ/wMCCv8A AAf/AAAH/w0NFf8MDxb/FRUd/w0QF/8AAAj/i46V/9TZ3//O19z/ws/X/8XU2//C09v/w9XZ /8nX1/+yvLP/oKGP/5+YfP92ZkL/jnZI/5FxPv+CXyX/g10f/4pjLP+2kGn/z6iH/+S7m//g uJX/06iF/8mddv/FmG//xJVr/8qabP/ZqXn/7LyL//rLlf/mtH//o3I6/249Bf9mNwP/78OW ///Wrv+3kGf/tY9o/9Kvif/Yso7/mnJP/3hNLf/ntpj//8+w//K5nP/7wKL/4qWG/7p+XP/S l3X/zpBp/51ZKP+8dUH/lE0f/4ZBGv+BPBv/bSwQ/3Y1H/9eHQn/UA8A/1kZAP9yMRH/jUki /49LGv+GQQr/jEYI/6BZGf+USg3/k0YO/5RCEP+VQRP/mEEW/5tCGv+eRR3/nUgf/6pbMv+U TSP/hUsj/1ktCP81GAD/DQAA/wYBAP+QkHb/ubaJ/3t0Rv8qHgT/FgwA/xYTDP8IERb/ABss /4Gpzf98run/drDw/3i17v90sd7/gr3d/3GqyP91qtT/b6Pc/2yg6f97r///d6v+/2GY6/9d ler/Vo/m/1OM5f9BfNb/M3DN/zNv0f84c9v/P3zn/0N96/8+d+r/PHXp/zx37f8uauT/KGjm /yZr7f8eZOj/DlPS/wxPwv8VVLv/FFWx/xVdsf9Qou7/Uanz/1ap6/9ssej/hrfg/77W8P/T 3+3/vsvR/77Mzf+/zc7/vs7O/77Ozv+9z8//vc/P/73Pz/++zs7/wc/Q/6Otr/+yur3/1tne //7////6+f///Pv///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+vn3/////f////3//fz6//n5+f//////+/z+//z////8////+/// /5ugpv8hKC7/JCsz/ykyOf8qMzr/Hyky/yIsNf8gLTb/IS43/yEuN/8iLzj/IzA5/yIwO/8j MTz/JjRB/yY2Q/8oOEX/KztI/y0/Tf8wQlD/M0VT/zRGVP81SFb/N0pY/ztNW/87TVn/OkpX /ztMVv9CUFv/R1Ve/0RRWv85Rk7/KTM8/xolK/8YISj/GiMo/xYdI/8QFRn/DxAV/w0MEf8J CA3/BQQJ/wECB/8AAQb/AQIH/wECB/8HBw//AAEI/wUIEf8ABA3/BQgR/wAACf8NEBn/tbnC /9DX3f/N1tv/wc7W/8PU3P+/09z/wNPZ/8bU1f+vtq7/oqGP/5eMcP+MdlH/m35S/5Z1Qv+H ZCz/gFwi/5t3Rf/Uso//5cOn//HOsP/oxKT/1rKQ/86ohP/Lo3//y6F5/9esgf/swJH//tCf //zOnP/brHj/nW44/2s8BP9cLgD/xplv///guv+5k2z/vZt1/9y8lv/z0a7/3bmZ/5ZtT/+w fmP/5KyT//W5n///yq7/87qc/9agfv/msY//3aZ9/8OBTf/hnGX/o18u/7JuR/+4d1n/lFY/ /5pdS/9aHxH/OwAA/zsAAP9RFAD/f0AX/59dK/+eXCD/llMP/5RPCv+QRgn/kEMN/5JAEP+R PhL/lD8Y/5dCHf+aRCH/mEgj/51TLP+HSB//cT0V/zsVAP8jCAD/EgEA/5GJdv/Bup3/joRP /42AS/9tWjr/Hw8A/wQAAP8ACBT/IUBd/3yq2/99tPf/dK/z/3y26P9kmrz/kcHP/3+rtP99 prr/eJy8/4al0/+Io9j/iaje/3qd1f+Ptu//g7Dr/3ys7P9+s/X/cKvx/2qo8/9gofH/VZfr /02Q6f9FiuX/O4Df/zN02v8+eur/MGrl/zR19f84e/3/L3Dw/zR16/89euT/K2vM/zd+1v9b qfv/Vqz5/1qq7/9rrOL/jrvi/8TY8P/J0dz/wMvP/77Mzf+/zc7/vs7O/77Ozv+/z8//v8/P /7/Pz/++zM3/vcvM/6awsv+vt7r/4+br//7////5+P7///7///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////78/////f////3//fz6 //7+/v/+////9/j8//L2+f/7////wsrN/zY9Q/8cJSr/KjM6/yYxN/8gKjP/ICoz/yAtNv8g LTb/IS43/yMwOf8kMTr/JDI7/yUzPv8lMz7/KDhF/yo6R/8sPEn/Lz9M/zFDUf80RlT/N0lX /zdKWP87Tlz/O05c/zxOXP88Tlz/PU1a/0BRW/9GVF//SVdg/0FOVv8pNjz/HSgu/yArL/8c JSr/CxUX/wgQE/8UGRz/DQ4S/wwLEP8IBwz/BAUJ/wIDCP8CAwj/AwQJ/wIFCv8GCRD/AwgO /wsPGP8KERn/DRQc/wABCf8eJS//y9La/87W2f/L1Nn/wM/W/8LU3v+80t3/vdHY/8DP0v+q sar/pqGO/45/Yv+bgVz/oYBT/5dzQf+LZzP/hmEt/7SSZf/oyar/9Na+//nZwP/szbH/3buf /9e2lf/XtZL/17SO/+vEm//70qb//9yv//3RoP/QonD/kWIu/2U2AP9aLAD/nHFH///bt//K p4H/yqqE/+nLp///6Mb//+jK/+W5nv++h3L/xYhz/7p4Yv/Ni3P/56eM/++0lv/os5P/yJFq /92baf/clmL/ol4x/8N/Wv+/fmD/ez0m/20yIv86AAD/QgcA/2UrFf+HSi3/lFQu/5tZJ/+i YCT/pGEd/59YFv+OQwn/kEAN/489Dv+PPBT/kDwY/5M/Hf+TQyL/kUck/4JBG/+HUCn/WzAG /zMRAP8mDAD/rpp//8u6pv96a0z/lYRM/6aRWP+pj27/RC4g/wcAAP8AABP/L1F3/3Oo3v9q pu//YJ/k/3ux4P95p7//3////+j////r////6v///9zo//+8xeL/fIqn/1Rkhf9ieZv/haHG /3qdxf92ocz/hrbm/36x5v90reT/bqnl/2yo5/9sqer/bq3y/3St+v9hk+z/X5H0/1yU//9Q jPz/PXbp/zdx3/9Ced7/QX7Z/1ac8v9ir///W678/1yr7v9sq+D/l8Hn/8rb7//Ax9H/wcrP /8DLzf+/zc7/v83O/77Ozv+/z8//v8/P/7/Pz/++zM3/usXH/6mztf+zuLz/8fT5//3+///5 +P7///7///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////9///++/////3//v37//z8/P/9//7//v////z////W29//Vl1j/x4lLf8i KzL/GiMs/yw2P/8VHyn/JTI7/yAtNv8gLTb/Ii84/yQxOv8lMz7/JjQ//yg2Q/8nN0T/LT1K /y4+S/8vQU//MkRS/zZIVv85S1n/Ok1c/ztOXf9AU2H/PFJf/z1QXv89UF7/QFJe/0JTXf9E Ul3/Q1Fa/y06Qv8gLTP/Hyow/yUuM/8ZIST/AgoM/wEGCf8PFBf/CwwQ/wkKDP8HCAz/BQYK /wUGCv8FCQz/CAsQ/wgNEf8ECQ//AAcN/wMKEv8ACA//AAkS/wACC/8wOUL/ztfe/8zU1//J 09X/v87V/8DU3f+60t7/uM/X/7zL0P+lqqT/pp+N/4d2Wv+niWX/pYBU/5p0Rf+WcEH/l3JF /86shv/u07j/9t3H//neyf/t07z/48it/+TGqv/nyKn/6cil//3atP//27H//+G0//rRo//B lWT/fU8d/14wAP9dMQD/eU8n/+3Ho//vz6n/2r6Z//vhvv//9dX//9q///HBqv/nqpj/9Kyd /+WYiP/DdmT/pFlE/5dROP+cXEH/nVw8/7BnPv+cUSf/gTcS/5ROLP9/PCH/SwsA/1ATAP9V Gwf/dzol/5ldQ/+ub07/pWQ8/6VhMv+zbDb/sGgu/6BVG/+QQw3/kEAP/488Ev+NORT/jDcY /4s6HP+JPh//hUMh/4JIIv9pORH/TikA/1w/F//HrYz/s5t//0o0H/9pUjP/uaBo/7WYXv+2 k3P/Sy8j/wgAAP8AARX/Rm2W/3658/90tv//ba7y/4G04f+MsMb/7/////b//v/3////8PP/ ///9///48vz/bWt2/0pOWv8xOUb/3er6/93v///M5fv/r83l/4utyP9ylbP/dpq6/4Gny/+B p8z/faPI/32izP+TtOf/kbXx/32n7/9xoPD/d6b+/3al//9zo/j/eK///2Ch8f9ep/T/Wajz /12o6/9xr+L/p8/z/9bl+P/IzNX/wcrP/8DLzf+/zc7/v83O/77Ozv+/z8//v8/P/7/Pz/+/ zc7/sr2//6q0tv+6v8P/+fz///z9///8+/////7///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////3///79///++/////3////9//b29v/8 /v3//v///+7z9v9xdnz/ICct/yUuNf8oMzn/GCIr/xQhKf8qN0D/Dxwl/x8sNf8gLTb/Ii84 /yUyO/8mND//KTdC/yk5Rv8qOkf/MUFO/zJCT/8zRVP/NkhW/zpMWv89T13/PlFg/z9SYf9A VmP/P1Vi/0BTYf9BVGL/Q1Vh/0FTXf89S1b/N0ZN/xkmLv8hLjT/JS4z/xkjJf8MFBb/BQ0P /wQJDP8CBwr/BQkK/wcICv8HCAz/BgoN/wkNEP8MERT/ERYa/xIaHf8YHyX/ERof/w8YH/8D DhT/BQ8Y/wUPGP9YYmv/097k/8rS1P/I0tT/vs3U/8DU3/+50N7/tszX/7fGy/+gpaH/o5qJ /4l0Wf+0lG7/r4hf/6uCVv+rhFn/s45k/+LBoP/w18H/9uHQ//ni0P/x28b/7tW///LYv//3 3L//+dy6///lwv//37b//960/+3Hmv+rgVH/az8O/1ovAP9jNwj/YjsU/76adv//6sb/79Wy ///21P//+dv/3LSb/7+Ldv+7eGj/zX1y/+yUiv/8opf//6qc/++civ++cV3/nFA4/5hHKv+C MRP/gDET/4Y7Hv98Nhz/dzUb/4pKL/+fYkb/qm1Q/6VmRf+gYDz/qGQ9/7tyR//Ddkj/sGIx /5hIFf+VRRT/kkES/488FP+LNxX/iDUX/4I1Gf9/OBz/eDwa/248F/8/GAD/eVou//DUrP+x l3T/f2RH/yECAP+CY0b/vZxm/8uocP/JoID/QiAU/woAAP8BDCL/XYiy/3Sy7f9jqfH/bK3x /36t1/+ox9v/8f39//b29P//+/////j////6///16+r/TURF/2pmZ/8QEBL/6u7x//H4/v/s 9fz/8fv//+74///k8fr/w8/b/4eQn/9XXm7/X2V1/4CJmP98jJv/gpit/32bv/97n8//g6fj /36l6P94oOX/d6jt/2yo7v9lq/H/X6z0/1+p6v91seP/q9P2/9Hh8f/Eyc//wcvN/8DLzf+/ zc7/v83O/77Ozv+/z8//v8/P/7/Pz//DztD/qbS2/6uztv/Gy8///P////z9/////f////7/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //3///79///++/////3////9//j4+P/+////6+zw/5GWmf8mKzH/Iikv/x8oL/8sNj//JS85 /wwZIv8zP0v/Cxkk/x8sNf8gLTb/IjA7/yQyPf8oNkH/KjhD/ys7SP8sPEn/M0VT/zRGVP82 SFb/OUtZ/zxPXv8/UmH/QVRj/0JVZP9BV2X/QFZk/0BWY/9FWGb/Rlhk/z9RW/81Q07/KjlA /xglLf8fLDL/HSYr/wsVF/8DCw3/CQ4R/wYMDP8AAgL/AwcI/wMHCP8FCQr/CQ0O/w4SFf8V Gh3/GyAk/x0lKP8sMzn/ND1C/0ZRV/9DUFj/RlNb/0dUXP+Om6T/z9rg/8jQ0v/I0NL/vM3U /77U3/+20N3/s8vX/7LDyv+coZ3/nJOC/452XP/DoX7/xJpy/8Wbc//HoHf/z6uH/+zNsP/0 3cv/+ufZ///q3P/65dL/+ePO//7o0P//68///+rI///mxP//4br//9y0/9q1if+SaTv/YTcH /14yAf9kOQz/YDoT/3hXNP/64L3//ubC///62P//7tD/37Wd/7mAb//Ie3H/vmVd/8ljXv/I YVr/0Gth/9t7bf/Qd2f/2YJx/8NqWP+uVUP/qVQ//6ZWPf+bUTb/nlk6/6VjQf+jYz//pGQ+ /6JhOf+pZjz/tm5G/7dpQv+qWDL/o04p/6VQJ/+aRxv/lkMX/5A8F/+JNhb/gjEW/3wwFv90 Mxf/bTQW/04iAP+UcUf/38SX/5V8U/+liGb/qotv/zIOAP+2kXT/3LSB/8eeav+zhGj/SyUa /xgIC/8RHjH/Woew/2Sm4P9apOv/a6/w/3KfyP/G3/X/8vX6//jr9P//8/////H///3y+v+4 sK3/KCMg/2xnZP8VEQ7/wLy7///9/P///f3///z7//Dk5P/Xx8f/ybW2/7edoP+Yenz/e1la /2RLRv99eGT/kpuI/8PV1f/K4fH/mLPR/3ycxf+Bo9P/dqHW/3Op5f9ur+//ZrH0/1+p5v93 s+X/qtL1/8bW5v+9wsj/wcvN/8DLzf+/zc7/v83O/7/Nzv/Azs//v8/P/7/Pz//F0NL/oayu /6mxtP/S19v/+v3///7//////f////7///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////+vj5//v6+P/7+/v///////7+///+////wcXI /yYrL/8mLTP/ISgw/xwlLv8eKDH/Hykz/yo3QP8UISr/NEBM/x4sN/8fLTj/IjA7/yM0Pv8o NkP/KTlG/yw8Sf8tPUr/NEZU/zZIVv84Slj/O01b/z1QX/9BVGP/Q1Zl/0RXZv9DVmX/QlVk /0RXZv9HWmj/SFpm/z9PXP8vPUj/IS43/yYwOf8bJiz/DhUb/wQMD/8FCg7/BwsO/wQIC/8A BAX/AQUG/wIGB/8FCQr/Cg4P/xIWGf8aHyL/Iicr/yQsL/85QEb/QktQ/1VgZv9RW2T/VF5n /2FrdP+ntLz/y9bc/8nO0v/Hz9H/v8zS/8HU2/+7z9j/tsnQ/7PBwv+Znpj/lo9//497Y//J rI7/z62K/9WyjP/XtY//4MCZ/+7Us//35dH//u7f///y4///79///+zb///x3P//89j//+/R ///iwP//473//tux/82me/+CWS3/XjMG/2M3Cv9kOQ//ZkIg/z4fAP/dwqT//+zN///z1P/8 3cD//9S7/+WsmP+/dmf/qlRH/7JRSP+3UEf/wVpR/8RfU/+kRzj/pUo4/61SQP+jSzf/okw1 /6ZVOP+WRyj/kEYj/6dfN/+qYzn/qWI4/6FaLv+mXTT/tmhB/7hoRf+rVzX/m0Qm/5U/Hv+d SST/mEUd/5A+Gf+GNxj/ezEU/3IvEv9pMRD/YzMP/6yFWv/Yt4r/knZH/41wRP/Eonz/sIlo /3xQM//Hmnn/zqRy/82jcf+7jm3/SSgX/xIGCP8YKD//aJjG/3G18v9iq+//c7Tu/2mUt//d 8P//+/r////0+///+P////D////5//+KhoX/Eg4N/yklJP8EAAD/fnZ0///8+v//8O3/+OPg //vf3P/519X/8crF/+S3sv/Pnpn/tYB6/55vX/+IaUr/fm9O/8XDtP/5////5/X//+b4///b 8///lbfk/2eb1f9mpub/Zavw/2Gl4v+CtuX/tdj2/8rc6P/Fz9H/wcvN/8DLzf/BzND/v83O /7/Nzv/Azs//v8/P/8DOz//H0tT/namp/6iwsv/a3+L/+Pz///7//////v////7///////// //////////////////////////////////////////7//////////v/////////+//3//v// //7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////3////9/////f// //3////9/////f////////////////////////////////////////////7+///+/f//+/z/ //r7///+////7/D0//7////j5uv/Njk+/yUqMP8eJSv/HiUt/x8mMP8fKDH/ISoz/yErNP8i LDX/IC02/x8tOv8fLzz/IjI//yU3Q/8qOkn/LkBO/zFDUf8zRVP/O01b/zxOXP89T13/P1Ff /0FTYf9DVWP/RFZk/0VWZv9IWWn/Q1Rk/0RUZP9HV2b/QE5b/y46SP8kLjr/JS04/xQbJf8Q Fx//DhEY/wgLEP8GBwz/BAUJ/wQDCP8EAwj/BAMI/wMECP8DBAj/AwQI/wMECP8BBQj/AQQJ /wAFCf8FChD/KS40/y00Ov9MU1v/VF1k/09YX//AydD/xczU/8XK0P/HzND/yNDS/8rU0//H 0s7/ucK9/6eupv+bnZL/g39z/6ebi//EtJ3/1cCl/9/Ipv/hyqD/6tKi//znvP/y58v/9e3a ///05P//+ur///nr///z4v//69T//uTJ//bZt///5L7/9tGl/7WMYP9xRBr/VSYA/1QjAP9R IwH/WTUd/yMDAP+XeWH///PZ///y1f/xzrD/8cam/8+cff/Hi2//wH1i/7dpUv+vWkX/qVA+ /6RJN/+fQjH/mT4p/4ozF/+bRyX/ok4q/51JJP+kUir/tmU6/7hnOv+qWSz/pVQp/7ZlOv/E ckr/v21I/6pXN/+aRyn/mEQo/51JLf+XQiX/jjsb/3wwDv98NhT/dzkU/1smAP91SB7/wZts /9Oxgf+RcT7/pINQ/9u3hf/uwpP/16d5/8GKYf/RnHD/zaFy/8qkc/+zkWP/QCkK/wEAAP82 Tmr/danj/2Kl6/9Vm9f/eLLg/3KUr//G1N/////////++v////j//P75//f4/P87OkL/DQwS /x8cI/8EAAT/EwgO/6aVm///+Pr/8tjZ/+rKy///6Of//9jU/9+wqv/Jl5D/2KSZ/9aej/+j Z0//t4Vu/8Gpnf///Pr//vn9/+Xn9P/z////kKzU/3Sn6P9lp/H/Zafz/2eh4f+Yven/wdzx /7rS1v/B1NL/wMvP/8DLz//Ay9H/wMvP/77Mz/++zM//vszN/77Mzf+5xcX/r7u5/622tf/k 6ur/+Pz7//j6+f/49vf//fv8//v7/f/8/P7//Pz+//39///9/v///v////7////+/////v/9 //z//f/+//3//P/9//7//f/8//v//P/9//z//f/+//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////f////3////7/////f////3////9/////f////////////////////////// /////////////v7///79///9/v///P3///z////6/f//8vX6//X4//9zdn3/LDE3/yEmLP8e JS3/HyYu/x8mMP8hKDL/ISoz/yIrNP8jLDX/Iiw2/x4uO/8fMT//IjRC/yY4Rv8rPUv/L0FP /zJEUv80RlT/PE5c/z1PXf8+UF7/QFJg/0JUYv9EVmT/RVdl/0ZYZv9FVWX/Slpq/05bbP9F UmL/OUVT/y43Rv8lLTr/ICgz/xIWIf8PExz/DQ0X/wgIEP8FBAr/AwII/wQCB/8DAgf/BAMI /wQDCP8DBAj/BAUJ/wQFCf8EBQn/AgUK/wIFCv8AAgn/ERQb/wUKEP8RFhz/Exoi/y82Pv+y ucH/vMPL/8LJ0f/Ey9H/x8/R/8rT0P/G0Mj/usG5/6WspP+Wm5T/dHZx/7a2rv/f29D/3tfF /+HXvv/p3Lr/5diu/9zTqv/59dr/9/bi//n25//89Of//vLm///u4v//7Nn//+nQ///ty/// 7cT/68WY/6Z6S/9wQBL/WicA/1kkAP9aKQn/WzUg/zMUAv9lRDH///Hb///jyf//5sn/6sGh /9eph/+/imj/u4Bg/7d2WP+2b1P/u2pV/7xnU/+6YVH/tV5K/7RjRf+zZT//r2E6/65hN/+1 Zjv/wG9E/71sP/+2Yzf/vWo+/7lmPP+yXzf/q1cz/6RRMf+eSy3/lkUo/5JCJ/+IPCL/eTIW /4A/If9pLgz/WCYB/6l/Vf/kwpT/t5ln/4xwPv+hg0//0rF8/+jDjv/XqXf/v41a/8KKWf/X onD/0aV0/8undf+ylGD/NCQA/wACAf8/WXr/cqjo/2Sn7v9rref/gbbg/1Ryiv9teoP///7/ /+jo4P/u9+T/+f/0/8PIzP8HCRb/AQEN/yglMP8WDhn/DQEL/yEQGP+ym6H/7dDU/+G/wP/B mZn/vZGO/9Sln/+zgXj/r3lv/9idj//Oh3P/i047/7OTiP//+/b/8efl/+rp7//e5vn/haHI /3Go6f9kp/b/Z6b1/2+i4/+gveX/xNnq/7rS0v+/1M//vszP/8HK0f/Ay9H/wMvR/77Mz/++ zM//vszN/77Mzf+tubn/rbm3/7S+vf/w9vT//P////7//f/8/Pr///7///////////////// ///////+/////v////7////+/////v/9//z//f/8//3//P/9//z/+//8//v//P/7//z/+//+ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////f////3////7/////f////3////9 /////f/////////////////////////////////+/v///v7///79///9/v//+fr///z////2 +f7/+fz//5ido/8nLDL/ICUr/yEmLP8eJS3/HyYu/x8oMf8gKTL/ISoz/yIrNP8jKzb/Iy05 /yAwPf8hM0H/JDZE/yg6SP8tP03/MUNR/zRGVP82SFb/PlBe/z9RX/9AUmD/QlRi/0RWZP9G WGb/SFpo/0haaP9FVWX/UV5v/1Bdbv8/TFz/MDxK/ys0Q/8iKjf/Fh4p/w0RHP8KDhf/CAgS /wQEDP8CAQf/AQAG/wIBBv8DAgf/BQQJ/wQFCf8EBQn/BQYK/wYHDP8GBwz/BQgN/wUIDf8G CxH/EBUb/wcLFP8LDxj/Bg0V/0FIUP+/xs7/wMfP/7/I0f/BytP/w87S/8bS0v+/zsv/sL+8 /5upqf+LmZr/dH+F/7rDyP/j6Oz/29/e/9ve1f/n6Nr/5+bR/97gyP/l6dj/6vDi//X47f/9 /fP///nx//rt5P/y4dH/8Ni+///kwv//5Lr/2rKB/5BiMP9jLwD/URkA/1QaAP9kLgr/XDMd /zwbCv9MKRb/9NG9///y2v//4sf/986w/+e6m//fro7/3KWH/9eafv/UkXf/0Id0/8l8av+/ bV//s2RT/7t1XP+ycVP/snBQ/7d1Uv+6dlH/tG9G/7BnPv+uYzn/plsx/6hbMf+mVy7/n1Ap /5ZGIf+QQB3/kT4e/4xBJP9yNhz/eEYt/2s8Iv+WbU//6MSi/9O1j/+XflX/oYpe/56IV//M tYP/5sqY/9++i//Dnmn/sIVQ/76PW//On2v/1al4/82ndv+xk1//KBgA/wMJCf9Oa43/c6bn /2io8P9mpN//f7Ld/0plgP+YobD//vz////+///o7uT/+f/6/4eOlv8ICxz/JiU1/xcVI/85 Mz//T0NP/wsABP+okZn/y66y/9GvsP94UE7/cEM+/9SjnP+PXVT/bTct/7Z8bv/IjHT/l2dQ /5N8bv/38Oj/+/r2/+nx9P/a6/3/c5W7/2yo5/9jqPX/ZqXy/3Wn5P+mwuf/x9jo/73R0v+/ 0tD/wMvP/8HK0f/Ay9H/wMvR/77Mz/++zM//vc3N/73Nzf+ntbX/sr68/77Ix//1+/n//P// //n7+v/5+fn//////////////v////////////////////////7+/v/9//7//v/9//7//f/+ //3//v/9//7/+//+//v//v/7//7/+/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////f////3////7/////f////3////9/////f////////////////////////////7+///+ /v///v7///38///8/f//+/z///f6///8////xMfM/zQ5P/8jKC7/JSow/yMoLv8fJi7/HyYu /x8oMf8gKTL/Iis0/yMsNf8kLDf/Iy05/yMzQP8jNUP/JzlH/ys9S/8vQU//NEZU/zdJV/85 S1n/QVNh/0FTYf9DVWP/RVdl/0dZZ/9JW2n/Slxq/0xca/9OW2v/TVpq/0VSYv85RVP/MDlI /ycxPf8ZISz/DBIe/wcLFv8ECBH/BAQM/wEBCf8AAAX/AAAF/wIBBv8DAgf/BAUJ/wUGCv8G Bwv/BwgM/wgJDv8KCxD/CAsQ/wkMEf8GCxH/EBUb/xQYIf8XGyT/DBMb/2FocP/GzdX/ucLL /73H0f+8ydL/vs3S/73P0f+3y8z/p7y//5GlrP9/laD/VGl6/4Warf+xw9f/ydrs/9fp9f/Y 6fD/2Ojo/9/v7P/f8Oj/2+zk/9nl4f/X4N3/3d/e/+jj3//z6d3//u7X///pyv//4Lf/xqBx /4JXJP9rOQb/XCcA/1shAP9qNA7/VCoU/0gkFP9FIA7/0q2a///23//+2b7//9a6//XKqv/p uJr/6bSV/+qukv/qqpH/6qON/+OYhf/WiXf/yn9s/7l3X/+0d1v/tXhb/7Z5Wv+0dVL/rW1H /6ppQf+takD/rWg+/6diOP+dViz/jEQc/30zDv93LQj/ei4M/3g2Fv9WJwv/lXBV//DNr/// 4L//wqSA/5R4Uf+Yf1b/po5g/93Dkv/v06H/2ruF/8+sdv/BmmH/qoBG/7mMU//JnGP/1ap1 /8umcv+njFf/Gg0A/wwUF/9hf6P/cqXn/2yq8/9xren/cJ/L/0VefP96gpX/8u///+/s9f/3 +/r/+f///4OJl/8PFCj/EhMn/wQBEv9bVGT/V0xa/xwMFv/s1d3/r5KW/+G9v//yycf/9cjD //LAuf+4hHn/0JeM/9efkP+6hm7/gVlA/5eFd//x7uX//P/7/+r4+//S7P3/ZY+1/2io6P9j qPX/ZqTt/3yt5/+uyOn/xtbl/77Q0v/Azs7/v8rO/8DJ0P+/ytD/v8rQ/73Lzv+9y87/vMzM /7zMzP+erKz/sb29/8LMy//0/fz/+/////n9/P/+///////////+/////v////////////// //////////7+/v/+/v7//v////7//f/+//3//v/9//7/+//+//v//v/7//7//f////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////f////3////7/////f////3////9/////f// /////////////////////v7///7+///+/v///f3///38///8/f///v////n8///o7fP/WV5k /yEmLP8nLDL/KC83/yIpMf8fJjD/ICcx/yApMv8hKjP/ISs1/yIsNv8jLTf/Ii46/yU1Qv8m OEb/KTtJ/y5ATv8yRFL/NkhW/zpMWv87TVv/Q1Vj/0RWZP9GWGb/SFpo/0pcav9MXmz/TV9t /09fbv9UYXH/Q09d/zRATv8yO0r/LjdG/yAoNf8PFSH/AwkV/wIGEf8ABA3/AQEJ/wAAB/8A AAX/AQAG/wQDCP8FBAn/BQYK/wYHC/8HCA3/CQoP/wkMEf8LDhP/DA8W/w0QF/8PFBr/ERYc /xIZIf8QFx//BQwW/3V8hv/Ezdb/uMLL/7jE0P+2x9H/uMvS/7jN0v+vyM3/nbjB/4WisP9y kqf/WXuX/1R2mf9La5L/TnCW/16Ao/9piqn/fZ+6/52+0f+11t3/v9zg/83m7f/b7/j/6PX9 /+72+f/08+//+PDj///x2P/r1LL/pIRb/2pEF/9kOAv/Xi0C/1UgAP9fKgj/USQP/1ozJP84 EQD/tY96///s0///5cn/98uu//XIqf/lspP/6LGS/+yxk//0s5f/+LKY//Wrkv/qnob/35V8 /9CPc//JjG//wINk/7d7Wf+1eVX/tHhT/7ByS/+naUD/nF41/5JUK/+ISiH/g0Ue/4JEH/97 PRj/bC0K/1okAP+feVX//+fB//XYsP+gg1n/nH1R/6KDVP+lhVT/zq14/+XCiv/zzJP/1a1w /8SYW/+vgkH/mWkn/7WEQf/SomL/0qNr/8efa/+WfEn/DwYA/xkmLP9vj7b/cqXn/3Cq9P9w qOP/h7Lf/0BUd/9jaYP/4t73//Lu///w8/r/+f///4KJnP9FS2P/FBYt/yYkOv92coP/X1Rk /ywcJ//QucH/gmVp/9y4uv/GnZv/36+r/8+akv/SmZD/05eN//G5qv+5i3P/JgYA/7+yov// //j/5O3o/+j7//+y0+b/ZJS8/2On6P9hqfP/Z6Pp/4Sz5/+20Ov/xdbg/8HP0v/Ay83/wMnO /8DJ0P+/ys7/v8rO/73Lzv+9y87/vMzM/7zMzP+XpaX/sb29/8TOz//y+/r/9Pr6/+/z9P/z 9Pb//P3////+/////v////7////+/////////v7///7+///+/v7///////////////3////9 /////f////3////9/////f////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////f// //3////7/////f////3////9/////f////////////7+/v/+/v7//v7///7+///9/f///f3/ //z7///7/P//+v3///z///+JjpT/ICUr/y4zOf8nLDL/FRwk/yYtNf8gJzH/Hygx/yApMv8h KjP/Iiw2/yMtN/8kLjj/Ii46/yg4Rf8pO0n/LD5M/zBCUP81R1X/OUtZ/zxOXP8+UF7/Rlhm /0dZZ/9IWmj/Slxq/0xebP9OYG7/UGJw/1Jicf9OWmj/OkNS/ys0Q/8qNED/Ji47/xUdKP8F Cxf/AAYQ/wAEDf8AAwz/AAEI/wAAB/8BAAb/BAMJ/wcGC/8JCg7/BgcL/wcIDP8JCg//CwwR /wwPFP8OERb/EBMa/xAVG/8YHSP/Fhsh/xceJv8VHCT/DBMd/4uSnP+8xc7/uMLL/7bCzv+0 xc//tcjP/7PK0P+pxMv/lLS//3uesf9mjqj/VoCm/1aAsP9Md6z/SHWs/1F+tf9Leq7/QW+g /0RxmP9LeI//T3mJ/1h9kP9piZ7/haC1/6i7zP/I1d7/3+Pk/9nXy//LwKz/lINn/2BHKP9M LQ7/RSAD/0oiCP9eNR//VS4f/1cxJv8+GAv/cUo5///cx///4Mf/7cSo/+Czlv/puJj/67SV /+6xkv/xsJD/8ayN/+yihf/hlHb/1Ypr/9qUcv/UkGv/yIdh/8CAWv++f1b/tXdO/51iOP+G TSL/d0EV/245D/9gLAT/VyMA/1MhAP9aKAX/ZTMQ/2k9GP+xkWj/2L2Q/7qeb/+RckP/nXtL /5t2Qv+vhlL/98yV/+u8hP/1xIn/2qhr/7F/QP+TYh//kmEc/7SEPP/Qn1z/yJdc/76WYv98 ZTP/CAMA/ys8Rv92mcP/caPo/3Gp9P91p+L/f6XU/y9BZ/86P1//VlJz/6unwv/q7fz/+P// /3B3kf9lbIj/DxMu/y0tRf9TUGX/XFFi/0ExPv+XgIj/zq+0/6+Li/9UKCf/vo2J/5lgWf/I jIL/rW5l/9qgkv+VaFH/SSkS/+DOwv///vj/7fHw/+j7//+ny+H/ap/J/2Cl6P9jqPP/Z6Pi /4666f+81+z/xtXc/8HO1P+/ys7/v8jN/7/Iz/+/yM3/vsnN/7zKzf+8ys3/u8vL/7vLy/+d q6z/t8XF/83Z2f/4////+f////n////3+/7//P3///j5/f/6+f7/+/r///z7///9/f///v7/ //7+///////////////////////////9/////f////3////9/////f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////f////3////7/////f////3////9/////f////////// //7+/v/+/v7//v7///39///9/f///Pz+//z7///7/P//8vX8/77Dyf8rMDb/Iict/ycuNv8h KDD/FBsl/yQrNf8fKDH/ICky/yEpNP8hKzX/Iiw2/yMtN/8kLjr/Ii46/yo6R/8rPUv/LkBO /zJEUv83SVf/O01b/z5QXv9AUmD/SFpo/0lbaf9KXGr/TF5s/05gbv9QYnD/UmRy/1Rkc/86 RlT/Nz9M/y42Q/8jKzb/Fhwo/wkPG/8DBxP/AQUQ/wADDP8AAgv/AAIJ/wACCf8DBAn/BgcM /woLEP8NDhP/BgcM/wUIDf8ICxD/Cg0S/w4RGP8QExr/Ehcd/xMYHv8TFyD/ERgg/xYdJ/8Z ICr/FB0m/5Sdpv+osbr/rLW+/7fByv+2w8v/tMXM/7LHzP+mwcj/kbG8/3WbsP9gjKn/Tnqn /1OCuP9Je7r/Q3W6/0qBxP9Ohcj/RoDA/0iBuP9TiLD/VIan/1CApP9Pe6D/T3Wa/1Fylf9W cIv/Wm+C/3WDjP93gH//aGlj/0tHPv8zKSD/KBkU/zEfHf9GMS7/UjYz/00uKf9JKCH/KQgA /9m4qf/vzLn/3beg/8yiif/YqY3/26aG/92igv/ion//5qB+/+Sad//ekGz/14hh/9WGW//P glT/yH5P/8J6Sv+wbD3/mVkp/4lPIf+ETiD/cD0Q/5RlO//GmXD/572X//HJpv/zyqr/+NGy //3Ztf+Wekv/lHlE/6GDT/+piFP/qYBM/7qMWP/SoGv/2aRu/+Wudv/bo2r/ypJX/6JsLv+M WRr/nWwq/6+APP+5iUf/vIpP/7WMWP9lTyD/AwMA/zpQXv94ns3/cqTp/3Ko8v93peD/YYOx /3OCqf8/Q2j/SURs/3h0l//7/f//vMLY/0tUcf8iK0r/BAkn/zQ1Uf9HRFn/OzJD/1dHVP+q k5v/6MnO/+rCw/+gcHD/5rGt/7t+ef/Ghn3/kE1F/9WXiv90QS7/rIV0//DPyP//7/D///3/ /+v3//+fwt7/dKrY/2Cj5/9kqPH/aaHc/5O/5v/C3Ov/xtXY/8LP1f+9yMz/v8jN/7/Izf+/ yM3/vsnN/7zKzf+8ys3/u8rN/7vLy/+js7P/tsTF/73LzP/l8PL/7fX4//b7/v/7/////P// //Dx9v/x8vf/9PP4//f2+//6+f7//fz///////////////7////+/////v////7//////f// //3////9/////f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////f////3////7 /////f////3////9/////f////////////7+/v/+/v7//f3///39///9/f///Pz+//z7///7 /P//8fT7/1dcYv8SFx3/Iygu/yMqMv8RGCD/MThC/xojLP8fKDH/ICky/yAqNP8hKzX/Iiw2 /yMtN/8kLjr/Iy87/ys7Sv8sPkz/L0FP/zRGVP84Slj/PE5c/z9RX/9BU2H/SVtp/0pcav9M Xmz/TV9t/1BicP9RY3H/U2Vz/1Vlcv8qNED/Nz9K/zY8SP8fJTH/CA4a/wAGEP8CBhH/AwcQ /wEEDf8AAwz/AAIJ/wADCv8FBgv/CQoP/w0OE/8QERb/BAcM/wYJDv8ICxD/Cw4T/w8SGf8R Fhz/Exge/xQZH/8eJS3/GyIq/xsiLP8dJi//HCUu/5+osf+nsLn/tL3G/7fAx/+3wsb/tsTH /7LFyf+nwMX/j7C5/3SZrP9diab/VoKv/1iJw/9Shcf/TYPN/0+H0v9Hg8z/Q3/I/06Jy/9r p9n/ZaDM/1mRwP9Qhbf/T36y/1N/sP9bga7/YoWr/118mf9adYr/XnOE/2Z4hv9odYb/Y2uA /1dfdv9RUmf/PDRD/0o9Rv82Jy7/DQAA/5KAgP/hzMf/uKCW/8Snmf/Foo//x52H/8uZgP/P mHr/1Zh5/9aUdP/RjGv/zYVf/9SKXf/MgE//wHhI/7BqOf+LSxv/dTgJ/4lTJP+xfk///M2h ///Yrf//4rr//+W+///duf/41LL/9dGv//TSrP/myJb/w6Vv/7CPWf+je0f/nW89/8CMWv/T mWn/tXlH/7V3RP+kZjP/sHRA/6JpMv+VYSj/o3I4/6FzN/+jdTn/s4BH/6+FU/9SQRb/AAQA /0Fdcv91oNP/cKXr/3On8P+Ktez/eZjE/217oP8yNlz/REFs/4eFrf/1+f//maC6/wAKKv8K FTX/e4Gh/5OXsv+tqcD/ioGS/6KSnf+ymKH/5MHF///b3P//09L/36Oi/5dWUv/Hgn3/yoF7 /6llXP+ARjj/toJ3///Nzv//7PT//Oby/+7x//+BosP/fbLk/2Gh6P9oqPD/a6DW/5nC4v/E 3+j/w9bU/8LQ0/+9yM7/v8jN/8DHzf+/yM3/vsnN/77Jzf+8ys3/u8rN/7vKzf+nt7f/pra2 /5Ohov+fra7/nKao/6WtsP+wt73/ub7C/+jr8P/s7fL/7/D0//P0+P/3+Pz//Pv////+//// //////7////+/////v////7////+//////3///79/////f////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////f////3////7/////f////3////9/////f////////////z8/P// ////+Pj6//r6/P/6+vz/+vr8//79///7/P//gIWL/ygvN/8PFh7/KzI6/yYtN/8XHij/Hicw /yMsNf8fJzL/Hykz/yAqNv8iLDj/Ii46/yQwPP8lMT3/JTM+/zBAT/8xQ1H/NEZU/zhKWP89 T13/QVNh/0RWZP9GWGb/Slxq/1BicP9abHr/UWNx/0ZYZv9XaXf/UWNx/yc1Qv85QUz/LDM9 /xsfKv8NERz/BgoV/wQIEf8DBg//AQQN/wADDP8BBAv/AgUM/wMGDf8HBw//CQkR/woKEv8K ChL/Cg0U/wsOFf8MERf/DhMZ/xEWHP8UGR//Fhoj/xUcJP8UGyX/GSAq/x8oMf8WHyj/Nz9K /5agqv+irLb/rLW+/62yuP+0ub3/uMLD/7TExP+kubr/iaSr/2yNnv9Wfpj/X4mz/1aEuP9M fr3/SX7E/0uBy/9Kgsz/SIDK/0N+wv9Vksn/YJ3T/22q4/9yren/cKfo/2qg4P9qntr/bZ7W /1GBsv9Rfar/T3qk/1N9pf9agaz/XoKy/1yAtP9dfKv/ZXme/2Nykf9QXnn/V2F6/1Rccf91 eIn/hoaQ/56YnP+klpb/q5aR/7CUif+wjHz/rIFw/6x9af+0gGr/vYZo/7h5Vv+oaUD/mVs0 /3xCGv+UXTT/yJRs///Uqv//3LH//9yx///ds///27H//9iw//vRqf/0yKH/7MCZ/+a9kf/Y t4T/uZhj/5x3Q/+Wajn/pHFC/692Sf+qbUH/nl0z/4tKIP+SUSf/lVgs/5VcL/+aZzj/n3FA /5RqOP+FWif/k2Ar/511RP8iFQD/Aw8F/1F0kP9/sOj/dKry/3Ol7P9+ptn/dpK5/4uZvP8n LFL/MDFf/3J0nf/0+f//Z3GM/wACIv80QWP/gImo/42RrP+Cf5T/NSo6/5yLlf/jyM//+9fZ //TGxv/QmJf/z4+N/69oZv/BdnP/s2Rg/1MFAf+hWlT/kExL/7Bncv/gobL//9rt//Lo//+H o8v/eazl/2ai6/9mour/cqTV/6nR6v/H4+T/t8zF/7rJzP/AytP/usPI/8XN0P/Ayc7/wczQ /7rFyf+9y87/xNPW/52vsf+hs7X/tsjK/4aVmP+Ypqn/qbS4/622u/+psrn/mJ+l/6qvs/+f oqf/nqGm/7K1uv/T1tv/8fL2//v8///+////6urs//Pz9f////////////f19v///v//+/n6 //n3+P/+/v7//v7+//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////f////3////7/////f// //3////9/////f//////////////////////+fn7////////////8fHz///+//+9vsP/NDk/ /xwjK/8fJi7/Jy42/xsiLP8ZIiv/ISoz/x0mL/8fKTP/Hykz/yErN/8jLTn/Iy87/yUxPf8n Mz//JzVC/zFBUP8yRFL/NUdV/zlLWf8+UF7/QlRi/0VXZf9HWWf/S11r/1Zodv9WaHb/UGJw /1Fjcf9NX23/PlBe/zNBTv8xN0P/Jys0/xcZJf8KDhf/BQkS/wQIEf8EBxD/AgUO/wEEC/8B BAv/AwYN/wQHDv8ICBD/CQkR/wsLE/8JDBP/DA8W/w0QF/8OExn/ERYc/xQZH/8XHCL/Fx4m /xgfJ/8iKTP/GCEq/xskLf8YISr/TVdh/6q0vv+xu8X/rba//66xuP+wtLf/rre2/6q2tP+d r6//jqao/32bpv9wk6f/S3GV/053pf9QfbT/UH68/0t8vv9Ie73/S37A/0yCwP9Mhbz/VpLI /2ah3f9zre3/e7T5/363/v+Auf7/gbv7/4jD//92sev/YJjR/0+HwP9IgL3/SH/C/0qAyP9O gMX/T3y1/1uFt/9chLX/aY+8/1+CrP9hf6X/UmuK/1Jmf/9lcoX/cXSD/357hP+Kf4P/kH5+ /4t2c/+FaWX/gGBV/39aR/+IX0n/q4Vu/9y4oP/00Lb//tzA//zbvP/x0K//7s2q/+/Np//x y6T/8sig/+/Cmf/qu4//5LOI/+CwgP/LoG3/tIlU/5tsOP+QXCr/lFos/5lZLf+XUij/kUog /5dOJf+WTyX/kk0k/5FSJ/+cYTX/pG5A/5lmN/+IViX/mmUz/5JrQP8fFgD/Ch4c/12Kq/+E vPf/f7j//4K19/+Irtv/VW+Q/2RzlP82PmL/SEx5/4SJs//z/P//eoag/wAAIP9UYYH/gouo /5yguf8hHjH/XlJg/9vGz//oyc7/+NDR/9qop/+zd3b/nVdV/5ZIRv+mUlL/hS0s/3okJf98 LC3/axog/5I3Sf+5ZoD/zZex/8y52f+MpNL/cKDe/2ih7v9noOf/eqbT/63S5P/F49v/t83B /7rJzP+/ydP/usPI/8TMz//Bys//wMvP/7rFyf+8y87/wdDT/52vsf+itLb/ipye/zRDRv8u PUL/QE1T/2Fscv+GkZf/lp+m/6ats/+jq67/rra5/6Orrv+eo6f/k5ic/77Cxf/u8vX//v// //7////s7e//+vr8///////9+/z/6+nq///+///+/v7//v7+//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////f////3////7/////f////3////9/////f//////////////////////+vr8 ///////4+Pr//////+fm6/9iY2j/BwwS/xkgKP8oLzn/Iikz/xcgKf8aIyz/Hycy/xslL/8f KTX/ICo2/yAsOP8jLzv/JjJA/yg0Qv8pN0T/KjhF/zNDUv80RlT/N0lX/ztNW/9AUmD/RFZk /0dZZ/9JW2n/TmBu/1tte/9UZnT/UWNx/1dpd/8/UV//Kz1L/zxKV/8kKzX/HB8m/xAQGv8G CRD/BAcO/wUID/8FCA//AwYN/wIFDP8DBg3/BAcO/wYJEP8HChH/CQwT/woNFP8LDhX/EBMa /xAVG/8SFx3/FRog/xYdJf8ZICj/GyIs/xwjLf8pMjv/GiMs/x4mMf8XISv/U11n/5ymsP+l r7v/mqKt/6yvuP+vsLX/r7S3/7G7uv+zwr//tcnI/7TQ1P+10uD/qszl/5/D5f+LsNz/cJjL /1qDt/9Peq//UHuu/1KAsv9RhLP/S4Cy/0d7tP9GfLr/TYLE/1OJz/9XkNX/WJPX/2+s6/9i ouD/UpTR/0aKy/9Dhsz/QobR/0GE1f8/gtH/S4/Y/0yP0/9Dh8j/R4jI/0SCv/9PisT/U4i+ /1yMvf9Vfqr/VXed/1Zwkf9bcI3/ZXON/2pyh/9lan3/YWNw/2JfZv+PiY3/vbm6/+nj4//i 3dn/8uvj/+fd0f/cz77/1cOt/9jApP/au5z/2bOP/9apgv/Sn3T/zJZo/8mRYP+5gkz/rHM8 /51gKv+VUx//lk4c/5tPHv+eTh3/nUsb/5lFFv+cSBn/nkwc/59RIP+kWyb/qWIs/6FcJf+Q URz/oGM0/3pUL/8TDgD/Ey8z/2mexv9/v/3/g7///4m8+/9/pcz/YXuW/3CAmv9AS2n/PUZt /5qjyv/l8///Tl1y/yAuSf+Gka//cXiS/2Jkef8HAxL/gnV//9rDyf/mxMX/5Li3/82VlP+w b23/mU1N/4EtLf9/JSf/dxgc/4MnLP9uFx3/okhU//aOp//1lrT/tHWU/4pxmP99lMb/a5ze /2qh8f9qn+X/gqzU/7HT3f/E4NL/uM+9/7rJzv++yNT/vcTM/8TMz//By83/v8rM/7vGyv+7 ys3/u8rN/56wsv+mub3/fZCU/zZITP82RUz/NURL/ys4QP8lMjr/ICsx/z5JTf+FkJT/prG1 /6Ousv+lr7H/nKao/5GZnP+YnaD/3eHk//z////y9vf//v///+3u8P/6+vz//v7+//39/f/+ /v7//v7+//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////f////3////7/////f////3////9 /////f////////////z8/P/4+Pj//Pz+//r6/P/29vj//////4yLkP8gISb/GyAm/yMqMv8h KDL/HSQu/x8oMf8aIyz/FyEr/yMtN/8gKjb/Iiw4/yIuOv8lMT3/KTVD/yw4Rv8tO0j/LDxJ /zZGVf82SFb/Okxa/z5QXv9CVGL/R1ln/0pcav9MXmz/UmRy/1lref9XaXf/U2Vz/0xebP8z RVP/JTdF/zVDTv8ZHSb/ExMb/wgIEP8DAwv/BAQM/wUID/8GCRD/BQgP/wQHDv8FCA//BgkQ /wcKEf8JDBP/Cw4V/wwPFv8MDxb/Exge/xQZH/8WGyH/GR4k/xkgKP8cIyv/HiUv/x4nMP8Y ISr/FB0m/yQuOP8dJzH/TFZg/36Ikv+Unqr/lZ2o/6yuu/+rrrf/qq+z/6u1tv+xwL3/uc3L /8Pb2//I4+r/utfn/7jY7/+52vn/vN7//73f//+11/3/psjt/5e94f92ocT/Z5W5/1eDsP9M eqz/S3qy/0t8t/9He7f/Qnq3/0uGwP9Hhb7/RYbA/0WJxv9Gi87/Q4nR/zuAzv8yecn/OIbR /zyM1f9Ajtj/RpTc/0OQ1v9DjNH/PoPG/z1+vv9Lh8X/T4a//1SGuf9bh7b/YIaz/15/qv9V dZz/UG2P/1Zvjf9edpD/WHCI/0theP85TmH/YXOB/4iWn/+apKb/urq4/7y1q/+7q5z/uJ+L /7GReP+rhGX/pnlY/6VzTv+ZYjn/j1co/4VIG/+BQRP/hkIV/41DFv+PQRP/jz4P/5pGF/+i TBv/pU8c/59MFv+bSRH/nUwU/6VVGv+mXSb/nl8z/1w4GP8BAgD/Gz1J/2mm1f9utff/dbX8 /4C08P93m73/ZYCT/4CSpv9reZP/VWOG/7fG5//t////c4SU/zNCWf+Dj6n/V190/zAxQ/8y LDj/wbK5/6WLjv/Npqf/6bm3/9mdnP+0bWv/q1lb/3wiJP99Gh//qUFI/3cTG/+iS1T/44iX //+vyf/5lLb/tHGU/4Jpkf+FoNX/a6Lj/2qj9P9qn+P/irLV/7bV2v/A3Mb/uc+6/7zJz/++ xtP/vsXN/8PLzv/Cys3/vcjK/7zHy/+6ycz/s8LF/5+xs/+yxcn/aXyA/yk6Qf8oOUD/Lz5F /y49RP81Qkr/PElR/zZFSv8bKi3/T15h/7XEx/+bqar/p7K0/6y2uP+Mlpj/bHR2/9bb3v/2 /Pz/9fn6//b6+//+////8fPy//z8/P/+/v7//v7+//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////f////3////7/////f////3////9/////f////////////j4+P/9/f3//v7///r6/P// ////y8vN/zo5Pv8VFhv/KC83/yYvOP8ZIiv/GSIr/yQsN/8bIy7/FR8p/ygyPP8gLDj/IS05 /yQwPv8oNEL/KzlG/y89Sv8xP0z/MUFO/zlJWP85S1n/PU9d/0FTYf9FV2X/Slxq/01fbf9P YW//Vmh2/1Vndf9abHr/UWNx/zZIVv8rPUv/KTtJ/yAuOf8PExz/DAsR/wQDCf8BAgf/BAUK /wgJDv8ICQ7/BwgN/wgIEP8JCRH/CAsS/wkME/8LDhX/DA8W/w4RGP8OERj/FRki/xYaI/8W HSX/GB8n/xsiKv8eJS3/Hygx/yApMv8lLTj/ISs1/ykzPf8QGiT/GCQw/yIuOv8uOkb/MDpG /0dMX/9VW2v/bHV+/4SSlf+Yq6n/qL24/63Gw/+wysv/zuny/8fj8f/A3e//vtrw/7/b8f/A 2vH/vdjt/7jV5//R8P//x+f8/7nb9/+tz/L/ocTs/42y3v90ncn/Yo67/1WGr/9Ngqr/R36n /0R/q/9Ggrb/SIW+/0eDwv9BgsT/SpHT/0aR1P9Fktb/Qo/T/0KP1f8/idD/PYfO/zuEyf9D ic7/SIvP/02Nzf9Pi8n/T4fC/1KGwP9XisP/XI7D/2KSwv9Me6f/U4Ku/1yLtf9gjbT/UX2g /1Z/nf9WepT/TGd8/1Nmdf9cZnD/Zmds/3Foaf96a2j/gm1o/4puYv90Tjn/bkIn/2c6Hf9v PiD/gUws/5BVM/+SVC//jk0l/55XK/+dUyT/mkwb/5VED/+RPwf/mEMK/6lVGf+zZi7/nl80 /0snDf8AAgD/LFJl/2ap3v9eq/H/Zaju/3Wp4v9jiKP/S2Vy/5asuf/t////2e3//+L3///P 5fL/kaWu/3KBlP+Gkaf/REtd/woJF/8gGSH/2MjL/3dbWv/Sqqj//8vH/9+emv+tX1//jjU3 /3wbIv+YLjj/w1Vg/5QuOf/RgIn//627//+atv/Xc5X/unmb/5F8pf+Dptz/ZqPm/2il9f9p nuL/k7rZ/7jW1v+9177/vM+5/77Jzf++xNT/wsbP/8LKzf/Cys3/u8bI/73IzP+5yMv/q7q/ /6Cytv+vwsj/Vmtw/y1AR/8wQ0r/NEVN/yw9Rf8uPEX/M0FK/zZITP8pPT7/HC4w/2Fzdf+e rbD/oK+y/6Kwsf+5xMb/bnh5/11naP/K0tT/+v////H39//8/////P////b3+f/+/v7//v7+ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////f////3////7/////f////3////9/////f// //////////v7+//////////////////7+/3/WVlb/yAfJP8oKS7/Exoi/x8oMf8cJS7/GCEq /yAoM/8dJTD/GiQu/yYwOv8hLTn/Ii46/yYyQP8qNkT/LjxJ/zJATf82RFH/NUVS/ztLWv88 Tlz/P1Ff/0NVY/9IWmj/TF5s/09hb/9RY3H/WGp4/1Nlc/9Yanj/R1ln/yc5R/8mOEb/JTdF /wwYJP8MDxj/CQgO/wMCCP8CAQf/BQYL/wkKD/8JCg//BwgN/woKEv8KChL/Cg0U/wsOFf8N EBf/DhEY/w8SGf8QExr/FRki/xYaI/8WHSX/GB8n/xsiKv8eJS3/Hygx/yApMv8jLTf/ISs1 /yQuOP8cJjD/ICw4/yQwPP8rN0P/LTlH/zhDWf8uOU3/IS88/xkqMf8gNDP/M0pE/0liXv9Y cm//boiJ/4Gan/+bs73/sMjU/7vR3P/B1d7/wtbd/8PY3f/E2dz/xNzg/8ff6//J4/T/y+P7 /8Tf+v+41/P/r9Hs/7bb9f+lz+f/jrrT/3qpxf9pmrv/XI21/1GBr/9Geqz/PHis/zt8sv9H iMD/R4nF/0yQzf9Bhsf/P4TH/zd9wv9Fi9H/RIrQ/0KHzP8+gcX/P4DE/0yLzv9joOH/dbHv /3u48f9kodj/aKXc/1yb0P9Wlcr/P36x/0eDtf9Be6n/V4q3/1mGr/9Zf6T/Wnia/11ykf9f b4n/YmyF/2hrfP9pYmn/ZVdX/19QTf9oV1D/e2Va/4drXf+GZVL/gVtE/4peQf+FUzD/hkwm /5BRJv+bVyr/nVUj/5xTIP+aVCP/nmA7/0YjDf8ABAP/Q3GJ/2Ss5v9aqvP/YKTr/3Kq3f9k ip//Um10/3WMkv+rwc7/qMHX/8Tf8v+atrr/dIyQ/4ubqv97hpj/VFpq/y0rNv+OhYr/xLKy /0QlIv/AlY//7rey/9SPiv+6aWj/bhIV/4IaI/+iND//oSw8/9dxfv/poKf//7/L//eTrf/I aYn/q2+R/4V5of9xmtD/Y6jr/2ao9v9on+D/nMHc/7rX0/+50rX/vc+1/8DHzf++wdL/xMjR /8PIzP/Cys3/u8XH/77Jzf+4x8r/orS4/5+ytv+Uqa7/NElO/yM2Pf8nOkH/LD1F/y0+Rv82 RE//PU5W/yg9QP8wRUb/LEFC/zxQUf+Zra7/orS2/7fHx/+dq6z/jpyc/z5KSv96hIX/pq6w /+ft7f/7////+v7///z////9//7//v7+//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////f// //3////7/////f////3////9/////f////////////////////////////f3+f+goKL/FxcZ /yUkKf8oKS7/DBMb/xkiK/8dJi//GyQt/xwmMP8cJjD/Hig0/yQuOv8iLjr/JDA8/yY0Qf8r OUb/MD5L/zVDUP85Rlb/OUlY/z1NXP8+UF7/QVNh/0ZYZv9KXGr/TmBu/1Jkcv9TZXP/V2l3 /1dpd/9NX23/OEpY/yY4Rv8iNEL/FSc1/wIOGv8LDhX/CggN/wQDCP8EAwj/CAcM/wsKD/8J Cg//BgcM/wsLE/8MDBT/Cw4V/wwPFv8OERj/EBMa/xEUHf8RFB3/Excg/xMaIv8VHCT/Fx4m /xohK/8dJC7/Hicw/x8oMf8jLTf/Iiw2/xwmMv8jLTn/ICw4/yIuOv8hLTn/IS4+/xspRP8i Mkz/Lj9R/zdLVP85UVP/Nk9L/y9KQ/8qRT7/JT88/y5GRv88UVT/SV5h/1ltbv9ugX//hpaT /5alnv+7yL7/wM3D/8PSzf/F1dX/xtXc/8XX4f/I3Of/yd/q/8Xg5//B3uT/vNvg/7nb5P+4 3Or/ttnt/6/R7P+nzOn/gqvL/3Ccv/9jk7n/Snuk/0p+rf9DeKz/Toa//06Kxv88ebr/P37B /0SFx/9Ki8//To/T/1GS1v9VlNf/V5fX/2up5v91s+7/f8H7/2yx7P9LktD/PIjG/0OOz/88 isr/O4XG/zyDw/9AgcH/RYLB/02Fwv9XicT/YI7J/2iRx/9ggq//W3uh/1Z0lv9WcY7/V22F /1Znef9RXmf/T1RY/2toY/9mWk7/a1ZF/4FiTf+RbFL/kGRH/4RWNf9/TSz/kVo8/0AfDP8A CAr/V4im/1+r6f9Yq/f/XKXq/3Su3v9hiJn/haGi/4ymp/+BmqH/mbTF/+P///+evLz/YXt6 /5ustv99hpX/ZGh0/19eZv/az9P/i3d2/21MR//ww73/5q2m/9WOiv/UgID/eRoe/4kfKf+b Kzf/kBoq//KMmv//wsj/5amx/8Nnfv+nTmz/kV59/4mErP9xo9j/Yazv/2Wq+P9ln97/ocbg /77Z0v+2zbD/wNC2/8LHzf+/wNL/xsnS/8PIy//Cys3/ucPF/7/Kzv+4x8r/nK6y/6Czt/+E mZ7/Kj9E/zNHTv82SlH/MUNN/yo8Rv8nN0T/JjhC/ytDR/8xSUv/JT09/1xxcv+zyMn/lKip /5utrf+0xMT/hpSV/yUwMv9GUFH/ZG5v/4uUk//I0dD/9/39//f7/P/9//7//v7+//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////3////7/////f////3////9/////f////////// //7////09ff//P3//+Lj5/83ODz/FBUZ/ykqL/8WGSD/ICcv/xkjLP8ZIiv/HScw/x4oMv8Z Ji//Hig0/yQwPP8iLjr/IzE8/yc1Qv8qOkf/MT9M/zREUf86R1f/OkpZ/z5OXf8/UV//QlRi /0dZZ/9LXWv/T2Fv/1Nlc/9UZnT/Vmh0/1xuev9EVmL/LT1K/y4+S/8iMD3/BxUi/wIMFv8N DRX/CwkO/wYECf8GBQr/CQgN/wwLEP8JCg//BgcM/wwMFP8KDRT/DA8W/w0QF/8PEhn/DxQa /xAUHf8RFR7/EBch/xEYIv8TGiT/Fh0n/xkgKv8cIy3/HSUw/x4mMf8THSf/GSMt/xUfK/8o Mj7/Hio2/yQwPP8jLzv/KzhI/yIyS/8mN1H/LkBU/zVIVv82TlL/NExM/zFKR/8uR0T/PlRS /zdMTf8vQ0T/L0FD/zVHR/8+Tk3/QlFO/0VSS/81QTX/SFRI/2NuaP97h4X/jZuc/6Cusf+x wMX/u83R/8ba2//C19j/wNjY/8Lc3f/H4OX/xeDp/8Hb6P+71uf/v9vw/7va7//D4/z/sNPv /63R8/+Ntdn/fqnT/2uaxv9QgLH/R3ms/0F0qf9Cdar/R3yy/0uAtv9JfrT/RHuz/02Fvv9H grz/TozH/2Kk4f9Ch8j/NX7C/zOAxv9Ektr/O4nU/zmH0v83g9H/OIHQ/zuC0v9BhNP/R4jY /0yL2P9BgMX/R4TF/0yIxv9NiMD/TYW4/06Brv9UgKf/W3+f/117k/9SaXn/T11o/1xgaf9n ZWj/amFi/25jYf94ZmL/blVR/ygcIP8ACRv/X5G2/16k4v9fqu7/YaLi/3qu3f94nrH/nLm9 /5y4u/+Tr7L/uNXd/+j///+Prqb/bYiB/5mqsv+Wnqv/kpCd/8q+yP/CrbT/ZUhK/62KiP/3 zMb//8zI/+Wfnf/WgIH/jisw/48kLv+cLDj/qDhG/9p6hf//w8L/0pya/8V1fv/Beoz/l3WQ /46Xvv9ppt//T6Di/2Or8/9nn9j/pcnf/8HY0v+2yrH/wc66/8PGy/++wM3/xsvR/8HJy//B y83/ucPF/77Mz/+3xsn/mauv/6Czt/9/kpj/ITY7/zFFTP8tQUj/JzpB/yg6RP8vQEr/MkRO /yk+Q/8tQkX/TWJl/6zBwv+Mn6P/k6eo/7HDxf+ntrn/R1VY/x4sL/8lMDL/PUdJ/1NdXv99 h4j/xc3P//v////9/v///v7+//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////3/9vXz /////f////3//Pz8//X19f/19vj/+vv9//H1+P/8////9Pn9/3d8gP8TGiD/ICct/x0kKv8a ISn/FiAp/xYjLP8aJC7/Gicw/x0pNf8fLTj/Ii46/yIwO/8nNUL/JzdE/yo6Sf8uQE7/NERT /zdJV/88TFv/Pk5d/0lZaf9DU2P/RlZm/1Bhcf9TZXP/TF9t/0xga/9UaHP/XXF6/0VXYf8p OkL/PEpT/zdBSv8NFh//BQwW/wIFDv8JBg3/CAYL/wgGC/8IBgv/BwYL/wcGC/8GBwz/BgcM /wkME/8KDRT/DA8W/w0SGP8QFB3/EBcf/xIZIf8TGiT/Fx0p/xogLP8dIy//ICYy/yAoM/8f JzL/HiYz/x0lMv8XIS3/GSMv/xomMv8fKzf/JDA8/yk1Qf8rOUT/LTtI/yo6Sv8qO0v/LD5M /y5ATP8wQkz/M0ZN/zVIT/82SVD/PE9W/z5RWP8yQ0v/LT5G/ztMVP89Tlb/NURL/zVESf8/ TlH/MD9C/yEwNf80RUz/MkNK/z1OVv82R0//PE9W/2h7gv91iI//iJyj/56yuf+vw8z/us7X /77S3f+90+D/y+Hv/8nf7f/F3Oz/w9rs/8DZ7f/B2u7/wdzx/8Le9P+yzub/utbu/7HP6f+V s83/eZex/2qIov9hf5n/VXea/013qf9KeLP/S3y2/0x+u/9MgsL/TIPG/0mEyv9IhM3/P37L /z6Azv8/gtP/QYPX/0OF2/9Fh97/Rong/0WL4f9DkOL/QI/e/z2K2P86htH/OoLK/z2Cx/9A gcH/RYG9/1KJwf9Th7n/VIKz/1N+q/9UeaX/Vneg/1d3nv9adp3/XHWd/0dkjv9CaJf/WYi8 /2uf2f9soNr/cqHV/4Cr1f+fw93/utrp/978///m////6v///9j47f+buqr/hJ6R/5SjqP+e oK3/uqm5/9u/zv+XcYD/ZDpE/6F6ff+edHX//9HQ//Kur//Ib3X/qURM/6w+Sf95Dhj/eRgf //uqqf/3uar/vYZx/6JjUv+hdG//hX6Q/36fyP9Zo+L/Xrb9/12n5P92r9z/tdbp/8PX1v+3 x73/v8vB/77EwP++xMT/wMrL/8TP0f+9yMz/uMbJ/73Lzv+2xcj/nq2y/5+xtf9qfID/LkFF /y9CSP8hNDr/O05U/zdKUf8cLzb/MkNL/yw9RP89TFP/kJ+m/6Gwtf+gr7b/m6qv/6e2u/9m c3n/Hywy/xsoLv8dKjD/ICsx/zpFS/9CTVP/aXR6/93m6//8/f///f39//39/f/+/v7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////3///78/////f////3/+fn5//r6+v/+/////P////f8///7 ////r7a8/x4lK/8bJCv/Hicu/x8oL/8fKTL/FSIr/xYjLP8YJS7/Gygx/x0rNv8fLTj/IS86 /yMxPP8mNkP/KDhF/yo8Sv8vQU//NEZU/zhKWP88Tlz/PlBe/0lWZ/9IVWb/Slpq/1Bhcf9T ZXP/UGNx/05kb/9RaHD/TWFo/zxPVv80Q0r/KzhA/yEqMf8RFR7/AQQN/wUEDP8IBQz/CQcM /wkHDP8IBwz/CAcM/wcIDP8HCA3/BQgN/woNFP8KDxX/DBEX/w4TGf8PFh7/ERgg/xIbIv8T HCX/GB4q/xogLv8eJDL/ICY0/yEpNv8gKDX/Hyc0/x0lMv8iLDj/Iy05/yIuOv8jLzv/JTE9 /yYyPv8mND//JzVA/yU1Qv8lNUL/JzdE/yk5Rv8rO0j/Lj5L/y8/TP8wQE3/Lz9M/zREUf80 RFH/M0NQ/zFBTv8sPEn/LT1K/zdHVP85S1X/LT9J/yw+SP8tP0n/Q1Vf/zBCTP8xQ03/PE5Y /zlLVf81R1H/MkRO/zVHUf9EVmD/Wmx2/3KEjv+Akpz/orTA/6i6xv+xw8//uszY/8DS3v/D 1eH/xNbi/8PV4f/C1OD/y93p/8/h7f/K3Oj/x9nl/8XX4/+8ztr/rMLX/5S22/+Fq9j/cpvJ /1+Juf9TfLD/THqu/0x7s/9Lfbj/T4LD/0uCxf9Igcj/RoLK/0aBzf9Fg9D/RYTT/0KH1f80 gdH/MYLR/zSD0v81hNH/NoTP/zmDzv86gsr/PYHI/12g5P9bmt3/VJHS/0yIx/9GgL//RHy5 /0N5tf9DebX/SXy7/0d6uf9Hebb/TH24/1aEv/9fjMP/ZZHC/2eQvP9tlbn/jrPQ/7jd8P/L 7/v/3P///8/y7v+avbb/hqWg/4ado/+Xoa3/2s/g/5+El/9nRVX/WTVB/0AhJv9rTU3/7MTE //O7vP/Sg4j/ym11/4AcJP9sEBX/l0dI///Cuf/ws57/uYNn/6BtUP+lhXj/e4KS/4Cr1f9d q+3/U6zw/2Cn3f99sdb/uNXl/8PV1/+3xcX/vsrG/7zHv/+7xr7/vMjI/7/Nzv+6yMv/t8XI /7zLzv+zwsX/nq2y/5yrsP9VZ2v/MUNH/y1ARv8sP0X/LkFH/yw/Rf8pPEP/KTpC/zFAR/9r eID/o7C4/56rs/+qt7//qLW9/4eUnP89SlL/Hyw0/xIfJ/8YJS3/HSoy/yk2Pv82Q0v/O0hQ /7/Izf/6/v///f39//39/f/+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////3////9/////f/9 /Pr//Pz8//7+/v/+/////P////v////j6Oz/T1Zc/wsSGP8VHiX/Ljc+/xQeJ/8ZIyz/FiMs /xckLf8ZJi//HCky/x4sN/8gLjn/IjA7/yQyPf8nN0T/KTlG/yw+TP8wQlD/NUdV/zpMWv8+ UF7/P1Ff/0ZTZP9NWmv/UGBw/1Bhcf9TZXP/Vml3/1VpdP9RZW7/PVBX/zFES/82RUz/FyEq /wcQF/8PExz/AAAH/wQDC/8IBQz/CQcM/wkHDP8JCA3/CQgO/wkKD/8JCg//CAsQ/wwPFv8M ERf/DhIb/w4VHf8RGCD/Exoi/xQdJP8VHif/GR8r/xwiMP8eJjP/ISk2/yIqN/8hKTb/Hyk1 /x4oNP8kLjr/JS87/yQwPP8kMDz/JDI9/yUzPv8mND//JjQ//yU1Qv8lNUL/JzdE/yg4Rf8q Okf/LDxJ/y09Sv8uPkv/NkZT/yk5Rv81RVL/VGRx/2R0gf9ba3j/RVVi/zFBTv8rPUf/CRsl /yw+SP9CVF7/PE5Y/zJETv9AUlz/ITM9/zFDTf80RlD/OUtV/z5QWv9AUlz/P1Fb/z5QWv88 Tlj/OkxY/0FTX/9QYm7/Y3WB/3mLl/+Nn6v/na+7/6a4xP+4ytb/vtDc/8LU4P/D1eH/ydvn /9Lk8P/X6fX/0uj2/8Hg9P+94Pb/ud31/7DV7/+kyeT/k7zY/4Svz/97p8r/X4yz/1iHsf9P gKv/Rnqp/0Z6qv9Kf7H/UIi7/1KNxf9Li8n/RorL/0SIyf9Chsf/Q4TG/0OExP9FhcX/RYXD /1qX1v9enNn/ZKDe/2ik4v9no9//ZJ/b/1+a1v9bltL/Uo3J/0aAv/9Gfrv/TITB/0l/vf8/ c6//Q3Ww/1OEvP9PfrL/WYi2/2CNtv9ciar/apiy/3Ogt/9lkqX/Z5Ki/2qUov+Rrrz/n6i5 /2lldv9TR1X/RThB/0E3OP8pHhz/2MO+/9Sxrf/coqH/oFpa/2MXF/9gGRf/3aGZ//jCtv/N mIb/qXZh/59vWf+fgXf/cnmL/3ulz/9gp+f/T6Dh/2em2f+Ittf/uNTi/8DS1P+2xsX/usrH /7nIw/+5xcH/tsTE/7vJyv+4xsn/t8XI/7vKzf+su77/nKuw/5Oip/8+UFT/MUNH/yQ3Pf8z Rkz/Jjk//yg7Qf80R07/JDU9/1JhaP+hrrb/mqev/6q3v/+ksbn/r7zE/0tYYP8dKjL/JDE5 /xIfJ/8ZJi7/Ii83/x4rM/8oNT3/FCEp/6Wus//6/v///f39//39/f/+/v7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////3////9//v6+P/+/vz///////z9///4/P//8/f6//v///+Ok5f/GyIo /yQtMv8SGyL/Ji82/xQeJ/8UHif/FyQt/xglLv8bKDH/HSoz/x8tOP8iMDv/JDI9/yUzPv8q Okf/LDxJ/y5ATv8zRVP/OEpY/zxOXP9AUmD/QlRi/0RUZP9RXm//VWV1/1Jicf9TZXP/WGx3 /1Vpcv9MYGn/NEdO/ys8RP8mMzv/CxYc/wEIEP8KDhf/AgUM/wMECf8HBgz/BwYL/wgHDP8J Cg7/CgsQ/wkMEf8KDRL/Cw4T/w4TGf8PFBr/DxYe/xEYIP8TGiL/Fh0l/xYfJv8XICn/GyEt /x0jMf8gKDX/Iys4/yQsOf8jKzj/ISs3/x8pNf8cJjL/Gycz/x4qNv8hLTn/JDI9/yc1QP8q OEP/KzlE/yo6R/8rO0j/LDxJ/y09Sv8uPkv/Lz9M/zBATf8wQE3/ITE+/zREUf91hZL/tsbT /8HR3v+vv8z/nq67/5Cgrf96jJb/eoyW/19xe/9LXWf/KjxG/y5ASv8wQkz/QlRe/y9BS/8z RU//OEpU/ztNV/88Tlj/OUtV/zVHUf8yRE7/QVNf/z9RXf89T1v/PE5a/z5QXP9CVGD/R1ll /0tdaf9abHj/cIKO/4yeqv+fsb3/qLrG/7HDz/+8ztr/wtbh/73Y3/+82d//vNvg/7za4v+7 3OX/vN7o/7zg7P+84fH/stnq/6/V6v+n0Ob/mcPb/4OvyP9smLP/VoOg/0l3mf9Geab/RHes /0R3rP9DeKz/Rnuv/0p/tf9Mg7n/ToW7/1mSyf9gmdD/aaTc/3Ou5v96te//fLfx/3m27/93 tO3/ca3p/2ai3v9intz/ZaHf/16a2f9Qisr/SYPD/0+Gx/9OhcX/VY3K/1CHwP9FfLL/TIS3 /1CIt/9MgrD/ToWs/1CJpP9toLX/V3eO/2N1jf9bZnr/TVZl/4iVnf8rNTb/zMzM/9LEw//B oaL/pnp7/1spLP+wgID/8MvF/82rov+ogHj/oHVs/6B2av+Hb23/d4KY/3egzP9lqeb/Yavo /2yl0v+TvNj/u9Pf/73P0f+yxsX/tsrI/7nJxv+2xsP/s8HB/7fFxv+3xcj/t8XI/7rJzP+j srX/mKes/4aVmv8uQET/LkBE/x4xN/8xREr/Kz5E/y1ARv8vQkn/N0hQ/4uaof+tusL/laKq /6u4wP+ms7v/gY6W/yIvN/8ZJi7/KTY+/x4rM/8hLjb/KDU9/x4rM/8YJS3/FSIq/6KrsP/6 /v///f39//39/f/+/v7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////3////9//n5+f////////// //b3+f/7////9/v+/9bb3/8yNzv/HSQq/xkiKf8gKTL/ChQd/x8pMv8gKjP/GSYv/xonMP8c KTL/Hyw1/yEvOv8jMTz/JTM+/yY0P/8sPEn/Lj5L/zFDUf81R1X/Okxa/z9RX/9CVGL/RFZk /0ZWZv9SYnL/V2d2/1Rkc/9SZHL/Vmh0/1BibP9FV2H/M0RM/yY3P/8LGCD/CRQa/wkQGP8E CQ//Cg0U/wUGC/8GBwz/BgcL/wgJDv8ICxD/Cg0S/wwPFP8NEBf/DRIY/xEWHP8SFx3/Ehkh /xQbI/8VHif/GCEq/xkiK/8aIyz/HCQv/x4mM/8iKjf/JS06/yUvO/8kLjr/Iy05/yErN/8Z JTH/GiYy/x0pNf8eLDf/IS86/yQyPf8mND//JzVA/ys8Rv8rPEb/KzxG/yw9R/8sPUf/LD1H /y0+SP8tPkj/L0BK/yM0Pv9DVF7/fY6Y/6O0vv+4ydP/xtfh/8jZ4//D1d//wdPd/8rc5v+i tL7/MUNN/yo8Rv87TVf/JTdB/z9RW/8+UFr/O01X/zlLVf85S1X/O01X/z5QWv9AUlz/N0lV /zpMWP8/UV3/Q1Vh/0RWYv9DVWH/QFJe/z5QXP9CVGD/QVNf/z1PW/84Slb/OEpW/0ZYZP9h c3//eIuS/5SqqP+iubP/tM3H/8Xe2v/N5uL/yePg/8Da2f+20tP/uNbY/7zZ3f/C3+X/xePr /8bk7v/B4uv/vd3o/7jZ6v+sz+v/mb3h/36ixv9jia7/U3qh/054oP9Tfqj/VYSu/0x8qv9I fKv/Rnyr/0Z+sf9Ohbv/WJHG/2Ke1P9opdv/barh/3+99v98uvX/aKbj/2uo6f99uv3/bqrw /0eGzf83db7/R4fR/0WFz/9Bgcv/R4fP/0SHzv9AgMj/PYHA/z2Gs/8+gqf/WY+1/1uGqf9T dpb/XX+a/3mcsP9efov/do6a/4SRmv+Nh5P/moqV/3Vhbf/Wxc//y8LH/6KXm/+FbnT/i25z /4Voav9YS1X/e4qp/3Cayv9goN3/aKrk/3Kjy/+hxNr/vtLb/7zMzP+xxsf/scnJ/7fLyv+z xsT/ssLC/7bExf+4xsn/t8XI/7nIy/+Xpqn/kqGm/3SDiP8hMzf/LD5C/yU4Pv8vQkj/MURK /y9CSP8rPkX/Z3iA/6m4v/+ap6//rrvD/6Kvt/+cqbH/N0RM/xonL/8hLjb/JTI6/yc0PP8j MDj/JTI6/yAtNf8PHCT/NkNL/6avtP/6/v///f39//39/f/+/v7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////3////9////////////+fr8//P09v/8////8/j7/2Jna/8PFhz/GyQr/xMcI/8i LDX/GCIr/xIcJf8mMDn/Gicw/xsoMf8dKjP/IC02/yIwO/8lMz7/JzVA/yg2Qf8uPkv/MEBN /zNFU/83SVf/PE5c/0FTYf9EVmT/Rlhm/0xcbP9SYnL/V2d2/1Zmdf9SZHD/TV9r/0RWYP88 TVX/Lj9H/x4tNP8ACA7/ChMa/w8WHP8ABQv/DA8W/wUIDf8DBgv/BAgL/wYJDv8IDRH/Cw4T /w0SFv8PFBr/EBUb/xQZH/8SGR//FBsj/xceJv8YISr/GiMs/xwlLv8dJi//HiYz/yAoNf8j Kzj/Ji47/ycxPf8mMDz/JC46/yEtOf8lMT3/JTE9/yMxPP8iMDv/IS86/yAuOf8fLTj/Hy04 /yY3Qf8mN0H/JTZA/yU2QP8lNkD/JTZA/yU2QP8lNkD/NUZQ/zBBS/8uP0n/HzA6/wQVH/8E FR//Lj9J/1hpc/+ClJ7/kKKs/4eZo/9MXmj/OEpU/yw+SP86TFb/O01X/zVHUf81R1H/NkhS /zVHUf80RlD/MUNN/y5ASv8tP0n/OkxY/zpMWP86TFj/OkxY/zlLV/84Slb/NkhU/zVHU/8+ UFz/PU9b/0BSXv9EVmL/P1Fd/zFDT/8mOET/IzY9/z9RUf9CVU//Sl1X/1lsZv9vgn7/ip2Z /6G1s/+wxMP/yNzb/8fb3P/G2tv/xNfb/8LX2v/B1tn/wdbZ/77V3f+zytz/utPp/8be9v/K 5v7/wuD6/7HQ7f+avdv/irHS/22Vuf9lkbb/WIiw/0+Aqf9Ie6j/RXmo/0Z8qv9Gfq3/Qnys /06KvP9QjMD/TIe//1uX0/9xrez/Z6Tn/0eGzf9Fhc//U5Xj/0SH1v87f9D/P4PW/z6E2f9H jeL/SpTf/zuLyP9BjsL/VZbM/0V/sf9QgrP/YJG8/0Z4nf9pl7j/W4Sg/1h3k/92iaf/doGd /3B3lP+Bi6b/aHiR/2Fthf97eZH/enCI/29jd/9FR2D/fZXB/3Oi2P9hnt3/ZqPa/3ijxv+v yt3/wNHY/7rIyf+xxsn/r8nK/7fMzf+yxsX/tMTE/7bExf+6yMv/uMbJ/7fGyf+Lmp3/ipme /2Fwdf8eMDT/LD5C/zFESv8xREr/MkVL/y9CSP9CVVz/l6iw/52ss/+grbX/s8DI/6i1vf9f bHT/Gygw/xMgKP8nNDz/HCkx/yIvN/8dKjL/HSoy/x4rM/8fLDT/W2hw/5+orf/6/v///f39 //39/f/+/v7///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////5+fn/////////////////9vf5//n6/P/7 ////tbq+/xYbIf8aISf/FR4l/yEqMf8ZIyz/LDY//woXIP8cKTL/Gygx/xwpMv8eKzT/IS43 /yMxPP8mND//KDZB/yk3Qv8wQE3/MkJP/zRGVP85S1n/PlBe/0NVY/9GWGb/SFpo/1FhcP9S YnH/VWV0/1lpeP9TY3D/RFRh/zhJU/82RE3/IjA5/xAdJf8BDBL/BxAX/wkQFv8BBgz/BAcM /wkMEf8CBwv/AwgM/wYLD/8HDxL/DBEX/w0UGv8PFhz/EBcd/xQbI/8VHCT/Fh0n/xghKv8a Iyz/HCUu/x4nMP8fKDH/Hyc0/yIqN/8kLjr/JzE9/ygyPv8nMT3/JDA8/yMvO/8sOET/KzlE /yo4Q/8oNkH/JTZA/yQ1P/8jND7/IjM9/yY3Qf8mN0H/JTZA/yQ1P/8kNT//IzQ+/yM0Pv8j ND7/JTZA/yo7Rf8rPEb/LD1H/y9ASv8sPUf/L0BK/zlKVP8bLTf/DyEr/yY4Qv8pO0X/MkRO /zZIUv9BU13/JDZA/zJETv8wQkz/LT9J/y0/Sf8xQ03/N0lT/z5QWv9DVV//N0lV/zVHU/8z RVH/MkRQ/zVHU/86TFj/QFJe/0RWYv82SFT/MEJO/zFDT/85S1f/OkxY/zZIVP82SFT/Pk9Z /z9OVf8+TVL/Pk1S/z1MUf88S1D/PEtQ/z1KUP8+S1P/VWJq/2Rxef98iZH/l6Ss/6y5wf+5 xs7/v8zU/7/N1v/H1+T/xNbk/8PU5P/C1eT/wdbn/8Ha7v/D3vP/wuD4/7zc9f+22fX/rdHx /5/G5/+NuNr/e6fK/22Zvv9kkbj/VISs/0h5ov9EdaD/TH+u/1GEuf9Lgrr/SIC7/0mDw/9A fcD/VZPc/0mJ0/9DhdP/QoXW/zh8z/87gtT/N4DP/zyK1P9Mmd//O3/G/zx7wP9Oicv/bafm /1OLxv9akcn/SXyx/1KAtP9Lc6f/bpLG/1JzqP9mir7/Vn6x/3SYyv92jLv/cYCr/3B8pP9e c57/cZrS/3Kq5/9kpOT/aaLZ/36hwf+4ztz/ws/V/7fFxv+xxsn/rsfL/7jOzP+yxcP/t8fH /7jGx/+9y87/ucfK/7XEx/+BkJP/gpGW/1FgZf8tP0P/LT9D/y1ARv8yRUv/MkVL/zhLUf92 iZD/qbrC/56ttP+wvcX/oq+3/4yZof8oNT3/HCkx/xUiKv8mMzv/HCkx/xkmLv8aJy//HSoy /x8sNP9NWmL/c4CI/5Gan//6/v///f39//39/f/+/v7///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////1 9fX///////z8/P/+////+fr8//z////j6Oz/ZGlt/xgfJf8iKzD/ICkw/xkkKv8XISr/GSYu /yMwOf8WIyz/HCky/x0qM/8fLDX/Ii84/yMxPP8mND//KDZB/yk3Qv8xQU7/M0NQ/zVHVf86 TFr/P1Ff/0RWZP9HWWf/SVtp/1VldP9RYXD/VGRz/1pqd/9SYm//QE5Z/zJASf8yP0j/FiMr /wYRF/8NFh3/BAsR/wAFC/8CBwv/AAAF/wsQFP8ACAv/AAoM/wQMD/8GEBL/ChEX/wwVGv8Q Fx3/EBke/xUcJP8VHiX/Fh8o/xkiK/8bJC3/HSYv/x8oMf8gKDP/ICg1/yIqN/8lLzv/JzE9 /ykzP/8oMj7/JTE9/yMvO/8qOEP/KjhD/ys5RP8tO0b/LD1H/y4/Sf8vQEr/MEFL/ys8Rv8r PEb/KjtF/yk6RP8oOUP/KDlD/yc4Qv8nOEL/Gyw2/yM0Pv8bLDb/Fygy/yU2QP8qO0X/KDlD /y9ASv8pO0X/LD5I/yI0Pv8yRE7/LkBK/y9BS/8lN0H/NUdR/y5ASv8wQkz/M0VP/zZIUv82 SFL/NEZQ/zFDTf8vQUv/NEZS/zZIVP85S1f/PE5a/z1PW/88Tlr/OkxY/zlLV/9gcn7/WGp2 /1Bibv9HWWX/NUdT/yg6Rv8wQk7/QlJf/0RRYf9DUGD/QU9c/0BOW/9ATlv/Q09d/0VRX/9J UmH/SFJe/0NNWf8/R1T/P0dU/0lRXP9aYm3/bXWA/3mDjf+Sn6j/m6my/6q4w/+3yNL/wNLe /8PW5P/A1uT/vtXl/7zW5/+81+r/vdnu/7zb8P+72/L/uNrz/7bY8f+01/P/qM3q/5zA4v+I rtL/cZm9/1yGrv9Oe6X/SXim/0Z4q/9FeK//WpDM/0uFxP9GgcP/RYHH/zx7wv9EhMv/QoXM /zuAzf83fMn/QoTQ/0SCzf9AfMX/ks3//3q1+f9ooeT/aaDj/2GY2f9dktT/TYLG/1OJz/8x aq//T4jN/0R5vf9Rfb7/S3Gv/16Buf9iisX/QHm8/0yM0/9IjM3/Uom//4Ggvf/A0N3/xM/R /7bExP+vx8v/rcbK/7rOzf+yxcH/usjJ/7nHyP++zM//usjL/7TDxv97io3/fYyR/0hXXP9A Ulb/LD5C/x8yOP8vQkj/NEdN/0ZZX/+luL//pLW9/7jHzv+sucH/naqy/0pXX/8pNj7/DRoi /yg1Pf8gLTX/Ii83/xUiKv8cKTH/Ii83/yMwOP95ho7/gI2V/4aPlP/6/v///f39//39/f/+ /v7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////5+vz/+Pn7//7////+////6uvv//L2+f+prrL/Gh8j /xkgJv8ZIin/GiMs/xslLv8cJjD/HCky/x0pNf8dKzb/Gygx/x0qM/8gLTb/JDE6/yc1QP8r OUT/LjxH/y89SP80RFH/NkZT/zpMWv8/UV//Rlhm/0tda/9QYnD/UmRy/1Vnc/9Za3f/VWVy /11tev9KWGX/NEJN/zZDTP8bJS//ChMc/xAZIP8OFR3/BAsR/wQJD/8LEBT/CxAU/wMIDP8A CQv/CRQY/wYPFP8ACQ3/BxAV/wwXG/8NFh3/EBsh/wUOF/8dJi//Ji84/xcgKf8TGyb/Iio1 /ygwO/8gKDP/Iiw4/zA6Rv8nMT3/HCYy/yYyPv8uOkb/LTlF/zI+Sv8yQEv/KzlE/2Jzff+N nqj/lKWv/3qLlf97jZf/anyG/1docP9GV1//JDU9/yg5Qf8oOUH/OUpS/zRFTf8qO0P/MkNL /zNETP8pOkL/JTY+/ys8RP8kNT3/Ficv/xUmLv8cLjj/Giw2/yg6RP8lN0H/Kz1H/zRGUP8o OkT/KjxG/zNFT/8tP0n/Kz1H/zxOWP80RlD/JzlD/zRGUP8yRE7/OkxY/z9RXf8/UV3/OUtX /z5QXP8qPEj/N0lV/5mrt/+3ydX/t8nV/6y+yv+Zq7f/iZun/3yOmv9ld4P/TmBu/zdGW/89 TGP/QE9m/z1MY/9AT2T/SVVr/0dUZ/9AS1//QEtd/0BLXf9DTF3/RE1e/0VOXf9FTl3/R05e /0ZPXv9LWWT/RVZg/0hZY/9YaXP/b4CK/4WXof+XqbP/obO//7PH0v+4zNf/u87c/8rd6/+7 ztz/utDd/7rQ3f+xx9X/u9Hm/77U6//B2fH/wdv0/7vW8f+uzen/ocLh/5i83P95ocT/bZm+ /1yMtP9Of6r/RXin/0V5qf9Jf67/S4K4/0uCxf9Mgsr/SYLJ/0eAxf9Ng8n/XJPW/3Kn6/+D uP7/ZJrg/3u0+/99uf//XZ3n/0GF0P8/hNH/RInX/0OG1f9KiNX/TIbQ/02Gzf9Jhc3/PoXT /zyI1P8/hcr/Rnuv/4yowP++y9P/vsjJ/7jGxv+xyc3/pr/D/7THw/+4x8L/sL6+/6+9vv+6 yMv/tsTH/6a1uP9+jZD/bHuA/yk4Pf83SU3/KTs//zdKUP8uQUf/O05U/5eqsP+fsrn/qLnB /6KxuP+4xc3/and//yYzO/8fLDT/FSIq/xckLP8jMDj/Gicv/x0qMv8gLTX/IC01/11qcv96 h4//e4iQ/36HjP/6/v///f39//39/f/+/v7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////4+fv//v// //z9///5/f7/9fn8/9vg4/9HTFD/HCMp/xkiKf8ZIin/GSMs/xkmLv8bKDH/HCky/xwqNf8d Kzb/HCky/x4rNP8hLjf/JTI7/yg2Qf8rOUT/LjxH/zA+Sf81RVL/N0dU/zpMWv9AUmD/Rlhm /0xebP9QYnD/UmRy/1Fjb/9UZnL/Wmp3/0xdZ/8+TFf/OEVO/ygyPP8VHif/ERgg/xgfJ/8Z ICb/Exgc/w0SFv8KDxP/AQYJ/wACBP8ACQ3/BRMW/wMRFP8ADRD/Dxoe/x4pLf8bJiz/Dxog /xkjLP8ZIyz/GSIr/xojLP8dJTD/Iio1/yUtOP8mLjn/Iy05/ykzP/8lLzv/KDI+/zI+Sv8s OET/ICw4/yMxPP8rOUT/bHqF/5mqtP+YqbP/b4CK/4+gqv+nucP/p7nD/5anr/+svcX/nq+3 /15vd/8zREz/IzQ8/yIzO/8rPET/Lj9H/y4/R/8tPkb/NkdP/zxNVf8vQEj/KjtD/zxNVf8m OEL/NkhS/yEzPf8aLDb/Giw2/yEzPf8eMDr/IjQ+/y0/Sf8nOUP/JzlD/zdJU/9AUlz/PlBa /zlLVf8qPEb/MEJO/zhKVv85S1f/MUNP/zlLV/8xQ0//MkRQ/21/i/+qvMj/vM7a/8nb5//G 2OT/wtTg/8TW4v/G2OT/xNbk/4SVqf9IWnL/IjJL/y09VP86SmH/MUBV/y8+U/8+TWD/P0xd /0BNXf9BTV3/Qk5c/0NPXf9EUF7/Rk9e/0RQXv89TVr/QVNf/0NVYf9BU13/Q1Re/0VWXv9C U1v/PE1V/1BfZv9jcnn/e4iQ/4yZof+ir7X/ucTK/7O+xP++yc//wMzY/8DM2v+/zNz/vc3c /73O3v+90N//u9Li/7rU5f+00eP/s9Tn/7HV6/+r0ej/ncXf/4myzv91obz/aJS3/052qv9O eLL/T362/1KDu/9Vhr7/VIW9/1OAu/9Pe7j/THy8/1mPz/9bm9v/TpPW/zyHy/83hMz/PobS /0KJ1/82fc3/On7P/z+C0P8/htT/OYrc/zmK2f9Ah8n/S3+u/5Stwf/Ayc7/vcfI/7fFxf+w x83/p8DE/7XGwP+6x8D/tMDA/6+9vv+4xsn/usjL/5+usf93hon/X25z/yY1Ov8pOz//Jzk9 /y5BR/8qPUP/a36E/6Czuf+vwsn/orO7/7PCyf+Sn6f/Qk9X/xsoMP8mMzv/IzA4/xonL/8d KjL/Gygw/xsoMP8uO0P/MT5G/216gv+AjZX/bnuD/5ihpv/6/v///f39//39/f/+/v7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////+/////P3///z////v8/b//P///4CFif8PFBr/GSAm/xkiKf8a Iyr/GiQt/xkmL/8bJzP/HCo1/x0rNv8dKzb/His0/x8sNf8iLzj/JjM8/yk3Qv8tO0b/MD5J /zJAS/83R1T/OUlW/zxOXP9BU2H/R1ln/0xebP9QYnD/UmRy/0xga/9RY2//W2x2/zxKVf8y Pkr/N0FL/xYeKf8OFR//JSw0/yYqM/8fJCr/Fxwg/xofI/8pLjH/Mzs9/zZAQf8jMTT/FyYp /xAfIv8LGh3/BxQa/wgVG/8QHSX/GCUt/x4rM/8ZJi7/GSMt/xwmMP8gKDP/ISk0/yUtOv8s NEH/JC46/ys3Q/8rN0P/KTVB/yk1Qf8jLzv/IzE8/y89SP8rOUT/cIGL/6e4wv+6y9X/obO9 /7DCzP+wwsz/rb/J/7fI0P/B0tr/ydri/19weP8dLjb/MEFJ/0xdZf88TVX/UGFp/25/h/9y g4v/Wmtz/0hZYf83SFD/KDlB/yM0PP8rPUf/QVNd/yk7Rf81R1H/NUdR/zBCTP8vQUv/KjxG /yEzPf8eMDr/HC44/xosNv8kNkD/L0FL/y5ASv8wQkz/LD5K/zNFUf8zRVH/KTtH/zFDT/8z RVH/KTtH/zVHU/8EFiL/Fyk1/zJEUP9RY2//dYeT/5aotP+ousb/rb/N/0tebf82S1z/MENU /ztOX/9EV2j/QVJi/ztNW/87TVn/Pk5b/z5PWf8/UFr/P1BY/0JQWf9DUln/Q1JZ/0JTW/9F WWT/QFZj/0BTYf9CVmH/Rlhk/0ZXYf9CU1v/P05V/0NQVv9IU1f/RE1S/ys1N/9BSUv/W2Fh /1ddXf9tcnX/io6X/5SYo/+iqbH/sbrB/7zHzf/AzdP/wM/U/77Q1P/C19r/wtre/8Hd4f/B 3uT/wN7m/7zd5v+62uX/uNfp/8Tf/f+vy/D/kLTW/3ihwf9plLT/YYms/1p9o/9SdZ//SG6b /0Z1o/9Ega7/Roq7/z6Huv83gLf/OHy5/z6Cw/9AhM3/QofS/0KK1P9Bjdj/PI/f/zmL1f9B hcL/U4Ks/6O2xf/AyMr/vcbF/7XFxf+txs3/qMHG/7fDv/+6xLz/tsLA/7C+v/+0wsX/v83Q /5Cfov9qeXz/Slle/yEwNf8nOT3/Jzk9/yI1O/9HWmD/m660/6e6wP+twMf/o7S8/7C/xv9c aXH/Hyw0/xckLP8mMzv/KDU9/xwpMf8dKjL/Hisz/x0qMv8wPUX/YG11/298hP+Gk5v/Xmtz /8XO0//6/v///f39//39/f/+/v7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////+////7O3v//j8///8 ////0tfb/yEmKv8fJiz/FyAl/xkiKf8ZIyz/GCUu/xonMP8aKDP/HCo1/x0rNv8eLDf/IC02 /yIvOP8lMjv/KDU+/yw6Rf8vPUj/MkBL/zRCTf86Slf/PExZ/z5QXv9DVWP/SFpo/0xebP9Q YnD/UmRy/05ibf9SZnH/T2Bq/zVDTv8vPEX/KTE8/wsSHP8NERr/GR0m/xwfJv8gIyj/JSgt /y4zNv87QEP/RExO/0hSU/9QX2L/WGps/2h6fP9se37/Wmlu/0NSV/8qNz//Eh8n/xYjK/8e KzP/JC44/x4oMv8cJC//Iio1/ykxPv8sNkL/KjRA/y05Rf8qNkL/JDA8/yUxPf8qOEP/LjxH /zE/Sv8aKzX/KzxG/1tsdv+DlJ7/rsDK/62/yf+1x9H/tsjS/8fY4P/O3+f/n7C4/zZHT/8u P0f/Lj9H/yY3P/9ldn7/jZ6m/5Kjq/9/kJj/cYKK/4aXn/+brLT/kKGp/32Olv9pe4X/PU9Z /y0/Sf80RlD/MEJM/yc5Q/81R1H/NEZQ/zhKVP82SFL/N0lT/y5ASv8sPkj/KTtF/x0vOf8k NkD/Fyk1/xwuOv8jNUH/JTdD/y9BTf87TVn/OUtX/zJEUP86TFj/NUdT/y0/S/8nOUX/JDZC /x0vO/8OICz/ARMf/yo9S/8+VGH/Rlln/zhLWf81SVT/Q1di/0ZaY/88UFf/PVBX/z1QVv8+ UVf/P1JW/0BTV/9AVFX/QlRW/0FUWv9KYGv/Q1ln/0JYZf9MX23/TV9r/0ZYZP9GV2H/Tlxl /0xZX/9SXWH/Tlha/zxER/9ITVD/UVdX/09TVP9KTlH/S05V/0pNVv9KT1X/UFVZ/1tjZv9t d3j/foqI/4eWk/+isq//pLez/6q+vP+wxsP/t8zN/7vT0/++1tr/wNff/8LT4/+/1Of/udno /7je6/+43e3/sdXl/6vG2/+iutT/nrnW/4Ooxf9flbH/RoWk/zp8nv86e6H/SYKt/1OLvP9H grr/R4XC/z+Bvv85gML/NITL/zB+wP8+e7H/WoWn/7TCy//Cx8P/u8TD/7PCxf+pxM3/qcLJ /7XBvf+7wrv/uMTC/7G/wP+xv8L/vszP/3yLjv9aaWz/NENI/xwrMP8wQkb/JDY6/yo9Q/+A k5n/qLvB/6a5v/+cr7b/rL3F/4aVnP8wPUX/Gicv/yEuNv8dKjL/IC01/x0qMv8kMTn/JTI6 /xwpMf9EUVn/d4SM/3SBif9wfYX/e4iQ/+ny9//6/v///f39//39/f/+/v7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////+////+v7///b6/f/8////YWZq/wsQFP8qMTf/HCUs/xojLP8aJC3/GSYv /xonMP8bKTT/HCo1/xwsOf8eLDf/IzA5/yQxOv8nND3/KzhB/y48R/8yQEv/NUNO/zZET/89 TVr/P09c/0FTYf9FV2X/SVtp/01fbf9QYnD/UWNx/1FlcP9TZ3D/O0xW/zdFUP8yPEb/Exsm /wsPGv8NEBn/DRAZ/w4RGP8UFxz/HyIn/ywxNP86P0L/RU5N/0xYWP9SZGb/bH+D/3iLj/90 hor/f5GV/5Olqf+Hlp3/ZXR7/yYzPP8iLzj/ISs1/yIsNv8jLTn/JC46/ygwPf8pMz//NT9L /yIuOv8dKTX/KDRA/zA+Sf8vPUj/JzVA/x8wOv8kNT//Gis1/xMlL/8AEhz/Fykz/yo8Rv9M YGn/WWt1/1xtdf8kNTz/ECEo/yEyOf82R07/OUpR/zlKUf+Vpq3/tMXM/5qrsv9+j5b/e4yT /4aXnv+JmqH/m6yz/8DR2f+6zNb/PlBa/0JUXv86TFb/LT9J/yk7Rf9AUlz/QVNd/09ha/9F V2H/QVNd/z9RW/88Tlj/OUtV/zZIUv86TFb/PlBc/zhKVv80RlL/MkRQ/yg6Rv8hMz//ITM/ /xkrN/8sPkr/MkRQ/ztNWf89T1v/OkxY/zhKVv88Tlr/Q1Vh/0pcZv8/U1z/N0lT/zdJU/86 TVT/PE9W/zxPVv88T1X/PlFX/z5RVf8+UVX/P1NU/0BUVf9AVlT/QVVU/0FWWf88UFv/QVRj /0VYZv9FWGb/SVtn/0xeav9HWGL/P01W/zxKU/8/TFT/OUZM/0ZRV/9IUVb/U1xh/2Rrcf9N VFr/P0hR/0RMV/9MVV7/Ulti/1ReYP9QXFz/S1dV/0ZVUv9MXFn/UWFe/1lsav9oe3n/e42P /46io/+fsrj/qrvC/7PAyf+1xtD/s9DU/7LV1/+y1df/uNXZ/8TW4P/M2uf/wNDf/73X5P+0 3ur/qt7r/6DY5/+Xyt3/i7PM/3yhvv9agqX/WISr/0h7pv9Aeqr/PYK7/zx/tP9PhKz/ep2z /8fP0f/ExLz/u8G//6/Bxf+lwc3/qMPO/7TAvv+5wLn/uMTC/7G/wP+vvcD/tcPG/2V0d/9I V1r/IzI3/xopLv8uQET/IjQ4/1hrcf+jtrz/oLO5/6S3vf+esbj/qbrC/1BfZv8aJy//JDE5 /yo3P/8YJS3/HCkx/x8sNP8kMTn/JjM7/yg1Pf9qd3//aHV9/3eEjP9hbnb/wM3V//D5/v/6 /v///f39//39/f/+/v7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7////+/////P////r+//+eo6b/HiMn /xUcIv8aIyr/HSYt/xkjLP8aJC3/GSYv/xsoMf8bKTT/HSs2/xwsOf8dLjj/JTE9/yYzPP8p Nj//LTpD/zA+Sf80Qk3/N0VQ/zlHUv9AUF3/QlJf/0NVY/9GWGb/Slxq/01fbf9QYnD/UWNv /1Bkb/9LX2j/LT9J/zVDTP8rNT//Bg0X/wsPGP8LDhf/EBAY/wkJEf8ICQ7/DRAV/xgdIP8l Ki3/NT49/0JOTv9jdXf/c4iL/3mMkP99kJT/jJ6i/5Cipv+Uo6r/orG4/19sdf8vPEX/FR8p /yQuOP8yPEj/KDI+/yIqN/8oMj7/OEJO/x8rN/8fKzf/LztH/yg2Qf8eLDf/KjtF/z9QWv8j ND7/MEFL/y5ASv8vQUv/Figy/x4wOv8UKDH/DyMq/wAPF/8mNz7/KTpB/zdIT/9EVVz/Jjc+ /xQlLP+NnqX/ssPK/7zN1P/C09r/xtfe/8PU2/+2x87/wtPa/+T1/P+8ztj/MUNN/ztNV/8o OkT/JTdB/1Vncf+ImqT/lKaw/3iKlP99j5n/e42X/3WHkf9WaHL/P1Fb/z9RW/8pO0X/L0FN /y0/S/8pO0f/NEZS/zNFUf8rPUn/NkhU/zlLV/8mOET/JjhE/ys9Sf8zRVH/NkhU/zVHU/85 S1f/QFJe/0JTXf84SVP/NUZQ/z1OWP9FVl7/QlNb/z1OVv86TVT/PlFX/z5RV/8/Ulj/QFNX /0BTV/9AVVb/QVZZ/0FWW/87TVn/QVNh/zxOXP9EVmL/eoyY/7rK1//A0N3/na64/5Chq/99 jpj/Wmhz/1hmb/9ATlf/R1Rd/0hVXv8/S1f/VGJv/09dav9IVmH/QU9Y/z5NUv9AT1L/Q1NT /0RWVv9CVFT/PlBQ/zlLTf83SU3/O0xT/0JTW/9MXWf/VGJt/2hyfP94iZD/i6mr/5zAvv+o ysn/s83O/8PO0v/M0df/yMzV/8XS2v+72Nz/strc/7Hd4P+43eX/vtXj/7vM3P/J3Ov/wNrr /6DC2/+FstP/carV/1qUvP9hjar/jae0/9rb1f/FwbX/ub+7/62/w/+iv83/qMTQ/7C+vv+3 vbn/t8PD/7G/wP+wvsH/pLK1/05dYP84R0r/Gyov/xopLv8hMzf/NUdL/5Klq/+mub//nrG3 /6e6wP+twMf/g5Sc/y08Q/8YJS3/IzA4/yg1Pf8dKjL/Ii83/yQxOf8cKTH/JDE5/1JfZ/9v fIT/a3iA/2NweP+Wo6v/7vv//+/4/f/6/v///f39//39/f/+/v7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7////+////8vb5/8bLz/88QUX/Fhsh/xceJP8QGSD/GiMq/xokLf8aJC3/Gicw/xsoMf8c KjX/HSs2/xwsOf8dLjj/JzM//yg1Pv8rOEH/LzxF/zJAS/82RE//OUdS/zpIU/9CUl//RFRh /0VXZf9IWmj/S11r/05gbv9QYnD/UWNv/0tfav85TVb/Kz5F/yg2P/8YIiz/Bg0X/wYKE/8F CBH/BAQM/wICCv8HCA3/DxIX/w8UF/8GCw7/AAkI/wANDf8ABgf/Dycp/zVKTf9pfoH/mq2z /5Cjqf+Bkpn/mquy/5upsv9RX2j/Gycz/yAsOP8xO0f/KDI+/yIqN/8qNED/LTdD/yMvO/8p N0L/LTtG/yc1QP85R1L/X3B6/3iJk/+Fl6H/coSO/15wev9Za3X/M0dQ/zVJUv8vQ0z/JztC /zZHT/8nOD//KTpB/zJDSv83SE//PU5V/yQ1PP8DFBv/KTpB/0RVXP9YaXD/c4SL/5+wt/+2 x87/qLnA/5anrv8sPkj/Cx0n/zdJU/9EVmD/TV9p/5iqtP+rvcf/lqiy/26Aiv+Mnqj/nK64 /7bI0v+pu8X/nrC6/5eps/9DVV//NUdT/zlLV/8uQEz/OEpW/zxOWv8wQk7/NEZS/zJEUP87 TVn/LkBM/yo8SP8zRVH/PE5a/zpMWP83SVX/OEhV/z1KWv9JVWX/SFRk/zhEVP8zQFD/P0xc /0VTYP8+Tlv/P09c/0BQXf9AUF3/QFJc/0FTXf9CVVz/QlRe/0JUXv9DVF7/RlRf/zxNV/9E VGH/e4uY/8PT4P/g8P3/1OTz/9Lk8v/O4O7/vtHf/8DT4f+nusj/lKe1/zlMW/9EV2b/NEla /zlQXv9CWGb/SF5r/0hfZ/9CWV//OlFX/zZLUP8xRkv/OExT/0JUXv9IWmb/Sltr/0VWaP8+ TmX/Okle/0FMXv89T13/N1Vd/zZcX/9BZGb/V3B0/3J5gf+EgYr/rKmw/6qtsv+pvb7/r8zK /7LQ0P+zy83/vsfQ/8rK0v/Jycf/ztTS/7/Q1/+21ef/teL//6bV8f+z1ur/5/j//+nl2v/H wLD/ub64/6q9w/+evs3/psbV/6+9vv+0vbr/tcHB/7G/wP+ywMP/kqCj/ztKTf8sOz7/Giku /xwrMP8kNjr/Z3l9/63Axv+sv8X/qbzC/67Bx/+gs7r/QlNb/yAvNv8iLzf/Gicv/x8sNP8m Mzv/KDU9/yc0PP8aJy//M0BI/257g/9kcXn/cH2F/3SBif/Z5u7/9f////X+///6/v///f39 //39/f/+/v7///////////////////////////////////////////////////////////// //////////////////////////////////3///////////////////////////////////// //7//////////v////7////+/////v////7////6////3uPn/2tyeP8iKS//Dxgd/xojKv8O Fx7/GyYs/xokLf8bJS7/Gicw/xsoMf8cKjP/HSs2/x8tOP8fLTj/JjQ//yg2Qf8rOUT/Lz1I /zFCTP81RlD/OEhV/zlJVv9EVGH/RFZi/0ZYZv9IWmj/S11r/05gbv9QYnD/UWNv/0dYYv8s PUX/M0BJ/x8pMv8IERr/ChEb/wEEDf8AAwz/DQ0V/wUFDf8FBQ3/Cw4T/wwRFf8FDRD/Bw8R /w4ZG/8IGx//GS4z/wATGP8GGR//YHN5/52wtv+crbX/m6y0/7zK0/90gov/Lz1I/xsnM/8i Ljr/JDA8/ygyPv8tN0P/HSk1/yEvOP8nNUD/KDY//0JQW/9/jZb/na64/4ydpf9gcnz/boGI /56wuv+jtr3/mqy2/4WZoP9xg43/NUhP/ztMU/8oOUD/OktS/z5PVv81Rk3/L0BH/0NUW/8l Nj3/GCkw/yAxOP8ZKjH/Dh8m/wobIv8AERj/AAoR/wARGP8bLTf/OkxW/zlLVf8uQEr/M0VP /6a4wv/H2eP/t8nT/7PFz/+uwcj/i56l/6O2vf+5zNP/0uXs/8jb4v88Tlj/MkRO/z1PW/8u QEz/N0lV/0NVYf85S1f/NUdT/yk7R/8wQk7/LT9L/zFDT/85S1f/N0lV/zJEUP84Slb/R1dk /y47S/88SFj/RFBg/0FNXf9CTl7/R1Rk/0ZUYf8+TFn/QFBd/0BQXf9AUF3/QVFe/0FTXf9C VF7/QlRe/0RVX/87SVL/R1Ve/0pYYf80RU//Hiw3/yAxO/9EVGH/aXuH/4+hr/+luMb/wdTj /9Pp9//U5/b/t83b/xInOP80S1v/NUxc/zhPX/88U2H/P1Zk/z5WYv87U13/N05W/zNKUv9G WmP/RFhj/0JVY/9AUWH/P1Bi/z9QZP9AUGf/QlFo/0hVaP9DVGT/PFhj/z9gZ/9HZmv/TGNp /09YYf9OTlj/V1Ze/05RVv9SYWT/aX5//3mOj/+DlZf/pKmv/8bFyv+9ubb/yMnE/7/KzP+9 097/v9/0/6jL3/+rxdL/2ejr/+vr4f/CwLT/tb67/6q9wf+fvcj/qsbS/66+vv+yvLv/tL/B /7C+wf+zwcT/hpSX/zA/RP8mNTr/Gyov/x4tMv82RUr/lqis/6y9xP+/0Nf/tMXM/7TFzP+C k5v/DyAo/x4sNf8rOEH/FSIr/xonMP8pN0D/JTQ7/yc2Pf8dLDP/TVxj/2Nyd/9teoD/W2hu /7K9w//u+f//+P////n////8/f///f39//39/f/+/v7///////////////////////////// /////////////////////////////////////////////////////////////f////v////9 /////f////3////9//7//f/+//3/+Pr5//X5+P/+////8fX2//v////8/////P////X6/f/2 ////h5KY/yk0Ov8SHSP/GiUr/yAqM/8bJS7/Dhsj/xUiKv8WIyv/GSYu/xwpMf8fLDT/Ii84 /yUyO/8lMzz/JzdE/yg6Rv8rPUn/LkBM/zNFUf82SFT/OUtZ/ztNW/86TFr/OEtZ/zxPXf9G WWf/TmFv/09icP9JXGr/RlZj/z9HUv9ARE//ISUw/wUJEv8KDRb/DhEa/wcKE/8HChP/BQgR /wYJEv8JDBX/CxAW/w8UGv8RGB7/Exog/xMeJP8UIyr/EiUs/xwvNv8iMzv/Lj9H/5ustP+j tL7/prfB/6GyvP+DlJ7/Gis1/zNBTP83RVD/LTtG/yo4Q/80Qk3/LTtE/yg5QP8hMjr/KDlA /z1OVv+jtLv/scLK/6m6wf+HmKD/gpOa/5Kjq/+Km6L/qLnB/77R1/+9ztb/OUpR/zBBSP84 SVD/N0hP/zNES/9KW2L/YXJ5/1Znbv80RUz/MUJJ/zhJUP8wQUj/NkdO/y9AR/8xQkn/Hi82 /zNES/88TVf/P1Ba/z1OVv85SlL/ITI6/0tcZP98jZX/l6iw/7fI0P+7zNP/zt/m/9Hi6f/m 9/7/3/D3/46fpv8QISj/MkRO/zpMVv85S1X/MUNN/zBCTP82SFL/NkhS/y9BS/80RlD/Gy03 /0pcZv9BU13/MEJM/ztNV/9FV2H/MkRO/zlKVP82RE3/Slhh/z9NVv9DUVr/T2Bo/zlKUv89 Tlb/QVJa/0JTW/9CU1v/QVJa/0RVXf9GV1//Q1Rc/z5PV/88TVT/QFFY/0FSWf8+UVj/QVJa /0FUW/8zRU//IDI8/xQmMP8ZKzX/JDZC/ys/Sv8oOkb/ITVA/yxAS/8+Ul3/O05c/z1PXf8+ UF7/QFJg/0JUYP9DVWH/RVdj/0ZYZP9EVmL/Q1Vh/0FTX/9AUF//QVFg/0NTYv9GVmb/R1dm /zdHVv9HWWX/RVtm/0JZYf9JYGj/R1tk/0RSW/9MWWL/SVZf/1FeZv9FVl7/Rllg/z9SWf9M X2b/UF5n/1tlb/9xe4X/eIKM/4GPnP+Nn63/m7DB/6vA0f+5zdj/wtPa/7zHyf+5w8T/sb/A /6m7vf+mu8D/qL3A/67AwP+0wsL/prS3/6y5v/+0wcf/and9/yc0PP8ZJi7/OUZO/y47Q/+J lp7/scDH/7PCyf+rusH/s8LJ/6++xf8rOkH/IjA5/yEtO/8XIzP/IC47/yAuO/8lNkD/ITI6 /xcqMf8/Ulj/YHJ2/3eJi/9hb3L/hpGT/+fv8v/s8fT//P////7///////////////////// //////////////////////////////////////////////////////////////////////// ///////////////9/////f////v////7////+/////3////9//7//f/+//3/+v79//z////w 9PX//P////j+/v/2/Pz/7PLy//n///+eqa//TVpi/xIfJ/8MGSH/Eh8n/xckLP8aJy//GCUt /xglLf8YJS3/Gicv/xwpMf8eKzP/IC01/yEuNv8hLzj/JzlF/yc6SP8qPUv/LkFP/zJFU/82 SVf/OUxa/zpNW/9AU2H/SVxq/0lcav9FWGb/TF9t/1Zpd/9JXGr/NkRR/zs/Sv86OEP/Hh4o /wkJE/8MDBb/DQ0X/wYJEv8KDRb/BgkS/wcKE/8JDRb/DBAZ/w4VHf8SGSH/FBsj/xUeJ/8a KDH/GSo0/xssNv8UJS//YXJ8/6O0vv+oucP/p7jC/7/Q2v9kdX//Hi85/yEyPP8pOkT/JjdB /yY3Qf8oOUH/MkNL/zRFTP8vQEf/IzQ7/yAxOP9zhIv/obK5/77P1v+7zNP/uMnQ/7bHzv+w wcj/vM3U/+////+gsbj/CBkg/zdIT/8pOkH/OElQ/2+Ah/+LnKP/iJmg/3uMk/+DlJv/hZad /4WWnf9zhIv/U2Rr/0xdZP8/UFf/QlNa/zxNVP87TFT/L0BK/zVGTv9HWGD/M0RM/xcoMP8H GCD/CRoi/xkqMf8tPkX/Vmhs/32Pk/9NX2P/KTs//xgqLv8kNTz/NUhP/zlLVf84SlT/MkRO /zNFT/84SlT/M0VP/yo8Rv8TJS//PU9Z/zJETv8yRE7/RVdh/zpMVv8sPkj/NUhP/zhJUf83 SE//MUJJ/0FSWf9FVl3/MkNK/zFCSf85SlH/NUZN/0JTWv9DVFv/NUZN/zZHTv9HWF//Tl9m /0hZYP81SE7/NEdN/zdKUP89UFb/P1JY/ztOVf81SE//MURL/y9CSf85TFP/QFJc/zxOWP8z RU//MkRO/zlLVf9AUlz/RFRh/0RUYf9DU2D/QlJf/0FRXv8/T1z/P09c/z5OW/9AUF3/Q1Ng /0dXZP9JWWb/SFhl/0VVYv9AUF3/PU1a/z9RW/9CVF7/PlBa/zlLVf84SlT/N0lT/z5QWv9N X2n/PE5Y/0RWYP9RY23/WGp0/05gav9LXWf/Slxm/0lbZ/9MXGz/Tl1w/1Jicv9XZ3f/XW18 /2Jyf/9mdoP/aXqC/4ucpP+Upaz/oLK2/6u9v/+vwcP/rL6+/6W3t/+fsbH/tcLI/7nGzv+w vcX/S1hg/xkmLv8+S1P/Gygw/01aYv+ntLz/sb7G/7vI0P+xvsb/vcrS/1xpcf8rOED/FiMs /yEtPf8gKz3/His7/yY2Q/8lNUL/Giw2/yxAR/9MYWb/Y3Z6/2V3ef9senv/yNLT//r////8 /////v7+//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////9/////f////v////7////+/// //3////9//7//f/+//3//P////z////4/P3/+v7///v////u9PT/8PX4/9Xd4P9LVFv/ICoz /w0XIP8XISr/FyEq/xYgKf8eKDH/Iy02/xslLv8bJS7/HCYv/x4oMf8fKTL/ICoz/yErNP8g LTb/JzlD/yg8R/8rP0r/L0NO/zNHUv83S1b/OU1Y/ztPWv8/U17/SV1o/0peaf9GWmX/TGBr /1Nncv9DV2L/LTtG/zA0P/8pKTP/FRUf/wsLFf8NDRf/CQkT/wUIEf8OERr/BwsU/wgMFf8L Dxj/DxMc/xAXH/8UGyP/Fh0l/xcgKf8YJi//FCUv/xssNv86S1X/n7C6/6e4wv+gsbv/sMHL /7HCzP81RlD/KTpE/xwtN/8hMjz/IjM9/yg5Q/8mNz//JDU9/yo7Qv86S1L/NEVM/xMkK/8N HiX/DR4l/xwtNP9PYGf/cIGI/4ydpP+fsLf/iZqh/2BxeP8SIyr/LT5F/zJDSv8yQ0r/WWpx /6y9xP+hsrn/dIWM/2Fyef+On6b/o7S7/56vtv+0xcz/rb7F/5Giqf8uP0b/N0hP/zdIT/8w QUn/Q1Rc/0RVXf8yQ0v/NkdP/zdIUP8yQ0r/KDlA/ztMU/8ZKjH/Bxgf/wQVHP8WKCz/ITM3 /zZITP89TlX/OEtS/zlLVf82SFL/NUdR/zhKVP85S1X/MEJM/yM1P/8jNT//PlBa/zhKVP8+ UFr/MkRO/0FTXf8/UVv/O05V/19weP+pusH/pba9/6m6wf+gsbj/hZad/4ydpP9qe4L/SVph /ztMU/8zREv/N0hP/zdIT/8xQkn/MkNK/zpLUv9BVFv/Ok1U/zlMU/89UFf/NklQ/yk7Rf8o OkT/MEJM/yg6RP84SlT/PlBc/zVHU/8vQU3/NUdT/zxOWv87TVn/Pk5b/z5OW/8+Tlv/Pk5b /z5OW/8+Tlv/Pk5b/z5OW/9AUF3/P09c/z5OW/88TFn/PExZ/ztLWP88TFn/PExZ/0haZv9B U1//VWdz/3yOmv+Poa3/g5Wh/2Z4hP9MXmr/QlRg/z1PW/9IWmb/TF5q/zpMWP8+UFz/TF5q /0xebP9WZnb/VWR3/1Jicv9PX2//TFxr/0lZZv9HV2T/Rldf/ztMVP89TlX/Q1VZ/09hY/9g cnT/dYeH/4iamv+Tpaf/maas/7C9xf+ir7f/Q1BY/yg1Pf9GU1v/LzxE/5ekrP+7yND/tsPL /7bDy//E0dn/n6y0/xonL/8kMTn/GCUu/yEtO/8oNET/His7/yk5Rv8iMj//HS85/0teZf9c b3X/Z3l9/2Fwc/+UoqP/8fv8//j+/v/8//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////f////v////7////+/////3////9//7//f/+//3//P////P39v/8////6+/w //X7+//7////3OHk/2Jqbf8oMTj/EBoj/xAaI/8dJzD/GCIr/xAaI/8UHif/GCIr/xkjLP8a JC3/GyUu/x4oMf8gKjP/Iy02/yUvOP8kMTr/KTpE/yk9SP8tP0v/L0NO/zVHU/83S1b/O01Z /zxQW/83SVX/Ok5Z/0JUYP9JXWj/S11p/0JWYf85S1f/NEJN/yMnMv8aGiT/Dg4Y/w4OGP8N DRf/BgYQ/wUIEf8QExz/Cg4X/wsPGP8OEhv/ERUe/xMaIv8WHSX/GSAo/xkiK/8XJS7/DyAq /yw9R/+Bkpz/scLM/6O0vv+gsbv/uMnT/2d4gv8YKTP/NEVP/yk6RP8lNkD/IzQ+/y0+SP8u P0f/Lj9H/yM0O/8uP0b/PE1U/zlKUf8oOUD/IjM6/ys8Q/8kNTz/AhMa/wQVHP8ADRT/AAkQ /xUmLf8wQUj/O0xT/zJDSv8uP0b/R1hf/6S1vP+4ydD/t8jP/5+wt/+0xcz/jp+m/5qrsv/O 3+b/3/D3/6e4v/8eLzb/MkNK/0JTWv8sPUX/TV5m/2x9hf90hY3/iJmh/2Fyev9GV17/Q1Rb /y0+Rf83SE//OUpR/yo7Qv8yREj/NEZK/zZITP8vQEf/O05V/zdJU/81R1H/N0lT/ztNV/85 S1X/LkBK/yEzPf8uQEr/O01X/0haZP9AUlz/N0lT/z1PWf8rPUf/QlVc/yw9Rf/F1t3/8v// /93u9f+1xs3/pre+/9Hi6f/G197/pLW8/4uco/9fcHf/OktS/zZHTv9DVFv/QFFY/zBBSP81 SE//NEdO/zVHUf81R1H/L0FL/yo8Rv8xQ03/PU9Z/yEzPf8rPUf/MEJO/ys9Sf8nOUX/Kz1J /y9BTf8wQk7/OkpX/zpKV/85SVb/OEhV/zhIVf83R1T/NkZT/zZGU/8/T1z/PU1a/zpKV/85 SVb/OkpX/z1NWv9BUV7/RFRh/ztNWf9RY2//lKay/9Lk8P/c7vr/z+Ht/8rc6P/H2eX/s8XR /5Wns/97jZn/cYOP/0VXY/9OYGz/TmBs/0JUYv9YaHj/V2Z5/1Vldf9SYnL/T19u/0xcaf9K Wmf/SVpk/z5PV/89TlX/O0xT/zhKTv83SU3/N0lL/zdJS/84Skz/UF1j/2h1ff9baHD/PElR /zpHT/8nNDz/bHmB/77L0/+5xs7/u8jQ/7C9xf/I1d3/WWZu/xsoMP8eKzP/KTY//yEtO/8k MED/Hyw8/yEvPP8dLjj/M0ZN/19yef9idHj/X3F1/3qKiv/V4OL/8vz9//D29v/w9PX///// //r6+v////////////////////////////////////////////////////////////////// /////////////////////////////////////////////f////3////9/////f////3////9 //7////+////9/v8//j8/f/2+vv//P////P4+//5/v//goeK/xggI/8kLTT/Dhgh/w0XIP8Y Iiv/FB4n/w4YIf8NFyD/CRMc/xgiK/8ZIyz/HCYv/yAqM/8kLjf/KDI7/ys1Pv8qN0D/KjtF /ys9R/8vQEr/MUNN/zdIUv85S1X/PU5Y/z5QWv82R1H/PlBa/0laZP9KXGb/Q1Re/zZIUv8y Q03/NEFK/xgcJ/8QEBr/DQ0X/xERG/8KDRb/AwYP/wgLFP8QExz/DREa/w4SG/8PFh7/Ehkh /xYdJf8ZICj/GyQr/xslLv8YJi//IjM9/2R1f/+jtL7/orO9/6m6xP+zxM7/kaKs/yc4Qv8g MTv/MUJM/zFCTP8qO0X/KDlD/zBBS/8yQ0v/KTpC/zhJUP9BUln/RFVc/0dYX/9AUVj/MkNK /yEyOf8kNTz/Q1Rb/y9AR/8dLjX/KTpB/yw9RP8xQkn/LD1E/zxNVP8zREv/KDlA/1hpcP9r fIP/jZ6l/4eYn/+TpKv/vs/W/9Pk6//P4Of/pre+/19wd/8ZKjH/NEVM/yg5QP9JWmH/lKWs /5Wmrf9QYWj/bH2E/56vtv+vwMf/mquy/46fpv9/kJf/TF1k/ztMU/84SVD/QlNa/zVGTf9C U1r/Ok1U/zZIUv80RlD/N0lT/zpMVv82SFL/LkBK/yg6RP9LXWf/OEpU/3mLlf+qvMb/d4mT /zhKVP9BU13/MURL/yQ1Pf9UZWz/Y3R7/3SFjP+MnaT/pba9/8vc4//X6O//zt/m/5qrsv9d bnX/O0xT/zFCSf8yQ0r/N0hP/z5PV/8xQ03/OEpU/zhKVv8vQU3/KTtH/y5ATP84Slb/PE5a /z1PW/86TFj/OkxY/zpMWP80RlL/Kz1J/ys9Sf8xQ0//IjM9/yU2QP8qO0X/MEFL/zdIUv89 Tlj/QlNd/0RVX/81RlD/OUpU/z9QWv9FVmD/SFlj/0hZY/9HWGL/Rldh/0NVYf8xQ0//Rlhk /3eJlf+arLj/uMrW/9fp9f/l9///8f///+L0///V5/P/1efz/2Fzf/82SFT/NEZS/19xf/9K Wmr/SVlp/0lZaf9JWWn/SFhn/0dXZP9HV2T/R1hi/zVGTv85SlH/QFFY/0RWWv9FV1v/QVNV /ztNT/83SUv/OUZM/zE+Rv8nNDz/PUpS/ztIUP89SlL/rbrC/77L0/+5xs7/ucbO/8HO1v+W o6v/KDU9/y88RP8gLTX/LTpD/yMvPf8aJjb/IC47/xYkMf8gMTv/U2Rs/2V2fv9fcXX/ZHN4 /6y6u//3////+P////n////1+fj//f39//Ly8v////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////f////3////9/////f////3////9//7////+////+Pz9//z////0+Pn//P////v///+k qaz/Jywv/xQcH/8wOUD/FiAp/xEbJP8eKDH/Iiw1/yQuN/8jLTb/GiQt/x4oMf8fKTL/Iiw1 /yUvOP8oMjv/KzU+/y44Qf8vOUL/LTtE/y0+SP8xP0r/M0RO/zlHUv87TFb/QE5Z/0BRW/9B T1r/T2Bq/1NhbP8/UFr/NUNO/zJDTf8uPEf/IS43/xAUH/8NDRf/EREb/xQUHv8ICxT/BgkS /wwPGP8MEBn/DxMc/xEVHv8RGCD/FRwk/xgfJ/8cIyv/Hicu/x4oMf8XJS7/Tl9p/6q7xf+m t8H/qLnD/7rL1f+oucP/QFFb/x8wOv82R1H/JjdB/y0+SP8pOkT/LD1H/zBBS/8sPUX/KTpC /3WGjf+Roqn/i5yj/4SVnP+Roqn/i5yj/3OEi/9oeYD/Pk9W/x0uNf9LXGP/NUZN/zdIT/9D VFv/MUJJ/zRFTP8yQ0r/HzA3/yAxOP8JGiH/FCUs/xgpMP8tPkX/T2Bn/1xtdP9AUVj/IjM6 /xcoL/8nOD//Q1Rb/yw9RP9hcnn/orO6/7LDyv+HmJ//eouS/3aHjv+AkZj/kqOq/7TFzP/L 3OP/rL3E/yk6Qf8xQkn/KDlA/0JTWv8xQkr/OEpU/zRGUP8zRU//NkhS/zVHUf8wQkz/MUNN /zZIUv9PYWv/ipym/6e5w//s/v//3vD6/0JUXv8tP0n/PlFY/zZHT/8oOUD/IzQ7/x4vNv8W Jy7/Hi82/zxNVP9hcnn/GCkw/xIjKv8fMDf/OktS/0VWXf86S1L/NUZN/z1OVv85S1f/QFJe /zxOXP8vQU3/Kz1L/zJEUP82SFT/MkRQ/0ZYZP8+UFz/PlBc/0VXY/9CVGD/OUtX/zhKVv9B U1//RVZg/0NUXv8+T1n/OElT/zFCTP8rPEb/JjdB/yQ1P/8vQEr/MUJM/zRFT/83SFL/OktV /z1OWP8+T1n/P1Ba/0JUYP86TFj/NkhU/yw+Sv8UJjL/DyEt/yo8SP9IWmb/W215/6W3w/+t v8v/fY+b/yQ2Qv9NX2v/VGZy/0VXZf9MXGz/TFxs/0tba/9KWmr/SVlo/0hYZ/9HV2T/R1hi /0NUXv8/UFj/OktT/zZHTv81Rk3/N0lN/ztNUf8+UFT/RlNb/zI/R/86R0//Sldf/y88RP97 iJD/xtPb/8LP1//E0dn/tcLK/8TR2f9JVl7/JDE5/yk2Pv8kMTn/IS43/yQwPv8THy//Hiw5 /xspNv8zRE7/Y3R8/2Jzev9icXb/ipib/+Dr7f/3////+f////v////8////9Pb1//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////f////3////9/////f////////////7////+ /////P////v////1+fz/+Pz//9Xa3f8zODv/DxQY/x4lK/82P0b/Hygx/xskLf8qMzz/NT5H /z5HUP9ASVL/NT5H/yw1Pv8sNT7/LDU+/yw1Pv8sNT7/LDU+/yw1Pv8rNT7/LzxF/y89Rv8z QEn/NkRN/ztIUf8+TFX/Qk9Y/0JQWf9FUlv/SFZf/z9MVf8sOkP/KTY//y07RP8jMDn/EBok /woOGf8MDxj/Fhki/xQXIP8GCRL/CQwV/w8THP8IDBX/ERUe/xEYIP8TGiL/Fx4m/xojKv8d Ji3/ICkw/yAqM/84Rk//h5ii/8HS3P+nuML/usvV/7HCzP9fcHr/HzA6/y9ASv81RlD/JjdB /y4/Sf8qO0X/L0BK/zFCTP8oOUH/X3B4/6Gyuf+drrX/j6Cn/3qLkv+TpKv/qrvC/7XGzf+q u8L/ssPK/2p7gv8xQkn/Lj9G/zhJUP8sPUT/N0hP/z9QV/84SVD/LT5F/zJDSv8xQkn/NEVM /y0+Rf8rPEP/HS41/xwtNP8UJSz/Gisy/zFCSf86S1L/PE1U/zVGTf9HWV3/n7G1/8/h5f/J 29//vM3U/73O1f+0xcz/tsfO/8vc4//W5+7/q7zE/w0eJv88TVX/N0hQ/1Vmbv8uP0f/NEZQ /zJETv8zRU//NUdR/y9BS/8qPEb/NUdR/0ZYYv90hpD/l6mz/8bY4v/X6fP/iZul/zNFT/82 SFL/NEdO/zpLU/8vQEf/OktS/z9QV/8tPkX/LT5F/zpLUv85SlH/L0BH/z9QV/9AUVj/MUJJ /y4/Rv86S1L/PE1U/zFCSv80RlL/M0VT/zFCUv8yRFL/OElZ/z5QXv9AUmD/PlBe/zhKWP83 SVf/OEpW/zxOWv8/UV3/QFJe/0FTX/9DVWH/NEVP/zVGUP83SFL/OktV/z1OWP9AUVv/QlNd /0NUXv82R1H/M0RO/y9ASv8sPUf/LD1H/y9ASv80RU//N0hS/0NVYf9CVGL/PlBe/0JUYv9L XWv/R1ln/z5QXv88Tlz/M0VT/xIkMv8IGij/L0FP/0FTYf9JW2n/Q1Vj/0dZZ/9KWmr/SVlp /0hYZ/9HV2b/RVVk/0RUY/9DU2D/Q1Re/zlKVP86S1P/PE1V/z5PVv8/UFf/P1BX/z5PVv89 TlX/N0RM/zdETP9JVl7/Q1BY/0hVXf+jsLj/vsvT/8LP1//H1Nz/u8jQ/4qXn/8iLzf/KTY+ /x0qMv8eKzP/HSoz/yIwO/8WJDH/GSc0/zNBTv9UYm3/YG53/2Bvdv9ue4H/oq2x//f////y /P3/9P38//v////8////+/36//7//f////////////////////////////////////////// /////////////////////////////////////////////////////////////////////f// //3////9/////f////////////7////+////+v7///z////k6Ov//P///3d8f/8AAQT/HSIm /xgfJf8wNz//GyQt/xskLf8rND3/Nj9I/0FKU/9ETVb/OkNM/zhBSv82P0j/ND1G/zE6Q/8t Nj//KjM8/ygxOv8mLzj/MTtF/zE+R/82QEr/N0RN/z5IUv8/TFX/RE5Y/0RRWv9ETlj/LTpD /x0nMf8aJzD/JS85/yQxOv8YIiz/CxQd/wgMFf8OERr/Gx4n/xUYIf8FCBH/Cg4X/xIWH/8F CRL/EBcf/xIZIf8UGyP/FyAn/xskK/8eJy7/ISox/yErNP9vfYb/tcbQ/6y9x/+mt8H/ucrU /5Okrv8SIy3/PU5Y/zRFT/8lNkD/Lj9J/zZHUf8uP0n/MUJM/zRFT/8qO0P/gpOb/6/Ax/+n uL//vc7V/56vtv+MnaT/fI2U/4maof+yw8r/w9Tb/5ipsP8ZKjH/LD1E/z5PVv9CU1r/TF1k /3KDiv94iZD/dYaN/2BxeP9LXGP/PU5V/zZHTv8wQUj/KzxD/zBBSP87TFP/NEVM/0JTWv8v QEf/JDU8/y0+Rf8TJSn/Gy0x/yU3O/9abHD/fo+W/5mqsf+oucD/0OHo/7TFzP+AkZj/IjM7 /x4vN/88TVX/O0xU/yIzO/9JWmT/MUNN/zFDTf80RlD/NEZQ/yo8Rv8mOEL/OEpU/1BibP+m uML/pLbA/+Dy/P+HmaP/Cx0n/zZIUv88Tlj/SFti/2t8hP97jJP/n7C3/66/xv9yg4r/QFFY /0dYX/8+T1b/SVph/zZHTv9oeYD/wtPa/8PU2/9neH//MEFI/z1OVv9BU2H/NUZW/zFCUv86 S1v/QFFh/zxNXf83SVf/OEpY/zlLWf8+UFz/PE5a/zZIVP83SVX/PlBa/zxOWv80RlD/QVJc /0JTXf9CU13/QlNd/0NUXv9DVF7/Q1Re/0NUXv9AUVv/QVJc/0FSXP9AUVv/PU5Y/zlKVP80 RU//MUJM/yY4RP8uQE7/JzlH/yY4Rv84Slj/P1Ff/z1PXf9EVmT/SVtp/0FTYf9GWGb/QlRi /1Jkcv9FV2X/Slxq/0haaP9HV2f/R1dn/0dXZv9HV2b/R1dm/0dXZv9HV2T/R1dk/0VWYP9E VV//QlNd/0BRWf89Tlb/OktS/zhJUf83SE//LzxE/zxJUf9ATVX/PUpS/5Kfp//H1Nz/zNnh /8XS2v/AzdX/xdLa/z9MVP8mMzv/IzA4/x0qMv8TICj/JjM8/yIwO/8cKjf/FSMw/0tZZP9r eYL/VGFp/19scv96hYn/lJ6g//P7/f/5////8ff1//z////y9/P//v/9//j69/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////3+///9/v//+Pz/ //H1+P/5/P//x8rP/wABBf8gJSn/Exgc/xgfJf8eJS3/DRYf/wQNFv8OFyD/HSYv/ycwOf8y O0T/PUZP/zlCS/84QUr/Nj9I/zM8Rf8uN0D/KTI7/yQtNv8iKzT/ICky/yErNP8kLTb/JC43 /yQtNv8hKzT/ICky/x0nMP8THCX/FR8o/xkiK/8aJC3/GyQt/xchKv8UHSb/Ehsk/wYKE/8I CxT/CAwV/wkNFv8LDxj/DBAZ/w0RGv8MExv/Exoi/xYdJf8ZIin/FB0k/yIrMv8iLTP/ERwi /2Zze/+ksrv/tMXP/7PEzv+qu8X/tMXP/y0+SP80RU//JDU//yw9R/8pOkT/ITI8/yw9R/80 RU//L0BK/yo7Rf86S1P/NEVN/4qbov+crbT/p7i//6q7wv+wwcj/uMnQ/7XGzf/O3+b/uMnQ /zdIT/8fMDf/Pk9W/zhJUP9MXWT/kqOq/6u8w/9wgYj/eYqR/6S1vP+gsbj/lKWs/4qbov9p eoH/O0xT/zBBSP80RUz/JTY9/zdIT/9EVVz/KTpB/z5PVv8hMzf/N0lL/yM1N/8YKiz/FCYq /wMVGf8JGiH/ECEo/wAKEv8FFh7/GCkz/ys8Rv85SlT/Pk9Z/z5PWf88TVf/OkxW/0FTXf8v QUv/KTtF/yQ2QP84SlT/KTtF/4GTnf/B093/z+Hr/9Hj7f8oOkT/M0VP/zBCTP87TVf/coWM /3aHj/97jJP/YnN6/7PEy//M3eT/TF1k/zpLUv83SE//RFVc/2Fyef+uv8b/1ufu/9fo7/9h cnn/QVJZ/zRFTf8uQE7/MUJU/zdIWP88TV3/Pk9f/z5PX/88Tlz/O01b/ztNWf88Tlr/PU9b /zVHUf85S1X/RFde/0JUXv89UFf/QFFZ/0BRWf9AUVn/QFFZ/0BRWf9AUVn/QFFZ/0BRWf87 TFT/QlNb/0pbY/9KW2P/QVJa/zpLU/88TVX/Q1Re/z9RXf8+UF7/O01b/zdJV/8yRFL/LkBO /ys9S/8qPEr/KjxK/zZIVv9BU2H/QlRi/zxOXP89T13/SFpo/1RmdP9GVmX/RlZl/0RUY/9C UmH/QFBf/z5OXf89TVr/PExZ/zxMWf8/UFr/QlNd/0NUXv9BUlz/O0xU/zVGUP8xQkr/NkNL /zZDS/9BTlb/VWJq/8nW3v/I1d3/0+Do/7rHz//R3ub/cH2F/zE+Rv8WIyv/FCEp/y06Qv8r OED/FSIr/yAuOf8bKzj/KjhD/05cZ/9caXL/Y212/3J9g/9LVFn/s7u+/+zx9P/7////9/v6 //f7+v/8//3/+v/7//j69/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////v7///3+///9/v//+/////z////y9fr/Y2Zr/wABBf8YHSH/Iicr/xkeJP8l LDT/HCUu/w8YIf8EDRb/AwwV/wgRGv8LFB3/DBUe/xcgKf8YISr/HCUu/x8oMf8jLDX/Ji84 /ygxOv8pMjv/HCUu/xwlLP8dJC7/GiMq/xgfKf8SGyL/DhUf/woTGv8RGCL/Ehsi/xUcJv8V HiX/FBsl/xAZIP8NFB7/ChEZ/wYKE/8ICxT/CAwV/woOF/8MEBn/DREa/w0UHP8NFBz/Exoi /xkiKf8YISj/GiMq/yUwNv8dKC7/Q05U/4qXn/+0wsv/rr/J/6q7xf/G1+H/UGFr/zpLVf8p OkT/LD1H/yQ1P/8zRE7/M0RO/yk6RP8pOkT/MUJM/yw9R/8jNDz/Ficv/xUmLf8ADxb/DyAn /z9QV/9VZm3/c4SL/3+Ql/9SY2r/Lj9G/x8wN/86S1L/MkNK/zZHTv+DlJv/nq+2/5eor/9t foX/doeO/5ipsP+Wp67/nq+2/7vM0//E1dz/j6Cn/zpLUv89TlX/OUpR/yAxOP84SVD/Q1Rb /zlLT/87TU//NEZI/zNFR/80Rkj/IDI2/yc5Pf88TVT/HC00/yEyOv8nOED/L0BK/zZHUf83 SFL/NEVP/y4+S/8qOkf/OUtV/zZIUv8pO0X/LD5I/yQ2QP83SVP/O01X/5utt//H2eP/wtTe /5utt/8IGiT/JzlD/zpMVv8rPUf/hpmg/8fY4P/g8fj/0+Tr/9bn7v+/0Nf/PE1U/zpLUv8+ T1b/IjM6/46fpv+NnqX/2erx/93u9f9JWmH/M0RL/0RVXf8vQU//MkNT/zdIWP87TFz/PU5e /z1PXf88Tlz/O01Z/zpMWP85S1X/OUtV/zlMU/89UFf/QlVb/0BTWf8+UVf/QFFZ/0BRWf9A UVn/QFFZ/0BRWf9AUVn/QFFZ/0BRWf86S1P/O0xU/z1OVv9AUVn/QlNb/0FSWv9CU1v/RFVf /0dZZf9GWGb/RFZk/0FTYf8+UF7/O01b/zlLWf84Slj/NEZU/zJEUv8wQlD/MEJQ/zFDUf8x Q1H/L0FP/y0/Tf9LW2r/S1tq/0paaf9JWWj/R1dm/0ZWZf9FVWL/RVVi/0FRXv9CUl//RFRh /0VWYP9DU2D/P1Ba/zpKV/83SFL/RFFa/0ZTW/9ATVX/nquz/8rX3//D0Nj/w9DY/77L0/+9 ytL/SFVd/xonL/8pNj7/KTY+/x4rM/8aJy//JjQ9/xgpM/8mN0H/OEZR/1xpcv9mcHn/Y2xz /212ff86QkX/09jc//r+///8////9vr5//b79//8//3/+//6//v/+v/+//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////+/v///v7///3+///9/v//+v3///z////X 2t//Cg0S/wcMEv8VGiD/Iict/xofJf8lLDT/KC85/x4lL/8JEBr/AAYQ/wQLFf8GDRf/AgkT /wYNF/8HDhj/ChEb/w4VH/8TGiT/Fx4o/xsiLP8dJC7/GiEp/xsiKP8dISr/GiEn/xkdJv8S GR//EBQd/wsSGP8RFR7/DxYc/xIWH/8OFRv/DhIb/wgPFf8GChP/AwcQ/wcLFP8IDBX/CQ0W /wsPGP8MExv/DhUd/xAXH/8QFx//Exwj/xwlLP8ZIin/ICsx/yYxN/8pNDr/hI+V/7K/x/+9 y9T/pbbA/7/Q2v+JmqT/Hi85/yo7Rf8uP0n/Lj9J/yk6RP8pOkT/LT5I/yo7Rf8oOUP/KTpE /zhJU/9AUVn/NUZO/zZHTv8wQUj/JDU8/yY3Pv8LHCP/DB0k/wwdJP8OHyb/IDE4/zFCSf88 TVT/OktS/yY3Pv94iZD/uMnQ/7jJ0P+svcT/r8DH/6/Ax/+is7r/rL3E/8vc4//c7fT/hZad /xorMv8mNz7/Rlde/zhJUP9dbnX/i5yj/5eprf+OoKL/hpiY/2h6ev9Yamr/TmBi/z9RVf87 TFP/NUZN/zZHT/83SFD/OktV/ztMVv86Slf/N0dU/zNDUv8xQU7/MEJM/y9BS/8vQUv/NUdR /yY4Qv8zRU//LD5I/2R2gP9BU13/DyEr/w0fKf8mOEL/S11n/0lbZf8jNT//NklQ/4SVnf/C 09r/tMXM/3SFjP9DVFv/Hi82/zFCSf8wQUj/WGlw/4+gp/+gsbj/2+zz/7nK0f8fMDf/SFlg /zZHT/8yRFL/NEVV/zdIWP87TVv/PE5c/z1PW/88Tlr/O01X/0BSXP9DVl3/QFNZ/z5RVf84 S0//NklN/z5RVf9EV1v/QVJZ/0FSWv9BUlr/QVJa/0FSWv9BUlr/QVJa/0FSWv8+T1f/Pk9X /z1OVv89Tlb/QFFZ/0NUXP9FVl7/RFVf/0haaP9IWWn/R1ho/0ZXZ/9FVmb/RFVl/0NUZP9C U2P/R1ho/0BRYf87TFz/Pk9f/0VWZv9HWGj/QlNj/zxNXf8oOEf/KjpJ/y4+Tf8zQ1L/OUlY /z5OXf9DU2L/RVVk/0ZWZf9CUmH/Pk5d/zpKV/85SVj/OkpX/z1NXP8/T1z/SVZf/z5LU/9g bXX/0t/n/83a4v/L2OD/xdLa/9Lf5/95ho7/M0BI/yAtNf8qNz//JDE5/x4rM/8cKTH/JTM8 /xwtN/83SFL/X214/2Vye/9YYmv/eYKJ/0hPV/+PlJj/9vn+//7////+////+fv6//j9+f/7 //r/+//7//z/+//+//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7+///+ /v///v7///z9///8/f//9/r///z///+2ub7/AAAF/xYbIf8YHSP/FRog/x8kKv8jKjT/KC85 /yUsNv8WHSf/ChEb/woRG/8OFR//EBch/wkQGv8IDxn/Bw4Y/wcOGP8IDxn/ChEb/wwTHf8O FR3/Exge/xUaIP8YHSP/GyAm/xwhJ/8bICb/GR4k/xccIv8TGB7/Ehcd/xAVG/8NEhj/CQ4U /wUKEP8CBw3/AAUL/wcLFP8IDBX/Cw8Y/w0RGv8OFR3/ERgg/xMaIv8THCP/Exwj/x0mLf8d KC7/JTA2/yItM/9SXWP/r7rA/8DN1f+1w8z/r8DK/7jJ0/8nOEL/LD1H/x4vOf8wQUv/KjtF /zpLVf8rPEb/LD1H/ys8Rv8zRE7/OktV/1hpc/9oeYH/Sltj/0BRWP84SVD/MUJJ/zJDSv8w QUj/L0BH/zxNVP8fMDf/Slti/zNES/8pOkH/SVph/x4vNv8YKTD/Rlde/1lqcf9/kJf/orO6 /7HCyf+7zNP/w9Tb/7zN1P+svcT/GCkw/zBBSP8/UFf/LD1E/1Vmbf+jtLv/lKWs/1pscP9n eXv/o7W1/7XHx/+rvb3/qbu9/46gov9ecHT/QVJZ/zdIUP84SVH/OElT/zlKVP86Slf/PExZ /z1NXP8+Tl3/MEJO/zVHUf84SlT/NEZQ/yg6RP86TFb/IzU//yEzPf8hMz3/KjxG/yY4Qv81 R1H/HjA6/y5ASv9HWWP/FCcu/yg5Qf8SIyr/AAcO/xYnLv8mNz7/QFFY/0BRWP9YaXD/kqOq /7zN1P/g8fj/6vv//0xdZP8vQEf/RFVc/zdIUP82SFT/N0lX/zhKWP86TFj/O01Z/zxOWP88 Tlj/PE9W/0RXXv9HWmD/PlFV/0JWV/9JXV7/SV1c/0ZaWf80SEn/QVJZ/0FSWv9BUlr/QVJa /0FSWv9BUlr/QVJa/0FSWv9DVFz/R1hg/0VWXv8/UFj/PE1V/0BRWf9DVFz/QVJc/0BSYP9A UWH/QFFh/0FSYv9CU2P/QlNj/0JTY/9DVGT/RFVl/0NUZP9DVGT/RVZm/0laav9LXGz/S1xs /0pba/9QYG//TV1s/0dXZv8+Tl3/NUVU/yw8S/8mNkX/IjJB/yo6Sf8zQ1L/Pk5d/0ZWZf9F VWT/PExb/y8/Tv8nN0T/RlNc/z1KUv+ptr7/ztvj/83a4v/V4ur/0d7m/8PQ2P82Q0v/LDlB /zRBSf8jMDj/FSIq/yMwOP8jMDj/Gikw/xssNP9CVF7/YG53/1BdZv9qdH3/bnV9/1RZX//r 7vP//v////7////+/////P77//z/+//8//v/+//7//z/+//+//3///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////v7///7+///+/f///fz///z9///8/f//+fz///b5/v+sr7b/AgUM /xofJf8YHSP/Gh8l/yYrMf8oLzn/JSw2/yMqNP8dJC7/DxYg/wEIEv8BCBL/CRAa/xIZI/8P FiD/CxIc/wgPGf8HDhj/CA8Z/wsSHP8NFBz/DRIY/xATGP8UFxz/Fxof/xgbIP8YGyD/Fxof /xYZHv8XGh//FRgd/xEUGf8NEBX/Cg0S/wcKD/8FCA3/BAcO/wgMFf8JDRb/ChEZ/w0UHP8R GCD/FBsj/xYfJv8XICf/FR4l/xwnLf8kLzX/JTA2/x8sMv+Jlpz/ucbM/7fEzP+wvsf/vM3X /2Z3gf8XKDL/LD1H/zRFT/8lNkD/KDlD/yw9R/8uP0n/NkdR/zdIUv9uf4n/lqex/6W2wP+M naX/r8DI/5+wt/+ImaD/hJWc/2l6gf9fcHf/Jzg//zJDSv8qO0L/OUpR/zBBSP82R07/MUJJ /zFCSf8qO0L/Jjc+/xorMv8TJCv/DB0k/x0uNf8+T1b/QFFY/xYnLv8ABAv/ITI5/zRFTP8v QEf/O0xT/4ydpP/B0tn/pba9/4udof97jY3/jaCe/6K0tP+ktrb/vc/R/+X3+f+muLz/Jjc+ /z5PV/88TVX/OUpU/zZGU/81RVT/NUVU/zZGVv82RlX/O01Z/zlLVf81R1H/Kz1H/yQ2QP88 Tlj/NkhS/y5ASv8vQUv/MEJM/0ZYYv9zhY//hJag/15wev9DVV//NUhP/zRFTf8qO0L/N0hP /0FSWf8xQkn/N0hP/zpLUv9WZ27/3O30//L////c7fT/XW51/yw9RP80RUz/NUZN/zFCSv86 TFj/OUtX/zlLV/85S1f/OUtX/zpMVv87TlX/PE9V/zVITP86Tk//NEhJ/1JmZf9/k5H/k6el /4WZl/9VaWj/QlRY/0JTWv9CU1r/QlNa/0JTWv9CU1r/QlNa/0JTWv8/UFf/RFVc/0JTWv87 TFP/O0xT/0JTWv9CU1r/OktT/ztNW/88TV3/PU5e/z5PX/8/UGD/QFFh/0FSYv9CU2P/RVZm /0NUZP9CU2P/QlNj/0NUZP9DVGT/QVJi/z9QYP8+Tl3/P09c/0FRXv9DU2D/RlZl/0hYZ/9K Wmn/Slpp/0ZWZf8+Tl3/MkJS/yk5Sf8pOUn/MUFR/z1NXf9GVmX/PUpT/298hP/g7fX/xtPb /87b4//R3ub/0d7m/3mGjv8lMjr/Hisz/yw5Qf8nNDz/HSoy/yAtNf8bKDD/HCsy/zNETP9c b3b/Tlxl/1Rhav+XoKn/XmVt/8HEy//+/////v////n5+//6+vr//v/9//z/+//8//v/+//6 //z/+//+//3///////////////////////////////////////////////////////////// //////////////////////////////////////////7+///+/v///v7///7+///9/P///fz/ //v8///7/P///P////X4/f+1uL//BAcO/xkeJP8YHSP/LzQ6/ygsNf8tND7/Ji03/yUsNv8n Ljj/HiUv/w0UHv8JEBr/EBch/yQrNf8fJjD/Fh0n/w0UHv8GDRf/AwoU/wMKFP8GChP/GRwj /xodIv8cHyT/HSAl/xwfJP8ZHCH/Fhke/xMWG/8XGh//FBcc/xATGP8MDxT/CQwR/wgLEP8I CxD/CQwR/wkNFv8KDhf/CxIa/w8WHv8UGyP/GB8n/xojKv8bJCv/GCMp/x4pL/8oMzn/JC81 /ys4Pv+yv8X/tcLI/628w/+9y9T/rr/J/xkqNP80RU//JzhC/zpLVf8oOUP/JjdB/zdIUv8x Qkz/M0RO/0BRW/+Roqz/o7S+/4ucpv9bbHT/g5Sc/6W2vf+tvsX/t8jP/66/xv+4ydD/R1hf /yo7Qv9DVFv/N0hP/zNES/8/UFf/Jjc+/zlKUf86S1L/JDU8/zVGTf8rPEP/Jjc+/yY3Pv8d LjX/EyQr/yM0O/9CU1r/OUpR/z9QV/8zREv/Jjc+/05fZv+brLP/wtPa/7zO0v/M3t7/s8bE /6S2tv+muLj/x9nb/9Hj5f99j5P/Giww/zpLU/85SlL/NkZT/zREUf8yQlH/MUFQ/zFBUf8x QVD/OUtX/zNFT/8wQkz/LkBK/yM1P/8lN0H/MEJM/0FTXf85S1X/WWt1/9Hj7f/T5e//x9nj /7bI0v96jJb/cYSL/2Jze/9tfoX/fI2U/zVGTf8sPUT/RFVc/0ZXXv8SIyr/obK5/7HCyf9J WmH/Jjc+/yU2Pf8+T1b/Gisy/ztMVP89T1n/PE5a/zpMWP84SlT/OEpU/zlMU/87TlT/PE9T /y9DRP86Tk3/M0dG/1FlY/9ziIP/g5iR/4memf9qfnz/QlRY/0JTWv9CU1r/QlNa/0JTWv9C U1r/QlNa/0JTWv86S1L/RVZd/0ZXXv8/UFf/QFFY/0hZYP9EVVz/N0hQ/z9RX/9AUWH/QFFh /0FSYv9CU2P/Q1Rk/0NUZP9EVWX/SFlp/0JTY/8+T1//QVJi/0laav9NXm7/SFlp/0NUZP8/ T17/P09c/z9PXP9AUF3/QFBf/0BQX/9AUF//QFBf/zlJWP88TFv/QFBg/0NTY/9EVGT/QlJi /z5OXv88TFv/O0hR/667w//d6vL/0+Do/9Pg6P/P3OT/uMXN/zhFTf8qNz//HCkx/yIvN/8j MDj/JTI6/yc0PP8eKzP/ITA3/1Fiav9fcnn/Tlxl/3F+hv9jbHP/i5CW//r9///9/v//+Pf8 //Pz8//6+vr//v/9//7/+//8//v/+//6//n++P/+//3///////////////////////////// //////////////////////////////////////////////////////////////////////// //7+///+/v///v7///39///9/P///Pv///v8///7/P///P////r9//+ztr3/EBMa/xsgJv8g JSv/MjY//ycrNP8wND//LzM+/y8zPv8zN0L/NDhD/y8zPv8pLTj/JSk0/ysvOv8kKDP/GR0o /w0RHP8FCRT/AQUQ/wAED/8BBQ7/Gx4l/x8gJf8hIif/IiMo/yEiJ/8fICX/HB0i/xobIP8V Fhv/EhMY/w4PFP8LDBH/CQoP/woLEP8MDRL/DA8U/wkNFv8JEBj/DBMb/xEYIP8WHSX/GiEp /xwlLP8eJy7/HSgu/yMuNP8nMjj/Iy40/0NQVv+9ytD/tcLI/7PCyf/F09z/o7S+/wgZI/80 RU//L0BK/ys8Rv8xQkz/KDlD/y0+SP8pOkT/KzxG/0FSXP+mt8H/tMXP/6u8xv+er7f/tcbO /7vM0/+pusH/pba9/8DR2P/R4un/TF1k/yo7Qv80RUz/MEFI/zxNVP9peoH/kqOq/5eor/94 iZD/ZHV8/1dob/84SVD/KDlA/zFCSf83SE//M0RL/y0+Rf8qO0L/SVph/y4/Rv8tPkX/NEVM /yEyOf8aKzL/N0hP/09hZf9xhIL/jqGd/6u+vP+xxML/p7m5/2p8fv8oOj7/NEZK/y9ASP8w QUn/MkJP/zNDUP80RFP/NUVU/zVFVf81RVT/L0FN/zJETv81R1H/NkhS/y0/Sf8aLDb/HzE7 /zFDTf9EVmD/IjQ+/4iapP/J2+X/3vD6/9nr9f+tv8n/p7rB/8zd5f/M3eT/zd7l/4iZoP8+ T1b/NEVM/z9QV/8yQ0r/Ficu/yQ1PP8rPEP/PU5V/0dYX/8kNTz/MUJJ/0hZYf9AUlz/PlBa /zpMVv83SVP/N0pR/zhLUf87TlL/PVFS/z1RUv9DV1b/NkpI/01iXf9NYlv/OE1E/0VaU/8/ VE//Q1VX/0NUW/9DVFv/Q1Rb/0NUW/9DVFv/Q1Rb/0NUW/9GV17/ZHV8/3OEi/9gcXj/SFlg /0JTWv9DVFv/QVJa/0JUYv9CU2X/QlNl/0JTZf9CU2X/QlNl/0JTZf9CU2X/Pk9h/z1OYP89 TmD/P1Bi/0JTZf9FVmj/RFVn/0NUZP9HV2b/R1dk/0ZWY/9EVGH/Q1Ni/0FRYP9AUF//QFBf /0NTY/9BUWH/P09f/z5OXv8/TmH/QlFk/0ZVaP9IWGf/cH2G/87b4//P3OT/2OXt/9Th6f/O 2+P/cn+H/yc0PP8oNT3/IzA4/yg1Pf8hLjb/IS42/yg1Pf8oNT3/NURL/1Vmbv9JXGP/UmFo /3aDi/89Rk3/ys/V/+np8f/5+P3/+vj9//j29////////v/9//r89//8//v/+//6//r/+f/+ //3///////////////////////7//////////v////////////////////////////////// //////////////////////////////////7+///+/v///fz///38///9/P//+/z///v8///5 /P//+v3///v///+lqrD/JSow/x8mLP8qMTf/ISgw/yMqMv8xOEL/NTxG/zU8Rv8yOUP/Nz5I /zxDTf8yOUP/Iikz/xceKP8RGCL/ChEb/wQLFf8CCRP/BAsV/wkQGv8OEhv/DAwU/w8QFf8T FBn/GBke/xscIf8cHSL/HB0i/xscIf8QERb/Dg8U/woLEP8HCA3/BwgN/wkKD/8MDRL/DA8U /wkOFP8JEBb/DRQa/xIZH/8XHiT/GiMq/x4nLv8fKjD/ICsx/ygzOf8mMTf/IC0z/1Zjaf+4 xcv/uMXL/77N1P+5ytL/s8TO/w4fKf8mN0H/L0BK/yk6RP8tPkj/Lj9J/yM0Pv84SVP/Lj9J /xMkLv9qe4X/jZ6o/6O0vv+pusT/scLK/6W2vf+1w8z/ydrh/9bk7f+Upaz/GCYv/zpLUv82 RE3/Q1Rb/3uJkv+Wp67/oa+4/32Olf+Bj5j/lqeu/6Gyuf+gsbj/k6Sr/2t8g/89TlX/MkNK /zpLUv83SE//LT5F/zpLUv81Rk3/MEFI/zVGTf80RUz/LD1E/yAyNv8XKSn/Cx4c/xstLf8K HBz/AAgK/wweIP8kNjr/N0hP/y9ASP8xQkr/NEVP/zZGU/82RlP/NUVU/zJCUf8xQVD/LkBK /z1PWf89T1n/OEpU/zpMVv8tP0n/KjxG/yw+SP82SFL/N0lT/xIkLv8zRU//eYuX/6O1v//E 1uL/3O74/9fo8P/q+///0uPr/6m6wv8zREz/RVZe/zxNVf80RU3/NEVN/ztMVP88TVX/LT5G /yg5Qf9EVV3/OktT/zRFTf9CVF7/P1Fb/zpMVv83SVP/NklQ/zhLUf87TlL/PVFS/0NXWP89 UVD/OExL/22Bf/97j43/U2hj/05iYP9BVVT/Q1Rb/0NUXP9DVFz/Q1Rc/0NUXP9DVFz/Q1Rc /0NUXP9YaXH/jJ2k/6m6wv+Gl57/Tl9n/zZHTv9AUVj/TV9p/0FSYv9AUmb/QFFj/z9QYv8+ T2H/Pk9f/z1OXv89Tl7/R1ln/09hb/9UZnT/TF5s/z1PXf81R1X/OUtZ/0JSYf9FVWL/RVZg /0RVX/9DVF7/QlJf/0FRXv9AUF3/QFBd/0FRYP8+Tl3/O0ta/zlJWP86Slr/Pk5e/0RUZP9H V2b/wc7X/9nk6v/Z5Or/z9zk/87b4//I1d3/JDM6/yk3QP8oNj//Hy02/ys5Qv8uO0P/IS42 /xckLP8nNDz/WGVt/2Jvdf9ZZmz/YWxy/3uEif+aoaf/+Pv///3+///39vv///7////+//// ///////9//T28//6//n//P/7//z/+//+//3/////////////////+vz7//n9/P/7/fz/+Pz7 //n6/P/6+/3//f7///7////7/P7//v////7+///8/P7////////////49vn////////+///+ /////f7///r7///8/f//9/r//+Dj6v/Eyc//c3h+/yoxN/8UHST/MjtC/zU+Rf8oMTj/Ljk/ /zlESv83QEn/OUFM/0BIU/9CSlX/NDxH/x4mMf8TGyb/Fh4p/xAYI/8OFiH/ChId/wYOGf8E DBf/BQ0Y/wYOGf8IDxn/AwML/wgHDf8NDBL/EhEX/xQTGf8TEhj/ERAW/w8OFP8IBw3/CAcN /wkIDv8KCQ//CwoQ/wsKEP8MCxH/CwwR/w0VGP8NFxn/EBoc/xMdH/8XISP/GiUp/xwnK/8e KS3/MTxA/x4sL/8qNz3/ITA1/zpJTv/H1tv/rbzD/8DP1v/A0dn/qrvF/1Nkbv8jND7/LT5I /zNETv80RU//L0BK/zNETv8zRE7/Lj9J/yIzPf8UJS//DB0n/w8gKv8UJS//NEJN/2Bud/+D j5v/b32G/zlFUf8VIyz/Ii46/z5MVf83Q0//WGZv/6ezv/+wvsf/kp6q/3uJkv94hJD/q7nC /7zN1P+0xcz/tsfO/8PU2/9neH//O0xT/yc4P/85SlH/Lj9G/zdIT/9CU1r/QFFY/zVGTf8x Qkn/N0hP/zxOUv8uQUX/NUlK/yc7PP8sQEH/NEdL/zpNU/8lOD7/N0pR/zVIT/81SE//NUdR /zVHUf81R1H/NUdT/zVHU/81R1P/NkhS/zZJUP82SVD/NklQ/zZIUv82SFL/NkhS/zZIUv8x Q0//MEJO/y0/S/8mOET/HC48/xEjL/8GGCb/ABIe/wweKv8BEx//ABAc/xAiLv8uQEz/QVNf /z1PW/8yRFD/LkBM/zFDT/81R1P/OUtX/zxOWv88Tlr/PE5a/ztNWf9LXWn/RFZi/y0/Sf89 T1n/N0pR/zpNU/82SU3/M0ZK/zNGSv9IW1//NEdL/zRHTf9TZmz/QFNZ/0hbYv86TFb/OEpW /zxOWv9GWGT/Q1Vh/0ZYZP9HWWX/Q1Vf/0BSXP86TFb/UmVs/15wev9neoH/ZXeB/z9SWf9J XGP/VWdz/0teb/81Sl//UGJ2/0daa/81SFf/Ok1b/z1RXP9idn//qr3E/8HU2//A0dj/t8jP /73O1v+wwcn/iZqi/2x9hf9ebHX/RlRd/1VjbP85R1D/P01Y/0lXYv8+TFf/PEpV/z9PXP8+ Tlv/S11p/zlLV/9KXGr/R1ln/zVHVf+DlJ7/4Ovx/9Lb4P/P2N3/1eDm/9fk7P9OXWT/NEVN /yo7Rf8mN0H/KjtF/yEyPP8dKzT/JjU8/x0sM/9LWF7/Ym1x/1RcX/9RVVj/rrK1//b6+//5 +vz//v/////////8/P7////////////////////////////+//3//v/9//7//f////////// ////////////+v79//z////8/////P////z////6/v//+vv9//n6/P/+////7/Dy//n5+/// ////8vL0//X19////v//7u3y//Dx9v/19vv/+vv///T1+v/X2uH/nqGo/05TWf8TGB7/Ehkf /yAnLf8rNDv/Mj1D/yo1O/8XIij/HCkv/z1KUv88RlD/Q01X/0BKVP8uOEL/Higy/xgiLP8S HCb/CxUf/wAFD/8HERv/GCIs/yUvOf8lLzn/GyUv/wsVH/8CCRP/BwoR/woLEP8NDBL/DQ4T /w4NE/8MDRL/DAsR/woLEP8HBgz/BwgN/wgHDf8ICQ7/CgkP/woLEP8LChD/CQwR/w8XGv8P GRr/Ehwe/xUfIf8YIyX/GyYo/x0oLP8fKi7/Gyks/x0qMP8ZKC3/LTxB/yQzOP+wv8b/uMfO /7jGz/+svcf/tsfR/6Kzvf86S1X/Ficx/zJDTf8jND7/NUZQ/yg5Q/8tPkj/M0RO/zRFT/8y Q03/Lj9J/y0+SP8sPUf/Hio2/xEdKf8GEh7/Cxcj/x4qNv8wPEj/N0NP/zdDT/8+Slb/UV1p /5airv+2ws7/vMjU/7vH0/+wvMj/ztzl/7C+x/+8zdT/3e71/8/g5/9KW2L/NEVM/z1OVf8v QEf/Tl9m/3mKkf+ZqrH/nK20/5Wmrf+Gl57/bH2E/1dob/9HWl7/Ok1R/zZJTf8yRUv/LD9F /zNGTP87TlX/IzY9/zVIT/81SE//NUdR/zVHUf81R1H/NUdT/zVHU/81R1P/NkhS/zZJUP82 SVD/NklQ/zZIUv82SFL/NkhS/zZIUv8iNED/JDZC/yY4Rv8pO0n/Kz1L/ys9S/8rPUv/KjxK /ztNW/81R1X/MEJQ/zJEUv83SVf/OUtZ/zRGVP8uQE7/MUNR/zRGVP84Slj/PE5c/z5QXv8+ UF7/PlBe/z1PXf8rPUv/Q1Vh/z5QXP9AUlz/M0ZN/0VYXv9yhYv/fZCU/3uOkv9bbnL/UWRr /z9SWf88Tlj/Q1Vf/0haaP9FV2X/UmRy/0dZZ/9HWWf/NkhW/0lbaf9HWWf/Rlhk/zRGUv9Z a3X/V2lz/zlLVf9JW2X/P1Fb/ztNV/83SlH/O09a/0xecv89Umf/Q1hr/ztQYf9DVmX/Rlpl /1Vpcv+nvMH/xtnd/9Ll6f/N3+H/wdPV/8PV2f/E1tr/xtjc/9Tj6P/J2N//kJ2l/y08Q/9S YWj/PEpT/z5MVf9OXGX/QlBZ/0RVX/9FVmD/OUtV/0VXYf8+UFz/O01Z/1pseP+xwsr/3+jt /8zU1//g6e7/0t3j/6y5wf8xQkr/M0RO/yg6RP8lN0P/JzlF/yY3Qf8gMTn/FiQt/zJBSP9a Z23/X2ht/1JWV/95eXn/z8/P//7+/v/6+vr//v7+///////5+fn///////////////////// /////////////////////////////////////////////P////z////8/////P////z////8 ////+vv9//b3+f/19vj//v////Lz9f/3+Pr///7///n4/f/39vv///7///v8///g4Oj/rbC3 /21wd/8xND3/EhUe/xYaI/8oLDX/Iikx/wkQGP8cJS7/QElS/zM9Rv8UHif/BhAZ/wAJEv89 RVD/PkZR/zM7Rv8dJTD/EBgj/xAYI/8RGST/Dxci/yMrNv8lLTj/Ji45/yYuOf8lLTj/Iio1 /x4mMf8dJC7/FBcg/xIVHP8RERn/Cw4V/wsLE/8HChH/CQkR/wcKEf8JCRH/BwoR/woKEv8J DBP/CwsT/woNFP8NDRX/Cw4V/xMaIP8THR//FR4j/xghJv8bJCn/Hics/x8qMP8gKzH/Gict /xMgKP8lMjr/KDU9/yY1PP9lc3z/vszV/73L1P/D1N7/zd7o/6y9x/+qu8X/eouV/yo7Rf8m N0H/ITI8/zVGUP8yQ03/L0BK/y4/Sf8wQUv/MEFL/y4/Sf8rPEb/MDxI/zI+Sv80QEz/Mz9L /zE9Sf8zP0v/OUVR/z9LV/8vO0f/JDA8/0FNWf9YZHD/dICM/4+bp/+Woq7/ssDJ/73L1P/E 1dz/oLG4/2p7gv8kNTz/MUJJ/zpLUv9AUVj/fo+W/7XGzf+mt77/aXqB/3GCif+qu8L/u8zT /6q7wv+zxsz/gZSa/09iaP8/Uln/RFde/y1AR/9CVF7/OEpU/zVHUf81R1H/NUdT/zVHU/81 R1P/NUdV/zVHVf81R1P/N0lT/zdKUf83SlH/N0pR/zdJU/83SVP/N0lT/zdJU/8yRFD/MEJO /yw+TP8oOkj/JTdF/yM1Q/8jNUP/IzVD/x4wPv8lN0X/KjxK/yo8Sv8nOUf/JzlH/yw+TP8z RVP/NkhW/zhKWP88Tlz/QFJg/0FTYf9BU2H/QFJg/z9RX/9IWmj/SFpm/zJEUP81R1H/RFde /22Ahv/G2d//1unt/8fa3v+qvcH/scTL/5Wor/9/kZv/cYON/zxOXP9UZnT/QFJg/0RWZP9S ZHL/OUtZ/0FTX/8zRVH/S11p/0pcaP9XaXX/U2Vx/0dZY/87TVf/PU9Z/zxOWP9MXmj/QlZh /zZIXP9AVWr/RVpt/0JYZv9SZXP/Q1dg/1Zqcf/N4uf/2+7y/87h5f+/0dP/xdfZ/9zu8v/k 9vr/4O/2/+Hw9//H1d7/wM7X/zE/SP9ATlf/Q1Fa/0JQWf8+T1f/Rldf/0JTXf9FVmD/NkdR /0xdZ/8/UVv/NkhS/5CirP/Z6vL/1t/k/9ri5f/d5uv/2eTq/1hlbf8rPET/IzQ+/yo8Rv8m OET/JDZC/yk6RP8jNDz/EB4n/09cZP9ncnj/VV5j/1peX/+ysrL/8vLy///////6+vr/+vr6 ///////4+Pj///////////////////////////////////////////////////////////// /////P////z////8/////P////z////8/////v////z9///y8/X//v////3+///7/P7/8O/0 //v6/////v//1dbb/3h4gP9AQEr/DRAZ/wwPGP8lJzP/LzI7/yImMf8TFyD/Fx4o/xsiLP8M FR7/Hicw/ztFTv8XISr/AAcQ/ycxOv8zO0b/Ji45/xsjLv8WHin/Dxci/wgQG/8NFSD/GCAr /ygwO/8rMz7/LzdC/zE5RP8xOUT/LTVA/ykxPP8nLjj/JSky/yIlLP8bHif/FBce/w8SG/8O ERj/DhEa/w8SGf8PEhv/DxIZ/xATHP8RFBv/EhUe/xIVHP8TFh//Ehcd/xgfJf8YISb/GiMo /xwlKv8eJy7/ISox/yEsMv8iLDX/Kjc//xkmLv8uO0T/KTY//yY0Pf8nNT7/k6Gs/73L1v+3 yNL/ucrU/8fY4v+8zdf/ucrU/7jJ0/+So63/doeR/0NUXv87TFb/M0RO/zFCTP80RU//NUZQ /zBBS/8tO0b/NEBM/zxIVP9CTlr/QExY/zhEUP80QEz/N0NP/z1JVf9EUFz/KTVB/yAsOP8T Hyv/Eh4q/xwoNP8hLTn/N0VO/0NRWv9CU1r/GSox/xcoL/8wQUj/TV5l/0BRWP9LXGP/pLW8 /7PEy/+ktbz/laat/5uss/+Roqn/ipui/5+wt/+qvcP/2u30/4mco/8xREv/NklQ/zVIT/9D VV//OEpU/zVHUf81R1P/NUdT/zVHU/81R1X/NUdV/zVHVf81R1P/N0lT/zdKUf83SlH/N0pR /zdJU/83SVP/N0lT/zdJU/9BU1//PU9b/zhKWP8zRVP/MEJQ/zFDUf8zRVP/NEZU/zBCUP85 S1n/QVNh/0BSYP86TFr/OUtZ/0FTYf9KXGr/O01b/z1PXf9AUmD/Q1Vj/0RWZP9EVmT/QlRi /0FTYf86TFr/OkxY/zZIVP9FV2H/SFti/09iaP+0x83/1unt/+b5/f/n+v7/3/L5/9ns8//t ////uszW/zNFU/9JW2n/UWNx/z9RX/81R1X/OUtZ/0tdaf88Tlr/QVNf/zhKVv9FV2P/P1Fd /0ZYYv9IWmT/Rlhi/zpMVv9GWGL/SFpo/0FUZf9BVmn/O1Bh/zdNW/9KXWv/RFhh/1tvdv/A 1dr/3O/z/+H0+P/m+Pr/6Pr8/+z+///r/f//6vn//+j3/v/0////aHZ//zNBSv9MWmP/QU9Y /z9NVv9MXWX/P1BY/zxNV/8/UFr/Q1Re/0NUXv9JW2X/T2Fr/73P2f/g7vf/0dzg/+rz+P/Z 5Or/sr/F/yUzPP8pOkL/Hi85/yg6RP8pO0f/IDI+/yc4Qv8iMDn/KDU9/2Btc/9ga3H/TlVb /4GChP/k5OT///////7+/v/9/f3/9/f3///////9/f3///////////////////////////// /////////////////////////////////////P////r+/f/1+fj/9fn4//z////8/////P// //z////n6+7/9vr9//P3+v/i5un/z9DV/8/Q1f+kpar/MzM7/zg4Qv8pKzf/ICIu/x0fK/8U GCT/Cg4Z/w0RHf8XGyb/DhQg/wQKFv8HDxr/DhYh/xQcJ/8sND//QUtV/z9JU/8mLzj/GiEr /xIZI/8SGSP/DxYg/wgPGf8JEBr/DxYg/w0UHv8TGiT/HSQu/yYtN/8sMz3/LzZA/y41P/8t ND7/MTVA/ywwOf8lKTT/HiIr/xoeKf8YHCX/GBwn/xkdJv8ZHSj/GR0m/xoeKf8bHyj/HCAr /xwgKf8dISz/HSEq/x4lLf8eJS3/HyYu/yEoMP8iKzT/Iyw1/yQuN/8kLjj/LjhC/y44Qv8h LTn/NEBM/xcjL/8nMz//Q1Fe/42bpv/J1+L/vcvW/8PR3P+6yNP/ucfS/8XT3v/Bz9r/ydfi /83b5v/Aztn/q7nE/5Wjrv96iJP/Wmhz/zhGUf8hLzr/Mj5K/zI+Sv8zP0v/NUFN/zdDT/82 Qk7/Mz9L/y87R/87R1P/NEBM/zhEUP81QU3/MT1J/zA8SP8rN0P/M0FK/yY0Pf8XKC//IDE4 /ztMU/81Rk3/O0xT/y9AR/8aKzL/kKGo/77P1v+8zdT/pLW8/7PEy//A0dj/ssPK/6m6wf+7 ztX/0ePt/2J0fv8iND7/LkBK/ztNV/84Slb/LT9L/zVHU/81R1X/NUdV/zVHVf81Rlb/NUZW /zVGVv81R1X/OEpU/zhLUv84S1L/OEtS/zhKVP84SlT/OEpU/zhKVP85S1f/N0lV/zVHVf81 R1X/OEpY/z1PXf9DVWP/Rlhm/zxOXP8/UV//QVNh/0BSYP88Tlz/Okxa/zxOXP8/UV//PlBe /0BSYP9DVWP/RVdl/0VXZf9EVmT/QlRi/0BSYP9CVGL/QlRg/0NVYf9IWmT/MURL/wASGP8b LjT/GSww/zxPU/94i4//mKuy/67ByP+qvMb/anyG/x4wPv9TZXP/PlBc/0JUYP9TZXH/orTA /77Q3P+uwMz/kqSw/4KUoP9kdoL/U2Vx/0FTX/9LXWn/P1Fd/0FTX/84Slb/Rlhm/0RXaP8+ UGT/RVhp/09icP9UaHP/QFRd/yc6Qf8uQUf/XnB0/3qMjv+crrD/tcfJ/9Df5P/p+P3/7/7/ /+Py+f+uv8f/KDlB/z9QWP9BUlr/QFFZ/z5PV/9GV1//PU5W/zxNV/9EVV//SFlj/zlKVP9K W2X/i5ym/9Dh6//W5O3/1+Lo/+jx9v/V4Ob/YW50/zA+R/8eLzf/LT5I/yAyPv8rPUn/HzE9 /yIzPf8hLzj/T1xk/2Jvdf9TXmT/WmJl/7m6vP////////////j4+P//////9/f3//z8/P// /////////////////////////////////////////////////////////////////////P// //j8+//y9vX/9Pj3//z////8/////P////f7/P/8////trq9/zs/Qv8BBAn/EBMY/yQnLP8u Ljb/PUBJ/x8hLv8WGCf/DhAf/w4QHf8MDx7/CQ0Z/wgLGv8KDhr/BAoW/wsRHf8ABA//CxMe /z1FUP9ETFf/KzM+/ykxPP8fJjD/HyYu/xYdJ/8KERn/Bw4Y/woRGf8FDBb/AAEJ/w0UHv8J EBj/BAsV/wIJEf8IDxn/Exoi/yAnMf8oLzn/KjE7/ygvOf8mKjX/ISgy/yAkL/8dJC7/HiIt /xwjLf8hJTD/HyYw/yImMf8hKDL/JCgz/yIpM/8lKTT/Iyo0/yMqNP8jKjT/JCs1/yUsNv8l Ljf/Ji45/ycvOv8mMDr/JjA8/y03Q/8kMDz/Ii48/yAsOv8wPEr/GSc0/z1LWP99i5b/wM7Z /73L1v+8ytX/u8nU/73L1v/T4ez/sL7J/8HP2v/C0Nv/xdPe/8rY4//M2uX/ytjj/8LQ2/+8 ytX/lKCs/4GNmf9jb3v/RlJe/zM/S/8wPEj/N0NP/z9LV/8+Slb/OUVR/zdDT/80QEz/NEBM /zVBTf8zP0v/NUNM/zZETf83SE//OUpR/zhJUP8xQkn/NkdO/zpLUv88TVT/FSYt/yo7Qv9B Uln/Znd+/5Giqf+er7b/p7i//8HS2f+fsbv/W213/xUnMf84SlT/PlBa/zZIUv8zRVH/M0VR /zVHVf81R1X/NUdV/zVHVf81Rlb/NUZW/zVGVv81R1X/OEpU/zhLUv84S1L/OEtS/zhKVP84 SlT/OEpU/zhKVP8zRVH/M0VR/zNFU/8zRVP/NUdV/zhKWP87TVv/PE5c/zxOXP88Tlz/PE5c /z5QXv9AUmD/QlRi/0JUYv9CVGL/P1Ff/0FTYf9DVWP/RVdl/0RWZP9DVWP/QFJg/z5QXv8/ UV//P1Fd/zlLV/8/UVv/R1ph/zdKUP80R03/KTxA/y1ARP8HGh7/AAUM/wAPFv8AEBr/DB4o /y5ATv9NX23/NEZS/09hbf9pe4f/zN7q/93v+//X6fX/zN7q/9Di7v/K3Oj/x9nl/7LE0P8/ UV3/Slxo/0JUYP9SZHD/Okxa/0lcbf89UGH/P1Jh/z9SYP86Tln/SV1k/1Vobv9NYGT/QFJU /zJERv8gMjT/Figq/yo5Pv9WZWr/anmA/11rdP8MHSX/P1BY/0tcZP8sPUX/RFVd/0NUXP8z REz/QlNb/0FSXP9PYGr/P1Ba/z5PWf9VZnD/xNXf/9Hi7P/U4uv/3Oft/+Dr7/+frLL/NURL /zA+R/8pOkT/LkBM/x8xPf8sPkr/IDI8/yMxOv8vPkX/ZnN5/1tmav9cZWr/hY2Q/+rr7f// ////+vr6//X19f//////+/v7//v7+/////////////////////////////////////////// /////////////////////////////v/9//r8+f/4+vn//f/+//z////8////7/P2/+Hl6P+O kZb/DhEW/wAECP8XHCL/BQoQ/w4TGf8fIiv/Iycy/0BDUv8tMEH/FBco/wgLGv8NECH/EhUk /wgOHv8AAA7/BAoY/wQKGP8pLz3/R01b/zc9S/8lKzn/Iyk1/xohK/8dJCz/HCEn/xIWH/8G CxH/BgoT/wsQFv8HCxT/AAEH/wgMFf8IDRP/CAwV/wgNE/8IDBX/CA0T/wkNFv8HDhb/Fx4o /xcfKv8aICz/GiIt/xshLf8ZISz/GR8r/xcfKv8iKDT/ISk0/yMpNf8iKjX/JCo2/yQsN/8l Kzf/Jiw4/yctOf8nLTn/Jy05/yguOv8pLzv/KDA9/ykxPv8pMT7/KDFA/yQtPP8wOUj/GiM0 /y46Sv8oNET/Iy8//xomNP8qOEP/MkBL/3SCjf+dq7b/vszX/7/N2P+ntcD/2+n0/7/N2P/C 0Nv/xtTf/8fV4P/G1N//xdPe/8bU3//I1uH/zNjk/8bS3v/Cztr/ws7a/73J1f+lsb3/f4uX /2Ftef9LV2P/RVFd/zdDT/8sOET/JzM//yo2Qv8zP0v/NkRN/zA+R/89TlX/MUJJ/yY3Pv82 R07/MUJJ/yc4P/80RUz/ITI5/yw9RP8eLzb/BRYd/wgZIP8dLjX/IzQ7/xssM/8JGiT/FSYw /y09Sv9AUF3/NUVS/zhIVf8/T17/MEBP/zZGVf82RlX/NkZW/zZGVv82RVj/NkVY/zZFWP82 Rlb/OUtV/zlMU/85TFP/OUxT/zlLVf85S1X/OUtV/zlLVf8zRVH/NkhU/zlLWf89T13/QFJg /0FTYf9CVGL/QlRi/zxOXP88Tlz/PE5c/zpMWv84Slj/N0lX/zZIVv83SVf/P1Ff/0BSYP9C VGL/Q1Vj/0NVY/9AUmD/PU9d/zxOXP8vQU//PU9b/0BSXv88Tlj/PVBX/0FUWv9FWF7/b4KG /3aJjf8/Ulb/OUxT/z5RWP8uQEr/MkRO/1Fjcf9OYG7/RVdj/0FTXf8mOEL/XnB6/4GTnf+n ucP/0OLu/+Dy/v/e8Pz/4/X//9Di7v8yRFD/UGJw/z9RX/9SZHL/NUdV/0JVZP9CVWT/Q1Zl /z5SXf84SlT/Rllg/1Znbv9NX2P/R1lb/0xeYP9WZWj/TVxf/zpJTv87SlH/P0xV/zE/SP9M XWf/OUtV/zpMVv9GWGL/QlNd/0BRW/9JWmT/P1Ba/0BRWf9MXWX/PkxV/09dZv+OnKX/3uz1 /9Ph6v/V5Ov/4Ovx/83Y3v9YZW3/MkFI/yIwOf81RlD/JzlF/yI0QP8qPEb/IzU//yg2P/9K WWD/X2xy/1JdYf96g4j/xMnM//7////6+vr/+fn5//j4+P/9/f3///////v7+/////////// /////////////////////////////////////////////////////////////f/8//v9+v/9 //7//v////z////7////4ubp/83R1P8OERb/AAEF/wwRF/8ECQ//AAQN/xAXH/8BBQ7/DBAc /zAzRP8oKz7/FRgr/wIFFv8BBBX/Cg0e/wcNHf8AAhL/GiAu/zpATv9UWmj/Q0lX/x4kMv8T GSX/Fx0p/xMaJP8fIyz/DhMZ/wMIDv8GCxH/Cg8V/wkOFP8KDxX/DxQa/wUKEP8HDBL/CxAW /w0SGP8OExn/DRIY/wsQFv8JDRb/Bg0X/wkRHP8OFiH/Exsm/xUdKP8UHCf/Ehol/xAYI/8g KDP/ICgz/yEpNP8iKjX/Iio1/yMrNv8kLDf/JCw3/ykvO/8pLzv/KS87/yowPP8qMD7/KjA+ /ykxPv8qMj//MThI/ys0Q/8nMEH/ND1O/x8rO/8oNET/MT1N/ys3Rf8UIC7/MkBL/yQyPf8n NUD/PkxX/0hWYf9odoH/iZei/6m3wv+2xM//xtTf/8za5f/K2OP/xdPe/8PR3P/E0t3/yNTg /8nV4f/I1OD/xtLe/8XR3f/F0d3/yNTg/8vX4/+4xND/vMjU/666xv+UoKz/b3uH/09bZ/8/ S1f/NEJL/zhGT/8hMjn/NUZN/0VWXf85SlH/M0RL/zxNVP8uP0b/NEVM/yw9RP8wQUj/OktS /zdIT/8rPEP/JDU8/yQ1PP8mN0H/OUpU/z1NWv8lNUL/PU1a/z5OW/82RlX/NUVU/zZGVf82 RlX/NkZW/zZGVv82RVj/NkVY/zZFWP82Rlb/OUtV/zlMU/85TFP/OUxT/zlLVf85S1X/OUtV /zlLVf8xQ0//NEZS/zdJV/86TFr/OUtZ/zZIVv8yRFL/MEJQ/zhKWP89T13/QFJg/z5QXv85 S1n/N0lX/zpMWv8/UV//PlBe/z9RX/9BU2H/QlRi/0FTYf8/UV//PE5c/zpMWv9CVGL/QlRg /0haZv9Za3X/YnV8/1ptc/84S1H/bH+D/22AhP9BVFj/QlVc/z1QV/9MXmj/SFpk/0ZYZv9E VmL/S11n/1BibP8nOUP/Fykz/wETHf8ADhj/JzlF/zJEUP9neYX/WWt3/yw+Sv8kNkL/QFJg /1Jkcv8zRVP/Wmx6/05hb/9JXGr/QFNh/1Jmcf96jZT/mq2z/6S2uv+arK7/g5WX/2Z4ev9Y Z2r/UWBj/0dWXf9MW2L/U2Bp/0hWYf9LW2j/O01Z/1Fjb/87TVf/SFlj/0tcZv9FVmD/PE1X /zlKUv8/UFj/RlRd/11rdP/O3OX/2+rx/9jn7v/T4Oj/5fL4/6y5v/83Rk3/Jjc//yY3Qf8o OUP/LD5K/yI0QP8nOUP/JzhC/y48Rf9hbnb/UFth/05YWv+ZoaT/8vf6//7////x8fH//v7+ //39/f/6+vr///////v7+//5+fn///////////////////////////////////////////// /////////////////////P77//n7+P/3+fb/+/38/+/z9P/6/v//9vr9/1hcX/8ABQn/AAMJ /wsPGP8RGCD/DBMd/xAZIv8TGiT/Bgwa/woPIv8wNUn/Iic7/wYLHv8BBhn/AAMW/wAAEP9H TV3/X2Vz/0dNW/8rLzv/Gh4q/xsfK/8cICz/EBQg/wEFDv8AAAf/AAEG/wIFCv8HCg//BwoP /wYJDv8JDBH/DRAV/wYJDv8DBgv/CAsQ/xATGP8QExj/Cg0S/w0QFf8VGiD/EBch/xEZJP8S GiX/Ehol/xEZJP8RGST/Exsm/xQcJ/8PFyL/Fh4p/xggK/8TGyb/GCAr/yQsN/8qMj3/JS04 /ykvO/8rLzv/LDA8/y0xPf8tM0H/LjRC/y81Q/8uNkP/Jy4+/ygvP/8oMUL/KTJD/yozRP8r NEX/LDVG/ys3Rf8pNUP/KTVB/yg0QP8mMj7/JDA8/yMvO/8iLjr/IS05/yYyPv80QEz/T1tn /297h/+Rnan/rrrG/8TQ3P/P2+f/xdHd/8bS3v/I1OD/ytbi/8vX4//K1uL/ytbi/8nV4f/M 2OT/ytbi/8rW4v/N2eX/0Nzo/8rW4v+8yNT/r73G/4aUnf9oeYD/Rlde/zNES/8zREv/OElQ /zhJUP81Rk3/OUpR/zNES/8vQEf/MkNK/zlKUf88TVT/OUpR/zVGTf88SlX/QE5Z/0NRXP8+ TFf/NkRP/zJAS/82RFH/O0lW/y06Sv8vPEz/M0BQ/zdEVP86R1j/O0hZ/zxJWv86Sln/O01X /ztOVf87TlX/O05V/zpMVv86TFb/OkxW/zpMVv85S1f/OUtX/zlLWf85S1n/Okxa/zpMWv86 TFr/O01b/z5QXv8+UF7/PlBe/z1PXf89T13/PU9d/zxOXP88Tlz/PU9d/z5QXv8+UF7/P1Ff /0BSYP9BU2H/QVNh/0JUYv9EVmT/Rlhk/4+hrf/Q4uz/xNfe/7DDyf+luL7/hJeb/3yPk/9c b3P/TWBn/zxPVv9IWmT/PU9Z/0RWZP9VZ3P/SFti/0JVXP9RZGv/QVRb/z1QV/9oe4L/PU9Z /yc5Q/8VJzP/ESMv/yM1Q/9EVmT/T2Bw/0RVZf9CU2P/TmBu/0VXZf9Yanb/Rlhk/3KEjv/C 09v/ytvi/8XX2//L3d//zdzf/8XV1f/G1Nf/qri7/6Gutv9mc3v/S1hh/01bZv9EVmL/QlZh /z9TXv89UVz/PU9b/z5QXP9CU13/Q1Re/0dVXv9EUlv/SVZe/6Cttf/f7PT/5fL6/9rn7//b 6O7/3uvz/0RTWv9DUVr/KjtD/yk6RP8oOkb/LD5K/yk7R/8oOUP/LD1H/1Zkbf9XZGr/VWBk /2lzdf/d5ej/8/f6//v8/v/8/Pz//Pz8//39/f/9/f3//f39//7+/v/+/v7///////////// /////////////////////////////////////////////////////P77//z++//+//3//v/9 //7////3+/z/0dXY/x0iJv8CBw3/CxIY/xgfJ/8SGyT/AAkS/wAHEv8QGCP/HSUy/wAEFv8d Ijb/P0RY/wAAE/8CBxr/REpa/2txgf8/RVP/MzlH/yYsOP8pLTn/KS04/xAUH/8XGyb/fICL //P3//+Mj5T/Oj1C/wAABf8AAAX/AwYL/wAABf8CBQr/GBsg/wAABf8LDhP/EhUa/w0QFf8K DRL/DhEW/xATGP8MDxb/EBch/w4WIf8OFCD/DRUg/w8VIf8PFyL/DhQg/wwUH/8QFiL/Fh4p /xkfK/8SGiX/Exkl/xcfKv8WHCj/DxUh/yUpNf8lKTX/Jio2/ycrN/8mLDj/Jy07/yguPP8p Lz3/KzJC/ywzQ/8tNET/LTZH/y43SP8vOEn/MDlK/zE6Sf8rN0P/KzdD/ys3Q/8qNkL/KTVB /yg0QP8oNED/KDRA/yIuOv8hLTn/Hio2/x4qNv8hLTn/JzM//y05Rf8yPkr/eoaS/4uXo/+l sb3/vsrW/87a5v/S3ur/ztrm/8rW4v/T3+v/0d3p/8/b5//Q3Oj/0d3p/8/b5//L1+P/x9Xe /9Xj7P/Q4ej/zd7l/8bX3v+1xs3/k6Sr/2l6gf9LXGP/PU5V/zdIT/8xQkn/MUJJ/zZHTv85 SlH/N0hP/zRFTP8wPkf/NkRN/zxKVf8/TVb/PEpV/zZET/8zQUz/MT9M/zxKV/88Slf/PElZ /zxJWf89Slr/Pktb/0BNXv8+Tl3/PU5Y/zxPVv87TlX/Ok1U/zlLVf84SlT/OEpU/zdJU/85 S1f/OUtX/zlLWf86TFr/Okxa/ztNW/87TVv/O01b/z5QXv8+UF7/PlBe/z1PXf89T13/PE5c /zxOXP88Tlz/PU9d/z5QXv8+UF7/P1Ff/0BSYP9AUmD/QVNh/0FTYf88Tlz/TV9r/6Cyvv/e 8Pr/4/b9/9Ll6//W6e//xtnd/8/i5v/a7fH/fZCX/z9SWf9BU13/OkxW/09hb/89T1v/PVBX /0RXXf8+UVj/P1JZ/2x/hv95jJP/PlBa/zxOWP8/UV3/OUtX/z5QXv9MXmz/Tl9v/0VWZv9D VGT/S1xs/05gbP80RlD/SFpk/6q9xP+6y9L/z+Hl/9Di5P/M3uD/zNzc/9Li4v/H1dj/1+Xo /9nm7v/Q3eX/M0BJ/0tZZP9EVmT/QVRi/z9SYP89UVz/PlBc/z9RXf9CU13/RFVf/0VTXP9W ZG3/Ul9n/8rX3//c6fH/2uft/+bx9//i7fP/nq20/zhJUP8+T1f/LT5I/yU3Q/8pO0f/LD5K /yY4RP8fMDr/PEpT/1Viav9eaW//VF1i/6ausP/n7O///P////v9/P/8/Pz//Pz8//39/f/9 /f3//v7+//7+/v/+/v7///////////////////////////////////////////////////// ////////////+/z3//3++f/9/fv//f/8//r8+//2+vv/z9PW/yYrL/8PFBr/DhUd/wsSHP8K Exz/DBQf/wQOGv8ABBD/AAEQ/x0mN/8RGCv/QEdZ/0ZNX/9bYnT/O0JS/zU7S/8jKTf/IiYy /yAkL/8PEx7/ERUe/1pdZv/Ex9D//P////z////4+f7/5+js/8vM0P+goaX/Zmdr/ykqLv8B Agb/AAAE/wUGCv8PEBT/EhMX/wkKDv8GBwv/Dg8T/xcYHP8XGh//EBQd/xQbJf8cICv/Fx4o /xMXIv8OFR//Fhol/xohK/8WGiX/GB8p/xsfKv8VHCb/GBwn/xsiLP8eIi3/Gh4p/x0hLP8f IS3/HyMu/yAkL/8hJTD/IiYy/yEnM/8iKDT/KjA+/ykxPv8qMj//KzJC/yw1RP8tNkX/LjdG /y43Rv8rN0P/LDhE/yw4RP8tOUX/LTlF/y46Rv8vO0f/LztH/ys3Q/8rN0P/KjZC/yk1Qf8o NED/JTE9/yMvO/8iLjr/ICw4/x0pNf8dKTX/KTVB/0RQXP9rd4P/kZ2p/6m1wf/F0d3/yNTg /8vX4//L1+P/y9fj/8vX4//O2ub/0N7n/9Ti6//N3uX/x9jf/8XW3f/I2eD/z+Dn/9fo7//c 7fT/t8jP/6e4v/+On6b/dIWM/1xtdP9HWF//NUZN/yo7Qv83Rk3/OEdO/zpIUf8/TlX/QlBZ /0FPWP88SlP/N0VQ/yw6Rf8wPkn/NUNQ/zlHVP86SFX/N0VS/zNAUP8uPkv/OUpU/zdKUf82 SVD/NklQ/zVHUf80RlD/M0VP/zNFT/86TFj/OkxY/zpMWv86TFr/O01b/ztNW/88Tlz/PE5c /z5QXv8+UF7/PU9d/z1PXf88Tlz/PE5c/zxOXP88Tlz/PU9d/z1PXf8+UF7/P1Ff/z9RX/9A UmD/QVNh/0FTYf89T13/JjhE/zhKVv9bbXf/hJee/6Czuf/D1tz/yt3h/9ns8P/B1Nj/TWBn /zRHTv9PYWv/RFZg/0haaP9VZ3P/hpmf/46hpf97jpT/Znl//2+Cif9TZm3/PE5Y/0xeaP9a bHj/VWdz/09hb/9LXGz/SFlr/0ZXaf9IWWv/Sltr/0ZYZP87TVf/ipuj/6/Ax/+9z9P/xNbY /9/u8f/D09P/x9XW/9nn6P/V4+b/5PL1//f///+2wMn/HCYw/0dVYP9EVmT/P1Vi/z1TYP87 UV7/PlJd/0FTX/9EVV//Rldh/05cZf9MWmP/lqOr/9/s9P/W4ef/7Pf9/9zl7P/c5+3/UmFo /y9ASP83SFL/MEJM/yM1Qf8pO0f/KTtH/yI0QP8oOUP/TFpj/1lmbv9daGz/b3l7/+Do6v/z +fn//P////v9/P/8/Pz//f39//39/f/+/v7//v7+//7+/v/+/v7///////////////////// /////////////////////////////////////////////P34////+/////3/9vb0//P19P/5 /f7/5+vu/2Vqbv8ABw3/BQ4V/wAEDf8AAgz/AAIO/wACDv8CDhz/ICw8/0JLXP9cZXb/VVxu /zA3R/8oLz//KzNA/yIoNv8dIy//DREc/xMXIP9QVF3/t7zC//n8///5/P//7fD1//L1+v/0 9fn//v////7////5+v7//v////X2+v+2t7v/bG1x/w0OEv8FBgr/AwQI/wgJDf8JCg7/CAkN /w8QFP8bHCH/HB8o/w8THP8GChX/DBAZ/xoeKf8fIyz/Fhol/woOF/8jJzL/ISUu/x4iLf8a Hif/Gh4p/x4iK/8iJjH/Iycw/xseJ/8cHyj/HCAp/x0hKv8eIi3/HyMu/x4lL/8eJDD/Iig0 /yIoNP8iKjf/Iys4/yMtOf8kLjr/JS49/yYwPP8pMz//KDRA/yk1Qf8qNkL/LDhE/y46Rv8v O0f/LztH/x8rN/8iLjr/JzM//yo2Qv8rN0P/KjZC/yczP/8lMT3/KzdD/ys3Q/8rN0P/KzdD /ys3Q/8qNkL/KjZC/yo2Qv8oNED/RFBc/215hf+Tn6v/rbnF/77K1v/K1uL/0d/o/8nX4P/O 3+b/0+Tr/9Lj6v/K2+L/xNXc/8LT2v/D1Nv/2Onw/9jp8P/Y6fD/1ebt/8zd5P++z9b/rr/G /6S1vP+CkZb/a3p//0xbYP82RUr/Lj1E/y8+Rf8yQUj/M0FK/z9NVv89S1T/OUdQ/zZET/81 Q07/NkRP/zhGU/86SFP/OUpS/zlMU/87TlX/PVBX/0BSXP9CVF7/RFZg/0VXYf86TFj/O01Z /ztNW/87TVv/PE5c/zxOXP88Tlz/PU9d/z1PXf89T13/PU9d/zxOXP88Tlz/PE5c/ztNW/87 TVv/PE5c/z1PXf89T13/PlBe/z9RX/9AUmD/QFJg/0FTYf9DVWP/MUNP/xstOf8TJS//CBsi /wseJP8ZLDL/L0JG/0lcYP8pPED/HjE4/zpNVP9HWWP/QlRe/0VXZf+ktsL/4PP5/9Hk6P/M 3+X/xtnf/8HU2/+twMf/qrzG/3eJk/9KXGj/TV9t/0laav9AUWH/QFFj/0hZa/9MXW//SFlp /01fa/9ZbHP/qbrB/7zO0v/J293/e42N/3GBgf+fr6//tcPE/8bU1f/h7/L/3evu//H7//82 QEn/LTdD/0NRXv9CVWP/P1Vj/z1TYf88Ul//P1Jg/0FVYP9FV2H/SFlj/0tZYv9ebHX/1+Ts /93q8P/Z5Or/8v3//97n7P+os7n/LTxD/zFCSv8sPkj/NEZQ/yU3Q/8mOET/IjRA/yEzP/9H WGL/VGJr/1tocP9gaW7/rbW4//T6+v/8////+vz7//39/f/9/f3//f39//7+/v/+/v7//v7+ //////////////////////////////////////////////////////////////////////// ///////7////+/////3//f37//v9/P/6/v//7PDz/4mOkv9gZ23/S1Rb/zE6Q/82QEr/UV1p /1Zkcf9OW2v/VmJy/z9IWf84QVL/LTZH/yYvPv8aITH/Ji47/yYsOP8NFB7/UFRd/52iqP/s 7/b//P////z////6/v//+/z///f4/P/09Pb///////////////////////7+///+/v//+/v9 /+Tk5v/T09X/s7O1/4GBg/9BQUP/Dg4Q/wAAAv8FBgr/DhEY/w0QF/8MDxj/EBMa/xUYIf8Z HCP/GBsk/xcaIf8SFR7/EhUc/xQXIP8YGyL/Gx4n/x0gJ/8gIyz/IiUs/xwfJv8dICf/HSAn /x8iKf8fIyz/ICQt/yElLv8hJTD/HiUv/x8mMP8fJzL/ICgz/yEpNP8iKjX/Iys4/yIsOP8j LTn/Iy05/yUvO/8mMDz/KDI+/ykzP/8rNUH/KzVB/zI8SP8vOUX/KzVB/ycxPf8mMDz/KDI+ /ys1Qf8tN0P/KTVB/yczP/8jLzv/IS05/yAsOP8iLjr/JDA8/yYyPv8pNUH/JDA8/xsnM/8U ICz/GiYy/zI+Sv9VYW3/bnyF/5Ohqv+ltr3/v9DX/9Hi6f/V5u3/0+Tr/9Pk6//V5u3/x9jf /8fY3//I2eD/yNng/8rb4v/N3uX/0eLp/9Tm6v/d7O//1+Xo/8za3f++zM//p7S6/4SRl/9c aW//QU5W/zRBSf80QUn/NUJK/zZDTP83RE3/OEVO/zhEUP84Rk//PE1V/zpNVP86TVT/OUxT /zdJU/82SFL/NkhS/zVHUf87TVn/PE5a/zxOXP88Tlz/PU9d/z1PXf89T13/PlBe/z1PXf89 T13/PE5c/zxOXP88Tlz/O01b/ztNW/87TVv/PE5c/zxOXP89T13/PlBe/z5QXv8/UV//QFJg /0BSYP8qPEr/QVNf/09hbf97jZf/d4qR/22Ahv87TlT/Kz5C/xUoLP8OISX/LUBH/0JVXP85 S1X/S11n/0RWZP9pe4f/sMPJ/83h4v/o+///5vn9/93w9v/a7fT/7////7nL1f80RlL/P1Ff /0JTY/89Tl7/QFFj/0pbbf9LXHD/QlNj/0FSXP+LnKP/ssPK/9bo7P/B0NP/l6en/1VlZf+Y qKf/prS1/7nHyP/k7/P/8fz//7fByv8XISr/Tlhk/0FPXP9BVGP/PVRi/z1TYf88Ul//QFNh /0NXYv9IWmT/S1xm/0VTXP+isLn/3uvz/+Pu9P/g6fD/5e7z/+bt8/9ZZGj/MkBJ/zhKVP8l N0P/NEZS/yg7Sf8jNkT/HDA7/yg6Rv9cbXf/UF5n/1FeZv9+h4z/5Ozv//b8/P/8////9Pb1 //39/f/9/f3//v7+//7+/v/+/v7///////////////////////////////////////////// ///////////////////////////////////////7////+/////3/+fn3//7////6/v//8PT3 /6uyuP9HTlb/SlNc/05YYv9MWGT/PUtY/yQyP/8fLDz/MD1N/yczQ/8bJDP/GyQz/yYwPP8q Mj//Fh4p/2Bncf+4v8f/+f7///v////6/f//9Pj7//T4+//6/v///v////z9//////////// ///////8/P7/9fX3//Ly9P/5+fv////////////9/f//9vb4////////////9fX3/66usP9q amz/AAAF/wAAB/8CAgr/AgUM/wQEDP8EBw7/CwsT/w4RGP8YGCD/FRgf/xwcJP8iJSz/JCQs /xodJP8YGCD/Fhkg/x0gJ/8dICX/HiEo/x8iKf8fJCr/ISYs/yElLv8iJi//ICcv/yEoMv8h KjP/Iis0/yMsNf8kLDf/JS04/yYuOf8gKjb/ICo2/yErN/8hKzf/Iiw4/yMtOf8jLTn/Iy05 /yQuOv8kLjr/JS87/ycxPf8qNED/LTdD/zA6Rv8yPEj/JzM//yo2Qv8tOUX/LjpG/yw4RP8n Mz//ICw4/xwoNP8xPUn/MT1J/y46Rv8pNUH/JTE9/yQwPP8oNED/KzlC/xspMv8hMjn/MEFI /0JTWv9cbXT/gZKZ/6i5wP/C09r/y9zj/9Dh6P/U5ez/1ebt/9Lj6v/Q4ej/0eLp/9Pl6f/X 5ej/0+Hi/9De3//Q3t//0uDj/9Xj5v/V4+b/1OHn/7fEyv+grbP/e4iO/1dkbP8+S1P/NUJK /zdETf86SFH/NkdP/zZJUP83SlH/OEtS/zlLVf87TVf/PE5Y/zxOWP88Tlr/PE5a/z1PXf89 T13/PlBe/z5QXv8+UF7/PlBe/zxOXP88Tlz/PE5c/zxOXP87TVv/O01b/zpMWv86TFr/O01b /zxOXP88Tlz/PU9d/z5QXv8/UV//P1Ff/0BSYP8+UF7/QVNf/0RWYv95i5X/kaSr/5irsf9c b3X/NUhM/0hbX/9FWFz/Ok1U/0NWXf9AUlz/T2Fr/0ZYZv8NHyn/DyIo/zhMTf9EV1v/YnV5 /5yvtf+nusD/ipym/05gav82SFb/QVNh/0hZaf9FVmb/Rldp/0pbbf9GV2v/O0xc/1Nkbv+n ub3/x9nd/8PV1/+7y8v/1+fn/7/Pzv+/z87/r72+/8/d3v/q9fn/7fj+/0VPWP9ASlT/RU9b /0VTYP9AU2L/PVRk/z1TYf89U2H/QVRi/0VZZP9KXGj/TV9p/2d1fv/N3OP/4+32/+Tv9f/X 4OX/6/T5/6qytf81QET/PkxV/zlLVf8kNkL/MkRQ/yo9S/8lOEb/ITVA/zlNWP9cbXf/TVtk /1NgaP+zvMH/+f////z////+/////P79//7+/v/+/v7//v7+//7+/v////////////////// /////////////////////////////////////////////////////////////////////v35 //r59f/5+ff/9/f1//7////1+fr/+////93k6v9sc3v/SVJb/zM9R/8vO0f/KDZD/yEuPv8i MkL/KzhI/xwoOP81QU//JzA//0NNWf+Qmqb/09vm//P6///2/f//8PX7//n+///8/////P// //z9///6/Pv//v////7///////////7////+///18/T/9fP0///+/////v////7///Lw8f// /v////7////+///6+Pn//Pr7//v5+v/29vj/6eju/8bHzP+hoKb/kZKX/5GQlv+Bgof/XFth /zk6P/8QDxX/CAkO/woJD/8REhf/FhUb/xUWG/8cGyH/JSYr/xseI/8bHyL/HB8k/x0gJf8e ISb/HyIn/x8kKv8gJSv/HiUr/x4lLf8fJi7/ICcv/yEqMf8iKzT/Iyw1/yMrNv8iLDj/ISs3 /yErN/8gKjb/ICo2/x8pNf8eKDT/Hig0/x4oNP8hKzf/JjA8/yo0QP8rNUH/KTM//yUvO/8i LDj/KTVB/yg0QP8oNED/KDRA/yk1Qf8qNkL/KzdD/yw4RP8hLTn/IS05/yIuOv8mMj7/KjZC /ys3Q/8pNUH/JTM8/yQyO/8kNTz/JTY9/yM0O/8gMTj/HS41/x4vNv8gMTj/Slti/2R1fP+K m6L/rL3E/8DR2P/K2+L/z+Dn/9Hj5//K2Nn/z93d/9Ti4v/W5OT/1ePk/9Ph4v/T4eL/1OLl /9Hf4v/W5Of/3Ort/9rn7f/M2d//tcLI/52qsv+Mm6L/Rldf/0VYX/9EV17/Q1Zd/0JUXv9B U13/QFJc/0BSXP89T1v/PU9b/z1PXf8+UF7/PlBe/z9RX/8/UV//P1Ff/zxOXP88Tlz/PE5c /ztNW/87TVv/Okxa/zpMWv86TFr/O01b/ztNW/88Tlz/PU9d/z5QXv8+UF7/P1Ff/z9RX/9D VWP/PE5a/zlLV/82SFL/N0pR/zxPVf9CVVv/PlFV/0FUWP9EV1v/Rllg/0hbYv9GWGL/PlBa /0haaP89T1n/QVRa/zlNTv8VKCz/Bxoe/wIVG/8CFRv/Bhgi/xAiLP9DVWP/SVtp/01ebv9L XG7/SVpu/0dYbP9BUWj/Oktd/5eosP+svsL/xNba/7vNz//P39//vs7O/9Xj4//U4uL/x9XW /+Ty8//v+v7/oayy/w8ZIv9LVV//OkJP/0ZSYP8+VGL/OlRj/zxTY/89VGL/QFZj/0ZaZf9M Xmr/T2Fr/6i2v//W5ez/6fP8/93o7v/b5On/4Ors/1hgY/8/Sk7/OEZP/zFDT/8pPUj/LEBL /yg7Sf8rPkz/MENR/1Bkb/9ZanT/UV9o/3+Mkv/g6uz/+f7///z////+///////9//7+/v/+ /v7//v7+//////////////////////////////////////////////////////////////// ////////////////////////////+Pf1//38+v////3////////////u7/H/+v3///n+//+O lZ3/YGly/0VPW/89SVX/LjpI/yUyQv8tOkv/MD1N/y44RP8TGyb/RE1W/+73///q8fn/9Pv/ //n+///7////7vH2//j8///7////9vf5//r8+//+/////v/9//r6+P/8/Pz//Pr7//v5+v/9 +/z///3+///+///9+/z/+vj5///+///8+vv/9vT1//r4+f/7+fr/9/X2//r4+f///v////7/ ///+///9/P///v3////+/////v///v3///z7///f3uP/u7q//42Mkf9hYGX/NjU6/xMSF/8G BQr/CAkN/xobH/8YHB//GR0g/xoeIf8cHyT/HSAl/x0iKP8dIij/GR4k/xgfJf8bICb/GiEn /xsiKv8cIyv/HSQs/x0mL/8lLzn/JC44/yMtOf8hKzX/ICo2/x4oMv8dJzP/HCYw/ykzP/8m MDr/Iiw4/x4oMv8cJjL/GyUv/xwmMv8dJzP/ICw4/yIuOv8kMDz/JzM//yk1Qf8pNUH/KTVB /yk1Qf8qNkL/JTE9/yEtOf8jLzv/KTVB/yo2Qv8lMT3/His0/yc1Pv8mNTz/JTQ7/yQzOv8i MTj/IC82/x8uNf8dKzT/Hiw1/x0rNP8cKjP/Hiw1/ys5Qv9GVF3/aXeA/4KRmP+mtLf/t8XG /87c3f/b6er/3Orr/9fl5v/U4uX/0+Hk/9fl6P/Y5un/2ebs/9vo7v/b6O7/2+ju/9rn7f/Z 5uz/2unw/83e5f+4ydD/na61/3+QmP9kdX3/UGFp/0RVXf8+T1n/P1Ba/z9QWv8/UFr/QFBd /0BRW/9AUF3/QFBd/z1NWv88Tlr/PExZ/ztNWf88TFn/OkxY/ztLWP86TFj/PExZ/ztNWf89 TVr/PU9b/z5OW/8+UFz/QFBd/z9RXf83SVf/L0JQ/0dZZf83S1b/RFZg/zVJUv9JXGP/Ok5V /0lcY/82SlH/VGZw/z1RWv9OYGz/SV1o/zhKWP9kdoL/hpmg/1ptc/9cb3b/dIeO/0FUW/8w Qkz/NUdT/zxOWv9JW2n/Sltr/0pbbf9KW23/SFlt/0RVaf9AUWX/Pk9f/56vt//U5ur/z+Hj /83f4f/X5un/ytra/8jW1//M2tv/1+Xm/93r7v/n9fj/SVZc/zdBSv9GUFr/Tlhi/0BOWf8+ VGH/OlRh/zxTYf8+VGL/Q1Zk/0haZv9OX2n/U2Fq/9Xi6//s9v//2eLp/97n7P/2////r7q8 /ztFR/9JV1r/JzhA/yY6Rf8vQ07/KDxH/yY4RP8xQ0//P09c/2FyfP9ebHX/WWZu/7bBxf/1 /f//9fr9//j8/f/7/fz/+fv6//7+/v/+/v7///////////////////////////////////// //////////////////////////////////////////////////////////////7////+//// /v///v7///79///8/f//+v3///n+///Ax8//SFFa/ztFUf8tOUX/JzNB/xYkMf8kMUH/Eh4q /x4jKf8AAQT/qq6x//X5/P/3+Pz//v////3+///5+vz//v////7////+//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////8 /P7//f3////////+/v//8vL0/9bW2P+xsbP/lpeZ/1RVWf8uMTb/CQwR/wIFCv8WGR7/Jyov /yQnLP8ZHCH/ICMo/xsgJP8YGyD/GR4i/x0iKP8gJSv/HyQq/xohJ/8hKzT/HSoy/xwpMv8b KDD/Gygx/x4rM/8gLTb/Ii83/yk2P/8fLDT/Gygx/x8sNP8eKzT/GCUt/xglLv8eKzT/Iy03 /yIsNv8hKzX/ICo0/yIsNv8lLzn/KDI8/yo0Pv8pMz3/KTM9/yo0Pv8qND7/KjQ+/ys1P/8r NT//KzU//yc0Pf8nND3/JzQ9/yc0Pf8oNT7/KDU+/yg1Pv8pNUH/JDA8/yQwPP8kMDz/JDA8 /yQwPv8kMD7/JDA+/yQwPP8oMjv/ND9F/0tWXP9qdXv/jpmf/7G8wv/N2N7/3Oft/9zn7f/a 5ev/2OLr/9Xf6P/T3eb/0tzl/9Hb5P/R3OL/1+Tq/9Pg5v/R3uT/1OHn/9nm7P/X5Or/z9zi /8bT2f+eq7H/jJmf/298gv9RXmT/PUpS/zRBR/81Qkr/N0RM/z5MVf88TVX/PkxV/ztMVP88 SlP/OktT/zxKU/87TFT/OUdQ/z1OVv9EUlv/QFFZ/zxKU/83SFD/PUtU/0BRW/8yRVP/NEpY /ztOXf89U2H/QFNi/z1TYf88T13/OE5b/zdKWP87UV7/RFdm/0NZZ/9EV2b/RVtp/05hcP9W aXj/X3KA/1Vodv9wg5H/UWRy/0pda/9EV2b/PE9e/0tebf9JXGv/SVxt/0daa/9FWGn/Q1Zn /0FUZf9AU2T/QFFh/32Olv+puL3/0eDl/9no7f/Q3+T/z97h/9jn6v/f7vH/4fDz//T///+l tLn/ITA1/zxJT/9CT1f/Qk9X/z9SWf87Vl//RGBr/zFMV/85T1r/VGRx/0JOWv9ZYW7/pKq2 /+vv+//t8fz/4OTt//H4/v/W4eX/Y3F0/zhISP8wQkT/LUFI/ytCSv8pPUb/IjU8/y0+Rv8z QEn/YGpz/1pjbP9eZW3/f4aM/+/0+P/6////+/////z////8////8/f2//7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////7////+/////v////3///79///8/f///P3///n+///V2eL/bXR+ /z5GUf87RVH/MTtH/xMfLf8HEyH/Higy/woOEf9UVFT/6urq///////4+Pj//Pz8//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////v7+//6+vr//v7+///////9/f3/+fn7 //Hy9v/m6e7/z9LX/6SnrP9tcHX/Nzo//xATGP8AAAX/DRAV/xEUGf8aHSL/JSgt/ysuM/8p LDH/HiEm/xMYHv8aIyr/FiMr/xgiK/8XJCz/GyUu/x0qMv8jLTb/IzA4/yErNP8fLDT/ICoz /xsoMP8eKDH/Ii83/yo0Pf8sNj//JjA6/ygyPP8qND7/KjQ+/ycxO/8hKzX/GiQu/xYgKv8l Lzn/JS85/yUvOf8mMDr/JjA6/ycxO/8nMTv/JzE7/ygyPP8oMjz/KDI8/ykzPf8pMz3/KTM9 /yo0QP8qNED/KDFA/ygxQP8oMUD/KDFA/ygxQv8oMUL/KDFC/ygxQP8fKTP/Hyky/yAqM/8i LDX/JjA5/yw2P/8xO0T/ND5H/3N9hv+Jk5z/q7W+/8zW3//g6vP/5O73/93n8P/W4On/3+rw /9zn6//a5en/2+bq/97p7f/g6+//3+ru/93o7P/d6Oz/3+ru/9/q7v/W4eX/w87S/6eytv+L lpr/eIWL/0dUXP9CUVj/PEtS/zpJUP86SVD/O0pR/zpJUP85SE//PEtS/0BPVv9DUln/RFNa /0JRWP9AT1b/QE9W/z9QWP8zRlT/NEpY/zpNXv87UV//PlFi/ztRX/87Tl//OE5c/0NWZ/9C WGb/RFdo/z1TYf86TV7/OE5c/0FUZf9IW2z/S15v/0VYaf9cb4D/R1pr/z9SY/9BVGX/N0pb /0hbbP9JXG3/SFts/0daa/9FWGn/Q1Zn/0FUZf9AU2T/QFJg/xQlLf8iMTb/PEtS/1lobf9v foX/hpWa/6m4v//I19z/ytng/5Wkqf9DUln/IzI3/0JRWP9JWF3/PUxT/0BTWf8+WWD/NVNb /z9aY/9EWGP/RVNe/1ZgbP9pbXn/zc/c//Pz///e4Oz/6u73/+rx9/+8x8v/Pk1Q/0BSUv8q P0D/LkVL/yxFTP8oPEP/M0ZN/yU0O/9LVV7/YWpx/1RbY/9cX2b/vL/E//z////3+/7/8PT1 //z////7////+v7///7///////////////////////////////////////////////////// //////////////////////////////////////////////////////79///+/f///v////3/ //7+///8/f///P3///n+///7////vMPN/1dgaf88RlD/O0VP/z9LV/8XIy//KjM8/1VZXP/B wcH///////j4+P/6+vr//Pz8//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //r6+v/39/f/+vr6//39/f/+/v7//f3///7////8/f//9/j9//7////+////+fr//9vc4f/A wcb/lJWa/29wdf85Oj//DxAV/wECB/8MDRL/ISIn/y4xOP8dJCz/GCMp/xUeJf8SHSP/FB0k /xciKP8cJSz/Hikv/xskK/8lMDb/KjM6/yEsMv8fKC//Ii0z/yEqMf8YISr/HiYx/x4mMf8d JTD/HiYx/x8nMv8hKTT/JCw3/yUtOP8iKjX/Iio1/yIqNf8jKzb/Iys2/yQsN/8kLDf/Iy03 /yYwOf8lMjr/JTI6/yUyOv8mMzz/JjM8/yYyPv8nMz//JzM//yczP/8nM0H/JzNB/yczQf8n M0H/JzND/yczQf8vO0f/LTpD/yk2P/8lMjv/JDE6/yMwOf8kMTr/JTI7/yc0Pf8gLTb/HCky /yUyO/9BTlf/bXqD/5qnsP+2w8v/zNfd/9Hc4v/W4ef/2eTq/9rl6//a5ev/3Oft/9/q8P/T 3uT/1N/l/9Xg5v/Y4+n/3Oft/+Dr8f/k7/X/5fL4/9Th6f+/ztX/orG4/4aVnP9ufYT/WGdu /0JRWP80Q0r/QlFY/z5NVP86SVD/OUhP/zxLUv9AT1b/QlFY/0FSWv9EVmL/P1Jg/zpLW/82 SVf/OElZ/zxPXf9EVWX/SFtp/z5PX/9EV2X/TV5u/05hb/9LXGz/RFdl/0FSYv8/UGD/PU5g /zxNX/9MXW//RFVn/zlKXP9EVWf/OUpc/0tcbv9IWWv/SFlr/0dYav9FVmj/RFVn/0NUZv9C U2X/QVJi/0tcZv87TFP/LT5G/yc4P/8fMDj/FCUs/xIjK/8XKC//AAkR/wUWHf8aKzP/SFlg /z9QWP9LXGP/QFFZ/0FUW/8+WWD/Mk9X/0liaf9IXGX/QU9a/1ljb/+Xnan/7PD8/+zu+v/k 5vL/4OTt//P8//9teHz/OEdK/zZISv8vREf/NExQ/ydARf8uQkn/OEtS/y08Q/9bZW7/YWpx /1BXX/96fYT/9vn+//7////4+f3/8fX2//b6+//8/////P////7///////////////////// //////////////////////////////////////////////////////////////////////// //////////////79///+/f////3///3+//7+/v/8/f///P3///r9///w9fv/+f///83U3P+K k5r/QUpT/zQ+R/85Q03/dH2E/87S1f//////9vb2/+zs7P/////////////////8/Pz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////8/Pz//v7+///////////////////////8/Pz/+Pj6//f4/P/4 +f7/+vv///3+///+/////v////7////9/v///v////3+///29/z/5OXq/8LDyP+PkJX/WVpf /zQ3PP8YHSP/Fh0l/xceJv8YHyf/GiEp/xwjK/8fJi7/ICcv/xYdJf8XHib/FBsj/xEYIP8X Hib/Iikx/yYtNf8jKjL/ISoz/yQsN/8pMTz/LDQ//ykxPP8iKjX/GiIt/xQcJ/8iKjX/Iio1 /yIqNf8iKjX/Iys2/yMrNv8jKzb/JC02/yMwOP8jMDj/IzA4/yQxOf8kMTr/JDE6/yUxPf8l MT3/KDRA/yg0QP8oNEL/KDRC/yg0Qv8oNEL/KDRE/yg0Qv8qNkL/KDU+/yUyO/8jMDn/IzA5 /yUyO/8nND3/KTY//yc0Pf8nND3/JzQ9/yUyO/8hLjf/HCky/xckLf8TICn/KDI7/0dSWP91 f4j/nqmv/7jCy//H0tj/0dvk/9bh5//g6vP/4Ovx/+Dq8//f6vD/3ujx/9vm7P/Y4uv/1+Hq /+Tx+f/e7fT/2+rx/93s8//d7PP/0+Lp/8HQ1/+ywcj/j56l/3WEi/9SYWj/OUhP/zNCSf85 SE//QlFY/0dVXv83R1T/OEpW/z5OXf9BU1//RVVk/0VXY/9GVmX/RVdj/0dXZv9HWWX/SFhn /0dZZf9HV2b/RVdj/0dXZv9IWmj/Pk9f/0FSZP9IWWv/SVps/zxNX/9KW23/P1Bi/09gcv9G V2n/Rldp/0VWaP9FVmj/RFVn/0NUZv9DVGb/QlNj/0JUXv9FWF//Q1Rc/zxPVv8+T1f/QFNa /zhJUf8oO0L/NUZO/0RXXv9FVl7/SFti/yo7Q/9CVVz/Q1Rc/zxQWf89Vl3/QFtk/0JZYf9E WGH/S1lk/1ljb//X3en/7vL+/+Tm8v/v8/7/5Ovz/9Ha4f8yPUH/P05R/y5AQv81Sk3/NU1R /yA3Pf80SE//LkFH/0taYf9ZZGr/W2Rr/2FmbP+9wMX//P////T1+f/5+v7//P////L29//3 +/z//P////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////7////+/////v///78//7+/P/8 /v3//P3///r+///7////+f////f+///4////7vf+/+Pu9P/p8/z/+P////z///////////// /////////////Pz8//X19f////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////+/v7///////////// //////////////////////////f4/P/+/////v////7////19vr/8PH1//n6/v/+/////v// //7////6+///+Pn9//n6/v/5+v7/9fb6//Hy9//V2N//vcLI/5WaoP9nbHL/PUJI/xwhJ/8I DRP/AAQK/x8kKv8kKS//KzA2/yswNv8eIyn/Exge/xgdI/8mKjP/HCMt/x4lL/8hKDL/JCs1 /ycuOP8oLzn/Jy44/ycuOP8kKzX/JSw2/yUsNv8lLDb/Ji03/yYtN/8mLTf/JS43/yEuNv8g LzT/IC80/yEwNf8hMDf/ITA3/yIwOf8iMDn/JTM8/yUzPP8lMz7/JTM+/yUzPv8lMz7/JTNA /yUzQP8xP0r/LjxH/yo4Q/8nNUD/JDI9/yQyPf8lMz7/JjQ//y07Rv8tO0b/LDpF/ys5RP8r OUT/KzlE/ys5RP8sOUL/JC44/yIsNf8cJjD/GCIr/x4oMv80Pkf/U11n/2p0ff+Yoqz/pa+4 /7rEzv/P2eL/3efx/+Pt9v/j7ff/4Orz/+Tx+f/f7PT/2+jw/93q8v/j8Pj/6PX9/+j1/f/l 8vr/4u/3/9zp8f/U4en/yNXd/7TByf+ToKj/bnuD/1Nhav9GVF//QFFb/zxKV/82R1H/N0VS /zdIUv89S1j/Pk9Z/z9NWv8+T1n/QE5b/0BRW/9DUV7/P1Ba/z5MWf85SVb/R1dn/0lZaf9K Wmr/TV1t/0BQYP9LW2v/QVFh/0tba/9FVWX/RVVl/0VVZf9FVWX/RVVl/0VVZf9EVGT/Q1Vj /zRGUv87T1j/P1Fb/zlNVv87TVf/QVVe/0JUXv87T1j/OUtV/zxQWf85S1X/QFRd/0VXYf9C Vl//OEpU/zpOV/9BWmH/SGNq/zlQWP9DVV//Tlxl/4SOmP/u9v//4+n1/+Lm8f/p7fj/+f// /3N+hP85Rkz/M0JH/ztNT/80SUz/MUlN/yM6QP8tQkf/MUJJ/19udf9WYWf/VVxk/4mOlP/1 +P3//P3///r7///4+f3//v////f4+v/3+/r//P////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////7////+/////v///76//7+/P/9/fv//P79//r+///2+vv/8/j7//v////5////+f// /+/5+//4////7/f6//7////29vb////////////09PT///////7+/v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////+/v7////////////8/Pz/9vb2//T09P/19fX/+Pj4//7////5+v7/8vP3 //T1+f/8/f///v////7////+////+Pn9//b3+//3+Pz//P3///7////+/////v////7////w 8fb/+Pv///7+///8////9fX9/9XY3/+2tr7/nqGo/2trc/8wMzr/AwML/wYJEP8oKDD/NDc+ /ygoMP8WGSD/HyMs/xsiKv8YHyn/Fh0l/xUcJv8WHSX/GB8p/xkgKP8kKzX/JCsz/yQrNf8l LDT/JSw2/yYtNf8mLTf/JS41/x8sMv8eLTL/Hi0y/x8uM/8fLjX/IC82/yAvNv8gLjf/IjA5 /yIwOf8iMDv/IjA7/yIwO/8iMDv/IjA7/yIwO/8jMTz/IjA7/yIwO/8iMDv/JTM+/yk3Qv8t O0b/MD5J/yc1QP8mND//JTM+/yQyPf8kMj3/JTM+/yY0P/8mND//LDhE/y85Q/8tN0P/KTM9 /yQuOv8iLDb/JC46/ycxO/8iLDj/KjQ+/zpEUP9TXWf/c32J/5agqv+0vsr/xc/Z/9vo8P/d 6vL/3uvz/97r8//c6fH/2ufv/9jl7f/W4+v/1uPr/9Xi6v/V4ur/2OXt/93q8v/g7fX/4O31 /97r8//L2OH/ucfQ/56qtv98ipP/X2t3/0lXYP89SVX/N0VO/0pWYv9GVF3/Q09b/0RSW/9J VWH/Slhh/0tXY/9IVmH/Sldn/0hYZ/9HV2f/R1dm/0FRYf9EVGP/P09f/0JSYf9DU2P/Q1Ni /0NTY/9EVGP/RFRk/0VVZP9FVWX/RlZl/0pcaP9HW2T/Sl5p/05ia/9HW2b/O09Y/zxQW/9F WWL/O09a/0ZaY/9FWWT/OU1W/0dbZv83S1T/NkpV/0ZdZf9HYGf/QVph/zxQWf9IWmT/WGZv /8rU3v/k7Pf/5ev3/+Xp9P/k6/X/2+Tr/zlESv9GU1n/L0FF/z5QVP8zSEv/LkNI/zBES/8m OT//R1hf/11qcP9aZWv/Ymlv/73CyP/+////9vf7//7////3+Pr//f7///z+/f/8/////f/+ //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////6////+v////r//v/5//7/+v/9/fv//P77 //r+/f/q7u3/+/////v////w+Pr/8vr8/+72+P/5////+P3///7////7+/v//f39///////v 7+////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////19fX//Pz8//////////////// ///////////////////+/////v////7///z7///7+v///v3////+/////v////7////+///8 +////Pv///79/////v//+vn+//b1+v///v///v////v6///4+f7/+Pf9//n6///8+////f7/ ///+///3+P3/5+bs/8TFyv+PjpT/UFFW/xsaIP8AAAf/Exge/xccIv8cICn/Iict/yYqM/8o LTP/KCw1/ygtM/8iJi//Iict/yImL/8jKC7/Iycw/yQpL/8kKDH/Iikv/x4sL/8dLC//HSwv /x0sL/8eLTL/Hi0y/x8uM/8fLjX/Hy41/x8uNf8fLTb/Hy02/x8tNv8fLTb/Hy02/x8tOP8e Lzn/HS06/xwsOf8cLDn/Hi47/yIyP/8mNkP/KDhF/yAwPf8kNEH/KTlG/y09Sv8tPUr/KTlG /yQ0Qf8iMD3/JTE//yUvO/8kLTz/JjA8/ykyQf8qNED/KDFA/yYwPP8oMUD/JC46/yApOP8e KDT/Hyg3/yQuOv8rNEP/LzlF/0RRWv9jcHj/j5yk/7XCyv/N2uL/2+jw/+bz+//t+v//4O31 /+Pw+P/m8/v/5fL6/+Lv9//g7fX/4e72/+Lv9//Z5u7/3ery/+Tu+P/i7/f/2uTu/8jV3f+3 wcv/qre//3qEjv9ndHz/UVtl/0BNVf8/SVP/QU5W/0hSXP9JVl//SFZj/0dVYv9HVGT/RFJf /0dUZP9CUF3/RVJi/0JQXf9DUGD/RFJf/0RRYf9FU2D/RlNj/0dVYv9IVWX/RlZj/zhKWP84 TFf/QVRi/0xga/9KXWv/P1Ne/zxPXf9CVmH/P1Jg/0VZZP9BVGL/NUlU/0hbaf9IXGf/P1Jg /y9DTv9IX2f/PFBX/z9SWf9PYGj/g5Ga/+v1///o8fr/6/T9/+jv+f/m7ff/foeQ/z5IUf8/ TFT/NkdO/zNES/81Sk//MEVK/zNITf8zRkz/Wmty/1Zjaf9aY2r/jZSa/+fs8v/8/f//+/z/ ///+///7+/3//P3///7////8/v3//v/9//////////////////////////////////////// ///////////////////////////////////////////////////////////////////////6 ////+v////r//v/5//7/+v/9/vn//P77//z++//2+vn//P////X5+P/7////+/////D5+P/0 +vr/+/////7/////////+vr6///////29vb////////////29vb///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////4+Pj//f39/////////////f39//z8/P///////////////////v////7////+//// /v////7///v6///19Pn//Pv///v6///8+/////7////+/////v//+fj9//Lx9v/8+////Pv/ //77///9/P///vv///38///9+v///Pv///v4///9/P///Pn///j3/f/8+f///v3///Pw9//h 4Ob/oaSr/4KHjf9TWF7/Jisx/wwRF/8JDhT/Exge/x4jKf8eIyn/HiMp/x4jKf8fJCr/HyQq /x8kKv8gJSv/HiUr/x8qLv8cKy7/HCsu/x0sL/8dLC//HSwx/x4tMv8eLTL/HCsy/xwrMv8c KzL/HCoz/xwqM/8cKjP/HCoz/xwqM/8hLzr/HS06/xoqN/8YKDX/GCg1/xkpNv8cLDn/HS06 /yExPv8hMT7/ITE+/yIyP/8jM0D/JTVC/yc3RP8qOEX/NUFP/y84R/8mLz7/JC08/ykyQf8r NEP/KTJB/yUuPf8lLj3/JzA//ykyQf8rNEP/KjNC/ygxQP8lLj3/Iy05/xwpMv8hLjb/JDE5 /yMwOP8pNj7/QU5W/2h1ff+HlJz/xNHZ/9Dd5f/c6fH/4e72/93q8v/Y5e3/2OXt/9nm7v/g 6vP/4Orz/97o8f/e6PH/3efw/97o8f/f6fL/4Orz/93n8P/X4er/zNbf/7/J0v+str//jpih /2x2f/9UXmf/SlZi/0ZUYf9JV2T/Q1Fe/09dav9FU2D/Tlxp/0dVYv9CUF3/Q1Fe/0RSX/9F U2D/RlRh/0hWY/9IVmP/R1dk/z5QXv9EV2X/RVhm/z9SYP8+UV//QVRi/zxPXf8xRFL/R1po /zxPXf88T13/PVBe/zlMWv8/UmD/SVxq/0hcZ/9GWGL/PE9W/z9QWP9SYGn/t8TN/9/s9f/3 ////7vf//+/4///d5u//OkRN/0hVXf9BUFf/LT5F/zBDSf80R03/NUpP/y9ESf9JXGL/YXB1 /1dkav9SW2D/ur/F//z////3+Pz//v////Ly9P/+/v7//v////7////19/T//v/9//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////6////+v////v////7////+/////v//v/7//7/+//+ //3//P/9//z//f/8/////P////v////8/////P////7///////////////////////////// ///////////////////////////////////////////////////////9/f3//f39//39/f/+ /v7//v7+//////////////////////////////////////////////////////////////// /////////////////////////////v7+//7+/v/+/v7//v7+//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////v////7////9/////v////3////+/////f////7////8//// /f////z////9/////P////3////8/////f//9/j9//r9///7/v//8PP4/9LV2v+mqa7/e36D /19iZ/8hJCn/Cw4T/wcKD/8cHyT/KSwx/yIlKv8gIyj/Jy8y/xIdH/8WJCX/FiQl/xAeH/8T ISL/IC4x/yg2Of8nNTj/IzA2/yIvNf8hLjT/IC01/yAtNf8hLjb/Ii83/yIwOf8hLzr/Gyk0 /xwqNf8iMDv/IC45/xknMv8bKTT/IzE8/yEvOv8gLjn/HSs2/xspNP8bKTT/Hiw3/yMxPP8n NUD/JjJA/ygxQP8oMUD/KTJB/ykyQf8qM0L/KjNC/yozQv8nMD//JzA//ycwP/8nMD//JzA/ /ycwP/8nMD//JzE9/ycxO/8nMTr/JzE6/ycxOv8nMTr/JzE6/ycxOv8nMTr/JzE6/zM9Rv9K VF3/anR9/5Cao/+1v8j/093m/+Tu9//i6/L/4+zz/+Ps8//i6/L/4Onw/97n7v/b5Ov/2uPq /+Lr8v/g6fD/3+jv/97n7v/d5u3/2eLp/9Pc4//O2OH/wMzY/6i0wP+FkZ3/aXWB/1hkcP9Q XGj/S1dj/0hUYP9FUV3/QU1Z/0BMWP9EUFz/S1dj/01ZZf9IVGD/QU9c/0FTYf9EV2X/RVhm /0BTYf86TVv/Ok1b/0FUYv9JXGr/RFdl/0NWZP9DVmT/QlVj/0JVY/9BVGL/QVRi/0FTX/9H WGD/SFlg/1JhaP9qeYD/0+Do/+77///e6PH/7vj///f///93gYr/TVdh/0FOV/80Qkv/QFFZ /zdKUf8zRk3/K0BF/zNITf9SZWn/WWht/1VgZv+AiY7/8/j+//z////8/f///f3///39///+ /v7//v7+/////f////3////9//////////////////////////////////////////////// ///////////////////////////////////////////////////////////////7////+/// //v////7////+/////v//v/7//7/+//+//3//v/9//7//f/8//3//v////z////+/////v// //////////////////////////////////////////////////////////////////////// ///////////////9/f3//f39//39/f/+/v7//v7+//////////////////////////////// /////////////////////////////////////////////////////////////v7+//7+/v/+ /v7//v7+//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////+/////f////3////9//// /f////3////9/////f////3////8/////P////z////8/////P////z////8/////f//+vv/ //n8///5/P//+fz///f6///1+P3/8vX6//Dz+P/i5er/zM/U/6irsP92eX7/Nzo//wcKD/8B BAn/Ehcb/xUfIf8fKiz/KTQ2/yUwMv8WISP/Dhkb/xUgJP8hLDD/ChUZ/xAbIf8ZJCr/ISwy /yMtNv8hKzT/HScw/xckLP8jMDn/IjA5/yAsOP8aKDH/Gycz/x4sNf8kMDz/JTM8/xsnM/8Y Ji//GiYy/x8tNv8nMz//JjQ9/x8rN/8XIy//JC46/yQuOv8kLTz/JS87/yUuPf8lLzv/Ji8+ /yYwPP8nMD//JzE9/ycwP/8nMT3/JzA//ycxPf8nMD//JzE9/ycxO/8nMTr/JzE6/ycxOv8n MTr/JzE6/ycxOv8nMTr/HScw/x0nMP8dJzD/ISs0/yYwOf8tN0D/ND5H/zlDTP93gIf/ipOa /6myuf/J0tn/4Onw/+rz+v/r9Pv/6vP6/+Hq8f/h6vH/4erx/97n7v/b5Ov/2eLp/9rj6v/a 5O3/5vD6/+Pv+//j7/v/4e35/9fj7//Bzdn/prK+/5Keqv9nc3//W2dz/0tXY/9CTlr/QExY /0JOWv9CTlr/QE5Z/z1PW/9AVF//Rlhm/0ZaZf9FV2X/QVVg/0FTYf9AVF//NUdV/zhMV/9A UmD/RFhj/0dZZ/9DV2L/QFJg/z1PWf9NW2T/RFNa/1BdZf/J1t7/7Pn//+Hu9v/s9v//3ujx /9Lc5f9danL/PktU/0FPWP85SlL/OUpS/y1AR/84S1L/MEVK/0hbX/9VZ2v/VmVo/1xna/+3 v8L/8vf7//7////9/f///f3///39/f/+/v7//v78/////f////3////9//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////9/////f////3////9/////f////3////9/////f////3////9 /////f/+//3////9//7//f////3////9//////////////////////////////////////// ///////////////////////////////////////////////9/f3//f39//39/f/+/v7//v7+ //////////////////////////////////////////////////////////////////////// /////////////////////v7+//7+/v/+/v7//v7+//////////////////////////////// ///+/////v////7////+/////v////7////+/////v////7////+/////v////7////+//// /v////7////+/////f////3////9/////f////3////9/////f////3////8/////P////z/ ///8/////P////z////8/////f///fz///v8///6+///+vv///v8///9/v///v////7////8 /f//+fr+//r7///+/////P3//+Tl6f+/wMT/oaWo/2Boav8pMzT/AAUG/wAICf8cJif/KzU2 /yYwMv8dJyn/KzU3/ykyN/8lLjP/ISov/x0mLf8bJCv/GiMq/xojLP8jLTb/JjM7/yQuOP8X JCz/GCIs/x4rM/8gKjT/FiMr/y03Qf8nNDz/Iy03/xwpMf8bJS//Gicv/yErNf8kLjj/ICo0 /yAqNP8gKjb/ISs1/yErN/8hKzX/Iiw4/yIsNv8mMDz/JjA6/yYwPP8mMDr/JjA8/yYwOv8m MDz/JjA6/ycwOf8nMDn/JzA5/ycwOf8nMDn/JzA5/ycwOf8nMDn/LTY//ys0Pf8oMTr/Ji84 /yUuN/8mLzj/JzA5/ygxOv8wOkP/KzU+/ygyO/8uOEH/RE5X/2Zwef+Ikpv/nqix/9Lc5f/d 5/D/6PL7/+r0/f/i7PX/2ePs/9bg6f/W4On/2ePt/9bg6v/U3uj/1uDq/9vl7//e6PL/3ujy /93n8f/l7/n/2OLs/8PN1/+qtL7/j5mj/3N9h/9aZG7/SFRg/0FSXP8/UVv/QVFe/0RWYP9K Wmf/S11n/0tbaP9IWmT/R1dk/0RWYP9CUl//QFJc/0NTYP9GWGL/TFxp/09gaP88SVH/UF1j /7fCyP/x/P//3+rw/+n0+v/a5+//9f///42ao/9GVF3/OEZP/z1LVP87TFb/OUpU/yk7Rf81 SE//PlFX/1ptcf9Za2//Tlxf/4GMkP/t9fj/9vv///7////9/f///vz///78/f///f7///78 /////f////v////9//////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////9 //////////3//////////f/////////9/////f////3////9/////f////3////9//////// //////////////////////////////////////////////////////////////////////// ///////9/f3//f39//39/f/+/v7//v7+//////////////////////////////////////// /////////////////////////////////////////////////////v7+//7+/v/+/v7//v7+ ///////////////////////////////////+/////v////7////+/////v////7////+//// /v////7////+/////v////7////+/////v////7////+/////f////3////9/////f////3/ ///9/////f////3////9/////f////3////9/////f////3////9/////v//+/r///z9///+ /////v////7////7/P//9fb6//Lz9//7/P///v////3+///5+v7//P3///7////+////+/z+ //v////w9vb/3OHk/7vAw/+IjZD/TFFU/xwhJf8FCg7/EBUZ/xYbH/8fJCr/Jisx/yktNv8n KzT/Iycw/x0kLP8YISj/GyYs/x0mL/8dKC7/JS43/ys2PP8rND3/JC81/yMsNf8iLTP/JC02 /yMuNP8kLTb/JjE3/ys0Pf8tN0D/Hyky/yAqM/8gKjT/ICoz/yErNf8hKzT/ISs1/yIsNf8k Ljj/JC43/yQuOP8kLjf/JC44/yQuN/8kLjj/JC43/yYvOP8mLzj/Ji84/yYvOP8mLzj/Ji84 /yYvOP8mLzj/JS43/yUuN/8kLTb/JC02/yQtNv8lLjf/Ji84/ycwOf8gKjP/Iiw1/yQuN/8m MDn/KTM8/yw2P/8uOEH/LzlC/yQuN/9BS1T/anR9/46Yof+ps7z/w83W/97o8f/x+///5e/5 /+Tu+P/j7ff/4uz2/+Hr9f/e6PL/2uTu/9fh6//d5/H/3+nz/+Ls9v/l7/n/5O74/9/p8//Y 4uz/093n/7G/yv+WpK//cH6J/1Jga/9EUl3/QlBb/0NRXP9DUVz/UV9q/09daP9LWWT/R1Vg /0NRXP9ATln/PkxX/z1LVP+CjZP/ydTY//f////v+v//5fD2/+Xw9v/1////x9bd/1FfaP9C UFn/QlBZ/zhGT/84SVP/P1Ba/y5ASv8uQUj/TmFn/15xdf9aaWz/UmBj/77Jy//5/////P// //z9///9/f///vz9//78/f///vz///78/////f////v////7//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////v////7////+/////v/////////////////////////////////////+//// /v////7////+/////v////7///////////////////////////////////////////////// ///////////////////////////////////////9/f3//f39//39/f/+/v7//v7+//////// //////////////////////////////////////////////////////////////////////// /////////////v7+//7+/v/+/v7//v7+///////////////////////////////////+//// /v////7////+/////v////7////+/////v////7////+/////v////7////+/////v////7/ ///+/////v////7////+/////v////7////+/////v////7////+/////v////7////+//// /v////7////+/////v/////////////////////////////////////////////w8PL///// ////////////+fn7//z8/v///////f7///v8/v/z9/b/7fHy//D09f/8/////P////P3+v/d 4eT/ub3A/5ebnv9iZWr/MTQ5/xMWHf8OERj/GBsi/yMmLf8pMDb/HSYr/xceJv8aIyj/HyYu /xwlKv8bIir/GyQp/yYtNf8fKC3/GyIq/xwlKv8kKzP/KDE2/ycuNv8iKzL/ISwy/yEsMv8i LDX/Ii0z/yIsNf8jLjT/Iy02/yMuNP8jLTb/Iy40/yMtNv8jLjT/Iy02/yMuNP8jLTb/Iy02 /yUuN/8lLjf/JS43/yUuN/8lLjf/JS43/yUuN/8lLjf/LjdA/y02P/8sNT7/KjM8/ygxOv8l Ljf/Iis0/yEqM/8nMTv/IzA5/x8sNf8cKTL/Gygx/xwpMv8eKzT/Hyw1/x0qM/8kMTr/KDU+ /yUyO/8hLjf/KDU+/zpHUP9NV2H/kZuk/6KrtP+6w8z/0drj/+Lr9P/q8/z/7fb//+32///e 5/D/3ebv/9zl7v/c5e7/3+jx/+Tt9v/s9f7/8Pr//+z2///l8vv/3erz/9Th6v/F0tv/q7jB /4uYof91gov/ZHF6/1Via/9DUFn/PUpT/05bZP9yf4j/nKmy/7rEzf/p8vn/5u/0//P8///r 9Pn/7Pf9//D7///N2uL/RlVc/zhGT/9BUlr/SFlj/z1OWP88TVf/P1Ba/zNDUP8zRE7/WWxw /1xwcf9QX2L/fIqN/+z2+P/5////+f3///3+///9/f///vz9///8/f///fz///78////+/// //v////7//////////////////////////////////////////////////////////////// /////////////////////////////////////////////v////7////+/////v/////+//// ///////////////////////////+/////v////7////+/////v////7///////////////// ///////////////////////////////////////////////////////////////////////9 /f3//f39//39/f/+/v7//v7+//////////////////////////////////////////////// /////////////////////////////////////////////v7+//7+/v/+/v7//v7+//////// ///////////////////////////+/////v////7////+/////v////7////+/////v////7/ ///+/////v////7////+/////v////7////+/////v////7////+/////v////7////+//// /v////7////+/////v////7////+/////v////7////+/////v/////////////+/v//+/v9 //r6/P/6+vz//Pz+//39//////////////v7/f/x8fP/+Pj6////////////9fX3//Pz8//+ //////////7////+/v///v////r5/v/t7vL/9fT5//r7/////v//9/j9/97d5f+2tr7/jo2V /3Nze/8wNTv/GiIl/xAVG/8VHSD/HyQq/x4mKf8jKC7/KDAz/xMYHv8XHyL/ISYs/yAoK/8f JCr/GiIl/x0iKP8eJSv/Iisw/yEsMv8hLDL/Ii0z/yItM/8iLTP/Iy40/yMuNP8iLTP/Ii0z /yItM/8iLTP/Ii0z/yItM/8iLTP/Ii0z/yQtNv8kLTb/JC02/yQtNv8kLTb/JC02/yQtNv8k LTb/Iis0/yQtNv8nMDn/KjM8/ys0Pf8rND3/KjM8/ykzPP8fLDX/Ii84/yc0Pf8qN0D/KTY/ /yYzPP8hLjf/His0/yg1Pv8pNj//JzQ9/yEuN/8bKDH/Hyw1/ys4Qf83RE3/HCUu/yYvOP84 QUr/Tldg/2pzfP+LlJ3/qrO8/77H0P/b5O3/4uv0/+rz/P/t9v//5/D5/9/o8f/Y4er/1d7n /+z1/v/m8Pn/4Or0/97o8f/h6/X/5e/4/+jy/P/p8/z/ytTe/8nT3P/J093/y9Xe/9Lc5v/c 5u//5/H7/+/4///f5uz/+f///+30+v/f6O3/8fz//7rHzf8xPkb/RlVc/zpLU/8+T1f/Rldh /0hZY/9DVF7/OElT/zdHVP9EVV//W25y/1psbv9WZWj/u8nM//j////6////8vb5//7////+ /P3//vz9///8+////fz///76////+/////v////7/////f////////////////////////// //////////////////////////////////////////////////////////////////////// /////v////7////+/////v/////+/////v////7////+/////v////7////+/////v////3/ ///9/////v////7///////////////////////////////////////////////////////// ///////////////////////////////9/f3//f39//39/f/+/v7//v7+//////////////// //////////////////////////////////////////////////////////////////////// /////v7+//7+/v/+/v7//v7+///////////////////////////////////+/////v////7/ ///+/////v////7////+/////v////7////+/////v////7////+/////v////7////+//// //3////9/////f////3////9/////f////3////9/////f////3////9/////f////3////9 /////f////3///7////+/////v////3+//78/f/9+/z//Pr7//v5+v/29PX//Pr7///9/v/8 +vv/+/n6//78/f///v////3+//37/P////////7////////9+/7/+/v9//37/v/9/f////7/ ///+///++///+/r///v4///7+v///vv///79///z9vv/1tve/7CzuP+IjZD/Y2Zr/zg9QP8R FBn/AAEE/xYZHv8aHyL/ISQp/yQpLP8lKC3/Iicq/yAjKP8eIyf/Hics/x0oLP8dKCz/Hikt /x4pLf8eKS3/Hyou/x8qLv8hLDD/ISww/yEsMP8hLDD/ISww/yEsMP8hLDD/ISwy/yQtNv8k LTb/JC02/yQtNv8kLTb/JC02/yQtNv8kLTb/Iis0/yQtNv8nMDn/KjM8/yozPP8pMjv/Ji84 /yMtNv8qN0D/KDZB/yY0P/8lMz7/IzE8/yMxPP8iMDv/IjA7/xQiLf8XJTD/GScy/xspNP8b KTT/HCo1/x4sN/8hLjf/JC02/ycuNv8mLTX/Iikx/x8mLv8iKTH/LTQ8/zY9Rf9OVV3/Z252 /4yTm/+vtr7/ytHZ/93k7P/s8/v/8/z//+Dp8P/k7fT/5/D5/+ny+f/o8fr/6fL5/+z1/v/v +P//6vP8/+ny+f/n8Pn/5u/2/+jx+v/r9Pv/7vf///D5///z+v//7PT3/97l6//t9vv/hpGV /z1KUP9JVl7/OEdO/z9QWP88TVX/QVNd/0dZY/8+UFz/NkhU/0RUYf9SY23/WGtv/1BiZP9/ jpH/6PP3//j////6////9Pj7//7////+/P3//vz9///8+////fz///76////+/////r////7 /////f////////////////////////////////////////////////////////////////// /////////////////////////////////////v////7////+/////v/////+/////v////7/ /////////v////7////+/////v////7////+/////v////7///////////////////////// ///////////////////////////////////////////////////////////////9/f3//f39 //39/f/+/v7//v7+//////////////////////////////////////////////////////// /////////////////////////////////////v7+//7+/v/+/v7//v7+//////////////// ///////////////////+/////v////7////+/////v////7////+/////v////7////+//// /v////7////+/////v////7////+//////3////9/////f////3////9/////f////3////9 /////f////3////9/////f////3////9/////f////3///7////+/////f7//Pr7//v5+v/+ /P3///7////+/////v////7////+/////f7///3+///+/////v////7////+///+/P3/+ff4 ///+/////v////7////+/////v///vz////9/////f////3////+/////v////7////+///+ /////P////7////8/////v////f7/P/c3eH/vMDB/5aXm/9XW1z/EhMX/wABAv8DBAj/Gh4f /yIjJ/8ZHSD/GyIo/xojKP8aIyj/GyQp/xskKf8bJCn/HCUq/xwlKv8hKi//ISov/yEqL/8h Ki//ISov/yEqL/8hKi//ISox/yMsNf8iLDX/Iyw1/yIsNf8jLDX/Iiw1/yMsNf8iLDX/JC02 /yUvOP8oMTr/JzE6/yYvOP8hKzT/HSYv/xkjLP8XJC3/GSUx/x0pNf8gLjn/JTE9/yY0P/8m ND//JzVA/yo4Q/8mND//IjA7/yAuOf8hLzr/IjA7/yIwO/8iLzj/Hicw/yUuNf8tNDz/LDU8 /ycuNv8jLDP/JSw0/ygxOP8oLzf/KDE4/ykwOP8qMzr/Nj1F/05XXv9udX3/hI2U/7zFzP/L 1tz/3unv/+r1+//q9fv/5/L4/+Xw9v/m8ff/6/b8/+r1+//o8/n/5/L4/+fy+P/n8vj/6PP5 /+rz+v/2/f//0djg/5ukrf9HUFn/QEpT/z5LU/83RU7/NkdP/ztMVP8+UFr/QlRe/z9RW/8z RVH/PE5a/1JkcP9WZ2//Wmls/0lXWP+wu73/9f////n////6/v///v////z8/v/9/f3//vz9 //79+////vz///78////+/////v////7/////f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /v///////////////////////////////////////////////////v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////7///////// /v/////////+//////////7//////////v/////////+//////////7///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//f39//39///9 /f///f3///39///9/f///f3///39///8/P7/+/38//z8/v/7/fz//Pz+//v9/P/8/P7/+/38 //f3+f/3+fj/8vL0/9ze3f+1tbf/foB//0xMTv8rLDD/Cg8V/wwTG/8SGSH/GSAo/x0kLP8f Ji7/HiUt/x0kLP8eJS3/HCMr/xUcJP8PFh7/GSAo/ygvN/8qMTn/Iikx/yAqM/8gLTX/Iy02 /yEuNv8iLDX/Hisz/x4oMf8bKDD/JC43/yEuNv8iLDX/Hisz/x0nMP8YJS3/FyEq/xUfKP8g KjT/ISs1/yMtN/8jMDn/JS85/yQxOv8lMjv/JjM8/x8tNv8fLTb/Hy02/x8tNv8dLjb/HS42 /x0uNv8fLTb/Iy02/yMtNv8kLTb/Iy02/yQtNv8jLTb/JC02/yMtNv8mLzj/JS84/yYvOP8l Lzj/Ji84/yUvOP8mLzj/JS84/x8sNP8uO0P/Sldf/298hP+Wo6v/u8jQ/9fk7P/m8/v/7Pn/ /+f0/P/n9Pz/7vv///L////h7vb/v8zU/6KvuP9JU1//RU5d/z9IV/83Q1H/Mz9N/zJATf8z QU7/MkJP/zxMWf8xQ0//N0lV/0FVYP8/U1z/TWRs/0RbY/9rfoT/V2Fj/3p+f//y9vf/9vr7 //7////+//////////Ly8v///////////////////////////////f////3////9//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/8/Pz//Pz8 //z8/P/8/Pz//Pz8//z8/P/8/Pz//Pz8//////////////////////////////////z8/P/5 +vz/xcjP/6Wpsv91eYL/REhR/yMnMP8WGiP/Fxsk/xwgKf8rLzj/Ky84/ywwOf8pLTb/IiYv /xsfKP8ZHSb/GB8n/xkjLP8TICj/FB4n/xkmLv8lLzj/JzQ8/yIsNf8ZJi7/GSMs/xkmLv8f KTL/IS42/yUvOP8kMTn/JS84/yUvOP8oMDv/ICgz/xgiLP8YIiz/Higy/yIsNv8fLDX/Gygx /x4rNP8dKzT/HSs0/x0rNP8bLDT/Gyw0/xssNP8dKzT/IS42/yMtNv8jLTb/Iy02/yMtNv8j LTb/Iy02/yMtNv8lLzj/JS84/yUvOP8lLzj/JS84/yUvOP8lLzj/IzA4/xopMP8cKzL/Hy41 /yMyOf8nNj3/KzpB/y49RP8wP0b/UWBn/19udf9peH//X251/0VUW/8vPkX/JjU8/yc1Pv8w PEz/LzpM/y45S/8vOkz/MT5P/zZDVP86Sln/PU1c/zdJVf81R1P/QVVg/0ZaZf86UVn/P1Ze /1hvd/9ZbHL/VVpd/7m5uf//////+fn5//b29v////////////n5+f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//f39//39/f/9/f3//f39 //39/f/9/f3//f39//39/f/8/Pz//Pz8//z8/P/8/Pz//Pz8//z8/P/8/Pz//Pz8//7+/v/8 /Pz/+vr6//n5+f/5+fn/+/v7//39/f/9/v//9vn+//v////7////+////+jt8/+/xMr/lJmf /3l+hP83PEL/GB0j/wEGDP8GCxH/Fxwi/yEmLP8oLTP/LDM5/xIbIv8THiT/Fh8m/xYhJ/8Y ISj/GiUr/x4nLv8gKzH/JC00/yUwNv8pMjn/KTQ6/ygxOP8jLjT/Hygv/xwlLv8fJzL/ICgz /yEpNP8gKDP/HScx/xwmMP8bJS//GSYv/x4rNP8eKzT/HSs0/x0rNP8dKzT/HSs0/x0rNP8d KzT/IS43/yEuN/8hLjf/IS43/yEuN/8hLjf/IS43/yEuN/8iLzj/Ii84/yIvOP8iLzj/Ii84 /yIvOP8iLzj/Ii84/yg3Pv8nNj3/JTQ7/yMyOf8hMDf/Hy41/x0sM/8cKzL/Gikw/yQzOv8r OkH/KDc+/yAvNv8cKzL/IzI5/yw6Q/8oNET/KDNF/yk0Rv8qNUf/LTpK/zI/T/80RFP/N0dW /zhKVv83SVX/QVVe/0NXYP89UVr/O1Ja/2Z9g/9EVlr/cnd6//X19f/7+/v//Pz8//Pz8//7 +/v//v7+//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/9/f3//f39//39/f/9 /f3//f39//39/f/9/f3//f39//v7+//9/f3//////////////////f39//f39//z9Pb/+f3/ //j9///6////+v////r////5/v//+P3///f8///z+Pz/5Ont/8nO0v+fpKj/Zmtv/y80OP8P FBj/BgsR/xYdI/8cIyv/JSw0/ywzO/8rMjr/Iyoy/xgfJ/8RGCD/HyYu/xsiKv8WHSX/FBsj /xgfJ/8hKDD/KzI6/zE4QP8gKTL/Iio1/yMrNv8jKzb/Iio1/yErNf8iLDb/JC44/yIsNv8g LTb/IC02/x8tNv8fLTb/Hy02/x8tNv8fLTb/IS43/yEuN/8hLjf/IS43/yEuN/8hLjf/IS43 /yEuN/8iLzj/Ii84/yIvOP8iLzj/Ii84/yIvOP8iLzj/Ii84/xYlLP8XJi3/GSgv/xsqMf8d LDP/IC82/yEwN/8iMTj/JDM6/x0sM/8XJi3/Gikw/yMyOf8pOD//KDc+/yQyO/8oNET/KDNF /yk0Rv8qNkb/KzhI/y47S/8wPU3/Lz9M/ztLWP8yRE7/MkRO/zhMVf9BVV7/R1ti/1xwd/9E Vlr/tLm8///////w8PD////////////7+/v/9/f3//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//n5+f/5+fn/+vr6 //v7+//8/Pz//v7+///////+/////P////r+///3+/7/9vr9//f7/v/6/v///P////z////1 +fz/8/f6//P3+v/6/v///P////v////a3uH/ub3A/5SZn/9iZ23/JCkv/wMIDv8GCxH/Fhsh /x8kKv8eIyn/Iygu/yMoLv8jKC7/Iict/yAlK/8cISf/GB0j/xYaI/8mLTf/HiUv/xgfKf8Y ISr/ICky/ycwOf8oMTr/JS84/yUvOP8jMDj/IzA4/yMwOP8jMDj/IzA4/yMwOP8jMDn/IC43 /yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8g Ljn/IC43/yEuNv8gLTX/IC01/yAtNf8fLDT/Hyw0/x4rM/8eKzP/KzhA/yg1Pf8lMjr/JDE5 /yQxOf8jMDj/IC01/x4rNP8jLDv/JS4//yYyQv8qNkb/LjpK/zA+S/8yQE3/MUFO/zNDUP8s PUf/JzhC/zFES/8/Uln/S15l/0VYX/9tfIH/7fL1//v7+//29vb////////////+/v7/9/f3 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////39/f/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7////////////////////////////////////////////+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//////////////////z8/P/5+fn/+fn5//r6+v/6/Pv//v////z////8 ////+//+//n9/v/3+/r/9vr7//b6+f/y9vf//P////z////5/fz/8/f4//n9/P/8////+v7/ //z////8////8PD4/+Dj6v/Ly9P/nJ+m/2Nja/82OUD/FhYe/xQXHv8XFx//GBsi/x4eJv8h JCv/KSkx/yotNP8SFh//Fx4m/x8mMP8iKTH/HiUv/xojKv8aIyz/HCUs/yQtNv8jLjT/Iy02 /yEuNP8hLjb/IS40/yEuNv8hLjb/IC43/yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8g Ljn/IC45/yAuOf8gLjn/IC45/yAuOf8gLjn/IC43/x8sNf8gLTX/IC01/yAtNf8gLTX/IS42 /yEuNv8hLjb/Gicv/xsoMP8dKjL/Hyw0/yIvN/8iLzf/Ii83/yEuN/8nMD//KTJD/yk1Rf8r N0X/KzdF/yo2RP8oNkP/JjQ//yY0P/8nOED/KzlC/zRFTf84SVH/QVJZ/0hZYP+quLv//P// //T09P///////Pz8/////////////v7+//39/f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////////////// ///////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//f39//4+Pj/+vr6//39/f// ///////////////+/////v////z//f/8////+//8//n9/P/4/fn/+Pz7//j9+f/8////+P35 //H19P/0+fX//P////z//f/8////8fX0//T1+f/5+v////7///7////6+f//9fb7//f2/P/4 +f7/19bc/7q7wP+OjZP/XV5j/zY1O/8cHSL/EhEX/w4OFv8fJCr/ICUr/yElLv8gJSv/HCAp /xceJP8VHCT/Exwh/x8oL/8fKC3/Hygv/x4pLf8eKS//Hikt/x4pL/8cKS//IC43/yAuOf8g Ljn/IC45/yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8gLjn/IC43 /yIvOP8iLzf/IS42/yEuNv8gLTX/Hyw0/x8sNP8eKzP/Ii83/x0qMv8ZJi7/Gicv/x4rM/8h Ljb/Hyw0/xwpMv8nMT3/KDFA/yozQv8qNED/JjI+/yIuOv8dKTX/Gicw/yMwOf8mND3/MD1G /ztKUf83Rk3/N0ZL/3B/hP/a5en/9vr7//f39///////+/v7/////////////v7+//7+/v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////39/f/9/f3//f39 //39/f/9/f3//f39//39/f/9/f3///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///// ///////////////////////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//////////////////v7+//6+vr//Pz8/////////////v/9//z//f/7//z/+v/7 //r/+//7//z//P/9//z//f/8//3//P/9//v//P/8//3//P/9//z//f/6//v//v/////+//// /v////3///z7///59v3/+Pf9//36/////v////3////+/////f////7///Dt9P/Qz9X/sq+2 /5ybof9eYWj/MTY8/wUKEP8AAwn/Fhsh/yovNf8kKS//Ehkf/xohJ/8ZIif/GSIn/xkiJ/8Z Iif/GCMn/xgjJ/8YIyn/IS43/yAuOf8gLjn/IC45/yAuOf8gLjn/IC45/yAuOf8fLTj/Hy04 /x8tOP8fLTj/Hy04/x8tOP8fLTj/Hy02/x4rM/8eKzP/Hisz/x4rM/8eKzP/Hyw0/x8sNP8f LDT/Gicv/xwpMf8cKTH/FyQs/xIfJ/8UISn/HSoy/yUyO/8VHyv/GSMv/x4oNP8jLTn/JDA8 /yMwOf8iLzj/IC02/yg1Pv8mMzv/MTtE/z5LUf89SE7/NEFH/5qnrf/t9vv/8fX2//v7+//2 9vb//Pz8////////////+fn5//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////v/9//7//f/+//3//v/9//7//f/+//3//v/9//7//f/+//3//v/9//7//f/+ //3//v/9//7//f/+//3//v////78///+/P////v///78////+////vz////7///+/P////z/ ///9/////P////3////8/////f////z////9///+////9Pf8/9/i5/+8v8T/jI+U/1VaXv8m Ky//Cg8T/wsQFP8PFxr/GCAj/yAqLP8kLjD/Iiwu/x4oKv8aJSn/FiMr/xMgKf8SHyj/FSIr /xwpMv8jMDn/KDU+/yo3QP8jMDn/KDU+/yUyO/8eKzT/IC02/yg1Pv8nND3/His0/yAqM/8j LTb/JC43/yIsNf8dJzD/HCYv/yAqM/8kLjf/JjA5/yUvOP8kLjf/Iiw1/yErNP8fKTL/Higx /x0nMP8hKzX/JC44/ycxO/8nMTv/JC44/yMtN/8mMDr/KjQ9/zQ+R/87Rkz/MjtC/y04Pv8o MTj/XGdr/83Y3P/5/////P3///39/f/9/f3//v7+//7+/v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////v/9//7//f/+//3//v/9//7//f/+ //3//v/9//7//f/+//3//v/9//7//f/+//3//v/9//7//f/+//3///////78////+/////v/ ///7////+/////v////7////+/////z////8/////P////z////8/////P////z////9///5 +P7/+/z///7////8/////P////X4/f/t8PX/5uvv/56jp/+AhYn/U1hc/ycvMv8PFxr/CxUX /xYgIv8hKi//GiUr/yAqM/8kLjf/Hyky/xYgKf8SHCX/FB4n/xkjLP8lLzj/ICoz/xgiK/8W ICn/Higx/yUvOP8jLTb/HCYv/ygyO/8jLTb/ICoz/yMtNv8pMzz/KjQ9/yQuN/8eKDH/JC43 /yMtNv8jLTb/Iiw1/yErNP8gKjP/Hyky/x8pMv8oMjz/HScx/xslL/8kLjj/JzE7/yIsNf8k Ljf/LTg+/yw1PP8sNTz/MDlA/yApLv8/Rkz/s7zB//n////v9Pj//P3///39/f/9/f3//v7+ //7+/v////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////9/////f////3////9/////f////3////9/////f////3////9/////f////3////9 /////f////3///////78////+/////v////7////+/////v////7////+/////z////8//// /P////z////8/////P////z////9///+/f///fz///v6///5+v7/+vv///v8///8/f///P// //z////7////+/////H2+f/N0tX/m6Ol/2tzdf9OVln/Hygt/xUeJf8OFx7/Ehsi/x0mLf8k LTT/ICkw/xghKP8ZIin/FB0k/xQdJP8dJi3/JS41/ycwN/8mLzb/Ji82/yYvOP8pMjv/KjM8 /ycwOf8iKzT/ISoz/yMsNf8nMDn/Hygx/yApMv8gKTL/ISoz/yMsNf8kLTb/JC02/yUuN/8e KDH/KjQ9/ycxOv8XISr/GCEq/ygxOP8qMzr/HSYt/zlASP8SGR//JSwy/0RMT/+EiY3/3OTn //v////7/////P3///39/f/9/f3//v7+//7+/v////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////f/////////9//////////3///// /////f/////////9//////////3//////////f/////////////9/v///P////z////8//// /P////z////8/////P////z////8/////P////z////8/////P////z////9/////v////7/ ///+///7+v//+Pf8//j5/f/5+v7/+/z///X2+v/2+v3/+/////v////7////+/////n+///0 /P7/3eLm/8rP0/+hpqr/Zmtv/y4zN/8OExf/CQ4S/xAVGf8sMTX/JCkt/x8kKP8fJCj/Fxwg /w0SFv8RFhr/GyIo/xwlLP8bJC3/Hicw/yUuN/8tNj//LDU+/yMsNf8aIyz/KDE6/ycwOf8l Ljf/Iyw1/yApMv8eJzD/HCUu/xskLf8tN0D/Hyky/xgiK/8hLDL/KzQ7/yozOv8kLTT/ICku /xsiKP83P0L/OT5C/2Vqbv/m6+//+////+vu8//6/v///P3///39/f/9/f3//v7+//7+/v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////9/v///f7///3+///9/v///f7///3+///9/v///f7///3+///9/v///f7///3+ ///9/v///f7///3+///9/v/08vX/9vT3//n3+v/7+/3//v7//////////////v////7////8 /////P////z////8////+/////v////7////+v7///b6/f/0+Pv/9vr9//H1+P/a3uH/s7e6 /5WZnP9AREf/HyMm/wYKDf8OEhX/ISUo/ygsL/8jJyr/HiMn/yUsNP8jLDX/Hygx/xYfKP8O FyD/Ehsk/x8oMf8rND3/HCUu/x0mL/8eJzD/ICky/yIrNP8kLTb/JS43/yYvOP8VICb/Iy40 /yo1O/8jLjT/HCUs/x8oLf8mLTP/KTA2/zc8Qv83PED/io2S//z////8////7vL1//7////+ /////f3///39/f/9/f3//v7+//7+/v////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////+/////v////7////+/////v////7/ ///+/////v////3+///9/v///f7///3+///9/v///f7///3+///9/v///v////7////+//// /v////////39///39/n/8/P1//7////+////+v7///f7/P/2+vv/9/v8//n////8////9vf5 //7//////////v////n5+//x8/L/9/f5//3//v/6+vz/8fPy/9ra3P+nqaj/Y2Nl/yYoJ/8J CQv/AAQH/xohKf8gKTL/JzA5/ycwOf8iKzT/ICky/yUuN/8rND3/Fh8o/xghKv8bJC3/Hygx /yMsNf8mLzj/KTI7/ys0Pf8lMDb/GyYs/xAbIf8PGiD/HCUq/ygxNv8qMTf/Iiot/1tgZP/Q 1dn/+f3///z////+////9/j8//7////+/////f39//39/f/9/f3//v7+//7+/v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////+//// /v////7////+/////v////7////+/////v////7////+/////v////7////+/////v////// //////////3////9/////f////3////9/////f////3//v78//7+/P/+/vz//v78//7+/P/+ /vz//v78//7+/P///v////7////+/////v////7////+/////////v7+//7////+/////v// //v9/P/4/Pv/+v79//z////8/////////////f/9+/z//v78///+//////3///7///r6+P// /v//+Pj2//Lw8f/4+Pb///7//////f/j4eL/wMHD/3R7gf9KU1z/HCUu/woTHP8UHSb/JC02 /yUuN/8fKDH/JzA5/yYvOP8kLTb/Iis0/x8oMf8dJi//GyQt/xojLP8eKS//ERwi/yIrMP8/ SE3/Nj9E/ygxNv9eZmn/sre7/+bp7v/8////9/j8//X2+v////////////j4+v/4+Pr//f39 //39/f/9/f3//v7+//7+/v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////v/////////+//////////7//////////v////// ///+//////////7//////////v////////////////3////9/////f////3////9/////f// //3//v78//7+/P/+/vz//v78//7+/P/+/vz//v78//7+/P/+/P3//fv8//37/P/9+/z//fv8 ///9/v////////////v9/P/8/v3//v////7////+/////P////7////9//7/+vr4///+/P// //3////9/////f////3//v37//79+//w7+3/+/r4///+/P/6+ff/+fj2/////f////3/+/v9 //v////4////5ez0/7e+xP94f4f/QEdN/x4lLf8RGB7/Fh0l/xgfJf8bIir/HyYs/yMqMv8n LjT/KjE5/ywzOf8lLDL/KjE3/yAoK/8mLjH/anJ1/8/U2P/7////+/////z////w8fP//v// //7////4+Pr//////////////////f39//39/f/9/f3//v7+//7+/v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//////////////////////////////////////////////////////// ///////////////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////// //////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///// /////////////v7+//7+/v/9/f3//f39//39/f/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v///v7+ //7+///+/v7//v7///7+/v/+/v///v7+//7+///+/v7//v7///7+/v/+/v///v7+//////// /////////////////////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v////////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+ /v7//f/+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7////+/////v////z9///3+Pz/8/T2//Dx9f/v 8PL/x8jM/6qrrf97fID/T1BS/zM0OP8rLC7/MjM3/zo7Pf9WV1n/d3h6/6qrrf/c3d//+/z+ //7////9/v//9fb4//3+///+/v7//v7///7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v////////////////////////////////////////////////////////// ///////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////////////////////// ///////////////////////////////////////////////////////////////+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v////////////////////////////////////////////7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//////////////////v7+//7+/v/9/f3//f39//39/f/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+/////////////////////////////////////////////v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////////////// //////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////// //////////z8/P/5+fn/9/f3//T09P/z8/P///////39/f/39/f/8vLy/+7u7v/t7e3/7u7u /+/v7//s7Oz/8fHx//n5+f/////////////////+/v7/+/v7//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////// ///////////////////////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//////////////////////////////////////////////////////////////// ///////////////////////+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v////////////////////////// //////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7///////////// /////v7+//7+/v/9/f3//f39//39/f/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//////////////// /////////////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v// //////////////////////////////////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//f39//z8/P/7+/v/+vr6//n5+f/5+fn/8/Pz //b29v/7+/v//////////////////v7+//z8/P////////////7+/v/9/f3//f39//7+/v// //////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v///////////////////////v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//////////////////v7+//7+/v/9/f3//f39//39/f/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//v7+//7+/v//Pz8 //z8/P/9/f3//f39//7+/v/+/v7/+fn5//n5+f/5+fn/+fn5//r6+v/7+/v//f39//39/f/0 9PT/9/f3//v7+////////////////////////f39//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//////////////////v7+ //7+/v/9/f3//f39//39/f/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//r6+v/7+/v//Pz8//39/f/+/v7/////////////////+vr6//39/f// //////////////////////////39/f////////////////////////////////////////// //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//f39//39/f/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//////////////////v7+//7+/v/9/f3//f39//39/f/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//z8/P/8/Pz//f39//7+/v// /////////////////////f39///////////////////////+/v7/+fn5//X19f/+/v7//f39 //v7+//6+vr/+/v7//z8/P////////////7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//f39//39/f/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//39/f/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9 /f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//f39//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//f39 //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//////////////////v7+//7+/v/9 /f3//f39//39/f/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//39/f/9/f3//f39//39/f/9/f3//f39 //39/f/9/f3//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/9/f3//f39//39/f/9 /f3//f39//39/f/9/f3//f39//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+/////////////////////////////////////////////f39//z8/P/8/Pz//Pz8 //39/f/////////////////4+Pj/+/v7///////////////////////7+/v/+Pj4//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+ //7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+ /v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/9/f3//f39 //39/f/9/f3/AA4BAAADAAAAAQEUAAABAQADAAAAAQC3AAABAgADAAAABAADFeYBAwADAAAA AQABAAABBgADAAAAAQACAAABEQAEAAAAAgADFfYBEgADAAAAAQABAAABFQADAAAAAQAEAAAB FgADAAAAAQB2AAABFwAEAAAAAgADFe4BHAADAAAAAQABAAABUgADAAAAAQABAAABUwADAAAA BAADFf6HcwAHAAAH2AADFgYAAAAAAAgACAAIAAgAAfzgAAEYUAAAAAgAAfzoAAEAAQABAAEA AAfYYXBwbAIgAABtbnRyUkdCIFhZWiAH2QACABkACwAaAAthY3NwQVBQTAAAAABhcHBsAAAA AAAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLWFwcGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtkZXNjAAABCAAAAG9kc2NtAAABeAAABZxjcHJ0AAAH FAAAADh3dHB0AAAHTAAAABRyWFlaAAAHYAAAABRnWFlaAAAHdAAAABRiWFlaAAAHiAAAABRy VFJDAAAHnAAAAA5jaGFkAAAHrAAAACxiVFJDAAAHnAAAAA5nVFJDAAAHnAAAAA5kZXNjAAAA AAAAABRHZW5lcmljIFJHQiBQcm9maWxlAAAAAAAAAAAAAAAUR2VuZXJpYyBSR0IgUHJvZmls ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbWx1 YwAAAAAAAAAfAAAADHNrU0sAAAAoAAABhGRhREsAAAAuAAABrGNhRVMAAAAkAAAB2nZpVk4A AAAkAAAB/nB0QlIAAAAmAAACInVrVUEAAAAqAAACSGZyRlUAAAAoAAACcmh1SFUAAAAoAAAC mnpoVFcAAAAWAAACwm5iTk8AAAAmAAAC2GNzQ1oAAAAiAAAC/mhlSUwAAAAeAAADIGl0SVQA AAAoAAADPnJvUk8AAAAkAAADZmRlREUAAAAsAAADimtvS1IAAAAWAAADtnN2U0UAAAAmAAAC 2HpoQ04AAAAWAAADzGphSlAAAAAaAAAD4mVsR1IAAAAiAAAD/HB0UE8AAAAmAAAEHm5sTkwA AAAoAAAERGVzRVMAAAAmAAAEHnRoVEgAAAAkAAAEbHRyVFIAAAAiAAAEkGZpRkkAAAAoAAAE smhySFIAAAAoAAAE2nBsUEwAAAAsAAAFAnJ1UlUAAAAiAAAFLmFyRUcAAAAmAAAFUGVuVVMA AAAmAAAFdgBWAWEAZQBvAGIAZQBjAG4A/QAgAFIARwBCACAAcAByAG8AZgBpAGwARwBlAG4A ZQByAGUAbAAgAFIARwBCAC0AYgBlAHMAawByAGkAdgBlAGwAcwBlAFAAZQByAGYAaQBsACAA UgBHAEIAIABnAGUAbgDoAHIAaQBjAEMepQB1ACAAaADsAG4AaAAgAFIARwBCACAAQwBoAHUA bgBnAFAAZQByAGYAaQBsACAAUgBHAEIAIABHAGUAbgDpAHIAaQBjAG8EFwQwBDMEMAQ7BEwE PQQ4BDkAIAQ/BEAEPgREBDAEOQQ7ACAAUgBHAEIAUAByAG8AZgBpAGwAIABnAOkAbgDpAHIA aQBxAHUAZQAgAFIAVgBCAMEAbAB0AGEAbADhAG4AbwBzACAAUgBHAEIAIABwAHIAbwBmAGkA bJAadSgAIABSAEcAQgAggnJfaWPPj/AARwBlAG4AZQByAGkAcwBrACAAUgBHAEIALQBwAHIA bwBmAGkAbABPAGIAZQBjAG4A/QAgAFIARwBCACAAcAByAG8AZgBpAGwF5AXoBdUF5AXZBdwA IABSAEcAQgAgBdsF3AXcBdkAUAByAG8AZgBpAGwAbwAgAFIARwBCACAAZwBlAG4AZQByAGkA YwBvAFAAcgBvAGYAaQBsACAAUgBHAEIAIABnAGUAbgBlAHIAaQBjAEEAbABsAGcAZQBtAGUA aQBuAGUAcwAgAFIARwBCAC0AUAByAG8AZgBpAGzHfLwYACAAUgBHAEIAINUEuFzTDMd8Zm6Q GgAgAFIARwBCACBjz4/wZYdO9k4AgiwAIABSAEcAQgAgMNcw7TDVMKEwpDDrA5MDtQO9A7kD ugPMACADwAPBA78DxgOvA7sAIABSAEcAQgBQAGUAcgBmAGkAbAAgAFIARwBCACAAZwBlAG4A 6QByAGkAYwBvAEEAbABnAGUAbQBlAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGUAbA5CDhsO Iw5EDh8OJQ5MACAAUgBHAEIAIA4XDjEOSA4nDkQOGwBHAGUAbgBlAGwAIABSAEcAQgAgAFAA cgBvAGYAaQBsAGkAWQBsAGUAaQBuAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGkAbABpAEcA ZQBuAGUAcgBpAQ0AawBpACAAUgBHAEIAIABwAHIAbwBmAGkAbABVAG4AaQB3AGUAcgBzAGEA bABuAHkAIABwAHIAbwBmAGkAbAAgAFIARwBCBB4EMQRJBDgEOQAgBD8EQAQ+BEQEOAQ7BEwA IABSAEcAQgZFBkQGQQAgBioGOQYxBkoGQQAgAFIARwBCACAGJwZEBjkGJwZFAEcAZQBuAGUA cgBpAGMAIABSAEcAQgAgAFAAcgBvAGYAaQBsAGV0ZXh0AAAAAENvcHlyaWdodCAyMDA3IEFw cGxlIEluYy4sIGFsbCByaWdodHMgcmVzZXJ2ZWQuAFhZWiAAAAAAAADzUgABAAAAARbPWFla IAAAAAAAAHRNAAA97gAAA9BYWVogAAAAAAAAWnUAAKxzAAAXNFhZWiAAAAAAAAAoGgAAFZ8A ALg2Y3VydgAAAAAAAAABAc0AAHNmMzIAAAAAAAEMQgAABd7///MmAAAHkgAA/ZH///ui///9 owAAA9wAAMBsUEsDBBQABgAIAAAAIQC0z1gZuQAAACQBAAAsAAAAcHB0L25vdGVzTWFzdGVy cy9fcmVscy9ub3Rlc01hc3RlcjEueG1sLnJlbHOMz8EKwjAMBuC74DuU3G23HURk7S4i7Crz AUqXdcWtLW0V9/YWdnHgwUsgCf8XUjfveSIvDNE4y6GkBRC0yvXGag737no4AYlJ2l5OziKH BSM0Yr+rbzjJlENxND6SrNjIYUzJnxmLasRZRuo82rwZXJhlym3QzEv1kBpZVRRHFr4NEBuT tD2H0PYlkG7x+I/thsEovDj1nNGmHydYylnMoAwaEwdK18laK5o9YKJmm9/EBwAA//8DAFBL AwQUAAYACAAAACEAk6p9mLkAAAAkAQAAMAAAAHBwdC9oYW5kb3V0TWFzdGVycy9fcmVscy9o YW5kb3V0TWFzdGVyMS54bWwucmVsc4zPwQrCMAwG4LvgO5TcbTcFEVm3iwi7ynyA0mZdcWtL W8W9vYVdHHjwEkjC/4VUzXsayQtDNM5yKGkBBK10yljN4d5ddycgMQmrxOgscpgxQlNvN9UN R5FyKA7GR5IVGzkMKfkzY1EOOIlInUebN70Lk0i5DZp5IR9CI9sXxZGFbwPqlUlaxSG0qgTS zR7/sV3fG4kXJ58T2vTjBEs5ixkUQWPiQOkyWeqBZg9YXbHVb/UHAAD//wMAUEsDBAoAAAAA AAAAIQDXx6PswCgAAMAoAAAXAAAAZG9jUHJvcHMvdGh1bWJuYWlsLmpwZWf/2P/gABBKRklG AAEBAABIAEgAAP/hAIBFeGlmAABNTQAqAAAACAAEARoABQAAAAEAAAA+ARsABQAAAAEAAABG ASgAAwAAAAEAAgAAh2kABAAAAAEAAABOAAAAAAAAAEgAAAABAAAASAAAAAEAA6ABAAMAAAAB AAEAAKACAAQAAAABAAABAKADAAQAAAABAAAAkAAAAAD/7QA4UGhvdG9zaG9wIDMuMAA4QklN BAQAAAAAAAA4QklNBCUAAAAAABDUHYzZjwCyBOmACZjs+EJ+/8AAEQgAkAEAAwEiAAIRAQMR Af/EAB8AAAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAAB fQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2 Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqi o6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5 +v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAEC dwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1 Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZ mqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5 +v/bAEMAAgICAgICAwICAwUDAwMFBgUFBQUGCAYGBgYGCAoICAgICAgKCgoKCgoKCgwMDAwM DA4ODg4ODw8PDw8PDw8PD//bAEMBAgICBAQEBwQEBxALCQsQEBAQEBAQEBAQEBAQEBAQEBAQ EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEP/dAAQAEP/aAAwDAQACEQMRAD8A/bn4 afEzw18UvDsfiDw7LgjCXFu5HnW8vdHA/wDHWHDDkdwPQ680+Fvws8N/Cjw6uh6Enmzy4e6u nAEtxIP4mx0A6Ko4UepyT6XQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQ AUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB//Q/fyvAP2oPGPinwF8Edf8UeC7p7LWbaSwjgli SKSQfaL2CBgizgxlmRyF3jAJBPrXv9ea/F7xB4Q8LfDvV9f8c6fHq2k2QikazkSN/tEwlT7P GqzER7zNs2FiAGwSRjNAHhOk/E74meCrjwf4P1nTL/V9W8Wz6pcSy+JbrT7GWwstMSBpGP8A ZcUsDqUdmQZDbuGYDleT0P8AbE1vXTLZ2XhC2nvp9Q0C1sCl/MlrcQeIWnSCbzZrON9qGDJZ I3R1OUY9/UtX+P3wWu7jTtd+yvrF7bwubWdbIv5UN1aLdTbJnG0IYhGJdhOCyhh1xgS+IPgD 8OvF8fhiPwJaaSvk2WoQ3dtp8GyS5EgNtHEkSmR5o2myuBuTcSAF+agZwMX7aerWfh+XXfEP ghLYT6bNd2MdtqDXJluLbVo9GljlxbqY4zcSB0dQ7GMHKbsLVrxH+2ZqnhXw7aanq3gSf+0N Q+321paLPIhutQ026iimhi82COQI1tKbhGeNWxG6MgK5rv2+JP7Lkmnvb/YLGSyktJbfZ/ZT NHJZ3RN7dIF8rDRgqZrhcYDDLDdWd4a+Kn7PUWn2GmXHhmHw/ZaDd3TafFJpylLX5vs8lyoi Rlg83zgpbILeZg5yaAOZvP2yLi50ybXfCvheC/0yDTtX8QCe51IWgudD0q5+y+db5hffPOwZ kjO1QoXL5cVm/Eb9qDxvb6NrniPw3oL2WheF/E2iaW80D/atS1FbtrSea3jsmhwjPBcbAfML b+F9R7VCfgL4w0HwzFD4SsdR0rSnu00+CbTI1GnDTkLTGOGRAUCsqJhByxWufuPi/wDB+z8P prniLw5FYz63O2tW9qY7a5lu7mztY7yG5doGdY5/LWPYZSrKygA42sQDM+J3xi8fXv7LVp8V /h+LPTda17+y/KZLkXCWkWo3cUHyyPAyvKokCsGiwjbjhtgDYQ/au1TRBdJqnhxLnT7Q6/p9 tc/2gr3txqHhi2lmujc2626CGKYwOEkXJGVLRqHUDv8Aw98VvgP4hto/h5a6XGn2q/AOkjTz JF9re4afeRGjRbt6/aGbPy5DnBzjDu/iD+z7YeNPED614TtbPXruVtG1S6exheWeW5keBLeZ 0DMy3ESLJ83ymOSPf1wAC58QfjB8QdK/Z6sviP8AYrTwvrGvXOlwpIJft8GmWuq3UMIupWeO JWaKKXeykbA/BLLknG1H4sa78JdH1bTP+Eysvihq8eqwWVrBcBbW9tzLaNdNDN/Z1vN577Ea RAluhVDlzhS1dAv7Q3we1Lw9Z6DqOmudJvbd4p7N7VZbaC2W3ldIpVwY23rAyLGu7OOmOa5X S/HP7KkvhyPw7D4TsbXwxBcNe20LaQvkPMiF2uo4FjY4EQZ2kZQQisD6EA4Gz/aQ8c+LvGHh vUNFuTpeieI5vAsy2LJFK0MOurftdxGUpubd5MY3cEbcrtya7X49fGD4jfC7x1qXhLSbwSye P9ItrfwgrwoRb68LpbSdM7fnHl3EVzh8gCN+3FeqeHNT+BuqW9vdeEfD1nIbHUdO0+BV09bd o5ISxtXiDov7uBJJXjZeFXft61Q8ZfF74a2nxSi8IeL/AA813feGcXlpqD26XH2e4liXBgGD IHYSpFlPmLOoxtO6gDwHx/8AtW+K9PsPFHhHQIoo7vSbOaSw12GQ3AuH0zUrXT7rzI5LWODe 5mORC8qxtlCQw41PFf7TPjPSbHx14f8ADlol3rGmyeL7iK71C7hto7Oz0ERIvkBbYiaQPOpS OQfdU75DkV2dt48/ZRurvWtUm8NWEU1zJIZZzpAd79JI4byeQFYizBQVkmVsFSu5hnBrU8Ye OP2YrrSfteveHrHWIpbrU7y2SbS1cXN5FEXuZozLHtJmC7fNJ2uwAJ4FAHH237VPiSDVNB8H QaRa6vdajp0cJv8A7TKu3Vv7GOqbbhFtvJjDBcFEmaQBg+wKQK57wX+1H44j0DTtX8UWUWpa zrGg+EJLe2juY4NON/4iuLmFJXl+z+ZApCK0oJkCnCICfmbrfFnxR+APgOTQPHl38P4W1LV4 b02dxDZWn2lZNJdbFYRISCGaNmEeDgRqVJAwKv6b4+/ZotdL1Dw7/wAIda6fpM8bWNxANLja C5S3eKZIUjjRvMRXvN4G0BWLEepAMDVf2wvElnZao1j4Jt7m88M6frl/rCnVCsCDw/dx21yt pKLdvP8AMEgaMlU5yr4INemfG7xZ4rOu/Cvw/wCFPE03hG18ZajdRXd3DFbSyiGLTp7pFH2q OWMfPGoJxnHFYS/E39mmBk8J6P4ftZ7WKyfTnSPTUjtYdPu5YPMhcsgHkyvKpZACGZW3AEc9 Zc+M/wBnv4xXOjeDtb0u28Q+Y4Nnb6hpjSQwyNDI8f8ArotsZkhRmTONydOuKAPn/wAP/tM+ PtNsILjUkbxfdaZa+Ko1Nqbe1t9YOi6pa2UF0AI2IZ0lJxC+0kMFRyUA7H/hrjWb3SNDk0Hw 1p95qupQ6/JdQz6lNYxWr+H/ACnlif7RZpMJXjlz5bxKUPUlcsPqq4+Gvw7u7CDSrnwxpktl bWklhFA1pCYo7OUq0kCpt2iNmRSUAwSoOMgVwmr/ALOfwg1rUPD9xe+HLI6d4bhvobbS/s0B 09jqDRNLI8JQgyAwqQwIPLZzmgD5w/4av8QWs3ifXtPs4tTtrxtFm0bS7t3t5ooLvQ11S4Uf Zre4llcclsrtQEsXVBXovh39qaTxH4n8L+ELfwyYdU8YR6NqGnxNdZ3aRqVlJd3N2SI8f6I0 MkLKOGYx/Mu/A9/1f4W/DXX2d9c8K6XfmSWGdjPZwybpYI/Jic7lOSkXyKey/L04rA0f4NeE 9F+IkPxGtjJ9o07Sho2l2QSGOz02yJRpEtkjjVh5jRrnczYA2rtXIoA9booooEFFFFABRRRQ AUUUUAf/0f38qtc2VneiNbyCOcQusqCRQ22RDlXGQcMD0I5FWaKAOYPgnwY0XkNoGnmPcW2/ ZYtu44ycbcZOBz7Cq2ufD7wN4lLtrug2V7JKkUTyPAnmNFBIsscZcDcYw6g7CdpxgjGRXYUU Acs3gfwU4cP4f09hKYS+bSE7jbDEOfl58scJ/d7YqaXwf4UmWRX0e0zKCGYQIrcsGPzAAg7l DZBzkA9QDXR0UAcn4S8C+E/Auk22ieFtOjsrS084xDLO6/aH3y/O5Z/nYAnJ5wPQYYnw+8BR qiR+G9MVYmldALOEBWn4lI+Xgvgbj/F3zXX0UAYFv4U8L2d4NQtNHs4LoYImS3jWQFd2PmCg 8b2xz/EfU0l74S8K6lcG71DRrK6naZbgyS28buZkUIsm5lJ3hVChuoAAzgCugooA5ObwD4Fu Cpn8OabIUQxrus4ThG5KjK/dOeR0pw8CeCBH5I8Pad5e6Ntv2SHG6LGw429V2jae2BjpXVUU AZVtoWiWbBrTT7eBlcSAxxIpDhSobgdQrEZ64JHQ1BqHhnw3q3mHVdJtLzziWfzoI5N5KGIl twOT5ZKc/wAJx04rcooA5RvAfgZxKreHdOYTiISA2kPziDHlBvl58vA2Z+7gYxSP4C8DSzNc yeHdOeZ5JZWc2kJYyTACRyduSzgAMerY5rrKKAMC48KeFruKGC70aymjt9/lq9vGyp5h3PtB XA3HlsdTyawdf+F3w+8TaZdaRq2g2rW14FWbyoxA7qrKwBki2PjKrxnnAzXe0UAchZ/D/wAC af5f2Lw7p8LRFWVltYtwZPutu25LDHUnPvWhYeE/C2lmJtM0eyszAxaMw28cexjuJK7VGD87 8j+83qc79FABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAH/9L9/KKK4f4i+PtH+Gfhabxbrscs tpBNbwlYfLDbrmVYUJMrxoFDOCxZgAMmgDuKK8Ig/aL+HU+hTa2Deq1vbpdPa/ZXe4WKSGOZ S4TciFlkAUO4LkME3YrWk+PvwkikEMmvqrmKObb9nuM+XKrOGI8vICqjF8/6vB37aAPYaK8R vPj34NtdJ0vXFtL+Wy1XVJtKSQwCERSQSmFpJvPaPy4yw+XdhjkDbnil079of4TX2nw6hPrJ 08SBi8d1BLG0IVUfMp2lUVhImxi21ywCFicUDse20V4i37RHwnt7vU7PUdXfT5NJa1WZbm3m icfbE3wnyynmLuwww6qfkc42qWr0jwz4x8NeMYbqfw1fLfR2UvkTMqsojlADGM7gPmAI3DqO hwaBHTUUUUAFFFFABRRRQAUUUUAFZesXcljp8lzE6oyleWUsOTjoK1K5bxnIYvD1w4DMQU4Q 4P3hTQHE6l451Wxi8yKeC4b+4sTBv1YD9a4bxR8ZPFfh/Z/ZejP4gJUsws4guznAyZ5IwSfb PvXG+J3+32Uts8V1kr8u1uhyMfrXzPD8OdNuory28TrfapMHGHmYsVVl4UY7Drj3rdJWIPcL v9rD4jWrFB8Ldbl90WzI/wDSusO4/bI+IdvzJ8KfEQ/3ba0f+V3Xyfrvwe+HK3k2NH3RhWZW YNuZlGcAZ5zx+deb6j8EvAHmsqaZIJGZl2gMMOMgZ54HynHtzUtrsVY+/NP/AG2fEnmbdS+F fioL/sWEH/yVXQP+2usQzJ8LvGBx6afbn/25r8urj4OeBoncxRvHsbaPkfccAknGeO2B79a9 f8IfCD4fwbV1ZWljAywMT9hyM5ppXEfoRpP7ZvgjULSC8vfDfijTY50V90uhzyqu4f3rcygj 3FexeD/jj8O/HUotvDuv273Z/wCXa4jltLj/AL9XCxsfwBr8/fCH7KWh63ZwalofieW1kuVW XYu9NhkG7aMHtnFemp+zP8UNIQHRfFRvgnIjuWMqn8JQwocQsfoapvmGcp+X/wBepovtO796 V2+wr5O8C+P/AIifDqeDQPi1pLx6U7COPUoQXhiJ4HmY3AL75wPSvrdWV1DoQysMgjkEGsmN IdRRRUjCiiigD//T/fyvMPjB4otfBngS68T3Wlwax9gntXjguZUgj83z0CSeZICFMbEOvGSQ AvJFen1wPxLv/Eum+Ep7nwrbm4uzNbJJsg+1SRW0kyLcSxwAgyvHEWZU7kdG+6QD5b0z4r/A 6G0W91T4fR2PkFFtWgtYHjkhmgDMyGTyWUqsewRsiuxCpGrMwWpZfjD8BtG1w6gngZVjntr+ V7uK0tnl3WShHjkRGPltJG5ASVlk6howAxHWy/E3436NbXb3HgWXX1aS3Nm6W7WsrIIrdpfO hUzCNi7ybSHbaykN0zV9PiF8cUtVEfgCKZnuDETM8kbFSbfMrKkRABM74weRC+eSKBmdB42+ Duo+ENSOjeBfOh8F2UeuR2U9lFEkRvE86F1I3hTL8zMwDfcZjnAzkj4j/BeO5srDU/BtjqWq hB5R0mO3vrRzNILFVgnlEBdGVFUuUES4CF9wAO3oXxC+Jq+IbxrH4VNp0d9PZPd3Llo5JUZY 4pMkR4d4V+6c7dg7HIrO8YeM/wBoHTtf8V2PhXw99stLNguluLA7PLFvKyruLASFpVjOULLj g+W3ykAyLT4ofs1z28lu3g5LeKA2iqsthbKWNxb/AGqDHznJIh2gE5LrgZ60eBv2gvBvhfT7 62g8KX1kLi4utQuFhmiupp7i4ijvppiXaP5SsrY3FThAFXoB6ZJL8drNvCdtcWljeTFdRutZ a3VVV1t5IvsUCyOhUTSRMytgKpYEqVUYORB8Vfi9/Zcur3Pw1kCxRL+7QymeaWQXIXZGYgwR TFEj7gCPNDY2DJAOhg/aI8IX2n6lqdlBLDb6Rqmn6ddyXjxW6RrfXX2bziQz7AmC5WQI2MZA zms3Vf2idHt7N30xdPkuI9VvNOkNzqKwW8UVqsrxzSypHKUNysX7hdmHLDDHvZ+GOoeKn8Ua lp+qfDy28NaZqjXN1LdQ5LTTo6BDMDGoJkVmOcnBB+tfQItrZc4iQZwT8o529Py7UASo29Ff +8Afzp1FFAgooooAKKKKACsHxNayXmjT28R2s23BPsQa3qzNXm+z2EkuAcFevTk04rUD4w+I 1n4qsYgum3qW7OrfO6ZAwRjkA4r5kGj/ABXG+VPG+nLE7FnGWLnA4GTEf5198eN/GVpoVotz d2RuonzGREm8/NgjgfSvn/xJ8d9C+HkCW+o+GL+OOfc6eXbiUHGAeU3Y/GulQdjPmR8a+J7D 4hTSXL2vi+ygw+CXIzw4w24RHJxkj/OfLLvSfimJXeDx1pUSlQVDSMSA+0MWxCeQCeO+O/Nf Xt9+2v8AD9JDHL4V1huP4dOkI/8AQa5G4/a4+Fs5OPB2r8+mkt/8RUKmyuY+V30v4rKjhPHW iZRF5LyDexAPQQ+vGPlxx1xS3em/HqzEt1a/FXQJI4gz+RHcSNJKF52KDAAWYcDnrX0jc/tK fDG4Tc3gzWwp9NKYf+yVgN8d/gxPIGn8Ia9nPbTmH5fJVezYuYw9C+IHxU0u0tpLH4v+GIP3 aHyjDdF0+UfKwFueV6H3r0vTfj58e12xQfEzSb7HQW2j3sxP4m3UfrXi2l+KPF+rykeHfCXi G5hkZjCU0RwDGSdmZG4PGOcV9FfDv4S/FrxjLG/iWzu/Dtg2NxuXiifHtEp35+opqkLmNzTv jp+0HeyJpk2vRag94REsDaTCnml+AoRndzn0KCv1E8PWt5ZaBptnqGz7VBbQpN5ahU8xUAba o4AznAHQV4n8OPhb4A+G7C+023N5qmMG7uDvkGeuwcBM+3J9a9ustUjvJvJXrgn8qznTfYcZ Lua1FFFYlhRRRQB//9T9/K5TxjH4sm0mOHwZNFb373VqsksyhwlqZl+0MqkgFxFu257469K6 uuU8beGbjxh4ZvfDtrq93oUt2oAvLFlS4iwQflLAjnGD7d6APALax/afaHTjPPZwz6a8DOu6 N4bpBaMrxuSfMJabBZjjB5TIqC6T9rC+0PVFJ06xumEqWyQ+U0xErHawkZtgaIYAJAyuTjcA D6Jqvwas9V0TxhoF1eC6tvFt7bXUhuUM7RiOG3hmwWbG9xCxRlCiNmBVfl547Tf2fdR0zxNF rcOtwGCHXzrCKbeTzUiy58pX87budX8p2K4MaR4A24IM89tJ/wBqBfFd/BCJluEtrlIzMgk0 5pEjXyCpJSPJbPO4HON2fmFdyIf2prWG8ubdtOmlvWilWCVkf7K4t4lZI3+QNG0+4vkZVNxT LFRVKf8AZr1SXxY3iWLxFHFGdWvtT8j7PI6sLxRujkZptzB2GJMMP3eUTYpIq5qn7PWt6j4U 8KeFk1+C1Xw/a6lA91Fbyrcq99G6RfZ3E2USEPypz5m1ckAFSANuo/2qTqz6hZjS/Ljh1KIw O6iFpWANi8YBLbAwwxfDkEjArU0bW/2imk1Ky1HTLSeWxtbFo5AggSa5lCPcxKXcq3lojKHQ lC8wGQI2rhIv2WPEEcV2j+KLaRrqxs7Nd1k4WA2siurxBZ1AaLb+7J65O7nmvtGgDx74aTfG aTVNTHxPt7KOyNvZtaG1ZcrOY/8ASUIBYsA/RiR6Bccn2GiigQUUUUAFFFFABRRRQAVXurS3 vYGtrpN8bYyMkdDntViihMDEPhzRSuz7MuPqf8ajHhfQx0tgPozf41v15741bx3FdWM3g10Z MP50UkavGzBk27mJDgYLZ288VftJdxcqOj/4RjRf+eB/77b/ABpp8LaKeDC3/fx/8a8mfxz8 ZvJuJU8DRKYSAEa6yXBZF4wPRmbjOAMdQa6yXxF8QU1vV9Ph8Pq9pBbmSyuGkG2SXKAI2MYH zMeAT8pzjjJ7SXcXIux2Y8O6OE8v7Pke7N/jTV8NaIvS2H/fTf415tc+JfijdeH9Tlj0Iadq NsbfyQv77fuciXAyc/KAwIU7d2CpKk1m/wDCYfGW1tZHbwel3I0x25nSPZCCq4YKW3MS24Ec ABs9BuPaS7j5F2PXn8PaQ42tbjHsSP61H/wjWj9oT/323+NeXat4k+LdrqOiXFpoSS20ts0t 9bRkNsfL/IJDj5lUL3GTnAbgDKi8Z/G1rpkPhJEt7h3ZJJGGYY1bhWRWyzFOeSOeB05ftpdx ezj2PZ/+Eb0f/nif++2/xq1aaPp9jN59tGVfBGdxPB+prToodWT0bBRXYKKKKzKCiiigD//V /fyszVtY07Q7VL3VJTDC80MAYIz/ALy4kWKMYQE8uwGeg6kgZNadZmrazpmhWqXur3C2sDzQ wK7ZwZbiRYol47s7BR7mgDgPFHxa8PeEtcOgapb3HngK25VTZtdR5ZJLAgSPuRePvK3bmkT4 yeB5dW0/RYric3GozJbput5Ywk0qu0aNvVcM6ozAcnb8xwvNReK/GfgnRPEo07xDpLS3JS2I ujbJIGPmnylQk+Y5jdi/yqdmSxxnNY8Pjn4FWMaW6vYWUcYt5lWSyaAKJiWgYB41xnJYHtkn jmgZ2UPxL8Jy32p6c1w6TaQt09xmGQoq2h/e4cLtZlBB2glsEcVnP8YvAEKzvcX0sKWhKztJ azqsJQqHEhKfLsZ0Vs/dLqD1FYN74++C89pqgu5Yo4Z4bj7XJ9injLxyny5j5giBYseGKkng n+EkNvfEHwdg8PPdQafBcadYXUVs3k2ZXyXmPk+cCyr8ihTmVSeEOCSAKANxvjP8Po7lLOe+ mhmeUwbJLS4QiUMUZCDHwVYAMO2VJ4Irc8MfEXwl4xuzZaBeNPMsC3JVopI/3bMUz86jkMME dR3ridGuPg7pXh+ePS7JJbTQZwJFezmknW7lYnZiSPe05YnKjLLkZAGKd4Y8cfB+Apd6BBBY XbwqpjhsmE4ics+D5KNkDYzvgkLjLYxQB7XRXnN38Wvh7ZO0dzq6qUiSY4ilb93IVVTkIepd eOvNRt8XPAMYYz6iYysksRxDK43Q5MmGRGU+Wo3PgnYCC2MigR6VRXGXXxB8IWOo3OlXmoCG 5tC4kVo5AMxx+c+1tu1tqYLbScZAPJArKj+LfgCRPMXUnCkEjdbXC7lWMSsygxjcqRssjEZC oQxwpzQB6RRXlsnxq+GMSB5NcjAZHcDypSdsbMpOAmeqtj12kjIBrZ1X4keDNEkjh1G/KPMk ToEgmk3edzGo2I2XYAkJ97aC2MAmgDuaK4/w1478MeLJZLfRbvzZ4jLujKkNsicJv9NrZBQ5 5B9QwHYUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB/9b9/Kq3d01qsbLBJP5k iR4jAJUOcb2yR8q9T3x0Bq1RQB4l4w1bw1beJbka34Pk1YxokbXMNuZ5Cu1WBKlQMDcVUhy2 QwAHQ87NrHw7uLue3k+Hdzctcqpb/iXI6yRpH5a5LYUEKxXaT0zznIr03W/BWq6jqVzqemeI 7vTJLp49yxgOixRptKIrcKWOWJ/TODVaDwX4rjNxJN4wupXlieJB5KKiZXCttzncDyTkEnOM cYBnMxXPg3xdZ6kn/CDys1kssmy/tEgWWVSzlUPzsSzbjkKeuejDMaeItDSzvNJfwJcLNDA8 zW62qtbSiCQhVSTA3El2ZQUzyeBkZ6xPBXiSO90q8/4Sy7c2IAuFaNSt0PNMjb1BAXKnYMDg DjvWc3w+8XNcK3/CdagIADujEUWSxOc7+oHTj29zkEclF4x8Gx6Zd6NJ4E1FNMmZXaOOw8wT FQP3jKOSQQPmG7sSeRTYNX+GT3kdrc+B5bW6aGWWJJLGNSyWoZyEGc9QQRjnI3cMCe10fwH4 t069Fxd+Nb29gUSYhaJAN7hsMWJZjtLA4zjgAALxVS6+H/jeSGZrfxvdJcY/dfuVEanvu+Ys QeB97PGfvZJAOHi1X4Y3UEgtvh7dS28QeIkaeuAPM2yLgE87l5A57HAres9X8AOLy6XwPdW5 FrPcEtpyDzUT926rtJ+aQOQBxuXk8Yrak+HvjaRZv+K9vVkdgUK28QCLjBGMnOfXt2rQvPAf iC/0yxsbnxRcNPZS3D/aBHseQTBggYI6jdHnKn26UAcLNqXgrUVvtZbwHf3txfXtpJOLq1US O00RCyLvY8IiAMvABODznDtNv/hxqGstZjwRf+bqckW6SewzEoiiEaDJJCKqRBSoA7gg/Njv dS8GeKr/AErT9Ph8XXNnNaM7SzxRKGuN2Cu/LEjaQeAQCDjHSu60u1u7Kwgtb25+1zRKFaXa VL47kFmOfxoA8R0+X4f3yIZfAs1vHfSXccebJSzpHCs8jyBfuhySkfJyRgYBqtD418FXnkal ceAtQWa18u1jP9no2xUP7sR8/dUdCBgDocEZ+h6KAPnXSPiB4L0TVNSl8O+FdTjvWWO3mEdq qxR+QzMsRKsQmHldsYyS+f4lz6Jq3xHtNK1KTTF0bUrxlj8xJbe38yGQEIVw4PcuBkjjBPQZ r0UKq52gDJycdzS0AeUQfFrTbh7mEaPqMc1kIHmikgAkWK4bAcKrMSAOTwOAe4IqrN8YbWOW 2iXw3rJM4DsTaYCRkZBOGPJ4+XqOc4wa9gCqCWAGT1P0paAPLtV+KVppk9xbLoWq3TW8Mcxe K2zEfNQMq7y3UZAbGQvJPAzVlPiPE2sXOjvoepB7aDzvMEOY3IjMjIpJHPAA9SR0BBPpFFAH l8PxQhmhu7hfD2rBLMLuU2w8xiS24Im7naFycHJyuAciqX/C4NO2QP8A8I9rX78bsfY+UHy/ eG7j73HXIHFeu0UAeOv8Y7LYZIvD2rmOLY0zyWvlrGjcsck8lRnIHHHXBBNvXPimdKmigtPD Wq3zSLFLujg+TynVHYggsSyh8bMZLDbx1r1YgMCCMg9qWgDycfFMz2Mt7Y+G9TkMaRMIpIli kYyuqbQCx5G4MSeMc9KdP8WtLttLj1WfRNWjjkuHttj2oVwyFBuILDCsXABzzgnoK9Wo69aA PJV+LEJeONvDWsBpQNg+y9SWKgcsMcjvggZYjbzWhH8SI7pdPFloWpNLqFwbcLLB5XlbZERn kOThQG3AjOcYODXpVFAHktj8U5L6G4X/AIRrU7e6htZrpVmiCxOsTbQvmgkBm9Mcd+CM7fg/ xnqniq5uFn0C50y0gUbZ5ztDv8p2hGVWxg9cY45xxXf0UAFFFFAH/9f9D5P+CkX7JcMjwv4l vQyMVP8AxKb7qDg/8saZ/wAPJv2Sf+hmvf8AwU3/AP8AGa/nNv7C++33X+jS/wCtk/gb+8fa mWttcQSs89hJOpSRQpVxhmUqrZA6qSGHY4waZXKf0a/8PJv2Sf8AoZr3/wAFN/8A/GaP+Hk3 7JP/AEM17/4Kb/8A+M1/OF9gv/8An2l/74b/AAo+wX//AD7S/wDfDf4UByn9Hv8Aw8m/ZJ/6 Ga9/8FN//wDGaP8Ah5N+yT/0M17/AOCm/wD/AIzX84X2C/8A+faX/vhv8KPsF/8A8+0v/fDf 4UByn9Hv/Dyb9kn/AKGa9/8ABTf/APxmj/h5N+yT/wBDNe/+Cm//APjNfzhfYL//AJ9pf++G /wAKPsF//wA+0v8A3w3+FAcp/R7/AMPJv2Sf+hmvf/BTf/8Axmj/AIeTfsk/9DNe/wDgpv8A /wCM1/OF9gv/APn2l/74b/Cj7Bf/APPtL/3w3+FAcp/R7/w8m/ZJ/wChmvf/AAU3/wD8Zo/4 eTfsk/8AQzXv/gpv/wD4zX84X2C//wCfaX/vhv8ACj7Bf/8APtL/AN8N/hQHKf0e/wDDyb9k n/oZr3/wU3//AMZo/wCHk37JP/QzXv8A4Kb/AP8AjNfzhfYL/wD59pf++G/wo+wX/wDz7S/9 8N/hQHKf0e/8PJv2Sf8AoZr3/wAFN/8A/GaP+Hk37JP/AEM17/4Kb/8A+M1/OF9gv/8An2l/ 74b/AAo+wX//AD7S/wDfDf4UByn9Hv8Aw8m/ZJ/6Ga9/8FN//wDGaP8Ah5N+yT/0M17/AOCm /wD/AIzX84X2C/8A+faX/vhv8KPsF/8A8+0v/fDf4UByn9Hv/Dyb9kn/AKGa9/8ABTf/APxm j/h5N+yT/wBDNe/+Cm//APjNfzhfYL//AJ9pf++G/wAKPsF//wA+0v8A3w3+FAcp/R7/AMPJ v2Sf+hmvf/BTf/8Axmj/AIeTfsk/9DNe/wDgpv8A/wCM1/OF9gv/APn2l/74b/Cj7Bf/APPt L/3w3+FAcp/R7/w8m/ZJ/wChmvf/AAU3/wD8Zo/4eTfsk/8AQzXv/gpv/wD4zX84X2C//wCf aX/vhv8ACj7Bf/8APtL/AN8N/hQHKf0gRf8ABST9keSWONvFN3EHYLvk0q+VFycZZjDwB1J7 Cvprx/8AGv4XfDLwAvxP8Y+Iba18NyrE0F1GxnFz5wzEtusW5pmccqEByMnoCa/kk+wX3/Pt L/3w3+Fa15f+LNQ0fTPD2oXN9daVovmmwtJWle3tPPbdL5MZyqbzydoGaA5T+ij/AIeTfsk/ 9DNe/wDgpv8A/wCM0f8ADyb9kn/oZr3/AMFN/wD/ABmv5wvsF/8A8+0v/fDf4UfYL/8A59pf ++G/woDlP6Pf+Hk37JP/AEM17/4Kb/8A+M0f8PJv2Sf+hmvf/BTf/wDxmv5wvsF//wA+0v8A 3w3+FH2C/wD+faX/AL4b/CgOU/o9/wCHk37JP/QzXv8A4Kb/AP8AjNT23/BR79k67uYbSDxL etLO6xoP7JvhlnOByYfU1/N39gv/APn2l/74b/CtbQLG+GvaYTbS/wDH1B/A3/PRfakHKf/Z UEsDBBQABgAIAAAAIQDg2BvwGQYAAJcaAAAUAAAAcHB0L3RoZW1lL3RoZW1lMy54bWzsWU+L GzcUvxf6HcTcHY/tGf9Z4g322E7a7CYhu0nJUZ6RZ5TVjIwk764JgZIcC4XStPRS6K2H0jaQ QC/pp9k2pU0hX6EajceWbJklzRYCjQ0e6c3vPf303tOTxnP5ymlKwDFiHNOs69QuuQ5AWUgj nMVd587hqNJ2ABcwiyChGeo6c8SdK7sffnAZ7ogEpQhI/YzvwK6TCDHdqVZ5KMWQX6JTlMl7 E8pSKGSXxdWIwRNpNyXVuus2qynEmQMymEqzNycTHCJwmJt0dkvjQyJ/MsFzQUjYQW4aGRoK Gx3V8guf84AwcAxJ15HjRPTkEJ0KBxDIhbzRdVz1caq7l6tLJSK26Gp6I/VZ6C0UoqO60mPx eKnoeb7X7C3tKwARm7hha9gcNpf2FACGoZxpwUXH+v1Of+AvsBqoaFpsD1qDRs3Aa/YbG/ie n38NvAIVTW8DPxoFKx9qoKLpW3zSqgeegVegotncwLfc3sBrGXgFSgjOjjbQrt9sBOVsl5AJ Jdes8I7vjVr1BXyFqmrZVehnYluupfA+ZSMJUMGFAmdAzKdoAkOJCyDBY4bBHo4TmXhTmFEu xW7dHbkN+Zt/PdVSHoE7CGrahSjkG6KcD+Ahw1PRdT6WVh0N8vrFj69fPAOvXzw9e/T87NEv Z48fnz362aJ4DWaxrvjq+y/+/vZT8Nez7149+cqO5zr+958+++3XL+1AoQNffv30j+dPX37z +Z8/PLHAewyOdfghThEHN9AJuE1TOTfLAGjM3kzjMIFY1+hlMYcZzHUs6KFIDPSNOSTQgusj 04N3mawUNuDV2X2D8EHCZgJbgNeT1ADuU0r6lFnndD0fS/fCLIvtg7OZjrsN4bFt7GAtvsPZ VKY8tpkMEmTQvEVkyGGMMiRAfo8eIWRRu4ex4dd9HDLK6USAexj0Iba65BCPjWxaKV3DqYzL 3EZQxtvwzf5d0KfEZn6Ajk2kXBWQ2EwiYrjxKpwJmFoZw5ToyD0oEhvJgzkLDYdzISMdI0LB MEKc23RusrlB97qsMPaw75N5aiKZwEc25B6kVEcO6FGQwHRq5YyzRMd+xI9kikJwiworCWqu kLwv4wCzreG+i5ER7vPX9h1ZXO0Jkt+ZMduSQNRcj3MygUgZr66V9BRn59b3tcruv6/s9sre Y9i6tNbr+TbcehUPKIvwu1/EB3CW3UJy3byv4e9r+P+xhm9bzxdfuVfFWh3oy2O7MpNuPcNP MCEHYk7QHldlnsvpRSMpVB2ltHxkmCayuRjOwMUMqjZgVHyCRXKQwKkcpqZGiPnCdMzBlHK5 USix1bbaaGbpPo0Kaa1WPqVKBShWcrnRlHK5LYlC2mytHseW5lUvVo/NJYFc901IaIOZJBoW Eq1SeA4JNbMLYdGxsGjn5reyUJdFVOT6AzD/g8P3CkYy3yBBUR6nQr+M7oVHepszzWnXLdPr 5FwvJtIGCS3dTBJaGiYwQuviC451ZxVSg17uik0arfZ/Eeu8iKzVBpKZPXAi11zDl2ZCOO06 E3lElM10Ku3xvG5CEmddJxQLR/+byjJlXAwgTwqYulXMP8UCMUBwKnNdDwPJVtxq9VY+x3eU XMd99zynLnqQ0WSCQrFFsurKe4UR6923BOcdOpOkD5LoBIzJjN2G0lF+q5Y7MMJcLL0ZYaYl 98qLa+VqsRSNf89WSxSSaQIXO4pezAu4ai/paPNQTNdnZfYXkxnHeZDeetc9X2mtaG7ZQPJd 014//rtNXmO1qvsGq6J0r9e6Tlnrtu0Sb78haNRWgxnUcsYWatv2jgs8EGjDLVNz2x5x0bvB etbmG0R5rlS9jdcUdHxfZv5AHldnRPDir4BT+YwQlH8wF5VAScvqcirAjOGu88D1e15Q94OK 2/aHFa/huZW232tUer7fqA39mjvo1x9Kp4gkrfnF2CP5PEPmi7cwSr7xJiYtj9mXQppWqToH V5WyehNTq29/EwOw9MyDZn3UaXT6zUqn0RtVvEG/XekEzX5l0Axag9Eg8Nud0UMHHCuw12sE XnPYrjRrQVDxmm5Ov92ptLx6vee1eu2h13u48LWceXkt3at47f4DAAD//wMAUEsDBAoAAAAA AAAAIQDPRlVmAiIBAAIiAQAVAAAAcHB0L21lZGlhL2ltYWdlOS50aWZmTU0AKgABFMj///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// +/3///7+/////f////3////+///+/////f////79/v///P7///3////+//////7//v7+//7+ /////////f////v////8/////v///////f///////v////7////+/////v////7////+//// /v////7////+////////////9v/+//n//f/9//v////7//////7///79///+/f////7///// /////v////7///7//v/7//7/+v/7//7+/P///vz///78/////v/9/////v////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////+v76////+v///fz//vr8//z9 ///9/P///vz///z9/v/5/vz/8/72//b+/f/8/////f///////v////z//f/6//39+P/++PH/ /fHk//ns2f/46c//+OfI//jnyP/45sj/+ObI//jmx//45sb/+ObH//jnyP/458n/+ejM//jp 2P/77eH//vTv//36/P/9/P7//f/1////+f/+//3//f////v//v/2//r/+v76//z99P/9+vv/ /fj3//n8+f/7+vn///r6///+/f/8//7//v/+//////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////P31///++f/+//7/+/7///f9/v/7/vv//f/8//z////6//// 9f39//r27f/78eD/9uzR//ThuP/u06P/6ceG/+rCeP/swHP/7bxs/+y6Z//tt13/7rRQ/+20 Uf/ts1D/7LNQ/+yzT//ss03/7LNP/+20Uv/utFP/7rVX/+y6Y//tvGf/7cBu/+rCdP/pxHz/ 7dCj//Tctv/16ND/+u7g//vx6f/6/Pr/+/////3++//+/fr//P35//j+/f/3+////f3///// ///8/Pj//v78//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////79///8/f///f3///39+P/8+vn/+/Xz//nq1v/32K7/8seP/+2+ef/puW3/6LVf/+yz Vf/0t1H/87RN//GyS//ytEn/87ZI//W4Rv/2uUv/97hV//e4U//2t1L/9rdS//a3Uf/2uE// 9rdR//e4U//3uFX/97lU//a4Tf/0tk7/8rRP//GyUf/xsVH/8bRN/+2yUf/ptFv/67pq/+7A dv/sx4L/9Nek//nqz//79/D/9/3///3+9v/8/fz//P7///3+//////r////9//////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////+//7/ /v/+//////////////7//////P///////v////3////+//7//v/8/////P///PT/+vDa//Hf uP/vx4T/7b1w/+q3Yf/utVb/87ZR//S5Sf/0u0b/9btH//O5Rv/wtkP/8rpE//S+Rv/yvEb/ 8LxG/+67Rf/vu0X/8r1E//G8RP/wvEP/8LtD//C7Qv/wvED/8LtB//G8RP/xvEb/8LxF/+67 Qf/vvEL/8b1C//O+Q//zvUT/8rZI//O5Sf/1ukr/9LlJ//K4SP/zs0n/77FM/+yzWP/xvG// 9MSC//DXtP/67Nr//vr1//39/v/9/v3////9//7////+///////+//////////////////// /////////v/9/////v////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////8//z//f76//77+P/9/Pr//v38///7 +P/5+vn/+P/4//v/+//7+ff/+ezX//LXq//ywnz/8Lpi/+i2WP/vtVT/8rZR//S5Tf/0ukf/ 87tB//O6Qv/zu0P/87tE//O7RP/zu0T/87tG//O7R//zu0b/87tF//K7RP/zu0T/9LtE//S7 RP/0u0T/9LtE//S7RP/0u0T/9LtE//S7RP/0u0T/87tE//K7Qv/yu0P/87tE//O7Rf/zu0X/ 8rtD//O7Q//zu0P/87tC//O7Qv/0vEH/9LpF//S5TP/ztk//8rRS/+i0Vv/quF7/7cF0//DT o//669X//fb2//v9/P/7//n//P/9//79+//+/vr//v7+//78/v/+/f7//f/4//7/+v////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+v////n+//38/P/8/vn/+v/1/////P/+/Pz//fHr//fZvf/uwpL/ 6LRr/++yWf/2sEj/+LNC//i6SP/0u0j/87pH//O6Rf/zu0T/87tE//O7RP/zu0T/87tE//O7 RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/ 87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7 RP/zu0T/87tE//O6Rf/zukb/87pH//a5Rf/1tkP/9LZI//K2Wv/utWv/7sV7//XZtf/66+X/ /vv+//3/+v/+//r//v/5//3+9f/8+/X///v+///9//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////v/7/fv/ +P////T////3/v///fz8//fpzf/q0Z7/5rxt/++1VP/1sU3/8bVJ//K2Rv/0uEb/8rlH/+65 SP/xu0D/87w///O7Qf/zu0P/87pF//O7RP/zu0T/87tE//O7RP/zu0T/9LxF//S8Rf/0vEX/ 9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8 Rf/0vEX/9LxF//S8Rf/0vEX/87tE//O7RP/zu0T/87tE//O7RP/zukX/87tE//O7Qv/zu0D/ 87w+//O6Rf/yu0X/8LlE//G2Rv/1tUz/9bVP/+u0Rv/kvVb/6tOP//bn0v/+9/r//f////f/ ///3//v/+v78//z9/f////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////6/v//+P////z88f/65sb/9seR/+u5 Zv/utFr/9bZT//e7Sv/wuz//9b1D//O9Rv/wu0j/8LpK//O6S//zukj/87pG//O6Rv/zukX/ 87tE//O7RP/zu0T/87tE//O7RP/zu0T/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 87tE//O7RP/zu0T/87tE//O7RP/zu0T/87pF//O6Rv/zukb/87pH//i6Rf/1vEb/8b5I//K8 Rf/4uUL/8blK//S6S//2t03/8LVU/+e2U//txX//9+C5//z37v/8/f///fz////9/v////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////9//3/9/76//v8 /f/+/fr////4//79////+vT/+ubM/+3Di//ptGL/7rVW//S4Tv/2uUf/9rtD//W8Rf/xvEr/ 9LxE//S7Q//yukP/8rlD//S5Q//0u0b/9LtH//S7Rv/0u0X/9LxF//S8Rf/0vEX/9LxF//S8 Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//S8Rf/0vEX/9LxF//S8 Rf/zu0T/87tE//O7Rf/zu0b/87pG//a7RP/0ukH/8blB//O6Qv/2u0P/8rxD//O6R//1uUn/ 9rhK//W3Tf/rtU7/6LZc/+7Dhf/64sD//vju//z9///8//v//v77//36/f/8/f3//f/6//// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////+/f///fr7//3/6//8//T///z+//Xp1//rwor/ 6rNn//a0Uv/2tkj/87lJ//O7Q//zu0T/87tE//O7RP/zu0P/87tE//O7RP/zu0T/87tE//O7 RP/0vEX/9LxF//S8Rf/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zu0T/87tE//O7RP/zu0T/ 87tE//O7RP/zu0T/87tE//O7RP/zu0T/87pG//O6R//zukf/87pH//O6Rv/2u0j/97VE//ez Sv/usl7/7cKE//Tkxf/9/Pv//P/+//z/7f//+/j///r+//////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////+//3/+/74//3+/f/78uX/8MuX/++3X//qs0z/9btP//m9SP/zvEP/8L5F//O7 RP/zu0T/87tE//O7RP/zu0T/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/ 9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8 Rf/0vEX/87pH//O6R//zukf/87pH//O6R//1vET/9bhA//e1Qf/3uEv/77VR/+61Wv/wxoT/ ++3W//3////3/Pv//P76//////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////vn0//bd wf/rv2n/8bRB//ixTf/zu0r/8LtJ/+65SP/yvk3/7blH//K6Q//zu0T/87tE//O7RP/zu0T/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//S8Rf/0vEX/9LxF//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/87tH//O6R//zukf/ 87pH//O6R//ut0L/9L5K//S+TP/wu0v/7rpK//KxTv/4tkv/7b9Z//Paq//7+e//+//+//// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7+///8/v/7//3/+//+///////97dj/9caN/+2xXf/2slT/8LZP/+vAQ//2uUH/ 9blD//W6Rv/ytUD/9bZA//S8Rf/0vEX/9LxF//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9 Rv/0vUX/871F//O9Rf/zvUX/871F//S+Rv/0vkb/9L5G//S+Rv/0vkb/9L5G//S+Rv/0vkb/ 9L5G//S+Rv/0vkb/9L5G//S+Rv/0vkb/9L5G//S+Rv/0vkb/9L5G//S+Rv/0vkb/9L5G//S+ Rv/0vkb/9L5G//S+Rv/0vkb/9L5G//S+Rv/0vkb/9L5G//S+Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxH//S7R//0u0f/9LtH//O7R//4u0T/9LhB//S7 Rf/0vEb/8rpD/+2/Qv/vvUz/9bVX/+2yV//wxID/+uXN//79+f////z///z///7////9/v7/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////+/v7//vz7//z49v/4+/// /P37//Lgrv/qunL/87VU//O3VP/zuU7/87pI//O6Rf/zu0T/87tE//O7RP/zu0T/87tE//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zvkb/8r5G//K+Rv/yvkb/ 8r5G//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/ R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/ 879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/87tE//O7RP/zu0T/87tE//O7Q//zu0T/ 87lL//O4U//0tFX/7rVd//TUqv/8+fT/+v76//3++//+/fv///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////7+/v/+/f7/+/79//r9///98ev/7MyS/+a3Xf/ptkf/87tF//O7 Rf/zukb/87pH//O6R//0vEX/9LxF//S8Rf/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/zvkb/8r5G//K+Rv/yvkb/8r5G//O/R//zv0f/879H//O/ R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/ 879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/ R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/0vEX/9LxF//S8Rf/0vEX/9LxF//O7Rf/zukX/87pG//O6R//yukj/97ZH//Cy Rv/ozIv/9/Hm//7/+//7/vz///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////+/v7//v7+//39 /f/8/f3//fz///zu2f/syG7/7LJH//K0SP/1vUv/87tA//O7Qv/zu0P/87pF//O6Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/zvkb/8r5G//K+Rv/yvkb/8r5G//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/ 879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/ R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//S8Rf/zu0T/87tE//O7Q//zu0P/8r1J//e7Vv/3sU3/7rts//PjyP/6//7/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////+/v3//f7+//z9/f/+/v//+e3Q/+y8Y//ss1r/ 97xN//S5Q//xuEn/87pI//O6R//zukb/87tE//O7Q//1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zvkb/8r5G//K+Rv/yvkb/ 8r5G//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/ R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/879H//O/R//zv0f/ 879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Qv/zu0H/ 87tE//O6R//zukr/8btM/+65Q//0vET/77VL/+i1Xf/22qr////9//7////+//7///////7/ /v////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////+//8/vf/9v/9//r8+P/12q7/7LVj//O2Vf/zuE//87xB//O7Qf/zu0P/9LxG//S8 Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//K+Rv/yvkb/8r5G//K+Rv/yvkb/ 879H//O/R//zv0f/879H//O/R//zv0X/879F//O/Rf/zv0X/879F//TARv/0wEb/9MBG//TA Rv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/ 9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TA Rv/zv0X/879F//O/Rf/zv0X/879F//O/R//zv0f/879H//O/R//zv0f/8r5G//K+Rv/yvkb/ 8r5G//K+Rv/0vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEb/9LxE//O7 Qf/yuz7/87pH//O3Vv/vs1D/8NOX//r88f/4/Pn//fr4//v+9/////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////n//v/0//7///v5//DW m//puFr/8bRa//O5S//zukf/87tE//O7Rv/zukj/9LxF//S8Rf/0vEX/9LxF//S8Rf/1vUb/ 9b1G//W9Rv/1vUb/9b1G//K+Rv/yvkb/8r5G//K+Rv/yvkb/879H//O/R//zv0f/879H//O/ R//zv0X/879F//O/Rf/zv0X/879F//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/ 9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TA Rv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/zv0X/879F//O/Rf/zv0X/ 879F//O/R//zv0f/879H//O/R//zv0f/8r5G//K+Rv/yvkb/8r5G//K+Rv/0vUb/9b1G//W9 Rv/1vUb/9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LtH//O6R//zu0T/87pF//S6SP/wtFz/ 6bJT/+/Qe//7+fL/9f35//78/P////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////v////7+fD/7tGR/+yzWv/4ulT/9b5A//O7Qf/zu0T/ 87pH//O6SP/zukj/9LxF//S8Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//K+ Rv/yvkb/8r5G//K+Rv/yvkb/879H//O/R//zv0f/879H//O/R//zv0X/879F//O/Rf/zv0X/ 879F//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TA Rv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/ 9MBG//TARv/0wEb/9MBG//TARv/zv0X/879F//O/Rf/zv0X/879F//O/R//zv0f/879H//O/ R//zv0f/8r5G//K+Rv/yvkb/8r5G//K+Rv/0vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/ 9LxF//S8Rf/0vEX/9LtH//O6SP/zukj/87pF//O7Qv/yvUD/9bRO//SwTP/m0YP/+vnw///7 /v////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////79f/w0JH/47Jd//G1Tv/1ukX/8bpE//O7QP/zukj/87pJ//O6Q//zvD//9LxF//S8 Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//K+Rv/yvkb/8r5G//K+Rv/yvkb/ 879H//O/R//zv0f/879H//O/R//zv0X/879F//O/Rf/zv0X/879E//TARv/0wEb/9MBG//TA Rv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/ 9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TARv/0wEb/9MBG//TA Rv/zv0X/879F//O/RP/zv0X/879G//O/SP/zv0f/879H//O/R//zv0f/8r5G//K+Rv/yvkb/ 8r5G//K+Rv/0vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxC//O7 QP/zukj/87pJ//S7RP/wuj//8LxG//O2Tf/1tFf/7MeL//j06P////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+/f///P7v//7++P//+////vn3//LXlP/ytF//8LdR//O8 QP/vt0P/9LxO//O7Q//zu0b/9LtG//S8RP/0vUL/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vkf/ 9L5H//S+R//0vkf/9L5H//O/Rf/zv0X/879F//O/Rf/zv0X/879G//K+Rf/1wUj/879G//PA Rv/xu0n/9b9I//bBQP/0vkL/9LxN//O9S//zv0n/9MBL//S/SP/3w0j/9cFG//XBR//1wUf/ 9cFH//XBR//1wUf/9cFH//XBR//1wUf/9cFH//XBR//1wUf/9cFH//XBR//1wUf/9cFH//XB R//1wUf/9cFH//XBR//1wUf/9cFH//XBR//1wUf/9cFH//bCR//3xEr/8bxJ//O8Tf/2v0j/ 9L88//S/PP/1vkb/87xN//K8TP/2w0r/9MBG//O/Rf/zv0X/879F//O/Rf/zvkb/9L5H//S+ R//0vkf/9L5H//S9Rv/1vUb/9b1G//W9Rv/1vUb/9b1E//S9Q//0u0b/9LtH//O7RP/0u0f/ 77pH//O9Q//4tkj/8bRb/+/Jhv//9+3///3+//z++v/7/f3//f73//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////fr//v35//j+9f//+vn/89ai/+q2Yv/0t1L/87pH//O7Qv/zukf/87pK//O7RP/zu0T/ 9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zv0f/879H//O/R//zv0f/879H//O/ Rf/zv0X/879F//O/Rf/zv0X/879F//XBR//xvUP/9cFH//O+Rf/0wT//88A8//nFRf/8yEr/ 9sJG//XBRf/3w0f/98RJ//O/Rf/4xEv/+cVL//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bC SP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/ 9sJI//bCSP/2wkj/9sJI//bCSP/1wUf/98NJ//XBR//2wEf/+cRL//nESv/5xEr/9cFH//TB Rv/2w0n/9MBG//O/Rf/zv0X/879F//O/Rf/zv0b/879H//O/R//zv0f/879H//S+Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//O7RP/zu0b/87pG//O7Qf/zvET/87hR//G2 XP/xzY7///L2//b88//6//T//Pr9//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////j//fv6//39///y47H/ 6bZU//m1Uv/zuU3/87pH//O7RP/zukb/87pJ//O7RP/zu0T/9LxF//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/zv0f/879H//O/R//zv0f/879H//O/Rf/zv0X/879F//O/Rf/zv0X/ 879I//K+Rv/0wEj/98NL//C8RP/zxEX/7bxL/9WgRf/VoUP/6rpI//bESP/3xEX/9cNB//nG R//xvUb/9cBJ//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/ 9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bC SP/2wUb/9ME9//LCPf/wvkz/1KBE/9KeRP/ruUv/88NA//bFQP/2wkX/879F//O/Rf/zv0X/ 879F//O/Rf/zv0b/879H//O/R//zv0f/879H//S+Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/0vEX/9LxF//O7RP/zu0X/87pG//O7Q//zukX/87lN//W2VP/vtE7/79Sc//z7+f/6//P/ //z9//////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+///////3//ni0f/htlf/9bhP//W2Q//zukf/87pH//O6 R//zukf/87pG//O7RP/zu0T/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zv0f/ 879H//O/R//zv0f/879H//O/Rf/zv0X/879F//O/Rf/zv0X/8r5I//XBS//2wUz/8r1I//zJ UP/PnUL/k18c/4RNF/9+SBT/jFkX/8+ZPP/8xlT/9cJE//jFRf/yvUb/9sFL//bCSP/2wkj/ 9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bC SP/2wkj/9sJI//bCSP/2wkj/9sJI//bCSP/2wkj/9sJI//bCR//0vkD/98FM/9ajPv+TYRL/ gU8Q/4NRFP+OXBD/yZY2//S/Tf/4wUX/9L9E//O/Rf/zv0X/879F//O/Rf/zv0b/879H//O/ R//zv0f/879H//S+Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//O7RP/zu0T/ 87tE//O6Rf/zukf/87pI//O2S//2tVb/5blF//TWtf//+/r//P/6//////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////f////7//f///fz///7///// ///8//3/9uzX/+i9cP/yslP/8rdF//O9S//zu0L/87pF//O7R//0u0f/9LtF//S8Rf/0vEX/ 9LxF//W9Rv/1vUb/9L5G//S+Rv/0vkb/9L5G//S+Rv/zv0b/879G//O/Rv/zv0b/879G//O/ Rf/zv0X/879F//O/Rf/zv0X/9L5J//G7Sf/yvkb/+sZP/9GcM/+GUg//gk8W/4hVHf+HUx3/ g08b/4tTEv/MlDv/+cZT//fFQv/2w0f/+cZN//bDR//2w0j/9sNI//bDSP/2w0j/9sNI//bD SP/2w0j/9sNI//bDSP/2w0j/9sNI//bDSP/2w0j/9sNI//bDSP/2w0j/9sNI//bDSP/3w0j/ 9sNG//bCR//3w0j/9cFH//TARf/4xEb/1J4//4tTE/+CTBj/hlIg/4VRH/+GUBz/hk8S/8eQ N//7yE3/9MBC//TAR//zv0b/9MBG//K+Qv/zwEX/879G//O/Rv/zv0b/879G//S+Rv/0vkb/ 9L5G//S+Rv/0vkb/9b1G//W9Rv/0vEX/9LxF//S8Rf/0vET/9LxE//S7Rv/zu0b/87pF//K7 R//wuE//9LVT/+q5XP/14Mb/+v73///+/v////////39///9/P/8//////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////+f////7++f//+/j//P3///3////+9uT/6siI/+azUP/3uU7/ 9LhG//S+RP/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/879H//O/ R//zv0f/879H//O/R//zv0X/879F//O/Rf/zv0X/879F//TARv/0wEb/9MBG//TARv/0wEb/ +MJI//O9S//4yEf/5bU7/5RbG/+HUR7/iVUc/4lVHP+JVRz/ilUc/4dSGP+QWhn/5LNP//jK QP/3xj//98VJ//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/ 9sVH//bFR//2xUf/9sVH//fER//3xEf/98RH//fER//3xEf/98VE//rGSf/4xUn/9sJG//TB Qv/mtkj/l2Ec/4hPHP+OVhz/kFYe/4xTG/+MUxj/ilEb/49ZFv/drkL/+cdK//O/R//wu0f/ 9sJK//G/PP/yv0H/879F//O/Rf/zv0X/879F//O/Rv/zv0f/879H//O/R//zv0f/9L5H//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/87tE//O7Q//0uUT/97lM/+m0TP/kv3n/ /e3X/////v/7/v///vv7///79v/4//7//v////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /f////79+v/+/v7/9f3///3+9//x1Kr/6rFZ//K3R//5uUr/9bxL//K8RP/zu0T/87tE//S8 Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/879H//O/R//zv0f/879H//O/R//zv0X/ 879F//O/Rf/zv0X/879F//TARv/0wEb/9MBG//TARv/0wEb/+cRE//bCRP/2w03/snwf/4RK Ff+MVCD/jlcd/45XHf+OVx3/jlcd/4xWGv+IURL/s38p//bFS//ywj7/9MJF//bFR//2xUf/ 9sVH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//fE R//3xEf/98RH//fER//2wkf/9sFN//fDSf/3xEb/+MVG//nGSf+2gS7/iE4a/5NYKf+RWRv/ jVUY/5BYHP+NVhf/jFIe/4lQHP+pdCX/9sFP//G9Rf/wvEX/9MBH//bCRP/yv0P/879F//O/ Rf/zv0X/879F//O/Rv/zv0f/879H//O/R//zv0f/9L5H//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/0vEX/87tE//O8Rf/zu0n/+LpL//O5Rv/otFX/8cWR//767//2/v//+fz////+ +//9//3///////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////9/P/6/f//+//8//nn wv/ptWz/+blQ//i7Q//ztkX/9LxK//W/Rf/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/879H//O/R//zv0f/879H//O/R//zv0X/879F//O/Rf/zv0X/879F//TA Rv/0wEb/9MBG//TARv/0wEb/98FE//fDRP/kr0j/llwb/5RZJf+RWB7/k1oe/5NaHv+TWh7/ k1oe/5RdHv+PWB//kVoX/+KvRv/4x0f/9sVF//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bF R//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//fER//3xEf/98RH//fER//3w0j/ 9cFN/+66Pv/0wkH/+cVL/+q1Rf+TXBf/kVgp/5JYJf+QWRb/kVob/5NbH/+PWRX/klkg/5JY J/+RWhf/3ag///jET//1wUn/8b1D//bCS//2wkn/879E//O/Rf/zv0X/879F//O/Rv/zv0f/ 879H//O/R//zv0f/9L5H//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/87tE//O7 RP/yukf/9rxL//nARP/0u0n/7rNh//XXsP/+/vb/+f7///7+/f///vz///////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////+///8////+fXk//HFf//1slP/9LpP//G7Q//ttkb/ 8LZD//a8Qf/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/879H//O/ R//zv0f/879H//O/R//zv0X/879F//O/Rf/zv0X/879F//TARv/0wEb/9MBG//TARv/0wEb/ 9b9K//jDSf/EjTH/kFQh/5ZdIf+VXBz/llwf/5ZcH/+WXB//llwf/5ZgHv+TXCb/ilEZ/8CK K//5yEr/+MZH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/9sVH//bFR//2xUf/ 9sVH//bFR//2xUf/9sVH//fER//3xEf/98RH//fER//2w0f/9sJH//fFQf/1w0D//MdV/8SM Lv+OWBD/k1oj/5VeIv+SWxX/lV0g/5dfJf+UXhf/lV4c/5JaIP+QWxL/uYQf//nDUf/2wkf/ 9sJH//K9Sv/zv0j/879F//O/Rf/zv0X/879F//O/Rv/zv0f/879H//O/R//zv0f/9L5H//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/87tE//O6Q//zuET/8bpI/+67Pv/vvEX/ 8LRW//S3dP/66tH//f////7+/v/+//7///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //r9//r8///9/Pv/9NKj/+q2Tv/vuVf/87pD//K7RP/yu0X/8rpD//S8RP/1vUb/9b1G//W9 Rv/1vUb/9L1G//K+Rv/yvkb/8r5G//K+Rv/yvkb/879F//O/Rf/zv0X/879F//O/Rf/0wEb/ 9MBG//TARv/0wEb/9MBG//bCSP/2wkj/9sJI//bCSP/2wkj/88I///bCU/+kax7/l1se/5dc Hf+XXh3/mGAg/5hgIP+YYCD/mGAg/5thI/+ZXx3/lFkZ/6VsIf/uukv/+MdF//fGSP/3xkj/ 98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fG SP/3xkj/98ZI//fGSP/3xkj/9cRH//XDR//2xUT/88BO/6lwIf+TWhr/lV0d/5dfH/+XXx7/ mGAg/5hgIP+YYB7/l18e/5VdHf+VXRv/n2UX//C6TP/2xEX/9cFI//O/R//0wEb/9MBG//TA Rv/0wEb/9MBG//O/Rf/zv0X/879F//O/Rf/zv0X/879F//K+Rv/yvkb/8r5G//K+Rv/zvkb/ 9b1G//W9Rv/1vUb/9b1G//W9Rf/zu0T/8rtE//G6Q//yu0P/8rpL/+20Wf/xxnj//fj2//f/ +P/+/fj////+//////////////////////////////////////////////////////////// /////////////////////////////////////////////////v7///z+/v/47Nv/6Lll//e5 Yf/wuz7/87tF//O7RP/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/9L1G//K+Rv/yvkb/ 8r5G//K+Rv/yvkb/879F//O/Rf/zv0X/879F//O/Rf/0wEb/9MBG//TARv/0wEb/9MBG//bC SP/2wkj/9sJI//bCSP/2wkj/+chF/+WwRv+ZYBb/nGAj/5peHv+bYR//m2Ig/5tiIP+bYiD/ m2Ig/55iJP+dYR7/ml8c/5heGP/msUj/+chI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fG SP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkf/ 98VH//jGTP/5yEj/6LRF/5xhGP+XXh3/mWAe/5pgHv+bYR//m2Ig/5tiH/+bYR//mmEf/5lg Hv+ZXx7/l1wW/+CpQP/6x0j/+MRL//bCSf/0wEX/9MBG//TARv/0wEb/9MBG//O/Rf/zv0X/ 879F//O/Rf/zv0X/879F//K+Rv/yvkb/8r5G//K+Rv/zvkb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/zu0T/87tE//O7RP/zu0T/8rtA//e4U//utmf/8+O3//z//f/7/vj///////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////+v/9///6+v/qyIT/67RZ//W3S//2vD3/87tE//O7RP/zu0T/ 87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/9L1G//K+Rv/yvkb/8r5G//K+Rv/yvkb/879F//O/ Rf/zv0X/879F//O/Rf/0wEb/9MBG//TARv/0wEb/9MBG//bCSP/2wkj/9sJI//bCSP/2wkj/ +8lN/82XM/+VWxT/oGQn/51iIP+fZCD/n2Qg/59kIP+fZCD/n2Qg/59kI/+eYyD/nmMi/5FW FP/Unjv/+8lM//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/ 98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/2xUf/98ZI//jGTP/8yk7/16E5/5RY Ff+cYR//nWIe/51iHv+eYx//nmMf/55jH/+eYx//nmMf/51iHv+dYh7/lVkX/8yUMf/7x0z/ +cVN//bCSf/zv0T/9MBG//TARv/0wEb/9MBG//O/Rf/zv0X/879F//O/Rf/zv0X/879F//K+ Rv/yvkb/8r5G//K+Rv/zvkb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zu0T/87tE//O7RP/zu0T/ 9btE//q6Pf/ss2L/58Vr//7z6f/5//7//v////////////////////////////////////// //////////////////////////////////////////////////////////////////////// +v////rjwP/ytVr/87tT/+u4O//2vEf/87tE//O7RP/zu0T/87tE//S8Rf/1vUb/9b1G//W9 Rv/1vUb/9L1G//K+Rv/yvkb/8r5G//K+Rv/yvkb/879F//O/Rf/zv0X/879F//O/Rf/0wEb/ 9MBG//TARv/0wEb/9MBG//bCSP/2wkj/9sJI//bCSP/2wkj/98NN/7uEJv+bYRv/nmIl/6Bl Iv+iZR//o2Ug/6NlIP+jZSD/o2Ug/6BkIf+eYyD/n2Ql/5hcHv+8hSj/+8lP//fGR//3xkj/ 98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fGSP/3xkj/98ZI//fG SP/3xkj/98ZI//fGSP/2xUb/9sVE//G/Rf/8ylD/yJIt/5dcH/+hYyD/oWMe/6JkH/+iZB// o2Ug/6NlIP+iZB//omQf/6FjHv+hYx7/nF4h/76GJ//4xEz/9MBJ//K/Q//0wET/9MBG//TA Rv/0wEb/9MBG//O/Rf/zv0X/879F//O/Rf/zv0X/879F//K+Rv/yvkb/8r5G//K+Rv/zvkb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/zu0T/87tE//O7RP/zu0T/9btF//a8Qf/uvlD/6bBa//bT nv/8//7///////////////////////////////////////////////////////////////// //////////////////////v9+////f///f7+//n++P/9/v7//vnt/+jGf//1tln/8bNE//O6 SP/yuUP/87tE//S8Rf/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9L5G//O/R//zv0f/ 879H//O/R//zv0f/9MBG//TARv/0wEb/9MBG//TARv/1wUf/9cFH//XBR//1wUf/9cFH//bD R//2w0f/9sNH//bDR//3w0f/88BL/7B4If+gYyH/omUh/6ZoIf+laCD/pmgh/6ZoIf+maCH/ pmgh/6RmIf+kZx//omUi/59kJv+rcx3/+MZQ//jHSP/4x0n/+MdJ//jHSf/4x0n/+MdJ//jH Sf/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//fGSP/3xkj/98ZI//fGSP/2xkb/ 9cVF//LBRP/7yU7/t30t/55gHv+kZR7/pWUf/6VmIP+nZyH/p2ch/6dnIf+nZyH/pmch/6Vl H/+lZR//nmAf/7J4Jv/xvkP/9cFJ//PAR//1wkX/9cFH//XBR//1wUf/9cFH//TARv/0wEb/ 9MBG//TARv/0wEb/9MBG//O/R//zv0f/879H//O/R//0vkf/9b1G//W9Rv/1vUb/9b1G//W9 Rv/0vEX/9LxF//S8Rf/zu0T/87pC//W8Sf/zvkX/87VY/+a6bP/57tv///7///7/+////fr/ //z+//3//v/+//////////////////////////////////////////////////////////v+ +v/9+vz//f7+//b/+//+////+uC//+W2Yv/1u03/9bVI//a7S//xukP/87tE//S8Rf/0vEX/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9L5G//O/R//zv0f/879H//O/R//zv0f/9MBG//TA Rv/0wEb/9MBG//TARv/2wkj/9sJI//bCSP/2wkj/9sJI//bDRv/2w0b/9sNG//bDRv/3xEf/ 8r5J/6pyIP+gYyP/p2gf/6lpH/+oaSL/qWoi/6lqIv+paiL/qWoi/6hoIv+paSD/pGUf/6Jl Jv+lbRz/9MFO//nISP/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/ +MdJ//jHSf/4x0n/+MdJ//fGSP/3xkj/98ZI//fGSP/2xkb/9cZH//bGRv/5yEv/r3Iv/6Bh Gv+mZh7/p2cg/6hoIf+qaiP/q2sj/6trI/+qaiP/qWki/6dnIP+nZh//n2Ic/6luJv/tuj// +MRK//bCTf/2w0X/9sJI//bCSP/2wkj/9sJI//XBR//0wEb/9MBG//TARv/0wEb/9MBG//O/ R//zv0f/879H//O/R//0vkf/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/ 8bpD//K7Rf/3uUf/97pI/+i2X//306n///3///n//f/9/Pz///r///z//v/+//////////// //////////////////////////////////////////////3//f/+/fr//f3///v+////+fX/ 78SL/+62TP/zuUD/9LpH/+67SP/wvUT/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9L5G//O/R//zv0f/879H//O/R//zv0f/9MBG//TARv/0wEb/9MBG//TARv/2wkj/ 9sJI//bCSP/2wkj/9sJI//bDRv/2w0b/9sNG//bDRv/3xEf/7rpF/6dvHP+kZib/p2kg/6lp IP+qaSL/q2oi/6tqIv+raiL/q2oi/6ppI/+paSD/pWch/6JmJ/+mbh3/8L1J//nISf/4x0n/ +MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//fG SP/3xkj/98ZI//fGSP/2xkf/9MZG//fGRv/1xEf/rHAr/6JjHP+nZx7/qGgg/6lpIf+qaiL/ q2sj/6trI/+qaiL/qmoi/6hoIP+nZx//o2Yg/6RpIf/suT3/98NI//bCTf/2w0X/9sJI//bC SP/2wkj/9sJI//XBR//0wEb/9MBG//TARv/0wEb/9MBG//O/R//zv0f/879H//O/R//0vkf/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/8rpE//K7Sf/1t0j/97lA//a5 Tf/zuXT//fft//j////5/P////39//7//v////////////////////////////////////// //////////////////////39//////j/+vz9//z9///65cb/7Lhl//K5Sv/vuj//8blH//G5 RP/zvEH/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9L5G//O/R//zv0f/ 879H//O/R//zv0f/9MBG//TARv/0wEb/9MBG//TARv/2wkj/9sJI//bCSP/2wkj/9sJI//bD Rv/2w0b/9sNG//bDRv/4xUf/6rdC/6NrGP+maSn/qGoh/6lpIP+taiL/r2si/69rIv+vayL/ r2si/6xqJP+paiH/qGkj/6NnKP+mbh3/67hE//rJSv/4x0n/+MdJ//jHSf/4x0n/+MdJ//jH Sf/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//fGSP/3xkj/98ZI//fGSP/3x0f/ 88VG//jISP/xwEL/qGwn/6VmH/+pah3/qmsf/6trIP+sbCH/rW0i/61tIv+sbCH/rGwh/6pr H/+paR7/p2ok/59kG//qtzv/9cFH//fCTf/2w0X/9sJI//bCSP/2wkj/9sJI//XBR//0wEb/ 9MBG//TARv/0wEb/9MBG//O/R//zv0f/879H//O/R//0vkf/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//S8Rf/zu0T/87tE//O5SP/yt0r/9LxC//W9R//rsVj/89yw///9/P/8/P// //74//39/f////////////////////////////////////////////////////////////7+ /f/+/vb//P/7//78/f/tzZD/6LJQ/+y2Sf/zvkj/+L5O//q7R//1ukD/87tE//S8Rf/0vEX/ 9b1G//W9Rv/0vUb/9L1G//S9Rv/1vUb/9L5G//O/R//zv0f/879H//O/R//zv0f/9MBG//TA Rv/0wEb/9MBG//TARv/2wkj/9sJI//bCSP/2wkj/9sJI//bDRv/2w0b/9sNG//bDRv/4xUf/ 6LQ//6FoGP+naij/qWoj/6tqIv+vbCD/sGwh/7BsIf+wbCH/sGwh/65sJP+rayH/qGoj/6Vo Kf+mbRz/57RB//rJSv/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/+MdJ//jHSf/4x0n/ +MdJ//jHSf/4x0n/+MdJ//fGSP/3xkj/98ZI//fGSP/3x0j/9MZH//jISP/tvD//p2om/6Zn IP+qax7/q2wg/6xsIf+tbiL/rm8j/65vIv+tbiH/rW0h/6tsIP+qax//qGsk/51hGv/otTz/ 9MFF//bCTP/2w0X/9sJI//bCSP/2wkj/9sJI//XBR//0wEb/9MBG//TARv/0wEb/9MBG//O/ R//zv0f/879H//O/R//0vkf/9b1G//W9Rv/0vUb/9L1G//S9Rv/1vUb/9b1G//S8Rf/zu0T/ 9LxF//W4Rf/yukr/8r9I//C+Sv/stVX/7MF4//327f/9/P7//v70//v8+/////////////// ///////////////////////////////////////////////+9v///fv//P79//306f/ntmX/ 9LVN//O7Rv/zukf/87pH//O6R//zu0b/9LxF//W9Rv/1vUb/9r5H//S+Rv/xvUX/8r5G//K+ Rv/zv0f/879G//O/Rf/zv0X/879F//O/Rf/zv0X/9MBG//TARv/0wEb/9MBG//TARv/2w0b/ 9sNG//bDRv/2w0b/9sNG//bFR//2xUf/9sVH//bFR//4x0j/6bU9/6BjHv+maB3/q2kn/69s KP+wbh7/r20f/69tH/+vbR//r20f/65sIP+ubB7/qWkh/6pqLP+maxr/5rM///rLS//4yEr/ +MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jI Sv/4yEr/+MhK//jISv/3yEj/98lK//jIR//quTz/qWwo/6VmH/+saSH/rWoj/61qI/+vbCX/ sG0m/7BuIv+vbSP/rmsi/61qJP+saSP/pWke/59iI//msT//9cNA//bDSP/2xET/9sNG//bD Rv/2w0b/9sNG//XBRv/0wEb/9MBG//TARv/0wEb/9MBG//O/Rf/zv0X/879F//O/Rf/zv0b/ 879H//O/R//yvkb/8b1F//K9Rf/2vkf/9r5H//W9Rv/1vUb/9LxF//O7RP/zukX/87pG//O6 Sf/1uUr/8bVd//bqy//7/fz///34//39/P/+//7///////////////////////////////// ///////////////////////++v/8//7////2//Lbtv/tt2T/9LhM//O6Rv/zukf/87pH//O6 R//zu0b/9LxF//W9Rv/1vUb/9r5H//S+Rv/xvUX/8r5G//K+Rv/zv0f/879G//O/Rf/zv0X/ 879F//O/Rf/zv0X/9MBG//TARv/0wEb/9MBG//TARv/2w0b/9sNG//bDRv/2w0b/9sNG//bF R//2xUf/9sVH//bFR//4x0j/6rc//6NmIf+lZhz/qmgm/61qJv+ubR7/rmwg/65sIP+ubCD/ rmwg/61rIP+sahz/qWkh/6dnKf+obRz/6bZC//rKS//4yEr/+MhK//jISv/4yEr/+MhK//jI Sv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/3yEn/ 9shJ//nJSP/vvUD/qGsn/6VmH/+raCD/rGki/61qI/+uayT/r2wl/69tIf+ubCL/rmsi/6xp I/+raCL/pGcc/6BjJP/os0H/98VC//XCR//2w0T/9sNG//bDRv/2w0b/9sNG//XBRv/0wEb/ 9MBG//TARv/0wEb/9MBG//O/Rf/zv0X/879F//O/Rf/zv0b/879H//O/R//yvkb/8b1F//K9 Rf/2vkf/9r5H//W9Rv/1vUb/9LxF//O7RP/zukX/87pG//O6Sf/0uUn/77VY/+3Tpv////f/ /v38//z9+v/+/v7////////////////////////////////////////////////////////8 /f/4//z//vzv/+3Df//ytl//87tL//O6Rv/zukf/87pH//O6R//zu0b/9LxF//W9Rv/1vUb/ 9r5H//S+Rv/xvUX/8r5G//K+Rv/zv0f/879G//O/Rf/zv0X/879F//O/Rf/zv0X/9MBG//TA Rv/0wEb/9MBG//TARv/2w0b/9sNG//bDRv/2w0b/9sNG//bFR//2xUf/9sVH//bFR//4x0j/ 67hA/6hqJf+jZRr/qmgm/6xpJf+tax7/rmsi/65rIv+uayL/rmsi/61rIf+raRv/qWkh/6Vl J/+pbh3/7bpH//rKS//4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/ +MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yUn/9sdI//nJSf/0w0b/qGsn/6Vm H/+raCD/q2gh/6xpIv+uayT/r2wl/69tIf+ubCH/rWoh/6toIv+raCL/pGcb/6BjJP/rtkT/ +cdE//XCR//1w0P/9sNG//bDRv/2w0b/9sNG//XBRv/0wEb/9MBG//TARv/0wEb/9MBG//O/ Rf/zv0X/879F//O/Rf/zv0b/879H//O/R//yvkb/8b1F//K9Rf/2vkf/9r5H//W9Rv/1vUb/ 9LxF//O7RP/zukX/87pG//O6Sf/zukj/7rVS/+jAe///+eL/+/7///38+f/+/v7///////// //////////////////////////////////////////////78/v/0////+PXo/++5XP/1tFj/ 8LpL//O6Rv/zukf/87pH//O6R//zu0b/9LxF//W9Rv/1vUb/9r5H//S+Rv/xvUX/8r5G//K+ Rv/zv0f/879G//O/Rf/zv0X/879F//O/Rf/zv0X/9MBG//TARv/0wEb/9MBG//TARv/2w0b/ 9sNG//bDRv/2w0b/9sNG//bFR//2xUf/9sVH//bFR//3x0f/7LlB/6ttKP+iZBn/qmgl/6to I/+raR7/rWoj/61qI/+taiP/rWoj/6xqIf+pZxn/qWgh/6NjJf+qbx//8L1J//nKSv/4yEr/ +MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jISv/4yEr/+MhK//jI Sv/4yEr/+MhK//jISv/4yUn/9cZH//nJSf/4x0r/p2om/6VmH/+qZx//q2gh/6toIf+taiP/ rmsk/65sIP+tayH/rGkg/6toIv+qZyH/omYb/6FkJf/uuUf/+8hG//XBR//1wkP/9sNG//bD Rv/2w0b/9sNG//XBRv/0wEb/9MBG//TARv/0wEb/9MBG//O/Rf/zv0X/879F//O/Rf/zv0b/ 879H//O/R//yvkb/8b1F//K9Rf/2vkf/9r5H//W9Rv/1vUb/9LxF//O7RP/zukX/87pG//O6 Sf/zu0j/7bZN/+uzYP/35cP/+v////3++P////////////////////////////////////// //////////////////////n+9//8+///+uTB/+u4Vv/0tkv/8blA//K6RP/zu0X/87tF//S8 Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/R//zv0f/879H//TARv/0wEb/ 9MBG//TARv/0wEb/9sJI//bCSP/2wkj/9sJI//bCSP/3xEf/98RH//fER//3xEf/98RH//bF R//2xUf/9sVH//bFR//3xkj/8rxD/65yIf+gYCP/pmcj/6hpIP+oaCD/qWkh/6lpIf+paSH/ qWkh/6dpJP+iZxz/o2ge/6BkIP+mbhj/+MdQ//nKSP/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/4yUn/ 9cZJ//nKSP/8zFL/rXce/59kIf+nZyD/qGcg/6hoIP+paCH/qmki/6ppIf+paSD/qGgg/6hn IP+nZx//oGMk/6pyGv/vvUb/+MdN//TCRv/1wkT/98RH//fER//3xEf/98RH//bDSP/2wkj/ 9sJI//bCSP/2wkj/9cFH//TARv/0wEb/9MBG//TARv/0wEb/879H//O/R//zv0f/879H//O/ R//1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/87tE//K6RP/yu0H/7bhC/+yyXv/t05b/ /v3+//z8/P////////////////////////////////////////////////////////////r/ +v///f7/8NCc/+65WP/1uEr/9LtA//K6Q//zu0T/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/ 9b1G//S+Rv/zv0f/879H//O/R//zv0f/879H//TARv/0wEb/9MBG//TARv/0wEb/9sJI//bC SP/2wkj/9sJI//bCSP/3xEf/98RH//fER//3xEf/98RH//bFR//2xUf/9sVH//bFR//2xkf/ +cZJ/7J5Iv+aWyH/o2cj/6RoIf+laCD/pmgg/6ZoIP+maCD/pmgg/6NnI/+gZh3/oWcf/55j H/+xeR7/+8pQ//nKSP/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/4yUn/9sZJ//nKR//8zVL/uoUm/5xi Hv+kZiD/pWYf/6VnIP+mZyD/pmgg/6ZoIf+mZyD/pWcg/6VmH/+kZh7/nmEk/7N9Hv/0wkn/ +MZM//XERf/1w0T/98RH//fER//3xEf/98RH//bDSP/2wkj/9sJI//bCSP/2wkj/9cFH//TA Rv/0wEb/9MBG//TARv/0wEb/879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/ 9b1G//S8Rf/zu0T/87tE//K6Q//xukD/8LtD//G0W//qxn3//vj0//7+/v////7///////// //////////////////////////////////////////////z/////+fD/5r92//S4WP/zuU3/ 871A//K6Q//zu0T/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/ R//zv0f/879H//TARv/0wEb/9MBG//TARv/0wEb/9sJI//bCSP/2wkj/9sJI//bCSP/3xEf/ 98RH//fER//3xEf/98RH//bFR//2xUf/9sVH//bFR//2xUb//s1L/8CJLv+WWh3/n2Uj/6Fm Iv+iZiH/o2Yg/6NmIP+jZiD/o2Yg/6FmIv+fZR7/nmMh/5pfHv/Ejiz//MxO//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+MhI//nLRf/8zE//zJg2/5hgGf+gYx//oGQe/6FkH/+iZR// omUg/6JlIP+iZR//omUf/6BkHv+hZB7/ml4f/8OMK//6yEz/9sVI//bGRP/2xET/98RH//fE R//3xEf/98RH//bDSP/2wkj/9sJI//bCSP/2wkj/9cFH//TARv/0wEb/9MBG//TARv/0wEb/ 879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/87tE//K6 Q//xukL/8rtG//m2Uv/muWT/+e7g/////v////7///////////////////////////////// //////////////////////7////77dr/7r5g//WzU//zuVD/77s8//K6RP/zu0T/87tE//S8 Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/R//zv0f/879H//TARv/0wEb/ 9MBG//TARv/0wEb/9sJI//bCSP/2wkj/9sJI//bCSP/3xEf/98RH//fER//3xEf/98RH//bF R//2xUf/9sVH//bFR//2xUb/+81H/9GcQP+aYCL/mmAg/5tiIv+dYyH/n2Qh/59kIf+fZCH/ n2Qh/59jIP+eYyD/nGAk/5ZaHf/WoTn//s9L//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpH//nLQv/8zU7/3KhG/5VcFP+dYh7/nGEe/55jIP+eYyH/nmMh/59kIP+eYyD/nmMg/5xh H/+cYR//lFkZ/9GbOP//zU7/9cRF//fHQ//3xUP/98RH//fER//3xEf/98RH//bDSP/2wkj/ 9sJI//bCSP/2wkj/9cFH//TARv/0wEb/9MBG//TARv/0wEb/879H//O/R//zv0f/879H//O/ R//1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/87tE//K6Q//xukP/77hD//24Sv/qtlb/ 9uTP///9/f////7///////////////////////////////////////////////////////7/ ///z4sD/77pW//S0Uv/1vEv/8bpB//K6RP/zu0T/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/ 9b1G//S+Rv/zv0f/879H//O/R//zv0f/879H//TARv/0wEb/9MBG//TARv/0wEb/9sJI//bC SP/2wkj/9sJI//bCSP/2xEf/9sRH//fER//3xEf/98VH//bFR//2xUf/9sVH//bFR//3xkj/ 9slD/+e1TP+ZYhz/mV8n/5tiJf+bYSD/nGIh/5xiIf+cYiH/nGIh/51jG/+eYyT/mV0p/5th G//irz3//s9L//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5y0r/+stK//nKRf/4ykb/5rRI/51k Gf+XWyD/nGIi/5lfG/+bYR7/m2Af/5leIP+cYiL/mV8d/5thH/+ZXx3/lVsW/9+qQ//7ykr/ 9cNG//fHRf/3xUX/98RH//fER//2xEf/9sRH//bDSP/2wkj/9sJI//bCSP/2wkj/9cFH//TA Rv/0wEb/9MBG//TARv/0wEb/879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/ 9b1G//S8Rf/0vEX/87tE//K6Q//zu0T/8bdF//a4Rv/wt1f/8dau//v9/f/+//7///////// ///////////////////////////////////////////////////w2qj/67JR//O5Uv/3vkP/ 9bpJ//O7Q//0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/ R//zv0f/879G//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/ 9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/9sdF//jHTf+kbhr/k1Yk/5xi J/+ZXx7/mV8g/5lfIP+ZXyD/mV8g/5phGf+XXCP/lFgo/6RuGP/1xUj/+stJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/6y0n/+spM//fGSf/3yUH/+cpR/693Jf+UWSP/mF4g/5lgGv+ZYBv/ mmAg/5ZcHv+cYiL/mV8f/5ddHf+ZXyH/pGwe//O/Uf/4xkf/+cZO//bFSP/1xEX/9sVH//bF R//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//TARv/0wEb/9MBG//TARv/0wEb/ 879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/0u0P/9blI//C5Rf/xt1j/7sqM//r9///+//////////////////////////////////// ///////////////////////9/f/x05X/7rNS//S5Tv/0vEL/9LpG//O7RP/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/R//zv0f/879G//TARv/0wEb/ 9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bF R//2xUf/98ZI//fGSP/4x0n/+MhK//jJSv/GkjH/iU8S/5ZaIv+UXB7/lFwe/5RcHv+UXB7/ lFwe/5NaGP+TWCD/jVMV/76KJ///0FD/+stJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/4yUj/ +MlK//fHTP/5y0T//tJS/82bOP+KUhP/k1sc/5hhIP+TWxr/mGEg/5VfGP+WYB3/ll4j/5Vd Iv+LVBf/w4wx//zKUf/3xkb/98RO//bER//1xUT/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/ 9sJI//XBR//1wUf/9cFH//TARv/0wEb/9MBG//TARv/0wEb/879H//O/R//zv0f/879H//O/ R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/zu0L/9bpI//K6Rf/ztlT/ 7cSC//769/////////////////////////////////////////////////////////////75 9v/sy3z/8rNT//O4SP/xu0H/8rpE//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S+Rv/zv0f/879H//O/R//zv0f/879G//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XB R//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/ 98ZM//fJRf/pt0b/m2Ma/5BVHv+PWB3/j1ke/49ZHf+OWR3/j1kd/41UGv+SVh//mGAV/+27 SP/7zUj/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykj/+stL//nIT//4yUL/9cg+//HC TP+TYBb/jVgX/5BaHf+MVxr/kVsa/49aFv+SXCD/j1gh/5FbHv+LWA//5LJE//rKRf/0xEP/ 9MFN//TDRv/3x0b/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//TA Rv/0wEb/9MBG//TARv/0wEb/879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/zu0L/87tH//K7Q//1t1D/67x1///17P////////////// //////////////////////////////////////////////328f/rxGz/87RV//S4Rv/vukH/ 8rpD//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/ R//zv0f/879G//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/ 9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/9sZM//bHQf/8zFD/uoQw/4xQ G/+NVxz/ilYa/4tWH/+NWSD/jFgb/5FXIv+GShP/vYcw//7OUf/5y0T/+MlJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykj/+spK//bFTP/5y0T/+s1A//vMTf/Dkj7/g1AM/4lVHP+OWiH/ iFYU/4hVFv+PWyf/jlkm/4NQDf+ufyb/+clQ//nJQP/2xUP/+cZR//LAQ//1w0P/98VI//bF R//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//TARv/0wEb/9MBG//TARv/0wEb/ 879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/yu0L/8rxF//O6Q//1t03/67hs//7x4f////////////////////////////////////// //////////////////////327f/ztWH/7LxX//m4Sv/vu0D/87tE//O7RP/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rf/yvkT/879F//O/Rf/0wEb/9MBG//TARv/0wEb/ 9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bF R//2xUf/98ZI//fGSP/4x0n/+MdK//fHSP/1x0H/8b9N/5xhJP+GUBf/iVUW/4tWGv+HUxn/ ilUc/4dNHv+XXxn/67tI//zOR//5yU7/+8tQ//nKSP/5ykn/+cpJ//nKSf/5ykn/+stK//rL Sv/6y0r/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//vMS//ww0v/m2kS/39LE/+KVST/ilke/4hYGf+GUh//hVAd/5Jf E//ouUv/+8tN//fGSP/3xkj/9sVH//bFR//3xkj/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/ 9sJI//XBR//1wUf/9cFH//XBR//1wUf/9MBG//TARv/zv0X/9MBG//TARv/zv0X/8r5E//O+ RP/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/zukT/8rtA//m3Sf/uuU// 8bZk///pzP////////////////////////////////////////////////////////////31 6f/xtFv/67tT//i4Sf/wu0L/87tF//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S9Rf/yvkT/879F//O/Rf/0wEb/9MBG//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XB R//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/ +spN//TESP/0xj//+8xJ/96rSv+GUh3/gE8Y/4NUD/+DUxT/f0wj/45YFv/drEb//tBS//jJ Q//7y1D/+clN//nKSP/5ykn/+cpJ//nKSf/5ykn/+stK//rLSv/6y0r/+stK//rLSv/6y0r/ +stK//rLSv/6y0r/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5zUj/369G/49bFP9+SRb/gU0d/4VSH/+BTBn/hVEQ/9CeP//6zE7/+MdH//fGSP/3xkj/ 9sVH//bFR//3xkj/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//XB R//1wUf/9MBG//TARv/zv0X/9MBG//TARv/zv0X/8r5E//O+RP/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/zukT/87xC//i3SP/uuU3/8bVf//7mx/////////////// //////////////////////////////////////////////vz4v/uslP/6btO//m4SP/xvEX/ 9LxH//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rf/yvkT/879F//O/ Rf/0wEb/9MBG//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/ 9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/9sdG//XFS//5ykf/+Ms+//zN Tv/bsEf/nG4e/4JPF/9+TQ//nG8b/96xP//80VL/98hE//nMSP/3x0n/+MlK//nKSf/5ykn/ +cpJ//nKSf/5ykn/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSP/5ykL/+85T/+i6VP+hbyT/ hFAQ/4hUEf+baBn/2ahH///RXP/zwz//+MdH//fGSf/3xkj/9sVH//bFR//3xkj/9sVH//bF R//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//XBR//1wUf/9MBG//TARv/zv0X/ 9MBG//TARv/zv0X/8r5E//O+RP/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/zu0T/9b5F//i3Sf/tukz/7rRY//nivv////////////////////////////////////// //////////////////////ny3P/ssUz/6LpL//m4SP/zvUj/9LxI//O7RP/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rf/yvkT/879F//O/Rf/0wEb/9MBG//TARv/0wEb/ 9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bF R//2xUf/98ZI//fGSP/4x0n/9sdA//bFTv/2xUz/9cc///bHQ//80Er/+sxO/+e1R//ouEn/ +MlN//rMSP/3yEb/98dK//vMTf/3yEX/+8xJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+stK//rL Sv/6y0r/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5x0n/9slG//XIRP/3y1L/47RK/+a3Sv/1x07/+cxH//nJ R//2xUv/98VJ//jHSf/3xkj/9sVH//bFR//3xkj/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/ 9sJI//XBR//1wUf/9cFH//XBR//1wUf/9MBG//TARv/zv0X/9MBG//TARv/zv0X/8r5E//O+ RP/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/0u0X/9r9I//i3Sf/tuUn/ 7LJR//Xftv////////////////////////////////////////////////////////////rx 4P/ws1X/7LtQ//u5Sv/yvEX/87tF//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S9Rf/yvkT/879F//O/Rf/0wEb/9MBG//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XB R//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/ 9sZG//TESP/3xkr/9MVF//nJSv/6y0z/+slI//vMSP/7y0j/+clK//nJSf/5ykn/+clK//jJ Sf/5y0n/+cpI//nKSf/5ykn/+cpJ//nKSf/5ykn/+stK//rLSv/6y0r/+stK//rLSv/6y0r/ +stK//rLSv/6y0r/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/4yEv/9cVG//rLSf/3yEf/+stN//vLTf/3yEf/98hG//bHR//1w0j/+cdK//fGSP/3xkj/ 9sVH//bFR//3xkj/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//XB R//1wUf/9MBG//TARv/zv0X/9MBG//TARv/zv0X/8r5E//O+RP/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/zu0T/8btD//e1SP/uukv/7bNT//bguP////////////// //////////////////////////////////////////////vx4v/ytFj/7bxS//y5S//yu0T/ 8rpE//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rf/yvkT/879F//O/ Rf/0wEb/9MBG//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/ 9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/9sZI//bGSP/3x0n/98dJ//jI Sv/4yEr/+MhK//jISv/4yEr/+MhK//nJSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/4yEr/+MhK//jISv/4yEr/ +MhK//jISv/3x0n/98dJ//bGSP/2xkj/+MdJ//fGSP/3xkj/9sVH//bFR//3xkj/9sVH//bF R//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//XBR//1wUf/9MBG//TARv/zv0X/ 9MBG//TARv/zv0X/8r5E//O+RP/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/0u0T/8LpB//e2SP/vu03/7rRU//jhuv////////////////////////////////////// //////////////////////vx4v/ytFj/7bxS//y5S//yu0T/8rpE//O7RP/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rf/yvkT/879F//O/Rf/0wEb/9MBG//TARv/0wEb/ 9cFH//XBR//1wUf/9cFH//XBR//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bF R//2xUf/98ZI//fGSP/4x0n/9sZI//bGSP/3x0n/98dJ//jISv/4yEr/+MhK//jISv/4yEr/ +MhK//nJSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+stK//rL Sv/6y0r/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/4yEr/+MhK//jISv/4yEr/+MhK//jISv/3x0n/98dJ//bG SP/2xkj/+MdJ//fGSP/3xkj/9sVH//bFR//3xkj/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/ 9sJI//XBR//1wUf/9cFH//XBR//1wUf/9MBG//TARv/zv0X/9MBG//TARv/zv0X/8r5E//O+ RP/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/0u0X/8rxC//i3Sf/wvE7/ 7rRV//jiu/////////////////////////////////////////////////////////////vx 4v/ytFj/7bxS//y5S//yu0T/8rpE//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S9Rf/yvkT/879F//O/Rf/0wEb/9MBG//TARv/0wEb/9cFH//XBR//1wUf/9cFH//XB R//2wkj/9sJI//fDSP/1xEb/9cRG//bFR//2xUf/98ZI//bFR//2xUf/98ZI//fGSP/4x0n/ 9sZI//bGSP/3x0n/98dJ//jISv/4yEr/+MhK//jISv/4yEr/+MhK//nJSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+stK//rLSv/6y0r/+stK//rLSv/6y0r/ +stK//rLSv/6y0r/+stK//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/4yEr/+MhK//jISv/4yEr/+MhK//jISv/3x0n/98dJ//bGSP/2xkj/+MdJ//fGSP/3xkj/ 9sVH//bFR//3xkj/9sVH//bFR//1xEb/9cRG//bDSP/2wkj/9sJI//XBR//1wUf/9cFH//XB R//1wUf/9MBG//TARv/zv0X/9MBG//TARv/zv0X/8r5E//O+RP/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/0u0X/8rxC//m3Sv/wvU7/77VV//jiuv////////////// //////////////////////////////////////////////vy5v/wt1n/8LpW//q6R//yuUb/ 8LtC//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rf/yvkX/879G//O/ Rv/0wEf/9MBJ//G+Sf/1wkj/88BE//O+RP/2wUn/871K//XASf/4w0r/+MRH//fDRP/0w0T/ 9cRE//fGRf/2xkT/9cRD//bFRv/2xUf/98ZI//fGSP/4x0n/9sZI//bGSP/3x0n/98dJ//jI Sv/4yEr/+MhK//jISv/4yEr/+MhK//nJSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//rLSv/6y0r/+stK//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/4yEr/+MhK//jISv/4yEr/ +MhK//jISv/3x0n/98dJ//bGSP/2xkj/+MdJ//fGSP/3xkj/9sVH//bFR//2xEb/+MZH//nG SP/3xEb/+MVI//fCSf/1wEn/98FK//bBSv/3wkv/98NF//jFQ//2wkr/98RJ//TBRf/zwEb/ 9MBH//TAR//zv0b/8r5F//O+Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/0u0T/8rxF//a5SP/0ulD/7rda//fkwv////////////////////////////////////// //////////////////////z17v/uvmL/87Zb//a6QP/0tkn/7r1A//S7RP/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rv/yvkb/879H//O/R//0wEj/9MFH//LCQ//0wkv/ 88BL//nETf/5xUj/+MNG//nERv/3wUb/9sBG//bBR//2xEn/+MVL//fFSv/1w0n/9MJI//bF R//2xUf/98ZI//fGSP/4x0n/9sZI//bGSP/3x0n/98dJ//jISv/4yEr/+MhK//jISv/4yEr/ +MhK//nJSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/4yEr/+MhK//jISv/4yEr/+MhK//jISv/3x0n/98dJ//bG SP/2xkj/98ZI//fGSP/3xkj/98ZI//fGSP/4xEn/+8ZM//nDSf/zvUP/98FH//fDQ//2wj// 98JD//nESP/7xU3/+sZI//nFT//yu1f/5bNA//LBQ//3xUz/9MBI//TASP/zv0f/8r5G//O+ Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/zu0P/8bpH//G7Rf/3tVL/ 7Lpg//fr0/////////////////////////////////////////////////////////////74 9f/zw3X/7rVX//W5RP/1t0j/77xC//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S9Rv/yvkb/879H//O/R//0v0n/9cJD//nIQ//Jkzf/m2Mb/7eDKf/Wpjj/6bhH//LB TP/4yE7/98dI//PEQ//0w0b/9MJG//TCSP/2xEv/98RM//bFSP/2xUf/98ZI//fGSP/4x0n/ 9sZI//bGSP/3x0n/98dJ//jISv/4yEr/+MhK//jISv/4yEr/+MhK//nJSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/4yEr/+MhK//jISv/4yEr/+MhK//jISv/3x0n/98dJ//bGSP/2xkj/98ZI//fGSP/3xkj/ 98ZI//jHSP/0w0T/88JD//TDQ//1xEL/98ZE//jIRf/5ykr/+chQ/+27S//apz7/x5M2/6Vv KP+ZYR7/sn0f//bDTP/zwEb/9MBI//TASP/zv0f/8r5G//O+Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/zu0T/8rpF//O7Rv/1tFT/6r1k//zw3/////////////// //////////////////////////////////////////////78/P/2yo3/6rNV//W5Sf/3uEj/ 8LxD//O7RP/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rv/yvkb/879H//O/ R//0wEj/88BD//nGTv/IkEX/gUgb/4VRH/+DURP/klwi/6FtJP+9jTD/2q08/+q9Q//2w03/ +shN//rISf/2xkD/8sM6//bFRv/2xUf/98ZI//fGSP/4x0n/9sZI//bGSP/3x0n/98dJ//jI Sv/4yEr/+MhK//jISv/4yEr/+MhK//nJSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/ +cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/4yEr/+MhK//jISv/4yEr/ +MhK//jISv/3x0n/98dJ//bGSP/2xkj/98ZI//fGSP/3xkj/98ZI//jHSP/4yEX/+clH//vK Tf/2xE7/6LZE/9ShQ/+/jD3/pnIm/5BbF/+GUBH/hFEV/4JPHP+FTxv/rXgf//rHUP/2w0f/ 9MBI//TASP/zv0f/8r5G//O+Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/zukb/9btD//O8Rv/xslX/6MFq///57v////////////////////////////////////// //////////////////////z////10J3/6LNV//W4S//4uUb/8bxE//O7RP/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S9Rv/yvkb/879H//O/R//0wEn/879C//jFRP/RnDz/ gk0N/4hWJP+EVCH/iVMf/4ZRGv+CTxX/hlMW/5FeHv+mbh//vYgv/9ekPv/quUT/+chK//zM Tf/7ykz/+clK//fHR//3x0f/98dI//bGSP/3x0j/98dI//jISv/4yEr/+MhK//jIS//4yEv/ +MhM//nJSv/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSP/5ykn/+ctJ//nK Sf/5ykn/+cpJ//nKSf/5ykn/+cpJ//nKSf/5ykr/+spJ//nKSf/5ykn/+cpJ//nLSf/5ykn/ +MlI//jKSP/5ykn/+cpJ//rLSf/4yEv/+MhL//jIS//4yEv/+MhK//jIS//3x0n/9sZH//bG Rv/3x0b/+MhI//rKS//7y07/+MdM//LBRv/ltEf/0J08/7eCK/+iayH/jVUV/4NOEv+DUBX/ gk8X/4NPGf+HURz/iFYd/4dXIv+EUBn/uYYo//nGSv/1wUP/9MBI//TASP/zv0f/8r5G//O+ Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/zukb/9bxC//S7SP/wslb/ 5sNw//799/////////////////////////////////////////////////////////////// ///z4rH/7bNV//izSf/vuzz/8b1J//O7Q//0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S+Rv/zv0f/879H//O/R//zv0f/875E//jCRf/cpT//iVEU/4ZOIf+JVh7/jVce/4pT G/+KVRz/ilYd/4ZTGf+GUBT/e0sU/31QGf+JVxv/o2oo/7OAKf/EkzD/3axA/+2+S//zxU7/ +8tO//zMTf/7y0v/+cpI//fIRv/1xkD/9cZA//bHRv/3x0n/+MhO//jISf/4yEf/+MhJ//nJ Sv/6yk3/+cpM//nJSv/4yUn/+MlJ//jISf/5yUn/+spL//jJSf/3yEj/9sdH//bHSP/3x0r/ +MhL//nKTf/6y07/+8xN//zNSf/7y0r/+clK//jISv/3x0v/+MhL//jJS//5ykr/+spL//vM Sv/4yUj/98hI//fIR//2x0b/9sdF//vMSv/9zU3//MxP//nJTv/3xk3/6r5K/9WpPf+9jzD/ qHcn/5dlH/+JVR3/hE8b/4NPGf+FUhr/hVIZ/4lXGf+HVRf/hFIY/4pVH/+LUBv/hk0W/4dS IP+ETBT/ypU3//jCR//zvkP/879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/zvEL/8LxA//a0VP/ytlP/7tGO///9/f////3///////// //////////////////////////////////////////////7////46cj/7bhg//a0Tf/wvD// 8b1K//O7Q//0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/ R//zv0f/875F//fBRP/jrUP/kVoZ/4ZOIf+HVRv/hVwa/4JWGv+CUh3/hlMn/4hSJ/+TVRr/ ilIa/4lVIP+GUhz/hk8Z/4ZOHP+DTBb/h1EV/5ZgHv+kbyn/uYUr/8eTMP/XpTz/6blI//bG Uf/5y07/+stK//nLR//7zEX//c9F//vNS//7zEz/+spK//jJSf/3yEf/+MhH//jJSP/5yUn/ +stK//rLS//6y0n/+MpF//nKRf/4yUX/+MlF//jJRP/4ykP/+ctD//nLQ//5zET/+sxF//rM R//6y0f/+cpK//nKS//5yUz/+8tL//rLSv/6y0v/+stL//vMS//8z0P//M5E//rLRv/4yEn/ 98dL/+m4Qf/erT//zJg8/7R9NP+jai3/jFgb/4dTF/+ETxf/gEsY/4VOIP+EVBz/hFYc/4NT HP+CTxv/iVQi/4xUI/+NUyH/iVIb/4VUGf+BVxn/glYa/4pUI/9/SAz/16NA//jCR//0v0X/ 879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7 RP/yu0L/8rxB//a3Vf/st1X/9t6s//7+/v////7///////////////////////////////// //////////////////////v//v/98ur/6sBw//O3Uv/zu0L/87tL//O7Q//0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S+Rv/zv0f/879H//O/R//zv0f/9L9H//fBRv/vukv/ nWYd/4ZPHf+GUR7/iFAf/4dQGv+KUhf/h1AN/4hRDP+GURv/iVEa/4dPGP+HURv/hlIf/4dR Iv+IUiL/iVQg/4hUHf+GUhj/hE0c/4dPGv+MVhn/lF4Z/5hlGf+sdij/u4Qw/8iTOf/XokL/ 4KxG/+e2Q//tvUP/9MRI//rKS//9zkv//c5K//zOSf/9zkr//c9K//3PSv/8zU3/+8tR//3M Uv/+zVP//85U///OVP/+z1L//s5R//zNUP/7y0//+8xM//3PRf/9z0j//s9L///QTv//0FD/ /dBN//rLSv/zw0X/7LtB/+e2Pv/ZpT7/zpo3/72IK/+rdR7/n2kX/5ZfH/+NVxv/hlAU/4ZP FP+KUxj/iFIe/4lUIf+IUx3/hE8Y/4lVG/+RViT/jlEg/4pQGP+JVBL/gE4G/4FNB/+ESwb/ jk8K/5RVGP+NViT/i1cn/4pVIv+HUQ7/5bFH//fCRv/1v0f/879H//O/R//zv0f/879H//O/ R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9LxF//O7RP/yukT/9bxF//W5Vf/mul3/ +evU//v+/v/+//7///////////////////////////////////////////////////////n/ +f//+f7/5sZ5/++5Vf/1vEX/9LtN//O7Q//0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S+Rv/zv0f/879H//O/R//zv0f/9MBI//fBRv/5xVH/pG8f/4ZQG/+DTxv/ilUe/4dW Iv+EWCb/mHZH/5Z3S/+ObEH/h1sm/31HCf+ETA7/hE8T/4NPFf+FUhj/iFUa/4hWGv+IVhn/ iVQe/4tWIP+NWCD/jVke/4xYG/+NVBv/jlMb/5BVGv+SVxn/lFoY/5tiHf+gaCD/pW0h/694 Jv+5gyz/xI8x/8uXNP/Qmzn/1aE+/9mlRP/dqj//4bE3/+OzOv/ltDz/57c+/+i3P//ntkD/ 5bQ+/+KxO//grzn/3q06/9mmQP/VoTz/zZk2/8eSMv/BjC7/sXwk/653Iv+mbiD/n2Yd/5lg Gv+TWBv/klgb/5JYG/+RVxr/kFYa/4xXHv+NVx//jVge/4xXGv+JVRb/iVUZ/4dSF/+HUhX/ h1IV/4JND/9+Rwj/g1AS/41jMP+dflj/uaOI/8G2of+2o4b/kmg5/4NPFP+HVBj/gU8Z/4ZR H/+aZRz/7LpJ//fCRf/zvUb/879H//O/R//zv0f/879H//O/R//1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9LxF//O7RP/zukb/+LtI//G5U//lwGX/+/Hq//n////+//7///////// //////////////////////////////////////////////n/9v/8/P//8tig//C3X//xuEz/ 8rxC//O7RP/zu0T/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//S9Rv/yvkb/8r5G//K+ Rv/yvkb/8r1H//bARf/5x0b/u4cx/4VPG/+GVRr/iVEU/4tcK//VysL//fjy//j5+P/u8Nz/ 3tbH/8m2pP+ymXr/lXtQ/4xkLf+HWx//g1ET/4NMEP+GSxL/i1MX/4xVF/+NVhf/jVgX/41a Gf+QVxj/k1ca/5RbHf+VXCD/lV0i/5ZaIP+YWiD/ml0j/5lgJf+YXyP/ml4c/5xeF/+bXRf/ mVwV/5dbE/+aWxf/nV4e/59fH/+fYB//oWIh/6FhIP+fYBz/n2Ac/59gHf+gYBz/nmEd/5xj HP+bYRr/ml8Y/5pdFf+aXRX/nWAj/5xgI/+aXyP/mF8i/5deIv+aXij/mVwm/5haIf+WVx3/ lVUZ/5NUHP+RVRv/jFUX/4RSEv9/Tw7/hFUR/4xeHf+LZCv/k3FC/6qLY//AsZr/zse2/+Pe 1P/z8vP/9fb//+3x/f/y9///49rK/4djJ/+JVRL/hlEb/4RNGf+0eyz/98FC//XAQf/yvU7/ 8r5G//K+Rv/yvkb/8r5G//O+Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/87tE//O7 RP/zukT/9LVI/+64Sf/ozIz//vr6//n9+v////////////////////////////////////// //////////////////////r+9//8/v//+uvH/+y2af/wt1H/8rxB//O7RP/zu0T/87tE//O7 RP/0vEX/9b1G//W9Rv/1vUb/9b1G//S9Rv/yvkb/8r5G//K+Rv/yvkb/8rxG//jCRv/0wz// 2aZH/4VQE/+DUxn/h04Y/5lqPf/v8/7/6+7y/+ny+v/r9Pb/7PD+/+/v///z8fj/9/Xv/+zj 6//k2dr/1Ma7/8KulP+zm3n/roBR/6NvO/+VXyf/kFgc/5RbG/+VWxr/k1cX/5JUEv+UVBH/ l1QP/5JaFf+QXRf/lF4X/5lfF/+cYhf/nGMc/5xkIP+dZSH/nmYi/6BoJP+gaCL/oGce/6Fo H/+haB//omkf/6NqIP+kaiP/o2ki/6FnIP+gZx//n2Ue/6NkHf+fZB7/nWQg/5pjIf+aYiD/ oVsP/59ZDv+ZVw3/lVUN/5NUDf+PXA3/kF4R/5BhFv+RZBz/kmYf/5NyK/+cfj7/q5Bc/7yk fv/HsZj/zb62/+HV0v/v5+j/8ev2//Tw///y9f//7/T8/+3x+P/s7/X/6+/0/+zx8f/m8Pr/ +Pr7/66OYf+ETw//h1Ia/4VNFf/Nkzn/+8VC//bCQ//xvU//8r5F//K+Rv/yvkb/8r5G//O+ Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//O7RP/zu0T/87tE//O7RP/zu0P/87dM/+m1UP/v3K// /f7///z+/P////////////////////////////////////////////////////////////3+ +//5/v7//ffo/+u+f//yuFT/87pH//O7Q//zu0T/87tE//O7RP/0vEX/9b1G//W9Rv/1vUb/ 9b1G//S9Rv/yvkb/8r5G//K+Rv/yvkb/9L9H//bARv/1wkb/779P/5pnGP9+Thn/g00b/591 RP/t9fr/5e7v/+Pt+f/p7ev/6e7z/+rv+f/o8Pj/5vD0/+Tz8//p9vn/7/f///P3/v/08/n/ 6/b3/+r09P/n7Or/3t7Y/9fSyf/Owq3/ybmd/8SvkP+8oID/tJVw/7eQZv+3il3/sYBP/6x0 Pv+mazL/pWgk/6VoHv+kZx7/pGce/6RnH/+kZx3/pmca/6ZnG/+naBv/p2gb/6ZnG/+mZh3/ pWYd/6ZmHP+mZhz/pmcd/6ltJv+scy//r3s9/7CDSP+wiFD/r5Bi/7SXav++oXn/xqqI/8uw kv/Qua3/1cK6/93Pyv/m3tn/6+jj/+3u8f/u8Pf/8PP8//L3///0+f//7Pf4/+jz8v/p8vL/ 7PPz/+zx8f/s7/P/7O/1/+zv9P/s7/T/7O/1/+nw6//p9v3/8PH9/7SVdf9+Tw3/hVIW/49Y Ff/osUb/+8RG//XBRv/xv0n/8r5G//K+Rv/yvkb/8r5G//O+Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//O7RP/zu0T/87tE//O7RP/zu0T/87xR/+e4bv/879f/+v7///39/f////7///////// ///////////////////////////////////////////////+/v/3//v//f7+//DPm//xtVP/ 87hK//O7Q//zu0T/87tE//O7RP/0vEX/9b1G//W9Rv/1vUb/9b1G//S9Rv/yvkb/8r5G//K+ Rv/yvkb/879E//O9Q//1wUr/9chJ/7yNLv+ATh3/iU8a/5RnLv/n7ej/8PTw/+nw+v/v9PL/ 7fLx/+rv7//p7/D/6vDx/+nv9v/p7vb/6O3u/+ru6P/s8Ob/6O/v/+vy9f/w9Pn/8vL5//Hv 9v/t9Pv/7Pf+//D4/P/x9/n/8PX1/+vz+v/o8fz/6vH5/+rv9P/q7fP/7Onm/+7m3f/t5t3/ 6+Tb/+ni2v/r49j/7eTV/+3k1f/u5db/7ubV/+/n2P/x6N//8urf//Pr4f/17OH/9O3k/+7w 7P/u8e7/7PLw/+vz8v/r8/L/7fLw/+3z8v/t9fb/7ff5/+74/P/w+fn/7vj6/+r2+f/n9fj/ 5PT4/+nz9//q9Pf/6vT0/+jz7v/o9Or/7O/2/+3u+//u7/r/7+/5/+/v+P/t7/X/7O/0/+zv 9P/s7/T/7O/1/+7y8//l7/v/7u3x/519T/+DTw7/iFIe/6dzJf/5xUv/9r5E//G9Rv/vvkH/ 8r5G//K+Rv/yvkb/8r5G//O+Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//O7RP/zu0T/87tE//O7 RP/zu0T/7blQ//DGlv/9+vb/+P39//38+v////3///////////////////////////////// //////////////////////79/v/4/fr/+v////jlwf/qsln/9rdO//O6Rv/zu0T/87tE//O7 RP/0u0X/9LxF//W9Rv/1vUb/9b1G//S9Rv/zvkb/875G//O+Rv/zvkb/8bxD//W/Rv/wvUX/ 9sdH/9uqRP+HURn/jVAY/4RRFf+uo4r//Pzu/+vw/f/t8fz/6+vy//Hu8P/u7/X/6+/7/+zx +P/r8Pf/6u73/+rt+P/q7fn/6+7y/+zw9P/t8Pj/6+/6/+jt+v/t7vb/7u70/+3u9v/u8Pn/ 7/P7/+/y9f/t8vH/6/Hx/+rw8v/o8PH/6/H1/+7y+P/w9Pn/8vb7//L3+//2+f7/+vv///r8 ///6/f///P7///z+///8////+/7///r8///4+/7/9/r9//P4/v/x9vz/7/P4/+3w9f/s7vT/ 6+76/+vv+f/r8Pj/6vH4/+nx9//o7vb/6e71/+vv9f/t8PX/7/D1/+vv7//r7vD/7O7z/+3u 9P/u7vT/6Orx/+vt9P/x8ff/7/H2/+rv9P/q8/T/6vDz/+3x+P/u8Pf/7e7w/+vt9f/09fv/ xLOZ/3xQFf+MVRj/gUsV/8mVPf/8yUr/871B//TARv/uvD//875H//O+Rv/zvkb/875G//S+ Rv/1vUb/9b1G//W9Rv/0vEX/9LxG//S7Rf/0u0L/87tC//K7Rv/yukn/6rRP//fdvv/8+/// +f/7///8+f////7///////////////////////////////////////////////////////7/ /f/8+/3//v7////77v/qvnz/9LVR//O5Tf/zukb/87tE//O6Rf/zukb/87tE//S8Rf/0vEX/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/87xH//TATP/xvUD/+MRK//K7Uv+nbhn/hE0X/4dP G/+AVRz/u6qK/+/t8f/o9v//6vP2//H09f/w9fb/5vDy/+vv8//s7/T/7O/0/+zv9P/s7/T/ 7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv 9P/s7/T/7fD1/+3w9f/v8vf/8fT5//L1+v/2+Pv/+vr6//v7+//8/Pz//f39//7+/v/9/f// /f3///v7/f/6+vz/+fn8//L1+v/x9Pn/7/L3/+7x9v/t8PX/7O/0/+zv9P/s7/T/7O/0/+zv 9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/6fH3/+zv9P/w7fT/ 8vD2/+3y9v/o7vP/7/T0/+nw6f/u8/H/7/P9//Pw9f/Aq5P/hFQc/5FTHP+DTxn/lWQZ/+21 Tv/3w0r/9cRB//XCRv/0v0n/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/ 87tF//W6R//1uz//8rxA//G6S//wt1P/8bdl//vy4//3/////P73///7/P////////////// //////////////////////////////////////////////z8/f/+/P7//f7/////9v/13K7/ 67Nc//S4UP/zukj/87tE//O6Rf/zukX/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b5J//S/Tf/yvkP/98RF//nFSv/NmS7/gUsS/41UIv+IVRr/fVQb/6aHY//a08f/ 7vf2/+b5///j8/r/7fL0/+3v9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv 9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7fD1/+3w9f/v8vf/ 8fT5//L1+v/19/r/+fn5//r6+v/7+/v//f39//39/v/9/f///Pz+//r6/P/6+vz/+Pj7//L1 +v/x9Pn/7/L3/+7x9v/t8PX/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/ 7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/6e3v/+vu8v/q7vf/5u33/+Xx+f/n9e7/6vLz//X0 ///17Pf/1Mi1/5l9V/9/Ux//jFcY/41SHP+ATBX/uYcw//zHT//0wUP/88BD//XATP/zvEz/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/87tF//W6R//1ukL/8rtE//G5 UP/utVv/8M6V///87v/3/v///f38///+/v////////////////////////////////////// //////////////////////39/v///vz//f/+//r//v/59OD/7r12//O2U//zuUz/87pF//O7 RP/zu0T/87tE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b5I//PASv/yvkb/ 9MBG//fER//2xEv/nGoc/4VMGP+KURv/jFcW/39JC/+MWB7/sZNs/97Vyf/v9fb/7Pf//+3w 9v/s8PX/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/ 7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7fD1/+3w9f/v8vf/8fT5//L1+v/19/r/+Pj4//r6 +v/6+vr//Pz8//z8/f/8/P7/+/v9//r6/P/5+fv/9/j6//L1+v/x9Pn/7/L3/+7x9v/t8PX/ 7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv9P/s7/T/7O/0/+zv 9P/s7/T/7vHv/+nv8P/o8Pj/8PT6//X28f/q8O7/4+Pe/8Szmv+bdk7/hUwW/4lNE/+HURH/ jlkd/4VOGv+YYRv/7rpP//TBQv/yvkP/8r5E//bBTP/wukT/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//S8Rf/zu0T/87tF//W5SP/1ukT/8rpJ//G4Vv/vtmr/9ejQ//r/9//6/f// //v///3//P/+//7////////////////////////////////////////////////////////+ /////fz/+/77//T+///9/vz/982U//K0U//zuE//87pG//O7RP/zu0T/87tE//S8Rf/0vEX/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9L1F//K/Rv/yvkj/8r1L//G9Sf/2wkv/16M8/4xV Gv+FTh7/iVQY/4tWGP+IVxv/hlAV/4lUIf+ieVT/ya6Y/+Xk4//s7u//8vT4//L1+//t8fj/ 6/D2/+rw9f/r7/X/7O/0/+zv8//s7/T/7O/0/+zu9P/t7/X/7e/2/+zv9f/r7/T/7PD1/+zv 9v/r7vb/7e/1/+3w8//v8vb/8fT4//L1+f/19/n/9vn5//f6+v/4+vv/+fv8//r8/v/6/P7/ +vz+//j6/P/2+fv/9fj7//T0+f/y8/j/8fH3//Dw9v/u8PX/7PD0/+vw9P/r8PP/6+/z/+rv 8//s8PL/7PDz/+zw8//s8PP/7PDz/+vw9f/q7/T/6+/1/+3x+P/x9Pz/9Pf1/+7y8v/r7e// 3dbN/7iljf+me1r/ilgn/4JSDP+FVQz/iVUb/4xSH/+NVx//hVcl/35NF//Nljn/+cJJ//XC Sf/2wkr/879F//K/QP/3w0b/9bxG//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/ 87tF//W5SP/1u0b/8rhL//G2Wv/xvHf/+vr1//X++v/7/v7///v///r+9//+//3///////// //////////////////////////////////////////////////////////////7///////// /O/e/+m+Xv/1r1X/8rtL//K6RP/5u0T/8rtE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9L5G//O/R//zv0f/879H//O/R//zwEL/9MJJ/611Mv+EThf/iFcV/4ZWGv+HVRz/ iFQb/4lTGf+EThX/hVEY/4thIv+ceET/uJ18/9TEt//m3dz/6fH3/+z2/P/w+f//8Pf//+zy +f/u9Pz/7vP9/+rw9v/q7/L/6+/u/+rw6//p7+v/6+/v/+3u8f/t7/T/7O/z/+vv8v/t8fP/ 7/P1//D09v/x9/f/8fr1//P69v/0+fb/9ff1//X49P/3+fT/9vr1//T59f/y+Pb/8vj2//T4 9v/y9/b/8PT3/+/y+P/t8Pf/6vDy/+nw8v/o8PP/6PDz/+jx8v/s8/P/7fT2/+71+v/u9/7/ 7/f//+v2///t9vz/7e/u/+Tc1P/YzL3/w6yU/6+NZv+abTb/iVcX/4FPEf+DThP/iFIX/4lU Gv+JVRz/h1Qa/4ZUGP+IVx//gU0X/55oHv/xvk3/9sND//O/SP/zv0j/879H//O/Rv/1v0f/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/9LtF//W7Rv/zvkv/965W/+u1 Vf/z58H//v////7//////////////////v////////////////////////////////////// //////////////////////////////////////////////////v5//PTpf/ss03/8LhK//G6 O//2uk7/87tD//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9L5G//O/R//zv0f/ 879H//O/R//yvkX/98VJ/+m2Sv+WYB7/h1Ei/4JRE/+IVBv/iFQb/4hUG/+IVBv/iFMb/41Q HP+IThb/g08S/4ZZFv+LYhv/nW45/7WKYP/GqYv/z7+t/9nTyP/k5OD/6uvu/+7z+P/s9/v/ 6fb6//D2/f/y9v//7PX//+b1/P/i9vf/6vX5//D0+//u8/r/7fH4/+zw9//t8vf/8fb2//T1 +P/29vr/9/f7//f2+//09fr/9PX6//T1+f/29fj/8/X5/+rz+v/r9Pn/6/X3/+v29P/r9fb/ 6/X//+30///x8/z/8vL0//Xy8P/17P//7uPv/+HV0f/UxrD/zLye/8Kifv+uiWD/lm49/4pd If+JWhb/flEP/4NSDv+MVhL/jlYd/4pTKv+IVCH/iFQb/4hUG/+IVBv/iFQb/4hVIP+GUx3/ hVEP/92pS//8yE3/9sNC//O+R//zv0f/879H//O/R//0vkf/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//S8Rf/zu0T/9LtG//S6Sv/vuT//8rNY/+fBev//+/T///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7///vv6P/owmv/8bRM//W9RP/uuEz/87tD//S8Rf/0vEX/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9L5G//O/R//zv0f/879H//O/R//0v0n/8rtA//zK Q//NmD3/h1Ac/4ZTF/+IVBr/iFQb/4hUG/+IVBv/iFQb/4pYGf+LWRn/jVoa/49aGv+PWRn/ jVgS/5BaD/+JUwv/h1EK/5dhG/+gbyX/o3Uv/62DSf+9l2r/zKmE/9K5nP/Uw6f/2cy5/9/X zf/j3dj/5eXl/+fs7P/r7+//7/P0//P39//1+fv/9fv///X8///2/P//9vz///X8///y+/// 9f3///f8///6/f//+fr+//Tx8P/u6+r/5uPh/93b1v/Z1sz/2cy2/9PAp//FrY7/uZx3/7CQ Zv+jfjn/n3cr/5trIv+VXhv/klUa/4xVDf+OWA7/kloT/5JZFv+PVxT/k1Yg/5JXHv+NWBj/ i1gV/4pXFf+JVRn/iFQb/4hUG/+IVBv/iFQb/4ZRH/+EUBP/xJE1//fFUP/zvUD/9L5E//O/ R//zv0f/879H//O/R//0vkf/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/ 8rpJ//C6P//2uFH/5rpe//Xkzv////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /v/5//z+/v/026//9rVS//S3V//svkL/9LtE//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9L5G//O/R//zv0f/879H//O/R//yvUX/+MBJ//K8Q//1w0v/tIAo/4RNHv+IVBv/ iFQb/4hUG/+IVBv/iFQb/4dUGv+JVhz/i1ce/4xYH/+MVx7/iVkg/4xaIP+PWB7/k1gd/5td H/+aWiL/mFkf/5hbGv+YXBP/llwN/5ZYDP+YWA3/nF0T/6VkH/+tbCn/rXUy/616Of+yfzz/ uIVD/72KSP/AkFH/wpZh/8Wbaf/JoXP/y6d8/8+tgv/SsYX/zKh6/8Oaaf+8jlr/uIdL/7qD Nv+1fjP/rnct/6hxKf+kayP/oV0T/6FcEv+gXBD/oFwP/6BbEP+aWxn/m1wa/5xcG/+dXB3/ nVwe/5paJ/+XWib/k1sg/45bHP+KWxf/jVYd/4tXIf+HWx//h1ga/4tTE/+JUxj/iFQc/4hU G/+IVBv/iFQb/4RPGv+pdCr/8b9L//bEP//yuET/9bxN//O/Rv/zv0f/879H//O/R//0vkf/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/8bxB//C5SP/1sFn/8c+V//38 /v/+//j////+//////////////////////////////////////////////////////////// ////////////////////////////////////////////////+//w//r8/P/+8ez/78Rx/+uz Wf/yvFH/87tB//O7Rv/zu0b/9LtG//S8Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//S+Rv/0vkb/ 9L5G//S+Rv/0vkX/8Lo///W/S//1wUj/8r1P/6VtHf+BTh3/ilYd/4lVGP+JVBr/jFYg/4tU Hf+MVR3/jFYb/41XGf+NWBf/jlgV/49ZFf+QWxj/kV4d/5FeH/+TXxv/lWAa/5hiHf+aYx// m2Ig/5tiIv+dYyL/oGYi/6JnHv+iZxr/pGYZ/6ZlGf+mZhn/pmYa/6dnG/+qZxj/rWUT/6xm Fv+rZhf/q2cZ/6toG/+raB7/rGgc/61mGf+tZRb/rWUX/6loH/+paCD/qWch/6lnI/+oZyP/ pGgj/6JnIv+gZiP/nmUi/51kIv+dYSH/nGEg/5pgH/+YXx//ll8e/5dcGv+WWxz/k1oe/5FZ Iv+NViP/jVkb/4tZG/+IWR3/iFYd/4tUHv+IURv/iFIb/4lVHv+HUxz/hlMf/5pmFf/msUX/ +MVL//G+QP/3wUz/8LhF//W+Rv/0vkb/9L5G//S+Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//S8 Rf/1vEb/9LlF//O4RP/1ukP/97tC//S1V//suWz//e/V//z////3//b//v/+//////////// //////////////////////////////////////////////////////////////////////// /////////////////////////v73//78/v/9+v3/9ue+/+W0X//ztU7/87pH//O6R//zukb/ 87pF//O6RP/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vkb/8sBC//rG TP/yvUn/9L9O/+y2S/+bZyT/gkwS/4dQGv+MVR3/h1EU/4lVGf+KVhr/ilYa/4tXG/+LVxv/ j1gc/5FZHf+RWR3/k1se/5RcH/+XXR7/mV4e/5pfH/+cYSH/nGEh/55jIP+fYx//oWQg/6Fl If+jZyT/pmci/6hoIf+paSL/qmoj/6trJP+sayP/rWsh/61sIf+ubCH/r20h/69tI/+vayX/ rmsk/61rJP+taiT/rWoj/6trJP+rayT/qWki/6hoIf+nZyH/o2cj/6JmIv+hZCD/oGQg/59j H/+dYiL/nGEh/5tgIP+ZXh7/mF0d/5VcH/+TWx7/klod/5FZG/+QWBr/jFcb/4tXG/+LVxv/ ilYa/4pWGv+KVBn/ilMf/4tTJP+FUBj/kF4U/9+tQf/7x0v/98NL/++7RP/yvkb/9b9H//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/87tE//O7RP/yukT/9LlF//W5R//0uUf/ +LlJ/+2uVf/02LL/+v7y//r/+P/9/f7///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //r///z8+//0//7/+/z5//LQlf/rtE7/9LhU//O6Sv/zukT/87pF//O6Rf/zu0T/87tE//S8 Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vkb/9cJH//C8Qv/yvkf/8bxH//TAS//ir0f/ kVsS/4hRHP+JUh3/iVcU/4hVGP+KVhr/ilYa/4tXG/+LVxv/j1gb/5FZHP+RWRz/k1se/5Rc H/+XXR7/mV4e/5pfH/+cYSH/nGEi/55iH/+eYh7/oGQg/6FlIf+iZiL/pWch/6hnIP+oaCH/ qWki/6trJP+rayL/rGoh/61qIf+tayL/rmsj/65sJP+uayT/rmsk/61qI/+taiP/rGki/6tr JP+qaiP/qGgh/6hoIf+mZyD/omYi/6FlIf+gZCD/n2Mf/55iHv+dYiH/nGEh/5tgIP+ZXh7/ mF0d/5VcH/+TWx7/klod/5FZHP+QWBv/jFcb/4tXG/+LVxv/ilYa/4pWGv+LVxz/ilQf/4lQ H/+OWBH/2qg8//bESf/0wEj/98NL//fDS//zv0f/875G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/0vEX/87tE//O6Q//zuEP/9rxG//a9S//xulD/7bRP/+/Eff/+8/H/9P/8//f/ 7f//+/z///7///////////////////////////////////////////////////////////// //////////////////////////////////////////////////z///r8+f/z/vv/+v////33 4v/uw4P/9LNb//O5Tv/zu0L/87tE//O6Rv/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/0vUX/879G//C8Qv/vu0H/9cJH//XBRf/8xUn/5K5I/5JcEv+DTRT/iFUg/4pX G/+KVhr/ilYa/4tXG/+LVxv/j1gb/5FZHP+RWRz/k1se/5RcH/+XXR7/mV4e/5pfH/+cYSH/ nGEi/51hH/+eYh7/n2Mf/6BkIP+hZSH/pGYg/6ZmH/+oaCH/qGgh/6pqI/+qaSP/q2gi/6xp I/+saSP/rWok/61qJP+taiP/rWoj/6xpIv+saSL/q2gh/6pqI/+paSL/qGgh/6dnIP+lZh// oWUh/6FlIf+fYx//nmIe/51hHv+dYiH/nGEh/5tgIP+ZXh7/mF0d/5VcH/+TWx7/klod/5FZ HP+QWBv/jFcb/4tXG/+LVxv/ilYa/4pWGf+HVB3/gk8U/4xWDP/Zo0D/9r9G//O/Q//zv0j/ 8b1F//G9Rf/xvkb/8btD//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/87tE//O6 Rf/2uET/9LpD//C8SP/tuVf/6rhp//bsz//+/f//+Pz///z/+f/++/3///////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////f/9//r+/P/3/Pn////+//7+///74s//7bZe//G3Tv/zuEf/ 8rlF//O7RP/zu0X/87tF//S7Rv/0vEb/9LxG//S8Rf/0vEX/9b1G//W9Rv/1vkb/8LtE//K9 RP/zvkT/879E//XAQ//3v0P/+sRN/+GuSf+WYBn/g00d/4pWIP+LVxz/i1ga/4tXGf+NWBz/ j1gb/5FZHP+RWRz/k1se/5RcH/+XXR7/mF4e/5lfH/+bYSH/m2Ei/51hH/+dYR3/nmMf/59j H/+hZSH/o2Uf/6VmH/+mZyD/p2gh/6doIv+paSL/qmgi/6tpIv+raSP/rGok/6xqI/+saiP/ q2ki/6tpIv+qaCH/qmgh/6doIv+naCL/pmcg/6VmH/+kZR//oWUh/6BkIP+eYx//nmIe/51h Hf+cYiH/m2Eh/5pgIP+YXh7/l10d/5VcH/+TWx7/klod/5FZHP+QWBv/jFYa/4xYG/+LVxn/ iVUZ/4lWHf+DThr/k18X/9mmPf/2wkn/9r5I//O9R//0v0f/9sBJ//O+Rv/yvUb/9b5H//W9 Rv/1vUb/9b1G//S8Rf/0vEX/9LxE//S8Rf/0vEX/87tE//S6R//2ukj/77k+//G2UP/quFb/ 78+e//z+/f/+/vj///r9///8///7/Pz////+//////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////v//792n/+m4TP/4tFX/8rhG/++9Qf/zukj/87pH//O6 R//zukf/87pG//O7RP/zu0T/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rv/yvkb/ 8r9B//TAR//uuVT/pmwd/35KE/+LVx//jVkd/4xXGf+MVhj/kVkc/5BYG/+RWRz/k1se/5Rc H/+VXB3/llwd/5heH/+ZXyD/mmAh/5thHv+cYR3/nWIe/55jH/+gZSH/oWUg/6FlH/+iZiD/ omYg/6NnIf+lZyH/qGgh/6hoIf+oaCH/qGgh/6hoIf+oaCH/qGgh/6hoIf+oaCH/p2gh/6Nn If+jZyH/omYg/6JmIP+hZR//oGUh/59kIP+dYh7/nWIe/5xhHf+aYCH/mV8g/5lfIP+XXR7/ llwd/5RcH/+TWx7/klod/5FZHP+QWBv/j1ga/4tVGP+LVhv/hlIZ/4JPF/+iax3/4KlC//jE TP/wvT//879J//S9Sf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//O7RP/zu0P/ 87tB//O7Q//zu0T/87pG//S6Sv/yu0j/8rlL/+6wVv/vzJD/+/nw//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///7//r//fn5//HNjP/ztkr/77hE//G+Tv/zukb/87pH//O6R//zukf/87pG//O7RP/zu0T/ 9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/xvUb/88BE//PAQf/0wUr/8bxP/7SB KP+FTg3/kFgn/45WI/+LVxX/j1gZ/5BXG/+RWRz/klod/5NbHv+VWx3/llwd/5ddHv+ZXyD/ mV8h/5tgHv+bYBz/nWIe/51iHv+fZCD/oGQf/6FlH/+hZR//omYg/6JmIP+kZiD/p2cg/6dn IP+nZyD/p2cg/6dnIP+nZyD/p2cg/6dnIP+nZyD/pmcg/6JmIP+iZiD/oWUf/6FlH/+gZB7/ n2Qg/55jH/+dYh7/nGEd/5tgHP+aYCD/mV8g/5heH/+WXB3/lVsc/5NbHv+SWh3/kVkc/5BY G/+PVxr/jVcd/49XJf+NVST/gUsM/7B+Jv/suEr//MhQ//XDQ//wvUD/98JP//a/S//1vUX/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//O7RP/zu0P/87tD//O7RP/zukb/87pI//K8 R//4u0r/97FU/+LGc//58vT////u//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////6////+/3////y7P/kxGr/ 6rZh//S9Tf/zukf/87pH//O6R//zukf/87pG//O7RP/zu0T/9LxF//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/yvkb/77tC//G+Qf/0wUP/88BC//bBSf/SnD3/j1gV/4ZQF/+JVxf/ jVYZ/49XGv+QWBv/kVkc/5JaHf+UWhz/lVsc/5ZcHf+YXh//mF4g/5pfHf+aXxv/nGEd/5xh Hf+eYx//n2Me/6BkHv+gZB7/oWUf/6FlH/+jZR//pWUe/6VlHv+lZR7/pWUe/6VlHv+lZR7/ pWUe/6VlHv+lZR7/pGUe/6FlH/+hZR//oGQe/6BkHv+fYx3/nmMf/51iHv+cYR3/m2Ac/5pf G/+ZXx//mF4f/5ddHv+VWxz/lFob/5JaHf+RWRz/kFgb/49XGv+OVhn/i1cf/4ZSFv+SXBX/ y5U6//PAUv/2w0f/88BD//G9Qf/yvkX/9cFL//S+SP/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/0vEX/9LxF//O7RP/zu0T/87pF//O6R//zukj/87lK//O5Sv/xtFb/6btr//ju2//3//r/ /fv5//////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////f3//v37//r+///38Nr/7sRy//W1Uv/zukX/87pH//O6 SP/zu0b/87pH//O7RP/zu0T/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0wEX/ 9MBH//XBSv/yvkb/8r9E//jCPv/7xUv/57JL/6FuIv+GVBn/ilMY/45WGv+PVxr/kVkc/5Fa HP+UWhv/lFoc/5ZcHf+WXB7/mF4f/5lfHP+aXxv/m2Ac/5xhHf+dYx//n2Me/59jHf+gZB7/ oGQe/6FlH/+iZR7/pGQd/6RkHf+kZB3/pGQd/6RkHf+kZB3/pGQd/6RkHf+kZB3/o2Qd/6Fl H/+hZR//oGQe/6BkHv+fYx3/nmMf/51iHv+bYBz/m2Ac/5pfG/+YXh//l10e/5ddHv+VWxz/ k1kb/5JaHf+RWRz/j1cb/49XG/+MVBf/iFQb/6FwIf/fr0L/+sVO//W8Sv/0vkv/8r5K//XA Tv/0v0r/8r5G//S+Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//O7RP/zu0T/ 87pH//O6SP/zukr/87lN//OySv/wt2T/9erK/////P/8/PL/+f76//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////Pn//v77//n9////////+uvH/+q+dv/xs0v/77lU/+28O//0vj//9LhN//O7Q//zu0T/ 87tE//O7RP/zu0T/9LxF//S8Rf/0vEX/9LxF//S8Rf/1vkb/9b5H//S9Rv/1vUb/9LxG//XA Rv/1wEf/8LxE//fDTv/Nmir/mmEb/4lPFv+NVR//jlkc/41bFf+SXCD/k1og/5JaHP+TWx3/ lV4h/5ddH/+YXh7/mF4f/5lfH/+ZXyD/m2Eh/51iIf+eYyL/nmMi/59kI/+fZCL/oGQg/6Bk IP+gZCD/oGQg/6BkIP+gZCD/oGQg/6BkIP+gZCD/oGQh/59kI/+fZCP/nmMi/51iIf+dYiH/ ml8g/5lfIP+YXh//mF4f/5heHv+YYCb/lV0h/5NbHf+RWhz/kVgd/49bH/+SXSX/jVUh/4dQ Ff+XXhn/xI8n//G9Sf/2w0r/879G//bBSv/zvUb/9L1H//W9R//1vUb/9b1G//S8Rf/0vEX/ 9LxF//S8Rf/0vEX/9LxF//O7RP/zu0T/87tE//O7RP/zuEb/9LdI//PBP//vu07/8LJd//G2 Yf/438T///74//n8/f/9/v3//v36//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////f7///3///r//v/7//r/ ///3//jlyv/ounf/7bZL//e6P//zuEj/875C//O7RP/zu0T/87tE//O7RP/zu0T/9LxF//S8 Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//O/R//2wkr/9MBI//C8RP/3wkn/ 7LhO/7yILP+TXhT/iFMV/4xXH/+TXCD/kFka/49YFv+SXBb/lWAU/5deG/+XXR//mF4f/5he H/+ZXyD/m2Ah/5xhIf+dYiL/nWIi/55jI/+eYyH/nmMf/55jH/+eYx//nmMf/55jH/+eYx// nmMf/55jH/+eYx//nmMg/55jI/+eYyP/nWIi/5xhIf+cYSH/mV8g/5lfIP+YXh//l10e/5dd Hv+WYBn/kl0W/5JcGP+UXRv/k1wa/45ZHf+IVBT/kFsR/7yHLf/ksEf/+MRN//bCSf/vu0P/ 7rpD//K+Rv/1vkf/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//O7 RP/zu0T/87tE//O7Q//zvEr/8bs///a4Q//ztlL/67ti//nav////vn//f/9//f8///8/v7/ //76//////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////f////3///3/+//6//v/+Pz///38///56Mf/68Bq//Gv Wf/3vE3/875F//O7RP/zu0T/87tE//O7RP/zu0T/9LxF//S8Rf/0vEX/9LxF//S8Rf/1vUb/ 9b1G//W9Rv/1vUb/9b1G//K+Rv/vu0P/879H//XBSf/xvUX/7707//fFSv/qtk7/u4Y1/5Re Hv+IURL/jlYb/5JZJf+PVyD/kVoa/5VdHP+WXB7/l10e/5ddHv+YXh//mV8f/5pfH/+bYCD/ m2Ag/5xhIf+cYR//nGEd/5xhHf+cYR3/nGEd/5xhHf+cYR3/nGEd/5xhHf+cYR3/nGEe/5xh If+cYSH/m2Ag/5tgIP+aXx//mF4f/5heH/+XXR7/llwd/5ZcHf+VXh//ll4m/5FZI/+NVRr/ kFkX/5NfE/+0gSn/5rNL//jGTv/2w0H/+cVK/++7Q//1wUn/98NL//O/R//1vkf/9b1G//W9 Rv/1vUb/9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//O7RP/zu0T/87tE//O7Rf/xvT// 77pN//OzXP/uu1//9Nu2//78/v/5/f//+f3///z////+//3///76//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///+/v7//f39//38/v/+/P///f3+//v++v/9/v//+enT/+e/df/vslr/8rNC//O8Q//zu0T/ 87tE//O7Rf/zu0P/9LxF//S8Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G/+66 Qv/yvkb/8r5G//TASP/yv0f/879G//XDSP/0wkT/+shT/+i2S//CkS7/o28e/4xUGf+MUx7/ kFgc/5RbGv+WXBz/llwd/5dcHf+XXR7/mF4e/5leHv+ZXh7/ml8f/5pfH/+bYB7/m2Ac/5tg HP+bYBz/m2Ac/5tgHP+bYBz/m2Ac/5tgHP+bYBz/m2Ad/5pfIP+aXx//mV4e/5leHv+ZXh7/ l10e/5ddHv+WXB3/llwd/5VcHP+RWR3/jVQh/4pSG/+eaR//w5Ix/+OyRv/4yFL/+MdJ//G9 QP/1v0j/+cRN//C8RP/wvET/8b5F//G+Rv/0vkb/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/ 9LxF//S8Rf/0vEX/9LxF//O8RP/zu0T/87tE//O7Q//0vEf/8rhW/+i7bf/137r//f3+//f9 ///9/v3//f78//7++////v3//v/+//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////7////+///8/////P// //79//3/+P/5/fr//v7///3w2f/ownD/67BU//a1Tf/zvEP/8L1D/++6PP/1ukz/87tG//O7 Rv/zu0b/87tG//O7Rv/0vEX/9LxF//S8Rf/0vEX/9LxF//O8Rf/yvET/9L5G//W/R//2v0j/ 9r5L//S8Rv/0v0L/9sFE//TARP/2xEn/8L1K/9mlP/+4gij/nmcU/5NaHP+TWSP/k1og/5Na Hv+VXB7/ll0e/5ZdHv+XXh7/l14d/5hfHP+aYBz/nGEd/5tgHP+aXxv/mV8b/5pfG/+bYBz/ m2Ac/5pfHP+aXxv/mV8c/5lgHf+ZYB7/mF8f/5hfH/+YXx//l18d/5RcHP+SWRz/kFcd/49W HP+cZBX/t4Ap/9ijQP/vvEr/8sFG//XARv/0v0T/9cBE//W+Rv/0vEr/9L1H//O9Rf/zvEX/ 871F//S9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/zu0T/87tE//O7RP/zvET/9LlH//G1 RP/yu0j/879D//S5Q//ytFv/6r9s//fjvv///P//9/z8//r9+f///fz////8///+/f////// /v////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////f/+/f3//P7///// +//67sn/6cl+/+uxWP/xtVb/97xG//W7S//yvTr/87pH//O6R//zukf/87pH//O6R//0vEX/ 9LxF//S8Rf/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/0vkj/8r5F//XBR//3wk//77hQ/9ejP/+/iy3/qHAe/5dfGf+TWR7/kFYc/5FWGv+TWR// l1wj/5leJ/+bYCb/nGAh/5tgIf+bXyD/ml8g/5tgIf+cYSL/m2Ah/5pfIP+ZXh//mV0g/5hd Jv+WXCP/lFkf/5FWG/+QVRn/k1ke/5hfG/+mbx7/v4kt/9ahPf/stU3/+sRS//jESP/wvUD/ +MRM//e+R//1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//S8Rf/zu0T/87tE//O7RP/zu0X/87tC//W4Rf/3u0H/9rlY/+2yY//swmb/ +efF///6+//9/v///f78/////P////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////+/////f///f/+//v//f/+//3//fXq/+zQk//os1// +7hY//S7Pf/vvkz/87pH//O6R//zukf/87pH//O6R//0vEX/9LxF//S8Rf/0vEX/9LxF//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zvkn/8r5H//O/Rf/0wUb/ 9sJH//TEQP/0xEH/8sBK/+m0Sv/XokD/woww/7Z/KP+udiT/oWge/5heGP+SWBX/kVYU/5JX Ff+UWRb/lVoX/5ZbGP+VWhj/lFkX/5NYFf+RVhT/kFUT/5VaFv+cYxv/qXAh/7R9J/+9hyz/ 1qBB/+eyS//0wU7/9sVH//XFP//zwUH/8L4+//G9QP/zv0X/9cFI//W+Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vEX/9LxF//S8Rf/0vEX/9LxF//O7Rf/zukb/ 87pG//O6Rv/zukb/8r1F//G6Pf/6tlT/7rJZ/+jHf//9797///3///3+///8//v///78///8 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////+/fz/+/v6//3+/v/8/v///P////z59v/23rP/679j/+62Xv/xuFL/87pF//O6 R//zukf/87pH//O6R//0vEX/9LxF//S8Rf/0vEX/9LxF//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1wEb/9cJK//K9Sf/uukP/8r9B//K+Rv/zvkj/9MBE//TC Qf/4xUD/+cZH//fCSv/yvUf/67VE/+exQv/gqkL/16FC/9WfPv/Rmzv/zpc3/8uVNf/LlTT/ z5k5/9OdPf/YoUL/3adD/+awQv/rtUX/8r1I//jDTP/8yE3/98VB//XCQv/0v0T/875J//K9 Sf/zwD//8r9D//O/SP/yv0b/8L1A//S9Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/0vEX/87tE//O7RP/zu0T/87tE//O6R//zukn/87pJ//O6Sf/zukf/87hP//O2 Xf/ruVf/89KZ//307f/7//z/+/3+//39//////r///77//79//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////3+/P/9/vv///3////9 //////z//P75//r+/P///v7/+ebW/+i/fP/rskz/9bdN//S7Sv/yu0X/9L1D//K6SP/0u0f/ 9LtG//S8Rf/0vET/9LxE//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/xvED/875G//O9Tf/vuEn/8bxH//W/Rf/3wEb/+MJJ//jBSv/1vUn/9L5I//a/Rv/2v0f/ 98FG//fBRf/3wkb/9cNG//bDR//3xEj/+MZJ//jFSf/2w0f/9sNH//fESP/3xUn/98RH//a/ Q//1v0T/9b5F//W+Rv/1vkf/8rpI//W9S//2v0r/9b5H//S9RP/1wEb/9b9M//K8S//wu0T/ 9MBB//W+Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/0vET/87tD//O7 RP/zu0X/87pG//K6SP/yu0n/8rxJ//O8R//0uEv/9LZT//C7bf/428X///n4//n++f/3/fT/ /v/3///9/////v7////7//7///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////78///++v/6/v// /v////334v/v06D/8LZh//C2Y//zvU7/8LpA//G5Qf/zuUr/87pI//O7Rf/zu0L/87tB//S8 Rf/0vEX/9LxF//S8Rf/0vEX/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9LxF//S8Rf/0vEX/9LxF//S8Rf/zu0L/87tC//O7RP/zukf/87pK//G4R//0vUn/ 9L9O/+u1Wv/psV3/7MR9//nt0/////z/+v////7+/v///vv///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7////8///6/vn/9//2//3/+P///fb/+ebA/+nF af/tsVX/+LVf//K4Rf/yu0L/87tC//O7RP/zu0T/87pF//S8Rf/0vEX/9LxF//S8Rf/0vEX/ 9LxF//S8Rf/0vEX/9LxF//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/ 9LxF//S8Rf/zu0X/87tE//O7RP/zu0P/87xC//O2Rv/1sk3/8K9Q/+i+af/w4a///vrq//7/ +//7//r/+v/8//79////+v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////7////8///9//r/+v/3//n9/f/7/////P7///7v7v/31Zn/7cJX/+m0W//zuUz/ 87pJ//O6SP/zukb/87pF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8 Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/zu0X/87pF//O6 R//zukj/9LlK/++5Uf/pulf/8MyD//vr1f/7/f//9v3///r9///7//3//f/7//77/v//+/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////9//7/+//+/f7/ //z////9/P///vf/+/35//f9/f/7/f//+uja//HNjv/ztFz/8rVV//O4T//0u0n/87tC//S8 Q//0vEb/9LxF//S8RP/0vEX/87tE//O7RP/zu0T/87tE//O7RP/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//O7RP/zu0T/87tE//O7 RP/zu0T/9LxG//S8Rf/0vET/9LxF//S8RP/zu0L/87tG//O5TP/yt1L/87NY/+vEev/z5sj/ /Pz8//n////9/fn///70///8/P///P///vz+//79/v/+//3///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////+/////v///v////7////+/v///vz////9//3/ /f/8///////////7+v/658n/8MiJ/++1Wv/xtk//67lL//W6SP/uvEP/6r5C/++9RP/3uUb/ 9LlI//O6SP/zukb/87tE//O7Q//zu0T/87tE//O7RP/zu0T/87tE//S8Rf/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/zu0T/87tE//O7RP/zu0T/87tE//O6R//zukf/87pF//O6Rf/zu0T/87lI/++8Rv/qvz// 7Lw9//e5Q//wulb/7rhW//G1U//xw3P/9965///29v///////f/+//z///////3////7///+ /f///v////7///////////7///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////7////5//7/ /vr1//vjuv/xxXj/7LBd//C0Vf/3uFX/+bhO//a4Rv/2vUr/9LxD//O7Qv/zu0T/87pF//O6 Rf/zu0T/87tE//O7RP/zu0T/87tE//S8Rf/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/ 9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9 Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/1vUb/9b1G//W9Rv/zu0T/87tE//O7RP/zu0T/ 87tE//O7RP/zu0T/87tE//O7RP/zu0T/978+//a5Qf/2tE//97Zc//C2Wf/psVT/8L9y//nb tv/98u//+f/7//z/+/////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////+///9+fz/+fz6//r////++fX/++nF//HN jP/vumj/8rJS//S2Tf/ru0X/8btC//O7Q//zukT/87pG//O6R//zu0X/87tE//O7RP/zu0T/ 87tE//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8 Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/9LxF//S8Rf/0vEX/ 9LxF//S8Rf/0vEX/9LxF//S8Rf/zu0T/87tE//O7RP/zu0T/87tE//O7Qv/zu0P/87pF//O6 R//zukj/7rZV//W1Vf/0s0n/7blV/+rJff/14Lb//vXs//r////4//z/+/v+///8//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////f/+/vT//fr+//v9/P/8/vr/+/z///358//789b/8d2a/+TAa//os2j/ 8rRW//S3Uf/0uE7/87pJ//O6Rf/zu0P/87tD//O7Q//zu0T/9LtE//O7RP/zu0T/87tE//O7 RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/87tE//O7RP/zu0T/ 87tE//O7RP/zu0T/87tE//K7RP/zu0T/87tE//O7Q//zu0P/87tE//O7RP/zu0T/87tE//O7 RP/zu0T/87tE//O7Q//zu0P/87tE//O7Rf/zukj/9LpN//S4UP/ztU//6rRX/+S8Zf/t0pT/ 9+nR//738//6+v7/+v/8//n+9v/8/v7//v37//7++v////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////7////5//// /f/6///8+v//+v3//v72//n/+f/6/////v3///7z7f/847X/9s2O/+u+cv/ptFf/8LNM//i2 Tv/3uU7/9bpM//S7Sv/xu0b/7rtB//C5RP/zuUb/87pG//S6Rf/0u0P/87lD//O5RP/0ukP/ 9rtC//e7Qf/2u0L/9LtF//S7RP/0u0T/9LtE//S7RP/0u0T/9LtE//S7RP/0u0T/9bpF//i6 Rv/2ukf/9blI//O5Sf/zuUn/9bxE//W8RP/1vEX/9LpF//O5Rf/wu0P/8btF//O6SP/0uEn/ 87dJ//i0Vf/0tEz/6rRK/+q8ZP/0yIf/+dyx//7u5P///f///f////z////+/vL///36///7 ///8/fr/+f/8//z///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////fv8//r05//z4br/6suK/+m+b//vuVb/8rdP//O2UP/1tlD/ 97RS//K5SP/yvEX/9LxJ//S7TP/zuEz/8rdM//K3S//yuUv/8rpJ//O6R//0ukX/9bpD//W6 RP/1ukT/9bpE//W6RP/1ukT/9bpE//W6RP/1ukT/9bpD//O7Qf/yu0P/87pD//K5Rf/xuUf/ 8bZJ//K5Sf/zu0f/8rxD//C6Qf/2uE3/9bdP//S2Uf/xt1P/7rdU/+3BZf/tyYL/89uy//ry 3//8+fX///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// +f/y//z+/f////////39//n26//348v/9dez/+3Ikv/su2//7bNY/++2V//xuFf/87hP//a4 Sf/3uEL/+LpA//m7Qf/3u0L/9b1C//O9Qf/yu0T/8rlH//K5Rv/yuUb/8rlG//K5Rv/yuUb/ 8rlG//K5Rv/yuUb/8rlH//K7TP/0ukv/9rpL//i5S//5uUn/9rc///W3RP/zt0v/8bdT/+63 V//ptk3/6rxh/+vIhv/y2LD/+eXP//fx2//9+vf///3////+///6//L//f/6//////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////z7///7/v/9+v3//Pv5//r7 8P/6/fT//f/6//387//98+D/9unZ//jdtP/20Zj/6cOE/+i5c//ruGv/7bhj/+61Xv/utVr/ 77NT/++yT//ws03/77ZN/++2Tf/vtk3/77ZN/++2Tf/vtk3/77ZN/++2Tf/vtk3/8LVM//Cy Sv/vs07/7rRU/+22Wf/ut17/77tu/+u6c//pwIH/886W//vZqP/059H/+/Hh//786//8//b/ +f/5//39/P/+/ff//v70///9/P//+f3///3+//////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////+/v7//39+P/9/fX/+/74//39+//9/Pn//v39//7+///8//3/ /P////v9///8/f/////7///67P/58Nv/9OnH//Pjuv/0263/9NOd//PNkP/yxoH/8MBx//DA cv/wwHL/8MBy//DAcv/wwHL/8MBy//DAcv/wwHH/8cJ3//PKkf/z0Jv/9diq//Thuv/z5sX/ 9uzW//315v///fj//P7///r8///9/////f////39/v/9/Pz//Pz7//z9/P/8/vv//f/7//3/ /P/9/fb//v78//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////v////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////7///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////8AEQEA AAMAAAABAJAAAAEBAAMAAAABAHsAAAECAAMAAAAEAAEVqgEDAAMAAAABAAEAAAEGAAMAAAAB AAIAAAERAAQAAAABAAAACAESAAMAAAABAAEAAAEVAAMAAAABAAQAAAEWAAMAAAABAHsAAAEX AAQAAAABAAEUwAEaAAUAAAABAAEVmgEbAAUAAAABAAEVogEcAAMAAAABAAEAAAEoAAMAAAAB AAIAAAFSAAMAAAABAAEAAAFTAAMAAAAEAAEVsodzAAcAAAxIAAEVugAAAAAAAABIAAAAAQAA AEgAAAABAAgACAAIAAgAAQABAAEAAQAADEhMaW5vAhAAAG1udHJSR0IgWFlaIAfOAAIACQAG ADEAAGFjc3BNU0ZUAAAAAElFQyBzUkdCAAAAAAAAAAAAAAAAAAD21gABAAAAANMtSFAgIAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEWNwcnQAAAFQ AAAAM2Rlc2MAAAGEAAAAbHd0cHQAAAHwAAAAFGJrcHQAAAIEAAAAFHJYWVoAAAIYAAAAFGdY WVoAAAIsAAAAFGJYWVoAAAJAAAAAFGRtbmQAAAJUAAAAcGRtZGQAAALEAAAAiHZ1ZWQAAANM AAAAhnZpZXcAAAPUAAAAJGx1bWkAAAP4AAAAFG1lYXMAAAQMAAAAJHRlY2gAAAQwAAAADHJU UkMAAAQ8AAAIDGdUUkMAAAQ8AAAIDGJUUkMAAAQ8AAAIDHRleHQAAAAAQ29weXJpZ2h0IChj KSAxOTk4IEhld2xldHQtUGFja2FyZCBDb21wYW55AABkZXNjAAAAAAAAABJzUkdCIElFQzYx OTY2LTIuMQAAAAAAAAAAAAAAEnNSR0IgSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABYWVogAAAAAAAA81EAAQAAAAEWzFhZ WiAAAAAAAAAAAAAAAAAAAAAAWFlaIAAAAAAAAG+iAAA49QAAA5BYWVogAAAAAAAAYpkAALeF AAAY2lhZWiAAAAAAAAAkoAAAD4QAALbPZGVzYwAAAAAAAAAWSUVDIGh0dHA6Ly93d3cuaWVj LmNoAAAAAAAAAAAAAAAWSUVDIGh0dHA6Ly93d3cuaWVjLmNoAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRlc2MAAAAAAAAALklFQyA2MTk2Ni0yLjEg RGVmYXVsdCBSR0IgY29sb3VyIHNwYWNlIC0gc1JHQgAAAAAAAAAAAAAALklFQyA2MTk2Ni0y LjEgRGVmYXVsdCBSR0IgY29sb3VyIHNwYWNlIC0gc1JHQgAAAAAAAAAAAAAAAAAAAAAAAAAA AABkZXNjAAAAAAAAACxSZWZlcmVuY2UgVmlld2luZyBDb25kaXRpb24gaW4gSUVDNjE5NjYt Mi4xAAAAAAAAAAAAAAAsUmVmZXJlbmNlIFZpZXdpbmcgQ29uZGl0aW9uIGluIElFQzYxOTY2 LTIuMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdmlldwAAAAAAE6T+ABRfLgAQzxQAA+3M AAQTCwADXJ4AAAABWFlaIAAAAAAATAlWAFAAAABXH+dtZWFzAAAAAAAAAAEAAAAAAAAAAAAA AAAAAAAAAAACjwAAAAJzaWcgAAAAAENSVCBjdXJ2AAAAAAAABAAAAAAFAAoADwAUABkAHgAj ACgALQAyADcAOwBAAEUASgBPAFQAWQBeAGMAaABtAHIAdwB8AIEAhgCLAJAAlQCaAJ8ApACp AK4AsgC3ALwAwQDGAMsA0ADVANsA4ADlAOsA8AD2APsBAQEHAQ0BEwEZAR8BJQErATIBOAE+ AUUBTAFSAVkBYAFnAW4BdQF8AYMBiwGSAZoBoQGpAbEBuQHBAckB0QHZAeEB6QHyAfoCAwIM AhQCHQImAi8COAJBAksCVAJdAmcCcQJ6AoQCjgKYAqICrAK2AsECywLVAuAC6wL1AwADCwMW AyEDLQM4A0MDTwNaA2YDcgN+A4oDlgOiA64DugPHA9MD4APsA/kEBgQTBCAELQQ7BEgEVQRj BHEEfgSMBJoEqAS2BMQE0wThBPAE/gUNBRwFKwU6BUkFWAVnBXcFhgWWBaYFtQXFBdUF5QX2 BgYGFgYnBjcGSAZZBmoGewaMBp0GrwbABtEG4wb1BwcHGQcrBz0HTwdhB3QHhgeZB6wHvwfS B+UH+AgLCB8IMghGCFoIbgiCCJYIqgi+CNII5wj7CRAJJQk6CU8JZAl5CY8JpAm6Cc8J5Qn7 ChEKJwo9ClQKagqBCpgKrgrFCtwK8wsLCyILOQtRC2kLgAuYC7ALyAvhC/kMEgwqDEMMXAx1 DI4MpwzADNkM8w0NDSYNQA1aDXQNjg2pDcMN3g34DhMOLg5JDmQOfw6bDrYO0g7uDwkPJQ9B D14Peg+WD7MPzw/sEAkQJhBDEGEQfhCbELkQ1xD1ERMRMRFPEW0RjBGqEckR6BIHEiYSRRJk EoQSoxLDEuMTAxMjE0MTYxODE6QTxRPlFAYUJxRJFGoUixStFM4U8BUSFTQVVhV4FZsVvRXg FgMWJhZJFmwWjxayFtYW+hcdF0EXZReJF64X0hf3GBsYQBhlGIoYrxjVGPoZIBlFGWsZkRm3 Gd0aBBoqGlEadxqeGsUa7BsUGzsbYxuKG7Ib2hwCHCocUhx7HKMczBz1HR4dRx1wHZkdwx3s HhYeQB5qHpQevh7pHxMfPh9pH5Qfvx/qIBUgQSBsIJggxCDwIRwhSCF1IaEhziH7IiciVSKC Iq8i3SMKIzgjZiOUI8Ij8CQfJE0kfCSrJNolCSU4JWgllyXHJfcmJyZXJocmtyboJxgnSSd6 J6sn3CgNKD8ocSiiKNQpBik4KWspnSnQKgIqNSpoKpsqzysCKzYraSudK9EsBSw5LG4soizX LQwtQS12Last4S4WLkwugi63Lu4vJC9aL5Evxy/+MDUwbDCkMNsxEjFKMYIxujHyMioyYzKb MtQzDTNGM38zuDPxNCs0ZTSeNNg1EzVNNYc1wjX9Njc2cjauNuk3JDdgN5w31zgUOFA4jDjI OQU5Qjl/Obw5+To2OnQ6sjrvOy07azuqO+g8JzxlPKQ84z0iPWE9oT3gPiA+YD6gPuA/IT9h P6I/4kAjQGRApkDnQSlBakGsQe5CMEJyQrVC90M6Q31DwEQDREdEikTORRJFVUWaRd5GIkZn RqtG8Ec1R3tHwEgFSEtIkUjXSR1JY0mpSfBKN0p9SsRLDEtTS5pL4kwqTHJMuk0CTUpNk03c TiVObk63TwBPSU+TT91QJ1BxULtRBlFQUZtR5lIxUnxSx1MTU19TqlP2VEJUj1TbVShVdVXC Vg9WXFapVvdXRFeSV+BYL1h9WMtZGllpWbhaB1pWWqZa9VtFW5Vb5Vw1XIZc1l0nXXhdyV4a XmxevV8PX2Ffs2AFYFdgqmD8YU9homH1YklinGLwY0Njl2PrZEBklGTpZT1lkmXnZj1mkmbo Zz1nk2fpaD9olmjsaUNpmmnxakhqn2r3a09rp2v/bFdsr20IbWBtuW4SbmtuxG8eb3hv0XAr cIZw4HE6cZVx8HJLcqZzAXNdc7h0FHRwdMx1KHWFdeF2Pnabdvh3VnezeBF4bnjMeSp5iXnn ekZ6pXsEe2N7wnwhfIF84X1BfaF+AX5ifsJ/I3+Ef+WAR4CogQqBa4HNgjCCkoL0g1eDuoQd hICE44VHhauGDoZyhteHO4efiASIaYjOiTOJmYn+imSKyoswi5aL/IxjjMqNMY2Yjf+OZo7O jzaPnpAGkG6Q1pE/kaiSEZJ6kuOTTZO2lCCUipT0lV+VyZY0lp+XCpd1l+CYTJi4mSSZkJn8 mmia1ZtCm6+cHJyJnPedZJ3SnkCerp8dn4uf+qBpoNihR6G2oiailqMGo3aj5qRWpMelOKWp phqmi6b9p26n4KhSqMSpN6mpqhyqj6sCq3Wr6axcrNCtRK24ri2uoa8Wr4uwALB1sOqxYLHW skuywrM4s660JbSctRO1irYBtnm28Ldot+C4WbjRuUq5wro7urW7LrunvCG8m70VvY++Cr6E vv+/er/1wHDA7MFnwePCX8Lbw1jD1MRRxM7FS8XIxkbGw8dBx7/IPci8yTrJuco4yrfLNsu2 zDXMtc01zbXONs62zzfPuNA50LrRPNG+0j/SwdNE08bUSdTL1U7V0dZV1tjXXNfg2GTY6Nls 2fHadtr724DcBdyK3RDdlt4c3qLfKd+v4DbgveFE4cziU+Lb42Pj6+Rz5PzlhOYN5pbnH+ep 6DLovOlG6dDqW+rl63Dr++yG7RHtnO4o7rTvQO/M8Fjw5fFy8f/yjPMZ86f0NPTC9VD13vZt 9vv3ivgZ+Kj5OPnH+lf65/t3/Af8mP0p/br+S/7c/23//1BLAwQKAAAAAAAAACEA2Eapjlnp AQBZ6QEAFAAAAHBwdC9tZWRpYS9pbWFnZTgucG5niVBORw0KGgoAAAANSUhEUgAAAZgAAAKM CAIAAABZ9jkSAAAAAXNSR0IB2cksfwAAAAlwSFlzAAAXEgAAFxIBZ5/SUgAAQABJREFUeAHs XQegFcXVvv2+Do8OgnQeTUCaBUERQQSMYiMxYMME8Q9E1KBiVEwQO1hiS8RY0GgkwURBgwUF sdERpCig9F5fvfX/Zs7u3Nn69t53X0OWy94zZ06bM7PnnZmd3eseMeI8l9URd7ncvA6Ag4No HRBWFUk6DDLKcOYMl8spXVV5Q+lLro61ysQ+Y2MdG2fJ6jZT5FhsUoSWNuikmLRcR2FdtOXV G2BLrNHhnBJsSRGTGhMWE5TGJIwXGxKbKi6Fu6I8Iq0+NdrosfbluNcV97jiPjsqfb/Y0aJO Z3aS3OUIr33V1H6dU2pfMxxaTO2s3j4Xvq4uM2BAiqqTGixJEZv3n3CVeXVFsKoHKlGFiWjb QJZkv6gtqIgXTiBeE2+fQK3TN6UmdH6125C6AUkNlqSI9R1FZViaBimmskmum4X0ylIh+1nR YRvIZHpTm7VIndlJcmtlnQAlar/OKSdAu8ybQO2s3j4Xvq4uM2BAiqqTGixJEdt1l3ldBbGq B0RvVFCeCbuJaI8JmREF28g81UgjSU3EoL0mTa6JllaJTTpfVFlfitFTJa1kSsrpeDJInJMy q7zGaJycmoqk7Kkk4nI8aKkVLS7X/ZbM5fWbuJxFJ3B1XJ5tRmat0UmNpks5Q0KtE/6TNOn3 APpE7gTAxl5Ks1ZVgdt27TjNSrk4VbOmyZWh6ESTKRyXZMPkoZUkayrkpI7O9ov9OukaRl1d DS6iWyrgYdGpFZBRg52jNe1n1Vht09NYSn3AKRdlGm1JTZT1WBcjxESwXZ0JuSXKXg7VGiz0 yVyGWktdLDTInNaENaLGovE1wrYTygg42mYQVdegKaf7yeKkhrNoZFJc1dLVegv15XQZJVyS LoFO5aBB+GimlignYU7y/U8+TEKF07Y4o0uueXqZZLweW25ZtDZF/nIVVCmBgx609DLnrfoJ pvBPuR0gukqw1HpA12bRQh3eSTtNWOJCnhMBaaWRreFWaAJZWlWdFFYrPIBRIA+Kcmx2NnIh 0IaQqpJQWo5NaarmS3gmZqdkKDElpNWQNqfUFlP/JppmWm2PhBk6fiPGXoKxVh/IdE3V6TPy Kxbp2EzoagZK2Fl+w2qGwdVkBfnJykn2tdVkcg1UCz9ZudDOWsEjRqsdtbM6N5dVjkCh2FRm OcymPFWH1AeyKtAsHGLvtyqw5KQK7gHqB9EtafEKSTPpYVVNNc4xbRqoWqchMWmFpv4EKpi2 X2pfGlxBKoyKCJOyAnkfmYkQSDeqlBp2EqydHqhYv2KgmIyVpD2RtIwaOBTJFdYtqQEmq31d jinWbeAdSw1Nro91GlVD7IToWIi0HEZW7fbhvyQYDxaYipJITEEhw5xbVJsyJ4U0V5CUCEZM YtJoV9IW1AAGOMHWA8LXplT2teU2j7MnBFvtMhNaSKCumOAvV1+1EehMlu2oTPO1/rUxAgZp YoAwkPEoFtqzCw4ZIJaUGWVRBEOUjb+MU0sQp6DdqFdgbLQLGucASUuvhc61nwCUVuMh6X53 0K9WukzdqDFA7WCbv6vs6iMyB5aYanSEpJsAqj2OWBwTJeUfx1LTQ1ghp1aOu1h3y2bJRUMg IxNkcnW4wD82wyo93juBpZBLK6mHTyC/qR5SxhoVcYb/CFbHpvpt+LsrKmqrV1QXaK5ah40R vA7pzZwVT1aIQ12VSWYIZEyZWeMqwQjtuExKQbIW1sKeScofyRFbOR5eNXeUwJr6XdSSFVoa VGoRFqZyIfIfSlxNbvwXwmMSIyTSzQIuGidGxd+3gO/EZehIsSTWGnTaCmsJVjWifUaC9Jlv lM0x1rpTUW0tzUJ9SmidFhQJYxrI1MpUmpOEdZUsXrYEqnQe4LXAVaERskE1BSavJJxAkJmv rC0W3BZseh3WklgNUYsoJooyFzQi5mHSh1pENH5KxC9W5tTJKZYVVA5cnqOcaqV2mVCbVZjh TFgTqKQZGGtKTAmdFYcsAhkJhnXC9xVXVc0SLFrCeoBdEz/rQ9/RcIf5yJSxVj6TaeBVlUyv w+hwUCQ+cZad8SyMCQAsHazEb7e7cY7H2WKZGwenoLyMMjnCgJoASUItBrWuUBtijtX5TSWG 03Qe0ZcTlDaQhU4bjkqssg1klai3RokWA75GWVW9xsAnaR+oEKi7gBJtlJUBxgdRjOVlCRKG 5PwsZqEW5yi7JFk4S0woFQ429VTpBaMk6ySo8QBzFXe18JmmWlfglDpcNRdPBjLeAdQzlldZ OjqpBnZ+Opoly9D5L9kWg1758HSMohhhZC2AgYQufmbfFNQAsUJczc0UEvYlWDh4Yp3gBYvD vIbcIVg4kTmloEkVILE6hU6EgTFZrpOBTDgWrqukDhUqahdQjkOMzjIdfFoylkAZvSBoAMTU SSVggQeLjk2u4gK5tQhi8XgMIZBTc10/07zM4B/mJFMk955cCSqds1US/m0rJEEpyASQqHMA EZedHVoh5QWyZOVppdeyErvKUnN7LWuoiblot8moIVSFfCKkqlLoW6AVW4DlH4bnFAoBUZsY zFFUizMtmXFeMPIlMkWAZo5pJac8vCKrPLIK19u31ijegt4CreXnRBaUQJs32YJeK7mciKkn tilb2mHgKS+QGRhOcARb9fy5rv3TIDUZwEaU+Xg2x2pHjEqjfvMLRi0wRYDFR8tqUiLLcAYL OzNBCqh8MyaWnyG2CTITQdaoGjoaWEtNDgu0tLpvRaEXlqBLQAoNHGlyGMhMaFJAGcWaqq+G QGZqRwotrDQWMtDowEpTWPsEw0Xp8g9tm2CZMH2EM0iHYbSY6AUKZLRSpoYtJs1DFVyikCPh hKo0A1BhdQgzrAjs8TaS7RlTrjVorGALUjakHMZqCGTlWHSy+mfqAX6FKDtgk75aKDxRLOPX Hs0oIUdciQxOWm6SfSGUgY9MEhhSTUWqspGNOxY2tSlWCVMkp6QoquaxnQxkZn3Cuvznul5G w73868iGQrpiyrtmiBThi+5RmnWGwClirRSrohg9LZkxDF/3FCzAAKazkFtxAAKZLvUQcIxp o0PgNGVRrZKxb9MoluBPQDKTOcxoSUcyXEKWgcnUXkFeWYATrVUayJwYlJQzZEenXTj/+52O FRLZyqSaV43EsDn9DrVpj6Ks4q4iw9VpJosvCGooUmizeseGhWWOXCBs1gG8iBMJUbe3KZpY JSqIhVEQZGGHQ7S5DC1WW3Io2JIM0qh56RWr06cTThp1NFUayHS6K1jUNa+C0izYU+imFFgs lNdWtOlIY43hXabpN6lAoPCepZByvQJBIp1m22L5zjKOlLRJUkyxxr9gpgYRL84CUJvJdrTB DloCVLQxBDvUb8YEDL5MhXNapycywCm1BZ1BiJ1dRKxj0RUt9Fii7fSpTEKFTOwskAlWVVY1 fpMtShvoi6M0+DTal7JcYkyjJVUsSme/PGqSsUQnxpQVNPTR1mpYnegHA8iIjc5UJDwXLuoV MlkjsRBGYlFIRC1ZIooE8MDHohZ/YkppjtAuRADDkEoko3q25weMKJR/CK0SqRlOqlZBh2Qq ufm3sDMt0sx1OMYKY8DhLJA5Fl3ZhGQ6zlbLtuRfR2Oism39Wcpnzzy63dFYVHdhUr9wl2g6 h/CiVgCmziNOopFhIpZEucWqvzqp1EQW0IPYICGxh9BQxTQQknhZmR+Qw/UqvIhiwgxWZbh3 AQSTw8MeFvQ9ShDj0U1SoUhXv0imWnL6LbgEYMPphMaGnaoqLgQShJ/LVScT1LJAxkxnDaXG Kmm7aDkuIUwkUC07VNQy3hQPaWnFSpyskmnR0emrUzQkDWw6wxxLlFpg9VeEyUIXuN0xPp2D JsFknKlxxUoPAgYlJyaMzMoJ6cTv5bGX+6gHNYbKKg/hVAoeKcDB7mK6EOBAq9wRFFIIMLVQ lcVaLLQI0cAQEmJ5CGPkAklVhCEWYJCK8TOvjLtiLDVTZNMXE6E9hBxFmVWtM7yWSiklVCgI oxWsgsgEsQAUpjR92Yg1miWIqyKQGdWn1mQyOjHg2NhkONEYJpbHMqZRqk2XAUw+KdNJ1FjA qE7sQ8k6JCfAAexS9njcyhPcNHdKpCfCIaAEn9FhhBF46j1JgyLAlJfqOC/jEKJkdiCJl5Ci SMOJWASvYCS8Gn1EPSmEItZAdstVeTiU4XWiTDHcFl7DqUUsY/ymhypU/U4QASOsJayRJkFt Bjmhd0JjJjvNOGNjhYKqCGRCWcqA1o+8OXykiz/fOsmMQvq7rautjmIFB1t1mFyuTjX/JUJK h6MxTObwPgq2F5U+KOq6glEoB3ML/lPCA3ocrO/QuQyv41NqFRpWShycV4mbwDIh/KzKVqRx JKvEf/rgmwHaJBMYcXBTZATVMDQLYeyLYIZnoti35SFqASB+oY10U1XAgoBEoKjDGEULAt46 fb2o1VdoJLMmGA8dr65IPDqkUUh6MbI62WhHgUxmSK9ZyUrD3z42dtxIyT0YQDrDWB2uLiY0 HovFkR+AFP+Bp2sjWXWW9LI7LYlO2ApqPdZ3yKuRSBSuJiRmS2i2AiNPYd5nfiBMwiPUc1TF YJaUKD3FqFlyh/lpgp5RsIPOMkBEjJcT4EQAzpwYhilWEA30oErQyMmUKkDzDS42W+YsyuBS 65kc6ygG5/DRyq1QWeibbFPPTDYRYVjj0DOQrZxTAkkSa4igBywXFYqfx5ejQJaaK4R/U2M3 cmFY+PwBj8cTiYYj4bDH69MOddajLJZh05DHm5EZLCsrYyEs7vJ4PTGeKQiZjMjsSLvNZkpq MU7nN/VaZYEHrkfowd8Pdll62LhixIgiBEiNZlQgQ7+wqSh7C0+MsTJyrxcJiv7vE7FyaeyU KHKIUDTLUyv136BBMOJxlcU1VOO/CGGqBIwfY/8zs2ATznx0MdsS4UyNYkwa/wjFKCpjUcXr RJNA7JjVJWVMC9lHkV1l10gWBQ4weumgok6dVO8I1Mk05XFCY8qYLiQMEM2sxECWRnNJFIYg XSls2HMUbwbreirKnkWaQFgMNn7VJNpsY5jsGhuyClcJ/wtJsu0CmV7AqDQJ+bJ9CozgxUTy pX1+vbG8F9clXfK8TuYSykDk5UtpPGKx69WDrqJ/KlcsFqWwYjRaYCCc5HONinhTjUK1qNVG MZaj4RC1RM8VsROSTHzBQEU1o1No8WWMoVTHzwpHgoFE8zMIeLUSWzlOoeeeYeMWB0kjANVy YzmLqGcloU8VzkkMJ5VHkGso1FoNEgWitqrVU1dJGcaQPbUgkAmHYGTzv+RRxDEsKtPfcLUh gooB+IsfcUUQ9QgrusukD9iVp0FTQbBo5EoFDY/ax1J9qiANYa1JqcpKG5+usZCrYFg8UuZd 6A6Pz+fz+pFehUMhjHojl2oQD3iiAO+hN9k0VLnpjBqKYiqJ9bd6bVnpIjyoOKD0KoYPJALD PyrSVonKzr7xX+HRzlJlAZyeIYyAyquQc2kskoqBSG0HBi5l4R1Dgs1SE/SyWMlRrFVERSpU DoXR4Zc9l32tQxWVQVbTA5lwHANYTs/+cVA3HvTOobmk2qOMR4hiMK9QRPBLToFVIvpWkJJs tV5CcdCKXk9nWSZVGvGagiVjuRXGRpTLYkIgG8NhurrYtcZyBOwdi8bZCj+/yPENrfgQl84C IBmTdCidKmFIjhahKQl+ikqkAkhZF8EyRohgNrAPqxSiRK2OhQiAVAEOsj+BJrySNJ0YIV4P gEUI53XkHWSqbJWX3T9BI7EKqYqmb7UkpJE6JZxpBQoaARCxKNoBBkV2xNVVV04gS6K5VdMC 3RXgTCl6QjSEQhj4IAkryhyQOp3o1K7TMOp0CYmEV1l0VM6LTBelY855qoRSblkC5pvFoJ93 CMukYDzOkSgSYQYna5qRARjmE4OghA1MfSIEaPCcS2VnkqiWQyz94R8mm/AGJSYIUDJ2pYbx ioOQahUZxSoljKDVAIKAiJll6sGCJPsDgaVgXyQCr6oV6jcZY4FOqJYNNRCrstLxnYJw2bYK mlBOIEtNehrtIwNS8JFgZMbgvyoCY+WGsTePHHmFTdN27Nj+3Xfr3ntv7tYt34NPcD8+49kO HTpu2rThtttu1rCrwjXIJAtJOE0OE8YBrtXbf8CgyZPvJhzaNf6ma7X1+tKEiZOHDBlK2Llz 58ya9SzBShO5lYpPELFwwD989ZsCGdbx9RKdlUmmRhcvkN4F731sI6akpGT9xvVrvl3z2luz ZbLzB5x/9+QpwEx/5IFPF30CAOaSQN6rApaZLGHqoEQ3MVHMalUgYzRN8YggwWjQIAiEqKdn PFvQoWDjpo2/u+3/eDTzMMdyP2u5GQeUknCVPVECpCK1fIaSILOx08BUgxAsJTEeaAx9jFXV iIGv6ZOUDbyH2GDgH7FgayejefMWuJgffngmogDoRB8LHmGJzh5dUdDrAB07kkT+4QOSjUl2 u5+tPFl9ZHFEI2MSsL4P0a7Wbdon6s2gXr36GNEwWBz8WmVXL7vRyA/lOuKXmYIR1LaA8ANR UdGWw7wyMzOzZ4+e14257tFpj5hTcKxQJwBBLAa81mWCUADKYKAyRUMIUavBrT9Q5eTgEuBV pp+fFSZEXrpVpTjZTJZYXCNdkjFMFP8kLCSMToxspMouWHS0CbyOUk/noKyTIIoOWPUk6czI TLpRry65MhpW8YOmOUwULjKcJSuXfLF43969OhWNGjXu2LFz/fr1MzOzJkyYtGPHNuRljMbt /vHHH/FNZ4ZJ/iADEKK4GTCFXfiyGFaBnQx0v0qusIdZ+GPC7KlQO3DgYKU5ZqQ9evRGw81q FBwUkA42jbShS75K6hahi+H4AqaCOXjw4KeLFlJB1n5al9OQvwCPcPaHibc/+tRjRHPs2FEk NYCPHTvGMAkeozbicHSGGPALYSpgIpOqTCqs9RDL1h+3ggRnVuSeNgghQmEGijQIGIaIFQqm y8DNkOYHcSXBYC6mqrFKIKuZdhv6A13KcMn6WolljE3qXJfr888XLVqszFlkD9TLrz9u3MR+ /fojll08YuRTT9Pf+bgKsD9zdgdGlOEyF2tzYMR9PRbB8HtBbCOVohkIlLxeLyNwPEEDl5Cg jldz40pKitGcPn3OeEmdLRqb0H/A+UASpVLLrOMWaiOXuQ5Von2tSqX5FixQpniEO5HjFcSB gween/W8oCR+NB+mYRY5acIkpGZDhwx9afbfDx46iNplq5bjowrEN+sE9pVQobFBKihKQGx6 CBtIlCgKYiNGVNkDJFDEYnti1IrmyBplWCeBWmRFINpLZhCvFbFOchqLQqOwp1zh5lPLctmq jEA0CQBFseRVY5zzQxvFbOQcOnzwhReeIoKe6lRLWGLDiCpFlwhP/LKRoxho0D24/HAfSu4n 2lASZUcSy0waEYplTDz/aCxdsWI5yvazS5pXEqVgRotYq0RZAninMLea1kqESYDJyiTTPln0 yWeLPyM1wwZfpNMny5T/FurIki1Sq/mZ/WmjDzqP8MlKE/TJstMoklNXGwlkJJ2FRgHYMAqa mgmkZ2pJrkx7C8mtyhkJi9dLYcKJIsUk5cviQrQQBOqDhw5gUR9L+zTVIhsw88rLrXPs+NHV K5cRK5acmjc/1UKMgl6sJn39+7MVN4xznkORZRrDduz4aQufxnICRpqfX3/IkGGtW7dr2LAh isXFxVu3blm48MOtW/lsl5E49f2aNauQY4LBanbZXZ1XCkoQwz6+WZ89Psm0uVxIVy8cMqxN 67YNGzZCsbi4CCZ9vPDDzVt+4PXKqX69+qd17Y7Ct2tXIz9q26bdoIGDu3Y5jViwMP/6W6/J 9Kaw8boyYgTj8lUrkI6hmJOTQ0jY0L1rdzhoNbPhAPlqIM86BZcR2LZj2w+8F9q1aXdqeZ2L AAqxZBUUAWhQr/6okVe2ad0mKysbwteu+/ab5UuRGOoU9e7Rq05enaPHjqIKdoIFE2TMJSkX Q21eXh1MjZcbGEF80eCL2rZp24j7v4j7/0P4f+tmPpiU8WDjKLIT9hApKAVGIHXW1vyiT2l3 zbWUXdR8Jz/LC9jHwWHeKDOsGY6lS6ZKrhlzg3LXUg1kCAr2N0AhRwQycffQVDiQuEu4dWsi HIwaNebyy0dhPijT9+jRExoXLPjgaWXCyysdeOX48WOrVq0Au5hd6pgG8Csc61Dz5s0dP34C 5PK7cp5AwIe5MBJFYH45asyVl/8SMzjZpNN79Lxs5BX/W/DBzKceFXhEsbv43dIHH3mgZ49e F6p3QokALOcPHPSHKbfRHFBwWQA6S82p5D4juEfX7lOUu5bTF/K7luAkjLkIjp0zd85mHsgG Dxx8ue3dbZDzQJYQNmbU6FFXjMqS/NOxQ8EVI69YsWrFgzMelht7wzU3oGoDX8K7Y9Jk3dIk aumupS6Qjebydf7HyiDs/GDBB4899agTTwkaI4CWCGSiVdUH6YyRu1gYBSQ+FcrITOUKBWkH 0Cpdw9KuQhbYogVLtXBhV1BpauzDho0cPfp6sgcBCFkP4Nat2xQUdERow03VoqLCl15S9kbI ZtvASI4QyPjsst0WHjHJNsooaF65fPlSIYE9BRmL4UlVPKSDQDZi+MhrVJNWSiZ1LOiESwuh Cib9ddZzgp2A0Vdf06J5C+yQWL5i2d59e3Oycwb0Pxf0QP5u3IT7H5wqjyLYIxd1olBErZU/ O7TvQPSFhYVGRisuI2WSGCUdg3xEsevHXAd2jJmly5cWFhWisX169UGQQqyZMf2xW6fcLscy UGZnZd1/91R4A/7Ztn0brfFbGXDJ8EtwZ5ZqERnFkOjE/Y9sFBqfm/U8CGy8JAsnn9g7XKav yXCFAlnVNExNwkxW0CvPgLE33Eyp0IaN3yFB08wAuVZCYpuV2GklGzNt2mMIGcAgyRL4ERez pXTdgenqtD+zmwkY/XPnviVqzzqrH8H33DN51SplJgsMJpszZz6Pa2PAgIHlBjLd2tyHC+Zf wVO8gQOHIJCJaxtkp6vzykWLPhF4dkG4WQhD87G0JEyacs8dK3lOSpT16tV/euZzMOncAQON gQwBa/uO7XdMue0QX4BHE16Z/RLR9+rZW3cV6YrCGxKgaxPiGmPChGvggIFE9tXSryR6ASrN umAETfAFngG9evR+eNrDANALb8/9J9U9P+s5fAimMzRBysPTHkVgAga5m6jFZJCi2OIli+97 8H6BB3Dz2JuQlMEPE8f9TlcFJMmhACRzGeF+6pC48493LJeGBNr+DPc/POBEjlFybcGIkcm6 XHvUgkAmjBaAtgn6kkMysHVoX2Akbt++oEuXrphCkty3+B5LXSxTHIoZKEVZNhVNOHnsDeMp ii1ZspiFOaMO1WSsN909ZSpKuFE484mHcZNBrXEJCSulIYta0CxatBCzSwQOodJGhRBIvFjI x0oZZpcvarO5Af1ZkMVlLKtDs9BwfvOBhQvMB0Hz+ZLFgoZadvjQwc8WLcTsEiaJtgoAMuUo xsxQ6ZGJIIKs0DYQBOIQQgiTlZWFu5OAEw13ufJy89q1bX8uz/JQhTjyg3a1TkgzBaACgWDq 3VNRi7To0ZmPiIBrSn/T2PEUxaBI3EKFPZgMgh6Jki5UAfnsrOcbN2rcv19/fKBLl5QhGjqM PkKvHMUgHwIXLlqIWAn/m9pcSUi5F5yr0PWpc0Z7yhQDWSVZY2+rk1orw0TMkYWUu7z12uy/ b9nyA0UxNTGUBaiwVDdq1GgSi230Dz54n0ph8o0oNn36DMr7Xn55lpx2gfqRRx7AGbvYTDit Uco8RyXQZy8uFy3kY3bZtk17ZXbJjTfOK7kM5k569h5OeJibtH3HNnKyzTiWewExDpFOxoBx 0/dsexeOvLw8uYqQ4qxTgfyF1t0EgQ5A6veXF/5CSBuxMhciy6PTH0dIBXLWyy/qYoRMCfjX WLXkq2ZQNFVNu2AkhGDBCwRvzknk1DLvoiWLEcWAwbLdx3y1jsxD6NRFMWuz43g+ARLgf1ny SZg8kGIgq0L3YZzwzrXuYWGMAxJBWw6APOKtt15/b96/WbLl+CWOmKBdccUoMCDDmjLlVtKh uxqFYmxVQ0BBEdPPefPnCjwBYoObwNM9UySMQ4cOE0h7QBfXQAxF1103FtFzxIiRf/nLY8Dg RsqA/oPojznmlbJANF24FK34bLG+Fu1FJIJJFw0dToyCXgDff7+R7QwQZS5TlACwJwK4jwSS RFHHW3lPtpNgpIp/eeFp5FOSHMFtDOmKAKzT0fzuX3Pn/GfeO7JYSQ5DI3m8Suncktun3E6U pGDAWedQETciB9neFS1o34ECGdFjXYwAJ2fcWDCaBP8XtC8YpvrfiZyUaYQ3U5YARhKia0iy Ao1CnAayCipO1tC00MNm2fXGpAwRRKQGskZsg/jhh42Zmdn4hMMhfLzalzhCLBPOcxm8xDE7 O7O0tLRunfxJk+6gDOuBB6ayGYq112684WZM8aAUC/mztLM8YQlStpEjR2Gei9sOJFZUCcAY qkSVESBiml0iBWNPEXAL+/UbAGLEbl1WKEugpsCky0Ze1aXLadwklsXoDnk3U6LK2g+osWoC qsjPQg7yoNffeBVFuVuplm5KGvGC1xTAPPEc3guYEuqWw3T0yLlunzSZErepD0w9oK73EVnT Jk0JoEc7dbwVLwr/wYwrR16FXSynsiFh4n/ygKCvuOraIsFpIKux7bHqM8LTRYLelf8ii+GO KKYmPnQBqjU8QrF3+yFbUDfZc4EJbSopc0w4HME2/T/+8c+U17w2+2VjRACnYEEGJKafM2Y8 aOpb7L2ghXm5FrFmw4bvgKEgKFc5gckAml3ikujeo9fq1Wx/U8+evXBm9yuVyJYQxqK/Uopj 70W5JgkHCQDcMpwQrULGWlWjwijSOWyjU579VnnpG/QQQme5RkgGQLCQDDJsKBPzxEdmPASM oBdCBGaq2rkvv/ay2BIhSxMs5QJCpkxpiuQECSWjR41BSqiLXxgS3/EhQVNXkpngkXWc0HAt CmTWfa3tIad0nIuHLPQ7Ap3Ex3MV2mHv6CWOkfCdd97Xga+SYIfXW2ZbPcXYwnRs4oRJUI7p 5yOPTJMX+EU72rRuP2b09VTEHQOEnp27tovgiDuqgjIpgFo4f54yu+x/znkIZMOHjaR0b5F2 5igkE5dDkxixNvUFhiQIgYxELiQDC0bhT3B7pCgm442CwU4EmCdOmsDm/lilmv7INN0CvI7x nrum0rOc2Ks1+63ZNirOH3GBjlcUheUCkxSA3bnXjrmOWDCJXrVm1Y6dO7CiB2PwGT92vCxN WGiv1L5WFph22KGFzvXqA1k1tq08o9H2cqwrp9pSAeMTnuVUSMWw5SJGHIAtWXnFVVf+mlIk PAzw1FNsLwUdWpkMh6nZTeMmUOB4+umZWxIb9BUW+sICFgF/1O690BDBHUYFOgpjkTdFzC4x Pe7WrQeo8Id99aplqLQSKZsEShJsdBzD8z8ORGB1ttJiRW/E67pEWK7DGxmBQTb6fzf9jlKb mU/PwF1OG66rR42h6SeeP3/sKbaqSMRoguDavWc3KerTo5dxE7+pDQIphAiMDIjaS9QhIe+9 qLgbZV21E4YPmBvwx6xmH+hJ0ZkGS61rNKS2MjSUcoFtnnJwTSLDGjPmejAiFvx52j32Y+vW W+8SC/zqrFbWqcCtWrUChLAosjCZCNti5aIZbG8F7l2uBBf2f3Xr1isxr+SCdL6iIs7CJBHF ZL0OTJLJqxm+49Y7xQI/5qqiyaKxAujZozflQejc+6bdAzwdOv+uXb+O8Nj+qpJovi8dfsmz M57BB4mVpsJxoXWr1qBFMKX7qjCAbODzbjeeiBKSdLYJfLoAUu38bK+X5NjTSLVGtUol/8U0 Hiuo8ySemgPC+vIPMcjsSDmRI0o7KYk6xIK7756KMtsINvNhdsuM+VHRoMuYsMBPW7HY/jKL Bf6EaJeLHtaTMYBP796btpjp8Nqi2kT1W6lVi/Pnv4MpFZDjxiExyQKw2GJeqRUrmSRGFLYU 9HBikk6SgyKspY8DWuckWOAXG+JemPWc1A4WGuQPOvfeu6dCMu0vO3joEGpND+R09L4gbElF uqejAebqq67G5LRB/QZJ7XHTyUERO+kEEiGMf3A7tRdtMUMVWVhBz1l4HcsvTLxFrbCregD9 1LJ6rLDWCs/BceUcRGE1ysphNq8Wwmy0Y6A/qG4EW7x4UW5enQEDBsn0JGTt2lVYCMNKOS3w I+QtWbII6/1GxXgcnVKwdevWYkcucjcsh4mQRzcxne+9MMqXMHFszT/77P6UHiLdME39JHqX MOmGG24WTxTk12P3VZ2bJLwqS5ZhHYFY5pdpUoNJMtbLaYEfsWnRkkVY7ye83Gt4eRmyHkSf R9T9ZXivBh7hFk+by0byx9HZNuY57/wLtyxxt+fx6Y9Ne+QBEbCwg/eaq8fQXaA3/vkGKGVd UltkqRJaBfHwOUIhEslxY8fjBit5BkZeNfLKqtl7QYYglqWxU9TGpeEbgUx40MLDadBSYREw jZbjhbHJi2QywGXeStSwdTHUO5lOkvKuXXtQIEARDz+KN0RTrThjHylmkWf0PYswyICsnh4X c8m5c/+J6ABKxD48inTw4H5kZ6QLcRC7RigmPvf8K58u/IjuLfBFvSS8gxsICGRkkvx8pTBb B+DxqWRN0kmoCcUzzxC9kDlFfQO4zjDkVstWLcND7zT9RC0eY6T3augoUXzgken03DjOpzRt hmchwfXCU89jpwjusSIFoxAGSjwJ8M68/xglOMGgX/HgFAIW1vWwgx95H17NlpWVRRYWl5Tg 8QDgIerV5//+0cKPda/8dqLCliYxrjiEkzLpSFRY8xON+WVnzeWwBmL5h/1ge809yErJEeqc Ld0ms78y/DAKhnYnvWVkTAmjdPehwwcemD4ViRKE4Eqg7Aww5qR33DEJb0ZEOEMRoS0nJ5cs x5lpJJeJM0OZHAjW77//H5pdotrJvPLw4YPTnZmUnZOLPzpVdlAHpbuPyIPJNQLh4+nnnqZe Q4hBAkVRDH5GoLn/wfsthCpDTHSa0XnA4L4q9q+JIUHZGeu7JYtvuWPSM7OeRzhDEXpz1bcY 2VhvYYkNR6LKaF6irvog98XDz9Nqr1l2KvNynibxTREsrtCoZYbiPwrcZMVu2xHNhgyxqG0W 5EogAIHZAr8iXOWy+ubBhNEqQizYLNAmUrE3ognfbFlUePybpV+Jt1TjPWh4gxD0LFz4Ed78 QwKZUseiKfzBd9guZ6LYGoXXctia5MLr0qzuxgpvW/1xSBDAALYkw9vDsZoqyTwrPJGIWgFI rKag4kHQA7LissKTREwnsYOf4E3fb9K96segVRFm33VC4yXDL6X9t8cLC79c+tX36oOl7du0 GzzwAgj5cOFHAmnQpSDsdRlqhfKEPDHUTOoSVAnIIDNRBci+ViLVaAMXPj5XHJ9aEshYUxDA xP5WajhalUhElNZqWip5QAVRTyQGQjX4mKV99o5WalWiRCRUMapy5VtGk1ZVp1yjEhsM1Ulj 9Vwl84WJAB25UmR/DrhkEcHN6ayw1lbZpGMJpgSkUaBBV20gU1U78qBKrDFeV3AkiPEowuzp VY2JG0gqRqfWUdFUlymSi2OqRC3prd5AJowBQIGsRi/2U/aEy5P7jidk7OpLtEJAid4TKLN+ JhxIABChRJXiFS0UJmyQu13CmlLaaE2MWUmIEWTN0b4120hjxCjprbGiXIzkMpnWJn6BzIJJ EWBfK2upfJhsMe2rhPJyqhOEppCmuU5EgYH1sqmwakLWtFX/Gh3IlK7joYuuE1z2vON5n7IU zVE36slIIGcV40NIqlHDxVHzTIKyJZ9opiVF+ivoMky/3BQkys13YlZNGAxkAz8rf9pStkpu vkPvlcsCAif2EE250iysKl9DzQ5kUrPQh2iNErvIH+VNpPTxS5Img8K55XtLZqtCGNEbM9Aa a56NJ7jNwsE2hJoqKenW4G0KSetQo7+FTMXZOrGODUtDX0E1SVEBnS0WhqeEthCdhlakZE4q TMZAJqy3aF0qWtLDkzBI2KgVrIlcCWotkXUpeY7ELNdaqsMaUq5pmKbAJtgcwVJSUcNhlGSE rUJBaEtlW5mCm2zlmVSaqTDDmbDqUM65dJTCUQKAZKKRMTp19kWdCntiUcvVMVbSm7J2IfCE BIyB7IRsprZRYkBVbFAIMVrpbI+Nafpkq82k0ly+RrQJl86YyivqlvA0f0U0WvGrUcouH4dp pbHhNu00EsvKBSPIANsQC0qZHTCxyLUkSkeW9iJp5OeEp2UznGu0arUVnmKmda1zzVVH+bMM ZOlwb7q6mcnBz0TxlwWxFUAWBfX2seufvX4QB/txNvyOL7++CHa0EzBd1uotk8qKfVpNKHHb lbvL7NewqBkSI0Atk9EBegItt66kmf8JyVCrwNwAgSdmquU1QpqGBAVey05aMkGvyk8gTCD0 r2k01yhT+aBI1ctQVnpV8ir91ni5SjWbK6u5gawquo2GTzo0yQMOnrZKyvSdwHI3/NRaLCsr B0M8FCpTX+KosYkJ54mYeIkjAp/b5cnMDpaVlVEQdHQZ6dUnV04kBtZ8OhrRDN1NUnvHU62s JCFHiZdyZQI2zQqpazxKCE0QyxDRGPWCJqHaApblpBEmvYgXwoA0CrcRZeoEQS8bQ7A9vWBM FZAV2o3xmhvIUm15JfJZ9RnhxSUmX05yP7DVLXZQzsVrcOLf0WiE/a3Wv8SRRy/p+gEzvcQR AC7MSIT9vhETqT2gxwSrpanskjBANFrRqJRZSQKVSpVL/Sa0xV0dI7sixfAlKAUgSIQmqhKJ BoqiShATUpwFXgeoonRoVsQvhFJriEamEBjoJdXCGJAZjZF5dbAQpcNT0brWqZKUDTO1Jy3I k4GsQm60HhMmYnnMYaNUc2HyXCWplzjiYiDpUf6juUZNTsejkTN9GOGZpIwRXPaGJMicpr72 8sxrhRa5CUCiSFUynkQIFhSJUida0/W6OrmoKjCqkKlqAiwslNtuNMy+1kifLMZn8mcRMoR1 ycqrVnolJ6psn/E2pqqE8Wm9i1QsiZc4KhNJboOTp4tStVPTkSlOb7hunFgKyqO4zhitHzQa RUHDYmSgPw4aIsGqAEYmPUV5ZZ14FCsiUydNp1xIjvPEnoiBtOfSCbEqWgthaq1rFXmqbWxq ocJWqqoQz+0+mZE59Xi53UyCiCzZbjadITq1rGbTIdTwSG3iEocurbHtc9LXxjYCA18Y8RoH 8ckbYTT4avaFYjVMqmm2WQQyZjCZqnV4FToViqtIm2iiY32Cw25c8QZUXSvsTEmxLrlEzMIp iGIpqhdsjvtFcCQNCBuT12XPCnmmBEY9Wkxyvk+6vRKDME/C6UFum94kMtgJu16cVLZg1zpD 8qHEqgEd3bzXcFRtwaKdTo2oILuJGkhMt1B0Gn3wpsYbx+Itsr1N9FY+Cm/aSPlnTWyt0w9K W+K0VQqvWkkkAlGLHEhewxb4FACdap0iU4GgoYMTJ0KGwKv1yX3TaBVnlZksks9qjdk3d4t+ 0FfQMDM9FcJZZGQJmVYG6xuW4KhiiAyBs8VffmD4fIYZwtdQqtgiqGMmqF8KnDACNTCW2a2b Ud40bmLPnr3+PfctVM2c8WyCwwyadGvit5TwZtohQy6iNzjjlVWLFi2EEN3vM+GF1Fdc/suC go70bmu8xPHrb76Uf/Dp+PFj48dPKCw6LiPNNCtTRQi8/ApFIN6Phh80+eCDd41vmsVrfwYN upB+Ygq24SWOs2fPwtvNZMn5+fXxc8UdO3amF3jt2LF96dKv8SpHHZnMImC8pRY/xCeKMjDp toSLgNd5CT+Bzryk/YVKkP1q1JiBAwfROwvxfsSFCz9+w/CzWHg16+UjrzoPL7auz15svXLV ig8WvE+/rSkbAJh1s/agcCm2CxouMCOHlr+SS2x0qiq4baKkYnHvlYMmFQmSlCGDP5xJcl88 4jxnlDoqtRUp6tVJMy+ST0kDrnmPxyOu/ETYMrCKm4KC0UCiQehboC8rxEqD+VfiL6ZGklKg 7ReKGFWa+s2CFxoC+wHgEALOHTDojsl3/3vunFmzWAib994nosoUGD7ifBKCl2iLXz/Bu2Tp 13wRC+6acitiGZmNN2vTa2kRSkBTv35DugLx43VPPf2IkD/j8WfBPm7ctYcNlzdohM8BDL3o kvHjJwCJELZ9+zYSCBgvX5Rj2YQJk+nFuYgXBw8ewJsgEUZhG36GXQQpRLEXXngFeBIl3oUL svHjr2W2JZzESvIBV4umyXiCh198PgM4u5WX7oSX+E8pU3y5+86p9JtJ9IpXvL8QAvDza9Me nKpKYj/C9PD0xynS4XWy4k2tr7z28us85Jnaq14wECMaJOMEkhHgoM4FYCqNkyROGkEJtBFS hJVLDzqVJjHYgaQPyVUJjFo0GHsyQ61ioUMVYPe52fvIys3INDZVcQFWimbRVSSuJXNLiAFb TNUIwdwkMjVzHkdYLke2hnMJ47QyRM9TRKNK0RZqgmpggvPXV1+DAqVjAPCC7ESdBJ3TbwB+ eg4BCDgIwWz0iitGAcb7r1/kP2iCV/vjlwQQMpDfTX/oPmIdO/YmohG/AIBZJN6XjSiDn7MU oefjjz9EeBo9euzT0o/akQTFYG593br1rrtuLPBLlix+SFWBXxQePfr6KVOmsjjIE67+/ZEn DgXZ7Nkvv/32bPQEbrPeeef9sB851G1quoRcDFEMv7iO3yoWjAi7aIL8+wBkhvHctFkzINH8 77/fKNfKnaPxEv87Qb+3ABXjx0184EHFS+f2Px9RDC90ffLpGfRLwPgVpXvuZqENPwon8jLk YohiiHQPPjJtM3+vIWrxY0v4fLX0S8LIlhAs26OrRRUbYNrDOEK09ZVYkkxlY5mKErISVacs OuU1MrWB6AFjJ6Rsji0jApRysIdz2IeHLAVmGIB8jxUuN+Q8LO3BYSvTYSXbPoAWc1kOBYIs EdHU0UDqREOEduQLuKgQF8RMZ9Gij40f0CMKYFb4pBpoLhuJn57OAoaiGAiQhT38yDSixK/q AkDOgvwLGdGLs57hzWB9h4gGDGp79eyLMx347V4gEX3wBloVp3yTI8EOJ1868kooBaWIYiDC hBThFfghQ4YRD2a7ANCoN996JcqOCIpg2bFjO17e3ZrbBgxahPNLL70gcrTFiz8GF5BdunTF 2f7Iyc4FAaIYfhhB9xGMCS/xKAY8/PyQ8JLa2Au5we9/MI+iGMhWrFr29hw20x8+7GIhjX7s Y/Ybr4qYhRiHrA0Evx41WpDZAHTxiDMoAde0AykqWagzjw3sCl/09kLsa2VHCQtTDmSytEqE 0STp4IGJXVLKhzyaKBMkMaQCmvcSRBsOW3/T0CQug0ilIULi+QMvALx6zSqBMQL8VsBNmH89 /ZeZorZPnzMA4yeOBAYA3jRNQapv3zNRbN+ezY+wOEVaxTjEHFNwYcxS2KUfIuHv0RaVCYA1 x+Nu3botvo0/WbJq1XLgu3btTgxYjwOAXzlh/cUPwmP9CwCpQNYGGKFtq/a3ivft20vEppc4 Ul36gIaCHX6qSqHnQUEXF2Qv0dDHecsW1Ut9mJeQydIi47LlS4UoAF8v/RJn/CVoy3+S8hfD L8UvgCBrE8GOiDdv2QygU8fOVHR2JlvKoRWjzAawFiGaywAhwZqe+Zv1Mj8A1/CDWgQj0xTI nHgoVZcIW0mA8DKLWmpEU4FUdXA+IVlIUZrFFEndK6rNgMQ1RswSn5CviFXZ27Rpj3QMpffm zVVxJt9jRo/F5fTBB/NxBYpqYtyknVWhdvv2n3Bu3KgpzshWMPOiKCMYAWA5DOc96q9kUxWR 4aebZEoZhvFYFQKmqKhQc5WoRC1atCQ8sjPgcA9BrdF8N2rUGOUdO7bBtk8//UhT53LRL/7+ +OOPOryxiDU1IJGHIv1E7omPkcbKS9u4l5o0Zl7CzyYR40r1d9SpiLSLfqWlcyeWHtLvFWzb vo1qxXnDxvWA0UFYQSOk6GUAOOSiKUxc1XumyMXPynSCujIFq0QbnfOmwCKEV3CNjBoOabCh ig6hUlkot9dMfUJ/jBwYCGFCfoIcKFWL+p2oJIj9sXNwCCpZS1+eEWB6aCOA33EbiszlRXVy BGKxUcP4o+Vbt27B7/i2atUKZDThkoXjmr/hhnEINBA4b74mei5e9DHWp3A9YnYpR0yZHT90 hmJ2do6MBJybm4czeAmP5BEqCClTEmPDhg2BRCKmy8Ww9o/fyoTxYH/vPY1tshABI0ihFbhN gekqIWE/JrmvzZ6F6AZMwkuLPhZcBMBLyMJatmqNfLQDz1vpd3Z1ZAhbWPWnn/yg3/Ret+5b 0ZVELMJft67djbcvdcRa+cpY0NHQzQctpWlJHkqmBOUjoZqkqIDOlvIlOKewEJ1KK2RRFQxk zu2vNMpUPGBiDPsDxB0jeydBx7XIVZrIJVckeOwgmSM3h63y7N+/X0bqmEdeejkwr7/xqozH TwLLRScwrfETJULntGn3ECx7kQJQ8+anbtn6gzrCQQXr+Bsk4og+LEr26tVHp/Gss/rJmI0b N4CsW7cecqzEDE4wykrBiGSKbq0CxtR45hMPs19jsnGKy0WLgIhlsHnJksWYkLZq3QaxCct8 nTt3GcdveqbgJSudwFMCKDdTB4PGil1Q6giEHwQASqKRMYLdCaBT4YQFNFwdYyW9KWt3qK4i ZNRA0cw0TS2FRRAsfwQ+VQCupE+qAhQ+JVE2k8Lsrbx+E94wU004WuVJrAoZKJGOId3AtY3l f0MlRwg3CUClQ94qfwoLjyN+IYVBPWROnz6jR/feSm6rsmA7BUC2ssY41Q4gmNNghxcCBzKv aX9+jEIJznfdeT/CliqDfS9Y8D7OWMtH9ET8AoytZ9AoUjZGJB34oXXYRpkpaO6eMhV7dKke 7DRtFGcSiGgLAjQHP/eJW7S44/HHe27/4z2TYR6i24033CyJtwSpi6gasM0h14qOFYBgJDKB NwKCUgcQpYwkUTKmMmBp+LNLQSomrU00VsdphafhZWy4jp2KQggAHKII2EcoMp3XnrAnilaa TIqHME3bNYWEK8hLiXLVQpSOzZ//3wqqRSve+udr/3jzFchp27bDHZPvwdV+000TbrrpWjPJ 8Wgsii1vfMCwm8QcZoT4sdgHHph6991TEbmeeuoFwYucCGELQYQwmNJib8SY0ddjnwf9NDrh iYzmp4IXAHaB0EYQBCnsyYCo664bu379WuRl+FF3kawRyyP899vlWbPoIwhZvHgRkjKs9NGm PFmLIANShgWNESkwAGSYXYSirPIzGrc6yiyGk0orvjVSUOB87GQlQMMgxDgDTHmhSNXLpFjp daahiqjISDqnOyPTNQG+MXWbjqwKiwhn8kdotjHTpkqwlw+k6gos8SB1QnR407C/HCvlpBc3 NHUG0DqUZrGcv4MiEonk5OTl5tbZtu3HZ599ElyIZUiUMBroI+Rg+0p+fj2fz4/45fX48vLy vB6vUut2rVy97LfjrsU6PeVQiE3Y+Pb+B++CgBI6osSejIkTx2HFisgAoEi5J+anQpcOwNrW Qw/ehyZjiQ03N9Ffx48pyRrJwRkYuR8Byxcf3bKg1G9n+V7ais7BvQuYQfcxyB4Wj1hIihMS d0UA79+/D7U5WB9k6hOGU4aI8rdrVwnDEtVaiMaC8SyoJMGyElGfZoBiAb8y0izZXpzwgD2Z ZS3x8+rav0Zm2UqnFWLQCMApZ5XQDRhwPvSsWMF2NsgHBh9fw2I4JCyfaWedtMzPL0737yf+ AcVXX31p5Uq2sYC/xNGDFGvFSrYNAkdeXh20XR3NhEMxTi9xZFvP3C72Ekc5VPAbhZjKCUaw YTcczsa9IPLDAyAYxTdb0f5VbKM9o+9ZuoelyAIERLF+L5I1qtKdyXIdUim62WYUgk/r2kO+ KwIuyUvxXbt2ggxhHcFLJwpIYHbt3I7GUhQGo260QDhoEHyxG074REejk6sJhDqVan5EooRA A5UjhM4M8AgMTCKrZGN0dtrrEKJMyaxrk1CiEyKKZDyK+CgZGRUEhalNJ5GV5AG68rFKbSqf lsZNt5ghxOApP3Cd3qOXzIsEjULAxwsXYKBmZ2ej2KtXX3Q4tnMhJCEvw9bh+vUbEdf2HT/J wwrPGwH//aaNoVAZthmzkBaPR6OJt9EiYM18/FkKWzIjQhIYl6/4hsROnDAZNxOR7lGRzshc evbshQtexBTYJrY+yJS0rF5UeFxG6uDHZzyLD9YQaQCL2h7cIUjcCIPHBgAQUtDUz1e8tHDh h2DHLlxYhdoRw0aKywHAiOFsnQ4LlDTtXb6ctQ42ixSMBFIXiL83YKRDAHKRkDgbPyof+3ZI JrOkApMRakRLRUL18ZCLoF8JZBW2hIKjhRjVUxbVtRJN04e0mF7Ir9VsvjlLJxDzSpofffnl IlGl+hrhJf7tt6uB799/gDy7xEZ2IDdu2rB58/cIWLQBHQtG+KuLCSOeE0JSBt6bx98CMlyi WzYnNqYBQxq379iGeMd0sDiG12qHRUJ2/HghruRhF/2CVbKDnRHXgETsoAue49kFf9HQiwmm Mz2QhN1wVFz6zVcAsNZGNw0Ak2ORqVEe9M1SRmB1YKENKtgjBHyM0UBDiIFDwPLNN18SZu1a 1Uv8ngNJwyYPADBYpGwUhgYNGswIyMtxFxXxHD5xrVq9DB4DDCeTcJwRE0nj50sS3US1oBRk AKgozhyhOQkuwhKLhiKZgk6ajpU6D0jxEkdhITE6OetkiqK1auZZ61ohgAE6MioSP0TQUAES h7egQysOpOVEMtMiqpYISUeLi0tKhl10cf36Dd544xVds0cMv7RTp847dmx/++03dFXoZRxr 163p0/sM7NLs2+csDMemTU8ZffV19KjNE088umfPLqI5d8D5TZo0ASV2adWr16Brl+7jx088 /XSWx+E5gW3bfwQZyUd2g8c5ca2+9PfnZY0gEFPL73/YMPTCEYh3fXqf6fMFmjU95dJfXHnZ yCtBP/OJR6CUGLGcdNFFF596asuWLdt43F7Mf6+95kY8bADhTzzxcElpCcgOHznUoEHjtm3b 9e17dv16DXNz8kB89dXXjRhxCWqxBrfwk/+RNNMzsst+/Qag+b17nwFLmjQ55ayzzvnd727D ZBlOe/jh+4lr3bo1IABZH/JSk1Oggp6geuKJR/bCS/yaWbfu26FDR4Csc+fTIBkGw0sIlGRw aUkJ85HbdejgIShFv2RmZsPgM886ZwLXiLzv7y8nbn2YGqxFKj7XIlnJWEEWGikJQ7XOz+AS UYyrUxTKSCtdDvGKRAtq+1rBpCNLFDlERfymGNIx9y8s3n6RUpMSioQploAzBc6oLJVUdgX7 y+LgMGmFFoWX9uCCefa5p+dpN/dPm/YYdkVhKX26+mAztGlZXcjF7v3jn8EuDMEU6e8vz5Kf EwDNQ/xJckEDANfnW/98Q6fx9xPZ+yqwKi8e55RZFNjNdplOuuUOyt0ICaUvvzxL3jIGPBKr Ky5nT4MKIYgvz7/wtJy1oQpbN3CPUtAAgDRkbS9Ju3/lWvlCx2uCrrrqatkSUCLPwhY5LFcJ LkRwPKmu8xIMnq/dD4zNKLdM0rQLBr/wfMJg6nFju+ih94OkUddDqhEKWh0zlAeplexbx0dF U6TgUoUJhAawqhUyOYA/UcohABWR+repao5MQklCCIfIUMFPtfT2i2oIZIod8uqitbuE0dYk 1VmTrkCGeRlexaMLWFYNM/UJIgtbBXO5CguPL/hwvnj4XBYiaIBkT1lr7w8Q5auvvI2gMGHi OKtt/YxMHV/Y50X73QuLji9YMF8OHCQNZ0z0Bg8ZRo9248afLtIRGeThGXLxgCfIMJU2fZWQ IlY1QGhBOEMmRUWseemeFhBkWOlP8gMAAEAASURBVLDryR+SL7IymDt32HBFGizBg/SCHYDo cbldWBYUO/sZsaGHNAh2+5g3QIM15dMgDeSs1v4w+ImRCzkcSFsUM9UlaWOqLWhYlXwIMgKY nRxK2CpRlxPIQCkaLHHZg8IAOzJF7MlApnUSRZAx11xpGoNk2uT7ReZWYNOuGj585M3jJ5ST jkGAKbMl2kS7QCUkiVYlUIKqCgFhhoVOEcjkej2Tvqy9lFINZKTRIJuhHfpMx4tLUMbIsNw6 h7CFDRqpFjR6DYKMACaCQxpzVSYKZHaL/UKcypLWb3Qn/6RVaA0VBk/SJ2Gfvux6cRZbk6J1 +gSZBKE76SPhUgdNRV0waDDmdHhKMXW5jjkxKNm4VD9sjc7gE8fCqoLQ0XA1dWtK1qmO0TOb OkkQG/XLVUIW9z0kaVzOyg4OMsB4NrAqtsiUBhoFIdPIMPkcY0MZLVb86btraa2hYjWiVRUT Uwu4MdHD1HLo0GHy/ceqtJsehJozx+Ttz2k3A91KBxuj/KMiUv0W12uqAqqLTxgOIF2HjUw+ ERLuT5fCapND8QHqq/+uZe12alqtX/fdt35/EFsKxI2/yh4gsvm4SYeF7Vdfc5COyWySiRZo iUKXAjhh0HCXX6CpXyUI5qaXr98BBTOuUgy00s1DJDTSR0+VbABN1nQn9DqaRJFDiaLedtak cu5aEkuyjVQV2ajWrheoDOKbcZppNcMJpuoH6Pop1w7zVphjLYUlSW4pBxV2/WTKZ8ZghjNl VtUhKzDjqUi7jLxmGsytUrBGEbzCvmf1TNqytqRq166RmdOYXwSqBKkW7PYt1crX0GqrEsJT hTTyNJqsJerIdEVrPlZDxFgj85b7zn4i1RhoL9tBrbA1KbHgSoregSEnSTQeIA+L3qE6+Fzg U/O/TiDEmkYxjSnpKJC1Ru3pkF2zZBj7pdxWG1lqVpOSt8bRs5Y0lJMXngqHcLGxM6rSjFRM r/E8RpfCZBkpw9Qawshnm1Ya2W2Iq6YKwwlW0TmNGsUoTUomX59KiiNFYjLPrDuURzEMcs1o DURpySV0mqiYlD91EshMR4HMpEWVikqhcanZY+oSiErKr6mpriouqyYm9JdPkaBNFqqynrQx jDoT56Qaaj+jtFFnV5WUBXaCHNVV2ShOQ7MqPFCqM5BV2HjWnWkR4mhc1DYik+FlQBkQqTTS RojuWrKhTEVx7efR+af2N6jaWlBJgYw6qELj1tGfRDEQKqTK4H1TaUKXgbyiCKEufSqESGab pqAYSzizmtRbY5SGR9YZEhssTI1IXZVTTnhUWCXDCf50+VySI4EJPemFRKOEWIdKjYxcAuO2 kmDBIjTbATpeXVFwmu50TdQKyBpwGshggVU7rYU7qhFtqyT5joyoNKLXXp0TDGZUmvhqEExv vGDPkPP1FvG0uZkpeDEh615OiO4VXW1Ge6LjyspKr76GPVd/8qgMDzgNZNCdfCwToakSR7DQ URneqbjMnJxcv99fcTk1RwLil23wqjmW1ixLkh0G4ppxOMKJ3iFx5blGmC1UyBhhnowUlEbA IRkYkwhkRjXVj3He0IrbSrpEV2gFitxYNyOOxWJawhOhpGuUVVyzwp8ILki+DTqnJS+g0jmq 4mISOiyuo5QbmVwggxnpNiBhuWgjoSpPUULlSShJDyAdo4wMZ/FbJJCBopBEMKIYUQr8SeDE 9oDu+q2yxmLk4eNLDEAzzUbjCGPPZZAkyI3yDLQ1HCFaINpUww1Os3mYV2KRAS+adUejsX17 2S9xNGnSGEWEMtrpSolYPB7jL2LEAyQ4hNfSbM1JcQ49m8bRaqXRCi/3kZi4yEgZdiJEphdw chmZYIO+NLpGiJUBXZMqW52s+iRs9ADlWegF/Eic1+NZsWzF9Kemr9uwDkGqW0G3+ydP7dit I37V6euvl0aKw+07dOh5Rs+YKxrHD8ohwHlTHGZGM05iqtEDukuyGi0xqq7iEUbhqCY7xOii kxjJA3G3x+M7vP/wTbeN31y6rm3vFlG368Ov3981ftfIiy996T9/2xPe43V74oe8N/7qpvvu vDeY6YuX+1dYEn8SrCQP1NhLLl2GlRPIrPIgqMfHqraSOqNmiaUe+Jm5wO2Oud3enbt2bN69 qdUFLT0tfaFocddhHVe/vvKLBxZ3vrB9h06nunyR6B73o8890OnUDmN+OzoeC7nifsxFa1b3 nWDWsAfR2WH1VyMt4zRdQacyfF9rhheFTuO5MpxyUqaVB9hvw7niOfj5X39OrMzliXmxEhb2 lTXsmd9lZIcGPfJLPcWl/qLclhkNWud/tfoLF6rZilpNvgSs2noSX5s8kGIgY8M59WYStzin Lqj6OUVkrX5TqsICtwtvTHE3atTs1GZtju08Goi6A1gEC8UaFzTMaOM7Gjrki+L2kS8c9ZRF IsHcbLwsKh7HNrqTgcysd5wNHqIy45dw+HvBPxJKCwpdzgHebTK5VqKjksxuCjuSYkVEEnlt ioHMSnLV43XeqXoDfiYakVXhYMMlHs+qm3HBoCH7th4OlbrinpgHeZrHHY6VZcaC7njQ6w6W 7g2V7QldOID9QKQbjykl+UcPDEnz/Ey64WQzLTxQ6wOZRbtOoivFA9h8gciFYPbLi6/Ki9U/ tP1Q0OeLuMOeaDzDnRn1xl0Z0cChjG/nrR819JfnDTyX/bivB8tqSUaySrG9BgsVf40rzUbK 15I7V5oxaRAs5WIkrSYEMjHH1AFpaO9JEWn3QITtfg0XdG7/q4uv3rl0t68k6MY7OuPheMwd 87jdhZ417313yZmXz3hsRjAzGImEMBuNx5CVRfFxuRAE2YenXJYnyv7SbnmtFihinQBqSHOE PaZAlRlZEwJZOhur82Y6RZ+UxW+KeZB3ub34ceebxl3fJNbswIYir98TD4Qxw/T5MrYs3Daw /aCXXvh73QZ14TC/L4gHANweL+514sN/7AZDDgGPHbJHT84lZW+chJP1QDnbL5IVl1Z63XxE M+7Tqigdwmq2dY5byLIkbYihXkAahXkjGon3o0djEezCKGvXsWDiTZPufPwP+QWdIv6wzx87 tKXUd8B/9zN3hgKFu7ZvDWHdDPcGotgQG3NjAxqbYvqys3LwCXqxwyyIACcMU5TG2SZatzvC F5q9HnZLif+tFWOB+1k8RSDYTxBAN4pEq82ap6M1IzmBcOW1tiYHsjR0g675tgMjDepquwhM AXmepDwmiaeMEIBYJEEUisc8cfzDTNHHQ4u3NFo26urR//r33I1L17fq3ywWLQ1vC8eC8Ye+ eODIp0dKjh5HlIq5XaFo2O31xMMuXwz3CjyZmVnBzKw6WTn5WfkNchs2rNOsSYPmDeo1PiWv ReOchvkZdbCfVg1etHcDtwv4PXI3nr+HeQiN7FkoMlUbc2u7+0/an7oHTvBAlrpjfpacmAYi 2UHAQIBgtxrZKj3+IW7gYUqWJJVFjm859NMP275ft3v1ivXL2jRpd/k1I6Y9uDze2+PNzyo8 uL1d165N85o1iTSqc0qdTH9GZjAT81AI9CA6xcLHy44Vlh4vDJUUh4p/PLJjxfY1JSVFsXDI 63JnBjKbNWja/pSO3U7t2bF5tzYNW9fLbsge60QQQ9hylbLHO11eHsGAwwMGLNoa8sda1m1o nt0fV93fYblxdmwyXc2GbRqYpOG1KJDpui59PkjSZScqOYICAgROCDp45wxSHp8Xa2HMzyXh o+t2frt4/VdLN3+9ac/K4iNl/sxgo3pNcEeyd7+zT8lp8/2cLf6G0WPfF/UZOPih6+/HzjGW xhk8RakV1vwx7I5Fio+WHTpSdHDXge27DuzcvHvLlj2bFn73+X+WvuvzeVs2aN2rdZ9zupxz eotejfKae914OWU8Eo942DNSuHvA37fBFdT2WGZw0klEKh6oRYEslead5HHiAR7CaPoW5o9G Ii/Dyn0A0WLTvh8+X7fwo3Xzv926OhoON2vYon+nYWd2OKdz226N6jVs4Kp/4Ogxb64/tjve tGGzWNfCRa++vM8Ta5aVcezw0UhxCaJOOFQajYYzMjNjMY/HHwjkZHsyMo82qVunbr26jZq2 bNq4e7N+rk51kGMVuWJ7SnZt3LH22w3LVm765t1l//3nordbN2t7drv+Q7oP7t769MxAFqyM RaOIZUjS2N4OhEuWPOrW9Zw0+iTNCeWB2hvITiZoFR6ISGyQNsGReCdPPBLFepg7Foj4XMjE vNE1W7/575L/zP3unb1F+9vUb/XLs6/t1+Pcjq27NPI0Yhnb1s2uxZ8dW7oy2K7taa1b/5S3 NePCrMCSovxlez1/eaUwHi5BsGGyY2F31Odiq/eRaAy3LkvcrgiiZMx72B+MBoJlOVneBvX8 jetndmyd2bFTm27d2xYMGNZ+aJEr8uOhHxZ+++HHaxe8/sVf3/jq2bPann9pn6vO7X5e3WA9 7N8oQ0Rzl/nZZBNBze31slxSeyO0wv6pyQKM6W5NtrbybausQCb8rIs3ld8iOw2wqkbZY2dr VdRh/TzmwfwRu1YREZDX4HEin+uH3Rte/Ozld9fNKz2+95zWZ99+5t3n9byoqT/fVVQU/Wxd 6NPXSr5ZVrhjU3DvQd/+w8GRw5uf2rL02zK88aJoW0lrV07dutklnuIIe2OZF49i8jeVsXf5 YJLK7hy43QE0Lcq2lrnjkYzCo/Gjh+Pfbyj69OMyd4Ynv2Fx8ybB0zvXP7dfp7PO6HLuhGvO vXHVD1+99/V/P/p2/qebPj3zi/5jBlx7QY8hQW8gHg1ABHusgKJYVXjs56tDXNFpdEEaL8bK CmRpbG2tEJXGLqmy9rIJGdabuD4PUiafp7ik+M0lr/x10TMHDu8eVHDBL3/10NmdhwRdftea dTv/MyM27+PcH/eHSgrZ6ld2TqnPn5ufFdmzq2f/c9173Lvf2lK8t6h1Rl3szwi58LoL7Pd3 Rd1+BElvvAw3PbkeBDOmEOGMp09Y8nK5/ZCX4XHVxf3NeGmhd/362PJVh1/9V6T5qcF+5+YN x5NO5/T79cDrDv5m3pK3/vXV2xNfvXnY8uG/Gfrb01qc7sZ6m4vts4VQBEmaI9euW5lygKiM USTL511Qg0462yrSfG9Bh1Zpb5lsnwynXZGZwHIUllNtJrEiuFFXjfb5atxfC7rgsTcCB2JJ OBz2BFw/7N1w11u3zPrktWZNWt1x2ZTbLrmnbaNO8Y8XRe964J2p90+b/148t/U/ju2MBVyd MnI9eLTSG2A/SBCNlp115re7djx288Rcf97mZcuG12mUjf1jkTKkZJ5YzBdhM0oELLaahfuh CGRscUsZtPQVdcVCnigLfvG41++PZGaEM9zBwoOeFV+VzPtv8cefeiKlzTqf06/HkG5d+5eG jr3/1dz/bfxfnYw67U5th/iFl3DwSSUeHoAIpYcFUJHuSyNvNBp985+vp1GgQ1FVPOAdWpVG Mtqtk7ZrzMZfNlWiPRUJxkLIScCJB0QQibpLPVG3J5IRCAaWbPnsT6/d9/3+taMHjJ5w8Z2n 5DUpXbrs4N9mZc79eE/7dvcFi3c1aHj2FcPefHnbl7u3dW6S28obw7wRgSrTHYqHj2dl+Yb0 bt/mlMaXzv/g1eKDXVzetnVzPWXFiGdBrz/M8y88PY6siTIxzCtlU7H9IoD3yWLq6WPPOwUi iJbeMn9WUcPscGnYv2JdfPnGwlfm5o39Vd+rr+579bPndRo4878P3fvWHbuPbxs/aKLPlR2P RiO+Mk88EzGypoUwuaUn4UryQHoCmZNQZd8ASNAMbXtqu1qdmIqbZqcs5ToRTYwSKuk61GlE JEE65Yv7MHFcsnXRlFcm7yraeddl99444LfxktDhBx8tff7FyJ6dmYGG+aOGZ38Uyf9o1aHC 3RmekhI2ifMGgu7ccGmpOxKNun0RvJgs8MJr8y8477xLhlx4x7/euK5Vl+uPRdrGM0rinrA3 HHVjnd8f9Xv80UgkFs2OB124u6B2OHoo5vO4Y1F/LJ4ZDx4IxZfESjceLVweLd4fCofikWJX LOB1NVm8ueniBV3nzj9j/A2D+w3rNL771Pem/OXD5yKlpbcMn+zxZruZFLbqJztQ12p4W641 Or+CGKirVPkVNK9C7OzPkO7iYvLor1OFJKeDOT2BLB2W/LxkVP1w12t0uwLRDI/PvXjDp/e+ NqWsJDT9ikevOPtX4UMHjo29reSdN735DQJNu39esrPv2q1DCjpMe+/D1T/96HEHY66M9SWe 74sPdWpQr5Hf7fP462VmbDmy4+0lB9p2aXPd6GHvLFnQIpgfce90RY8GMxq6ohlBbL+IuA4F itDHQVcAj53zzlb+xsAwFtTcEY877x/HDswNRFZ4XbuL99dr0bhj6zYt69SNBHyhQ4VHjxze sm/fnHf/EfrfnIKWbfudd36vgvZ7Atv/+uVrnoD35gtvzYjm4D2PfE8v+4Unimj6VlfyKKug uhr6V7eSnSbEy803CZmCzgxIQyCT1ZupcIozykm2MU41pY8uBQuxRYvrl8e8senpM9EgSU1S 2JOOi7/79I+zJ28u3nRewQU92vbEGlYgr17O6MtjnjLvvK+Kz2w6fd/+K1atPnPcVbm5eVu/ WHO8NHQkGp7hP5Tfv2XjpT/+NlQ34C3dtndnw0YNXrr99kyvLyfTN7zfoCmz37ytXuO7Ao3m F5Z+hnyr+MilwQa9MzPj0RJkcHFPyCP9oCqmmcHSWE5G3RnRI+90ataqa4/8b5ZNuWH0gGio xd6jWU1yXZ3bebp2Lov4jhw7emD9hmV//883azd+s/GZt73B4/XcwZaeF7a8GIjm/G7473Hv FUtRwrNVnx9VvUZD95aHSGHIlifSLFEz8FTGGKe2cMkVWuyHhMowT/ggfcLTJ0kY5wzQLfZj oMdiWJNGD+BkPqZYRSUcsJekqoZDu/vIsSNl0bKIK7Rh93fvLHt7/bZVruzMVgOG17nsMnfT psu9x2Ys/nL7waNNCjpu37c32+3fumdLi1ObXnnpcF9WztzN37/rKds/oNvLSxc3i9dpUDfv mrvu3rNv/yUjLty88ad1O3fk9+vzwrZNQ0ddnnH1iOeXrWp5PNrJFyj1eT2xMDZjKGMHPYPJ oNf/XUHrZzKKrp1898p58++65uJrfj0i971vIq/OK/p6bfH/loV97qy+nfLrZDXdfbjpJ18P jbpG5+adHqxXr3XB9z8d27Z093drN3Yu6Ni2dXvkYmoDzb8rwbUJkQYnJ2ay1bXYL3sBzjZ8 +G0YE7yRUpaUgA0CTRhBw29SJ7jSCGFbD7q8ooEsjQaZiiI3mVYlg2SerJZDF8hgA0IZ3muD 3yJiDw+yT3UeTeo1Pa/roGHdftG5aTd3mXvJDwvnrJn3064N7Zu2aHzuBZ4uXb/46P1dxw4e 3r8/I1TWq2vr638x7OzePf43f0FJJLh22y53JPyXwVdfeckVL8ybk53pX73pJ7wWY+KoIVeN vHjNvoNv7thWWhjqt3bzLaefuaZzq2ULPxyRlV3iduPpcTRc6Q6su4TDuaec+kGLBgdPa3dB u75LPn5/ym/GxEuORgqaZHRu5c+vE83LcXVtldH6lOKYK9iwoadxk+IItpB5O3Rte+kfbhg8 cmhDT+aqr9e+8Pqbu3bu6NK5c35+fnX6lN82xWSZ3dhg168y9mpIIKuWq4ApVf2QdgMokKVh apl2y4wCMRbMsxcjqTlGcKctogmJ5goNWPzVBg7LQ1gcd4dK1u3YgBd4eeP8BTds33uSB3aw 6g72jgjbg1ssm02XGjbI+32+Nk3aNB98fdd2nd768l//XTNn9Y+LfnfhbVf0vf612XPvuee+ HRs2nN6qxc2jhhf06vLt2i1//ce/8/cca5QRcAc8zz43s2D4sAPFRwaf3umua0eFQnGfO+jJ 8j5yy8TRdz/wY+aRRr464Xfnt7vk/APBrFDcFYxgC4afvdwHDmGrY8wn7oa5xfXzTvU1yq2b WRQpDBWV7fMeuX/FO/VOqTfi9N79G3YIeOp8vefbl1YsOLXxqRf17Nnl/HHxw8cjwcxITkY3 v6vHHWOvuWTIc7P/+exzz3/w2cJ7p9x71nk9jseP+sO4DZEdDUf92GKCbbixaCAaD9NWDTtX GQeJ7DYTTvZej6jL546WxsPN657SpF5LNE3ZoWdCXhUo5llHBzXWKbUjkWZEbNsNDt7jZvVJ 4gz21o5AxjxQ0ViWpKcqhxyvica+rb3Fuyb8bcLB6G5/vDjm87sieMha6hkH15H4O29jprgt aEXDVLINXrgK2TDDz+5m+TNKYuGAJ7jj4J7ps/+8+8j+CUMmv/H6y98sXXnj2F+3+mp1QUGX 01qf8ujvx//ppZf79OySWeoKnxFYnR/r1Khlt9M612+e5y6KuUp8Xy5f/enqlT/s2XjesdJz Au5N3px/fPCfgR6Xnz1F4I26Ing/EOIuU4yXleGFZYUlTZo0+HDNpru6TsqqU2/Oh5+MuXr4 5W16zduxZl3ZtjOQLcb8zRu1PatFj492fJcdWNdmw57iNz/Kivn2dT+10QVnHmpR97/Hvm51 advJXa75x6z3x46+uvWQVg175pZGi5DulWX63djLxh4ixd8NXEpG/2o8xG/najB89GkxUncx L7K3tUUj/mhhYXTSRbfcMuxOFp795faAVubJkuSBZK/3WhPIpDbWYhAXEV7qlZGdc+XAK0Px Qoz+KF7vFdOkV8YrjbI5udlmF2M516fMTjDfzMUnt4ij7H0SeJ4ohnwqgBuLsZIPVr7/6Lwn szLrje0/um+f06fPfOa2sWNzPVmX/WpwQZc2A3v3/tMrr3Yqjc07fVjw0st+s2N3tisQPh4L lbnunPlUTnZw0rib/7tg2fLw7gkNvTtiP7X7LnpjbuOwu+yIx1UnVBbzZiCC4vElSltKftp1 dtNmD3362ffrN4373aR7Jk0c0u+cX3QdclHb00vmf1H6+6eO5mbmnXHadeefObLLWV6vJ2P+ 0pINe48c3OX6fMXO1Tvz7x6Tn5Pz7ravT+3U/JVXHrrvvmc/WrAs111w3aQbsUMtGscTA9j1 5vOE4DZPBDNboy80GG2UYlV6DrlHQI2AjC7EFpJIcaRX2zPKkGu7PPg5KaMgjZ6ThfR5wH3x iPNSlqbv3pQFJcNY8cHBdr5U+DCYYS7zX3PmB4NBaKOhj3gRxktQPeEsbKWv2cc3+1ZNfvXu fQd+eOKqPw3pOSpe6nruxednPjb12pEXv/3Jp32aFHTp1evdlV83+2p183N6LT5wYMyQfh99 /uUPuw/9uHv/vTdeH4kWzv9qaenx8JQLhrXbvL3Zqh8KXfvjkUhGNCPmC7si3ih7FhO78r2+ SLzs+LH61/zymQbZHyz+8oMPP5w8efLqBfP/9vTj7ZrWPfC32Yef+2fdcKw4HM26ZFDD264p ys7yYk7+4y7/N2vLdh4tbNk8e3CfjJxgyeEDh5evb5SZvS8j+7d/fe2DZUunP/zA5NvvqHo3 h6Ih7EqhASH+LJWVlV16xbDKM8Z8/DnVZxjORkb1snFAamTWY7DdTo8ylMtXxCnw2Ajy/NqX kcEB5bfQ4JSagkAagleg7jqwa8bfMouOhoLRTDzDw967igQFDeM7qgCwZ3Wwt5JWsdgffF7J kKySTY8wH2OO4CdQ4jWqPi4CK0GoZuQsxRIrE0BwNM8SWDXTwHIIvDsCC/TgQqYIOb5wsAxP HQXDwc5Z/kmHXFPqH3nyv39r17J3m/y2G79ddVaP3ivXb7lg+9Fp7iLXho1XXD5y8YXnzVmx Zv0Xq5b6lv20f3+Hvmdef0YfX9HxRm26vzH53qeenLHi8efPz29Y4i8N4B4HxpsHK4K+TDy1 5MFrMCKxWCTq83lygsfeWXDD49PeX7fitlsnP/3kY9ePP/TrCZNenT61YOyV/s6t41+tzzx2 NNapZSnukuAmayT0cmRDaff4wBFndwk0KWZvbozHv90dmz57V+E+bEC7r1OH3fl1p917f5PV 31/aoEU0fDTkjWfE/Eg6Meoxq4VLuesUHzL3wCfwDjzJUlPlqlWKLBqhi5jr2dIe+0ZuB4w6 EvG+RySzUVdRWSx32OCsX1yE5z+16wVcwclTpXmg9gUyPoxqVCxjccHhgQuC/QJHKOR9+Y3C oj1uXxB38XBNZcZDbP+Ty88yFRbPWFRhgSyOd0X4SvAXJ4aXCoIgghcL+kPs9YIhfwyL5z5W Ey0KujLwHn1cZR5fOBbPcuNpbTymDao47iPEXP5AxF/mi/ldJZ5oOOLPjLq8Wdh1EcUPifhw BeJhSy+e7Xa7Q16WJeFnd7EkjgA3IMt/5aDGs9vsfOfr185qOvKLzxfddt3op56bdVPIG9q5 tfCnze6FCy/v3uO060b/YeeuJx+77+sVq+Z/tfH3/zeRvFFcXNqrV9+bsl84reTo8My6x6KF UbTLD1V4ThNPd8bzIz7M+Yqioaygt/TI0fiTzz/zp/+78k8P33nXlL8/99K0hx4bOfH2O//v +msuG+E6u2esJFSCnW/heBC70NDAsOv9LUuXbF57b/8xXfOaF4cKPac3zR43wv/p+sjO3acd iU+59lejnnvhydmz+mU1q+MpCccDpeyxzKg3gtuzHlgRi4Rj/qA3AnfirgtyKE84Gs2MeAJR 19FMFnH9IVdJhseLZ5+wZwav6454Yn4PkslgFPNwb1nA4wpHsviz8f4I1sTwyBYeQC1zNarv uXQYZpr0V4dcIcMOh4pDsiQGn51EEqPGZQtKXbVOta7WQkZloWv69ovKabeuC5JQYtZbdtJG XfVr+aFx/Mkvw/2sUEno9bfDvrAnJy8Q9GbiplcoEPIj1Yj4cUcvEnUFXGG/x+fL8mXkuDKy 4xkBX1Ywy+uPRVyIRjm5Hi9SmTgmZ+6SIE649emLYuUoEg9kBV35Gd6wK+zyItIF2WXpxYt0 fMFIED/MFsjy18mMZ2ZDnCuQmZGBvCMSdwWyM/LcdXLx5HUwVuYO5PhyGsUys8I5fo831uJw 2fIuwf2B+Cd/XzSsRzdvdmjrfz69vmGTuD+C9/HEfZ74kZJ9Xdp+vvWHS/p2b9mi+V/+8ebi VauHXnQRspbN27b+tG1HcSjy3ZYtmaHAKb462V48GBCpi0zR49pVGP2oJP6n0P5joXhDdzAz 01d3067sn/aOnPx/D77375UffzFt2v2devZ65NkXP/jgo4JT2zRt3OxQ6d6ZX//r62M/5Gbl XNSk+y9anzkwv6DFUdfxkuMZmbmuzFx3t1ZbezeLX9yz/i8GNOnabemStUv37euUk9Mnr1Fh RsAfDPoyfL5gRmYkGMv0x+vC99le+DbHF4SXoq5wHfyiQHZJAM86eSMBjyc/O+D1RzKy6yL6 Zfq9eVl4UZs7J8udEfTmevNc6K9gxO8NZHlieRmxjGxPpg9LjL5zz/H074chRT+sIqaWlbT9 wm7wJTGuHZBCk/ZTIdX4o5ymozZtvzA2GW4wiylGwpqFQfaFtTF3JBKPYj3Y7Y/EIiXRorP6 ZJzTv04Ey9KF+AE1vzsvBKL9O/3LNhWuX+cL7fMF6vjxUx/ugPeGMVFvrOSf72VfeX79gtbY Jh/w+fxleB2iN15ShlfmhFasLP74q4yhg+v26ImsBTMuzHEC3lio+IjPleHatrNk/vv+SNgf i5VmuMKHfNGCjjm/HJHd/4zSnBzfgWMlCz+Lzvk4tGOzp07Ih2cfPTmnFPrrflb46cblpYsO N71o8PJFyy4O5jbBaxHx0LjPVxKL5uHXk7yukmgkXFKaf8op5/Xo+rd35+39wx+Re+FXRvqd 1a/3ad3m9Os/4aknG2xdf5a/3r5YYUdX9m5feHv9jDXxWGGR72tfaFPxoel16h1r7Iqt/Dxn Wslbkyf8+R//uODC82c8/pf/ffjp49Mf+M19D/XtUnD5JYMKGrT8cN+3hzYeb3P65fWyc93v Lz7y/L/cmf7S1i3yRw0t7Nbi8Q0f/VS069JmXW/qfmXLlk3zose+3r/vqmhu3Fcacbnzw+6i o5Gyi/r7XMUZn30VzsjweaKxA8XR9t0zRw6qf36f0pw6GWWh2IIvD777bskPa+r4A6GGeaGe XUuXrc1EkuuO5JZ4jgR9nrLosQxf/JeX4FVokTn/9eKRUJr3Y7qO+79s6lorx2fNulqSsaZW Ti2pgVUcy9ISN7EK4+NLK/y3Hj3uUAgvIqw/+mp3/37hhg2CQb9v+05fSTwY8OTk+wM5ed5v lh9/5Omiz78IxsOl/qxmY6/Fu1APvPN55MILc/r1whZ5zJZ8oWgpnsdufIonEDv4m1syDhfm 9uycffXlETyh7YlmxTzRMk9G4wbR3IzIQ48HDhZFG+I1ET7v4cL4kMvqz7yjpJ4//NXG2Mbd 4c6n5k25rezKS47e+sfAl5+E8utkhPyr+nRZtvzDG74qbF63YfG/FoWikf+5jg4NedtmZR4J uH0lrjDyPcyGvZ5Afl280ey6Sy4+eOjY83+6K5Ad9Ph9odKS3JycpoHAlF9dvj1UmF1W2jQc 3rBz1xm9+v4JTY6F9x48euMD9/fdUpbpcR2JB/JygpE16/1/ePzFfzzx6oY1Eyf87qLBF956 262/vfm3M2Y+ee/M2QWN6g7v36fvaV3yMxu4Ml112596uG0z9/c7ChetPHS0sMmjt03tc9mX 21Z7M4NfrPlu5+4DF54/0P36m2XuaMDvCodCh4+7A5f9osljt+99/PnQh4uzApH44XDpkAHN ZzzobtTg+OqVrm9/8jVvEJh0Q4trLjl2y5TYvI98TTxZt44reXp25MOFkfreYBh/SgJYECtx uVvdeC1u+u759wJXqMQbxA4M9nuffkzv+QBNy4BJ5lqualpak2WZFW8qpVgOW40LgR184ZFD FT3V4kBW0aZXCz/SJPS714M3zoTdMdzQdLtKCqf+OR7Lyfv7g/5Wp/x06U15x/aHMLOp29g/ YEjWTb/Mnf3Xovv+vP+vs7J9YW9p2JMR98WPRn5/++F6uVFEAk8kEApFT2nZ8K03Xds2lPzv o5zG0ZK/zj760ntZocOhQCyz1L0vN6/Va09l1K9z/N8LvJmuCH6U7UiZp1v3/Gfujh89fvT/ 2bsOACmKrD05b2ITOQcJkhFQlywCAoJw4Jn1zCfGU1TwRFF/xRMDCHoqp4ABBUGQIIogiCBZ guSM5I2T8/9V10xNT0/3pJ2FRWfE2eqq9169et39zauqV1VDHzKs3yJXurHnTkm/QYXTX6r5 +stnbrpfdWK/pmmNbzNdXStcEwvr29VuU0bBLJdj0zlbvtKIYaNMh0yOLf51XrXWcOJM6fuf f5WZpVN5Nc1q17Q7nQ4EvSq8WqNOK/c4ZLJ8hdGUWUuudGBAqlZBA7/H8dnK7zJUum3nTugO ne5jaOHzl2r8Oiz6xpY8Wc5ymct89dU9Vyxa/Nab/1m59sfrr79h7NhnlWOfWbx46ecLF0xf +GPjGjU6tWlyeYc29Z990HiuPNtm1xXkKGrUKvS4B+foFm5c9+Tn02++/8ldOzfklat1tUw2 V2lGmU5+13Dl6//yGgpVJR43Bg8dDvNlzWq/OQG/L6WjH7Kv+V4v95ox7Hhl75rvTsqY+vIf p84qjx+T5dev8a97yrbtUlSccBsywIgBswy03enBWADCZ5xqDHASZwx+mYdsWkvmDdKfC2mB SgEZu1kUjC+k3tWgrmiNZpZhetKxEjzj6NL7ENYuw+HcCjIghonoc6UeRRkm87DPtLb4mKe0 XKvNcZ066twyybJ4Xt6MqVkTJ9p+/8O/ZrFfiQF6PXbBl5vPKLznvZ4MtdrnrSjLHHKTr1aW dfJ8+Fn2XJOq4rzSXW73e1VarfdcRc6gZqq2rSzvf1pxEH0lk8ztlsls2r8N8tasbR1zn+zX X3yZmSqlBjsg+hZ+fb5JzYLX/i+z9xX+GdtP1m64fvfWx/0ZcDbKvU6ZTF/htbnU8pnWsn/I axQoXBb0ht22Qr/s1gEjpn39WQZGxXAobzOD56Srn0XRTK/FVIPOJ1/kMh9oqNZZ3HXOKYgP 16zlsN4dDWWaMjkWHdnH5jds4KioUOhPWeVf+kr2OsraqhrvnfD8CbVyUO8hI0bf+Oqbr703 7f2vlyzq0Kb1dUOv//TzL44dObxm8y/b1m1c8NFcTGaYcCqJRoVJBK/LaXU5zXZ3Qc36r731 7v7SU+snfP7fGoV+33mv1al5cIzu/550oXPvcGrVFoSsOvwy/fU9tA2blj4wzrl8sTHHYFer 1V6NZ+lS6yvZ+g+mmvoXWT78UG6tUHW/2vTUg+bn/o1ZGT3OCfBq3EqsU8AyARWZU/GpZMBg crowGbgkYYG8KU32DFT7BHukI59fSd0ZKWWOJYKVSwpMrqBSQJZclWmucAvI5WqcoUEmIjF9 KVdjHwfsvoUVNR5vrl62f2/F+FdUX8/KfGD0uU1rPDiGW+bXypVWncmj0eo1KrfH7Mqvq3rw RtmRA2UrftZqEMUOqMS4vdqt9modfmeW2njvnT6nz/ztdyZsWKjBvBvqUqsLavr9jorjBzDK jqWfZMYTZVp11r6zbrfHl51jz8ne1T5/95oDGM0GhDnUGRVKz60ebRtT7dfcxQtLjjyszx9i NMnUvhqTp/cbNHCJUXa1TD7rsgxlt3z9wjNvGBq0MNjLfPJcd2Yj86HxBfK8HoX157r6yFXT yk7+7ZfcHlpsIOtRuowHZKbpbssKy/kyj6+WNsPgz5lUfmzKLeP7XHXVzAVz35w08W+n3Tde 2bOiT9sFh/ZPfvud//NPb920+bX9eowZ81iW0eTDGFdJyalzpyrsZr1OU2DKk9XMc58q/mze 3J8++uQlr6az3lVmVqjHPad8eoxjyRLzvuP5d9/qV2LqFtEgWOye63M4rMePKw16j06nxtop /NZkGu1/nDG63dlZORVKhUMlgwlk//ibd90m/7xF2izMd6InCScMKwXgv+GeECcs/Lb+la5o 0xmkXYymp4HsYlg9Wp14OdTlagVG8clwTEGOa+Nvrh1HlO3b6LLysWwQrw0m+5VkHtLgk5mV Zpf+hr7e5s38U9/SHDys1BvwJsInQJQg3lSnzabt0trQu5f7p02yjZtUGjUcIkR34Kgkn1ep 8zhNKgSN4dUlPSHEaxBfAnstkgA0jcfi6JVZ+OzkKeNeefHg0ZKb8nNqoCur0lyu0nzmLVis sr9vL/7EVTxGU3B9k9ofH9zZbd/JI2qf7LJc1/6yOyzqFjW1brsNE60yubOtoVb2ySPyHjV+ r1H+hDnnOotnXOm6DzLr7fCWLXHatqhUdf2mIerMDtnqthjMcuuzzbLZ8+Z9/dlnG+R7+7XL u63ElbX8K8PaH/7Vrpuj9RV7dLotttKvZn1yylqh1utq1KiRlYUDTzK0SpX9vLnYCQg65jt8 qNOwwYvmzst/aWLZtv26SeO1D9ypWLD49D8fyhw0SIGQNr9Ghd1xscc2pgAUSgPmQxCPIVeq vJghwbZm6DwqdF6F1Q+XE1il8JWeQ+hu7tiHzVv2e49tUxg0xLXGfSCnBWDyN/AS0zCLi/pG R3u2/sRlaSCLcXPjfCjjJItSWeAHHd6UR2ZCAJiMDCrjhUI3xmMu08j0KpNJ4/O7FX4M1ePN 8WEBIcLdddl5o28wOCzn533nVLm0ShPOJ3LLnHhRIRD/9MOvVxpN7tnfuG0WWWYmljZixhTj V9haWqVQkYgoBHTJEYbuVmFfaoXSofLmyHHYGnbRN5e8/u79t4/q+ua74z747/qFi57NrdXM pKjwWNV+7RCtoq82/2OLf5L9/Ey7YttRezeHe32hLrNQf+rXU4fcvnGlh7E+HvFiKlmp2aGv yPDU8apL89X/PXFap9Ns9PtuKjfX1ho6ZxoekCsa6TRZLp3F6ytRevI0mkdMud0WzR9w/987 tL/MuXuP2+Gy6/LcTvOZdUtkP3/XIjO/Q8MGdzWoVdG440mf56jX+kdxiex8GTAnt3WbVlZ7 /QOHmzrUBWd8iu5trJ+8ofvtlHFon9LZX3iee0lx9ojOqEMEDIyK4wb8Mkw96tHN98sQm4c5 SQz6+TRkpAsdfnipJArP5FNn6DIqdm73Ll6T9+o4x8P3lD071uBxypQ6EhTIRe9hY1oihMbH sijZiJsd8yEJPAMRjFEymMwkeKXFMmFMvDRtvCVMZjIM4nrwRKaBLF6zppCOhNST8HJ80D1B woexYkxA6vAO4G1QYmNo8lvv1KoMFo/HKJc1rOGxWxzlpdkyYJC8hEQoeRzw3JwebefLtVd3 sX7/s3PbHmVOht+JV1Cm0pDAVofLpWhQVz10gH3PLtsPP/iNRvggZOGhGtGdTje268ebKiOn HCEkTYOtpj2Y4IQzQtRyImzUiLgsn3n6O61+3vjh8w9/0L3DHa+889AZ+8iCTJnXVga1tNpH cyxDHY1u2v3HqVauX4saI1zUmOVrUFR3ncf5E4lDQMiIDAeRoKoamfXVmYrCDjmb8wzaGvps W+bZH05PNTS/0uAtd3qsLtUppa8GwNTvXm23TbFZO3TuOXDg0P8e/ggTnR6tEbv/q1T5HoUT QcA2n9mx+zfvb9swx1tXpayv1an1JMRXl5enn/yGf/3m829/IHOfPz/9mP5Qie6/L3iHti6Z 9qHsxbdU9nJ/ZqFN5jfilwB2UspdMD2JlMC4FplNxn9uhQInABOn1+fwqGAh4JnPofQbFPLz Mz+3tWubefco16+rvZ9/LsMhKThQE/cSG6ph0JOGjTHfjFgx/blwFkgDWWVtLf5bISE1gFs4 Aherc9An8auwpw8C6RFfr8QfP2a/NBi+B64g4Fxnc7kqfIZ7bs1s0ersfyb7zp5FxCp6jiqM l+NAXQTMurSG4f28WVrLp9/43U6jK9NFImEVCgSrYvzG7DTcdI2qQdOKfz8vKzthyMzDCR+Y LdBjO2icN0lIAKQIpiX7qgLfZEotLtwq0rPU+V12n9atlitq1PTs2vnBB4/mPfiv8Z/PeuPl Cb+s3/pkfn5DrabMa7XLnWf9SrfJVnht3Xp5eplD5ZR5jK3VBjlmYwMfVIKgBNJxdfsM9bS5 jQyAOI9cv7vMM239yVaaOmV6Z6ZDieNDNjgUH/rsR7S+nkVXPzPlHVd944dTP3FpVCUGdROz w66xY5ED/FTMMJJpESw3wpAhUMhl99htLica4Ffayr0OJ0LY3Kocf4GidMXXxruKlZc3sM5c aHBWOEwZmjILVjBgObdNjSE6OeDb73UAzmVeTAljoB4zybCBEgAGT5jE/MI+akT0e3w6k8pt qXj17RpXtS8Y9/S5LVt9B467FQ6d18ANjqErj5FHL6yKfiZte0IPRtBa6b9JWoBMsFT+g3v2 V7pteFDZe1pJ48EBA35h6QwcI/hLTrnZ7KkoVlUUa86edzv88gfvNLww0bVtk3v6bLlWp5Tr 3ZgWwHJrbOpgLZY3bqQbMcK2ebvn5x9V2Bkfzh1ePaIRlgo4FaYM3c3DZafPeJb+7NSrXHIu WoPsZi/3l2K20COXufw2s7zUoih1yCscXrPdb7UprHaME7mwagmdV0zhud2uzJx9ua4ZP065 vEvdr5Yu8T1y/yhL2aLiM4WoSqmbUXbkeCtdYX6m11LhAya7FFgB5HfAjQn8Q9rj8HhcXixg hNOHU5HcNrfG6m7RufDbLNsPFcUNffq9Pufj5Wf/abTVbNJoTu5lTx0rzbKUGTR5dUx5p9WO 80YAt5rMDHLPGen3kX9cW6EDtoTFeiqcuYewe9IlB2bCsUWfXImwNPuGta5ps/R+qysLvxkw qFPv02KiEWuSAOAOpws3gPhcbpfNavFbzb6KEr/F7LIgTBkrIfxYnemSyXUyrRtjaVmZ+l17 S1+d6mpYV/vEQzJ5pt7lxq4aXpypgmpT8QJw7aOtTIm8Sj6c5EEK/xdNILoCJLJM5M0Qz40m K/GytEeWuM1SyIFbzEGZGyd+44UyZWXfeYvTZdX4NbLCOqreXfUd25T+uNr19POuM0cMWQV4 7fCuwpXAwkC51S4bPECRX2h98z1F2Wl5ZgE5Tg0vNpZ/I7DA4dIM7K/p3N7y4WzV3gOyDMQM qABR8P+8cp3hmp7qpg0wJGa8psjSpqFGZfT5HUa5xu20yjp2cZLjdRHHrvNjZtTm3lvbcNLg rFtQ02TMrmvWTO/Ue87UTs9MffP3bQd6meqsMnnzO9dVuZ0+uDFquHaAZATICj/E/+M+JCHH inO3IUuu6tNg/OKjKypcm43y7k0vWyBXNiw9ay21Otxa6+FjuvYdW+Y2Xa1dcThP3mu/0klO EwlHCyIT2E0QjeA35JODzRGVSqrAJbwqhYYs9fKjY+pEvsyFSDzIUMk1Xl+Fx6Pq01PeujHc UdOVnXWZerUpC1gr82icPruuZUtM75JjOzEPgO64Ql2Oe5QpL1+w0Hj1lcbRN7hXbnMgfEPn 15KRNaD+X+vHXHiDL+o1uaXhj4YYnl5UFVNbuaCx0YULiNklnlh82GV0ITFL8QpiPzIc44i+ oiW3hunJB7UmA879xuId+c69fzz+tOyrRRk2mycnw+vywEFQu30OhVbuc2jzaxpvGyU7fEzx 7TKP3qgmk2hY+ERWPuGQNo9Srxo9AitpXF/N8yL8VpaNxZlYsa0xOxSDuma8+29Pbr0Kvybr 389o9XK1S+1EtAbcFJ9F4dM69RocSan2W7CA3KtR7qzvKNF4+9bqWmis412/tvzBMTdcW9T9 xddenP/ptJmztV0L6hVoHS6rW6nHhl8qLEAEspCf5tCHrF8nEEwyMevqJaNRiJP1NG+u2rlD t+aMYlad1s3PV/jKSovVGBPUKUotrp9/NQ4f1rXpFZ/smLuupnuYFkumIDQglqTgkXGXkEzd ADK+yI08cg4ZoIUsh8cgIGZFMA/pkatcMhvZQAlqeN0Vbqf8ig4FH7wmq93UBkB//BHcA6tS p5VhmSVC5Rwar7pcp5Y7nQY3xhxlbismAeR2nc5od1pffU3VtWPu+IdtiF47dspLDuRM1eMQ MhqxVdhVsPHhmewqIWLGlWAi7LYmqKBYVeQmkk/48yJCCTJBAwVEaY9MYJALcYlRcLIaj9wc oAvGx8gWFTgeUnfi2NmbH5aZzT69wmMu9Z06hZ6dRq8tq2HU2OwyFcZvMBrv9SjcaodVP2iY okUL69sfao6e8OtMeGURloXdZJQKJYLLjC07Z/cqMq/5yb91hxurhbBgHO8+GcHK8B86Zhv1 VI0xj+gHtioZ87T3wAmZ2qCQObGHj9fu1BVdlfXiU+f02C8D8R9KhPtvqlkq1xuuatId8wxn Nq5yq6znv1/eZN+pJ++4aUmjH2q20PvhspDOHI4hwNpOsosHGQHnfeiBIPCokAdXEnOu6Bpb ZViM6arTr5511gHz3hM+natCk4GpVKOvgrhC6/Z6ykraNe7cPKP2juzde2sYW52Ft+dFvCl2 y8EGFQhFJQ5oEMu4JHwueFrwR8kV1tVjBBID8QQ5iZuGrSv8btgPISw4zlyjUx49XXrLS8r7 RmYP72t+9kX35o1qo8kqs8gU2T67zdCmdc7kV0tVWismQ8HlB5AqtR6VEkd7HttX9urbNae/ rlRp5IeP4FA9lxMudPAjeNmD2em/VWqBVAIZg8wLcCtZXVVhHQnhlWoW5zhwrgp5AQFkxHMi iIZJSvJu6XCykBpwcvCwznIWu5liZz6/Cv0WPYLGdG6VQoZtVbErtMauUmY63EqfyTd6qMZs LvlqITpMCpXGJXeho6XzGCx6AJrcMHygPEdfMetznc2tNGk8cocLk6Ean85j8h3ah3gO2e2j 1IoO7m0HfDt3yrKMfkRsuDU++2l3ocmvcCBIDcfqIgZ+ex3txtrW1gWtujfvJis5b/9unUqZ pVMjcsE5/fPZijxZRiMdtq7BUDdCSbH0CnuNRbongbZTjwzGJcevOIEyPqs2p4b6QIeccT+X fGEozHJXlJN9/VUavcy6/3fZ+vV5Awb1vazozfPbv2+ubHtO5pRh3ApdcPLrDG9R5cEQO7dU ghuhwpEmaDnADi3FsJdOpraQzccQaEwecnR44aJhBb1Hq0AIC2YfPGdPuE+d1l/fBZ6q5/ff 3Vu2eg0mhGXAiZPZzru1HpdSpnernJjcxKp8zKeSqGGXR6mS67Pdi76p6NJRe+/tKtSPXYHI lCVBVTSOOp5V/VhW6llMmXLVQwuuOWG/nMghjxn3L2WNvfQFUYPgptF/KWwQXAeEPyB+C8iG GUW88HiHFUa136D36tTYEwYjL3hJXSozkMiNaCUM1cCtcDrcHTvKr+lmXfqDe+cepT4Lw91Y 86f0ZzqwC0+5RV23lnH0NR68mT/tVGEKUak3yg0qv9GHbiPGEuCnZGVhqxovZt0ysB+NAVtA yPCVkSnXZWhVGUqPFg4iOnmAm/kdPMVy1c1thuaZCjwLflRt26NVyjPVyl8aNZlv2ZfbVodd ztCJU2KgnUxYcN27mAYic4FKhMthPM/ld9S7ss7mOtaPrRZIVjptXqzLVmO+oUI5axFgZXD7 Uc30rX5oXHEwz2F0qbAZEeJYLbACZltJqBe5K8AOMvzv8yHMF4eaw3NVYhdamCviReO2FZOr fRgog9I6uQm+qlKNTWuNBkWG0WvC6s88jVbrNhl18mxMjuAIdYyZYT9a+HJYKY69rKG5T6VX OD22dz5yHNrh0esx44ldTDjXMGbLLxzBX+0tTqVHduHu0p+mJvIjjsl+rQ87I+t0HqMWyyNJ xCo2UsCTiA/eT3gIbpXehYAMjQJLaORah0qXf9NIoy7P161r4eIZMp0eR2UCDb0qk/vsafO9 TymH9lfVa+E1lebPnowYf50Krh5CX3X5LtfJl97wrd2AXbQQbKEwYg9uslZAoUQQKIbrnQq5 sdykN2CNpEGt9WrX1jOsqGHtmNelX6ehLmtpyRfzfHKHGnEK9Zt9aj5lz3c2r5WDCT8uxh2a kk+c/ggCxogrpVCqEThvcBX0qP3BnOMD1PWbK+UWFxxHldvgtfy4SrfulyZX9xjW/vqJm9/4 tJPyyR8Br8Qu3O6P2GORc8dgJATekUgWldeU6TdmObHBmgP73Lo1xOcNgRlSiKRw6eQKjdGF 0DOvX+PUuIxGN8bCNNiKDQbG2CJWtcOp1AMzs/S6CgPQWevWZ2BhrAubkvic6KGjfy8z6f1H Dpgnf6i5++8yLCkrwZpZ7n6lvy6SBSSBjN6X0FOQiH7snibHnkhVcdEyfeKijkUUj7RYNAHD 4PXzI+qLbPBudSxept6Up3E6vehXopuC8U8EexEXB+igLtejD+oq//objTdDo1X4LKfcn8xW yE1uuC8yOB9aLBFHz05xvtiR6cl22R2fLZI7KxRGDHQjQABLkuB+yR0eh8LlwOAcdhX0rV7h tJ7NLS0u06JjhIAqN2L+yX6CRw47Z3xi3Lh5X753WmeFRme8vdfdNYz5ZdPes21eL89AF0u5 uVbNpXt/qNcnEwFiTrJvIxnLh9niRDG0DQPq6P56yMpSL5TNbZqz9wrnlA32ybmZSq/dpcmE v2W3lpZNfb+gfceRfUf/eHjVUtf2pm2Vf9+MoDccqKdwwTVCvxyVY6ECAAtb3dqc7o9n246f U8ktDi023ZUhIMVB5kACHxgSWKc5sNM8Y6Z69z4X2cJDrlr7s8Uv1x8761TriAOGPi/Zi8dj Kz+q+3CWbt0mhPzL5nxe6lMYHHaXVmUnx6T7XQpNhkFnWbTaSg6EcpJhQXLLgjVJ/I1VHmAL aSwhB9l8UVHo+WTgikIpXVW8JfSnV1BjvMxx0EUqz69LPjjq4SORzHHUGCKpJHtIUESK34aI QmFGBHEMvQT09JKOK0O0oFRYGXfNaOaHHz6Chx3dSO+pE+VXDfM4Sz1yLd4axETo/D4rhqgl jqeQAABAAElEQVR8ciNGsrRKLOwmEvDmcd0mTLM51QjM9Dgdfo1fq9J4bNi/BzRkiBkwiH0a yfuKfxgb0mQobdghFh6Fn0QFkGPeMD4u9yIGwSXzIdxMibO+5R6Xw2PDHqjYdkYDAXiByVpz hFZZffKCUplVZ3llqGFBruLOK2959obnlQcOFA+/TXbiqEOrrNG42ZNy1RzZtjbXFiJWwYuo UXKgGzwXbnNtCmas/WgFWb/DdQG5MTJiHgT+wg7YXhYdaw/itLBIW1FR5jr94dG3/RlDMo2l CgV2iwSQqyoc2ncnZt5+509bf3j063HZdvNry3xtTiE4AuBNou5JPdxELbAccXFKbEcLdJd7 nDotZmkxgIU5YVIjqZMYCHt4YwDR6sbRmz6PSa31IRzPblVostHVxB5CShU20AA8ahDd7/fb HEoDInAxkenw2tTqGj6vA9HKPi8cNi+cWMTS+hQwMdxZdHRVXp3Xb/c6LdlPPGEYN5b8AnH3 kIE7Dh8ZGt/hIzGeTtoe3nf89PFT8sTHm6wMkMWctRRVgj5lGAbFT4ukRybK+efO5L99VdRS DPIjMh+hDi6c/whYIhCAVULwm7B/qxXPGbAMw+4kpJP70D/Yh1mGEyTxohIctLvJfvcALfyP nb7I6JAaDgHBCjIp6Lb40WPUyl3cIXNAJ2CZC7cZAzxaVOayy1zQAVOH/mwPFwnhxHwlAUHU qZQ7s9xGr073eQ/TolruK/LaPdT/UbXXWTzxLc/RI5oMTI5qN+WY5h1ZX7dXLg6Ewtg7xrXA iCeJvLZ4a4kgLsmpgy9ksJeZ5qE6uu2+i+ysTQRgttRUw+C/tsZ7X5d3U9eqoS01a9QapwKA ZZ38vqJb5ys79Lvr7NY3V0x/vYfy6TXyVkdc51TAYQAPXDIcUIDWkccZOI69tJ3otLpsZAPL oA7sL1wnnAmHETYCvWYP9AeViQS/ymU2SoUZDliWFBjk2AYE+8URJMbebw4ALg5b4MRiDhS3 DB8MccqcCpfK45abEeKB0F+sFMBdRt2gvDAfQTMvVLWkjSn7UFEJqs4njwFkTFU+T/zaJ6Ve DPFMpRh04sUJtCNYUcCRCF6Ky2W5UcjwzOM/rtuoVHS5XF6Wb/RjbJ+gCf/DBUNhCi6Qi16b NmLoiez5w/ug0sjRZiw14pHgvcJlWA56r5g6DafBS6z6KuvE2y2L62U2eeHvz+ebsivemeZc 8K0vx+BwOjIatZhdYbcXyrJraTHnoCBL0+HBAASJipBFepmc98OBIyecYALpQ+ODukBFxsbc OF0SI+9YD4R4DSxwRHi+o0nDvJ/zS98wH/k/bY7e7XeSxUha9aFjFc+8Wuujt+7v/+D58+c+ 2j33ne6KsXn1GvlyLT5s7UjaBLTGP0hHYAe/OSRNdqcIfUBFxs14H2CWwJikp4wmUMDi5NHD N/mvCvlNYR/wKx1Y1+R3abEJraxWLbi5JLoG24gIDM5YoibC9AtSRjQsWJDIX4HklMhk9QuE s/x4EkyTpIXw7048NaZpKmMB0gfBHJ+jTs3aX02TKbl+C+5hELMCoolzhRvKu7mRt5eEqYd/ wt9YUsYEUMLwF5jk4WXlE+HV9bg/3vrxW/Mn5ekL/m/4c61rtXd8vbT0tfd8emeWE9Giuctr KWatXdeqXz3sPYuoeRLSgKXpWAPAxWuROtEWsgQ71CTgF8G4YAYSeL1dGGtSwxNFaK/Ob3eX nrecOuowHFYNzG58pdqssBOQQ0wYNmZUZKjdS78vnThZ958Xnhz575JP7V9Z56vvrDdhwDN1 sy4L2YmaKFgLbTH3LbAdLgU5+EkQWIqzf1he2AUnlv9DAsMhKhbf+F3ArhiYw8QcLkLr0p8L ZwEAGbtJ0SxPyxhpQgpWhpdVFE05RhSRSI5LICYeIfHQkHcYb5oXB5vZvtu9CnGtmJ6DY6Ik kVGhj4go7u0PUUSkwEJ//PFNHCDygVAkAmkuwQQjk6RDM3oEeOBSKHcd2/jhmk9qGgom3TC5 W4urnT+tLnnqOaX9vNqkwjSgIyurVr/e/Uw1Nu782X+k1FSYk1FXq8jAZo1eFaKr0APjXl6u SlIFRqm4WuCbEPlwxND6gGPmVtrLPJYSl+OUy1vmK/Tk3q6s371Q1bNCqSlxF2ttOsTjcvEZ buz8n+k2fzLTkZ9Z6+mnx/3t+Qy/+5NNc+0O3aiOQzG9gf1yyRYW6Mr5yGym8MMazRVwQEdt wgipp8gu0T0nBHzYj3SsgkamXMSQcKGxBTZ6w61z23ao1ZpsVSZETF4ViSfD20H4Bc1IXGSE fqEHIglhqWAJKkB+YRP7YKgk/al6C9B3hXStMEmpVBS7Dk6a/cJ59yk1gkLxa85/afCAcm8b e3BxT8PLibpkA56wD9cTIovPsSdPsAhprNSGn4AeHAIUiFgUkV4erUKOWQIMkfu1GapMRGRh B/tSl7lFva6Thk1s37Sz7ceVZ8e8oC4+o8bJ3pihwGDRudPNvvzls6L+hzv1XltxcsX+3Qd2 HC9zni6XndWpDL5MnyrDU0Ov02Zq7W5sQYEl5xoNzgLAwmysPAdeI3CkzFVsdmrMfpUly6TX NdRkdlVlFNXIbuaU55075T/1Bw7bdGAywo94EQKDZEG3EhtyaNTY8OKVqac9nprjx427ZZLS lDNv9czt+5YqMPWh1Fk9FkRHAMtIy4JmIc0kLzs5RhNm4axCsIXYE5jLrcok94UMsoV/BGhH bBZOQK7CmUjvFLs0en0234MDx3QY1hKLolAZtXMkc5XmhGsmpnuVVn+RhGPWsnewaoEFgtm8 vyI3lFcaPVkZXkiOrZxY9RFc4lpEkBFZwUxxFkFtQWJBtozOWgaBDOEUcrfXbfaVb9i73oU4 dRJFrkUmnw0vHkWcYCZkhxEgn/g2AQ3Jy4lyvPM0HyP4eo0OxyQ57GT4OvAC4+Ul5QFFuHcZ m8Bq1EqVRWX+duuCn3ascntcvdv1fmrE840zm1UsXl786NOK80e0xnyGjBDgtdsVbpc+N1/f pKm7ZePztbNP+5QnnIrdzvLTJSetPtfmXQcP79rToVNbu8tZVlFSXFpSWKtQZ8rJUmT/tnN7 m5r5fVq3LVCY2jhttf3evNIy1bnTiOfH0BLG5hByQWZfCbagdVCcTDrCGliWBCRSeTxWi0t3 1x2F//dvj17zycop01dMM9sttXLq3djzllY5Lb12n0tuJSam5uJshjQMhF8PL047wO4YXBFa BIjBh8y0Ato4Y8I69ENtFLyS+ht2R8ivABaqyr2IKmles0XLOi1x8HvAswsKJ7OWIwZJiQvk h0lNIW1IVPQawkqlnumQsKpKhWoOU0i8Okw04cnkAxmlCwkR5+Ny45AfhTtQFF1IXHrEqiQo JHpVDLOIuCALHvkAF8sRrS16qSD8Ai8VdhJTI2wishMkKj2pzF07d9vs1i5dOsfkPlJy+H8/ frhs2+JMXeaInqPu6HKbzqks/t8X9tffNdrLnEZoSYb16LsNNAHMYEwbU34uxIF5ZFhvrjMY lFmZniyDPitDXlhv19Aeo199fcJjTw8e0G/r5s3/fOSh9z54v03b9j+t/uWZW27+IKtm1zyj zezwVlgdZB8KpVxNVpBizpVgGHGUiOdIEmRekaiPNPcHPVVEkaDr5rZf07fm888o2rT89dja j5d+uOnQhsYFjR8a+FBR674K/C5Ug4/H58KKV7xfAeU5lVIOZKINjfGgk5+8uD/Bjl7cDKkn DP+JF5dPgUzZvHkj8fKouQmYQ1pOSoRIi+eXJFMVAzK+oETTNwZPGidvJ/dOkqEiPE5kip4c uhP8weYJjg6NlJA1iCPGFyASfTGsy4Zwi8366KOPbN22tXu37iqsEgz0JTnfjUNqwiSX7Tyy 5eEp9y898F2WIf+5ERNGd/m7XKU1L1jsfGy8x35Ao9G4NTkynFoX/BCUIUNRiEjFfCOieLGb hhz9xnJnuf/s2fLTh3zrttfMyfQUdfrgiy//cfedPpV6wTff3Hfv/fm5uWP+eX/RobMjdfry 4hPYBcyF4Dmd3IPoExJHj6XdpFXUPvgOAidREv+Rvp/Pj0WOWAflcltUW3+3Wr3qvkWNCpt2 b1m05/Tu1UdWLVm/GONlnRp3JyeBkIYSA3FmIRaB5rjAIXXoyyPfg5lS0t/kKuJcVq568kU+ xDoxP5xsWgM4sDAKSxQAwpxfzHm/xGp8Kajz8y8/5eeIpMM4RMpjZsUUEJOAX0VCxHzGlKXj 0AAk+BcJZDQ/DgEcf8o0TqmgiEcxruYkxBVBLN4ABmS0mHu48W4iiJODMKyeDn/cQUZe3Vj/ ONvTO0UEk+4TtlvGcBjkKeQ7d/x26NDBjIzMGR/NGHjtQIPBwCFF4M5ywskrmIEzwwvqlFrP HTyze9+xXdhdo0l+q8zWlyn7dHP6/PYTf/jLSnAwAOmT4g0lLybptkFzOGlcF5AM5iMaFIfz wlvCuU1evcqz49gVI0b8tG/70aOHM3Kzv5k/v2e3otnff/v71GnT8pv4FBYXDj7HPvjQE/t+ gBc7YWBjVdLtpX1ALrAWyKtEjC5Rktw5YAC25rZaHH6Xv11b7YRxuQ/dq83J2nzk53cX/2fV nh/yM/Jv73nXwA7DaphyiLIYryLgx0kl2yZy3VSvf/7XCxYt+vbc2fOtW7fCtCKpEbMEBM44 G8ayefhN4d8mUhVKFdiKCW4qndYg5UQs+6ARn331KcmM8o9R04Zzignk8EhiJ8NVIPSROZJS BHomxCspNLECoQpi2gdoeGNkgjqoFQWZYZdiYsMILtZFhOoxNKX0CXFFEIu3lXUtw4spN6cV kuSt439iaMsnpQNYQD7sj42HVKlQrV69+o3J/3n11dd++P6H8vKysU8/Td4xAnAcWnBPMnF5 yFg4vEPZedeZhRu+nvnjRweL93Vv1P+2vrf1vHxQBryk3/ecmrdQtWCp5fhRpcOixoJEBEso sLUPNpjAdhyEHbv8Qx7+w+b3GoxuIxrU6pvTsOZCn3nj7j36zKyK0tK87KxSs6W5X/1YjcLr MSCvkbl8JqxRghMDDjSV7BCNfhhWfCIWHxMQMqxaADBjS1hsNmFROBGsr1MX1FJd3VU/uJ/x 2n5ek2H32V1zV838ctMcn9N/fdfhN/W4uV3dDgjRIy4paRc36QH/kfSFuc3ZyPCYfPee3UMG D8nPz5/40sR+ffvBjPDUODeV/Jig48w3bMJpch+jMaFrOSS+yH4qhQjjPSbRREuXRdWIsMUk CMmulj1N6I+uJb4jx8iY5oK3i+WHEglYIcR0IVIRqsfQlNInxBVBLN4uCSATJ04iF3gELnzj ncSq6S1btvz73/+eNGnS7t27X3zxxSVLltSpUwe+AF5jkBGfCp5QkAVPMbqjZDRHLjtaenDB inmfbvzfOUt5p6btb7v6pu5tBubpc/1mq3P9Vvf3q2wbfvEdOawoN+OQEo8OZ5tgcxy1zq8j Q2ZqrFdXK21eXe0mU7O9k/fukumMWHmEgS81DoX0ujKxtkBr8Lss422qWzR67IpGjiGHGtCa IBieRIUaOyD6fBgsR6eT7LiqsHsz/IqajTLbdVX3LNL0usLfoB7WMWw/8sv89fOWb17qdJT0 anztzYPu7NbiShXQEcftckF6HK6StnLGDNwlgNRvv/02derUvXv3Pvzww9t/215WXnbPPfdc fvnlHo8Hs7rUOBxLVX1VTyDjtzbmSxKDgC+ratIEscI/yCDjtvi+jpu1jCAIJydX0d7cONgj BVZhDk/XaKrxyERbmACvVGMuGJDhXV23bh3A6/nnny8oKLj33nu7dOly6tSpxx9/vG3btlS9 EIRx2KfEyif6wmO5DZIK2Z5TO+avnbdwyzcnzKcaFTTo17rPwHbDmzVpmS3LwJocz+4j9s2/ ybdvKdm1T3niD9n5s36HDYeoAI0w/YlDNPXt25wc0Av7ItYg+0NjzyEuuITUUeHQ6G3YruLL xU1Ly7EuEZv7Y+gOS0DRdSWAhpF8rKnSGnx5eZ5aNdVN6pvatjN07Khs00aWk4mDJQ+e27d8 74qVW5bsP/Kb0+e9qkW/m6+8qXfrXjj8ExBGnk3gIhfwAG0oXqPJaC/1s8rLy8eOHdutW7cd O3bcf//9Lpdr69atdevWLSoqYo4YuKRuYkryEwWy6JWGnPhEtI5OG700Up+QDpFlVZQjpmIa yITYLMC1wEsucUsiiMXpLgyQ0brnzZuH02o7dux41113/eMf/7juuuteffVVvMNXXnklEK1X r17NmzeHd0ZfXawwMJeZd+7a1aJls/y8Ao/PAY9GLcMmG7ITJfuX7vxu2W/Ldh7drvJ7muY2 bN+sa7vmV7Vr1LFeVgMy4Qo/6txZ3/Fj7iOHrX+cVB0v9Z86W2o9qTp7Tl+h9HmscpcV8Q4Y 53J6vFqyMbfKjT0qsBWi11tsUBkVRqXahDNAPFkmWX42DiFW5OUp6zcz1SxUNq4vq1MoM2DF pOyso3T3yV3bD6zb9vvavSd2ldvNhbl1erXpO6TjkDYNuqjVOjJfQmAQ3iE3ZEfuJ4I0iIcF OKN+1q5duxYvXgwjHDhw4IUXXvj4449Hjx79xhtvvPbaa/BVKepBDEMxYB9Li9/RZHPTQJas 5Xh80kAWf0AslSH+/tJcsVp4SlyQpLh+UasWY4nWFDH6qBVckEK8gSNHjkRVM2bMAGYBxfbv 379gwYKMjIzWrVvr9fpHMZH5yCPXXnstKPFBj/KLOXO+++67wlr5RT2Kbhx9oxz7oCmwIF1V N7fZPT2b3dr9zk1/7Pp5/8/bdvwyf923s9fOyVDrmtZs2rBuq9b12zbOb1GvSYMaHVubFNjn npgrG/87XLJyuww7xmIdgN+BWNtMbCJEwiswRYiduMnO+TgPQKnVy/RamUYr0+twSjD44FRh qfVZe/HJkqMH9/+y9+TeQ0f37z+5/7jtKPajaJrVtKjT9Ve16NW9Saf8rFqwP/qRZNNveJQK ud3hLLc7sC/33LnzBw7oV7NmTSARUAyQvWLFig8//HD48OHA7uXLlwO2SkpKgGi9e/eG0woj UMyqIuRCu6ruE/kQRntkg3oIuOJhCbKK/KXSKilERG5SWQEgS20Lk9IkzZSMBdhLiAReVLyc N954I6YpKyoq3nzzzcLCwszMTARSHDt2LC8vD34Z6iAw5vd//fXX707DqNFUo9H49NNP9+93 bX5ePgbLVRiowtOAvbdVxqsbXYF/jt737T+1b/sfO7Yf+33PiZ0rd337zc9fqNQavU6fmZlV K7NugaFWYX5NbCGbY8gx6TOMhmytTotKEevAuf3cKZvERyJrmEjshee847TZ7rKW20rPmc+c BnyZz52znjxZer7UVgEdsL9YnZzCNvVb3Fj/7+0bdrmsTqs8Yw61DnHAfNiqB+P4yv379n35 1Vfnz59H3xTTFtu2/eZx29GnhheG1gGzPvjgA4yCjRgxAsrAKUN38sEHH6xVqxZcVKgjam5m T9HSapQpwA/BCwxFBQRxqC6QEVsAoxBwxlGXkISJEhbEex2/RxavxDTdRbEAsAn1wvUgwRbc fNwTTzyBl/nOO+9s1KjRVVddBX+tYcOGtOcFsoMHD2L+7ttvF/3664ZRo0YhDS5MRAJ7SPdT TdwodCFBqVMbL6/fAf9u7i6rsJsrXGVnyk8fPL1316Ed5yrOHy85eOLcXvt+p81ld2LDe6Vf q9BjszH4RBoswCKHpuM/zHjB/VHi1DscbQk3yqGsgFuFCAx0NE26jAyNqb6+dsuWbevkNmiS 36RxXoOC7IKcrDxskxPo/+OIXMjAvATayAXiAbxKykrhUd5yyy3oLe7Zs2ft2rWffvpp586d p0yZcv311zdt2hSoBALANMYN8Y353P79+0MxaiuIwueSQS6q7gX8FqBTpaGmalUPHQfHV5S1 gZ/JKSLIYISkkF0IiKq2BZx0VnWwrhgqRNAH+aT/JsEiLSz1JfwXEi8qHLHs7OwmTZrAL0Ov Cu8zPC8AGYAJlHa7HT2sV155BRMCGAWHk7J58+Zff/21fv36ffv2RT8U+lGBJ06eyjBlZGWY yN2Vy3b8vG3xvEU169Wu37TeM0Mn6gwai9NmthVb7DaL01LuKLU4rHaPxWKz4EQ6ABgcHxID QYLDuCYjnlah0upwNECmUWM0aTMydBlYVGA0mBDUplKFxeVv3LqtIL+gXp3aqJmE/gPBgnOv ZB5WJu96Rddnn332hx9+yMrK6tq167BhwzAchknbnj17Io36brvtNpQeP378l19+Gch9qNNK rc+3GM2p6u/UPkJhjzhcXzHtCY1kQagkTJSYnCh5RDyPX7JGURE8RtHyODOhQ9oji9NWlwwZ UIy+onhp8cJfc801PXr0gCMGT424Wly0FHwTxGoAxeCewHPBKHifPn26d+/+xRdfLFy4EO// mjVrAAc4aPz1198Y/9z4tpe3waazarlaW2jYcW5vy95tt+z97bu1348Z81DtwrpY7ejP4T/M SdgKK7ec0JzEdREHDuinXrJoXsMGjW6//S4izqcGjuFvaWlpTk4OHQIDPSYi58yZg+la9Bwx Jvjyyy9jFB/ADQcTo2DoYMJfu/XWWzEHAmKwo/lI4HPhUYy0Iv2pMguEgIwCd4IQycgpd0DN pEQl2cSwiokMplJsgRG8sVmqLQV7Obn3lLyoSACt8K3lPsQ03DgaUABRZidOnPjyyy9Pnjy5 ceNGOGsIREBnE2NqrVq1wlwnIjZAvGTJ4o0b1hefOwshSkAJOnY2f4OC2n+/YbRKrX72mXGz /jfn7rvvyM7MFhodx3OQ2A7ygZFJdAVJcVAE14x76NA39GLbaNJbRCHUxf7S0BnbTcuOnvjj uyXfNWlw2b6De/fs3Wu2WDp16nT06NH3pk0DFmP4DyEUHTp0QBpeJ7Dssccew/g9Ak3atGmz fv36c+fOAbgxIoYuM/qSnBYk9pU2H9/4EHUuJpwJDUaVjO878NgKnl5RiYxGtJRVx8hoTnRi xiWaYKIqI0RUcvTMEJCJ0lG1LrBOoppcepnsll4Q1enLiapYgjpf/MqRQ/tWGBHH+799+3bM 8WFE6T//+Q96ZOPGjUMHDb3R9u3bv/feewDBVq1a33Pvvb379CEoQHBJfvr86bzCAqAYPKMz Z09jAmHVylWLFi7SaXVt27UtPl+M8St0VIE7R44cwaB7ixYt4PERZwhIhSE3KKeS//777xih b9euHbqE6PcBSdF7RZcWgWzYEw0g88Py5ZNef3Xo0KGrVq0ym81Wm21Fo0ZA3n79+qEJ7777 LhghCR8oBqj6/vvv//nPfyIuDNgEFwwjgxjjpw1HDj6gpNZAgm+Qv0SatljwNAou47AKnyMG uWiNAlvHECGgjn2pbBa+aFxUvmhmTNnJccUUG4sgJdWmRAjR9MbRNwMRYul8IcrZK43K0Ges V68e4AaeF9wxeDdw0zBeDgft7NmzACm4P3jzEQd/xRVXNGvWDCwUDlauXInhNsx+fvXVVwAp EMODA+X06dPRgQWCTJ48GcLLysowH4q4UywtmDt3LjAL/UGQORwOUKL3CkaMZ4EAvVp8b9u2 7cjRI1dc0QU4Q0EHOIhxLuAdhvCGDxuGDiOEo/O7bNkyjIshH1iGsTwAGbqN8NHQcaZxYciH XwmPjOqMbwpeFx3C4D9+Flo0nrIHDA2kn+gSo5cKujExiGHSYKVR/sagiVEcRbCwiEoSvmN8 3AUHJWKZ0rULCElljIvVLM3OSOJNRAqPhzMWVyoUjFVHPHpWEQ19mfHyA1MATLQWJOBYoV9m sVhMJhMwYvbs2XDNELUAVEIMGsgYI7qfACx4c5gWhDcHTEGfFCui4NDBM4Jvhc4dPCngDnLg i4H+gQcegFdFJWzatAmLqN555x3MRcCNeumllxo3bgz2ffv2vf7664A/4B30gT912WWXAVtx WVxc3KhRI+RgguKpp55CFxIDeW63G+BL/EScLu713n333fhm7YIE/HjQUtpGWnsVWTURseEP WKxHJXJFDrkXEjCCrjpfk/CauFU8vGJhUH6QlXKxegVCmACQSxWFaDgK8hUUzoqqIiEEsqqo Iy2zWlkAAIFXHR+83viGbjQmAyiGS4AaQmeRiTTACO4VQwTEpsPrGTBgAHwxEKDnCGfq7bff xrofdOgw1g7622+/HaPsEAgAApBhuAqYAqeJWQAs+ODSarUCzlCKcXr4VsAmJOioPDTE5/Tp 03AGz5w5A2IAK5YlAG0x8gV0Q8QvGKna0JNqSNGKwRltHSCbVZ1O/IktIB8U2iE2WjMpAMeE 4aCIuEA4bmlBqdHAPS5hArUEl9F/ZiKIQ1qFpTg6Rrxg3hIMtYcRXNQLilz0nadpqMPP5BdR LKCl9BuODxCEtgAeHCYNEMYBCEPPDoNriHUAJGG0C8sJsMAAvTw4WfhG/xHoAy6wI0gVk4y5 ubkAMkyPbtiwASAIuMQM4+DBgwGCVPihQ4eAZeACCyRQF5LqxlcYWiET4IVMVkrT/EZRmRf3 Gz8Dg0deF6YDe0rCckMXzDMKZUV/Rvl04Y6Q4PUQemRhjKE6BFx8qihFQjLRZsbJz5clkaaR J4kBGRMVSw1R3Rl3IBFLiJAe19Jy4xImYBdchm4gr+YIGl6ZaJJjIF+cRguCB/SK0lb/TAoH TE8+tCGNDyuimIIOIHIAZxi3wjgXAtMwsQjXicIfpUE+OpuNGjWCD4hRM4AUSgW9Xb4nRbkg NlIZVnv1TxAgGxEOZEGlE3rGqMUFGBe6DUGZgndFjICQRke0AJcUc7CuKOWkSLR5UXiCYuP8 S4Es3bWM01xpMmIBQAlDE5rGN+AMuEP7d4AwkMGNQrcRMwkoRT58K8aFooYNGxJZXJdWp9NR f4rKYWRUGiXDN8tnOelE2gJ8CyQJZAxkJYBVkM3I+VWLI3UYRVwXgrpEeATVCy5FGNJZQQvw fS6aF5mDfAANsIwWIU2RC5f0Q2GIfjNQQxEcMWQiAQn4pgSUJVj/n/BvJR+/AHtQiuDpZ56a YE6ATgUIiMmN42VFeme0kkA+j1JwV0AmVUgkcGWRwgVCKnmZJJBVstY0+6VrAQY3tAn8S6Tx ARJRJ4sRUJBinUfQRDafMkbmp3PSFojHApUFsgBmx1NVmubStwDDIJpg3hOFIXqJNB3hApwx N41iGQzASikLNQmlZOZBEdJgYTl/joQIfle6YQKZIo5P3FZk3pmIEOjJahITyApBKFYezOXT VbrtfAHxAhlVQFxFvjzxNONLYTuYTPEqq0kufaWriTKVV0MKXPj5LC1oO8unavAvo1NWXu3q IEHQxguuEnlfoseaSanEXtrKvHIpESKlIfLjBbIoItJFUSxgsZi1Wl0UgnTRX8QCDieOHEh/ qsoC8YZfCOoXYLPgUkAc65KBtYCwclJ5vrBAbkR90SqKIBYIi7jkGMhXNKkRXFWQkUT9cbCE 2SMO+njNECY3whrRSwXkksS0gKz6DH346VAuUsGC4N9AIet/0WtBadjgeVCckCaYL/hLyOIw aJj2AhFil0KRgeswpYQ0VI7UsUlB6uBfYa1S+YSOyYxGJBQY/ZqGX6TjnqNbKV2atkDaApeA BVLTtWTwnjqcvQRs95dUkd5hdsNj2yAB0tjCYlDEqKtKZw/E6hbL4zUhubdFwBWjjoBnGWKi 9KFrnj5xJlmNEkKi1cBYohHFqUcYWWqALExkwhescQlzphmiWCDVj4pIVVVXBZUsUmUlsuKU GSdZuCLJPMNJVcS6vIH6k6mYsFK+gApMk3ikMRrKxS7DDSJ5lRyXpLhgQbprGbRE+m/aAmkL XLIWqA4e2YUzHvvlCa+SZSf66xIu5tK/Ss4QjIsaoDJGFIiCQCotMp9v7OilhJJSxKNZcDRa IJNcxsPOV0sqLbG/vhR59HzB5IPUVABrTqARgWsW/8/KebUF9RTIZKQ0n1xyQhMyD1M7IS6e csLkXwvIhK1PX/+FLcBeyL+wDaqw6cy8qYKq6LqmGMio9hdG9egNu2il1a3xf+VbcgFeJlYF 74ETy+MVV2mSPX4SStBsRhWXr0qpJQTGbI2wxpgMSREkCWQXRrmkWpRmugAWCLwIwSc87BkP u0hWF/amRZcWvZRWztEweZIKMVGxSYNdVU5WPOSSlaa8IKFW8GoPtEJ0bbmUTJbPk5Nwkgqp vBHTg/0Jmz7NkLZA2gLVzQJJemTVrRkp0of9xlT2F4LxM4kp0jBhMcmNqsb5OxkkC/s9T0hF ZijKxczFEqLSopcSlgCFQLyosEAmG9KOLTyamFSURdcgvjbR+05oo0uj+lKaoGTGEczgiCTG /kkZxxCqkcpM5Fu8xkQkpIEsEWtVJ9rGjZr27X1NpEabtuCI7k2R+X+CnMaNmvXpfc2+/Xt/ WrMisjk3jr7VZMwQ5G/evHFLHNa4964HsHP3Z3NmCdjTl6myQDhUpkpqSM6fE8gYwIcaekml OrTv/MrE116d9PJPa36UUrxe3fo3DB8ZWYrMn9euefnVCZFFl3pO3br1hw8fOX/+XFEg63ZF 9+bNLxO0EdbYu2/viy89V1JaTItEnw1KVuVAFubhCDTlLkWVExAKaGLKpAThXOwqjFs8V1C9 9GUc7HGQSMuPWvLnBLKoTY6nkBqc3GV2p9k9iIe/kjR/GzE6Tglfz5/7wYzpjBhu2sMPPX71 VUV/H33r5xfKv+BZJsxiTKtggkcYJStYFPl3585tr016+cSJY5FFLGfQkD7kpnFVNWpMnFaA 1KuvvPH0s08wLGPELIHfDBwywC6rKCHS/iqqKSiW1cge42CJ1F9KGOCjf+LkDePkvThSNYnm M4VpaZxVgzgNZKL2vDiZQJ/L27S9rEVLuvN9EkocOnzgnamT333nfcj5fE6YgJ5FeMNlO3b+ Jvo+18jJvbxNuwpzhVS3FE5iRkbmTgl2WgqIgQJhtQYv2rfvXFFedujwfpqB6tq0aY+0qG9F aXoU9UUC4MUURmK1WKeS0kd+QxmqD7BsxPBRfMSnxB3bdy4vLzt4+MAqeL6CdyhSHC+naaOm 8Ihhrs1bN/Oy08mLZoEkgSx+pLxoLROrWPCjIUaS4ryEaiwsqGkwGI8dP5aXm4cD05JThb66 kMPYgY9w8Rg4Ll++bObsGRQdlixasW/f3vUb1jGCEyeOT39/KoWzu+96AF25adOn9Ovbv3lz cpYlPujZfcjzAQFhjz36FNMW0qZMnUx16FHUZ+xT40BfUFB41VVFSAAyauTUuP++h3FJpY0Z 89jceXO+CDqPb74xDd3D8c899dijY6lMu90GAupd9izqC4FwQj+cMY2yi3z7uVF73gMK/Bo4 4LqePXpTIOtV1OdpTgi0gusKaQcOH/hu0Qr0QB95/MH/e+n1Du07PjN+LBtZwxj25x9/ifPu rh81GNXl5uROGD+xRdAaOL7z/Y/eX7lacgRARMPIrEQwVMgdn9cUGokPr0ucW4qaq5sWIsmm R6hKIVFcKiRDqHEC1+HKBhh59zYkKkkgCwlIp1JngbemvE6F3XPXA3AikhNMPa9z585SdqDY bbfcsXXblnXr1prNFf37D+zff0B+QcG4556kBPXq1ce/r+bNOXXyj2bNWqDexx996pHHHmB+ 0J133L1n72706eCRDR0yDNAGRoplQLFxz04oLj4/a/aikyf/aN6sBUonPP/Kozz2AQOus9ls QDEM0oPxufETAVUA063bNlOBt95yp9lsWbxkPtUH35C5bNkS0FOBI0eMrmQ3GfoDntDvpgiL KgBt0AooRrViVe/YsR2UvXr0ZkDWqX1nQOp3y5eBBig26ZU38DMzb/7cvfv31alVe9TI0c8+ 9WxFRfnmbWnXjFkxdiKEerFp46JIA1lcZqq2RHArKHJRDfHm4xVF+ue1q/GNHhxcLaDYs889 SX/HMHvw8kTidACDqNsFTw0gRWcV6Dew7Ibho5jbdfz4sfFB1Fu3bs1/3/8E2ERLb7v1LsDB M8Hhp9Xc1ASwjM8ONRiuwUcDiq1du+btKZOowuvWrYbA0aNu4gMZUIz6XOhIUm8OvliUTigV FeX78OFDaDI6g3AJGdkYHtqyTIz3/23k6FatWrOcXkW9kV61ZiW+Rw4fVa9uvWeeG7sJsMW9 i7v37n71pdcAZ2kgYxaLPyFwuERdrTilKeKko2Soif6T4opeKsWV8vwUqQE7h0wds+1RWlEZ 3ihiUYTOETpK7B/142bO/phC0lXdi4BT8MX4Quhlp45daCaO1KXE9PLHld8j0ahRY3zTxu/c tYMW4Rtu2pYtmyATOAiURH8T8Q3MdwPB1/O/xHdDjp1yrVnzEyPo0L4TMpcu+5aNBXMCN8Pl gUBKj++v5weG96DAmbNnWL50AqP7id3z1UwrrBIP3WRSw+Ytm4BWTRo3pdV17tQF/cfNXAzH FV26Hj9xnKZpKfALOS1btKSXF+0bTRD8S0QVyirkILnEsEywgIArZHcyUCggFlwKJCR3yWSy BOSkPbLkjFlduBBpQZ0vphAflWrWrIX8Bx8Yg3+MQJCAw8XPoZ0vI2+IbT/XJWQ0ZzlkQa+w TZt2yERHFf9YKU3w2a1WCytt2LAR0oL5hKDALEbGgI/lVDJhNJogAWPzTA5fK5ZJE2vWrsbP A6Y7Dx46gNkAgCw6krQIAIfE8kUiUWwCIenLC2yBeIEMv3d/1Q9wn35SYAMqgkkMSk7+L1CA j1yigtCVi/RrBPAkyhhPJkb3d/FcNspi4YGXtJBoxohlIsl7IcqIriIcTzbsJaUS5V21+sd7 /3E/nK//fjQdg2Ug/oHzUikXvLNVq1dKSajm+cw4kuYTb0CAPKGVmAJJrGqan6ACAmEil/EC mQhrOqvaW4ACysFDB7/4MhSzjjFvjBYhDoOqn5ubx28H7eIdOXKYZdaqXYelkaDdRsRhZGfn 4BKzCmw0DZdcXEU7qVAvEKM3yh90B0vr1m3wjTALfCf2EbwclDniFcEYIjwpuK7xC9+0eeO1 /Qegd4l+JWYz2cgaUAxC3p8xnexaFqy9d48+GOyPX/gFogyqRwaD+B96yUp5RSxPwMEjkUiK ykxcHOOIrCamSomNkUVWkM6pzhb4dcM6qNeta3e+koiYfXjM4ywHXSf+dEFPbmz79NnTjAAR 8ywNDEKYG95n9P7QCUWiY0cyWMYIMMyPCAmE4LMcfuLQ4YO4xDIjlolVRxj+37dvT8q7k7QK 6HbzTbch/fmc2azSmAnqc900+hYYB7EpjH73nt+R05uLyKOZQDHMWnbpFBhwZJTpRGotAIyT +kcrkvTIYkIgX9GEiPmMFyXNtI3yCxBFMcqeHC8VW0kFougmKALWINABY1iYqVy+fClKEX4B nwhhB3zgAK7B7aLhFyBGKBkL7AIL6F/i2Gm0BEb6//fxh7SiOV9+htG3/3vljYWLFiC2g0ZL YJKUTl8KlMElxPbu1RfTmkgj7oEKRHr+gnnBQWNim0RtS+iDHhIiV3BFP5jx7NSxMxTG7Afz qoKF0f6iE4ohfPCiQ7ps+RJG+umc2ch8dMzjtWvX+ePkSRp+ATT/av5XjCZKIjCrEFQ1CmUq i6g12TPHiSZTI9Ti8dg6XALjCBcZOAlP5P6Fs9OmMSH0UiCKZib0LQlkCUlJE1dbCyA2DR1M zGYi/gBK4s3kAkpDq5owyIWOJGLNaBNwiZWJ/OaAHtGk8LMo+6zZHy9esoAS0AQCzdhkAsbj 3nt/Cp9dkEasBkLJKJZRgQi4lQI+AW88l3TellECVb9bvpQE7if42bDx1xHcqtXi4CJNCAAa vvjKhAfve+j2oLnQ8fzfzBnFJaTLmf5cRAvIrxvcu/LVVx5QK69DpAQB6idBEMnC5YQ1N2Yt EkLCslMiJExi0MOhmehhYQUS0oKZARrZ/+gTD9KBs+Pha4wQ2Q9cQJQZgAYhYGCXQhxaKrWA SaAYLlEdup9w4tgMZjIWCPKQv2H3RFhhkFCYT66DZcG/QhrqvAhyMZuZmZEFcx04FApMYzRS ogIEkR5ZDAYmuBIJKftwVQsKBZdM7WD1YeqKEIeVB++MCF1QXsTfRGhlCpkfA2RJemQJ1RSh ZzrjQlsAHUkBhAk0QCeUBl4I8tmlFIRRguilTAhLxKyOUYonwl8VcZqYuZUQQsJfpdnZ2yFN ElO5C0VAdQ1XlF6xVgRUYTTCgghVBQSUUVxoBG+yGenB/mQtl+ZLWyBtgWpjgRgemQBbq43a cSnClGe/JQI2SiBVKiDmXYb9uCQrhCcvomOUuEohaazVoaxKp5g+KRTOZCavXWQfLVxWCqoI F8i7YsfGpdAkPPEpTzJbiOkb6D4H20Qrl+RgnW1OFA0uA4uYYCIpMLFAxTGhtA4JHgEVpY38 5nPHGCPjk0YKulRyotsleql0G8Nsk6wQcfGVkRamlrj45HNTKLwybQx06yoJZOEahF+FTMRe 21BWaGAt+Jryy3hpcZmRaovT8QSlMBnlFoYDGatTkiNQENBekowTJFgHFhAenYdpIJGg3JUa I5OQHDM7+h2rXLNiVn7pEAgMEd1qtFkClkunrcloGo9BkpH7l+ehhk3wWQqQM9eMWjFBIcmY nmpLv1UXoL5kdLzUeJgZ0+9Y9FtXKfswZmbu6JVdKqWsOayBcWvOOJiMGKyUQZSaZTKhnCxJ DkbGGKXrFji2AQeNSaCMcciJrAFM+Jce7I+0TDonbYG0BS4xC8QY7I+7NQJojZsvjFAgJCl8 DhMYuGCCBBXQ4uilYvJoHhPGBJB8LPdBgDsrY+xYpB09AIJRRibCKogsrsocNAe7LWJvH9Hg DLK/GFd6xRXdTUYTf9FlpFKRNmE0CFhD1C5/OQErCiSCzD17EH1WSOgj5JK45qLAMrFJv+gy ciyxxFpUxIhh9wsJAaGB7aBeIcJO7TtlZmZJbbWYWyO3XZt25dxGjAInJSQijlRkvYKcGM8M oxajCygWPmTGOJh2IVZaJqcZAcJAHqMOT4i3PbzGMI5QZWHZ7CJVQMYE/tUTdJmOqBWw6C/6 ERiiXJGZiCbFcsXKIGOkzCg5iIktLCgUPZbp7n/cjz2gsQdZV3KCUYvoQBa9CqwoiAZkQWa6 hy2WN4kCa5BK8u9N4bt+Y3XRG29OYnAGlHmet401ovY/njlj82+bIsW9NvF1bCY+5okH+UWA sH/e/xDd6gf5WOQ09b2p/A0X//XwvwYEtzxC1Z99+dmCJd/wJaTTSVsgDWRJmy4aI42GBwX9 XUJgPVZTAxGeePxptsd0NP6oZfAXIAorh5J28aKKDytEFUArrAwPy+UusE8GVlBjTRKibWfO moGFkwKawE+zIFfsEubibxYmRsLlyWXwDYHgbOsOKUrRqrFbP1ZiYZEWll5iY+7atepgM9jn xk3419hHqfP12itvAIaw+xiAEqXY9/Vfjz2FjWSxAokIDDoF2Pwa670Ac6T2YCZ2wX7yMXJ2 AdsFe/CgIRPGTbjzvjvOcwuYKIpt2bZl2fJlGRkZw4YMG/PAmBMnT5DNZtknzKdhuWEJ0aaF UXAXArKgmpGE0jmMRyAryMGyA4TC6yBd/H8j53Oj8rK1q6ACkLH6ozJdhEKqGDNnlWtAa6oK c+BVh7eCFYt0wSO/JVKLhygNwCIzIzPK4UZ8UXSZUXRiutGF1FlKfGksjT1gsZJ88KBh3waX WNKiHkW9kaDbOrKVRowLCdo0hrb0UlQ9RsNnRzqkbXAxI1Y7Ri7/pg0HvZQcKvba/gORmPjK hIAL5peZLeZ/PjBm6ODhb77zOpw1imLYhozS4/v2W++49ppB9LzLJo2aDhs8HFubMZ+LIws8 pX8b/jeKYu999B5lX79x/fR33kP+9I/ea9q4KXwxYN9T45+ipbt273rvnfcGDxgcBmS0rNp8 J/UGhr2wgqlM1rIwIpabfMKf9siSN16inDikA886n+vRMU+y7VWxBcXSZYtZ7wwQhkNAGD16 IpPfmgS8eIucM0QONIJThn+DhpAz00B8+6130XxcMmJaF2UZ99xYJhBeCU4biacrBwkLv50P Jbt3v0oAZEVFPVERXZzEnX7U4jpOGZoe/9xYnCGCnScouOAYcP5BTViSTZ1K2l625BPViWs7 N6AtPZaFHV2Mhj/Bs9IjnA0jj32jdsAGROjusY4kMhctXgAgo/vWNmncBDkYfaPE+P7u+yUA MmyCRIEsOysblDijAHjETlFixG1aX440fxsMLMMEJc3v1qUbStf9GtoRCKVQpih4mhSTk04k Z4HqD2TMQ0o1iCdnMBGuuH634I/gsCLskMMEjHt6Ak5F458nhHcbpfTdHv/sBKTRCaK76+BI EeSMGDUY22Nhe0IwYlCJ7qYPyZQYnU10u7AhDyADOU+OfZQ/kIQcACUI6DATaOIEMgiB2vAl UVFpcCuI6wYNA0gtW7aYNUeQAIphd3+6My28OfTpIITu9oOthOgJKQIW/qVQ25GjP+ftDcko n+OwEg1nmwLBhkiLbneB5gu2rqUb89tsVghs0KAhcJk/wI8eJT716wX2VsNW/Wy3fqndriO3 waCQV7OwJqqAj8Y0R+LI0SNw7jq373QBnDL2FlEFQu9SHA+vYGA+MrRVKJy7DnIFpgB4DSfF AhZWGlKMZUknglUQiuoPZNLtqMYlGPLnawdw6dOrL978Tz+bSfPRaQIY4Q1kLtgv69a8/SY5 gRE5KAUxSinWUKcGv+1wQJBDeYFilBejbyAG5DFgAvZh152/j76FP0LP3D1Iw+A9aoec6H0x 1oQfV60AEvXvP2hO8ADKdm3J8br0pBJGxk+w6pCJQ5LgA7KJDlTK/Eo+Cz8dYPfLflotqS21 ErZ+pS4Y3g1sp4FzWGB8USD7L+84TlrX3XfdhwSOgMM3MCUw7MXT43zx+Ra5YbeSVxiWxK8L MKtT+05sdB9TBwwEG3GHFQi2yqAoj100wgSlL5KywF8LyBjeS/0gJGVDESa23xa/DM4XAw56 nhA9c4jSYByNjkYBrejIN0Dt9OlTtEPH8I4vkKaxuzxggqEYMlFL5Ag9v67ILfwjxfJzli9f AiDDVrEUyOCaYfgfHhbf4+PTI82qwwAWOshruTkBRgO/knWEWSY/EWDnbpiUtmgmsyflFfx+ 8AUK0hj4xyQywAs4SHuOAoJEL1evXYMjSzBr+S43U4lBsXvuuhc/MInKIfQX7DFlytH3gdXL 8kUTjEziLQpkh5dS74mxigquTOYlBGQJGTt5mzBbh9+ImALDyNl5tJSNboWKkSZ0bSgk0XGZ 2TPJ4WmCD0b38X7SnV2xYSH+0V4k3m2AnYAYl3Xr1gOBIJ8bjwtzJUR5BVxSl+AFEsGJAyoB vOCa4RVduUp4mBDfBKw6zLFCrACM4DNK1UXzGTtfZiQL9IHjmZ9fEDloFUlMc4DCD943BqAD 9McMI4b22R2XYomST3kxpL1yzYo6tWtjw0Ucc0np0S3FHGXMk+IqU3sUxaIXCayakA6MNyEu nj7R+KQmB3jsoSRf0CUEZKEGVP8Uhmn4W3Th3v++e+fUd96nQ79Mf3QeWZolEIqJNHZ2xSg7 4sVwxCRGqeG/wEG7577b2RvO6C9M4rft2wBk0AdA1qZNW1QKN+3CVC1VC1zXVyYS1ECXEJbE j4TZTGYhpeiRP2TQsLvuuBsojJPDP5k9g7/7K3AHR4gLeJGDIXlBptTl7Dmz1m9Y3693PxBY LJal3y99YfyLx7jT9s5yHU+4afzeJTr4oPwteAqMlNh0fjwWSM1aSwbS8VRZORpWFR+OKydS gptVwKqUIIydDVGHeWdcg4GeJySImMebCXcMSEHjCRAkwXqUdH4Tw2Esh9WKNzA34g0E8KHr x2gqn0APF1ta9+jRGzpj4B8OGh8FosinuExfWkZGe9bsMjIRj80xXwFGNoMJFnQYI0WxHJQC 5gBM096fyp+7pATHjh9FuzCwxQbskcZn99rfmYQoiabc2VTbd/72HkbiiPZysMNPhNOHu0/P 7mzdsjUfyBpy0wukOvaoRalAeoA8KlNchQFrB40eOT4vKoU/1g6CyEkAysUXLmARiOXMEJ8t OE5IptSIP0vNWssEKhfo/le9PBhxnhC6PJiqGz6MTFzC8cFoPXpwzDwHDu5naUFiD3e0D0a+ WT5iHZBGiAPLSUkCZ4bjxb5x9C2QBgctTpnAZUAtxtSAzpQFLUXoRpzsUcgQW49SOkxG3xYa KSbFAtuiOzn22SciUQws27kh/xHDRzF2mo6zpf16X/PsU+MG8m4ZIsgg6oeVP7Dv/n37M+Gd 2nfCCN3GzRtZTjqRhAVw3+mtT3ctk7BeClgwNo95TBpvgZAIOoiGLs8ns2ZAOobD0JGkHgeG kzDped3AIcjnzxJijB85cNBw0Blggp2ERMMv8May4fbo6sINRAwaRt/50wWiLD+tWYlhPnQw AUzs/BFRSkEmPWzp9dfeAhSiCCiGaKwkB8J5onft2gGX55WJr+N4ERiwX9/+tG+Iw5MQvCqI mwV6ghid0JHDR9FHn0myWiwY78e/Pr374sAR5GNkAPMGSIN+4eLASSuBN0biR/uHld8PGnDd KM5J/OPkHy04dgTxUxcM30gjJnbSS5OQqF2r9uiRo3GP/jf7f0wNkQStS6CuCF2qswQ1SjRZ WKuATCCEUgsyw1kEhUL5YtdMQMqAjElk1SWhFuONI8HER9YcB/fFIMH7jx4fViwjrhXaIxwB K5YolkEdlE6bPoWGyGMgDEeuoSuHuUKqKR56lMK7wSV8EExKYowf/wBkyHzplQkIdmXE6FRO f39qnKNp6MxCq50Rp4XTevnf0A2SUSlmV5n1+QRSaTrxOnTIMOAgGoL4Mrg57OAlKa6Y+XPn f9mahKR0xD8Q48CkMS89N+XN6RjIR1dOAGRtubNXgGX4J5AMtKITl3DWsNaSYhlokP9C8EAp 9pBJNfzA4QMfffzhP+64mx2wBMB6453/sLpoGljWkdMWt3vSm5NYN5aRVYeEoI2s7dF1S44r usz4S+VDBveKnzohSkHDEuJNhDhOO4eJTEi3hIiD1cTQismkw2GiC3cgio6aRZbCv8CpSIJ8 SowxKYp3QU1i/8XmEyCKHH2LzZksBTq/gF2M0EtVyuwTpQZKQ7eyIJtVcCgPywCzMFYVBcfD hAd3XGCZRGBmJhEotvuF6CgP44W29PhejMTxh8NoK0CG8f76devT3S9Y00RlslIWPMqvJVRa 9ak4h8wEikgNmYWRxXhLwmhFLyBAJfOrZb4qBLLIiqvmTiRjjCQ0SYKFs0A09ZKVGWnaSuUg PBVdWuoMVkqQBHMkUNJVDVg1Jag0IYMkRAzVYtDHKA60TRR0xFi5+x5eEH4VMpaoTF5xsOpQ lmRKqgpJBq4g2jPKOINEwb+sIJFE8GcjBk/cdYCQAlnKupYxNEsXV1cLwI9Dv1IAKKlVFkEn 6L1iw7Kt3E4PV1/VAwNtiH2rTKXJvbGpbVdaWvWxQNoji/deJPvmRPtxSVZmvDpXEzp09/49 fiKwjOmD6I3p70+J7P1FN0j0UiZcKhGDPUZxQKqo9yTGyt338ILwq5CaojJ5xcGqQ1mSKakq JBm4gmjPKOMMEgX/soJEElXmkV1QIKMtTs7WAmsJDJKocZPQIQkWns7RFKycZF4l1TtJx/Wg o+gmQvEYIR6aKDaIwR6jOCA4OujwZHB3nHcN/vCrkKbRZTI2KXYqKHppqLJEUtGeWsjhimPQ xFddXANqwRr5IlF7umvJN0g6XeUWgP8lWBpZ5VWmK/jLWOAijJExCK+K35Cqu3GVU5u1lYmp Ok0vJcnMLlWn9AWoouqUh+To+kcvraRiAuGiz248NDHVEAiRohdVgBJfBCCT0jKdn7ZAFAvE +axHkZAuSrEF2C2JAjBxVhmnBFZjUCzJ4HjTQBY0SfpvxzwMEgAAQABJREFU9bNAxHNb/VS8 FDSKbkbgAAjiRJJq1Vy+2jEWjUc3QSVbRW2XkiqokJg3IyV1VbLVkexM7eqpXqTCKcmpusZW neSUNDxVQhJrJnvIRKuPT5aAKiSSFnDXAhpWW4iYZSWeEJ0VgWT8S82i8cRVSnOkLZC2QNoC KbNAjK6lFI5K4W7K9KrGgqhN/soWqLY3J31TLuStEbV2ooghRZ9oQ2IAWaLi0vRpC6QtELLA RfrRIxATN0JQYlFUCjREELQZal54SiAibgXCpSR5lQayJA2XZqtSCwheiiqt608mvCpMFynz wsJU7FuUJJCl8JeGWSTSWLHVD6dgEpjM8PLqcBVNR6Y2I6oOGqdWh6poWlXIFLSaVMFuj6BM OtSLKibFJzp0zWRLNUoqP8AoVRmTm0RCSqaYKqE8LkVYpdg5TUL0PMWicvDoeMkkgYwnIZ1M WyBtgbQFLoIFKAjS74sAZAyDk8Ddi2CtdJUpsgC775WXl0JRlVfmwki4RJscqXYVvfWVAjKB TpFKX5h7HFkL1USgXiRZOqcaWqD6PEXV0DhSKkXvpUpxVSaf3CbeC0aSUncu8bdRSpKowiDG v0oBmajcdGbaAmkLXEgLJPTaV5FiAh14EFdFFQrFXgQgS0kjcQAUmsKZT1IeM64khdAaCVwz mayWBJjTpBEWiNOMcZJFiJfOiCUxQWeHPRehGmPVEKKkqcTo5cQxSoxFWGEKrkmzBU0X6EQv 6XsbUaGANaI8dsZFALLYSqUp0hZIWyBuCwgQI26+VBIKdKg8MCWq3MUEsiBGB3SmjRdYJNH2 pOmrmwVSckNTIqQqLJOcYslxVV7/ROu9YHgkpVj8CqQSyFitUmpV/k4kJ4HpcxE1bNyoGY7d bd26DZpgtdmOHD709fw5JaUloi26hzvWaMXK7wXnIeHIJQjBOZhSOxTimA+L1SJ1QiUO8W3W LLTftKBqJpaeFSIohdgNG9YJ9OHTRK8aLYKEz+fMoizYLZYef/sBzuUO/+A8cJwpibYLznNj VDeNvhXb//83yHgvZytWShNR2EEwdNCwmjVr4fDKVat/pPS9epBKBUL4lzi2EvrczFXNz+en QXPg8EEcOd6vdz+azx48i8Wy9PulgcPf2FPIZ04wnWCHN0HplSYnDec1E0k/XR7ALMIrrXRt REAqgSwlCv0phTwy5ikc6Yim4VxIm81av14DHMU4YMCg/338UeRJtzgNZDh3TCxuugA46tWt j3MwcYqaFJChFId6SAEZUIwdoxlpZyZWigYHuM2c/bGUcHrCiCjY/X30rVRtVilQjNayactG wREkABQUAWWkgKzbFd1xNiUDMnYMJROOBDK/W75s8pTX+Zksfdcdd+N4YJyDyYCMHsfLCCIT VB9adWQpzdm7fy+ADPdIVCWcyDtn7pzZc2ZLsf+J8yl8MRCjLa08lFGBkIN/ktv4CGpNyMpM xehCKBmjYVwJ1ZUQMasrIa7oxIJWRBJTFMNrM2PG+4cO76cEPYr6PjzmMRxSe/LkCcGb3KOo N2hwgCvOEpc69jGylvhzXpv0shQOMiFAw0efeJBdIgFv7uabbgOW7d27W6AwJcNZ5TheBA6j AHxRenmbtviGl0Qp8d2lS1c0MDc3t2dR7y3bNrH8yEQ8twwn6T7M0xYHU+LE72v7DzAajRNf nSCQCXcMKIba8VuSWyOXekn//Wj6+0EXD/TLF62AzDE8mXwh/Yf0ZZdB9YQP79z5c9+b8V6A zC+7/rrrhw0ZdsetdyBn9peJYVmwClZnAonK8KIaUXZhU+NQByxwIcMYBaLDykISBVShgohU ehufCJOkNAOABV9s374945/7F0Mx1LB6zYp3pryJxIgRowUVFhX1hOOG07xxpje8M0HpxboE 9v24agVq79Sxi6gOy5cvQT7AV1CKXiQgA7jAAA6Nqle33qbNG3GKbY+ingL6yl8CGZ9+7kn8 cuDIcXRUBQKv7H4Vcr5dugjftHsrIKiKy28Wf/OvZ/8F9IRflpuTWxVVVGeZFI/wzf+XWoWr FsiAsxJQm5pWUPlVWkUlFcUZjpAwc9aMSDnAMpyKZjQY+UXXcf7CylUrVq9ZiXw4LPzSi5s+ dfKPKArgbBE0JxJ8KVj8umEd46WNWvjt/I0bf4VzNGTQMFaUwsSX8+ZAWhFnfyYWIAJU/Xnt ms++mGW32wG78BToP0ZTRQm4fitXr0R7B/YfKFoFe8lFS2kmaPBGQeFL/hM0e8D+rPE0kXjz JIGMYkTiApPnoE2g9SZyp5JtevKaJsB52WWt7HabaF8MUl55dcJj4f2X7py/AO8GLPgB79RJ 3P1JQIPUkdKJgtOnT0mJ/G37NhQJwBe9SEDGd5y/RhnhhcEXwxAY7Wy2a9teSmBl8uGXod6W l7XiC6GoSvXcvGUTHMMmjZryCeJMs/cuTnpKtnHzRiSaNGqSEFdyxFX3VrC2V10VSTQ5Pdif hNESYMEwEPqVcTLQXhj6RPTk2p9Wr8SwNwanYg5pxSmfkmGoa/iwkZEs/EExg8GAevk0Hdp3 4vrIe79dsoCfz0+jaPSom/jgi2lWgAU8IHYWL/wveCXwxcAILENjO3XsjIYzAr7ASqaPHT+G aQG+ELhgQLeFi0kTFi/7Fn3Pfr2vkZpV4DPy01PemMa/pOnDRw6/MeU/kfn8nM3cQesF+QX8 zHQ6JRaIAWTMMwL6VtEnJVXQgGFOSSYvAX0pT9W1UVoVWmdA5xuGjwLlunVrKf3Kld8DyNA5 TS2QSSsTKkEPcexT40LXXAoQ8M7UyYJMwSWG9oB3FHzRNoz9g2A756lRSupyzp3/Jb3csXM7 mcDtP+izYGQGzQdvCm8HFdWJG5vDbCbtmm3mfN5ePXrzh/lp7Ul/R9c5oS5hdFFSGibHJSUt nnxBjcm8fqhGwMaECvKlFYoBZNKM6ZLUWwC9MAitVbMWi+QCdnTsmOLx/k8/mxkTGTHbADJ+ C2noxuuvvTVi1GB+viCNkS8AGQPfnj16o4O8KOjEUZcTOSM5yAav0WjCN5nWJCNaKf7Ar4QB mdBeRb2RxlTmfcHQM5vdBocRAAdQY2QxEw+FjQbE/arJZHSY32qzxqziL0jAsIu2PQGzcgx/ KiBjjRcYJeZjkSh9TIGMAP3K5s0vk+o6zfz4K4NBP3LUENBjLg9+EBI0iIxJQOLG0bdKRW/x yVKYttlsArDDZWFB4VVXFUXv6mJqEiBIwRctQs8aHhBTjA5RIZMGkbF8OGUYq0q0i8fYRRNA DYAUuq6slM6QojvJcmjiugGDEwIyATu9jOcRKup+NYgPHT4kKiFmJnXo4qkopqgIFygOjlS6 yLGqoz2scCr2dodnB67iBTIqJTkjJsTLqkiIi9c2KiB6q3nkKUqy+pj+VPCuXTsBZP37D4pE IkRm4JXGTB+lpOFjCPJaveZHphTGmKa88z4cli+qwGH5f/a+A8yOo0r35js5aEajnK1kSbZk W3KOgI1NNAYbg2FZ/B7pLeyy+5bHEh4sy7LALpiwHzzvksMCXnAAbGxjjG3ZxsY5yQpWzmFm NDnc9P6q6jpdXV0dbpgk3dbodtU5//nPqdPV1dV9u/uSl5CFw0cOh0H++YnHMU5h8F3Mr2pj jkZW4sL/je//C/WKGO7Ux+1pr+LXqpA9LYFkG6ag2opB8/kXnxdCcfvYr277pXYi+bMf3IKL dIHkKjMH0wYPNLUBl7/qclR+/8f7bBEvucg1feWrpXkM02ZiDgOuYMM8v7WsoI+TmQrPIeFb y7dec512RxjmaLjojsz87m52QxMW3D6Gcy51FIMQExzMKTBhAZ6jpsDHrfz6FwZfDBD4dlK7 fQzfFaqjGNqDq2M4ARSn1ZVqHs4Wr3rt65DPn8pLb+fzr4PxFJHm4gF+SwSGOU1e8eoN192A bx42PrLxlZ2vVJy8SpjwvMxmyg2NsjTumlAlygQ5MVOhBLoyr/2X4NHLBDstbnzFTfyf/MRn N2586Bn+vRUeiLnooksxHfvxT77P78yIitvHNm580M3zIr8cjvkFPZaIh4HoIhrh6UnJtrZ2 t1Z9ABMXsIxPXBIDcZZW6OzuFIMvzHFDHJGI2zLUC/+kwuiGMz7ckU+neLj/y/3wo9cTlO1t 7eoTl4sXLcbQj8Hx3772ZeFC3D4m7vkgp6KAoQ1PFGGY+7W8kEcArx74AXmJDUgVc98f76NB as2qNR947weI6uz1Z+M8FwF88+Z/J6FXQeX0wrjl/lYhfwjJTatIosKF6bRPQcmiFg8NHVJf ibUMCINY2FPLSrg9STlw42tfX8+73/VeXAXHn8gCJgvf+vY377zLOu0S3+X9RjkLo2ThnrJ3 3fAeTFhoIMOTQPgjgCjQk5LuK1AAqA9g4jqXZqsxGLUQYjTE5+WXX6ldPnPj8cUrhhLItdvH 0Gq68K9a4cYuDGQY6Wggc1/JAt7rAUw0WX28EUMYbvj46S9+QhfdxHcL4skE1S/KwGB8QbQY 7DAEa1pjVfWlArZu20oDGSZf6p0faDgeWrrltv8O6UKlrZZFBtwjIyQ0Pkbf9IZLHJnS4A6d XQmHsvEohTQJCXNQ+1VYSyvN6efPxxdOD1evZjd/7tu3R31cSdkcJTL7mY27zpgBo9AdWkiY ZlialUaiVb05ad9hFt4wB58/TNOqVZThT5U4eJWKP6YSMzLLmaP9lszfOQOZrCzjclagrYkU UtG8a0amOfSIUKA8lObAiLgoKzNXEVLhjZwXYVka1CczOM3E7MxESykZvzhNYUykjFJQVBCl WRldBFGdvJtGS5eWqJB5IauQeM2pVxW0+ANn9WK/V4qq8moGqhmYMhlwzci0yGn8pBFVAfgq FZyz6G/lr3Uyha25Lk9aly3D2k8O3FhkprItM/WRynqw2Mp0FM6c8u1oQjjbUHEWReUIQqn4 k3CtuSEKR1lFcuHay8y0IuDKxgS2GP5rf2b/VWk1A+OSgeXnrVq0euW4uKo6OXEyYDi1rOxg eeKkqtqSMc5AMpVc/JZ5Pz31h72z7eeKxthnlf4EyUDQqSU1Uwxv/hNZAleiMJYOtad3K3+m SQeDIhNGcCKoRConMQc1uLG1sfmNydvbflroLdQM1HqFTHgvgFse2iQg56F53CGEkow1f6gg pizIMCObsm2pBj5VM9DU2rTwXQ0Ptd3ehANrPh8phD6+TtUWV+OucAaK7DF00HIePoTYKQsO NIyVh8Ng8mIQXoGT82LInNgwbXRaBNfGgjPY65ghGprqZ12X+H3qlkQ6G8+l4+zY6rVFQgUR 2rgC29crIP8Y/LVenEXJx8GFFo/wGDKnFF5IvObLXTUPZCo7uXQbnzAStb3UqJOh4dTYiSqk 0qmFN9Q/PO222mhtIpIYiBSyhbz2OxUTFZvwO4HdQLguNQBjpx7TXJLHUkMuI7rgU0uKrgwv VdOTOgNe/ToajS67tvXZGb+trW1OxWLxXH1jriUdr83Ecid1vqqNLz4DwQOZmRPDm/rHQSQw m3hIQ1oJmAfHmIhxX4z6NyY+PEmx73vt/pYN5Y0KnmRjrBCxBoRriuGsN6zYt/T2VKoxlUth 6MoVsnXRmpmJ2YlCUoOHdCFgmq2p6tmbyBEVTOaestKsPOmqitAZMJ9ahjavAk+WDESjkVg8 ls8VYuzWQ7Zgp2WlaCSPEl+AsRdMt2QFgAJ+aRpYnDTGooV8JBqPzl7Ufuice0ZjrbHIaK6A S/yARHP5fDwajXOwtK6uqxkIzkCFBjLRZ2WHDnZrQoThoH2jPFcm98EyzSfFEmxJUI0iyJLg ROBnIUBk4wctUtfc0nTlR2ZHpvXkR1KRGIadAsamkVw0j3WeD0GFWD6fyxdyo9EC5lYQFqKF 0QIk+AqyMJIrDGeswQzX8wvZVDQxkJz5fFd2qFBIwCaL/yykQiYyeqTQPZQeLTJAf3io7PlT VETrtWm85P5OS7Py55y62lADmdoRTtr0qUnA9j6p8oDxqH7pjnz9ICZlI7H+XCSfy+XiGKsw imWzmUJ+JFbIZbMQjkZi2Xw+k8nk8rmhXBYzLMhHCvkhbgKzkUx8MJNYVl8TTTTG88l4NoMp GmijuUQhOtIX6RmMjHSlh8d/jzqpNuj4p3esPYYayNQgsD9XN7makJOhHI1jqzdme/L3/Esq Njw9H8mj1bFIFlKcBWLSlUOBlQs4L8QZJJuIYRWLMTXrLoUawDDsZXOt9ammi/ti6w73xIdj 0XwUp5pR8NBhopBMRvtGBupOhrRW21i5DBQ9kPm5lr1R3Clf4ngnSfzHS0KJeEr05deYAJ14 RJb71WLxMxTQ4qMVFqEclerCL+xYPJpjF8N6O3e25jKdFH9IX4SHj3xdbM78oaHCcN1IaiQ6 gitpsSi+cZJfUxbyyWSha/B4UQOZyu9sRnDGvG2dTL61QJJAgC+9Wemf/NL6p9lTOKnwGA5b eVSp31pWPpIq4+TNAIabkVxmJD8SZ4NOWcu6d9cOzjyQTzRFErguhukbDliYvuEPO3sUMzqc sKbZd5jVpZqBIjJQbr80u8LBgt/UyNdmiKcU/Vn8eSIMCuFIHKMM6rEVUcRh457QaEvMRa6A i/c4QcSVfnsJ22BpsfD09qG1z9dE6yOFQVzmx5koOx1l3xywbwjY+WU0ji9GU60j0mKyr4vN wGRvz3jFV/FdYGwGsjLSQS0UhTKYxsNUixbVsVzEXqOOJJ7eKDBPRDEK3DaRzWVw4d6+paIY c4Gta6yZef0rhVhtLJrAH27n4IcsBxEuSsTjkePTjjqkY1MZhzEo9AajzWUsjE37K8TKI2Z3 XFaIr0SaUgYyNdkluq2aTakM4DpWNodvI3ECiI1f4rLmzU259v6aKG52xb1iCf61gErFBkl2 j1o+vX1fRS/dqk6q5RM0A6UMZHScCRiE5YAn16Wk0LYVpSAOwquFIKNK6nFo4n+hOCnIUGgb pG6BkBvBNi6hlB3NZzO5kWwsT1fli2SZtai59rIXotEWdnWfnU1ifjeaj2QKBZyzFmLRdAxf d8b6B4eT3U+e+aYM+yFbLNROUS3+UxA47MrmdLCNS4W6CSsUFT+3HKvpkujq7mn1uOREd1LK oQ/ZoQVprS4nfAZwE0UW94CVurFjsdipr49Hk+n60cxQNh2JjPJbNcQFfuxmkWx0OJsYHu6e t/up1BsHlww+/8IJn9JqAyubAXGdotQeWs6ZRpHt4MeWMk5sinRXPlwEXD5PCIZQB+ly4sFj SbjXteRrZMvWz0yfsyuXy6eijdEYLuQjFlowSEYS8Vj3gdqDzy1duGC0LYb7aqvfWlJ+3AXa FYrYpPJEQZwuFLe/a7ZUdUc2QRLW/0s5tSw6XMp80ZaKgdhbiYoKCsSrSFhR8IJVVC7CDdtj xjGwUlqJs79sFtf76alKmwQ35S9YNiuOS/QeS01detXbe/KxTCxWNxwbZRMwtuBMMs8fu0wm kyOH9zZnHll/1tzheUsPxJKeVMKy+M/itkXx/EVbiICKNuMG1JnLISnNdTlWFPYYdfVxGcjK SUDVdhJkABf6c9nEyAjOCK1xSASVboovvzbae/UfmuY0e4V5ylkthXkH0oXGWGE0mx/E85g4 fuJKGZ4cz+STtYnRfa80Jh8/c8W2SEu2NxZJRvPVPumVy6rcMwOlXCPzJAtSiC/v2blEyYvz F5MZk2PPCnXlUbOgWMqJi0i0AubhqsQZvqphZS0wh6WONdZVC43MwpNUhRq5VCH/1pJdlcdC 8o5lTYVzNx2a3d2aqB9aNxTZQxq7gN8TWfmG7ly2KRIVz4HDP2fA5f5Eqq525MWXIrGnLpy1 pX9kaHQ4na2N4LaMsVvs4LmP0l1pRGMXcQhmrRWhQtO6ZQgvJUK04MCixecGlOaJjn7g9/oL YEYo9BcAraqnZgYwgcpl2X1kIvxUTWrWxQ3dF2zMtWRT2dpYLB1fvK1ldru7ccvObqld0h+N ZJRRGnfBsq/eGhL5nS9nRx+5aPYrAyMDA7BNxGuzuElWGSvdhFVJNQPGDNBAZtQKoTaG+iCr qoAMTNERP56IZuL5waEsrsq3zmhsv2LwlYX352oT8Ug2mU9kCoO1TbGm0x19CZ2mpja99PLO HO6AjWX5c0iYkccTubqhdG+8Jr59b+T4xg1ztwwP9/aLrNXmorVZnFhW+5vVi8RsRXwGdCxb TV2MCrbuBC45Ot/4tBPdWfxZE7kyvLJthbM15c+eHNJ2RCHcolqENgpHXRKK4inJGsOB8a8U skQiVherGUxkC8sGOzdsfqn94VRNoqaQzGDUSedjhXRNKhI/9eXWmR0q+7rzF3SsxgOVeLkF upk1PPXHemqitcPHCtvumbVkT3yUz8WEFb4bTSWT8r2NTFZeBtRYjGVjfqw4jQaVEop2kfvS aAVJabbjZkVtpAJt08rGP67XyMYtfVVHlc0A3tJz/HjspSP7uxbtS6YK00ZnNeKCPV5IBjfs +n8qXhhMt43ET0tFDlmeE8n4ois6cUUfXxPEYolIll0jwzt96pLx7u7kH/7QvnpXc29npxon 7olNJKodUk1JtRw2AxMwI6PQrCGZhmhSlFFQZ2fsSoxYyIVWkHrjWsNS1QguVijYQloVBQ7i tA6NRXE2t7Tc/vyWQwcz6UiyHteyov3D/FwRvjC9zkZHM7lYU7yxbtXW1DTr68szLlyQWLIv Hm+ORyO5XAbvJgMyycqpe+5NnrNr/lBntxYq3udDAxkdwEVBQ45xNdh5ZTuDa+5cRPtCREIQ tVCEi9KgqjO1XBqbl5VghjbkQBa8aYUn8GIRn0JS/TwBMtB9+PjKjuZMIprMZhKpGN5rHcHY JE5dC/ghylgumi5kY9NnDCTnsYEM3WX2RcfwNCXecY3rYuwdF/EkHrCE5jf3J1a/vPjY9l3u tODOsnQhF0uG7JNughNQQjtUdZ9CBox/YquXNpNHR6VFz7Coi08VRwbVAmVgqmQJL3ddMKs5 Wze9b0f2eLa7OdHQlGS3s1oNyRfwnGQilkimI7XnHchsSc+YVRvFdCzSgDNLYHKxQmI4l0/m HnwhP/2x+f27vV5uARK8MFbvUZSuk6YgE+ucEiAvUIjPslPhn2QKoGw/xRD4x+TPNPFHP0Rv /fEvAfzDLVZrPtMkFts3BUE6z4Iw8lSPmYKCrZAHdFb1z481VRcfyQ1Oi+VmvHT28r0XZbPH M5F0Hj+kK5eaWHNDemYyWjdj+eGmla2LL43VpnEeiWtiwOAqWiydim3alzx27ynpPX3SSF9j CIvj/bATsxPpwSh1kSVFELrov8n8taGdWEBiE4VizUvGa36pWjJhaYYTP5CVFnfValwzgKv9 OH/MZjLHsv1/Kizd+5beYdxXgfvK8NMig83p9rpkcy6TzOUxmMVmvvZQ6pxD6WxdPJrK4+79 KL6JTHWN9D14T8Pc3ZEsnnXyWBK4iBZh7yrz0FfF1Qx4ZmDSDWQVvDnD3eiACZowoGOKVnDS +Sqd0KBasVQCH8QaSk+u5ezMbDU6lBsZLgxG4vi9N7zP9ciDXUs3vxXCQqSmLtlWn2vDGeRQ ricXHcYzlIuX9TXXFnLxPHvYCPOraC6ViPzy/viKXbOHuo+bHXBpuhCvycfwVYIPxqhSWmHU O4RFgRVLmr0qMjmPd4gqWSGnRc8KqZnGgn+M8v4o2hf9CjIHRj9uob/n0rXlD2RIseeCdmAR n56gqmLSZwAdmb0hNpfDl48i2P1PHpz17FU1x3N18Tn5xMBINjecPR5JDscSeE8GMHjrGF5i NpjMpRviI489n009s2Rg217/hoIcT5DHInjPT3UxZ+BE2qEqO8iVP5Ah4+pxQ98AJ1Lq9bad NHVcvcrksvg5N4xotBx4em/sgQ1H9u3pyQ5l8j3xmtFsIcovnKE/4BfhCglc8Ypn9valH/9D Y+uuMK/hjyaSqWh1IKMUexe0UcAbODEaLTxjtVKRiS7JLkiIv0rxVorHimos49PONK2qVwMo Eq3A8SaZF1GAnKj8cQQTBX9waK16TLLn2uzHxPOx4QyeNHLMrw/v7Mw/sGboSF9fvAs3lsUy yRi7uo8/nFLGIrhDI5Z46P7RWQc6Bnt6tRjcYScjhQT7pUvm163VzEVVhEuqkFYCXxSYXJRW 8Pflr1U8iuZqjVb0oYvCo9dnaJoSgF4+veRhXVRkRhbWWRU3RTOA+8ByWUzKDC/vOLbr2NA9 pxa60xjrCsksru6LNsbysVjNyMu7Bw4/Oz2742CYhrPX+OPHy6Nh5m5h+KqYkygD9kAmhsTJ 1nR7oBY3Z1B97AJVntxkkwP8+S8UklKgor9pBbVlehTmrnhoChDFyy/4z4e7IJHI4e2dg3eu yA8czxdw8wR+W4QvMdxclvz1PZGOw/W5bLg3vvI7+wt4EXboRYRNUYpCmakI7dwGhvToDyOt KNjsJ19JS4V/VaTHHsjGOl1qNGPt68Tgn1QdejRXwAuocTQx5vbA5q7+e18z0n8sFsNbZHGD WbQmOfroyyPRvcv79oaajoE2hq888ZgAftR8HBfqluPosyKuHKM3tcJdqIgzjcTtRZNo+OKr 1LqwphUfyBABFvHpGQSaXV2mUgaikWFcI2OvVvSMevtj+4bu25DN9Y7iSaZ8KpOr/f0j+RkH Bz0NXIqaQiyFB53GdRxzBXHCCbQhpiLVSZgkfSCjdk7CWBGSHZ5dGttImR/nyaaoBniV4Vl3 4MjIA6xMasnkMRdymRDepSldgAEMv2nJftaSv/DCi2jLHw/33782jtf412cf2XK8de+i3sNe TyNZHGq0mMexd/8r34yqWi+nkGuwoo/mnFqQeHvRnJiBoUAyYDOFlIakknBqtLsgIZNijQ7k +OOTHj1mvS5BPi3QBzIfaFV18mYAp4v5CG5yxYDmkwSMd0/+8ujR30zPxnqfeWpm/e4hH7Bb hS9GfX7ExI2vSqoZoAyU9tA4mU9YAccra+ElDOGORa87lBWp8JsEbCbfmQo/BHOs9q507bc8 bLpKlESKisoEZVWzwreJOF8cGc0OzDuQj2fxM0e4sQJvrMZtr3iJGF6/E2Pv2mfWiVhh797C 8Ob27kMjs2cMpGbhxYr8MXC8IgMm0RjGQlwGi+BXAECCqS5b+DtYCtGGlkJtJB0z/YiSV2Ba ngRMC17DFF8l50WYajbGkMJg4FKDURBGTtJO2oIImxpFhTIDrvhAJgILDk9FTNFNUmbqSzBX kwbzcctboiHeNdTdmR7Mn/YiHj3CW8MSiXg6OZpMxBPJJJ6OTEQLyUQygfdfJLPZZPzPLyfa F8ya/YZjhWwyGssnE9EUuzsWVniYcjSOF2Uws0RNMoWXaOMvzX49KRKPxAeHRwo5v0lfCUkr ykTL8Hgmuag4iwGPWzcpJqhKY8sfyNybvugYQXFSJLvoxEwWg0xfZmnnmrrhxhTeYpHA5QhM rXA9K49XjGE2hoEsjQsf7AU80Swbo0YXFdKJeLzvmVo2cYsW8PQkLn3h98aBrsP7f9jcDDW8 oiwZibGnBVJx/JplAhyjo6mR7vL75GTJWzWOcctAWZ2muNOrsWyTNpoGnOiNwahZWirEXexI jHWnaZGBiVb7G1Fm/GHaxtGY+4/3p55PzUucks9k87haJq7H4yU9iJw9Fh7NcHZ2+3+MDW7s 95bYsMYeGhd+QSiK+CaAtZcZYS3OMdmLF3HLLf7jfT/x+GFYoqyFFL5aWpNd/BZNRdgEiX+T yJGIxB8MTLF4VwMrLNDiqTB7EF1ZA1kQeVV/4mRgdGQ0gj/nInc2uw+zYY4vUuU0QM337gpP KxdNVVDNgJoBfSCjnqRNMVSbyV+2dyxnrFbrvNROcFmnu5RHwUkePeTWlwASVtoETQu/WpXp tDKh5d47P5qdN7BIjcYbOp5QbjTyUDZTH4RWi4brA5ls2ninRfVX2Q0sWzSua7U5cDymLSJf Y+rFN33kmWJxnPiQ2pcklNJ2wOEVZA50P86uNXcIbzwbG5iNMQK4Wx3SkddAFj5pJbv2jFBj DB+KJ2NVUc1ANQMndAbwVZGjfXIQkWuHcpwqzogq6dTYKk93RjSF42lGCLtA5+nWtxBkSwWn L3Gmifu0bAqUCOyQ2hWB9kKZteTBZOarZH5dnIKF7OzYQpbI0hSOgcMVgAFDIiIXkpAuyFwr lM9WLIOGr0grtEaVXzUGWT5tAEMhUp2RBaSoqq5moJqByZ8Br4EsVOQBdzmE4ph4kNcxJOCI XZqZF6km5+T0GIB17V/zqJmESyRxWNZEIhRUDccmUDpnMbZe2LHg1HyRCzGzLKnpGmVZVSUe B8+EB+aIZjJV1IyVNZDxRoXPs+q3iHzALLyPIngnAqqlYCzaJVyMBXPohJFzq7ljvQUpq+Q4 dKgVA1IMYBzPMFS/FWvM1CGi5pc/kIVvtM/2pXjMbJoaRJD40JlZqtJqBqoZOEEz4Pn2CwwT gX/BCAcFTpW8/gKc4TZv9Q9+2Y3fxr/KbSeMlca/AA+ajS/aEyuaJm21rFliT2OmJ6Xk0NcC YEuFRzJzqkls40OXvvaVb61bexYxoOC1vOO6d330w38vtF//yrfOWHsWyqqhj62wKgqscDPr Im2FQ/OnRkVVMzpISuZaIchuUui1mCtbVVtYnZGp2aiWK5+B5cuWNzU2heFtqG9YuHCRQIa3 CsNcxZzwGRjPgcwnmZgPaAvGbs9F6DSEm8LTfrIqqEUVbIvgrBRhkWxmtyAxKyq9XSifKvH4 uFY9UlmLZwIjoZBOgIJIY+JEy6Z/e7SuVNJm1Dj8HbIzFnUJQKtQ1+4uqcS3mdZXmWQhtSQI M1qQkRUXhScUutrmNpYEnDiMGB/hH/74+yeffsIHAFWZLpzkWqTUWoZyVFybwskzMTUtwqKC 0FpOtuVwEsmEFCbJjGxC2l51amcAl7EaG5tRf2jjH2xpJHLRha9i1YIuVzHTWtvWrF4LyYNO WxUTprx95yuBsEsuvAyYnr7ep599MhBcBZw8GTjJBjKvI5G6wYs8Khnhnn4E2lNtxWFGkRVX i3kZDPSpGbVFYRFFDiZ15Mb3fmjVqtW33/6rG2/8QFtb29atm+fNm/+RD3/0+z/47p133fY/ 3vuh1772KqD37t0j5L/81S9+dsuPIREPKiCc11919Rvf8Oa5c+fBtq6u/v987JPPPPv0L3/1 82f4KEPxwmTd2jPfds3b1609Y+++vai2t7U/9fST3775m13dnQTDxf4ZHTNv+ua/AqAtGCs/ 9P4PX3D+hZ2dncc6j82fNx+A3919539879soEINmZaxSKkgrzeWaFFaBWbithNLLRucw1ceC 0+THIPNybYBOEdGkHch8eoh5K2hSH/spsmnGI8y2tukf+9gnH3lk4803fwNjSmtr2wfe/5EP ffDDpyxZevnlr73t9l9+53vfQhwYRyB/1w1/+fgTj+3YuU1E9vbr3vXuG/7y3nvv/vgn/ha2 EC5etPQjf/XRT33is5//wmfFWCaQGMWuuPy1Dz+y8Z3vvlYiT/n4xz71jZu+/ZGPfrCT2wKp XuwXhuIT3r/0ha/U1dZ98cv//MDG+4Xwfe/94JWvfV1Hx4zPf/GzKrhaPjkz4Hn7xSROB8Yo 458jZIxr2p9DfbJWRE6o9WIi9i9f/IwYX/D5hS9+BrMeNordZo1iAFvyrs7LLn2NsMUpJ0ax W2/75de++WVhCznGuL/5uw9t3rIZYxlGH/KCUeyee+/+5y9+VkG+8vFP/N3g0OD//dQ/aSGR FRU+86l/wij24Y9+kEYxqDAX+/o3v4o5GuZxhDwxClq/1aonRhu1VmhtDF8lnqk4kFHwY1Mw DpKqMIRbbUvoFqTWFY46oUTB1olgZF3cZSZrrrUni4XEqaVms3nzJkhuve0XbvnqU1dDiNsB L7/8SpxOivmaBvvKV/8FkrdcfR2FjZER4508/FhwDGo//a8f4TYLXJ7TGNQq7iYD5j+/9/+6 jndqJ3gY1zDLu/SSV2lNpKrK41MmvFpQ8Oq2p7KlV03UsmJeLY5hBpBzMYRVB7IxzPLkpx4a GtSu7iPmI0cOY5Ci2RO1AnIq42rXY3/+E1XVAgyffvqp1avYkCeWJ58yfxf54Mb7McaddcZ6 CTSszzpzfWdXpzoXU0HPPf/svLnz1Nmfqq2WT54M4K3q8kg5boWpnt3iE4Wr4+JPz3YxqaAD vmVEYfA63f0fQMlZ8H4grLHgQr6KFy5sidOFkANzMf8q889PPOZ19o7vH5ctW0E827dvE+64 hEhZ4eXNm1atWkNId2HVqWtefnmTnTcRovx85LGNMDltzelWJE57iTIqnVBXTbOlqgQ6WqHs Qpae8GpB2pa1Vgl9ymX58DX2cVqyytdhkJJvisl5sR8J8VkQuHHxkltgufMabAMsDRZVEbsi 5pWFgwcOqKq+vl61qpYxy5s+vQMS2uRUIBguhN39G8dNIaSqFqoZEBmowA2x7p4XkNzgYcOE sN3YJV9HbhK3xCJwMwIKoaeBp51vRJNSKdoe1NKJCV3EhgthDz/ykE/Kn3/xuYmJbxJ7dXfp SRxsWaGh6+Jvcs7IymrYZDbWuldpw4c+9AgWSR18f5lIEPDSxJgxKO3w7BLD7tvHTkhxgqnf ASsJly5bjgtbRLt06XIgpdISC0rcyDY4OMBdaXoLBm19fT2upjlDsLS4Onba6tPty3lGDmlp VIJI6i1O/1UQiRcZswuy9fdc1fploHqx3y87VZ0xAzipxDh1wfkXGbUQXnzRpeKrTwHYsP5s IxLD0PJlK3bu3GHUCiG08+ct8AK89epr//rDf+ulrcpPkgzg6BGj1+OwA5Prj7Si4Ab4SSqb RVdsBteV9Tj2bDhEi78SXOm2lB/JFXBbhoT5rA0ugIYjPMn00B/PP+/CM05n7+fRFjwS0Dat jZ0Myrbh1v/Xv+5qDQblNVdfByEeseQqzmtvVAuOpy9xs9v1HjeLsRFzy8u2kUiC2xO1RCnQ O6UUmRUyJMUuQSS0edSC5cRoS8JiIzkZ8QXrJoyy2m7YMpLPRyUhJaxVVq2sslFP8CqoYL0M GywuSyEmsOZdqxLsBCzgLjNMyj7w/g+vO91xFxgeWrryiqvwoJJ61ombPP7yL24U33VSLvBg wFuufitulPX50gBgPCGwZeuWt11zHW4oUzcHVJ/6+Gcxxt1z7++Is1o4aTNQ4Wtk2JUndCnK vzYqaYGDCgCNEEdxfyubBC9/tCtWSRCGZXCZTyIBLkvddNOXMJB9/p++/MijG3E/V0NDwzkb zsVdFxjFvnITuyeWlu//8LtvfP2b8SQmzkbFk+FLFp1y/vkX4tEofqMsAc2Fz33+01/8wlc+ /YnP4uHKrdu2ADR79pyzN5yLG2V/9JMf4PKZSKg73Wa6qvREzEB8+dKF5bcrzK4ZjAlGlB+p ZGC+Av0ZAUahpA1YC1sDA0QGaQCbpRa27KfjxB/t0JyRxG4PDQ1Nvb09L216HoYKLNLY0NQD +UvPk3+hFfgXpfzQoQO/vev2fC4/Z868FctWzJ0z7+ixoz/7+U++98Obh4aHyLa2th53nP3o p9/N5fI4x1y8cDGQg4ODQP74v75HflEQfgV/XW39s88/0427+SORoeHBRx59OJlM4Y6zlStO xR8Ydu3aedPX/3Xjww+Qo+ACfCgLubYbL0QcQ1qtoBAEFzVbqnpYQm9YyMpYMBhMJpEx5soK cSss/qJvvOri8huOyAKXYEwwItBJaADz5e8P4wEANCoQs78VwWBptBW0NkwtuQ1UbUBZ+bbS Qjoj9XxJhkBL33Jt8GZQOV04mQwMTGRgsZHeSpMn2y6QmEODOTjMOwiofZXcPMSHB0nI+BwO PKgcmAmslNKkIsNNFPL8z5kJcuwUW9yk1XzhjAuLl1YDe1aNLr3Q5Trz4p36co/MiIFOH86K yTkR20Z2ieeNIwwwNamkFkIng6YEROrlupxeRhxqPChrXrWqM05fpcbrWfUgCRmfg9ZI5UCc 8BWkzfsHeivfeq+tBE8TsDFYNN4RWQF5A0Kkx301DXQQKqRcwMKYgAR4tUCEogTpBZx0cp8k TsXmTLr8Tu6AKnyxv7TGaruyVi2Nc8yswu8UPnuWiE4AAmFj1pSThlhNcfjtd9Kk50RoqP2I ktjY/ptZ09r9gys0rTs9Nl7otLqw14RuFiEJdGZ04cWmycOQh4xTY/at+lMGBCVPGsVpvsGP Ze9F43BOFSPaUyvQUi3WRgY7PAn2mh+TXpjIK4+a2OYrpWQMUfOgVZ0mmpJicKJIbC54kdCp g2TzBpqJT3wpMlO9s//E38zVFlYzcKJmAIM6RjH8JehIKMd7c5ONRwHNhDA0KSCJIBV4ErIf 2XVfH9JIzeG4zcw4eru8h9osntJS/ybbydcb6Z93snOYaVKLgpi42oyRNHTJkIykxryWbA64 nIyaTUqUOjwoHCICGQftPgrCLhLKFvGSF7cG06qSLZT1mOREC4hX6dtyk3J8ZGyabp1ayhyN j2ODl1Abx2A3caLAiGkf5TEKuGI04SkPlToRpRJ2KKvJDPLJ+4nUzMm8CcYitrG52C96hE+X CWqKT5cqgzXIa0X1Pk3gfnz0U6WJFc1XlayagVIzgH0pIc7vUPLZe6Dy2e0MlgKNGZ9CSkWN iqoWgHD+rSIzX5gagAHIScihJyUhDBTeIk86blIap7e3MdXQ6YNHm6zGiJWNsUt2dF7t1uQm U5tEK1F4Qm6y1eg1AqvqBhmoDCIzm4/U7UgFV8IDdsqK0KhxTdYyGlqRh8Yna/uqcVUzUM3A yZKBIi/2a4cSGvS5nGoieRo2MKPC3HllyduoWHZvJi1sA9AfUblIDK7HTGSM2r+hSixGa0tP utBsCnElihSAIJuoMEpuihb/FG1Fyc0vxTDknf0+XYEl3UetqKho2E4GUSnNMdiQV4NOisbG uz+rOKOXEWhrGbSBwiDSjMe0KtzL+MbQVaUdhQnZkFtNFIZlDJNSpfbOwNhc7Pf2V74GnQnd S3yWzzamDKX2e3X30Ti0KsJXwWPamip5NQOTNwPWxX7PALXdxLkfiQGF2Uq5Cpcym1to6QK8 DVagSpEZ2hhJw95XA7mGk1p97bbXEXbwbg2TBDJ4R8JMPcy9jWBjKU0YDzoW6Am4uFtryklA w90kwsBFpQkMdm6RZhMQShlqt2sj2bjFY/QeXhiyOUZCrY3i5dWejyhZnqSRGH0091Jp761C osGM0ZQshAvwi8+SScbHkPJTpDs1fxqHVgWxCi7STxVezcAJkQHsFfoNsWJHMewcXOHejUQe NLwGE3Mod8Y0mJHKbYUxTBjiU/XLqmrdYFmSyBilyuTt1FvD7EX8Jnopk2vVm7PRnhq3azOZ kyBkzU0Owwry+4ShuS7SqWbt4yesSmMsMp6wXqo4nwyInFvfWqKibQNRpe1knJERu2ZLVgQQ BQsm0V4wy4qr6aJ4iYOU9KVF4qgGxOHAFl3xD8DXtZfSn7LoCBUD8hjkgvRkobDIotARVIon y5pCn7QRlpApalQJtlPFxNDGwG8tT6RtPFW2UzXOagaqGSg2A+aL/Ri/rGGPr9gHH9K0cY2G Rk3uH4RmRVVxAb8gvwuQcotbyKVQ9SAAXIOiCaGirTJgFHSglT8n8RjcSJEXg4etLvYyl/TW WjfT1MVUQ3q0k2gnXouCXjCpyYuJxhMrwnQxh41e8GpoF5und7cikEoDaAzluNaoTqoq8qZf Iyuq/ZR3/80TlpPowhoouxE3UQkqE1LoSAKBamwENgpJ61HwN0K7AZhsrfdoSlVczUDZGUB3 x1/QfWR8r+Efng79dhqTTrCZNJ4uSlDAi+pCq/oNgeRMtSehb8E/Ub6mFVEiYtHQwECC2hZI gHiDOCrSpClNUmyGjPgwm2JKZ6nc4JEg9hofnid86EnU68ydScbkItekFVWmEIuzTjCXkmno YVfxQiU6MZFg4uI0wkKxcjynLmzYp9vK1gWXyNoI1dpjxLgZfK2E0jayS0Z2p9CDWRP7UxYF drp31yxXGqeGk/H4ozQjq0o2kkSuzfAAqWAjCiI3mhFMav3hEnXyrl0JC5WKgKyC1J6RCQ9k oTkUchISTA3DX6siq+VqBqoZqGagYhmgGVmZjNq4Zo2JkPKSVWU+WFFMtVCSVkzI765gAvvN lnTnBaRskXCrwlkZi7DiUgbicidYqQkrB5VlyVZOWy+UYmAbaUKt6qRiboQrDUZVJ57EoQoa s6TSxGGoAkwC1G4PIhR7C7sR3nmRzTDZjIUspD/ZJAqh6KSQpdbDFfmJVAyZ19BN5neVIun2 jEw31baIc4upt5VpQPA4scowovsY27odGC+xDyWNSpGFYYMJpYpkpA6ZRiExE7cW0TlilMFM ulhlYNV1QAa0LWfcugEUJ7YaGeH3kYlEWfkxpklLZWBaNJIw5vr0i0YTL2dhSL1suVwLUsX6 qFSYY/BzKHil7AjdlGVIwrap/NC92m1HYJfKaND4m4qG+Qfv1fjKRWv04B9U5ZxPTiaWEv0+ MmOagLMyFS5h1l34EizW+NSu3EtWy2dUfxBcyCWLFYIFFs8psYo1BDrkkplmYJZWyolTbBip JQ4hlne0iZq0lTXPRw0EueTkcPcwLVnk2gHXXUmQc62ZOJV2TbZVwGXN1vuUyIOeCR8bP1Vp zv0YNR0FrMmN1aKiMTKQkPz6nzYTvloInYFQWwkg/T4ysqNtA5dGoRqKANgmgQaq8eQpT9Gw J08Cq5FUMzAhGWAX+7ljfNrDkDEU2smFllcDrMDIYcQsH/cmAS/QRIwf90knwLYLoZBzG6tm h8o9uVohpDTXk48HWGBpTVUZjyUgOQdqUzAZifCpzFm00ERVurLWxCy1JBAAKdbMHFXNRDne OGBUCcNJYK3g8qXpfaqeps54nDXwOewcFR9nZpWL2wwLkoYIIip7RQhskLuqPkwGMEzwkQIP jVs5FyvzNlelwKnVEM78mEOYWxArzPAGE430D9g/h5VJWWkZ8I9M5VRbGN5KZaiWK5MBLfvq hqmMg0nNUsBizcjUOMWVLCUXbMRzZMqhY6YOrXIwVScxipHThBQaixrTiVemVvs3bQJyEjIy xD0Bwflnq6oVGRiHDRO+l4z1RqEZmcMR4sNfcCJMCM0Qp4xstgekrWBmZMqnhE6BIxZWEdaq WAyOch5pswkMXGEhF6JEYDHGCowCtATiDFQBc4hkk9FaQmWl8DGp7ZxjuFYd0RVLdcx3iIWl HYqD06pImebezWNJwuJMBNKXSRcgc5tagfjGo5yqB/BztduJp5WvW0+rYhVFBCSpxycw6e1E W9szMko9FdS2alm2rmu5oAJmi0XJrquUpZZ1H6XyTHU72iSVTe9UT0s1/pMyA9btF9gXaL9A AVXj3kEY/1wJWwYWXCg46CwaeTeGVbXnH97sDhoOs4ylieWacFxNNYmitUOtUTlBSoJIYS4I GsunmMfJ5w2QDyGniKRP85FBgxGn07GVOAI7tVQL0hPQUJBhGlQQlcNsZrR/k8Hfs7QOh+Lo kMGGZgzJJyM1rUP7Mhn7yyoQnb+DidWKzOESGbuzn7WVUskb7jekGDMjzEnlYEMFChLJhjsE ckiTSr+1MCRfZiixB+Cc1mTlFFu1oqiMDCUI/UMC4YREVUxDAltQDFkVO1kyMHn6HW5F4AMZ dTQ7NJTUsYwpSCmmGMIIQpL7JNjgQUM7rz8FcAaoNeoQ1eD4QpBMFISC1wKoeJY0fr3qFYeO 4/XxDs4YRFU4gRkoqruEiVPe2Y+uFYJb64D+FoxSGHAc9yAsJA3dQcYjVbCs7l/VopWMmjgo A9zMGYVuwiJ2hkK+GFQ5aXRaOnKjVJQiMaNgiUnrdCmo7UAdIejxeR1ciNsZqKj5KqUHkyGT +RprsQbBLV++lF5xlCUP8uhuR1nuVOOxoLaao7dKr6thjGvZ8+uvoqJguwRrkn37hdZAj3M9 QoVNvTDwQItZn1eLfE2Laq03mNrjDRlbzXg0cmxbUGWvZmDCM4DdSM7IZCw05oT5/tueInBz bVhAldgEvbxDjYBCT1WG0kxsnaYQjPLTU2nbM6ioaWAnRDLSGmgnwllzRUyGSkE9UVfEsrE4 s9ZiEi41oe1YlCw1TQoFM64YSBcMoHFIldYmEnsUiNJD7yf2isDLhvvSjMrx7+VHk9se7ZIK sUIYh0hUr4HlyRZPYMAWwGuXCGsvcbL9+mt85OZSN6a2l0Elrakk4XIt3Shr24YLS0dqRJxN k1nkPj6UwMoqao7dXOMQg9spJIGBGa0gLCLgUD5MIMiKcKNEqpGVRqLwVYuVyIC2VSpBWQQH hkT86QOZiYB1FxEr7zisqIVOHUrIFTDjIy2rFL+ArUQGLUof1yU68GGcsqrwSdOaWFwOS3aj etVIiotAJaqWy8nAOORd29JatNDqp5YaQlSBCxOrhtF8Qyu/nGRAxilOgjScjMDIRkJBRZfy FA5e1C+8kd5yLZ2wNXHqw7MAuc77bDwHELWAW58EMqstlD3X9YU5mO2KZWOTCJVNxUp2zWqo IlDaXtAzZrsptuRw4IzAj4oyZgKRUic3gUuT2cx2qTSmsbXSN/fYepsi7PT2C8Qr+gptROo6 alPK0ao8YcrClxaGfwA2bVicbeFXMobiZ6CMH1oD/K1OZm0JST6Z01Vtu8wAOg7+8PYLSyDX Uu+7tkY92ktNxnSMF7MnQOQEykLbV6W5LxOHHQS5EiJxizzntDG85ALafglJrhhYOcQ55IS2 ClIp17pe1oVeC0MqxdpXaUP9PRGJP4zorHSTGVPIOTJKGosDxrsK8qgJibpiBT2KihCHizoc inaXikRWCom21xRFoW3jomzHCRxyM6jRoBOrMzKh8uBRMwCI3t88rNhWF2gDQIoEtaypAdpl 1b1vnLaJWgo2dyNUeyr7R0kwU0HzIJj0PHJDcqKMsBYjqURdcGpCk/NxkWktLNln6e3RIiid qOTYq4blZEDbfuGp2EDmhRb7mOwLci4l0couBIi1P0qwBVLDEmWyEkiqSla2JiuNTcWoZSOJ CqhkmYJTSSmCkBGrtuWUKZhx9ltOzONqSwkaV6/lOatuyxLzF3CxH32BpRbTWbtXaLm2FRaY IuF1jqZzEgHms2OmFVVmwLFkyQuefgTMopI2FpUwokvXwoMaPfAYlaVjubYcWi4lNVuzc1gS U5HhmVSxJycWmkHYIslETSgZVpJzuWrDFLxO8zXSKu4EHfs0CslE4Aij3XRms+glsuAKsQFt mV0iOy7S3ApbgjgKBgqh91Q4zFnF5E0BSXV4QsXYqyhJzfqKujK7CCl1T+dDGo4pLDg/wQhn gNiRYOIzI3PCrT3ftBUh83Oe5/1NIMicCqoXYBxyYnVIVYsKlQMdUfSENHoOE6fGEMbE6Ksq DM6Alutgg0mAqHaIEjeCfbFfENgbX6YUEhRFzdZytDaxkRbq5XOGs+W8SJMC9xv0hS8Rifik AwuRWHIJMstloJpWs5Uc1prmjZrcqkpOTSsi1BzZWLuk2fGqNNNRzrqzZiVUmlqHEaqa3HCZ zuIJtBU2aUhjDcbtNZlkt7mt6AROE3ugpbi69soA7ZtGgMc2cWE9toYLN8ECNMd+saKIxRg5 neNIjIVi6eAJIyu9M/K6LuQjmWYimcWafQorFMQmoTM3sR/LkzwLZblgpILYIZdC6ITc0pKc +YNHZzslSK45Ma84XAhbRmUBHXjNhdos7lJYk4lgZrFIWrEmuYqXQg3LIbrMAyvFTm9KTfCU uFcEsiuOSinqjSyFo7I2IVvsCNxh49BUNrbJwOZoq6uXlxghn0roF/spkZpLbx8AsgFAxYch IYwowJwRKW5UQkU8+YrUAC00tTGaCtUp0zx36FVJNQOTLgPqxX6xb/nvf6wBQFhQdtncEw+M qmNWigcUaQ4jskJnkYVdvtcAAEAASURBVGqSMBeQJMJY+LcgzL9VZGvEQr/8hioFQI4kmMyl gHN7NMXtV1iRnLHZYYrcQGnpDWDunsnFyTWvsg+Kk4ylipOQQ54pwcsBnEoQSAOsLbg9oWUC 4hBAPWxpbsFAzEuKL4kItfa3Y9RKAIJRvkNX47eZtBZoOK1qmzkVRZE4TI291IEotuIVY7E8 xeC92m/FQupwsYVDFRNfMVh4x56rz8iIQQRHLSK5qwAIw6qNCWHF8PgjJBVc/H4C4bQ0Wz/e 8nWieeDxCs4oF+3xsvLXlh/zJGGYvBt1kiSoGoYhA/o1MhvC+xPtbrQTCQBdF3eisNsyAU1t hLmwdZpYfhz80ofDSgYklRgamN6aCfLpBlTykhlzLi2Uksd4YoZKexmbhaJDsS4XeMllZUCS yIFMqklu0Tnk1myEOXDIZfiWULSdEHrbrfhkmOTRzKnBLFZ7XkRubJ6gkkYZBDfrS/ALomJc e3nw5xBaL1tzW6actMjmaRmjPWWc2o1o2Z39MmjrvIbGG97vpVLvIZZcqq2tKxukbWwpxgDH DNQdD3XbIW+3pLQ8alVKDck5IYntMVSItEhsHC9ZgVF8mlqrqi5Vlb+50crfBORGK3IaaM6R FoeTylnTN6urTi6LKNgu7JLR3Fft2UZfK6Mfg7AoEmcoRZkaXI+viC69hHMrmmofxsJZTTgK 28Tz1FILTmw+5ybVIJ5V2KqG1BMgpDKMVQxxhfEbSEJsY1IIE+KYOPYgnWzxeIQ5JmK1K6gO jH1LBVTLUzYD2Ob4w4yMbWRtTOESJtevxVKH4D3GrvESRn+1I0FmVbkWszE5F2NirrUVkIiF i1hRteUqyS3XENLxxunZMCYqRoxMeNFO78g1dycDEBXl0xGYxkthK3gUCWW5QF2eFKtA+qZC 4i248iUAg9MkWthqbRdCdvqptUco7E/mRDsLoHwqITMDEQ/nM5EqZgBHJalsBWMwLCYmGxZg bAODS3AUgs07HIOxNzg4HI4wEcg0Bm456cMQmFTJdQiIhCprGYkiKqIorEvzXIQbAYUb7ACF mDUjI6+UYCGhqtGB20qFqQwog0qVqEitLMCqUBgKiX9IqtXUK4t2uttPLal449XMkhcUKu5I Ja+WjRmobgtjWsIJXaeWxmzKbk1KKTA7CQNzYKgi+DADUSTaRTTVJaH841FNRJkMVVVxJBqF VgVvCDphFAIow3R7kRp9XQSpbjpO9fBt8Qpo8rfRK/ITTl7+xiwzJd7fWlrE1FlYqDTltOJ2 KO1I1KEHSH2qKa3E2isFFkqqxRpCKdDjE3VLK10YJ4Gk1Lg0Zt2BU00kukc7DbzktLLBTrkj eJvBAtlWXCVcEwFFYtuJLBFCURjBpHdZEJxpuJZ/kFhY6mZ6XfI7zagzSbVpbZkQo5MCFqQx WYuDiQfERWVkGCOhR0zcm3YloagI/HhVInPypTQsi8pYarnszYBg8UC3PiOjJpTNzxpGbKKV FeEsNWHjbicaX8E2UzYryFlaVigSzXzCA9PiqVZPmgzoD41Tw+UVWy7w6riQq32XyhxPNcJY NA5qyyHALjGDy+8HeFGdFHA7ZmUROFeaVFZFSLJGcTlt7bi5nNBOlC3WSJ0wcw3GmheBI6HN biDQlFpVnQ67jXWwGyEkFk6DW+hwYbqo5fHeUujcBlb2PQaJuZnDiFWY2nsK44BbfuVK0yl+ lKIEF7fWWlqcsQutBcr1JpkpbK9ITPa0C5qVrri0TePWh5KEdeZBBnMMHOw+MhPAlBITLpxM uCiC0xmT+fs3QedElplZi0xy2h54qYj4ZVokk6x7rEPCYF1EDOFJi+P1aENVXM3AxGUAnV0/ tRTBqHtBwM7DoYSPsvkAauLT0TLCQOrmDK8V5ubRTbKINXlh0zqrYrxXwRFnNMY9sO90OY1k kdwOcOkVI5305UVrNCJwkDUBXQV/XhfcEoTz15rNLR7OdGRycWQ0Gu1MxPakkwdS8lQgHIlX CJNUXlo+i2qMlTd7/s3nruPg2BDlxHh1BmLdR0ZCupVJnLN5hujsf6KmftUIQsz4LJRksWBO W9s1h0msPtppRgKGT02uVcWZSQybGwr+ZSgfAS0nti8eBEB84aQYyHKsEUyj4TjYdmzUCozX p4ySTC2BrIu1REkWqkuYVDjWXkqyVtF0Om/Uqki1bLlQPQl7RZLOFy7uHbykd2jeaEa1FeVj ifgjTbW/b67vSbDjBl8UYymyDouySmsFyopKlUH828LARoTNYpcYnf9ipPI3KU8rurRwy+YN MgCcROJAoRyoeSuKaQrFJSn1xJIvC1kSuWVLPshrqQWWkELUPCMrldOyQwMrF2eJsbBRNRqJ x2PxRHSodygzMprP5xtam+OJSD6LyRaabx/N4AOdIJGK5TK54b7hzGgmVVtb31STyxZghc4x 4c0pMQvhzUSnLKqd3uBz+4be0dnbksW3SealPZt7U1f/ld0Dt7c13Nna4IkzW5+80mg0nkiw Ay66ZS6bGxoaymVG0JmjsVgina5N1yYTcfae93w+m8tbpxQnerZEN4x3zFzEWyoGer3Ryogv VLASf6zqGAnUwYsrhANiZFUuYuOnJZVrUbW0ZKFINRmvOo0dCAw9GMEgGh4Y3P7Ss4uWLp85 f07bjOn7N+/s2nG0prk2UZuKYeNjs2Ngi0VQxHe4e5/anKqv65gza86i+ahueuKxRLomkU7F InE2ljn90dHIKbbCoBY6wkLFiNZB5jpdtzWPOfax2cPcLJZSag8XmMMkqQDjU/zBRKqQqRuP 9rytq68G43/Qgi20anB05dDoM3U1o1p+hW0wh58PGZTE8Do+jH8SNEnXOCSjs2YymcP7dh7d tX10aDBdWztn7vxZ8+bPmDWnrW16KpE4dmj/ge2b+ro7RzMjtfUtiXiMHc79cujWKTnjPUqp Vygz1I9D8Lnj04zQwNHRaCYTi65ZexnXWQOZFrfSuwSnJWDfE2CRaLGWNUuOqgXjDpiWI4TQ KioYQc3lgpu5oN2T5GLLiCoJtQImW7l8DgNUTU168eL5Z5xzbn1jI6j2bNm+6bmX9uzfM5pj O85QV08kkks3NMcw6mWyy1YsX7V+Hca72vq63uM9Lz7x+I7tuwcGhxFHnI10IgO8MUoQ5NpS 8FWJA5mRS/IyJQeIOHSss+6sMQq3xCF1koYCM3u+SDRy9JFD3WcODEtF2PXeVPILc6b1x0Hg WiS5qnBsCVXhLOumet2Jnrw1HGejmRGcKIzU1DW0t09ra2ppmzGjpaOjrb2jpq4eV05yuexA /8DRQ/sP7dvd29fX1z9w6PDhQj6Xrq2LReP8BMSYM7dQyZEsukFaqgIBDnylB7KBwfjAEOYj RS4IWjYwwFI0zwusNt4LE+DAObSoJNjww8OZdE3N/MWLbnjfe5csW5pKpjCr6r+o/87f/Gbf D3423DtcU1cz0tOXj2STNXX5Qi7TM3zh66+47PJX1zeynpHNZletPe2WH/1083MvDfT1Jxrq cJLpdKjX9GjVgHTdmNfV9MJZZWLRSF2NeMex3hJGMdDgOtpfH+r+l9lt+jlmZeJ2BTqVBDgV wIOzuVwuU8hn29rbz7/0VStXrp4xa1ZjU2NtTU0imQQA1z8ymdHBwaFDhw7u27Nn5/atD913 d09vTySXw0GYb/+gjVdGTrCVxpA9XGD27RdioLQDEn1I1q2ZkexYllhqLV9Sq465gIipFsMK vDWrs/Yum8MucT4Og0yyWmpZdbRPNY1GY7lsPpqNLJy74G8/8bElpyyJxTDHZn0BQ1LXsc7O vqPTZ81Yd9b6jlkzY/FY3/HeI7sPPH/Pn48dOxqNRWtralPpFDrHhra21taW//rG9+76ya21 q2oxZbUuOjgjUF3bMZmlut5ikoTsRIAvUmDjUWKzPAlgVam0wKgbzSTQeO1AmTJzY0kq1gqf SyC98zXTrhkauaJnwCEuprJiaPSq4/2/bWmQITBjFgAlxcymxOgCWFRhn2Inez9OApVUUBsX RIBdjv3FcDmst3Pf6rUbzrnwVZe95rVz582F0Gg8bVpk7ty5Z555Fs5Ar7jqDffcdef9d906 2DdQ19hSiGAXyLMvAwIWBaAUzUal5SmQVnR1s0uzFH2k6BmZmWncpZQNPZnRaCIZ3/30jive /oazLz4Xo5gIrbure9f2Hd+66Zvrzj7zazffPGfunKampobGRmhHR0aHh4Y7//fR55577vvf vnnN2tPPvfCC6TM6MGwtPuWUc6+6pGu459F7H2yf1xHJy7Fs3Ns7yR1iK9xwrK/MIN/c3f9g Y12v8QSzTOopaI5DKaLO5/KDvd03/tXHz1i/YdnyFalUGqMYO6CKHUDr/RCysS+aSqVWrDx1 3rx5y5evuPvXtz71xGNtM2bn8kDTfjMFM+ITctQeyPSxmr0HRm03T5kLZHFb6aEsCbB07BSr pBwhNwbBVFKptDecBZMuRFUNLBaPH84db5szfdac2ZiLgW3L5s3PPv3sjq3brv+LG5avWtHS 2ppOp6GKx9kXAslksq6+rqmlqa1j+inLl+3dteu+e39/9jnnLFyyCICWaa0zZs3sPrJ7+vwZ 1jjGXVJgIlrtopiutZqkt92y0luOxlrNEnZiCktTEzmNspxY1jIFimulyIg0N1xry+ySEqzF IIkkRtatSWAhum5weHYmS4alFXDHxmt6Bn41rYHMuT/bGeSiIjMAAYPIsMjOWQhQO8GsVrSB m8JD4miLhqFGSfexbGZ0dLDvmuvf/erLr2ybPr2mphazM1ixMc7I5BQ2NDadd+GFyVSifUbH Pb+9dVrHXHZ/hrZfa0HwqgzApXPyu9ShBJ7kqnUokGKQx0AmbIoJUfXib2dxB7mA3ocnyNpq j03ChoFMFt9O53LY8Nu2brvnN3enUsmVp65at/7M1mmtwgC9ARt1eHgYhy8Mahja2qe31+Cq Qzr9ypatD/3hj9l8bv6C+WDIZbOxQorGESV/vkURtwbxaaeGLKFq9KjxjE0AF/QPaX5Kq57X P6QOZBUbUsam1aW1MYwVOuRIfz965ilr1l7y6stnzp6VSCRhKKZpYRgEsqV12prT16VTqc0v Pd/ZdTyRxDUTdo4ZhiEYE6a/aSwV3xAyBnmyjbr6p7n3rkoeL4QIPDj8kpzrTgUJhp66ZKrv eE/nsc6uzq5HH37kxWeea2puvvTyV01rmwYbcVBCAcjDBw/ivBJXD8TS2Ni4dPkyzMu2bdny 2CN/Orh///Gu7uPHe2vr2t3X+nX3YepqO1FGj8IfCmO8aG4r6w1bd9XQaEU4Z2RyHaO50rqi XwBa+ydV1RR3LI5vqwaTqeSGCy5asmw5RjHRP4sayEQ/b5/esXL1aaefdV5meAgXinEV2OSw LNnY99/g8OLT+X1keuNkXa51Ip5QS2lj7BLDK2dbTGEr7RLLAJ8lQ2RJXbNmR5aoItDEpBYw DWtqaMlks4cOHtq6des/fOoTX/rqv55/0QWYi2GOhmMdgseCzTw6OvrVL30F0y6oErjRkH2N nUOhuaVlzoJ5b7v2bf09fbu2bd+5fWckFWU3phlnZeSbNdq1OLUUvwMnTxRsLTuZxH8SOFm4 MYNYiygxE0qjVMm0srqtFQaEETq1qpUlXjDImgRNz+ZeX8ZlfkljrV+uTR1Iyku3uiu1OYqd C6boWDFIr8HHqoowDH+u4FjnxLlSMrFwyZJr3/FujEToq6zLKps8TIjA41CNDp9MpRoaGn// m1/FkmncIM4GOLsnu9wrQYZOHHXUMnNtCMbcUnkhBdrRbGw0I98Qa0ZPhFSkJHSDTCEWCqma dF9v/8HDh397713/8LH/c9ppa5pbmrH9xEUx1QbnktjSJAEAMFw1W7R48Rf+6Z//87vfzQ2P zpk+E11hPCZOFMeUKuBpygrG2+r9PICnF2U/Ypiyeo+nk3FT4N7Xnq7OU09bu+q0dTipZP0T DSypUWLsw7F53vwFq848Z+f2V/DFFm5LwgF73JozPo7sfdjlD5lj4574E1qqYm9ni1NLZwSW CR/32ejvhFGV3dDA/sQBAmK+cDVRSwxmJ/xPbk9BIk7LFELbFybnuMs8PRA55+xz6hsa0Bt4 vJYTe4WjnKmL4JLZ+g0bZsYb08MR9qgmP4QZHVnRUzNEQTZZ0zqyaQfhEsskSHMt23zT2B65 VkIpBVZyZSR2mk3NENZkqxUkt3SpRI5iGurKLTWYffDdljfS6iKiLfjUAgtZ9W9dSBILVkxL KWxRsB05Sez2soZj8IkPdh9rbmpunz4TT8oxLBAlLeDCgs6Pk4y58xcWspnhgV52SiL3Kzsk kVunFz1sE8ZpEWID6Qbl1WVI1hweVXVBA+wlKIm+WKFknwRzkJObIC8EDFkQk+q21rbpHdPF 40pmQ4RFkSkIbGtcUGtvnYYbpvGdgaIZg6IWQKVT4Y5YdViKN9U+EhnyuK3J7TeMZGAMLuKE 8TthGGcyxYG1MDqSSMRxjUw9XSgnQkzKamtrca9/Tv9y2ek+tI8SzQL4Q7O6gPJihI8Dzca3 4wMLvfjklFTTWHz8mVUKpxmgSnEMGhkcjSeSy89YPQOTc35rEsYmYMTshcqqFZWFtr29fe7q pceG+oaHBpPpNL+znyATUaAU+m6C8Y/saILdxVKppbOibJWKyuahrWCLKlkCPf7y2Sw6IX8E uDLk7O0JuMiLJ8nLP6mkDEySfsjjUX+gl6eMB8dV7INCxVSUV61GWFXtnEJBW+kXEstITn24 EB9SzLGywuT8bE8IlOkbc4aqJbccWCtpbVVxwpwZHo3VplvaWxvq2XklwVn/4CMaJDh/xHGP qgJD1bqG+qZpzbjmOtI1ioHMGS7xKTlSZDpY5IEAhlbwFojAtMaQlSDFGbbA2nJekl8NUMas L1s0Nq2qkXhVKX6TeU8s1hmPt5W/h/AusTOZ1LPnFRVwFJhScpvbKE8qt8LUVDfKljicOCrA aHV/7nwhWdeUGc2OsO/T82UNZ7yvwBsOxj3Hu+PoxzX1+CbB07+nwm5n2BJ1RKeBELv8aAly 2Fg92SGzKuARfyFmZCb7SS5jaeKDAh4dzyt3zeB88+jRo7jDDK++wL2BI8Mjxw4fxfMcxuYA jJk4hg11HDQiJ4XQ1TXGM6rnatOX9Q+W73F7Otl3st/Zj/O/fEN7x+HDh/bs2tHT04PLW0gs HV+LSrLoFOjInZ1d2zZvQleuaWhEtSiSKQG2BzLRZnsYNQ2RtLNIpbUWMwzN1gWWCdEVksz7 OCEtbYRmQ1WBxPljPMlezNTf3Ts4ONjc1CQOaxizXnzhxSHscog1GsXDSc3TWrQvLmErSIYG hnq7ekdHsskk/8aagtAK1BxNLqpaZEYMCW0qu8SUJhInwgRxIkTNxMTdC4XTxERKsToKDzbU VmQge6ih1sEbWNECDsSrAM9cqKDiyhWgZPtSPl1Te3Tv7r01adzniFsgSxvFKHTc0b1/757D e7dHEnW48OZ7kcSQUGqUrtNmSvb+T54NBZ3EgniIhdZXKU7t7IHM5ZPFLxh4SyQZ1rJlUkQC FwdHiPZKIxfGLZBnXlxjvQhM8SUCYwI3p4BBjveI4Tvm3Xv3Hu/s7ujoSPCzSxyLeo73DPT1 sdEqFsXb59acfpqxowDQ3d21f//+/sH++ro69nZF38UdiYBbZh7WWk/QPJg5PajItuhsk6VP QXOqVSORHcnk8zXp04ZHfDgCVbg6trG+xjpzNmxbhcCwz7hiUuDjUvQNwFephYe+hxuAug7t 35+Ib3rhhXkLF9bU1ABT2nCG97jgvT7PPvVkb3dXU1salzPxXlHqWn5xEUiLj1dVpZnELJVc qr2Uudf+HAwvET4DmZtWSqSxVXfGJJTik2uEGp+amWTzXSs8vjinEnfqp2vSPX09L7+yefee PUuWniJuEMMXN29561ucWEMNPQlD3v59+zbt3IpRr6W1ZWRw2H/PMrBMLVEpG8fRwp+0Nn7+ 0GjxT3LZJD+c1ohL3Hb9JC7lc4XaaTOGosk/3HPXaWvXLjzlFIxi6JNFXeUAHlY9x49v37r1 nt/c0dgxDzd2FPEVvH+XmGQbKj69YxE6jD1Ey95jxWmHi5LsZazI/lgdf9aHtaczAb9azzWo gBtFa2JFYBTEIi9SSxZbbukFmWRTvMCCpDLpQoBPWOWHc7HOSNu8trPOXo9jGjugAUYm0pG6 xhAGGBZcZ/3vn92y95ntqUIiWZtifULF+ZQtnAxI86ezqDDeUB9mqbI4nFTOmuZVWlLrFbQ6 uWFiRUVmkIk/krgL/bFYTyJ+xlCJk7J7G+vuaaxz0zollCIrHEqfCqNoqWBpUR+bRXfk8iLi DOuf9dMCHrTEO8YO7Nwxki8sXbYMd7GKB5XQOV30DgH6sKhj1Ovr7X1040N33nH7Ky+9UFfX hH2Cne0oWROR2/Yqt9B5fdo2xi6jOlGgKKounBq7FgYj0eLO/vj0GYuYRFrKtRRQnZs5azZG yG2tLPG1SLydf6mUgZBzgZZigomCserepgTGpAzv86lva7jvvjvPOGtDA5bGBnHh3w5F+rLW 2MS8E2Aq/vifHvvipz+JN1/XNVsXRykAzUiv6jhn3VlTbLnCU6sAnekihWaqVXWYolaKfIOq dWlmkkmdst6TTI5Eo6tGRkPiyfSxuprvtTUp+xdptAINZJrcUfX07qlwmJdQCUkcEib2K3ZM jcVTdTUvPrKxf2iEPXjX3FxfX88HIr9UoXuLHn7gwP47/vuWe++4ddPTTza1teciWe/RRTY6 bIjUC6Vh+HUYF2Ew0qP1iJKVEq/M2IwMQShbzOmEXBMKPI4u7Lq6vPIBoRvGObw+2NDiZSKP PToAJhiUcAdzIpUoDMWf+fPTbdOmdczoEBvYyxOLjT3mVug+1vXEI4/nhguJeAIk6EM+JrqK cqQpvNqgwsqxVXm8t5SF8nIEtY/K6cJYu6uh/nA8/v7uHtygbwRoQoB+01T/KxwtbLhdssFW 9nRVmKTaJNxap/DuXbZhZUshg2b7Df7FEnV1Lz395GB/38F9e1995etmzJyld3dneNlMZmRk ZM+uXY88eP+Tj/7p2NGj8TS7xMZOjTwaLyJyK53EjlrA5g1uo5835SKew6mxAiL8eV4jE37U 8w7G4hsfhWZZeYBtmBWXhIvceFhpbXCRaHpWZZhCpC7ZuGfnbjxAPjAwgOk67h2jubcY19Qq vsfEgtdm7HhlR0Oimf3siNxi5FF4CgrTQx/QRs2JcOXxGYgVIRDMIyIP9iLEGvFTtTWfTibf 2dO7Nuja/65U8sctjVvTeI419ELNCWOhRRbGJBjjiCCkhyCYUy89oO/heIz35O3btevI/v27 tm1ddfq66TNmoFfjxiC8sQVXfumqGbC4ro8vKPt68d6Xo49tfPjuO27rPHo0mcYdF814EbZy Ica7kdK1irBlzjBVjLsssLYtIYSoGCoyNRTAxgk9BzKDTakiOKpU2MWGkI/kdw/see3VV+Fl sA8/uHFaW9tZG85SHx3H5lenaU8/8VRfbx9eufieD7z3mV8/lhvNxdPsneisR1WX0Bk4nIh/ tb1lfiZ78cAQvsqc4XyqvCceeyGdfqS+dlNNqpi5bmj3JxKwEMEMq23O3OM7dh58+jm8aRGN wz0ZRw4dGhgcnDFzJs43cc8+ruHibVQH9u3dvn37tk0vvvzsc0/ed/+SM9c2tEzDuVDYUWwq 5y26cs1lxvi1oce6GiVnaA4tmwCz/ZyEVOBCMVTYALqwJWAEllVryCCYYNamxS4rRyOgxUll b3/v1p1bP/ePn7v0kkt/+OMffvc/vzOvbub/+sRfn3vR+Xi1OS6Z4Q4ymGEKhqn4saPHHrjv /ps+/48Hu7pWrlv3tZu+vn/Xnk997jPDvQOL5ywYHTbfNMu8UihKCCRzjX9C4HGtx5lesiU2 xYPt16yVen+tFn4g2BEAXHgZMO9W+FjV5/NtuTzuYRmORbtj8R68mJcZUvs0Vl6VzL4g2Uib QMAtY6OtJLZtSijZrfOg8xCX4Aq/zZroO3Zk6eo1Z5x3/mVXXPHCc8/ddcvPtzz9TG9XV2t7 cz1ezZJMYYI22NPduefASC7X1NHePLOD3cEfYdeE2bV992HYGZ8xUSxWDlO0dnpZyUniaJtU uWwdKKooMJLxguRxSq0arNCy/qFk/1CiEgOZ7LXMKXesescm53Meu+HU+wWMwLJqNYpgktXx zarLytFSaHGYwjGq+0jXu9//bky/n/7z0y88/Vx7R9vRwe4FzXNPXXPqKauXzls0H1fBjh49 dnjfoWceePKF/c831TRmRnO1dXVnnnXGgqWL7/zvO/r7+puam/AwgMOBWqFQFCHJXFtICE6u gUxJjCiK5rtyo+JkBn1B7n1JppdTGW0lseqs6PJ4DmQ4IciOjnTMmj191iy8NvblZ56N4wCM 3YPdjYEvBJL4YVbsZLhlKJfJ4yda4/j9y2QCd4Cz14V6HS2cWTAmiiWFwxStnV5WcpIYk2jZ AolYvPGKCyeNtwlwsKKBrNKnluBmQauNFLEIqTPKcDXftnhT4IdV4onG2sbd23fjB5n7unub G5vxm6Zde7dnD49ms/nuvp4de3biFQN9R493H+7asmnL0ZFjHUtn1qWieEZk2+Zto3haMx9L J9OBd8N6B+GtUTddiS20yImpPBrvUB0a4c3gyiDihoqcio79i+J3+CGsQ3oyVjBE4fUH6MNH Dhw4cvDg0YMHOxbMr21sxOEZj4AX2KtZWArx5s9ULXs5KLsHEv/plS2TIZNiG7u3dOVii65c LU8tnaTOmtWBaJZkHZEkiA5QDIfDLSKWcw5AeA0K61YyaWQN0BonaYVLVFUJB7N8kFCcjREJ WWHzY6MCtu/lvY3TGuua69MN6UimkKhJYtsPHO/H40c7e3cDPzMyHb+nNG3R9FQqMTKC3yxm HJmh4UM7Ds1YOCtVh4GM3VgomPFpl0jkLoQCwYxvWy+wlMu1241DYsHESh7/bFu7xKysmoTJ ukUotE4LoRLJN2hcIt40i0+sOIR9OFSOCuFddELjmJYzkdmaaHhB9kWnNJytbuNf94ja3yhI y0kzoxlcyE/X1uC5bzyRgj7J4lf7JeqYnzgXVveNSTfQwQ69WuHMAq2KdXdOnR2cJdfd2QBj yc0GSf+gOLWcxAOZaKba2PADmUhENB+JpxNgwLbH9zz8FYnINebdUfYb9AlcyI/gtBGHL6hF PxDu2E8sJaLZDB7nQK7UEJwVY74hdFh4gSDnm8YLLOVy7cPDVBZMrOQIZdvaJQUsYdLYciGw TguhYgEbBwYXmDfN4hMrDmEfDpWjQngXndBYYFtrtiYaXjDGC00YWydTUM2OKwhZhJ6TsqMy /9LJPVr5ULEW+sakp0AHO/RqhTMLtCrW3Tl1dqSWXHdnA4wlNxskYiDTf6CXmi1syJE155JM 1oHR3g0cTSIrPRppbskdRnoKXCTcWGOQnVFeJXc5xDiVyUELO9YPuJ59B4m7AzF0ZdiVL4vS eTRjU/OMaLQrEN2Jqa7FqXM41aym5ILAEmWtpVyuTX4h06wkyitFlp5bmZglnRWiDbFLKoV0 x9YWgoCcyuazoDqKi10oJ1huLB1Griy4WDnOZB2akivSUUBW/fklCaE0gdU6vkKf9W+G54/v WiySW66FU9HF5X7s8uAEU5xWQWwFJ0ZuGR0rO4NL7hToG9SpNdWYe1hV+hoZZwWvHDOEFzgr PkIZNWOTZePaX2s8goktRkk3M5Da6PVEEQamd2IaGthfzNtsYoI9Cb2q6Q/cVp758bdUffhS gKbEgSyUC/iGB5y8ic8yxjLPVpyQCtq6YbNcVhZcTsi9oHXp7eOKhtTCIEN/mGZlVclYVTuI HBU7JhU/5cpam8Ykfh8fxqSbgvDhMMFLlWlufMPDQGbpxSTFnio7zcTk0zrBdAcmXComECg1 twGXaFZ0vqrCbRYqOdpHUtWIyppWqxJMLTjYuUKzcgOA0jBEqGdVAJWvDiTSyCqVYi0hYu3l 0bYxIiSJBdMwmlZyaSgpNq/txnmwGV17Tn8t32YucfXL1nmyOEMtqj1OU1GzdxOTNqzMjjus BcN5+BZiF6Vsqm6lpdVlJyLiYl0nKa2gnWpS6l/LEIwQln1RK2IhK0FX0Z+NIO5qoZqBagaq GRjHDBTsU0t9oORjHw2rmtY68nl9HVRUC+xBlpd0T5KL5CIm/QgjYc614CZTpzLshbsAEk5q N0J35qhbV1NtNDNmCI5yik2HXkFGOAe3depuywimRCi1UifXUq6Gw83Ehw2TJQvI1HovsDqH ghQk4pM8OfVSbF13lpefaRtJvVxLSsZCMielhLjXYXFuS0uiEVAAdiiepkaFxmfESKEnlkdh 7xciKImWa8Fi9UNJaYXtxHi2xRdmK+0Sc0MjifEKk+c3FTJCJ5mUghYtYbqoPZDZysqWRAj4 tLd2cQ5KtSvOy0mLFlumjO0zOTInupkWS7XraAmZ0lXjJraEyoxszNoo9hGMnEq3so4b7HKK lELNiqKqHzHKDk44kqGUTacSsG8zjDm2G6PCyyprfrSqoJYJdTiykaJkg+ySw4AqtiWJrIbp Gr2u4J3FIJdOtF3T7IL9+SM0OttPxUrwgJt+QIdA3N+ecxVT4wb9irmsIJFX9sY+b9QIrxAI QAXMyCywWGlB6hNVGnaEFfkRZrJqkTi5UHMKEAMb23BvKo9GKhkJH/Vs30yPm784TJJIX0JI n5KFBFSIsgcLgm7GIbRd4B2RDbLKrzHZWtZRmU+7myqB4cZbpkFHlVHLHCgg1lrxX2VlZQIZ G+WvVbisopFEhYEwEKPiUTbijULbkOK2RawkD3PW90lEYsHtusleasXahHA6q1xNepaMmm/0 DdY92H88CqlsUobHM0ZWq7PCXJLJtST1WyuHfO6bAnDuPhoFebDgthUDUk2zMlclWq4linwI ga1mJbm5JdjWConT2FmTNg7k2J9aOt06anhFCW5NHR7FAxd4aEyo0rV4gVIyFY9lMtat9g6T UivsBtdCHm9v4oNLaBb+5Jr41Rnc68+HLNsWgxee1C1k83gUzpbyUjTG7rrN4qUr0QKe4tUM NXC1ShlYtHL53IULUN34u3tJOEULOMLhrTtHX9mGX9ttnjWnaUZHPsff0cp3Szxccmz3npGe nkI2M3PNGjxoUuT4MUWzUvGwrXEjuoIeUeIutLFPr9rDvNBYA6sFk1rMQ2hhsyA2aQFS2Z2B 5IeSmlSqrjaNx/WtHwOPRLu7jh86ur9vsHvJvOVs0KGJmCQXvvTApD+jHEI8cQQn/GmknBqI sNOsLCEfxeJ4jimRgAnepcHagMMrTx3Cx0Pp0OEnMgcHBqMJNvkSfRHNxbCJ422qJoXhb3ho CJMyGWAxaxmWXJttNa2SZYa3tNbmRpWVzjj/nPd84H+odIDt2r7j17f8asemrcyqELnzqY23 /eyW7/7bNzQYr1qsYmVVROOZsWVxx5MP3/7zW77vZGA6CbBwfHXBVZdff+N75s6fT8JHH3jw 5n+7qfvIUZKgILstk4nyV3/wXZT/9j034vO3jz9y289v+c5NX2dqLCZHQuOrFcT+xjaNocRN cyOjbTNnLV+xDO/yPHLk6NMbH2lobRVvqkB3Gh0aPH3D2c0t+Km3yJOPPzE8OIgOI3omjoJ8 Hq+8NBc+gMP+gK4FnfOVxeyBO77V+YHV0dM0lToPggnvzkijlVRW4EV8sF2P77GGV2iIPuRq tsVCcrnD6nK+VWyhOc2W3oYJWhcYgwte49M3hF1UYF0IisdY8IG7VEKATzsqjFyjo8Pd3Uev ueatpyxZHEvgddI5lrdCZHBg+ODh/fsP7N3y/K50OmZFx15OYnVLNgtiP6HAnwlnNuykk//Y G9v8WBAwNjjbDuzqA6Z8+J9fuvSUxcuWbNu69amNeH85+/1wqKyzWlgwTqsHsO2LPhWNALPn wL7lK5avW7sOP0j+wx/9qL21rTZVk8/k8WsAOw/sWbF8+YYN6+fOn4cXBP3hj/fhPRktTS14 ohM/ct7Y0jxj9syzzz8br2n83S13FeKFGBvpGDHlk72kQA7TJKxAwUqztXLtzSwteDHR8pUr Hn7gIbyfT3jETxpceNkl+Pufb31nl2PsYHj237EQuUPqrLiMSO2yvvL6t37g7/7m2Sef+o+v fP3ZRx9v7Zj+mje//pp3Xv/P3/rGJz/0EW0sI5pyC64wSiE0tZINEIXCcG9f22mnXXj5a1rb 2na9suOJ++5Hr8UAgY2Od7nWNTZedtWVM2bPGhkefnnT5v7jx1M1NegeUOKFBexJX3aMZEdE SHA4hC2eFx4eGY6nknH8GDvrs6wBQLKniPFu2EwmVVuLKuTWOUQ8jkeIcVoAQDyVSqZSOClh VthfAMPzx9kM+BPJJHs1I70tg3OyN9DyP0SF7Q/GseiqXgkvYcuM7aml2Mr4FH8UN8aF4ZHs 0a79512wHmMBJjvHj/cguTgBrK2rxXsOD+4/+G87vtE71JNKYFKD4Yy9xleaR+NspmZtSHxx C/IMe0EFvPARDGesAGM4YtU4XmuCLYJXj5178XmDI4MP3fHHuvr6RIL95u5oNoNhCxcqYMhy x/6jzC5n4Jw3lowd6jp0Vvv68y85P5lK/stNX2ppaorH69i5ZDKx/9j+tRvWnXvRBevPOau+ ueHW22+pq2mc1tKOTjowMDh/ycIVq1e86W1v3rt7390/+m0+XYin0EcRWAbhwg+8xNlXxiVs MpmGstcP3//AA3fdi0iw4BPTsX//0Xff8u7rv+OeQ5Xty4cAw9ZffPB9GMU+88G/FjCMXLf8 5/cO7tv/9//4f6++4R3f+6qcYfmwTJTKtAHR7RDOcP9gU0vzoiVLZs2d29TUVI/fvsni3SpJ bPPh4ZG5ixaedsa66TNn4ufaauvrMEixvlDAo8GZAt5fEI1hCELnZN2T9XRceUH3yeczGTbo MDGOiHzAzGbZgZ09OJzJY9Ch3QQHeLysCpZcxXYuIK3r0XyowxCZzbEDOM5q4Rn0LGrW//N4 VwIEUHFbvA+LTRZYr2WIybnIgYy2h3+oNoxKol2syocUXpWzSqGza5wcH5jw8L/YrFkzMU49 8cQzDz2wsam5Ee/knT13zoUXnHfhxRfg6HH9O9++4pTVjemm7s6u57Y+xdkSzQ2tpy0/FT+v Ozw0MnR8aLR/JN2UfunAC8A31jWeuuDU7Gj2hd0vjGZH65N1S1oXt8yZhgtWB/btx2usD+zZ 39LRdnxvd6o+FW2MPbvjOcQ9MzKtpaF51rL52G74ffLsSKbzeNemvS+3Rxr6I0N1dXVtHe1J vCeDXV7DEIofMM+K6VVtXU3ztKbG5qYz1585P71wuDCKjZ9Kp57fu+lN737L2Rec0z59OmZk EfyoUJq1Gb3wxeef6crhTDOCt7GsX7kumcI7gtjVQXPWWVLZItYhe5EFdlFKF5LUopZi/Mju S9ZJpb0dbeeR9/7vj6xaexoERw8fufvWO5575HG2G/Fl0anLXnfdNQuWLEZt07PP3/Hjn3Uf xvkgd4QPvm6dMf1v/vFTAHz9M59XZ1hQvvrq1+NNlj/4xrcEUpBir9p4171LV67o7+vjlyUK uHz2+mvfumAx83L08OFffP+HO1/ewv3rH9Sk1137tnMvuhDHraNHDv/8ez/csZnhF69YftlV r73/d3evPO00aH/1058+86fHnRRE4BSHqvHWotEYQrIZ/EbE0PAwri3U1te/5h1v/9WXv5Ru a0u0Ttu5fet7PvJX6PmD+CGJvn68mQeHxtHhwdGBgaGDB858yzW9nZ2bH/sT3tszd9VqXL84 uu2VmoaG5pkzTr34zKMHDr748MZETW3bvLmxSGzfM08vWHdG26L5OB5seeaZg888Uz9jRvP8 +RjX9jz55KzVq+ctW4YpIV5k9tKdd7YuX16D3y2PxY5s355IpWYvWdLc0bF78+aB7mNtc+dj 9ERvjCWT2x95dM6aVa0zZ7Y0tz555x3pjplN+InrJH7xmo2tVneU2WANVhJmtR9C9TxWwUiA Yy0rkpTWnNnW2iULgQFWLHIgI8vxKcA9jwAjfn9//xNP/ekXt/zXgtlLU7XpnXt/tGfPtTfe +D9OWXoKtvTwwHBNvHbe/Pkf+pv3T5s2rau7e9Ozm+795X0101KLly6aOWtmc0vTvn37/+6K j6ZT6SOHj/zxnj/ip3k/+LEPtra29B7vfeLRPz9+/58bWuvxXrpjR44N9A00TGu45HWX4u3W 3V3d7/vo+2fMnLF3195dW3Y8cPsf2xdP7z54vKmt8dwLz/v7Sz82vaP92SefmzVnJn7jMlrH tx87LrG4RfpwlMOMfvfO3bhW9rr3vfGJex/f+vTmWafNXb9o7Wkr18yYMeOVba+gL8YaMI3P jfSNjBwd+NtPfXLpiuUjI0NHDh255/a7+o73pmvTOMai349P4n28vP39fwnt/Xfdo2GmzZj+ hW9/vW16+9N/fvLIwUPrzzvnn77xlZ/8x3f/++YfAHn6+Wf/wxc/NzQ4+NDv78ek44o3vf6s 8875q7e8QyXBKPZ5zvDFj39aHcUEZvHSpV3Hju3cZBiVvvcV6wrd6eed/YkvfL7z2LEnH30M Xi649JIzNqx//7XvcLOR33/48hfOWL/+6See2PnKdsT85W//+z9/4lMYszAVuvq6a+sbGi5/ 3VX79uwhfIULOKZlsskYhqfh411dhw4fPu+iC//9G1/Hb97Ni8Tn1UxbvWb1tpdfbp8xo6au DofJ3t17F6w97ZRLLnn9NW/hr+GPI7atL7xwy7dvxi+qXvGuG9auP2vZypUIEi+2xi8k3X/X nY/e/8fs4PD/+tKXzzz3HFwZwK6E84xHH3ro8QcefP6xxzDL+8jXvrb2zDMbm5owGuBHd569 /vpffOc7+3biZaLxN91442uuvBJJwPdsA/39vT3Hh0dGHrjjtgd/8+t4Q9NfffnLZ2zY0Nzc zE5m/v7v77j11o333o2ZY+uMmTilqHCiKkRXqYFMjMlyb5RrdahmAQu5wPIGYJqDeTHOBHsH jm/b/RJmPLmhdCreXF9Xf2D/fuze9Q11K05d9rbrrmlpb+k+1o0Z3KqVK+cvmPfFf/3i+gvO OvfCc9ecvmbfnr0YYDo6OpYuW7pmzZrevl6ckLZMa1m4cNHK1ad2Hu7as233wgWLLr3qsvsT 9+98fseGs8+es2B2L+ZK0Qhe279i+Yrus7pramr/3w9vPnv1+otfc+kFl15YX1d79Nixc87b gKsYmJHt3c1cWDnHmhcxzqLQ29sz1D+I04SXN2/Z86cD8VeSr77u8ukzp6NRhw4cXrBoPk4I ju8/MmfhvPf94/889cw1mB10dExfsQKtWPDNz30Vs39cPcOBjs3tfRfSW/mTaRRmsiaT7KLS YZHIO298z9XXXyuA+AHPuQvmf+srX9suLvaTeSFy9buuh+rTH/m75x5mM5fvR77xuZu/fs0N 19932/9n7z0A9DjKu/HZ3bdd71Vdpy5ZxZJtSZZlWbaxMcaAMQZjjA0BA+ZLQklIQgiBkH/g oyWYD0IJJWBsYkLHBtwb7rK6ZPXepbvT6epbdv+/mdmZnZ3dfe99r6gYrV7tzjx9npl9dtru /a7jyPF3ffB9iGIfu+39SMOGtS+8/Def+/TbPvCen33rB1wG4uDn/pOODe+66VbWU5OiaQIP +PqmRvzBBG6/dIFXHObr17/5TdBy11tv4czbt2z90Mc+MmfhhU//XoRdyQkKhyx//TWXXn75 pz7yMd7bwvT/v37j7nd/4E7Z+brsihUSy2VGnr0BRSRJGAJPPgt/+wbzWb39/RtWr77quusu W3rpvk2b0p0nltx0fUV1zUsvvIj1rElTpmCA19V7avnVV+KPRfT29f3km98aN23q5VddtXDJ 0q6u7v/4xtc/deXKmuqardu3f/WrX333re+6ePElM+fNw2O7v6932VVX7ty67dUNG/70yMN/ +Y+fmnfRRUf27d+2cWPbBXMuW7ly3549j/z853s3bVpx663LLrts1XPPYREKz90bb7kFT4X1 zzxzcP/+qbPnrLxq5cEDBzOp0sPEfM9Nb7ts5RWvbtr87M6de7ZuvvH291593XX7du7ctWMH FmHRm/NuhLBiazCPWK0gECkVrLGoWY2J33ehvIFAxlkLU6OqLCAdIhShKplMTZgwcdGihexm JiWxhvETxqMTu+XVrZhvbG5tmtQ2ccy41lWrVx09fKylpWX8+PHzFs2trq1KxOM1tdWtY1vx l/teWf3KQP8AOmjTZk3btmXb2rVrqw5UtrS2zLtoftP4plc3bIon483NzeUVZQO9A9U1Vc2t LWbMev755xGMrrr6yqbWpmlzp3ec6hw3ZfyUmVNq6mtWr3rl0KFDTVWNtTX1JakSjFuDBaTd bIPOx2FtYtzE8TUNtfHyJIRMmorlC6u3t+9Uzyn02nrtPnyftmV864wFs/fs3bNj+3b8Safm puap06eOnTRhx/6duUy2NJnCxEhQxRAgIV72SfHwe3btRg9LRb7nQ3ce2LNv9Z/UoZax/OqV a15ateaZF+VY8uc/vu9zd38ZQ8KXn3p22qwZv7rvfhmhnnngIQjcv2sPJ8ZfeEEUQxz8yG1/ IWlUjZFpfzv8/S9/jR8nxhiqubVVY/RKxRCXXnE5ejQV1dWIaJxy9/Ydb3nHzRhX8uzTjz8h g5omamSzeEhl+gf27d6DftCUqdPa9+zt7myfNHs2JqCOHT4ybsIEzFjg+52VDfUT2qY0tbS+ umnj0aNHzbKSTDZbW183fe4FfZlMdXU15o7BgqaOgNJcX3+q86SVTKQss7qmBq7CEPXI4cNb NmxsmzZ1YCAdT6WSZWVdnZ07t23btX07vpGN/lRVTU0p/kp1VVUdnvlNTU888cSra9ceP3yk N5tbedWVqVQKX9TOWPEZc+dWVVV3nDiBnsSJo8cgdvHixS0Txrfjg/D79pXXVCOa6C1Vy2uV EeZQjSOMpDhYIJAVxx5CzUtRQFno/GI6nWloqHvXre+87rprsVCDWfmqqkr8WSP0gH52z8/x ed8VV15+0UUXn+ho/+Q/fhKBY2zjuCsvv+rDH//QW954I7rEdDtFNvfYI4/d/Y27F85duHz5 8o/83UfWrFrzf7/8hWRnfMniJV/88VemT5/+P/ff0959PAvSnN3dgzkXgr8lvnHjhk/83Scw lfbt//z2RYsuQt8Nhbn2huumTpm6Yd2G2+54Nzoptf3Vd330rts/ekfMDHEU7EcxsVHsicee uOuvPjx35pwlCy/6wxOPzr1wPsat+KslaHnY87G758CNN7xlyZIlCKC33XEbhtJgRFS9/6f3 3/y+t3/yU58aONXbNm5SLpcO8eZoguhk/wPeZP9/kbv/457/+tDH//rOP/kGhnX19Rg2qobw rhnC8ZhJEwDftulVFctjGQ9kV11/3f49dPh2/dvf+o1//jeVTKaPHzm64OJFMqsm3nbne5D9 2Xe+v/bZF9778b++7YN3jsPn6ktL0ZtQyYJp/PFH7OT4u898WkNhXMkhq196WUONdBa3Kp0w wKf08V31Nc+92Hlb50WXLtmya8fRbbmFFy06dODA4QMHeru70ar7enqWvOH6SdOnlZaVnmhv X/7GN3R1nkTzxoBx2ozp9anU4X37J7a1TW2b8ld33bV148b7f/ADrI9hmR9LkVh3xrp5qrQE IeZPjzzy4tNPYdoNa5Sdx4797733Htmzt7K2ZvGNb6mvr4cidKlQa8uvugozj1/4/OdTllVb VfWbxx+77vo3YN4GvS2MQBcsXIQbMGvbNU1NU2bPOrB/n5W4bP6iRbmBgdWPPDJj8ZKcwdYl Rtpfw5GH29C7PwsJPV6PkI1zJAu6Jjh4FmcebmnWSykEfHmEATA9hNnQQwcP79q9G4N/LL3g YVFXW4MZrnGTx5kvm3gW4flRV1/zyMOPYB4di8SYQK2srrxg7pyXX1yFXlh7e/vLz708q3VG Q20DCE52nty8fvO0lmlGC6keV4tBnxHD2MAdHsDO6uoa7MTZu2fvlvVbFkyau3rXup7enu7e bmwKg0X4g+RY4d5/YF88Hn/9Fdc+9cLTOzp37dt3AE843JkokfxR83FgSGg4//3TH91y+y0T 2iagM7/n+b1jW8fc+9iTnR0dmGvjVBMmTUAzbB3T+utf/YoWE+tHjtPS2tzb11tSkhro6cd+ SO4qTk9dF324TlUZFGK/yyVCTr1qskWWsW1csw6DTXWyn0/tYlpK1CUViNGilCsSQg7yrmH0 ghj3+Y//w5vefcubbrkZo04a4xRCyusQ9AoRmzALhgUEDYsdGFs2bf6ZY/zlZz65bOWKn//k vh9/6zsIapdddw0WNDVJVJo40EPZuvlVvrlMwFy7ZB9NwgdJSM8NQsfQvnEoveFhJGb9u08c 37xh48w5s6c0NKT37Wtqaf7Zvfeh244tEaDBn9XFyDGRTGER88033UQfkNh44djYmYHHwJxp M7//9a9funLl8quvevPb3hZ7xzuOHT365KOPPvXQQ2sefPD7zc1vfPvb0bObN3/Bu+64Y+OG jY/97gEMMzFDd/O73z1u0iS61QmdtAxdoMeEHYRjYg6BrMJxysvKKrC1bdcuzCADzsuHTeOt Y8fefMstmHSjkyfYEoC4lsFWXifJN2uB0KXlReZ8gAkou9K9APQI1pKLdtl8HnNhQpBfkYv0 gCCD1dxwL5BJstFIBEsDLSgpVmTQebn/f+//3vf+C46GTejCfOiDH7r9jjtueMv1//PL++BK OPTwoSPr1q6tqIDz0Sqy8PuLz7+I2X3sigBXWUXZgVX7cuMxDUn/9jKmvfpOdGNdEkvPGNmB BbXhGcBS4MKR7ac7raGC7vhnxYZbkKA7N2i10H/UTvz3XMvo3BP1JO967Nm1t7W15cJF8+xP vCtr5x556lGsV65YuYJ7GQKxOHnyZNeGdetpH55gZjC3ds3aPTt21caq4mVmZuB0d8fUYsh0 Y0tzsLODceXCxRdLGiSuessbcX7luRf3btuBxPxLFj3zwMOcoKap/ge//yUGm//9RTpPv2nt Oowof/iluxcuXfyev75r48urg9PzWOXEEsGtH3o/DWTKgYk2BLgNq9cAdvX112Fv7f3f+QGv CUxgK4QhSUzwYyBZ29gg98Qhfr357Td/7hN/H0I9WiC0O9opi6VK6yaMf+yBB2bMnHHlm99y 4fLLu7u6HvjPb8656nVYOkTAiplWR2dHb2/PlvUbvvTZf/nTxvWwaMXFl4xpacFUWrw0NXPu /KdfeOFr3/7WuNLSy1//+ne8971LLr+8pqb22N792Of1d3//96eOHZtSVnbTxz9+/Zve1N99 Clt72qbPuGD+/Pt/9KM/PvLIjr17F7a1feunP8XtgIfokcOHxi26KIO1y8OHT3V24kZAdwy3 AHcDpv83bdjwT5/+9M5XN7dgv2Q69747bu84dgwrxfXTZtHXQsPvhdFyYoFyCw1k+qKrGxlE mdwrjwa49QWcWSG6QyEmseeAM9Bj2n0VbVOasfth46vrMEeAJ0bzmCaEly7c/Z2dA5n0Zz/3 LwhSED116rS77vxAV+epunq6JQcBGdMQToZt2YM4uvyHxRb8TXlcgFTmtkRPEPbQaEWn14Fl 0QpMzPbjx06gyzamtTmVyz713NO1ieqpY6Y0t7QcPXLEjWpKIfjTgE+fvfjsi8tXLJ87fy5m H3bt2HXi+AnEX+jA6BIc+9ADHNPa2FD//S9++0DfUViHqY2//fjf4CHcdRJTtumyilJaFuE/ JHGIHMsM9cRFSW5V5rSZM2SjBHzqrBmXrliO3fya6od+88AnPvfpz337az/42jfCUQisAABA AElEQVR3bdxy84fe89Z3vWPrplfXPk3jzsO/ffDqN16HPQQ//OLXEcXe/4mPYlb+iQfEHDwo mAXf/fLXPvv1r7zzrvfrA0yDINL94p77br3zLz7zra/98sf3IpxhlfNNt92C6IZe1c++/X3I gMxFSxb/qvFeBCZ0x7DvDEB6yOLJBAP/8p57r73h+n/7xt1f/KfP7Ni8ZcHSS9753jvwAoaM a4xKnvzMEswSAud6TnWgn5BTMzx48IAbwH4GvPHB9qKWlP7ioT9e/463T58xY9yUtrWvvLKh o2MOemRYaIzFSsrLnn7gd1esvGLilCk33Pw2+1fYo5p401tvamhsPHL44H3f++7/+cTfXrz8 0k0bN7385JMnTrTjNQDMdsVLUs0TJ930zneOaWvbvX374R07EZjQ6uim23gcz6RkKpXJ5ca0 to6fMHHlFSswqBzX1taXTj/6298tv3zFJ//5n7dv3drR3j5hypTxEydifwZme9F3W/XSS5df ccW1r3vdzokTO48dvWbBhddee+1vfvnLI4cOI+TxLqZacP6ophDWBRPuQp4npcMUDKUWWXYV GYqgh2DS4Rwbdo4IZFKAkBjGWyxMCvUY4Rp0h3DGyK6qsibOKhY9bRylJaWAH9x/8GDLwcaW xprqavw9cGxmqa6qQpV0Hu+oratBZwoH61zSnizd6YXgB5uZd3GlAB5WaQpjJtbro6NEenBn siRlhVnYS9GMNcX6eqxsdvT3tzVOnjhxYklZSTCKgZgx0hM4X92yeeacmVhSaK0Z8/xzL/b1 9iVTCUpBjBKSOrBj/5763XMvuKC6pvqY3elYRkUlOvU127Pb+CZszyOjlQqpyBvFkiXXib4Y oth/fenrfhOMpx94GG8C3H7XnV+753schSj2bx/7B94Wf/KN72IV/8233IwfsIg4P/rmd/bQ LWk+jeueeeHX991PB5gvsgGmogN0P/v2D/Doetvt7/rs3V+RmId/9+BPvvldnsWg8l3v/4sf PvArZLFXg2cxunwqsFkEBBCIgIXNFh/91Cfv/m8aB3EgJp6+7hhr6ZguwIo85uyxLxU2dR0/ fvzIkba2NryxdADr7FjRpDtScxhhoNF2nejYvWNHeVX1lBnTlyxenEgkJ7VNRozbvuXVge4e hKcxY8ZUVFRiMMLb9vGjRw/u25fu60uWlM6dO7exvn57TW1DQyMe/NBy/OBBeAk7KlrGjMFU TElZecu4cdjQhsiIKfxnV6/GBo5Zs2ejYwujxo4bR3fNwhq8VJBOb1m/ftFFF82cMaO+thbP 7wWLFuGvwaKX19fTTe81eteE3Mjcyb6znwqBfVSPiEA2qjqFcDqCw91gkxzpSTvtA30D8Cax DTtrpzNpzBpg+v/RPz558nj3hz5y5z0/uefIoSPY24IJ0b279m5+adPEqZOwXYP16fD8gxi8 hobQBAD+CLPoFLIIZBsYYNKwRZ3JXwFgdyF4sKUQJNAKLHa7/vFXD+APN199/eu+e8+9qPJE KllfV8djDShpLeJHQxhlZFVDq6vMsB5+7OGJUyYtu+zSpqbGJ//4eFd7J15RAiN2Y4+Pt659 +OXuQycvXLzoC9/79wP79qdKSrCch427u7btLC2pi8czsOB0Hpjjf5ItL7o+EVGHlYidMD1/ 4WW0pMysB3/yc/wuu/5q5LAiuZttneUGoz/1xY99En2oORctAOSZ3z0kmMhbFlAJ8vjhF+/G z5UooSwBLX+493/xm3vpJXi7C7CnuXlIMQvQL3vkl7+dvehC7HjiU2lYoeMyPv5u+pYlP954 8aUiSfCq0+3XvWn+0ksqqqr37969E7tnmainfv9H/CTZaCRom8Czubq0r7vn2OFDmJi30wMT LWvb+vV4HldWVa994fkJRirb23fiGP7e7kH0g+qr6574/R+xkejGW2+9/sYb0SXDxohtm1/9 5Y/uqUlV/PE3v8NCwZx58956yzsQ3Q4fPvz8k0899+jjh17d9uRDD2EHBubI5l+4EFP169as fumJJ1954sne7p5JkyZhDwruB4xkV7+yGlgMF/Dnyp9ft+6/v/vdN99884xZszBi2LN7NzY8 lpaW4GGOSZtHf/Pr5jFjLlm2DPtCeMx68Ne/fuXpp7DuWT9hUjZzVsyBBGvNmDF7JYfyJqtR SCBP0K6lcuhYhgKQvzYksTRc0Qbp8gKOV5T6etJH93Z86B/eidj00jOrV72wtrquwrKMY7va p8+dsnDZfGwW+9F3f3zy2Em8UD5u4tib3/u2qurqvv5ebIj9ydd+glXEWUvmTJ8zvbm58bc/ +23n0c7qhuqxE8dcvGzxI7976OCeQ+h/NY1pvvyaFa9u3PzyYy/OuWju3IvnrV+9bssrm193 47WZTGbH1h17Xt3RubdzxduvbpnUir8xf+/Xf1xSVYpAObFt0rU3XYfeE2g6OzqxMord4T/8 9HcqJ1QnypOY7cIQ+PC6A7OWXLDgykWJWOzn3/9Z9/GuGQtnz7lkbn1j/f3fue9kZ1d1XfWl 117W0tr6ix/9bzrTj1feetu73vd3H26bPhXeQLP4xY//d8szm6omYBIkTrf3S38xZ4kTrvrB CWVN8Cw7c5gqyJOKgK0ekkhh59Gf0mlYDggAXXlCgl+BUCa58qCBAplLIBmYBAF0r+5FCPey KpdsaqoEwRJyVXmFGQrMUxLCK0AqEedFBEEXBs9kkBgJTIM42YF0rrcf7xXHa6tgI90IjW2E OdvAn141zQEs/fT0dHW2L7h0Gbppr65dnUkPNI0Zlyora9+xm/T3JlLxaSuv7u85tWXVKszs VtY1YK3gwOZNdWPGVqOvNX7s4b17d65bW1ZTU9XQiC1mA3v3Tbz4IrOkBOtOL696ee60GXh+ YkBa3VC/8JKLv/CVrwx0dKAjkysr+91vfoM1t+99//v3//Snr1u2bPMLL9Q2NVXX1ze2tm5f taq3vb168uQE23PLxhiizOyqDFbccnO0mOz3EctMoIPm+k91IyVWqsHjlSkkHKOnP97THxv1 QAZLuDGydUnb0Jfdvu+4YRyrr6qvr2xitxF9p7b3ZH/3yZ4O69C0MTMRxdACBtL9u47vRBoT UqlYanzteCtm5tLZ4z0nTvZ1TWuZQv1rO90DPQc6D01raMPMBLQgu/vo3inVE1PlJUe6jrWf ap9aMzFWmtp1bFdJLNVQVh9LxtGj6zrSOTDQmzF7W8dPwYMU3aju/p5dJ/ZhSq40TUrtEosk +oyTYygWnTL3lkN07uugW6L7rK6xY2bG8BJCR193Z/cR8/CM8bMRRrP9ua6jXYftA21jpicT cdQ3RsybD25HKZDG1Mmk+vGYJGE9POEjWUPMR9JREswTHC6rnGfZmcN8fDLDpzekKA/OQDzL nlNUiIblgADQFebyikAkVfCE5JIG+wgkWkC1Ju5yiSeoJsTLqnJkU2MyPRqhQr+qvCMXyLhy 3tfGZBlvN7STjvUl7IGmZiHW4cDsCs3RDx0grGCYl2ZvWeINRwoy0ebpuAF9JwwA8ZIQomOc virHJaIt4UVMisxkMBvHwLTx446gb5LjFU6kMLnMvmCV7uvH5E3rxPH/9PnPY58ABqcY0bdN n45h5re/9rXN69ZhU0h1bW0Wr23CLqYRu2fx+SoeldzYpLtLOpgj3OxpDmRWfeMkXq9+8zhM b9DuXcfatUqPapFZJPhPiuVcKgFQcC/8jYpJJa3yVCk+HcHvNDblhe6JYyWNimQFag09XvBi KRA0qThIS/FOJWCsTWCjFtjLmDBap9BdlizFOiTloZP5dkW8HHOqSFiGVZ4stWIWREEOPnpG p+fwakEuR6dkk7HS0gpqGA2otBKhDvEuQT+QlrASVkkZlDKHsM4TZYR8LLymYmUllXg5nc76 gzVpVSKL+Tjox0g5YZSXVrJ5O7TAWDaXxlJrKgahqYoUDLNY+Ha97V2ksxjIn2M2eKTBrI9c ZpCQaXDLNE9QcwNACUG5Jb0E8oSEywTg6iHhSKg/lYamXTp/z9RDCFaXzM3yi0dFU4HDZQnA JSCMIAwmGQZJKLy0YeLnMtBGT18zpqUFDFkKoSmWYaToxNHYZqLR4kSbNH1Pl0YiALGWhaiE gSfY6KddgLLitAmxKRbKYiWYMoQRLDTQJXtccQ+BhcqhOCczMIDhNha1sL6P+U1swti0fv0z jz+OESj9rgbiXox+qgWmQT5lxDdywIb/7PBudRfg2u/mWFlYiRiAWYMU7ilB4IP7gCLjJxXQ 4JU+sYx01sI0Y2SPTBjgcvOsfNTxdi1pPDgjV+A0rxHT544oVQLfIjNNdKTp3wN3bxZsMMYO Gxxmuj/NKxI0iCYcT59KafrGP+oHn9NB3wu7ZKgW9JcsM5bA223IUr+hCuOJWDaNzWdZzCwg hOUGMO9qY48YxOaw5w/twnGwwsAbU3ogTRsWlWNBDonRGMeWQWnlDAzgL497BxRAIFUPV/bj awF07ysCE5pBui+NLCQhCxgYeSlgYxLdO3xnEXlMA2PXIVY28xxCn7j6SEOBoOBwWSOSR4Qq l0+yu/Ss7WhARZoUwxwLOkrvVpgkk0Q0wfVxe0AsRQsivbG6BBRMyUUB9MDGxCpAl55LDdxj FBwK5PQul5qR6YDBEuNP+MqhMbGCUBiamctFIxjK4GZpjpZXYJGhIHqLoAmpYIphjZNNBPtQ rPVSLLTQA6T8oG2Z+xEa4DMaHjEs6DvVNbat7bIrr8T3DtDUe3t7n3/qqS1r1mAvSBI7nNj3 M6gqHJSd3iSuQHYpzp/CI74yUsmqSK2getZHKjKwCdYhsPf24yWw6KGlX5GrV7QuKgKHpPHg TI0CZ2QKMZIsR12jk3FeAYVMQcwQ4iSAwp+CXuA9sRIiEwFaiQlJ+GqP4wvmD+F1JURiQiwQ 6sTVRxIKBAWHyxqRPEMMZMxeRRfNiyxvBVSDgEhtSLglDUNRBt0RLh0F4z+9g5gwJWax/LkW yJjRgVO4UwJkYQDdb6DxSwshEHIQTWhsw1c3urpW7dg+kKHzd+glLJg0ubq+Dox0dOLVqsum CRQ3nhAauProhW3DDGQ+mVIjGokIZIOsWnIzhDFSwCAJjYvfQuBx5bALTjoZk6oTC1Va6AQY ZaMSWBG5KOTchMwL9qKvqHBXgcuq10SkRKpb6g+vgEheP0IyS3F+fEE5vd0JoeIqhETo8INp dwGMAFJ2XQQX5XKo9wNnEZo4IyfzRPCU5HKzuhbRORB8mnkC7Cu0AHq14llCUzxm6hFTcvmJ 3Zyn10sBVWgj8Qv3WRuqLj9Q0+qzSOOkjRqjmdLKyssvuph2FNkwlo48sAEDtGw4qfHIrGu1 33jpVQ3MuUR9UdH4T2m4eX5qNydIOK96DpYJLCiMlD9IIFNlFZgOqgwygqYQsiAjh4CXFiMK PSJw7lrXwULi6KoUWs6qq+YBblsoUDNbo9Gyf4ae1PxzRrMYLmKMySsBcY3GszNqz6DKQ81T gXogUxoYJ1MAijbZbwIMFPI5qpDoSUqmw2g+CFQhXlpYzSGaRo8sTMWIwKgKYYMrkGnVYCOi SxcSVhVSr1d2CaKWumAPqxqtK0BeMnMOLesycKiQKa66NE4lJehoWucUKQiixCgkUgSvd8Ep wYEEp8gj2VMP3rx0umwmOmiBK6NAUUF+XY3MF0HKeTSGMItoH45NfWm0UmmehM6i5cPUQZpG FSo/JJpGSFPYXQpMPIcfUfBwatYUePMMEnBRUqAMgi5EIMTVLbLIuvLyZ6VSTiY94nJpzJI6 LKH10xkJ59ekRFWND855PBBPaZKEGRLs0TNUXibBXOxVt6xY/kh6abwsTiSpEkJcrgAzHcyG 3AaCnF8L0RSUUiBXHutHClVUKfIqlf7LSxWN9PMXNeb1s0oVEizdzSFuVqIFgyQTgAKu4GFL iAWQqiSaKi2rUiKdH6sRa9nh8GqizmfPe+C8B16LHqCREP/1oWWgqL6IqUUWJSvI+FUgxFWX qsJ5B01C5JgREAmU/BIou3Uc5VGyFM96QL91Upqb8OgogHcBGMplC+ujuayM3ksjJVT5gH4N HiqU2EOPakrXrdnoy3IPKCAlCSPDRcnRbbAYHoOX0qgkwq/K1SVaiX+MqolQDNOEcEKpgmdD aQIiA61SSHGv7BI1NgmRpoAYKz3ltcTVo/CFJj0yL8UIFeEaJkQOo8jfL4sSIuCuPpFFpSgW QKU/p9QZNQdLEcyqyLbEDQTNoIGMySn+pJgHXcjxs262Qubp4EAVJdMy4VGfT424B7xGN+Ki zws87wHPAyPR0BASaFQYJJAVGjg0i2SW8vPHE9/O4JWh8FQhNhRCw0wpSK00fxBq0BWoeBBB Q0aHWlqcTXoh/CJ5TumlhppK5yQDNEEz/KKlJMYsnnQSOqIJUYwRFToCwiI8MjzJQccPJm9U zBhZpYOZ6AYypeyDcYTbRwXIDjWXhrNMcCY+IceBjN4nyyXW9AtqcZUyOUCjFj1TQR1B5NPr jYzc8apgdlV55VLZAopdpGTm+SgyjtWIpfxws6Ws4thcqZxbDsndrFApZQsAvUbp8TymUgfS fMnFE+KlAqTRAG1cH3iDjwmV1sviRQuUGGmO5JaoYhI+Ma4oKVEii5EYSitFhmIBDCUIBUZJ KBAeJdOFC7Q2gowULug5gVa/AhnpR4w9eTMbymR/qE2aKmQ1SCjX6QFyY84ee05PqUO1iJYR ijwPPO+Bc84DbovWh5ZRdzuHS6zofLmAANZ1B39ASi4Olf2eUK4gsSCjFrNJXgrwHr1+Bjcn 71eWjyJ2rRQXd2ZR/WS9QOEqRXKYVKvBFQ6alGQcnp9Y49Wyklc6kIuXfRauS5AFnogSQeWK 2XJNR/6skCCpOEAMKnW0sMf1getXmtMppcBggnN5hfF383RBnE7UdwDLxLvmBIzQqAVZ0CQV ojCpDBIsgRKicou0pGKAvKQBs4UM7TocITqvP+/VhV+lnypQyf4ySlaNS8tKMp4IYuUqgB7I NM5BsxHmqTcwtIPKLX4ofRDIIUF4lD2FU0ZJ+LOGBxvIaXYHN4CfX3N1ebq9C31nmQ+5RaPq h+EGMtngB3edvxx4akax5O8tRHFJS0YpwfX6C1HoY2eUTAqILdw3/nKofC5GBQX0hAMki194 SB+CU2pkrlAODceF6/WgBXFpRNJqT8y5n5K9dF6U01tGzcHchFDgCDpaBrKhKXK5NEdpWWlu KFwCZUI6X4W4aaqQ/ldRwSyXQM/+YimDMpUkvBSSwi9Dgt2EZkmBxPnJdB0F5kdFaIhurkcr eJAu1Bw+NKTEg/Izia4QKYs/5YQUN+fpZnSCOICldALp8YSnNLrCrBWiCqL2NPCUn8nDCqHa dVACjV7NFsWrEWtZVWyedBSXDvfn/bl8bWYEJvv9/s9TFg8FFo0rmNUgHvP51HkPnPfAeQ+4 HkCsoz/6kT8OUQOHmlaxklgCg5RAQSLg/McpcZZZycITMqvLZHZRLKPQiL0JZtd8V48rzb24 QP0iWNypYa6AEjGEHwsoF8bBmmBBq2sYJC/ZNHGCTeIFwHcVZvuAyGAlGmdtrYKLou5iusRn DuTwPVxV6NCEkVIpmtVShIDzqwS7dip5Jeki9YtGoWWlCW7PTMzuCwPcNi2wPuEajWj+gkai BYBfRRdQavajB8+F+2RwPkER8ICLiIILPt81P3F+LAS5BJIuwldcpaRys1pe2BW1dBAqRDB5 V0jFD4bIoaWH01JBayVEJvKzgIz/NDKZVbFRMiXx+cSIe0C2Md4mhlYFUgjMK1YC1+tKkJli pYy4X4oXqDqheO7R4Rh9N54NpR48kBXlXek0JGS6KAnDIS5K6dng/eEUdpi8PFyECIETA66J JA7hp6CAAB+d1jA4cX4WH/9ZmTnD9ms+HQUXoYBnuIx5CzVIIMvvH4mVCa5Ly0oDOFxitazH yxymkwkv8kGRNsj1eKWyAhJCiFRFeYQeNxDLbAHyKAmXVSwXFz4Il89M1RyJYAL4OIuPM6k9 kVJVhBiqQywdRUmJUg0lpkT0ysdZkkzyUpx3DDJ6de0KavIkhKWYjqjxCDfAb4ZeozpWUyLR fsNkzhtjckaJ0OTwrF9aYKFeoim1LxPISvEamYRriVCyUKDKmIcgBMVAHtzvCg+uKpDl8hNz kigWKUB3PqQJnkECmRRReEK1kKdxVoEQpWWl8Ci4JDifOO+B8x4474GgBwoNZKEPdh4NZfRB QqZVTRpc0sgEJ+ZkoUAQcLiGVbVIITQh4rRmkAT7GX1gqUIrnZ/F06DBeVYTotOIPoxPsU6k 5KU4BSZ5w5AKXUQyf+k4k1TBs54ikZLPQ52A5cNVCF6pQtPC4RKrZmnaz+5iZQ+NYSWJtmSh ixr9fJ6iQbnSQWOEglqWphADBVM4bRQ2Ai49Fy6NQzXe/NZqxJ5crekIRLHSIJ+rKCiQRZVP hSOtZoVh3lXFqmlQ8GwkMMwZGrGnpuBUUEKYnkHESSGUV2YGYToDaHlLCxvdsvJ7SQCpYUCw rIRxSjfL5UicKIkrTWQ1vJaFCo/eSwnm8NYgsRGJEDkRlIWCgxL1chQqaZh0QUOowFEwJlzR MK3Pyz6CGgsKZKox0oEyoWJlWmB5hHXDrwBKKjcRBdfpWL4o4lAJ54H5PYA6QwuDn6mrR7Ct 5dd6bmLPRffA5nPR7PwNRP9mvxsmxNjH/UZGQAZv5S6xeDwEsxICAdx3nFHIozChSpK4SM4r JciEixbiNLiW1SpMYAWYXfP3Zl11gYsQ5ZWLkwjRLgMn04ABYT5iZIZmkog8VJv8s17yG5uu we4UvNor4kVgXNQQ12TkWYqeODWDuFiXjuUoJz/clHsRpPwKcR6hYAi55icSdguZmgDGrHhP mKCQBTnza+SskTQcERSqaKRJP1moNH2kKZhCJWlAqUGDRygC1aAWU0nR7IoeP5FYZFIIWNJP 5WFD4aFAj8efQknwK7pHxoUE3RCEqOq4MkDyk0UJV0WdT582D/D2VEiVnTaTzis674FQD+iB TGm1RYRFhcvTEgQCwn+ciBPIl6Q0ep7VFhlUdk9TdHx0OwGaaMHp3qiioMqTnFLIDgSHSxmC 3JXC4RpQaPDRIKOrYHiPV+rQ+PNmObvGKmXKTRD645UxyClXrRQyiwRE8Sy132+JhHOw6yhB 5F41Ir+EQXNCmCDUdLhgV4fmXsEjLGClZQIZRFawoFOvul4VF0xLaqEqSBKESCbFwSqVlEUJ FWJKE+y+cU6NjAPZWUpTYCIZxRUF53wCK65+qFaoqJ4aJxMd7UA5mcyIahXW42qgR8brVAHS pLRNK76E++hVKGXQmHy0IlMIjaD1rpRL1eZhRiAlTSpCg+QR+iWgCCGCt4DrEKT6WHiLCRvO a4aLLO52KkBkFe9LuRIXYb8kjMAPFTxacguzZ/S0FyRZJTpTFZDXUaqBeQlHBqn3yAqRGvCb DyBmit2CAKeiAVWzalpVHQVXac58+tywsiA/afXi41GLeZqbp8+O85lCPfCaqaUCCsJbp/LS uM9J4pGttmEQYJyiQZQndAAlJOosOpxaCxpOFkocBAYhXCqHy/KLrAQI3Xmvgsslyp/NK8lF DtI39sY4XJXrCq+/XYiOwWjUMZmU7Oqj3Vy3FkQ9uB4TQxiJpWo4DrwukaZaCvXDOVhjkbQa 3M8aVCT5OKHLrX9O1i9FlEVAZa14/hco4QXkPcN4SmgOLY6klrI9iRAlZIViUesCT2WLNJJC JYNppaBZkGocVKvkohntUIR7mFAg0FFwwRnmPnDp+kNMFBJwdalVXV7aSykcLAmX4gfmofTI VGG6tQLH4ThrBFqWkwfJhJjz19PnAd5aQivo9BlxXtN5DwzJA4UGMrRvNPSiWnl0eHIDLBcY JVODa1mtsN7DjNmYn1jjlVnO5RoHqF+KzHkEkjNPQrLloRkJlLQqv0KdTFJLBDOG5ySSGyhJ ouCcTMPKwkl2CUEiFKgS5E8H2DkgyoQIYbzzEN6xcFtBQFGEqNMILsqkAokLJAstpc6r512m QE8tVFg4MEIkJS4okPF2obQORSCFqhiOotYqUKopCKHQwKFwuVoUSIB6eAAueWiepbwwUImg Q7AlsJSjOHYI4sJYpETXjdKbEuHnUsaYHEHpJC1dA0WGnT2gLsGfD+SkCR5GivVANCVV+MFn NCdtCilGpGEuUzEsQVnaoFIlYPKHIl2WRpWWP10gS4Fkqq4hsEj2ggKZpGYJV53iNgpRspSK E0kgEjItiTUgZTu3DrVI55blw7GWx25Wds8B+dugRxetuBCaaO7zmD9zD3iBrJCGxGhw0jox 3l4ld/MVa9YylimSvfYOoAIvohZcLsEsrlKCVCshniJPvYccYoqKwv+AelecH85ynEMg2ECG Z0bQKm6UWiShT3+0uFUodPMqFDnxIBKCfEJAhDzrHnj0gjL8qtAx1gAVh1I1kpRm5CGhEuJP +IgjZLh1FSlKb9Q+QqnAg/KURPgNKirnySyAbTjEGq+W1ZRHYaPgnD0K68F5ivnNA2q6RXZQ AkFY2NCSU4sq04UHR1eCUmrxEhIFKTIt0UGIRJ2NiXPM3BFyIS+1Vna9Ufh1acR+pJsrhCaU 8Tzwz9gDst15PbIobwTjVBQl4G5r1Bql1JaH84ygNDtH1AYuW250cGVHzCgXrjm/L6EUBHmK JdldGkEqdwZwSzhYJ/Zb6cMKOSCRcFWUhCuEfnGjkZOmKFplUiJHQ3O4TKlSGhFO54NKJh9U yWhdSQXjJQcV4pEGalBFBdOjJ1nqGkQFnCl39ksemdBcrWV5a2USJMfgCV2InyMUW4CK0GIK oF8ozwmcX73M+VkkeBAuSRfBLvF5EoOoGERygJs1cA2qyZBYHc7yEhga5mRBpBAOkVySQE1o xApKw8hsfnmKgJFNyvAw7GdPoXaJEkvNhTIqdEKGAgpLFkjGWYsiltoiucLqM5JYisubALvs kXmiwhSFiAGZSqmmQS2xGpwLCgWG6BAPh8LpQ4WMJPCMmuJVUkSROAHOI2um1DuyYiMKcR48 uAdkjQxO+mdAgWYpP+PjNtGwlhriNHd6X2A0LpkVQgUd86n7hBNEgQeej5jXAkCC3E152WLq KUS0yl6IUFWEj14iJFRCVB3FpKUkwQQAExopmRO4fJpn9Q4aFSLf1OC9AMnBFeAsRFELhHYk /Qb4uxAYTbtclAmHL+fn5AT8zMikBQzGQJzDFRLN7ony6eNgnwyXUpINItPvGs4lWaS9Wpld D0kdnnWRKSlTNVlSa1hlfc1VpREUIiRKeH54qCKwFAjXevdSF0/obtTQ0dmQHlk0sYvRaid/ dlBp5xiBVtrTa31UW5FWcAKcz6iZ0hya0Gw+ewzzWXmuZTSvnmvmj5i98AN3BQLZafcJb8tS bbBpc5SEa9nhOUFKDYqRFgVRLiSEOcjkQoKISLGjgNC0hxhemNKhydG4NFVDNkaTc3ZleZmL KVt+L0WWTlMhs0MSNySmSNM4YjRk5lUJhY7+GR/ZVdY4ubuk0zhW7d8CAl4/waiWKK9wvx3+ nN5d4ViI4wmcqWNEFuXKq2kQrOZGLatL1g2V5DqhRBSR8Fet/HIsl+A6wV+j3oI16/HrK7BS t1+yVwjXamk8xeQfO3i8TLjklKoKSUguTZpeVQItrq5sye7TJe32F9ZHM1jGk8xTmmLJLrFR BJwSWE8iAyn02ghOI5SqtER+Mg2rZTVRWjY/sYflKaUgkONhNaEyS1cth3r4dQ0iJQ9xmOWD SCsQDaX4aiPOXDsUZQlJs3OGnW2mGzcvyOKEJNjah0UIfmCxmQf5uUCNf55ksp1xP/95OmEU S00bMZvMhH9pI3boDy04R0jGcXDmB1ptwqDtGPe0hQRjcZuv47ZmQfvauwYCWVRjlK2V+SCc SntY8TAh4ojiO4HwIoyCRFKTrmUZrd8clwOEPCqBBDWIuu52SB8xemhEcxCnmk1SZzjlhKRY dceYwWgJWYP0O6SLkA5inHBIOzEQ8iqJU2KQMkKSjBhkUIofJIccYUZKMvk49yAyxRM6u1Y+ jXoksqzsnho35V64ORLr/QWA/Jolg1IopWQcrQAomY/Hl1F0eX1DvXEoRMUmNWXCLnF1xWlU vEsZ6RBOLdZQZLfI39P1lzloNiwAAwITjqzjnLQJWvApQnoJKSVkvEWqLKPcIEkTTdOIi4rM 2qSfOD0O6XGcbtvZnyMDDm3EpaAkRoVJwxyPa7YjDePK9TJyqDhrWC0rqMKvUcSRcM37fqlR XKAKBDLGqUpT036x+XJD48onMS8ODy38UE50uE45qHQDAauKOJNipIHkGi2n0nDKDKeCkArT RmNIGI5lOHh64UDMQpACY49jdDlGv2NAQodjHreNE7ZxmBhHiLGXkDpCqljHDS5DewgPZ3mN HBoyT+UVLlATMqq1I3VFaZEEqv1RxCrNazwNF9CfwYJXzumgd6cxLmZOjZP6pFluGWUxUmOZ lZZRahkpiwampBhTwadoxAOO02fbAznSZztdWUTAXGfG7sogbR/Ikq1Z2oIR18pN2l/DeITH tZFwa2idjoTgQmWEB7JCuUeCbpgtmLOjEvuZMYhNVQYNW2MMu94gk02nycqNMZ1yA90rB30r VH2STg0SE7GMsYAXFcqagTHA+nGIZV2OfSBnHjPNvY5RhY9UOEbSMRArc47RxyQgzQ+tCrWs oDq7rpqRxVbBoOzwVF1duqW5v74xXVmZLSnJpVK5WNyxbaO3xxrot7q6Yh3tiSOHk8eOJrLo D2sdM3ZHn10uG8wa7kPNM/mZpNvdDjt/PGYc2oEqt0jcJCWWOTlmTkkYzUmzKmZUoS8WMwGP mwbOJhs/oiFCEBSDHSPNrG1mbDRTJ01jmXk8a59I2x2ZXDLjDGScWI7E0BvD6INqcedQijJa FGlITIJ5sGtxwpkfY7LT67rVL0P6OqJHL6jFlVvocrELMEJI5GTxYOVS8W6nGDL5Dzgkegxy nBgYPM42nYWmPS+G4JWtMJxai34D13f4TQUK4Qw/RMAUOukuMSVaYOXQWcPg9KRtHLStVbnY mpy1xyC7CJnI+vhoQpROkw+IcgQGla56zhTAKpxFJl25Aa681nnU4ZZECA2VWV+fnn/hybnz utqm9EyY2JtM4sYa/EAU27+3ZNfOsg3rKte8UnVgHwb9IYdmSKgBIWxFgaQOv3Sek0hXpPAX H2Pq2AL1cjYooDpoR4x0E+eYbSyMW3NLzdllRm3crE+ZtZaRtNh0Lxuy4jZisYg2PpmAADTi mImDKsddDZkgQLcLg9OMnWvP5o70Zbb12YfS9sY+Z0PGmWAa6J2h3aPZR9SVVi4tSxVFHxqx lo3kK5TOE8D9Z8yddzmHUWfiYILcNPcwA3MI5wFAZF21bJhOXc0PmeBkIut+fUsRQvF8+kMB ukI4LyOgEJF1NfLo08emDjCrdXXMXmrlxlv29FiuwbQZNSrcZeI8OAshqkCaxuHKFWlQCmKG QQZzZ7bV7hjr7NjjWfNB20QbqKcdQNqbw48fqhxAhAkC7dOjYzXeUIFSkJYI5QWNKIVG7ssG aVyIEKoRyGws5ly4sHPppR3zF5wcOw61MdzjxPEEwtmLz9W8+GxNfz8qOXhQ5dKAIFqFFEim stB0GJvwhE7LP/cisW5CSJBwLlNm3QRuDHpvGE5HztntGMuSxtRk7OIKc2q5WZ8wEiblQivG 5BcY+A8X2fUImupTwCghgRljxJg01lPLHctktpzKPN+VWz9g78mSRkKqLRryXBVeGaU8DlKz atpjUFIagZZVCH1JTlYgMee0s2YuYyGQLed5MUFJc6L43AkMz2SLkAQ4zTMXufS4SKwpDOFk Es7poUgkPCEUoqugknFILTRtOJCGgSGmPo84ZKLhzLHsZfHcfCtTbTmYNKABzq0RiKODwWEe EEYFsV+OGHh0YTatyzbWOrHNOfMF2/xTzhxvEMy+4UA4Y4XQI5QAe7ZwMlk2N+vhvVQUKgru ceZN+byalxJIl1ioRHbK1J7rrjuy8srjFZXoto78MdBvPvt03R8eaFy/tsrthKtKxPNBLYWK 5+n8WEmfn0yokuQ0ITzhAuUHMgNwP5fUhARWmvpscpTQ1ahrUtbFVdaMMqMmTqpjaLW0yFKW 5OKK1axPvD8DdpWSS2MQ3H5Y68y1Z3KHBrJbezKrT2WfHDCaCCkz6LxbOsTfXLS0iBvi1+fm VJogV5BFpVfTQcoghNMjkNkZMySQ8eKrZyqCMcm4oAYyBejqkkO00EAGB3MWVQhVp6twpeHC jQEXAhnum1OO0Wg4E6zctJg9w7Knmbkm00YIY/183tl3mwFn9AQNKQW7uBxqIO18GjmHHLPN g46x2UEgsw7lzH2OgUERlpKApr0zXTFlVQ83L8h0tCCNggOfByW4812F5hCaIMqF4BlvkmXL Ttx888HZc/AoOR3H3t2lP/9Zy2MPNWTQWKVCEV08iEQpifxYSZifTKiS5DShOV8GMk4ksRov hUMZ2jEej0dtowXTXjGzLkmWl1szSkltnM58YecEIokUwSWO7Bk24C5B76wnZx8fyOzozz3X nTnYRzpzTq9Nalg/JGywqRqlplXrgvAgJIo+P6XKxdOc/iwNZNTJzEx+5hZzIOxGi4GH8Ui5 zMxdncyMN+1608YQDwf3vGTnjCN75o7DmQdiBKxuQrbb1qOZ+IM5ExE2TgwaT6mdWlPkrJ45 bl4UUkcLwnA44wpHCcbIq2ATmiMJOYKT4QyfL19+4vY79k2ciF0Ap/vAkPOnPxn7+981ZTO8 8LJTn8+SosoYJUgLRpxMeNFl0gKZFOVGA2EHFQVO/NB0TpnGSkyElZrTS8zxZUbKdGe+8JDE IVikqJFMcOstgzoRpvfnMvt6B546mdvUb+9OO0mbroJxAzil0C1zMiEw3jWICkI8auYMmc1P KclkgtOjO4ZYZswTc2QSzYugdpeAEkCXSp0U4yhJwxJUBeDuTxioUYp+GZWpoSSEw3GOYYsM awAtpn1zLLcimcaTg5tBQ5sigYob5QMFwo8qZfZhpPl4Nv5IznzetrC2UKmMMf01JaIb44KN wjGR5oYShN5akSI0RKhEQSPsEnnh1VmzTn34w7tx9hBnInXwQOq/vjXx2adrheP5DFWkKcHi qKT5sSol0lE+d93JG2KgQgXWrWhs+SFYUsSWRSNm3Vprrag2qhNGiUlnwfgAHTYVZZZmZVFZ 2RIsmGNil0ZmZ196fU/mpydyCdsoYcsLLKpKQik+CKEukuiwhIbVspxDAfq8oMBDRCOKOeit DyeQcW08HkGDVI4gyNPuGRXHDFAIaL7AQAYyMB5wsCJpL41lVySy02K5OFtp0cQyJafvxPyL YQCd08gYWNk0t+Sse7LxFx2jlW2jxWyaVr9ulQhH5K8hnVmULOqmEvi817wqhV2ehIry7Ac+ sOcNbzjidoE8zBlLvfBczde/OuXEMaxRn1OBLGk4e3KkwTIXlFrX1lpzyh0MJNF86Psl6gT1 aXcsbRIOsWAMdqLl0pu6e392LLu5H8udRrNF96YFLApCmIgAnQLQWLQsJ1SAvpaowBWJIoke mZM1rebmCQLiXtXoIOWpQNDRZs0n7d0EjVWSWAttkpgnKDtTFTy7FogL5MC7WAw7RIyVsdy7 U+mLY7mxlo0ZSbgeyzC4ciGC47RemXZqA41lBjZdO42mM82w++lSgHmYEEzk8TqgoUf55a+Y qDJ4XBAVfXhk0TQSk1cSWbTw5Fe+smn+/C5ayLPmGDuu//XXH+loj+/YjtcuqGVR1ol+km46 6KNYKGkYjrPIc4BGYMJ40YgxijM2ZY0lJeaV1bGra8wpZfQDWrSqWHWdWf+qNpsGFkytcUlC hzuOvSlj1LMAp7uwiLzWILVsQBD1ZIAmAFDY6FvDtmE1t0xArcCT8scriZdOljFPlmpmcjVi wFS4JJNwnlBpmBj3hCiGoTq2N6PCL7ZyNyWy860c9oXRBzE9zmzlcxt8Z1iL+f46g27I6Geh DSsAlax4RfWh9ErjjlPPPrVFZlQ5yqOIVhX/MXmW5XzwA3s+9tGdpaV06eJsO+JxZ8my9vET +la9WJNVFwH8hqJAoUcU3CUeBM2oomg0OLJoFnhXDm+9zS2x3lhrzq8wxpUYeBTL+bOzoSHD BtHszLhhVsWNStOsjjkncw5eCcCbeqN8COVQU7Qux6YjQLdHpnOLJk6dzH48IX3O6flZ63/x IqsEMs0T0lhk+U9COC/P8gaAebEm07ktkbs8kYE/QY8yQ6MUJVnOYEKWArbh3Y9W00b8Qlt9 zsYrcWyJtmBzlRoVBSqYVzAUcQ2VXVOd+fznN1915XFZ3UVIPI2kEyb1Ll1+Ys2q6q6TfL1H 1x1aOhBFwV3+QdCMKorGD8fSj4EBGh5rfTHjfTXW0mqjIUF3D2HuCc4FsZ9eL8DpzHNjcLYd M2ladQl0zRzDzr7QT1IOZvdOV2Mo2iM0kNEeGRtaSm5ZHO5DFQ4IjyAMSO84JUvJaVHZjyd4 jsIpUqm1QJQETu2zQCz/rXXI/0lkb01kliczgECllMlEnl0nbhuMRAieYNozTbvFNP7DMcex 9+GABYp6rfBDlDY/V35s4do4JRYl/+Orm6ZOwRPkHDiqqrJXXH1s66sVRw55rwRwt+GsHRpc ZgdJhAUcyYIWydNcF2vaLEQBiiaLprDFIWUJ458brasa3OEkXZwC+mw9YBt64XgDqsxKTC03 2qzsA71OHO/ojbzNStPlXpSDSgUT7SeXKCqQqYzSdlePilMiFAerxIBwFp4Y9KwS8L4Yotjd yYE3ptJtVg6TDDBaygfxWXvASG5qyiRtZu4SQn5sm3h5rmRogez0lnPO7FP//uVNeE3y9Kod lrZE0l5x5bED+0v27MLXAOgR1U40uJblvCHn/HShWAB5FHslZ95Za95aay6pob0w3jJCWUIU nzkQLISp+OHN9EmlZIqZe27A2Z8leHsZwFE5huGU/IEMgpls13Ce1bTxrARqCfpgAkg9Mxcw GE1xeo+LITAHiq9NYFTz0UTmBuyxoK92UxJJxmSc1SeYSr1m4DVPo9lwagwD65j7iYFXQYqa cFJ7qcECD9qiBiXQZC6Yf/JLX9hcVlaUjZqMM5M1LbJ0efuxo8mddPpfbyqsWenAIFmhpvsb IhdOpbGumSsETTZnGFts8y/qjDfUGm2lbJtrwLJCVZ4JOl4w1oYsDIcrTaPCymGYWfDcv9b8 lKysEDXh4qU/Q8usCFHwPJC1NE8AszxkWiaAktIpkGfYmcYppXZYzoNwQkmQH8vJ8BjDbsuc gdDvvDeBvhjdr88PyS4AZ/+VugfzejGHrHOMbrrpjb7WjgP1oRYnvHpApxIxxtE7XTDn1Jf/ 76aSlDsFPXqKRkkyfH3J0g5sNNu9Ey/a+I5gFhAN6GOIyLhcUZwSjgRm99MOicfMd9WStlKj PEa7YzgkTYSKsxNslsboPm+H5F4dsG2bvmc+rIN6IbLNFy/ZUHtkkl26Wk2oaZWSwkWHy0sA xhhw4ozqmXFQGRLIExyCQLaLGFijvDOO/WJ0XowfkkYAzvYrDJYFbDGdFmJiKfNB22pkUJwK qkguYvTLOnly79e+vLG05FyNYm4jMciSy9rRKTuwD+N479C8qGU9ugJTUfwSjlbb6ZABjCnq zBW1+PAh2ykmGkSBWs4SMl4obPXHB9Ga4nY1yT3aQ1flEdfUxiLLnsds3uIpZSHUeQQFUAhk dNWyZTyVzOIRDUDix9NcJz+rJqjwECwD4SRQ7m1LVz5E4PN0McNQ+3AOPv51lZW9JZFZmUiz Z4BrTsD2cwOA4qPkOI817bF0Y475kmNUs/kTtRkECyP8FcRQiIv1I0OBfpLwXEND+utf3VBd PSrvfoerHDUoGtXiS9tXvVTTfkLs0vEaoatVtElpBG2UwZ9Eawmw0x9tyPTHDxeITNIwDtvG xIRxTYV5YxP7fiEjkaQux7lzgeW0EeNdYiM+riTnpHObBugUSYnpxbKw0nk+ccvKAHBc8ccg bRv3EgtkE7hkTQPPqmeQSRoVrgEpGQPhJFHCeIrhQIniENiKjxribn9PMr0olsWHkqj3BNu5 e0UR4GcEZXyfdoJhv4oPAbFPaMjOZr6ijX754zHnK1/aNGH8CHyBJ19BTiMOXxa6aHHH4w81 4vONXK3mRS0rWmuRJgakUH5UKl4/qo8ZK6vM62oJPmWBGx6UocRFKjyT5LCfPngNui1jTCqz o5ek8aKVLfb0FlhA5oXRcAXmkmkga6UbYqmZzFU48x/LsZAk+lBAuHGIPY5UFpdY9BWiAplU IXkpI/72B74dYpCjBvlwPL04nq1mi7AF3epc8dl9RqnRDFAcfOixnBi/tc00PqHu75vzEuhP Hu4vUTodOxhc4COurJo//pGdy5Zi0/Fr6igty02d0f34HxvQvv0upMWUEOYA2qhDCy+wFK3+ QoldGVhc3+EY11cbK6rI+BI6ogyXHS7jrIaKgpgVcXzmxTmRy21LE+yWpAFO8Wm+MjARQo5C 6GvXvoxCFJp0iVkgG4VwwW3FWfv5bYER/Acw+8C0gwW+mbEsvlI9Cjb5dZ+JHJyBbwvPMOh3 t/EpKrx+zd2TzxbpoHxEg+Ckn4OJFctP3HD9kUH4z0303AUn3/auA5rt4Q7HW2TuTxu0a80X 2ZDDJaIXg/6JkLoYmVxC6K7X0dupEGLGaQIhMseM2MSS2LikUR3DH7mgz+dwxygWjUQzVsSF J9krSgzF7dGs0oASq8I1IIRJrERRDWqHDgiWRe1jB/xhXNAds3JXJDN8291rLJax4lIf1JlO wrEOOMbLDv0cI55nPhdRksAxOEWApQBAbV3mK1/YVOAHqQuQd9aRzJnXteqFmvbjgcky3Ffs CPg1ANDKlAePUSymnHfa5M4asqLKqIvT71bnodcknytZlCjnWLUJB1+FTzjZJ3uNBnf8XkAJ mDtGwyd8aNnSQrdfYHBHgwlS4qdmKZwd4upScnp2ptXmYTVil9slUMmQxh8NqTXIpVbufckB d0djIbe3kHluXVHecQZWsPHwNvCnnmQrEDdXeGk8rPSd1nsI8PlYwBX4/e1Hd86agc+pvWYP fLx++szuhx9owl884YVUnEcBWlY4gjdq3WGSgd8oPm48dfEeku0Ys1LGe5qM+gS9PVABEQqE onP1infuzAorVp9Ib+8mvdgvp9z5apm8Jug6D/6gznX94kerjDJNSSiT+wuvGTpBhqWIM9z1 weNyA8EL9vZ18VwlPi0nrJZleS0lUCEIYZgpuwjltew14iuMp7+MF84/efXKY6df72nWOGlK z5tuPjjqSrHBAtOMhw1yQzVpStHR1vBmxxAYLGLFDfpjXwUb9RIUoQBxI+uYKSs2JpW6poZs cxxMDGEcfaYPPZCJ6KfbReOeO6mFaBP8MT4am70f6/FRNnlwNp4FGFlsf51MnDmGPdnIMlMA e40fKGazkZtrZKcSB68C8dnSosqsunFQRk6snq2Y87G/3smejYNyjxaBQ6pz1l+d6Pt9e3qD XZYlFY78OeX2KXLiRP9jWfOTDhk7TAveftu+mlr9jSveyIcjmUugZ0zw4+/gVhikLY69r3R9 engHujuYtOt2+g/bp47a3QP41NbZ17WjzQl/l25KqTkljiI7+BN2I9wFkQ4O8aZszCrOamVD SwmCAPXg8gDh3ToZpnh3jxOzMz3xrJrQRKlZSoa/g0vIIsO+zKKf6GF/YvPM3l+agaOShZfw CMdU4A7b2oXJU7Y5gzYE5dCyCoYlpaN1BM3rvAHit9xw+PWvO5PdsQz5y37nnxKl18cSM5Op xliM1bwoC4YqsVginmixErP70suydkvM3EQ/jDSkI475nJT90rP4qGxk+4SH1J/Q43McI+DN X8jhtwSeS102aYiRC1JkZQ39Y5T80eTjFiLzXrkNqD88+9P4yyQmBqtGKf7EG/LFS8uravhI NqBMmJlDvfbRDP6Kiu+Vcr0JaupYYYIl8nG56DCYJo1uccPPwhyZitHkyyxPyCxnUYA0KbEy ESCjAI5FA8DE3CuG8TeJ7MJYrt6kH+NnnTLO9No8o+woJh7bGFPjA//fz8WwTRrfbSiuX6b5 N7+r/MTYOPa5T289Uy9UZu1ZPbnvJsputeIzLavWshIWBk+BA3+c0cK4yqw0rfFm/KL+zKWO fSRm7ggQFgSY1Nbz+EMNPd3e+MfvEq/d+sVpVH4kchyPhxLm+OeXkTdU0x4Z+iaAD8YakEU5 0BfLEbubDJRZJTeUX/buyutWlMzP5TJbs/uTWBIrXmZQy8hAYAkLMPjj53bcyD7W5xzMGi1W wS8Ss5IMUpwwdBiM1oMWyNjg0S0pWPhPllwIcTHsGUEfUCCUzws29pQcNMG5+KNL1gSACFi4 dTG4XkCc2xMDY0ybP5Q5vU/EazFDPYC/IGc4u2yrzzDwZh7uZt/DJ6rU4Iz2kSZBy3LG6645 eu3VQ++OZexZ/bkPk9itWbLMsQ9aRuGijKzx9j77U6nyq2JxfLWvoGcWi2glpjUhk5tH7HbL 2BTlmDxwvFKeTDq8U8bJNBcGs8zNvNmyJh6QTgl46+9zjLYEWVZBLq4kSdYd08QFeEMBmBQ7 5pyKm4k3lC29q+m25VWXTCgdOybVPCk1fnXvxj67F3awUWco95kCGlallTvWT2K2cwp/w5yV XG920Q5kbZm5Omh/mBPDYOAMBjJPXJBFQNwrv6hnKtET4KZUAolFAmELe8kxsHpPLLuE7eMP ZQ/Iey0AUHzUNc54lnc51tO2iffJ0S8rqFMmnTgET+ANOcv5l09trRzaX6I0atP2FWnnb2Ml d1iJCw1rcTo72bF3xsz9hdiSJddlY19KlsyPx4t+5xjhLJ5oGsjOc3Lolw0llo2f2PuHXzcP DLi9P82LEVkNHCglQjH+mMj2rPP6KufCCjJhiDtgoSZG8IefTy1MzVxetuDNtde0JptS+PIT 3aRlllqlcfxpm4F1GZIrMxLsT/UGLDn9ABiNH3qfKcvuyTj9du75AdIshtUjYE+Y88NgUMUD mf5g5BZGWcKxnkCZj0pECOJRG0MqTI2VuMsIEaSvXTBGlxcYuRrWHUMpPa/mKTIcF3jicVgA HCJl6eKOsWOGONmUsZemjc+myq9PpVKY1UI8SpVdmyb/ms4tDtHkB2Vys/pyfxVPTNKmw/xU +XKYkikpnZq1Ppm1Z+eji8Dhm2XX3KBv/RVtVlxpDai/AvwKEnStp5WQpjh9OBdSB2EWZgmW 7MuXls2/rHzRmGRzwqCxHh0+BLISM3lR+bzZiUlVRlmPPXC2TfzT/bETUvjRuRL+KIYLR+7g 9VGIPNSDW3viKgE0AW/yn8C6tSsUyMrmicE0MjZIxB8nxMNsHF4/xKASQGrCn92BZ8g404YH yg0Ho8tBXSB9nd9TkWQOef1QB5UDuaU9mfeVlC1QIxGmt8oqr+hzPj+QW5bfpJxxU6psZeh0 WH5GFYt+WWn5rKz5YRVYePqaNx7BcJY1wAATcxmWnviPxqPAT2I9Cbhv8XGeBstpTZCKkJm+ gJoQAL25HKPXHhgfb5xVOm1yyURA8AcuccafAcEPibGpliWp2c2xuh58UoMGzrPrMOsSVmuS dscwPyhmCPMY6TkwrBz5sWEcFAYuvUcWRTqCcGg9ScU5l5v2GDOHJjA060fQpNMsipcXZ3zd f7FhNxlOO6sJQEbvqKzILl0CPUUfNpk0QL5QWfPGYCRCcKmoWt7nfE3pl+m3tO2MjZdcqo0o c7lcZ2dnNut9cqOnp6erq0s1rru7u6/P9za7YSSSpVfZQ9qT0dTSP2cea3eqjiGncd8giuFz PZeVkLFJUmoNbSu/aeBrWs4ep3NxydzmeD1GRPDRagAAQABJREFUlLbjIH5Ju9gapnFN9eUX lM1IGUnljyBKkjOXwKR41rZq4rEJydislHOyoNmRUTLXdZm8taQaDlGyeErgOSUP/syS2YgE k0I52RwQ50En9KBj4L20pfiGtV9ohJShgql2+mwjmO/Fz4qRGIYAeA8uSeKBH4AUhX0xmLJg 9HSPkOaGoVoSxgdvwPsXmA4+jLHLYcMJPxl3lzx7SAHi7wjy7gNNhw1uBC25cuVxLFl6QgpO 9WXfX1axCDErlAPw6poLe+xvpnMLQUA7E/5jIHdD1lmgwhDFEKQQthDLGItz8uRJpE+dOtXR 0QEsgOl0GlnQIOHjdeoG7HeqkMLTy1Ye5w2Cz6qwKQ3a/iLqmIP14nAvY0iFCGQcc8jF5aQC DabAOU7dWLROmxi7nN7aWG3cbQK+OgIBOmjNyYYryy5+R+U1m3LHeDdNF3Sm8rA+bpq1ifis UrKNBjJ6x/gO140oCH6s00LRLtRHqWZks1WBetrtJjMwXy3UKUY1j6cw/lZpleGMM5Cku/lD ij90C5jH6CiC33g23WadxVRphp7TvaQfC9wO/YYn3M7bDHcqPIHv8SXLWYxL0aCGcIa/Wopo Q29OyGEMlIWzDd1Ezskfts0k10RMjC75F19GRnSYaVeuwG08lCNtL0o6g8zQ19Qu6Gi/xzTe HDO3aDoGsvVJu1wC8YnR/v5+RKvm5mbEKaTRWduyZcu8efOSyeSaNWumTZuGASxCW21tLYgR zsrLy4HiEhynvLd/eol8l03KLSCx9PIT3/r3KXlWVVDN+Q+3dkCH7hh+2Lw6Bs+/QfnySMWX 3EmTkejO9eRoE8DtHpBGA4AxLjVmqWEs7n35UOZECf4yOI2Ao9dY8hgcQMG4lBlrThr4S4jU pID9AY7RAAyrEoZgEEqJ6FVF6MessVTHYsQQxARYqPeYB9EOEBszaUIf7Fj4sQkWgGIW/aUS JIdRQJLg07P4nDb9sKSQA1b0VhJYQi4hZox234Cif8i+n8U7fK/axEsj7kOFcrH+j+Ae6pUa jL8XV2uSWpgsjRmqOLc4zA2ajFTSxh8W0YAFZktLaqK6Y6qEmtoZHSf+uyrxFpMcZg3aRZoG ulR4brhfbcVwEl0MBK9jx44hVJ04caK1tbWsrAzUCFtIIIoheCGLGIf4hRsbA0wZyFArpjnE v/BUVZNpm3pqxxZ8QmmIh+daPNQwu1VjksrYcO5cVudOJUl05bqzjjfQDtpXaqYaE/WzkpP2 Z48hhLHpviDVmYCgS4teYnXcqMNT3+3hwo7hN2e9MBESUSn4oRpcvFdJigCBVEBDTrK4AS1o pNMNssAkDYgyzIhQ1UXoofxwIntE8R5eupt0473sHKmIk8oxpHkiqa4lFVWkuoZUVJISdLhQ cGU2B1y5LMGMzKku0tNNTp4k7UfJ0X2ko5P04DNyeAeljJRUKe2HPRGhNsK5hRjPS11t2tMd ez5BT4Z+pAxAiCxKqkasZbklcy/oGtq4EuxYogzpJoSVsKbuklMdXy2P3WHQPYLuYZn4Q+WY 6qrk+UQiMTAwcOjQobq6up07d86ePRtxDekjR440NDTU1NCgyVEIc8ePH0dcQ99NCMNcd3dJ YoPMFptYcHHnjlcjApnfcVqb1EfMvcTBZ1uWxJ161ldF+9EYCrMMM2Ko8wazdFd6X7fTW0/w Ryr4SMLjR4/HdmwaK6yKa6suf7z3Fd4+eFPx6M5ICjc1yoChS0PMnJGw9w04FiylLVj4w3Wr ByjITsHNiGWGy5JZTxL+0I+XOS0pBI8OfJXfyOEjECUsTIaYVbglYEYXDH0lhKETB0hfN8nm yNT55OJrydTppKaWtLSSxmZSVUniCYIdTIkkSeHPwSshTNVl58hAmmQytEM3MEAj2jGEs6Pk +DGyYxtZ9RzZsYEM9JDyStIwmVgJ1KHb71OFFJzmBcd+oUbijDWc5x0ayEbpWLhg6PPc9C4q zCyEpKyznD4dlUBWkniG4F0s0iRlVLADWQQsnBElZagqKXE7bpMnTwaquhofBvcOyDdIezL2 XJ7hoUcdlpo117eeEEZSAAwzu3gtqdIk45Ikic67e68WwKmT8OmFciO1I7P/eKajMVZXYZVz oEoKFyGcWXgPJ9k41qo7mu3AOwAIeSMyLlAVDSWNN6lQiSWx2PhUemuaoG8N/9Bx92k99KFl /i5YsUFHRFC3VGBHCDnu0D+SNh4zrqzrUaxMzz2YmEcbyg6QAxtJ/QSy9GoydjyZeQFpm0Ka mmn/C90uzHNhUOlO27OoJ+cgtPYHOAJcKkV/QNGfTcZPJIhuWFzrPkUOHyK7d5Gjh8nGteSl P5Ej+0gZenmY4DLo7NuQDvgFxW8wnIkm2Z8zpE8YOChRt9hPIZ950qOu20F24fyh38DpdK8Z s4NLln7tbs5x8PqspxdQ01mXTr9kGgvRswtlKRyYTg+ke1+siK0vnEWjnDkH3UM38kQ1dek+ lddHjEDda5Ny05mEJSNsO8CMt0pbbNopNRIbcge39u+rNiqnl5XTeC1bKRNGKx4vYDqZDd1b N+UO1NCncQyxrFhNo0LPbDNLLGtSEi96OFjLw3wmne4r4uD+Y+1mKK4Ez3B7ZMWqBX2OOHg7 pwKTlcM5MJPV30ObZNwii1aQCxaS2ReSxiYyppXU1BE82NEFk21WVQQW3kr8bYWSyEABFMVi XoxxIp0qIaXlpK6eYPpm3Hja0du0hnbWOtHTMUkSu7qLrDrFJGwJriJ2li59jcphms6UyUOc V4JB2Uwvbq1CLMOsUWXqu4YdCOtZ/AGpK0lsViFC8tDEYwdi8R/742Qe8hBUaXmurmHg+FF3 6QAUQ/Q5/GFhlpf/zdUQRcWAECQNzNAeHDh0wKqdVjZZj2KYSDYMzKCdzJ56uXd9DKNMPB2G aHcxdhVFi+4ivhmrzjsXxT5s4uEGMu3xG7CH+5uf5c2AT9fnytnzBKCiawQM+GX68HcD6Zix ZQy55i1kwULaC0Nnyv8pBdce9T4Mxi/V6ChKDEurqugPBG1tZPZcsm4NWf0iWfMCOd7OjMFI UzzrVYF507z4WMOtIHT4FuoN6bW8khhSJVXcit38w/kSrJ074NAFtUGbitN78v+Vmt9mU/s+ YxPmo319X+/J/X9l6MMO9Uinu7K9Pyi1nhiqAJdvzPje40fRbcCh+MhFFnbhfsZzB3+wcqgy pCba83fwV5xLdqb3lFuppfYi+n6S/4CSU7nuPen9z/SuxcoA9n6cFYNK1UiEdHgjhbvLNU06 Rm2VKsfIpvH5+HwC89/1GqcMArIMnIBr4EAszOCBgnaE/pLGXly2Yze58iayZAW5aDGZNk1s tvD3qiBRFgDGcfuwi4Im8MOOCqaTzgDBGMzf844YB7IsS9KTLBvSqVIyYRIZP4FcvISsX0se +BV5+F5SNZFuQBO1KPkKSYANb2thRwG+MxoeLVxX+TwWqDdZky5GEowb69tWWohJKo1pHGTf 8dXvLpUGXba+rq+XmJ9mlCqGpzOp2I96Bqp6jU+Xlg5l6wRWMAe6f1CZvBtOCkovCjJmXN/a l3xTb/nZfU5HBSOPCSBMVmDKIlHg5GF+DWiGuRqjbFN6T79hXztwqK1kIhor2qLKtr//4Atd a7Zlj86MNWLW8qwLZIaBry2SOnyDyb3RZPPjpaABjt1mHC6xvJAyK4jdomtwF+q/QAKafviN 46ccyRye7FMJacQuULFkWZx0TGNleknnHvLWD5L3fJD2wspKaauiHwFiPpGRS5Xb0U4XIrtO km6sZp6iq5PYZpnJkgxbXMMgFDEoGSfYnlReQbt1FRWkvoHU1nlxUBXL4yCUNjaSZcvJtBl0 PeG+u4lVRqpaSNa3gVO1IpjmtYhvk9Vi9McmEAupuaCc/JCWZm8NMT9lKLYsucEw8FFs7JmJ OrLp7n8pMb9p8Fc2wqgM0hu3Oq0E7wqFUUTAsF0jm9ljZj5TkfiDQVe8h3uMnTissE7Vo63h Ly23mg76IAgpwz4gAnEg69jHsh3Pdq1CIFOjGNJpO70jvXdV//oJZhV6xyOgctg2awKwbdcs i5l1pt3N+gdo2afXSi+Q8ZvKs0/Pe5iQVKTRKoJ2GTB9UoPNU8RI0rijYkOk6iDM3GM9EcuF F76O3H4nmTjRW39EWNEO3ofCec9u8v++TLauIYd2kwN4xwM9MmwuY38AJs4MyLI9ZQixEIKA VW2S1moy8xJy10fJ5Kl0ug1C1EBG09w76Fsmydhx5Lb3kh1bye7tpOsUjYZsb7pmTp4s1ixK iVNPP+RPHyzSL1He0eDaw9nFSiKDNDUNK5BZ5EHD/DtCxoQWwc4dy/b+e4J8i33vOZSEAgey y7Ox25OhA/8IJrpvNrszSf4j4TxnGtvUldAIjoLADdQbvPq4j3jaBVERDOxCAyJp5UNAhUnb SQpP0ADFkADYDdtAyjO5zP3dj19SMX9yyQS8jwJJbC8DdjHiy0eV9WbtNnKoxEgYtEd21h1G iWngD8T1steoMOzSDwmhtvsyOmVknnOFlt0LZJHcAYQ0IoAZHICBAYYo+A1lBQsT/N0nSaKE zFuEu5NGMTW+aMo5CguOG9eTZ18kve00ApbgYcr8gDLgx0uPEAYYMPRgfw6+o5f86QWy5BXS 0EQ7aINqQfdt7kJyrJ1s203aKunEf6izuYbAGSsKcAhGlwhk4BuOewOyqcDqqmENx9DPOtmx tbRylva+JNflON2G85JhYLEy32GbC5MlF3EK9LF6e46XxB+zzJMD2Zn4HBAxqviqKHb8Y1ts Mr4xFd9pZR6NOetjBtYoh2W/Zha2xWqQorPwKZpvik2RFM0czoCnkYV9pQ7ps/te7FnblGzE Pgy0BP6UQqesNdEwq2Tqn/rpii3vr2kPsHC5pwtK1yOw3RBruLCOPvjd++x06Q8MLfldpN2G I3VrQSyfNMbEeKyoe537Az2yngFiJ8isOaSU7gWnR54oAyw2ha1dQ3buIVXlZMI4Uo1bIroB 8HJio2xXN9m6k6xeRRYvpWPMKBUcji4egt3MOeT5l8jRk2RazB2xMusKOSGQsUnDIXikEPGk ony4gSBhPWGQK/A6RlCfaTXasZtJ7pEgSkLw8QwSvwlbWxGn0ukeI/vdlPMHK7fNsPsSNj6b UEucciNHR52Og83HmZh9xMgcj5P99H4Y6UP9Ou4QxaM/hJkgxDLM92u3yvCsRSyz7Nwz3a8s rVhUZpbGDEsEMtKcaLygfEZlV0XGzuHjubB8RDUPz26YAoOwlQvf2JM3uRDJnTza1ur7yIT2 Qa/MsOKso9To96CwWGLgew2Ka0k0cMBZCVLXQCLeYXbt5oNBdMc6TpDVL5Fp42m9p/sKGvRh gFmCT7BPIRvW0b1jY8bS0aI2ugy6p6aGkuEIDnKDxALCi4+nGLwRx+uW+PS4QPmuoX6Wk/v6 7S6p3SaE7yn6pBWfSVm/SGfebpiXBneTGQa+93dzb9ezpfEfRgnOGbeWlC7p6zti2ffFck/H jMcMi74ujjqxjKN4PIUcwzU5RCQHJUvwMOUuc1uf58gwJpdIRaHDzSsMdw/sDKFQqQtNY18Y uloJI/ZI//r5HU+9uf6axngdfb+drVHWxKouMKd9tP7Wvz/2nQaSpN/yl6OIQjWMDp3bylgg 4zMjTA/3alHbRJgkWvGsR1eEtWCk4/DTebilxoNmyC0VnNjHH8UPOP+hVNidv2cveexZusyE YSl967uAg0rGTp04eeoFsn0nnfbCIcVSbNiBoDmMrWS89sLkjgCslN26QxLEqwvuOJwdeDaX C59rw7d8nMRntU9cSHW2nTjZ8VzX8X+NZz8St/8xbvzCICyKSYpzNIG7LaItDLlAaLuYdZtl Nf7k1MMvdq8/0I8/XU3fT+JjyaSZxCew/77mlowZO+r04puGQ1b02mOMDmSoJLWeeFY7+/2B Vs9/frCXAxb68DeY8UzkQUXV4NFFpfjOiYF+sncfnbDnIzsZtjgXgPihv4YZdyxTblxHwxk1 i5seJVqFM0oIQWzatYNu5Yco+jkNJhlnfsjQxiH79xH2URq6s7XggxcfrsBgJR3dl+Omy7PQ j5Ui+qPVxEYgnEBUgrATa154SX7YR8L8n2x6DSawgpLwdmRZ+dis+ZkgikLwVnzFr6tSn46R n2IqOJzm9EJd12gOFTbQxqL8BFi5oi1gpwze8qf7MPy3iUI1tCSMwrtHCcd5uOuZ33c9iZfJ Md8vHs4OtphdVX3pLZVXjo037bLb0X3jMW5oukaGi7sRfoA34BbmEhniadYf8blvpWrV1Uhr h0asYdVs+NAyKFHwwOphHXiIIK70EzNDHLwKVJwsBJQybHm1yIa15A1vIJX+DQG4x/BDmOvp YW8UHSZ7d5NnniAtdVQLDYIFa6NBKkfGNpPN68hTtXTrBt5bpm+bl9IXNpMJb7WUi0SsfHUD 6T1JGmto+CtcEWNHWEdXB5+g5vEGoaJIASHl8iSgdWFZdoiHJyZurklnHszl5uNDrWHCTHwF u7/jmlTsjxrWNAaSifCunEZ5erK0fzOcAy7BuBILBvgYFCb0vA8UDUeoxwvxGLliaXL7wN5+ Oz0lOf6yykswWcYpELbq4jVXVFyM71KZPebe9KF6sxSRwqsnTxJN8TAXjfdTDznHPQpv9DND 8GgPGMRJAuAhq/QYIRm/0907RYVgGw/a9VCWjjB2q8SuMYNsWkfajxN8+wUTUgg6gCN8IJog ip04QY4cIIeOkG1byP69ZMNq0tpAo1hRC9aQieY0tons20GessmRw6RtBhnTROqxba2C8Okw xFMsm/KpupMdNJD1nyKtdYUOYL2KoGtycAjcwqtEwQwlGWwr/f2hs1BFC09aD6YHrjbNZcGZ MshC37DfuM/MXZuwXixa9Glk6OkZtjfwwMFmQdy0Q2nEgxcVj9y4ETtpn9qbPfzMyZdnl89o tNw3IhCSEJuw0ewyux9/9/I76f05B+tmdO5fbO/25MNM3hhYOKNtevQODA1sdFER3KEG1pz2 I7xH5pnhln5YTuDMvIBoRO3E6cJGcJ73NBWQQsDCi8f4rs7TT5MnnyDXvJ56rbebdHTQ17l3 72afqdhE1j9CduboChtWKhumDSGyuKZg9GolyeZXyJ8eIAcImUzIzEtJ43gyaQppm0o39+MF KfQKsdHs6afIk0/TN3nHji12yRK6Mo5xyjFPONiFQ13F+ubUBJrRD06gQ/PkwXCqe2QeVzFj dS73g0xmhmU1BTViNqe6uqaj/aeGcSO6b0GCswRy6iSWG4s5/NVAb1K4Ey243TH6cg7mUkf6 gIoMtpWZlb1O+t7ep5uO1d3aeGM56wgjTuCHoe0FZTPxl+JK///2vgNAjuJMt8PEDdqgXa2k 1SblnEESIHIyIJKMnw9HfJgzxr7H3Tvb57ON35155wsO+JxxIJhgI5MxOQtQBCGUc9ZKm/Pk 7vdVV3d1dXX3zGxSwPTOzlT9uf6q/ruqurpaCv2o89EqKVqEdZnOrRYR3dCQEnoS69HCpEOH l2YO50padML6MlK3Eci8rxROPzKnUTCbsWFwLsECo0lroZhEEAxNE7ck5/5Fte+TJJy0eB8g qGEKszI3MygwzY8l+JMmSL+5S3r1ebK6oq1VWrVRymjSSI1smlg0WqqaLY3GIlNjiEa+B3dg sX7pWGkCdmtJk5VimAt77XGpCc1DkRrGSZMbyMMAe7dL48YQCLbi6M9Bi4+xdocub5GkRUZ9 sOrpj6RstC2tQ3ayhZU/6cpZmnYT3tDmqbKsvKGz455C/TMBebMnwUkHdnUMus3jRG3FoFKT ceqSM3DIa4ycFHhKHBtOTVZH/qjj8QKlcHHxnEnR8ehbQZkRLfDCk8Ibq64dESj+eecTe9Jt DXIpmf43Ol7o07VpvQk50xCoiuvJ1nQ31nyXqcV4koyGwiGvBQRNrSetNWJTEGMxUT8miofG FrFHNoR14ikKbQC+jJNpsoEeaDq49YzL0p7dRhjUpYm1RBaW6aOLTbYJI83Aal6eVuSv2mg2 aFekAaCGsHtKUIoUSmVG+MXGG8eOms2YbIrtMTWQj6a0MWmIbZ0QLA25JhNLm2VgeadQE2v+ 2FcGBmg8hsW2Q3XEtcS98fi0aNHZftvGlpTO7e78dVS/xXgHJbPC2wANu7HBZIxKpYFvNOQt 2gd69FCU2sTcKWR9+DiwiiaYkTFjGyMrOYbpgFX4KDo2vBpxX9cLh9ItH0v1zRsxE2ZTg9Ei sc3/eSWLNUXZGt/9Ws/alJbCWydiZGtj6YzwpCUj5jeEaxNaojF5bGXX+rWpXXg0PUrmmFX0 zobYbAwtExkJr2jFDKozuFNrbXVGXnC+VSZQMYzN4Z8issCA+J7n1cktXTTPX5kDYwiS0Qfp X9fFIcMwHoEDj0yiE4SnXjCExEFmwYzrDZnXH6B5oh7kiVRDMnEXfYMJdmc0yoEblEm8CiAt FUT6NwfnVIO5BUyQ4TDmMpw4ksu3LH50Rxsx7hiyQ5VWKZn/7On+9YiSaj+hxSVndbb/rkC6 OajgYuN3zQqntfqe9G80TS6MrAnq31fkVj+BQwg/fMC+WQGPiS3bz4mM0iLAsggpPtThwKOc WCscPpBp25HYPypQWl9QUxow99qltOXB0jnRSVEleDB57GjqWACRRFHDasGcginzozNGhypT eqpKLetK9xyJdWXSMSzmyOhprLw1rswe+gYIgjiEdaxIgENFn/ZbJBNgOTu3hDwDWW5BeVKg 5mFli660kLcuYOf8gR4ILljcT0MM9jUcwsjlaxHqinv2CJcdWI+noPFeDEzeDeigxcfEwnGN rKPFhRTfQ37s407dIREeDfxF0b6ZyfxOxd68PkdJ2aK21mdKoncrmV9jW1cxHMvFmvqFrtgd 5SPpNPY5rS1XloXOU7A1X96B20dzDvCRg+YmtKAbYPOj0xVYatCCV+vmf67lMMwTDVW4mVUr l+9JHtiePlipll5SthRv7UXjMy7aZO5/YrShJjx2cqju2fbXOjM9deHqqdEJc4tn0hf9Qmxl cOSEgoapHQ2Pd72yL3W0NdNdIWEfWiIb1g9NAZKa1mychrBoaCR6+sMXqNaMqeWRqFrjQ8Y4 3AdJ4eCQPKFJRbBwMf0InBBdLuG9Ovp8vA5OwPUri/kvVMSJCGE+ZpFWAANou/ahyQqGm8C8 SVNXZ9RmSXZcal0tjFQJdxitBa3ZCfXiisXV668+PohlsZxWKxlQjklyhRyYbwE8fqMFpUrw /FRmoqStVWS6CNawVi5Jy7d2Jb5RXm4/8xSNlnf03hBWHpbJmwKH8bj35w2pJLnNh4P3HXUl IPTjtsAmRioh6wgmJYp25ghy8bFxbr6hgeD5iYiuPtL7VpVUODY0qkCN4uQyikAiGrY1HBks XzRiPkaac4qmV4fHAILOF0jIGYI7m3KgPlpzRuHsBdHpcib9SnJTgR4CDfYOxVk0KPON4uvd meTL7XpHEm9II3ZxsQw5Q74dDTzUWSAjYuT0GCcdi2F0dC9lMZD5yLD0+KBd4Gz0xj0NGfWw SM2g1DAqG7VL9IcGQAvep8vrMoFVmQAWxPp2b2iZPdzkARL9Y5DMndVdX0vHryJ+oPk+Sdub yoxXgxOzSlCUwKTu2McC8lZF3k8pM9KC3sxdJSWVuNHJeJGOREs7epeFlceMXYMGdY1jYoUE JsieeJiMiKliW70BcQN5dp4YD9nJ2FEPvZqlxWTbfhzD344xNVcihZ+Nb9AyiRFKARaUYYSI aIUVszj/EbBoaEOCmk3hJDQYDznhmhtRwyNDZbMLp05Wxx1JN/ZosbieiMiYXTZZ+PLmlQYf HnXHhmptieSzrXoCIwtqhZvb4T8RbSPtlEjjkzcDWe2YWrDm4s6FF3X40gOBakfvA+U9T8ng 7ZZg9aUWxX7Y8ih4m668pilvaOoIY46UltC7WXm4yQMk+sggKStLnbUoxwYVImOuvCy1ytrG tFarBidnoZVlNRQemZEv1XDrV39Wkxf16Q8UFVe77xXgfAtH0C+7NKQ8o8gDf1tKFmPWvj1y zUqyQJo6jn2zBOOlECOLJPkYJ6iZJmtiMS/SLmkXj9BHGBteo844HiZnaBOIXFiZgQCEe5pY ujUyWBrAs3fWQUMIiVymtRaCmEZgMBBLH6NKpFCNRhTsNKv2abE+LREgU2YDPPBOFLJa5FAi uaKDbOGCrPfhB3dSc9c2J4LmPMxEIMPH2oRC1CLkxc6ne0RjaRUZLbj5C0Mw83wU37p8TJNr VXJD2GglAuGHP0suoTKZ396vK/uwT4uxLNajoow77sQdAs6eixB8Tl3HqAl2/XvOpyAoyWC/ MTOwScp8LZPoVsOfzCIMMSsUHqtpn5ek8xW5uFD3iGKUHZQlpTO6Oh4eEbhRVQ5lkTkw1CZ/ P3g6EVo84HBtyFj+d0hTmpJ4R69OhqrM4QMzLTcXFKDOxyjFB1KNiZ54S6pJUZWpkfFFaiHd vCy7CGYiQhrm1C5XikaqpX2Z2BvpzePIRmIDnaNBjwyrco8n9H0ZGS95hJr+z7UwJ/fXiYQR PMbugtmLP8RYaijiP9YA7yMvo6NXjyHWclqIIxdJSWrUAp06Xg/CqnJYbMd8f1t7jpHrgBTr ir5NSf2/ZOyFnOzk2SZlOk4id1+M58VjA8Uli7vSD6a1bB09niXPNM7UDWtLeeL+njYcL+oL A7aMfDBOXq08CEGczNxJhIiUnh6nlPRmel/ue++nx+5b3725K423lJMHy8mkWNaD9MqMVod9 HEuCIxrC48aGx23ROozHfAfaAjHHFtPSR5Pkxn2O/lRW4waHVOuMoSWEkJrhP7TEpnQHhlSh QZldtVC5LIsEVq/h8SJ0xi4MpIyeMeT91R24BmJe7MlUYIdGdvtHR1Vshj5eYZ7kXUaAHL3R ZTZqyQJOaOibPHFY5tFlqUnWNmX0qrQ2wfPpJd7OfNKIdMFQdXdfQyiwScE8xBAdu7cXPfnH assfZmt3y6YEPBmhcV5pgCWTIkEyP5SZV0SW4/gOqdwaBgvBhj9hJVgsRzoyvc/1rdHS8VQm XhWqDBmrlGlYdZy+LoWYPoOQLX271ndvzGjdBWR61rNZuTgFAGYyk7p2NJF8uYVsW4s5b9/D G0U8ybP0MxSClw4tVcyR8XLstEO8DR58Cg7DpoiYeV4rKdcpeonRGwFw2BQO3uQhloDCko8s 788EfpAOHtSVSncUg87+esST3gLGYuoVlw5ZUBA8IkvHZe1dSfugO3ZBBNtMDvpALFMDDYrc rejrjCcbBy1RkhDFtm/GGMo8aELIAucDZ4SEnWRwDmO+f11aP6dAL1Wxfz+2xOh3lRFhAzkQ rdCEQrJaoAfXJHetjm09HjtSoZaXBkfgXiSNYuQ15obVQlBD902R5X19B5/vfefV2HqyFAOd igFYAfFBJXM8nt7Wl3ysE28eIep8BTkc6KttoIHMvDcEJfyHqCGnGvfx0sxYXEjG6cIYAKNM eMBQ3q1h8hIg5/XOm+lDBUV3DBewfZrcht0pjBsgxA3OI4cTGbGzGigXQ7LE+vdKm5oxtTNc hyztDuj3hrS/7enaRCc+B6kpFAqpwZnYqXuQcig7Rl1vv2qv9rBl5utlm8NMwe24j4hH7Q4n 5Hb/DfJcfEMHIE0GJoR0OZ1JbErsebDzuZWda3f17e1IdZIZWKcmNgBGvMG7fjf0bTmSaCQP ZPYzdjikYkF/UxI9MgkKcRePWHTiDr6AOW5yO8+RITMRYqEYN3u26gpW+Z+4C9mQlWDwgmRs nYBBZZps+WjWiHhOsbyQcCqnSCfMzuFSSz9Yufncy+R5oGE9ooFHg5n/oyUe7usb7NZj2Npf S++UhmgXxnfXljXhvby0QffLBZ7+ZcCgLuMtbi0pMlN2wg9MT2GEiJ18SpTQsXTL491vvNC5 cnXP+zvjBzozXQkd70A3pytIKyCXF+Mja02p1nV9G48nm/Aia4SfgZue1jNH4vgYr1Uwm/Hw ucFdewziP7QUzBlSI7EQHlGsUpY26fK5agZvWcAMEbw5pEqEApwqWVpMtK+DmvLDZBhreFB8 cXYsu7GCm4SsHy+msprDH7+2cTAXYD/ZPDyg7JW1t9Opo6lMuSRXDXjWLB5vUdJ3KRKeph+C 4/c/azhysACuYt6iCSELTT5wRkiMIRlUJD7lirI/rY8ISrVh8uJx+uQKITlxh7EuXCqQQxVy 0ab0vndim17tXdMaa45hixlYCDNlsmEGEoh6MS1+IHH4d8f/tDqxFf2yQjkCYL9tNcTigb1M cyr5WKu2My5VYIxhOMRXlsOB/lT5kVn8oKbryOxFKBaK/DJhhsEGhKUMOmeOYyClMf4NMvrl 2eHCY9/oiq7X5bWZQERKT8Xk41/TgUdN16aDayR5koz3rhvXs1zFp0MF0fPgYiBWbQ5RFlqX 9h+Ivv7WyAuXDvsjjZgyKwj8LJl+T5eWJzPnatJMjBOz36x0mIwyaYcC2q8U6V0BPrDs0cOR 1W9jCsc815ifWMJDrO02E0mJRRa8W3trWtnap01R9TH0bPYQdgJARjzSxiil6HZhOcRzsdX3 970xUa2YGBw7LjBqfKhmhFLUmm5rzLS8E/+gKd2OVwLjPB/U0+PYJXdzV2ZDQmtKy9MDZJvJ k3fk3SPLbqJYvQK1NxrlRjPo0TELojUo2l/DKn8UGb7A5h+NunJ3EhunytiKAV2kvJqAtxc5 V+ckkKTDRyPXLzvO8QxjEgvBVOlFPbM5Ho/JckrT8XLZQD7hTNcO6/E7A9pdMnlD3hAcf7i7 bue2YuYemsgza6k3O7KMy4Sj5jDxiNfTdkmZ+QVklT+tS5HOEnMifsklLyzhVZjkmYMOrXt/ uvHt5PanYxu2JvccSB3FjVbs4oKlb3m1OrfBYCPr5mS9LZlY0aR3pSQ8ho+FCDnE5eeRfo4X IJT2yIYqkHkXwuiLuQtgEuMHI8oWSa5W9MmKVkLm61AHbnq3L09jCGqqU5IPaOoD6SAaAGkS eR45Kf0JWPW0tIVmTuupGee3I0WepvSDTJEPh9UXVP2FRCKhZeLBQE86E0xnyFAA08zCTHMq lVCk96TE95XMPf3QkZX0eGPkru9Pxh4bzD00wbKMm4e7sD6BDMxBTJ6T1czamYVaqVEuAF38 TMsJSEA59piNGHvbYPYupiWatR58FDwPIGlYbIFHLzEgHbglcAbeeH4onn6qnUzDhaAwZ4Fz Ehjm2LWUl3UQag0theLkpy67EipDEMxYeDg2ItihK6szgWl4vbeCRgxW4IfCCKbvFEqQomED jT2ZwGvJwDZdXoAhlNcEGe8imG9mBajLSeacrQvucIAu3X1vzZIz2/vZYBwyBpCRpcbCwPcI Y6wklb6lLzE9EKwuLq6QVUwSluJFL9jIVtMyfZ3rSsJfGar1FtTOh35fk05ldwohFLxLefFt XVlZJRBRtjiAQ1jrpinNSWVVtzY2jOezGe/JSsAo7MuBIsH4CN4dp0Qr5BE4uRC8yP0BdMnI ZN7AD5RQxwsFVnVpW9NSvUJmebH05AQcVIntYJoinUHvObITYBJVgamiabK+T1fuT6sLZXUc noE1ELapJ8yU4VeEoqFcxzLqK2n1T5nAfPJoh+/5M3zmbN5W/PRzVVdfcYIGmGJB9M6o+t/0 FaDmTmXKRXjAQdK2okdegi56Pw64M8f5s2t70cvPV1GR1P/9EJ8nKe5XlpIHpwP3dugLizL1 ERLaULWnQCOmtylJpymHn/IsKvE33iiudabT++Lpp9ulqUbfY5j3MsrHOGOwK1xhUGb3xxDG wFS0ncWIkPtYrykzhs02kSnVMguL8PBQhYx3Nvdo8uaM+ud0EHENtX8KNADLxiH9pafdM6nA mnSgBXuPuIRzriI4ISuQGzfSve6cUzaLnXoUV2b6oUJ+enddZ1fOaxgMdNsoWDHgLNbcYAKH HLL2CqIYTffnG0ugcpiH4PKrn4znFxfAN+zg0waQNj3r23RYHo0RgmCILCvH0uqzbfLx5CkS xVhJhzKBcxqPiO/sS73Wpndr5syIy5WD1EgWZDk/QuwQ5KOS1LrRtQLUO5tHhboZaaMw4aIE M497v3S/1Xc1dZasV8g6RtzwjEjuln76QFBGlAi7Q21IB7+XCh3T5VHGiMWjAWQttgc9nODJ 4gm0PIb3KvX0BJaelX0/DGjzVmiJGdSvUcmDkUCunNn5n35szHNPjqGewLeQAC+DGHLM0bYT aHuXwimTleb0A1QkKx8kpbEB7GSolwY/hOEMwSWkpLf2pJ7rSj/X7d+IObfYSQ+f2UiWymfK w5ZEqMkcGSIqk8AnaBPO0Ux4Bp80leNCQrttC05y3PbBB28kWaepmPvv94shXQpOQQCKiTtw 72XUJh1uJ/d58H0yDtP5T/xl9PoNw7Elxskok5fOxiORe39d74UZIMynMRvS6KkSleVuTdke lw8npSTZ1DBXpB2gJSeBjRYelw7csNkR0w7H9d4MebKSFvwkGCSqVGuHrkeWZ6EEMlrdGOfg 9vhbmjJd0cfKWN1HBgR2tBPNPp3yCFgoCG4T7syo30uGETzwqCmAgh/MInmXGVBvhO0IC8/E mjwW3KY0UvDvug0lyy5vCodPUkQVDBrSbCYj3/G1GceOkqc+mQNoQsgaaskwklEyAgqxsvgl HzNrednKG2LwVSLLO5Jkjqw6qI8MkU4ZlWLhT+Nf+EiRMwdiid82ae0pucJ4pWw/ymM50pvF dK83UoDakuwe2VAGMkFd/lnaKhDLesh6dzUq6eMVDeNNGgLyl3MKUqII6PT26vI2Tf2vWOSI rCCKAeIbPOxK4kvjDeUp7PPVgpo8/qy9vYHd+wovv6hZPBstCafv729+3vDW61ieSg7eAUiz LJcgSYZicIPbpvfO8tRox0FZwp6/LSn5UFybVygVGPOAgPNkVNBp9A37VXI3Q29O9P3yqH4w QaY3EazNO3N5liS7C7JjnSpsWi6QYY4McBtlsFCIACQYD5BTh1eOxikvDIFRLL5xbuP5YCxK aNcVvNhhrpqBuyh2QGr9FJ44OIynMeupVPjpdPBRPVBPikmfLaU+FowxZuSJlwUsdYAJpz6x aGTMFfH1YhJZrqMoi0VQJx06jOGQtGDuCXoVm6h+ePKvvVyJQAbZcAX7ZgnmCooFEVnLRv5M eoPJkWa8fIKS2d9UHFY1FClSm6bsTkuhtD4dr9CVzUZg6rM5To8U/IXzEM8NHEvEn27RX+jR y1Wy/JXsrdGvw6/8guPzkGlLMgMZ3juQ92Q/lW+LyKavnyW0RUE8ePEuetzUmyDroxUNgYAC 89Nsizq5KeoBavMHmeCDqcBGbJ0iycVWX8ynOC6wCXDBSfEsoPXrXeTsWEzbbSypqY5PmjDY Z7y9tZ9w6Patxd/71rQMFn5aB6sLBqIJLkuSLqDJ7we3xFu/TBxd4ozw1ZKRGsJaSYB0XnDA DkZjMZ3qv6bNcmZfLLOpN/VMp6xpenhgxfErvB/c3zc2h7NH5uagde+G56wJX0YPWSaIZ8H1 DG8SwsL3g+TNpPK0AFYhk0cycdjGm3ynwQ/6mJjafzAZej4TaNWVBlnHjhcoiH9ZPDCGfyy4 9WsU3spYv94e8cYCSj+E6a3V5bNndFePPXHL/b1NHTT0wP6Cb/7jzL4ec2UJK7qjtJb/OSxJ 0iwHNK0R4MxGRinSodYxCx6W5T3Y2UTTq/DCQEWKYkbJ0sFEnBYJjCDb0qmX29NrerX349I4 4xksr7LwJ7JXyUSHWTR+cAvv/rU5uECW52S/YKWQNXXZCghAoBGyNgFDGN17nOrotuDzuK6O 0uQ6RSs0Yhmah1O8qfMU/EGBqKntuvxIIvzDdAj7JmIVAOKEqwgAeIw0LZcQrIPJ5HcCKY2J Et1u+8cisCFWCo/vvPJmxfw5XaOrsJLvdD2OHI58/fZZbW32nmusxCyBsiHNZ43SmgAexWhY gvqFZVnC9BfLI4HGimO0orwew7NAZOFzHfbLOa0mfWkTRN8rpSdeak3d267tTEozAxLeXYmi scK6TnOj5J5fjAcJloY0O+3J5gG0OfofyDzEOUFC8ZzI/HKWfeiXYfzdIEkrNFXBfJmmTDDm y2jzsKjyk3nCqWAkah9FaNSUBxKRf8mEZkg6zi08gzMER5bCZ0FRxVkJ0mn55dcrZs3oHjvm tIxlhw5E/+n22a3GzpF8QWna85uRGRdQcj7Rj+AtRpYd7jgfKQ8aAV4vuT4hb03oxZI+sYBM LeHAqSIIpaJPnW9YSHaZlfG2ysSzLekft+BNtDIuxehlDPzwK7Mf3F+TzeEfyEg84o7sWUYo zDebcIuZYLmDgsk3TQFrfByTh3h4S5ZGkwUZgTU6CWeTlAxdN8uYOJEnPwmr6AczJJ26jNn9 R1KhuzPY4ZQUC9GNmp3d0Ow0BMt5UiS2UZZDBWUGAcNZCTQF85NOKy+/Xjm+oW+o34Ap2DH0 2R3bi77+j7PaWsmzyzjoN0vQkvJZQmQdBjE5HwQuC2/+MizNmwyUjWcW2FDxJQoWRqqvYgoy JY0J6hGV7JBxajzAJBhrZo1Vr1JvOnMoFl/RnP5Fu1QnGzt8uMk9Si42S2vA4YIzaYJrCdyf 2OCyOUg90AWxeS+/YHpdCWgVQpVIYisWMSTvj8XsGMIZLmzN5IEeuUrW0D2n7wLyZ/JScUJg uIBhG/4uTX4uFXoyrW7WFDRXbBEP+wd8iDWapdg2yk459BpgH5xJiOVXr7xeUVigoWvm4D2F M2+vHPmdf56OBxVgIy0dK2PeWUcgY2Xl2ZlMihWyjMUjQad405KMuX9MlIGzGLHMmC/3oD6p INiGD16o0p1Or+/OvNeTXtWnJzUZKzwBR1vEd7+PnDw5CVwqbY4hDWREjy3apXUQWIQAvLYW V7XNkoJ3ptUpOjplmDLDyzhx2TCWFWdX7GXM0MNMYzKS3KtL29OB+1LhlZraSjZN9JwXy2GB R/BCKeknC6vtCTvlIDfAPjibEMF49bqyo40R7JARwHOwp/CBlU33/b72f340EX1JaiYtHSuj kAUNIF5YAhPgTCCFMyyD00TubzRfxLJiWd6UkmLom8lyGR5gMrY3p94VROeWODwUMIZ+8Nrw XbH0Sx3p9/r0fUm5QbUHFAMx1cHj1Z4cBHmVzebII5B5qRS1UBo3pQmBPvqx+OjgkaMnaC5L 6LgswWJUjmaAyfLtkvyHTKBZU6t1uVrFq2EpI2jsJmjpOUG/zFRcsNBcyeY8qfBXE+EmWIip XuNNUcQ+/hDzPM4nne9zIMRd5OOlwsJxKrzIGHr3nsKVq8rnzekqKx3UvAgTOOSJ1pbQHd+e 9sKzZGcLoShcvRC1DEsTBIsUg5KkkRGBFq8TTqCugxNm4kwbKC8yuCaPU+WjaeW9uLyxD08p 6mPCpF+GMxFNB4dbhClp+H8MW7GnBfyAN1SmVrcn/vOYfiCOWxTyGBUvoDXL4hp4MXhWE3MW jBDkJ8rSY4v0CWT9E2eJ9f219fmRZKcwsbAKzaDcXC6rPJcJdGUCY9RMqfF6ZRBRs7PL8rNg YHCmkThSlg9nlN8noj9NhX6XJkte8RASGidm9z1M8gDlMqG/LHnSZyUDsq099NRzVZGINmNa DynmqXS8+krlt745fd/eQmqX2zoGQYJP00JQCIOTKnSRCTQcMZGRPWu7iqdDg8AbwQsx+5DR n+hVe+J6ZQjPYJPV/+hQ0nDmFm3LGuoUa8QBWVaVTGMitbYz9XhL+r9apVEwFZM4xuw+XwQ+ na85OXlyErg02Ryk4vA6STy9LJ8zdykIaaGMb5oUmQUon2VplmDMAoRm2Q1XYTMuBqfsjBcJ mEs/qG68orxPlkbJmX8MpmcqWg22liX9IbsIlJLZMFQJZg8EQgWOuC4368qGjHJfKrhVU1Vd wqN99C0qBr4fX/wkI6+IiKDKrAIyoSKZheBFGTAfQkOsJdtidv5S7PSpPf/8f3ZNmTQ0u047 NfQ719gY+Z+fjF/1TjmxzWoxrBRmwg03fMDmpSgZGwugJ8IkCDIBt1GcsYzXhHkScfRmklqA do9uLiYha0P6wqi+qECfXkheXwKhsBPP/eA7T4FuFflAqHwMckGMHRq6UqntvamnOvTGpNaF cIt2TB52AJU5hPIxBgTGYf6yUGxBHWyUyGIhwq2DJK0aM2Ec1gFxtW2CDWTkYFpWa6rqSC7f 8Quh5Q+3Sh7rk3aUkKPxhhOooQYJzOjCX42IIJJcpuM+kJyR5aiM+9p4TwzaIxxCqsdbEKdp EEmYQga8eI7qoK5uyqhvpwK4tdquETPKDPMIRX8V5MmQD1k+NDDPIMtOS7HNLaEn/zLm2PHw tCk9hQXoHJ+cA0+G/uH+mn+/cwpWvTKzaULIWoWza4ERUJSLiwAYjYBlpWUEPLGJ5XGMwZ1A y8AHLRWdnWZN6saDP5iR0vDGcgmth75XF6LylOaWnyfEkI/3qup9Gb0lqe2Kp9b1aO/3Su1p vGNYLsdsvxnCTHm57EGZvI5cbA6e/Ii9qBRNVrGP+dlzSI8Mh2WNEBwpkmFNSovYxNIfN1CA 0CxTYFx6bAkMTnUwXpYAHGk0AyzLwvm0U5dLJL1B0Zer6bMDKXTN0B0OyTq9rUmvayi4V9lt pdlTUEeNpEIwnQ+9fZqMN7mtTQfWa+pqTdmjKTNlHR0xXMvYRam/Stmlhi+sYJuJskT7UTJR FrsPoSHHEmbROn8FbCSsXbus8TOfPFJRgT3qT9yBO5JPPD7mkT9Vd/ObQRrFohYyO82E1ZJs OEcMuwEnH8sxdI7Ml9eroOSKycMdGR7hkYZaUkdkTZlGwlmnpk8M6ZeP0GcUShVBaWxIwhIN KGCNCTKYfDCztIdsDsRTWiUlJw8EaLIWy+CtutqheGZzb3p1r7Q1pU/BvVRDNLfdK+VztShT iyXVnESzsgzrMNQUZSL5eEIwgjsFUQYB4fS0JJAmPTIEsnMICZFlHYYBdtYA81k+TXkEiGfW ANKymXj6w8rg4OIyXNK0EFIAxJZeOJ+wYcYOXa6X9Y+rmRmKdkYgPR4rzjBuBolVbiqBfju8 a5WY/VIaZEFmUlrtPabJhzQVy1zRBftjJrBdl3ELokbW8doBLCEFIz7ZhTMtHgmLkxnA0ziA efedrdKbkrLzcYMrW7NllA1BKhjUL72oafk1jdOnwffDexw8GH3qyTF/+UtVrI+sYnDYYziF QhicJahZtOoAZAkTbvwwYuOxe1M4B6S0DqUMCxyfNkk5oKPKnGiGwusmyRADKw9jmrQ9o2NH xtqAdHmxPqdIGheRilTSR8MHkYXuM4HQBmZPxUwFTVAdZJBCP5gFI3Kwmxj2EcNuYukNXemX e/S9aalX06coclTBvq8sdDILTWFOjQzLEpZOB4Ce1w6QYb5FTH/xTUhYEHBhTTIqR2jSBqtE Ahm6GKdvIDOuLqQsaOPoDR03RnyYL7tY1s8JpCcqmTLy2LkelcmL5uxDcK2NMFIcJWo2piut mowdHw9mlDczwdc0GXckMbFYZ7yUk7KCw/Ryfm1MUGhmLb2e1jmA2QMSJ12o9ex8+QcyaKCi Jk7oveLS5gvPb6ka6geburoCb7xZ8eKLlZs+KMEaC0Oj/U1SOAynULdZzhPPcTt+GSeKm8xk NzwlirKczrioWpZlCQoXsBY3jzTbB0PRzj4xmjRl4w0OZL8EPAiiSOeEpQUF+qigNDosVQXl wgDpwSHk0eEn+kCQQgXRb2aNcSPUrCJErjQJXlI8ozUltSOxzNaYvj+lr05qWB1Wh72YDUKj R2rfm7QEM9OFhsTZz0hIwiyOBTuRgSyAQHaW0SNjxhEzmFNcRaJGMmKWEOCuLJHIiFmBPYtK eW1qi5GyM9OYNHrVQdYc2RkUaPwRXR8h42KjT5T1yaqGt0MUyXpE0ookshgNI0FcCzGzBnW4 y4wBI14x2afrveTNXnIMO0rp8r6MekCTd+vSYR0QBRMztNMNDWCnljAzqNnMPLMUOX9cDLxA Pm1Lyh6QbDorRc9mKyf8ivqtvB8T4p1BQkwzw4QsTZrYu2B+x7y5XfPmdhYMdBItmVS2bCl+ 773SDRtKtm4pxtJcaqplEcnxadpCKMQBtwxj9AzLCiVwCT0yk97yPmPn7QFQgFNsjm+DB4It 2SY5umZkihdQNFy63CUo6wlMVGGLUUWfGlTqQ9g+WyoPSCMDUlCVIoqMpRt4kIHsEWQZgrm2 JMIW+Uh4iWg8I3WktKNJ7VhKb0pJW9J4ybhejPcc6BjIkM4gTgPj5MGlAiKoSaJhfJktGlZG FwsBZO9bMfksQaVm5zLEErVCSKVGo0fGBTLLG4ScOzh9JpSH8Gmg/bIuK01Cv0DGXxyYLZSH mSnoApx00o2WgI3oMfWO2IRBX42qj9X1CSrubEpFkhaVdWyngbePFRrPP2JCDfJTOp4hkfok 9LzIpngIZPhGL+ywpmBz/cMarpE45GpZx84c0IIDjY0ZwEwiRAa2H18GAxMlMOaG56OPnb6C dCMrCrDyjMkCEGqSZghn0hAmBVR98qTeSRN7xk/oqx4bGzM6UVGZLCqEd8Wjr0/F0924gXD0 aGTv3sI9ewq2bytO4HWALh+KBjBJhncolqchEizHCVh/OCFkQvy4qGZGxrNQFPvmaYgtXN4y jdGSBAlklAyU2MIQ6ZiuN5HARLK1qoxRJ9bQlqhSaQjXYbkgQHY9QyQitwggHxc3nVzJYxm9 V8daMPKJaySQtaV08slIe/CeHwk3+8n2xBEjdOMMYX0KYgU5BPPMrGW/J5YDkqTrZDfk+km2 dObLZVnCC7UC2dxzDPUmSvjhrOR5PdIACcQs67LSxPCBzDN48cZQHlYQJpynQRoE+OD13SAw whO5xYm5HGOAYtiIRzhxx9MIc2HDZEQlOte218AbAslIa5REQl6R0f/CGYaJMAiBWGaDQenI CihKkO3bYPArS254PvrY6etlhyjAyjMmC0CYSZohnEkqmyemEHwjuqGbhg21QyEtlZITcRWv PkGCEZgJq7QCgs9yyk0miuVpgGBkAtYfTgiZED8uqpKReWYpUPy2eKwi2ngKIf0j7iARB6EJ dzbR7PB2SoSzLtwT0KVucpaQs6ZYIe8CRUjClRlPX4AeDR7tGN2xDizs0PUeUBoyq2Tsvm2G PDwghVMCNyvZy+Esw5hyhx3sjLbIPLEckCRdJ7spmyMjEC7bHy7LEl4oll+QHtkSI5CZCO6H aWIJDmnawRlNreFJkHbWj+FtQBkXLznPQCYoIFleihONUuODKxamAsh1ywhtqG5cikiFkgRx DFBoMOhqhYyZL5oFFpQ0clENhJQ7smcpIU/jb6ZBy5P6lMlDgpOLs84radSGXSVOXj7Hp90F AUQgoFkByCywNTKQkfCjp1SeWLcogYxm/cgErJkl+kiScXFwC0d+zYOR0TwltpCuXydarEED awCNL2vSgJKZwyjQII+H8rAowmjEZNKQTP8brRMhCQc9BzB9hlBFGzqI0aAJJb4JHjKoWJhI ElkNY5SUzM4a5WNZlqDFNs2gGaLFoYMRs4TFZTFwv4yGJUxih0izSKoRyOhQiZNxSiaF8uRp I+VCzEJtMg8AiDRfbIYCJT44GCRPRR+RfYg9QBvMcBSQb9V82q1Lp/GItk5qENqo8Qi6Ee+s BotfBC8ciHSUGCe7IdoMi27RHxaI+7FgyynOEvo42gS7sA4hHJbAuaxTh5HLjrUZ8qOjVIwW PS+WdpjoVE1pKAEjy8IIboalFjIu2+DsKYN/eFubKd2y1Pi17bRTxFCh3yGEdpvWEkYLZ8Oz F9YLOzBeql/gZUZZcPOXdRnoHQsuSwxizqdlZ0KYsVSKH5yRZUkwFQINZDrEGppMCP2hFFZ5 TGpkGYRKdKH4oG8AACiqSURBVEgRlHhk/cj94LmUUGssbtOPgokeZhCQRZVzZEaILQ0kbRwA 8F0TC+xBaaMYpwji8i5FBOcJpExZrPfnsorO6fVLMlIqjbVggd68I0egnmodYhgFgwrS/KS4 yXJCmC6REogs6p3UeRJ6knkCmfjBYJmQIUlQR2W3hzmTkrEsDOAhvBDqZlM4j/BpKHmWhakW AhyDEznGPL67lu1TxrDHwWKod0OyWJUPsR+NH5ypy0nAKAeT8A5kg5GYJ69dE3kyDDUZ719n 4xxqTR8ueSfUV3wlnSg3QifKSDW7C0uxvC1uCI/1S1P5ftjs8Oy8biwgbmB2Facdlt7z8DBb KLmQpQwuoGNEwrDuBNj5FZg0qDEyb+HCZcvD5NwgqoL2vIw2agIE1XRhEb2XBBRtzdZULBqF AbDKasl0aBcFui+pJrlJ6PyxVDpEDjDDnYpECZc1BZoQwwKGZQlKZJXVg52XKXCZvKaeAf0I Ek038aIohYAw2WjXGxkLTeBkrQIFOFuUTUZr2pisBqMpi9NpSSMgiuUhHCGXdEoR6K15cRPM sDTBslQcrOYhjNcEWoo4GgLimYDisJyRDG4IcdMIECHLzLMkWqYYeU9ii9LXHkaQJQHJcMJH PTLiIofLs/jsI9QJ9kD25j+kxkBVlmaQE0ttySLB01h3+dwQnhHY7ASUWKARsrzAD03aN5Dl WfjsZH5YHzhpBq4JrP62DY+qYepEWc5rMmvIlJ72y9i8twmEeCqF8RrdFV8Vpjm58B5W2yBT oQ3gUkwwYAadWEaONmfSj9cPTgV6YHmrDCIPmpzWDJSAKfdU6sYyiFAcwHkJApmbGBCePov5 pignNYCeKvIEepLBBmuRGlNGCL2JGUkW0/14XSzeKiyy7FiLqh+/7ruW2Zg59TTpKDqHdQjx g1Oi7FjB5Sx6EN4cnITEYR8BkIPxCVgKF4CMnsH9yAzZ3l9Mozf6hECtWxm2LaxE0M+nmTkC UMgyMiGRJ5nAlXfWQ7w1vEIp7NIZAgkxA3Gc3nBGCS469QEIPjw1J4RoMFksqDjza8EJqevg 1ZG0k5jHAilkmTA/OCOgiTzJBK5+8VoqnMXwlMgDDXI2d2EJ4Sm4tA8aYN8eGcd9CiVxNrLJ NRLU0H8T284ArYVcqzNoqRgiyQM06DRhE5qtkD0tCoHTIH+zBWLhzBKyvFjG6KQhjY1AnI2N 0bDEaeHJk2hkjh6Znx/pNdAfS0rkh2WlFQi8s6wtGCpR6/jgte2IYgFFCQRUVVaSqXQ6A5Ah QJDClBkJinSEQjRiE0oSRAYaFlVqwM0BJopj0Bl4Q5ZtGEmRMMipoGkCZynvBKeJIyDFw2HJ 5DCDT5qlFzovgp0sSxMsS9WzLEv0x6wBMeWrwBBuaWDBgQLMGrIqxaxlSDauYBaThyZS6Rya yuEAHIsTyjRSClsjzUMo6PFNFNihjF5QBV5CwOlBkmYtoN1OnVQsRwgFAyxeYoWiIhTgHLLO I4OPETAp/U0MXkJOjVCBz4nrkTmK5MjkNNUgwOYTGT0RTyVTWggxTFEOHW/StG5ZSmjamPET sKc/Hr0dgFzSkhAZk73JYEgNBNVUIp1IZFTs2VkUNveBys/Ak0+F0qNJ0u9+WcO7zXkqEjE8 1l+sm8+f9pTGMC/CSlYo6gOWHZoC6FqqO5nuxa4FUriyCG88FA+qz6U1Z4XkJBAUabrW096h BgPBcEgJ4IkBAX8aZN3O8zAa5RI+HkQ+IOoT8s2L8CH2BqMidbk3lioeUVxTM2769CnTZ0yZ NnXy1KmTJk+a0NBQX1ZWEoulEYysMSFCk6wo5MMgTDIBEayBM66zeHgtHIqMb6gbObIsEe+J FoRra6tHV4+O9eFpXbzYgHLglzCRnCGLlgZJCDOg2AiKKTl5CdvdnA285430J25c/s6GlX/7 pZuEJjtlxuS3N6z81r99E31B+hEIIPSr3/jqG++vRALF5T+cvn4kL1p2yWvvv4nPpBmT3Wz/ 9uM7gfrlQ3e7UQIEZF/+xlcBhMBX338T3wJBzqzgpP7SC+y5s7gwp7WS0tL6CePrJ44nDxXh Msw71GhOtPGJxhhkpNVhDx/ahtnphazR9PkWbrATSbTGjBMDJz7JEjuxxUYgUDiiKFpQEAyy 18Ya6kXFeeVp2fMizU1k2pyTUOyRwYh8DoEse1YQ6CJmLiMYDmvASeXK6O/uO9By0XmLLrzg nHnzZsVifakU3UVJ74vF3npr1c9//lhxkR4OY6BJ9mfCQFPBPt7kgVkSZYwH0IhgKwphxzna APACBhn9r7q6qtu++rlV76y56yf/fdFFl1xzzfLOjs5v/suPa8eVFxaopLudxmaempZB28EG UNYwwBhPojcOBdjUDHYimJHeOxkZmuXgikPcYBSJJPjDaL88wEqzkUB+Y0xP4Z7ARx589O9u ++Kc+XMsTebv5VddjtQrL75KLWWlYGSQ1t3Vs33rdiTckk2Is8zG8IkJEBOsZJdeednuzTt5 oSOrKhYsWigy+ORhUk9XNzRT5WbCMAhfpkXGj521RJETHIdJ5EgCRpEGBSHhsxSIb08gwyLB apIQE48oGbyMU1MXX3LuhddeCtj3vvyt3kQv3pqtouESctJUEdtS5EFhbJxHpoCQxRe5XGMM gZe1aXjjL4hIMDMMwxc5dFzSNU0j7xgjTRXKyEAF3ySDpJ5Ba9WxrRnZMAhNO5PJlJSNnL9g fnt7+6HD5C8aLSS6THlUqiHZTtopmyqnF2wmMWULETH55sVAli/fiaQjHShNShytrCwdNaoC mt98c1VXT8/IsrIxY6qqq8feeuvN5WVlP/rxPfsPHJsypRYDzO2bjiWT+xDHFHX0jOm1iqqi 7sCoqurx4x0tLTuTyZ5AIFRXN6+kJJpO49UFgbq62p07dqmq0tvT03TsWFd398iiolhvHANa NIjGvR3t2g5dqiwuKpk6YQz1u6rIyb70oZ1NbTq2X6yorhpVPaYCtWnsSzz4qhleF69bs/68 C86trKpobjL2WzO0LT5rUUtLy5qVa7O0yft+ec/9v7xnaI07dODgBZde8Iv//Ckv9orrryoo KACKB/qlb73xFj9UTjiqKkt5KZZWJ8j4LCRTRoZ166IoJ5xEsrbtLZfectWsJXPq6usQTc6+ 5vwXf/9UZ3tH+ZQq7LuihNS+jp727o4dx9C0pDl1M4uLi4MFoXQyowaVVCJ15NjBo8cP90nS 1PIJo2pGBcIhLZ3BW90QflqPHjt+9GirHJ9U0VA5dlQgEkTI6+vuJTtlYGv4vp5dB3fDnnkz 5hUX4m3Xcld7V+Xoqssuv2zHjh2tba1bPthyxuIzEPY8IpmzGKdUTpzs9/I7MdgTLgCFrLuc AoFP1t2oyGWEmKBLiURi156Dd9/7WOPB98m+JqpaUVH5f//1/11w4XkbNm7btHlb8/G2w4e6 r1++dObMzyN+HTp47M+Pv1FSpEZRnbq0c2fjhRcumDv3uhEjiuLxxKpVG95+e+eIERE1qCYT yXQ6BZrGo00b3t0UTyYjRerU6VMw8dbbF1t8zoKZs77U0tJx5NCxVW+/W1gcCSjy8aYuSQl8 4m+vnDitrvlY65aNO3du2xspCoZC0GWWglxWucOR4eBm0l10N03eEE9hAFL4hvXvIZBdff2y 3//qHogEEOPK2rraRx5eQWmWf2r5OeefU1hY2Nvb+9brKx978FHKePGyS6ZMn/pzK+hgEHfe hedXVo3q6+3d+N7GP/ziHkoGmQuXLrpq+dWjqkZBwnNPPvvq0y/52f7K8y9//u++QEaFT79k ukiWLr784pWvvQnJPJeh7jwK3LRx0yP3PtxynARijCt3bN3+ipcK2+eGZciSDozzIEBmN0Vx NCxJyHzOBSAYmVO2KwcRAb1dOjDrjNmyor675t1AKDDvzAXPP7qis725XBmrBuXmbccnLJg4 d/yCm2d8GfwfrH7v4PYDLbuaKyZVtjd1lo0qu/SKK+smNRQVFe3aumP1X1Z39HaWT6xMxhOJ nsSs+fM/8flPFY8s2bNt97tvr+vt7i0sL54ye3pADaTSKQTEL8+8ra+vb/XKVbiGJZPJhknj z7/w/FGjR+EES6STsXj8eGOzgrde0K6cq7xiMQW/WcUlUdN12DCLy4ZwxF5jFMrgSU48P7w9 MqrWWzlnd35JWhI5GAiMLC2M9dQURIK4WYkZgceeeHbO7JmzZk6J9XUe2LvlW9/+h7PPmkda piyftzQ8c+asu3/zh8ajrRhk3nzz9cuuvkzF/IEiBwLKueee+9BDTzz77FvNzV1kTKqQGcMJ ExsuvfzCjs7O1994YeHCa2bMmElu6OiZ0pIRJSUl3d09Y8dV/+KnD0dkdcGSWZdcufSMhXPi sXjBksJzzm7dvXPvb3/zgBYi0xTw7gBvPuTnjhxUTqdbzcaMYuBd8eCjt9x2y1yMLi3Ky666 DPAXnnkB33f++M5zLzj33XXvIliMnzj+f3/t9nkL59/xD98CClHshr/5BO09ffbWm276uy9g WLf5/Q+qxoxGeszY0f/97e+D7DNfvgmx6T1IeH/T+Enjv3Xnd6prqv/wi3uBch9HDh1Bz+vc i85jwQ5TZjV1tU888vglVxKr6PHZWz8PFUTmxk2jR1fd8Dc3zJozi/bFkF7x8ArPQGZx278o MXOIDXWm8qEBByWzXGiLEE47pg5tEj32RG9q1qIl9eMnNDU17dy6IxQOXnrF5TMXnBmKlsR7 4z0HO5dee8HF11xaUVWR0bRAILjozEWbNnyw7q3VK199ecGSsz923VW19bXBUBiX3sWLF0+d Mm3b+1teevL5sVNrPv23n62tryurKEvEEmedffbM2TOfevrpzVs3f/yTH1+0ZFF3dzcGktFI QUFhwZlnnrl61Zp3175bVFQIsvKy8lAwhDZ7YO/+Q/sOhaJh9BLIq+ryO9weyI9vyKjEHtng BftVraPt5FFuRsIaAbUNYSgaCUejRYUF0bSWwYzpwUON6XS6qLiwrBxjz5FnnDGrtTXW1nYE c2UVFRUzZ0wYVz2mo70vkUgvXDi7oqJs69atvT3d6GuceeaiGTMmvPTSW4kE3vkLA8lVubi4 CGdjOBJKJHvLykbU19WgZ7d+7cZjjUfnzZ9XWjZiyrSJPb3xijGjJkyomzixoaOte//B3aVl ZSPLR06ZOXls9ehDRw9FI+iyqZ4XpcF7eKgk0NEllYaCz54z++CBgzu37Lxk2SWIYogLP7W6 XV/9xlcQvNAX4yMFTrP/9ZlPIqz80823UyHoFn38xk88/vCj7a1tQP35oRW/tCTc+o2vAvLs Y8+0HrNHsnxB0CkDwcjRFS0GwXWfvL61peXxBx/lA9nVy69GH+2Of/g2Zfz69/75Y8uuYO0E QL80rwhpFBaU+B7Awavg2Xk4k0yBVB0lRgtDk43HumcumBWJhFHGLdu2BIKBy6+6srq2rqOj e9P7H4RUdfK8aVXVYzDXtW3bVgQyBJ3a8fXHm451P9UzYfrE+okN6Ent27UjHo8vWrx4/NQJ Pd3did54dc24iVMn4VzYs2dPb0/v9BnT6yeMH1tTvXv/nhEjisdPnLBvzz6Ezv37t+G+2dx5 cydNmnjkyJGD+w+0t7VjNUBvXy+myVqaW8nQF0fezZcvO+8TK039kYvKos76K7iW0FK5vj0y c2zko10AC1nBFAHLZYlZXNbJJyLM/ia6OelMBmvH0I8GCWY229t7kqkMJi+rx1ZfffUN9XW1 11z39WNH12BCAH3vFSseu/KKpeFIZO/+44sWzX/jjVU/+MF/7Nq1c9SoUb/4xd01NdWFhZqi 9EKU42PUIlmOEQx0tHd97467jrRs+t+3375o0aKG+vqMrF1y9VlLzl2gpfX/+vcfb9m5Bp32 m276wqdv/PTy/3XV7f/4zQl19eHCIg1o5/nC6sFZ1Jw5j6bARIl+yinMJJCffOwpjC5v+NTH 0TtDVJo6fSrGlUCef+F5GHogirEh2M//42dXXnPVuRee/8pTL5kVpktXXL8Mc1h/vO9hZskj 9z2M8V17aztQuAW2c+t2dvew8chRQDDt9cDP77X0m7/0BzEOPTgQ0F7bGUvOXLdqrd04jEL+ 8q5fHtx3gNKjyzZqdJVDRN4Z6jF8M8s9WK2hokAjZMHo6X8eaKchU8XNpUTL8f1zlvx9WtPf 37xpxVOPQcjffflLU2dP70n2Pvn8E5eefdmSc846fPjQmjVr/uMH/4VO3K9+/svRVaNr6hv6 ospFl1+KscMDDz5wz733qgH1jm9+e/FZS0rLy9BQL7/mysKCggcffui+++8Lh8LLLl/2mc99 5syFZ2jJdDKVwm2EtWvXvv32248+/iiC3ROPP1nf0DC7re3e++8piBSMGzdu+44dr73y2pN/ fHr2olk4y3BmCW4R8xTthDpzggCPLG1j/eVyC/INZG7SUwWCpkQuGfgz7tmocjQcDahyXzyO HtXkKRMqK8t/e/fXEOLQxjIZbfz48b29MdyanDK5JRZPP/b484WFVbNnV+Adz5/73L9NnFgS T6j1DXW4/qCZGc3UHhOiw3es8djevfsON78/buz0nq5Y0/HmqlGjx5aWojtWUzN2XE31nf/5 TXTZkslEJRSXlccgTqH3sMng9mSOLnNVGCb1MbU/b+E8BLJl118F8ofvfRjfmNU6uF+cYgcE cF5kUXERsutXrmHnNnpbxthQLiouBupf7vwOT480hQtAmgUvelsXXX4xAtm1n14+sqLi8YfJ Gc4fG9dt+MJXbm6YMB4xF3B0Z3jsINM4l1hBeFECXMjylCztd1qSRqvLqh4qU2tnzJxRXlZ6 zdXLZs+cAcbyypHFxSPaOtrkcHDW4tnBUGD1G6u2b9l61syFgUjkd//xq0A4GCqOXHrWReXl 5evXrO042FoXHjP5jOnPrnj2jefeSMYSASU0cdLEisqKL978xeXLlwdDQYRYQLAurLunB+PE g4cO/vGRP+7ds/f8c85/+fWX33v33cWLFo+rHjdn2vyC4gKEuXAohDodVVNpnAd+hWClPLUS AbPn5bLKLAerW2e5nDkXswEQaIQsSFwQU5kLTuUbl0hjlUw0EioqjBQWRI4cPt7R0XnNdZdj zN94tKW9vWNCQz0uPrj7jBiCiSocGEiuXrMOa/9HjixFrx7Xw0AA4RsfubZWLi2NxOMp3MOG UvrhCwMIrktYzKHp5a3HcDcAk7MK+mpp3FdS8SYADBMMXWTGLdja0nrk8JGtW7bXVddgaS19 2oD5j4oViiZgedX5pwUhQpbJ8YSvXbX2/IvOx1URSzEwI4ZoQsngTwB5lsLCgt5e3CUDjIBx TpLTkmYsHawHRwEXzz7Xwnj9Gr6gKuj3m6+8sfSCcyfOmDx34TzMu+3aslNg+9HddwHy+COP /+jOHwCLkewNN95Aqo3yczUImOBqhyiD3mKySf1YOA1EDE9mC3EosE3iwUpA7uvsCynBCz59 +djq6r5Yb1l5eWEh3lAoYUqrtLR06uQp13/sWkUhG+8bz6vo4UgUXS19ZGEoFAhHwoXFeOOI jFXhaiRYXFmG9V+Rokh4RFRGGCuMoGGnUinMgkEpaiejZzZt2oQ7MLt37F5y7hItpSUSBI+7 UWNLx2lkFYaGh2OihQVYSonLPuaIMQTB3XxyN4QrJJfkS5Mz7fCN1Zqs35zcOQicwvGcTw76 PNDucroheYjJSUKkor+Lwf/O7ft7e4/D5am0ghtY5y5dHIvFt2/7oL2jc/68GX29sUcfXdHd 3YWqCQbVpUsvisUSOAkxRxYOBbHYdd3a/Z2d7WhAV1xxTVlZ8YoVT/f0tEG2OSeASiRTnLQu AaNwxXgKitzChgsDIazSwHWu58CB+L333UvOaVkeP35iXW09dMW60oEyrNJxNvmc5RseAkeF u1S88sKrVyy74qYvf37BGQt+/+vfUzym5xEgJs+YTEMJJNCp9xUPkYEnOzBaRBq9pyceeJQC r/nM8q9+7fZvfOWf1r2z5uM33oDsk38wUZj8+re7/v3Rh1a8isGpz4He3Jduv/XTX/wswtk9 ljGMFqNUTP/f+e3v0Xk6tAbMijLsABI5WynvOkrMqpRH5a8akaIn1RspjE6aOS2RTNz3h/u7 OjpwkURzQwy68cZPFUSiU6dP3711B2CVVZVHGo9s3r0Zq4+uvnJZ+cjyVCb14ksvpTOpsrJy OaQ2dTfH9ieWLFqCzl1Hc8cLe5/D4sd0Kr12/do1a9eo6PnJ+tmLz+7rwTxBH6aSi0qKJuI9 fT29u3bv7El0j6wYWRCN4up7+MiBmtpqlAgzbh0dmBhorhxVDpPQ8um1yrOAOb3nyTV8wMEG sn6Upx+knuU1LhPkcSIJsUzXMd0ZqxhVN2nqzEWLFjQ2Ht+5c3tnV9ex4y09PX2YCDh6FJP9 OubIFi48G5XUhunMdBPizfTpkz7YuCqZ7CstLbjssgsQgP7858d6evAyTCSN9okv49cwgmQM MLnKGQhCFi0KHT1yvLm5TQ1or776CkzBxezii7SxVdUYzPZ0JApHhAy2wZbZUDqMX3R0ec3y q6Hj6ceeoZoevu/hK6+98jvfv+P+39z38tMvIYJ87oufw8mAKTDeFMSvaz9x3c233dLV2YUY hJ7UtZ+4Hjcf331zLcgwWXbzbV/sBuqplybOnPypL+JuWu3GtRt4Ce70ay++hggY6+vDlJmA 7eroBOS8i86jgey2b3wVM/0CzdBmhcpDUyAXOOugbQQ0LAEMn2ZZwkERshTXk6FIwYTJExEw Hrz/wdbmplAggLcRJhLxBQsXzpk9Z+Lkia888Xwinqypr2lub+59JwbeM89aVFVV1dTS/KOf 3dXT20MmMUaV4yVvXX1d02dOP3vp2Yf2Hnr6gaeONh4F2fbt21966SX0y7BMf/rU6ZgOw53Q TBq33UvmzJ6diMffWfNOYWlB9bhqdM2aW1sOHzlsjGDQYLGiSU9l8Myfsdqc2G0fgjdsxKmR MgOZn5U2XKiirNYzLpZwklNZDpgPJaUBPUaJkXRaj0aiixfPeu65B7HKHv3kKJ4nCkdwq+UX v7w3lcFyZPWPj7wwf/7sBx96qPHoMdQlarygcMRvfnPPjh2bDh3ct/m6ZR9ffvWZZ8zDlFYk EqmpqXnooUe7uqTRo0vRdyMVaRwKLme490wW4mIoiREqUFoKq6mNug6F1brxox564MVYn37T zde9+urre3bvHTmyvKiwMJlMbfzg/mgRbjyQlRw4WLk8ysxhKbE9NPOkNs8GXirl68c3E0wT +H71xdc+ceMNb772Jm4XUiAS3/36HX//tb//9p3fwQfSMRv1f79+R2sjITAZjYL97L//5wtf vvlbd96BD8gQxQCh1nz39n/517v+HdNkdKYMEv7163e0GSqYT9x2v/TMCwhk69esxyBXwK5b uRaTaOisvbbxTaAw9kQPET3HXz1895f+xlgNC7n0Y3Bm0cIkUxp6/WJAIUHLCyAvkKZ5CCXj IQIL2lYilhxTOnratBm19TWvv/h6ebpoTE3lqDpyy+L9d9Yc2rmvauSoSVMmpzM67gUvvXDp wsVnXHrZZcFIsLamdsuWLevXrYcRLz378rLrlt32ldtuvPFGLKeYMnUKXLFt17a9ffuefeLZ W//+1ltuueWmm25qOt40YcIEXH7+9MCKA/sOoXcWCIauX379RRdf1N7RXlpaVllZsWHD++tW ra8sHtN8vAUDzbPOXjJ37pya2tq/PP1ctDCKHRlwVRa84c4KRTYImM/c5BbEYrN+LfhAf+X5 85aC10+cCBfz3oyMiiWIeXbGLKcN4JGsJBYa0QO8x9s6Lzhn/uJF8+fNnYUVp7ijgnvGjcea du068OtfPRMpkiorijCci8WS4XDhbbd+csrk8aFQCKO/Rx979tE/v1lYqJaWRRqPxr/1rc/j ac1oNNLXF1u5ctVvf/sElkxPmlS/fPkVGzd+cN99K5YsXnDRRUu7unt++MO7b7nlRjw80HSs 5eEH/xIuCMyfP7WuvmbC+PF/fPjxjo4uzKzV19d++rPXYsof173Nm7atXv3enx99deaUsQiB ZERqDlZJkfKoW44mBzVxjR+JAGdZmhCzlpOp1xmWhuEzlp5ZUlqCrtA6o5PFsCxBuSbNnFQ7 vq6zo+vdN3GnGAfBUxr0xWrG10EC7aYZWK4h0LzxLczVOu2yWTDIha6Dew9gmQj4sCLkwN4D bDaNcgmiOCXeSaE4biIQMHsYMUu46T0ghFrGlDweaZwwbcI5F5z7wjPP7d+xDxdLzErBWb2d XXWTxtdNqF+45IyXn3vx6eef/vznbpo9Z079+Hp0ptasWr3q5VWb1n0wZkp109bGi264dNF5 i+ob6sG7c/vO+35y3/HG42X15d1t3dNmT1tw5oK58+ZggQXu5Dzx6FMrV77Z0d3+wx/8aOq0 qZjgR29rztw5yVTyzTdWrn17/a4duyrHVKAxL7vmyukzp1WNGvXmm289/ucnC4vw3GUAq9hY WZgHGIQmvOAevrHIrDkyOy/II1mLSERZTE44BkuYEp9nBDKG8SZ1oy1TTXrjx83rgFjtywG0 JNtAO0VwNIeC4QYiZtpVKR5Q4ugkAY7pgEQC76wOqSF0otEHMkb0eHyMPD/WGg4HEQGR7ksU Y9IriGVdqpJMYuVZc0FBBB2udFpqb49EC5RQCHOrqVSyXVWrdD2BPTYwqa/rSiRCVqml01gO FiwuIPdI0UXTNEzCdkYjFbAMwRTZtNYVDodhqZYK6alQRsaCw6BztpQUxHIYSec8svcRqFOM ex+GJKdoZ85exU7hDOuZZYaZ/Ukm3qgGgRdIBmGMLJEF5axhk0MAWo3FbABMLEvw9HwaBIyX EQ9hgi8X0rxqOA1ZnoDqJTQGFNc2NKGUlO5MdFREK9CALHoyTYbOf0pL9SR7ysNleO6yO9mL pyWjBVFwhTsCEtp3BG01iF5/pjeTCWe0KE5fua+3r1AtDOHhgHAQHSicA0ktkdQTpIWn0sWR EUeOHcEa27t+9BM8pvLd734XzyEVFxVDpop127AGt9iDKuZ/E30ZSU3LqqZo4UAQIxHaf7A9 x5fULpeN51MOHzgZnTmnA5mIfgUy46WfA9qzX7SF6R+2BE5a7DyWSKbiSYz2ew09CFJoCFhE L2P0CAKyZgsOUPBApdzZleruiaMqcKhBrJ0NocmgrUTCgdZ2LR7vBVzHg7saolURGhnuc/bF cCsgXlQUxqYXyURcVgLhcFFXVydinyprgWAU5wdiGP6Mmwa4JYq6RiCTerrjfT2Y5dCDakEo qBYWoonBQ6KTaN5Rw8PmLgg+YYrchRg+1aJP3bqHHwIbUEBPS9DAvFHWNQfXQjRaLD1N9CbS wQw2oyKDDUMWUOh54Z5iHDelpGRBpKgHD/rGEqlYCkK1DFZ/R8MFYdDguyfWE+uLJePYnQXt XispL8WwEZKxrCwNCWjfiV48RIm/wlARmjrMxTSLhktua09bUyeiJrgKwkWRaBRXcWAQ9VLQ FI9rUjoSkkJRrJ7hOmOiVz1LD6J8ap7R+AkRleWZzz3ZD4VMOYQOsf48zYRfdb0gHAwWVwSD o432QnpbWBmLg9xPpI0I5iGWyVLV6FrMbZEWgL5WHGEKVpPrNJCjq+oQEw0JEtZT4Ilx1Go4 FB0xpgHNCNnCwkhJSSHUpZKZkeVlpBmg8aXIZH8kFCiIhNTS0ngiCU24vIKxZux4MiOGtpIm /Tfjqph3qT4i/HB5QDhZUDi+e4jGidhVVFBYUjYiHcfGU2h7RvlJONMRhorCRSVlpbhcYwp4 dMUYdJfQtCABLRNhCE0d7RbfRRVFJcESRB9wk1ZnrDcirR3PM4WCIwsqRqlV5FJNFrWSIBUI Bru6ulraWqLBgqqyqpq6asyIpdD6IRI2GJQjK0eogXJMieDOFVoxOUFOq0Oe6xxauo0X6oZ6 npLZaTtFMM6cJdKqUgErZAVmEevjYHLRoQfVIlSDhTTBTqzNawmneA5uyub5+DTQdpamBI2m APvHprdhXMpA+9JYwikDtVMgFrKgpBAGF7OGTAFryTcNc2MZhMknpE7zONeYcgQ8hQpAM+us A4GGqbJaVjb5Js5lHYPTBF8iAeWZzU2fm8KsGzKg4A+L0Qm1KjJXQZhPjAsulqoUYRka5jFx sTa6aLwmpIkS8ph4fw7RMCdvdqxFS/ujVs5qK368FM6spFkMLbGTVu4eGVPyUeIjD3zkgRPp Ab/zuV82kK6ZLHd2dmXa8fw5Ztr4+c9+STqlickdE8cxJM5zSLQz+clmBnmQsyu0azrQ4rJ+ ba18SsRSFSKU5yBpirfNMfL2WgmRnM/np8BSwXNyl1zRPtEeJ9tJzzFzaeFtvxmWMewg7GQi Wb+DCmPw7LKzkAElGChkBclZRAmUeWRNVZjbYsR2ioGMhB/cSWX18XDrCsNUPDDAzh+BjmaZ UGeZGdiTSQDmSZwnmSDcOwtr/Vb2C2qErLe4fkKHQ2Y/TTiZ5LT4tMEwVzjbz8k0j+k+BU1i tuVMMMfmpOQJ+sHFeYdLWuHDFROplpzycxLw1opp3g4Oh34ZDmMumYNyF0sDyjT7SHGwDknG oYipH4Boj6HlYMRls4C3ebh0ZNP/Ee609sCJaDJ8E6XOMiau3GCC9Iaeoj7GTBmO08vmfrnS FciE6vFpPgLY7OELUKu2rVlMhhZ0OA1m/Wph2GBQ5SfCKRA5H4U+j5JZShgXtYQZZl9xbUUW j6WK8dokHinGRXE068Eq0HlQUJsIQhg9iLSCKA+jPECmEBcvbzBD2hrtlIdMPxCT40ngiXUD KcQNz18mT+mW4y6ZmwYSPIFEsuhQQZ4ja50+vEUeaT9dJtwh0s3uRFuy8uG1aN0yhx7itNLy ouFnVyAbeu0fSfzIAx82D9CzVzivhqOQ+YSJfGiGw7ZTSuYwBrIh8S9rK4I0IcvIBuVcs89l CmMqPO9K29g8VPaL2JZnsdFfu4wW3KYc5pRpALPAaQDLMbxpjsmWzTjGKxD5wU0yS5MnGYCe cD8V+RALvO6sZZEbkw/EYQI/AjQQVLZFY/3aHZL8NTitZJLyETBUNMOkNFcgYyUfoP4Bsg2V 1/olh5W1X1wCMS3wYEQxl2UXwmG5JLGGZpkYwUC/LOFioxgmEVJY2o9TgPdXscDOZ/1EZYe7 sW4ItJjA7MXLimViQcXSvP39S1u6+ivKQc8ylrT+2SBQ5yGEkTDNgowTkx36PftPjN0fafnI A0PgAXYWDk4WPYeHRNjJDQeDc8PJ4YbH8Am4ve/pSnG+29NmJksUQREOqC8tk0wHetaUP6Nn +PwTNq+RsmftxbGkSUh/hFlzlzom1VEuF9kgAFk1MK2Mitdk7P/IA9CxYhwE7shYAHb3g3bN BMkCi4BlMt1wIt46BCEW2LQnOxbElMBN5gkXyDyyAGU3l9mXR0KQTzhyCBfQTABLUK2UzCK2 my/BCqQ5NDJqSxhVIHwzKlN6VmKB1y9ry/SiyI714rBhsA6fj3pktkc+Sv3VeWAoTtG/Oqed YgVGEMQn1xyZYDSr+MGEUOiFHCKBiRPUDE22v9L7S+9p5ZAIoZKpj4dOIJXEak7ICqWx1RoM JpcN5foCPFCQkiXL7HDTACU8D+hJ7AmEtP7C3QacHAize2AOpUbnJ4RR5VVSP+rB2JmX4n4Q 5RvIqM1+JfJU6C5mv9hNmawjbY0xPXX5At1GgNQG2ilOAjPTE2sSCiM1jn24knmZxZ3G2azP 00am0knPwJ4qGNbJlCPnxyXAPVuBQMM0+cEpQXYsEzKoBNPh9JQzxyKvD9jEMyxLDKIc1DBB 0qCKKjKzoouI4cnnG8iGR/spLBV1jKrIXtMnuK5OAW9Rl+R0zGAspU4detfmU6GDsfsj3pPq gf8PdZoWE35hOh8AAAAASUVORK5CYIJQSwMECgAAAAAAAAAhALljRBrf2gEA39oBABQAAABw cHQvbWVkaWEvaW1hZ2U3LnBuZ4lQTkcNChoKAAAADUlIRFIAAAGYAAACiggCAAAAj6/aDwAA AAFzUkdCAdnJLH8AAAAJcEhZcwAAFxIAABcSAWef0lIAAEAASURBVHgB7J0JoCVFdbDfvs4M zAIKCs6MICiLA8MiQRBUkM3ECSjGACKYACYQQQOyGDECykTBHwzC/wsi8psfNRkSARFUFMSF zUFABWRYhkWWGWD2N/OW/zt1us+trl5u3/vu24bX776+p06drU5Vn1tVXV3dfNhh+zXlHUNN Tc0uD6DEobQlCEeLpBEGpWWUc0ZTU1m60fJGVJdOnZQqw750YUsbl8vanKWotNiaCHNtCKRk lDygyE8W8oYGFBIndJSnhK0mYlWTwZKBSphEeykgKchyUpwrqhEl9cXRJsQWp4dam4Zamoba iqjCeimiJS8wu0buKsInXraWP3DKxCtGSYu1nGNb5+brsTIDA+pUXVNjqYk4u/7MVdnZw8HG HhhBFRmiCwNZjfUSl2A4XtiIeDO8vRGVLizKeKj8MbehfgNqaiw1EYcVpWksbYCUTNkqt1lC +kip8P0c6SgMZD59ps1JZGB2jdxJWRtBSssfOGUjKFd2EbScY1vn5uuxMgMD6lRdU2Opibio urLzhomNPWC1MUx5GewZolsyyNIobFPzYiPTJOMRQ3kzijweLR0VmwJfjFpdWusZlVKKkioV rwbZuSazqhUm4eT6VNRkzwgRV/FgrlZKXNX9uczV6s0uZ6sEp87JK+yR5Wssk5OoUsdQUVuG f5Km8R6gTvxKAE7XUoO1xgqaC+eOG6zUiYs1J4o8Eoo2NpnmuBoL5jetGlnrIVd1ei6e7A+k JxiDvHGcpFqG4WGr1GHIGMfOSZr2mipssugNTNXf4KKLsoG21Ccqv61bC8kQXJSXQZ6LKpaj uSkL23yuVG6uLgkNPmc+4bjIySn8uLBtozICRxc0orFqNFWqXy2uqTlbIWviGpOqDi0M040y ylzSKIFl5VAgPomhJekazKm9/tWHNagoW5ZydLUVL5SpxofYqmkrbZ38VRWMKkGJGsz1suMd /QGm+adqBVhVGcuEB4IyWwkDfJlyZrAMmbwyAhpK41vjrEgEsoaqmhQ2ITxAK/AbRRWby7Vc BBYQalYNSqvY1KBsN4WXYXZdhipTRdo4KXNdZcn0b6VomdnFSMwI+NOYYgnp3DCQBUUN9KX5 I4sCtgy68YEyO6sXbHwYPEZWqJ/ynFScO0Ymj0O1+CnPhUXWGo+11iLqcnnNTlYVgaY4U2YV 5kye0UOGgWwUNJtDiv02CpZMqnAe0HqwammIV1RaRg3HasZwjFlQwNi6BElGKRL5G1Eis/xe +RrgClWRVqSYuhX468gyhCA9rdIr2CQ4MT0wvHqloWS0lZo9UbOMcdgU1RX5JRkHJsd1XcWU /DK4itWC1lbHgcbYkCIhAYuSVmGU7OY2/j3BPFiQKcojyQRNRja3ZWcy14TMVlCTCCFWMQ20 q2YLxgEDTij0gPk6k6o4t2rxHHtFcN4qM9OiAoNkhb+qvjEjCEz27RhJ85P+LTACgxIxwAwU nsjCYnbj8AFlqZvRF6Uwogr8lR5aQlyH9rRewxRoN5rygEprrIXltW8ElHntoeZ6L1Gveboy 3ZgwIK7ggt9VufqUrIQlmRpLIfUmQGxPKZbSRDX5p7TUxhAOy6kj4y6pbt8sP5kKZGqCTx43 F/xT0Kwa472NWIq6dIRqeCPyW+yhqK1pkjP+Uzhum/F36nfXMiaqV2IXJK7akoUx3pL0Wc4a qlVISV0jSZYKZKIsq3AjYESyXdakoFYLJ2DN1OSP2ojzHI9Xsx1l2Ey/W65akaQhM4nIMdUJ 8X8ouZqa+Tfhgx4jEvVmgRPNSajcfgt8Vy7DUoo9sflg2VLkS8jLsfKlCRpnflq2w+Trrkd1 vrQc9XWhAy0kFZMZyOLMeopTg3UjLN63BFWBB1wuuFE0wjdovMDqlYoTFMryVb7Fxp3DFurI lyQ5Sm1RzJI+FxqJeQz6yCWiuVMlfknaUdem2FcwMnA1R5XVquXKoM7KyMJlsFZQNTMIa11M FZ3Dh3ICmQrGOvP98FWNsYSckkgNyDXxmj7CisYd2S3Tx+b5zKfBqzFZqCPtcCgqnyHpnble mAgA9g5JudvtzZyHhmSyrJnDUWi/THtyioFaAU/CBAaTrogLko0N/BYT47TAI2G6QlkA5egs 4BjBrMJANoJ6x5Voa/DjyqqxNQafNLyhIjC4gCpl9JUB8yGKSb+sQiJIxy8xi1zOA3JJSjir DCgjDhl6xvTG6MmaBBMeEFc5V5vPEtlBwlEGuDFOTgYyVwFaM7lXWSMqaRxWfiOK5csI/Fdr iaGPPq47plFMMb4WYJDocmf51qAGJImhuG8WkciXsThw4zrhhZwjO0fdYSyOKJvSaOoFVGyg sIwwGGvlmgxk5lhcN0IVaiomFlDFIWlnZTa+JJl0oNJeMBqAwXhQCWx4WAI2P8sJdNYSxIaG BgmBjtrpeo32y1L+ESdlIp33/EyoAmfHJO67UEiF0sgMqOSVgJSryI6kkGqBrFZ5SekTLCVX WX1un2AFzTCXcme0GkUNyycmNZai34aObAHrPoJ3FBGBUmcY7FCay1mnzBwvjG6KLBKQGGPm yamGj2RVIxt2fnFp0+Jz6HPQSX5HlEMJOrvIOfRJyVUiZkhckM61I8VTLZClGDZyhMx6vlbn /rWRZjTgNCq7PWdjky0mpom/3QUTJ0QRsH2SrBkptYwzLHIWQREYfQuT9M+IbUaWISgfNU5b g5Q048hBe7P7eRShsApdBYpocGTGkSLLoKkDlRabqX4MAlmmHXWUcMRY1MC0A0dM4cQTjIsa 5R9dNiE9Yf2YM1RHqrVk6AUFmc6UxWFLpLVohpNocjycqWowgIq8w8zIIyjGF0guZqw7N6Vx mCWo25AqjGMQyKpYNJn9GvWAu0KiFbA1Xy0anjSWuWtPR5TIsStR4Jrl1lgXpgw+NckwqlqT mlUgmzsWBbl1ZpkpnlPqFDX+2CYDWVadSJW/VufLtLlXv44KKLwrpto1o6SEL71HmVUZhovE 5imORQm9TpkJxs17GgsYYD2b3OEDCBRd8WHwoGjTw3CJtGXHZPKdGcUq/BXIZ8qGhVZ11MJl slJMmfYa+UgBZbSOaiArY1BNzvAd3XDh7ve7ETMkvpU1FW8MibG58Q4tKE+kbPiuUsPjYabE F4IaSQ1teXts5FhWygVmcwC4JCcVEi9vizRJJhnKIhQK5dhREp0tI4lNpkoKziVDmhavsWID fYFw1RjQjGogC3QPMxkUb5jSctjrqKY6WHKUT1R0ZkuTwrgqS9Sbl1DQvJcrpKpXEGTdaVkW 61aWOaSnzZOSiU3/gmUapLycDYiLKSvasEOnACNtgpAj/hYmMHxlCne0ZU9qQFnqHLqUkCK7 lDhgCZI5enLRRfpiJlPhE5cLZMYayxrDb7UlKoN+OVQC30D76parjA20ZJRFBfb7raYWSwIx mazQ6CeZm2Atox8GyJRNz5pUvBNu+RGZr1FZFOOxRCSWq5ZYUgEX+CRquSemouKYdhMBRpBR JNN8WfMDI4nqh2n1SLNwXnYMliSLybO/zc6GSMvWURprxsBRLpCVFj3ShGo657xpW/VvqTYx 0ra+JuXLM4/NzQODA8GFqfXiXJKoHMVbrgGZzlNOpfFhJfZENdusfzyoTEQW6CFOSaisIUxl iQZFKq+k3YEcpzfiJYqZGZKVuncBQuS4sMeEfksUxFx081RE0uMvlRmnyn4blwEFnGVoCtg1 a/hCkGB+rqrOJ5hggUxMl4JqYaNuu5WcS4iBBNm+Qy1XeOs8vKmVPHG+StES0IXZdRrSALbA sNISvRLk/YqILKqguXnQDefQZEzpkZpTHNUgMJSOWDE+qyPUk7uXJ5v7xIcWRtMxj+JiChcp 4JC7mE0EOGijO4ImRYFMC2NZUmLTYqLBKBKxLoQJuSE1SzHKAoaumDu7zKGmQemaRbL1S0Qk D5MTKcvLLYdPUkWpiooIkbZCMpTMiA2ImBr0VSA2bZYRj0YgS6uvr8hqdKXBSdsUnBVGxLpY Jhq93EYZIPJVWSAxYYFQbdxH1OvwnIAD5FJuaWmOnuDWsVOle2IOgRK+tMMUY3itPU9DJCCT V/Mcr3CYKJ8dpPIq0pLanJTFeI1R8XH0sXxViCIpoNxyjR4OFXwgKhPjbHE5jtpimfBnHrHQ +LtCBMasVWyapkKdBZWhL0OTJbvBuHRhTcFoBDJTVjeQ9KMrjmvp9vMdSBYK73c7yB2L5DAb 21iYXFVn3P9VQu0ODwwymGM/ClmLqh+SQVUIRXSIW/jXDg/0HFJ3VK7gA74oN6KRVOVwvFHc BCtC3DmWHUlzSMnkXz98C5DsZIKxw5niIzRH0BLC5EthwYso+c49LBeA+EUZ9aaqwUagIkgG mLRoI3ClC/MtN8xISJYipI+AN0gqT4BMC2ksxlfnG10qkPkMjTWrVmn89knbaaZL3kIDCgyT PK4uETo0ODhE/wBS/sHrtVGrulx63525RBtthpae+R31an//AK5WJKMlih3B9FPE++IHxVQ8 ojWnWQJLpySqKaGWzh3j0wq9UMihZx9QIuF1BJwU4OyIMSyyQmnQQ5bR+J2pWEDiGy4ZLTuW qHHF+SInP4rhHNdanRUxi36rbfFZZCsRzZojZFBbHacHqiQpiNED+8mI4rXxVSqQ1ecK8299 7GkumkVbe0dLS0v/wIb+DRtaWtuSTV1qVGIZi4ZaWru6O/v6+iSEDTW1tLYMup6CyRSirKPh NmcpmcC4wG/xtSqBB9cTevj9kMuyRdqVEBNFFPAKLVSQUS8yFJVdeAaFVchbW+mghL9Pyuqk yamSdJCidJQXZ4bf0BCMXFyVuEY2/xbCYgm0n3T9i1nYxNm1LrGtEs7iKCbS3McUk4zaYowP RKtAVswGnTLRovZpZI/ZE5It4QCh9w5NBuq8/FJgIDOTpwxNJmOjkBhgxRzBQNZAc1UUTVCv FGn2DuWKIVWvSd+zdBMUS2NzV02lzAWG+a4pIBt2lvnfJPm2G7KxQFppDfJ9+yKY4CUi3dS+ u96k38t1qZe8y/O5TBlErW4qzUUsuV5bqCr9i7kGBwc0rKSNNgzCVb7TGInP1GiqLTcZxaSP xmG5Su8UyYlOJl8YGKkWuoiWr3QM1Tx3jjgqDCranSFw2VFsdbiI3nlG2i2HSlOAbL+wjsXy JWX6YuGOJHWKeYw8QRHnJpAklDovN6QelTTGqD0TIJCZQ2jZ7pd8gDjGpLL+hscFMSoB+MXv b+on6inWqiujDuTKS6A1YSwJuV4iwRPXsZdfL6hNOGlSvbIaxhcUFrkRRuJRNO6iOlra2tpa 2+lebVi/nlaf5ooNcgHPEniP2pRhaHTTmRyNYjFJ/nd8beXpUjxUDohqleaDRDDuEyMLlcTs 8s1/xJMcpfoCHL0g0kDMG5E7aRJJrSFq2cHgUgnvNAkZpVbofbGeo6RUSqUqYo6IseRXMVdx bkkVI0E23gOZOU4A6dPLnwOD9hA6R8eScY0Kj4kS2GVEItwlF8ExkX5HSE92nO+hHJhHH9Ll plVVQnwikctYNSNdiKosGQS+MQ7Wq0uuNekjsHZsYEhm+N1Fzjda+ShXYAFIYfKOqFI9jMpJ IhIp49eopCpA+roU9jEmQmyQj2SaKMsNWJQAZAw4UH4CM3g9aYEYEx8CsJhwl6feoacqs7xy /4RCMgsZi9bvOGXSVF0UzpICjcYAJbZkEZBSVEQ8VnlVAlkNxR2dEgRXQDml1IQVREMYfEhi RtkBXqUrXVx1CcZAl0lUfMwSUJVPii7tjpXnGRVKv2QV2C0WQ7+rEOlJYTzn/gE6wgLXalqa AYz4JCWoYoOor4SABN5xxewiSXMdJN0f9xHZik8pyUBAKexRjvDaocg4S42STA9jtAnACJRY LIsPCZLyA8FUcFt/P16NM+JvNSYHXVHtG5oijmU14rsO4b5twzShSiCrT3oD7VMDfB99/PhP LFhwRIFha9eu+ePDf3zwgfv/33XfhlGM4T8WIZ26lH1xpiNWes4OqxKMIKZI6q9kJ/G1pFJG 5TP7YSLdwJN8P7jhp0lEbmrRou9fdeVlQbaVLAKclcDiUT2A3ey3BjLm8QMJJZPIfPe+7z7z 9LOhv2Dh+bfdHpl9yUWXbfeW7R5+5OGTT/uEijKTXNK/9rNVKb26F2/F7M0/vuHH2QwOu3bt 2j88/IffPfC7a6+7VslUgp4FI6IQljAgs4vnG6CigrMRxLbFRooCWTMry1lwrPNzklc4/j12 0T+c9g8uNyorMJDJTDKGKSOrFDAkGdfp7EA2PgujvjaP5/m1u7tnl3m78tl///eeedZpy5cv oynEASi67kVIpVlURAJVyh63gkp2nFfBOCNidNPb5+02ddomK1e8ev/ie/LMAx+wxypl4k+4 aL4msUCKZmlQyw5n5aVUUeMbbNcqcUz7Y3hS+NWf2ZZky/fFQhEkM3mMxgGVAho+k0uRSuOf C4i7u7t3nbcrn5132vn0c/7ZKGFHa6wuMiCWWbHHpze4AHAShN2ERypcsBTG5uaZM2a+fce3 A97/4P3Lli8TZPKAxdiFoWJnJMzlC49o8g7LBufDHkkFrEpQIa0G5YkKzKsmRvKzA1kZzjRN HerTQnxMXjmV5s4773jhhed9eoVnz5lLFAN+4xu3+uw5XzjtU/IzJaLkyqvUYTT8sYZCljug yS6IaxjFJh19zHFvecv2jzzyx7xApgbEgRU90quJNcu3ZLGSQe9X+RnFcFE4E85ly5bdfvtt xTIeffThgCBhmcsDo0gZRgbUw0vii5UrVtDzQsyKFSs4a8Q0qSl12bVk9BlARUSFF8/cluWZ nXbYiZ4gQohlnz7ln798yb+ZQMRIzcXpGKjIjHNiX1m6BBBLE9IIjpstUeys088Cf8HCC356 +09UGDSPP/E4MGe1AIwBShMj4lThtyrNKEwh15hnRoFsfNqdqg+qtGLpL+68/fa4OgM/7jJv t7PPPpeuGWFl3rzd7r//Xghce9BqEvKCK7FSl6xzqtA5AU5TYjjhMMlTxUjD+50s7uuJet4X JAupImIQpFpbW2EJVr2ZkDQAl0mI22uljEa/bNmL6WGj5RYBYp2zsOIHIc/Q4UkpzvUIKyAs 9yy+h4+6I1JZyQfSnFC1DmnJy1QK0rFpjUklKKVDivSXlr10+ZWXJ/RIQoQx1D315NPomh10 4EFXX3uV3wkyXSrfkiYnjbGsYiBPYB4XBfm3S/7NFcrKlO0KlaBEeeaZCDVDWfKI80waPt40 mj1VZbqxTFWqsSOwIgH4UazYot8uvufmm29Smvm77s41KEdR/WbIE42OTfPMkgzSECXRxbhE TrJCSHH5cR/KR5NG24AcNUwzJUREZoj46PoNDSubdt6OiJ3nKkHcF6FkPrGfWx9cIJOs9CHm VTt8mTY0rsbU9NPbf/rzO36uZAcfcEiaXhW7swRK/VB5ik/Tl8TUyq6tyF/uUiBBjdRz2p4C xjTxuMI0Zmiprmx4wdSt0ZkOS2trmVarZiQHShl8++7znl3mzZ89ezb0L7744pLH/3TrLTct f1mmHpRaY4R2eObM2Xb//Q+YM2duT08PBE888cRjjz16042LgPWg38fsWE9PL0nO++zzboCn n37q8SWPxj2JpunTZx544CFz5myz2Wabk/vkk48vXnyv36mUnpoLYrvssvvUqZusXPnqYjfX duSRRzuuzeBC9Q03LHr88UeB3dEw36cb8bxddp+/625v22EnFKEG1X967NEf3HR9pDn+2nXe btOmTWM8eN/ie2bMmHnEgg/t4FhefPGFO+68/WfxtP1++757V3H4HPieeOLx+xbfS6SIZcg3 c0A7uzmg38VzQL5JCr957jZbv3FriPPmibbJJUBA5CtfrG9AGsZIumPgp0yZorm+kS8tX0av bZ+99918s82vuuaqexbfazogO+SAg7eZ+2at6zVrVi95fMmtt/340SV/SmsBA/2RCz44d87c XteEGCfeu/g+/KMWk8u48i3bvkV5HSCF0Fsi89X/K1fc/VtmZhNlNLHaMnG7ilUPKKnarBiK M3/ernNcHVF9jy157Ie3/pBiZto8rpBtUbnHlVEJY+i6sMQZP8vUsnxKHNmFirEzps9k7oxR p0kC3nvvfY44/Mirr77yxpsWiUrvOO648D6p4z3oQx/6yFcvvlBjjc6OKRNzc6e7u2/cB5RA 5o5DDllw7LHHM9o1wW95y3YHHHDQX/3V4V/72sUamOK5s6ajj47m2iD+5CfPmDlzpse1/YEH HnTttd+87rpvG7K+PkCBK4lH5yRdhC5KfWDTQUd+6CNf+erC38o1Ex0fPeY4vbFI+rMyou/W DJDv3HsfrvMvfPHcz555LnDM0UTW+w48aMst3nCtVwqi2Fmpu5bGosA7dn/HsUcfC3zzLTd/ +ZIv+7laZycc9/fMaoE/8ZQTuc9jBJXbPYZKAAlnJKo/QdbkG0lc1jAHybRpmxjh0UcedeQR R/bEflA8Vh2x4AjMXpg0m9wFh/7V8cd+3KfHP0g+4gOH/8t5/8KQ1mbHVBRyFNBA9rHY//f8 9h6/GGmx2zuxh3/g8M86sUYMQMj7wjn/il6VzFmr70NHHPmNq7/x3zf+t+FHEzALVWlmvYDk M6weWabckSsnpQoKVqBr3rz5mpvsmjURxb54wUXEGnJ/u/i+Jx5fAkBXa968XYkyJ5108pSp UyxGUECLYk8/vfTuu38DcW/vlLe9bQckEF/OOvvcE0746MveBaNK7ayDykMPWYBkRdo9it13 3xMhRIcLL7z4jDNO9TpZEffMmZuddZbM9JnqHXbY0cXQpqOO+thdd/06zWJ600ByeIsjpfbU n+kpvwtiFzEXTsxatXpVT3evlfqzZ5378RM+6ocJRM2aOUujGF6l9zGld8q++7yLoEb80iUU LGi49757nn/h+ddt/jo6emR99Ohjf333rx6LOynWnAAMtoIo5uZbf0iMgHf3+btblgFcjRrF 7lt8359isZpbvuWYNIDtto0u7FWrVvl44MM/cIRe9kufXrpmzZpXV7yqKggfH3OhFhrMwBUA dLW23+6thCrCE868zJuVg/5k1zbwzz3OP7iO0tG6kP+v5/xrvKgi0F+UxFcfiMWuid1uYgln xKxPnPYPUe27KPaVC768lbsofJtxJq7GvKlTptoylCLFY5c3rEA2OmbHnTB7hKO6WgZ6++yz L3Rch7ffEd3fUbbTTjuT8MFas/MvOJepNLtg5s7Z9vTTzyHr6KM+dvddv16iY7fm5oMOOhRG os8Xv/Q5ALvmj/zwMUcddSxRZsGCI6+88rLT3Cqniy66jEDDXUuSkeRmCZ3HHns8vMSjhQvP iyQ3NV151WWMGVGHkH/8x1M/9alonZTayVk7YkHnywIrQ92qgSwZvEwwgFhn13ZEFqe5VYIf IPjtb+8965xPt7e3M9budzN3f3f8SX+94Aga9/sOOOQ/vM4UxFjLpXjWOWcwwFRJP7/9tgvO u5AsLkiu9i8tPE9jFrmMRr/ost67/wEWyKAsPETqsuUvEQ0Jjqjbbd78e0WX1WHTwQccrBJY /5USFRcvleF5IpFHWNxv3/0VRcAFqGiKC3X+wvN1tGjS995rb2U5/ZwzGGyaRKRdfvFlmL3/ vvtbIAP58WM/Dg3++dRZn7b7CeC1f4Tr5s+bzxiTD+O++K5lZZ2dyfcB2OniqdjTUmIJZHzw npn3mdPOIIpRfeeef64hKSzj9LNPP5ssesG/vvvXwW+Dr3F0YHOyXxGqegIEMjNaAUu+c+99 3xL/YPp+1J4OGKLVxV+VC8kONy8m4w6NYoYHIL4QZS655Argww5bcMmlC2m3++zzHi5aMHf+ 8nYlNlfSazv44PfTLuklJZbsKJ2dh5qIdIQqEN/5zjUWxTQfIVN6p7K+l/DHGjQdpRorAINT lvX6GMLfQQcdgkB6kWZM4grzqWMY+Tf84KdxKuP7woXn22zd/Pl7KMU3rrqCUba7+RCFi/9z 1dcJZOTqnJHVhdJ/7/vX+b8NRDSuT/2d/7/fucYCFlyQadaOO+wUCFFRivSzuC2l5V38u8U6 SiXKEMiURrNY8wU7FyQzOyqn6plJTwJEQDZt6rRt3rztu1yPkqxf3HlH+hrmN/LTZ31a548q FeGWa8Byx513WERQ4QQp1nkwKqTNmDrmxbSBfe3yr1kUIxf44q9dfPklcjuV3tm9XkA03gLg Qws+qAPVS7PEXuHE7jF/d7WQ4ms31o9iKpxSE6nVjA8c9oFgLO+XusCYIMuv0yBrOMk6A9kI WVNTSZjVKqCXPtf55y6+P5rKYdaLnh2z+7Aw9rEpHr8yHlvyKJ0prvnZs2e7bmBlSm7vv9j3 5z+Xnp1f8GOP/VDGTQTPJhW+r/tVpzsW9A2VcNGi6/RBhfm77pEOZIQtT14ELl36FEbqbYcg 1zqMis/vkQV8ieRPb7v1EbembMmSPzm/DZIdzBsmGOKE9dHMS4y5yOSa/3k8b01S3aJZJI3Y BxT2aydW0vQ/N17/Nx/6COHAH11Cz7yeXpAM0AgEBRJMFABxVifmfKQPE3C/dsWlivHtISql oxhk5y+8gPNTTz/lC0nDah69M7IYzVnUUzxIggjRkNsIDAkdO8p9/WmRFUxarOXRf0QstyBi sU3M7pPr22DEAJjB4j46hnoHwM8aV3CdgWwUy0Dlucq1Gi6nmz7L2WefS8/Ljw7M8sC9ZvXq ffd9T6YYbl8SI/hwAbOY62c/v/Xkk09FFEHzmm99jzWl9957lwqUEBY9G8DTI9EmjibTWhxX l/4CM79mSCXTAnGflAMaeljGrgBRNcDUmrS4horkglgxXg1wIbvpGe/CW7LkUT7okkeW3UEp dtxx3tSp0/aKx02g48wIeOSRhw0TscU0y5a9WHmMIkbGywW4LRwtjDF2ANneLKJUtxGTYwQr zu69m3sFOG23ebvRKUMdeYccGI0r7//d4lh4xUgzqSaAvti/X3Gpezgk5Hv40UdUb5Dxk+St WHIZxG0ybZPttn3LIW6awugZAGrb0Hk0wxvw+S9+3uAygHabq4r9XFLsDu6iWL16ddAztep4 4cUXCGR8tCbKWFJAo0JMeAFlQVZaSNlANkzFBTbVneWPhlSIGskE2RFHfFgn70/95BkfPfaD UW6zrPUHJioV9+agGRgY6O7u5WK/4Iv/etaZ/0Iso83RdeKjz3Jyl4CeCxc8mzj29navW7fO rWJVE6IYwWXE9a/atY+jcHDmOkd4Zg8roEwnLVSls3wMKmxBLI2AyMGmhi08EdUsJdVfejXd GiuxnsH7m940W53mSwNOtgdl0lgTEJq8BN7YAfKKQJbPbCwI+tnttxHIAHR0CUDuzjvKuJKQ /d83hgtEwOcddLiu/Q7P5PqqIlpbOGK8GUSW5wGEEsaMjJq33mpr/16kRyKgPm8EoDExyPWT ftl9fBrGwvJilV3H/vvI/eWiIU5a17jClA1k48po35h0HdNj4vOtb31Pfu9mzmQWn3BTxyBL 9vZrbl7827s//ndHH3H439jUG0FNn+UkqN1yy82Xfu3LGzb0V32oKG2nX4rRge06jIwxmwxw EYG7E+m1F1hID/E3d/2KuxNqrd/JMvs9SYYTIA9fNStm5Ft+HrQINvu22/zdFTlrxkx9Lo3O WsySMEAT5gHLY4T7k9t/rIsz0oyGgTHmNZxhTJgAmWsvCK+//+PvydVgURERs6YxcU6sNk4H 31WyA+qNNzmBAll+XSerR+nuvfdu1luR88Y3bq0DJaP6r0Xf/0ZimwdpDLbOyJHJMlhdYc8S tpdfXg49n7lzt91j93fMnbvN9tu/jRAJJSpWr1511Tcvl7WscuS2q9wMt4AWTpszcnJG5GQe LDAGxSeccAqDawAdkLJ+5cEHF+tSYZCVQJaykfl4OQg4Ol7VpOI8eDigFeGuu39DV4Ja4AYo tw64i6pi6awVyIc9XfZk1edzm+58km3nbmNrL5iK4r7E0mee1vkvuE86/sR81gbkBEULkmkF foG+v+j7X/cWhUDs56Z5h4kx2xqlJQxkjZI7zHJmsVP2Ktb52cSXtBBm3BkopWajhM8867iI YzxkqbHJZpOaCIgWExl5neKmz7iHmAyLFWHIXBrPPXGD1Sb7fTvp/ujY7XG34ChtcwEmb1BW wKIuxACZRXLhxjcGRh4/0HH34sX3nfPZTxeIihiTjhN6J7a4C5xmKlCUmcW4/nB3/5TRJYFM 71cyTqSz5peopCKfJa3OhPDomZ+bSLiMBYd9QAnO8NZepMmUxm4IMH1m2xZ58odYsr+Je2RC 5wG9rAg0w/wsX2zw7ISS6ZwdC9/0ZqjePmalmy9k4sD4QNwQBrJxVwBtBZk1VjWwxYUxGU8+ +QRRY/vtpLuReZx/3pd7e3oefOhBloYxnf/hI4/ec8+9oDw13gzLuFisQGxidMlI05BpgPUW 9GvoOMgqjazjgAOjrkSwcDeLtjwOf+VdPiKEUOMidYZbbVLvllt+mBbB/GN5I0aUksUcejeN 0SXPLem4km5aGaVBuUjyyXRZwkE6l16oYM7sOeRjmN2F9MmDYMENQW0bAd5YznWPSXDDIR3I zDAzyjCPxGLfnBObEMvMHR1GDWRPPPkEfdu3bvdW0xsAC89byINTDzz0gHbZTFFAlpcMvB2Q qbRiGo8lV7l7Y5qrSGSVFudJHg0w13pfeRnj2TADFkIPuzP6vAqD5HpgVLVq1UrFrFy1Sm9i HnrogjT95pu/DiRtMZUV2aI9Jga5ECCHVWwpyqY995BAKYO45MLdNKViyvXCYmfE38ILHCeJ YnnyDc89SoMNOPzwDxssl36pmqlw1AZ5Bmcy/uY3skiVH4m/OfIoJfjJbbdmUgbIwGorhwJ5 Z9wXMAZiLZl534Z+kK4OMTKAu13bAM+qVx9P0U86/iRdYsYDj36WwYQw90lUglpoYlFq9Ap8 4vgT9f7Dn2Kxt995B1nospGv7/gTjz8R87hluWrVKr0X7OcGwscwGU1rjKEFxapLNZ3SriVY 6JoGVnX6sYzlBSR1qSfDT91aFtW//NXt3KPEwo8de3ywYgN6HYJpnPJLsdVWW7PuH/o5c7cF /4MbFqkQhqJ+LGNQeeZnPq+zUTf98H98CZWQk8Q2LpXr1zvu+Ila+/73f4BH5U0ja4O/8pXL uBdsmDoAtOqnJK9eq3nEN996k2bp+liWB9qa2zRLoDq3/B6n0TjeUlGMbgsC6OBYUCDJTUyS 9INMtjZYzt+89pss3wX/jyf+o4tlTlXT0FFHHqUDZ37h/MdRVcJBBx68/77vCVZLkGUGX3nt N3kyCczJJ/6jH8u4EaHPaSL22/HOtww/dRs4sgKziWJKL/d23cJsW9eiloyfM0NLKz6OHa8H pjE9IeeaLeShyzvctmXK/YXzPqvPWhK2Dj7oEBaXIlGjCQCt6uuXX2o6WED0/e9fd/TR8hTR Gaef/fHjT2QdA7mEKh1REvW+fe2VRv/QQw8iih+3o486FiTr8hla8vn+f16njyL5QkzpnXfe YU93mqhagbyhYoEc7Zel1/SyAxJDZsbgPOegcd/Ki6mbbbYZljMzyGD5U6kRd4G6hmdROwy7 NIoh/Je/urOkinRD1wGaXaWpVpbmyFb13UXfO/SgQ2kAXP+sSmWzM3pnur6BpsWEusaFb17+ zZ/c9hOeXmThLo9k8zAjNBeedyHxgns+PLVKN1MVXOEm4LEHC9gUBCEIp4uknbv0FJgaitgr Y7ELndjVa9Zs5om9/Ep5gsUOniHXZy0xD/ufchcFvTAlQCkPHijsPCPmqKKUo0xkBVCash6s 8JWCEOs+8sL28XuolZ4jSoyI4tLcd+9dCvLQpfaMNMndN/a/5oIkSTDimrSAwpLO08/4JDPH sQz5ZrX6Nd/mZ1P6ZTQvpdcoxkWuW2kb/aJF3yW0WdIAunisetNBqAkhF7EEu+gpTuJKpXyV FqLjBzubTAUcU3QSTFyxERBQx0mCFzyt7ohxle+rrrqMZSWatvJK1+Dab37pS58jWJOlrqvw eBC/OMk5cS/PwEr5DFUPwNpXZcM8VvyXFIFyX79eCeAcXjxtfgy6hF4FZasigvCgj1U0sUCj GBNSp55xKjs4EhTgBGn7ArHqjXcUKAt4WDSKgfnMOWfoTQAM4uBBgu9+/zoHVj8tuvG/ecbA xPJwpYnlIVAioMpUQZjNk54YSZJAiQ0WxeisnXrGJ/1JOp+xuh2jRdH8/kP3S+oaX3bKVYF9 rtsgXTKsixcviqEuKWcHypffQiWdOKSlKgsbEri1FL1TpkKxatXKu+/mQXHZKyrdQwEJE0NF e7QT+rugj7foMR0uEDXL3mRugik97cXQ0oQEyxpMSAAUDGk0HtldVbHcuSKQkJnU4EfJWC6X SaBbsGkWpjLkNDKede/tnbp61crMjmRBFKtUTgUyqQIk0FL1rjwOm8iKmZgT+M413yX1n4u+ /7+v/HqMrnwblwGVvGwo8iD0QHlceXgTyeYTW7x+C5JMLfmPW/MY9nv3fy/4H9/2Yyb7HX0k jKGibbbBJJcfOyAzjTNnzNJd27g7yby+k1A5pev/PSI22sjsrnvvtrUgFR4Pwry9dn+HBlnP clNeIbWmlpFXoapAacMqeXbx+qhsOKENmXzamob4TJBAJqUigOlFTWHULQJoJ6bipkRJM5xB vpKkCKMIlvmrW5GfITKyJv5yv+xKlsPmo1Vr3BXzcyJNBYFMKaQgbsWDWJ4hIJITfMnPgXNB ZnkD4oxkyn1GM5qB7O/dbhx0c44/4aN0K8wGA8xMAywrAGKCUh6MiQMZiWQpQcIRCSumjzVW mkOMSSgtmcjUlYl0AkWV5aresQ1kZgyABrJxvfxCe09cns53rkMmV1+lFAZV6s9QWfWsOEgA lNCjqvOKNoUVG/xq97CZlAVaK23WE5IGpTjJXbPTNGlM1L1NZ1TFeC7zaQviF2Q5TJGA4lxf iw/THTvYPb3Ixj6ZUcwnLg2rLZl1VZFRJbtCmAkliltGFAxSy5nCxgjJReldiWNkhKd2XAey qOqcw/Q64bJ3Fe/qVLpoXlHywZBMBTp6ax8maVw1l/wyJXLU+DKWWzET/CObwK5GqmXLbLX3 fQcezIQO8HfiG3BVy+HbUcasMi6tqnSYBGqDO0c/bXVb5Re/pFVVWSAoY4/SVJWWY1V1DeM7 kHnFog4pTRS71B/VBlJh/PKk+aA5t7q3fLZRhInejEDHrXkFnnA2m4MLCBNZxT/1TDLqQhnl YXaMVRc166gSXCNnB2KLDfPK0IC6QrVKiYHAFk/bsMEc0Q0oxbBNKysgHcjM+pzSlZXceLqK QWZjUkkiclWok0T5qdo5GtjTUOWJgiUSMsB2COmSWo6DSfmI/AKSY4SFVIWZdbipUF5GZpaK NI5bcmxC+3+u/Ho6y2QWZBmNAgGlOcoAyJTGxwRCipOBimJiy3XqhFX11q3dBG6UQHqy34pZ n9uNvQFArXWWCGTV9IvwWhUkZYYO8tIN6T6ZPB1Pl+qTGU/S1JFIBVN4mc53DmapR7TKp1KE pOeTKQJGshiuM15fEXzJwEm5CZE+JRk5yUhAkJsQJIns/ALtKQkRwgmqeDpbbh5zjM/Tm4dX +/NyzQbrnxomVpj7nSczDx8LCjUYPcAEmOyPizEev82VwzRO5LhNHOXbHemrQK7/aNMcfxNH hUutBGyUtQWF1astCGfodbZHd5flbViuTQYNMzAvyHUeKtAcZNn1JXiTjMwIdtINr8yam9Sb ICHhcuWUJFMBck4wVNAJSGcJEiiXyORFUaxXiPL0pqWNAibh5VHQV01FemhZjWO08kej2rT5 NEKT3+DwkA0Eq3hLxotDgwODPT1TaOLr1/dt2LC+tbWt0nNx/CLc9fH8TRybm1q6ezv7+vqi 15JrWaroG1Z2pWOQLyagMdcGN0mLHZ8uSkVOFC+zLQjCqBKJ99hytrBbpzRpvUioqM6Bs00Z Nlb1Ei/MgGGLLCUg0wnG6RujcDG9MdYL+AqLfirGbyCrt+QjyJdXZ4q3S8y/nPx6iAdMupzE 5XBy3wMD/fJbPRhvHCSFQKqLXt71A9Y2ceTC7O8fCEKeFl44FRq7sxkQOS36SvRbDGdmxlzx d1yeNCU5mUgT5QNGaYDlmibNso4GScsyYkXa2fABEIsK0JJk3zq9R6U0PoVh0KuqzRjI0sb4 vAFsogK8JvNzyyqp27BMexqCnAxkw3JjfpvIEOvCkrTSxO1W11exTRyZTopjU0arovPV378h 3sTR7VKdoae2Rp8loAE480xGMfLFG1c+ieRUyMp2fYvlZeeaFr8IIElqlo9XEcaiRmYR+CTZ egUbK0hLyOcZmxyzsLhgxbnDN73NaxSeNLPOw41/MOoTjbTPnCPqVSJ8Se/KxFh6E8c8b0cD SZed93SRz1uvnb6Meoc3Tjcn6YK6KB4Yk/RDQqMlEixpBv1xSBAZawSkmUKKaulAPMnhyAyk BcpNsm7iqMQgi7kCIXnJfCGiNj83khfbJkOLGM5TNYp4Z/dkj6ysx6tWswpSslqrOe6FlTVm AtERalykznBJSZeO28KWqet0GcHgizQ+4SA3eFNMAj/GvoisxqTxZltOIBOD1dSkw0fRqSge JW1WxNL6jKOoXbkCjF4pikypM6+2eeYcpxDF6lRvbKXrxThqBszG2nUVsyIvkyCtJ4mpzfc1 l9djMPM8XAg620KT1OAy7KE4L53DnnSG50OPNQHmBLIEzVgmKGdYplrMGSZ7hip1/HBsSgk1 YX/n9q3Vt8ylqHIR7Mc9ZcpU4XpcXkY5Qsc++77nwAMP3m47dlvrQQW7Ff3+9w/dcMOix1Nb gKQMoHw5zdUjZePGbbfdLthmw8sX8DjnH3uvXZAbJM2rAV6T7GWCOuA///m5G25cBOBPYBvL 3x1/ksLsPau7NrKt9nv2PyBTOC9w0i0rglxNFrvAWBxQoTW8mVQTUBGUYKtNaqZnahOR0D4i iaqBLM/gHBeNiJGFQtUQN36J6MC48Ywk3RxKIf+IZIoJCHZfEVzRQ47Mi4EIRpRsZwiSN2Cm NwiqcKcg3irArmHCNWKB7ORTTtdXUplytl3kA/Lab38zczMfo1Qgs7w+DWGF4rM7m+0XRGiD wJLA6p+SgcwXnob1fQvg2RJOA1mahtdl2bNQuFcD2VZv3NqQAQt7uvKwwZcvXniPt6WdVHPy 0Ligt67JSV1gaY4k/winpHXGKpxtloqx3Ht1YEZGhaRuKOWPcpKqBrKkmLTtdepNii2R4prn lbJ25YcDlqRh0WWD2Py7WsZRKYGiKukSZpUjQbBJJbTyalwOK0s5GRlUDRHiyw0HDy7vkEMX aBS7ftH3b7vt1scf/xN6Dzr4r97zngMIoEcd/bFnn3vWDze+QGBXcbKJI7B/pyIgW716JRtV cjb86aefDVwgmVx/pYsxhoC5PsyQNB3Mww5dcMNN0ikLjr88LHxRA5JMGM94+vS8QIQXPrB5 4RfPu5CNEu2tSEZPG4ibnPy6OnyMcIKMUsVq5fotx1cXwAlBQV4iGSkpoNcs6AAMNhngAzst Kw8o0JXHYvjyvDUGMtMwKgDFMK9Rr+jUc65yZeAWYBwklCeXvnSGk+Nb4zjNuKQcCwf+Zaam QahFiA1MctaYaoiQqjoJWNDceecdvFlKrUfvTTcuuummRVdfLW9BZshZEG50QYm8z9wu5CyV dOvK9OyyWOvH0YHC/rfvPC8IZFqxvJ8J0UqT1pHex5FthRZe8BV2eT315NPYljrYWSinsYhg sqSBJY/RqdykzijlmSptWZMeMpNpjJGlHnDJsjEuIDWQroQshuHjCFDRIQ/nyMeFrAgWDKB7 GSXBgk6P6/cMf6pZDJflA5TYlbRkccUxceXHzop8YAUp6ROuEOZ0+AAUs/BCEzah5QOQpqQM rhhDRpamSWPodoG8072ACnatAiW7/fbbAPLeSMIrMhke8qFqCGQs+oWYjWfBDP+1cmxfzrSd /zIXNamms744Ztdd56e5eO8vMY5N9Nl3P52biSFynX7Wp3Rb/Q8u+FAmjSK1PdgZJPB4OxgC q4WBedKwh33RFwspzvUdZRaO6x4ZFlMkr45THTIXKqCJDw+MUTV/qwxPq5OQFRBNW0gsHIqD BCAlMlWQHCuJXCeecMree+9j+Yy/rrnmquDFApr7TycnZrLYd/+SSxca4w0/+CnwMcd8kBeJ m8CTTz6VF6PQFbKYa/QBsOUWW4KR4nibODLSDMh40xKBb+HC83nni02rHX/8iV/96oVQHn30 cRoWgbldcMUVly6Op5OOO+4TOkfGGwNUiEr+gTP7/YdFe5CBnD5j5jnnfMHkWBGUnnNWbVhm lKs0q1av4t1LDAkPO2TBD25KbPn/rn33h+fuu3+zww47VZirQcSy2+/4+fsOPIjXBl+etfV2 UoC1kSQ6mdLGk8SVTyWcUUYUDFLLTkOCubzOUaTEVC1UgwKZeWgEiq6yTTBJhXWsGTjNyAJ8 maRJNuKoWJoRJSwzG/CHk0LhpnYjg83ymLXYWqLY/77iW0zicM1zRcG0++57cgGfffa5559/ bhDL/vYjxzD7zmX5xONLeOEmoYo4wuvWr7zqslibfF9wwUV0NIhxZPEaJKTxeqfnnn1WXzTl UxqMdiQffsSRYG659aaXX5YdpdVyfUeUURrwkY8cgxZGoy+88Py+++4P/MlPntHTI5sgqmqQ yCSuWSAzXoAnnniCs4YqfY2Tn6tFUOF+EdJvSPC58uAHHrifQMboMghkOq7kZmVNgQwt9y2+ l0BGkWfNmGmjS9xVtfkUN4Y8+xuLVxvcOfppq9uqquVNW14HiwkZZiCzYg7HBjOmFGAqZazH UazZ0UASxpccVUKZzgIVa4m/Q6Ly8pUzQ0sosom+GFGMK/aCL35OM79x5WW8T5Oey6mnnnHM Rz/oc3DlnPPZ0y26sSaDCEXgCwIZAk844aO8Skp5z/vClxkY2hvzTKBv3ne+cw3z7jAyr8+H yPLQQw+yauFXv7rd5BijAhhz/gXn3u96W4sWXXfFFd8Cw2TTqaeeqHFQkYQqRpqPp262Xuo6 ktoXy3zjnF8E3g1K1KYIP/dejxLYU5D80a0//OARH95118Qb1G1cWfCizLyW8LPbf3qmu03B K0Jsyj+P2BkWOTug0ZubBZbHWX5dxbgav1GtUmIgsKVGcYXkOaLrKYUvqu45skJjRzMTDxR8 SltiYyu8Y58Kt1MhNPEn/nYI36MVniLIVPiAz8BLnrg+WRxw+RWX+HhimU4/7zIvce3dccft FsWg14lzej0+L/B3v/ud5S8vt8D8K/cuyNmzZyeKYzx0epub6OkwVFy8+D5FE32IpCeddPI1 13zvoq9cdugh4a09yDCGrpbKJNjpy0OZUAMOkG9849aKMZ1miWL4hbCPYn7wg+v9AKqTdxTB JNQEIIot/9ky+/2HfMAYdVx5220/8SvWasrIAiBNYJgA4KrzP5brC1Skj6kJNpk+UFUCzte2 4QBp2+P2oFwcegZodCDz3WZKnMr6TkGzrk8IXBan0hLE5JGrN3NIWnEhZo/d30H+Hx/+I6+h DQh1inr+/D18/J8ee9SCLEDUXSXwOtiSrJlyM/4y6c9nxcoVvpAQFiKJ3bff/pNzzvk082tf //qlLPWiU6Yv+iSoEdFOOfn0gHHx4nsDDEkWu6aRJTFUkNUgPcGSXGXIqJ/fuZdj7rXX3lpX cO27z7s4/yh+k7nJgcAOq1gDLEsBw6eBgNKSSmlJADCjcHjNX9zsJWtWboUNOPPw2jVIFzxg 16QJAeCwJHCbotR0l7vRnvRKCMaAIBNlTyQqrlAvVdIjD7FYHyVMeKVVMb2VRq4sDkkxA30s bjuS4naDHDE++HZukBuUrN1zDUZuEjPj468d5S7qgg8cTixjMu4HNywaueW4gW0vL18WNdqk 9cmUY9JiJPmVzD/fcNP1Hzv248yUcTOXn433H/oBOmjMNqoiozRA5blkYvynBNZTfuDBxbbq NWlCOqWsEZ6EGZ7THocV4BLKYltQFOsVVJ7emHxcfKuRem50jywoIL7JdFtANopJIpf/Mc0F ZhZkGXt1wHOFLaeoztVoiv7+/ilTpk2duklbWzuwiac16AeMtozWlrbp02dsu83273rXe3fd Zc9p06a1tsiiVjlcWRhyfuG8z2rX7N37y1qzBh76q4NAraxMyWGW2p0i9RyfyouK0nTfffJ6 +fcdeAjETPwDP/DA71izzCf2B4WWMW5FhKivpBQCsd12bwVm+E8cDLPjtJqUPsf5CcEpJUbV MEBL5fV6Gya5WJB5oJgsN1f5XfYIB7JcE8ZRhnnD3BoADbd1xx3nnXH62XyqSub+Y5pm9py5 IJ/783N0q/wOpl5z0ZVHGaKjAimC9VwDAwN0sewS5XI2IrtS6aqyieN++7339H8+64QT/kE2 cfQvYyfL5r9iXePs26tISuh/PEPFYfe70eWOO+5M4NzVLSu79dYbPRoN3dFZ8Z7sSi5Z79hj L846/A9ofIHA9pMa4DWpNeKfM8nKINNmGAZ2rXE/KlsbqE+4z+Ur8vFOrXg+icxOBUL8JPya jAKZn5ctbBI7wh6wxa4rV7yKqnvvvYuzXlS+Zsi2305WqP7+Dw+6iS4/swLbpFjQVhhNEpLo i7F0mCXDcTvyyGMZCGfr7eeeexYENw222mq2qEsdM2dulsKNDYI2XMehLZ+nFOhaMrrkbi/3 Z7mzwd1VzapJJuyMtWFhrK2MgVWatLOq8M++upJkPks9sKoPGko9gsaAR12E4kb1yGjiGa08 KlnsqTEo6IipDMc1tSh68MHFSn7ooZVbfgcecAhILie9+ciZOXUuqrPO/Lwv29ZkLFnyCJEl M7j49Pq0ltUNwYvtGOmUwQjsUwYwBMQ7JsUYJZH16U99Zu6cbQKasz7zedZVgGTvDc7WqgKy mpKBY1n+WpZdbrHKh1kqVvzPnbOtJvVcVch998kNikMO/kvODzx4vzTnEo3aVKCUBckseYGd tXI89m96jQaAwz87ROJkXIpV4gRFLYlAWsBqrcI2cTTblLHMOZBpyXzV4tb8XBMgQECmSeVH hDYVkBzDXEfmZEyeavQAM8oEKX66P3bs8VOnTOGha9bNH+FWnLJwwYSxgv/ss89lEcYVl3/L FsTSOSLY/Ye8Wzt/rt5EpIjgsdjn8QNW8B63gN+48nJGwei95JIrdMEtSMa89BaJs8CLrv/+ SMz0U0zkX3zx5cuWvZi5mkyMyzr0+QHurvor1LS5p8kNzzIOXE1cRu+tt9xkeGMJMPqkhOUa wLq//3VJ5YEKw9cEoMuijDKq9gBpMgPbquIhqIhyo0pNVpAmYnwDGKw2h4HMPNL4IplodU3j FYxvl6t1sROYJv+se87m6KM/ZnYH1wCdsvPPP/eYY+SxHlsRRii58qoratrnx+QrYIHMw4PL rQ/WXjDaVTMYfPExRjpr1333OzdmbR1hNHUDN998EwvWiCwcoZDYjSF+GGmee+dRKnTRNSuY p8/TQPh7+OE//uiWH1Z/wMCMz3W5KIEqnZ9GmrA8wzLxJtkB9GxG6ajPWjFOOc1QA2LDm//y sP1iOPGdokzk5iRK2RlJ9mcXc8SBrsuMfHGNzvHn2gtkZ5TCoRiP2HKwgv0UWRzLwlHkMyal N5chrUB3Tlapqkry+tauWr3y4Yf/4C/BhbYOmapBGLNKxZPhFPzpp58Kt2+spomnNXn8gMc2 kyUokcoyw2fLrPGQKUwnCyf3Pl0BislirUZlQJxT/TvTTybHAZUoZvjqcrMoMnUF9ZpDE4oz MgXEMAdVbPU42pqHeEdvbiCDsvaCmQGenhQYiZ0MZCnPlETUXi8ZgktVVQafQ+Uw56DzpAi+ wmKlqqCKGIuZQ5xKAABAAElEQVTz2F+IZxiYwi8my8g1MzLyBDWGgUwtyjSwpM8CXi5BH+PD OaUvQufYkJCaQxOKNTIFRISDEubGTBrIwqFlnCvf8Cas8POGD8drcjKNG774cSXBKqbiz0oV lbW0wluWo4hOpZlhRaQjkxfUO2sjGlXAk08+nYFePVGssKSZISzkaFQZ8i+9zIYTqPWrNchS g60X4UsDziQOyugLD7KSyUhYGfqAxpLqc0lWs6wokCXNGptUpUhjo39S64h4wKqV+NWYwxp6 c9Njjz167bVXNkbsyEsxwxuoqkAmIaxRLm+gwXWLoixanPEeyOou4STj+PSAfxWNxCXFNczN B1/L+PTDaFrl4lrFJUGYC5KjaVgDdTU2kJlPKl6ramvQYxdOE1OVeawJbHwUlKKsXeqncuU1 n5YjL2tCbXRmhMeWhfOyPTCi1F5BeTZPQh4Y+B8X1Sw+x62B5MCAHKaIqjg3EFVfsmpJYxv0 O+GVOKuiOZFdQZeEEvJKigrIwmRCZGiGT1wlkClpobRQetW0qa9JLFw10Vc1Y5Ig8IB62GpH c/G54evzfyAQsSPREQvKQlKtTWtPU050TLpeqpY6zTLRnVAlkGnxtCmPTlHNxenKGE0zRqew o6wl7VIM8JE+rLYpxj8X2JxmLyAenSyaE1bpuYEarZXWJNOm2GviqoNYzcuqjrzlglm0GYrr K3dCUKBJkzXJDSSo9FKBLGHIKCTqKFx9VmW6BFE1+bU+1aPFlVfEiv7qFBXaWqFRq8kCw7Qy OddU0OIRZYG6oqyaLCgSVCpv1FpxA4o17IYyloFs2MZLdTZESKl2MdGIMppXCpVC1FPIAiHB tVRAWY/iic8T+GfiF2jMSlD02PAwjKKChltH/CSmPxK3/I+Z6CPLw8YeAJkSApoGJmN17GzB lvwsoB++bERWjlh+BZP0ouazafXxx33CaMsDJjbNIk8+yWhG+jd8Rv/wW6EPVywR64bfWhNC GiWyYmQKSrs6RZKNSDM6jFxqcRlCwLsQExeficrW5LBGowDhJsAoLzfN5JMjKJMloC3bI0MW 5RuJw6wfIfkjYfMIyWRni113nf9fi64z+ezCyutv2bdHH8/mQctbbvnhz2//iREo8C5Hpk9B 8vwju+MjRPbINue6BnTkkUfvv9979bHNp59e+rOf/dh/Jy57zJ500smrV6/0kYEiTbLidPbs 2ZlZivz2t6+SPfsHB9lq9S/23m///Q/YLi4CO+TcessP0y/05XVwu+2+p9nGQ/LlHzA65JAF +tpztFN89gJjHZm/r79axZYYOFPfwqle4h0o6ccq8dJ++1e8dFvSSyqKvWT/esGR+oIoMFov PJSquZPn0fdA63ZvmV1Sq3dRlOQwsmGwmoxiYOQ1FOv3Q0YBJWbmWcpl9jd/c9QNN/z3nb+M NsBgc6tPfOKULV6/xYoVK3jeENa5c9/8zr33HRwYfOih35kWyP7BkXFxQjZr1qyddnr7Hrvv 9ctf3rF23VrIVClvGzrssL+aNm0TQhjvQJoz580777zLm9409xe/+JmKeuqpx3fbbc93vGPv H//4R+sco6kIgCOP/FueY585c1be5957fvPUU0vojn3wQ0f//d//w+vjIrDzypy5b957730H BhNFuOzr39pjz71829761rf5tgUG+Emi6oc//LdYYsXffvu37u4VH2I8QHj6xEmnYImR4SUl W7dWvKTHZ84MvfT2pJf4uSWKffGCi/bcc6+enh73+oK1271le62XB716iUXKt+ttuG2GfGwh rLWW11rSrEqfxg8fU94GdJnZZo+Psc5KSZkmpKAULc2yGVkNgaxAVrWskmZXE5PONyelsxqO KXRqxZB6y3rWmedyJfPmN15Vje08KP5P//Sp9vZ2tqP57L+c/qMf3bjo+u/1dPdyhb/97bv8 +te/fFlehtTEaPQzZ5wD2X/FZD/+yY+IYnRtXrf5FgQpNUejJA/uXHzxwn+/7KIf3XLj7//w EK/bmDt3Gzbmt7DY1tax117v7O2ddtdddxb4j7dV3nPPXezVweeX3ufFF57f/q07ECi/ftlF WoSTT5EiXH/99z73L5++9ZYbr7/+u93dvdAQQynCK69IEeiLEcWw7V//9ewrr7zslltuvPnm GwgxO+64E8S//e3dBZbw0nK25YDg29d+87zzz6Fc3/ved4iA8O6ww84klXfm9JlnnC5ewpmf +9zpqCBYowIvbe68pGS8upzfkkwv+ZH3bz/yMaIYxTz7nNP/33XfvuHG6/Eh8c6vl4TN0jhq i2IJ9tFKWBsOgJr0a3vzWRKYWHQC6VMn4TJkGsiIZTUcZeTWIC5JGpcxCurJzI08Ra+Ki4q4 YAMidsFnOEn3gfe/WeH1XXAkbY98BjiQ0S8gS2uHEeWFC8+Dht21eGuk/gYypALDxji2yQxD v//8TxnDHuy2EgTg4PlENPIyERgVk3mGl7Ehn1+4s4N/zM4c7zvoUKLA2Wedplz7738gti1f tuwqbIsXjzFgBAPB/vu/Vydl3neQ7CiJMYhVRnZnPcsJYeymmLyzlgu/+cPhL37pc0QZ+ozs raiMC2Iv2XAVFQvNS3Mjskwv8SZ2hOiGiyrtIGfw//3ONbYLG+EMG8j98JFHKc1r8KzX7+gX nBbORzY7LvikzarLXNOQljfRMFp+zg09mLpCnu4c7wtmT0E/CRxg9th9T5APPvRghay5iQuM eARmjz3knXIMhXRi6N777qqQNTXdddevSbIDlx+2dLN5ZrV8yjLwqaedSdj61tXfePnll3z6 l1JF8DFvn7c7XNCzl6HPRaAhOmPbvMJbH0y9waXvc/PZdR9KKwUvKiaXjX18GrYGirzk3rzH VrSZXrrb8xLtmFsiGEy8jn4S4qa9ZMmfEL799m8DMZqHtcdioIEmFStK5/qqo0n9fB8F7D5v MVxbj8xkoW+kj7qLNNKGNVw+HQed5PZ3KJR3izQ1bbXV1gweTSPjTToaJB+J3xGpjOlXRi5d +iRkjC45864TlWBdHk2ygSoXJPBb37qjYjjrKymrdoWMXgGm24kCTOT7e04wE0cuRZg+fZbR EzS1CGrztKnTNIvIZTQ+oC8l8jE+rEEw71V49uqWYi9t/roiL/Gr4HuJKUsM0FcO+5awOxtJ Iq9fXz7BRgDrJTk+C1JnIKu3MPr7VS/3Rsqn/SY6IH75brxxEaMVLtSvXnw5A09uX3I+93MX QANeb5DZQo3KfUz3C8PpcfdCTL23uO2228EVyFddekEyBW6q9X5i0E2z3BQgFTp9+syPHvtx rvZvXnW5T0BQYwaNIrBd9YeOPIb5LM6f+9wXoQGviuwNwQjxeYF7eno59/ZODfB+UkPM1Dga WlZv7xTgzTaTF6OYl+hDBV2BmrykIUxfYRV07tBie0zuFP9smDHjAdAYNMzzSBQkMKluFVWW XwQVb2pUfV6ukW3MAC7gaIQLprhr9cUX41GkSm5qYuL/4osuo//ib4dNPAKPZqi4OeCMELiB B9GB6MPWrP6e9wXyFyz4EPTXL/pemv5LX/qXL3/l6xThqKM+ZhIoAnhN3r/4blV3wIGH+PNc jCi1G2VcmQC7S9MT3HnneX5nlqH0/Pm7G/20qZGXIkxWlck6t3JHb48MhMfdEe/mZrsYBBZm FTogqZ4s7aTqohpOMco9svrtx4mZn/oljhvOHXaQkR23AgOLNIpxndMF43YbZ2CCAu8iyR+/ qJMCSbUltZum/biqnAwbmeOH7Db3IqWAXqMYZtMFI9Jx1iJc9vVrbLz5o5tlduzww49khYSy M1A966xzfVH01+jQ+R/twbGqDjJua7CUl/gFTAS84IKL6FEqu3/tNcA1vk2T8HjyQJUeWZ6p wwvwAbff2PIUjle82R6UqdDeMkwfP+4TxCxmo8/9/Fn2qhHmyBZeeDFdlaOPOj7jVT3xncFC 5Y3KjAqs3TEiVLo7xroKisA9ys9//kzLZY7sSxd+lSIcddRxl166EGuuuurfmcz6i733oddm HTfiHTNuOvsODdN8pyffZ7xw4fnubulPtthyS17CtmDBEXysbAR9otvqNTIDOMwjt2KTGclU VMNVOnpl2oH7/aYISfmpMuUvi49ITVeKNRdRVWYuZyWjDrUV5qqQJ33C9MjyCkVZ/E8e2YTD 63T7TTf9j0UxigDMEgqAffbZl7NbJSslS3fQdJLoiSeeIJcXhXDWKScA/1Ckzsr7+PKwdsd+ ePMP0iz77vtukDf98H8sipEE/tHNsrzrnfu8y1gYaf7bwvOIPow6+dD9POGEj2qu3hNYufJV zbIzGCVgQHrKKSfwKknNAiCp3dsn3ESheSk9DVeTl/T2i84AKKPZD2BV8ED80lI/dxIeaQ/U 2SMbabMm5evgiFdeBq7Q+5XMSYG3GEeHJfl8TPPs2XMgWL16Fednn43eFh6IIqnzUM8+uzSd lYNJ9AwYA2IJfS6mutL0M9z47rlnnwmyNDZpESyL7tXtd/zUkgBbbfUmznpPgPutwS1Xn5Ib i5e4zp0hj3TruVSRrfbCS3d4TxHRXZo9ezYs6qXnynlJQ6QymjoAneNnMfPy5bLKt7aDn2I9 Et6NkY34zps7a4TssZBhHouVj4ceGbWX+Ylt3Ni/9RaY3g6zsjK2At5yyy0No4DeodNcMDzl x3mXefN9MmaL3vIWuVOpLwDnbp3SswbKJyMMkWT0GsSImTPlZp9GAZ8+DbNAH+S9996VzgKj SrfY8g1BblAE5tH4BDRMhxHKGV0G+CDJ80kXfeUy5sV8PMXfddf5aPdW/4qceRlekrUsOrsX eMlapDoNL+l9SV2Lx5DZumCqWqvgvvvu8S1pIMyVG3waKHw4ogKrguRwJNfEOx4CWU0GVyEe Kz9WMaswW4d+we2w++67FyZdKOtzv/c9slRVcwEefOB+zow0/euKeSuQDLWsM6L0PFkN3g5N 8oS5YRTQzqCNyIJcP7nLrhJAedmHjzT4t64I+7m1voYEePd7DuSsuQAMb4kLrMwwGsaAH/mI JHUu3/A+oIEGDLwHH/R+P+uEE06hu6djcPA0iQcfjLzEqlejZLk/cFUvqcPNS4QzXUbLMxUm CufrYP8Xd95uyElgND0wOs9aNqRENMhxfFgErd3GNWvWHnLw+2fOnPWd//iWcT/zzDP770ev ZNa79n33lClTZ8zYjKcgjz/uRK5b+hqfO/dMfSSTp5R3321PFoLxfCX75Wzx+i3/9iMf1Udt Lv7qwj//ORqZPvTQAwcfdBhkb3vbTv39AwyyTjrxFERxTX71qxf6j4jTFeKhbvBXX51YFGaG GTBv3u4HHngIyUsv/fK6dRnT6s888/R+rgg8w9grRZj1jr32+VhchM+fe6ZykUXPjpukU6du OmXKNCnm8Scx5qU7dvXVV5i6TODFF184+OD3b731m3i+sqW5dYcd5x1zzMdZl6fl4pl5bTQ8 TMrz8BSf5yuHhppfv8UbPvKRY9Ne+v1DDxyU9NInYi9d/NUL9Ql8AujyZct5RJyHXnn0dcrU ae94xztPOflTLIWhd3zVN/93ws5a26y1IgUSssJEQDtWydCsEUoHxfO00Bfj0/z+w/bzkOMZ pCjDPWiFI33UpMKIL/6KrBe77OuX+uuhWMl5zNHHgfdt5hK9+OILbfklWXQHPnvOF3wyYtw3 r/6GLwoypJ36yTO0t6UCn3566RVXXBqMKxms8awlU+Z6S9FX7WAzWR72XrDgg0yQHXts5XZh QM8TSEenigALccGm1ZDolMrToHYQxS666It5y/0hMztYtHHE4fLAqfFSrsvjclmjoZd3Tuil NVdffWXgJUapaS8hzRyuev8mpZQo9pWLviRbJ3lHlbuWXik8Jg+0Qnq41yhoFZkqf2vTEJ/J QJZyzPAQNbU9I2bVPmsIuG13wZc+F+gnAM3fdQ9FMtNv8z4VMidll112n7+rrAJdtXrVLbfc xMPnVvXsbQhek8z46Dp+7lTqNWxkKpB3dBPsuPHn32qs6KoEEA8XC0+gvAThTG0Dx9Sbzt9b vjqBZRk8ZK7I++67KwivRmyAcmmSSTHW0+q6YisXWZWixdTEqV3nizMZzvN0J14ygT5gXuJO ZRDpdNN7JPP7ceABh9Alg5FZwt8uvteXoHDVQAZZbFqauxBTJ1uhzNHPrNRQ/bonXCALilqP D0ah9mtS4RNf4yLI0cd8MO/qCspfSaqU5tAhlvYDWYUrhowMBNP/J510cn53DBLf5FiEHzIq uLKQJ9G3pQq7x5VNmZDlUVcNLh5tluRkdvFaq6q6UJCUl6UxE1cnW6assUMmKqlOMzSQbWyT /XU6YxywfeNKmZPyp5BH3yim/5mAm0Cv6R59F01qHJ8emLiBjJ8k/zM+3VuDVYwZGVqy15U+ alMDJz9rWb9s5h0VFSTT8pnmZ6KNfcEKZqbSXHVjqtpTRnKekCx/lJGXSxMooiOmn2yGeJf7 7NyGYLXSJ/q5Ia5wQkbqrqV5uHGmFksq1XRLERXrGclc7i22t3euWbvG7jbWoq1s4QI6S3Ir k2ny+rpjJqQWg9O0dYpRNmM2IK1AMFWys5kMG3PH35bhA4WZPuEEgilTwz8NKf7I3rW0quSn bFQOU1hF2wjZU5/Y+rhySljggQw9aeo0JkeRojNkGn2mqCKGiDOTz6RGQLGcbBGOp8yMFToy 5QvSZaj84qkxrvhMIWFJUun6uFJiEohshyRIxkuivuLrHNmIPKLk+w64Pvtq9K4p8ZVnyBgt ezJUT6JG2gNV6r5QvTWgTCpPsgdmkk4ix8IDDQtkBdVbkGVFLm5GRjYJTHrAPEC7smZTpo0Z 4ySw8XmgMYFs+M3Ib5TD87K1bRUzfNOGZ87ocVPwvMIqPvDMCFpWo6Y8s7MtDKiDZDbPMLBa FtNSXLSSo9dhmDN2rDKczii9oM07Y2ddYwLZ2Nk/qXnceqCgdWdcD/UVo0BHfQLHlmsjK06t zvSLX2sTaUAg89XXarpPn5ZTa2F8aaMDjzMLWXYuXkx7Mu0Ns7wMcZo9VmJiSqpVSdk6DesL zVJdM25j7ijV6oyGOxcDysi02q3V4AJ61eskDyuQjYRtvtnIL+MinyUFe2VN5W18CDr/VW6o 5Ze5Lk81rAn4ghpR7/nlTOWUa2O+gSkREwSRVYZypc8vYOZ4M01ed7NMi8rEDCuQZUpsLFJd P1xnN9am8S3NNaysFluj2Zk+b4DcLDPSYsFkGpDFPYmb9EDTeA9kWkXDbtZ2UaQvmTobgUms g384vOXUqYagsM3/9Ml/7u7uUiyjLYBm2QGFg99L/WVlkxtQLU3Ng5KJGE5DzbyVngc2HZFw aZ4TYIoiXS5XkC6tSKXRwCRqwMa/z2QpMQvl5XFs0dbUjE2DyuT0yiL65uYhyVchcibtTG5e u2bt/7p4oRQifagQ8GpImiAfY6xKEiQDPsmtXUUgpLHJ0lvCJuqosTb40qgvSVKPPrZuOCVl YgQy8UDciOsu+2uPkdpOXF5Tens7OzsJQBJHXKgiYmlccd/gJWa4k7Q4+RNiwbkQ4yCJdTG/ +JTMiNKBEuUUg2gXbKIIpbQSqITJqarUqTVMyRACDkKXSJLDGUEARaKzyckQCvaiapm4j9lp 4SbPGR5wTSgDn4eaMIEsrwCT+EIPVAIEZIODEmUGJcBIJAIGSUoDhKaIFcQwfj8HHQGRhDjh Yh+09Mxcb0yYhlqEUkKYRDoX61paIWiBQugGhgaQQb4wc5aYI+pc8BLupkG1QCWS5XJjg8VG IY44Iki4Y2Mkl8/gwIBQTR6vbQ9MpEDmGrP8IA/jUG6VNAwxGaylZLr+RAbzyKO0G0W8kfhA AIrMJU2QkYSM5xRNlAEmZLTIII9DAhJZLdBKGHG4pmbi1ED/YHt7W2tr64b+gQ0b1q9atWpg cLCtvY3k9GnTerq7+gcGhEmClwQ3wlzU4XKRLKqMSLv6RnGRnQ4lwVLUy0n6aEIeB0+R5hBq U03nSFNVnriDWJVwbAmiajEjwrRl1AvIT5IcZf2Wqcd150VIvbUWSU2ZMpECmZaBIgzLlZn+ fW0gnd8qLcgFJVqUi07k0QmSeOGCRLPGMGA+QkIXTWJGc0trM32uoSeXLn3u2eeWv/LqG9+4 5abTpv3+j488/+fnXn351Rdfemn9hg2DA4Ovf8MbDzr4wG3nzO7u7GxrbdnABtsDItmLhE4V Il2kQ3EMSiOVEAZGvqzNxyBmajtWusnW8NpovcWlnHiBjPKMs1hmV1Wuq71rLZPYy8+VUWeG r08ihYiROEBUEFiCkwwU3dCPnpjrgrls8bL8E9H0t7iZUNTe3rJq7Zr7Ft//2KN/6mhrXv7S 8gfvv6+rq3vt6tUrX33llZWr1q/rI9gRtV589rnHHnlk9ty5b5r9pjdtvfV228593WabDQwM 9A/0izyLXmqGs0StcVY55WKkhSw13J05NUvPDiax0EhcevgnlVtSTk3EJWXWRCa11IBDxVQp TZAdqA5yG2BULSImZCCrpYANph3b2hp+Ybju3cVPkJABpE75S4sklkXRA0AjF18a2qRfRnjq 6m5/cunTt/3s9ueeenJ93zqGn60trStWrOxbvx6WPnpiG/ohA6BHhsiVy5ff/9JLD9732/bO ji222mqX+bv8xV57br3l6+nTwTI4NMho00VTFKORjhkxM3Kwi3VaXIKe6wyKWZItoTeOcDJV p1RZZynTSB+joGKki1BSfrqk4+limKiBzF1tJWtgksw8IDNfEgukCWqnxkUFycej4lSZg3cd NEfnbhRK7ODeYAsdsRtu+OHSJY8BE8Ja25o7O9rXrVvPjJgMPCXOyLKJtta2wWbuKwy2tLmI 08Lc2sDSxx5d+thjv/j5L96+2y7bvHmb+TvvMK23d/0GIiBKozgl1JLUL9HPx/UHI6QYotnk uIFwzCEFmDxeyx6YqIGMOqNNy/U4Wkd9uspxyeWZPMrxJXmqpui+OE3EiGjNAmpkwkl7YDIj RZYbrElnRuIZMvnv6Oh45LEl3//ef7347LPErcHBAVnG0d/U17eeGLdhfX9rWys0azas6eru aW2RoeXQ0EB/Pz0zbgkMEdS4J0D0W/HS8z/+wQ0/6+j6w7v2PeKv/3LzGdPX928QPWhxgcmp d3FUgpazTDwhUHRr1ZEKjpk9jWXAo344o0Zd6zhT6OrNNRFxhwNKX5I6xwGPY21AwSZwIGtA 6V9jIogFErek9bhOkKx0la6UhBFO0gcSjPOKRDXJaGpqb2//3UN/+K//WvTc088MDfa7qXmZ L4Ny6tRN2lrb1zSvbW9v5eWYdNM6O9pY49HSSheteXCor7urm2i4cvWqvr7+pqb+1taWrs72 ltame+684/nnnjnwfQfsuvNOHe1tgzrfjzpdiIuVLqiKrRKx5Ppw60DEWATKEFSiXxTynMGT p9e0B4YVyLTJ4z9pVK+5o6jQ5pl6vRIIr0deIAJLpD/mfgOZV5Koxckti3CABjhCGotkXSCh HzXU3N7a9syf/3z99f/9xKOPMFUPh2DphjU3M4QkcvHa2jbuAKxejezu7u71fXp7UpZudLS3 Dwz2963rc1NmQ+3tHTD29/c3DdBJa3r84Ueue+nF5184YN93/sWMTaYOuGk1bUpEqein2pXb FQSIlW0KAguBfEksc0S1ODqTIRNZi9SNgNa5V8pRgzOMVJmribD8BrtrWIGswbZMihsVD8QN jhboQB2gOZCTa5dyam6m/9SyYvWa/7juP5c8/AhTYhs2DLhQMsQcWU93T2dnB/0yQhhBjejF qjFGnevWrWP+bNrUqW4if2j9+vUMQnt7iJz0/Zr6GIXSpXPL0phZe2X58ltuuGHpk08ecfhf b/m6zcGofmcGQY9eGaQym49B3FEl7hK25D6CHtppdBbHqMnvsfCAazy1RL/GGzkZyBrv03Es 0fVjpF8jsUK7PW5+jGDAR/AEB/4BmEWj43Tjj3700OLF6/v6WOba0dHGpFibLIBtIcl4kDEe wa6vr6+jo1NuWm4YaG2VOwACsdKif4CJfrptLD5btxZWJtRQQdwbamtrgWA9VCtWLr7rrg3r Nxxz9N/OmjkDFmeJLM2lxyVnhVySNDhEuMOZKlCMUPTk+TXpgYKb169Jf6QKrZe4XNqFh5Ep UEhbR6aEGO9TSkLakthIvkWYjM0EJGoQLsCAANZfVmJN+333/+6XP7+DpV90ztazqGJokChG R6y3p5fJeyhZe+FGmTJUJXZxE4BO07p1fat4kfeq1fTO1vdtWLNm3SuvrGBBrItiqBniwfWu zi5EdXXI8JRw+McHf7do0aJXXl1BHNRYK3bJv1rpYpXEV7FOTI1m0ByVpEfgQLZ+krKlT4jG ckpNRkkgqapUyiSXoi5LpCUsV8jaZJalhs6MyLVDKZzIyR5ZDZ6d6KRS766jQ+vncnSrtqIO jvR+3Iy7u07dsK5p6PElS3hfL9GNcWIrc/KtbW2dsu6is7197dq10gNbT/DaADX9t6EhpvN5 aoloJo9ptre20GWjW0dsgx1aGSgOyPzaUNNa6aS1tnR0tsuzmSwoaxp88P7Fm06ffujBB3V1 dkqocLP+2KmNWBBitAwrZWBKUoogAdR9SEwer2kPTAay4Va/XF8T59ChmYwfJTLw3HccByQ0 2KitiS7YqytXPvnU0sF+VlAMMinW1d3V292jHaQ2elMbNqxkFp8Jq+ZmhpzMe/X0dPL8dhcz /B3tzJ9xy4DwRPTr5ElMptLW9vUPNa1Zt27lWumoETMZoDKQ5P4A7HTEBvv7F99z75w5s+ft tJPrlUURLHKt9B45JHKRIVYLRmhk8Dnyx8Sq5ZH3x7jT0JhAptU8Gg1qXDhwzAsaGFDDVeY4 6SFJ18bB3IOk2yRBQf4dQAjijuUdd/7y+aefZiaLiMFrg1mmsXrNGsJTV1f7q6vXru9b39rW QgziUcreri5GhF3M/fOs+NTeaT1dHUND7TxFNEAE6yf2sIq/r7dr3cDQ+oEp6zb0v7xqzZ+X v7yubwNa6KB1tE+Z0tNLuFz56su/+uWv5s6ZPWPT6aLXRVsXaOMI68KwDCsJn1GHUg0Pm0UN HglZLR04OfKXZWcCw9QbsKcsyNQ5osjAhMDAhGr9QRGGkCoQkuBqVKIxgaxR1kzKGXkP0Ko0 HtDcCFwy9S6ALNOSYSdjP5auPv3Ms089vmSDm57vZrDX1dm/YT2LxXo727s72mc1dcmtR3ph HcyXdU/t7pTulyyyHexlHRk7XvQPtCKKNM9dMrOGXIlZrC9r6mrvnNbVNaWna8mzz69eyw2A 9avXrG5ra2LejY7ZI3/4/S9++ev3H3IwY0+36s3ZJk5RIzljbGRyHFpG4zoRvZPHePUAzaLN NY2KgRt3owgKWyl2FhQQW1JdZMks1tpwaVE11kImeVqqWOWCgAtXwiRjOBcOojXyrp/Dg5B9 PAO+agVLL9bw+CSjPya3mPt63ZTezaZ0TWtrncIdTJa1trS2tzYT1xhLciNAhqNDTcS7oRYe Tmpfy11MouPAUFdLywaGsNynHBzgySVW+jPGnNHds27WjMefe5FlaYhe19ff1TXU0dUzuGb1 HT/92VZbvXHXnXceYrlZpWSyUNdNsGGwK5rkESCJvsTQUodjy6DMw2eQ5qMaIiQQH8isOCOg c8maiLMElMEFJgxbJ61GjQ8Ep2whP1AWkEz2yAKHbNRJN0Rzs2GuDxZHMTpTLmSQzXL8gbVr V//5+efXrF3Hqq+pU6dMmzJlQ/+GGdN6t5zWs0l7a3fLUEdrc0cL82QALUxwEUjaiDMwM6Js p2PHyowBJK6VQWUzo04CXnvrUGt/U8uGpj4GmxJNh2ZO6V42pXvlqrXSDRxqom/WRf+ut3f1 6lV3/Ozns7faavr06dK5c2NeacZRW5YySEzj7OS4dWYbda1NFq6EBxoZyCxk0shG+jBdI6Eo R3j9xcoRmGt7Jn2N6tPksisrWBezCAVEHAxAlXzp+lWS7JDILvjLli1/5plnubPY0d7BfD4T 868ninW1dTU1cd+S+fuO1iEiWDtb+TCqFFFEFYap3D8gXg01rR9gfNrJJBr7L8qjAE0b5AGl pk55kKCtn9uZgwNdra2bbTKVHh/yuZmgj2S6mwctK5Yve+mll2ZMnyH9rchJYrilUOrQYBSI iEbkq1BDbN6IaA6E+roKjQr4Ri45Pqxw5Qu75ThLPyNX+gknWR1CpelnYtnvV6gLYUQDBpJS 7y5L2qJX47JGn00p7r//gTWr1rCav7OLoWETvadNujo6mdFvk/DU2cqjS249BqGOCNZCpGvu YPK/tY3OFbcOWGXG8lnm1rq72oh16CDGEfMAGY22tzV10ZVrbprW1bPJ1N4OZMHf2sqa2T5W aTQ3v/LKKw888CC3S+lyRfHLBbQ4fmlNSJ7FuZGrFM85I6ek8ZInqNl1OyIMZHULmmScCB6Q a196McyNuahAmkNQEuToPfUzGb906dNPP7WUGCXbWLe0TOls23xqV2cLkYhl+nIroKVdgxfz XoQgAh1dKglhTfSumN9nnAmNRKdoBhaK1lZWljEgbSGTwWY7Dzm1Nfd2tk6f0ku8Y3Uta9PY QaOfp6DkOaTmP/z+wWef+7Osy5BgRmx0Roul2mKxlktVOpXyN3m85j2QG8iGE9GVl/M4ORpr TxnPmMYyxCW9NGyZLhbIVa//cWiopGUrjMGmwaVPPc1qfva07uzoIFZM5U5lezvz9OzMI525 VpHAinw3rMMoBqyArYNM8jNghb+faXq+mMZfL487yeIOeWCA/RQJWG3NxDKem5QVsa3NTT2d HVO6u4mQ69f3dzCO7WDZBqGxeeXLrzz22J+cCrkhga0as1h36+yVSOwGyiWdV5rMvFyNQwmL qUxYTUCxTM31BRbQ+2TAI3pIfbjpTlXacF2uCUjbtY+vIjeQ+UST8MbhAQkH0gyodI1ikqS/ Q3dHcmRI2MGjSMuWvUgHilWvsvVY37pp3R3sjMiAVDa+IEINsPOivCRJ2q2MKulusdyCJ5R4 HJzuURthjKc0WUEGO9v3q3BiE2sv6L4REtsBJAkrjLJotpuHldqa1/WtJQJyM5S7A1jzxJLH 5Il06fCJca7v5TTGxdDVcJI3ebzmPTAZyCpNwH6+KqiNDiIcuLcZ8S2/0G75hZxJgHL7WPSv JnzwgBHvSOrvY1wp7w5hdzEO7ggQ0gabZAMLYhrPGzW1yJY8bFvBo5QOyaNI/SzSl10uWL4v j53zxwNOBC73sDlraLmDycY/hDUmyxic0g1kxRjhjhhHd6yJpzJ5WpN9Z59lgPvUE4RXsZlY FkdbAfnIvU/QEpStlhpZg5Eaky2AyRffjZvDt2pUDWugYhVVo0u1ipSpyl1L80ulsdSiTNnr 483TYyblERTia7AlVuQ6AK4RF0qOMmOuMrTDojFFJYsEvetDSfRxiiUMxEIEJmIw3FuxYsXL L7/MunrCR2t7y5TuLoaGMjqEQm4TyLx+m3SSXJ8LQfSyGC/STxscZEdYwhsrOFBAx4rgJdtc yy4ZrCNDAEko2Oqfv4FWlsiyVpYOHY9rspB/sJlNftDDXBlhkYWyLy9fzqw/ljFecdEMY50R KAUnaElWLX5cxtDbeXilK84NZcXp+rhi7ug7U0jVYgZCMpOB5IbINEWBcMOXAcySuoVUCWRl jJikmTAecFP6cReGNiNRQoaIFEACl/wx308nCgRRp7O9tYcNXYVM8qTXRKAZojNFd4jelmy6 04aEJp6alOeN6LG5uwHM6cPcSWzrX7+OPcvk3Uk8GY4iHg6QubQNrPeHuKeleZX4TgS1cHtT tmlc08ZNAVnHMcjIdPWqVWKMNfMoeEkAk4c8nd0iYPJ4zXuAQGbNpCgaap6R1uS34fCaoiLj jCgF1McViCkjpAxNILZRSVNdtXYkGkkXxoUuuk3EBUnTf9JHL+lLDU6dMpWnhVZ3rWbAx6J9 HgKXYOeiRntTS3dbRxe777udLeBuZz2ZwCznGGhrYtjYwaIMHswEs37dankiifuWg30EHib+ CXUMJ4l0RDlZbdEy2NnctFl3+8q+1j4W96/n4c1WtvdhDQYikCC7aSPBqcYCd1ACIPnHaFcM L8w1yqG1y4msq52xPEdaRdXqrio8lOkcWpVrBAliA/hVrfGgxz95vGY8IPHIxTI3J+aGZtKr oVPm0NLlauaBpKlTprzy8ivr+njQu5O1+7LJoXtZCTcVmdVqam2ne9Xe0S3LK1o7ZONW4lhf G10qwh5PVq5h857WlvWtPeA3AAz20ysjzA1x43MDI0seopQ7k01sNzskzwbM6p2ypn/F6rXr MK+rq2twrWzJiCVMw/GwFH0/6TS60CURVewXg/kTQFp8za1+467wIDy9RrwzGcikVQd1v7E2 dPpiOrEknRlp4CRdO5chp0yckaZPNGP69KVPPkXPSdZ3yRxWfzMPf7e2DjS3vDrQMri+r6dd xn+dvHyEdykNDLLeTKb429qeX7V2Zd/aF5a/wuL+voGBHhbTsmRjoJ9eGDNim7JErZnNr4k+ 0o1SxZjUylpZ5tLcXBg7McoyD4aoxEh2PVu3ltua3Blw+z1qGJOz9iWlmlwkE6BRR/51X0Mj qYE0aXe+9iRdDanAliINQV7AWYPOYZOa6sCkfMF+IFMmk5HBZHml5VeEGK+hioWk6Y2xdqBY VUKe6Y2utWphzugTUsYioZYUFFXDloteLhy4jg4RxLHALYGutb2tq6dbOkHM8RNfmlqZ6lqz fuAVgh8PXw40rVq3bkp7+/SevtdNI6ARyVrYUVHeENff99zLLy1fS09u/YvcMli7jiUVfOio ccdgk66utWv7p7TKvNggr4BjVSz/jGllBQf6ZTMhntPkfqU8ns7r42SQ2jZtylQ6Xq5ccqrY Gf30SPSTnlnyMESBK5IciVQU3BO43ITpyqUYsYxM1fUV2WwMZA5TmomtFTC9gT0FcvxAVkA2 mbUxeID2EUdnaSougAHQWjjLNBkAq1F5dQgoWZnPcrLmZjZQXPrSKzwuNJUdqukdgeHlbkM8 a9nU0dI8vbvXrZBtlvFme0vXhnaC0sypm2y12axNZdPETgaTA11TO7u7n1v65BOvrugY3DCz p2taZxNbZRDM6KwN9jexeT9LaQlJaGfTWcxhVUdPb8/rt9iS4Sx9OjGQAKP9SXphUfQSyxve J3N+mDxNMA+kA5k0cXcURUPNM9KYpbbvIgW1SQqp65MccAXJQEdxbkCckSzDX5d/VXAhK5kS EiQISIcmmmmKsa1bbf2m7p6u9eytMzT00upVzy17mUmvWVOnMdzrJTIx3nRjVB70XtO3todH L5ubOrq6mzasYka/eWDg9T0dgz2da9Zv4G5CD/Nm7JLRNLh6xbJN21s6p27a1zy4um8NG5ER yhDDiHXlBqbOBjva2letWTOlo237WdNn9XY/sWo1O/tsssmmWKeDSdEpJkoHUjpNUTm9DlvK y5k+zkQKawnHmYYMIRkoI4+AmmKu1GAtJqmOwAoRUvcR+zgSUFNPtW6lScboBytGFjgwHchi psnvjdADBC/Xtl2j1MBATHAo180hrg01veENb9x8882fefKp1WvWs/chK/ffMGvW1jOndRPC mppWrpP1sKwn6+rt4b2Uy1e9MHPTGZtt1v3ciyvWrRua0jy0ZvXaZf1DK1vann58Cfcq6cbN 2Wyz1/OAeHtzZ9PAmq4pa1hvsXpFc2cbA0tm5tjRrKenm/3Lttl02q6zphMH1/cPzpra+2h7 B3P/VIIYiOLoqsZAEs7aqIKc+RthZY1IkRoZ6UbEwNqEuqYgLJOBrDbHTXBq7b9IZ8z90aq1 JbhY4No4FN093W0sgGAtPu9MovvV2TWd25Hr1j38wponl73CMJAnIl+3ySZv2rzlhbUDM5oH X89DTNxgXL+hub2zY2jDqrVrprW2bbP9tlN7upYuXTqzd9rA+r5Hnnl1zqxN6L61962c29ve O32zdXTL+gYYTPIW3xW8cKSlecaU3ukzNt3AqrTVq98wtauvu7u9o1Nn65x9YrOEMXcbEwym yj0KlzdC9RJc9iOkZQzF+gUcSUeOYBG1CNH+BFllCHB+kSOzDBWQjqDVNYsuMs3sr1lq3Qw1 qVTiohLk2mF6Etwyse8Gai6A+WMFIYvGbE0dbMEjnaEe5sO6OztYUEb8+P3TL7y8fmDmZpu9 vPylTXq6t5gxY8Urr65bt7Z7amf/mlVDq5qmtzT/cc3ajt6O6Zv2rlm5bvkjf9pi2qZztt9p YO2qgb41a/rbu9jnp2mQ3Wbp2PFYE0vLUMrTTSyRndLRMtDU3rdu7brB1i1mzXpl9eopnT0z BwdWrVoxc9NNeDZAB8JiYxS3KJ+MMSWaBcOPXJeMTIY5Okt8wVAoizyBE8GJykvkVgqdTwPD /2fvTQCmKM688Zmee96bl1tAAbkUFcUzBBQPokYTUCO7riauyW6O/cwmMdF8Ht+6m2MTc/7V RN3NGqMkK0SDicZbUQjxAkTjhajIIfcL7zn38f9VPdM11dXH9BzvAUzzMlNd9Vz1dPdvnqqu Q7HOkdYg3+JEaWnCOkW6BU+Nsxzsr0dkNfb1UBbH7gMgARsYL25xDm1oZLJB+/hkARCGks2c OaN73z4fxsey1fqz3fF4Z19sbGvb8GBwZPuI1saGqNfbjRXKkvlhWIMsxmZUZtIZzF7aF8+O DfrDfPJ5MBGL+nOeMCajh4Z5winAVjrJVgZCnxmap+wpx6OA1wv5iDffnc81R6NYjbaxoamH TXCKNsY6dm7bNmHcBARrHMhATrClW8u7+DA+bSj7vG7bwHiAjR5yd+B2sb1jcD8OODpbW12B JcRitH+AKitUWyasa1hmrpCs87HRDmyhVrayFwU1bAwXLiC7uoWAzXv0tKMjfj/2Fgl6vY2A ilR64vDWkY2RJk96dMQXyiWz6RTmUo4MBBqxLiKWwMCgDb9/jN/boqU82TS2IGlvjDZjxTHN 19LQ3D5seEtra3MgHMKoC+jGOtisn40tys9mIHnYJphowmJfJS2PlwAICf3JREJL53du2YzZ 5wBZGIh/3E4kWXOSpdl/Vgm9auwmxB9dvGKuXkyl+pn6zTES1pn5DJTOQoiUaPDZf4dQIRJu dAliSrhhcaCpiRAH+WUVFSIy2CQfJS6mTFpPu/SA4mLicnY0sciMzvSlLAE3e/pBhq/iE8sj NJyyRifDBowJa2tvb2xrSXZ2BjBH0utpaYxgyiVWqsDoi5Dfn2eLXWtdXZ2NeOmIRcqwFn8W +1RqwzRfVy4fCjFQwwI+GPSPbTGxAFke6/nE+tAb1hptxNoXyVhfGsPOMPCVurw8GMmBrTC9 EY+WYcPIMpHGxmR3HyCsLx7DgkFQwnZU4gdFjkiyKUrcGzBY9hCRVfJZrm8dtJYrqgJzFRVm YxQCFyoUGaUFCAqF04UulUSIUgvcnteblm49dVDQ4X5Bkw6LWfBbj2EAUAyZ/D4qYBvKsD9S oKGpEQtQYDwZBkbgCGIRMXAigkIIpeVimZQ3k24GsmX86VwmicV3sAhGwN8EZMOcSoys8HgS mGGUTibSCbzsxGSncATvKfGiMotlz4Bs2OeET37CootsH/PmUKQNS2P7Q73dXVjxB3o60yls CwzNDGiN7UdWjcL14N1n/XNtdBX9I33IS1Wqz2+RoWt0cTs42VBRBzmTV0LJEISsUJwoRANQ e6Fa11XCBBO9zmf/XQELE2ZkMz6P9sp4iULMqkTSSlTOWixYwcdhiwti+MUwhO9CgmzgFw/K 2NITmNrtaw6GelgbjlkRYLPCWS8aRvDHUqloJIOhE63+UFswgv57NrHb50mwPnlgnLchHGxu bU3FejO+AGYjQTQb4R+MgiqXx8zLHKIpP+ZYolGZYRuVQEciGQs2sL2aglH26iDR2wc03JGM jx45CuCI3jdmMXC28J9XkDGyHj3FS7xunMDlBzOaH6in/SGo7ElYidkYmd6lEJnFIW2wF9fJ ipTR2BYUSwyirOQ45DHxEr+tRksREqNluctM2FCPyFz66mAgo+ALVx0JBgt0A+Jm4vdT8QMT uvO54eHwfrYMRa7R548gRkIYl8siQGsKRxpCwW70b2GD3nAE05iy2aQfcyTZUoreRCqLMRia D1v6Yth+FjMtsXQPBnIgEMNzg6H7DC+BlWDDyhboKsOJ5sUKPmmseqH5e3v7vGh4JpIg7fB6 Pn7kkfwtK+Nh78gK9z2+kMPOGegeDFemXodqPVAEMtwXOMq8LQQ5cResqUhUgbfcL4NixixM Ki3JxFuapTKKmihShJRRT91oQi70ebGDgQM+OCCw+UnIxR/LQCFW2YlEG5BC/xRrcbIJSWyp REwix2vHcFNzXyyZi3eFGhqCja2ZVDK2f0cY4/sz2KAkH48nerq7/bl0Q1M7dvJlm45g6ngq lUwl0PuGNcoQ1iEaY7MrNX/eiy4wvOX0ZZMpqOru7sLrheZQw9Z9HdHRo8eNGQtajr/cZm4b T3Gj2BJnrBrCM8x0mxCEl1h/kFusy1znChtkDstMTkCWyrTu0wWpinBLiYLGslSoFGSU40ws uCwTQlQ1QiwlO2eWeGsJs4RlzoLqpaoHFN/hwlZ/basTwtqJ3Ab26PIEhTn8JSa/0LwYuIM5 j4G2VoyJZZEQgjEs5pNlLwjRcx+JNEdbR2Iwa3c61RPv7e7s6O3Zj3RvNpsGNSRisVdfGBuN x3v3Y/lEDGrF0tZoXwLBssAyxG2AM9xX0ErvTiEfbx8DgUgo0NwQymNjOa+2JRmfOnVGJBzh rwTIteRQFoMx+/X11FS3l3tOLuXecMVKVpifCpLjSsTAElkaJmpBCRcWyRwlyC01KjxuaBQW x9NiROZIVi88GDwgnj4W47ATikXYyopAWQZibHAXvlj/VXTYMGwjrmFtV9bSzCPgCmnhcENT tLUdeIStLXfGklgUI6p1ZTw5jKyIRKLYawRbi2MkLd5aJqMN8e4uv9aRy7Ujisvk0wjLgEp8 0xJ0uSEeY0tfQCHbn4QttIgtlIIBzR/PJT+KJ7qj0aOmz+CDM+h9BAxD/CWsRpLbC9yEvfXj kPeACmTiXifP0E0iMu3vGYWQcQsu4WR7dkHiNmEW7oazFFctDDTq6L8uHKHHvdEcq9iDz+f9 4BsREQIjfqUYtCHJhpeiTx5DViORBrxozPT0YmVXjPNCyMQ2Cwlh8iNGU6SwxgV26k1g+/Bg uMEfHT6sDeP2k72dgTTAyId1qsPBsLcBnV0xLR7GoNh0Kg3IyeEfCjn4QBHWu8C+clgJm008 z2b7evt60a2fy7/b2zlh5tEjR4zg+5vgwrIuffxDigVvrJOfh7c8vpSrzyisDut8ypX5yRVG CUUqnlJE2V1fhYyba5SLMxORQmEpvBBLK6TcR3KesVrqWwjuS4lct4S4hF5FiGAAuV1RkYZT sA9duCjqj4QKZP2hoy5zSHmAwwh1igEQGEZQcMOMxH0HkGOhD+vaxyqt+GYxlP5mAB386NOP 9XUnYn3R1kY0OTHlO5z37OvrBCTxRa6TeC+AzrCILxxoGtbXuSeZiQXR5tQgB1u9BdA6xRbi HryuTGPAhjfHRqIB3rBZQMqPPUnYhgFZdPUfM/NYv8+P95gI3qCcR5CFZ4dZzFqwOOVzl8Rj N6S8XDdmYD1QAsgEmBZuohLGCSrBZ2BQcgW1gcjxRJEg0VYgTOKuddLezlpr0n/w3NUfVEQI DOFhDk5ZE431vbN4jf1SM4xA0xIRFkaToWcMWWxgBaI3n4YN4tBI7OntzAG1Gpvy2XQ80ZfA rpfo1E9nEtlsGCjGxml4kvFudOqzdwP5LP7YZnDhUB77JEES+vwRjbGRsljtB3PDGzHOP5Nh m5y3hBs37t2VCgaHtw9nY/+ZWcxE1JLbjUYwsJV+45mpoqACt4Lf/eGS2ETGrXavpipKgy64 ThZmKJMLjGkDj7FoiJ+VADLFelFPl35R2A/EU1Hlso0fij5iKFDAMtZUQ+WoucnGybMTtqwO RWj5cAQzklo693dhs1yWzUbR5tCh35dM9Xn9abyexIjWZDyARRC9IV8gHGYtUrzc9GIEbMLj iyCB3cNzWi7gCeUziNf8WNTaE8yhvx960ZD1BdNs9IUvmUxAciqXW79jx/rs7j3x3pknzmaL OyI0hFZuGUMsBmfMfoJblkAGjGaGWx+2BUTOhVpzlsplkt1f3xJ2GCFHVm3PqISh7m0h8YKd /XKZDyXTSrpMYlVuFtq/OexGqR+HjAcYCLBYjCEAi8FY+FU4cDciTXc4ArJcU1NTc1sbXlli 8Bhal3zERD6Ry2KnyUQwksXo/HhfyOcZFoiMDERbU57WdDCS8Hp64+hFaw5qwUjEH4mif60X uyGxkbcAJWw7wrccYTedzxtuZLskYQRZIpbHGhiaf09f36sfbevNJA8bNw4zAQBkMJLbCctg KvsjcwGD/OGhTL0G9e9D2APlRWTCUfLtLzKlhILRglwi4c+N4bzCE0WXhRRFvXJqwXAAZolK lXIHBwEgAIVgrKbgAHfxR5plsV54f2NzSz4QxBAwoAm6sXLebFILJNBMxKKvmCuZSsZ7MAWp BztdhjRfTyrTnUthaR6MN/NgLmZDCHteNkaDEMX2yMRS/WzkGEQDEvEi0hdPJdF8ZWCKlfrR sMx5WsKRnsbMjBnTjzv2WGQzKt08bi+FYxQKwXyUFQI0RuX+sPeUKIEwkSbsFKeWeqxKue1W BVZ5llKtMwvsuhTlcktX0VCCKwhxhiwuXtCzUl2mUEwZ4tdD5CsJkJklE43QahauCKnytEIg q1JrnX1QPAB0wIF7l38DVOg2o7eIVIgylskwJO8ZO+6Id15bhyzsv8vRR+tLxLHvm9+T3dvR 3bW309uXCnv9zRjJqmGbpFwjYEnzpvMZrNIT9gTT6ClLpSNNTcEGrIKhZTHViPXza54ARoex TeLYzuTptNePVRVznlgMLc9QJPyxOXPHjRuHbZmYdRxuxUOCBG+UciP5ie0DNCj+rSsdPA9U C2TsrrfH48GrV12zlQdYXxcDB4IrfOKU/1Zjvw9MGEIB/jP8AA165EeNHjthyrTtH2xK9mAY K8a7YkvegC+T7u3uyyQTEa/Wjuan5m8IY3UyzErCktXhNEboB9JeFoehLenb0xtj+4ynsGWc F8PIMOIMYzgw/h97/3pSPYmeHkRqWAEol+rzY+CHT2tva20bNgwtW2YGBzDemqQmJbeXwyyK oQBJFijSLShV15QhlbH6c7nGPPdncghjweWo27HQQpibLEUm/xky8rmurqiahRCIFJqsBIpC EFqV67kyndHMKs/cAhkZYG1iaRMEXw3rIWSWVn9IUQgXWzmI3ass2mKPP0Mr/fZkwMUY+b3M GoNsqBbmG/mPPe7k3q6+nnQ2lUtix/BQY2PXvr1YUTHQ5s+2ZIPYPc4XTnp9CJ/8IYyXQLsR 7ycb2HQmzC3CHktN2t6evkSELT+GRTLSWJTH489g1GsK+IbhY5jry/a1xHtMplzzDh8xPBwM sriNm8gM4iCG4kJ12BfHWzxtgF82orbsyytc5IazLGJhphvJA0vDHVdEI6bcpeeEB1zSW9ar JkIsJVOmWyBzEFEvOnA8UAhkYLCOYrg5gRJsrhDBA4c3ftdhwYtstm3YiKkzj30z1p3qxkAv DL0Ptgwbnu/pxE66WkMDWpx9bMA+RvSjcyyjYefKSAQTJ/1+vOrE2hapQKTJG2NvJYFv2MUk kY5DVcbnjWHdRH8oEE578WIzw/aCQwTXPnLM5BkzWlvb0AjFNEwAFosRmXOZUQxdkWRW4puX sCRMFc8II60fh6YHygMyccvw26sCj1nyCamKQEtihcbp1E6uiadaRSaBjurO+QAAQABJREFU QzWDRTf8ZWXBQAZfhBUsvEEJy+cxEPMdC9ow3mLiEZP2bN/64ZuvRzRfJp6MYLEwNrco42Mb vrGh9mgUArkgKBJqiAYRl7G1oTCIDGEWdu2Nto3IaIGevm5PMIqdfOO9vYjJeF8ZuAOZDF6E AgvTTWOPmDhpagijaBsa2VAPpp+bwz5xxgMzso+hMDcOGMxQjecyy0sdTChnlggpT8ooJBlC 8kP/LpwqX86lbiQIgUyUi6oIwwSjnDDbY6QX3mKEglhRS45nLpZFS/SUrZQaaQf6rDwgG2jr 6vpq6wF2h+KPblR+h4unhzANzTs2rp8iHdahBqTAUNbJU2ds/WAjRn01NzRillLK6w32dmb6 urD2vtcTCGlY4IK2881qWJg6l0CPfsYfzIWiGCiLJa/juTxWiO3r2u/DhCRvKBaLaT5vW2ME w9AwczyR7sPm5kcefyqA9KPtm4GRDdGGLII8LDvLo0SOttxuGMSeHtaeZMjLMLe2DqpLO1A9 UBsgs4P2A9UrB6vdePx1+OKQhiYf/UTzC8hBAZ1ZqD3ocMZGj7GgLDt8xMiJ0476cOP7DaFo IBTG+q0YiY93mb5MPghKzYcmJ2g1dOF7velsBkteoJerL56KtrcGIg0e7LbrDybSXdh9BKzZ bD6ITcmxpixbPzaJ4f4TZs9rahvV17Uv3hu/f9mDY8eMHT1m1FHTpsI+TDRnfXaEvjAT9nPw JQhjbyb4OV0xXg1KWn32K+xZ6bbKkwzjDpfO3SUVrhI6Ct4pMhF98dydUplKaLQR4qRBsDgR ycrcpmsDZG61WdOJylkX13Mr84DVrYI8/LFQi5eyyY4sweCMx2FMEy4HL2SjWJFmnWkYBjZl +lFbtm3vY6sfYoX9kAedX1izGkCCHjCvFwu/ohcsGoli5hKW70ljDKwfyyv6+7BUP0aOYUYA ZlCmMligBzDJWp1YjD+dBFkimRx++JTDjzoelBi6NmLEqF//5texRByrN17ymUsuuuA8COdo RUYxkOUH7z5jMFywVc93+qZaOVGQ6JIUFgSV3MMu7VG0KVyVKGYSia8gTMh0I03QEJc4Vey0 O62My06ayGf3dP04RDzAnn569vkAB4AAP+VhDkMEhD4c0di9ifuNxW8syQZO5Fpb24897niE XWx7EG/eH8XebS2YSckGUvCJ5WxchdeTxFKw/kAam48ALyPR3lRy584dm7ds6ensjsV6Y329 6NxvCvpb2Oqwmd5Yb+OwEUfPOw+QCazT/IERo8biwBo/nkzq98uWrX75Faztw2Mw2MNMYn/8 0eFhGjeUnoxD5BLWq2njgUMLyOhpMLmCsg/+B4LBFEcB/sXfW3JsKPw8s1YndwKLghgdj9Io B+MmchMnTm4bMaxr3/50NhdsbvNGGtOBYFrzJbGUot+PXS2TeU8v1iTzh/PBhpQW6EukEulM Z3fX7r2793bswbgKfyDckM+ODHgiPl8snmgeMfbE8y9taB2GjZuwlCMwCy8NDjtsfIC99PSm 4/FlDzy4bfvOICaeFyzDF7OSDgbLHNioVOTr5dI3UUgZtkkG5+xPOZgAOIy8p5SVe8rl1EaU bhXZ5iCTHFCsVuEc9aE/qzrY2ClEkaPYr6O4OlZiLPMKBluWVZR5aAFZRS46iJhYxMXvOw5S 7CngeMWfUTy9DBnYvc6e4wIZz8GTzeYVoYF5zDHHYbXX/fv2d3b3JDEeP9yUCTfhE4iWyGSx /0g870XDMoMplA1NWBMjjrZoIoXWJd5mYvkeTzoxIhrGlKbO3lj7lBkfu+iK5uGj8UKBDdjw Yx0zLPKfn3HMLAyKxShaQNvWDzY9+NAf2Q5NaASz68AMA8gK+9hTyFqrlRxcSCWMdR43HiD3 4nNgjhoDWf3mKPzC8cduYC5hCS3yJaFIg4EZRwOOauJWQybvFAOYcThjNcEPJ4vOGB/rq8q1 tLSefNrH8j5PV9f+ZB4Lh3m0xkZPYwtALa35sTAGBlPEM1kMnd3f09vV3dXZuRdrWzeEQ8Mb G9uigQnDmkKaty+nHXX2wjkLL482tUIy2wsASzZio1+sZIZ3AvFkd083m5aJsWR+3+pVq1a/ +EooGGL1YBBG1jGDGKbRfEs7FzAe/scAz46ounyhQhJjlScV92uSampfWbKtaIJ6Xiwppqrz nhsNRV2VpioEsoExrtJK1fnsPIChFbgrEcLwGdmsKYIrif/4ZGkGYIVpTBwy2B3M83EGHMNy /Nnc2MPGn3TKKb29+zt2bOvr7orFEr2J9N6urr5UKo0JQ5lcOtHXuXN75/Ztsa79Ddiu3JvD luPBfKY1HELQlfYFjlqw8Ng5Z2FSFDaGw7qKHozcYPvFhbC6fyqVWv2X5zD/iVeAWZVKJH73 v0vfeGcD1sPQw0lmM7OWx2Kwz/lgdWJBZglCTsbd4SyOl0rEzEcuOAaIRDKsLI1UC/bDgD/l sJNpSazwljytiRBoGQpvLUtWtk5QIw9QNMPfWvKmGr9psT4r67FgwVeh0cYeexzUumRJQBg9 rBCAYa6jR431e7S9Wz6MRKMAoHRfLIvt4CJYHDuKWUMZ7DuCBRSxUKLPF/Llgwim8rkAVr9I pX0tI2ed/anxU4+K9/Uik42mRRCGJX2gIxjyB4Kvrntl8wcb2S5v/AaHkYGAf+/OHb/4xZ3/ +tV/mTZ5YhJLcaCs0CYmO4cQjjC31Y/B8ECFEdlgmDoAOvnTY/GbVLbqwg9c2Xy1Z2AYxSIZ OqiCQCUWX7G+JZQBx5DNvpFB4EWxGZ3xX2mGcAi3GKTxyCzfNnIsoqe+rs7E/j2+bKLR74li 6lE6GcjGG/LJRi07tjkwrtHfHNCwcqzGdh3JD5s2a87f/dMRM47BwDQMwIANbAcSABkmomvY nKlxy+ZNf3n+WQ6ZHJsAYwxAvRh0tvOjrb+44673Nm2ORsNggRnMVoZoBYML9RNfoqJMHJcm imwSqCH7Y5UW7rIh7e9sssDu0512uu7uqq7WWWg2qKIbydKXnIG4DCyuT6w1umYHYR3IyvHW AU7LnnwOa/T0c0hiy7XiQAlHLKohngJ2cxdwAuDFFq/GuFe/LxTx8leKow6b0MgmRWJ8GBbj wb5xWlDz+rMpTyqJFRFbg75GhFmpNNaIRVM13Db8+E9dOfeSK1uGj0DPPYAMVqAHDECGBYDQ tNTCIdA+8tADvb1dbOwFt4nFjKx3jsWKGHC7ffPmH97ykz/9+Um8PQhHwmwrOVYdfDBArh9D 3APszutPE31Tpk6sWL4lOkOaXX7FisplrNplg16Dcmtcmh5VOvOMswMBNhSfhVfwEe/Ep14w jlssSOKC2OI4rJz9Yz/tGDXrCzV89P47u9auCGEQRWNLNu8FRO3dsgl9E5DMtqpEoxNj/fOe aEALeHLoO8PM8p7e3vjejjf39G3cl546aXL7iHZEYyDmPMBO/noBOBUKP/XYn1Y99xR6y2Ab N41dAvyHBXQgiOvu7Hx13fq/vfEWUPCwMWMj0QhwFFOZVjz3jHX9gYVchFxa+b3BLDIf1rlm OpZjMkYlq8A4R/2s0FGpNbeeq38bzLTMFBSs1JmCk9qR2OUL+eYEsdT7yMyeQQ7dUMxFwrMV 3GOWogcxk1eBh1m8WiwKY91UiI/wD3AB0ziIFHaQJPI85ht99PIzyY8+eGfz9vh7b/pan17v GT1jdPOI0eOGjRnfvf1DtsFbHpMoc+EQhvNjvddEZy7f05fq2deJbvuU1/NOd2/Drsc7Ds+F fJejC61hxGi2YCzHJ7asTyD44fvvPfXEI2hnMuM4hCLOIvwSFwCLyLJ1Zj35DW+/9d7Gjc8+ t/L88z5x4gnHh0JBk0sLF22oXbKBt0doFLexyVdKBhEW+OjLJa+BU3pwFAXOp8JgInOpGsR1 IHN27MFWCqRgAMGQC/cMO+M1pC98sogMUIJcHdcQkmmZvZv9b/55kq+xc2TjG/sSu3e9qW3z fOj3tbQM94ZCWLHak8P+u15MQur1esOtI5Ide3p27cSgMAyg2J3MJjz+y6aGd7z05IpHnzp+ 7uknfe5aDqHQgHeWnp7uzvuX/Lqrcz/GkrFXCexe1oM1bhyMoW41ABksZmT53N/Wr9+w4Z1j jzn2jHkf51T1j0PaAxUCmXukHFLeLTy1A2jTwGt0qBwHLwZUDClYqMPabQw36GDrXlAcBBKE Psx2tDWzWHU63h2KRNGj2hDI7k01pHtamyLd+Uyic98ev6ZFJ88YO3V6onNvXyY/euSo9Pvr O3d8yEZi4HWk1/NRPDNrRHi0L/HqjvTI5sDYk89CX5snjRU0mG7Mr/zD0t++8+ZrWOoMrU6m kcMs+a0QJnoxPx079zKrWbzGy7AmB5ZBW/vyy++89eaw4bCNH9xmVqMCfyHb+Ys8YMfBRZoF wD/mzEpzqhHlbL1uEdWC1dGoy5rbjppLEw6Rbh1WUBTFU0UZnKuyD6OxBRmWV6pCIKvMrDrX 4HqAv5YERtFDiJuEUEHcgQwjqGXHb0t2K/qw/STgLtmL+5SPrs9HA55MaMSRw1KjtcQHPaHd cU/fjg+7o5H47m1r9qVHN2w8KbArBujLeaN+z84ktlsKnTnGs3JrMhHPTT7xtMOmn5BLYyAt Duw4F1nx9BOrnn8GQzTQBQY72D0KJGMJfDDD0B2GLjpEZARwjI0BMafCEkOY1JnCXpk6kKGg fhwIHhD3XK2MrQNZrTx5IMjhCCZ+SPWGJUMPfqBZxzv70ZrEAC7MRfJqezs61qxZM3L3jijW UwSueTwtgTTG4Pfkw8c35Nsi+d4MZk2mfHvWrtvvaUgiTPJu8PtSnnzIh11IvO/3pucfHt7X m/io1zujLXT06edhFaB0Io6euUA4snvXjgfuv5c1J7HdOBumyw5uDeCLhWv81JvJYqVs1iLm 5UUgo/gMoii/5Cc9PCXJ6gQD5gHliri9kFb2lQdkJTWVJLCyofZ5ZIbipvLVGH42RNUqEFsN b/lm23LActZmhDVIMZsYprFRZNRpxr7YQAqMsMfCsBvff2/1X/669tXXOnbtvGZW1N/ky6ax yyU244WQ3N50FB1qvancmFZPIuzRsqH3sPEu1lRMp/pSfqAY2qTb4mms+DO9Kf/0h5kmX37y jGNGz5idTScBSf4A9hnXlvzmv7d/tAUbmLAFY5kVzHJmEt8LjufAQhaOsXw9ECNEo1OezSuD j8oOwsvKeIcOl7n64p5zYSRxqxwsl+XxYdJMikJQbDxK2qUkYxGnCi8rq/QQMoUACC8PyARn PXEgeoDFNSzwoR59dmPiDuC3BTLxrQVDGM+VfGXN2pUrn3/jzbe6u3uQPbwhGAmgfZfDLiF9 yfym/dl41+Y9yczzce/oZt+wdG5nt7cxkG8MBLfEtAatly2FyDYu8exNeGa0h3qTqX1J7zGt 3ukfWxBqaMpgJTJNQ6PyT8uX/YU1KtE1hv4vbgp8qsMZzik6RB5ancLbzFod0XgSdTLf2IK8 njhUPOAWyGoIqAeaa8VzUgMfkAghcQBcYTSaQxlGS7AOJwQ7AAiUsyYmZmVjt7Z1r7762BNP vvXWW4l4Ar3pATQSM7m2ENayyGFoxPud+Re35dd3xtoC8SNCgZaIf0Iz1o/1NIc1AFwile7L aCFI9ubxChPLXcey3inDAlv2gz43cfKRo46bi5lMCLewXM/m9zcuXfJrNpoCoz+wnZLfz+zh mKS7iDd8+fq0yMb7SuEr2XsUnVkWiUyXCVmsS5YDjkzU0XhXlKxHgRyXBKQKr0uZgoyUKUJK WlCSwC2QlRRUJxiiHqA7iN84SDL4YjmFJFJ88S/PO++8/ejjT6xbtx7L7mD7EKxGwYjY0j3e 5oC3K57vjuVf34U9k3wpzTsmEjhxjNbCoC+1p09rxX67ec+urthwgJ/mB0xiAtL+ZBaTwdv9 ufcSnmEhz+RTzwm3tGeTcUwwwrZwv/mfOzv27gqFwtDCuvnR0Y/2JAsYmWX4ZHjIWr5YP4jw DYSGA7kMMlk4xnv+qLDmz4dB5wF1wq4yPxSf0Kko1anwLfIUDonEJmkps3xxgsOspqRJdSAz O+0gztFxjPU4YX4Qls8JbNu69bHHn/jrX1/o7esDfgHFUH/WmuMw0YQdLAPe3d25iN+DbSjH RL1b0iG0HiNB7LKb2tU2fd/osbu3b+jOZWefP/uZFc93dOyb2BoOaLnudG54Qyjky8ZS2UkT x06YfUYem/x6csFg+LE/PfjCi6vQjAVIUUiVzqYx4xK9ZgzL9K4y3gWT40N01StCEMZRjBqa KoFy7vCEKJT106HpAYcrSBhnC2QlIVCucFnEMuOgpIW1Dt5xMIzYK+MlsVUa4GCbRZFQhjI2 L5E1J9GOCwWDWCb/0ccef+yxx/d17OMNSR6FMRFUOUQ7XswGbw97okEtrOUa/N6uNLYKSSFg S3sDm9uPyk885chJR7c3RlLJ1PgJEycdd+oD/3Xbe5u3DG8MpzyB8Q2hWLIP7xynzP5YdPjY TDKORuX77759373/jZcBrFeMhYd0MNt4axe6gWD8H0NS4Fihg4wAjgEwR1g65fVlURmL4ob8 geqyQ4ogB8JkXamsi/9IcJ9RqVxmThslCA7F5bYyjewkXgihU0WU2YSSObZAVpKzTnDAeYA9 8ZhxFMD8bi86wn7/4B/efvsdIAriMNSFDYNgeKLfY4AxT747ne9J8V3Cs/lUDruCp0e1tk44 fMLuKVPyDW0j2oY1RSJtbcMDPl8iHhs3bfbff+M7t991W8c7a0eGI8lE7C+9yXGjRkyZcx5i PESAWAf77v/+5b69e8LhCCmihi60Yv45lonlTzksgA24txEXskNAGMyT8IuZKp8ecJejbnAN PYCXS/XDpQf0J5z/kgm/iVyXUmSymgiRBcppIbyYyZaR8O/Y+dEzaAQ+vwptSfRpcchAqAZY YFUhCKEE+uIxwOLNzsz54/1tYS8QLT5iyjHHnhlqHdndsz8T62pvH41VyLAxOMe/fCIRHzV+ wo03ffflJ5a98Oc/dHb1Bv250878xPDDp6fSiWg4+sD996xb+yK6xpguIKgOWQjA0OWPPjXu WmYvC9hwoLGJFG/n4oyZqIOXSNSxjPmrokPcuha3irVAIizw0ZfCK2QKAQqByJcTCpcbFpkd 9BVGZOVqkrXW04PlATQnV/71r/f/79LOffvxHhCrgHHEwN4hHCDILCR54AMAwTcCokgwiB14 n93Sq006Zd78S6OhIBaBbYpGQm3DWtpHAvmAOYioOOxo6VQSHW3zL77q8OnHPrf0v0KZ2DHn XJKMdQfDkbdfX3//b+9hLygBSawFyYGT64ImnGEeEt+xnIVgWE0D0IaDIjLGUiBnWEu9aUyx QL4KfKo8PRVIsGERT0e/abBRXEE22Wo0lM5ELQpSBY1aYNKqEBCjtVATb6UZFQJZperqfIPp gQ3vvXf33b9JJeKIfYALuLVYUIQvhDncLmro8VCJQ40nH/Rp2/pyv1zf4482XTR9VqJ7f7il JRINT540Jef1AW3YemQYHsHjJ0KndD7jwW6V46ed9blr0rHeUCTSsXtbKNq05L5f9fR0R/RG JVPIsYnNTSokgFoF8EIK5RSWcdPYB8EZqAudTbwCfGqTIKknDlEPlAAyBVsPLCcJ4+nHwGy8 /vSaS5xzSF5BfKVCDCqEqZRrZ7CBx+ZEESVTLVu2LJ9NNTTy/imOHazhxiCNNfTwKfNSJpub ncuFI/7RY0d0dnzkyfR27YvGY917Dp+Eud+9fb1ofvqxPCKP33Rd6A3zJZJxLGWNKeU79+7A UrBvvfnGO++sRwwHGmjhKhl5Ic2CLKYcOIaeMqRlS5DPbCMLC5/s/SYzHhKocYyU6ajGjSZh Sga08xyDzxSaoXQqfKF4Vq6EXiey25ZDVJmLoh8/sFgJZpKIvPjbQ9Lp04ZHqJZpzWmZ2/vJ C+abKUSOTCoyD7iEs1+cS+0ra/BNpUKsxVcjzWCWtfjKc2sovJo6IvRjB0DYsSrOpQqzHbF4 bGVVRWLLYp20SKbnsG+z2dZ0Mk/t0g6X0AhkQqUtR6GgYL0tGRdUADIhlBLOPAqx6ZS48ZuG 37ISEZmJt8oM5ytWXbWqNG0osSuOcPYaGa6wDKXa1N4WNw6pvdZDQCI5tsx7qUAuQjPyU5lC KnEuWUuf9beWlXjQzCMuW/0ZMztHzqnKP4JZuFsWfeCmRXVEBV3XRXAIGSVYicGSWmQKoVyW LYcgE4z2upXItayWpr1UVgLl+ENQVj/qHqh7oO6BA9sDtWpaCnCuxh2KEBc4706bEKQoIG7n UnsNQpgQwGjpRJTZs5dRYlBQBt/QIq3KJ1Ux194P4opUYpfeFaUEKWVZadar5AgLrcUKaiu6 gmG6nSRBcAiBRVYqK7yhKRAW8gS1MWFdd6NGA0dRmSFbnNQjMuGKeqLugboHDlQP1CoiO1Dr 30920+/H8bNOxKqB3T3dr65fY1aE0uamZuQ/v+pZc2kFOX+3+IrJEyePGDESvHv27H5/0/tP Pvnovv0dQtTpc8+cMmXasyue+mDTeyJTTnzhqi9jRMX9S++TMyk9aeKRZ84/R/ldBLGiQmY0 /4bLpS7TBZPu5yYp6o0iULupU6Y9w2tXE9Uknnpz/vnzXzZqY2dPr3jqvU3vF/KtVMLe+fNg 1dSnVzz93gfWPjeIpQpaiRJkjoWCSnklW2goFIvdpIS3bVSK7AKheu5Gh5HG/D7XWK6cFTra uHoAmdCvkA36KRkm3Nnv9pCmct3xwLJHHn/8z7+6+w7ZPmDKJRcvxvQdyuzo6Pjpz28RcAYI +/IX/8+4ceOp9KtXf+MxkwQh7YZv3zxnztwf3vI9B7wTAuPx+NatW8B7wgknguszFy/+7vdv FnqBYhctumTjxg12QIbSd9/dYAlk48dNQKmwSiRQzQceXGrJImiqSRRMIiBzvFmBYozYvnbV mHGxVd2R+fiTj//kth/pPQoWGqZNmQqydze+6wrILAQMZlZFT6DhgVVeZYrKGIhEbuUJrMVS P6rwwBeu+opAKyFm3twzr7j8SmDKfUvu2b79ozFjDwOg3Hj9zd+67muEIN/42rXt7e1/WP4A MAWlZ55xFp5Ay1DogvMXAo+EZMvEsLZ2CIcZECjjKcCU9MpYZinBfeZyo4pPnr/wUxcuRGUh oZ+wDAiOkNaNhYjFgGJ/e+M1N8QV0Gx4d8PV13xFMM6edeKlFy8+d8G5jQ0N//6Dfxf5SgKx 2IaN777Wb1Yp6g7Z06EPZCJCqjWIV3HN58096+Nz5k2ffhTwyCxmwYLzkPk9HgqR9b09PV/5 8tWfumDRz2/7EbAJXE8++bgAnZdffuH2W+869eTTFCxAa+4fr/yCWb6S8+UvXg0Uu3fJPQo7 Tnds/+i6a2/43BVXiaBM4cUpWmT4xPMvN0LNZJY5f370oRdeWPXzn92BuEy0ManKgNdjZh4H LudAEo1rQUAshpZ43vP8StbuNvcNm81+f9N7+FPsnDzxSMSSkLnOqnVPxGfMYx54/Y3XOvYV m+GKHPPp2vVr8PeD7/zo43Pmzp975gpupyBrH9Z+7MzjkIlAbKObRqXg9HhOnDW7ublly7Yt NQzixFNEeorPEhUUzyU79KTifPPQVlU4P9e51EkaFFUrLLqq8prAugrGPfSBTNRxCCXGjh07 YsSIjo49caxdo7cQhX3Tp83Ytm2rjB2PPPoQgOyIIyaCZvToMfh8df1aQW/X0Pv2tTeCBpC3 YMG5glhJ4OFHyGbXHgRGLFp4ydSp09D2lO0hIcik2BCniB9//+BSRbibU8DfypUrFi26ZMGC 8wlJYRKwVQSSaDhDsgBZ9Hkh/PzlHbchlCPXgQAx4+lz54tqojr/8d2bCFgffeQZnP4rD4V+ /pNfTps67fqbrruGh7TC7P/lnXr/zCX/4JbvPcf7HE+YdSIQHPRUC7Tuf/LzWwSc/X8k6sbr rvk6i45J1LIHlv7Oqn/QwQ/LHlx6wqwT5s2ZS0B2+09/AY3fvvG6f7uBxcjI/NLnv4Sm5fdv +f6zK599+PcPQ9SFn7lQCDxy4pF33XrnuvXrvnXTtcgEhF2rVw2niAF/evvPaghnQu/Blzi0 3lrih4f+qryQeCy/fs1X8Pfb391rFoUusxXPPSPnI7bCKRYyxCcCsfMvPEuEIcjBs43PN978 Gz7F8bWrv4Xn/Nbbfoomp8g0Jz52Gmt4KrwyGRVNmzZDzkQacIMGaTQaRYMUzTd00n328isV Gpena9e9AspJEycT/f+78TtAMeAvxAKwOjr2QjLiUFkaIs3Nmz8EAbTjgf/ed344d+7pCCqR 8+r6dUDeixZdyuitIoWbrr/5+ZUrAFjEi+azLJnSqB3IJoyfABpQQjJqihwEaDLxTTcYRF16 iYUomd6cRlCG34AZ04+Sbyyg2Np1ax5c/oBCv2bdGlT205/8dCE/7zln/tlIr35hNT6BYjdf f3MsHrtnyT3fu+X7Dyx/AJj4/X/7HoI7RU7tTxEg2cVIZmWlnqKCMPrSPwuZZmk1yjmAIjK4 AofVrV0jX5AYoYD0uZYtyL2izSjM/fxVX0T6b2+8LktDQISQob19OCKC1atXyVx47BGe4CEE 3qGHXuZS0hTfoa9NyRenVNTY0ChyKAGkwEMFoEG0iBwCVsRKCpmbU4r18LYULmCvDqdOQ3XQ iCbev76w6r/v+s3iSy8jRZS5bt2a7/3gZqSh9+STTgFk//qeXxEBGrlL7l028+hjiBKfwrOU A8z9b/5qBbwjR45Cyw5KyX7BcgmvHfBLRFjorPz2tTf8/eLLv/uDm4XARx//83/9zx244s+t LIhCMxNpIadkArxbtm7hcZ+Q6oHYO//nTjPvI489MnfO3CmTp1AReE856RTg4EOP/hE5V11x VSwWu+b6b3bwF83P8rjykkWXXLroM3dYSTPLd59TtJXziHvejQTBWxaXJNmJz+7lgMReTMqC Dq2IrOiDgUqh4/+uO+45ftYJeLZF80pWjsYpTvGSEX3zlE9dY2hPydAms9QkDfjAIySDC4Zl VC/5+FmzIeTRxx8RotBCBGwBrAHcIvO119eLNJ5epIUlJbvqHly+TPDu3r1LpOXESbx2AsVQ hPYmWpezTyjagExZ1C4bUbJYl+nfL/+9JeXa9Wthw0mzT6LSIyeh/248wjSctre1Aw1fWfsK oRgRLONyJk2cZCmtnil7oDZzLQVIy6L7Jy1UyXDcL6qEAqHSnRoi96J18yXeVQS8oJd9ECiL QiBDsQyecLTy0EQipKOuMXQSuVPHqDBazY4Yb0UtixAEASvlIruuOplGTou6oKbIp4Yz9QMq /XGEETRojiRgYTJZlDkN4UK+UloS6UAPgEAHk8K4t2PvtHZDeCujhkLs/hSNVlximb5j315z 04Gu/oqVKxBkzZ41G6B2Nm9XIkwD73H8xQjegeJPFoV0Q7SBcuwcotBXcFqQrCsw989bypT7 2kFgfglAXLJwhUURy5848dgphRankEzUGH9Wm6YlXSQLVYdqFsYloBsIbTd0Fd235G752QNs ya/q4CE89qtWPY+2JL2JA8Tgdxs9TeQ8tD2R+IfLPotu+69Jr/+plFqOR+qtFcqUPzFEFqfU jSXn1zBN/XSbNn1QQ5nlitKfwXL5qqVHJAXQRG+9S0EYjQEgmz9vPoAM7UpcaCREfwnA92/G rlKI7e3tdSn8ECTDdadLXxsgOwQ96FBlDM7AO0q8uLzzrtuV2ARc6BdDL5Iy3EH06GOggBIo OShCEfqG8NaP95Qb4JK4ECuh0YqnxWwGMsePnyALl5t+cn7J9NlnLQANtUwxowC1Q+tYju+o w6vmI7wcwAu1G85/AGTj0Xbbum2rnFN2GiqNEQM64yBE6f10EItXkLABrUtqV6JHn4gx2AKJ 3Xt233F3sXMNKIlIjYocZNa+SPGsscq26hQyRQixKZlGFqXQVpFUIATUrI8MEpU/SV1/JFFr +usP4VXJXLTwYrQ1/u/115jhAy56k//kYrCCrOP0efPBAlQCC8Iu+Q9v6ECJ16PmcIwkoPMb oR9GPMgCKX3NN76NoqXLfmcueuedt1BEMSCVzj6h0HdjJhY5wulI0IGuPerdJ+TCvCjkYzKT Xo63mUeCAOgsh6WitJ8Sb7/zFnrlzuBD5EjFZbwL8pVXXqpGo3hsSAjGxJ5/7icBmkvKGbTx 0isvwbZ/WPwPEIIAjUS9t+k9yDnxhBMBXsJCdPPfcO31E8YZfm9Eaf8l5KssLnRJdZVxlRTr kqAekbl0lFsyBEFTp07Hc1sYQCDxIexCL9gfli8799xPokcMbxLRMET3FiIa3Nl4RynRlpHE O4FRI0dhxMN99ywD6lFjE+86AY4Qizd3oh9dFvq/S5cgWEM0h040jJsF/XnnflImsEwjtqLB IlRKLxwRe95x122UgwrSRAWcUu0wXgzp5Q9VWDsSW+4naod+/X+9+htjxx6G95X4hMPxU/GA 9KKgXJkI8eQZl+iDxzscyPzxz28pSxReBaB1CcxCQ1IeI/a7Zb+7+stX/+T7P37o4Ye6e3ow twlkaLRiAFpZ8g9N4n4EMuXnC/51j+5D6mJQRVwaP3PmLBiPGAR/Si2AbnjOEZhg0P/Xv3at GOuAhwEoVs07SgxlQGT0yfMuFDKhGvjyyzt+Z4liKEUAhWGoGBBLw8cQDuAU47kUm5VTpV7g guWAZjna+vb116CDT1iC2mGQhzI8QhErTl06WdDbJTDE/zvfv/kavXYgQ4Pul3fdbtG773qi Mn4V5BmXqNdfVq/67dIl5ukExeanVX0wfwDwhGG0L7z0gmw/DcL4wpVfAJxR/qrVq26763aZ pmTaSmFJpqK9lqS0u4MgMj/X1lyWdMpCPXbmWvJaqtEzvRdecIae7vdvO7OrU1x+pSuC1EqN tzUPfVL0ttHlQ+7GS2jHYUYOKJU+OAdeal3W0AbSRZYY5hs5GKEXuXeyS0qM78erla3btgBu SrCUKC6YaPnezYqVX3djgfFMrzPuRuM9ciZvEWN6ZgF2dTb9u8hoTrmhMXMZ9ZvLeY5OpH/b kDlnK0BmR+xaBwj9nnzAk6sDmZ0v1fzKbhG1c9gotVKZRikH0ZmzQ5xLS7qhBHuJ4oJ4BXQo 14qVP4vGAuNZ0V5LmVKxrrqYZZuyU2HLwAtc4YZOpH87i7Qp7Tcg68empbkq5ILKfK1IUxxS lXMV0TU+pepaG1hDh9TY6gEXV5O7YsCtLigUV3cQa1GNajteUS9WT51I/y78RhtoSl4Am4a8 OgatqMMo0V5Zzd5aGhXWz+oeqHug7oGB88CARmRULYGqdrA7cLUvR1N1Zou6CjHl6D54aYVf +q+KA6Ci/4yHZGf7nUurNEwRbnnvuqEpaYYixI7e0gAiHgQgs7Oynl/3gIMHXN7rDhLqRTX2 gLgkDgDjUqVLCUKjLpZlcN46kOkuqX8PPQ+Y7tuhZ+KBYJGzG4EDIHCJJEOqurLZJSaNO7ug ylqR72qigoSUvBg10VVlrc3swuyhaZ7Z4Jrk9F9l+09yTSpeKyHlVVPcZJbq3clSqIoiqYCf KzRCW5FYZJWfsHy9C8n4q0dk5buzFAfmWmIjDDMVVpRfWaMNk8zC+y8HA80w7t9u7yVRevLJ p2GuQsXDev+Jb+BEa7061wUTj2i3JIuRqM6cUimNL7NbAnsyW2BnAht9VuYq1aQBU5eam1q6 e7rWvrpW0llIYqFEzKDs6u5i08XrR408UALI7HDUDndrZNWQFkM+cfAAHrNFiy6xrAMWscAc THkcvCVZyUwMN8V8RswBqvlAVkvVGKaPWVC0FKJC8IXPf4kvM7sMew5g3H/FQAYVmLLjBsjE bklmIHO4KMJsTLrEpiGYZ0o5mJyAOUZiCWygzL/d+B2+UCIrh0n33Hu3KBVCkPjhd34UjTbI 25EgExD2L1/8P1gPgygxneAXd94uA9Y3v/pNsVAPVGNa0h//zFZVPBAPS2+Xixh29OU6pASQ lSuuTi88gFWbV656RpxiDuZFixYD4L7xjW/feNO3RH5lCdqcDdODBgDIoAJohYmZZlMxOQET d7BmJKD5N/fdLa84ZiZ2zsGC1IiPnGmolHZLwl4hbogVGkRzn+MbXP2Gb3CFOZgAtf93/c3X XPc1Cr5++P2fAIawSjXC57FjDsPi19/8+rVXf/3Lyr4kACxMtATMyfIx3/tbfMV9sGPnpMPG jr3gvAux7PU/fvFKYicUw/wkbCLX1NS08MKFmI207aNta16rcWjGIMY1QhCxJSoVaqcM2pTr LKcVEa4NkGVUnK4DWcWuK48Rj/qv7v7lvHnz8QAonMC4mfYbDtH6ZS7n+riZGERzktzPYYK1 a9e+guXSsAC3MnMTO4ag9C+rV+LTvNQHMlE17KUk0JZOLesiaMCFQzwUtIIFYEuEsQjEzLEY 7ZYELtp5hISYP8/lG1z9x/dvFkEWNrj6ly9f/ekLFv301h8hWCMUw/rXgvdzV1z5iXPOp8Vm 0eQE5VFHHS1iLkGGBJb0AawDxe5kK3Gz5/jFl1+849Y7P7PoM1j5Guv2IBYD9l1747XE9ebb b955650XnHdBbYFMuE62rcq0WebAwlRp8ysEMqqGuXqlFZoohEeqlyYkCJkmbYOcgY2XcK/L r4n+9epvid2DsBYF7fVLFQGEiV2OYDdaIrTLLzYTohnpaI7hD1uZoBTEtNIZ1VAQ0ymx3HDT dUIg5jzLmxsRmd3nnx5ZDiNPO22OAmRYBw2KCINIBRkj1NGGm0RA+2xSmw5tLqyoA+MRVNIC /I89/AweclqqCOxo3Jl3SyI0Me+WhMnh3KvM/K9d/Q22Er9xv2RRL2xwBdUCxZD/p0cfApDR wraTJ7FFKBHxCfonnnoUQHbqKaf9Fgv1eD0tLa2gxNrcMFU0P0FM14uWXfu9tMDGxk3vgZLy Tz3pVFDKE8VRCmOwir9QJyfEzSxnIm2XXyDrj1vfTqaVKcU8nmKsduzc4iJ9oQLsy5FDopOS FQKZJKGedOsBxCNYyxCLUgiG6/ku4lhFFrvDYQI5VryhzjV6toECoMQ6PGKZHeRcfOkFL778 AtYvpF3gaJMkSCZi4AI6zsxbApNG0GDxMhCg8x4gIhbXFvbYJbBUBsxGLAlFIjJCgAZUgkA7 LqjDav20zjWIscwGhPyJrVHT/YkF55VcNQibHkE4mnjUKQZr5TX4hVKQwQxqDKJtCx/ynb03 WIZmwDixhiVJoH2VYnyDq8MPPwK4LHfwo0mIA7sxETHtZUnpJx8u9hsIY5AwL7BBkDdq1GiU vvjKizLxh5s/RHCH/ZPW1Dv+Zb+4SxMI0ucgAJnA4Apw110FhwQVHj/ZDmyFOf+MsyOR6G9/ 9zPKx74kACN5727a7BarlQHI0ADE8wlgooX8KajBbzsiL+SgFLxAMepcx9pnIAbkETHk09a8 2DRI7qEHLhA9pNESZpBDkmVTLdPPPvcMkEhsXgma445lCxY5bFki1IEMuyghBrxOf9EBpRR2 WeqiTLBTYAVIot2S0MwU8IS7CH/IQcWxnI4IwYCS//faG+B8QSmrEGQi85/4Blev8w2ugCkI oEQRJfaaVvpXCMQpfl2AWeg+A95RJnrNBAhO5LuayguQgUbfzaBFCLFLiKfGjmBo5pvN7qen viogU2wyGz1YziVLFPMG2BjLF5cIvsQbANpwCIt5CcMQ7FBvFNAKDyTyEbbs3LmDGnQOLwRp SySBYmAEUph76GVd5W4ahI3EAWRiO3SEZuj+R4QlL2ktKkIJoQ49d2j6AW5ENAeCl15+QW6d CV5xF8mLINrtlgS0UgBL+f0QYs0JgODll30W4AXDLGM9M4tzzsrVK7E3Hd5a/uIu9qYSm+/+ 01X/DJx15qpJqeUAq5pIthPCLpP0gLGkuHIKT/lPo50kRTCdghh/VQGZpdx6JnkAoRaaRcIb 1HJET1NfXy96/ZFP/TL33VsEMkFMu5MA9UCP5f/xh0UZEX8BGmQsEPTmLZFQhJ1x242bBlny CiHOCfCuXr0KYSBQCeCF0AyPKMI0By6hjpZIU8AIC7c68KJIsDuToW142eLLsaumJSxa8iJQ +soXrwboIEhEm9QcpllylcxcserZw8YehreiP9DXp0SzFO8oZ5h2Ry4pqiyCsh77siS7J1Zs kCDOvYyqKAcByGpSSVoOhLvPVp5wri1FFa4TMoUWRRgf/mp4zt9++43bbr3r6KNnypTAO/mU 0hiKiQT2uEUvO8aLTZw4Cb3U6OBHgPZPX/ycyyfcLLbKHGxGCSCDPQCyY2YeC2kI06qUqbDb OVOQgUCmwbjW/+SogSYhIAn9X/QWUtCbE586f+FVfIOrJ558/DdL7pbHVQB3zFuWIAdd8nL0 YZYpcpYsXYI3lbTPG4x59MnH/uPG/8AOvrAZG4sAavHuUm5dooEPXqyhKCQgIVdQzrdOe5lp 5bFYC6oqlz0O4pEgSYpNdGq3jE9VyhnzIABZ1TYfqAI+2LRRNp02HFJGzKNRidgNSEEDKTBI QrQov8bfb6I7TOQIaXgC202bBgH40PQTNNUn0MLFHnfYCgA2o+MfAZpLSCVcRj+XbAO1rOWc CtIYBQau/7zle6KBScM17EShFO8oAUxY9lp+d0n0W7ZuRr0wJlagG9I43l79lp1AOR9tyfHj DsdIkTv1nZDQAAd40VZJ1JY/esbRMpAdwV8vmN8PyGJLphXEKEnfHwSKDQqm9YdGReZgrkeG ysv1R+UHvv6KOwby9APThkO472+4/uZFC9msAAQ+1117g7zZ0nvvG3BQNhVbIuF5owFilE/7 lr9c3aZBsgpKY/9NKMI7BJzKu4WbKUUOLjGGfQFqsRsI0JnyUdN5c08XNCUTdJ/IdwuxYGw9 EgLFkKaRYnYCL1p4Cb1zMKMYWF7/2+v4vJjv8EYSKL1e2hddkQyThFVnzz/n+muvP48PVSMy jCBDgrZKos8FfOs84sLLSvTQYXdxRWb/nZJe95/9Z4ki2c4khczhtJYRmYAhmDWkDmHPULIw f//Se+efcRa9E0A7lDrR2MvH++6GncuXL0NDEmMO4Em8gsSICuwtgrT8lhB9/MhBgKZsiUTD L/DEiu5258tBY9AwqkN+XWDJ8vyqFei2QwMTwKSMKbOkF5nYkg49fT/+4c9XrnoemUAxjMaq viMc/YYIeX7wnR89/uRj6FjEflTUNkSTDX1nyrhZdI2BGI1QGarIwt7eXvT34+/M+WfRDiM0 7ANp0GOsmaiIQ+LpFU9hdzgKEj/avh3bIIEdg/gpBMMn0hgTe8t3b3nsyccx7n8x39jp7iW/ dpBpVzTwvft2lljmsydOPGw8iR1MWIb5UbTkLz+zlkBWvvZDjgPPPzaLA3DQOHjMu8SMJcIy +AKlv7zjNipCq+3X9/wKTTm8KyQ3AZhQSm8J6aUk+vjxByBDprwlEujRqLzjrttdNv0AAWiH AhRIkcMnbINkKMXbVQcyc9HDHAsuvHDhJxaci4qsXbfm9dfXA9rMlGXlPLh8GR+ScgKahGB8 df26q797020/uwMd+WjKKUCGOQagAZbhT9ECtKIXlxgggrmWhGWgQf7N371JIbY7xd6U/3PP rz5/5RfQ3080QK4f3/ZjQf/jW1kaWIYtlJDA5b7l57dU2a4UwodyguCLPoWdEtCJvPISJBBy 2N+nbXZRUrSWp0GndiNE0FDFxKkuw+mbE1fvECcVLsvKMluSyYxHg2vcuAk9Pd3KLB+SCdQD 0Jin9aB1hidTySdi9EkR3kmKSiRpt0pz71sJNhfFdp75+8VXAKMxUM75paEdu6xZ3ioJ+Yi8 4Bl0L5bACKNoOcbhy1c0Y4tvBQplpZTWZRhuwvl8GySwA9oYmU5ELHyP8QlYG8NuEKyR3FPY jY2Y9U/ZWj3P4lsRZUFRfpahqu7YwQJLDIyKZYYyd0I5FfhCnnwQuyjVgawMt9mTKtfFnlAp cbqAlcpUVLg6xfBUzPpWkNQVZykiqgVW6QEhzVggjhu+fTPiJsxDsuyuElL70QlG0S6hQRhG CV2G4TrqmTqtcm7z5k6nVnDvYAAyUbViQpmIbvBfkapkSgBZ/zYtyTzlOpY0zj2BqH7/qXBv zIFLiTgO7cr+QDHhk6OPPgYNuoaGRkzGQubH58wDiqHh5oxigr2WCf1eqQy5ammJUZZulzHX eAYabykcNHIM1TOlFlXjmm1ERg5w49ySrnIWopRWhk2KH0qaVHMCpRau5YvqWnBUKtNC1CBm US3QEMb243LnFMbT//Ku20r24tXeCbrEaoBMlyH8ariOaqlyrjzDugyFSs82RGSgcQlkdtKE 2FolDDWvWKjyALsWCsISTUsyqSbucBailIoqKPnOLlL84EzcH6VlWSsZIKor5enJSmXq/EPj W64F9evBLnlZHmczZXZnSrelusQ6kLn1mCOd0x3syGgoVB5g10JB6ArIhDL96ouMMhIueYlM VMEll2wHZxEC5JISaeKpQKOQWw2v0g0qZIpEdcKFmIFOOJjtUERWliQoqzI1lGYSZbjfTKXc TD3XGTp1qkLNiqfFFO8ytwno+sNvZTmZiA3uKIffwCiqbMi1EIdyArL+7SOz0FzPqnug7oG6 B0weENhFJaUQTOU/qIBMVF5xilpp03m59CYB9YwyPHBQensAKkUBXY0UiWfF/YWrkWY3Cq2i TmeL3QIZSamsKmXxChVlcUnOIQHOtZbIa5QU+oT9NRJ8aImp0ntVsjv42iRZXHAHJrdFJuFu GSumq0yjmzoLyW6IK7bfzDiYcy3N1tRz6h6oe6DugQo84DeOt1VHISsSBcoK3FUIqjkl4UKy SFQgkyJTLkGYXIGYocKieGaomGVjRzUXzkZkiez+0Ggv03BH2ZNJNls1lKRiNelKpsqkDqNV ypW3gkqpu1MvGeayNkotDF5zp680lW4QQMxt07K00DpF3QN1D9Q90G8eMCMjcgQ+HsxAJiqp uKDfXF0XbOuB+iWwdY1jAXtWXYZAjnJqWigeLCF1EC4vUyl5xgRkipE2FhKVTaGoniEhBJfF ZRBRyQlpE8orEVEWTwWekdrzA2dnWZUaAOLK7orKuCyrU0rUoXtpFHcpjnLpF8Hlkl5RancK sfiDzHpnv52L6vl1D9Q9cMB4wBSRKZYL/BSIKhE4Fkp0xqQzl3OpUZLbMykCJZZCt6Vb/qFB 1x+eqW3NrO6R2mooSKtSkTt24W9DFdzxurKzLFEGI6QTZyG81LoikoyqkkKF6SmzFksG19Ym SPObJTq7xtq6em7dA3UP1D0weB6waFqaoW3wzKtrrnug7oG6B0p7oFTTUkggeBvAaK0/FSqz d2vf0hQ/BmU6TJALAeICHJwJUWGX1SuXHmJds5TwuWs5LquikvW3fFXfwXVuEZEdXBWs16bu gboHDn4PuI7IyBXiR8v480HZxrzSvnPDZaOwtPByKOwMF8rLEWakdVNHI0fps/6QWVrrgUNh dzlNNajB9TXJLGQ42+BcaiezrPwBUKHYQxpd+lSY55Je0WU+tQYyWbpQaWY+aHLk+opKHQoV F5WtJ+w8MIi3Aamu1ADLm9quljXJFxorNbkKK0o3LYV1VWipsx7SHhiE+/qQ9vehWHnriKy0 JxR447eqyCvrxnXJRWRlSS5dC0cKZVxMLabdOuozFFJFhW8MZXRiLhtI58gGDYBelypckklT 9OR6sLRrCSojnVfJbi20nuvCA6UjMhdC6iR1D9Q9UPfAYHqg0ohMsbkW8ZIbGSIMGYyfPkWn sEXxhcUpSCdNnDJ//jlHHz0TxX2x2IebPvjD8qV2ewh94aqvgOzZFU99sGkjF1fQha18z5x/ zrsbN6xc9axZDYiwz25PX+/9S+8zlyLn9LlnTpmibrItKDdu3IANzHFKm/WKfEr09vW+/PIL tO+vcITsAuxcCZr/tVH9z7yUdvOGQOxCcvGiS5Ew7857xtwzp06Z9syKp+w2x/2HxVc0NjTe dfcdZNgX+Y6ZlBafT694qrA5LsuSzWTnnz7/02NGj9mw8d0Vuhuxpe60KVNRJKrG6KTj6RVP Q+Dliy+HainbkATNxk3vHTnxyHPmn20o8HjgmUeffGzv/g4ln07tlFoSi8zKuAT7QZZwBWTy jXDIuk92Am6Csvzw1auvXbDgXHBt27Y1FuubMP7w42edcO655//6nv/586PLlVsKu0wuWnQJ ZepAViDBhuQoWr78AUsgAxFK3313gx2QAcUu0iUrSnGKTb8JyOxosDH4vUvusRNOO1e+pIOd LP+yxVdAJuSLzEsWXUpa1qx7RdnaEih2MWqxcYMdkJ168mnYVk4AGYiFWJFA5uNPPv6T234k cuTE56/8QiQSWbd+nQAyoJilHMH17sZ3AWSncdUiU0mABkA2YdyES6xMWnzx4vsfXHrf0iUK V/20Jh5wBWSyJjzPZT3DMu+hmSYUW79+3d133/V+IcLyzJt71lev/vpXvnz19u1blZ1x5809 E47q6Og46aRTfnX3L2vutB/e8j0CLAfJQMOvXcOiQnEgmvuHyz4LLNuw4W0FeogGEAZ8OWv+ ORS1CUYkjpl5LD4RZIlMVA0VbG9vP2PufEtpgtJNAhv9Xs2tpTtz9qwTL7148bkLzm1saPj3 H9ysSEA4BhSD9hNmndDe1t7Bo6Q7777zjrvvFJRPP/w0ZP7LNf8icuTE2ReqAZdcSukHlj8g C1x4/qcXXrjwHy+/EqV1LDO7q/qcmvaRAeT4H31XaJwuxJldUFWly1mHYyleBfC3ASVQHYCF WOzdd9+58aZvIrwS1q5c9cytt/0MGi6++O8UPXPnzkPgtnbtK+PGjUd0xkuhpYQiWQi01PwA 9j373DMQO/uEkyyFP/Hko8gHQimlaEUi/AQuiAjrhFknjh83fs3aV7Zu2zpv7ukKfWWnsoPW rl9z3U3fQsCFzcznzz1LEfix0+Yg55HHHsbnZxZ9hhjLcK4ijp+WFLL80T9+4/pvAj0RlwE9 rWSUnSfuJUtOl/enJW9lmQOvUbazpkAmC66nuQfmzJmH73vvu9vsD2DZ6tWrGqJRueiT5y+K RKIrnnuaGo8UnckEg5jesf0jB+3o78Pm4UAoHXwLtNQXhnhN8J4+dz7Sf3xk+cuvvITg6FPn LxRFNUwse3AppM2bM1eWCRBBIAY7lyxdEo/HTzbBrkxc2zRCvxUrV0QjkfMXnFdbyXVp8ED/ ABn/saBfDHyWd5T8dbMSV6EuK1Hl5wmLKWEQMH36UfF4bP36NXKusPb7P/i3rxtbcKfxeOHJ Jx9FexM/4LNnW4c/srQBS9OLgp07dwiNSoVff309iginBA1iNEDG4zxeo0xEYYjFEKBRY/O4 Y2cJ4homEJdB74zpR8kyEYLhdD23c+26NYBd9M3LBOWmFQ84s7+87hUQHDlxsjPZoVAqHoFa VbbsPrJaKbaTowAfbpShfCjWwlTFYHQDoV3psgrUCnt1/Tp6m7ly5Qp03qNxitiNS1BkO0kV hpl50NW1aKFFB7ncKRaNRtEpJis4ftZstJHRQnz40YfkfDmNosWXXnaiBL54zQqwQAQk3s9e eP5CRGGvvPISGIFlqOzsE04UfVWytOrTW7ZuQbedLAchGNDtj4/+EZkPP/4I2p5nzz9ber8p 09qmf/GTX5jLNn246Ue3/VjJV5y/Zv1aEIwYMVIhM79XNRIoYoyFg33G77TBt7ASIBMPCXw4 +DUY7AtZQ/0XLVoMaS+8sJpkYvgFgOzjc+bpQFZDVSVEoXvuumtvUIgAAbfe/lMlUzlFz9cn FpwLEKT3Cej7B8FrPAIiSuqiemD5Mjp9/Y3X0YP2iQXni5EZisAans6eNRuoireZJHPt+rWI eefPm4+e/hpqqYsaFA9UAmRuwUsHPDRTtRMAAEAASURBVLFKjltGyRO6DNa1zo5SIgS9JKMk k0xbbZq/AYAQUWkngcJaqhb1lGOIE40jAyeapSecMNtKhOwIIcaCUJQJht/+7t6Sby3xtgFk sjgauvHjH/78oksvkPOV9J8eWQ4gA/iSitPnzQdYiCCOQk7kYPgF2UPDso6deezvWI+Wegib 1QJ354grAb6CFm9IkW5oaPjiVV+izFg8BmgDwAHUBFnJhPw2sywLqZsf429KqjASiGvIsvP6 7WzINTKIM07DbOyPeSn6rS60DWaiEiCTPVjWhRzMig6SbrQrp06djgdYtK1kQ35zz++j0chn ODSgjxxxEEoRhck0SP/d4ivsRm8plLU6jcViCtjhdOTIUWiLiWjLUhfGXqD/C61FlKJGaFk/ oUdAyAF+4ROZylA1BGWTJx4pXmtaSi43E6gBkMK7S8F4On9DOtfY/Y/SC869oCwgEwLLTcw7 7eNg+WDTB+Uy1ulLegBARlgko1NJriIB2AYGy4R9A6OuWMNKU2Twm2++ASA7Z8H5S01D3tH5 hUcaLy5JA72gxCAvuSGJ+QC33XrXzJnHeUzskl3CJcJJUqGeRJlTsU7m8L179y6HUlGE/i/g 1N8vvmIS79VGjCaKqOP/81/8HGBdGI3hsp+7/Eo0QmsLZJ/hoPm3N14n7TR87EHj8C4ULb1n 6YkcdoWR/Zc456wFEP7UiqerU6FcRuFIJ6lK9FRWgKbwOqkZnDJ4IN8/by2V+tAzpPhfoSl5 yqwtjFOj0WqFz5KMJiYXHNWTkLn55cuXonl4ycWLZxVGhBUkI0a77LLP4uSxx9mAJvgGw8fQ 5pJRDPkYeobucAQsoC9wDvmvB3n/FwbBIi5DdCbGx9LwMbwrVIJT9I6hAVjbkRAYE3v+uZ+E P5ewHwB2LahvDrOIFP9hSARePgDmlPyan16x+PLpU6etWr0Ko//p5qhMhXiYqhFSmepquITZ lKhGlCVvJU1LS0H1TEsP4KG97bafXX3112+4/uZVq1au530x6G+aN28+wrH7lvyaRmbQ8DEQ mIW88cZrADK8BxCj/DFhU3SiCXoxAbO9fbh5siTm+onGKTqwaCCF4KWEmGup5Jd7iioT+IJx BR9DSxJoWIbc8S8kA93QaAXSiVH+c+fMw1wlQUAJzKC0jNqGtw//kjTjcuLESRgsBnD80c9v IUYaPgZUNb+gBLRhRtGc0+bQq0xFo+Xpl/QuNqUUoZaQf8zRx3xZIjvlpFPQzoUBt951u8JV P62JBwYUyLBnMo48fkoqPowxMZPEZRbluRCucAheF6yC1m0CYfmqVU/39HRdccVVGL5AMy7B jGDhjjtuExMtafjYI48sl20jezCm7IrL/xGNMgFkaKviT7GAT8BkozSAj+ZeNnkC5hxTJxGJ EnMtFcniFGiI9CcWnKd0nwkCkcCLV4AvTmm4P+Vj+BhqLTr+BTESQDcAmTxdCacyAaXtJmCi yvJMSUAYBnz8dukSASvUzOQzE+SLzJwNGuCLPF3JrFfJsZxKCRrMQhcaMexDHvmBimPS0tLl v6cZUYrA6k7lWwaS5AraCh6w1qJinNk+M4Gt0Y4F3oUXnu5IgMIydLnxYlVAZrSVqVOsc2OB UYg4q4JVyHBKtLUNnzmTDf7ctm2LMhvckq06exS/qBoqEF4BC2m1ZLTMVKx0QwMWl2QmY0q4 SDFGPnWp0Y6M8oV6469zUY8du6kiRZYynSEz9kta1FFIVyplJhCULhNhTy7izbmJyKC6enUu rTqYyfbv37uqMLT1YK4m1U25Xw/+CvdDDfHU0bNXjjPNj2o53P1Qi4ER6QbIamwJNTAhtODg KvzMLpqRvTDcTDHZSKMUilPlFnDHJLhrnxD2VGSJHZOQWnuDay5R2GpXmeo02kkVaqsTb89N CuzU2/MZSmoixCCxH07Mdewn5w7IW8t+cFBdZN0DdQ/UPSA8MAgRmdBd+EkREG1Gb0HqOqEM qC8EaEKFIsdRY0VMigLb00LdbcsNBWURGzgtTgp19vLuAkcHWDAPQNa0jx2d6s598MbbA6DL RoXiFYsbQWQppDYCS2YrYoT4kozFTh9FhMRpKc2eXOKsJmmptRqBlrzQQopcRmSotvxnKZNl ktCBqYOtEfWCwfZAZU9JIBiYdNH43x71m+6xxXlFg12VQdYvHqj6MwUPWP7RFaosIpNvVNXD dE6fMt0g3xFDUn3dS+KyNLU1tXwq8FD7b/Pd+XBfROQfkgnx3BgeLpyggD6rdotBskmaMMBU 0p8ZzjY5a64MyJxllldatJ6najg4A3ZYtzSFgUXdIkt9eyAVFJLENPCXWhhbI9WKGCHeXON+ z2luaz78ioY/+pc2+z17cjlPfvBvS6nO5KhK/CN4FF+TcOdSyQBXSSGNqC01uhJUJpGit0zu mpEPqTumZrWqCzqAPNDY3DBmsf+p4DJ/KOPLhnyst2PAHsMDyE91U508MOSArIaDM8z1LhGg EYPdT4zx4VKojIVmzU455Yoi+mo0CmuEan1xGJEhSPo3EQwFj7i84S/Dlke8Eb/H3+fJZ/I5 ehHhXrEw2o1PyiKWbBCyhQBWSCeiTKKvSVIRbFDtrMCZVJGriCrX/wq746mzZkdWx0KXnf0O MpwsI286+9RBdL3o4PaA1+udemnb+lGPRCItQU3zZRuasq0hXyStZQ/uildcu4PpgUJdlL+K 3QLG6oEMQoBl4k815mByvVq3+nl1HjjxwunbpjwUDDYFs0FAVzafiXrDo/1j/flAdYIPfu4a QkB/OEsxz/K0VnoJYfz0BaFOkVWtdJYjhwwrjtTvB/uUlmbBOrsJtcJTSi24YUphNcYKUc5C BBmZ40ysmGx/qogpKkGT3+fTctm8phXcBlJWDHfpTIZuAYRbuhoQ5DkRsrxgz3m8Pu/YicN3 nfpESmvTPKls3pPLgcSbzeV8Xq8PKc6rC9YFmb6JQChyyUViyiI2aS4vw1mXc6mkSfYHMUmF 5SSrYi5HkYm2XM1ylU3CpIwh10cm2VZPDhUPtLQ2n/fVsZ5hXblk0KMBdvK5vCeZ9ebwneMQ lNdyuWwun01584itkJn35lN55OAVZD6ZzSfSBTBDf34+E/T6+wKjX9+XiefzfvBk8J/VNZ/2 pHbn98dDqaFS87odB4gHikBGUOkWAAeqekUApztd6O0/Q41rETA9RSOEeilhVSpivf4zU7KA JYUVlWkkdhNvIQN41DDlg1xDTPNpSa0368lls1kfsAoolsmk87mkls9mMshMebRMLpdOp7O5 bDybQYSF/GQ+F+csYEumfbG0f2pD2Otv8uUCvkwaIRrEerP+vDfZ4+mKeZL7QgmldnanlmZX 6Qo7XQ75LjU6k4lSUmS6Fg76D7YixRUO1ROURSBzoK5JkVAJaYfyRXLvTPLYUPCV14dr1pTp yj3xn0EtMSLnyaEWmifD3nWiVehBFEbNxzzahQBVFqmBQNPQXORtynwYZIC9TLatIdh8eo92 /K4uX0Lz5rxoanozMg4HAt6eZJ9h12L3LiufUtyWQ8HP5ZhvsNfhPaOBrhwFDrTCaQ401RWV bXXNgQwWoJr0aVsXorAtrhcMMQ9oPm8WlzXX3bGpLZsuLrdvZ6bDbZiLaodNiMfziWgymPQm 0ZOmefHGSX9Nmc8FAvl9sc4BAzK7Khw0+f0POkPCVSqQiWo73IuDaHjRvGKqf81heqx8UXwL YalfN6/wrUvQvy15rDN1SazUDbugd0NsrdKUi076ZBatxaTPW+3IiOM/G9k9ens+Nwyw6M0g fEPshvgOf7DXi4gOMV6IvcNkh8u6KGSVVZyE2PMKJWSa9acgspdTrJcbGlA7k+l2OFAJo3Ta wfxWnxtLuy0zYbVDTWoy/GIwHVPXPTAeyObReR8uhk4VaT3iuOHxWa+HvQ2efAzd/Hg5ydue wDL2hoDdp14fXowG25IVia8zHboeUCOyA8UTRWzmKRXC1fPaV0t055No9YdGUaibqwzt0IcZ KNS1OSWdZXlCN1ONAtAAzGTT6LjnQypEXRUflDA72hQe/ffvxbWIlsujYwwtVY8HvWOGAxJ9 Pk/nsD0tnrFygZ1hMg3SFVRZkWB1KpRbFdrkKTyWV8ENDcQrZEKhpUxROmQTZLaolEhUaXDN IzIyrLR5oBB/Vdbh0GEXHqPEgFUcvViZLN5Gsj5+NwfMMx/HLGzODu8NezHYFWPF/Py1gEzF QFLD/1zo/W2D9vtKjpU/ZRMPzDSgY+j89ZcLqwcy+aIjXclRIVslquo8lXggk8pl0tlkRsuJ XvkyxYyZ2BI5829ebyvr3Ud7Mof4LpXzpPN5tFkRoIU0vO7UemOJwP41sz+dZhvZ1o+6B9x7 oKqfPqVpIZoc7tXXilKBwhKW9ENQXpkrWNc2Pwpj18o0jGrtzCQ840ymXAhFMoZQZDAGTBUh zoUSRUzhFOMwjrrA5w2EGlLpeCbk8aTYSH+MleWRApgz3kTGn0jsH795bfBTscmx1/9mLchd rrBG2OeOT6EqiKmJNBLibI9QRHY4E4OmXHqlejU/VeypuXxngdVHZM7y66UHgwcwLQljXdFH pj497io39aTRoVM/zGZzQW+TV0NHvnzPs3Fmfp+2f3tkx2tTjjg81a5hXK0+GsOd/DpV3QMq kOGuoj/ECiX/hqz78KBY/hUMtiwzZ1ZTPeFHSghRNvl4CcD++PADFqaRMYJrsBMsIsvkMU7f iEHMLAzKP3zqGB+66G2OcDR09N915bS0pkUTWkoPltGSzPFpl4FAILlra0t69UknjkuMn7Jd C9iKstFgm61cUls6taC/vF+pPap9lueK8IE/tbSqvzPFpVKBTFfs3g86R3Xfsr7qJA0Jbrk6 SPfrIXT1nxbMNcpmAskkG78vH6Fm37RLte5FzzQf1sJ/AYuFwqopJ7bmx28P5Zu0fCqTi2E+ JijRU4aZ4+lcIOJPbXuvKfDS7BkbPa2Zbs0T8Obs7kkmXIilRFFf/6cGWLWiDqeHwmGutXOO 8IldH5nxhhXkFonae1iR6N4UC+vqWbXwAEbf460l69eSkGzk1ObcaW/vHLu/zd8QPz7u2WKh CfuJzLhwfzbT7PHSPHBcW3490UPmD0YjyTfe9Ghr547d0JuMpxKhTMRTXI7FQlw9q+4BGw9o yptZvTnpjINyqY3gKrJxp8t/VUhSWWW7RVolEueCwjIhyFwkdK/qEYVgEfUUOTxBLc1yww8y 0yipeGZdKqpWJCymRCECKMz9Zn1k/AiGg2NOb9z38b9kWzPBTETTQr5JG1vHjtCvW1HC1FNa I5N7vZ601CbFKFj4w9Poz216O5NaPe+w9/qSfX3g8fsiGQySLWdwnXWlivoNqWJ1JGsMFOWc VC+tXAkKPZ2WY/JA0Foa6T6zQhPztgsriiesZKJC1Q5sSrUdKOtFA+MBn19L+3KxeAa98m2j mto/Ed94xIpsxO/zZAI5fzofizRrzcepTcJIJDRlQUcWI2A1TC9n/WtY08yfjcZD3b6w7/2t ns5VJ4/fkEh091ItollvJJPzUcg2MBWrazlYPKDefGXVi3dQUzc1+zxADwU3xWmJ6gg6JeHM Rr8LZhrl94ITFN4AiAe7LEVmFQWZxhcJQi8Jt+Hy+71RLRzzZ3JTY3tP3vDm8L8Ew/5wPpBG QB/KaflQOOjxHfV22+iRsoBZcw4fORMLjWH4Pm4zaGJHr9YV9kYSe/Mbnxhz5BZfisdiVIR3 o0GsfQFL9MiVJ6mw9p+SO6FTOqu9KlcSZQvktCvmQ5IIXhKHXR+ZICiZKNygJekqDudhrnsd LswYTBLZ9bCjP+pFKmorGU3Kzk7tzd0f7Zu4LRDMD0uNacIvFxYkY3XAZ9CXj4Xak75jQ56d hWr5A75Jn+hAjz4WJNM0vyfD+sgwITwa8O3fH3jmmeHHfNjS3dGBTHFgrL8fkCnOXScES21r 7Vo/IxQ2ID2QZsh6yzL44CAW1a8qIivTF7i+dn8lJMFc+Q/UogIlOOvFtfBAS2vLQ6+/s3NH OuQJNKAvy9ub4G1FfiG8GW8qndWafU3Ro98NDmslhcfPPdw3eZvP1+LzerLZtBfhlscbYOng E08GTv1wQrxjv2Ia1vMBkCmZ9dO6B9x4wBbI7CBHzrfFJZmomBZNJXPCHuI4O96VyX/sl70o 1sjrptLuaGTolNMluGXSUnBrS0u10zUp/ipk2zKzclGoy1C/iaCYSxoFm7G4c1fnjJGtab83 kEn7gxrWtfYAm+jy57ERpZb1hvIZbcSovsD4ZpI5dl4HIiyscY1+MbbGhS+ACZa4VA8/65/5 9qS9739YVK2nMLIslM96A4Z70sYincf4XRax4qQyeY2KjWeKKHFqpHJ7JtiVhFv+QaVTbK7t qVwzw00jF/RD2g57kF/iUOoPauTUjwHzQDafO3xMy4zxIwKJ5s5MIuUJRAJsOGvBgFwe8yT9 mr8BW7l9bHswHJowsdU7ebvPE0TLEjRZLe9PZH2B7PNv5Ua+OKF38x5Ly71MCF8Xw7K4nln3 gL0HBhLI7K2wCO0ciAsoZkY3J54DoUzUqIbGkswqBYaivmQ2NkzLjnnzlGlb52UynWlPKIeN dPUjrLU0hkYHvNFR03Y3z2ibNN8XCaEdicgZNOhF00JB7a1tgY4njwxt6Smy6ez0jUEevkCA 3Qs1OqjuymeNZFciZuhYUon1Q5WH7hd/7W6boVFR5/rYPUPl2K7IcFaoho4lqI12KMS6Yt6m w/OunxOT8YzlKexG2QpTgVawkDRdJluTH+3HTDq1N53dlZvqX7Rp/CNtoTa8BMhkYu0NR0QD Ldl0IBcIjQ7FvefuCkxMhTJRX1DLeJM5bwCNxX3x7pVPDJ+62RPPqGuQCbt86ERDpdhSPrYH lQkzbelcFShiDHoNJ6586UplDYkUC8uSrNRc8FYjUwgZlMQQicgGpe51pW49kI5nU4l8zOPD fm/YV2T38/umvHNxKo7lMMLRQHtDth0tyHi2K+tNYInXSVN7WiL5rC/HJhuhL9ObDfo9Dzzr m/7h2Pj+TgeVobwvnNPwKsGBpl5U94ClBw4xIMMvUck/Sz/ZZ+KxM//ZkhOpbXGhwJpKWM6p xBsAW2GSFGGhHbFEy0lIl06NhRXTWCE2m/X6NDQWQbxjzY6x688Ld2ajvsNy/r5kJpvIdHoC Cc2PdTJwU2HVMSxiFgtkQ42+5IuvZ4KvTu7buFWXZ/CYyMRqP5hBrnmwzk+JQ1RHNbsEHytW eHGqH8K/SoKVm7kqUK0rKnz3h0xFhd3pIKq2M6nK/CELZMrNJJ9aV1m5NtZE9dyKPIDeqzTm WmKFWBquyoVsX7fV99xJu7dt6crE07kuXziVyXt5xxkuFnaEy/vR4+VLb+0JvfRM07AP3WxV 6fUHgl4XQFZRJepMB7MHhiyQOThdBjU5bWBRcA2n9QMeILeU6wq2mXhOS6T5RpYS865NHfnn ZsZ39/T49mFgmZYOsICNKUGTElEcew+58tnU2O0jYl3dEp8hKUxCP7+f7XSJa3pIH+QQu8+D 0jV2lS2ZL7xxIAKZML5/EjI2WqZdqFUugMohitUCw7mgokSxjKzSz6mNqZ+Zvm2lmCjtMzAO LJdBUFaAGIBVAa88nr0f7k08MSO/PwSsywcyOS/mh7NDy2laOPn25r5d60dkPtjB84x28yz5 AwPNMOQs5zVuoeTCfoVEnMrCHdKCXk5I9E43gcwipyX2erIfPQCfE4TVgawfvXwQifam09gp HBXCnaMeu97viP15eq6vM5cPAMwKxRoGlwX+9IRn1K4oljNTeazO0a+Gkf15LIRdP+oeKNMD fjcv6cuUWYrc4lkoxTKkygtxSRk2iRqXz1rUogoRsngBjckAtTosoyiApwrEhQEFQgZR2arA MvvZPBagBgH+ilw6w44NHdEnz9E+9dfG9jaU4n1AOJD669tebevU3q2biUrn0r8Lhuki2E+r 1+fDgFgj6tmSKxXjp0biomiLQit2KU/hFSW6Bv1bFBQSBT5LdjseVYbjuaVkM0dNdJnFIsel AZa8/ZLJqzo0IzL4yuHPzhuokNNfBRLtNB1y+V5PAn1ketPSsvrvv7Q1/vTJmWx3CjOZcsF0 NvLU6tyoHTFLYnMmrk44rwUx0anCjQHMIus5h5AHajAgFrdgeUfpHwsriqKaYspRr1mIOacg wCwRpMi0ZbDlc7Ro6BWKijvXFF33eGPJtrVkfWO2x7srdjYNO27Yp7Zq0czqDX3Dtk7r2bXd ltpUgDiOrf3PX4ya1ThbaBJ2qGeYHXiwegQ3Bv6GZkR2sPpcjTMrqyfuUcNtSldSl1V6fBlR qlJ0fv6tFnIUY4Nc2WT9Qi0MDPwEM5LWPLhnzyMjMlr3q2tHNW42hGMkU3zq7GQ9E4sXow6b mBToBbmc0GWp/jVWQ6hWEoLbTULhFac6r2yWnGblglhJ6Lz178o9UF81pXLfHTqceJuI9mIy lYmN357TMtjmCB3znhyW8sfyPFj9AoPx0bmlAcj8Wn7bFk/ineH7d6YOw2IYY7CwIkaheUDO Jh95NR+242U5+AXFQAu2Cwk7cJL3NrbmI56QVrNNlA6d63Oo1xS/GFgjveAF3EzmQy90ojFz VURtK6ZQoJhiSW5ZB0vKoZEp7HVTOcVklVeI0Auo+79E378i1HiqS/L4G3374vs7QrHcMW9g 6hHeLfr9vlAgFfD7/IGAXwPM5TWWCoSw0E/A9/Lb/uGHjxlz4d58JuDVcgG/N8hGx4ILkylT WDgbCZyFA0GfH6spYp9x7J7k8Xl8sUQS8wd4W0EoN9pkeSbqTqUKq3KqSxBMlgPXRKlOXuLb UokkREoWJRWYLHkFlSWnKK0nmAfynhpEZLKjlUviUFTFBZClKmJk/XJaIaNTBzmsFYDDJAL3 vMwlp0mm/GnilgsPqHS6Jz2145hooimIVSz8PJjS0J+VY+8YMWZC84bYjpwszMpginggNTEf 8vt8Pa9GeBSGMI29kUTIBvJIgC1gBlof0MwXYOPNvJ6AD7tZ4gW6N50KpvbrAziMLlK86ex6 I2v97OD3QA2ATHbSYN9eZelXHg25HkhDFAgUgejrduYqCjFCHuWTQLcSirIGO9Xb2Rt8PTjB f2QWg/vR508LVHDfYBgsnIIh/zjY8H/Nl/r/2fsOwDiK629JpzudTr03S7YsF7n3hgu26QZC TDctBBIIJCEJ/EMSQiophCQkwBcSQu/EhI4JGGPAprv3KsuWLFuyZPVev9/UnZ3dvTs1F9Ba vp157/fKvJ2dnZmd3cU3Kzs7SLuGho1EgfBIyTtpAs0YgYJERpRd6MwRQWzkc3NhYR6XqxQc OVAgYLvNGkTqgh10gPYViIDRkAVTD5ww1lpFQueEdgqrvRYntB09eIu9t2Vnv8c05k7w7quG eFGUhWScSxkK2a7MgiaHV7Y+ANXW0traYlmqKsSlPx14mklmbBPmVWIaxPEVP0FfP4hCJw/M 3ho5I0XdoeIaTfrppFsC1EQgJZoye7g9VZjRVAjyibL373zvvZT6B+5a9j6YAxoGIjAQgeMT AbTj7M+Y7GeOyBbOtqWXXM1rtrrIiauBHbO2Jp3QvTXmpPfkpztExn7uvzsxl4oNISNF40YR NjA1qJLNiGYNGhMQwRf7bnXNVLuKLo2sq7Q6ocj6ZeqKnfIOSmQZNTlbOMf442lqvqxZhK1P JvuDjI/TUYL4cTgYxBtnj7hDzoAgymydTYM6EBWllEDcOA4BcCoBc0Vx0gl4wtH9BPFkLM4J F98T2yFjjuw4+qmdylr2ODpmZzr4k8LPmcUUM0BAmJ0XA7TuREANcfDHrzsWBrDHOQLGI0rs YPs/zBrXqB+UoXGtJTPwjKflmbxGtGphlIDGbE04adPowSgP0k9Ns9+sf5UBnBILxhwfIuLy TmpMxmXGFu3IZWjBZntbDUYYBNipfyz5TETcC9bIhr6epGxd1CxoWbOIxpQ+mFGSbJ9wUiKH DkKbM9Be8ZefisgMTPZ/+Q/zQAkHIvBljQAadbRi+DNe4yPae/si214FNBGJkZ0CSWFKGV4S 2VohmeWGNaX27gQ7rcRmpBxV6radjJ1MdP9FliW2xMRCMBVayvmjchVSExXSJCWTKZJThhrd ZEbJCG0muOiMKrjeJ00WFHXMA+GHU0eSCUiUIk+STro1mJYV2oKS7peYaA7RrFzfY8c8NjTS TedDSxGjY2PYxkpQB8dG7viRAnosz1HqI4MrQsc95EGFjnmpuB2U1IkM8hP3L1MxT+RD0B++ 9c/QEjWid5WCKbD97Y8o9IdOzXmLCY2vZi3Yk5nwt788OGnC1GBKcPllV//w+7cz5N//+uCk iUFJBaN5APPljgBOHr6ODCk/VyqwAHDcrJIMjR6fwpJJTZXMcoDEOdqjDCnmF6Y6YAOkSqRB R5USYaPCmeSojor0TKeztX7lyOGDQ5l4YdjOwNDUiBH5MTFxsgI5lRv0mKiYIUOGMACkYiEV 3CbdY3DDAUPcyayBQMoKslFlQzIpCSZjNaRK9YUFlKVP1Kh+nahpFJR86mZgG4jAQAQGInCS R6Cbk/3apUQ2+pQucywmGjZgoJi4eWbJWai72p01aW7bAP0j+s4TG9P9RrL12n9BFV9spTlf 8oLWxgVXvv/uuvVfKFZ6mJQOMPnuutFDq30npvl/kpai7+IRhKYgV/b7qQok6H7YCksmbY6T DSkI74OBSKt+wP1j3b9Wv293EE7bqLAh+SlZ8KwJE6fFxsTC8OrV76lSc+eexrKMzswL/zgw MSFp7NiJyKwyy6p6gknvK9wTEHYq9ae2rmbDxrUBwQpAc1nhGEmb2GqkYLQY+gZSxzACJ8TK /m6VF5UJ1Yv9dkvw2IN7Wu/V00fToWVRJhXcvSJed93No8eMe+3V/15//U2JSUm7d+/Mzs75 /vdvfeKJR9566xVwzz77XGgsLi5i9Jde+s9//vOUauPcRYvPP//rgwZlQ9bni7r99p9v3Lj+ vy+9sNHSymDm/qKLLp80cfLBg8XQkJSUtH79un89dH9l1VGpEJP9aakZ9z1wj6TIBNrKm268 ZfbsuUfJVg5/wPrf22898tiDEjOQ+CpHQH9oXI+FdpqYzyPWoBARQVfhgmaoZFw5AW+AFaiS JIIGRqghb7ECXcMJrr63yusIw3krh1ACanD2hIg6iDsLQYYz7TAO6oijPdmSk1J+fPudn3y8 +qGH7q+qqohPSL7xxltuuumWvLzhZ555ziuvvPgYbSkSKP2qq775xRefFop+02WXXX31Vd9c vvztO+64lbVHQ3OHf+97P/r5Hb/+/R9+rbZlkyZOOfPMsz/+ePXV11wikT+5/c6//+1fP/zR d2RbFk0n+9VisNKiFfvjH+6NjPT96Z7ffyg6fd+67uZzzl6Ulpr2+7t/pYpY004hs4RXI9jI WUmajNV6X1Gspm01HzN/bK0HTwyyOLYKtTJicIM/vGednDeSp2U5jz4YIjFSuw42q5Kwvk0w N6zO9K2VPtEm42NN+NWPoyz/NGA3NWnSlizriN199y/RioGJX6TR51FbMZW+YMEZTMe8uaeh FXvllf/e/8A9siXC2PDW227etWsn2jK0PtIaWjG0d3+4+1cq8md33NrU1PiLO++SMKcEMGjF 0OSpQ1f0xe5/4G/oo6Ef5yQ4QP+KRABnBW/IZIHZiSKzRoIyWONn/ZXtHUtoAEOJOWU9KUEJ vNEGGIZgRbVLsv2xma2oFnna2ahsjWwTkAPdbhMmSRxNZaRZ3FhX/xSAostqUWGakhhamvIh ITt3bgfllVeWWuljxowDEcrR0mE4if6aNCTB9977R6QXL75MUtAyWgeMaNSefe4pLLPwv14M XGAeefRfrBGU5pBAu4Ze3sL5p0tDgRKqdMB0IGWUr2kJSmYA1KcRYKcIeRkx/nDK4M2e5OWe 4o+cRCJNAJTj5IACJEinjcOoZlW5NGpKUC3MDQLu2aZ5ZpvtmeYgpWwtSqJfJdpJIrN+hbrH RJ9Ind1nJsqPlKKRYn00Vd2RI6Ui2zVx4mQMM0XWtEeLg/mvMWPGMm3grVu3xoQQGbREaOOm TJ4uCDZ7cIFR+2IqaNPmjZihU3t/Ktd/uj/i6d/iMeDKQp3gid6Ewlo0tBsB1pEFd8b1xqsB 2eMZAUzk98A8u5Xp1JBB4b7CvehGSc17CxxvR6L3hyZPIq0JcFkP0coC5ZNPV+F3HL1nagsY IH5FImA/2Y/2C80e2eiO/IBk6ZRxjIVOoM6bJiWzbAKffMqCboJODcMEpQuiqp0BKMfwWwXY pQHnimnCTq8h5p8r9RgClpSTBgdZnewkrtnRxTS2Q7ZnUiEhctaf6ZU+Qt/hQyWUyFXX19WC a2vnyJGylJQUB884GRNhy95Y6R9j5kpfzGSHnIa29dNBVCcHVKUBNPnemNZUfaWyiFuvHhqX cfd/eIKNqVQXrIB+bqgK+saloD0JCFR9k2BbouQ6JPwLodwAnGildyhKcGRMhH30Mel5OW1b tm50Yg3Qv/QRQHXHX6B1ZPSsoT+OAfF30tjxmDY7jqOJHjBgRTWhZf01gdKYKi+JfhP+A+VX tE+Y8JgVNKAjQZTNSUdXyEF8TDwkBANMdX5NLcDw4SMxsSUpyDpNcmHk2NDYKJHWBLi+qCgn ccyOYS2uvBlqFT++lCCibHLQFu90HEySX+UMAkSWX4iZfjmtzhP0nKAYcnKwP6dwaVyJ5wkx u880G+ooW7GLrxnifhxHC7C8Q0ecoB9AZD8USGhYUsZOYKZO+GpyQnpAuU7FcKKbVFn0O0mp dKsGlWtJozymOm0V90OxaGMEplP+OqAMskSaPKH8wn170E7Nnn2qgTan5s1bqE5sTZs2A1GT B1ImkhKSMJW2v7AAFBFWs6KQkP2F+3KyB+tUkb9w8WW3fP9H0lVBltp6kmDuCX9s3Jb+K25L Q8KFgb19BGSgupWw1yWp0BWmZpCXm2aH0SVRwtSEf66KHEif7BFYtWolpq4mTpxmLcj1192M hfsff/yhZOHGIp4BkFmZWLz4UqTff/9dSbEm8PQltDktFps3b8HOXTutUgOUr1YEZI9MdINk f6h7CeOCShsz3plCLNUsSbM+FdljqYcwSnpYFEqCz3pY5FffJJ4keIZoITJClaAzffLXOKoM TUTs/pgiwTKk/KbsVQkljGtWQGiKzzZpKm0WCjqn+SPkHMiCbbeXIlYmVpmhU3bjjd+fOGGa GslFixbjwSY8qLRq1XucHhKCRR7XXvuteXNPp90yruyyy65ZvPiS5cv/Z3nEkpkFjCQ2bFyD tSAXX3SZdbnZHT/9Ddo4aLC613uKpZdnr5LBFJ6MWQ8SipovbVLGtVsJ53DwBsDPHBkOhLrB LjZBpLcQ+fBH0Ay0GWseJRmofk8ZjtEU+WGeUctKkuQNsESpJCqiwVRtgn9898xjO7/72teq yoq//+1PN37n+3f97h5Mxm/evCEmOmb6jFkYKqIVY2tiZSzw8Ob55y/Gk5izZ8/bt28vfBma OwwdOgjiwQAJc0rc9btf4BElPC3w9ttv7d6zC7DMzMwZ04mtp5953Gn6zEnbSUf3U1FPurL0 i8Oo710hrqG5ufLMdTKDULInHA0Aja4MsUwYAKQEle1FzmAoFCZnIjhJcajEmj0TZLFnaPnL yQ5cDhNcsZfS3Uuo4mo6GC3dxfvR6awqOiautqZm2zb9lp+gb9K0RsfEUjynl5YeWvbmK50d XRg5jhyZnzUou7y8/IUXnn7i8X81NzXCLPuLjIxas+azZ55+tIMic3OHDsrKbmxsBPLZZx9T TTD9W7cS/b7IqE2bN1RVVSKNDt0nn6x2uyNwZ2BU/mj8QcP+/fv/ft+fV69+X9XQv2kWSdvL hDTsHG0JcU4EJcyiqv066/zyc7o6Q/AXunD+fFpWfnxsY0mIjCGPIs1KsEywsJnbFtmgGQkO 490gLh1qfhCcfeCWzqcyuBDie+KKYlcmpYsEJ6hyb+IyTQpK4wopjjNztUIKXaJvZ/o+r1nS gBopzZTBcE71QEQ456yUcXTVrAMeSCoA338QLFzdhwDau8+2WAykgnnkV6zLsVYEUt47vl+n eqf6OEsHKhkmqdpCOtq69HVkUk6tR7ZEtYAMYIgEFFCFT5z0Ser2iRPAAU8GInBcIiC/ooRT 2GiGbF2RJznj0mwAKWikMKmZTsxBXhJoQnbE6HVf8hjYMMEYZJ6fbDzHMuTXRJdkRpV9PfF4 AAcLmMwKfzhB0ilQu9gKT5gvSp9Fc41lhSm+l5oFVxIYQJA1MVNWE5EhMIGUTDA6FbgpabFl 4vrNOIqa/THnoNEkZ8r4NWfHtOi2AwWmBeEEblExPUFgAxscQASOALtpRr9raQq9/TFXqYCr 2cCmzAPIIPD2kJOuavh32H8Mmax/jH2Yek8N3qpawuCleu/hgAY9Alr01QOjQ7+EebK+gQ8t 1dKx2R0lFqRvZIqUiUdETVzlYqp2YhQhs4hkaFpUn758aVlq/0U7DjEJ0jP4fRyc8x+tAS6L wDE4MMHXkv4+KGT1Eu2RmQyBhL/AgbBDaIIYMpKONpAGg4hJUeqAmWDyhWSYtEpmjaPowhva GAamsEkTLCXBrI1lGAXICWwEqoApRGgT3nKislP0EaphnGIoV23RFUm1zTeRmaThikknzwia Zt6qh1OCxdkpELbseAFoVlHuiF9/lKF6AP2UbTXiKOXXrKNUdxndcEioPjaOCWtftr3RI5Oh lwm1rFqU+byWBcpgBpmljLyqsqdp3UZP9ZzscvKQ9G14T/awDPj/lYwAf40PzgV5XiCBrO3Z ITH+Y8VkCZjpQsKkjqsRKxR41uh/OGs3qaEwLixEuGmJo2yZEyi5N7E1VWaQEiDJsE8wNdwm 68fJRSRijC49EjbtrwwaTOo0G+aBk2AzV+YC8SXQJiHctGGB1BvN9hrZK50Iz79lIR0ciqKD dDZojUHqE57a7YO2ZSfsn9YH3vk3cHy5LHKYIiMr+0lZZShpwf01KbaRYeKSZdKGDBiSJApu IogmTTD97ZmgtGUPldoD4MzSUspM5rluqbLV0AOif5eg8Lh41Z2CBCxBd5QNYE+UCJw49Q5L EWhDJiua4RpSaltGGJLJuhhMCERJ9xNgGwsa2jz/FEBnALamOohsYP+CUHK8INJ5zYE+j5Km X886+aHjaP5YO2frxADxOEagW9UlGD/FG2JRtYLQrVVA/xJEJROgOGqBSQg1cgUZ9VTBkrz/ rOat0KiRA0WAipm90EWIx2ZXpC0CVQaNZklTbJSMkpSakeBkyTWbZKoNR00u6P45XVykbrOj LOeXKSzYCRKaX2HN10BwbsuvSic/ekUPZNFajl6ZU4X7QzUvjl4qPa+6cUzTjre/uuUFOSVI kYzlF1oBHcZ6EhVs6JmAA5r1+pxK5Fe0W6V1BsvyOEP6l3MsCtm/JRjQPhCB4x4BnEaiRyZ8 kW1OMPe/jS4CFdeaBWSlNqZerFCTQMaXWYLSRAyexmAaxa8j05AnUJbTwGaI0Cj3QJsR5pzF YymoJNSBukIWhcXIWvOJmdSIhmGW4mzZKWSaMWMgTBCApkOwtDJJskNCqnTg+yM7eeAkQ21p Qr2x72RHoxsWjZQK4S4cA09UqwHTJ5o/AR3mAKdTIlh5gRPl1191LQ6XejC1swwsIS1TAi72 woyyN2QosedITRHVptG4cj82FMd6ldQMW3UdAx+sRkEJ6JitFIjdcDgoG3Yg0LphRvFUU9Yz JYq+gWRfREA7Kn2hshs60CTiT2/I7BSQ6sJ8pRWHJDXXZYVidAVM9EkuyXR/g7YeatC89GO6 hwb8aDxpWcEHTSti92LYYzOqVU1J9zxQFQ2kexOBYxB37Uhr3oKrDy01BMsCF4yvGkazDa64 OUmARCcbBGk44YGtNklkquRUnqKDJvWJN8nnpoURspc69eaZgSzjPgNPAVI1g/NfCbJnc5TR 1/ULM2k2MlzGUMJYhiqSMnK8oApBKXsfvn/GZMDsgeG7NSUjZmWpftpx+4RmuG2k+kRxHyvR D3cfqz851cm3X8B9VpHkQbStV73hdjdCzJbmhn8HDBPB4gwJfylbV/wJKO2HVgD/Ul9lbg+C /FUO10DZRQRQcfAXLi/ZrCIJboA9b/XkWWonLHtFrPcEiOhAcbQxK02t2ekw3JCmGIktkac6 DQxNWYCGXYmUpghYucSZ6BLNE4Ip9jpf5Blfc0Mw2d4v04D6tySV+IdJdTzcUowwRB8ZKU2L CUarCuKoEaXqPkvoXvSJ4uC8Dg4lT5c+8awnSrSzplsqtGPcLdljBA7yMKjeoBKrPTLGctCj RgAQvb45SJGjztA2AEFiqkVOddBIq+b9+mmIqKnA4laEKi/T/r2UMLuEZoFp0uNIBaURpYXl GiWL5ZlOjWhn/JjQtBL22GbPy6N50HNFPfZ9QLA3EdCOX/CqSEPmhGbnmKgLoi8l0MopBAg/ HwWYg1S3WFpKMaTMCq1kL6U0bSpGTdsqUQF9mZbOqUqlB0F6rMr2Ji2dOcZ2e+PzMZWVATqm VntnbOBY9jB+ASb7URdIaNGdNWqFFmuDwcHSE5qnaDkmYWDaOyZcliUCFCslacLRDoNxVUKG q2JCcuqaWVC9Bx6tsjAs9twgNylUkz0Zw0qyTBI8oSry0ghHEwjZhDKWY0yCFcopXZUhDJqX /TXJVcwxdeTXlihFGE5itEVnhhY9JSUogx1Ag2akpBwlaWaZrISYEjYqGN+RYRInGTtrCkiw g1eoCDslhVJ7fp+asjcRJNXanQ9SsF9hgeMTGGF2ECcSRPz0yMxwfubbHUXQ/BnvpPWNIaS4 TKhWgDHRpVYTVZXoo3RAQ9J7ibS1HIyfmoZgRGxtDRADR0CLdWCBEwAxUCF6eBCMyX6mwDj4 IqSgIMlyBpeitY6NkFCnzwnOoNOk7BRY36DPbDFP2K+8sEglnC5A9nThqMbVZIUOvpf9Ro3O s0KnxmUeaoYMrJHS5GhWiOkoc96c4wEVovwyIrN2ZihN1+IINBiG0iCFNRiV12hCu6Gbe8dw GtkBLcgDe6cIyHPTFuBwTCxYh6NhwR1nAopjvFiR+WLruRzjCAxHkXDQgEkpvTLSvE6kLZkm IjSzPfllUkiwQyJHbuw8FoM8juImiFKm2EQXRPAYnXMlndiDRXM5BUjsqWKaMZlgskQVB5rw mgm1WNQkk5YiTDPxRahle0lX8YKoYSlEpzlgBdlsTckxPT08KwJqVwz1JKkXsic6+lYmyBKb HDfJmDh969uJoM1UVkst76GHtCuhT/bLQGomnW0ASBoAFR+MEolhCYgTRYoZVaFCPvGSsgCa a2phNBayJ03xrK4PUAYicMJFQJ3sZ+eW//OPFAAIDiXT5o54YFQekVIsICn7MCwqchSpBgl9 AaGECTP7HELs8yTZwxf55TdkpQPSkABLcUGguh2KYrXLpCSdaDPcZLEBk/NtwNQ8obPBNc2S H+mnFBYsqkQapJFieimAqmIKhAD2HG50aAlB6mBA3W0hzmFQTFOKLYEIau9fjqhWHGAaxTt0 Nf2GJq0EGk7LGmJmRreUmERta6kJ0d2Mk4/d1dMdvFP5uS+SHZxvwaG64193sLCOM1fvkUkN zDlZIkm3JAAhWLUwQUgRPP4kUiYs+v0RmNGeyfrT23seKx70ODlnS2flcZLyz+29zyeIhhP3 oJ4gARpwwyYC+hyZAaH1SZ5u8iRiADkvbkbhtCUE2bVh4kzWLMLtmPQLGyYp4ZBgomkgfN4T pN0NsMSUGTEuJJSUQ3tiDxXywjeOkpdinc7wQhePgFAiGjLBlnSuzkTnvRFiwEQX7nMiK7tE 6GXn/gk3pUV7nRqMazX6RdKMoSdQSlMZCG7P74FdKOqOaScL/nUwrpOsfVlOOmo3i6dFTJ4p x6jc8Jas7BdO83GNbG9ovRdMvYZwumDzoysKpB1sQUYDRwTUEw95wyAtt1DJLWpZGRpJpwol 2WhDGUnzxMDRFHdM+qextaxqUmX5F7eV8i8C5bZS0mhAcYrkOsyqzDn9sFry0mQ3EoYJI2Ur 7pftWEa/UrZ2bIjdUmJ2pVuiNqaPLUlOvQRnlhXVuIwFJ3XcUTgmjkNLzTl2+MyHVIM4ZiGr CsqaAKJMQ1jFSF3B2A2oRGrrl0QwLvaLYQelJ5o/Dm72C1mtCqoB27qlAgbSJ20EcMzxhx4Z Ocham0IphK7PxcoKQWuMkaMptP5qRQKNZykXvTHRFyNkyjUYoLCNkkhSlaUsoVvsQZTXG7Nl mzZRESLKmBVteCdNU3PCAZZRfk2OaXql2woeSYniJpAXg2IVKO9UCDyHKzcBCFx2opmsVnZG JMNPrTyMYfwSI9ooQMZTcZkIMH+oPjulihjAoUKpKAXRYLPZaTJgAYQNYOAUDAWhzdkdG2Fn cGB3KMJOgQhjwCMnbNg4JlhiHwREQJW98EQhdSPJpHtmuRtmGBRmcAJ0hfEembQqA8woMmtr wCqlwlQNSEOVSlGRWpqBVSITZBT/LqlSJ1+aldNaflmSPi+8GllpBYk+N6QqH0jbRmDgWNiG JTiiZWhpG01RrSVTEOyNBAMzYWSG6UMPRKFok2iqSYny748qwtJSUGV1T4mmQstCbxDqmFAQ QOGm1Yrg6PtuKNVFj1E++LI4OXTil9HJ8y8dvfcHs5chcb5ryRXLykJclV1O7reJaXiiNj1A 6l1NIcX2TiHgKMFmexAFQfeP5TlXmLDtBEqmpkvTrBsws6US3aIRBpoySxlgM93kvKGBgwwp ymKmpQLpiSHHoiQRCsMWLPkWCQknHMqlP5LMJHUxPS/0m8VkZRJsuz0XkRrNKiAhOXbS7GLi ALGostXQT0QHn6g1bSahWx7406sqsg++oAarRdXY03SvDwOcxQPdeo9MFqHX+knBpDZWyj7R 2dOAHXM5Vvg+LLOMZh/q7FlUpCea+HF3TPNnIPuViYD+0LgsuJixpQSnigu6WndlmuJlTmK4 GpNqbhBgC5nAxf0BmlQ7BVSOSHEF5p1GFVnmkshJv8yyht+ULtFmlEHWlJph9jkIa1YYThIN 7TYKNKaWVbvDVmEdbEUwCsdpcI4Ozk2LanG95wxdt41Wch9DkqmYSYhkCNu5C2OCc7tip/EU O0pSgLu310raPWELWnOU8u1odm47eWInL09Be6bFL+3QWPlBUYI15qAM4mg4yDoyO4BdSOxw wdGYiW7oNPtkf/+NqTMjexlZrkzoNCzQVDf8F2ERmkTeYR8kDNLd8CF4pd3T61CGAfJABI5f BFDZ9aElc0Y9CwKcPBQq8aGkP4Ac+zWVTGJAteoMnsvE7Vs3oYXtpRXSreMZ27UKJj9Dw6gF ck+XqhFahG4TuOcZW3XClpNaWyEJDiQtgZaEf70WOCcEZy+pvWNoc1tKW0dEV1dbaMhRt6so wl3iEUOB4JQ4uXCC0nsWz24VhsfN6H/TvusxMGzj5fGxanaEryOTRLmUiY3ZHF001z+WU281 QiF6fBwltHCYWdYwTWECq7d2mhCD4Veja1k2MgnD4QaD3gylLSA3YtiiTgBEN6oUDVkHKQTh aDgKNgzbchnG6Vd4KUU5QeTZXqCEFpkXMMEw7Z2YUlpFy+G8LVdFqmluQrXE5BWKt7NrQW3j qbWNWa3tqixLV4W7PoqJfCc+qiacXDfopggLEr8siqzcK1CSVLIE4r8sBGyLMLQYKaLO/2ar yr9I77isSjOzpN8gHMAgEmtClQs1LUV3iiL9Eir1wEpbHNkj5VxW2pBWe5ogAekKte+R9VQn l0MB+87PHvpCWtXQEJcrzBUe2lTb1NbS2tnZGZ0Q5woP6WxHZwvFN65msIFKEO4J62jraK5r bmtt80RGRsV6O9q7IIXKcdyL08MoBC/GKmW3yukMnlPXdEVFbUwH7ibZbwntHedX1Z9V3fB6 YvSbCdEdzqrs5b+q1NBQV3g4ueCiWna0dzQ1NXW0taAyh4aFhUdEREZEusNd5D3vnZ3tHZ18 SPFljxWrO67U9FxaUtbQ64VWWnzGghT7I1lTS6A2XpTBDEiNJEtJpP3kVLFnWc6VEgpVo9Gs WdiEQNODFgyk5obGgm0bc4ePTM/JSkpLKdlZWLmv3BsXGR7pCcPBx2FHwxYWgiTu4Rav2+mJ 8qVmZWTl5iC7fc1n4RHe8AhPWIiLtGVme/JqZCZzN2QJTW4hY4vWQfZ5OW9r3+YY12YHcXuy oMryUIK9m5LKwPhlfxARLPTwbzhSs7iyHgNJodpxjyM0uql1VFPrep+3VYsvEwqsw1E5GMIp gaF5/Nj+CdAJusclGZW1ra2t7GBh+f6C1qbGiMjIrEE5Gdk5aRlZSUkpnvDwitKSQwXb66qO tra1REbFh7vCyEHwF0MrT4kZrVFKvo8iI+txEPqs/mlCKGBra2hbW1jouIkLKY83ZJrfSu1i OjmB3CfAJtBsL3KcjiyHUQOESxGMyJMKhqmmdKabmJCnp6SzI8Oykqgl0Nnq6OxAA+X1Rgwd mjN55qyomBioKtpVsH3TtqKSotYOcuI0VdaEhHRERMeFodVrax+RP3LMtElo7yKjfLXVNVvX fL6v4EBDYzP8cJGWjkWAFkZxQprmDLrrYUNmq0voJUwKYH7oWHPenCMqrBQT1aw0KDCRp5tA oxX7QWnVxMYWwQh2X+wJ/2NWUp1LDjMVQaFcIZmPhMowp3VRPW9Gn7g5XGdD21owUGjx+qKT kxOTYuOT0tLiU1OTklO9vijMnHR0tDfUN5SXlpQePFBbV1dX31BaVtbV2RER6QsLddEBiKn2 irJaiUqMRNIKEuJ8HxBgwvd1Q9bQ6GpoQn+kmxucFgUMIMmK5wRWC++ECWDA3LSoSnDgm5vb IrzenKG5V91wXd6I4R63B72q+nn1y9544+ATzzfXNnt93paaus6QdrfX19nV0VbTPPe8sxae eXpUDKkZ7e3tYyaOX/rUszs3bWuoqw+P9mGQaTao53RvVYd0Xr/n1fDCWN/4oim1FOKqitoe tGJQk93afktp1R8zk/SxaN/4bXH0ZCJgKIAHZzs6Otq6OtuTkpNnLzht1KixaRkZMbExkV5v uNsNAOY/2tpaGxubSksPHywqKizYvWrF2zW1NSEdHbgI0+Mf6OD1IiY4Sv2oPTjHjOUXrKE0 HGJ1SOR5z0hULE4WXG5LcNU2FxDW1SJYhue9On52GTqMFNVHYaAJrZwtsqbyqaKhoWEd7Z2h 7SFDBg2+9Y7b84blhYWhj03qApqkyoqjR+vKUzLSJk2dlpqRHuYKq6uuPXLg0OZ3vqioKA8N C430RnoiPKgc05OSEhLin7v/sbeeeTlyTCS6rHzSweyBatrwyZ6q87kmoVCOxgTBwCNFenmK WpnkYORtxYSM7dyB0mWmwkIp2yv6LASza8hNaGw5rbbRRO5OJr+p9dzq+jfio4ULRJg4IINi r03x0QLgqoJ9il3K+9MpQT1KqIULpACnHPkLw3RY7dGDYydOnzn3tIVnnD0oexCItsKJiSGD Bg2aMmUqRqBnLTr/nbeWrXzr5ca6Bl9MfFcIToFOcjMgwKYAlKS9UM/iFFAtq+r2Ju2pqCPd 7pHZazrmVBkNPZihoeFu14H1+866/PwZp85CK8Zcq6qs2l+w78G/PTBpxpS/P/RQ1qCs2NjY 6JgYcFtbWpubmo/+X/mmTZse/+dD4yZOmDV3TkpaKpqtocOGzVo0v7K55pPlHyZnp4Z0irbs mJf3BDeIo3Dl0bpeOvm1qvoPYny1tgPMXqo+CcVxKYXXnR2djbVV13/vp5OnTR8xMt/jiUAr Ri6o7ATQaj+IpO0L9Xg8+aNGZ2dnjxyZ//brL69b81lSWmZHJ9DyvDkJI+LH5VCjIdPbavIe GLUxkPj3AABAAElEQVTcNGQWENfNwyOjxMDCsJmsKqUIcTAkTFUqmMaB4zBhgmVVx8JcrrKO 6qSslIysTPTFoG3Xzp0b12/ct3vPkm9cNXJMfnxCQkREBFguF7kh4Ha7fVG+2PjYpNSUYSNH FO/fv2L5uzNmzhySlwtAfGJCWkZ61ZEDKTlpvB2jJqVjzFttUkzn8iLpZedSeslRWF4sJse6 sLJrIrpR3AiXFiFQTCtJokgzQ7kGzUgpznINQpHAiDzvBHaFTmlozmizWWYhVQWTwIqNM2oa XkqMlmBqzzAGOsuICIBAIMItKWdOBGCbwSTXbQGrCgeKqSwaRhZKmA9rb2ttbay7aMk1p595 TlJKitcbid4ZpEgbZ6vJTIyOiT1l7ly3Jzw5LfWdN19OTB1E1mdo57XmBM0KByw8s34LOyiC o3JVOiiQItCJhozJdMdF1Yp/Oa47kAnw/egJJM3LYyghzUBbO+5Od3TgwO/ZveedN972eNyj Ro+ZNG1KQmICE0BtwEFtbm7G5QuNGpq25JRkL2YdIiL27tq96r332zs7cgbnQENHe3tYl0e2 I0r8/CaZ3xrETzk1ZA+ythY1Pf3jwOz6Js1Oz7Kn1DepDVmfNSn9U+qelTEYKVTIlvp61Mxh 4ybOP/3M9MyM8HA3BFk3LRgNDBmfkDhuwqQIj2fnts1HK6vD3ZgzIWPMYDQExgRT3zQtfX4g hA9isI28+qeZd84KPU4I5nhg93tkXDfKlKDp8bk9ddU1RyuOVh6t/OSjj7du2BQbF7fgzNMS kxIhwy5KSABZdvgwxpWYPWBbTEzM8JEj0C/bs2vXZx9/erikpLqyqrq6NtKXbJ3r180Hk1fL iTRqFP6Q6OdNM9u31lCHRjd3+06lrQ9pbR2prR09q4q2CjlRK/8JlbXzO8yFu1WNbo97+px5 eSNGohVj9bNbDRmr58kpqaPGjp8w9ZS25iZMFGMW2M5gr2j9X38Du+dKoevI9MKJvNjrimhA OdPAGCmCV0ZbhGEwjRSJAO0lg8Spll6zKUoyw9BSk5pANyw2Or6tvb30cOnu3bt/ducdf7r3 z7PnzUFfDH00XOvgPDYc5tbW1nv/9Fd0u8AKx0JDchu7A4m4+PiswdmXXHpJfU3d/j0FhQWF IZ5QsjDNtlcmbZNCWzYzV/pvwomBgsElg0n8lwSzFipMIHxjKSIiwyhYIqwkb3CZgMQwnprV 0gLPNIicAKW0d5xX0yByvd1vj/QcdoupW92UWhzFkAWm8EgyEF+D91cWbtj8WZwjlRNjJXf4 kLy8S6+4Bi0R6iqpssohD8ZF4HGpRoV3ezzR0THvvvFSmDsCC8RJA2fUZIt5xcmgAycrai9j beOMfUnFRAq4re1hrW3iDbH26ONBZSEJukB2LnZ1ebwRdbX1h8vK3lz+1s9u/8n48ePi4uNw /NikmCqDsSSOtKQAABhmzXKHDv3DXb9/+NFHO5pbs1LSURWORcdJ+nFSJbBMvw/9TWjv/sBH OY+IJ72qPX1YlB6qwtrXmsqjo8dPHDN+EgaVpH6igD0qFGv7cG3Ozhk8ZsrMwoK9uLGFZUm4 YPfQuRNVzDiHLR4icqTdY3+MK7M428lm5soRAReh7T5p/c0wmSULGsgfu0CATDfKlqoFBr0T +ieOJ1PChmWKQsMWOudYjx/REDJzxsyo6GjUBuovN2LscJWzqyKYMps2fXq6KyaiOYQ8qkkv YbaGuPeyGCwhiqxxTdE0nLCQRRCEuBZtemgMi5QroDIEPLjCEyPMdsVg0lJWSwjdwqTiOZLB LOI3S/jLedH7oKctLSSvIqws+NUcCzLrv3RBKuEwf77rPOk2SxiGzECjvKTgaHxcjVUVcbFx ySnpeFKOYIHo0QZd2FD5McgYlDOkq72tuaGWDEnEeWW4xGJrtqK7bYcxSwRxgHSB3uWFS7wP j6y6oQDGFiiIfrGMSX4lzKRcmglkRQKDTLBOdVJCUkpqCntcyV4QbknPFASONSbUkhMSsWAa 9wwUTj8kNQf6OhRWj1WDPbGmyoeENDosa7LaDYbS2A+TOMHYPW4YczDZhbWrtSU83IU5MnW4 0BsP0SmLjIzEWv8O/eay2XzQNnooFkB/0FotQDEZ4ceAJuO34gMLPvulKmVO0+LHnj1L0WkP UKm4BrU0trrC3SMnj01D55wuTULbBAzrvci0KiXTjJucnDxo7PCKprrmpkZ3RARd2S8hxyMh Q+j3EBx7z8rDySqWvtoq+lRbX3ll6JFHwSD1ZQrq8dfZ3o5KSB8B7hvl5O0JmOTFk+S9H1TK CJwg9ZD6g5k/HinuFd1RGvmRrqIrSrMczbNSmOlQ0CalwgTfUxh+BJliRYbQ6WiPEZTuGzGG LKdzA3wnpHkWA+a25tawyIj45IToKDKulHBSP2iLBgrGj7juySzDyKwvOio2MQ5zri2VrWjI zO5KfUqMFJoOlpFhGJtS0BIwx7TCGGoZho5yrWbFrQEZMX6zRdOmZQ3lflPSfzvxmrCwoy5X Uu/PEFolCj1uPXqOrrFqyNjSRa1iEa7Cc9RlYdgV1QJSCCYjpgxAWt6/7s4uty+2rbW9hdxP 7+xVc0bPUFjDxbimusqFeuyNwp0ER/uODKWgQSZlRTTjGdliRwuQSYbXZBONZ6CH/QXRI7OT P8FpJEy0UcCj453KqhmMN8vLy7HCDK++wNrAluaWirJyPM9hWxyA0RNHs6G2g7bIE4JoqRrH 0qtNkREL63v+fJJ0dW+Eu1656kj6VymB8V9ndHJqWVlp0f59NTU1mN5C8eX1tVuhYJUCFfno 0co9O7ejKnujY5DtlpKTAmw0ZKzMRjNq10TKk0Uw+Z71MDRZC1gERGcIZc7XCSFpIDQZmWVI jB9dbvJipvqq2sbGxrjYWHZZQ5u1dcvWJpxy8DU0FA8nxSXGazcuIcuUNDU01VbWtra0u930 jrV0QkvI4mh0ltU8s8VIoqHKSBGmnRIzwg5iRrCcnSZqnjHMInZKpa+mxIfRkX3SkH0Y7TPp DZjRHA6IVwGOsVBB3Uv3gUpyLnVGeCPLiw8UeyOwzhFLIHvWiknXsaK7pLiorLggJNyHiTe/ kyQ2AZWF0nlaT8k4/6Vlm4SuhEMcyIzrl8l64EZDZrFJ/GcaaEmEMuxFyQRJEiw6KIKVVwhZ MFaCGHlRDn8RmGKLOUYIVp0MBjreI4Z7zAeKi6uPVqWmpobT6zyuRTXVNQ11daS1CgvF2+fG TRhvW1EAqKqqLCkpqW+sj/L5yNsV/W5WTxicizlIazVBs2Cv00GVlO12tKWkn4RmVMuGhOxz uzd7I8b3blks5to+jsIQnmm3Lz330eacsfjkpzj9wvLrgF+m5g7qHhYAVZaWlIS7tm/Zkj1k iNfrBaZnzRne44L3+mxct7a2qjI2KQLTmXivqAyuP78kSPOPZlWmvRJ7qtClyguade9fB8EL hJ+GzKpWUIQwz5t9Ykz2SzmMjV9NTGjzu1f0+MWZmVipH+GNqKmr2bF354Giorzhw9gCMdy4 ufDiC81YmxxqEpq8koMHtxfuRqsXnxDf0ths02raiJ60pJ4cHFNhn0mI+V1pa/ef5OJKYP/p xBhMcZuUflUznR1dkYlpTaHu9955a/zEiUOGDUMrhjrZrVkO4CFVU11dsHv3O2+8FpOajYUd 3bgF779KnGAHypWSmovaYjTRoupwPw13kRK1jCTJH8njj//wM50Q6Gw95SAD3UjyjpUEI8E2 MUkttBh0zmfKhDbFCiQkVQSdEfALqc7mjrCjIUnZSVNnTMM1jVzQAJMiwpC6RxMGGDbMs774 /NLiDQWernB3pIfUCRXnJ81xwiHNnq5FhdGC+tEsWFyHWZU5p1kVkrL0Clrt3BCywpJioLE/ SbEmMLdVE+6a3NTDZ5XeifEtjwk4rpQh4u7I8Kn+SG9lgnOR759NN2SxwvwM1j6pp1140BLv GDtUuK+ls2v4iBFYxcoeVELltKg3EVCHWR6tXl1t7SerVy177dW927b4fLE4J8hoR4ka89yQ V3UzntOvIWNbZVQjChRJ1YSZY+SCwQg0W9nvSknLJRQhKfaCIPNUzJwzMIxucEWK7lngjfgL pnBEGmdoQZYwlrDNWo+pBKNThvf5RCVFr1ixbPLU6dHYYqLZxL/hirDF9zjEtBKgK/75p5/d /Yuf483Xvjg+OSod0IT0rI4z5805RZYyHLkK0BwuydBEtawOU9hKkh5QNS/E7GiCp+yL3G68 eHdsS6tCCyr5UVTkk4mxyvnlJCUbMicAoTt668jwpy0YXpCKg4SxApBrapjL4/Nu/Xh1fVML efAuLi4qKoo2RP5CherNavihQyWvvbh0+Wsvb1+/NjYpuSOk3bl1EaUM1kU/URaqnPbBmAgG I/TzR5R4SJwiY2gkCIkyyFQdo2tEhsfVhcyri5kPEK0wqsPphzQtTiLi2qMDIIJGCSuYwz3h XU2uDV+sT0pMTE1LZQfYyRLxjTzm1lVVUbnm4887mrvCXeFQgjrkR0RnyRhpDKcyqLDeyKp6 nI8URzkZAtsPy2zCNrcsOgqrMa6trg1yjAlrr8dGvxyHa4zUZ6QkSRxgnRVMUA0lVFpX4Vy7 DMG+TQXpNDlv8C8s3Ofbtn5tY33d4YPFp59zblp6hoiGvVvtbW0tLS1F+/d//OHKtZ98WlFe 7oogU2xkaORQeOaRlWlvgFLlqWePCVxGf9aUSTx79SoVivDnOEfG7KjjDiLs1z/pGpdyABsw 7o6As9g4SKmuI21RovFJlmC6QnzumKLCA3iAvKGhAd11rB2TfW/WrqlZ3MfEhtdm7Nu7Lzo8 jnx2RBwxaZFZCuSmAz9AGTUjzJTDb0Asc0HCHDxy0N4Nsqb4I1/kHo/nypraiYHm/rFk7KmE 2L1YOBb8JosTjIjmWTAigTEmD4K0EAhm5gsLqHu4HuM9eQf37z9SUrJ/z+4xEyalpKWhVmNh EN7YgplfOWsGLOb1cYOyrhbvfSn/bPVHb7/2ytHycncEVlzE4UXYykSMcyGFaRVh0Mxuqhhr mmENWYlgpO6okqI2CWijCh0bMhuZnpJgqK/c7q4LnSGdBxqKzl68CC+D/ejD1YlJSVOnT1Uf HcfhV7tp69esq6utwysXr/3OdRte/6yjtcMVQd6JTmrUwBZ0BMrCXfcmx+e0tc9raMKtzHTz U+VVrrBtEREYTm734kMKA5vfCHSFoIeVlDWoel/h4fWb8KZFoLEm40hpaUNjY1p6OsabWLOP OVy8jerQweKCgoI927fu2Lhp7YqVeVMmRscnYiwUbCvm15ETnBk6atxCWxe1pofPRokemolL OsCkQkqiTFAiayoMgJzYYjAJFlletyWMada6xRYpUyHAxaCytr52d+Hu3/7mtwvmL3jy6Scf ffiRbF/6d+/4wax5s/Fqc0yZYQUZxNAFQ1e8orzigxUr//a73xyurBw1adLf/3Zfyf6iO3/7 q+bahqFZg1ub7RfNEqvSFcUFSbOcqIzgMNdjDq+UldoUC4Zde67g++dq7gcEmxyACScBYp27 jx0+7pLcIb407nLV4VkZIijLp2mlWaHZL0gU0lDA4FzYVlYoNmR6kDJK56DOgdwDU/g2a3hd xZHhY8dNPmX2wrPO2rJp01tLX9i1fkNtZWVCclwUXs3i9qCD1lhTdbToUEtHR2xqclx6KlnB H0LmhMncvvUybPbPNlDEVwpTuEZ4ScqsxFQ2wbLImlAyo8AkjSaEHjOV5yCFktU3ueubwvui IRO1lhilhlXrOOS0z2MUXNZ+BpNgkeWFkjCh1XRn1SJlKim4uEzhGlV1pPKaG69B93v9F+u3 rN+UnJpU3lg1OG7Q6HGjh40dnp2bg1mw8vKKsoOlGz5Yu6Vkc6w3pq21I9LnmzJ18uDhQ5e9 +Fp9XX1sXCweBjAZUDPSFYUoaZYjxAhfrYZMCQxLsuJbYqPiRAT9gqznkggvVWUrKxSrxrqd PpYNGQYE7a0tqRmZKRkZeG3sjg0bXbgA4/QgqzFwQ8CND7PiJMOSoY62Tnyi1YXvX7rDsQKc vC7U6WphjoJtoEhQKEzhGuElKbMS2yByWSDhizNeMWFW4ywCHKRkQ9bXQ0voJk6rhWS+MKrZ y+ByfsvirAIfVnGFx0TGHCg4gA8y11XVxsXE4ZumlcUF7WWt7e2dVXU1+4oK8YqBuvLqqrLK Xdt3lbdUpA5P93lC8YzInp17WvG0ZmdYhDsi4GpYZyecOeqh62EJuXKpqXdqnF01cZg1G1M2 JCqo0GXSdH5J/012JNZE/Spm0ETh9Qeow0cOHTpy+HD54cOpg3MiY2JwecYj4F3k1SwkhHjz pyeSvByUrIHEf/nKlhMhkuwYW4903/kWOmqsGFqalZpzvALJXhK/IgmQvEARHC638Fj0OQCh OTD4UjIhxBtoTafkMpPIqhQKJvGQRDYak0qkFA4/DipgB3cUxyTG+OKiIqIjQtq6wr1uHPuG 6no8flRYewD49JAUfE8pMTfF4wlvacE3i4mOtqbm0n2laUMyPD40ZGRhIdOMXyMlSdZEUCCI 0WPrBBZ0sbeaMVE4jO3E9c+QNVJEiucETOS5QsY1SzAWC74Nx0KiReP62I5CyI+JZcpIvEUd 45i65YRkLy3V0ISoi2ZqcLK6jP+8g9f+hQJxqdK21jZM5EdEevHcN55IQZ0k/qv1Enn0T8wb yfv1SRfQwSa+mqGaGVol6+bMPMM5TtfNGQDblFUbKPWNbGh5AjdkrJhqYYNvyFggQjtDXBHh 0IBjj/s89BWJiDX63aHkG/ThmMgPwbARly+wWT1g5sgnlsJD29vwOAdipbpgztjGG0SThBMI dHponMCCLvZ+9BAWh7GdaKEMWSOlgAVMCHMTDGuWYCzisG3DYAHTonF9bEch5MfEMmUk3qKO cTjY4NpLSzU0YesvOMHImjUFyhl+BUJ2g0+Vkqsyvelkba38qCIl9OuTHgIdbOKrGaqZoVWy bs7MMzzldN2cAbBNWbWBwhoy/QO9sthMRhrifS6hiV8YjdPAVCQppXsjxDndJKSHwKKECmsa RGUUs+QWg2in2jrAhRypB5RP7kFidSCarjYy88VVmq9mpGvexgptcUQ3YpfX/NR1mNkkp8RC ggWK7wVd7O3sgqZJCZRTiDifStlpFuq4iwbESKkqhDmy5wgJpKoMfRyqoyjZgjKDxcHSYdIU h7OdaSRr4vQ4IwwFiKp//UKJRGkEXjq6Q531XwzHj+9yLUK32DOjrIqL89hiwQyWfvIEOwpm jDgyOlZUBgvdTNAPqJlrlyPmIdXXc2RUK/SKNoNZgbHueyi8JtpE2nbvn2t7BWNHTAbdXoNk 21r9shADhvf4FDRgfbE/ZsfH2a+gVTX8AY+VY3z8S6o2/KqAmh42ZEGZgG1YwOCN/faiLXMs xZeSIY9usFHuVRQsRqR5ptbCN64rGlJzQwr6h2lSPCuFVbZJkSlj+KTiT7q0VqZ+8d+PDdug 2znhR4cdvKc0zYxf99CQcT7rpBhdZbMY63zyAabVMWZSEQFByVkFKEWTkuNVFW5okSlT+SRV FZJpjatlJUxNmLRThiZlBQClYaRCPaoMqNw6EEhbrYLJ9gLC9k4WDRlbhFDCYRpG4wpdGkqQ 7fdG4Ry02Zp27P5y2/a62OyXwXPUYna1W+Uxi7KccZrYcYOlGX4HK0FwDrYZ2aJSFFWX0sJq kWMeUbLOEyq502a2ZOq3ZSRMIrh8t3ZSi5Ri6vr0sxFS90BiIAIDERiIwDGMQJcxtNQbStr2 yWZV4/Irn9PtoG6VwGhkaUq3JHRJOvNJv8IImHnPdEtRMzPYibsASqhSoxC6MVOez6YaaCJM EBRlJttdepkyiTPp5kN3gyZhioeCK3hiL+iqO1SM/RgwkeJAwtZrAa8cCpIpYb/SkpkvyHze WUw/y2Mk+GIvVBItkmZWKSDWfbA4qySnaAqkA4YrjqK2DE2fLUYQHbHUC+O8YE4JtNgzLbwe CpXcbTPGsSx+YQbTSBEzsiWxnWFyvFMhPDQrE1SoRUkIL9RoyAxm36aYC/g1jnb3DPRUrntW vrJodmR6cXxOjMixaqb5MlB1tICc1FnbQ8yJSo+s38rIzhG0nEq14tcNMp0iqGCTJMvqV4xe O8cMCVd6rU5VQO5m2MbYKIwK71Vas6NlmWoRUJMhA8lSBshImQRkxpCUJF4wnaPnFbw5Gcik GW3kNLnA9vwjNHWGnT5LwQIW/UAdHLHePacswsYC/T4z2YeKnKLX/3GThXByQQJkAj0yDmY7 zUm9oyqbHSYl7TAxkeVKzLqQMxPgA2nbsDaVeiOYRAlt9QzbhI/FXxQmlAhbjCh/hRZJkIlQ 8mBBoMU4Em0kaEUkjazyNSaDSyoqsWlUU8UxLLwlHFRU4bWIgQIipWX/Va0kLUG2hfLPVXTx pK0SFQaFATEqHmlbvC3REJR+GySSEpc5fj9JKuFwI28nL7hsb4cwG+u7nLAsNGq2UTdI9SD/ 8SikckgJHs8Y8VK3M3GhTOyFUn975ZJPbUsHzKePpkJa4HBDigBlTpOyzwq02AuUtMEIBpuk xOEWYIPLKGZhc07ImJD9P7Q0mzXl8IoSLE1tbsUDF3hojLEiIvECJbfHFdbWxpfam0R6miEL XLs68fYm2rgErYU+uca+OoO1/rTJMmTReOFJ3a72TjwKZ1BpKjSMrLptx0tXQrvwFK8mqIEH sjICuaNGDhoyGNnV/1suiSdpAlc4vHWnfO8efG03LiMrNi21s4O+o5Welni4pOJAUUtNTVd7 W/q4cXjQpJvtx0kalT53m7cbofnyESVqQmv79KzRzDMOb1g5THDRD5Eb6QWRTguQyukMJL2U eD0eX2QEHtfnHwMPCa2qrC4tL6lrrMrLHkkaHdkRE8qZLd0xYc+WDiKeOIIR+jRSh+oIk9Ok OJG2Yi48xxQeDhG8S4OUAZdXGjq4j4fSwcMnMhsbGkPDSeeL1UUUF80mrrcerwfNX3NTEzpl wsHu7IVbYm8vq3GVKBM85/LDjSxJTZ4989rvfEtVB9j+gn2vL31p3/bdRKorZNm61a88v/TR v9yvwWiWa2U7nmGFJ8Jc4rW1H736wtLHzRoITwA4ju7mLDpzyfXXDsrJkcRPPvjwob/8repI uaQgIaotobH0vU88ivSt116P3zc///iVF5Y+8rf7CBubnSHG8ctliv0LG2psUlS0o6U1KT1j ZP4IvMvzyJHy9as/jk5IYG+qQHVqbWqcMH1GXDw+9Ray9vM1zY2NqDCsZuIqSPvxyktzYQM4 nA+oWuCZX1lMHrijR51eWE01TWOp/SCI0OqMMPKgkgRN4oecevSMtXmFBqtDlmJzLZIuTlid To+KQbQPM+cbMKbWAkbjgtf41DXhFGVYC0L6Y5vwA7ewGAG/hldouVpbm6uqyi+66OJheUPD wvE66Q4St66Qxobmw2UlJYeKd23eHxERxr0jLyfh1ZL0gsgnFOgz4USGDDrpx97I4ccGh3HA yXEgsw/o8uF/5/Dhw4aOyNuze/e61Xh/Ofl+OFh8VAsJopPXAHJ8UadCQ4ApOnRwZP7ISRMn 4YPkTz71VHJCUqTH29nWia8BFB4qyh85cvr0aYNysvGCoPfeX4H3ZMTHxuOJTnzkPCY+Li0z fcbsGXhN4/+WvtXl6gojLR1RLONJXlIgmmlJ7IMEDzPfWc5mEha8mGjkqPyPPliF9/Mxi/ik wdyF8/H37YuvrDS1HQRP/ps2qdxENWcsQpJtkT5nycXfue2HG9eu+/df79v4yecJqSlnfP28 i65c8vsH7//5zbdobZlU09uExY2eKLQrJWkgurqaa+uSxo+fe+YZCUlJ+/fuW7NiJWotGggc dLzL1RcTs3DROWmZGS3NzTu276yvrvZ4vageYOKFBeRJX3KNJFdEUHA5hCyeF25uaXZ53C43 GQGAjl8gyVPEeDdsW5snMhJZ0PkYwuXCI8QYFgDg8njcHg8GJUQK5wtgeP64vQ36w91u8mpG +bYMqpO8gZb+wSscf2jsj6rqFPAeHJn+HVqyo4xf9if9RrvQ3NJeXllyypxpaAvQ2amurkFw MQCM9EXiPYeHSw7/Zd/9tU01nnB0atCckdf4CvFQF+mp8QOJG7dQ3kZeUAErtAXDiBVgNEck 68JrTXBE8OqxWaee0tjSuOq1931RUeHh5Ju7re1taLYwUQFBEjvyH2kynYExb5g7rLSydGry tNnzZ7s97j/+7U/xsbEul4+MJd3hJRUlE6dPmjVvzrSZU6Piol9+danPG5MYn4xK2tDQmJM3 JH9s/gWXfL34wMG3n3qzM6LL5UEdhWNtcBd2YMVFbhn34JCJMPR6/9HKDz54azk8wYZfdMf+ 31OPXnjNkkesfahe2/KjAM3WN266Aa3Yr276AYOh5Vr68GOHD5b8+De/XHzVFY/dK3pYfrQc L5bdAUS1gzvN9Y2x8XG5eXkZgwbFxsZG4ds37Xi3ihvHvLm5ZVDukPGTJ6Wkp+NzbZFRPjRS pC504dHgti68vyA0DE0QKiepnqSmY+YF1aezs62NNDqEjCsibTDb28mFnTw43NaJRkeeJrjA 42VVkKQscnIByeejaVOHJrK9g1zAMaqFZagnXpP634l3JYAAFpXF+7BIZ4HUWoI4MTfRkMnj 4d9VAyZTrFwkS5sUmhW9SsYzclQ5ftDhoX9hGRnpaKfWrNmw6oPVsXExeCdv5qCsuXNOmXvq HFw9llx5ef6wsTERsVVHKzftXke1hcdFJ4wfORqf121uammqbmqtb4mIjdh2aAvwMb6Y0YNH t7e2bzmwpbW9Ncrty0sYGp+ViAmrQwdL8BrrQ0Ul8alJ1cVVnihPaEzYxn2b4Hd6SGJ8dFzG iBwcN3yfvL2l7Wh15fbiHckh0fUhTT6fLyk12Y33ZJDpNTSh+IB5O+teRfq8cYmxMXGxU6ZN yYkY0tzVioPvifBsLt5+wTUXzpgzMzklBT2ykNbQkAhSZtTCrZs3VHZgpBmCt7FMGzXJ7cE7 gsjsoH3USVDJxvZB1iIOtqgUJoRSrlqQ8ZHdbXxQaRxHw3jIdf93y5iJ40EoLzvy9suvbfr4 c3Ia0S139IhzL7tocN5Q5LZv3Pza089XlWE8SA3hh+4T0lJ++Js7AbjvV79Te1hgnr74PLzJ 8on7H2RIphRn1eq3lg8flV9fV0enJbowfXbepRcPHkqslJeV/efxJwt37KL29R9ZpHMvvWTW vLm4bpUfKXvhsSf37ST4ofkjFy46e+X/3h41fjy4Lz377IZPPzerkArM5KBytLQoNJqQ9jZ8 I6KpuRlzC5FRUWdccflL9/wpIikpPCGxsGD3tbd8DzW/ER+SqKvHm3lwaWxtbmxtaGg6fGjK hRfVHj2687NP8d6eQWPGYv6ifM9eb3R0XHra6FOnlB86vPWj1eHeyKTsQWEhYQc3rB88aXJS bg6uB7s2bDi8YUNUWlpcTg7ataK1azPGjs0eMQJdQrzIbNuyZQkjR3rx3fKwsCMFBeEeT2Ze Xlxq6oGdOxuqKpIG5aD1RG0Mc7sLPv4ka9yYhPT0+LiEtctei0hNj8Unrt344jVpW3l1FNEg BVYCxssPojqOVTACYNqLjFAq91SzwTVSHIEGlm2iIZOSxyYB89QDtPj19fVr1n36n6XPDc4c 7omMKCx+qqjo0uuv/9aw4cNwpJsbmr2uyOycnJt/eGNiYmJlVdX2jduX/3eFN9EzdHhuekZ6 XHzswYMlt531owhPxJGyI++/8z4+zXvT7TclJMTXVteu+eSLz1d+EZ0QhffSVRypaKhriE6M nn/uArzduqqy6oYf3ZiWnla8v3j/rn0fvPp+8tCUqsPVsUkxs+ae8uMFt6ekJm9cuykjKx3f uAz10eNHrkvEbxY+XOXQoz9QeABzZefe8LU1yz/fvX5nxvhB03Injh81Li0tbe+evaiLYdHo xne01LW0lDfceufPh+ePbGlpOlJ65J1X36qrro2IjMA1FvX+2ATej5XLb/wmuCvfekfDJKal /OGf9yWlJK//Yu2Rw6XTTpl51/1/febfj7740BNATpg942d3/7apsXHVuyvR6TjrgvOmnjLz exdeoSpBK/Y7quHun/5CbcUYZujw4ZUVFYXbbVqlx/7KZ+gmnDLjjj/87mhFxdpPPoOVOQvm T54+7cZLr7Bqk3Z/ds8fJk+btn7NmsK9BfD5nn/+v9/fcSfaLHSFFl92aVR09JnnLjpYVCTx fZzANa2t3R2G5qm5urKytKzslHlz/9/99+Gbd9khrmxv4thxY/fs2JGclub1+XCZrD1QPHji +GHz55930YX0Nfwu+LZ7y5al/3wIX1Q96+qrJk6bOmLUKDiJF1vjC0kr31r2ycr32xubv/un e6bMmomZAZxKGGd8smrV5x98uPmzz9DLu+Xvf584ZUpMbCxaA3x0Z+OSJf955JGDhXiZqOuC 668/45xzEATcZ2uor6+tqW5uafngtVc+fON1V3Ts9+65Z/L06XFxcWQw8+Mfv/byy6uXv42e Y0JaOoYUfRyoPlLXVw0Za5PF2Sj2alNNHGZ0hqUFQDcH/WKMBGsbqvcc2IYeT0dThMcVF+WL OlRSgtM7KtqXP3rEJZddFJ8cX1VRhR7cmFGjcgZn3/3nu6fNmTpr7qxxE8YdLCpGA5Oamjp8 xPBx48bV1tViQBqfGD9kSO6osaOPllUW7TkwZHDugkULV4avLNy8b/qMGVmDM2vRVwoNwWv7 80fmV02t8noj//XkQzPGTjv1jAVzFsyN8kWWV1TMPGU6ZjHQIys+QEzwmGNPk2hnkaitrWmq b8QwYcfOXUWfHnLtdZ9+2Zkp6SkoVOmhssG5ORgQVJccyRqSfcNvvj16yjj0DlJTU/LzUYrB D/z2XvT+MXuGCx3p2/vdJJ/HT4SRiYmcCLJFlQ4LCbny+msXL7mUAfEBz0GDcx78698L2GS/ FO8KWXz1ErB+ccttmz4iPZfHQ+7/7UP3XXTVkhWvvFlVVnHVd76FVuzWq7+NNHzY9Pna/7vr l5fc+M0X//U404F28K5/krHhzRdfSXtqUjVJ4AKfnJaKDyYw/2UIjOLQWJ/z9Qtg5eaLljDh vbt233TrD8dOmbz6f6LZlZJAdIXMO+es2aeeeucPb2W9LUz//+4f919z4w2y8zV3wXzJZTod f40BhSPEjoErnwvfvsF8VmNz89YNG05ftGjuKbOLt29vrT466+LzYuIT1nz+Be5n5Q4bhgFe bWPdvDNOw8ciGpuann3wX9kjhp96+ulTZp1SW1v/9388cOdpCxPiE3bv3Xvvvfdec+VV02fO GDVhAi7bzU2Nc04/bd/uPTu3bv14xbvf//mdE6ZNKys+uGfbtrxxY+cuXFh84MCKl14q2r59 /pVXzpk7d92nn+ImFK67Fy5ZgqvClo8+OnTw4PAxYxeevvBQyaE2r680JOybF18yd+GCndt3 fLJv34HdOy78xnVnLFpUvG9fYUEBbsKiN2ecCHbF1mgGWD1AACkHWBNRs5oQO+9sZS0NGRMN zoxqMoi0jVI0VRER3sGDh0ydOoWezCGR4Sk5g3PQid21czfmG9Mz03LzhmRlZ67bsO5IaXlG RkZOTs6EqePjE+M8bndCYnzmoEx8uW/9hvUt+FpPRvqI0SP27NqzadOmuJLYjMyMCdMmpuWk 7dy63R3hTk9Pj46JamlsiU+IS8/MCAt3ffbZZ2iMTj/jtLTMtBHjR1bVVWcPyxk2alhCcsKG desPHz6cFpeamJAc6Y3EuNVaQNLNDiXzcbg3kT0kJyEl0R0dASW5w3H7wtXY2FTXgO9suBo7 m/B+2oyczPxJYw4UHSjYuxefdEpPSx8+cvig3MEFB/d1tLX7IryYGLGa6AHFJsomLQb/QOF+ 9LBU5jdvuqHkQPGGj9WhVui8MxZuXLNu40dfyLHkS08/f9f9f8GQcO2qT0aMzn/1+aWyhfpo 2XIoPFh4gIHxhRe0YmgHf3j19RKjWnRMm+vh/155DX8MjDFUemamJmiUijJmLzgVPZqY+Hi0 aAy5f2/B4ssvxbiSZVe//4Fs1DRVfZvFRaqtuaV4/wH0g4YNH1F5oKi+ujJ3zBhMQJWXlmUP HowZC7y/MzYleXDesLSMzJ3btx05ciQsKrKtvT0xOWnk+HFNbW3x8fGYO4YIqjoalPTk5Lrq GleEx+sKi09IQKgwRC0rLd21dVveiOEtLa1urzciKqq2unrfnj2Fe/fiHdnoT8UlJPjwleq4 uCRc89PSPvjgg52bNlWUljW2dyw8/TSv14s3are53Pnjx8fFxVcdPYqexNEj5VA7c+bMjME5 lXghfHFxdEI8WhO9pmp57WDYBVSTsIN0j2ZpyLonboNmpQiiLGR+sbW1LSUl6aorr1i06Gzc qMGsfFxcLD5rhB7Qi8+8hNf7zj/t1GnTph+tqrzj53eg4RiUmn3aqad/97abFp9/IbrEZDlF e8fKFSvv/8f9U8ZPmTdv3g9/8sON6zb+6S93R1S7Z82cdc/Tfx05cuR/lj5TWV/RDmhHZ30D 5lxC8C3xbdu23v6T2zGV9tA/H5o2dRr6bijM2V9bNHzY8K2bt1597TXopCQ2x9/8o5u/8aNr w8NsAgX/UUwsFPtg5Qc33/Ld8aPGzpoy7e0P3hs/eSLGrfhqCWoe1nzsbyi58GuLZ82ahQb0 6muvxlAagmhVl76w9NJvXXbHnXe21DXmZed2dLTaRLM/SWSyf5kx2f9IyP1/f+aRm277wQ0f mwaGScnJGDaqjrCuGZrjrNzBoO/ZvlPlsraMNWSnn7fo4AEyfDvvsov+8as/qDCZrig7Mmn6 VJlVE5fc8E1kX/z3Y5s++fy6235w9XduyMbr6n0+9CZUmDWNjz9iJcdPfv1LjYVxJaNsWLNW Y/V1FqcqmTDAq/TxXvWNn35RfXX1tNmzdhUWHNnTMWXa1MMlJaUlJY319ajVTQ0Ns849L3fk CF+U72hl5bzzz62trkH1xoBxRP7IZK+3tPjgkLy84XnDbrn55t3bti19/HHcH8NtftyKxH1n 3Df3+iLRxHy8YsUXq1dh2g33KKvLy//73HNlB4piExNmXrg4OTkZhtClwlGbd/rpmHm8+49/ 9LpciXFxr7+/ctF552LeBr0tjEAnTZmKE7C9szMhLW3YmNElB4tdnrkTp07taGnZsGJF/sxZ HaH0vkRfx6s3+nAaGudnME2P0SOk4xwpgq4JNpbFL2tuSdZIKQB2e4QSMD2E2dDDh0oL9+/H 4B+3XnCxSEpMwAxX9tDssLVhuBbh+pGUnLDi3RWYR8dNYkygxsbHjhs/du0X69ALq6ysXPvp 2tGZ+SmJKQDUVNfs2LJjRMaI0IyQ+OxEDPpCwzE24MMD+Bkfn4CVOEUHinZt2TUpd/yGws0N jQ31jfVYFAaP8EFy3OE+WFLsdrvPWXD2qs9XF1QXFheX4AqHMxMlkn/EfWwYEoZ2PfnCU0u+ sWRw3mB05g98VjQoM+u5lR9WV1Vhro2hBucORjXMzMp87dVXSTFx/6irKyMzvbGpMTLS29LQ jPWQLFQMT0LnvPGgqgIK2BxyyZBTr5pukaVi2zZuxmBTnexnU7uYlhLHkijEaFHqFQmhB3nu GNmhjfvjbT+74JolFyy5FKNO0sYpQCLbFYJeIdomzILhBoLGxQqMXdt3vNgV+v1f3zFn4fyX nn3+6X/9G43a3EVn4YampoloExt6KLt37GSLywSN+yX7aJIeICEjFwBH2aZxKDnh4SRm/euP VuzYum3U2DHDUlJai4vTMtJffO55dNuxJAIYfFYXI0dPhBc3Mb9+8cXkAomFF12dWJmBy8DY EaMee+CB2QsXzjvj9K9fckn45ZeXHzny4XvvrVq+fONbbz2Wnn7+ZZehZzdh4qSrrr1229Zt K99chmEmZuguveaa7NxcstQJnbQ2coMeE3ZQjok5NGQxXV3RUVExWNpWWIgZZNBZ+bBoPHPQ oEuXLMGkG5k8wZIAtGttWMrbFcEWawHIsazITA40QaV7shaAbNajxNlczBQxThOKzIY40yAC Bq+Z40ZDJmH9kbCWBlZQUtyRQedl6X+XPvroIwg0fEIX5qbv3PSNa6/92uLz/vPK8wglAlp6 uGzzpk0xMQg+akU74v7FZ19gdh+rIiAVFRNVsq64IwfTkOTby5j2ajpaj/uSuPWMkR1EcDQM B2gKUtjam8lKa5ggK/5psREWJMjKDXJYyD/iJ/4boaU4/kMiyboeBwqLMjMzJk+d0Hn7Ve2d HStWvYf7lfMXzmdRhkLcnKypqd26eQvpw4dgZrBj08ZNBwoKE8Pj3FFhbS3HujumFkOmUzPS rZ0djCunzJwuMUicvvh8/K7/9IuiPQVITJwx9aNl7zJAQlry4/97BYPNJ+8h8/TbN23GiPKJ P98/5ZSZ3/zBzdvWbrBOz+MuJ24RXHnTt0lDpmyYaEMDt3XDRtDOOG8R1tYu/ffj7EhgAlsB 2iQxwY+BZGJqilwTh/br65ddetftP7VB9xcJ9Y50ysK9vqTBOSuXLcsflX/a1xdPnndqfW3t sn8+OPb0M3HrEA1WeJirqrqqsbFh15atf/7Nbz/etgUezZ8+IysjA1Npbp931PiJqz///L6H /pXt8516zjmXX3fdrFNPTUhILC86iHVeP/npT+vKy4dFRV18223nXXBBc30dlvbkjcwfN3Hi 0qeeemfFioKioil5ef964QWcDriIlpUezp46rQ33LktL66qrcSKgO4ZTgIUB0//bt279xS9/ uW/njgysl2zt+Na136gqL8ed4uQRo8ljofbnQn8FMUi9wTZk+k1X3jKIMvE9aw1w6gs69UJ0 h2xcoteBrpaGsM6mmLxh6Vj9sG3nZswR4IqRnpWG5qUWZ391dUtb62/u+i0aKagePnzEzTfc WFtdl5RMluSgQcY0RFcbXbIHdeT2H2624Jvy2IGpzG2JniD8Ia0VmV4Hl7ZWEKK+V5QfRZct KzPd29G+6tPViZ744VnD0jMyjpSV8VZNKQS7GrDpsy8++WLe/HnjJ47H7ENhQeHRiqNof2ED o0tIFKMHmJWZmpL82D0PlTQdgXeY2vjxbf+Hi3BtDaZsW6NifKQsIn5IYhM5munpD1MlpVWd I0bly0oJ+vDR+bPnz8Nqfs308teX3X7XL+966L7H73uwcNuuS2/65kVXXb57+85Nq0m78+4b b51x/iKsIXjingfQin379h9hVv6DZWIOHgjqwcN/ue83D/z1ipu/rQ8wQ0PQ0r38zPNX3nD9 r/913ytPP4fmDHc5L7h6CVo39KpefOgx6IDOqbNmvpr6HBomdMew7gxEssniyQQlv/LMc2d/ 7bw//OP+e37x64IduyadMuOK667FAxiyXaMo+WMWlmSaEDweOTWAZiBDUz5kcIFrwXoGPPFB 16JG+l5e/s55l182Mj8/e1jepvXrt1ZVjUWPDDcaw8Mjo6NWL3tzwcIFQ4YN+9qll3S+ijWq ngsuujglNbWs9NDzjz78vdt/PH3e7O3btq/98MOjRyvxGABmu9yR3vQhuRdfcUVWXt7+vXtL C/ahYUKtI4tu3W5ckyK83raOjqzMzJzBQxYumI9BZXZeXlNr63tvvDnv1Pl3/OpXe3fvrqqs HDxsWM6QIVifgdle9N3WrVlz6oIFZ5955r4hQ6rLj5w1afLZZ5/9+iuvlB0uRZPHuphqwdml mlBoF0yEC3mWlAFTOAQtsnQvMoRBNiGk0xnX7tehIZMKhEY72e7SpFJDEKFBdwi/GNnFxSa4 6YFFTxubL9IH+qGDhw5lHErNSE2Ij8f3wLGYJT4uDoekuqIqMSkBnSlstHNJerJkpRcaP/hM o4s9IbBmlaQwZqK9PjJKJBsLJk0SUbiFtRTpuKeYnIw7m1XNzXmpQ4cMGRIZFWltxQCmguQH kjt37Rg1dhRuKWQmZH326RdNjU0RXg9BhIRGhnhLCg4eSN4/fty4+IT48s7qLldoTCw69Ql7 2/ewRdhGRPorZXMgLxS3LJlN9MXQij3y5wfMLoSuXvYungT4xs033PfMo4yFVuwPt/6M1cVn //Ew7uJ/fcml+AMXLc5TD/77AFmSZrK4+aPPX3t+KRlgfkEHmIoN4F586HFcui75xlW/uf+v kvPum289++DDLItB5VXfvv6JZa8ii7UaLIvR5SrLYhEAoBANFhZb/OjOO+5/krSD2NAmHrvu GK3pmC7AHXnM2WNdKnyqraioKCvLy8vDE0sluM+OO5pkRWoHRhiotLVHq/YXFETHxQ/LHzlr 5kyPJyI3byjauL27drbUN6B5ysrKiomJxWCE1e2KI0cOFRe3NjVFRPrGjx+fmpy8NyExJSUV F35YqTh0CFHCioqMrCxMxURGRWdkZ2NBG1pGTOF/smEDFnCMHjMGHVs4NSg7m6yahTd4qKC1 ddeWLVOnTRuVn5+cmIjr96SpU/E1WPTymhrqyblGzhqbE5kF2fRrRqFh79fNoSHrV5tCORnB 4WzoDOkIaWjtqmxpakE0QzpDO9s7W9taMWuA6f/33vmwpqL+ph/e8Myzz5QdLsPaFkyIFhUW 7VizfcjwXCzXoH06XP+gBo+hoWkCAR9hFp1C2gJ1hmKASZotEkz2CAA9CyGDJYWAwCq4WO36 zqvL8OHmM8478+FnnsMh93gjkpOSWFsDJDmK+CNNGBGkh4YcrqhQ17sr3x0yLHfO3Nlpaakf vvN+bWU1HlGCIFZj57gzN727tv5wzeSZU+9+9G8lxQe9kZG4nYeFu4V79vkik9zuNnhwLDfM 8X9Iby/ymIhWh5aI/mB6fvJcUlLq1lvPvoS/ueedgRzuSO6nS2eZw+hP3XPrHehDjZ02CZSP 3lwuhEIWTyIa5PbEPffjj2uUVJqAlbef+y/+xs+egae7QFvN3EOKeoB+2YpX3hgzdTJWPLGp NNyhYzpuu4Y8Zcm286fPFskQPOr0jUUXTDxlRkxc/MH9+/dh9SxVtep/7+BPwvojQeoErs3x vqb6hvLSw5iY72xtGeJy7dmyBdfj2Lj4TZ9/NjjU297YdLQc39s9hH5QcnzSB/97BwuJLrzy yvMuvBBdMiyM2LNj5ytPPZPgjXnn9Tdxo2DshAkXLbkcrVtpaelnH6769L33D+/c8+Hy5ViB gTmyiZOnYKp+88YNaz74cP0HHzbWN+Tm5mINCs4HjGQ3rN8ALoYL+Fz5Z5s3P/nww1+/9NL8 0aMxYjiwfz8WPPp8kbiYY9LmvddfS8/KmjFnDtaFsDbrrddeW796Fe57Jg/ObW87IeZArEct NH/MQkZlVVZDSCJLkK6lsulcygKRPTYkuaS5IhWSy4KOR5SaGlqPFFXd9LMr0Dat+WjDus83 xSfFuFyh5YWVI8cPmzJnIhaLPfXw0zXlNXigPHvIoEuvuyQuPr6puRELYp+971ncRRw9a+zI sSPT01PfePGN6iPV8Snxg4ZkTZ8zc8Wbyw8dOIz+V1pW+qlnzd+5bcfalV+MnTZ+/PQJWzZs 3rV+x5kXnt3W1lawu+DAzoLqour5l52RkZuJb8w/98DTkXE+NJRD8nLPvngRek/AVFdV484o Voc/8ct/xw6O90RHYLYLQ+DSzSWjZ42bdNpUT3j4S4+9WF9Rmz9lzNgZ45NTk5f++/ma6tr4 pPjZZ8/NyMx8+an/trY145G3xsrab/3ku3kjhyMaqBYvP/3fXR9tjxuMSRA3Wd4v40WDJX6w 1zcGlEeCZekvo6mKDK1osNVNghRx1voTnMZlBAuR6xMazAaEMSnlhw0WYBwgBagGQeR7vhPK jawqJauaqkGI2OxVWeGGQjOM2MgKkgpismhB0IXBNRmQUA+mQbraW1o7GpvxXLE7MQ4+koXQ WEbY0RmKT6+GhbXg1k9DQ2115aTZc9BN27lpQ1trS1pWtjcqqrJgf0hzo8frHrHwjOaGul3r 1mFmNzYpBfcKSnZsT8oaFI++Vs6g0qKifZs3RSUkxKWkYolZS1HxkOnTwiIjcd9p7bq140fk 4/qJAWl8SvKUGdPv/utfW6qq0JHpiIp68/XXcc/t0cceW/rCC2fOmbPj888T09Lik5NTMzP3 rlvXWFkZP3Soh665pWMMUWa6VwYrvNyMLSb7TWCZsXTQePzUMBKwchgMWZlCoiu0odnd0Bze 7w0ZPGHOyNolfUNfdm9xRWhoeXJccnJsGj2NyDO1jTXN9TUNVa7DI7JGoRVDDWhpbS6s2Ic0 JqS84d6cxBxXeFhHa3tFw9GaptoRGcNIfDu76lsaSqoPj0jJw8wErCC7/0jRsPgh3ujIstry yrrK4QlDwn3ewvLCyHBvSlRyeIQbPbrasuqWlsa2sMbMnGG4kKIbVd/cUHi0GFNyvtYQX2ek K8TTFFqTRbjolPFTDq1zUxVZEt3kqh2UNSocDyFUNdVX15eFlebnjEEz2t7cUXuktrSzJC9r ZITHjeONEfOOQ3tRCqQxdZKbnINJEtrDEzGSR4jGSAZKklmC0eUhZ1n6y2gmOZlh0xtSlUGn JJal1ymiROMygoXIlXFZ0RBJEywhpaTDJoBkC6pWxbmUuIJqSoysqkdWNarTwAgT+l6V7buG jBlnfW1MlrF6QzrpuL+ENdDELbR12DC7QnLkRQdoVjDMa6VPWeIJR0IKQ50n4wb0nTAAxENC aB3d5FE5phF1CQ9iEmZbG2bjKJlUfpwR5ElyPMKJFCaX6RusWpuaMXmTOSTnF3/8I9YJYHCK EX3eyJEYZj503307Nm/GopD4xMR2PLYJv6hFrJ7F66tYq8TbJj1cMsCMwbPHuCFzJafmsuNq do/R9ArNzzpar1U8DovMIsH+pFompQLAQngRbxwYb4Qr2uvDqyPYmUanvNA96XJFhMZExOCo occLWdwKBMbrBtSHZypBo3UCC7UgHkWVkWMK21ERPtyHJDJkMr8zxh2NOVUkXKGu6AifK9wF VdCDl56R6Tk8WtDRQaZkI8J9vhjiGGlQyUGEObR3HvKCNI/L44qMglEaENp5IoLQjxuv3vCo yFg8nE5m/SEa4YpFFvNxsI+Rsic02hdL5+1QA8PbO1pxq9UbDqXeGC8cc9Hmm0fb2MlgUZI5 R30woNasCS4zSMg0pGWaJYi7FqKkoNwSL4ksIekyAbq6SToS6p+KIWmOM/dMDYYQ5TCeZTsD RVKWjYtY6JJgB7CjSYEACUWWVEz8cQFS6cljxqS0oCFLKCRFMxSKThxp28JQafFDqjR5Tpe0 RCDiXhZaJQw8IUZe7QKWy02qEJ1iISIuDzWGZgQ3Gsgte+xxDkGE6CG8rraWFgy3cVML9/cx v4lFGNu3bPno/fcxAiXv1UC7F05e1QLXoJ8I4h05EMN/uhmnOidw/3mOloWWiBKoN0jhnBIA E91EFBkzVFCte3LFCm1td2Ga0bFHJhzg0iwrL3WsXkuMQadwhU7yGphcd0SpPHgXWVgYOtLk e+D8ZMECY6ywwRbW2tzKDuT/Z+9N4Cw5zjrBiMx31n303a2+u9Xq1i1Z92XJh3xyDGDAy2GG 9Y8dWBaWZRgYloEBfuwMjPFgA2N7AXMYg1nMGGPZxrJlW7J1n91qHa1Wt9T3VdV11zsyc/8R X0ZkZGTmu+pVdbfU+at6GfHd8UXklxGRkZGgQTQhvLgrVcUb/6gfbKeDvhdWyQgt6C+5Tq6A t9uQFX5DFeYLuXoVi8/qmFlACPMqmHf1sUYMYj2s+UO7CAI8YaDGVK1URcMSclzIYTkR4+Rj UFE5lQq+PB4dUACBQj1cOY/dAsTaVwQmNIPqXBVZSEIWMDBSKWBjEd077LOIPKaBseoQTzYb HEqfOsdIU4GgILiuEc2jQlXIp9lDetl2LKAhTYuRjgWdoA8r35UnKQAAQABJREFUTJNpIpEg fWQPiLVoRWQ31pBAgAW5KoAd2KRYAxjSk9TENSbAqUCiD7nMjE4nDNaYeCJWDotJFkTA0MxC LhHBUIYwK3KivAqLjACJSwRNyAQLjGycciI4hpKtV2ChRRwgpUO0ZfIjNMBnIjxiWDA3Nblu y5bb77kH+x2gqc/Ozj7y7W+/9MwzWAtSxAonuX+GUIVDsIuLJBQoT+35U3kkVkYh2RRpFdTO xkhVBjbBOgT22Xm8BJY9tIwrCvWq1iVE4NA0EVyqMeCSzCBGUuaEa2wy4lVQyFTEEqF+FFD5 U9ErfCRWQ3QiQasxKYlY7RG+Zf4U3lBCJibFAqVOnWMkqUBQEFzXiObpMJBJew1dIq+y1AqE BgXR2pAIS5qGEgy2I0I6Aca/uIKkMCNmyfyFFsik0YmfdKckyNIAtt9AE5eWQqDkIJqI2IZd NyYnn9z/SqUm5u/QS7hm0+ahZaNgFKOTqFZDNkuguvCU0MQ5Rq9sW2Agi8nUGtFIVCBr8tSS zFDGaAFNEhYXXULgCeXIE35sMinVJlaqrNAJMMomJMgikijkwoTOK/a2z6jwUEHIatdEpkSh W+tPr4BM3jhCM2txcXxLObvdKaHqrIRk6IiDRXcBjAAKdlsEiQo5zOuBWJQmYiSySASlNFeY tbWozoHis8xT4FihFTCqlcgSkaKYaUdMzRUnDnOR3igFVKuNJC48Zm2qusZAS2vMIotTNGqM ZnoGBu58yw2ioyiHsWLkgQUYoJXDSYtHZ0Or48Zrr1pg4lL1JUTjX9CQeXHqMKdIiNf8TZYJ LCiMlt8kkJmyWkwnVSYZQdMKWZKRIOAVxchCdwVOrg0drCQurkql5bw6Wx4g21KBltkWjZV9 E3rS8s85zWK4iDEmVQLimohn59SepspTzTOBdiAzGhiRGQBDm+43AQYKfR81SOykILNhIp8E mpAorawmiKUxIktT0RWYUKFsCAVKrRasK7psIWlVofVGZdcgYWkIjrCm0bYC5DUzcVjZkIGg SqY629KISkuw0aLOBVIRZIkxSLQIqnfFqcGJBFE0kBypB29DOlu2FJ20IJTRoqgkv61G59sg JR6LIc0i0YeTU18WrVbaIGGzWPk0dZBmUaXKT4mmGdIM9pACE8/pRxY8nVo2BWqeSQISpQXq IBhCFEKdwyKrbCivcVYrJTLtkZDLYtbUaQmrny5JiN+SklU1MTjxRCBKWZKUGRoc0UtUQybF 3O7Ztqxd/kx6bbwuTiapEUJCrgSzGMymXAaKnM6taEpKaZGrgfXdQrVVioZKtf8aUmUj4/xt jXnjrFqFBmt3EyTMarRi0GQK0MIZPPIRYgukJomlysqalEg3xlrEVnYhvJaoi9mLHrjogTei B0QkxL89tEwUNRYxrchiZBUZnRVCnW2pJpw6aBqix4yAaKDm10DdrSNURClTlI2Aceu0tDAR 0QkAdQEkKmRL66OFrJI+SiOlVMWAcQ0RKpU4Qi9qytZt2RjLkgcMkJGEkemi9Og2WYyIIUpZ VBoRVxXqUq0kPka1RBiGWUKIUKugbCpNQmSiVSop4VmessYmKdIMkGQVPw0tCfUYfKnJiCxK SUJDuIVJkSMpGvfLsoQoeKhPZVEphgVQGc8ZdSbMwaMIaVVmWyIDQdM0kEk57f8Y5kEXcvRr m22QRToIaKJ0Wici6ouprnsganRdF31R4EUPRB7oRkNDSBBRoUkgazVwWBbprOCn2xMtZ4jK 0HqqFRtaoZGmtKRWm9+EGnQtKm4iqGN0qqXt2WQXIi6SckYvNdVUMSeZoEmaERetJUlmdafT 0K4mVDG6KrQLwjI8sjDJScc3k7coZnRXaTMTw0BmlL0ZR7p9QoDuUJM0/OoEMdGEHAElfUxW SGzpV9TqrGUSwKJWPVNFnUEU0xuNjMLxqmIOVUXlMtkSikOkZqZ8FhlhLWItP91sLas9tlAq cesheZhVKrVsBRDnLD2Rx0zqRJoeuURColSCNBtgjesTb/BJodp6XbxsgRqjzdHcGtVOIiYm FKUlamQ7ElNptchULICpBKnALAktwrNkhnCFtkaQmcIVPRFY9auQmX7E2JOaWSeT/ak2WaqQ tSCpXEsDJGPOH3uWptSpWlTLSEVeBF70wAXngbBF20PLrKud4BqrOl8hIIEN3UE3SM1FUN3v SeVKEisyYbGc5BWA6NYbZwhz+nqV+Szi0Ep1CmcWzS3rFQpnLZJgWq0FNzhEUpMRvDGxxWtl Na92IInXfRbSpcgSd0SNEHLVbLmlo3FWSdBUBFCDShut7Al9EPpV5GxKLTCZIK6oMPFuni2I 6FR9J7BSfGhOwgiLWpElTTIhBpPJoMEaqCEmt0prKgloSJowW8mwzgsRYvPG81FdxFXGqRKV HC+jZrW4rKwmo0QSq58C2IHM4myazTDPvIChHVRh8VPpk0CCJOFZ9rROmSXhTQ1PNpAldgcZ QL9vuLpcau9C33nmQ7JoUf2w0ECmG3xz18XLgbtmFkvj3kIWl7ZkkRKkN16IVm87i2RSQmzr vomXw+QLMSYooScdoFniwlP6EERpkYVCCZqOS9cbQVvisoi01ZGYCz+le+lUlKUto+VgMiEV 2EVH60DWmaKQy3KUldXmpsI1UCe0801ImBYKxb+JSmZJgviNF8sYlJkk6aXQFHEZGhwmLEta JG5MZutoMb8oQlN0kx6r4Em6VHNoaCiIm/JLiaEQLYvuckpKmIt0SzpFnMAKOoWMeNJTFl1r 1ipRLVFHGigVZ4qwSqh1bkpg0ZvZtngtYitrim2QzuKy4fF8PNeozXRhsj/u/wZliVBgsbiS WQsSMV9MXfTARQ9c9EDoAcQ68Sc2+SOIGTjMtInVxBqYpAQKEgGnP6LEr85qFkrorC1T2iWw ksIijiaYQ/NDPaG08BQC7ZNiCaeGSYEgkog4FlASRmBLsKK1NTTJazZLnGLTeAWInZXZMSAy eBKNX+tZBYkS7pK61DYHevierip1aCJJhRTLai1CwemswaGdRt5Ihkj7ZFFYWW1C2DNTs/vK gLBNK2xMuEWjmr+i0WgFoLPqAmrNcXTzXLpPmvMpioQHQkQWXPHFzo2JG2MhKCTQdBm+IpWa KsxaeWVX1qODVCGKKTpDKv5giB5aRjgrlbRWQ3SiMQvI6M8i01kTmyVTE19MdN0Duo1Rm+is CrQQmNeuBNIbStCZdqV03S/tCzSd0D734nAsvhvPh1I3D2RteVc7DQmdbkvCQojbUno+eH8h hV0gL4WLFCFwYsI1mcQp/AKUEBCjsxoGETdmifGfl5lzbL/l00VwEQp4jsvYsFBNAllj/2is TpAuK6sNILjGWtmIVzrMJlNepEGRNciNeLWyFhJKiFYleJSeMBDrbAvyBAnJapeLhDfhiplp mqMRUgCNs2icKezJlGoi1FAdYsUoSkvUagSxIBJnGmdpMs0rcNHRZPQa2pXUFElIS0kdWeMR MiBuhl2jNtZSotFxw3QuGmMSo0ZYcigbl5Z4UK/RgjqWSWS1eItMw61EKlkq0GRsQJCCkqAI HndFBDcV6HLFiYkki0ULsJ0PaYqnSSDTIlpPmBZSGr8mEKKsrBaeBdcEFxMXPXDRAxc9kPRA q4Es9cZO0VBHHyR02tRkwTWNThAxkaUCQUBwC2tq0UJEQsVpyyANjjPGwFqFVbo4S6TBglPW EmLTqD5MTLFNZOS1OAOmedOQBl1GsnHpiEmroGykSKX0/dAmkPl0FYpXq7C0EFxjzaxIx9lD rO6hSawmsR5Z2KIWP9+gaFBudNAkoaLWpWnFQMWUTpuFzYBrz6VLI6jF29haiziSazUdhWhX GuSTipYCWVb5TDjSZlYZFp1NrJkGBWUzgWnOsIgjNS2nkhLS9DQRp4UIXp1pwnQO0PqSVjaG ZaVrSQGFYUDIrIYRZZglORqnShJKU1kLb2WhIqKPUoo5vTVobEYiRU4GZavgpES7HK1KWiBd 0hAhcBGMSVe0QOsbsndRY0uBzDRGO1AnTKxOKyxF2DD8KqCmChNZcJtO5tsiTpVwEdjYA6gz tDD4Wbi6i22tsdYLE3shugc2X4hmN24g9p79YZhQY59wj4yEDGrlIbG6PSSzGgIB5DtiVPIE TKnSJCGSeLUEnQjRSpwFt7JWhSmsAstz495sqC5xUqKichGJEh0yEJkFTAiLESPTmUkq8ght +rNeeo/N0OBwCt7sFVERJJcwJDQZeZkSP0QtISE2pJM5wUlHmApPipTOEBcRKoaUc2MiZbeS aQmQzIb3lAkGWZKzsUZizaQhRFKooVEk42Sp0uyRpmJKlWQBtQYLnqEIVE0tFpKy2Q09cSL1 kMkgkMk4VYRNhacCI554CiXBX9s9MhKSdEMSYqojZYA0JssSboq6mF4yD1B7aqXKlsyki4ou eiDVA3YgM1ptG2HR4Iq0JIGA0B8REYF+Scqip6z1kMFkjzRlx8ewE2CJVpzhhaoKatzJBYXu QBBcy1DkoRSCW0ClIUaDjK1C4iNercPib5gldotVy9SLIOzbq2TQU65WKXQWCYiirLA/bomG Ezh0lCIKzxZRXELTnBKmCC0dITjUYblX8SgLZGmlQAnRFazozLOt18Ql05paqUqSJCGayXCw SaVlCUKDWNAku2/EaZERUP5qaQZMJbO4suDEp7DqHIdahcrqqRGZ6mgnyillZlSrsh5njh4Z 1akBFEltm1V8DY/Rm1DBYDHFaFWmFRpFG50Fl6ktwnQhpU1qQ4PmUfo1oA0hireFcwdSYyzU YtKG85bhKourXQhQWcP7Wq7GZdivCTPwnYIXS25r9iye9pYkm0TnqgIaOso0sCFhd5B2j6wV qQm/xQBqpjgsCHAmGlAza6ZN1Vlwk+bcpy8MK1vyk1UvMR6zmEvcPGN2XMy06oE3TC21UBBq ncZL4zEnqVu22YZBgHGKBTHu0AmUkmiz2HBhLWiILJU4CUxCSCrBdflVVgOU7oZnxRUSNc42 lBQim/SNozEOqQpdEfW3W9HRjMYck2nJoT7RzQ1rQdVD6DE1hNFYoYZw4A2JLNVaaBxOYItF 01rwOGtSkeYjwpDb3k42LkWVRUF1rUT+VyjlBeQjwyilNKcWR1Nr2ZFEiFKyUrGodYUXslUa SaVSwqxSiCxILQ6hVXOJjHUYwiNMKhDoLLjiTHMfuGz9KSYqCTiH1KauKB2lDA6ZhEvxB+ZO emSmMNtahSM4fi0CK0vkSTIl5uJ56TxArSW1gpbOiIuaLnqgIw+0GsjQvtHQ22rl2eEpDLAk MEumBbeyVmGjm5m0sTGxxauzxBUaB2hcis5FBJqzQUKzNaDpBkpb1VihTaapNUIaQzmNJAM1 SRacyCysLpxm1xAkUoEmQeN0gp0AWSZkCKPOQ3rHImwFCUUZopYQ3JZJLRK3SJZaSpvXzodM iZ5aqrB0YIZIQdxSIKN2YbQOQ6CAmhhCCWsNqNCUhAho4jC4Qi0GJEG9MABJ7syzghcGGhG0 A1sSj3IMx3YgLo1FSwzdqL2pEXEuY4xJCEGnacUzUGTkbwS0JcTziZw2IcJosRFIpLSKOPic 5rRNKcXINCxkaoclKcsaVJoEUn4n0nVpTGmN0y2ytEhm6uqARbO3FMg0tUyE6gy3CYiRFVRE pIFI6LQmtoCC7cI6zCJdWJYvxFqK3bLskQMat8GILltxKzTZ3Bcxb3IPRIGslYYkafBjdWKi tUrh4ivZrHUsMyRH7R1AA95GLYRcilmdtQStVkMiRZH6CNlhSojCf0J9KC4OlzniUAg5kKFM F60io8wiKX32rSWsQqWbqlDl1I1ICYoJARHysnsQ0SvK9LNBJ1kTVAQVajSpyOhDQzUknogR Z8gI6ypTlN2oY4RaQQSllEbEDWorF8lsgW0hxBavlbWUZ2Gz4MSehY3glJJ+i4CWbpVtSqAI WxtaErWqMlt4cnSlKLWWKKFRkKLTGp2EaNT5mLjAzO2SC6nUVtntRhHXZRHHkWGuFZpUxovA N7EHdLuLemRZ3kjGqSxKwMPWaDVKra0B5zlBWXZ21QaSrRc6hLIzZpRb19zYl1AKggbF0uwh jSLVKwPIEgLbxHErY1glByQaborScIMwLm4xctoUQ6tOauRiaE6XqVVqI9LpYlDNFIMaGasr aWCiZFMhEWmiBk1UMr14krWuJirgTL2yX/PohOVqK0utVUrQHM0TtpA4Ryq2BRWpxVTAuFDK KVxcvc7FWTS4CZemy2DX+AaJJiqaSE5wywZuQS0ZGmvDZV4DU8OcLogWQhDNpQnMhEVsoCyM zjaWZwjoblKHhwXfe1q1S5VYa26V0aBTMgxQWrJFMmJti1hry+RKq89MYi2uYQLsukcWiUpT lCIGZCalmQa1xlpwEpQKTNGhbg6t06cK6SbwnJoSVVJGkYgAv901U+vtrtiMQlwEN/eArpHm pG8CCjRLvY1P2ETTWmqK08LpfYWxuHRWCVV00qfhHU4RJW54MWKqBYAUeZiKsu3UU4pok70V oaaIGL1GaKiGmDraSWtJigkAKTRTMhGEfJZn7Q6aEKLf1KBegOYgBfhVooQFSjuScQPiXQiM pkMuwYQjlotzEgH9SjJtgYRJEHGEQrLZI1ExfQSOyQgpNVkTmXHXEJdm0fZaZQ49pHVE1mWm tEzTZE1tYY3na6Eqi6AVIVnCG8NTFYGlRbjVu9e6KGG70UJnZ1N6ZNnEIcaqncbZptIuMAKr tEtrfVZb0VYQAX7PqZnaHJGwbD5/DItZeaFlLK9eaOZ3zV74gVyBQLbkPqG2rNUmmzahNNzK LswJWmpSjLYoiQohKcxJphCSRGSKXQSEpT3F8NaUdibH4rJUdWyMJef8ylKZ2ylbYy9lls5S obMdieuIKdM0QiyGzIYqoTCwt/HRXWWLk9ylnUZYs38LCHjjBItaoobC43bEc3Z3hbAQRwn8 CseoLMrVUFMTrOVGK2tLtg3V5DahRrSRiFet3jmWJIROiNdo9MBa9vjtJ7Bad1xyVIjQam28 wDQeO0S8Urjm1KpaSWguS5pdVQqtzqFszR7Tpe2OFzZG0ywTSaaUpViza2wWAVECG0mUIIPe GsFZhFqVlWhMZmGtrCXKyjYmjrCUMgoCORHWEqqz4qllp0dcVxMpDYjTLG8irUU0lGLXRvyS diiqM1aVvzX560vduHhBlmesIJ99uIzhDyy+9CD9tqjxzUmm2xn5+c3phEUstWjEcjIT/hWN OBB/aMEeY7UgwC8daLUFLtoxrmkXCckSNt8gbM2K9o13TgSyrMaoW6v0QTqVdbOiMKHiiOE7 hYgijIFE0pJuZSVt3JyQA4QUlUCCGkRdTwdsjvEZEdECxKlVDhvlQR9jJVndOWkwWkKds/mA TTI2zviZgI0xjpA3wIIyZ72MFSUxyKAUf5CccqQZqcn07TyC6BQlbHarfBZ1N7Ky7JGaMBWe yByNjb4A0FizZjAKZZSM0AZAkMV4YhlDV9Q3tBuHQdRu0lKm7FLnUJxFRV3KTIcQtXqGortF 8Z5uvMxJs2EBGBCYcNSDYMJnaMFTjM0y1sPYepcNuryPs6KDpsnzqiLrPptnwUzAZoJg2g8O e6wSiEbcA0rG+x0R5iiu+YE2jJTbZSSo+rWwVlZRpZ+ziDPhlvfjUrO4QJUIZJLTlGam42Ib 5TrjaiSxIQ43LfyhnOhwTQWodI6ANciCTTm2nHkr3GCAB7086Ges3/HRGAo8cHmAuxcOxCwE KTDOBHwy4PMBh4TxwDnt8zM+P874CcZfZ2yUsUHZcYPL0B7Sw1lDIztDNqi81gVaQha1drSu LC2awLQ/i9ikeYOn4QLxx2Xw8oJxcXXyS3LOtjxbVnT6XN6bY8OuM+DyHpeXXBGYimpMBZ+i EVeCYM73Kx6b84PJOiKgd7bmT9aQ9o/U2ct10YIR1/oc0V/DeITiWjfcmlqn3RDcqoz0QNYq dzfoFtiCiR2VOC+NQWwa5CJsreX+Ms42O8FK11vrBH0c3asAfStUfVFMDTIHsUyygBcVKpsB r8h+HGLZZOAf8ZxTjvN6wAexSUXAiwFHrPQCPiclIE2HVYVWVlGdX2fLyHaroCm76wbLlldX rZofXVYbHKiVe7yeXjhYHPPz7tysOzmROzteOH6seOJEsV4T+pvKlNzn7w/50CpFY3O128MO O90ea4HoQPW5LO+wsutszjlbC3xV0RnM8UH0xXIO4HmH49eR40c0RAiCYrBjpFn3nZqPZhpU RSxzTtf9M1V/vOYVa0GlFuQ8lkNvDKMPoSWcQ2nLaFWkjpgUc7Nze8KlH3O60xu6NS5D+zqj R6+o1ZksDLnkCRglJHOyuFm5THzYKYZM+gMOiRnOTjOOweMuJ7jO8a/KIXjV+3kw4oo9cGNH 3FSgEM7whwhYQic9JBZE17geOmsYnE74/KjvPunlnvHc1zg7wNhG2cdHExJ0lnxAjCMxqAzV E1MCa3C2mQzlJrgaWhdRp1uSITQpE61ow8bZXZdP7dw1tXnLzIaNc/k8Lqzmh+fxI4dLB/b3 vri3f++egX0v9fh+UvyShDld2Lh+ymlkWCTlLxpj2tjm5ZYUxAYFQofoiLFpFpzy+XV598oe Z1cvH8k7y0rOiMuLrpzulUNWXEYyFgmn6AQEoBHnHBxCNOoDMkGAbhcGpzXfG6t7J+Zq++b8 Y1X/+blgTy3Y4HD0ztDu0ewz6soql5UVirIPi9jKZvK1ShcJIP/xK6+6k2DCmTikoDBNHpZg ghAPACobqpXDdOFqOnSCyFQ23H3LECLwNP1hAEMhxCsJBERlQ40Ufebk1AFmtd6e829xvfWu f2nOW+74khoVHjIRD36VEFOgSOMI5ao0KBWxxCCDuTPfHQv4c37ugbpzn++gDSwTHUDRmwv7 G3E5QqySIgVbemysaYOijxmmgclEKi/IbP1JzjSakEsJtYToLKLVdddP3Hrb2I03j42MYE5y ocfUZO6pJ4Ye+c7Io98dRsctTZxQrg1II4hgLZJFDJRKY1OesGlpuxeNDRNKgoaTxTobJnBh iGuDB+NecDDgtxX5tmLuhn5nW5+zrMALjuBCK8bkFxjoDyfd9RCscXtiCiQlCCQNz0lpsqfm narVXpqqPTLp7a74r9XZCsaGXBHyQhWRTC2PQGbWTEcMRsoisLIGYSxJZC0SE6dfd7yai0B2 B+XVBKXIqeIbjpKyVUgCXOS1GymhsY4yhMg0nMigSCUiIQJiqxCW4CDiMM0DSMPAEFOfJwK2 kQeXu/5tee9qtzbkBpg0EAEurBGIE4PBBR4QJgTJP49x3Lowmzbp82eD3Aue86jvfMdz1nOG 2TccCGeyEHaEUuDIFiLTZQuzET5KZaGy4BFnw1TMqw0pgQyJlUpkt2+ffs/7Ttz11jN9fei2 dv+oVhyEs698aeUzTw8Gyf6Cuj+YpUga0Rir6RuTKVWaXCSUJ0Kg3iAzAY9zaU1I4EnTnM9O MvE06p0l94ZBd0cvH86zoRxarWhzWpbmIsVmNiY+ngG7SUnSJASXH551emM171il/vJM7emp +rcqfCVjvVzMu1WF8tTDhJtpkzgJT0Ky6BtTmlyUJnoEMr/mpAQyKr75K9gkk44LZiAzgKEu PURLDWRwMLGYQoQ6W0UoDScyBlzoyeO6mQr4Ch5scL3tOX+H6293vJWOjxAm+/nU2Q+bATFG gjpKwS6SIwwUnU/uBeyU7xwN+AsBApl7zHMOBRxPQvEoCWjRO7MVC1bzCPOKzEYr0iw48A1Q irvRWWlOoUmiQkjAHCe4/Y6xD3zgyI7LplM4FwF0+FD5859bc/9Xl1ermBNSh4ouEURhzHNj rKZsTKZUaXKRsJyvAxkRaazFK+BQhnaM2+NJn6/GtFfOGS2yO/rcHT1sJC9mvrByggaMJGsx fmEDrhL0zmY8/3Sltn/ee3i6dnSOnfWCWZ8Ny35I8uYRL7Uuo2VgEp6EmCwm1kybNFlpoj9P A5lwsjScfqkMBITdaDHwMG4ptzve24u19Y6/zPExxMNBntfsxNjdX3IcfikQI2Dhan7Fd79e y9/nOYiwecZFPBV2Wm2dWCNzwrwqpI1WhOlwyZWOUoyZZ8WmNGcSEoLI8Aufv/Wu0z/+k4fW r8eAfqmPM6cLn/vbtV/64ip6MgD/asMamNJWGbPkWMGIyJQXQyYrkGlRYTRQdghR4MQfms6U w+/GRFiPc2nZWd/LS04484WbJA7FokV1M0HWu1w4EabPe7VDs5VvT3h75/2D1aDoi6dgZABR Kt06pxMKE52TqCQkopbO0NnGlJpMJ4ge3THEMn6VmiPTaCqC2V0CSgFDKnNSjFCaRiaECsDD P2WgRan6ZUKmhdIQguM3hyUysgGsdvwfynl3Fau4c5AZIrQZEoS4RT5QIPwJpdI+jDQfqOfv 95xHfBfPFgaMMWa8plR0k1ywUTkm09xUgtRLK1OEhUiVqGiUXSqvvLpt28wv/MKrO3diQH8u DzwW+JP/vvnJx4eU42mGKtOkZHFM0sZYkxLpLJ+H7qSGmKhQhQ0rGkt+GB4pYskiz7kfHHHv GuJDBV52xCwYDdBhU1tmWVa2ldUtwYU5DlZp1F6dq+6eqf3dGa/g87J8vCCjqibU4pMQ4SKN TktYWCtLHAYw5gUDniIaUSzA0HIhgYy0UTyCBq0cQZDS4a96GGgQCINaDGQgA+ORAE8k/Vty 9bsK9e05Ly+ftJhaUoq4yCDpXwwDxJxGjePJpvOS5/5NPf9YwNfIZbSYTbPqN6wS5YjGNWQz q+JkXVQK3/DcUKWyK5LQ31f/0IcOfc/3HMeKigh6TlMPfnP0E3+8+cwpPKO+oAJZkQeveWy5 61zT49474l7eF2AgieYj3i8xJ6iX3LmiYgPmwhisRPOqe6dn/+FU/YV5PO7kq1yxNi1hURIi RSToDIDFYmWJ0ADGWqIBNySqJHpkQd1xV63aoCDh2YwOWp4JBJ3oidCkfZgQsUoTW6FNE1NC sEtVyd/QAnWCHHgXI5ljjN+d8368VL0h561zfcxIwvV4DIMzCVEcS3qW2oUNIpZxLLoOVjjB du7Pi0cBznHGMJFHdSBCj/HXuGKyyhBxQVT2EZFl02hMQ0ns2msmPvKRvdddN0HP9DXXuU1g bce73nti7Ez+1Vfw2oUoQVYpVD/Jthf0WSyCNA1HLPo3QaMwabxoxBjF8b11fnPZuWco9/Zh Z2uv2EBLVJWsLtGIzt1hKnc4Hpi6lxSZGO4E/t4aXyYD3AKssxqklU0IFp5M0CQABpt4a9jn 7qrVG1Ar8KT+o0qi0ukyNsgKzVKuRQyYCddkGk4Jk0aKCX8QxTBUx/JmVPgNrvcDhfrVrod1 YeJGLI5zW/lkQ+wX1mK+f5SLBRnzMrThCcCALF5bfSi70shx5m9MbZsZU45xKxJVRX9SHib1 P/STh375l/f39ohHF+fbkc8HN982tnJV5aknhr16ZktAgVKPLHhI3AQtqbJoLDiyaBZYl4K3 3q4su+8bca7u55eUOW7Fev4s0/xU2xcHCBtUs3Py3BnM8wHHGcoFE16AVwLwpt4iH0o51LSt K8DCwwCBTPbIbG7VxIWT5R8ltM+Jnn6t/hcV2STQaUpoY5GlPw0hXspSA8C82Eon+LGCd2eh Bn+CHmWGRi1Ks5zDhC4FbMO7H2scH/ELbfVhH6/EyUe0LZtr1KgqUMu8iqGNc6rs4eHa7/3u i/fee0pXdxsSl5B0y9aZm24be+7pockJet5j604tHYiy4CF/E7SkyqKJw/Hoh2OAhtvaXI7/ 9LB7yxBfXhCrhzD3BOeCOE5vF2Ap82QMfv3AKTruaAFds4D79UfnWSnA7N5SNYa2PSICmeiR xQOZLg75UEulBEUQmRZXnJEV5KKo8o8SlBNwgTRqLRElgTP7LBBLf88G7OcK9Q8WancUa4BA pZYpRZ5fP2QbjEQI3uD4lzn+aod/NHAuke/DAQuU8FrrhyptY67G2Na1EeWmTbN/9NHnt27F HeQCOIaGa3e/4+QrL/YdP4becHiQ2/BrHRZcZ5sk0gKOZkGLpDTpkk1bhihA0WTRFF4KWG+B /6cV7tuWh8NJ8XAK6PP1gG3oheMNqF63sK2Pb3HrX5oN8nhHr/s2G02XvKgHlQYm208hUVYg Mxm17aEeE2dEKAKbxIAQCyWa/poE1BdDFPujYuV9peoW18MkA4zW8kF83h4wkkwtOWyL493I 2F/7Dl6eK3cWyJa2nFdeMfmHf7B3ZLgLa/SXzPBCIbjzntPHjpYOvoopM3FktRMLbmWJN+W3 MV0qFkCKYk95zodHnA+OODcPi14YtYxUlhTF5w4EC2Eq/vBm+qYettXxHq4Eh+sMby8DuCjH ApzSOJBBsJQdGk5ZSxtlNdBKiBsTQOavdIGEiRTRR1wSgTlQ7DZxmvNfLNTejzUW4tVuQaLJ pIzz+gemCq9xvObJV/FgmHM8xzzMOF4FaWvCyeylJgvctEU1JbBkvuW6s//l917oOS8nxSxT rSyeRdx8+xjWmu3fhy2a7KYim5UNTJJZMjOz8YZIwoU02TULudBkPc5f8p1/O8rfM8K39Mhl rgnLMnWcBwgqmGxDLobDAw7vdz0MM1ue+7ean5HVFWImQrz2Z6oLDCEGngLZ6lUbwKwPndYJ oLR0AaSM/BVxyqgdmYsgRKgJGmOJDLcx7LnkcYT+4KcK6IuJ9fp0aHYFOP/Pwj2Y18sF7LmA T4tFb+K1dhyoD7M46dUDOpNIMi7ez1VXTiKKlYrhFPTiKVokyfD1jbeMnTgm3j+33JbMAmIB W7Eq5Mri1HAk0KOtBiyfc/6XEbalh/flRHcMh6ZpRd95Q+P05MQ674B5L1Z83xfvmS/oEF7I bPPtS+Zmj0yza1ebCTNtUgq46nBFCcAkA36I0fyVHEKGBlKCIAhkBxjHM8oP57FeTMyL0aFp FOB8P8NgXcDVTrCaOXiUeZ/vrpBQ/LRUkSRi8cu6efPsR3//+Z7yhRrFwkbC2U23jmNNxpFD GMdHh+VFKxvRtZjK4tdwtNqzAatgTDHq3DWCjQ/lSjHVIFrUcp6QUaGw1B8boq3M+0PM+/qM eCqPuGY2Fl32BmZTixeUrVA3EJRAIZCJp5ar1wvJMh6JAKT+KE066dc0wYSnYCUIPwoVXrbi yYcKfJEuaRhqH87B5l9vc+s/UqjdXajKe0BoTsL2CwOA4qPk+F3n+OvEwhzn8YBjWToKazaD ZGGUv5IYAQmxcWQqME6Snlu+vPqxj+wZGlqUd7/TVS4aFI3qplvHnnlq6Mwp7LYVHqoRpmdR P6rtxxKK2z5DmvgTDVn80RECkSlyftznGwv8nf3O96+U+xdKEk0aclw4J1guGjHeJeb5S8pe UPX2VsQUSdmJGnFa6SKfhGWVADiu/aNJ28a1JAPZBpJsaaCs+QsyTWPCLaAgkyD8aJQyXmAI qFEEga3Y1BBX+4eK1etzdWyUJLyn2C7cM4oAPyMoY3/aDdx/ERsByS00dGezUdEWv/yFgv+R /7p3w7l4fbJRwReAy+WC628af+BrK7CDI4mxvGhlVWttU2VCiuBHpeL1o2U5fveg8+4Rhq0s cMGDMpW4TYXnkhz2ixsvF8sy1pZq+2dZFS9a+WpNb4sFlF5YDFdgLllsegrRhnTKRQCdtxLp fkXwSf3T1FjpbhOgo4JX8Ws8OMmDD+Srl+fq2M0Vfots0NwXZoL6X1g8hDUZH3TrYyw4K0Nb sjTaNUkUIFlYgqeyNALKCv3Fnz+w49Il2seikTFdxY0uq/7qb72IHYCpzWbJ1i06lUBjrURI rCvD9D66aQcDfsMAv2mArSzJxWKpsi9AILyAFhiw3OpSz3tH8hvKbAx7oXSlIKYHw0beolxd CaDvji0xxbLMYXw0W0GMKHZZyg2mAzzguyxXxy7Vi2BTXPe5yMETGO3s4GLfbWxFhdevyTeN bIlVcSPCBjhd2cnE3Xedfu+7TzTgvXBRl181+cM/cdiyP93h4t5Kf/JeEfGYbTedFbQhkThx 8YmQ0RzbXGZi1evirVSITFzqFB5X5XhuYzl3SZEP5fCRCxE/UPbGRzeacWMNwMpXlCQV2WNZ ZQE11oRbQAjTWI0SGtTsmE6g6vGHFfDHRYr9rOu9tVijZXdvsFgGP5ArRp2gELhHAv5EILZj bKnjGXOirKpu/CxbVv2D33uheME+pmzqA8SyJx8dxpoMTRk6EteVPBJ+TQA0ZwZDhMcoFlPO r/rsw8PsrkE+mhf7VjeTF7FfKCmUyAvckUKAXeELQf1bs3x5OH5voQTSHYvhEzm0dFevFssv 8M4zhRXhfflnZpGmQ53lLJgKTAIrlhZEFUdkEbEqZRIOCD4aMsLZra7308UKvm9kKVKAN8gZ 5b2E4wk2bt4cn3rSrUBdXOnFjLDap1bvIcEXYwFX4u/Xf3Xf9gtk+X6icC0B0Cwv3TX1r/+y Sn8EwHCekGBllVDZnBMO0wx0ocS4cdfFe0h+wHeW+IdW8mUFcXmgAjIUKEUX6hnTUU6/m1tW qL4yzWaxXs648s0yRU0wdJ5og8In5Jc42mTUaUEimMK/9JoRE2SYRTjHXR/cLvcwvGDvvzvv DWBrOWW1LssbKYEKQQjDJ1HegvK6/jNqF8alL+Ptt47dcevY0utdYo0bN89+3weOLLpSLLDA 3gbHOXv/kJgawyWFnXnoau1INwKDy9w8F39yV7COpCwSE+JGPXBKbm5tqfTOYbYvCDAxhHH0 uT7sQKain22XiHvRvBYCjvUn+URsjv5kj0+w6YN4KAswslj+upkFl3N/M69LUwB7gx8o5iru Xcnr21iADcsQ2to9TDc25SVi8zeX93/uZw42ZVxUgoANee7Pn5n78lh1j99bZ/2B/gv6/Cl2 5sz8N+rOrwVs3QLN+KEfOzw8IveFMwRRIzcAbSdJgvjF0zJ8B7efsy15rH0Vz6cXdqC7gxm7 6WD+uD910p+uYKuthQTFhRmTxS2aE75Lt7XH2ZpHkQN8wq7LXRDt4BQTdGM2ce4aObTUIAgw D5IHCHXrdJii7h4Ry1/xQ1kzYYkys4IM38Fl7Hru3+6KLXrwXI/0WGRvsCy8hFs4pgL3++4B TJ7KJ5iiIRiHlTUwMqkdbSNE3uZNEP/g9x97+92n01iXCFZj//t88H8Xet6bK1xWLK3I5WTN K+UYquRyhXxhtVvYNVe9re6vzjl7xcZIHR3Y8Kenx3/sOyPg1p7QCRKJrPmn9MSoJAE1fyWH LgnclyZ9tjzHriixu4fFxyjp1hTjViIbnskG1B/u/VV8mcTBYJX34BNvyLcvraGqhSPlgLLg 1I7N+idr+IpK7JVyuwla6mRhkiWKcYXoNJglTSxxw5+YIzMxlnydpYTOEosBFEmN1YkEmQAQ Fg0AE3NPcf5/FerX5bxljlhyITtlxPTG/EXZUUzctjGmxgb/f+7lsEwa+za01y+z/NvYVXHi Usn73f/0crnUnsLGGlrH1v2dM96nCr0fdPOXue6I6xZcDJ4SBz7O6GJc5Qw47non/5b52q2B fyLn7E8QtgTYuGXmgX9dPjMdjX/iLonabVycRRVHIkd43JQwx391L3vPkOiRoW8CeDPWhCzB gb6Yx/xpVul1y+/vu/3HB959V/lqz6u9XD9cxCOx9mUmtXQHAktkgMHHz/08r39jLjha56vd ll8kliVpUpw0dBpM1IMVyOTgMSwpWOhPl1wJCTHyHiFuUCDU9ws59tQcIkFcdOvSNQEgAhau JAyur2HBTxQqax2fbspEHxPxRswID+ALcjw44LtznOPNPFzNsZtPVqnBme0jS4KVJcYf/L7j d97W+exYzd857/0sy32wzm4L/KMuP5VlaQLO6/wDc/6vl/relstj176W7lkyopUdd0PNu4r5 Yy7fmxDbHABVpZL/uOyUEbXlwmRWupmarWziCSWCgFr/XMC3FNht/eyGAVaU3TFLXII3FYBJ sVPBVN4pvKf3ln+38sfuGLxxQ8+6taVVm0rrn559fs6fhR1y1JnKfa6A3B1wvVPzLOcHU/iG uSy53eyyHSjbsnR10v40J6bBwJkMZJG4JIuChGc6mb9CYiQgTJkEGosEwhY2sMbA6kO5+s1y HX8qe0LeGwGA4qOu8Yt7+WTgPug7eJ8c/bKW+kjaiR14Am/IucFv/sd9fb1t7cGhNPGRqv/W avDLufJPuoVruXtTtb458F/NOYcVRaNznb27nvv9YvnqfL7td44RzvKFlZX6VYGHflknsWz9 xrmvfnFVpbW1/srH6pxVLIRifEzklXrwrsHg2n6GNaIdzfFDTY7hw89T15Uuu6P3mu8deeea 4soSdn4Si7ScHrcnj0/bVJ6rMa+XF+SnerMMWkI4jMYfep8l15+pBfO+90iFrVLD6i4Ykub8 NBhUUSCzb4xkYZYlhI0E6nxWIkMQRW0MqTA1Vg4fI2SQvnHBGF1ewb1h2R1DKSOvNigyHJe4 4xEsAU6RctvN4ytXoB/cyVHzb6ny3yr1vbdUKmFWC/Go1Htvlf1O1bupqbiat3PO+/l8YZM1 HdaUURNgSqbcs63u/lrd36WBrScKRf/e9x+36FWbVWdRA+ZfC34FCbrW28tsZV7cnFupA8sI ma0zPLLvu6X36tv7rl9bXFXgItajw4dAVnaKb+m7aldh0yDvnfEr59vEv1gfu6GEPzFXQrdi uLB7B9VHK/JQD2HtqbMGiAS8SX8KG9auUqArmxLNNEo2SKyhd8CxoirAWzuyQwrEm+7APeQS x4cH8EoWRpdNXaB93dhTmWQBe9c78GHrTo6Kd8tM7afLvdeYkQjTW70Db50Lfq/i3dZYqMd/ oNR7d+p0WGNGE4t+WU/fzrrzsyaw9fQ73nsCY0zVbuN80mViKaT8E/Eo8aexkQRct9icZ7kb rCmw/pSZvriO9Jy4uAI+61fW51fs7Nm+ubwREHzgEr/4DAj+kFhXWn1zadeq3OgMttQQgfP8 OpzRgrumKLpjmB+EA1WkyLIycmAaRWNsGoeAgcvukWWRdhEOrRNCXHCn4691PDSBzqzvoklL LIrKi1/s7n8T91fyALNWqAlAFu8YHKjfdCOeErd9+GxThf0/A8PvS0YiBJf+wTvmgv9u9Mvs S9oP1uXLt1ojSs/zzp49W69HW27MzMxMTk6axk1PT8/NxT4GzHmh2PM2v6M1GStWVa64WrY7 U0fHadQWohi267m9zNYVWY/b2VJ+h2M3reC14OxN5StX5ZdhROkHAeKXtks+w+TvHLrzit4d JV40PoKoSc5dApPidd8dzuc2FHM7S8FES7Mji2Ru6DJ9aWk1BDGyuEvgPqUPumfpbEZCShGc cg6IeNAJPRpwvJd2C/awjgvNkNIpWGgX9zbmYF0hplNzLIchAN6DK7J84g9AgcK6GExZSHqx RshyQ6eWpPHBG/D+FU6AjTEOBHI4EScjd+nfCKlA9I4gdR9EOm1wo2jZPXefzmOPx/aPufr/ 2tt/PWJWKivgQ8PXzvh/UvWuA4HoTMSPivf+enCNCUMUQ5BC2EIskyzBxMQE0lNTU+Pj48AC WK1WkQUNEjHeYLTi/6gJaT19m1h0IkcY8jmXnNIQ7S+jjglsF4e8jCEVIhA/FbAb+lg/GkyL c5y2sWidPuMHgtmR3Eg+bAKxOgIBOmirisvv6b3hhwfeudc7Rd00W9C5ysP6vOOMFPI7e9g+ EcjEFRM7QjeiIPjTN+sQGqM0M7rZmkA7HXaTJZieFtoUi5rHXRjfKh3kwSUcSbGaP6X4nVsg PSZGEXTh+WIKto6p0pr4rc6yeTzgDsQennA7tRlyKjyB/fiKfTLGlURQQzjDV0sRbcTFCTmS QbAQW+cmEifdbFcxbyVzMLqkHV+6IzrNtHvu6nDtWNW/vhg0maEfHrlmfOxvHP69OeclS3ml vqzoix2o6cAWo/Pz84hWq1atQpxCGp21l1566aqrrioWi88888z27dsxgEVoGxkZATHCWV9f H1DEHgR9s/OXlvW7bEpsK+eb7zjzpx/Z2uCpCqq58RHWDujQHRObvjrBWtz/mvI1kIqd3NlK Xpj2ZjzRBHC5J6SJAMAvKa29hfObZp84VjtTxpfBRQRcvMbSwOAECsaVnNyqIseXEIVJCfsT HIsBWFAldGAQSonoNcjEZtZ4VCdjRAdiEizCe9KDaAeIjbUqEzd2PPjxGR4A5VzxVyowD6OA IsPWs9hOW2wsqeSAFb2VAh4hl5mTE903oMSH7OdlvMN+1Q5eGglvKoJL9n8Ud6dnYTC+Fzfi sBGYrI3pVFxYHOkGS0a55O3aiR03Ojl6ysNZ3TFT3PDIjvEzfzlY+D6HYVo9KozD0aXCfSPc tRXDSXQxELxOnTqFUHXmzJk1a9b09orvhiBsIYEohuCFLGIc4hcubAwwdSBDrThOh194Ghyu bdsxuW/vgGl2W+nItbipYXZr2GEDuYVcudJNwQArTHrT9SAaaCet6nFKKwrLdhY3Ha6fQgiT 031JqnMBQZcWvcShPB/FXT/s4cKOqAV0y6gMiagU/KEaQnxUSYZihTRAHSdl3IAWNNJLObvG YcsRZaQRqarb0CP44UR5i6IeXnWaTeO9bI/159nAWrZqIxsaYf2DbGiY9Q+wMjpcKLgxmwMu r84wIzM1yWam2cQEGzvJTh5i42fZDLaRwzsovaw8aLQfeUeE2gzntmI8lXrI8S8N/KsZejK8 X3oDItuSahFbWbLkyiumOhtXgh2PKFO6CWklHB69cWr8I325n+RijWB4uM4kYhFjYfgoFAqV SuXYsWOjo6Ovvvrqrl27ENeQPnHixPLly4eHRdAkFMLc6dOnEdfQd1PCMNc9XS7s0dl2E1df P7Hv+YxAFnec1SbtEfMsC7Bty835YJnsq6L9WAytWYYZMdT5cqfnQPXQdDC7jOEjFTSSiPjR 4/EDX8QKt//ewTsfmH2K2gcUxk2OWJYuhYsaZcDQZXnO2VHwD1UCF5YKy5Q/QhsjQEvGKW5J rDMkS2cjSfjQT5RZkhSCxzh25eceNoEoyzCZYlbrloAZXTD0lRCGzhxhc9Os7rFtV7Mb7mXb LmXDI2z1GrZiFRscYPkCwwqmQpGV8Dl4I4SZunyPVaqsVhMdukpFRLRTCGcn2elTbP8+9uTD bP8eVplhfQNs+WbmFlCHYb/PFNJymgqO9UIrWLCOB48EIpAt0nHdNZ3Pc4urqDWzEJLqwR3i 7mgEsnLhIYZ3sdhKLaNfHsgiYOEXUVKHqnI57Lht3rwZqKEhbAweHZDP2Vgx93CD4WFEnZba eSX8cEkaph0YZnbxWtKAwy4psiI6753HE5pe6OOl/bXDp2vjK3Kj/W4fAU2D4CKEMxfv4RRX rHNHT9bH8Q4AQl5XxgWmok7SeJMKlVjO5daXqi9XGfrW8I8Ydy/pYQ8tG3fB2g06KoKGpQI7 QsjpQHwkbT0eO8tbSrsyI/dgYh5tqF5hR55nyzawW97O1q1nl13BtmxlK1eJ/he6XZjnwqAy nLaXUU/PQVjtD3AEuFJJ/AEl/ny2fiNDdMPDtekpdvwYO3iAnTzOnn+WPf4dduIQ60UvDxNc XMy+dXTALyj+ch5sdNhhj2ufSHBSom1xnELf87RHQ7eD7NoFPLCrVmednJ98ZBnXHuaCAA9G I72AOsFz1erjDr8OPbtUltaB1WqlOvtYf2536ywW5Y5dU2gL4m04uDhmZkSo3ReBLGIE6lmf 9TnBJjwywrIDzHibtO2mgx5e2OMdfXn+0BAfuLS3T8Rr3UqlMFHxeAEzqO2Zfnmvd2RY3I1z iGXtaloUemmbU3bdTUW86BHgWR7mM8V0XxsH+U9WSCeuBM9Ce2TtqgW9xwK8ndOPycqFHJjJ mp8R4SbvsuvvYldcx3Zdy1asZGvXsOFRhhs7umBoDda1D42AUCuJtxVhiyYGSmAxLyZNRLpU Zj19bHQZw/TNJetFR2/vM6KzdhZ3eIcVsaq7zaqTgukHS4IHmV8Xj74W5cCC/m1bsM9Ih0e9 NotLqxVmzBoNlD7F/URYr+MDUvew3M5WhDSgyeeO5PJ/HY+TDchTUD193qo188cOYy12eHTo c/jDxSwvfXNVyerwjIjKMUN7tHLsiDuyvXezHcUwkcw5ZtAm6lNPzO7OYZSJu0OHdndoYnM2 dBexZ6w579ycp5sUCw1k1u03YRr5m371xRD0Ma9P3k8AartGwIC/2hy+GyjGjKvXsnd+H7vm OtELQ2cqvpVCaI95HSbjl2l0FiWGpYOD4g8EW7awXVey555hTz/GnnmUnR6TxmCkmRY3TeGJ NBUfz3D7mRi+pXpDey3BnQCYpIZb16+by+c7v2343pFAPFBr2lSC2YmP9zifkFP7MdsKztfn 5j424/1uL/qwnR7V6mR99i963G92KiDk27B5+hjewhaH4aMQ2dqJ/Iz7Dj5Y2akMrUn0/AN8 xbn8avW1Prd0i3+9eD8pfkDJlDf9WvXwQ7PP4skA1n6cF4NK00iEdHijhKsrNE07xmyVJkd3 09g+vpHAxle9xamDgC4DEZAGAuLBDG4o6H6iv2Sxt5cdP8ju+QF2813sLTex7dvVYot4rwoS dQFgHNmHVRQigT+sqJA6xQwQjMH8PXXECCizMil+dNmQLvWwDZvY+g3shpvZ7mfZl/4n+9rf ssGNYgGaqkXN10oCbOghYEUB9hlNjxahq2IeS9SbrskQownWretwDxwy3uFH5T6+9tVlFg1d trnJj5Wd35CUJobStVLur2Yqg7P8N3p6Olk6gSeYlem/GCj+kXzonZTfBmQNvKFd0wJfzOmo YOQxAYQBKqYsCi1OHjZRg6nWYd67t/raPPfvrRzbUt6Ixoq2aLIdnj/66OQz++onL8utwKzl eRfIOMdui2wUezCFF5rlYxHg5GVGcI2lQuosFVmX3IKbDtFpEKPpp184mqjrCdzZtzG2AqtA 1SPL9lRgGqs2y86+xv7Nz7AP/YzohfX2iFYlpj1k8XXkMuWOj4kHkZMTbBpPM6fE00kss6zV WU0+XMMgFDGomGdYntTXL7p1/f1s2XI2MhrFQVMsxUEoXbGC3XYH275DPE/47B8xt5cNrmb1 2AJO04pkmioMe5ONOMFWOYHYSs0l5TSGrF4VPUNsTJmK7S3u4RxfWsKamayjXp3+z2XnTzi9 spFGxdls3j3rFnALa+/Aco167TWn9pv9ha9w8cR7oQeGlgsVgbaGLy2vcQL0QRBSFnxABOJA PfBP1ce/O/kkApkZxZCu+tX91defnN+9wRlE77gLKhdssyUAy3ad3pwz6vjTsn+Alr20VkaB jC6qyD47H2FSUplGmwjRZcD0yTAWTzFeFHHHxKZItUGYucfzRDwuvPYd7Cc+zDZujJ4/IqxY B/Wh8PvaQfbxP2AvP8OOHWRH8I4HemRYXCY/AJOXBtTlmjKEWAhBwBpy2JohdtmN7N/9Itu8 TUy3QYgZyESavIO+ZZGtu4T92E+x/S+zg6+wySkRDeXadMucBlk8s+hhwTKxkb+4sWi/ZHnH gls35xCriThbvnxBgcxl93HnVxhbm1oE3ztVn/3DAvsfcr/nVBIBrNTvqOd+opg68M9gEutm 668W2UcLwcMO32c+Cc3gaAk8shx3Gqo+8hGlQ5AQIcEhNCFSVD7c2e+IdlLCHTRB0REAq2GX s76aV/vc9AM39l+9ubwB76NAklzLgFWM2PloYJkzso8dK/MCPpfYJbUd2ZrBxMsOH8ANS75G hWGXfWiIsD2WsSkz88SVWvYokGVyJxDaiASmOQBDSwxR8NfJEyxM8E9PsEKZXXU9W4nHhRiX Z9tCKDxwfH43++5jbHZMRMAybqbSD+DDH5UeIQwwYMQhPwc/Psu+8yi7+Sm2fKXooDXVgu7b ldexU2Ns30G2ZUBM/Kc6m1DamnoAAEAASURBVDQkfvFEAQ7B6BKBDHzZRUpwtgCAQLxl2QJh Jgn6WRPjL/cM7LTelySGIJjmweOcN3mL03euK5bfQizoY83OnC7nv+E6E5X6ZdgOiPFBeiqK Ff9YFlvMP1/Kv+rWvp4Lduc4nlEuyH6rYANDuJku7IBP0XxLcopkYZI0N+5GLtaVBmzOn3ts 5tmVxRVYh4GWQHcpdMrWFJbvLG/7zrx4Ykv9NesGpkWdk4R4HoHlhniGC+vEjT+8zpbMGDuQ 0VVkXYbdurQgliaNMTGea+taJ3+gRzZTYX6B7byc9Yi14OJoEGWAxaKwZ59hr77GBvvYhkvY EC6J7AZA5cRC2clp9vKr7Okn2U23iDFmlgqCo4uHYHfZ5eyRx9nJCbY9F45YpXWt/CCQyUnD DjzSiviFBjLoKLjf5OyteB0jqc9xV/i5H2Le/UmUhmDzDJb/ASxtRZyqVmd4/VOl4Cuut4/7 cwUf2yaMsKCPe2LUGQRYfFzL+Sd47XSeHRbXQ7ePvv4oLHYoHv0hzAQhlmG+37pUFmYtYpnr ew9NP3VL//W9Tk+OuyqQsVWFFVf07RiY7K/5HjbPheVd1bwwu2EKDMJSLuyxpy9yJZKcvNjW 2uvIlPamZ2lYe9YJavR7UFg8YqC1Bu21JBE44KwCG13OMt5hDu2mwSC6Y+Nn2NOPs+3rRb1X 51oa9GGAWcYW7FvZnufE2rG168Ro0RpdJt0zPCzIcCQHuUliBaHi4y4Gb+TxuiW2Hleo2DnV z3py377cNXXYhByMoxd2lNzPV2sf4M6tydVknGO/vx+anfxuT/7TWUo8/sFyz81zcydc/7M5 78Ec/wZ3xeviqBOXn8TtKeVYqMkpIgmEvcmQkK4h/2QuKCP6kMiUhw43VRiuHtiZQmFSt5rG ujB0tQo8d//87qvHv/29y965Ij8qdg2UzyiHc4NXONt/cdkH/8OpTy5nRbGXvx5FtKphceio +PADvEEzI1IPNc+2lolISaLiZY+uDWvBKMbhS3mEpcaNpuOWCk6s48/iB5z+UCqszn/tdfaN 74rHTBiWire+WziEZKzUybNvP8peeVVMe+HQYgU27UDQXMBSMqq9NLldgPV2tiWs0EzVhdPx euW7npc+14a9fILCb1lbXGi7fb8wMf7w5Onfydd/Ie//xzz/PGcyimmKCzSBqy2jLXRcILRd zLrtdFd8Zuprj03vPjKPT1eL95NoLFl0itgC+z8M/0jNyZ0MZrGnYceK3niM2YEMlWTWE2Wt 37g/0OrpLw6OcsBCH77BjAEmBRVTQ0SXlaKVE5V59vohMWFPIzsdtogLQPyhv4YZdzymfP45 Ec6EWWR6lmgTLikhBLHpwH6xlB+ixHYaUjJ+6dChjSCHDzG5KY1Y2dryQcWHKzBYqWb35ch0 /av040mR+BPVJEcgRKAqQdnJeK2aXcstm1pw/r5efQYTWEkOvB3Z27eu7vxmEiUgeCu+/wuD pd/Isb/DVHA6zdJCQ9dYDlU2iMZi/CmwcUZbwEoZvOUv1mHELxODqrMkjMK7R4Ug+NrkQ1+e /BZeJsd8v7o5B1hi9rahW39k4J51+ZUH/DF03yjGdaarO1zkRvgB3oBbpEt0iBfZeMQn32rV pquRtg6L2MKa2fShZVKi4oHVCzpwE0FcmWdOjQV4Fag9WQgovVjy6rI9z7L3vIcNxBcE4BrD H8LczIx8o+g4e/0ge+ibbPWo0CKCYMvaRJDy2LpV7IXn2LdHxNINvLcs3jbvES9sFgvR01IS iVj54h42O8FWDIvw17oiyY6wjq4OFgVQvEGoaFNASrkiCQiR2JC3wyMSk3eeqdbu87yrsVFr mjAHu2DPj7+zlPuqhXV4pVhI78pZlBdGFi7BuBIPDLAZFCb0og2KumM+xGPkikeTr1Ren/er W4vrbx+4EZNlJB1hazQ//Nb+G7AvlTPjvF49tszpQaSI6iluBYW5bHycuuMctS94Y14aglt7 wiAiSYA7VhkxQjL+lrp3igrBTgho1508OsLYbQCrxjjb+xwbO82w9wsmpBB0AEf4QDRBFDtz hp04wo6dYPteYodfZ3ueZmuWiyjW1gNryERzWreSHdrPvu2zE8fZlh1s7Uq2DMvW+hlNhyGe 4rEpTdVNjItANj/F1oy2OoCNKkI8k4ND4BaqEgPTSTLZVubVRzc6EWfwFN37qpW3O85tyZky UKFvOM8/63j3FtzHDKbzLjk9teA2jxsOlnDgou2kETd3CG65eZ6b8Kderx9/aOKJXX07Vrjh GxEISYhNWGh2uz+P715+snrYC/DcTMz9q+XdkXyYSY1BhjPRphfvwNDARxcVwR1qYM2SH+k9 ssiMsPQLcgIxUwERyMZYMImF4JSPNLWQQsDCi8fYV+fBB9m3vsne+S7htdlpNj4uXuc+eFBu U7GX7b6fveqJJ2x4Url8eweRJTQFo1e3yF54in3nS+wIY5sZu+xWtmI927SVbdkmFvfjBSn0 CrHQ7MFvs289KN7kXbeu3UeW0FUL+FTgnAmwCke4SvbNhQkiYx9EYEMb5MFwdmLBl65UkONP e95f1Go7XDfaykKrxmzO0NDw+Njfcf796L5p+PmWmJ5s0xvxahAXKQSgBY8FfM4LMJfa7QMq alhW5gzMBtW/nX1w5anRD674/j7ZEUacwB+Gtlf0XoYvxfWwwkcm/nElK/dhXWZ8q0VENzSk SoBpBacoOnT4aOZirqRFJ2zWY1MykIXdR8svcT9qJIH1jI2GGwkdGENahdISQdBmpSoRHZ9R 7QcYw0WL7wFCCEzRVrYkE9P8WIK/bQv71EfZN74iVleMnWEPP8s8n436YtPEvlVs5ZVsFRaZ yiGa+F3YgcX6Q2vYFuzWUhcrxTAX9sA/sZNoHg7btI5t3yReBnj1RbZutYBgK452Dio+xtpn A/48YzfK+tDV046kRrRnJ7p2sRWdvw+cW3z/Q/hCW6rK4ZFNE2f/ojf4sRzfk0pwzoGTZ9Mt b8MwXKhnMKj0OS5dcQV2vcbERYG3xLHh1HZ39CNn/6nH6b2p/6pt5c3oW0GZjBb44Envj678 3oFc/x9P/M/99bFNfEhM/8uOF/p0Y/5MhXubcivng+qZ+hTWfA+7/XiTjEJhG4VtjRRB05+u +8ewKYhcTNTGRHFrCppR2T2yLtZJqii0AfhyXkyTdXqg6eDRM25L+1+RYTBgW9cLWVimjy62 2CZMNAPVvFKtaF21bDZoV6IBoIawe0qelXrZsAy/2Hjj+NGwGYtNsVOmBlrRVJeThtjWCcFS yg2ZdDosg87HhYbY8BTdGTTg6PFos4c4awe5eb/y6fn5y8p9t2ZtGzs4dPXUxCfKwYflNyi1 Fem6fOzGBpMxKmWxL4+kU3cDeuJYiWzS7rSyzZW4aIIex4ztHKY3F+uAVfhzAmx4NfCXk189 VD/9rtrsNQOXw2wyGC0S2/zfOXiT7zh75195YPqxml/DVyfmxNbG7C3FbTcPXLupuL7iV45V jz84+cRjtX14Nb0s5phd9M66bDeGlhWP4ROtmEGNB3eyNlIn85bzVZlApTERR3ZKyAID4nuL PbKkdNu8bGUxjBTE0Qdpr+sSkyGNR+DAK5PoBOGtFwwhcYhZMHm/EfP6HZpn60FeSJWShbvo CybYnVGWAw8oq/gUQJ31lNqbg4urwdwCJshwyLmMOE7kWi1LFt3RYxh3dO1w2cOO91+mpz4x MLg2S2j/4C0T43/Ww3467+Bmk3XPKtb9jdP1T/k+7y09mg9+z+FnsgR2EX7S8AY8ZrfsLCdq SkWAZRFsvtvhIKWcWCtcfM0be6lycEVuaGPPJUO52A63I/mhq8rbyk7+9erxo7XjOUQSxy26 PVf1XHptedeqwvJaUFvpDk/Wp4/MTXr1OSzm8II6Vt7KO3OKvg5BEIewjhUJcKjt07ZFagHK 2c0ltBjImgtqkQI1DytPB85p8dUF7Jzf6YHggsX9FGKwr2EXI1emRagr490j3HZgPd6CLhY7 XkFGxcfEwglfrKPFjRS/XT8OHEx9zti5nnLuS47/q573Zy725s04BodvHDvzL4PlTzreJ7Ct qx2Oeb/v/tTk3G+MjNI09m1nTr9nuHCng635Wg7cGZqbgA8Z3uiw+dF0BZYanMandVu/1poY loqGKjzMWs9H9ldfe7H++nJ36O3Dt+OrvWh88qYt5v63ljddUlyzvbDhvvEHJrzpDcW1O8pb ru6/nD70C7HL86NbejbtOLvpnya/fqB29Iw3tYxhH1ohG9Z3pwBV3z8lL0NY1B2Jqf7IBLqX rF5vIlG18k+McYw/JK3DQJqEIZXAwsX0Z3FC9AjDd3WCa/E5OAvXVhbzX6iIpQhhGWaJVgAD qF1n0DQEw01g3u27j3juKcZjt9pECxNVYhyytaA1x6FpXHPz7ve//0RPuZvdh5xznPFlPHet YZGdLPcMOfm7at5W5j/mcFoEK63lg3X+v01WfmVkJHrnqVweOTvzg0Xns1x8KXARjz//2Obq vHjMh8P0HbkSEPpLWhARI1XhAYLJoOPfMCBuPhEuydcdCN6fKAXu52YeWsl61xRW9LhlXFyy CCKiYVvD0fzIjQPXYqR5Vd/OtcXVgKDzBRJxheDJJs9tLF/ylt4rryvv5F7969XdPUEBNNg7 FFfRgsyXxQ+mvOr948HZKr6QJuwyYhlyUn4UDVLUKZCMGE09ZkjHYpgA3UtuB7IMGUpPBjoB bkQvn2lw1MONrodSw6hG1AnRbxgAFXw24I97uYe9HBbEZnZvqMwpbkoB2f6RJFdfOblxPY1f bXyn+Vnmv1rzNrv5rQ0lOE5u29Tcu3J8r8MPEqXHrpvxPjo4uBwPOjUv0qXy0NmZ9xWdz8td gxZ0j9NirQT2hv38Z9YBSIoj9RKSBJrsJjFex+HYUQ+9mtv7xbb9OBa/HWNqbpAV75t/2vcq A04PFpRhhIhohRWzuP4RsCi0IUFmE1yEBvmSE+65Jbc4Whi+snfHdnfdkfqxaX9uPqiUOGaX QxazvC2lwYdX3bGh2lilet+ZoIKRBVmR5I75z0ZHyChl02Tkw0C2fvV6sDbjboa3dWTSA4Fq R+8D5b3T8fB1S7BmUtti32h5FHwscB7wnW/57oCcI6USpjerFDelgGwfSZLhofotHX1m3JZm 5Dk7w/1n6/56N7/dANtJzt1CcdTj7/Dx6De4z+c3zgZ/09e/NvmsANdbsYR+2TsKzr84vPOv pdgWGPnHHhp99EGxQJocp391QtMSRGaRFH/yAg3TYk0s5kXGmf+2gWBAbniNOjN4tJzuJhC5 sDIDAQjPNLF0azQ/lMO7d+qgECIiV2itQgjTBAwGYulj2Sn1uuWSg51m3Vl/btav5MSUWYcH vokiVoscqlT/4azYwgXZ9CMLHqc27m1xBOVSzEQgw5/ahMLWYuXtzmdyRKO02owKHp5hCGae j+I34Md9vt4VD4RlK7EI3/hZcQvlYn77YOAcwD4tcllsSkXJJ+7CHRYumouwfE6u09QC++TT 8bcgiGShv5gZ2M28X/YqU27xhxsIQ8wqFNf4/k8ydpfD+3uDlChG7KAcHNo1efazA7kfdZ1D DWR2htr9VKYfUp0ILSlwuLYgl/8d8p2TVXyjNxBDVe3wzkxrzgUFqPPVTv9rtWOV6fnTtZOO 6+wobe5ze2nzssYitIkIaZhTu9fpG3WHZr25b9X3rBMbiXU6R4MeGVblnqgEBzyOjzxCTftz LdrJ7TpRMIJH7i7YuPhdxpKhiP9YA3xAfIyO7h5d1nJBiBM3ScaO+bmJAPtT6KpcFNtfPdgz Nt5k5NqR4sAJXnBqv1ud+2pTdvFuk7MTF1GyL2by4rWB/sGbJuufqfuNOnomS4tpXKlPPzZk Erd72Ri8qC8M2Dz++rz4tPICBBkymycRImpBfZ0zOOPN3D/71MeO/+UTU3sm6/hKuXixXEyK NTxEr0y2OuzjOJgf2FRct6a47nn/rHzNt9MWiDm2Ob9+tCoe3DfpTzU0bmFId4McWkKIqBnz j0ocSo9hRBVKysaqrcrVWSSweg2vF6EzdneuJnvGkPemO3APxLzYF2q5l3yx2z86qnYzzPCK 9qTpMgE06GWXWdaSAm7dPLtty6LMo3N2kvu7vWBl3d+S+vaSaWcraUS6fGHt1OymQm63g3mI Lh37X+r7wmfXKn+ErT0pmwhMMkETv9MAKyZF8mJ+yLumTyzHyRxSJTUsFIINf4pOvp+Xznoz X5591K/P17z5lYXlBblKmcJq7PJNKMT0GYQ8P7vvialnPX+qR0zPpjarBKcFwExmNfCPVqr3 nxbb1mLOO/NIRwlPmixthkLw0tDSxRyZKSdKx8RH4IWn4DBsioiZ58eY831OMCh7IwAumsKF m9xlCSis+OP8oJf7g3r+9cBZnoxi0NmuR1LpFXB2zn33O7oWFCyPcHaC+08y/7mpubeWsM3k gg/EMje3yeFTTvC4fLNxwRIZ+8LfrX1xN8ZQ4UEJKwtcBlwTCnaRwTWM+f7H68FtPcGQi/37 sSVG21UmhHVyIFqhCRW42xPkH63ue2Ru74m5I8vckaH8AJ5FUhQTnzGXVltBDd03h/MDs69/ Zea735h7QizFQKeiAysgPu94J+brL8xWPz+BL48IdZmCYg7M1NZpIAufDUGJ+SfUiEvN+EvT rFkSSM2ZwEiALBNeMOSv+Ji8BCh+v0tnekNB0R3DDeyAz8ew94l8ACLcED+aOFETx6uBuDRS J554aujkKUztLNbB2Su54NMF/99OT+6mic8FaioUCm7+cnxufIFyiB2jroe+Hq32iGS26uWI I0zB7XiOiFftDlf4ePYGeQm+7gFEk4EJhYDXvcruyv7PTHz5wYnH9s2+erY2IWZg45r0ABjx Bt/6fXr2+SOVY+KFzDZjR0wqFvSfrKJHxqAQT/GERUt3mAVs8pA7fo10zUSIhWI87NkbOFjl v3Q3sq6VYOGCOLZOwKCyLrZ8DGvEvqZ03krElRMyDotyuNXSH1Zufvl+8T7Qoh7l3D/mvV/y K5+dnV3o1mPY2t+vv4x33rti8JOPDZ88Kb94Yzb/VkSn+lcD8wHHV9xO18RM2ZIfmJ7CCBE7 +Qw6heP10/809a2vTjz4yPQzL8+/NuFNVgJ8Az2crhCtQNxe5B/3T9bOPD777InqSXzIGuGn c9PrgXdkHn/yswrterZtf0GBpUNDsoeWlhZLgIVtM4ulmYhiyznbHfA7XA9fWcAMEbzZVSVt 2rRU5FRMtK/Xfee/VYtYw4Pi27NjjY2x3GRls3gxlXWq+IPfe2whN+As2SY857zK/e/Ua0dr 3gjjKzueNZufP+3UP+owvE3fhePPP77pyOs9cJX2FiWsLDRlwDWhMEZkUJH4G3Gcg/VgIM/W F8WHx+nNFUGydIdcF856eGEZ79tdP/Ddud3fmHn0zNypOWwxAwthJhcbZiCBqDfnz79WOfxn J/7+kcpe9Mt6eQnAtm2VYvHCnneqVv38Gf/lebYMYwzpkExZMQdmU7VGpvhBTevIokUoCiXO Wpg0WEJ0StLFcwaDKI38l2T0k9rhwmvf6Io+EfDHvFyJ1Xdg8vHNdOBV08fq+UcZ38bx3XV5 P2tWfBoq2J4HlwbpaouJUuiAHXyt/PBjw11fUBbTJjOYMuvJfbxafypg/6bq3eGzyzFObPyw 0hIS+Idy/v9w2JMWvLPs0cOlR76DKZzwWtN+0okUsZHbQiQR2yz4tvbeurN31r/UDVbT1Zwi bAlAMh75q50hdLuwHOLLc4/81ey3trrLtubXrMut2Fy4ZMDpO1MfO+ad/u78cyfr4/gkMK7z Bb09jl1y90x6T1f8k3W+Mye2mTx3R8s9ssYm2tVrUaejUW40g+kAsyD+Jsd/M6zyR5HhC2z+ cSxwPlnFxqm8LCYpolhkOS6WTfeiQdKUgLETp4rve9dJg2cRk1gI5rJ/Dbw98/NznNf8AB+X zbUSzgL/cDD/Ozn/o1x8Ia8Lx199YuO+F8TX1eigRItZzWRxhXDUKCYe8XnaSeZd2yNW+dPl rKUr/iU8i1tekeFTmOKdg7P+1MH6se9UX/zi3NN7q/tfqx3Fg1bs4oKlb2Rp24aBTayb48FY tfIPJ4PJGsO7vFiI0ERcax5pc7wAoY16ZG2XLaMQqX0x6kKg1PgbZMH+wDnInHHG+8RbFoC1 VuD2TTxfOHB1Buy477wUOP0obdMG0A27dRt76rmBJ54evP6aRVk3n2ppjj88UHg48FbPVn6a uzfmelfjZQAfy+FdF0HNmmmu1So551lW+bjj/XWqtA6A2LfnX7+0MotRewYEnbQ8DMt68Hqo zw5WndM1r0+s8pevq2QpXFw4LiEqCLbzRy8BS+6xt+K8XzvF5s9gyowXB3hhhONDc7kF9cWg A188P1UN9lexkhAeyAgAi1tYU7pa2a9hnVSmZg4TJMNsIiaFCS9jwjtwHvFyl+Hz3k5FjuSB 74YRpsrzJS2Khg009nu5B6q5FwJ+HZ5dpk2QmS6C7WHWgiacFM7ZJuCx0gfs45/c8Bd/8lyb d76YjA4ynB3rzf22YJwbrNU/PFvZmcuv7e9fxl1MEg7hQy+MTfm+Nzvx+GDx57q13oLs/Ns/ v6TewlcLLO/qMqq1C7oShH8jHwNcwFo33zlVdR6e8tcU8X625j1XCRiFfTnQbmB8Cd+Oc8rL +AAuLsymiecD6JKJybzOD5QwwAcFHp7099bZRkfM8mLpyRIcpCRyMKVEGE2fI1sCk0gFpoou 48GBwPmruns9d9fhHViJiExdMlMWXxGKhnId99yv192/93LXilc7VJBafO1aw54X+v/5vpXf 854TGrKkiWCi7P4+fQI03KnMuQcvODB/Lx5kD7a3cxrc2eT62fdi3/1fCbtj5P/uFxbPK4fE i9O5T58Nru/zNpZEaEPVngeNWI5xYBrCV5fKjWLluT9Rrx+Yr39xnO2QfY9F3suoFdPlYNe6 w6DMyT8pTINJdJTFqNz4U58pkx3OiCiUqszCIjy8VMHxzeZpn+/x3P+vnkdcQ+2fBw1A2djV M112/1LLPVrPncbeIwnhhqsEzspa5Oh/0Z8F114mdvIo7sz0R8Qf++SGieZb18PApI22tk7z GH5hAkcc3P86ohil2/nFkKaJebiC//SjW8KOqhQNn+jDTEsgNT31GzqshcYIQTCEc+d43b1v jJ+onidRTJe0mwlc0xivvjxbe2AsmPLlZFnTu0nb+sWCrPifbtWpslBJ7oZV61NxNrCFCrVZ 6BrSUFtCmMckA+23+qTvXsGDZTwoyABok2s5F2ACZURrx+5QT9fzv10rHA/4CjliSVxL0mXZ BUyhB3Gqp1KBSvJ8xZ2azt9xC/Y7bHBAW7rCBjyto2Qlt06epBR3ziTUhHzx86u//M+ryBP4 tRKg1BDJFY6248DIuwQnJpU2tAHUx53nqmxNDjsZBkP5N2A4Q3ApOPW907UvT9a/PJXdiA23 RMkUn0VInWplyiOSJKjFZD8iqpZgJqgJN2kmJkNGmuQkkNAe2YKLHI998Icvkjzuu6fx8dNm DTQh8AIAoJh4AveU554M4HbxnAe/5+IInf+FL63ErP+5MGCJdGLJxac/sbGLyjIas9RAl0qZ 8ynfeXGeH66yqtjU8I3TkKnwuHVUfO+lOf/wfDDjiTcrqeBd9HKnotz13euRtVgoi4yqG3N1 /Zw95Ds7nWANx2MQMSCIol2nxTsf+BCwUBBsXP+y5/52tYjggVdNAbT8EJqaXmZA0xFRARVe iw15FDyilCn497GnhrAUo1g8RxHVMqirWc/j/+nf7zp+VLz1qR1ACSsr1YphpKbUBARRWZzF X5hVXlZ5KQY/g5y/VBVzZGvzwWgh3AhbiVBEF+YZPnK499pc5f896Y/X+DL5Sdk2itLYC8K3 Rl01lBtJinpk3QxkDZU3QlKrQCybFuvd3TILNjs+xpsUAhpxnvc4FAGd3pmAv+C7/3WudIQ7 iGKAZAaPqJLMsqVDTYroelXQkCebdWbWfeVA7733nLKvRiXhwj1/6o83PfRNLE8Vh+kApHXW SIikRmm45I7o07MmNdpxnjPs+Xu6xg/N+9f0sh45Dwi4SUaCLqBf2O+KpxnBqcrsnx4NXq+I 6U0E6/DJXIslaeyCxti4iojWCGSYIwM8QkkWglhAgUkBxXWk5ShOpWEEjLD4xbWN94OxKGE8 cPBhh6tdD+4ibEdqsxQuHRzGU8z651rxi/X8Pwa5jaKYYh7TuHBMe+SMfAqWHBBykU+UBC6W PxJeSgqJlOsIpVhMXSJ96DCGQ/y6q5duWZltwSLkH/jacgQyCCavaN9QQrsihAuXiw4ZsppS 82rrNEonNCpMEAKrGvocNuY7r9RZoR7sxCd0edgIMjltSedXHv7CdYj3Bo5X5r94OvjqdDDi iuWvYm+Nto6s8gOehcqQH5GHgQzfHWh5sp9kRiIydEhwmyWMREE8ePEtejzU28KDVY6PQEDA 1jRHos5tijxANj/n5T9Tyz2LrVMYxwpY6otlFCcBDgEJuCieAqpzepEbYzFt9+zgJWvnt21Z 6Dve6dqXHPri3v7f/vXLvHpUbF0XGkQJIyuSCWBoehbcLpkWJxYCCHHOaY9tKvqDOdF5wQE7 NI3IXwhHaDP3Dsx5u2dq/zLBfT8odlacrMJnwbP9E3HEe2RJDqr7JLxpTWQypsgKQSYL7mf4 ktAE46+LL5Pyy3I+Jstk77yp5mwF5w6DmIWp/c9UC1/xcmcCZxMPsOMFaiGqCNu2FIz0j4Kr s+RTGXW2hVE+HQso/Qmihx4ZuWLn1Lo1WR+gTBd8HkIPHuj51V+6fHY6XB2pix4rrfK/gRVJ yhrAsHwWXJdaU9p0qHXMghc534+dTfxgJT4Y6LAyZpSUDi3igkhgBDlWr90/Xn90xn9mnq2T 72CllcW8kNNKZjtM0WTBFT55jjiMQNbiZL9lpZUNdUUKBMCisbIRgUbI7j0udXRb8PdPgbvC 5xscv1fGMjSPuPhQ53l4QoHI1PGAf65S/G/1AvZNXM3FfH+iCACkjDSVSwQ2xhTyx4FEE6Js t0f+UQQRRKXwidxvfHvZtVdNrlqJlXwX6nHkcOnf/8IV42PRnmu6xDqBsiFtZmVpQ4CJ0jQ6 QX7RWZ0I/aXzSFCve5XjfHOO53yx8HkD9su5oCZ9qQmi71ULKl87U/v0uP9ylV2eY/h2JTkx LHZ2e1ME6mw6SKfBHqUVZbNzxNF+IGsm2y5eU/oUAmUf+mUYf29i7B9818F8me9skfNl1DwU VYqA8wEEI1H7KMIx3/mbSunXvMIuFuDawjs4XTgaFL4BihQ3JKjX+f3fXHb5rqm1qy/IWHbo tfIv/R9Xjp0WUcwsKKVTfzWZvIGGAc4AhtWlIZYXLXiKVjQCfF7yiQrfWwn6WbC1R0wt4dA3 ulDD+XeChWKXWY6vVVbuO13/w9P4Ei3HrRi9jM4P22FKUhZc4ZPniCM7kFEg1ryNsxEZREfS FVgxi9lo4yCw+KUU8WJJiqIXtHh5izOsZXzIzz0aiHC2zfFo3axmMkSe+ySsoj/MkEwEHLP7 n6sVPulhh1NRLEQ3MruxoY1pBNbwpE0coZRDLWWSQONUAk0h/KvXnfu/uXzzxtmNG7r7BUzL ju5nX3yh/1f+z8vRF5NFjJykszoRd6GwRKLE9UA0CiJQ5qGxBAwZiM1kNnmQRsUPOlgY6X4D U5A1tjoflFyxQ8b58QKTZWyYlate2UzdOzQ3/w+n6n8yzjZwucNHkjyl5HazVAOOBFxLs1wr 4NnEkiviEPVAC2JbXn6h9SYS0GqFKpskUmxjRD4bi9kxhDPc2E6JF3r4Su6je44dLRsySfS5 +MENDNvwT/r8y7XCF+ruHt9Bc8UW8bC/48Ou0WxfGW7MIJLgDFxoIJZfff3/b+874Owo7vvf vv7u3en6naTTFd2ddCqn3lGhiKIAQoCAODI24AA2YByST2wHg3Fi83ecxLFJHIODHYNo4o+Q RLFpohgJUEcSQr3X0zVde+9ef5vv7OzOzs7uKyedhHC0d5+3v/n9vr8ys7OzM7Ozux+W+HOS Y0b3nHbM51jxo1XFjzw4MqDMi9HcsTxmnTQ0ZCx+Xp3ZpFIhyVQsCDrFG7dJmPvHRBk089CW KfPlFugvlIXY8I8PqvTE4xt7Ep8G4mt65WhSwgpP8FEX8dvnLaNORoDJpa7Rrw0Z8aObNnk9 AymaAHy2Fle1z212fDOt2i6jU4YpM7yyA5cNZVlxesdWwfQ/Tw0mYZPwfp5dcefimGd10tFO XppoOS+WIQKLxgu5pP9pVPWS0CkDXGGnkOlANMZrNxSeaPLOmNrhxHOw5/GGlU2Lf1/1n7+s R1+Shklzx/IoJIEBx0pKeAKfGaR8JmV8SmT+RfVFW5YnSdtithD6ZpJUiAeYlNeb09IVTGe2 eHYQCIb+47Phe0PxlZ3xT3vlg1FpqEMfUJxOqAYdq/pkAGSVN10ji4bMyqXohWLMSJUDf/Rf 06ODRw5PxFyS4LgkkWJUjmqAyfJdNunZhLM16aiQpQoHPg1LFYHRq6Dm5xztWai4YKG6kpfz xDz3RzwtiNBmG6h8KYrEx29impeloLN9DoQUF/m3cqHJOBdWMCbet9+/ek3RhHHdhQVnNC/C DPY70d7mfuThkW+/Qd5sIWSFOy7ELZNSgkhBMS4hlYTI1HSNfMI1bZwxVabGQHWRwDV5iEM6 Ebd/Gpa29uIpRXmQh/TLcCai6mAzm1Atnf2dEiveaYFywBcqY2s7Iv9yUj4cxi0KaZADH6BV 82IaeDF+2hAzZowAsjOl+dFNpmjI+mZOM5tyr/tLBUmPUKWICtWgSF0ua38z4exOOAc5EgXK 55UBomGnt5UqgtPjM4+kICXpWML++4jvVzH3/8TJklc8hITKidl9i5AsWJlC6KtKlvi0MAhP dbhfe7Pc602OHhkg2TyftvfeLf3BP4zGYgsalzk6xgHB0zQTlMP45BCaYAKGAxMb6ZN6UfE4 VAh8EdyP2YeE/ErQEQjLpW48g01W/6NDSZszs2ndVn9TrBI7JclhTzRFYuu7Yiva4v/abitD qJjEUWb3+SzwdLbhZNTJCDB50jXIgcPnJPH0sjRr/GwAaaaUX0qKygKXTzKaEUxZ4NAku+Eq vIyL8ak60wWBcOk/Djc+Ud4r2cqkxN+54o32ZKU9mU/6Q3oWKJLF0F8EiwcG4QJbWJZaZfvm hH1xzLUj6XDINjzaR7+iosj78MNPMvKOiAnqTMsgMyrCNAFvSuGlACpmNduasnFPpSMbAg/+ /d6GYf3z1mmjhz6njh/3/uo/a9euKSKxaTWG5UIlzHylDNi8FIWxsQB6IsyCYBN8XcQFy3RV niWIw6skjQD1Ht1cTEJWueXJPnlajjzKTz5fAqOIE8/94DdLg2YX2XCofQxyAcYbGrpjsV3B 2GudclM02Y3mFvWYPOwAlDqEShEMAMqm7llTrHENahSkqRDj2kZI7YipPE5q4JjqNpE6E5Ir Ljkqy6tJKtvxC8Hym9klL01BG3LIYaz5hKu4AYGVjiivJrQgNqlQxn0gKSFJPgn3tfGdGNRH FAg5PNaGOE9nQCIUMuDFc1RHZMe2hOPjmBO3VjuSJIxCJTyC6KuDLBWygWWDQXgKLD2WStva 3a/+cdDJZs+I4UG/H53jL2YLBp3PPlP500cbjhxWO2JaJvTSZtmhhJCkcYNpkhKGAGZJllue w9MEIKaZkpFAzcA/aio6O61JWw8e/MGMVBJfLLeh9tDv6sJUltaMtvuQUuzju6pyb0Juiyb3 hmMbAsktQVtHHN8Yloow2y8uIUhvHHmy2vqUjezAVih7UnIkJWnmONIjw6ZFIzSOVMikKlID q1K6MzMFDk0yB8qlR7fA+NQH02UE+KBRDbBYCOfTHlnCK/+H2uWFjvhMZwxdM3SH3ZJMb2vS 6xoybpV33Wl6Cu5okNQIpvPhtzcp4Utu6+POjUnH2qR9f9LeKMnoiOFaxi5KfXXKLjV8ZoXY VJFmOhWSmdLUUwAVO5oxDWvcC1KPO3n9/JNf/cvj5WXndK0Z7kiuWD5o6UsVPfzLIJVs0QhZ nCqh1SSdz4GRRfDJv1YwdI4spa6xTGiKXDF5viHBCyxouCXHiKwpS5LmrCsp17vleQPk0X5b ics22G3DEg04YJUJNph9KDPawjbH4pFaTsnJAwNJKRlK4Ku6yaPhxOfB+NqgbUdMbsC9VMU0 97pXqmeqUaoXzao6iaYlmdQQqGpKFfLtCZEIxSmYUgBE0zISZ5z0yNCQzSIQYkvblAD0pMLm kzxNdQSOZVJh0rypcrpjeTBocQmOVCOEFTDxSq+o8sKM3bJUI8k3ORKj7ckpzngtVpxh3AyI lm9qgf4aSlfLMdtTDJKAqUitvoeS0tGkA8tc0QV7MeHcJUu4BVEpyfjsAE5rKOI/vXHmxYLQ NFkAPMbAzLrvrOVetZRejxtc6Z61oHQOKNzKvOLS1oU3NDWOOutLNI4c8b326qA//rE81EtW MRjiUQqFchifETRieujAZITKV3YMrDx2rxrnmBRrcMqkkPG0CuWYhkNmFDMRPjdJhhhYeRhK 2nYlZLyRscppm5cnj8u1DfHa8B0T9NHwj5aFvmcCTRuULR0zF5SgPsgghf5jFozYwdvE8B4x vE0svrk7/m5APhC3BZNyg13y2fHeV9Z0sghVY0aPTMoIzaeBQc9rA0sJXwPTPX4JhDUCJqkK o3aEKq2o2khDhi7Gl7chU64uJC+o4+gNNSsjPsyXXS7Js5zxenuikDx2Lvsk8qE5fROKVhco FIfEkQ3J9vakhDc+HknYVyVcHyQl3JHExGK18lFOqgoNtZSzq2OCQzWp+bWMzsBM3yBx1oWj nl4v+4YMHqiputreq69queyStn5/sKmry/Xhh8Ur3y39bCv63CRLtHi0QlIyacU3AKDFMMqJ wqQCkX1DxiLhCSUa9YdZNhwyhlDETEQ7+yRvpCorX3Ag70vAgyB22yyPbVKOXOayDfTYyl2S 30l6cGjy6PATfSBYoYboL3Os3AhVDxFarjhpvGzhRLIlmjweSuwIyYdi8tpoEqvDqvEuZgWo 9Ej1e5OaYRa1UJG4+BmEEGp2NN65bMjwSSjpIqVHxoIjYbBCMWWJBsnAjBD4piSxyMAsw5ZZ pbo6WlOk6iw0Zo1edZBUR3YKApcurywPkHCxkeslebgjia9D4HNzXlsy10YWo2EkiGshZtbg DneZMWDEJyZ7ZTlok6I2KYQ3SsnSwYTjcFLaJ9uOyeDYMTFDO93wAHUaCQuDhs3CU3ORcWdS 4A3ytG4pfYOk4zSKns1aStiL/rV0KiW0dwqEhKY2E5Ktvi44cWLXpAld48d1nfYkWjRq3749 b9Omgi2b83fsyMPSXBqqFhFJ8TStIZRj4GuBMTyTskwJWkJDpuK10mfqfDxgCnwqzfCr6MCw ZluFo2tGpnjBRcWly11ckhzBRBVeMWqXR7jsNW68PttW5LQVO20uh81rl7B0Aw8ykHcEaYFg ri2KZov82/AR0XDC1hlLnogmT8bklphtexwfGZfz8J0DGQMZ0hnEaaCcPFiOBxM0JDEwPs8a huXRpEIY6ftWzD4jqNX0WopZ4lZoUmnQ6JFxDZlWGgTObZw/lctzeBriVElTlCowVUPGXxxY LFSHhSn4Ap900pWa0IGZ+CRpmzDoq3TIg2W5zoE7m7ZcW9InyXidBr4+5leef8SEGuzHZDxD Yuu1oedFXoqHhgy/6IUdS9rxcv1jSVwjsUkVkow3c8ALNlQ2FgALiYAUaR9+FAVmSlDMzM/G Hzt9BetKUjSgpZmSxiBoQjOBkVSM2ZwOeVh9cPiwwNChvRWDw4MGhUtKonl5KF1xCwYd7e3u 5mZPU5N3/wH//n3+Xbty0ZYBx3sUkgaRUjqUY+BzgQlSFruJTxjMiElqCJ7BeBUDgjMFPgmT 07E8pqQhozAg8QpD0CFZbiENE0lWOSSMOrGGNt9hK3DjOozvUpK3nqElIrcIYB8XN5lcyUMJ OShjLRj5DydJQ3YqJpP/hG0/vvNjw81+8npir9J04wxhfQp4VDYhPDWpxW8p5ZiENJ3saS0T YV+0tEh4o1pDNn6WakwVGnZclLyuBQ2WAGZJU95UCd+QWTZefChUh2WEGecxoAHAPz7fDYDS PJFbnHjxrDZzSnwOxB1PpZnzKCGjVaJzbQf0PJCRVpmNNHm5Sv8LZxgmwmAEZlkM1DWf5Gkh MOukopAqL5n52fhjp69VBKIBLc2UNAZRJjQTGElqmwdTDn7xoCy6aS6n7PUlIhF7LGoPhRx4 Rp0BVELLrSDgk5xzVYlKeQwEDCZIU/MJkBlJpUVdMphlkjLFX01Hy6IupxzSP+I20uKgacKd TVQ7fJ0SzVk37gnIth5ylpAanGcn3wJFk4QrM56+AB4VHvUY3bFOLOyQ5QCQis1yCW/fVps8 PCCFUwI3K9nH4bTAmHNDHOyM1mCWUo5JSHpSmw1yMCLkkn3R0iJR7StWsPyC9MhmKA0Zc8wI 5okRTASCMrmgCcOENB4fAqAwNRwen2VDxseg0rwVoxhu8I8rFqYCyHVLadpwuHEpIgeUECQS iFBh0NVyKzNfNAkpkLTloh4IlNvSJymQx6QOU8HyUIuSJBgLC0Yt6jTlr3I09ENi1OVTPE2t CRzLpMBkYegeGUshUuEtPapMUxEIRmjS7FHlU7+aEY5JSKbF8YkCTSqqSlJTpxxBymAqYRQb VVXTClP50SYNKEwdRsEC0ngoD4silEqMZkiZ/ldqJ5okbLRqYPoMTRWt6ACjQitVnC5Mgw1q FoERIm1gDElhelLJFUsygmZWDYMmiBeDDwZmhKalKXB7hmGECjaYVLPkUBoyOlTibJyXpJCf LGOkWmiz0HKxEgATNJ9tJgIS/9gYJ0tHF2B/xiVAK8zZyCBfq3na7EtGDcaNS1o7aUCoo8oj 6Ep7p1VY7NF4YcNsLgXjZFdMq82i2fSfC8f8WLBWKMYcpiholW2SGoxwUsLnkkYfSiq9VFfI DkdRDIueF6MNIRpdUwwFMFgaRWgzKY2QaekBp6cU/bNb21TrWqTKXo9Tp0igrHuiRi1IWV40 Y5RhRDFQVsTp6VL/gi4LSuOre9ZloHcsuCSJkBU+zTszwqKnVlLxGSwNwVwIGNg0mFU8qRy6 owgtPyoaScahFg1WBCcWyVTwVPxMTmg0mrZajkKIFmEQlobKODIjYM0DoZUNDL5rorEtkLqI aYosLm1yRGSWTKqUJvrUWlrWOb+pSAal1lgNFvDqHTnCtXRrMMMQjCtYS2XFDMvIYb5EJARp 3BvRWQItYZZMZv5MpMxIvxC0oNLHwwqTwlgSAfAc3ggtZtU4L0hRUbLMC3MtNHCMT+wo8/jm o6yfMko8BhXFvZmTJqpswKkwqfjMXUYAQ54JYd2QnYnFLHX1I5GlQn/D+PI1Vs7+9vTnZe+c lhV/kM5VMcIn8kg9mzNLpXwsZg4vTUVT+6mk6fnpdc1ScMzM9C6+dFJ6z8MibCHnQpIqmJiG EQmTmgmo8yswaaPGYNbGhcuWRciZWdQF7XkpdVRlCK7pwiJ6LwkiWpu1qVhUCoWh5VWzafAu GjRfUlW4CjTuNJcGk6eZ4E5F4oRLqgZVjhIBkzKCgrS8WqjzNgUtVVf1c1o7waJaTLwpihAE qhrteiOhiQmfrFWgDGON0mH0SKs3Ay2yrFkjYVBPPIcPTqcpTksLeG1eXGUzKSVYkmojap7D dFWm5ojDEBavBBEn1WJS9rwRM0bgCEkWnmZRC4W3rMmEvaUpAZMqCV0UwoUeGSkfQ5GnKrAL /HNfAmdSwfsYLVylqQYZpdRbGguW4ZjzZ+bwipCmB1CwgBGSvME/GzplQ5Zl5tPDUklT8Ek1 ME1g9bVuWBwa5k60Zbwms4pM8bRfxua9VSbMUytMV+mupHShhpNJbhG1zlId6gyOYobBU3Bi HjlsRjKVbio+NWgh5aNSQBaYjNGcLoA5t3RqljKOkB3weQsCzAwGh8enCV81ZUSDaekiS6Yl DDFoi9SYMwK0BjNImtBT6ZpUrF1osPRSDdWHvfmuZTplzj0lDVnnpAYjqfgUlF4qFDlrPYhu Bk0CMcRHGGRjeoKU8gUmwzN+Kphi2/qHebQWnxOuditDj4XlCP55moUjMIUkgwlEljBBK+uk hXlteIVc6LlTDBIwY3Ga1nyGhBad+gAH/zyaM0I8qCoaV5z51fgEatp4d4Q2gnkphEKSGUvF ZwBKZAkTtPqkq7kwZsPSIs9U4GzuQjPCIzg6hRjslD0yTvs8InE2ssk10qih/ybWndOMFna1 zqDmop8sn2ZAXxI1odoKyS9FJnAaZB+2ABbOLCHJm2WKRgypbIRjrGwMw4gvRUl+gUFm6JGl Kkd6DUwtJTlKJWW5FQDWSVYXFJc46vjHZ9vRijntdqfT4ZDs0Vg8ngBLMSBYYc4UggoNTSEq scolBLGBikWdKnx1gInsKDhFrtjSAyMUaQY5F5QmfEZZE5wnDkCyh02zyUnOnFRzL3RehDhZ khIsSd2zJCP6EtZpKWXrQDGueWCNA2WoR0g7KOpRhmXlCqYpWXgiB50TUzscg1MxcplHitA9 0jSMAo9f4kBvyugFVdAlAM4PSJrUmHo9NaJYigCFADRdEoXdgaYA55B2Hil6DMCs9JU4cwsZ PcIF/s9dj8yQJUMiY6gKAC+fSMiRcCwaS7rRhtntR5tbkskeyRZJJgfV1uGd/nj09jTskpqE ljEajLrcDqfLEYvEI5GEA+/szPWo74HKLsAvHoXco0rS3z5Fwxeb8VQkZnhparNmvdTY81rC ShFRskzRMmDJ/smAnIz1RONBvLXA5inNxRcPxY36M3nNeEAyAgRHSTkZ6Oh0uJwuj9vuxBMD gvxLkDQXnkXQyJfwbwFKwaJlQn55EynA1mwcSFkKhmJ5A/IqK4eMGtUwanTDyBHDR4wYNnxY 3dChNYWF+aFQHI2RNiZE0yTZ7eSfcZhlwiJSRaZcZ/HwmsftrR1aXVxcGAkHfDmeqqqKgRUD Q714WhcfNqAa2BMlklJs0dyAhDGFixdBMSdfHKEXNxcDX/IKfcuihZ9sXv3X37pDqLINo4d/ vHn1Qz9+EH1B+i8AYPT+79//4ZbVIJBd/p/z1wdy7vwrPtiyCv/DRg83q/34l49C9MQLT5pF Agewe79/P5gw+P6WVfgVABmTQiH1FS+oZ07iwhxP5hcU1NTV1tTXkoeKcBnmC1SpTrTyicEo MFLr8A4fWofZ6YWkUvX5Gq6oE0v0iCknBk58kiRx4hUbTqd/QK4vJ8flYp+NVdyLjrNK07xn Bc0MUmPOCBR7ZAgim02ApU8KBk1gVmREwkkVPjm4Evq7Bw+3zb142mWXzpowYUwo1BuL0bco yb2h0Ecfrfn1r5fn5coeDwaa5P1MGGja8R5v8oAaaWWUB9CIYa0VwhvnaAXABxgk9L+qq8vv u/+2NZ+se+w//m3u3CsWLFjY1dn14A9+WTWkyJ/jIN3tOF7mmUwmUHfwAihtGKCMJ9EbhwO8 1AxxojEjvXcyMlTzwWWHFIOSJULwm1J/eYZGs5FAdmNMS+OWzJeeX/bN++4aN3Gc5kndz7t2 Hqj33nmfRspywWCw1tMd2LVjFwizZZVjzLMyfGIGRILl7Mprrtr3+R7eaHF5yaRpk0WFFGmE FOjugWfqXCWUgPCjRqTs9KRmipzg2FSQgQSPChUEgfBJysSvJZNJQbAjScCkROwJfIwz6Zh+ xZzLrr8SvJ/c+1AwEsRXsx2ouAROqirathh5UBgvziNTQEjih1yuMYbAx9qS+OIvQKQxUwLD D9lkXNKTyST5xhipqnBGBir4JQmQcgK1VcZrzcgLg1C1E4lEfmHxxEkTOzo6jh4jfz6fn/hS 7VGrimWd1CkdlbEUdCWR0o2IkmzTYkOWrd65xJEOVNIWOVFaWlBWVgLPq1at6Q4EigsLBw0q r6gYfM89dxYVFv7il08dOnyyoaEKA8xd205GowfRjtkdA0ePqrI7HDh2UHQ4HM3NnW1te6LR gNPprq6ekJ/vi8fx6QJndXXVnt17HQ57MBBoOXmyu6enODc3FAxjQIsK0XSgsyO5W7aV5uXm j6gbRMvdYZeivfGje1pOyXj9YklFeVnFoBIcTeW9xGd+aM5uEW9Yt/HiS+eUlpe0tijvW1O8 Tb9oWltb27rV69PUycVPPPXME0/1b3BHDx+59MpLH/+XX/Fmr77x2pycHIh4Zir6nkV3pxJl 5ONQpckvldLDCRifhGWqyKRmX1Rk5JOW7NSutivvvnbMjHHVNdVoTWYuuOSd37/W1dFZ1FCO 967Y3Y7ezkBHT+fuk6hatnHVjXl5ea4cdzyacLjssUjs+MkjJ5qP9dpsI4rqyirLnPieQjyB r7qh+Wk/cbL5xIl2KTysZGjp4DKn14Umr7cnSN6UgVfD9wb2HtmHeCaMnpDnx9eupe6O7tKB 5VfNu2r37t3tp9q3f7Z9yvQpaPYsWjJjNs6rlDjZb1XuJGBLvsAUkuZ8CoAUSXOlIpcREoJs i0Qie/cfefLp5U1HtpD3mjgcJSWl//hP/+/Syy7evHXnts93tjafOna058aFsxsbb0f7dfTI yZdXfJif6/DhcMq2PXuaLrts0vjxNwwYkBsOR9as2fzxx3sGDPA6XI5oJBqPx4BpOtGyedO2 cDTqzXWMGNWAibdgb2j6rEmNY77V1tZ5/OjJNR9v8ud5nXapuaXbZnfe8tfX1I+sbj3Zvn3r nj07D3hzXW43fKm5IJdVbjMkOL5KmrNuxmTNsTQGJuVv3vgpGrLrbpz/+988BZNgYlxZVV31 0pKlFLPwqwtnXTLL7/cHg8GP/rR6+fPLqOLl869oGDXi11qjg0HcxZddUlpe1hsMbv1067OP P0VhsDl59rRrF15XVl4GC2+++sb7r69MFft7b717+ze/QUaFr69Ui0iyXT7v8tUfrIJlXktx dzFlbtu67aWnl7Q1k4YY48rdO3a9Z+VCL3MlMiRJB8a4ESaLm4o4DCMJLMW5AAGDGW2bUjDh lDtsh8dMGSvZHZvWbXK6nROmTnpr2dKujtYi+2CHS2rd2Vw3qX587aQ7R98L/c/Wfnpk1+G2 va0lw0o7WroKywqvvPqa6mFDc3Nz9+7YvfaPazuDXUX1pdFwJBKIjJk48Zbbv5pXnL9/575N H28I9gT9RXkNY0c5Hc5YPIYG8d7G+3p7e9euXoNrWDQaHTqs9pLLLikbWIYTLBKPhsLh5qZW O756QbtypvyK2RTKTcsuaTVNm87TtHQOB7Yao1AFSzgp+bPbI6NurZ1zcWdH0pxILqezuMAf ClTmeF24WYkZgeWvvDFubOOYxoZQb9fhA9sfevhvZ140gdRMSbp4tqexccyTv3226UQ7Bpl3 3nnj/OuucmD+wC45nfY5c+a88MIrb7zxUWtrNxmT2smMYV390CvnXdbZ1fWnD9+ePHnB6NGN 5IaOnCjIH5Cfn9/TExg8pOLxXy3xSo5JM8Zccc3sKZPHhUPhnBn+WTPb9+058LvfPpd0k2kK lO5p3nzIrjgyoIyFrlUbtRWD7tLnl919393jMbrUkFddexX4b//hbfw++stH51w6Z9OGTWgs autr/+a7D0yYPPGRv30IIrRiN//VLbT39PV77rjjm9/AsO7zLZ+VDxoIetDggf/28D8D9rV7 70Db9CksbNlWO6z2oUd/WFFZ8ezjT0Nk3o4fPY6e15y5F7PGDlNmldVVr7y04oprSFR0+/o9 t8MFsbl128CB5Tf/1c1jxo2hfTHQS5cstWzING19jxyzAtG5RiobDDQoTCtC3YRw2jGXZogM AAAaMElEQVR3qJPosUeCsTHTZtTU1rW0tOzZsdvtcV159bzGSVPdvvxwMBw40jX7+ksvX3Bl SXlJIpl0Ol3Tpk7btvmzDR+tXf3+u5NmzPyLG66tqqlyuT249E6fPn1Ew8idW7avfPWtwSMq b/3rr1fVVBeWFEZCkYtmzmwc2/ja669/vuPzm75y07QZ03p6ejCQ9Hlzcvw5U6dOXbtm3ab1 m3Jz/YAVFRa5XW7U2cMHDh09eNTt86CXQD5Vl91mLoHs9PoNJfbIztxwqkNrqDtZ5JtBWCWg saEZ8nk9Pl+uP8cXTyYwY3rkaFM8Hs/N8xcWYexZPGXKmPb20KlTxzFXVlJS0ji6bkjFoM6O 3kgkPnny2JKSwh07dgQDPehrTJ06bfToupUrP4pE8M1fBEiuynl5uTgbPV53JBosLBxQU12J nt3G9VtPNp2YMHFCQeGAhpH1gWC4ZFBZXV11ff3QzlM9h47sKygsLC4qbmgcPrhi4NETR31e dNkclhelMy/h/rJAR5fUGjI+dtzYI4eP7Nm+54r5V6AVQ7vwK63bdf/3v43GC30xvqXAafaX X/sKmpW/v/MBagTdopsW3bJiybKO9lMQvfzC0ic0C/d8/35w3lj+h/aT+kiWzwg6ZQAUDyxp UwA3fOXG9ra2Fc8v4xuy6xZehz7aI3/7MFX83k/+4S/mX83qCZipaN4RaGQWSPyexsa74NV5 PrNMmdQdBaOGocqGQz2Nk8Z4vR7kcfvO7U6Xc96111RUVXd29mzb8pnb4Rg+YWR5xSDMde3c uQMNGRqdqtqa5paTPa8F6kbV19QPRU/q4N7d4XB42vTptSPqAj09kWC4onJI/YhhOBf2798f DARHjR5VU1c7uLJi36H9Awbk1dbXHdx/EE3noUM7cd9s/ITxw4bVHz9+/Mihwx2nOrAaINgb xDRZW2s7Gfpiy7r68nnny0SjaXlkQmnotHuhaAmW2k3ZI1PHRim8C2whKYQiSLkkCYtLGvVE gdrfRDcnnkhg7Rj60YBgZrOjIxCNJTB5WTG44rrrbq6prlpww/dOnliHCQH0vZcuXX7N1bM9 Xu+BQ83Tpk388MM1P//5z/bu3VNWVvb4409WVlb4/Um7PQhThn/lKJLlGC5nZ0f3Tx557Hjb tr954IFp06YNralJSMkrrrtoxpxJybj8rz/95fY969Bpv+OOb9y66NaFf3ntA3/3YF11jcef m4TYeL6w42DMasaURVVgpsRyymhMBUivLn8No8ubv3oTemdolUaMGoFxJYSXXHYxhh5oxdgQ 7Nc/+69rFlw757JL3nttpXrAZNvVN87HHNaLi5ewSF5avATju472DohwC2zPjl3s7mHT8RPg YNrruV8/rflX93SHNg49OABor23KjKkb1qzXK4eSyScee+LIwcMUjy5b2cByg4msE7TE8Msi t1DVhooCRkhC0bL8eaZOw6YDN5cibc2Hxs34Tjwpb/l829LXlsPIN+/91oixowLR4KtvvXLl zKtmzLro2LGj69at+9nP/xWduN/8+omB5QMra4b2+uxz512JscNzzz/31NNPO5yORx58ePpF MwqKClFR5y24xp+T8/ySFxY/s9jj9syfN/9rt31t6uQpyWg8GovhNsL69es//vjjZSuWobF7 ZcWrNUOHjj116ulnnsrx5gwZMmTX7t0fvPfBqy++PnbaGJxlOLOEYhHTVGzkGlOCAYskrWN9 1TIbStmQmaHnCwdViVwy8Kfcs3FIPo/P6ZB6w2H0qIY31JWWFv3uye+iiUMdSySStbW1wWAI tyYbhreFwvHlK97y+8vHji3BN55vu+3H9fX54YijZmg1rj+oZko11ceE6PCdbDp54MDBY61b hgweFegOtTS3lpcNHFxQgO5YZeXgIZUVj/7Lg+iyRaORUjguLArBnJ3ewyaD2y9ydJnpgGFS H1P7EyZPQEM2/8ZrAV/y9BL8YlbryCFxih0c8HmTuXm5SG5cvY6d2+htKWNDKTcvD6IfPPpD Hg+a8gUmTUIXva258y5HQ3b9rQuLS0pWLCFnOL9t3bD5G9++c2hdLdpc8NGd4aVnSONcYhnh TQl8IckjGZ3qtCSVVpYcsrvQUTW6cXRRYcGC6+aPbRwNxaLS4ry8Aac6T0ke15jpY11u59oP 1+zavuOixslOr/d/fvYbp8flzvNeedHcoqKijevWdx5pr/YMGj5l1BtL3/jwzQ+joYjT7q4f Vl9SWnLXnXctXLjQ5XahiQUH68J6AgGME48cPfLiSy8e2H/gklmXvPundz/dtGn6tOlDKoaM GzkxJy8HzZzH7cYxLassVc6DVJlguTy/CKfa8zJFpeaDHVtjvowpk7LCEDBCEhATR3Vm4lP7 yiVSWSXj87pz/V5/jvf4sebOzq4FN8zDmL/pRFtHR2fd0BpcfHD3GW0IJqqwYSC5dt0GrP0v Li5Arx7XQ6cTzTf+paoqqaDAGw7HcA8bTuk/nxlwcF3CYo6kXNR+EncDMDlrR18tjvtKDnwJ AMMExReZcXO1t7UfP3Z8x/Zd1RWVWFpLnzZg5UfNClkTpLzr7GnBiJBkdiz569esv2TuJbgq YikGZsTQmlAYyhNMXsXvzwkGcZcMPMLGOUlOS5rQfLAeHGVcPnaOJrHaK2VBXdDfVe99OPvS OfWjh4+fPAHzbnu37xHUfvHkY+CseGnFLx79OaQYyd686GZy2Kg+dwTBE4raYErBa0o6NJUK 54GY4WG6EYMDPSSebXdKvV29brvr0lvnDa6o6A0FC4uK/H58odCGKa2CgoIRwxtu/Ivr7Xby 4n3leRXZ4/WhqyUX+91up8fr8efhiyMSVoU7vK680kKs//Lmej0DfBKaMb8XFTsWi2EWDE5x dBJyYtu2bbgDs2/3vhlzZiRjyUiEyHE3anDBkCRZhZHEwzE+fw6WUuKyjzliDEFwN5/cDeEy yZF8bjLShrLRapO2z6idAWA0jud8MuCzEJvzaeZkYSYjhFhFfxeD/z27DgWDzSjyWNyOG1hz Zk8PhcK7dn7W0dk1ccLo3mBo2bKlPT3dODQul2P27LmhUAQnIebIPG4XFrtuWH+oq6sDFejq qxcUFuYtXfp6IHAKttU5ARxEMsVJjyV4lG9XnoIit7BRhE43VmngOhc4fDj89OKnyTktSbW1 9dVVNfAV6o47C7FKx1jlM+bv7AAMB9zk4r233796/tV33Hv7pCmTfv/fv6dyTM+jgRg+ejht SmCBTr0vfYEMPNmG0SJo9J5eeW4ZZS742sL7v/vA97/99xs+WXfTopuRfPVZVYTJrx8/9tNl Lyx9H4PTFBt6c9964J5b7/o6mrOntGAYFqNUTP8/+vBP6DwdagNmRZn0NIiMtZQvOgpmh5QX Ze8aLUUgFvT6fcMaR0aikcXPPtPd2YmLJKob2qBFi76a4/WNGDVq347d4JWWlx5vOv75vs+x +ui6a+YXFRfFErF3Vq6MJ2KFhUWS29HS0xo6FJkxbQY6d52tnW8feBOLH+Ox+PqN69etX+dA z0+SZ06f2RvAPEEvppJz83Pra+t6A8G9+/YEIj3FJcU5Ph+uvseOH66sqkCOMOPW2YmJgdbS siKEhJpPr1WWGcxYepZaZ495pg1ZH/LTB6hlfpXLBHmcyIa2TJYx3RkqKaseNqJx2rRJTU3N e/bs6uruPtncFgj0YiLgxAlM9suYI5s8eSYO0ilMZ8Zb0N6MGjXss61rotHegoKcq666FA3Q yy8vDwTwMUyQSv3Ej7JXgiAJhU2ucoqAwHy57hPHm1tbTzmcyffffw+h4GJ2+dzk4PIKDGYD nRH/ALeidqZ5VpyexR86ulyw8Dr4eH35H6inJYuXXHP9NT/850ee+e3id19fiRbktrtuw8mA KTA+FLRf199yw5333d3d1Y02CD2p62+5ETcfN61aDxgmy+68764eiF5bWd84/Kt34W5a1db1 m3kLZvqDdz5ACxjq7cWUmSDt7uwC5+K5F9OG7L7v34+ZfgHTv0nh4KEqkAucttE6AgwjIOFp liQaVCDZwnLU7c2pG16PBuP5Z55vb21xO534GmEkEp40efK4sePqh9e/98pbkXC0sqaytaM1 +EkIulMvmlZeXt7S1vqL/3osEAyQSYyyInzkrbu3e1TjqJmzZx49cPT151470XQCsF27dq1c uRL9MizTHzViFKbDcCc0Ecdt9/xxY8dGwuFP1n3iL8ipGFKBrllre9ux48eUEQwqLFY0ybEE nvlTVpuTuPVNKA1dcH5QakOWKkqdLxyitNEzLUYY4dSWgZcCSTHAY5Tojcdln9c3ffqYN998 Hqvs0U/24Xkijxe3Wh5/4ulYAsuRHS++9PbEiWOff+GFphMncSxxxHP8A37726d279529MjB z2+Yf9PC66ZOmYApLa/XW1lZ+cILy7q7bQMHFqDvRg6kstlxOcO9Z7IQF0NJjFAhSsawmlo5 1m6Po7q27IXn3gn1ynfcecP77/9p/74DxcVFuX5/NBrb+tkzvlzceCArObCxfFnkmZNSsD40 s0SrZwNvler14ZcZpgR+33/ng1sW3bzqg1W4XUiZIH70vUe+893vPPzoD/EP65iN+sfvPdLe RACqopKx//q3//zGvXc+9Ogj+AcMrRg4NJofPfCDf3rsp5gmozNlsPBP33vklOKClYk57pV/ eBsN2cZ1GzHIFaQbVq/HJBo6ax9sXQURxp7oIaLn+JslT37rr5TVsLBL/xXNNF6YZYqh1y/G FAiaXzB5g5TmORTGcwQV1K1IKDqoYODIkaOrair/9M6fiuK5gypLy6rJLYstn6w7uudgeXHZ sIbh8YSMe8GzL5s9efqUK6+6yuV1VVVWbd++feOGjQhi5Rvvzr9h/n3fvm/RokVYTtEwogFF sXPvzgO9B9945Y17vnPP3Xfffccdd7Q0t9TV1eHy8/+fW3r44FH0zpwu940Lb5x7+dyOzo6C gsLS0pLNm7dsWLOxNG9Qa3MbBpoXzZwxfvy4yqqqP77+ps/vwxsZcFUWSsOcFLKsAFiZmeEa R1PT9hr/dPfSxAmzoZvKnMgX09aKDMUIEp6eUPOpM3ghy4kmRusB3eZTXZfOmjh92sQJ48dg xSnuqOCecdPJlr17D//3b/7gzbWVluRiOBcKRT0e/333fKVheK3b7cbob9nyN5a9vMrvdxQU eptOhB966HY8renzeXt7Q6tXr/nd717Bkulhw2oWLrx669bPFi9eOmP6pLlzZ3f3BP7935+8 ++5FeHig5WTbkuf/6MlxTpw4orqmsq629sUlKzo7uzGzVlNTdevXr8eUP657n2/buXbtpy8v e7+xYTCaQDIiVQerJEtZHFsOkwFNiiYVROCzJCXEpFbItNSZlDbDU2ZPzS/IR1dog9LJYlJG UK1hjcOqaqu7Ors3rcKdYmxETjHoi1XWVsMC7aYpUq4i0LTyK8zVGuPSVTDIha8jBw5jmQj0 sCLk8IHDbDaNagmmOCfWpJAdMwgAFg8DM8KMt+AQtIQpeTzSWDeybtalc97+w5uHdh/ExRKz UiisYFd39bDa6rqayTOmvPvmO6+/9frtt90xdty4mtoadKbWrVm75t012zZ8NqihomVH09yb r5x28bSaoTXQ3bNrz+L/WNzc1FxYU9Rzqmfk2JGTpk4aP2EcFljgTs4ry15bvXpVZ0/Hv//8 FyNGjsAEP3pb48aPi8aiqz5cvf7jjXt37y0dVILKPH/BNaMaR5aXla1a9dGKl1/15+K5SydW sbG8sBJgHEpY8S3KRoNpc2R6WrBHkhpIFGlKRj4GS5gSn6A0ZExiDTWLtVBVvLIz6xo4Wv0y MDXLOlOniIymkDHcQMRMu8MWdtrD6CSBj+mASMQRi7kdbnSi0QdSRvR4fIw8P9bu8bjQAoLu jeRh0suFZV0OezSKlWetOTledLjicVtHh9eXY3e7Mbcai0U7HI5yWY7gHRuY1Jdlu9dLVqnF 41gO5srLIfdI0UVLJjEJ2+XzliAyNKZIxpPdHo8HkSZjbjnmTkhYcOgyzpaSjGgFRuiMW/o+ Ai0U5d6HYslo2pjSV7FTPpNaJllgan+SmVcOg6ALIeMwRUakERmPsKohMLXKolYAZpYRPJ6n AWC6DNyPBJ8v0LxrFBqSPID6JRiFi2sbqlDMFu+KdJb4SlCBNDyZJkPnP5aMBaKBIk8hnrvs iQbxtKQvxwctT6cTX2yXvKirLvT6E8FEwpNI+nD6Sr3BXr/D78bDAR4XOlA4B6LJSFSOkBoe i+d5Bxw/eRxrbB/7xX/gMZUf/ehHeA4pLzcPNh1Yt41ocIvd5cD8b6Q3YXPEJUfSnvQ4XRiJ 0P6DXnJ8TvV86XKeMpSBUdGYMhYgM9Gnhkz56OdpvbNfjIX5P2sETlq8eSwSjYWjGO0HFT9o pFARsIhewugRALJmCwVgxwOVUld3rCcQxqHA5nBh7awbVQZ1xetxtnckw+Eg+DIe3E2itcpF JcN9zt4QbgWEc3M9eOlFNBKW7E6PJ7e7uwttn0NKOl0+nB9ow/Cn3DTALVEcazRktkBPuDeA WQ7Z5chxuxx+P6oYSkgsJJo2HOGzVlwwfM4cmTNx9lyLZWr2ffY5iAEZtIwEFcxapF1zcC1E pcXS00gwEncl8DIqMthQbEGEnhfuKYZxU8oWzfHmBvCgbygSC8VgNJnA6m+fJ8cDDH4DoUCo NxQN4+0sqPfJ/KICDBthGcvK4rCA+h0J4iFK/PnduajqCBfTLElcctsDp1q60GpCK8eT6/X5 cBWHBK1eDJ7C4aQt7nXb3D6snuE6Y2KpWuYeoGyOPMOkMiI6yzKdebIfDplzGO1n/1mGiXKV 5RyPy5VX4nINVOoL6W1hZSw2cj+RViKEh7ZMspUPrMLcFqkB6GuF0UwhanKdhnBgeTXaRMWC Desp8MQ4jqrH7RswaCiqEZJ+vzc/3w93sWiiuKiQVANUvhiZ7Pe6nTlet6OgIByJwhMur1Cs HFxLZsRQV+Kk/6ZcFbPO1QXgn1cJCCcLMsd3D1E50Xbl5vjzCwfEw3jxFOqekn/SnMlohnI9 ufmFBbhcYwp4YMkgdJdQtWABNRPNEKo66i1+c0ty8135aH2gTWqdst6I1HY8z+R2FeeUlDnK yaWaLGoljZTT5eru7m471eZz5ZQXlldWV2BGLIbaD5OIQUEWlw5wOIswJYI7V6jF5AT5Um3S eOPQ0hy8cGxoyVOYTusUkRhTmkntkApSISkoi9IUBUwuOnSjXoTDoAlVtlGq62rGqZzjq7Z5 PZ6GWE9SSvCoGtB3Ol7ncZQiTonRjFMFGqcAFpJAUg7ji0nFpiDV7KuBmaWMw+wTqDE8rmhU O4KccgWmmjQeAwHDXGk1K519VWaKjvEpwedIEFkmM+MzI9RjQwYU/KYpGrnagcyUEVYmygUX S1VysQwN85i4WCtdNN4TaOKEPCbel00MzKibXqphaX9US2l1JZUu5bMoaRJDS7xJK3OPjDm5 QFwogQslcC5LINX53KcYSNdMkrq6uhMdeP4cM238/GefLJ3XYHLHxLD1S+EZLOqJ7GyzgCzg 7Aptmg7UtLS97pWnRCl1IXJ5DUJTuR6OktbXSohwPp2dA80Fr8ldcsX4xHiMal94ioVLM6+X mxIZk55BnMwk63dQY4yf3nYaGERCgEJSsJzGlIDMIqm6wtwWA+sUYylEKr4RpfXxcOsKw1Q8 MMDOHwFHk8yoMc+MbakkMLMEZwkTjFsnEW2qlf2CGyFpba6P3LNhs48hfJFwmn1aYVhRGOvP Fxke830ehsRiy0iwgs2I5AF90OJKhyO15sPUJlIvGe1nBPDRijQfBydDvwybMpfMcbmLpcJl nlNYMaj2S8LgiLk/DdMWQ8szMZcuAj7ms+Ujnf8Lsi91CZyLKsNXUVpYysSVmU2E1tzztIwx U4btyxVzn4rS1JAJhydF9RHYag9f4GpHW5vFZGLBhzFg1q8Whg0KKjsTRoNIpXCY4lEyzQnT opGwwPQrru5I09FcMV0dYkExLSqjSQtVAWeBoDERgTB6ELGCKYugLFiqEZMuHzAT6h51ysJm KhazYwmwlJqZlGPmZ2+TR5rtmHNmxsCCJZNYFgtUsGdIaqcPH5EFncqXyjeYNKsbxZqtbHQ1 rNlm/3OMUWqlqJSzqSHrf+8XLF4ogT+3EqBnr3BenY1MZtNMZIM5G7GdVzbPYkPWL+XL6opg TUgy2BkVrtrnUo0xF5Z3pXVpFi77BNbtaWp0r+dR4+vIs0ypAbAIjAGwFJOr4ahq6YJjugIo FV+FaZ4sYWBa8lO5yAYs6JqTWkRmSTYcQwj8CFARUNsaRtvrHZLsPRijZJayMdBfmLPkNFND xnJ+mv5PU62/Sq1Pdlhe+6QlgGmGz8QUK7L0RjgpR5JoaJKZEQJMlSRabBTDLMIKo1NpCvy+ OhbU+WQqU+n5ZqmZAy8qM3320kqZWaAYzcffN1rz1VdTBjxLaNb6FoOAzsIIgzDPgo1zk+z/ d/afm7gveLlQAv1QAuwsPDNb9BzuF2NfbHNwZsXwxWijxPDvNJe+ZVGK892WMTNbogkqMHBT YpllOtDTpvwZnsmzJ3RdhdJn7cWxpAqkO2HW3OSOWTXkywQ7A0ZaD8wrQ/GelPc/8gx0rJgG 4RsSGoPd/aBdM8GyoCJImU0zn5jXNsGIxlbjSS8FmALMMEu+ALNIgpU+XBZfFoRgn2hkMC6I mQFGUK8UpoH16kukAjSDR4bWjFEHwi9DqdbTggXdVEndphUivdRKQ+chOvxf6JHpJXKB+j9X Av1xiv6fK7TzLMNoBPGfaY5MCJod+DNpQuEXdogFZk5w0z/JvlrvK94yyn4xQi3TMu4/g9QS O3JCUsiN7lZRULV0LtcX4JmClTRJFocZA5HwPKAl2JIJa33lmwP4Yjgs7tMrUBp0dkYYKquc pkKfSZxZOe4D6H8BqNMQJF7mPo8AAAAASUVORK5CYIJQSwMEFAAGAAgAAAAhAG0nGmCahg8A oKKcARQAAABwcHQvbWVkaWEvaW1hZ2U2LmVtZlxWZVQUALOlpRtcEKRDumFhaVwapWTpBulG GumQFgGJJQRWumTpDulaOiWWbqTr+f1453vnzTlz7sS9M//mDCoKCoojyn9NFQMFRRP9v/kL JxQUoA4KCv1bdTAKCipKXkE2apoJCgrG/9H8xw7/FWr+6WRQUVBO/18PZQMD5XMJOsq/ASin 7JQoW/9cUUFZ/p9E5n8pav8SLfT/bPi3C6zw/j/Y+I/H9Q9Z3iuAufl5BHFZepHnyAPYRd5E bz+uED0fvYuFPS4IRM+rZu1s6/mRXvhfSYueF2zn6Gnt/g8dzT2tFawtXays6aWkcD083a3N nXB9UGdy9BOZf7v9XjvQJn+jv8gCbDP+9I1OPSsSH5A0gvlgti8LSGKNNx40mrqauz6h+578 3cvz3XhNagXFvOTkNz0Fm2WqS8vHqLvfzXYaw+6vETtCYzAPwfFLvt+8dO0Vz/VPHo/bw7mZ d0+wO8fnoGbY0e301bpLoH4kgu+vuuGnCztoenvJ8dpc8HUabGynsmxtFVEkSSu92l611hq4 NKv+eNVyt7avlxtwN1gV9NjsfKAXTCYldTvqEBRwaWj27bEhiCLo5m+W3tWwaNVw4nj50Y5p b39usJttBxQN0vYzsC84+HL7S90jJRQi6rgBOGJbV80eCRqJbarIgudGdTWLdZzO9d0+1ATd v7uUbq14fu+kufDuws5gLFDOmva9L2aI3OjS88/plQSBR/zkKPN5b9tU1MeX7D1o6NaMKnfm RvmFicMY9XmMT/yjucE1AHqQhBrCxVRR50yn896FdAMV2EfTY0awu7YY3OViX4j6BHmbejQr xnNRcgA7IuW1LMcFCKId+h2AiftLAP1P03XpTE/3XSKuD0qvGtHUrV0KUGDryzlRRc5pV7/i PM/anZvrBobMPeZb0Irzx1RN2zgXwZDHyqdVwvUj2OX1WlDj85V08FOVdFuZ1ENnQPO6ULzI vbcUwWYXwLFGtMN/bTr4+SV8wg9HisBLgGtYy5BupiI7H9gAgyOa936S8HR7O5vhWbCd1eFi HzE0Ed/FiPzl9xVgdNlzjaadbZLfDOi5FYqmfhTKThN5Hx2hfjFvC0EfytoGfXjEOBMnEZLb h3ZJ1Lfwmo2S34XW7gHb8Z1Uh+f9Z3IV6w/3WUe7GP4K18Oc93bEpetdtdhGhS7JGXRPNid5 JJEXFoQ4aTa5fte69zQQ894eyZb4ZOaXmX6gL+oA72I7nG7GrtUZnNlffuWG82WrcA6zw7Xx JMZR30oJkYmR5/F6l7yqgCXl15gBtofuzozleV1QDZyvvhRUXwk9AsglWfCBsypq4t6qagLf ZUajlWGs9yKjDO8R3uDMkp4AYUxhxF0ASFNGLp3OOXXstnVO/ORbtLfUu4vp3CzX45PZPBCB YgKgc25N9PLdmiLV+fxr5tO9fALJeaoWr6dNX6qD55Kdu1z1yZ/tD9Rt+XRLJXTUgQctxVl/ KPeW5kypEUFD5FkXTTmU5IlB+9Tev8Q8MOqPQGNHJbaG4yu+wHjhHf/D8UtX52ZrUP3TdeAK PHD8hypFLkrL5kRDtV9QbBt5tdB84OOl4IT/9KZ/CUTqSoyrpzfXLkjY04X4ieBwTU+Tovq+ dRZtH1t5BZgHUcTQ1f6t3c0EY95wcy62Do9Htu80GeIvSEWJy+IasUJqCqb1UFXl9/Owc83r hGEaWi0n6YgmxVS5ed8YNaluoUEMhywE+x5PGtJJ8LCfKaP3zzb2LLubprQzTJuNwl8CTNzk RNo085Q8ESPO13VA41EWl+VdKW/53P5Ua69x1Blif9BA572ojhDXej+Dd4mFUTdaRNRcgGAg aBmcvkL4QNdX1VOntIlLixs6Kk+op3+ZngG/M3qK5vVm7UfiBs+hKSjShCVk/DJB+PNyZfhO J+p7eFWaY8/N0eg2t78VtPRQoA0XFkWH+C1ndvhyj3bgfcG0tsE+PQMOWx/lBnZVBT7iCovy firbEiWbrz+itiU/KuJsrAqLJHdz4WgoUxJHsVzLEff8VtjmigI+2iF0yyq89zn+IbIuLhtp RZVhrsman05ZzY7uccKzck5D426a6Nky4nRArW4aM0gI9x4LV0agkQqzLxbBAkxGGLo2DsuW W/BqQS+ilssnq4fiwYhPEeAwXNuhJDPNH1SUcYR2QhcGP+w4tQvzVbobqtBKmSEFIZMlzIiE DJxkY9kRbnFcjFtXFkY8i+K0GIwQtb/HhcPRntiBtwpMP4cclGmLZiQNcpsG1PqyKvcFfamT dzVf7TnP2npLRr/NG//7zU5hfNJ2XytXVtS/VKouq4CyiWsz2jn08yCueiiLsVW3j2zG38qu v8NxbXHTCXfDgTNwYwR9HQ2jb4vnAO1iKrV6eNGk8+xHQlvTuBQ/fGp1GrYSerugCOhG2by9 kFtF31ccppIODOXNVTajNBV1Px47Rpx0ZdMz3/L6zM/jHJK65cKXup2E9dQMBMVSqQbxGX9w sSSGqsu7tuBUVwEV/TpxeVOHL7A51NN1qC29ZNlvaSbYjOCwzackKQ9deGKF6tef4wrKuPZ0 s7azAl6w8YysXXAgmFHsPR7Jw9kHTuHFwgcDF7N6IgeBlhlnoe/7lOr9nvG/uIko7SMDvf4I rpaWJNVn3a65K+vS/j4TouXyxo51ls7tD3o9yv2JGhby/O6A5Ti10Hu38GlAG7BMW0u6jDPB 40O3dciOH6T2PY+PEneCZGSpQO4PFhFHWqL5PtqGZn/Ab9bJMavUa/0FpWp0zPDX2kttaFMj u2FkQxTUtktqEdos0G66gx/CdKOaLXM06u2UZxRRtBUL5pn5mxPmL10zoJz98+O8JXpu6wmf 79wDLByCcH5X8mN0cE/Rh21FIF2aZrJVNC0BJkPBkwSbIDjk3bwGYvkT99q2s8wfEQE9K+LU i8m0dutYQaOjka433PfX0S+MjmwPukYDRSy+jLyY/2ULSIHXyxsEcK4I2df12zKG2475TCGX zaQjYK/D+572jj66M9oITMk2x4QRUnmnnXE7NeKB/ULb5MviqiN3yDVilwYXKat3Yuva9zQY SZ6pswE+EQGhdkn0U3fsU9izoMB3BeD1m/rJ9/CzCPudxMWwI2IuvKWwDn/p8Elv2QbR5/Oj FunHh57g4Huk6eojsofopOPxtofoevsszH5yycw0r/K2wm0mzBVu9IaMexuh0JEXjLVEyusV +7utssbaembcZtdiwmLaEvm07eXVcEOXe4rSL431REsHcn1J8CgB1QtPSCRm3ew4JwqXWtaC f6bZroW22/MQOeFDb0JB0dUmYM93vdYfq6fkjikDLOWu+Qi7Li9M/EGdd8l0/q3n2TE8naVo V5MBG9yyEUEg+RKsF4tafKeNO2Z/soD70zcGpb/SQC53dfW708s+cgB4rdiJsJTfrrLGV1Wy pmBTc9F4UUMTRcmB88zdfPed1XjoaTzbbRFX1Qq5F7S3wv+hd4eqvQsH+of5I5k2giiEbNMW PCYXTjjO1yolqVuroAEDhpairlcS0weywxXEQuL3qz9RFb/XsYpZpUyUCZV19ayCCZYUM5Ha gXCFsdbmneMGfvSXb528ZiiGaZSHCfYPY3Ygec5XLjVB+L346qDP2xkKn9mKXRGYydCMNItq 9pO1VsaAwyDgzSSMD1bHzw/57qOB9ynU8ix9Y/CTWFGc8h4DtI0pMOQ1hx8xm7zFYhVWkLxe 5+MbxgWLUAvjAOLDD9r8w1jOe0TC4e3ypgtEN+zScgwop26vrYw9tWwpDI8G5wB6QaMX4TzZ j5mc4UXzQcO1vTUSUmZjgRBmpVaHzuQ0CiuUL/aouKZh+Vhb5wcrOlS4PthqeYH2e74Vhrm2 RL62X6wqbQ+k3mVtonOBoGmtm7wu9fsG7SqiG1E1TWqNbB464j/NLgi9Duxq5qTI5PLaFOg+ 8pefsvGc0COPqZ9ix3uJluj8ftXSKRrgdpB+/UTiezbOKXbYTKamaLLKd8K+oCcWB57A5L+h d5lfRGKzPtU83jGEQ6hbv26/JWKgxGthBvSjMKShSLwAhttkZIKTYopPuNx73lHGsPV726Oj 6xDFtnhsM3L9ta/xedrE5xMezVvChPIPiRqGwLw6rwpJSVvfGi/Fkwh1v7noWCGrIXLoeGvD Zyy7HSIcAPyILnWYzRkjMxIsfxmmNNpPbHPSxPFLMo25LJzvotlFAucCAg1/EbVuxH62Xxkm ndTlNpddNmAHJJ9CoRCejMG5g44lWigkLxitXkZPVx/ktgad+St+9jnlla0byMpi/ZiVbBOp l+Dfle3SdaC8S5ZOPPy69JTkhvBQEXKYZPGHEv/Fen8uqXY1uQtHymmdmChNG07rnZhDOVVm 9JnY/U9XiVwg1P2txlrRjQ6iH0AToxnjL4bPPS9oa2A2NVWGDslZVImIjTvc5vqWkXz+Xg2W vCeRBA0Tkeq0ujXd00t2izSIZdj9+u5rd3b0V162TLO+UC3DqC5Gup6m1JQmpBHRPRmcTET3 +OBkJ93dV+3R3VkJSV9vr9BosQCxuqLU+z05fVjINQpSU7VcvArVoTJTjs5Jw9fdLVSkiY2O njDfH3OyBeJY0+mi8gaQNv7gv3fDWP8Qcw7ra7IXeNO1KruI7WDdygSj1990or1i/8JpNWsj EGkkqUUV9rSi7q50CMbesB3bsH2Obu5c/Wjvlc/LyxRO/eZvt86XC3LV4aKk9RucFDlxMlIU Vi9gXd06hsFsYeItH53BDjtA0HOsgyKQYEEAfM92nWD/qeYi+ZGZ4mIwJ13OQfRyMlAxGUDC TxOdxr+2qjenXz9V5UH9WxmINyGnPBxNdhgiByCr5cpRpRlA0CMPr7yaBEjxEw+Yv+Oovv47 1pyJ+sxo89drsIlVmlqZUwiuJD8ouWAXLb/HwNUE2ZoNiwTbKXe2Dyg6GLGchTaetlHeKj5O JuwBWl/4MHOtw3VAf8bmJncKVaCd79QdUExtNvImvvdtggk/Cq+gB3b/bYm2dhw69Xn6bkO1 QnzWM/Zgu5ZSURBPwdYOPOB8JTLy7ofPRktS3Lik32VdSrIZj4P5VCwX5rlNX4+5bsrOO02B P/OstEO9yVpnMkOcFJQuC8IsTH56hJSF5a9zA/gnMTgpfX+dvvoWx8xX6+kuXZfw59vIlNDP dzwcVMOmpoNi2dQBfRc0KtbdOvgWHJsmfXwf81W2XidQ4BM4nN0VqmGQGlgJdnVDhTI4ydgB JRU9JkZd84nE5HFF7/leD22qtyD1Qx5CIO8g0m4pqOlqgw1SKX6y7eWqWXzbkUiaDKDDrbtu GkFzGqnVApl/R4FJ3I1SS168ZM2FlpzTDB5m0I/V+v3HzbKXTMUySWhur0BqpOn6oj9fMhEq XBSyA2DqaTPFiSUmjY64LeY/UP5YBYdCn2T2wxljZW/xD+Ki9vZKyPzBJJfpMPXn2iqHpCC7 V/4VHdWXVlpSWoG3wk/sv0guwKPfjJZlvVBZ+97G0sd+efjbAU5nz+MMRKbD6KgOugT0mdb3 /jrQp5eAVDSm4tlUA2OqE6LzV0IZIX3j222Sob6GZPKTz1PFqZR+ard1eloGBgYwuKYxKVcp +Jzec1lyqq+65l0tsux6Ehm7Y91CjqkQuNhHTjaSzvh1ZUn8EJO51Htbt4idIJOVjWHY61WB eLNLzxXj/TOQfyzngIW5b23Dzy081cPy7c2fs8jUNyyLfEbnR00tEaWpF2o0YkPaZJWh5Ed4 H92bdYbg1UcrXz2oyWQVuD3u2CDzcVgHYlhpwiy4/XBCf9Q1fct/L4Okm/TYizCMeuzYIs6U lpi8+4OPJGUR1/vFW0WdOz8Cnrkr51116ZHmhjpCzcaligK9vFzE1I6PjklOyOAvU9TufyUR WZdksW0LJdVacb1SdMtre4XSql+2Sq0ndhvdyOeNMhrND56jL1vk4bUJI5hN0AvBpDZJpqWK W62BBLWyLNYCm/EPC6Py8p1y7WFFAvnqGGPwlA0Autmj01kcMU6ytOI7zg2rEB2Q7pP/cUXt GkW6iy9hU65ou9NoVLXu6y1dyO0fetO5YYNGJyUJI8vDPfe2nUJnpF8ohZyzmYvTv4BlNXj3 vFGzknOGBepe+OnPXOjbptXEl1t+f63JUpd4MJuChPowLpAMqP+O2yOpuyRB5ulLpF+r4v1c 6kGUB+eWO+U6L/vcvRvv3NuKCqN3fOnr7znrveZ/Jx3cyxYY8arQHUIXBMZTaFN1NUvRvV37 xmT1b/qQd50sMc/p7jkSIvlxveBK1esnB/0IQ6AU8dn6tpjjcdHWTZjhmfWWzzj3C7y9BzR3 o5ehP1AawtmfPGUr4n4e8wn3aimkirEAqx6EMMsseFcXZ1B6H5KTgjV1TF6e95aEXjiGjcHw fGtVJE26kCk+LTm//hD37CbXPwooPVj8/hqkgo1EAZvD3n+O2CnmB+3w6fcTci7VphwBoD5d Jargp5D1d4mDVO/Z0WVl85xQPXpM30/lKVvlL4YtaZi2mT4IHIWxKthvsWJQj29TYnWpdUTI kn7oTt+UbcKMEgN1ehXixHCEsHY/o7YTnu03amyqqN8lyJDMhMRqARhCmmiVyicekwM8PB13 02IV11lxpCtAxAcdEM3stkRW2zz8AnguoKoqSnlGdSI+Rm0kcHiLHXWbj5GMkHP6xc8WsxMy +14PWTDjV8vHPeUVKhYdQ5lUQLy2A9YHQuPPHVVTkslmHxopF97U+NV9/0zxistJQYl4yT1G AVLTwsSwP2Ogln4Dn7I54+OYMYB+h0ro5HycdwUmKxBRcO3HjHsZ8fWs5DsINBNOJfrgSDxQ fPzw4Ti0sNVaCq84Vdb9y0yao3Op28QH+ZFYNPiVRweKPAmj5vJf6tztGUEdHv7sdN2YHJ/I 5j4/fBZv1v71B04KZbZB1iIXo3gEyY7ePSXf+Z8QlY0IRsnJC7cwluAzgPvNVXq+J/6nXesn Q4GPT6/sa44lNYn4eDgc2S31YtEwF4iTQyN/n8iUHWshQ4VEoXISXkZ/Mz1zmbIHkl9BuA29 HtNvGceMXmMn1h5pkMVo3/CtwzNIz3y8rUTcouihCgAUUXSxb4CyIPGFbpUK4XkrDeD+Y1yh Nilwq/FsawumHQnxE8gZw8CZo/SJbLo0+vydf5aU6+7oHAmzpR35tdlTqZvPNGYZHVnqmsmz 7srnBSGXQNTzAaImv3AeBFo2iH6qLmVyFnqT1yOi7IQHof4RYz3gkyDT/NZqCM4c6dHjbHD5 0rysqRDuG8RDlYhn+w3fbnhkqFt/T6eOND3OMT/BKywNZ7X70DPtFh5tLnw3077iU4q43dIR VW48JtYhzZexokcLX+gppaghxM7oxw4XsaClr8XBptN7fDtvvzwtMo4E0zCPXSXqwB+uc5Vg D4hx6eD79fHandUHk73jw+FfiQHjn1OECntWdak+cHHWj/IxB5Tr/v1ctsb26UgcoULr2vdH xItenZtH9gEr6ikaL0Ud81yZQUKZKtq0yK+QWltc5ErmVaU/9Kdv3+g4iZfs0GdjVOMekYqS jojjjbZoXl9L/k7BS7hAob2yVaFrgZMH3RV2mkExQF4L4wE0WvSKUwURlRrdW5ahPQ+ZRq+T yNJN96WYC/ihzXsRmsz53rjRDuqjG4k82ndSDdq0pE8nraIGiqepQ2hakmV6CuhPUMtB4k1O 0DUvE93KJV9d/QleO96ID6S+FCwWjFVyNwuiqTKBgoTWHTweNo+TIYeZA8hXq6elEE7V+gQ0 EtJQ+gom94g4hXC0dZy05OQlMOBi2HILPSB8QC28oIPbfHoNFdVlSzfGtKeslLaqYON1Kwdv 1zU+u7K8eHk22CitOO3KxWR/tHWIjc1E18mrOOrLTQwwtQtxado3zXPOwWEx36dqS7ShW+M3 Quar62x8yvGK1aN4oExpcqy6s2LgDjMto9CtjIDLldP/2PKCk1m+0TTTaLqUkthseaKXj9mx J0CCR3IpB8EEoFB+BLrgPS91aXFj3vUYuJ+wfr8xjzsA7VDdkYi+H8yf5Okc/uHiaB94MMqO qFpfshx/BYKp3k2OZu9/2Ol5jfxd6JZqqP89WkWR91KRzA/hYTIlZ+Wq9XJLZZOy2laMToTN W6+fkWBHgq/0FRkp+Q+sE1kH1viSLDJFpjAx8HQjBXZdoZIY4D5kC0NtWb+e7a1TMA+VElXv 0cEC1nsnPL86TTwzqZDMEq1xGQ5+4QXS2sYHIzE1b51wzTuCL1I5dKqGnGaODTsrfZE7vS3R 5aRe0mNE+tT9FKy6cODL5GVpdJGKl355VCSun8r7nGK5f3fkHn/am8+xANqE8GdW+vfqAOtM LJnbcN6QrVv60xr2MZSLFPY5nQ32+1dTwvps3F5UShfnIp+QZ+S5K6OlO1KZxp8pCGP13SZN 9Dg3FTNjKb72C7aqkLJ1leeYE6zIKB+87sni+6HiBE89Y1IY0mDixq+JRrfLcHvLIWjNwIEZ Fxocne5hWuLDJSEKisoJ7BdEaJ459/7RMyTPtCmUSNXLHCYI2wmTWJwe6j2MKn9gz5kSLhl5 xNVLtyE2hlRGvHW62mcREaHdlkag0pH/HfZlP63T0e0W5nkGzbYOiWv423K8KHUtlouneG0l K9aeodaZPh1PYGKNRrNuGvN5QnmsSQkWrmAkghpTG07kyn2ErDHJHopjux4dGW7qSSb99ZVE L3qfSFX7TYe21AxUi+dYycnwQwxnEDRqt6srXmmZg1/owgHDuyH6h/o0sggvje47PQXdFrzr jTk7P9GY0ocmM+yarZkQByyXUuClXKIRZLmLnZ8MUsgMCnA21tjUN8luNV0RCB2G/hwdo04N ZaqMJuPtEYNzsA4YNDUxW2rWR+GzXhFEjOcxdZntThZTb7nR/oyGMhzWUeXWqVTda4tFW3V6 z75U1AkYNqfWtk7GfNXqhPP1+t0xuacIlNFCQoh5VKSwbqsJjG25LQzEP7EwgInInH4o0iGi qNL3tGsBnSx0N++1Su9es+gpBTmSMuhyJ7n89Ax4pVRgVfJA3b7yE7UJfYOAhukD051blONF rgSqSi8rhNnYS2b1iBXCIOKMbwMleSVKobTM4H1pJPtZLVVGw5wx/oCZ0lH+yqKlsKJmScZR KqovnhL7oXzoKPm3UZPpV+/WXAEEqhJLfMQcxVcTKh3svgFE65zxS9LDIfCRSelsycpTjm3T vRcRoCazYwVyz3XEAGu5/TnGDbxvnUWPzHOP+sAhFGqgpV0D7DXvlMGoPWNTe04eyi6NS5iS /SZTG+f3sDEMIi0eJ64hc6a+nt69iPplzohNQ4m7617cn3gjns8sAOvz2vDg1qCeyePOFGF/ YaVpEDD7gtvc9RWa58baOtDoapZbtHeMgyaKk0c+4JvabG7sAB8hXUrM0U8V1dpSuaspAru5 csMH/aUZDgJ+B1EiFYBJWFJV2IOwS2sCtgaX8ZCppGgE+zWJ2rcvjstRPiZvFEXEx/jH0Wv4 +P1zMCrlTNLQc3u25CsIKMr/QPaustHwkFpov903GxR6sIQZf/4og8RqtK7EAkO/fYzeVfkp MvusNlYtOZ9lCVWmGrCZg3mW3idZElr6OBKNvYw0TeAFecd2pakJo7Cbgw66MbK72gsayhQ3 pn8it9Mm0UMLvpxC6bRHdE+qj8pow9GVRYgk5G0Xlmi7DM5BfsttcOEY86hz4i7TUy4Wzjc4 ds9x0To3GDivoZ6fs8bNCfqVQZ69pfJ2XaTgIqMhgu47d8aBeU0Gk8cK6I8s1WohZ9/qC4ag SAEyIhHK39EbcqyYCjSX2xjt+VsX8SDswM250yOcIbV2edIBdHN5ru35B82c+AqJHS1iw4jo CBNWmgtHhUx0AcdBTDcyHLy/WoEe8vZQD4hyJTeOU93A0y2gidn3rdu3yWnlJmb+V71GtQz8 vd2KNAJo68Vx4uQtWJZLFvNv0rdQ+vl1lCXZ6VoIZ8epUxgXB7M2X9qb3KBohSikYdx5wt39 cKujulM0EbaVt03lSeL4JdnkWgFgtlWVEGutbj4bA88bjFeTAtUVGDHwWPnSQh/tnLXcFPYU 4UKERbpmwfRat9bSA41H2ObgKnVJmxcrQeeoEIqU7ty47ycjsKLAKfRwupHjdB2v9ltYcpg+ bTxNIF5xfFBgbfJX94mGm5ShJLMXN6GMqKa6vXrmPSaykJDZX3oYeGmCbDdD0CkT5Q82zJ/N 0q9TxfDNqwyvdeAp1/77LHHZ8ZKMHStYqfzHgBhWFQ7OZjtXVbrKMbWODPGLcGVxiUviD7We 0+noeIYwDJfyHO98ccdq71Qgi8MLrA3iBu9F/NCeTAqE8/JR16JbHXOWSCuXhcNRtKhLBa0u +zjf1d78BxzSCkDz4ry4jDc8ofTs+7revHi2RK1Pq0FpiXSxKAZgUAEqKVSMrYfKlEQztf6j 4sfX0A0XYJW14XRLUpkpPL66GzBQzlvmPK4XMyEHbtWq9doiyFE5UStHEFtscL0doxNcQtts biSHflGtYVnS2rpRsTFUOOAfWVLpdJxUCRblsHlDXlMmUMuP7r3DjvhoedgK4a5r27Q46PaZ ogH2mlThf9pSaq5uBayX5YhrkfirNLiTH9kqC12xuwk8+NrAmLF9EpIADiJIjl+L8gNySGse vs8bu43nqri85+ExkizjIk6eB/qovN204jI+jt+UaEpbOT0QhBS6lBgIv3OP8gmoYZfr+cYv 829DAsXcg+tDdFjgJbS0RYvOo/6B8b6m8jsmRNZTeAMoHV9CbGSCA/gGJCafiEN5BjC6s4Ew X2rzfTIilkQced+Q7/Xc9fNPiZpUY61fctqdJkqDTdvY2KlNQUjv+ODjw6xehZRAwfygXYqx lCKVoZVk/OAg+goxP2YnOVoba7Ax+J6Eq6ENXFs6uMR4nd4gAx1m4HL6Mpx/FFWnLSKVlgNN cdta4mx883je+p0ltT5ker2MPz6iRFvMaEnD7pwSXY+BXr9huVIvgH9e/PM8MWEoQbaHtsVO byc3duXpV0K4NDuMjV8kh/+FfmuWkGXzF0tx5vGCj2nl7DFIegYksOH6f9g7E7gau/Xva0LR PKLYImRqz4NKpCINUjuiediaB7VLCg2KBiUhU0KDytSEiqcyJjSpVEKRklQUKiTee+/23io9 /3MeOuf9v+/n+pzno+897HWvtX5rXeu61r3udRTEana3r23e7Du3cNUja9+7yjaPpdrvu+I6 tR7F+LRtwHc3COy42pDYzS3gfbb9i4ihBH942xER4wF79fl0D4J8eUqvd6syLXfPRrLR4ZgL YhkGdIU+3UGKZN28czuruuYtX9Igt3RR6oLcguwrF7JStw0e10/6une6YnFjxj6JtWd6HrR4 x1Rs/3Z4W6qLGNediBv7dqg7qJoYn5PAHui9HpzlitXVx/Zst7XtyZ/6kYoNOLZPzuX8hplf r9goLeucOGVwokxnjVTGrlcPHY9PtV002zX+5pe26EfmNdgWjPlhv0ZBmyxJ4sGi77vlsvyL d7yhrxI6WXXtOD7+4+OSdbO2USR65zwrqX566aGgSMSL+64Bg8/jG+yPLDTyXKkgodZEd3OK M27wo/aU6N23z1CTff/livmCab6+GUqnJjy/HSCSG77IxcOfqjvwVVJ1aqzBvFvrUYZGTc3t Gz9Z0D8ccRfUea7l60EWvdv34DN6a5IcpnP1Bp4vpedIhn1r+L6d33jQ0KOkdL2o+5vUc9pm l2vK1gZ+T5MMpKb4Faziyj73AL+s9HxF86trMU+iDksfFXLfWhReuJ+iLFx5hC7+JJ5f70CQ xZn3h2+5bZgbXL8uTfzCtUtr96q73wvZfDu5kM+Ett29R32t0yJbxRtuEiGnWz6XLf58W4Gv Z/8a03pBkbtWUxszpF8cjNExL8swntz44MaeZtqZDfwFJhKYTjXHrOPrvu0rsdsSF3T3pJm9 lrA+LYd/gV1ywILk6+mLezYnoXduX5i1THZznIV44sPiVuqyxiSrtvS9rzYvn0YJcEmw6lKe qrnwZnd/2cJd+74cbtCS4e72yZ55JOAseif1pnH0D6uwNfUfBhdddwzRf7PCOCwu0swrstIt ur/OOEjbed/e18tcp6yc0/DuQHaCnnaj8ZLDXS557ZI+Db1PyNtte4oEt09qDTRxlEv8vr7t xpHsoDOWc2Us3NMzYki5UZnSqIxTmx/5NAUku/a4hQ/ill3er9C5IlB+ZkPmtROT/UUPR0fb LFQwzlf3/lIZ7YqvUn7fGhNANt4v3LXGu98g+Lj+4ucCRtPfF0+faCy+r6Bm4rnXV0X7blGf 989K33zIpUlN3IDStIMquXnyXcOdknsdnmVa64QsadmqnrRNLDXrzFmZ7p4pYSFW1w8nO+ep d/cUP6jRmF6vY6wjte/G1LeF5U4lMw4RrGbUNvLOkQkm3ExzFSkNXkjQO92Gs8pV4o8v63UL XFOarXJp7RKTPFn3BFpH4fxbM5vMzgVPwOwm3Uafl41r2FIfJTbX9fDFUN11tjt2B+qST8UL i0i9iJbf6uKwwDhce1FTrcQMgdgnTw+IvTE/ueKJQaRgFPaRT859/zeEJ1tyn9rdyR74/BVj WuwT5nBg673Fh1+eaBk0cJv/Xt37rovhZR1MEO/tC7poD5ve0KAUpOxipVY5IYMyB3jvTqcb PcQLdW0Te1/WUhxqm3tQrvhZ3pGZ1qV1cy8fjc8ty7R/P9smfGVRi0S3q1rxa9mYVDWbnkkP NSxce7gxrb7OiFpW1oXFuBYLDxOnGdZhTTPqYnwfP/aKmd/G01kRVGBW4unsez/OXGH17f6O wou3rTT49xip12kcdXGbYa2UdSCva2Z5cHrwwOxmsYinswbs1/CfFveOkSmu9W1caCHIdcVA ub7u1or64rrHK/YVxaZbntCWP1ZxpyZ0juAs29tXJdwzlzRVXT12X7LnQ5FDa12VAM3NjrXK CCHG4iTGiiTGXwoOTWKfww5buETd7kFDKRlY2zP/9aS50VG4oUVMhjQvd29PW5oXijh0YpW7 Gx257oViLHxCjvVodo7W6u6+KFM0coJEwaKIGKy5wPLl7Ocwfsd+joGnu60RjY4yRVBDC3ku zZeOUtJ2RR6szvq7ivVXG2XOeJiLu6eRh7UtDcX4+SovDIrEeCySPEpJ05e+2ohuTR+6thq5 hsEPLb1iXNVC8sm8QKViUZShvFKpeBSGVTAqlYDcz0wMYRIKyzlPQeEZRRlKxmSdjRPNdigl bVfkBxgsMwfMIyQ3jFpkHmAZj8cMpaftSkERh9JAmITCkzk/QWE457FY5Besp2q74lE41rox 5C4Skk3mFUZaWBSW8xsMkmksqzTIFTRyH+cIQ0GOOJnDoX7eR0YRWCVF7iIjd3GeREThWboi V4jIFWYJmEc45Emc+wionykjJSAyf8RMDqlc9no3RvVQWLdpIRlgJ6bFKAKruWgxEqawak0L SZfALJsA4wIKw0mJhCJy7mHkmK2aFrMG0Kz60ELqmfQzYSyKzMqXFlJkIqvStRgZJnGyxagz 7M+0kTrD/LwRqXe2PlpI3RA4yTHqBs3JHR41pDTzNxgU+WdzMbCm02mebszmYoBcYWXbAMka Uw1mwzVysLZzdLNn3mTkgAjFypyRA6OoWFbSyBFS0axnIgdIY+NcoaAIQ8kxLqDYBTByQJoa 5wdI62I1ACMHpAGwcoLcj1xA/zxCZEazGoeRA9IcWNVp5IBHYTnpMto9+ucRQwJO2oyqwbAa EXLEqMKhPoocIc1mKD2k2D8tArONjFozSWGLMMaiSZZ5YndFJSNvGzrzjJa7p+vQv4w7BDAo JXWmJSIgNYVj1B6G0aso5sPNGIWV8dWe7t4eQxIgD/C0dvPyYBg+2+2ImTESwHC6BYru6Y08 Sge1xdrFi7GAc8QaTsl9ykKBKAle/3VZ818MfO4l+hhumqFuLb9Q471S52Wcqeh66/iQOO7k lQmhy/fGZb3ktvTS+bK9aFBD+ZpOBIXv0Ww19Xm7M5O2FE88bshlGVF19P0uuQC7x1Itv9pw Zg0xAcM5xSjL39nWv7eqI20aYvgw+KEWiJTsp0rM3jtKJRy744yHShgy0lZIjPECUYs8UqUh 6zd+KmEQlUR4/S2zlCa8Q8X3EX02s2T68f6Y49WjJyP4JGumrJEJ4jnKu8T2Lr9yW9yHwb+e Bl09L10/w4YcqvidJH63XYSYsLcyhVtZ8uK+I3uOCC8Xk9ryq0zMKmKKg+WcYhTmj2VCuiB+ qO2OkIlpWEfJxLbb49OZkO6KQ1oakUxA4UkjZcKy6n/8ZSJPnnxvWG/6ofSO2ZtehlhrinCb rPkqw5DpSgtLpm0k9PY3QpNsPqbanewLWGfxkJzMTZB+hTYfVNmVSJSO/lUmZhWNlIlZmD+W CbGNhCE7PUIm5pA32uaxB7XxkAmHDPc4EhkZzxH/BUscafNYRv0/YfN42107k7OJIbc0qGGN TffclHGSopK1vCZqKw9ybxf1nbnE9jZf/uu4Dx93DYT7oC+4imgY7Ngi6W26b3N+gsgebsH0 FUvvkktJ/a+E66Klu8cwe+zOQ8FzTg1v8r8tFDJssQbFEUIx/ZHRC/rZo/24mD2kx2KRJ2MR s4BDk0cIRWDZ1/HvT4GveEMbi/UXOq9aoKsR+uaH6rYTS7akyifeyuS7PnMPd7zxyuZH2A3x lTpuik0V1+UcBoQPbrx1kGqy6cOG8kfdiySMMs0XVnq9FK1W+P6Zq/Kr9KMxggz2gEEhcE4N b/W/rRQyTBDYjv0wpZje4iil2I7I+CiFuDwMy4dBLOBoyzfk44yfUhShQPRUXn+LLCUPdXnr 66ln5kgS1BVjJq/m/XHviav965W3djdOSVyocXOtk23NPr75z+I74t73mwrXPDcRxTY83RS2 yivcX+3yBEEL21zJvHTem76bVAdzeqUv/KoTs46Guhbn1HCP7Ld1QpxXwhiOBNOTH6UTcTxN H4ZCROGIiBOBZZg+wgidiONq+uSGj1BkoTVvftq+75b46nJdTQ2+ScI9U6WCch2mTRFKo+Qe yhjYtO1yV3XI/WlvoqVtPnq3xH+3xS6rny2Zln40sKez7TO3cbrUwV9VYtbQSHePWZY/Vglp z0PBw6jexAyxRnenoQh5nHTCIzEQHnH6iIgfQ8DhRvYnduw3PkItok6mLqCiszJ5bbz4VuF4 +MRxoYnUUI9QFb7BwJrElprg2Ko7sqGJuqexq4x0VFfN4eNBYrrHOCJPezWOSJiAKe3V1V2s lxfrJflJ1StKUMLsQ9C8SdwTzLOlcsfoUcxqGjlIDRXoT9XCIdEqcQx3YigEHq0WelzHKSSU ZKiFQ+LeX9RCj/NAxfAoRPj81/Xo31gdp+k3Qzn9guAZtKhkYr80tqtUglfCIfv0/ZU53Bin W3umeOoRzrYN9on3vjneq77fQDD7lsd7XuW7qlIaCXuOzj7ign99/eRt4U1zpFLHkIpZRyP7 1VBp/lgqJBBnmbURUjEnKEYpRRpPB53RnTFkxjQABXEs8COEIo2zg359yPwV2RQF3pvd3Dss jmqyzT15LFiSrxbX6bDygomUiCxDKj9tllQiG2Sqb5fwpK8oM04oq+SOmNpvXlrp5RPSHvf1 K8+F/dKhv0rFrKSRnYpZnD8WCosINYY/wZw8GiUUmT1vNB5CEbHIGIVG7B+BEVGN9PzIrPmP 8fcn0PouwVXVlQcipp+RWGMW/uLH0ec+WwTEBIK3ibybzXVAscGvZt+0+Q2KdQTE8etMO5FV Jbqo3i2trkmhjfyNyzCq4cKkhh6Rmx6bVHeeXS/t/KtOzDoa6U8wS/PHOuEQncbyJ4YnzvYn WLM64zNOEYf8CQLlV3+CxJoe/I/4E0uzcrOqHzSICIivn/014JGuMo4PJ/DXQo1pi7l70/in CB1VfHz0EuJP1Fx0XKx78yaRGva8bv3kvv33nzRuw9zet0llT87JNmnjGKn9Y/gT7Lmin3aP WZY/VgmPqDSGP8GccR1t9sZzkg9DQgJeNBGFZfQqAmmkSuM8yXce6U0ivKqWWZYen7T9Z+5O EtBbw8fP13Djh1dn/cn0NWmVQdaPJ9i/kMxafJq2mPyoIt/1y67G3hVPWzvwxyYrkOcRi3Qs IhdzeR5wzZX8ZJQ185VC7yeu9G7pvWOYPc4830+zNx7zfDgCErSM5UowZ8NHuxLs1yHj5qAz XmgQ0TjGSDXSlWC/GRivHvVziJoglN+NeOiX2R56Uer1rlJqaRr60U2TKfOE+xY+4N5cHMzj 92BJa8euWjlX8aP3FQVQ+Zl3Tl0sqT5loKr5zjBoZqS3jH57hdJjLekXY3gTzGoa5fiNmJH7 bbWQGiON4U0Mva34xU0fT/NHxDIm+sjIMIVFETAjzR+G/Spq/B2/CXmRkZ/YM367whotSy7j PqJeBFVO6NCK4VE+FCI5/1PsWt3+AddJDyyWiClInb2VWHJ1bW/jGh3Jg21Lt7yh1N2lP3b/ zIUNkNIZy0f/1QAOleaPpWJMY481P8F8lfSLVOPpoxMR3xxDRiPhNPEX1w+DGWcfnSLG6Fhe lhilwNaYOSTMwZL6xMkXxITX/niPPanfvztkUrRW2gq0QGNYyRQHvkX6JSmXzd71PxW6fLJo mUA2qtj5pfe2J6g6HvlrDnvNZrc5cZ+N7GiflL5aet9YanHc9GER1bi46WRErTG8Cua7vtHz fuPp/REQn5Mx70dEAoJf5v3G2fv7OUEbeG/jsEmKxqY2feUcQX7BcmUH+9MLbm0S3c5VYHWX P/9QwkPGRHphzoUFgTJSVwaNXq7+EKCE11RuEaBsFMeY70hYHvNW2niMST+O88eZR2cW5o9l QmIa1ig+KvAda9YPPa7Tfng00/5hEP/oF/uHHud5v5/2LxMVGVgQdZJau8fgaNisxP5t9xn2 r3mlO+GCsJVgX9q0RfppCnWH3iM9qsZ8sbiDRyW3MvaqscRfPksUiHO2IZGV5pZqhabPPEs6 pZiLPEYHvpxpv2GB73jM+yHVxQg/f5GK+Y58lFL48XyBiEUCXzwREQnJAYE4cn6WvbDiPzBO XQ/cwZmgUNN4r2TXcGy7SM+KKK5isUP2aL6afZLzW2KdHzAGqreNquuCVdJutoTkFEjIlvSZ OUh+ihFoMZtqe61B+XtQoDT3r0Ixq2hkj2IW5o9lYswQjOFRMFcvjA57x3UiCTG5jLAXwzB8 o8Pe/9g8UuCi68Gf2PMTiDvR1Frgs2XmYt/KngnzhH0m2wWXJ829QH5Unn6HXtTkc7rzgaf7 mhV+mhepdSbzNvJozV0jjmtQjLzr67jzC1cajzR9jLj31yGKWZw/FgqLCDXW/MQYE7Tkfz0/ y16SwgbmWQzj0NGNzlaK6uji6GbPvIRj68ZoF0Q88h8jh0Z0mgfjSGkTh/Ss6Z6OjPuWMpeT IP9jAGI9lxIZcRkOg1tKwVLw5gLD9eaUa9RUbaXwmiVr9ZcsUNQrXb/gAa/A0WMLZCbMPrS2 3Liyv5SA2eBxf9JCYd4JYWsE74+hBNvjJnBMG/NBf6wEI1wZw1dgruUZ/TKXvW7of40SRCxx KY7yd0pQOBb7nymxnq2EgeCDMd7Wso3JTyWYD/pjJfDM6c1fVz8MH8CGrRbEsIrHXmvFrE8s 4xZ3Tzsv5PF4ChnHXJbHAjIZR0GiAeTBGu6uiB4Cpsg1DONY05eOPAz5yZDJGfoXOa/l7WZL d3R3Q541ZMSGh9TDy/xPsoUhYbFMN5cFWCRsJv5utjjGnj0FNLxP/JNckUgkLHNNJAuIZAIZ /bu5Yi8I40xu/G5djWuuOHaJ7cQO7+L/JFdELInMnP5kAYGEQ2Pxv5mroWFvWMMa7lr/k1wR 0BgcMzUW/FFz51hEtnvyu+0KQ8LgCWjGgkwClsR4fcw6xhLQBDyBKMDJHuqfZG8olhpWab8r 5ci6Yh1hSEQSGY/+zbxxTBi7mQ0f0/9ZM6PgmYaCBX/QzLCs5bTDg6zfzRaFgGUIiGYDnoDH ELC/mS3OCMXJ1vCZtd/IFis3rCMKmoxD439LSCzr/eewPvC7WWO3eYbJH9EbfjNjo40+cxHv H4yQrNbPOvqT1o8dWmc8QtDfzdwv4ySORML/bvMfbfuHFjf/QbZYuWEd4UkEPPl35fxlBOCs 3vm/2jVHDwFDa77/d3TN0fafuQT9380abljWsEQsmcLokIgDTWSO6awzAuwzWAqOTEZchf8p o8yIlfnPyGyyvwf4ObaPtQCHHeD9XdDNdJhRShsd7RjLs5ExCqW0huZo70BHco0nCShpuyGR hoc7Ixhhxc5j1oCetZcz4myyYhh1R7qXAc1zlburh7sb42MgMjuuEfjb3Yw7K4MYGygHnh5M l1YMEeCZOFUGbXUjkAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4L8BR+WWiTC2AprwIcA1hHeSkCzZ48WN IB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAgP8ScHVWBjH3Aor54TxnLlQLAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH8d HPZG8zH2Apr4xbTCZuNsuxuBXDwTp8qgrQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6/gEwh 3k63CVwCNDc7L7onzdqVQe42TgIYMh6FRjGIiCER8OzTOALrrIoKSkmX5mZPd0DhiMg5Q5QS dbsHDaVkss7GiWZLRykZedvQmWe0Xa3tkT8bHe2QmzEkLBaltIbmaO9AR5FxaOSyG53m6eHu Yk2nCdA9vZE7V7m7uHsaeVjb0lAYCmYocSM9ay9nFBaDHTpUd6R7GdA8V7m7eri70dyQpFBK Wo4uSErIX0ZSGjRbdzuawPLlAqxy+bL/XyACTw+mSyuGCEAjAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiv Qp7cMinGVkAyLe6q4SdDY6BmOOAhxOvxcawNoZi7PA3tDEXCcfaDwhAZ+zON2hAKQ2Tt0vTv 7QhFIVM4O0IRiCSB4TtCof71jlCMfar+xx2hBIbvCIUaviNUVyWGC2kGt073rnMVFA5bYQ0t AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AADgH32bikEn9o31berQB6dMwpNIRM5pEmGMj1NJjA9Z/92PU3E4HOfbVDwB4WHfpgr8629T WY/6+29TUcO/TRX4m29Tu1wnwbepAAAAAAAA/6/Ai4kT38iN6bAwnRAmUSgk9lki+ld3hbm/ xr/rreAxaI63giEQ/qm3Qv4TbyWIsaHK7dNfjGa1hBqAswIA8LtWY6vVm/qxrAZnrx0yAcex JDjKGDEOnmFJ/l2rQSAOC3H+hc3AYlkpM+5CTIOSIQ250dGHxrzH0ZVG93S0HcuECIxlQkZs xnP42HYPM81d907FeD+ME+SNc5790O2F8MLDLobakiewxXvdNsW1DlztsXl3W/ZwTDO6c3q2 laH21Dh8brH6BXSmNaZexms3l/9OG+04rSTbd9PKUvIrytvKdq+U1LKr7q15V/e+/1rR4ODO gKJ3pHI77JP3ESLBW+Yd1E4x7PFVmR41cceuorq2Xr+dyy3RMvvuJN6nL1ykMa98Vq28goa6 Xaz84fJ52fLT7nssslTZb4frcSEqZteHhE7upiYnyZ+U+GD6aJ8LrmDBgrP9pTXfz9CIgm8u G2IXq4fR3z14vSLYqNABR8op9sz9VGJ+lGfvJJReGHVtctoreXEpx24tk41riQOFaGXx9dWa uzc7zhfjb+3zr34/U1E1+1jw3G3rcMfK7mDTFxyym/PIBC0iOCCmaL/YWdjeTPRlFP9Gs/pV ik+pzyT11hUbvltTKhftZ7s1QV+Bt8Rz0Zr7yc0hLrGKHqeC7efJbI/5YtyypChA9eDu4/4T VmZRsTKRn+ec4ZHqmWWfOpPy2ry/p6XMfVNArX1h8+OsU582XerwHrx8b6t5xqu2nZc6LLLM bWUGNU91vRcKrS1Qu/Zx0b3INtVJXQe+e/iJ+WwiBFDexmza5cRHnLBgrZpAqRrN8Ux8hGdV uCbWSLFkyt6/5I/HqB6fejfWUlnMv/zu2/28GZ1ez09nW17sp3r7zy3oSpxpn9U4r0DFIn1K 3PkuvozpJ10vlWPr0FsdMwZSM5Y5NWX9GAj8MWdd5THRly7zjkWn5EzTrHesTLJp1arl+zQB dW6FZlv26uBn817Jv9XRP2uEOXS4PMLLIquNmtkaM/i1sCf/+WuKX7XK7bBkQhl286K+p4vo Z6cPhjo9z5cva09MuGmzO787ZWtpVUPk5auR9D7DAq+Em9vN93+cmJRytaIWc2imXvhk3eTY 0w/TxWXI2HuUaysas8tb5XE6OFGdcCuTkGp1i+ft9z+XZ7hEuZ/YapnVqDQtMdbP8O30Exdn xPVdi7T4QC3sLPhMq7Ds/Gh24fgFQ3+dmsaFF1NeGDcQNjxyVXqsd4iekLFBkOpcanjE9O3k sup1Fim5z/2smkMP6ntNvnrrdPOp5DB5wcSle+qx1bcEY9J914bYyEtoz93N37P6hMOODiot I99kZ6Fv05cnDY90oqK3T1x9pXxD+hXL7xH+CdYXqN5ucW4v5AfTkrPinJ7T5C5FCK2+eb4l 5SX2ZI5LUSp150ubx8ce4puo57XO+d0+vDkneav2wLMjafOJMxPI6Jbpwve0ZziKVgiImUdk Tjou+21t+Eor/ILgHnpxs7jSrpPfOyw+Lr79gnbujcLb+05R6VR/v7jv9PBdHnFbLuRVz0NM Q8HVJwXSl3wf7vgSYOpkMa3gXIV+iVm1s5Lv4OD5q879yq8LsQrtKh+u+0VerqAmXlnb7R6f homWdlSNnbdjp7tHP/8pBa23Ze0igs0+zwblklD7wxdkdln0PLN/5OxXnBL90iZpo98T4wu9 h+kDkYLvbAqSnr1Iq6Kco9ZaTpu07VTErGk6m87ytuwfyI72qJohbBobmlHNby0brrJD/lvu JNmU6c7a6zJNbNOpgsaf9M6EZB9Zt6H/WspGo6rlFVHPXwnvnGZnQtk/T8xz4sMHFD3FsNkn Vgqrb1veh+sixe5Sf9tbVlufsvxETcdC7OeH1Jvn9H90CtWZXRysmjlwcH6ifWj3Ho361/p6 e7gvrShp4/fT2nnwZvBG4pvwr3J91L7c+fF1aV91RMJrPbXrnlTpe6U8Mq7qir2m23pyt1fN 2eknd0ZjklXFMx/eV9E7G7TpzldXbbuwS7hCl48vd2k3WT4TTzPY5EwdVFt/4vW76waPKSqm 7ufRJpGEObRlXmXna/drrXrn2yyccX6bi7tpluPjDxdzM5p29Tc87qjNsDTtbrjaWtjUEXWG /pZw/nP+rqnSOnusosrNzn485CinYP7as6vE5ZVGSrnh2Wxqx/MZjSofacefSyXvkogwLFrS uV9+8Fte3mbna1S1xdN25ODjKNm7zLzwCQ+VXb2MbWMbF7eXKkxvu1KcpyqT9WX3eZKbi4OT i6treoap4cbrefnp1u1VKVFRUb29vTVrky5dii4++0Xvae7z10fjsXc19U5pvp1+aUN+JL18 7V8Zx9IM9sd5Rx3yOf7gsXjrMvtQ6w/zBkPv3fMSK9uDijFaOXN+5M4Xh/KSnR2WOqY+jSw5 T31F+zqF5uTVrhMXsTMhv2HFldr1tmjznuNPpu2Lvj6vzvWJYZ2Bpel139aI1os6J2ZMny4R UlZWdvHiRSs3R8czegV5hY6tcd5B2hlqhwrP1Aldzd9sn7X18ub3LeeqTK0NCy9vqFHWoQ3q PK+MzpFXsC9Dc82qSDF2CwtYLf/Ys9L8CUU+dXVShq77ko1R5vlKRzr6lFOaJj30+9Y6oHWu P+GvWx7l4uHHui7pPXXjuX1xyusMiys2T6pqz56dl7nkoeTX/JTK08+qCm2+vD4seup510fL DMzhrhnn3/I+NkivNU7MOpK2pOQKt+NWR5dWpw6Vsu7mJKNCme/RseGFU+ZQjKMUsos6MRWG etQ3e+YmXX9mdXeK1zXZqfIHWvclae5ZH7si1K+5gfTqu0lV16mGy9s7IiQXOR1Z7OR0wTLb Ttsrp5POd5RbrF5igauDQ1Omj6bKckpCtNnAcSPDp0qG21+fk6Mt6198JcmEprnFN5OK40rJ 6fXJboraucH00IoI8R5ZOckiHt+5irvO4CyTvQ87P0otMKuYzu9zPTmntF2mSJeW0e4j4bg+ uPctj2gq6cWJiMsZZlwJV2krbhah8816srkPT49B2fMvuaKTm2Eyrdt/4q3vJ4TyIqivYsst 3fbFtj7w9qkyP3Zz/bmcm4bHnOIvhsj6H95Kl48gvrIqe9WCJ8tWfDfuD0n23uiwdM3xHmyv SXrt7GkTt3QskT6vkiLXYt3x17uXDWq6Kt8dyfpoLZuO2oumlz1uZm/Y8exZff1fvutVbxg4 urouUTeOb6ytndjWqzPj/bO8x20Cc2PbU4seLPbbeejiSr/7IaUPlEvJlxKf8m/ecU/INOWK VHtni8f5fbiJR3p2yIanKcb+FW53vud0hY1vx3SFy0rvZBNSZyq1o4/QhZ75WrU02l5a1+lo If+tkKKW6fqUKF+QlWByztnV9Wnm1o7XZSdILvWZW18VLzG9emFTjtZs8VKdzdJum6+3f75/ 02VZs2RzmkLmx5DBLYPHFl2/53Rtz0NlPV+z4nRNlw0eng75WRXvwuyqn6AOalZ/4NJY+iRG UXawtYNL+26xqnykEd8pN+2OUzQPi2rctXc760743JRIztAo3fntzn3z6wmOTg5zpUVXdtRd 8n97v0l22Y6aVs/tKgkrUC/oy9S+vkl6fn1bhmXRTMzlK7VX8Je/fXQP6P+SlasuGv3JLVXk VHR4wA41n0HnS5SGA54qabm7D37Tzg6uL9p+u/U1NVYoEDfX3j//TsiRb0V1c912RMl5WUU3 4jKU53ZdMe8rvqHWO3ifLGZnYkmUFd0a4PC2clbTbjxW+ECBb0+z//uC/kilwqPx8fHHjzfr RFQsKGqaJRCax4d2mD1NFTWhsSHL9t7N3ZM2CR30FLsaUu3ui/3YND2PXpRy7eE27baav5Zu S3mwI/KdS11onuA9Uc3qitlGVnqT1NsvBb3Rc89L0ffSrHgRPOds248W0sErYUT5JXLbdBt+ 5CTZdjVc/DIh/8f3AbUf37wKP38dGFBWVnYvGuzrepqb9FT5/V85SUm2vr5kqUg5ZZ/OwoF3 qyae35ihda0+7fHboCCuY6jytqA7dw5V7o8M8PVK8wwIWL/xh3GG77KJiW1fyIcEW54dayJ6 7U2NKdH9mtRc9FXz1UDhyXvm85/3iPRIxfTzYCS9jumtUxuk6swIT+Obx3/winPdTFW/QxVS MSo9d8S/1M8+tODOAI+wSvfLvbM+vPT43G1d0iJ5NVUzUupKbu4c/g2iW97YGWpgX5r0nTT4 9Gjl0+O7eZQSpNGKtq+SlGYejT6YM3AoTKvV6FT33RBKzOu8UhmM6Do72wM3WrpX/CjfO8vF 1VLfLJdwhZt/boVqv2w08ZjuC2ufRC3FF5sKd1DIm8qnKP2FxuNDnhitU9VUy9o/oUX3cRV3 zavdr9GnZD+Eyy1tPqNRekSkLz3+urVYzPovRnMq7LGtfETLafl5AgJu1dqLg5946Cavs5T5 1jsoXLPU2bSeWuSn5z+YaHp06+Nzxqd29k0zvFOkK7g+kxdNP5GUw8XDPav33ZOc+bJCAV/b U7szUHemzpDqzVD26Qvw4lq9p6plTazIamGh1daFrz9/eHE+vlouX2Hw+RcjfcPJRK6g9LCw sFKJvYr/h707D4Ry/fsHPrbsQlGRCNlKzYwxRiEJUaTQTgjJvpalJGsREZGoSEm0kBZpsxWh aBMdFEmlbFG2koc5lb7n6/ecnJ7f+X2f33n7p5fbNDH3NZe767o/789CU5Lr25im3tYrmemu 60x9FUJ9G6P7Hds+qv920XbSMf3c10e379JfMXtnWsjp2Nlroi9ddqpfel1ieUq4RvbVj082 kKIU1DcI0za8c/ry8YmiTcWR4PvmJprJ7Dqy/TlcNOO56if7eioFCtlqnnqp7N/j2nrQ+5XO kaU0Vu2httDnF6lzTbNPbVtVW/bk5Kue5mXCCXYWEydqSNHYbVKYwnYtkQ5fJBvF5rhp95Kg iWL9Wiw+7Op3vUSEL67My93q+ijltedC9/ZwLoH4UOJMfxuF0PDPC1hOkSUN+nsPmujeIsYs 6p7DtFc8ft+SOv8Sv5zT3pafMhOmUDMnWJpu8C0qe/UklbtLM1+iv6Zt21QmLjbXWYO8WlnP t9U6uvBURk3YHC0wu5A/6sOuuK0WKn6lZZfjPp5+t2GjV5fZ9Rnu7UzcWmQ/lZhXkwMim59T 3JKKycublViNCyIllevc3B7ZXaKdMmcg0BypGyT5/ZV4AziWmddtrTb1mn6RWNz2ub/bs72O vTuIv3/pSrbB64zrnRjC+RtMzq5mktDtqzSxqn/xds7Rg9OKvzxONyLIsEUv1w5RJ0tfEI7Q DhDxLJLTe+ZaIrJn0rnJNZqPnt3YXpoiKZN/J+FuI6sc2/mVTi02yjYVhxmK7hLzmhWcFz+T sp0dkMQu91a8ijad52GDRKQK4wx1fpOsE5OvrL/i0ng8Us2nvU75lq5ggPuWIDu7kNuEZXbJ 2dq/ndnz3K6LyMEYYnj7k4q1p5TOui49sWmChzt7ClhFkx9m5n0ZOGRztKBehnezzH3Ort0z fNiYJqh4vImKfr3oVLKhiYHwK9vZOV68s6YEHeywEuBYPnnT+bXxwSwVQZP4Dyxx2aOhExkY GGhqarpntfKc89vFO/bv51PhSXo5t3WdiGJRwOqnbGv52GKPRTH0M8xsnjmYdWwFd+pkl2yZ jf2ueUyxjDOvbWsb6GuKPLt69jy3zhUcu3lvBco9834tMpnzxnOpu4dpAqu9RV6+mX7qsE2+ QfJ78ak796xoWRl/S2zIaMbdrLXWqQpV4ZHvDrH5+ccd57sgptVw7PDxJZFqn1ov8JbT5ky7 unZy5i5WMyb+i5M7H4UyBHPvrWpuVpq0PniVnZtIZueAHlv3YI2M0PHdLsWcZTOCZuRnnplM 2DVTWsYri3XGpQCTUq6pj8TuR0UxHhe7c53szZHqlCP8VGHvizlPjrJSjQK9z5dkmx9qkdc6 3ZDG4CB1m4+FT+5I2LVYs8L3akKBBoJ3Cg95nlx3slfh4CYT3td6R8Lz987hZZBY+SHUYSdz WjbnrtW2vEsarHif9Nm8uDV1efxF80M3U1ocryczq3EPlDrImMw8K7ZekjQo669evPpxqpf7 QEM/ddmKFQWSwVrNooOZEwInz7m1IFDM3MWwyVOyV+I9jxejfCaDZleNZaTshplz9JMmm9fJ 7TTW1DrrwlMRYPVFR7qTTdVudYHYRLW+hqFDr7uHzu56d6z3Ru+za5/ar7mGFTJNZdN9QVoo VVQ4Myg/kDFRe18146pF5BZJdvMb5gWMNO++xt3PfXtNrxheXHO/wyMgIrrStDVkyb7pjYEB gyyeLnPS9CsWvT2hGaQZkJoUES20f0WWsZDfzntihwdozG4a5ksa1rJEX7exCUhgTXdZ1ndc kEq22/bw/HkSVeRE+aHh/2EH6i3TX6g6PcR2KI9D9M50nmlJIeLlKiGH1B9mrs2WeBRSGxoa 2lQS6e7VNIch50Cv+6znK5zSqlsXsZR7JLY48mwf+V0mnbSjq/mgWWGg24A820c/QmiI4tUx lq7pa0sjoigSR5ehyGMtQymMZxmKpPjD4jWZNM7Fa/LXT391q92W/Z+11Z7POuFx9phbFPST NyIylTR6o8VYp1lpXKeZSqF8P89KNOVxxn2TFX4l7puBm36eew0ceZRwSwUAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD/J3G9282t2McO+f6WoEGi KiuPZmjQvsX4/pihQRvpYPLTXUkUlX6hKwl5pCvKr0elOHKJIkIDAAAAAIC/givcXDYHxrx8 ol8S0QPISArKo0fHSiBTHk8CGXU0f2yE47t2UvqFa6ea89wEAhtjVuK6HWZDUUIzkjlDY8J5 xdR3qSflz2dkZhshgeEb/KsZjw6N+L5sp0/dAYkfv0ZHDZNdrtqWMV44+qtB7xNB+35McayX jd5w5u8Kbhv5BhDcBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAPxEcBs9F+PfgtvI347+EKFB/hpy8XOxbWTq9wANEmm80SMKXz/9a7Ft/oThj6Lk fiPRRsbgFQjQ+Aegj4npQsxY45s+aEegSCJ+H/MKI6mAfwyIUaCOJyBGkTg6vIffLOMc3gr/ M6mE7Ab/pHyYzulTH3aOOYfRTx39bCuOhidRR+KL/i0FiDaOk0xRoP0wh5Fp40wBoo+yv5wC NDqJvcQcBgAAAAAAAAAAAAAAAAAAAAAA8K97g0JTk4TG3vse2Q0aEZVCU/x+lN734o8bR+Tx bBwpKv+4cUQb7+7gr/TdQM8yAPjPh/9QPmHBtDFnJfpUMyJlitJof8WRWwb+OCkpUcYzKRGV Rm/JUaSNezf7F3ratP6+m70reTB9imwQB84/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPytiBeZzzsSBUTo8nMMYmblmU5zacj3ZwIAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4G8CQ9t9 BnYCgbAreSizlu8NMzcikgAAAAAA+H+DfFuxU3cIDBzWTlbuHm7WFo4jct5kx0FSoogRxUak oExUpnw7TKV+PaqiIjZPz9rJxmOLGFVp+Jih2DxjbxdrsXlrDTbZWVt6iM0z2rrJg35E19HC ZviPNbZWww9WJNLE5ulY29ps8RAjKZOHv+rkYe3m4uxg4WHN4eG2dfiBi50dnN2MXCwsrYcf Qfr9uY30LdztxciUr59q2Hq4r7B2W+zs6OLsZO3kITb8pNq2DsPPNPznyFNpWls6W1lzqKlx fP2xvIYvwPxHshiLkvuNRBsZg1dYYAQAAPDPw5d8gqfKWLM+fSqnT/8KROL3XwUKI7PuHyZ9 kgJ5HLM+ifbDrE8mjnfWV/iVWZ/EMDzrFyZ/NHBkN9ijjln/pwYIExOb85iXBfTTTr8sICl/ P6g4coL+OEAURy4gfnqAKA2f5G8jRJFG4/hxhIj9+QhR/LMRwvHjCBH7P40QNjOMEAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD456Ijn9DGM2ZlFb1e6vcaK4oC6dth 5ZHKpj+UVimPFGH/bGUVRXm09I5CGm/l3dfS7l+tvOOch7qqUeT5M3RojzUG6Cd2BGTl7wOA Qvv3AUBRHk/F/Q8DgESijXcEfP2nfnUEcIliBADAfyT8h/IJC6aNNSPR3/70qYmiNPqb6luV +L+U+47MUz9d7ksikr5PSso0yjjLfRX/NAbk58p9MSkBAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAA/0BU+jMklIxd6/6tqJlEISlTvx+mjVVYSBtPYSGV8r2scITj KnWmdzH9q6XONee5CQQ2xqzEdTvMhqKEZiRzhsaE84qp71JPyp/PyMw2QgLDN/hXMx4dGvF9 2U6fugMSP36Njhomu1y1LWO8cvRXY0Q02vdj1DEyAkj0Tu0/+7IpUEe7ryoTlcf7wv1p99X/ rkacgZtejtlr4DiRlU8G7xsAAAAAAAAAAAAAAP73woVGFD435moYfamGnraloKD8/Sh5rFUd 8nhWdUiKSsS/nv1IT/lC8h8A/OcE9b3OJ3R5jDmJ0GcG+sIwdXRBnZ7f+sc5hJ4o+tPpoQo/ rKgTieOdQ/6H0kO5J2IOAQAAAAAAAAAAAADgVxHJxHQ6YMyFle8NWChkkuK3o9+b9fywsPLt Nrifa8tDGl2aJQ3/zfGtq1D/tAHCf7eu4k8Y/ihK7jcSfRm8AssqAPAX0eBq/qZmrFmDPhfQ V2MVFb7PJErfmqn8y+3NxPHs6Cgojk4bVCXaOPumUP/0Duf/rm/K9xt121oZcKMuAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8PehL5/wJmbMoh/6Xfl0kZSVlb4dJo9xA7/C eO7fVyArjlb9kMYbUE7P+UbONvBTyK/NJ2SrjjW66UOWXqVCHA2RVxwZa38sTlEkj6c4hag8 OrqVaZTxFqf8ad7YTxWnYHQDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA/zuQxMS06uCYVa708r7fm9yRSKOlgAojlXh/LAVUGGmD97OlgCMN7b4WAv5pbzsydaSq 1vD3RzkNP6Wh9fADbbdZ0x9j62jt4WZrOVZZIMdYRa//WhYYb+tgXC1QIqplayw48+NigZQT Fw2rqKsEtE4J21r13HCYEO54fdMkGWONztSUTf2/7bQ/vZm0gWS+JV+quOaWw+b9hEWp/AyX 9B0jVTcWNz21Uel+Jd/9qqd3R+zBFkqYnEr2KtklPUe62691PBvqT2p+1hvUt/TmpoahOP+g +/oPYnjr+Xxl+InBRK6Zeny3k600pjZevE/xmG90MuHtxK7TtUxvwkMnh2Vppgl1EG+bFz4J 3sx+lM82ZK34YeGNH+5n8ebl1i/Mkb3+0u15bsVG03i+e8YM+dFSfhqKd+MjyottQ/ksThSo 2DFFspk6t5Gf586P9jzXlHO2ja+Wsmqq7ozNO8qy28qDr3Sk3j69dW6zpqZyW9Ka51WtU1aI 35UMem/jHv+EX4Pl9dQkqt+xA/e5RB5uqLuZs37g5HR9mRJLdwO1NstwgSlxCRQHiZIv/dNy 4s8v0T1/1dpKO8L+bcub8hIN762+B1kdVXRnBtzSkJt7l0ZrNLrkMKVw+fpTV+18H0p3rd8d 2ySiYL87VmEgeu85v1nyFlrTpj+apZP45T2n1IWXjgc9G3OXp0oRB8+ovYus3On6bPuF512p a3X0OczKxGmOQ3z2pAVcjSvs25Ruduuqp4fe7Llplj74KaC7/vUEh2vmhoofrtxLmWV4echd zFZ9X4bG6d7QpI0cy1VFjrq5ufz2QDrPoXWgJpZRkMakcWHQqUR6b0jo3WXn3tQe/HQgwaJ5 XsEhadWF9l0b3fsJUg+tIth9k/Ut4hcdbdYsJBkJ69e6ej1TnN/xIr9cmvVkUstKtS1mVa22 rZf6rbSEJe9KTtI1vfYw7ab37dQdNYMD2/3XXap3r607q1qoJy1fHqbFf/JoMUVvaZpRj/Nc 5u5Hlqc5+W/zOw6ez3l39cB80tm56Ttq3lekOn12WkyJCb14r0k+p+9ByZEyUrWSgW2Za7XB XDXH9mlV6Soa+lPjHDnvcOlPDTovFpKn+bDFQcJQdkFtNnPtpMJEwZ6gy2+kTlSx3kr8aHDy sM+Xj1cbpym2N9uoRqgW2u+pcMl2lOksGkh7tG/bbNHUA/OHrhdXJC5e2aeoKWb/6swyQY3s +QzscmnPV2aHPB08KeY7SVbuwv2zWWK2Ri8qohR7o21+C3Vq3vMpVeHoUxufV4/VvAdNXucI qWb6Th747XyBbMfWszdbHV1TjVOYBx6fCV2Yx6wtZWmyucfqbUWWXucbKdLyRdNOU2dyRDQL HJ9x7FDpCVqN/LP8jiXzTz5hLVAevNVwd9LK5sr90/I872V89O31KElS4460XmIsEPp+ilC+ WFJtT9L6wrAT8vLyeqb3M15KHdgYuWWhc1feh4JJzVvSDKszH6t8Kt7/OvNwl/52P/O3uvZL A1fYqZQLXa9WFbdYIqZteOymnvldIlfLivzkBcdzH1P0e6z4ywnFy16SGPkd4iyGpsluq7Mh vZuYdHmob+0b1rRNz/PMd3Qc78sZmk9Mu+xZ0X9sjVDI5qRPr0/bXNuc1LazydnAr3eic86i 61n96Xp9wQEX3tjIr2eNN/5yTdp+l/u01ysD5EhUJu5nBuyeJpzphVMuhAzaSVoJZezZx7Fm bZuOpLa4XY1zvG3jk4dFH7rOHC3sGNqrM1vydHil5r4ZEdqW59eK8Xb63JCQkNiZ97z3EHPR SSGdkOsMzpQX3MyW7XzlwuETrldOkqh/3/jlSvWUiZopx+veBy9ZnDBD8Dd1lQaO/vpFC4/Y 3eHqNxpUe3ehP9svsECs/PxcJRf7OPlthuHsnqJqO67YVB7NyMhISUl58eJFV1dXWFhYdnb2 w4cPP0frVzVrxaYmcmSEUY0PCArErTJ2er7CtKf9SYaj1u06udmzawyjzNYbmqzaaHjdum3f 1neXVx3MnCd7Zk5639Z1H4sLP6d0RXTEvVSoncLBKSAo6FR/9WNDQWB1ptnuueqlOjHtcY5G Ro8uO9bGzTO7aVeVUXV6zTzTqx7NZbHCSk4m173eJyjavykNnbPhcrh3PO8iG/nV665tkz/I OWWuSY6TiI+1dfPgp96tpp7qZYRdbYt385B2trYoyuQJTZIyOb8pmFnvdR+L8d3iwzJnWNjv lsoJUx3UbfSd/Ld1PLuhecSDxJZ6rd5JycFS6HLn5MiGA9HR0fIbLjs8vykyr2HgMNv+C97d m99oPMk0m6hCPH6BEr9O6FQi1bEwLVRTY1OgQTRbflFRkUpiUlLkTIL9li1vWlr2F9wzj2a7 5ia+ePHijx8/RmVZlfKHRgieil7Lvv1Bipb6rMgT12YlGesQomSjHWWC13rvjdt/SKuqxc8i 9caNG8nJhIMM7Co0toMFxCNWzPEk/5epFVZzF5XF6HMVz5/BbCUzOcBOY4oX+Sy5JNJo4u6i M7Ns6y7ZV7fV5rCysro+qb/m6dlaw5DKNkNUpPnjHcFSaS+CLl8+b9BAoECF/IHpLySv6hiK h4lZHXvyZDUrl4mr7twGXz3zeGZZJn6uK4mtDXMryeHLtliFe1zkMu+/Q9ugFxfUoLg0oqSp VLPwqovOgPGaNUVnJcMYDBmo/jPTtfevplkWs89553pZIPpAfBC3rkSQztUrWln7ha7EXozV 1Oe4oyOpkUDgTzO74aM4I8fMJ8qK7N1UzD1dTsL/etTgxUl3JXVOyUvybDxet59Wfc70OOGF J297XW6MnexintVHMsgFYsdYok5wsaVLXjygFjDpooy3t/djO0Om2QTldXrZc2ft2SK5YI+q S3aTusgWW127MppAiFd+XCljeoacrN7GBie5XMkYQa8PK4oZJurES14bfsb37VISNSbqWn3+ HCJTFot5609k1+KMiYmneUXNZ5fcwb085f2TsxteLoga/jaYqLqy1lHct59qSh3VDSOas2lk 3IudveawCOtrKpX6kH35+qhlDjWK78VCdbO3f/ncf7iEbDSVWMe4MGePbsWymFiagziRXSXe qqOovFUxKtQ9N5hRpevI4jMXLJdzxBwQ0+Ab/tFYpucsLT7V7ZUkEkMpqT+05BL7NqXyRiMi IbqmNsfZzN1dgbX12bNniUrO7c9uJAalxMe01IgrfQi1id7qqiR2bK+dRKUGb3mITGXYB4np Pq69kpuVZu25NbPTnEstPczYeZcre8SbOkbi7R3Z/KxutMBSHza5Mtq1mQfKTPnzG04UuquL y5245q3ppGp1aE7f1GjvN7HS819TXsT3FIZ5KOktNc5nkqPZ8s1vYZBkytI694J2RCbWbAKh lLDUX0+m4RiN4XNhDVlU8ki6QkNBtde0twQpJaH7DyN5Y/Zda3573SRfftXeHLcen+GRPjVE +xZJ0v3YlCeHIjTj2ifE35JiephrkmXOQCqtPWSixZisXiBZO+ukBYteT2/vAqI5eXf75vXq AQzmbPmdZKvsc8y6a1OYii2il5zYoFzUPUGTuEuhu4kg4f7JteF9U8nwdBAlsIGR6cTdKerR 1R5un5O1+dz2TUotCZ2URVKXEtJdMmDOk6hRsfCCC2OaSjZvDWFC0raKcF+eFBam6EP1RNlF L9qLdk9UCEmTbLxCOMbqdMhIbcGXOPZDccq21umaDETVE0znNKW9J06nqSfoSB0xX2xra7uf vUJlj9WMpf0fpB+UfXG93BmSShZimCAnJZluERI3Y3XQ28uXqSXVPDGaUlZdtwOdnU4oP93d 4GTHsmh50J2j73PulkreMozL4l0VfKmn43llryB/QUGI+LKIEwc2qFs/ejmnRHfisRSNBS0x sxvbVlXozX5utY5nf3d3l5YFQ4ieTe4DwkMLgWBSb3t9oN2+D/GBhSvDitgzi2WU+TYXm7Fx dCvkSnioeXU2PDi+xFjn9V4GtiFun9PrbMe43qdfw9ODbGijraxJlJGusH+83KeMNLj+6eQP ReporA2ZOM5YG6WvCTq/GmvDo7RH/R/YzbqTQqw1H7tz+bcm5WTqDzkv3zoT/0vOC3V8TYgV fqEJsdLXTJlfzXn5h55uAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4D8ODbbm BK+xC7dH7teni0wkK4ze8D9WD1fKeHq4UoijhdtKf1a4rfS1RuT/QuF2jW7kgVK+CeZfwmZt ULtXr9TjW+N596Yz/96omqD+aZbruvwXm00tvcOv4aDdeo13SjyDZ9EeC7OEZxlX4zLlBieT utONa0wPPG57FFSivK5fq1j4vbbm5uVpHxI/F6sLT5hgJLQ8llK3Qd5XaHn64YfvzsSdMZbz bfYp+zyvKuxGet/5KDkmx/CtnbkHqkKM5Fedvhuok7peeZXRjbX6t78Yyx8UFjW8EbeUO5hi 0pHvIVy11G/pOpa1GQf3ptexZbz2fbDwlE5R0aUzFGOD5vU+BtwTj88K3iQVxm8suFfU/qk/ 68LBFtH6SXkd/eU3kiZkr1cVEFIxfhTltyrsOEui9WLRpxlpdqY+e1WbP+hXx7g+jy0ZVP1k WR25MDDjQ+pVDyU23eAJrMfFM5rrX6/lvP1sTuzVZS29fp9c68xi/L501h8/SDYT0qsKqOtR DJihepR1b/r6ZYHrMlYtS+9ZHHfyyM3eax2ifo8+ej1b2KEqX24rX3WaO/vdOjmuiKVZ4XcS r54VVGg5Gycc3N1xrKsy9sOVhJ2nrGIbr35c2jSULibQMuXouwjr2oxL6+VfBWs03ktUElXb 8aajw6+33dTZObO0/OC8hdtkfH19MzfeIN/0y4wyarkQz7xUryEhy+/L537V7T1nNuQ4fXxb Zf/kzLqbO/rDBGY/yTRzbq4UKQvhFp5KmqHiFfV00/mVpc3Z7rNCH+j0bbru9f7FSf3EzZVH VR1/u9jyKK3yyALPisPKUrde5IiUHZA12jz8ie1Dydoc5+c72+tyDz+cY08R5Ot4V50ZKbKA uvNzX3/368pEpYm8DNyOw//o6vlBg9uKw6eN1JVmW4XeeJWy81OPYz7LprvbfXyenDPlFE85 biu+0YnZw6vrY1MAC+etZUkihV6S87s2pBuL59qpU4/dl+YzT67ZdzFzyV1Fx3D1vsq+/HxC RqhOxH77qreTLt2RDfO64tZcZl0ed0gmkqc845jTvGe3ChNyr8aue699p+BCwJqdLsq5dlUZ TSWRluoGtqd4uav2bymeJL38FC/VeqnZLrYzU5lMrze84RVhnt0rl0TpsFtQIllZFRvVGHLv lallEGdAN+2A0/lk1bdyXe/eTW3MnjfvgYRbCcPCAu6J1y4LkbWvzFnS3jlno/QMkxuTWKvj X+wc+KC7hG217gL292diUxxLJk/hNYmYVhjxZl2y5e7ZeTzanmWZWe5fFvpKijO0/3ZptktV 7OwG9+Q8LvmtihaFzFqn3rnLJcQuieck7jtuwtreWLSbaU1DxenPMbqc7Slaex/vMvygy923 tCvxtLfl3cVp1qoJj3PPD//8Khsz92xW3DzooJYpOG/jGUk1JqraJYGEXRqFCfI7xe+5MqwR VeZqqrtz9lJDhrfNlYA0Mb3aiHNnTfLaJKcXZxCaWj9GRS24qNThWBChoFIRV9ff6c9kxnE0 MZ3qmcjFw5MgI9l8wi/Uvej801Y/zrkiN4fH15xe/UeKvaY3vzQHpXvlMXz8ODxkXI6s2bcl QsVtZ3ruheVHVZ7W18svWrx4cd8DH1fhncoDdiu9k3WKbnq911Du7+9sLDp3bq5sd03+sfIj 6y+cln9/laRafCCubI2Aa9OymL2teWHqnRfcX1cMfurteHZjwYdg3bi5pnKGzBnTBBsy4qZf ZVnTlq5e5nrUvapO58WlJungdKO09aHeHmF8S8PDo8xp5758nvHZ7MqMNT2GJ1u8DyVmt+dG C0/WWFuxyLJwknSkqaRKjtP+S/u943gGgm4qaDYt0CaenEI4L6bHwvth/oQcp/qyk5lquuLW XEZ3zELMQstpk/sVn133Nrpgv/uaZ8fSFAN166cGs9K8ht9KDfo8AWvzfD7K+R6xPz6FZ3mn toODsPOtWRtPtj/Pq6SZxHjJWjA1Dr9xnqxbOlgYzKmRSHMV940ZfuvYC16RUrHxT2IWeBuW rpIrJb/19o07+1aG6yyWXbGwyTTis2PtZYualcn6kvWCxSy3adYBp68TzrA6HdZS9uCcq8gb XZjQliLm8nTKZOoOO8EB9aJVA4Z6oqeVzxl49D2nbvx8f3L5Jfvqw1OXBy7wbG+IkOaNnK7s 1vJwlvZjaZYHM5Nu7szb0Z+t5Vp/xTXwdIE7L1t1Gt/AlEM+MTEujpFFHCtmNL26l9hc7fNy pfLMAsGLjzzJ14weC+x0WBS8f42rE3POoq2clXM0y9T3sljWWNYV73q18GBUKMOk3AviFLPb OuILVgdYSIhs0351qFtuiRz7heTcxg+P5vmXe+tONrUy0hTLsjqioPZ00/HPr67oXWqTEKyx udczPG2VzlMTVfWZPI+ykbSzuUxA95Z0oVabCivDsiGOMs5pjfK+jwUPdr9lvniqqW7FRI5i bY9jK4OzMtMb3xotVC7doH8wSfhBXl/k5wmVrS/1P1gPac8Xt//U07bApSF/n8iCrN3aBZvu vkkLt9wlTCl9WRrjeHFGztRzu357MWmLZa17YMJjTbnuoPW3Fp/g8l9RyM3RcGZqf/4s3naW BIbXNm8utpklmDgWK06sZNqr33Nc/wzv3GnWrIKFgSRtvUILiZ0n1HzS+i91f+53dzZN3l83 vTourrPbQMKg1c2sfO98112i8z1OpUa+iNTh9337WPZgws6nV1wtKSc3Xl455zOpRWfXi6Da lG1Hk9R8f0u8vyr64Oovm/deVfX5cErD8Ibcov2nDCeJLxLR3Wi5vbdd1f2V3pekJJdEbx6D 60yKJ/M4fI7m6t4TqVhfXBdcu9+r/mnz+snLVQpFWPjO5OuLV79vKY2R/mLXm2l2W/RpxVHV d9FVeV+eVO9/uYFySYaR5DYgqvFu+quxahu/RdeQidTRUlbaWMWNtPEUN1IUaKOlrCTyuIsb R76Bv1zc6E8Y/ihK7jcSfRm8ArWNAAAAAAAAAAAAAAAAAAAAAAAAP6BPaGqS0Ji3ztB3g0ZE pdB+yEAd6UHwb6mYX4NJf67lAZmm/H3niKxEJI5352ik6cJf3Dlq/X3naFfyYPoU2SAOjAIA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+FsR LzKfdyQKiNDl5xjEzMoznebSkO/PBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAADA3wSG1vv+9CygqCF7CUm8LAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwX+zdd1RT+dovcKUclaKiAw6ODgEFhyZSAiIi DAoiYwQDBggRFRKQRMqEothxxF5CH6NYAQ0hQUpQFERHRymCIxBCsaGgomIXxYLvDtMMx7ve M/fcd+561/n+5Ye9Ysj+led5fj+y9wYAAAAAAAAAAPjbsXjzcBX5vYDWv1/0lf45NAsAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/N0Y5BBD kt8LaFDHx9ahw9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAPC3o/mQ8mD5vYBIH2Vu7mgWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPjbcXb4+KHyewEN6q2wddmAZgEAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAvxuD4u47998LqPKj RGsUmgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA/nYcnzlESX4vIOe+/J08NAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAA/O1YP37aSPm9gAY9Xxe+UQXNAgAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB/NwZ3/5IgvxXQetK6h99O3qjx 5ZTFZ9cPVv4HAAAAAAAA8L8EZ9eQWjYPGqzGimBGx3BZS8Lligxiq1mSp5CmkPo11dbe1vqP 47bWvx2fPp1kMZcVERqzlGRpa0McpJIsfOKjWCQLP88gNis4hmThHRsU039kTviSUOIf3zCm /NX2U+1JFu6ssNClMSSyrZ2axZyIGBY3KnLZkhgWKYYbS7xyZuSySK531JJgFvFyy1/f3Juy JJpDsrKz//VHl7CYaC8Wd2ZkeFRkBCsihjSVZOEWtox4JzULN/lbzWIFRzJZpBkz1H47tRVE +Wo5mChffzr4yjNcc8QW5yUYBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAH8FUZZTDvd89urU/gtO+2VjZ2f7+2E7q3++NtVOfr3qv3ppKnnK1D+uTLW0tyJ9 emWq2n97ZerU3378P1+ZSvr0ylQ1xStT+2+scv5gr7deu1KiF65MBQDgPxB9Zwctn/65qN8f yvuDvvWUKX+kAjt51B14Q4L+TPAvR31L2z+ivq2VzV+N+r8lmH836ncg6AMAAAAAAAAAAAAA 8D+BshEaZ0Z9dof9j710Gytrmz+P2n1us2XqX9hssba1/mOzxX6K/V/dbCH/O5stgzX7b/74 2jN8xBCtbzACAAAAAAAAAAAAAAD4X/y9yalTvhJ/fldHvlXTv6tjbW3/x9HfH/Xx6abOb/su /9oTPWz+fKCHpeVf3tOR7yn9X+/p/PlAj3+s+495oMeuhMFXqj7bwb9/GcqK/Me3Yi2tP/fI Fuu/9MgW8pQ/O9hqyl/t4P/2iS3/WgcP8/xPemLL03Ff1j/9bB/3d92vnfzHHLax/ec+tvlt Yv1rX4Kz/aSL7az/Yhf//uO/28UaengoDwAA/1HfeFZWjtzxuVDfH8H7Yz4RYX8/aP2Zv8FZ /6U/wZHt/qzXpk6x/Kux/t/4wvOj354ffPCDYIzxRjX0PwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8rfhx/LSR8lsBDXq+LnyjypDh46ZG 3TqboAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAwN+Ewd2/DB42aNCg9Qc/5rdp3VfRxC2SgP+f+FJDxeXMoMFqrAhmdAyXtSRcrsggtpr1 VNIUUj/syGSr349aWf5+ePp0ksVcVkRozFKSlaU9cZBKsvCJj2KRLPw8g9is4BiShXdsUEz/ kTnhS0KJf3zDmMSrbSynkCzcWWGhS2NIlmQyyWJm5LJIrnfUkmCWmsUsVlxYMGs2d0k88b8i YljcqMhlS2JYpBhuLPEGLmEx0V4s7szI8KjICFZEDGkqycItbBnxMuJf+etmsYIjmSzSjBlq v53MCmLCWQ4mJtxPB195hg/z3OK8BJ3+T7ihrPxmxucGwa892z8Kplj+cZBs/ZkxQLb5C2PA 1uaPISDn//QIGKzZPwL6BJEjhmh9M+D8E14nDE5Y8vT2Z86+/5zksvnz5InR+5kJYPkXTt6a PMXyzxlgbWOn9kkDkP7fNIDapw3wKHP5otEBbYkHjuR7WF8YRF2QtfHGqsikQFUtrbYj93r7 9NrLl++5/Oiyhoqr4R7TdeOM9S+fsbJ2aiqVBT50+tg+ePBQ50FKI9cPUiENAv/zaDfqzdFb 398Z8VRl4Gve7FRRm0U/d7Ti2ZgX9QP/88g5B51//Hnt2N7zq7UGvvNa5cG+fMehjteefNyk fMtQf8DvPLje2WtrIpN+S/3cPe0ylQMuAz7a2eujnhr6OWd0jdCrPvKU01f0pOebFeSBn27o qKeNvs5pxkm0N0NXt73bekv41HLg6V3TH2xa9px6mV380XRFs8W9AyHrHg0fsTFjw4CGSJg+ eMKp6Zo5hv4Jc9VX51Z0O8reM/sS3/xTmz3etn6CdINH9/z7S8gBXvn6sscP1tyKHfBbVYap SPjUJW4848yeqS+9FpFv+l6xuUNupPOM9GYqvuXJ0UrzqbVj2J77Nl+NiD+3iXE6Zfn6MQkD mtpo5C/sG16UCz9SWR45C76Y3ihrfF3Wy58k+1KcWPVce0DLOHk6C83uhBTTzfMbi+cJfXab xN8fYSKVPV9JadF3lPQ4V/xyRW+I07CBAyFeqb2An84OyQpZwB8qYcd/c85oRG9QYP6e65z9 jOCT6Zeqhwzs563rj0gb9132ICcFh+wzMhAZPT3Or31A7t5k00B25M8Ufajfe27EgFM+rlJ8 qn5azVSSMpUSspR2zFFzemqE9YbaHbLppXc1ZGfVB36uCmcSNy/HwPWlF4XSOCsnu2M+R+9B cG/yqGWtIwRx+calF6O6x9xQXfuFYmet/+6gl1BQwJ8kTe2dry5pbS1+cUwk3UCplTX2kCfI XjaR20o3addnXw4dcFYRs0nMhFTdPWoPMjpmO/p4K5Ovhl3Z71jTofd86+o5w2wdAhtC3B0Y 0Xm8j9ceL15hO3DQfaNUEEw2lzZ6UVL5TWGxsbGvevT1tkV4b6BUka9y2KcuRu20Vhsw4hdq bWlkryzif0lyzRUc4s8lOo6zdOkKsd7zhGO2hs2pDOECLuUyr1Vd4FHIuseXuFBL43yfjM5X VvjNE+Wj8+vcs2tPB9TukL70qv2GbNgw9quv9r6cOYPn6Xo8fiVlj77yebKo6etRtw8ci976 s+LUWz777FW2R66x6G44rcGbTPYR5o/JzmHSo6Ojt6+tHPJcMNQ2W3Z5hTlJdq2d3zt++fLL ZaMGTCTupIOxPt+W8o9KXwYSjbCD6m0lkkgkFKcO5V4flb1NHLq465iWA2N7ta7x8vS8EQPa YbxW1EV2UMLlIT1CDXddYZeIbeWTsocvP4/AshVhehaBlUcNmosDOVMayC2ncsp4hdGUWLHq crEl4/SREzsyFGfOKGfifFR1iDcS+CVN88zdSh2d2fNgwaq+Zw+kNRkGzbPyBc/4yZxputQN bnPNJrLNBx8d+d3GAaEsgadanypc8DaYPEHKPBaSSl/17uHwV/cfNX4si4i0W0nZKR+3mrKJ F/RMOyJXNKyYoxjrrg2btUu638fHRJRzib1n7pryL0l70z7MD2F7HIuNiyNGx8PNqw/atHGO yOgShjD/CrM+bEGyaDPHT7/mw7igNQMC42himNiq1j+iWQeT9+SWj8xumuxBiaHbtjU0NJiO 6J20t1vnXMjLVvXvZ047T87jLf+Y/mybwls4946OyuKb+1pv/dDL1Cr3F/lr8FYeaxIk0iMj Fy2qWPPy1Vam9waR925ZYLG/RZaGTInmnmbt0knvPeCVN3Jg7NpFUzfcfmykO5nWMLyyzOdh l3am7ZQp3+w+pP/qZkJCX9+Mq0ToSGmnR6dojp3P3dnemlnmWzZUYcjwxinRhT+nC3VFOcuF W5WpJbmxcayi8vLDjbOyNUfsbr709PhS26uc8vKWvP3iOTZModrYqwW8+ezuQ31pbzMmbSab JipGS6+Jg0PzQsx5njFaJX6kBYsrrGmjBU2ZaYeIUaTFPnIkOPjOW0tb22nTDDZQXvLH5m9l pBzTWncyh+sW08nPcglKNHue2R6m2GjJw6bSzS8q6X4p7KWGM31iWi9cyFozd+6O3bu3BlrL J2ZhLGUTx0iHGit21ZS9b2l1mrN2hJ/DgLnhoqSvzjzGoEza7h5Y8Yj28P6jup5jAv7lxosX XY9SKDXBbl8/uCmoqhomkr2MMW8znzNh5cmcYH0RPSWTk+Yj1j4zbPVwxeB41nCkPS26Wrqs cMsNkdFe6cqVawS2hlbhcXERERFrA/usHUyTw6szOK3qXZqyZXVbBAxhng3NfbR6VVTtmu/e aAyYfesMJHRi7vqRPhTwl9G+Gkf1Ju8RGB+ydao4fvyYnrq6Qcus41sDvRvIljN7XplYZLWU xi2sG8reaT2gAnDmEXHodo2UH0CPHZr1tXBO3pZJ0rt3XY+am5u3Xaqvv317w32yqYz5hF4x VtyVyRl1++Y35yV7RbxHDPUz367WUAxqyUSSKWNqFTjTFiyQTaeoVktbA3+8zi5fs7Ko9c1G fm7tle3UgEB//4ULF6Zsfl9UWGi2MnztjWpJ0hJrhncBb1roxmrJrP0hZmMVR69hgrtIJzhh 9fWrUvPT0kY/SpBrqk+AFzGdWt++fbuJiHeHm1MDA7y4lB7xTn47f1viS65bkKmsWPt5woys gMk/HB2Q2L6ZpLTLRz1DKM2x1p2TsIwd8SzZtTFC0q4l8Q8PiatzlxB5pPTaXrtIW7tOp1JG xMyXRAZvbCI7MB4+iOG6TTx/oFrCnZbhp64wbKKWq4wT3fUnqV9ka+6k1PaeXTssoTiYPEf7 qrfkVawWe+/egIC2twUSw2TzjIBFixamdfEfLdy7v/68JGGtU2jWnn1Jp1epxxsqBiWNYUtF OaLNI/QeFLQeubT7wFIRLfiEsLeTCL0+19m9Ba3vN1g5iyOXZpeUlxcVCfUcHNra6PnhecIu /jOXB+30dQdqdcM44Ye4Io0rRukqijWXFjH/jOjdScnsEobIKM3jqHUCVzLc2LehyuBIcGEA xZ7kKCjJTmy9ceNM/KPux9sWtyU/46dztqtbMRocZDF17hkdO8peRrvVh5nIHt+/3sEakGH0 by2VfKmelSr0V8+i6OjqSk9LU5WpVFdmrhE13Ler+IeZ76ZObb55s40s7zpji45HOx4xvOWj zLOTXrrPKU9Zscp1VHHRqbzUpOS/cHHCy2rpDtV6XaG/II7k0X3/vp/Trl2zisev4FIOu9HS u6PCl8Ws8ArQj60bSqu8+aLkea7iuA8bvWWcsLNGSu0KPaNany5sYSYJwqoe+gZLdu6bJC32 crCPF+pNmnTpkkHz9NL0Nq/zZEm0Oc96VEBpT0fVnUu7v65KfdI+szylbhwrLOXu/QGF8xee JKpQO8t5m2qha7bz3Rqpz+KPL3dsdM69zr69vvEflT/M1BVs9XJwdHQk5sGLHlE9hyauaiI7 MvYeSKkjV+k+y+O50sSHmrat84w3UoyZz1XGCUJqpHPVsiTOD7iSi4tLW8/eOj5HZ9gOKTOf n8z2EGyduypUz6PAuDykgz9xZ8dmTrL14Tye8ppy/6Nc85SkaslRMlm6IE1bm4hZoRwNmUff rODBiuFFNJSIokb+F3SWOOi4S38wrzLoLeBbSG+UOzg5rcvXe37u9PIzjJQsLTIjYGHVvR0a I7qqJWXahQWHzkx+MbdG8sDEXHbc5caD7o4qxVbfM/IXunkhQ9SaLpRKh5jxWvYHBohDlN4t GJr1iNYQTCYvIEqIUewxvZfevT4sq6trjOl+6pXs1hhF+dmFvy9pcWerMEM1jZPINp/CMB39 xkxxfKx3tvk1oVDFtPn+hjqVP3ElsgQu2cKfuWbmE1pRsMTbXDp58ozVb6IExDn8nJjOCdrU GOjuyCAaPdPaShTtdttEtoHmXqWblBPBdTt80+2MmkK/puoOni382Y/0QyfbX1eouYdLzjQ7 fEr60o8SSSuiUtQlu3v0k4lctUOWqksNX9hwnuwUOpFR2nSt8c04U+aezKVmQxRDmzZRs1iJ GaJu1uks55BV17jk0c0VRcJL7FGmhzV4Y9hZPc/uLOh79uxIPedGTO1weWbwLbUlYtu0wBMV q7/tbBXdmLlfMQqnjk+oLOCnCo3VOxpc1JmzQ5eXnIhcvHRFzGoXf1Js4ZYS59yR7i2inGJi BUEXrHn7sqtoeofe/HAPoj4P2cyhntK5rGtJq9ywL+meUehEwwJespp/GFX/Z7U5nfSWzE1m QxVDKWmkQBpEBHqHU6cWyN+8lStZXbjFjyTySSkghqPbMeOCnK89iNzdsEqWyniRxzMJZbLi r/qId1JLaU97nhor1hhzici83cR3VbogcsXkTrbI4oKScZVBq1JYtfSuTnq6r8yOmzvkdFSe EZWi0jomfnXa5re+XeQkzrl2vg9TuC+JMSP0gpDxsCCNIzKv3WnFiDaVXTgSFsLp2DHxxT6W 9NOP7q5EdGZ8lUFQQl69TmXry6K5mUslRgs2rqGU8lV6HjK1uteX8crZ+328XWpXbeygzwjt 2FRN5iT6aLYk6vdluRi1T2TtVHhD0mCRtPh2/FOv3dKvHdfmKb9Tppt7iYkBGXwnJSiB4ceo yxCOf6Pj/r0zXZDj03ri/cw1OS/5+8XxDjIfecpvm5LGsW5IyeGKThw9LbzzyjSgNG6NSYdy +Q6VM2vMdBUb3lOpzs+cIabt7bnEvihvpB/OByVoZAi7mEkvXmx/70cp1XM99sHuI8+TaPYy 3pgx9+5Nu3CTrn+zQ8TzHh185HwJl5LtUiKxsetqp0/L9FA1lcVcJoLl8+l2/tqfdkryXKI2 369qtc+s/lprT/0JZz6XPCeBEeivmSrsnEmq9aN0+6ibkCe0pDK2jxXbp3GKrHO44Qcr7EzP S+LIjCNc86p7xpzNn87T+qFvdCo3q+pUjp3zyLdN6lPo7r19qWSxvKAJ3alKTXYtUUtxzaPV fCd50rtZvhLR9tP33PUqqlbAsKZVzqjSnZ/GCfcRG3Z3MMsVemCyPKPpVM5mnyAqZ+GwDGGs gEsukH/iFKVeNyopm9HtbsYLDS0JoLCc714iSvsPx0e8KrhPXncyfXeij/0EolHyeKbfbX9R lMOtpes7qIl4xO95XczqVGj8VURBffqqkq6/uCeE05blrEMndfuZfyNNDVKvlmxob9VM47Sq tdQ3vnn/dp9WUU7huod+JMU4flGlWHzVmNekZHydNU218NRZJUG1dNqy0tbK5ll5qs9dXi0W 6jy65Ve7Nzf+I7FC6Kps0myJqHOfl+0y2fxy7by91ZK1rMRHxCcO7GwtKq5+mjHyY/W2bZOI hmG9LymwUawiyuRLm+edbEEzV7JVoDtHx79ePqm6MoRrvDrZ1UoCF9LPj785ddmjeN2r82uD Ovlj1Lv89Ee8fp1Fekepo+uH5hhdnL15M5Hxj3bseCPguYmJgD/JQPb1nk3LzB11xWmv99Q8 UDi9GypEhTpVlWq4vSy5gO8tzqGSZE2G/rPMeFqd7MChWZOIBaf6A/K6e/RmtTBTWdOCztb3 +wSMr8Y+qqB0jmWLyq4spA35tJiwMrrlTg4Q3/UjWRPNVZpN8Sc5lDO1whP22VUZ2OsKux/r jZvWyU5gakXm6aSyHwQ7BtaMkM3dUqEhu20q26HNPZgvo+uHd9KNJtDcTWTVbyayFJYOxOQl QvvE7TbTI6n0WgvflC8qq9ar1n+nk/RF5fJpqvWaj3Y3sMV0ojppb+f7loZQ9WM76YeInJew L0ll/0nF2cma58yRLC7c4vFo9wkirL99O2Tz7IsG1dJd84K8Sa9UandJ+0L1erwdGC9c3qs3 tlLSOLmkgGwX28ZQpa/koeD6yZ5fbpbS7kZOrPlBYc1UvXW9Na1Ix93YV3gsL/kLIsORbyr5 +8ljzClG90/f6cxvkypVGbjti6dSPnDO3Kbr10bV3t2xL3NPtWRhmrVBGidZLd67k5+hFtbJ nxXwlt19gLvy3oBC1quOKGTlBfeN5sa8ZNdWQ/+JbW1OU20Om/Oibf077nIlZ+Vj3YVrHnLy 7gLxHJOO1m11unv44/TGP5OvzejWaZzO1fxCW4XFwS7nSiVdX3ETjVnaumqh2GjrB6LY5BTT z0XVenMWzVh3qjCN86RuHutk3IrjFaeLJAJTmU54Z2vl04NixkMiMH5rOjGNs9UhxX+KQoNs c+7wo1RLU1Wfhx1SLTzifZG9RnlmspmVJTm8Rmp74z5X8sOEOQnFVQZXO9lL1JlrL+ZUxO7U fp5Z4nLjMNfcULOFylvo/20n3T9TbPaPT/twq748syW7pqoWXipynndlhY77QnGJhWszMUg6 Ov3PDamrI0eepPGsb/vr272gVXYd1H4uybB2MWEGzVuk82ndkMA1vOUuOcaVhBJltjRd2PVF 5VVOjXTGsQL6Mx13z2J7dve7dR/fUVhvtms/T5G47H9HqwwvcFlpPyGxP41N06YuEDu+4rpd kPW699xOsqaK71k+/HRn1LlUK6qYn2FmoFNpEp6QR3GqaZTe9BGXlJafPnqRTRQsjkt0PkRW qu3JZ5wuex/1rG96ZOK1NJ/Ka2/JxIhoXzRm9G1PE2Zp5oU8hfqE5e7MIYsCv57eGCx5WCMt lm+v1F42N5ucLxbdK1Z9fmuMOW9/XPQmzjNa5Q/l18OdQpluebxgk9CsE5PapPOziPVX4Erd M9lmwxRT15pPUleyUktLdrLrPzb/rCRIdu1P8USRYu7r4OjgVPHNGUZtQ+jjil300aYd63Zq U4P0s7ndLpuIwcA8zpWX+FEH8+3apAKqfhudv/dllHnmvOzpplm5jPNq/m+PmpsqVIcto4lG Ck3QmLS9mUtOU2pxWlwjnajKjXe9yHZNF374ZezlNNb3B7qOPvCp1LspodcE6DvRTTu6Aizk JcXeTMs0jvKH8pbH4uFE+Oi7xkpQOKdQJbowTD3rQsRUusht1DtpHLlF1NTcaODa3J3vcKpw mj+TuWw1d2WTH8nuglJpip6w3OEKEX77nr96eCLSSudd3weiclpafldDNt2UeYZLCWdsF/cn u/DEZetamlpdOun2B87kaX7akp0eZ3WFW2mrsuKEP2cI43XcvcUlx4uDzHmr3uUwuud+JwnI ELpWk2eL/E07ZBYmFxbl8dbWVZ7ru7GrY4e7SUd1/e33j142XlhxQ61l/tLELK6I4clsUlWI uhNuLSWH5uVsO05RyxovLN9m7GtarxSW5Ztlsv3D4QmysvbWbhNioU3VlLknmhV5Z3Qq5J28 YRvNePUze2aF+wonH3fO5ZKvyCs5IpCMGePkL9YxbzaQ0ld3trY+eF7/07VHxQLGQ1+ae6b1 bWK8H+GK8jxDdRSSAFd/pD2tJkOYHVQjNcoJmeg/y58UHWl7YvnjY4zusaU5y8vW2NlPWJSt 78BMnH6NSImLO/mFLsO79iXNIxZV3vo7GUJxbm7eisNUfYoZEU46uR5FwxWKZ1X5XsO8BJ8q g3xmXk6NdFNMYeXlfZSEsgYiWDW2VtDEPwcQWaT1lIZM5969uZ2tvFxGik+lgalMY3fhCo6/ imIkPfXram2cOtMt29mWfKLYWJ15kEGhksJL6fMusnv7I/ichFT/Zk+iiGDbXlLTFTMcKhb+ nqY8Xpd1Vn66uPR6LI/NKWZBEv5EYhhL2q8+I9IUl7NKJnFeW3bq7Uv7kc16v7ATRz2yPcAp 1Sl2CVz0W646q9ZL1Wba2fKsqY9DbR9+mleI1XD/uqz2u4S8/NdU0osqg6RO9uxJkZ5XHucx zOnn7c9LvjTtqHrWfq7vcV1TSMRMf2Jh7X6c271gSSf/xklaeyRj1f0nDNPu1+lHPi30Bql4 pP+esKyNeQKfaZmC7YXOKzvZNSWMWjrpyj4uecFG85UPIszkgaSR7tPZ2tLSlnJnQnbTXPke 3w2fUpq398IFXfd2uE84md/UZ9xyIl15wK/4cf0RaZAZz4rGoVUZzCtt9Znh32GXLoxXqv0g S+JYnpfcmZCpVvrK6MSZksPRbjlGl2bPLtuntbDUqL+F31zr/EWhhevkuwzEksbtotFE/4lE Wi2f7JvSzV7U6Fd7WfqY5J81VGKUxvH11bNwYjD2VTg4pLUTRYy9pa3V9GO/Lcyu5qoVfvXA 2o4mTnuhe7ZVcVtklTuJm2fUyc4d+o5IWdRJ219qaswprLyQmiVf0O+8GSi+W23zpMirzp0h H713m8r3Jb2plvg8EHAS3zvl8V4/3dHJU1g0aSgl0c1zGLUFzvPuyQuB8I9P7795PWn7imm1 7wOytK2IIZDHa+hPoFVTa/0NFVpv5/oJ0sPV0v0CruTi3XRagLipQeY0dXquOe/7TrbeZKfA NW/LiSxVZM+mcN3OCDTWFbisHWXake2nn1ktuXbxbW6V7p59X341/utx9x/WxsWONWUWlbjk VkuOTgvNcsl2mbF24rvXlbrGkmj+nU/3f53tRyqmrBfepGAiY6vXSFNpDZ3s9i/cPZnXr1fo y6NhNzVOXJ6RyTHRpt7boSLiWTHUfcTlXmmcwu9FdY8ZphrPJmkXjpsX16TQ0KMMDkr4NIMR X/+6dxa7eJ2zULVaemrVSpZ8aofMLaxcOS+ANKJvg2p9w6q6KPMZ2vXyErF1h598eEd6lgjv hJgySRcqNt4IHK6tmMMov+Wwr7zFtjkpROJSq5bOu1J3xWLy5G6/7hOpwvi3lz/I5nP6FxSj 1AUi3pMrsZ38eYkxpjKGKXPtyfR5R6n7talkZnCiWW3D3iObPm2cqlG/p6qOGmlh+QflmROO 3Enxtk5WKi0rLNlvWsjo3tzkLb5wqubKuFIdJ0bbzbbru3IZNXHLY71KaYX3LId8uv+cwJ1w K4Bk6HL+Kpuc3JxfIhQwk3J0jH+KWHf9appUvhKI9y5tvXfTT6wjekZE5P70Y0osQ3dWS7gO Vf4jFAbMbqLiMj/DEJm2tdmRjHk5jPAlYazY6+nC8ePGHyhzdHDwdWyWTdz+/itR4eMHwl30 Ilpl/n7t+iu69s03veUFaGlh8VQnB0eWiSzGhLn5C6ZD/zx8Unx3i8I8fC5fQjQrCS7Ka4Ts FFei/LDozz7MxoVbC9/Ivu9o1aRV1l57S5/VyS9xKbEhzyBGQYdnlI7iKDAcWejscfTHeQl5 n6SguWodbhHRq0KXf7zldZF9NPTJRP+OEelCV9MSd0mIqWzGBR9xbf8qq2/GnMQYE9n++aW0 w5PsNmt++tb18k3939NRTOGWQue7N7bQ2toyzq4tcD5zukpJ11z8uE9IF3/w2v3k5h0R71A1 OTjx0ZPauOUedVsiE224FF+x43wBz0gnuVpS7/jMnquwPxstn9fE2j6YzEkY99WBl+a8deVE OO5yHS7z2VSx8c3enZyjkdmkNppYlC+abFF3hajyDxHp/es5iWWlXE1J3JUrkcMV/nBn6HE2 iV0ijxQhPmpM7+jv9hY6x62sMggendJQ9KI/hPRlcyUGjfST3O731zwTzYgiOUVLHjkMVx6O blaYApbEIjha6Z0wfPG6hWtmHmliJ5vVt4jkNRVRJ+qqdzT1iDkJ71fEvuqKJh3/eLrH4IG9 b/Gxt2sWafrrV6whC3iPo2qFjIAF/8XHtzgyufj/f89KF+umsnMWlbts5MSHUiftKDUkZbOb oUJqI5qiQlJHJXQ2jOOWU41i9mB6sNy6oJlQwmq6nLQll3WhlJDf80z12c7v9/39AeXZnvf7 /bq8X+85GJfbElJfXjHePOOi7nCgN9PWwdg0Yl94lcZfC4EJlrHfHnhjOTAYIpLxo4V4SEtw XFC7Eibjaa0ZjHqH0k2uI7r+8b85OP726PnTx7J7Iauw8lMSNHqlHnpFp4Px8pIeZ0EhUXzm S1IruhCiAtferQU2fqhl58c4hn3QNEFrDf5J6oKkeEIGItM1/yEazY+3YvuKZEIrcrkF+6Ao C3M7vSE6YfQzn6aMnYLBq008DV71rJBjB27x6Xr65wA6v7AQKCoufsfauuU1rLei3nezFmna lnMhYkpL0vJsYrReYoGFmaKxRgUXogUfLNnrS6eeJXfdu9bKYa6FRp6ogDUfGzA3b0h/vUZP noPEFXW7SHZuB6o5gx+i1dI1TFMmLuNnimR+K/g+V7oRkLiayNG5q+3wgmLot5RiGFhVIGD/ 6X4mdncVycn8p7OaRueTtQiOvx2kMos9q7u0oceg8kJ341OczQogwrzLNDH4SQsLvBbD7EYW xr+cz2VuSNHO9PbzoXY4GL/nMgs7CWVO52Gzb+qs7nBdbq++5gRJwfFI1WUwDUJKuog6ozEV uOMyAV7Fe/OdPEWklKv2szU6zdPsm4IqogvKRPmQiPr44ePCBX/6esPOwqaYL9HPLdmc7wjF jK+pqQrDSll6g3yzoADW3uDDj17BjDexIn1frnYh1M4DOZxfsCYOxvnRcWFDGksGN3iLY5p4 Tkvo6m3AfNg+sVQM8axWiKfldx0W0dZpdSzZHvvJbyMdSTPczIUgafh+CUTU8YV0vVGsNI3G TJk3tV6vt0TAjlsU62k41eHQWvIv4LtPc+efn73wI0X54OXd9aWb/u5CKBhPN9bawMBna0YN 2FhZ6Gmw0LUB0X+gYW8x23xbESukpxk9lwTUQiq5jJGcw2FVbaHMUP9Wv876KagYtZrMT7Yg 6z1sNkK6aSmgwdb3dhqRnmkiUt4mn5iapVj5eLiPqAApNA0yCY3P0fY2bP0uoRjidENTLjP2 Zc6rSPXswd/6c9bRWstxZ1KdhxWMx8++xl3ScUFlZnGWinvSIBElE3PdYsdttwG6PiJ7U5KY Aw+k4EjytuplADRDF0gRTI0uizGCoClwFu86jS6i9bSMSpf7UHMtIYVQbkqC4Ahp3JUlT6I3 hylP3+s+z6czr7CUjrmd+hqOhWueJiS9gEQ/BJeVQW8bEGO3ynEnuEbBmV4ufz6uXXX7Qjej 4pDy+e62c/pVQfAEViTpD70tlNiVOQ1IwH4Lgqjb/A7YtiBVu9/b0EtBg76D/NiYUoR6d0xY wYM5OC74QEiUhQXbZz11i7fBJAtci6HyiJC80fKWh0EIipwnrSGqAKqO1UoxjIKEnRvh5cij HB2oLLpd2t5qlMXcxatkCPRqcjah2YipJ2pV5j6dPL0ZzYeo4Vg8RDyPiGRWnVkC+ngYQUGL 9YPICcELAGUSMIgIcP9pvGmovuT85+uic/p83V2A/aVU53QSSRoeuoXfX0ZbgxLvv3R4U13R WeZaGqQKZK+yc0Cntms5nGyoKa4RVQtn5decCf25GmGqNdMr2LQAne9IZArJN8GCxOtOK4b6 JeBHsEvRGC/K7HeBvj9+MbsktJhu6xWxbGKj45p1mmbkP6GLw3i0PSLZw7Q0fuCA3sW1kCyi InkuKHT2XzkXc9cqGIZIXoYlq72l6/xO5gsJODJSTmhGi5wVNCuoIEdm9kWqf9S/t8Ar/wK6 4NIupp0Lqn+oWwERhgPwetAmz7I3f1oWjZWnMC4tFe+PO1xfN+BtGBstZSiz3eOTxOgHJLGi cYwaEq+PXrYTpicuClqC7yJ9jbTQm7mwtW/Rns53qZYtuQtBMthklos4FgPhjytqDYw/St/Z o9v64XaNqKoAM3t+JYmp7dqFrK3rTYJ4pSxBUZHw8u3nKmMvwmPHrAWau6sq65k5ZbRLWjbw FvZInZbwykMrsi0Kz7XcSzBobzulYJgeiPuQln2lu1i3o5C+YUM4VpqegXoV5K6Q/XOSCBx5 ShGZ9T4iM6eeZNieevmvLNyM6bVVYHG3PoacnZWZ7Uf3paYuFddoCYObGFtLHVjuy2rrfULj eVB35dzX1xgskj8gcBl7RDPgMxlEodiWa3nZkg1V+hVsj0opXE51foVCuYtk6WtJBFprGr85 ArT+GgGmlOO2LpD+BqKu0aP6+pLWkcQJZZwXv0PzppjtKTLTejz/Y6YeViqR8/aiNZG3ZDFU vC4iWqAXiAfT8HZ3EZkeqMy/UpaKG4cx5JGZWeMlebbDT+VJ0aCD8UprSIfVbIq9KoD+14ry 5cX07HMCulv+xW4iP5dJBCYHHre0axRM9NwtDDtzKg9wZFvuhemK8G+VZKqKTnE2gjR+hWGP HhDzdaJf4h5/jwwI8Bie4JsznXVsreRTsH+gJn5zYJWf6rxdm+cfF2yPwkNV2K/3i/6K2gq6 8o7iLt9DsSfuw3+yyw9B+PShCbR2BaAm670toLeEFJdk5XCaE8oe7MmGt7QhVq0y7UwXqSQY TqnoDr83fmyOb8Nzrlp6aAh2ox8L2rvp/JCDb98UlskSyEAEVaZgXMSFT0EMa7ODMSSXitnV Pd43WCHN/B/wlMw8EtEHEeZZThMu8dsbvO4aqdPuMFu40p2OwkssJ9gy5Zkk7kfydqCo7SFF S8WnbSCszmpFA43wRmbBwtHIyJwczntc2zmMmORgXMawWtQbO1J911ZT89qYQlzqtoIBQvJ8 MFok+2sHai6Xn1vEAhPdAuMmgj0NnB/gDbY1F+COY1rHVSClTAyNj44FsNLrtNQcTo0uy1WR VEXC29LdrhIsoMZaJixzSu8/0iTUyGB4Q5w0sQw367tqSrG0sTO2YFdakMcvHblgftz1k982 oFEVlvIW2ds5OK6/zNoqfOqzXMmo6o5+GjYfKw/xCLi48F8mGKSeZE4HwCoWaH+V7m7JLn+g YLy1JgrxmWmQZpDgYUfgFlGc+rJUF2LyNtVHKQs0smkr48RltL9heh0ht2K/PCGSNWVDE752 8vRu4bkynCvycaVNOe4VmJ3OtL/znGZYf5yEr2cpbxKBBF2WsyJpOxMrv4/Lmyddv2E7hhca T+TCOaPJuvBcsoZutIDTiWsUDOVyn10KRij0gA4ZfIVW1sjv8jAruqiAYLg2fLBb20FJheFI DrUPxdCtf28vRaMEzs48X4GrW4TkrSYPfpJ0vYK6XrZ1RxOjenz22cWPrJuN+n6WIaj7FIwL +JbYxYXdDTClcnxCFHU/l6YqB6CHE0DvD81lRh7dO+L5LxYP8crvAaGugrzAgYErElg8iTsk A8fbKAa5LPAoMsC3L615diNVhVDK/yKT4Lq1zYUVGhHa3w084dHm12cFKdHWApxZAaSQfKHB c5sknuHFFhSz+S2JyHDbvfGdXGatRHvsS5PEjhB79Xlx3tHUMR3NPVnnnHWeglK6e2uXDTq0 eJ8luzZmxkUtlmMR/M4DIbX/Bw1JBnLz8nLrwEL2QYWMsl0FSvkRhodqNMa5P1yHFmTm/mDG wQNR74tqr5R7Z/DnRykYTfAwOxY1uuN8acjuqT7rxQi0a1wSakP+lNdz7bGX1STm87osIr42 XDk5toHDjP+2T8XBixZIhkVGs0ZYGl/pHlgYnc61IqdGgOYXYBWR7G4lCLH2S9Cy6Xlo3mxk LIFXRBG8FOfLYNaOirWkWx3kwEPYVU3aaC/YGcIE8TaztspoXpiAzTFNr5KIXl4k4mc96Yov G6Sun3kvNeyx/4nLnrMOfoWOnp7uTHAgK4uIiQkR0cSIYxEFdxmef0z2ly/jc0NFNN7ub4Ze JsXwz1NcJtJXIfu7iD54maUsWJL+Vn0kGxhOb5zSymjQP3ZQMAi24fZUk0sKBoehjL1AT0W9 C3WGTRnxa/H93fVtEGjjMdLFrJ+E29VfYMOiOVSDld5IXlLX9r31ICz2nyMcdCpgXy2ygu7+ iuE3oWQklEJqw8pToIWRdjaBkD78Q4J+wGVKtC24zAu6QhnNcGX2vNhi9po+Wz+N5sqEORUE S/mryW4+BMB+44Z6vCjL/P6TWJD+EPGxuhmts/b1z7q9U+89lwm92s4JnVwVsgs8p1fdZHI6 qs80KGBv9OGjqyDouizIF7nYA13NbSBx4IA7KBNtVdAy6Uc1Ay1rF0HNvEOI94kxoPKqr1bG hu3f4mlwdeT7Iqp5ByphJ3OKJkKFqnDK0rqtR2LXrk0NgHBqdujR7DHNxPNO2r+yQ6/SSYFx Q0QLdryC8Z1whsT9VokSezSD8Jgvc3JtO/es6tV86erVT1Ru38BwigSd2UnCp8JwFVGV3sxj BlaY3bFL1UZXOH0l0IJWbNPMhdPhqPKaZqP57SXW5J4nz54S/MElJXTlsARq1qv01iX738Am 36qgBpphZGUlgiRuLtUVPqAYcukPSWLcufq8F3/Sqt8Q+6I0qt4Cqvr++tGV8G5qp4j2CGZ8 +yAekkGW2rNkiGMntTq4B0Ztg6pQsB2w/rsdUCxYbb36XnOYFUVUoC08guGRRaRr3WK0RSHz wmkNPq4DEbIsENeUzrdABpSAuB0uQvw1upLI5fvQZfD+yGJgy227xVwEddVjfdgzqjsKB3Av /wAsz76kRxLwpK5wdWp6jo4KsQJ/wSx/NU96fl3PMW0NAXN22sK+xQKDQ6dO7pjWUwou+JHO UTA2Xd9nsdSm+fMT2My2y9U+UMxmQrLWtRiaQLTyPz4PEvHF7PzwhEM8DSFrgajT8txn68pv 5PJBB5gUOwxCMiWAE2lDHjfwB2dm8J357SroIi/uDbWZeImRbr1GHy+0zV6psVx0gbNyWpKu jsz1Fre7m42sezYMo8Tv5wbGdSoYeqEmWqzQKYO/LIcfmCXujpunvdZKel5AX4LlAfTsCi4z pvbxm7YFm3Q7KIZebXhITpnGzGW9U3/ScyY/MkSryMjzJd6x+g50gtbjuBdZQfFP7gm8sTx5 0me4443a/evmaBqbO3O0bChAN8RD19tfsmK7mWmlsMBeZ28evDI0F3QfvEYffDvYHHGkKIfT nf6qqW++LzxGFRFU4Qr1Mt1yoasBQfXy8hn5j1f2iVfeBtD4FHqbJ8778zycYrAUFLvC8ab1 CsZ7lLjX2X3MsXw/Vg5A3V2sy9qqSJq3cP4HPawcW2JQvXpk+9qAwUVT5hjdjganFO3mRg0v I8UM/riW7JIRlHgNJJ0zISLu5RLHoyu7hTasKlQFJKlcMDwhrEfRJdNZoCt4rHzG5KyMDxaS WxqDMwFqaVj0uwfZnBDiS2GcgiqmL42vm/9EHyRRRBGXMNJhFVY9eh0WoEIrl5qTVFv1veji sOu07SLa5is74g5bslN/gq27N8/qKAbPL17UQoxv4q8Y2qkTsWu9maHHsIC9qY4JjioHyT7s 5RxbI3hdZ8MXsI2btB93Pfg6EOiN5TIDo44Jf1X7yDOX3Ke5h4YIFYwOYLShDCehCMoK80Gl AlsGxyNMqAFbqAahGDJyv12uZ+gsl7mcPc6rH0Ikc2lAnv7KFUNv35zTZd2hGAZtxPIk6H52 DqeiG2UhHg3fWlSEwWImkpkLJ3OZcx0fUDVtscSTtqQlSLmxadd1Eh8odMnvkKbzrfDa8hur yT2gghF0Y7b3+dJNMSTPZBaoZzetruZJHX1lZ4Yqze9umz0etQFCyWv0cpVFPZj1cr+GRT3v h64qbmJA1DYNosmcAM7atTQDNN8H+1hfhLKlj2CkENXKkaDfw5Fkz/nSgVyi+GZYa55gknDv 2K1wTaZc72YQEBcdbMW2IdkmTHYjxnoDo27Cw42oLT/Dw70RU5TvPm8JJVdXfTbwt8vkx7yv 5F/qAroYU+N+PBq8FkG+SppZzF6CCdpCBiywPCLgQBIzmPHRwTYTZU5fn7olP9fYDfSoodou IOK0+EZ1KFNU4KyMTLU1WuCZawuRw4XJuh0l33WV6+8VYjuM9GC48zu6hme4EMGhtbqgCvkL TRIPf/owunBBctJxVbyopQtwjwsoJqXxEvUBH4KoQlizrkTA9jfefHqyspBu+/bL5LoZDtoa ZMzg1EnjrmBRlkvcdRjwuh896SiyZOf6PH5WF3frxYM1gXHXYdQKeY44thr+I2PNlThJ2hwB KY2ELXU6g5W2Te+n4NVyDc+JgZXj/EIr+ASqKipAxASY+WDL7dBAIRGvi7QY1zEdSs1l6pAR fuqz7+ak0T/7wb8COGf6pBn8EBkLTK2ERJ2nkoScOTr7Oo2TZXrLA0mdNgKnxVaKrbCIABPX 0kL6YJrETtC9TE+MFvmR9bap3wDF9cLJ7j5LeDtFu6Zy5Lnf8hVHm40udy0AsLf3FUdgldQk 3WH56y8SO4jMEgwHbds/hLmH0pE8p1lnmI15Vr8t0cxIb/4BW1pWbMIxpFzvLmLsa29vRzq/ cCm+Oe8u4hj2UkHe0DXQCSs/m/ipLyjIhv6Q0UoE0Fh5mgSdwKff0R47C1icmK9hIZz6F0KJ johkCwWbDlp7p3xZcoGOhTQmBhIA2xUyH/qqmlkazuSvPz1HWHCW/D+QqO+tBbkaewRd2M1j KQcGXuZnwbSswh56dToY6dd3RxpK1HXvzeX/NxRt15bff/f68x9C3OrVgmIgdBVS/uzrLc7S PVHNRimIwlTnUtzXouCHLMEjiZ1LfKeD8UNIYbejm686dQd2HCCISC4K2XI/fI2+xsf9C8dT 8fe3ry/TleRGqSDWERrNAP1hITtb9BGMVshWwVy87J0GF/8cDo/j0LgPLV3Hv6jWIK1WllYl QMgTImD2wIiHe0a7pBVr4ClI0B1OrXDypfvBkskfK6V5Z+l5KbJc4q9zmb1H81nKdp/QCTON SLkbRKN84WQtv6iIebGA8bA9GimH5mfEoCoFV4YS51AMIj+NmpbW/4IM2Hnq3aH3kIxzeuOK kYNc5uXugb1OExbi1aPCF8c0HlkJr9mStIaPPEM4mDUb2YaPFNFDNlaKnEW095cHr+ahHehI b8OFxN8rhE4ATJ5at3tc+LMwh/Ps4hvggnRMAjK7ZDNiPCdGCX/6acbgG5aE8WhVdIF9bvPn ZqPGNH4uARh9yBgqWHm4k7ZHIYsvom9IBuh6LWSg9uDCV0mdBZ5EoNFPP1ojhRTLgUrvN2TA LYrg0q58XB0MUQSI2iTDoS9loXvcxNFAgkF9/PnS0BTj6KnjiDrd4buRgu66mMkvpr/RHzoY 74Vf+79TqUpr38MTDI2v+Hcc067WvXna5NvGb1ahlNf1LIpB+frvEDU+oRgk87vwKJHvyacD 1W1hrVjx6suwvwuxm7PzpDKaN8+g+q8cjtEOo4sIzaWK3bd0qmvRYxYI6ablXoAZvEB1z8dl sUAfbyCiIKrUGuoI7pcbytTl4D4Be1/V6PsO+4BE3eHXu2NDt7G2QjT8Vlydr0v8UFgxmwg8 /XikcfB3dXuVPH0BZeEP7rODL44KIG193iSxRvQA0UxRVjCGmvo2sFr1gKe74W/lBLw6LXqx rJBdf1z3/YiGho1CGCJ510MOIAOOJLsPQargZ+ueGShxAgUpb2ycjVb5fBSDUCK9fvgPPIjy E5kVst2Q4eUPUyHwMaGIzugOv7HG+mqcHNW7GrBUN1+NCCpdJFugYNRfvnHiSxCkoDa3vDUL kvNb0YeK2WebtPvJgHvSnwsW9ufolDnVHX/Q3fGESPl2fbF9sz2XWX+co/nAn+f+bwDkIpJ5 MAV+U7fEcFQjs4TuTfXNqeQyN1fy6bZBEo+cvROat25hUYgLxHIFA5LTGXw7+8rrGGRAELmi MhSX4tyUpsV6ZpIot6+MNKHKITBePN5eCytNiyUrK/iTN1YlxmhtE8RDAOSPkSbpdsiTZmKk NpmHQwYggVlZn/Z5rkZRWHzPnZIVDOu9LV32ISJZszdUCxAmFwu/WD2fo4KX0OcrVibosiKj 3DBSEiwn3X/ETzfU3jy6RmM/YfKToAuwIodbsqmBcfrdCoZtODKxhc/UO4bkLePXPkyYjHd+ lNR1ItEJWXfNlp7ooi6R8G3iy23wrqnwVPBVluCGmnE9mnpVb9MszVOXbTfR8H1PGt+LSHLR Dtgjot1HOHArcXXvrdhBRXTlN+TZNZ9icDpr4FMMhDzXJGC5beE06rhg5BNDH6aBB0kzNA3a cqMjBhz1OBT0S7vm8feJMz8gqDjD0kkke0vw2TQpuUBPRANa05KIwar5myXIlIB5or8+ozXv y79dWgjELPBTGn/yeueN0yuTiExPUcSRj++H7zQ2jlWXE0KrXlEMzZu2BitoZyXoQwK2XVe3 9tijgM+zzzAjj2KGNcyskyc9oGJGrSK7BQ3w5kBaoSb47a8W7M13rrxcIkGIqq4Lb9RdsmRH jc/eloLoN02MTlsx1N57sgFxbPbAYLf1JYUsBE4m2/iJRm0oovQUCn4Xk6tLBMbIC1ZqtPSn xT9cvTIFY/zstrsmiU9opMmClef0AajQDmPk+w4+pRlePU0SS33b5kDN/Elb3qVOVRe53OQw dikY7TY2JGQa/+MHF22eBTkbgrjxv1OcJ1h2CShDreG1B4SfM5KJzL3xEwEC9g4F7aB/TJc8 6SiXufExsMM/Pvhg9LOdb0lAgpt9QLxJkMnwl95EjQ6kIi6QRlKcISVlasH2IICq6yro7/yV 9R2fOikCCJ5qqv7ZEOluEAD7Fj6SNvCTMNzdHoBeXOsgVrpF0BV4sf/M0G14fxo72vGyT6M1 rb6dA+ZW4i4ke+xov9fKZ4Efo0XLUOJqlHf9xHHOHbBUdxinG9CHle5r0C4M33o86kb1+vPX nRzvm3eAV5c917wcPm/+Dx4ME9FC1l+xZNtT5U0s8GH5CDQ6T1D3PFUg1zFaSUDM2GW57G5L CxINjE07f3Us92kqOZ06PcVl2pzPZwk+DyYHaexLKfBXYsl+UUYLZ/a4PUc42Kx3LLRit6Qg MqPKA63YZc1GcUpGpMXmo4LeOZ9J36OnXufqhU4X66yKfyRPqWgA5OdAtOh8bdHRFRqdkXuy m3G8hbN9m77qPFAV73nAUO6NuzcQwNEJjMvJ9d6JEs8vw70ZerNSX3IQJGQ/mnovMRuNHTcL uWeSuNS88MTL8pwXWWR2bgndlqGUf363OzbybqVT23G1e4vJL1p3sRqG6TpEG8X9uuzKtj9X boJK066QuL4I3uu7w7x9Xjo/N5e/IpgLz9/QNN9N7zs000A9a0hibn7jGJUgsl93X4otZC+P h4XW+WrxUZTGB4TZJ8Rr86azMEmW5OrHCJfdUx7n+NVTOtuAY3fAsDbxke9HFzlEcV7Vo88a 5u6TUzgxwqKV6tEZAQ4gkHLkXYSDDjOuhi1apmBEWl9/I9c1VmVRs4ro2UtUpmA/GV4SmDHc MdLtZ2Ldj3gFOjemQrPLO+fcb5ppsDnwwgq+JnRO5yt3AhHmngMeNefSmcfvj8Fbqslle+J/ +w9J/ORLUYVT23Y1WBsmGM7gMj22ABtt5j8mAlrWNo7qluNND9gCfLEUz7Ucxlymh8SzwE2X St6MRm6B/W3o4SrqYCm1KQgjPTNrPJQg2tcG5K2z0rS1TXKnhZQ/bNckt1qFSBCPH3OVSj12 AAdSUfD9BCSjNmnZ+AGj/SMZ1n71RUvxmc9KfZQHG7ut67OudN/mMvugGmzSPsDaiuAyM7ff SJeAvOeulE0a1Bx2EYTnrG6PfosAWUFU3zzUHzE+g6bM8JplHbZtphNJvFMh69mtyAqKz5nn bagHS6OXLSkZGiw/9jop0ZIc7mmwERlwWCSrwJA3QCz8ArEz7zg6qAqVqjphwIhJheyxHM4A Jtt2LxziiQQOidTH5v8gnJeENTG6ERYKhpmWsJRutT8uR+Jt4CXKsrrtSFAwfvYVZQlxAyuG blKUzzflb/68sXFR2LcMqjf/vwFUf4JhSNu5D/xxhjLvssf2ixoO1B/T2R0bCpCuVK7UX/YA JRaNNQZyIYCirSl6/czx7rcIqkv8k6fPjqeOsLYWNGg79CqSXkvAfRjp4hPWe8bUf9kB1v9J WDITzvjVriZXD6c6m9D+COBE8Ts745yL7Arp1Te+HB170ds78fRx4Vp6DwzZCtllAV2vjMtc jglqUP3mROXPmBI1pGb/ZzrQQ3B+5IG0Yi/PfYrRYsGBnrTpPM+0anpwyJG6RXdP7FfLBXhL 9ifaFa0FO1rAHhLg7kcQpbtu9GIIhKegV/+UQLFW/7EDuEqn8enpxotarONN5biDB0PeDhgN VV5dY8FO6kIUva478QukJMjAAax83zNth+XXnepGWVvx8TXZ/FSy2q9B4H/9aVuRM5e/saVz 7W8ZLHA6kRpLEMlm25HuII752VEnDqmHUYUk/FWWVWVZHYO1tUYCXgwmXy1zsh8k4r1Eo50t aJ0gpfHj+S5t+FOh9pbL1VCV9K+gj82Ry11ZRJ2IYJGsYDlf1z8u6Wft6D7HRRD/GuEyM4Th ytohemoyzDMIrK1AIT113tSNe7ZWUu3NEy7xNV12klQ1xE1xgcTEZOXI6bPHi0dfv/dfDsey IRrA5R9Ayt+JH33mUQx+RmWQTbU8veGztF+Q8pid3vXH56lyqMO4fKdX4Vsh9HIoYKnDl59N yQaShp2oN2edvwq9ZCv5EP8KynBFQTUo/oFhXpaTH/Mi4eTIEiyvwelETU0N+0VWnnY/CUhO XrBwwYePNGyAt1t46gog/2FhWhC8W6QYhlZhNLcHX0dWbuMfQ4nDhPhpHDsggY8nqJ4GiVbk 8Uu6N/2khvq4XTM/ZOcv2XMiWsqwCo0nGn6VaB/7UlHKColoIgLzP3zaF1i1VbFs7S8abBUB 2wOXFl4g8TkNJ0Afd9PE/ciA8cELQPEO+KNQ/eOeLELK2958vXVp5mgqgpq2AJNs7nDHrh1m 8v87WN3uav5TDYlN/oLNQMEoXklKtCZDiKwKror+piuH6B93EwDSMkiYXjncmQU6nfj441Ci zAmwtGprz4IPP4fYp4LvwvGQU281K8kerqSkLqJOhUvchxTnvZKuZxAIpL62ePp2WmoBLHdv Q++sZXnQ6MrGpvapP1YujEtWlB83gJCqb5AfhgS50ytGGp8LrEMuP8ajJUKahcBlhu+Nz9np YDwp0e4nApnzprIGiiTntRPQc/uSTCbPB0yqg9L9mUZ3GWMskAgVdENnkkmiZX8AB146x8wd ukq34oVL5Ega0J/DUcmu/wT0EPHPtY9VWRt+vSUBE94/eGGYa9th4WBcp2uzUzS6Jd8piwJh c5W5+ow1wBl48uMJ8NbWUBXFsyBjlzhE3LExOsvcg+UJ6N4ZL2S9qsu+Gz6KLAfjGVdXrVSn RyoD+9uFxFWc/fcDCUv2iBnVxNwfjIYVhaxy6ivZbM1xI/+vsvrfF79TRrnd3KVKBvV4AYE2 /TSMNOVoy55W9dGv8rSF+DsjZvldE9/vJDrcUM3eBpt8fWK+TIy1SEuebykS0ZTPMDoLiucg aICWgC0lA4IBIt5HRNofHxxsEMQTu6VdVfvEJmkw1bqycw+cBLRhW9qs2IFyuEwXzAEJAx6H zjDXFLLXegG1mGI6HxA6GEe8lG2O7aM5Wbulqzet+pn6t7OIVKPgjSQkzQDZAmdOt3P5PkcV DAZAWkcar+wEte++nZZN5bAtXWTQoxJO7lymHUZXKLzdguZMhfzDB2OrXNVJP3vLdBrCVaTi nmW4iCPTqng/Up7jjrpEtzr0pfX/dyEBYSBtcej6YrXjxr9XIQyR8pJ0fq1UwRD6KBPrfZID OEJCOAfmSQDg6HuiqmpdbGQE5g642U6FTteIcNbi+9H6t9sIIqB7BBw2UV8S6KiMaAiSHa2u 4yIORwRFjc86Y0IN2OvqaXBEJGvS8wEicCLa4/4yPRRPQfs1yASAOXj4oG8bPlpBw3zsBJ2+ riSJZz5NpGDUf14Kjgik8R1Q4n50O0LUn4+r27gxyryny5GOKsDZkKp//5g2UGl8lilVmaCH 72uPyVrQhrodtTZjaj+8YvACNve8gNF76XxQxgIv1n299eJBWQJT0pVGGv9DS0j8KFVe6NnF TLEd/nbLRzG0boQ7VWHfTXZvE8sbHr1+94/Khn5IMcwGVXd9XQ7GuroeDcnj+IidKbYp77KX tvz3vmWu6T/77azhs1kvGYKafeL/EHbt8Uzv//+0OGm6Uebo6n5fnTgSKWshFHLbmEllcmxu LZGEVqlEmss4ifrmGrO5fmgh3Zu5dA7NahVdNh2VkkQkfp/3prbO9/v9ff/t8ejR+nze79fz 9Xy9ns/np78UTHaB4Gdw1R5aUz7X6GLwyQr6OA/a9ogzujMaTLPzzVXrsLxIVhUVplT8R/kU qVt9ZMGdmu+HA0MF0+fpBQnyXnW4b/fzQsJMfmAJ93n6Wpi2nfPzIe7097sPQxbtdwtTuriw JbxBFW7BLiJjqxoaB1+ltp9So24Xp46MkhqtwyWaosy45ho5GTvt9iK4CXtOhYR/UKG1+aY1 VXVNV9mZ9nBRGng0DneIDZlWQcOhW1mPgATT2bSoHnstpoIeMYzjliF+BKYla3Rx3NtPMnwM 5V4ueED3ERquKJh+GCvWJF7PhlFQNHw6lX/aFMal6dw1i4Nummkr/W3pU8qd/MzmE3qRZdhJ htrwSBhRLMQkRtQ3Mo/xLN5t/zH67LBykcL6b14+aOJnCi1UXZmEM4CxSVRRjQk/pUg1sMXp KJphb+m+2tYZ2VGL7YfZPKGRA2wTFu/cfthwLgcGPeBFd6L9JiYrbzPpQXAaInj8zqhdLc60 yUnfQ1UtCZktgpbEadc9iXtEuWATNcwMThrZ77BgdMxLnOujBYY+waWl24GJ5BsULbU0lr9B YE6wG4i1kqU+valTbql7nYawK0DuFdzFf4F7l3h0gQyNzl0/r7pNjnH8qYBFOYbUdRnR+Yoo R292vy9M5Qh1MBip7/ZkZ+9ijbZMwz2oH2dUq4QaFh4t9GJ/GnMyLvLkjKbyLMLx8v5Znf/i 1TPEb6v7LYXQlE0RfjFe6WNBXLw19CFSoxyIqBkziNPFtfCXYY5qzL09N2T30Eo6se4ywS+r EZPXgYWvYdlNQcE3yAnw89+Zd9GcQdlSTnXx0IpgE7ew9F7tvSOrjZgapfUeHdmgJKQ6gwCg EE8U13WNLyl0D/VQdG8WU0yqyHajmZriM39XybDPMHm83IQEHBHRMPtJ9dEqI27rWXGa/x3I aCLg11n8MCBs9pc3r5cthXBx/N7dEnep2S7aE2HvATR9VWUoUtSwA0miBm3zwK+sAc68+nKq w95gUG9PnowCZq9roZSwcDKMO7qcGGOcbE+XsRXuJsN0TEzxH+sI8c1ofBzDDZVsit9gHRt3 yIFD8NB7ZPEmWgI/cPfzMlDn1jHr4NsNwFEe2unoDTPXpJZ9g5feJ23v9W4/LYcRPLrEn8c1 2IkkGTNcg0kVqPof/XkheOUz/KnmfrdD17zrFZZDKIY5NXp0VPT5712JAhwbvQZ9kEE5Nvsv GItArAxDbWfnqcnKnwNYXz1P5Bhvk5vhOf7yfV36RDjqYUqH2ULz12NbdIQIq+BMe0O8iV/y gRzl/SJCe+TgZ8dSbHhzaywQ5gC2dFCi+InO2cORHYRz35x6UTWOUVJX+WP+tcvVueeYA0+i PzZM+E99uk9hoGhSkQN+1RpvsbCx1lODvaL8uRD4GIuxq//gWfQhH00N2zONuaPAWtaN497T v2X7K3Fbv1pHufyzOi71mhszH4RDCHDNBpb9kkFKTzZykigh4G4te88EcytTTFgLfvZ/c0TU bH/nIqf0gTtAqR3ClN5tfgEMnAdXrVyRaTqMD9qRPDnMfS60ANvFDEC5S+UoN0gskBAlTwmt Z9UTWaWViZEHR2BsWpizqnLTbpqpysCI+oLu/wFJVR0asWgctz57bxho/t0OdDqmqmXkpSv0 PvIxk3dtf5vtFaPp0EBwApIEF/G9uzm5XeSLtm3hUCRSFLDj50lenOOPgz0JlbExKfLjlDwg ZIYSmbVaU0KkhhIw7Y1E7Kj4oUfvIU9ECP/pjbBWpPrkMDv+IKV/yqvHrNxFazp5+u9NqzJk o+vHT6OpDnC3EuFW31ZJTPEGgS+fe+92ya58MhgGyOOQF9yjl/P4wB1xhgp9MWW8u1FtBWZ9 ycBnDqkNf+VI9n0wKDdgXZPALua7Z6/tjz94kGrL5n2fZafxhjT+61ar9rh0SYoGIRLfRTwj Af1jGK1IpbFTR3QEe05QZpmIcls1WvHsoMZG68vEbUNfU4q/SztoVH1gi0BcqsvFs3HeOslf yY25zqgQcrr2WzmLhGUWs2wQZglPdXyj3BbqebDEJkDTtsdYILxMNHn1eAlFNldx0oXrMcx8 3vBGR+c7IklXiIPP/v4sGny0oRqTMGRKd2/Vnu71vHF991d7xL+Z9iTqyW7PEioL2O0f7fbQ igcue2YRFZ089luPLIGIlwQfZmU/Tb4P3E00RgHJzISYbE/Q7FglSnRXGWK+XztrK9g9SXQ9 oroibNq8+aNjowdx3OySu6+qrXSKsNltYSkHZKhmt+gUhMGp+4DBTTCAz1hl0aiEDabyXYPY 0Vr7LXj8d9XGVytPosp6QsXCk/C74TwK8eT09BmU0fPLqSw+DvjJ0SqWv6JkYaq8HOAaCWBn n0aDAXU6Kb2Y4e2EevSk99HjnOtTe0zpY96GkcQx2pFsiu2Dl1/GDgJJ0+PDmfCz0WCYm9n8 9mff+UGUiYjJ5UFSrY8Z0aTvsYaJ7KEH2UvlqUGg3w98mXkNgNUXTZh6/QIzJONbAdjJjrtQ d0OGJARFgMtRV+8HpD+7AXst4VOXKHVXkinTTy1FNh9x0nnmCN0E+rNz7kZ0F+k4b0AvJdVl u+v9zvNUKC+VP4zi7q/GHGrVhitScsJEbVukzM/HprLA8O5pj9wEx1D5m1r1AcElw9668QAn twjj+rMp3e9xI1tx+CWfX3qfdn3qvZBfMv3zdG3i6MfHzplHNnkfxXEjAlyMizZIDKi9Xd+t FB9AIaXoBxeZvvMwRcjudyZgT7PPftOq1lzrhYkEzyDFLpu54hxJhfEw4DL/cJnDrsSQ06W2 CQ86I9H6asNSfh9MMW/YXQHfRm0c9/lmmJpqSfIxvEGS2dRd6ORUJ0Ta+bVCLjvw2Upw5ZNQ XC/j/M4H4yhuWpPUmVjkjKpGcWtrd4GdgS07kjegbk1GGweL3r4dbP2QDuNyU92vthRjwc9z CkwE5Cc8i/G+xdcIX16tDChZvlROOYX4vmvt38ERPmh/MvlimAc/ukMoxxUP7/uw8ka6Anam SK57BsgJCTQRVGH1h3ruZsjqUutiqWhVdEBM1rH21Q1g14vP8L04hJ3MePdAKGJ4zujY9XC4 +U70/ZolrDzrRaHxoJiEzlOBSXmREifFMsFSqdd8UrEDIW/cSPqGV+WUCyfQ9PEfoCp3yqj6 JZ+K/sN8mN+feripDgxrjG5BK5ySRkwE+jBd8ygr3ZOUBTwUjLb4VLkbSQWCvTxS+tVdIKkD LnJHgY3/jGLNbbsdrcvDRZGDuTxIzQkkSix/j6+QpX/ongKj6JpTTkBn9iNkwQd6fKA72JSu p5Pk/AyzAtK30unzOjGtricgXYne9xz3D8RK9+Kqy7klxKl/e3HvnSWVwn9t7tUP1V4ykRZi JjEhpWrGX766mQpV7m0g7GokzL2MWPDhgqp0xdqDHPBmo+GO41aCONeD4iI1l0tEqLZldL1I wYtFstdmpgQI1Kb47z4JUdVq/Pm1rdpvOC4MID8dvmCcR7U2lc6rqVHxYqGJHwfF7EFoTbVe mVPlLJ8I4HRdg5nUxifnUyHBuASeVI3xG7zFZPUcHmL8kY/mASXSrgoHJMnKqbSlCgXIEnRk BqDAJBQmS0YMc0naz3f73l1k7Jr3nsuXyPoF7e/hdf9u20sMmk5qeTfOCHK4LhkIRIqFD+AW j/vnLglBKvSfL4Ax6sWKsxYyjOrSAr4In80SX0R9zkzOiZ2fZjDMPszne1m3JUv2q3pWOqtW 915Ux3N6HMSEgSeX13vIRhQ2iPRA6DMVYodG9B0pwqSd5PEXpKW59QpXhlJoWQsqdtQoobhd KnZjXxwhYmP1//RE6L1fzZU1uNe/yrSlBTx+72WSCowVDTVG9wpTJKvT0TFdNap5w7Vs4OHk rrwv2R/ZrAs+7sX9EvvyxWW5u660JAzkq3WUkdKhM0/6v0GQrq9o8sVRKkRd4jBGdUknu1TQ y6mDt1wYlK/xYGvqzekhmwD/ePYRv5VymcXFWBADgeKWl7/OLS0D8XP+8V4c4XFXlC/B1/9+ swqIIYZf13txwORyr7mLDTuRsZdPUM5HUHuQVoVUh/ByYpw0x+QW5MG5tC9PNqJJVbIjg+BN 3RQfZdHDz6IRkGBSRGQdZ7haLT8kikSHJtkMfTNGdGcCupCBLJtx7Sken6AaFbZdLJZfngUg 0rxg8uG5H9p+dxkYM/+LGAYzJakxAi4mx34yLrNYT0YTOdEJCdETo6L1BdQw0xIJ1nyJ637B lT1HLLAuAbtedRmnePAOczStM9xfqoPp8AHRIzuRonsm/sfRWvRLS7gZHj8tD52rMvRddipY 8/x5bqeGiklRp8Y5PvCXzvIGwhP4zYvq75nJLqgTsNk+bgzl5NYxN+6TxIOEkkPC4sZfT1Ah HYbp8LvJZlfUPii309uy8KzqxMuLW9BrETDilGg+XiCAT0UgzJJlgtObPKgczFoTpRM9J+Kz 5bpySFCmKonDPlxUlNtD5luAReigQUpTVnWuHxtVg7mQH1IG07Tk5LwaKyLI4ynSYMc3PZj/ KDh4T5INEqZRgETBncqbuzDYBCyFwabUqzIubZm8pVPmEidX9GcxXcQSzrSszHOB8j4ZZ4oF ilysWPi1xX/fcVl36j6TnWoUaJH5MAJNLyeyvhn4zNZptWrvV04pIYa1rcHHBbfxbyPGxdsS GmF0pC7arFd7wlHOxDdXonHPUvMwFhRpNl7atD9QTCgI/8UUJfdT3aSjPImmVLGNnwWcmGZr 9YzoKfBZSU1wekgjc0qm1W/EZErAx8dEtCEsKeu5MM2Ts07FD2yaWGW4DXDF+eI5pp8gM487 WtMcWf26KQ/4czLsQ0GTgsqaYUsZv26OqsxZZkVULgWDGFy2+qswsfDPQWNBu0XWyIa5b+RC Y4A7B6h79BW7CJoHOITA/duYNRjnGke3vuvPhi5LQiyf9NdHSK0Q8BWE6E63b3zfOa14seYW lKLcIFk6XW0qojroQ0DmYygdV9Vg93ZBZn6Zz3Odkg5POkbHZJhT71nq7lwgN0p0+8+eCLg5 tPv9kqoPiQvmIZ6S/SafUXwnFn4ub/HsWLI8II1/mbtK/o6umMXij/TlzghK0aHArRtGazdI OYXbcB3hi+DpJZ/8e55gj4e8ca86/fCMde/Tzk7HSwTl45/7nkKtJvIj71zpiOAh1SKI9hYC ntTv6FQPtGu8vruqgxgkSdW+q9m3thBuwQm9yPHnL/4BT3BHgcBxr263zneGzyiffkbN7K+x HSiZ1S5B/T8DlByFah/rfx+zQNddQaKsVvbREmzv5D4QHdwsJtQuZe9OmvRv0NmpLr+fuN6A cXY82kXeJyaHuYKAyUAYBgIO06uXisnJHtjiqoffhwP8UPQ1akcD1oODunJgSEtuwfkeBH0o ZzGLzQ94HGdl2nsBJrJ8DATMOSJFvVObf/UVFTpCEnGPL1Jb3+reZTGhWkKbJHpTqyIPrcYN Gya9HAO/Wfd6G5dUys13nKQzaigmyp2dvXy3Z7bJmRl8im7QCyYBcc8WcLGPqpmds3SR2wBO LaLBTBBuGhIqiWGueikVYTvYuOyCklB1NWDMG3fy04r40QLh4A2GdZBtFPOFQNaDFIErm6xY U15+tT+kfN3X9gbMNVVlUoMrSmOlGuiYYVRigAMVxeO/QNODmD/5+MxVMRQiOSZldCtKUp67 lY6ltyzNpOjpdl8Zw4BvnCTKZNw6AjC4dYrU/SlUSLXLaHm59iKpwNTGRPR6+MXNJyB8B/D4 GPy9N4fFQgjHnTOh2viyLVteI2CYKEvwtvXV9QH4IfU9aJ1wPnqksAdpIliNrKDf4EHVMBsk GAt40ydakbK+YJUu0HVToRMO+YgBH6BXqcaUVwuB5+HaxjgD+4frqgKKMQnKartzbgd8WE7C fpPmfBn99CZnKNLlVeop4PBpJ5uIuH9iWpySvG5ZGAumnqFTAmQJaqpbgKK0+q68bbwku6c+ p/I24tzgQKZEnNNURkT/ix/lcFUjUNdOoapdVesZfEuRNW5pC8Et/TckqscxkAOvfnDpqe4P 3H3pB5UlCIZTHE7PIBOY3oIHRR4DlDbgIAC+h6dwyd8UGyd167nAoPS7GhgR9SBDTlBWrTmw ZVQSYlJ47GvzilZgjFMGWahhO7zZB9w5o8wGrQQ5A6bmjCwcZG8FWpQSw8h7O/VTmlr9NN0C Temp/B12Y7nScce9rSfTwANLBXz/TV766AuqQ/sn1D6t4R8Sz5f8ZwsfhdY0VD/jdXgHeTx/ Blex2TN5kSUs+uPN/9XFpxizapOcr+vKiRlOBJf915Ig2yLifIang8JIpMt0RNKMArUax40R wmTIIkiOC1nwya+WMiiCJ0c/y4mTMPPkIOlq3KEvc046OOj56kYAnmWtCF8hDaMc3dXFknST sKDYfb04diwOBMZVYe8+oX+WDdiOHNkqDecpwhCA9ZYSGh7ijeK6MhBWv663sS4xpdcT0Q2c 5sBMe5jpFxNd9EYTJ0Ye1WJ4qQhlkmqSmxP7kTsFvoNi3WBSrBPcIJNNilo13MFkr1+fIWcr NwtNmrzXqDouVyh/Qqz+pkNtuUYM6wZblCIjfGNTjRHo74p2On3efLICBBgxgHre19+XkGcp ZUo4ypn5nw6cCyawQ0BYVt/9oa0sToPuJrnrWqVQh+tOtNx08PI98iUq8PN7g7DCdeYNVVea rtand6O4swGBNHtuXErMfj8DUuxKYlsptufeZQuqwxVlOdsTUao5JYWCZeEoQVnk1YsYv1uN udZy5UodWAN5THXeQfiuRuo7vYl8QLikNnzrDgg62eup5S3Orca6luXBXQaqCjgABrx4tdjy E6Eau7d9tLkFvQl3PSxLTNLN+399eSMBLU4T+y9C2etmzZjKuRaZ5mYWVjt3cHpMtaZ8tBYn FAbJ1D3PDJQ+oxzHWyb/zQmhUus/WChk9+ulcIlnSOldKHTyxgl5YNrBqRfj2Gd2cEYXx+gk KPywgf+nBpXrp3nPIAsMksNmZD3VF021jegXbVNmw+dxj7frI1NiGwSfaok4sgRSozoWY6Nj oj+X0e8CK7dxGVH5yYnPch8R0Twq54dghf6mpGyUjYF5fu0GMNM+zzkAA8ACglYZMeXK2JDc haa9mbskGAgBpXJTPx8zI7ogh7mbZopbPNT0xVlmhci7eDHf+VRLh4ZRxT/Raq/ZZBmxcarn doysu+8Cicb/07DneIWI7kXEBkz/8uqKZuRGWgGL3vj4O4NCAqmpFYPi5mVclJykq2Y2YEnq kbUjiH8aIzIQHGNwG/ynt27qQy9GSHWmuyJi/KgOcrO7HwQ7OUHPzMRb5B6ISOXfPRE4fd7x oONz15NZVdRBrDdQM8uAKyOmO+iOjNs5fh/VGdHTvq2Xnj62tbFOiDuEUnqLN6L3Ye0fPrdN HEcqOCcfiUia/ODPhCICWhLmLhSM8iNhfmodTML5aW098fOEnloNs/Arv60eZyw43WT/QRbV QvcBBlsXM7jDE/IvrAef5rFYB9XVNx/WQ3FD3S7qpqTCh8tFTJ7FgomNUbJK2qefZ9hTf+p6 IBaciT5hQfbImpRWDae3HclJsuEBCczmpIQJjWdKnXllS7gH/Nn1MFR1dvYFHL7SlOqGGh87 YXtsfJ2C85Ejcu68UKckG+uHfY/T81QavmFT9ttla5iyLt9+0T/o0gApXc0JFbu/UDGjmjCX u3DBh2hpGykx6MF0UmOFRo2VjhBZdoISbkxSLKPbP+EclPl04Z5DS1kUSKFVsKtlzrwZEanw HpPpdrHl82P+n+SGzFk2jbpKduXQZ55FJtJqw0arS1SHo0BW1Tbt0CbXhQyCU1yhOFzmo5li gn/8V6u2QURYDdcCxc34vCzv2HFMukIdsXva5EVjq8Y4eb/DchPRpWrsBIOy2Iv9dGrnHbcf +rd/msVJD0zwnihHHv/0ZOOFUoYOjfucsB7IzYFmNMIEBM2mMyj9BBfhitOfZLvM26rS7w6B cPKyNv7S834EhmJNLchWmsEhoM2BgUinVfvkPYOMh4nvGMxxlOM5y100063pN3NNZ0ntD/k8 KE+UaroG3R4H/OLaZfQ1wm/Wu/OHCCDX09f9g90gMdO/SPWv8kJCOiW52bs28nv35CjPkuDC fk3xm/FuaWLfln8tn3scIBLUEDHbSocJQtvhPuWhRBljInXdOT0784ee7MwpwUfaX5IhXsuT 94tXYbILR3e5NOiBxus7PYLro9fmek8Ozr/4JMXMT3m+QHv13mtyn1DZ4Sr12jlzCPZBDB8g 3TmK4pY1KQ6fCaQdTtz3nAGMD+Pn1ZRFYdOvX40XO113pyThuAvV39+/31lEdWFaeIL8BU9j oGSZb0KyehruKwu2uqImT4dm5QNFacjruWkTDaqRgO6jdyURza10PDNfKjIoHfCBeL3prkyB iLFShTuplzy+8LQpPs6NI4xQm930eaPBom9WO/HJlJSPMcGlvZEdMCKmnnnIgxZIZohhnaeI efBR/bCuPVfW5iyRJpigJUqlfNPhmuZbRZgF88+mucFl4EUX7/XEiRrMu8FVy52Qog4xebr3 o22dlY3SpPUstCDcj7OOxQJk9rAxyb/f1/r7VyXOEHXUzF6fGJ1+mx/it/hpffRY4dYic7ul Iavu/DkW37fFbmLdHgWvJ1f7pqcX93JwLGe+s/dmjObT9QGjvcZOQUSBE6u16c3KSQ3ZLdVC XKolHCeyzP9aYYTfsN56U/rNqTXq56DcSsWMm1MttlMfkfb2mlEclBd7xdv3g1xqWLedVvBX d8csit7IxratslXLQs1dZ8i7qVDDpxrcx1b+xM9Fil3pTLQdl3/Nf6d/4piI7IG+WYHz2v+z +pdfFLClFsnYBEt3rh9Yh8c3P/V3XVID+RoJeuH7utudm7hyaHpK3maEmbW4aq9Fg6+dNp3f hRjXx6knvrHXtHVUqNlqmfK3kigvGaOvh+A0VPaQOXaaq14uaqdg/rVeSaGAriEWFttwRr0v EDPnCNLOPqCGffGkfkSJc7dTjJFl8x490puy01L+/IWxTdaDJW7RjMKlnMIktNtpGuiXBr9C oRjEsMUcwr72+cSgTUrHVwuOunO3WCI516421f1q4O741LyrT9Cdz12LHMdOtwz3HVYfqpXr FxXtry/lH6VCVw82n8bk7k0nisjqXP7wWtWhC4rbruf21DAoIcXEtjqskAclp1Jd7LU2CAl+ I1SXaMraLIriJzTvjqx6lWrt6iCHK5hRWD0PnnQJez/0nsa43r+sJCqvw+jbxq9T4XL3qvS9 JCvGFfTf1BwiKTQZii72HSK02Wl5J7ecxl64GGQi6H+1XCz8c1dipanA2rbp/e9bOaO/9R1t kknBDLcjDuG6FzY1HS4TkCuNjXe+8WX12LBLcu0JwgcV+ircnU9NzUq06R+VtxkjOHoq3KfN x27pxBLOoLgGGwY/3rzjcp3A5hx9m0rtONfjKikT0Whx7uIkr406zpweGpX1a4sDR6bIGVqi UAHltpMrH1zeKyJD1T4229n6aHoasSOE5kW1OMePqnV0Vh9loriryqum+3PynBO7Eb5PAn/G TxsqVIR02GlFJJQbCNiTG3VOzvnS6LpESiDc2fMXzh/ZZkK6eRpbQIw7HWG3U2YCXrJgFgW8 Zx6hw04zngppPDWt0e/QjtmqafQ2MevWpjUebxUq9nX4sxXjHOqoLgStW1kUa+Sjnq7JNBz3 5jhK7Cwbe3QvUrLTvPO4SIdu4avCTeyLmdCme6arcKMIrXxS5ajnKLklr3lpLaF6oQZxWkdF Kb+ngEFZ9gYuxTBn7PYsD75dScwMQauLhd2HKUPyX2C6j9GMYmWnM+9Qs5iD2vi4okKbNZ4T CiNXShLjtQZ2QcTMishfkUY8C7WkkSyKJBz0arBdAX1VE87xInXw05vTp/GVpA1Tw3o8KPjz qAgt96NVlfL5NQTN+A7tjfFf4fd31Vd3Me0JDk0/qX2zxLdo5NW8Tc8DFynBT6AQ3CTh6+EC d/aZeQt7t3L6J6fHuhNODr2W+6luWPicpxI7TmPIQEbpd/I0kFGOLpznVMs9fhqz2rpD26nU 93YIrSlSTN6pkLE3/d76px+XFtvDd+AoD0pRAgck6pDDYR40ccid3byZM6rbl94k07Bx1cEb +x21VvvtIo7wtB5+w8Zt8fsImvxucrlilw3rBJFV1z9vU0ch/Da0ZvMg8xZqmH8DliwmRC+p 4SRfSD8cf2z4moxkDCj97Yv2YuMCReT5Z64pkSpPY9L2tvHzlHSp0FarGx+1xVvgY2xfh72w so9N9DwaykeeG9AoK2OzyytGVhI/buSMRvXpNMkR0+uFi6t6yPoIIyrEKyeH0NqzmeM6dPNz SkXpzDIlknMrvyvHgV0ySubyecFDzzI3HTliwUr6lFrkEexAHzQUFKkNrxbn2iKNNursuVIa LPqrxSp2s+yWjChU+KK1wddIPr3em/6hNUREXrj+j486i5RUq+5Cp8TC1uo67LvBw6NZ4Os4 LwPD75/CsSH45E+s2d476/vJt9GhYRTMnNk96YXEQRMq9Cwkz5Z2PQwUZne2f0CAf8K20jXX ijqfioWvBkXZhoLsM9SwdkOBKnxO07A9PX8YkpK6n7/3Y298qT4vQi4Gf2gH4hLFAvxXReff KpEKmFshTFpqmpsr/Ac1ZNQjDxUufM4C1Wi/dWjjS3yPK4nC5kRNLUCsnLWR/RTPWbdhMYuY 4oQu2k7xZhgKVk4Mcu9/H6/SJsFx1RaR85PDdfCZSqIKNH4Dht2/onE8YtHBn2h/igk7OCWF 9MetHWfgspOCTYiKc/g9qf39mPF72fhwJe2IRXlSK7+3x3JdM1zTG9OZn+Y7Khfp4P1O0Znx nh3aF4iDLS3xSV+n466rZK+iYc4tgm+rLnL8qZ0WWkygUvY/HdDYB8JaJLDl3YAl8Cxa180p oE/b3MQrrZH79PSQHfy6OsJQ6UokKA3Tc6evx5Jb0VNg9zCdCoUZvcVTIKI2PYja3x+IfUZT QLhzU6mDHheIX4zd2K3HKK73ufUjqU8KiJkLpk9MNAjp+f4v3ExEi+MvDtfIjvDaucc7ySoq 3LPnlETH0zCr0ZXsiFD9BtsNVCizdv/HK0LvbCU/2+MvK+atPHhEfE9zxzoFbA7lhqHoEjmp fSS1vcPVzfXyhfSpaxfe2aW5c9Unpr+u+vjluEBOjHbwN0TPZVQWk3+nGcqtg680c6/KCto8 BjO/dPVqOpPRsf3GnHhjRE/d3iyKbWL5vsHXw2boNotKtS6c1Jc8f+S8IWmrHyVlJ/vOy+o/ Ajj6ylFZlLOjejxl2ds10Jbi2hUcJez9wff2mvfqiC4ETXyxotm4E4sfHob6sJE96nXSb6c6 Aq4YKdipcVYptH2JB+Mz01A07ltPDUvohOv9/NExHnW+WLg4niL/nGLhq+5i26TdEtywFyKE vMWfZZbtTc9ed45vrYd4xDxvf9dLgZqweatmgy6C0xgTeVDXjalCM2Xto7ll4hE91A41UnAW pbMu+hA16mBVwxt7rVdPDUVHRlINxYQ5POjVuLHYX1YFAkEVMGM2H/J2/yDk8snHqBaWiAEu Pw/l2EJEH7hk87Bccfje2YuWlnAfcKjnVUdKPlwHzhmKzixLGjnkAJrqfEORkDf8oqmQaO7O Pa5UwzLU5UH3plTFn2T/zGIVuC2isErsHroqF1XwtyuYebGjY0Bh3XNR48pUk0rVXYsYDuqt BscF3IwwdMf735MOF1S675StoGzmwrXAY/n2Sv5LMoxdjnr4j1LoqnvLpzPFg6T7y3JW0v4M QRM49ZeyKMqqSXkeG3WOGSNDjAR5C6aFwFfBE+zmQQbjBc/t5TSA77bNAJe2JKSsy7Sm4Lx9 fUx0OpPRe/y6gbEm4hCx+81An+v9U6KUY+5cHQPkgJFAoqiPuu+YM5J60B0AGJRKqVy+ZR0P +pIQP/xeRggzQTU4iqaX+4q2wMwbwmjjTf41e2OOx03pAS9yZ4fxqGGx+27AkPXEjdN/2MBm QLBgjVyiS6TlLIqXOdXCBOFb6afp99jaS6HLAFSWgm7TjCyIUKJo5scefdMyzdj401kmY2je ja1xq+FzDvfD/naGgjxDEoaDC1hVuYUTPYbXnZaJd0Rnjlgw7X9L+a2Z4l6ba4BfdkBMdlXo gm/MheJrf6O4TEo3Ynybg0UcLo4diH4/m+ahu+gUtpdN9BOw6ARO9oqk0PCCYN2IgMYm2ee/ uclHLgD9BE65aBmtyZ4dnUpkLTk5e5MnTaUqm6LCoscYCTaRTATkcpf7p2IjB4vHRATXAJ1J HbmRyj2DXSz4mHiIyK7KpHpiRwoGhJwpmBWLyCF4tn40dJ0wmKgYPSSmau6Igvsq9HZOtnN+ /oXlJpvrC4mZOG5jFgUqUesaSW06PHC+Zyp28v0K+dSCZ+GIngqUiiTV4wv4klOUAvXGbyma eJOrtzapE0E/hd7DiaaasuhxGy7a6lla9kTd57aPiD7/8dgc7ohYhoJ3U//H19vHM73+8eOn HdWiG8vdUck20YrlRHIkLDEiyU2TWTmnxLFFtVCknJ1yJGJy0zGh3B5mUxi9JU6nuyEpzixz d8qmkApF7up7XXPX5/f7Pr7/Z7333vV6PW9ez+u6rki9v7nEHAOIVbaUrmVWJ6qmI5zt/BE3 nghwqQb8Q8tVx6cW2mGDqCoyyadPIllF0Pgrxz5aCsOOjoyEmiO5VNwMbmmbd31t4yu0Ol3+ RBAPfVz2pG1exNtPQ9YGzMg0ZOVXRPz8qw3HNs83Z6Frvajc0h+RvBzcledpE30zYpLtQvyB ZXBbxVBDgZWle/2x4LE7/+GhY+6qJYUrZVSph17EPABkXCa9KVLHefTvDhr9iGCErWamKGSg nJSRbldGKqHoS/x/UzI8irpRL7jOdLLDVYBC94xQHcpuM7bWl5aeHRgiz7uKGrAH63mcYUjp A2R+i9xfsNwcHEMbSKPCRvXW2NLDYyP4yZzCyOcKlkfIBZa9I5LSLqGdCiMDiTEQwNumWJDE ONaegandWXPFb3+vZq3sTlLE/Fk7a9PAukUa8CtZRS0YYeXntvE/Ht2R0tvM4cZ8G6yj7EPj a8JWFIvgQ0ZCNjjzzyavF7vr57zTbE3JSPBKYgz9Rz0fyiTeedDV/yFfbehWzR+hFvP76h1I jfRx1ZFXuQe5dwv/ehY5Ve0JGvwBhBNHiotz2r3HUYHpHxp89rBxgQ47ygh+qXJjS7EX+FIy apD+LGDtUmVaf4r9OPopZD0z1rr6mbfmDW+9yW9HkIdXgua7A6EeaPfi7lLy8aigqz/H2IsM SuApAwVptrG0ge3BJ1g0nnvc1/C4LPzPTgwyoudiXxBZVVm1u57ZwIBny6h0Z9/f+f0UQPlC tZJsnsDWUPxqcP+Ty9YbZatchI8nX8kE8/p0OQT6y6RFabbUNvPOiDf/Etnnd5KhguEySij1 LvwRu0zdmL6P9Q+tr/+FfvNVo9nCMuJcvz8RCCLdLxsVQ8+l8GhpmSeTGDvPT9216FiSxDAL Zww5z3+pYeUPeLarNsBIQdOL4rUeifmApvq8fmxzqjgQfD1h6PppGfaEOlBvCxjmqokErprI JTOGGAbR67K1L0Qv9TzaySz290DFjFV/L5MMh08Nbfpmcx6qherkK/Do8xf8inBWs4KkdEd9 hh4KifhPKHINc79jyx+pybJaOrwAu/fZjOpqJ+SIjZmnb9b02+DkUQI/vzw9sJBtQlRXyiQB 3lmTWvNEAg+6gy9PlIRu82cFpdkCLmdGxqbr+OzIZCI/oZMUFjBoJ68yRt34vQQfL8dhcyou 8w336tX5odSplVBm5ed4YRkleLYDv4eM1UKopxWM0sl8ysrXZy1tNqvMaCsHpPxHq36CeNE+ VdfR2Nt1ggrQWyY3yuaDAKzHesqVlHqh6FACvErAzF/dBSOU5g+kH5DSH4bzX0scr/y2Vgz6 0zFAxMlLW0Hfi7FelMTYqGiWdYZcmeP3gBEZ9MiERzvDo+LSqfaA0kwlP5k/Yoa1lPXMk/gC 5V8rIgNVVAYRqjbRUrvw8xK5hWCfTWtLkkmGXv2eTVvtUmfiH/nEBcBUvE815bPht6f6OM/K qhagf1NaypersT7WivKMmQIA+kZEditT4P11qnhyj/fXwC4zU/WvY1edv2O9woGFvUMmeTiV xPj0aWWkDTIy2nWnCjUPKJHTKPWnZ0Mi9zIg6RN4duapkbdoqejTp1Ht6n/OdRVRtkfR+Kqo 3B2keMYXgnSgThDcoViQzKgmSM/oCgMhSl09tu/L/AFYp9dA4yD+mk+9qF1d+IhcsdCoWR6C sLQwd8Z56F/utsjMykHvrxdclKOJNuhM4/cEDu/vCa52JjLihzsecL85T3gOr5L3iZpQmjEP uz8t+wVj78Evp0uBzEotkdIdLhBfW+PZusFvX99X1V3AoCq58XNd/fLXP45afAYUthwY6QxG IbdwY0cGZuxIvClvyq3Huyg8fJ6po6eF1QaGoGUkbnQl6+273n7tNWs1mzHChc0Gv9N4hBXv aUEIZlZlBUZOTm5AkFt5Z8i+eesfPwY9lUdLhBTN7vM7me583R5QQGGENCn9sIpbk8HKTR4T hTL60G2Js4BycoS+JSapbf/fr4kAgpo5BDG/uHhTTW6zhrfr6xKauWu9oLGtlihS9E9iHM6+ D2jB5xdjX7pCwGunF9W4ISHiihUR35y+fFyJ9UzAEYrcFYacQhSMnoua26x+3IJvwLsZN6EK ZHQvoUhxaP9T2x3YWLCsJy10XKBnsDuw0kLneZ1g/9vLWpGTVlnsivDuofnNSdhT0x4hWHxP nyIYe6LcJ7zhue7t0SeZO67fhGZYoAvfTI5cAADfed+adPxWDk6jFldKb+AFzAEXX4cd46hf 6LkO6zEREho8lY72+SW9EVmFPv0/AHaVIM39RnSlZnB+0NZau+rN+4F3zCz2DJoBrphLjyw6 rdt4t8l46Nl7n3Pz6aHb/x/9FUZkg1IfOIpwOKIyGijNXi0NIB5/I335X6/Qjceu9HugHZkk 4zgjI8WuUI4t66kVvF0ZQcV1GFK/zJtI238DrOxjdN9Dx7uUM/tcbihNnC3lOPPzvLB2AlrA U3/11t19aCkOI5zUuhPqB/+5gBYTGLm9vattMIzcs07R7EYYeXwi7I7KKTvcWd0vKz6HvbL7 5gYMKCQgll2gBVibxvwEceyQlP7agZ9SvYVhAuW/FZD/py2n5dfKyCSqPfgdw24kMyrVXMPI Ri7C1CKCjy+iHv/4UKCqq2ZJtHXKcENk4ywN/tsbWqumKM2j6puZJiKU2U8+UnoTCqksv5X6 RI5bSpnvf6gzB13tlApY/W9kEhaVH0kQh52pVCGIv4yf+VNjvlX9olCFznFfsL+Uytsywn0s ci+1d0y7eNPcSq/yTHDpxThSp67HBIs28O68EaDLoeuVt/GOJDH67gloSQwtgvif6p/HjOdX z3HAzAASUSuuAByHCp3qmahub8cPOR3ODEtxxQiPBSq4FjnFLZ4wxb+tynyMfIe2UbmZZ6IS WXUim32wUfjyXrUrf9e0F3gu5JELv5cyJ6WiIojDiXPrnKQC1QTGXkBJVBcGdhhk6bAzaMTH 6JyTa2ItNw2ZytfI/m6JlotwQNpDvgj5WhuV0/VcsXZg4fxiWAS1VLt95cISPX1UgRTo2aYE rhmRXU4DqEyFrs/QKWlPOu4DCVa8C/9szF4+8UnjtjrBvQX+kWVgObvwLR6ZbimeJZEkTRX0 Ae4RKf2WPUzNX9sS8xfapyma5PBLjQ22pl2NFf7fhiva5wHXZEGsOjQ2+v4NlCU9NrjFE2fO QJCKsd7WzaHw71J47D1E8MWNqrs/PJ/VUbdXQIyCjc9EhXXtz2sjeLZQlPFyaYMXlMyguN2j apI+m6/gp2dGY9sI4q2mLR5XNTTWyCQXwZvVl3bUmeQJJsJ3DR+b/UQCUMvQw6UolBwUkMrL yoPBE19tg9eMWpjXvBGKrqTQnPDswFI0U/DajDa8Sfm0+4ymop3msc0I4r5+XcVoJo/2/sfw wLns1h8Aqzwjp0zybtbcuFXg2UhvgnXQhDIbiCGd62xts/pghy3mF9d8/aA2MkHFan/aXRuz A1qSWOXIyeDuMmtJvYkHUs4HNfda3rHJf7QTpBNxI5Qw8pee/tTMWZJx/cmSN55Oi6+UyOjv ilpe/Cqlaxs14G8wBd3N0E+hjhSRf/maeC0/1AW9XWsBA1F/rhg67QlMQMmRxXYsnL5HZ/9o 7DrLkLqyPCoubVW/U6N9cPC+I7mj/0kcDZU8e7wffAM/yuvkMDckaJuGuBKKEhkQY0lhAndA a83ahVK6DTbzHbZBf+d/tUv2N1P3N9pvDA4JY77dAA84o8kkH/beZvLKy/MqCwubBjQTvJVD myVW996v/zIff0gynnW7eSbY2f3KbWx1e1NULXWg1rmxaoFCRvJvJnxbAzFYNZetyRvFF0Gv OPDHfK/YuUQBz0aEokdBpfZk/kiouEhUhJYCLJvQfXynqzpf9GW0aLFT51J4NxBc4KB5PuzX vJXFdqOoDnUVEXIMxEGqJf/0fhgliteOOz36xty7ogO4mApC3ScIoxJB7aTZLvqDnOPpQydT saCRKsHbmf4YO4FW3brAgi/LorUlU4TSnnHJpXea0RSowNYpbujmrJZDmO6pYy+/n/3oD6MK 1n4CcxlYK6m6Hm5Etg1WaeJBg2jHfzegUQBYobs+qIqar+d61OamH4z/O26d49IG2mSiT6Pv rS6SLD/SnjTuuP4Bvb+Z8zF20lXri55iaOqetjqBtKWnstnYyMJksyU9jJyjNtQVV07pmEUr G9UrGQkl1caDL2dLZu//E6YGHoVSG0ZvU19q7UDwAJFNof4iIWBZGVvogJaexMjOYDo5MYhN L7t+dpgMVm3yeOWsv65i/kzMn6H3lRl3sOpfhsBDTa3yZpcpd0xKtzg7VUJpZgrM8j19jBEe FbsimtQT0i7z3nH94pJpgtZ8OJfWdiuMPFknWEFG1M14z43/mZrfpEIAgoFI8ODGsLlOb3wT cpMNEElo3yvGtrP+LaDXXfq8+2nuTuy130x4mjKODS4ivKa6MokgFSvxaM2/HwXy0wbnB3iw 3zw6HUHimZfvqMzRSfmrkQsrI6ag88u9Gwmb/eE50OrCCaHoyxvjg58H461A6V6Kml654ZBV pyUQpC+EH36OOOZ8KsuNKN7LP6Ex72dWYICSGrpzFHDfWtG2zlPngDrvg47mNTs+oLsMQHfj HbBB1MSMBIYn/2xiBzWwTrA8iVFx1mz41Fw1mQOyRS2j8e5URPxsT8WeZwrudyc2l/6rEU06 d1KHbYr/p2XtUe9SNP6tncXm4UPy0QUV6KLVpoq9sYxCP+mHn703iNdBLl1qHMcMIKUwDizJ hwpjo4yqVidg1ugPjs0ukOPQ5L2H9vE68/iMP+ttSwN+G6q3VmRZ4IuR0se2GQ1Xyz+fdkdH EUlv3wLImKli62uyHKFsR2KfKfae8xzOnHt28FV12DsQye909dYXDoHv374DTaaW6sSx3dRU 4rGTn1J83/i9EstPF8AzIEUVgKZPj2kdkJZAOUYldxAvrpjdykjaAt/FcqZgQ4dBSUl5derk ulLOQa5sJSu85eS6Y4sALpqBop1y+To6cSpI1VVfXG6l66TK3PMptj13VjylMJ57v5qc0xG6 jtMzWIfSi9GkPbv3nMHYS+nO51b1LMPuFcK6LbzfJTbG89hRE1SkHIHhcjiJFUbfcvGPdHcR xp/aKF6zMOfLPxtbiw9b/jC3nj6o3CQLjiKStD+For7VaZ0CgE9/onOa5+EJhbGv8FRAqDjt YmQrejseCoqN4k2bXF83GTNXyKhadSZfNUy+zh5qwypZBzQ5hinI87Xg7iq194hPmSYrJ/Hs VF9MxcKhvvHxiXhturtSGcnyVS/7KliJihd/04hMMpBqWehsU0Qqq34qzoYnPDtAsUIQ1w1t fRA1e9IA9nfAL4NuC4WiB/wRySXYvhHbClLnJg9zSgN+z+GIkaI87SMnzg0eJNk5bgJUBKIp k3iIajwtH9Yrmr0n4/Y12lvLTSAR3HfeeZ5heHe9GF/97+fD8xGNVQpFAioQDuoxj/tXV6F9 supTuGZyvknFum2ooV1GS7MzzoduRqtawnfSr7kr96hM0lfXBD3q1WsB+R9NrzMZy70C5dWq rvvh84dUK5P/5ojweHYJhbFMOJclyVlopMLy4VE++/nzlVHOu/9eJcanMMBbvh5GXgcYAPFt TKrV/FgeIDmr6EeMkCOhigyGKCaACeXQ1XcFjY4sW7o8Pq7XNyEy94gdf6T1ALfAsyGBW9tN t7r7WAQa9WDvn1ejSDg4dQ2vExgebLyoFnmticeWN0/8jJx65GE2P/3eNe0J7tsnFv6lnugC 1I/vtCHI1AQrQ4uNqMPpsQW/17up/QatrWNQX5yHT2bcepEmWfVJuqpOcKVKbfDG3Jl3OOVt XM8G/LLL1b4YHQ/QvECfvPd8cEkDPvKka48Dln0MmoBeSQxGE1R7OqNufLOuQzjvY5OY+Wfy hbyKY3tN3V4f1dpng82FFw3+ejpokoJIKuq5/e9tsMNnXXumcODTWsr0LHRqznW0T04WPBJw 6+uDJBS+bsVWcXpGQm9B9KBLM6ydryFlgj6Cz9mqPSGMEtpJKk7/YO2w4GOs6vBUFGM2HvZf CLR0nxscko+t4JlIAop5sIx+FXDZs/bgv9v7gwLKxd6E71lvIh+Penp7nUiexaRpR9BJLm3K rDu/mDR2zTqve3MUPhblOW8zPNgnoJL46rGw2ONIfb4JDdJyOmv7OpTnD3aH+SjUQvLsEBao v7cDVAudxOoMjK6QYqGT0MwpflBjX3MJOTofx3P6m8pdKKMHp9AGDpP5W2+k2aKYgpO6Ho7e hWjpivyFrnt8XQ1ISj6s9AxkDXr7etiY60y8VYf6Iyn8Xqg/gWrSFBkfssOly6jb18YgLvZH hHqKqVMPn36drcvr69BA5dgoNBl69MPD7DQTfRNSzfxZVfG0gXjLYovXCxJGYaVHfotLqRlr tN0sdO5adETvEdAYdwMQsmrJuncO4ejZp6ehDiq4rn3uUUpNovHuA92jwLSk8UdMeBxbNlet DpPa/xuJBQeSNkgI0UKnq8nbcC8f6aqbXP/twSRiuiXCUWPt9sGzEzNoAf3N0zvwajwfRJM6 29sn8ShP7GufTd+jFpJI8QzQKpevGElmOmUB1etDsYNxRx+kJfk4FXeXkOPK33eD1v3H7AF5 pA1zU9h3PyKS9SJojny3/B8aSkExg/SG2UCP3G51Ek5hnVQirwVns88Gqg61ZGCy2LmnS18Z z7CyOjbpKUYYoQt9ifN8WsAOk5ijR3WP8Mrh4C1yqsmAmdACO/7CCN8eFI6tDcmkDS6ZOdB2 QH6oc+e7Tbk0hqnc1Kv78Oih3czPkrQYeiA2WC6XQe960PfqWP/qVfeldLdKT58jAWeNe22w RIQapGBkFbWzUw3U1DoUYosTwFBQkw3utXujEHy8uFCtqSDSB6GsNd1sOXMB9PUL82NW0NuN iUAlKfYqPxGQrhNm8kD3p+5qufADAouKNxkSn+yCMDe+T3WoG/REu9UFNVKHz47X4ufeYsFK OQ5xJFyR+A7DZD2q1epHKRmrAR52JcuGT1H1O7JpJWpMd8bCs+2bfPtxnQ2yFXODxt2JUApN N1pqzDza7iX75SmuAiRXwOvuWpEezV9LnBk5GTUbMFPG8fijbi++ducnkRZRscNnfpJ24L5j WeP/s8V9nWxplhSnpWXek8v6XdAqfdIP2RMbyjuoFu+GDt6a4SFHSKRG+jaCj5R+yONMgC32 CK+lvamlc/DLeRvsmYlFgK3vtsWWyuiPCz3XhVOal3U8NXyu1HtNKAB/O6b3M1GMV2j1RfRc hP+DStsk+/R93A7f7dWczVWc6bVAKIu8+8Jt5q6niPwNKHO0VN+ksNeTl1e+VT2ma6OHkg0A prsUFczIqDad9weN2LX4l05t1ELnvzktu1WbPPkHDtB3hmzUdREermEG+MvjQPoyKlg2rghu 0Gwucj9dya4tdB6d51sL8Wk3VKe/Wy09yVImHEW13Fa/RTuZzAiEryc2/vLSFX0ZGK1IG8T3 7N1hq7kGzUSx0D6R0TBP5P/WdHaSeg+dk8I9u5lp0sqd+rjWQwfl+WLxEf7yafNjLInhXZWB 0Vc0yw2DGSNbnC3ia4tj7JarpPWKntJR/U3aM/3SFxY23oPbxBS8IDIFrWMPj0jpoVYvmQuU CZpwmFrzYmzgY6z9Jepo7J8EqYZWpKpM8i7OG9mqVkCLedj5b8tf6wEXTm69fDl+5uIhAgZ1 o5QjMmh69oah3jtteQJ4at2t4FovWm5zwanUvnYNZwyrLFSC+YqbakbZNC+vAwe31JmYKqZm MxvGevQTik9Yzl1ikLtr2qv2Z22BZiEjMIDhgRFuEqFSiR6OM0yzFy0Fb+ncelTq1exNxxRZ +PVglTcZDzkGf75TL5hFKg8PUI5lcdbbLHQ2KrY+b5FkUXH93cElXokyTrOiZqz1FzdO19vw uQiZA2t25nrnAL/8bikMA+bzaQNDErnxPnTS+OoK1vbpYBAAqg0u9nbTZ8K+IYjJFjJORgsn bdXq3dE1cdbjDpN3l0fkCVxvJw9qzhLSXXB69e8QnF4BPX4PtoE0r/3Ugwe6XjhMO3zbr/mH OqKT9GZNgXBoCjA+xe7eE3skjJyE9aqwrqwTvPW/nJFwpSp/jh7o2gC8SkX75NCcbLETTgpM MmcOsFYhHDoryS0lSeEZypOzmG6pppARK5dTVD3FMeLUJ2t98UeI9akEaWyf5mYIYyU3LNfG P2wn5Bj5OF78T+bYVfaIybvwjhGuOtt7lG/6Ci6ic7z5LW1WP+Wk2fr2AGITHHDYODUbgtcZ i9baOA3QUR1iZ8FLuCzfz8c3zMgRadkIE5OOsoyHr2flhMoCQ9SGmsOUOcxSklZpsD5ybKuF BwfSikRsbvKLgtT471nhM8B19mxwQQjjeZ2JIfR5rr37NZwyuxMZgz4Apeng+CLML/2+CaPp 0bsVmEwHW+gB9CeWkd5prxlPs+WD+sQIw9ccC3VGJ62EhkAhLZGQ804zVeQixIgUW5uTPwBV MQNe+gVemtqLZoroCnQD0AjVL2s1Qt2g9fuYgTJBcWYEW2EduN4UCJMWbVDblCujhpYzRwJc /3eJVB0OtRdF2T1enxekwHzoL+/Siw+CLm3rCNUiQXpKK7Jqp/x45rYOUM6SNmoaQCwi6DY1 pYNjs7/2DmwQTw8j7OvjSExvVX72MkSN7cCzLQBCBdHw7EIIVAc4tkEKTVe4tnbYmJEiIdwK EKrLPqnKdKbiEvUUzfLlVN6I5zkLVuBpV46aWCrMPK07+ptM0JaYJ0R7JWklrIL6/iUpplEk ZCbSF+XA5mWx+7n1jkonV0b+WyeYTwHF3HKvlo2tmYtKbljAcFeqE/W9+vTpYOlFbz74BnsR yUKmgGn207AZ7sNbGBbwQlIodYLh0uZEZZnE5gKTt1xGTei8c3uGm5HM4MID796tNJBVhmc3 V6Olr9PvTn0fTcpIzw+PnLJKWmyO/efcSKnWMTRYV6oLDBXHXldktEAeu3STOKjxog0uuFFY FWcdd3npMgd9n1NZw/cn4kKSGLLjUd3GM8TyUhp05HVWkWGeQUyBfb2BGDCg9R7mhSuOkTgw 6jO0CeEcozQHtD01fODY90wYxfpOYYgEeSa6pAEyIa89qszOy9aFGQkXPsYGlVVEY9v6/xeg 2rsGaRZzWygcQRHvUhhKXiX6WERx81od8/BYMpcISiEvhTsARIPDmZu2F6amolbBUM3LNfVe 1tc/LtnfzIm23lYv4DoeFqYQpIMv733hf4RXof2SS+snI5SyU8RNa2YWruXchIoioJRK6cZg xQDFbtmhCTXUuJ+fJU4hI3W6YPfExRfBcpi+yx2KzIIURoh+zjGkZ6Dly4bMO6hM1Vn9ao1T vkiiAA1cJLr26JwKa3L0bL4hzCq5K0lTQMHVUQfeSN2t+Cl7IhIFnLeic2Hx3M1ci+ENKRXn wS86o6m+ZGC8VZkOn2J/lXEuWV9iNlyynkkJOquW7A2k0BbPrM1J9AW+CJROroy+WUqXHX8l M7a+/uuSNyecvhq9qQCypJbRYXzIFncEyctiZzADNroi6jF3C3guznxQyTUTuMwfZl7Ir6CS TbieOTeeiw2aZnbnv6sTuUPoCgyAL6Vs/S/g9UXugRH2o5FPCOIWylWNy3AY3vMX7WQ1UWnA /Fr/bIj9us+S/dkcuVuvB2kp9P02olpFHXCKtn2b5Q08m8xPae8cxLM18B5uGOF7wNTPtTUU Ud48PsBfgbLdPZ1iVXJEUpIy4F50W//If13s8/1spvPc7vqzSsuNxy5Ud83oTr5Cy6Dpt05g tWfOztz7F/yRszxzejsGmIIAHQ9zC2OmwPFTGacYenZqg6FsR6DLFFNIWEXNvfwCinB3o3Bc UjeUBRR4cBJQj2M7nBkNTkDC9U1d6p/xvJJWL7Dg9nZp1JwuENMXQGHwdh/G3o6/teKmdGuM sCjkdBo6TUC9l3Ec+RGdpPg/8LW6AMZeOxRb93+lGIo/nmdUU+y7mLz2d2rhB+diLumAnBlj hPYIxwpllgigvQTP9m7uddSBdivzEFAbG/1+sVysoJgGoOuIHa4mt+ZgjmsJrbmZkw3zCMaF fuscgBQaan3vUDWX5Ng07VePy+jw5LtKT2knU2A1vmbfCzsLQJ+UCYHTvGzYFmd6LSMhtbfW QEbVrzMZ1bsXMSsx2aZyOZU+L6fmoIkWbsuntPsd4K9FPXSaixDlSiAlo6gy6YeWyqid72zm 81e4aVlFrareYfMCPM1Zv3/8WWs0tTKvuWLk+xwbiGqsdrAK1THlbQZ4IrvS8wLa54R2GBKG Vl0/g1EU+w5jI242W6dQrcQO6Ewee9mnwdvZNK41os5UeRk/N0U3mtuacZnG+ymeTzNRqIsF 8or4F80cbuaSSfKirZ+OZ7MJ4oy31ffntnyyVUCjjokjhTEF1Qv8YYJDyVGf27/a61StKId6 QV1oZL5++ASOHTGtqGr6CT7jITIJPGn11FVXvqBCsFUf8iv/JMYVVTskpZn4R8TsPp6/vZXn dmGITATHDgUPVhxUGILkPwgq96eAxLji4SUeri8yHRWMvi7+iQ85pgYqwUXY7zgspZKR8qkN /lnsk+AH90L0mqnnax54K5Wkn1i2Y8S7nfXZZXZJBeoob+Pa2mCtfPFslSYDo4qbf0npabUD jUJRnexN/esLpATMDIYFqjLPBof6/7IHqtecmuJ884TDqkORX4zuDrSl1MzbR6P4ny/LJ6lV 1Z0M9VpbfgiLxhM+LaFtUnCQr0t9cZMDErKWT0sTEsTuqjOZHxu21k4kpHhi6deZvvMdKwqm Lk1RqQIKg04hst/z0NKPsRosd4aJGmu7uSmR7SHOWzjkQbpwQBJlbakFyvri7CaMieCTw8a3 ac0WOgBvLXSGtymabTXaQuCxO6KfrnhvLnHhW7y1vO88N7v4UR6m8PoB4bwQHfQq5RSJOF4S yREghXyKA9U1QRe6I6Vbnets/9Pzsm+C9fZqppMyQWc6rvr6Oqwt8KZx9YK4ka0Yn9eAY998 f/ic4px//xm9n2ESTap2hY1P9OjQ4I8Ip4y0Dc6BAQCMxNKIuRYvroJ3/mbpE7tI0gll+XA1 KIXh8SUj4f75qY70AedyZsD+DeJKF/7YO61Jj7mekAHZuA2UiIUt9BRaANk0pmhXqTDfXIdd JLrUbVC/z/r6gyX7uzl3oGtdcIb86DH5j8XBjRfjrAtlnA5Fz7HKrFdqPLZzRP0rrfkj4pRZ qgx2HKnlX848VpmpabJ259fUUp3WekzsUih50Hg3fDtaVXsmtHqrurKk7Ecrc4tcOMcwyWIf Cc6X3p9pEUPWgI6BRXZsHSo1jRaggVAH0z2RQ+ikDdDdO/IVRn8efYzdPxdP3cuXyfQeps38 ed2fpDdFviYxW7aMc2zDxsdh5PHRAYRzCUqOZhVD7dWohw4QfmJh/orBrY8hIz1k3El3vlnX zSPhMS+zZwv3w/HZsSmAL45Xm2SfQglXPlzg2Oq5KzCf+6vvAvrJoVT4vLZgy4j3baYJZN1I zwnBIYsmZocyweXbZGpOs/ErN75IHMMcWFYniOq69HnX7E9jLZe7pfbN5roeE6au/PIAKT3f j8wPiabxbBorwg3QScoskqrRdZq5ubkZoCWdT/1c+LxinoHhtjqBix00qbXLsHfgfgp2m9I3 7WHls1IJD8ZpW7l4djYVAkxZVWX1reRoUqFAotHxIpP4jy+PYv3ay1IRXuQqoMX8GrndwhIe SjlVld5+JSPhSIfxKw/+hh3luTQuZFsfBdbV/3rfHOeOGNbwx07MndcWI4cc+wTuPso+R3mU VZt1rRY0jFCMMOkKN9fwMowE1/VGoX16rx0dW6dMMIGvJ4/mmPt0j/PHsh641YJ54lwI+VOs zQY46BQHJDnPqGLQfedSrB1wxJIb4isbljst3dQHzAaNyPbjYTD3U5oEE6sZb/c8nG3AdYkk LEpT16Nf6MIfUUOoqWtPj71QJlD/fwGfd5Ai7XGKBUrO+lPsCxehZJVKZNFxhVYbXP2wXn3+ jKG1/RrpDbVhvUeM2PQi2ss0pur97p+IbJ3s7kS3jSikqqS8GsnFsycWRz1uQvVujaFFL56I WoeNJqkPtCYrRZFSMc+6JWeTGXtUjZqNhw6OxladDCMfclXa0EzdJ+sXq6kVXzvRcOb4QGZU BGM+DZGkBEMB1vyW1DdxSVytNVqZzwxcfaO8LEGrvDQNQs28GYfvkx3OhZ9cz0tsnDku8vTy mdmplyHDJJP2fxi79riY8v6/kpVYGV1siGlKRY1bRqIyT3elO5OmUZ6V0oyK012lnSVKt4nK FpXtIjXNRDUySi1rNcoUMkW6bWYQ3RHp9jvfc87E7sPvef7bl+1yOvP9ft6fy/v9/nACyFS8 Gr/N9ASt/zxdZRgoAU3ne+3IOji2fpHObgyGzuvkF9Bs/f2424w1uBCntLKqIc702uYGSEjh 7rhhtCjGiz+6vNKwE7OCdaz4PDGtINfEif7sOoqztuVuJun7EFg74sgD/WwedS1O4GzcM8wH /mv4i3WkaKWNebSqVO3WmvqzjJFuOPd4VrOX753LqkekFUplBwczaFuwrrfhF7qKO+J3fe23 c8+w/bzBJN72+eX6wp/JGYozVVSWE1eI9M7efXgfhNFSf28aS2yKkEZyR3PZEidkVNrKlsv3 VeG7cEOyb1wncykvXtJMTGRP5yBVfVtTDp1W9SULVRXk0yEVvGuvJNTqtSpmfIp5qOVabKeO 44/YeLSVzoELnJtywMKsIonMtZnvNdLso8hMOARUE5SJU1tMZsFfvvB/FANSfvywlYvR2R0T QJt+ZVbYmHOpyGP3ruqWcionnGZHiq+ouFfSsvqbUsD+djhM7T1/d8qz9s4a23Jrw+WHxhIW 6Rj+dzHFT9UkCNtQwDTF7+OIvCgRBZYkDVd24p89/4ZISF5jPz/fk5t+w3HFIZEMHLnEC7mR eLlUtc9T1vcJy1f0DW51EvDSJH+GW/E3G216sI7Dmqcrrwr/hXIGJlxMEOWoCb/F/kY5r8u0 /gE5zZjJA6F3JLPN4DIagaf5owntl2jNTsAbJDTxh/cBknskqnq8eEpwQAoidgCXZgNc8rLA T/O+0E+k1W9Ia5o1S26i9msKilS4iI8DCsn8O7XFZSPBv0LErtA5nVjD7zumjDpGUDWsF4Wk sI9cjPlO1uZXwN6r550/z9IRpyjG7PTnvtERt98HHoSxA6opOuK5pcqPKmkRxOdtunWsRIhD HoinYQ26i46gNXBLxVqkN6Juzr12ksY5kVwYuUmOjDdDYWqppO3F3bbXKClVdUV1MiQco6xN jZBtnaEkdcohhZIb1uB744gTcAc6p5jqvioZ8H9bFLpp8m8+55Hhy9IVPTERHphHxUc3y2QY 9g97gm2uWFPb4gQkjAPtPRMJNermscNCc3URZJe9JH2jRzojvGrlyF3pEdAAE1YhwfJEP5zE AmExZw/Y2RJ7+5iY/mfEVkm9+nezVsJ4PZbHmiVpy/AEEFt43EnwQuuopXz/McF7DDXkE0Fn YPBIuYROsuS2PDgopq+RUV3r+swJ4u0X02sU1abBUMAODFBzESHeYi82qLGs7Xi9qhsUuGPp jJiQpu6jM2k6YEwLzfFwKeG2mwiIuKRoWUhLEUhWNW7br+ZT29LYRXL5o/vGW+jTusLmZTlw 8qWzcgaK7qNABP8qKmed/Go361xWU4iiOFEqHN45MzfdLSRkxQ1kd07d+itlgxqTtofmAf8T nJq9TKjXho/FplkMWvwebtZyW10YsF867Kj08bLMZc0oAHW7xzXOYeMHgcEX8j92OntvhJDg TPxF7vxbInwbfvofZYC5tIYPxJQP2JxQafHf2aerGDzmbzj4RMDV0QGRXhmGUtoZ3rhVt6eG zRazbsl5xWW1fNyCkNwePM+s9dFcImnrIyJc1MyW4jVOXOVHUWcYWIEujkfFFHDOa2IgY7jt pSW+cvtgny9u9Gm4+XxNBm+jiXDkobpjPWAH/EuSmWTq75PLKp/SEVtV+pygCCI75oZ7YieY CaYv6/ltzz7dvRRKcGUYwNUS8xacSnc9pibKea3OcRg7BLZhwBV9vo/43OuhczriUEXAz7vH EQYX+tzZzX3/PiTU0ElA6QA6KM2UJPiaBWTTMLejblU4x8qEq0CcgK7GLImv5QSw3DgWcVc0 JPRn3hxL2UfG1cM5oCOGkzNX16/n2YZD/WwjvpYC19BY49kjfSgests6sex1F90sJCRu+y99 Ptc1RlSw+3CbcNGHFPV92DAakF8BnvaLs+xeOfGrJ3fEFeb4c+murQVznK3gcxliKlt2wb4Q NFh/19hHbM11V1fYret1yccLrpcUi78smB6tLRmXc5WKQX4/u+grKgrQ9At/3SPDzwyNfF4L g9sBM/gdJYCGmfP88ODwjHRJZiswaNa6a3Xq1Pef7KRlFJBOlNLOPpldz9Pm/zCSi/0pv6xC RX9PAJmveA50WCCAbzi0m4oPTGNPPtTOKDOsHP6X+nfMMg1sWkXVki+ymditNDKh587fvP2l DljnFnGAfxLi7BtMp2FMj+6xeWE467FEDoktstlfexSFqzi5qrf7c6tcEc+AakVm+xk58UAn fKGURptl3EJ8XEzWy+K7teHX1A4ULi92Mgq1rU7NjajyQHqBC62bYp25wRdpEVPn1Qex1WY6 Rl8TTbDdIN7jmJF9XQTX8ZzpXX9Eg1viSP+WZkJNkhlnqmXO8rOAkynlTuFZXax1YzR7FoNS 3kK3OdFfQb4hJOAgnoNAZNN/5d5LJkqK5PIbeOOrAa2OUzCmxmE1HdaYkXjPsQG4dD7Zn1ly 7zR5DT9zCfNCZnZiLPnSgdKTtP6ApPAJPfix3sEXnndQ0nbSmUu0Rpp4C4pBPha4dQKw5tfo ep5a3Sr/7vs/DszUpQagGaLKp+o5g5xLW0jQveHmFeETOk2WB7qTybEzCuDpl2K0n2e9qnyc 2TXfmHe5LKu5zj2Drlw7u6TkpFfZKWt7VYdzWSaSNoZqq4fhyUOpjOjA2WIfbOI4xx4fRJl/ jVzsnaKAcNVwSE9JIFrRv68OiEdXWc7A1iW91nSEmSqYhHMLg3Bml/91oxkxotWMhuKNikAq odCU4b/aFK95gJOOKLUnPw1GSwzqPxk0NBYV3En6KXI5wheDq17eRaifYApYtfAB/vQpTK2e N94h/tiKHWOCFopQdoPUxyWjv+n/W0yHM/TmGrn8Z3pn4sgeez2jp4efvxQK16mK+tz60/V/ iAai6Yuy814dEa6Mqd7Lv8Z1V+dBxG3yT9vNm6xxXf78IOwe3gR01O1DLKIr/B7gKlPruJBQ B5+BodR7VvApmcpGy6hqW/6oujuf4uJ31PI+yu8ZiNLonjsznTT/O1Rd3WPk0YUnHLpJeWsF ZrZaMhnOEK9C19UlgtfHWwrxarePDsvDIeohDv7z10uoCOG0RPZpEnBCGHTmijIp1s36hFr/ t5d40fLDx/4gSU/H4e1o+aTEp7LpKk4Ibw8FrfUAsU4PPBHMgculJgeU8KNdd0N55G2h+MXd zAHVDECRCAR+CxxlSdukf+AEA4vZD4H0Z5rCHd3dIBIf4eV0PqdvijeavsoKPQEjexL5VYVW Pe/NG3ZDQO+7P8895uu1Jj2G+t+GQLY8cDp+deKuMgmpma7cO6/s/NI38DXrzzo3HwMvsTkY ykAkZWbkWTXmYyFhtpnGI72NJA0ii8q99n5Hg2ghfKrb+az5gNKR9HX5xGlTym4YE3sv1W3H bq8SDq2j4OQ4yl8WCmlMJPtXEVk+L4vWjVxvq2zoU7Fuoc8J9RD/Ap+hSNDQ6sgFPZvPoEW4 0QEVYYdsHAMtdw0pYP31cDiuyF1Mp1PG7WU3er4kdy6BP+ggjP2z61QtXFnZKo0457LSISKf xx94l+Cl29r2jBqs5Ly6tfO6scaZn6JXOaxo1oe6qtSnMbNCx7Cv01Gzbk4e1yCwYo4ZiT8B FFJfFAuaGudGxG2u4ZAdz/R1Ni5ayTmd8bSeFH6Yc8uInw4E615/dQQB3ipymI0BE7WryfNL JioMLufp8GFBZYCxND//f/9DBnghEO8qA7/OraA13SEffr228vn7rygB3324vmHIYYaILvtP dqrovV0Hop4oip8vpsccIyN/iAzQSWECwMdOglKK0oiLlryhPmmDyVawuOBZRwEVM2QhooNV Zy4uRu/EM71WaRq4Ho7SgRqsW4Dd9Qa+RuoIyUtEcmNLdFzH8xxWzYFMezYiRwJo3OI9uGqX JdRrkN/BK7WVhduYUP+tUPIxzETO8QkQURjF+kulfoxDG3EC+zjyKMpSDSWw3Bcz24UlooNM vdjmlUvgxFxJATS78mguCsAJ9QJcSyWZhtQMkvmUJwbuoFuO3MtoTE8RGjD9Owv0+XgFaSQY BrcfFtNX731SCqfpE4sURoXrxojDg121vn3rsvdruMrDgXzbP8oqXUDnxeR+y0GupVUGWtED 0WZibSn4WILQbYkPLrc+gSopfgwf1V8EJnvki3Jf11K47TOgrsU22g+RZZhy+b+GB833sqPI Ot8TtYOR+/xk8iWe3DI+FXfhB745/JNYcifs4U9vlGj6Fb3fijB3cR32PDGg0/elHD2XwLrn 8GxbFWDy3KkDHBULG3IyY6v+2qdHeLSzmuHrwYzF0MlapP9olbGGh26+PtcXxin4yx/Dya9u 6rL10pro+nGQm+KYQRK6hiXXm4qHo0VvEavhJBwtksmvILvgj7ZxtW+728Yy5MrgHDpwf1Qw KkzXkWRWoNOoycHrFkMYoMARKflnUrEqmNWUuBJZRI6f2hqZp5LN8Tt32jU1rtv6WflHKlL5 zS1/yP44DQcfnetgDHuZVnU9B+LUeOTCH8lI6DlJFnYlFLRhmKL8OzpxdV/AwUP0lvK2U40n UsBQpGKdzFi4T1MSDFXnVQSeTBXBbeMVRw4gRVMMGQ8qE7WYinMMLuS3F755TcKdDjB8I7M+ m7hohm2gorGGQq3ZCNZCYk4sflCeeSxM3Z37opGemGjJHVX/mwowNW8FeHdKpG8IKO6U0lya M+kxh+glBsYaX5JWRyK0ezqkV1xO/Zu6iQw5r/oz7Li9xCuUcU+nldnXwxAzHUs4Xb191NK5 qLz57H4Sx7CeJ0pb5crfbKTEpbE5nCJucXFQhKXYNaizYtRBQPxFGsrJ+OT/ohDsf5rkXw0+ Aw9U5K4FyPmPwCQBut+vegRcj5GwQglH+lloLIolvyC4LmsWEv6CeKVUrlYye3IXg+RTemm8 MEvfKjyr/GMFIn1BsY1UqLwxanhV8NoG3j4wnzoUtEcXFbafVwZCtSRTyha1qRpJ2x8DmhMz qwwcgHuQFsQrpr+voMLXyCB+wYJE63LB44QKMp3fpgLj/La44WZk5gLU7DQgb81op3m6P5Ti mrn6AVpgHmvaSmlk3kBpNWbl3h0AGmSh9XAOhdRiPGRHzgnvFPdk9wnAmmPOXYwCmgvgNE+N TgmasB7pyE44F7stpgek0Th8HqdDIPr0PSBWBKSxo6qqb0zZy44wrTYeAzNRshwceM5mp3gW /+GZy+oq+GN6Y9a1NKwK8zpK/yny8buEy8BchO0fs6ueZ3DDR5Mgv6PJOnuwsRobzndvn74q HVttlXFbEv2GR7asF12Dkx4YOIfNskGCefIC+SNqlCBgwuc9A65/PY7ZRiP6drhaupNo2lZP InF41qeij68ebnWy9ozbzmEt/0Ea7MwAO6hz4kttu1DbtZmItMFfboo/pBUsO8KS81qoTZya B95OrTrgw1HVHZKTF374EGKaypiMutkRl8yFiBA1zyd/38ADGuqAlmo4i8EB9isWApFWULng kU06rZ8GjIS8OUgW7wWy+O+Yi74mAXxE4c7JZTVKkWujl221jISasXLBR3Qdk+P6fwgsMOji JQq9ksC89QQOGulG55LdK9CT/SLe1FsX0//Jv1h7PwbLsXORmsuu+Ns114QaRHp/HU4uI5bX fiwE3wNp/kMCmBuQJFUB4KdBlfEQ4qHNJeaCetHCZAf7JmdPTZkx+JlPkuIn1tUdl5tGp+f+ AMe15MOfW6rfBNOpqAIwb+XQzmcdSQVL4Tv+pq+Y6Mrgy2BmwsDvDQ4cIqodFV+FyBSPQrzl GqzGWz3pZ+ciqfp3Mh/w+xIZoebqlWfPw9mBLocFNsdNRvkjhdderyY5+DgswY5DOLjclF9V BJklcvln2HwwbU+PAyvlEaFFP22U7vuUre5aVecbHy0PXu1voOmSRxtX+Y3m/mtOMBBcPJJ/ WpDK6IexTUVC7fS/Kx1F463/6atSdm2tkAAjGTZ4Hflt7mJMBHtb7tWR/uRPtV21eXksqnT6 Cj//k65nGk4Chd8+011VqqNGtKVePNro+PUAGI0pnm32kF3Mpz4ZjkPY+EM7Uf2Fp81E1tzW xqZ85UczukCgZ02JM+3k0PZTI0bGNwRIpeZg+PoUzBXd4CzDnQqsVsoa/FQyfs3MzvKES+Yd buwDBNaSxcAWgMU2bjZMrIQL3HrgijMnjbFkiYeul389b2sqwy3UdgrjOsNF/p7yzN1PPPfL jy9bej7zfYmWkLDXmApsF1BukbEa0yjQfUYXON3SuzwqXefDbOUc0GL9vXnRA8+rnxooZazQ dwmvgDrtxUvvoCYBa1lMZNfDTpsmwduu0+FWWAGiA1gUB22v0YRZoqXLEmn9ZpfcNHdxQ/o2 xV++O9XnJlwm0umLzjRbWop8otNuDbxY3/534ldD+wI+gDrEQv3cLkBhsjoV/J9yDD2vV3Yx 26U7T7qvyu1h8PrkvPRUklsbqPBh19oIDtELc/xuoIi55HyMvxRn3ZiEzFrTZjzECrXrsiG/ 4AMo11UBzgXpfpLMCWoT8GopicCVSts7ZNbMfHYpiy28T9RbW8r1s57vpSVTJD/uxjZ+cyvB AHza+4DoN1aS+S5hed9gf2S6jlc+lKjjNZR0L0c66j1HxstkxNP8dhrEe4npOR28TBJAMp4n 5PixP4KaKJcfdbknGlSHYUH/VAU6I6YhLvsns+p5L28yhv2lqhrQ+ZbKARcxU71T0G5iZoqK NdH1mSl39NVcogfImH/vwj14nnnM+eNCSRsXzqVyAdXVWsk5m2bGp2yeK2uC2seJs+AULaQQ WEqVA8+AKG+OKJLI2hQ/0fFbfA6Yth2eEWHASH3M6oV0P5QKMAkSEpRLRSUUF8bS8QK3/H+g VpGKYLArehGz+sPD0yuR3DUW07FP3uCPjbkkMlzPneut4EgnXM0uis/zLvmYU9Wn+w8yRE6C T2FZfS3w2fAHOnaHLc36P3U4j63EXoUV0iMrjzXHs4Nly9ZOtTCYCalsv2X8tiJd1yo45TRo bKbX1IlWDCvdtkVq8N/VvqrI0FCVZGa2UMW3eN+/FWciNFffmMjH4xvXYX3hw6DV0OWDVWeN VOE3ZYKdR37qKQWZjPi4dIpbs5c/ekunlVBI8oyrjQj9a7s0Sftoi9Vh8HtfqQ/x5nXoLWax s3T51E/OFvjoLTjrvTK97uyHMhnJeUsH58GAR/qqIiNjH6B0AwOxZTG7Th7KZUWHa7+ow37L X/+/TrDZ1C3n3MchJPswR9sONcAhCsljExcojH4YDdLeKoJ+kFA/3kwFgkKk+zYHMFsVYtlu RBtuy3DNZyAzgnhGWfwwdwQYAJE7DuqnHrWsKaj1EF+ivSHzR5Uqf5JaTS6CKyGOCtH1DQWM rlAUq/bGacMwQThEYH3Y7jisiFykkz+vaB3YxVXD6qvgJkHf/cfi6+8SFgggju5fFaZHnawL EK5QSLSkSeoOApRyMHo9a9vWaTvfqxK4wVg7cEd3kOLxrhGZZ5XRcLQBeI6UUARv9Q2+oREc q6z0li4suDhPvBw8qcqucsFdChThEzrYPWTdQgfCDHsN14j7x5VLASx2O82Dy6/FIPUKCF3d +v3cT0erqlIhTodOa2cu7fkWrD4KI4DKc/lnIcbYDm/STUrDKpmxy9oLPVD8XkHGV+rkU7h+ 0TaZOuILr1X5tvxRKs90K4+l15r9qkbYgIzbyGOLgACFwHqk99MMOLXNtrdBDGOZkSDrBFPZ 8YhtObs/c4MU9+c9ki/KZa0c3MU17LGPOr86p2qNlAU5dBBMZ925o1pwqgxmAqDg0pLp3YTV WydBqzCORsyZu74T7Bki20vrLOusnKzsdjjSnIL6Hw4IqxdhdgI4KdM1W5Tvls+2akAHV4Y4 wc5ygdvr+NgromY69QRxFQuutS7YL8JcusK+l/FQGmkKMOaAyKFKA30C+KZy165r/FKVQbJH DgxwgwWzADWXDRDpKvvmNWRS5P+QyKpsECXtLrf+WHJp/Lcsz79M/vjreCX6DcuBslfuX9fc gC9CQ5xpYxUocM+wslMOSagzCvXBe7zCG+eGb2C/ZTHQp5dpoE3Dbgu84t5rNDgq7yx4R7Ub BUO+j/DLqStfjGRiwChhhtfqJ7Av0JQP73PlEomN21Bia40LX6tW/t0lXrTNEKUeNDFRH7qv 69MFO2XP8KhT9u7V+khVgeERG3Vb0eavfCsdJhzC9Bctj1uKvVMqi93MLWC0tM6tqgzYdzgs CIYnPT3iNojXlE3rj09h3/PoL+wT3X9ON8evjPylZy6IJEZzmQ98hYW08Z73gPNTFHfENyYo j5VLU/xXCApSfRG4aemqKeZ36MyruJjhtSv+3mVvC7w+arfCT6D1GyY5VgPWK/MlIB9MsnmI 092T4KbYONNjD52snbj9Ax/TGC4poMqy80s8CqJP94sGqUERhP+marDpSGaPMfLSlD/LMuBk N4+2jJ8DCfkfxIfP9kjxuf7cz6TiDG9c4ZxHp8nXtuKsfcEy3qUr1D40iM482+YhO3LbHF+r yIwsLlcqBQyY7t7PkvYBiIgVXO9FyiL9jZw8FvxXVJhOPQOKjFzW++GtTzn3IKEvglwWzfrO NT4LTVAlZXsyqsj4EReST/OL8Anw5Ijs4ep8FcQr3GY9XI/EvBkqq3UcUEcow7X469Wt7b6g f3gpj1UDHFcGQ8tfeCLFI9kNNBZqfGpQKit1vcxqoIXO8FVJcetnyYmbV2SHBWOF/j81g4r7 MzDVYKITIhvUC6iNPDhj01PCozpyKT73RCbeYrriDeBNs80V4r0rSIHx3Zpf16DxuoJs8mxe vAE4sEM/glmOTiuMSwG9pUuo/EuFJFTPDsO4E3csFxA7w/ReWKqnqZ/XEe+t9JnCQuvQyi9p rRr7H+lt1Ncmsj6ksCcfhk7VbTEdWjrj9YpVW0slbZhF3qOidAanktgaawotxuai5ouBnP1K ZaYoV0xXQ7w13oKGQm9AGcWMO/quTgcxfv1dERhj/V18sdpYAwbswVsTc7CsUwXIXnPAlARO NwU7HEDvm4r/oLBwUkhw3Vg8yZLVxAm0TayGR5DPDjARoN0gkNi9T7j/WkccS4/p67UJ47Ds QYO52JHbATFelGJAlTljhgcDSI8Lbh3wLrr4AJHP1ZM6MFR6Ssbkghek7sqzZAyt8NNpQEb1 ww2IN0ekV3Y1hsZ50LibBtadMeuATH2H0khVkmnnb7Rly1+96R9wNtbo9+MIbZDaqdv7vvRO /QIqysXMEi63KEqRDeayBxecZdv1eqcAAm++IrNCTH+IE9QZmwzR0U/BSBZKMh3Yoev1nwJB lWq7t2jF5HgXqEpi5cR1O4HhS4aKADBVs19evlOFVD8a4Jaulw+/LPt0zWfXcA7Y3tFrH1nt wn8hMHnPKUoIEEZiY5+fsYKJ58ouDW2l28uWRe8TJJLXwki0lsWWDGv+6Q4uRJgNXPSnw4ml j4X6ZD0vTg7Rpy/UmLE2bAGvnEH39/V78/GDmU8uQCLLvfxMRSacoCPCi4KaWLlnSsBZ23MW btRlBSHMD4Ui+j+gqDcbF2f6OjslXC1m+TLVpUFUdSeuRWfq2HzsiZOBUF1850uhegHn5vPJ uXFksEa5XPDraWD/81ZIv/Hm6Vhwn0sOISwK/VVUwLgwZUWhbUDdfwoEy1L/pluPrNSb0sX4 LBc+M1izRXQ6Y//VjxyIR5bdmPaIQcL9Gz5pbXmLke1hoIEHpq9ZkjZRwWavQswhbLzqETCe tOVKaaxpzU7Hm0DK9J2MAiLtx1m7sXnFvMxVAJTWCwk58NV4GyunyeAZrSgKQ8ZTDv+SjrKs KF9oBFMa249aXhh/PDsAmsAG0xdjgYWKshYw3Cm82mWOTwMmnPYWlvjmAVSv/qsou+fiHQbI dQS6GBqd2XoOnJ8vRIItZ85DnNgAHm0rdnURevp/iAONtYdfoC03cjLjU+uR2qzslGVweZHL 8gwCo5o1CKf1b8r1U+3NY6roAIX4/4gDg+bDocAoJzMsAgm3dl/VWGjIu1FfKpig/Zz2/0Ea mHUhO6twrTmwL6yNnv7LEi8J5Zjjc8aH7owj9ePmz7OttcPnwAiFCAcxtm6xjxfVSj0rG6cc 03eQ4Rfe+niP58rSsx2Zeq0XKILTriOavMdKERzWdHs447k0GNj88qViELBgZ+SCEdfKFwcA Yit8amScBD+D8Zb3UbC6Jn2JmqTtciGtuZka6LLfbNLdmNurk196J8eXo9mohgm5BVmAaDQ5 CEzB5guArxSitkDJsI9xArNVt7VkMurOLg4A2+nwOcDh0lxX3HvkCrAO0mvWP+Mbcyjh15bI Bl77YKDUUI2cAowttWRUVwMSzDFF5oUU75SfQcD/LLaohX9uU7PiIPi53XyA407cA7ksoBOH T44DIwlwrhovZ+PygHBi2evnqKWl2WYnAcHY9/DTGdu2L1xcg8oF9y9UkLlcv0NagakApoZf bt04ZIJ+7cQMTPlvMdbQbz7rVs+jrB7Wlh97sG3b9rnYAtff48n1x5/RKfFn2MF7QBl04QOB 5VEuWPKUXeSNC6eBeSPwdG2K3tejhhSWMTMTXVueezyFGw7WThRAd7sDMbbx/yAVXAEXRPWq wEBw+TZz/FtoV48d8rPPYsAFrEu/KhkcZy8z2Y76m1hYAScSFjtY60YKW/L24x8RIPDqLEY1 g/37ogNevg2BZhZjWITmdv+CFKXdV78iGqzey7WULbNOotC0kNoetD9R7Lq0bq3zS+eeAKQv hNqtFPvk3+SAvRgXFkanMpKj5LpR7+eLrHknuHBF4rZ3r8v435dhJCTZyjqT4ktKOLbl1o5c LULfyu35sht/ZEbeCfxuHdrJnGOHf6kjzq4w1UJNWLx0W72o5amM0t26+S7z4yAOS0GVtgy5 sxPKqD3Y2Ab4tLG8U/hzfJm0cypAmR9F6elBJ1WAEfxjjBGcJ39VShgy6mpgfkyq2tozw4Nt jRASjvEzzfFmEmQdRqhODzKoUloOl/8NFG5BGmBaT2gCRrAfwRSUWJwrCxfT0GhipArKBRab RHoDDDFmbMC2bDUxBBqMG1c8LfDRc6j4+QNKt+agbRFFxaFcFrBd7W8VCpu6IbsPCdafFe8P LlaYhmhL12F4nZrlgT6z/BkAbE+6/gdggzH/4/I7DcgBOYRimh8wgIIYZlaA4pr/WnWHdZO1 VcR5ubKb2SmvXxfX24Qf5tzG3Jr/1XmYryPdxvxVYFvly2x/DPGMNVxtfRU2Q7zbJvpHgpFc DPCHM3Tyy2lVNzadPOQbY2Ri9KQrLRvnzt9cksqA6/GB0OMvsST6oSIqAC4RUUVU4Rm28JV3 CslXZSzIBy612t7mnA5Dep5zrL6Kaji1mF0NpCplZ2LrwRi9TxrzVqLhtEwORrYzq47A2cr+ 2jjy1HhN8xLAhiqeA9lS8aEHOCFBUPFKV1tEqbF0PBrRESq3x8UBUgWepSDzWzO1AiIqIuzY Y5JM5ZgSdfmM4ICXqJyLvGMRfOHjaBybBpQPG1wu6IUTf/4q0DiaBRpHYMprBoDONQwGOtyG I6+BtH51A7YaQ6fVpufJrVPYInHQRSjxTjlp6Vlu7eA53T0keHJdFw6s8NmOCZTtQbJPpVlf V73z6zqeXxJI20RgjwhqI/5fZINcgPX1g3ZxZJVbT+OQBddDkVgn4Uoq414C5IeimG/MRCXg zfFMW+re/BRAZ8Bx6Shkl12TTt9fqjySc5s/CK3CcjwasH8Aco6qZxL6M0vuCwuwDgMxbx2N nDurE3Xrks9A66ysrLEvYAyx9FY4SmUAH9fWKpNpdGpwGjiNvwtYgTQCfwblwGgxpneHzlt4 UbZV250QUjmsZFskTDCNMAPywjqELZdST1olaOGwEt8HvIc4d3dzMxDN4K8DjTQsbevejnCR NCT0KTnxTi2ZsXunycfsCtfZlcfSmakR6+DMQu0XtLuGmDmU5SEI5rzaidvrK3Ticrh6xMYm GMZSdCRLnaztDdDYQvi8HWNUYWEvUG7MiZbtkUGiymyUIAtXZsvsgeW4VzqgGFHjLuz8+CPy 7d1IIbXoGlpIAbtxgqvuyXJcK8JYOAx4Brm0qpqaGxPp9p6RO7KqGki68oakDd6pjHki/dw8 1iP9HnN1u6bY9scyxhoDaqxprJuvBPyxMh24KqUBi3DX/FXCuzIOU/FWlnXahbtkofADflGB thagykq2OBFVSeuPjgnc3I1WPxf3gQFOTT1JG/Rx71WYbn5c93xDUUwqRVBcD+oQVXAHXynO W4IC7dMZdfs2Z24Iudz61oWw64vA//nT+uuLnJ4ahE8ZoI+p/zXpYBlIYGpgjHbgaokIFWSV 51fjGKBdPnT/23ucBhIAQeLF7AWtIPO+uGCGDfufqndzK/zLnbIbV+MEwFgIdATvf4jqxM7h aWwUW3+W4Sm5RwoHe7uJwD3MIMCJe6+iZZETkG0saDRAnUIKyF9b3KTPn1TlU52yTlzfg0SI nShjcMUNJ8F7kaQgxhCpaj7jlcoe+Q+QyWx09qr5pe7dei3EA8ShSNmeNjQ8zCAVsRlhvW4E nDCQgT5sIOG86hy5aeLVJxUQrl8FGFYtY96nwpBVWXEttLqSwGrWXyPDX0Nk3XOgc0IY5bGD R3iELRqH41ApZ6i0AIMTuOI7nhbqTU1wavA2MAnhDbmmM7JWdoZW5NF0+10W5IA3RvZVfFCe uXBg2d/kgv+xrmk1XMOEfli4MFnsywtsfhIdHDU5ieyiqD0W15zqnVKdE379O+TMWP23JU4V yRsityKvfueM/j2BxtmsEn8Ko+obElk2XK3yTH+VHXt1FK7RmY/z2hL1i8cQf8DB63eUASQJ FFF+0fmc1/d4utHAuHWKqxhDc3fzuBCaygA+7I/kM64APovNmPkfPmAw5XhUSsggKQIupzec pmZuim9XY+Zf2e5Qt7wTrLggX1WUrsB4CAy2F3xhLW47qPSHNoAexzbg0SyvyCwpIiVOwtFo cNzeUxZas1EmI/1mZhJ5Cs60+qw0uWBmSJ4FFO/f2N1E9e16PxYk1ftgDFkrfht8bGS2NB6e hxQdacCn1fx5ZbM+FKi4OEYJcGiO1vOK7g0/xHXoE5wECh66+fsFXKB+i5y8kdsj0t2RVh0J p2Wx9utoYEMXc+SLzmBKds3Urb9wHYBnCscr0R+4nPngOW99Y21T+5KG5wt+L0RCE/MXrX2J dBgyKsiZoL1CqkTMWl0Rftim+J2X0U0YQcB0TDDflTs6eWoZM7WLOXKdeutCCBZXbL65vIny wEdpLXIu+UjC4Z1yKZRIp/wfYd8eD3X2/79ra4lPuRRtKcYlRGojyn2SWwqJTDOmbCXWTKhh lXuzrY3cRm5LoVRK00xFQ0Po3kSIGpMhJJNb7vdc+r3Peb9p+32+j+/3v33szo6Z95zzuj4v Uhh/Q9/lXWTGvncDF/jnxqIf/oGWJnNLFuViJI7vIbHcnNOTMzCT5SDJyS+VSUQOtTx9TXUa M0ZierDrFy5pLnEz+Uc4rgYQboit8IdcQmgc0CUu0C4TF4Q5seXnwi/qoA/g/Lp/6YvL/U9u TWzAI6RIF/kDc6mnTs5hEFLs5ABwRCnU/LcZsp4m4GQ92MX9lGhpX8vbFWJjP978RBye0d3/ 7dfkFL76wxhsEHB/zqs1XJOn+XcWXkcFwubRr6TNa4n3oTDKUVucDD0O6Zw6tAjT58i67b8/ UoaP6+EVoGmHDvWmdLPKJ88bn0yn5hQnu+eS3Q0rOZuvkHchvZ6JJNFdbe2ctiTxQ+Dk8qgN pS6yyqC2xW8HPVQM0J1p9bTFLXeU6uB1TXaknMNvZHolYXR2N1neJjn6zCcb3LPwHYuG6xLW YUuOd4tG7wd5iISfdyNVmwaHoce6TNa5cUZyJdgxX4qD/Dkap8aqOAmomDWkQSLhxawLxD5t 5uLzjyOmTz36Cmf/dFsVmRKylLYgcAXNhMtNckZ6PV6iH0BUHA37pR1SZLV2z7MKW9+NOmIe GDhgEOerYske7xvu+VKqSZjeBHy7kgZVMVVdrLmKsSTNi7K2awvAiuqilifTD/A5gNug5Ihf zT7YIeDXyy0w3CFUyL0VV0ja89+8wjbfNAts/jqzFJBlvyMWvtEv0DVTK9YSXH1ScXmOZejp nT5J5cQH1G549uaHHKwgS0IhgzP/xOAd78vyxuKrO8a9bZHucNg/YTVE9CBNzj9Yb+XKYmRk J3Ebu18ipcY3r8FWQ6mhiBoUeI1/KXvHhnOJzNp48LYqI4SloctwBFCWvyv5NS4rkQZLKayh DS45ANoEDq8j5lw/Cvmio6Q0KhJzWOQLqLw6ktATihoUysixL45srqA5/KmJhN1+mafiMFi2 fUc5tAjUKAmxYhtu0csTUeTo5FQFXocmx620lNiRWJ5oPqrxal7j10/z/2ZwPHTSJSvBCAfX Wo/TW1eSvpMSf0XJkqN/5lerHtEWM6pAByrfmQ82JcrO6KLPbv2PVO4nyQL9SgNvkomZESAZ j+UyRvxW0PAhNik01k8iUvDaKBRjJ5kK9MWIfXzmuXMCG7abogohGVS8ASTcLI2zgsbRNIsa bEdRtP8/FvZfFEOvXMYSWU93UFdFhUR/KIElxLZ/UTig1SDS7wLbi6bOvuL9c5gR02DxgtWg 379z1MwvT1/ASPIayVF2J14+cEtk8j2t/zU2REJKZOirtk70l70NytS6Ss7Sa2R3hlZHSs+q Va5AejDZh5VfFzgpaHAl7HMrX+bClh+Nz46F6gj0w+u+YxnO8i//qQzpx/QXGpdecCx6vkaY mKlt3aryv3o0HewGDhjPQmY+lMB6ezFqfpGfaW3+F4/fwGCajXf/KUD/4gt44W2AO0/AEV8M Cgs8mpp3xbYX1VqjDd+QzB1A+ixUZZDYDc3CBqSVMgfzgq8Wof4tCpwGlkeFe2TuFgU7tT63 DV/KB9wvW+HPFT2V2zNUF17+1fZUJ4mY77lPTkv+8vnVnTmFJvmeZIELMTm4U6nKsdDOy1tA pW9IY4Z/bf3aMZHxZSKzRn/EL7tiBpPJetiHdmYmiQAEzDtNY929e1lJRApL2EZeD77EOzSp yao9HodC5CbFOBrHYBc7iJY5fcMdt+k2uzxs9kvfly+lcZTxW0HTZ1LnHaKOn0RCJ5ItWm6R m94Cwye3NVHHfC97q4+/UPKDX/0WakzoxcGXyPIUOyi2PH5//++PnNB4aQKYXEh+83dhl210 Y/Mb/smWHWkXHhmo5uxf+xNa5spoecwTPpD0rlDFn5HlcS0BjjpOwuR6B2UqNnZXmZtLKKed I4w8Od4lEsfuqb36bw7UQ5Uccv/b3VRI9kD+DD8DkD2GJ+/6k6avh+VMk1EX2adnURQRckeQ IqTu7pK1dDLp4AECoHnYm2oP5qBzlyeYbcZQ0j3L/oHyyPQToTafvK5rakLXDKotVyFnxzKA M8fjPoFSTItLIsTQOE4ktkYox7+lFxA9mj/85YRy4negai18vuhZZ9jczJH+VwfYZa0vj8XS fPlaAo04mu5s3jS/IsueEU/T/fRCGern4degukN5Vu9qY9UY3aBqQjEizrJ27zcUsFQZyssK bF9Eeckup69IdMCJvYzB6MGDx8GvNbBqvTUSrVayyLuuZTO1PMf0U6gnto0djwevabfGZoTX Q6d/bpbomPlTkd4cXFF62/rddW9ZXcYtvlL//seaMGefxhx1u7U6HFUkjQYSLctPAJ/COEHG WSaYKMjoY6mu7l3zMFKZZNmwDeEowcgg4Ay5rxDYPd1L+BlDSaYsRRGyAxAh67F7Rf1e9tGi YsOsbFkC1/B1a9NHK5UmyPfILjVTG1Z6tDx44kJ20j9rz94nw9pi58NMfrOXbAy+oUvCM/xJ 7HONDL4wRQLpH4uONFCscFWf1jxGEZ4P48Es/E9an2ULeVrdn/0yFngUJozGNV8iJ68UZK72 6DrBuo96PxVsqMWTAQqZTtNEQvnsluDR/bf52a77usFgAslNSF1li3uhmZfnvU6MW1BSvl6X YSyWYWZqrCEW/PHR6Uh0nHPUCqxxiy299ul4Xvb23J7LQMptzz1p1G65K4zE0StFzbU/kZUx VWsMJrv1FNXAh/65ex/YDK/SJphUZeWoEXSuJEuki8E3rUOzn7rkeg4jfeXKYCI7mMUoovlS aGGBnr+/tlIpNRY2jdJYl1VSaVcYQJio4LOjGRlUPfRTqPbLqmMKPgOfQ0TWuLVAMYXtfyxt A2E6PyemLnH3vBlOW/mSLtvk/oovUzucqFFaV7WHCM68wjeHRUKMW/15oNfhCjlW8Aj73dWA WNHBM0VeHGOfz4TbYDC+lv45Irm/TwC+CrfLClcMXI4jGWYpjyNIuIFpxqNO9IYpy91Jo/qt KLhEDsjjJH988vnRXPbKKHLgFcYOY8nG2ZtSIlJcjTnaPfwDiJ16TDNnf6Z1FcqqcCcmg/1W VZaO9PhSGufr3GBSpTLGjWrejOY7Ksx3ntLmn5FoGM/hi6xhvvPB8t1mI/ETGRBukAGcGqgG 6x4HkXDvvZIkuEKTDsrJMErbC/SzmqEt2Ti10mAt6JXDd+p4GuWE3jcEv80JVZlo/LmVNsX4 BgWY5eIBTWVQwvMgMM/on4p7hL1Ljhzah/mn0nx3Qgkpz/3WKkh3+uaDB8HdZfZzxtu4RaE2 7YFubSQ0NW4HEUCSxnG9Svb18tueae26SG/Ez/vkwBP6inE1wvSbM2KR6I5eCfN9kr7u3UHC fJ+UlOxiKjy4hvpmRuZ5oTYh0FjjSwrVCRua922vMQkDUEP6NsyYMI3s+wqoqKnTOGdN9w2i q5Xjxd/cCV/SkNT3Esl86wEJJO0GOSC74oSp0XFU+uC406JbztU8/i0JzysU+jHqQNdeWbsc sm9QxIlgKBGoV+CmAyN7+deByOHSnbMm9p1TJ4trXSNWz5vxAa+IPdygOWol5/nzv0NSqBOB eR+OgP+ojjkUot5PTo61X4Alh52KWHDwH2OiXoG/QNB61LXQm1Mafmn4zbz7lhPqAlVdyXGA LlDPnHkNCiE254No7RHwrCgDjGxX2F3grUP8XWFJKnOtCqF0+qOYBWoSqPQXxlZ04I6X7Oe6 uR8JsXkVS00s2yroH+DWaqKV7DEw+0bCMFdY2LPah7772urVqy88VgUxAyB6omPwn1LIugOV /LcHWacABn57zRr47JFqXBs1gBLRrmu+sLXHLHUNRaQsn6gtSPzbtRfJYJqGtuIbUehXfwya wazZDS2NY/aqjLLwn848uXJkOXLfPIHm8mzPSA7GjDuMbXlf2JbID8+WvmpoWvpeX28rUlt+ GI/7XUQyqeSEGvMHN4PXngdSRRus2YabDdQgwQMks9vM8JGDhCtEdQVvuY1y6IgL4OdyyaUl JQ8mL9bmRL7Keknr26MraBnwLEJOljPb4RcR6YvDBDPSJBVXeo0rKyIVLHNuBiGGXgEMNlHW 4sE19N0To2PSy+LjdqLbOgrg06kSdCJKRibQcZKMWAh5ZAKo3biu0CsUjcdZ6Qj25nciXeHs f0TCVrOPg2/ARXkKgLIKKqDsGpHyW0R74Us3NasKTxHwzT1WFOML3HbxgqOa4IwjA5zlrUBu qOOBBRBs7xfXgFOSh7NAZv9XrlBqHYHqO9C1hcahX/5QN7RzLWhj84l9UrK8StPa45DudH4n SrMvhTT7lTGWB+2+JbGkxgwwGUm6/GiuRUlTspENAvJ4c9+qpJPS2bzpdiT5fF0f7QS6+T0t C7zF+AR8w9YHgyQwYTYpnbbCJQcbfmCjE1U8TiZqg5ZgY0c1x2n4UyYF6HDNAez3uVTqcDsp OTgAyWE5brxhc0N0tdKfCqbhyR/qjpS5he7ddw06PN3DB91QsEtidivwTugS3I9nWhfpzecv 4qlLIyvRZ44HS6ASeb3pQ5GC3lVErCJf0zXg0KoUNZo62dpLPy2N1sQ0td9YwCT+CxIwU/wU iESd88wsUU1tEnPdYOBjXXgzTv+LbZ9/hZFTwwGipcJKAxPJRn5dS146denS/BTFKFcgcyUK 2tMOlSpMcf+iJ7roMp6oQWfCXkX/Yr11lfyInk5FabjFR67eAyBxNErrw+sKUEqKTwpV+tTw hyvwaJw9vZKeQshkEVmOq6f5vZSbYHxbuk6s8fYF68BFw4ZcIaGDMmQed3wMbcC3I6Wajpbg bSz1mpagZA/7Wef9p6mguD8lgVERb89bOxGb3jXr0Tif64Ze+my8LjW9T6qDYHDzQGR669a5 yaEzz+eir5thEmzt4MDsXjEsjLcMMVNrPCMNfRMUgboWGI4iTyTPGqXSmz3dHl0LzwYE6PwG +E9WSGkahzdO5JwyP8+lYF97MzDPWCfJTW4MUcwFWi9IA5yOxOQh55hdkPPwG2y/HnQp8IS5 C5QOpLD22yXV0TK3fXwPaPCyBKrHOijPEgMxrJcc8CbVr+TUylZyrqESNOosRhqtb3ElR9xk 2dAjmC+T8F0kFo6wy7oSKE9fBahF/YGgoAkGc13/D4+XYoMJYPiePHd+klBl8PKrOBA6yVwe BbrP3qRs2U3AU4TEHXeFaFktQeWQxDM4FZjsRYFJV3UIivo0gzdAKSflrNFXtERRT/nGTWwX NuZDbmJv36cvPcPnkQrFBc61DnCf3xsXOFmFobh8NTgx9LLGKe6T8nQPtU0/hx+/D0CPhSOx VQlkXTUqx3JRwX6wLNgSqz56/LEvenIxM8IprkCS+CfSSzmDYW5lP+8p3M3ePwmcIeXHBZmP 5/I+pbmZMcv6HRVBaVWDJKaBkxN9Eh2iVB/6jNLv9A4u5kdkp0rHr9hbwDCW9NkkIIuEeT2r iOR/LmRlX/xF8cQVxu0S46YmknvXKu7ERxlluMTZAK2ddM5Ba6dm5Le6LQWtndSuEzuS/RTu ehtITief2vAhG4aKh6rYGDFBulB8OnTgpF6TtiQ3N8Qm77rGc9s/aqNXRh3z8UOyioEBvzY7 eBPbbLyAcTT4Vlsumn770TQW1lOEz9u7dGn8PDuxBLATr+oSXMBpaQi4WAEnSXT15XfyOHey k8j9ox2Tdg7UoBW0EKQiVSdz3QhIRXNg9hVwdroV8kZocfKkUhuWK6cA0hjucoUmpQd3AoVb AHY9ZmmLS4cq5uo5Jve3okD8dahiZnK27FagPeS4on4U6LVaAQWv1rsxUHTi+G3Qge1FIZBk tls0PsIFkBJtFg2nZ4/MvEAvtjfG46iDPA79ci1PNEM1xVpWAjov8+KyyFZa38HEpWEo8KlZ GYPKUt82UaxBy6W3RU+jWlU/AHoTNvH47WG5bUK0Utsk8/ojaT1Ypbw65ut3qzs7Ccmu2mPk XIYem+vMA0zEuWW7wuQgHlhVxpj5Xhu4NoOu6y2Ng6Tvj28Km1+MPCb16VA5FYOjnbboQMEU uhVCsCkS1QJ/aT8C/l6KJtjxJDPL9tAAtdNRjQDRsTkPnNnjU+3DPVXpt61wH09ktmmjn24A qCB2r5piG884rBhWzSlOpWb0sarHOKlHfaIuZmiPxj1I0vIk2JYmWGqLhAHv9eVko656XzVN JJHlwSduBWIRkM9BDVxUUP4hSgAQPU3r00BiZJKYi91xX2s+MnJQDJqMlu2C35MU5vf0EXpr +IJs9Y2LWBEu2S4NvqeWPxCNbB1OVOrlCJNvah8AI/YwmsF7MSO2iCLlWMhzs7HFFSKd3RDj ITo7fPjTcnSDq2lrzy2ijsVtAy4LcwedUMunvS1ndSGJ/OGALCoKE/4X2dd+a+ytW/Iv+TW0 4SLS3GOg8202OHU6EfYNdBoOY9XzbnuwN25Sl5zqJusI7uGaMEIi1l1VMnQv/5JCrTgp2Q5V L5EP33Drkw3uTLXqYi7pa9tgNOQnf3nexNodQ+PkfCHuWybtMK/cdbxiAXykoCP4Mh3yBokp 0/hnfBj7pACPfsaxJpPfc/WuRxk7L9NaaGz11/tZjfdNMGHRhhS4q3UZE6HL2tAS99JFUI7V 69PWVXFqC9x1HLgNUbS+TRejJpNgqEbiJUmXBGXTt6jqMpAHMd412fF2xXjr6w3DHkYWSITH hketaigZsc9GJeuEA+ybINWbIhLOXERi62okcO80YTEOQqAscv+6VWKrILD4LJapWPyriwsg 2+SqJkFns1i3ae5cixojB3Nd0kIi5v2gXStomoVHcxkj9ZJGmw2NTbe12QCpAg8bSOg46602 B/Ts6DSo8ZwBk5fnHnCp+/v7lD2lj7KQK9g5ZUrj0Cy0j4ej447fMCrimstkd1oq9cmOesnG KynULBvuuJiIxL144/4y2Aw4ItWnG4N5TVVE0Q+Qqt9QUHR3fbWqSWmo8rKrdypSJDrOmClO /YYl2AzkSgudxiItIqxsgeFG54HnViorP9nvYZvtg76EVRwTC/2hn8AVa96KeRJWq2qIGRmY 9VrjkpipLwtzqlDEw32w2spfFukBgOheFr+LhA1N1WP81GuLYywd5XMZ/gcraCE20ZYtE40x tSB7w1aKtZ+dR1rIWjF44++SloEO4HdstF3MRkk7SkBlf3EqtbOTq4/c9cUikhmo7k2GYHXf H4u6EXLy7lTkc6/tA26E9W+uA485o95YfHnre4Esz6V48fBwT08VwePQV+mskddO18RDNYZh zgfOtmqXlOO+yK4n8txDbAIhT8XZVkXzuc3fWW52HDIVaT3LExzClkGsyjowDffZlMbkFpIC CpOYZeVEdtDVTGvz7Mj6atXxW5/iKSvG0xuN6FVoKjmrDjJXnkEhObQiuTEol1EPFotDzu/1 z6dlJx0WkRwcxgq9W7DGayz60VmsqQbX+5ksz/Xm5cvODUCY6f2RKv5F4LO0WZZHdkxEUv84 mGianuzg+Hghfa0E1tciBdYtH91b3urphanUXqpOVWwCzTfQKoVath3pvVjkZI/nIHFFBvm1 OaGrq9lviesnGocbdU3EH4svrhcjRgNr9I9PfsDUykT23/tCrconq0kGR3ZqmoNFysNwGQkr nP955rXQafG//7Z9oRlYaLedPd6CmUDtXDR8gcQ0CjVooIhCTNvgRB6pA8CU3FwktL3t/fSc Zc1+QMZ4GUvVrY4v1hb0f/zrkTd6i5XlUMhRiU0ZSyEar5AJrRLkuCSiaRsXhXraiUEbKL+W XHJT05iOAHhLlmUnRYIZkieJev6EbmrIRme74IClIqGyUtrkR3i6ogEZkQnIiLGAjOhQaCdX I9mMYg5MV9Bfi4RLKzlLfYBnM15cyxwsCR62aiKlVx7xak9+Jp/Su/tIxZbYe0UnA1eDRs+x RYswfSvTOhpv/jY5uxYCk+iTcmiimpv98qVpqwH7wEFyx0gRTbewjNM9GveqZrdDwgWANXKt MlgbdezYjfT3mT2r6liMfU4dZYEhNnNz3eecYJTdiqqSP70HePNBceS+p6nMAzhC7MBmug4a 7c+uk4m2vHmimgQ0yS1reZ+eZzLJseBfLVg/VW8+lwPmb223AYVj7nkEOhA0ohrMlpDCn0j5 fJ54CSiVkH/NvsX2t5fqSKDQX8nRw97ZmuSgNV/MPGs+YRkoydxqoz24eYsab3pbVdxXMGRN 2c987dl+Rhl9cQXQ5F8sooylkfsctrMNr0EjKP11hCoPpNx+dYKuiN4WcVQABkkiEcaCSgMz 1s5aOxXosvAZ6OjW42DaBc65c/2PYiCktU0Joq6g+xOARV/AsJEz8lyh02xzMENTSRnL39Fr F4BHNlxDMC0Agfpdq+BCv1uVQQp14tSt9iuwRFoP2Ia3V6Nsw7Gb0/GaoKo5fJ/c53IQkPli 32eclkIXMzQ1lHNoH2Jj3mmRlQ5t3bUE/aOTT2E7eVwZo85DKiToqZzYRbNw2LV9vOsdVSFJ AcnLz86E9526E4l7vLH4hYUApQYP4S694LinUtG2yhnolaPmdAXk+YQ1Fud6hVya6KKQA+h9 bbXQbYLG6Q+ETvSAe+gIP+4L/Rwmuma/D7SNiCyG93W/+YSF/MPDeMuWd/qWOh05a69PQgmK OUn6eehMeJ6iEFyalcQRoq1V/QZatgAg806YSB4vQwNOEQo/QkqsziYUIlJmZs9tQOraTXvY s6lq8hZgwvPwAPDPRcri54R3yhqEC3XVqlTFC+6rNMXWR81eQ2qgcSNe1Lwp1T94H8DKaApO 3+zMW8zXp12g9eVTogIpKkT2+7HNsTnwp09E3TXsfEBMXK+LmkFVTjbWXEMr8r2YIdTns7MH nNm+Ze/JHgeIJKT1f/v0/j3Lm1odF5DHm+C3T3nZXNepR9imzQJc7mc0Tuf6JKaB4QUO0vl8 gT7MazSQQ6BO41xdI3VfGs38OqjQc1ZOZ42jU8KOFKoL0l+GpFAjI1LaNWGhTwUX1pLdUC9s aKkbG+jtD3TK+WZLGOWV9KbZVvbQhccRfLEps9diRLda042YQYqMPkAddUqbscIryucUUAYi 5KLmJlg6xqGCNbnkaeoL7Yhf4TIKJqdTvwIGohkHMhB9e7s+h4x98eIKkygKS3L4Wp8TG3ee rkKj0vC6fxlB+WpKcrsgz4MUYnMulfqtk2ohl745Im6BUkPtgQ28utiUVTwlxI3JYu6CE8EH Ep4lMgCnRpfw3HhdQFF9bMN2K5cOZqP/02HHBRuog7/vCNqo6cxTqwBW0HXO7HhtEWmAVWkw tZgN3Aq/cP/8is7j+hMWePFsqFvud+jlFnCYp9RyqtBYN4lus5AAF3AFGKbRDgN0CSAjlpq4 DCXDq2xAxy8qqARvgxSdB294ycrTXWmcQP+vD18Pdk0+fRu3JXYD65YxjTORTe67ArmIFyZK VsvyJteK3T+M/swB3/dYSIzTEbiC8t+Xtck9U9F/H3Iml/wFzyQQqUMzFamKv1fvprwqww0D 7asSdEY6t6Wjr4rRAExEqTplx1oeUDR15iUaS66v5JQdQB6Mxl5umr3ZbeY+f/Zlcqnoh2cV kBUvjdls5DcKMMdlj2ggHUOPvuOjsHOUfvoCOr/SUwc73SJLhRSAjaqCOue7XNlGmn+Hbssc lEUhluhGN4CEcwAcElJTlsTVLUCRJi7BqQeAbo4GBZVJdHBj8BEqYsS/pQM3omAJObuFEaFg 3VwBuarTV0TyCqUGhKPEMyRK5+YyDqzt89WWbHy3Z1OpAZFtBBPZgaAQm21bsZHTvI+hG4jb TY3vv15qoGiyyX3tlYDzsast47Q7umAtUEPS2c8p1Jvye3MZCeiSuhE5NaGVBidJVD1/jPLh xju77cZQBnLnrQHwbm48HOQ0JMcg5Tuw8Cl4vUG1kJQm4dloxuXi4K96Yw0mLtvR9WvonQrv sbjdTg4r5t2hzNSeQWZirrRTsynUfEMFjvT2ssfzcIQLSLH3I1eYcZ4p2hQH9c3fWB4Myltc QFsm1Qx20kjxIAO58xzLFcMBc2+4GHte0plnxNc/nEJFGnWXIzt2aIswXuLsmupJuO9evMD4 gBr2GleJnn7bSTjB1ha/o/YpzNm3tQzxkIihu1j1KgnEUGSrAEWf9QbMwA9cJVPT5b565TKi 3shFwrxwSOKUrF2w7/5qijONs3EXsAyS4Aqvz3gTmSoE5unlPxajEpoiMCVDF7pRQpa1juAB tGc3Sh6CynfnwNomjMb5GckrN00OROMdQ2mcvpP1YlMfcL3+Ctwt1apIGB9QqZFHw2/9kq4T LFcsZgGrIKQiKc++J5DsBgaCrNUiUp3KuQoQiwbTMYxSf+AmJMBatHEt0JLuB4D63sPNc1c5 qeeuIWmkHA207XIZkVMbnsP2Vsb6UodER4UcGDccIrCLkFK8xU+NsOvhjix39AH9BYBZSNNr baviD5Q4lo5OjN/ITqpJGHe7Rg6l03R71J9ZgLcaFIDvpy5GdHFxnzDd1zr4OBZPonFWvcf6 KWMxn5f8XDXGklA5msm8OMa6PbQVNA+Sir6GJBcpiv1c5ruoSk5FkM1HcVBhoyR5f0kwqPQi 4U62qBF0mjq3rESr6lQMBeuVinO3VtkqIBDSFKAZMcDxdm9dLBLGO/Nsv+AfcVG3iH7GaYOb 8lVg43L3Lld0FO2hli2Lvy/LE/3KFRrROPbmK44PzDvV3fJh7eemESo5hW+SP8qIhK5/0VhK IuHa7CeTzhANpIq65oJRHxFTNuGT+vCqjOve3ETVx4ZRsx6pwA1qY6HmL+mYaomdKXCEGjmb 3VDu4REp9c0RCk1N/0HKEwr3b1pf3nJ5iGR/+B5cy4RMiIfNJkEiX9EfgUFlIbqyvAW96qYO SjnRofhnk4p3u2Z+SlLEUNtgn8xVUOEZViFVhp+JM896q2R+iE19vX49P58EJIYyM3u8ax+s FCiF+rPfzwZH5cAZo9gSSNwwd4bEjd6evfl/K4pQWwdaCEtD9fMmD/6Nv8msz9kNcKX8o4Sr Btyw2nlzg4IP/adRLsq0UinsXTLARrgTDwamUK8gdU0sjSVWG9Osh5yYOwtKZEHQCSpAalce seM9S9augZIavLGNDedUl25JQLeCvsmu1+cAwvllzN26Q+/16w+QaqMDSk69W74MFtW4OTDw 015OT+FkvnnnDyzInsbia6xscCP9vZTWBwL+P/zKHmL1M7SRvwb2rmGVnETU8cnmO8enTC3P VOD4pDf3Ykc/yGHSmI8ulUvq+ZkrnGkf1kYOSvi7gFa02CBA20Kr2Q+jcTxFqRLQjVUCgqOZ SLj7Kg1pnQ4SmC1AyEXJ2wQI0tsto78mVlMUfCjjBrGj0PfXYbc92Fvmiyhbi5DOMbb3p6xe tKZaBKUg3FWkKjnxY/yjV0C+XgdM7TU6n/KyAL8T/z0jEdtUnSbrFhaWgjW7qXnS87mAJGb+ 87lNHuUlsnZTrLWFJLGc0WYwe/xR4mk6NiVIo+mqman1Um9C/1SUh9jzu78LixG/dOxfloUj P9iuMQeVBv4zStuIlj1ki/ZUHW95/I3s3WBdPGn+nEtDT7wh6sSBvFFUdlJ1PId/1JZr2L9e MHqvQVjf/HbSMpFqLNmtMzRhPJPRcDjSq+NnkDUg5MLhS9fdb16F7vtJxAOtYaVZdbK8zw6q xxooLyOaA1A/c5ld3yWllflknXuWhra7qWC79iEBbNfOW86bFPY5OPl/vRSDr9lZGL2OoC/L c5qaiYIc+alPmmKrqsS3rQTkwx/E5PFI0j53hZEzklMTYEREmRtG/2MmchczSVSezjNIo+40 wtOUgertN49Ci22muResPylcXUwL/9jnlmcFWizTG6c7lbAEIhMtu9Bi+WdBmKSqiFSaMrk8 6kH6E0VlpOt0/Q/0KJzYC42gqqARVC40gjLPjrRkK1wR35KO9WuTFa99HFKoBEL6SkrxJxc2 0ZmXkb8khSofcLjDRgXpFnEyJW4jL/lIAWr113ukvl6ny+i2XEQLsYHMw+mse/iIbTwlpNiG LlAeFfZi5yXUNSGgHuKQ0PR0b55Kjfy04WY+t+XrQS9DMqjkiG9rHkpCXnl4oa9CstM20+Nc G2y2uAkaT6RSxZXHTx7lFoFuag6kzKcXpbmyyMU3lUiBvEMwDbnuFbiIhhzwB0SUvjE3vDzZ AhPmue+PuW90aXnOeYmEg6/xkf6JPau6P//uv6/S4PoTZREpeM3kfUkkSCRgxPn8fFZo9k3/ Ux+scbpcYZyfArHpXYpX0iWyrrFYcGviWnPpeW2M+iUpa6Ka0914cTGWG2+AqVPmbmrafEPl zH42xOMZ7ACXECVtlK+3wl1Hyo5DO0m4rdfAkKU7ET83T32dN9sgbpXkcoGhDw62ptteCy5s 3Cw5ZadsqdQ2+ATO+aPFMc6G4mrFMq+kvR2UTqQ/m1n1SjSPRNVA+v1nlZwHe9lZUcC4O4U6 piVoP7GhQ1sFDObmM9N7MR9rnHe4LG+idFp5GRJqnGp3S2FrKJlDrTPH2755WUNnjVrlENJ0 RPis7jeHp1hjMJjV28BilHX3C26XGDuzUxsfJYI53WFr4KZr6AfddCnQTVfYUNc41sOxwk2L /408CktrnH8yEnwi9Jl1G/YuSzwwP/celFp0S5Spw9u4HUhSo91TibGJFaNvLO7tW1eLUI1N 7H1GaBsVyx+KiQXlznHlRbeAN3LODWeHWgrnjz/yXZ/E0zjyPvTmehonXI1Q5SM9bh1YyIus GGS0zZPb8G0/LtgUVklBm0Ln8bYn2dCm0PkaudeaG6R81sj8JyRYbVhQcDnA4m/gCi/6KTQy vJJOFtvgiEyztjNpiZirzYw5cmED0qnFMHt3PH3Xdad/VZ2zHYdc6K7Cp8W78Z4q/crdjPxx R0gqtD++QCq82TRPKnQn4SY8WUGnwnI9CFWdFlUkh4OEaZtFwxPK8TOY2RE+A2Nr+G8VCNzS FDq9gTyHB7TYjbFseWmUAIKDeia+i+TQQeGT2Gnazuyi6xesHR0dCnlLZXl6wf3HVy3Y4gAS vbH6yJPuVVxDMzW3FcOvYwB1Y1UKNcbcihYASMlAOI9YrepQXe6VBBWa78bsJAABaB7fPqJh SBk7MO070fLrv5ql5IqIH9p/gn/N4l+sQlbf2ixtscY3YPGgZ2xudE2VgWFYY/HZpagVFP3j H5xT5v8s7LTp3+UmuShy0IJ2C8AKkFQUFXtcant7LmpdDQlwaMlIt6QAbuGwhfWJKDiMgQZ8 vyv4BAcXkn1f8PgPwBzicfL/o+zb46HK///bSdvEVu62iwxK5LYRkkRymYhyyawxtJVYM2GN IoSmbYqoRrmEUIjVmFE0MUW2+yDZpTHlkmKGLbdQJLffeZ9zBu22+/l9/959TGPO+7xer+fr /bycqUJ/j9UnUU1h1iqV7fLUmNFK2AfQPVVZ1FwOSwsFEURKwBU/4UDW+09voa8kC+yfp5f0 ACqFFExtqjoN+F30qwplHta+HKQxxYXbhyAOFrteosr46j/3jvwUMzDp5OsZYet+GF373VYo 4Q7Svdn82zVGjZJvPdlr3hQ9MoeLuCNCfkUUhiRVzNiz05bRNd36O2CFYVCwGiN50q27H9Fh eIDd9Q5uSm3crES+ENEW8to3Pxl8ApUzH1QzO9OQGMw1PdW1bWIvAY2vACI7bkrvfo0wCHtP qMK7veFr8G5vdw6pT47KOa9yeOIUWi0vgrHKmht6+HD4oGm2xfRFM+j1cJen+pLvawoaIOxv p3rV72GcVXqWjOlpiQjbqfflD2CGnrQd4tnCunJjO5xLuDus2Z+2ckX2pSxnGdjHkxWgQJv4 hWEuKzPSR+VM7/uM7ygRe7Ndh8BSHyGZMrxJ0uOvZVpQ168uTzlPxPvTi6JhNkHnchYjeLM3 iOP5XVkGSX5ve/sKz23+pk5tZH6COGBvNch+R3KhzNKAhncU5EK1/Rl3VgUa3lcD9GBjhzPn NouNpyEo6MfX6UBTCR9asLhbEYC8A21KFzWFZ2o4b67QEOLPq2tJlDJb6DPXvN9QA9gwzjNs H0fHgLZht6gHUvqYMaIaIwoWFSpBqFldhje5lMxyt5coMVDxaTVC/TO5/6CxQhC/2xf0p3WS hd+9fAQSjnPPUidCoP/5HurskgG1eHJEaPRef49q/i0Ds4FE5prRb55minvKGoTRXgpH6hK5 t/7en0iyR3/obAJf4AiqgA/6+SA0f9gnMjPVCXc+xj2OQZ8JfjkC4YPan5eHhgcnpqKRGvmS sLgQGisba41esq7uYocvNJ6C4NlvwOalyxYX30TWZQX0ZXoVF2GFvZdOW7IdpHy6MonMthc6 HZFeuv7nNPpRc+1535w6pkSf+FdmaqqIONpD8MrUFKwbwtc4bgPxlx+K8tVfw6G6BRHuTMNi ZjWRxWFtq4PGgl5BnZrcOgy3/GaOGqNFltbaYsFbVdNC9su/MQ2uwATF7eziqhglM406tc0P 0cOnsBVRFx6H1YUIxyIFvHvXsmSgvgISMfd1qkC/rwIe0RbGwdpCvWQy9gK6yyTikkmOvkZt OufNCCAHqtCOQ/FzG2bxGczdD0vTM5Dtsz0IHELuYiHU1nvvlPlaSe6NW7fh5G+7k99eVTCA 2UK7Xw8meUId6jtxG4MKSBSVYwpBcdU6tTI7nFZv8fO1xqPoeIv/fbmgVUS8DvZyeQoGO4Bd lXIAS9+fLuRBs6SbAboDpMSrMabvvhuBZgk1dUb4SxDUYqLGUPh0tCsF/SmmR2Ng8bsjEZiq z7QpjUaiVg2Eq6uDIVxteRyYPgD+ahyVYy4kb04Tv8TvgQHmkqaJXyJs2cXbchinnOQNSjmF uQypEEMIfe+/7WedwyiudAdKjbeN166t3bla6sOn9TUciWxnrhGwKh2fhg55jiJ+Tym+/ffX 7/+6GKgITWOJzLGsHbCXM/zvLEFMjDx2sQOKivX0TWs4N/58swca6QuWPYOJcrK2/4BTLjI8 EFk0EwRU4LG6c0P8Rl1GN5vUV0swgdqWY+dho1Ut4r0SEB9sFTWHz8mG2p+rKcjKJTm88Ehq oQGXYUTvXltrbMSk8/hN0KBRXajVW6W5rne0jqzw6VKH+GdV2IGTpn+nKXCaBMJ90xUJVrdu /WEoG5XT2Q791+2rL/txdnGJrESmkdG4GmNyHcbUW4cgJxM68h7LJS6wiOPCVmLQTy+P2pRT D5VSHReVwGT0vFv5+Z9fGg48MmrPoGzfXBy8E+wBEYcWLSrHj28kC+QlY+qMEDqqJ3Sq5g/N 1RPqvtv6GF4CgQKaAkxctQRUrqs6LxRE+YZnUOtU6ElZiU8+JLgJt6dknLQsmb11gt64C42l PL7suKXo8Qw/V0xQbZDkVo2/cgWpdNT7fcv+rOFAH1m9JZ0aBoya0IhCaNYZWcRtbrNo/4Qo jufRPqEmYV+0IUB8yiF5QtBkEfQYmLCekEDJYex2OmXhjG/XOld1AmzbvyCjmuky9ndegPXN 19Jtbu2WGHqwdQRvg7OwlxgqXUGTj5eU4X2y8ODORzFNJggqLF4n6Araxb6ap+iSz3nnpynY F71aNKQKrK2RNFyzNooQKjeXykTkhafsnhT4+brf0SHT8q5PP8sKnkA2rIDDiFiKKdNbqw9W 6moKoNF8BRynwchVnsaCLQLK+Pn5YGA49Kxgys95Rbwd+5a8KmH8aHD4x0cXmJNLucQKlWvi jO/XTojV5cQ+OE4DuUQtr+Gg/YntCcjnFdUysVZTFy6FrAgDqFMREC8zbFZjPHLVGR8X6y/P 8HGXgml+X3SnIaeqnrG94jHz4XlorILeMi9eBiVbWGcUHlz3dtnLxKzEFdCpeNMOYf4VJfEO ExwGz/StW9Pbs3foAJ7PAVEQ4jtwOGq4z923u1KdoA5h8oI1KCaHiZfAQN6ACdOJUAGzzy+X i0289skPJW7pXS0SPo4CL4819DYDPuq3QV9oCandEJxa1UF74ofOsvvsYFJqn/iK+QC3i2PV jCiaE69slUNbFufkSbeaYtKFcukajuSm51SmNF7MS+UQI/0ETEHb26wticwzCY4/A5WX4OoC g2EnFj8wSHGssCpx/+jKN4ivDnLBhcItbXGQYaaitkARTv95/1OVjmAXNCccheeEJYCSvrFs oqv6Cx6Qj3tPCjR+BsIrwEdrlGmtKViEyfnKPXfBULF57ScxVcMHiCvYuDtfEVc0GOYkUbw0 BRuboR+jGjB4fdwjh/KuvStMhP3aV4Mc3UuK+CqS7imSbtpSl340fPe9ADHJ9L7jjC/2Wx35 fm99nFVgEUtPf1ONkRx9Rzyu5bRVDsnh1ZVks+OWC4AslcLKt37hJJVXBC4E3Nju+yQaxtSm KO3DEyjJBnoUDuKeJNQAvqGhNzl38xRKMEtvthpIyMJpUNrVrh9vEwOcgRKsAivc4SNhkG3H VmxZu0YJpVUe0UScWPpYLmzd7fCK7zsmmgfVQ6ZcyzaPXJ5Pcvjr3tmW49DJA9E5gAZkn8Ts UyVE/rZ2RTYao4r/DsQ/uU2PAsB0d0mc1apNzvidX5FQHCBFdnxfAo12b3G1lZa4NzADSiqP rBjupYPEPckOHxPaolVuKZznDkc+pegI3FNToYf+olhLcElu1/1z4a2roJk4SJylW+JcZnkr 7FAhNm8nuH8A/ae0tIczo5rIWD+5wqC7ZfSeCoY0kxR9AE1yH4Yl7VD/WA4hJWf2o/HrNfxt l4/P7T/hsJVVpqc0tzl9DcHMtC7quS4jlUDYczd6MjRq0svWKNJdu9Nvvjh575ilhzTUrC0k w0upAa5lVmQRMVi+hEPPSpTc0kXtkY41h04rvYZfpIg3wYT/SurDAq5JeznCNTlmOQHcW2Pd eS1JlOL4ZArHKN/vYUX5yIvIEN2RhZuAdhCv9g0FuLargekoXgx/CoVk2xOZrlTOxKNHV72Z hZXEQWJf1ScL83K0AENwb8t/KifAfo4Tc/7Is84sIIP6Ag1tMr6iznDI95DgNrfHeA/CPgdI MweYiNOp7k9vbY+a1iv9GLptNOFpndNOp3JzdSK36SxV99WT3exVGAUHVOGerEkYzxORSwjj XZVs21L8gi17uAfQHpH9j+Z0QdR8hQiL/5jA/DTjhxrOh4x+wnTouq2hDiHqNZzT5oPUTunY NQj5NAk7Hh4sYdDWKAAwGrBP12EKM8Td6a/yP4Cj8D7rRda46QmHjGy02ByzXAMGrCo/4c5k SuHzEAUIG52k6qacIugth6rk/1L+rXubWFOJlsp+WM/9GyCYZ1rJU1+p0I92Aqaex9YnpEAF TDAgAeylcpRs2U3+QvL8bQ9Azq+hCY+/hclZLsMzi94x2IkeUgVwSGdVE3A4YVofyxEOJwS3 TRudeaHKwJi5O7A+tmJy0PoV9I1W9xcQ2SqgUn1BQbXZ7zocQOUol7qrYzzu1e8KVEarVCqw Y1ggaqZXcEe2vwJr6Nt+PnYRtoG7AGxy7KrjdMjGFD/IducJlSO56tiHZ4FWYrQh90kEayTv mr3SyLgviGsVkTdhTLesNzLXluEl8z/WlXkuU6Y9XbVKWY42UbtUKxpcdoI7ixxwvv9y5xWR 6TofEnTQNLoaqi7SnHCP+n98ArLDqtVQsQTSnMwrYSXCNhHZjzscIiQrTMqLutBmEXMBTtaF IOVVxaGhDjX9WqNiEIsBB9B9tzgdUHUjM7zZRhvyXAIBGzPWSqPnMgTscV0znuKAWl3Z3zRH OlHirg1NT64xd6bqioOijcWloxp6gpQ/a40cuLfKX0Po4uTCcZiUui86GhpkdmkBRmrFLkod +XDDi2JvwoUy/iWsz2jGoaAqQJ3h2azFcHVleJWTv/ZeAZmEaRMLV4ehS+4jv4CyvJWb702S IoA9uqoyvTeaT6eyXM7eaV0r0WEPoaTqohHrSuA1DrXVs6SAAwH7Q2rPM0XPkheOf8ttjlk6 9fHZAvR9x0lHgsCQHIYgUL6hZ1n1qqMvQnLEKgrDRrqmD1Hipbu8rIhIOldKMpGQdfg9nV/E SZfdC812gSDUifUQmzd8dfm433yTmVfFQ/r6Y45nDkNmjrhv37nbrd9L7INDch/EBtKKdOEw Qjgq8Y0MrwLOyX1kmBAv3itlWP51U5FFimQmURzihyFwDiv7muOhqndjy1DwICiE/y3mcxiZ n3gHXU0kgWhY0IY67Q7BdynOvPVthg3q5ure8g3LBDfnrKQHYmsVtuFk0P6zZlYzMbGKBPKV 4DO6D/B73E5VJX0y02dnZp7GtWgKbvlwITwp1BQ8TgIgDqzyCvKtV87jLsJa4pb8n4R8nnqT LXrdGTf3rVrZimjagMe8NdqS9riyjYztwVNZ+ewGSV3ivBNIiE23eVrUVc1/vLYAXVeHSsDU UwR31/7mW08e/ZBZ90T86Hc5IwL06KpQomofoLJ8qUN/272nfykmWBU2YdBLAZR0VCgBvVsf dwh90XdLZIO6LK9U8V06MgqL1oBT3KdkuD19fsQRk0w7qE2dm6BJ/sVcgNSASbM32rDBmG6D 8+Kmn7a8BsTXTz2A6622N1OVoF38ZLk4kBQPiA1S0DkVOe08e+45mpsLtScvrwDHwx8Ny/ys ozl9jpTphyPzeHSoRNzAIeatiUxOWGjleaxPEAxtX5w4a6mXBqzBFkXwgrXRVnVkJuWi3JlX tgIqcoGhEbPI6cbGamoifBknUSLPbYb5Oydq+Vv8uekV7JG6SK8zvolHLEbKI9C3IAExCwsh qg53q4T4lYDNkF++xmM7zqw4va2hNZaq+9Jub/8SjGjH/1LyNdep2Z9gZdgcl+F9H9UYgmYC QmAhCQkjFOT7CYfuJ31iAiXbF/q+UPmhaRm6Tvd8PcG3tBMwLQBMRtToe2fAR8vuzc4SbclS aiLfBWmE66MaghFG7zxaORzgdBlQC5ELphOXQrmLsQ8hpHqNXs331uQSKZF2BYnMxd8tPgcI PD5JqDw9oaf0DHIJC73Nv0L1d3s9L4z/Rt+Zp9/wJiaxvqWG83SkKb/R0MDM0Mh0yyaDDS/m CtV7shL9rimUvIurEO2sxx889ztpIxBffqFTlypeYODCvuWqAwGctAS/lWFo1ECsKc0S6KC1 T1v1ezrjPdgK2gLhI47GcBcxGMgkbmwchh5lrDpABQMX7c59JPZt352sB1YHDZiXV4g4G3a+ J+4JhxRwz1/xZQ30b0Ew4Wm2L2kLuj2MAyvpQ9o+Iw+m2AXAZCOvH1H0pX5PP5q3dHfw5sVg W2qZBk7636USSSTdmL3A+ur8Jx4YpODvvB5oBWYDCHd2EwH1JECUrjwXOqEurQbmIqqHdKzF /5D0BdVcjLoTwhUfk9XHgNWQviBHrOkbtBihLgTcVH2Mlv4TYikxc8MIU8B3Aygv1EGiZA8c cxFANSLi5N7/3KmIftVFqtKbWApJlGx7N/bhK6T4No9UqZOWCWAzlSMiV9qDLyHuOzx+CbiA NFWgTfTa4h7tH/KKDvnY+WTp8nG5oUudxugnDs4u5yy6+eX5SRQPu3+T8z36JP/06rbLE4C2 cw+bF6gYBzWO72mH7uI6xxfUJ6PxYjjpWWnER2Pr2bWcznSIHgFLK5fDWuMeKeZ4wps5e3aX LRDxN2K4mS9ftsGLS6Jj3PXhEsI2tuKo3TIBsCkHBUgTmDFrCrbYaQpSFLuVRc3vGTeBsZCS pqAjWrHrsyoQGQrIC7jEdS5sY8MyXJ3aOkxa+NrS5lPztXpTscInLWqMRZOvum+JM1ljFwPu +Kih0Hwxh3ShzPi4M28b37BkWG9/DkNKQ9IUsIS/0qaSB8dSHX61JKE8VALbGMI6+eDG9GCW I2mmZ5z+Qtz3dvDPK2I2qjc1ibI/9wGImPLIodaZ+j8SkXiHoRn1gI04Jdf4miLv1shZPQVa b3CGTb6vb7dSqjKII9ycCkJtj5POPFGdwUuoBdjwcGvah4SkayTKwSRQLko2CanrpfHzgP+N 5DjFcW+Ma4gDM4vvHVZwBlDfv+xVhD17q4oXlOyoKubqiDHJurNfZg+6fkzQ0YPxQ8IZqFAT vDL7Ali6HxJWv/7xqa7l5V5wvbTwWvxX5H3WRiNK9WT5EUJr47kVaGV6SEPE6BtqOaNmaQEK dJIzms1zGyDTWxtM0r8k+SS3bYUTYGvSjnHcDWV4BYFSPuv4f/yhSeH8JNGQzGSt4Kb7026K yNa4zveMjuXiNSRsFhZhS7Xl3qpaa66eQ/JEA3ne1HBu325Of/fOD5rRJza1ZjRNaXWHqAog tJikNHOZWlnak2yNg/AFMBLWOCRBhRmpzL/sVpqgZzPWDCFAbK+PXUFPcGNvBwNCuPIh7nLs w0uWOIzHaVKAlUm8vJA8MEnlWMGaiKhU/QqVu2X8qfjxMlPxIT9mOfSlNOJTDqOteKrP7fhB fWCkqkwvom6aiKrlXFRR4R7FWr6ORmxV3L1yX7lrn7Z855s4k7wDcpps2SkVaxXDgJM2uNvZ iIkgadtw83MYVzVBb5KlJwXXnbGasshhjIZUiFxxjO8xV0qbWVSjOMtn+uVgi+yq1ttoqH4/ 3yOvIyuoFTCOEc4Sojx30wa8h5WnuTJgzPs3GV8+EVd1dMxewmCqXgfQkuARCFz6OUbY3mUu iZGjV/AAozT/D6QhBUbYvsLLlzBzvexUk6l93P5lcbFWDYYu0af2s7HAk+RfOpFraXoK08ss iDnmTWAW6R/tR82dYAI8iI42kvGJNFfPWAHOcqsru9Cf5ehNohismYI5PAUKJQlOD0iSILED oKhHX6CobJJjmeVZCrf5eKNOSTIEFnRkeOXmp8u9xS+LFbobuJALNlRsvmGHJgjkiTQXEYU3 bevxY6vOcQ2wSVKoTYodj59/qJRXQ0wk9emETWllV/1AMRKSr7RPT2wTfyScvwZjp6po7u0K hqawIIRFcm0kJlJ1pemHUsRy85MH4wyukLRTG38QfAMI3mimuwuDCQ0y575HLFIq2mqSIHRf WPWxZpKZ1oNO56BQITZ4R4FPVQYi31WGzVHCqqL5/Dgq62j9PdIy8GWUaEnt/T/ONiu856nY 63fa8yLHYdWInhqh03lm03L8K1o+Vuu5ByQViZrk/xDyHcea3du5IXAx8uwY4Mze2c1NMf/0 Uw5Av9GBvhEuEbYnfbhNF6DpuRJ2DM8laQtK1wsW0KhAjrpAnUEGsLQSvok05xLjZPDdBNe4 ccnuk+Laj9+AkExD328dTTiYpimsWEFf+QvSqtSBH5BOQed6AQYEof0P6Z61xY1yU/Rvvgpo pwnUvpAT1AA0Aw4CYOdc2IeXi5qlkigHQqS7rIBTwt8aFWVFRoNOSemd0TeWkuMOcZbuzalm o+gaD1zbJynSN7vVcjLD0lh75kj2hrYYhxwG4u0r4FrCJd1mB7gkbYoHbOr76rGR6PRh+doW 3Tr32M5wTU2veqrulh86Q6avlgwfeOK1RRoTvAYWQRjxMS9/I4JAq9s7JBpA6Fta5h5SqJC8 zANwRYVkk+jGYX3xLjh2LQAG6wTP6kNAokPVZRLTjqsoUN8gWEyLVEUCb1lavUHkQH9+afqG +A8f/Ofoyg9LDD0PoFVU3P489JE59FOMklL1ORWLQ+Hnp6LjuwmGBHRtDv0h8t9EXfpzYUa2 xYebI5OfiVIlUWumoDrZ9fjzuyH42tQZyOWtuaH6p6BZEbMIB8DTWb3/1uwNXxa/BrgmMFee wLXowN4f7e808z4k4OWpR91GE/Ku+uX9yHV3Ba42o4jPl8RKE+4C6IcdBTmBHVi0DRmZYNL6 b4jITsAD/iJQRdgZqYNE9w7O8lJiUbYTCV20zMP4lo20L67hkJxyGHZZ1ICoWV1E0C6uux80 NBP+enVzpH4gc+iTK3QGWpGrJ5cmct833ObW+w1D7z4/9vSn6VjjPJiDE+KY3Mtq2KQSEC2g nkzpA4PRRWgweq8EQi9MqvkNlZPwUkvutkcejhA5wOY/L+oCW/IxgKGwPjabOeVi6s4acJQB 0dS7PlaBfulGDiMHuNhd5Q66i5r3bF4ylAvByaHVSEzg4TMRnrrSNJ0N8U+fbgcUSvsIteBi 8fQrL/M+wjYP71jJDQ2IsNXT1wOaqZjncASTRw0n7W314A2rel4VEBAYsIyqy1PszVM18yqA JeHmnc9IChL9qf8Q7P2ptDFm5g25D66cxMry0chmUSNO2hMsodNtrmVd82DderZhxKEUj8Cl t1ih8AyVU3/N4wTW576KI1hZoxE5ULmtpvb9XebQ+HZZWmZa+koTc/UGycIUyiZU5MA3zPFU ZWbhM+aZq98wJ4e8kf6kDqgAxvF4iRJbO1zPCu8jcHa7sjrBLBh22T8SgRIWcLtM54QEajnz JttGBww84d6kqyZZ+Bjq9R+SPzVKjtn5eU/9INGBBwm3MeOIqnydH6sLiMo5d2lb23Ry1Bna zJ6MBgw3lwiE5drdtIeZM9Q42MJLS/Cvir3OI++E6dCz3ANCxo5TOREO/xA7MJgKUVHDZTNo JguY3QP+8dDfJQ6AfJv47VuQt1zDcJQfUtrJneieA5cSj5NYMb8c8TlolQ5TSocIQrLFR5Mf O6oKUAIKGDtT/rUjMUXLazifsm9w52Nb4XRAfRbC6fmKXo/5okDeBL1U+c0H0Fo0BWy2nuOp 6bQKcIHRDGy946h9es9uT3yHfXhxTk8CHK++av6t9r7e/qiNvFXKkXVqDZixj8wj14uraoOS Hhofx945r0JsNUNfuxLsX8GOKtGBLuwDynO0D2e+q6ay1vbByYF8Q5czVN3HdoF6ypgqYFgn ZYsz23THe7uUz5fCPWZRgXTYzNEGfSqdLxke+s4WlUMM2KoubNUUnjFXv2k11fQy1UKCtlFG 0xSzLImpW+ibWNYC1enZFhWuTLNmK05+rENsLkCpG0Sdw/905nn+Q7r36O3ROo7V67NgsLRn wNkEgMSUIEdLuj/losaIm/bt+lZc/I8d09hFlHfRFoRGO4rtT3QE/X/teHqOZmkKjLjEQYGu RCSXfdBaXKoApwX24vJxX1SyW54aEnX4gD9wmJPrhJMCgwJ3s03Pk6LytJ+UagigEXbCGJow tVOY5jvjSKxZEQQsJJ+j1GMMkKfQXeE8TDJQLsHYiHQF3jrbaAreObMnR7ipFhAURWMCASrK 88gr2DkbE2hVyvPvz4297ri3igzbnhQ91PfvXyYeKO01Xtuoxkz90dg82tMTdE/UTCNCU7/L KISPNtZwZODo4yRKsNn+kErpcilgCMEMUSfI3Wl21YYjzI3bMOGlpD68UfwJGBYNzT8diTIR 3DYjwoclrmxTOBvwK5LxjgRePdAxX4KAkPZZxN7E0RuRi2OAUryYb33iDInVkW0/TzwE/I5Y IrzVEejp31Q1S5XbOpK4h3urBKbhJFNZo+6i9InmNpBU+36bhhKgia6fwUDmOJA+YACMJSsG 9gLWE/qx1mDh/FU1nsWWecPzcdJyIBUwGRrWm/jQ4VQSpwLeLov56ecjh45CsOjrSrzYgYNT aOIy9BitcYeIw1qCLRGgBHOhF0oPzh+QgaZh0EY4nLsH/QMrdnMVL3Rqpi76BnsCyE6Bcjzf 3ZaTlECmY/P4SNAbk8df93bwvvhKCPe+G1j7xJyZRGmlGpJjznaqNtxba1mMNBZM+YfKPzCG 1v6QMAGomxqNxAsJlMLnw7eJH7ugcvS+UW9aHjO4ZpZ6isQFjlkB0ckSa6hb8bJjYoblZmbP TUisRcllUsuPe7yMATsGXgR0Pxq9VJO87fL9RT/mpvsrBn9Np/dZRE7L9NLHhAeqMfYAg41n sVifBpVNrYgNI9BdA+L/v6n1NjrjC/ysbVTrYD9V71BKCViTQk1s/jfm6grRvO4RObDpU0u3 ScC2nAYxeWZ3xlWeE2HNOSkNRM9UvWfVwanZcH1agEIr0MTwdoBI66eeyyCTGlFflLiNxSFy yQ5w93oCuhfRkq2YYGkPAINiuo2Pe60srehygVSZ+BN/z54xQzn18tdJcybwd3c93rvCEyjZ kyNfiZ6pSruimbZlQnKQJJWjhWTaanGJU/eB51/e0QFp2sTwADUaI/5VtgNqky3XPdYq+lnM HJ15YaRtAgi6OUg+yADGPIXfvbRW3R9h1V2i+voLEYSBsWqdWogUVGnuDoZqu+aQ+gqmjO07 BDqjKLyGTlN0qrhz8cqc6nmXrFUDYCVEjzs+h7FyWBXC18Bj0nL3jA5CgrqexB7RmvYAW8no UakMNLIJ+mXpqLn44cPhV0BiIGdREiXO9EKIujQWpDMPV4MrjdvStEsjQnLLANRLH2xtateh +gMbAvcXpSdbZijkZajowRpYf7yCDZ/HIxq8tfPgKAG+psDqbNWEOvbhSTQi0GlUjTDOGtgz hcapArFC2t8IpkutVYN6l11RMDD2O6QnjzltWS3Di1kDyNIP2KSA7UbxFW13HYHogccPnKJ2 zVD159Gmpf5FmteUqlt3BmpBwc2nLJ+iEUtiWV7OjULTHWzj3AybJmPjqwDX6XKJhyTOD+wV //bQJ2ti1tipjl5VMAALvGt+PkcP+ryIs7obuuCloy+psYZTIE4OHB42S91jOkstRUIDM0d5 /Jy7v4x1i4ub5etUVExeJOvD1BR2fX5X03DcWrXArZ732nJP0Oc6Vo2RXRHzHC055J3ISVXa DJo53XXAxP/YNozVZY1beMq2FSukXiT1reQ260epDCPG8fDHZ0BTlIK2YMieGxoaQV2ZQ8pI X7l0N5ufS4pvW5YpdfKYWKPXdGvkLDtmT1hB5OebpIDWZKg/4TnuZgys8K0H0qOmCaJ7S2Kv 9xWrTSHRHWhS/e/xVlMTVwo4AwJB+/FaI5BvgG8zLPktlyHnLT+0m7C2xshpQjrWEGzjjcoT mXFefYUKtCQOkeJpByhBsrRele/P+yYuUqBVOLKhkfNnxUXRC4Z3ik/Fsd8Xz8Cm1VBdtlZV QlKWHOrxhAIy/UOELZl8Ldt82JsU2VvJVewe1hEsoZ0Aq3lZ2tEcWyNzJr+Jf9VlsUnNbN+a FDGX8xnMtveLn1bNDgsmMtfzjeTA0iNV6TFD15mXC5ikb8ENUTLqhaopkI040X1r3Ymvacgr 7hhhqol9+VD3Up451bGIjpbTmbtNG1QCjbWPd9Tjw/zN1Z+lXbda8nurhsQ+K5w0rcgAiBdN QTpFoZDsLUHVMMCkhe2BWRKPixQHJ2st0KUm+KaAJ/E/JXoaa8P0Su+j6zuWiFy4Qkgejq9l wq+LaM7rYrEWjq8dUHGqj63wy4m0LULumBpc2XXW68Aa77CmYF3v8/q+x8DT3tcofoPReLoN ko6ukbeAelca6GRXeEJAcXIsdYMFKmKZR5PU+KpkXIae0BmXRXHSRAQQBQsarHEcEotTmetq g4t0k/K58R8CvcmlpcQFFp7lKHVznkT/8a9q9OyA6XykG9jyVTpyrIyNn9cGOqZQnLR9fpAc 22m1tKpVUWIf2PRBnYjo/UqH0LKeyrngqk64U24AGEn9Hcw02P8C3Q78n3R6h/K7XS5sh1vS hdmWBAshYHZEC2BHvFp935f1eD7qywBcBb6ZoaFeNH/RHu/GViCqZqjnG0XYng/v7WZ32Ik1 eo42uIWOElSndBsMWKUC4QOiFw/DyvDMPu3rspupWd+A5fT/p0pvnzuq0hs0ex3yKA4sV2Rk 8FUworI2iX+qi5/r1JVBD/KYUxst1L8qGY/JYcSZNoWoL1r92gYnMtFEIgI9AK+K9AGOCLRD IgK9kIhAGZ7FuFUX4iEEf/94JCeQyayV4nhCI1qRpvDpc4kajkTWX9yrJ4CBz5iQDE2naveb 6tSKbzfSscIPCaeBg8GImT8sjDiviC/zsCbiqqKTJVbL4Hs8k2egyjxMmC0IFFPqWAPum9Gs uItkem/P9khxzC0z23y3M36tFNTOrfzmBWqvQkOYwm4rcZszo6qGfp0tV9nACeUr2r0jK19y ayTX7CICcu+KVcrZl9L/lOFBZ3/Ilwv/zYpz/mYaYOh9Idw75sw+HHqzbB2wPz5HZVl1YwLv 9P5TWH43BeuTHai4LDsJWDrNke4t+2jzQMxEhgmWyl92srwfuRqN6VdBoGeoXZjeb/eRuyee CfRrJm2I19HZLiXMByYK45nFu6e+m+3a6v9c/EFlDuTEN66xVVV5m7ufrpzK9cJulp8r2pOp AqmWV6icECE57AOr9tzs87gqez2fA8ERby3Bs/vJYuuTpYc3d4eo7oKv/P9Vupen10vQZbTP V+t1qfrl08DMQ4HGJrpYDdFeXFy1IJUCU+YhNIFacl1VKDFpm/wM+hXn/ta0KmCY90dpev8+ o3+4nhDVGJPztzXoGFxRY5RV84+WLqdy9ozliGDHAXQ+BqwJ7vFeWWDB6PIxIa/9UO3NJtXj B4v98mBOefGD6RuEjunfn/y4ZRVm+z+9TwKTmCzoVUtJYfat4BKdIq/bQFirr+zu3rFts5PD zpkU9n+R7aV86LQYVQILI0UZ0HLvEJkeM2qHgcAzliXu4xcGSFNIFAl8KhZgmsq79ASBcGIW qifPgYZtrm+Z1ecUyqvAvuzvlY9y3bAPE8Ct0wHwu4QsH3eUGGontN0FMmRXXUYLNMGupXAe dMpN3iZuAYMnwvZ7XDQi1V48UTD7J9SjYRZlGT0UbYf44VJDOGupNIfB0ZD0+GgdXak/8OxI J/Hp2SqSnkSHFUyi4JB1CQ7JmoSWxjq1tQX5HsKTWGF21OD7gpmdwTwJe1XQ0nqGUB+UG7Bm YrafqfFSgheLiKRnYyQ/+LLZvRTvWlrskYdYa+5rSGYWAqTvcveHsaDZd7sS1pvnAr7c48/v SpyBV6VsMuVZuMFU977+eZgD/9RHuKH6CGDRpKVA20DlPH3GVqJtDvt/jF19PFT5295mKVEb YSx6GS95Vy2pFUpCVLR5mWEMKmLNhG2ERDSVVKTxnvetlBhzCh1MhJZqjKhkTIZSmaFChETE c74zGLvP/n7P899+9o9xOuf+3td93d/7vi4+AvIOkWk7xYY9atInNs7n0T8lhJLeAdocA4Go 2+Etkh9G42x0eYLuZaF8ySypQpCoEF3yq2RDJulwSEsv+d3soNAclhltQBW8xo7Ig6ul6l8X vJtPl/+fW33qnzSjoO0BYC/Ic9ms8omRLqr9tioYATjo9xDJ16764UkSmTD3+0mVEdv5DysS VhX0BMF+QYthSWG49dSscyBShY+S7WoqekjReb7qATt/4Cgv+a8LfYM/qlLbOOuiZoeFwD8j fXafwnjWM1CIaStBDlOMub6N83PQ3yRPjgGt1PDpRP7cgCVQu5ydCtogOdGGcPDM7PUOEIxU xxMfchsvy4LuX/wypNJrYN/TA1cK60/I2Nx25XVPaCIcdUaflTurJAGGEEUoFft0YmricWd6 JYhjQ0dZa0Yq1kxtKzBjFwiyMhcZPDNcmS/7C0eSUgLa23O75vRMK4/g/Gw0s/hzwwdFeQrB veNlJxcrw1yxpF1N5mDXetzkYODJyaGgBR8zAAl02NMZaurTAisrzyTbW18+e6MlUJzk78iN vWgGpBYtoLbsT5eSaauf6ZEbQ9VmlOZLDlPTf0ihDF62uEaI/S5Wu7w+2twP9Aw3b1QXzHz4 HfZ3byMu+ttaX8zMoR7J+fd5SkPoxxR7weL1LYLyGqX3gwNHr1EH6AgBIQkGDXtQUOl/hi0E EMVlKU9sxMgzZ/C0lJUUnolQtEmYLa7+fVY1SYGzis9tbmIZpbdlTK2bxlMHqhg3U35rdi3t j68lSIsd2vGPxXPRZp/ZqML63LkrcQQeLghtmJ7o7Ci7CCQ8TwsarICB3avX4qmd7Ix7+OBK 7FnzsFkLpuqrxc9JaG0rKCSeMJBWrTlxef6b1NYB+djrhMkxu0ukhe4ThYLJRCh+bPN9guyO EElwgf+FkXEFTFoLWoRESsRhBNR6ncTI7niM4WArfuCRj0xXH3HFiHN9/ny9vkhCbOnx/Uxw T4U9b1G4Mko+2tREHwvpg8ZgwtsHka5QsPBeVb9HbVGa501wgOvqhYt9WHDBQ/dfnW0ANNM8 twg84PzJ8Oz+3lPVJtUHG6ynl85DgpYUqo3cJO+tkExqvhtCjgCFaeksrmnx8Qos2MCsL8i1 WGMexKwhbNpuo7ML7QHLAnlE44EHWH2qJ/tWyEAcsRpGULNkHNujKgqePf8Q/Q63lyMD7yBw axW/bPluXW8u2JiI/XK89mGazL9voneoUeXGKruip6LmE+pv5+aNlwT7d3XJ4Hrledu3loDo iLG7hR+X0qmHj33rdXhnKeRhTO5WgUyKaKVvoioRtA2VZZgGUxo9ifOPbP4z5ZmfPh5MMy2E ryQ/uhwfn9XcSNAVCEGCtJa7R6xkE4O7hgzfGTSdFprrzCpbmEEffm1dke9r+dp3qbXKimwt bx+S4y4VhR6gNPlYoIDjiZSi8SqVYCFNkQUv2fpxpPiX/7KIfmh09ZMbIn73u7BEm20Gzs4G 1VwjBDX/+ct2m6AJ6fFK4QBrFtpGFjA5rHY/7l/3+latyc3K4Te7MzLARX3j0D38KE51RkRg kmVmr2rVBOLTHxQ/a3OUlK0YY6uA/8CzkReyYMZYAFI6DG6Nyryd0vu75oXl7Ijo79Wu9Ljq CxWzFk2Cx5cWyiOHfMQBvG0/IFynqI+X6XxpJv2slHtpDpS68VDZnbsl96onQiqlKU4kI18s UiJUu16C8cxyDNgLm3tM3X9Z97MUoFFE0eU/v208sSLGYxsK9Rns+wjMA58WkpCMpYcb2YXp lZSxUQP+7FnzKl1z7oGEmkTG+vknfwPa4UKfJYmS1UAQ5PVNgE01Bym6kSID9m+vwKxq9QbD aVGuU78s7PLFX86TBwCdT8hM0uKd7TC8Jrh0XTNa9TTmcdrftvzww9UFDLX5C66kf4EjIBWL 5nMLhZ4T+C9xL/cz7+E/DOH2M3V2Ue3kDKqvi+GmQ0FfLIIMn3ukIbBdx73yyxcnH4kQ6J/g nEuZZRcF+icFEnl+s+JcuiOk7Mq59gTGWGy0YozGgieUk0naBdHJfsvBx+ePvEgSCIEIVinU hPt9m2LVe93STUTF//pZNLpONUmnl4vzMxRmFyjSzy49HV6hOWecpAVEh4KV/mXbfDqG0PT9 WveMiEu5zKqkQlun1klOPLRU0Z+7cz2aQgI3U/ZyJe7lYNDvjhZv+9djcj1emN/aRFYTd823 7WNvqRpSBYYvPgEPLDGGKymdQFruhiXGa2Kg3kr0ty5qSp8H3Q6F4R6uZliQnQch6IR1SJ4v bzE/49j4FqPqZ+f6hQsVfvQiX4n1nyIX8KzW0f6pv1pKEmn+8jwi8lanTVb9MB8R6WCULSD6 SaFAfvWvqf5RodFEn3As9fKtr0FKPY5ANXNu+dxJxuaFHpkGhn8i4wn6DZ7PO4We73MTa7M+ E2ELV9CB8du5xXbCrskGjnd5qgUDW5aEUhh7Nm8LCBbQqyR49bzRonjhCvqrcFlKFcOVlz/d FWIVVXl0RNQhHPu/F/nMRiVqex+fBSbsG8c/C004vjg9JQb3BBux9VraVErx5ZaYyeBS5tmL 5uvX0xHEKrPEfB1bURIzXMZN9+uvqTK49L2rpjEkyyfhZZRm0I+iQhQYqXVqee9g9OwlaT4W tPs3CBQpY/J8LbUFlhXeHm8M1sYJ7QH/bQP9OxnuZAwfoAFB1Rp3TzXcSHXruO78Maf+/J+2 LOLJTZYqL1SZY9eoy5FDe2TNmzONaaeMaK+UKMtSBHOt05rZVwK1AsTmD77TJqFuSs3NBR4V g3drU8zUKeZiDlPorShXNzmKE6jujWUVKU8aPZYz8FZRQUHzr9xpsRCUxrDanFR1SePrJ6zP Ocu1aHG88SS/zaung2EgwWm23BEy46WnPz1X+yNQlkQirmAlnxjOZOt0K6dXigpbtGjFLyH0 ABhgFTgEzmKTzeU5h8CCONK+HJuPfZ+9ELK+cd1QAh+cdqky80KfBA6S6JfziG0c+QX1u06c sObaxILp5aA7uCee7N/PQcoMBrzK/hnhR7FP0aeMChXBTGqrYOIPzKp+GFi7SinBJwHhUoSQ DCsDk0oP0C60w2P4oXrfQvWbZ+J1+xtj528mfkBd0Fy4cb44mXTp0jVCeDx5wMNn0ba8qnmV rnDQkTrGI5JSCQO8TdfudG2hrZuuvDinFicQBPh3dyRWeOSbj58uI/FrwSfC1lBb6xEeUWdu u088ckNQoyggZ/WN/+7slzHYBE+abEAY1HHMnKnfWNE9639b8KvSxclWZnQ/GKOzp7s7hEqo wqOWPqdykp2zaq32jjIBl+tIRh45bzTO9KYvj3Jz8bYxFYn5OZ9C1zyTVx2c+QW/RlpfoasY A29Q488QBfhQo1CDPyRCnU6drBzsOtw561RaDpQRuMCF5fda31RFJEINZsVPklJp7icnvtnR 2Vn3lZpUa6bMHq+de84fUJ+Bb+sF8sDHj8PvgrZFTf8SqtEI74T/AVBzpkjKfHz6pZ8Izd+F Wt12VphchV2YF2YlWGUlxSSfBMCUnJtUO3SAYGT4McLv6P2q/bc9DztJWWO6J1LqnEWtRIlk e/AJcxIckkkjQc9ZcHKrxUVMJSiqJrPlx+/GgCtWKyYbqcBrLwkGVJnZXysn8WdPnkA/RzXg 6aO3N88pVoGj/wOorP4EfhihkvuZYVFyw5c6gN5xXbNUxLczgCtsZHBjH/Wkpqni+oQeSR08 Yi4bf0nCG1XtDQa85l5yh2ha9YJF5C/7bfYwUttfc4+dsCbwuUC2Szb6CAf8X43BfpsmCTO1 FZt3Dj34uvP/MPeLmqyM2z67YCbQWf0XcySTFkPyGTIYVCVGXF0O1FHwZvwsv8HeqSf55m+q Z6fQBWNN4/Wto0WWGByWs+WGuMMuTCkC4pYY2XH5RqF/kbARjEFi/JqbSmmhfMkzwxLMfqY2 e6FSCmmwb1lTr/mbNRIu1/G/QdiuNwIrhHycUSzyj7g1C1gDK6qbxq+Lotvv/2/qN6zLOW/x uu5J7S5TIPUh2EDPAAp2zLfCi/NgP4qeMzTmODO4yc9zW+eK+XL8VK3//wOvntypzd+mBa60 qLe13iwwS8qj77R8+Uool/Ivfn6Bk9fedS0oFoCI/xw4HQSzQsbqAt/1aPLADs0l26ZygNJk OjvHtKDwhNLcyt86jMjGT2e48UKm6F5Ift9CCjUTFe7LRcPDJwdmEnJPn9e/xsTooAyejpjG PtHCqNofHzXtmlEzDcc5by2wRy1HtbwK9cA4binItF+fGs7Gm3S4KbdJMjZuMTFD6oIs+RIr yRIzXfUU0pai1eNHt+ypfUF87WIXe8dfMk+ZZivpfYjBdWOxd0+/lpoVwgPnY8mifZB4HRzr DCnqenudfGXooBKINRp6Mb2YckXc4Z4OK7iSe2aVVF4qLRrNTHj+WU6KV/yErYVr7PZ4WC5i AC1q1FttLbqc1Lvgc3dioWCafAuNUKo47bxCZxDnlKzpDH2/VHN7Il26QhV1wQs+wsBrwAR/ 7yMWiVatKMa3EP+TXiQ31KQ2Tvd+h76u6I0prDvA4waaRbZnJTj6MUMKqFflDbCMzQamL7t8 ydb4db7qdy2sdTgsK+gVvLzdCXJPwL/xm9agWNLR+yit3gm4HQx8ri7uhZwNi73+ROi7yfk2 gHmBrM0q6CGdCpH9Xc+RSl84lpHpg4dSSGOBr2omOJu3K6PSNN7YGuGgHlcMaa+k906vJIGd 2SFKVk56pichVY75ZaO4QTlhoLdmhjWTdmVmSzHHu6Ar3WX7gnCdmYzKwcfioNU3nCBXXe8i Mh3hiDIppDSsmOlQ2cqhu/jdJTYDpSfYxES9dyxBI0wNzcS4qpMoU8Nf+soHu6KycqblCnpI RgF284cN+enfUNaQFZ3qi4P0M5xsHBmppOgi2jpfXlnh8ua+fRI/01NdIOQdxKnHLnucZDWm hesum5soA1J0i1Cv/9BfJz9cxYJxjBTSCh335vMdFVj0J8JkUk1GmJ5YQNapLdggtI02rlSb mr43OLhJVvuvzV7wLXEDLZyjVJ5GbIVq/059nMlPLPYxKNUEe50wgArdUC0/n8vlTBbto69z hlav+RR1vKa89P4HHY664C/qpEl+IFuzWKrEgVzlmaDMtRKUPbLIq7go7sBiK21ytWwEXkrh k4vjxMmsdbFICur/+lvb3FjED2JQwilNjsM50uDXvTq8ynKkNJHS8PU+cuz4Hxim4i8ppOVI IOBlh2o7bDE+lKkXZHjfTYJdGe27RDktQY98KXRLjqjBJreVYglrpJA8ayKNJyIiIkY/D5mf I1VuJYSXl927VgDC488ajhMEVwVETrxjoL052+hXyQMhkiuaP14TW/mY6ADdtHq5IkifquGa R8vfl2hl/UhdvCWZpijFaxv7iU+MjkziTYm6T11qB3j4Tb7qdLIdnUpr3NFsc4KP1xj5jU79 qnuLUHnL4s1koBQSv6nI76KZ8bUo420yLhjOaTnm9zN1l0vcB0ZsAyTVveCa0I5uoZ+t4Aii VKi/Ekyuk5vwKo+vY5mcHc0SBdRyK/8/1kSZ1yYRbfnEy+4MbhAOanvOfgUGHMnWjAwiHOiC keLdZPqJmhFuO2sdSYmGw46GUw8lJ+yKqJqHokd1OFhcqoJ/s00AnzvyaLFXdCsLjtnRfL5/ hKHbvowXN0U59ubqlr1IztlRct4Fo3tJfHj/l27kdCCH3P9kEClcQYpHZzQeFdrCC+YlDyyt L6K2s2DZdsaYbQjkp5PXoHgBr3K4ItWNoaHMyanIJjFUpg+e215A3VK0bfyogsqBuxlh8Gtt Qy+48uun9Nrp89gkOaa1HSWZbOQlmFIgwxcK0tsnHt7gO3tROmXo58RLDgRezAIGPLOXYUZi VW/xJ3R4zW09J64YGqhgmSpNArVNUsMLybDHU9oRCTXZEx4SnZhFgUXoDbjwZAdos3eilU8P mcUGt1hauEqjr8b2IkIgp4EEOYNlVGyxWy+v2CJyuIgaWIplFgv8EnOg5rEyrB2YLLq1pQ7+ +HGvxh0LIl8Jy1RuVZ661Qhi/gAlTjO2ggxj9XF9R/nERJRxDcYLNm1kR2aSoI2BClmzommC 4GlaOcTDf/vD3y2GhBxas1fZA4FcPBI1VTZvEspPm/9OSfZPzcHSEusjX0Fjd9tcMZkPUe0B iVbIOWrBY3D1KEYx437p5PSPaGbm/TOf52xFgf+erI0TqZ1l9KoilcDwoVPdH0m2T5VcYMFu V7f+emGP9NAj4jX2p48B8CgZLhtrhtbYgjUrwyCp2EYPBvfq0n6OHHOw68aSydH8qbWAiNn0 b+jp0CKJlkw4lkhgNUuGKbmo1GUlZA/o0wmyury/OvtHeeNX6ARDLDOVAPAr7dkyU96g9NDd jC3YF6pHMlGK6rF5yTS+H+VuGtfI/bGp0F1e+Nj7kRfCNcYyYTb/xlmWkVf0kaLb4dY6vK79 q6ZaG1eed8XcCP0rz3wbs9icyEDeNfLMDWiml+NZOwZ+/2tdV2CQPBsbYagLxCZn6KR9ARjD KU8hvSJGbzJWQ5hJ94gOZ/1kqNHlM7XyCGjQDjeyDQr4RDUv2US9a2gmu5zUp5xMezXlHisQ oJ694Tp3KoHkg7vUDz1/m9EPX3BT8UohtUkWGKvREw1X3rTAM3wQ3DKSb3lk4cAIebj7TP6k I+oCXj8H9SGF9oVBNkpD2TLwDZ3rXOf3CaXH3cRWxpAy3m5QmQ7p5j6olvOuZMH8Gw8n2j9o uzHa8lNIiZLpvvyM75Pj+2ZYPZ+lx71QOU5BfGKOeIm1I6ZPWSmzFdWuhEACmCO07yDDzoq0 w46YoEa2Ov6sd0JN8K7uXlEqOKT6pgA+zuc+f6jDIRLrJW353LWNS3PeKC09jtdf51rvB+Oa 9CGCnQMGYFZoX2a1+HAjLg01YZiKct1bLtUmdHsWAk6p2CGszWcLJd287QQpHQ7aCEyKIin7 Ts1TJ6hAfvgGklnZiYbkS6pn8qtXoqxpiqSAAAaeipoY9aOi0u3Qtnq4DgRjfAKdpzaJmsen wYnercOL+Vpp0pGpPNiGxbUinNpY7TnLaD8pkp/RXoGVCSDoSoVC7g25naZLxdbvrFWmGUsh IeXceTtZjrn35r17PbaJANYyQ/nEZlTY+xSabSX+SNGY59LXv7kYLDh/8iuHWvEOzcy3b6dj voYXth3hc6c69/7GaOtIIjCwzl/+HJ7+fhHja3nu56v4yV6DqMMjP0tMGS/aR7vhgjlc1DZU 9QH5j47Xx46FfB1b/rMUL3kP+iphQDLQzBQY0839lQkxU0aqASEpK6FWEsFM5N8jzYu7AnKM A2OsN/G0b4UG6hcp72184o8aruoMhM1p45IGiNuPFfn0EjXc2R77ez3DIpaIfvEHsWZQoamm kNauWOFdgS63iF+2fPRrBgtO5TRt8BzH2qyGnG/JD+c0DV1exoE+XD6ag0Z9mAU3NDOGgbZJ 0mthv9BsUFXzSkT5sdhYLZzJoP1fnAU3XRAFCfgJ8C3JwWFHDzbz4vJw0GGDFSd1eTN3LG5K La0mD4ithPG7GRm+lFW5EnrUmwT/8NDB79MP3j6+3u8yYOIFkyrUPicvqHJUKPVvuYoppAxJ Px2OBcgOHOjX8UVp6m9s4Twy/BgPYTnPxjtTaMHHgr+OrchxhcYmeI0cBNXqwiUG5xnPIgmC ApKmbZuZ+5qGQrHMpG6vGrJ/8OGw5z1xccirGKvMkiFFH7kVjp1sdYLMkFOvjbUhW68vMDn+ 8iEIdhu0jJT3jWLzbYWRq26a30yl0fmptALsJOQFH5fkBbvnmW5YkJQKkLwDTnuGZHqT4tIi aiSfK4UkO3gsr6d4kzdSGg8QKkmhUIJk2NGCB2rT1FPPiT0poflP4tifXlf6oibV8PoOkI8D ZtKOwT1rh3b1MEIzV+tRb5wI8n4lum27LTt0jqRdQF07FhJatplTx4Iv/Emml16/T+dH6Kob q0XdMj0+Lr70OPKIDO71ZDKskqRnYJjmCIX8ySc+1gwosmZwPWtIR0UNij+dJI6DFHhBfniy /Lanfb3kxAemE5TuZFNDbiq38Ikhsdnpew9Et5478suf+xkhOwoelM+oINEtjmYeLzmviyOd fPG6/VU3i60uTo486Bdm9JQMd/V8007JFO8TtWmkK/xQOYQ9ipBVERVBMSGETe4MflB3OxFA 2IwmAosp6mN9IUZ26ILAZNX+Ho6+/4CGa70LRvOpNk5NfPjmoP2UqSgJfBRbyc7gxUWkvOX6 ptP5OEabJZ/rLPlTTl8JCOIPfCIQ5TRDIrcRSL+h05BSqPn15IrJ9Xdm4rwTZnYjMfhtYSgn ncpvy5If3nQHSdM3jdUQroVnaBRQb5L9I54g7Ca4rBwus9lR5hudRx4oOXTm8XcZwDjKzT+6 IMmwY2/J+WLzc3xiGB4zcDgoW0HjqWiJDUy/fp0xZYTEyyMR2O6qglCYIgB+j77d882zmE54 +eZBlCVStlb1OmDW8lwwMEH/jjmXDBeJk096BYX74h4R8WdPRuxlKJXbLPjRmt2Y/UgdAj/V TiE5JnUjXKZyj4OK2/UU0uY6T4upQUfG2C7umSWe583fuei7Qam2+jhlxUyqtwxsDlW7u3W9 5KbWTkfoUaO+ZPBjFjZkli1S40T2fe7D3ZNvcYLo992DscylvtH9n45EqWGZOISPOTCwUAEV Kbltgoea0lSot9gOelQDhDswr759/kyIYp9dRCimpY66UGeEpBpenI1OHo3g5oHPys3OKUkh nbz/Knt1omRYJF9JvD1NRsVUY60Qv8okOhAStkm8pPpqsa0+lb6jhPmM+X6cd1cf55ZSjG9D hamjEYYn+QH9iCHCL1WNWfx6/pbCi+O5CRb4zrPgCMvFXUHrxEzpPeJj2/+gfN+X09amSNdo UP0nlnFud1XvQk1GpbeXMhwujtvXtixIqQEqi0Z23ZoIcqqi9vLiftbNW8YBw6PNNvsOREe0 j1ZRshJ0n681tZ0Wi8ManunoJMPmNLOTH1lsj8NJVisb2WNHSpiaSXrvSPBvhTIvo6QGPbOE ngaCdxQA+JkVnfGWWwmz5WGL5t+bmUAe/naDol9CVkInC96dZvhuM5QS7cGcmkH3mqj8sRip WXv0qHz+PXc7PQFluxTHfodm/knwf52CIB7v7duE3QifHeseHc0nSJWkyNKxneXbsSJeFWAM GBs/btWabykkoEGUhMRRuSaDTN/tqDKIEzNWMxiXYHO3+04tak7DUDXngU1aF6eceSUjJ9vT JVGOWYvyQ00q0l4NK8vni358d5KQtCUaltyHGdP2RdSCFJKLyoicUkTHWlmkUhvRxilvbFBt J8OhB0uYuwxxhh3syPcuTc3sn2kpPcsTRH1CipsVEu1WOpxt54zVcuTJ9aUW1cch8XZ4H6mZ Tpjs3s4OO92iQf0Vm0Q2gs23PYHNM7wToJxttmhFxSQ5G0eozILBpd8TP2qwAGs+iMURDM+c DdLhbG4boREavddclHcIgcSxzJmD0Xr+lOBo2r5WYm8qaKbYMzLQB70oe2t0h+QXHMKOHZij FSHWfC4qhYS7te14oZT0UB7egcH10sfRSL9HfGKxt967Fz655KkebrKoQbWr2otStTpUrRkl SsK1mm8KjBoUJyZGRkcfr0B4qb19/OXvLJidwrfKNDQASi2DZGuER1s5ep0pBrMQO5MMHfbv Xz954dPuxcgnUqCqR5AkQVZuUD1EKdqEZu5iX66TY7aSYbgTlJVhGVTUB0+NCNHSAsgfOzA+ 0U6MnuWcTfIGmYYlFRsVnKAvXw/rcpzo7MZHsGZAb0axRSEhSGU6z+Lm79Lbstcuus5+Qntv n4586fuhT8XGdt3FA3OKXflx7L2zwOX+Qg4gV1S3Rp3ABXwOANQXBVakJkpOHAwM9Q0PqmtU vICF7pNTSAVE/ZXvcrs8eyMUxErEqorxVYSB/bsZXKotOj29URtn8owMe7HY68Nq3syrdYJ5 a1uEWkBk/UPRU8e8dThxeKR0KpIn6wVE351jXR//WK7rjQ0eaj4sgeD5HfNHSVYlfOJA9iuz kz8m6hlsVtGmKmjjJv2h6Myq8XHXhZ2WXzOFgSujiyQrZeXVa1a97xtA0t+LtpaiOiOEGly3 Ov6kXcxCKu9I1Oh/Ri7k6Sf/6qUt+GVxcySKkaIah3zuiKkPWjUsWEOH05y6OuLLu7/jliJw ywqfOTjzbOxAboLesOciApSluqDk8JPZSB5AksIsrUK4tOJaZcU1yVkJ6xUhuOylE/MZuBD5 WkCorNj2Vkbl3+Aq0Mj1LBluuZdbjBdBKwEwDg8d3oPIA9EEN/cQLPNzrWS7jIuKcl9fzo2e OKqkIkv6deMZ8yco7ZPSGuLDO+LFDTygzTcaVPfo0hBilNlhUmmATfJOuN6NfLmLfY8eEkWP bSuNsM5DoJvwtNcZCg4NvlsOIxEdhGOMXWHBpvUSXWQ0pb4YX0bQT8JDmw8lWgH0xnVdxBp6 wQharTuaXboQBU+rU3MXwFSTovFtMj2LBZdaLvXcoy5EpkS9d3rUnXXXr4onkuHTVbJHWxZ8 kqMINMEV8mRfUpC7Dic1DShB39SolzTe9GxDAZUYHXEyANB3y8N/aQZJHHdoSqGFoZlKdpSi wN+PkNE2mcBUe+s2Y/9G9iEASO8UzHJFl+fSWtIoYTNw9eo1/VHHoygseJcTxEdO05PLp/LZ VbXTS5CKpOEFd+t1trpr3pdLSF0vZ+MG+ehT270TMLOIFDVz9MS3kfxNTlPfvjRafryCO0kh XM3SWBANS2Ul6NSaKEV4DEkiuyIqyuh1CDUGILsJy6RUr6ETkpxsdDjDL9QicFvBMZbeXE7Q f0bcl3uPDON802gDfiXn7fqfsolXndTu1JwdDNOb1SMEHY+fwOF1oA6cQ74coRjLbKgFrFY/ 0TARQVjXsJprqp0VWPQJlRczHr266/YI2JZ3GMLhGpxwHKYLcvjK7n7jE9tQBQ2q68WHh4be J501d4Cwv4aqNAPHyPnrMkER1vITpzrryrn+up3FFp+sBPau/nz8bSwEP9TlFE6xjBRTzxIH chNT1PVMo5GXKKg9SOdTaJfs9to9bd6gh6TrNlSDi/7E1t7ShYfPtjaJpF0HboeKkOLlxu8/ bTtpjNAqniufiJzZ1e6v7n9H6JU30actlXZf6hGxkH2EkXEENykTgKtDuVK/atiLmojgIC+A ozyLxVibAkLS6X5uvlEvFnL/FHhijXOykFCF1DiE0h7qgS+a8IstJesG4VKHwoKPVyy7kdy0 bK26wb4YUv5633pXle0IaXaC/It26XKsHXQ5Bukxh6KTs0lOkPyN+nslVuuIMCDw4gb5Aj5l 1qD6MDL3kNBLWlDWb1qq/hPnXQHotonbRh9D6iykWEs/pg1rDv8DneLEyUNPyPDTDL3T4iWb Br2KFvRJEbSnN/wxkO8znikdpQitXjuZQqLpAomojP8NS21O2xPbM3rirjgxw0PXbTmdleDw 4lAvnfMfGoR7HhPXnibDskiCGEE/LBS9DG2kMFBxhsLqjOyi5XS9f2NsBrAUk0IqbPt4uJsr Wx7U5KKiBjApR/PA7vd91rR0XH22gSG2MnwwZ2n/5d9hGwY3M94+Se+QHhX5mmHBdo6Y0Dvm qcOXYmFRPZGIebOc4+Cgsr0fSeyBAceN1eoSsmT0mW1ZCU4weunnDSqufzl0zwJSAlJCbXUT 9AUP8YlL8FDIqmSan2Re1enDP2poIzlp8JDArFz48seXIpyKH2dZRM2N38vP2I/UP4mwRbxf 8/lAEToRd27GMiu8tduf/ldw8uA8jJoosViQ8N5pvGmAk9/i60Gj4JF1zJIlm3zzvtu57Sn9 iaPUrAQhlYtrNHq96V1zFtaaTfTjE+02ZHrGCG4x9q7HTR5DqpBkmvzX5RcFju2zb0ODeqsN YTZ9nA2auZe3r0YIlQ8dOSPR3LNfTcH1zWwPEAygvb1D8OcPcL89ahuz3+Rq6YCpiVJYoo5m JlbHFB8XwUg9UlyZlJP9H2MRdkneEWT96JJ8ye38PedIdP3N8gYCW/aTOhxThkPLWnUiXCFe 8jnsxR5byhHDBtVHKEXkBLK9ZZDoGLeuX1iDr5RAIrvKiXnme60ko+xefxG1myJfonbHIifd 8LR8yVk2/jVCTRncZA2wY8xy8QcECjW5zpX3/qULRhu3pyJjQtQCPGV+VEaAR1M+RdRep/+F RyvRPp9vaMazh7Vwyr80qILeJ60NtOtuuGFi+955Gy1ILzfsMdt18woIbuGVH4uoshmGZA8+ wiUtuC4250hHVRxRubatRG20jS36KJqp4gj1OCCPo/tFWa5PtASyzg4pJ9HlFp9+31GGV1GY hSI/Hc5WtuTEt06WkVvMkenjGxYl/LUy5ZQmm9zIXuOTR6D3+A2Ufjv3SMOXcrdBdadaIso4 2wnSAHC0+5vHw3eiG7APMkOt+CrywPv3Q/9D2JeHJZWGfU9OTKU1rdJYU+FaimSjoVNaMZZm GVkugIhaSZqQlseyzMphSsetwrVc2l1SBAM9GmnZtCKmjSmaaFoGNpVm6WiZS9/zoCbO+37f 91ddXVcHOOc892+579/z7Ph6b+CkFL2cpEIk3YajsP9A8fArSjOILbr9C/SlgXbOx5inm4rC P2+Pue65ozybNBynvfNsS0RljPpkP4e0J2JwqPIaejEnZ13bPTRgEXjkTxVxWxbgFSTvMxTB JhODZPbUomWTAMP/3o0qMOpkKS9gnB+yDvYC/tCBoGvI2E31LKOKumG/9caMnPzZahbFvGmH 76FJf+y1guZxDGq7FVTaqjFJJJUOaGu/fIiK9r+m/1twpMXMVsOPjrNIffs2belljChLZkaN dcfNnFlFI8dcB7f7QdNc9niv0XCryqD2/xNw7i3r+15epul+upLMtvhtBG7Oe4iNvk/Zxh9y OakRYbgb2kIPNIx90EiaWP7svsrJ49/ft8l0iRoqGIyszm1iLE2XXK2aVy6p0PmFAsBXlJDF bI12x3UBYXYiz4SMDQVLkQV7likw7Pm+ZXhSoqk50YJdKWuJULKWeIrTHsuOn2ySXSdFzjdT 97bmreJsQLG5jIGf2uMOUySzq2ALjBUBHuWXm34jkgjvbuzSoeX0M2+TWD4knaInM9eT2Wgx Ld2ZzC3OOD9wK7oHpleOe/WzbswDsv/xnbazgEIdXKVfrdlfQ9PNQgJ81tDFlgl0cUqFTf6R S9YN1xj4kAiswGw7L7RCz+mCfYIdQ5yWSTrtR4DunkfM9U1YcV3E4/H81XeTY7iktv2EC5qp fIbHuYvnQ5LZHG3zJ1LiwPxjn+ev7dKeNskpT4wQ0zXeuOMW5mOcE+xW3zxyZGDKVSUL8MnL mG6JO648AuvQf3GyKdfu8Ked47GG7zT85n6oS1PEDdZND5/bZnYPHTP6go5vDba3P6X9tD3u mrYoV3jZi88lys4wi43uEdM1Q7sETDLXwtlAZBqkc4HiCBal3bNcJYv9Lt1jNWVgVhLv/NGD xlzwx7H+brcJ5XdWoe1DE6CZnPPhrEPQzsAQOUUFUBx6WFsIbKsb3L/oKtmQ5fL54kp61WBI V1KqkJ7PIARykpizfTiPjWKjKE1/abg3l+ioKXHcfuPRBu29lvfVfe2RZy3MbVZyq3Rq/uiw cIGIF1GwjcbRf3FKloERNc/bGYsx1zfm1jDjGxpVTt8cvEosvZpLFWQbc7tZ9zVCc2PTpqi/ NtNUnSs0X7u752OOvovYF945Jp/rk2bRZtKgR5EsJX7z+/K5dnnvbfgpuzhxKXA710//znAQ SZ6dzCQBhkUoaHcX9DWV2ccqjvh8O6xL9Rp9N8lJkDUdXswQiFfL1Rku4nqc7rCT0Baba1np SYEdq+g82VOpLK0MIQpJW43O8o6tHjb1IQKVt1/ZzVe72gOnEbnUUOC99UBxipcYS9fNZVS6 WdgNBbXRCM6wUe8hwkpUkMTPJAUGdG1ItLt9gznblPsgvHan6kyt0Wv1z1mBEFqhpZ6WER/k E9FR6yqx4hN2mmSio1AU4yICxCoJQdtTLKWy7luz+teOP/hJU+9D5GlLZhuN2niPfCgSi2B7 hwjTOW9SSjDdETQcWUw/tG1UCb1O5m0qmqpkCXlJTmpXSTKCzWeKZN9DzdCtSvoh6sYwD157 nM2+vddqpegjwPCiV8Sa6QflG2ElUukUt5mGk7uDzkHIOXWOGS+OsNuE/QXrUMAgPNdwT5tv wBsvZqC8O+D24RXZmbaC1XjFyfa4DKrKp7PEJrykMwbnPfObg9JjMN0H62FlZ2gq5NZS2V2t M5/Ulipu/3LO/Zf0Zk3xVUwjK4IBFERq2iwIa+86DtfWd6sw6PLe4RdmK+LvvjEBC1eZwnvD 4GePQ1BHx9tpptzaTUrWRrB8wnZ3z1B/PwD+BCrlQopgEZBDFwG7S3IW90VJUb3Ew2AZGlN5 fAt6VSFJjhDZnDqhvJiG+zTzx3WbZxdrdXwVrHkm1Nu7fLP6UyHdmTNR+fgi9gAxEXujU9rI pYKcpmzbt/tPgevP9Q9cBbjiy2t4amIIijyBhfzml4evyWbe0RjRrauOCXY/1GmEeonpG3jx pnc7x2fT4R6sqp7Tb8ULIZd5QNdd+j0+sz2uyKHaoTaYHDE92N4E30V1PbmwQXr3PPtBrn/M AbcWGtmUe8gtT4ffdynPJDF3bSGD4MuxsVnpQzS+O9znmbVAyZrWoH9xPO0OH+A4HjHWFwM0 CikusTTwu+8qqNriJJeiXnwGG5AqcqT5ZfpAjkMEefbyylpIKnR4xH9oVSpPDqnQ2/cEJZlT tArsWtQK/O+kH0eWZktX5xGKQ6Jq/qspALFP66nUEYYPzb+cbyw1BDLlUwaEZkthqzuO6G5Q RDqdScedOdHJWne3k7UHzeDFz1QDf9wsw9E+09VV+rPxiqh22LdCbTcr0/wijr7I537aGxnO vEFJepr9DJsM/Tl0IJtBCLYXyz8r/jVVsmq04j6pX29/qIa9IFX3kVm6hZ51zJbqKL+IpJdp dN17UjS+Topuad8p+/652F5J35l3YwO/3TDWJnTBJmxobU3j8yarFcsq9Ny1Mo2p1haYBKFc aea+eNr4pbeZQ2vjo6tkr1J+d7CjiMfQyueGUiBl/q63HQ7++LrgzsNJDhlx5dpDStYiIYLK 0N5TVYCYf1piIPwKGNVK4demki4OxnmY+h2fYv5pPnZsExM4M7h0sg2KLWBYd5s0UAz9mP8D g1x02XlLKvaSI9mAAwdGGPgpsGxLJ16WAZytqUNQaNbubE0eQ5+higipjzrViic91tThMUDt 2lstabvb3FHEZ7ybiW+Io/N4x75ktgvj2Q81daZ9XKrdjWUXvaiLo1iU51rv9s3H4qmxHrgA uJH2447BtqfSPCHpfYbbySoaf94+8/yxTY5gmylhrMF66/n5zqpT4KbvNVHUzkPtqx1w0YHv yltoVe44l0qZV0kxemi1luKcQex9qey+Rv+bz5/vJ6t0keg6yat7jlLdsTN0BO+2mCJ58uji 6R9n7r4BsIfPKKRIfqmCQ//gzUlMG1NGxT+9vcYo5S8g/GqmspuvjigjIOb22jrjXs9PSaH2 mEJxtM8wDBXuVy8HjKgx506RUKWjs3BRdS6DzZ0Vns/lDBtnhq/XyvyHNSKKvCBr2RqJlaxw V1x9LANKphj6p+ZA6ode5iXsUy+sv88BIgHUqd53Z+eeh7LfBq+Q/P1dMjvCQJrwhBiUjwWF SxCqZ/esd8YpcoJGYwJK+vHMNfgm8cuS50n4nefXbOJMT7AzwHQPHAoi7eIojMbHruF8pu4O RZrOMcV22HMy8mM203QHVmp3k9mO5zT94S7xIRelKPPYgfS16ddkzgA6PeTLqAOJWqceqWXQ SC/uqt5vKdrJrzqoIyBY4xWH62APPyBhR+hFx+NYyR4AUPu+vvg7SkiqbpwnKawE3NLrM6KY pF6io0YsOiiJHvlRxzRRtaTnYeRqPhzxcxUo+anDT62MToOn7u7ef+ntznag7f+egFLRZ6FI 0i/4tWV88Bt+SrcBt0QbcXHWpZ7XRmyD7RF8wwZ+aDJbmabp7wPQfcAxz7T/kRELnaeleJeP QRwS7IyyDTDIdiiXKnu+tDVNgKvQUftu6XXV9lBbyFFQeRwIKfMfGfCJOskcuuO3L25ELR0Q UFzmGsVuqARfPJUmCNkgBjVinXqN+I5jMfUwi1CCdNLwDT8m4BsinU0aFm8Xh/hI37Wtk4Bi q2ShB40wTwtJp+1NuV31ViXFhz61dC25Mc9h7rMCY+46H7tnfmXdn8c7O6rv+SPnb83+gbPb 2eucnMLv/8k28tuQD5/0U5rulC9Hbhpqi/hZ/bLKbCBCPRnWz//VByu32HWCVDr1JN3r9hwt ZtjGswax069hussQNAoO4WXgT5upNfBIOG/IJJdJqlXDYUS/TDtQ5C9Ybf4t5JyF8ze77j2j 1D/i7pPgyWXCNBquK8/Vgt75m5ubkcsxX7E8LpO0PB1ByVRByJ4j17Omgr8fNSPeHjtpeGRS 0+BFLtEPWhpmSwW6HvncMDihmmDRRhX0spT0hclszKWpayCDTBLST5yWga/7S6KpCDeGT6Uv HjwqUf/eL/ZqXGBoRbJf/0c6LRL053LjX9J/9RjI+S6TXHN+12ON0CfuuN35vnMHzmO6H1S2 R2GepoDKo4gBJFBCC/g0NKXQs/Pz58I4GVPQp98siKRYD9i+UrfiZ91YAZgY4JTFTGfdpY82 blwJYTZX21m1ur/3iyjzsxgU2g6vwZz7hlqJfmJ55CZs//WuBLtquHK0JapzY8dfnnkQvP6S APBC3iL24EIC1DYyma2fm8xOfbzeWIIFyCVvrd3zl9PWOpaXSJKYE8+Mt1p0/vmtY9+f+E2c RgccUp5qzI2TOQsIayc0kdfpc39lxHroFiaz4RFiAoRw3bbdXeybvP6S/udP8mkqb7pxnoMf Z6WSdXDGqScyjcY8Y+6aW0Mn1rPgcTAjWmrZMqoWgXvlQw0rPGRS9x714pkJZ13KkE4Jj+GR nBHfL059c0fTP9i+DkaYtxXkquknnRJbUXCn3C1taJJKPeUeCwkRy9Pw8No3PQhzni2pYeUW rLitfnNAdU4Yga+m1vDypRRJVe8hZ3HxjRVW1gH4hi8ByrRM29vmLL4gJSN+YcKu18M/XZVt uVkJvb1YlesegsK2eHRuKs59Q5G82t3uWZxseWjVx/GoPvgMxcY7CwVZmbbHnzU9b2xpPlxS fBMgQTRF4P9b8aaIo/SeZ9MbHj9EHUwMVum/fsvDD/6g6qEC7cfidBzASoT5mG6+H2fwwNGj bQl2KzHOXoY0XE/pzc/jMUK4TR6UUqpJ183Q4StWTWGqZjwJKgQ79wHOus7AK7TfijJzuuGg qzldUN/S+Nwnwe6hkVGO32tjUMB50RML+OZphxHC7htYoe3yxox4Yc3LDCn6g0lDwv3aGeHL i0gx9hR+CkVQrwDaQlPB3MOZnmi3dvGxK4zOzWZWF9SCJ2Bx4tQdvTNn1i5ePPke8YnmKvOV JKV8BlsYfJyhklAUz54NMdfJIkllewoot4c3ELiF0OfCszjN8pbGRL2OnkrZcOmdyrh9Ewv5 8q13JGgsRXBqIZ55Mdv2dnxGPOAJAMVZHiq4Cr4v0w5ftZ2XlcQjlhRtF4R8dIxQ2wMH/NpI lUutpqiuQptEQAv1HHzTXUiyhxY3WNbkqsdVZsv5gGOsZYscaAKjGr1MUssHtOKMGrtddlAj mkXO57ZmaHc/lqLvBaf7iil8RljLs205yYBsJUjRWC1B5Tq9cWVlcSZvyZ9YCXUX5yh4KF+m PIDtCRaHoa2laK8vntz32odj2usY2TuhRGVPnTDEWvGQ6CEuDglRpl1Dl9bM+oqQI4qE3OzB yryYSt6cxakbcNshg/H2I3DXJ5ia/2JozI11rOSxu5ZRS3MrT12cwAK0Zo3Mp1vTuXyK5EF/ Y2ruNJVcrT5tFUAIpet2/bQzPvPXz82GYLETvAR9125mG23BVuQwOqMQVIthfRSv/oAEZ3/P qWco5WeWmDTczsj4uXI/YUvEvwDRRNAsGplQJRpLqreJQzb1HhT+GUonZDH4xdWZpCNYSU0U xvkRWBLN6/Ybc+HRan1DpX07HsVcL/gUISlUvyXfaYgn2+IVXd72/N187oK2AorkxFCzFK2Y 5iGuryXkcgMIVQVelmtykM5d9HdO5U17iD6/HFSyngoo72ENp1BbP5e9UeKF8NS4TSLJ73Tc E0BW9xAT7BCz+WvVedidGXM+RLJ/+y0ErLc8dGbXoUPFVlZlUiI7oi4jHqsjIK7Zl/RHx1HE ftg168Nh3RenAMyHUrPSalgz8/LMU99aVMpWwjcq4CaCrq89wTfm+uaHLFjIAy/nCarBuvEd LsGnTQILfBVe4b8Dyjsow/K1kZ2BIUeeUsbQzSof9/9ANy3BrGH1BXPHW/9FBbrjBvYJNOsS NFNdxYBgrWb0uOjiHSLKflg0v5DUEgyVXOP9436cox9Fq3Zxft6EkhYvYY8ZgX+zwjuPKKZM wHqDkSCGgTYS6AuDNxuC7a/AKYuC39KVNrvbaGSp7D1A7y0XlKyFSbyIgvAJmvAOwQgyz+xB 0Sr9nJxpFIknO4Lh6bWSIokWxr/8a3htooUeRULdaZIZIDm+DXCHP6Toz8LeP5cYsYhm7oqK WgeRJP109fuW25y/LjHIBKBZnrfh410m6M5RS2Hc/jt26/n8XEYh69VMQ8fctc2JLAGjKpu0 Ggo32JYSYCX1Y90GXZS0tYkZD1TYjE3YxmNff5szcOYPBP1bw5i1SIv5XvnXI3VM/xw7qr82 g8tTHNIt5uQyeLnxUvRPQKuE1/4dzV4A3lvPEMv/PAboja1Y7l32/nON+mUkJ0Zx6gwFToPU 3NAWQVDCp/i3vwG8TMk6JH1MI1Cg/dQkg2aK0chpHZTrpPYg3Q+ECTTj4Dc5VYhvKMI18RgW Cxv0crm77ff+1Bi06Eh21MVaVcOUJabXaaxKQUm3ZxC4f9IFIUfbgNzEOB9/RcPte25XMU3N yiPdgU6Ks1L+8uVtvKQYvlChXrBPjX96BgCyEBZP+QnYQLlRpq6ut00emTQNK1+ay01/13VX iv4itP1x8ir9bITPkaL4p3v+qj2JlZizOVvwVLa0kNE5V8my2/+XaLJaoZqj97+AC3qIzcM7 iy3fmTT8wFDSY9vjPlMkeVMSXoKCEHZot4HBru/xzEt/dQ9aqeklI3fF7uBYMqfj3ZKfF2/X UnQ0323rjqHjAKnuM8CYO2D79dY8a30wKRojOinYn6ImtbfdmRzHKN2jlN/wFveZ08Up8TSH 7WwgTYwfz7lNGIOdLLDYu97fOntnGAYpCjsowfTOnOcC+x3hk7zRjNXq8xSq4guUNASjUGMP 6DV6T1mln2lr5FCgFW6yTotJE9TXgAJezAgwyWKQUXnJdQb5it3frKyg0EI1U4rzh9HIQE+u zjCQUe35XC+l/K20+0qVzjSThtXyJjpfW3T5vXtnbdqjGilqgFesm08xM+z9/T4k4nj8Etc1 j23yjv9Mx3lHY7pPGcT+S9NSnCwkCWIwCOyb9tNwWl/Qygr1MnBJMjFcAXAp3UJktErfz1UQ TQ9rU9ADo8JvBM1AQyK/bIFtKEmDu5bi7w//fL5fV5TCI7gIKIqzePV+wDKVHb1GG9noolu4 Sn/uq6v31qdZPG38mM03dMIrFunbV8/CZw0ZOuU9qJQtdmuoO1mh9zqFt+jnxYu2CyjOVPNY teq3bK3GBXpwMlCVSTSJ2dKlj8wZWi66Q1J0JDOx1W8MjoS2vkD6X/8AV6qYHnA+m3T7X1Pu VR8WJ+PsPImspCsDY050NxB58j97SfIneHQPNuKKbIeHd9fR6zVzdYdZETbPnvAZ6RnXR2IT 5oyrSOfdt4/Df69hPVz+Vgonb6nfAIhRBG59E1mFPktzfOs0xHpYCfR9PBv59prMj56Z6h92 aQPsSd2BFa2Q1XlvQOWT/K25SoemW2oAE7hp1xg9GNrwklAfopDU4pbbLpVB/MlEiKoQhSXG uVK2gZfKjF+v0oxJvOR/DKtEags1JvLbPGqkahr1fyT/1uOZxGR2vyP6tUcVo3rImrGa0iOV PdwikvxhEJuxj2NwvXzPcipWbSR/Gx2sfuz0huUUiD2neg8+Acjz+7bEfafccVm9d2i4Ja7i /4BPut5eqWzzuzm+qNqttnPEbednUQUEf6U8iaYLpFOmB4zVkevoa5PZ82st7AafR/sQwYWW YSWDUpnlMipe7pgYMaGASYg+KQO7g+23Zuk2ZdlGqqBnOn7k/MYt1Q48RdxJikMTN8CkQVrZ 9bw0jDp4bPdusL7/qf6v7eeXYCfCSohkTnO83t4EuxvqzUnctgxoigTBSS4PL/q50bHT+TxG oabhxuKktj9H4xKjrh9Vi8n2CPOjngESOxeDyI1i8+XM2ekaqQTqQN/QozO1tRfXfR2iJlk1 yWJ6/tjtpu5wwbjLRyl6NQkykjg3gazOQSlfb9JQPevyqEjKVrLM5khl7YAszBz4cwlZU3G2 YDnGOSutQLb5H/Sx84Qvzpy8iyKhKeXHi5CAmkzbNCnKwDM9CWBNS1b2GF6VVZtSe0y5nUC2 PCFQPRoQdI1UFtOxmblqApQZjsw5POExwpI9xL6WAreTAH6sG6rhUzqo0j5ABASVOzvDUMgV lQCCm61hurdVyk47MaAmDX7E+qocFvT/pL7e4FTvBbpjHsPapvkQqwp2eRWhkHnMXZmjGsqp QdCQRFPzX23AStb1dMqYSE65Y4E+wFyCh543yXD/yfMZ7il64fKLFpMuprsA8nJxC5zF0Uqw Y5YuqNCjHvb84DoB+QfgRLir4NjQF6Wi5+PHmkf3Tuy40RcYcNDOpMHXUyn/ncdghz4f7H4Q TJBkI4Rtfi3l0T6og5g+EnOs0DNL99iryfT++uJDFB3nR3Rn2hG4Hk3WYSzYVK/WMD6l9YuW ojV8e9AP6p/7+x23WSuQTkC5Xvm8SWbrREcc3Rb69TgmmW0iV0Uf6MGO6XjqXC3FDW9BMRD3 bmXNoT+qS8l5syA9KkOqaLoNIork4zXt7oNcC1uTTCtXrSL6Sox5DZyGOHhgk2YmgZq+GcjG fB+iKRdzIDoobwLRMPgWeJiPV1j5qWX4tonra1rqWXzujIeab9wE0SvF+OgFu3fHu0rCEQz5 4/GMXylztZhZmaS1o8BzC0HjhdP8RrRQymnoEnb3Vt1T9zoA/oLXc69SHt3BGDCwbmC+SqvS cU/MiLcwAX+XJ6Y9yta1trrfGnc2/4ix18H2AtNxJcTBIEH+oQc7z+8hGlPDysO5zifJIodJ 3qHqiAwjLODdfeqie0g1oPotu3e4tj4hR7v79OwVt7ONn56xyYWxPVdPaOxleAhC9h8+sEEs DzVj3h49B2IElK/oA1Cmio0oDtERgwiCmN5DV2g/LWAsXNDR1fnm7QGKJPth5BELBk9QzdwM nsao09c740m6VyRWMslFAHRj6CYO4xjPB+1JtDue3upVc8vIfXy7bPg5O6aepEhay+PolXRd 4n1vPnfKgDiZnTi3GOHnlBZ6RgKCYud70p5nl2gH8SfQlOsWWJoWJ3v7dqEdjxiLET1XWXsI wvINOR7kb2fKVY1TijxmaBlQjdU/avO5361g/6JRSuTVry1rhWbHVD43kaMtckTsixB+tJTo tnesCyVG0Lwt2atz4bh7gDiNDJu6ixb7z+zTUbK+Jn/QOps1gU38A0eY3HWdAGM7ZyEqvIXu 5HO1ggvhdDj4Z49MXFOhbcoeZdro8F0wVnIfQW0I3L6zlH8LyNjxTBwki0tVuidEOBbWo0hz uWBd7xIDyPU+jJXEu45mzPEfeYlK9SSC5ahDl5nMdtkV8XNNRnwgansTxrxQJ8/IcNkJOP2h 3JTMjl/j9aAncCTnUFHICDiBoE9vY93XqN8wZOpPYt+8UvVgOXLIw3bwajJb/96JoWNGfplu iL0tnpmJ8BkKuWcT17MumR1NJ3xFUIxUhnglHFX/XZOm/jRiPT91ExAq9weEHJECZeiZD5Rp WlvqtdTkUT9OMsVyFFssczEilH+rkLcxwS4SMP2ARDtKQ/29eZJmBL34dRhvkqa3V0BR/4Qk HFjSgJOedjZpyIcxeBhnWNZznWnSYMNPSTB1Hsj3Quk0gZExoEhznQWWr5N5x56tG9zjjCs/ OvSlc+DTkpycdXZ5/XT+ZO+LpmpNHoBWW3C+ETal6tAS4K+MU6XI++4k89aEwuDCeU9B8UYx fZo3R20eFPxv/1FRAwp+AYJvWOx6M2N2SRDftFlMMaA4qKGKKVesZAFiT6uH28QLpg5AVDmB EM/zlKfBI3cMm9QTOqEaEtQj5DmYxmKErEKvWLquoV9mvumV+mHjH8Tt/ug8LWYRA9zO0pJ9 gLnkZPu9Vk0zX7mVSftpAtLE/H+i44YuYmwhKTuZR1S6C/oqkngVIeiSlyHEBDvBW0x1j7pl dWnHNIM8Yi5j4EtvZcXrV6+unvlzijmjSTaS2SDDScvvBQhfebCncv4TFFc62aRBLVInSam3 StNohJk6Fmdlhd6oxRZ2kYyt0dubaDqnhITteBczV21TYHhI/LnxlF1je1zcGUC8dhtgnTVF XdR53kr6Fdg2Zwf6h9XOpuEeLdXQUshLe8kuJ2+FcxM0KmidZ7xrbSapXzDmBBzH8RJnYxrN YQV5tR2veIfzy7zmorsmN8VV0Hej3b/TAhTmkfDCE/wo4jwIMhRqTrBziRMQR2h7IQpuAuHh 6e5VBGO0dDjbgNpa/oTPBIXX+qaBb+YyxN6GjzWIjcKIngK66bYOqEB6ZweCEq0o9zRCZWa7 LkzoMTzYBN7SxxTBeUk16iQKJrvokqsd9kRsyWcknmI7sRanR3Y0z/q64l45zkV3LpxucJbK MjDInsOuplyLwp7YBA1/U651aViXkIR9ffD++Jwp7Mn0jmbDT4OikhE/Dehg/2qHnOkN9O4i 25ZfruS8MB9cMwIui07LDMDiJSfaxWHMhYzOFx/+iUJQXrhOT9wERmQ7LnMcfCIGFe66rb58 ro/++hNDt9Z4nq9WGen7IlWpOlCi7/C5FyhaptyPQvq9nuyzBWlkTeahM3hq4jxJf8SDMpgI b90w+/Zd2n+aSZtgmm6JIDUj/hISMNpBsm5qLULnBSjTgLx5aGzYOhYKz67Q6z11RZY2Egv/ AdQdfwIXv4vT/Ky5pTH5znFnnFm/5oRO7axlbhrRLIKHOHthQwIeFB5RJU033dtS21uZZkWZ yw/59P5WmFLA4Jt4CbA02FN+3DzYJqIKQg5nrnnml8QbouYVkOrVmxeTphrAMa1C2ws/UCQr /Jh+YY74hvv/Yy8T5mxXQSi9aiHPf3YxmZMkTCsk/VChd8LIfQOBm2DanYKgirM/X/xPPxHa asH5XONk9kPNRpr3p3yas64P1sFff1lDJ2smYsqlC7B03EZnAveROfUqg1A+36AVM+G7/Tqa Az89omjqFDf4jHcU+NL6WgzyFru2FFxb5pTHKO3N5f5nJ5N2ILbgJGzx5D4XwcODY+cgji6P C2Dhlvd+7sU/h2bSQp3FHSUjWXA6PKpNqdfwXh7Z8Ucuw7GO9XGeAxkbmuwhAIUziec5/ECi r64FvuNMBSQxzfezY1T58xsh180wjeqbmDhB/w9O1PFOBn7cX6Xy0wpJ9efmSSIfGqEke9id V8HN7vwUMucxkDL9XeVXok6ZF9fpl//wnwYtjgv3g4A6JhZKGNd1Jn9LiaoRhbq1PCofm8Lr dRQ53IchfSZh1BoegLpIT3aUn9IT9uLbUZajF101OQ5W7/ALcleH8BtYV0Hjt91LCM0Zs6/K 5lTKymCGLNReLF+sZK0qWLFWLToEWw1jPZ3D5aWFt8QfIavnc438DOjiPpMSpPO3rEqdoJHh m5K/Nd/ACTlQBwCbDxTT98DfCwjKfzYuQczcFqu/BZw5gB+imRnx9+4Nzez65MoHvGpThE0B wpdmweogEkXRB14XV8A7MTaRcOvY9w81VtmJ6dGeBNP56j/ZarMqakCsgGHg/+INxv3/hjeB /2pXzZxgnQphL95Z7Ouiq3LZJPsJgRE/6yz4pwtof0JBuvdYCE4zFyEE5RspWfSTQysaNBqf fskGRENtbxJ+GVHJsk7iaVcq76yeUEzSAS/Cjgx9em9lRJXDHTmyKRKZEudncAshJIZeo0gG tEtKkW+m2q03U025r+Zy4HX9Z/cN//VyY6Ogr9/ACs7cBBzJDV4+oZqsgDzJAjIYxIYVYVoG 3qY8Q0AwQpSsJ55i+kaqaiRBAphonuz2To7p9bPrctQ2rvmO47FlwgYl5oNO/83HtTbVyhrH FE5uMnvmiYzZjZgQaoJ1oEd1VI7sD+ZsIYmyQEtx9e0jotOFC1RBcfFtcRZczGksogvcNqfs QfmxraMHkI4pqgcjEod+WhupLbSV7ieUIGRLwZog6wZk/eC96V/LL2imqhJGBecxIni21Sjq OFbyHmqIT2C6seV5q4gT6M33MEpzQVNciIoXUwRj0wpFJajCP6LM5+RT76oPnzJVIbiDv8Ld TuotyXDgj4xNhTsQWcLE6ij67Loxlfa9+ioJNJy4MclqTWixEVvVQWcHTF55MCP+VW1Dcka2 4ILVraOyvc640jDVGG+1mYTW2Wntx7GxdleUXD6CD2/NUBuXh7pvBXSQ1zIc8xnv3qgycc6z ktn2PB3H7L2ZPWNhuEY+hdq6jM53N+WOhuH4GASqmUbhAmMupkfz9YYJXsc1oN7pxUinC0uZ htqG6OCZPZXZTZ7i9lOyDbznt8K6vEKPjO7mYRGsVa0hRgMqZT+Sd3zVqdD7qv2Wx+lR7xOB ezHzW/tm8Gg+QsY3hOyF/WXVSdanz4DFnajZqIdpvKDdneKmhjkHoGFnlKLae2TFvidmZy3U wlzgupqpgExWC20F/OVmhq6je2gVNp3T1CkkbS4kiQOpYVwfuDniHdgWSACYkw1nJ2yP1wS/ n7Aopv4ve48Awb74IlUccvV/4MzojllA1vxx2Dg4YcKVLDXsBUP1rxoKDuAVgva4/LG8dl1G PAXUn//D3peHQ939f0e2SLYohLEWshtLyZIlytgNxtqYGcxgZA1tSMYSk6UyKNliZiwjI/tS lpDKNhhJizVriZTtmbm77/t75/7+81zX88fvua7fX3Oc+TjnM+e83ts576UUCy7L7Cb/upi8 Xkin4nZbANBp0t6qjDLTPeTCLjWFbF8P9Drz26iAXxHb97iv119a9Njdflf2X8K26ZlH7C01 1V1WC3Dy9MMooAxz5R/x2ncCyX2+tVR80lClLN0CoJ+ZDZZa1971YNju1v6HQzVdqQbQPW7c akODSd1knBDp7M72XoHDdSjF5CTWoJYat/18kp4HSB4zoX78n247NNI6yiA5nAd+8fCxBn+/ GL3gRyJOTVVbReMUPXUYPanGDxtb8Xkk+twrTB8yfoomc1/4VppCa6nv4p4kVggS+EcScwb+ KQv1DXj+TLjwbpkeJNTg7OxK05WTppOM6E5LPzJQiE8Q45o/zJ7Q3r/NHoTtnwEINjf9Omi2 D8yqTGOZrpZ+fUNTpS9FyB0yPYllXvs5DfuNBGqYdMh309UCZ+WGNTSlvIzkhqdnENHd5HcP JrvJeDxrxnd5uei/BNGpP21vmzJKbpeE23/iEQLce7K1f9P2k/4KwuZ1FHedwkHEWaOzeWxr ZcAvml3+EkTG3UMst0yk/kotskkzHblECKO1Ql0Sxus/vX47UaxppNNqQeDipw+t11L5A2He /8mW9ezp2boPuBfSWR/EBMtcB3xpZBUr8GLzT6GUCoqqEqDHYkN7hkLX33mlGVs0Yew2FW04 OSYXrzIEIX5DIIR+ulh59po62FSwjEbKz7Ink5Lq6ewNOUXtqQgsrTtFk03IxR1OiPiZ0rtx zJW/bMEC/emLUeZvkLv8i/NRvx0572N8evMGP2rX2FYcnv5Nkoa4xFJsOBJYzlY/wX/x9ctX SooK5Q+sb/pV4WCJR42aRcp3saink8wvfX6Dq9YBWGGcvURzcNV6udHG8RKgA/ZqqNyke9eK JrTXeP34K7qtUEYzzIM0SNeVHy4i+7aRFsRYpEJPcthv3kJ/JCkhDF3bVUUuPhYom3pF2bqN CpJ5fh3mrXz1E8T/1u6a8cY5Mm7BoT7y+7szaSPodcIZ/DWXT1XURG9ocx9yQC0IN9JcV930 gXeTy4WveqxcAJbo7X09l3JzKGRb6PLfdcr/Sq7CcHxwUsxeClF11x7l3pR9RXcn+HC8oNO9 DrLyc/chXO9KSmfS23QIBwjbz5cbA+xDTvWXhRaBE6sJ0iggnyK0DSdjMF1Mxgr+MxrlD1D4 M0aBN4eFS9uHIIGfcPYozpDXyIcUnbJrMBsT80/URm+ZAnuwA+6AoAhxOx48FtmMnkEaIJov RKuTtsGl4Z/I8zshK1u/nazuY1qw6u2l8f9aV9RE89VtfD5Q0zntGTln8du1hfRRXEmnAA+/ X2fTedJdwhAjXwFincD6tcv2ibtC535tDd3MNf0merWGUWDmdty5c9RyGRlTEWKmAqqfhDBB tV4GSSv8ljCHpmhkSeYijbgeD8EGcPwoRFVo8OWa5nKkHyroU87MzWPJp8UlZSVpVNgNr0Js UsrgYxAwUZAPFvqcGoOXm3PoQZJ9q00t0c29AioQP7N1QqPzxFuqBkThGNG4HQeGxkX0qn78 RyqrX1NK59YZPQP4PcPwoO70UVmtUTKt7oPU/o9bb5NkXVbXS4GZEb75FNVMvO/pajyQxxZP Saqpq+uDgAnjZtQKmSAyte4nS1fUlYzeqGOYSX3F8iYgxM/Loa6C69Cix+Jq1xF+VGhVUc5I 4IkjQW8XymMe/m6kpJ+K0k90LJS5iEVUFGmY8qBwKry3knz9ypoj6+tOIv007h748bnQGkXO oxSIOPeQ4GNUspD4E6hCWAUChOVlcpp4QxPztYWLoLi5Z6JCoiIPX4RerAeYAg0+e4BcsRQW nyGclvh1rUaEvbPRU3jml0N7FmBenHuWe7P8M98X/Wu7MhDQOjEcqlDvBxqku2h/G2zbmF15 c0NqI4zu0ekjQKaMWIlxCh64jR1WhdiSEAsZo62QWCkDhCbRrBXnDRytoPyh+tY//rNuTGBE qH/rzXXWGPL3zShHtUgKrEoGCYpDBZ7gPnPF/LeMCHT3HgSbozE0FncemD9kR/R5hskkLjZf VxKUPAVRG6MITCMeHz/+R8zlnwZ3tXrzFXFkb+LNYGTv66O1cmKwfg+FLKrYzcTZW2S6D4Pi eMX02U2vmSP32ph8WFChndSdRznE0T4cHpg/nO3xpPL23xWW/zrukWHgQeIHkw7YsKLARLM2 zBIkKB7bwTZXXSodl2SUhNXwnBQyQfGQpqGb+TFk4gEbDWLj3OznpUUxNhC2rxVXBxiHLQ6Q rFGV6N7PQMJIOttemDdfaJlVt0eqgp9AFO4TnUgCyRQdSRg9EqUHpXJW11L9LOIcysTDtc8b 9FB+PrrKGutfcRcUnYQDwCsQ5li1oA8efqix6XVUC8YfwkdGTOGkNuY/eK/8I2nrr3ksWjCH eZBgvMh1VcjiCuA+0ezK7k9c79G+Pkg0T2XTUibo5kFVk+g+HA8YX1FmQpxTEyTdrfHsPUhp kDJNo5bPSYR24i4ZQEhFDJLgUqdamQhQmolEXNQz4T2M7XqUvhGu2MJ2f4EjwBjflUx+HrP/ koGQcEECOWCYZtBvzGJ6l7+fQ1mKOuipxmNr6ylJbXW85Ol4ckEr7qEi7yhJoC3RVLzanGLe S2Neqi4DX3Cvhr9ZsR/bszv+HAwEO6PiEpvTP73JuNFKBK9JJRT0cZPs2wtLMpUo6DoaDlcz 6T+HcpCnnD0y2Rg5RRJBvfPoXXLMqro60lPE7dyO+2LQtJs7RoHVhG70zQLzR2DbTqPT2H+v nkmL92HCANFmgETdYdV0TNMyPU6pEnTeLx6zsRMUVmosYVLmW1kEVWhlnssDbIugqrmcXbB1 cFAblfozQhkyFlkuLikxbFdeAk0zjJXbC4Ix45YX/JIuRi2YJOuS6qcoFlTW/DxK6B2a/oLn AQVHJpYXIRe+GrjVOvbUAQh41RQpNylhZsH1i2Nvr41XItqpY+QwCcogm082lj6LYDtCOstJ 9z+1mf4soKfBKDFg93i0hCbFxsb7cEA1x0hhfpSnJJV8922Sq7093R9ZR0gl0F7X9HoPbiY6 vRXi53o1vwaQJf20eZwGMoHJjQJ+FO7tbqiCFQpctth1GcSfNeCLmGr4XTUHBAgfKA60ZvZ8 jDw9BiZ0eYDaqXkkg25Yry9kfnkRLAabn0eYLaOJ5YQMV1QtjyQc/hnSQBMes9EvuxbDYkfq 4ArcKI4OVhrHEizregUULDcbxBxDtI5qJtzY/5u0u9EycRybITstYq+Eh8KKEQW4V0PvBEur q2pyIylER2F6lZ25z4dJlP4tGwkT/2esJXlK3CjrIzCZYIOmy0Nvf1nnnRpQYZKG2mm95pqa Yy8pFE27MrM3GHYN+dHg1vU3U0G/Q5y7RoSJsRC6a8+cfx5xQQQrPM87hq7CHaKoc/YfQaGN iJk6L37Sgz/VG/XaWcOZsyiBbZDw8PZtuqvjcwUUjrnEmUI9XV/qKCwo/BCrbjpaVZQPtEZR 2GW1JfOG7UhOvUUETi5XvX9xCxDATrY1En/RrqfY5okNSAfLq5QXA/RrF713BoWoLPqw7SdB aWMdxfKjIEkKWZTu5fHGzebdWN0XBAHUAWeK0FkSQgbFq6wqB/XrLiFblZU2Rh6Xt+1CGGcp 3t27rn7Hc4U6MIJf9D7b+YUYpwFywFn9s9c4j/II0zBQbk/MqfdZfN2OG/0po/Hi2/sdjOP8 0qLwUfUsCiNZ5jlQcji4YR0cWm5GxYgiHu3Fh9U+piSMNVAyr+MEeUpahJBJt/27jgiq+mAr vUAyqCjHyLtYZSiN9SG2SZDEOsBumGZY5frLWwYskRQj4hrXrDfoNvaUM598wR3Ux1subk48 7TJxRMtDrrL/Ii6LFrmjkojgApmdc2r2fCUIDWIJWE3RNH7JgVQUSVmAKbjS92ueG5WBeA0J IRPaqtPI4Pilp1k0+SRQDDw+PH0E1lRdU1WQCjpk7ffh4r2XzntY3tNE/WLI5BkC3GgQU+WE fYTLQPIqfqzCBRkgg5uVKHi1Oq9eYOn28nnNUuPjqFFlU2FlKIoiJJTldv8B8HaMOo+kRelc gB8SskZdyD44YkQS7JVBpRkKdP2nwOYvdXcfmyOnJNp+oNgiLZO6kNSmj7d7EkRTDf0rZBRN +cYn3idQdEih5AOSMxiy15oJsTFiHGqCcqWwaav73kJJDCe5ZT2wbpeh/RAnob3rFC3pwXRb TrjPZwA/SLQTFqFwosCEzFYIgCJVpzeWsCiDGlagbM3ueAxQUZzLy9hRCBrdvOCsFgiqLrtt ifHga5eR1DiDePtIfvJ3Pg2wYmNiFPG0v/1CmEebD1EsUz+UZDe/PMSJEpFxk6qH964RR2d3 Er5GOuSMi+UQp5iSdKqzKAveICQpBzJ/J50nAwUuv50cD+XrQhhlnTTjcjr2r3cX98hIarL3 k+T18vUNHjwBzMF3OZZ2+gCfeC4a29IYGNDd6AIJDSHaw1VlLhZQpg2a3rj5nnaeX7h7GyU3 zMIS0qSho6oqQTjK31cUR0zYQwr6DLwVuI4Xwne0JUJvsbCyZtvNL6kHAR8PVcF7afxYLVPO NsGPtj5HlKEyqClojPolbAo+pApMqKc8uNDxgoAYf1pED5Sfm+NkyjLVEKmsNaS0/WtvDzDh EY5Sr3KPmRR3WYEeIy3wjQJckxw+bf7FmhCFo8S5u0CygVuKo1rpiMahfl/Ik3wy7rElvEoA Tye2eci9l8N2FWtdSaBkhjPB2nulJfu9G3c0TCYxI3P2jyjj0llDwU8hzolMBiwQkDnWEoXE b7dCNNwnP0dQdmolzzllFrfk8o8JlzqRKd/6D9JsShqrn0FJjNhVxiPU4oixe1fIgC/gq8nN 5M8iPEiTksY7EUDJITcNGlUDDUxYUJeOTOo52CQsxpMjp/hDq9aV+Y6Kz38eD1DAovygcb6a CSBg1rG6g7+5YtAvnPRbMNkW2rA8yrsdk1vIKDtbDphn41gFggwJ7YQkc3x93U7djb2EVYX0 /AT0eisQKNn0nGHxLmmNKIXSUj+JEVgbIvlQ5CxUa48kPKzIcNzfrqDEnC+HQkGm444C4E9x wgS4JjHzhClNAWH5fq8EbW1PEeOi7CjRtAcxWHAV4qyJFLyNczjJxbZRJhoknYXUCHoh96+R GaL0pzDvrcdXf4YErRKs8JkknNmiJmnbv2K6PdGl0DFxAyBZT8EPsgkWA0XKgOrnFWEDHDnl 8R6/uDBAB2b8r61L0C/2jv5ut1y8pHIWFIfkZSxZo2mMq1UQWMV6c+WCxyJeBmVBrMXw1KNA SdgoyADTdcGyzDnIp6A+lElFo12vTNwD3b00A5XwaEvGiKroJVjZFsqEb6+FpJ60kbcBUSti anEDSP9O6hoGOBMz2IdTOXuKXCQrmUexKysRtMkzmVSmb5j2S/bL/3SZp2PYlE2rRFKu97N6 /uBLu94kmr14JkJqc6htv08VDgd4ngr8FN2Q0AUJHoDQ1hNPglcjSrFyw7B53CxQcmSQx8d4 LCjyvvHKf0pm/QJXK1+AxLk4nwh1zI++l4NJDKqnwfQAqamrWYpQFtQr5nB7Z8rOawzwU0zS bcqCL2gIl1km2IhgzpLT0J4kSsa5HkD/doND2ya5KEzLnbDSpRK+1Xw2YGbJmatQESw0Khiy CGFFPXBUyye/YfMZxImUlbgQwvMiQAfv4Ee+YdOm97K2AibiEk9O0dneE8BxIk35WNOf9qZz nc8uWB66Mr9QDZy/aScPm74jWO7Uijicxe8X2L93gxMybiSoaz+YNS2dJlkjVe0HSLjR8iJR 09EKgQXHeiRJwBoFh7d6K9iheNmd1pQJw3gxPTBN3mX7rVfMvN4rjdr1AfIhkyKE60ZsXaYg T2OjEsGSolGJ4dIhCWhvMmUnzCEJa1Jq/3b4A47OWedugA5p2waNrE7vtYc/SnLPihKiRbUL BTKQd2ohWMXAWEXTe8q8Rkmz3grnSrUbZVaB/L7I+MHnD5T+tcJqDITrSYd5zaQ6nuNZVe2e eALdCcbmWAfet7vXA7fyO0WCHCUL7FGtAaAiFH44uKUo+YX+k8wnU5x7cXrcA4blMXIqlDlk Kj+0cA2YSXAqDS2MAaKrZExMNZ1t5QsyUNBb6hEg5ix73/WTpQFqj3v3GiXt51rMxFZTPouL wLrAQHukU0mR34g2ZLGbZgdW3lVzTvuAS0NNRYg6tRbNFB3/l9y1Yys+pBrHh8wbVGeyKUKa 4KeQZAIfSoWMuIWKckn7ghtCmZC6akdVnAMqt/55X/LLHbj4UOrzg5XBRYh0iB1em6sAaOD2 CLx6GxvGKF/Acvv+HO6L4a3U3hwPcP3owL92QUISy6/3yDzorEI2PtaTfNqC4BrjyJGNxVMW AnpnyfoVcwLVL+5EUq8c3DPvCJuRlBW4SPARYjsF8RSnB96cOU+GKEN66PKCsbFof3VAR1GH +V6uK23WgpfsPdxnOOMSZcfRgXQgDp0lT0tsSXdObDlGsqyXnpF/989AqV+X1Naxk7Jkol19 YCkNrI9cnkSAXgEizjb8p4jkr3eqOnA0Uwbt60xuAk4NTd8GO7n/4NG9uiE51fhe521z4faF i2u/k74P7wsekwfe7OTBjJ6q9weei/EsuSU+MHw190V8zzrxSnDbn2vdtObnP0GY/6H5My2V 3znA4l+7kX5g4/NcxGHcLnHH8qCu3NQEA+p3Hw+AxwEm9q7d4WG74a07u/k/fnNspjc/MpU5 3c/Z/PZF7aPanq/Op7XUMiag9zCJ/23+/9SMgkqt7DJYi40xs8P9YUHBgfCLfvQWGopkV1VR ASgD6C0VFSBQW+XvfvW/+nV0AErmcH+vYG+AqroqrdMGoGQXHgAHKDlaQpFwz2CAkm0INPiP HjO/i160DwcfGO1poLIWQMkU7uPlHQxQ0VYFKBmifdGBtgEXPeHsSkbwUB9P+LnAi+G0//IP hgcGoH0vBsMBwYEhtAHO+gQHWcEDDdF+AWh/uH8wgDaSiY8v7THaJ/05I7gnGgYH6Oqy//lz LjMsvlFh2Ldv37PcNctFnwMY/YstNxj2sxw8quzxv43/yY33+/df5drH8F+g+Qfa6C11de2/ OzU0/wsuNbT+L3CpoqwN/BuY2lrq7P8AJuD/DTDZ/wnMhRyfmGDjO7H8DHfs4TzMsInvxvos sHsgWIiBCPPgj129ix/bUgUzv4NDmseHcuydHuu+1Dr0rTFcdbUEw3fHSW+DQc/uBrsVg5w+ c/E+/lzG/3l/HLvBqKfzfGbfrXaHAkY7D1b2bAau0zsOocpsOwdojymei1Jb3iG8+qK9aqh0 jk83lt0qSoE9O3D3QQz36U0Hyx94Z5ae3SO0sU5bvy/ovVzmupuvdvXV2ou0jid8fRvnilv6 5Cvgj3MiWN15xMp0p2YSdmZL3EN6AlKuyVrtkwuQZvd9e+H4UsftyM103xrsdd9PF3K0sm+f dYnHbXmVtHw5UXGxx3cMidpctQPUTEfrPY6IJz+d0KByMoq8Zv9gWtLCwgz+3jHdO4huVNgM 2S9b1lj1+taRka/d27Ma8xVyYyzxP9xto7T5HceYs9bN659SND9AOx+0JIi5r8zc7PxeXq9b TBi7g+73AvVoO3CeM2bObelOcJ841ssCGYUt6r6t8LlXXLPUr9cTNrJSuYgB33prWllGTWhw CbPzEGK+Ox/pJzZ5u/LtOZ+HpQttofX+Be2WGlfK9Ga8nj/c7uo44jMRBtf3qbmgUGmDOq+4 9gAhewnQ+bgFql1O/FEl/XM7tdqmua9fw2UUP172rhsjHLo++vP+UgbY7RRniZgfb97wia6n EktQxmQ0Z2AbK0G/OcJB4LLrznhHsXPRuHnIvRBnZfSbjJy3th87Lmx+s3QLr91aGq/4fNlZ BK+bE2DfV/h2++bWisc9Afcr15gFCCGk3HkIWtPANzm0pw2MDHMcjdxuMt8MzeDXVNDVXN54 crkFRFBKdasSNhR0vscVy1uq+whCgA9dFr+uZ7CqZJa8cuPw7D2v5mvz3f7gK74xDdrQ5+qz mPEh37pKwc1SnMbqKRl/p+2tb+YPh/RCen4GDSSuLbuwDBxU6RjH8LDDh852mbzDR+iJbV8R eWPzifCqWP8poH4NIhD4pMGz9/HV986S6CMTZ8Od2916Iiv8e/3np7cbGbj1xn7++PHZa775 6xNOru7l/kbE1V0d/FEf0UaOVGDgaCr2kZ/kZXNDzdMOIWman35O3l93jvI/ECqvLuDv1kt6 Np/n/ux59XmqTtPDfoHEq/eeeo4WbWu8yrqWwf7V/V1d2uui5gcTudfrv1LDT6o0qcOOiHdB T0nnnbzBi3wsiDH7Ya3pNG639L3u0xgoT7/+c5204AVgqZv7m6y5vk4RjuCNV/gshXX3d/fg zaHCpww/VoMejr1eG/3mgO55veRGaPAXNUwiJA/GuWX2SxamWGt8kQKZvrTWDFlssKh01E7a ts118h6XSCI73ZtnuZJe/kbxa8W29Xri4sO6h75xhWdmNpWXX42Qx6tfYWo8n88cmdnw3UgL m5wJLT+Mxk28Y02/5e1ZJnRfxljClth2wvUmVKdkZX2ueJVPjQKCqXVtPmX5YcJK1H9STQ05 QiCVWTpXwBnGIt7ppwiIKpw+FXiy5kOkyuKbkZrxDgtMTdD2ak/QVcrudM4caZyjPbLI4Xur Xdk3O5/Mft5C5u7QByMLg6MJP1Be5MyV/W41V9a2rXKdLHttEtccHCaF9BjF/BYezes2gUMu tIX59xwavwBHjYIJka/DPMfzSZfGruZwfyGQX7ue3iBuj7sXsj5FH152mngbZ9OJ8FQwdBCX sHISP+9d8szkRh6uk8nlsZZSwIR+GuKWM1eoHkVy4mPLYS0eQNZG300xTl3VM3dXVlyh7s+b oiCBIwj5LPokeSR0FsgVcOl798wD8utyyy3itvN34taPrwv1OIeE70T0kqGs4ZM7LPZCRfd1 Fe/ySnMTU09ZqVriVgpAoRaGaQjxYyMS0/OH7ABK2dObXZJYRqzGzht+oYlrdaHbkaTOuPLI 8f2CopkiTbGQwFl/2qShnuO5TT6roYqbVw1uRW6+vur189v1qXftMd3yk9+/OpQu+3vKGg5E sdgJFZ2wcSk+lg/LvXE8K4B3dYDpuAjoCi6r5DUK+r5/Mp/LIKrB8dr9e33gG7Br3zZWprKj uU5uSOsER0qFtol2T3rXXnQm+VpMlPkI31N4x/BxZyvc49zDLc3lZVFHN6nG7Gb/8KvCoIDC R93Rsoq2EucZz380E3ugNaRijFLXFpTp/ap1c+1lWIMvM066UspUOMooOWdf6sadPC7i5OEr R3UrZhc5gK37J2pfJd88NG5Jqg0mtHcMXHVcL1wcrLrq6ayZfrnimih1I3zj8MPbu18N1w5w aaQkfzcr9152uZW7P6FvzsrzLXfr/oykwycQRnM3oHIxxxXPIFovJ5c49cMEcelz1cspDaK4 2MBRQvrrMXfmr89ecBRxGHwb62ZI3bgksg96gS9RPVasDkPCDc9eFM59lu8Zhxb3PT4B4dQM 5ui4W6UACStFTzUMywuJOl0RHd8KP3lVY9c2RXFnUnIt/IfCVvvnLGpWp1awVVSGOX/x+2i7 Aqm8Kn2VszFDIpZyIH+iVutCuG+qT16aiLJTV+BX3OhERq9m/THmr0hHXqm7fSw3iF/2Xxhq 2s+hd34lSqk3WXSEY904cfuic6Fh3LL8gsoEuu4HVIlKOZk1tI6mDpM2+bhXxMTQupbZnwa2 HnXWd7YNDHCMCt89Uv09pW/2zZX7R0lcouaXcOCCKqM+07IPZnF8L+N6zdu7hEAWN8zcpMPX XF5FTNmuW0RVsX2lVpQ/4I8uYIMxA2LFnFesoSlnU1hEq60r4L7fgydXSos2X4U98u8ayauG z+smb+fwfIFt65A/rH6T1RXeGXr82f26qh7wXUFTViOqofbQ87iC56uPGOU4iuwK0o8W7mOu q9ZhqMs4Ln1KVktWXZtBRj7KzE3JR3BxnHeGw7WY0efzQMIIGxZlwJ14hUO/Yv1kVPyG5Kqh g3+8LpNYXY3amfOT1u/7SPsjX1TbMrJqZKN1x+NJKn75HZS18WyNyNwPmUurvrvhS+kPdyYi qzefv27jG7iwgWp3pp7uZAvW0lVP6i9OzbW5b5OfzksjAO+Ae+F5DB4d8dOnMmVy0NHa1aMd DZFC9SIyPgaus8+mxCb4mPtvzkCSJGCGbJUHAK0pWXCzz/3p6Ib3cWXjN7lc3/JEpldJM6bw hh0O9dgdscBPtlisusYpzI71aXgtgMca4Zab/uiRlSvbDRVTqx+7vXr0ds5uE15rpqw6nCiH oY8uo9DLhq3FV24cJRgUwhOiQ8zS951fkeo8zvOAyUJC6wAu3fycj83ZNOD9k06pTbFfu6lp 7a+Ga9iY+40ez7lzS40Wn8fCmXj3aUeJfc05uvHmvaFAbYdovKjQk3NvrUes31h3WbdG5czU Wz0tQFuNl8H3jxVZjOnmrth8/9H7cfVr/MP25q9ZSylNhy0vKHmg7dys3IfdXeM+GD6bTZLj l4uVZZa1ksPk8d5KqXyWxmZ5g49hE4x70eZ/w+zI/TbNZMUHVff7eesx/C+btR2jTjX79Gep s7gDTbhPZvJGp0sklZUfArhu9cXS3u3+l74+yVbDT4dGJde35etNmtM4tOW0Kj74LksjZ1lu c6KEa3xRE184Bd1KHjqErZdcX82YvrjDOBW7sP3Rb22IUyFe/mihdaF+obJ0Xrp5+sH05OOy OgwWqWGM2VKfmEjxV+S9vVM9oE+aU6c8yFoXfPkL4fbD1PfGrzuXraJOEWRva8cDtJlGGbmd MI4pGWKi14i0pdJq0jodwaTDe/pbT01uPkPcopav7himTvZq4udbCs4j1SFFbehPq9SPq3oz Gyd3RlBfsiemH49tpg8P3Fs7Mmwwclm58jz/foSytKSxShaG8VAYQ8Jq2/O0BD4ui0D8J/U7 yzf9lGWdLDjNqyukFOpEFOE7JSrsBaNE9yMJ3LtyrednoViAaU3xPI8pB/cFd52tlcn2/JRo ru3+9PZk4PK3gMsvwvwqDJtj94ts3KK4DgU8DxXTyFs+T5MuXn58j3tFMJcbtxv6rlwL67Bc PffO++FKhI52Y1KjawOhqYaL8RPpDoN8rNypK7O55mam1q1GWtztURJ5Mg/YyqMW7bNfGDkF pKrmlCof6Jk8fLJk/qRCkwrhoeV4FGOIwPzLMlZx6cQ79nkXfdMvZgOWoi6zDzABlq47/rTZ iMJfiEnx+4Ytd2qRJOUbxPniGQ+NBR4QrlPwzKJWK0RqV182xGjOz5Ty6aEfv47fXXFeU2oe 1VF9l99wv9GrgXyotSW1IvVRnnm8VqFkAoY113fGLIZvxFY0m8m86vxCU1cpBOAvmabbcwee Z4aOv/CzokCxJtjiMusF3PWPgfwjGCwZIJU0aI4d2Mfk7p0pJr3VUkkO9Gtl9U3h/T8kmYc/ FI7/x6WLs8/ZEXfnzsreK/Pkzt7ODCFbZM8ccadwzrnsxCEjmUmo7BUyskdZIRSRFPX1+f3+ g/fj/X6/Xu/n6/GOdvnc8v17nWBJupY+Xtk9cc6ku/wHE26J28GyxWep/WVpfuEt3PfR+S9L cnHTf6fVNsxHGGbVPoZP2aaf9GNiMNyuT1OD5HLArqmCvfhVqMElA7Yn8p/xnwGPWhwrStFs ecXFjfRsp6njD4gYt8+7nuSpjxGtbfdN1VKoQyd2Hnf58AveEqqAAjmt0rXEqUTpGN8s1dwW f8/iLpXZdnHbGiTuiR5pEZa7uueg0TcbOWIUvoaJfUItvuM/ujYH7f55d3n5AeibhMa3F7Fx 8V139lYi4w8qVq5njHxzC7T9XvKN370zh+96tlgn+7NL5SHI7QRs3WiExSrbey13tZzcPzdm ZPJcfu5P2Pzhy8O4W0wUuOdGuKyKs5K8HINT6yi1Q/fE/f9WPy7VKqyxTvrEUKoM5YEW9ZK4 AQz9wdw/tN7rjlDVr/qvpkRWcMZhxnvFJDejkasW258z9R/QhqEz0g3S6Zl3O2ZxryWGNZoL 88NC5g5u8GhsaQgUHUye57L8/kLiQkl5BNo526eA1jpnGa//ZyF0ongR/hL1F8t+dGaPhIF/ +MP/UD4hy73kjN8rZOLJH+DdFIDQsw1xTIkhGjORgvi9Z23r5lT4uJH3F0lOxEy40sQxVYde 5zXEvfBCwdp11fxVehA6iOhf1FndukcCy8Mb9DdcIqbeXQ7ST7rWEHjk0EoQTLicPxpeHNDf cMO/u9zfMSxCH5eRN9avdioff1i6n7ChNzE8t9A3rOTSCSwUu3JRJCxtU8OEpIiMNC+ce892 nS8lFgZ9mlt/tUDcKzijaGH8A9wFm/vWycG4S7bzZFjCnmt5lJj3GYS4Mztc+jebI9lPH8cL FdkMk0FBUUmQ3svm93Mul1C13lr4qBAfyW0sIHqGGtf/dNnk6VwZwhf9HbX74cUaNp2Z782x vc+sifGC0s9QWrxp3phA2G/vv0fCS4lrsRPX59Vo7a/WUl0fHaK+oJkHNWxltPRbBRFun9Fd aHqTAiHEZCuX/qVuhUxiLEVlCPzOncGwriCqxZ3NYMf+WrPDr0WOKztNJGl3Bh33BpkvCKA2 yWdpd36YH834BqcOyORopieMnH0Qqk9iGXYU//m9vbfAIiUlZoFGbfchJixjT3BXRDAlQH4l 9PWVYXLTjTzFgN0tZrYnm2MC4f8G4/9Omral9KuVzTSdSHZ/0D6lCq1T3B8igcuBFlaSmUxI Ua1L2RJaMgy9h9eYTMEmRUh/fe+JHqHMLWWjVO8S6XF4P3WWAvnT8LN5BCoI1g01sFHc5f9r +wC6AIJlVQX4aAM3l7CEUOyRyqMoiAL1NtWh8ryG/N+7cajeadUe+d+4T5er20v1L2e46D9k XsDw8L0+HwprOs9V9J8buSai4avx5Na7ish3d5bWhn3LbJvDpXTHE1RswFbvSMyi2uy0Q6qm 77W2S9mCKopuZvmVo1/VsXDOULooY8HygzInx3eWX5D3wDF6oX1f8SJz3f6hRi+sQBbzlrYl IGGco1QSz6g2rjlxNlJVoncLvagHhGXu02vJJ8wNZPALeEaTZi8fEa4VZ6Z0l9Zdzi8v6Va0 ptFPYVoo9B4mdyzeW33488fGqObeyr+S+Lh2TNSM5vwCV508Bm12ydIoC8s+brjWfMXMJ8bt dPS682e6goi7DSZZeV8WM7Cj1ELEldd/5jeVXR9/+lqZhMAZwMS9zS3eHO7Qa5THtpnelpAz 2wQwttpr5si/2vQF2tHpNBXGSuDtqOF8oMu4mMobabqS835VB/obKWTfywKYBXKr8g2L9ae3 mjqZ/XJSmf8VTS9tRD/vTv420u4xHOB8d7V6/8cxs+bSk78+B98P7U+dzo8Z7K7WbNU5UUv3 hoiiWAetXjOLwOq0XvcIrw4IFXhV1NgL3zD2KUn8gJw3nh9Y5//1gv+CXhqAhqNJxNh5J/0D ySvQ664oCJK75BYt64NPD7tqhSbV+9Iuhk3hu2mxSewiASlwaYdf0K8z/1kQZtdcN4Of/4Za XYqsilvFXN91h3GlO43eX9Od3VZNh8eejJ3a/e3duP229ttUe9XbOJ70NMm+KrMg1uIUaBk0 tU/kmpm4lkwB0FRc3bzgWTisdZTeuCgd+SWIHSeQ7Utv4B4cz5bjdwfNS8YkZ2GJvh6h80qF fSMHTJiZH+Z+Kx3c7uPqQp+rhBjH52MPdMQzRYHeBSB9VH4vO9aLh4bWhZ8MM6IlgO8jD/T2 WDI0sQLVvwaORDJT/BgXoNnXZrXr80MCe00a02xP3HbHPL+WF3aM4t76/T077hnbjD+R+mpq +GKy3bM9+lraf3VfZuEoxv1X96oSjDTEBlcv+pYjUK08HlyvOOhTleUFC5huVG6Z7KJECO2/ JcMrPPALCItV3y5wzWvepo1m+crtVT8zC84gu+no+kGheDwsbOCF1a1hd07zgXII8s+ceaoM NkKw7QGkqFtd8j8rZSZ8CerhvOOkeNhN5HqoAd+l0XDPXBuWmyAzsiwIzIq+8a1LdFPaXhZz GPnpPJ9ej26TKFD6oygbc29/jPy26FbJHaP28Kupac8ZrWn5xbRYuWhVOUpIIMR96rRCYfK3 9S13OWN3ncwtcRfsO4q7yomvCyyAh1jQRRyVNCcvYjeJ+Ue/iRwkiPu0Xhs/yegNnpYlMBvK KTjUdP8IQZ/wxGeGzwc2KUjhhjq/dwKtfwZjUROPSu+5JlBBeqnsHmrCojtPPl/VwPIfFs53 C9ZfVhN5aUnLvBKXe9WjRTIspB/31mmiInp3tXmI4Yv5r3f0NlefuVOsStiLSUC99SumSR+Z TMRVEyr2pvEUVX+/C9a+jy9TkT1XGY4081G5Li4ahke+alm9uyJm4HOF1lcBFaxgBl5J9cCz LPs0arzZ4sXOWPWxrjLWl9RGOIItaiEUq9ugJIwaLqa1mP3eW/ksKA0dFgk8bAIB+FFXcO4z VDjOwI//PpzpnbJ+1meL3TqhrAluJTC53KptED3jVarXbTGbM3vZuUN+6DTrN/Y61Nbu4CR7 TDPsp93pWvyt2LTf5JHhftwOt/97PWqOnk76QscGcIl7MUQr6GLFowqQd0tu+pXjEarO44PS kRaqxi656jvp6LqeYL4T5/FbFl1EBVLOno9I5gs1AqUYnkXhpy8Klcq4OoOFEpaqZGO5Ld4T +KFpbEQswRq7DkJOXOjxiGquh0XcSao1xv2NflfKROlNfg5+JrUQ3mynjQVx/47ZjHPPEd4o XsTf8C9P/E2HAz++DXoEZxpNcUh+4QawAJuLmRkkwdTHRUwBMzEVD03ehT/nCJcXfYp+QDfB l3vmlotxaegj5q1GYNwCBmXFWl29s5FmJYaqbwSHsQLNa5vRAZny8pLA1tfSAM+IJOhDEcpR 0jsj/0RCNncPcCIF8jbTskWBOvNbHSOB9MYqrmlcv4f/AX/1d4yu/pxj/cKhZE3bPQ8WKeWD McMzcf43h9jjvR85bgUen/pIWgZCQ1fNooqUTdRV8Z/g4xTjkB5ICi1DDmREO+gVnZFiHSCM rgt8Gpda537dIK8Yjuo62izZas6FXoEuP7EfAR28JHIRSwhawAIQk47ZSOwzTxk8RAEwRwWy iwksdV3atVQwXVI7R3WzZGiANeQZA7ddV17w8L/0GGJukMhWtJuLXKp93xYmJ/43tOvLgmW8 yS/df/NnzKfGbdqkzrJL+dR6BJoLgqJKLVM3w5RxFnktfvmM7kQ3mzQdwP0wHyjrKjeMfFyo +5Ft25bpiarpx1V6mAYexGBo2u+RvqNy8b8P5536D8IfPnqoTHEdsOd284f6AhMuxgu6vumj 1HZMRHABTuI+jbI4sgNY1pkKYrS/VV5Gvpko+YVt5jn7kDNfyGI3nMDisIH5ls3/l6M6X/Cl QUb6rGPk2MeOVw23uBzOpu6+uh9/90D2upSjflY/91qtkXdmSUnrfarUyvnvlG68sJpnIbfx e+VKvAn2/6UlXQ+vuINXqF5iIWMwWNjohbQufaFZV6rWpivZwxx4MPD1p7+9b56Mfeo16EGv K56Nl4bnQokkWFZCoT2Yh07FFkvoX1eFSvR6ca5piNG3KqTM0YB+aMpqqp9tHdTfzECoD6Uf SJDCrOd8zhX9fm5zMseEV42dVPwu2DGNbdnwyHu8r2+VnJf8DcueQBK5tAwgcRSFjKPpTFTz IrxglzYXXj2DwNj+syvRwcibpptJJ2II1+2Yj2wq/P8dCXO3l19Nz0supRnwITD9m61DE5Kh nzAn9SySLg+N/wnrtn04DGHMVNHhbsASSP1eCuWAC+9K44azAqBAIxASAsaGsOKoe85Yhm/Z xyEPLb4nHPvfKszlf83rFjhrg44W/mnZODbB7LhU4etwZvXfO8Jrz9/mlhpTNU+Al5nHNo6Y 0NB3kcdhcweO/V5uuemnQj75TdKRli6HNPMuDuR2QHfPGlhtjcuDj8XQInnyJkJrcOxu8YuQ bAKcq6/BUoZSLotgnEsm/Kkp/mqCA0BNMaDVXsdAoR8Xejq8OejapRvKQDF0EY8/+KVrU+0p 1RClMBRw8HnlCeY37yfWBaFvZQ29ZN66hfIK7c63Ur/u5YVvOUer1Mqu1+h6WRLckHSIp1UM jEXcTYYRMLYSNkG2JMeKD4DcdI7QpvLJrvU9IelMD9b96n7EdK1n2OCaC5rOsN3UeIQYSsLE CV65JExXe9vdqOH6M4Du6qv3PnwlElWVCgBXoCxPDtRL4kfqo9DyZA4YcFAbRZGZNuG0MwrV 9gGC+XH6EDDTFyp3OU2fI9dq3q/q35+qFe/SrkC8x3o0dsIxy/cdFHfpnv0auxJrErFL5hpd 2+nns4dHOtbBioe21c1zjQ9ohFOPrfOanuJjDOE5EWS2BLyQivNgpXilaLrai7zPi4Ge+Md3 5Tsze0W5IP4MBopEit8jp70m/D8Tr41Bo37Q9jyrewujtnk5nS4l5Fuhx3cdH/YSIJ0wEktw S/ITwoU9LUmMpQOxX6LXCj4z72IR/5zKcmuV6YafFGWE9U/ZnH5k4vNv3R9HorWLlfufOMWO HLNuyCi5Jemg5S1l7k/8oHSjAcLZQrFe4EiTBPyfF4GGLg0JCOJqcZozpsSaj86wqZWiO+hU 5zRu68YlR2MAIoXcHMTDc7mp1LjnOWR7GNqGQAy6U6bNm1NXdKaMeju55ct89HML8KdMoNUy 7uoeL2hfVg6xO2ZdwREfL5jYufMD0Pfj8fsM65geg2/bnx1K5yRDBZ7vNm7EtR+OnK8w/HI8 dRDXb5BdrNITzBy2SZj47i5oIo/c9bIAX4tR8fqTV67iT/4hKal8AKdNRv9CSDkk4usoxeto 36iPjcrTNzKSbTWT15Zqo66XqiBioxol2vA3GhL3FDeeAGOJlVXlobXDJOWeXULekJdxuads mQTACQp+8IyDGqvu77+3k6SsTcn72uw44qYFMnULBjZQAalBX/pnGkRCgza/C+oJMGkMVd1K 0J+Tetgx5d8yuTfDQNWr8nd9e7mVd0sHBzMXMmBh30A/Yy6adYfMiXaiP8DvqH7O87s/+OfV So+dxSpxpiZdUDyTvd/sUDxV2bQEd9sTr4cow7I1u7AYfNi5WuSrYDCNAqsJhg2RuJVXinXy JHPnhgjEoQg7226QxOBiuMBofwhQVHvgoShw3Kf2sds00O3LF3lAPTPonpkv1cT3ywwfyTVx PL8Npq2v/cJMCIbdfOsxfy20S7K96/w8nuuotWtG2dXsOXWHxlMHaoP+rEdZ7IV+JXhhVTqh aduMgYvwzECeZdXEvEgmcrUxVugOGpiVbBsTkKOAmVXjrCVI58kea9tGTHTAy3g1q21uWMe+ 13ffc1APtJf5wOpiT18KwlV14r5q446znubk3wYZu5EgzKAjwvNLlF8CTJqKa6WSp7OApc0B tTvDQmojYR0Qi4LTsaLNwhZGleuTeE57m9A04YR9fmGE8vgs4B5O6jJelDXPPQejUjESrEFo jHMZbAM/bmd6iySboYOaUt4kIXrF7fTwM4FT9zpGGDpRgS4kcfRES1ZPUW7alTv8pkALKJGY +5wRbyXUBQq8OyONlLwKVmtu0emiw0MA1yp1QNrAGJC7DAOWnYWSpgVLEL0EfLMP1nSjW8BK MqjbxLSxTnDOvcp8ud8l922v89/qtLY/CTb4cYd7h7P1sfKBaJefqLF0vHbWFaP3cqeMxscO GLcRHy26XSKY7N4IcMbP1k6XbB7nRx91gZURiA5tw0EaIsqRH+6KanAZIUKj7s4QeaTeR+T7 cKUgU6qke35b/pFG7k71GUsARZ2rivAqeIgn9lP0kAQBAHLCZQuoRNv16zfuTAZgVmTyleY+ LcW7Zqyor4Y+ICalNY1mhRZQPsEn3TmEcmJHgqPIEdAvsT0Iz46o6nkaEs52wgFBXvE69eRF Twl1dlCbgIWUbuiRQQdaFLRnjSZl0OMRNGqqVhY5b5n1hF6tmd1dVieVrUQbWNXqJTzpCeKu PBzJcgQxaJtcAWVokgQ8zn9Hjfq2S55/fF7vKuw0O7q0ptmunWo9V1Vl99W64BcyQYgz3y8F 76EyCqYzsnCkJg9Qp7L3X++y6dkuBUvRRMf9+JQYlfeCsP44ypbO3sDngMa2Ato2LhjjmiUN n6PKzHsvn4DTmqWXg3l+TbkP9UkZeK7rPPM8ueoJIeFJavTQe4ZxouSOTFTDaCGhoI9dAEkH q6+ZdhUHaD9rAyfM0vfYL3ZltFOGdW4t0FSreWaE/yp7O1+l5WvAmdv4MzmLOlzv/KoxbAyd ia43gklm0sz2gCNeCCQ5WSyClQyvkqbegP3DJI55HQdEbiCWC8korAO3Nhjfdx2tmAw/31dN /xftACkZNPIcGBl3KzeuckE9GUJyE2VzQ5Pab5vgrkA9k5AyMzFTTIBMdlWLHH6I8Vk9o+bQ a2fJ380dQdu8R5/4X5XPWyzAorsGPfPkn6KT0Qe3DgpLzo+cB0Xj8D31Q0RF8VOnX7UciHFb 4iGvfPZWvcsRiXRU3ge/SXR7NdT3YT0ZitdueABsuCHClo6jhaE8p0AHih85khfj4yu/3uQG 5xp5i1ebo7RREZVAHR+Zlj4IAt/ZMpF9iSI535DOZRjjIcC36Lz8kMuZNRgalpusKidhbOHV cEXoY9xzcdE4NClJUwuzqsf3/HOTOf4kG9noS2dgAkGTAl4mweufpAsCDsx/F/sqloZ00Gws WeUGJUNA45OyRcNTyvAo3aY2cR/ZzEFMoE8i4aSGj80EpagThY0ArwFEhcTIub1dmGhWwYWq mmp5zn03PSnbc2e/Pjpnt8pdnbOcbFVTw7zZRc6cpDuwYaoVYc4cDHGyEcnJtu/XEzoh2r1t DpbwyVtBmoE3eL/d23MjWr3eJuYfE9a9tBroM/lwOMeruFeVr7tAlbtiugZiiZzhTLqwLFF/ qPLqP+Y8nSn6emwAk07JNWTGmj1jAwS3Ke1AZTHjUTMVRyfFeQrgDTdNqSO8fvIwp1TV1yDr l8G7mW6w0ECwKrlJJf0VwqeDXNcTbdgUzY/ga3Hq0Bv5vfkxJO0wrVzpZLn62o+vcHwA+Pmi /IP8l9Qx7BBviEUjj8RIDVwuKhJ3lALXBFTsuVSK6cpnj7+uTYZmDqJu4RYq80Grzj4hTb5q 0VDUGrZGD+JEBfZtdGg8z1uefK604Xs8H27JJmfjNZEkxGR05IukZgs3CnacmEV8bg+4iT/K RjrgN5U4ScXe/FyMn6YFjQOJprCT1uXU+TRnM2JWvuOrTKcQR0hQ8q9rVPs4TGOVhxwQ2S6b xciqEsRV5NMPMvbw4YY9ltTnXjUfaDNmJx7mFPRhJGi+lh6bGwKxHhsrtl+ptjm9W5IrFito ZZ8FiL3GB+fVdAGyAjLppi+5TDT2nBHfg+8ZincHrRyfnzz/zNGfqHQFwYvGxhGlHZulRsSU 5hDaAYkvbguid+vwukTuEqZZ6EVnSJ4N1fNwuXm3csZ6fmu+l195sA0BgcletkB62V/+ont0 opGPjOIpMkzaMLxdDsSAgAk6CJ2uHQ4Y5x+wUcPO7AqVFzbnDOc4FHr9mxcRP61oRLpM9CC6 wN9KMlLrPJUlDJr0R1S/cCCukp5Zlmzk5y2HyOBPXl1FT+sS7S9p0BOUkepnYqDBlz7KsI7K q/5VzmQ6w+ajZC+xUldU1uARsF5dSFXH4qploRUESTaEopi13TJPS3xt3VqMMlxu86+D2rx9 vtQxGIONOMUPXl20oc7ZEANbsRJ+iox2+iiKP6KxzX5mvgqn61dAwQbTfg75yqH3DBJ5XWIP ETD8ynCeNEyFDkYeQUbOXM6URjb1vz8H3cEtQHee+Zhf3K0Ty/P7RngdG1aLRJAdZy4Eo4iH XCJ883/a/PCFUy5ta2v6ftmCiu+Xyc1XRiouE7RC/ulsHgVAwxrcZRLQ8PukgzJk94YPzmA5 jrf/NK8Y0B+4KGJHgM+j1VsroXT0Sh8Djhf73pbFthnTEPdAonOPSJ55WkimTDaeiVbot44U 3TALYqd1imjmgUhPLc149KA4cA4FOldM3WiiJoRJ8C/ZFLi822NUlPd2beDMkRfH1yGXiNnP kP621Vdmzsqh+EWpukL4RyEZ4tTN06ksxXvIYHqclQNHAsrKswsUqfVVVoG505ynVR5A6+Ej JiixL/K1CAdqm/vQbqWZxetthNeW1fbTPleTagg7Na57kh4F3PPbjFzuA49EX0MEPA5xRacZ mDG9jC5lzcak2NMZwDo6j6lz4TZtlWW8xgF5BMr8c30qogLu1YurV5z95bMMkXE/5RyHavw9 +S8sYqfZ6UbDgjTSkqe1uaZcljMZc68qrOWLiLsvyO3pVyIk0vW8wu6efscfId4YufoRkpK0 99rFnjcaWmCo1xRKAfq/1d8GEQeyH5GX24UeuCgZgNHt9OLwTjoN4wAYnPUxkl7J/hJ56uY9 3mPU3dx3JFa8OUXGhg25CPZu4AlFnn1wkrE2fywah+uH9hFakqDBNi0sui7Jxc8e9smGWzYX P8ySQWSMe5g9IuwBvKfn3KNx3UFX8tCj0nPvwDXXxEuMeUyKAV/uLooNno60rZKKJz9O5isQ vTK+nv9S0Ch4bceAPtriNyKmQVQiHlLo9ABZ1IYPUCH49flHZyhrXhy7pbVvm81j0VYjt4Fo PLSX0U4XSB/KINVMA91PnE1F+z6zc1gM+nH9g1GEPfCCDueDSFZkl0Lv5NKZKgWRg7M+oxlU 4DR61drFMQye5q387rEucZ60KYRve27zT4IVH/gukWawEgqeMxLAqT9ayDlotPIKNY3DSQP0 /wpmZ2aFfTQ7NuqbX+g9PER6JhCEgCpM2psrGnyuNpDudSRZvIvIjPi/CNLscs+AormXyHIk IhC1eYFS/TFZSwMjH0zVE3gNtMBMaC3iVSKkpfLKJxXtBiaYfYEoGTdf9QpJUYaBcerwpf1g Vje3AcPNyqgnbbIXofVqMsnopsPwSxjyLYrQR4BEfvuu2ULvKGqYx1ihjf/5jM5A/q13IvGk bLxZGK1cC6HL20C0ar+IoUd3BRgLDcZAVJiQVYjV/9TyncH6LlJWtyj68xVHzaTXRum6UcnF ms1yuiXlvsbQnLX4oZM+MZ0JLhNntb2q1X+hj+jXjwlk/KbyX4kkKbiTjUJ3Z95k+kz2WTkN QqFjGw0zrpVqv//kTSX8gNDjCG52yF/sW7Qh+b9Obko09t/tHbFTMEVmjL5jw6N6oCXNucSR rfGlFP6o9UyN3Lke0DZTZxrU9RmM0Vs297uOIoSipHOYqtJ3rVsm0ALy4tEQ0e9xAfiCBCPM VrfTZhIK4b1B52lcCUzwjBuHKGa0eot2uO82XOUSnNYz0+/+QDMvFDbHuG/lRAPzxHnFA/e1 QjSRayAV0dt7HnlDU9KUPGg+iPgj5zXsUHWuifxrRaCFOjJtKnvyAUL4JqI35ONhGgfWlfQu +Dm8XuyuIXGHyN5mfS+fBl7mMxnycr5IHUKIAHI8BdLcS3NGw9e6D9QOkPOo9cfBrW3y1cvh AnysDMiiqJ3cO0WT7psbj2/Fcmj6zcggFxYtubGva1Og8/aeek6B4j+QNLe4hGHrr07o9OMb qPEIXvMSnnRhZRuml2yxqLs1cbeNEZWgR9XcDsStDmqpt36DI3Jj6sfsZzYM6A+G4NYRPKS+ cGvh0EyrgVGvdg6Q6Yb3Y0E+ggZ2CPpXcaYcMeKnCco7L1wHhJK2wvUL/zWJmDhrnwk/uy9K IBs7GYqK4xnv4MGNBuvXWd7WWt+Y8TK5R4zQxGcHvHwAD644uxacr/V4fh1Hqf7LD9BX1Aac GnHh/e7jaGAKueNd7x22ZBxcgfZWaVCUhzpjZVyVPnSFLJIEhNKEVbwTNSOyFbxqAjghDh+k FCMnea8DFlTemFoYweCnhSHlHkQvlNsD3kaH51TtzMR5WLwXZPDU6FuNJBTLu5w5+g4cCZwz kvx206OPyHNDspR2f5Gl0jpXMZs1GcMdHJW0G+B0IHXtCXU2Ir+EmEQkrdSUKYX9vDl22UGT bh5tT0B+vhmcz0hUW8AhpcCEvmm98U2IbL4iO51lz7DcRL39DdYOTtY3Vfaw1jfX04H21s9l 15IHosE4P09cheyc2XM9px86ijeh/S27KqtL1+/6kIqdMYnEguVPR0yPiGR4793n0MF7Y2X0 3y9PLNFnrdu+fS2XiGReAKLuTpffX79LTfQQCU7Lh5X1VXNdKt52Emunz3TMR3dU3bUer7w6 +EgG6dNmM3/cYHT0GE3aCgCWD3aD4BVDBE5oaN+/tj8bPW8j2ukpD6y7iDvZLgowMZlqOC0i c9lqmAN+imzIZ9FsmkgLf/XmZx7fSrUkXqkMCre7jP9rRMbC9xXoCbuRWg3g1AGgPPtBTHki 6ti6DN1zdblsrIYJ2QBt6CP4pMwWevi6onI/yk/2ty2qHD60hEjUNWzdBzPgC+FYIphE+imv YKBKLJYzZrTt2HmG/h87d/4P5ffHDZzJCKXMZKQxoZmxJ2RGJPuYGUQoY8n2kazZRmXNksrQ zGgslV22YjDJnj1DUtYMkayTJSE72W7fx+O+/4f7h347v1zPcz3O+7xf51y/XN5rupxr8bkq 27cxTuKlEWybvbPLGx8G6sttbpK+nakTghOlQBcAArcsEDQuUBkmg15ZCIQvvaF7zNzumacK lUmemBM2b3mW8ilxqAi3q+ANWVa4HnlAl5bxZHBLjAXoxKgGiRg45Ymg8t0v8e4ODDoMKl8S ig/0vt71feRrrkrYAPZvL+Fiaj0/Hqz/xaY+f1r5v9hZL/hZzO43cmZdgihorTaaLsv6cfJn j93LQqKbZdzezQtHnqAKyJetLxrfVD5T4i/ru8x3R98ABx5RizPKbiFW3DTM/YQeQqJrlBot gg1+UxFavtdHCKt43yPlYsPHnjprlA1VRTgnwSUyzVwtwv6esATvATLwGDgfSObP5JZ3h8vo ihDoJMbjIqLih/xx3kezSQU/6Vkmc60KYpqRfI8A934k5VW3+7xfk0zIhZYEs2iPkV4TWP9U IWT8cFYcBtoXViIeOfheXnxIjnonmtTvyhQsvV6nygzZ/DG65i3QfJbDPhV0s4IbXnFx6tMX 7id3C8jcz5T87sneIm43FjT9lDEddChqTxlLzMpVMiTgsz8ZT1U1gGoosB96nFY/CHF4Pnyd 2EL+HdpsTP2Axw+xZ+dlAJ4W3eP6U7XJ8Ih2OxFxeEVyWqebePaTdlcPUmBccsVLlq3L43NK /6H0LvjU/jFIhUhLyxwr45J4jPxjW3HieA7GwPzy1ys11rwG9g8s5lWMno1jwRikXHLnPhGp w5ZtHD1vTc/otqIMpnTmDv5ujn6PZ8qDnJWX6k9T8UhlJ9I4FONz3e6/9j4zef+PhYvTwK6D bgkZU8tbWc4iBh+ker2D3KUOP0IUOBs3R9WXSD9+SfKODJxABhvYnIzXLKsx1HofsAkXNRAs GPX4FToYOl35nWltF0kScq37evXaUnbDTRhNMlkn7sxfPeazvr6S1nP/RRe9vvii3HBLWNY3 GwCUOLxg8VZmYYTuxhhog5eeV926NGuU4AKW48zxPfKC+Z09UVlZQIliU9UdaeNgzs47dTHO Ckfin8DDEquqCPKCy5WbgjE3SKjnPIbKUFLWxev8tIXjMZ9kyloV2cykzvBxIuSNpzLB83Ti jXgriCqNqQu2lY+zj+eISUXaVBqIxozRBm6r0DljFsZ6OWMaHrfhRHRpHrFuQVgGOiFHue/t +wh8l8t7bWRsrcjks5dJF6+9qL2yhZL1tQF2gCno2iTkfwmB+GyJ8Xav83AD8WUSZgcviKTo mxcPeC54l7e5n+2gSQr2UpU3Cb0VsiXt1/LGrq4ks4s01xS7xl7Nn613SelyQ8Kfk1yVD9OA F/NFgJblk/yZGZrIe3mBvJKZA0AISh9DExYfIm1ql7vK00bc8PDHqe1eTGTzJw0vA6MCSgTG x4v1PVOirDelszN+KHDBUsV9XyO1l9NAj5bS084Jle/BfC28GzsurGCyLIvJWAMztJlPlfNu ot+dUd/3KfFI/YKPs97Qc5Ls6CdbnQ6VhFRfBHYQKeupeCcpn+BU5i4BlZD4jEkUmY//+GDF u7KDv6cawY/z8n2q3XHnwzmDj+uFvX9bzDgN8tovvlomgLwuJZiA3C+trpDT0ks1aREkByTA ASLQe6ftCM3mx7ozN1+4Ze2NWyeczEvuyG5fux5J42MWUizqYpA13GSHidVnuSlIQmWBeGmZ Sh82XlnEqthYOz59gLZM0lT/Djeb9tKlzQoquaL12FVup4ZO0HgwqORzetgLwZo7AMFvmPi+ aw9fIoN/tvqsP3PmjK8yO6D0YzsazyCfD2FOxQCRYR1YMGmC2yAfj0T1+RFsQe4PcDM7Cqmh 0wWv8xbsvE8134afgYuF33nOYzL6CocpuThva0HRQwlwVkSNK508rdi6m3BjHCxIgsDkLjvF SwNCiDnnYoS82Q3ljPNVvQBfme+q+Nw4dpAtHk4plijzo9+7rm1+KvVzt2elOdL2cDvE/G9l 3MVXJqIjeBZBvQkBo64ukXhjl/hz4NiPx20/OK+Cbox/ECTdg83b4LP3EjUMnI2afPTxk+Lb iBFCTRLX+pjizbwyi65habxoK9A9fmiN08DPRqP0zEdaBtzslQwv5eyHBFPMokRfhkWn6xpH hg67s6rfCkISdKiwgd+/f1qgdEev8BzYJnrjtErNbsuN8T5BEgtGr43nKrjyt69HVuycwScv ptcPrviUIWc6izo/kchfclIakqoDMyPtCpwM8LfwAl1zI0pnDxSeDmqxTkrl8N0vieS5ADYj YVSi7Fm+mCsCOtUzF6N/vVDpDBWAVDsCnYx3wB89cFfj9cD+BrkvMIuqH+4BfG+u55cL0vCu njLDiV+wYaWnZu50KIko7Hm05kOR7+kKSoy5w3N75Dz4x9KbnqypL3a0kKXrnqzVM16CNKjP UZDC4cWk90nAGmktkucMsZn+MjysDmAUH0gsg8a/MTAfIWzii/TtdZySKSNx+cmU/jC/L21x 83lCYKSKd/lwQ8P5Z86xzv6sU9BVwk8OY159omaOQND3lM7sD/QGD1SMNOZ5JP5RyLn1LYMZ EdNIOzkBujphxwMf759qfgCJ43qAVPVERG+EPW1pVHVf7U/wrijUy9ZATpa3nRMxvhOvQ0yG DV2l8eh7f1S6gkpLMuW6FIt0tVAntFqxVGhC8J/j6c9dtG9xw2vti3ZDQoq0ceCisN+AeoHh E0tB3td/ENSrLHWc9EU8cXqd3Jwxl5Ho0lIhsDL+iS9GJjvjaj2Eo3GRsrgZ3zNbDB+oiDXF ULuzlu2MQbt3kkQnk36Rc5U9BcxuVlyGozAbgaxV1n1GUzyS+zACHX4P5N85Eof5Qkgbbplz mHt26SkXWgRFy9rwlEhVKbWeab+di27CZ+N9Sgwft+mB5HuaIDRTzNO6/2KlMZo0sM9D0v0Y pBG7tkGfmfdjL21ZwTyy/rojb7wKsvc9xd6Xve6Avrm3xbAIR5QFLQ4lRTDlVGy2i7FylRVY 3tPdNDDZ6nyfOWbpwVF99nPmUdHEIyih2Cab9fvKI1KTXkuE9F4VUCTeNYajEdylJDBUC+k6 /R4GfI4sfcZEgO9WxRo8fEdBx4+/5Yf2aeqKxFghU4bGs4x58T168KqPIa1Y/ngzmLU5Vzrd qaTDz57Rg9FFbKbqS2e7/unZ8s4npafrxAyKT9rB/1iwQDH43MftP7+IZuoCN/Q5pWJ8opzi 3byjFgf4xf0YFgx08Dqk1AYtrvNpOnKnxZ0V29l5aSwwx06XWCy2XZ8b6HxK/518dnRQ3tTv 0o+sw1Xi2nMhsJNC2z4rp56bjCTh4Jw/HyTbNByFVF8BOq2LGNjU3kPgP8B1OrEnhjHacAkR f5v1foZlmKdUit1ZXxnYkAntrT7ylc5H6xP6a8czfirbZBQIyMyRdwrpQ19+dopkYoAbRpH8 5wyqi+VAMcHFtKEmj4oITPpA2jfBKCaF4IWp5aKmPYRXb9rJouKuyI7KlkgaviLZGj2q5WBa U6gWsEb/a48Ehhitn6uGxIAmQHBieH2ZhTzYWSW4BwsA++HLozFGjc+/vdG5+ATxXRrgb8GQ iv8eY6ibUw9/s9KwXikUpJFZCmXcL/KOxDP9d5TTQ0/JKmIjvx2TqHL/X8cdR87irjNYsY1v bSTEg7YvEcPr1rPdnaLmyT3QuMwBPdz87TZEE49ThnmOUgCkgVTRmOPHkkMRplkAfluavuaU 11Iw0UUe7DfR9gWaaQjcMI6URMp4exp61cVxvQ7nBDOG2BGYtAH8Hd+2tsv4Sl+2U0eD1HWM iKVYsDAEauDWf3NBF9TpmnvllqsrD+3BzaLQzD2L8RviMqyx9jujIZYA8MI5Wh8D9VFr+VvO yac6F8kIHRA/dlIxo6LE4/zDjYCXdKenWboIXkpikEP4EVxQhQWmmKXQuPvXE5bRzAgMELC+ G/N76dFK55smHqAJL7gUf6WsVxLMhTR/F8NsOw5eELeOw4WtIXJhw9GVO4FcgjIynejBb7TR 53CXEsN0y7ArgM4l6dVsS2Zh3X152t1YJCkwk+Qc/KiddO+Tq+hLAD9+P+Ha98DtwQsqhsn8 w1O9Z5dM6COuj1qCZ8V1pFJEtzuDKOmb/ORd3xnYnMzKrYXLcg2k+yXZGASFfi3kMTev8anY rB9f0ix8QgZdyo6DXsw1Sb5gGAEvGEV6idOEglCVTwYLCXIA8N2PT7/GCoHLs5vFS03KMxB9 p8eIzoPCc9LwZjys7SkZ6wRKdPsiRPta97ynbrNBJa34MXygVFaAZso876bLfieEyPRv4kMh C0AxosMJKuDAYul9Ifp6y8lc9dFTIsJIYhtWvTc3514zzVMhEZEMt6QrvcsiCQZXzFylrqbI r9ReqviyQ/txNCt9SSZTJ2i6Nn8+XUBtPK/TsvEq8CLenJX/MPcY3tAJUewW3MbtGiaGcd2F 4lJUytPbEEBEdT5PQPqnxzHBStox+tog+d5x1SW5lSkQ7X8Xn/qioWLWr6JKge04A//khGZX s0g9i6b7n7PjciNyuQ9LxfsaAhHxctdv5obVKPgzuwbbgcXDQmIb7ReUzKXhWm/d9aGv2im9 CgAH5HVMV88befNTKfrS75oF1foNfoZcj/xMcOQF1w61U3+zvrQF48+XRuo8fE6Yw3z94POT 528PUSQlyfPtUsBH2hN4Hj7KKNZ3zuMVz98xs+zmdYyPx2PsKegSREf362N43pUWPPvd6XOZ AVt8RVHOetrZEBElfE9fMBh3od3lHrl/0UIZ+0d9jC5Im6p7q8+2Bxm5eSRZentcyOc5R9yS S0YIF2ofA9+QE6B96zYTpEM0kM+/Za3QzyLbaB/zQMZ7NPVwvx0vYkPb90lEsc4Oz/39kg+g 1/gFdbpgsxoU1nbKgZnSJfA06yaXvKtq9ObQjMSrZdPcaeXz3cftokK3JuQcYds+gcguEJDX Q2XimZtTTpLDgnhMoLMc7n7GAA/WsVpc+JM+NEaf/QGzViKrb4g9Nf3rY2aoR3RQzsSX8Lpf 6v2ucEG/syfCddUAsoq6kcfBcsNu2isKu5rPuZDSQ25zm3GZYSulI0/zi5e97KM0UWlfy45N +VForYgO2o/HCFGytP6IsF8IRLDGSCZ7Dz79NALuUWK4WfsNntGTa4rUefQzGSQX151mGKlS 1pxeHKYBNdkP1obH8MuqOJVnn+JPX16MG5fMCfEzWaJ+9wHiPrjIb7R3qcLD3UDkQBo2bPam dHY9faLksv4XIQNe4/lYdqhLodpPxzdNeXI9D7lgkXqTnAbGdxyfuUnZfAaN9MhqPZZofGTR gZaBRWq8OxbApWqTj/JmdMjrq1KiR1mCT8fD4FX6bEWGaIue7tSei5em/1zKauQNx8tA8GFY NEMAb/YKv/51Raoo4h8hiMz8pzh2HWM3NwPGmPMasMtHY2l0R7Kb4a0HrorYov5aQ9BLevXU VS9afE+13AdT5/e3v3DyE8T9mCa/9T9Jgg877bsqfKFIenBcKGee8ZEx524ThXKWmmi3UcyW oQzTRZxAr/CV+ucFt++7F58YyIh7Dfgq/Uz7Hc/htjWjhr6TEXVfoCUORHDMmHiyfTgMvJKw O10f7B+sLWvmGAg218ONdXNekfiDUs6wtd80BQLvXLdetjz5OykCKVIcPqu2kpv0gOXyWKPv btwsC6HexGPKFSuNDQv9cS+l75HSZJ59zRntEEuWHcQh15TNCN/7PvabCC/VZ26/krsYVrrM P22RdRLPh9uP7GDA/uo35/8kpW3Kw5RCMF+h9akWXQO/O85+Elz+znk+r7dBuczyZxjtdHiO nWt1trQZs3ZsHcuRx6NHCxpUxFUe5UOJ0+Rd8xwYu5LU8WmOgsHxuqWya/PrCNU8qR9FFb/m 3fnNQZFN2++g20fUhGM2LNQMoxZZ0n3jLhxqlGj12DR4dRa+u0fx1VBUa6ulKhQoBFueDlwQ /wQLsvw76Te6qa+RLzUoLIMr/0V3p7wvquXDkeGfzjQvcNxPbPvbJVphriANn3F7BDef29s9 9oqUzqQLuoNTcpItTiTy2b4D8IH5d1ju8jEUKDJjMCucqTrp5Rb8Hvv+0Js3dlM/jiM8BO2m PDqbR3PEmPRd8eJHYGknk+B974dNH/F2SihIaC6SIFZcyLwoDJ9KM2itrGEvv6rsg2iM7+Fi 7cxBZf4O+LKvWBuzUT8VKVyIX4yBRCwZpEWVauORhu/Bk+AHut3WOBoi478T6Xy2DwFq4kpR TPXeBqVMyB6CqEevelWxgUe9YuWgXahpH89acyP+WPYGushQ7jNilR7q1SfDJ57y6DfQBZWu 2j8kh3JBVD2AwdTQ18XLLLHmVs5m2lucrztHH1Q957Wr530IVRU77Jj7lx7fl3V09LcFE57Z /iBGlTyzWFjVWCuvGwtb75seVzDj/O7pi4/XedgVeNgIAHDa5oOls9+KPOJyy9tScX992b+t OzccuXDuV/IOQ+DSkSKz3IEgBTMDzVg+WCnAS9sJ6+mLOQzwek6XskKNSYuxY3y4Sm4E8Tqo EJV3CxOG141FOYRVkPXxNIR9F+yvOFCFiFEQp6mUXyimuQxUztaW+SL/Y4a9wKaDai4tl4SU 38bQUfF9gre48uzVKK/5/6AsjxaLaT7n0440hvU+Jfd0ecCWy6fnpJZFrOYX27cv9xia+PNT N/a5GqUnot1zV383R08wNA+ybVPeyFCgCPNc6zxSnkea3f9+HXCN8/s9l2ehS1XlcAYnjv3S 3sTTPtR+MfbFNC3/qHELSG12/uyyKxpnrkgsTsuv0Qk3+9CB4sH2O6zL8r8/PEGdopdNc0rH Wr4u22aEhoIhWQDTLC6kaqHUPmngQYsL6yvaZj3JhbDdGSMl5vAIMWgXULxBTZODGQj3prmA yG6feVLGi29hzKGXsL44kMyHvKtAbrm3H0Byg6F7FgaeuTaIAFnNg6Ldu8Yi1BHHCVJ5VroY glhpueT33JGdP6xs/hCU1v5VMrBgXUWGX+ZiIHB5+YajvKh1PjoYy+DH+epeW1LoowY6o8HX 05TopdeD3KC8UZDX7uWRFukgLsSQA2uR5cy4mDOhmw+IgrhNgdZaRXC5cg33rEHUfif+RR0j eTcoNY0fYWdy5P8+F4ztCXoyz8nGZKg0eyZh/3YxhUvh/2/urDgcGfEWhyzuzQ/UupmzSBL0 rAtgLioM6xNyhA3UKBYhCyj+YKy5Inxfdtiy2DCnjeeHxYX/ZN+e5ru7fBi/5sW9kiiNm1H2 AxdgOgT/lvWNVPTMJ4/jCJnXMqzRHbHEw07cUGkmoTMmOjCllga0eiudUF7ZZ1MgjddHqW4V 3J1FbqK9OQ3SA1kB7OYdv3DQ4tm5dyllKYhidDwRWi+uHYxlOzPuZZwTNguHDKbrG0YFVzx8 pmwAfNOEB3pcWdFY1NsZ1DIr1lnl6RoIfeTL1Qpdo/anMF4WVSNFtV5FzwO6vKnOZMxXPNrK 70DWZOOJcnYzaYcOIj+DI06fzDQG2kaOkyrjHn3+O6MVpApf5IlFK9RH7Aga4eoGPFB0tdPY eDT8bFFfiJBaZ/1marMsf9GoMrjrkMjlGVSAfJMDNtH6ugphBROkUeE/T3ZFX4+8JlG3dpa8 ylI8JWBqtWp9NofVmOKm2yrDT0s9RwTJCMckujCY7M+mkQiLLF8ud0ptEZjqdjLF9pHkpnqL c1IR92DWXAXiaRE2wvdJvE8caC0jL03yOMHHUT/ZRUJYrc9g6m1BU4bMOEzG3bgacV/35KZM 4adhV/QnmJoclklYznxt5skM6V5kXaaMCDhy0zPyt78Mj3smty2wNBLiGXpAKiFyHM+Lqwvg klr74MwqkvRAj0beN4ljnSXMPVIYIK1nvALZz6MajbnlShwqLvKngczZbpZyRxsYfOWw3oSG 3o5CSbor+meo6OWectq6zUuEqzyLAzEcKhTA9e1s0coUqi9E8h40beHBqeiVumER/iJme0MJ omHQTK7HiRmMK5/2HJTxIJziX65OqFDCfbmlkXDJnAi1RfdZIfpCpu9B2SjimSvUDbjw9kzV 2EVhtV+tHc1LxYDHiD71lWtr1HaN5T7QmDNaerutGHH/CuM+Na3XSV7YvRgkvzl5I2PA/fcv zHxUHDfhs/sGwaRBGKJqCHyEeIf2Wz8sb3XjGxe0Gb0XS5Db3phut1aMP4YeRccXgeY1Qla9 +t1/qxp3uvsiT46rdyRPZhU0jcoeNrKgZ9E0/ejaZBpjwKOc7Tndnh4wsjiNX7bqNi/0I1e3 2JhsTgaE+J0/OeM+KuDJVZVRPIMKkZN0IPPBCgASMFoRdukYqQgb7jlZYRm+CvhCy/fnCjht F1Jc2ZLJj7BZKq56ix1sP0LkpVsjiAllmxnr96BtcNx7E7XfewRttUlrCsuj/Jx9mKduN2s8 0P4udXbJnnUL7XqelRjMgHjEtti8x/ZDS1OxKaPK3e4bN00azkJUscDjCDS9dzVoVlsPQR8R ctz74yk6r6ZoPl9/acw8pXvtgqu/FQu6HSW6iPbk0vrmaYz4qIqDKUO+BQBHnPWL8xND62ms nYmvtzlrbvi3xTIqKd9uIwhvesdG6mbsPTW/fq2fhboXgWrdMPwDD14kLOGAVLPIFFbgp9Mv soa8OGejA+IsSrRb0hHq0qy7wrSperM3MifoIzxxJSBbnrHKt+8M/clyibc0uYAC1PJp/AJM KQ7yevW3K+N5XorcotbNj6T1t5qP/YOqkeLqRWELydaIaHHpMRofLBMQC7qEM58hBRc9NadU tLyOXbJWcpLyyB6Va3z+4hh6qcEhpbtjzt4TqtYwN0EqaDonbfoFVGtUum7l8KAm0cNQvY4Q ujCdrbyWGYTKFu79jE25CbDHnPSs2fo9r3XphJx/ip7VtdCPOTeaOmm3j9gkegzfD6Rv2YtQ EK5kbLZXbn/IUotXV7UEh3CpKGHkw99BH1+DCLE357BUYiSx5+iriFTEQMSTzwD2TOi6ZfNP ydbbrZcUs11Du2GU84pOXocVZxECF/6DkNlGABIt6nCuT4dzKT30ZYuFKwRQ241j+04wAoB3 CrcmX6zeF6SMixK2ef/M+KWuPg9eMus6edQYeEI7khux/kxheKJ4MsRP2L2229e1V64zJsVm 6faraQ4C2GGZBDElWxVIjkFMlR46JP/xTM/zy91tf1Reah+EAkRblJj252K9H29KDoSgoLSo oCZ8OaX9mhEH4r4RR4hVXOBj4uzRLA5FeDrief94CUdaYe9TwbHQI40XX2kREna6dy8PrDrl qpSO/jQuut9w2gshtjcRt5KT+j8mK3qdg8mWMz+MuKZ3UHlWfxtIPW1zmL5yC72farl+WOTJ bOWzhb3BDH0ElZYkOTD8YKCSApvb9f12Y5xDEC+8jauvkV7PDBKhj6pmNzYV7LnWNuHXPgx+ xxJPef714l3QVOeQ3469MY6HuCk6NTbLRK+Csb5T+LstUuQ0CfpcNg1CHn9RooIqFf1/qNVH kh2kx8E28f1E913mYKrVf6XTcoLy0F4EmtnOef5MAxwyCxGOAx3ci5mx78l8/ysHpFK6odx2 kMr3Ox0g5ciuCaU4xWL/XEdb2i7bxWEvkxNruyfxlP1qLjl0SBVxS/dGlrSj8PaowgUb9dTN 2ZaTI5ueGqlVnuRdW4bI3IktMOK295bYm6ZI6R4nrmgPzcGdbl+VbuqWvQB2MiOiFkougv25 jSKKG8Uwgur47nxsf0os8G9t717fvNQdNoFP6OfC9t1D7GlwXhkPqZuPR2hJA1Wc2F4YRFP7 LYmCoTPYkgTDTnclJ60xIx92FgHisNEuWK1LHrnbsq5Owpbs8CoRnefJLek2kWRQvYx4HajR FxlWIBnGH/pauMY4ZWIwHnoQxGvsIUy5Wr+vWi0j6EsOfa2V9npTqKbVkHxVqRHGBanmAnZF 0OZLNKZuF7U6UXKx2TSHe708i6ZksVonFJH3WERcFmDGcrxDCd44WXuLfGW2cbw2GCKXkLJ6 7eIBAFJtBSQoZr8obai96uGdYEixOjwaWrt4Di5DVFWBz4VL1dNjaFGphg2KEOE8DqWLhkGa L/iu5hyOOm8QxW84JgKY7dI/t21lFSmHI9T1T5GmkWZ8AoicxBn/gibU4ejrVYmjukCsjDaZ bJ7RnXf4saZNvqqcBOP5B/4D/4H/wH/gP/Af+A/8B/4D/4H/wH/gP/Af+A/8B/4D/4H/wP/P wfNKK9uu4VtbLWONOxtL9gcLnxU0N9dOxWnsNj1obNh50Vi9V5l5sDad6l29LzVoF9LJsjyY LaSHbbWI2Q7NRGvV/SoUs3uwjh6030yY96mem87c3638Hr5Mrw1/MBZ1UmuD+bW7fmvFx+Hg x/elvf2WuIM/Q6cdwvZmGsNWN8N3l7Qa9xZ3lg72Mg92Nxu/Sncdvt6cYDWAPBJsJhwUIZzs beenjctr4sPuV5+D1giQd82zaWRawBkKjPV3yvG16XiHEvGHSQLUyTn2NlMHVgXYiaF1z1Fg m+/YsyeNIpUd2R/Vy6x86vdO03vbxWJoLTb6od8Rlk1KKwtVB7tj4bt7qY372/MKWlrNIjXe R4VrumTRzHYaQ/NEOBh4Ebs/4MQOty8GjtXmjs8LzZ9QXJmSa2qvOr9l8q5flRwEEabSaj3y plkH2z++2xQs5077zIqcw07bhcKGzvPdYbbfbFx1Y5uVZ+qjiFP8g0vS0Bqz4e5n/QKIsvMS 1KlAyDcq7XTu0wontqtW/fZDxZU3d0sb/rzDIHyUoGqjFe00sSIAQmmlDEwRQBytjdiavDF+ sN+tuJJO8Njf6HTINl/dr8V7hOX0tuudHAmIk0TXUrHHEZsjm016sbQxN9RKQ1qBmQ9bYezl pZWz3f2+r8wj9wjiiisKMlsljuyh1xmBa+aKK/1lCkVObAeiShxudSOEf3mBah+p7MTGuWpO 7CDUJp4+ZFgVqUHPYalhMuYRLRaOZxFidQddN33EC4YEKb8BiCpV7KK++S3hoKnigNGDLAMP YQps8f+QdOXxTP9/vIQcKRuiOZptiso995Fjm03kKNcIIcdcodw5w7Bhk+TKtciGJYRcHWLI fUuURoXIFSJ++z5+f38+78/7834er+fr83g/Pp/P9HzeeSKbOOrQ7VZlCmlCEJp+zTKIHgFt eGTcl6MIEU5DwFksr/c2rx5HSdgQWh4rbJS3HwjNcikGwq+RTug4cIAIB9vyiaR0JZSEBWEm rMu34fDKbSZV2dGeKbKXDFOJI31abbyhuMGlsDFMY5036sKBOrxOEFvtYU2dzlbEiD789y9k LuXD3512blTbu5zcdN1QM3LuhGMYhpzbJQRtBxIOHBQ3BHyvaqWqbMSfn9z2wLPguypMOFh6 GrEWjVbY+Mgr38pGaNl5a1SIfrZ4+QPjKgT0ddujq/aCxnD8Db14wHvG1VNQp8jDnxffMPLe MDYHjkF35iJC3uJnivGlYd87Gdt4lCA0RAv1VJjQcljmwhwZaNtdMot+7Nmh+M6y763slbbf ijLOGkQU9A2DZbQx4UJuVJS8SNiDWFLhbOAIsfk9w7SBcacSSJz5t7x/PpJZc7GQm3BwWGqm SXgxH2Fyjeyqo81xvYORma6z8eVf+ytPZokiJESzPVmrQAgaXF57gaXnr6xp1hVlzBU2BqKn 70NBxMjd/Z0tl1AMTo4d2gg6RLWCHEtJ+3DQ1D0V7fRdiZE4pu0Zi+NdjE77VHbomavS7fLF s/iDNnZyrjfLXQ4PfrFBA1QOlkyP+7jqdGR9CNGV4Dj0FhkyMF1NOGqVqKhoOPv5H+1AWWXi 6S8PXIllZtTzsuZDn1/mRLW0FzeDtGlkqI4Chx7p+Y47gZkZtveaFPRv2uodo9Nvt/roCsjI lqrxIuHDhM4FDrhIty90uiO3eSA4VMkfisKpRcLTIv823YwcinYXcgqv7KqT1hg3vPGmCgBT aZoV9YX+0LX/lXDVZg69mjjwz+OiVeTefl7Sq5bdNqPiGHvosOqwMG76FSnCeGeKb/ZBcNof Za2b0Ge5ZUcmokbD9N1pMxOKqJFnmtgHMhN8xiy2H1RxVT7ApXVnRSTZUMVyXfafR/18qrdg c2rqqKtV0MOvLGwV29a3eGwV5scZ727/qxLE1f23oZt3Yfz/VfLnSQ8cEMW0/P5pdTehruax 0zqyosxB6IWCEZ70Mxt2MjSUZzS/s5IUqCDvJ0riLThvWLzot5eV+ylq9hUxnw/6jnT+li8R qlZ0ZOLvWu8t+I8a86Eid5fI3Y1jkN7bu0V+6xYyT0E37UR463qbjbbcbiDWJYBoO6hPDLsS wHv0jHrc/sBBJ6D50rGkzcHTR+vndWmL6B7W4O4JWFKIJw8XkuLNnFMp7x5Haz5Jupa62vLt T+QnvBCuWgx69UUem2VF2dN1WQlvVaOeLKj0npKYRp1U506BUyyQMNqLOjgZWb+30iAfchE3 7Av1qNxRJULVrTK1rf2Torej645XaTDzakGJ0E15k/9+zvHCGWFvWz9jHwRqrUXLuTywqCKF l5RpVn5/j67YXfrasvtVe4/I3SQ2Wy1WY9jmNJ/h70AR+cqlEajnTaBrNrMlQII3c0a94OV7 KyPpC6H0YOLkg37Ty5FNvkyfbcdUVN3N+PdhPwNDf7p+4PAcaKcUQBeyN19j+V6yEuJPVve6 eAabLGplsZY80iF7PCre5W8VLbBt50pCbhwpQWNeTbj71nHHDVm7PrXonYiCc2lig0vzNIkk NlnkodpnFZedF0sDMWrZRMp+PmkkXwhaf7PWPY1h5piFNf37U3sU13bU0FxJMEpzTQ58FEHX M0dQW/1ejM99fnQ51bx86PxsXTWg2YfSgOo3f04yNk0ltQV1vARVjE2mj+0mVAZfbUmEfvT+ E+W7zpGOPF7OFY5aoQLaE63kEo52T4x6OU5oEp/2bs6tERdrz/cWID2qdzRRX2qsgxBrrh/q +y03xio5J94vJ1R6itc4bfi+B3RCu16aa/TrWB8THEpF8aAOJiIWVD1EKjc+Aemoiy1zPGu3 oH7E5+/DH3siRI0Gu0B8nre6baIqUTiV9ggtk3E5seS6RLGpb2MfbLROczwWrHFmbzffXE9a a7/MSTtEmN57l52/mLi83SXV70esk6DNdWH3v1ZZl164HFWFWk1quIvwF7eIQIQPwqskWZhU sDCh6Zl3WIKavTryAUde3Afha73y02ajHWt+fzT6psSsnWF5UOsN03al9a0gv5eLd2FC3vxp GdCI5rpdF6NSvWdojNehnA70T1DYMHzDT9F25NlvqXKNQhWgiEVQh5xlpV3fiTPfTr69/XL+ CT0BupT2Q8rz8JoAkzF05ebpe+lCtqX4gx+LhUPKLu1B2+Nrhyc5l2vNdNafP131DQLN8EQH e3eUkBSMcitR0VpmJuOqYnvztOkeLLWNYPQnNHZ9LE0vNg2y+9PR2zlrrjzAg8Uu3bhe2BS6 UZu3g1iz23urzaKW+eLPIv4Q3HgUPPvgTE9TrmDal3z5cKPKLCGkUyCTy1o6qfGIp9ICEf16 QtS23kTgLfpvAmhZp5ZXcODbC7lakM7TpCCVHU/DyIdQy8qw9teVaO+6MNjrQZH0lSPsN9F+ qt410rBS3CNU9GubcFSdSelb/AFnqIrtUESiZp9GEKgL3Ye7GzI04KeSWZ8IDe+3oYuT7rIj nTSKd9Kj30lIGrnfyhObKJZ+QeFajbeJ3uaV/TNvLtEDXyKMOjPHC7s/eKjtpscUypd3LzLq J24lfQvDvYSINZ35vgkX01/jkrvxqIReprJAkR8GLad4aAdK09LWNLLZLgsqujLNcocjS66a xT/9782ikzSHwtDePjXjEfzhyqKfwnw9SNkOKtY09xmgUbQzLeqPO4OFpyOwI0EP+WBBVRZp 7gNC5viiECHhp8Xcjr+sRKAaz8JuiNo+80DI3SbmoeAi61psldeDxqsBDserCqAytJ/vSF1P H82Ssh1rSuhNlc/Hf5g5JfTlfgMEug1MiDv5X+B4ZcGkkYdta3YSvj9F5XTmk7QgIl6nxpXH vbAEh33XpvvMznFx0ixAwy4+vu3xuGd95wqg1i7z6rsO9zKhnpqVdjap4iFbZjMwldmprGEC leHz08l0pvwhUJw70hcwCoF+hN0mUGvL80ZouJ6Zn36mBPyaNzbiodjUUUKnWr5tbKY0hOjx fNjTGHpIzS+T0YE+UNiAtnozV0S67fqUxMK+FBuN3UFiSy8+uHpguwK4l/7G/fMbwAVVAflb p32dBBncfJpf8mwRK1Ya10ptLvbczp1r2wBqDvzubT28zHIlKkVjOAk6ruUid3kYRBu3HRP2 2KLwVn1D+xIuGv25U7GuU2YFvsG+SN1KLQobM279IaK/fwk0UGdcKkPcpc2+eb3pzD6EFxtQ /k8rQz2XkHNdkKpYnZedgGWP+6VZnN11vNknPkE5ph+irsH1Se3oioZi/CuCp7HAW8YAy0d3 cpmEfGj5lGAa48HxkOm1u8bYeJxpvZFzLbapcx6wluqv/i7GLf2xmNMdVQ6cNJmnVSJVGlm3 VgmCPh9+9GhRuGHukg5UDTOAfuTV/4swiiW6qwDSZjaUD/LlsfPQqiGq/GvWxfyYXAJ5U2ev dNUm8TDNKZOQLIj10v2IMSLgppf2M5ILPb9snXOcC9VvVb7eD+jDkbXIqW2544x0U7yOy2do FvTD+aFQSnAd1uV9jNsZYbDTz99Ctg8huGprJ4RMCRLUpG4h7VLvWEeAHy5BRDRsro+4q4DS Qq9FUlQaH1tR24Z0NmbXrmnPb4N0ysv5YCY+p6OzAtn3q97EQeawy7j7NlKlgJTG1kviUMdl lRRb43jVUApci5fV+WmINa2GL+tf8+JbATRlW60AGuxk6TL3ne5SRKpyJxXAU2v1jAYtcw4Q HnGk9XEs+uCXf3TWcn/HLV+ZOIEwBVSgcel/wtmrsewoIAVxQgFpFJc+vopsq18kowVH61o7 YTFSW6gv+LZLUBFvJv2BHg9csEaTnl8y9JDzu+e4tIs4FAWYCXOXhWqdQb2+C3um0jAblWTl bb79+R0J+2K9NPwU+rTnnQ2rM6hYTohECjuybcoEoEGyIQCqhuEyfdVxpAtib81MbVm8EuHF XmMh3YBtI8oZ0/4JWygWptrtdcc9SIH3kfzrIx4YPjRHrcWqHsk0WbOZlidHkrKHWrEyG71O M35WoBnrh486o5g87U1hq486cW1j4ut32cdADUZRRJrR31BmfDolGvF3frtlTS06M5VwKKx2 LmGkJ8btaEJq7neGIFpwr+EzD7/g3v7c3WsA6Q2NcBta87QlYtUJWSXciTb2ChYmIC4uW12l 9kGtq4ZSBwd1XjLxow+uHp7on4iUOulTojybb80JS6rT3qtOKtKLQ/MgO+zrD0MmIUWM8iLG fhRV7QZ7g/p7kfXeFOMsTsEpC4Xh11CWiIjHwzfxU1D32uB1xv55htRAoDjo9ORohzsgQ6FW 46FVT8iMNwcWD6/GX4S7V/MgdR0sKZM0P0IRr65lrjgn9FlWPZ+R3+upFcBk5Q935JTamDel UOj7g7cktM9dptpJmEbtbbVpR/mbbTOHl5z5h7T6YUALPLgwmYfvo9UkZBcD0iDuHDYHv8d3 QRyXWu1T4GMiXnGAfKrh+aXTurs3uPxz61hla9nAPpCF34Im3IvgDxQNQbchXQT6PCUy+GH7 zZZ77qzsTcQvKKvjPThygSlPZF0Ew+zXZJRSQt8z6AkQHL1aBIr2Ck4gvTAShE44fPpUKT1h q2253BbYhurfLwH8qs2dDOXF+Ncr1U59suoR/uTPYb1xjhc5KgTwH2tGjjpk5R1n5kJmgh+7 An7FOtXYbGdvBBuT3uAToH7pz/tSeJ9WrdDEKv5BA6+brfKZl44J5F09sloD2/X5cJH/OVZF NrfedIYiBhtSmpEf7ZEG36RATSsr0Y8F9Umov/1bcrvjIlOyKGwaWEx/Bz9VSRMjLQ/ePcKD YKYu8TEduHbf9WzwVG9CT/a0E8e4pOVGjgFgNEyqWDHI6vo35JUNEewXwH+VB/1NHPqMN6pL UGYMtNXh9MuL7/QEo6/S9D9v5+8gXbVPATE+lA3adW+5KYQ79Cx36/i/W7TIWh0rcB5ksXLa NBlXFS7tMksdDbu6J/3RKv/ndnUtB/L35bDb9CWzkZV8iKk6UOztV9A3RsF0/6Uw4k7x19lj YqPx+i7JpoFYKbCXkmh4VcRryz1sBO0Nhr+7mKUav1RG37EB+zXc+VRmm7IyKjidlAidgOXV L+C3a+dZw3cffOvLnwSDayTIurWS6D/BrRsf/pjHniJJDzD/msQyhDWKwzb5ntAaz73R/LLw tCR/6GZKEbcuaCDY+llyXMCNbaE8oXb7G98A23bPVnnTvhwCWtX1+ICmPoMp1mzABmyDLazy cPXr/MLlX0ls4oiSGwhTQIP1Z3shPFhw/WGnL2DmVFH5urXMhquWcdBtwaG7lF8Sdt+4/s6X AvpOAav+E4ZABrhW3977e/3rKWPySlfJgv1KFhufoWXzObDLds4daYiNoFcDw99pyIA+Ix+n 3Oot2P2Zlju0oi2CkfP+aWB/l/k0IuC6GQg7pAfhxGB8Ory2Y5i99PbDWmxVN4S1ZlzFxp0/ VrF9/NweVpIb31lHgCfXcdIl3MRJiPrwZVOPxnNfZiMsiZ1KoGK07LBDjCIL8eveH919NSAP 1ntISeeRb1GngDP4xA5UgTUfujKJ/XSym6o3uIbKByU/uMWIpAfwwPlJSyamHkAEU0G+/6sX naunxVMjYjlkXHb+FaP0zLd5q2JGwQ9h/WcNxQwOELQH4EyhqCyLNS1LNKm94VE1u5oqOlTn Em8NfxQlC07+yHkWIztti7DsaWfvblzoubhWyqaDuPuU/Wri9y6Pw/WQrbysxFpgCiPMEV6N NdhcGWl0ZH49qU9q5rToGM6VFXu7l9tcp9gmAsPWeLEB67FStet4plvGIGyqC9kX8vomR75k 8LEBWRIff3JkGS8SXqxoj8jr1yN9auiCCDsTRuvcBYzuik+LhxxaqpcIZ2j/DcWwKC975sQO C+zpVBKtRcMhQ23jLq/kIMA4pmX2lfOv/HngsYwL+KLtWyaAPo/BV5d2BL6q0xMhw404buI0 RMEmoJ2rf8uv21OOAPn0DfAdrYqG18SOUI8nq3ap5ZiuY0vPV5n5Pvm08om8uO/wiq08Fq9B c0+hRHbeAvg6jD1E+QJUbIwsmbA0hg7KE2wRjxAQrZh8PpLy1JobPTjKQxPKIdrBTpNV0in3 7c+RHf5sLGz+0YtFqp5wqjfzCMeH6mYaAqoG0QXC3KaKNic/QBg+zrXVCypqs4Rlu4A3nXzA qgPd9VEIuOaj+wl0S3rHGjQgQwE2Fb/90Uak6E2iXoeWdb0Zgo7NuleGgvAAmi7VnEHiDL4t Uh1awjeJ4ZtUm/AbxEU25dyl9C+noa0qRaPezBb6jOvD+PDbGaEfOENKkHqQvnXL/bFcIhZW GF3xb90UUbJT6tvjK0I+ZdsbyRThmNZzu52sjmizMOsAx/Ee7xAkVVvRNrCxnB6edQFCQqBf 0UYGN3ha1Yke/yDZGBIo7WZakfys6DeafhyNMJjCWW5l3K7u5mpNc1d1Ib3xNgXLLMydhp3C dFa66N5/zpaqR+l1H/wjJzXLRpK/enSQvlSJo+EXlRvt2LvCvqb859kyFRthwaYXr5RTDXqO rniZfsU7JlmrWwJFb7IEcPY4pga78KTv5BByOAYhOnzQaZ2MHg8STYQZTqidj1rn8eFBGOfh nxbU6AJMPdghgTSu/oGiuUqmsvQgQtrl19qQrKUPoPmc3vVvYVcCLXR+c5xfuLolNrTZ9qx4 jA+oXjUMWjvOLQbcysCPpVRb3yuVoqtY5v3wGXuvanq8kReDJqc69US+A3M8PuV1AnDg89BB etgQoTk3VLdUhmcqq/flGQD8oxselpmzZ79Z9mrJH3JoVHSRtkiDFdYHwvzAsfobl+vqIOC3 xU7wrmvu8THsKqL1aB40DjEPrrkRwQlMhMU/Vj6vpRfrjFfLtTKCsZGWaCVm7E/xKIgCkg0y fCmOFbKFbwuOqfdf/rw2fAVCpAUO5dxLtT2KULHxvuKi1cx+SvjgvJLRb6jtWxLSJfMEsBZ7 AmZ5IERXobaLo82PiDNl01WnMJyV3robQCEu/EGXbpRf51Lz+JbfY3QKok1Ps5TfwkOF1Up9 pO0RmiGgFHRvjkRJsnlHVEanP6e0zYmVVchupuRoAIJXlTiEExL1layJYS+PIk39UBT9iRqR A8pPF/2lPYDNQtbK/1j6CUhyYwKTU3PTWa5XVaJwQp724ekpvbn1rvePAzQSkk7AGR53c9WS IL4GI09ohtKQfIsMeIKTwxYhj0CJZ549eEevKylOQLABZadGP3bKAjVe2FDbC0tw8Ynw4xix o1vcGFzhQXRJzkPV7mfV93VXXAR/iAC7Pz7W6wBvdMkBSaL9uZGdPPDhBuostaG93A/gcOru z0Xc6RvhaZUw1a8Zb3BCSQhcuydkaN4/tEqqnrRBv/9KTh8o9EUXJomRc8ds0h1fsl0+FWBT z4cg06n8eybGLQrWsgX6zXax+FEPeGGNI6ARkmpOUbaRpyMyZV4SjEBpRUJVnLDb9WywAZza 9GV6T6yO7PR/33Xp0LT3nuoMFA3BYNtVyKJkJtlG+3yDN8f1bv6qPlvV0rZL1Xb/7nFAAqNQ JgBfoZpIzr41QMrBQflwY0ovkiyrBD973CJQG4jyhqk2Kks8c+JFM0fpY1GytYqp7Mg8NuAW qcMub2ym0wC4Y0+aYce4gJ58XgmP3Vy71chWE/r5BlKuNABt7G6eq19uV2Nlka+IL3IVknL0 FtQPK8uFmGknRqI+WTebd1yGPwuy8iVZ1DB4jJzrcvXnhfK40Ft1T+GlxclMQbCXCfAhbJXs A+N2JfM6rUW+WRVSFzIsgW/yVcOWIsfOQuiyknGX6A5Z0hwg2c2/Vcd8pZV6HEwrTGUnQ41o F1WX6sZjOirH86eKWLctmo6++2dC0x5Aeo4Zfgj74TfGLKvBBJoYkFeicjblHYvY7EWGRSBo 97Ox+MKCGjRTNhQyvCtBwucXrv816fHw26Yh+VMOKGsateZMcm4/ULcn2mEBf0FVBvy2wskL ZegOVclj1ltnhO5NWIoqYwI/l/FhyKYvjYFlasKNB3vlA3Q9MCz8Y6Cc6ylSr1WQ0shJSPix AckN9zguzbkPdvdvMB2bCtCGpE+DAeOJEGyxlw8pVhCQf48TM5JSplO1mHEMFngmGQsL7L+Q osoDrJpGeyxrrbXuRNyjNGEgTaY8GCyZIfQoYDERpnH0etGpUZtFeEaWG0oMsAbUD1jcWfsq d0wPYdwCSobhn8uwukDBlEoYHOpLAqaLGNUp60qpqoBlrL37fEYhdie7O2c6q8lr/6lnw/pq YR0vx3UX/CvqUnEO+aOgEfsrXGZfpSEsf8yyUBE/ymYagXcPNRCAeQFFjyp+z9eF621sfoLU DgWp0sBDtaofYOtsdwXIXzr6vNCWBBYgzbb7B6JaFs6xGbrZdkoUmDIAj85Gb1sFBJelIwQh 4e9zxj1W9XRd+9ZSlfypgwRTTzHYtbQ3Xrf40O8gNSWmKejBKeq2U5C9VEMNm8KKdQCGORHd 2jqWmafgUGv2bsv9Ym9BNJNN0FaB8ij42au8gwzLz9s9hC38F/IiCI9Wjeeh71Ona/7O85L6 2RHvBN/+QsQwsNIv/QW542FSqs+2lqVEvVC0s8lhVdyw8FGUP+AY2pk8OoP6NQ4ie5Ye8GCs R0Q5pYRfnN+9SLeN5TCwfse/fVMr0TZMWAcy7fW4GfHR5j6e8fWcirU45IOdCt7zvZ3sYOjO voQB5TtLMxrgoY+oXPQg0brFWqMmSRVIRIvBHI+qwBWSGKluJ+fMfAT5hykNdjsq6ENv4dG7 PSFprj3/VYXUs8oPJck9V84BE9GieAQt5y/1+W/jrkvXv9znT75Osi/VFdgzuY/8kwk5DtSh elz3fuQzH4Wsx94mzQR8L2h/WULcKdVAb1UStxjfDMhzrdvjWpYNNdZA2ZnJc1+ez1xBW2qO bM307ZiGGz7Kj1b7LZ+vHytlgBOZryBMSa5WlNwQavrIYzgDCFsTd1O+nfzFgMSBoGjHi+b5 n7nhljOwYpFj0zgUbS1O9qkP7+vUg1yMHkIBK4izkC/iXu7ke5LcZFGxz/GmJUk7qiQKxt/Y 3NIiMHHhTXQCj0MNW4IkIEHaIFfBTdSw8msrTPnZ91Y35UaeY/wk72SJhrad/YU29wRGQQi+ FmtCyh+YDJht5UMKyiRDgRk+DJ+XSEu9uPftZtM/54Sd/vKF2ztFiN/Pk4Ote2PCyaG/Ov0u xi5g0e+KmCk2V48SxKXN+S2VcuoVOizPbRsOPs+d57/DhUXcFbeQ6bMFb/z1JvU9p1PFaera rvxNyzYhPAjsDYQ98m+ku/9SywM45CiEDbPAxQbs9fkIsTuRHPyKDeZC/iJxvNeX+pmqphfS bZqG2ZokCvlrt0oaB78Q371Y7RA7AqacMVQyXPly66b7I8moXTk2gC1E/okURBhW4qoChvwk LCrjEXVeY6YAB25+X9q+eIrITQLU4mVyDEJZdJ+bJ78Wg8xbImkTDCMa0xGrgIwRVRZ9GQgH svTM8zmckd/M3c8m5DvmL8lzB9mvlrP8BQ5FRYWes3uVZpC7YUb105J5IiV8a1I5sdA4PXab SqwqtO3S9XVOxGrixZdsAC09gQZVD/wKspZhrBB3dIkDNoXbvkAWhYG7wbFT4Tv0APczHr7m rwCZ7Gqidn6Zt4Db9hHkJ2Zxl17cL/vKPve46KH0VCPH7pF6IdsnADARd9pw5Xc7RemH4si0 H1Op0Yh97NYdfCN1vApX4M5J8ngHPI5YbV6baHfUY++nOl0G7pnY0vbzBwSpV04AvSHJfvCT mJvRHLDFV7r82069vqN+2xkwsqhGQHxtBHmG8gSWichz6L3tjPGHS3tt5qWQcc1KlzTmJDQ3 opshlMmKbjNTrljR4QTWql1aqeGZXOQcXf4AJyu5SBunbTkE5IPAUHBtG+Myv8Yj8w7bYU6Y Rq3M2WQrlmYhC073XiV+Wmri84teNQSa+almsOtUO7YollLYpUhzFMvfl4wZZGj5W7tEJ27L zSenJVNNUO8zcnu+4BZVT3cn4mHKjRzHktYgeWHUPve7wYvZ9uDhReWTgJRQk0DNjEaj+QYu twzbz+4YcsPc0OH4U1gUcBJT0ur1takkUsAiGS4uIOUxdfkgxFqo0eUhIpMK6Zg23ArfkW/H ++1If3xecSkrZ4WaCHWJRdtCOElOlSjW8/ciZE1Sn6LOIm3Mr26p/kI64i96RRMYw9Tt85UI q6y3d4qdAxE37NFsvSonpVTaMdt5BGCiFE304dECN4/PBfxUBdoNziPjjpdE0MEbPXIr/LK9 lcqwU4BGqi94YxKarr01eAKXLIi3LcQXPPXqUY5hvF1Q/iD5s9LaTXV8nCcVkap6DjYOkfdb xkh2L7tnXsGUtAe58kn1FlH6/J2z1I3r6G7iUiYB1ycxXX+PrrPbDbgqGVDPWSrngBJDL5V2 HX1S7xAZllI2iyi340NQ1F2FYbhauziuHuVuO5UbzDcGJGJOHzf4pwmQF2Pe+NMHqNNig4ac jF2YR7aGAe441/VmF8EW1ISkCn5Nl8LO0a9wnb98ebyr9XqGT8JWMHWvQtwAcip5U2nY9cL9 c6HUx70xkpaffflIHqOAIT3Ya8QocOhVyJoAaYmAggjoU3p9jO298ye9oUCdOpvAPKe5iZsx VdnMhGzH8Ka6Zyowr1S1IXn6Hh/PW+k5eLV3qJT9O+BLtwdQ8V/REZpxCIlSfTQK3ywpvZJY Ol2mJGtIrbj0wD3Yp+w+YksNys/KBKpKniz4pUvKShAN3ef29+hRajsHbNi8PISkjm6RrIqD jflKhHdEYHA2uaMxVXluApgrrTVFlG7/60nkR/MZUkbXiNq/fdkDLrqRuirBiFzDGP5GSVAi 5aZ7geQH/mRW9JNAeE/VTHDgDdHkyscepwUgMT0/9YDb/+O4ygOZ8N+/GDbnbNKcDdvM2TbX UNicY+SOSO5cCbmTMjOb2za3EHKlQzoclfuY64N06KNiraJDrkQf1c/398f7/9f7eZ7XdfaJ Td/FShQimdsy/64bToprDLNgNBkqseP2HAik20srslUj2sr2m6bGb/+mWgGkDJ/fAr9qKRmb r8gNxn2khTb1NOJujH49E4Hb4kbh3GseBjUm3EyBB2QlISvbvRl2HeUpKixCA4Wn8R+PZRAz b522/ejhwzoWIL4y4FHjjkc7qU7osTVEXaBpW4hAYr0LbYpgLaHtKsQ+uWld30sB+HD4SI6t e3AjodWtsngqjxwiRasd1dpTZigH0OeDRkymFj2s4ExtqS+eZzLG/I1vXg7oANq2HZ06ATlv aw8nRGV0O1ARCaXmdlHZy58Rs6/zEhpJZKYtpRaxKa/Xba3euWV3mh30aKjtpUIphmPEn7b/ DnX1PqAljAxQZo5GWtmOB7VpBLbk7rSEX6GntGYq/3NCtVRK1sIO90xQhQMhgbs+VoxAywEq +vB2HYgnQhARs3sq7Zm1KmTft+lqAxXx4s3ntJtuUW3at5hDEvzCJKfHRTn5DWffyn/U7m35 UUmFRFT+VMWfCwEJsFr6YtMonmfp1azZDBxHbIOMAlNyJgHKsb6NOF5xKFhdrGg8tzix/sOb 8+7SBwNWP/O9U7SvcuoFPLaz0VaerSdDwnojVVYXPUweHkm4SUO8tedy8li8BTR/xDdrk2cD sQ4ExrUns5ee2al31jZI2g9ot6es2/ncw2L8z+zO+M+tq37CKFG0OmBD8AUQx4NuQEOYPQ/H pbx1vCCp7k+v7nI1sax888b1lhjWAsEsb/7OxRUBLV+kPp+LTCi2UekwD5L638F26BvPvV5s BJG26+6XIJRYY8X8dBIFwXzr6eSyJX9i5JMHKcyJ5fsysmTbnxRA2kVqkhxZH8CoLCBris+L FDAprH6wADFKYbSrqki/keyXWENdxAA4TKJ/ak2G5kbb/4g88bd3HOwQUqfHgqucURkLeeww lPq8RTkWd5DOQqOgCTeRhp+ZoaBXd3zm/wOo9GBH3Ul1wX4Nhp2pzrYQAmn8As5OrmMo7+Wz jgYQ2bgMM2sErLq/H6pSqANwluchKHHJk3LE7aUrpOCGQfL0t7phsuSbPUWVtawVfZW57/nv e/oL0VP30+nBuimazs92TAMREND06XBXVWYo81h8JZc5z7M+zxQkbScwi2sPpO5jcWhHxHS0 i5SNsW/OGW4MA2V0xm9uoKGeQ/h6oz6VIwP/EWr2B5p23Nr03X/CoygFeA6soQFrXQgkbt/X +eq2rwGIIsyjG6yA3W6z/h6ust+wETCKhJS+5df92wYV+um22zcbuZPbRWOgg7bEDHhkkKYZ BXWqbFBl/GRJM2sNHSgQPDI2oqLidsW7+84kdSFvt7rRvfDBmzRkJhINuoM0qv4QmQnSvfZb 2T2nwOCPJ1+QPoChZQ10eQa7SFwUIZylq/AKIoCMgShxi3mJDVP3WxOeCnOYhu5WJXpoT3jl 1P0i+pUz//AYAHPulVHwxaMMS8Qh5th5FURRjvctQNsUwtt2U+G2GmNbyBEksWGV9v6GnwXo MeTV7WyIvr3KYLq3S9XLAea3dFIfVW/hqF/chViNNDYQIdAAItyv+hfaIEoUIf6ZsVTuQr/3 t3UI3lZTMcAAaPSaCkLYiOQ7ZfBqR7kcY0giR9Fw9W++v0wh+33v6Yfti0LKpC9MT11SPin6 e53BxJdbm68rZAgkPPJf5zqt/jDTILymVlH1S37oonedYWlbiNHOIJ6e9S+8ayIOVhVnsk/8 +4/EUXluQf7RHIVGScKkXTGsAdwwFehUxGGQibaxFuGwupbcP9bUFwmuOqpi7a666uUHiASK dCrDHDemFehuWsakihcvHJQZvoeunWdaQm69AZD0nqgTGKUXtHq9GHZOYjsyD1Ba2B7EMLIc KVPWoDWqxeKWV1Wgtv2PgeEnTB15WYLwm3xhxMJ8+GtpSEj4A6LTfPyxoPTCaIs2jYyaHhaG FyfWrlRkCg7rKAdpPj4sF/E37DDiyZsKInO+hOaRPBE1w9VAtJTcLDyILWiAvZNLG1MG+drg GLpdrOlkjFwJz1hiLSehJKjsvlDb7kW6/fpqAMsqemA9KBHvNVM/agNr1v+z+5TjFy6SAWzg GzoPxrcghbwgQxTwF9HZkUJ9KpzV705fbjZoEfuM232iseH2H96SVS6ebjsVki+hwjdRshhy ostLlbTNuoroPGU6Jw9Advqkidp9BUjoaM7eHTr9afaGTAKHiURiFoRY0hWRDZwrHkkDfB/I ll4DgYQCbo3ObpEA+DxqMHNCojCagAAsWIK3i0lGI5+xRPCJ0J+HosRbxFtLxjzPHCmfzKEc +N9KXAEGIJz45GGPH11eRVOMYd5wAEb1GqeIJMp8zfT45vEdmf6u9fcteVsKN08eSWGqxcjB CIzK2xHojaeQWsDTA3I4ZLO8uPEK2LP6mDA/5lwVxkGG4Xido4Iv8gsOlgej1fiDHR6Ybt7c HtsNhcLEzR2FwS3DbNjQBJYCdouL+VL4AUsrTHx3ayrY40Ux2hJMIQuVZnlqbO0GuhSnK3KD yx8cJB3KeC5S9/Wmb6VlSfrYBsEy/d7Y+cWo87axGQjDNJ51RF/MSmOQYefgg4YDZwbaVVsl Vjy/4OFUpx3uMUDSIkg1NeAXLv14eMot1mDAcqsqHxXRz8EtLPRBPx6XRUd83f1u99WZWfqa TyW5cecqW6dwsmBKiq6G9ZiKV3su0i1HRVB4x60LOHHO9HM4jjihqYeqHNJyG2N5s2cBTBJb 5S+qnwyJNZ/7ZCDFLLO/x1wsW65QOLWqpm4NStOzn5Pf8Pl3P0TAru1f90vzCK1077lGfMCT z84K2ryxxKLFM4cxUiVtfYgeVCZKqSqoan49SNvUq8ApSPKDdrzW32RFxYivtv2jdttSqxOP RNPuKwFdytiDbHADvmVCTwignjwZQm0gjwwUooqLBHS7dFxh92xDHn+4lm6bU6Rf2JaJeKmK mpWLtmeulJS+uK/Ark113aoUd2YYlsAHCZ5cdccQDg7DwXCKGO40/wo9pUi92wvfWe/lZ+UR 366US/WEjKTQn/rLO4gVT6n6hmjvXmilip/4tTK4vryXM3J0RNITHl5HE3ZRBfMwMhRLSD0W KOf6HEgwEgoTm3T7J7Bu+EmSskym1v86ZINe647YrKuu89s3YLpCmMGze0FvkKsWzBLEGmtF 36bo7djwpssTbBPArCqYwOAZ/n33tuuP7T0fK5+HpTlYCO5YBvhh5OpnfqGncHC3zN+/76ys h5JDQn4EKl06l9hhGuf+czLu1Ke1PQfLKtcTqhoL16nPbsMShx9/GWdO+lZiZKEo7zK43sJM g7fi5fnX4tWRipKaK919T0NbF1O9U99XVvIXaJ9wuay31/5hFGmOIKTePXGxUIxYBUcRR0Jl bRZVRZ2rKy6/WQ5i05o1n73GXSkwg1xX1k2SfaacqWxDjwuPXLsFV2cipqa0mUlHkyDIl2hO FCaIdLrqtr2IvRB5ntMe80AWtWmUiXKoAqqFJSx+i7vMnOLKywnGx3f82h4u+JSqhF8V192/ bp9guYl9NvjcZtjmc0E0Jof/0AGeuaE48blIcjbYN6wJH0+0xZdX06jFyVXKLyo2LHnAohHW EdaQysv7hjm9C9cbEjL+St6zlBHmaHKZivbsp1H+3Oug1GnFCi08qHrSXF12vBl+rDHnt8Dh 070ffoNdz35If5/z6L3kqbi4N0XtYUJNgyZcEfRlaeBIfhhu6uniUlYwfHCgjW/DV+x1VxzW Eez75RiFTRMzwf0EM3FDbZNnFGMnyRnDt0ygtnZvW6fFzZ4UO/hNkGYE8z/mLVRKI7cNXT/b ZQyGRHPOOJSMcf3IDlrtj6mXqyJFvDXPpTPsoRJ9MhVa3KEMz7wXBX833/99egFj8vo0lWJy q3qNaOW+a374yosLMQaLiycvxHkBz14XP05M9VmuX5Ukd5iYGfCVk8k8+O5dMJj6cnVTo8fs 9yvLsdDPKacSybS4wwOif40UAnAAD+ujFlTZDtFjFjS22w9gkTdM9mylbUBN56466oM8KbWa 9/LKrVpqTVxQHfWb/C/5C4KXPDa//92o0dYieVEiMgy1+g8PTENqMKSyyFSJBkaoSzRlaYgJ nR4IkZY/3mJOYtwLZRer129GeXzcyfkuUPjN/k1q9MBIZ0+hqoN9YJZ6wbzSNSW3o9knoUfX zvLDlc0L08cG8ObHbd2PjdDG5Qg4UJhK0GRJTGcbnFr6u+NOhEUrU/n5eKgptfRNS9dNUJHf GFY3ccm59yu8vSAqE+FPjrWC+PRlfRS35b/0zIqxV0mDSPSkrFWwkAYmd/6R7dO/PIcseTLH w5NH+q6qsO4aHUbR/VocHuKvG3dxGbLVjU40F87ZPpPGyHYK97HXEzPOkVNBS0XiBiMWHxx6 PJ9V374BK+V0u6XEpTqlmV+5K8ziDxKybYSHBGiR3kgNCU9gvGTEy83+eLsqp4MrnT8IJupY YAJCijTudG+Rf2AaXJaRo46Qnrjvzsy+t351CMsDiILIhYHlXLlL+H32IXLLhrHCS2T1Exxm YyhIGBpHu3VNl/YC1o9yUMEvr1dYqe3ap1nVoPMcBlmQG2HsaXbL5cXxmLPtGyv/OSN8A67M ON57o764Uhf4OMzG5nWJrFKekuBRhzRPyZdQ8HvhX503+ZfxQCSwu2tlGC6cnlMktJEgdqxI mbBP7Lny+8h0072bEcB2jKVjyH4MMCF4ZkFccwtokV+eDFErYCEqDG+ii3qX41MVkUZ1H1lb s5Ilw+VekAHqmeVGctDFdVmURYVbxdcYl0nHTySgtIAd0o7O9mqcdOsaLtZauHy590P93umX NnlyooYiRhrGkw+TQrN7NTLFazKzxQ8ZNo0mHb42P6piZi3auGWhHH66TAhMKhQnHNwLkHQ0 cKtFk7gUhJJlxtC/FH4faTSDboCS6ZfKBwvVZOsu9FpA4tP3VhEI0mQjid3Z6+UUELj1ThT5 drD9/pCWhKdKQYYodXbUWTVr9Yt1OfqqouknCko+PgBfZNrFnw29oXxjhS3u7nH3rs+dm3u/ e3EblMTRMB1vdD4kofZf7optgs+gwOuMGkDdtt6iqDzGO22sP1oaoS32iUOk+N1VfAKTKO4f hhEmR6jADbSl6tq+gnsL2LfdRDnoXLBeYAJsU8XX509hxlAgc+FNJAlSN/Rb3PQ7cCvsut1X EQXxad2kB/cb2qkvhTOQK++lWYMgaP7Nw8EqNR03GN6KdOhyQ4+iZGD5SEpH0n7A8zsL8+jq iRehJVYeDePooRv4rfQzRv8UnBAo3juX+HPreWk9Ma9c/lA+UcLCBiipLslS8k6B74fuwg61 7h1ZKRgvUDSfYZCgGb65sWCJxgQKGrRshSOOdXL/JvaekaKY6wtNoi2yi43EugD9N3vX+Uh1 yaw6y7wlSLEbOzpSCe28ZucVEMbQkrDxvW7PLk3yU/EPgKI0yfPT/ZlG11BR8fxq/gl0aHD7 Y0+1qzhocAabv5jUCta+ZRlzTp37z25fLK7ubI9i9H3xK38NDALV97MNumXO2WQK38oZyjrX BIPXX4pJzd2v31AVIuBnqkUQLuBSOJ2Ad6UpNICHInOZhZDMWtUM/HN3W5pyhBzXQ6jos4Ni 7MikrxVLmIRbkM9mrryDx/+eMutbgidY6Xr6gxQlgkjteD9GHCnoTlQsuaxZe9LX8ZVCKSoP Neaw+Nmt6u4dVx5H3ykXvZxijfUKc79GubeFG3rqHtrTwY67smTUuV1zZu3BkajEz11CuLil 79Nd2B2izd33IkoOqT5LAnuj68e4NpZw76twm3gQP7QeoV/nJkU1sCYBaa6Do7UtOfh4mKzy 0MjESpABjofhudOT1rMuMAH1Yc/fujkPbOhFCH535t7jUZDdMsL14RgjCOowapJcoedsJqwH arI4MKr041Inb18doMWES084Z28QbiW/+eBkJxOifUrpUUDaT5OJiU/le87Vl5dH7CSuD6q4 5qd6PpN5OV1+MX0HfCLkh/+O1f+jzDL0h6U7XZ0ZaJYK5EsHpDOW3TRCxgszyID0PELZZ9NG OCCmtXGimZj6lOxojUPcmsQdhZR/nlWWjOX+eXSGNSRkJ0Tyu+DDXte1242xUUTCNNX9GUGk YI7kfu0hyzu7fIjKlOFz8FmeXhl1Sh2zMQ/Qc7Y5NzPUJmGmBML7Q+Q3G9ap5u0AK8iwQ8FC tW3InuzOzqVudz/BCbTLnZdTaS2bhkl+W7g/TpBABYemyAtDPVq7jwcYCjjtj6fHJIaV4nSu n4Bd7uspS16+0YkyY18R+wvZ9+SjSMfzDZ3IRQDJuY0uG+nBZfbi4jipocti7mP6xIC+SHgD p/D82Y8YnqlC9a/8TIQ9T65uSO3jjwX+sGjpnrlleKJ+VsZ9gMCdu/hdBf1kBR5yzPcNz7ws KYAYHLCnKeD5qyoTFWucgUI50llS16jHQdV3XSc50FPoPLSuC7nJ7YZLFw4kc3PBYzRhNGJf e6fnU010f09/rrX4J9pPr0iXN+eGk6bSgJIaBewD27NInXmMMIUfwB/r1dr3k0dJ0y/BhOn2 YETLGGEpQIiwOIIGYaUosziDeFVHbesRAXexlgqxhRFlm6zjgrSm3j0hUkKd5R/araVsSITQ kQNKchxKzMvgl8XLbMujA7Qv5xtmZc06R1H+RI8yJlhLpF1FoPRUdVwdUP22y/ojTOf1udTA eqjhvoNvlN0sN/rUy0QlAaW11Im1id+ZE7KrGMdX7w7t7IysE44uLnkudtgmSicAlaor67bm VvzXkOtY2piQaRI296dfW579oQD1cDS4Ad45cBbCY8JDRz3LXteDE4JkqFRWV4lylvLJwGWk 2d1agKpxvK8SifSrMoIdHe17QuGL8DMuHRn6vkyHcLITxAKh9PWK9NRfW3Zx7hrToLombLVi NQh6NUnDeSWFeAPmCtFwPFzZV3Avl/hmFjnRXfqf/fcPW1M23/S4vCS/eXpVYK3FUvSgynP/ FXPe9XztEMcP3sAC0ZS+x2I/DqXaprH5qCDbGMykeZuk6lXpA6ZC5XiSMjdar9tTcjEP6OAL n98SbFnKE/SFdtwxwiDLrKMQ8S0vhyns5KIg8YypbR+dGV2mgER9jF33uuOGQurFhOFCB7r0 Q6Fe17QdF9euqvkniaEz0eLqI9Ki5za6YB7JO6I+PeiZcm3f0VudX66V85/6+eWf+4FXMp/+ Aw3/ZBQ4iMjKEHg5LmgsYlJ7nF9ppWcJknb6yISpwe4Y34+TIwUa5vNjN/ixV9GCWGhGlA7L TS/QFiyojKD/V9Z7mJBSZfyhxU05vbCEpiC7iRB6u/TvTwTIOeCbPBRJt+vW2FgsLt0q11q4 O3TvlAjru40r7MoIpaZlZMzSYPRy/muj6orQqFvZrD7QZP4Eyz+x+SQ/+rqTX7KWpf8zT2y2 9ZpN8LKc0vlQp1xx842pPlzCk5DkY6KvC1L6e3nVZq5rhseqzn34xHgybdqlHF3m33IvYwVs cvyH51LR9tXkol9g0+z9JYVya+cFqqwU0MLNq4zurE4Y+V6YS4gCU3/DfmJni8KA6unhBsFE mgLt8SFp3x3pS+xUroGOXWceRNIe3zAi+iv1IXVWs8me/QSXemv1Zv/Q5inHcqeKoPDNd3+h +L0YHqoi4/ko2PyaH29ogDXO4svWOhnOpkmPs6+K3OGFebZ7BluL2htqetlUBlwZttjqOHV6 /VXh8mUvf3Ds4BOR22TKWf96K1ajjslViVUJYIHTgcCIngCnuaW67S3/yfw1uNsvBsjz2fFv zcKCDty+UetMbgRYzZYOrhEl2IzcKxRUtqE9buO9W23aQRShy3/npfRbFDfLtkVFFyFLtfxV 1fwDdA7eHFUqMhw6XUFHLccTr5X923IcVEslplti66Qb/OwM4rPZ4+jjbrXnNSZjvlBufJHR /Hhj7B03nS9TohFKh27pKl5yUe1y1hdWGxZT5Eg80vYTvigp6pi1g0lZh8B8suTXMnc+yJit 8VFdW7wpbISlCvWK28djhsBVx49jhYkqA/Y1BraQ0rcY9S5LztdohD1+XSOnI6lqdnR2UdMU ++tnVZ1hJcs06yJK4aAWDg0zoud4oGQXgIjiSdVsPRGak5yrFnn56+VPdoU36gQz5d1zM1oG 3n2OupR3F0UTt7AOFfd9NcAajVM3sJU4opipYJ4VlyUqeXcwV3QZe194Rfk7biir+1i6pIFf wq9AbpYXbKR51X9HDgGsw7irIFLFKrtvEyWIvqff1Pz4pGRNkrSH289LrGmpdyMEoH0A3e0M pKE/LoIFGRRRe5wCW2BsAPy/rnzTq+3bBDi/4vn/+4oijUU2E1uYnrLPx+bamIJCyhsDsQ/n 0t5fY1EuPQlf/OUlBesOewU3nLzjNz3ImY0TXlgeV132fy2w7bTTvx44o8ot4PSKpekJ6woM xc6rELJzulToDHCl6N6WQ3W3s3KT5paXV8ynYX6kWYG2dz8GP2l3L8PCHdKvqTUtaB/5FDAY XlLGh+rA+ZuM5jnOopQdqdAH8RS1GbXH9CRgdHwiH9uRbSnilm08KnT4lIbuKQz9gneLl0KK +sWjgn+shb9xmo7sbMWw6j6OO3nCxN8LRZXx4HieJzEBjhVf9h/PWHdaxy4d+qacYptqexlv evxv4Z8luGxPZ8bRBVo6fxgfwyN3iu1lGJL61ikU/AoGVVYViaEuQcTp4OGWSSJEWc3pieuk 2WppBmL1AirjmRNuAHIRj7LH6RSNrqLUqIxBBI7FvSjigI+ow76SOhh0tuMI5msfaAD6ngFi 1zmhnYn1fT8wNgd7MM78Vl0rAjkc6ct2LLlP/JqTX4kOVSI//8Pt+e31+0GkpMWI9j+O5768 al6E4xHG5geJJH40Wrs6xSm5bBt48IHmvbqd80uDv3PUmt9S0zOWkdiMo1KU9blurJMMxJLU WoHVJbQCW0w/ShDzxfZIYTFbwzXmIMXpEqR7qVjJGK+ZpdtvaTp6g/Hz4tMjDghHDcf5F85n z41B14e2SfyZIsMMrlzmQxuNTDK22all7LenvNEHkcY7bZ6aZ9w4vi8f1oz/ael55opUj5Nu urrVntc6Pi+UNai14sd6yMxoVZ3xLxeOFC3O6lf93+1u9OesxMm+OXpzv/BPtABUig6g/8Io wrs7dYSJa1KI1EnC2BTuN+RpkjBydiAm6z26XWeabl8xSjiJp5IyGZH5RFbFAe/lfCxETJYt SVo8zhLoAOWwtIjc8V3AQ7hIoPQvJY706aP1doPZnGKwFqh0+sjzi+wkozLs3d6zaXAJRUj7 Ee0R7ekBA6ppoMVEpfw2DSSBlhC8QbdDGs9E+vueXkivzhlWGuyEHa89IXQCYYr5jV0O9AFB /1jtO9E0DtWJWcpYiwD4QCBK1FoJPCqQSA2qSAkLyhfZg8DrLqbyIWPxiV6U6nWM0RHMLJuR Ol2IIkGNrs3OLSwBFjj0gH7olgnUaXFLLA9iK+UKdxVxy9UYyL6Y2aGOPnnH/av70/cvRLu/ 1XNrTENPvk/kDn+WXcodoZVLRDXQtmmd15tV+w89Xz7wh+iEyGWszrJhCtzEfRc7b8O10IUP 9iLMWvlAoh0CB820/kigEfDMZAkcdaAHTxVcFk88s2cHGeIzXobE+JR6Hj1XppABopJcUSJ+ wmS4g5wDL07IAe4odlA6MOImixLJdW+nxaRL0XARK5FClUbzJpibiDvCA59Z8LYgEmz3vNXD pBh3IYJxbPQQZdVvb+SXefLmTh0/DRpYJTdEm8hTwaONAPn+nuvlTUxF2+N/JhawkfbOSms+ tB30NnCLsh23pLolKWpOOQqGdzdHUZsF4UUUMPzFlCLpM7HwPvb56FfufD1xzeNr1m+aJcc0 cUpJIohz2H6SV4iU6ZUj6wXj/CgziDBmB6q3pw/0ZvruwVybnXzqOq0PuZTVW+qZjGu2ENvw p4AyR7Rg/S4cmcd6I80D3rNmyaOw64o1Jhf2H8QovYY3prkZj79t+yK+7ZkrP6PALzxG+Ie7 gnnJn+CUjDgOrvrjt43Zik2X3C2VugozW/KbzyzXmlzHuFN8oA3bgbetxghjWcihQbWEPAgL eURroxojb1RehidPfoRfVcQQQu81MYbvCqjB8OU8zoyaONqqDuAMq+dTF3OB3YC5ubQCNXVO wdqkp+qe3rN7pVX0Un/H99u/J2rv/qaYedaQRneIDFG1kb8V82A9BflMeZBEYUarwIo5t/1u 4K5MlnBVjs1RkuTDC9qmipuBE5JQONA5i89fKFYAjnVDid8DB2kebF/p9rzk3zxv9nzCepOi ffiu8WBDCOrFdExF2bPyIYaVWj70E+O/ayLSdmy4SACboU4+l6cxrzF9mGKFAuZfrQjerzgX EmHYl3O+b+LbFCP6v5519yvT7XfuCBVhDarFLtTqkyNnmsvemhcMdxKiAUYIE5/Eq4reSfgT Wv9Fb+GWB/ft5WCbg4dwgLE2824GgdkNCZJRNpLZ7MgolDxJ+3RyXb3EckekhIoJw2xMDkFf FaPuG+cfdIOyBX9p0WqnGi1zUF3nqn9+HTyTLOW2dBlfSEEJZs98yAbYw5QBolpvY1gf2lQP J7/14F80nq6Zmd1//Ccl6fx5DDrQ4pxI5fSRc6YGT6U0JF4d1tWCC2/lW2ZZNbYc1zgemfD1 0coT/InFJ55pIn9dfmRtDQrSm5rvYg4VelHcxGOBm6mH0w6bxQggo2KydTh9PANyxWxMhXTM vSXq8ZjL9/gFIYLaSuTasi97h8hF5HTH9qQSxaPPNOolvApwBPTJ5+Fzgj9uho/cOrLbnQj8 uvMl8T/VvckkxXdfFaKNX8flU4SuZQdmLILxIkZX8zHauWRVvczN6E/EpKtK2zqndmHai41m fZKSzgu0Bb4G28Ji+PCIgtSmOx+XYbiBtr+nFrn6RQlF9lN2kKn4P3a9Ppzp9v87VLoo6ppI ZK5cTa6wNBsyW1cpFUulB88jmbExTFjGuLqU51Uq2TyEJJdn5ikPU3mImeeH0UqeNoXE5HH4 Tbq+x+8+jt8/93Hff9zHffjHzr2cn/Pzer/fr/f7PM9j76P6mfrlvF9MJgCH7x+emM5nqT3X vKgjEteLa12mvkrP3a6O3vWe/kumecJzeF9Z/3LrAiKpS0YITVRwMk93BDkngByxoj195Nr9 R/v1n/r9fpzj+fpdJkds2BslezcjFxFMxQXBpXYT+OfvKP8Fv+SFniyVf/QIFDP0sO1Q0dFL R9Qdf010/D3/COrpm5MJPgn+csvUfMMJubdTZ5+dSAk7DLgsZfHHlZNZF7PLbAuCvPdopeFR 5flPTb16T+WtLC8vWYxaPq/RQrd5bN2pvj3j+MFhhzvO4ia/maQ6YUxiVfCVNa+2GmHt9yMO nti18luQscL2NNXCo1dUn/yF//3dtj8v/DrT3TE0p1Th0Lg11iv08a6nZJO4ojvhJ2OfnxsB 7bgASvgbLmb+3PzXw4BLUpflnguTjtc9O5g5ZPnAWvFQOC8DduWIXvAhvSzcpJvoQF5mZFW9 PUbYbecSFSuuU3+m4a4SR+/t9g9NwJ3KPprbDnSIjo0L8q/VPu8ZcrpDfYfcHfw7Ui6Eu+Vd 8dZMbd7uEd+UQAl0YNQhOdHt5g+zV7p97cbX1L0ezmyFO2Ys6AEu/n7prBxA44roZvNF7l6E 46GyN5Z1sXuPXLuq7XEAXE49T5BM3E7KC7TgNroI0sh1n0LV1FJCgn3w2DvEU12On5456njv PhABlzI8Dn9u9FBlh3k64thq2Vvq6ZCtJ64BiDtmdnkOHiJMw0xfsbyePtry5OglpOSZe8AC mLaqbFZsY2NeKVzjhIZxyhmd57ovdojugY51/QjNs90Z947sG1VWokyNv+jxNWr5wiReobw8 EKfQntWfk/xgj9PEjuiau2WDn16OqB43E11iT5D2wUtmy2pN2oE8B7ew89JEadV7qmCNPMIX lz9M3RxugPjbzZr5V2i71SUOcX5VD0iSCzn57Knxb5eavx8+6/VCaJHRhDS3VQTSB/HnulOl 5m7zqq8uZX1lZKCufXsXPHhSQl3v0p0D1rhCzqNMQ/nmf6i7OgOdJAwjZi7imxp1OlVCVU4H 3pTYnkzd/8tZgKpNcJfcc7GRsqeEiJ1g/6K9oGnFs/oLoSXm1ToQ145a18sJLXmYhMPhK0dm aoUX9hymWIR3iPY1n5eWJyKbTp2N3GUBKPktp7u+SUvPnlOd/GU1vGJ1ZzUY/OYU8k6bor5e 4ueo6F+UL8REyJhl27BOO2XsVTl/gfRL4j3gXuChtRpgTuSfxwIr25LZUs/Fnu8Z2baW3kIl px25aNXxd6M4IBTUq6uTpZZg6XuSVDj8S0iqsW/XL25nUCr0MiAz4rsNiTsT53OxrjbCL2iL PN4+fxdY2jm1p+qc7luHatHBRXbSlaWNtnNxKt1h0nA36z6+MyC89Ax7MOb0mOeH121vBy+l SxbfO53x/F58nDbSY+btsfu4YOVfZqI7Pj0mLGubdfAnsB214dFv9l9IEO1BKFFKhsjpON89 f7mufCgHeOTiVU2CjcZyYvbs5AOI43IduS05Z5JlaqhdpgB5k7FFZah+a4zqvbZ2zmBT2utT s57ktkr/pd/I/tLXVw+JyubwlpHH372DhLe37Td9dcwqvdEY8N1HXF3L8POSsVjEETkB3OP2 I5b1sP87OcAfp/8RJu7c/UUnKFNQE+k7YaPTkHh5EgyPynCTHA1dVlSEwIeD21Kva/iedr03 b10vWe1Q0spDNahTfPx9JtsLZYngEGooUOY+xp4eutj3QLU33at6ZkIKviX2ICoK5HgLkxCm /mHq7xM6qc1nz714evFc+kNb15uK3xWhFd8OuVV0LUfKDIcv/RnonHrQY6zb85Rq/67jDCel d/mokR19v/mU4V5nHHZafkywC3i68HT60uw9QZr0fYn7Lqwh8prptWdvb4JRE+DYI2FXd9L1 y98CSuHhcrqk+rsDr0usAknljnm/KpcWHz1ic4Z9Zq+5ZDEX7Qs3cuTusjWr3acur247ULdT xuJAuIyTyZtTHWoJrIMIs8CJb14L0w/X1vguH723HUe9OhgTc2GveuTxxRb/h0ENW88ffjQd cI3pBdDQFhVR7mrU/uxDVn2FQ3WuFtIrVxtW/xYgPHVkXnRCsHJZx45qYM6kbWN722yNO+AE Hi2oUSu+p4f+A6E90tBK3UJivdFv/S6U8nlq1vG7a4dn4WCjlJx603aNxxp/PgZde2aVany9 zF+nVzw5xkV+drlTr7dildtZnRSt8ceAASxi6Ky3XPfg2OEJy6jIFeenKWuVaq1VxZ8pOo3U eKC6OKl6S4t55aCUmW55feMT9bqpv09q/DoaF/Ko6dFuEYNI9HtuqnbFnpnCyb/Dl5LWM2xa 7rsqOke5GyIoKq76JebXWycCno4tREbIuJhcFR0Vtce8ZIH3gARLaX6mfYX4PNb7kLltcm03 Zbj0C0dfNZSOLtFyywojK585FHMn86xC5ctnpqHMdsdtoTF+LpdbfW4Dpnn9NjI+ur5b4ceN 3lRozlqONAw24NZYyckU5l5/kUSjQsVLT/gebDpkEXElPPORdXzxDa/KrC+sBpU7b0aprXl2 rayYO/vtPIN/E7ukA/VwCqERFh99s6xivW5YXkEjW4UfjxztHHGJ7Gucvs2Zz9R+eJj9XTex 8OxeOYdMlLLHP3pAmukKdF5gpWfSeW4QvizP2Sf5eqfhDh+zV8My8BcTcmsqUyuEoKS17BrD nJpT+hp3XU49+uvR6Yyoy1mH9AOeXc620Gj4gOpGLl6Ed/tctK8EzkGSCvYEys841eP2qigN H+NU5i4YrnQmZRgd+dZ33WFloKpT/cDhrLOZLZLOJT2qwM+hEQFV95GtVd81tS/obWvQt65p v9lQM8F14K+wZ4LmKEOCv1y2Id5L4VffToUcU3PWQfxRdu1O781pKXvccg5w+vorTiu/4nW9 /44zeXgbn4lHDQXayZPIGVKKbIG4YRJeTa77osYfB76OU6kt6f8sK9xa0Zadav1UrwEmTP2l HOCrfJscttbB/z2oaS9HYvR8mu1F5/HgnlcfeudtEK+qebwHofsVMHWO3gXGyFFmP2mySBx4 a5t20+jd89Mn38vx7LoLM6dKg8ZmGMJK8Hyc6fSltckWUuLeheAjnlYmw9JxdXqUwcKoXjD8 1P3vGWBgfOvYzGrO/LLYGqlFQzRt6Nqna9GDuLi6xRoF7V8856Vl4YujpdwAEzQX2W4wWCSO 5khxs/5cXnLeRekBw/0L0Rzka4MPInxACm6ZxSqt+vUwS2C0VNM7D/b82G4Vkndrm0rOl/nl 6rxbzq3Lx494XnuWW2OqeDl5WDl5r77o66fsGquQInGXbS1SCf+fAOhRKSHyu52yjJSzx02i j7ezo/v6iHDDTeoYTF/1qOr6SFcXelTvP7C+3k8YDlcFmzl7uPhgVY/pr8+9rAq+QvJ0VgVb mt9wc3byUQVb3Lrh8wM55+7oIvq47npTNFtH10AVfNbZ1QXro6qjIxqfIuAJ3haejk7OUmBj Z19XJ2cTb0eS6CkPH2dvTwLe0cdZ1cf7lmiBk64+xIvO3qcI7p4ED2cPH1V9VfAZV7xomuhz fZ6xsxPhprMqAiH10xp/sck2sV1btmx582ze3F1GL+yEY02wmMT2nfuOOvwfD0Leh4idPrVF 7H/w3g+PrI90jur8BzwG+R98d0z3f8d3MF3d/zhPT99A6r85T/X/jvOk/hfnfSDR954uGRv0 HfPFynVd2y5pbAxyvn9Jbs+ePXJ79/J9xwaD1qievRHNVbi4V1+J2dZzRvQggez7aq/jhwfG Y5nqB9WKVmfVFcTEt+7YrXoieMv/s4OQgIufED94cunia2j6LcLDpYyD6/9Yy6ihZMOZKxbc qR/fA8w/lRIWKZ5esLWUeZV/KAfXlzi8Dab+ifqF3ZQ8Q0c2SmivY2VxW4ME9syOv1a52WbV n2UHspeeRa6/8euuEHbpPMpv9fFBBg/j9DEa6THtxFV6uaqxzuWZnCX3m96v+Q9Cq/s1ebar Gp3AihmLlb7T62znU2uaEoNefQeb5p89ZYGX79TiASn9wozWfIrXHpEdNVUaRwf4/IrVwzUH JSPhPl2YJJzOrVWDTmA8ZfXyXEr3uOMPI7Ozar5MClNG7RCExU42EpJ/9o1t2GQDhuj2JN3K FyO8yJQLrP3xxnGNbyylpTKWeaPVCCYdhiroe0Q77SqfEp7ssJqCaTexW3egJ2FH8/z3RW3g /HI73UBPqfhzOPups71mHbc8mGYK8QNRaKHj6I2peTs0PSZJdGBdvHfRJXr5rjTA+/enbc6x X3SYpVjdBDn64W2p5euOcAjcBvPgG87MIWiQecwIL664zxdfv3U+2kfLApD18hLN1aDoZfOJ QO6GZyJqyvKoX5tfK7Lo5bBy1l67fYFPLxdEP2bXF2LOszmI94fZDBppouAXXxf7Ctt1Kvmr 4sMxiA9cYIDmHUiPHqvfzJQusu82LiiRRroUi6PtoWVCImvhOrnqP6jnt4h3sslSvJZEq4R2 ejOqB+Pk2gmg49lN2/v9E0HmSex0xRTFxPBk3I1At+pV3g+53BKFsz6Dfpv7Qc0gTS+e7ux+ Y1DHvtQqmv1EARbZowlre6EOjeww/uzNwt8EBZU1zrpuRIhZ42NKDQjQdemjn3Z/kc52wx9T sHFnH4TOU4tayv9pNIHG0w4YDimicrHeBpBjgPzWkeL3GyEDH/065uVC5ZlVNY6iJtLr+kGw DlgdhoRwiCywYmDUoILVPpE3UhtHm182f/0QMNM//oPrd4V9frMfKiAiop1fMF2Y6S5MefST gr76N6DVDIO3bm5DF2sqXzYeQv0NioOoQQLmv7LG+yqTiD+U90oqanmhLG3qg1Jj46eRJZBv Z5Kltnv9nhB0PQY3Tut2ZnNORK4UGUCd5jVNASmNxc1hZoUIYK/0j2SxdAmpfMzXWulzGf6a 9LqRq4krKqCKON9mYVjS9HJoZyEGntV3lg1wQhXtQGnfPOM0NzWwlvojn3rsVL/yFFmaLWMo HqYLFAeL5Iz08YVzgjC2r3UR56SNJs5bQss82dktSSU9HFU01iwNjnqnrO/56dBPV5/gtqbF WSWMobIJ9UO8z5yzSstY0knVknYeB34UAdxd0NcBshZO8TKgTDN2rLm2aWxKY8vNmzIqZIO8 U//y9wIj/Y9+Hd+TsE7jEl09mVs8Pt1ggh/S7W/S7pe3AawVOeNuSGrJGlKvsnPtBKmYqWqX hgiQYWy8gc/Y4zKZhls/U+6P+6XTlYnA47MzLMUECXBMN6oHpNeRtOSMLykNL3lIQ/IjodP2 qOprRcTz7KRM3WUTbCpEMd7T6Pbs058e+TTWXpbm4l2oZ+GRBMTRT+OH4lHVLoK2U8PLYk4K 7jhp+uMe4aE46KIU383NW6B5Plaadv0gxCp+uAEdPQ7d8EvRiY9NVCDSVzOS6N+E0vZIomg/ gVngZ4Jr/DOJx1XyV3rg+5hK7gV3RJy4CKX0+JOQY4L+cID6hSQ4qWnDFs3dfjNlyUzYXxA+ zwGffhqf9KHUZZ5zhn4jFrj7qTxs2p+SNU6rawy27Rl5SzNjA0iaDubwzPDTqGzXQl0Tap03 r/hlc6ZFhjkzqVfx3+JVRk1GBH65IqceQJwYs+QqkzWewBTpln1RndjywnA7htdXkj0HP6ja 39QYvOhQM0xtzexTEi3KPoy6C3oi0q5LS5JRwFduuWAjeuiQMmrDB2HzeJ6J542Q2HLF4sZ0 9hn80FHrEpACjNUpxmRCBcM0kZbseuCLV7LdXnQpkw16dC/RLNsTIkab4182LwoUtG2bx3dt UMyoKYtEl3mukkUUAeUk93/YLEkT/Ew8qtKliHOargCz4RqLstnno4FfW9LSe0iFKJeuol7w xgrKdffQxsx0eR3ppoT670824mmhShjyAlOGh+omUCOYf9gFaffQ8TeKCFNfXWZGBC0oafok A8Q0j1WXeJEBdZJ0n08KbDViIi0Asm72gVq9ui6tGJFE+p6y4gZ8f2TrcWnbamU/wY4WpXh6 kYuJu71R0OzZegwl4QxLIDb9DpNwmqUOE4D6r8lIRt1CMTDlobAqq1hDrJf4ZLoZe/q6eQL8 AN0lsu2mc25lbO/VDaMzT3ysy6tdEc4c1CsvMSDdiGCbeu2f7OOctrHiaOq1l/TQ4HdhKr0j FVDSDq3WZ6OFmOc8zxcgBSi/peEhj116ULc9Pmuqevnrf/THbcyL+XjT42PZU0PXDHNn/A0l rRtFr/JJs+33gEkXUqNRjIFAfYfjd0tI0lpJPSOFIN82mdEi2lm2ZVdUh21ji23F3MeA3jw0 ZeBnZu32m57/WOGrFUB01vS4oa61rmeZUW1rFbKKNL2ugM81HndFeaTkaOJizDIVI2mWnTdd CyF/BgzXS/6rFCU9j8q1oDlMLtuyP4qjHGkCUxI9+jn4cwi7xBqCzA3XYsAV8wuyG53EMlpv un0k47RFBfMYUcDT+mlWDZsOJB/1hnTzcvSIwEkzRJGBr781ZwRA/+xTM3SrhUwnSjOvqs63 vUgTk0XCqxV3D3CbwdvNzHExytSuyqA5YR0HGdlVS+Mt7WDn2ACDFh5syMTq01tZwof95eVJ OPoRQoMFPbIg2ndpBNcQJ00nN2B6W7jGdBUOvhTaGc4XeQw93JwBLb/zJJM0zGYRGub6DqM0 RTIpJVASetU3zEWGeEmuLcyZAKO53LAcBudswPJMGApRaKWNn+EIwKKgvsrt099/9EIKygZL +mgQB3VpsXu3i+GXy0vl3aGr6SrGmwteDW9sL4B9ft/MEYv+TWy27EFY70GYiN1vfu28ULbP cQd8KmrAmC4jKWI37IVKOkkvaZMBJsZB41501c71sW0Kni/qHyfyW1z+rbeGfoiV2dhs1MTz D/6UCNTX1NE3vLHBRZ8TCcZKecQYSVhgTngDdJFEg39Tvtd2IanlHnQ6G3QN+oBm2XXT9Zhu MmVwY4eWXxAWtR7Us6LLElAF4S7rhYSjbHgsWYZjhMx3xaGUd+2j4oYssNPebM5JVga04I6v Qcy25szGjqg2btVy+obvr3/6+gFc/Y5r7H4QpufkDJDcqt2gba2Nr/8c7F8HQkbAkPnxzMtF jwccIIGpvNeSazNxXjvdg2yLCkJ9l5ote4zdcvn/YDTdvM8BUha/ZOVVbyTqbalaIyELrKaX TOVwVw9fg3mdUFXpq33Da/6MomMXC/jRd7DvsahKewiiUpHQq6nSa2aD9dqhFQe9nldXEKwB tRDpd6Ds54GqevW4N6QHVk6Vf4+dQjNhovpbi+k3VhrIjFfhRKFvxKIzFad6ufOGyMsQSipm 9R2xutGgyg5Axc3I9Wf2ttq9uyNWcGfuNVsWubQQa/iAVoGOaSMr9fptBMUkpDKUIkCNgNwA pvSC6Lk/J1KjQ9nlveaj5xjCC6igCZKyjKWy8fsOEzdYMYiaEp0m1jlMS2swj9JiFGSX71Fv G7JiJ9AIxyADFf8yXtb2hjSAkvtq1eiujhBCap2fW70EHa68m3ndAaHc1kVb2GetvCtsALRb PUkg169EuMCi2QA/JFkAKlzSdCl+P7y4JEVeC+wCPYGhgxSP0M2RjSawzje8aFE6mBs1DAaT 6UUp0GEAdLEv+AB19J4evxQ3kyamnqHF8Lcmqvm1IapilbCXaAQnlGAeuHF2bBGnUPtHOkCl 7V/J+++1i45IFyRt9RVyws0lzQYGlCXbYT1Qm0XV/hkilolHqex61wBVANtVPzTHeVsR+UUa UKJrkHB642ok2i2oyNWFt7JpMDXY8AO2Jce2nPx5qBySUa8EEwwGf24TzGYZlM7+yejuGRmH Dqu1eo2QlHfpe/1xAQ4ubUOIlO2l6WDfFdUmnPh56Hx34oz7mfVNX5QWAHpB+BwGnq9I4CjD 7zOPaiG/ww/cbhn4I/97j1nyKaU875acPooq8q7vQWBvrQajIBSmhauOOMDgIlkdQqEAuWFx kjhyLaG4kRMlIY4W6W+OYxwZi52u4c2GD5ugSYs1q+20jGvWkAO3P76J508rPQM2DRzePU6b vo0Snm+JQ4dTUxIRdPWkPHuWFmOaAQL2kPXSz7j2CNBgJFTkBUxINqoeJLuDTPKz5tR+Ds66 PhSCYvC6sSgV4/cA5rVn5dDF2+whaajXTi3EReLnnEUvFD4l0Mtv4ln0VVSu6+rnDdP3hlUs HIOhKbfmIwvCn6i3i1Yhv8AcD4MBb8fkEXj3JOSZ8QI/ythitfCqq1IANrJn5AFftGbM9pHI BD2ksg0WHfSYRQMGha0UabKZG7bniq8J+cp0W04tgE4CaNnzm9+KDatak78YMMNg9jyhk40A wwCZw01wiFZBS6cMrSt7nGkb5CEKrubWF5woO4aIS0PScBeRwWOjS0D2+a7u7Nm+YAV7soZ9 nqJJ0vC6iEUaidRiuFpBrkHX/s1+Y6+DMCcFLXmYEh3bm1cl8FU2jszrMgNzRNtydXNfyb0S oTG7EDr8TlA8PoytcfH6ZCCTMtpJs+2ppZYnVQe5rSfmjpCoH/VRlOosi1Zgc068fX5jnAFR 1t2NrSbbEM+fTDzFQmvkY9nEPhr5MfF2FQZxtyQTauG2Sv15AHGIYedZC1aLs0hjJAtcvYnb zDD9PYGtxuyj+VdhvEYMrGPBvUKjC9ujnNnMtar//mZNfNCSazauOuatmJOdIKtngo4M6+mn CWd5Ta94cTmNaWICeVrPQulj0ZtwmkdLeXw8289LX1U2NbqVkJuNk+GZuK3G5jRSU9gNbQxM 9NroTBpAVBzkF3J6uC3gVNdoismPm/O5EziaKurU+k6fHtzzSHf7JrqJbqKb6Ca6iW6im+gm uoluopvoJrqJbqKb6Ca6iW6im+gmuoluopvoJrqJ/ot+ojjjEKuzReBq4RJ9qnptWRa5IqRS hAL02tI8k75K2nhkjRQy4MY2KUX4r1VlEZjf6xchGfaGviNtrxXQ/h4DXzPW5kZyG4DL42lU uDAOiVz4JDE/QBkIpCwF9gbOf6CsScgiFvhMuPBdGiVwYtrOHPF99mtVa9W3IdN7McoBk13x AkLl97lu3BTFczytHDqAwQV10NaEzL2rxuJbd8xKNecsfs4Arq6ulA6QV0YVkgOXvEp4/edx 9m4E9ltmHy2SkFvCyyIUQpH1b0A9UHlY1dqAB0z0qFB92zHo2hIfGbT6uaGdltfUMzFp2wtn dNBciHZE/R5oXjK1p5I4uXTDrqidZgD7+ZMkTeqmW1AWdKpyhVdHktXqhbbTMvrn2gqhhjwj RnRPAt2a6NR/qmK5u3cgaD4wG+ftCMnB91zhUFHrzbS+IbbdI4UiHgOU+cle9IfE+bZctFIO ySipVxkhl0PyTYPKIhmTfCgRl/SOD21FrA2ZgoGIuS+NvWnQuAHS/FI0HRgkbExsnWq5J+EN cI9ACbM3mg9MQ86yK7MXtVV6uSvCC/C8ctLwUsWUbZBgqLzXvPr2xDfWkZy+6V6TtZoe24ie SoWc8pXGRP0weTo2MjSakz3KtAnCihZqFrdw87YCmEgMebH5fojylUG20tRpnLY7g7dYkEu6 0TtMMcbNMWdnjpg42RHn3qSX5lYufxxS7WeEP8mQ8HYGFG904tKkau3IE89WAjvl+5enqgJG Z9KlXURP6PZAl9fu90yQhzKZRkUuA4Jl2Zu4CwktPZqyqSg6tiA//kbszyVeSQkrzdick3Qq nOn3vcmmndapbm+01IRlJ7kkBX0JT8wZpyWaw+NzSNo2xBF/BgidH34HG4liWHJqC/gaMORK Nmx8ifA0mS4SqhXN66MBOrcR0Nopb62yK+y6QRq0IQ0qOYcsJbRCKOOubIlpbf4pWeSv/Db5 HNJgzWs8qrI5XrL9CR2b3ACgwyOeFIQHMjjnNto9j0uNaAkbyMWYiWd1jcEF2eWKNljBAz6g gVrp/e0EGaZqLbjJeoXxYKcZqrwvx1n3Vn4bej09GKwf5vt5RliDSZB5l4a1wKfC1PQWBa9+ NHuwtw6prL59ROP+yXJmL7jV+NsSp7lN6m6F0Apv2ckHXjKTIZJfB4b01uW3eMxF5XaSCmcE ZE1+wWvho6M4zcWLrze6vI4clV/v+6nw2qElA2/QYIwvhtJMFV6otS7eZjNy+4oFBQemDRhk JoaVEy6bGm3EsOytZSVQWAr4obdiYGDMHexiDaY83Hc51hwZaccAM1vSUR7P/21Krm5dKSJU ry6x9KeEfRnJXBXgxygtRunHfQ1tMPu8xlvsMzgRy1cYIu5FnEFDCl9febcs/gZg0i1JJowg GcXhRrvABsiGbgDky5+/rX+qmKo+0CB+4ypk8lm0M/uxf6xAGB/thI1s3a7ZC33vgQoaM0Ao Hz1gzHorNn2aURAOuyA5om1d2Rb/Houu6wB5x77eEMz+9aDQLbvIj5WwydEHGMJA8fLsRj0D c5SJxBySSTAny2jZjyozLztMpLjnQIfjpISLYNHfWsn2FyLjS6VG1nthILD1dpaPfOG3OUah KOR5Zzyq/xWkMbZ6yfsB7T3w45Jqck9tIegCnBnkvfgeV/+AP90XvPAdulgJKm0LWpvKiw8K QTEwZDKRNEa67QBxT607Apuq9ls5Q540cII8gflB9NqVNvpf0k9w36rpdqbyYqkCR3b0uKAQ 039SCX3qvc8IaTxnsTMwEv0EFkgmKt9uySPwJOjktyCEBUQeNh2Dghc2ujPCUPjngV563ht9 ZsV7w9pq56wmkutc+bKED5V7DLFOVoCMtnr5fmEore4Bv9ucsPrxFtsNpxIvkzo6GCz0rmGE y6u3a9f7uQ35n6gFlbTz0tnv2Ar/tvy18ju4MV3k3ZnhBxhkawBw1zsthn8scXV//xcdhtaK 1Bhy5RWUJQkb7iJq48/gP8Y7EUX1HhFTzM7wu3FrgxVUvozI77TsJAvbTUp5XVF3xLw+LV4h 73QXztC4J+kx2zVjUm4xMMNHoKIE7r2QhCBq+7YPPUDV8paWgSMI62z3Y3peHzbicFwqKsD/ b96cSTnlSatbrl0gf1J/n+cgN96yp1bSbSiuF742MRtKe+yEfe/KHnJuwbOFMD5x+hxD6FPD yA83ge2h66vuXsbqEdjli/oRGwRvyYUZLijTNNnLXpoOz0F+baIqyIwlFoTCKCmYVXyNrw1E pECwpBmBM5IhMbOXbskRiTAbn2sbqBcHu0TX0APW3frZga5+X++bbTv3lcFjnrWydNhV1AuM kxUEcVEwazHshRJea/m8r/8a4h7MKE8RKPMObER9KzbcKzVyjkFyjK3AEvE3XGOLw7lRH/+L fe+KarLrtqYIiEEEUSDSRZqUQKgRpCqoNBGR3iGhd+lvKNKJgEoLXRFQQVqQIiVIDYRQlS4I BJAOoUYCnPj6nvOdi3NzLs4//osvN8nIGHs9e68991xrP2POaZ9/5Ft3YHb3WVyzhHGK3mK8 hiyKTg1lEDDItUsrzx7gHmyB+jbwWtxcOozZvSGeFd0ONfstuUHgODJmPpMO0gyyX2T/fP7n sJn86DqPs8jCeloG8xtK+w92/ZbKrMN/jZk7oc+kB9AeuiSzCO/L7lWVkGAlnokOucnoaa1s F5bE7MOZRvhtVoU/mDCOWBtbsIJvfK8qbshJzAJURaS/h3DH/g6nBKwkU3YLISfZtXYsK9QG NX4nJPjQztY3sEMwbwJRpDsqyCpf9Tno8Lurd+fAH9XSPgvGPHC6p6KFJRvmCXOeqQ+cs1Aq hTyd/7SgJS/uSrB3UuTO5Rlza5YlzoUrxclxj+tkO+l3giKTonE1ielVkKBgs8kmZtffC9W9 0v0vGbkov4yhs4/BqwGXpa/4kJzdakG4/qRCNGuya7G9E/oYRUnm/K9Zi9TZpFHf08u/t3Qn XCFRzs53dW8NNpCnEiaVN4WYsUiiSfrP9BEWsZ53ybvhu0Mi+sIKZYSWv+IZJ0k1UDHX4lEH l9q9FVyoFctHciFqqAxS0HsjzibXuKAhC2rKrIKE7o2XVuQqAD/15NYEer1qbthbyq7q+Fe9 VNpcHEIC2K7LNBRDguY/GScv0k5+oSYCIIebeXmjOtisHW3IsniNeLnr0ij+/TK6C7Q8TewI 7IZuoRLHOSH+oeW6S4IhLF/i8X8Ej5Y0BDluJCRMQkM6Y+moij/291zNmsx3O/oDzVDOAHcA +tEP/cRnTva2u4NNlUjygTMufj7etEd4bcyo/wmYmD02kAMJ8b+y3PSPyJP3pu/BOhIiU1Uc P8wZtDiIBS1+EETrsSzn5o9/8h2phiaSq8AnqDIXEyB7BwNNwJ2yWd9ScPGVYZOvyvAnfH0/ UmKdvIb4z2ie+BL9/FtPCfh45qzCqmLIHuFLhtW0yqNXFeRUyom71g5ldVJnq2i5sjY67RRl eSv/mFiel5mMaJDTAstXdHlMxgvr3fiz3a7/KO1ZD/cXdjKhErgItgUT1TKX67JEF1xOVqiZ dK761CTr5LxXq98t3vxxnWQyU83jfXM0Q2zP3uFMpjkhwXvjVQumOSYLf7L3nIbwBE46qrI3 dOrKEnywq56jOtUoIstBl1fiiNtSuVapFJf+MT4aF4dLUuCpdAVmW0w6uNt5szQELW7P8TPn CP+DGQvezaWqPAjpgZ+g3MC8mm760sQ9XaXSeCMcuTGeZa7w7hKiXnL8LZ6WG2IFZFcl1i7s 3HXz7x6GfsBhdA8EI1k6e5b+TMmdhqDJfbirMYFkznJ09q94KzhQ0Mk4GZjsq4d7Mipbmu20 sEApWhUfcCt/ohk20FKmK+ZxgM5sDlqxOSdU/t+sGgN9HZFLnSdVb3tkcS23Q8Cy+klGOD8J m7dQ+AvfxGRXcldIzM2avotFORHTdcvcCDJmOUyYyY5JKB66t9RJbZrjzeX3DxeLeSzQXZf+ PaXp2xxF8Ycu8yat5FDrBeIZsmT+tWNxD73qrsyTsuWXNC7m8qqhZ1HX4tg3/p+ywBbXGDTz 1V5tdxpV9RapzZLsouni36GdM/LbDXGkTGZObXOnhtj0j6am4zqxQ0vjHcOCLtKs8iGHnR5m 54ReSd8VCtP8R0aqOt27m56HnKgLiBL0H3gjsxsia+git1Hg3iy7S509lBXE5j6jGeI2qcXx qWe6AzqZ1wzMEdazILL8acB0abpylTxXkMjbjQEqu30j2GF8iCzROYto0epjiloUr9kht0WV pvG4wAHBgyE7/o2ePt1yjzfywBwdPSui9J8gF2mKp47qC7tzb29u+TrZ6aICH+9OvZ8gI0/T 9ckTuQVqqiB1GzH3JTK7K+V2AnHxPP1/8CsuuflTHwY9PXi8nuvoVDwsdjBAqNnt+gDlMHfi qAriHXijK5oNkfMlQwy1Fl/VFHTzGYs25x/PHoBqIe/061fyFniT3Lqtu9+Hh8b6vsgKrYOa vzcl913RuOJx/KFLtVxDfc/0HU+wQlWhnOWC1h7bP7Jlop7y5qp3wEA2qZ9BV/ldzzC+MMv6 LfT4I1Df7Yndq/zSHn6qQnKrOpTNnPMiB3JrAfbPUPKlo+8Ksk/HDxoFNXSW+0jevNpf9VAS YzZxehdkL+2CwuiKeRISeJyYc/v+2P9Gn9hMD6HAE0iTIcQgQhZn8rWmGOr2Rhc00VcFvOTe RYa9Ll5QbmQ+Id9Rr/9oiBT9j8nJc32BkSfgl9ZC73dU2nCHYs6CKa7mw0RXNfQWl+TGG/cO wRZj6W+CPiwhzt6dyVJXYchcEv0f51o61YJVy7s+jI6foAZKWJdb1bwY2qjoRO4kP7oRUtQs RugjTCZ1PsUvy3l35qvQwB7oQf+wymF4q4kO3ge6qhMlmHSuY3NiadjvLXTm7pTJJD6opkGu 4TMyWPoqbCKH2L3L8/ejuqgmMhvADQU9/WXp0EmVbPnB2k/Pai3G+wbcyEv7CkVmr+OqFexf o84P7Bn+Ev0buMjWUFD+mf30ohaMVZt8irK1R9J+gxWYPX0v+/eJwdWsXFPpI2XgVIrPNP9G i0BlsIb1NB4lbb/lplRimloMksWO9x07jUxC+3E/cS4+6SppaL6/DZvqvPwsxsqq8aJjHGgx XK38oA+LeDlpgypIV+tcsSFV4jfcUXtJfoc1PRm+P/JY2AOIK6BsdZTJiF8aVEBOtAGY7byz XE66cpr+t3tTN8IA+ZwGt0dZ43wVnH7DMgxZzBlmWe7BCsghwpjyQnatpc4ek6/XGRfcpqd2 t554noje/ZnQ16Uk+qriFIlFz5LsiZ5/p2qJCnt8vDpbVmPDz9QcVkfQ6pgtP507zfv7Md4R OPqfOGwFdIoUK346dVtinSf59/uGXKrEbNLSGckIePruLBYXVvYnIWdXqcIePz4V2j01pjiO vUEmprCS1rMb1Kee/587b//7Dzjfdhilp4rt7P/gqf7bKf23p1pWRkHmX3/L/k+uarn/hata Wlb+v0zVMrLS/+eO9NwAjSv3OTpmpddEEpgpewriCs7feyjJdLUduRBEbDnTCixdXcmrjBw7 6F+VmDqJjevv6ycJr77fXEGezp490j53OeIOL/O9/91Xgdo5uIuF6yCwrsOWQ2u/VMuDXu5q Dr6f6UC2eINke9Xi7i73m6WXHO1PxwpHQ4N37T4s9CWM1fPHnRjVcakUBV57aqFruJllbb4y 7FrP/a78G2fD3ntij4xAKeZVb/lN9JNLr2+VWUNenlWSFlDSCU1viqfEGwvWrz0dohGm4xi7 kP9GH9fPp1havHDVV/3UhbS4Y3ZSpFgfe21sWujoEj72mGVHiNXXQLc2ufFKgGPTPY2y0oEf 3BK1/Ps18xGMsO6xkvia/tbc54p1gvwHGyX2YwaqZaKLshwUUu8jgmvynviKcc0qJ/BkeUvY nh5gXT7cdgGGdDS5WaE17B4nG02sp2wekYThDpS7M68tHHKOo/jFKGzmhk4t3HdjO4V+vgL3 W+FiJvSq3qcS3YVQ1PYo+leVC6K13Sj/NzPpXCtH3txmlRdrMqSlFmAt8sKAasuENEWUHZ9c m8qZ273ztYWTXRqTXy7WKABQ0s8vL3oa6rO450r7P+EDslSd57DRP3w7+T4hi7GYJ0tDfBC/ LsnWWbbrdt1j1u8mEE9lbygFjxaxNQSFn3cv+TSyLxfAycXSLejinNWlFiIIxQL7wWZAn67A /KbrGVVaiFL5ltxc2gOEK2whWyWKqxL16h1NVg7XkkVfv5RZJljfMsbChoGPT1e184oUPYd1 AfOYr5Es10UtAdeXgrBYU7snOYbEESDhMXolo8ZZ7iBFGzHXtf17KTGH0w27LmwfnP0rfZcx WW87TTPncD5L4MX06BxpTZXJpuuvpB4zdJTov6o8inRnm+p0yUqKtqeSu58ojWfoIzCMqmg1 2GB1C/s9FV5wguHiE/HQD5Kl23Fq7OxxbG6NQ8Ffg9ec/c9zM3R3vKC5lsMHs5Mw7GcoNCpC 7BbPIk2vsI8giuxcMqkEZ/O4I5s7Ro09RwwC6/O4X9LCwpVhmQLQryoVi9cXPZkejriZheug tm8pqwHbhYXtLsu1dtWi0WEFCTEL20JPV15Si98GoOIhhX03YPTUsCkZfJt+FDqcho8NGBDc cYPhJDL2JyMjo9E3Wjpi+3WXyJgCZ46OaREsRiREZNevHVRuWivT5QNYPaokSj11Q4BUOzTZ V6/OzM0x1w4FZyeBlRD5bAbUNQosu/2p5ia9tMgkN+jrrGXyXDjtLnNfuz4zNFRVVYV1Ml51 VTqXJCOXYB9ZowDLxJr5W6oYdBHlEpXbBwopiClA8HzVSBX74UGbgCo7laB1NRcPD9rsbru3 l0wBNxdXxFs6keUZqyDNiOqrKlu94heASU0DUWIaElIxhharHOwFMRclV/R0LDSyy+p2eFlY FLjvscjsK0lSjPxcKXbEt4j10t1HlkxGPihnBvfNH+0kMRJ3iIDKBO2HO4ODmPMCDK2tihCI rOzTk1/7HPtynNRaWTnnXCJpl18w22zSLW0mJvlode8sMPjIMLBJmj3sZazmhLD4dGWCuTkj 47hstwWmV1aynaT3Zbntgq9pUbuEy/UX8kte1DJNirCivzW+TgwSqZNxuAWmFXPAYDy2FzZn tFN2tuOY9C2yb9j8yEUic3NzsxuNPLPJn9xcJKVLZF5Unggss0sV7QxMtUzBvhVrdGroFRIQ NT/6UPIm4MCiK9CPQVnK290lIepLht/yMtsg65qzUmubUtLdYbySrEDfNrRw+unctGnnok7v Epv4e4f05pM+TyuMJMBv9/OP7sEdzM9FUVUlyCI99db8/PDwsHuN4lOZ9aRCMYmXNQtistYN bqkGJykZahPAGN/F9LLQ0e/PBELqwlMcWdlCgo+V7Nlp7ioFJEZFHPbnLi6m/ZoiEHIVVS8O 4nUg+rp6FrK9fzXfZmvsz7a91xtCDe7N4zRVLzYtWLpo2P2yio/WlsLKtCHkkHvyJPjaJa/D zd4LaiBI34h8ub4Vv+ORjzUo0kLCMU0Z4P0xY+6dg2ePWIgexpLNlvXZuyCH0JMuHPBDoHd8 1JfD0xO6S9xlo1NeiONDtaycjPR3S8hszSA3v8DKs2G2R/585Y58inU2NQX82Smx4C6vC3xW ppS225bm5ubWs+8qPlYsCJdS/LU103tBEiTRKu2hp421F4YjUyH164XgkFFxY6KYBealdJ1q qK86d7OSshrXQD8O1CocbhLVE+DrWzpT29BQRTk8HxpAU0wpNfAIy7IgidDpLd/jgtidvEiP cZtQ9/ji9PqDFiqTasF81+vCNRrZpha1lks832a55xWyOZj2VqnfBQHtWBdFxn0kHB0djX+V wb63PThImWP9qY99oQXiWIBItQCAFR/V2s81NZ/Un9Y2n/wc0rChJcPD0iDGfprXUWgRsPxi /gfb+v7rkZLescgU4CtntigGbeVv9+u21WNMdQYGRTfFtLvWOL5KUqgEEVI3TN1GZvTzlOBN F/vMCxik2sE/2H2lKxfjdXrveRMSqfDpHNcJUkgRJGUS30TGbRDePE/qeWQc5dEEyno8r1tu 42R9YqREPwpYrNY7SKByBz6KEW0c1kL/oIi5eNmbt/zbfPQzhNfrz1ramrWSdeH8GhiUTWj2 rRggLC7i8O7JBhGEdsh0BhYgVgNcWR8Vi5buDYEkw9UwH0I/XkDmuoyVPAnHTtuFRhp5wpkb 2qRjEl7bMsGJBKPmjUUsG6iD2GMfGCNcITZrlZNfmNr914q0Yf/NfMf67ZDLuMqitUQFjIB2 sXnrC2dWm6YHXCMieZRS9Gj4SXHLwa/9UuMfJE6XGFgKmPNZrY7IMtzAvlcc0GBy6NTD1jgx VWiemZKxNWNt6YuIZycDbGMqYL+mztObwYcWqhXkvq/MYO/NXa6DrnwXSll3T+He43ehH3/2 RHu9MAcHh/glIiEshMmupXat5Px7XXd0WrfWXBWoFNCsizD9RfZKxwdBHktdX8+dRFq6JllX EjaYMawS1RQBQZweEdWxHwLCnv7li5WC7z+Imw1TPWafrT8OsYXvJ6RTWs9MWmSkNlvXlz+1 IhIKphn0OOCMBAcU4DljleibVCWlXrcv1SUf6qr2nY57DANpHBiuUu90J+evuvKo3OqruE9c ebWhZc4h6LjMJtHhmFYxyEGPboWOEwCYctF5MVMPPr7Cn47kBYeHfayYO99GYk1X6xWGv6wm 0hzztz/jvGG3iGIYIzyozUScctNJPDyUpJCX6nTzDgHuXFQv5kMH3udCC81bh51YeB7vG9vB L8FoHaUZHgQRD9o+IldE/H9lpnqHRf2l7FivEWuB/gzcA8IZ9Xp+JtpImtL3f75eFjJWbNPj k7ivSw9saJMSnJ+FH28cHsU0q4TRQgsRq8tFiOHYUCn3+xM382+NcjaP86ek/QiWmGthMQSL Ba0wTreRS0F6UnRm+Fmc+7Rp5nPwRY1PntRFW/2XdZD3gWn6O+rAfl4e/LmMUYTXutHUdsrT D96++pYvss97YQNw4nm9YuAuKhIstF2fLpMPagDfNXv0ZKWxEcEUwHJ7DVvI2VDHkEG3yBqz 3v0jtJ7drr5+ThzooaYF3/+1oXgk9ZThYje1fwgVqpDBPF20cE/KejB1gqtn4e5r+WFCygSb yA0FNauG2BTS9s4IbGAOc7kaRjL+a2NA5Xn1feI37PL6C15rCsI8W8ruDGYmou9c9yn3Wp5p tS+AfsKPNGYdNjZy+gsQWZzuzL41A7ahILDqANO2RsV+hQbFiPoTD645ANgOr/6gQA5Rpcxd RbeLrmr08VwSxmaIOBKjeSteEyirwTmXekM4wO00a9xiwIlID0qtmJTnOyr7MvrIR5omMSL8 1m6okZJASgx7M/u6see5gILqL4mjxtVrRijQm8x1XtTmbS0t/PeQ9NsXkLfK6aQOrjreQ8Ip MRW2vfq1PEspkLc5Gpvb/Hc+MkI4qkGq0EjDeiYHXwALWOGEY/aOaczOFCyrOrYvsApR4Nb8 wj8CoSfLW7oZpB2T8hr/mf3sGFSEmO8ehqXp3zcFJqV4fsDGwmXpQIHtwRUiphpslQD/IwWf L+eWDatNfU4QXI5YtqCmVnbmtKZWifz167EklO6FcVF/A2pTqYbXKSqOQAm1YkuZOz30hGdv 8dsGOK46Urw07ITEly/x0nIdc/MXDwveyW9OURAzV/amTielcCh6K5M3FpUwA1ZL0mRrsY/k 7L8ZjD0HuWZ5lETvo1D6U/zfA/494N8D/t8MoMGo8GwpTAT9WieWb2qfPOO3Xxgr9ujvB4nP hlS2EMkkam3VFHxy8D02GQ0/3ThUOSWtbaHPiMuzvyZVzkgnh9ZhpzvHnvlhJ3tz36fGKqxI hL2ddtw+3WF6BivU0wotpywH/hr2vnGNNDGSK6SYdBa6h5nToLu0Plu3VZLfBqqkr72ycELH yH0rFJ/Jmy+F0YgKPVlaVxfH61+MIWHU8rC8hxQEoJoyNMX8OUFfEH8d77sMOrBYDUhZhovh sY99BjoBy/1+eZEvL1bfb3j/iaGsqNZzVvkCcfBF4WPC+37pZQkKQusgZrH0YXUsSRiVqClC bEYlvnlZQUVQpSV2DHQncUMc4JTtwnU8HhcWR0TChLouE4bsu/X9cm6JY/6C4KcIDpeIJ7Fd anB+fVZ82hSgBqC2WfhyIE/5m/e8Au9IqsgiSJgNtHZ8GQT3OQ3IsXu9kZHi2COkl/fo+xoN fghrLOSp2lNnvPmx3BOIl/dEU+M/7n8LiQy1J6ymDb2OaLEyajEsC90D6Dd40ROLrp4d3H7I ppLc3+hLPU+thwmqp8DPDYlGha7FqrXI8mPauauNlIUWqY9FlrjMidUcFz4fGSjmYeGznPZQ wDKr5ffmk2ft9saCgp5902ZNzT5hTxcabwbZ75/25t5VzcuqB8spjV8SKCT0gHgdr9Fytddx VZQHEp/P54RprlwhBTVUtGL9mXY2KtNuN5BLWHtnWryIeothFKk8wn+nP4gw2mVGOxEJ1pkQ cqyvLizzrWh4M/xtielaBEQl+PT1qZufS6dKODuzKYIPr1fkYEbAOO7dLYZREjdPZIWJPahl kFWzMwN+dgIYpI8ZyL8ddAcTsCWGG9DTt+SANUkaQuMUKY1ZHeMbAoFHjegO0htfpjT7g9h+ 5T7lZq8HdLv+58Xt+za5qSzqxEzpGblaFAN4ytyVpmnxGVEk5pX5w9nS9Z0ToiJf2A18RnjT iZf9RgSvqBWiNzUN9KMX4vgV3XS1HCch1+h/qdCu97Ty1Hfv/abYtPOLMk+vBH4t4At9v1ax Gw71NOLE1bfJPa7Zn1LOyirNczXg7inyY18r8hp7euXlwHGb53dpLCYMijNfgAlL5VjLovJx 65ZuAxHHgIdnQJLqsVvuPX+rWEvFSP+9TPs+70SAMLlfrfI2AbPkXLR0U4l+aY3+MhidaiGC V4GfkYgj3Ze2ZiiqeZpsYuwXC0VGQH1pXI5mtBBzbPl9Yyc2LPbgPOeLCyIZ5JaeSPQH35LK K/xU+FCKSbtbBsDAeB9TWO0QnSgmiP56NCj0/JLRe4ckJmbC1BgIor6HiQTP0+gQVxcN8ID7 QK6XegYxUjztQcfaXvUbhMDX8xatFhBHxYJjvvlnexF5khTLbt5ZPxIFO7Yv2IdWdUeF0uS6 fGtWr3dScFgjuJvGZC8rcJ5EPtpsGH86Q47EIn0NRImzZCnXKwBkctE9e4RMTUQ0I7js9Nlh RdIdPCqFXLEJzt1dmUbJSQx8/AKzOb5PQYk9NYkxwsSxZJ4ZNE465yaPDhDOJ5JtGwfuZOjr DiKcqiu5dE/Y9ndaiDty4eDwBgRxV/ZiSGuShF5alKLeoy7Yj6uS+DxtH4fzSBHT9PVV7ssW M6XlkxKZc+dNd9TTtg4iidH3iZdDbgwSgCa0khywvLCuyfuT+JyQmC9MGQlvLZiq7d3ArHaG knoJy7T1TlxOvAwdAl2CDgyCKDSdtkQUQEX563mMacwU/ifNr9DtxPv3gTGU5po7/I62tLCX miPfFIywt6IgbChhY5HFlynO3TcDIHbU6z9fgijyV/uYrFOT6GKHpgpTcOLVerLtd2fmStf7 49CybQXrovlrSYMgfG/7M82JeKKfED70Akx/2E532Cf5OpQqfNSnN+0eEcAHQxTZebYqgNq1 W2/olIQbDSYf09JOFMbwo9adO/JOmt1kkPR6AfkfYnO+h9vlX7oPhNs+KrZNAUdyChviUlGq sHe5uqXXPl9xTzeIsuhRCJNwkE68bH89Xe1eS4xx+EBwx+08qQ959EBqts9fYk+5N7eb57ha 9PP/iq3ICgn93LMcWX2T5zi0H7Qk4MgeU8KAleyD0dzSENd9Jf1NR0oR6xSVmpgiXaHaanvF P076WTh8IOeuohCzRuf35ua/ToZ3HKUBF8ix5c6V6Mmu5rVF738QfYaQyI8Ei/L8Cv39iiQV fLHdYHNrbUMA6q3c/apbNkfQGRlrpGHbJSvdfx97V8R4ji1KjK46tG+T7lnVmoek5mCkt9l8 SFKoM4slm21Xc4r3WSsTyQRRoT/Qh0Ot2/5om37j0FMW8k3N/7BUu5hEQX2YuOsrPTLmjB0k bA9SiD/LfC6NWOA04HDy8SffO/Qn3CC+ixd4t3gdRpW6TeJyabTRyyALCpvLtPPafwkuDFVh F4wrvqQwi/M67N0RMx8Ppbh4aeiluMVXFQFVX6rptxT7xEEub3jEXL/Ag6Bfv97WKD2w39yi Xs7z8N5sI2rcOOcu6J45B3yj0+0UniqN8a97Zp/5CQH81senNLvJHW8SF6ulabCLOYqxX492 87DlZ3sepYN+OJBVNGDQwtdr3KXJt/SF0qs4h3LylX+O+KRaX+ND1txfRX3teI+5vra18RJb Iwjq/LaAjZCdAo1D6OJNF27giFg6+cYDFqzNND/6bPzp5UdCELpyOOBsE8zwrJahO7PAkQn1 CqWaKAMHXoWERko8LBYvPTD6ycZd/Ybm1V21bjudq9n07XytYxSFkxcjK5kMuwz3LkjGmOLV R9f5Ml6aHqb++FAFoHXMvrNnhYoLXXmVaov1QnAY1jDYFucULbdoU4jfb3x0fqxy06acfCfN SIsvuSWQbW7ybeFeVcy4Rbfp037zO9ZhZxSEKOaYhG7drhFpVN2SM+ZQB8PQw15pHI5KXec9 M/ccUfqIPhXLBJOo+L31emUYXIKgkx06fSmoFWSXWqwgLLnhHlKt/MbiA95d3mqAusSFiedn 4z/OtWXJz1FSSTDRzve85xiR78m8FWNqUvMjV+jpYajx2yyvnS10FKJADMO58dbai6Qu4vHX /qmlPtIu77P/xgf8usJIwcfLv2wyLrpv0z6YU04rUph/b96rRIsTAoXosDYtDn35AUWgKjWT mWzYpWTF2mICN0cjpZ6ETsEf8TuwSazqe93FEABLAJDj02MEoe1jwwTQpoVxJJMJNo6iv1UR tVqs0FsGrwdiVqg7ww1uO2xhoKx3u/raB7clL3z/ya7Tdn4ksWgeYtbpvsqOkJI5hxIGNPhg kCKwR5qtqnWX6J+leoLE+9jIdAaku2DLqlAm7ZQalJGQ6sgetFJ6zWeJ1X+rX1qzrp9f0PYB u7JOBsUch7ztFfUmPxgQLtbF/kk1+dpQG6SaQ6f87aZBD0PvDMhLPu3RQYxt6tZHseVMAdhq 0PyqAoMZ4/NW2wZGeSpIpb51/ybNrd+vbTwXFy71TkUns74Llkl04zVEIAUyR8H02u3XQ11t bePjtmZCKFRmQo9+SmmJP94fL4JOYKMtPOu9UnCpuda8NhjJvNtBpLhUY57pRkCftjYAUHcD NgBhqemEFcMeHmj0c3EJiBgzTsAAi/IghzvyjJhnUs/bimTHK3WoJGyjluc666LZwVaz473s MKNk9dpTbrGGB5h1U1+78G/KNxgMZiZNYh3P724U3a2PWRYL86fdCBaBLFr0OqLfDUoQ3CLg cVE6KGEpf2ccSx4yWrs1no3PLjYT7I+Q+q4O3ZkzlHDgaHjHUE1Sf3S6N9euKMiwd4yo7nDL 5IN1mzoO+kLLDa0HDdNtH/YysN9FvztPzvVEn2iXfEDs1+esl0ZEBlfqNXkkXMbj2aFND4Ce tyeLjd/9bO50uo17w4u/2RadyEZIjEx1xr5FrB46Jf4Hc2cVEwf0rftipVhp8UGKOwwwuLtD KQ4FCmUYKEUHLS7FmeJaZIoWikvRAVpgYBisuENhkFLcHW7/9+E8nZebm5OcZCc72ftlf1lr f3vt5Jcs2zeRn/NyZbeyczbpYrynNRVHHkHsiGc9zNH0P1C3hdh6I0ztzsl65snm6z3Old5y OllRjuS1azekLyqx6uyGPpsOmiVYpicJG54b+EQxo91hXxPfDlnk/ECcK1QXsGR5npePNMKG nJuIuW/Gt+4Kx5IAyauo/aZoEoh9x9PZ3nCYmdiqCl9vUp1HJCJcysdeUd31id1Mcwa/Qxpc YajXMk24u69Q4ONfdydLnIRkzWysnsJj3whY/QzyiuKu5XsvtAkbbL2j03tKQINUloq0cw7e pbl5p9iXPilbY5e5VnlOyTUBIm5YR7xOEl6a89ZP+tMnqSYuosEd0PWO3k5NgrJzCAjSVmtU qP+SJPoEV9yE4xyqxJKhJ9HbDhqJsAxZIrc7q1ylFtPB7SkrsOy19HLoIXaY/v08Hr7kgrS0 F96w9VXx0ddfXaCsh78K+6bO7PlFt0jhj9yKuXmr6SlBuVmMNYLHP9Jrd7iQhTmzhK+HyyD4 bA0PyTfEPmNm3vqxgDUOsORC94SBLt1akDdEABXIp4dD/XIgFJatmKUugc7RpnmMpmnAvPVT MrFU0Kn4cPKytTs88pqZY11NoTSNKOFon0S5D5g1pcgMKZbUvEJDLpEKXZs/JhVGxlWntEaY PG3FORm2klapxGwr337JFcKJVIe9Ohq3yxVu6nwz0kLYjLpVqrbUzt4gzYI/GBg0sEupAzr5 uBc6plnWF1PpsAB6G2+LU0udld0hqHo74qa5JKH+sC+Y798Riz+5ZGxhpogHm9a1Ezc7voZD SM17FAyqyl90cJFhC3wb3FJCVibjoExL79z3iXzp1zIWSJoVIdntblGQcoI2DXUWtpXcmx0u z6o7GoIINVki7sySsWOYwRJIi9eRDrAVO1D1a9R3g+oC56wNACEt8Je5NR2OejwNXon1LfU6 H8eMbP6t/G3xJc7gWqTi5q1fjk9ldgQeylVhwrsge75yeYCbC6wifnoyOcYrVMpqyrpOXy9M rAfooaHpD83Kc1inTKrL5u4hCScEOQxB41zkkuc+9ZRbWL2NPgiJsEygpmlHvTCweWmy2jCn 2BIbTaczSDs2+SqJHRNuuA6yr+b6awariBiicFDOzwaboUIhabI9BsLtHBeSj+OS7bM8qu10 tO1e+sh2gv1f6I6ajAO/uceD1iuPhd64B2okLhBDO0s3yaRQrhqGGAovsCRe/0cusBslXl82 sylytpgPHQK1mdO//6Ts8WSIQliwa8TjMXdO2sESv7JJhLIDrl4RQX3iQPp0B/FxdTqprNym nWLfLdMyD57d08d18Ren5WBLL/DrSF6/U7BQtREKDyVIbEC1uaIx99bHNkr44XjQ8Cmt7OQT LjXYh5ypNBgBTuBuGGnRdrL8SkV12z4l04na+xcCp7+zAqgihMUIslNrcSUZJTIYZ4wQhQzi MUfANMosJ24L8Zwlsgw5pSgrLqs/5fgyFtgo2sgFZMpOTQAAIl6Y66sukV/5k6iPKIcq/om6 3uYnxJmuJ9FVnUGkscy5goe0T6vSR6qpdNkRbhvKKRenKw9XwKWXQdO1gyz5EHD80uEpYBv7 pEVQpVhd225ghP9SC2uyI8XC6IkfZ5d7qbPeR/c3fMzguGd7SknCzLytzMZlmaZO/SQ2CGmI wxDCQsnaxKZJ0V5JTG8aoZeTkFgQv6svMkN55KpvtTSYhgiIwQjmCkNGqlo+eemH3oY38L4P YKJXGNmbvW1p+6bOfqAiKW7PG9JihY1238Bep5SPH7THgJ+NyMdmfOKgWyc0BPXdAgzqi28h ne6kiUc/OYZhJdyYKG5Cxp181yyQ2WRvXJ/w00JnA58k8Wnox6m/+YvdBiB8Kd9hKkp2iY/O ab575lukEbOTZjnsvXOUEJSo1bN4yk9jR66vfXpUEe3fgGJ3SknJwKRU44tFPigx50mylj3R p6d7a1TGZh6f0uLBaOl0ueGFyVwl350u94oBumPG6XRXEUxe41AYMXtr9yPhtcgcnkfME/xG 51p6RvaQmkXych0UBIWkMKVh+5Z+LKvDU2xtAzLhtzs/od3vB20wBJmnWX2N+Kiae9rdGpP1 Y2OxW37/GdN6HPNWtSUvZGZngim5FfSVycm/8jYck3NsR82PDtru84uEAjklb92dmIWtavfH +LP4EUlLLaoDyUIMv+MXAs5Gxbya2+JLarg2lKJVzOfapmFoMXmqxMhZhJIO2O9C0ZCPJjnP 4t27n0wfVkV/O4V5TP9solDXM4lItfjC251MFDAbNrr353kj32u7i1cA/rgGrG9Qu0wBnwxQ 1L7kT1Xx69N1L2ablthIMeUmwf5CifDFd8yZzuYMuzr/CotNqtYkIdIxSVAE7NuWMGj5oLDZ tZw15RPJAB8tTisbJOAtSpUaczip5EojRmJePeQqCrKEYoce/NV8R/LMPVgjKDzYiVDLZGae COB7s446L1YuUN9bZn2VC9XfjTEiMteXzPTISF+yKgvc7Twsy68H4USVSGyhxZyTEydyUjxZ SC4t+O18+0cJ5o7p7JmD9c+0cAaC35XNFlVnQQH1mq3nUe+hgiPdICdrKAcI7qEU41m6mFTX nBesBkH95+wA/sApXloPuVsTT5zvh6+eahtDXPV30MuCxz8DtGn2I6n2YzW8q4Ngg8RFJuiV MeAQf5ySmnpvf/O8nb6IXU7+Bift8fILdf5vVB4Fbi6sNEjm0RT+LeToC/aJCea5VKJGiMac bpoov/hnDw476/NflHUDjVdpkJ0dygk6B+zZ3oLXyiMpkUztl8Zj1HfvD7e2uKk5eHZcrU1u b2miAmwSEy/2BTfomm6tiFnBzqlNsysLYULw6QGazDb/+1LDVaGo7gaI8We8kFcASAIvtbM5 MvHC6Ohxz+0eX/BQql5qOveB86B0tiP7gxrKvBFFDDhJT15eLHZnt1vyRvfxlYFDwALaqP1z x54hlhRQ9AFR2mBDpzC/tnP6s7tjpuwkR5S04Kahw25kWn8krK6dweAJFQmf/7I7S+NtEXcz PYar/7IuzSIJOqjvqtnHr9aqCmim2MiALCqlWWRBB1+5OvbxK7UiAc24GxkOi9hpF48wpV8R nDTikhuy3S3l3AeAPl0dP1Ih19fogDhoqsEyGJaTcpwPXoxIu2DClBYhOAHigA1ZdEs514F5 n66KH6mwKy064DM09dUyBpYTfpzvsIibthB6RPp1kQoWIrgh9vZWmbuZBMOo0fqJ5kEQ7YK8 xNd3Fe6Tj/BYELrHSltIOvL9upgB6xLeEIMsvkMjmykI6gI63jjJeGLgHeUPTj35y+V+hO15 APFXg+zobOO0/LB1f5b9K0RpgE9l8B1V4i8b/pyIq62Z/LBFDIyuGqLXWgUI4US7jLQkpy3t eA3xzE8mdoiL92YuOa2zrTbNCGmG4KPv7yj9m5Vu1glrMI/1zwVQgtyZK/OTYnNVqBbm148h boAUqDbCokCn5O8B7W8af4DgJe1aL418/XsucJBPgFtyB03y+wzD2/KShsvqnPNT8IO0PiWk +bq4aEhcoGhblO9crsBnWzugeqPG2PCxfWdzYsTdMV8wnsQFWcem/4xutlpRZwW8PuQt/wqn Q003vo1y5cznDGuj2QRYxeEGrL6jidTNusleO4oGfAE64AhwMCxKu9mAVkyArFmfihqOXE5U 2RWI9zdJYwi/O8d7xAo/8dygA1KFH4GFNuPBOX+XwNZ/q5IfDCIzzhKcOl+m85LG1L5xRLN3 kYPvDnm+5NYUMP+C/9KK521sTYiV/Fy/fJLNL/ulRIvJgawpHXXJ4tYh3tTR0R3IFQ6afsHF f3ioFb9vo0oz0+LBXNmdYYJ6s24VzCq70nylvIznaHrX8VAJB1n/uDUhuu5w6KnXTYG+vSJE iDdVAfol1O7vIRa+6oNW8SfSz6MM1yvEHKtyNha0r8iY5Q/zSlcsfl5tBTVktL4yhXqzNtOf 0M2EZg2y3ERSnt5jfBxu915PH6tZzpIeILc82EdbahmpGoLOaCtcw2uZNz2ULCNVD7JcPRkM x1bKIHwGmvxOZ1hV0VHeCq18DaLAgv1MniHTtrG/dXNakS5GJ7YMH7XDwuszzjEeFU0iJwKj WNdIz67ANgvPCYF4JKX/Qs6R+Pu5qqNQvITGJkbq7xuEs2bSNHtzDV/NwpBUiVYbtP5Nv3Rt bz8lrGYs10GKbYZeS18ekYeqBRyv11mIWWnrOgW9qTTM8rr91Glp9tVgZ57wpGhvr995YSHx D4XZSHutzMHZQNMF4cmmW1lwoXMF/gSo9tn55vR0T3Ti7Au5RTJbs0hvxfcmWy6Dn6kN7xrf EGSOmyE+bfQdEJ30cSgUubi6uuv7D8y2MVli+S3WhC5uwroKrh0hFsBxma6Yktq6H4yCNVU1 brVVNTXPhQzw9rIGP7L1tSYdNdv0M0GAkcPGS9ybAb9vbSiLZ0xMGUMFTYujYS6a/kDQnsmx awADuS8XpJIVWcLztbXyhkUo/iRIlIxjDYnHlzHyYUiVcMEDUcj2u1t8Na21c+XMMTY7K9P0 0WcS68zILJCJlzaMKPRs5hHa7JnXuw9pO216b7qg5Lb50Z9/Xv2Hm4Hc+gUQ8ETRKffFuZrJ j9ZIm1iCrwMqZ4wCvIePg2gglQf4aPJGYtvO7woj1fzAZ0J2geD3HthWjhbyNVu2M1e9sw9p ytyJMKswIeWhXhlfIv8msZCdaXojGX6AcJvj2Gzv7Mn3GsW0G/xoNTUB7aEoP5+nX8Y2N+1J hHiWp3hhlB/vmtSYp0dvqp3a02u+zXXeuKHNylpXYABbNSwEluRKbp0POUsnNIiQwRGVVYcN a9+mjIVu4995o82e3tj6CmTo09P3ze8fwmKdUtcDwf90a2b9K94zENqx0Njqh015bl9vzzq0 YilxD/FIZ9hhxDPlPrMeuuYSgTcSiWc6qaYfEPs7+2l6770t+PYSjPtvwvxUspi3Yp2mOTiq N2Mc+5esbAP/3lTjmHsq6l7thbyS8y3QzlB0eGyPukJfXho3HR3xHhJkCeUWrlR208B3JaCI Wntn5RlhF61i6dzJEP2+46ZnwjJgG5REolWTmH1E9OM/fbWEfZh/Hx8vW0uia6c0aT24rO8b 2/29VMfQExSKi67zKenPePzra3/zI6AZNdt2S0ZN0IM32iG0taKivZ36/T5jqGQRCenHmicT XP7t7e06fXlfyTB5gBAXnf318pGJYh2hQZHra6z57/f3coDIVCGwqi2CDrPEzXjwByU0mBMg YPX3ZI9MhVhA7KtgL0O/4fAC5YlrAvQ2ggsux/vPyJZkZTum/f0Pl5DA7LpxIUguzQH6gzg/ 4w0gTfrlgHAooHpsyju5eI7pLZlaB7mtA2V/wgvHrbrhGqa+kKDyjR71hBc4kH+JuDq8rvNr GpgkaEuXp/QvKoJygZe/fM3i73dMJyof2skhNlSQD48Fi3C7xR7Niz4qjSGpa4jrvdyRX6FF 45MySAWykTcIpgor3jwmge+nxf1ntxhTE7qcDerdndSR/ChM96c+9nDgKXOGMSqB9IVE0vV4 u8dyWD15w9t9CYIRtqq+rnzcVRbbeagtgtfmTj3s+B4H/2m3kB2AL7QXVhz2G8aBwF6Ehtd9 4mkySqYJyRN8aNa5CuUyHPrBN/KIf7yYpPPRkN3uv5QZSbg4UJ6ou79hXXCPf40WzSpwEIvO pAWyilVowB6UJQEbQTerNLXEiXPrOopbJLQZelx0mbsS25cVuU5cOcKMUsQTX1x+iR9HHVyN 7gZL9AJN2PqsIZaHkHfZtiOC8Q0aONUY7W723vp/8uVpZl75ZDnSxtByvPtmOoylVvwFIMzA 2fcQO+OSJB1FLdwxJ0He6Iat1w3p1exX/KJ6xblZG9TLJxrfgOPidcSJ5RChi+Rux2PuU1NF S9pHkkCH75O0UZxaMSGEd1+alqtVzLPy8hmmuqm1lvyEItykm0TbD+PFzUZAuU6hECzgA0+n 5NtoiW2JLE9++waHaNEHpRWf4b3ntwSOym5DTFvM8zMwtys4wyo8BdalLw1oef0L0rkc23ol Hqw0T49LmOWLZTX/z6dYX4WXueXCum4TW0g1AgBhAn7BRwIExuy4nb//PhSkFH39mEYg0bIR orPCjh2rwJL0hO3/YwIT3DJuO8XB/ztY/T8A+v+F1YXEhUH/tSwq9N/A6qKg/5cWYEKCQv9F q0tKiPxPtwDbzfP7KKJad4aHpa9wrqsvZp4eRG63ompurGJ5tHZzJ99Nx5kxhPr2J38kPzvY XvKuv8NsdNJrqgY0qpIbM3T9k/SSGYuM6X/bCANgm+6dZV89vucjSPohyVmbqZX7R3OLnkkA jgtkCLvD+/0XHHj+MK19Efqhh81djGBXKjaxgJzT52/1jL+Y5sk3jd+FzyXeq71w+/vgXjN6 1HlSJt32Ti/pQhnbNOFH01zTiUy+QayTz63O3XiegPfC3ZvWrz/cOMI8tWwwEVIeWq75v6V5 estvZzcrpI6jxAolviZmZOpi4zPVvp13znOd4ltSfVotezYKNIXqQq8s3HxxCnFk6IPxCHKD sDduZ2WKTCbcBour8DBtOMF/eWc9Bnj95nQKcX3P4eI1SbgvsxREycWGc/TlxYZ6pxpllUDB Xmg4a+d928aZa0vV0bL482/v8g9xMDWsYcJqX2jOznABHPqiY1EDLW83qfyhdz/lkarOLYur Gd8CXnyZXCT84eD85NBD4/cH3Gkw4jORX30lp2G+0862xMjcp5QjjC4cTn/SsH1x/wFTAjNF dBYFdjnRZhsjPXRvv2FklfJ1sU3TfvirUGPkdOM3cjVPHCXnjo0sR2eQk8tACvHcWYebCz7g +6Cpq/yMi5xXfNzsoXjLZ8Ithcrh1i+xU3EzWFto1oMI+TjU4WKYiL+GLpIkE3xVpScGvK4y sw5Xw1NTJfHWy6ZdmGQVzkaFmWyqH5mjdsfJx/2av2txM3B8ZEtvPjByKuUw9SAcJxyzHILu +e0d8hEltouN17enEfIVAi3bpX+1jtOBroUrS+4TJMhHZW/pHH3QO5y1gWrRDMy3YmQScT88 IoD97oxLPWWJrUmcGjmifkAkMR3HG3hy/NVnBy9+KvFMuMX5dVrX383rgJN0fmDbyrB7KnQr W005rRVvEMt9qzOQZZDTZ5J8syv1hyO5GWxgI8nlox/NmtD+hOXhVfJXmF6RzHfbbpKTWt1f yNvh1MBUrcW2M0+Lqzl/dFVOJ7f18JrSAglxM+XF54OVZDutp8AC4jac43OmDL13R4/0AhCH F6kKijb0kYNCtB/FE//QbAT9rmG3K2GS+3osczIgrjMgZkqdKjl6a0DrfnhOfuV8e3ZFS5U5 AwxoyX6V6TWRUMA7+NrUpJ4McSIcs1Uf+AYzwfdCnDT5B/czmv4lY0wt7Od1j0h40Cu36SQS wvGt8ddygVSbrXObux4mDuUt4ImtEXCQ2N209LGvQE2FlXsnUVcdGzD4JC+KYNDeaq6YZzu5 sV9ErgNZJBv5s8daE1vNht4JIwFbzVbbNVDJgMY4auRQiKnP59ZJTnJOackFAje550v3bT04 C1qcJrb2wYFidyPt49QCwHKr953BXSVsQJ+ZvHB9xySqNlsVC6pGI8oQpu3nSEM6+MZlruS1 5m8VAliPE72/HNPEs++KCyzP6SZcYhJpQVooJUUvnrNyiGfVqBw8yfFz04D0y4NK8otJeEDi WXnIluxFscCLmjKrd20fuvKCQ3y67u7VIQDvkpT0qMV8hQCm88BxnBN1CbmZo2z4H/c1gfZc 3D5mUeLmy4ZpdUgJi1AhEUmsfK0U/1pNzXBWlmJRMN9Uz1e7z1+FAvrnliLXHDa2tjgPuUOO Rq/FE00pZrKBS26l5YNKFmoQbi/2d98qVRDifTxFZXyi7Plbh0n9WyGSW48Ori9xo6AisFpj QdC3mIQ5RRVb5x2FC/2ujCRFxTXSxpFysR6vvjPAO0/QsCEc0TO0rwVduT6JPz4ZZJXfcOwy e7i/uW4mpd6g/gxc2i9ZyVl+3w5FPtN5/FbfioDbpOzphyqeI51TLNUv9YqGUfhyxJGYRL77 KG0VGxrpnrLXaNRznhTV4l/P8vCBzFKKgU3E2KA/0SMtYjguaueatOTio9tiO6bX7g/HJz/e wDfcWkPOVPfIjr2R388rmtsdxb82086DuLSpqJCbTxoq+YzZ83GV0q1EkIynh4fRb6GxpThu 3nrYfj+IWcvTki93MsDPP1UG7a4lgsmeP9zEKv5TWclkrvD47hcB9cnoJhheIOc4YZcQ22kU i3+yVUB+vb5y9fuYDqM1jrzaON9pvoltn7AgcRxAp0Syb6MNTOjFjNgjee5tTplbyyoxaRkt L9i5A56C8n1WCZzHk11A9YqqBlIffzpjpJDMNJdUkWwEmoQpeLipPBxZL5uzgsQAYJ9r571U ic1zLkrSi9EaseAXc6sNR+vWZ24fPtzutxQGfwoeg5J2TVrE3UzkfJLGxzPNKKk142lMoiTf oajw0tfcHuXQBRjClQyOzVoPyT+KS6gyJX6iT5wVfB9S5gXzE0mxY0OyyFIAVHv7zsuYxQiY mKmGOPE0sVPOcDz5OfJHesT4XfKbWulOJEcvOZ4lVssnutzL5MvlhPytOzsIbAx62xnXUu9T 7rOxp3batPYC2gXkNzdvq2WzwuoH8pZO/l4yRrIFUVASGaWUrguqMvoGXIpRHf9BFdm/bzmK FuAKk2EZ15BUUpNR6uNqPGpRVKViCZeHE5H8DKyVb7VSFPQMJGO/Qx0XGApyFL/8JQYOevp1 joE2yQ7r4ar30O+YBr5KLVt3+fny3EsxOHYv5ezxmuvptKVlfSNfGlIpQ9/UKI3IGKACaS8t nux/eK+jgcbLY0FUMTxhY9AEeZyVsQ6+s+NmjYwT0StWZdFVERz3RomTANh6KYqJNMZJh4Tg buYyzm/6VL7HLjg0jB4rcgYvyXXNHfq9/zoalRoyEXxXE11zpr09Yz9Da+p6sXqcgsS7yCtG hmcA+Vjaicyx5vSNFayV0zl4Pijx8Kjmhss/U9dATzNBosP6GVtf4aYkrEddfk8oLu5To+mb Z6FxBHwiHqOK+/NnmKV+/FkOLv+TZAJbYTxC24mvRE9KM4dF8rzl8Lzlrk8bB+Y3a/S2RTDK zPlvAvPNg/OXjhpkDrKRAsFSnUJWEdq67Trt77vwOhi6RDt028GL7YPvyKkE37fZkuVCVJU7 Knlon9rrO86NlnFfTvwyZAxYQwUapJH5jWrpH2e1vUqNFG/IVvD/w80E8Cp+ql4PMwtTsFPB B/eySFKMHeVgP2f4TRZdFoVCNatwsBVza5An6cs7J7xtgxwdapajnxtOl7rDZ+W28CM/VAfl r5z7FVw631xtLdQEuV5KdUUE6/p8giL9r4J5vwE1LXc7mfmJIFic6YulvOEGEDxnyvofT41j X7GrQCjLIkpnPYdTDHjQ34HcCxSQkyfrXZa42J5S4fKa/PSOYzFPm40FWUDhWLQFKKrnY1hw ERWHiCHiO8wCBe6EOqfBDOmQcI5HVpAcuffra77vkguldcO7IlfKtG8sA9+8Dnojd9wgtVGC FAgS6uS3CnXStSywqrFGLMesUOyP7lNcOI9jPyUsJtCON0upfNeYYgTJKVP5wpL4EpNm/LdB 16A+VUm19cm8oDdpSZJznPrnhMZKNTUTlAYuqxSulSoT62XDjDGbOosqPTaJJllhiG9D+B8K 2tMee1oOKzJSeJaULnj+r8i+58LW3RfSmtNRN73diZAt3p7MK7xT3nEiWMWU9sVCKIINWif9 hle7hPcbEsj7vJLPCPK8HFXUTZ6KTw1FGxiehkUX27D9gVPBSLQDmri1aF0Ne9LkA/sIivHb dZxlLHX9hnnok8eKpcjGNCRYZWk0eVhipYx6J7IjY1BMAiJsSKYCpmsHQAjcW0r07odlg2M0 4E/Dc+GJrfLh+SyUXHOqCYIWPjMNX2HANNy71CDFOz53LgtwVY9WTwvIbhPtD+/XOxI94SIU 1Jd4XsdmFfYiumPcGAlO1wh99q2lrEW/fTxNy0DwsYgYiWprcENhMXPG42UAnAWBsHpSvDUH r3/MtlqsqLEroFvCKkkPBcxZqcrkQJW/l4CeRzE5Z849IoilYSOIuY91vR5bL4qPHlGDf5bS B6/N6+wbynitnR2d9F36eY6OXlos03Rhzi73g0V9vKFV/qvB5P7KpcAWbeNBjn+GpGT2hZcJ PxzIyzIcd/FW2IWRGIxXuJYcF8CzIII0ZBwNXB9FgTTqTn2pVTVx3DOP0HDJItxxz8pIuyrW J/Zneq9I1ZOmnDOTmal+rvxQVJHJTpb/TLPxItqL5GeEO0Essdrmp3vHjNhi8m/b+PY5ujJD ivDErFwhY5e/51e75EFJsc3jW3tFcgfE8KLg673TihXazkmBYutsK0dL8f2fbvi+9hcx7cb/ 3o1CG9wkrSp8vhfVp+/wePa+rdVpERk/1gesUWQ1grMMtLTi9F/PTzTkOw+dC2U+XgPk8SAq XXCvT3ZGRaTZnBhal717IetqAlMiDNCPUx60METGuI3Oa+8+o+ISYY11XZUM2vqMpMhwFO54 7OQpTqrOlgUZaV6ynKJLWxNgd0JK76Ga6MAEfnF+a9S1s3RvdUV4WzivOi96Q/JnuKVNBPrT qqLRDhKbhNe91laflm5cOa6CF1sq84W+zEvXsZw0v76du/mbvAU+9+UCuRraQN+58WxsRn29 CToYIg3GvQbvJIIcxHQ12HS++w9rqZusagib6ar5C9p2apg8J/qP94+5TGVRRf1OrNCO6WfS VPR6XHWKQw6MVR/Syit2mb5WeZmKGOy9GRzFn9rqYZWfMmfkC7m4uQuYQF5ufB+cik+UDvt3 YfRdzLm14/6FHNstiZJNkd9MyHi7IC42Do/H3PD1/kfOgOamjqVs4nkXRS0yCk97oc4EQv2R 2bTVDSPchGcppawzU1IG0ayStEKAgZ8xt8kNZmxGveP/hwRz8WfCf99/iXJMmzmfZ9gY5ZRo zhvbyjmnkcpZhkhCSjllc9xsEpo1c8p5Rk6lhIwk52ORKFLkGOWtr8/v9xfcr8fjft3X9bwu ScG5M0j4qdfQ57i0wB6oojaKroAx/TEQMSx8UTc/wg0REdLY/H1Y33old0f97m7A+l7UwMD8 eCz7D6MpPsJeU+cna1vFw5PcFBH4gJjMCoj9CkhdIZbdeEQVq8x9dv/uhNqhSxgLV5RuKMCp H0CQMpNxMeqdBjNfCoi7xClrPtDWgaKNXI4b+8Nb1X068wmA6z+tbatHYLIKBJAVhdjIdq5a Xk95XCmW4dqs36trbVnp7dQ/SiXmKgNJKdd5+VsEhMzkdLAp+4AxmAiX9veH/WcvtuUmPZPV wtwdKuHIbMbCRNrljQsLevx3qe1X7nl7YFrOtc80xbygNp2e8R4Xc/xQAhe47Nbb6+AEP8ZS swOK6lx3cgTbaJkUk0GbDvC1QDN+y9Q79fqCDXJpp50ocoylMz+KWJkjOtq3oiSPPTiIndKZ VoDkLbRkNZl5PakcE5L/6a8hoxXaGeMyKmUvSbiKDCaJpQZAwTb0fb2RjuroZ35leU+ue/ac SmpKhPAMLieYDF747xUldbm0vq7fJr86EPj2hye6Sz55QN52S2f/uwn85blq1cuMCxdnEj7Z zciujrCL1QVSoFIAMetkDxduhQ6qirrdcsrh+4HKtgwv55/eS/HSur6CjvDNQWhXG+W80RrH jAjjJxpJm1Os44ferpxJ2zOp1n1wcDUSQMZZ1VaqLKP5rSoDIX0pgi2gNES8p5MLoHOkGixF uAqtSMmV9QpL8dUuSuzZ4uUJ5PK6Wb5i5Zxpfz6WsbM8XbJtDjfuLxyw+Zwd96809XSo+GjN pkjrhsqZGHdNTYz7cV8tY4HLkj7KFURf02sVZWVoZi4XtRrWd2ZRfGnAlpD51QjA/MGAWqGg d2c8lyU71/S5fhIuChAkIc7Vhz79uFIqo9IHEk9SuuRzClBv8ev3sLaksIUYECj5DqpwtjmC tldZD5O4OaQamNeiVfzo+nr0QWyYWuG+UOHpdpNq9cvPrsTO9CloYnB0uBhb9xrhUlkfP4Na onY1uJj+iN1R+ZRI7NWBwk2Szp7bDNTbcwskJsNwW3yYZnFnbLhDyPgnNz2HygkdiNEq4wcc WjDgkmsqQm7cuX3h+jAYyF0Mq+OLQ25IfVRQaFbCWOlKTSoopbp2OiFlAQCSTIqgFLje9F+v Ct/gXjxhmKdzy0LV7d25J/eDzf8IWos8t14q9og1iH1pmDTwi+eKZnv7ZdcW1/b9yPMxN8NK Y6Ytj/R6XcqrTakO2GrMEr0Qz3rmWsZgOAQRuSnuysUnYM+gKrC8nTJGbmZ4/WrQjezIpo90 Taw4SM/+LBNxF3Tl83IEof2lUYIipC7P46z7Z5Krep7B4V2hPb0J6ZoVy4YsmMxgdb1YOoIU S+oJ+OCdgwAECxJMueP0NE6GCcEgyG/8KtbipwqdEmKXtoKGB1UDaM+DLWtG521TBwptf9Xv jsbh4u601sY23Dv2M3lrx9ydxTZ1E+sArveaOyNctfy7vpterwhgeonSVdQMbMKsJYsoJ6oW 6hXRHGI8oJjopYi9aX+Gq/joP8NYS7NAi+dCXy8gntaMVOnv/AxMUyQY6xPOrIOsFB94l9hU qJytQ6xpBpplS0SOAGpGos6xckilleZfGlOepUhVjF0uUfMKVlQEp1h4WPhsWYGAQNalU++U Ch0TYicWVoYH/QNoLXdx4rj1R9vfVrzvjbWvn+4S/13RO/790eza29XTbOULAim5LSdbGEfE WfOviZKNmEsdz6gpdTxqA09tiwOJUzBbdOqBdz8dJdmM6QWjB9n+T6EwpCS3L3UjDUU7W1Yz UtmSNjtNF8YOmZOxaJxftgxZSwFjCI5LuGiFc/5yMijV8qJlSzMRWKOiSy5tTaE3V4JIlYoa /CTOtXqmOlrs1JMrWh/xO8V7S9kRBS8D7z3Cro9rFIZm7OMN9moWx4v7JGt0QCWzmR+vzFR9 alG/AMwxc7mU/BrIYjmIoqOAohfiwunzxfLDIIL2tVI4RNnQMSaLnE7B2WVtpRkIH7CVzeoA AmaBx5qFfvadqxGOGxC6jbgvR0aG1KegyVloialjZMoEejNlUqlaSdjrDqCyOBqppudcRuKV GOP1Qaq/GMDYDMeTaB+Ydp0ypNtsWOcxgOSSxBqpx4evToJ7uMv/kL/fQZ9cCW6p6izqH+lC vHe8l2+8/3OiMLjd6ErXPNd0kuqDutYg/YrncjKvIHypWn2fsT380NZnUcd90tXV1PpMeTgD hheXyeDL7BQHNlHGrPe/qaxZEIoxhbOPBIJkO7Ro00dM9mdaLs1OnDsR9bH2Fi8mL+vqC8+I oiodaV7MBfzZpUMxs5QM818olktDlz5+liIa5YSCPwk89GENMCPBSBfp99rBnBwvyMXQqRw4 V5gYfb0R1po3LlC8u2Na2DVerVlx+cZJ3/3uP0++pz9k+VxbbuE6KueLOtL6DBpZcexxmesf HW61jV8fSubvYRNhtL1EpsJatMemnLCDHEXB147ivFIeTgM9jXAUU2TvH/W5Hx4FcIdxTpGZ M93Pzl5rrE5k8kByJnrkxXWfKtaYIbgebQOCZV57SSUqOZhdCuXG9CsoGRUT0rqduEWP1yOT TX3KFY34l4Hxy/OObw/M37JZbmOjSiXzZ6yG9zVEv6x1fZNX3YHd25v953nZquXd540vtD+X py6fSFD0OwoTdsU1Dfkox4u6UHOOKHax+bOOqxnZ2GePOchjXAAluWYCGLN5pYQj0uW6KNLd k3I5CsqgrlgQIfQpVAPZLFv8xb3Oxs4aJAratMujL9UKmV27Hy7hBKMyT2Ig4LosZEU7J+iF ErYdmG2OPpV1yTCefXwVfdKKtsk8PojuC0RIkPzqi4nsiONxCuLgIV0mOUuRa7B8xC/HtkH3 vymmx7uJa86hw8Q42q7/9HOhRw1NC5Hqyzv7ydJHurR4UzkhhyBRlfisEslDIhabSOsVN8MU Yb8caAAMx6zXm7YDF+XRCBFjzCQJCfn0UOPjtf54Xw79IYZd4uidoqS0TtNN3sm0yswO0Y/7 nnJRJvnTpaVRkyWLZ6UTO7Wlz0F40Vez6Hc79wGdSgkZPVcgP9TJPgu+eK77ozrWltdFw2w7 rZ1s/XzuB7XM6nJnvyqx+F8/hDfe5vt6MySXcDdDTCe6WOyf4Zz/9mIXz06FfEhvKHu2mcR7 jdPC+CXGIjuhdBRquNz+eD/AlsOul7rmgjOlWuUFyUMJFOhvRLwE6niWYb02nR0opkhshbby 8XOB0nxlR0ayHbMbqrDxDz94kJXAQF6MZNYrf2tDr0Chi85CVp4UbHoajAoYBGSTFCUG07q9 AI4AYdQMEANmXNsrU9x5FFmlECxVta30ddbr+knH20U++3/LBuIiD2S28w9erIOTL1yesZy5 PCbm/SFLsIMcwcNiOYs63YjmPSWaeQn+1y2wN/ePqUPMvNIbUzGV5wpdQ7QS6C/7bqaqOWgB 4c5TLGhXplpKVz2vhokgoz+WJEGcG9ZH/JQhYlllZlyFo5t5TKUbVpVzqZVfR6u0wU83zVFn bggAlsPQ46f+eVeIQEpSrWnGT7zihTarB3q8hqpV/rwHhvGbNLXkzsf//SioL3n7k1taB2NC RtGnq+nkMwa/5tNeqBq0MzMPGIklg9Y7zB0Y8wlVJ8E/MURwAhQPYn92T2HZ27GShrTl9oqW jvJ/yc5+RJalIL/vjGWX3MpXgTyfeyESoERgpFtCciZ1S53mAdyQr/Ut/c/WU6ixV+LPA93S z1dqlEvGk0JSXc2/qIG/6IMBooC0X8XJlcrMfqlCy+jrXYnu77uusUJEEtYi/+zfLh2waf/e Guyi47GzQZv3/Pf4yDlyMvqWMvc5DvapGvBQCSW5qB8or20CyV6ETGYjbj26udQohClInMcM JHgurxecUMEioX69mojJBbqdrY0n+l7tI7Lu81v5WQgfUWlb/Ix/w1dSrRW8Knr0DUnfx2jN wdLhTHx7GJXYsyuL4vaeOUjxExqUBGx6FytolSY35/hdM3KrILzMNi/oFXZycay42FL3OTnB XDwnqdrHrfxScZKapppcma513TnUgRry+5drvQowDTTp8+dFmlzRPo5o9Elv2gJEydDnxapv zCQWI/SvKmdSoyQKC9h5iRRQRtBzTEz4sDlw4awVL+E8RKNunRU6TioYu+p+ZCklkqYos3fE 2n9Mk7HzbA/sDSdfQiqR7JH7p2HJ/6CKd0t2Zzib5bb11Fj4t++a8b/iSvcnF6Vyxl+01N0b eJz4Zpl90SVeucnQq4xI0KfdN+YHiIruYh3f2fKlOr8BoYmUPUWYM8ry02ae4SH1uB6VJHq9 h3PzEBkGmS3QnE16+A9fmsxTUzsxyUxDqMbnydy1gq3Y1qb20NvKGE46d0be9CsI6ZlHbhVt qgk1pJ0P3b/+4qsBL6beTU/ODHdM9jUuL0DqQYagtlc3r0PYQIAHCvykHMntbdT94n38WdgY /5DKsFeeUP2NPraR+ZmXJsUDgCuti/EPpd1ntuLiLYE5xdXQD3SBoRK1fJRvOSyKgfvNIQ+1 gSIW++ivGi8KoKI/FUyWDmYCFYm8RNEYOeR7HUsoVNpqdEKHJkNHr9oYGfDdnbbAZM0IKvL9 QbelI1PbhRmSVY/wbEB/6/xlq3fyYbLRb4alBKx84Ns3OotIcCV017ja0LCk9AcM8rhQ3V6W Cvrd4zDN4kBn2+6Y44VkD5kv42PjbrOOLcskyzPYiTRv6E1nqhCDfIxaAtt9c8pXXi9Ab708 HnQO9hR6Oj8TTBzCU7S+rRtm8hPzWFBpd9IJMaywXUyHhZHBy1w4k1tUW2ibkc9dcV+v1eyi F0fIHAjRFyMHTJYI8E3h8rMW3h1PuqKPG/W3Xkcz9fxYls71FJJYWtNpIF/6M94DsRwwsOhu uaKxUbLB8DcHrfGx7PBMyYP24d13V97+8SRKr+oeR5+s7uvFOSEuwZDFqia0v3PCCZOwryVb UNT4Ka/bJb8ha9Fvh2lJjAXmCUXs++jKGz/kiAJEP4SB6fotRAgdP5ydq/q2MEx8W59bUR9L JtO1rLnacRjyhfl0yFRmiVO+PZpZvA1DQlQgeRNlZl4flWBykjMknGX3VWTyYhk4Fe1zinR2 Q4Av8KafXmGOY0gp5o7U9bCC2eZh1Om1iCSGWW8LiyLqRJ3LsPOFqWn8DbMOM+nqoGRRFNe1 UACMJKirXs595pj3mDmIE03rNci8xZiIofk8ZR7h4Rs4btQc+XFArH6R8ex12Kr6BKRv1Jss hNWG6DdeF25Ov91jcuZ/AoVI2n75UdHsH3oYsKvUE9SSEdClr6ZXyLgzyiClazPq0C4Awavy 77wVWGNZubJ9gTo2FUp+8wuQf3GlO4/bspRCgnxqIaAF8v96NV6nljK2KUoX9e+kjCLMO2vj Nc6ePVZkXe+8HL1qsDWXSg9IAVbDwaB6Ow+7toA0l3vbiSeO92obY2KANyFf34V9/ciD0K+F xwOPBnTl+14conS6Y5KzmCCyTFYbsy9IAdK42GNuNeLbEIU8OONW3B1jWTmx8hNsJGFgjgID 6+w/Pbx7MbGLm1PvP42cvvaeluf547/U201Lwb8LJuG1PP3vx6NO/CdTjh8F3XbM2nO9Sdxp 3W6z6p/M9FmhmNl/itUhywnZe0r9v+gahJCjp8WEF4mm6c1i/lPlnbzL6Gxrvk+u/abBQ0oi e9Q7YT5Qx6gQc3LBdI9hvirtFWPW1++LUBWu1j5h4aNYpq7sYDdJUeb1nLYkxsC6JyXpg5HY IEn6TZQiWOv7W05WCad7kn1LZdWovWaX4B4apJTGjYdIxuY/w4OoZo5b9tUdFCoz6oV/FdTZ KPn03/MVsu2V/VCNbw/oiHXus5YkNdt6O0bAjKwbXLeRuK5trGU0GPUkxiGoH4dN3ipJw3hg khe6v5+dhLxmzZqjnY/yfdf75WZUwzEcUtPzXJUtIuUMjag5pPac2RhOK/Pv/0qI7NKbG9G8 umk0ngbsPFpdgdVQg9kF5gHLbR+BkLCvxYlU4LYc06gECt159fiWdySvfU48+NaXsYdDOnIC dt2J/uJG16K0scQLHDC0bsvvZ9P1yC/JQVvkJUsuOyDsSB9OeiXLSp7PnPw6SC+VKYg+u9yj JkMKSza5pv0D978KKwN1CTUlsaP15G20/MHi1oRuvk3wH9rnK20EFF/1zX72Bfv12rAR0J2S jRvraY/IQ/Eg2zvJEl2gRSMoVtje00LAODJspRp+0S2I2tCFmACgriOAdDTBanq1gQclREmP md/hGCIkv40t/rkinUB+DSWo/cJh4M2S/7OZqsxDwHRmc8w3Gg2q1oL+8QKld5UqopD1UvCS 9Uo/RSXvM/MWN+1IwWAH66TwqYLPgfd4NKuQl+rwz1ioS1vXlK3rTPgNLmLI4AQFHhjOzLMb Kp+UPmQBWkFJcvP8ZTQlxaeVjkZV8qGea5oKEKVZRbSoOz9yV88gHgRkOHA9Rt2r58cySd9U pm2NcYsaKpIUSBKEA6lrdD495YrU5ufjAtaMN5kwotO/84I9+q63pAWcG/Lhjhs9W4GW6w7G 15y4p2dS/UrX6PYVtzD34eC5zeEz1MyeuhFKOjne/qnG3vf+EgkeoxDtgpbDM9xQ+eM7ODPG 05W35mQH/hK9+xm6zk70L1bVFrKbXY5h8dt6GV+uvo9ci6TONjkCzQgNJY/J+yCNaovIYSpk m4lCA5vTnzfkWTFerNv/aXi5y4uOHAKk3/dNW56tSUrrbGLb53UHS/dVXPN8l3RTv3Cgh0cc 6tI0nYAW9q+C9Z1ByT033tFaq/M1TmIkpm8AQF359uxjcSDKkgUhTZUHOnYr0wnh17Ozy/2f 6geRy8ISa3PL/areUeHNCxAk210ZZTc0lD82T7SmVznKBQcOfvzTo9Qij6mY7sTm+yI3qkfx HocZIeCz+E+lW4h4qEv34HFJt1LdQHr33OX079s9JkqOG2CPbqlVchzi0VbZJcf5ATN+x18n LP6FV0J4gmFURoCS8acVJcVDxZ9iXTDjE1DWlhOyk6sDCsfYxZwgdql6nm787Yfnt7U0aP4+ tMSBKhu1ux1XDng0Pk5wF21yBk5i6M0QqcPA+yUYogGOnoUD+/BzWez7yFarSg+RaOshALIN kDFRWA1X6rvaabUSfqrm4R4qt81/W26M/WjAW1nNIlcbi4USLQ+5CQYqVjaSYggaCHtM0jYS VSskbQXs5nosk04k4zNsLY1gHdkh3d0/WkDhDl/1BUqRCeQQypL5XArGRyAgHRO7SIMRnO/r QQgzlo0uyLj96VClhkBzsk4+ytRhBd2Tkq8k4XfgcvHhlX8Cz4uIBaN7t7VqgsrVpHWLTVB3 yw7utzLhCZQGRhpG2JySsxl1M58a7WHXYT6YZnUMpLE+McYTQgfFzEf+8PvtI2ir2VaAzyIL mRE05tRZ0k5AfGOu2iupw0Rq+WfwndLgi2Mx/d1SX9qzil9eY4eMk+QyKNrAuIXuBy0y3eI3 WbRHrTjj9HW3LhF8HosCkj6ayvZPZbimxA/VbTNy1f/SxtMH1aRplX4IMXqAo3TLakNHkdHv Blra8vvM2BqrXW4gzQNsMAlXriplnlB+KbZr0wbvc/nIzIWocyTIbFZ6EmQqvQTABwdW1krK AEWBFYdHNR8odCCzDJ2SSKe87gmfoT3ai5SsvrmHx1pPasIkRFOcP6I5xPku7z0BX6ocJcPK rO59I20dfoyCtW17efP3R5zmWMQ3P7eTS6m3w8O+hXM4CsoJTl4O4HJ6KHxuVNo21OeYS+Ws uzoH3Gz/yKcn+Cw/Yaer9P4CWlYyO0/WZ0H74vvNmMyish9w2G4FI84Ti6rbjrf+XwkhZDdi JgmkoWKBMUM/XDG3EYgHd4AXblc21mvbavqw6ilA3sDnWDu+DDqyQp+158XUV1celKpVx9iG 1F4X1iTkQ6quF6HyU9DJ71Ra3OxrJmUyBQ0dOD3nzg6sCLbGjhsZPzdz3NeyopA3aP1EL40Q +2UtcZ6PwTDzQCe5/qgO8ugRZaDcFrv5AXlDdglzWnw6EmsRxZi0CTWqw78tnUnKzsZhO9WW 99J/RlLiyX7N1+vbflK/FkuHUsSVX49Z5psDV4KCy/txaJwp0DhoQY8jSziKkmzODddRhX0s SJdAPczQY7oOFSliU+1edlTvakI9F9fPUkI4X490CVHsbdn/IL3nlzKoEaoPVaXrn6RCVa3Q hG/6uJeAUu6KB/YnnIu4a47eMz0/zH7CXbVhjWGHD1OZDyFTE88WZ1FI7XMQb9NwZoZgXEuy YpSW/+RiS8XnByczpw6InbMUrcOtDuFBfPb4y8IgX8mnlTyoYxScLXx2MCZsXGSt0SoKuIp5 /NPj3ZJPBQW+IR0KG6RDhvIfQqCB6YFumNo5y+x8z6NjGoV1I5bvnPkwI/jtlM6kThz6IvqX i+9ivVigtZzHm7JWD5HV+dmfv25sOs4yoQYrrwOIp3x7oln0gMlzf6aMd+m3GgIfVUIQrmK7 8asqFXsZemy3f4Tn9YEtOomqL5x/TL6f6/JkLi0EwDB71ueU5ShRFoRK7ka1Gw7AqqO3lc3U CZNVGs/N5Pl628+4t2a5+g3LAveDX6fU7oqaz8cl4HcXjuqlsVNN6jTXZE8KG2beN3M444wf SWQIUmmo98fMHsBSWWHspxMOciNR7HKNrQUqleZqkk9Nrcq3fiPi5t7WG6nJKvgBVWaBz8Vg wdBAS8J20/cxyETbNk/0do06pyO0YcHycNFZwop7Oo3+TjV6iT6ArIvfexaf+DxaeV/P/FEC 9R5KmHPR1wlQ6XWwg5vWJSFu2CE+h1lEptgyC4UE0nzb468csJrrALQt/ImvHBQ1+wkTeeer E5blCDbDMPWnHicHi+tDOSfkr3orTVsqLJ51PvhpzurF40xZNxHhzX4iazv//ms3QLklQQXM 1pXfrnJK0k64m+7wZ+JHk526aWuud612Auoj77i/KAqpTFLtTxu9dV/cyabxAub25WLQjxJ1 53XCodFxrjaHOJBzZrayuFUIoQpzAIwy5JYp+eD44oNOwq3HfAukrOMpfkY0UeH/L4aC8V5O cpJ02Jflo73HjUh3y+M281ULBc838toiptd9u8TPGGppaNm64QIrazpTX3u7EDCEBf0JtyP9 gQ4v9qgx1bzYq5Rcchs+I2ggpMXaC+uQD9nQDa6i3an6nAU/Rta9uLHU/K4+5fcnvgUtUjK2 HKrdmRPPkOs1/KJ1QnmZT5BCW0uUFzB6nZM5FZwpu/q5GxsVX8WvO20W/K20SkssHa89ipN3 r/5R8KYxWyYHn00umI3as2y84gHlbA7azlf8/jTYcCcFw7T1xL6izSx5SSdCLEJEzONLBWqc lMiakAtFepmPjcm7VyBHuKIjIlCcbryAvYcdBBnoexg1FL6sH0FtcefAGynpYhSm6pDC3/nU iRzDFUKzaovL6xd/wk2DjCQXmL9sYh1oOgYch/CGQE7DzkH+Sk2oPaapOoTqage2wYhS6DrB VRBnrsj2hvHgmMP5jAo8OWuBaC0vMlv6tKPZgiufl3mNfHwAjBxsd5vmVm6xE+OzLVf1K4ww AOjvPH3YcThl4SvoSYQBCZabkH2z4SPH8M2kirJne92+nyTFdb1kOxvtPfXXmXvHD/hTebDD mh8TYaWk/q/aMR+HHjoyqZscVcBt+ED3agsDDwBt2lXWCwGIvv9zmf4mVYT8Xeb5BreXCcHy V4Ij8eMi+HvAyYznNKQ3vpLr3SeOuc176xusbMqrW6I1yDHuouHRsfXF/a/LpYV3d6KtQ+/9 dce37VpWttgX+tgBN90HsSxezFk+Ts67EmGxA3E+GRQdRFnLZqDfZytRToHC1nHdRUextlH4 Wa6+2zOZo7ICH94nR3yb9C+8h5uZgK7mFsw8TKeMINaH3qNI2QWfIfXcQTfY09uWk/I48bmA cQQTuaJfxn26gCxHMcV8uueSRsZiGDAh7LwiQY8MRwBT0VuY3ybKgedk9MJ31yB2ALRFWWZF cLy2K5TXLrwje15Elw4xKn8j4nN+YlJO4Oib1C6WbA8BDtt5mT1I2IbF7BRlW1/jiMHcvukD KT7K0ZvBbvxtKMzcc+y/cBfgNMFnkYQHka+n/ZLg+2FDV+99H8948luM3nNkxxdxxs45Bvxf XWjv2d9GHwd/QYjnDaYnFVTLa7OrsnWqVfKLkXddkMrAnCh3AkrZDUuL1RaNf3Ozq4RrSuN0 Q/7XJixgIh8DbsbwXBXA6L6knNtMSfH5ffRNIeRBMHekGChtwOMLySRRit70gDUisvI8Ligr G7qKOGhqZN3aZHII7K6YCPJK57ceQwwOKGlzHX74S1h/VGKwnTCzN21OoRF3yL+VXwzKucBn dd46USF4spAiHzHiGSQN3dh/9GCaDzihCZUg7Up/Q8mJUsTo7MS3hlMI49c2v2u9qz6+fKg6 T4vQifzl1VrgOkuAnKeKBN3cfndcFYN1MHDtB05b9DPI07VvTDOweU7gkqCtZnMsvlSJqX8T yzqJiVmalN/hy1A4UAOiuf9I/L0iHbV7x0+RtULgxQrYRQ6LrPnd+W/7adMwblIupkd6kiy6 clfV2qbD0OBvs80QUOBC9eh7oN4FHxE92xs4nrdTWFwcri80mY4ckg62toiph6kMegLVZ5ou AAGcuHXe6c2LlyHLnE0TzByIN8Js+UuoMlSMvgW0vZT24pXIAV9jsWW0/+PVJWceXltcsH+W iAaooqCnNXKEILQCCX+iI10AgZFqkXe+iUtmUG7EaEk4bLw6pqn8Sae9NxQBDSviPs9fyZJ2 IXcovy5awQ7Jr8LSZA6wQCjvltY4N+pEsSVUmuuQoZgmY9vco7JNdUbT0Yos2SsnoMVPPCcB BpikJ7U2+PrsepkCiMbyNcz7G21SMyIF9ljcvWEcFvd/7Jj7P9P///9faaklh7ZCORRmS4gJ mZybw9gUHcyZ8Uo5n4+hOU8SWw0zEtOJGDlEziYk5DRLcpwQi5wP0Wev9/fP+PbL85fH5Xm/ XO/3++1+e94fz3Wjh6AvVEgVFN5+UqfTFPUjjaY7OEVYFQJSpfE6G7z6p1RyDVsG1hhVd3dB tnnY93vtZ2wrRbs3PoPntcuYWPt30w6LBuaBQKcAXB+4qKbnlIA58TGbzlChst+X0Bj2Vk+I GY7mz4sOydrUn+rPNkUJd3YLEdcSw5JlEhopgCqhORdlwL8n85AtMornlK8ZaVvTLgvnrk2l 3r7cIHDN7LI8Arjgmr5A7Z6A3EUdJ1e4+2YQdxWbLeR+qTV7P6nbvl3x2CkRxGdqE/62gMiQ WYB2kmHd0dL4g0J3Yvp5YQBZmJbtGqPrctcyu/tS/TpS08Xi/C0lJpvBPJF98gGH9Unz1EPW 21PUYzbSp75UOteF87/Iki1v1yu3f/84VI5l+z1DnyAmy8xSv32pCvAO7T0ysDt+IOFoYwwg FfLZ2PWI6fE85OGPKjr43DuXvk7kntUK46jZv7ve1am9ORo0LBGS164TlFPRDby3/rR7/KIF RJIG6FmozJftVrSOk621JYyU8MmdKgYFvljPQ47MVD5j2Ni9v6pyHiiJ1oIkQIxTPfebTkp9 BhTy30z5CteznidsfO0iPyL/nLt9aCQCV4lTu0pXtJWFlU8CR8wDS7GBOXklLhiYWz/iVAXt pB9D8a4zcMdeprXv4SNaKQ0FrP3+7XzYrpdXVkYu8dYRb31CcFdB+02iKefJeDGEE2af3tei JIuXOVJx4HSMf1xuni5zhKOmhReTnySsl9dvehdxXopkEyXsLe+NRza4tvvneDPyTakfNd1k NKzdOysVFfqYoG7fn+9aIwYNTCUj7JKbl00pj1WLXI8/njMyro15ZOrPEJ3RfXqG52K49MHx SwpNKxJ8V0e19T0UWsCXrpZTnYzVSWDbA0l2L54Q2icg23Qr9SELxb4iVE9RouyVhILbBM/2 reVSSUUagzyeN3By+yHZx/8ayAjoQly96Bha+BW4WALr1kFNAsM5/3pUPf6Plw2IhGF5XnrB FIc7jYoPw2IFIw4NsTvoNDcNZ3KgXPNRcYxvYAHoXcmtxu0TPj07oMsGu7yyb54hiaginsTp 5C1lXFuoxtczUn+eAHoE8KJv4Qki26nDIfl2o7cOVi0j3+YI6g7OsRXlOXrmdeUy/tIewRVy wTkLJ5o7n2CCTBWB1ZBbh8fDMn5ipU8J3LOqO489PVtY6ppG3BwfzmODi6ff/lQlgX7ZWc1j nkF+XcO+Q1wGx1uVg/HqgfZcn+deWq6G+If2l0tYH04yqkoyZyQbjhM88+I4LKR5YDX41YJC EWPY8HA2VMTKElNLDk2O3dgmT7GMDio7yLTCxyuJxKAomRmxENNr3BEUq2y4ju6XbDcXfKSL 5HFL0RNr8tAuO/mhBEb5iQxdeXFDvsrzRRrY+q0Ls1NlOL08dZ1KfXLDuJL2VXaYsno++9W3 +2SrAZCaQ0SCTPaxExaoDO42RMtDDoj57pUsnZuY+Bqr4XIwLuMKDxgwojz2HGYS8mEZ6dH2 TUtuhlEMVi27WzLdTCAH0aTURxZK6X7ESgjF7Md/hnGb3CHp3s9JluB1ev9jn+d7bQnN9Zip Vr0zWgVusl0wm9AE1U53Voo2CtoWqNKdn0SVcOJEvrKRO1z7yVNtU19A+ue4Mp5PMGzNw18H 3BELLiAXt4JeTSITVo9VuYxCZG0a8fM/vt29I0fIc30DeQPnjB4TcTgH9JQVCp+aJHijH9J0 FgjxsNrgwz8JbpcX5pC1uH+7U6tyaHZuEtS5rtoSOkWhErIIQvlF7Vz3VMvzcp8iI7FTDUWq 5Ds3Vj6cP99piVvAv7/eP5A9IT5arSO+LwOkXuSBl7hQzcR/csrcnyqMkgpmkDks2NOkWnNB c+8aQzGcrW4xRKSmZj+tDDVAvF1v+qduoy7BNt9QfNE6hs64bJYfJ+PhSwaayx8qupkfWZId Szwb1cN7VCkDEHxWqCDC+emJSdRSSlttjpRmMyXHqky/ebV3nkdvMKh4HhkDXiptd5dYdx7S sFDruxQ0z9ahUlJs/BWLh5svnGoBcXL+dF/v8K0oY9DY2vK8BVf4K50459N3Hla9mFnpPn8O yLysJbx/BEg144F/eJ+7tkx7D6u9jvcUX/iOygAvJAchyuyMFzQtZG/NMob3K18LWEpUOwu+ hopVIIs0iFNOsqlrZDYdoEZ1JXecpjIXRwoZMaBSwMJI9s/HSJZIZu+M6KQhqakEgMt7FN7f SvL8QPaP2SO57kKwsI6gT0kSsWCaZuh7gdOski4J2OEbJJpsTUqsvUOEPrbqtF726RaQQuuv Y8ZmGrXU3t3v8nLz2/xr716OLe7obQVAfKOAxTNIDunG6HxlTiF1jiKxgFuoEUjBCprT+1Dy IEeUGsLUrO4qJ2Mz0VbaGeiu0a85/onIbwlazx67Lm05NSLu2bs0N/GE1CSOF13tWqZllTl8 xYeVmwQjzWnmi0zgD01WiCaVtOxs+zo2lSR/PFuhAtml0RnOkRNgrj0LG2sBDfrWLr0u2iZb EKxlg6LA2FlJ3mgKoOcSXnTTDEEYA3cHe1r/OgerBVybYfhLXMTJauhH1wfRCYJfB5GWOd6t +ZPss1k9pmb+p9o5IPkjtseNW0GipemTL61VWCUWTfpyrELXTz4xc9uSInXhIFaiXkrUANh1 L1NC8b91sDYfS8V2B10b7psA9BAeBwVWptI0WWqoaifbE0ECtP/a9N6MjmSRp+7ob/W1Syvo Z4xkTtKO9tyWO7WaHZl7sFcK/0Cvad31VG6om6ccrFb/QDG4K8iJ4e6brw1bdlYcspgGqCuQ f4hrqFt7AE1b5m54MItu+Y2GSbSAPHKqe7aVGpr4fF3hjiTikwV3tgFZqSVtQjutqQGAk6xY dk0y34/X2c1dvLc+JOIY+pVgA8OaU2PB685qQ+mKEl5Sfud/VGyo5Sy+GPYpR5kVp4CDCTf8 VNv6xkCc0Ej70w5vxKmfiAamxSdGFy7hfceNm1ZNJvKFkmo+swFfUjOS+0SzZwBiudivBCyM smAyQOCF9eqAdRYPbi70N3pSQwlbyu7lseSmC+nnUws1Rmxx3oQEWcvWu7c7LU0hrm/3K27u fc9P4R07DBR/dH8B9YTjSQSXmdeVFDQTNqgdX5GF9fvPDpd1E6pa1cU20tx54PhLBT5/UqqG 7yjp28VUaghqvbwpvqh2VuxsjW1/C7FXZyDYyr4nUWLwnuKZQnZoa4qbowDP+06Ct+7DOfbb XobmqRjwfGm1gPqrH3F+xGTNJxSqeT7YJh9X/hk0H952waRc2JgD+oLhj3RXapSul/VpUIuT dYyMxwzS/MZogJPUysdIdAgi4cgSERAsK3Sx4N/L37TS7WBECa/LxxcANeYA2A9qpuCDG+0P wZ5macmaGIyl297dl51pbLsIRYeHB5dORqEe++XJ3s7A7tatk9foDE0zrVZCw/ZDy3J5x31x oB2U50qoyo3kK+b07PqKnMygmNpUBGzEUckQd7d0k1edo1HmjVU6XkRhaeZcVxA680Z2RE/w PXJntuy1oFyq5/24vUefFP83sOW/LNaeKNSB3IKyEg4vPQHcPsItrgLP4zmk+jVTf27YyzAQ NUmwSBFWfkUhBVzpLOIufXJq4BbJxN8p0467Dkhf8FNMr9RwzzBJlol092ks8NihJRW84e4I Loruj4lZzoynsgeEWOdhDqzjC+zeaGatuQasP0BaR8FSQhR2J/GkmLChhP2rARx4qbh6D6O8 dFWzr9PGv9vGjG6C7dJYCVd8aybdZh0v2x1iWC1fGEeKBWxI0bOp2BJwD0GVYfM6llddAbKR b14IvYLfch0C2MSYmiuxO8LFOTevNyIrGKYtj4rWk/+N7F993bNgfGaTzl4o7aNVKUxW4JTB 1Eijk701NMBRRBl09yXYrCS2nhXuG9MW7fNsBvCB4EkBqIWJyk4VQ0f4InIatG64gHN2YK+h JbKv0qZt/OVt5jBm10DkoMh+e1ww4T/t9o8SJclxS6ZyNbQAfHWkJ48tG8AEhuNak9YnkF8X ujXgYsHXSLayA/pu9RwfkBgC9/MpLbO4EpAADJ/zQghMET+DsKXuGXW7kpbU72TsUl28rGLr s8fiEchfInY4HjE2MgeLhXkzwn15zgi/EkgBc3sN8nuEuYEZ2Ye+KIDGkk0sWMLs0bUBW+8n DwsKG5GVyA19A7v8b7IsL73XGiZ+dMWC0tY+OiODN9Eat+7v5k8wPuSTA9iQpqeR7lyGI/pq Uw/B5hD6h7NpmsrmowkY9xhK6lrLjw90Q/wWA0eCQlnW/GINNlJu3JkNNzTcan0Unkz6RmTS hJ2Bha6lzgySyT+AcmrHY0vEcfCBf3GC5rTiAv6yOScSGSwKK+8iCAfxqvU5YK3AjwNb4tp+ 68rB79rEvPYdJmYfzzAR1P6hodg+zyxSz2DTXa8kXJGbpJ7FuxzHdgGprMcLFRNIW3MGt4zC slPXwK+ECkSq2qHPoTCHM8HwPgHwtySHT1Ye94bWNeQV03nD5y/8Om9u5mdnVicubkFoNFvA KoSpAO38eaCwmnaHGcgh2DmQ2etYMhhuPta3Xymcnff8oFpzKmDEu1zZ+eoF1bt4AhThnRkK 1mZOO3Xhv2fkLdz8qIGrb7nQd95cgdHpjfLkuAtd2DaZ4JCayoAp/tI15o8JttbGl1mDGnhK En+2igTHYbfmJYFTL2zL9IAVB8bNXUiFEeeSMic2K5sgx8By7NGA0hKO7R3CYz9G+JNvvEiz exaOEuTQ0GDPtN+HIL7zwC3X/jlGMQmuof869gkDR03iLzLM0ce45ggEQ95NB8vNT3DsqtoD X89R4zJDncr7iV/rml1PZsSRQ0+27wyKku12+sz/eYF2Okn9bbWZY1Qiow3rb779KvUVMFnT xTPmjXgf1nEEeg0PvkY6gg4nuiQQROKHbaRlneWmM9fd5VJ/2oC6VyfJrDdPVRz3w0HvkAAi dbCZIAazHOwD/TLFjMa1ZV/pVu9LToVptouQzitbtCL5EHduRbDLYMWNyD1QRUaKTb6cufv1 Ab0US3/CBw2fdScAL8JvFvlR0wGyX8RMaktQHGQf/6b4KovehZxFGpAkM+0eBFfGO+NspD12 aVZeg0TXDBavyXgkbPMDne3UmuwYKAc85o7bZYT3AnecuzWsXxGKdyKm4Bak3WhnqOeC/erO MjAe6uIUw7SCIEa2w5XU7z42SF1ELKcUt8MVjy/dnAYNgzxfqN8BthLNEIywgUQZ5Q4UAOZM jeOX54dpD6TfjL4G/jIGgBaPQClzWJniCDpMiEJrgowMWRKnE4AVSOZ0h4rzMEh++t5qd/U4 VxQnEp07JxPAjfOWYNFBZCyY40S60e6FPRGkOqCPObwQiMR8ruNqf0yNo95J6CHEQa84SStC a68WXFga6BlmOlm6E5bUP+dYJchmhKetfhc0dEojCVPf+U3J4q6DA5kPKKHyxUUEZmLlG8mF xLZYr4jj4l2x34QyTWSNNdG8q0PToHml7cWAbr/AWdBzjcTTur8lQXMAd7W+07/Gr0n/LCO8 JlS2JHiBCD2oRCgUynSZ+im/8ajK1FwU+u3ek4ZhU7PwZJdLX3wofwx5IL6nAbXU0HSNL/TX UF9nXbJVYP00B0rHSPeVVe3csTd71uknTerwH+HR9XMsuyVa2rFteAmdn/YWY5Y5Rf2QNrkE wfMDain3Ss0IZWu9nthHGDtMXZhXBSY/6M1mc7IHj5pGAqX4IDjAsayaAkXUxhJEoeVnjTfE 9QTr1+pN+SJ7/FQvzNuUT46FZQJMJpDAl9Q5hvwQ+0FvH5/8ZZCJvAIaW3x2Y2e5Hqub4jVc XLTvagAWIcGVmyniXwQ7SeKLCYNHEdHYu4SQjAkyl2nu2qSSDPdWvTbBGGRf9jS7Pxb+AIPE LINSNrO9iGCJ4j79M562+S7POvfTURKZqpsnzeKfhpm/Hyo+p2Cr+rHEXfFCOlG5giE29FLW WCt8/yKQqowvhlrKkJ9EozCuZjzWVxQ40HIp/MZQRKToG48XQhRPQXTdw/1CK/rCfVlEufnW 1WjyusbIa2ZFnFwP8NHxfU0QK/3+R5RZkKcEHAeej99bfVrxjQHOGVboS09OVctGhm0xDEgQ 6K2PeJcpPNAGXfzQgUj9DDoR/0r2so7bviiQqoPnuPejsfPq+pFbrxwLgt4IYFKzZu1Oln4s u4mw+QhsRzI3Cbs7o3wv2aHc2QaOobwV18jTyhcQe8dbfc7iMYBb7lNqOT775zlQ9+wK5Gz8 7KfYIR2WlGq6PTHfz+vqMOQQdNh6dUFF+fim2k1/ivPKo+iOIt1vSngy9kfVvHcYldudtSOs xVatOH6+ccDJKWXnPqvx85r9R4q6oS53/PfWh++KLZb9l0fuTOgjwmN/VWWLzZs2jm+dpwwn n5Cpkgr7t0Fn8V4AG9/+IYapZqd6elX4l1IHbZaxZM8zVKnAGUc0bXcohGZMlukuHTEpTSXU QdpHrRSWSK991dGu43cG/WzsyjkO2z4QPZ4XKKcb4MDSeODuUMZLQZm+dCOsfQHJAFy8OWBP DITxsBEgx8Wc70nC8wuKLVGV363WMpvgv5ogo1ZLt1pzD2K/GisiuiebxzHcq7Op2i9vsEdR 9CZHmLIW0+NVLfDQ4zRlEQZ9oNC+aFXXdPXW1l259oPgxct5Zv6088dW188MEgntn87I4g8K vRwEVBEgmjZ9ZZ/Z1VidlJjUTYrJHdBDj7kYbaPcAhzIWmBD8v7eeR+54e9WijMmjTZKfDLK BAHwB9nDomd+HwWxcpoMMJb5sUw1D3X9MNES1FGM54vwL0l6CqxpNgIKvVPoY506HH/mHpbi +PQHHsg8avaeUtXgTlyVIIrvyL7Xdd+HAKkq+BLon0piqlUgd/BqoHNqYVv6i0TXockKPbfo AUYt2gAtvFG0KPVQEiyI9sSkVhbNQIx9Jh5L/Rom/QNc1Ds7iDTTVHa2+K+Q/48DGI6hxxbc TCzSclMagDxAdfl7EsZlQJkdkv13aCLtXL18b0jYNlX8Mnlq1dhkQhlgpNaHPCypwJzrWHFW mqvb+n3xqvZ26MKrzcrWhsmRMQHPcnTg1fAvRiPl4l8i9DTnn0YJR5hsSoLX+lyeGvGhwy22 lKlbitzeGh+/TwldpWyUSPURPiPtSZfYEtHlJ/HW9NzZUO3ZWpcsaMG/KrcRoddTFUQ+qEPn 4HdTUYLoFmXEj/2tJe77idKfB5GepDvq6Z+RIr9RpUB1dQu+WyGvhytbi7SMXZ0fabnJQW26 5q1Tv5T61BfYSqNk6pWWSU0QGCIxn7EkdQCkQblfRPgCJc7FeeDqoazkfx56PNBqD1Erm1pu wEmfIlYXE/7NV+rqs0+X7vLbHaI4Vra7HkH7fjMel4iO4Q6KL8AAY3Nnqh56J5af79Yq9eVs 6PgIHAPedCzMGFMAhzUbehT2WqeOlPb9N/Akaiu/YBQYuGje1MaOUNh+G5P6RtJbWGFF/NVs xcMj9EmKcGJp7N3y0oN88D6yWmBWYBfgq1r+EwcPRO6M07iVV5ShTH115sTrkEZjrhbSmqSO vKO8y8SWEuq2p1avBl3GdgXk+3RfslvA0JlVVRlu/eXiSahqtKSRs2iluJfKLwXj08zACDWF j/rvT1eyhWRix/V53gIolI7g9T8GpcDXrQ2jvbaYQVVCYWsVS9C2OeGuvxZcTgE8j41YD3k5 49nhL5rxScd1XwsoHncfjdn2OPMMGOzLuIAicxsGE0nMeN6pM0S1+wSHNxdVs9WiQm8ijrb2 l5E9EFWNp8vF1zKVlREd7yYy0ppUD/BhaHkuQ872P91wMQ9/FObKRHp4DEAMoauVk0LgVcdf PxVXHVtVCKlq3zqQGTN55NWnf1j54rzQgd5MWFqT85GKz65ZsyZme7b91RvEpE5Sv8UfvSXV ZgHUsP0LvkRD0eer1GeZBfvywUTmG7Rn+lMbKLMMWlr9eb2lO6qQLH4bu2xr4iTI8xpqqD1b IMiOt8M+HbiM+UkO2S30OrKhMKsKL8OZrzi+yYiqQH829VmIl+n6Mi0ZdpRb9gNHMjPXtIxt f7SqpkceKS5o8Hd6JAV9pTLKYNgwizN0KhuhXUgPxGG9ltKzB0CsB/dt6S9nkX5bD3rX7Z+V RxQEU2gziB9NPxYCcGak+n5q0J8i73LmbytPyMN6x/q9dcc/oN2T8c63ERHauFwkT6IU/VNA vsaxAaQE1suWxGF6XgXbL2SIs6aTUVullp/Sb0b1OsHuFotK1qKJ//qLQn8Lc/038shZ1VNo sMLGaurOz6adXCjzYMRRHPEBwqexKLvxQ9RD5r57/GSkd9ps2j9A8YT7yYRs6KsBgEDxYhrE Y88fMQtoA8gHjJhdoCvVCwe4PnF0t+7al1cktaYcjuIDLmLysqAs6c5LancFPC/Mdoh9ChKJ eaZe50MZGEHTM9Z61zi2I2gf3Mqzzcbn8YgK9EZUi1Y6QMCwaYXajI/PvJeU42TR03wBUE91 KQooeWBE0m5jMI/ZZhN+6i7fXypPeJg+FiaImyr6bdl12mpLwt1kOcLESZcHCv0z5N8zXsav X7weANe/EikCrkvuujVr4hXa+1yt7pNP323i+dYRtKNIwMZ7/dz/Fh9RngvQMn58g67xeKgU /7qFmLctZS5iz9wCTVcxPt/6JmssOPrhx2Xn+1xB3AdsyNBPgB01xCsnZ9cOfRccK91t+h7U CgNlbT3Q/3WhcfR2OQgsHLAR8U7rAUAApdfG+IhgxU+UlvHhL1FY+yZS0FDUXGchoszNZa3Y 2Q3iczGd47j6UTy5UyoR0PiAG/4feLo52F7DEyfNl1jQB2HyRwxTvAw+91PDBiBK3X38Tutq Ig0H8J5voT41etlA9eebimL13XF7pbva9tx8EiFOYalLBkK2lN8OYphij+4Q78HhnXVhVr3w LAT+6xv65/I3dPEBZhtg6ZAanPBvlBDpisFkSPo/wE9gUQbbp0zXEgT2NBBSpKPQG3DMWWhD j1KVUe2uw7fTqEv327yh9QeCF60LMj/p2uTq8yTK0oXAdbI3TmNs+BbpBSh3/DcPEVZ8JqOf OoZprDlAxvmznJt9ZPBhPJWZHWYGZQWduAhIcqeWI/fljISm4zj//AcBqio1RtnMtO8p6YS6 bp+ufnEjaMZt5IpRr+IBMNgDb6/U02y7J9n6tetXFV90UM9+V4IHvFmzsZ2tLdKbsfD73kFs cmeNhHPdstkVpxPgtYEF3vUz7pTVlZNCpDZN3eTOwlPJdX2r5k7vMyvsndRU0u2dZgqjYCJZ o88jBoxdVwxq7mTi/MeMRUv/9AuxzkGXjtmaJmaOBmri+oPP0g1b5y7+kjhyjot0jot0Ga+I 6984K9TLbmh41gk0hBbVp6uqPMukbh5oW2isA9ihG1rJ/VWH8RHQu1dI8Zl2jUt8BocPqjNo 9WrGY/ynv2aFurZw0BeW3rFznl7hWcVJl06OrHq1RhCAIWc1EguSM+7JAYvb2GaRXwzH3Ltl wJH8GT+/htrBa/Z3Gg4tWqQD29iWqWZjawiI778MCAeGgSMSCxIy0DyH8Bjcyn7Lxe0v30Jy nVyncCp1dzXCoGF8WCNo2/VpKZBGLOA8fPtG8OMeXH52k+QNdMNgP/00/QTpooZ7KApyTSgv 88S10CSAiVPuP22uuad6ueZ07sg19NFzWkgeiPLV+ziV3hQ3rhucAJyDHjohKX0AlAnTg2e5 fbjIHYyjPCdIPEcF/yekvMxPF6dPcb/Ahw4kow7EJ3KPvwOvob9n/TrGdZ6Yf9po91uucI9X uYFWP4XyAtP09O/jLPUmpbjHYdxAYbe1YgEmeWf14HJ5y0JcS9U6wBXNRa5o/mL+xfyL+Rfz L+ZfzL+YfzH/Yv7F/Iv5F/Mv5l/Mv5h/Mf9i/sX8i/kX8/8zTF/1NvaD0v3f65eid3d197dL /9zbHP+zP859LEWvVv8vAwHURHJyJydkLHIpsvHexDNjyeiVV26OodtDw+P3ZusFdffZj55e RwsgeLfsIb7S//0snoadid7av+zTsP+jS0lrd5D0SHdl+WBj3ZJbyHhYu1f177XnYlEr0wul 7zcoHlGh60NW9uuxNb03rewj1wVLa76PLJT8+XXV+938i+rRKhRapyCT2tE6oySFvwJiGaIl Nf3gNbk4/47ET0vS+CtCLAh0qbADgPNfQhlBdfMzxae+rFw2mcjj5nm4rVtJBv/AzEkR6nhP oJf9CQn946w2O5WqM/YlXvpaUqebGIO9Ab7oFEBZXXXo3uYs1VGmeRerz/FfR18YDJ3utnPi WcX57/0qQgiRxOopV+A1TQUPqoNfHXmX+XtW98/OrO7+fjU3z1UrR/HjWXZ/ClwyEqxwK5kb WSauK1UbWcoqNTdc0i5F6B9xhW8HnyCN7zF30TTKasCr76GUAH+cv/wOWlUFn6n1R6WNHXPs /NiHGQjdAj0W9RZEEvPZArax/VNPjKkBxfWd3mdqKUnQH2kTpUnXhUiOWsufS1VVwlAyJEFa jsMAtXG/+xhr6Z36bJJbRzQUf1HfyQjtXT/z4gUU2hj2fdsSva8ov/fu8xL62EkHANAT5oRb yTlNH9/nlDo3RS1L9lMzVFW2h64I/jbQJoGPk858HBG/5NR9sawjDle+h/jliJr4BD4C366+ EXAUHvb90lWdYD142DQnRHfrjkmAaBZ1W4rBBzkgQ3+R+dt3/GZruaeGNClbW6XGUYsE43Iq EjodP118lulLIzYhpK496DQ+U7e7IWYSoKBSMz5Azc5287eDb5epviFkjvoNa+v+iU/qLLBG R5XyLjru7/AfwyZ3Ik6Z1KFBogx2duN+G4V5A+1wHR5m0C+e1GkfMhblASIVbbJ62YerngGl wWDSVyQ6islgt1kJZdX9SU/ufHoWGu2Da3nD1LiBmigGm+BWNn2uoKOWcCv5SOhVraPw7S/a Id+ccSsunIvpCm5RATQFqK6+az7Of3xPUFolbAeR1GkrRNK9t9OWAYX+oXfEzVDf6qT8H0VX Hsj0/8Z/X61YOcok5ajYQY0ox0aSWtjYHBUzuUZy3+QIuZtCNkYzZ66csxyRe3Mlyn1FlDN3 jhzhp/8/79fn87ye1/N6nj8+7/fbJwC8epgO+X74Pah+70v94SbfWYoaWmX/YuBh9x55pmbr 08svajxyvl/ZU4rROrQkHZeyrVB9HefqHWpCUo0M8XfGi/ZZcai5tjWR2DQiq3nl390ZF5I8 5XZ2rwXt/l7Xfagz7mfKnkKeo+ydfpOX1FYcjU9+H3tYjdYJ3Jlgxd46cIjWkYQ+CWpbPYlO h1oY417q3NG59ezQ9BzFXO1gjsX3SZBxmmLiXDff0guiPDHvE83+frhqFa3zQTVgn+0TD+iS DFbXYXTpSoAWYfvURZh0XPu7F0Dv+LozKhjW84Sl+YuBKHFKjapqIk9a91pTh3hwNOCRTg8v wPyXhkMpsjYKuEUZaJvKvfDm0dPP8rO0hZGtjafffJXY4HEvORlhM3naaidSOE38MBhQfDP4 8E1SQ9C9Y44jXajq+UglU24i83uyTNONxo8yPTE9AXwhTi898MJ1v9+GG93mMOG6rV2TdN+z N3H0zeLhCB0MTRacxZ9yXCG81AANRFTeRB2AgPTjR3zh5WbTajunKH3vvUO0PQyJIYG7H5f7 BfFLubrR0EKetPDJRodLwWPAD4/JIzqZ1+FO0LvHCh3LvL/dY8lAKxBPbIOXTB0IwuN6XRl2 zL3QaV1yQ/DRw+IJk0F2X0aqr9P9BtyV9t12dR7pZNFBpg5F3Vn1TogEj2devFjKMT7eQFHg 59O2VGAFpeug4KxHxYOIPy6E9cesPB4lObvySfsShbMgBawQ7fPNRwdwoMjr58ehzm8KvW+o yz0p5OZTdfCHd3Z7+52ljNuKm2AqR2S3CL1Yrh6D+m96unLIiYkJo7gG7uDU6akEZFDZ40Dm f42nmMcWfw79t1WXtpMccf/YYiDRvb9fHHq03qXLeLncRnt/9xe9fr+2PlL7t0h+++ef01/I DY1ceVQty+36AebWktLwdbdDhbMeI3t/i9cVKQWBsntVn7YutY1KZItiHb26kle07ta6VGxF L0ul/ENo1OCsfwHwhl0iiJtCDwff08eZETZ+8PWXPFyBgXzeN4ydYarXoLRZLWvmUPdUnavF UYd4WBN5VTFvUBrrl8r6av0nsiMNfGThtsGkrfocGUpsabIn4Y1HkPmNZ/TKmUuvutuyJGcb gpu19z/Ld0tjCbnAcaVClb67OkI0EfcXqx+1LGAcSW/GD6oluRdsoEs8j/gqE5BjQWPvr9fw UzaqLX29YhyPXXVyKKl/7Ns1a/4sPJxV6iWxJZ9BW9yw3rkLdsVzYLU994INhQ7+9upatzOW 1SyEG2aUXDd5uLYKuJOTytx5x03H/8RXdA58tWMiv2TQRLxfr45qWXByfOU/pTNiBi09LLBG rvhQf/or5iTOtH0SMblRoyuXS0K7WwSc4xi9iPa+/PWH6xSyNBcIx0dAVW4aHnABRVIb8iCH f1u/P252/f6YR6VXMxG9+Crem6JBfV+ShHfCiw5lOHV6X/Y5yE6dHVK50zserePJq4bbjga7 CgR/5X936uP+iPlMrrBE7VZUXeeXjzqCo4VvHjM15TS5h/R1muQbeTeZA7pRrNTZOcHN6jOF FbSyr2GkLv1Y6iGOgxMyQQgRA41+QtkjuXTqthdjmcQP/e6BoYOPtgvUux/zSzu0ngXFe3hq U3yedn2xjvQb4xTcFBnLNCNgb0UPJi5U9EjOXToiUcQza7VDy0IlOAfSY0Uk/rh2IqE2y7Ke 2Mx4gmTeqBWMCEhIM4H+ql8GvbF1ElJlHBjWl93UXBcpmK3ZwZXRLGJ3BWioTBbH2hbn5yBI 8LEzz6l5O9VcOlOQc0F/2YtGNdM/3gxouxjj/JO/H1Db5xp2bzEqO37TfYq+934JP14winmr DE9W0rAllpLMDoL11hyOhpOK01zSpeBWsySrGKCZe0Yw8B9Ok/kMzP8N/D19/6/RC7QidkTl zmMJ/BSypzJH0PEU9rPCmhmoZM42kzVk3QGaUYtrsOSylkarQpeTnv2d9B/B8O0pOOms1G5s ddH3pSmnjwrXc0Gjw8NxWnZ3wKKR4IW/AwqYXR30webVeyKGoQ8oLO5zgaeAjuCv5WAYMmj/ worQVgPABG1l2kWJHY6azJu2vaZarbNVqQO/Duxl/xbZKJqMZjHHLpj5yIVBe+67ODHwGRJi 8H7rn6HTaq+PnAdelrWCubbSMR9DchzKM3kz0Zw+UmpojfTfKdHuRa3Tffy77samZ98Kh1Z4 f/BnPKAcixU8siBHqJ4daaOgfMbIQ+emrO/fuAqZVuUBvyOZPWa2eQz8Cz4rV8xF9vCvtg8j bk4Pq6hGODgFFIk/EmhRMwAd4wQuStkYYWxtlExHT/OVNwBe/g0Udzl/y4b6k9izLmKS1mu+ OHgHVNP4qFJhDaV5RZk8/6xVZzb9WIS5BocwV2E5YFRrVFu9HP4KEjiXZdSaxQllmLtUN36/ vhg+qfqe7kjDf6cRGEXKf7dLstPXf1zFL5+z/92fFjf3bC8Wg7VlOfv03dThyMWkf+U3kf57 7kNJ0F/WSumf5/C1u7AAXp3VFnen6933AlsFQC4mL0XJGwmsyvHxOyDpOa0SoLf4KkqThnVM zAoSLAX2Tz2I5A5CAh8AHmC+FkR09petny0BbKrGEcgSKoXG//4wbZLrbmCbzBdR39c/NphG DmXdioT2nLiqUtze1UOds70HG4ZK91qy0Jt031cAXPLtU9p3tMteH5Pe2f1i1m63XLCZ9MHK 3QgADd2vdqHeeNHupVZ9K58lRtNS16TutZ8UNb75DSQ6dKSPXrHLf/fBDOFgLCFkYFDN+KJq 2RR2ePehYrbmusOCHDqYNFTS2uneJG/ny5vPkpZXLyH5M1S7444HVWu0+g0yTzmUAu+njLX8 LygKgHt+W9dN0I20TCQu2TMJQrUlk3W3LqhCOxpQygPgjmG160CFRmK9uPxO/1vdPM6XKE5h hH2AUAVQB78UxqNg5/CiSm4RyH3m4CT/EOn2IPlQeJ/flpRUgqe8TVaoCx4fdDUPWBkE8eoQ Ut9zYZ9VfQ/le+uBBaWYde8I7DUqHtUO3iUi243Ze3qCL66BdFrovohxrIQ3ya8kB0Ks+0S0 1HbPIoeCOZcLlOpTfSxC2lCCe8YFaD5sGc/WbL3PxGVdz7LMXkfQRrHTQ1COMuz6g21tLQvh YDGqbdR9W+DI3JisOkRTcPqmzL59qZSqn05hPEWEYmWNfGgbYkYZXalZEDO+ya0Qh+I8K/qO r2OmR78ng+bo/+mvEj8igEPFHn1DR6+9m2dgKiXdZ5O6kfTN08oFr1JhlXnti7o1+Q4Fn/F2 j3apW/1e6y/WiBMxhaGt0M1fegG2YakbJLImLKMarI4prLWO+5m+/tBMBj7jIASVao9jupon gILb1xaNQKBOj28KVQcwpW8+IDO/M9OWWE/PHQaNMWfKItenzs9FAEYIakIwHS+ZfR/Y814J Wdv2oPKH2FHtQpJZjdHYZrkdSfgIUu7Pwy2x14+Rkqf8LdwL4bDf9Hu2ISjNCnEGSnOB1eMU Uhlep5LfrvQd82Rf7XDTZZR8uy+ssX2e59KBDb8sR2i8Fj7TGzhixikdJ7PLN76uuNstexR2 WZzYvj1MMCkviTuD5F089qzAh6HlaZF888QowARBWLkgeFrTUXzMgSA+kBmTpcyNQ4yjJ8qA 3ISeJn7pn+kr/T+P1OBV8G7nJAs10u9ZzoAgf9Wl2lpcD4NunUiJn2vzZtgng0FbY3+ke0tp Xea1k9bvoJ44nD9q7Y+5AQcaUxNF0W7KgTBFybboq1NakSR7kmF4c0CtBJl+JCrBDBI1sohP 8YpyJpQ8lwcctQKtYVHYsvdiSw5xv2QRVVkS9MoASQ60dpm+k44bSvsArJKU94dWjlLWqbbM TBApFHQmuF+PIeEZ48dPDaLM/Sy1PV/PcVegM6A9xrFeysVQKUSGh3teRvNK1SPAgAG/JWkE UiHWWpY1jZh7hiW4/0khtHerxr2e2s6nWyW6X4J42YZExQxDO8NM3wH9LA/Dtsqt6X85S9vn 6Ixij6oWlZWtPq6k+DnnY9TJS3BS1Grl9/Rws4GtjBWFHUgota2uRFbna7H3leB/Er+5SML1 RY6FNZPrs6AGvXGBIN/ONOqL83T6yOrkNWiwxkQbg11otPHVX5SzYM/vEcd6PzdloHjgUxNM IKnsK6qDtWoB6XYbBYxBZS2LSuoKSIsJ4D3EweUCdMEvblWYPHFUbyLodYMbF1hqvqUgHHK4 bVhh++p6V27QazG/AiAfIQSC7N61j0CDkbDZpAekrk21xhyHoiIxSIqt2fsWv42mO1h2RPSD JxSPO0hkF9ePKnA6QEOqe5zcKF0qwDlQYNeuMtSY1Qqprikp77bCdtl9KBlWqNqN7EC1YvHS p2d1NBXBDcqi8vQPtKwHnKKOhgPtGvAiEO4U/xClwZYqL9Wt0LRcQzMNITMKlyhiuwlUC3QM rSTcMgQ8m9RZcgVsjL0ELX1P8kpGoTmXoGgso5bkOPViwE/bS69f/6JhFFtyIeyMNnLYY3tV np+LwxhDbSnQIiFKDJq7ef3KzbLBrzYRqjLdTpyKtu1ohZ6n0qQULri8XQU63vOrkVoeyXOg PlgUaMGKciOHghzfWC9tVhX/rOJ9SxG6+PcQzJAIxmBeT8JZ/Gg3i0Tb0asDW9HIGNt2fFt7 RDvpBLQ9NBoF08HDdz7ujYfTLFJ4K8LD3YjvYoy8/L60Xx/MoC8ivLetwK+54Fng6yJKZmvO dFezZNOQaUQ9pfN1ZsyxevaRVM0D0EeYeu3IUjDn5ZNk6NjL9HekJMbQGcUC0kfGl/Z8NacI hZ/s+6Jl9AakujHMPcUxRQ/XIzQZRG7gBVSggeM2k/dE7PwSEinaT4/0yzArLaUNhr2nzvm7 U2cWgK0QGWjpxDVHiuT8xhC7D2W4Xxv2OMiZ7vNQMxQ0b+HwWLQcJwlTeXX+aPoUAChi0F9c 4fA4DYWiHxYKMSYl19qVLRf8sW7AMvA598+ySF+583coeqAkhuRpJYXuQFDh5YHawT5E94Mn ovSj3HoQz6cIWEVEaqVf0tMCjjP6O8lycPWznGMQy9pbfz7frx84ykirnDSpa3CoeUqgzDpu bttm8y3N5w9tUSt9ycGGfqk/Lj9GkARB7KwPxi3o4aLONN0FM0DBY1nsKMSvGmLcqv+czJmP AKeSTIiuhVPaRv6bP1EBF+6f239nT4qAjinGkXnHPyX0oeyV6z9c/Nj06QA6QnBpAdqzZ1j2 cUN00JSyc0oYaNQbR/Rk9tr+4DMlciRnoQKM5LRpa7+cSWGQvB/4qJ8DBYvmIWNvMyB/2kLo hRA15nTA3LP+D1OoMaOr/KxQ0T727i+Tf5v7bNCxN3NOeX1GlD6AccJMcdZPQhbZBjiZtY2J ohXcBJeUeiLN68tdTJ90NwOVjxgxFfcGUoEdZlrl1MKTyNz0oxq0g6QIJFvc5Rjz6xwZ/IZQ j8aHUmJvDfAqziONZ5QH2DNOsLdPm1ooY5FCQb/dTw9BIRU33tIgba4WNYFRqUY82vLN6k9J Q5Ah94m4yOkiQXzsjRZIMSTXpo5gTe4HK1ua5EicJT4EDcc1CP5Kcst81yXsgu4gAWBFhaET YBNYAl12tErEI/Qp8m5DAtv7/Gtno42EvKUoAEwbWD2rCt8RcgbSjYxfWUnFGJfwqUm6tAVT v5FS+puuIeOprypICZ7VNK0n+6Z/vu15yLPy3UJUgan+6oIHdseSVWCSC89khEFlj1orLNcF 9+SUM+ifuW8cLDbDZAEQ4WxURyMUMmDCUQlu4se6fZZRP8/pz2txI0ua4H4FzdtEaVR81892 wivgUv1mjN+dqf99hYDzc2U+xNWshA13NaddqGEh//U3PQNNSGh8ekBdOITQXCrQushfVmuG lB7+t9P25bn9jHIxxcILMNqv9OAiJKzH7NpD4ruFPK8QKn6BdC9lKHHx1SSa7eXxbacX7FrK xb65baaGRdeUZEEQVyCy2nXb3E72c9Kl4rwDm3a9BTkIm0RbNF7xWa24G1o0Of3Oqy6/I1va Uii1tKSj8t/yOM4VJ2YH9XiEXFmDBbG7AG1eZaxbU2yj/40cAGrLWI6zROyp8c6bwZclz68n LyYkxX8wDln2lTPrNhF3JkUeBeC7YcTQpm1eSZY/2NAYy3ZbSqQTYqwUF5V79RXseGDEI45/ KPyQQ6w9al1Qfu/eNNL1V3bq/Gxqg1B8YdZU2q5zEb57tq4gCSLNUk8jhEEMmkkCmov8+JLK sZB9bUfVGOllbS/6/QHylV60fYjqQnPE5gNN6hE50iGgDXremQKvFAauAgXj1u3a15ngEaHc Ph/v8x+ngys5fi6wW3JSCylkQGy56qf9dT2qHDGykX/WslKbUHBB0VClhlrYx1ZeeDuJ6mer 4MD9chcNqxfKC62qYrzY+V4GMBUzKbFOSpu3UKqIh+fvjfW7Fvf1xA1J/SFKaBINQp5MF7sZ BrFNjxWAJbg9o2jMZ6hZPzLYhuZD36EKW0i5yquWEgj1L0DC0Ouj/HHAvKVgu00y68SPvj/K RX+177w5UdNjBcJfRed///CQOMptXQLQJyVBDFlx3K1+2uLw4PWoKMbTfOnCwavpEC/HTHsO YcGCFyb5b28t/tRtQh4hT03xeLLt+ZLPel9BzpvBWRQrPsxByLqWhTRkIC1HHT2lVG3VfkIq LhyROpleCVAtwb8MZWTlIt5u+t0rs9YDeQ5oOv5YOCDkS/A4GoID7ygPZc2iCtipC/Hu4smw +WV0ta3me9EI2KwbdJUWq2lRBFaVPP9b2Dg01AgvP1p+D2LGkvt5ViWxjX9ShPpKKoZ6NNgE brN6H317cpa+eYhVENUHOZkLOw7JIYI9QhLYzE4gDVftFXJc5S6zV1iXMEtqQ4fBdJ7GKGn4 bvleYuijxSXVjdAdLgMGP+oK+l3ZPgkPA5gewCjEGeocka7lxpaZh0xezYBIKXZjc0yx3xCk B60E3Gm6hXkILIjiLoqHmQ3Nu2dity7DZHXFR9dWwWef2qbRI+0aHehQhh5ZEmCy06J4K2T+ wk7nES/njPE8rTdEFhVff+Mv4RpdhnRc77JzUmbEaO3GCSZ/oKHyPVjR1fs0JYZxnNBjUSVi eTEItyiILHV8krgaNp0yf6YD1AUN1uM3b+WErG3kcELM6rujM8sFCxd2mrz787K0SYvB1psT yvD5FPsxmSp+AjMGewdLcwt58IQLJz8ot4AaWLC1fHIZ1mPt4lQ6brMySVIccUE/zYM98XBf zYdyLeaDxeI/PGTG8xuLvspDXTDL9jVzQNjXyDSRH0d5ZJdbP6AwLJsR6q3tVxBxCWwDSMyj 1iKKAa5GeuC9KPzK8iQa85S6Bdy0Jn77rfnlQjAWQ+5JdsUUDir8FnbRvyuHz+TXIsW7fjXO tCH1uX72STjbRGDbOZMUvvpHeUyXW2dDZXGL5TMLE6iBA99iqwF0G6mPpLmCEtat9g1xzD2p a5Gmp9s1Ej+xuXjP4iX51TxPCPle4NuxYhlIz9ucDldBgx8tBVvUhn9HTfmo4uLdinVirMZJ u9Bqys8mhL5Co7YXY4NvaXNoBqBR2OeVFYmtgGqFiyaAFlMAVwf2huCj55soeCORed5N65K4 DkqXYLBpAmA6WSTeNnB9+GLtvc5a/pWnAfrPjIaxWNosZe3KRx6LXCMtknKJfrNxBCS3Tix3 r/hnUIL9b4lR4YpsZVdc34vN6hgTWA87x4uo6521MsWKVTtgX20uzRFyzyyIilwN83OvgAJK bHQ5NCVJhi6OO9FISE9aRZvLrZ3tn3zdS7S3/L61gs+MlLT9InpZ/E/NSoVmP9uSJLVlfvm0 ojFeNxFxEXhHnfQq3kLKDFtmauoYn+6tfThTdPR7N2E4po9ieC0nmDk7MWMXKcEQIBt+PJMG GO68gxavjTuQP4Xx+681C1BxlZ8OhugfWQFn8qUiFvk9+QfqRU8/OFsZiaiarhhdblCEpR65 ijgObgh6i7upAbsMoy1trLKjVGZaKjxzo3TzYJHJPH9z9oGLxWDpWjt1UtEp5x2sNGTV1JI6 d0dk2HGiWGX5Q+cYfxjEYXYTMwLJgIglg39ar1om/vtwV+I5d/E90BD/7SSY6uiRFWSpjDvE Vr400N26+OXmOuZMkj55sYqg92NT2LQT5n/R0n9QiapPwpAWn/fZI4RZ/OZgRwP35kUyj33m O14CDo5oTEX3nD4lYZiMY3STkKU9bJtuEqF0pGUmW1RON7PTjCkaBmPulzk/+d6T8nYj7L9P CTTJv+NLAMM7TOTH0ltGui7Wlb6L6VBMzy+li3Ur5RaeH2cAR1R1hGaLvNo8as3M/JUcYRd8 BGTkdpBNGfgVRYD+KPklW4x+aRC4YB1Kt+jkxagMZaRHwvAPRSaBPaIlgi49FEmh+7oVsfYH C5PAwngAD+/Iz+rf6Goyys/K4Pf8xcd8ClePRy7kR6+PGGVWOFDJaVatc3KsNfGuiZrUaAFY EyUj/8YJWBXG0UvUi1iOq3mFswamS48E07WcNBOXLL5QxjbB517V56aLBDatCjtwXL08f7m9 C/NDndTnAq+PszFaDACPFdvqC2cBVHhuY8Th7ZsTZmykhyXpJMaAssyyN24VJpqYttLxVxfn okTBKni9wtGU9I46Ll29b92emgUqlq32Twt3SoV54oth8LW+t3RN3ZTbIDLecz3AiGxY3b0U 46nq6hnvoyM+z3PT6CH5oR6HVBxHlySkWhmhTbJBEGucebW7npvyx7Vf7zc+DqMtyC8AwlP0 cYz0oSO+oos6SJEw/aN3tS6ChkpHRIV3utJhwhwCJz+90xUJbNSySH698do6GzyinymcULZx wj8hKx1QXGACqd7pLin3MBPkLMkGuCyckkIuWJLQn64gSExes/DLGnAz18AFp2V2NR3PfBsA 072XvZ3w/Zf47T5vjT/gbJUMWGgQseM//Ynufd0HurTQHon4NeP1oLiG+TO2GGLJx7hDlQ/g 2hSUSi9Nl/mALCfp+2ep8vviTnRFglblVUKfmLE2KSG02ac/DyCcaOuCFnDrIq/TxCnYRvSU MmFQH1l195TKKWT3Eq6sQyxZJWYY99TqnN/13dJ7Taz/TW9ATwate3NgtaK+2XCjvR+SZ+Lx Uvjfwu8x1khzrfZjw1fXusiGLDkpY+lmpMl5HCVeHGH3kAjE6UHN2kkPvBmjpMJhEkbuwnDW A+4bhk0UyWX2pxSCrkHTz/8wDurDYEkd3wrdEwcLB4AYfn4+tGA7T37DKtrAW0KO5J07n2kR 7wKXbOy4+nVhpJAfBeEzlkPUkMdXqz+7dgXimZ+8rNXQjnN5D4lOymh3d/8YXFk0dot4H2ls rTKZalvqo6E7wIuJW/sbG8I8DJt8AwkulrBCEc9OYC+Tik6M54Cd9nmqZ7CY1OZb3YyjiNK8 Pm6dxElB9PluJd+jC1LKDoVCKTIw5rZuEWWZnWPN6S5+NepigMhL70swmxbxm+e/4V1unVGp aIXpf2+PgPOnXr89H9KjKnASg5TycU1tcL5DfOkMrmzPTuaRO3JQA7/1XYcxzwCN7Cm3jU6W 172XI6cT2n5b/DF1ShzUx3QVm/SUoQ6s4kFAnOMfPwBMs4P0REX/yHRIuSqWaYUbbOq52LNi 3SAevZZXkSHX1bR9WuIA1a/l3ytUFZ2Je/H6UuW8DCkCLPuo9MKHzQ4Tb0oCqvLK/L8KY8gI qbfjDPgV6OvkSXl1OQVSBB4AW3cnsyjLLfZeuV9BjpsvOGKFmTbp+HYEILvfR/BeqkCGLArp 3rLKeYXDVNPP5v1psjU56bXtdA5EqbrkuQxnRQT/2pFDbG9xGKPhkkgCpuY9GI3ucu3KWx8J Yx9YceP8in8OkAZJ5UtsSkraWO5Lb/honMEapV4dllx0JXC68lcLLeD38p5l2hAOk7pSdkKg G7T0gU9z4EYqQ6/QVkf93QwgdkndgqDl5ywR6KDrbIjJpBbA60qjMfK1wN6HIfx9Ln6B6x17 1jwxXh/zjUIAmomTthQaNdSDZ/aZNcL0vjcVtKLSzXOScUJ2ClCe8thHvF/UpPr+HKnoe3Aw +ZjAQlzR8fAoZuu3SamUBn3lkD6oJjj5Dj/WmciT1gzOAVdsaxAwMbwYaxa/Az2xjnwKChG/ ghwsPbFXyrBKxlUqKhpz2EbD/qg9N1grEQs/XzCJfmolPYb2I+/jzesp/KkC6T4tICndP3rU kKas3C9nDwZtOLJjpj7bzMfBw63Pk6cWbfTItlLql7d9pb6j9EJ2se6mj5EXqSdcqORwY/db 1+mPXZlM3Fd2jmrpuxXAHmh7C323gsKinDN37nQcDwhpfo7VtUamzwP5UwXTHc/F09fjK+Da rcmzvY/3E7MktCOzjIIULgHflwuQV03Kjc3OjYPTUB0NPfpEzO/RxGyVTj9MJr9ITsGUkmED UKpq+Aqi6vtZYIwW6Q1kVppl/Km9f7e0GBSLo7qHLOGabjbmi1qrXEjdGKdICvp7LObBmNX4 ykzDY8eBsZyStewbPkzkHTf1YcHMr0m1hU2lH1YImtT/2jUuo8OFy7IbIfPt0fCaxhYOg+OK EN+r8eBX5OUqXnU0E/OswNbRmKMk689Hs/9JGc8qFzFA3WgHqwWzwicqof7i87gK3Zo91HpK 3srQjCNBtuu/qEQf+G27ELKqwFhhdBQzSfFv2imOUU/2MbJNHApFjAYbVrhdXiuW/wDueM2O n1Jdcb+nIy4KMUXL17ZPC69c0S8APzJauorEYLpMIt5z4+CDZxbA7aSH3kx63rmC4RiZKwOr gCLHM6laXrnNsIFOw1+kp2W+z5ltPoYhPRf0T6ij0boV+klb8JkhyHaasYaBmdWaVrbEuGZI fqeBFrwSfZmk2GElx2gBrxgvaViRs8DE+KmNHCTkQjwq0Ooa4/bPv1t5U38xQNTjyaPZCDwy ZN0ZIy014PiEW5cdzaPqq5HfXP1/jsvEkQn//+M5xiZha+5rm43NmeWo3Gxsi5ibJORKKuRT 8ulwjLa5tpn7vm85IqTkypCzcstd+aQiEiX9fH//wev9fj2Px8sukh2XLK+yBRLQ98r/9LVe zVgSm+uoJQcoWdO/37r1UG29n44lDKDSTdvxcMY/xXcK9wcWUhJxxggxohry7P/iAKkbJpmH 1HUFyKXgVCfZ77XKelwvKaA1J7XvPGv22sR2nl2wbWjM/iT1knM7JGyc3nt9/UKB0oz8tdhA pD7QBrFyVYwOov/oLwxU9cnl3A2nNmiaS0JjLgwAxLJVFc7KuPQpDMEleVgdg756Bk31Tf/m zvovHVVFl6Lk/aNH14y9y/qggF7ftwrI7nhp25CVjbvqJ5lLkb62nmgfV/Pb+23y5NiIYjg3 jw/QRnWlMzepP3keib5CxSoPvILFsEI6kWtAyf4t6jrnHCyScXDi8dbbX9/M4fUM3t8aXpqn BJ2+KAXn4cR5FZ4xP2hdy/i5Yz6oCySFY1pcUM7RtzpLVgln+1O81vW3Zi4IWxe2XdntL1dy 1xAzAPGgAGjHZZOEMhH2h4EPIiWObMQXT3ZIp703ISDW31vQ4q1fzT/Ii8jz8Pq2hNrWMcd9 x1ba6iu9N6F+kWLJe8vSlzlludeO4OTBydrPKAYrZxX3fIpzu9BR9Sutrd59PlhPZ6fnwPnd yUvu7UAb/ZV+Mbo5OmAgoKgaOJC+7T/+RhT1G12LNmNgSQLd7FuYU2anbPsJFAXp0B5ZFt6Y hYAAaRnIsQVldRoF6dp6d3CGGHqZa6Go5z6rGmnw3OUcKnUh/XM4sdi7MfvJnwuLvbUNsiDr twnvQi2+JJtau/f4kgI4iCWTvudnG8bHxVIDgaQ4m1CffBBJtlAVihqXIw20QuN/Ff5kMVMn Q8ua9JAGsDFzyNuH/HBal1XGnL/fjCKKtmM+oFvzrolzs1KsafvmM1PD1DwfHz/VL7BZTFcy 4U6AwdaQtan1q2MorFzVViCU/bWQUKDEyhUrSj9dpUmyY8siYzxJBpEjPWNkfLO5QlwQ7r5j IJyxzPzA+HSBuy3F+PRFMLNltg0CqZprD/iCfL9S6bDoYIkg2RbrgtmhVavfCaDiNfTZetv6 L9/Kv9JCZ1au66V+Vd3p+axXqeR6KpHSJwud3iJfexUH7NVnB/n0iQCII2L4aRNbsQxh7TXL cgu3Hh3R4JvFKG0Xc5HE9ERqfPU/SAByglEK7vcLMwA0X8LdqcpEps56wOv2awxayd3vfhPf Bjsc3SIn/ntZiPzaOjDY9w9GPgoyn0j+99KjA1//7I50MhGHic4WvB+4SxrjHIFa8Xq/xgPM LnHkjr31EyNH6ZmQiPHz+uVb1bwAnxWyjet4siiK3jfVOvTUtaF0+guZFP43LWlBYvjgr1PU S1PcK2fkOYtEBhNo0eP3o51PVPoN+B+CfmNwnLcaUu2pyyNk5tynGxbRLMqaMglbeiRwjzZz G69n5T+aIZejb9WXeIvmHPzdHa6xSF0r72q4f6YP5g03bo4Ul5b09KTNHhfn4pYzpv6NeEn9 +1ec2uSI88b5Ot6x/mbQqJH8Y/TS/On5Szkfe55OuoIdTgdBlmhziWVKPqlf+KwlODqREBDJ vOEE+tP3PZmBbpxkc9/9kWLb5uE+85wPfxOM8JjnCyPZTn/l8GLa49eHeGTIOG6/N1AigPgk 4l1rJ77AiqVPghxeNaSzpNpuP9y+YWMbhC3d+LjpTbLe+3g71Lf+6Z0gLGwH9MH6jLy0PjEy SsXQNQrRdzIjkIwWYvdvc3Y2tEnimKfM8X8NpUtlfm9XUp7xM+u0zOLnXgKvD3UxBQmxsE79 TATrIizyaSdRl/k0MZ03zaNnzW1oPlCLNpuFIJVWsL7efPHAAZsh29d/Idfydl+sdZjv1qjS 8El32kwYK5Zf3Ngkalkt93h+/vX4a01fkAOJaHBxBBqC2TE4genep1juL/y2OWu/T7V3kcCq MCkcS3CejKcO9i2hm/qx+t2kfaIIkk4Iak7wQyYjNBkeyglOSprEKJd9BrI9vYpgGwJpy2qx AdXmpe4qEhrEUd/4UbgBHX2aCnp/rWxszlPq8+2ybd671XlCnNj6rWIB6MEf2R/xejb67IQX wSTocLNP/Dh1eRsNE3hmIE5gbmMsieVv7fSedBw+fFj3Hemoc761VvcvO3f+IDywBZJZG7O7 0Aw/OetR/EpB96xtzlDHZ1duzbnMq1WR3gpEhGJnvEqtZh7tGorYpGv36ZdQEUsEtfKgk/Ys h5nbot/anwzhiEVG8QJOX9eNjLJvJkJzh+282EiBtj4TtqxtpmWr7wDC/jYfJ2ClvzLcSWMW 5j0Gb27nYj5CR8VrvwNqYleBgQkhE/iksBFFXtDI7DM+otYNOpI2MaTGmhNBfb353sEeewry b2Jy/xdCbl1rkVFSpJbYfI7KfURu+hKGG6Amd0dfL3/PQ9qUjSD7h0uRw+Z13H7JTabOK5Rw 2LJ2t019mozE7c+6rUfMgVf/3sB6xxDOZFbi+fCMhA3NQi7IBUaPqhQPC9xkytgDvdSf93VA 8rH856ZOEZlIOlFdu98UcnOhunA1Zz8LRvsqz1LKTHi+TLuUbRXL71Skk0vIf7m1mEmi24jl 71VEftdnodOvx0mUiOAV9i4VVyuXIEpO98aQYkgzeWoOE2KMSRuN6p/f/YUZsiZ0oQpBcvM5 Qasizon49KqMNaBG4qvYoUXOBQbbhPVEh5vYU8MHOU+0ZLW01gez0pUy5hOSKQmLZzFnC73j kvW+r9KVjPbX5TcPZI/bVBqbxPWpw+OS4zUiuux4/u5fbsMx1zNohTAfUQyNvXTvxikf/hTT lBxA21sVdN1jcUXxvbqy6yY6F10zxGgH4ZGcS3RKhaSEZMhqpoIZ49PBwsNfFrlc1XUOksQo 3vd84pbnGVCi18Pqro9E/WD8hQbWKpU1nLQ+9t9tUjh2I3F5qsA6VGcx6aEtn3cGp9In8KPE SiZJ0UY9gnX/ik4inDy3s0EthKHwpL3cU4bZt1Y2qrldsb3PDDPvxL1Iwt8XODwsI6aQUo5X uwmIPX6uIa4+ufnSWmdn0Q4At3rEazY+HNby37pyCTWK6XnVGCxvclybOx4tCzZvDkeeKaQg FS9+YcVtzFTDgm8WiZ3anoAkr3pLWfPfZn1avirZKkUsvH+axrrz5eY5m9xl2kje5vhuGvca N1pfm3E9F0GupUGa+RElCqgGKIc9a8n83WqR0jKcFbBWydrYn0WV5z2Ijbi7WHfz3vr5qGIh FwmISAaG1Q/EQLx6sBOxzHgL38t2Z5dBtOOQYaZbpDcTefvuXaHBFQGUfozwNlKa5e99yCi+ tbI8RklON6jXcpyXPaQJ5vlK31UNWz6xArcR63sT6XUpd+JDMC0KCigtA8esoHt3yx+6Mbxc SMmYi6WhBQ3GqCaSuMpET3XTLYxz+65c+fgvlcf9Gb/OCm8sRPA/eCvmGXq7SRz7+BTuhqKk LbxhDJFPtVAoJlSCPSkrCoGTB2VWiktIaTc/sonKDvDMMqhfBKlj4fXwQ6xnlSKxmHCOYC7s zFo1YbFfa8/oWrAD07FbPerGVs8al4hfvvFai0V2wacxyT7oWdtpNvrvMRoWjEqepvpeF1jA kcwEGtjGAt4CNSM9UF2jKNKMfBlpTJlH5bjTOWd11myrqnz5qu5hyj7waZK0YSmMV5AYVQ3M kFh+ECvChBItkqGSXrw1Uqe1RRVOWhxe72ZaEsInAk5elSF+hl19X0qA9CAvWhVymnhRfe8D R+vv/5eptDCzK7sKmu3N6Fu2fdsypcANvTD3zHhf4eCHl3nDrm6YefKjgkAQ+Yzy4JhO3osF SMw2Gl/sBvfxGQDYq5fb1ofEqTha2z03AKY5tj2OYe7ChQ2cX8TbW3TMQ3ocCPFZf8QfC4l0 I9oN74WG8+PE6OkSrUngZIUqOeIVs8Qg3AsgJLYGdT3BZD9w7ugx6bxO6XmQyWfI/1mTGRbS Bdq48OnklveebF7Su2MDjvnVxp5pSrYuF5r3/bOEB33jbbUEilzEMReLnfU/Dz/CojJYdwUy lmkCF43gDr6VYa5ZSugrOm+ayQS7G1k/mt8q5IaVsxb20pr5My8XfWM/rvmHejGx6kNPJRzn rhhKEEVQqF7M13jTuFC6c4+ynd1bQpN2i87MpvYyMHki/dqfzx0Bw6/adIquJ8OWVPvdWZ/a uA9uiRLckpG3bEI2rF4uR/5WyUUbat4/2rm0fpzxVu5WoU2YonAkVqovt5CzY1+YP5lsImAx F7avk0ccS8/Syzthl14muN2tORNBKhugpwSZWD3WjxWbWG0O7Et+zM/ckpx9LhS/Wz5a9DoG COdieHr7UrRij3CymMCrgI87g4fWh/DVFCtgLEZ/Ohg2hHgjkd3TqrAtBi8sA0XkqyVCfufJ /L1dO5RlxuIHjj9cA+VWcwMS/Y5D5QOlE65YkwXIq+GMokUsn+RQG4H5jZjiRYjcJg/yi5NA OSxTH2M8k5SsXEiii/YNUB03NW6m2h6s6H+9CHDHpDk2VhFnHP880p82uvnX/9zmVoKXRoeW I0z3dftsrJFD14nTVYZNlce7qwbjzidMxS75oJkUQgn113NzMBXsuWqE9UaZ2ybmf4tjOh7U PK+0yFYIluWKZ45O7+EyVVggpP8cm035EFu22evtiuqnuelJ54ZBz9A8m1U6uvmET1ifRPtv wVgOFC+nklfpqq9sHsQK9ppB09CG9AYlgXADueJiAoYwzWHTMBNEMbvFB7wpyg43vGIeTvOn JKf05Kg2TAvdFb3gMPDod/iDLL87fSdf+v9ci/txM167Tm3P82caEIzjMLiYp7TkHv83UB37 1xTcFDBVJSmxHsL7R8qS0fJ4XWb/XZ5mwD8mXWOO2S2PrpV0zmwGXLVBCkFKkMnIMf1+A1Z2 /qrCNu+f5bMMn74zADpiWgjqi+YWsJtWJ3uHH0LSTjHMTRK/Py0le/yLtC23nfsJxCzdQ9qN 4uXOAS7lQZUjBmyUY5RrHXApO8bqTrHuxLrX/pKVgKYp+q3wOpX/9lvTFn0efPm6FQr84ulp QbOJAY9d4Rf5NkAR2NIv/iSCLVZhcoNXEWZx5UvSY1SsYyXT0qJSxmR4AAQJpkxqh1x5wwvS QL2sYqnCTPjPSOs2Itc1QUjizo3xeRmWvgnk+WqqYXCud0SXUBIPQC13fIVpGrlGTlOa1ccX tqxzkenmnT6CIsUvd1sInjx3y9k5lhnpIVyiJNEygV6Sh8+HAT5VgFpyYEZTnHKz6FaWkf/b l9G1envodfIPCzSDSwRQacKgM7pEgOCZDAFmCiJOIkMzKrR4ALxzbVcGE4Ub5iuqkWzORHRK 6oJYgXOcWc7c0VwJtEeX92DW5n1hQCg3wOx693dem9iPkbh9AJJuac3XiDha/5nzQVR2Ipvq V2Wp+Zknp3CarWwPUX5tH2u/lE1yhnmiWhsiUJzlNEfJgYf2K4WXzL+o+xgYbGGHLTXc5RJH cnb/q0+8+dJgP40V9RrS0y1SAh8wQ5qdOjSUiLoKnpJs9jele7cLqCHO2xlYeVefe/7qDZOh cPuqllUhXJ55FG9FFCQAlH1ieHa7zuHIj5TtGivWxtDQGFJYYRnfEZam9G7T/qgLoDeldPNh uMij6fuhKCoioesqVAQVmBQH3c+VtQ28rZOBRbheEYghteT5/xn9S1V2cs5oXfag1d+vws42 7FUq0Llr8IN/Ksov7y993wp2W3sg0/Ei6UZwCLeOG8FceuUtjOAA54GPwr0IWv4COA9/Szpn zCMAifY6cTlcqjlAMR4mCzob9eJxiKPepZu8yEUqBJL9RDwKaRIVj3wzIYm0YuE+f2jJEu9c ol1+8YEmzAnvO8NLwjXE29DXtgQBk6yUjyAapDUQJcCarjNwIngeJbEFFm9Z38indoHLLtaG WF73s7FIoH75bo2bzRTM3QYAEO31+Vn5dDh1OA3/gq1ce+Fqxa+yPH/5UwYScxLzaTDCvbTv P1Y9WfLcBFF4CFbGNUei4RGVCB7KnXaweD1WDS2oMHlsDq+6wnvLXzIJ5oc35L58Uiaynlb+ rtGx6aGGCUvNY1tH7aYB8i63kHW792CyhP+VCBY36qJ+8toYTZ+PLUiOxZmo/xuNbmFxNbjs 59pjJEcaaPHB95qZf1OKMJfKee0r7YmVHK6CquoX2BElrbFEl/s3/AElJxvcYw4Lav0xoS77 XZk1vTK/7Z4/HO0OGwmXr/P/aZJYqW8M/msb0LvouHBuIkKqGOINo0QCRboUH7dKCoCdEEJg IngNUYCf2vTpm2xk9hBapPrBU5nSMi68xPWZoBbt0ov/gJ3skD6qNUTWyo1c4247DZcwrNQr vUhEXyMPKVzOqrB4HYMzSYz6rPpn3E24Np6FwBNMOh650PsaX/uh7OgXNEsFCyAknwLSORhV NHe/SNEmBB/lozgoouZ42/2RVeuny/vk1rlrDn9GeeqXCi5f79C6X5dYOvcBziNdD5IvMIJG h4kUnvSjM8kyrOeSlnStWEGqIKahBKj3YsDcNoFSFRwPk+s81l9o0QO2JqAJWITnZKlzFubG 81Rk2Z1tqJz7YSEA7Z8/xO2T3XOLH40v3FOlx5Iti9AZas380xt0aG9jIMKutC5BMAdRWmzD Za9qG/lnmowXAzozXSvcmB5b91Bag8ZxH59atdTpNLpeL4NuteuJ/kkW/nhHLelzMK/Wwftp zUXNleizhGOUu5U4jg3cmJMKr8At+vEefa+g+dw4pcykL61GKkNK2CUlEXox+lrRn62R+Un/ WMorxaKJIJ2kCCSq//1ctvrm4PrmdydVfRcAKe7o+gijQu7LHXCdILHjyQQoslEqqIhg8vSR cgm85Jz8bea0eeqFClOf4ykkUZ2IUe6QamitVh26RbYQMOk0lnrjmB65RMXL/lXTy98PCl4O zR9W/vLnjpVL5Qngl7K4ydhJcB+Rjdf1loHFwE7AN4YoQpqxxtQwNEuEaNZogzwVZXdt/K1W fLFM6yLBmtDD1KN7C7MUiO4XooUf9uYqYWwCKIWWzdwlpQ086AT02VODR5cA/Z61tmEmCW47 hRf6rFBK2b9KApyt+Z33Vpl21BmrJECcipg7D7xdpC2v8nnBRRsWucDhBQ6UVpk4f/1Hx6f+ sLIQ+Tynr9t1UdLtPzUivhUm+Ao3+kzlv4NSRl8RonGXY/9cavaNYAyL7Ny1o+FUv//86n/m vhh0TDJc0Xzqu1V8cRX52atV4K2JHe2NqZb6aSCk6WFWEyZYZeR9EaKfvcpY7W7d3NBDWocs vzjOxr79MKl2Kr988EryT+4BBNmxEDrbTWPH23JjevdfWxK3T2NEV58oHtHbKDeXSiB3/YnV cEAU6qVpP8SXU5lQ4rTOulfxvXdQd9BFr2TUaODrzm6CZNjiXN2zY4/mf4vDzkHkO5MKjIEi V0WojERGgVk2XATRcNoWwXXULvj4urWL3WCv4kHwBYbbLSQv7VL7uzNRtQk/H4oztG6eNg55 PdRovDc6ibJ5IS/NDQVBcQ1pxmTli0gBaYPXPpJFgpNmCcvNSvdGNA6R8dZ3DNmYbMt62oG6 faWt5u8V2xJbgFdMpwArpTOFO5WU2pkqqU5LE5Kw/1bus6FWckjO/ZRHTu+8xG+BK+MFNll0 Re9siuAOgiI2QF36Pe2WfkAKIQb4r5aMZL0bpdvP86pbfFhZrNrlzMxIcJpCtn/CPe8JBRSc aNLARfypY8G657//cGdSybrNWNK400WfaqPPxs+eMUhCkl43r0sxTNjHmcsv/Mqht+9lWo7h Hhj3Rj33PyBUwMqsKkwrnR2lnQtcp4NiKmqi8ZmoUYSR/WJXwUUH/8Nrj3NUfTZe/3NYL/dU OEPIuNRnTyyn+vh0DBN7Q8fpVT/W8pPgA48eSx0+KSTIFux1rlgTNxagDLZ2AhxdlbESNMeh S/FBZwzvWwXhhi4DWaE67w//JF7PegY7y1otalyq0G0/zubYnLNZPLIucx2UAFlBQzCvfZ1S Qnqh4XkiyusPeEXXjjSQrfzpL8UZVP2Sl6bCo2qvylI1Pd8AMIm7Tk66nfSrJzZALUtk5emt gofZfV8UBiyuOPXZc5bGFZ48+gTnuWL1eLXvGFALCPK6Csx5bQwsXRh6HQGHIP6nBHX8Ge2u rUZF80Kn01VMr2tnTLoyJhZqiJ9VCdzIgzJBqX3pG9DhgsKkp3crZxYW8SD2gXUv0AfN5oOe 97lUGA8teYVGDJgXByFjovfSe25iSy7KD5dSMVEktOhUXrHAE7oe7KRKD2lN4AeJ6zz8vFlc t89ob+95JUGPkz9e/66YMOrq3t0F3JhCbW7EZprpcgz1/xgPyux40Ct941UYfAxzkVtYHJUb bAYMJWCRXwTtmEbysR9GpPCBiU1UZhSTdRRpjWscZQICEQmbjvJmrJ6gr9zriXOC3cXKjKwY a9K43yTjloh9d1PzfX0bI7MJGE+BZ5zUUqSdvnXnyyyT3g/fTyqzjtBS3ZHuuu4W6QF2JohN quLivMR2TF3oBW42WcrvqLcsTlg4fH6gvF8mv3tHNs+xnvxy6RPwdl2K9A7MEGmcb8zLGIX9 DzDUzRSPggyIaN7ZlV906iCZnXRFYrooDtClT1QyshvsiVyl1spHZDgCakqPOD+XYcNoP4bs m21vGVjYBCRxo/jIbThJHDmRu9CeWRjULC3fD83VpEY4WpJxg3bMBAzJ/lgKsTJCuT1coFdg ZiBWtDJlUWCHFIXnOv5qiVstUCAG7tV99orbJgq4EqkOXLkYofj14/LD/pWwpJakEeq/ZHVt fqHjFlelM1enPNznXuTnSO8dM0qPRhp39VEEgimcQee4O6dwpkh4l9xQnq86Qg1Bp0j0Ux1K S72Qa1TfFWbS3BKHh74asXqidXPHYp6L1HwXm/oczxa0PcVELDQi8J50b7qL/D/32WWEclhJ ylEgnC6mXxXN3r4ixKlfDohxJtYinflcFmPeQpbLr5fEPTlPFZ+oVJ68Qe67Hnfu8c/OCL2f P1AvFt5LCX+Pvivx4A0HflsrHCgfLQ9imIrEU8Ou+MJ46ys1vYHgaUk7RBS1GBjCJIFp4LuZ auYwC6zc9C0khBXvOj9tGY3snpFh6F+az1uMEeYpIbEhRTjsbGASjR0L1b4XxNfwfdqbHko6 qRxBZ9PPi5bR9fJBKu9dzVtYHkwvLpf0uQbUaiUedGMcP1PCEc+7RpbUHcal+E0b1Z/8Rv72 p2hDKE9WOt9P2te4BUzj5NWbRMNxTScWwFchhfYAuKIJkAHjiMFrzeL/P3snPgFwtnT/XUGn 4+lor5NbbRONlzjA51J2ColH3tP3k1VAdkwnWIGR/Mi8/I3L3xTuGFfABxhoXeqyicDR0NCf BsdtX+9rlb78rVXg9ZWfhPqSdF5UApZjQThO8QA4g1pNn7M8iA3GjWdcOakRx1PiLMGDyU2u ItHcvtqfFUn3HhoFjf7c7ZAdSX0qrnEwIRzzqFc6X2HKJOyMAZ8hS14U9vXKYWG5SM7otcF0 wUiRsSdUzZ4UIIzVCpSxUlS4AA69p3HKdo2zIiN5C2nBbHdndqzpCedv2Llwo6QNAmW7d2yK 9npUcQNqxfmPAof5sSWnS0Cid4x4lNnKpQ6K1adcQK2QcFSCCEQssRvjzQzwHGWFgt1ZGrvf 9D9P3DBHXRkZ/Jc/Ozbyt/AvvR/WtJHSxdET3n0LgHMcIR3PqUfB+1z38iWvZH2EEexAIj81 wRXDQEnTYrNiAjNUKwdxUds03nILqA5jhHtLZD0b/uCc9VT1YPJX9bX8sJWW81AwKoSdgf7w byVJcthvEPrkfjwGqlxq356zcfjItve3UZ1xDyk9P8hkDKTMAoDjTMXqY0zi3qA2lyNAf7j7 8hHNs7ZTL6RRHR1KcrtG3/0m77wW7lb6zWfwQ5dL6ElQd9upQ/SOTaLAPeqRTjc14ab6QpGC BWkZFKoKePs0nu6sHmIFHjSfO+IaigztOHNRw/u+UqLqK18VghDBvarFqP+3UGG8CfRubgpa LWOezjYeWL2nml9jKWkaYwOqPGNvWkVxrjgyD0XYK0BFBaehNcf4PhsRt4La6xoF4OPMyTcq A96bF1x+ryRqe97tMODu7AF6Y3H7+um5q9EbwFCb8DP65YZ8hiLFM76R2m1tbFi8qbGIVIYk XKxq/LWEmRuVAf/qx42YKAm2MFPD4hUmvj/voa4SdB50PO9lrgQaElM6lh4J5UNHGiH4Wj8R FH7gQgnFsuIq6RTqtXUkiSAq7FDsoOzY5hbpDnbOd8aJ+YtlwCvF/OI+ddUB/sArxH3Uvx9X XtokkKeI0qLt8zpCc2EMDWrOVupc3Mibsu1UOr2CXxg80D3dqR7/5soiDzfuQOJYBW9BcgUQ FEsR6WzhCIIH8b5HeTR9ZZWUqHXZboewxAEjbzof+btIwMbdEkpj06G+GIdSXjuJMXeT3nAj lnKBw2KEf2SEaCaMIxoMiMLvk+DnTY5PQ4L+p7wLEoA21cXODM8UUuvHG/ked/I6nmxQxVqG hLuFKjRb4CG854oNkIb0A+PTrwDAPbg4j3QyL1HUlEJJo3n8UMQVWpnR7TW7wE+0tBVkMwKH FGTOwvZ53/3BGDaIlKTn1pJJjHH8gLGA9VcT/Wd+pFVMR4cxqlignCVE6CQhVYyk3TAeGG+4 q1vTASsoeMkr8dhMr84+7/uZPYDuk7j/PvwjdyeB6458T5WY86eTy6cHPT+1RMl4PbomPGZ2 GAOnbl85xiuF4wUpRO/WfhcJk/yPAUV4+uXjMqEm6uMYCOiau/axyRObjCYPSvMHloIF4x6d dOhmuO1Z2PKlNYHtv38APBfznv+uQMyAQMqOUb7AvwM8KjYq0SrjKimqomrecYNi5i1X6YGv TSNAN3um4JpviHaVsveL+Z/+qmz41l6n95cw31k/FbsyzrcEHjfbBIZD7zHkeWDjsOgjro93 0FTuIvBed9dE2oItc0GICrwU/gz47/+x4+XhUL5h20iybyEVQ4RkzV7GUpItiTCyDSE/YewM BslOTAhJqGxlDTFjHYw1WwhhLDO2iGGQdfBNmX7v9x3H+8f3Hsf7/fMd71/PfdzP81zXdZ/X eZ33dd8Ud+TUjYJ6sZ2LRkPZ20oAAd0lvhCLFzIBne6qSaL6BdGiTFcr1ERN1Dm3X4bc+CTj 0dYs8+ZFp4BsK+EQG63UKePC1i5x2abYJSf60LpqFVGykg39OuWyz89/6iLLHUWlFmnJNyJ6 Oy3Yb9/4WPm/GAndfFnA/Ew9gjHchfuW8tClpJpoHibx3luJYvIbpCgKSkakZoYY7j95jisV ea0i8KXQKPrl2D4j6fQo85bqo8yHlqN+OIMpPYje7IPZM/Hbeh+4LgjAzaXF7q0++hVzqea7 McrX4skNX5OVzdXWcJjScZZaguLFnb1ED0bkGQWXWdsNmpH5xVIVaZPUrX+IVyhEqUPpz9Oe v2EvbX+F7Sa1kf07bYIcw52WYaU7pVuddNqNT2+EoDVgXKKqqUb2ugOiFh9cPlKV48zSawT4 tqKo484geKx1lFudLF5eygcGPUjMDzb8VZjkbyFWjxehwuO/gYYPNy6Fnf++qREr+DmQx0ub pQ+BxtnKnbloxNrGz/hAI4zj2XOlcPQag4aNI1c0h4TMg1YRrZfxwNhEdKKi+KDUck5ptIxD pVXe1z3jfOS9MY087ZRbnLGcILEUMU5S+wkoN+tObkt1T3SP+Xx6iGgk9WHEqLH6p3xJnTWe b/tDg8fxXZ7TioBXEArmidsJT7W+5myGUXgwyZxtZZN5ZGIJ4Oc2ekkq5ewL77joYu9yjyFf X4DzPIcZVh06MVez5+1lje3WPxXN+nD/44ednNwRu5TYlAixS2a0qdFmcnV8BIkF0TeSp6RM 3xaC6iQ0iyc/4JFrbcdJWgRmDxTMGHDbU3Dg2vebO0nLYdefBHBHfmQrEDA4bODvfM46esk+ euL8rVY7Nt1ErSueLIJRgtn5cqivBg3CX3hz5TKNTqVMvzcaM4x4lPdIU59feTMz4uyziFih hhdGqT1uhz38t5Ns467a3m3/ZrR9KL5ZUflpBhezkYSZhIVvnYX4KwWj0Z8v8lQptPJVY4Ei EPegLhbKXLbWIdbCF/kavoxOrEvm9lJ3zBU2DoW1mLUav8YezUUdUuXeldG8S7dZGap7Py8m JTJl+p21zqe79tit2GEL4+zJIkCcr23mHaxvp70T/Mn0mhD/tlqf4ybTz77dlad3NDpsouJY WAwP6Sk0Q+8/o1a3t78VIXdegJf9lv0p0rYoq+nL9rO5U6SsqQxPgRcUslCdVnrw/ufmKnXK vZR8k+A6O01LugacDaGZc0g8IfUH/TuiZY1cI0crhXxD7uzAlT3HHVxm/sHbjMlzC2OSDlqG gDCAqFo4/BVjOYM6P50OU4tYpqZdeylDArObQK7sbV37SO2FooG1w2ZDQbAVNrgR/OFSnqMo Fkb/AH9T0zjmw4jE/UJOD6EWTjgIxtW3fHVAxr77rV6tANVj/vyiV6aYvB/Z465upgBqWWGX 76FdKJOlZg/Wnj2mQyxRm06AiV21nU7m0mX2RL7lnqk1iPrlz50SsTwPNve45tJC7BEvKuy+ UKU8LFQyeVzMWKpEajMtK42rGWuN640pw5Z9asX98hayMVZTg9naj71dZpo64/sS7vNphiip 0ahjOhjDtSMtZVtX7xoKgMxztQTPCIKDy4PPT78VdEgS7Xp51dj0g5KJjOke9lnKV7HT4jdT n6V+k8iU1Gx8a2+IqitJPYhaXZvi7ReSd4kqfILprDHe3BDckbpu8ZhL+LI2ZfRZ+5udXy/V qqsfZca4IQn9IzP5WYkOB0MhfVKzx81eL8Gj9HePz947jpsK/0Jr0hhvmWcjhJTZoj9mvpQc GptqrxcWZ2JfeO7bzw9TtaA42BSKKiwrO6ROtTRbejv5wlkl91xu3fk7kN34Rqfem94jPUqU /bC7SumxL1gFLIRkNObuz/0s7CjDTmBsvzzVTSZtjL5mHy11PslVXKnT7B2+0Br8LX8yx3S0 xNQXD28JWbJu1Jx8qMbZ/1IjAx6gBW+GC9xM4vdjk1npoUrUSCx7h29cWJO+5qCgNo16pmuU Zytk+eJIW+aYd4HpyHXhsXme68MEMbBZTV5SkB+YwLexsn9eVm4XyfPkgH6bv9EK3UGhLahd +EJYg14Df2uOWhDsdTP49LTrY9JOdCul1KSinHgxU8wpfOVLzimxTAnTCC/b8VmjaszkyPZw stgFXdaAX+8JROJYBlrP+3vfVttK0f5j1U+Q3bAMzMuwOVcaAb3LFfkC08oce/RXV3mDIk5f vViIafryVYzhYeQ/D78/iy3mrBW6+3G5ZkZtzsN/oheiVhjDA+Ve+XTwhXnljOqK6hhWWZGt 4nbRGYG1DxSo9rJ9VuPCM/vN4qBYm3LP12K9gLQbnyf13218tO6bHcjfABO/QRGNfj7inLxi wBtqXE/nnnbmX8thhVltlhGOizczp9boi4+j1j7HmmjsjfqeSk1IlbBsymDmBtaKr4CIzQEc StW9pq0dd0JeMTrFyez0lrJ6YnoOJBB+G72KxjVNuotfUsVNHRtYd3B5I2vmWL6D9H2njMP5 p46b7zvi+eouhzOOlSwo7/EtwXorqWqo6m7sTnGChNue6U6M8mdbLacYuNAfcGaP86Hjw7J+ eHTB9bla8noiVJQdT5MiWyn3PCVeeXHjRr3hx72coPgQjOMmGrIi/uOTyPZRW3aDWe7OQUjv 3oLjaUhZk2bX9yFFMSY1TIpIdp3hoNt6Tje69iCidBS3fSErO4tTSUy6pMnnmsrT1CvD3ebW IesyFcVlKJhwwjz+sMQNKNHnDzWdKW6qFHMv+rpeWZcSMHtO8pr7zhnFqS08HB+U4wharscX Nz0MTStuatDdyp4u+aG4F3GGZVto+piIfxhaSVVWRcXCtbLvzBeb/IuXD7ZQZYqrX/vzopz0 YrvoaNwZVraZ5Xi6jx6WILYO1FXtcPNKWPpts5Lq9+wbUpDuv4P4/2Jidxw0c0wZKvP5O70D xN7L29PB1vX3yO3RE3oZeRl+af7fIzk5RZlr/07LXSdPA4H8UncdII7e//DLyEuTJo34pYz9 3R34pcwMHj1xsPPml3rg88j7z4yOq60j6QFysid9LX9diV9K28HJ8R9v/mvXSGMNNxc3zwfu tnYO9FK3HXyd7By0PG39SX9BvB083d1cbL0d+L09fUgGbjl5e9138NRwc3V3gzhAvPlJf99x ciF9Rnr+/u62g52bvQO/qio9eTVQytWv1ygpKCha3v4ycGXki1a3bXpKeYqGkVva5n8G/3eD dQD32UoKyv+MI7/z/nskK/sfDFH8zxii9F9hyLXrStf/pYi8giL9/0YR/v8eitD/HxTJPGNh PDZ4BzVwbfH5ecGrV5896ru+WDz7I/zgOKRlx3R4SsRbUe6U3Jv80eAshg/6Qw19NZUfxk2q jteOzVifUlDzU1DSqlNQ/c/w/9Xw01vqYOeHDPvoPdu/r3oi1eManEPe9G4SVP7OiVOHvq5Q Pra9ZE2jdopsJPT49lur8e7P48fbiOOtYiD333nA2X8Sq/bqas2PajqkIguiyB5t8qmfJJR+ qdv2+WUoG/QYcIYchboUnfGKZaXvAd9V+Mo8A67mEjm+V2yhLT3yTlJSpqtl3VYb51UUWZ6R bb31o65AF5VKUlvDDA9Ht3gbAnWAsn8XJnvpxUtLsxv+BzueDsnnWHSwu3ezMjv+rvirGBV2 vaX/0orRTBuIwLLnQbBqCNAHSv39e5LuGy8+v2/KOtH0aHPtqEw+3i8kGED5N1g4LbI1+ZUY PUtI2bfCDAwgCbA6PZYDahu69dd+iromTvhHdK0+Rnjdc2y6FZVyoQNntbRBQbawRkty8FqS sfFqSfHGCuHWrFm937lIx8iTpXkL2gAStqD06MoW/Zkiu5ruybltuHCAygiKLs5vthulceIm 4M7bF9Al9yEfp/XLG8P7GSuE2PZyaH8powEjGbws9Tq0BjYfLz/sEJIIBAxA6dvLd7ee7oHI YZTR2sdo8UiqBHIA6MEWVuwBUMzlbK/lVKMOXEOtwl88bMypjD65QQIfBhjnHpjuvpaX2a31 rOmfnE008YvvaFfiyk6VPqY9cfmDLfQyYRBrElFWJr5nKSAln9AW6K0JNT9x2NRDa8ZRog0U GnpwVUUT+3PU7es40iMnaNxGVQoIGSBZOv8IcJpsiSl0RB2Dc/farfXJd6eDzbbrZxCTja3/ wTzBuDhiAnu/n1vrzcM+JDNl6Gwne1qCqwaGF5KBfbeun6FQUNVlAgAgimtNCu0IS2MbZWRq ZrF3jnknQ7HuLGjOZ3ozFhuDoxEdVdchgaQkFKRFipC5etfg7UvkTqpoWhbaXRNrUe1SUixh 0TLLlZDxG8N//sXQjS63ovrlXSkevC2So9F1YvtztWsyCZyr3mhcQ8NVoDIZRBpq3ZhAGSt5 12peCLNihN6MMskx3iNiVme2FSdL0aNB5p6KwIuKJSctDBUhFu2wnmle5zJ2TrllNtUEbsMT t/OjYv0zeR14avqYIrnJ190uGsA2LD1af0ajTSaxe5a+A3FbujEhiIAP96cml4oWtSVOoaRX d0iQVYqn0a6AsTFwJ8uszm8NcCGpQ2OW7bkdAWDFlcVFpm8mib5P2Ay6vCdYpvON90svye5O NRx83sZP1jkaQDHykOZdGs6PyYZrzOla5JoKuMm/PF6v0EDbWsSsGLoGdxBO65DgmX735gbX WtuvmevkNMkK39fGVCwBot0wZjHoHfxEyExTaJj5vrfNcfAmVPM3FDS9p8gfb+q/FSDUC0JC oV/yMlpYmM/pCRtc6G8m0WSNoWXz5onjx7qkPFUsOY+WgteYcBPVB8FIHskIvhtvRt5poNF4 j7h2v9Wtlze4skWd/srNK0cqYcKVe3CXfRodTNy48dACc1oLnOeXz1y0fXCnXKPbdJZKo2xp vIe4aj8ovCCMrIkv1JOQiq/GUndpptkQLVsqgRKkPPIp+64gR8rttOC6c/mEw0b50n0FcVWN PiDjCZbSa9TL7GloQVbFqDXZKD1sBxyeK0TKks6s7kc7gj8KALxEJkj77xwtt1W3dqtjkpe6 sIIi995s+eBaY9g2kU6YZ6Rg7HqArGSrx9RX2aUqlib8bssE7X5NzOnQxxbcy7wwPFiQvOAx hPRc1v3IsiqQo3o8Gu4YTo4/Wj2uVTCj0SutcJyZB+j9nSfYiEotMzWGmCuX9du8YDuQlkyA s1TyMROpyJ3oQJOJdWxOBwZb0P/m+sWfPelDpR4M7RJ5pLL2NIQakcv6Lu1nXQxNg5lT7Wmc br4Ys5pEGDwzTl7Bd7tnaajgnqa0Ksz9WFVmWfZdj91fmvO/uAzRAD2wyqBpYFw1daqlIswK 4t1FYTDYLWcYEVNTXumYR0gW4XjubEfi/czr9Zdk3p9no40p0sfEDQXpwTruncYdCLIilCzp s18phRy1RGwu9uvNLfbpzOYASKQ+f23h5t+yZ70iBGlbEvYo099RJ37v7DK8TnJFhZJe0hPO fvWivf8KNyhoAqvRilOpEQeKkgtHOdQ05iAV2pefreSzv/LqOmwD1xaX9nnLyegCH8jocOuD 0bJZvbLt372BJH/iHtlv8LKgIL0/NIdnekWBa9+M5uUSKh1fknRVpVYcKEE2LkbptVsxr/rJ tdec7w3Ex7VQH1GhwNDaH5+NcjekR3nKj6SIpWnMLrb//tGKbvPv7gGnvc1vnbg74qpQKqED 23qetLTgLkoc9wGPllozxRs8F/udHm+rv6qrrkiFMrlsPVK1OpVRsUTfKiJ59zU6b/2iImSq 3n+2/dfPUcvZc33wbDRukmKHOO1z+uEJxz5QE+U8fkrH4byLnCs9XM+waCpMJi15IjmCNxck wOw1zkTc3B6d+JSXDoL49GaDvv/0CXnuqV/EjbOV2Q8hXDYlCd/Z+VRy1Ik4oevESMbgg23e kgmE27RnPLhRzp8yDqFUrRXignLfc1uhqjipg/t04n5RaTnW34QgTI+tM/BjW3Fpk1iZ3Umz DaQTcTlF71w5FF6cma1QV0sEftgRXbv4h7TjdJejLMLSR/MtFCYRrSoZqgqQri3nUbep2qBF fEPgjutknd8OnteJuF8lllYOrV6tD5GsWgVXgWu2FLvJK/5EHYywrF3IP3iIuzBq2pXvbJ7h MMQZ3Y31W5uqO55pDoti+YVtlCPJX1WRGWxqvkSkeK+ud2oVUVh6ieFPFDRJTfR+u8tVXNET 13Jv6AKH8y2Sd/e69EClky/QnBHdM3AXnbmdNTFuxG9JAseBDq1G/ZbwofX6/kMn6N2xiRC1 9IBe1S87jXu9hRvzPo37kqeHhQNU7v1MlAs2+C1/BhEgautfftV+3W1DeRmPlmLJ0KnTFhtJ TiYvXZy9Qph0GoxzJOk9S5RaMHHuY5kInC+jfW1qoF2pfLceWs8BrUOJbUt+VuHfEXY7+yf2 fMFPuvQgbrxIjFg6QBmnutR2pzQhe4fXQ2iIMyqjJXsvqStbe3ZnTZREr0VxQgIVfLdu3e97 XYCQz7z5yBOuP6xm5KEEIV2jxdLxyjh/yH76tZSqsQQklYffbuVifzYKSrjFly0UN92G8/KG 2q7LUJXt1bVNdU3wug3Ki/+hK7ccVWzLaAkYdY0HbzckJggSkSIZUGiVYA4RDkNtCcEz2vlU v/5eRbG8NS2G+V3MPJUBAXGgfHpacs1ocl6/NvWkgwjTs8kUxbS4x6FdzSamDvcoKq/154ux ovyObZWI892gRutGY+DRytKs1jh3B64ymRTOypoDZyiI6Lp/b5vZB7RmYtVwz1mFnNjwpkgm rkhnNQwPBD0eOaSDe8KO8hY6g+OKQsF+mf+MD4L+Yo/rvzd1ZJXJBGBD0gFxa7emIWuX1174 TjTUhJJj0rLJYSyVBipbpiydYclLbu3oNxh/e26CLYR4medoodfCwu2y59DukEgr7thq3pVG SmP91oxJSFSD/tTDyT2F4Ta7P7te0wz79zkaxYiifFftSYcDFuZurKC/+UTVxUbBo7mPHdj8 db/qOQ/xo+lfrtOJnFmVPx6vC1Dv0AIZLElA1X1C1ClPF9V6litU/q04l7EKhyJRmJYnCWg4 z8XyI5mMES4HVxY+sfRSy/2L54lBxV9JiIdw7L2k6Rfdurw+t1bsVunXOVFvhSms9fV3dTiJ i5/9+2Maloi1X0rEzvJZvDtfBoRkBSBKYiEq5PjSyMHOGpBbJEfVK95PFlrUpOKftWXVOVFi NVUwUeisTEY6/ilj6RXYP/2A4c+iacG3O9JE00sHvfWdN3+LI7j+s5Il8/GrkTNDSJL2wiK5 3AyhiZoG16DcQIF1jqdaW5kabmPKGNdxybUB3l9VySfAn9K0SWNsnOBoRHlDVbXrL0SLRIXE /iLMnmEgdXM9PFkc1mO0O0HrLTMjt7ksZqwbuQh+u8oTynW/Y3tXt+wcTc7fbRvERQxnaa33 /KBBwuOoRXVLE1d6EjePt5a8ig2yP+32ECdNu1PD1n3DREInthFuQVGo5AahtfuIh3XIm36g UQC5TLhDSZrUNRPbwiKaksWL7/LOQD5RxpkOP+7yvk7cXJQqVw05sm9WKoeCkkc3f2QyWjM0 64WKBQJiNj/5vYMM+TZq7XA585ERe9EUrAg1Qi4PSjDzqYVc4g16D/CoSmsIsFIiOpuD75Ia 2wz0T/8tI+zI3YWc75gZB9os86MklOB+QpNy0cTnTMjQoROvzUkKbdiVoO5QM5qdK7C51q4H Bf32USAqD718LZ6jXz8VwUZ758SPsjkhytjEOwYpLsvUUowA0S2ep4HE1SOStZqJel6/5Waz Whi5mrWpopi7pqPgPNcLb9eKwra20suj0au7MkwBoqcIcL4UPcWokJ1fTHHHIhEGbOFRzQ+Y JwO3c+YNeE9VE1b9veD1yXVCeKShzzxxfGkj5SctecWxTYYldh0O6/d3x8q9zi6KSFk3ekqY VKkQtiu+k1qtjObjXbRqsCBX9r3ZqtsB+tgUudqAZtfncUzu5cwyP3krN+R3EJw85jiMIKlC xSF1mqtf2m60/zlahlJedseMRFPjaUDCVra7rREtWP8+Pd38KPTx1/13x+ltqOCjnkaoVjLi av1rLYRvxcs7ZdyYArx9aJG7xIHytrJR++WeEuXhsjfgejZwbTgZCCCViEHWjTy52otAjuCl jWFn0vZr6hAglH7U5bUU2xKSKxRvR9LUYxSQv0FJEMiRFTdWnNo7+MMj+E3HjCg1giOAvqlh SnpYbDc4il24FHJdGTKY3OhNGB+58q9COe0d9Dxsm5HZ9dfEpkmCawImeSEXcZoyh5uO/Xl1 6ONvSV9UuEW43M76L16pN0+ALCaO0X0KDn4DL4WX+z+cKbQUI5Y8r5lQxkh41FWuLnxLifPJ d8gk13YTK7dXaPeMDnacGaQ/0aAU+q2j3sxh/9wESxq6d0ZNg8Qy/Zmh29hyToj/lgCtQVT/ Sxo4rzsdZnAxVRkxQwIGaMuOS62cXeDZ9Ekg15OOze+Gr5sachP53l3U8uNW3U6KnlR7/Tee I1mJ0ySTw7ihO1hNwKTemHFcaZC7T9L85VpGPBtyb+Lg9PupT5/8PkwEzw8ORmyKOYIMRuF/ ZXbmWYnOnjK1ZNj0fY7gjpZ1Laz7xc3BAawaJ+n8hjKcNH0N5JlqPAcxRIrVy9Pu6G5NmkZO XXX/ee4FSsIZv+3rXwCu8c7ZT6nUWwStCZABTmzK04tFSYFrPH8ty8tCjXZPXQcys5EI/Py9 Qn+eGOMxpx7YljA4vV94IbLoY/EVx6KrGL8WCdppSK+9dWfq4lR7T+Z7rBSxpL4mYgriBvJL rZZ8Y1VTX/rpRIfXaS2Ha4VDwKhEkgBiOEplW8E/WD34EBc0XbtIDRC4OviwBffgKuyhEqwt 1rgvNWe9M8eNKaLAaEuuZurOKIgaskrl+KDqWcV84+Q7sIwGxjdjPGJosCrOJ5OsgtozkUsH CyUWiJQ7ac3JLdltAw4K823CVUFxrxUY0FbYh6QD2MO51fStjxykCucKt5AIUA0UZsQL+r2f lho/TR9UAIspshjcnjA+J1maKflXfxKaJMCIKvyrJvQMV0RGC9jpUUDWN+Go43e1W6/RgqTd FUIQlVmSiPH+SbcDDEi/gxiahbk3xDdU1SAAoRYo8GcGaNWtcby0n6PrREolQ9oIL1kl+UPr qvE1KD4gbLeTUTJCLSSdB3B2qKGm2Ht3uhHI7Qiux61bfk1VRFtw4nkdhvkxAV30YROdme9t wbwHH8elCzkf1WnssSsiJguCsTiSguzV9p8UebPg+kwo0ZXKL8yCI4sDIu/qELbb/1KPJer4 UJHL4OPWR5klB83a1QgQZ6l59akl2p2cEe3UW+uYT26rwVNrBb6USxbnBdL8jBDhmXhDKyVw bcC/ggfvmdpA3HKPawZfjigwDsgg4XpM3IQHpbabTOU/r2Uy4vs+5soZBfo59uh2rb7vxyvA +YGdumYWCyGLtpnrEVlE1+HIBTeHHpV1Zr/u8SWF4Qi90b7S/8D6LHhwZ8iRHdk2Q99SdV4y 4oAOt/T1LNMTPQ9kjQU9IqJNgr3siqX8UtXdAEbHIjFg7JiLCFFbZld0ggaR7AhbLoE3VFEA a08nNUpsMPufG5ckkbB+P4Csfs2X+AO1qI82Us4DxTCO9XO2RSN8pU11xtB/YDN2hFh0tzRG kXR68JEwRObXmgGCoLufnq2/uWNAA3+HUJCR2v/1APHUoU9lq2+PXe/V9zLLamKLiWo9eXN5 y3Z/y5USSVylQvBbGiI5IB+9y/QQSvVhaAluPpc4EAfAFvo5Zb7XPfNBvuy9YglLtMmw0eM/ mb06BqRhCbNgysj7WkWJn6Tqmi51m16V9ouqPATEM4BgsLa/ieX3r0NxhqKC0hgB9Aa2UKz7 aVyWtpQaY3WbGLMbC9pVFgMXzdDFFhhkqwTiLe0HVleU+AKcLWZqwOC2yPHpmEen0xDfeL9s Z8iVWuwRmMi4w59iXLsPD4/CHq3Ds4H0COl61dk8911UteX8KRdCbItFy3r9eUAQtsRwlzBr HQ+4CVU9HGay5kQqMpihwIOIMQs8s2OH/oXRkm0C77+dzsZi6i0p6qO9OM7P6S1xD4t0M855 IMVgMxLWHtAoaWBKLoKkftdrn61vELcHZwrVQZQZDBjfxm7z0whEjfIbXr9/LBVV/1w7Nj1l f4F0Fd3fprBkQ/q2OKy/bok7WtfOcYwSiWf5R9zaCxk7GDe5zhEZaLe7varsx8zEGYjVwTqJ AM9gPbzfZPM6yrto1jX6HWiW3OIQM6turVZ2afPpBvVJ8fGdyBMFHWzDYT8VpT8DcYe3BH17 olT/Qa9MCWi0HPYP4XVLSXkPD2AxPsAR6iAL688y7lug3yl3sRunQ9ksIiYIq767zgrIW+4T VCBq/Oq+Zolttd8eQxp+CAnZHijjJfu4T9c5hXWjs3Ta0s4FcVhvpw7zqH7gKruOCUSvImU4 8yy4p5J0QA/STXLT6MvmBsrA/VGo/RpZpwVXLuRi34P1zCGheSnL4KJ9n5/E5uCL5Hb5LeuL xsnp2OYqztI9ySkzro7Uqjbs8QG4oibv+xkJLjcfZBS2yPRn0wBHpHPrkwGTER3sOSmum7uZ ME9LBaj3gVBoIA5TqaHZxPsFUie6ulx+EiwrndnKqt6Rb2hUc4r2TrJW3vo3i9SeQzUwIaq5 EqmMMVDW4XTNRK+/+864g3V5Xboc4w1viQMG5A6s7m7HNg8hedd+bT6KyHVL9jP1a9TadJg9 ub9mlKR8gEiNmK4+2uLGLBRXXyFmf/W9glHdzz7Tg3sQjtXNO2cLLdVB9LpnlJkbQsfpdzLd GVoaknoRzSm3d0L9R1bTTq1/x0uurOIl3YaQT6rgHpR7Jxe0p7TVt/uo+mkQvetAbB5XZFTX mX4cL+9U7cWshUrRZAC9mlPlGEdEXcuDaxZXgNmH5tyY5f6ihuCPg9Kr3mblz0pE3fqQ4bA/ V0qhNwXfDhSWc4RqMeIrBytbHnAfuZ2PYnkkrhp0dXL/iwAjorrCuD9/QHKVHhW4c3QYxSIR D8n7wRVWkP5LgTBSsHq7CCwpx+h/Dl86lbFXQTh/UhSvn04oHygzThWuc0WxmN9pWF7HmKWK jeOQFasTKowg4UkFNHzMu9o0IlAjfTVc60JDgPsbRrzo1rcisJjcy2b0JO/agPfqLvXJenWb 8ivmHR5uCcCPDBJaJjhUbQ5wmTzWuYNepINuJke693Dl0ouzvLKFngoGJMaRytZjy1kGajJz 3Qu/LTlvhbq5Kf83LcDQr36aMxHNx6tz65SxbRPVaC+TgLz3JeyRRbLEcAV0gSEyQdbwwiTD mMtFTGT15bCigJLltdy1FXwoSovy5N4rXb3a938xbe3xTO///xzppsyl0MWlFIpY5JJczyk5 bi2JxRilKbS5M/ec0rAjRay1gxJTroVdMJeMxJIyl2xsNrfmuoUmt/1WOd/H77/99Xm/X6/3 8/V83Z4TDHZ2obNLBmdc4k0oa/Tbl0nZAOAZWngw2QQV2Eib6Hp9ELH9fsw+qF8PpCCYKZW4 0vujjABrQK4GEx5Eb4WIuZ/NCRqIavQR1JI9434Nn7ZceBocOYtOay42XG6+THJ14R2oqVPv ck/fD39oD6Tye91yHHqMGDZOsLy/MC0Nj8vl7xbvoxiS+yr71rym6kPz+/UUEjd3PdclXONB e+5M3oz77ZqghBpmh4OjlF6Gq31yk6a6aMb34KsVpEgBxBvatonYO/wX12k3PhxLhcqJrzXI HmR9l9p8y0MX5W8KIgXtJ6b8rYDRaNBssEORrS9Wm0E5ZtESXGkHwoabjZ3L8rq0t+K+AZh8 oMViByk+mFZguxol9UZHQiYRA9ZOdPVUb9y8Vo3s435GuegLOzDye0ZYL0pmjl1/4+bk/VkI 6RaLfHW9jhDoVgklhI5Lba2nYYD00NgN9rVKN9Q0eQ8cRSrsgVCDD85xNXjP+Nsf/mWSHKuP i2wpzy1rGyFuh0oNrecWqeRDKuQTNwemKdalGBEzX4VziYA0QUG0vRTgrINzZ91A+a+JVY/s moq6grvATqmLZfwdLfAjQw6fLNB5u6EvPUt3UGY114OUUmw3FzX4oydFihkXh3wFbemt0wBv 50c15QOvn+MKtIddeMYwo6XswX9c53cLY4ytbvYKWyAK0MJPzwEWQX9DJKEr9fj548DfRP/t w4ySvhOWpWC9BzMvApXnymE6VVTXnhwi1TV77mW4mZFne3b21WXCtP+poanBW3UB9oWQvXM/ KjnwtWCZN9PHF9Oab8TDls//bzJYTVxO+qzEJkbQ8DVABJPr9Hr5EYB00lMDbl9E4+TYg20g /0QJTpr3FU4XVh2zAypUlPM7LyB1t1UmjxQ11z+bZG8O68OOnlRCz7tFMInluFLFSgWSrsef DVx+TKD7aU8mp+/yykvnpXurCLJfmccNZO3+jRVCl5+LEcT9vbhZfmRTeYAiu6xcuZMN2LRz f9IgJI4NdY+rh8StrxACw1JXuFq9ZqaUYw7Cw/Cz9fDzuEu8dtvwzx2Dr9V3ZxCrbDPQXfy0 ljBVC/vBE+n339yIzBAc+zWUVUjCuq+xhpkmld4NcYKW1trqYlDu6YRFPj8pPjZyPrONdEyx O91v6e4K9y4XDgBCaHEfAxgAoAtPpYVfsx8hRWoIrrQl5QV3P8f8gdS7TtNHVlbIde/anPk6 +txTbMo6YWkZ6bc49u71EYTgmVdfpGBINw/XpmTD1QV0z3IImcYH+VxXnn1R6ev3sdRK9l9X yV03Frr4L/ey5O/68j8IFRJ/fW/XHz54xaaIUUa2Q9ZkdZuMyuUTc2e94yAUlz/j5U6wBjlu OXn2jK+RyMtFOtkVcnBM5dhwsELNYEofmLE7UdToKy5n8/4O3t0oG3Vsc0+L1zy5BW2VsDjC yjVGx6bGMBRJHfBSNzHs23a1MVVU6T2BGvBoM8/nPS7aDWJeXLrlTxYjZ2Dv/TfFjcXLSj/N vHJMQvSJmw0XNBB1oR+80+/WDRCxF5TM5fOTxAhUZHKOZycIMg/QEKyqgsXLH/1Q6ROZ4U6R HbHihrDiGjFGtvHiQEr+lv/5zB6duLLMWWcOVEItf/yKz2iDoJliOz2YfnC/43u9b6aCpvlw ZlThHP8zYOC2Uqk9WNvrCGOmLMuWIZ3B0xOXt4+q179SOy4iJ1dRTck/U1Lb0Y9dXOAQt08+ QgdhtvfGsyvJMbAxhydMIv/ZcjgAHOiex1dHMR8Qqyffwi/XfVB2tcEJ7zERSLl7xZmL96W0 MhofC7Wtfo2UPXY63hBEpbV5m1dfMXc3T2MWdDvujCi9SHoIjMwbtGcqeP8bt7JbuTGo6V5R aeFsYRCqVNuiuEctRttCitETrMTcDXzSWaBjLs+z45RLft9cTvu83hFOXB6ozLeKjwOim+IE Mx1HSGTMCzCxzfUZdFdbAzhO7ivvVCRZ2oNwGH5mrrW0Z561sNDJaAlm7xb6nndevjacveb5 X5gAFEWjq8LrAjG4LTFtz89ZwNGTd+tQ3GgwBcogPsBxNUNWh69+D8URSjb4VXrDYbx6YeFx uFZZYReJWglFX44BUNmU9L+J++YKTiond8+wOM6/ZAGfJfGvlpXQbewnbRD5KTFa7I8hqGCd 74tbHyEjyQ5x9ihmklaknzsDICwJL71ZiuLANIenB9NCjeV56PiMrws/mcFHW0JFd2N2GtPt VrAx4eo85LczQq3pSQDT40/BvyCTcr3HbWJK1LdRVgUIM4kO2v70EK0Se+Ep29l3nwBXkYvJ 1UqWfbpU9k8utfbd0XtiY3qgOz9xY3k09op5EDr2z+F7LwKDIUZ7M6AhB5eres6GjBOULnG/ VaddX5EyjeubMgocKCftB+Y4kPTh/aoJ77nBTADYDiftvzDL31f9JIbaFJervltLKug9vHNX 0k8Y3Zf00N2YlCGRlUiue6aO7yV5hZjtsKGCI55go7C6Fyzj8YCM/qpj/tVz/H18MegtE2r2 2GZREzfKYD3OyPbV5KZfFZKm3BefEAWSP2ToRqMYiRp7haPvy8AUo3yoMVbX8UxDH8cePzAa fJDuN8uJ5L/ILvImZhpL++uQqBbZUOflbsOhoid2QT3JXMLmmpWxo1cXaveiKRG8s42gg0Bl 3s9zvJFZUtPl0bZ+7pIrsfzYmTalC9xONliKXhyMrEG138V8Bgj30DzEZEblG19e27q5fLoq +Z6rmLCxTkqrS4MLYo4hbNHTp0/lnoCO0V1KkdP45b//GpIQYE3NGVQXO1wdNd5s6HwRRHv4 AO0WBb2UzWuYfBIuIkywEw9GYpGmm0s2gGSJIjgE4sx029kW8S8WQ3S3HL5RqZ0PRaRVll0m 6t5tNTONgzvTibRAhjkGWoPCaMAbVVhP7EH1nOs9ZkMqawo/r2f45LZtnqki6Bky4JRObNuR /AS/xbtfebkmbQoHaBW7DoWEIeVSbO8sMwgJCUj9UY1v1C5OJJJMyLGxg4SjlAADKUQrBRQJ xUlvhFJObyY7u6eKaZNegsfLBXJTboxIyPfwIIVKeBrmLLOHrFQd2K2LsCps4xAPV7CqdCMn 7CwAVlb7ZzkTwTj+1ylCEArswrvLGc9tBv/a0yRKSqEDb3z+yrMqAw+df7HarFQJEjqFSF+0 Mg1dDDbE9mkzFV+ZN0zwr71Dm8YFRpJXqBFjqRn+C3tAe1Gx7nW5UQWzfJDKAZp59pzpTmPq 6vy2CYUfIN93XSK51ZWJj6s7ivDy0xS8K2bWcp8IM8XfA3PLAd1dMA7/meFoUTg5A6mPgrjX YWoUAFrZlu9MLOZVfnQ7lw5/VA/RgS84heAYE1t6A+VBo9AC8/hcTDFwaDE8jKxBp7mACmrf Kzf6YkzXfHQBTRNHoIb+RspQBCrWNcYo+8K+xsuIG6ztP9tp9Y9W8t0AIMiCN8GH5DhEoSav 8ow5Gmdo7zlLb6ve1M1RIL/yg4Qk/hFSVXgJ3UoLX5m4xqD9OZtafJoiLt89ib7FXP56eQjy 9BqvesjDTwPOrqa6SvCF7Jl7wCSzx6SfRHF7Z69GnhQzDrSWXUwnaFW0ELfNpA4oz9nAbcKw pnHiJrBb1aL0ua3YjfmqiCPQ95z5Rw7dGvDx20rKls0mlkE/rZc/NFL/JhPbdUunuGH5Gfdl 28yFf25Nu+Ui7s/C0FiLRJast7OuY8Yd2hifQ+UEdzmIS7tEZD3VLAgFTNrVAfkF5DdHLsq0 0t8RH9ev9Ky2zpeAzD/ooy1DzH63odKn47klxtOvqSKgadzgV3aiaLiYMiYdEiQrPAuSQk3u B3ZwYIHuzEiyCHDWd3BkWEjx/eEhhyRrI1kQnKvbxosKYpMjx7nJqaedKaH/DG7LvZ3ZrT7b 0LoL5cA1QilJc2HKrC7OLRQwGYIR/vTNyM7rKFvjhggfXMRjBTjX90lugmM1XWd7WqVXfUxf ZzI2l/WGA+11M8S4hvJEnzhbEvf89osxVjKthzn6lboSAmG/BsIFrIureFk6Ge+wdkXvApsI W3grPa3E31t9NGRa1vuhcSu9NRzoaHXyljS37TvHEhhf4hnjoMzCKN1Xkv7VZYCeTvCn7Aot w43ON4zdWqk9Lbp+BcLVnUwFnkO5y6WATVqN4H1ohnYXrMQfpwkYeETsvKuUKLyFklkT7frt J/VY7XQUO95zfWSUkTYK6gnh5jmR6ozNUsOz4KmVzmfiD28jKgCChmXBzsyPiCA92ha6A8rq NasqwAmX6+52ASmIYucr3Qf/70LByNrDqmF0q3ikqB9kFb3GT5BLyVcpV07MrOKVBEKwpNZY j1yoE77S0z3/cWP9MceMsyDujDMOY5lNpc3xk5q2/7zXbxLrdk+zqKKPO/0id/tbrp0DZGgK BNXagWYJhgH0Ph8izCVvIEcDkTfrihPTT6xBfN9UX2BPIdFQ30KJUHQYSJpn0QefP8EgTkF7 XsPOmJu3c05TrIKuQI1+ktpeSY8fYJ4Izv1zqmPxtIPnEXCll1siNrKVZh33rJqXTC3tCGfL gmzgsDCsTED9HSqa9l7pVy6W3OnIC4anlBp4URm90Ikk8g+1RQygVYh0h5Q4gQYXxxvge0Dy ws7FAINh41ZfRolxKyh/qcBYGhKBstIAeP8dpRu08ycg/rGup87uuNTGmeOb6BtZaNCB0H1q LocS1m4uYmzcIYHGDSgI1+ZQXj3N0CCe+vb0n5RLvW578ezqq6UJCcurMiFxSAe9YbY5jLdm 9fsviGU19wKEBcZWf6192oJbkO8I38o9YvxFQ4hxPwT9J3DVYivXgiEPVGY9caxEpGR4OEPc H+epqN7ICw9FJkJNNt1j7XMAVVxgPK93CgXO5Pl/RM+nDEgItj5EWmARKtwl6RCdAIdkXhrV mxKzbpwPuUetHf1VYPBkHz+k+p4d8iNkdyyGf0sFBTo4cfs1KlRCaHihpjxQQqCObfyQxcuW FuyxfNkFUuvajuHwi8Lqv174lQr/9IlBBQ6VSNFdnHEf5EhZoMvYuY7wg7jG4W0NNVu5DUx5 kHylJDd0WTPdkV1bOiQrttXsD3MpesMfa9R2kHdjwmrFafOJmvV10lLOd1xl84jDZspRk3uc RA27Wmdm7oqfLDGelxv4vHi6ucygorw4CdnGme63jRqseGaxCkCiyD9eLSCULEX3vYgz85Tm 6hdLo4SfvDodflW2FyQnRvin/6JkOgLPV3wzxCEGYxQIvN8upUe7Q+zwWqj8M+UFxA7a+D2k 6te/qWbDv62p/HTrom6S+4/jMT8t2pGEhBhYBKVMZtHEGWA7IV60Qd1OWF9Sql1sbPCN5vxE 24Od7z9znB9bPgzlsbzw0oIXjqTrdSrxPavWFI++nHZKbxbviJYtWlpQ339oo+yEowhxkHuA mEZdGJ/8VeMu6ichAIlL3Np51OSEAdARmMaInP14D1mTcgMlaqQUE3iEEuLxTN6UrHDUVscG vjRhoMxqjzoB/MHgv0kaJA2ard2WogcCKjXpscQj0DDkGUqZGzZhqI7mYdLKbly9qCK28f8f t//M0HbC4AOMOkAthxo1fylqMGfIqz/Hcd4OXnc0r4ThdsWVeaA0YEEf+NLAIsNx4LWWyfOz lMePVbtgeQ4iNKvKstE/mvfT+hFJv+ngIL0wVCwKOaVXLS1IdsRXOm5/gGBxfaFTw7D+w3N7 6GIQLvRfUNOVootKtnGHdmzWPxtHT1oBKhUJrsqs6R/Ocvsn2q4jXA0LvRCdKi045lhpkiKc jBh13RwMTNA4+gjCjN6CtABqOlTF058sehGgcwNffL3ubXnOMOzJV4Pxe8vcoS0fcmU2T3D0 UTzzNYiAhYnW1oXeiesrSwvdcd++aOVGX9ueEusVM51AVrOqi4rKIwbcwNhcjZmTnc+liiqr jqgmIS1v18Au49IhS3MG07KJ4KN0CI7m9zu8n50J3Ju/2ca77Hn80m9tfwyHn+eKx1FLk8iu BHc0GXDI6RT9ucFwJq+2vqzuMGuKv9XUikJPDp2K25zN7EuKdA43+U45QzF4qXsBOG1nIA77 7Ge8cQ4M2qfoCxVX43tyD+dlqPU9UMI9RtjAt76eezDxLSWH1tIgtdn037d2Okg/8AKkkich UKhtKOtRT1h+UcLgDmUFmgQMw/Lpn2DjL7U25orHT7UnlnmlAMAzQb82RdbWkh4Kzkvtj7Sn bFEDWwRx/NQSBsVm7eND3yOWEzB8x+Lxwfff1bTBTyNDSkillyQ2tzXBEgrAy/HOAYXVD1f6 OKopTA6M4A6vLdH1w092Lmp1q2M37JKQqFRe7pv334McvvZNPwS6tNcvKW1O8NHWOOlMTfuw vca8kaLGcKSuLGgWpl+qW8Iosxm6gcdk8yrZY3NVNYeheZ79SZ1DohKfjaBoFW7L5Qrw0vn1 js2dxdGLnU9P3t31nG/rZo/7d6Wfs2RNEXtNlxuSgjywcKnSEYinfGYG+RrIJD6MVlJ6OjdP hubO9Vlt6pb+kpzS3mFxNBtnWnU+081DcjxxWgaL2uBvLXEQNYkCd7ZCGLSyEnhvKaPkFJ3d KHp6fYUUYzDMTtiVWSt6Xf1m9Mny0nE99+j8jf/2NPLvDN5FnnQlG2of6A54aV+SqGLpdAj6 MoB2iu49cb0uHQI3/ZPS6WvZ+OHfhSBQ5E77pGKdMaWyGNLGm18m/aFxcap5ZqTgnWrQANK/ xDJi+XLS8oWuaNOTZdZrY1+wYXuyMBUBrKmG7Rl55qW5sQWAkPW/XcJTMIYT46WFfOM7zHH+ 9DWlY14VZEjTL53KbxIVdz+elY+WandI16JehxBM1yaV/cr1PPWGlVnHZdmv6fb0PqibG0FB l2uPn5YVADoW31+DWmo11j4qT3mjIyHcdR2jzX7FTlvK/m8feshQ1u2k1eNjLaNFb48YlrlT vFVY+rLsqoh6M3MJQbVUq1HQEt6V4H8Z1+0o1Af2Xa9rEkU/jIrJPGdiwzFF5+3Ok+C3sCM/ dcYu7dqERI51VRJlRLtbFbxh/O0t2sc8Gr881mJnBI+XRynB4DYZ5Gx8+7+Y9e0yKh3VjEuu uEyecZCRmjrLABGhqgJ1QQJadt1hAt2Ob+jNzJKmJ6dWWn+5NEn94unmRz4GMln17fGxlI/k XfUfSYmfugHeCHlvwhl7uk7S8rsO+o3u6NjBcjOhmuU3LO+TOguKtUwE5P/JIUqrxo48tM74 wtTL9iaRXaw2RWNPdz6W9tzlPsZuQr0tfYPEta32cGDGFtKBtCSk/mQbg3bNDVJU0uWHB7dT HkdMdnHKpUgBiztajqDntnVLkKYLaQrC6e3e8//T0DlKzt09WZs6JD+NFxjsA98jtXHjp/kF ZfA067g1yj28UvGPMMu3pHESPw/CGl44yqDMLuS2z0nD3Dl5NgOqqINDo/MfSV5VZG/29xja fyHio3jy8N1OrzH3UTduzh3BLUGch3/imbgV6yEQ0AwjIRiCfptr0KZD/PDdvoeg0lTmXmjr SFEzlRX5iRsZv2fa6D+xzG3T5nBZbdLjIXPEAdAPg4sEOw4qmHiwwKtEq43ln7OKfMvGROG3 pVIl8a8EpIiVCzGp8Ko1jE6Im3n/peOhr62MjNpnUpTw44dZJhHBqgmhrkQEDpRBCbcbYE/6 3HQCA2Va0XSa9ll6YBL5TKvuYf15QOU9DktuzoyDD0a/6RpRTaoX360uIKS6MW0p8z88Niv7 nAnOhjjOqQINVY9HAIN0rgkK+ZaRSOd+N6acMKlUMWVAHMs2FPkUJi7fJNV2HxRMXr90fYtX mdIQ413mm7MjK3CdmfJSRZPpXd7dm2+SIvn+956k0qFzc6rg03l3BMd152rZlmhqmPHwKm1N WZB+pvGEMAUsIej8F3MTWJ2+lSmbP2BN4fLVsxBbec+CZVrK/5kdtT1FLup2GnkW5GXUBMkf jOnclMtoHNr51/aroeh34yHJo5cwhojjS8dPsCoBYHfmV49DjTDmfa+zsX1H8iRC1MglpkAW NOfCofQSYt5piuo90nGKIXLH2jjtVZSBcA8kgzlw5Behn4BL8KzWq24nxO/M0lEHHSA1CPxP 6CUL2QlIuG3cuLjwHiiv3Ma1tb2QaxlYxBtAIA9VPONZTmowaNyRrGhHPCmZ0+aHZEllHBry Dc5oPjtSMV+IqP9DTXH6900gpN4WCb3VH3QPj6W96xpVTYecnFuCK6IhETgCEEfxjQaGeffV RBwLpL8y3so1DjGSDnTQyh+zXivvjrabhS0cTIkKJ8PvoVpc3+M9jIs+ZduY3NFKmh7QRVOy 6iNKWRkRlcS5zRh7uYcvmsNtUTV/8L5rTP57dZkgKu9Sfg93fYY/fqAf7w+XajVZvr9cMbw6 s2xwsN9tG7eNB1NNmSY97lVHfM1F6QPn+P/ag07CTw3p9JQ/6fox4e175b9lSD1YSNLLoUEG gIhPZo2ITUFf844vViL5Nw2x+NDUIfO5A4nrHmajcujieIEyWlR007OHV8+q+rAOk2p9XqaL x2OKeOPNfeaTbSxymZmVPFClgnL+HraFX9JisWNADylP/g7BdI7HT95nl5JqEMTyg7+S5xWG JLdpLbR5lvnjGAvVA6R/Y0rbjGzfL82qzcRNW07JgABBOoHMunjUBzm2ldehOVe42GtgFYTh FvyNnufFJwr4JnnngdJ6SbimLtZVxPDTAXrdpgzhjyM+28ghoxNOJtHItYe2o42nWAGC8BKs u1YddtXvLdqUwvDuP/OlrVuu24UeaMadTVoeyuLpAkAnqZx+RagzuedL3jnSDk+JqMRpEjBK SAgEw70EEdhNgdB5a9E6ZltFx5h8rXpo9FpS1VSey7wsmsb1/34ucyMUWdpaegcKULNICL3c jhnsXczpWVRO6YYYDCuonp3vvLySob4b7IKdTYbsrcgNZm5P3LsN05x9mvSZORs/njZchtHz qns8cPR/QFufFPUU0TCwUKXv5YUhW0e1g0s91mRyRVeNpp6FgIoczOINAvtG+TP8qrLyHu/I sc+pLsULAthL2yEHMauTs5/ZNYdJtzqgimf5u+n+MfvyFBB/kD3eqR7bFnVHKxHX4DWclaUU l0sy2sy+b9Sfir7RJLIMalM9xSGP+ETeOooQVNU5pfux/P3UB76qlzWGInPIToELt2IWMYP3 kbtjUsNa6QLYisLE7GpGfmdS6YJCCum0+bzDZ+A5y3jWk051KZlk8O6K3zw3iB+ZMyoM1YEz 4DL9TaHO7t9XM0TLy613HefUTTJwb6vbjGZaT0Br0MU+Qy68dUVUsa5gqoaYk1rqO6qkB61N WCDeB8auePrvmJar3M7VHIne2ar7IsihKNBk7XkkNeLu+2kMMF5n6OsXxbvsHlXyt6bKK2u5 i7NT/ekx/QPYK8WbzHZacjE/wdTHUdPkIUhbtSnUtX6UNDfUIGq+FuJK6uBmf4JXkYFqc8Pe IUgjWe/amHRxc7gOs/wCW/xnW4NnY8x6f+6qzPOm91sEQWxdEb/0JnC6iFr+VLcleDa53W15 uH5wJOcPkySQ45Ux+FfLsLfzvc7lLpu1o7XE8+fySY6Wmhmot0f2NZX+s5J1owpZ/un9panX hlmF3crQbDKMrgOD1zbN/K1ZwaLEC5NY39FgfaMG5X7Fg1zxi1pgWaoonWxVG15QRGbp1GCe xVIAUX0HaV+cwU7PDeN4VC0ozzxavVxu082Kv68LRWMdLsXnqaN79qS9tdjXNK7ACMXCsrMv dvv2ZrX5ll3x/ldN1Qj+TUBiF9iZgwIDjwcubFTlWIvbi4UDKSBesK/7XQ5jN+lcnc7aSkR3 gdYdXPN40DqR97W/K2ao/3XN/U3OCt6hbKa55Z+/xjiC12Fpb7NdwPbrObNoSAgEexHzMRyP BVrx6tRUGstON93yaijTXcJ8/6R1XDbR+98jlkFbwBDlPMbipQvUKKruj6W9sCX7r4EL5K0c JT1HxytSFpKI16QOyAQRspRSTt106GkJ2/vvJAy+p5gjOOTMKSXNLi5DCRyP0eilWVZXsh1H Gy9pEBSuNmRGqFpREuc/lB8cqPB8Ym61uXh7jkLJzDDrY29OfoNDTIIY/y2EPQihbWnsRO/G OKxu8tumdbfznRYbnVsEl7jRt1ZUD+IQ21OLN6qufaStyuSby4r0E824XspzNryHdmBTiBu5 +FP78Ehas0bwd+asyoRlodFQFWDTRR17XokW1c6EL786l3DC3zN2dJCbdzExYOfStbS6E4gD Is3kWJPLVqaUJ04g1APEoMd9JxAM/snbz4w7BXRxbpSJwVZax0mhDjp0Rb1OI4opRdNrKy+t xYsjdwf3xmlEMW6a1BVMQvRsaWP8J1s77CNasvqibpVpmLDieGWt08jhRbHUkonbM9XJzITs dliwvxaFbhJChqfqLFfC6CREaboTOBHbybiU6G76BZawRVCF153sKS/UPUCDuntjpRiP+o4p VHiEOzzP8LsDWYM/i3oHEU411nzbtPHVji9NolUh7p3McWWrSE/TpVfkEmaZI6Se68ycsH32 guy0PUsz2Xa/m7cpRVPwyGngD+72e3APSHEVUVWSCwcMVJ57WejkyuvO/45YHjZr3J/wPbNk 0JFTDFLaFiUm/rOsOoiwkID7j5h9uvMaYjW+FoaM9+5CB0KGCnoK3D0VpvItE3Pam45JASl0 rVUOAyHUDXGKcYbHfMC3Hy5sqzFewgx+XvRfoU30HoE64AMvMPPH5YLVWJOX65I5URa7SaHE hT14/o6WDHfA+oPtYtfWN0SQAEUE9GblZetz86YQkfrjv23IK3Fra2MaGr2lz8hL2OPP56bp xYZXyrwDGGXX9Y7m2VYQDVNLxXmTQMgmrPNsH0wph4TxPY9a7kFBtC1agpm7gQoJa8ufniOC bUY4869IiIFc/9n/CeAe/B45e8D+APiCxYkEtzb4ma7pla4anQrjU0xFTJtCOu6Ni2119tWl s17iFjzUgaKLy8MTBgEtj2DwsJBlkSPXFDu30IN+TZBDMSPJS/fYjUV/G9MKA0+tzexHt7h2 RrZe459czrPQ5L8iDVcw6Yz/RM1HDv0+86DdaVTqLVUcVSZonb3d9VzL+D4xTjFvrFrtsOtj /OPVvIRvdgj5DH/4VAkNBrdK2zD4YRqrg8OmJ2kFscd+KDi8m/Anhwx42j/krdeC95tL5o2V MyMCa4mbMtbbPxDDJGLFh8UKVU6/uOLZB39+4+3bWR94ulyGV4jVo8uKif/HzrX/M92///tW d92dqDmVY4kkh3V3QM7VXU4xHRjNJnUjh2E5zfl2l8MId8RisUpMZIpsw0ZlkuZQlsQw3pJG NmMYhu80ff6G7w/3Lx4PP7ze1+t9vfa+rud1vZ7XE5zJGBpPqjpqgnD9/lm0EpzWROgoKbcV Xa+xpZoY0oobA4jSZCszafPnR4fEmNy8+4W8tFGuUTe0ZGAKg2JtJ+dWySXyZG7CNnKlZKKX aHW1YcirEh9naQ+tTrI1xFkoOakNaErOeAuckIP6wuRKYQdXvk6yIkr487zHwZaHqvEqg11X Pp3AcR2APwwH8ukznwUxmzjuWghNZvuw5bg0+UQ5STXwSSh7B/lclIswYYPCLdh2g5tBbO5K bsPy4gK87s76z9bmCvNrO4xkM6JwWztNXZnv1B/eHFJJUb013XdMbaLdPyh5vMjYrIpD0mq4 YI2BSh9m9IYyzC6JTb4gHfTPjh07mseVJs9co75hj0wFU0hNla3D47pph91xw33bsK9zzoK3 E79jlmBzGcrhpxET/6v7DQP+3WyIdDlWqEeMRdmXRh+0iGytazOT6/k9jCxU9igJLqguzv0a 11o8FlB3/F7vr96GRrQjHK2zxMv7PCZ3di0wSsgBKbrSmUeHLu11DRM64GDllxZr/5hMit4d OBpwQpyJqDvF8G/aIPBT2P+idNbf4soJ2vniKj829VyOE9nJ/bdx3wAcCYNvBUpQsEoELYbT Ap+/08RSajNEOu6HXutK6ymJuA5azZMG4fFW1Lp9gWMUkom7FtIlJ/AMxyU77sszuYZ4/PS3 wrOQTfO/mHFYvJ6adXtOUhOf8t4MiH+07ElCwmMnkehxWJ7bQSIGXEXxdZ8YZSiG99dMDhuu tGWX+qbVkW589dPCNXQeoN2t4UR+GTfzEZdgaLmaBbfvteS2+SbnXGKWYYF6CPdpapfze++8 UF0fZaWqguCLQm9VzWu/UuJmsxqYqvUHKrrX7etJ+X96CtdNT26uqEN2IhKBQz0uB7lw7yzK 1o/HY5wVsG9GUXv65QrfZB1b6q8qa0orol80jLU/YRT7sIqjkLL67gwSlVGeYfah4Vb3i7ym blUua9iumLUveI1u1ymOgfWNDoPdrDD5n6MNf6tcUQLrBW6ZpeoG7m+71Of9kALrP8ad6GUa 8/rEVha/f+gaZv7FlGH1C96WsP2Ua00sewUaO7FNx5HHDenOH719Xj6BdPptez2M6PJmDRfa deaFpr0+PbzrH8ZQYgNzoO5/5eaV7kNMtGs/qTk5HHYw7s/fxpWEWdOcCO5AvHDq+T98AgRv OwTBu+5eedlRz1VO7tFU6xWM6zyOKqc9dcDS/Qe8EB9LNvzVp0rkBrOl5y/VeXVFRGrQnChj 7/eL0Qs06LP8uhMPS1VZ+aIKiLSi7c1pXYaJgDffuotS2VIyZVxc5AEE6zpm6vNjhK1f7zpY ll6OWW7IGiuB/MHxCvRC6uwEZ3G8PKMsNhi0DLvkWoyvvRH5H5JKIussZfKfaCnaVEQDPN5n fTJql+vD/TS529Z6Bs9zHlLC8po/knBk7ltARs0i602NWt7r47n0lpuLasTIFlJw97aa6LdP i6bLdxzpyO9OlYc+FS7PjzK83nsxQqVagxqdL/RvExbHPcsAde7w7jN3QtapahErbl6zIDpM hubYgtW7Hit2lnTW2pptBuKL/6oroV4/bWa0dgfXOtygKsYQOtsVHfl3X5tvgvxKWapfzoB3 rOfxvVe2BqfXNzs/4nqnwVE5JN+/6wq8vGuQ3vzNMtdsh3PtOms+qpka9g/XBCzm19SgkC2Q 0qTOKo7f4eipb75tDquChQkyz/KrT5c9warfiF5ROskZsZa5kR4fTjFhSH8XH0by8CEbyFbo b6d3u0uBBQN8l1mPfKGkkWaf9/fKUpAS+fbi5TzktVvAGV8cObWccW7N/tK0cMNRofm2ppHH +t0X5k+qFFrT6NEVgRjCpmqEDzPW2j0B3QsX41eXewhjs+pjyUvhaLkXkS6nfXeMfoBtLxTQ 7vKcBpUlQ/TWL48VJt2rYFNs6wHTnL/mukhvCbpy2OagViCCNzgTBt3aWPzh6hP1MrAKYgBE rtiwFNZcxVliNEG+P8OGbuXUmxnFIqo4NVZmZ0ta7ioiUwivBZdjh3aFJS810DMmy2yNElkI tAt666sBNhPeIwjqO7ueabM0h1YfzqdfVT8zbtp8AzZ+JC2mLixP52HcRSWjTDYtZIyk0w9h vCj8uhKMzkWL6rLIdPNRJ8N7T3K4H7J9wB6NkeKSJTdgUSXDAqPKv+wM02R6uB0xN8LK6w0M 538ghSTP5pxBnXRBv3uEe1Uu5ZFlpB209ccXXAf6d9s7J+ppi9g1GFEtTMeRAwfmwhjyXILX XHZTBVF/TOUQDEjOuG5PDTgc/R0G8Cz97KlHjOBKhTQ6TIrvnhc44CWf7I+IEll8qRWY1190 jro1rLM1cy/Vb+qJAU/KZft00U8ukY1UICqn1B/q7vaVFFNXQoJfOgVXaEQd/bTjzDC08vqL ewXoAW0UWmx1kNA9zPtAOlnz6qmZ6MsMVg9lmhhKBPVkoLV2QnI4hecyd6BMyedmuiBjSqtf pvx2N3SViyo6LFuG5BPAnyabOiUXUWe0hhQ6d5UdaHjxiYDfc/FgHH96tLxLGIYRJVnUvV6m TzSg0B0lE7u7hF7FI7kUb3rLeeCOw+pISyc+flkr2R6Y2ZWy9NRwG32iNVT93oh0z31DHrPc tP91cNhM9PGoh1MBU2dokULJVdSztxv7WARy7y+zVwVldW0G5xDU0IVUcTAsezTFUNQOA2rU a7oFK1O3yG+NXe1jBkFsJK+qTmtl6EO24w7vGcWUVeGwPvDkCO3zTmg1rSDyQgh6UFomOfqA ua7KTfD0qq+Qv2Yn/9QDbyPTv1hjNHrCY8PfRr9/RruKpuUjRePye0RdZxyELoeWv3O+dqJb 78HioDoZ+wrEB7a5V3B5L/Eo3TkvsDXUdPbLI3nFv5J5s8vBIcLFWZe7gUgvhSTyQbPGoxY/ rnte/iIbTKs5ltcsCsVZm5T9Oh7IT8MawElhnKxHwZNJ/malqthewR7wwus39QKyW8CyLvu9 p72oe4L86YpLAKbTHIeYS9HdmXmazm6+p+hcopvHVQYQ7sFf3r9a/mOmQ5Wb7lUihg49RQSx TfC6TSvZtyCPvCTSgkjw7gng86YNUDygDV7Mv6QReyq7uaPvPCz2y1SVMa1Pi/iKY/LNKwB4 rRWGIQdgVoX8GWwQphNiSAOl+A+W4eFzbzMNmFsAl4/hfl/umcZACmET1/yRplTz7erflHON ZH4EFq2EC8D5woZI/3G5zKI2vYcGaXjL+H36FynhTZDMryNHcKZg2uKB00CZP7NUUfk+twhx NTjKJOmjN3EuwF4EVv6Uu0EMzgbRaZR0v7S/orxO9y816WMDi8bsk6Gvp6aRfAk/aLtxwt3r pKY2uaLLkXVGHr7XcUl5qpYouy1hbjExV09p9GzW6pJPwrscgnu5/qH+4olP4SWDpzTbGgzU mvbn7OCuSn9Gy78KcMDLcEC57eslHEKAXV7Yb8c03wnRB5S6FVSB2lLkdaw3NTQc/VeXLi8V LLlqfr9FE4Njv+Nz6jXwxIvNA0AXxYwY1rFdzVOYolI4dtNwur9qPHHWyM2OWkysQAYvxgRh VgcUUqydcR0J9Uqtoc6KKnzP8vqAT2XpvrojUx/3ZDSVQ+9W/nj6y98vaaq1Qxec+L83Wzse UrAMmfvuqneUcoSztcm5K/zblTZhILWpPKhqpFSRBeIdNo4tJNGvvbdPthJ9Si89R+ZWPSp1 qHZpH/YXe0wL6ZwcwlgXpCnb6Aci5yFJHtSLsxy/RxahXz7zZb35TJ8Omy+LVzZhX+tvtzTr N5IOykEnnweH51I2ERrR3YbGsQZhyEUEoyR6byCo5xkpk7QfsRGAGvi2MfI+aOQRmz4PDMcp 1Pe8GJ4aH3jXI2F8739vgJqQI592MpOzDI+hHzPI9E+ve1UcvK1pja7tMxZ6zFIa21TfXePc AYpffdUBWm3qBGXmlYcMgowwkD0pY+8EGx65DezMrBMEUwhd/th0y3Xu2+UuTlkAk4KtYImD ztT74SJvlK/Zp9Zsbfdh6y9TG2JHpvT4bh9r2q2xlCrOk8anCins7gz0pZqFe9iP+wLF38q9 jKaFeG2JxI6W05+AoXP/gayzsXWn+LSlHCejNNyba+m3VaBygVvJl6Imbge1K/h/PUCktdih ouzhrNptipXujZFjg03u99XCkBw9/sK7kuj4PAcHsCO4WhWFJ0fd0DxbAnPZb0g/TqjIsteW 5kUpSkQbNti91ApMZMU9pgSlEpz6ZceTpdX/SB8L+379gjDuRMzbTsY5H+RCzHtvEzMS/SIq yqKswqSyoobY3gHCZ54H5+jzqftX9iXV+A75SdMZZYbl59hU35tSKLAf4zjSOMZqtbKVtSYe 9L7AqpxujlerB8qQpqWuord3iqwz1ZhdhP3J5lstn3WSmpaah/fxjc+ZyRN4n2thBVOjVBJn vO8rRSuwV4DvA5Ex5Wop5U8nn8u4p1vFCP4yqT+XgNbK44b0BdC3SfPiZGd+/1Hv2O0tzk/j cHIh8079oHHxQbirkcNcN5H/rAtvyrHruf7cotR3hjHeWHoXFKTviKfGzCa1+0f7Wd9rD4LD iA7gd32DZwxpCiksanfsO//P97DfdlZqMlHCByuW2fNrxJ4rmzaWgeb5nK3NSD9cNymvGT6S fHWHDHYru9tSuvMOOvab36xKl79REDv6XzLdMmem76tLz6d9uMIlxrHj5pNr1JHd3aSosNp9 GU0+wTIzO38cg/2Du+g+uUwn9y2zz4Rxvu7DlIWlB5uH1RJlJvtr4a1si88yPYk5v2Mj4TgH x8wm+sRpaKX7BBwO08IhdPyr99tUWPdD9oo9M5Zh5wz740uzpsWz+QNBKpK8v/P6HUo7JPNW 3fE0mF5DUKMZ1391JXZp7rIGvF6M6HiyyViQxygoSMcRchrKKzeGFyFEKl1B7LVY65PfY9ij z298d4Cfef5TSQi926Nkv01nJt4cruMAOcoM8Yoa3Mm78euCjwRQu0vtKikLZdWVXrQYAI3D yNZ6DT6VZoW52wvlB62l5wOiej1JqGySSB8ElpblhUpz8M0nHofcQYfZ9+Po7L4XhmD/tCcc n66XzqpWSgno236MBGOUcGhFPTtijYJ/5cDGKnpIttuu1Ppm/d09feVeePlbMDlxnPuaXvb6 BudYjaUZLb6zBGraJrpvqOtoWSgtW6lAYFFJPIvKycpaVU9xyiL0CTrxqTOMC/F5UijV/XGu 2vjPOkCNVb92zfBUXv8rs03raRGj67gDE32wEDReJZQu/picFE4Y3QTVgJ8XBwAjIm9b8lid oWWpAxKoNR4waXMsUMO9bebE3UNXGMeqjffF2K/JbBgudzN8Ch06vZD5+XFvk2qeHBv4Sr2b YNwq+HXFUkvCDTy35S4IMoOQS/VJg6UvdsDrz31JfRkx2Vdb7UTBvphNbiJkUTrssfROW+CQ I9ikzeJTKlPeodOkgHuHoh6XpU2jdvYKTMl3HaBuuE004a7HaiktL51N6/XSI/ftxHMc2kZ+ JKdDCZp8u4PcLWHy5CfwGNw/qEgz/eIP5KCZg+5bxbhcmhb4/Wn39D9nUXUXduT6OG0uyPBl 1dR/O2wa/0HT4kxyr4rKSuP0xqN4wYWKNUtvSmBuuB1RGCvq911GGIIOeBQ3pLtOMDJNOAgx ErvO4ENec8WfcAWjdNzb4iD9oxQQ52Fw4vDy8JQKJhqHbpGuzshmjj00HpjoO0bU/1qiiwvM RqQGRN0/mb8o/mAGIBaYLgF1/2BcjVB5/dGJf9v3GzbHQt3hroGo1g6T9nMjkbZD3sFQyqG+ F7EsRRTaorSiaY93C+R2oXnEYKalrao3bzBeJGo2bYtrT6Mz9PnTmijl2vxqTk0VacfEJFmj s0Q2Bcp1apCQo3W2XJrm6MhVurorYVtiObpHKVpdRq5ncLeYMrWhNJ4NwQcT4SfbGGYNii8x 5EeoW3T4o6K87PvHShpjVgT802L//MWEvesLcMX9BgSkQCJbpiUsGac1qZ+HFKM07bTowwYo RcZ2xMF+FYORL4eefi38OBx0OOye7xXWKTEamOgLFdr2XvEOYSK7GLXVRdoZYwFRJouPFVIU sSngddZBwZZbdKw+pB5IbK6wGTiG0NvSvyPwPCVxOBYIlqHPPMVO7+1a9v3EoCfaQy/iKBmW kfMPA2RXo4lIYLRUMZtidI/mdNMtH8fdDy13AM4YFlhRZwresX/kZivlXxksv22fNLni0gtV HljtcrSH0sr6tMm+iIWgyKk9EcSlNF00NNdA0bR3BFS7gUdPPqb5y4LH+1aEKxWfQT0U0vXD jP3QCQeg0CFTlU/Sbfb4mS63XDrFT22ufjOK8pgm76GWTYkrnQAMFtRZjXjkQL0/myWjUVHo adgjXf2IqO9NLDOkfQaRA+qU2o5xmvPpjD5BVePTWRO+JOCId5pwCvDS476i+Pe/5rvuC5Z5 7fw+l9RE26Sbc8Fo9kVFqT8zabWsWwFDtqdGIIGC8b6r9jHTohN4HCLDHdleQoZrr0it60ud 3TvK3P+w8CqqmmKE0ynn2p8IhRQtISg6/U1TccHoQFmwJrcaMae22yIm4MvHvBBZmni7muKs qw8HlHoUdngr1ZbVcpQKi05tqOIgydrxkhE45q61g0e7xoyWPUZta7lW8eFITf2r08Oxw1MX gIsyAfUhkM13LKCeuBpMfEHlTZvVBYIG370nt57e0gLIdV21d5/95wyyzqA1FHo7fl32S1PK DdjanN1c0a0nzhdovRnynv5/gnXcYWTf1xEh0YzUeUKVubJXthYxu2v++vj4nWvacpiWp9gy +tjYMX48crxMkxiJnAxDWoTUVGkN9l1Jov8EIW3/WpU3y9/WTo82VlsMT6h/ZZ/IusV7Y2pm DRSUEOeCr8Dy769M+EQu2vrDcWEYRcK/uTAgIzQJm5G83k2WPYyBYfNm8yL1AhUi0nVVwNjE IbVb0XLES1HxxjF+mKWP3dvy6y5LB1w0iR10lIWoeu/jX0XAxOh7SDC+xXtWHwXPONmoHbkq 6SeeliqmtwP6SjJhhMwDEYwi2AFzOe7ISVzF/TwHeOwR3kVojsPqUqUcRnGmT82cEs3qAJGv 2dCI7ZmgNQKvnVm7gzVwlBoSufvH+302ltOXEYPkh/wjKjI3cS/tb85nNl3UtBj9JrCHVrLr olc9cfQxzyuwYuJktrpn7ljNghugbZ2hZrCZ0DPRR9H9KRqnOQSCKFT69Ztzpw1+455Ep77G NaoH/mJiDViEhQm+U0qI+XT1WVcAKc4KuWilWVAYEvWPW5t7wXDiyLqmZcLvzdXN/kqZXyIX PkxPhiUamWKJaSwNvj7seFhYZ8MxkwHNwrNi1Ftxuu1QEbOGsMxrXMVN2jVzch3nWzk8Ni1y FnDbDk8HBLKGlUh8uz+rLlI2DCliSxTZvG33nuK/Fr/pXeegXWjPKbkko8HhMIx/aFQ9PSha E3E/frol0zJ+ZdE/sAUvqqxo+l6hSXxYPs/rp8YVG79+eg1VR3yjV7mfvWm9n/ygG0CUBp6M ONjfMC2vPLbyR6z9jK+zBp90uu2NaGc1K0LdLAqoRpiB8BGYiPz7g7XGcJz8HOP8zMPprT/c 9uDkxqwsxhUzpY4q6mTImaHz2YFs5gPy4W573xyK6lWSz+qrJutMvBm8MP6CnfsG1ld9UCcS EGefJjE6NGmT9r9Rl0QM9Nd1xI9XTM2vO9FxY5XYiTLZ0MlJD8XMScGf6Uv1FwBmwZ992afb biT3Yk8BtQ7UT54kr5mzqUzlCPbUPz8ImrIJr9sO0HxdRlHL/Lnvk3e174wb81VNI8jq2mKv x+f3ZNuwNBH+spZRaHRqK2f511zolh+OaN/n9Hzmklql+eMTlTF9UCABDQfqs+iQSJPlvh0s WbwPhvCBo1+NKLykWciiR3BL1Q44Jve+UMyWDHGKc8xHlQrLSwD/U/x4cvsUGq8P8ngwQi8v YjbGdr8khe7kxCp/LnEDDx4giv+I953dxXni4N629KjryjtcimQeNqFZ4/3X8Y74567gIEPL CL5mYQmxhElnU+OGN7AC8+gtzKfY67JGGP9v44cc4MXGsYY993iSQaI/H1STGI2TRk7p/6KX XpKMU14wnypK8ePqm9G0NZ8qnX0QGj5bnkR7m0dTwVJUtRv8apwJPUzO2IEDYI/6yKXBmy01 5nx8iNpcl8mzyZsyAdHTUysDsB5zkHrB9N4LmhbV2xjrvaDLUsUvCbGu1asoO4y68okwbzvM 6vEWDJJpawaBFwDHUJqD35VToRIRxG3WD6rpMtvVpTEeAhuRZwbdMjqttxNPu4P+w2S53y2N fnxC6ywhSPCBows98gw5zN0WB5KQbX9N2GQjYoxlji5o53zg2FBluOoIDQlnRyPBBRM0QDod C2xTwKy+3+ftBuTMQHYXNKSQN1oqSbjiiS8FIEv2ROhipuUpQD/5Xo1dTMHlto+eZ9PcGvtd qI4SasnvUhftRbe2styBCO5sIISqwR9LpfOKs20cgPCV1kK4aeh94ZsdNjH7uL/FbZLsa09C Pt0ooN+9hKnoAlR6hGcZJ9+b7Z2kMyRtq0TNZ6Wg1YWLd4SXWjA9EI3ZBORjpuL0pyFJ49iK uSX0rtBCNyDNRvSuBlcTumhUoG0RpO9doBk3Od08M3bBJDZoD2Y/v4RtS7WQbDJYCq4VF3tS K27JWxsTcl/4D1tRZCWZb9wgVZ0lrIxUmutSw9TTxRkh09UTlkG/g1bvt6X++XN5O1aY226C CdXnCH5rPC5MkCTHUKlEOnTil7vuBYgBWd5dR4/3NioYo2U1YFYS9TV2WQFpGwvV1+dP7+km XAD8FSxB8cGVJO0G9jwdQx+LSl+Ik1h5tDF/Lx+izm6c9QTv49uCA0yj0Lsx4A+4DLLkFmDm 9AMHgBX2ix3BnC+Oyg2rwoW0eUznTCG6ng7BK50EZkISIhUkD6vb+K+wi0aiHpX8C2xUuAg0 XsAb3xGCGlvR0ZL9K0sdxQpxkRACRIf/XKeLw8CCYXOsINqvr6rX+xGL6b+AeGTdNxM/jmYt x9rch0lmCfa+J2z8F41HGCMM19V4MSEy64hm8a54GXNbC2NdJ3cvivtTkhcPsgJio4bRvetq xZod5usT098uStlQIWAVsGSmc+/f9NrN68Au1u4XzDwnccRrnY6tAAXWxgqXesDIzQ8OmxYo S3TxxFW12G5Hyk+pUyXbXzBG01VTj/6nFryXz72N/qm1eke8//3gbWBJM/i/xf8t/m/xf4v/ W/zf4v8W//9Y7K3Hx0qADoPMixcJFyYqG1dWxvDxq8vsgJ7G1ZWZTnb88uLCWKZlQ/zyNGdk iVzpsSZS8YrGMqqEF97fbRrr9+Xb8PBydASv7zmS8TV9oqcCTvMbTWVjwR6k72S2UusdxXUh ezHOQ4LYpGs93NjNSTLqpqjxttqZn1cJLRC8Nib+OGb1fhF99QywLe7hggQFPhP8fhfkQQsf SErHkUk2oumaMrpl7B+Y1SdO7neET0/zg9G7MPErgn0afGsZLggDpsFuR0g0j2gaTjYxzmeA aH2Q+nlNC9R5UGMs72QG3R6jncZoqXZb3DHEazQrWFlmQW1FBQSmA2BEVOAIbj5mRod1RyIk mwZt9AN54DX4F4DsfXzrO46rU5yZniC2PAZ2UO25MECOuIMfv9KRQNFc4TfVG1UizKKnv8Xt 42f3yXaC2PRCYRalGy0r6SqwN17Wamju4kTPy6hbmNwYF3y+pRk3MjewNvkTvTDeXi/zpKp9 muOJ4qBd7KXB430W8THqoHj0KrdCGQqGO3myWkcM+A8LWGSkGIzGfohch99KG+vsRGWacR6g eP54+jtmDqTzoVBFbyWCE8woGQNCs4VhtjGip7ai96+Wo8W4lcJAS6Zp38tKXbQRDQ0XtUAO gRqDOeOzsAje2LTgLQHmi2sGuoR62Ib5ns6PV7x7Bd8OR6N5He0T0HNAkQE/9gC/Qg1TiVGo 9npxb/aLwZCtpNYGb3lhE8PMRbIipCd746f+tRV9p9hSD0IyY+pO8Z9RfGNIE9Ab6I1AroP4 yO7UYDwab/Bf/+g3qp8IfXBXeFlzEBuhCJaUSFF2Q2R2rj5sZYmn63I5bHExHUcKOI7hHcXg d+fQK867j3JO4IlO7nBvTz6+0fsJ34MYrCyYnpxQ/A34dCV3vO/YxCiwEOLjaAs02QI4I6Sr Rw4agpr68nNIcd8QyIML8hCXQgmnrc8B+XNXRzlnLJYLwpsrrAb0iHfrssar3ebS41f+bTpe 0R5OZ9P4kcjzPSXSR7OFz3U0O16SVmrJ6GKJL69JOWMq4Y2ezK8pa/Uk/w7yEKQxaj8yNdoX J1+a3FyMmqfoLFgSLYuDM5sqysSPo736/opm6tKjcBGaqeqi2RCNnaMbBT09C9hQW4w2QiQX ycunr9hhWC8UJ/5Ic0AxCP7T47gI3gBgO3KBH4B9PRXk0Rg391fUrhRWLmW876OnS4ajNbAc cpRvJ7mo9dxyj16jExgN+Mth/PsY4f5yPW9JRfsPQcgOfA38CtA9QbYrjRcFvKKMfvRpfBzM koGqcFsFip2FFi6Gy3M7kBgCIDCbaNZscIwGdCd/kUtlKs5xhwiSWrFoywt7sxIaOjPvEOuF DjFmUVUXyfxoSBZunkyLXxhXWrVgaN2MX85SCWwNLbgy59QrwPUcD52NOeRoeb2Zs7DzqObg t/oURUklnnbqwYE1YYH9rEdmA4dYx8wHZjiIPu8tYQ4xz28vav82Mk3Ji1FgNHyQ46IoKivT tWeJl/dyewWY55fhMKXPJTaiCA3+mdozwoeSA7kk1bhQQuni6OY4QiPrNLnm3ud7vUcQdyHz Tu4bPAppKa7uOrMQLh9c7Y63TH7NbtyRDDsC90KaLP/ZKwjNRxc7mKlqZ9BxUYr8Oklj4fzv mphVA0yPUjOzBP2F2X0obn7lprUJo02P+0q4eYbyp0V5MU9UOjA1zxts4BuLONd2RD23cq/h 5DqQWzlN4Ul58oRyBxUM+B3tlYykGi+RTbGh3p+7au4dvjEVmQojUA5URh0kIlDINNhZuALU cXl5c2TMp4mbuqLJiR7wmkxw9JEBKRQP1EMlhSa51RgX2FA5RrKVMpLKLdfqDPBkzX0B3riw 1OjYRa90hDMSp0e8HbX1zcAIz4c2SIsuP+juKdwWQTGk55xrDD+TQHG0PHEcgAO1xIrrstbA tmj/KaYkR3A29mkiAlKjs/MSgUNO0FPmbiLOzBhYPr0xrggdIz3h8HBKWy2ZXetVzFFIIQRE DYLYAQRMy7dQzUEBDtOz3mKxf3CAf2PKr4OA36NsafnkVpSr6P/I+654ttu//7ulRalUq9xV q0ap2WETo6VWWzVqlFC1i5DasapqVSNUSymiglqxR2y1R0nFCJKYNRM7scdfb/fv+Z88J8/B c/ScXQfX63utz7o+1+f7fv9o6UgwMJECc+Og977aTewsDelqTGEQyoEFc3f/YI+shKC7x8iU K5js/QTfW+uzlChJcv0PvX9y0SHhV9yj5p0kb65Lrdgh2r/jf1XSt1WIF/6pr9XJVfFLVjoy EEH0YrfrA26EqvjvGVmjl7CfdRv9QF0U1kg8WgbQ6uPS4+V6h3QuSvbAfnr2NJ3QfFlYgHt2 UaZMXKENpUx83nb1vfl9UMkOStFnNay9ZQZTYXmwbTexdZB03eJCMG/EhHeE5slRrCM5cHPz sWC8waMncJl1u59PrEbwoYjT/OXjmy8ub1fnt00+U4ENLg0YCoMZqLaQczPZkLAZOELrt4ep XppSwg/QlE7WxFMJIuc/2Fm2nypyf7h0bKHuLGURLmtOP25I9HU9dYZNtB9bBygUPkThvTZ+ 1u13NWYH3UMkWfD4a1hth+DGaJHmZTQTOMkzbGrOfRaLgcNzpU5mqCNTT/iTmBZoaKqiU2H+ R1KSH6U/m1aADZIGPISDXg9Wtn3Wb7S9Rf2Fbl7f3+ZReqql3JO1+rmpd7JwzdlEsrYFc5VZ L95S6WuhvmSDIHfbYqP0tZtFF/8lToqlPbFR2Wge2+yAvRiQPCsPJNrZihAKGUA3Q9pmfFbH Bz7+PN4vdRvcrv1xNcyqzGgvcxY76y448CzZMqFiVpXQd3vzz/RifehUTqs/OR7zzhU+96tx e6+pTJz7LsoKP1lrgIvS23XR9ydyfLnaSBlvNxFAmuu9bu9uiDZYvDLfPHUrCcxvgixAkU82 DdYQ7ws5nd0kbWnrifFU7BILmzbGZ1/wqtqpXo9iZJewrCuoh7DvXgw7OYeNbertHUGNqXmh dkwq0AaClrcATiujHh/aXZcufDxKeXahdSBBLm7n7QTfv7ktR5EziejuAXFWKy6hpNxnFt/Q vZbA2y5sPPJ+S5SkMhssWnCoQh7M1whdTn67MSoemM/nHjY5dkHvgsnfytCld/JKHxctk8GH diyRiZfdRDQt2f+Ff/jBYCTY0C3YYD2TLT4u2uDvVrkTZYjUnpmDXKl+JJGI8R6VtXodIkpv wqo8Z70TFWfTNZX2CK6qZDcQrRXw48z6f2hjYIKXPrtyvy/S+eYrMHjikCHRPMpQ8o6WI6Fl PepEiy3cP1ulUJNTUgY90E3Eye5MUSYV79aZtfraCO9XpuYij6tuQgCti7edycBWxlPN0+B7 Gucr4moovIKftl4PbYmAo9v1nssVlu+NVHvMzFx5Pu/QSMZ3dGC0J9//+KzlE8YDzDhco9kn TCVvZnCtU8dYJAVWQNMuUZJY12b4qQm8eVl4c1FUYD3laZUrhHQPX6snvRTxsV3vS4eeaEmQ sUhiz3wx5RDKdgV9jZDhfuvg19oZmHmFnBKnJZ4FrsoZJbvOPS39n4yg1mU4VgZ/1aoWXN82 bQ+RTl6OawPUtAM5VSAbv3MNkdmvNWY9TLdoN7Zz47smC90ZW/Cclphs/nWNmsc7JaeOQ/3s 1ShRVp/oosQ2WXa2qhcEqUJ3C24V5buv799M7J5HP5oQevgwRvS8T6hofIMVM8/YM1hLtG2N 7BenBZHLbtPAVufT2lYNPt47e9eE5U/09CR2GZ2uZf0QcSK7N18nWYjIJmGgi7VUgQ54UtPn hyoCobXNPiZcK9enaaejPa3WbE7DKR56I4EVG7wIG+5XYmptePjWl/arMTycMnE8ynzxzlxf ezYcYhsBzvxKTCtJlG+pilXzh+5uLHrM20n5tNOH7orrHKdRwI1/Xm6rniqFFxX2V6JfQvL1 q2AQJ4t+tD9BQzmg02iF1OlivDf+IOL36lQod2jP5BjT9m0CtMfFwHzRncRSVfpHOavO/auc eyFvBNI2F5XVgFer/Ly+mik5E5TAZ6qH1RhPdofCCc0+3N9e9ggVjQPXTuHxnGDgtAZvX4Kv CkG/7hRw0fT2We3pz0+VdAbj2x7McMesjiNbax6BJQBfv/Y7VJAZyFFbIrRVf1uo+Rr7SjPD 5SVppxm9762FnjolDP2f9/JvDVCYw6Csug5RusFmvg/UnQ9YlonXnX1+c2pU/NjbPw1YC5rs msRXQkWIQtn5EoFUEQ+00IBhvFyIL4L4vO4UOG5BOuSVsGUJejva2cZCcca8d0Yn/2tn7++5 1+YrU8cHNxpwZNRfFkfj1Q+cPGf7q8D9YN8x5iKFOqbWON+i1XNpPKcb8kE1AS002DKtXNPb jVf6W4/bJ2719ufan7Ob8uLBaVw33K9ZqKFvKemMZbvLXV4tM49OPE1aA4VixRsIIoPObHoc JnINftF0v/E/f1/onrfeveI6Udl7TiLUWbLuqa9gYtq0u+jjjilg49WdM6di6nZi1q6+x4mB +U0f/6Hj6hB8fa/6I6nkfkvZzpeGCYQuxukPqrfNqILipvr+lKiNigUzZtlOq24CLGZ5SmlG SXujTaj5mfBMDHzFFNXQK73CndhJ/L2yYeuBW3NR1iJar4qtwa7brj31vdBSny2umKJat111 5j9wNx+bPrH5wBzgorxVgokOX809lUmzmCt6iyfDFoEMGVucmYW+jifK/lc8r9skaAlrC7Qh hK7/QisV1tUMn0ddWg0IKHco+4tw3z2r387dxDdOp2Oqvn7lX74wsXNn7YTT7i6Voh8Wh7fP QrKGKmzHnlb74y4q4QFHTEc/0gYRwOt12e4TgG0LBcVp3amHM8DTVDiA3khsPA+yDHPWLrHe cK/O9VnpmUUBtn4fGbrURV8tH80Z4mM62VH0pJLg6VhcZ+Oewj/UmBHyBg2lwOu+kUpGlp1K or5biMfj2hMyiN6Llvq+76bkAhYJ9nVXTuWHISS5jRHGzi0bxy6ynS5/Hah+wKOS7aCFOKgW p5V86x7dHN8c35L7itRlN396SXqhfSnHvG4Q7Ueo7LCpdhuIqIk6HkDk6cUjxu676yH9+eo1 TobQJtjWMfyHS8l2/ZPBdtp6Z57my/q5jft1mxthwIoEu7UKMXrMBYy1HPNqv8a80+nXcy85 DqEjZhoUuaHUdKV3igiegXj2s5JMMc2J3alt+6dXn/ErnWx6m/iNS7KMMNHs5a7ErXsuuxgK YDZ68fD6vNB/3hkQqk59fCjww4s/2HjmtWfaNnfZsxqoz2a9KCpG42f+dVch9EYHZpuvjh6A 6j0ODIOwS/PdjC8kA0IkFFT+1DX9RZvAFJL3MD+XmvfKf8PrkE7yWlody7+EWW8v5+xLHefS LfXpgY7r0lc/85zGTZdM39Iu2YNiVcTV3tcJ/tv55ZWFzy3s+4Hrp4CK/9cpKxdozh4DHml9 oPlvOFP/YUL9pyUvKyf3/6lUpf87Xl2Z/wFr6j2Ze/9Fmip/W/5/nVeX6GDDqllF+4Ku6e/b /b9TBhg/qgrEqfdd43RvWj86RrjnP/Hp/anT3E7mfGEizTP4Zr2SsoPeo/wk9zkgdovfnBN7 cYbRtOks2/+kueN7FuETA98Gfdj+yTUt38i5ithvOfL0cGQ/WI44jGl/XelXaCXVURcslfAX z1IExy+XD3RBd9ZMlAe3pb03y9/ToBkPsg+/2kSs3QhKD3d7s9XTd2cNkNx4dKOhaj0ZifWS U+xMtfI+un9o0t5z4/j7LReYTQno7qpw8PhBxYbbbLCPjVTLC+0Ih/w6qZit7XV4fiXjvorx D1Vtw9Iatt9ZPe6DVsPBTY333hzyCFmUB9eLElUHEtpD6Y6l0ObkDTfJ53XHlFCfzDN/x6I2 TYj8I7Vj+qOVQSYrsSJOT7NCtI34JHnkdoQOhCrK13E9jeyS64Wb4uONOB3ZX0PynxpXONfp YDI9ViOVQRFnk0VRb2+KfjJh4tyhOarWwQ+v/kU4+Fwo1SOVyS97YVOHM396smiBeywExNbJ wVdIavecsvoZB05vqRYJNgS8ZQe/qhqptBzxXtNjj7XXYHfsPOvnNd/k1gXS/TqiP1LJbQRa 8PHIGvW6nWFS8OIV7WaytPPwME0jrWJFkgCTqzc/udS1Pha8jTmfdY1bH3uVo+BHXaG8qmX5 dZerlajaws3g+jeeXczGnhDLKjAw5iJkzYQ0fNXV2NuM1zlyBNrgti/EqIvMZKSMVdiOF0+Z c16HuBOKQwi/HsawkulZzleizEerG6G1UqIK6T/qIDPZfWrujoy1ApUkqMRyykSjhoKOQro+ xnO8zk/Xw2W8zulKuT4+hCust7JI6mS18q3UKkbtsvXI2IeexelTdXY9wyh8sg1pWNw8pxdr aWIgcAE/zMjfgTgKpXDYS4kopFS54hsCNT1cJhpczR2Rpdf4nWNH2vbyHYtBuM2uCb5eaiz2 otQXnxVCmM02OIhY7dHB7FhWHgUqMClpezgwXwFp2HRAiIvBvljWQ5fHqCRkRtx1vM8bv21u Tn+IO+3Ok5duF8lUEq4QVJ+cGolif9mOqAfViC+64p/+8hyvdZtoOIRMsq+NXyRz5ZDB1vg9 FR1RpUtYc/1+sYX6p8ruk3/I3ZinekJo9rcfXM+Cddtby954STqHmjAe0FBo5s+wwXB/2jzD y6McIBDTEnEm6MVxQ6D/lvqHT5f6pxeYkr4fFmGFFyNjAvebdzvjkB1LEEpnXB7XnbfNc0uO JL/2WcCRdnIqXTNN/g0kza+IroCDYLknKZO4mY4YrrCtHzQfWArg9CzefBWLHiDAl+NoqZfJ t+r9ARn86XCa3d9dUXJP0mh31psefkgvjhsRLHYFvuFs9GNfTK3V0UZmnAl8/fL161evlgZv BSSlpMiZlSCLfZbLqQEzG0KrvLAvEoKPF9yVvfYonpzf9RAXlnPID/RHFH1c8BywSBL014FV VjUvn1IsVvMCZfDWbYS8OfzewMBgmhwDmT9Cf4TJxRzA17E6rgHFgQsiIph5gOELXwRObnrz fakqwUfN5wLkfVbISSdz41SE7lwy1qStRM2bNdZS4pA/me8jzm2GJSUlRSvZ208GroiVmI1o wnnVXYCY3eVayIrFr1nXsQ8U1cfITVXf9BN5DUv6809MDSddEIRlLATot0F7/92wvwXOo3wi N3ubTMR8OZqIiuoyjGRmpbTpJhZZVEO92DqG8k0KLZhdWjtzuxjedcY9oMunsoGx9TKXD1Oz AA84pn6QeaVSHByKQPAZDnSRxQ0ZRv9XGwIFAPxeoLNCJgu38GLOwugoCedGQF/rgF3HFWH6 zm/tljk8QWRQ9U1Xo5kgoIjd2iFKwyHdKJQ3+zsmRVEldEEVGLo7vAwl1PhttlOdyyLjkjbn /+bjcnbBpt5YTea+ARumwdIDbDuGzFRbdvuIUEJ14D5bMQt/ooSlXLBMATy/0PWwTx6UOQp9 dE8pI/PMxXn/bRJkdYWo2BTT3CB3ZfiKkAsxnBqsBZ/ph6ruYWeFnU4+9KMFqoQOPuYuRhZf 48sh3TJvLJIyB2hZVUOXFXQ4frkHUdDccG7lgL/Iwi7v6FF6+JpvR27SwKuoDsGCCFnwP+MI 6aW1r//umumAv+EKgw3dYdM0j95T0S2jot9Sb59oPkLZf0spxgGTdt6bVcZY09RKzqd9uG2v UdeKfvFr1SttFb8L8+ySlnUBUZIYhIr/XjnbP73KvcSXtmMfxstGf8mmIDvehW/0mJxoneSb Q9oRFr7iBhfSdqGTjB+OZWB7hV/pAiV/1T3gGNjYIDJS3hDxpHV4FTHALlHaVdvVN2Mt7qQa fPwA2HSYx7bVQreg/iJwyOviyrY2QFslXaoUqXq8MwMvsprpAagYubyLRD3rf6Cr6Vt3XyN+ l0pCBE2bOAZbMV4f3jbD4SxwqyYDI2hCzDkWrLCTOl168N7ivFwn1+fDJUHjjg64C1cYMV7q 248DXc4djRdlxa6og7+fJ9+BrfFSJBsPnsOtgm54X2TBealIP17kCXqhTUf5KvcXM1mYTO/i 0LlfGOn6RJOkr8vR4DZ+wNbxVbbV2BpJKqMWL55ZvKn0fCHD1dlOquMokwWr39+IoxkrcAmn p/Hvx3k1Yn8dHm6rLK3vr7ZWeomTG7LMHaFX8MNhCpp7GDkXUI98+HhWl3n6rvSJjczsiw1f s6IKj/yMlY0OdCUbJqPocC1syeP6I/TkNjCxzFMsMhRbKeGUyksM75gI9nlgG4fzyqBMUOmX 6ckarqlC4o4xV/cBMiPR0kWGmTSVoq6koFolCrcFC+mtnLAriZx81Cj3fm+6L9Z28WxvUUj9 F5TKF0pG1dEbbDRhL1RH8hUJIFYfiVJBUzIqjuix0YN7SC1JHRJcoJ4epZJMySg7isRG/9xD 6kiKkOAnPQtUaigZJUe0mexRVKEb9cIFKiyLGi8Ou7Tg9VQhAeDcMOITxdQ8+CXWxuWwSxuO ogoJA7OHEZkU0+fBGVgbx8MuHXgqVUgMaD+MKKeYmgVPY21sD7t04TAqvRY8iqqlBQ+jRmrB Q6idWvA6Kr02HE3V0oaXUyO14cXUTm14AZVeB55D1dKBZ1IjdeDp1E4deJp0buPk+myiboIY qMZl1KSn0bLk9VCT4f6a+zOlixcwHj/KJNciM/Z2Bw7WoEEHnoe294MsLQPsHx8GwH0NXfe5 8R+spFfxrsoD00SVe+DxsruJ4uY1nl0fJRuZPgg3bTAI1we6vq8RrX8ZI5U2hotrYEVYBm9z ZyHa5pM3aGyvL+6xHQJ4ibmkjWvqRMxws1BtFQKkuO13zgMxgX55Lm2UWPEknTvW8rJ0fcC5 9xx6GRZV3HoZBIM09WsYzQK90FeZPBt3zhzQjlbpHKfqdxNxH47T1ndvbBaQHO6SPIg9ZQHT o87rj9SUaWTSRnsd+oueC5IE80jjKPaPEutqTkqjqXpMcx4uuwGtGwRUbEOb0F2lIAOVxX2q c4Dw60zNALJ6QOUI3a2lJ2YdDs5TyOdrZpE75DFc0UwoEaHS4rAwM3ppNklo1u9FQJCNkhs7 RmaubAFXZF679/WZqP6wPs5pmGZQN1FiP49hyYsk60J4J1S7eWskFGtSRJw0fMit/H6e9ufF pRC9nQW2F31FM42Om7cYg38ej3QJrf+MN5ft9ojv9lhphuop8QQOtF8k4VC5w1aBQ1GktB6o ak1rB060Rq0+kC6rVi0wCUPEduBk1YhsVM1sY7NNpPPuOu6xxcTfARZnljjg3WRlg9vy98/n 6D7FRAGU76L9WO2Uph8BPK0D6n5F5OGkSzbj/AQ1PHSqA4dk8r8C5klBySIq91W4W/S5JQ25 PSI07dr5z83cwb6PHSLS3wJpNdr1mhgivmcYI0ymQ+HePPSv2uneK3CnDuwaUbELvcgnluzR nvslz5fpcHdRyIJd7RlfF+xyGJ/t9h+AOKaHnaXyLFiT79sJGfbb3+ZfYGAAqh81SoII2C/k +VCg15vP5Hpu6zhfzSko4ZUZO53yYP0n6lm9jSh6p1rnT9QLqA+HiVT8e4UaQEEUWXk6aiZ1 BcnqVT44q8Y/+41Jf2g96esFUiMWVYsVVEGLJfzlxM3EApiaHGgCf/5OGBJqSviOXE3DhRVX czveh4qQJLy+DlKnVswrE6TXf8X1yZQEUowDH8WlBesrmx1uf+SlxtvGo+a1ZDW4EAHEpzNm 51zud7c0KQA2ckFaDna2HsDGgv1vxkHuiJHHS2Bd4PecuMGALeN9dWEDnNCLtRKm0OGkMOBf sOQET1avwLOafvYGmwEiUjeIMCYe9WOMHZdqvSmAVRq6NAvZQGovPR9cjqnz4xDk3s+NcHv2 CtxTHeFUUMa4v4wVeQU0O/+MC/49jwGrrBd7PSkkXO+xlr/Iu/uHhj5P7kEQf9cm/gh8Cewd VBK4wy1jwHOhjfiyg8Mv1QWUY7NqoKuQ0LqnGrlhmrQncFu5Jg4TPJsQx4DVJgVmFchCMCNk m4Q7KHxYid5S2IbNwBxKbrc/5Ve++UZpYJRQcHvL/pqUTiWv6d+76Izg0pXafd98z8BsJu/b sxDtAJlnWTHfC4doF5WH5ZJjvf37xJFs7Q15UF4V00E5TPn7+aRh5EBLxohLV0+1IfBbtZIs ej9F3cyDZ+BinIGHRpYVaRfr+0s74IPiiR28l4Zmw66XCxhIrhnNQEXe4TdR/ea4sie3GGeU luSvt4U8AXzPvTZE+ISbH1UOfN8xmlGgj7Nz+vD9QcXw40iKGzFOgmQtpDQtr821ON/r4b1u S5FjeUu3/CTxXkAEc12gNVlajWNp91CzF76SxmlCe0G6VCGtjAPObP+ucw914/LdwASvuhfA DiPus/r7iyO1Czfe5iwmBmRClOzYAd80jeM5SC+Bi56U29BLYh/srg+kTBo697p66jEY5JIE QyqPc3b70xzfl31XI/q1+vtB3VGkKtZKto401LzOPcVu6EiCZ+Alp88rym8tB4Xc+WwtAaV5 Kbqu0FjaJWzwQorlNvnWtqTFVX7VNS28b+d+vW+3v5+At+HIbG4UTb4Nrqax9KbX9+xoTxBg 5lqmI9AUu/4FPCyVBWlmwGvIDGflCalyLVt68NFag/rME0vBl2132DK7AJYGLub1K0eCfVJe Oesp9u+o4pkVBZBr58OI2nEbk63V0TaNduJLHwc+SsCd1GWJYTEUYWwcj4mkT86Ed9QLZupa qtcDoEoeXWED69K9+T7MZNyI/jBKei82rJjOe1E/eHAxv0CQKO86Nlr5MwT8as/41lIPu0Nf R2lkXuEgZDbfXzp7uzjI3EhWiLp0fm6HwZa6eM8BYwP6UNqgT1K4nxl9GOhA6nySuYJ1SlUj ktt6PMjdlef07pt4pmecAQ2EYk1ZJW2eKQVv/XTy5A3jENeqlZjms6lfG3IzbeSn9s/IoWS9 OKxhpQ3vShvC0fYgzcjJcq9QlGWmJ5/f8A6m/RjKwvNYFsQdZqajcLeGBpYigdV6xUYdXRww hAT+ZUb8Zonpq/GA3WlO1nkQ4ZUIXTl/c+u9/lAEfHpvuXUw1ymhoqBognXrhR2dN5mLBM6u N/plZbb5+YI0Rg83jNRJjOhFLgv/AqzYAJkWvuL0B270ZqQpS0uzJL6cfl2Yp5Azn0YkRSen 2lCgoRfpV7SbKgOEJJs4lT7ozsbxijk/v1dkNtI6t0Hv8snb1rsArjBkssnBOetJ/2aPgXQu C5lYOMryK47zolTLjMiAzdx9VmpuV9QVtHuffdHFSwbBNEuvNbXmpbR4nh16L6HFmgx50SNh tGq17CwGBTSKLzPj+a/WWri4rDapgeb1NQM+7Sclb/qKe7J6qmuqAnSQOSUi3IRGNz15eM0i /iJPgsJK+VRF4WuTs5I/bqs9HTYsfhg+2HzTW3x54SBZ5qsi9QkoMetOgf6H+k/SVkIfa9o7 lBaxWmXx9uo20uT7CJXodOWwzIf6HnQtRD7J2+C+zEJ94N+81OzskWZyU9trAXqJZs8CzFWX dnqPzPPaXSztnR4g2uiv7tMSKWk9NVqayI70bCmJ0YQBX4wfOFkxYaSUMP1cy+Ghpi1d88wj UViGxK7akuNWsZgEK29LYfRmTs+hTT7JSyOcWgjUH0ZPhtWk5YRxxcF+rjhqqrxGsPdXBxd4 cQVqLe8YDQe+8zIfFFR+KWmZRdqNOQtK4c+Y4rwB+ib0dGBEpDRHN2ht0JIw28psG2S8rQfS I7fJG92k7+ZwgtFbg+4V0Vy/8zqG0XYozTW5sTSE/Lzsotq7wdJwfcxgRU5P6De/HrrVB7+G Y0WtcUnnuK4CtRdtYFIrtbkndtQtT/aTtOKm2BJa/DLDZTsYfe6wGDnHxVamXB/Pgn/8wMA7 FuKjZY6z7oUxSXZRdGHKALiBs9v6Z0/D/qzZp2BWh3eUVu2E8sykQbmSjozxJrwA3Qqx51vh vKqv3RuGy4w2JfYgng/NykeNGbCxuctR04VjJoU/N8RYwa1R8fl5JHSNounwoZEXiJU/lz+n BLKopYm5o+g/q/MVw+R4W+9JcbooRS0zItNGX11fNA/ClY1ztpQuwPeAernIEFeIB4oEFCO/ hVVKlrPgXbR0IPm48zLJcejawL7UpvoEL6E8fEa4JyGlAw9cYqjDPkBOCZeEvI6BhnsYeYaM 9ybbBwxqQNJz8D3RgZSh2Zt3U8EXXiVID0D5OZQHpTehqw2BdJGwn8rQRwSmlYXj8hI1+wkx 2Rzmhvj0bC+rE8Max/Po1fi7JkGWed0ZMCD1GGefdcuh/eFtfiQAuSlXDBDkwpo/4Hjsxerl YGWZYxZ7qC+72rPwqaKgCglgcDHa+vGA/uMZsKOeHsLVm1w6R5RzKaqIy2W0kbTmGlTqHxSQ ngnFouNqtJyPA72hySX9xpv9/AsKzFy2GiYLy51Ow1Lgg2cn/mglxDK3h8H5KT9q9+bf7V65 pGVhlxdl5dvISkbZ55eNfEBCJJkNgzq1bMK05XRNQxJvWn6nd5HJkimrrj4uvR1Ps3RIJycI qpzoFYn8dWkz5PCnoxGlkGsBeD4LmZsW/MB/dbBm9jwL9jm/+htY90Mnw+uEzo85KxmgsWX0 Q8OJD6xucT+oZz97yaqFW7H3GMdpgDaR7ZqEpRA8wP27ZsrB/K0sRxJfCjJ5HRXqNzH+Zrz6 XrqiNGgMLry0tfIuSEKC752y28oOKM98a7oeBPOi9f6RvZXWroiGP3SiuX6R4UlJRmEPaAU6 //CTtD8pm0iK50jl3oqCtED9eM67ybQdLqGjalJuwlJ1xN4yOdxaHYW9He96H/OxcDEkfS45 x8eJicJzaOv1oJf2lh2oAPcwnFc9EtZt77RKCBNmWL18s2D5LaivZHouzHf1/OpC/mpJdPkT ZMyBsDPfe451fbfumWcJcr36ew4KuJfhGxKDmzHLkcy2dDYKr2toK4Zb5TWASlQH12fO1q3X rdF26haaIP5iRpmXtubuJm5GPo48CqwjkGnJpRpCIEpWYKruyoQNO4NBcw0ibzhP69Wcpvkg evsNrsw9Lmweqd9veq6Hr9Od2e5uWToL1zkFY/VBqaILg1Xc33LwxkV0i+EKfXJDshGv7T5J M9a+dBtvHlvxvVc7StM+d55RQDKqzV9zNyEzeXhdohYR/ORbTE7hbsgW8tYrwkeTIs7hep/F JR17Vrvhe4wK6aPQ9MxoTxj8if72laHUedlEENOAAvj8ommROc9nGOdo+TXCVaXpd64MxdXV 8myJPH7HzW3ZBbvj/d7WYtbEDu1LEtEVQ84bNPPKO2xMBVG9wPrZVpU+wrJNmT4fTQXT7+Y6 p//H3nlFNdV+6z4kIfQmCkgLGhEbTaRICx2UDxEVaYZQBAVEUHpLIFRBmqJU6QhIFxAIQgBB kI6EKh2pAUILEEjZ/M/FOTf7Zl/sq/PdrfG7eMeYc81nzvmONZ6x7HU6j/1+fw9TMccHmXqF eRWWWhGYE2sJUbG/ad6whnmj7TMzBfNxDy9VxgXo+lohJV32R6WRI6OWttP6dYqR2OXId9jm iivlEZ1vGr8a2zrePz+rjma9iW60BWW43NH31zHiuqtvcqg5bZRQn9r0cExcJ2HcHJqDqJ8X WXjL+9RnehofY0faXHG18BAKFb3UZmmqtt/Q9DWUDFOQwRXRn8ek7bwS9EndteMz1tPX5V+J /mfJJg7j6K3ji1/W/i1ffNIdfw9T44C4mQ9WMOsccRF09VdkFJ1s13vK79Jkdrgu31ySSHyj hwkErCud8JBD9CqCcK6Jep7u6WcMba468Mlxju5Nyp9TxqqWRyVs/dRH64qYloFNLBRH/9kw nT3r+joPm9cMa7K//svjkkFi5bIX6ddD8/Ov2BwsBMifV4nNKwHv6qXWVdcrT/eKUL+96wPo QChV/xfXJflo5S3Zjtj4VyHi/Qk/FcKNELKcDjKRcrmhgwWHqwaH1B2WjYNuKYiDmk3fZ64y g7y+dU6i4JWhlO3AsxXQbcnVJYTw8LMB5PfeugQ9i+ulaCpJ8YVd91VCZtFQsA1oj9dSLUMt lhYas7AUE6gNwChvBfwtcN/8vvYkKi+l+O0c8zNNLrynPja5aOuygb2I1fkbcW2fFaJVutNn kQl533nEVe/8Nu/8Qx3a7nvifOZSG3aiff8eAruefVqOuju9TlOGw1NifGNm3MLP1+oBehf4 /9r854eQT1Z/B55dE93Le5B8OomGrGE6rAqGQrUiU6ZPyGW8D2p+inftSnlOVVqeyY/w8kFs PON6CAorJGn0IW4bPwoVVNFdZtoyeWaSfPK5xHPtk6F1tqO5ihKr3DvQhdjol22g63Zm2MJc 0SuEUexZhSqTyRyRGY7b14WdtDaKCMuxwhKF92Cag6HtUsu/5rDjUHmFmPA0CY3Ka+pvivQe xlKU1Eb8FnU9+mQUro4IwCGco9y8af0ctwyxH7Zqi5h6LEcLKhuyWDa3y+coB9tBCiqHdiLE CQcLD1tVuAf5WpugkF5ZTO0fw5yXjzuinP8y8XUcP6b6ZkkSt+ZSV38Pms5FC3e/Lv90urTM RPs3y/ProzC811VqrvsUuz/S/HXWLlmuzP+6wOwe2m4Bv69hnswX9kwTb35YdUMhveN3ML78 eHLEUK4r/g1vIn7nW4zkOz1NJjkcWrj0r9J9I3ZOZX3d6nwX/6S0LRPsfkAtGxmjuK0rcWZc t9FX8Vw/MWFqafGcspu7jmXebHp0ZbO3/T22d1rTCmKnC/+XgXty8BQ8qQzwvSHvCVO8dzlA X1yxe16VC3v38I4kAavgXclW930RpyZXIJWygc0r74nk7JCYl9G8az5bb4pt4ndwyXw4AsLX vUwqiqMM6l+85XPjg4d371/LjqXOq93ht3O1z0muWhecu+Bqq++QLFxsgaE3uq82Dt8ptusr SDw83JyJAd9GYWz7+k+vOBv8Q5gktX+0gs+u8z8vgS488iqNjlrn7SRDkh/gmdcth7veSr0m v9mWX3iHPMJ5gD5dmrZUDEfcbbx8Z68Pf43LI8m74ZyzUeBHPu/YxkFiTm1mlBdPukCmgS7b O6M+a2lB7pc29ddufkmFHmmE1XMY+wzhHcsFfFCfIxq8XmYHlK/Va1l4x/b186Qi7FVoVnXn rHG6zj3K6nmMPsxymtyjXohHbGeeafp6zdXNlGBf8OnGQsASGv85kXw5KNCfw81ci9Dqct2c oiz+BB23O8yR5OGXZ7cjcLyw2SY9aOfjHBDnS+0/ClIYLbEYfa71jfh3hVNkCVvEd+lLmkQG BpsBJjdGygWQPL2mW5O+pa18yWNo/eJ7ayZGIAvdUbfKZVBXTzLbgX1DKrOzqZB2Cz9ZKDdM o/j7Krp/vXPoWRBZmy39uXlb6A6i7fjvUydNX778W6O38UqMDxRivo+TopIZBwkIG9BrYfwG PAFqsH5lfanHZPhKwj0BRbjRSQxDsLUBfV4XcnnRbZJoP2fWvlwYKVP+KhJ54y27S2nMC81K ebfGJn9BUl1miXKRfXVUgGv3ee4XPQMLYObHunpe76Hi6mLUx6t+8AM4N+k4ftlIdYUripMQ xf1AH6Nj7oFQ3eEpWrQzcyoxNv75xTwPu6zfEP7ZYIBsu0z9ZtbtE1TlN6u7x1Tz2KLiGAJ1 avWOJ9gVLFskOHINP/LK0N2ULGk0lXTOZDifb90IIV5cSOvK/Vk3TWHeQ+2UX4PuE+cb2V2S 5HnzWVweQPVMs6J5703+aO9/IqHpe93CWGiPjK8K1bSKtY7nMKjxf7t+F1EAvzKy/X4I+9GL g2DOb1jHHyBgHVXMz+Qr8hntbH1+7oNupuuXwvtC66ukNNNEE0SMoO5NChfdFjkPLW6ItA0O POv8gm/osb2VtSC358hzUhpFQM0pQ76YbdGsZ8WMpP95mdPxgrNU9Gea2xriJWjoQ8htBkxQ Q7Efn/xWJc2tco/+rbinX/UeJjCldLmgw68nt0Q5DyR7GiqVWySq2GjaZZF651ZAubNZbcmk VQo5dg9HeXPifDjSBIm07u3JvfRb/2EhrwvwoeHFoFteylWXZWr/Rf+if9G/6F/0L/oX/Yv+ Rf+i/z+QQPQxkS60fnRCxNGPCQNwFH2zrwJHoRx3EnEBZMraYuQhcQYrG7C0QJYrvEzz2dgO CQrwfjmL9VuM8HIxq7BssCOb9XyUIu/2SDcfUTyoYJgcTYW0NEGo25pCHx2t7SVXNNPnScY4 yvFy3Sz9aG8ARwOOyOB1sTm0+ROz8OP+MkJMiH8flkNI0W262eOwGRQZT3NbwKfuyWkGxeOl Mccr2TQQvkZ0vcWQQtZ/RBqAN0FIMUXOD5CZTl/8D1MeyxcrurKsa0uS+lQORVX9dzc6Soio o53CrD9fRX+n/b7mfB99uN5RLREvOtXoUZ2jHg3gIaW9Yk6Qbn7y1XPCrMes9EmtIH725eRX 15WtJiaNoF38fkNqj1nF7HcR/AASc+xVEMfMMHqfKT+9iDbfmBx+fNBHMJMeyEjXewxVO4u3 UghqtJ3ueog+IPMjH61XhPqrFfs8Wr96H4n131zebBQvxdmb142yJ16Ig1s5LUc+1n2ABJLw dx4Qp5s8/ow/hN5GvXY+3gg3NCufLsInihWUVt2khbSJbp0GTLPahKdACxgaghYnPxjyGwSp Fvkk+Ac9Io0VgDS93tow7VrUiPGIISvMSX1ptQVffDan0cz494V31AIWH3MQkl0t6AcqVZGq qIrfBUWpUC7irG2Fz1rbxNqv953xwpM4HzPDJrsbxYcbcN+/4yz3s3C+Dgf+pTFDW7JlMK0Z CmQjp2anIi9/4iF9/1j/rLxVE/Zabpl6gP9uu+x9YjHeZSyw+ouh2s1Nz5NYVFylVM+Chilx gh8/tPkK8bYSdYBxQJQO7c4DxgKglMNZCqvTC2QKXjqzA/K5NHqVZBC0LYnPS4F6AJ/KA8Ni SeVqz0vjc6qkCHZG3N9G3yYUEZDoIN7JswE40DmjtSxrD6OnD/RLfAg/5cujHap93aFf/AmO T0mTI9NfRLnWv0ZekMc2fZW6qJlbmqX6I65qVP44QZQz6VYBTD0t1/GRvalOxdhWT+cb/4nd CrNSiiPJ0pV/wjyP0dZc/1kQfxlpsTAqwZk6PACn39xneL58y1l5YXEo9MQnEVqdzDNSyzDE GYG/njjS48v5NybxhYZz8A0LPnyJAULI5ZuYOX+V/LNGnxgH6irLxXxzetTZkAN3pgwk3bzg PFRpxFOI/GrpzLelQhfQ13SOqH6FWEavRkTptLWTpsAofy5TQyyKOL/o3MfNoNAwS5/DGa8W ORnAUVFGt2OUdxfx7S1fzBVjitbF86xHOGoFCQqlJqNmFbqW/IQVaYvxWfo2qD5SZfsMA3XX L9Ex0MakveHyX3218EmnEsJt/Kvsn/2qBzLKdZ2VehgbN5TDNx0Dc7h2FEBo8q/oQgtbYGQS irxAri5aO/GpCrI1yaPboLbZDTLKHEGYb/4ZRVUInTozy4TpKWlRlRDw7Z4aPd7XhP7pk0oU Zd+pNeKgsrMkGEXbX7PPZzrNtDl+yNS+wnyA4CWUUFW0nl1OuKhMCF0tHQrN0LREOoadJegz v7CBo0MmRQ98dxZuXxMUp17J58FHxcfw38crjXluuHuOWJ5L/+ZfU1yL2Mj4s3gZwvLa7utH r9rmyDap8UFRmu+oxmxMWrP3h02mGOxyZK6ylM+Hh2J5xohGtUz3a7ZNyYWazhYwrbbjg+nG QyIcfLAoUeT66JCbiU6VMBbNy4XO4ND8rqLOaZoiurG6iStpF+EXv/jZZme6Ci41K9/DJMWA nvD7XXD8Ezee7mGrKt/HzEI4bU6zDQFE9Wsn8zB3XgqVi3YSP0eZowUl3fLnyu/8YBgVb4mf uqZn4jaVbVq1YaOXgb0d+8WIXcrf9kfX17jTEyb+4/oEej8PFerMO1RfQKK5+4ObGdcmEqR2 WnOXz6UohXb3LMl/MbRSwzbqPvIqKLeNBb/5qu4r4KQm21HfLOOxdtO/uYXT9ezhdmdTgM+8 8CBzfI8B111jowwlVM2N6O+yOdb8ReTWIlH+9ZcYHQvjfz5lqgdstfV29JiVQxTunhxsqhRt 2car2ETIVYPEjZzyO9eKWWqgN9bvoWpM1Lrxr9oETZte3K74u/uW92BZKVHQCXExzCtoi9Kr e/ZgxMJ5tt5vb1QSw+U1J97yz0pws5KHer6EkNNMcrCu7C5IKCVq/Xfw2xkRxax5T97iiU1b RPsvtSfyZhawskOYFvdYb4IcO48d/yZh+/PRyWk3qEBK9xetxrDHy/3DZQBTH0TVxORGYxvq nJKK0ytfdmNvXYiMJv29GtY1sbfyrAhRbzKjLVqtVG7d8Dq1P0zPNyPtxm/502pzMHlUYuYG E7JwLovpMXP/UfRVj7ctiL3MOCMjA3hwvr2L0RnJSryuDb3f/ChjICfXOCstTdUPI2/ktI+v eqhT2EkDkVuFDpwfxV/0yqiUwstr3rVwm3o7I8ijRYB1xsF0rinU/FLz4GHKiFA6YvXNYVvh GTonKB5EGee5m3wUdRD6yfrq+kdsk5KyFs7usb75nur6mJGFh4NO2ODxXA7MZLxdzynv20Bm qGJ7pOqR4ArmPGNsdGbUO/XXRzYf4o6u/Oe7YPE6D/AlzrQsZrNNwKFP0r52Bs0dzvGivav9 6VKmugdk4Yeob+LaWptwfxdn0n4r1WT4T93ubswk18vuvCL9b2Xlkgbvxf5xUbjw/Oh5bByX XxM03GhjEc/5MkmRNXA1tOKmvDyLI14uF5bNtaF/jzjJ8/vFvnu16DtsThxHr4Ge19pBitj0 15eliWONBxtl44PlUxISl+/P/YD6pr4PT+0vfa5BnK5mE3o96pkoarD+AG+vKdIk35hgOfYn t/JN32891/dCS7FA4vwcQRiO2hgfWhcevLHm9zuULPsVXyUj5dStfPB2RDCoy/vswZaayeTg 5cNEAHy0R/MvLJILqqUWKffVXiK/7sXWqCcvdGh9nr3r+YOBOwmrWvVwt9I6iELNYe43i6nt z0q/IlW3LwaWhT7Vc98I99Bw27yrfz9e20SRcLENm++lY1D70+hCukIe70QzqADhHID0hYqR t5msLycdXsiO8Xja+dEovdn0nr4hosC+RAmriyjB3nj76vLTQX9YaYikqw5LdwCx+fUGdKFI OoT/h+FWnH+EnJby3TSEqM+bslsBzlLReUYIH1mT0fEuz7IxdEx5/AdEjc+Gjhdxsil9oUnY 9+r3uf5PKt5hcrmhV6mbqk4HeCOT+OePrp8OJJgWdvS5jsKjjaJN1z+J4ga8wtyCx3OEbdK3 vAyLgSvPNX1csBvWes1FoWkO03oG5vrQtg6ecVOhO2dGOD5uqkbd6uWRxvCHvpYxW+EgwFQX epn845eQJsoLeQojMCs8OyHC/9eDn7WlDUoQBcOTP7EG74zS14x2lNrW1HD45KhkbefsDB5h gzgSIeG3/OfG364m8QqkP2VvYgUsoLUcL/0ffq+AWXNKGzoq5WWzIPja6wzipbwejsqXm44p 9dW9PscaIG8HngxPX4oFKaiJLJEUzjoqwfKEVu/549McT2TbfmsiepSxLubVXJqwr3biVdqN 7sPpjNZxbfszSEJJu2G59oskf2sqh9X3D6o/2ksYxAsvlOm55Rc3OkxbylVe9x7SSxpMZ+yH hUVQHlhftb5lByKxrwARhsqPde7E+5ski17q/o8izYV71pk3rrjyKZYIObXlre7vyFtLWdfL RO5FVzDd9dfwT9oDJbOkBLNZ5X2NUXgHZvpe4ju0tuTy/fl3yl0IUwYIyxL/6p0UPtarrhJW rZ0+0rc6yqOhjRpykZXTavASDY7LiNsX2Mxf7qi4QrCbjmBO7ozikUoswJp4hGfcChLZyT1q uy1jOlHjfvuv4/era7KJmc8QbCqVOX2Ty5pvLRd212xvVFg6tswkkKbCpcTVFH7XlrogqitB QgT7ocs+IGuT6EEZJIGttuuDBWNfdPmgqX/7mA4kqhsrFad64UFVMaIBdq8tkOFI85vPCeLE 8qbUknArz5Ask/+NfKsXmX4LmhsPJl/QFubo4376n8LIb2GfpWfvZOTGjVyKthNuTqqturrx RfIljWIKc5gjjMFSTAftmadHa/03vtX/Of6o99s8IT34p082nZY3u9RHxlVRW2u0PtIjde// RH1iQlql8tiv/Endi43rcFOBz4j56Aokra34gJpJitNE+xs2/JQLWLiDBJYfeIdc3Urmp/B1 rnExoZ9QpXQVrB/JscctXjqWhvfMcdEuoA+lZ8fr6YtP1l+N7Q08+x+YurY1GWnQKFjq1H9j k/s/1rf/PMnK3Za5+f/cc3L/jU1O6db/wCYnL6vwf21yCjdv/a/b5BDP7IU6y5ukDy+/2miX fEWcfp28NNO4OGO1oPTGjUyHz38C2Tg++/bqzqurd9sDK68437GI0RYGgDLInfBAssi2ypxP CzF4lgEHQjFROI/+18GwHxNN2mqYjN6nm3L5iFUHTCuqUe6he642gLwOXvq/vEvroc0KzIpc ST1Oj/iAUGie3SLWtPuI1bqErlUXDhOSj3BbOBS7j1jVM8cVt2byMz8HeHyF0A9666zdry2N W4t0KtJ5pn2fHn1d3eLJeWTzU3QwfaFjKuQ5rpfiuPr8aB3UcLFN7HuPHU2CNileD2p1pwiW OWXiZI7rRs6hDITD+CfTJVuz5nGva1QGOyjOJ0RnPnSuUlGuTQ09Huec65PdR6HXGCvFCrvS g5o3yIBQMONxPy/VnpLMEcR05oQJGldxaxFesmw2XPHlhrq0hozAdsfxS05MjuTNIX52V1Q1 lWupYOA6O+vZS2Ipq1lLuNI/IqvPUSQaJSkm1elkxCsG3nJuneOWTJeaZh39A1I+RyUhBSe7 3xk50QWXxQmiOcbiO94RyXkAkLtWHJDWxkJ1pblAZkIS+6SzaM9Psr6Ku7cMgCH7jA7cXW4i R+g9Nn8cyHW5Ip6KOVx5NtXL9aci1gURWMM3AGIJY7iaoxHCGEGZbqKH0Ngmt1qU+nAvp7Gk gvDCKEibRiDDImaOVRjsGpE6OHDmxKeHkganOlM5zIXeh7u9YVlouS9WLsYUooJhSW2kuCin 4QSPh8k/Tt6v9JGZ9oYP4B7UXEPRvTtABhkAaxh3Etelm4+Mg+mGZNzK7GEAU8RNus/SIPwd HBFod5qXyxbpim6jTDo/BuAgiAZDYAg3hpERrNkeHJqNTJcgZqagw3ornqJe47Ao8qrbJLjH beadpHq1E6/N/ezgnBw/ID4VxvyOng/fIHC+fUG7tfeQWJGDnKBYfXvRMflRSr3KwTCYIZAB wXCUzQ6UCG0uFZ2t66NoO6JaKW8p0ca4FPSfb5vmKvXedjvXs8a/cSgB2PH8YtfEoNxgyxuv 9bn78H9C22mLrFShXunPs+G1VvzQM2ztmhqtEB3Gq8xAoXrYKgsg5ibaftUtC5WA3lkrJHcc BBxsTAjxNzMIBoOUwLnB5dmswFfguJAd++w8spUcPB9Vm4NrR9XglOhtlEpqc9DJgQTb7NY0 mzA3JAIDAEIiigR+TrVoytzjvrTsxkptWBmuXHvISrWYK46ldlHXKTsmK5FZo3D3ObGxC1J+ nnMtNGpLSItNp/crRgjwF6fAGXPnOQEBXohyCh1Zuzygjabujzmghk7G0uiDOT9O96arfM0w Ps4NfjexckAgt6bYq/k6MAPwXGfLguygI20nguaMAqPWCrOW4a//rg41NDTY2/b1iaj57zO7 u2/P0agBhxieFqbbzDf1K4/SZRqJMnp7LtPGLjSvVOh79Z+o2uXIzXgoPLF8sTNeJP2hQAv/ xsQnzFwnVPzSYFSLSOvFufRxNDAVKUO31kP9pW2fJs04Q8lvF1/8sHCxTVHCOENGIJiHGSPS ylv5uL3yPgzY2RIlUFQL96+pTPD2SDyx0qavf44PPEY7sVENlyOJintZ6h7LvRTKROXyyg7V aWFOKYNBwJauvgO2UoDpJt0MwbTkalHkYTORFkEW1dSR4zfkyKn9N8uzaZG0d+RNrizajzZq A3kgE2GuFOmVGcPFx9cPZC5kZLQBgxi+hiJRjqnZC8yOIyl5lGlGACsdSTuyjxR1acmcZc6B w9ARqG6qO61wZ6cz8jRn6Pm28BjzZClEG+4IYgBgBzN2Lp8FM7NLSp1VsPml5AjJm4qZCDTS 0QBr2NFXKQ/3VlKhbPCc9fgvbogR3O19/fzZp6hJ2u7SdVtE8z9XuCEYDC8r8CkTO0sSRy+P 0nl2lr+sQGYAiT5EO9rvdHRzPTJQVseQ0xWCIGG0t5TrWShZ+Fs0SXDUS0q93n+J1d19HhjU uvZQIm5ARPOfSv5fraOSD8SDYQZ5WhQH7ZmYie+qYmL1weyA1pMY6lA3QpYuk4pkptovIMNo nrR92jJlZ81sD4lDLf6MTbedrme4xMw+x8a3PJCRK6HkaTObibgi8Fgk5Cmk2gk/T1s/A74I fLeaxYEeopGo1pvp6m+pk1p0G1QC7jY68NiJdir4aexpzYtY+LoTRo3mADIAmABz3EWpfNj4 5bhglagFZlWxVU5QaPDtkGAAKJiMrqWnDRLNJvZt3czYqS4KQax7nePGvPS/w1mpdEsZ+Av0 4VZT5dZMk4e+jTtVUGC+zY8EZgB7goVGXR5dEcegc603nsgIsJ5jNmfR4AV4Adbp9o3PxOjY 8QqnYf1oGjP11g7/7rMF6f6sHPgPlC+9hHIUaYxLo9OoTB1YNDGzZW6ZAwvEzO3fiQCHw678 1vYCH51AZsMmmi+GBjNi1kF4RgNAQiCtYLoaNcCVil78zHUTdzCIG6JwQWnRpCg2JFQ9UOw0 zCcSzP2fHAzuvwKznFeCQIBPZLN1uC+IyQNYGOYYwICva8hx3Od1uP8yfx9aux53tD9MiRdV ++l/kY0LEBbJJTrVyKRnoNFSOfgAxMdmIXPA2qoxHMk2KcaNCAaKbZBLqAVjZmlqa9Q/ikE3 9lQKvKBs1Pe9xnY4qyjq6z363T243+7+2vAz7Pbqr/edOq1BMkDN4JTgF2JxgGIGF7CQonlZ QgBElBusXRdoJJNtreENzOduuZFwDlBMEwA8px+PG2Obbuy7DVC+jkvL0kUiUH9RymgUpY8y kAVH57DFZzJAMECG1tqSZOlMCaGwKDG98PPnayhUWh76lnbwvRZuDdaESa5QNIq2uWhMrNhE xfRQBI7rUuhLPckVnvNDbG1zv+zrgYwhYeAF5ny94P37v8R+BDOFu97nZzeQub8L1AGIAaBi I2g8aoTB4Adym7ZxmEueIBZYNY/0DmjR9yYK4WzUUHIsZfi0tdPlR4WkAoNI0Ve4zQDcU3re 7ksLZMZX4Mc33j7lBgEpsa51Nsvoj3Yar7X0QtkhHSzcDIT8nXhmbqaWqVl1mkVnZ7BR1kGv 9M9TdS9QQsmz3/16SFsidHHOKMwz41YmLm6Bme+oDw2tTvkQvnPObzQO2C+Jbd+dByQUcs8d AEIZfgIZwV1AZuBFQDvdqpNLnXp0xEb26acIap8mLUutRJbe6ENcBHIHY5KlGcHZoPZwT3AU cxxM7Wmr+a/sK+f87ysBgIKcAufwGhqLwVEAf8AaOeRE8QQ66o2LkESyUQu2frRxlTRz5KCr yfDAo22TsUgu4uwP6PeQ6/e5p5iEomAp+rFzBpqQXs7qYJvBoJSlLH24zVDwzRBfhr+hQIbK 4HfB9wFWNA36LjmSaj9NvKRItVQIsjmdo8ODcEdUgTG8CYc6HqFktQHPqn+X1tBQYI4DrF3w jqsPWGVodY+6DLn7siVKA6N5CeQJzDjJZrMBF81DhWhfsUhb2o2DmHR11xx6DH/ICc+xaS9d aIz45Oh4jVcDcDZKwvfihRAloE545wrrzblMBpVuVTEB9sgpDnMZbjsGcOg/kFUwO0NACAAC 2KePEk/1yIeqX0pPhUfQXJf1F6AbSHuasSNtwJaBCXMqzY69wi5u4jDPk2b3l6ImOQkMIAxS 4fVsV5dGITtkNsai6WKrRhRkFXJJ4hHz4OmLVvEhPgYDAOuAF2NMAc2jxHNa6IOAR4pBkAga sf1EfyUrhR5fr46OkMu+7nu4TOrhN+BsgdS5WTe+Zjk9PQQfowm5ozGnaauCfRMSxnpJEm8D qAI0aQS3SNmGgDwZ1hnCaE70hUVoCQ27mNWJekBy66ZgyOdPQo499tB3xqA6DJrBLdvi3eD4 Sxc1/A1uJvRqADFZtU82zmG893qMQZB813+KNKYBmBASAQaeAwswgcHChUyVCGQ9up2W3LDi IgIdGUT2zaaRLVaRCnSoHQ1eRWtrS5Y+HU3amtwTp4rumlu4/RTiIQbq4eThdv/z/IP8xwXi hrui4947YVArR6WygaKNNaBqLrPpPPBe3kGhJNKOXrmUFUn7umT14jhJC80X2Es2XE5Opctl oGXgZcgbuRoaYi9aogBxc//FwZnHQ/W9cfzeO9dsBsMMjf2OdYpqSAhxxzokhlRUMpZKJSn0 pcKdYUKJQQslRqlICyppH0tFqcZSKSkiaSeSrL/p99/9477uOefzPJ/neZ/X69wzGJ8Hfnnw xk2Mh/XoypA1E9mAOolvgpugTAUiaAeGgpPYki1df0CCZLn+49nxEZVN73+d89WafJE+mzFl /KuyYG5nUMj9X4pFAiEWhVUNv873UFMnaxbBmkP43fPlNgpVpEL4I+Qy54xIOTnUw1oURAeG m3EUmD0Rq+aGXd3y/FR49/NNI3Pr/lbkpfj/VslNCR7cMhBiLeeq+62TIf1kBOXybCEmLgJ/ TNdEHXpWJNp4+lg3u8PJq0d6P9BYuQ2z4KQBYZw04SNfABzd8kKBDVW1l3ybDH1+w2VoTq+S OabyLOTp4nGb7rlujXsis4lVXagO6J9q6owvnxf7XKJFpTOGMYnel/nymRrNZ9sAJqg/qxpD MSupbe+0wvhMLhQ49fHyYu3ZvJX3b9X87JU5pSWnrH46px+EQihqN9F/1Q4yxnWSr2JItGbk UW4ccfj4y/fCwhTrRjRVWxwzPJx7M5wM7oKOC4DdABBzfKV+/Wz7cOOBnN6ZSz8aV+orzZgV hswfP/NHpTjEcWZb8tQrdPijYkNDjr5YC1m+f/rrzO0b0ZGo+Jvu3qPlhrcM8YGIFxtJLK0D 8Tg1ZQ2q2BZzRIMxAF2fPPH3/EzI3b1PleaYLnNrRuf+3B8kD5E6VdkL6BQHGYaawbueSCtd e1A+I4NZGq2pqI4sjrBCTfhspBpLgyB5t44H20dXV6fc+5zfmXShUP+pvuPs45kHj+buP2jI H4Y1VJEF+6cORPDPOl+iNh8TtGqvvuDaE93SGnyUj6ThtoftQM+AA3AzuQXmEjWM6HVaRdKk CWDPTOh7fWVs1mn/7NWaxU9zVpbUl6a8np6b33olhwjFw0byADMRVIQKnV9byvSgSrVEeeF8 cZiBZrJ5YEfDmVgu6Vnr4iIX94w49I707j4VPcnoVRQAeFFT3G8hzDlOqRzcfZ/OOQWncZqk +p6olAyeIEY9wa6alOY0pTaAgDSHEMr/tKgUCsCTbbAscSngzNkFjYEZIANCAJbjXFDP4oop q03JlwZzEG5z7w1fT5QqbOh3cwmq3TGw+rQ7myIQrDqvqSRT2nCf2SZBezNrACo6D+m7HzVF f5cSMTr3ynG2ZR6Jokmd3vSauUJ067/yqUdvrX9JqtreXnfisiWJ4I3DN9fyN1CngQawXio6 1Ezuw/NodXNoAgqBo+C6GVWC5FtJV4jZrOfQn+tFf8++LelanlSQx9GixjzBVhtEa4dCic8X qZC3Pw2eKgvt1f5ssim6/GhYAGmpXrMFFtPbvikTj4G7cL4ljinPuLwkIBw4lqwAbJ4LnAgq +6tO9kQl6lA0Ev4EWZN57Z8u67a/ctK0kC40rFCpOvN2nFI4T+KAdYpHgGm0CXPFDeKpZJjI gKhzZkDUkxvVP0yZ6K8RX6dfv3MUcEx78wuutTuOEETtKwY4oXf78rdUMniWsqTwCnp4R8FH sB8awWmpQjgKASevf81QK7Dp/Ss5ZU13W97fm7+2+DDIOesVwSmF4fi7rnp0k83P9TYzJo6l Krih/KUG82mnXZt+Af4uuwV8zFMeVfsfOFUQw5gYiJpPZ9VPC9OpVC5vwr7S9a3TsQM1Bqym I5zqeMZecvBBgyX7Jw8LkIX0l7Doogr/fkYiGNagbdOiIAXy5Z1aDsJTGvIQYj7AUmDrFAlg MMcr98820kCcuXotXmQfMRbwMCdpynZpwtP+VtUmpdRA85dYL4aHy1VLvcsTBecUmoAzYJ0c D4ahOGg+RMQMRn3r7puMKh6InlqnTXf8Lal6eO1UyWM2YMmaJBTofjkA/slKo/AQfhg2KT11 O0/rHEMWKMEAmzk1wPzdNHTYgSVX81Z8II1eUz9t/5i6v3/BuFI514K6AK6MfyQ5obv7PpJX n5quoVKgj2lTDSTzZDMlEKgAvHHsD05+qUN/d2/X75ql8/Y5BaVe/1pigu/iBcKwhnrN8Sw/ 5l6u+QLX64E6IFnEUsulVK3G7kiywIfCChUiMBT2QfCq92nEEwmRfHPHEQWR5Y4AWLT9Wklr OuULiG3B4WH4/THL1LBuojF0jHzGsC5e281gJUUuvgM/GbkFHsLRQdyO7t9CTHBOIp6J8J// tnrH6LkvYk5/UsFn/QL9yD1wFLN33GIVzlNloQF/8/BEpoIoT4M4j4hvUqKrSy7jf+wOXsVr vuSylX2lgj4p5tg3KVKa/ENZqpKNd+aPUZvscs/h8/S2ufIjpNewETQbHIGCvbv/nnjGKc3S 7+7s+0+PXlsq8ca7bUN6PkYZcG2UyNbiTkyV44VXxWmoqOFOPe3+3ODPa17g9yjZ8grdug9p RF+uKrh23Exbp9rZr1lFpFTsSPOQf79T5uzsXz/BHHa6s2klL3ImQsfp2KXGa/5DnND87/2j AopzQKAt9JpT+5bvu9GIX0p84Jwm8lYyXzD93YaZKtYYOyTYzcu45PLaUY8dQZ2LShG/FVww FOtGrMk69OODOWdgvDQgq1A7MnBicEccTCQG6omvSQhOgAd1qiVuKrAZNXkWxuN+/7C/GaFo /xVzwiYn2GGSIq00wdWLV3h/xK994lZeEDUrHVEKXHTOkBghqejrahTMkfCywAtPH3g6BX0V 1/+nRb8lTLTaN4sI0a+unws4Og5P/yiVbWiecYnWLV0XGYVUgKcb7uEgsbcAVCHHbs8eD25C +4gG2kQiy4WZf37ISByt1oMeScKRSDwjtJrXJRkg7kVwdzat4DEmWxxYOsoUVdjvhPkQ7QIZ 3PYQhKs3sk7BGYrGRlRrtJodCycpwCAunlOqpDkx8DkGkL5QxQ0SIe3AffPTZV9R5HbzjZ81 G5oNOINEowXXvlWteuPU5PaBkEV57II/t8LIn57ImzjlW1wLnTEkOseWtp6M0Q764Gx13DGs ZeL3SbwHOy3RPtiLYgRydCwjlcjLdgxMRixkUSll7QFKxRJAYKXuRpWpVnElqoLOzLxvVfmh 6XWsMAnDUk4lh+LtZ8t14QueaqtcffTDpogr3SIXRXCxt5ix3OywJbBPJfSdz3ENELzOwnsX v9ml8c7XmkG6jlSdOx036LpcEK++sHMZ9E1HNCZeGcEOVEFYqzP3/4qrEtlvyBVITXyubdtA 0dtF8/uTU/aqaMdDyr8GbCDrRDsai1uQLMk+Xld9XfDiCqFEh572TVqr7FPkb80/SzTuF2vF KBZmS7ZQEnhdL6oaNxzHkBbVFSvPrS/3EryzvKbONOJ58FXrlxwi4/Cz2evxpwKTMw6ZI1xT 35DJgc/s2uh71hzB6kNCM667cm11vXiHW9TC8ECWcXg8LKB4gfXUwe9xW9XotRTNXlvFEocd 1ns6fNWoRpeRHTaPfCxr5Xz8gSiH2W3UZqml3PY1W/icUNNG5djc1Ydczg7jBrgHW1YdN9xq ufPRJxp9QBT+2utcwsL+hiEiVTWtXNyd7m8WgUqfuuDhEwxK+DufV+eONjz/O7DVLbvJ1Nf+ xL06c5BTLYooRk3b26Kjs7Gkh+54c9UjOGGyBW8e3TFDK37RuvUFcWkeJHJeKY7YddDK7QOR qp5HWRRytBVjoHuaFwkNLIaeqjS/LMWLdE18D3WY8xbtufRYWVKuwGF4fgLWcfDnP/kZ1O1d vjmdSDbNAD8bjrR0KJvo9uVBCmPw+zcMA13QQPh0fRalQLP16poCWJRfj14vaf3IdWfHTq3w Qni5Wm2m9cCJTmKBprkF/uDG08g6e+6/BXQ/3ThZIQF0/54LSPPP7cwqXf1gTFwI1rhUUGUq b2u9+tLqJNXn2XjRIg//mk/c92qwUMBOHsOdcW67cCEM0SCa0GgQ7mNyzUEdz62/OuUjopwY WE2VpdkZJqGrRG6UxR5mhSEBmcLIHZ3lh/LPr0/6FQf3px939eD7MS1T8/QzRoBRYaCcCnPH Nf6sNmzHj7rWMY46+xTd1PFkvyu4pyzFHqQxbTq1VPeS29ZqaRGd1249/+Z9zLyPRxs0luV9 b0k8/v7vwGdxF9dCvFvwMK1ZUaxd44gsNaikmTCGdv1kxDDxeV6lKpqUrW+zj78KR3e7aBy6 GdvcE/7a9s6+EC1i3PNyFk2oSL2r9If0c0/8Upa3j6W4ZdXy6a6PXLt1t2ctG+UTOKEdRl69 3fXt8mL7RVMKay+XCpAfur6nvVnJKC31nKTKKvGLVvxva72xqAPgi8uddqUvDl534JUptHtb F16TNksWsbw/cr3yzycPfkbyj6ds9FXQvubahBda6dTZ9Illaqll/owy1rp0ijlrbMeZmmrt e4tvgvNp7gu6Gt0NXlvfKV95dmUfGjKCEURKm7U/dVRo9xb7XbdDjn4Qkm35vNvhnSu8GZWu N91PPckdw8DDxB03sGjA3r3dOSxIEK/iumCCnUv2W8Hr8stuOsvCpxrH42q3Nxswa4QMVa81 mE+NgZlM4PLd/OeVyq48j24LfphYZ+fR5twu5pBjol3Xm99rrdxwmdpiyC8SyS3taD/gl3I0 rEESYPyrpWOvS/ZsFB7MxP+aOZ3KWFz1AcvSbGnd6m/kreU1RSKoUeTFcmhPdOKmx7AG9df+ kwyl5jjOdv0gjsJMqDwz7HyLL8RULyi4Mf171vCdoFWJjVx7Kdg9lWF8wMKArpsnW/tusXqg qHf72fNiTujuwc96Tu+2GXlvocruUKNRyNlIwS7CKHUzY/mVHaZKAbL18QgMy+ecJyDcL88m JUO0SNPS1n8+erTCdns5ma6lRO83HsRPnhYaISzdnS/WzZ9+95GLxwFrB6KxUeOzGPW2W5F5 xpkDBmhuZ7rJB7zzUdZJh6RnS3x/vhscWaO4Zbq1w2fw8m1WOnorqOxjqQHifcJz2aY185TG PuEhPJW6X+5OO7kmGxpgXtUaIoPGTczoONfu24oNHxuSHcFn+dvIDPFlzuKduvf2/vV+5rAy teGufLeqdOCtUqeFIFqj1KsITqt2jcQ9uuuBW2O8jUy+svFxzo3JREMfy+ElvrdLmekoXyiz E2K8NELEHRac1nKnmijuklrkCx170HSvvpEz6Qf7L73UWJU+VPinotHdwWoJxzpIuCvcsl53 q2GrDUVEMunDO6NivOjKhuyytmunUnjxuI9FgDeqdMLOJKMGl4b+jEb4En/jgy743SceJB83 /ByVdLOKDOpaZq1/+E2vnbMqVJhue1di4GLUTptxkfjP72TiSOSTOTfCBNLnt6M4bgtpF59u ocRf4a7OCDSyNpk40qzmk0by4pQ+yb3WFV+gv7oHY3Palkrxln6GlYNwoihGLVpiwRpr6QjN Kg5ZL5ICJhmjm/z2RfgvA20oYShvLH+1iW+OnmNBcURv/vmbD8zeu5mIPftPbB3tWkotRKxU NeSvH6l6dY2HUC1kVhESjyIm6211/Oji5MGtD3qX+gb0oCJSRE3GlyV+2T9W8y763sgybYA/ EB83PHBMXBfe9cPXzQZb1h+QUFZES/vu/F2Lu7rcZLXRmsVUtpiieefq6KL4r+wr9IPuPTkI TttSWtI98661+ah8N1CARM+7sPFuS4DHpnbPj7Aw9Vyxc7TuxsPr0/f997WzbzJ+4/wowmiG N+9qsO18E1kCei7nUHHD2sXFoVMTxVH6/a0dvwYqCKKFrIxoCY4GX5+8Y2e1yySDMXEhs36n /pPdRkUOy/fzUhtWypmwoMTpILW5UPpQsWJl5ammXFJcXVRmobQOWXPojI6nXeLemJR7SXce m4l+88s3QTuYae7xkcwAt8dGpgW2tJjFlsGnXXP5kvmst/c2XSWIfp9Tee5uI2uG6YZpAUm8 8ssB6ZPvFnkrhTgMvjtyPXd6ZNmyP3tinAp36hO6u18RBe4mvPrMs6HChoGPHpDAEm/OupNZ 7AyLKMR2rz4tXcuJT053RQiBo0iLaQjwuSjlbD7ttHqTcGzgRPUnOH7z+c/9zqa5MeAMEJE5 llBZlbQhzzDo/vijpZUzGVffTkwGx+FE5GDrNWVqESvq4fnQ6RdXCRCo6aBO6bU6NO/NqsAo /eMDXJ7xr+/9lhQD+LE3NT0rfMnNx52+C0xZVHHh8pnB91/wtvujGPzrEyONL5mpP/c3S0Bc JvJZaxXreP+CsW8GocJbm3eHC0dssl3hMus5laziK1fKhJZ4dkTMdqlYQBCRlE9rl4cKv9s3 BuZacCJNXqXu+H7t4MbdQkAAgW3jbPtn3L48j5R8slC/aqCqnL6XV9B1qy80DY0QPqw+fYQU tuRmRXv2vhIpQlXlFWz4VjyNI1JxJS0KnCa9Fx/sba4E5/ZfGszmno3p1gggP+GU7tQmLaDg 5tOMcOcuuFXspinQ6Olrfz+AyQIMowAp875WOsAwQ3lajy2VUBmRiuT7o8UNTcauNrww4XT5 QTVaxCeN3/WwJny6Y21+f/iVJwBCZVPufPpRbYS/qPGIQ9O35JpvTCJS6OfpRv6478s4EcLk hwf9ia6wbKB++vXaBBBFpwELSUuoN0XL1Hc5y8pKXjJGsa2ZpL2RTDqFqArDrsB0UHAIAPrL M7J6F4shHRtJOuWYfdR52WhcP37epUt1AjuTIUv+uqKNL7VpMJE9uUQFGG18t1SRKouRSLFv DIRV9Gi8miBSbzT1jYiWiEjeB2RHKkzrYRJsAEXOONU5hrfgpgjvG5SQhTxKBrn+bjfTwnZP 2br5YxK2BElFTexWsfw0lgkO5v95Bs9XLacBU5WKvK8dH+7P+eg0/b7NAaYUskgVrswa19DJ rtQG/q9frz5vgkYhZ5wQGAGsll2cW79hwl2jZGLM7y0qBD2V5z0rGrh5Y2rbXnLSVyrW3INW dmI6W04SV82tKdrhOPiF2oMqwU0K5TNO6mYS8DkV+vnewCgrGWsp9Wwf6H50L55xl6MsQJaK iyK8KgQde/IqdFe12dOqPHlsRMSvAC1/h8s8COj62KQJScjIleW/QWoCYUHC7183d9UvHNdY HyYtdr5Cd+9IJ6QWSJWrW8vwCRfi55aBPagy6Ibt79r6tc6RrkhEYKqyQ8q46wcBhONSLp6X feQK/37c/gO/rlCywG5VrlZGrP6hfeJ94AFoED4yvHXuv6rrixz2zuuTbnkvU7qTMGvFxy65 Rhq2NfE/1ZadH9733hFP3E2ETViZz1i0I65bJnXYSynl89hEKUmeE9M7D6pXIyq9CkTBFt8S h7CNUjkuLbXbc6QlNF4W8TK1IY207eOjLwWSlLZCNfjgAnZsimy502d2XGDC9GS8K5zyy589 PNHWCONMBYICnb1nq5DUC9oFUFvhEVKdobk2OAjD4LW5FV1B8/Tu7ic5EOljHoublBxmf/cl jeLs4jIGYnImBF8kLd+i9dcy+f64k/lfeAZ2qddkA49MmuA36th+FJFCCM7xb5FTyux0oblD grIVkT6gj2Dew4yAmLnLu0ELDALzXLwljzQgn+Jnk+O7ltDMz04HNsB4uUrVE2eAhHH610xz x73jWVyEzk8R4qiYdkLMzx87Mgn+FPayiDDp53AVcmW0xGApO/FvdTNsrmJpyN0jfNdOkD1v nM7Rd0o2UlTRc0o8zeU9RxN6z8fg/vx4ey9x5svHQ1LgvxwXMz8dazVK625eoEhqlfGsLBrN dx6BBsCnfweWzA69CklJilRU0V+uhrDoMJKjV68kJsO4TxmgcrGXAMNteQBPmpdsVi2UriPu itbtAZo+K5oU3JkONIM31kya6o+kq+j9u3109u6+iU+Oek77uQiVVIMBzmgFFt+QIeixr+Xk ubP5je5XL/qtjcepm2ScXvJAU335oWcD3nxNTpfyy6yfI1fuN8z++dFzd5/Hy57b/5EUcFCR 0ByD5VLU7fr++Cwdtw4pN0pfUsgIYLIPe/NXnkYgV4j5JgUA3t6MnRpfGHxjJ05RKq+Li/pK 95I2pGUM3wrtLdstUM/UwbkJhk9+m3h8hOT1K1xFONRK0OEh6fPGX9hHdMMaKl4l7ABjOkQc o357jwOie+4kGl4+eSNalRhHdFZuUIPAOjAt7aL6imiGouiggLXC6uSHF6ttZK1wC/b59hdN 9XAd9iU2+FAh+eo9JAEsmzZKhHrxju9fXQ7+2PDq3/2xbB2AiEFzqpIM7bqE5NBZqy9pWaQl TuxuRgbIPNFCaMlZ6RP3kC1NEg7hDWAqxeuhbzYB+Hcc9/XLo2auwg+oDtQP+yssvrO3sA94 +DyW0lzU4u0r8SA2VZ/296kyOr0knio1uvkQSsPsQK3xxx9XHF+08Q7y9cMD+QOOMKjSS43I NU/4aOxfX6iDK1qa12i+uQ5lG9DGzOxohdJrcIJjrnI2UyeAGCnxhaWzn56/tkuZbRBRCBqs jBuYNqBOxCuH3ue/yv7eqrSK0rp5N6NHupsPEb245vwXKU1/2WZAVYzG9uTiuUXmRThlCp5C jRIsXgRCEigtLdaDjvPXR/DO1QkmFlSmeEm92pMcN5vhpYp4nm4WlT8ScsoeYKcMtm4N2vKs CFTTeHYKR6ETKFR+iitleB56qA58hFaHTOeceKg6AK9Y6KTBFFuAqeB2lQetVAQ1jUkGAduk L50t+aa+RbaCFN9Tdit1iJQhZap+TF8l2vutsMM0nJtxwLlfGDSOa1PCSA034z8HvVxhaLdK iejCxmrZB1LJYOZwBlAwNzESXpNNIylQqLpSZozAslkzDieBVihV78xI4Pd4x3LS0EJSO7hK Z6tT0N/qIfxjb2kCNV5ABKtuI70T1TdvnqkdzNb9J0EcgagScSq8EyDKlNg64l+oFFC5Gb5R msB/eND1gCBgG8Kub2/JcSMeKUBT5W1PS8j7S1CRlaHSNsP0Rrv/nyyh4zPUBPC0YSjuSkm4 iLgVvKHY5YSEn796UDCEP0ag8Tyke5vODi8e6RkJ9/h3we9Qb30qoWr4o6yvEQPvCh7itwwa h0rvE3UULGNwF9XC7knlEZA9hPcei19g13HVaFec3I4yvjxv0ybO+32vT9cCbKtS5hyDpv78 dJKwqf5ihirHQOMXPi17WCtGi+Cni54tYPZlTQm0TLhuW465J5s7Sw6QqCqWDNke5OWM53c2 C6j676de0D65mc+zqT5Uf8ypN2wQa1a9YhvHn9tYCpEIgXoFLxKQW/JvdP37K8nclPgrnKZ6 quWG4kJThMZ1CESBkq22ICj90XM77vu7u+lswEzHwFSmzV7bG/ZDKuNsrNl3nic4RtqijlOF cknnOMnmtwRXZIVi5Yb3N9czmlwjuNhKwRgEgfvL/kCA/X8/ZNdjP10OBvFaWlTCrYLlVMib TFV1X1AQ5MRncGOFR0jjup3gKq6aL+/fiopJcT5pT1E8eILWei/20fj37rgd7++FP3oWPIZ/ SCKq9qnE6TIhqe7+w7fAbwzPRP7vC5qtSme0WRYct2TvZzX3zLYExUrHZtLZvuzSh6o9C8IO BxYg46lbr/s6ttnX7uy+Ff9VI2j9jeju2iTCHcEyXB40LVjIAUIbZ04vbKVUr0d7vuhvpuM6 5jsd4KM+iJyfMwn5MyEH/rhKjy08abPzw5s7iaPHFq6/Ua9dsERiw38cueKDBwp4Y028q0JU 4eoaw22bhcZH9CstOQvsdc+7P1+cpgGIAEcZ2/Tlc6fRkF6+4r9hM6m5FhBpei2OK8CMDngp nNCgMwoyL7fbmRQo/612MOWjzZcMwqFoenCYQ6SrFFbxwfSHSmzeGFBh/BeKkRX/YbPoyr7x b8cmOBuv7zrjitu+ZkVFgrUFH+y7sLpSe7cw80nOCwvQF+ldo2qGa9fRswcCP/kdv7er8cDv GuuorjpVNo+esQSZj7gfERFu77EQBvQiWnxXRoOgLoStmMyn0nQCyW2Fi7yxa7wT9ddAdEVS RDzA77kVv/3VB31EwJ5QqBbwoFHYJKu2wBX/PpQ6YbELd2uLFY4x1AzLMW0AlifW/PjcbR1A LJStFMLZhMC4txMd9BJi4O093303TJAZRLJzBOovhdQCXfkamneBPHkdTiNvVsLlkpLL2fVt /W9NARqFeqpvy3+71i0ZedGmtP9ppcsmE3QTUqtAIAKg0wzjWANQJJWiONeBQ4DQHMCCXGP0 IPAphUYpC7Y2Gx0JsOSI9VfZYC2Wy5IxmnGUlqwIPa/wWpnVAbbj05br/2XP1eG3L50DNYDU Bk0qni+qsjpsNYvEmWtN/FivSNhcmiIXozPzmbd38kUazUi3tOa7h4tBrcohNovHfweIUqus mbmdVGcmrw7czgz624f+wGsNPPL5LxTKVncLuVdHiPceJk3BfGgXjmlK3FqqTNpKyNh/bO0c 5q//UsVpukrrB3Ia7YCPKUV56oaecc1dBg/hNxvpNDNliFNt2ekltlW3jpIaigIj4VSbTx6a X/eVR4WDCozieSGoF0ApWLxNgRQyfMo9F69374e9O+6qUJBGOrcq2bzQ3Gw3pOe1eRnnm6Kv 9dyDkx3igqM0HZguVjNaH4BEanp6kbTcF+yFoXolRCfw8wZePG7izsX3w7FtbgeLJEtoWZnk AxFQNlG9n6nVQQKIUINkWCEOv2apxKPKS20FycltMabb2KR0cT8lgClzSzbvWTR9+3y410ED izRu5RRsYUr0FtemXlC//8KYjZDN2RN+B/Gwc6D/Cpltno4BlWrD75M+Hsdd9xZ7KenYWab3 t6YajdxNt332No3lNOPoVwH2mFa9KxWSJJZmNaOWmthjXus3o+u4s7FmOv0dtvs4fsgIk4+m UOclAWeIJEMIttKSaBeQKEaHDRtg7dvs+p/qnh9GloDuT74F3DIylYJGNb78ZZx62O2PhwBb R6/ajDHaju1vjMirSHNVNVcCoDicWTFZq5CfT/LTE9om5dHk9Nzsww62NOl1BC+4yDMzt3DX LtwEQjBsyI48fOgeYpfKc1AbvVrkqo84UO9Ks+oEzfBL58BcfbPMZ2Xe7KA2za3M/7Fw7fFM f//ftrfZ5LLMLZfMbeS6mesS2xDVcksuRablkuTjHl20zSW55M6EsCQikVKEJnInktJFVC6T yiUqob7v9fv9xxvvxzmv1+t5O2cPIl7ljfSBCywiFgOs0qlAyC5hNb2ME06B8BpMfWrAmJp5 t2OpCFPKQfCwiaMP60a+Enp+lw9UW+KBAaQ77l5f9bWi9+Yc0keWIyGJhJIhCWhCU/cuqbRF 3aCXCjPnc5SsCDExJaWZSNmxA2Xeupp+OmXc/XBDYgj36SVBKM+agsOg3NuVfQqQrrkJmgeo dREr9LKCFp7KmCL9tQbJCldtpazhiNUsIukKl0eo3Sud1RDogUrbSaLYe/iO6wDWskIl/p2G JltAyKk+3zMqlR6JMCM/Fww4xsDlZ59lAnSgInka0BnfoxfDsuSgk47R/N4JcPwqnokgwqsg g8gh7+aw07tmuuOR4xT3L7IHFh297DFUknzfTW+UYxyUyfxACrrztxxhh78XVoV5J68rytU3 xrVn2YnmRKVG1lTmIR3Vgo+zEBBzTVlyFsCNl+42EOmhnxVYhmTum9Z19RtF/NXqIF2IDHh1 bAcu9wLrgNsdDWqd5AodiX7XHuIzBGipY8eUB5EBNlfNE0hXWAJxCECFBCFJJyHqHrjXy+IQ 51VzmTOdQJiw1Njs/TN2J1St9wUdVBDXxmBmt9Fw3lyuQH/QtYuZJfELfnAoC+zyIS3LH3KD 07vQjh6Gq2JjOPIqdBkdhEt6KXU0n0F79vQUNOJjYc09oVl4GJbtvF6vooHDMnruRWViOVla ann3mB/1qanSInK6OjEUBmXz6qZpi0pMdu7aMAZDxc2s0DkkmXBwZDJgSYFsjIlH3UmEeFxT 3FbHz99Gx4of9wr/1qOUDgBPoz4opO/yyCoiwalrdRxKIPjMNN2xcdtRdunxOwGvDETCvvuP nJg56DqATgSp4aVhf/pE20/SFcLFta4wlmXb5rrM771tK6bhUZlXznWb5ssF+EFTc4CYD3LY SoIrk8XWzftachMd+d9dg2spwYxep9P2IcDuLn9puMul32bPLXaJAiM7kpwthW9m9e06cdJ+ OA3J+uAsGf/WkVu6OrrEkfpltPn1M5yNdulKnj1Rw/s4sytDSTuMVShZejRjFL6XxgroySqT f5ym735ZnH8KIiJZHLMP+2tp3uSrUqECuiVlA5gpokVj7YJeB0RvkMPmk88HoCqnAamRHd/Q VOYm205U0h89N6ZMZ2G05KqtinXc0uPt9b3ey9ggOotK0WheU+SFM5kvk4cC7IcvI5Mgf5gd BT11uHcped/HEpll7KmnWXhyvZfmBpCr2vOSbi4yyN03yl1CuQ+9VJj/G4ySHQBG1SzzcO3I VKnXyBNR5vejRO2ElFXPd3NJnlPSy/aiA8gKSsTeMFa3iu1bdQ3ZNCT8/d3cKGYTaLXYwev1 CwauwETZNIZyGnsGKytxPZKK21qhY4kdVrwwLBcyMwRYUUpfmDq7KSZzCCZ9/h6qGr9WZFI6 /367SXLvRVIjEp9MC6IVGi9AzUo8NfrNMQpweBybtm+6W5OoKhwRWlJqQHvTB1QPiwS1Wm1u JDYpEaJP22IRsAqnrGit6W4D7LgKSzUT3PozJFGZeAaWM5fht+IZSAOVihqBRThpoZOkT7YD HyLC/Fn2jQ9SwhDxfiuibHwjZPQGivMFY1lBZUBGm4u4BTQAcWKszFCDHbiOp7NgUQKKY91F yMT6tmOFj5hwLE+H+P3xsk5jqR3p130UpyZTiXA40J/1YfBamwr/1HrNDK3mDOMpsl4InEnt 2CF10YEUUWGTdLcPCMD+LMLcX2Z0wyEG7Su5SuFYWdrMDyW3CdJB++ECZNcEZXwIkMXlfkfe S8m56dydbddqOBz8Y/XmYcQLcfZH7q1TJv9ZFXiyaVoz4J78Io1dOx/rb53bCp0RkwX+ARAv wq7gELD23klDJ4Qyz0ZWHl+o0LjFj/fDmtZmaSt0p7N9KZ0HsfqW3vzDZ/bZ9foiZEtoedBy 389MZE1CiFl/uhnaZeDt/OVb8pU4co7SgXL4+9a/PX4r+kRXtd1dF1KlfI7vkuHoWPuvCoyq aGTUq4D13rHncaUw06eA1Azv2u2Rt4hOkj15Zh3vz3r3BPZYm0DO5g2sp+TjHULm3odlKqEF iZP4nQEXj4FqPNoHKKFHduw8XpgyVGl64XBs6kXvm/L4RzI2Jly50K+M+Zy+dJsq5i21+t50 qWarhlPv9S7GxJMUtI9YmdQtzx0E0/Rkk/ybQ7Z59oGYAnxtvhwiq9NFeeAGvAjZ7O59By+i NgjO1Rd3yAp9c6N5Mq2gxaCZuRdb+oK7iali9k4DVSjfEyyxFTrh5OuhixHxpCFA+0BszfcJ 9uA2UZgZ2nq9fg/W2uzityeGwk5ROUqFB/uj/lRfl2fHjhSE9qZHtpkQwnz4ye3WCv2QOjHu +jb9Yu8W3kCqe9PWsxqD9tW+9DU14mhsnOsfh+vylXRW8bkfiqb3js90u7aFPtpK4IcMLbpN JBhTJIurZDhUOLVwptszsBSNCGTTzHrSJ4Q5BK19LZrr9fY/Twp6S06QLiP9HGKDBOWbthxS ULKZSKy2Ea4cdYNAfrT89eZ1XHtET7pXW8jQTDfxdTTXZkRU5DirKlvpUVhmVqf6yA7N4Sbe gEC2W2xRE1N638eqTKWOMt81DmHNVmZlsXpz5I/1WSEDRGdXJiVwqnS/KK1kqi8yVeqy6YXL yC5Lmpx/qq1kcej9yy8643bKA3I3wKB9FR36WwKtk8tLtZOYvJPNdwU02ksbf7iH98Vrj5jK M93D1G8r9Ilv3yW9c60wIJVRp8BiBbUsb74iGjD709PmohxmHk0Hl5Ij/JKnu6eHDRBOx/Lp +z1jg0RK+5SH+4AcOZo9jUNYZmctzwHr7iMl3m0uNv78n3e9emDHLm3gDaTk35nUO2xP02C/ p3yyqxFr2hz/OJXBByzbeWRHvtLRoq9fx8wAKJpauDmuBJomeRV7b23r+RV6h/L1AmRQjV21 lYf90vkjbBr5JxLEe0PM+udb8hn1HM+s6DfsqWuzgJ6la+Os3aSbMo4UOLWMngb6bWNTOQTV CfbrGCdddDmsIhPpEjilHHEpFWkxP5/LMR55tkNqDHIoX2kBchX0PSLsvtRlH4VDFCzX3Wmd naWOKo4ps33zCsdMGUpNvqIFwHHtEj3pW+s3jDUeRn/TCWM13X3BSBkSuZzAd1y8FbrVe65U SMyYqAubC04Qo/jon3gefJgyjiWi1S9rUzGQD9M34LXHorAB9Qsoy2RU0uA02NtDepazHILV eMv5+STqUpQBJecl5Vf33GQV5dePwWpK0vOZ7r4KhbUNHhxcQEzS6GSp6dY9HFmyeNcccMog 9Gy+2s6kVAQTQg3RQzhxTpFuWUXATNtXn1kcRVSPlbk10s8fvQEHu1HK3O053AX0740NWqxV fHubuDqaHpsXKdRwM9+afwFTXA7HlqCtsSHr9S+uqZpfQfUU0Hb0piuezpML2ffRPqnSl+Wr YTnrDCtO9broFAG7ARn1Nn6t3DiqSvy0Ql/Den5p2A715f/50/dvfL//1kI/3By/i38f/ef6 CP9ikT9KWIefj6wR1li28Xp9yJGRbnHTZpzrJXBx5x/e8mHtylM6d3oDOAN+/wXVUw5/Wftp h9TRxg+pyZ5JK3lf0aUFLaZD5ym68SUWsdG2ob/9HXbuabGtYvYbuEac16sSO+1Zkjz0C68+ QbvrjmXXvGAQyCbVYmcOE9ABJzEyxU1uGsS474Kv7d51jyQ4ReyNSp1s3VcAtiqxIeITmO5y wqB0ViuoWFet/eORyZDRrXM3SA+RGuwK6hSHkOb67GJGE9NX17JxPT9tYQsYfddc3NaPAdFS /O218CP+Ze/zItLQ7fD1eim/pauWGmdg/Qdja9SIn6iO9A9MhxkUwhmmZ2m81HW7aBvRgIw1 qlvlEBTjNR9HKvfVag5OkOJ4qf3pka3F/cvNCtDbVMcspY1fhUMFfycebI5761m+1L4rgXWP XaHrEQnSQSAimciKgxFd8ZoHI2a5FmZDCmNloscU5SCSfCDpqK7XQ5xhmxt7H+o2rErEgXJ3 gI/sBlbcLXmwRx71rVvFhxFgvC3YuV4/5Awj+D33+fvuCFYTbLllJHysDKSlDo+XPlzJ3V1v V9lZ9z9wte6IRSZSwPm2BtENsrBnnoyrMo6B1HKGbbmBXaxxC7DBgkP9lUNwLHSsYoofUDHK EHZyZWNOK6y/LCglBINq9wQ4pGLpKlHcjlcnZ0VbVluRA0kOdzavoKbKfDc3iJOpr1twzRBX +PFF1C2rUO4qrx59c1ZGkxhH319hG1HhFDtg459oHRbPv57lEJhIzwi/nt17WvPl4X92gZEO NFh57rFfhgYXDv4rlM44R57HBdnB+MuEl/QrW0SELxTkG+koxVlLj37AKcJvMfaKVLH5Hv2P qyaLPPeRfrf/sP2Adx8lR50/yz7UY23GfFECv17Zc9Rn0hYxza+j9sDQ6Yv229BBb+tPPRPA lsru2o3QINCO2EnIo4v2XFgZH6GkR32C28s0o3wLW0/FSk8IsKfevvnsqIHlbd1TueWc8oI7 2p2+k/1C4Mous8MaRnWBYz/rSTypJ3LX5xxsEDkFmFyl3Zf9VkDqfK9pr312I1hirOxvD3vd +53W760HnhF71S/PORSbzlJymmwu/a3tA8ANu9VOtngNIVORWKwRqnO+GJn4IOKTNocvbbty leT5szgc8K1ZiY9BcEPNG/eySqp9+AXphd/5cxrEAPsf5sNGCm55XYqBy5YmPgqWaUwamjZr L8zgAxpnco5457Qfa2iF/kkJt6UvLTi4WnnVslCI6lBi/m2s7Cm0+grfMFJyQDneHfp54Mn6 ySylR97gBgtW6AuxwoPTstnHN9hul+CqauEwXWqIcrWY7nZ0C1NtebT78ftuxrzRPZSeXSQv BE/7zCHEiR5rVYkj6UjIcAhNqJkJonJflQ+r5EJJaeBU+7N7OJBWRNsuaH9MfidqaCdayaOC CZu6tN5/IpwlzF+vLIn9f6oWItBqpWH/TH9K59QXNDUJ+eeVkYZp9gyQiXS9IPNg2/rPtA/G t6cf4BAnPq4aUXIO6VpGkdQuR3INZwEL1xc7GpvkA3xZC0+vhILp/RPi+/rfNP/l2+WGS2sL kx/YWQ6mFQB1ScGsHYYu9mDr40HNiGg8F+YjxuQCoK77QndoU1SXG2S+qGzV3Vuhm9Q6F70v wOBnKsXR/DuwoMwi2mPXSwbYjIYaVeD43/FfE6R5nVM/xF57vATf/HEVnN9brxtezfwD/dHY L6X96b5YxR+FClBR0BkfmgYO9AAXz+dJP5lmZ/Xwp72mt/+VCQGsTu7i2P6tts98BbjxpvnD 4i0KjcHnGaN3vb4bEbr/SPr+nObf5VvyAXlymm6XYrstyE6Knz+9IypcdnNTbD6zMbtmDYYL KLq4vgKiL3FGyEoKCuNLXPPku5lQ0KCNUy3GVujLOqcUtYUpOeeivjFQN0C2T2wCX+nHsg4k Ndtp9PMXdTVBqE0LBFMVJF9JPhqd/1OQ/9kF8E15D4rf/vmpatB+wsbflJ5q9j35Bbdln2g5 JUfPaNjvW3OJjckwk3+q9KWn3dRVzatcz9rDfy5vToXvrMVGCp5fWd54cKcwDMobmTVj5sDP Xyt9uvI0PZDP7sny91aUbPgKd0iD+P3UdV4qoV2TkYYKOMHqCDevUJsFsiU5ESMFTlTi6qkj /NUkthX2rwiCYCiHC4f+PklnaYBrP1bOByWtb6bblHb2mBBV/DXjZKPDlBn5TJFLQamWZWK9 ip3Eo033n4+aa2pTg0sTkRijOnFnGNg+MHCotIb2X9kVs04s0GBTCWbC8UouSSu9qmAZtDtV ABV+F9z/WzKIbpDDympaVtBtSmI3tr6XJ2h6P87pNeCN9OHVM9SiRgps4nSamRL8X+f89/Vu DIzGmFn1VbP88ctHjzhahHaMTpL1Nu5yv/q3sok5zdVqREk7w5p4qfsl8tlcG/+8rohPv2/D meR/QlQrb5GwmN0E9qKQsm3tj3cfxlHV0o9DcFW8msGjuhRmwISJ25yaeQN2IR5mVEeJ4lDl vqHoHlCnXjBAnWor6V96ogAlB5b2IPOosalPrGDql70i/EQy5DuBSA5Bv85hKXifjX/YvuMg vyigwkxArwibBstH3LmGT0Y1gx7wC7GzOhwBYN1frtCr3UB8oxC/bJ/wR2Ug7Sj5lesE1wBV jFfuC9fie8GUDroUFJRNj/RdmUVgn6TPZN/cGBuk1lGnu68omqmZQbqS74LONOshYelfrgrZ nJYAg4F08eu7oGbr7Xv3+ltvwmEEtYQ3IKNwwlPVOsZJ7bIQwunsK9LxL78v8UPW0qUxEK92 EuE1vM2n/WDfwhdBy0jN+pXdmH6wIuXF0F179csj1J3W/lGL74KpdcYK7jNUx/+WrvpX87Wt Ox6p53Xb5RJWm6j6cfWfKzQCzVuVFlCRjowubyW0V0rv/NVsgK7RIrS3FyH5/1zNENf+33M7 cydsQJYcSMrMvOC20s/wqwU04Zlu+52fkBVVvIGrY5Y1v//sluEEGcesa4yIGu4XlfyXacLX DMJZh7q1zUDGyTltPrWBYJq6uvSBEpBnHUjbziFMnrXHcUEs2J4AaV47+EPYRckJbhiddQqU ztigTNlUvs8jTnfDk4fiP6NgFHAkpYTv8yXu+vuhmV/NPPh+WMWoNjFuVBtPP3/9CtK41rsf TXVT1j9h3vOBMqkhm9SHYBqgyzkEvrmx0JvbdovqKFVstotDcLujMabcj6QGTk3+nc1s+LKl 4CC/a3KfWH0a3WYtqzNDLuNzhsKJAUV6M+SOmOjlbh48TxQN7mvuBjFnGhgCrI5466WjAuis bBXrmNzdXeIV1klZK3QZcOGS2W7HDnUAYGn+EKuY+eb9vz85Jw21gHnMBLRRBPLT8g6L7RMk UT5U6s6EexxTUkbx2SDvhrLMcslOLrDxmV2qxveDGtnolgNDd8X4W07BtbUZ8gHmMt2tp3cb NbNITlrxsElacTSv6AyDRomWElf1QRcUJ4TjEt+Q1uu35Y8WTaUVHb30vkz/4tr4brUN4AMw mh6gnMNPSDWFvru9xwYAousLfrVBy3Stb9sCe+pm5IIJC9moojG+bd9Hs0w1PXy78z5Rcw30 u2c34KDH674A9Wd9KM17xDxc7eoWxrre7aF4VRgbHaf3/Gb6xcEETfFC0z3JnQuvEmJYD906 H//3cLdBuNsc32Ae0CEemtCoNMz2fnx2/UlTllo9yMSAdxwXo7w/VWrGrN0Z356yF6spyj5r P7xDvEnePZUnYvno02vdIHSxMtqc8YLxDV1kwVQBdc6C9oYPGDOgIh4JBQVEp97lP3EhvpNf i1q4OZsWbjLMBYpvwH/7Q82uP7H2l3aJ6CqghQb0KaPA2lo2TnMIJdpm7aK9yMAETa/YIFM7 NX6ROyaapcIjx0TBziTjgx9Ylgsz9Vbo802RF9MvlmCeIf8EoorJkQiq4w6cV7FR9vfFhSgN vx9acQLVVoLomhkL8u3NccPLQ55gugvic2Im3jMSJlXF3Lte/y+zzb0EQ3QP/E5bnTBzHl18 kgYOfvXV8Bx/FbT7Nh8bviXP7kvXZfJVMO34NOROVTPzn1dgnHs4cNEzgbv6b4vCdw3Ah+53 HpzTmmzh4xGzA5er97x3FlCafHwB3ZWcgfZsjYDwtbkx2sXGhNtHMm9GbQCF1KI/Gf3pun/0 HNZ2WyM661VAgg2MW1sqOeXL8jrnyzW0k9Cg4jzW6/VLFvjtHm87/HTeK5AWkGFtUveOXWof sfcFFrS1dihr0GvyyW3WoXgKr74Bjr1dg3/+KwNyjtJbOhWX3lCzYO3fdn6dYJ+ne4M3UKvY B+gRs3c8eGsCihecmlI01YPfod0c77fy9sxig93mx8PNdAU87o/9R+t01875yTaxQDSYKwZb imv7JkgT7iNFqVJeA3DqZCJk1PIcaO8W9KURX9lZWaZ7CqYqCWQNKxPvnGYmx9AxVWpMlN3M o37f8rxi2fuO+zMEVmY4bEH7HfvE3yMOadGC5vvL0I6aLtHNey+hlAFZAiZIHuelxX+Mh5ZN w8tPkeYGHnwdv+8/CdGW8CaRor//8HIqPUocKahzCOme6e5CQK756Wap1pu7vNfOCl94skMq C91yfivqOT/K3+IQhNBVkEw1Y9BMqH0Tzs6SzwjARMIu1bu5vLx+oTWHn0GSYBVfzSAJl37N RbZKEc55cUkRsC8KPs6YZNUN+l93A/9rufCzAdg7+0V7LMh6lq65/KTrRBYRkXTJwArKiaoF l5bb7h5BU63sHY+z0OG2YAdc+mXuHBIBIAZ74w8GY1wRZbYbzLP3TmZGbwqC3Kmd+uK7agep HHoZcbrSOhuaAnc2yciH/5a+eUeE3Qim05GEDhXsNqEcYdT2z/aQU7AodqScaKXOmv9DpkVK Z68FJKXTmW+/fQbfzv+O0jLtHOSsC76AJ1tpPW+pe8ZYWnj1+JDy/nylhRPPnPSSZX/9ODqv olPJWFO2jv+y8znha/YWJQ3+Owy2jlfvwLffWvRkBrsryMJ1FKZcyaJSaupP8m1OC3jBejOW o6VsA9mlDZvsEhpRDSEhAoxkckxRVZiTir2VAn3TOVglb2fUARgSfZ6lhue7h0TD03P91bLu jz/466I8XFEzdikvMx0eK6vcG+QcywJBthDEfeodgEo6VCEtRnsl+4E0jhc5kpNeYtEd7FQV 2YnD7dTCmQxnIsV6CnzVlff7s3yctuNpceqdAjeqPNRSC3yMFIbllK8zQ/Y/dcdNUXE1W12h FyiCdtsodg93yNLmGLeyD/hFPzJ9oCOd5CySapNueAYm6gzTIoavhozrbT5VuwySjDWpXDZD eORIheDTWKdzkZhl2CcuSYw5TOn5nDELnBmxOWtj41/nAL6eM9ivfwA3nCNtZxtzusz0oGg3 g3mF76b3Syi9iIEqat/9jmwxdGz8L3/xLY6RrXV8gaQLv3tl5Wkc5gzsNp/JvFLfLl/9gHcc 2kZxfBiQsKIAZSJDjjjlIk/U9Mx0E99ED/uymEGfTPOEoo+LntnGFewNJpv3uBhfaagMCb2G 8WHd8SnB3BabCF+vJ3cpLM/5imCMRNQ5rY6a+lGp9wrv+bVU2on7PLU5kXTYBEO36R1JAE3g ev32r+9+3DWAxwLw48dQ9rX7bQfG7fvQaU2RCm/6thFlFYHDiHF3pz4gn4OasfBnGTeIrTVo wa+eRXa0z6rBqlEhL13GSSTMI/j1ZpYftm6e4s8q+0IceHpQdljOCe8V5oWGDVyF26LeICHQ 63FPGaAb0YJVDAEdslFJp07hUM1JJx5zszpw/6UqwgoMNzFBS5fqyFBWppNjAmmLMV+wt4r5 34USGgLkKmH4NEAYLbt7XefB6cne7arwBH/poVPiyOqnHxEZO1miKAkBQA7NReskiv8z6wYH 1n4eZDEXHbVri3yrrOaM/aMm4YOy0nBU6lOpf5+f5vCoMSXgNEqnXJGE6Uj3v8ejYW9NDcnE SIBjQTbOeCdwjYEHV+PkRZaCDgEpRl9Qd/TpmMyb98PT0ks+ljVSxdV1zq+qMRh4Jotxvi6p EmPQ/vjx/kiwY4m4KVk9I5HOnRKZOzVvWatYQlAYFdLu16d7xUvMCQ6lGPcW7cpmph/WVCIq 1WT+Sj2h/SM547gAhJnBdEGwiPPbrYGbczukJYAzRno1LNr2Wkwz5CxEptij5eClC0I0xqfE j0ISCW+iow+GAH1wAcgnyhrgrJ1VSnOqxVBoAmgwnH6TXZx8dOomGGtPzb5cQIvwzjOzIByK KfSQsk9sgDJ5CQjQsc5uKhcSEQYA1WbW9gKaqhSvCHkk7e3apVmhz4rMnowM0f0YGu0XZRQG F4QI4g0VVMhJwVPVBLJbYdpGs5xIyKIjVuxBiip3aLsVi4dEyVqcX/1VZZ2YEgUGMjN0Swoo akRCcIrbpAMeA4H0CjiVVVwqwpPSSEZVEqiAqCVHFitefG+k4D+feHj32roIDkP22Q/PUG8g iI741F6dGUFjdpOKSSpWM3E2TSwevM0YT9ZYx4OlkLR2FrG2RY0LhBkikJX2tg4Y5oeZah1p vK2kRVIt5iBq3H/8pJAy/24xYedthUMS4dAI0STT1gMS+n28GzLy8LaRWIN94m5/EbskTKGz cARSBSEry7FnJJe5pPQIwTzbS8frEpD7OYTuuazPGTP8k+G7Mz2TWjKa8CnEvQ7P1xhBCNSq IklTuiyIakG7QcvktwlHDlDeTIKMvnLKGi+gnXgk9v0JDzGd+gklLSxf56wGDlV7ptlL5KyM o66EBW2wrksq5wzqiCc5niT/71wExO+bJMjeBOPIngICNgkORYqIK7bv5MAF+4Tk5PI8yTWy W+pQqdu6ew9jf7WqgHmR0xCgEAqi+fbbr76djFujuxDxooZqtFzScWhFkpAYOcf6ls22ufq0 6LXfaUfXakvvFoxPCXPkfx3xZf2/C3yLV5fVPvI4+Ha6VGTD6blqZxFeU5SzGs1T85pAOK8G /WU3d1XgPEOxPFxmb5Rg2Xc24tfi8X+Hdw0JQt52YBsyGIxQZRKDi8IMr5ZOwRITC7R7+hJv 1zJud7ME2klpL7jhYCAIuo/3dqJhEoGPSAlUyF/EmMoKcxrclcGBATTw1SB7VuItNecIOcC8 8dohK0Yz844ZvyRscGNfk5id2+08AyLqovYsAFd3yirhLDOGQ+q06/JGA5/aketk+YYguPHr +cNchiRSx8wRValNO1F5nqHmROlgq798xPqpFO7meNpw1H3K0og/bsVfjYe2XVfVZJKcO2Ul S50x68w84TA3bqt1nqi2EzlNm9vt7S7gLQgtI+aIsSlFf37nHpCRduHHVONoe5x9x83FMQjw RKhH3N1MzOP4VUzAa5Ti3uduSz8utGoPG2aqcW0Q7jIn41AzBdnd1RyCZU0Y1u62SUV3JIY0 xpbvtazN3ZyS6Rd316fkuVsLlrkyBjuxbo4nLZ9hUEcR2vz8DOo33qNp6zQAk5BhiWUo2iUH TACaO7SUXDyZNoI1UuNi0KsHKClO17Vx3oxetWXodqie9evg6+8vHhEk24mradJiMTZWiYn3 awV29wXsuaRNKvE46ILygvzMiYRAbEa5N9MXR+n7MUZgOVrlWze3SaDUMn2m4oZqSb8HPnuR eWYJ8xCoCkmZgabiHTCtViAEjPvjHzs4YiJIFsOnO5m1pDMo4kNosa3EBgxiYI8Sr9fdJ/Fo czz+q/5jPRgTEOwSkpBrbIYaFnVVln4RzgpVewgtJc0+X9JvW8/+TM+FVaugRTKUPpX5Hgi9 7rqySCU5LpFTtKeMne1QBm60CXWehfhEYtlcjibqf+x8eTyU7dv3GCNjCNmVMtqMITQKWUKy y761WFqmdCv7LsvIUmSJmaTIvkzWFlGWGaQ0SZFCYoYaO2PfxvJel/t571/8fv88n8/7vH89 /rrW8zyu4/ge3+9xnONzivCySMGAwulcIiGTPHP7qq1Tj/5F9qzfiCTdF4siVnqOLG+MlPNk UEjI+opCIMsO1uG9DfHTrEXcWGPkkQiHvY8E9Pl4udzZunQRqvDvF07ZkoUO+O6J0n0xjCge EkBBuK70t4kbwjxP4ka4e1/TZy4nY3x/MQzMEqvCV2BaivxnFX9fzb6X9da18Y2uggQsW1OY F/kMIkHWHZBUrhfgrfLN26/xQDG+atg4Z+Td4m0YbBTxlAO6+56dYsde2F3EMCKX/nIUEbPg lW7IemgYChXhDkmkhOVFAt3uSW3Z0XQ+gSulyF6jl3vpNWWZ7mwqt80mTxC6T98rHIVC+eDy IlV+Qw/22d8JDuc+gZNki8V4MWMFYVm+99o9ugXL/dXSpP3XhJp+8fy0fLeSzumoEXxFennP 29uedruQvE0jOkn+n0v39ry64XnYudLGUWNiFCEfaeEDzjKEuBOekAFjzzjJAe3TgU8pe+1g FT5lUp7BW55GKzhedMJiYGAuWLRmMlj1NfS64svCsAPwrOmuq7ztMNx5ioxQzYamSPPKVP9a 0CnaodqwJ85lyVgfY5oFq4/NKPN1aynypUikq7YuW73g2wWv8QMcCDgrLWzBFgaHJfLJizid Q80CHXrw+cox5jWU8x0wA99dTtdCVUPHD7AJ1AQXjE30KMHZhtmgsINH0qKFpPbokWEqTm+4 Yw60wuzjFCfHMLxv98ImpGkoi2HpO71RA4grO7TstdpCXGf1p9jKwG2F2CBwqNm+Y3LIesjV e8l9EgAVVZ6JDiWhEUmfTrscferHlrfgNXb0VFH3R1syS2eRrVw/jML75QPGRaLFE8oBl8hs KtlvyhldSW8uKwwPU4UPIJIefM2dVo4/8CH3zZlsu+mlD5ZzKTUQLu9af26YWsBq0Vuokrlo uROt0OTB6w5ys82eRc4ilL69FjIi+8adJ5axCIwteWA65/24esjCz+8K+2ltZTyMA2JWcLsD HhLgItUvxSFnRkpYZpfe7j7B5mIVpylYn2Ynvxb5NhcUxfv0x+nXKr+N5R/Nv5t/CmMzmH4I tbmhFl+q2YGoSn1YDR2Rve/bGMQzzEXb6a0ezgOBTu6Xgu3KVI7QvaRJS9zBCsiy7GzcUDAf 7zEgew2k+SKyq3+n3XvqdWxa0fveJP+OV/v4WBYnf5ogM69npWFrA75+boX9Okp92HdIC8hP 1GF+o1LIs4ua9bVMMq6YOccCZ3O9oK2MckDiNOtMaToDR7s9zN2Sw5ycbZG9h2KgKrerF717 aznF3WffzbvYesKbbXZ1HFYE1x+NvzfG8gt4+7DhZfsPItC6zjIQROltPtfeumC97xPnw8OK bGXt1T7bQRzI4Sz5kVppffT3geX0ZrfUsMw2wQ6T7PJqWPr7mPAxJdefMF6njcdKNNZSB61j /iFaSOS00y4uf87+5vzR6UgOAFtfvofIxl0ND+dMkbXHKVT5TryRUUNCeREyLV85eaFMDpbr u8n3njH455w/3qeqsGj1I879+Iw9ab1wv/xxFUS3yp+jD6JJbkj5mBIGmSKvXo8ME4g2Ey2U ryeh9MZ0Bu5PKPYJH0aJNAjqV0uYa4pA2F/JOvDC0k4EW1xiOaXJ1E0UUuG/1+n+61YlDMZ6 QetHCPcp5YDRY9naDbRVNvuhzxnnlYMWuNLIHuC/lL+9/cYaiLHJi7jlWj4BLm+2p9g8dd1w KJk2Dg0Lq4BAWlhZ3KFeejxGMuQnLDY7Dh7pWD8q5jRqLH+VM75/Aojta+i3Sq6JoQ7Zet32 Z/wR9SMK1wZ90k94PYJn8ivfSux32gmrUTm24/b8jBAHgs/2i9rd/QhFvUyPADF5wCyBRPfd G1CIJiSdXL/G5ILy8QTKf4ntfsfM54B3CL6szIgN3xnM4uQ+rhyWOabM4j5XroxTr/ZLgkNY 3t2G77ApOyX5LEEwrtP1V3AljC1VGmWa3XyS723xwiQ1NBGvKQaBX/CCkHchw0wyuVjcDouX vV4JUGLTqjQQ4C6crM+fYWmgyYdBDtLE1dQiNMPg5GeRPXxyNN7h986XQzsnS8NyUKdZLkLE xNRyx2j1rCwsqhCWg5G6sIgwhfqund/f7/H1ZBM78zsMbY6U76oUH4MUJ1S4lS1BfKAcsIMi U2mZPDlxa+rVVdD4w7sRsB3u7B4T3TuFul7bB4T5sETddrFhqtV3Hfk2tOcqyjntdHcuKkyh 67WX8CquxB5C5taBpGuyQR32jn71/hXE4IJVJKM8ucPlG77f7HnlRtVCDv+QgGjKVI2kOCpe 5S1/+SVBViwjKzC4AI2gTAyxsD2uvNGNVu4qdel5VXK+Eg4dhn0vizud2CJSvWpX9m5P52Nb rUTTbCf0ThTZHO6+A8lGI38XgoSdhMDN9n2xQ+5VWNz7y+MskbFIzEb6AcV5WL3cYzjs/GN4 WAZhBw0mI2YlN1UWqsI/d7PyWV0oNPySuJRJthMch8pU6FpS8OBNgUBOQpbDDsGK6kwlaK5O xVdHlz/xCRxsumycHWEucJvFA2lGfi/OeVATdloS8Hm3SW1dMDQ8SVpegCxabK/nVx6ibecv A5HfnTiaqd+K2lUlPPztUnBNQHj4W0F3w1QU7cJuIDZOuxCrMYx6KBfMTvzqseYZJJJ2JCL4 YeHGIqD0APNYswOeJ+MgOCdyg5/GbsANIghl2IqSVRlJQgvIPi42BGsV69lLt06eO3CSzAsY 8k0tOWAWBsuqhjVBtVhQOPlMDZQQaUPLLuyYGS5MOt743Y3L60c4EOHSZgJIeSfnTOXMCSwH JIKNi+W6DI1X5IXH4XlfDjgN4c2JAyLKKwLnDWOTbYBCULcgjVrc+CX9D7kt374Cwp+JDPs5 UQllHSCHIQcTIGZCdzhwp8i9mqY7Hr3tOYyUt0WizETuaCOFqobF9aEtO2Asd4Xd4cYNNmtr 8XyIZrhdecUya0VttyMLWROpE6adqTFrPJguCPvhZeiYWZCng4TvnhPX0htlzVUb3h+R/MyS RDrkw0ZFcbXsffgtVi581yyLEAJwa6cKf+Bii6B8h61lSpiT6czQ83Fr/hWNlbIRJvdD9bhd b99enRmPPZvh2CC9sp6xzDSd5IY9zpfXL0+002AJew9NVvhyOsTydP2GtXuiBPK16/4NuY1D yTWsd32m5RVqQpId5T9sPNoo/dCL+0k5Qj0zSfpNus4xqRlLn9czmgqdcXwt4Je5j8NoWmOa OvL/d2vjvy88JKhObeTnDl7/D7tOb+4kvXmEOXHs6D+Xj/2nXaeP/Xd2nT6qrPzPrtNHMfL/ 47tOfznKAoFAGjLnTW9yyt3RvEgOY2HdwSUi7/Q/dFDDvsMOCWH5Dy7ddNPmRt6Yf23jraT0 HxyqpPzf2cYbo3ziH49ilOTlEX+4FPn/xqWIP1063murLWD/WJYmmqTfavA2An4H+NMXYL2E vBMWo+/+eWODI8jazzI8DloXMTlaZDIYJFhdVMqaMvZkqHReY+PXfs0wCAsUBudF/u/B/x78 fZCohtvw2fXnDc1wtqTKhPnTm3dFcLAy0r64LW+toxMflpSwSwBnuFUh5cAKtOfWAU6xxfex Dy72fe/lB09DOMUcHvO9gQTJbJl6KZbcn34xhOHZqw6e/y4g11cMNx8q6tLZYuQHfuW/2P3d ox9mBF3wOwNeWUa7O+1UqTq99gqSUrXlo5DmUNJNJvcknOeGwKxP2VgdB3iRARv4NkROwp8t 5quABIlsNyLkr2UXNxE34VnXnLGozRfE2QZ8JB1iLFy+4iqKOraac1dIuZzN+CbHr52XarAt 79dKgw6Dfqjh63L0GtBBnUtasC2cw1wY3JJruAjO3MVQZnW99kX6et3RMsVq1wfg3RkT5Iu+ 8fd4kgXFOW6lgsvxhD+heusXfWbjnpwpXf2xphNU731OdIJncTEmteRy382AXvlNt90n96dh ik+NzKO4pSylbb+PBn3banHAkcSKNqObG+04rJjNegz6ECHg5Ve/IuB+syluziJ5OfT+xHt8 Kh5zLhcjbXt1vsR9azTbYe2qdS0Lcj84dK/T1y/QGebYkMng3uObs9eR69Mw/JbrhlKWRVZ2 5QudNEPhLQg7aOYU2imsGEaMo/UXY+LRX1Wbf1JH3miDzzTr4TrQyfsK1AQs8/WkFhUozoKl Ku7W2zzAAmVXDLRua5UTtMv/SvG2SRUtUhOzHvw12am+Ca9STjGCZRTLhlW/qrr+a3HzfCHa 7u02ICvoRnkPUl9ijp9NfRpWwPP9vtXgynrfGvClSCpbCB0/rUzPeohR1ztrn+4Q6ZJT1Lot 6nz6NxfamXW8dlFVwBjLBYWYivsti73lTEkwvBf4l9QLZI7EXabIT2YArpDAppl+Lyjbsc2M U8gXn4zYyy7OCs9QrOxSW9GNTHToGetJHmtDtNdNL0YImHEwnLOPQW0GRt00tVWqUUWA+/Nd C4qxvmiJ7cURwyP1cdPffm/FVo3QHSX/OOJOx64lHSbJ2C71SdG9+O934yGm8ySewwSDLv6g HZve3otjPYE1qFp4L7V4mTK1oRcb0zdyB1PsSJyv7N76uRz8+u9L4og1GIJN/g7pX4UYdSvR iT2xsZaNsm2uGL+FV5MRm/B1RJ47a8FKaGoyN06lSDUew+Ito65TEi2iHmIe5Rjr4C8KuhrY l8huyTh9vGZgpfCrYIly4zzCxeeYR0VcZUVc78P0GE/V5K1EDxGIE1fWGTHqLJv4itH0NRFN n1+Tzm/JxV9MN9TBl5TcJBb1/lt4GAvnzueQMYI2UfcJqKJ7OZS5x2iFeTcDbOmNsV524Nmk A4nHTUWb8LY5KZa6X/HEh5iXtTlaFCvd7r6+Xfad7bYFsVtYbsYB+aLJ6Obijx5tp1RDaW07 0XM0pjlW2UZSwWr5vEVq2tozyU0K/CiojCloeVlneRTrfOvaKQoqh6vI9iXUMaFUdlv8TyMr PsUuBF3s6WzblUcwt+sW8yFbmmPzN9Kfhhqh5fwOMHoA/kk0w60N+K2GUNZ++P2V9rxOYnc+ 1wv8zZvm+qmGqJzjS7pVrm+2ZogWtM1E7se0PWlfE0GimOss9inrPh0Ccd1vLp9CTaJ05GOy 9lxN2HSZsLS7eyZGRU+SYJn/F/ViGkYsk/8SRTnvni7Kcvk30Le5bsu+i9CLL4TZyswviDZQ 1ooxxta6bFM/5rJUSEmUgY42alvpzKXFZ3WbApEk5e5tIrp3wX6PyYrJezzxLMVsLj4KlRMx 05qu2kscK93qYL79iX1DkTupEz2Vpy6IRkk3XsGii27EIWhJlCv50CcxwDOvD0xFp2E66nI8 KPn5Dx68ehUfP2VIcU7CEMx9/ai1PfylQW3fxramw2l4rmJAmytjsndy0uqc6BmbqNeUQmjf j/aOji9mtsJ7N/bGd9ztoV5Fe10LZZiAGbcITc3ErIVTnhszmF+UsQKWupEMVB6XBBZvFnW8 qqysjLodbfDzteX91X5yBBvdZII5h1oMWtti2aUQY4I2MjS0MMC+fNHCnHjGvmmPkVDzb7yO uZkoKQMDJPRHqZ5GFhV7+xE8BiGlfVrUpp+5yJ49htvmmwOJP4Z7SeKKwRKl9xook8Y2ogga MYuytrKIy23Xpx9yGwsGVZPvwFRlGsbnjskdqTK9o/R0ecNUbmDUZVq9U9W+k7eUt1HFW3jE TYeXPUFTTk7IXAKxHENBu/VysU25jGRRWmIBZbj7gU0NDjzvqYvkt8oflDLiWazTNhF9J2XJ yG95iw9eM9cX5aOUwzUCj6W92bcNKrugI/Z9OXoXP27SW7fwIBoA91wpBcjqUWp0MqXdgs5I 6+6v3gUmdqWmmplon3QSOsSxpNB4vs6yILiyItqDskcJyCPULernCLxE9q1V/ytXfhtU6dpv rVl4cc4pwopBCeI8PNEvgZzv4/EiEAsxNUXPZ8+hiTduFBZ9Siv0yiuWgREONen0xyykLNdq +y6C77oToezs6Jzb3tyD+JKbbT1Sbj/f7DWkpj6c6TcTsIi6g5FpMM2Izyu7tpW1moNwLUKM ka/l/ZweWHTxLZFBtII5feK8uYXoN9Lj50mGZcSajvRaOUAONDGw516UmLkTKnFn+kXS412A SRje0X4gNZotheC5pXLuzHS/mHZXTyjl2MoQv2s1/7otPDH3RH3Pnr/nERhEa1sBse/1y1ay 3meIlkaXPii4hk5fTb+XSLYEXqTxsWFOYM29aX6r4ZRHP96svMsfNDYJYJocMxE1pI48nPng DHxWBEamPjk52XIbFSdqdg1HTvTNJtpElWOuEBK02QEo56wvpvcA6b3yZb2UIlaYHHgmb2bx kOtkMKj4SchEdTPR2sznpXX9tibdwUq7C27Ji+RL6emeAqGXE+EZGHjY59M2gmKBjqj3zXl3 TUWC0dI9i72D1mZR47Lum6gLntVVtigoOe6VbYImqslbjBwnGOgj1FiBV2X1aFUAQeXwe1Lq 1gvngSgRH84sn4YD/vNc0KkavLAVFEicc4GSqqoCfzvlQ6L1Sc7LhItPMbufjjM45xnaBvQs Vh88Se7aZcZ5kGN5ccUDfjqjbIQ2NazRXAgFVTD+WniTEPktTYxPS9FvwKWGHKLGrKsc/g3l bfvkfox9ymugJFqbGF/J/hvfqbmYmoLnhx4RV33mKmf8TnlCE7TA7Aeq10xMTebzrKPplr5Y T4oZc1/I6pVj+LpGeaw+WCngTesCZq/2bRNgPvie2vJeAAMCIH99QD0VC+aLQrOLn5Z7yqVA IPL7nHtkqRdqax056035SDE0MkxbDb5eHeRoDNbkwkuXTbo72r+HlCgAldFl7wYplUbzMdW0 jOQYqaEGMWwzqlFldWEifBvnHJpauNk1CYSoxaY1L5tiBklYoWatByOJN9xcrhtKEtpwKuwO lqITx2ZDSeMc4Hu0SyD4bg0sfotZu+197lyPavsJ7HCwhr+ISZtBnOXke3yZtr6oDp7RVxvE 2EbTHBElDpuAuELwsBKNQjemgprS6jJRciRr1V6YlG+xzLxUObcpLR/4lNXMzjqEHA/Rwrqc RxfU8Le23fWkTAVS5E1OnBA0pHrJaferGoKJ1RidMF0xvHUuNaE7lX7iGrfge+p4bep2mtPH rKxOHP97TmIuxmfBr3MdkDIXNIGUTBDy3w28eKEGKKtnDJulpIsGhK18fXurfFAFaQ/TnnAc pRd1zs4S8RgKSlg4ZcBlW+kUIMPrxnggJNwYJRdBkChKyzDVISh87T9DaItFKxjQ088rZed6 bhwnUKjCpLzFuM2CiJwRQ43rB7CIo5I8Ke73Wv39VenjsbyWdRxHsSKgEtk1Pkix3YZ3eRyd DtDRRWwzwLP0ohS5qwUFIaboMj29UKXj6FBJNHpKHniwSgzXyEpIHfCzD9a29NeiV4yN3PZe YW8IoJozgvZ31GmPqaKD9Y4CYMy5N/O1wLTo38q1rtHInY5waW0b0WxKIWTd09X3qgZRTGyY qrHC7ASdJnft2t9ZxYVrPEEvG/Cz9BpkI/Sq17J7UYS9subXFGseYYAqRgqLzlldXZ59tA14 B3kVAyX84hoodCurZdnThDLHT7X6koT+cYYysaUm/3npq3zDZVVRc1wB8AY5D76atdT7pUss hjrCSkpolqLm5UulWAKDZ19IKN35bzV3xYdYi05em6hiTAxaI8LPev0E0ZiU/1wl2UplmWnh u1SHB8Mm6+6fOeM0XX1EgKQgV7j6jcldVsDlVsD1C992DDscFI3H8JuFeGxrlGEWuLGVQJUi Yx2CucXy4ZrCGbIxllpb3a+ZPtb5o9EFvceijKh2YT1+IS2g7qYvc1OAtKDRXhTtJsbCnCa9 to7Js+8kpSYDk24Z5UHJy1t76Hn5QHGjo0Kn0nZpIK/vk7uxqKh4ykY0zjqqEMNlLVuj/tDq 5C13jYOESjdfHwcXt5uuf5mt12XW1pQBpanm39LgYWBgcP2sSkFxKZFZsrQ21fZLkujlnZ2G ScuelVA3WQ44gq8FeMguQmmbyqJw5d847wJFGZc59ulGMIp4a2aprZE9ldWnYTNVRPb4HwZT JU1zQRNr3SyVw0/qUbFoYsxpqSRkqAUv3PIM9JUFCOiHn0iB8Xu8I+kqhsL4N3ShfYDAOxdj BK2jlKzzr6Jz+H2eaASt/PYY1Ew3W49PouTr0hmxPV+Y4FwHjZGqBcXFT4klLnDJkPdyhWL6 tZkzzWmYY3U5BpRyXrfXW8naA3qxWlgxmFg4U5nr6RuIOUgg5pB+dVoB6SGjMKUMpoc+jl+A lCNsxV3gYJb6qCDNEf5++HTBcMR3P5V842i8RrZLzzZu3qV/czb793EKUAFgrTbir6Ib76p4 SRDFxPfsFY13sOz+urcWJK/9SnN1INAN+Jv3Fa5ar06OvwmoVkWHRAtbxV91MFtWSQZLcMfs 6xRUvpqA+eS2pYzPbCHYkouNleLWIQbfSAB1jK3lkABIsXPXAKOrXq/HDYH/nsLGcWUIf7aJ sV64tNfB7MTR47MDYBfm5W0zkIbZa6krbRe4q2/bAs9+WHt1jTMp5S6aFKlkrTvPaDTADh4n LE72cZQRuSRDK5WXmeG+c3VRf1Nv3VKwnAAp+tS0aqAWFl1wS3gIiCWAVvkzgOLzP+MKgm9d UjmD/E0wtxHNRyspkULOSBKMYoFMXnbOx9TkY/Ck6B2MxV7LdRObS7TrYDrUQ7tZCd1NDHYe cR25whaxpbXJxvfufX7eP/2eLgCa3yaD/Uu0x2vrFzTALHpqUU+5LAlEJWvXG8XB6y/5kih+ bqG1+TMARAFyrcla9AEB9hBoIJeDplVrMj3dh6eT5zjRjrUBe7jbl4EG6L3U16PYlwIb3lsH z4Zl1zrgrfOzKc6FM+f/ygdQI04tSKKkEu9OP5NMEN8Z9TeAjv0NIE0cvyCpkROt9+RkUN1G OCXB6CNxtq5RDXu4gEv6QSLGfIN3GiTif+ZQRiW2onOyKMrEC2svxZIo3stBo8svCgCjq1IW rUGjc4GMogOiAGjCC+Jt75OysmXF+UFUYhpmd8GqoOW6xjaS00cm2+aDhUgAkniPpyM1/cmt k0IOlsTV9GYaWRv4Olo4WJPmxFAT2psY3a/NVlvFcl/UTdNdAp8AzJNvUworebsvcgsrX8J1 PJBDhzEA3e+m9g8zlo4T9PCkx+mrwVqqQY7agKxegadlL6lPFy3t3ZvLT8c/bvMA5WsOsRD6 b2VmYJmwDgGQd/eFxZQ5nIrHctBA91dJk3UTXRuaFIgCKRAFeoKk6Ma71Kyltf32qyakzBkj oEBj96R0tBMy87pytixfauoiK/pVH1rpso9G5M6QN2UIa8swAmVIDDeeNgNrYrACRP6sNj1Q A2tXmo39uNtk68KiwJ2FW0wDrHe2yeAw49vUIwoPMZl0raDxAzUn2nTdZt3EJIRmABrXB92w W3U4I0wiRfcB7VbqBmzaahviVYnGBDA7tZeZE2OAFOfHS4em4PECwpHSP2KfLIZ0Dm2uVT3h uMJj9aQcTNXlI2m5/DHU6n4yY2rDSsFsuYdvUgNcfvyHf2VwxmbLCmKFLx6rrDCv0BlRK28e jT6NKaLbUiiG2maihwjhFDVOnp+yYK2sCRCj1arJd42Dajv/DGOrMTIod6anM26+gpXOGP7t Rmdwdn1iIkDYmCKTLYUEo0eY7c+l6bbS6BwcJerd4INX8a2ljyurGfO94mK79wWsjNPuUmOo 1161MJFbFOm+pq9FQOaq+kbKjJ8Isdj4k1XUfUM643ce55M7wBPXwFaBuJSut3HaHVxt/OfL quxY6AyFrrvMTd5QNty0vK5Lp6/yzzxElsGe66ET0KEaHjOL5kHuJF3wVqgQgN2iUJ6qs3+a cqEOMIW4ujZ0s5K6uSaTjAD8DLSW608Z3Fs0rRFKSiGRVJeZuUHuGnp/j9jcKiVI8lpyZHXd ss79GrB/c9C4/xqUnwMVMtTAx9i3ZcRr0G4Dujmdcb8/q54ZvPjGjTo+Ou7sct31RqHXzOJd xbEQ0BmRKMAZAVbTzLbm4a7ZDyPCco6f5Wo2ql6uXve5+etjp9tjamXIDcb45OTkGpftS2N6 N2XU9080aNIyYBgt+ufa8kM/u9ef5a3a37kffu0woACpCEABYqgbL3WZ2n+6GSWDGwfjodBb xpQHLgg8IjOaGDMxFGegG3n2Oq8k58XY4MRkUPAie3QUQF6PHz7qFi+8cHZNbCfY+gNgqHXO bFfDXlx7/PYr378sMRsGvjhvxi8rEvEkBYyz1Gac7Yc3vk+tbuG5+2Ezi2ddPwcLAacIByDM ak+X1OeWPnQtve0Y/1mk5EYNtrvgcNb+PLW5JrNdk373u5vG6T8L998cVxIAqhW+1QoBL2+g M5fSa0JR/vu3BP/h38Ev2+MdGg+6WhZ0deZSsDrQdhVUbtQ3HjBZdfAbWIw8sloHxuJfEUZn rtoPPwsfkgTdCAopSZjEmOfhQocMjWpw/NzCsrJngUQCZL1lYfzkZkQP8gqTYo0MDT+W4jOm 3jJMmZIhbjeDtOiHNh6TO8Fs/ydynmzPk4FAnEIIqUmDKWmIDMqcsZ1m/gDi0Z1SNiTcF3rh 3LqASfvdWKpqdXWQRqPgkTMp1corvlt4tMofJAQvNz8/v2vM998XP7mZW7xeuR4w8osZudwp 52hsehIsQUKWMkmVBcyFT6Wt8a8e5G9hDSPDmNjYmJhs9dGzE37B3JtpnAIoJHEpeDr2jdvB PwnWgfNKEqU20WryxrUkCkAf3wj0Jh5GX13AcSXV40dPLvyezqnHrfdV+7n2VoWU1Fa8JmYB hfpTC4tUxxPh1YcAlwZwXPGkZA/8iqV+LrjqcGUH2laANLuSwev65M8oXJNJTAeCnNGp2zcE wAxJBKUA4JuaC0zlLSrnqLmsSnyGGwKaO3IkGC1JVIhcSYSwleuttVfLwWPRyd5JG4ydpvp/ QugXG8AigGhdDApyBLCFOwhHhYiTulY4trhWGbeJofQIGlkBjFg27Dk7WpBkWr66Aq5W/UH1 9rRcOkPPZL2uUJ3EAIvsk6AlMVSSXMX64y0CanJwkz/STXfhgkBv5CGAvsWe2vWz/Xtbt8+s r58pda0+q/9+wee0peBsbDfPn+yXGQZghvIVT/r4sQxPePBfSlLmMBrVnQJii9wEMtw+mRAq /ATWbeN2dIKu7vt3kgXXHOueOPpveFxftlQ2GDIaPJient7bW5vRH/MgB+oQp66ypXBYdTxc uPq6srq6+sXa5THmYCUKLElq5qbXGlYBFcuXzEiIi0eFOo4PUkFuRvIAVYRhk9vG8y0/JOIA Ct1HVHuzqn5M+Qs1aLG1ZE9nWUWlotLxjm/fraxtLuw8QGgzxnocsxSdsJt1ujwhBBIbzRi2 2Z0A7cn1bsIMwEsdmnkDixplH9aRfxqJOA+Iq9X6yeS9NTygvxvYgNBom5w9T/0i4GAWMLHS 1sTQaWI0rOtFF4A/xvzfd8lUWLxMaNlG3mpw7YuckjxiVl1p/huKPrbhMjwBYH6cBuItK7j8 I1JYs3sH2uWvsd2PHp3v0TYJGGvtDVpjva2dkHEvztT4U0tt4OxCb3RTHmEqnBLXwomuBLoF XbfCezbZpBKrkIQtQUdog3L7mc4IolBDfz5n7gSJF6+ZZrkOtF7ku9TIaVMOU4M/nafAp5xm 5RrJ6mNBZ5hKM4dGWozPqAWpYNSO+ZMYDosTj+3b9LFel7X/DyPfHg/V+r5dYiMVRSRCWzUO obPzoSRJIady/nawOyiUNE4zk9qlqBTJdq4oJOx0QJgph8ookkoKw2gIZcygmWGZeZ9njWqW 9/v7ve9/fXymmbXWcz/XfV33dT1rnbOHx1VjnunY9W3F+SvzrlXXLNBweiMGNspDqYlppuby K9I62YkUPD2RInudcoAE+t34egbz9GWcmRk0cHFqea4I/1HmuB9G8Q37ScyLd+VLaSZRac5o c+bGgUvP3MH6rKIjGNw21CQKaxraYjGJVM0GWlMSRVCyj+MFe86qaApQU4knAvGc0R+WYdyD +08cATrwB2OQd5ajnsHNuEZaHzZP9GrTs0+x8dHL56jBXiLYoaGWZ+bPmnggT2k6tprTjOGR fz/tvkoFLOb2NBx602VFSaQIPv/ozAIN0apTptaYAaD1jpDJ7LlRwuTXOyB8ZT2rC7vtzMUx WyD90tNuAOumTBdxWbgcIQpGdqxIK9bEEcWDWZtEF2qT/EvxJAe+xYtLVfHwZzaJ06O31TE3 TbSe7lsuWng2UqpqoGIdtqZ2rYb08YfYMQiw8wcfMDEMtlta1UFH4Msf6icTHhTAGi2/D2v0 bsmtSmSbxyE7u2PHdpbdMv/WxrxI+BPF6r+tVuStdGBc899FLXZ3dWt998EQ4N9zHFGXqNRJ 0TRbjaV+XcsYTNb95qu2suqjnHM57OdjAUvzjxzeujxp4S5AIHGAQKafX9AOn0ijDSSDk1Rt 3YLDU1uhOLSzLLRvqIof/ezmC8fnz3F3/ur1rQqfGKqhv6XeBQt0pO7HRswCPQELBBpdSBtt wglebgUsfBdWZEhAQGTkATw+iHmg7NZZXH9cQZ8mFkHkwCbQIfVF/tPFB+AQrAbqWvDv03FN TH0Gm4AGGF5bT4tTpxm8ohCNTc3D9/MqNkBBPGHGnpFlh3qx5yV14k1YXqyJE4NFsCBEfsdS GiyN2S3EfO2vyhFUgQ52ttX18RRg/T1ygt7qauKIaz0uwYEy58GC8yFUkh5R4ITwW/781opl ZadA+bANGExJzkQ6QnD/TMyC/weZb3SHSyioyC2lXaBJKroLErEJih2glZGqxfDb4IhYDl7w SiJ+0oQ1kS9PERxd+iMXOwvQDA6D1GOB8ww/eIvtC8+jMByMheEQxfOnqQLOSF9TVVVHR8b3 owxm+yWZdmVIXnw1Krg+Hj4uADXhYPj7+Nw6ZohvDgHCwW/w2qYh75rZ+4X5A/KGCBzJL2pv lwpcj/tiLCt/LWLydR9tiudODzcXr9Y379o/dTYD3uck8B3+F9NMSdE1mkkTDGZTga59nHpn FWHkcGM9TSlNhrtB6Ommu+gQswSHv6lgbrNLQL9KdUmipC0eHDx8t0BHlyrsfQpKsPe19FL5 nwjoBiMpgJ1YB9SwuRMvmc5pR7FFKdmysKiQxBs/OjLxIf472vaGiVezmj331YtuT0j5lc4n UsETyvg+upWRDJiNY8PvijK22GDC/tptRQpy5HwHjUybJHjxmmLpAOfIcqiVBzbzJOf2O6YI J4b8UQrQpVfhJlRa+BW1MhsILRRwo2q7EDXCj6jDvXUN76wYb6m5TQEqfuTAwECbWUl7MgHp TVn53gJ1039e3dmlcpD0Zgme0wzh4vuJK1BketRnZiaIfsp4uRwOwDQvQb3MEf4W9NOA2HKx f5wGxcrvSYmEgw9/qPJD56f2d067vOQbW8oXN7bYLcnrMcsYaZwbZQGrY5sGlEDyfMcZsDP+ rqj2BedtdTgNtLQ0Pwo6ZCm5ZuHYV/fq3cgBR9tzMWrtTJm+/nZU7wCRZsOQIMdAj1kf0HQv mUcVmAt5JlULVAPnbMxM8hV4/Vpysq58dyTwSOBR5tdvT34DTeZlTNN93zSo4kc5SpSV7K/F 9W/W3f5sZa4aHNmKbKcHVivyzXj1NCrNeNHKsuXweVwFz/55HTP27kAq9MSuP77i0lnZ0dGC Fzx7M3we7LIRsW+zsOX3r5WZc4oOSfDxkzPfIruDHA/phtps1Z1I0d38wiBAtCYeDRoGhoLO JmsWtW6NyQYLY3NTTgSxe/JFHcOxIGDQb82sJFMhg/e/wR6OGKRgf8Eo2ijfzIM38eHS1Hh4 ICDgbgExI9dFdd67Cz9Kw8v08A2oqpwPKw2QE0iNChYmLc29F+CEWASuHkNnyL8R8Q8xHFDI BHbYweAbgs4O09In1yg2iyEW3xHusmfsAU3sRTwUY20F8m3NGUlHG6FUPk2luzooy7pm5nCr SAmX6ZxDSnssHTFbRlKcnnMc6I4p4eFHuVdcSPT0RbjEPfyxhrb+emGbkRyPjHwim0TRTaI4 PhFwQqBzGhoddoP9lc55HUzHZ8lTZO9l8XHYFvzoaX8Dbcn3wtc75oY+Wu/Wn1Py8GHOsgj7 262uvRFzuvmQmthGG+W6IhaDoR/6MNO6p9ISdNhzLIdok39AM8FguI+OH1wNW2JWcNXYPuzz SrdKd+XfRMxzkQzuqepZgEINA2hjXIilGfxqbQN9Y5Ppx4X9qq8pq/nu8XZqDwcD+6ee7hRL yTlusN45JXwH4/l43/ukX6QEtBYiOmc53bRuBjrGQa/8cMZoAPZaNoKFYPg10LI1a6xlhzhj J2jktvdtzR/evtvtt8tlia+Lhy/x9kr0MazQfTy8DjDJhKfScbR4W5Tp9/nCCcK/ZcihUD21 vBN0jkRhGzqy/T3hUjyP6k7qclR3/pBACcv+Yk4m1Mm/ZbDBDaSK4sEhgVt0OgXICg88Qeak pHWNZnZTpmNjZZjyXFeitydvNByOKl6/LixUZ8noVN1cw2mNwmPUVroiAIwkisyqm8MvweVW nqLjHYqbAzE/dxYiV64BKabU1XduUP5FPyAL8DLEFlnUPlt2pV477lY4dWokhZKRxWlen01M KgI7yyOLg/4TfJBb38K6kK+MIyp9sJQz08OodO8ugAKXYB2l5JSsM3HK1fJOoJrF4tp1UOIL cc4gijV2Fmt16AHI5dvzKqrrabcgO/1SOEW0QNsjWLvYB6A7v6O//7t6GPflBVpbQK6fKLrN iB6R+9lT1L1ohhTCZAn5MdDmLFSbhzxoSezZl60ZrzZvlPPjBO3JsUnPSC97F2uCGVSIpdpn VXBWN66A9aG6KFBq7EwKsloNycTPiNq8txcc315wTxjZfTNqBWbXKFwHoNduf8n1L6jORVpt 4F+H9yL9iS+sz8wicIY6y9+Dmur8dA/xeck6dwAHzXhIR312F5BzRfui1TyZWkj8pbeqmYlB +aoVTKVzCmBrVYSttU4E2tbEKIWXovO4XyG0BeD2ATWfy2DKB45NLoIBKmfI5Z2QIove2qA6 ZqVnR8dKTMBqZ9c1BjMN9MuUbWWHoBpdAGkNM8q7tGMtxh/URRui4FPtBNQrW0ueasfS5Fse hMTSLkziTkmKUkmry9K1dgxtKq3Qge9w/Fx3G/j8Y2Fr3CdT8hnbkWRUd/GJx7hwr+7HLQKb IjoHSgegYChHA49Ofrw87+2xBIdngpGZmHbT6KuB8vsIs24ehCZLwQi4v4U4Ytbk+KA8lh7i AeK/0ieRwiirBBGBJyOORx0ZZWXHzJqsMu8oDfSmfChC9IbQaQtUo7kGRBLvMc/8lctzIE0H WBOxdMo03CHNf7ksKTL/KnWqzjp2CyqflDzkdnd8Niy+RhlZcym4BaKuIvosBSWB4w+wqOMA USergZbYlHXp8hxZ8zL1LTpBtsX5RwIOHb5XXJBfdDdPy4Di7O7p7OztrVB0UDa9au0PXXSX yIul3CgxSnL5zQIhm/wE2OQlL3xExISkmkWEmckGYhdc7xBPEgGz3lKIPtj4FRWmpuACPg3k MmwYzPTzikL1sRmqDxtj/0Mrcu8VFQYcBKxgELCCcMAKyIAVdOMcXwD54VuJsoJ4e124QRQo JD/TSUNsL4l5Kt1Aq5mqfbtLro83GG6YGkNc2qKTnbJNM+nAgmVcOfjZRChPHnEng8P2j7aN 1KcIh7KyxgwhSQN03OyDHxQVIj9BkUZ3Sd+1edzdEChOnaJzggqyBKKjM0Cc5MF2kE+iMI14 ppJikqXwby5whUlaRJo70lg11rYEM+4ZFud78/lhw7AWXZ6LEdMhRdKUg5Ols6XUyL3TBu8o bKxNOa0CLcCU2elk6JrR2c/kKaX4k3gO8Zyu51r2wQshmLm7xpVdYsecw0/wJt63fxut5X78 2iPs2NcoTevMh/cIqTto1uqxND9DStDkRwCAO520c18VSHS+FmW7GkzxNXYM38M5x6fogOEH y+KilUt28YtOsjk83BxytFDMQ7gdCYw+WYMZTK+LRuUM5exM/joYNtvZtbmO+cwW7Wt3QF+r 8nBC9B+SpMJ8Mbd90QrViHufd2Wiwwqgv6mJCyl+ZNi3X0wxRQVKyF+3T2J0o5ZCtCaV5neN IrBf1dUER4y24vT0NW6Ivq5BcV7e3aL8gqAjhw+h9VZRkcvhn4n51fl4gN0RXmpbEnxljBml rwuHz1G/aizB9StQKVJmGBqj7wFQ4WIDjUYmtu2eQLQr77CFU7S/VmRZqixRVosIFh3LPheO ZWPZbF3/28uX16ExtVrjEnO8CrpU0jpxLcYMlPy5rX80NneHXuH31iJaWWhubinJijWRkLzH D0vR7oPHMzQ09K22r/9eYdFKA6KU3e1Eiv8SYdB7u4OHAuPabf/+9JInj4tu3i9fb+4UzvGl Pe16M5yY2yPvsueGM8vUV3lSFjtzVp3JYCIXNdph+IuvAwpyoo5ZEEtLfvBq3B07Qs1Hq3Ky 1ZxCWwYBTTr9CXeJw1sP4YRfyiAPUfN1SomwZjQF2wzW2rUqCP0XERrvo+EAyMOIzt/BELO4 cShuTzIHsy2xe1BJ74qdDsdZM6m/FWY4DD6TKJDJpiuhmBfn60JQxwKPJCg4dhmbY40j9UUZ df8BMFVOWosoiHFrVsdow+gGeUiZgqTRxLAGkChqXgixt5bZ4EUgYJqS1H6Z9CKEMPHXrgO2 XgEh+6x9joa6+de9h8sJ1xMs58kXdh8ZaPb6S7HVqCFLcI5yNc7RDfHlQyJlb2R3QDc958GD iorSvmUZ3yRairFIz5uNIg1PZXtZCPjbNxnVRu3ia36FeWj84eDhQ0cpJyefF5qaV03OOhOv Fn/5kuP2psaqiJ5a5oiPPwE76U33Bs8Wj8c/bunrj+rY7efl4+GLDAfu4U+DgqF2lJsEQG5y dMdfOSUrF+df/Esne5LF920TwGcVHaf0U5vAUMk8Y/99IQFetgdaX3/GM8fmzpk31zJ8sRKF RvL29JisVPtDx5ASE04Nu7HGc4kD+TrXDnv8ZJgmAZAkOpFC4TMg9sXJqkVpQvahA3bAQopg gv5VHitf6EK+n7hiJhHSynLtYEivydzl7w2xgpwEKUlHNpUWREyiSCZRQtamBu+C/AGufO77 N+rY0VCDktEdZJINxG0ttwU31UF0SPab4W5ME4uR1GkAxMzt/frQsUs79PqVXE9yRjtJw6B3 nPjG+wLf492nVC2jk8El8Br+NcVOZgiw/gDT92eFm8x7V/96tNpnvoaTFAwCacbS8I6AvHc2 ZVlmh+4hXRqGNFz0PuqkoXDGL92vnHl1RvT+2Ug5N0M5D2m5QAtwQMhlEq2GWEG0GigTtiOO pEvCrX0/7CoutWxb1zAcra+WyaJh77ldAdB1QT5CeFRZuZ1nujM8JmaplYZAfB7sO+Xl7U90 sVvcHRRRvA6JEsrG820Uh/6ZES0mb2THmuCjINK04s6txBOdZBlc/717RHfE4uSF0VlY8nFT jEqTuH4ozBuwuhUwccWsY/b74YjFW1B0LVT/DClm80YTh7flbxitydg7YwqVa3W1TLz1KauN UqqwvZD8viBYDgD6I2wUSpvzupdKy229BkSIWmFpYBIGbC6DC+dNtP1a6U6h9vrU/tFpl5eP m8exR3AEC2ewO8tuLQm59ecMWTjYa1eEo6e65ctv+/vH0l4UhhGzMF973BN0AaQKqfplokzB P5HbRQxyxJvkH5miWbM3wrLPXvIgZ02py1y87SmrBPjcJWNpr6eQvi8wSPC0K/tF9r4eyHaL OysJnD3Hwv1DjxI0K2+wI8M2+iPnqAf1XvbXUV9jIywzpQALHhpq/PEjvpCZRiMHArkOW0IY JzmRMng4YI1mkn/zVv91Ltp5253F6B6oTIct4rXL9eu3Q6gDn578TgIwOwdD6PiZ93rUrmLU 5U8m6urMG2tANfAqZ+UE6ipn4/U3kYzB6LMTmpDYzAMg6oEM/dwqOfKUxAeHIxdgrL3d4KmZ pbHx3f4Smf+APyUvRXe1w7DJ92bRAnIyAgymvAAhKO85wwRd5qmllKoWMSbxxGUtIl7gi/hC 68t/bOTT8+RiXycPo4BKHEbjEKW1SALrLV3xEEmcoZNUcDdgYEAldY1B3rehfnMyt6qCs9a7 +c8rfg3XoYcpsllyIB6DXRWfwf3CtO94MnEcqrC/rU46eHi4yTu8PWRCr2Vq44i40MkfmKjm 1kyrH0DoO/DJkX3o5MfLK3VxOuIjF34+ZpmVBkf88kpiq6oRa4JD51TS8WzFIEeMC7559n5c UvcX5iNKFtLxtn1RAnXgLhU1dLfZQ0O3euH3zJAgR+ZlYWjvGxT5m/Wb1OAJit+qG3cDycgT r6kBnzkB8zFf6ZzE+yzpOma11ztzjG/A9kSdbtP+jTF9mlYaQVMpwvpieQpgcxHKJ0cwm1pO BlyeZAOt2I/8T0pq2I/R+uE3XZPkSLwwCeHCb/x8reaSvMaVVmjs5moTSbTx+1UPKgZrmWES o5bYSXeuON+J7zvlQUZt1cnFZZnyTIuz5xo6QscF2o/MdM+dHXOwDd5QGHX4e/9itTMAI6XT H3LN2aNtte8gLmdwJ2kfbEmpmI2q74naig7uZd2HwBKds/oBIdKm+B8y1tBrdLPimSrPP5cL Lq5brM0YfKi86LIF5OciX+YLXT9xBrP3zrknn1KnVue33U44UZ0thpqO9nCw9yKTW8glsBry MIb7jOi18i8hATJYHjN8GxKgbOFFpeidQRMHIihj06XAYPI7M4c+G1aYmH7yTBWOzKu3+pdf pVpukSGegcb6n1cyXHSIfdQ/ByywPXQONMWTKE3LPIaXQlxXmVnHXOs9EqWAxdESq5POvAKk avjHWIPSWhf5pkwLZbXFlTR8ECmnpHx15Z0Sk5FU6vB1asJXvSRfl/ANN/92hIJko7AGvX3d OlSw6/TAypvf2dHR0ca//+gRT2+bzi5LPQNCFGWVegK1v75vX7Zmjay66kqS4bdkSkZuyCqn Yah/g58LH7xlcRjWG5b68hhuLSaDCaN5zS/i/wAchtlZHtoz/uiHO46UdUyhuwf2nRzQAwIN bg5hBlHija6gBsyc+Je36Ahc+fP6+l3PzQotuqZNUk8x4MIJPnJAeCdrfcQIcKQh8sMJp9gc ksOCKPR7bNEIU+NtiXdV2N6tLLM/3lXNjU+8hRAsjP92hDmALHEFSlNY1cgxrDYbRFM1nKy9 syjQa4iDqVHwnWML38NTihhew61CJjvqaUrJ1lwYikXs0J/nOxZkWG7HEOVyA2GEKbfrabE8 mgIE8ojEOxGD7cq9/2uESUJCkXxuRnQ1vCCzu9zJgyjhGUUJDxpcefjkMYsxWPqa6WX5GKhP VH6O2/Nf7ZqnLjochA9qo4a8K79dJu0THJNRaWeVLoQBaXscpnpdEYuYsSZbDIezKhIGgPp2 /9V9Ek000eJojIVJzVb+1vtC7IWss4MzPiQ7b268GWHD6vUPLJ3KS8aNF+dtf+2yZVZSZLPV 7XCqt1dIhyy2EGFiz5Wvf88JRpuueAkjJySvOkQNm6zcAnZ/6Z+z8YBvRMvs77sGI4pqlsoq Wf+kZkSO9X6vkI1r0C0IGFRJUXIFP/pq9veNmH51UKwNkniJzMSwKIATjlasijeKe5rspw3X 0XxQg4x2FNAYZ/X+h/xS9NnX08YMiIITX//b7toWgK7WYI9A1xtGF2JpPEDeAqaTNxTVY47L lG46ZdUtVVvHpCckwDkrzow10cK/QPP67OsU/i21TxKLycnC+FK19BYzbXgmD1wer4BL+A7a 1beG1hEZpqW+Hmk2rh984VTWhL+3iXH2RRWmbmdEZwsDbB3Qm0SHVzZ2jIFcxu14plKvHyVq tTkv6siJ/dzuMxhgG0C9wKLrftq6unra2vr6OjqxJ9vKH/ThcVDZ4kAvc2ZN5Nk0FE8/xQ5H FFt18I/X2jGej38aoLLpMaAnVaamZaQuUo9kc5u7rEjMDlN0DDdlj7m4aee/ylWtrQJFUSGW kl6Sx+XSOSP5KUop0dSFdUxxgybsYXgJLTS81Bf4T3cjarpAxMbP1H+ploLpvvqg+776WOMy X+OKLVwo6ViavW63RBJqbdHGu5dlbPJrMLcULb6EpWDz9n9hmlEN4fCaZ3CDm3GR8Q4e+hJF A0W0Z4xYcofFASzFC1sGyfcTikwigJX91K6BFp+OZFiWx5gut9IgCZtplPd27LRVKj0aYCqg 2fzNqkPXZkSbKXGtWRXk34HBTPLEGesaTccsY9bEnOtm6hsxtWysBx5I5h3Ex5d4+97DnJyc Mi3v5sumTdazSh0hrClAFNmNkOcfp3byJWXVL10EutWhiRxlThnm97xl5wYnNCa/sjOZmjUv nPTPbCm4lIaJC8wUeyG1/zQ1K7KiosL0s+VjchAxLoH63rHBXuji8vZGsHkfv55nc2zOKZHj ZkSflkMznvEeD5AN2P0NQ33sr2zOm/9WCx7H1l903bI2qa55u//DPv3zwc+sF8Du+d+CS/gE JZ8m0ZH4TDHSfLA0AkCFZ+ssTzpwxZsrJSY+e4tG5I01X67BiQ5Y/tYidR/EF2B3Q0Rv6fT8 /3+PLz3brKMGlmWt4nlJnexw6iqn8PVzXD+8+7B+3frSxzHp7A8ZFZxxyT9+olTKFEoJqw2g VKCtQd7FTiflSfPMPvurn0UjU+AfG3/Hlw6ounGNwBW7ajRqC9wRONUdhOM6EQvi2tPunOO6 qnmJOiSSZ5ul44G/DtPbWkTaSOwWnTQVlVtXqdTYV9CelVj8OOwImn9gVdxQ9JTF4iAOJmya 62mmrHoaIJQPKBkIYTKVzaEsl+dDavJWjAWLu95dxxJ7JOPs0mAgsG0XAUhXvAMJjqoEPZ19 JJbW6eSxqOBRLibXuFRKFajYlSTLXXyLF6+qbeU1nP4jRtIm2uL624eGUIdnemrJR2rw/gHM lzyT0SIp7d5CPyYtV+YNZ6bX6phNDog+V0IFe7bJAF6ZFS/yEKumojTI9/Vrhx0X483DzdYZ vWF+YTbMNYoynSkWbiCHZk/TPD9Bn+tcNJU8gTNlTRwYbcXTW7VksW307LJgI3CnjROqtbPQ SHMs7exDcsS0cdxtqxV5J9j4ebYqgZdmRP8tVQs7XK73XcQIu4YwVAWp85elkDq3y6MztNO7 fc2XYVHBsyvYmcdh4x1hJC1jyVG915fGQte/d0tayECVCKS6QIlUhxioBNtCZJaO3u7kkU7V biiCQ6u7RdBCN4A+ZX6rPgnLCxZoBSewOdyPX19mx8iOR1o7hwMCd8V1w/qcBECll+ZdTNy2 0d/h76WBp2dEpyvA8RPlOJV6NxWo1Du9H34EZBgGdpRHFpP+A4943GddyE8p3xXUSZ74t+xh yUAtU7yoUu0CVv0rGqEj9ETpmLQ/4SsgQLlkxdLSvLw+oxMIFHkeEUb9vhKxYwOpL4+EeTFa jxwHSBL92VrEvrFN/b1Y22cvbHXzcSQDIuC2gnHGt9EvVxnMT8Op4El7b9/cLg/66Ao4XQyl l9I5dfdOkrGHL477dQ1vZcxnMKfOnMQAYsvsqArRBZx7Kmm7Ij1XnnLnbbhJ+fWLZepQE8B9 +og7ac0y5Si5YHxZGMYHNYPY8yaeTVrgSH3bhruBJHipHr0vllb6JBK1bhYrL1HJSs8kwJH3 r0ADNCHJC49Tv85NAtzgD93MeGxPT1fkxrDxkQNwdofU27UDgpCMgzcGFP94KJ3jgiP2jR7u 78XqDwTmDHVIfr7p3WnScltvTAWCInqxgSCAgfSr1J9ZJvEVy8EqRtvLv9Qn7nKH0bd1jx4+ 8qsgghtuSnaC7UX0hnXkcElL89rbHOJdiR5+XpMPkYl62qzJqu71Sc0wpZN8PYILuCfbTkMt b04dU9RvhuE3U5OFlKYT60egKyLC0gVitskU6HXoEcM4P14XGIOH6aJP95WGr9eAI4tGwaO3 8tgWLSFVq5mUq0MyXP+h9b3rLjf3a8mAzKBcZvauh7pNGRefZgjnEWs2+h/Tyd0u68q/zTXv q2XK7GZHSWDL7yGc8oNHd/hOdwN4dNetVuSujD0OVbGvZIcq9rOxp9j4kur5joC8OkjVGjOO 1TGbD8AoduX2ua76hVHjlZC49/Z+gHkpwNxQ6pbamLS8Bs1Zibrb8qivH/JnR7A8PFRpxZpA rutlYdXGhYVo3GBzraYa2KeqMNa2kCJfERYBTx+IIJNk9Hbn8mS1fOT+GGEEnkyhpCMd4T8T 5KCuQ9an5yaaOL0INzGWu1wmAWp7E6jtHjrexi10hw9hn8tP5m9O4KjPmRuvRcyqudWridmC GiRYO5NsTm9vq4FKQJZl4UqoM8FejEvJ72vKRK1PWmvL1AQ/LhHc3Lxj4Oa+3Ho6v44JsGX8 3BWXx6C8etzxjkGCpzW2mtn7ehJbHjggjTSJdxmiUVgo9NAhrf4KtSFQo1Ewg0jSJRpuAC05 muqFH+ocVF+kGoF86efWvnv18+gDHJCTWWOfeznBVxyiEhxGOSPKgiQmVKxYY35/AniuUfbW 7QYAN7RQV9C4crh8PfYVBTuiw3LWuPGBtL6NZMR1x0QCZLOEii8kPwQOvkXKWAkagSVsDprU jml13fCu9YPrrkkTx1wj1Tz5729GNO2Dk+Fayf6aCqKer7Kvk0dr8A1uRy43QykgOw0rRxrk jHbyJoTRg0k0esD4whx5aQiTCzzY4mJpyfdTeQ7T36wA3UBTwb4FjuBB+ovEkb7UMicTT5w8 KXQ0x9OMmclKMKSLSdlrT5nKQh44Me5PODrWwqa/4MiMFPs1Ojhejr902SzC6A3tcwshD/HJ Rwgp+eeZK4Csgf5hdhzNsAYeb8r1vjG9M/5jtSIfgkYM9X8KJzkfpPtKyZU5oTtf/1+bdz1Y C6INmsUkPVI8ttqMHHPvk/XTc108dsKED6SHSqkXuGugEu5qqmOCjtYa1D6A4SInh8aQ6on4 uIYs99YPAJoCN47YYde0D6wpL4bNSWfjL0v8GRgDwBmWoaMrQmQNvP6MV1dMdne3fGHMODl6 GuJ5M60+nHyvjDDNkIkXS4HL0XdL1nDzKatMgBtw8qK/mY8dgMidF0d9GLP6ze1geY1XBFfT OT2z6piysbTr/5n2jjFhVtFYkVi2BCDuJg10suH5HwTmTESRIQkAlu/+pYEJqDURQrVUokQy LRctVlOGp4lhhNLOxF43y6L4aBTvSXn5ozFN4sbbhq6Zh1lsjMMM32oGHRcqbaEDv/H1t1qf +TBuFUur91I0n4/5Ue9UAKiZZOTnyH8qdr1z58N9lBvBT1shlEiihH+do4fnydvIYRt/tx1H fax/ul6mv1wvE4vV63tqmfZe/VGYearUl5inlCSKisrA4YA1dv6Hrrmeu+HsnDKr/IIX9LPE 6UDAmlp+MMVjXU5jfTT24udd2Z0GpOXp/z2RZEye88Qcu7GUo43y2zs62tr4P4H2d9I1My0j Ex5YDh8NRk8LoXPpz1Bu98BVXbZZPzN6KrKQq0UUenlYqApuXDk7EBNcRR+mMJP03I4xLRLH H63vufksmhyJZ7YPDHw7GHTUnW/hf6f7BdrEYP/3+8RmxGEx/JDQ8CnZqwB62NPw2fC86Wpz U85hwFBiUIbCsmI0Ng4NdTYFK+dt//RkIBxLNPwk6DBpYOYyN2sHNFjAjgclOrDPAXFH+K3+ 1CxsDP30fCN/3sQdNj6Brti0CboLsPrxz1YmTUuc6m9CI0D8mMpq9aVWN2ZIKFAM9h5jQ69d ZPhzCqJsLBtfkEiRWZXOeikulQOvoEWJQjFiVczY5RGPbaA4JaMiZJI+DJVS9WIgvTwgpbvN nTwaEjD44uSJK5cTTziQt/GwHqrWIhRAK67UKDU5nHpaL84v5FbRa5mnPVzNtab74P/PNBKh ZGuN43z4domwG86sCcuVpnzsl8hxz4BdWp2gEA+XRBqFB3VFBQr2VsT5cVZmzrw+NufLyAFh wDHmKvVzc4AOLDJhvlsHk++uy9q1qSsETnvr//9iRha/K8EfJp0287BJJycn6BVVVDyYOttU rDIYUJB1XSmJYmCsyBoD2/KKkDxR34Ie5+PV+uZj+yf0aFZjRyRh1hnrGmEUuTIMVdDqED2L g8DC3bjuNk24ClYOgzt9gVZ7kjEvEqZxmZ0dpvlXqR96n/+0BFDD7VDOmhixhaWguFJg1swv jiYbY7slyzwrPZzFDl2UN0ckfZSVrEWCWWmRhL4dWncWI/trJBdoXFk0s465yXOROUx3iuzC BAhpeQjhRT3tgrQvfKETDk4LBE4IuZBLsLP/pxjrbG2W1iJlGRUMnwFNTxgbxh3mjWDOrGtc CRDuxT1bVmWmzojuEXdwRdQQwPDTzuIpGdyqqgcVqHNGKyt/PBvqEcx/1v2fgkfxcesQC/jC OXh9N7mToWh4H7R/iaTjVG8PXjsMYogg6Z0pgAkUfBwn874PCqO3PQ4weISvFlOGxrAQTvp6 F/cWTX9PGnoL7pu6lcC2CQMPT7wQP+3Y+3FhCEXGImEmaOBBMBxcH0szoFUSON09aDb4kkEs rZyMlFti0dZ4KmREstdFcPDAL+A7+XS8R3i4zf9FW6s46maqv5oaHKFaO/D6RzxfalOOBp41 dN0i2W9kh+tTtDAUNQJh2AG0hOcMZpAwjq/g68JD89dKa3+l+SDNEVJae5d9BJ8doW42NuG8 pJK3CQl0+q1gm4rxTdvXmq0FbB09RNGfzt7Gex8LtfT4uTvXhczjSUvLZ8vg4VrmKqfyssqS J4/htI67bAnQcr0DfdMeKmcqGY6zcDxwNNQ/nGW9Fb6e6uWM59ag6d77ucVKTvzcY6lqeZWi Od5VMJwZKZNuOu2lPfJOfIsNxcOzQFFmghUdUqIUg1VtG+jFnouGr/eELas6bi88/kRa4IQ0 /h/OvgUcyrX7uzRCKnKsiCnlMESRcorpiA5DiOwcdltSr3JM04SZhs4KxSTl0C4lu4PSAYlR CKN4Y5ctNAyTymHMKDPTnP73/Uz73c3zf7/vu65vX9e+rn21ZZ6577V+67fW+q31VL19NUuB n+OlCD/nF2qp0wlH8b+rIdUQIZ1BUlK8ReOpbM7atF9dbGCNEQF/6Z3wMUXw18KCWzAKkJI/ DXLCXsyib4Urv3To2vefkDCKv82dCgs1hI0vWRYANxFjetDAiQAZROP2NmR75T9PODbj/6Un muTLli4cL4YQWan0hhkmM5C6Wrpu5yYKO4Yen7MJlYtWP3T19naL5t37VNrZI2lh5qOK8EHy TM5mlRF3FPhTCrLm6IcFPFW0gGWCT9xPfwnqvyrOaqs6svmZvjdTNjmG37ubMAYnPn7qHa/5 oTMqp+xPZoonE8KSEaOoqzq+qvTjnmKzl40bjd3mG37ijFbGD7/8Btc9bZ317bF97nlG2d4i 28slZw8JKjNXVKjAeHUFsZ6PFptb2h3DE5osDP4Wgtf8x4AqBBKp3C+XeQsti89Ox732/Vg3 45ORopGU/xAs2tL8yJKyB1JSQvjnAaQdcGS5nJ2M/7sPz6yuYjBlehSBLziaVEC4AE29G87o VczHfof5PIMpzLxe4a6EafXqiyEI2xqip9GOl5GPKCY3DpGQg22XutKn1JtpYzMn4Lxm9TOB iyI+xmyihjGYNiDBdg2NTYUl+Np+KoMXc4HwN3J8R/YpyWFjQaKr4wQL1ibHUzaZkQvjGrgD ist9+2ygyJd+kd7CmjhoeCt++q7TGbDAAAUm7jp0TsEnqNClW60iK25iUjU0AUzdnUavIzkR pDXZf9bnaGFjzitRrMkR03Gygyz+ZW16RmAYqoqu6VB5lMff8HIhrLUH6ThA2V4yT7feSyEb mkK1+0duFCR01o/X568HfEUZURtFVLwQmKNOZT7iPq6ke/1mgCWm13qeYcJdBYWw06ebXzQx GezgGRH+7SGLv+/dfDfFkIxJ1/eWEgh9LE/weNXwOOn69GIKiFTz2dlMkJfLty1sUPksPit1 Wi21CXZTbGSAw4BTAThKoWv/uBlwZiK1DnKdN+rHQ1HzZPqL5LNYBRUVFJCRWl4VJC8cPmuj MCCAVLd/Vm6TuxDl9ld5Xfgn6QS0QrjO6dCjx4h22T9gu3/QUqjIhpJsnXt72yjv82rhKG5f OwZWjGAjIrDrfANHqgK5RGOBF45cuH8r1xdlFIWwIsJsYf5ok8z2ZMu5mYZxD2f0M8GMtnSr vKS78JZLDI/4aCjHL+SXQRbg5A43IEzguVWVjyXvvxmUj/WMjhrPTfp6GKSmv4HU9O2Vco6r lXXpnXt3o4/p+5E1bG6dZXrPk2z93kaZJUpFbZ7Gb/qBEb4mtP9Ikzaa0P6P+LCrqMzUzidQ 7xxsxqQwfF8uJudNoW5GCsG7Cmxn+t38b4qlcprCwBzgRVfhmNgfYkmIUKTlqxO69Wht5QxD mIvW1IY3BqC7lfC0HlpQCiPv99VBzN2odBKWxq/rq9I3KVqKtR/smtiwOQA9IrIvCOaCP/Lt +4tF5AMvgx0EhDqCnPWLMk3/qYfQVpG/Y6kjRbZ54uqLTsKdQpFtlg4TPhncFOO/vfPPt6tW hId4d/V2JIpPM+UtMd1f8JYn3FFGOGSeqYaj3Az1FYZFRk7sxJWID44Pch5oF4qTo56naMBN IfPgqgLadvv+xfk3TQjigjgW39Ea76oojFE11GpCOOb1FfWNgLqlKbnr0SNn50HJyt7z48Yo o3qBKctiuNHoHH5vVeIP4vHfo5es8tLmCjPw1+rl3Xb9J30ChUUemtjxVVS3bHoAjT4QVCcD qO0IW6VvGjhmYQPasD3vgmrPazrEy4U/g8dsC45Noa5DWrYVRUVFj0aQoIasOiHJIHUpFOIG pqGklZ5wyUIqm9NpE4pM3X/ffXivt1Dkzep3Aw7vTB0ByZoOHSrhQVQFXNczRx8tWiaYxSQJ E4/wKrPoE9aZsXUY1d3yhRDFO5eJFdtlmg4B8qe9k1Rng9SSzZaS5bIFOZz/YyhP58nlC4lu FOlZ6QeXTvqlZMXqlKa5BzAbWDczmQfrZhz5oSpXfiLtVSQhwfKtIdHyrSHv4JIH6N5B0jHg 9X9PnpfIJ89Z/yKR/imBZE8TF8wCtAXyBGRJSH6VepazYsqspAt3P6wRVv1Y/2G7mBawmFaZ +QJGcKlpZrNFxmruTm4VPmBtBrK9/R8yuxB2ip+Kg7X24Oo8buQy6MpLyBlQgi1XvpzTbQpG laGngcwQpPM8Wx3mFiiQRg5axX8qarwajhjDFjZfeMLUNX8KVV0XcEIa+yW6qh0GbTeUzUG2 p/zHAMbJzGrJxMHLBgbXJg62l5bMHPpsTgndO85qgYFO3l9f3pKiKKWdqpRjoplDJxJlbon8 Lt0Nnfdm8UnNF+Knr5mD/DN128xTVMMNa+tqZDKvw7cf3VXfj/+tI3i1MC4U5/f2ctj9IyNh he530/LEwaKhweihz3luy7j5GNWiYKw9lDfnaxgQUQ4v0/FYUCKuEq+2X+668ru4qw9PYaaK eolQNZEnzp+saJilpllx7CiL7+Y2LQkuVP3ZKgypfyIj5aRTxgvx2GnKPrBYbzfU0ZiFOiQ6 JptutyyY6wEA9CT+X3D4udPsqBsqtG/RAg/jUiKWrBWKnOK0O4HzJgOuk/t120CgIvrXOmJ8 YJvg6waLMRD+t6oVzfYD8WrA5Hk56pO7tQVVYkm8yP2SHwgQ1kkyp1UirqRqVVZp40b3E4Wu nznDo5Wdb7s+vO/ZwRnkXNkUEJQzhTqs6fHaQpcezUl9mY9y90qMD+S+pSamsbOUMFHb+jgs IgidDt6B8uT/Q1dC6VD/9UYob7AJ3bplKz1RFntobJh//Abt7eNzr++OFjpXJSaKTtc/f97f v6vCvSDS7ttWVHSr1VX2yWJkMZgmdetSM4xXi+18uqCkOHBbiP+R4qKKW/evXsW62QhmPKTu PGvaA8GXDk8fBG03A8DtVgs/ehFA2qX1MduNrExbQ8hVjd+0hq3r9huqPq3pQMfb3nJxUZW2 8STVvQvY0ds0pioFWmdeRppp654TUXe0UxvckZ+0lZf9ckC76QB1NyE3x3hLor6ebo45mfl+ KM1AISOZQk1TKzIFvKZywcSO1dQRPY8FMFT+VZzCQZl++eKr4vze388Wm+H7LgETERK5ol2y 2r5/T+gD4PaNjnBN+i5md4tZ7Yz33zfylGmE9sobXiblKIMugay6MU6DAownEXONRfy32F88 ORUFuGVbsPbwWxTseJkFyKkfNuEqz4NbdX04xCs6VJZVbJYnqB6r51iJPvEqFHWq7iC3u778 pMwUj01T9oGx3IG8P1Bb4VDr/bEJEFXTsuZnELBEZetAcUhIcDcwDmnlw4dDyrQHkqKHiv2s ptmIKzkTrxtZmmVWK5VMo8l06d1SazI9+Yf5NLD7FuffElQXehgaTg/tf3JpgUGFgigB/Ees lsd02kmV0+t/o0QTh4YmM5aVBAWGBAmkCVGTAyJitGloBsjw3ZLbmZ3d8aW3H1Y/rnxQ8+Tm 07Jrz74SPAFc71qzhkwOCQm5pL07mtHfrKbZtIf6JywtE4y3v/t5k8lUJceFmVtwGilFcRSb XD9IwKyWtlJEPGHHydxyX+2BMJsCNwNAwRJj6KIoWEhYlwzDOSm3yPZK1oI2AtZVqTnP1kbG NCPTCy6TcwxvBfmIW09nOKYp9oPuzPHYCvxtQJu5Q43ao4nYT+tljYUaKP4kVTWnDG3MDKNh frMC1ltwXVB9X+fZ1biwYfeYC633sg5KkxYJQlHJwRVoLwRpeuy1sH0Ylhng3FeMF44phhjM vW3AWJ55CKsWO3ibOXgVY128GqlO3LSjd07hP6oD5DFaCtC+s6O7Uzb4+eH5Nw86s6LzBMnn Co2sFRUmmHuBfc/YIHWXtorrX2prNa1GzlZ02W1JkKKoVLVos9yE+C+MLE0zbygV69AjvyAz zM5VKVSGewZctxZSE8ciPnXd3qOYPqsG+cutu/3VyzDtJkfqn4CBnGEObOMmkmMdQbZjR7rQ KiUvio2Zm3R8Z394+TY0H4EgDVHBY7GWKLHK2a2ccsyTzeCxXvBL4x8aM+mJdsIj+w+uFzoP 2WLVTTM/K5XApCYhyaoCTs//PPm1hPrneUZWCxM282CKUNMNR9O9Q+F0BIAycJxmLt5mbuDf LbNsV3eNJwHv2YDN9f3IHtLX0QGgkp19UTIfQsYNL220rwfoOhT4jWHsaDnmFBlsgMWqHb2T il+pCu5kuiPssCSPpzCepF+Hc/yh3+JfKKweArb1SDVvhzTE7bq49w3E/9CdvgBho4psDXiG bR7YdKU3+HAHr3kz/T6oTcdZ3v4jctjg8i8peWUiaepJuNupLRTudtraliT4KmwpFx6/0adM M2jW9xs7bnNrJkhdxlL2dUX1otobmg6+fQIPQBf9ojCe7HaWuNym0C35EglZQ8Sq5BEN64wi F4Er30Yg+XNFzZVeYj2/AuHyfmPFQIS/jEk3o20TJpI+t5GcOny1S0PSZ2rMciV/vT8UEhDh AAOGQbrfRdpFTGmJeOIiiJZWr5NcVlLvaDtcFyyY7fdh+PPoMIX3tavp0yUW8bLrph6FuX9g BMHYeX4nzCgcdzOK8VIKXTI8yElfCZhnWoLLMuoOtfWQKwbIZsYoowq1jkqNMESG0YZ2zKQ6 zFjvyH6bxvzgnetYuKEAdRpiDqUxi6HdwiwFLj6Xv0ObOqLj4AV3J3U3Ksq+NZtcAfSOzIx0 saca6p6ajrPZIQ5JYBEnk11JCpOtmk321AETmjuDqQ4c7c3ipjK13ffw2b7SYPG9aLgoZGQG oZ30VZAErWLofXH+N0W58Ed1Qy9cmzWF7yR0jtc29NqIVcHo0O1kdg3aqFi4WT3okTi5s5np qKkSuIh6Vgc8lS7dppotWoM6kefyE7GzLeR6gy9Nl+mzAemcJz7PUphMgYEf3uqQNaXTL8A/ OwdpbOjq6QwODSmH7krHIsr4c6qLUxniUCgfbM5v5yFVN2B5Sw8sIKbq+01+c+aKZhhPJyvW G1V7ntR+ZnOEnNChPW41FNGeuKT9Bwe7Oswkyc/h3tPoxamx25QwrXrgOwAWUc4crZH1/RR/ O+yMXZOlvAPkXfsaTjPLJQsHpKgkrkf+HdtmbxZbgnC+SJOdnYMjR3NGRkZHzbRUVE4+D6j4 nJ948ivcV65w4t/hd2Ywyy+8qLCYqhQxQ3xd0HtXkF/TNpOIetvYKtPMmTgNDa3TEkk104R2 ZTjSsiVNZk4JUC4tsarWfnbD9sjW8EtL8uatFLhDC14LoUTCT2GU8Rh/fEGq0ysbOAaiwzG7 UDe0B9qMWTa9uNj0ZWOIi/F8w08UQR+ZOH6ZAdcfvv/yB6PPJd+85GBB6xKWvttaSEGv5fHK GjjBDZwVlHsVC1DIl42f6ycNHWc9SY25GRfNOcvjZzVmpEwcfOrUvfOKgcGXPHFy+tEGQFdj Eqi7vUnvoX4g5/13iSbK6vHw/57nEUFCnHzgHI//VntuAGxKQnCKYRF3IUZwvYHTKiOIyZ/r OTPFxyDNVriaRfKrkeleERCVMO3mmtD69Ls6k21QH7aJureIt5bNOcLmrNhjH7UBG6Hsk8YM l48Pn3sNTUyGI7cl5eWLvieTY0nhB5Ljhxsn2/KB/QFGu2acnFYXU9rC2Pp+HQpq8+acusCo pxOkRp846iG+8wqKr4vzH1aeP67tUYxf4U1ay616HMx1jnAttlI03DgQDvxM2zqEvtKQ4MBf Lskm2RPFGnYEKSHCdiAEONOcU3EMii7dPbQa0Ai+tBPPftHO+/L+5cd3k5MEB+95r3zn33pF 87IbRvEK/VMb4ZnUm0gB4d+iCbK772366qi3m+lrn4KymS1Ne+DbJOjK1+AkRxpIeRXXNKru Lj3KK//11BTqWe1TUEg1IjnIHUTdQorSGw92IY8/Ofnu48v3X3jtf4fTKwVHJF/YTeP//sdC UicOgvQrtjldZZGmydQGjvrYYE2+4kfWr8FugiirM7FjBvUO9FtwNZ32Kx47cJ1nG7u8Q2tc dCpihFXViAj4ydM/yp7d+YfxhYzr3lQPXJBx+LASxhaPZVhcZxH3kTaEI3Xj+EzfQ73Dn5O/ CpqRpUdePX9KlqDsxh/aTYAwkRjhLnSedmF+Bh57UvnCmnBpKSylDBL2BZJgOM70ffIooWd0 DAQe48Pf90NRCu91d27Gw/hQepuNdemdu9FRkr8ASa4qp/+gudKLdxMfDqFyhUozzSW00/VS 6Yex1rZR451yHJigh/oKJ18PQgnow+JpkuTq1Ugim9Lp9w7ubsiWrfKZ1+p3Qrh2dqPlRcLR WnvVxfGMZ8uKrc7GMb780sDpER0uQ4USR+puH9K4yCWfCfX/XxjtL37E69wCqP/nJsGVSf0w YwYp4cKzsWrwoBELyBMtK0NJWDTPwUrwpSuCzdAJAZLZbBN/8BZPkhQl35iyYHCz2vo2FGNH L3Ce53al75xzqgR6yRGu6A0CyTaNZjdv/p0SvWhnfPlemBdnk7QmXHCCERPRMtnbNYFywCBt D1NaRA49VBogHdsfDYP5WjNK44qVZVZK+3SRRw4SGZYpbEvQxI5vxs6H3adI04E9wNeWXBWM +iqqYFUHK/DZfgU+0gLHASjgpF/QoyzG95UBfGI3N3DuiTSMjCzIdF9xKzfDukVBKU7dMcOc ErpyBzceQPUVEKJx5EZe6strqJBIwlw7z7CTrzjyMnL7AvJ13Wc3y+R7DkHmAicEKsyTNocf LiCEXLIP2hnTvxY8VjqksP31yAbHqt7V1cmSaV6Fq40XGBQmTRz6ODDS0xk9kdZiGfnG00nU 7+n0HM4LO7a95CSiotPGGes9w1mDWXQaPd7MqswHZKqZrywmXpAYL66xLjjfCGfTtr99nIAs V8gHQV3Y3/876hs8VjenMH1WDjwBR6gH4Cpeh25WzKzWUMHRbayWlt47AGgJDJRjxyeyp+NK JQPPlVFk74jytfOb2NEP5oDIuvCqIP/DVmYv6jlfgue8weMf2L1izBPbCZCK8TCNWWcTkg4o qjPXOcxtswtKfVXxtJbNYCY8frud9pzkRHwxcfDFtIS84qxhUtY37Yqz4EIKQsRjieLdew/v /vo2soFzO1pwDwUrtoHAQJ5tEVb92czMad4jnjlVyRPg1Rbp4fH9iviHfa20zYfE5RHjisrM DUtmRuDqXq2ZAuehJ2YAP8wiiKNc41j8BywiyNeAQb98lzFaCG4F3E8/4eLH1x2jqHdPUiP1 gEmr0Dfi+IeI5CjZX+93hP4UIQAlHrAJ/SeSR8CFBKk8Pun6XKb70VoLJbiDL/l199MWVNF+ RAeJDF6evmJ7QDkWAUedoLCzNzQsIW5qYSCrLQ2gyH7sEJODANmI8NNfgsEr5XbGe4ZqyFdC g0IC06bj+Hzt06l1fS348ENk6eF/oTLPIOjigMbsLYo7EE6KlYo6K7sy7KKZWxCpYaLTv0GG 3pFcLt/n+cTUCQCBaKOPof4SzWjq3qu232DvbaDqkRu6MzunAi8UAbrw7LrJbZPMlVRzKCem tc1XjH6w8Id8yY6LbyrmUPP0K/DcxLVcUaGoIhoVAbmaSATM08iYoumRBUGoSBC8bTtswxcJ FmR46d1G/YWcOYIAoaiXYkY5yeZYm1GKLVpiDZRi5RDTMtJFRqUZ9f4IxKRHWu0OxthuxnOd nxSa6aEg8Z4pQPwSNifanSAlk78OckzNKBH+vIF9qrsz4DNxWfyPGajKWmLwAdkE3GOk4Cam aouzGKmhJjR5Yrv/wB0oxH6FVC5UQIJx+qiLBfWsPvDSFh06ZT8Hs4ZdmOfjnetZuLhAUeWh GpSKX+FDOiJM5H27/eZ8/+9mGaIjiWPHS0v2RyHT+XfMbZZChTbOyryprU295sXMRQOpWhoe R2tH1X6m8JCcXn6PLBgESMVPFH1XKXBNdHVaSR6s59ygAeZ1lzmNJtoFuQzDonSXjKi4eBqb GQhcK9djhONuQkMiISDTOUMVdiD5+hHhtnzMHnLh7uQ6P3R1VNztD2BAjRp/kX7y5HQVaZ64 Fxlb+pGdI156zu/l8oAyU6VOC4Q2rnqQU6W4REyz6QgI/z5CkZPJvM5F+L5o4P93ZM/uT0GZ /EPwkCViCfEeqw2cXSG4NuB/DxOf3kZFqhFdh2qxRPIJKtg6c/6q0IIDJXEMuzSm10n3jYDm 5QGaB/Gbo7655XakwZXnnk4EceuHtrleii9nwLQuRULuUMjh3Q2Y9iUxwEpyAOgTxK58whjc SfqzYRhirhXxBnn8k7nl0aaNjRsL3RAvTPxRvgLse+vBAsI2EGQOXyVc2lBkyY8xBrHaHaQY BUdY/GoVDWMo4aQfdnRdbi8ZqytuC61RnkazvD38HM8GFLm3ulqyntXXNz6+rOcB6/7EL6hq OjYTBwtq5HN+Y6Nj4h7pg8cPap6WPboqzl+9JtNsCcghIWDlP50mMkC9hherhfiyncNn7l5M 2Q6QtX+UMSzSzmwey75IC/B/++e7VSsfQ+JVw+zudFsmQPCqHuKV62tJsFhqLyfJZw9FyVDt a5a5nGiRV/hUPil75iAbHe7Zv0Na4C1tZWU3XdeuCAZgxMuGM/0Dgue/ocrYfT5KOTaUAJDG foBeMDPUd96zG+2RuOhVmnFEpXnyNCTn/dX/lfMsQezJeZqvUcZ6bIuyDj3+80D9L6hCvK4y uK9SHv8Cj3jRfb1RYe1d9fXTaEOWZDqRxdflx8NtqwqsamffMR7/o5Ag9ZfWfDNsmqbZtBvA ozj5AsHTc98/dDcyMaKzuuBDTaNXweyMszVHVjtKxiSNXZWlTP2LFwM6V65E3rEwInXyGKr1 dOoCmfBn1JORQLBm3BJLwiLjww4kkPb1J8YUtDbyOTfNQunz4RInXkVpOSzSJIIfgPKq8A2k ffs8BZcZfXAEPreZej7CJMZASd+aTDnE4pNWRTFRBbrfLMC9ACc/z64wo1bMQCoxD8Sf7qPF D9OUGMzYWWfupNUuhWWYQhZ/AUh//6IHo7ra9ZsQDK5p8Gu8q1a/BWCwf6G23jrFD203QT50 edoZq5O1d+Xln89djb0oVKxfByLQu3bDVaaaXkj4SW8sPrYdFbpXqK03oclwFLcEHtHFd8nt RTGvlcz06XAI+qfQOjdpMgnkCCyQI2gU5gnyb45+OICC8xPqgJ15Sz90d/cKK8GJAzcN3xcr 7c6p7NKA4fRsxjlXyuTBq/RSPpnfK1+aBZWUvLJ25yUNGzYcV1YWCkkk0i7X2NfnTwIqkBmO 1KXziq2scNaVvr/4h8iDHdxU3JXAeV7nDlWdNiE1ly+BdNP1lQWgcHfvIJUlWU9Xb3e31+LZ s2draNT1WtSt8lZYhYvEjOt42xIXgb2P0LKkB9YcAWMRSEdbhryMP2z12nqWnrTcZYXD+Kf+ 1MTg/B8DA2+36zYXlS3bgkuFku/w0xcal8RIlHYRhDLlqjXS42eYaQAG1xCEYYlmqjjZYHYK I7LnU7DC5g6QoaZCPizO9xsbG8GY0K4YRN5uWeMjlDcGOrJKQ8+lz7SkhFJuDZzBsExjXIrF q70D5830w5Ej6hqpCoOLsFtjBYEhi8EslFpSNHCUxqV+ZUZKnVaAGdv4iKV/CJJbCqdGKU5T YWzd+4zZnF9hqLjcYZhjoulLHZhGW/LcANdiibsNV6hQ6HBancPNKq4zuR5Wapaq70fOy1eH zOGV0GF8MQpfDkFHaykQB+vkFw/Y05afK7RKq63EpA9lm+nQjfOG66PhOGZEShUqwnTLs/r4 48trTk+haitbB4tne7XHsvijydMrFAeZNZvg8jJtX32K59Ha45h0+EaYiFYjDnynz892+E51 Pew86Z8Jh+P37vAZzjADJ9T61qDCjKnaek+2J5vTRpC6XmgQeIGEUc+hWpDv4jkEbAvW9UOf Jdkv180rmvg8kcOERcqI9mJqBEoIVL70qjg57isrWk3TobSWS2XE69MDXuTxGidbW8c+kBfF ahoVxc+N8iivtniqMBEOYcEZViJuMJjETZvO5ImTPzg08ueculHLhc2IQ0/i0E3i5XIKuOOE h96GvhPK1r+I4YvCUjVmb0ZRP8CVf4pgSEn9P+bNYf5fzJsdfoO46UzaDHX1GbyJlNJlDyr6 vevZappNVtTd3rmFod7eO/wOHuKKXlfxjSOGUvT9rK0tycwm8tg1VCS8DS2C3sJMU2fSW1+T Z15gNHeWIo1eUk9n94Rzyf4fzEwjBXyjV2fOucyiPpph2GaRoUM3uCxHHsq/FYNkStbBmtc2 1nfv3I3G2NwSz3t21fbIuvAK/fBve770K97uFKolzBYXPaDzI4t4je8A1jDaWUkOPsJdH0ev wPUiQ23TVb6LjnCIzNG9cFmmxkacZZYJ7U0kyIYW3V14+socbMzt/yDQ93xfuKH/nX1eEpzx 1OVHoqMaayk48jYrCt1HWvPWoem12u6b0M9vC3plg5/Hmz79NezZwDlMubADXZ+cDks2X9ic ZY+X+ebmnr5QvAhgSiNsaEb+lRGcgsrxn4Ac3zSbXurGiN2g9EDX42P2Lq6zg+fQMRax7Ser tV+QVzRQz+mR3nlwBFVIiKbaMZihsjzxXfGC7kfNL1SDfPoE+PCDLOKBZJ4yDeTnZ5iyD0eT FbXa4C8WQpLtL0wcCQIZRXPDknUabhuP4v3VwKXp0mXdPhLF95gB894Hm052IFHoG+Tc2ZTl YkW9Mgc8cWMak+ZOEEurBKud+d9EsGqCVAkVqRnVujpZiKrf47H+SiWebKRsx2h/QWRzrniS gmj4i7D7dzHAz78z6I4gH7bYw++4EqzQfZStgJEZGZlTIkiHB7lqRZ5Y+2Iry9I7f9y7G733 X/uGK7qTZWtCZbV9D4ds4AsSPrT+aCg1yLm/8XRc6ZMwEdxu+3MxKQJ8S2DDK9iro9ZhDQBJ GhBTfz2AQkh/qCPoYDAzjFcnxfxo+P5+78nTP679qP/t+lH/M53bdenZ4T2QM2c6QWJ+e2fF FRRsClTzfKQhgSEzQ3wd/1ZR5IuTx+Y2rtI69RiRdSwozJhmiYYqq0wnQPwXDBc1s1SDQgBf duKKLpYfKEetDViu67EVl3GRnnqe8bnkdIBN6EyNWThKqGsfNwvDwoKnIp1n8eFlSda/OM1c LrF6YIW6+HAA1Q4Yj3d47Cx5S5JG/FUfhVEYKVQwuLgLq353dfAqtiX9w+nDihZax6orYaLW gGeUPhSs5vHe1v/5FcGcGnLojl8CkSb+7CGLOiojNbWuri6mUxitwVN8AQo8KSYwlxs8/tIi fJQntk6ui0k+o/hDU5U6cUg3Y7bWaUk1svR5lw+pvZkJC5d8eZsAzrhYWjI2c7KzdeaVvBo/ 1jwwp+IpctLJd50fpClm/yCrF4V+gZqlt2ELArCallMboo310AnwfAwwCRmDGV8ocxKK2jzC 1wWPX2acGYzEpZb76R2LLvl6mbEj3FdvHVYLabYT6j6OoH4JthNjHSi9J/GVWvtL01mGsjXY i8iBE+8le+9ANRU80vDwmYhWHaZpi2IcQXL4aKQ+SlFLgFHNA59qwuZ0AZB4TnIKf051auhH Jqxbjop1QD6OPMpkM1pe23MK7yclLLaO45XziC9Vthhl1tqrFn2EeWqZdhVq6Agb0+7BZsr3 POm3Fc6a/ZW/uoKJFFlK5MbgCAvEH0+qfDmW+9J+vYn1GkAwkSKx+Neop/fllez/X6WPQKb9 QHG0E0lRtTySt4LTOVG03ii1dikEFBy58PGV76tQENS3CXD58jzlytXULbqIOqn0Ufd3VBsL 37dfjgpbZqW76FNXzDAnF1YnfA9A/9R7RXnRyA8FFFxbODrIWXFiY9QGbC8UoZxhdtZIniru ywLn6NfH4fHboMFWlj2rGJcM94yA/ObDlhojuKXwexFg214+gZxBzsGhjWPu2Hy5N74510FR hBRAGbAIOOS34puqVXdfrWU2cLTMyMzaj8MX0JqoUMSpiNNN3Y1O4+ej5E69IqSLYAMFxAf2 /91FKPQAZDy1NCZVGNnGhR1Bxd94Wqn5Km8cq6o3yT9EzKZ3XFKp1KVu0UFO16tnNbrNgY2p luuLcucakUyV9ml5i2s+LH33Fu398eqI5GnfpmM9J/DTZ8ivNNH5G7rxWbsdkcVZ8jwwUZtB UBBXCST34f4JYRrcPwHzc6TlGrsv/ECyiTCFMT6LptJvgKurZuMSswpRLA0TtxXRjIierF3E XxLTorSN60y/ehVa7TUzMmek2SJ+1KT+CCpXtZ+BPGt5nh4wrJ3Q48Wlgt53bxJKi8tLZc0d 2vK1UfZRDLSYJW47CGsAQS5eW1i+JHP5D/8nL9uhuEhTs0JXbpJnPdNdVKlf1YLKBNXPnj55 UPlYEu/OFfkfilmF+iaxWojkp0N/dqU2dcsc8Ewu1wWSyR9JuF5OatbBayzi4QuEGDjMyPqq tmspCp/OAV/J1dIhzVYqN0ekbMWxxocU95CCn4LaR5j0Pmu6q9Zzolb5DLO0+CZziQouR+e/ obVF5mU/HIW50W+wABPlhU2Ao41OxMBOVI8a07ok5gOP/7DY6zssByYkwJcCvYOj8f7ZOUgh RF4PbGlR70jvbvmlJ3cKtUUNYNaQOdnGStnmVs9f3+fkFQHr1a+5apsEmGZhXuQAFy0RnELV gb2pmEyPEc4opNv+0pqgnoFi1d038LbFr1rabMzNQQZrYbFUXQUXKX//gXPV2LevrkdcHFa4 8Hg0FpEx/YvN/yqq64DDt/GRWqvtwYFInBJT1L4l3P+jn5FTI3S5DD06Z7pjOBTJtW3c2Bji VQPSJvuxarR1qIqXwOAGfsOvN3l8DzagTv9NQNQ4YdWSUfxDEWr0OQMdrJ5CtaWXNUVDEazl HcxXkbiB3JDA7fcALxHf2yYmdE4fcUX72By5sC7gN9zwq4T/KoUi/21J6fv/kKJEwJoVebWn 2ZwENico4/4dNxUMIvlrOXCdjEqvNSv0IOvsaGH+D2NnHw9V/v7/T5YQRStJCZvKPaUbNO76 7JZERigrd9uNtUqImISZ1FYbRWFIZigUUmyUm9xMKsnQ2FJJ4QhDKqYZMjPNMX7nfc6oHPv9 PH77eOx/Jeec9/u6fV6vS4nKCNeuK32oMd/Cgys6o8Io8c+OmL4AELHAVlKNKUw6PfsNgwk1 O1JYbRlZl458DgPoMDf39JT/X/J+f5Gh4fF295VEMYvEIyXmeaWpLwFPcVngA2ZawbTpoTHQ DBj9mIcuzpn2O5Xes22GQhA/X51rvMXgw4ED9/OeRW24deam0fJG6Zw45vHj93PQJlbAAkb+ 13aiK9hR169gwL+v5n4qpECRf94w5BcT3CmXUxZA3AvMLpDOExrNDJufWMfp5bconWD2Jidr 598ouGFD7uULE6DjW7VW4D9KhJwGEUiBmN4u7e0EPFJXjiB2qej6AfylS1fGgEbQ6+VcYD7J BZLEg76J/g1c0PFWZZje8sdtV0Re7iPpxCR3TX2KKVbW/wokglNEEBK6Z6W9YP+JIUFI3h/I +Xi3vU30jisEWk9Re5eUKeDhhQUWWe5Zv4rJiHOkbfnbyExXmuUGa6It7JYzkKXwwm/Tlswh v8I4YtrDl9FLt6DQAFNhIcODLoiNrr5NwPdl51vYIA7Q+J9lynsl3Zql3RtwRYP18hImabzz w/ugkIPBQQVYfwFVgPnaX1iw/NFPSVfnP44EWfOkYT5WwfIF489LkKwV7DMjZI6HtOLQyT0r Qp/yQHFMu/BGyQTVPa1b/jhTr3CB++/RiWxhnzFod4qb9UHvC2Xg7v8PBE61gfPrsBBfOjTz 6BGAGLAm16CoeTfymDXu3OjogICQENsLFhYWinX3D+qEm68j4ro+cvsK73FRvcEUI8ekO8d6 SWnBTzVx6AXW6LXasnyczycnuQcXl9w0MmVRMND7jTm6M6U1y2YIxU6ojKLjYPF244bXpZWL QA1Tly7oKhbQCV51VBzepbgQ+TJR/xVGH92/J+Zjw+iV+jjxaaURkqyD/xTNGpqV2O7+SK+5 NFUA6qv+CVB1PKRekxC9FpesqcX1ObDV2RzdJC1LIaFuexq1wbNHq4EzktVdR9YlN/oTK6Yt NFTWPn8H1G7nFdw4Z6etPBdUnYY3D9fjzoWznIZWYc1hIcFUMGdUuV55llTGCrSqbnnrqtd0 7S3lx75xqwpgBpK1nPhkR6+1ZnNa5mRYzY0rmjOtF4WN8aJTUMizdCABLJAo/v5ZzFEiKYXh dWkJYlFocOwL6aZWlcoo0JfUI6uJWfrNU7DkLsTlcGyPvLJdZTEGNzQjQc1QhlK2DUW4nvH3 7dK7dbc+7xUNskZ8Dyc7V3o8PDhZpon30SnSyQ7+YXk8ojA6wj9wt/hNemu2TQuNA1CDzFZa Z9y9TTI5AFBOifRpnZFU6Cmfc/ctgH38PADZ6YvuI3H/1eV8tmlhzR+n+kXynZX3GuKhNWiC lw0at16Q0zz3EY7uj7L1b36aN9c9qzLuiyPeviyWyckzu/AKgkTWrlVVdWhnBIuBpzdwwznB 9pk8/jlZp2DkL0mj8NCBTjN8aVa5cjWSuB7Y8qf3cbsBeeQcMeKh3BJfIkgoDlwO2x0YFXEQ 9CWidY/87G9BDLzMe7TeTw3HxEgnKqAVyAy1dVHLpNLVXGCbuhfC6WA6cqq4aBMuVuj0mPjj 47XIJ0NeXZ/5bpw6nLTcchkkNDXew7OSLjZCT1Q5rqBjp30AcBm2bCT6uPnk3J0X7KsnocGh mn+BmTKX0OFYtl6TjFwnDbnDLz/ewylhIL6EiMJMISbmYf5SQwCklMBMt8tJkRDlkyQsTp9O IvpHxO4F+FmPNv3dcnooRRBS8WlmMp65AMUE7A1I/wclIPEMtjEAVcdWKqGouucQPbk3J+f+ 8eNwTY9hi/2zjMZKtVlShVLbndVVGY5TRevME7TSD75ETm4j8dQpe5ogNoVQdACf56gtBI6M kcLsoi9lc56/a4SUH2tOM9M7fYGZ7k8FkF119FG0CbwEyKlN4SocFFf5kNkUx5wA5apVgjmk 0woh+mS8Y9YOdYjTK3SabhAnydvYX60hEkx9Hj8MSpDyvm6eQKVyuxja4m/hpr5yeUfK4BFX qUMLtgykRu129lzETn1xJx5K7/wJXcg07TDZgAh0hEfK55E0Ro0PxJ9GGZ78EKUIMKI37cpc AofFrwQ0+u19/VUtQenDdDssDger4tYN3zDBeQw5b5SQ+ApB2eeubmZpg25jfy/JI7SXr6NL 9otJGVPBR4yXpFk7xGQh1ATRh29S6LDPu36O4pwiq60sxEIjGcql9cQKXIFKutgDbX+xOv5s vr/3p8uC2Fqv3CJ8bSVQ7a9kphsTWhOA1jAT/mxe1gssc1YR2JsDur1P0E7QZNRGNijAh4Ye ObJoRD4Q+qtzuv4GKGoykBc3Dhrchx6X3vipDm3tHnTDFcSkSwEaYVUGW28wsxrr5+Z2Z0X7 1B8w+FoXakYVE+9XuJ8aHOo/GegQU6ZtqHP+Fshq/1RBhSBHIvlj45+VrGLRRtpX2O4JgO02 /UB1hlmvrTtPzKjzfSWe1qyn836TJiuAGkhoVqmkBBLlvyPioA8QEIoe9AMdisYAUfk0MX7E TayZxQ45pAbIxDBmWwIUm5StOHeqnxpr4SKM/WbXAgLMjwINpkdB0RUauDPmI/UU1dvI36Fp EyCzgFF2oPnzbXw8WYhaNXrZ9vSTAbfs1rpk7IKDbVxhTTI3LGbP/l1c0XP6P7b42LLCNLSK R0KHTEOzWPRPVvRPdksHh/YdesV+WrZTmwkGwCimn6VnzmaBrlMqw5EO0+/MT5dNOnEPMdh8 JLxrmPssCX/xAxcgxyYhnZGiQ930Fr1i11Ye2kK5EWcXCSpLKc6wzR3BUiTfk7jDgNDzzsAd KuUdenMIn7Ieuycv1ZTH62nfwpagj0s+FBk6KoxCdTHisd2/I5EKzE4YnJq2GEFCxcD9LmJW ol6z26Nf0UcivnoFq+Ivciz2ks+uMXZMuIKEUy2TVLeFqumd+sagTl14E11tVPlmAkloHnwD 5+zYkikS9YKWOvobFdwxspC0QrTOuRd/DckODQxnonseA4igDxJ9lxN5+85akB//AkYkG1fJ lOU5qSH2P4n2HWbUSH99CXfPTeS8L8MTenoUkj4l4OifbGEYAFdVGeG708s34x5PB3u8ef1e aYtU4hQWMHS7a+jbYdaF4U4zXESVpvCLA1uGCW1jQqvla4x0DDHk1wgiW4Mtp9OsrFOPH5tD mqQj5oBOvZV2OjEDtX9ab5gwWF01LfiKxJCG36PS2A/de8IaOCt0yQEi32Eh7t+HQWhxB54Y ftwEtSZlAUvTpthSauanvbig5gg3ehTQ1t/1K+CupMl5AdM3ESI/Zlzuf1JOLUolVrtZciBk jYdsy0nHL/OIzvoFLVk+r1NwUbDG/L82GxBNKcQ68jrUDB3yC2mtLWYBiBmsn2LG854BXRjU TQI/6bQ9bKVZqYvUkBri8YSMMOZXShIw5NtQ98bhfzVK8GNAvluWZnrhqaJIiRPLvcC8Q2U3 RLE5Y7rbR7b0HAZDh2oDqSebaKU518EiqsKqO7VlH5CUJGn2bNCJ0sgGvfm3bYOmUB3WnddD XrbzjJdtIkdDjCtoSA72Y2sX3mNkAHpRA/N4YzFNDOXKeVhedpLesRj3A+bNQWOu9vkrq2bH ZQLVmPqJjmTcHwoGHd8qJsSvBmfdQii6dl+vfUVoPODWtnJFWb2k4OHOnTjliV690KNCkegp MMJE+fPwuri14HNlNHBAaxwJDp2xavMBJFdng2qzMZJFHBosB1r+31vhn7FzNzcqxUu5MvVe QwIE/JSmNTcaTb2QzAsSLArelzZdI0ha7qEd4n6JJhTKxSh0VmRMiCHVTCidmQErxxXJIblT uh45BKUeRFS3Uxuv0sxmZ5avwEVfr+b820mEi2Cft/2cojwiOe2eUBqN4Mvf/H0S73Sv2K0F 4Wrdq8ek+VtK7lXFQydas8CWqpoowujbNlpvxRMcFg+GGPQKrWph6yswvfsPZpfcLwBFRnJ7 ji0SNhoDtY8IawsHey7B0NxfCTfrF7bTTkhg/gnLxjkB5syvgZOTnPwMDNmgK4AHXo6ziqOt axFnZsElBPBDFHAu+xZAsXJ5/CQsJO5ZR8XmbcythV9evEOj4pndHXQByxzQ+ga97x1Nt/Ma R5Uf70GjQ0K+0dfg0At69fzZy0MVInKI3yQSSN8o35eAC2UsUS7joZh8OIsFWs9whXahIlG8 U8zqLWjORXyjWX6LQjjzfg5k6b8JdeJtnDjmdHTNmUs4bR7miH8yZYsrcO1QP8fIucLqqDcY fiFyRYm9JKNx7wR8V8MZGA0qo+/HUE97K2kTb3ie87MMP+9dSHr16gsXcthwut5D4EVmzu4p wTXQZ0mpY5gR93HFjWWayKdDYrZHQWma+DG6yt0omn8gj8cH80t9FyI8N42jIR5/bsgxExx6 IrcvETlJwhIe302XEhAywm4qA5RTePkWIj5pzNuGpiJlRi28yltg0EyV0VY+/+50xUfEqSAx vSEFwsox+wuKbhZf1zM1rHUDCSbIMNViTgq3Bj3QUdA5vxIUPFy40YdAvLMGOYABAST09oUm O8/+WKKJdxaVx9BTT7+mwTwoR9NH+ePB1Cn8GGTW/zcjFRs3t7UC32VSl5yKbs7o4fL1L9t3 pi0cZMRmZE6sGh1/AqTURjFv/JVKKLlZeN0p0X3hSR3qWyf/i3/T1OvBQJX4J5R8p5X+/Y7k 7Dm/PzVi7rYnN4fpPnxNq5i1qyzWwr3sIiTHJ3Ee0Hhog/3oKpeqiTUXgaTSA2hYsfuo1WLc e7TrMQUfsr+fc3MNQPPE9qz+bHlvB21195WyBo7H45hTlw85ssQQqE9XQoEqhjGxlo8eefJO kRAsfJv2faio0+dTpVbaOiHJNwbkVOUfna5soQ1GFba7ZlgUwhNDDB7/Mo+/bvl2k42Il3Fc wDgBfH9zMBndEjfNyKyKo6QywOjOpUUU4Z4jf4T2PH0gy4TyG53EJ++9AJxQ1nZY0w1m/X3w ed+MVsJPoC5RjnFLdvQitjt5Q4XMN2yJA3rLnyq+bIiUbcdfLbk8N/R8hhN0y768Ua08zI1+ cgYa6lzVhZNhUq7cCF7sa5BlVGT6VUUnymlogUnaeuPWq3hsxUkVubCmO8R1bq6ueTBdx/OS fzcNBYIIbhWOrfjifmcBmPlwF4s/9nMyFfK9M+xce8Z6SRJ4EjEn1poai8ncqfa5LUUYC/iV c8GJJjh+RS7P007o5bu5J1IGvDMfmKzSn1oWvnFKvQBJ/yP54ypnTnwCGzPzokSHCfjvtwGd jeC82VbUae0B3mI81F5VW7UQfyB2YElCkUNGBHQNMZ87h9M10/DvzGEW8pPOFnYS2sHvY0CG +n0HX+Ojq1Og1EJJZ6ip1VHomRMCcddY/wePXJ0HxGyrkW96EpKq0/t+jrfS6xuTW6Uaw5k6 DZxTEs5ba+yzkiLKedtwB4ZbThOzGTGZmJGU83URrjmy0X/sFPOTueUD8yUzOEJlC3AMTH8V FxdfNzJVSGZKChVwTU3Nqogq16C+0/L9qWgnCDSCvpFEFlxRi08zTnpjlhQXK5JIZikQkwbc tIwO1c+GMmezQf5K39qv5BakQ51JJbrpZzb4egL0+PRG/+1PzzRwxOhFbfQlbuASskQlO/Cu 3R5UBIrSGchNsLwbFqfxo0UWCJ47qED5cPqXy5Tg7ROLC2GARZeX3raYNF5UCH+zXydAcIJF WGvXvZQFUZll6nXP9xEgdf1bsFTRPcsFHokSvOP2/PMpIb1k5bVrUO2kIOpbu97YtKDlSdfr 67jorVMmlVFCOB5mLTUJxCuMSgpuFBfeJNYBUJHIJYxklnzGP1kjSBDLmNDewQ1CQouvmP6P YJ6UtGs4mELtWU4/qkvWgrJh3BgVoJ4BtsSElFIZJ4OkiwFLmaTGMEQSoQkSN3onl5C+3v8A rlVqaXj+kvtsXUoJPZZHyk1hlGjsrLIbAS1n3xwBHY3v/CBaV7XR9F1jcsp/ZaBVcyQ37Opv YbbpA8kEb5i8er3N6s+RA5JyBsq8BU0gbqpl/W/N+KpJolxeorsBJX9NeViJhooLbFMqAjgj LmHdHvc8j/eHUAQoUzCkXrdIc3EM/BUARD5TWrHnyB2g4OKbJ5gIR10j8sPunhQC0aBpFUcT qfxUhkcadu3mJjMx/ujgRqoC+zaGH6XffL4BX/8zVEB/z8HDab9zzXVDu3v5j5s9VNzaON2U w718qrnFDESodAsqoFBXVcCkhnuinV5CQvnWJFzfRK7z9jEeycQ+4GXWZkzJ4VqFefuMIs5W 7Yg8ngabg00RzwCPf0x51NN4U27fhanLCtq2SMi3cJ77y5fr1q6vQExg1wfs5P4NrFb2TKvl jDU5E3imSZdWSLiNqqQZJlD5hziFVIbo+7b0C9CWRq7Lis0GZcsNRi9K+uWNv/FvT9ehRAzt URlU+iZk9dOwDxZz9Mh+nGvs/Xjb6ATQEhQvQsPeddz37IS3V+obkzTF6oVBBQq+bp4XYrb5 f0pjHv8EaHf1xvNPLhWboNDZ0rbh56X4z1ck510K+4jy4WErepGsZ7HyAexdG3ilzUAg9hie 3+AqJAmj9+9BU5b6OHGdrMQqWAoJL59eavDJRUx/EN9ZAbcNSLrYC/noVq7iLOtceCkt322h RoGbdx4ce64qzbHBCWv33+Wvasf/vT3LlKkMFRBdjbBY3ymumDgZQFNATD86zLJa4bnR4Gas hXzxIy0NDzN5M+zebwFssBoTMv9xX9UfN2QWMEooD8LAGrlpF+ERhsLcaFuT4Jhp9x7EyGcr XB1nPJLBJ5JQlM8jvT5uZB6PEXqxL4aZOB0MJLhfiKIQiRHk3w8NzXeBEz/XBU5fLYfc5G1y eSupulSG/anTs7Vsj76aEpC5UlyOBBlDDjWdKwz/v6gcLY1DEUB7hJFjzi3iXJpRsG/BVGya QO5bZqY2+k/GCvRQBrx8NBiI/8OKGMXBuvFPc9s+OuCHkp+Vhl4uRfdTg7KArwRQtUeRffEa l6rbpYvnuYsv5SvKGijdj9s6mqpeGXh0Of60n8Ikpm44PrIK3YwJTEH/jLNL8QeeBiAegz7e qg5TYETdYc2j4j1BMXveT3fpW+ouP7Pzp5X/egBvRwFxCQKTid0Zqp2XjvXyq/iaEL4fo2xh guEnu5jsR56mgIZk9fLvqjCSOE5ifPLeT0Ps0suAvQvPW0oVWrKRdwKatfGQZUXrrlX4KpYm hue0yNdZOeyU/6WBAwMqoDc5PEtQCw8+5NCtTQusWq+xcXOx/4m7iKFDntTEqFdnAaUznRwK QAl+qOZ7/aKlyMEPLknDh5PevyBZ994wE6XkLowU21S+DMIVROT6azCOMFL29yzxTrCSgmwq gw+OvXdglpua17ytbBeQdbrfwJE0SygrSr4cGB6ckXB26EpEJdAr/D+ptm9TOwfRqZ1vDSI0 7ipqev930wOVyjzkpkUl9vIxkuKm1htbUiQ9LyU2Ol8X37VDrE6Gu6a0A1vsa1YIJGg8d9Ek rakQTIqCst7iH4jfI5lekTgRMwf2ihPGtgsNUQGuSY4Kw4+4jeGYlVfW/5DzofuJ9/QFpEh0 EYy5iJ36lxo6KzGTEcmJz8rCuxLVuNE0RrY+BTrSw57tCeIC5NwzfQeu4c99OXCrSIBjOGqm FEuYplA0nTIq56RlTV9wjPwzniAsWMbmJPfY0Xus6Mc/WS2Vfd/p7D5QXKEPDvdtQaz5Y33R F6DTaoZEyMKBgzwZakJzvcOGzKaUw+N0QWyZFw03Ooh8y2WX4djM1enRAVWotaMbe2UP4mZX pM2cgUfu5/HPpzDKrNxHBe0mlwX0Q6IMWTzKVeqJHafxX5pl9oLfS30BA8z/nlBzL4+gecNZ HjBrYPhZ2QyqUT90jzA6Fkz2vkUnezlQbUaM9foNP9KnaQ35HtU94ugvuMSEP62j7g5WabZj 5sjRQFdpIVA/AhV461yBtfUoWsscUEs7ruYevNzPpUqt7jIPLf8a1zRBYe34U4VO+xRaWQAo YhwE9Nm+YrA8Gn+G5GelMZjy/8LtqOiSAx6sfKeOzxMV56OSSw7sEh6f9yxbQmp/5xHWaCBO vmiuvUHz1hRdyuTiwrVuGSry9E1iYNNBNdgPBCfqpVejFPFOzUsmeSN7t4VrVbZGYafVLjFZ RBJWbxN6/Zr+ASsDlY/EZOHgD+XHVkC4hQlVadZ7TqKSLEcBxZMRJcrRxX/N4J97jrhG7RGK 7vD4ls8MoeQ1UgELGF40QeyS6ovR+IzoljISHGfEPPlviT2ovf/GjX5xBrr1yswYNxuhXLl6 Sm9I0oYZGH6OJCVYG8ZZXJdV0LyjFDRfJk3I7WCbD4jngJ5GDJIInGLEmI9nDt+f4QSDVJA3 bUAJOHRq4GmbdmhWL/8ealL7UkK66yYtwAQD3Mtjvv4yAObkCdXRIgAa7/60Ir+l/MmzUfzT mBsiRo4O00+dbzYu9dVGJbU6Ypte4D+w9wIUR6J/9rwk00lD+xmDvb6BT2YEA1MqSf+bSNIY HHBd5rEytFmq6bLZpIezp7t3WP7tmpzS69fWI/ntYVAV2Mb5tRhfrnu4s8eKzcH6RNljfBkH 9r/gSd1h5wfGzQ3weNKu16853zEDAKX9jjrpfch5NZKFny+X8y65xwVucMmTu95W0TLIOXJt 4AzT6bW1aOHBmyOeGerSMN2ijiVXo3iZC5Coqa04AEeiAvkImq84axJT4KsIWUk0QtWKEKPS FNRyZw04W1ZDAOA72/naavruZCTzjQDKPUQ9CpG47WxS7RGbtRb/TH6qnxjpWUdFJc8x6Yan Bwzo+SmWhZd0q4JBrTGIG+3BJXyI3KyEW6ghl+cHrsBmoaipzx45miNyLZ9LN34HIuVTOGF4 Tlr7dynkIZWpUY+8AJhBNCKTxKRevqMuuTGIdBvXr7XTrsXEhkJWzw//4IRpoYyNOI3gX3g/ DQgkQW/fvq3fuOwWoyIfpp/ZnRFw1zrueS/JE92PEwvW8zb6NHBob8yMwUZ33K3b5xK1aDZV FM2wNzBvb9+Zpka0FlajegmPmqCK9Kyq8LsAcrws8PkVPXY3akqv3y2vu1J49Y4PV/RofMUM hiZsO9Bmy+bxv1N6OcQj3XVdzW9ai3WBGmqfXsJfmrWgHqRmQGnH0imcbFdxSqBnyuBPoYES 3AO2donazI2exnR42ZZTRj6ODKPgUbXqvAdQ2drJ/dW4oS3k7TZL5+SZcRHra0cBfbjqpQeZ UHpiHfzbQnls1B/5FUtjn8wYNOjQO+9kkAJarAHbkwe2h7gCe7QD1oz9fHT/ly4RYpUlw/Rg eeFbO/9VxMDLZktIm1rxJ6gzHmvJpNxKPxCQiUSrNz/aB+MT4/5Su1RgvLzSBqJCnFFrw2J3 PX2Nf3Fjc7wr4a7uKUlAdVp+uK4FcbA9bgOrrarqeQu1zRiFj4a6znVOW5kLLH8gmGAjCqOj QUCGzllLXO02Yi0ZoLTvkEOO3A60znDOWexMihwgBy6wuCLwkXRTOkE3pRoJVyk9qHAjt8k8 hC6gtxEKGvAevR1IDjGhwLP3Ow1OAKKTEQ9JNF+6+FpWH8FmNnEvW/Dw+dhU2A/mhaBXX25N rLHYorvBQRcevlsH7fDAeyW5hyAEzJoERJvivA6r11TE+pgZkNPRwbLnMj9QNzp3IEE1/2mf 7s9gjXMin/VHBN7MvAY1Jz82B8WLDAN8TM43SMVDgdCJf4FPvLS3GrR6iEeAGOOPNddKy69d L82BGaOHeSd+iLh/VjdBxyDJuWdyxTTmA4lk37/WaeDYx0PrZ1Z5zsnRiuAJ3jdIkmRAURjr NcAkI0o7KvGjOHY9RlhnspibGUH3kGgW5MYxR2mCicHl9CnCiVLC+lI7GoJ3j7OkKGDwGzEc jIrq0XBR48uBLwAwhyWAeewaS5v1G3gfh9BrcotHyuDxo9asgtKFU7pEPej2Ar4SZUbs5J0N YidRP2cvm/Pya7QEOfiDWTlB2taSwhZ4FUslC3u49orqyh9nPJwU1nwoVE+jPJ4V15YAYX3v /4F1xUNqr0Jipi/hAT/pMOhmXoWtc2H6D6t9WKarEX/hwRV1fTtk58KYtZ9kqGAwBCpoo0Cw Av6HHLsXKNWELmR7cFdjNmqS28blKXinq1x5CFypFh4f61Qm4epE0iWFRohznwO5Dq2jWtJG /SeetXrCZHKeYGIbYk/5K83xhbQwSS/NJrTsmCOmGFBVLvLETYgB/RLEim2tgF3QvuJYLwlC z/pUn/vDcvrJq2iX++Yw4pO73slQkRDPMzozH59LlzpJ5IjchQSTKB9W8c9cQnOkURI+mXzo AarnvuJ53a5RIAQfu8RcNdrUca/5fpkr0Aw8OZp68qvgDxJVYOs8q0dsjwj+ADtDUJY1EPGA JJ3b05X4ERv9g7SJh7gYdASdVlJPvo3bEFWfnmdmiLx78jvUhxy7+VgHf56rTDCtktA96bmO RCxW/uNy6bXyuluFV2/2BfMnuuvEcfmtNAH9Q3XeZ7x9GgL6er/soUh0f28++QyYCUzukVUz 7ToQ0SxgAOggoDfQPrwuyC9yrUtUXC8fLYaDmdM3tidOHM5JOXwfyhmD6+7OOFLadRIQyR9N W/9Vd+nIGAhVWOPIJZrN5gQlDYWJhbmgpVRXnUnFF809V2DPHxOZ7vYfNT0y2uHfHTnyoULY wKbe+eNyGAUDFhTdf3+RNrgb70rOqiIvQIfNmcvm0OYMh4XeQu75hV5Sgy1Y08Z65dNyAv8v cpUrfxNWOwoJsuG1lcaWAB7qu5XgOX1XqrK2sgJmqIIP0T7TVl4WLE2obV6Gj9YrAeMBsCFn sY3xD6P8DFMkh/OtEdQOPeRUHjz2Ek837jt/j8GEOInZgB0SOtB0rRwRh2zqBotv1ZaVVatp 5vUtpyu+fmg1B//bKGFaOzeONDMaNklAosa9jLI5M8jpKZIIlDGma9pgylKbkCtyy4d1Uwd1 z/0+TWX4N1Slfxmmhwf6jJhYoGhVeEUZTsfKTjsXOJ62ZghTkFCyjtI4696t4OfWgfW/hJNl pGyv7YeHX9vx7VmWJ/6a8xf637GLyivsZ8nP7bOe/Flw/e+bskGuKgQn8seJmn+u7N9VRPbu q9tPTaemLlBVXdg/yGYPDEjb7p6XWqt/cQ0xKu6IS0Z0qttCVCA4bQdwk6BQbnNE8M6BRAyB mj1KQOtppQ35i5n1aHgkeTuXcJXz27wZXVwNxLiebRjng6ZXCNr0AqCaISU/ZmzgPynKfw2m Wu52ztBqBUS7RPbrNSHrsHXsSyARMDAMdL+ep4dAlBaWMcoZveISwkeOsPCwwhafuLJmKLwM KK/+CAmjQy8zOB1txbr2OtRzn++s20FV9b+6okFCHZmdedziyNmInIdWYzJDQ2MxmS9+0P98 sKTezv+8m0lJ8UH49e0+0vvueg11vCFdjfkd67yAOh4LyNYOZLF/wR9WJ3BVHKmM7FdCEStn nd/hE8ApqjdwGuOhjKOnw31nCLTK6VGg3zQHcl3dUMaubZDVvwV/AW+ooMyH25p94e7tapXu 3OpJQSJkK+4AqNFCgoUi+f7n5AhzeV18RKlcqYIROxPstsYzSMr3tr3Ed/zz+GFDip/t+lF5 khG4S1cEtVUT0QEkjl6+4omtlmx6Z2qMPP7xr0pxEaP0R14YYgX5KKEGAvlNBEr6G6EoUcfc jySDRfHPvGhteMf/bBMmgvPfOQPG+qbng7iiN2d7SXc7azRmNCR3Y61k3pXMH5x2geqAN1c0 WsGx/X1wYdrOne3mZH1ywKta1hDeyBeahG4VitJ5pGdnLprn5SDptaYqQyE+futWJtPwOupn wAnTJEXyrSjcMMTRdImUUtyyGc6tsGIYAL208ztfd8tnuagH5+3VpbszEixt8DdSBzRWC+Da O8IDSFhsecSJ3ZoxVJKdv9K2hmIOeri9UUTSYF/iOCgFAeQtnleanAzKmHBNTWcnrUe35aTr 6pIwJ08DZSWD8Ml+1BVe9VelvlgXMRfxwUqaNkefdbW9IQU1gry1Mt8Sp0dmp+0DjM/CN1DS eJsnKGlmz03eSqAEBD5On5W/tFU//D7NjNFDdPbEAnFBwOXSD0NliH+rNw+xb3yEYheHa89Y BuN/7s+g2K6dEj7njNR2Z2GFwOeGgP4T3ygf30rZV4AhNIsihdu+zFnuA8+LnAKQ5DRdhIQj duynKgZKJ7JDz+17xyPtmjlc+SOqeTK2ja0hZGDlpzldQRp4c2zX4x2HJNSha12Fg6upkWKx OZ/HaAO2XJXR6gOLZ5TxtwBtK14Oj+9IoOR77EpvsC8S0LdWLGrEY0jKlXlYDnXodvr2fE3k BvwKkwMaOY7dK2vOzgD+ZaWaqAwt0u0K0P1uf+m+Iw1JQkEOiqSgiPFEbOd/U7dfSE9x+Dnu kwFMqX9xMdMdA5L6PP5OYTkj/5ONIkN/06UTKkUCvC85dm+1BCN0szxN0w41Q8WR9I2LCm5c LzzwR1Bw7KdPT1NACUH8zfLyniRCjcGyMyYqtUOTkNujnjDMmeggBoBSun/gIfJ4YwuSbts4 n0WcCIP8Avioif6nD2SRzG1uxLoXVFUuOotqRitUXJPzZ89jU7nOK3ZW+S3yg/qjCuL+VPZG ZwCXPX/2sptb+fUs5fbyW6vQkOa3y2Ei0iqi+lz3U4Z9mmrXSmaWTOl2VoVW5aP8AUsCxZAC 7X4/UJS88C9ZJGb1JGmF4yt0drMxxR+Hxj3d5/dI6YYzDdUYD3TdFxe0HMvMdMNHws+ckIBz LxPST6u2pPUjlrntY3df6IxehK6MiR6FknVJQ2tJrOh3zE2YsDn999eU1BHiUn6gbqp33uDP VkUVRymaLh0dXaNwQ3P9lbcX+For820o9Cx5TZfARk5KxQ+TeCBIO5QChH92NEMyT8kb1j+v qnZnmU8YIp/T6qqgK6JwKUOVweH49mfiTXsQGH1oY0LQMDwRoj1Ayc+719HAEdixPQnkkg4u 4U1IHAtf4d+iPovNSXXq1nB3ldIF+hduA+O9djPSuHQgw1ziLjYxMXAVOxu4jvZ6KVtkgE2+ ZGE0fv7eTvukdA6IfhYuW6sVJSuVrk+25Wgtihkd73p1pDKFxddC3o6jYVE8pH9YJ0xvxqWe 1KdAG9MGDIO39/TbsYUNnDOTkbCvfDjzJsgqaid+/ajduWVwlbfiiPzMhJOvgwao0J6LA7kh 23r2gV6qbcV8CF/7UK6chbgzxI/cWfVEFgL9vLmdP8RIz3iUddK9Duz6pyjJzxl+4oeR/FiM YLXO0mZ8ZDgT9K8DiNWa/+ti7z984EKq0srzesBYh4/yeApzFjDc+rJ69WY8ggegUyeNKaYm LRO0DPHi5VStbsYSzcUxQtQlZOeVSrRhjOQMkobhpdc2JzMfrn0SEuyIPG7UDYEP9KrzS8/b XF0fIKdb4quUdDZxWww8xn7D1yobTfh/nH17PJT5F/9WLkXRJqxymW+tZFSKymVcd1e6WMSU rma7yOqCkHGdSdraVGiZdHFpI5eEokIusxXJEC2VlfIwmqQwZgYzY26/z+cZbe08fq/X7/X7 o/8088znOZ9z3uec93mfTSCNXfhwBp6qqpl/DoSo4niz5bggTL1jbsX/JmFX4jo8mlxCPuLj C4z/6/1/uN7PJSanFIfqUSrTymlPhW/alZg2fu7WHpdJIyZ5y+RTCr8eDDjEjngzNnrZgB70 waF3H+YEys3neuA9zKgyIsDpOF7Vi7nWNp6RBzlV/M+XaFAQKyLPQ7APnQt1iCxZ7BdPb+u7 vFdPb4YSHJFGI+EYZylR/x4STvwpzWnj/hG3BAaDOaEbOVU8hMlvlruje+dJVw09I2V8A1fM F62fv94Nn51Bp9HbHZ43vdBar5+/zKwk/2ZxwVnHa6VlVf1MJnmwZ6Vglq4Ts3REUQsSWHkV dFqnqYbelVVlZTXa39MOFTY1kKWGlaMtyOUr52xKiPPWN5tuasKfyAj76A7g2ZtEhBzrwYnF fFLhLPBDMr2lw6U8Ml45fHvUsjwdulnikEASxInewREdtFJlY17vmwKnvV6Rq70qS++uJB8Q Vv1ZC+tLUKW5Iv82ztHR3NzKRDBLK2fZnNb08bezvkcb6wPLH6cpZh9Kga5OQtHworVI2Izp Z2xYA/Vsq8XZ+xKQ8tD2kQLMw+78dr0+vHZxds9c3yTC2ND4rEkUBCHKzso1Ak/MazJQ/34J raEJITl6/JyYVBMN/a1MWJa3O4kAt5in0oNMTvEKdOETLgGJWQ1kLpzt5IgS2atqFTMJXLAp 1Lcykw2J7Tm9NRl0843PxZIVSvMg12NTUYg55phy4p2YEKrvPhlYuzggrkmHfrq7duHCrPQJ 8ctEZCBYNeQc5ifSp5+BtI82vStWb+KcmHCJGLJlUKZYC1CycAIHp2GxlnQ0Nq4OJtwzhh3d FVnGUFmLuZ5lzEDGjn3OQFBWUmRkZaWNjc2ei2GSnxgmwB5BGqQ7LCgSSJC2cex45WotYK80 ula8Bb2SFFcHodvqqr+td2HO22X6hlR6dPQDwiROQbdSpqYpL6a5rMOzrR43nQrygJfKfMc/ UkWW6Nz1hLg62J85PFPW9kEfpCDDxczjmPDp8y14FpkZtTVGNhF5MCRm8G2XVfwMSWuWvYTg tZ200C631E56idFjSovs9cbb51qcb6Ovtn2BPnThrTC2YjlpZk6FE1GaWL8XrsEhdO2UMwNW 8kMP2K7HmzhUG+mhzjNCWPU+SNhFsQ1IFd7o+3MJ1B8ypXgcjZj6Rkl3Sg2NIKVAcpNeUp73 qTH7tOaOqwuHxBmJl0m2hmVM/suL98iY69DmiVtVYLdVquGKbwU+VjSQqrLw43ydpdS8fUqX DBvSreEO5FNWeqexCda541xy1E/h2yNTz0B6hZ/OvQ7Fo1Nq88IdzeHe5fIXsti3zqmxx3LA KXMTmdewp6yNvnH2miwe66j8jRcWh7AV2Uczc+L+orPYSLhURzv3hNNe2I5X4WudxmDiigfo VSDjlY5tp8xOQHxIbd0bMAbgHVeHPt7zHicZz9/jXysCQbFTSGh6XNdlJ6lD5T1KTp1y7aZe ujQhPhb1vv/NI9gmfVLyrGgIgW3SO9tQ72k+snr3VQ3FdjJkCXNQTaBwuSZQkOVxXmcadJja 9LKPxe/2K2Kjwflyt0O88t6l3HgkiFOVn7NaP//Wl3AkHO3kATT6Zzn7yRMTmQZxRdGtUzNo rrzUXieWs7VnQKYFgX2wRWGB5tz1HuD3QjWfRdZZ0XryUx6tLrdWLMAcd/KCxdNZrdXvW4C7 gb9/Rgly7lzieep/AzNHFWBTt48aPfUYqyROus4yYouuxOyaIANvpdKgmFLNrQiVPxEiaJbV moEnYuyrZ6uCeF8VHUWqtvNrYB8jUBBh0WNdjMpV4FbgkIp/sEZC/wR2IAziiAKCSHQm/1n3 9BjMQADORWkeul7a7UV1z1q4wy3Q15fivOdvY7LYV1rVx2/JVCXmPt1dvwdjw8WLki+hGj2z +y3N54HICSlJE+Dr+vpL2i0d+3V00uIzwq4z+TDZ+U58Undsi048H/MxM99kOdnl29n9Lr/4 9PLyRzkhfpFH9wz3N492tHprGXUnzdacUxvzd1f7W2FFNrpVA66+vF59C13Oh4NRzsrExMTt yoqN2eKMvwamoxdP8lYHyoMqpJCGEAk6JxOH2fUpjPNj92g36oWdsIkhHD0Kt/Q8++QDNeF2 exjaxzyX88q3bN+8FV9gZ3+M17VfGQKh4fp6Nr8vxZsTxzCuZ0dX+Ak2Yhzw8lnfQ8JW45PD vtTdcovauWPEQZFNiku+CSyqY05ntew1jLvGCYj6JvCaIXWByh58vcFkC9s8EZtcREIPTaCS CJG8aY0zlwIEXxmFRfDxyvMgrW7/3rUlNcVoDCOrIMHp2LGQZXFNF+mkTqHowZl0ftaS5Etw I+G9bRJFxhIu+e/pZ2Amlqd8kEI2g5QOKCP8uZDiGN0N1SfGMwzolhPr3r3DQELZJjd8iilV d7LQiGLqj2FmRy9qPiNCI++rZ592du9sFzFZhQAh/q2pZeQI0iyhTfntCv3BHJ5ZbUqL9LM9 lY5hnC8uuVbuUnRAyjs0LO7uVkth0Fj1v1VmWbZD7BET4WhhlyPOKNjTa5/pg7rJ2vJ5rpgQ CBAoiNcDLDZICrozi02SDB1+hSXLwoKbt5aaLTfVWId/fJnxJjjXojljeNU492XAkrmtpqEh 8pzgbMLGjUlwmKmkMrdGcWYOl5wJoAVLm4G4Ot/IsXj2x6Nohzfgt+Pybt0qLlAHeeZEzyiT X80kR3Uf0F+DeVd747ybkE/9qXQjSL9/8ZIIA7teQXX/bfPzdIcF+bP7TePjGMxfrpVC5kdx 7R2bp6ZG9gNRr7s6HEcmnj2FddQ8c6RWdimDtE3N0LPyW6oTy1dwnDEyi9a7JoZDG9bGJmQF y5OtvSLDhaICLnmBa7zpsQ+b3SN9OaLfDOjeove9HzD/wQofbFHwZtbaFzZ4qrm55K2HP4oQ YMuyvzUz3GH4V01XVCTpAqPtD0ELArJ17Rm50odLKciHReN7MG7TbS4A2r0tiOjvFgTgSCMZ MFbnQi75o0lcQexJtGa05M2P6Yo67049B5TcE4nDKtBoCwx4NyR/u9iwns2n2//JPTCs5KCg pw1uFjLdJIUBTpgNcwIDtz+1rPMEBsM5vIqyqrxytoJZ+jewRbUeAgrm+hepA6jgeSptzul5 c4hLtot97/Xxi5DZMdMwz+erDJ7P0Ixq3twqheq9eUlQNiLIV3OUP/ZaSFh4vW6nfcPSPHG5 YHfHc1hy+XY20SGaUmlA13y8ie/bkWiuSIKHkzVxKVATs+h92HZZbwJiVRkeq8hPd8JlKzGd b2TQyxx+qp5xHBUnyQ5c5K4gqApOZPF0Exgi2LiSplclaENz4fYHDopld1ioBSfHa0LeZshB /YKPhwoL8VA4ISFBTZ3L44aEhp7IWnmG8Wp+SyQJTaGTQhgo/7UUnTvrmUYLF7fcrkpox2DD Xc49Fiw2XPzgY04aHVfawALpqrPXdp/QVOLF+arOfqlENbz57E+lAmVOukU/Pb307q1J86+8 NwSzaA+46sGXrgfbwZ+Dtfoms3Bx7aOb4zqYQG+rlg7DdAtzGWethz3DtIQInElnZ1dXUr2G hkZ81sgfPzfceH8Jg9eUWrStL8OweGBXWk1WkSB2eNEoRgzxmziZxNyQmFnK44vfoAVjR/cY 63vi3Xp2uV5CQnRZw/4WuwX5dkdAQhXE/x/2v3v2vFvPMmWx0el+qxI4T5gVbh85325yVc/N 0kX/eJhEud2QhP2xYbj00z1wW18y+cXM8quKegROOHUl9yU04E9IdtQD/ezBhO+C3h82X0px /Dg4PDAULTwIN9I8rmtoJeX5U1pQNYsi2es3r6U1Wu9Se7Xw9tcs1IfXuV9Q7PccjDNLpV9N CocrAC7rm7c7GoNfdE/wVookIkFDgoyX5EUmmK64tQ2sJA887DXIIkE+XBUWO89MN5t7nmhY B+BCNAMhp7/zE3QY63yWiIHNYyM7otiBfHRCcUzRCVcIGT0z8Xy+9BxRuoO0c7uvmNzPBh6+ ZxWtl2LLQPQyzbtfDLjMoDlDQcfb+RU5X+zoxs8cQuHwandMDA++ANf9vaTd+G0SSuzvZ19l DJUOhV5P5wIANFIF0QI1vG37th2+u7sE9yprarSGc7QOw7bC2Ve36dik8gfcggK3m+LdcD0I qqVEJG5LzkpLu3pVS3yykXj/xtEWvttka06ql2+XJ5A0JiJ6R388Og9jLGaQveEmFDU3PzP6 Q1feZysQxLLGBhRFMgHC/tZT6u5wkpeoLld6ih42blHUD8IFL5f3RR+NPlNfsfyaILZoy4Ai afGbuMPz0ar+poZg34g4dAFJxnn+/H5swnTFqY3Fvi+XOLjJSPjFMYMJ/mXPOTaYF+ockeZC TQxh5At2e/27HQCtO5eJOnm6M+J/BBf49ZWxFZgLvA7KBVCbkK6uq/S1r7ampem8p7S4USV2 a2ykUjQQ6bZmHSODQBR0KODgbR5ZRzmpMfOjaT27FPoiXB5aad/sL+9xQoKE0RKH1xzCYraZ u6KmFC652imV6FsslnzojX/1HldwC6VnioJyLKwuFczWurnfe3lJ6+q4CPfLt/vIkGu30lP4 YUNHO6QZdAR1Jyae96BMcIdESZ1COSlgMoECGdQ/qKBtxJElVJdoRb1uuKxKrS6FEe+4mIZC 57VWr3x8Luq896fGyMZZ7eh6tqsdcFzPoyrTLipfnBHQyfw50wOVDuqX/LUZY3nDP0MZnI14 MjkcJGQWFU33WxNUaZWuNn7OezYf3TBgfBahquL5j+MYv2S2ObFq3mrFrMLENAq8ZjpdCCKy 9BIeQqnZ0tZ9eODkvoMrOcZKQSZe5S0kdJUCR2e1IF8M4ijIb/wTEH7Z81gMLwfHUl6xRUoR kYRVUGggKytN1+FG2z58yqwxi5F76KYWblP3NEwm5OUhlxr6a3DE3WMDhzB2sXwxtjZ0AY7X bpZKw9yFVS9aEPIC5dzRNOAB8nTphBOwTN/+4UmPJ8bRk1ckx8gZkNDdXh/0gI6rbRbzrf4u eLqIcN64olLIN3HNc39fh29dTtXUnKNRHSG9VcU76oqKYEFlHJfIZKIOQMYnPQpGLzGqZil5 j+1sWUGxQpvt+QrwIxbCDyt6RXXp/cAGdnPFBWt1DAi5pwwL+IQt3n+9cCz+9Rpk2RZ8Bn5y KpME5OeQ2l5tWBK7WaSwRAgtOM3/3YSm6ooqSkxtX2dg9dTb0ba6ffE5iA1WV0+z3o8x05vy Bg75yrDf87TdpQLJxDZ0zHJL4DeJ8ZjbZCFv+Tr39hpkbkQ9h8XZ13FTVFF6DrLYOwhUZM93 lx6RtFmp/rr06Ez6d9/928fPzgjTQTfJUI4Ewq1v6zTzR08y7lbHWSuOpsPN9uAZfUypaf8I Cb/9WFdlvbqefXXH7w6KSp+45DE4IwvevrzO+lUGWjS8yIBnULAI5gKPIhliFNz8q/OXe/H+ eCJAIlljY5qzayMJcNQCWL4NgeIv+VlV8VuceojTWGziGUnbsDX0xaIXN1hpWGTeKD/ZgLT5 3bxpDfGMN9npFgvg3Ox/eoVpJYOCjOao0R2YNzMOlYOW3Ue5fSi7E72uFDT79jAycTiXOFuz JqqzA2bfqHfLPQWVaNRY7OhENfbYp2yY2g7WRFuHYg9U7fvNUsr43U+N2eOQBBUF3tShjREy kiHKVKxcMAUoPSsfMBclydr6Z/6xlJIEex5+Ue/7B+UMfCgLwob9I2i6KwWzSv5a5nvcHZNj OeFWoBzSgRStbv6FdTNoDQkIK1wc7o1BlnMrEmEv0npBwTlD78oHpXdXOor6ROXm3lC+LQip hjtUmxADBsI30OoW8V3R7dtbM/kYbzMzHV5ugJPtp7mlzPAUO9w5IdbE3qir6HJWLn/wTgad ZIQIq0BCEzAP3/1oD3jKRl06VRL5JR27R7b0uQMXESsWrKhxEZAYrP6nrwplf6q37w1BzT0U U7SaKtMGqPxgFcwXL4Rb6FpXUKkRskCooVDP8wdI/XEDce3n6rACAyiBFteb7j3hgTMkvgdv TPn/wkzgc19+Ak5pH4Fi3skRqaTdSsL42P1QwuDJXpHob4rt5M40mXGY1AxWuydJP+aVfeVM 8qlup3SMTfQ8gQr4hnb3eWR0M9gWP5ftARuOWkP9+AUFzeJllqh82GGhEIc9bjrswhozEHsG ctnINTP2VAJC1T0vwwBPXLC6XK0xfF2/eQJSfns8RkHTE1r00S/UIos1Ng5rJ8bPc8nhebQ0 s/+Qh9Dy16Tbec0RCRJ4CPbi5sn1jDoNXDKp4wlIXrEhXXF4ChinzVd0Hc3sxY9LSDWDn4YG KFz0Lj6Bd/FXx4wTwY4ZwT9mrHxm68jmdozCc/UfFki+NOddG56Y5NXGiKT71n6Xv2v7buR2 H/9Z0ZYsxWnGuU8PA6czOluTPZKfnc59A+OfpWhd7yC2uyff94bsGU/bStL+KpeD7u7jlQen wE2F4hQDcAMtdSwqYn/YYWZfnjlygNLcMrnhRTNfDDs95UZnDfRVHHtfhnf53G3FprPrPaak jrVK0y9rNCH7gPOjLesefAjuT2SkUMhJL60GiF3O5azpq2by31Nt/L4jMkzbeYa9+dhAvniu B14zcR0+OyfkmF9A7/UMehPMWc+CnBXcDhU0Gl89P9Ob2Y664cBX2UGYG7m/SM6Bmdf4S4LB SSb5VbdeujXGkIvlAbn+h0fzrdNBQA6pZ7c2kMVbxbWfbgyKMEccgDKYOp484JLV3p3kx87c 7C70N8m4fv0PmDDf/Pj6wSlHzfzBweFI6aNEJICiGizAcmugOlA2l//qfQkqkrSK9pBiCyth lH/dQOZwS4PB0JHl/+4HMjZ26d2Hj88jRrmxYhsSrGSSDbp0eheH4LL13mOsRko2uNxSb6kv yGaf+VMHRs+g1Rjb4kMNGKy/3hFYV1iCJntwG7CuIE7VNg5BolO+GEMQyUmRTz74m/6yIOYC +LTlexswzf+nM9Hmv3v8N5xEjVUos/J3l+Hvsef4v2viWNcB0kTMzyjwrZ8Xnjw1NDPHU+l3 eeSJ/ec7bAFaat72ukVxAg2XfABSalLp6LDfpDWeJFBlly5LuQN9dQBxj3zyMYdye1l2UYJr 6NA23J2LAQsVxdoXIkPVZtaFMtKDMy0+p5tfG+/Rjnb/WMmM+KDP7UqYIshJNudJV7vo5HD+ +Pi+O+h+lJHXG8tYPViaC4T0mURDfZAzG9NgLoQiuAMQwfkdhGpjU1MfGlIY4pUFs09s3OCn 9u5ch/3JlXli6kO6XyA4l/p/yXEnGHSbG9e43Tr3zLHvMBsW9sUpk1vQ0CwsPocrL+unyNkQ RGlt4MxLGmzHyzCNvTVTBY+q5xvZxYzmwGERGRpb7pxJyqo9OYM22V1xdtebQ1ThpYYwwqoN rA9gvLQ9hDSDd7n8chkDkQAQMHeN76fv+mz8LOrZWSDHqIiKxZRVcSlKqfQS2pDfi6seGkQd ZY9JIkDRIQHvOKNlOLPf3FdDYw49Wva/CCdWx8BlHKQ25nTFhWJ8wRu4RSmgn31OzaAk2EJO VhrKCaUWdlph0q227Shpv2QuwMU7i3eJNchtQvY0GvhltQutsWyHWLVdnlKN8fY7PLIK64J/ JqMxjhGagCwGP6rSN1ZhGQT4UfsgYbjwIh3qnU2W3wZtLWfxThN1rC97Z3qJhx+8SERU8Jbj 63rrsC4eYqg73uFSaWA/m5ioGzT4D9OGZUqgNJDbBqImBiNlf/VchZ22+Iyw2lgZxx/t/5Ou 1WLL8mumMxCri/wbQ6oZ+vnVYZxo42ZTOJwJ7BeYb3Amd2V1eumBIevN2AiO4hY5awnvKXXv OsltjcuCLcKg4GNChSWM8O+b1OFuZvIV1UQfO/H+swhJm25Of1CtsIURumPufxiswEGOwRpO JazhdApFCdN+eVA9NMldKoDVrxOq6C40EuVMJKbXcvwvP0gFpcJ1aKGO/rl0lQ2s03z2qdMq pNqI7q86V/J9UD8JCbunN1om8lBq02XjvjVYgFC+CBz/hov0QrwZY2N8TultXJSb36WojG9/ Fx7bqAa8xia2oEgQa3bo+WksGD05Pc2USkd5Fij92fEz+5nFybGYJIZcIObu148cd64HWcOb 6mrxiRPeZ5Ea1M6TqmXXBEMUTF8SLkwDgGqsCdkz7JfLHdy18qU0xCLPbqsYbmVE041iBWoi WtWQr9fCVDW03370+/gY67IsfCGD746kJlsSdv9f1pIkrDZmwnrVWlsL8cQWdLgixVXT6O5a q7UvlNH6vo79kmN2nHSLZRTVGTRqCEO+6xdqQI0nNoC8y/4zgU2w/3ZKogHdUnqgRwnz7Xw8 5C11CUX9CMxtUxjftDPrUVod+9i3EwoK7dDiPpjSTlP/YMC1UkXPSHDZI0oBetECwBFN538Z 8WJ6Ckgbyndiqv/H/6qB/CVI+/GStvyeapnpnblbPCzOg3PooYFQdftIX0euKrFbdP3YN5gv PgfpS0nr8NChp9ItF110sztTF8dAwcGVB4IZeHDYK7o5BB2UwHyu2tTaFOtSZv4kGkgv55Vz yXtfp9XSNyjSlfh38LGKpGwn3EJltG/cbnWyuu5C1g5xsfV9CODXdqumY5uuUuV5KVCkqTXL fijqzd+TM4jecPHxDqjhl5wFS5ta4pN6/xhftzCv9JA3TEWk3xIxBujUQ/VPpfsMimOzjjKL Ysl73SOjOKJnTz9cYpaLMO2f438ZqKEEMWSHewRipN9q6gHZNbGnm575YEgfUP/vEtHQnIpW CSdJgRSQjGosKBFJzoD0bD6dyh4cHmrYGy52CF0unOLr1iitWEH1iIkI6md/OnCyYEQKOUGi BWYNO7FWHrgVskDmsdgTD35xzEgQUGyVeym2vads98y7qHYmfZ81CNzevtvEhlGiwMMxIR95 IOxkhapvMis8tJC+tvxxJCP4GldevzkQOI4fDcD6ECW0Adx+ojZMthv2f8tfYjOf5B/QnmkP TqcL6Xrb2Ql7pvsIVFcWuxsLDetdXJTX4dtxdW7QBXv/qm07f8ruxlGUwvxHwzuNzZwurykw fSSkmKRz+cgFxsRrAEtZHBRrN6tneQ2sojXWnybzP6JWkEq6pIGZq0w+Mt1nGbVjKRXZ/Tzi WdBGlDJy5DKBhKlvLJiJvn+SpZ5bUbkZJe8hPuz3KZIx+1wuncuXQ5O+fezuWj39D1Tp4ACH S76d5R5w+0/3PRVZiVzywRspDYlLjl7z4nQ9mOJXOcfliw3OGpfxyCBgLbvN49+BHtJyFQAL 7g+3fEjGviD3hQXicrG9wxev1jHp1V51KIsGiHWueGNagY7HuoZswZEzGAAxM+e8E3MfuInZ OebPZIvhgxGO6OTOUFRrmrn/6nEQFPMu+BtR0Lb3kaYuISZstK3/wksq03r4QnyWSV5Q9MNp DPTGBb+GX+ptGeU2nD8P+sYiMtYO5usIysWS6GgzNzxUEvtcgOf0Sp6OPO9p0q2x/9IrHBRn 7AqM6ChxR+0qQttWYa0H/Lx2tL5iu7WawxaVC3YTvRZoEF+9eGW1+t7de2S74Rg5JHneRd7X NznIkb4T3SQouIfOswShwzHWdnazUw5/wjQwwe0dUv/eIfcr4pMskYiiYThmLicCT5IWHML7 /ryq6eaLO3qNe5fJh2VZvtES6fvUs01me9wrj80nqtj4LWs2VaaV06fHTuEnLoC3wXX+JYG+ GNrGfcVpbVi9Bh+OZospT3ma5pne79+ppBQLlX9zSUBM6SoGinvigKkvRQk5WUbKueMkLfSd hE1R0Z0LQNRQz6rG7E3NprLlFMehoU9GEZIDID0Xw/QcLQ+jwxu/O15rc7cNuH3QYBHG/WvJ 3X+Km6p3P2szh/ArXJ3LDDnmjvm+2Toogc3bBFjKemApSdp0ozC74cHhgVgON9WA3jEkyHi4 6U0BloL3o5OQULly5W+kDEhHyWtYFJaKvbhxcjqbGjTs19pnEThXD3wjcNODkU43CNOxJ2+v hjJz/BviCkRpIFrKEpAimQ7dkSK1RWPuUZt/NpjgKeyGvaqnH3pEbHjTpz1QiH09pV44Q6Kh Yd3eO3ChJPI1X3HiU3/BGU02VGoh1X4YGhiOmYx5Pt5oN29yLwrs5qWkaB3wK7j6zm/8gjFk Mm6vzMxYjTntWOX/T9KS23mxJbQc3+o+vojTWCBwYv3BJE8U78QyXp7aoYwzwhpmQ5ORC8oV el9E9McWiIJBCt+kesJ0glGXzp1Xz/7tRs802sKrOx+621aFtzWOuAyPTpGBJ1vDlGj+z997 OC6rZ9/d5q8xBSBfBB7B4jKXvBm4W+B1fYHHnXPMPWleEL8cRN+Gs4imEch4R2sjYFP6neT0 LAKFdFdfjK3+9tQqrdgppfj1s7t+1i8ZH0AJYbHLjTFCV2gzEyW7Fv52ij9SbJmAvLw3Nufn 5UeGDB46scr64eKlIKSTI9rRVKc4qwFD+G7cKsjmO93M2Ui6bO0ZuZUTvRpPaTVfoUoYECew c8rok8Utv+BPHVfMMe4bPEDu/wP/zZRKMt1U/cwKNRJ/334p9nOSP0JqVl4a/TMbYHTEWb7z frJgCk604k/3QPDvUvrbAxb9ZUnqsPQgh/6Prl//ow2t5RNJIYmKilawGQHjtRqLnX3NyyvS bn31kMxdP392CAPW+oABFGkmotnIx9/YUzQpCoyDDwqjJSDcx6ODcFfgIJzFYlp5hmvmmPBv Jz9rD73ZRB2A2rVpW9YcA5mCs/tXDdJ16xqemDjGCsclDYNwZdpxxnkAbvmPVImnPPJnlxx/ 8WCJwRysP1wrh35Z2pq5zezsdG41k69OoPj3nQhvwbipu5C2May08KM+jZ6WJh3Os0QB4FcE 2NOLaSCB6l3vF7Bh88glBt0DvvfC73npTLK1pxDSg/j1aKM4AQmoWmmAqf7hupSYzn4VPD7l Lo/P4fIbqOFSyvOb4lifM+8GEC107VTXwWO1WOqTjrWNV+XCc/CnGM7NfRoEfgrCJFekuO+M dl3pKRwUshKQTM/LjWZdlVgv+nPPfq/Ig0JRDZeckJP6cM+uXMHbPEFGYNNzDjZrXErNc58Z eWbxGRV8yjJKyWtO144pQM6RuJTFtAaowYRWwrkDfQp9ZrTq9ZmGkmf9j4fJa08Tt79XfHs/ shEqbgCMcs+Hlo0hMc9d7wufliKs6mpBfDT0gpjnOdcs+EvzlqHrFc2gHuwsQ0+9IWBpGeIF IwprvFDIMXf9fbHBOeJroWiJV8M7R3Tg2j3ut765WOgVuK3nHQwe3GlMg5rFaBMhYpbAGvuh qXOBcfg+EO8G7tvQLrd0aYSbH8XXNzDQfUTrQAB5fpcf0lEXD7HqtjUamIKhU88T5ZYV1NZW OAc0IeyrO/2Fx5QEjSgtefWCfLsiwdtxmD7n1cRKJlnFX5ECtAkURJDAiZuiTLA4OASyMXxD np6tXT0FU8lIHL7COAsL4Zx6Fkw3genB2R8eiwQi5Xq2a8Zb+5pwce2TRSNbsacg0oWzLqp3 /pFKu7MuMEifYCtHN5VuFt8AOVgesIGm9z6Af6HPb4L8BHiW7MgvHYGbqKT/VpjU/ThVUrcE 0vQyvaSZ+kYLDSJ5UdfoJfwAgIQf7ptcwYM3OyEJu57TRrEtp6Wts2FtQfe/Wd3xjFHBxvjl 6ulu+FZTKj1CugxYoLz0UvuqBSmnuUl5lSDduQU7G0GRsYII7A8lzKv4QVhVCWnGO4SirPWc rVL/1Z56g4KMLE9xoCyogV0ODilbu+/QFDblitoUv+jdeR/Jczj/XJtRiORhr1rOOafVXnqB +WXl5EYuOYPL3/K4YX932jbxiuWo7PGhXw/CekoWk5+H9pPe66b5vHpFPRJ4RNYN7kDlZFih hzJ2hWlMgWWdTjilElWcWUIClT8GDW02v32z1H1JYDX3UHYcwzsBWX4kAZnVUUrCMqxyymBL VGDpJSwX13xpiWaBpJuVz9kRdC6EcTYBeczuTvJwj3VYkL/rK16TBqzMquDbI4/ZYuqXTjqw xc5AOhjaQeJnAO3cVcvAY9+eTKoLe7dWhmt9+2bAmBRUiOEgOeEIsGB7waT71U5U54Kw9c8y bP9MEJTDDYKyRbyOJ68/ctseyel2eUsaEHo0Ac5nC8tA7g3ns39xNCBQka3r9SjFzHIaZiYC 6oMxkHI9G9+BMnB+1AQEFrTCxS0PtD+exOpcLkoOE1YVfXaD/yn+w4ms+2Yuod1hbjiGaTaT vGF7pHw/hHeydziAxpRxcf1fPckG9DK/87YY/R+nrbDj7zopP7SvoNde7G+X32zPMIXE400b m/D4wkMn0ksrxx4+Ri90rDlpzpykc5RLAsHAp9Hm1kpU5GOMdHWnvIHA33cn/nGPibj8WcLZ fzZgLXX/8cnu7SQHhFokX3IW6caS9yR/lEsIkB2g47cBvhHV6+ykyhca3Hn74920zSQ9+SS6 I8O08OB8uuUvRTbK2JvHQ+c0syRh0u9pk9uW5CEmIESOcyEdOw/iXOA2a35djY5+Vx2QKOpV QWGYSaV6dZy5qBFceLV69px69uxd6e6KYuBytXq9TbXi2MOO4Eibci/401cAj1wjeMvJkbdQ pyJp0W3+7dPTD27d/QRLDHTCDUHkLmSxy2U0elfXDmmnkIC0IP55SWmyTWgvSnIdW1CcNr1R vl8wTVM7qI+WgDSSqruxpdhkZ/DYUF+uXT5EvW2/3hyi702B/Q1BhvOm5wXYe60/ayn4s9cR Y5oJIeBWNWEhOG4T7BiENiGPf4yfYZ7p+AnkLt+CiPdv4fpuTn7+bVzMRr+KLHf3S+W77Yua mOQn8QzvcHHgfxhzsADs6BYjHoVzQSh5Y8fdlBYKQC23LyRmhJWGGRCOYEx7AlIVB0dh2TXI 3vl8f6pNr50fBWWeBXylUydyJIB8M092PRRDc5g2PQ8KaETNi5Tq/mTD6qxnZ/abw01FSI1s pc2YjX4+LAl89lZQ/qXFG7xqFnMcs//rm7hR+WqVVs35QZ9KEpCBsm36plMEGzXYcOAf8bvQ Hxu42vPyNnGg7VaxYQwvPOxwjBdHpONzIgnTHJtbQYorpNEPHZIHtoTHkrBHKOPR1zDyFYI2 mik+cUFTcLvJUNQAz2LPI1CzaM6+H/m62vSsfziibt3fZ2DTi4rFcLNTrdjAqGDZTFc4tLCS XEV06ndxnc5J5941oLcuo4BU5dYtWL8/ItNY23YmvG2WTJv94QRnip6EUqDLZDNxGB2vgMkm 1CPKknAkXWke/4e0Lw1r6lrbbtWKbVW0VqhVxB6tFERQrCJgGI4D4gAIUUQmWw5SRUEBCRBI RE/rUQSqElKEACoYKAoqymCArVVEA4KCMpONgRAZN4QhCdkk71oJndz7fN97Xe8Pr8sfmr33 Ws9wP89zr3v9yZnpi24Z69pD99gZ4lsmkd6vb1CnQtanrSSziky2Ztg70L82R/s/f2Ebwj0/ udtrs29I35mzCUpDBjM5TW5hBVlvOnNANawu0RNi+KMHQuKJztfx7RRtYOpSK7nmEEh0qmwN vFyr188nyIkmVp8HTPmy98iv1ydDE5HLO75RlW78MnvX93CYVW9yECGi1GfzYlbw0drTEtpZ iXRh8HMm+hkkNC26eyGVBIuc1AQiZueTVgXq8DkCpyIuePng3sFJkkLJFM58EpHFLCT/8vdT vCXNbV5huOPkws5ZJDWofcc1ifQ1EwYBH4N0XCHQwI5VLWSwI0u91pPmO0rbVcz7QuklPaQ+ OMKCQIf7IGYndMbv5fTxpho0PwHDb4Hsv2YdWJpy2WRAgEJaMygQwLM48O5FZZXXRHrzp8SX g6c6NfSqttZ2eRnUMC//E1HwUTfHrxegX4gS3QwZQcewGXYiNNXFOVn4adVbYnt+hcG8OGqa l1I5pGwfetnxMFb8l/7hEc1Zgx1/O2twducuMb7ys/9uU2mh0tHxsihITxltikdBqPWq837v nioYapOmZDTsl7OmCEx7noQvV82fSmpprt7B0F7ueXrOff9wIQiqH8fsTEK0QF2uHMTbX0M9 YtieOeCyJJ760zrWNiPTT9apMcy5qvqdJJ2mKa2cb46UCtCFABQ4WBBAwQcxq6AqVhYf1fSA joqxzM1VP2RILgilnXnc2okJrZloqZ4eJBGoU5iGRAAy4iqvJgGhyQNJDv5sRBwPd50TujGi f84ex4jAYYWo4+UQ73f1C/mirkRNv21Axjm0k/+WaG6emne3TjIWDDFX+uDKtVZIeFQlpmae rpF9rCrLk2D9FJJA4wKVE51MmUz56Anh4z9JFcAxfoZUObdvGEGBKkFzuxXf8HGGi2NyS+7z V0Sb8fQii1fF2bhXoBirepIE2cPRY7mvrUiHkOp139X/Cx5gshcf/BuLCWAYxhsLO+JGbIGM LR5OuYFzomwXMe2/dY4oEUrFnTBlGXjnMd6XJwOLfWcadISvTBm+/0+Rou8qsQteXo4ERRrb jjqNFFXFI9+7+c54+ejJdwTuMcCkcJyvSkTYOmJ/Zs2uszBeGKQ4KyOi1RTbgdxqOXG84Gms VlHiIPk6u9PC3RJdlasZuqsYPlEWke+Lt0Gdcshp2yOnB/wOtz3XuMjHRl53aUbhWt6bsL90 QzVnG1z+drahue3cbZMUlT1AtJOXXXX+i+jYsJ6aj+She3WEmFln/c4+/yPgFF7Do2/9sj7N tfvfFn6MR+m/M8SGax0t/0bHtfCrDIp9/yQLbN3Ai2lY29OU3WpFq/ExEU60FxNDeNMUVckA qSzSKIIftBAxjRiLeF83TMNKVHMNd3SFZ/lshUqNzHwz1fuqLppz/M9ZiKqfW68JGnBeumSQ uyAw29eGg1w9lOi6ci/u7amBM/chnFFz6WBhaFOzVXWKeLYf9u5nqBMSsqdzTKnqqcCMrBj+ vx05MZektQCFWO3kdCydgzCrd0FX/P5o6L9kY7ns6DJK+1S7uQn2td3n/wkwrvO8+WwlFi9O ZANcwtFDgrBfx58Tf77HYIp5l3CJ/3dNlily5YsOWyZawPXio+Kfcr5zlKtOV29wG7aa3Hea yBibV+ymOZXSNlviwtyU/IftGDHQvoWDVcT9qtsMSQZcFoJMuikH3ZTly25dECfCGa9GYA7A oqN/AKK9dZ0TJ0jmDzMCt4EAk7ZXqbyJR9tZL5qUd9n67Vnj7P7eaRWeWB7LPrP58XLMZpdj tNKSsqArMQwvT65q4pLkTB7UP3kjodndS3cMC8oO0agGvalvbVT1jg09e9f0pNLJpzxaBaJp 8b27heV3SvwyzNobL3aS4MU8tbSV/eOLbrKEVbpI4+dIPv1jug3RebcB4OzzFXtXeNVz2Ae+ sP9LR5JelgksEFaxkNjY84mIClM5wo40LeJDBeEIDlSw/0PLiLOGkiyLLYhFhzmhD9Ks4UFh WfcA787wQQNOx4csZhhUjvx5a9e3JCtsayu3Whu5a9DcQMuo1pThhBd1Snf84hp4DOtXD+O1 4KBGlnBiuuqGNfGNT9m2aLoOz0WXmT7RZnAUy1vYQRS0mOECDQK426GE57hKwxxy7XxA+5wE pq2cslwNI1U5dc95CkTB4hx4Kq8oaCbI92l/8B3+9N+/8h1yvMwMfWaWblhK7e7uFol0P/+G wW15MxBOXIS6bSAZ4UV4mWbCFPAzVUPgHBKpURDzEv93ebll2dW9HMSpOxFAR0i5UfO03zOd 05zQQ2Jd9r6GBvPTWlTl3KXOiyhXzXDa9pTYpzHELA7Fav8PKkKP20ymP11hGv3JcKqZQSq3 2lR22TXJbd+b1w3p5Z3wqjqfMmvChN92WQhsBhwWYenMKhRLRJzOmXbaiSIqMIGuKbxiRsC8 3UnrvvmFP0HNbdnxVVMkpeb1LhFww8tZufUkhce/EmBnA/x0csqmPjcNcciqJ9UF/32UrGa3 GQCwM2n9NzrOodqJ4Pcv6YACWwudldarLmzCpMBSr+shAb1CNT93D17e//W793Wk4V+UUgRU c6US6bOsMOXcet5IXVm1vPU5AIOt/ySKOS07fizmCSjPw9QqQfOKnobwL1dg532tGCoPPG0f Xj5+snc68SFmcEjVht+/UwiRN627Bp2joYJNydDAu7FKLB45JVVTV86lJrHcqHsN3PB42F/8 inHD52ANcRwE6W5CO9HbGIlUxO85Z+GnKc+9on+H1WOj42NIJNlYuant7uUavzyHfOKxhmfb NLO4kH/srMCOeq6oSSbGn7kzPrvM7xRh6iZepaAset3Glyq8uT5PQ1Rp9lA6LoEXLpyJfe1G jKz/Kn+4SISBYrBjLWtdvZ2LhVpASLXLXa0jk4xsSf2K+KkcDYUkfY+y/Ogw/R2MWs9zan0G ZNEG7NumJJ8xSyPeMZppdiLDLFkoVR9Y2V8djy66cySVoE526mHcp98w05fuXIlvgGSA8uHc V1okxpr//5EQYs8b8ntmCgUqAr3VIh6w2tno7O7qgU5loZEe9UDzPNrMS0y1IL7HfQ1d6Eno esgjURxgc4iM1VnzNhr+vEXOK+K+d3jNfY2Le+Kc5Sz1rPV51TMVmf3u1mwwcxsUR4iIi7Ai AUexkC2m4qPrUIQB1fnoUggE/qBjzEzIMU6wuWEWvsPPW5bI3xW9y0+tzlTRyCLZ8Hnbd3Sc F2FXEBF2AXUyUBNxej8Z+Z6k6caGyiz/hYtzqLYGFIfskv+UEs7Hqw/agTf2FWE9IXz0EcMy 69FPlj9+lOw5ZYnjX4tJnHLWik+2iLD9xoVIkVo6bCUL1JWQOvpbZrDwseLi26uP2Kag/oJN XrWu1PBnEqIA2YfTzJdBZYYDcsXuDUlwpNExIZlPEmhMDNTkEBX6ykm9WqI8w3ySDfr5nlpG iI/6w46Gg4+XgPhv4C2uahEQOyqonZo/fdZH8nVt/4HKZAfk9B80Ql9/agIE/GoWCUqvhQjs Speq1qwdk6u70j/CrnTcH13pM3POw+nVPNk2ZVbULBIzma2WXtMahs1C1eLs6hcvqtTXbxqZ 7MFrOtZ3vCapKe2Wncg066tCVTpI7GlQBVyDVcBVDdVeXO9fq9CaqVEGw62mri5b+sL1p+ks rbe2WRF8avFTPSKVx9Zy1oqVrGZv5T7c8Wxfw1oSz/3llESaHld+XZUCmSz+TeuxUJKX2wNf LrcK2FlO+EXL9y4Xh19sPG/7LqOCEpyz0XmRdcbdBzcGsSlBoHudNB3j2VyC2tOy40WgtNwz oFApTddCDYnJe/AChrEUeAFDQrr6QFAY48RhP9hXrXK0pNFFExuID67+DHhGdYuEBmof9Sob 7wirxDgUUDg0CI9vIJobDVKRDgXIrU5kSBAhre9MfCXHfyHSyKzQMpL63ml69N3QgmuCt8hV Uhscn5KFaoayUABe/egg4kuEf4xufpcCu/bXELRbHYIcTuz5zs5OM5p1dPxlVC/AhdvMVMf2 w8yTZMFmdD484GrnUoLoOhlNAZup062VGnEFnzHp2Hjo+3SK7hUsiGbMQWkv6YWKVwDEnkd7 Qp5buZDMjyFPt+AO3LgIR4JAEu0lwL6Oz3e22RHbF5lnTklozi5qrbb6t8KTBJ26D6ctWgEC QPJJK6bBHpxhY22xUD/b0wWvyfDroBKNbBBCgepCCU0dBMp8kuaSFIitavIMKwf8ZHci+xuG qfFH2tltTW2fhNU1t7d+qg+s76rZverCvkoigxBgxUUQo9yE+RLPy/tDmat58ndy3nnUPKRC TqSNfjiNC0WTnicisZoeniQY9vDGPg3jOnDTiepAUv2V/bLolo+6aGRl2T//F/Qss7u4mluG PtkqWkcWotWqN5FyesZfteM002j+jp3nz1zkH79hZp6aMzsE+TYViiBqvMPIyJCi5h1MGElm knxnIxR1K8hSO3JXIjxQ+Wi6kYf+ElNGwrYKTF4hAkWRDyiUxh9zQk/HhfZnhrTnvlR8jDPH BwtWn/+3+/Sh8plbqDOqLQy2VPz7fPYvBd8sW/aPaZFKlc/G9nWuqw82sQ7GRSqyasr9OV8G RiKb3PbqEmJ4vq4sgI0gNYbM2zJKuOptJ7fWZ26JbLJRpTWdaBMHWTPKl+bgSok0x8Zfzrvo qgwfVqTGormjr+X7Sb4w9iOdlaz6CjvO18bMRoGL3KrshqQvZkcsGps+W0WUbbLt0P0kKkRO jxKIMF6sCVO/qYgmrRnw4ugNeGxQ5UlDf43hS352POHg73vCgRsdYN84rscb/9w0e1Nw/5Oc wbSRMna+N6ZffGxYoWsdf4DoR/j9aZ/aG9noLGcxcQmN5ap8J5QyfXAlgow3D58hATn7LWJ+ dPC7j1MAEngT6++0lFJsHk7veHp/FTuyNp0S0isDpY5UdznLqvAkazkrpeWAh/m9mz5Fg0UH lMpHQpqFc8So7Hl9u9jEs7SO1l6Bseg1UYS7S0Bs0P+k2kOZxuHkJFDLFZfZSG4MP90TZ1hZ r5Uzeh+PViYnN5eUOKVbM5WeLZPzGlUEiWc14fqb28czgwUSad9Vdm26NSgNBwdilH1uptI0 rEc53YTpZiESVmADVjSsnTl0fK1zRHc/0wPXoSor7auR96+LgvthM8t4lxFSgkeP1Lorlaax KEUHUT0O6fQhwt1lt69Ni8uQjHBLSmyYct6X2fdkZde0L2oTByfLbh+N+RFswSjcggO497hv Jxkyunn74W+Zksoq1ADxVA7ikybgVb3f2ldWEvcV7lO6l9I69CAqaLcqor25xC+Mu7X4wIGG fI+isIEr6wP4K4bSb0y6zqGC55VwKw3IfsNQ/Vb98K1MDg/Tj0RGHjoUFjhYz62tSL90NEsW PZe45h9OWw8sRJT+AG+fZdTYEMxPmnNrceuGoMNoS/P9aPEgRTF3iWUk3tUTqItMGhCnt7bL dmfMpzI6JdKXubq1aZsij0trbin7ot1MvDc2Rj8I3w2Mr+x+dFU36gfXFG8QSpWb7eM5G9+0 h5TDM9eT04u0MJsofFRedbXx8fWgSoOVqFP0L0qZX0bdJr+W678SdDlOPdRfDexEsrgKPVOk NZHvU9ZGL+cqXp/ztT+fGVybp9fKsywsDBKMfp1jLHBpvpefczOYn2XCYN6TTdqrzDvOEnf0 h5lwEbSTkFoOZYTurVSyK7DlOkjKW4tRPZJqNzjGhqGxkEm2TS8jimjJN3T2b3SRV64GFptV gd1gzI62IGmfemXMNlJhI2Jg6y9evKipxg9XoT6mjKArzOFWoRRV4go5sb1zZStYcGW1CKPw aIFYL64H3GI6q0IondBs3bFAtOXV/ejKPApdqo8HDyuuxKIvJLYTS0kuRMp5+NtF/n4lw8oS j3wnGuEm6AtU0aaal0ZG3477EkMKbj3tzXaR02pmENrQ/Krcb+RGYUPDnNV9jbc8eGG7h7m7 ZqoOp9nEZQQfW829qU1VHhxWKK8b1HqXfhm5zsxygzJQMvn6bE/CuoKCkJD08y9ktVl12IjV 2G6SmRvOmLbXxcLc3MrKVT8nyhxeR3Po3VQUo4v3qcbKV+majoamW0fg765OVzASRNg2x5Ib 1YarGSqG9o0gYoAeYn/87SX+UwrH5pCcxzdUHRvmYU9ftJ6RLn0908hHO6FULyXc3GL9eq+5 VB1I/1HdVS3Bi4kL5w7XIP0+fmzYqi+mjk1SS12a8WumxOmAMm+m0WqGac/VITZJhMCBIR2H LwJeWFLpsJnEO3cuyN5m5CunHzkiaX/S1HrxbeMY3VI6MwgtPTHAzxKE+Nd+Lg2dq9+GgERz oxy8EP1wwmnk/dtyoZ/uydhhpEoUYUcygl8JpYUg8fSDIPrszgLuA3qN1Ls88hazY7xj8mwC CNIWo5HhowOyJ12KHO2Krzi9lxwPX5blviLOBE899FnxcruRSiHCJhXj/S13ynJ9AxTdu48t BnkEJpLAgStCp+T5yss4l2+YW4EVvvBosbIsOoaW8J4ZautTGJLq5pAydl6xbFKX0sWgEr2k W/eHGaz0PgdRZU8PSpfz5lPzbokSVy8+YF54rKWt/H5B7jNDab/V8XfPhi9zeXR1oipTNXB4 Un1KxLjwzUt1lUCLi+E3q1NQrE3WrhGVMopstZk/2bKoNcAVa6JSlWvGGJJ2NSX06kSAESYo ecMsw/gVn1LauU5LbYLfPSynVAQY8SyLCoOacb/Mu6k5xq6/tZ3ja2yw0c3Czx6EEZvO78Zc Sbb+0bS4TImNKVP/KAALRlwQSrRsbjNITovYuGZ8mXPTS6m8xUYW24k+00E6L8WD3x35SupK ghBmQp+RjlShI4M9XaYwNKDeuLWnJ27dKZQGDW2ZOE/y2dyHzAPK8rCxYEyeNuhqEK9nUczE rlWhfSlvNTlOaZXua0M4bXzqYZCJcxxVKahCUR9cMGaqiwBL7na6nU88njXkP4vqIKIlIZiq Q0KrN4Zvpjo8rBA8rnRKR5ZEUjZNhG0K5v8JEyLxRYi7DXE690EM6pBxkaqUSWghU6EK7Xk+ 4kUSQKqh8zCL8XaayAUrKfB3XGoTWRy+WzTIaS06GXYvqLk059b9k5t3ypP4krSaK2ZrcXGj 6vAMFlosKwNxKxgdU3rQBgXM0a7mWPZmyN/+NWaHLiKmzFcSR9eghFEv/UAVuhvB258ZNiaO JPZ5bLgXeLT1XgkEe1M+d/xVRVAsukg7OY2sk7q3w9xHmRfMx0wZ6db0PGkdq3yxedAcAd15 LrUcrJIk7Kiwvev169HRyl54p5k8XzuWSRDqBltz5GPqchYilhRVYG8i10SZkCykj5Hz1ywb BPcqzQr2HU7i965n+R2RBfi4ND8zRO7LyugCoTQrt3FCK1AbmECWU9IhkjdmbDsI0lbrA5Bz zS/xx0R2nAt0y72OYGv9GZ1KL5J12v0NMBoTgAdWj0loy7PxwQrM18CJJvUsfiekLbAOKycD mFvVi1vPRkLU4DLflMGkDfOKM9dNhEV9D3OK8GfHkw7cb/c/EeqTmMI8WRZ0ONdjmcHdnaNn c6SXF3QG2Z/10S6LUo4OP1aokYQXRBLi6pwFlfFLQEQFUKKnClV/Ctva5AoZ5NKLOZIpkQKs fK4CiwGw1CZK0l9RdRWKzr+xFfX3t7UB8KU/nZU78i85MbZ9OM1mOdiBkSTE4GnlNnvB7LLI 4f7n1xU0rK0XEdBEwh/TBusNEvQtAC5Mg7jw5D5p6GfqfD+igxQdHXjXUugLYky6fEBBI/no b2MfOoEqJPC0JsK0GztdxEgg3MFkmM6wApg9kpEQJvEgyinbkY+B9zoZMzG+J8xpTMawggNw hfSDiW0kNnFkmqoQjw56K8L64aM9+UKpIqcHZH3RV3rs0E1Kkv9yZQcIczglCWEXyij9Qpor JbR8Nokd5MPE2ifC2CMmTJ80ptzq2BQSe2NapyLr8hXpyOKSkNzUOhD+Jp/JJSTPLtcBcQJB 8Oi+7rhyWBlxKNES2SvJehaAWBqYE+LhEdD3U9JYX8MtL94NmevKc6qbgvRtziWFSa6FR39o byo8HKJoqMkDtclAM63j5cUpiw4vwSJVD2EysgbJSPRycSzqo6qbNCVbAUeQocXdh/z9rR2Z v0TaWKxVI57skiRksYXoihnXE31mOLXpjYNlCu2l1mHC18mwaszz7tMvpoRj6vIXRgngFL8B 3EnvjyLKboKydoYSAPYswQjF35Gzcd/inLb7vh5ulQ3jL1JaNiQtZ4l2iY4kUPdZiLR1EVPP B3W0zu5bj+jaSxdOZ211tFBHoExQAzN6lESSwSnbAhh4XpQBa+I1L12CEnTHQGw6/wmwJpBy rMO6XsZE0xlyCEskVrGo/WpG/rvNbx+TgyXMlIlEyvGezrMAAWmP+vCulOBeokQdhCnvvEqc eIAAtxxEmg2YRMo8gFvbqITSka26iP8hcbd1tIky0WYg/8QbgnQu/H/p87Mv8YNMmTalTGmN LQCaVRqgmXwb95pDNflumB6sLmoPOLrPZAXz0yPMcB5ZaMyyXZ6DUxfnpMo3Tn7XO9n1RNb6 6m0j8I0ykRvwo+AdsSgiyXlJEMYGS2QKbTIlRK7w10X0bQpkk7HpywbIqsx/A8iyoVNCW+8s R3UQ/U2MCVyUq6mkBO6497nKx/5k4XDrNBQA/8YVMMC5e+CBh48dC2gtzSq7HtI6DswVXlv5 DgCq2jTe8Z4daFxK0UyMEg4T4T+4SyKs9nUlYtwbsebUpLOhnnXyrQmXSNqnM5IgOthXhWIG 6O4LZXqG3q5yYfNle+3BOYIHEdcxNX51St/EgJc+0kHQK79VcB2UioXvVRQ6KvcSdUVB4ba9 fHDnWH33+C2OVyttsKUAe3h1eaVj2uBgMkgGS7KXRK7bZLnBek9X4puv9XQRtjJUlkK2L6wp mAfC6dNtZ9HZZcaX+KVVaFxq8O5k17ygHHGiR2FY6LHWO7nWzhF/9TGv2aAAV+5NuGBN8rP7 7DIcQHJKNdNBzEGZ/iNankCk8i97uQJEW7+Q1Uyw6JfEjxtJztINBYAgdzcZRC3Ya0K6DV+S WKlt4cPa1cxGrAeg7lu5vn1JaueVhvLPWK6KdPJ/a+sXcMKhsgLrF29hksSAXCOI3Fol0h+D vJSCppYWFy+lyUgFq1hRtoZ7IRbVM2Hk957pIFG1mJUJvbetkY2k14KYCUrv0ee+9nP1mor8 G2Gzy6N18XLWqlTqhmC+RCh90Cuk0SOG6eJrsai5J+4YHfotkd2x7PbpaauAb205v6oInxyz 9QOx44vsm+LESqc0a/rgb1mrohuDBF+WSjteXfY39S5jrNPAIE1SgZWkxqFbPtlBoqUCt2Y3 yC6eQon0p6SFejmp5s4l5Vl+AN3Ee9HH9TaGdjWdq2+niE29B3kCm+Piwd+roEPhoUejrj0z tPncwm91dqJrXsv0zjMkK3LzPDAonSp03Tp9rs2usvTUL/QX6zHWjUrk9ZXaGFq27iUoHSQV wXLFFlDLVY4L02pATl74gFtwMCN4c0BA642Jrzn7cWtGb3Wz2tRyTRk2kROlX2QvWRpt5T2b ynhuWBXDl4gPLFyjT3IE6tRDo1mgsHW6f5F/wMVCHvg9PvBuqM/Nz0XeIegYiFncmOfdS2GO V+d0jlWhVlVV6IBIhDVIJLQ7Ci8TJtuwUzLYY/zMEOCqmhahtHz62QSdWLT9jiy6Uig12jTH msiwP2V7yXa9i/y6CIO9Hq+Nbm315zLvhjn5V90ojNvqXBLsIDqdcbdcVuYXEOHg35hWpqiq wFwrhDRMlFshlA4AeLs4e1dk4j3CCX9gDLNjjHJSFa8k0jdbq9CK7aKG4My7u4zcjmQG2zm6 L86+CbBfSWZId3+JYKfb98O8MAfuftzEtGc/7v10eUc+STP/h2kx+sbwGNXoHl+5YscxuaJq u6iwJlhO32pvpDuD5eNTZ6iLgNrR2IQhRR+EFD2QUYDdLti0pZx49PqDGNEnIMPFshG0lDEG Ato/ckpD+g7dwaOH/3nCSdw1vPzs3P7WggAxTrfsq0rmi5Csu7OMYrXdeWHtD54+x36czjJw 5OSsZvis0kG0EDrs9QSnazFJiHO28cCuGDS5IuyEXNErmkrYYbIOZRkvlm45dpEvTHOswkVY Vnq93My5hBENIPD10swC7gkH8dGBSzUgbmupy8VU+21uZFFg2dALEXanRYRNbBd1DKSYn6db lolrGkBUWXWJ30LhhO8UTSzciHvpZ3u66mcfBUlilZZR7E5LdQv2dnGmqzEjHQkv2Y8vLQ6R Kq9LPmKBOsmYkf/bSMdystAxC6zcp2zE3v7LKlQ6VVNXUTjfZwY3xoNvAZXYQpAuEbleUHa/ MXhSqmToVadBbSrFx6suQibrGWFvzj8LZQBXorzMy5KmH0i84eCPH/2aGTz8Zxs56PZ+UN2e fEXh5NXcGljr4l6aeReUO1mDjMpuWuccFoDqee107SWWwTcfZIaMNHCODNOfVGALGZ9FLSHZ /l0xmDEzYXYlhfMoQhoa/wbriVrvUlIaYqkyc3bnZYb0HIlwEAd61hnqIJUowEz19fpqzME6 G2rNttmxMktAEqFmGe8FISoVwSnW+4yZjfZGGMqhOYllryYonI+CcjzHt/stz/Y8LuGFbxax Y/hBXnV3ZGWv0WLEnrgAGYvgAjySSBuloSapfSbAuZfktDU9uJoVJuNZu5Q8acci7ETmAmfg TKVRJwVfcxqDjBnmnZe7rMiKnPi/ohhNHwp898ypziuol/QvUHVOdNadhq2PsPaJpCSzbGMn Bq3BkQGeYRGUIenbaamDsEd4UtIqJQ5Ekub9SthwCb62X7k0D62PcBbUl8AO1xEQVGS8AvBn rUvJzRDLkZlGHgc8NF3OPWm4wNVKDmyznydg9tW0ayWkbaIP944dP5ZRB9BvxOmo+SQ2v+or UHOFhBSsA9FSCv4Uc0M0PWu2qcmSnP5sPWXg6iSkURcs+tNBaWnG3UK51+Js49N8ALnBJ7Gn sxoDZ7ctLZXe3uAsP1T8IHOdq1edIfMn1u2hRWQb+y/Yczwi532RE+UWT90w2PNku18QMHTh kBS4MSgwxv0y7842is28O2sJ+55iElEtNBS3PO2medyRe82lDjbd90djHtsnMAMygkePnXSo FNIa1l1//0J0aJgLdQFm1DVm1vK4BcczJQ/LKbywo1hv0wPYpZ2w4IDPMTvNl3RL3bih8ZyN 7ZPA8CGVjvc8R7tefw41T3a9YzrJDq34xHhpzk20fpHe4QtUQbo0ib+gcq7+zThq2MmGMKSq iGoSIKW/6qZF7OAGeBzLkLzUuCzqkYanSX/iB82mJqE2F50CSDPzloN2Lu5LlSZqL2qmK/uT L1cmLP01jhrY92tNj7FN9s0NiPkbcyQgKHtT1CgckwnnsKLNAxkRm0WlMfzm4BFFyLC9c8k/ nGK0SaY6Pxu/nGVk0+jj6r6SdbmCwgEGNZ7ELxcO0ZykOQvsfTPvnnD037wTWNcom9qw0qjR pAkXjIsSa2Bb8nwMP8bUAFkMfVgHuaz/5QBZ8i9+ePoiP7mnZ+tyFg2bPeqDROZ8keMZ7sgN dxCx27Esr/octO5cRvBbuEJiIau8T2QrOjPxHJNPZ1Vs8rNwPpwWXKGvpU/kPdgucwCrUxKe KbFb6xIxsg1lxYrpNamWADHTaAj7+G5/O+eSH0Z4J3ZwmR3j7Yop+x+6BnGjQ21sIdmCw/kB I09PqTySKVG2t06fbMzz7KU0Rk9UWXB6B2ljl/hfz2SNuVELC6carAGCbhp4Qv7GLNfZVOtI CS56mfIWLEuVLvXLbE/W2UcknMR52xfIxreLjg8MSa9/nymBzfqq2DAkgIZ4eHj8yqYqo5zd mVtFLSenOmTUNnwwlTbCK5RH+2ra0ADvmC8PqlwJx0E/lF6tE9JaRq4Rh0EfxLyZL7tEramp fq3NTCiDV6T1VhQA1KUtWCq7q2gvVrS7t03Gs6kmY1dqfvOwvO9GDUTvBNQqz9xPQcXnU9BG ndS6RYuZ5u5difr+nrg3p/IhyYGjec8W7gcAlblTJGv6YXV2lOSdXYSj+MAJR27bZF77pOB+ CN1tPjXQu3s95yM7vxJ5+6sm3Dqqv6unwGcDIubUGWoZ5WbcxRtKAh+QjGmX3b40ba161OE6 k4WBYiku/nUYos/moeZIPwN292mLqA00xPzzXLSvIc/d9d/xNmUKiirJcXIhq/VIfvam0C7Z 83X+VSmoOfikuBfY24tFnaLuotTgr5mYNUl9aRvysfEuI67AyfECcuwCtQadtI7An12d7udc civkO2f3Faydc4wai+4l5me3bVItZHFrRl+bI0Hoasee10EMUwG+wbnZM+HnIOIxENuD8mmf nuFru17GdDCGT0noVa7i9fD1s9oQE1UWhjv47YzY7b/bAjhcxt3SLFf6Vr+BJMfOhSyAe3XM EexzcyQ9yRyx56egwOg2yVdzPZVB7QYkNewPG2IiXeQ9rgDEWnFH/KS8YkU0t1jhRXcQ5bTs NIrNCH6006ivMTTpc2pe3HU0paiavlUEgL440lTqZboBwShR+L1i+eSLF9ihdaPRJKF73v48 24tUhhKXu06uZo21Yy3tGBySLS4FD/H7H/bOM6qJt2v3ShEVFRULCgKCignSAtI7CCItkAgq KCpGRHpAYyhBLCDSLIxIB4EQREBAQKQEC6AjRUVFpASF0ARCDSUJnNHzruecd/3HD+es533X WWfNBxfDmN9kruvee9977kwGsvXgtx8je4EvB1OZAsCvrwU+ebZ4ByPm3e8KqVEJHO91kHlc 9kBFGMhcesULgal+zfs/iOVFQ7Maif47Xp9/JDF/LpTm2krqfFqNfg/FrCan5lkkGIg9Ts/B GSyerMppw3V9qnQQAKZP2WlNepf4TVdBra8GPdnuIwnmHiTD02Qoro7TOXrHxykidMk/y4tC f4qU/DUwTZVRQy19Q8IX8jbjLwd8PWVH7oVK9xeFVJ+aR0TvQkm8Iit3tgJuNfWCTdgJ++Od vLQ0RRK9sSe2ekfgAtedtxdoBz203W57aEc89tBO1igr894fOxzfHuCgSNN1FgC66z+yph60 9NYI/b6+ml1sfts5GfluDve7QfIwygkDB4LDg//5DdaVfO+3zW/GU54IAn0+kC36oYvzL2te fj+YWu9Gf59RcqnDiGBp6TcT1PaAHVtYb07/VRGQBlQEmHkYMSNOQOYt1IxKtQvB6JD+EM/H 1EqFhjWuTYq6T66Bsa2KUXRK1+mK9eAFP2u5FooP+pR9x6eS6khwtiyD6L8Dqh6VQayl6xFx zTqLvAInbXV68tTwZA7c0swdw75xUnU2sTrYgrAJr0/GO7dVkrNYRNarUsZYWSlDAbq2ITrQ 6dqLIc8vz1RVXJ7hjPPM/WaqKJZu1GM8xWtHkhnyM/JzKnCrhbYZxRw9HVWcDf5r0fDn62AV dMAa6F+9KfPPPQSXPAsEAaYl2lGNpmsvjFY6NRyVxVCK6ImOjrWuDnKR4BWesusIDqzdBHdT gLwsFhrc5GSF6+AcAWpqqTgDTkhWkSYnhP37Yr9WFL/ESk/nTNOXeT7NSWW/ttniJbWJ3P7E UugiuvKrwQRzaK6z+FBFgMOAEBsF1xWppRtu/X3mTQYcvQ+hBavR0LymS+nHhjwq8ffgDPzc BcREgukGnJMD8S7XQHZB6iwJ/xWKWTTtQCwlQRS4Bg4EnQiWhbum2YMVRhtsFQW+dLA0TJQ8 3OisLvQ10DImY8rQa7ZqHVqjAIutdPeHyrV83LCEZsCzh7TRSt+8h7Tqg1dYRpvw28zp5hfN 6bkSvFM5LtVxMFeoH6z4pouGq5VaKXFQcKfpU3x9JqApTj5BMV4UMBfZ9c2xOovopEDzzLfF KzL3AmXNrMURktNW/Lj8dRBHwJJnA3fg9YO5M4c24WMhVSKzGVP+ZKvcxG/B22GbJPuMF9Tp 4moqTgCYLWXESUFMPnSYx9vw4x1lrluvgbuq2FAMjENtfakZdsG75HnOtEospajfdqwUrq5d UAxbtES//8KaGp2b/1adMTUwi6GNKl4DXwuxv1wDY8/OBjH3oXW0K6BfXtebEvRo1eSqh7Rg exF0Y4Mg0DxLm4db8HOw7e00Yt6PmBPyWd5Pc67o/8K6VJbPYI7MaVwHOdfALxwC5x9/VeN3 HURPKBkRWJU+tvhCTyz5J36usgeKgHrTnIyS4+lbGHALpOi1kODKxMTvI3OmrrOcd1nfTQmM HAxN129m4mV9PkNeDC+pG/xMEv9bkHnxop6dEy8tMTGZ0/+gBa2/Uh/mw2xD0dVcTVp1tTRt dHEqFty6Bl11kUWLzpgqyShZkybkAvMxm+HtOhKUe/U6aA6YMRVw0O64AOC0szHggRTe250F Fa00RQc6VIa6OfvQuDR+uNscstc2iaAZ9OSKxZA5dl2MkhFzaWpk7rEAwHn/u/ST+wa8jAgj bRn/vNN9RdieMDOsllNt1hRdEBB3cvpa5FQZCS4YMeteZfy5zyLxOItmFagGt8oy8UugdgOa sa7mioNE20LgI2JQyCOi4DXw69dy6+JFBRr3Et0zFS5x8w1tsJV22I4nIjdYcDcamPQGGTGv HxIFgkhjx15GgmbYyt93ozCSaL8/5dVWn2wZITWIZv7jYayQHIEwH0FAKeoLC5JQ/Fpobvl7 xlRMBubH8Q9wK1BJVzMwMadc4RLG2BC7Y/M/n8ny+xlufNdAtcAYuElt9UojwmEaXLHKXrMa 3TZ08J/f1oPkCggAuzNhGkbpO/ukaVZZ7Q/hPmDYuBEffgNuIQ8RhYhCRCGiEFGIKEQUIgoR hYhCRCGiEFGIKEQUIgoRhYhCRCGiEFGIKEQUIgoRhYhCRCGiEFGIKEQUIgoRhYhCRCGiEFGI KEQUIgoRhYhCRCGi/ttE1S2Xukaor1ixYvXrpeWdZeLKRw/fA2G+VXzYkGb1Cu5AvqIb0T4z sXCnjDAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAI gzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAIgzAI gzAIgzAI8/8H87Un9fJRcraw2LaUTYTNRlijLUa+q/xuNZA9I8Sy/A5/shBZXlZKyR0J8Sid 7H+iv9L5Ugs70CD7XtkLnI7j1PAp26ObpLECN0CZMzB/adowI+kq9nhMTwPcw8a2rMwsOXwM TgVtnzTeIatCBe65ZocMaQc2O8A9C+3xmtXAlyEvK7hHqG3aiI66AcA9du0inzHhYKC4KIxn iCxEFiILkYXIQmQhshBZiCxEFiILkYXIQmQhsv5fkcVNXwcUUeYnc+ek9ClLzHYGZblPanl+ kL40ywp1FC2BPaDLyd5WY2bUoK2UQfUcr0DcQz6hRUmhJT1Jz8/z4lnuxNBE5nWhVWxWZ2lQ e2EqjxcSorP0vb29nUH3by/sDmKPSWn6TnyYGPo2/+ajq9z5wYHtCS0uJ45X+f3iBIlIGoQs PVoPpNvTuCdp3JHlTd/gTPcKU8cvLXF86EtTw30Rcwa8+df5W9BSATfBSi8RgLOkhj+1XKiD X+Kq3ATpjYcJVvideU94Urd5MOYFHwr7jFqebQ3lTnIY/jTuQug6wLzC/xHRx5GWYiMKCKvY kQkKxsxuoTjQlBlI87Rk0kPghmfmseFIfOg2NIuy3D3LHiIl0aKxWuVe5nQcTcIzjlIUAeZb 04I/SfAoc9MRtumhkZGgmn1HE549QudbdoY5Yu2lMDXbxFVo10dTCa3p+lxuod4ib8hoA+D4 Mxa8ubAaaPuVSWT0KDDsOsLBuwHmzJnJjso2YctBxVORWDJnnGdum8Yb+/JLw4dRVjScXcqw zotmjMjCRZ2G4CNcOT+Q3ncbJPkw3uwCWtN0X4TOsUntRacqr3i7/whwpEnoKk9sNWE2rwZE ZPG1wbx9abzYUgYh2z5vtHl5nouDeVz9BcEkG0hAn0Lq80dTY8ntSsvs0XevVwMa7SbMSV07 LUzwkMcNMLGyza2lwZQ5UpZcMd4VeiyN591CyR0M+GRFyD4iBReCNeiNa5SluEuXXr9jNYqw GJUh098vWuHTYiLBxKLN6Aizhg1SiSna+v6Ym6BwAo42qsvpTuHF3gWpeCp+GNYBN8GloQAw eIrTqLnA4/6OqvGu21jywqvKUjciLUUXo6+OeVYgCpjIZqHwkpaZRD8tY+b3GKfhDhaRrWOG NqAs5qAA+vLuo+zR0GtLL+H+QoDVjsHaUGshusGbdyyp5PuMYYVUJ42vMnhFc5qulr/nxam3 P8bWADqksZ5SEmPpymzVDVBUzjYHS3YnKOhxurU4PHXvPCuR0Fz7HY30vhXP4+DKTtqWwzwW qxJHlaP3oVJ1sQsHbCiD5nRHxZPHTun6j/RHSqDNKwiPStYD/NeFIsKTI0HR0tw/OXjbje7T 462U19Q6nB1BT7bfkYepAGeC4IM9yVCgjvFJlzkoRgteVlyPV5ejt20F2osKnbXpzzRDL5av B14PD80tcUfmWv5TEZiGikcX95V9NdW/rDIbk8qjTI5EaPiEgjkl1gB9Aea9Ng6dCUtBJdss sK27sDt8KAaBviwOFFAXq3NKnykbVEiiRTZs8FTBs6EUM1Gx09L3C1h8M9o1fPMKW+ekfQdk 29SsiEHDD9ac1CcsQXt5DDYAIgQp7g0og+rQZZwEl8LDGOSIytF9ut/GUZTqsxilctQ4m2gp yV2SJ0QAXnIKrUsM3WhP09VX3d5KafTQ9rMgpPBqE9LayEs/jyoCrJ9pYFw68XG0FHy+mQvq hy7FMz6St6dipLgt/ADJO5QU4kXgfWStBlyzXkeUq+AlNa9cuHLOs5rM1qmh3lfMs3KjT/tr D0/M/dJQwSUeYUbEfUTjCmZg0k76QxRf3nIId353TdZ9bYL2PI/rTjky6OBsR84JsXQbmP98 7gZ4dzUgBH5kNVvjqZbovi8sPQ5b5E0pYxNaJBfbUU0VTcBTSxnk7KnJtsHQIKhMNUyy0v3z uUN/yZ5H9kvc2gAw4SOqbT2ggiW7es2C9eMVAfY0CatMYmtad9WUk3YoTyVVAk06ROtKMGZ+ OAwpc7HvSOG1yAJxabohSzIAqItfUCwDbwH6cBNWIE6a7zQePJ8yNZsfYMS8by4CvZdG533G wm3QFXfffENcbLY5XYjtpY8ff9tKYd2+C9ZY06LbA2LjLdHbE5ScX5QEKsThe0LnNQvzrHLp WfiGBVZ6z6F8eBOr+OxQfZ9JEhxKakuIQdBmIfq0IaF6IdWWkp6WrCXpM2xKk/A2ZvaI0bq6 TAkkWpeBslgCPpbaHkCNbU7RPUh/Hs/g1UpW4BuCtO3QfTMkHXyiE9MWXtqxXq9klAuVg8rC Nbxk6WIrA7VSufr+I+c2AFCZmDWnJ2Mr+4ooJ0UBa9qo82/XoHJ2ZV5nQ2hFztRC1Pais4+n IjRUHOGrW4JgT/XCbirKpebKZPVY/ELvXNkXMZou6fIZijfbVHuhuzpH9VttTumuTCLvHjjc p+qf21bF2K5U5BzzGpo2gmfm3bWXduGAvKMNcw3mcFOy7dr+FWLAFDMqYFSn23aht6eb1bc3 1cPR8WwGkTzZNFzZ0dfWvBU4GUfx2YunutHn1FspIvV7AT920OK3SE1OzdMAxW77yst6hXnR iSBHRKp+kuXW2umwgCbm/KXO3eK2O4DxKKlGHe1KXIOlNjmD6H6mNoWr6IgfZ1RQzJkuegvd XXaJxoTpUZK/BfPuuzyo39CRBYYnSE34nkrSstF9dLLDgkxtAvyYYKW/0NUsF7jH76Ok3uho q9gmajMXDQlBUzoudh3kmSC30FAXBtWYELoBcM/G1FBVN7MotpIxpYyxwwRtbvcDUOyxVR6m AZ2uH3Xsb+MiY9+gTLDCmVGrxVlD2TY7hOh94WBO/eUMIqaHKxl5nwGZNgnVUIWboFIrhWSG nv7BwqN9uqovcTg6WkcHHHYUf4IdECVh3XdASXN8hU939V1tQqCFXBo3VhzdZsh8Mx9qsFBz MxK0oelqqqUweIqygFtC20FAPt+j/dMka9/RhmPM1xFxkvUX/mL91isz+417r3PISVOXd+ZW bxusxeU6x8rRp9cDw6jUYnb/3OJWwEkYGL4HEtlBwY+i8Yr99mQy4aDIUSp+hyug4kheXro+ /5O0CFvujcI+L8vw91SJu9XSbROnGmY9HPsooOX2FqX0bmVsRwpX8luFj20K1wYKJkU8e3aO BWUE+fQEtpqj97XLvqM69/4RZv37Ziwz5uHjpgLMWUI/fB+hJ39nZ2+qMyrZKrEB1caL98pN 0dIPebaLpqt25bT0enx5ZokPLm5YDcqKURLFRi4OT50LsEk/3pQz9Ykpn5/v4dHeVwhKyPs0 /sWpU9ueh3DYBbfiVazIIV5jIxfPgVFeuVZC9E5xNFRMRKHhIFAs3VSLKOa0aDe6LL6hg8Xj T70LRmbhGm2aqPaVvpeHuxaEt8sepfL3+h0n3AY06BzFcPm/daB76laHbUIVnYw6kkhFKZ3S DPVGpXL0L2Fqsv0DHlVmluygRUeCLe9YBTfBGi28pK6aGkZbnXJuaigABURZvvd6bFWAqQdp wMe/vMMTw4tXP+5vL6Qe6TgPMnPqb5bjqNcZfa5ZsiYRG7x1F3Y54pdmsZVZSrb4Aaj6Qong P895249XBPxzB1sPqOVh4o6eOn78+MnmSmIzbNyKCJs+cj550l3+T1Y466qGBio242waoxh9 Eebm4RHq6/DeUwqpu7ozibZu2cQr52Z8m/BUey1VHRI6Fyx1f4KJvepSHTA8xZSfLJj/SzuB X6nkUhsw/LNeuNI+LcYdXGjLHTjvRsxNuaDDDA8DFW6ARAvm+GqAOUEKXNDRo6mGjF5xxndQ wfrP6Nb63RPCd+WzHOGDlxD29uom/lbzLc6x+ahOKzJRvedjJBkcinfNUrHtCAADTJjbCmlW osAvaD4/TKjOFW3HD9jvmMPbHMpLeffbH8U0vapnz1KIBKu/vsXnlQkJCQ+SjiTmomRxabfm auO8h+L5OVm4gdyApDDQ2tmuYxfaNRuza0lSLNpeqwsFuNMwOaBYfrQD+fyZMyoX/5YRNYob Ucr7UNtbTLOjVRl+WgQwvu0jCsq+h7kS+gEXfH2lL4FQbYL639eHCfpcvSu0eDBS7LGnPcEb QDmYFUQ7J16DT4WerYe3Kp/tDb4dX2l/GcM0dczV3Zg6FRUGNlvhvSXyDrTj1XMwNTRVFS0t wJ4QfbSliXpMi4S+SAiehq/OJ6Qj6j7vd40nXt4XjmpTY37uPzcSn0VOK/E3IvibMAeE0O/3 Ajwd0vj3sqC5tABr5tJzKuYIE1vN22U7ko3fgQMqjw4c0wrCMEFu6hRsB3CfL2dlWrRZogyh MH74A6kFGkPZyVib6Ts2+vPdUDYZnKrvKE5UWgpljs4VbkFPHwTs0G1R2nn4B/jEE4SdT6J9 9q3/yxheCjsclre6YT+zeFiM6qlKcLZN1GH29oaxr4GfUaQxTyF0xRZ0lRm67bp2qn1HNqjr QA5AbwgzL7CqKUE9GNaAP6pd2NDVPCGqmdYlNUdQc2ZXIoYEXvfKbdqON6M1pWLW470V8eUJ +AFsh+SSt22olGds6CBei9L/1jRlZbpuEhQW4PwnJfh2KJ9Pi58q+XAns//Nm7uyfalWWlsa a13TiKGcOzZuGcQ2qPzvBYZH5xJyMOFo/7zoaUYW1C5smtgij4NOGhPyt3M+FEZdOSAhdlz5 52knlGtSibPtwmAq8T4/4P4IEwEW2leSXAbnSV14ra5nUKltxBU2vcRQUuBjbNtbLV/dg+Br V79+naPgPpx6O268s4pkS5mo0puvuXmf0S0LTE6R/BerFIAFKmhiAoXAS7AYL+/6HHYWrdPY fed67zFRlH9OU1yIiOTb1qEAEjhzr+WBNmHuMDPcPrHns0UeJnWFbQFUifZ8ATVX9wQvyC3y w842qA/n61IEZNdTjTXj0YQXKRgCGKDHXNQljMc7ifyuNSggiE3NBNX/TOuYdrBLvvNsYmiW AYxt0h+S+T7KJRsn7iSYgs4ojXMgcTyoBufNvg3uau5gGSgAUHNQDF4AVI4l1s4b5RyjhsNf ipAEiRusIjGHwIc5TQDGFjfgB3pBHeIoadAoVQ2XqPS4yQSwfhztsMOtri+K8YkNctu4YbBd wfbDR5UHX769wT+ZY8I4mYjp+TiclNv1yhByiqDLg9qh7iA2NAGcIEisjFOimN2X12nG8Izh yxDqjslpi/hKO7NsK6DkHNjtPlIMXZ0bMR9oQ6YvEB5HV6H7onjJJzpmwM8HYKeqYGE+crTK env1uxg0oTpTNKJW4zw4NhQ/9oM1kAbi0VVUdJszQVQ+2bljzYOx1lJYj9/zobDlkZgYe+rh jlRUsivDmjra+dOQoGPf0YPrYFgAfo4E7ZWSLqOMdwD5TQn+/YDjoiysoH0fwusuv4t8mndz TJmgPdMNnctIvMsDcPZ3pRCXtyxqog+996ycNOfIw1W7Jbrws91P87FmMlY1yt1WiSzqgUQi R5uQiy9vpCfngcF8uuVWyY3t/fahe2BGubdT9MLOM+KoaWVmQiLx/WAtSc3FhTOboGTt/cAh cbM7B3cA1kN/vryN5S4bInJkHriDY2D8JnnLvNGuozuCmHoa/eCUxxNYypXPS3HUFLTJ6VpU 1R7TZDZkgocf/Aq6dJHAkX8RcYBeHCqy5Ae3FOfPt1dY3YOk4Zwe3NXgB24+ULU00B10eSm4 r3XKEbYfeWEot+HysoXj4QNeflXthQo/bas05gZhz+oXnzjnx+X2d0pLFHEN+dDZgmX5iVZb OK+27L/p27d4CM8NDK30cwo9BFMYVoTtmZhN6g9d0uFowPh9ta5CfiJd+NGyIFwwIBvIxj8S fDvfsiBFDpBaS/A+5x9AJJzx+r3lc/biWoyGprSy9O8tFYyalqb6v/Zrav3Hfl1daSUrgrdb wAVpjJYytNNeWglP9iVIKx2zPXuR4BogrYS7dDbgzx4LrzNu0A9H93PQq1UOKksrHSa4u10I kFbBQNsmPp4+RJzvGVfCWiVTwmV3V4I58QwZorwDCERfH88zAQTpAOIl6ADG7gH+WALRxMfL 18eb4B0grSmtZObuCb0M+vn7daYEV59zBGl9/bX/IefKyrEPK9evWLHiVcacrZeI0Kb968SU T9ddXcm/6t+w0XvmtBl2xUoY+/448sc+ZZV/7cSowHiHwfxfe6fyX++dyso/3s3aeq01uGV4 5t9l3J+NU/z8ZgOw7v3x5H+6p/qvnaoHYdxTVf8/cE9NVfN/uaeC0Vz7v9kn/e+xb+1/si+V bLKlfXM9I+qjWF+tz/MffHwyaBnp2z9r3+xKEDuoQmYsy1b7Px4fG9+xKirHjfowjyO07ti6 L7PT+C8nXyy0hp41FZDh2xR2y9BUWmbjplur/82/ihvwLVu79rlYGDgbUb9wK6UKQ0xOuarS clx83r4fOZObsHnRouETa853o/rXnIOP7JxjpMQV1L9+maVWbJWJoSXRH4uxz+9RbzkK7N+5 2+tI1mRVzmxD5SvJGTVXWt276sfp8sspoY+ErhfbKaJ278/YY2+gEX3+S47U9/3t3/wpF7mq qpltdflTN7mu5Z/Tf1X6ekYL3+uV23z0XHKy2TVHQTmDFyqFJY3VTwxlNxJMTjslraLnLh/R qZf49mKanrkpCYuK5NlHmypfF/bszgQoHmsUhg/IyhYVAC+LBE/yJVTe/K7dWrQ2RtuyCVPs ErWbu/n5teRz7+q+unsKPjO+cAdnvOp0J5rf5V7KtTa+hP5t37SjCtYkqUnf2y5azEBfXwGk nDvyA9r73pLiJJi0x/zjjpk9MvxPx9bzMzb6ymg+3OfddC+zvOWjh2BMU53ZrbFvxa5uKhOC YpshTn1fWIH/k9uMZ1t23s9S5pfaXR7lOue9IEBZG3vNNUTY89B+nblHa3aWZg2Y7TGTkVWM 1sP0MwsFFIet+8ObHouOH76XalghcGLzifP76tgODWl689vq7Hz7H/w+SyN5XmzOB9MLNLcP OwjlQnXssU6X6BDOxPqrnWVRXVjGsZ6He/mdGp8eNHR9XbQ1xli2VC/oxrcwfqEN1LAEztx1 iS3m3je7nj0/dG9UoPLrh/1qn1XBdTKyT00iNuT6DW2s3aO5NpaMcYOMWnOau+u9oWgmSvVW 9JtYCa2khruyESLXnd9Z9z+4t6fkHK2ge+LB9VWZxWljWU23Roc+ujbG5vqNfvuYJWD+crft eE8BUdhzLBxg0AXVrD493JUoIaoqo0MJPt1rupOfvzFOWNPXNe1cktVxjHWXsZdW3di8p4mO QOKmjkhROdu0I33970TlBLo2DVkzt337HpY7G6Qo4jXnvSkJI1uCy7VJfykm0d/Ylmuz5rnr 4fj+cpIPreDSjc6J7q8fyn3MLdpG92uLr8BsFJfQDWKPaq0LlqlqW6Fx1ZTc73uvsyW1s8L/ 1S6LkvU0sMJ5W9IDNbXd5rEyB+/tuJWqE7p0LXZ6sJW/+/TPfUTLeoWnwEevtnwpY5NfV4aU 1544e3nDm/Dw8Ails+tERNaffL7CF1xPbDvwLm3P07I1DhQn4aS11gGrzpusUMdg0K7nBIbC MRrZFs33Ph1ZVS7BKA8uz9ylo+87tYXYVzltYmKorq1+GRVTXGx3VXznox5sD5+T0+qyKzj+ E2BsbuvVjpu7ZaoC3LlTzPeiYvNqlOHNLyN7WlL0ycYle068O3xPwfgko4IisB7nYSyu6Tcy 09vR5MmdegPIOxaCdVFrrlp2tTyS11Kp+7nt2wj/55FUyjrrxY2GOqq3+jWDN2mL09edbS+0 tjnV+DCl+vLYCCD/av3smO6Le3ydtVin/CvtU3riSfHPSgf3aN3r+OKxQv3gJZOGz1s+rJR4 rmL96EXq3Z/hDsTQ0/k3sVEax1HPprfvf/Zm3Ruq26eHtX6uaD9x8RrN4N1Py24RmxknNqnN 7H4bK5uVgG3NKEVJJ9eQpwckVuk3t1gJa3zWeOs1/4q8RaMcyqik41t9KvguyNmsfRYl65rw UOJl9NsB7+4XCn1fFe4kp67UoL6zdJU94B1WcMtX/NSTdTuTGnc3x7bvu9nRVdA5PT1NOtdb 73VVtuKdB8377b1RC03+1WVlK4+/T/UYzT3zUswjjsMuDXojs02HYlilpr8yc7eG8fmKQVZX TdVTX1ZPzc2bN6tIrNUa/RZvvfisLU57CBfMUOXxO7Whl+v6XZrS/p3QxZw5qdNddJGAVzHE Kn0yAAVJmUjnSEbmeqPL1VrmqQpd/MURced0BbR+hKu9O/Dup5nnoIxFOX/3xcyT6UnUD2+j 30oaUGT6JrPMV5h7V/h0p6Sa4TZDQW7J8M/5oFxhFlj96p66DsljacMl9tDHPjnbdP37kzPv RK9m9Yw3MZKSCX5QZr0qD7ygWvo2lrR93MTNNm1FxzRDK80glL2uN6OCI0wa9Gktfr7Xc7uM xVcrn/Uf9uj0VMV1rT5vyP5Zbxm9XclwQ5ekQeCVZcmSPVFOp/MTHQKrDhq5Xg6ewCaGfct3 LDpFbxC6g/MWses+1sXnlJB5ZtjO43uT9QM1/LNG24zS7YbsxVnxHXvkuqQ1zllsqaj7uu3i g0++TyLu//J3VlLMLM7WMybuUZUO4rDHdNYFB/L79oarWXiS+JPlLhxwt02zv3COPd59dueK ObOnekLq26ADrPL0wO/MsLh840Odp98kjyMiwWLQXZyD5bqw3Wm6Gzy9DM8X6Snel8wR+Tg6 z1Z4uPKb+Y49Fc+hTea+b5I3vl8UqnDIySTH39tnzF8aJ2WQMzkpW2nnfcAbC+lL/p6Uqbf5 QlPslp13eJONUukqE8NtuXEyGngN9p6w5u1q8ZAwKHqX3mz0BWPqrZ/qrS37ssY75Ih8pt35 0KWFQ6teGvnEd+ps03is8PTL4QL1C6f3vamlHPXt3fbtosDRkHztjJD5q7f3aXMWZ39prAte nBIMNLnEmdj92SGGpFDkEcbe1LRf7ZCZp4CQd7pB6XPB8hNYwMdeSe3TomW4r6hn072wgugr 64u+Csf82n1hfq+O/QVpdsW66o2Vxag1ngfvPK4+FPLhzq5DbmC0VOTY74nMYc3CosvXdQrD ozpmn5xOOxlkD5AuCKnJtN3t33bRYwNnsbZQfKfy3XYDzPxtqL7+uv6Z2zYWRm2aV3l60Lw6 vKiTr+AcFfqPP8cWyrCDMmrz9CW6p9Sz0LaNHYLll+4/rjbiZPI4PqfzBapjE7yuP7hJTc8q /7JSnm4ekZHXJWMx8PR/sG/e33B93/9PJIgWUcOIPkYv0UtEZ5DRScyIXmeQGC0iiF4HM6L3 TpiEwWh5RRCdRBkyaiRGJ1oQBF/v7/r8GfnhrrPWvo+1977rnPM8e6917vsd39zic2PdKq+Q 1Jywtv9G37CrUTeDMSM/7Ga/5UewEqd6K5eN/W9D7RFU9uLft4CNn/CsmuKhFQ2jZDCamzWX VpXF5PhJGeg+U34sKzFD/cm2Qtt18TpshllaSGAROR5EW3OGg42SzW4oyj0JpL/yc60+R7KN 6gqJsejBt1+5Ie8ZtAvggNrDlGq6cGdXhutO5ZIP1Gk8RcvTt15djTVdK+RXr8nl1a78JNQH XaVlFTdy9yoVPs+Fqxgs9geU4nXZxAeaNJ4U+EP14IuzocfLqH3kV7kdzDcY9XKRU9Avn6b3 P/NI9J+Colnhs6lXjnDEvyLit9OembgX4zMWX4mKE/AaxdEzGa8P3jeazFJcYYhrzfffXNFF o5pe5C2o0v8zMz3nMPQoxtNRixOOClGV/986tQqfzTLY9G3ysnEPqcWjaLHP6r083UMSvEq1 Ng09Obih3I6b5O4hsViFokN2vG341GPiS0oot8OmgHtIJLa56JAKbxs5dZf4kh7Kbb+p466a glUoPlTE20ZPTRBf3oXSO226uKsmYpuLD4XwtrFTacSX3FB6x01Kd9VYrFrRIRs+NHzKnHhK CaV32BR0V43EdhQd3sKHRk4xEU/pofT2m3ruHFywMM3ZReIpy0xM71THqLwUPjQG71B/qNBI l4D9XuwF9rzudcORxp1jV5+KbjR04YPLkCQsbB7vdXaU3x6wM918uVjcrZdSqBj0cncuujix NFPCrjXgvHd4BHYQuKP64vefdZkHmZeHs4GJ3A9DT5cOCg8fZhYWb5GeTHy/rhjmvXslgX0p XA/9nl8uqLYHbs99DJnF2zVf4FyGVgrDLoImKgqlgJ96Svs3gsbIZqa8ZkOZ3IOPuXkar6ur BH9kn+kGuReyAC5yIi7uR4dNnXxjVtZP6qgpOvp6vBN2ef7N7vvHkPP95YNVtYchf+r+/Nre fCwZFnb0e6+b8vjXl+9tSr5Lp02imZIo23vKYaxEirht9a6jWbwXbBaFZWm0u+7V92U+2MDd LUO9/XJ3L82to+NO+X+XVzrjBt7e/PYsLD2MTKv6fHZ98f3hMVVj2OUPHjnHK7kYKiw6Wu8O 7jz6eexmzKX2oePmbLa5IGUyp+ork7rtufpzhTjsCBGMkr7wuPrAsIUP7OsMJ/c1ZgMXF3+U 9lEY5cEjAs6+dJ3HphQ8CL74ubyp8Ozu98cHS4zwS+9b3oNb33XhzBz1ITfxzc9sO17t/Z1O 06PfkZxrna/Cy1QaCeFDgo+3DIihJy5DrkD9ETQGuKmPGlKLSR4N2F5ILAn401+/RLbdtdtP /PN5cqB6fVpJXcs0eL/xR8pIFQHQeGRsxsGHs7rut7IqLe1iBYf0gIg8eIV+9NfCh0G/F7nq RkaMjCG2+WzcHOwfn/8Sq+NUCyDtdp6fHZU0Vs/MWM/gCFWy29oJJb1GpFvKaPMtbWr3SSPg at9cwqvzjOqQzEeR9DrqHzA1ilkhFwUyZSZDjk4eWsm1GXgymK/euLLeFEheM+1m9gH/WV9J Fa8ajsljMOUgsOaE4Zz/bY58ajZgBk1IlbqT3uKnqyx6Ic7yFXclxOEV22AD9EyqBdLZVw9J wanv64HoRzOutdVZFqdDLjF/hbadzEPfVKhZNmFyElBeztG5xs9ZXK1dBGTCe9sqzsFvPWf0 +PQWsCtgecyIEs7lzI5J7oS77pFoCaTjCwGoliEjt849llBGsV/qjmqQi6MjElOFmqdIVrXR 8oCMfkB89ZdPtCg1JlKmWnkiUG79YjpV9hBtNoNM9tzgH4qJKn6XDbWelFXDsYxd7DmbX2ZB GYwmy8JfCXICG3uV8I6iLQJInScJ4CZ0L/X3tuflz5MHwunUYqWZ3FMBwWHlvcwDgxkcmI1a 7Lge3hOszXNovwRrSgWw6hytWJEelbPoJ/JtnZaHa88WVrMQhRQY8kSMzFzGcpmrkdGdXmnW rlPU7HGmrsw5K31fwyyqyuVxeY2WAMbfaL2UNUZ9JQ9ELBFQtW5m9esUZoB6qpaBU+x0nS2s cmjTrQ+5SENGLoTektCphTyw+o0fiB6uLcGBnB+lUOU49yvY8KCZs0VhLvFlWYjKXx21nstt VuJQxOsYqoCmcM9fp76Waa0ARmcNOmGzuvQ56ufD6S5oQ9MNZbyuu46jWJxA+nX2rPRRRach AlCHlQam7MHxAFJfftjP6itP0Z4xOKWOMuu2EYfU8Tbx09XwSXeuvN3rCrGWNyJk8bHMVqr1 00Uw9bCQMpbxfNaNneDi8ktNS9f0D/2gqP4o9oSZ2GNPXWk5VvwZjeeF/9v8Kf5yHIu51zu+ VX/syx4rkyGZrUEb7KSZGiNw6rS8VgOxxWtKXBA383rDsV/2GgHK/MSrSYdE3ECzfHCRaYz5 FZley1PR30+77rOXb7BNLl1m0g0HsoJFzsH1f+y8+P3Dy8QJ+7SwxzwHFBDo0OAQH06D34WO UPYODajT8OJrpudWAyEtRzzQogdlyLRRLM/nw1yL4h8dDNnrhEcqvWZO7hqjyqHMrlG65bwa mJm0vidJzPC2I7un3zChzoWe02XkmBLuYl24kGc0ocU7r3nSL2aekNhPDVQBy/MPpxoXqJ49 /QwifoJ0ivP2XbZ5sPb9YUZuAuRPek7tBDVEXV2lFdJqn/D2zglpDo2OnkTO3DAxRPSP6wxm jIyHlnEK48ibHO/XgFM9YCgXrAFquz8x04KjVb9gmPT63XCG2fLgQGBzvXh4zNaIhN2+o2l/ 0f0ynWpXKvbs+PEsHo4qB7rWZV2YlpqZW4JYlb71EEzWg7LdRmGKc0ubbv6WclgcihjFMQHs FEBGryGz+ZspWgcuf0vEY8usJOQNvMVOe7QfAWMcY4bj5vpJfzYExp0iYv4z9eOfe9852OGd 4rhu1w42mk7l46g6t9nyeK+mA4JP4kCrt9/CZMUQyF/2SGp2zHw/mTmpVPBzxZztR8YeF790 v+xPy5ZMWO9qwXVqvNXo2zQPD1Wk2aNP2i7qoOGqRsGULB59r9v+4qaIeoe0QD2EhKclHFtB 7OkFGCcKNV2dYxaeJfLLR2TZjKS4d2+Vs+88v0CtAAe8qPCn7SjuDv7qeIJh+QDUKSfDI/G9 yyMWXRRV/V3C9IEbhotbtYhwVd470lubpQmQPqiI1EAhTF697azY8yheqGj1QOeN6e4pOXDt vciZSf17+9k6KtJhmedxwIH/NQg3FIV+Hd+NMLKsXBORIes50nkLm8ZIRagl+5xf5lR78JtZ yKovmZXGPULymZeAdMBJn9ST+nlkf6fQExPBEc6r7/3poPxNrGdysBe/KoU8Nysyyo7M67ln ZGEcd+A5vILvSg70VKQDEQVKjHNcD1/+/nN/HziA5nwnVm9IJWNMNZp7h2M5pu09JbPzz947 U/Qrejv938HVcupaOt0G/Kf0GdLyf1wMmG357jPy4/pSrm1fqGLh4NSJJ+NtyuEeARpYxeOJ ii4rSCpqVeeoMs3aZqdDatjbmYwGKuTZkACBz0bGXhMkZdQ5dRGq793NnJAud0wDVpdjcwmK hhML99+v+xajh82+m66J7pk5pnAljLIWyZL6ch+lKtbI3U/uhlojRgjPt/SoORoA/B9t65vK epXkv5253OUgjKJs7nFyfGNWEid6l+KrF1KFyDmJGgFRgm2lG9KK1koO/hM/re6ZLoadeLtD ynXdi2Ji1LSY8l2ch+NaGNF3fTQcRtmu5NxkwptGFoyiQr6iPZBTejj+qtfoNmJyJtmieoAP KEMyg2vdtSbyyFvgkyAtvKYL7WHccrdLi/QChrOokyMMkYhPU5z1pnPZUBaAaE4tnZNuxbxq 3A/Nt42fNh9KL/1Hvrb15RU5oCzgZJx466jhKx1SADcKuN2Id/InURKyeF22s2IfT5+ae7Jz 4IA5mBMVk7l5clobw95KfXOdWOsX0Gqbz2OM4t5ms42N1VPKUCLj1fkkanCjsUdnRbf2sU+n QXx8m5BEuI7NzYDjZJ7IUe8vdVUQ21JCFk9Qntx2ktWXBlZK/nJOh8+I/tRHeB0a4dVXFghc Uc+EtZgnHz7Ky4AU4Ju8qJ68FVWwy/SCwDnIKUDZ6XN4083QuRtG6D2Rr2NxPDM9MDnusCwH 9dEAVVe84GuPBMfcmZpCq/H9CY39NHztIZtT90RmxLIgLKM8cvjUuRolq3tu4o1Wsmiv0ozk e06FMZVnxg6CHI5aLkNwLWNpVRkZlWAm0uvbS/K6P2Nr0hqzBSlwG+nHRgd7KiZDxDu9bQN/ 187fzBzvK74IcjeKqqDhrm5yKxSqe8Pi4bBY8owxW2po1GSSRw7Unzb3xTvoVit+ipuUCYdU laelKvrR1qcTQUDDiFmUR+oN5bo09DUMV/rjYVrtZ22FaYQMwAAQ/8vUMD+OS3SFizaqQjQp S9PQ7euGwKBBFUnTZ6Bld32dYzRbKlf95aNRbbgQAlcSzSFntlqYnNycm8Ol7OpgXl+Mipox meVRQLbLKwWdnzKPMhQsdkfHnSZ8HjhMCxZRROf+Bp4QgUjnwM9TPHJi8f0/RFsPNI321m4n 8TntjVtUDf5kIWP1uc4WD7HV0jF35S+RtZID0wmmmk4dpeul+q4WPubbrEWkL1GOn3IvXo8i 40gj3cIBWyE2vEoagZxOBjF8wAfORuuWVYrT48L0vsvJZWbTyiJ4ajkDcRY5D64xpUEoSxav JE7HuQPtr2Ny74MtOYXjY1D/1viaEBww7hSjW12eixiMXPKXSK6Tr/AuI9qm5QMKdlepbt57 kDEeA6xGmj/XvL31DlOQrL9hfLO/RA+ZRxj4dQ0HdH3mqS+i4BNHbEz8a8r79vg7Y1OHkmVa ds6KXoVeeIwlvbUtySLpcxalPvXdzPcHAIlTaoo4hmm2bLpShk79MBHUCdoSmwqdyPe86pyh iLKM24nmnshmh66A0+Gi50ydqGQNZGZvn6Tvo7VF/2t8EqhWpviGrKTEuQx70Z6pIKy+ZIkZ IiojQDkxO8tKgqTRedNImoTru741/kQTNEwx9pBPlRFw7EE66q5QKSFqEsDYFnIDb4bJSP8P vnSb/BigcZ6yv26LxvNrgT7Ozn7MW1FcH1bZ7iYIBxkxztFmirnA9HaERo597FHaAAwusfax sdrL5jClHiu4Ply61ejYZpfI8jiqvkXRd4kiGPWGoliksyyTGkqSU5ZGMojckNZPrjT2CQ15 VGS5z1+ewdqItK4xRGRDg1YBOwrOyRaew5jKAboI/pZih6JuNnQ4TWoxY9TfJ0e3jH7LF375 UR5cgUx+5JjGfFKq+O3smQEdFe4NIAGwMtXSoZ/C5OtVnxVb/M2eldl0XW6DZaiHPjKLT0tD xdcA5xQT87cl2K0psjajCVqt74C4A+sN+N1i0Ux7m/TFrkX9xb1uDyEdsJRCziCdys2XNbCg sJI47CbhI/gGVbW+qdZx1m3FwRjrsXHD+YiKoreyv9/G3rkW9WOutUGbIr++hFMt543Vil46 dIJuxp/QhOwF9YWU4QbiwZaznd0YgYFtknCEisytkXzV2OvNicVs1RoBOcoanyQ2ZI+WXkO8 RSHHZIbc8bDwg1MwJU2uLL+SxsZfaFmMkfaza+kHKA/0hjSMDqQx9kZd5F3G4xQe2ogsPn4Z 6u1djXXtF+qIvqMPt6xbnd64eM1Dz+i/R+lgEFCUY5o/NuRMwNDVWzBV2DhfGeIXFXv928Gd JOix7v2Gpc/JiSOfQYLDQbDXR2h9z7BzgRro0yIrYD9QbqXPzzvM6ttu670HylCCuMMbSQsJ G83nAL7IQSPmYeJ+pZH2vhOs7KgQBLf2RE4U26f9jNmg8M5q5+Rme50oKKxcHNjGNsjwrYc9 4ku/yzTuc0xwi6VnreeaXgLztA88bBUX89/m8fqR8VUgDFtwHg4wHBMalx8D1LCx96l/wXtd nQf8yFk3n9OsWP8sq3ig7dZbaGv6f6HVLIS3jk7JztzZ9RreXahF9dtr/UYUf79oSVUkR5ur kAaG2s7FA32WQhVYYC+lqDIvpnUuJgbE8Tj2MRd0ygsu8go48qvEs9TC0nG/79GbCXlR+tOM +ss0LBbIw1s3u3y22AatXSmK5TQQLQrtGb2XappYDF8asWWogjhqoOndRReh8uom6XXyVsL1 7y6Lmo2764RkGvuluUujY6MfC8EJkIoZJR1qOfuaZlObi/mc6vsaBt8Ky0GVHa2S4qJ/bLbB LjQJ46Y28rY8d25RxnM+BCqbu1Z5WAACpsZBkFICfBxakiGSG3BZIp+n0eun4hO5eJuLT6mI v723GMireT1WXKkfUrdXNzAMCfpC/jmGBdPMJ6+Pftv0zlQrwlkyIta07q343Jie6WIxxQOy ElGLLMVSJWdqC03UXZS6FBcwYPc1c+N/waOxRQwM7kLw4ZTqcDFXhJwJwgjNnJvnIoAXU0BG Lh5x8ygVmb/wa7kXwcinvU+au32IssboY4zbRisVNK7m0AAORj84mPDB6svsnzSYXHWpZVYL XPyjzvWRMm764WRVH2w/OgLZGBhnO1Jafb56swDSQaNZ3IbVk294OMzK4sSdup0a4yBvZ70Z 8jA3lKP1AkW1TDSjPK1b2tMCP01oNfPIV/SvuiT83V/muNqosIeVk2eSw6nufzW2h+7mlRlS YXzlrJr22Q0f4GXi4n036K6L7VXbSNlJs14Dfb6ZLZWWYTfhRIW1qk6PhpwxPJzRm9T1zJ59 N3+TcsDUj0/ldEYqqvx3DoHj2Gx5UfNlLW172LoeUOfnOsRm0lFlXAA+kwSmFB7io59WN4Mr vk9RWToUCq8VWVkw2ZO1kf5oL8vGcpOSV9PbGWlRfF/V1X2y74yAvir7TT3J5f0wAgrMihh+ ZQc94xr++jeuaS+7lQZ/1zXW+3iAV7wPrge6JAwTGuNrH5sOdeS6o1AdJqLKYP3U5lViwm4y KCTPuvVtv9KTzsqXk69G4qSkb41+wbA3ON2QRecA+6FV4p34bLiTIe7w2zBdPGM2o0z452Rb EY3TPIp310QezWUJLJMi5qbuK0XDfGR1fhp5+6GDejNgl8tLV2WnrImTdTd/hvNT7WAGNOCZ +6AetuXV16bbG8J2bqe19xf1dKPHNFLxNV+AKnD+rhyK8kk6rCadEs4k13ngKhpGwGjM5ZUf Xnqtwy+37acY8QWGMWUhgljGPcYcT/lG7KPxwZaEebBkSIdfKobnvqXh8ePNE0XNJSN2V/t4 o+WIE0z9or0nG/8Rz5ombrSRQbhoUkiuHDRyaUxHlFagvs1i1C/wwg+nXZW8xI90/xmTzgwa +MtWWZOm4LpCYi+SHltZEaKGueQ8fV+SEdacMIWUiRAOQPMIvmdtfnwgBJ+ZBzZEGPvUA26E AiVoo8BolmGoZo2gRoUEjp2joexqWQMtRdojCtqgJ0LbFb8qNkAv9sA8jWgwunmH1HV0lH8X nocVlgtINW+hwe6nFtyEgOzHnS0k8K+onsTf1QFJp0X0Jnfwqr4d34iY4sHXyv8GxnPQ5BFa Ijgv9ZaLH27qZQuqP8P5xVcKri1R7f3B7lGVga8a7lZOU7j7+QRman+j6tgOMzX6x7dTTdKt fqfP8VI2GO2X++7eNHoLnO9h98QW8fF0XybI1Imto85XLEuuvO9ySteLSl7YO5vjZmzx7XoN a9ddMkVj+wKg/H/66gXGcdVHk5sKimO6DksH484FIyAzkGd+gUtY5jqgSp8m3jWKhl8MofBO RmPwvAApw5RCf5CX/s7ox2lG6+8kw9fCuFoZ6Qld7RQuwi1x0wlOjunGsYqoOe3nOWI1u9Kf N9wqTH9kJC/v3aq1wKPrhx6bOSxR44Yb1F5ticjJX7RGO8tETANOQx9N9eqON6yOo3Wp6QRE /dkmh7xeiF826Djqu2I4MqVrjD2IT3q4cmm9G312w26pWNFiREfHBCYL2qZ3GTJ55wBcRc9f pgb+LE10duhOglQVx4vBLr+8R5Wt55h0j+8dVM6VjeFAVEgp1VWGkVL1iSZh148ZWhEYNXCL LNLStbpiUriJlRgFo8gcFe/MVB0pnNgXwAGh+iQwy2wrTRYOItvE/7Cqfk8ylyFDTj917TQx 19E5M0m47o7Zx5mYr2SJ3IxS2SUsrffd+nKK0+GGWGdWG97WrtyuDgHJ5+xdkJ2ynwcY84R7 XK2yPpaz6EZls/w6f1OEgNy7Y+OGWhTtZreSTzA5t2NdzQNAn1nTsFCEOYM1uTVvI/SAv9EK DTNdMECmR01v2S8jQGadFPXbZvWc3aWB9QAlzCyDtXovLuy4as/mKZqXBu7JW86OxvXeDIrC 3trnL4gq16zpr0KOoCTZBTmTngJaTwkSsj1WFgp/C/6KHqxujewXrnfYGyoEbDJppBSq31Xy M51hkEW3HmZSwWwfrlhB/js/x+309qqZLyWE5bxzeIYiEJNs7ikrCFHtL4b//XBnIPlRyJDd qz1JJdsT3/haOmVD4tu5DMxQQeMFbZ8oUdtTWAdXhyqNz+vZ6D+PxYXWTmw1ru2EQ+G8Y0k2 ipUuqLB24Pz6SWKtzyIZzO4E+R17B5H5RbrZINqww1+pMuNVx6eYizDKtrCH/YdswZfaKARU 2aG7V6hyer4YNIuw8w+EfE3q94MAwsyWZCp9I5wt0yaUT2q/YBK991AU0L8lSV7BduInPUcK ax+rUH3207p8OhEzn/RNOKamCkXRWXUDAQGtZZMDI57WgLE20FDqzh89ln0/uk1r96sM3a21 ZlMoGC3pzG7I2hZyRguwbi8TTuczFfdKnz3P6RvH+4t+jlkJ47bij545cfA6b+3p9ZC/qydC UCZq44tAbrpST3O7RYAclwduY0m7FE8z5Ay8RL+G3JlJeRcy0NGUXNm8M76t6VnWK4GJRkGc S3o9AqD39jToKjcUB0LzBKeZxv8UPoyfhppOUVf/IPuP/D+KsLKQYqKsjlV18eE3jwDbez80 nRferpMYokDYpiJ5v9Bd2VViUe8A1CBVpAkQQdoRt/Akl8Pz57n5Qmooqw7LxncLhapOzDHb piYNTqSvfFUnTo7BzIQttpOGW/CLLCIXuZyK7oVYRI4aCK+nMZKMVkssWkmJ/4f/w//h//B/ +D/8H/4P/4f/w//h//B/+D/8//B1huLzxvXVEVjo9OkmflslYHuh/fJ/t7CMCx4Gh7qTxj83 VWfnNu8sBO/+WT+4+37hA+zv7nrKV7uPoWebOzvfL09Wv4ddfkPv7XRc/j04P/seFnJ2unzA XfhQ7GPwwUbPQWUK91x78NnKMKEp3pBfa5XSuFAx9Pdu53lw4M5Mfcjse1jYNO5kFdLSeHnx jbazV+bPewNIldeZ19mXp8EG8O5S8qbY+JngSkLM10LVELPq7ekm37Nns1GA+h9kCtQsLW0/ 0WV4l00rs9n/3L6HR8am0Jkg4mfuNerCJYvlHhO4NBG+JU2mxfLq2O3ZBliV17xZnFdP8Rrj 9/SzTPFO2pN6cKpK4M584OIog4mK71HX7tofFuf+1qDio7Ohb3SEi3VozKsU2pP948oUDa8C wjsbviaZ/11lU/Kz/74wr5LILKyEQcKW17KUM//ocImy594EDALKKlzoCEZ5ZE2JRfJBkYRf aq/+1hYdVU41vTMLPt8/dkvhXhBs4kh73KsnaasYvEKgMpvoAgkzOp4FMSFmE3ox1/AcT7sl bdCJ0WMVZDPvJ3EU8FXGJuvioyjCgkFMrckmWHK/47Ke40SvHa02hvoQdpxBKJA1UaGET3aB zuPsYfcV6Ay0pGb13u0jqNnWybOeLLlV6AlBykBUGHFS/ETkaoxE8tOYKddnI5JzYRZmZ1tx M11/sdbu2/vEnmLfSIPtazSzt4/4PcGv6ZAyer5zIrxe9M37dy1C/ddBH+R7XaNj8HYqYHHE zB+7jy//C5/5eZZSaADPh//lxZshCtVCXnVUQYP97KqedrwMosWq5YCFPR+ht/RCBeSXj5Zu vel8+xaXhDifSziWQAsI5jyY/7BF5DNwCtW2nG0wdkWIIVZj9STCZ36PwAJZuYBYfxRA0FPa 7qzBYLuzKx+mUKmxPX5rFv2Gr4HIzNEirpCj+YbssTYuzmuemKDwpcMg1PcHZF1iVEwllTOM xd397PhXLCGVp6m2fH0mP5i8if7p+Iw04dd8Kx08yzXlth04GnUOHkR3gLyHbIPYC/mcGT/d G+H70IQc2skJowlzOT3/aRLZ3iEmgyebkRfxEpzS0YbnYekKuB1pputk90+3S2jg3Km8rYr7 QpLJdfHaDk4Jb4Q5fIGGHA2kKRcJjukGaaCNsF+SY7J78vN84nhwhZ2pVCnNdClJ5oOdt7qb vZW6odnSywxZ/qC2XnJxs7Mb/tuzCrXu/t5tR2oefEO0VPC2snImeQ+9J0SgDpdSVDbekcn7 ZvMcuHOgXpPIbBMNo/ZBEX5zwqTMFdbMf+y8H0ryYuswdbcAHCz9KOVr8s1yaqitZ9efkLOO 2ZJoemZ38fdvX58jL+Z/M8MqX9EvJj+Abg8w8x7lYG4eForoBnsMS7dgYPNEwJsYO/5LY8ww tf1PqafPVEO7X3/J4szmqs/yJ7HVAMpibir5QHLRhD+r5Qzu2zveV88zTUhGiksXCFLGLF8B Zpmt54+lJ5tdmB/GqOBv5JUgQs4Zucoz+y1bqrngvVbp0AgrqVL+3+CQ8tWyCeS16S9P17iY ZBv5quCpAKayN0049moxrYBoqO3vrxOezPKN/DYTmjvvHbsfweq2tQxxiS9vtGRoOZXsaRRF 5YlI+GiBa4jwQbR4senq//57osZy9hCnZYsaVINp3G8Ipl0tA39VGnHSxKoNwFrsbkq7obgx kZj8HJIobNYTgCz6ROE9CpsQikj1kNZ0riRJK6xg8fZM8NOOYhPoQFJy1Yc1t4CQb+P1HPz3 VfzYIJfXDkrBdJykw3WLqZZ2XbjO0nc5eFAXSMWzte5pu/Q7Ry0tPuJtXsNfs4bePM1+pBdS 8haOFJQ9VApehoD6SX48BnpD9v+x811xTTXf2kivSgcJvURKQOldmkBognRC7wFCi0hVeodQ QhMQpENo0hIQLIAQQlEjNRB6ERQBRcFCO/xf3+9cnYvv4jt3393M7LWeNWvN2rNmfnv/HgPE dTtSve5PMVxRXFgnXCbbnssV/6/cTQsiIG9Xo67H7n50xUV6vYYmpeDmO1VtruXqskm6kkwA LiQt5uyEujV4k3NVtlr7oeHdfoM6D/fJVBNtRzp0IV5OGeglLr2lOxfn/YlA5XYi2+luufBJ y0cXKyoP+nVfyN5GrydPUlK4u6MPfIntr2+ePnQH4OaeZQkbMVu8ypO4fJzAjUdzZlIzecEN glTe+AEw4vJernZ3pz2vGiBQo5p/LJy+lj8szCSjEpX9/GUnWE6w/h0jFyQ32BItBvI2WMkm L7Y5/S7jsb3tFzFo3fxng5HUG9btVa8Lw+UOhX6c/s+/z3wiivGqmiFGlNVa+elS3ZLTpaAG VrrHKCGUCYxC/m02A76myFv2mkeQ5NogBYnZdyVyt5RsbuXIL0pJQLwUvVF0zXTA8qwuznJ2 8zTubkefzh6RQ1l58MidVcEkd0cw0EEfkMat/FDAFaAUzR2pCufcjG2NuMVMao6/d5+iGwhD dc0YmkQyFTew4buocg06+afIG7qCKPin5bJiCR/cB79soqagdyrktEsrpgkZcsI406cRs/pF eiqhhO2YLcrS8p8DaoAmoUW3jarC9L3PiS4AlZj9L8VTOaVBCeuprT63rpKaEwy+uTdudj15 ZOD0ypioxuzh1lTZJm+EWKqWEnWrJMvzMu6vkc0vGaZPjZMgqawLNk5leKIJV0N8AUOFqouw N1q9UK58qiK4MXHhccg2iq3p3JZnzYvBouZYiJE4kxbciCBQJhHTriBVQ5s/xSfVVLCGmp/U EBOX8fes2wv2YkzcmszGdU2K9qc+54d+n/TKebw6yKZpMSPdH0w6lGr82JGzVxRfw+ZqZYHy WXlPjoqqcqzFXhakDsbSj2A3HSO41nOtoBvBPvC0GT925B0x8ZodkrveNILdzPa6MHnzJmFw mX09OspSbqa467u2cZCYgAMNdtTtySCjB36ewmtEukZfu7S8TMeKBTVazGTYYri3EqMawt2B yzHwi3mIrAWH5opjiPc7p0D+YKR7PuDSmhm3XnClRwNZHIl+o5mh83rynzqCGTFkuU51Tb4O PLhNLLBqIQSN4pllLSV7GtJVRsdJauBP1ji51eg8BjO1dUxYoAjzN3DrEncORAwVapQS0FDZ Flwu6a3v9FJ0OPk20uCwA4dYJOfGuebbSHBSCH+lUY7VGdcOEOwWx0yfByKTJLFRZ0mIA3Nz FpRVQTLwgqTu7c72vDd4RoXCFs6UIPOucOMJY8JEDrcu1OYGSi4J26iHqt0CGeT83gxOQbUf cfiWCK5sjmGTN4EzChFWWwrw3HghZWgrZ+QSc/zUENWewZZFABKo6w81aFCQQua7ub+YM0EE mpvlUSLNjYgevYwgP55JQNUHl6usBlqWiZbXOaToGRgYbngUSTm/gh9BkrGnuOsKTVz1hAJy MUTMCEq+BqxwwQoAIDP3FmYkim46a5cL96wJVJD1jfUP563z61LDyW/cTwQpurnfsFN+0IHC L/S2W1WOXpconzQFTNJKvi2lYpb5qDk56EmCzHTl4ZDW09OrlPmo56rwwN0rdH/2tIzCR1fp TauhpAjuKiZnZjD5OuCYUMMXR2irfrvv3P528XHvbZqAiTwSRRXSkMQbQs5ouLCa5EMZfZfy 6Vqj4VlguxXKqiY5ArJwQ0hOyixtwnye9KYvrfudkYYsaRIyaX6jiTrvAC8okq+d3C4XUoRq b/PRIG030EG2vV16Unx3kSRrUwoRV5YZMvAi9FYNJforapVSScSUEHpQuDcNUpDbqSXMlgqW NrietQvKi/nQIlC5ebdCuMy7K8QaDG+tVSlhRwYkmHR8X0RvJN/qU48pMow6ldvWn6/5/T3j iWohwLe3An0QY5Q+4fbmCUL58JO7W59qzElhUF8wT3zCOvjqF6zBTQYHpWdPuYSV46dQjljM 0xtJ6bI3fBybQn0XtKo45sWtEPaTE9m9D99b6XoCcebs5EAnBqVPPfHBR59n/IQVdD068fN7 v/9z5jTFm0dPWJnUzM53YOlHgeYNtdHk/sLs4Byhewuxe+cv+8ISiSDyy2qhXPEGzNFoI8ko H0XbMyGJYijzwGL3NY6EYCcNeSVd1uZG5hLvmIKq6Y0GHCrXhb+4NdoLig+Q31UB3hjY/ZPP SNYxRK+tI6RdK69ZPR0ywGe+ayuLbFgDb67EBGuobuFIAdPHOXCLAEVv70RuvOPI8NbuUIxJ JZjGd6l6XQmdV5APV0Tfgynrzt5BXFwBM3iaMNeUIzbSsAlK3klTfB3R2WziraGZhUl0jcx3 433TuyraPhVfF9Ar1vKmE+wihYj7dkgha2fZfGsJcB8LtLrV81wAhWJY3qZXXaXKThYZR0Yl vXwE6eLOznCGTi8p9hHpkzF3fUG3KYWOS5sVaHG0jNYh/xWVXNou1+IknyhqF3GJeGbLnp7i eTswPVffA1UBss6UbF6NiGOHAkoo322fuac1dU05ZXOQBAJB/9WUcNpMzNjeuToTd/+SNoKs 125wY3VGXLujj3Km/cMmuRaHVPtp0kJyVmLnnrCCQW6ptKcErX3ZtLinpJW8OtgMtJrNJqku wWFoQ5lE16esSOVASy+YMBZr/FidoqvIOPsgyOFOBtehe1iNdQ0OhBHUZyeIdqdcY+UWUYyx J6wdhhdwpud8uaWBYyG3I5kSjojXd9m65Xm79wmdPVWDgNbhr5RN/aUHAl0SNl1EEmm2wor4 HtGbmaokem7p9CpCnRw3nSUvt5fZYJS82RQFs/+Flf8zfJ5ajF4ADbdw2M99ng4h9TWqI9Sp 7Y8c6WeOfXDdTaDvhpNvKwycC4c/h+ovGJmogM3drXROwtkRqc2ru5EjrIA7IalibMwF/aSt FFf0ctUfknsM0ms3abvfawK3dHpKWkgsgO8u1HQVEBJLY6s3c0AHax0k2b9Y+T9dKZOTUOGj UpgXycm6I17KjikrKIWbJzejALneHJsnarXfTKc3f926Cxm9RwoL0vbpBcvLVs9IGEgMxL/a TygiEZLmT3iHxC9LVdVJq5NCxrKTplVsZxO5ImMq65pyrxNThoe7RQPyAT1aQabg/Q86FWSq gxJfc3kGll4oy94nayp0ODeMgkcuJ4rJdAsNV1lvN/AU6SDAORz6IStJEhk+QOCMEVrXdogi Tsst7bFgwjvzUFhs4Xeh2lkGX/HLgy6FQgGgRyTIMGunP+urzG1D01LjHUTG297uNxba2zmC EcBAGnQVAGXv99ASnDfLLC+Mu8dNfB4vf4qib9lRkpEcPtr8ZAHNHKroKHrGLPtJR9yQTK4A Us/ioZO+WWPifVnCFtF2+U7Iy+Ii/JO+iGxGPQL0lVndR3qq5iohR1hMQU5YhyNHsLZNxNcz GaaB5vlEKbdY2USVukV4p9St9Jw3czk6ulydirkKZzRdEKQede6QyoZbfuV+QF1ZgCdoFOJV xNGCuuzKHekICxK5vECn19G6wwI251njV/oowyH7Fd2/IzxG7ZrlLWBIwWBwQy7XQbW4aszd Dt9pLj6Vym4rm0BAs9kboPfCxmZ8G0hqzAO0pTPWtErhItgxF7j8Qrfv9S+nirO4Pb8WHxou AC7rBk5cPuQC5B/PUCZsg9R4wfGSRkmgfscw1CBUppYM0+UhdtKwox/e1cSG7rXpOif7MSxX yoKhlT/OsfOrwZIboJi4bDg8FSjT5A9Jb9XoXm4MIl4GUNidXrqWdIZpGQXJAIrusMAPxZpw /pEQmtCk/cfSU5l3kcLDl0cQbYal1B85vdET9aL5115r9s+pjp5fQ8nL5RoiwqIMt2/WH73/ juU061MoVpzI4eVTcwm8ibN9Y+myWduf+FjQHW78Vsg+um4kn6+PH40s+QgeBhoh84n12QZB xgXXHd2KcO2v7xREVdAVdn+8PP9GvKiRL/bi23T3AptgOo18M8NeTpurdvC8v4WPCplSh74Y iYew+CpuC2u4CThv4ycX6/NtSRKwmvTFuUcg2akIiGzX1SL5WuxHDfTFApIR4B2QBpARMRfB yVdIlLA6ajy/SVQhzOQO1k0TEC6vkksbQnSbKpv9G1HNbBCjJMmDaZfq5BM5uMaLxcS6lNRg XrZuu53C6xycz7/e60pvdjPjjEvDaoKEptKB8+27eIj7ybF8sLsiKn1KsOjDS7FI1rvbrKVm b0x4irmiwMt8sVENPVVWIMS00yw8edrqom4w2UfBumvSkd18LkdAS3Kv2BNqjk18TFo9lM9p mTwtOtFVZRB5KiVhh2L71DPdOJ0jXCviajpYd+cH5YB8TvWOnLNvoFhnkNuGE/cfpsrkWeeD h4Chll/DIZKSUPkC9B8ZjwKu8n1RMXM6++AD/iymztbLHav2mnH1uIyey7StYB1OWJldxKRX f4+vj6SFQmEUKdhN3iqcIlN0ZwRmEPBkLI3gQWXVUAkYeKk0fJY+mcnq6T+6EMww3UE4vGqv /L6QFaVos/s2AS7MhngNbSHE5UaEBHwtYtR5ls0GklIDeu3o9DIgAAuc5gvIhViTjyQTeeQp zCOCRXL68AjDCoKHvj4a24tNeBbZV5WPfsI/rk82ozLiJZtXgvP0hkWGoZfVcUInSuDMjRU1 MRu7d94pT6eqvHShxqkiHi6F4hA34J67N0fnuU2mOEYvgPFJrJ/wCNbc5u6koYi4/bucLwJT ZUoO+M/g+GYzCfacbitz4fKvj596VCSZXKuV2rFjhD0JVn6q6i2TNxuam9QcZ6unVxYRWwj3 MAe0t/eelZGn0M4ZZ50ZsAFOmMzt8e7PLMA5qOZgto5JraqDQKN4EHo2hPoKoJrBUXifz1hM hicoX/1zF03eXHPXT5xPbkRu8T1PTL6dTXoJ7d2Z2fTSECC5jUGhjACY0CNJ4vtF78evGkPJ pfeSPMI/74y/RS9qfXz1OqtjVhv2lmWvim8g08RCuARHda1p2tJHpugdjist2MlxB+Q5IqU9 7jtOMHyZtk4Lh2xNqmURerbKGtYc8Euqv6OztH3/3Kr3rCOgQdqfuV+KwgxgC9lfVud7QRjZ P4s5VRkTSZKeYHWImXEd2rU5tZnJzmvWCkqBiSfKrNYoM8FEA0TQ9WouUj8pcJHWn3XHRiFi 6B8ho258fbwog/SJDMgM2ybcqskA9kUwIw+1FZfjhrrH7H43wxBk0zm9L6vB1qI151QDKu4z sAONirSKwpGinq/tMfDJb8iQ9QLzph+CMP6t5z52vg4HgabxoAa2kV0kYWyvZF1A/fc70+U7 qScfgn6l62sTMnfuZoI++xXd5HGX7dD24q0ogDcFsQz7BJpPUHpcHamV+sB1Awbyq50Olwjb ytWM8GsJzku2asGSz9sSOghwQJr3/bph8KOQ1GXPsqHkZedSXDzXocHGdDOrna7X1ZBCCqed lol8h6egEkNLbzvZUWIdZNbSFzJD0Kyrd5ST0rLmyBrXeSAvAq61DpizfNfR0REct6lU/r3h vfQGswwX83JunaLip0cyW1r6KJ/h6WYPa72RlAkZdOOqOHJ80aMTQAjP2Z2iWh6W/Lmy428B OwEcuke21jzhHM2we41LcBtrtAagkz86D2MKwnS+4U03uGT6Ym5ParbJL93PNVXR9tNm4Ght umaVq2xuN9oS53Bst1XY4NqSGFUH0xs7UWKFICHfcF3TR0Xjgg9Wgm1h39symtNbCNz+i225 /grDwDDI9zq55Qu75ZV807ftl/dp2mKrjc2DB2te69bNEtV8BvUHovKYMyi/so37nLOmBJ+p rXqIg79uTePMDXRHB9oX3NhXvdXLDvfovdLVU3QrowVf4hB9NVnD2Ejd8JU4BlkCBBu2lPAd 7PS237bSeypWfKJ/mlTK3gJueQl2ygANXb5IW6KkYTBIgcKe0NSjvp6bDNnRuUKNYjrWDZKI nPcHoorBahYWqMpGtt/tz2NgDrvPmtPlQs7QRi0oAR9x/z9KDm5TI8VWKsytOVC+tH3n96oK 5ff21kMnFs7tqTHxEJWIFAOFxhJW+Ue4JDXqhkoWH1v5wiprkKb1nxGV7xvMaP/C1/WxqvOb oPgQYZ+YH9ymegoueX2aDyaBhLaK4egaURhzMlq3DaBhZWaB+nSlFQgV9TXZEyr689vbPIQK gBev112g9vfxycu64+2vK1RcntpHbq+j31HZfsZYohZsFEAWEDuLv71O0GKDHB3Xq9z9zcrg EZ17glvM/SGEYaCSnC6s8wf5tkxW69duLSQPd6xHr0RbECktIS7ECvwfVYMAW+hZpj+Zzq4z DMAFee1GXMX/YSEmp8xmEyJJIBeuuzTQs+QW/YojDkx53KwpIZIacuGyKwY9i28ZqTiiwpQn zF4jRDJCDtx3DaAvs1r0K48UMOVJs+OESE7IgduuD/RlestI5REQU54ym0H4QwI5cN2lg75M bjGtOGLHvIqbNSL8oYYcuOxKQF/Gt7yvOKLEvEqYpSP8YVzAjswW4RVUMLeTMO3tR5JdiMyW 7Ep/B9gjBv9qt937UACL/YoOMZVAylUe1P6hnJQVv/nbRGIE8+OeT1nMR2tNFmjTPfuf7RRd 5P5CrnRQii5EgmSFVYU/K+xKy5UFbD87vqTCnxx2xZ9G7oJACqGDLl/KFuIfutNBxzW/Z0pW SNL528EYYorBfKIr81bI2GMyqNOlCJ/29zTJiut4NTc6KFAuhkC6QFsR8YYdb03+lgMTi9GG lrdRdLHpfL+01kJawnFpwAr/0IUO2pT48Yq9pr181/6lBb/YWf/LJyb43oxLMSaI4iWwvM4u 7yXAVejSIDt+lsKk/SzskzNpwO5+qKb9ja6AS4jd5NmIy9lTQsuw7HjfuFm7yw4QWjZ02UmY Vb7s6EH3sMcHFx7UnTEXA7/Ozw5eX5zvErufOb86/f0725RPA/Qq6uTjzPjKU/VHpzsDL/u+ dwe8W+yJ3hvbMqrmSLn5BKD26HDoW3XKNZ7F14Hv9x1VuwNXMHtzLa9h8x0R399rBC4M+dAF ql8EtlyZ5wwEzi1hIkoPaWtnzmMqdQjaPkdIPwAmxrA2165mBPIczWev2cT2+JXdSRuN1Bkj Ary0qRIrWTHD0GLCEntQO/mKqutPJZrOfp3SS9rUj0o+YtCx7MQ/xlXFBKKi1J01+gDQP+NI TDUZGM2InaX0Ch8vaX90YvScbcLtepPkou/w8RGgTSQgPK525JnzOWiW13lkwd2f2u/N8e/3 N51jEYseq7XNHNsUG7HWgE4u5OZu9wG7xsPTHyPeA3oBPppQ281r0AeD4it+6r5RxyfjNvF7 b24EneTBT8RXv9JMPObReLQ6ayzaQh+u/uxz//GrHCIH8k2KNvSADKL+pGS5VgFmnIcv5XeH b/JCNf3SQ/2dZ5P2pvhWKYPAiEFQxUxywwyg5Roxw+bZygtHB49CcsX4hAmzD6Jdw/+hKYhk GmGA6D5aWrGXxaRkP719cjZs5BJFBdssHBm5huRZeREthufFXs99YAE5pNztP04k4A3TF0nu Yqlk7B+Of2TCl6tdhRppO40oziYhYkJ1NjG/eOM3wq95KWUMZ10oVy5lT9k+MIMc8voNh16s Vd94Xy5rhCT2Dcst517v3Pheb8pL0SWy1roL8BvCaMLMF51yifY5ZO3dHsB5JjzvonPq/ewH rr7RT+Xdo77utI8xLDq9zr3i4YH9AoaGNaZYpay3+d7fmft+tNC2ZNfzc3XNHYfwOdxqstFM uXYzad7ikw7pQmTDY40+IKz7YPFlCojmeRzx4Kbm1SGn06tl96Agn7AAm6yklElj+iZ5W2lM 5SHT3P3u7bi9K42AH3pB3JrHP2gWGMV8ure9MjpPr/ijja1dXkfCpjrvd388kIolCu3sifUH q+kGPExMD82eDw4IVVmJZcJbk7geAZuwCvLqUd/ZO4QvsY5/fWO5np0L4FPr6eafDw6NFF+S lw25vV9ip57Hdjpk2F5magCH+0Z+BP4jThkkE/vlXN2y6zfxfs+Uj6954ANaqARJm0LejGtp j0rEGZZ+izKAjoQKzk/pgZ9XW2As7BptYnmhcfkWI3Dp0b5JhHfpC9gbrU590QlwloAwjkuX 2fdpZakRInufh3o0VQGKbK2p/SWZ1gn+sIfrY+hRsTHE4sftA1x/BrH7o6jcaNaGuyVE054l q+AcP9ZWVrmgh5VyfBUPElsk2Z/1v94da/xYC9oTFQZLxL8b2uuTEGkDqtIR16pHqO6WAzFr uR+MisQUg0qTVwOWn7zpr7fbxKJ2oTq2k3rJbAuai/dfAnklTivZXFUpYBzJN7OyEDoBY/6R QMQnwOV93z2U+xVJbZnKdbw15zm6pIWV+JwOKcLSvWthoehhbOKY8g5Hr92X+vyBpr1EmtXZ omFbmdIDr6/cHcKbof9hh2dcRI+O7nLm5c3FfhnztJSjRvBcFFvcoMwaFhKzTnKRxGpgQ1fx f0k9VNRT/8kKpc8A3Gh/Bs0OzDgR+1FaS5XxPZMdXYbV6QRtG4/GQPmdTb0AkrDfh+SUtxHO zF4NUFwWjBfVRXbyE/vG2TrORbJOYxATdvGfb73cZAoeBlt6A3FPsqTHvqwzIjfsPPS1VeG/ XDTt6ZJnzjMRDLIkHgZroVeO9tZxuIZMJn4Ab9U7yve3VHk1uPDWgDN5oj3BdlG0e8IfCuXc IYGFQxtcCjvcRf3fclqfJGgMYQIvBnRSss0CxhjSDk+T5N7peFV15onL3X4P8l3wffPa+sSz fW/xpffBbbGAnFK4TpVa1PET+hecagmLYK8ROVXmhXfhtEsQreb97cI3GPft/aV4BFxIkXb/ x/VMra+k0oJGE1cFVPeJfVE/3/F82+mf0Y15O9vSfoZ5NPLO0SBgzGSgbEwnJ+1d/nXVcx5i TMa2euv1oc/ReCxwiyFe9TbJ6CdOTqWrHjhEytV0POnC5/hX0bvWhOglPbSAke8DMkXhseoR zbsj0lrWMjoG1ZPRS1ym1o4aOQUvdehg9mmSngaF3WRU15i4cZ+U4Jtf13RwCBB0UrWqhqKr IKlPqsmzLW3RdqmfYW9TSyDMljJVWt7LixWi2UQ3YrhSL48BKa7pBQkXUVpiYp5+zvRPPRbI 5bXh+hr5BeKmU2j5fM/tUcK6ptQ1Zh3fxZd0E5ZQVN3Z4oEp3TMq3Nhy7RXi+9Ju2O+tohbR AEHFLpFVTNS10dyyhwtkHjvHoyA6RHb4NahERpiJtVGbvwCGVjGeTJnnIUMx2yXQZRnklIgp BcJqFxu691T5e8r6lFLpyJzNvaaL5U4/BYr9+M1nYRvRs9vhkI6Au5d4PBJSQhqROTPauWEV 7pyT6Gk2ZWDTV+rZFNasY8lE+zf06XWTF3uOimIx6/xzgbYDGBr/YS8Pg0+GZivUV5ESVK+x 3aWPj45WSlB8l3Nvp7H/qDfgCa8Zrhzi79T2xmVd8fcMbp1v7D+eAjYyEBoUqe/25zpwbT7O qaxoXzMVaQm8aLR4K2x9FGoFswogr99MLGKsHiMkCnsJdsViGoPmPBdjTXo8B1Afwdd0Ytlw j7nJII7Us4e3RS4T/G0eUkzECmh7SCPIUiCtCPSq7ELfeVH4FOXCEiCuJKJvHtFW6MpY/PlL faw1XSz6ZZpLnkZfZYwMkyUrfjLbymOsme/ixebCoMNPUzFMfKl4AI2yQKFVYchsUQxL1/7X Z0dnzBgk0TTtCXKMT2xY7tC0+UgR+36GMY5+7bVVEMl0PMcre8jc16YNyVmmOOQdlp7m1tPn bj1ZzhwaEAtycaWvMjqN0QFdDZ/msMRmRVKE7a8Cbfs/Z0fndb9+Rwq15Zt9D/t89uhbAFq3 4rrleS/GmTFwGktN3qJAqbis8r/BA8oUl0x9yieQfz3pf+Bi/Ydh9Z+WtIKS3H8PS8v9D2ys 0v+haP2/5rJVVlL+bzpWeQXF/3021pRQNv1OvWcswG16bf4qTWZmUnLB7SedCOmB85ULpn2b mSWWu/3aN95CQ595Mom8nZf1etrY2nj++sJdi4SUMZaEnJ/kCrXm/2/+P24yUp9Od6yS/jug uUXTRej7MT7mrMZB/XcMKh6HbFe9qEJBw5f+KsfRsuzw7z1FL8T0DT6LM0r4CyiXrZnR+HZ5 eOZw5O3GG4nkv6OW+ZofPuiGFUU7nRppWP1ICrL7F8OLSZTw3GPv2Jn13KuT8ZuvwN85FQjn FD8H7Tl3WP05+xJoc4gOuvevApAp1VqqRGUq7Dhv/SkQoUjD/IztrwtmWqRao89r8rpj3tqc tnw5uJNh83U4yOBfPUomUVW1HZW5sOPOr1SSXIGMQCfxvxGogJMvro2+Dfg8QXw9XBD95kLu bGb1fOwltxT1X2A8J6luSmlNdVv1KxufpKfJKzd9FzU6pZ+EV/6L3cgkqqRm0+ND/FF286TM YUOAU3/dqq/Y4drfiKRr7n81XqOIu+AtGlf73nMOZA+cthjMSPpHV5xZVHlR0F8WLUE8eqkC Onl+5jUZPrpu9dDOgeXv/FyGWXDcUpL6STcS9GPq+eAI4ooRe/d752854XH/ZyWYocHh9INb fjY/SwY7VsAflNifrbZsIv/650pOe/Waa4/u2sDq4c+FdUgncKrH8unIeuI6Q5RX+PO/wWMg 9UxJaQmyCWf91ftwdLv1m/Yt3gziD93Gb749tP9mxX3qkKDw1qDfUY9cW+xtJsMzh1vu8KQp bqetFWj/I2BF3aW6yLqvFc74i9IeoBjQxTf77L3c/kB4uVn3TYuCoqEH/+Ybl1bF8Brmeqtj IJE6LKnvledXk9IfA3d45QKUH3QqVYYL8TI7Cf/NHKRm6Rt1esUkibR9ypUun6mPPRObrcHj KA7Ju7dfIhWLMuL/CQGbScXSmkCeVJJ+wviK/eTke5MNac5s9p+0DxSGbX64D2b8k5+XkdrZ CcoeNFljjw+c70C3YWDzzVA1yg32DImTVv/gm2Zzc42rEv9GjoRUIq8/jPs/mIFEjHqrPxET sISk2BCo5sUMVw/bAEWc2P7NoUhyFdVFmU9aa7QDJquql+YdN6RrA3g2nBYLk9ZnotIcmP5d TF3mX1lvJGmzKVdQ6PHCM4+R4z32TG/2n4m93cXtYq8EnzI5sf51PE9TMSWKk5f11Rvy/yLi 2+OZ7t//P7dbJ8pKLIlJB3KcciwblbtbOaTIcU4dEDKNMOdb0mSYcljOqZyPmWxjiJnlMCqn tLFsKOQwrI0cfhN9f3/tscdju3a9ruv5fF7P1+v1fqxRH6bgJ9r2iqLNo+Ap5bSuxBP9h8om VMZL/uSJPh+EUtnLO+Uogm3m/RjC6ZZBQwPnRvJdSa6ca3SgKT2J3xFyEam91WxrIaY/H0gX YR7Y2xg01xj+66f3DF0xdU7JjnGOJhHnbSvzxJar7u/0+9NV4ntWseToFrf7k6GqqgeD0RRz lpdm5+KkygHJyj3b3FMSGpateFjrc1pENxqTIPtBevAT4PZJtC9DyojzQXk2k5Ua8tRx73YN dojbPSTzCC3jc9FDz6jUn1Q7BpqugzQI1xZ3icLsBm8FVTb5aihTQbtvRbh1//Dqh7wnBDFZ iF6OqgCWA5Uu9QOLk8WQhpfg552/AfDX7rL9QswAQuEn3uxwE1MCLmQYxo+tJB88iHpGafjH aZglLwG+UVu+/yJp7zactTfXdVsKLqIbJQcNMZv+/vGV8WsEjt/YYPMSHu6e3mqdC4+2nTxY OSH7bavQrvn7BZmnXgmK6fxKTZTFmB7DtrkhrPEzI27DLFAcLDndJ+44J3Xhv/lzW7CoFl6n j9YegV8nHFltfXIwufFqlh5IbZbiE3MNwpRQFK/84fOtZbso+/kA1NyX8jidmNGKebY4vz1Z 0cJzEnWll/+UjBJ7/GglcYYSFiJFimu1fXewxXRbejZLeVsq4gfh8GpfcTHhxMIVHL9V/mQf b3boreZYL/mDTu5QWw7Seu7c4I4tqES9E5eFpz+w5fctLZnZ9fZawTmvjBUunqoQ4pbDygyG dSlPWm1b2M3ef1Se74uak1u8Udcyn6xYWFDgcTU3Z9/0UlfXUsothGkRbPOLzy2MWZKNbEfp rU5ICJk+QO4mFxa4u9+ZJxI1Hfz9cbjCYVbaNcMiIS60PtUCY+5ukzPb6/z5oIsSRqTy762O /+taLIbXWE2RUI/OPatpaBj588cqCWKg7w0E5BFE+oJg4XUZXTVKjV92VX5SdH7zizb+u5Pv OuSrTqDkMvT8fvDHrpz85OHhNo/z6Fk+p/LUlK3ZW6iA+VVBGO99qwQ60bjzSWUW9ZHt1qST PFF1B5X7/IZUhMN1/uqQ/7eeXJcPnwDfuliFHhAJwPIDpgTvsoAL8xH+W3Okym+36vCoooXS XoCICyFp4CEs7GcNiqXsc2TRHDEngdek+IScm1xKXayZN9lCgIlwxLtRq95CD6jgC/c5rFt2 h8COdnqRgc57uKoSgwXIsnudJ7vnl5SH/St2/K6Czc4oOQS/a5KoafLadBSNxqr/qqshID+q VjxaWVJKrbU3GNahWA/9+4rfgbyIlPzDaMOx+SHiMq5CwJWO1M2/Dib6LS+cxPGJOA+JuNIa tbHexQ4di0JU2IqFtdu7gG03NXX5K1Umwn2dEXxpFKtu+nUwrJ2NBXcKOiVYPV0CH1ZHu7fY XLp81n2dxt/SGvMT14yNbdYy1s6u2E9jXSLWuINMm/KVcO6UtvdgObMKsZhWTg/63nWQ5okb qT6oWOjunmriQvgq0hS4tsI94jAoIK9CAti55tHKPfnciqsIOZ7l8yH3xd4/nuD8i6nHZevc s1S5+/zlGDQ6riV//ogu+Rl1mCVCwYXV7fNRGettsGL0SODnWrfU3138+/pE/kpd2ZjkehUZ 7Eh6YC8QQt/hOp/pgfJMd04nVjXPIOjLdK+pufvoXgnDdrNwd9VtGTj6YXbJJKO67hCXLeZC unOTIBHxqztbP2huijwD0/XNoByCStiWIkssAMm2uq3syzSWSNtWqh9uCDkxSTWfSXUDZQOp auRRk3yVvU3hMKEmD1OQrZY62oX4ADHKIL2N8+BO5tWYU596RdRdvbBM0+reSvtf8buR3z5N LD3rLB3vVHamVctUaDhe5w+H8tjPqHMMm3+hj1inc0EOlEWjawMESj4CMvJ+Iyj44+avf9kz ZgOmk4oWlOtwyoM1MiiXhgINhuT617zKXby5XWjUNcZUr5VBuEVgEcG90otf8hAB3PIjMf+x atVLL31vn7iEPWTmLOlp8+Nc2vj8tC582EYCvjNybHqUvMsdcbIPKgEoZxnMncwxLnFG0IG2 r9K1EqmZC4bgyoObrOPtvhMI5kMIJFy7isIHEcfuBZmKG3X6qx/ZVEwuJPglBsNgmWzqgzqu tzewBBmYkp6r3HgzvI/vtZ1Jwn/HCAvKU9DvEP/gzPbFJJLQRFn3SdXB0aBZ5b3YllwI9ySm nvJWDZ7HbyGWWYeFqWYpzwKZp9CwPxUsOPCdn3PSHrpMGluwSfY4Vpn4j3HYyc4H/Bl93qzp qMXreY/GHIN9wKbQX2kXEQHptG/5PgahAdRA+zBcfl8+IjhrSxUTTiY1RbbTZs9h1INSqUUM 85yTg5oY/52oEcOl7/OFPTneDVWAHgaLNxdzbZX1EOPMtbr2IC1dVgUOZB4TjLmjGNwW3w8L S+ADHCg88IXJ698mFl4sPGyvjw1rvTn/vmltQVbQHfFJSz76ENinAXlAdf3rutNMHMyTTnwg 0tGah8i+nGEftqgQ7HjM4zc/z7N31zT47onA/BuUvguLNQNd9DsYHHrewO9p4rxQSCBh73pH midDbX0+CsWyVc8v9qGW19JqKbwfNq/Sd7BhKTeCnnaOb+H87qmopZ0KwcMPQHfUsVhzuDwR TZJI8njCPeD14DWzThdlGAoXiZRNg8CBtojMGFZeDa2wNvvDZx3rImP0nEZCJ1v8rOiWdzM5 /9TRbnINLQr9DCmGpENixtrZBrX6OwQvxwMmixqDLcRslddilFbN7SpdjNGwUyBT+qqq5tv0 dIokem7RNQz1/xf4955TcaYqobtuXwSc002v73zV8aoddsnZrEx3gN1wTgBnnQrdZpZF7p08 wr5rufrlb3y8gLro0jqfuZHhjuI5rT9lvylcK2m7vk7Jnr1ocabHHD7JrX5vdX4EieF9vy9K ZpLCf6mX4X03J5DvPoo/GqZRcTeMp/5ku/vmx6pekRZ4YPefrg+GIEQGa2F/MioJEgvZOSYL GSHdJ4HFInmz4XZzI+kCNFYY4O7ZMrzp7gVdLGOMmYylhkEtE6r+dDuVC8KBqbbrPynDsyYW ZwDqgMM/BcEe4q/NAL/0iIB8h0By/Tu5SU2+PWI8jdW1X4CbDZG+wMFaQn8txQlh+PTBVeNn O9FygQn1VMmk7ZD2wj8lbH+uU8ZAKerZmV3RncntuCTGpZFmdkxNSHQLJ0JPoBooQ9ZKkur6 qv1ZidwgdC4E4dhM8HQc5Ued3jG2jQFQVPiQia9r14/m7x8nroybvAkNgXYDrxNh8kfBFDaR mvmSs67HkFgvrDRcjwXiH4WA4rz5U/Y4/lJfe3sRYpHfjEj/Q5gTGkDbMNHbDkGvjDNDXUEv /ZiqAPKlT6BgUJIiBraBrODkvqKisoZBs/jpTPLG6vfpHsNhli9TOS8HxQp8bl/Fn5wstrrO NhaTy3n+XO/Be8f/E0UpgAoJdbow88OrLqgGRoH3oy5mTBmJi2V4Dz+kau9T6CNSZhDBkNnE SmQCr1PglprWzwh0IhzG8KKDluetzcNOo3MzDTVDHX5XgPBpygG1rdinhES+mph+dIz79vrB YnBScGynGiUnnXFsAXIU8ySAKTcnk1h5L4FHHp1jqiSvc9gukWvcKxvt7HRKQy2N3nUPnglb /ZF+dhA5z3/CPkMcuL6tZEn/XfK7OZQpdSi0LziJSB0vECCodIomMlK2j/a3n2lZJrUhmsFG ZKctZFq40XBTKnbsNX/CXpAtnAPJqyD6DArmdQ3y5ujq2V7kgsD6JYu0b2d8XojKXnBVb/VX X3qxeNQf3Rnd/tZ2Vj54P3HXWJodAAR+3e/EbmfLlzZaao8oomBS6tEb5W7HAMDIjZGVLkge nMaCczrRh5zYi80CM9RrZWVVaLcVer+Qon7ZFZdR8/ga0Cec++I13fyLUXf8AO1GXtCdY6dB +DVBy6Vl0xbqc50yYtiCnMMDCEqr/vME2Gp0EJoqEoDj06YHUywx0ob6kW2XIkIeb4NDXmO4 WqI9xs33luP8mbplhltEn0ghSeiLGVx/3GZh4kCwDN3nyNibbrXX/ebsZraKM3stgP+NoCrd o5qTEEaM5CUmApsitO8yWjj+HuZjlstZ1dPbGD4R1dvYkim1ZyRh9lwQdlfqrmTYOKyrPGgB ecqWN8xxv0vyFciP0wVkrYPaLOqZASGy5yHnSFxb5SkZW4j6084xS+IAZEvJMozfHSNWSfTE /Ddbo3iX7V560d+f6PZZMhkWCI2DxM/8bK2baL5HB071N3SUp1i7NH9EusiqR0fuMTUUBfLE ufg8GAMDbCp0hdxlQODHsO1gVdXLE3/y/Ivip5S1iOxOEeSZntmppopR8D1AFJ8ueYAj1Q2W whygolQcjZMoLTerlxYVhl/XXy1VS9/crzEK0sGBEnE72AUIAHXTyNkrYDvM/wSW+YuC8FTK Ef3LSWOFNFO7E6vyMccspw2d8vfCQyr+3h4rV9K3MnSbU4Thmtb+N2Ic9M+hUZdGQkt0mz/a e91LT4QiphUqoQ2CRKx9eVtqm+9H3KY07fgLPXVV9ETND/P4K9DvDNFCxriXiU3csFlFEuTQ sry+mFUq3DOSJJEY9AGpQ/E5eTfsvthGiStDraIYHOkVFwL50BWNGCTEsPG+9ucj2HUD2i4L 20Mj4/L5j44i309wixZPLb72kwNbShDdBnxQEB6hsN8nCHKnfwPGNorP/LVWvjJzH/2uaVm5 lfXmn7WGOXRTEiXXwEYLPspvqA+aI7Tn+5Uf2S7F0b/QY6xqZDezWTi3nmY0mmKy46Ku1YWx L8d5zcMf2QNIYC0VKjP3mrMwgKRFc5rPrtLxXaxcy1fp9gwHmhnbpKSe6jR2hnhjW3raDhBS wZiJW+c9TADneLSBG3/PDJsph5lGt1x0h4YwRAduO0AfsQf04drw/LsQT5Leaj7zwML9xpH/ ycCv8w03VpMfcsBp13vUQJZT19kWEFAk/2tzeHkoMHVbyNOFJTqX43xv3Qm0qnsmru4fM2Gj K0l/Fv7usowE8Mw0CANzHu6dkpeZK0DItUmLKZcT235NzGOmABurQyZfHra4Ccob8eouh3C6 wtVRGn/fkUP4pyLWkRjgUuC/rUTP/ntJhLxI/mT+XX3xxYKrH6bd591lk3J61POIZwMIb/nc +xiY3ixlyksWbMzWWc+3ZquTV1KLAa2jE3OEEw9wBC5asB9Xq1AOGCQEMy7BFXSx28mfFlYN 83aJQaqvrF69T0SNd1TBNK32tqu9BSkE1VPLbw1DQC2InhLYHHJXAt2Mu/Ktb9fMfUCbKNA2 oU6yuNRkWAsOily+eAyggC/6M3iPf73uOGqEPMgOxH5Qkz+gAzMfB6aqNMBjfA2UuhQjlI/i D+p1sQsd2VRVGUPk/LuoFGuwF6OQEPN0qoLTB7dpcg2bF9NFm7KUgBiPjB0JuzC7nma2O030 bEuclpAIK66TSREuNf3u7h9ELGWYz4a3iwuGFD6YJJU4d+UjQTvL57OrYuKvJSyk0LkzexMl LjD7f4fVcmhwnCvjFSKG7cu0O7++kprOGBDdrjLmfCx7AbOuoHDX6aJudn1ndIc1VzGZGsv4 20//IVnnvfV3HX19TU3t/jRrC2neY5xdkTPPNeydWI8W6DbnDmJaSjdBRSZyQz2WYQ5X3/ZC 5N2PpCqWTpPQe65ie2gTxA7amMHNE4eCISYqSIhFqZy+zWcZ8F3ItK6KJKFfTUruORm6FyB3 USMHBpFBiQsIrS5YOlQ58nbnxT9gSDuPPHTwrXpeJi2602k8zQVwzLY58+d7HzRD5/0iMqy7 hVOlH7F0Oe8GNIVAqUV0Fg/qSck9JluZQAeKQp/WlfQZeu723k1VO4qPZdzygzVPhD3ast3i 83fVAd9PPMAHWwbv7egtqnpu3wPJ+SSALsaea8YWEJVBDA/9rtvpP6Wmz4ZTO3Qz91FH3dCh ZMIu9gW2SalKZcXJZGNs/YflrV3lvhP7XxIt/8Eu4D6O2xsmx4zpLPR6BP0SC0ZT3+qD4vob xlW9wuZG7EbTfBOoQvg6AWK/jG78cjEpKYwPkWnOuMReIFDYwKfGqfU92yFVcv+jwrMNx+ac HadynsY+Db5GTGfodCS/f3sJpDwMRzqs+dmMF5TVcbPGpZlNLmyXc+N9alKD/8O7RC5TgtpU 5OIBn0c3FiW1c+xJLzj7E2HO0AzIECP+/7Yed0OZ4nvl4nMCYQ1eHYvT6e+Nzo+wOKYL/OVF ZRvfQYI5QjPhkN+USBvuI5hbxXeVBUnA5dD9Pp47S/2mgAn0v/JrobOdjhXjUWfltij2UfjT L+xYQC+xHVIC0SSiGR5BsFtQJKOTQeqgBVJNpXkmAYZ+jjC2zmq+41dgNOfTGHZU5uYCmelm J2YB7NFvM8oOmUAcDG4eb59c3Tq6T5Df/5LwiboKjd807FZE8R8XxkqQoukBJweG2YE1b6Xf GzlA3ftFPxI8wxylweN9De/KHQucOSkr8zIjXhxV6Q0vEOZAcHxHdM/ydsRjH7g0kw8hS8R2 hiPIDOQR/+j6zY/s05VwOvsKGwsMFzbrI5hbY9sAiXLzydcDZ37sj6eu1JrAwp6LCQb8Q4GI +SaiTsPdsKEZ2YAtol4TouDB6cPDE+qLXWM5jvhYx4YlrwtWt5xS4c5VFTUrw/V4XybpcChV VNqWnN7975uLAfqH8699BU5UtbWDY/42ccIaZv0AzSvuHRwdakN66VilZ+Zq5jwhHfXXPbdd 3WDhc43ee65idLCdogo9BREO7sOQirgAuhzGk7s/8dcEsrRt5hEuxcq2lzAXXzmox4Vzff5O WwBELOfpQwRCBsIcw8DGJv7so7PPLzeYzgZgifWQDMijMQW/zrJDUBCZkyKgvO2TzJU2oyZ7 +cIcSYLkQ05tygrAK/BFZLiwGFiYXWID2OfBuR3bLiqXuf6/xZXftx5HjydlgXzgyuDnDN12 o/PO88i9VG1hBXgi3gsy3odzhaQUe3B97FNDJHXbjNnzJHpZn7/NQnBH9aH4bovfEV7kCZ95 +suCMXFhvH1M/gTgGF7Wj0dweA8tr7i/OmrElMFL4x3ZIzqzMLZ9FExqrToYJxv3rLBvMQEx 6G79uCqxe7Qc5JvQDnvUDd4K2Cws4uvkl53ZoZkMuzybOXYSQ50R6KFN2fo7L8bLNp/VTiLO uWhWk5Eoo/4jXmCEcp5Ue6Xm95UOnjZwQGVScTfL5E/0GOrw7cfzjX6LnK3QlW/t4+ntRvCG MQRTbrB4AJiIOqbbWYLVAuHb1ApzHnI03tGm6CJKXGV4/AaKHDQ7Uu97b/Vr69Pbilev0rpy zoaut7DGSwd9Rxr955rJVIvcBuTyCo3Om9vgL7IFb9fXV5fRSRG/3L8OU2a/50e8n6H1bJ+T uwnNmADUMQoWxzChgoahqQ3dNHp3dVkIMAFGTscn5GYDzgb4Sls0I8t80UoBc9qlORSVsXmd QayvXNP2ObNUVHW303jzGPG91a1h6Oz4VIkNr0DTWzZoM4RWxXEqWNXu6vBUH+whR2/5pE3x L9UAplRPJ32nQ0DjIzBcnFe6PI4V7Ct8+kuYtpXOuMDhlX1HdH2H6sKpGux5HdTike1zsPjz 9CPPH3Z2HsND/SrtAcEBmZPAEsYXLTjZrvLzHo9vPfZXw0M6ruoK1GVX24NTcblPxC2nGk87 Q9FYIQ4zgjw61NtisYX8l8Im53qs4Qq8WMhAnRvIYpTgtkl43azgvJD3xbAoGCj+l1aARTEq gfPW2ydtpcRuxCbBjtQ/+gwZS9b1GapTax3d9Rgn5/xRMWbrvD0qTvxUEeRgMOgpKoP7FUF7 IFrPHvBP83aMmXIenTjLtdSA+9uFZ9RN0SH5jYhXGF8VO0aPVNATdflJaFHTLSZz5KqdOvRE 7yuybj2Z9+MIeVQyPIS45etOBeqm/gP/K1gehLGGK/tZlYcUIJjSTYXliDlpF1KRlQkum/Ph HvBx8bcGd4odSQjI4+2/wrppFDbzhTutC39G3nycy4MZIdO9cWLreBQhZG+W80+O+HQzW0mm p3qqAqGd5SYJT7PCC+kyD+em2/Qg7+qYKgXk5s/6u1TbOcqyCyx4318IzWys1P2kaaI8jrD8 +MCzYYM5DdkyEd7/a3CTjIQQIL+zLdKLmttU6HsiZl0lsIRMT0dUFrHN6uqwCMNSI8Lv0zRd Nb/RI6jxNKiD3tKI3KGac4WUZcZrWXKqHx5FYUC5EO3wEPWfKOa7UcnIJOLvoOYnk/5xjqUu 1tTFsHOs8ZZcgi5IC67JmGWo72I7MyeUuPcNinXatB9p+2qraMVj1IE9MjkBWKX0xuZnkyOO tRvv+Hlj88v+oofATsTH5MyVjZ2VRzbpJ7u7ZtNLUAtwV6Xx5Ry7rwWujNC2/ntpllOBJ0ze kGhxfZ3l7sdxSAUEoDUSkDrpacTY+TbAj78W0eNZSr7drL1102e+uyYU8ogtq7W+wu3EyhdW nONKxJeaOf3N0Fq+pMYusTTUA+m2GQXDTllWPqa8asWdBi+nHPKJPYT+IoLQE6tsv93lthnp rmpUNfU2j8DLGr8SILfxrLZNQJtrzIKUkC9SzOkj7PJxn6H52gMU1kqt8wBQiKNRonail/0Y edO17tsnX2YAyhAfPDm3oglueNMjBZb5vdfYaXw0BALH7MKElof0EZT7RaUxO+DAeG8x7yIB qbmE084X0EGireX1qqYFWDHoaZRh8GPyLt5nTuqW6BkKn/N0bGDfPFqanSiuwkix4gnh73k4 ol7amTipsXVi+kNp93ZPzzrp1/qaatrdJvMv3+ZUt6rtx5foHEnPOdnboBFuIOuogDI8g2o6 JjbXc7zNNuo3ZZoPfM+w5t2F9CIFnNMAdfQJ+PE2ni5hQ5ca5LxuZuk00DyqKkyP2xl7ciCZ 65nc2EJZQRtEZVmN8nAUZqSB9/VjcqEf37szf+MjCme8K2ia37EtFhupLZyUGxYn4QWc54KE dWfiYT1Ik+LpO5q5+Tmp+Jhj3A47yGXSjQFgUKs2XPtGAfVOiJd66NLmP6SkkzemuKv3c8Bb J+LvXPc86CfgE6hZIcD40B7C1VP9qzpyq2dKOT7ncrSAxbadrEtPpoU/If/nqbR/MAV768yw zPon1jwgjozgu8pBGs/91sml6Hc8rdmzXI0WWlAbVMo2PNNySlA83bby2xCZ2Fuo5AjDV+su 0Za/+N88TR0Vc1/fCzE9GvFJCJG5wGp/APZKJjNJqeSN1tE1ZA1f+vcyNZBCTlo5Pgn03XiB 7c3vC78NScEXX3bStKu3g8Rf552dCq9Zigwrfthqu5xG6Phy72uJSW9vIlIw+BTfxuzjPCM3 ha2tzGRaz+vnNTN3N/69dSH5lbqn5i6D2vR5gGBxw/YqFNCWC6lNqcu9N8Gm3wqmv6kA4veU vapCUu+F6F1yFMcHl57e35QlxLlnxGDd94mNbB41XD/BObyVopDQpYRvknCfZsJOgr3J2mx2 zSbxSf0/PlxAU4KwZ6YyhtNgjIfs3PXj/83S5bAn4W8nKffqeoL3fMu5E0UIikXtQ8gYPDRO 8t3ze2R1Kn64xD4tZZu+QsdH1A71Ktrkw4+wB07Dv2Xk2+BM7CHJfN/lNOTpTINgE32Wh6g+ S34/2Cc22dRlnd3q8Zut7+7vEU5AKcGZjW8n+sjdhCl635lZ45dFg6pp+HSKohGZkGvuUAb/ Fd5/9xbnFKL/rWRtq5VPXfWksndmpmHQTc6CtWF9F5VEimD32uhLFAB4/84Pb09Uw6svXnAu XoWKthmFZxb2kdv42vqDqq2sjNezt13OOZC0lvJ9Dy/OReS9bLWKTq9t1S6nZbRisvXOjg89 4MZ6d6NpZjwgR3U/2Dd2Q++KwdZF4FGNe0KyflPF72jT9IsmULpUU14i5y5CO962g7XjyTdU 0sr7/jecPT5PcjPgtALqz+qy+vg7K1W5Bo1yW9C7/GJ//Ab7bEBuobNIGzQ/B4t328duZ1Gu ahq6OB7m3qSy/AjdGqKLX0TEe6S7wkxXGQ+rJwd9h99Elfa0ZGEvopHqHNDThcltct08cOou ZKJv7UZK0/rC6bI0S8wRtkArbyNkT+dQWUTK5pVWINeLfsgiwd19UD6lqJ4MO+Fc5L24U5Mp 3uQOYwWGpAMc354FO2dUxP1XZhRm93XZYDt2zh4J1RHxeFRK3b6I4PWuTjrpMlQnHm/P6NaC uejtPVmDBlBZTCyyzLt32W3A1eaLOD7awiBS/W0sb28KePsRHilQ1MM2/YK+YZbF7ad1M2gX xw/F7h9Zeb1mB+3wQDVn+KENuLmD4XqVOUunsvytHvQyZODt0IHXOtrQ/oJkc7mRxbagrbEe IX7KnlFHa7nAjugmcDPsqYRUPLTqcNkoJAWIpnuequa37QOh8fvCJ1FFTTztJKSh3K7GLUPc hz5/he2O6CX044eWX9+8zVCrOFyG+GEqEDbjcF6F7CV0ZQeafuJzlC96Wn+VYfnZ5nmWs0mh h6z7PyxuyD9Eh99L+W7y4g5iB1tWdZ1xC4EntDWmnJkaVjWo8eGIiTNTDtWOizdl/WxtqKLR W2/fPDK5VIHZGblVhX7Fa5+QZsWhlenZsc/i+sr7VbPMHWr5z29xsvVrfawR9J2pRZWeKtc3 nM+QeIbJrXSHLr8ncu2lvbgon3wg7t4AWrNovZwlsv0MkprwOTvHzXEBL0z+snegmhKeWJfr qVMLxiG9tI64I2B7KT4/vN5YMBRqZfuqsJ8VIz52aywacAp7tH/kawWkXiONI75it/wHWKgC kVvgXGa58f0IWw3IY19jeZ6iJprJyMjRsbKeadK0M2jYC8hnOOdZq+30fty+TB3fhIN0sSF5 997CnixoJOdT6rTnDy9li54jlHKrrGskZwtVW9HfeZ6NgkjxmsFqAlHwSqOwhoQHlLLNlNFy H6QCUot8O037bGNYOtZZaxCzJyoSApw2hHSxEKyM7Ig+j8KeQ9KUJv3qGabMbsPtB7j6Hp+H c/T4+Tder8sBeR99Yv7VxCOdGQO/BoJ4lddiW6G5cAFnKIqJbeaI3Pqp5QfZ/z17XIi6RtKa 24EenIgav7g1RS+/03a+XLyRRDF6NbQ7jv6yNVIJHhfqBmNIABRfSCxO3pyf+tWytFS5XKsH BBuIr27Nbi8jV3vg4FN3gzq11KJSgk+C+XWwDzoI8Dp0PTnwCb0AGQgsHu/tjWKN7pYQpZA/ 1Briin3sSDoApUMiv6vhtHtMiXtj5Cdeshj1BiyrOTWqkWLE/n88XHkg0/0ffx4dSkWPGA+Z 6skVc0RUthFPqdCUWLOZUjnbZiRz7ikkFkvFnjVHkjsk2eacayQkEbEhc+U21+b+rXh+/p/P 9/3+vN736/3pdaP3KDZXDxrCMjeWG78z2KG1xMXzQXGSMgJrPjg5T7XQVv/04/f7o1bymBLt JwK+Hhhb+s03m1MCll813FTLfVPAY7mPHActYHoFwRcJPQeJy2TIMPbdQKKkBVRM/KWWF01a yVhrlwF0clIEL8u0B3Z8z+4FGFEu5kwVz5dwvvjcJr7NDhUyKT8Dsj2p/tQYSfR9VyID6nmG c3da3OfynA5dLHurAZwdHT2PD+e1AaKcmLfUqGlovEp7X5f/a+ISl/6GuY/k568txGymn9vu TyNRtk4TBs+NGVg0eds113fnCnXPQqywezg81pgX/75aO0kaDg22/pChKdNXbiTFFtUOIGGl nOLL9R8NhVdTYtjjM1be0ZsMh6tilu+F+5RT0fLLzq4ptUs54Rh+lVp7aO1AOgH63joNUyqY MtmfTrdOTrJVr3C7yanWU28xCPracobPo7NMiIcBTmNzVX2bdKtjB4Q4ksn7a1ytkP4yZNCX i+1FIG0SozkIT7J8v80yk9Npz8y/WwJDL6RgPGQZNlw/ttSKhjo7bHktItvGiITEKwLyZws/ FP3qkFWSpb1IG55KA/av0d1yxLnuFjlGjQ12lMA/yyDYv5p6xqmmC7uLEMld/xwYu8BLgZbL R2U44pvRiS/4YQF0EBZAXFgGATZaXUNZUps8Q7UnOwZyAQL95rsVhJNftHQuk+fghRj+YdX2 VBHSkyTPFGRhCkwhsExPJFi1fRpCCGNrbuz33iTevbUS6ysSzrnCvEnIyIACJugOCedWxMyi e973xxFf5t+pWtfBpDC/0ifhNKr0WLYNw8fmHYYvTk761iTnzL8NVQ7aJMxcpVYSEWCg1ZjK mOsq6sui6ANU2m+qT0kzbMB7g7pe24DzMXNhAa28Y5freXYhvxUbbkLpvmkOu22C7ofrC/ur +Qqec1YHaxwXxZkwLcxFBj1aVrB2Kppr2oniAFTQkmzRP8i0qedBwHuCNpmP7dGmNLbJ0vYO wXTv8m8dn7VDBhzUscaQ4Oy3oN7TIb4nAS3m/BOn7YNSrW3IsmMdrg/Z44u/eZdvNmxEsENw H1YMsjHdABPHf5eeCqj+ZuW6s2mM5mlscs9hGUakTojkxYNL3icRKH2nq6+A3eyGTMHM3Zms TZ+IEbtNWml4rWyyzq9y5r9pnUhXaNbWTpjD8L+BoPNhAZd5S9sXntgIMPwyJuaTKgORihBB MpWTic1ZtP3wdRMRs7veI1d1GMwTL7L+hsgwugbp70Eht3gv92E5RamgFOhnF/4rtggphpaZ clohhzRF+msMlBFu1pmZSvcvARihF0RRM1kos8AEQf0CTiuFXznIBRwYC+2RNYqkcJoMzHoY 7EmrL46Bd1Y9PAwatUIaxd9KkzqnUgYf/PJ01yO3lyC5F9sbObxe0NQA3NYs2K1ZlCFHhJUs UNN49Ov8yG/aMWwKYXrJc1NyP7FiNitkbZm9yJ68fkXnso4Mw7GE+eRhptyBMffBRlyHq+j8 nuy2gOXgZwRAVAaGf5Ub74zXQgsiYscjfhmW8tHrANjN9tt81tw5fVlGeANmVP25czIi28Yp x/wCfF8FouwWvy8EmUbVuYEEG7z4g7Tx3XEk/1cPpvLjIZv3TEnzWPYcT6QuYEQm42i773uC Xgr0g83qxnoN7/TnpoiKsN/f1HzIVDTcDO6mh/7SfeG3Y3HSVitJpT2XmSv64UqTARN0tD34 4fI5y0ypNHozCIs7UP2dTr8WdB7QgpU1+VX2/L7rroquVTLn7HsE+A4pY1uz6DNPpQClVJrT 8yXVZGCAjfKEy8pMNgcXp/cfyTvBtFR1fc1P/rhg2hP+XfyZKPW4gyz77Ar4pL9HLWWiq+jm Sgc4BZrwxxiaayhGokzthWlu5fKB2y9+kS9r8CEFRpbIMW738MjKUGagsTI3/ZkN7wPFDINc OvQ8SaK1lOhNB0FvkeRw58atV+q2mjuPTHOU58dfQXcqPFMjBapj2ZgO13QMvzN/FlqoSdF2 80IeXDoOpeenIVAYl9BE4SzRH8/RBSX1hfL2HQMXBPTVbKZRDw+ou6VMzHGPbJtnBh941v5U eszQHEKrUPDk2Mtymkos2srXGmZu8veGYGcIqd3ATp2tkRbgvuGBb7ijiSO96nWD27qPTl/H G0uwH2aafM16rZGC/cvpkjWwUXrs3juCJY1KpRvB/TYmRDd8ClwqG4J7Vxpv8iZ5a3BsJVYs URHUsPoElTSa+gSp/Ki+EcDA8nX/FnmzHDPH3Qte6u4JFWPiKXfd9Mfz+oEbt5gAsiRMULkX iLNhug6NLOC2Gp2RpgixfvgZqQvDh4/BAA1/Q3dFW5AodPZA1usCs55zFQm05ETqRxqbgeO8 Q+z2bcaQijAe+oq31KFNwfx4XbAtsyfl7siXtuXIramPypOrM4K+C5LJPUNnhrRnqwK5iWk4 Wy6gRXpMajrQrEdKJbqZh+Z05Da/qf9nxTi5t/PaauFJ5Kea0dP/rE5evkvYniyT9Cd3CrFe ts7e6sZLf7g9M/psD6SE+ziWBPYHn31UjFue018pWYS8YhfycxBmjvrtcjoJAhf8V/pSA29S dH+S7BVFkh+D0NC/I5yT27A6KTVh8R/cy8IjzYwopR/1Y2nnHcC9yv6uTiqFws586N+QRNf4 6KDivLDl6mL9wrYCOug91TdBOJt4raTTROGiVu+YV6BOGjJWkTtlT3DZmF8Q3yLOnD90shKa LtAbFvfzPzMIfCIHBqq09eUVuvG9zdYwmTZSuxfK6CA61T1s+Ykfe4Wr0wskqb1fbu0zGLrB 1OROWc0zphBB103ebjb1CrbPCrSpTc8aUj/YOkOk6lM9350skTLh6yAuZmbE6hiar/UmIo3K 6LmBNMQNoUc+f1EAJVYWEFz4gzP7H6qFl1alsiYjg5M7jLfuOcp0WdBHnBfoVo3oaZMP+394 Y0Ee6SdsnMA6tTbdTrzq7kWDZ5owzC+I7lcNdrDQsLC81A9BQ0SILUxfYI6YKMawOUrA0Jn9 /1gEc+aW47fIAKr7e0tvHTeiRGwPPJ+rRkbanDQV4UdOegxqDjF+Pl9XVNb8pq2WcjicF5qH nWNY7Iiob555YmEULn7fIpDVGtC8NZyV1pUq8z/Qyz4/MjwrpXw8trTeHC0Su0cvy6dMqnh+ RuUigPyXU295cKIHp/qMOj4s4AbP8rAM7EB7oCSDtbJjJ5AkXhbAunVht45boe7qgAWciSXv QQmagF1wB53/W43qfXh+tfG/R32MikncbbM/8JON9zoILC2gCnb3gll4QAod5KmvmeBiL1/h kSKsLG2ymg4tZO4r3icBZzi29tP/xF4m6DJXkIxmYJecQ8v/aRwuv+XOrKt0cWtmrQap9ZCc 3lf4lrXFybIvV9SnRqjsgSZeA89Dv5T58o+xtm5Zk1eO+CJq0USUlJqMciabcxAb6ugdzgr2 3OlHFPc3aQv4uKmVndK629zCGTqtw0CK6xHGP1wwem99TS9BL6M347ooBoiM/PQuNqcpKCwg QXj8D7WKu3vZLJrkdI2y5FFAiwP/rCG5hiQJl0UaMHejjC6RJw7k1m+5oiO/21Y+U+uftHxf LD4cf90oFmmKVRzsOI/dNwiIiXBDvRgtrSPt9t2nZvubggcHLdPdBJYx+aono2zvznl5fKyY bXySe3w0z+v254V0TSGSPJFqQQa+28Ruyvaj9y3Iq2uWb4tzwJFcCDYOq3fQKHqll/Dmql90 REKA0wN+vA03Rp+EcSHPRerkphDkOfSAhWMmcPBElOBw9/o6Rd5KC3iit7Uf+NBTkevsteP7 FA5SKAUEM5U7IJuIfnNHjN+3wpN6Vxkqvi6p+oEr5tP4lvZB9okF2e8L4ZS8chi70AalRjIp U1atCOvP0ZNhoPlBd0SVnfXbPriX8vrd3wAtMT6CF4a+jUhDs9Fd+SLgcGWBe7H9jC4kedwR 6bc1Zz4qto5jEd8KQOkLh3xs/VVnv+PTvpJaCVp4zTvRApA8OYUJzySuHxTlG4aFI9mYubam O0KPXew5ND82jBeaiW3UwkbGXJIk/vHA60+UmF9wX7EPcjw+l7Z5F9dGt6/2rUyE/mlqiUNb jWj7SDU+E4lBq5eN8fRDncWiB+LpdeJufFHqMFzKI4YQNhatE4TS5vxrL/PQ/LVAv/rdY+Or KH5Z4xupgkVicOSZWp7TEF6fUNUvUeurlVPf35KMBK7FKqKqGFguyFYQrWiU939q3TyZZU/o PJJb2uQ4JPFRGTr/iCs9rpc7pSCQNsq52kKvs1zABJ/Pqr/GVdEm0arfReoYBp0I5xXAg1ry EjkMbO/7G2slRTlEpzRH/mFfKrV/5Q6/hT8BhwvldvCyGFonUbT+llfVcWcoVUO4QkGRZ2fe ckn1Jr7jrA+t+jitqouj5ox0zozkeev77y9W6cAQuX71exSmAY8FWP5RPlhmIzVQPaTSjD9J 19SOzI9lRyhECTp5aAFOrPN4uJ8306Jf8KCq5+fApdgbMS69xUo5V7m+xEgz0h72ZRSfHT5e /GWcWm/3I94dPBEdyKKKD6QnyD+mhax4QbOCZcefLz72FoVKYNRKpVw4z31xTNeSs6xEKmV/ ZbnmPKuB7GXhJFi+bXu17zf2kkgkOR10WeV/o+LPrHWHL5U8Xpol1se2mOdN5Z6dAnauE3Lq MMuWGvItgc3L0iRabWkEz5A++b6OnubDZpBvfSfhqAL9VCBD/UG1iecHkktu+prX0JchL8xD i3AnkhilXA7wyTNxM2syfbbrm8laBQAAmOghcbgo7I1iq5C//FErA9lwWCvTLhvJQkjUsb5d wuoBpk/Jw1KERpqfP5nzy0yDL+8YK9TPUCUrUd1o5ae5QQFEAbuHF1WFcTfh0hqdrZFezGov cnW+Y9F+7nbtwGRI4L2QkPW9W0o8a7qx2NLS+LvDyCdqi/WwRFPPYMNAEpw4M3M5HS+bjbwE KWR23mTH4+dw0xq+wbtJE6VhPPyD5VGNPaLq5eu324YTX+hQ1/bgQ0ma4FNctY4sE9T09XZ1 nCQrBVyiCN6FWkyi0b6e/i8O7H9LFNS8aHtnpDPs41PMHpKzHoR7k/tsiwMQA8DHGwvwhBqP AiZM0SdSoEDiyO3eveCtvj5/IeFlBaE/IZwX3pVjOHNbJg2zRmcSlmdPglXbevoNJ4Z7EzlG uGtHHM8IH5h5HWBOQPT19SEQyFZ+Mbz/M2uFfus3ULlfbKv1cJ43qQF0xI+MdFiLyeZaDcCS oUQsZgDXF/+Ab3axB9Q7XkF4J6r8EFDHGvhXzbznswMRginuO5vV1a5T4bx6skv9y2sUhH1y 3oELRYhJWoe58HN9MF4Rpmx/MtDgBMX93mqqeFQN7qEu+FjQp+3YRajv2NH/0ojvz+NZPvjk 0o+3vdmD8UgYkOWv74FSwabY9HiPhT9f/k0LvYttm89sQZcHrtQVNUqwfY9kmfFPzpx1dKGZ UbqyD/tRu2hh6wjwQYBatJwSdhqdBL5iTTvFrfE62+/6aXuoZd+zZ2qXEk5uUR1cRPhdq1BV U5ucJHVxr2r/HAYD4WjIw4E8/r+2xKUrVcx7dbkVoL0ho4VsjhlembN4JEEzZG7ZrhkNMTbS H9rm5ECWVb7njiSCtKM5X1LweOcA+mHsSv+wV3j/zzWHNlsXr6WVbwU3RSHixiacfXYdjLbc efKeFQ792sevmMr9Gz0jHGrsVmL1tzJH2hurhC+1RGUtKYKKUE/ypfpqYhSdoeXEAqby0rH7 lv2t/Tg00o+q0nbCx14F482snilGwIWvd3Png4Uz27dUafH9LShw5Egarcl6KKrBelDiQ0vC qcAORr0OtS4Yh0IOoDOmjAcQF3vIf7Y4NC+/1elViELGLY7DRWlFIdyc0pUiQm+1CL11vP4P cA2wDzM6mjirfrD2xS8mP1MDtZPCklI6nXliS5OysMr1cp08c4fFYfZt7DFKg+PgMP8ULCfn I8gdJYu1/+5SxcxoH6gTHtJKCueF/Nu14idxce7AheDvlvbd8TszXdMwJlJF73NhAIFHlUnT wPL3jKQf0Y2NctkehR/vWqY7lbjhhROjo1mZMzXaM/xtDje3grnk7ysRJlrlOL2c0kaQll9s 48BhIEyhs5fwISviOgpAXHCwGxs7UViss0Yn1NugzPaoPUWXXlHH7NnWPtBO/5oDZ9vaPHwB m7Y8B7n3nVa1IXxZfde4pMmiiJ1Nz6FoZwMOnRLJKxNiI6asyGERN6BbOSXpn/VJQZqfdrro Cl+J4No6kAHOhfqdO4uNqnMcYGBdf8qbW5ZbyA70NHjGnrMB+1L91accXShvGt/kvs9Ns0P9 MTtjr+zR3sM7zbfbSVQ+iL2Jdj6U9+l0dLYocVGFHEOJ9TFw072QLUkV7pfjR8tFOEVhVY1i 1cgwa4S9Y9HYHjlwxtQOrECZcBGCfRxxZGHxWpkaiRHBu7f3YkrjG3N3ZIpd0I+leSibd+9K Qr4fbm0X3yyQqtY2MqJFCeExw/ujqusXSyv9pnu3XELdH9+UKL3lH0byZg/N/uAPdANNbivA rziqYIGPcyonpyD5OE3s48BzPaebJVI5AUXMcJ5TWyXFjIL4Ra5nb7tQbhd0a2keDVpvN1I3 sLAAiqQ5BW5Cfo0hSNS6/lw0I0tQKv2muMWh/9HlXhLXgkd7SKPcqz+FQ4JDBj8U3CyuA2Vg d2Al6kBpeccWzjiAw3ijuvq07o4r3YAMuhL15Ldiu6APNN5FriD+shSAuFYH1g5nXb5MU2ub U8KrKLsMzVxg91f1X0ydjq/yu9NXEay4ZR/nTDeEK+8E2qqioEUCzzHTvloPtOlnXxUkLA9p jhm2/ZDLv4IrEI60DF0rS05h+lGH0jB4D+SSzPPW4bbAQuFf5WoB61eMZfKH+EbL6hHI45C4 dE4MU6UNZn1sRRfvtvrP8dF0rz+DOPRcJAO7Zfihu34or7+f71X5CI5C/V7sz63mZ+LjmP6X ekLxC48beRV6SUUv/H2RJiCRiZzeOdSWcdK05x77hPCoFYYk/jTbLmh6KtF9fmzX3CgEyT0t QFccJ7NChiQFKaNQL7ttAzcPaUco22s7SvaVc2S17+PoRVt1qWbSPxuhTqvfcaimkZ8OXjYW 6QxpYwbUq2E8UVXCpR1xWZppedH8p+yb0SVaSQ8r/g0LPP3ZKhnNld0YMEd3uyBrs+xQS/Pb VhYnugswOTHHG2Fn/ryXQcgMnVZJnWI/SOe/RYMZH+82+++G8OxfTN0X8lMb+gEPcba7tIm4 W5viH9gtpAH8Sm4BrbFAuHNPNX+bOFiBUgfJCHFBGw9k4/YoDhzDBS5r1fFc+LDk9XukETam /Gh7ai1L9iKH126YuOOpA5uVDFNGRyCWL0GuoajRagqpc6tnrw17qbTVNKgd80R+TtGx/5p+ q8SjWyaCVgOSMArFfXub9P9liMO5M71nDSmNoR8YOCkgw4t7YgopCq05Vo7NLhV6U2dFuX1h m02UyljwWyGcQSh4D3ofxQHym7Iablo4zI6y8h0WxvNPx9z9dyRWNULw/HJn4JHExWUrIGNh Iusgdht84K3hwqNfOKivv/okX89Xosa6X3XG9z+G8/0Ja1IYVrvl7zzrWSWNg4xyfo2Flnzy C3sGNa1dxz2EJps1IvLz1mMZKfO5zEnjpXlOh/ftXJ5CuUM2DDaHDvlzKoVXXBuYeVnOescA rGmgxap/ysvkHHe58VPW9kM7eCt2bXRbxV3DXhpBPSVF/23I/E4c5532e0b7ADrUB6jmQwKD cUG8t1+zkNQSuyxkPsKVFBEW4CZHCQ/sk4VTqHF0dw+kZQ5Bvnw5MajkCmdHseRkRmNTZuBA kjsXsv63BPxg3q0SMby159w7wx28gEZn14rMp7Di+e9etsIXJ3K2KkMtMU9eFA591CcL/AgF JCuIUGnJfX8i73rQ7ODzF83Dt/FxjB2kHGCjcXM11UVh+QsLw7+i3quXnBRzXLM5cMlxoO0m NNhtWDskdQgBNpiCENwUBAs/UoxRqZg8D/sgN5KUMS/eqkVJO3y8YC1xqyg/YhNU7/yTQB+L dOkBT7UyKUyNDCh+MDOt3S5Nm5RTluuGT3zoDMBpYMf1ZHQurOaT2cvzMUvzd4Gj2a0HHzyN DCoGwAd6y1ekBvkR5FteGqvrPaUMyH5ylwjeBUr84IvpnuZcn1E68VBovvN/2z61DNCZH1Wi /JBalztgdWohNOkKIxq/z5ZxxJfBPN1skFH7ySBQsE6+xh3m8MakVjKUAdNPYTrtGTkojjne HTNo7YKdvY1AGeDcoz6Vr8wyc1cE09Qa0H7GHPrNm9yDjzghBC9mEqdvqy7TFWMbgVxE3sti cBhvVyJrgPUd+3XktDyuiCnZ/26AzZEeg8hkUsz42KX5A/WSyseSLV7Mjnq7A5SkBGqNBcze A+6vct1RwM4Sv+kppVOrdSc0PQsvBsUVyYrhLY2ZNaC9G9aKu/4P3Xm6ihAciaL6tgkfvhal v9OxbJFbjsYjuFHt+iTPmOXCER0nVsEAG6mlvU9whZPeop3w4EpTxkoZxQuYdToDxH7jryNN K3Mx55wr0cgz2tv4lrmvteA6SkFqPMYYZYehaAc8Y1KKEF/O6PiWqrSF1sDPhm9sVUsu+92I +bzjfs8CTbF8ZjW+k/BNQfA84Jv89HX+Z+0kHEnuwFjwLjZnrK2mTK64+UVTTF0K5jjtlS1G GqkOLVEtHHJpr4mcNMJR64uwffSTqIa7e2pBNKB4ee0RKDEroIbnLl7uMP54k7Fc+VH1M9/6 4vDdLO7fQDDQAHvBt435gF++Ul33822ANqtCDranQL/56qufJx9rl7UU7I8af1ZUCJQ6um9p Hh6SzWyGsbwvIIYRHA0oqsiaf5vNM/zbokoYTRPdLM1oaMbTmynGv2Lo6IOmYxvE8Jrs+u+a KxsOaKWf0k7vf+QsdUyHgOpnnh1o5Rk38brl4f40JNe4+RV7UldGllGk2q5yPQczfkKm5ZLs 9L8wKXOO2W2kDfLRJQvDKRUsa8PrXA854ES0E+twbOP3K0I7lTbIfobLaZrnzdKNtDN8vdGX nPG+J5sc1bdiu4Pq+0fJ3CGsN7kedJDxuiSOidDN69Kp0MvjY1RIyFJmXKYrh5fSYqWWIty7 sB7G84dCmmCdrWijvCIpzB4az/PYW42Kx9e4MErxXYQCpR7jWJqOKjmIvU+IuBPw4hLFpSmv MiOesv2XkW6cPXSBG2IQS6uHAFsMgKH4QiFa80oLCK2ObaMTGGEBsBTCqeT1xWZNpcK1H1WQ fWda98okSrwqd+bI9LE6G8slaLyAU39pwpw+VTCVv4XgLyuwvE+80RyeIe3p/kMQm1NgCGlJ r/eBr4XHZO83GVYS/v4r7D80e0lra+6ne5MjmvE/OdFkxQEs//llHcrPScGKfNTI0rygy/+1 H9aRNUbj6dM1kl40ZX/RAE69To2xmYyOlVWUvxRoe+v2zsOFN8zvmuW+/PQIybyuwNKKdWqt txSVxtoJAlNwY3p9990FSrgEdE/tQvTD2YkZ682Og8d2CXu/fma9+UntnySk2U951/FzMapv S9jmeOTFzMDwgCxEWYYjXgcz569D9AxZVn6RvN6tydFKzovlZTVY+TQZwIJW6McwUePQjSds zMtJhNLCsWgd9GwRk8Cvrl7y0dsvMD+PmWYF3QtQr8nvNmcvbDKfdHcfjRMnZ7wpicum1c39 0EOs/mt9PY5d/ncPnb3mxXc2W2ukrE9ERQQFnNw+RBbEw4iLg63bPI+P0zXQ4Zf4XtMhtTzD z4uPXfo1FFhel484lRH4Zl5Crrt1wO6/4OX/tCjwjF6D8DlWavuVhzeOBf1iXMUdtZklfGbG MWW1KtgOzc5aQK08vTH39ewFKlvCNwfTKGU2aq6+XuSVyTSiQmZUC7+kEz7ow91tUX5L4lpT auWfEk/luAWdAXY6XDuJwwsT7tXm7uyT0i0sHk3bqd+SDp/1573afGSAuf1VPeQgWUGQiI/L ynfCnR3D4qcNjI+QOPK+yVyXn/uRRP5xWsq6YMRMvWL1C70jaPmLETsn1hVdwp4sW/yzudrW IGSK6+808inxRERyknbC0Snxf9nafLuO6+cOQbkbFkLsr1V+q5dv8DpXGde5NJEt2pFPGAIt 24ORqB6eXkperE4BAhzOgwii6v11nKByhuxkSMg3ukZvmm3QYCbFDW+cvzao4R7UcSLE8M2S vw/z6Wj/b4VvLLkqSbIZz6yVlxyHxX6NTcNNPxMsdYGGdbZ2RS6MYrbogGecVVP9Pew4G+Ka KtC1o9NmNWd2NBna9ZkuSeMZ7kwDQ4PnXV8O+vlkAeAe5iNFnq5B9+5NPY7fHjLclGC8elW+ OLvzx1BgCIr2sHb8xwFlaXKtT/fq3l/LuLufG2CrCHS9KQCcxSwijevKaGL37PZVZL34Sl86 ox5uE/SdxusS3k18p3Sx4ni53UuBhzvA5O61iMaw61ww1NjV0/4G07AWlmSDoBnVTF+mMDuL cp08pRnUnNdtihsmWr/9lOr57kEFQb9OLqBze4coBrulQ/X3XRZUYdAc+73suQJM+USUZ9Cy Uf6dQtXCRWu8ouApGZZ/7TYN7/iUXS+VdYP7gG9rezG7JUHS08XFQTIZjF27PXAT6mPniwlZ vlBgXRYkEG4+W2JAM8XirYkNN/E0W+cD1/y6Gl6LY7xpC9RwiYWrnHTDQmgEr/eWfbcM0UMk F/61Y1351dR3zUmpaQjUzVGQfDJ4FJgc35Ah+mvqV4txd6Clf5m0xZT4RlIumRyWxi1uZJcF /ER44q73JNcFj6+ZKxOGyoYunJ/PC8iO+WOQ7nBRrRLckBFxSSQHL1GkvPliqsaCk6+S4Mto 0b41QfcN+icsp5R4Z/Wl+EA9jFkv+8Qz8Xi4ssk9gz21EFpMbUSI+NLDX8yRcy/PglPO9aRX EFIRh1Om/nK6yrGXZJu43OTInBc444Oxoye/XO1K54925mlp/8jEWJvFDtYtZtlyF0mdgc3w IjoJef3ev5XHSJ5a5Q/4qVF1MKtjQMEJ/yMnVz8T9tbeNIQ0B9yAlblsIPG/3sx5ePaQPiz+ MqMLk8Jsdq24lky1y0QWEgQ2ZRaRGy0qQCO2XdL6lPW/ZQotMgJ9m2zHLheB5s0/6WrdWtpJ 3Slvr3MNQiaYfwM7+DcBEZpUbNqofYdL1/w++870mu7shUu3r7Wo9P2PvW8Ph7Jt9y4popBd PdKQKIUo27JPhaRRQsJIQmKGKfsZIyGNiUlCEvLIJjKKzIztVAYJjzIkZuzusWliMLZjv4bp ede71vP8sdZxrPc71vd9/vsdM8d13dd9Xufmuu5zx7eukJNOcR6FWUuEzw18GMvRf3nQEq0S HZbCaAxCEcRXPS2KriCvokVXv37WqrqXXfll/1LaQzdtDBXOdL1IH2K9iwOdUI52sEllPnCQ TXej0F2AxOBYk/efCNwYNAWxT03Wb4IsTnV7UYdaEk1YhB6lntyjJRyD6RGzu8UInQgt6RY6 XvDtCuuhmx3G6wVzZQsOHkU3jZNubxWO7u4/l1NvRPOimGjtQ6vOmw+prof2yoU36X0AnmXB ojN/yFsWWbXcor5uVh6NcUi2l6ZKnoIn4meeglu0a+nE5KOJ0KgUaOZy/slBxsqPG8q6DjSs F2GNQjevXwfeFG2P6ueDmtCkQVvgaSblWuNq9KWEgysZDV5r9aXeiPOkBLfdzHmlmpnXtdhU HK+akPtOiXM3fPYC9xbq0xvKprdgM1bwrlbVDYD+MIWeAtSmQKM+4zVKLHdegebGHx20ERoe v6FcYY/sgFF/C4yVefKp5nhUao1+Cm4f3EtUO9qjBPKI7QuT6V0r0WG0c7v81Dv5NgKM6nLA 2XshvzTFLZMYCy2paZrsLDgsPt5CTP72WUv302uhQQZqWMxCt9jJB32uHZqv/r36zjCsg4hA IpdeFMIPI5V1aPld3qZ6W4G3uJ3ojokwpaO/rdmhR/zyU6cxiFPdR9psqJLD+GBF2NafUlRJ IXWlJLwCerXCG+MQHDL3WUsVbAhvy3l8FWtP7Wvf73K1lWDOIR6SOrtPN7Csbo7Za5hzl9bx /TsqkHiEYmKTeoJWwjBDmn+Zt1i/31u+b3IdznwJZWm6DDRqZWSCDlZfCS9Pi7hN/9YtElMv Zr6YAF6FuFGzMcPDHro7IU5uNs5aza+PcHZpx3JybULd3FhCPb2L4FM02Nrcn3Re9QZlRqBg TnTv8qqAKmiNVjP8NyQJTnAopt6dpSxO4PHX5Ru89OO4RTa0S5wQruqsJz5enxNkUMIcxHiA Y3LjA/ZWXj2BDst1RtKHmh3wR/bM3XS09y8MvTpLB7W/K6uxPq4vTI4PmlkJ649ZtwEYo3dB oJiiqTKoZEw9zwxDzbi7RcLOkyrIuZ7dDTEGjkAdAk7qP0TM//R4Ia5EHbvlTnVr9raIsJua nL5SoVJjA6shOihXo7JmFfHeiXUSsQ62oXPpxGnrAgs7aZB0+ueuSe+Q7Mc720P8yqTWD/kT 7GPybbpRgAEeejQgJRsZoggtQYaEadUKDjLGe9jT03y1k377pjQNhnKhiOAQBUTTx4i2duCk Y909Vh4rrSIgpUFhwkmgJjAvRyWQo1lqKvH5zD0TJEFuLNBDox21YbNbmiublSOBk83nM4lC kmAnd5dbVIpHz5H0QQoCelzJFj84yBBGTtyCpBtAGAzG/D6mN3yExBEZTVg/EWARAxR3EMr9 JHIW7xOlcSvHhckmuHAzvdxGbibMi1gO1c7lLeKIws6lPDNtbvg3QfNdsdTA8cCm3Lniw7gW 5uV0mCgpxFzfvURThyf77ruC2juxPt0HsV5MtfDUjxE12uTPfoHErYANTU2x8hKKG32XKPtI Of1g9fcJmxEJO0WUL/AgGX84A9eKn12Ytur8Fm3J8nvJriD08z9ZDISlkF2DQxyw9v5gPsZN +L6jWdf0TtMl45SK0pPEYdR+gZqqivOIrftFCJOLP5kLdkDwoBx38WZGgGe3RG9xs2BbVePo k0R8cAHxgvH2KUhPNSETmoG8mQqGMMuKmxsp1NzcwJFj1i+vXqz1L2b/1PRK7OOXsrMNnUpS gd1ucDTEvJr+MZFk9Nw7hGU8OMy9Ml54oS+uugP5tlXLS8LOYHmIWSGsnDE2BbmUYP9dfNwe cDYIWxihZ8j0kGYYDHtsJ1KH5wwF8rq4OafqdUsjpaD9UDoRb++YhijoGJDqJTbopasK1pTo 0KRhusBhjsUSs0VxkyiP8t6rLVXC8fifiX3b2GRB9ZN7VRqDCA2B91i8anhNsIRTxXyYxyrC 5mZjvZJV0+2wnXNStRWV6V9XAkwxDmqwr8Roev7tRtvLRMtbgmegBSgLXUA8Fzt7drJ7LTCp LfJupev2mTdKEGWo4Lxf2j1gCgLrRptQiw+W9NRXRX7E26INf3xThMSRC37LC3gTtKMO6kPT wzFZ75QFCJfL27OjdSr3PLCb2vpt4NXQ8bUpNSLvetZHF92vafqIfgm/W37B+OuP9jeH04dy SdtTAU93B9VE6FGWTwq5XXFlcp5iGpzFbmobeHsg+lQW+9v1rKCokeouleqfc470Ibh22Q3Y NmEBn0Cd8CCTlXH6ejrIj8S7Fo6ZQQ4G+gVgVa0Ut1QgNM97cfwsK2jPq1kyJjr+/legqnps cyiqEwjIS3HQG41VKhzbXDbvsG1OkSYxtti/XwhbyuAFtpQbI+3Xv+nFGD0mZiiBJhmQtU38 eNF90MRqsqFg+ZV3Y0hTTySoJMlTlY+aU3X5KqByp60baCX+Dk8kdo4Rk87j3AxLmn2zW9Wj o/O1BMnx7JgF0sPdW9YO0la8NADS5W5NjZmfrql/As5IM/SIfnEjFfDpLb2Mn7manm5eSVOE ZInVNgbW7RjlI89vhxdz7sZ60mC5wIhhgblnWgXnweE6oqrWg3Zcvos3srrwee0zAPPZ3O+Z ULHMhtfZ1ktpgTG5lqwerBFDjjXl4beHAde9iHTWu+io+yl/tZhnLEYrxrRSRbJlTeyT5G47 rwhiP2b7NmYfihZDByKt5i25kYJG71UgeeDeymydd8xpxzLryuziwkB0GFODmR13gHr83RkM puDIqokGzHNG8fZu4uSPJDOwQH3/b8YobqUsC4UvR1iWLqiQLvG5CyxvZEhmceHwgVpXrH3/ adYwWMarq7Fwr127ImRPJ17pPMI+1/211Glg1a5rdyAmtU6/ABY8g0z5YNkPup8sfUEr9BVY NUx4zTxQtpNtWfiDJSYca5DQ9EdgofcIdOLWN8We0BvUrzUqB6i2hfnIk05YaxDGy1XvZmUf PDBwyeoycTyaahtuS8kwhxiua03l+LvPXaYgp9ZkVDgNCHicggWPX+qcLQSLri5STPedlRrC GXw+i/d/XnFVGE24UvmDtedRRY16hIM46FaXL1tU5uoKNxaTl+ciUBz0vFLqwnGvAm/ETY8X lfgUqMzqwo1EqP7sU7f4oCfsVDvVdP3gl/HQ0rSKZ4YXJS2jpfwNXQ560ubqm7tdOu+X2Rpz GPGQSIv5pPo6/dkG4SJojzTgVTGUhj0wo26FcyR5qlPlWXbQCLvkbtch0dWkWG9EqvnSUGkj RtBfOh3yflRS1VMvpz2CICiD4WzF1sgl8V+HwfcKsHk//5giB9Lby53uHi+eCB0fcQ4O2Y3u rUgzpw3j6lybtBKjc1UH/WOnx5+owLKgUIkBpuFOUsFN/dcT5rzAgao7yDtrC5uR60P3KrI+ EpNZJqaviwur9LrjxMdNsojmjsNP7bOITLRX0AJm+FxuKrkoSB50P5cP7fMqlVxTHZRunZwd 8VY9sd75YPiIqTSkaBVOXA/gt5GVDYz8jE9KgWZPTnMMimFbPKDqTApd/RAnvrp0Yvapim7a CunN4TEK5B6Zsl2xQ9cc6TooLO5TlnyxQQE7LOeD/nAnSiya4DvADZ6fcOIxBkgLKQBzkJGG aNomC5dJX5HdAXbWQQz5zbk23WqNaL9IBwVb9Efx01DPlrvHew6viPwq3XlK9lylY/pYhF1V vbL0YZwZrZEiSKG0u86Ok0LRZMOrJ6sUWYJaek4IQKxfudX3YadURsVV1tuCM/iUlMb+IAxJ cFtRQ0UC4DXAtQ5qV3lSyGHOUL6U2snpU1j7ubOsavMlkyfsmo/H3J3+kNNkxEp+byUhjOnd pyELSharn5e4Enj37q4fyqxjupeWBtoY6gz+J+FnAZmeWtemLoVqj+G41nAgCYlriVU60YW6 +KDGYfW1QVGMErdEaL6ILzp6cjroJTsuDTEbm32WJc/ig1IgymnVSxxBfMOky7ihnSf9Fhro SRc4BMF7dz2NO1bCHFiIBAKwDk7dgx02wdJEIW7Mq9hmrJCuRgxY+oTWCc07Z2MBly6Mud55 BPoAdeFYYGmj/ctuYfGiDDLT/ofc2ChhZLrSt5AbtqrAsz8DhDUyp0BmHbKI8jAKBOc4FQ8F p5MU47xHGmnt981oPoE5o63g/Gl5XxXuIF0eBbTP93fBIwG6PLUKnDHlsd4mQGM5pexD8gwD KfqrfqbZixKycKSnarfCSikBVPLu0Iq9R/wQApgbp5Wj2mfJHrne4KVrNLHe50z06tUKfZbc LZQQN/flh2r46iPiBXG7k8tjEaZSnbP5LTUUEmqZZglQDmFlzgDLVRSkJjeMBs57j6z70Luk n1HiYQloawT6vxDtCAekKhbY/csVIHSGofpeeZTs5VwxdBExN2439ztc6P6JUHR0WYE54BIU QrpgNJ90BjCrVCU8VuUqR8sDX2wAU+jYrYNw3c2DNk/YuS3OIfqbFUbRuX4LcwrViWaVnsIK Rbu54ntW9pyeTPpYO4NPCARLDkI97LyrYOB8LvcAK7vbfOWX2zTOqIIcONqVmnb3kk7d6yBJ Rp88yqSdMWwJHLr8XXKWcwKmg85B1Li6L9YolUxgfi/NTSBrFqvoWiG/i/a+gRVmXD+L6WyF HQn7FadhLJtA3OeKd6EPFVrEs4fDmejAOM5E6qCzEIX1iZb2hMeJ9np4xN//iBdMxvUQE/cp rqzUyHCU33RZkejqlEnmG0tR0tNcytx4Z6lraivDbKmeM/9aZuna/C/k4fsUx+KD7IGO6COs RrPK38CgItH1P0MOfnEC6tuvBwxVyrE+mC9hLL290JyHt8z9mcO0cz/HwqjgD43F64j6fDrw vpF7SCoXzYsl2xUtMO3yKSMLT+Hc4sNq/DxmSJHL889+JVHtF1kTLpvc3a2MwDFDpPQiefFq 2soWBOD1gBw9oTGhwuUyW97yc0sPLJae78a7iYZ19Eqqy0MKPKJ+leKN2cVOJ+e6t+wAAy1L iq177RwKKIRoA7gcK0Zfx1FonUQP0zeJyizr9wn8Sn9rlHujhw6bX2BmhK0sz4U1OrEUW6+f TDND2s9hwb8i9MR80auTIz4F3gHlB/FRBnAJvCcY+dOP4BeyqrDCg9ZmHx7gJse/L+aXZbm5 0BN+TZ516C7ZNEyYyPMrL/N/1d9vpNGryymdjCzSHcfNXKbl0MZn6cCmTVxFo7RZHtKhW+/P zfunb5dl1RnybOLuV7moEeBfdcdRe2PgxsCNgRsDNwZuDNwY+E8D82LIGYahSxMr3Q7aOEh1 EAoVsDCAzhLjEx7tLfGqny1M1YZdIQQ0/7QhLS+MqBquLlHA/meaubNt4l2weHEIvbpIcsOF rS4PZ/g4k1ArS4wibBgyaHV2phEn2nufvIion7/F9Wxf51c+A2iP0xBsNmMquai3ErFaX08y WF6eb+zw6V2ZH+4NS/aE3yHKrwxO9R5lBZ5BO5dbxZGzyHacg/JTj7jd3INwqNyXMwBdzDQu 4/nJ0CFaVK1SRwLZOYW8uvRDdPUIOrU2mUDrZ4qS7ows2JgvPWxl1KukVYMZ0/KsXvPcOUbS lNufZdZvxrNzVKgBo10lPk3yBinmS7NVfNh0PQTrZ7NDQhAoRrUDGPIVJEugw5amsHPjPZF+ C1WyrDtQUWcSjHlLvvoS6ASEj1sLAMM5ShPGaUxRQ3dRw4o3QYNdzdTACPLalXT/IEU/8+he VZ+G/mMiq9YOgA+kKmh2+msEIhAGId1mfCxTz829ADI8DvdtOsBSSdWWY6G6YdXco+BreZ59 CtWB3ktfdpkj3S+IkrxFSTJatb0hBvqRQDExuy259F6NiezKBzzZWQ8hh+5NIu+OZ58LqQ7i Xo3UjHgOsjLC5mcINqQiSAlsuc7SAX9EtLeiVwH1WR7FmmzfS/idrJIBMoG340M1Y1V9GHf0 U1bsjqWiVseYqR1HVY8+t5E3CB79RNaJZ2/y0XOW4pb0Br9QZJWWkYWlTyJHya9SOkuGFVgj hNd63Vq1zsOZ7GHVHNYgTjWlxkRLf1wtgTzsfh6IrqufHespC6UmWb6kjKw+Z3HPt9dEeAXi 2V0ze7WgQvHs8IjH7AZG5/zU7qNOVSiKErWyoekUvAi6uFiiUX0em/qxqqrpGbnwtcoNSiHO sgQiz7I+dB5YtAQc4tmyMF3ntaLRm3htecIzbrCeXlC1WMozpyGaii1ZIjFKmTgBf81nng10 w+pRsVW8JBycQwpdPhIX8jWJ6P+0ueUZWVjmpNUjtlTRhdUoNFSpP56uyS3fTeJ/olD9VY7l hJiV0dGBa2jEOLhRdw5SCg2W5y2YMQX4Zle4J00fdm7lwwxBHCQNa/ATJkN/5OPJVbjmXBzo W5sNlqzt0/UGYm1XWLsDPTeCm/L/1atB5GZC0E1xwz1StSZuqZOMzHfMqBx8Vei4JOFaZfSg C9HSMXRqoV2Q+cAhIsXygrMj/z53g5P70EUPTB/u3rwuERFyj+Srb808Kx3RUhRtyamSTn03 6QeN8XJPNV/6mpDbkmhFuOK4CIQdya1eyj6/kHGJvUhIPx82K88LfM6hJhFjKIWWND78/Pwh e3ncuRAho9/aEt53cO8rXbsUzZHLdc1SnZIhTaeCFyq3FV1N6NwnWKufCVJeMT7hH4wssxAg PNPC1DgbhOWINemJELwX5oPbSyVONo0uiclDKupjBNc7tIS7iPCLrvq357cXdEhK1dqkwxKh WiXNz5rWmkEssaypktoYpT3JdZYDjVdm0TLi9/miva6kPmbgD+C6/BpzWi4gnFJ3545/zwmH okRfjaPF0ML0+D4Ed4ec+E+jqe+Si8k1uxSTwB0DHL7WyxyTDJs/eXOp6nQ1TSGCZH1En9wP Br3Kt9QFOnBXtLrv49J1nv3sOg88K8+nkwvfNBcznh+CJJtiRrjXQmMxRQs9jRjqLsV87xJL Vuf8nXywnSKOxx+KSa11VuQsVSKOhCBVZrcgF2djs1udFZNhe4G5sUgjWgkDblH5xQVveyge tyCBFl5w6Rvh6uAqfnH56rOxQLBbarN3yQX4OiVVVqbnp5Jx8GBkp8W25I/d/VgZTxPHNSbS vNNeQaZ/sWkO6Wx6jw/Rt3JUWVcMO7Cc+7irm8OoeEaKtSKK9Vj0J14F9pYttpUeU+dcfUmv ekkhol7NsczvBGce5gPniTUaUivxfs+C8r0E49kTXybSft2z2g9aPSYeoWrVH7CSZz0CYzOJ 9o5v2RHn6ZNBwiO1mOHPLzlGgu3iR7QpbegXIGM6/Yq8TIB2VCTxJLcwiMTm5KBnFbcGGS7u qXHic8iFNk/hWpVMmCQJsbpSE42ViDUMzQly3DV/Oyn099+WGlwtsgtyLOFEaRQD+Fg2X0ax TR3r9JOZET2YGx0OPQ1khZixq7mfdix5Usgm2BQbfNQaqbAOnqmn4Aptqs42yjgpf8E6zswo ufjUz8lvR8UiPmRPIG6zLU84JjKOiRgGO3ZOb1mcO5yajienlF9tjo4u4N6Vv4qqoUd4xTVj Rk7Di7ypxc1YcZm9dgbL5IbDBPZWAvFWm8TD3opxUPKn0vQl9mSL9Y6VCWMrtkr7u8NChBsh kg+iPzB08fN5yf6Q53/8mP5qoIgM5FpbULg83Eu8o6/d9yVbSDMlysTqINgyI70EysJgkouu nOvWGAPZGfXUPH4vEelw0MklyI+oQPHI0RORkaES6lv2Nw+VRmnBc3C249uBdcej0bUbvF0K kKZchCIOCm/MS60tKqtrpgeOH5ZzXikf3oYVIN0Ovlg2fWfKtj2gNYCsL+LTzJFoHVGZzoiP 2lyp+7nrC78GOHdVkq8o35r2kwLtwezOQ5zqVkG5sB570fRQI7NM3cDzg40OCzQqwW0tBefK kVDjMr877Ffm1F3YcOItir/Qq2avkswCs8oQsLAd94PVAQURedggw95AX7DW5gVqmv0SX6uS hfrj0s8ceBR9km2ZQnOsfuiWkddCgjsFTxfk+ArWlMqApCE7yFDfhYVSuIU0Gjtt3J/KlYsZ fnl0I+BiTVvz2TO7SjoCarHSgpIZ+llPyj1peqDTRxNVA506yoe2BUYh9sAW+3MPmhzXH31Q 8Lq5vtReFuYAPLxQ1EOvkeBGDSpuJ5IL9brlq0MK23Nzj6rPxBzCgFua/jCnD/+hyot1Dkhw dlopvz342W27ozE7amq4JV1fXTt1TXPHWhLWKmJNeZ8UlRmM+DjHJaOA6CclqkAm+xtTN4Bp q2iA+nSdJXYIfDgbpHkUm/ppt6qnE2SoNfenklmf4LBK/JhARvrJE8FL3+Nrol/nQ9dy1KaM aFg1jvAIHSvoUycrcNf5gP+GaMsUQzKmPrLcfukHS6xrT0ZArJK0nR4KZXwwuTG5YjRh9/k+ 94m8CetDYPloB0RKCFmzUCWxdNAfaoY83bK9V5Lb18RM1ow2xai1otXh7UuIyih23r01m4QL op1GzdJOlCHnLRYMEAEGUkj3kM8SqOlPkbX9ixq+mvKUmovAW600oRIBA31H7rfSh0+MODuh UB1QtdPKLtW+mP0BXWN6rw6cUi/xqOWPhoHb85PJoQs02ugog6JOcZ8wP9NvipVO19GB+AZZ yMaRTReeTzRzS7Tc4/2d3JgZ5M6qWmw/irtG08T5Ll0WmW9iUG4HC1tkGKpn8SM/7wRJ4NSQ TYCvROn8/SCzHAfZdH90gmVR34E/6ZTH/86M5lF0NSrkYe3c1XPdmiB9g+BWS9yLymQFBDjt pP/kwMDAdm3i7xMmAjU2yRz+KKsJ/YIZfxBtxGGznyf6F7k15bZu50U7JNhLsX/f/jOl1iar GvyBzf4wwHKtx2bowK9fOjIOtywnYWWspZw40tWbfIJWV3nzD0wI2ZXzWkrsiV+9vtSu8zAz ifhaQcle+lqJZM+ZGtM46bUGP8RGRwPnb60eFr31cc/ed/eBolI/BkbpIKfqYkdC+27tmQYS IBo6y4fkWLsMVZAIruIQD3cE9ovPRYYUs2fXuoJocThAmMWOTF160FAZnd0ivGLLj/J1DPaj 7uitoO6r9h8ZKq6Bmj43qrwkvHPdWcjR4rIi8itTqrZdQ2JtGMneHLkZpxzWAFzhm8RjmWf8 IxO3bZdoaJNJwnbaTtjFoB01/qPmD2tq3rcP+GLIBeEPC341a7sccbctL6LJEZCMoU7b6F7R qwOo+NS6QGaPmF512Pld8+Es+J1gHwtnE+cG3uqwjHsTeb6J71I4ol19FPbAwcZB8sEB1i09 dcet3OmijB5xNr8XI2kXX+5F+wjH1M+NWbs7lfmrWE8UJ4duXjw1NF6FoPV17Uj+aCE0t5N1 nUPogskvvvv+7Blmr5gu+hMGL7o4Z1tSSP293mnA/fadsiT7oOBGw+7quHnEHM5JN3DskwQI mND0sj0UHb3ma9cE7cbxrEtG/mnZc3r3AbxKujLssL//Q5/OW/3s2X26AWPvmsoL9V1SosOQ US0zRSWNvLBjxK39MR+hujT3ytfMH748rCP62o6/Yibu3jWnBdTqOtA0cC/LOQpprWr1XOXS yOgbfuQi/ubEi4k3+2A7AYN8lbp+jac2fRf7Rf/s/faY7KBc7Q7N86Hm/Rra8RiJgKxE4beG K23rrWzImpgZqXxZ+MPXS7WmPxHhTZTlMgZP+CnFsQjq9djymLYOXMnxmZ17B1myt9XLtg5W 0z42zosY9pK+JakcnLjmq3QO/GpaTygw+gDriN5hR27ZuctYo/3iLSqwvfSL9A904wHQk8ZK 4+Gx/kHkm6K+Wa0wJd5eovE21cN6g613oksUIFWm0UpcK3lR7NOapW0GDGZqpeqc6KC4+rs0 19v2HfeGQcnVMVTq1vQdY1uh6efq+7NQR9gr3N0S5nFSBmngfB1BdhAnrwgVTwK4sfpZmFNo aGiybVRBTqFItNiDDroLcIRb1oTI6whAMmFvg/bvIcDUo9Zc9sFWwWN3SiZuJ4VFvfSZI/Di /vCdue+l7niR2OzZKD22F9BBElt4e3dy7yGnXlxj6WXDtsJ6NECnQedBbrgvZcKNvXuvbALx Ho0IvKQjVNToSvbnlqgz4393RW8bnXPOogFwB3fqniTT1dlpE/btfgvT8N1ZE4/OCQusoo2Q 8i1be7l+0FtGsmZ6N9qgoxafXhV8VOHo0vRXele1FYPsZeh2n2aYu4LSTQmnQy5zHvOBUqPA fczN7acxhDWbdWaswZ8QzJedXLUkQ/pMMisOFCGORy5CgjjLkmG6fgjk1lm5KnLzLdGUnm4z l6RuHTx2+zAB20gKUHQTbPe2F08Xv3C0ShIrsptbqS/rwJd8Vh9L/rbSbmw5c0p4NpFerBEi GZk18VVfEOnB5Zq94TdYvqAYS2VhKt3928tO4+WbvSZKSOvFp87nu9V+FdfhbLHIp+YUrfoI mwgXSr0BWi+0jO06Nv77h4aXWOBEH4KrMPW3i+tBJIOfeGNCEItuF2mdLYJ2VuBIR81ffdZu 8ApItoPVy4RWDg366BV3tHCPHZv5254ZdeYy7LZMBC20Dsp4Ncdh1t92TZCMOl+bzNtshWgm /yotdwXOu02BJcEX88sZ9v9ng8yzZn2rmz3fPOT/m+6s6x1X19EJnRPH//Gz1rG/6c6qdfy/ 0Z1V45jaP5qzHtPUlP2n5qwC/zPNWWX/Q3PWL8c2b9q06eOLGTB0O/iBkcv7u5u3bNuxR+3a BvgT9GzZwjbYtPlvuGB9Z9eQutqxf2/cq/43PKC+1rb3v9yhV/OfeOC42r+eBzbvXOeBOTBU mG+X4v8kAftcrp21+lvarVNkDR37J9od+5Og/6G78RpB/8u00z5+/B/E01FX+5d3N/4XEm8D bIANsAE2wAbYABtgA2yADbABNsAG2AAbYANsgA2wATbABtgA/y+DoD17vpj+rRtl3TmyhrSO a2r+49cTf+eHPPHf8UNqav2TD0pb/f+kH3KHzIYf8v8KUMm3LSTsb7lyndXWkIaG1r97/E78 DVNqqP13mFJNW+sfXKmpo/Ovdu6Ndg8GXG6UvPv1jmykiGNERcX9vrGxseeLK1hfu/aeCoXt X8xPvnQbOzb24dSPdKe5Fm1bm+UpbPSmzTy8/CKyRnc3wAb43w7ClSd89BT/+u/K47t7ppJf IKYyzBs9aJRUn7YKuf88gV/ke6JoAqpzV1Ej5odouLmk1TKhfEA/KOUvDxnblZeb3ID6pj9e o5SmFN7wrZndm1rQMdSr8J/nnH7xnj19nFGEmAhFWEBFnxKvDSW2RBp6Ukg/qH9Z5ILDtVP+ 825xb3cRSHafi3pCpwTyk8A12GbniQIf+tz2vwy4Kn7zD5Wd+3IWPKd2v2M7hdqv8mscfXTr 6/mlt6yChfo63b+spynGyPVWyp7r+b2eS/n2wb9VexIE2pLPll5BzbsuW1TMNId0/+Vt40Ty PJKck57+FP7p3LWriIb5wR/elZ+XZL4CR9VQpvnakwPJXnNyfyF692ErhaScsdYvrkPay8Yz 7XHtI3+AEZIQ/zJ5qSRz+s9Xy5X9LY2kY4JFtQT5vxAu+q4cRSZj6nVV4/XN7Rin31jbpDKA uZ/OB342d9X3/xthXxrWxBm1/b5axWrVWsUoqLSiIGuUVTaxFbARAkUKKIFBQfYlIigwbKW2 WgJIFSWQsCgmYQ0psoRtQKUBISJL2CSQWDDgBGIEEiKE5Rt6fd+f0Ov68iO/nmvmPOfc9zn3 Oc9korpX4WYJ3538DlZepJ569dXDR/7xD+Adavi53Zu6MPgHAy761Mly92W6dXxIksMG1Jys /+WYYX0qPwz7LaPg2cJkqHvZix1CJ99BnRa3/pCuIfc9im7X2BN4AUzH0o5c29+vjV2db9Mw 7DCV4BKO9/wpUXFzqozZytZcK71kA4foPm72+I6nq3hH1U07sf7Adn1bsEOZptXx8Co6AXPQ b46fm058H3cr42zrXJCH5cBISaLDjuD4gapfGqYiFy4ohD/5zTeB4QY7bRmEUwMZmTYHsbSq M2yzGGOpwEUZqnYkGFf9tfqeX1wKRCrn30aJCjZ4OKrxLMGABbx66DF3zFXZT4jxv7on6GJF h/ce75y1e8VDIrW1r7zXfqMMVd+6U6pJp1T/poGzNozfsmquSLvHaluCsXjPXvuDtAsG5865 PiwpdRAmlQhTwJU6/2BxfZakk+WyH7pDrTqR35Q2LlMpBerj55ZKEkytv9vA4kDslfg+VXe/ iw+0SA4fwb1lacVDpEinxIE6ijvOwmyc+sgwt+DGzoFSQEUaGvjSCjOB3RAgf5fHwWDN92UP RQSzsi+dNfwgcCCk2GDtzaSOBLJwffwdTHUgZvSW6eUdnRpYJbOvO0sJK1zpGDdvaaFJXzGp nG3fbkPs0JxQPg8b++V4ZGglfpOCnmRo+Od43jJfWIm9WqXRkyvppGbaSQiLTaxZXYzTEkb3 yY1Fm33haSBMfj2iI0nfQF4r7a8xx40hHwcGz+9G1kFvP4Kuy1fTAv0JB+iIlzK9id7xADjX wzbDdzyg2rMr3N0gS9gsfLZ6jrGosjHtkc5uN7TllOHzdZXonVplBp2UiDIjhrsDzrXVrRDA PuMnGujDgsPcdJ2AIEs2QTPRTbfAWzc/8el84gbLDPdlZ0s6nct+lpBKHUjMUtETXRp9zlWp ZNtks2Gr+zgj+tHzYxiGNlj5U2cusymmcAYJhi4jSsOX1F+25Z8KcAJQRPzZKx+3qJCAylmT 49A//xR+sE0tcc8pZOuWONqxr9r1k+VO18OBF79RmNevAqdbzbagdgTYii43W7o5Bb9k5QZw RlLERqb4Fy0XFNHywSO5EBbsMNhPEWWyyl0buN+aOOp7A2UGOkc/GmfgqM7QgdpSJ1yQoVfj dtryS00NaOQlRh2M/ac8LcDVcraVcOlMvXDgKTDxmPdwLTYpWTE59PA3SWnENokQw/jKUKq7 14u2zRAOrB6pe1Q8RGQH9FFQnDwWjfvzr6m5THOr+mnW+EE1aemRQ/xy9B4oSDFOz6O2CDH4 b49Dv5+Dm7kP/X0GtV86dJ6S6mdWAZVbTF2h+JOkYlOvJf3VuBYMyGpI+b0KlJJGMhsA0oC9 HM9+5PJV7OReqRGkD2wHFGl4UhMx1T0dfoRhnAAnWh2c/VX60kTMyLnKLpG1eWxfiO6L2LFy r0Z965Ahu1Gclx1Ede3XcXeMeNE52qy2tpHV7C86aSjut+w8phbMSgk0g6mYssmTLl04Zddu CkBMGBHF1iNm+n2pT+z6cbEch7qMRuctUYDctmynfo5kZP7JZ31FKnl/2U8C0mBqHlOqBQ1b 5dwGrF5TDFwoOdWpBjs9U8CEmksEU3kZhcgMKcIynSWDdNWDl9W678SM371//2aXM6P2et8k 9/OdhFcf9BRLwBc09J9koEFaq8JhW5wgFmVKjsLKfrSvDEte25BKtlb4/OzUTz4TP7Ta5a0J jZR2sP1b76QP7PVC20LG8E+QUQkxo9/+NiigdpCAoYqt6FwFMGSrJietpXdl1NCI7ZK+Nu6P YNBI8LGt9NKTVaewnsqXGbXpF/vJZKewXWsDfE2oP9l3oNypzJ9D62JVBU20XTKfHqQWu3s+ 7P0r3McRvVU6+WnnYtEG9o1p/mQEtZ2C4rOAC+D0oMDERcfwvv9FckcrCLfd9hkvrU298S3/ Ksnk4gWjMeYujwRWiz0oCAzwMC6ZCnv7zC/EElcbymsKcinPPSQl+FUdGyN58uLL4Jpg8fSG Ev3orAsn9RR03J5wChpAolztGm5oS9LiOoSpCQjKtXy3tJW5CUYmkHZrsmtkegiVqjH4unYc 44WPPChtq3lXvejGmSayJhK+UbiuaG+xKQLyiHN2o7HkaB7NMrONblLkXNZmsjdCw66CoLPb jQCK5N82jFvU/CnptK0K4y6IuNEUzcRRN1soytmunORn3/k9NHfW6nae1ywcd18RSFPbKDT3 Q0UoLDod1sO5OXoisC/pCi2zq7CB3ixuW+PpLJ7rs29H7z94en/XvbwazWe8Qfqe25Hbw4er 80z5+1H8VUj2znuDCJT8cvatZI7OlCIRsLJ7n0PHtbfn3Cl1f+1Zv1Kr5PZ9CP4fJoZxyUCV cyUAMGy8JdIvWP99yB/O0FGhsT5pJBmclHjI/ydeeQOd9mUPS+aygTRPKoWpl44bmHCoMBQ4 dgZ/6MwBV55lrT6UdH4H/Szx6Zh5W8WMWZjhQTq2kB6ZY3WwUl5bp+EbE3MivOPELoRZS347 YwsUHUL+4gaHPcSbpDNZQSDrKkhmUijEOQfXgE5LlxnK62SNvHv+FxnYAtuAJPL+B8BXsLK9 Bj07Qb5QFMBvhipDjwpZOaCqaVp5yJH+MhKvJW+FB5lvKIUBCH95L4V30qKS4Ib7O4NQfscQ m4U3/fGSHMuoR5uxpIZvpObT87k17vNTFBSq9GdbND17s9KuQ5YH1lLKUWUatlCT3ASdI7BV quiGg8CqhReLbYp32b3dpiTFwqAvFxiQ+EyHrfMZrw7b9oZ0GpZ073NlAIEOQum7zgOyrNVs CYE+cmrwcnn2baXdyk5RSBiUG/Hzj3kEATtL9wjQ/5fMjaM6JSJuKJn8bWl4kJ3FKE6Hw7jA MegAM/iDoVnPzMhlL/DKRbFpAzR/Xu8Y5FNuiOipK7vUzsQfs7q7W+2CK16cf8kAx/x7jBlb Gxl77d2oZKvS1slusml3MghV/dy0V8Fr79DbjEyh4xG5QIIDXv7GK27hI79gM/ZtAOGsi4jq kOJv0y/focbxXNurpwEZUVC26F9595/OHrLYj3gs+sO75IQ4X1nYaILqDn+vsJZbr2HW8YMk nmdSw2qCIsamv+gb5A7HNV45ucDbhb5HI9byaPb4idDq4djGaG9to/MXn3QkTwbmN14ga/lu Dj8VfVx4c+zuGQFq9EJfasmbH58jcJB+UyaIkR5KNY788G41IYICmDujw91ScAZu7zdL79wx grSS9q9uUoT3u4IkIRZdAaXT3EMhr5arnEl6Se/DFFplz8MUDTxtdL97Dql/evFmv0+fzh1J 4QfWDbOI8WuzuacTl4d790nnHgMe6OlBGs3d+qfuXKAb/S3+T0VhyDx7joPbh0WrFRHxr060 Sfr6XR2NXJ90pEy++if+B4+vgBRQtHrW/JO8hiQhfAdd0u+dd8wzzytw0XTKf+Usft4cX8ib TFeduxLgy0ktnrKEdi2PQscUXRiJaFlG3ULtaUd0GKTXJtn1nkJUweYEBqdr3HJpe4/U/Xq1 sEbg8jRG/PzFgT62rVgCGwbYnT/fnWuWsPQzAXRO5jwGRujQk1uPgdhZUTyW4aX2SHxOMc+k ng0G5zmxYD3s2g4r4/DR4jG1+xrpXgjKA432BPlsDlcZsJcdGU7kckOoAgqzZdvz2Mq0e/ld TtcgTtE8aPZwq9SnhkLGD5UD9YUNn00+vuqRgHFbYqMV2STfQiIBzUd9paSb06bhBDozgsRL Phf7UZsAuFDMbj4bdtQS1qxthqvFw2CfxSW9rEs6vr5TfYYmJrdMSgECOPAYuPkYgGBqKl4E iaq7x6YVVbu5x5UfOLga88NFCOAmT0FP2x1z0wpR92mlRgGcGddT4MD12WQu3mLJN38hlfxD n7163imKqbmKvSDeEtWX9EbZGX2Ln0XGz1O1WSymgIfD4kcK7rX8qOizsrPh4GYBjzs+wq0R RIAlMCsbuC9R0eka/hCY+8DN4ljXApfnZemCiJJVrK345e+prH/Lu8upYnduPBndcakyHn7A aj23Qwn1VSAINSY2GSoK1awvVMi88VHJYPnht38FsQeR/DMa83Wme4ALrUQb22nkG/uz+FL9 E6TSU3cHvGkRPXwAtF6sj4JvgPpeDTGzPxDAIqf9yFaSwcUHacqL48he3lj7oDcI1wvJd2im TTEdzwQ6bvTLRBJg7ogOf/WjL3hfcrG3LJrk81kYpdKs7YjZK22Yq1qbSM336LOIFb4OvNey R1LhWX/DeBURXOehA/0ho/GN4V2lj0g8tcWE/91ATPdNE2ReZyAIE9LGT0Pq7Y6Un/ZiGDNG e4IJjpH6dlKfNXqxTGf4yOcVLQ2IE3BjGYpa7Bwoc2ew9lp7phSjAoTU7yH1u7v+turgMmn2 BkbQkUtHeIoJ4OTdTZmm0DghrU5qkg6zZlyPQRFPNMJK0soMbCCz5Rn/xYL84D5VK5z+w5Ch CmJ3zVGh7RpWR/C82cqVgwtzxGdZW/HzFZ0UlPwlFn+TxGFj8fxkn2nRpfsS4ROarvGUcIoi 4gXJwxh6mVqaUGUkSt9uKf3mjQn/xPDRuvysTtaOqTdtk9wD8CgzwN2siAkKCH4fX32oOT6x oqiBkrBXPDm4ymfBYOPCTOoEUnBEb7UHRosvdkm1B95bParlr9bsnsavnnNxAqfQng2HbNFu Het/9sVf/6Vs1yGpjyzM40T7+AzLKgJjNxLX6MaRkwuoSamKmzFLTsHiw/I5OhWvTt86Wstr ywZIzZ10DSrp2YBn8z45PsSUhORIOvVUOgWlWu2bY9PbmCB3BH3o74uJW6VzyaCSTKyHbqYb Q09ebNm8eX6qSy7j88bnwzfouirtkxiO6uWWU15xjdFrL9Tb+yIQ2/dPuKfTJ/1VBnSU/sot MS0r6MmNnw86Dum4qy/zCI+jmTEf3xejpo+FNWOJ12b4jRYLgfiRkw/IvD5Wa6oRZLYYs/JU MbkwdzgMSkxCCTRmnHg1ytZuBFT1BW3LSzywyiH6qEZtWyjce8uE91rUA55A5xRS3MQfx+Jk H9sjxbyxJscKLyz7/euSifPzLKYfkkF8cmim+WOMDaJYbzsiO3p6Po1T2eOWUI16DS1a8rnE EKF/fktpO8kzpMI7Vb47tCVsTwO5OdQDIxbWqJpG9jYmrX0PFgqV2cdMod66Y+c40zTbdzWK YjVP92QzTNcm896Mxe0+RFgvYFCi+s4rrM+u9EGbivrYpwde3KABmknPOTFhhhhQ9tE65pKl s/Rif6rXSOWiyS4gLRW/e2YMioyrlA3m8ozOHEj6XbGR/Gl7P5lXaFnkbgKJkLxVw0TkQCiU jn1kBlsVS0k+W6fbpMiXBMPFxwXYYtEwdUZ1wNTt1dPzGWrWiZIP/7Tuk4bzCXOqSkJlLN7b CKIvWlphGdH706J/UMgtywnJ3qZQgi3Hvh32kvsx9khXV8+bsNfGqzMBlfdIXv5e3JGpWS+0 qkuSvaGTg9JzLeKW3le2KhlDl1c/xccpVkSnLzTwIM7XEU3iVe4t6s5PxeEnPt62iPb9Qgd7 RQDMn6b99XHo13RDKRhY6WAIu+ocG2znSN6Xyk7uFApo0YkIu3wdGXcH05gbLL2ZzDeCbt/N yLNMWIgPB4Nwgta7JR9cWZPOofRy2l82UMtqfdeg9elMCtFf4pNgae/0M7StpdIG6QHrLghm ciyLmJoLvHDeyWduHDJ9d49MceC59MPjRzSivlGXL7iTpaFJlss66Y8KgQzdLFgTCmzOQK4Z t2BpvR5M+7eythqdCKtntCF1+7+5is2l+ffviFh8d7NRUbT/zDIraj18eUZv/wDzPn1XKzJ+ fRK2Sn8sK4zJt3ZyFv9zOy5iPswznkzizaoryXI4IdwAgarinGpF92QQh3toCh5Yr88TbyCl 3Zx9bi5VmMhLhcBuev7B41CTJdAUc9kSjVz1Nhg0L+qarqExvTnTTwTjdEWSRGp+aqRFv48h cRqjBGCltPYPE9eqWOevfFLASNnbGrl3flBf6jv5nKBsuSk+Z/A8L56s31EX9SSbo0Pi2U3B NfKn8yuKKvnM3uyef2vhn1OSBTVdMuAZp9oOswa5BzghBJOgb9gUoFs3+6AmVH0aQHWXIUpu 7hWKb8dRxcbhjaH8y3q8bYqVomhTUiiI0n+ERbdJbvSVlXaVGRGOC7vgoqE3SfF3MGgp7wSI n5tfugkcdoqcSzeD2L0SxyBQtFwXj1bEJmPLao/Erl3fs8IY6niWXjykzi7aiUETEI0Qm1kI jPy7RSosfaUya7Jhrr3ncwLHwtUIwi0S0oZBsmalcGzSL0rVmeF7hp3T9CeyqUsqJR8g+24u E48I1EPFRBJvZyRouBi47LVhtPNFchYZOFREjHa3q9NqxO4yLeR90Re+nG5yHIoWc1xsoPjH vN9ozBD5YBdSiNqOjxsrzi/yjvVc4DTen5QcEUxI+nQHG5+N7uMgSNBMyOXE64kwYJBX/Oc/ y4CBODWrJu/XcJ5ON4cjoS3uWQzZ0NxsTd5P5q0EgrHTIjKz/oMgar5C2zS8Jexr0cuCWj04 4fOnWV8PlUq5iVox0cSfjwQLHQx61ek3XVP0sO8WjxAwWmwd72kEHeDYt15ybcBM0XL6p4ed mDWowXwKij3uO/u+WDYpZaPgB2nyaDy/jgbXLGA+a29oH0M2JQWDU+M8rirzIiduaYbFRvz+ AIDGjF77svy2mU7c4aROtds5FVgmSj69WImLFo9WhrEn06fPD1ZcrrnBeka1378braLicfp0 3RXks7ocO/s+v3/EXupapd7TRpFp5V86pObzE9oYmiLxZuKvNesoDvTE/6IP7d0Y0VgCUynu f5MPvPpG2pCwpUYLZpV+lsDzU931QmqxbOkRbUgU0jqtqZgIXK9sx4oXU91PFRHbJIXc92Cm xjMbyHElEBfnFeYAVmr07c0EbTlxQY6Mmu7nG48PaCdOsmgoHJ5z1m0PngCqC7H3m542N0EY MZuINhMGgYel38WdUnRd95cOVBiKl5qbQg8lpaDvRUYZ0QaXCZSnNOkiGz5cjGIWnXZilLnf RTkpTvrLn/eTgIaj6hmw8qLGnWehLaLhjNrfUYPNFKK2eEhCwUBOJZI2pKsEdhQkozfM5B28 rpRi0Xm0oX68DVTyNLqTHxiCND5oW6QAuZzxZtxWVDqXk7WMIUQM9EpUNt0rHqKnPh3DiHGW ZsJ0MqcxVjTHinxadE/NrC6pu0KEM8UfutzoP0Dws0eth9bz5MmTSbympDWRmw2DvOGwRmkT JxgMIvrpvRtOtFBSw1msdpggyefb8Y7bIDzOXUJ6B8ZhNaL4e0XBXbzDoRKmhuCtE+7R3L/I ffau7sTTXSPG1iFxffL8/D/AxYe2WEbI/l9RijPmqCfPjUjA+qiJoX3a9mWKxR5e871UxwKr 2OVPq5AFMxxoARfHFyt719/VbRV/fY03ZhEdyn0WO7FUPX3DL7TR88GC1y69Qw44tNJk+yQ7 tnLFIF9/30wfMbc+U768OLtH98Ahz9NG1YExsw+obLdyzxp/UYNU1TTsbW3C1EdIvvvIGXD5 PdxbOY/AFkqcH8yLk6mdSZybiR39NZfpkxR6aTffhZOqPKvlFU/++Cpm7tPqGHdS0hCVHvN2 41GGA9Jw+iJdp22r1oIHaZ3GMXMoE3sMw/NrV04cDca+EUdvPBL4JtuDEyf/mPBW0knRFHb9 mPRmdU73GKQ2+3fpKzKS6M3k11ZaNwx7t71+DLvuaacAQ/SHly+Atv0hw3HymQ71OHxj+M2Y FxtmejscGDCVI7nYp6N+z1BqvnY7PP73qgeSxNXlnKFzDceenikqgo1fys02zNasNumZQppO BS3xXiIonYZa0XDPLY570x/SHTDLbGaHHof2SfuCeySrg5owXxHfS65XtmLRDwDnCBuowsOq iijxMfsZKz7XLBvkcSs8Dm44zegx3sTBg2ZwCug1j3FHR5kguqo/taRrOK4MduUlbjhpq/a+ 0oZFi5lGJUOrTv5ZzRPlGlZYfNYZY37WhvOGYz0gJy6rmyP/NMuZYni3sCJAQW4+BtLodlxj lR+H1lbljGFCmCODM/TL0HlFqLY8TyMBvREOwpvdBtldFHcbSMxHevZ86btHiqrXS/ukiIY6 d/m+5Eb7HmmDoLVgjEJUkhpB4Ze/AjQVzWJt4oSA/JYiOrMepv6pLrzZvj1bQEHELB4pZvcE 71wVLz+mc3Kepim8yS6y5mLQO8NWPx+RUetktbis34YwimaXnFUl5RcPHS5YmdFEcoqF26/u G9ZAz6tJPGaTrHYYnHaA9C9vriJLVmUta4JW5S74ZseNTwaKB6QV+7Mvc3Qu3Es1aLjy5Wuw jyNpuKIck6KIuoxtr+tg6kNkT8vB2SsUpNPKLRqa3fFih2IcwR+u2K1rFsS7LIPPqhgnzjSB +s5WcefQtz13aAEXGROol94YkAS0MzajFWdZH5STbxlZOTNa3Vv562vuojejMxTXHE6uXV/z FPW39wVkzXnGJvQ9xTXHkxfW19we+pt/AaSbQtLpwXKPylB4/B/bc7dv/78ecddWSd+GHjFP 4+RlDrcudnohL25BzfLGcv+H+lQiY6wuQbbaqtmd3xK/sjB2N6PgTNLKwoo8o8B6Tc6oU2+1 PZi38MQEym/JkmiYQKjufMuGJNlC1/r/+6ha3Vx+hVTtW2H8hljft5IsGw7udN3jQLAQ4BRN ov5jAmvzKccUv/r81xcvnti22mfp4yqDuxqkJbAoOBA0fQpbLZ3jGJbIVAX1y09biBIhVsye ylDjQQkrBsaQkhRpAntWISmNGR9EhwXfWznj9YkpSYo144NG8lGYSmOeNIUE6VhxT+8NR0Yo iE40LZJZOzPUrT+3ZEsSOZKKv3N58EQ9LDoxJXHT9669Nns9n2N/G6yUDyrO7hA+FJ7tf7i4 uR7eiQaehS523nDEt1dAclUy7zaipsm8KYyM17Z1dK1v3jBfzbo5aW1VND2ELrBOWv78zwqX yfCG4ldnOibuysRj9TfnlwbYqO6M9Pwzscsf/rktl33k1ftys4bvmT271VX6KOKVx2/5tufu gz5O/rnVWcFO9+PMn2XfXE7tLPv24JsMJ7N0X/1DhJjG09hrbechE3+D/0/hcKzKYQAtsfLV 1nYkqEmLJBOvpLU93ApO23SMygJQVEBzsj6zhJ99UZSxIi2zLIoWL3RNu+vnW8ct2QSDjdGh 7Di8e3tAnrWwetHkvJUrg7XGXjJQzMjiLTdEHXRNYn4gWDbP44ZZFM4dMgfHo3KLogUer2Fj EwitJUqzdmIEmvfG2kC7tifEJq/RKbIpWvTns8dGw3AmYQcuN5p7PXAOb6YXAuCTIxsPvfd/ 4fNLyPc1UpN7HBx069q5tHBbjsX10yTe23kUwxPZIhAOMoCiFHr20JItAqSh783Q0MMWsiRx QPIRCTcV2dzn581jFkx8OtIkNneR8ak4gz4b/yMdoVdfLH2zQb627LDBdOAMOEFg0HSYuSOi MofT6/EqWKf+6eJiGTGTdw0rhieUZIWwFxSVOPO6w/fu7o/cvVhG7aLJbiFVXUpIGKxUsdr4 9FLS/h9t0VhYoGowdzCEVcO0kM1YxHwe7sjmNO4rKhsLinDszgHz+iWrt/pU+RJeEzi7DE/c jbjjYwTt6JX8XykVj7HjxeN2CQWte10G5jc+IFWt8bUt/vrVBAd0La+Cv0789TfOWt6YeZ9T 2S8Zf/nbv2Sf1eZnfSJDzIhioNniRQ54uGdhFexDOsSMkcMH8eP+DwNBmZjXECGd+72y16U9 Yx/x2t/J4LTvfBgn/cSpsqn/eKLD+cr1Udfi2OmwCNu2+xO9En3PZnBiMK9uszTIM3nkB85e qfm3U1TiJ1km4MuR75PxBkk8USCI6kbCCZ5AIBDajGVe02V4RR6SHYrb+HCXx/4/voPis3l9 USSesEYwyK07OtHTO1Fk1y2gRTOfwAmdkaC1RqPMZD13S/F9IcGgGr8lbr4hl9OYMO8RDBY5 HcIqCUUj9/HNXkzafukd1M6dO/Uk/+FC7a+N/Xqvj2bcf8DrHFi8k9a0Dr7UEPz5bq+meFGb 6BmM8OzjSru1iVUmePhP6eSVC+KkenhFd4GXWEriZZ5HfHcvFY9uYzE1M1jJ4MBj3quRarmJ k1DvyBHg4bP8jY9bPjZOtnWWlFKYwdgIEsADccD9iNnOGrJLKFjIyz0PmWHACTKPO4T2toyb +/ACCgRZLGbEY6By0aSg2D0VtN9/fsDeq/s/ktivZy9opaLQWjTJUZiOa7nKyaJzo2l05uJp aJ5YgRDIwjtOviyYZkrNoLqtEy1rhK7avWvThWn1dDAyU5L4VtLHYi4+SEPywFg82bE/NcSg sxh1V6iXUu7+G1R99D+A3rLnx++Og519fkETYRdAddU+KtPilgiDw0+cXm8YGhYWXjzV7Aaq eUikuoI45KcU4hlpQaxYNNRdcAbpUJDMWazfrLerv8yE35YC7pHaXexny/FEPS9Sw3/5zjaZ 6tfLxuBX2rpwtdRT0IpSxiGdfyM2HwF2A00EM2j3QCzYksexP18meL43ZapdJua3JKwsCean MkrmbT7ELi6/zWzfLeY3RuosXFt/j3moRNIxEfSrzj0Pdk1AQsSgh+hi/4v1gSxSbbtTNWWl Znr+h9cyul37QkLBAk6AV8vnhcmaqMe8nOVTYramMOxtdUQCASxTF9IvNcfnbLT6ivYmNpGB YHog6AJiuc+UKD9BycdB/D6nako1gxMnnRTJ+yXNiSsLVkiA2BAzvCWv9ZNpAIZRd0xd5SPz RF09LEjFq1n9SLxG2Sy1c8o7ndUXxktQdUbX8itwe13RftC+BcuN0aF/aeNwuV6bAJyxR2tC w7GqvuDdjLw/6MwptFf6hKQzBJ9Kky2yhxj8tdH1ADkPklspqILYkTicMRSNL4QF9gYfRxv2 bM6ZEs5nwz9C1SsmGUJqKTOY+h+xuZn8Qav+Q3o5/6djUNO8STqcd8Rq6Hou4Hl/dtLrNWzL kbuZQClEX6PVeyJmpLN00mC9bDgh1GWj+GfSwwaj8fwfyfj2N38/BjwTyLf4k8VEO6ndIGvX aPYgLq/zP/DwrnuT88UbPalhzErxrUjP2Eb1B7zmOgmSGN6kUelM07lsXp2OAQKKtl9NO7pt oRY16aQRjA0FB44fjJ0X/S5897e2MGysKci3FNSapmOv/hetCGerH96ctutLA3z77Im8tmze 8O93EFYR0mQC5YN6xlZc/BrIIXMpQ6P/h7Evj2oi2/p9H85yEVtb0UbBVpG2FaIIRBsZbAWN iIioiJFCBRsRQwwikQrgpb3twCAKYpAg0AgBRYgTRIEKbduAQjOYBIKEVFRkSEJIAynCzDvF /b43dOUNf7CWa53UqbP3b5+9f/ucvUvtI3ebzO3wQsmvufX8yAMk+dVFKXB5RKh86Rj9QjPV 3I/0u36P0BOpKswxIaN9ceuRrfs0Z74RxZvaWNcU8Zl9jpe0XxSD7OYly4v6kMR3wA9d5ivr GdMuPLye0R6WkY6q2KSBlTWKuwkb2NYZpvXldGPzfeDFp6ZouFy09icndz7eaUwor3XZYPD+ YE7BubYV0lB+lUBqgxfyRO7T1JZ8xl1hacWQvR1iPoJKKUPSm2NWXhq6G/JqP2zkQQLBdY4y lUPXyG5w6KJsqGxdR+vt6zBjjOaLHWyRVgR7f8/SE+GPzMzJ2+X14VnJRpjRoY69ci1pRZ0D XZQGqVukp1Q0weqA+R6Nuaj/OfhCpjZMVAheww6siMQGRkStUab8wPaKu7Oxhq4CpvavX2eM 6VIP08dKaVR+qOyznjDltwquLaVJBxPQzFYm6+OBe9qGzPLzD5eJCmlItORSBto4NWlKvkNW kDyUE0WPyDoK/bgI+KGlZHnXDuQ6HLQ/aztjYw6UoOx8xA8J6n2dGMTRA97h2DveEb3tr0Ik fce1C8z2Binub4/u6n1VvRkJIkGC0FaYU/z2zFPFPfGYuwdvRjLkLXKfo0RYY2UnD5A0gvoU 2PKmuePBI8iyFimyoQza7qBvJ8/9cneRI+lnKP19fA7zS09/hrb6LIW3QsQCpH7M2EiClrZp dyGVi7AfvlXkJY0GPdUNqdiNVV3ScHe3b8TuPnKofNFuZV4B8/sFzXWHSUYqtbSc6fkvR6JR /Pb1zKHcTJMdvO9gxh3oeNLtfG3xcWD36OXh4eDNXJ9QBLgOrk1+95C08r32h9WKVNwcJu5y oDfZ6JvwHBRbrUxM5E7wvbCbZjdPIm/hsTW9rh/0EZjvFtpZpNfGXtmcY7IFrhm4hfYcbbvE 6jzG2FH9AGT/PuTAqNHxzhB1XMLdBpH7td5t3vTS51DQWuSYaCwzHWIMqjmnDmjeX2EdFpef j+k99wh2bXFYBDYZlKtHMJdCg/X5K2qBFtH+FEYy2vMBEOlHuUzN6wdXNyNJWQ8UIKBs9ST9 CBLnU/uGODlorxuygAK7ikJao6hGSkdWMlPOpSCFbFLVpPQ4tr/zsUkHvPvmLn2y7duxKq72 /YOaUz9qdvWWebiSrmqt/QTpXO1Ag3Q6GTvs7METYKUYSC3pRzhQ/lrE9vZydv74MEQTTCzj B+buQLo9CwuYHW3NWw9pfiyGNz9mfs9EOmqSzOO7C/TY4ZLYO2Av/3FTmrKtpzOHfVVbDJV7 WQCvz7FGEkXaAaPlorOAYWx0Qxoo8GmRu5cmRL0LsVE67tUFtgsi1yQq/QSX+qPuYQ0ZDSdJ LVl641j+/vtO0V1/nlkAd5Ogioyr2tpctrFoQzLEUNBKsNLOEHod8rJU3nCkWZWdyxbSthWw 06GMAp8+gUcKvF4pQ6I3+CAbns4ge6jum5o6sCLCw7X7tufrYRZF83LTFnlYhKGtry50k45f 9+NvfmDiqmlRlzM6aWuRl4P2EaggeupTgJMH7yzsvW0/KQgkjBE5kKUF8khht0CJJMn4PBDf 7+agV8aYmjuHSaUfuY+Z33ZhBz+4N/rq9Yau+248CnPCKlZoa3OY3X0Tc7Yp8t5ohQ3S0TRU 9/LbgL0+gV8/AEo8twu5uRenad2ekQd4cXDSGqVsQyF07nXiY+a2X5A7QznqSL28NnORneZz njs74EewlzPfly/eCYOs7uZ6pDrXhI0eCYBFZ+D1w1+K7jlf/mOFD+PzMfT+yBDtH2GOJI0b 8n/KLOtNJUmP/Z6f7Yw77c7eaAbZ2r44f/78699++218ZPDzO78Q+599uy83NuzFYecH3smi 7xS7m5zO9UIOYcInaKLqocoPSa5FO931uOyHc3NzwyzCoL7IYJFandPjGJdrIgk45A2XGNqA 8BqOH/QMubWepJD8ojjGYncOHbCtAYvZmDIFbsxyjD5+BFmt6ixmTrSV3NHHUbwXX38U5tg1 GNq+EdcIa3i4X9RP0eD/ywvIs71CkQlexcSp+c67+jc/lFQ/kTAovF8VzbOx9Bw0JUdZ9QSV OQQf17TUc7yGhH/qCa4n5husf7jL91XqbG1fe2I2e4GQlaGT2XsoUh3oIR70+Va8obwcyDQe db7P1p4FGeMOJFxHe5OL1nVvfsTGMUUuk8qgBaz1+iDlfnfeIfPOYB9at4P3PVxvSr8gLKzW ckEOm+roxYv24s1IgSajOmanmo/sQuj+pjmA2CtGgfOofWyC+6nvWQ/1TrvqFmfvi9TvNhqb bf9zB0mWeDseiuygZeT5WCBtaahtKRoHqw3hqfDPd6D35x4omot3BCfAYOIcpWN08jP0wTVj c6dLt2qhmFPzYD2GuOi7K9PTJwkzpZae8Tlses2lsb6Ja0mnhe5MdCmFlKjweA4iVoi3RPXH eiRs4QVhgW5SJiUHH9J0xm9/rLNlIoeGDrbpc3x+q2prOy4dbKzboamq+w6O3MPbC/sLSi0V H2KkmVzJrxReWxRVHk3liOMLgH7vYZnOrKXxVrVQQq8+TXy78LRFd0Vr2Ni463z4VU/VLcDC QurSMrdgbULtD3aKRPM3CWuwMHEd+fSXR+yrGDA2BrLVj5Sp39qW7gmeNmbXJtZg6fdwlS/s X2lniShCkYtcyCEdqlmHjN6AQVAeGZUaa7ybWWPrnkHvsdW9efdf6tkdwfNyXy564/2qG4lZ vINkgnz+Dgl3dAsQct4Fw+uBxA6ix5LXFJ5TgWQZJoiaHF+fCOizTyAiBjN23kZe/KVnjaKF 1yuSbeo4q3vy/PgPe/K+Ra7m6tb4Xb5l/TbtXVpmAfkNV/KOwgs+oNl9/NHABPXVVOkRIHZe sckgHHmKVFR2XHfwk75wuxYY1bilxd07x3JeVvBMkNFb0PFITgr6Zw2gDstdkYb9sMcV2MiL 5IaFNcefRNJa3Afhbb2HGaQiJ7084eBRiuftwVM/kty0AwnQm1uQt5DzCV/hlQLJJwrvZBDW 2BrjUKxc4stTwq5t8Yd9NKyqH7X+RD3K53/JWTRFee7d/zXOcnrL7j/uKQnoBo7+6kDKc8/e xoQdxVsZ6v/fs7b/h0esD5ld//jN1NkaSwTwh8oX7uXfKjuNXvoLn0CByNZjJMenLZ/Xt9yf +vtRMLBu3+y3G1zProehmcjnVUi4nEbbw9sDbzEXLca49xY4OCtSX5WaYbW4axVU5+z1JV1D nvUuiS++OxyX2lOpJ4H+ugC7c6zevSOy/+sdpNDyojgIsC7TlEwKojiEhO6B671I6kraY/iV KvUkbw/r/S09sVK0+LtTUENksAspc54rr4jiKebAYtXNXB9XJOwQ7wj2eX571LzQY9SvEkXe Vj846xHLPfv6xtMN7o6kJNzoOhMgX23bs35784c+laub78FWGBJKgTseQIgyutGPRH/jcZrk 2Fk2OINoFYdmxVUcHCd3VuR0d17QPsqRTOYGHeTlJfuM5fRR4JICn0Rlp9RmYGl7+A8BXw0J bUKOM2P2E5u4TsfeOTqQUug+6vnmOtr4qKeEsbdRzS85JhF6lq1XNOMr6QxGPp9D2haFvGU1 Dwyu0cf3jFLzaiNLHPnOKldePaUxF3K3I132YlogylMdU8LFhgXwQUvrTMaGBhKxGY+74cAs dnWmj+n7MZ7alfe988Phrd4afjRPlQxhH7oeSdKwMLSQZOu8hpB6pD11sTtweOLo2nvj8he+ pROeky0K/8VYzGKsbLMir0T4JCq9C3vU2bmbuBGG5ttiaUM1FUqHOLgyOLLT/GKIsC6LIfph b+UZjQ0mI3rIH0/8eOWhUrpxIm0KWUs/qDG5yCtMgZ6eXbfx+0rCremqTVSD53f60ytpMf05 KGDCzlP7tihkLy92o8D7Z21nTQ40q8h0OeD6/YPdJP/KmHjR0vgZi7dEDQZtllamF/2iHCOa z5/VtGWVD12XHxePuYpVebk6juvHJOJKy9xdwA8a4+V3tWUhVqwSgvCCrxZiMUuwtYhgxDmW TGwOsv8PL/pAgaXionTvEExALHrtKqXHUvC002jlP/nEp53A06fEKdoy+kpWFfHdixZi1bsd KTzepPHHeoKMZV4u4pCbcDJELj7Fu0c4IwgyyIECwNyj50ZY5cT+0q8XYkovT6Gqwa73MKHN ZXS/i7gwJzNXwoyXm64jtPUV/rPAZxdYF9XnicSDINTO//AiuYJRY7aAT+iF7IH+A38r2qxK Jb71kIt4S54k310uJb6T51KJq4IlKfYh7M0eauwkrgi5dRT97y01q5rqDSZWAAhCoVeQAyFF SZr100LMnnbcefoiZMNdK79nly69b2r6/X85bjN5Hv78XL5TMmROYtHvE+aXGUx8A+bvg/iQ I2F+3qzRLUoKHI30IJEEb8A31OIIlUU3wxMEhJxMeiqBYWEjybohYgsPqYmO63HSTrWS2OQL ZVfi4OkMzYg5mcnM0fVgQciTU8gc4l6fwjzBgjYyiSNmX/Ww8eW8/Rn7e5kT3vwssUyBkzNL iG6zaaeB6L5YKqDVcf/vNTY3hzx3b0+GjK2O0gmljS4nRlNg2WJsraOKgK9Lds1MOPogUMbT WSo1kWNoR3Mzc4MSCdY2V5vtQvIEqnB8eQKxIAoMZQJNPKbr0cSSnmYKMMXdJo/5rkR5C6cV QdgWq5reGCBbHwIN/vUz1kLUIMwAIjwvJjp9+Hi2ZB2wLzP/J6gZMaLwPIAILbbEAfO5WiGQ XDLHsIVKqBdY2JMHRGiECftsYc/iWOge7jYCX8McYlxHbIAIvnXEgei1TYZAcsgc4Jeqx+zW 4eClEQcaZ5ZNg/ccgEd04+FjOHhGesD71YWMgxcNwDtNxCh0Gjw9rM5pSU8LDp4nAE8PRkXT 4LkTB2oMZNPg9QPwiBiVTYMXShwYPZ4txcFzAuA5ETHiT4NHaGXFN+JFES75a6JKFs6N7bsB VjmLuEqXVYZ/blQWUct/aq5dUnfX2nd7xZkzZz59/PhzbGzsyGB3VYppuzONtdbRkFAVAhaz vsnCi2SH3JnfXZ/lvOnJifPnPzU15Xyqmr40D2tOL1G10NtfnJYO3S/H65OHe/pT8nfXNPhX RGGjiVRmnwxE6HfPu6fvgYdA6DZ3vjw5gKn4Gnnl1HD/lszxIavZej6r4GfRNFlArnR6KCne hnA3I7MMZ5tY39GWnU2NfEr8NW3JGbqYulBKV3lo5EO7kH4KqVobtx7BWxysudrSdGGI6tFf 9cT99cOxE21edNVdD1MJj1oON9d2dt6DFXsQ3+twc4P0RX9payTVEw5pKZI/CY7Plbx3/zOe yKLO8H/bl4NeXYEdsXVDuCybts0Fku1ctrHI1Ax6FuibLqyj0J/nSvrsPo0RavLmhr/8TfsA 7fL4Cmt5DC3xor9L/vRJOSAd6hPQVoioC68plugCdgmpyyn0wDfV3ytWhjm6XSPZEoo2wJ6J NihyRYAc/+OqaLexeXslU9egpq5RJu4SU+/loJ8/ua5X2mkEtDfZ0Adttaai3ge9+biRQpdk Rs9ZsHJbxGfxvfAOdWpIaAVN/vmv+3o05p1dVcAsSoAtb67cFn5CnrkCs+cW8EEGc3UN9kjG X19dX6GwS8QP6ONPdauFLwYjPMrMAwZbaA5Kiqb3lSE7TFjOmvrUMX24iI3WS/GasvHx6dsd vGCho6bx0oBp35+NvxcSmiTBlkt2KfTS1OYZdjdkbjvshvg5lNJkFYyJt23X4frdymamvGGr 0i5BYXWmPZJjLJK+xGETWvbG6/Gt+z+yvTT1Kh9SljNrYPjTRDkzVPbS/lvlYbZ8f+lYqdUV uN+jqyqlFLX+rlq7tCYNaos0vaagPVogcojCuwCa76A0b9iR74J8S9yqNwy8E+GSNVjplzVY tUZQZKSsD9/PK8Xsk6FtXB91hRVYHMKcer0HtvRMunk/KZEvoXNzdT3vvE3pljG1MXoOTvNn xphjmV0UREqOpyBdLJs4GX9zAf9FxZi9f8rtq6q2TQU+9si8AJjRTVvB9emrKEpGq+p8VBTN L8+18NlYeAtx5yyeNfk1ZlY1JJWSOdaVMr7lTbF00W5llYxfeGSjf7pG4DcdjVcZK0vKFVYr 4kxthGlQR4P0c63UFj/kmRO8F6SVGueY8S9wwg3zUkKRG4gdRrFyV8SkMcspUpu9WZmqC+xt F5S0RUs3FUhauOwkUch2D1JfhZ9fe2R5dNDTwaFdTvtIngrZK93H9x17YJIokZ8M0Td6aH4m Xqv5GKTsRnQauSBywiYHBRbfl5oCjwxI227DwQfo6n/tQMIG1f8wFsd7VQ67GVHpptXa9Ag0 sxzsK9nLJRTNp478xjAhy1IxoXwwNKYnsK3eRBGPafsDHJWOUed5ZeOl2w/yWqOpUMrtOdhS Izu64L6vKOSH/fSTvRVW1ojVfpE0vUaLb6QcAMJeuFF0By3XmZ+rUKfmKaKJNGR870cTL41f ppg1pGWIwKJ16kmkPEBHsysw4QduNNvvxaPNUR724J1UqZ+1wuU/qd9e9Yjcx3s5OPTnhwvN J+HpM2YfngXiH/02JotoM/yZ6xJhc7SSNTbaXNfdmCnWvNtTTk/Kl/FH0hOWianl60LfHW25 5O7mYC2wKkUbOP4h8FMsoqqWEQBbitKgkkF7c67kjlYQ/Z87k6MqaqwrJ6K86q9K+S5kYA8S plMf7RXQvhFTn8OdccvEpmZm33xzboWY875LWt2hrS3ij1xNuI2ZkumypyGNgivXksySDG3O MtGWBaI6U3pHrZSenHlaTxTuMPDw0uDnKoKoSW3/Toanm6hPGnaAlFXAjwz4h9IOTX7/ZKTU 0YP++ufXOQorqgBEp4uRKppAO/T2qS3Xp3xVx/uU/KeD9iu5uv6OIAqvxqSQ//dKxoWrDszd dx3OWqOs6pOSwd8cnQYVMNTA41Rlo6+jclAQK1p41OdnT9MG1T/PArmACYcufa+NKcEi5LE7 dydlndvuoekXdZOAobVdCjmph6UIXC6Ix0ZLlonddyvzZHwsxAY4s+WWypWtPrJkL5qgSBYl 7eKSbW23Z9wUUUtgWglmL7vF+Hwog8vsry0x5fe1s26R3l53oFtWDpTqnB00f6/zw7tnZh0U uzP3jo/3T4zp6IfBv+XcEBuz9jpLpd92Z3tY+cfTgbsJL0fs6YJ6svzIHCXutyFW+aZ09LOF u2koIsPdUwU21P6Luw9PXhGti3ECdriPN7IJcZrYitCIPi9mYUEOmnQdD6CNWR27EMYVmG2d UShPfmplL7eXR3EWiDeko5VbWqMc+uMSTj+cLv4YbFEzMiBRi9R2ujY9GDYKgIsr1NeWqBz1 nP8IxuyzCnRahpm4PAYbqBqMHFT/OoMVwqGbgk3OJQ/OwNaF4B2H4So1Xl648i0frW6R1qWE IkWJik7ylwuELxNNc/DD4kIjZV4hXV7VJTXx4NAbM2rnKNUfXkWHnBPQBGsDIvBCbH7YxQ/a CPUHn5X5TEVtSVuLlM1TsdFq9JN58GIG7Ow4zogkdETgaZCu8uvXAzfA5qahUZxiQSLVJjOV H/hHPX/EBXmAV2o9LzwHF/oUX5+BXRVZLFe/Gi61z+dPU62cKFe3Zm1Eb9tin8AVDgw4vPf3 vA3NDLiziG/uHD3NpKrd6dGP9bwWPpb9StFZSLc0KyDbw2Vla9c0KopoZ+Arhm1lulKgfA8W na9uXeITeMiDF+HqtiLf5AJsns6BYHKXFoZfwxeIk0buJxkpO+v5GIfuj0RBDQq/ymN+yYzz UygIxHkI/4JQuz/TjFYxFCHcYGPr6J5OtEvjmQdnc07iV+a0GoTfpR09UR8ZT3zTlkVvU2j3 27RxDjYZ+eQHnq3+erISu9iwfTyGRp2RmU9+cuL3lcul1DLd0DUWnUWjwc7ESVMME0JgvBoS Q/hjU78jeO9fReCHgdTCuG2IGi9+Ow8IrHdQNc5f1dVFDjqz7fBAL+AmdFRAsn43fMQvilOz wPJyfgxbD1f2nGtLQybu8pCJvyZlnP8qjJpw4IceLw/rH2+9512TZOb0hN7YoB5BpXaF/y73 /Cvn118YahpVgwBwNpz1oOvQGddumjlHdp2zRQolF0Ss8XChu01MHOz41BqZR9x2/oYJpqKx gRERXi0koEhQN1E5s7sFK2STMp1ZXV/6H1xb0Ctz5ABuHDnYVW9+JhQO2W1/ru0ZrWa6WHOb /eRnqQkPqow2uYJrZ+SYqbjOSyPRSLL0fO2sJyyWm8uu1jrtFrJ0Q1ghHthjLk31qTnvtdYZ po7RA8O3d449UNCkz4LfvG0DUtrWK1wTx8iZy9tZY57j2COF0QIjvH41/EPc4ULJzcfyl5FU BqX6/eJ8t4BBdSqFLI9JrOfLB2/AORCbRyERw9pHvgGg51nOOdejx46FItGmVHpWdxGfCbyI O97Gc39rxPAJsGEDpP9u4YFKTn0QtrIcbG3TdOhSD/o6Cu8hYDPHbDPS0drm5li4fDAWfjoy dLwtijWI1ykEDIIIrFs/GzsoLvRP6ZfT5aXOxHQZZIYGWK6JB++utjpJkQroRZKIitjYIVEZ EIeDjsfOqqriN1ssDx4Ezqiknh9gYl2VDdkin+8m+NBP6dQ1nouZ8jhYVvYdEqrnqmGerSVS MTjkXaa1v8/1SVDIBMsDYJPqUyr1U/A3BOhAjJ9oyXLDNoZrtXNzBvQmFnZnd9fzTePq+WML uqaLSmt3IEGkb4oFK5m5mQW68iQ0S08Kkv/bcK7kyeBQ1fPRYLi5iF/VIo3C2wz9MkvRUk0b iEUmc5QerVHlzKlfo9zdNhf4+EU7xOiK1HzZq6XIWeLS785MT4YGG6RteXyFLbKda0IOtG2H qcAJr8wnVzp2K5pJ7/bMUebV80GCtp4ukJUEXd5W4OPspXmfEtTo3yXjm58aozHAkiXCaxo9 3L3M6yObwgPJWTmuG6Zy+P3A1QRbruQFVvppK7Lcj8UZQru4EhDd5FHl1qECWbqnOH4Hsjhf 1IyHW0CcpydPjG8KIbqVtLjfcikkc65u9HTJ4FBLYiE7oJv2JhimdrRIL5ZQ6TU0ZJr1HaA/ qRiJGKk9HNKSR7UpVbeWWGYVMAe0Pa+iPNzaojkaAchIbsDeI39FWxGdBXn+vmSt0+Xx4ckJ Kfm2NrPmJGzcJ3uVykQzHVijgd+IpPwgyU0a/j0YlbrphJkopKZFqnRBIoEPJiNV7nFUGyVe JT70x8MtQYUyPu6qxrWRgBbtQsJH1BK6vFIaI03cINQj4fCV375QNDv3wryDQpb2IyqTknn5 m5HWSNbno70VsnJW91BbGjpwutNoeXOLNPLphaGse44d9vIFRsYk37LH9gUm5XTgLDfF6NRX dnuuViLwRJd6zDgHNXcK1/Olu6Z6gxQLxNM8hKJ59+CarjAX5CaOmxj7SKFvj7Zu5YIsQLK1 gL/OSGmnFtC2HiS5IuwciMxz4xGOVV2yZ8XKLZCoTtoFYaHfrds1WpA1l5waEVZvRsJUNE46 hEaVr0rHy/JmYwPN/JIQGyEgWGuwUDky9RdDMN6SCxlmlRNbzfAPevmvQ/7z1o4iGCgFNKet QXq7JORI0XHBxv2iDSAH/Mc/cnPZgCW/UKSyA//kyMNz0GdLmu2Wg3Sp+Tbc6bgcK9C1DEmL /W5DW4k3TuYzY1K1qN1apG1iWeI1RdWs5SpJkS8S5roWqXqjEEoBobBfkc8mvRsmD5wIhTuz AREDWQzWBhIONJqTJHbXBV6HLw9nTGwmmlPj3Be3tEoflJvL/HLgYhpajalauPf54CVgB4Kd wS3il3DJMQdIfilPI9aqBbLSAJ9I3FbwGv1XER0t91klav46DP7pNryGGDkTDYrWIeGd6qM7 hXWAqkeg+2245A4wJ/6FgNlL/3FEEnionL5GSZO/Kr8OM3IhhufVAsnwp1FCz9Q/XUjzX6Rp i7tzyfDodGw6BJLqZb4m1xR2mgpaRxpUpPBojy4Pw9IvrjG17yzgMy9H4pPFG4pZxBOBZaSm Y8LyD7e0C8w3pqDcO9rPmxBKBFraeTXhchyXvV9cqBGs/MYMOrjiIf8n2ei7B6iHlF5zuTZG T4ax00DkCXdOLFNsQsK7aRd3uE0IpfbnEJqZOKQdQJDy9KToblsnvyZESndFzI79is4ngrw1 9t6/AWaiSx3oUjtc57xPe5CXlg/Kxu0bxKb8iSNiU922MQt9GO5zwOPmeguEcU1xmIl25Uru bkZueNH/68wNJP0txdRKhuguLQdqfLyH/i9ibDQ2oO2D8S+N/OkmBOs2Zcu7djh6aYyzCp31 UCjfWMU6ZOXifO1qhRH4va5B+tKiI+uyyNsv5Vsl1ntWW62nLGNh2g6htIIxsaejWnqDwvNw oFOvw2tU5FD0Ge3aFuzY8NvoeUTxmIbh7sKxDtzxygzfF/69v3XuwjOHs60o9A/JVW/ir/50 cW9jLlSYVcAjHrj1MGJLLZBPHzxhYK9Rm2GWvjrEcB/hYuzYyL5oIz1EzTCcCkZheJs+knt5 aY8g11I5MeKNLSGOOm5sSqR4ilWfZimKiLF0nJLtkAIibX5jc5aezO+xC3+doxcviJ1LdiNm 0KzYPg84B9U4+14m3AquanpgIMvQ7kLM/O6gS4l2p5lZ5qC4AVeOnZtYrkfg+eEsXOAwX9hb z93+0p5JXOBREWapR+DvmgxxgV//orDSI/DebHIyELiwUaLRI3CGC28tELj7Lpe8S88XUF00 YJQ+4NmqIeZ62jQXkgV4tmZpPp9Y7bzpngsdjNKfNbZqiKvS3nHh4c/m380n63nWK1sH1kzu 9x5y0CPv2qZ4XN5fZykJnzqYOTfBpKce6CpxKmNCT3ITNBO2Ayg4Pt+FfEWkRT/FogBfaNBS 7aPntaub6vDX3nZV0oivtZ2vjQAAfuMc4kzcNz3zYiFPMLHnRm868ZAs27ppDExceLkthmhz TTMMJm7hVnW0gPBpHWA3Fk3m+KNOdD21GOGISyWOrYr9iEykxgfmaj3Bgh8T7jf/W2zmwp58 oELsj2RsHUENE9ZN/rgadFjfBMGeYJdsOQBOMiO+hUrEnO8yhWNe6VPB/Hsn+sIeODZmH1CR hESlE5XQaDBxDyghBhpEiZfBdbNGcUz9BOeRKIKCpuZr6UDMUWYzq5sgaPHSnm4g6EVMiH0m 3AJNfN8kxwWVXNREEwQtO5otB25EUhUvcSfgrc3/J66+7lod8WLQb8MqxcTixkrFPZPG8ZEZ M2YYzp5jssDI6huoIlDxbMkGnyJfh2cxHV1W0ojedvyA583upKztjj9ETH7uLARZbtkFzeSb Gs9Mx8sjSkzK1zhHjQ+PDLJ5/pXRU5MTNUlZ/YFosd8KPfTGxXL+Hng9UNT9l/bIOiLqlFlr kdVgOMXauPLvTbYAgkiDZCgVYNBAvQ99RXRva8GwI/70xoWVeq5Xg8FwAMDhB1o0rKfuaPHM yQytWXv5BVXXdFZsPp2mvn8zR6eRIRdqSq045GJz/GMA+AWZle/27dun67B2HF/mcDmmzMHe f7U0o66swye08v6TPeOz9cg+bw+8eOeDAgllgziESC6XWa5SeOyDS+U3qWtj9AhPMUhGA3Fj yLVTlujZ/GD2FEtg2sH3hmcRX949dw9cuRcYd/fjgzwiIcje4SIcuyhUFRWwnYOniItLM4q9 ig6ZxKTLXzdeisHzkTFAgyujJvFWP/z0MwYbGHlumWTu9JLZ3YLfl/jj54fT3M24Tw6ShZs0 qj39fxZLUJ9dunTpf79h5CVO+FmrbjqrYqX0oIDbo5l6zmbmj/+SjfdVX/YVjnn49yoLyCdP 5iW16Wl0ORI7z+inu28yc3WcdJ9JL74bwi0RtxxWcoiBYN+6JnHATzwVBb68H5ZFcqH/TtmX hzV1de/en63VOlatIjJVUSkiUhCICIE6AAUERISIgdAyCTKkgEwnDB+1DkxSxgiBoAwhMsUJ wnTAVgFlFJIwBU4UJJAEgpATgkLgnvh99/k9F3Lvfe4//BXO2Wfvd631rr3ftfbLDQeam2Ij 15OaYY2fTJv0b+QMvQHScVpWtK1FuJgJ/YpHn8+m3NwjB1Mz31E1iLd3OKaefHZRfNUaoC9J gGTgo6Bqhl5t7uj+S8vYgeYLzfKUosiLnn//qYTsef0WZdTJvq/cssFMWkEqxFX/et3mRxp1 WK+8so8mR8TJ28o8ZlPZ8GGLo7+eU7EfnpkBr3w/f2C1kVCIq7taxsrIvlRXNX/a/yrFXZ5c c5fv9eN19Zkbj7bcP9aZmU/Jd7Dv878QHrcSRT8PcosxWoCfd5ZNpWtJgZzPPbnrRy2bIddL sW/caA/51Wg+MqPdkV3uvSoOtCs/em+tSsRVTpbccsZSC+S9W4HqlJ3pmvgY4wN+60Rzk2kC Qh/7T2BGvxMfyIBqCzEdUVEPY+VUPnZe+eFWduFMlhv+LEsrxJYgk7BYv1JaNchXE7ceAfVn XDqnss7o7HN5csnswyQoR1cNbDDHaV6yUVxIrMDQgBbn9gVztBU+usp/ZkBFTXxdbbqnQLcE cxjcv3zccGQfWkeb7vGwqZxMl1cWtLGseL7ql+OaNcVPMZ2CCdvaljrA4dqBQpzSN+LrExrX CmpPH+y+sgTPvVyKwLs3A/+u4VNDPM/S/5fn+W8FaHm1SX++O+u9A23hb7vjgNFUlpGOdmNI WtOcPEnzgy3/SnO5NKxVj+sGMi6DIwE+ysi4LPtIIS7T01Si6VBeHOk27GETcQxoicQ5iPpO x7ihafLqeLZedpgIsz6uKXRyoyn320i89VP5Jb4nGRRik+UJs3QoMwMyW70RwiyPeapLIdr3 adFHnc11JI1PuSVOn/vkcC63+EzMJUjrHxwf8NsTlMsqT+VnsfGh1TkuzPJbalb4A1a0oiLc Z98OXZBSjOmcKpmpiTpNuxulMxYllOO0yD8namlu4j4mTorLyhRIR/2LgO0OeAtb+z6S8xv/ RRsV40coYVFK6G7RmQQ/9szSKS3dTeCIKPG+5Di5VJ5tbS5+nu7x6w7CI0FJBbEMZ1SGmWnW LsQJDU/eBcbrUwW6Bzzcys1mmMgsspF8+vGc4WjMpb3gAM3xbQcaGac92SRqWs5A7/2cmZW5 IXTQxk3nGniVRfrpEfGfLpiE+8zePmrZ5189bhDjdscCnCsIDM4PToPHLJL1pkrImFeNlqmq aDkGccHyh3Zr6/i66ZYXyCLrVmBS+Hvv8GOSRL38mwAjCDEsRxJpQee0Hl+qxysJpNdNoeNw C42HuOjI35ujhfLKPfZQ/2i/uUlzI+UpsR7XjjxTwUGnDDcch7XjV6sjhs6oihxf8dCwAJ/y WOFQrCYKsuizOQcEH7Q4BqSqlb5vvCzyyIJse1TkiK8vfx3imFCz+9aRLDBT3F6mMMk3MAfx 1VZgZhAFRdXgpWiFnlz03mQBLkaWM+CmFul+cTHxDnypV+sPHNzoKhKO1Kn0aMt78MZLznWh GsO4LQSn/iQX0OMy7TfZ1tGwkO1ngBj4N9vx/7jPNFIx+qDHBXx0H8FhL/g93OeLS4xCjdcF j7eGyR1tIbX4cYjAeddCSH/HS6DH46ug4Tj2fpmyoTeIwoAPg9+6BVk09wY70CDY48JsB3Gs lR3x6UcwE+6jsDcZTZn32Ojq7ONX+w9UySlooBz7zunIsLU1grKWWtw2gTkryVNWIULUcfe/ CWh226L5Jc1ObNIncJj06b20gR7cPyy6Zq9qFv37bPcMSY64Q4VdEwDVxnrN5DppYY5jZecJ H/9bqLjKgfIjzMMCU1RNHTw5v3IiNt+9e1fFg+M/TfBk3s/70ChZivvTeHK4IXGDw9aNZVvI 6FY03uO7xGu0pR58Z3V/+965zBqxY1iF5WoI0RxsFaTA7M/hoeMzAsyTmZpjgNEDhTM6IbgK phKqajK0S06sbvpZ8xgq6LxbwmMFN5oXWMZHx/XuFpcR9NoTgCiPq0ySEQpcNE6HTNpeChMB 1pJUwqEdBvWKJA+2AL2ip1y3hgM9WVqYE3LK74cV7pLTXSauwlmbCb1ioUU/4aKPeOxpMtEx A+iiYuyYScDJAYpCnHkfabJYUrB6w4lZjvv9GU/6CSE2O8WtbIWe0F9m6ceBiJCfZy2SueZd SbcAXl+xnBhStYF4wtzlzfOIynbAqELyjj7yL2N1vlQs4aScAamo0ADABQ5ozJdQBpwcaMDL Ll3Qvhdub+KPRC7BVsrFGAVwMzAk+5rGU7q6wQcLRHI8UPjX1jYJlJC5sQ9emeBpwWh9vpOO hViPnzVDZ6EVC8wwDrMctSGCFq8rrru8yVPBlp/laxx4QWe27cdrPO++pINgXm9DMPg12Bnl Mt+dbxwhp3/IT6h432OTPe61f/2m881CFQ6MRde8g+oIq2dO8llEzsqQL+DEJDHyyMX0i1Y0 Ug3H2VbHjpFkgxd1s+/3lWdAz9JhD3bgPvD+W1LyXOPWNFE3GX1StcdPji25fq33KM+IYPgP dGv/YFJFxMT1gL9BJ0vwlKPOUbE1cwl+pCjmmiAuQNu1T4Bk4zGCQDIFJbIYx6I8BwI1gV2w dY8x2tAwnM+UU0b464kNpXbmTkZuYeBrwEU89iu4n1V+VPwlceliR3hLZnaiEC9wMAM3cB7s g8sq6XExKyPKDMKnsSFGW3A2NMqmt/+F65xyO1VwRgfAMRszNCzHjN7Lqc/F/BDa/iajqGjX gt1kLe4R4H1ZpwjC71Qzi8kmcvpvAlGFuJH0NBTHotmPIKospj+2omELcUU8Fhav5AlMxCb/ AkTo8Vr+wmkCTm+T8iLGXn38+HFuvO2OnLg78+15GyNTk+ix83+Cvb3HEAfR4QAKUNbM8tk3 902pqDYKMl83+gTpVIwBeMpudjYkD7qzc0LWIq/jJSxkWc2OnZ+uTymMuK5/E/mmhw///vu/ 5K7NN5vu3D40nVURcey2uJtsbBb8JBGIEE6gFbWRKILi1BiVIi+K7hPcow40HlJPhya5foAu RbLoIGwEcxyBNNjj32tUOLl9m7Jxvzu5SA6kZ7de1pwYfBIfPw2kie1aVUcG47GWIKluaaF3 vDTY1mL8PNjKZYdYWRCQuI1NlhnpcnpPYqRzlWv1dRatHENzaQgf/bxdCRUoZNcHtnWPEhZU TkUu+q6+ePvx9dRgZOP4m/2tyRjXMPZn5iuZkOxzpo4R/QoR3e9NDCMtVWBJOOgvXQMKRgPU cuozRu87iRiq3pRYoobe3fObnNLKhg05jvcWJMQKjBP4hLFLfCLTCjzGN9gkLpR8eIBTpQ7E MjLgfRq8sHNMEgSP9bE5nKYo1n5GQ9j41SzYgxN4GLwE3/PuMY5efPvw3CZ5ecPW8/ZG0aca oCf7+5PKIkL0JRxuMZTljwqq3saXqmI43SDPCkjKgut/4HvLGkZ0BAMT/WwZnSyzY5SHQ3bc Vjaj1MLzFx0f+CkSb4wj372Il85Ny6ukUv9L80hi+99TQBgraXttUSmCI7pPq5C9n0kQ1zcd KRrOdnFL722FsFb4uXTcZBF0maHVxnPC4gvativWiWuSeW6nMEfA8XNhvUkPiLr4WQgk/B9Q m1C42232Vzexh8w6cmp/9HyqS5V8GBIRaZzGJfRObLkhp4aNxM+WC4BKKlDCk+4JBeJiqu4x yukQt4QedabV6zA49+R+n5YV8mE7fN525NIJEqGbHFgtfKnOT6iiN18GB/+F2JprZrDwrCKz oxwvwOpdzZWtUyv4bTo0dhS0swT9bHXuMfwDQG2Ul2tDujFeyYoWIKtf4jYiTlL4Uc60aXyn 7T1QNQWU8FVOf6/0uzq/ZYHN92BqDeTSvZgkPHYHc+kLDox5Yaf4Mb0w1Bib08aThq92Vyqx 7kM8R41Qa510nGIfu0HjJq6CNcOm4+Uuz3dHjgDWPiAVQOimJZhRt2S4SRw0Uu+oQiWS8KXu 6XOjMnuP7RMEMP39gALT2MVxSQQeB0avwMGgeOESmoJSvsbLKlZoCIq49rYjj86SG4KLm6cA YxuW/3nw1CXaNr5bfYiUO3NdNNOBCX4AqQU/wLmmz3HihmXBJewQL0yfb4sHoswtRoAlOLha vDD/4TzuL1296OjHh0FpGhw+k1iocIamQ9aWuzZ6lABtJ/xAlTKrwwr0vHlul9jjIt5jPqSD y0bhO+KBqLnAUXhlFqvAsQbyrQCVZGCufVXSHDeemNws8MeLEpP5/ewRgDB31kjW9eyz5zhi VMp9bNU9CCEwlMMDuIcee9tw+it1y4lFwBG+eOc2VbO0m4DCCS6X3cDisjFhjCWRiKNLxQhf Lzoj63Y6Cz6tIEZwUrdQE2XeChrTq9y7KulGFOIdnopp5IMc2Pot+7lfkRwNplu8Lalw1ZzF rqlMBDbtUDXdLfHalvoqAZjUOOEGxoq6QY4qOmphbEJAR6a2rfZwURDAaVx07hMgQe4KE0lu 9EolA5NmZhPV9GBzi7A8CGF14/3s0GutFpa3N6W23McdBtG6JcSGIBS+m0z/W+56wpmymKfH nxmNeDDdhCZr8Fu47OyvxBS39F2hAOc6kgRoZOBKC6GBXAghkXhcg0kOFm9PpkZAhulQ9nFA ybAi9Vq+nO9Tib+gqWToxSovgshgVDFuGz//VNQxQ07/Jj46ehmOwqXrhs3N0ElIFj5UPPCQ iiriZWnpkc1iMjFeH4KBL7NIvxaR09dRTDTHj9ZXyyM6G/srtZxou8Rjv4DKzI4uelFpD7kg 9gEOF61EwIvG2HEIStzr1M/1CZBId4GphTxaRZEFsfnDbI0huGwcDhEE4gDC4ruVWjX1qra7 RfAhnnlvEqu+Vc5sVf3MzKwAWMXQgsoTmXnd247Agv8ziI04QPR6PoR4pG4N8N55sJ8iQbJ2 DmkAcsZ45fkHgSm6oJsxSdbTN9egXK4jr3DJcKIlAuya2RGnb8TtXLbJxdlLylSMe7qDe/TS qBHaiqaErEQhzoaxxByGhaOPql7vNwvTCwK1PQFC+IR0v7e1Tgbu+IC7vMdvOW/rZwE2ahRt 46t0d9FZ8YjTRL9OwgsokkfToHSynIA/Agp/AVTuyryp4wLkbDsrk+OQTaJ/16l6XZuOfEY7 Fp/qXMrL0gUHI7FHQPc4twl5BOfdgLs6v1IzAwi2t9jGd9LgqygpqxqF1TcdHodu3hmCcc1S qfROKscPARYdceGpwMlcqEEmxYxcWHx/s7WaXio6Ba6EnLPIo2Ba4bJiTCJkLSe6EjakrRTy s6z+7YacSHjRz2CIVWs1iT5r+qMCpyl2SdiAMAEBQj+nHPDZFMmynx+Aqsryx1vaK6vdpWCC Xr/eqtd+H8plGRUpdITdkovgHzVdxIf4E2mAERUT2ITuM/t9+TwuPU2BAzURmmUONcyxDztN lWRRIlaFM0qYIllbdI3b33zuqKRHyT5BQXYZQiHvW2BmOQ7jvg5TvpvPM7UyAEH/5ANcUFPK l69Q80WmJuIIaH4P4AQCrL2KUYLAIcAYYR7pkI5csq837c3EgvUHmAJ2fYwlFI39Yrt7iFVQ bZhkBS9rifbpc1eDJC5aYIIAiY1EMwsklM2mSmaRcKNIwMc1xElk4pSj3amp5ozyqtevsfiO frYyo5wCD7tUNd1ePzeb9Quh3GpvkUyHuImvgt6nwLmXUpBEiYjxYSwtS+JWc2YQKkBbSocK LUAaChT0wt1OtrSmQ+pfAmjKM9i54m7LYApgumfds7duLCx+9QBq/3weTCG1xwMT6cm1izXV PHRuLuJ+tWTL+o+CstqjtCARmpjWGaLefvuzdWZIT/B0tVBt/wFVRRUlM0Ksx/w8SxCsaz0S vjz177KRhAaH+ZBM+wKzVXHEwkjcilQSN5epsLJ6lSwb82RpaooRaGlUitBhR407m1INSDgE iiYXZEWMLeOOa3eERzUvmoOAKNDoIi2XYbzbFv+ByczDGYIYxL3Q9JF5NuZ8PGQB6uRC5YME 9jBsQUGB24PNW/ksb0GlJhjkhjZVWOthsjZ4X8SzyhCf0njYE+GoTyQLv8TZMBpCV+mW9k2y PYOqaHDinHZ/MY5ti0dS9qiZQD+AFQzk4iQn1AqS1x5VnY2v50mvnnhDJUFQHZLE0LZyAkXq 2peYDDh3bGXdVXGPH2wQyV6yMcbKTNqloMH3A8ykhdFfrbM+7AZRH/K7mgrjRfOk3WJ9cEfT b2ZrDzGvOG8Q9SK/ErrrJe1CfiN032R6cO0b9b/mPuTJygW/32fKbzm9yFldkU4WIH8+9dir rUauCrsGhGCYpYVOxf6CtLWf5xFfcB1YlayOpcH1i+Ka6OcbU5GZSKqJWyewO178wv5LEufe Ex07eysFEJ/+qRRVQOuUrNOBdJ74GGpL+zNvJESRdKKI+6qmo3n1c56xjtmr/g56nWT+39uw zYQv27AaGt0FKmpKKoqqB6bMgEXZRUche7j9TV0kVNCV5tiZYYNyzGr9dVZZlhbmleMW5nTB UMHK/Rf/WKIRq5vuWsSuM+e6b5cvMpaWCuJWUpIxCsiQgz7kL/Fv3QNywk9On7anhc4O2q8V X2TfemGij3YE0M8u7TvFd7KdxdvSru37c+fao3+Y+qJHhoI7OOk/Fmhb2p3sP1LX/ebpi1QD cNVuBpS+Kaa3uABJ9dH79PjefUuonsvPJeEOnEdqaw9/j5vFqwUB4njEcaVW5mxMAup264Oq 2O2mJ9YrD8xYsHXrpxwlvC1Pe+Wpy1vqNTv8nDu1YO1NOcfPxS+QoCQMHgJXx1+WmsmMdhrs MgLnz7d+0kC5roiN6K4Iif1CSv7TH2GnkAPGyPojZOyZ7LmXmnJv287tsBo6+uOLJnRDhHCw phqx5VeJ2NdUTBUo7YDYdo0Ys4y1sLXYYDYMI25HFtDJWO2tCuIQ3WUUX1hQ8HTGZzjm8xR9 KQLv1gz4jY0sPkp7/7en5Q6VQaI5wssp2wUDlW5SQZmTFqZicYJIdoTj152r5u9ZnKNgtvOt gHxChNlyhsIxvrScJ/1oPKew7reh3y0mUIgO9n2km2GSaJ6kCFq5eSd1Yee27anJiLtFm+lG feKLkZgHET5+/CJ4bAJkqtMv+StsFO7R5jwd53Ey3HRuJxeun0QvHV6bvl/a69vAQ5NiydDz u+PHQRxWdev3Yj0ewtrtp8GZ6ur3orXH9egfPt60penmOHGfHgZVI3tPmo5tOA9e2Zoy8VMY mUxBfQU1rzvh5555R3R3rrhSJ0vFB6pkjRq5TYHG4UKI8O5t2srf79McxyePymivoFvK8Wjz FuThhgJddt9Twk++P3JjDHv8IjNJF8w21sOZDMCn50KkF9Zu4jza2lnJk6603bGPy97DlBVz pP8+RmakRvXy2I08+P9ltfPtjMoYrCF+5HGsdLja33kSLC13bu0qjZL4mdiMNhBim//JF2oV 8SyYbqBPYPhoyq5wus/Q6DN80DW+k1ZhAChd1hSCUrQQjJm7wBCQUcKMtYtpY/mOaNQlawp4 pcp8Ef/s3WAkuzzpN6gIihO90QV7ciINQJzbflPUWqORbjB7C/PPgI/+8LSmLXFEAQW/k4sg jlOfFhZvFhtJ43X5CHvWsT7RwZ/aKBJTLmzNIG05ZQh1txGmXkvuz1IlEaa6FGIavYQ3Whcm 5ZckhI6XWiAJg6wIzz3ohZDd6Pfyc5h/6GzYdGMNr15964uda0sdAKd3d3JxZCoGHfYiOBuH b1qtKYTSVuIfvk/rfTL3bFLj6L+rNEcJO1VbKzX/FyynG+sONlz9Ps4PAOv2Ra9V+z4gfs1l wtAKrovXNY1Kx+mA8/09p+McdCioco02eCwxWdLclqLJUlHkwlffSE+uk6tNbuQOw2Nj7MFo 9jB+JHJJhH8YyvnNtAjnsq+gvJLuxGXBpyU+0rX3Q/yqKYMOSCiQXfqh5aDDTxHoAjHBnXhm UlaaJ5DSXc4Tf57/+Gltc27h9/dtGASVO6XeyH/hLcD/tNn8v6Ls6p//O8pGNyMom9kcZXbW ZPTRM2VTlokFmAzGWUxWkiB/Ap74csO88VprUvnuvj+DsHoQxVlxYZEsGqNEfO8LXkj6Gxkn +qg+qcnPGsQm4qyA5mZCEa/rJXtOe/3lSps7H/LAaCl3dJb1AOcM6t3bG3GwManhu8Ogiy+B m8rV5ce0T47faTyknos7kWTZPBphadFzfKNa5toQvCt+1hDUGsBDdRK2rO2pfi5uh1dW6XMl K5olBKNMudHnwQpQzbS1b/FKtnkW4HluoYgjHE2YGUTYZkrBAUVVk/APb+Nj6nY1/Md/dqEH n3zF5grwjaqrCet2nR3fEWzxT4dgWcXn0R3MjjPgsdEP5pspsM8fCx+ae7DMjuq5hwcYHXNd k/YFJsBftrOJlIGMrS/vrI2Z9ZcfgBTJu96MUieG1viVk+0IJa2HJ2pWn3A1+BNU3D7QF0SI VU9B68GkEp5tLsN/NXDRet32Z8TXwwGAbAN3ZczJ6OKsVK0rRNSQQue8n8lZNbF30NlnaZID Q9laek2+gHQBWujM/XhmHZD2+pbyRpskP+RCzwIA/Hh2sgVd832reP/oUtAk/CbWlA9GEZOK TJqb/R+BkqA2iN2ahzjaUvpY0rqI8WzL81F4Pj3Z5CJ+ISh0NehPknwgnl4DxHwZECs3R+mc NXkW+2Pc4H/FF9wDXKI5Uhz5AkCzEcbAH8+c2G5L+wrPTF3LrrKrXtBJ0FBCo/o4YuRRc4HK VJR/TYI64zB45PFZrjrfnKXVw0bViWtcCST/8av64LMJCBsK2Pxasrh33ZU2W6NLeW73G0Mq h+AQUWC3hxOLcsHDvDoNPr2ye5L31bIXkzBXVpFK/+TVR/g05uJKWMKOwid8ARGcG620bn3i mtjwCVSu7OabmwC+cLBRi8V1UnyVDmd3H/s8RFUQqO/7JQpHZM3BwbL80I0c4AcQQs+Fc7hf ivNIhCeeGjW2gzbX9n6yXTtU8+8WC3mBnDrCbPw5y8+bUlPzDpgRfpufr1byng10Td+F4vgw /c+TiHX0S33YP4nPfc3GSgtxCU0O4nbRsVb4QMe48zOeilonSM+FCsGLZnfXMpHCDZzrQFFp OSVCYIeLVtrEb3kAJfvswfxwygb/rXZKQTLw5KxHwgeRXgYuAIxZfAflY1FjC5lbr9mn3vMF bHwrF53WjnnHls5heAETCjgxGgB1Es41Pe0mkOLlSHls/RSZ4sUF7qrl6g0mYZf/YbLCEd5E P9sXCFafN7fFr7hnz64jadh4miEYP66OZHeyOn1AH6xdXAhOAFI8GPf/QSZ5sO/THBWjkzap 0y5adlFkaGG8vBjG7lz4G4/ZmVjEwQ3mzgnWYjjpxFs7hpYCx7TzDHifWf6HrbA8+WDFJokQ alJs8QkZWx6ae9Kb9v5h/ErRnZ2qg3QN2pnBYbq3qBVxHzS3Bp8w6Nbj694jt/+SHHz1bKqZ qjZIeWGPUBT1ul/I6DiyOS3slmtuL1zToF7UNfC+Q453jC7i5e9Hx3CXW2wwNEtGRxfdiIoB bBX/Tod9el13x8E3HXTuGKm1Hoqa1ydafQ9eObgTyZdJA1WuuafifALgV3MyC6Ufzk50X6ui nMp8MW07+w4JluMaFm3deQW1NyauqlJRBJpuycAjSc1fZhLLImh0aWdZmeRwQVsOPP9NVu3C gvW2EMNc6O8RQjlP+8NWGFzrQ47ofBRTUJcNwDcBAL10Mvf+i8QYevBSfArdJiR++QqzIUwD Y3UZtEwVRV1Ox4WGLtQFAE8Mlh4jgxxIdk9ci7zL8Y8o9HDpbVvSUs0XhCO8c2nTbbs8ZSUz lK4i0esDl613k0U1YH3dn4/t7sMyidW+ZtN3CnEUjuvRZnRyhYK5TiksHK1UeHMrdNxTwwA0 J9yM/W5t+vd8o48hWBnGMD79k36e7exZP0D3DyfERgx2wdaVddo87aHqOU+HWe7MU7tDgqzS wyAb5SmYKUlS6L5XcFoRQ321/Zj37Iws3zKscKcbztolkBxdc596EdPd1ybDVzbH+zCwe0IB JZTE1h8obe3B1d7fxGc9oQQZsJad8jK4rexbkUfc5tBxh5FMNMEBpDZL1D6EmpXC1otdWnqF vJbq121Xc3GuCY3ODEEifebcuhrvoz9hGexns+/eF7Xdvm1ZKLvmtu7TgnPOi9zrBhH4yWUW qyNY8rcMvlSDr6Rp/jum2c++iN6WagLueex549PFV351tVrP4knIfi0y7qurVQWSTYVQlj/r LLIGuBsgQSLMLh64crTUM2ubBSPJ4Kn/5MJ9RgeF3poHhbj9Gru2ncy7a1/7+MluhTT+fWrq CcKzexm9sIcoUPFFYmBWzvXcSu7naq10qOdtxCdOPoHZcGOCL1ZmJa1gycZGJQov8+rEhrTX +41MI6dfPwwAjPXBE3FLpmu7xLwd3eBuCKqU8FSMDCOjvW5Md9aNRGNLco1TLoc2pF2/wAuT dEjr7FGT1Ahdi9M0b1ZSBQadA7frX1MuVRiAVNWm8Yag3hs/u9lJXFrz2mqK45h4RVt8R/9M GEOgdirW48ZxFIf7AGcQt3fPlaHr/EuhvEIE5MBQpwHfrfZU1CdrFy1UkaAl9Jk1QCxbwFaB CJWqqcyF0nHGsUZrqd9vG5G4zM61xU+9ehPyAPJCxzqF5Z5mvmpiJynkldAf65QyODH3HGZH biVc0XIRV3Fqd6FnWxGCWIJxbq87WSpKTI6XmfoAL0IwuVZ7i9b+icBgx338ZfVnXHrwaUNO 6wPcM8Z56hu7UHFIJ87t1CSQTI6VcFY/hiYB17rzC+46gK7aaeKxun1aRzJwoeRnTQvhA/cC WdrHFqDYVZXFLevCG3HDSRLOvZM3AzWY6TR12ei1c9lPS/RKaXy70IkQnv5kd+3cgs3bErFG aCJQ2pOHVttYexksZzlqZ9Ue9Iye9lIuxaDA2gN1+I6jEuhEZfUYfe2u7j6HByW8SvbjYEa2 L2CsZDu7mJDhOY74w+3utt65yn3GcQudvNp2fYmjKjr6pxMnR1VKfPwNYqtjA7f9WrkSxpIl w1V3SzMfmi+XLFOj9ty3YRqHAcsByQgtaLhhRJ6KInqSRR5VWXOMUjtDOiSE6kB9UCzo5HWx k+ZT1gYw7yNvh+F+IoUeMylEL+1Qvh4gq4LW43uX1IUcOdlV8mbkguJSkH0BEnxWruacYxpH Hdv9+wniFZ0M4nxOZ3X6J7pur4tbWpotQjdTcqE+d9PYc+tQ8bU1A1vHH2D591clUeh1eFlP GkouLqBJO+voIduiPtc8qlZKMf0nWnFHk/+Sw+yrN71P9MowT6GW6KO5SSV14nAO2c24Bh/o Bxh1fOrQcVvALp1a30Ron4w/jJIVZDXzLVz2o97yPl+9KbcfzwGeRRqBjTNclDG+oHKGGrH8 6rWvi86TryTLt/YPJFWnJ01cCC0WvX4o6/54T0tPH4wioJvWap0fK2+kGIDbdUvp1U2Hi6Bo 4wN3ivMTLBx3234LHOlLbvkL+vYaTzt1LyOWqaSqWYQgkIxWcNEpCL12kmf+P7qV9D6HCmag kI9j2V2y8yUy2QiceJK8nL0WgyZbvBjY3kFCw2/jXO1e+MCm/8nel7+zmb59P11mdNpvmY6W KsW3naFapBUJSqUztbQltKN2kpYmliAlisSS+vbtoqSmVUsSpRj7kiKkloi2lhKxhSyktJbY KbHU/gad53iPev+A5zkOv8jt475v53Vdn3O77/M6M3pcPup3usCCSMiw0GaZAP363oydE04b +4tonjqjByUPxl+ns/v73VxYL4aagq7gNIAvKxqPyGlAKYLUdhaD0bJtc8Gw1obtPj40gmCj FLICv3xpE+eauC+nc2FmqXpHXG3f10tILEW/mS5l9gy9C0kEp/UUvk3pL3OxIBjv8zHIdM0A lnrED/oNV6/RsYmwsvmAS07RibSTQ50fmtmOCbJDFd/nWGY3NkhPyKCpkcWhIy0QX7YY8NpC O/9Bxq8kXiDZUe03+m/l6sg1hwkj+iXTp4ryj7MCT+TAkPRCdqZl/brNWPqx0ah8WjCpXpzv O4rTsBfzU9vWH7w3g9RDap8d3TPXJ+z2vAaYvHAKYyvnXtSaeIyQknu0Xf7YB3abJDKNT7RV fCFqc/mSc4NknTsTRU2sepJJkPpsVg57xcriQv5Kw6maaI0RkhpVuWaKdDsLtv4biA+dNVeE EJN8UJfeWWjTNHJ3dWxh1/dxg6b0Y5uYoZH8pbtzJF5Iha/V3VewnhDyfVwhsUhSO71Fezdr OoUXGKwNOBc7Wz4eqsmr9zg5elzXXzfOPBuH6ExUt5ShF91svOHWgyM7ojOfip2R6qomL1hE 2BaiqJ2lj3RKjE7wSoLRkqPHiccqPOeJp1sHqrp1FaDtjs8jXTjwUf3rlNuf7LRMc3MCQ4K+ GkWNERJ1fV3eXMW13XNTTxjtcoSibXzw3weiP399WN2UQcv2qvpoLzVaC5Iriy9qBLa5Pcw1 xKg/nP2Vjs7SbFif/ZgVf1zXZC4nR0fb30DGQjOh/9KlPZ12Q+GhnQk9nCoeriJlnL5aMk4n oOm/Nqz8uW3JfvgloXQBrNnwgUXzNTOR64h0lFqS+JF0N2OA+Fb3MiASppAua5tw3gwdDjPT CesGp8LGeYb+f9+gh799mzIqlxdv7lrr1cKW7del+y25pI3c7Z8aA26rNS+3ecWftRGHslUK WVza3eWnRztyA3rjUnLjzksbU9Y/PLtURvizfawrvvyi0njwdXSg4vuENNz1uaXo4/JZyXZa rLJmAygFYY4uyaBdnGqkff/4Jq70ogfuTP/TKL8rJpKjc9b3cYOkKMEVOYm/QUl/ujX+BVNM d7uK9gAQAPgKtAk9cTLql0RrSjNutTCgb924DeXV6aNOrNtIDbDGRfk0uMOy9DbPpLO3ygvn eEKcssDkyj3riK7WiRHYXEEA+RLueY/OjfhR/JJFB9OanYU7lx844G44jZdHqTyHybG7K8+V 9oALPrTOxo16Tgd/PzkHVK/p0I92OFqBe30ETgdHYz/S5iwas8GYr9fUcMvzA9dxRDdxMMWU bGxwLyMU/ct5kGdtcGDhWehQ808vbCtOJMWe6b8bP9JcMsbRqdfPzZItxunlBQ7fmauBWMsF 2ZaIwJZsprwWpyCb1kNijwkOzMV8T+Sewx8yaCeWzD1w1i8bfqfzLhNNR2MJL9hd5k3DnZdw czWxf3PJgDUJyJxOKqy31A6cPlr7riEv8Oz7npT7ElIKWar6geOn5N7oZWSOrH5y/ML9nmWD mmc7N55Aj+kIO2lly6W+5x1KiadZRmR+rzpOv9R7bKzb6yqan59MMaXn/DAlOCJ/56TE1Bln gB/MHhTsWoSx/ZVup63hiiP1FDkaht363r+F7RU7Bpz8YFzV0bInWbQz3eYWTrFu+COzfcp0 YVW34JJH/8RK5eOkRc3epzjEDTR3sgnHn8txQysy7J7DJjmauSoW7NzSnjpf3MYjDebCtkca moeySDD+xlcIDPLd9XyPXKf0mPL/RM5rP4HxL6mN3G0wcxJET89l2WokTpT5XeUwX8teANhA e7KKQh3pnsc23zP7GT9ky8ouHFny2NaT8IDRq2xNg4TyqVeH5ho/u5+7Y/3O3BkZMJHXbe7a cxp9/gO4HxcFg/80gV+jGNOL7mhJuImDTllnCs6lCHN6pCRqpLY8u25Wmz4/F7pt9+wnyLoa lCLO32m38yLEeh7hYdZxZo8t4WwMIoNU+iRV5y42+2+aQKZdZ+OLMmLFbh8WQA8KsBlDopLS uTxst/lbxFh+Bk0Q91fv9709vuqJHVkkGe0q8j4yBx6c774MhD8kFuGLrgLz9U9BR1YFjsMl jAvBHbl+d5znSr2jO9lBpTocVgbuKsBy88Vpv1hqmOMuQ8D3Qbh9ePnIYDiu2IgOeGee+JhD +61Azz1DTh6tv7x2fpbNODQH9m7O4dJA85/qNAUzNRDth7MzNrF3xzKmeJzZ87Myq3bb9iD+ IA56xEbuI40wQbMS2fARWq23Exrk6DyIfXvTrFZMv82PBbiAfzdN34+PP76MtM2LUhAkTOfF W9jQT49Z30KPcXL26nCgL2dntOkGFi0lNAx1YXCbUa0Lx2ncx1ldB+h8Aheb/4TDKjs4zyL/ 5XgFx0SdC5WbG33ZjVV0vUH/ICbhqCpSv3i4xHwE+vJd1l4AJbZ/m3UTXlJ+cpVJtdb7k/IE 52tlAvLpbNJCGImN82Ry1L8v6PQ01x8Y7pyaNu5A5b00sKE04n4bN+4mF96ZCYvqZJRGjehZ UGxlw1u+T0T8r77yxCEOIJKy4m9lOL1o0/KxtiV6GlFO457DMntsF1YE9qmwp6PGh2CMlEYc AgYwmXcpLX72H9fP2uJgXswI7gV0p+r34TXukjjSiEVp5WTFp+HSRwc1G0NSG1/QY86l2n70 vYbM7ztVUvfMfToU1y87rzZkdtOkAyXzOQ9nzYkMpyfwmOsaam8QgzUvYMx2IsVyYHlbSVNc xMWHxMqsV+Vjr/yJHmwbOUTOaWn7jOuzOaE0dkXU3zRzm6YOip5jB1OvxdMOUAQjcs/8ju5q VJNHg+hql9e37bVNyL2IYueqzjWudXtKIXxS81LNbYhHqafJqvISqSVRDldwmAfw3XDIhVGQ jWVJSCMVVkBcyra1wIx0oFSnbOx3/xL2wzZv0be/A0o51kFOQhzTy7BHaA3HytEBKvn+xNpQ lPMM2yEVJkhUyM08Nqv+XuwvbCW5kZ0x6zdsLGTowi57oihl8Xj5QPz0ue1d107+dT29K4Rs nfEEl8vNy36UP+qRe77xdmvuj/niCWCdPsmcbT6QzLUk5botzTTk2FKS1avFBml/QbzFYbqT vjjPk4nO0KFQ3ut8v3k8jnDxZGPNK9jxuQxrYrYKex8OmGOefZ5pwgScv/Sqcq38J1pBchOu 8w0sjk5EmbaT3w7Dt7/gO5wg5vfxFxrFNndj1ORV5Y0p1xG/0vX8ACUAsec1Odw8Z1V0R47L pMZbWkyBuBau0+IgpcPmfu/39Sp22mLLgjIhmnSeKbaxfp5NMjchFmGK5MR3Mw62/Lh0P8OY Lk5RJDm5xTAPbOe6NsdCM8mz35uPRfUG0KrskyO/j7mR4dkqMdfRpxupHQnImOz/9Nx48Wy2 fJGl2e5GLryXYXMNA6OYD3eCgjynb1iJnfoJugrk+0oRO5fdGlAkrhPllZIXY27WCkSW1HCq LVfPA2WvOc/l+NIVJppUAXWPVYt96bgctQvQqczx1e/7rd7k73/xq5UmgFAheRWTPWOmdzR/ vxbrVxEixr7UK2w6o5p6RNv7p84z2WsQhC/oSdLf3FmR1DYro/Rzwm8N2qb5GcbE9tszz9kh OYy5PZBmuL3fbrbtNeeHbnkpp4dBkTB6WNSIRlntJ9nvKwNkrrw6rUW4Qjd5RgQ13NCzbHf8 W4cNhCCFv3hqppYPsP6FI/yqPjLXdGZ+mzsskL52u3wydrZLIie+FWCF0H2PRrWRG99OWxIA UyVw9tC2XmL+zy6eLDQf04Qf1HpiLksv91k8RfhNO20U6nh9jmEemn2O7oMNNZT43gnE7LYi Ikr3ASdaMqqoqngrJVzK3gyZOp0KGDNeo0N1OnQbA5lGr9Kp5meC2Ovpg7lRdhoxsecewYvv Ypu65jLwbxWqigHb+5wlQG/ifIhJM40M6Pp/+FUPII7zu9myV9YcXX8LnYbH0Y/81zYFD9kX ct25iuTaNMx6tPDLqiJcPY2/djNibTJMY/sW2L1IJgC+Yq9qmJDMt9oNzyN64FutGE+ktnWk Hf4h3GNuMBI/8qC32m38l3CATQvgR4OKgc6vR78X4Pnha65xA6iJJoC1RkbzihdkWxPh1+N7 axIQC42r7/4/LdB2DnYO/vcc2F3dva70XxmI3/cjfG5j/P0Qt7w3jtAunvu1tM8qn1XeONI+ q6UN/G9YS+8bbGCgDDBH+Lj5uytrATfO/VMZcAN7B6EMsLN08US4+isDrO66+G8iV7xvuYk/ bD1ui88+B9bWVgZcRni4ufsr6+jq7QdcQnuh/azu3HIVn2OECPBwRZj63cKKL/PxR/jdQXvd 8kco+/vdFf/1Dw9/zDWE3yW09x20D8LHX1lXGWDi4SU+Tfy5cZ4RwhV9G7Hf0HD/t+EE7Zr4 iCUfMS4d/hwwHOB+uMPmRwkjIxXEX9cPHzp06PCRI0MBw5/D1qPvcJ800VHx5ZOYPIf5C+Qw kVR3le/5U71jMQzVEyeL12ZVv6/C+x94EB587dNWtaCAvHsdTr6Lfr6UueGfwtczq/F5BoxV K8HU5u/Blp9o6EX8HV/wesqCYg7+xMYtTv0AVv0UPcpqTJ4hQxr2aG5gb+L3holgjPb/rAny zKtGpHrzll5thgCTB8NZtAVo4FrsCaoQ6dpDgPhMuwrks9bUNnOCw3aCLzq/vH72oKpLXei0 psZWqpixWuVvdlJYSK1ufBlWPgcwe335kpWXDFtDqITvWslseY333cjjq+lqZ3uHhirWTlWf kIg08O9AJqHO3V3TYysR8Wt/zqd0jt3aHGRebvXoxErKoLMhepHNggBfX37n9HiiHonxjEu3 D0CuXGMcDq3Z/I9jal+Y8ktvmJYN9gPIdDC0kP+CZOwhkxKRfHMtBdlm6rwxgXfQ+5oW5hY1 lRaW28h6OvIlIxGsBARMvVZQdo9kBgxUwZMejMG3TqXsU/eZwJKVaol+xdfJZQfTpLu7jR2v sDLazVPsb6vcCvRyii7bDEpCfwD7DOnPzBuSgAvIAWF8CT/Aq27vAsFfw0o6N+s6yUOvOKvp Yqhga2aeVL+hRE82vZVjksvAZcwjzkdDE/4sJMSy6oqQV1k8w+5TLCoJO174U4AbrMJp0x2t 7e5/avhRoBSsfh/I0WF2mZuRxePDocJekrDXY1CkQ6RsYGSNwbkC1U3RXzfvZrNC9gubX9on tpGboBykqwdbmuzFavyxK+ilimUSK10uRe5lRDLKJdSzak24SZe74uWsyyTjBB9P6qXpEMkI b5fP52A0ewIrThYcyVEHt2aogiLbjUb8mF63VcLeNMx6bK0Qo9rfLDo4WNuNTzb2zkhneXpp yTp6s06AFqKLm8tyGkxBRNJx/T45aIG7nx5QS/p1y0BJ99aSAc5ODvu6RQvN6Q2D0PH02i4V cDu4Fok1vBlZaE9FngSJ1vji2UhtGGzKapr8GDzTNbYp65zs0cDZjxVAsaDsUWQHcroDWUaI K+TXvVNZy9R77+nZd626MqvhN+j/UYkHngQGL0wyx/iVSZhN5pXvj1r++iZt6qN8Q8OngSWV AHaSnaZ33aFweB0SNUbqRLB4FyNXi/VArgvqZtIpDSVNj82LDJW4BzaVxc4tvDJ2SGOV79Y/ mfS2QaCOKi6MFsuMYyKZB8hlIHYR0iCXf5kl7Qot3gfVvG3iOj/Vu566qU8cZ+VJoRxTvXkY KkR2qMSDI3kD/KGVedFjVoBDMe8PR3WU3x4Ny2SEZ5JiegS0eLjpACDqg4LunU+/fZvqi4KW tHj7xGFoHrquTzjCuyy/7I79Q7m0TcgzOGuo9HMhv13FYWVKmAlimLNiLDXNYlIamm/fllQM 0aNc+kd+XwAk6Ozk2KHEDTGuk1WTBSVj0/WmXn3aXY2aXTKO0uvFCJSLhIaUfrQ1q8BZlIqc qnKrf6KiH0PU8x+OfSNZf/ebyp3+izZd+VLp/OwMUy5xD+BpJ5SjotOetITwKqVFlD4nQYYi QdMwaJVNMeYqKylbe9nUPRUoR7xzATeb8G1GPg23vUlz8yvSsfJJUkKRjb36iNAqN1Hrpf7l Xa6y3qgD5FjOym/xoMX9Q56efiL1qzEHSLYngPbE/no4YQy0NS/FF3sao5UgAeqRmKBGqKZP El4zDmzlNXOvOigbc17x9SrH4ChD3rvwvlgmgaF8OvEPoJaoK0Ja1SLJANu4NRb1nwNn3iQz wP8BDglveqUbeyV9pLkt8EzILjHifEEGPB2Ezx0j1Tbcc+IMvCeZs6Sx6jctDbIjjKF5HkXa ptG1fsKSrKZsq0xLRhJX7h/j9SY62TB09MZh1WDM+LCdQCFELQ4sR7bjR7Hdy4oinKm+k1gY z+uzcldjw73Fm9X90S3ZfHnxTVmnoA9V4sTc3XgVEzwpKBNtrR48/E10/ceVpjGK6R2X8Jgy uZKGdJaJV99Zh1IVWTCTvYvBAIn6SWIuOXMMFm/keWZ0KITocbSvk+zaEp8MNhGzmhZFsppO TWMHt0TMrH4TCX9zZy1ELKJ0GdY7h8WUMPWaIUIr3Yp5xmRZsKPASKzN/j16ga1JS93ACrEu WUMzhMOFZdqHSMPm2sL2dDN03Vzc1npaKaP7fAH4/r7acegAModVmPYITnQpRk9Nus0MiJqh B8gTVBWGZYzqnoxMkKuE90JSaMsFBsRKWsoTFqrB1XZrQYopwk9gxvcGbGrr+QNOVQqBon3N 8kRysZupN+xC2OzlOiQ+0YQp2jX9AZlozFQFi1S6bCQlou5CqciyB2C6fYy+u+/uiXRz1rSt ZaLBcbJbZOttREFlDNd6a9DZF3tqKTWrKzMndMpK9bAuT1hmvscm+DxjR3ueuk5bKYdk8BCs yB2oAGH3abS8GixC/i28k6EiCxpqrn8uZNFOaLcRc6eqlif/m3+CBsrTnts+PW8S9D0yLRFe LvIaLsXlr7GzbY+UkixSCVBqb6juzfMPS7EHNJI4A0UqAa2Sg8Wkyyy7jqh2p4Zmp4r5nmAu BY7v/aZZPwdOL/RUBGgEYxDqPi6qGht8lhzUdFAMUTxAri0cEhiNeUB9UvLVUU/Ns+UiSXbs 2x5FwN+D++sk/mGKvI5P5XrYPLKAZdcVxVOINAXLiy8duTcSzip1AEIKIjSoBnKvC/MaXHdl ttz27AlBaYoNphZGJNT4NqxqFlkp5KwfsFOYr4NRmjA3LNYLCHLgDUiTR/yr++42h5AxBxjW ygutGWm7pCAGVXI/9wqaAD+aW6KeKkR3VIbNr9TyIJEdNSTh0j5WvqNS2NdnWzSx//ReCv3x WFlZEop8Bl1vRY4sJAQsDaDq4w+QQ+qR3GaBEVmR50UDsSOGxDMG72/KBJXdj8vG9rOY6Pp5 /imoupgmNDQ+kau6NVxIuK/E+td5UyWCQPA4n8q7HLw88xhqWGSv6TXDEwHEi1pewNc9dtYi Beroju3Riwe5NTt/OEgNLBCmCu+TT2rLES1F5f1b7kX6aOAXS8PFoEYWS+oEmHsCLJbu34Ft wgcs//M3vVKhvUZkSQmxdP2+0KQ/yKWtkkov40HxGR0183yWY+Hfi7rnMUPNbv/YW/1Aw9XZ mDzo+N8fg/BPoJOpg++Ew58X/S8mGslTME8lwKH5EfWgRSzJ4IvCo1aLpOZHoOk8FRvQM5Jd x20PLe1k/OctDy3zdaW45YSOPVkKDS2McNswJDwFfa1kSd4FyGsPFFTh4NFoVJ+V+7Qfi/cH MxNUeD9A7+kPTdkN7VGtAvpy+tbc236a/Aio+iAw8j4B1nFFSEvs1azXdND0qhu5F1SrAnkC hrwmMv4sju29CQxNFb6VWJ+J9/2Xd5hTceGDgKUmO46RZ8FQDlLd0++KdMriaC6laktRcftr LqwwASd1kqN5grVTNmDfi8qK/Jp3wqYRKNl9sXCIcN+92x1aCQMaVsqhueqKXHNHd999GvEg W0pt4T01kJWYv71vvgVUVWvn/YAccFm0TLf7FJwBFtvfGmSXkXxvNlGRFwV3iYFny01xBQv6 kD+B+FTk2gdMVYMe3Vk6GjVzuCub2+L84f6uwvvzb1lSkKWvMfrPSBXwp60h8tzArUUxDa98 gBdBB1Q8pc3IhYT538dTCQ9YZVzLwSvUFQto2DhWQdJOwai73dQTXKISnUJI28XuJ6XVW0Zp UAvzyg6ptvbZsxJJaC1gb8U/Ei9r+gHrVZL5NSfJHreA6NTaQM+6PWQDhZ8ZtjcNFVo7SF+P OigcfNyr8rNqkuhwlzzagklyVPqYZCVd4ZamjQ/cnMWl/SHroR0qcWB4mNwZsiWkwRTMfick iNXB8kL953sh5OIUUL80aJF/73j04COdIRpqJm2XaqYGNcgBczKw1ZAeI+9+nYR2hYoWlLZi x+bd+OiugXYVWttkyLFHbeIQyULCSVc2P8JSwry3V0GiDcwBOS4qd81g3BleUMWDH+pBsgDn queWKD97zFCxGgjjEbYyvZUaib1FNGTt63upNPBJcP8zlh3PqSxkpK8MmFknDxZ9vjfSKprN 1aPN/k7t5AyMgfpPtvgOYBUO6vqetjAA0FoNxcz2Vb8J64hqXRn/FnR+uGjibbLh9MVqIU0u jJhHGryWQ/MUDP5inNWAzBkcxzX3nn49xzFPviRP8WvO5+OVIQ8DTihxa9SohQ/AGqiqJ8ep AgizfWVFBNkacdJuyHpiSQMvas9uuJh/8zyjyBj36WrhbES/KRy7WL3WRsq0cQAex/W8Iw5N y79Sauw99fMYaRoHXbnaHA+PiE55aUhWTaLAmBrUaaqKEidEJ93EgyOCAyAg8Swgw/OgdSpS +0KwgQ68mpF7ubZ94VCqsNMdqmjULc2weVUGWsSx+g6AfP+lYXgNM5K/6Av1Sgn1DRx/RbCG FnisjWwN/cjjiq9aYDj+7kJkYUScapv4LiEZyPOPwUq4pxS08NEeGQZRFIgfXqxasfaQD3aP 5Aw8GxLf8+mPA5GJOhAFR3d4WCyTpBT2eLVYncXYGnvB7vWVIQWyE69GmoyV1oANNb3f1a/s EDKqx3gMhglXXB1FSKqKpYEpyrBF1MyWJHXkjTGcwjY6havvzeBFOVPFstQn9XdgqEIWvFQF 9trDmzXLvycLC1GDUeRMk/o3SCzmSKQG1cMeaANa/0f7jXxPgF1lNWTA8mR3LoUuClAwiqR0 mAN4Yrdc1cQvfVS6YsQqAvV/EJWM9btXu/l+0pNMGWSTnDg10WVJVWGbewD2hUdt2kexqjOt WpSa8omw1w3xehgpb0/WSal64tDEy0tMuNprdxaGTwqJxeDoSMOHpdkgK8+16G8ByM2nLIqD aK0kFzuMtULVmXrO9JO70ayTDD4piI70HdBziAFwVy5Y/BiFYDHW6f/vf1b3ClvyyENVPX2/ y9VZlMsZJ0Mec7pIK7PCxnJhfH5D2i6RDInzlbbxvBClfpYmHPJiBfrqKkulElrQBXkoSaGp 51pMfkN0Cqu+lYokrA/OpEmLjYPM13yOoBmQ6kHAm25mzlcuokjK0M09oOn3OC+0f9xBd9Ad dAfdQXfQHXQH3UF30B10B91Bd9AddAfdQXfQHXQH3UF30B10B91Bd9B/0E94BMpwbbYYULWy RJ6qWl+WgqyuRONXRPD1pQUGeQ27dck6NrzXk2VKMwxap+eiGXN1i8BMmH7AQOtbWXiQT+9k 5vr8QEG90vJYWrTBSjwE8vXTnoVefG8ofimUG7rwEb++R8rw6xDDYOVDGj50fNrZ0nBudpLe Qv/SZ/boqULwRAdRhK6cm+9ETeHvjKWVgXqRqLB20voK48ia0UYzwf1N+YsjmUpra6u03pDV Qdnk0CXfUmHXVRTME816z+CTItEFpcJcdBEIUvdOhQOSAdPXe33AG98GqPqDFmh9aQgStjZS 30aiNHLGJ5y4BtR2khvGGaPLAVGSozmVmIklF+fiNpIe+NsrSdL+255huaCpylVhLVZKgwtq I2V2zbcWgfSFF6gETiLZAePadaliuZPbG7YQmofyuwXM9+Lc4EVDN4ppA8KdOgeKxHL04hcm uPCPLxdaC+Dy+dgLSVwFw8P52IA0kBSEOjEEwqCSPgyBWgzX+8wASobzow3cNFB8L3ZhiUBW CltpeNky1fxoj5+09xPoSt5W8YFZ+GVWZd6ipiJXsLpiYUApw/YvVUw5hYn6yriWVbjxL8wz +fxprul6NcfpCadSNr9steGl7mMZsnvkAwIvb5DhGOa+0Z1yt5Wnn7206Z4+X9ZQoGHZ6meW /JQxStObKlwsLMC6cPvxRqh5xuzMGVNXZ8z8u3RaQeVyT59yFzUiLnOPH0K6ZKsSl7S/xjlk /NVqKFuma3mKHjw4k37ATXyFNge0vP4XZzykL5txoditV7QsdRtlkdjMUZdKhZLdC18TXWK+ 3aJ8/0qlOYv3BznagBE41+jYRmKrwi4sNbqzktySwkYjXuaPkV5aGhDzsZqOmIEgqgr8dcR9 90go1Y5XUzikBoas5oHHltAJyWQxUe1Jvj168IIG6Ra2jIPiwce2emmg+jSQxDyEhm4B4sc8 WHumNYcuSUF+GWqVycd+rn7rBa1sIkq0xZHdk+ulyQZP4gojQqm8K1vlnuf3D2is1IeUIMdf 1TbcK8wrk3N0Fz0bkq6PrvT7cjEErOwgus0sR/qw0vQVu8tQDtzKL31vpz/f030cMDKzUo1M lPyQ5m7llQo+qbMoKt8s9mDt7VNce/+CJPidiWB99awOcsJMCxpVPYtAFX5SE898JSfCJSZ7 +3Q26Leo5aaIS1LkDag4hGQIm4fgUbymksW3W1VeZ87KbNT9VPju05A0qFejji0+IJnJZpxs WcSxqAX8ElHh8Wk9aggDycyPkEolXKDacWuYiXimrFff+10Apaf33RerkWURAcsxlpBIZyqA 0ZwO9fn7n6LkqpbVYnTV2hJTd2qFn5ksUFTqidKg0nqO1reCYZSGuywTlFjKciQGlRGvV58y pKvws5SXi/SEZ5LkY7REFE9AcAP3huh7SkOyvr1b/1QxVXW8freLNXDiFQHBig2KEa0QCa7u kS0/qnNB3T7QsGE9Q4Wzx42Y73dNG1MLI8AWEgOaDpWtxG53eG27il/M2y3CHNtYFLJdR0is vHsy4Th1JXR3WV6Djp4l1HTPPISBtgyR1IANKjD+vDme4p0P6o/fv7IIEP+skWjLEA+etn9g oxYGCN4oZ+kZWvkyTy0SLznFxKfqH0IauVct+T0jdSv1LCknc2qKVCwMGGF+i92oumdD0/x7 X+dAi5UqtNaw9SkKMSwcSkWGhGCww1jcTaB3au0Z8FRV4KpJyISeKzAOHAjUaZPfqn9Jvyh4 f1KbnSqMiRbdYhHGREXIrj/k4Ze6/QewY/mL7NDI/8vOl0Ylub79Nu4GK2u700zTRq1tauU8 QeUudylSWc5DZeGIpKiIIGSTmaWVqSkKu0zJyoGcMgesHDJFnHJAlBQEJ0RFBWQ6tOv/vqfW ++V8OB/OOn1hXQvWc1/T7/7d18O6rtsn1TQGDdeMbi2EsZfj0B90AE5GqqYziSDr103Qktug 4GcxoWZh3/rMSjffbqtbcJsk1AdwlGEDVZus/H3dVIhtDao0yc2M+gecz2CYbDCCEhiklb7h 6cjQVUlYbUm8qm67QQMicDjqcJ1OWTs7h/KRovaflj8qp4Oe2IXemBe/rQTtrqK9/qN+SVQy XLaVNn6wRF+6dhQofWvSvMqU2QU3CD4ePJjuC1fwPSCxlEJEXIz4ZpWJ6hs4p9O1Ey1ptytn d929vjT0i+gseh1UMptBP4pL/G1/4pOIEghTz0SxgXsc8QC4QWT78ANQHXtRrM0CuL+CHjIL HfiWB8u1d1FRN9gLdhXYVGpggVcMh2u+5coQPd21u25V4HBaj7V8cu5mRoqvf38AZfhyazBF YsqBz5wokYTXlhTF25luwplv3yj2N4NRKkTmd74ZGPHHbSuhZsZ+ijh0//lnOog2BQuSk+Gk m6bYJxBZcG2kh5ECgYarHGC9LOLy2c04114FCF8FF3jGmKWZnsbtM9Ouj/jega5732zas53+ 1iKF7a6pdPscKBfi62YEOMWfc2KGgiTOrWNbaM6AOFObQnXtDR8NbZI+LGX2rGWdKEFeSK70 hwdfDEgujaffHaSHfW/f+svv4gmVoIy9FKvQ/dudVKz8K15ZHDIMarDD+ypBoz2LP1Of6HsY YTdBK+JVyR8g7l9bbu5SNNIG30oWUk7jHuBG733bbK5fGlZTPDOaYV7Ru5yMItsavrbKTGIW ezz8yXIjKjkEJHGPDf0dSiqyiLbW7qszpd2k2+ECVRJwgsFKjI2q+TdMuMRO9DC9MdwBUm5F ZkKGEik2Nc9CK+7rctbqRQrKrpnNTAoq68lAny/u/QsVLbh4AR5Vp4Pvu5sD6tZRNSO9RQoG gkLrqd+6luZVPnpE0ZsKa1RwfjC/gME3UUOe1i8tIoZLmXZm+kGzvv5WWlnaPcHVJqKhq9a3 TbV6HXD+4HrDa4k3KSUJqSQLZLQ7rWpT0FdHQX80/ncbud4uY6eAsNPJ1EB2FwuVyX+tgwHT zG+qJgXl+vqTxcVLFZzflTGyHCfphst+/5rSmavmCaYX4eNzE35UPBB7EN9/d9AzcWXif8I3 O9IMO6bIBnxGIoL7ZRvrcrpYG2iSEsj+oNzuS4Flc2MUtLdKvuIgqihCmjs+1VczrWTamhhW PSZZoOd6XxZmmauXNmWVRF1Jrq6YY+NIdf99XlpPjbSnK6ntNK7ItUAOl7okjfxGe7dcpGQh mMLjux2aM2bsLTj6JfoFQexuVh6H3GDIoYvqohohvOKEXk2LSHQBiK2DUnkXz/rW8Oi1ctZU K90Ca2BrlMYWknbFfbXVvcqDX9ca5V4coARVIp/5Ak647u97gd9WVZSu2HAuufd6q+Zmn7hs AJeqJ+B6qJkWqMg/OFXfmzy3/wlfmEy3MCblxndoIkfamg1HXuiQHVU4WYTeUnjna0iC4hQo hQC2bVTCzXyE3KHI1HwszQPhxmpmpLTI2a68TqJP0sTd/6wGYxHBBMuIWVb8poxsUq7F3Oy7 NG868ExyoSKUpvpBZe0Z9ctxQLsg1Ur/mZyMUMCXPs6wMS22wtTukFlhQwgtfq/j7m/pDvre aa8qmGfOPIYYUGLVmK6HXwXuNBEFUjIz0O5GWUf7aaq04Su14ZbbCb0OSQqmGmbBM4+jLsif U1zpmhbRc70kplumK/Nb9O6tnHXGSIQkXyf/hgydk/yjmYf7K/eZaKzCEy9TeMCtRda3U/Pj b1JuUxLNtYuC1HGetEvQi6EqFciR6aFdmzL3fseM5/YpNglvITkZrmNKHT4CSmX3/Q2yfhl/ jqIojBmbCkMbdJezL39tnjZtV1XCkRLKmDPHgiMbOyAvKB9BCzrXVOqb2N9Mgq6cPa4l4Nv2 pW/KuBwQWfhMh/pP/QZaVBLckeLcbfIS589kLtUjxSMsCX3VftSaV6D9IQvkx9XIsfMrdAv+ t1ENakvdNXa9lPSsyYRSY4M6ZAJOPEcJNzj/DIJ5AE9IClJUhaKsDPqx5mJ/USroVfCssXvm xo+0OhqEBZlj1y93ywzdFv6di/eHMFftNPpqEt1GIydeEDjsWqtYavIf/TQTBf9eVIGiN0MB 2vd54Ym9+wOTK5pGQJ5iePz3Y0HtdiVysMv3CJ9eTHqWbq+SFHg8MLLOPrPz6zSEEKBgTnsP /4q41Hw3t16HuHZ2b12HTqCRqhlKUB/ivkI32eiYLvb49zbSw/RP/FR8el854oZOJPWpMR9l 4hRoyv0HWm3CX45rz0CqQQePo4JpdhqlTfQ6CA1frZ6519FTpPKtAAOtbMiyho2lp9tUIoD8 ls7mDhbKRBSQIfKsDXMrHtEvmVGURUVu8ZQoqs5C+8Vd3KYWUEHIUzP1TAdHb5HRt0XWr8zt F77JbsyymeLB/S+CiqPO8vvz+hTIOx7k7GzKXL4MefT8fihbwe7WWfXqlHjt1m/41T8wNQr2 g8gWzk5mXfbP7di/QJ0t4Te8gGh4+GuQkNupT0F6OAtTuAJixRPxpCrkn9dV7DW/zewpLWPi ZV1dihSESoIbfRrzrqLj4A8y0OUQjzw3Rd11k5LbyxIEvjateNNE/wt2yJyUberFtJtT+962 LHIETI2HIqg4Ses6EOB5UwcrO8PnGUScrw4Odr6YTHjZtGtZtqJUbcdtynyQaWHJ9Pv+qOKl o+WP9BaHcMgNiFOAab4ieWWLbyCSDTgRnW/oaxRY/BG0HzZ7R9t/U1bLt/G/bufz9PbiQ33p ru132+6aUFy7SnIhwU9Bhn0tJHVlaIMC9iCWjmnn8B3CZcdWYbvk5vchJ9gkc4M2YtGO+Wmg OKWjziqT6UYpedHX8Bpiue0A9ym0TqfGxeizTpgKKiC0PungZr/0LMmab5NrqcuY3jXPWz46 hOvYFu8FaR32yIVUWvkrKsn84Nn7Rzw718S60hxK4zmmofUE4Eq/k46Qb6wiuFrr6sAKg4w7 3NBJXFE31cfuCH8GGTzW70pjIUsqTCvepkcbbfbryxQ18rX/VdWwrO9xxaGKf5paX6VCaECc WVtZ6fUyz94WarDCtS5IOm6S8trc90nxauqc06Lev8BNr0UbEuS+9BE7P1V7xS7C2XemfAWr Oo7+N+7rjqGUjG0FtkjSKMBc+b93lwXtKYq29aGzio18ecHWRLdHuYYmzb0tYv9OGqSVMkoJ DEsFppC/XgUSizq6fZeKC+BwvF6PBnk/pcysLUxFv0DCXYYE2a3IdVqW8Jki/EAk1P17d8QX vMoWhGjMEHe02LUzPAWyx1SvQh0XMMMpkPwhS/13ehMUezr93krK3NKSgM2HUnd7YdNzNbFe BSGqSpkiv414FN/noPys4vU6bW0wvZ/Pc4ZJ9Y6N3mlpsNZLLpSlN5MZEl8R7N9QsZc1i8Xj jFcl53dtrMaWz9rVMQpkQzL8v2pCYylrRinNhZB+SZy+rN/GYFI76ev/DVnLEnAStlxyTl32 XB5Hwb76FhD55mXYs2dlunyZyxJx3O6vF/MSa+W7l8tg/w/NVWN2TGOXwoAXGP/DVPW/k9Jf pYMmxubG//W1hdH/MFVtYfx/MFVtZGJm8V9T1eYHDv7fnqqerEZc31OfQqy2Crt65eibhgim F3Or8j1oVcrG7QG7IZF+DJ5cfZBvpbPzUGHh23MRL6Nmk96WhRy3Rg4rSiURWaa2asX2JUtX H16ybOPVJb/EX+Iv8Zf4S/wl/hJ/ib/EX+Iv8Zf4S/z/T6wtvFcr98ZIaAfafH76Ue1BbVgS TDZ1bNIi5tqPT0+/3H7APEpOGt9Sw395/qjujh9X9ty+jJLjMcK/xys39Nm+JHzlTzqP6Z6q 8eTzMEaa5G14eW5MtmzkafYT7E82GqyIDRvueAm345XrbZAX0cmSRqWlsY4/efCmbcX7WA1J zfQiJq2RF8Hiz60akdcLQmUGJf5tFj+49OXpxi3bgBXhs1Os0YpGIhBblF3dpjslp2SSE45e x/y88O0VdH7COm+B+BOzMiDMWPtAFTmPj9jU16b7c6CuHxZIMphq8QDEYsgCM9VjeAZSrbav 9qM0hc8Bhh2MalP6+Ymk2lHRsRziWuuR4QE0X99S1rsBGwD4pxLL1ooeN8wCoskJulvnVv9o 0IEVrNdIkt8zSUktOJFQGcPmD4w3QiPrjFDNmoeRWHdpHA9xgXU18Sdd6bVfRKJBgzEh8jU1 s7o/pDIm7M2qLYOMOlEy/+9B3k6ltTHXfwh868HYdE6PJjBHzJofCG3MYoY2bkPQMZV0IBL7 SVJa5yPCcB6vBMX9iIkrR9Y8miBqWEblE1OiaeMAgZi1IB0DI+41EmSXEs9HYdmSc5+JOUpM LexiqdLaOyFHfoy3efmK1GjMmDCdgejxwsr4A5ZTFRwtrIRP4L21n2JsOymd/6r5DYbj/Lu/ +Y+qY9c8Lsw9CaKKkCQiUfKqg79BoZ0/gOJVC+ovUKdMlNvo5CuykOrSzTGfBM0PqUoOCQU/ q09aAcET7tjoj6glEnLELdxKnkzMI5+NsyEbVgEtsGWj1N+xFV8M7QEnxFl2B/+h/Ajpep2N BT4jkvf8SooRBruBzOvIWaUVNf0ubljxsUrrTfi+KuBl2avxYjRwgPUuTdxn6B18aW7DTxvD YlcRnV/Jb61kCQcQZHpNnFa08AHGWtJmGyZvEVdypiqnAmsIC6K6eSs/NQL76A8ukFWXjS2K BvGRagju5Ng+crhE61E/QvQpxY7/Jmzk04idFrK3imwvYKB4A1hvtvjBvLh0tbL0xo+5XxN7 cIyDJ+jzK3edwaTOoKaf2GkdLOeRGrWwO5MatbGTJDuKOJnvF0/O4/ntIbjNIB2jwUY/EYDk z9VvJtKUpCWthdZkFA/eyHstikkCzrCcwDbz4ZqKD5YK2HqhN0WPLdk3gwCzpSWf7R+haTqE Z1LM5te2PxJKLP/o9mSM81RAecR0tY0NB0GtFvi8vssY0ZsS2EhbjKiAtMZiKoBfgsQmASHp wD2yDgE/31t26qX0irS1eZ6Y9RPlXau9PzeBZwwI6Aj5cmWbyUSGExjXL5B8fmlYNf10m2HV lflxPrVJ4abg44dZ6Vn+WD96oUS7gFF4NGp094/Q814tHKBjs58x6HwUazY7CXghkSCKMawS djQbkiV3ti1MdyQYPhbocngkO8M4np8g6gCDehKwi8vZTOCsXML9MfzbrwytOdtBbbaBwqj9 JR+abcpaeE/sCqwX6pLDJCxBdRj3c89w1Dyt1EUBh0VJMdV1GFzD2NM/cawf7d7kp4je9QnE 0MitDT9Cg3On1ngMMQEtr+T4fcbPSvBhjVRpTQ8jigkCDkYx53u8qxdm7Q09Y6bSifhHPD8x epDPOcgl2gAqiOKK35dvVfqR3/2X2XYYlkVV8MHYGvHglMgrpl2T3OONZVLKBzG6ieWMaPtW hp4heS+Dt8aDJ7ifKj5GK3RBDy96+Vc8gf83Ibscr21hmzQWrvttwCZthcNVORMYmENgfJIW sEU20lefo2uCEwmSGkShDxbcOD/Bq+GXZZKDRsTIJiJR+nSYjyBLuRcuS7vXnRGPenqbbo05 uiK1+dOarLuEm4rzY0nsiLvvwtTKUV0vRdLTa4P/arT3GGApZaaihUGQYwzlzMPdqAYtQ+8p pKBacKyUaE1O80bOz5sNRosHJnjV8nertMeFX6QChXoO14zx99fE6XHVNKpHuzGrhhb11e8M ejSMxTaz8sxgec/2Y/ld/Q1rdiyJ/bC76K9jb9TNZW6zWR8m1+UrTk/nTY/XMUPRhliAaPEF gxWzOnPbUpX21LliG+8QMhNMGx55F1faCsYTzmBgZLhUqgyQjDKTgDWhH2ToS4OMeYT+jC6D J/LLZ3V2YF4IJcnQuYco9NsJRKSopKnWA2DaiND1AVYGvUsHZ9WyPvX/7Qp3IEeP63vFvA/4 MPl5vHB2zYrtRauWJR8sPx7QAsyQMLRo78CKnOqC/kmijUXJKMMHpdegUe2JvsavpQ3pwD6S ykR/JTMJKlxchOfLwz+AfVqSPDp4grIOKkIwF0ZtTqJtMKSSz9fjYVXzrZW8algi4x4Y8Hmm SdesRYSSVyMYBxm8lDTvqKl0Xe3yz5i0i9lpHvItCdLWtvkJNaTlOrW4PJOwsDk5nTBvLWE/ JKJS8vaQyUP51XhZlbS3FrJz5fx7Vg7eUStOblVsoAztFc7NaVTUnCAytKyYS03H/rJ4xeMd BNg4v+whCFyBMdFy6/CLT9X2X3u7+DgGLryXHCS88jAFDJ6axDVkmo3tBhcyvPt4wi/PwFQe AbsMdGNxY8gHSbl94sIFOUYc79XySQaOWwzmlnr5h38gTTfRGG7yofcwLufevG71XkJ0B88M AwbukQYnpaGq6PwZXQLS0QLIlxQ0z4hZnVSAWJJgWCOU8KkAEw7vg/IgSsA188F+ThW7fQV/ IIkwNYk4XuBTOQtqW0RXXXosi/Rhhqcbl5R1JXfnRmfbGIgF+YNB5CKCrkcWfyc6byiwpw5v fKFI18v1FqLRsNzH3EuTWzJzKbhdIpp8Sexo7bOwKfiD6y5knaX56rqZhzJLppsCTMZutBa3 EZIxvnGY/cYjaO+b3fe6JUeg4VkkllvegyFt1Mnzq+57xJSadBLuEls4nYaTFx9oDUns7+xz FEoSsjHvv9RRazbvrgmfXnHyVMZc3V6tWwIepHH6NLpcGiTtVs0qKGzwFd+0RR6CDl7E3qKa GVdg4TMuplWd8nNU00y//iQiMLDQ1HjYEzvZ29ImlT6e44dRiYTKxQ69MVHTzNcwkTtmRtTC ZHSBUxPH3oWAct9MIDVyuOVZWRMuPflenE51YrMB1qR+rGxhP6qDXDGJ6K7qkZ+mpkrnNvBA 2BbvfIuZCvlzy37RMzfT59zNYBd/vtP7c+vLGwcX9PHzcqumoB7q67wIKU63T0vMxTy9HtDR NBc1+txm4OjuREFK05jpgr9w4VbnAixE0m4kPFpagLjIXOEUOfTcEWL5TIQVj582getZjPoM pm3QwJCuu0tfYWN8pPLN68XSHcw01TWP/FOnA790H06MlYpz7NDOjLkhb+BpYEXU6wXHmMsj 0+uloS+wL0WdjYMdIYYKm2usg6ZYxQvAe+9ydblAZ1BEcac+yiLg/XACZi2qLM+Gw4enFe0Y S6tEuVdwil180COfP4piJPEWGJ8YBSVZ1kRyqGiyoJDMT82RekfJFHuq8vcE6ZS1UU+hwTmv v7y4W2N0zRzTvPmBn84a+A27cOcaF7TtsbAZiqIM23eLkZmVT9asKZYEyKGosqhxuMxxvmB+ oMlh5QiCjAuYq1jKkTuRT5GjOs6PWzP38NIiRMWB2Vr9csLftv2FScRMs0DJ5I1+3yzrWp2s /YunDx3v4jdfudHDpM5z7k1vtWmv6ZRDPyZfdmqgOnofSAzb/EIjP2dwNm/wccA9UbOJ6oUJ /ukMUxnYBL5zbXMhYqIJcO6DG4HhGtxzQ2VMGrUnClOz5tmWlEz/dfX+PQdan0jjNtthXsEa 5MLVLYRP2t6OfunTiR/K/2gdAybmb+l5V6IKxv9R9uczd3+YzDOmUIa0SBmrnB843QhyL7/y 2gTmIGv3OZs8TMqaPEp7b6oi7x63EZ8k2ysDwuo/2UCfMF4WepRyVmkPCFnf2rVhZKljYzlb EjNTMYtxng14KfVGy9KJwSTG9bSpziypjht5zMSqwgUZO/5i7PeGEUB76NsqYHHZpI8QZ+yM 4IbufBe0uzrGWLQKe1CSgS8r9tyeXgg45/KZZ6Cb0wYKpZ6NNhveDb5uWait8MZgozgKMThb 9YUbVhD10AXZ3WJya7Gd9vZpRFOkf/++0sbo0Ksgy6396+XnpPRma3PPvHoikjv8ZHdgm0rz Vvf8IB+qtptwvlPl7mUKfW6wSiMQGv5u/kheXMdWM1BSdGWNaeeOy3afT5iaQCiceZWbqM1Q GArt6pOP9eJP4IAvtPO0B4Yk0Jo+dGoE43H5+Rx85gIG7OfTcwhgBV5xJvHo/T16gEvBrIbt 3fdDrkvYQ/6wcY2ZgUNb5vQsDsz2qF1tyXGRn8mAHLmMH9JoL9g6Ap3eD8UE5b6sFnYO8rVp Sy6fDMAkpiyvyvLl6LZXRpK6qiwnBvWJARxHQUrEyQICo++InnTnGEJE0j07heSWmkGzGHZm gNJHDDMGRiAVYElMlAV2VhqCvhRANjs3o54gDSao9Q/zyzziSjHEzrSqAzuOvr2CKQVHZxpw PZr+vlNsfzq5unq1/FlxZMbGrshEX+t4n4zbkmMPRXvSclmXTo16ZZvp48HPWipNleXgj7Nn OFTDlDvMGotKtmWQF8fASaW5g1HAGxXr9rbsOe/Bx/T3p2kVm4wrMF+iXHSiMSX2shw4wQak HGlqnbUjX9tzBgrJNAvttpYTF1B+u7bwdUJmok8YVqmM1/5mW9R3A5T2qmdHTki5/+eHhZds 00A2yyej3NMuEGxn9nIQXvf1Ad68lZdoywhbX2Zn78wIfOrUxrA3UIVtM4iN3xJw4+/bgSX9 qxfaX5Fimu/YEurvg5PfyfpWtmOCSt+AHK02DW6tMaknUHxLn9569LGrDQo/jLIlLJpJGWz9 BTNm3C3CmmUTK3bVnNYN4BT5vOimUEsoE4s+Ns68Docxm5ZmeGgV+UQ1Bzq1iOygRgrQ7aqL 1VCrqsccwYgLA+2HYfhghUNxZNnnTDJMnyfo09XGTuPPoRsuAvs59eVC64ge2KHzJ1Unf1/c A6wIfesJ0H3odm9NXmbCPwn9re+BY9wz8/fZHyXhzd4olXGwmoi+mNvgQvnIsRKbLTXzTo/P pO/Oqf4rp7FfBSpDLee0TDb+fg7vW+GvKR0YASHytha8uPvJ/JZZ5f285mSIVrVNsfwuewSW dKn50BR3jKIOqhHG9hVqTYwoqgBXqdsMNTnE4Nxv26QAPOVc/TUHELH+BH+D7QHnq578yPCd 8Be+uprP1785tRaeP9NoeZx5ysc9zzY3G34yDCRetNs11d1WkTp6sa3xIvluX58MZ2WtAWZc bqd2gC0BnXZQWX9CYIbZDkxMgIqEIsXHrHJGz19dc/fMWebe3NeaXNM7MWeDbjPestrEspua Uwuwh+I/EOKmjQuawRYdE+cIdl6WxPcafLGblHvdJX+WHfH5AXeKYohFrk5avz6J8YKRftBt nyYz50Hi2PKqcqh50wJYTJ5ItzXUPuW1f4DuMJSibw3W/qvD0Aw5g1ockNfa4ueKw6iKIlUg VQbKdtuQtTFC3Aa+TDY7oCg3RCJiGY03UD5YVI8poyaUCbsGtjn2zWvcPNLz9/sr15jh0hSv wcevr/pd29JRhptO0u2NGwXvwfw5m0xvsUgTfTEtZqyrXoSlHWM/bnl9oPNZBdff0sb71iHy nlIRaMFnkVOw1IlTn96d0JRISFSz2eP5W5YjISXvgmOr7O0bEeI3dVyLpVWZr6jHL1/vJk/X +7S5VYnuc646balpgEUls9oqEq796XwuIbWqJSFQOWLNKmVARqdXKgnpZeRyPnBhYqZ5/uXC vMqmu1lIP8LTg8WOrspnYOsCs/fdq9ctOP5pZ7hyG+aItMw7TT1i3Z5DH7hkf/Lk+eWRncoz HcA+7VCg/MypnJU0UY513GJ8ACdb28pnnzhOPTZP5w5AQB4UH8UemI18FMIHovYcSN65xq9v jU7thd2PIq7gEvv94shjHxg1uTNTQ/iNQs1xI2SC0yLD9KpqI0wb4LfoYOsPiMrw68oAbgCI 47qHDxHmjsva7p6odcWcAGs9iHaRTiR77l6i+0mE5hzRLGx/FU31kJnrSEsaE1JQNYJY7vTF z3iGWwMPBpQJO8FAqZDJwAgnBAy3Jo7fCyEa9W5eAyH0xKwRLIR8PKHypnMLMYgGKGn4DWEM mTNAL9G0E4Id5myH4X8r3xr4i90s9bD9cgC4tcBeyS7NMs15bQzGft+cByyCayNNzqU/pzgh KGddztC04+sTAGU2GQSb1Rpnk+9tUCvftbc3KwNQZKOezsgzkY0sD+6YyuqVaCeEtS9bBshk zvLkMIJGz0nZyjdrbdXK2jUKDkAiz2PzwLbxxtseygjr8ioEasQpzNzx0C00WsMTTG+B8+3D ozckVk7rM17kskcb+JSaosm5zjyYSBQn7JvZemBGsjU2QGVnjcuu9x9XIC0GG21E61YZUvfF HkmEfoxb03P8QeMtG51g3z67hW2RdAurOTx2y3LAcdRb7ILTE2PibGp2dVxuf7wfs1xHWIy8 u2OSSVyvVRr+cHcRXv+qnlKQf5k0FfO84bzkjsbsUt94yboeiHU9ZqPJ/KPxCxdSNa5lcro3 4o9GUKlpiyIunYnH6I/5jeC1UziCcm3sYl8SoUUgTkhBu9dz7LQzcybMPr4PSOzcVyv7hHMK eX6pDzSXiQKV/PaupzPrJnY0RCWGAkXeetzL9kvPCh8a8WSN/OmQbakiMKQVXT/RMZP5uXgp bt2byAt3cev5b/Y/YOrdxIi5ZxjJu0BvjBnWGWo91AuU4C/mTPziBJB9ZvO9crjIJO1O4NHL /ObJ20oDlxzSjFvsxSkFF5IGGpATC/p8O/8vCqJbXd07Z7jD97pnSe+c/7jhOgGzetOn97qN Xb/bX/rTPVJW+P5wlH31jnsHi5f32/foXD8WNZGqHgsKu08ofG/T/nv53rcpn5Xscwm+/rfO ERFuwe6fwD4cgvH5QGVxIbRvZqH0HOjvZcVI0r7jnQlPtiS1i7t/w2fClhnYDl2tv4TrTAeX 5lpe1rnRmbZcCo6kmyiSpCyeXmLzJfu0WTR2aGydCqlVM5fZ9XBbI6x1OmF+BXHWMXOAkxQ6 Hd7ZeLv+SWvKtlMs9Gh5ZOrWjB0kLCy36el26JYvB4uP6fXHl0U9PCt9ArGjwHcCqQ4Lq9tX Tss8h1s0ZVLtkLcVpsj2Bfxb0ofSnsFoTrWC9LrgmNRZ8RiHLGdqy4ViBlY2ZmcvjgnaTCjr 5S1awaqcVxJo7MuR8Lh6vTflCM8/WiGKKuGDp3FlvPdU/avbp66VXZ+mYrFbvJQAtZAH2ntq KA0ZicRDhCMv6u83nlmxSsj+c98DRk92FOgJcUxn3sbmTDrKujCALxoJerGj9a2yJvcFztuz 4DTTHedkqYmUcnem3R0wtsSC3mn1xMHy7ZlR8S2I048+cvfy7f4XAEkgtt8geIBNOkIvNv3L vJdrlEG/AMd7FhpDF1BqIubFsptN8MNw8XbVH39rg9yqTacjGJuQTj7PLgw9GAjP9UZ5fNIY Mzuwv9SHc4sw/L/ZHNCUyC71A2rv0FiNw0lkq5evhxCsGor+G975CY4NL/wf8vTd7pOIJKph 5ksh3G8DMuc3a0ISkNcnEcszh8CFGLtxV0I8GJ7H1YsbePHxQRIYxXgy2UqKm9vnXl8M9D/b cffCoXc17mO8y2KQwRBTcQrcNNThYpt/ZurSx4+k14W3ZvgMRJ/aQ503RtBsFk/nz8Z9tN2t lKZ/fOzp//Qb0WD/NXvHVUAovyVDcEFCdHWWD3CN5TmiOtkKRtWj4TE6F+0Ki7hNc0N5QNfO u6jnhc4cwBuOs27qd9sdkfR75FHb3lMr/d6+buWen3/5tVV7/u1HOX7//Oc/zfn7+Sel/b75 yhb7zVw/u7lD3tfPBEGb/pxcF89qnPp5l3VLH3TRDCNYk9+ehH/sb02vS2b3QZaXSP3waXva RL6ZYGXatXT8bC2KN+Ukr+0yvEd6L1qaVyW0uefMmlFinXclEVG8Mt2kvO0IpR7Pw4ZLbb5U nS8JHh9f/NWBuVBNnFa7jHGdPa2Qf/LKR4VZc/+UoPQsjalo/abDORLW9k/LmrdC5m3+S5fZ 9Or2Cr+datsnB9ikbZu+w/emvXS3ZK0yWKILdnmrlEXoioW5P6Z9l1MXqvgzl9szFowd6ea4 Wx7TkCXW9Uaqja4yXHHco2OwC+1jVyIzHeI24aL35/C2ti6m4lBzT3dRm5ZomsGLT3Uhdeoo XehX0a/f9rz869OrHcI4Tn1TcStdYN+oBhxPNS0SUBM6gZnpadevWZ7L9OL2neebF4TAKMXd 8QulVX6fIsPu9blxYOP73nbcd197em8OfB/wivco/6cBNxluUWcc47z+jo7fqC5r/I6T/Ok/ 9yG8ZOSGVSGj1A/zBc2Vy9FX5KKSSrEvb7f9VAugK4zYTRNHoWsxE6tNA/y4iJp+sh+KynxX EGmrpIqcFrlsrZ5nXTmMl5rgTM7jpn55Z4eHrzym7T0t6Wd7vNz47Iuvv/0+PL9//qcd5vz9 3dJ+cv2+CNevbfNy6V65frf+8eabfv/7E3b9znCc+qnnghlhR4ltjt69C3+JftcO07ntqKI/ EflVMp+D287dU/LWoMOQ4ZWtiCvluqRT82j4NIzX9Xl4e7LZuh63Z3rDrbgw32S8eTVHqvNb Unk1Sk19HRdRXfSoAvFYfp+LbnWnr2rMlFWoQxrWdWzTsAsWlprofFbS2+KDal7S3bvMb9GE +VcOsEnzJu7hdfVykIuJoXtUZbDBnHBdETNjDygsidi6YEnCDkgwdqDemq8OyJoJW2ZmzPTo fwSJpCNSa9w3PfLdBR0SJqEpkXLB3MCYmhfelk2KdiYOwzjsLuqkFLXXovmpw/lL36s0w/bA 6vR+tZfafSZXoZPyr70eVJP05+B/VQM29Xps4OomDAS8EVPLU67n0pOPP87zi08gxplEb1Gn WqDHplpJj5L6shF8pNsgv1/Hpcnhb9lHbjbYV+X/ufvXvb9wdSZh2Dxxq+xx226eapTbGUcE ok/tb57VB+9k5FbYxvoSastU5UQBRIQsVWXWRNiv6Zf0Q3Ky5A/nEDRV26PSU5nbZoB7+7Kt 9rAGT/9Se+b/HO0q7ejmXZvoZt6fX7Fz7PwZUBN1v6nfLVHved+lh2ZJP23x8oNyfub5/etf 5vtZ2k8Vn+n6xTYvT9kOnw+m62dX8ve/82t4XMt3evX7q7Mbp37B/fS9Nf5sQTRr8O5J+Pvv pymSv2+XbQxAd+2wTPSbnA9PFkRe6Rn7TbdHIj1TQi8ryKb3cyL0cyFpqZHm95n14WE86fOm 0O+V2eb6e/InlLk5ganNpc5H5VXayxOkEwd5Jii7vKyL7rORO34yP21GmAiVq7jITdZff8su sl1ct7HSujQN2xJ/uor6/V3aM/tuNa+ZfCaTDnfSvOMo/NkJN788wCZtbvTO31joZYux7qAM 1syMCx+lvnBdsTj3T2QqZ0PPVR+QYGzPWHAj0z44fq5tq+xrpjfC5SutkXbgA3XE69AloUQG HVJKROq2R2emRqG3Z33zq8WyHGdqoto6nQ5CM0xtL7nwa2yv1S0Yzx6n93Sbx/t1etexU0Ms VZMakF131XTEBoxx15odp02Q4EqGTbD1oJeuvFfrxdXd5ZMLSMAHmRs2C96XT2bp95mVIK/P DYRLlzTEH9TxUDv8pd6/dMmGfDiAzf0Lca+BnuNNFpVMKj2MycZhmnfhdZ3s8/tQSXB6T3Vm b0JXHaGz5MdWQWT6fRFdDzPFTSwfePYD0dz8qTROuvMX08hy32+9jhlVjH49T7QFHf92/KlJ b1QQQ25S/ukyQ9gl5zhW1BmNJp/j0vW71es9/c4OT/o9/d56J5J+8vx+kuf3r3/9+9/m/P3z H1bxOXH97Jbuj1955MH7I+uXrp9blifSr7MbpzFKl6VLUjZ9+Prs22z0vQj/UtHPqNB0dnU5 3ij0a0TeJ8WJzC8IvevIw454xIjsynw0idx1CmpmDEhRZBTPtLVZatLcdrgW1594acp81OZ3 K5gny82tl4ydx4K6wUH2Vhx9DIxXfbVQ6WIr5ZA5B3/qAuABx25d/lGOvEfXj2ThLXYjm7ed zFv4U3PHTgp/8ZSb3jnAJm1q8u6fj2KxaGsffR5cqzWkMVbM/VOZcr2fA69ckXXK8HQEY1vK Ypue38QS84jLJPw/1xtNaTQ7sD9pamTQIRZE8gEqN6QrEYWQeh51qLFY04FqcfP8FnHbxRuv 7rKhOL2K9ptrzjj5KHkFrlhjeLOWRqkiVpkS17F5+iqBXdaAikstN/4mp5y/mDXBIyHZBDfa 5fMVgpBj193OPbMOY/xCQOen4PUFJqALvhCsqiBrSLHsBHf7ZCPIOtDofvjhhx9ZOOxNfSbD QcNd/p/Gus99IXE+E5e4ezjd5lAfP2WmWAQ1lU0NIA3fPslnIcFpPtjJ1YYauamzPGWXzp/p LR1D0qONf298a20Ev9yAqp8JvafUYRv+o7zl9SkdszDAfXyreUdC5CZTqaacj2ZLNRWam3l/ dsV8mnPhOXf6QvKu6fn3Jua3Rr1nbvLy8jVf6ffp5199Y+WeP/0sz+/fOgbXz9f6vf2G3dJd rt/DD9x/76nc1s9RC7qPloUop+flT2ycNsGcTg4pmj09o9nXB29NfscTfvv96LGimj66unLw DmfiaifRT4n3EW3NsznRjbseFY2YbIapukmSo3MPFYPj6N7r8yYjISRiJnUxaPM7wiYxZWEa SWk+9/kygmfauyl1fy5d7so8w3kqAp2o8xa1txNF8Nz1grfjqD2bCJV3oC662TNuUUnVSaFW yiGSCzbbDAUnw5QTpRWz6NpRW+f30SqhbI7pHmX+CA2bENM42fMwPEKTTuBfspcnNA+2CXr+ ZM3cn8nknAslFDrUwAMRjC2vgg/XSPkF3XHVioX/uy8z6A0PE0k/dJ1xeTzSNrRPuxJRSsD4 SocMNmHZF+6F9RTcpiCbtXo17iG25XoiliSV9vpTuJ3d/amokEhsB03fzIvtU1Mq2WQ1nl5q yQ7JVTP+mt8ru2oiRls3oCX9akBUacSsCRkaU/n+FLv33pivNDy3A8G3zikBSfA46MNWyLSb ey8mxbITzExIr8+tg8uXr+h4dHL4W5cv26D38S7/z8d6mQvN18kwrIZ5O6QtY9Iy49HFdxqb XlKOlFP+aTwsGhUtZWfOn6f+zO/T6HN2twU6D5FJ9QxNHN3h8IZlmozDX5eki5NeuYozUprW rbpIScU+wGVdS69MzjKccPPTrptCQYSKiFC1mhhdDe9PNt5g5C1LBfW2H+YzB1r1nrqp3z33 5e3c455+ttJPe7xYuWd4fr/8Yr7ff/6nZ/20zcsnH9kt3V+/9uLzzzz52OWHHrjf7+h+wrf1 kxSc2Tg1yRtc/eGiZpvS2OmiWX6oK46jC3/2efXcdnTRn4q8KaiMerSwqGQ+vT8f3in0GomH 6vwJV+qKQuYKtbS56STznCI8IGWhRJ+ieOHumdnm+nv8I1Nu0OYzdW72k6kGo+S1700vHJdQ 60Pou2ZTlVBlEHLIVGaC0h5aemEy5UTib/D9xGkQ452ejs373aCOJ807uszv1Jb88gE26Sjd WP8/umYSLS8POpl5cMVMmWa7dEQGFHxCnBvtLvfN81tUhi63pysY64nWpyI7zi2DIeZJLEVc ZAWWNq/ov4f+B0PwscnhlqErk0GHpEm4kBHwEFJUFo2K1ltWzZw/RqNL02W4w8wiSxgMuQoF t+Kwq7vE9sqrWFOc/ej8PEtfq2USxpLGIdjSWGVozYNrasLyBqw1/paeu96MJrQBsbwJXeDC hJUQe9mGaW43PAffT52qH+fxghPQxQ6F6jIs16JNtbIUmt+n4W5GgtkBMhAe1SB//PHHn5gd 9pY+efTRK1c03i3eU+6fT8ULwRYf5uH8dc/PIqgKM8W5w+mM2PRQjdTKkk7jiVsW05E7DB7T HdJZ7vclu2y/K0sNPdlYUUmlJ5ENbUBqCE4tky53wwWqy5Mx5qZj3I7Lkq2dgKg5eaRuCvWY 4SnNdN7T8v5qfWOq5yHz19t7+M9CaZsf/Qcl/Wx/z3vvf+Bhu7PDM1dfuvb6W9fft+09I+n3 938o5/eLHUr7yfWzbV6+tPv6mev32ivm+j0h12+4t4O5SPIL9o9Aw/Qsx+kK3y8apfnPhq8b O23w7kH4s8/z6bUph2aK7CD6Je56HETeY9HhAKbMZ5gqAsM99febQeZP4DofR3KEa2bBRShK VUhVvhH2W4Txwulz2+1R1+hS6eMhXe7KPLT5XJ2bCRGxq15TaUGhLAjw1hylO9kLF6qcjrz9 btH5JZc1J32aKQfPT+qPXmvCGT1UNXG5hj3q1QvIJyXzRyGmRGSaoScxDI/UpP3/U3QycmpN Lkyw537JDspgi7nS9cWKuX/mNYTrd1CCsc1V0HgrtRGKvBuBm/RGqA1TGWkHPtmPfMc+W6VD Wj1YqtpIzmcMfIw1Lh+p2ezme7WQuzl+0nJmeIWacD2h4gXZop6LWGZ7yffTFbSf3ZKavt3O 7tUuTRhbqiS1VGimbIC5YMsa4Kpz+wZMkn7dMFzSBDc9Y77LRIw7f7fffuutS5IO23Se75x/ Aho+g0XZx3xm3XIMud9nbp95fTIRNNCffPIpO57W8YwOf/a03nvySfv4cRvw8v/S/bukPP89 Hm8IYyHjDbVFSu6P4svlNc9Lnbfxa1Lr07xm96wiON2HtCp85A6DRzZFFTzJ/TO/T+qntz/U j7XeRn60PX7J3eEGZByCqX/sonTZiis0t4TKNR7TsX6WHRBZa+JwzZTKMdTjiqWaYQj/YWv1 3HtxSM8k8prkrN4zb+p36cG2yYvd00/be1bSzzy///qv/5LrZ2v9tMPn119+duPD9955s9/W b1zqd0Kun8nAmY7T39W8NE3yVqNGz68G7x6Ev/98lNQsTO73zXyAjWqhBD7dBBd5+Qo9W6RZ 2YP75jN0kySMvEp3a86fgjgA6ZaElAVnakSRtIrihQG3JIxXUTw33cxqk/qeHPaeTDi33oZo 3tR+CjVYiKTCyoYa1djWiKIby/Sdqk9k0Pl04FHIaaKypyinGjacP680aYJsZ9m6RZMvJuUw kjPasUeZn5xryxcH2KQtW77L11bLxbwsadd5cJ3aMI2h2XHZ3B9JE4vYNpE3tTD1/M5YMLbB a1gnemMovXJDrCwxG3kt/C870AzBVBvSGM0OdGMw/ug91yauRB6XRTiYhBGfSR8o6we68+dI 16uRaHbXE1EKdeedJQ3Z2sEe0qV0zXB/GaNT28v1lv3sltjqakvRtqnprrvC7Yyze67kEdVO qHjCa+GmDWiqKcXIfnNb53MM+KgJzfmcN6EbeXFueZ5y/u4w38+Cdl5wlkp7y85vA4jvHDQB u9Lp+MVMVgLUnC+fauW7PJxun3l9ZiC4u/fss88+58fzfsRze9P9QPMA3f/zse4jTt5fidxQ L6FcVzh+zVKRvpT4yqtp2sbGz5UzPFrNwoOlsmLweL2TFTzFoRu6qDTe2y923nxTPkPjIxua tsndd/sQVFh61RCMS9Q1nNZSjTNK13CmX45IqOmmKNRds1QzigRi14RhypMgbaUxD2E4ONFW 75k39bv8WG7y8u77Hynp952t9POknzw/uX7a5sVcv2+/tns7fHhdG3zGUr++y4tVToTnt3cS oqtJwRIqg1Hfcr9pEp/oOPWLnRNT6180q8lmiaYN3r0I/8LPu+jb5L5EOewq+qPId+MuEvJy /2wtiiW8zfuLkkYVO6uqO2S+2yQNxVkLtkRkJiMZSOsGnMeim0q6ojCe9Lk8vgjgmfZOnW7a XC9kw7n9Juutonmpzps+73m1Sdl6eMc7c4luNJlKg8YN0BCqKD5J61P2Zx0WlMwUpQKOqWHv mWhYDdGI7ttpdm6a/8OsfYsyb47HsRT+7s06wCbt3olN/zHrZDN0FSNu2sZrl48+Dy6fPpfP /WMuWYaz64ShAPAQBGMT08gcrQ4YWQ3zUPbVB17TGxNDMOzA4a+bhKFFpERGHRIFYRlC8jLa nhIoLTIm/pb0JAXCJ8R0fKzYU+Jw77333x+TYZSo5aIku7qRilBZwH33NturUl+7uD8zaTTP z0rVImGhs1t0qrSAnVyKaVRND0UDpqrJ55bfSIrst5d0d+GtWRNuku2ZAO6pJkgTlVCH4Wl6 MSzxpYbnlqdeaAtvnDMCdqHTWrD5sEWJw3fpGjX8PjcT5PU984zMg+efv3r16gsvvPDi5LA3 7O3nn5fhYDZD+H+W/bvsU/HU+ZOzM26RYgHUip3U+B2tFI0fzfEKQp/uobPmyLXRM7ixOXhi O3jz+uxwazz1jxy/7jOXieIqwDWQxqA7w246DfpnOvpzhI8azpanTS9PaDhrZJxlCz7qVB36 PzukIKUdXUXIGs4YUZYnWG+9oaPzJzPqN90OPifi70Iv18/krTZ5Ub3ns1bvGZu8fPHVt9/H Sr9I+pnrZ9u8/D02+Pz8k4+HpX62y8vCUr+tNPcOsA5gnE6DktXBLpsR+YyghCbffQh//rrn ZyOwOple++Teyo5MolfKfkm7P7rAN5H3csa+PNkNEnf/3PuLbegiIN2cPznBh5T4KxHptmda Q+H4hQHnoSh5JvKb3OsLn8/9PdfortNNi/thqryUeWrzJ8P9a+qrgnl3ilFLgph3NWiFHeTc v9plykqIbwqDRjZV2vfRfLviQ8rBUwv250kZl4OHGlaOR7i9fauiazs1sbfvJGR+p6bUlw+w SdW0/T32TrpchGd17HlwpbqID6QsfG70lPd87lfBnEeEQuJN6BWxqAqF/SrD/YEcf8mglgk4 BhXDjvHCosphud831xtm580MwZfyKLPQDcJuETaTUDbhIzIxZBS2lEBpkXL+BjVSU05vfUzj PjuMnp/ricHwGqaEHrva0vbqJ5s/69KYOb8IxysKYW5n+H0eWvMJyRSTa6ZpA8z7/PNdGTc7 gmrqTUhFmbNjB2B63qfGmvIyDzPvvET4dxLhmNLmXeX1xSPQh72pq/L8pimlBx5wQ8HtBLl9 cvpkHrz44ksvvWzHK3Zcy0PP9d5LL734oka8OYBuMcheKO8vI8V33tkH+R8UTNc6IXl+vlKo 5vlx/GZwWpP806d66Ix2aOjaLPBodaR7bdYTc/7M7lGp562ZkJMGkOP3yCNXmpE1/NDIo4Z/ zCI+ifgQLHkbNJzbv7pAjZAujwb4Y0MRrp9nNaNoxvRvqiZ1cfByw8015exXTRaUigT6lZvY wRKmRfVcnTioRxG1GUM05zf1e+1Nr/f8Mu7pp5V+nvRz168v9fvwfav3fOXF5562u/o9dOm+ uqH7H07ohu4iayJRtUQyiCukXBGAEx6n3b5RO9qFjnaZuaMVRtUma9KehD9/3pWTl9T44PIg /ySqotl1LFacy/5U1vPVEpFvy5NtbkyLxN2GScRDVQpm3h1WwMNIlYiMFlxLC3uWtGLRqS4y jOcK/apCeGa0SX1PDnvPPhm1uVVzSJ1fkeH2wAP3R/BKemGo5JgC2m3s50XvFp0bNBVN6LPR UHtieYU4PEfputq0mDcxrRwLW7naGg0sO9FuLctvlz4+GZm/KE06Uj/W/lNxHz2r48yDcy2x 5HVTFUvmfo/7erFOGc5y/DxZfSLKcC2bo34otdGmFgc7VgrU5GIZtAy4VLgoov8zQ7DswP6Y FuFEhzyrKgIvIXDvT9n5MSVQ1sUftKZkrZ6NlrueaJOPy4MFuCpbYTOD6wlLTtrlnWkGJf7S 9Vple63kmicvLWU5Py/18phnmq1jbE2KyasnzIzcpJrGCXbl+fWBtyGqI9wiGBTlpAlGQIdb sK65xbx1PkQ4Uo5bn3ptu/jw4AmY6LRhr3ksjDfljKNc+r6IXly+YgP+SWX7ZCXI6ZPHd+3a q6+++podrw+HXr/26qvXrskHlAMo/8/GepoLnvpzNyL0ZkidUn/h+IXnFxHeyfjt07yXEJz6 HzMsNHRt+ERI2cyeGjxu9JjVk0cukXTPzxw/WVkOz3Olbp+033n0ivHwxJ/rH4cR+i6iLyk/ qWTM/v39goYb/HIhsjbaKXaiEyaTemeHa0dXEYtLNZv3N3P+PFrkeT/PgRy80FsDQ2Uazz/c dMsf86Z+D0e9p23ykvWeurPD33Vjh6j3tKxfq/f8bKz3XLyrn3HYL4WzH6dDRjojg9HFQTZt 8on5z9MzmnyPJfz6/fz11dPrlRhdppt2EP2U+InIp8xbeF9xUcvst3JBj0ffNU13jzbJYQi9 JKSp8lAU5ohbHG1aGN4NItcWGcZzhe4avVS6q/FQ5abLTZubN1jafFDnVcrRYvZRtu4R+zLa 1LDdRkP0pFt03aC5FOrOFaqikFV74snJ/PP8PN6YinrB9zuylTO0bybzivTtQeHvhkvfPsAm 7d6JTf8xdPIE5sHVk6bpC02NS+Z+Tf3DrK1Mt4mtJupDEYwNTA1pqQ2Ntx7830JvePQ/DEFT G1IWsgPfGA+9EVpEOiQtwheWZgRG528MIVUgfFntuLe9PJ+WA1a9yQMPqq6hrFa3iKQXppkI U/EK35fvZxVou7g/AS601E2ma9Pz85inhafK7DODzE77fByzBoQN6UWfLSyV/bVf33Dp7OOx CWG6a52ROZ8WFu1NkFUYU57su26Iy/AMx7eLsMKZW516c+P4xiETsIvczIU+6sNY6DljF2JN tOX2yenTOLdB/uabb/nxth/x/M037QMNeTmAshg01sP7M7tKzp+GeUVbYtcQy/fZ4bZK1Ev7 +O3iK+mN4LRKTM/iUOGTFr+MXmwOnkiE3SbvL+/lqbSE6Z9ovzvNrfUyUNw40SB0HuZCpv7J ITgf/X6V5houo0sTDScVYz+/Ix61yA9TT64dfaLLuozMcrrLbrm/xcKMP2yMzR3gCJDYG9BJ vecjXu/58qtZ7/n1t3lnB9vdsy31m9V7vnTVbu2gu/p5veettyj4exJL/Q5hnC76fn5dSzZb VEKTz96EP/TTghOwdHp10d9S9kvirQwpRX6Q+YjteIV6i0ffrR3dp2mt9QHpUxb6kpDFtHCP 4mUJQkaiQp96GM+jeG65yWx7045Q5G/pqd5y+620+aDOo5TDIaXzN90zIRKjattOOHxS6hfd 0vIyaOyiu2el9vtspOmo1Z5UojLSC2O88cplhdc04Qx5v7mK3bF9pT7SA1kj8y9o+cOuCn+n 1viXfaC4RjuYJu3eiU3/UZ10z6os/f3Ng6unTV1BM2H63O8itWg4y+vTsY0yPCXBWM9UQ7NZ gNHsZQEjs2NaQEN6w0wMRYtSb4yGYNiBw19pktAiZRG+opqwWUYgQkiT+oGwCxeMi0l/QiAa b3O+lPO79z5zfMLxKz3hJQ2tdmGwRRW+N9dr4sFv6f4s1VIK+MvtNJs5zT6blqSlVFGhv2PH LeeZqinCUj3xuGVUKvrvmnLw/FJR9iaoSi+OieHpju+CVvRTTyjz4uIRGMd9aisLE+cyUQ+d RAzThDj9Phvu7vWZgWBD+u137Hj33XevD4e91Ltvv20j3mwG+X/m/r34ont/5ewMmS5fH1J7 pNzSotQL41c1pho+PsWriuBUD51VQ9f09ejFRtRImwgoEZZHLvQN/eMaIOEpV+qHh8/1O+Lh wz99P8HwqmsvurbLEzLXlYxiiVHtqRlvquEmhKIOdy2jbEw9qEDfdZPmJDeIzRpO/88zIen9 1dqeqR1s891h1b+tHa01ZchMmtZ7+k393v/wk89U76nbuVfS7yzrPQ9jnIbvVwsCMjboJGOr 1D75hOf3yOVjCv//VlQzjOxm7HUnYDK9jsphteiXqOejJL6LvMu8WXdN5k3ofVmvShonQl9L /g7I9xslpFlwWevZNtxJA65MEtOnKt5QwF7Gmyv0t12lS6fnIV3uyrxpc1PnBu3q1eee8yCY U5LzJ0TpHvf9qo7k+62RqYcVyVf5iUchp7UnkV1QjjLjjVc93vjE4xZunFo5XcUeLcI96mN5 IN3zO7bMr1Vbaz48wCatae0RPxo7ub95cO0kaR+6ttCUvWTub4azi5QUgo5WB3wAgrEWtdRG 8/yGlN9YKZCFg5lAi/B/6A2L/itSZHZgGoJlBr4XR740TTLqkDIJx4yAQkhpXqyrH1iorxgF IgaiCk7cLrryqAeIKluhZUmWdhwyEW6LXn7Ebsk79f0UFNrG/VmjpaZaILWUaicy8WkG1kQ1 WVgqfb+sRt/S+bT50Vq6zPN7SIqym+1pN2u2kxBLcT/+mBFX0nM89bZ9XytUfHj4BNq4l7bq pYTmuvhKVeWMPWfuoRM3FOT3ve6DXS7f9evvvfe+HR9MDr3z3ns27G3Al/8n909CZ+GWyHSp BidMhVgfcksc7aYI8musdkYZ+6eeHtRNFhZolj/tI4tYS2Ol1xb90E6fvg/87XYAOyDE3+dT CzyVX+Z2ijl+Cc+rqaxIVsaJfkfOn1kmrn8qKO27fE6HoCuZnvSr2JZV1Jn5GyHwZgm1Itzd 8Fij1KxUTuXlRrDaLbyqTpfTPtrB030dTBG5et4tyH/6IyWIuj9hdRra31M39bP9Pac39ftR 9Z61ycsvq/b3nNd7esnEPvt0CONUjn4PSmbJp3WyZNP1h6ISnp9Rwlui6SGjIwu/+r3l3Oa2 yE7KoUu8z8ctsjPIvC9oq5LGgxb6BNX3d1EBRa/19A13qoLCtbmq9lsYz5J8Mt48hGdGmxT4 cNg7UuaDNn9t0F9PmwKz6FWvfvfU6Oj7pU7YYUAsu+gZTXCDrivUXnui/KQfylFmvclLijf6 jGPhNSnqNNRrI+VtDayFpquBlWHbJPNa/bCrwl844eY3DrBJmxu94zdcG5zsPLhi1lw9909F Knw/+VARol2nDE9JMNYxXqE2Ftb7TMu+ut4Ip0+R/24Ifjg5ZBm6LmkWoZuElgCsjEA4QW4V uhapDRS0MHfhlnNz4yI1xWzyUURcjo8HiFzNKV2halT7a2PRMhFui4b/476faj4j7q6Sz1AM 68jZZyGNbjn7xU43P04+mflKSw2lcJ4KCdUkB8x9v1Y6PLX+1jVjMupVcZrFEdZ/eb5dUbpZ KDUkw9O04rOmtx971LTiwqm36vu6NvHZ4RNoA3/q+XXPRXH1Cp34CHrttTfeUK5PTp8N6A9s lH/00Ucfzw57yz7QkDebwS2GN202fvVaCN2Q6VK0xWpwVOWsHVJ8i5QsNi3PT5U95ThpBHk5 UlYjne6DKp9cY6kf3Wtzk8LvV2HOnx9+66zIyJn+keN69YXQllEg69Wwrvn0Mzb8FX8x/aPw yzD6hyHYlUwlVlTVIM9PoR13jQdDToh2QdNNJq/scvUYSsI6ak2UonDvT9WpWZgxtYNjz3tN e3IJ5ur5EAeCq0xpbZXom740mg8+cuWJp557weo937n+4cf9pn620i/rPcf9PXU/99ev2f3c n3zsctV7WsL2ROo9D2Ocuu/XVkOU7xdta3FHj0pY3CM8v+MKv348XL8MTK2Z20I5qFhxC9lf IfIZky2Zz5BHCH2LeNjuVHkrpMmCtoWA9CmKfXGqYs9hxXZEodrKD0/4ZZjo2jXpU8XsI4on hS6NLpVuhyn1eKK33H4rbW75v7Dc0rUK5y/XLGcMuft+0mO7wamL/tuIRuZFz2iCGXQeSfPq k2h+JCqtE56h7PUmPuO8YM6fmXgbw2s7Xa6mPqSP9yvzO7Vj+PIBNmlo3X6eumA0XaNk6z7n wTV6Y5j75TVUxLaSJm3Wjt2fInt2KIKxBr30hiZsedNDqcB0vY9Xevb80csvl96waFEG/11t hMowrXFjPMI0tM9SicgDTJNwVCKeEhhCSJP6gdSzrkhmxoVLfdyiyUJdKvccJp9nnn3+qpmt nq3wmgZdYa9ES1tUgfe0vWzBhnzNIe5ubNags4+cXZPGmZbqZl8qWQuu6Zg2wFSTIv/pgEXR aaw3HKy/Na2YDoiZIpooSpmeMu/k+sp+lVasU2ut47zva07KR+eeQBv4Ne4jTuwbJMWqinL8 LELsM62Nn3T7bLDLOLhx4xMdn/rx2Wfx6G/duCHLwWwG+X/vWvZP5sK1V2QsRKZL3k5EHDxM 7Btk3mpL5Sx24jn7Mh6tsifPXtlGm+PP4oiaBdMcr1k/fAKQ16Zx6/lL3ZYmDkv5ZS2m/LJo fyZLs5zKNEDgsJ953uMvVx6J8ItCTxP141I2KpkMMquqwTw/D+0sEtoVUdhMKuwy3aTS/CE+ 5Y6ulYg/I5+9FWZk5i9D/G13617ftUFvnu3oKZVp9Z4+Ydx1z30PPHT5sSeeeT7qPT/yes/J Tf2y3lP3c/9m4X7uJ7q/56GM08HAqZIYNc1nX1kOYlnWWIRdjyv8019fmNtjblNURSEp92FM kLfTDSXxo8jPlie3kIebJLkj2mCTVO5orHQ+E7FOTGHCuZPcUn5actyX/IcB5/m+qt4wXh7G M59PCl12m+vv8Y+9535gavOmzrOUwyPIKqqUJowVdR5AH3fSlMW2NZtRpMqA1vIVD+WPMpVR yEw5eHLB6k26cakZ52XNOCo1mYfXenR/+5ZlF8YG7lvmt6Y0/eIBNmnawH28OvF5cJXuWD33 X4piwZy14/bEMQQPRDDWcDeZaZ5fuau6M13cNaqt98mVtaoTML8vqr5UI6BhJ6dvZgh+Nj1k E0qZuBJxi/AD1YQNGYGoB1MR4qx+IFfmzvSsWl0j1juQ3pfz9iBuUxQKuVuDK7zlV1eVaG++ 4Q6QAu/N97PsbU5wrhg8XLWGnX3kE9/U7Ry1VJ08ciXKjPrROu7GsOnOsCFNjpY4YNXPVQ3J AWECl3lHD4W0/styLkXvjqe6Hn1/cdL3zDnI6/SpvRNedWbeP8cENII85OOen60hk+enpHUV K3qxcOTcXn5FI979PhvuNtrNRpDHZ6P8888//2J22Fv2gUb8jRvy/2ysu7lQzl9km339RRQ5 W0Ih9se0PVJ8odxkCL34ktl28vtalCkm+dP+mzbFW295P9KkSN/P+mG71sQha6tC1GaoXDW3 2dVPNj9tk7fjZ14K/RORnwg9KWCe6ieH4ETJRGynPD83f+WYH5uQtcuMJjtaZb4HyDw9me6f p0FqbY87f/tZ23Pqo6ipTHNXvN7TDEur9/Sb+r3+1vUPPv40b+o31Hv2+7l/Zfdz/8Du537t Jb+f+7zec4tZY5cOH8w4jaCkDHoVpFguRy2zQ2Fj9/zCTLftOBSViLDHMYW/fn2DY6lShPBh 5sWK63XEIPLKGCnsUTKfFdmR8G4Rj9ydKvZ7qcRW0ggeu1zZPX23XYQWu497C7sFZ6rINnfJ ZZG9AKppCwOW+lwun2t0qfTxkCnn9ptp8489mmd64p13XA++GkGwLB9SNG/J1hdVCrBtf5tI LTdomky98055rWZ+1uE5yoo3xowzNfG8smsSXttkYC20uzWwkn77lPmFs231xgE2aat27/Ql ddLrbIu7FepnBHR/8+BylRHxhCbzHk6wuV/FOn3W1pYkOqbZ6n0pw51QbfHl1N1RKqAmLwkY 1XofKxSo/FnYYV1vlNowlVF24Jd15Bv2USgRtwhDhwwZgchDWS61O39e9bnGuMgh6/ODqT1z fSowGALhMXdrclleUaWmS+sXMp2/mf+zPO6+imSde0XMc0FLmZq12FlLhUg1vfySIv/u+5Uc +T5/af3ZBLvq5Pm+D4gIu2ryNeO9F9zMLc90PMvxbX23nIPFM4e0X1RpbDgzH59jAi66FSn2 ce8pt7ghVyyzs5U6KrbMyIniPGYnuNsnG0Ej/csvv/Lj63bE6y+/tA814OX/aaz7SH/rTc/8 1VRciW7fH9O8v9gc00uUeojXhtC1V7vb6VEmhadP+4iShcGJrXHrLmwkwf6s4+70/OxWAcr5 qf2vvf7mW0HPx3+kQs3SfON103oagzb6s+RzUD99CA4jfBJLfPRxm/GeV2hrcMyD0NaIymRS RYbrJpXmuxPo8amwhRXfzyrXUT0rxD+9HWmZwZpWDnhsNKA2Y0S956UHH3n0iaej3vO9D2+0 es/pJi9tf8+x3vOhByxi96c7bjuhes8DGaeaHobVEHXrV2/dGHeNuKPlo/ch/PHrE8cy0t0z xzKcAA0uifMG1TCTeJuOJfIu8+OCtliLEjs7+I4A2odAro2quzPb7ZXO/dYm1tzTl3qd1N3v wfOLVX5K+VkMSrcb0H475fhFHFyBqAzjWaLP9bmbbma1hQpvf+0dmXBNm7s6N0Vo3t8QPo/E WpRAiI8WzniYQCrBoyHbovHupEjNDZpSdxYItPbLbdV0NElU3oh6E483DirWwvs+30RwPdu2 3X4OC4qsqY9KdHuV2Z5kfuFsW71xgE3aqt07fWmhk2np7mMeXKc02tx/XSmjwWavTHLN2u77 2Z1uYzM2q0c9e8FYCTjVxuD5xR57Wu/jASNfGxxbLWTZV8Xf3Qz8qKL/7vKl1kgz8Bs/8oUr klAirkPcJDQlohEaSiSy82YWekGYth+JijDtoKDVQFIkecPxVCWpZyUQQ9yxuT4mEGF5yXJs iu4jVbCbKfq+EhGmutz18ryfKi67Ymipr5Xs9MHs3L5qxGqHtMjwqTTKJlpKBRUmZBk7k/X3 2quvWOTffb9xwU8FVxVLXNuCYbXhTV5xY+WuE893sDxjP44IiYUIh+8X0YtcahRnjqju+jPz 6TkmMBgMfg8aD9nfUbWWNo3JcTERbp5X+n1mJrjXp7FuY1tj/NvZoffso6++ks3g7p/JvEb6 u2YsSHGa1A2Jbq0OMVNKh+2RklukqJixGY9vvPn2O83t9Hk+SktP76+FtuTDpsJq49ZiNlFJ FFuf3O2H5/y8GDP1z2uWLzU7y82UUADhC6f+eVGj3/Sdqx/TddrkMzIrNfhzymuxLd/ESkom PD+FtiwlOiWkEP6Gwzs1/DHdJOXkhbpLlmrmAuEqzCg7uKtntfpc+H5pXEa8zmJlpjBV7/mk 13vWTf2+W1Xv+fVCvaet0tRlU7I26yX2pxgOZ5wuFKRk2k+Tr6XlMu5acceafI8l/HmhhqTf Clvq/ffN6/NSBJfnVYI/CLs/lcSnyCv0MV2ebHFZi8zk2h55Nr4JXTh/Evq4n9fCQpT9Xfqt finlIyy41OSxBXAE8cwYqfKNqJwfokSGTMUbGcWTiRYKvet0qXI7pMxNnZf/l4owSzkUvoq1 I9o3IPIgo+8XKWIJy1YdKpuqh/Ijp9ZsqlfCnoswZLTfi08iU+kpyog3fmA2niysCK899YRK K3yrF6/sGnTslg1rzU99vEHmwy89ksJvZ9r6yQE2aeu2b/3F7OS+58FV2iLfD02xYu4PpyFm bVnOcfiSfO25kUmYqTI8VcFYBbfpjelyn9jiLwJGsd4nV9ZOyr4GveE+32AHfjc/ZBx2JdJM wswIvG/eXyWiVAHlmT/fkdeX0ZiezTLMpcaFBKJcP19s0CpOLEakmHtajsPcoEREmKIWeDfX SzWfphjsbOH/ZD1Aj7uvBpgTX8R/RrdLnt+CllKJnErhXHkqcvZ22sJh/SmA7Mk3Obq/Lzti vWYauz8k/dJyVrGcO74mbwIgyy5yME0put35ULq9i3bnqq7z/nkmkCM/tsuywhr3/GKVXW1R pFrPKFYMv8INhU+V7HOvTy6fD/PvdfwlD3/hb2vAu/8n908S/5Gl/sz5i2BHS3Qr3Zz7Y8bm mHlPMLvJWvec3nlXE/3HH4ed0isLFI0+ncNrFjKFqXFrPqwUx/MKGmmDTvf97rGM3z33ajs9 z5o+8fSznvOz8WduWeCTAvDx32iYYfL8s1I/sdNLBhDb4DchG0d4KDibUcy3zPCSKZlwjf0M bsnJCtqKS5hL/leaSW2zTmZdhgeorLOW/otKl1zjWOpZIf5c29PM4HPh+3WgSvrd8SdN0A/7 Tf1eupY39fvq2+9/+PHnf/T9Pave8/tvZ/WePmtoncAtN8th3zxn7KQ2DmacZmFT5XLSxY3m 9bScYkcpm/sQfvt5n1/d2FOlc9pSLaobjqXbUpW62iD6CxIvkV+UeXdrJrtT+ZZoSvGH0Jtz o6XxbilUBaxCNds6ODtJweovxwUwSHK/m+fXF0zHHsAq33DHLyrPq3yjhfHS5xsVuivyqTYf 1Xnqc9ltMqFaNC/yILVuxdYAq3hpt7SfX/MUqZm6e8ZsKrfnLOP3gexPm440Hw2ZSk8veLzx Yws3lqb2EPf60orVjBc+CakUbc9K7lfmF8621RsH2KSt2r3Ll9THqaFfusbTLMeZB9dOlqYy bGKMcMJs7p/N2pab0pE1VHtWhrug2vjdpjdmnp+n/LQrVKsUqDVrVbiUZuDEDnRDcLACyxrs RqFMQncBm0koonJGIgknLaIsXDh/FkOSTVVVRdrps26eoZxUqVnrhGu+iOHmdm3W9EcfN33n msJi7mV5RXhIF9JMUY8KhQlnvt/jrrXK8xpiQmswxrl/GwGqXmvpbld4fm9avL+0lJfIuZDN bGG3/pQ/sBiCNiB2O8JbsIUhEYO+BUa1u6fnHd1ylvMpu9AN56qLGKzwud0ZG72ktj7lWWwN Zz7aNwGX3J7sb55f31lTxkIEDkJ+PvpYE638Pkv1uZEQDt9f/fghD3/hI/7773O0K/3n3p/G ucVhI9gRvp8S3eX7aXtM2x3T9yVwx2YwHiW/PtFrnlcE+gyOSGGGzePdMN8vijUtmuy+371+ mOfnmtOSls+/oMiTeX5SAWmnmAKwmcR+xoJP5kJaUFqhpydN/UTabzL4fQhORvho/7qCe8XN X1dwn3zSErI78zGTya0mNc/aJ/+0LdW00Jz57KadfduEqXqutT0yg5t6Nu1c6nnfgruP32tA 66Z+916y+cLrPV978x3Ve3759Xd+P/fFes/vvvnq809U7/naK7G/58nWex7QOG070La50a9x M8dUi+yxz5x89yD8ulBTYy/XET75dFRSe1TlqLphIvKDzJuesvxf250qdjPJuwSETSI/WEvj q6rxzHw/Ew8h6or8plu04+S4YjvLNzKKF4WSKkAodWpu32p9Hspd+nyuzs2EEqdKrCkMNmya EOufcseq2CzdhGWrses9WpJHlj0Xnp8iaX7Nczry0hNPLLTsQkw4Nzy+ZhPOq6+Y79dD3EtL K7ZqXHwp9EczOFVmVTLvqQYpfCN8ZIW/Q1PqqwfYpGra3h6jj2npntQ8uHziXDX3t2Idm7Wt WMc0Y7h+vm/CRBmelWAsp596I7f2zB2BDWlWffWAUTh+vuBmKPvK8H/ojXD5pCnKCFx4tM9C h5hNmCkBS//JDDLvT0m4CCF5Cab2H4lNz3XTOQWRlsTY1H4/ND1EyUmLDComrunBXZ93B01h hmMkHd34ek+WaCiG8rxMpft+PWPcfTm/STy+TXxmRXjCwuxmz7cN5/YSOS+eKFu4rL+XPX/Q FvzcXgtHFC/boDJzQGRgtCINVnE6dP/9MJx9AXf4vREQe+O1sF7T6dyl66uQ8P55IGDDxi0G DZsMXvq4jzsGuLVQq9QycCBLofy+775Tlq/G+t/mR4x8H+0yGGysm/cXzl+JnWpwKtFt41tb pPj2mHf5JjO+0s9n+vKcPvwozu92ykKF6azg9ERequwpfFgpDstfSnGoF7FHlOUCLANmx33y /KQ6I/SSnp/Gnxkq8lpVO6Xh/4kME/l+Uj9WONoCiD6JZAJpdP1qhHvqQ/toyP612E6Zv+6Z KyErA2gbBm4ojX+8OF9znzRkX9zj2T9ZwqvW9twdZvCi73eYQ8GFP9IKtr+nbuq3pN7z+5X1 nl98duPD995549WXX3jOrpo57FHvqTqNSHBsUNi7QDmkcTpfDe5Tk+uRxjLTcjn5KkHjVvAR hV+e5RDVbcaeIqtRz+NRzdINFpPaQvRHebfnTeRnMu9uzbA7VdY05o1wPV7VK521xKeXNW7n 4ewiBau/a4TcO3b7xxW5L/OTBWeZbLfg4m4IueOBl4U3vy+UhYXsPYgXplso8x/r8Jeu0Ls+ lyZM3yriV6YKW1Vl7aTpAexaUrdL2m+QqJt7EZeq260KpYmUzQeuT+W2KqPQkpR68W200L3T D6zSJEw8FedHyadZk1MTb8dL5mI5c0EWZV6BUhHeXeGvvt4rPznAJq1s61E/iD5O8yz7mAc3 zpXSEzVpK5U8zP2TWduXpJk9Nan3PGPBWAp7VBtjqUDf4i/uCjdd77NRb5TSWHiUFpESmeoQ VyIKgrcQku99YFufqJbKqjAjL7BSz0YvuuunpZW264+bXh53tLzbexFzV8LCJwcbjWl8yfVq Jlz3vKrscZPjlcIYt4eqqal7nTHxjVrK1VS3hWVEDpH/MYbQa07XWxKu+2vuHXKeMTsq59e6 7wkTWXWpE7PrVrSmjKdV3vV8Y9bzLJUb3jz3BGroN8/vjxHxcXPB7hhQa8i0SLZHWJXvk50g t8/GsQ3nGuM/taPeycEeY12TsQ05uTtN4N3300I5c5rC9/P9MX0zcrNZInIT0RMLoX58wxxP P78bKproFUY6nSPMCjcpXHFYvDv0v9k7nrBzLSXfz4775fnVYl+LPKXx+8mnn3/x1VfhkpVh EjDefF2pd7s/nOX8VXBuZonFDxddP68vGhMrNsItlP/q6xFjdlPIzzAaQs0iWvNExlI7NA3K Ok6DRZG5LHVRgD/Ku6y9EeK3Lc48bat80J1e/uZ5v7OxgrcflNLakUtSvWd50o/7/p6t3tOT ftN6z7///OMPVe9pN/WL/T1V72l600zJumabYnXbN1TruKOtFaE5u3FqBSk5QaR0RlRyOgO6 G+2Tr2Voji386fpJSfXKOv26vADPp2tu+1DZFdcN7gSsEfThoybv9qSLvOw7mx4t691kvkU8 tJWl2yQh9F6MZAtRFvJ+umQ7XOHjfbXkY+r5VexeRVu6r6/uK6p1H3KUozqgvJIl6jw1+c9x xCtX6m68SZ9bOC99q1DoXlXZV9SV76dofdhR5hfnhrDb9LZJlNbQLNhUFUxwfdqnI+Uc6sgW SlV/9mnE19zEk53jJp6Xow4m3s4DVgGJQSp9gZEZnPuQ+aMKzwE2aZuLvdN3QjKOMA8ew0wI nSEtEfEO5brd98u5f5i1leO27UjsuCnV1SEIxjLCo9pwz6+VCswDRr45uXYq8Jr6DC5HuGVu BrqqSLUxe/CPpETCA3Ql0gI0UQHp9QMWB8+N7ywtEHc7Tj27WF+hPtjhIzGC4tpVJ9Lvbhl5 4s09v88+T8tVWt9UVygGWaIWswoTrnJfERNy42uD7zcIoy8a0bWOUlNbZJhGWc5M33wTRrPE UKkQkySF/mVEqupL2TdFpXLBzzTyv24uaZoyxE2GjO8mG7OjPD+rPQjDOfIBNr9FzkESrHIz nXgMXuQ+LxvTjcuEivfOBQEfM1kl5CGq4X5cw8aU2p7EbIUI2odbYQM+3D6NZA3p2SjXSx/p P7WhHiM9BF5ek2XMYu19LHEzm1K+nxJ/d9n+mLG5VERuxjFknpNmelc4qysLPD59En/MrtC4 LRfWhq2HbJSw87Sfl3zer+PSAw88ZHvUmPss8/T1N1X887GFqL/8yg0tzSXffeej32FYBFFj UKv9KvwSEWlfNuaWQNcyE1uojfDuGqcpZ40dGZRNtOJxOjFG+0xByQMMW9jdv6gSj8IM35dU Fbu+x435BOfL9xsmDLnSd1mocF7v+c3qes8vP+v1nq6w77vHNnmZuOvr9PVO+uGQxmnNTJkv qVWNk8lXJU6Wsre03D6Ev1y/0dhTQYCSfpbuNi8gopo1tUs3zUTf4szLj1HoS+RHmbcpMtYn +5YA2g+uLWiT0LvSip0+zYfw/R3OIO8Xtk/q8Zbzs4ug+4pG/ElBPF9w/LqVevpWU718wrTp 90ZMQbxQ5qHL/z474l1T6vYl+X+lCdOC8QCW50Fq7bNWzsxSxJn220L405zza142Va+mbJE0 Ofs+HUT7WxQyjUvp6q5jFeMuEy+z9Jn200Xb3dA5QZk/nuuXNvB+h+FRm7TFxd7tK0eYB8dp 8MjPTYNM5n7z/dxk19zfkyamF1Xx6a5fq/fcnzLc41VIteHhi8Hzy2JPN16GgFE6fjICNegU vnZPxs1AGXnNCBz1xj90DG+sUSKRhcv1d7IMTY/UXedSz3pgOUsIYsjGgpKayc2GjZncche6 P+909ilVETpfRpx5QIvG1wP3t9zXFhWfS4WxgpIzqy+NZgmgiZJbkRaWsrIvNyKtdiyybwqu tsLLLTTT0HuFsGPuzdnRIn1muytlEoZz5BzD7bXohRKOVrSmxIV5vb7HjTaqa+HrPUrbbmOc b58sgXUWZds2vaq1ImldfpcMhVXDPUZ6DHL9DWshzAUXeIVbImo2LnF7SOt5zfe7u26M4Pcq r8iNQhcWPZEAu+PnlkpLN0r1nMZRFoXrDe+F0vVmUNg6vbgxi23/cOlSeH6Z9PP9Im0Auuf3 xZdffyO/1Q3Rv/xF6ufLzy0mbfEXK/n02sEh7tOKB+1KRVm55/VzUwGtd1KQ2ZJ+Zv/6CHdA YQpN0rHORhnY8Vg7B2YDba4zD9Wa6e6fFQp4pUBb2/PqKy/F5sCPXbEaKvPdbYVy5f0m1W8n K8hH+vXBuMx6T58vtL/ntddrf0+v9/znuNTvn/+wpN9fvvt6qPeUu36S9Z6HNU572q8FB805 8wTqb+V3tMlXtcj7EP76dZknLejhFV726xFZ/UDaSUGh777zmFRzAUopjHIfzxelv4l8l3lL GVVJo9aLWcRDm4E3mySKkXIhypn5fiYejn/M+eUyPxV7amNPpfxU6xnlGxXFiyB4GCQiFgE8 U99usC37I9UeKj3dv7KFPXxtWiwCYS/Fvlfas0Ap4rAmfKcXc7C2S66lRC255h5JU4mDR7Jj OvjrdDaqSUcOqjt/paozvrYyxr1bsCZdv0HmSypdHx9P4R9Jp/2vA2zS0Tqy5r/C1DXJ2Hoe LC1wrEdTG7LZBwsm5/6o+Fe2pmQ90n5K+pUyPHPBWOSZaqN5fmpsFn3d17b4y4CRVwrERgtZ X92NMIPaFMca1dHVyQol8k2tBtLmK23Xc7vFu9/wThFHX/BX9RW+kZxWK5X6s61WhpFo+7X5 7POyRYnk+9j0EKaXXFUdqRg+V9otjK9JzdU0iLtIL98JWez1KJn0a1ZrxPvbqSO4JjH8W0mS lySEETk3/2yv8D/UHp8rWzDYhctmR4+LtpSD6Xo7mtPpGU/LN4bPmdVmW/Z8TYP46OAJpMmg mpW6a66XvVl0Nc2F2B4oy6lawi38vvXjXePbD1kKdkSwuEbcVy7w7u9Uott3VzLfT86fNsis u6FH5MamejPv5PmlY5OOZ2QWF//GSY/6d/H3+jsatTZs02n75ON02jR6PA/w0APm+12ynN+D Fjcz9aOFeOZKvGM1B6l+lC918/OHH8Iuke+nwW9j8KqqrmsM6j4Bw9gAKyDU368pT3l9r2oY Q1t+AgNkQXBzLd0UmqZixx5sngKzfVKRHuv0AgVz/8oQlvPX1LMSf1b/5hu6l+/XMiCpnQ9v MDhOudLOM+o9w5O26eJtv5/7199Wvecvv/yXHb9of0+r9/yr1Xt+bpf+utd7PvOUR8wUKxzq PW1w7avPBzVOL1dwsBKckcmxy1zLDaI6r8ISexD+/wjH0t0A20RN9TxRVGNJv2u2IU/Or1IN PrbKFqnh30XfaxCWS//oEErk3f+rkIdyf1qKUs6flamH0IfW8psdKlp6FlJfps+C56eqLS/2 bCm/LN+opSdRgTRo87Tc/unHf45HvPXPsN9Mr6dGT99qKOVw388iYVKHphIikBy5NdVPZXnw 5pExsammNVy65m/bNY/pILWdyk6sXc3A9DbapCMT67tvrbRKJp7tymTxtRZctyKFoax+57Rf 6eMWkGihuD3I/NGUxwE2afOl3vUb1cmjzYOlFOpxUA4bn07m/pnPULIeasDSfjdFvWeUk2SM 9swEY5Fxqo0Fz0+3zbGge1mAHjDKSgEtt0kj0EddxFsEso+8VBT9obRIf6dpEftHmYWuRMIf 8RpMlUCadaGqTxUQtKLPue9nm5IqkiTfr80+LfBovnZUXvv8INMxPL9IWaTvZYpBQSFP38bK jWnN1bjcZpGg3glZnDmduj+U3xq4nE7Fp9wm8+K40J4//hjmnzKPUxeswsg1wW5STDUeMhRi s2OUxKThKcPZCmI85eBlYJ5x/OZrW3jl+UYlLiJvneHrbc+7nAjvngMCOWRksXmVkFlVbgBr gyIPFOuuJLVOVetootKyuRV9vLcJd/GJfUmH9EMO88h1he+nAZ5zsdkJljaS76ej3RnBBpFF 9i12ETHUNoh+nJeYxnkW/y42adU7i/+b76jx/XBlFb5f2BNWKi6nzSs+zf958AE/zPN7xO6I Y/F2tT9NlS9DB3h1RNklyvulWXLt5VbxaVbJLPxSWsZclYolVmjrFbeFmn7TFTI81vrsautZ 74Uux4YjTOQKdnqwyAtdvU481bN2TnD1HLvcyNLLvN9oBWuaObgBUTxbqLDqPS2Hmvt7Wr3n 3376+R9j0u8//2H3c//Ld99YveeH77u3HgX6l+7rV2x7A3crKIc1TtsOtFnxmfNvm3x1YyE5 Zz79KG5zfOHX/O6O5RJjb1AN33z7/V9++MHGlkS/BvlS0bdhsEz2yycMkTefQTJvMR6tjTB9 FRvCmcpyoa9st1U1WmpLTkQYfWYuZC3S6Ui9ziI8c8/v7nsqeKaUn1R57PFtyz60M0qWb6Tf Z0CcmNlnZaotf3QDTmwH7884eSAstaGp9NituJbU5cBot6naJu3nnapYQl+IW4F8r6GIOFea VGr+0Hq10xsp5+8v36u2y0x1Veh5yWetqfGMpGortgiuL4zVZnLddAIyfzR9eYBNWsB27Dcy s7nDPFjKoD82tTB7Mk6QS56Pc78FbH2Z2Dxga5azZf103Ky1c/tWhkcTjEXooTbk+Zn9Z3Ng 5vz8hqlWKqCVKioViA323vX1Ps3xU2xZfp+CywZQWF0xbFAeg0qJ8RlqRFAjCabibPPFPr3h y4HabeciqG55PyshULAmY2xSs+77tfkhb63ni90iihu+tif9FBNPy8j1vxSDfL8IvNuat9yq u0KbWrPZglWL/OKdYcDFguQx/GNWxAdKN1pM0mYm2WTOyl3fv/+cYanQTBmV0o5xqvry5fQx weaCn9WXPZqQux7FlgXdLpThGXZhOJ920ZS8VsphYnY+VwuNxJeCz1WX+6K8nzZDDf3YFVdV hJYr9zsStH3UWsL4L2ZbmQh34ypGfP3tqnX2zBWsBpxiPBO3KZdfmMQrgC7fz5w/7ZDptUq+ k7dM8XKdPKc192xmJ+svq132OKidhafD1zIi1X9i/kwmT4slR8jIjEEFTrRruPY7Cd/vwUj6 Zea/KwFbPFZ+mX5IMHzwq95b2icX3MbYn4zBGuItyGyLebt+i6IG5fxMLaeSGfvVOxaT3ZJ5 belbZiLLIvbFPW4JW524FglLPVvC0+08y4EMG7qH75cV+amdTdQObdSMxmVM0PeHxvQk7bvv f/zJ5199k/We//53JP1++fe/ot7z26+/sFDd9bctbpEBM/N5zVnP6SJ2s9hXjw9snA7r0OXe x2K/cs4UeVSOxhJOtkVT1HseW/jjx31yq6CHdNRTz1x90ZN+Ob/GzO5OzETyu+jXqpOlkl5v ulM4lfkx4pE3JdXexCX0Kmuc+H6nKfUhHR68jwieIVIIzxS5ed9V7JlbJMdGd4PjJ/stPeXS kf9acXS1KbrSi6ELFbVXzN4zaypdl07wPQt8yyptfDvepmpTDDtGjSs7d/2iqq9iCU9VDUVZ c3/5q5tUZnpa+yYtt9fWSplYP/xVlo6H94faiqXB9V3UVDP7TkLmd2lIVzQH2KTeuH09S9dv y3lwEhH4z1ExzKf2ja+XzP0eS5glTXyfl3D9NBb3rAyPJhgL7E1t9IhR8/zsjnBjqcA8YBQV 4iqpD72RroxB7cph1bNxbNZ3XI04VZlUZgv5ylxZVbXt+WzH4O77jRvJTVy/VnNiS8Gfu/ry Nc8a3PjU/S+3jCLIZWacfL/v3ffzks958iuWvHlkc7X1UgNuaVDS3S55fpqZZJOZLGbXrefu /JX5ZxVEHkf21X4Pxz5/FkrUBLuhBZl4HCvj53ahMp7m+flFc3vObPDQiKo2kxETm5TnFp+4 fguj5YK9MbMoZVR5KZVvq9nunaQdFGIdjaq73fFrpkIf8aVR12lPuRzdbWrBjgy3WIjY0n51 awQl/XyXFHedwr5TvWQm/dxc6eeqs4+PpV38cVA7/x6O4e1/jd8ff6ee97NlJzxw4oFuqxSP ULJVPV55xNJ+lveT56eN9are05KWN1wJyFQJ5RNmyd98ECrn77OI15urdmShfHA6xKexRFvp Z2l9jy+Z5ydbKJRMdbA6p85UR8IDjIsiq7e/nj5zi9j9v7EwwzN/cVcK5UC6GewVXjL1uu9n mlkTzYENH1faMi5da/d6T5sulKf68OPPvsib+v3zX/+ues9/Wb3nT3bJdFO/j6187PVrfsG0 Qnrhgu2rw4c2TpX2cz93mCLa5DvAVMWNKjK1bvJ4wl+u38TYi5k9kn7jzP53n17nku82X4m+ nJZ1RziBIfNpkSitlduiaYWPbQmX2W6vdD5D3y+kY1K2VZ5fVm09O9xZOLdIVvlGRvHcUw7H KTynQT/60yKZjzNV0lW6Z9Zi2bL5flIJ2rKqxQlKWLbcTiVMqlkhVa0dtRLfpu3MnjF1ahbV v9TaX9qhV/8yrW6hGjMrw8JSmma6pDoH7Rbh/SXaa2L2hQLZn8wfTXscYJOWgDvmW+76pam7 1Ty4QoRdlGt+X/c46I0wYOZz/1ir48XNkfabLPXblzI8mmDMkWtCNrUatQJWmxo5v/L8lgWM olLA1lJ7ws+j/8bFsJVGiMhLfzU8m12A9lJfCfdPXD0r4M5frRxuu0bphiyeGhh9v76ZQEwQ g/dTBTxRczIoC/lfanK6Xp7383oABd5fVuB9TLpVZHOl8VJqashAe6VpzHvv2BpDd7vC83Mt 5WrKVJM0ky0dSc1kpZdzH2zr9FuNeZsdW47ZtrhRtdlrb5imVN4xPT+P8pUIm9OrQgi5nLOO TzIOc8nh9fkn4IPfxr6Xe2o9sqlRq/O2aL1ZVXkXcts7xJfY9RVkkbSejPgYwPZWV5ErnnVD oVVZe8rsZd/WNtJ+fls8vzeCrVOx7GONohbaz9R56J2Jxh6UjZ6GhpENkEezC4Yn9Zk9xvdn PzI5gV7IY/vZCrXdmrBqgVpBErd3kOtnvp95fqr3fEz1nql+LItksRdLI6WpYufxwW8BGMsh abtIi79k1fVQc9DLzReGeN+V5DVb6Sct4/GlPMG/UslkB9U571r0IS7Qgv278rpZn105R2FG rO0xxWEx/qaeW1lGhvlNgfjODrEWbKX2PKOBFNLvS8Nj6xCVKIbGVL3n++ZIf+n1nn+f1Xv+ /JPNF1bvqZv6qdBXaVrtyepJv63CdDv2+NDGqTbGnxakZNXNxI/OyONehH8ys6ex5/u3eWmu JrcYWoqsNi+gD+wm+jP/T8LeK0Onoq+RIQ9QKe/0/kahN61lVY22aixXuZbvp1qkqdTvx1Jb KTImHKMJ58aml+2reMNDT/L8YquuDOL5lpgVuFf/3XgzSJ3Y9Jn4TY5SkaENx1BYbFklnT4s qbOh4atgd6irzNFZ9v2dd8Xqzojjj7GEH1SQ7Y5fRGe0IreOX2xprsVqwsIyk9KVtQbttVhS /ciy4PoO16sUcgt37FPmj6YvD7BJK0X3qB9UH5upu8U86BP+KNUhzyXI8aiZcf0xzv2qFOxz f04CuTNjVnw21+/sBWMGe6Y2Vnl+VSOe++v1XQTGgNE0125gp1TjVemP8RrY8/x2WlVRTRXO X1R9TvWsysLc99MNpMYFJeHELnX90vuxCcKD4hkmakEhzeVWD+AxIaX9ct3+pIRnzcZUgyx6 vWeqqVrnIJvVjb4fwugzFetqysRRzl/3/SL0L3NCt/caQv83d/tvdgnby2pDU0P3D95nj7pK U3pprtuv4XL20z73zODz4vo1uBfySdoMvdwzFvppiY47LLIXzPPLvZHaMlWZChnoGUa5NGba TjN3YmpRSex8gCvfnLrT0n5+QzvbHzlujRC3xWt3xctdUnqFjy3ncdVT7VhUNaFoUs2En1f2 wLLH+EZ+Pf538TfjHe9npeqjUNwiyZEzD99HFZ/h+cXWenZfs1g6ppoDv1eAOROhLmWWWDmS tI8NQlV8WurdN4ouoyTKzb1GqltDqi/yILMVKOZd6N6yim4P7ii+ZCNcQfBmC/V5r2nadrUm +Y9+rWYzoH/gfvtYmGHrk29ogbKbwVrw19f7eUW+a+cqyLfmH9Qw6jgzWKaghxcRKk/lm7x8 ZY66wew39fvFNnnx/T293vOD1fWeNhXtrbsHN059ZupzYxSklHdW61Bb2HUfwl8/Phh7WU06 SSma56f8T82vNtIXJF/h3i77Xd7bsxT8fO3+n7J/Q8RjapNY0WfL+9k6lMEm8WUoJy319vsb PL+2XMf3wmn7ZGXVeSsOKJNM7tLkCHW48Lf0o8Mc1q3I95NK8DvVZAw9a6FHg2KTLghzplLy 5u3H6GwFxBnnsiige36m7Oxq//d///f/6Ye98n2ZlKhXdF2lXdrRoRc4tTU1u7RsUGLd5lLF zHBvmH3I/NH0xwE2aQC2n6fVR68t32Ue9Km/q4QVsd6S7MVH1xzzub+L03BPpnD9bjbXz8sP 96oMjyYYM/Sj2tAOf5YvMgm2qmptDKWcXy8VWAgYKXVk+jGsr5WKYRFffHWiXOKFO4sKqZce cePQC6piI0Avrved5Jb4frncz3MYrSykEX/Zba+Pp7aXn1ZBoZ9/0no/iwkp+xVG3LhbtwVy Y7HfSuZNFivjpsxJrnN4651W7BI2mSYm11LSTLZlnLega6b3r79Vof8WlEr77zcqm5pdwnoZ TRjqI3rfY7c6i4vK7nTPz6e3f6gQovm8VmzmHufc9dtUZ1rn5/HcEfDRH0k/ixeEjvI67yuP a3+i8Pxyb5W+TDWHfBvxMcLLnKpYeVRM6W84gs2y0vB2369W3muJW7uhnS2Ue8BKPu2W6PcP N0Rf4vqF9lnl+nnjUsWYpneNn0NuYhz8n/9j5oFbCG1SKF1kP7Gou/TOUvU/un6XPe33kJJ+ lx/1pGXdKkDxH41ATyON2ifSfplFqqrrsK1D+UxdvyG6o6V+nlVUXt+TftqRMvJUpWWkZuww EDpn9Kuul9TtcLTL5BpiAkDv2Md+9dwQ1u4XKspvvt/L5ftlBqSs4L7nxUENkdSYQ72nhWZV RKg8leVQrTx3qPcMhFLWrd7zo17vqao2Lx07og25FszBjVML0VRkoic5K+5qrp+MiEqhtvtk HEv4m+vXgh4V12yTm65VuAF9fvUZdi76a3w/l3r7E4LvrzQiJPMe8Rh2M6lsdyz481r1aTz6 lCIeowkXZVte7anb+Snnpw1ebKMG3dW31e0rdF+On/qa2T43ieNPKMHQFqHoJ6ogdX+9J73g aqEtW1YupJXxV3lw3zxgi8V+IfOT3dpjdKoE5I2Ic0UJhXt+//631Lu8vv/bD7105y8sLCuu yPC+mToq045teXsII/TUSgtryRgtu+9EZH6XhvS2HWCTeuP29Kz3sUKgvuR91TzYZv7VU/2K ub4kvD2GqEsX1P4gFuUYlkq1Yoh0/dKj2q8yPJpgTNmH2hjWB089P+0IbPcithumxubJGTDy SoHB9JIiaLpipihKl8ZjERz/oxSO/0Lz/iIx4NtGKbKcenb0/bTPp24g1ReUeNFJun65A165 PxV2t7U2KriqOJHOrc265fuV9fV+ukCWdKuqFp/O17pAK2Tx2Vg04uUoHu4Po08mmdSSHTY3 le8XTpiv+MnSy7izswKJm1uwdB1Q8z4j6ZfFZhHns2sh36/3+91w/arftc1L9HsqN7y6CATS aIikX5Z7WrratGjcj2C4M9F8mWqNeA1kDWob3rKQokJKdlI70gV070JWlL41pP3cc4iVclXx aXfFM9/Pjkursn7Ka1XWL6200iz52BWMjXA32qX1Y8iN1kG94x6gvucKoZk8s1+Nl+kAxf4s LesXt+TzrJ+7fub5xf6esdRPK/F81xBP+v3D1o55lDq1jwdg8gbhry8WEMY+Gna5upqJIPO9 dQNyL1B0XyXVW+xI2Xqc3m30LpSsd8Ov2eD52dO4SKrgb2hFM66zXWhdwbyAU/Ws8rfw/bRR q+oB/WZeqvGyfUCknK39BzRuGs0KFMb8HGmFuKmfxcpssgg/2qVIujpu6tfqPdv66O6pb1yW vRsFb2hM0mqql2Wf6TjNrcBU31rrt3zuVRvjxnutJNNomqV+fOEv128x6NFjul5JbTk/D6zW yC5rb3nYI+Q/Rd4e3EyZj/ou87EZd9wH+IZHPNoqV/l+tsi1S73KdE6h0DmEI024WLCTO7zI 84u7+fnOntd1Kz/fEdP2mqvNDprfZ5phONKa68N+jmT+WogUsK+9AyY7aWq1n5cHxxZI242O cXQO61fGpJ+VUAyXXOr9//7f/5kc5gW685c3ZHELawjvD3Xagxzbmbcen6GQT0jmd2jH0OAD bNLQuv08jT4qZrfVPNhnfmmF0ghtrt9ezGv6M9fPFnu0uX9w/Xze01q/wfXbuzI8mmBM0JuQ e62AjL/c2933eajI/9N2p2D3/CxglFVfY8DIK8QHr68sprKQwh7senWiWo13KJhB47h6lo2R ikTbr9hmn3b3gYgsm571GJvVV1hyIDcRHzYTMPviN2tcP0+++X2aJrN5q+FR0VWk/Yb1NvM7 NU0A1osQxci4TfK7c5czrQjXUh6dyrCUVySYZvKCBI8lW81p3F3dY8m33rLlckMrdo3NpmzJ VsVFZ1OvlS+pIsY4V7FZnXXM+rVpXfPXHmStUPF4MARidvU91GRR5X0dlK5+QiPfPL92PwWL W9Q2ai1I7MM3PIIwjswjkNOnnfEmh73nDmC4f/a3ew6+r26Lm1nhlN0WXJt8Lnf9VDftmyVF zDpqDtxaqz/NJJE6VwNNu8hmL7/Px9z/jIfeCTMx3CP7h+xYOjv2k/Xr+Wh6zLoQia9hf1xt kmS35LM7myvr556fbu2Q93fRriFWc+CemQoI1ayMSOteAb5tiCo+385tQ9xc8kHoJQceJ48L 5jVQrb5Ia9NaYiXy+j/a0hfVPzUt4/2LBIh65x3zS+YZv3TOBx/dVbZ1Nmj6zCiY/kQ4mvM3 qGct+HPfz7zfupmXb/USW0CeghG867jKua9pzKgoy/LZuKmfXS6lUHu9Z8QJzVP/9ivb31MV IjVVKAsWuxjWjpd7U5oHN07dZG7x7ZqZzDubuH5ePfvkM1dfii1zjif83fWbGnumpdxLt5Ri VFL70FLIw4e6D+0a2C7CMZxdwpeFPDTEQ+zb+hV/Gb6NLfAtm6Rnu22zl6j5DJvE97L0UO1p RDxMNhZNON/bs3l+7fY80p66t5OH7lWyVY5fKkkpSrfGZgow1V5/SECTh+77+V0UfM+CWrii LZBaYGTzyhUfyOqW36xi5uzHum8Vt3dlJ20qZed6/f/1Q6/D+fvFIjZeWK811VaO2sP7i7sz 7WLtqJVjuGOvMn80BXKATdpVM2/8vvoYy4p3mgdnU70J+0zSTaK7lC99lnP/snX+ba2f7j3Q XD+7R7pcvwMQjAnVVBs+wnxzT3NbrJnN85uUCkTKbwgYleJwfPnHrIPUlKYKdEzVa4aUDaq+ lc6ftI20jg57ar9kP9I0SUSWq6ood5IzE3GqZ3MzAXP8qjMLM4St27eweM4QFRv0WUG+n9WC /+B7LUTRlVlxY8Vn1lv+xyqtUKLo8eO80sq45eZmg5ryaPx/p5b6Hzs8LBWaSQk4WRRrdgxf 2YK6s+C8ekmrDWOdkfZ4sVqwebHZmHBorl/fsaASDhO54cVFIDAYDZFMiKJ5W+inOu8Xreit 3Y7SC4VVRjgf882LcH/Ovb68I5bdCdwP3SZZjmD6f9IH8hCzYlC7gcdNJV32fI9PuzNC+H6R 9VNr5If6nm5Wg2dVPjJetCN5S1GFromYfZlu4fuFbomwn4xBDTk7wjyI5zIP0kQMFSRdVoqs poI8Qz6k81olq7k150tWqek7fDbXL5b6jUMwkn6mBeSOZs7fF4/1oa+VxpV6t70RzIqsQehX LKc8U9W+23kk9iO6o3J21TRYgGk0hrJ/UV6erl8667oWuhx5xCu7RN7P0tIVpAsdH5e8gvyK ffr9slTh5b6f3N+MzMlzjcXYLQFyQAPnf3fjcjpZDBqzXa6YoTzpJ0fdo4Sq93SxnV6tZttu nzxYS+UAx6l3uDY0rWXoM9fPl2bJkZ5Xzx5J+Oeun5XztKDH9bgLhxK0fgPGiHn44B5HtlsW btxJulMRhcTbX71OqU/jJBRI6AJZNRHx8N2d8iZxvqRNW1mG71c2iZt+pxTxSOEoq6ct2PFq T+X8bHP2rNryTZqHun3pcutdN77C/nJzONWfrF+HMv+jD2TCDYfjaYVwFquvWo7lOeINfk1T dZWSv7sKuGp0TkMJZlKZbpda///6oZf/ExaWZ+tr4OaqnmX3ZFGIakPTxsFqOsTQt6zfIPNx W9CqGD+SzO/QjqFNB9ikoXX7eRqq27N+28yDbdo3Yaip3tdajbLevL65rM9eL879vrv3uMOn Zr3K+tnUYg7BIQjGiH6uNjQBxg5/ts7P9yQ3+8+KxK/Hcp8WMPLdMW3Qe1jdA+thFKS9lOrC VGnpVTcs6kWqWFcdzTxrvl96f+X8yULUij8v+vTdBF7VLuJmYS3qWZkX6fr13bq9Pjz9n/c/ jC3bLJCrLduy6tJkIPSCygFstV+b0LXobUsfqESxLzv12uOY9ircn/HjX/7L41NSS3ZIGK0e fawjshYs3TcuCkjsoo3XsD2PJqQWakstVB/h6+DN+9QOEzk5KhkiGzB2LBi7Pd+srqzO/5+9 L+GSqziy/rA9tmdssxgbzI5AgBASQhJiFwixG7N4BW8zpj2e//8TvrtERGa+elVdVV2tLvlU nkN3qemuei9fZmTciBs36nMOL/5dZkDbP5PkbsVlGhkSVeR534BmZObZVEUjAQV7C14/jNHY JZI9lBDe7377W/ZBzoF/QQn4d8Z/kf0j8gvop/4OLvajshETRk+O0E/lKtRJAWsMsRsFoNRi IrpRRTSpt8/plgiyyLMR9IPVP+LQvqN/oBfYgRh5IND82NmjU0MHp39jvbZdE3Y1JYF09BI1 EPRz0o+lfu6OKOA6CEYamZF98t8M+yDuhIw/49E3ofNSIlNK+Jvr3Wf9ytOYxBJZm8bojpJ+ 8H+HE4+fxSwjtz3vjM4vTTJsc5+ixT9lqOUHeyLTBeYz1+zosaenl/2yVN3Dkk3JnMI6N8qn 0kJ7l/bz8kcKteJ10vc0o8x8T1jMZXzPeFhg5s9VZm7oQK62KHu4TwH9mMgBI4YcvkxzVtZP ge5knchVP/Hi/x7GXNAj2KTCATpgea5nAsg7m2EdOXqKKWvpx9qvkEctelqTMB+57Mu30a7B nkmfhHImKESJNgZs6SmfhO39+jIUXDie4OpHvPX/1doofXbXayN47zq/Dvk1kWZzPR3EK1IE Q14c3f6m8aO9g7krPy4sQ3hwAyc8JsdMOFt11kBRM9zCcdNAwTFTcg/iMnrg2J2xnCjBhGh6 +TNSLpArx5yfgV+DffGqw37h7NTOBbE+Ne2mKuprPy5cZkC/U1jzx0zRkkWzh5e05Eq3/zFX x/cb4j7uHDyKQx/fj7qjHqVWOuuXHvU67/sv3dkPsEA6os/+aT+4GehnCt5ujOF2C6ObbpgN 7y/SPcUSBz5FF3QpvBTyizI/Eq2qH3kL/ssbsD9gP7C3rBOvQh5GuBbhWWDSm39m62MLxEdC PiLTA5RQFzGMHpbbxZSdFY2gRZaJ/cReHVgCKtyP1FfZiyRE4Vwg9usi70Hj6fmWx5XacSL7 BHTW4Aw+nxCnPvY7uJ+DacIibOoBJBKpQbRj/516gMvu5u1SXsJoKqWLr1KLdjj+BRZfs2zE +/sB8Qb060ufN4uDdQvs8HKvZ6Dtfm5+8ZQZnJJkOtPVTLMFw5LZ4tRMjy1vhIQTn/kfYTn3 fPv6q6+++rIbX31FFBj4z9k/6+VREiAyRvCfABrUBYruU8v6qa9fUiYzB8kQVLQXNEyRR7Lg lvS2JaDfEQbwXu8fKPrC84DZ93AQA9EG7KPvMzo/8BgTumbGi16O21ixpfsM9EssoaQc6JjO TOBDYXy09bkLP/6Q3QKiRXgykabQrwsy68jrEyu9dWsBJt523l8gvwB+hn1MzOLhEZ9nhhaz OTHRihY1c0/42Mxz5f0WGzk34wAVIOrfbPS6N1vinnIulzDkaTENpJvFLH7IlO+5CIROfD7n TMWFkue7H/uU4tONw1eMGPnq8sfoBrPgICSITMlE6HHrxY+lo3dvML0jUL3VC/L85a8NB9Dt 98qX2EctfRqsacgjaQlt1fekpD7iYQ26rPTpsR/7TnVFroh4sKztNJc9PLhy4dyTOdvzPG6F Fzd1oMCLyJ5u6gtTLv3fMeEn5JeusGxfxYa66BD8t4wNKegWOFlxMp4ETPupRzLTfmjwYArD zGo5ZnvwvuTKlSfXSTAVeb4Lc9Gyl2H/F0fzsGhmew8L/TjtYVFKeSaGccy15cbEd1xmQj/M /FprHnH+tQ1+90lrv9zDS1r72tf9Ra6OTc5BHfqM9B5hKMyro54WQcHr5Ud98y3iVTv7FeBg wW/oGdEohvgVqDr/qb5+7u2wHwujm9wwG4QsMqnITCblyzoPL6M8WMgvY+3s4E5VT6gnt+D/ GClinEiGFV6eHQrzvvKrnQuZD0XYwkHDmwj5gYDJh4L4k54KvYs0Jp/2MTb39+vsbPArfsBB JNuO85TAcwZezhF5IcZgcPmYdINdiMi7mzVBYb2xARTazIKGWavAlRgW4CeomOqJWINIOEtw FKCylbJ1wnKcjf37CrSYjr+CxvccEo+zoNcyyJxiEeAF/dhTDO53hLBTva0CurN33S2lw8u7 bwa0/adJP/Z1SIIlsmzZIjyQHzZ9bFRvevv/9IWwSQHlUPr15ZdffPGbYXzxBX5IAEj4Z2gB y8BfV9KMNTMMnSNfRM5ED/2o88LOeOdfuBhQNNRGhf3UVlQeG92RGLbP8t8QlHZgiZbFxT+w +zoEykXgizgPMitWp4Ej3nrDfHd/l2XT5YfeQ7h/0DhpKi9dbweQZ1WQRJUX1Y6BciD/NIwP 4k4dh5C7ULYnXBLrDziNpEfWHXmNRoLAViRWmKZKM2NvSDco6Keknx4ajbQOMUI+PIsc/EeY aNw55zFnMZ+8rXO60TbPpGWIko9myYGAKe3g+h4eg+DjK2x1ivmPjTdgGu3SCpgyytTUT/G6 qcUE37OnhwTf08medlDMh+i2uE6eLjyl6dyHxstZ7lN2RGteDgm9poYInCmJGo1HAP2wdS/v YPEL+mEORujnoEc717ny/+IDdrry4VTkks2lP7onvV8Sqz6wH0xdDMWjHfEQwAnKgvJ+0CCg 9VIyFGk/NXU+/Wz3jAuXwfvWnidDZo7dkydPB46mnHuZHle4XJghJ/STElCRIZoFDUxTFx3K 8JAYXHSfe6UX9cl67Vo6Uo9UsZ9twWqXwoeT1jyikoNLVcWdrEJonlwgP4G+9iUMvHy8BXbF TMJ+PQmatodhRLwzO6XJHa35721CPG1XZDR6Ottw20vqrm43L2m7NzgHMyjQoJ8IMN7Pmaxy eHc86hf+xfRVdnkxFdFpfywlJmp4ZjPpL/2RH2MY+jGftjtjePKnUGYjD5WUeWBXB8rSAflR 2tP9nFUd/Pu0G/YBaTpoFTGFJBExAZB2VVFk+BPmfSER4OB/H/8n/EvXAm/QGSKbIptqNyBA EdysnTX2A+tEoXEyIgP6EQCxvLI5RxO5bkI/80KE/cL9gvhvMT43yH/Zi/B2m37qm0NMkp9K asL//m+YJ/qeYKNnKCidip7xuV4GLq8hRY/SkbHbKb6ng668cxp8pBsAeOF0Kt+gEkcKVSAO JuHudeDmbvbx4V3OZAbidM3jlV2JxNFSSxIV+pFfSVUVV4jaXZDnLwjBPR+nvawhkBxR3+e/ xvgsB//x+eeAgsB/Cf/kQ8A04PfV2K/xJWegX7SYgTGi6Ix4SyAgfI73Y9VxZKrkkIRP0ofv BVuU42ba7zvyPeMU8O6jY2DoJ2TU/MP0fQSPaO7pJ9bAxwrm4l5BRJcCFcvcUPDjUj8k/fq2 fqhUbG3ilEbqjA/j0fJJpPNCtjkDMF00OqDfD2jw+cgyyAw70weZX38b0E+JFfE9CS3zZgfo R0PNgFrlaWWiZaDTSDtDi3umgaaFZniuLHQsgPCksz+MGmapvAdRMzJ3Sci32hmMc6t7wh2c yWJf/FDOZbptcC5ViY/ysZEhHxZzgH4jOZcWE/3cHwvP1jjoFPieKcMbyXnQh85sn7oZdga4 V0K/c3CDeQBFj8StF7+h3wpnj9UMfdAjtjmXfgY9yl5x6TNUpYCHHRSEpWxMaD2Whjzk6WD/ pE/iiIcCP9SfE1/9yUnEw9q2p7TstYY7uidcngrekytxiXV+b0ZjVswQlZGTvRFEeCE/QT/e HXMgYfs0STFLMUn65plyDI/5vwyzOU+IuXWnYISCQNIi4zMJ0ejqnoKwZi8t7sn2E25O786K 4bcOpiXBhJabFU2nT1VeVcN+zP1xEfzjfzLtt9MyXRnkEWftas1v6+Hv4SW157qjV7rHWYLB /DnIpYHhtF8QwNtyN/0bMI8H/XjU15mfL/LsB18p1Sfz7McxgM3PIo156HfWC6PNfdgNnynR 1UssccXZqe3ZIz+TPUPooYL/gn4EfmEyIpRMq4oUgJlfX7QhHlh6gBB/SPQXrgW9CpsiB6IE /pz4y4qSZmfhJlZkuWJsxn7/ob2Y57n667EXDGkC1ampeV8CXllwE8JtICrAkrdoLr2XFVVv NFQK/tBO2YVG8iQrDJE6Qa5xOJhko/7v//4PJiosU5b8WO1BjM/hCn7GK1BMaskx0nYDuXst 8Qjmnk1llAHBi4NfqAlelusc8w079WPa8ju8OuMZ4KIN3zeTCaB6F90ThX7VNDf7JEdqHttU foIxRAuDEfZ99umnn3zyycc58PrTTz/9jADQ8I/ug0NCRH7kSyKZjyLeBcInG/sh7fc4e1NJ JFMMVAmUQ+rl17/5DbCk3wtv5wGzjAEjDftdHhxti2IdDvRkvr1hPyMj1wM53CRAK3DUMgP5 GfyOj0V6U1cfyI88dPh+gq5PuaE7036u9ZuFflGJJyqSw9HY+RF2agGYkhf+wXLo58w+CKVj VjEiTDrxjuj7iPSWyK/lacXOLRNNC10GGpG+CM8tGGia6jTP6g1K5bxO0V2UwI790qX9znjZ 58fLZtNoF6PMBMXqx/NRFU7irFCCBDecemDme5rPFt3B6lnB2xdOz0864ff926fAOOtk/aLM /uWrxXxJ6Lfx4u+hH0O6fdCjUamj7qtf+YZ+iHPmYnXMww5Keiha8zImNB+DW9J4Dlzxvd0b IA6Zjdi1VCiejXhsmcA5buVMXDh15voFW5R07Xlazk8izZXyw80MvhYnCLE8274wD7J0A32/ TVVQONLOqiJKESUkRCV7L2tgjc9pq2DvkFV3p91J1zQj2VlCkyIvpddHR46VfjLsHeTLl/L4 53y8UZyXqZqWv147QIXrHLJ+O1zzu4J+e3BJq570Vv9P0z6BfsvPwYgD9VHeOL0cuzZqERWJ DkR/1C+8nj/7pVPAnMmkt0PL+u3TU+jMRhT63R/1werkTuRHtidyfi7zU8BooArYFNpkxBw2 jwI2QsSvzz9XGoDRf4T/nQBgBkD8LzhpvW+RgSi4YWy+QUtLVwUx6hk7y8hyJyRX3f1I+Azo NxU7mY89MizIkNC335TWAqJVop+poqHTWliGgmyomp1ixk2a6zj1Zlwy5/yA/DCM/eIKWkAZ VwC1hwj+r3EFfVc/no2L6U5Jm4b2X0A/TK5ornDbSqg88S4dmapwXII2t9q1hz/ajxnQ/lc1 RWmoPQT7hAbhUAayniawhFYNJSNL3567vkN+kjtRAg9hMMC+jz/+6EOMDzz48qOPPv6YABD4 L+Af00uyD8yaWbsXkbNe5oUt3TH6zn7BQXj31vtQqvsE74bMn6mkfLsYMMxZV5genHTsYFmU 9ztCJoxgqPMLlPWrzEALYTH6p3NA75kfoO+2bbxf4FZ19wLPkUk/uH7nnkal32OPPfooehIu Qr8MvwQr7Yi2B0ZO21DQ7zZFIxv0Q7sA1MqBOLYI/YYQkzl1VZwGd6i8IR94tHHuIMqchTTq GZwLem4Z6TDQdPAwj/aDyc3QJBoADf4isJDMMxWyyPlEoJ8gXtRdBeZgukh/cdrvVMueNt1V ttl0H5a1gGVtQMhiCfnpNFIjDpVlphhXk4oY26/uKL25l/u0K2vpHOZJ/HPq7Zxg8R8D/bqg B4BA4gA6/djwCnoU8qO9Us5ea18uiujpjZbeVn2/7IMoI9Nnn+SPxDhc9Rm6YtYfhPVIhzoc /cPgwuIpbrpAj/99LQ1zgUcXLkjywZRQWy6RN7CaIf7rWFgDfna0AvgFH8BzREOXXhydN7lv COHJ7trQJlLOiuiu26mK/dQ6XTH01HlpjOjldxiLvgvhlwRTE61rJKYG9tOwt+8090r7yc4O JKdJRtJmapWewuIFw4oMMf8drvmTQr9MQ+zBJS3O2wl/omk39FvnHOQa4FhKAlh61A/nPv/R n/3i+7DGgdpmUHkqvqfq28n3XA79TmAMt10YOefYXExVle/HGgJJvFDmwdruRn7RSaujCjCI HiMpEBkrklmlUYU5JeT7DN7gMEAEMwMs4J+CbLBHsLIsH+Q7S5IhwV+YbHQeLztL7yJibCwM KlYRPSRTPv+DJmPS7JG0k54TVeXgOhzAt8yCm9JaEOsquI/2vyKcm1NY3zWTHRslWwM71fge 2nnVg7ZLRt9TwC+hH6v9plfQe4COSYWS2uwp4mvAjeeOF7n4eevKmwvmxKOiZPTfQtiUPS0Y w1YzQSQaN9A1rQk4vLj7ZqA7XadJv8umezLo83l0CE/k54gMTlGEDZSPZ4Mb1uwBBwn2ffDB 7dvvv38rx/vv3759+4MPPvyQ+C/QH1wHDBkIIj+q5LlGTNGc6Ov38EMPPWTsl2m/K9csUv7e +7fxbn4zUklr6G2JWiKAT6/EuEWWJbDfkPabHgc9hTWYC3hD+D+TAkalNz8Byv3gfZR5vwVe 07VM+hH5AfgJ+z0hhc8u61d2QIFqmp4toJ8cooFdMMOpm0I/Jv0YSONDS7jOxCXvpDfStM+C 6GTUGv3RX7QXzNgcVgBDcxbFgf1H+AihubLOVfQu4rhpkK72AyMDHjyW3V7slW75uzSgVOKs IEg0EbIk4Soz3pGSyEhxZgueYsh3eQPd545us7vQ/dmny2VeuhNohz4nJpS4Mpy9+xZqZ1YF Pbzym72SwaKHEkFpuSRe9KKl16qfDXnAQZnxSWLVs9wvIh5cDQqdnuKy19LgtKS/YxcODf3o wl1SsKyxPUnbp1SX3azYxvgGR8AcDtkGGYeYIttoGoi0EOTxK4Zv/JcWQuwAVkWDM8dKKDe7 pubvoPMiKtzxDYqxcejNjJgqmxTjaEq+p3LIraxZzn37kuCPPzHjUx7Wn/5gZn35O/bYW3R9 s5w9LvQA/XZk6TZ4m5x2qL/20G/ZORirIvk9XPGwBwiClkyBSIqzR325F/liPPvd0YiEny4R VaV++wr9bE1lNnj6BUvcYurWdkfOz8iP/ZxlCUWASOBnk9G7S3QD7VDQWnxC4tdHGvD9OPDv ZICxXAfeBULL9NAM/kbsF96FjHaP/WBno7JmGmML7Gfo11bF06l2Et0deu4l3K+ODVAFN+zX pGK/VsSxHHhhIdoA9DrEU+G9rgZdWb+CfqJ80gMcS37qCh4fykiWeRV5DUVfQuIxycV94hGm 0nxPeYJoZ+hm0i4yumpefrvnVSzXDXbq4Vf3bwa0YIKsEvKe8NWQ9GPPXMnhsgM5icosqLDG IR2FjBEb+VHugDqdBH7I9d0G6Hvv3XffvZkDr99779YtAEDBPyf/lP5nYAh/lGkzFMuIMIVu 4BT4JPIj+CPlkzFsBaOE/d6+icTf7Q8/JJT8NN02vJnHQCtg/N6iBrp8YJbvJAGOk8COQbgF yxIDEfNGsDvf3t9l25jeRMrvPSC/N15jqY8r/Z6iQOmjjz7yCNN+0qihE5a1fsdAv08hPXd8 1q+DflPvOiQph6yfQp0j8pNrR8IqHkFvpctAZ4YWvl03iek0Gvo189ywH3qSyt3Ds0QChEov Y9oPR87eQD8FPpfxPcF1zngdLaaCnXD5mwxziQSK2uoSjyFAuCuEu4/7lM+2FA0aTW7irdcJ FITPEyz+gH7dykdkUyUVi4WEfdCDZzuJzoxUqUIvJRqwpYVnQEiHkxK0dK16pLS6VR9QySEP xDzS/tHpSZ8EPR646luRK2hfqGubpv12fgSMyG9w4SJ4D6kGsPbhwrEVaiG/Mb6eWNbAL9n7 GRUa6ftw3zoHTrSLQn+Af9KN+h1PBCmyN+gXOpos9kOSeLkjVVNkb+YHlOtzy81ULmh8T5Wg s0mX+Z5ZxB1e/vgtoF9V9ZDltLJ58tpWChc6Qr/0uk6+5rc1lXt4SfVcd/Ui7zGh3zHnYKyG Ogm7IGjKFES6anrUjwc//rVw9r+eZz/z/S0PJX3PH3fQ7+wXRkx+mA0uWxY7yPdjy3n4WV1l TbA9kyQuqoBOQYO/LlgEpic5Aq7foU8Hp47Mrw+QBOiHEgDKAJiy9eWXDLKVh+ZTNuPKzblo dhY6n4izl5S6YmzSQVFoGVZFw2Joq4iPJQV2pOMBiyHIj1XFsX4GDAtxYgDiXGIz9VRfKOE9 cs7geQb0K8bn/BW0csNjiv3yGmArqQSQiUd29ZuW+gXJnx9IacFSeUlZ0xAVHRyZXe3Zw/vs ywx4wUStE3eKl4wqVB1ZBd0zztce+SlkFuEY8bCp1QLmo3Dfe+/efOedt99+q423337nnXdu AgAa/nnrA7ORCwCnS+jppkJnUkmxwKeQ3y9/KewHBBWVKy+/Quz35tvv6M2cSaTXVkP8gkYr kFdi02KSE6VesN2L8skToY6DjOWDDGlLpsSAbT2vtRvwf2DbiHMB/N4G8nv1GpuNsishaAhA fo9wPIo6RaPWOwf9yrvuCJ/0e0D3xHbHfidKM1xvidrBSFeGVvY51HTSPk+xX5JIwYJU3g+y l2hMI4kqkdVT/cTU8cx/7MMO0PkXaaQwmO4RTlUSGO3oAEuqcyb9MIEMzoXB/PDWfPNVcnOX hee2uvG93KdRZi8279lAv2OcPe1x720ZLOWmRUa0i8KQB8PSZKR7KCxNWnrFpGvVq1i4YyMx acC9FNgP/f2ikUFEPAoV/8QprtPJdmMJm7dVrbnu/3m6cCDtD41ZjfyKtl8O1hjICx5478TR 0Im9LyeOLH78WxT+xuAP9IfqHZRZ03bCcoLJTzqcs36qW2mq4cfHk2N3CumnZMMyCSZGsmnW q6CLVn0ysBBUVN05PDvav3gEB+i3lV070R/ltC+DfnPnYDvqZckn9JeOpNid9IsvF8/+61dZ 6tEn/cz3/NGPfrTP0O8H4gr8lzvOu5+zxD0V94e2u+r8EDBiyUNSBXrWu1xA1I4wz//1119+ +ZvfwFdiLJ+ekYlf72Eg9s/oP+P/t0gBs9uWdpapP6QW0GwmP6JMk8DfYGd/TTs7xNga5ZMV JcZ+7lPYHFroti3IncBm2BWsYr8stVNECAUrrnub9NWbiVr7dF5e6of+UF9ZJNyFCEw6JPIr 6EeNT7hQYE655+hmxX6+BBFi0lY+4QxOKJvOlPplEIwfWLdszYLGf9ixI3OiDX/4493NQHe6 JjU6ZS6wU8CNvhV0T0q8yPtFwDui3vSB6fiQ7EmuJ4GfcNBNAKE333jj9ddfy/H662+88eab b731dsK/QGwMH9tK3HrvJvNm2RUP2ElJv19qMO+HBg/uUYXy42uv3nj9Db2ZoSQdkW4Er6D3 SroSZfoIzUn4l/s+KSA8nxigKaucWPcpDmghv/mugN/rYnsK+QG4Mmf5CARqKFEj0Crq1dKs H1wSHERZ63firF8deXKH5A11/m9DfpaoAfKWmYZVpnHmKAMtjG4/mD0UI3sa2I9pv++AJzFM I1UFHNp5sdyPgTmmcFva7z4rKCQo2lU+7CSboVv+nRT0M89fYBcRClKqEQcUBNkuACcFcyMM lY210X0LoDvA93QCJPrlMTl/dvuUVfYP85ToxTGmAdDjAt3rL36A6XjzDZw9r/xaobJXhDXy UMJFgY/iAWgj0yReAtEfvZI/mOoU4L+8EnEkRf79IzgzFrftIh6Ym1J7SG22bVM4K9a4ljCA R0f3TJU+ymJhdbAxa9K24H+wzE9rGWbQI8ieKnA2D1xOHNgARMZ24oq+T9vAIQeunytNFulb HKog1pnAxn5bQ7943MVhyrNJfM8xJf/fduP+WdgPr4T8G/5LG2jCNh4ZBLWytd/JsvaJQbLM 5thM9/prftsls4eXtGIVb/e/8h6PtQbtHDTtlzHQQH6oeC8OwPKjfjj3+Y8PCGzi7H9TZz8K /djUCXQlbXsxvZH02xD6nf7C8FSPZqNxBdTPGYcKNYGJ/ELbfUB+JH1h/lT6YKHwJHhHIJkJ AHqCQHw3kQRgGkCDL28iAYCgPVIAMB4ff/xp6rRPnYuyTgws0znqYmy0KSWpNSmrDuyXjQpB YjVV4II0prPYL3GYwkVHR5h1Aq/5FJh79a5KgXEyK4Bc6ZPn6EUEL708soVSv6XFftFl7/nz brVwHFUCl+DwEzdD1kI8m6V+jmGL57qs1G9RU7RXNd0Hb207I3H4q/kZ0IIJvqd0gZT0syxt Jv0smE5SDZxfOz7h9RBEEPmB2mONY5S8AcG99cYbr71249VXX71+/fq1a9fwFa9v3Hjttdff CPjXI7YPZCb4d8ybqSves+J7Mun3y19wIPMH7Pc4lOzPP3/hIrDf1euv6s0CStIRaQPuW6sr jPi9w0qWpyrst+gU6DgQ9V/chQxh0f2hNcNoH8NKRhg35jffegPG/zrq/HrkJ42ahH7oknhh RdZvM4NvS4NgeHkapheUiGIZmjjy/olQpyLeidCU8yNDV66dE5dhpWmebaBln8GpZUWlkiCe xIr+aSl8x9GwHzIgZMuTlBGdnBnrz7Rflj3RhZ+Jnc0v0dP8qe1l5LxVLqI0Eg3mpAuQGPKC fgx4sAFjdQBqMtBdeHCzWqFj73Ev9ymFLIPcxAh3MPgSndXiPEvoB+cfK18ne4tUmYpYS18u isLS4ZTQK0HMo3kllfgj+i/ox4AHDYZ8EmK/PuIRUCLbe1nUBOt+18uetgBnvk04pjwrduTC oa0DSft9Y1YiP6Uv223YmCuOlwXAJHpG8N4uLpw40vdtHGgeyOCwgdBcheCWdKEsiEXqnA+F 98ISsNWLqERdeGTlhMTubIoNyfccUvLRchOmzgE9Qr5+LFr5Ptj9wa133iLP6WS1urjSzbJ+ mxn8Y83DzC/s4SXNXOXJfrRwj8ecg1wKNgcRCVLkGm1IkgNACkDguuGo7059v/TZj8NfZ/+N /uxHeQN3vYneRH5I+1Vfvz2ICXjKZTdkNiQNFc2CQPdkP2cI/MH5Y9z/I7bLaTm/v8v+JfIj f95yca7sZaiHoaL0J+gZvfXWm8gC1HhTCQBQwG4GZ8tyDQobifX5bepPNfu0YGehw2JWUSck 99CDtCrgV0BEnHk/Qr8umbGq0cIRhqAfLXmd6yAtKXCNjk16nqs46liHBbvmOaaSiqt2sziV uqxfpf1OVOyX11Bhslpqo7rNtNSv82SosTgpbzyemnGyHXz46zObAS+Y3vf9FRonZdojkn4s EIHD35CfGX4MxFDaI7ptqlwPAO5N1LwBB127+sorr1zxwKurV4EBAQAHxJZmFI6FbOgNsSYg kkXCJCv9gPwexAD4e+jhLPe7cPGly0j8Xcd7IZWI3F9EktJ5E7HgFqPSEZNm0grRe1IKzHWC +2YvobyCTPqJzEf/h3A2EgNBXQhj3z7FrhCM25sB/K4k8kPgjylLSdQQ+z2OfCWgH1nXbm02 QjNYns08AZrt0dNYeeSBBIVh8yb/12xPVuJ0iVqa6bLSztDKPt+6bTkdgj+lQIL5wUMAkO87 j8j7wXZ2lM8+7afckCgw1OA6BR94my3EiUyb3RHkz0vcVnJg2Y9nyvf0XX6sNqh5RCDJozKm 6r+zQz/fF7pn+1Qh7vBzgtSIB3tHoF/hyrVXPtQ9FDjGk1N3YBQldy4KfRQM8tKDlk5E00Ie le5egv20HsaIB/t79Wm/XPa7jZ9qCWMNK+lH3lZoNciFuwSM5OA95dllxo9BfsqACPhNnTh7 cXDdOCZzFfGhkluWUIbAI+W7UAbNnj1U79oI+vW702FJnU0KpsOQqouNJZi+VSQ7O7aGuYNV xdA/nP3rjKCDN4sKvXhe8CCbpvm6O/ieqUHeXbhjJTheYfT28JJWXO12/2vhHldaAyeB+6Ne yM/UZKCWT4n7HOkYokHdkV8vFQaZO/vZ0++hX4gHoW4DSEKR8Zk7s/zx3XgC200b/mowG4RI ylXh6iTtboE/dfVSsU/m/GD8EPnqkZ/5so6TG/jZqBITi/kF3teNG0wDcOAV/i0KGP22dynX EELtAH+ILC+YWXgXZCYoxua8Xx9jsxy8A5C/+Llk0EX5/CGQn4v9eF/zTd3V5YCOIIt/HBtk IYflLiW2cINi87biUZ68DAhhHY4OWZagt1K/rqsfjNIy6DdXbjgp9tMxgsc3ffR5DQF4+1K/ sZ/uX//mh8iw5Xye89DQfTq5/47/zgXDzg52G8I4cferOjQVDnW8ytvPrajCmUJ+4HqKs6n8 19VXrrz88uXLl2pcfvnll68AAAqxAbK99VYP2BBNJoBi8OwyPAS6lLCgRH4PPvhzDIC/Dvu9 8CISf1fwXkaSYpLKcbND4rLCvq4QmT9aFmM/5y6BWbQDDf6YEnMdnN1DlsEh7m3OejqIDHmT tlAfhRektTLBiQsH8HtJjI+nA/mhRBFDCjWmqp4i9FvtadgXgg1l0s8GVFKcakarRK0JurLS MM820MTVfEpln4WgwzxH5sDYD5NXb85YwNdMgEjz4obicp3Hp/4OewT9EqeAJTGE64qpYZL+ LN/T5eBzfcEy/7VooLe1Ifu5T4euSqnWn1Na6GwAHyDg3/XiPOK5y3U5HLu9rnXrbCJguXXQ g5EqBHWwteGkUFgqlj53MdjpGlr05BKQlyCvZIwbOWFGb8ROCTJm3lLCflHkSto62wE/3ar9 oq0J5mZ3a4JraXThSPVxa67ozgMjLtJ+0LaKtZ92nKZcbhXD9w55KSWqbjsTJw6Gzn6cvtN/ o4EQ7+IW40PutYPp8qCCjiJLqckwzkiVhi6fD615Pu0KZE/4ntStcVSyg35YT5Nh9GcjiLUG KxgSvdY0F9EJZT0n6ct5zwH6bWvZTvJ3m027oN8QA3W1ipTJK9JBfbq5o74/9vV62dnPcA/j B2x3w9IzgpCpd7WEn8OFu7YxPJEpkd2IpF/jCjyGqP9z6EPOGoK3brLc4bOm7R5cgYR+IYqg MDJpXwJ+QM6YPxf8yDFiDgBZgBoigaXfBuMhO/vhRyANDOH5wcwS/BX2g7/JVjolqTW201Da T3Me0G9a7DeiIJA45Ahy1usMoveSTe6qqfuDDAgtbeqOdSjol4aqYyfA/HY9hyBGBcdzgvwq 6zcp9tuosx8f6MA5bSkc+PEq23IGh6ZS+L1aO7C2MG+Y1Y08tg6lfiexS3fD39oCOGKcgdUo pIdmHmQuWOkXS0bRAjo9cheCPgWFF7I92ccbRzx0WkR8vPLyZeCgixdffPECx4svvnjx4ksv Xbp0ucE/cz+ZshMtgJmzoE1U0o/Ij8CPo8N+zz73/IUXX8J7GUki+YcRnhu/kVzAsHQ6JQjf K3o/wX69JECkxJYmBnAUMIgl5kL3SfSEwGplgtPA74XnIDbMOj9xVX+J8VBXpXim0I/WLeme 9H+tvgdLDUNN2B13YitNA037HCla2Ge5wUTQzJ6qLVha5+8cNUvsp3I/rAjUYr9X1X7KfzBy lkIv8OGx9M58h9hky7nMwIfjxgt8T0NdBD2dF+5YEtCtl58PHVNnNlv+a3e3uL/7VHktU20S 8E4ioDsMdG8F/fqVb44Cs92sSs6lj7g0QtKipXvRMzJF9JfgjxFpkD6TLy7gBOiniLSxHzGl KJ9Icrmy7SLUnpj2E/cr14TW/S6XvRaG3I6S6UOfexI3JNQlFw41caHUlfXaM8hPBA7wtlY4 cfLi6MlhmMMfFH7FhzhZzJMizubhwBkDgpY9RbvTOUHY5WYgdmdjbsGjQr+KF0KCCeWLqT/W hfOOcuj5yDbhJ4H+8MohPsf3U0+BjM/Lel6PjTLqaz+uew7Qb5eret332mzasQh6umdEguS/ IAhaOgWzR3136vvl4tmPiDXPfhhEbnmSD52B2kfol2ZjyhUgO0mFflEfPIP86P0JiCWLAnzZ 5HYL+GH+WPBDx+gqmF9XkARgGgCDL16+ogyAUgD0AWFnEWSzi5aJv28p9jKwigbsxzaqltSq 3sEDv6KgXwLuEYm9735N4LGVLHCYhUyCff6Z6Dyld3ksEsI6/N4P3BsYzNlQSpwXliHfbB76 nayzHy9BQdEKYgPHT9pLVKmfoZ9cmSHN2TwZpTk7rHv2vtq6NuHwe+vNgBfMbGDVBapdWzNs xiy9rRhM9dkU8mOx3vWrrwj3AfS98Pzzzz/Hge/Pv0AIeDHgn5N/DhyDPsSgO1Nn+FMLZEbS j8jvgQfuv//+Bx4g+FO935NPnXvm/HMv6L0CSdIRYTVhDZUVCls2B45RpcZZtyaAGSBJ/8/4 /ZAYqBiWsntJXNAn4UPhA9G4wbJdungR93uerdyLqqoqRab9oPNy7tlTJXyuTqzQ8YF1U7gb Kf70f6FG/z6bUgRDt8y0DLQouiTV2j7TDf4IrDHJw5M5a+vM+hq7V8774Tgw5bOl/Vr+o1cD WdupWm8db/dbOgDDXloVqzpGt/avYmrM8T3jgKiSgOy+Y4O5W07r3u7TYjfJz1E6F5mtMTG3 enEecWVun/Vb/eZt5Uduro9UJTk9fBSw0mPRa9UrdCTw54g0092J/RrTmXEwRowscMRwNBUI WDShgDHTfrXsU99ou8U6/1dcGIz2WgUTvA0k/SjQ3rtwaOsAF47Gr9iejN8xmB4uFbkOwQKP Aj06cSpkCicu6fvy3uC+0X8zhb+LD7lGUm27LNxMd5oWxg2YQ/CpTciyBsm+1X53ZliSWYmJ BFPclejnYYvIQhAsV262wT8stWR3FOPzE/azYgcttzJG+KYiVEFOWMfrwWM4rTX/vS3zxHt4 SfNL+AQ/3fAeaQ26woehWiVCQY3+Ut7E3Ivx7Afbh2e/y1QeRqEfZK8Q5EzkR8Znlp3tMA62 7cLgfHtv+ehT0m/KFZDEC8579nNWV6/I+dFijMiPfFmXjthm9O6EiF8vvcQsQAwmABC1F2lL 3gUqdgj+SLBAZJl1OSB9rsB+YhV9ibP3w/cZWn4VfZSVqIqCvG7aMevJZCNbIDv73ewUT5DN GHReuqbu76fKCumkWeyXxJZJuArLkDYYMSr0yJhjmIa4ZraTmEK/SvudoNjP17Co/3AZSuWp bfPb38Nv44M0ZZdHYida0BU3jgGwkyy0E2zuw5+e6gy0RRu2qQuQvI5mUGPSzx6P/AUnP0ju i5wfYrspdHXp4oswhc+dP//ss894PPvs+fPngQCB/wj/CNmI/sD9ZsYOQ8kzps4uohsyTeij j5DuCeQH4KfxABN/0np58ulzz+LNjP5oRhRIkuPmL/JJaFdILBWngFElGpa0K0KxcAkC+80c B5EYUNeGlhO7yvrFNuABEfUxwXnhwvMy/k/x0n+VNYoqUnRPQvTKOcusH/1rOtihSeHAGZDf TTaluIGuFAawl2ymlaHNp4SSSgbnAP5ono2g6zRo2C+yis2atLTfIPTCA3FPGJ9c/c1lu+8B 5EsiVDbhe+IoSn1Py/m7IqBYEpKtJwqy1GWmvyYnxAl28v7u0yj1I7spijj7OWXh2Q69HQQM uge2xpvL1TvCyg941uwVOAp2UjJ4o7g0nRLbprbqIXWAQjn4QIH9/sZaCYMKAAwGVPTmsoVy SSg8fu0V9nWf0zeC13WChTD50+bCiRUpjZeHoVSkip2XxdlHVykSI+HCwaVyeiyQ64D8SqiZ LE04cc6IMiCXE0TyPtw4Dr5kEL8o/BG/h41g7o8NMj6mXoY4tZbvuqI+97COTo03VaCl06E1 T+80aVTStJUHN5VgMompPROjWt4fBp7RURuEhHxgqkoeGJ+5iQHVBzW/dR4XrvUA/SZr8w78 c8NpJ/JDaUeYA8ZAKxL0QeMABJFncta3U9+vlp39Qn6ie0JxJPJPLW+9S2N4Ao9cZoNoJfqm RIEwpKFI93wlJKOTJd6QGA1HMMQV7lJbG1dOI8ojkXY4geFO2DEi7+uFNsQBAwWMfpt8QISW Bf76yPKEVUQri4cWdlZg5QvwzKKiBApNL6jJkAyLlKZ/5Hmnuo4Y8FXsd4VFTOnUMhD2Nwpu yjyIE+XAdem3ISAk1ZMM6vqMW4xaYxmO27+HmrS/YCe0JvILpX6p8dkioF/j/uhcDIwihaQa 53RilvIaMshAR/4ZihakvkS1l+ihHyOW8AUnWU5C3YkRvAOb+fARd3QGcsFkvIIRY+x/r5gI FnjVuprCFS6twAWmU8J2FPB+E7V6V4XeLgD3AfWdexrjqaee4renz5175hkAwIRsfcJOITSA KubOXnzhOcl7Cj49SOR333333Xvffcj8ifSJHg+PP/nU08j86a2AJMUkpS/iYWKB/DfUAsqw vMOoErAf/B9Whij03af9WiSQdXA8DhD6hgoE/R8LeJX/Q+JCfhK/EymB1Yr8Ju/46aeC7FlM VWA/5yrZJrVtw53LvByb+zhqyKzhdSI/pPwI/JSpBWS3nVaG1ila22eCP8+i5SJc920nOD0r ecGjeF7mP1C8SZ+PsmdJfTvBwbWzHeLV33WMzpO5dYxubGeWuHd8T5JOWsIgSrEfnNzgxDxv f+F7uk9ZkIuqgMb3ZK4T47Tc4O2gn5nO2tuUpKIQJ9npkOWVk8LojeLSpKXTmmTM47XXuerf Ax1J6W4FpLu8mdY9nZKkfNJwTNN+U6iz6Ddsvyjwl1wXzYVLjRere44uHIArXTid+8ZD8Kbo TjGIZ7mLkL/pnDjZPbL3OUHB3odtoHnQXJnCHxwOhdnevQX6FvSVOW5T311VADeuMzjPCFAT vlkSQW/TkbtTZ1P1KA4JJvZJFt9TOYmRHkb/lLkJDf0DT+kohp3IqZmKNjRQ8xsC3mun7nGt p7XmtzWUe3hJ7dnu6NWG9yjkVwdh9uN0tQp1Cjr6CwLKk6O+P/b1esnZj5wfkV8k/f4DQ2Vn WVCw+qTGIm0AgNZEeiPzhc/bLgyZDYIVrdiER5QFCa4ARYFV6JfKUB3/ckR+7OUnnXCqOYlA 1Bf8mPj1HHIA3XiOGQCG7S9eCsEG9umKyLL4Fb0mQxdjo7FKiqIj141fodiyU3N92o/3NhT7 dThINcI0h4gNYdYVEIiC82XAq+91MCxgLENt/4pRVbSziWtah3i21O//Kut3gmI/XEOfeEyV l669RF+3BdPYApZdbeN8I8MteQfDHB3+sWczkIu22gRk2iNFXpDy9yZRbpzIr4+/MIj+ObUN 0GITyA9aJ5dfepHAj7DvqSeffOKJJx5//HF8feLJJwHYgNgA/xL9MfCDsHEG0eSAXTDyk0sJ uucDAH73egj8QezFffII/vRWZpKymjAHmQXilaIWEJlFgj8YlsR+QV8Y0n4RCXQic0JhdfEi c2L2f+gB1aAP9IJgH3DfOQK/SPmJqPqAaaq4ZBhVEpXODPodIa2pE098TNapoQkZn5rwOhpq XKHzK4ZuGGoZaKdo8Yw4jYzNhRfcmLOaRptOfYKIeyIRCBllz6wXBwWFbAJwz86A0Zab6p5a /UHUmAt8MFsS7NaCfk7wMO5402VCCDtu6zSud+11pYxjSsOxMfklxnQ2+xQqvNIxR2FL0zHZ L+jXrXxEOElSUOt1Ir+RnU56Op0S8RLolWjVvwnWANPdcEq6wJHbwxhOyB4WlEAAVQGBBX0j Rox3nu3WCjboaG6O/A5W7ExdOCO/8qaIjxryW8OJE3uf9A2MYa5saSNP6qZd77+v3jdUfFBw iU3PKCBgaLVOBKjfnU2CKbWn0XITSQnlMjs0LpzH+6Jn44GX/CnOLawELgY/r+A6LQngbFyT fM8B+q1nyHb7WxtOe4N+zlkNHACu0y5fxWBQHfQzL+bPftb5TZGfoV/Y7QIFZ6rwiXnrIkbR 2IFcATopr1gUOFjiC8pQ3Fp2ldwhCmRPh8m901vBTyN+neNA8B8DLDBSwMQAg1ofomxQ67uh GBtLSszNopPWKkrkdIbfiQ9Wup5u54rewU63zvXUaFgMzXohWk9LbuiHEB6hX2upDjqpROqO lz3hdBJHI+PGuUzYNePvrYR+Jyn28yWIc9qM5aTU72tx4+GzValfUh/Y3hQV6sl6V4G6znQQ eRSsPGtXbbdm4/BumAHazli0g76nGieR76lCeqfGuUk4HH5xEJ3hF6ktvfMmSm5Zqoe0HYEf YdDjjz2a47HHHiMEfBIpwHOF/ojQwBvSUAKNqPFZ0T0hk2Lkd++9P/O49977lPhj7Rwyf3ir pw3/5IrQbauR/huj9+G/EfulvrkrXrzlyfjsk35ikjPalokBac9YtYZRbwK9NuACwRN6VglO AN3HH38UWZCep4oSRaLVM4d+RxiKJqbhbE8NmVo8NlUrIHFJhm4ZaDh4DM9dusxpVGzOXnAw Z8PlSsaEPgKBuaj2Y3KFYblQUOgI842zcMZbEIs/TXYBKlLlXrxUgY9OQVBZP8iauVhyDarY LmNluNT93KcPKeknNbukucakVjRph94OjiE/sbXfvAU9dMyp5+TH6jfAbDdjHmKnk56O1W9e OuCfGEkR8mDiL0gDTJ01nyTBBA3iwCBUtV80hYqOH6eT7Q54NPK2EBRQnKnonqo00YXr2BcO sh13HJ05P4HiFU5cT98Xib8cOEFlsbeyRPIdNm3WsNQfJ/pl8T2R+6/Y/HFZP+5OUdJaLJ0S TIstNzMwI4jXcN/fNYj/BvDXhS4ZwQlmVZPpdXEmF3Su53VCVNyffAoZmdnhmv/elnZkDy9p 5/Z+w3sk3TPSOzoIWwy04wCIArBw1LdDP15Nzv4n4Oz47B+R3w9+EFm/fYJ+NhuR9GM60gXC klAqrkAU+iVLnBEjjgH5scwPYsChGVCxtCj4CeLXU3CN2iAJDAgwCGCwswJ/qClhZBkVf2IV jdgPtgqPrTmeSfl072C0jYFtaRV5TvuR8tkJq1oaGFxWJjQXiv1oyPH2suJ8czV9oRGH+pNo 4KsZkFiFtFRV6ocIMkwwg28L/FJ5nQulfi3tt3Wxn6+hs0ATzmnq9Iv3QehH/F4Fz0TRc6V+ YQLXsYA739uHNzzVGRgW7TReMSkO5d7H/osdaGEDitq54FaV/BZpodQJLSFq3jAefvhhfvvV I488+ijwH+FfoD9X/jFJxyHaJMAHdVJY6FfI76cxfkbwZ6VPgT+gP8E/BpIYSqrBuDSTgawq JPhjUAl2haF7lbwo2gMniNEexgET+ikSuJAYuAYO6+WXBv8wP0kffI75TQBd3rE7ESZNNVmq SFQioHamWT+aNvEluNnp8PCpsSvqG8HRZZn6eaA+3QsztAmsqaZq8MfEX2RAGhFkkvZz5Ixp P2ZXnP+wgkKKHUZ+aC+K/drqnxS6Nr4nE5x1+MGLzMywTwfYy3mBiF3HytqVoo58j/Yp6J6p ZidPPviep+YGbw79tPIjGW2msxowoMm4AYkVGkRPJz8dTgm9kue96tE9NIxHYT9rHsSyL+wn yicAlJKKmfZ7eRDK/ul/NayzqxjqPVwXnmzhIzV2AGOf/YuR9Luhvg7pwgXPPa04IniyCGJ7 irjFBuwTJ852b2Dvg8DP0c+V40MRZ4PAstsjNuVmEMqvQL7rOfI9KZaHohVniW0F5k843Vs5 VLXmu5abVC1VAWMU4iq/hy9M+P0dMRqPvzNkU+DP55dNYehRuc7lhGJNeBAH6Df/IE/zpxtO ex318nqz8IF9AjoOAKseWL+hUFAe9QvfZ85+Vvjz7A+2J7c7erAJ+7nqbI3aZJkrOuVrdLr5 3pYxAQX8aTYyYgS3ChXZKhB+8VIE/SEKHKe8+zkn8sPW0SHoQkkhP0bJpfSAnCkKRzKKXMQv 8L4eR+hfg6/hAsoHhKGFl0Yn7ZWr10EZ6L2LTltGBgvzEvl6EZecrkWuqomIu6QEdbqq9sPk C/ol45NgjDFd1fBnsR8cwYHxmQE8xgezmAO9IwZGzxwYwioMIwx8fx/mciXQhNM5dvX7P4x/ /QspCEfnrZMXIam1i/3yGlqcLJnFzHO29hJSeSnoFznOSalfRb/aiXWam/jw3mcxA7lgUE7R aajlFiGnpqrSlBlX9CU8Bp+cKbMLDBHynM+cg9SJYdBDD7G/AQcb3AECAv8x+xfojwhNFKvi TYI2KZ2UQn4/+9lPf/oTDQDAn0XiDy3+8FYEkoR/xCn0RNqg+2ZeqewKM1Zvojl9s2aIE8t5 g8yuBsxKSqAkB6QlBsD0xGkAEZfyD9sn4ZPx+chvGumqBT2MP6SdNUxSRTP6DMRnyW3NqqJA MGvdrl+D4U+3aENPw9CPGTn3JcjGOK9eY+IjOLqk6NI4cxhYPwM1VbnB8oLTOlvyOSF0pP3G /EqUPcE0k/pGWXd5fSge3ptiP85immzreypaV4WutJfuGB21DoZ+STgh3/OdLqm5XZHQeru+ u9J926f2daRmp2azzMttujjXLm/ZEvo5F53BYukDQBsuSApUZzI9nbak4yUo5HFVXOcgjCMQ 0ImlIBKGjYuRAeN011Lf6NLFLhjd6eDcs1Po11w44KN0O8DbgrLbW6RFlgtXHRCIfwbkB5Mw ceLQp3TGiSvjYP9NkTdCZbIDYGrRbofsLUp+vgHdZgwrNwP5oQ5A3VopfZ/uWfJf57dAvztH ClMvwfTb5KMFi0m4z8DvrxrAf1PwF5i36VEtluxOzNTxz+uejQ3y2mt+Ww9/Dy9p/kmf4Kcb 3mNBv67wAfye9xkDhT3AMjUHwLEOhoJWjCVnP7Q9VedH8CHkZ4S1R+lgUL26iFHUIOLoo8YD 8mLMVKmQ1mXu9pUa8iuiADQRymgYOnsCLXYq3hfsBYlfj2BE+J8JgHDc4LPJdMBywHBcm0SW M6bDfc2UwxGG7GxRPkkrGnoHlxCnyiwx/RRWpV87R8HMOiamAGzHIzYut3YAXhQqeIQ9egYK ZLdqOZ10x+Zh19hLAp81g/wK+v3Pf085p9epj4XGyMc0mGjXsBAbdkFIupwl8KkotogP0dWv OWqy0XbU9iJG38314eWOZiAXTBFVxnhF8T0FlbxFYv+Z9ub00fvvUmVXkd3obRP5LzRkz4FG B25yB8z2aKA/pP3FsHoOg0G2Z+CCAXt0OT8Bv//y+MlPgP3uTbkXoT8nEgVUWE/oke4bQYub vyOmBC9oonQXJG9DvyElxmogxJNaYkDVi+Uf5ufwOz/6MVk3pDcBdH8hTVIAP5FUzVGFLum+ QL8iyvsOIbpu//eCulKQo5uWmgY6npLAH8zzFU4jTgV1CdOxUMxZ2c5Gpun7O4jxaeNl1gSC cnsSTNLiH0y2V3/wPXGfGfhgqGzgexLYkh9PCS4B2zLN/d0d7zGuu433eJ9WlJuezve/L+S3 f9CvjxUTmRVJoaenMy6toId5Ceoemk4JOZ9WOAqwIY/kyAM4KiP1KkKBR6L+DiEPJ7fhNE5S LosIXtC1ZNJPMl1q6Tdx4ULihW6UBnN+/2252kl5s/KhCghJsZ5OHCNCsnNy4+i+pQNn+If4 feRJwbKAulYKN6N4CkoxrAC/iCJuJf1UGyqCsAVh71myS7zkB4dqSctNBWa0PRGbUXjmb3/7 61//EuOvfyX6w48r8yfoV6KsC4zPMlObMD5xtRvG4g7Qb13jt+L3Np12hye5VyOAF5FrSPJW xoq4L0JB/VG/8HrZ2b+A/JRc2zvo1yJGTPpJ2N1pMTZzZ16sK6QV/MK2Ed1TNQ+KIE+Rn+t9 QujcsI+Q72F4RjVEAiMAdM2OG3WRViTvIshZyjdKSU5AhTbriAN21vwKRfH07GbSfjIuP/4R B8DYVF5nWuxX7R1GI45qFb51ha0naGiwWliFAf30YYulfj3OXAX91ir2m/WefAlLOKcq3KLH psIt6lMzQhYYuk9xpp7pKpy7Yjce/tddNANt0U6p6N0OocyFG6BwAyb0mzayQvYIySM1ZoD4 A9J2ID+gKR9SYOjKR8GTn4OsCfzHHueB/uQ2mK8J/sQ5+RjMF7acH1J+wH3/yYHvP3HiTyV/ fCPCPyQS7YnIHSmXxIlFZqxkVhhSutml/UhicMKN0I82xYkBpcTgDAyJAUjP4DQoB4joqA0H tGjdgPt4x8z4AbFyBEWVxX4Kqc2U/foiOK3lPJ5i1i/q1ADYI2CGQjyTdJVtRakiTDWMMwdm 1vYZ9Fz0UUQKBFrxxn7lBKdkYEC/mMgFCvnVKWuCbQAAEgb7ecd3zT3NXDa+Z9cx2hUBKI0O SXx7lc6b4tADnbU5+M9E7+6ByLbD29vjfdqaF7ek36m5wUKWG/rY2twIeqiMN9QB2GPcoSrW FoNoQLOj0DSsCWnpME3PPCvr0bBf1KE0pcz0SGw/+BHOqA9BgacyXtsHBXaz2HMF9wrtyduC xotcuE4LJVmqDfnZBZ5DfiraXnDi0jbIPBSF/8knn35a7ACzt6JjsxqtsvMplZtBAmtJv+qb t8oIxL3Frd3XtUlGOhMUJsXSk++ZkRniPnimAn5//vOfv/0WX4AAAf4YuTH2czvD9CDN0KVc 08kYn9igGy7LjQz+NutlDy9pm9tY+Teb3yPhg8I05gCkWAgl6tqaD6UCBzvaWT99NXf2M1gN CkTm/FCgzazfTELoDGVeMGt9xEhcAVanlcYLimMWuAJCfgwXLRoNicXBnkriz66SDKrC4SB+ sb9xDVHA4F503gUi9GR9IvH3Jgv+ys46tNxJapGrgLwYz2Cys/DwhrTfE4zaKDlHEoqg39DZ 71nVCbtnGTUspN8mP7AcW/suOt5Dwy1zbuxGClA5A7w4nXjMM6V+bI09sEvl7s1n/Yrxqbub A2S+N8qFLRpOX4OsJUOASf5YLG4k3S2hX1fqlwZQ/YhiFqvaeYeOzMrdfPifd3AGcsV0zUDg /HZSlNUMpCkhDbvPBV3vwJOCevdiSz40ZgAS4ldwH6Mxe6G/4GuCOPEUW0AotmyiqCnzYk4Q +P1Yg+ivgb+fP8ieecR/YJISAnYjrApi94hGk08gqxIsBgmWmsVAxNKgX0uJMaHTJQYkPRMp sWAu5IcRI+EKZN2E+wL4BUVVDFW0ot8P6NdOvNZ5GlEtA/anJE5KBCtLbYquMPoT6qNIDC3s N6RPXT9kxueIof9g4yXhqGtql9yjoxnjdQdXvT+qdy57FmV0jA5+PHTAuFiUN6BfGTo50kO+ hbDgdfZvazXmQetj9muXBnN/9ykWPA5EtLASvYnQrPyKUwh0bwn95K4k31PiAEx3k4SITjIm GlRw2jEPgj+EPOiUICCtyFErFh6z3UcY6U8Gfyb1jaZLY65Q5ATrnqtCiMOeZUv6JW+LLpx0 uljVgmAXPQ8G0PHF8XO4Gar9pVgDS3ZmnTgHhGTmwo3rKfwtfu/SHYTaXkbZ3yvo+I7xiqSR qfrsbq30KliOcyzru+5NhBTcGo1oK9cJfU91WkxoJ+AH5MeMH2Dft99g4FuCPyb+7L8ye9GW RNb13KCZyiYtmzI+cbkH6HeCpbzln24+7QoESYpMch7Ri4Ul74yBmgNg9svkqM8jv74vOfsR q+6RH7HfnkG/OPiUjGQL8kz6nVehDwuEKYkXXY2iNCY2DrJF4gn2RoNlfsGepz67ImlR70NX 4kH4RcOg45Y+IINs4aUZ+70xYL/sw1VKcpl3yCCbmt/xEHZwmZ1j2ECKp7Cw34/N+AAYIOff FBsilFcEx27X/bViP713H79ryie9Rt2iDaep0uZH1dQIu67PaMrMlvqduNgvr+E4zmlX6tcQ tEpXMItFLV0Oc7fcp4c/27sZkOns4hXo7ULGd1TDzm0QejkMvJgw4fQRQ6bEEMHpaVm7VOcE /ZG1b9I9QXs+9GZX7k8QjQwrDnxHlC2FUgihlPJL4Ef0Z/CH94o3wjvRjAABahAGajhl9Tj6 /9F7E2ZBkR1pDGMM/B//OBL2o+uGexo5rEoMOCWWujW4uMZdiA/l59u8scTPGT9mKjNJiRQl oR+mtUfUSbwutgGuQMgMvuPpZP1651SK5mQrdoD9iRAoS1MtZO0M7eNPIAUS83id89h7lFU1 WSA674O5xep5Xj5VNr4jh3yX4GjzrWVriQOwmUtUus8oCDJFbD4Zj708dZjagR6y/cXie/Yu 7RIm2+ZXaiHePq64L/uUOe5sYcWknxBvnoR7Av1wpHtJ2tdTWIfeAnTh1EmGhcnB1tZmDl6C nRKkuwP7vQ3WQAGpVixMAwIrkgak6Rv1jM+IRc/Ga7dZDv4bu3DhdKjCo4k1NI2XMDVaw1k1 0yM/xc+N/FY5cfDiYG3Lh7PlLQp/5kldGMyyP+A/jcsUTHwRzFEKN7PSj7JA8s0Wfah+Krrd OVK2mgRTOafK6mGHQtKzgN833/xJg+gP4G9M/PEIq+RBmamI4lTuoKLeaxgqXO4B+vXP7868 3nzavVNL6FqlHS5XQSRIyEXA7xFnrNKjmHyfO/sz6MtQ9Y+izu/7GjDc3RmT6htnl/Xj1gqs IhMdYRUl/VggTHoUuO3qaiQdlBYySeQ3Gg2zZR1DbkIPtBiwF+J9Ie7fhnpehQ9I3qe8C9lZ FfxZkK80ZqzKkAQLh6y6tF900oGkVjSQ+gUqEBhZ6qHffLHfV9lqD8jyCKOoX/LBfL63pu4m Qc7l3Dif3Py9H0GhrY6e8FV2kqDL+c///de//kVtl36kzgv90G+/UU6zR2THNZho12BrGQ5C 45kl51SuTPA9lwvKPAitIrkyh1K/O2PI7vynYMX0qeqKrKLWl0jJPXPZ1qzHKPKk0gOuuAtb 9p4/9xQaN4GvKd4jaY+WaEGZHgcBYMpeGv2Rr9loFLa3qJezR0myJzN+St07fQ/wx/cikHQa UURSQsA24L+V91aYBYF7Vrv2PIYq9tOup3foe1LxhxLg4LDypkK35le/EqmTHlAb8oVMaxXu E98jGaq4UoqSdtDv6m4MPp2+jT0NPLbeZIKt+EYCdj42ur/m6MpIi6JL+/zwr2CeIVBq7Hf1 +muSDewwdLbG6fKnnMkkZHTFfouVynd+xdcn2nHO0OdUQTA7RrOpHxMmDfqVjuOEJVb8+B/9 cPf2cq/3aTYv1m3DTd436EeGV678lJ1FiSb56aEnTG0++SnczmQTiJQOp8ShI+X9KBQlpjNd IifRiKS62NHf5VBmtptloC2NVCTHHa6NmOl0LCvpB7EG9uYqjRevYSzhEfmp0O+bjZw4svdj mMNv5gUSpazfBkmW3PAQbn6JnXsuvcRW8E6m8GhQ0k+u2TFdDtsqypab5czAhi7wPUHo5CDX Uxk/4L4//vGPf/gDvvwJqYMEf0X6jLQfixaK3NUxPmsvpxLNsVGcbQxyxsjWiPWV1drgxR5e 0gZXv96vbn6PCf208B25xkFIuqeQH/XFIwANkzCe9e3U96slZ7/JnlR4YSSMPXkGWLAf0A9X 1dHEVenXJf3Q0o/S1uYKyG4AeilXLjeJdEvJuFEl/KbqJEn2DOAMTyLsKVEf+F5SvOu+mAFG Q1vexbln+xhbx6+IYgtb2iOMCGEvuJ+Z9lOUDbDFaT9m/cbIEdWvOun6rPwh9uuj4xkPwjlR VADZ8JnwHRZhQL9jYBdMMA4M8T2XQL9ti/1oLntH3u0lKofTkrjifoDwSd6uaiA2ZZauty8P v7X3M5BemgU+R4Ywyyksn52lftgebYOQP6X00ftKfjDpx8huHe9O2iH5pTI9ZcEIAI3+ACyY +yNfs7E1q2AucgnYv9rAkOn1QNluZP4MI8kktScCR6SN8t4efQx0AmIWUj7tMHwcPa7Ef3K0 h0H7XqaBBKAQDc7EgDu1u3yR9Ys1/Ok2bxQjBdQ1XGWOkvxU0Sky64c40BlCv8Vc7Wuv4sAL wA5BX0tTh6nW1OIp0Tw/or6Ewn4kv4UAWBwOM1WTwZqI9g6uoklS5EiYP8MNcg/WvvFzqNtW 3IMZk+wY7T5uje8Z8gB5Mizje+Ktd5rS3Ot9qmNWmh1wdXAI5cXuS9aP7L6Afvb1yFIAv6vj p1ueKW0J0Z9CHmE+Ll5md/QZ3TsZEBGd4TekJ+9st8jAZNBM4rWLZRpb74F+Bad/g7x1ijXQ wZmYu4idZ9JPi1m9zYLtyfD96MRJs9hU9tGLs+lVAD+hstlbUu0j/LvwIga+oROq6n9gRGFj 0NmhJf2WF/y2e+MqcvHKHN9TlDBn/arI71sCvz/84Q+/x8A3gb9I/DXsp/wF6z+b79OgOhpQ bMj4xPVuHIvLBXOAfifZAhtOO6FfRXld+ACZZpoDkpbcWQpBUJ6Fkiqoo37hxbKzXym/Qn77 B/3CQHcRI558JHtZFdhJvy+QqFLMP5GfoZ8rHljS7P5QoIjDaLDMD37EswghQ6TPngTj90R9 cosY+M8hClhmAAT+ilZkbn3wK3olOapwKjMXUhMZyXO1X3RYairi0d8B6YIG/ToJt5msRkA/ c7+GsHWxIJtNGMN3Pu866hyZ6UuoczwwVkM/hinJqGtmqSUeTR5ZlXhMpX60l7C17HI4jACK owXkFyWb9uGjuw1Zs+mlsWCySA879WS23uqHP9ztDEy9NOwPpqovt0p6par/gsyOItxHhH48 NaPQthO7oCeF5m043n/xYKj+CboBBGmEUgtzdmJshtdAtmbQKaJijsDPZX4N+P0HBuFfgj/l /vBG4pEyBdgPFBUqpMR8FZ03BJSyW42Fq+TPp84Lbsn31JmTYBG4GZXsmXRrKOKiOFZ9WsSy cCEwbMhwEujibiNF+V9QFkY6qcnunT30k6/TRO3IkX+OVCwhP2Vbw1Zrau+Tos4vMZGZ9xOG DkoITgflxJRPcPoDMLpyLL3xmuq8rCZ77XaNL3m3sNiLPA3KW+twyHKHIemX4Ub3/TmJt7jk umZ/vLf7lKRsbtNW6beX0C8I6nSys/MCkn7WnCx+eoSn4ZXAfiDkgUrXWPYOHcWyj2ZytIkJ /QZ9ozGNdHqHabpwXsE/m036JW8radnhPjnpRYMXThyCXXbihPwmThyC9+HE0cp5wOKJeqH2 NQoQcbrM+3S/Zjbu4YB4MxUTQaMDr6C6QIIU53rfJSGSbncmqnW6pPE9M/REMieyfvhSKT8A v9//LgbQ3x+d+CNCrHq/KeNzRd3uOnEcXO+GGKTFCg7Qb9bmrfPDzae9YjTK96p9G/PzOAjJ 7+FJCHvgIOh41NeZny+Gs98x33RYDPyY88PYt6wft1bGPHNv0e1zS683KIkwFAgj4wbcVciv qoPRBDSMBpBfzB7JQzl78uLCK2LkPwa8JJgQWo/wLtj2ON2LSwotg1/R9aQJ2wXQpIELURBb pdtdmH6sq+7Tfl0hf+bB1LYs8prMxenNcY/1zk3GrQdE7BmYhqsAEeczcqj8JOZPFmBXpyiz FPqVzks413FWTckj7IiaUglFRqhrqHBrOfJ9jrOgn5J+KZYDMVNaP5RsLQQqR5C7zo48/M7d MQOLK2ZCR0iGsFPVsfVaEP1LKUVKHU3cJib9oILLzHi4hEXWJGhzzs5aLVWvlwV7UUtCjgD+ OsieP4JPicaoOQL8KfWHnFrwSGlIukEkeP/9dt6A/Z469yzK/dyuRuIA2aqtcVgF/RbLF682 4Ro6LezW6jBW92HhCQn1Fe4rkCqyAWqMRVYS+/uss35lMJ2rVeoD2NZeGRA7HxwRrOYW9lnm mRKlNs4vvvQygJGOh54TMvrAGRlIR/uNG1dTNXh53OpOb5iGUMQoW64guMD3LG2xJaqAp8P3 XO1ZnuU+bciPvg7mNY/COoYmRuUEha7ypjb2setAV6teZPRxnPKcQ8Mm89MRqwpHxV4J7Qfy 3RXyiGUv/YOkDTDbbZ+h9I1kQhAQT+GQdeK12697znP4HKFQG62E2bg4OQ7F2zLd0xY8vKeo bWYvGzhx775NsYbOiYvovXGfQB+MAm0DjQMGTZ/gn0JtTv2B95n9mtG4B5178OUZAD+IZJFR DuSnqCBkgWDYw68o/6WbiraIFviecWvRcpMaw4R+GiJ7KuUH4PfbrzV++7vf/T4Tf8J+ofMZ AUzYw6laL+KXjxTjc132Nh7Gxsuyt5MqHH61czOTHfGDH2xLINjDS+qe8G5ebnOPHf2b+p6S ab5Gfk8hPx/1tAgrx7KzX43cUeWH7cmxj9CvrqmPGGXSz4oIpHu2AmERBRTzr64Y7gw8GA3h 5nSU6MTRWiAajqHwPxw3DFkQZwAUWibBIrEf+RWiFTFIL08tBKoy83A0idOzIM4sjosX2IDv 0VHoheQrxd/ZvqL0FtDjXBUrprRGCK9PKG5iw7EGJ3t/DnalSj5L/eZr/QL6MScdAqZR7LcG Jstr6OQan5S4hNjx7Wb1QJPvqY9pTtq0PEEIczkvYzcb+PAuZzQDbcW4twM53yFHMvaB/Nvf TY48GneeeG+OlzKvA0+KST9Qeu4V8hNwIw6KwQQ89yKZkOk1wG9QWRmJ86oIlg/G9Bl+NYAf aPMezv0liuQbcdgTya/2SEbIgrRfekMULc5k1XBPZCkyzz5JDDglZqcFmJQuUH5SfPdFhHXr bjnIBozGA/opm3rWWT9XMzYiJsAt9FcQ6nR9piU7wlZzYvmUUKwojVIZZ02kKsFJH/+ChdKN DVzFfmm8khap3NixjVHv7B7g0m8WW8G6WQVB9a9gtoCBMpSDyirXGpFVRr/VrXqBrX/De75P nfPjKSHkt3AU7m7xbw39auU7WwtQBoZSNpoT8mPMw9bEqx7yTBXySNpAdEifzXaPWRzmFh2v PbV1r0XRhZtbhAmZMVT6SayBvC1t0Qxty4Ib94xOHLUuGvKbd+LsxaX/Rstr+Kfcn0t3nPp7 EqLNTz99DgPfoN3MhqEN+TEkz6Tfcr9i3J0ql26h9P5oYmAmoV8gP6X8APy++urLL7/66uuv Af6c+FP/v6J8mvFZ1KrQbLpEe5jtODbQbMIFH6Df+gZtV7+5zbQ36Jf0b6mdsfA3I0H0YBh/ nh71k5PfBkPnJZEN3Bs4OhPgh0NmvxZGF1VZFjFS0q8RepjzS454MQXYAIv9nCnwlzm/jjtE 3AdrmpCvZQA4UQ7dh3eRdhYxepaUiFuPMmWR1anG3linQ9ovDbrytpRbq5wV5Sntf+KJ0N3s U5tgtL0C/8W9YWTHo2CFb46QWIZjvl4j5xaLmLaKj7iDXYUxu7oRGCqV+h0L/aihmEzMD6vp QoqIzyYe/x+vIWXg7m1hbMs19ilOq7zImfEM3qE45a42/OF9djQDk1Xr7BQ431cGBVwcrwsZ siFioGTxxeB7Ounn050Ju4bairJJ9EevIThDcBxikFdEdGXkR0va3qDehzjSINJWpHkiBmEd ZLHvxrSfI1rvRq82RXsmmcxUeRGHIMoXyWHVceBwdZUv5gelKyR7FqY/k5S4SEWcBP0Aqa35 dLZZP5I1uk5W1kROwB4s3YjP2UDjId177/0PJPZ7FgoSzp+q9UED0SxflsTnP51BjQ9SUlhc gr5Wuqcs7Gghb/42XvoqeMijwc+oMcpCQXDge6qbZZW4CkFsqwe/wTXv+T61v6MwNxyLvFip 8tNr3+Hi3x76laJHnaaM8jPpp/IzbG15KhGUjpBHYD8v+8qktXUxZruHeG1yaBalbXEPRRba YA1MfzXmOUt2eniUYa6WmIetQ5zLvpN4Tda3FN1zMyfOpk5fY67kwhV7S70x2LYH2b8YT7jJ F4hg4k04Kog1E4Kw0xvjvxd2p4UownFLATIlJirpV8jv98z4Afd9wQH4B/DHxN83ShAW5RP1 Lr28uZ7X9p1acMH75eGHKjC0PE4h+b6bFTz34Df82TbTLg4AI3gtygvcIKWCEiJSEFSRoDrq F17I7+iwDf0SuyuV8dMe3bOFwa3lSxoS6uQkERRlpZ/2lvvBCPqlKC5QCWgvKvR7nw2w2CSH bE/6SYz7g/LVsbYSD3NuakQGQIp9FVp+hPyskmXgZTRJPuWq5tN+Tj5ISm4sKgnGZ0K/43iY 9F8K+g0Cm1gbC+EgBq3wbLVYOZ8ThZVOJb+HXXY4/+ms3788UuST//rf/2W9TC7PzROPrdyw ZAuydiW6GMKRB1Xlv0F2F8RNykN0MLxcXaqInReZrRvuzcOv7/MMeNlWwCKhn4IFOl/h5bg4 1E7OURa1WBw5bWfEXJ4VVYbVsFg4jOsysDuMlrVz2l8ZuqzXI3feWbU+5ce/t0Yyv/JfeBOB SOI/W5HOHeFLAkv7buBswaRA6YU+w7SCaxb6mf0DNiSFIIBXMjFgohIhaYNG+bG+Dls2235d ZUG/n+Mq9gH6ZTIuabrRyIUFmsnSZYO2SFxGhpYzmdiPtjnKJqF22ElImDLBrF9AP8WtquiJ H9RcYMgGN7b6We2OcJyzY3SSclnqPjLK5vmeppkgWjw5b06JJLHP+9QBGm7STPpFFPQ0fM4t od/iymc3xixNTpaCeAadAcGyF/YTZZyxI4kEl7Yta1Cq2C9DHozXduveTR+HLJLdhpOve66J 5sKhpJiUJldq09RlvNmq4gzdybs5koNj5hZIDpbhrS6mDt+v5cSl6aUh78GfVPvUr/kxAEAO NsZ2zx4jP3WBzKTfPApe3J1qjzO3O4vvOSC/r7784je/+c3nn3/+m998sYD9gvIZkyC1MhD/ 1MVLzPRntmB84mkcoN/JF/Wm77DNtMu3ZlrF9G936GGl2Cqlgjzrp99nzv4e+LVNujcAnJdU fE+ajcIJGTFalfQrpoAK/SSNKoUXRcjJ+CJ1nrF7+kn2JOivDYOeUvK/7F7gIuioIVnGID1L SiinDMrnKCfg0FUitDK1UmaYRmHpgeIK8B8Zn4y/hwnpMmFq8az2FTaO02K/oak7iD2zTd09 n26mzs+p6UyHs8EuHRdAfiR8zgxBP5JHQnVi88RjHbnUtFGbqspwiupmlRcAPyC/krboOnBN Ncl4Vs1b6E036uH392wGctkiVz3ujklvh5REYQurqIXtw2YJ/VTqN/Rt6mGbgRuQW+z8IH3D b+gHSRRpNpwyFPCDmwOLxUH0J/hn/GfEpTygzbCT/Mzy3xct9aqEuWcKRf49AuFS/Rpl+4eU WArXyJ7l55De0Yasmy4OXjAvUc18+o6p7PRyVlk/WrV0gJOHycJest6ikRWF94j8fui8Je6M U2mpGkIjgehK+6lsUozP1EeOrN9En7iZz5FItUOlw202VZ3JPBl8AMJaWhyxPHzJW9NcNr4n 3eWMeERlNCYQ4c7xWNixvdznfYp1YlUD7lD47BgBSXJmdxj32AL69SufQY9MxznEyaRf4wdp N9uARMhDyx4uyQsXG2XcZzlqUBg8Yp8mhTzGdU9e6elK23qaUzc+fQ7p9FV+Miv9nPQ70pB/ Y6E+Ij+QHKjW0Jw41T/OO3FJaKCps+GzB5foT/o45H1atvkRNu7BFzTBTuWMcAsjLCi/Yr7U j9Y+780JTe9O+FNvisrqgtHG90Qf9z9D2vOP0Hf5+msCv89/rRHgL/J+zuBTuCKUbuTKYkNL 1FnnWB/i70Pfc9fZLA+exgH6tem4U6+2mfaCflPyRnEA5pQK6tCPF17/8XU4+2WjyhaeojHc yitv5hlJP518Y8QoaOKZ9GPESANcSGXJhZkBSlBiB9AsqmxXNP1z2NKSecDkYGLsEg1fbT6a nVUDrAjSO7ascr+mTzyT9gvoMnsWR2s/OmuCfu55ivs0EdP1b0gq2n0JvS54ggn9igXuFMAY 3p0KX2IJTrZ+lPo1YqlhVzjRK6EfI4jFOXWIfh0BlryGcmbqyH0VIJr50/LU5MoI+qXp+7Rv UMxiSXjwIMy28Pxqy3entvrhc3Y6A7FkIAmb0A8pMmw+ByzU3UWSsBtAPwl5uB0kt30VO9Mx TORW6C/0Wkj/9CCrQtEawqpCfvzbHPkesiUyufGls8VmeCtbRdcNTkPEizMULsLnqFqauChS Yuj5LCEIRQKpSweLFsCoPqj/9DJtvD4OYj/Nax+PP1PoVyZlGk2KAk3y43/845x2wmvcqUmr ERxkUkE6YBSRECGjZ8uXC/yPka0OFzibJQ+N/c40oOSVT4pEFDy0AzBKGenge53Aca5AGU8+ 6mIsRBq5QjaoDdpsG+/1PtU29T4n7sOYnoW7S3lvB/3ayv/cIc4QZhVmj71tlgK3tFa9YsVY 9gx5oMpVBsTtjlXkGiujz3br0FYotafqhNtAKDXoZW/2/Gd+u01zruCHYOmwP3tFq6r0W0j6 4UJP6sTFXGELBdFCTAurKxP+Af954KW08u+HipQSAg35MVYwe3NcQjO7k1253upp+5n065Ef U36f//qzTzU++/XnSvwJ+wXlM6Af0n4t9C21CKXxnz+PEGY9MKnpHW+qsOgP0G/mSZ7yj7aZ dkA/lTmZ4JPFVFQqkDw5OAAGL2Nkt059v1h69qefQjuocXrGcEvohyvUUo2eRmwB584OQ8SI 7WwVMTL0c6QkSt2/pDwOC/3UFIPIz6gZNg6xHVXrJBcEfpH9oe5ruG5pZxmkR3THnloE2Yp5 2jWWL2WGTPsx+/B1UpiqK+djj9jWivEJ0wRLnhUdE0yGE77zbhP6hU0ITIkqQrK/zg9MAHLV a/LzuEszzPOiU1j5kKnLBqTV22FJ2g9Zv548Qj8DKkTQsBnaLmCGF7iYk2tI9l5r6J7Katmg mCeiCgqj1M9RyhfAg8npgxs+3OYpb+TD29/hGfCSMURxTjxlaeuA9eZweBvO/ZGyfuP2SME8 VqJaGy2d4BH5ySoKFTFrx51PrwF7k0NUer7AD0QUmAV+NqxhRgpujS/41gNikWVDxi0jIDAn albalA+6UMs0Jea94MQAU2K+rPET/S9fVZj+gn5DYG0voF8GykJ406pYTlql+gJvhTdVM+nG 9OTOEkTL/2IdNtBRVIMX840LxK1pSuqQdoWEmsqOCSJtL123g02CQ7kOwIp6DAdgKAhCDjnN ZcuUhK5tOIpTc9kdCzu4Ur3F3u9TrBcufPo6/6+mdm+yfg36ubdDHuf09Wb46QsG5HEwnSPt 5+BRiAS3iJgN49znoIaIPPhTgH6Y73DhvIJbz3PBo46Q3Sf9bL9TzthO3HvpxFX5o504BLtg EUQD6E2cDZ1/IkOu+D09LIA/uHFCf2iNyL49HGyNzb44qgGKt6QZ5ZJZgvxmdqdNj9zTFnX6 9i9R6ie6p3N+X31p4PfJxxiffPIpwR9In8B+KvdjIKel/VItomN8NqHACOboSmcvtO1vLPoD 9GvTcadebTPthH6ueVdXONWJBd+z5wB0y95LfdVXbwmaQA3aQQ7YwlzJp2AMl+ye1XPvC1qa UA8yT08T/47DHRWg8GCiLCJowsxZJClldxqNQM05eZyXnJT2HT/kZKadBcHC/gV1Pvu66mbC qMVS7cWOZMNCDKVkSlqfJRE5EKmnK4kh6JesCPJ6ionJom2ryDC5ecT3HXJu7gPkYj9phz6Y 8V07L4xa8Qk7SsX0yazCSvBKoxkQs37GfvXiXxr8Z0C/DTv7xTMd/XimcK6II8FgJe9UWqlj GHuxNsGCdZg9+rqn4MqsXp2H/3unZsBrZlwy3hydCBI1fhuz6YjEpoyW9jjJtTM2ntx3ruaI jY8Nws/yyI1P9MeCPe/Q/JoEcRqHznDoHdp78J1oVxYHbYqwnyifTV2T8h3scmyf3jeVgaQe +qV3GFq305RYXNbi505MnM1BamhVAv4MCZ/pmJreBLbGq1edkwgt8wlexx1qKp0XY2CAvqW6 PqbtrMZ3cKdoOk18E/SjDFBmPxRS2jfox+Wz9AAk6yUCZQt8T2nAsjrK9DDT4yd8TyzWnW7h /d+n2tncoynRcTr6Etpkm/nYcFu6lQ+fRSs/u42Q3XKfVz55q9zWXPXM2MNZs0tC3sBcyGOx 2C+pA2EXsULGiPEOQ6leEuMKHnqeh6FLUfHv6NpgyImj/Y5qp8GJo9ovhW8yfN8BP86MHnJ+ 4Q84V8EOENMC6I8NYYj+0BqRbXs4rN3cKTfTMeRc03ed2yj38KhYtTupLszEqwIz7OsQST+y PQP5ffzxRx99+OFHH3388aef9thPkZyEfqQnLFQuXNhmS+OSN1uWeBD9sjw0d9jKYG4z7YJ+ LWFkQl1X+EDAHzFQGwSt9NVfclPwO60gh26IS3mvFkZdEJleoDU4Q3T+AkPjFHlpcMtJv++c Des1gWHdTPd0O8Smh1DIT/u7995yUmqebDvkqJF42rBfavKp6qJsWGQgw4YJ+pUPmq1aAdE6 JyM0Po39XOwXsTEy98fSH7ovSG4e2Th2OeFWrdLi1gJFWBh80HjE3XzqUxZL/VIVzJ8CJ0mQ r/8i5AeVl4R+k1vzMRJqcnNkzP4aUObEzoKkx1vM9KalDZXC4SNtDCbugd6DtxyDgqE+Edtd brU5D3+0xzPgNVPQry1bxo1HlPQP7IyoaWFWRwqfkW2H8Qy9i0kY3RpunTXk53GU0yD0J/yX XHrCQYSS6VPQ2vr3ZUrri3+27KveuyNbkgdV+8A31ef5jzCWe4ezKbFln9yuFa/gFfXdwnfH eYuzZcMDRfEsPzVBP7b1UxupBXaTgvG+Fbp2izPJRhlRDlc8gpXQD5I5bljFosKqiTvLrB+W kp4QHfyx4GFglP1+aaDMlVwQhVCKAM5y8T3DXM55tNsbAl/uHu9TrRduUNyjL3Z/oB8jud3K F/RblOdRjFMARCC73+amDAgD9eZCrBHyiHht5hPoHMmpPC1p25rlxZKdcOH6wEzGuGDrFpw4 mgIZ8E7UaoUTZ9MQXzVXRn8u3YnUH3N/atuDzj2tZY+5YEn35GR7xUw3xnq7UyyqlvRTod/v fivk9+knHwP3fcDx4Ucff5LYDzKfoHzC/WlCL8NBFkKB1P8ZeU/l6E2vtP6NS94rD9/7cN8u qaZrVy+2mfaqeQdXUHmdzBe5ZFu8bKU8FJwYlvtx/6AF9MgbrG26J1k/XF3DoqVK8szzF1TK /M5CGYcR0ZD0U4kkQp+ie7JFTsjjKOfHVJupUfO+m2bH0+ggWzK0Iu9HqZcgWIDYHfkqdxik 0mCH/RhmG/TK6WT0lMWe8UmQGzJYYi2hYMXurUs6Uv84i/1c1qG+EVGwPbhJXT5smE/XxcDd lKxg+NBJK6Xd+Ycqw3vUN3lNic8KCTX3Wqh21ErIrqhcaPlMGa3UNYj6T2kJEt3Cj1egrIN+ GfNClTMOgKC1PtW1NM2k325dmdwYh+9nOwNeMxu6lC1cibX5mWok4NvDC3ZHpGRaD9bT9rDb 94n+SP1k4r+NwH1Lgd/iW00NMmxKRO1jLzYWax8CSbrWkaHf1DucT4mlQZt+Zoa14urwv3kR bS/uD/TLXFwBMhe2kEKuTG14ZFwaPYBNxkTqSCyWTWZoYCHrV580gX7fd9zsDLYAnlIcgF3B AzM74wHonkI2l38vvieDnikFf5G94TYuDNr4ju+Kfaqlz1vD1Z6Wz2lsxu1dp9xxO6sPekSv 9QxFTJ5cC3osDXlE0n4QCPC656E9VBEhYiwdoJS2VXBgZwUUS1dwr1Cbqm6d0yTnRkhYRauW N5l34iT5JGKmZr2lM5qNk4mwC8cAfmT+SPxUr/f7clC7eWjZw8Ae/xhvtbgZlt6bd+d7li1g GLvje0LjBarzvwWD6fNfA/l9+MHt2+9j3L5N8PfpZ+B8oscDKZ8Ai3OMz+gP1gsFVjgniE8z l1oXf4prnrNUn7PBiz28pA2ufr1f3eYeC/pNcvOm9D1AtbPwXbhC1xmxIfLbcOl50Kxtr043 HYwJg3EeXJOsgCsF9IGgSLBlo5EkcSf9JAyFPFvfzVkky5bSx9TFlHQzEj/RtDq0zPirgmzs A+SakqpXrrSfIzb/4NXA0iqARcbnn6qqpEMv6upObYae8RlaUWYtEZV1yTB7gnjvZh0l5mZU BJMwYe1XFZxuZnT1UjPAsKtR03UDvP6ZrF/DfyqoIhtAhXgs9mPicSj2k36+FigsqCwDriKv oeLYVbwSftooWzB8QgmS9bi5fMHtbE/3wA8v93IGvGa2g36IjLhQWgmkqy9LLJKy2KyeCSMQ tJ5mA7RXsFA5EDGGEfIQAPQX/4D/07/mP+kPv/jJsm98a2E/i/oqlRnEZxMahupe2BHm+SMx sAQXORIollKZs2UfjweN/5V7McMwxzmomxl8fsBm3vX8LfYMiTzxZFB8c20mu2oiRLQm0aSQ +Dwe+tHV7rJ+Zwn9+Hz6A7DUkKmLP0Ybkx3fF0a7AfTY8aenx/fLdQc73+vpLtinuteNF+f6 i182YRcrXz2MJG3bfD2+ubZuvzgy7ReMzxZF/b06pRNViQ0R0K914zVZaFwinWzaCVeFV8R0 BYPkw0oW05l+PbhwRx6yA7NOHBubPRX09rTfycv0xMgoxBO2gShLDqOtyh2CP+p9Urb5Zxhs 2MOWPQR+kn+Az5JsML/pzDzo3viQK3K2ZHc2vudfkAH4E+meX34B5IeUH4DfrVvvvXfr1q3b t4n9fv35Fyh3YRpfaoEd43OxQ21HGxuN4sy15o9wzZsty/XXfDh4+Ulrf9/DS1r72tf9xW3u sUG/rO0o377EDX/kpEpCl1jtx36buextrvAUmcC4nPSOOr6nC/hl21jAX+RAV8DRP1InFJHE W9KPVC/F+5UiL6evGY1mMMaJ8Txi/+sQVpi+r85hydHL1159w95a8iUrUu+66pYbC9U6x9m6 9gQF/ahSTvpGI7XBRJLa6hI469mI8Qno172vk8Ir6Za8E94F1dw5n66K4VkxZZWyWtHci8R+ 5NBhNNwnmRdMNiKI6xf7wdPgNcCbKfcghXvMzrp12/cpeYvI+rm1A1s8j+WupcbQ+zLjszv8 699jBmLdDgqfy2r9FLBInZfRDXbZk3yHEMnq+fKB4bzf4yu3PQcRXuG/gIHK98nH42/4D1ZP 9/DWvqdhI1SLzYR+alZYe5GmbQL9Wnmay14HVaXx4+YuzdewSW5iM08AV2ADvnYscf4WB+g3 FV/hh8g206wFkcAIVl3Pk0jAvo+ayuOh3yTrt61PMzfjG/0s78zGEqnhLHgYFGycVuhEXlTk XoXRbPwY0cCpx7DzSJmfxGDb1YjilesriNk6Qzodr9vvnuI+9Z7wU9h4ca6/+HcC/ZbJDuHN fRs0THmUkjiQkVyv+4VwcUI/pLsZibYGbGqzYYuNTJ3d1M7H3qwVzGukdLlLdlIDMzSYUIjL cDlH8D0p14CVrFRX8PV7J67ry2rrrXmZ7rGaLNlxoj/AOlZuL7btIe5TEH5Afpzu6Zvi3/fY 7tS95e6Meyt9KbI3/8pKPwi9O+n39Vdf/MbI7/1b772r8d6t929/YOwHqZdkPTXGJ2hjre5r pjU0rrpCfjPXmj/CNR+gX07Gnfu+zbRPoB9r3m3IR5JvWQMv89mva9zoNld4Z6DfWJpWRRzF aBBUkd2g85BlsawOC6YXwv2IklDEKjvkqESS8f7y3JbNEKeTv+TEHx1QexiSGxVfsiJYoakl wiTtGH1Q2bFkfDb4cnlg4XSMz6HYrwlfZnQMiEhs0oR+MOKlHRpa76MRT7ql7qLOigm8nIOu 4UUb9eXXQn/lXgcPfarFzgbMC8V+cQ1E0F2yY9CzSTm+0ZlhqV9GP65dqcoEBufDF9QeWPYI Dz+/m2eA2w8hi2XQryJAg8xLC0tEh7Nb77z1Ghif0QBddoCNQXBoJutbpmAMoXHfewj+jV/y f+WfbDTHvin1qW91zIrDvLYR9JvDResmqjSvdyX063Z72ZTF6Lt57G19OKJFU0arPMHRInwq lD5m/c4Q+mGByVPrjaUyw1AQ7KisSCv8rfieoWwdNCHWt2qFTFiDdJVnHdqN1vDkl/d9n2Kl cMRV42pPyw2WIdnszTcLekQQ1ctjWPfDWWptOIgP9Fk/LXyUUBQJ6RS7mqSRy+OekV705QnG sjiRFjLuos1HR9ibFVNWif/UiYNrgZNfbV7CdtMU9w93XJn6P7LWCuGJui/drtRsZtueEG8G JhTwYx13A5Tj+/FfeM/Z3Vn39lFr9WzoJ5EXJP1I9wTbEzk/AL+b72jcfPe9W8Z+pHxW9W6m /ZJbVUKBPePzwVQAOp7xeYprflt7soeXtPiwT/iTbe4xoZ+VriX6tKwFS1q0E1zlNld4etAP V0O01SXUoyxMUa3KhDFDhHMvk34ZL6oSOEQRU9+hWmKk0Vi9uWsm03IQ+3UdkEOZ4cIlMouS lWm2ovGZAsxHhn6Os/Vbt2dmSq1H4oHZ3iFDeFPWEjngBf2Ucxvid6FUoIN+QrdstiqD8EVQ aC4SEg0S1/RnOEIu/HqkIQAo9BfukzOsLSClmvGFEGKHPtNe5jX0z7SP0POZhsqLnJniuFX0 Y6bUr57Y4cW/0wzIEvzgPwbot7SvX6xZ7bqm88LWI++yIfCVS6YMMU0W7gOxH0OmzOPJP9B+ b1/0s/Ylfyt/kr+46YzHTohclWPGhn5K80dLguYT0SEyWtmZ04aJ3cxBxTVsYPBpcTZ7/7rF QXdzBt12yIWfMn6MlaNSHnmh7+MS6NdSqNH6fJpf3PQBn/T3fV+zB2AVPMw09esb4aC0ICRg o0GAA2XH+4hbXXs8iLtkn268ONdf/KcJ/Wrlt3VPFTwzPtXWZJFB87e/d4TPhZjHkvRifdBW a0F/xAWhrTmg02jqpwBXL/IiF66C5dZHYHtKJ/3eeO2aBBKmThws9yqEFhcvIy2LbfpGQ3/R tYcNe1rLHjfHWfm+WuyL7qkbFg73tpD0A93zs0B+77zz9lsYb7/9jrHfJyr3a2m/6OqOZIbT fj1tLBmfv5Cj11VAL39gp7jmD9DvTkx76Hika8/MVcWyln/+8f9nvxaG9lZHaCjnqENDvQhe Jv2Ih8b0OEkv1HihJDDlHZgpQoI8jYbMwurZ4a/QinGrm9td5Pox7Tf2xSPH4uhIaiglzyC5 nu5ERgCLQlXmGUR7hyj2e1pGErhsQfYB1AgMhcZ4q4u4aD4rPLHDpeXeKawk+SJaSODqJ0Po T1+O7F5vUOznabS9rFI/NHilnI36LytSRjkbeLyT4pXqHLio+NdJ2ax+jIf/e1fOwD2JknoX h6Hj8ICT9x3cSC9OoQgl28N9kNrTdab9mtqTQ8fAfqvBHy9gdnBBe2w+sXlTKd6IngRmX5vh vQz6HRuv34CqhfvaDJqt7/3SE8DY8P23gX7BvDKToBMNXgf6jZM529dvBx7w5muDf8HZ8/TJ te8I+tMDkJoQaS3z6MvS6xQU6wNlGYnb7rqW/1Ve8ABF9nafbrw411/8dwT6tQXiAo7gA7Mg piWFKxL9j6r1W4B+Ld2965iHF8TY85x8TzKWpyU7Skz2PKkEOx1z6yROnM0RrXgH/qTarJC7 v0DAmUpeKd0sm88/nFnz7d5G+fm6t098LI18TzUcY9LvY+b8bgL4vfkGxptvvf3OzXdv3f6Q Ui/ocC8vjB22urQf2K+t6kUSQH0vRtdnksM2e7VxA6e45ld/8MwE7u8lLb/YLf/PHk775E72 6wq9txo3MMgCnWh3ciCjC90RRjh8LfIph+/aK4z1n0txnOCIR7hoydYe54a/RKtBpjijmkH5 fIyC7Ej7RYd5NOPqig+JRYX9gNEYwxpyY8HDsVJrB/0YH6sQHtkbQ7+7luIE8ssEpxofFBuS jDZExty0+qdVsU1PTDewSDHrTgo2dCd9iKRSHBY1+GkY/neAP/zDs00Jmxn02RrE9lIzugZM 4Vhu6EAlGzW2csmpM6MjgBncoTHGUOE8PrPDv/5NZuCehpL6GlUuGoVXEyUtEpsYlsD2+CqZ 35H2Y2Mol/sl9lPir8/8Gblw2w8DyzfG8ONtJrrdlIxJtjomm119a8x8Xsj6jWilmRHJ1jBR dYB+x2T9bJRNKRsoEzOT+cPjnKltnvx6f8NV35Cz+uCALacjIbtWRMHDHN9z2kaIWW7y70sT a6WLuN4VTn/r7tqnuNrTinvcGehXMY/MqY1MIRymWRCD8zyh3z8FYCMQPZES3XmRay6IMQ+c CrXRl5mR3r+kCxf+krgFnROH+s/XTNigRHvQPU3VZ+Lje7LW0+U4/bcstqy3aJ+UfAnR5r5l T9ezR7/Lv5q+E/6Nn1ZgZlU5EvU9/6pSP/A9KfIC+NaQH4Df66+/9trrrwP8vXMTnE9gP/iQ AuyKfnfQr00HFctaNl+zsWY2/xTXPJ/BzDwd+6M9vKRjr3nTX9j/e9yvK8TVyDanYVMHOJMF uqZ+3Fq0bAFUejhk0cl3wWdg0o+a7nn+icoTdX5Ltvb06fLXdBQT+yU8k7sWab8hxz81ZauZ mSqJY9rPusNst746hEfGJ0an84LmH5byhoEk9AOkLF8wg7yaz0nJ1EIzdWbcEvoF1PNHYYY5 jjSI/vACV9ByrK0WL9DntNhP9lnwucq2ejWb3osf4thwdodSv+HtfwZwG0JH25me6YM+/Hvv ZoA7r0sVV/pfNb9NAgnr1qFjr86WFOdp+9knUIdF4AC2QFK/hf3uh76uKm2Z+FsD/NEQjGPL +Rpv6hcH6GeDMqnAO56NhocRTliSyA39KL08Q5iABaPt8uqQO5XixA4qDYXSJIZ8b0ufZstl UX/m2xLfc0a+ZuhqOyT9iGb7woLFwui4qa08tbq8mRf5IOY4zKVHCrmd/dinuNp/E+jXWkiE AnrXKCmBFf0j2sU56OfWmdH/I6VEd9HQMhdEXWDbmQ7aVaTX4LSFysMKlIrB7pw4GAv6cU79 Cf4F/nO6zwm/4v4vxZTd7kx55AX5+YBwncgLk35QoADd84P3kfN76w3gvhsYQH9vvPX2zffe /+AjUD6d9ks3DJzP/6F8xRLGJ33atRmfp7jmtzWTe3hJM6btZD/a/3vcqyvExcA0dyffGNPK Ts4p3GZMEiRIgQXXR7KnX3RyznhRJorWDhfpudPdo81Q2i+15DK+DI1M1t1/qMpe8xXLC7Wb 4bKj4Uzui/3C+1TLmfGgT24EMopf/ba9NWGYgJfE0ejbqhY6q/pbNhHASEf999rVU0QU3SnK DjdK6RBu4kdoiHDuL/j3URu6glZQ1dDnVC+s0KceanCzprRWlvoldy91C1hZNPbFgO8+TByp u2fooJ3MJhz+ep0ZsClQutoJMsvEkdhkgfDs2e2aFrk4seuC8UlbwP2BaCkpny8+fz7zfg8+ YOynyMum4G+di1/6O7EVwk8+QD+aFUWz5OSkpdwA+lWMcLF+uC8M6KBf2E5rbw3tzR7EqijG xJnElHTc+LQJnnMGB0yObwfgECdLckl1srQ2QFIw1uOFLV2zq//H3bVPcbX/LtAPMkDRGxR9 ellt9urrXY9c5dRG6GcOEqwiA2IQD0QVXbZ+3CH003rgHJeNm5SYTAWYnI+vsIy5RG5ojUq/ SxfZxTyE+rZ34nhVdOQK/Rn/qWeP1Zv5v/Q73xPymwuRjLuzl0vv/DVanQnfs0v6vSvkd+PV V69fv/7qDWI/5P36tJ9kHbq0H0Xry9GbZXymm7V0m57imudcLf3cFf9jDy9pxdVu97/2/x73 6gpxMYR+lSAC3zPVzwd5Mxk2VjFzyHWo4rM0bKx0h2VrST+J+m2G/JTi5yXFaZysTF3TglYx Iza6pkxApDhCp1M5SV456wfsN7JJM3b9QZlJxUyVgisdrArz0lEam8U3go/snexwhqmyi9dQ 6ieVFxE+M7XIsJOG0F8P/gz9ar6P7+xHq+uzYNk1RLEkE48cau0wmDzi+DymBgbTdpZnu718 +Ks7OQM2Bb3eU6zc+ZqWiG6zxLa0fpX2A/kbGwRqATAHDfuh9leJvwB/iCOUtlsc/TjnT2Fx yb51btGh1i/s92bQD4/GB8WCg3n5aucB/171wxmP4yeBr5A4qWJWlSGbaBPfydUen8XbGrHJ r9BIdsL3dKgOxlLW8u9/gykmRaJFPUECSTUIiRq14+A0VnQt6Yl138t9igm+y6EfGZ+dOzIG c1MzTdFiET67rN8dhH69C5fBi4iUN0aqtJnhwjErmU4ckI7oGhLoaswt1CMGc9lBbYA0mIC1 UQd/lztLgxgPPuYw9LP4//rl2bfWm3Rz37pxjfLz4nu6swP5nmjnLgbKR7dvCfndePX6NQ2C P2A/lvsh7TfL+GRdTTl6PeOz43cdl8/PBZP8iILi4VJXDNWG8ugIDyNdVxqVD9kpdLeBgj28 pJ1b+1O8x+9vibgn93iKV7h5TAAX09u1trfQDHQkVwplJfSbSk62HihZ6Ve0aEZ2sIUnk7D8 n9ruuKaubJkin+fOoyJPHUr7tnQioZpjwf0jP6O1YciStcYuks4LOOcUeklYSR3kKG1ceOvv OPC2kXPzYU8OOMmtDo7JQlbomtasz6IWbW4o9XN9MS4+CoyF9oD7hMPwnf/GBx95BPSbGKWl eTnMNq7B0E+pzcVrSNszUJhEkO8Yrctyissf3eH/3NUzkKagTixza7oAK4tUJ9Ft7TpuDzHg VO1nyue1K+jxWdjvl7/4+QPrgL+dT2DcVEXED9CPhjJETKt2eEnWD3E7mW58wTzmQdG1dKfa hXhv8KWy5CkLimi8YDuz/jr6ILh85vwzzCukc3mGfALZSpw1i4gWOZ0ix3vZT+JkqYqoXlCF ZjfQgN92rd9V+xQT/G8B/RQdj3IzBwfGhpaMeUyhn6Irv2u04BZOZbskdcrdAeHTS7ipNfTl HW8WA5iGm96SkV9wsZNKVIqWxdxCVx4L9RXy28iJcwifVxZDUK//kv+Db8sxuxlid7bI3UOB okp+vgDchO9JT+3jD0H3fPvN12+8eu3a1Vc4rl579QbzfqB8stpPQi8947Orq3EL56VdW3D5 S64ZN3KKa37Vx85OYfxwDy9p1eVu9f9Oeo8fCXFfRc4jFD6V8wg+3/KnvcG1nvQKdxoTwMXI NC/QeBDLfQshrcqCtZ7HR8ZY6jFekU8pOzDyOXQ2cmp8c6OBjbUQ66Eun4VemptR6gwRx+LW rcKSD2/dVHoum0gFV5u1fmZ8Do2+BmgWDm4W+w1A9yNL2rjYT8XQZi1FKZwufcii9tAymsZL 5UW4y0wDJfycfwv014E/U06nNPShArmLnhNpL70GdkbMqi3dY/Nmhjj2kjdPT3CDxX741btn BtKlJLFJehePUV5JxCaaglJXGiQ+jSOw7ayvBEkDxlrffgPlfujwkNjvkYfR5OHn999/75j5 64v+5ADsxMAOM172zQTvFhE/yLzgiSXhc0F+UH5pRrf5aGxTupyweodBS6IznBY6HKHfQjQb UbMJlfwMpYN1Y3HUpHS/JWB91DS+J7XjO4pExslAb36rSh1GwWfyXXa/nrG476p9eorejo66 zXDl2kGP/tnpFnroFzpALHLNrJ/S3SOympTTaouRSUNa1GlAvwUXjsGL6OdOMcveWcoyXHGx ywj42GfX+ZRrcJ1HMrcGw3rcP8Ke03C0QfDX/oVX+Vuz77a4O9N8d+HIZXxPVPrxIBLyu/rK lZcxrhj7vfn2TaX9QuhFjE8F3xnjd+3CHOPTkSoG+Y9jfJ7imt/WpOzhJc0+8pP8cJt7bJFJ KnYx2QroR03XZst3eDxtc4ULB+iu0sG4mIB+4Rq1Ah/oAjeQVYoqR0dHLvWz1WD1G4jswFgW eVlI+nl7b/REY8cHfiK9PgsQM9BWgHQsZV8IZi8+SUjPEPp1jM/KxveEzOQtiY1pnRdCyrII 02K/ULSxWUvU2vnPL4YYggilwR8y9CP2I8+TtMu/g0sEVhE9jMr8fYdBymlBv0FqhmZ6QWqG tjWvATKmHUNlFGSo6hVRmJS1KTGyBf/sUOq30Rq+G39ZpmDWxZmV+EzGZ2bFzbNBRRcEtVHu R+yXeb8nHnvkVw9F4q+Bv6nii92AHc/c1L4dsn4w4IuGUhT2MXKX1ctwz2hRYFJUgG2RdZhk BQaW0iVwTuQHMSrQ3EufrX2IMM/WHT/5dd6OtxYEiWBPZl25CCYSQ/5ihu9pQdvSeybfU5a4 +fQJm9e5ig1/567ap5jhzdAZVuea3s6ZQb+gBAtaZXBgzPpx6c9Bv44WbFrUDrN+RWxYcOEs X2AXzhQpQD97NQ7YuQxXgXL6vXbihhbmG4bvtaJtz/lV9mPhS/v/SzaA/rBWjz2ZBTa25NLp ypjwab6nxKapOPYWzqFrBH6XOQD+rr0qyqfSftUjzJU3dLNQ+tLMFaFAanwObtYxm/sU1/wB +i1ZK/jxNtM+Qr/33un6WZvx3JdttwW76tXyC9zqCtc0hhsvDG4ucytbMy/2veraAPjkS7LA EYY8h66C44NbEnlxfXCi5T46smHsE/MqT6MPMYefYcZn5c4WOAw5T2OxX8/MRBzL0I+0toaL iM1mHNyAfn02kSXbNpIzeWGeRqMrEWIIXZiKNAMcFBFFJuwT0VO4z/ZrCv6IDnlnA/p8HeSM SrNm80nZJNpYGsxpGHC4BreXcCB7odQvke1cz/oVK/vwv+7qGcC2W24LRi50Vdgmc8gnJook kmjDMxfYj/V+z5576gk0eXj4TMCfDFxjDGXY+NDcIdhogwYFiS7qyarGPBHdpjmRVRPyk/TW AywMQHZMsss9MRKGTSfFP1plwAoeRuU+7EqdwebhSeM1n30fWySw8T1pr8ekH+NkY9TzPJtg kyUH4Rr0/sjEwDyR7WR3elftU12s5bqlkVLze/K6p7OBfl0k1cSopgy3MutHn6GvCI1lgpvY 0D2aLJ62hMuFS7UGcHy64EW6cCmMAJeibECKvLhmdWBuWaKdvu7kg9f5J/+shg2JvtbP+GLp G8WtNeu9Nt+THeqR9FMEksjv8qWXMC4V9lPar+8RFuyrmhMIhGJOwrEtN0sMwBS8W/7cTnHN b7ta9vCSlj72bf/HNve4AP0aKaUz5jifZGy6FdxeDmu5+8fMbWxzhQlpdl0EimsRSkBLmIHH zqq6qnQgWSDTa0cYGebvKt0RHBEDkjmoSeRzi3gR5q8uK2k4T6gT8xy76B//6Ir9srIEubFk ZlYZho/lDvpVZ79n2BE32zhlzzsy4wX9xvsNta7ZtBiZEaxobsYqXc3uwkfoJ4InM35AfehJ g+40jF8N4I9kBMejhgrkLPbrnbVco+M1dGFAnQXRqVEtbfj5gn5BYcpZY/OKmYziCkM9s9QP P7qbZiB3XYSPF0tEu2qu3HSEftofDExoCbGdEjS1HW8F9nvxheeepdDnYwR/YH2y5O8OZv4O 0O/TrOyNphx6YosHShBdogQvS7Wlv06aFkQaWE6kEmmKBjvpl6V+HR14AfoxDt/k4x1VmjEt Z2FZ+oOmK/2OlmhmvVRFUON7BrnZLVDN9xzCgHIOT43vydhxhPaWlHLv0z7FxVbeRusmVc/u IuhXzsiCZvcyhU/sMWb9sFBKMuQtxGoT+nUdoXYE/fpSv0xKLnHhGvSrqEwq9RVza6ppsoUT VycfNtmKUb+2+AJ/VTM/qS9uHZ6jMXtk/f5qAaavvyT5hEm/129cv3rl5UsvXdQA+GPe7/U3 32EtU/W8EEWdXtYkwv7hLdPZgqBejM8K7Cxes35yimv+AP2WzDl+vM20N+gXgCGzvIhVc5dG DDT96gb4VrzqV/t4tdtc4eJJ3UqGUcO2dclwba6JtMMo29bxxI8w6OqNVkN8T2yQXUU+fVk9 gqpg4bycHM3ZP31hY25s2kWKOi/M+tGJ+clCsR8O+0EPa7HYbxArYFP3rq0eI73ykmSHC7M+ XVnUypxQkYphZBcATCCz348Y+BH3xUjw14nACPpJKs9SM0hNt0Wq+ET0lRcvPyLZc2HAuoYW yAbsbJJ1qiTVW/NpPlLmLqUYlsfoxlV++NddNwNpDFq2ON20ngvdGQPvOmw7iXyWtBp4cOyn xLzftVdedsHfuafQ9OWRMwB/o5t8aO4gAz5y6hjtoXBVGXBn4yzQnLp87Mts5GeBeyT9ziHp x4gZG+7IbKIrTlYUKevX00NKSeLalTEWx4/ZAe1tq92mFT8QJKIVz4KgWBcmE/siGKy30QW7 i3rKpR/KJLe6rGP+6K7ap7jYuxz65XRX27wg8qD6BDUxJnxO5a/oJDUfCTDEJaHJCy7o53T3 ic7UpZcXag1KSnalfmW006cUThpqVvseJTtKX/fucLw+ZpXLlQ/ol95pqe9StKAlNJGZGPie 4p58pC5DpJ4Q+b14AePFi8R+V6+D8om0X5os6PP8DRU2Af341ERQJx1iy+19imv+AP2WL5tt pr2g31BH5axHMD7J4aAguXz75V8mWLAt+O6Ct7nC3KanlfXreOJPPnO+9FQGHJT93ImwXA3L WO7Y6G5CFWCWdJtoLuZtYdOH5MTKUFaPSWlvxczMUBuzkQLxyfh0daPlQ1+4SLTbqrbTwe2K /brgNQiu0vOeBK8ZG3DSb2UWFefEAP2c8QPs+/Ofv/322z//Ga8E/rLiz+Go9Yr9HJ4Q57Rd Q5WlD5nc4jBVqR9pEkVnHWtdD6V+3Q7+N325fNN1nL6eApBehNN+PDLZ51pkG2I/1vsZ+znx B9YnSv76zB+avP8nam8njf5sNXc0yQfotzLrNzLjEcsibcOixQyS/dC9l9GNi8BPOb9773/g wV+60o/CWymE2ULoSi4G9COByp5UVBFLG5mmZSaqtKMnvv7bxDHTisqd6D5/IdoINZWzspU4 iMmSi7LvY9MCJ3Lql93IXbVPT9HbEQdrM1ypYIRojll8ejwPM6d7PiLWxYpJEyoBzdEVMbKy NFxVjSVzcBsPqa2Ndnml1tC7cGqCPEWmUepnvmdnAnCB1KHZBXOrXeDWr3xn66jvJvRT0k9c bOK2aDKE4COA3wsvPP/CCwB/l15muZ/Sfmxv/LXPsyz2Y9ovZqWwAJK1kz5XcoZWpGtPcc1v 509vlxE7LdCx9YI45g+3mXYksRCyZjMQcTig2RWNelD5gLSHsmo8B92MKuOgs98LFRYITPhX 1z1FNZXQOjkFYuOF4d3FcC5TYDjSrYIwx35Uec8RxhDLrTRp8T13Evn0dU2zZ0nL7DNXC539 BsOeOi+9qoB1XhTBjmI/lw4vclyT8UkiQKU5HcKbVNq11qfJ98yeSxbI77KoUKSCuCaMFeAd JF0wSPUk8APu++abb4j+yPvE/y25F14AN+JQ7JcFeZLjysyv0af4nhWlRCSbAfrUyKkwYDZ0 D29mEcjznZ0BoBN4egym2hqHF2c5A92mC/Z3xAyujEHWVs5F7GeLwKy0Uscs9/sc6mrCfpBX A9/m8ktU+nz23NNP9uBPrR5+ugL87WYqDtBvFvpVtLNqWsjYl84Li/0YJMOj4ZkXQ8APVQFC fg8h/M5KP4q83FDqg8JbX/8uSv1IluCyED2kGa0IxYWCWmscdmamJaBfT5bDijf7Pw5jcCeV yyxbCWNJLPu7Y4uBVriGJ1zZd9U+xcVuhs6YL2NkOcpJVuiZ33HoV9gKa9/h8b5+YqylK5ch peEULUYVxUAU2sGhqgmu6MWcC1dqDV2FdjK3GiE1epTsjLl1wkVOtJKeMpowR23OvPquKFSU SWh8TxQdSGf6+lXk/F688MLzzz/33PPPB/a7foNpv04xYobxOZTyXrzQKFA/g4rFMYzPU1zz G3v48Rj28JJOvECmb7DNPRL6Tb1qdndAbDJioHDt8cAVnkYEdMnosaAgYMI/LGKOfAqThNaZ Qj9eS9iN+xDNpWI3+9kuwqDqPsmkX4RGMnK2YDU68mHd9vRBrfw3ZsuztKLuyFLiQ6htPDUk 1trKNjOYrTRDMD7jnpcq25jxGdBPPICMXs9X2mkJIELeZVHrmEg2aaq8KLNXNX4Aft988ycO oj+CP1f8BekTUjB0OvpiP4qqioU+FvtV5jGjlJZHZVUOvbTbFQZkQxsxTg390pt5zylNH1Id 5x8Z723tzspHffif+zID3nOLXkT0VEktu0yIR4Db2M8StCr3I/ZjUyX3043EHyr+zj8D1ucT j5n2+Yufo9UDm7yfNvgb7ciB8HnEARMe3nWLdl6nxIOOvIehxQq1EmE/s+OB+2BN/usnRn4Q ungUVOBnn2fSL6MCxEgtgk7oR2XidOLjY95hYVzPwsiQ2dmYlljwU0Es9jMJckmXyzQ5n7aS rkI7+pJ3X8kcEoTCpc8jf7c7PC4bAVvVLJS3v5f7FBd7d0O/YbbtLxQACdahe4PjOC1sJSdJ TmXmE3SqJtV57AW8nYuUa0oGrrlwfVe/ObWGZGoQmi5xekd/ggD7ZFeYV7rhd0681k46Mgg4 kfoV7Z2P43tG0o/V5heef+68xnPPX3jxpctXrrHaD3/fBHoWGZ9j27ILnZT68YTuU1zz2z6L PbykDZfD8b++zT3mLuiQPkrpWLqmjMqDD/AgBPYT+Msw6Px3o8IAgcR/Af+AZTB4+VzRp2UM N10YdS3LWnkhlju2hDk6slXr2+eF4OUShuB2x19eWW37AMhInxXBHuFY91ENnRcV+6VLMxTl tZgN/BlBP9KX4MpE5wjDs4BGY29iMz4T7CLYW4rebOo+lsNFVnhIVs6pbaHUz1k/RqqU8gPV k8DvjxwAf6J9IvFHaGbsZ+hXsVCX51zDJTiMWGcJqPnAfiHJMGRyX2o6NhEGjGJD8T0jyEp6 ewH5OVLWdk/z+G17+I2znwHvua7CNgXVIA3b5A5/x0JVBlyw69TfgSZB4SBS4Sj1AuxHrZfC fkz8seJvAfy5yTu2pGzrSPukudyFx3GAfotZv3BMzWBHdx7S0Uhj8JHHaKePPKdkAft+/J8B /O4D29PIDxXMqvRDAP3dLoCumrj/z957sEl1XUvDll/7XluyFUAISYiccwaRMwhllOzP6Upz r///X/iqaoW9T+ru02Gmsfo8jwVmmOH0CXuvWhWWNcyA/CSWyI6ZLIUWB2bx8ZAqlKk4y7jZ 494hPF++FXcwVOwyvv+19Z4UCMV145illoJ1Cikw7iy7f/u1ek9xsquqdlRbjfvh4wWf9UPS 0kIgF47ckaaKox8WSXhSQlTNFa9EbrmBPndVLHreIuje4tn/pHqGVc04Pqo1PlUJl6MdSpPc 6Gtv+NbDJ6ZDnNnPcp6/6Y+5JGlRqEm+5NuRZk7noCwrpMxzgHfTwvjQaJLX/Pixo0ePHDl6 9BiwHyWfoP3o0pRUofSr3O0XFWRKALkyKsapCj+mumqw2l7hMz/4b065wmt4SlPOePyX5/mM 2qEarTxNqaP8xWg/6F+8Ccp9sHsoOET/cUBIBCj8l+CPhYx2N3uiAQ/Cu7qDrF/3XEwbWI8B qHXiW9Hi1+DLVAjesjCVPpX4vBt6nlkTlMZ8vM6oeWtmsQLt9toYVhkyC9QaJmMS7WeLZbFt h9mvWiwT+lXTLBT6mzVMxYzpnsMXM9FmJ6tfgX6MdyHlB+D3gx0O/iIIBsMfUEQNTfZr53Da Y6c0PpNJ9LYBJc3SYEHL91Qju6SVezVTBrtmH3v8C7n5jtfmCsRLl/2WsNXX3E6sB9nhriSf if3g9yP2o+Hv1k0Rf1J9OvizwJc9Hvcp5q8J/tQvyxVzoeu3gX6D0K9+6TFwWvF+Zctju5Oo 3I63yPi9/c67u3bvEed36MgxtN+xTyhv4Sn651wzFR3FxIRfeBjpl3IauIjVVWoDpakTkhe6 /xO+mY97wSUgdHKpzC6ZZWWyrJf8nkHMlogVLUBsfUZjLsnlPuF0y5dep/cU5zoOnaEvEVzx lGSD7YB+WIT8IclFkdm2x8QMsx/WqUTYDtticyUgRDaLO6HgsauWOzv+d51nIcvJ6JHb9DpO 9ftZQo3/4/nx3TRTW15k6KOik9yZUTL+vBb+Dl15PTpF71li3uv0XTZmdDT1nmhnXbui0bJA fkcO4zhyxLAfaT8xork0Dig+M83duvyzDm9Z4TO/gX7DD9Y8l700J/M1ldlPtN9H0r8Y9kN7 evBIQEgISATo6K8F/soTvUbQr0+f2C9j3+KqFktzNIwaYZO7UTPUk42Gb9Wkr/AydaSoR1Bt cFeOXlsVOeE6BuszA8VnV7Yd8RnQj82kGGjRVrlivEP0gqyKUf+6I4/oUS4ReEnvWQYEt2x2 qJCY8hLQD7MciPxA+QH4ff/9d9999/33P/zwo4i/Cvtp9h/LjuZHc/EUIVox+6nlULUWPLQu rH5sdZk0q4J+JP0q7dcaibImPSSbry33CuCdszrNR71A/53aJuPa89kR7eeST6wJWBTw6kk5 bLwfsR8Nfw81VReOP7RfpbzBJgzZ5wjwt+BH3EC/rG9yuAML0zAvf0MFu80uNsUnlC7a8pyS /dNbOP70JwN+7+16vyC/U2fPX5LTT6QfC0xRH0pMMORXaSU0JQsmenXQgS9LVymoj+3XE9jj 3sNya6lsmoEM+ekJF2LWZSOWDb0no57pi65pzFV9pNfpPcW5vo7QD+4GlCD0m2kBSRX8Lk8C OqkkoAj4fPV9Rtu6EIJFUkKrQBAtl2sKgxdZ4uJZmKGEY7Puf//3/wj92gtAjCo2+tqsMYWV nLd/v8jnkjpOj05i7obeU3kPki/153tCYsC2zAUOF4LV4JCOw8B+J0+nTJ0dK1p5OxmfbXWV jTvsxt/wEek5VvjMb6Bfz/X2P5rnsldbFOV8Nsjx/BmQRUb77eE0Kg6j4j4YfdD+X4kMCQIN /hn6C/DHdYRH1Wpc8qSbsQ9GnAvWjXrQgaW8NMJUzOrHflGzYZQKwUYvt1o1hu/U5K9Up0Zu LgJo6GfoU9gH9GtFKkOL2jGXeHiBFJ9yD3ezbdIYzY+Nw6VLldOOwWCtlRz6DcJ9kX6NAcHF ZkctqZrjCnIB7BPwA/Ij5Ufc9+rVK4E/EX8y/FnWS4F+lS8bjXo/hUqJYKLTGn522oBa7rKT jUZ2BBeklrXkr+9+16uZjdVv8vP6n/DVeOdoIuqT2NAYH2JhVviAfpXks8J+379C6wVhLxR9 gvjjmAcbryTbBTbiXvCHldPs1BItF+ZvoUu7gX55z7rQ7yfMKChTF7ig+ZbHdqcGML79Zx5v k/B7971dEHvupc+PnN+pMzLN3EaLUKSfSa/YTmJOuq2Z3qyCkWKGpPSFbvMc31x24qAVcghr 6D196HOf3tOjrXMb6AvEn+OkZvqW1+k9xbm+ptCP2M+ekfwAwQxjXJOMld4eR9eDfLctiaxE vEiC/DBNoVYwKEep0aglxJzppg/8pXgWrIRL36eXcBFlQo2+Fuwa+s3USAa1utgJDpz31D+2 D0bM3SimDHNDZO5yTYvMK6Sf8j1d78mxK0wYw4Zz8OCBAwcPHgL2o+ST4VTlR5SOlWWpB13b UHx27UzD2QcrfObnvRtreEpTn4Cxf2Gez5gdmiQ+JH+B6x3p/ZR8xkb4Z6C/CQcbpEKEAf/E /amQwRuEIxcTCvLWhPVrp7yQWguXO5r84r8w+MT1XVvRMOquaogIKL3c0DLMvazZm18c+BZW whc/s9cGcl7UbEsbvvbmsuJquoPl1jXWFEV2acdnIVM0EiZeEqWRTbzPrEsOfUTH40Hsxxh0 ai17A1NZOcvqx9nthvwo9iTlB9z3LQ+gPxB/dPyBGpTQCMCP2C/iWKJaKx1n5tC+i0w+oloq jSv4WWPmGMCVVRpxpY12YBHYTrBZh/z1sa//5u8vcAXsnRMNUlhrM9aDa48a3yjjoP0q7KcU Wrwl4P2+B4essBcj/kz1qQlLFfjbxyHvDdmn26nJnbtLWivmAh/pNxvoNwj91NumckNmP0zA guCLWx5dDsB+7He++46Od4n7APxA+X20L5DfuYuSe95/pI6Aj1YuI7KsXWb/RhRRSqaCQ5p+ pyIqW0LM4TxPCJ/2AkveeQ8eRh+GXek9balMvec/XO8ZS7AP+YHVwZQX3F5861thxfw6vac4 10ROS250q6Ya98Nn8Po1LG58ROz8oxvGWVAla6TRHg9FJZBfxaqlKbTVg05l1GLISte3pLwM BvWphGOnLli/CuAwOSADSBtxRTvX8MXCn1deHkt9MhuRjAoQcXWRVD5B74kVDUU8sqUB/Pbv 33/AsB9pv2s3bt/laL9GK7OY/VwLr1lXnn3QMA0lYdt781b4zG+g3/BSP/6y4z1F/et7FMzb 8iRYw+D40cPQvwj7+UaI/ufgwf4ogaEBQE2sUiYoFXh1JVNtOEteDMc+GGXdcAez7X2hDeTg ExV6vm5g4ehd1cLv0GDEF1w18s0PhFxGFDRyXoqG3U4ubiU252AkO+xcQr9S4NayzJRE6mMb 7UfglaWSlko8IV1pPHi/mHwcHcJGYCqkpG714/wGH+kg5AfG79tvv/nm62++Afj77jsTfTaw 37/6J/u1zX5iHgN+emhrKGXvVoEMgJUK+DSVnjXLNHrWwPKxWpS1MJAffl83X1mfK8B3Lgqd 2G5d8YmuCNqk0UQOTxdpP2I//qKoF7wlwn4/Avt9A65HxN+jB1R93rx+7cps4C/zXlh3Wbts /mvkBUS2jl3CmrrxVnOL6xs7gc2GfanaUtQ3Aq+8sbrq1y/P+Oq67nb6lgdjDHrk2vKI/QTK d72nYxdx3/sfAPh9/Mn+g8b5weiH2ch3OBuZTr/ASAymUgklEljEgppKVl62jXFoVu2o1Y+e gjqOuUzBkanAPxaXSjTJzBaNcJzvjcZ072LuAtul9yxauPCUF2X22r2nK3z4lwL9YHK9dF7p Jgneo67X8vNbhqbxGUGtgC3drnSMSnKrH9vjjL7y9ngUSXz400ahPASGDjSh1cKkWhMgsX3h A5DrKcUeh0eB/v8B+nGRi3rGmxhQLrPz08qtW2lQ7eQ1Hc8NL33p/ccnEy9RFzIqkizlBe9m W8eABQ3NLKhMcOw/cODQ4aMRT5Xwsan4lBZepV63vwMk0B521cdtrPCZH1vhx0Vew1OKU1va r+M/Y7wHsaTHJkWZMHqgwn65EaL/OXSwP0pYKPwn+i+a2KWL/QYOrCjjWlVxgtMn3Yx9MKp1 g1mXeru4rBXBi6TQFbziqjEhSqWKPBnmw2e717qRamf1w1LKtOnIy3YWS1CcXEK0kC923NVY 2nkMm/0U6Z1Bhr/gqBMLWlPsYynX+I/yg8v1pCPc12GyqBX0s2F+RH6g/AD8vv76q6+++vpr gb/vZfjjshaST1Ye0zQaITrNvSpb2cgrb7jSJWLCj6bes27NUyHflLbX7pXZbt3mb72mV4CL k9Ym0tZ6giNY14NeJO3ja6eQT5N8JvYjzyPsx5w1BH0a8ffimVSfs4G/RtinC+W5ZvZtsLNd Y/9EG+gXkq8tHL6e4TahNJUYszhjtOXRi/kBwN/7u3W8//6ePZB6fvQxKL+Dh49KNAXkx/FY kHsi4xBiBj0U0nsa9CsqBWhpmCJaGeOqNXP1HNnAc4KHqnrYs6p3KV9xcVEO1oB+LVt0V3OP 7X7hin7gpP2PG6e+3u8pTnVV1c5C0O+7InJhgGPHfspbyCPisnNBFLQ6dQ7Gk9KCzjrE3M98 wUodkqOPGykqPv9q4QclHuLokIOUZBu7BPUVBdPPZvUj9Iv2VtH6pHK5jHbY0YavPeK1x/Ij dCGPnZLH8naJ59SI5H6957UrFzivhiX8J5/sw0Hwp3wqDLpiRRai0WHFp6cfp7mnctZMeMtX +MyPrfBjHVnDU4pTW9qv4z9jATMcR4xkOmVdezhQboQEf9gI0f8cOtgfJSwkACT8I/oj+AMc aGA/rifrIvgcPhWfQqdmrrLch1e1Ijz8OIWHHls8f8mm1uYUMWov9EPEp0JLmtMdMKKxVkU6 RGvqMjH+oCsmLYrPeqh72KJbW4YwJbJDu1YpbBMpUfhJc/uA+xDwQp+fIT8Cvy95CPxR9InA PA0rZSOdgs+AfinN7DP74RRMczq4Fzhk9nomRztEZl19N02URRnpyquZpS0Amx80/xWI/daa 3GoG+YxrVjpO+5nbjy0XDHho8H7Aflbw86mm6BPE3xcvP3v+7Alm/NHyl8zfmVMw31OIs/+T luxTi6Ysf02txLwfagP9UtRUvH7Y8urFhP72kofHLe8AbstHYP4+2MPjgw+A+xz4oXRiUsL5 i0J+dyX3ZBeOdifDSD6NxkQK7KeyyI5+qgElX4sbmSjz3uB5v0/POjfi/hiJMjYMHysHoLL3 5h1YfiKslc02WVELrlDvGQOigoxa6/d0fD3WZKRWNdKdc9tcFhSmfa/rvdUJoRYPxbbljs50 WwAQdMcz9Dglg5UpRu9XGkQ8Rqnbgl68SFKV1HiI09nfKWXYqKPeU9AvY54U623DXSy2zsjP nR24ySc8MG2JHNt/6MiJU/LphcfSmpAD+Z6KlJKKgauZjn3QLID2g01Zt2+a4rN0B8iIuuJz Bm5/hc/8BvoNr/fjL7tBP4+6YINSis8bVy9rJIgGEVcb4fvDBxqkgIXCf4b+AP4iuiDrGDzR w3hLj3SsJWWnnnkxHPlgxOsVmx/9dDK9BQTKU2loGVg1+Bw4FA2NxO7IhlpCw6icXGM8XfqX W+N06K4W69ed7uCvbQ/06xqISydPzm3eAyo+i3ElcdenMVE9Df42MdCHxb9drH6ElB5NI6sf ayQ7GsgPwO+Lzz///AuCv28g+kQSaFRTjv2CoAslgqG0WqTBccIJayOpI4fK+4oZ2izxiWb1 8wKtlb8ed3PnQviG3/PNV1ZwBfTOqS8VG25YbKPUKYkeaB3o5djCYZJPLKR8T/iUWkdDxJ+p Ppn1meCPaZ8Af3BhOMpweeG7ytJiBi8fY5pWUXtxvUQhMC/xt4F+/dDPpBtksGT2o3iRgXgR iwCFFMEfjr1AfYB9IPzolTlCyq9Cfg+fPPvM5J5kgsWOsU0VjapowgXp50CpeMJ3rqtk+8tQ jEToPX1gRUfvGSLZUMnVue+rl8m9Ru8pTnVVjW4tDeN+OHbyCdUL/KcKypZ2hjYdHOyj2ghg EsN7zenH4DafD+BCnloFsRUVZfQ9sK0i5SUy2ZDyQmN+mkLnXdm0/ttTzP5FBnMd9BCaVhqe 0hqK1S8HupuIyU2ryLb4uFZugftc6PTm3qPyCY/alB7LwzZT44YPZgiReUK/ht7T2jLU7amP xbVMqgXRfgKQ2Y0fUnxGN7w4ejnzFJPeys3rvTwrfOZHVvh5/dfwlPLclvWb8Z/RX1RXvXmH 8vbN61d8I0RzWhshd8K9/Qfaojz2gBgUM0j4R/TXnFbsfr91hH5aNzIRRDb3MPaIDde6Ycou Lp5qaCUIcq1AZQ7Dhm773wJ3VS+/mrIzLmqEfluhRs3pDmlfZvo2llzrNKOwdMVnR5jZGdUT 0K+jJC0T1f0HM6EQyI+rlaJDP2xNjZCQ1EY7CPoJ+ZEeeQV+5CsCv5cvXxL8GfarJZ9WTdXa zMqaXa3XZOhwUMyKpJnwJhxnswxBHbUrHWVa6j2xR+U0DM12brCZeTcX4HAXeBA237ptVwAA y/tSUUpU0Rdw+ynw3lJqmRCrSDvxflt2WI8E3QRNWCKbLeIPcx6eP03whzF/GPXAOX9t8KdQ SeglQi3REEvMWYJsoN8g9ItuJwcgYzXhGKzY8gjJqZKyZjlgn3wyAn4nT3Mo8pVrNz69ffc+ jX6Qe0ZscYF+pvy1mTGVopSkn81YNc+MMlFWLY/sfX2qR71arRkjYVK+1GhkFLI+ErTMzTE4 nPaMfLPZlGC9ZzLHH1Yn7yX/2r6nWFHGoTOUYzU6WzLrV3541PXF5CbQw7Q0NVA1mDkENChB 3sFkEw5+dNLvyo1G1ohWQxdBOPQbMGf0+MXmeALiW2LBxnoNhX4z4FPtixxUhRLOrX7qkEc1 gwQmMfL1kBKPjFsCKRmnOfpX+1y13lN0qzC3tecth2KS3pNtmROW1qHSXdgPkk/QfjMoPuXT RPSHaQCdGc42P7oD7Ez2I7EVPvP9/+D0y7uGpzT9pEf+jfGfUdCPb4KaNKb4vH/nFioU2wjh EwX4I/rjTvjR0GEdUgJAwT+BP8o+Gz1strBxrGoxHPlg2PulllETJly1xgo7WpWMXbyawNXf 69lGPfMTvJc7Z7Xmdzyq0FQufuIq9gEpQ0I/O7tI1qJ1Lcn6GFXALBRFobiP0DHaxavERxFm EYYmYD9jM/CI5L7vkVgnSp+MZj/QFUR+BlbDmGxWPxeWp9WPck8L9xTyE/D7jIfAn3g/Yb/S Sk/FZ8K0zNdJizrRJz7YsI/R72m/1S9m1Z+uPlYmkfU2uEa+nZu/vtZXwEtKV8FpTVDgfSqc 5LGwrCLp4NgS6mK/JvFH1afA32Myf/T8cdQDwB8YJgd/LvvMGe/dRRNnNt9qsoF+Q9BPDTyj +2lyIO2XW54mYQH97Qf++wTReOD7EIwOxu/kqTMQexbk99SQn1Y1rFRuTK4TUdxDcf92qiMz CLq4iLd/bdHex304aYWBsWEc+hWkn+k9aQsRWNYnOmVr5Uz5D8t6+fEusIh4Hd7T8fVYQWd8 dJYO/YZMeOyfio+D1tF9OtZEtf38HZPVogY5eqIi/eLlssiBWArLR4jRx9mB7rBqv12ooWoP gmeKV6FuVUZ7wxZDvSehX6DrGgAvez7XAk+7P+DIwXf5CUG3glUrU44miQ7me0rvaaSfadep WldMFQW7DIthK3wo47NR4Y6d3rnCZ35khZ+3YA1PKc9tWb8Z+xnBFPmbIBU/q2ou6/c4i4pz iL088XxY5gT1H3CRChiSGST9B+2nDcXNMgbqAUkUsGivFfRrrhsWSNlIBKmTVISTK9cbeyLd qemEfgMdkdnvc0A/vPzmZK8NzHhnYwQDNuafqWIX9MOiVp3dU50dB5QXhBY9PYN+SrNIupMN 31oVabN6jPb7V/2D1QqK3D/hLnULiQA8IMPf/Srol7r7a0VHSgWRCz5T7mnUyMvPXrx4/vz5 ixcAf198CexHu59NeDC3X0K/4FsrFUnxKTjzWMHPOr00EpFly/knQ15aceUmIi1JxmFH/3+o zhbapGa/8Zu/uWNXAKunr04Z9GIVMcgQkzhVeY5qSgxhv3+wsyHHH+NeBP6eGfN39/atAv5O J/jj/mwTBd5+u+qYcdXUsonHb57nbwP9ojr1yV7Y77jjqfhDB0+9LMgXSfsF9sNNgRNTc5AP 4jh0CLAPuO+4AT9Qflev37wlzu/p85B7ujbdQJIIMvZS46c/uq8By5iVK9JPmjLN2cl8z3nu 7QKvCR4mgSfb/LC/QMtXx0iUBAiXsVZoVp23pw8l4rtgNKaZCUxR4mTASj+Qzl5VxLq/pzjT VVU7WhZG//CEfjZxxFq4jPgEdbsXAb4QBhn2o4JHjVxupYn8DoEYhlUMpJ+SgKyTisRjk0Dg 1cLBJLx6oDtNMWLVam+GeKPFiyReXifHIPJJhBTBcgrDw7uJoYMokizg06CflFvmeLSo2nZe USi3VvogD7zCb9jbWTVmPL6GxoMRek+QfpB70rVsnmViPyagtrj9YcWnc6I3wtNbpOp+efqa Vjj70Y9lYPEp7Y4N9Bt4YvDHIy+7XCoKrTT5C6tq9ECxVUHyeZW839nT7E1XOyF3w8ZxwA61 SAkAyS4rGjuwH7pI9K5EEbNO0M/XjQb5lYGUXDdkecuJNdIK9MnEg1eTpHLZqxrPrhFbHPlr zBbw+NEC/drJ7NcI/TB5yZUWCf3YUuowihVI8/WgNvtR7hO4C6nQod5P3KV5jn98kwqi5hT6 AJTfIAgPC7F5/SLiJZHf82c8ntfYD9P9kvbzgipjBu4zZgCihrKhoPZgw9KYR0U0ulcLAgcG kj1+GoAZAhUKPpXvWVO4/FQsZxiLE56EjdVveLn5D/sKt1zbtvRqyN6SwQYqd8iJm+TTJjz0 8X4l6TMyjAj+0Npogj+srmD+BP5iyDuWzV27oJWnVN5a703R5/jLvYF+fdDPup2p+FS2WbXl sd95HHve0SM6jh47dpy4D1LP8xcuXabY89adew8ePXnmyA+LGtYpW1JsCAIlvwxEAUxixoun yGghDnVkhLws3iQc/1SgTPAHo0ErVDESmu6K3a9P76kEsYcCs/6J0r+ltXLhgn7qB3p93tOR 9dgWgdOMZfDC0M/UfJTOULV7kBOcYcODlYuS82jjAvj92dSeMPohaeTYydOcaMnmuPWfX6FB 26P3LNqjptVvuduqLq+g32CRVJVwkfLCS8yXf8rAeTYx5uq3TX1+p/yF+u1sNedL+DznjmEP wqpjkx2YK82xKz7PXWNKMfnqgOeIwYuFvKoPP+Y9BHr3TqYPhu/L+Gy4YCLjswoLzK5V58Os 8JnfQL/O1c4/GHnZnSpi4JEUn9yrSPtB/3KLeXSXLrI6ae6Eth/W/z2MA73Rg5ocSYeE+gzS L6GFbaF1FfZbI9YvoB8WN5/toFkEyVJV4ErEmjpanqHJthkdZykTt95n8ETzPqVxK3Enfzut oVWgn52d9g31syqEVub25FCWGH4X0K+ehuMOf+kk0ClnjKErPrNRJnl8B3dpw/jjH6X3NJsd M6mwUTRkpBrVTqtfkXty+jWDEJ/agYIKvN9XXyPqhSmf2lY847My+1lmHrpR9bAgs0mJeRSa Tz6zmTTDNiChHw79xMrq19WQbqx+8UT+5//qey6UZAy1s/kOTvvRHsG57o+aYf4a4xZCpy0e 9rKgfGP5nwG2Dv7g+Xv88AFkn7dAMaG1xuWVrTVq6jlBde8Hrvo04i/TXoBISTuP70BvoF8H +pnQxbY8VkvffPVFbnnUfF5kCg/2vJMnThznceIEYB9w39kAfkb5Afm9eMmIl1cIpDJ1gi0p lBJUyC/UpFfll6HTj6Sfgi5iadn+ApObSyomi6iEm1+bVmjqPSMQK5mcaq5qyfec50kds7rg 5/v5r/t7ihNdFQMyJ/TLzjVnOIu7xYOJTfTQftF+0Xl6U8dbAn7v0udH5HcQSSOQe0otGAMG rEQqmVeoQRK8Yq6JJcavaluNyxvSKCzWEvkIIZVOr2e0B/RjIkIFTVMbpQZ5ji5FrPeiNdyY Z7r6u/549+o9uQel5guYO0Neemy4aGFzuRERgxBGjCbdi4hWxsWcnqz41OWp2vyVFqpKwRnK c4qbEtVlqr9cU5bpiRahsbU1e7tj3huyhqdU3e/l/HbkZ0zoB7OfPTui/Sj5vMPqRIkE2glR oGgnPDZwHGWP9LAJQz0RFC1sEn/EfsysU2QdaxjtOf+98w9GXKtYN5xUR41HhqgtqUzoFw7h enxCkycKrcBCtxRnhys1kxxVWgbyfs136IUlVmJlj9gSBXiJgoXZz+vbBkpTGEqY/ULHAewX Zr8w+VchK1hcKBSx+0zkB9Ivw2OO+lS/GP4qU0yD9JMejrOvQYk85vHkKYg/1FTAfkz51OpW KT5pSZXkyLS2Tmm2RKcN+NkzVF5UopAftoCI4avBZJUcg8vlGqaFbufmm1+HK8CXzmq1mvZT OaFUNPa64e+K+ZTYeA371eBPb4uP+Evw923IPg38gWLC8kpdhYG/45GkbKrPNvH3/1TmoSIY jf20iFQJeOQwYfP/FY90b2x5wcx9hlxrbHnUfPKegI49e+bM6dOneJw+fQawD7gPHr+r127c RL7LvQd4DLRKlQYVizDrJgH4oY+K/CqiSv5kyj3VhTddnVmqwOtynzDSb/R9XexlqmvLilY4 VmIknuMZj+z4sPqx9VctvpVAIocabdda+dq8p1FjrKDaWQz6gR+CY9O0jpYHckC0327DfhzO BdyHrfztd9/dtRt9cSE/aAUp9+REyyD9mIbQiLxq6j2jTRyJA13osMij7MvbYDH5uY3iwflp tgOsfo3ZDqWQ8B6y1TIIw1uOcmvOj2alX23ETb1nBKum4Tyhn/Tl1Evm2BWEvCDeExNK5b/a hbuo24jZfjm909OcXOEFKKYj9brFqununvQpQ5RiMTg9basVPvMb6Df8SI287MILnHBZ0354 ep5gI6T5AcTf5dZOqO2w9Z+TbJECGbowlPFo7l1x7Cf1kks+fUroChbDkQ/GyHUjaoaEfnrL 7uSUg32pZVgi9KtDaJCuxazKEkLTcDDrVvapRaTL9PxRBfP+Qcnxgn4KxoLRwyvCQbMfVgTK UKiNLMtlmP0kJaVHABgfBxuFNIVns6dSkUoaJehnTj/LQDTO7/HjRzwePwb2A+8nux/dfg3F p04hKM2O2Q82BUhVCD/7kmZI2FQFjUE/63hYcgE9CRFX3qVwt7k8G37HN19Z2RXwmrhF+5lG hoQIekIlzz/aEtJEb5WD2M9EnyL+nPnrgD/21iSqP8+0T4A/jvnDsknVJ1ihbJkVqfwc2G8D /dqsny/jXM8My0iVmVsetC4Af9rzzp07d/YsQB9QH2DfpStXrl0n8Ltz7/7DR09g83sJS7JL E6BN+LsXYaT8CvKTjdCGBp6jkLyQfqgutU+ggh+P6Bd8AVAlRIfD8j3TJKUk5AatYNk11MZ7 c9hbnreCyZmpHFzwhNvf/tq8pyPrMSwifVt4T/dWPQO/iWNKqSS8NLUNLVwwOpg5wkAQ0H6Q fO5Wvx6jmXG8DZMfKb89UgraTDi0wK7dJPWULTBLAvqZDWiev/xDtk8zay7gJXyurenCS+io 5vJmgQjm70ADI8dJ2QQE9/lyqh+gX54g3nyxkjI85uS6HQ/49Ie7as1nfdbUe6o2cr2n2jIt vSesMPD5mIUcU7eB/XgjbTKjFJ+TprpnrcfEiFFtnjdWx3TPu1au4Sm1l7SF///Iz2jQT30a W9ld/wLs99A709gJif7QCLWtELth5ziDgz1SMoOyBQL8YS4S5UuJ/cLu53NCBxs120cHj1w3 vGaolPhQxgItmA66wla2pS+6oeNOin/wnPmAZxpTUMYu/aUOodGq1kSmdwsyrQwZrCZR3pZ4 t16YJl0kO0Fey7pIwid9YjmQhMk/eEI/tAohn82cZS7DafWTPN2sftB7cpg7SD8be/0UAYgP Hzx48PDhI8N+qqtA+xXFp8x+IumsudVxj79j40SE/IbhZzCJgn6o/phs6y3Q+EztuPKdKM8W Xgo2P2D8FbBdVxKtQvvx5QB17JJPn+KtmsL7Em3sJ9HnWPB3AlHKleoziT9bN0kOcd8bixKa i8j7UUP8ulk/SD5jyyPtZ5JP2/KAxxHCc+0K9rxLF3FcwP8uwd8Hvo+4D+kuBH6k/BDwEqJ0 yj1DefWPv5vO1zi/lzL6oaNEuaep6mwZli3ZSb9Fd4p5HnPuLaIVvEeWtEJL72l9Nw95abii x4nAxp/jxO94bd7TkfXYFp/MqsJYcsKnoR4TutgeapZNPpsaAxDY79133nnn7XeE+0j5USfo 08CZd2UdsDA9YxFUyEtAPyx8UYNUek9OAclSgUEyRhqNXc9aT0V7eWNWkSitKqo8xnNZyktC vxhT4iSZQgPAkRmBXc6v9Q9ux/9l5WfSE2J6WZEy33OM3pNjV5zJReA+MTxvJXYzZYVKtTuU 8UnFZwY79Im7Szpxd0ta4TO/gX7DD+DIy15DP1XBcKbL+/DsCfx+8qTcBPV3VVsh9sILQ8d5 IkOKZOQLRBFzUNFChv0stcDkLUB+ayP4DGyVLaPhdcMyNG1hZrO4jjuxntx+iA6hewTx5BLB BVe137SXtWTm+pc13UpUNLHsJvXvuSWFlCTrR+hnWvK0OUqcWShFzbWQSN6wX6oAkiEriShY L6n4lEhEpF+Vs2wT9UJEqsxOs/ohA4Ok31cIFkIABpDfg/s8Hjj2Q2WFlM+k/TqT/Wp9Jptb KTo15nEIfpaB7oB+7ND7FlA873UoTm1fGX7pNl/5j7kCvu02aT+fZqV+923Z/TzYMVKI/qcN /n4pqs+a+cu0z+dcXx/cvytVPUc9ME6Llj8smyL+2Hv3tJeFsN/AIrKBfipQY8uD2xggDRZ3 aF2g+rx5A3vetavY9XhcvXoNsE+4744DP8oSMoXY3MtO+gH4SeRL5KeIF46NAEEGMQHWFZZi oY6vSb9tFhQYcIpnvNGn66EVar2ngms6w75S7zkc/bDsBeJ1eU/9/VtFo1vNoNFGwtzG04dH RsdoP197FM8OsACeSCJBDAXYB7xwBAPhzmCmJbQPknsiLdunitMOGlHH8oawSRwhKkEs+hQQ btNWI7lVbJEng08Br8Cs7fFk/YaKpBLuthTl1nyfzT5V+VgpoFIAYYwrpMeysvr16T1J5EJE wr0EWF7Yj7SfRCxqyQ9PdfeEVj0kmnk1oPjsa4rj/Ec/ltEtYEMiCZW2T2l+8+UantJ8z8aE 7xr5GYkXqh4otfzUv2AjRN615lDdgSmluRXahtj872U0SY0alEP+xDENgjcBgdcwfzDEsY7Q T53PoNX6fTBoGfmV6oRDNXSP73jCdd8rMeG29X0pl7VEpgeO0I1BMUMOJ2fLjcuuTi+0DEIz lRWxE1kp6Fdv/VoPkPlrOO3xc5++nv08Lei5XvaMQbVUaGI/kn4aArRP3SXI5JgG9oRaS8Iu dchRHln0PUk/Gv30sN2/d+/uvXv31VXPCAWmWMWoZI13GDb7MV7VRKeT4ad+onw5MdqhaNob mv+4mTsSwtf3SGz+bNVXwKripP2QrUvpMh5lNJPD5QKtE14QNSYC+xk3vlUdxpTL8tcCf5zz R29rA/whWwRhn1R9WtyLiT6jZ6b3VaUezm8UTshFxNidDeuXC6WRE+htV1setC7E47e552HT i+Pmp6D7bhP3weNHLzL16KL8MH/GV7S/A/vhfx5f5ciPMlIY/VBcX6TcU/qrdPphPzTV3rg7 uoQ3AEVCm1ZA8B890Vr/i96TiguU9ST9sPi7K9rcRJrUpi6ZfNZyEni5vB0s5mvynvJKr6oM 1now+oeDU4x2Z6gxr18hJY3GE5xhNglAo5l3MRhkj0+DwwKIhBchPxj9KPd8/lL6LHNk5Pon uWcUCtR7ovUhuWAkce9RCDrb48uFflD5pNJo0BQT0K8GGs+k3Iq08pBGLUe5Nde7ao92XZ3F qk0BVaS7hxEX7yckn5CYYx1r6D1jkAzWGyjv3oF29x3F9VjQy8kz5xnTOk3xyZ/oYUCZfJ6N niFjLx760Y9lfUc20G/O52bMZQea4YhL6QDo9ouNEE1QJi6KiWEfFFthYy+MPdF+vY7jGrqk pAbNIR/WFWTW6clDSQ4KPWk/Sk1W0QcbRwfHsoyW0UzrRgX9TCPIlwIyaEG/5uC8JaxqmNPR u2sUAaU7fYegH8QWIsZsAEJzWkFAv3a7rPzwmBqIgTiu+JSMA5IfCuTV90UvGyYBn+irVOg/ /4mHZ0H3akgL9JPeUxQzotW9zXD3zp07d0NRhb66VdesP6qcl1p11BZoBvPIkzD4aRVNBT9z yXS9JzPYwzso3yb3qBR+VHbvURX3XO/u5pt2/gpo38US6jsvRmqadtlHGUfLW9iPrQyx2CyP 8ZZAGL1VHS6TZr+iCf405N0WWCINzfm7cll5L+yZifhT1KdlZIVPei7N5wb69Xj9Ysuj269s eViHGDVF8QH2PGx6t2/pwG+0Kt1/CD0CPH45fAYJxD/8VJAfgJ8hPwjZISJFTyvGJF27ctHk nj47zRzXth1yz9rupcV2vt9R8B96T+b+oRzkPLSaVmjoPSWNd7m/L5U+AJVMziQJ2PLf69fk PY0aYxXVzlzQz+WkYXIw6QxpvzMnIfkk9lM8u+bA7cE0AI4B37f/wKHDRxP53cRIy0eccYPZ VzJkGOmn1U9iB1cLcmielSBwhfbpPRfvqMblZRxzHVeHZRqPcVr7aYpRd7xAP4O/EjAp6saU W7KtBivJvsy2v5p4U/ihShFv0fOdxoy66Eb6+fYSCXwef+cXnLMaGdyjA9hv9x41Mj36zqe6 G3nrU5wV9KIpzmQQXOJljlAp1k1f1SBuW+sXPsAG+i1/yZv2E8dddku7BVlk1gfqXxBMhuIe KjwPXWQfFGwM8V/shbYj1v/91JAhlaFEf6ZeMvE4ahjNisHOELSffGarWAznh371umE5Ku11 w1k/9Ird8mYtLZvoXgYMLDEcauZbaelVYiV5HzF74i+aJYzZE5Dy++y7RDOUsRv0Q3lbJvtl KjJaQY8w1YnrOlTyWDRV1DLnpf7k5v2tFkwqPv9M7Afk5+Wyy2dbVj8gOY128CdNck86S9Vi UJl1jzEKaK1LUIKTIO2HIMX/EYVSGxWaZj8pPnEGFkwm5jEcLEXGZJ+KFY1DP7f6RW8Ln4hp rexk0+5tKXzYZHdiD5j2rm++voIroJrSxs/w5fAWgrzxYEUuXGbUC2M+yfsJ+5nshr0JYr8a /OH/Wd7LMPgT0iD44yAdrpsc9GDEH4U6MvzhhbWu2TzYbwP9WtCP3U62O13H0NzyDPzRdAz4 x10PB36lCh2wz8KHyfgxguoV8odJ+Wk9I+wj8JPYs0Z+nBRPVuUs4vbkvOFdZYIPbmmSfq3S aQVPdeNH2iNe0wrKfsjYv2r5b0I/qy47ek9bKq1Ltng53zjV4f/zWryn5UqPSWKZkQGZB/qx yU/+ltCPyAyk3D1/QKE5OMqlR+APo5lxfEjc98n+AwdB+R0/ibGWWP6uE/k1o66s8cW1jyue WsQpzVHIC0oQzmDK2OyyrS64rxIlDaWgZxXDyAJNZla1K6+fM5/R8lUHORjsFKTOLy8cfmpn +Yp9qKox48OJq8ZMKG3xeor04yqGVSewtpJ7XGBr1ItSe0D8qR9O/0K+7IMZn9UIsycP794e gO/Mnm7XRjMXrtgyPRpoVn9r9x+b5YoKTq8bGp3txEf8rXGXPaBfZyNUY/ozJu6jD6r8Dbiw YjPUjtj6D7ukVIYqH43qJRB/jv202RXaD8BvrVg/TQYK6GfdEEM/lgYZ60Yb+pWgy0ojqF09 HcwjblvfX41b2Zk9kVhKvrUILhb02xL0c26OCzvDqxpjz+WwTujnE3050zD4MfbLTJ5ZYpt/ thoWTfLa5ZgJMjBHA3exTvVUMIjkXFJeSUiZs0yShNDP9J4WsEDST75SdNmlrCLvh6iXF6T9 1FdUATKD2S9yqf+EbLKEn6aRzaSZkMgL+dkHiqCvexlaB+tg8W0uhcLtu8GbP1vDK6BqLWg/ kiJYGt7nTCtOM2bxg+l+iPkk9vPWhIk+Wf/MC/4sTFmWPwqvuG5yHBNFnxzv7rNxsGyq2sMZ zo4VNtCvA/2Y8ielC5pZSvm0JpS2vJfa8zBl5hE2vTyI+qjzdMLvqwR+pPyY8GJHB/lhYASR 39VLNPpVQ7PLZsgbOuJuLud9YW2pvnw2/mx2pQ/7ot7Ts9aotzC9J6XxuE5ZXRa9py2VVZds ez7Q6/Ge8lKvqubUYjDyh0vfZREept6JySMXz6PtpJRhgj+MZtax7xMDfqL8zp6/GMjvMTdn NL68L+vKIAA/1Ak1YQTST/GQ3lD1EJUGQbzQI22XNwdgqehQCUcto3cwyuxjC/hk12eCaUde RHVmtq2L0bwEerB1WwuXGeE14/WeTvqxJ482plVFrscaofh8ZKJd15DuLaLd3pDWKFxX0O6Y d7Vcw1Nq3vUl/L9xn9H7ICn5pGY4NsKvaEnhTggVjPbCejPMXVG/QTAjgCGZQeWjIRz7glYS 63My6gUSFxeECPmtkeAz1409BCvD68YQ9OMeOJALvODtjFsZ0K85rpRjB2eHfhTmVOFV6Dfz qOKDG0hNm7+rAKylRxUA2nmCft99mwkyRJWu+RG3G7ICQr8eLFlZ/VzvKVXUUxslIlGxbDU+ NyuyNCw8Omg/Nrh6JkwYT2fMI5Cf97e0ZoaDJR2McrAA+xWrnylTqtA6LJlwDtoWsEN7wIKP z+bb57sCtvVy7/2vP2DzheRzF0wkzEWj3Q/PUhP7lYHeRvx1VJ/WNSHKQKPBWaHvv3v1rUEN 2FzB/N23kXJXMOWPFRi770h7oWBCRunEfjnfb+aPtoF+AWNSGC/Vlytd/qUlQFueR/C8/Mz2 PPQ8ue0B8z15+tRgH/g+EH4B/NqUH28uDcyF8+OoQAxIAvLL8Hy2yKq90JDf7EB+5ts+8S9i Y2FvAzuf6z37aYV0WdPqxyaZ2xyqaXCh94yl0rtk2/KBXov31C71auwtC0A/zzbDZD9hM3Qn KPmk5ABLz8EDB/bv/4TH/gMg/A4fAfAT5XcJSx98fux7lbas3Bje9CLyM9IPxjP2xu1R0fQI RHYwc8S1NBAe9aKGic9t94u8vHqQY0SJig7RY+GJY6uXUsafEYcQb76gnz/NQ6adZVgRuyc8 w5/wM83UmLF57pZVZzbcbqAq542pfVhroRqNHmV8dhWfEre54rOeFCjqttMWb77w+AQjOxIz p9puoN/wEzTushv045RLf2np5bbdC6UJwR/R34vnxH/aC7ERdg9skOqSQhkK9MdwbDpXWMOo hLH3vXQ6HXTseE+A71ilFoiWEf0OsW68KutGBf2olwimyFm1FrSyLXD4Ls30Fd1KzXQH9SAw deDQMYxIt4nzTwH9vtG6BnDGda3J+mHllSOvMbJG664Lc36HzR/lbbX7H/QQGc6zLz/dzH4O /ZoiAHV+XcihKlWSciRJea0s94jMxGrAYURwZfVjvqdCXoz044hrC1ZQgvr9B5B8+v7iI2MT +g2Z/fbaJBFjHs3R3AM/MVmQAlIJPlHP1D+sjGisYfKG9Jvpaf2P+UsqKVkaszFSSz5h92PU Swv7fQPHFx4p2S4mgT+plYfAn03SuakpfxBMuOhzCPvhDJt77YRrrzWues09JvjXm/BZdztV p9osBgI2bXlqeAL+YdPL48WLzwj7vjDcJ6lnA/gB1PeoPZ8+NuRnRipshfvMeMOOkonuheRH 3MwJ93nEl/SAO63wp2KRakvApPlQwFZAvx43UXsKzjZ2yfQx1v499fdvFfaWuaEfU1hM8Ymp dqL9brrc/JTP5jp0UMch4b7jAn7nL1bIjxEvjN+uJptS7O5FJOM9nR+mnpQJotkhTjkltlV8 gNkXst4HvCqR8CCz38xoOUI/FTEvWiVSQL8h044rUpdo2uk968l/aGVpj95Tk/hCkcXKz/Yc tRQn6T3RlwHwe/NNGGFMDNWUd7cUn6z0cDiCd+NQ5R+c4Y3XXVlNu2PeJ2YNT2nyUzDHV8d9 RvVBUv/C2228Hwau2U5o6A+d0OZemJui/eYZkSGZQaYWAPxhUrGwH0qYg2r1WKvTg14IOdbh weA79juDVtwAnacabBkJWpmXLqGfYm97BJXLhn6zrGsF+mHpLbzYACuJnpuq29T8hC2ORn/T SgCqFbNfrAaCSsXmeAk5L0dZ1MiZxGlAJUeqhpLkKGmz+8msMWow+EAtyT2Zcg+18PVr1zU9 645ai+4kN6zWY/ZTElTOYGdqOhWfwTySqnEDY/lMsvoF9NNoh0bzj5MKm+OHlhJENsd7vPmW HbsCVhoH9pPkUwLmTzDS+ERiP/P72QQSPNcMrqWBVKrPfuZvCPyBZULMEcYKYOFUCQbsV03Z 6uH9cIazYr8N9Otl/ULyyS0PdJ3anbbloeHJjufnL19y18OB3+D/EvaR7wPuk8evmPw0UpnT /LJrCj5X0VUP7t3BHVW453EskhqxBUtAaYKyeJ/9Vi7rheC+JzNrrv1dGsAEJXB6S+6puqDU 8624/ikcwLJOu/NzXov31BmcNYJ+slXpZjJd2+dOcuFBtx42HYA/UH9+HD0G3HcKJr/zFy5d gc3vVtmY5XOOuaamdBfyY1qgEsaVDYl8209vXGGVwKF+5KDC6Ood1VnXsc7d1x+o2m13xxVe SeinosO74wpBd+gHXNPOa6hMO1D7/Kmku/X/uyv8U3uqW4KsrjfPpbbYcSbme7rKwHLPKWFh YnWS/FXGp2o9xukx2aFd7FU8Pyp6zqfhMlZLohq3cRwG2cKxYf2W8ESNu+wO/UT7Je+HLeyn n34Q+EMfVFsh90JuhrEd2qYARSC631j/l8ygbIEsYZBaQOyHEqbe8fSo/P73Iv3WBPqhvqPg k73PqS2jCvrZ0oaWGTZBj1GpEzQDLix4O3ErW9C0ammRRxti/RrQ73a/IBXIz4vb0EqE3LVn sl8uB3IJwCCOLYP+bfTzLBWFZj8oCzA21KbHtKx+6R6prX7os3PvYd8RNZLIYqTEIin2+o1P b925R9ovFZ8y+xntlzuLB5ji49FCzsl+xjwS/CnGmNM6lFuHdlndBJRQwq1+tVACBKkiS6FM 8RQre2K3sZO94BOz+fZlXAFtvkYnuOSTTmB2hg4eZsyd8354QpH2iPb319+CzmZTg2O9Sfzx dfmlzntR/AE6qYPgj2nKVH36winRpxn+NBg10AItuiOZog30a0M/1n/e7UQjL9qd2PKs38kt j3seAKAf+C1Q39ffBO4j4WfpLj7Lj+CvB/k9TOTHedmB/ELuSUHZjkA/ry258SnaWqUg2nQn z4hWqOLe2SIL6Ff0nuSJxOQMOn8adeAy3sj+n/FavKdrBf2g7qrMfh70YoZUKbWQM6XBzCeO A/8dO378hHDfWQK/y1cp9rRt+QWCjoT8SDxpxdOC10QMFjlSk35uoKcr9A9ayealcMrjENVu yxPDDR/zJzqeGL34W8pD6NRIKiIc1ews9PNHZnpjBq+noJ9iirv8HLB2CO7A+f3xj+D9IrVM 5Khbe3NOmAljtXkJ+3mlFdkxbXcvOlg+AaPdvoq7suO6vu6DskanVE5uSb8bd9kT+lHyGRth KGAA/kD9ffuN9kJthmU7jG3RfyUwlEdCKf2gcIj9GBgctB/oGDU7PVtyXVi/DvSbJqg01i+g H6OR6Q9rzc0z6DdzY37ozuNWOvRTcrGzkqdrQapaWhFfBWw6+7JG6OefPnKRG764dPo3O0HW 0bPVgPmalHKoEYRFRpNDNQj2fRFuZpyskCQFItgslIbg47Q4SRlFLwgPZBzaDOWrxH7mKJCu RNIGr6lVO/eb/bjOgfbjCBtNL91N+Gn26IuchJjwU/tV6j11K/u8i+prkadehidh6BZv/nwd r0BVU1LyydEvkjAD+3G4FeIOaHqpyiCIPl3LzM14LPhjmjIaIDC88j1I4k9jttjPsJGZqJds trt0XjjF2a7cBvr1Q79C+5HSam15tucRAgLy4SDqE933/Q/AfUn4ie9T213QT/blWsR+5xZu pnVAD6NXrlsp5BdzjlDkzXwjZ7vdM/wtPd1dvaeGuiJADGJ/NhVhdUCLTE+z6T1LkywmPLf0 ESznCWZnfTJnONUpf+U1eE9xh9FEWk2jWwvBmB+uAoEVDD37TIQ02g+T97juUG2OfL5zZ4D+ cJzkf06fIe6D1BPA7+YtbcryYRD5UcIjpYP1ugj8TEAdTwpCszk3gaQfHhX2xjURztii5Twr Ue0G9HOZz4XL/Ul4XegXY6pWldcw5Qnu+TKrPivMWkbcVmPGypiAfqmw7WHkQWIC+P3hDwB/ llqGVIs6N6ar+AQLNKT4VPy5s7dDED7uyhrhrDU8pZ57v9gfjfuMAf1sI6yxHyQwaIMK/QH+ OQDUPtj3n6+ADD0U5gkGI6l9jawXJlpD6EKLA83tql6M9fuv9ZjrF9DPh8DZbCPjiDotozbr lyPTc9alyRliHsDCW6AtAmQlHfoZL1dDv8qLyNMbD/0qFxCCLGT2a1Jk7Pw2RAA17G2Y/UD7 7XqPxy5DXWVQVOpHK+jHZAWLl6YlBr2CGxwMwgPbDJUlpP1C8ckiRBW1Qb/an1cm+xXmEeQj TkI8jc0pDvgZkxDN6qeKT54HJzGrxNK4lapntrOcWezt33z3Mq6Al5RYHFCzsfmqCQ9sZzDm M3i/aE989rmIPzr+TPVZgb+a+vuFVhhj/iQyNFM1VYYgmThKh8SfumYc8+CGPwcMqRL0bjkR w2zYbwP9BqAflS7mcA/sJ9XnD9+j4fndK+153Pd4vHpFlSdhn+M+hXoC+FE6wAMriYFH7Jeu ZMC9LMgP4Z77ZfSjeJdGPxvpJ5w0431cxnNtP8O2FTzaSSuoYKZDytfJz3ydbOk9f/T5p48h 4mNyRzOuf4ABWN55d3/Sa/CeEvmNQWd6JvFASjPJDuuE8dYLQD9GOtgGDOyjdUfDRZExzLnM 586dPXvmzNmzZ88J93FHFvDDlsxgYwkdKuQX5YEjP546M16oJUXAbTj9KKXJXTV0UYs+/HiW m1fXHB4J/TyoFtVDEXxuZQo68xCqFPRV5DV0H9opf6JnWp/JxGi7lT6IgDHki0VjxuZuuW1F ioOBee4ovI1zwZKDA9jPtrJQfNZoslZ8hmnTkhB4KwXiG55NcDm1KKrejTp3JcRXDsjzruDJ 2Qx3mPJAzP7lcZe9Af24EQLsY+GRekXgj+iPeyE2w8ZuaHti/pfMINAfM2EoXTKTA3YH0X7h cfCMT2I/pOetQv0+rkaPSxUtI0/QHFILBPTzdfnbNvQLJfuqod+52rlWYmja0O9VGvIqHbuU 9i63EO1X9yObxrjnNttCk/18cac4SqsBFnYb7oT0ujD7IY5wN7HfLiA/oC72lThWAf03psao kdy2+qlKeuZNR42EvIRDO43V1c8wXjDCp/om+7XMfhXzSPipVEbSuLpgZcBrw+rnUWSab3RT k2dpXeQmxV5FqWdmfwM3f/O1vwJeU9o6xZTPPyswtsZ+nO/n1DREn5zz5mPeMu/FZJ81+KOw wpfYBviDxhCNM8yUY9JtiD472K8BGWZmizbQbxD6mdLFdjzxftzx2O/0LY/bno7vA/aJ7yu4 D3QYD8vYM78gkN9XoWS4xfAMDvST9IX9TyoJvAG6U3LP39S1pfhs6uJ9rb72KW3esfK39J6x Uj596HpPEgDO5FAhtwP6iNfgPV0z6MfmMJ54avmC9rOYNUUM21xmwD8/LtpuTAfGbaVu27Rd JrwUzi9JP4mnXRhM1Io9VYN3L9Lpp0fFgcgfrfPBaq1GDHNsG1HCtfkloqRK5hPhvhXr1xPV R/WSEZMuSWVrZo6TWuhb8Il6jbhnzqExgwnsaIdHY2ZWvSdJP0yG/W9gP9J+Gu03RvEZge5t xSe5HMfwTap/6K4EF7uBfgs9IkPfPO6yE/r9+996I7wJmjsh+kJ//Yv2QtsMDQHGbtj6lbjQ EkGVWSAFwXWOM1JnMCTHxey3ltBvilqgA/1iIICzfgn9HC8suqxhkyb132H9lgb9vB/p3aUI OOUSY5P9uMRwnjpYDDP7oS2Q9mg1girKDS29PcR+RH5EXSRI1KrCepWLcNfqh/hnTP5RuXvl kvYcbDfsMn56+94DtBjRYbQJFqn4ZNFsKs2m2Y/R0TAcQvJJ4rFmHonlS2Qr80KD9VPvE9Ua XZuagMhdqkye1fO60XsOLTX/uX+OkgTvHnU3pP004cGHhWDLFO93TsON3ZIKctqIP6g+lWPU kH22wF/01zrgL4k/iT6ZkKygT2uc2USAii6atWzaQL8h6BdKl86O9+OP3PF4gOjTQbbP/H0d 3CfsF4pRD656AQwPDd1NjHLXQD8P90TEBV0P7CeNJm+X9675k80Hu+XyFq1gDilGRxe9J7Ct r5Te7sz5p+EmilpZPObyznXaT3od3lNfRdrgZAll8DysH9sdeODthtYR24posLnMV69ckf4G v8B6f+PGTXj8DPjR24xmLLM9Q+3puVamZ+Ca5gEyZBMx1RKS56gCg/RTlwCdDyywyyiRmqyf +KWzF9Lh4Y1jCpdiuAPAL7BvL/TLTgawEuXLOwX9lEBR9J5szLgR1xoz3xJ4/41ybGs7DSYw pdoOyM+wH2MtyCQOKz6tZWkULiotZdlbo/8mU/Cs4WP8rYfF8zrVGHkcBtnCsYl5mbbUzfD1 cZfdoF8v9jPmz9DfT2U39M2w9QtxoWVjo4BRZAHVLnD7ef4jRN7vcdsjKlpb1u9XBv2stk1k ac1fExZUaA1LTEI/LpmGu9DUA2ZDTw/32AydmkL2/m4eRvoxkkZG4oIjK72nFArfoJKgH8Ad TpcuXDh//vwFWQsg+UTIJ4Ne3HaS0E9qmCrB9HbFPIr2I/wk87gXowozGas2fTv0M71npFC7 azNDqAs/qoWtXtlmeAs3f+X1vgIO/VLyWWI+3e+H2e7IOqcuWdPdWRGhF645D0oAGQn+pPok 8UfJhL8OfdjvD5iHhfUTj+QG+pFl0mWYZ8sb6HZGuxPkXx5AfYJ9PrydOk/ivf/xg7SfLyU/ ptwTRa+NcreBfs2IF7+HI27iMl8mXC1DI029J2IRo+cXtAI6ZCXkpRbZw+PtA1378rC2c6lc 9/cU99jS1MrFXp74jQ8QbmUt3Jn8w9W8praLLVyy1GpVKGntCcbLcDKXTVhC0jbS1q5fJ+y7 Rdx3/8HDx08A/KLHFciPD4hSrYAULDDJjX6SeyrjBZqjQvqpCKxCXhZ9VnpffWiN+qDfls/1 a0M/Nn31PB87svPQTw90V+8ZRlxvzLz6gS35aGCzJAOKb+oyFcBAvacrzNFuQqnnxvXM+Jym +FQYTqb6WbRDzPLEvRxQfPbeFaZI9XKxWzg20G8JS/y4yw7o928cthHWvJ92M82o/SvJP7J/ PHI/bP0GSNCnQWAhYdNTWx8Vn6L6mbsfbz1LFwo+V7EYtroPUy5n51JNFooPsX6GfjDuhCpB BAOHSrDRCJlyKr1fxvlhZS/YDFDG4FSOX6AZH0tAe66fvbApyhwQfHLf4CJTTfar8jA1ic9/ fo/ZL9WuVgOAcvuItJ+OPR8AdSEJH5lxprX0VlWd8mJWPzwsDHlhm+DK5UsAfrAZmK1ctB9H x6LJmCp0llsstCQ6jQWpwzySehT8BJQ3q9+VtlJCNh3WazbeyLTsdCVYUyv52+z9LbpF9d7f zR+u7RXADizar4v9QGdjxgNnuxP7megTWbQk/irVp/IPsi765ZdpzB89YhwJgL6ZiT7xQpAx QkwWvNLWL7ecLDFGI6IhN6xfD+uXWx6KDlTCtqpgOfAND/tdbHhEfcDygn1/U6An5ncI91G6 i8O/F6yYBHToZsk8dQ/xFldzoN+CzO0yXxM92F5bwkL+LkbgBANQxBFactt6T6WCdNr/Su5Q IuJO5GGt/XtqYWq1r3IyOtvCE6npCxS2rMDrxzgAo/20+QX2Y7uek7mI/m7fuvWpHbdu3Xbc 9yiAX65x1QoHmsg3ZiOHlQDuck/0ZbGnZgB3NdkBwBV3b8FH21e3MA+Zhy2hn2sjKVwC69eC fn/9i2diFuhX9MupZFz0BMd+PtV8VpW9WbSZcq20jbhdvWeacJplDAAahQaEfhKwFMWnVKS3 axWp9/nNlh6N/q7ik7WupXf0KT7xIbTCrIDpHlfhl6u/hqdUTm5Jvxv3GR36VbRf0SOxNI7N UPCvsSMaFMz/UiPzncqXL5hWRxEf9j7xwxwE8mEyz+pav2bQz9QCrxn0K368Xuin6rH5hnK6 U481Tmb/UHwCd6HGMY3kE2okfRwC69O9hv32fPDBhyyQm5kxsiY3p/rxDMEdiuVAuhj95bCW e5T09ZtwUhEzlmgWVVyyoqq1mBujYka5uyBJgadA4hGaU8BPQNmaeYRvUEqJRruMuQy5Zoql hnKUC5uT1JvRDktamV6rHxM1pdv9PBuN4/0c+508jaDPyxp1dQ8t8afPrCOelr8sjbB4cNTD APgTX6R8ESP+bPFEM0RDlkPzCZ8Yu0rhE0vab4bCZAP9JkM/w35u2KPS5f8D82ftTgN9fbhP oM//4+Z4LEmunwN6h+FB4Z4I68mxDsxpleuGxVLOdZjhDi73vWFtWZZ9zTTyjuJFdsiK3hMP sPObld7TPA7F9JPtzn7Tz3JPve+nrft7uk7QDwVM5NqC9hNMQ8rnK7WcYDS20Vz3Af9w3Llz h7/cuw++j7jvmRi/LznIphlmHOy39mXKgvEWpJpHyi/L+sPe7IJn9FOtS9BUCfbd3al/Ngn6 xdACOjwmQr/GgC5rZews9LOJY10jLl0rbsRlx7+p9+zHZ+QiqLAV9BPtB0DJQWb50jsTF5PC PNQvg16s2vMKaUbF5zgMsoVj5nbHBvoNvxPjLnsN/bQsWBIBtjOqWDSnVruhbYfaE7v/MUiY 2M9kS9r8GP1fd3wooZbicz1Zv4kNOSK//2XHjOgHLbl41aB59CbLerF+BdFMg35tz0fDT9wy +0HNn0Pdn0rQYfJv4i5iPxwfGOo6BGqEqVRRTrg/wGc7mMdchgA8KaxzL57HUCEewn5Kz4fi E2zKbGY/nyDp8BOaU9oNAT813/VmWv3qSagM5dONbJsG66l+G6vf8Frzn/wV1JSokVEks03l ShmOw7XnKgx/FfFnPhhO/fa8l5HgT8Qfoj4tdQHvRHGK9aVD4txwitPvwAb6zQL9hN98vwvw Zxsd/h8boEn4gd8g5gOW54HfOfSTfA5rLu+fa14s4qUO96QlTrStJLuz3cDpt3jU3+BjjYea qhuPfECycwo07mHFrZptRe9ZyyOK3pNj0CjnGRB+jTqxOf/yur+npvdcicZprOATyM/nWcrt p+3PsR+05gR/Qn8PHz548OA+MN+DBw8B+xz3vYSqoVrc3DQRwmfVi/YDhfzU0r0HHQ2FX5zw Rd6bKUce9ee76gzr1+THIlc3o8jI+qnjzLLjdYR+epqdk5crTxjtCPrXXSNugX7l5aQHB+LV CN/9QP0mLjo19Oua/VziheIIff5//UvrG/5j0Q4/icW1jM8Qek9+8cdhkC0cG+g3+Tmf6avj LnsX+hUFDLGfgz/2Qr0b2kV++hMIZGwiLrLqpFqizd3DYBuxvoJ+GOu3ksXwt6MaSSMv1U5D v+zUzJbwWUO/PgebbxwuKH27Vv5EPlairsh5kdmPeCnUlmn2kywN2I/HXmNGasLN7SONqX4a 7YAOufjhy5gohHGyPIj9yKcgQBE9aCg+v3n1vTIH5CtQpSWhZvmAihllhtjHUJ2S9wP+BOnH SI7jUn/EfFdPL9CiKb4FulPKasy3mEMKPebLTMxLEabM9Opu/tIaXQFswsR+Xrn5iIfAfp9k 2AuwnyaRwPFH1Sctf9YY56QHB398bg0tYJPLowIO/0B7De1y78A3sZ/nQ6KtpPk4KrKZQDDr Y5nFkRX6oe4jxaM6X0y4dnwP2qYV6J9/x/nkjn8bybdGh1c9EQtBmKl2e2O1+h/eqBH6Ita/ Kfhsexxc5+KbnXa9FvDDjUwOV7cwoZ87/TSn1OWeJtjlWIeKtA2z5g4hP38gYmRQ0Xti1a87 ZCzuK+jHHtnXaNVhva4k9j7gayDuYTte5zV/T2FuWZm9ZS7ox5km1DijtZ/Yj9NlfDSX4N/j OJ48eSq+D+uaAT9SfmWGjR4PKp5FFATy477MlwD7OrpX50F8IzjN6GHTrKMEHONWnvQU5erW hn60eDw2wedU1i+9fjsv+MRSZt3GYoeK3PWO3lOkn4xZbvUD3uYcRa+6i9YOb6cLPrWNvU3o 56m+Hh5j6eeQRNkULexWvrRxAGSjO56J7sFz9NH94xbkLRwb6DfpKZ/xa+Mue0C/2u3nrUxl VhP7aTs08Ke9sP0fA4PAfpB8ckYV0wpk9vvVQD8b6Z7iF2bZYG2bpSc/8abiVmIdSK/fnNCP 6pw+6EdOgz+/z4dQJ2JidGhjsl8sBpFvKrMfpzeC9iP22wvk9/EnHIAWVj9fWPqsfqb3lLiN yI9TZDVGVj4qBL2kwMHWpKbZz33NUYlQ8UnVKahHwU/oPWH1I/MYIaMW92UNS7Y1zOon2ekj BpYbgXlgY/Wb+Fj+Sr44WFMyP4jY7+hxE32a489Unxx61QZ/qKAngD/zirFsov2V6uOYDaCE SM0GOGzzwC0gMlI+8fLiFKfejCyONtCvxPwNQb9K5uK7XAP4WaIFqiJWKzxMFiX3MSqkVLpB wk6+g1UvF0a3aorxaEa8TL99U+/vyL/wBp6H5qJPmT8DuXKZ9IYfR6mqtkd1afIIKuw5qq3o PfnJhi0/I09tzr++5u+pQT+ruWmyco51GZEXc0I/d/sV7CefscAfZnO9eP78GQ5APhzPIfME 7BPug5whgF9paRH14fCcyabm2doflHuyKSt62MSH3vuYZfWa9kzk6jYe+kG8ZL6V4vXb8ZgX XBJ7O9WYwRiG0pjpMeIy3zNfzmyEs+oOohWUvBGtRvtFWLVDvwbXn9lO6PdU0M9yFaof7jVS TMFg06dj8sWnGNGLwzq6gX7THvRZvj7usg9CP/Yy+Vwl9JuA/cQHOu33LXTeoXnphX6ARb// 3X8Y67e90G/mke7q0WqjDuinGJoks1AENF9RqwIsm+VemYOneeqSOalZaH2g5kAEziwm5/Yh gB+Q3z6WxiTcyoIF6g6BxNg0cKjMNY8d8z3pCLh4nsjv5MkTJ06eOgXe78Il0H53pPicZPar 6Dr0FkX7iXnEWXzMPI6aecScQpsTAQ/LP/hoW0GTvexICuXoWQslcgy/OIif5cXd/J01uwLd mpI5n+/u2q2plQx74XR3pr3Q8QdnKgcew/Jn4M9knzbqYSr4w9PIPgR8MngrNBdOdjG2RIAf XMusECkNBFfbfEbaL4ujDfTrh36p2uRN6LQ5A/p5uIsoP9YqfuCbsVNyKaF+ABUSwJGmmSnj hdM50I9C/tWaGP1+4wOD2E8s2fEtvWcskw3SD5HKrQjBCPqbMNp5e17o9X5P1w76ifbTY+u8 HztOls4O6u/zly8/qw7CPvaygPu+/U6MH8QMHHDCLdQ44QB+XL/Q/ch3QNs6It5D7inemxPm itNv8c5Hrm5t6Ddd8JnQT5EFbGDv/Fy/GvoVvWerMZPSJSI/LFpZxjBZ5x4Dz2lA8oQN09iS 9vPhDtwGDPr5a69pgY+fpSweoYEG/cQNw9/TEHkVxafiO/ql3m9soN/2LH3Nf2XcZR+Eft7K mQ36kfcT9EvWT3aHXwn0g04QrxoSPl39stSEz3D8gqQP1m869OuZWcONuj2uNKEfcp982otF iKoBXA0PLeMdeoe6a6Uh7UfsR+QH0g+FcVugriGwAf2gbtM4PS5W1IVcOEfkd+LE8RMEf2fO nWd0vhSfbbMfxSWokxsyBDgKMEWErhqcwl4cPAup8oJ5lJo9g+uwcbHY5qoGz6Zb/a5Xnsg0 sGysfs3l5df0/7QRoztS+f0S+8FIaqJPpr3I8XfrDqaRGPhTlxy1EsVRUSoNMn9AE64ZNNEn m2eUzDMqxLwyVExhdYm+ua0vs0qmsjjaQL8e6AcEJ+ZOd8ChX0PVUkM/ufx+ccqPUlF9M6Ef cbutaG5yCqlbIf0yo6fM5li88h39Nta1Za75OQFnqt6zUVxWOx7qeftYM9DQo8956jes8XvK y8JG93qwfgxyD7dfWXTQcRL442Dmr7788osvAADtAOr78ivDfa8S+BXkZ9DPCAJr5zryg+hL fh8Z/ST3ZGmk4LSGZmHqnZ36F4Ik8yzJMV6/9YR+bMY3hFip97x5u2XEpRwbFx9ljNpOKmMU vGfEXChFuPAAcOv445sY5cmZ7hzsJ+hng+LrcCeTeEHa4LLgqtSyny7tf8mz17tPArq8+29s oN/UJ3cFf2HcZR+AftJvN0g/2w9N29n3X6Rhu9fPChd79y3m5bXx+g0Nd0AbBPNAh7x+2wD9 vAOEMelHT5CUS1MGRJQ9wx16oF9fR8ugnzn+uSAUdcGg2U91DpaaygdEfQGFTaD9ALxwfGyk H/Setq4UDBlWP9a43yu6mvohE0edPX0KwO/YsWPHj584eRpkymW2o6D4nNHsx0ZXgZ9kHlGb I2nGmUeOifgq+2UB/VCvNVyL6PwVvX+yoygtVvCibn7kul8B3HeUFl3s995uhr2wtYApDyL+ YE3lnIc79wD+NP5KzB8CX777AUPevU9ewB8wQzkcelj7lps4A/JkltHQk8uek9Bwy0hRPhvt t4F+2c+eAP2cuiDph50uNzj8Hn/CiBfdPCoffhH0s81gi7gxoV/qPT3hzAgP3bewabrckw/V ziwqb/BxaIj8Q+9p2V6l+89c56L35HMZek/AWnXatK035RFV+beNL/dav6e/x2E5UZbVv5OC T4N+pP3M7ueaT5ZuAH/o2wP94fgqD/wf0H0QeqKLZW0syXaM8xPp5MDvb3+tvcpm9zGjn0kW 2LZqZrws5wXogX6Hj/lwh/D6/dA/3IFpdd59pjLKAgk77fFt3fnxIBP6sVPAZnwdv9CUT2mo H1/PAv3i7UTmemH9KBR5h0Jzw35/tKBqDXfQ9K0TKNHcDqMyC4OX3d1D6AfsJy17DFF++pCu GCc64kqhSuKAVW1G8c7jY2wEn3Extu/XcZc9oF+2g9QE5XYm/XalgMntsPc3QH6CfjmcyuKt hxI+11TwOQT9/tkP/Ywt4pzLJuvnzteFAQMXAmP9CP0QyCtXRgX9hGU0cr2Gpv/i/AUn1Sbq 2H+Ln693tHiKI+O0gEtODlTsUyg+nXKzpcYCpaDnF+4C9uOxT6QfRp9pqp8rR6m1DOjHfcLB 42PWSVdJ+oHzA/A7ehTg78Sp02eho5PiU2nGaUAeMvsJfgL6QXVK6hH4E5pT03tmyOgXFhUq q5+xfkrG4mgHW9SsW1b1s8yzuTP1zPatGJt/aegK9NaUaJIg6FOGv/0HmfQJx5+pPpvgj4Ev I8AfFlyRR24Zc+xnw+E4EjmbuHVG3gz1kxcTqe/zIW6/9pgXoz9oe2JzG/udNLcEfs39TeAv sV8/9DMVgq1oZZwZaklzOVkgQjWYA2USb9y2VpX2iOMf5Yrfo/esZzvHBBxndYzTpN4TCyU8 0ZYjIUVZjIwuyvgd+FBUsfJzCdRmHi/ZjTV4T2FvcehnrPuOev0C+sVjb2sOYJuBP6I/wL9v v4kDvyfsI+5z4JfIzzJG8NJQPSPKj6y33D451RmDSVEYlJWregX0BgwtuyP+3Fe3mOtnV9eh 3wOPeemHfgoqDw/bcB7Ctj7PeooTNA0MXpFppQxeibfzG81IphE3oB+NK0Lcfxb2+yOA35tv 6bVA6xKsn+LPafH99O59DVCmJ8cyACYg2d8V1OHSyghFQ1F8olhT30fBPR75lWOsq70InyM/ xZL9rVw5Rzwf+VfX8JTy3Jb1m3GfsYZ+6GRubZWtkHuhrA/ZBuUQh/5Dw96lGkBWlMeTD8/1 gwhirRI+MdyAJPgHGAFO52s6sCPg8h9N6EdoVQkFE/p9EoLPJUI/26bB0gf049w9dYAeP4US kjRWL/Tj+cGNJ1O+5Nlis+QWQsB4QppYOXkF3uHQsgCXV11e4Pl/LcVn/fHN80/K7eCBTz7Z t+/jfUB+poXrWP0S+kmh4KWE5YBhejWQ39EjR44A/B2n5PPiZSg+qXFIAzJzh312rNajKpuT TTsqPqk6BfgT/ORJGPPYkEoE9Au9J02LNqEwYww3Vr9lrUav+c8ZqCkR9EnD30e0tJrj7+x5 BhNdv5nMHz1/Bv5eJfMHBIFqmrJBdFSx1Obh8CPEO6KPqByM4ah8tivJJ8O6GSQ1E+3nr/gG +tlcZ6g3UAD/uxpkWyM/c61zj8OOxl+IA2ltIu8Xt063TRIQ7ZaWlYglUWY4t/pdZ/1lIS8S 6nrYAk2aodSdq4JZ8H0SRHJaQUoSCL8QyGVTeEoF+IMqQH5itoCt+Cv6fNWWJ47xgYwNZUf1 nrgma/ye4pZrmLZbK9cB+tlwP+n51G8CcjO/zg/fA/0R//nB//O94z70bfEq6F0g6RcHS0Ra 9yn5CpvyI07qxRtwQWNJZXal3LOR8VIBhUWe6Td6QcbZCzFTKnICCuHPDw9qw2ZUBfS7jSg8 DkRAf03dDI7C4woLoLHI2Y39XnwaNmYYvNdsFHgPfergFWUwOfRDqqolC78DyedbIP4A/Ij8 4FZH4zImX9nQCBNXyQ+jYAcTN2BbksFH5V5mO3QzPnWptBn5B+6/K6Ww9ia8pi3aRrhJ+Bz7 rPT8/XGX3aFfk/TzJijbOd4F9c0wB7h3fsOJ7jILA/nRqPLogVm4bOJdTAHhWCPtfv8R0M+h FfogxvqtBvqJ/TdoCmCmUCaDfs/SBDcnNOXqGz3gyuxnQ2SqcGRHl8H6YayhaSXKIHRVOYfJ uenYD74NqKs5i0YpLzYjK1JehLkYFX6ZpB/UngB+hw8D/IlJQdCLJ3MGxPXK2fmRCn0X+IlT APok8iPpB73nmQsahVEyazQKlRtXQD+PreNtjDScPbsxPlsx+i0lQ8/7tvmj/+Qr0FNT0i3B sBeIPtE6FfGnVoUsfwR/dyn7tMCXDvhrI4gtP6zDKuwnEEHN5/Onj20VRVQkbfvs4npWwh+i 1p7eA91Avx7BZ2u/C86PJTBBH44ff4RNE4fQHwve9p1Tn9QEn8b6BfQDYJd7mYsiU+3N5vS2 jfQj8nPSbydeG1/wq1BnNvvYTsRie/tu1Wej3tORn2XYcBQPQ7W8738CH21C33+7P9zavqc+ T40KvrURfJYBzsF2s+VB3RaqONRx1UG6jy+CvQZUP6MNktBP6e/6Vg6mAY6yuV6B/KR4NgQS ck+Vf0t8A/BA9/JL4ViZAv3EZFs2SoF+2vx3Avp5PRZ6zxjB4POpmkZcLUfWmKHPODRUwfrJ Hq5oYQxTJPbzI7YuWv3Q8mESgli/OgoBLz5UboRk6g5YuZecvys+S3REj+Jz6K5c9vHxG+i3 kvVx3GW3FmjVA+2Rv/huiM3QlgYuD52D/aJvNR/mZc6l4jxPpm8cgC4YzDOHuqBdbc5nyN/d mrvMPtg4OjguVbB+FbTiRLlp0Go6q7bgDW6fX7KS12JOnSVWtqBfe+T8kCDVoJ+WTu8y9Zn9 jFjM8Q7qcRP6NdYCCjtI++0n+APyY/I99Z5KjwreDsPhtXdgn0GTMK0j0nuC9CPyO3zo0CGA PzmoznOIaVnv+if7+aApNaLRZDf4uQ/Eo9XkJ8LqF5ZBDqj3nUvRDL5k+jgc6XZDxM42hTX+ trXzt+Azs/n25V6BTk0JcTSKOBOTGfHHPofZUy9eNuYvwJ/P+WMqenj+HEKkcnDLD8N+yooM 7OezwdUZoeSzJKSPof020G8S9PPLToWLuA/VvyqAtcNF2YuWFSlbEn/WEK9uW7B+WhI5/cCg n+H15kAzcrVrQPrlKFd3d9McRYlFNUqHq2RAP1soRZBUbp/+2m/Hlsq1fU+F/TxVf8niN/YQ +pFPf43d5bvp7NGzz4ff2h6NIg//p/Q/rG8LuEfsp19IDRAzivL7hvG2aFfB6kPOj+3ck5a6 3ZhqWd6AZSzUUSLNVkvyAiDmZuuXYP2siFEsJqBf1c4orN82PtH4MNX9NJ1XlbtXlaTZmBFr 674VdmYc+pkEirQfxsHuepfgT8fbaFoWp3rUaKD7DfrRVyMRWUA/0n5UlLrTlz/fFJ/VpepR fI67K1xLN6zfEt6GcZe9QD91MWMnRB9TRH5zNai6Qa3fUiVAjzA5P7z+Rvox35o8SipDPAkW L78U+bO9rit8MHSptA8WuSOH0U1i1SQWKDEqE710i64aM9/KpiC1Cf1i6Dry2Iw0aLyqWRiG 5jXNfjcbqEtaS9Sr3CtiLfgSaw0xk1z/J4m7Dh4A+DsA5Mdi2OuJmBs9ZPXT9zPBHmpPAL+D BwH+jkDyeRpBL6745FSGUKGH4lPMI1dunoOIw4SfzjwygwN6TwLICshDy27QD883HYde0fiY Yunq4jIVXewSXsvNj3hNr0CjpmRDVtgvuqcg/hgnJNUns4kI/m6E7BPMXwv8UT0oCGGqT65t W1uU2eMIARaqKcm1WUghKe+OtUaMQSq0X6AInN7kC5tvuLEOm5HuVv9Z0GFedJOtoYgl7MPm RqkbtG4Su2GEtQf1EA01sR82zFgR3evXhH6Fqi2sH+q7qXdt8j2d96tvZG2Jbic8BBkaXa+S noVV0Qr2QFYJgr0Zf7Xia94TXOD71vM9hTQb2O+/GfC5Hqzfv4e0zg7+CultrLd0z5I9G/Ij 6RewT5IwA34xz7kP+WnRsmHutmrpSZm2bs32KOCJbrJ+Lc9O8ktWIgX0Q3yJvH4J/W5KxliY bEp+tr3vy9dzit7TKqHSmDHox+QEDTl26GdKW866+hCwe/eu9wj+cLwD4Ae5ivvUrUZTe75A P/MPMduCB/Yk/AvmbzJjjA+PkN47C6W24hMfpHlXoqrcsH6zPdbz/a1xl73ZCArkxx6o9XMY 3lL2wtCAd36VNxjA74tEfndu2VCqWqnkAQXrCP1m9tK1oF/OhOkbnjClKJt6f71qa9GjFLIb mGmpGTyBNN5V5rBAoEPoR8EYADhfVSjuSb26kBEPi72kMvtlksxpRnOaQa5CXan4tDbQt2XA L30toP2E/Yj8NO7aUFcBkFXKS231M70nSD8iP2DHAwB/qqTPOmkYZm1GmU4w+4Fgdvi5HwfP gktbm3lEZE1CPy+xw+pXYuvEUEvvue2r/9RnYvMXtvsKtGpK5bSbZ4IpEiD+oPqEeIZM9Wnk vQTzp7TPGvwh7RMgQs4xhxC+v26ZdtBc1nx7qxlxQSGhgx6TmpiUF7SfUMTkC+JveLhHNtCv hn4Btw35ca8j6uP2poSLV55xgSq4unE1+LMfwGaYRFdYEuEbVjuMmVEUfBaVrpkdlqh2m3zj e75qy728RNHqcw9BrPeVr7qQfhJ5IEbCh6iaMD71nvVCueiO13POM//Rmr6nGqi2ptCPT6/z fngDzNzT8PaE3RUmP0d+lHzaESLRyujjnN9N+vzI+eVoExn93oRMvaK9Z76xk/5iVLsh3Joi jGpAv7/WOeXuYOPrWgY7bW83Aw9wVmPI94TeU1ks/XpPNqHs3rEaq6DfbQxJ5jRFZa7vA/Yj 70fwx+O9XUR+yHix0UTWX5ethkHqbLC3oJ/RfrXKS1SCzUA0X2SPMybuyo6TO+XRWcNTKie3 pN+N+4yxDzadv9jKRORXeyG3wgh+6vxqicACfi/E+SXnXwmV6HT3qS7rw/oNJ2jmNIBmjErX Iry6dKis2myf7h1aE/FVNnyCfZoK+hkrdw1VSNBZobol9ONeqX/CBUC22ITr3312CS816FO0 H9tAf/mxsv1fo6Gb2A3YD8ch1MGGuigj95ExPQPdi1hTSWCGHAHaQi/abkV7r6sseNVMPlN8 FvhJ5hEngaDQJnXYgH6txPJi9cMc1D9T8hEIeUmv5ubHvJZXwF4T7MroyEqu0CD+0EJl3Is0 zi3w53P+kvnTnD9iCKk+K+LPAra62E9D4jj8hPIJS3pJt9+stF8uIhvWr8p66E43++tPPwH4 Sb2CjY472tfY57DrlYlmfuOM+FNb3Hul3C851w8OTWNqEcyqmBd6/aw3rnRDVr47CP18uQ8v UX92fM4+LdAPpSVWe7d23+R2wjG2IYzv8frszGu+lu+pDdO2FcOy5JbHgACZOFaYrca2Pr/c PQ27HyoGS/SLQD8iPjvI9+Eg8pNZI1Bf6ENtoBe0nl+g6aGIB/T8bUwvG7HknQA9bK6DF388 a9yq5TwjUe0G9Ks8O3fudz07NfQjl5WTnfhUw5uk1zWtSb/73TgD0YIficVYky2jEZfjkcXM sZAKElNq7Cb0s4RPaFc5C9Za8Zp1Bey3532iPx67CfyoVNHMY3TGUWPZ+OQK+mmmu7F+KCeh Zy+KT8YGmsrLFJ+dPDy7rXFXZnsst3A0ylZnLHrL1nnvyBqe0oKPS/fbx33GgH4m95Sej6b1 zPtlC5SYz8AdJ34OHJwD+vKzF8+fPX2MiBeovW/YE1g53XP38ymnO/5g4FJV0A/ql5ybl2rH /rl5jWDg1aVDDVRtFziJJRz5ymKjLRfcAW8i3yG9qrGqYSnwVa3R0NKqZpslufkkBT5i5q/S keGz09pZzH6i/ZT5VNpANuoFs8ek2KRXD3pNCTYxnkHRAWTtOFahZfXLSeo3rlxSh5CcoVkF IaADYyfFZ2X289xha3b9I+HnS7TZLSqmhp/SnIbeszCPM1n9VF0rkWhD+nXXl1/hn9hrQuwn OU4t+qR+xvdS0sxt5u/u/QcMfHHwBxTBIe9//StTQ2rtIF9dyT5FIhUOCUACcua7BiQK7Ufm 3kM+VUZNvCUDi8iveLiD7XlKsybpYdk6oVvjZLOyzeU8a943RBxKrivRJ0NaefiWGUwtw3lw x0Kkq1xWridF77aj0K+uLQey47Xcl+x4ktASIEvvaVaiXr3n9Cdx4mO6jC+u4Xv6Fl5UH6b9 lmZpLzPZYA7oB71nrfgM2i+wH4g/grrOIeiX/+GXbZqXMX7y+aDnbzY/FH7g/CTBEfKz+QK8 ECn3XDL0C8+Oq5YmhKBX0M9kjMouktOfQMOlUc3++DKezJl+BstRbDD/VRdjluvHpLowzoQd j3WQr14R85I+Y2/FI/mAo5YJ/oD+eOwh8NPgK3TGYaqBsgoSMvxsVnpfsutDbZViXrZ04AEJ KsFnILrik82fwYRffJKN4HOme77UvzTustfQL7YxUn7cCfVea8gnEd8XBHdDx8uXLz8T7gPw e3j/3h0hv0vnGe7rnR8RKRorQL3n7zDrpqVj3IHoV1wqPKI+P7MYH5ikm2ihd2R60YnX6VCW eGZ80TJAg51ewrLIYEGj5sataiGwGZywDKl8FPTDZp35JbdNxo6GlgeySaCj3GJulVkZthVA Zvu3eepAXaxVHfo1Rr2Y2Q+3+hRyWsD74UBEpwZdq6EUJzrJ6oeNwlNiZNMz/RxaUgrnjB8w 0ewHFQL0mhX8BHjsMo88h4be061+dhOrJlPIYpdxF5f6cm9+2I5cAX9RCP60dEn0qRlJNE9k I5V5LzX445y/DvhD3ksh/iIzhO9uE/v54EvfzT0wq+2a9vkOE69JvuAb1s9ZP+151iZjT1sS FwgAFFAN3IetrmxzX3zxpcYzGmgvN45LYUA/a4aFQVNZC65iryLOEq1HzMvEm7aaL9piXzX6 AodMzo4vek9b7EMd8WFHGL8kKmfuT7+O7+m6Qz96VUn7tSd5deBf+QMQgpYGaq+MBTyA8lPA i5CfurCq/JDvx9LPelXLJ73xSBMtIUC1zL86ysDaGEzcnH/VB/2wxMoV48OZjaTPQIRl0ZPT n+msxWyeu/Se+w9i8IocPujDk5j7xscsoxjDEtSAfik2R8aG10JKvRP42/uBjr0EfjIo2Ewi 5ClcvYH2+sMnhH6a6xcxL1t2NBSfHu4gEUqZhOERHl5S8oPqrqxDhV+u+hqeUjm5Jf1u3Gd0 6JcbYe6EweTHVkhsB3Q3cDzH8ezp0ycCfndv37oZrR/kPmq8SIT7qvGz5tDvnMYBeCZkgX4N bJURl2ScVmQRxp1U8wSMnCu/XYxZfHiawan0zQr62ciadDBDewRo1etg5lZp/0a1dlqmVJg/ 6ogVg36Z+VTMfjaSHdMZOJePg/k45loNJYfQ6Cc1rX6KV6kTWiycc5/GAko+R8pOQoeHDbOf NO7cqxqT/UCMXGGnwWJChT91EljarjG0nFqJr30WaqS8FKsfs3o02Kd1lTZ6zyWtSa/9j2nU lJXok1GfnPMgyx/8EzX445y/G5/eKuDv8y++5Ix3I5CM+JPocwtHjf0YpOQPJ1OMIrXN3X6R laz8WdtuJ17esogoXH7j9ftfg35bEEg0kZ9iyiReyY3us89evsRt+wr3LcBfYWyZeoUj6q8m WGf2FXWRmBRG95DN9QuR7vJYj4m3vvXFerG3HSUeBk6yzWanaAWx0pEdb0NiQ16Rek9TR6yV MH793lOn/TBNm8O0OTx4RwWfTdaPr8A46CfUF7gP0X6R7Aex18MH9yj2BO7gRozCD5wfk90b yC8aH8tqErB+MeinJxouNpUvQ937hH7/E+ElHlgwOJx5+wb78aN4vedt+IbeUzUM1VOReaC1 x0L3zGfsGpFbDNnQtCwG51FJhWlXH330IY6PNPCY5VUgP2xSkJDdf8QU9q/a0M+FEW3Fp43S ojrWdWSJk2Ndw0fZsH6t1Xcb/u+4y277IPJubUKRIz9QftHQsa3wxQtiu2dAdwPHkyePHwP3 Pbh/7+6dW5/euH7Vnr6Ue9eSF7J+KJ/WhfX7fd1lcWm1gq6N8YI7DAw4BJUN6DdAqy3VIsy1 oCIlNX3XlN+k/58+ByoL6Pfzz3F6WMkr6FeTkhqu6Ca2pLPs3yjMZziLRS3Kpxfy8mD9VC41 M5/gRWKbSTPZjwL42Uh2NpRuzWT1s0CEg1qjNJPPRsI35wL6mlegn51D6pByOKDgJzi/Xuax TnkpVj/lMkQze+8ebFbVTNft6/ttw+qw+SfmuwJVTVmIP6b2MepTqWme9xLgj2mfl65crcHf i88E/oghnPhz0ecWDmG/3Gs96sW8YxYbojk5ntVkzyeBBDRfOLVJn2kD/dIhU7F+1utkOCcF jeL8UMa6Wx07nW9zz549f/7iM6I/B3/VjVMjrIJ+08x+UFuEe3jaPZt0P+f/Gtf6ZklmDgeu s7lSe39MgyzQYSt6T46toN4z0rDoYWR6h5Q8XtHPf27L+s71e0/f/CN5v/WEftQrN6FfJfh0 t1/1C+c8OOyTKRba6C8Z6f5CLh/mO1jHX5lvni8J5Aexsz370HstW+5s9UtHuDXQvTeiA8Md WCVlDaPnWlN9jx1JByv0qb68LuvRnPZz7KOwFPN57sx24BxnG7xiBV8mnbNpqHvHN5RLD/SY 6hNiqChpv/NncRcsfoE2Gsy70vGJRm/Z+Cx05y9evgq9J4o0VJMs9EJapYRPE6IUFx7/BXPX 2ND4YcUnPsoG+k2738v/+rjL7i1QQj8+SKZ+AfLzhg4TO4H6uBM+Ibh7/GjgePgQsI+47/at T0n5Xb5ofYfDBxukn0U8rRn0o7a60Grmqu1gK4d+XDZaZro7Mr53LcLMUVno9nItGOhocQRT 0P/UZicytUWNEh1/UZ3PKvR8DWpIzbdLwzD7qRFcZd1U4x1stbG5CJFnx9t9ErwfD4neMJbP FerF6kenOMwEWqkSs6mWUJNQ3Sl0pvZ9sl/j2JXRUnejYUER9LOSzbNmohsNczO6jSeOHQP6 BP60k6CUvTCPtPpZwCftrMbcSsRAgZaFFzT166qsF7qJm2/+D7kCLCpROqN4BvZL4q8Cfx8U 8Ke0zzPnOOQ9wN/DR0+ePn/xkjPevwUFDk9F8Y3JUt/Gfo3YNnrH9HyCRAraT9YZllKTl5n2 +/0xzLwQEfWqxnUi2Aiwwk3VjGf3aPr9xYVbZSXAGzPi5+NCI+SCC7lveEJ+TKdXGYvN7on6 mNjpsOE9efr0Oa2ahbGtY3pUfgWAtJEcVTSPeeLKUFv3Z+KWTbln0y/pPH+Dzy/VcZO9RKXF FqRftU56vJ/vJhmFOEsLYp4znud71u09Be3HQwvFurF+sqri8QXC7815MayX//WRf5x8wgAI vDBWH2KYF7SeoPyGkd9KjH54POyZHuje1+1x1UgB/Xpj2i9yEJnW11brd56ncPz3aHvRMmbi VeZ7RuQeEt2bek+zG2MBM7E5m9jIYfr8BSbLYBqQU69qxjN7T8HplnsOwk9emOMnT505e/4C SL+bt6D3fPzsBeVd5ohRk7+iOpJMUMivjJE2tc02I0B7eYiqRWDcgryFowDMEkxfOXCK+3Le pXMNT2n8MzLlO8Z9xj71iyE/7oSfG+7DTviI2A7gbui4d+/uXcd9169dvXzpgroOLOg1VrJD +q0T6yfo93bJOzt3cVhRadCvsghLJ86HtDU9gS/C5Jpsyn3UshZLwds23/PAIVqYU8f+pSew dKDfX/+iLtBnz03K6HzWR3uRNyDPSdAFOAU8Lq26KeK+3exXuMU0+1FtKY2BTfZjqAEHuJ4+ deLEcRwnbL71JTSUqCInO6lFBTUTod9fVdTmG652G0wxIP3gSJYswQOoMGGxJTuVDt1yXhx+ xmQ/TAc01WmBn1jcJGUn8wicDDkDk2Y4mpnGBg8viNw6U8Vawhea2fAmWGU970oz9eZu/sLr dgVYUwr8Gfb7PcZ1WXBfMn+y0KutaqMeCvi7zVEPj58w74UYAhPemRpSwl62cAT2Qz2mzdbM Yxo9IlY6Zw7XMURG+026lBvo12L97EKz2rBWZyC/L78Qf0HTQmx1Dx48fPgI6E85PV8QtOeN sx5UQD+2TG1ZwzTGZ9Ba2LTTmMjh0khbU5whW6wtOOmOD3xNT69vKNHqtDYApwU1O2w9ek9O reiJeKDek2zO+iyUfE3X6D19601ivzfXBPr9X6a8mMLAiKOC/CzBxYf7GeYD4HPMZ6NPBPuI +wT82CnJeAexTQx4kdrzww+o9hTn10J+y3v2eaf5TDe796d6Szgm4VHxiU9uK6wa5B5cK8OH oJ9bWJP1W97JDryY9sf6JPZR+vWekGSaZ8VyWLj0WPPKShnG+jEV7IGTrxfPW0WGVvgRwj87 GMRgvXnbnK7Bj256T852YNtH7fWff06qY0udQJdYtal/5rf2UP/4LFpodjzIsVzxNTylcnJL +t24z6iXAS3Q3AjR7SXnZ3G9DOy0rZCMHrAdjtsDx61bn4LvA+67cvmSHjv6rsT6Y+OzuS6+ APzO2uY7L/j8TVk36IOZJUeF0K+lE1cnVHHXhTEyLdYbi60afnblOsW4UlqYq/BNVCH+puo2 AhTVkWzI4gX0Uxh3XTPGXq0Vh0Dce02hli+T/bjgEDOpGaTVJoe6u1CeecJUl58G74fjpDpK F+Gyo4pcqcEdq59NIPVh7Gc4r5phVB9+uBdGZE1KO3iYGZ+uRKpWPSu52mY/KpGgOgXtR+pR +NNOwphHWv0kk2+mvNTDIcA9sunXzMJZp4pmScvD5sfMfQVYUqqmLMQfxDns58PyZ7JPy0+D 50/zTU5iyHswf7fv3nvwEGGfUH1++ZUcf9IO/oOTKrXROvTTUqxUteyumNAuRDaffNQAEvEe D36q5hr3fti7fr2sn0M/kX7eAvpePfOXCCl88vjhw7LXYcu7d/8B0Z+HtMaN+9vfNPFcIXvo vEstY2IGiqIs47OayMGeWzPjE0/S4B1b0Re00g/XllV2PKs/qCv4sVJ53FP0ZQi++v2LNjqX 96nX6j2l2FEHtOHv7DzrV6Df1pYNk9HTK85P4Z5u5vupwnsY7Ixxl+T6FPcOui9wnwW6I9cP cANUk1vM4PJhH7eN/KxBwBbBEh/9KF9cJFmXcHUmZkbhtaFfKxGhHYa3jdMd7JM09Z4IWw+9 56Ni8PFKjJRtdK/kM/5Kis/I2qHu7qyVZNBiHfUDsO/4iZOnTp/xCbRCftiXqPeE1Y/Qj22f Gvp5wWvjvEJi1WP4LQ0g3OEN9FveejbzTxp32U39glUgGwhU4xH5fY6dkBpu+fdA6N0mtgO6 6z9u3Lhx/fo1w30XrN9Q9X7gcveMJzwf0HvTLrMGXr8W9MuyqHd6grflG9DvC/kfVmQRLqta hG9K+g0VZEx0d9PvP/5ZpNkdYIoxLJc9u8prxjRnaAUuK86bDes/UNd1c+qF2Y+ZvxSYU2Sg 8RHfcT6DesFGuWmhOQngBy3BOWgJrt+kihzRUfIPI9PeWT+XJ9gqkkq2/RZD/MEHTKHi3Jmj nm0VP0MtKbWjs9iizkHCUYbt2DQhh59a3nASyTw2U17+jg+AB/2Vsp1J3OIi2ZhSp0atma26 eokb1cwv8eYvruUVwJ7G9wWN5hL1SRsPLX8N8Gdz/ph25M3V6zfZXX1A1aeIP/FHDIzsYL8t LsblFfvaaL/bn5ZYNWtL17z0pEd0A/36WD+/yMrTkVGG+52yKsy1oL3u009v3UJGK9GfJnR8 LuKv4dS0hHXDSJHx6amsHvRCDZmnBrouaodov7LS93mJ3DxuQ50bpJ/pPaFjbUu9ICHpSL3W 47Xla7om7ylc4+sK/VLuSRFMzHOXmQ/p7gb3HPEJ9EHjqSlfGH3yhQk9jRcw4Eetp1qvzOo+ AJcPnvkG57cS5AfVUrJ+dfdeevbOACyUcIJ+Jt1SlFZjBFZn+vESpFuzvhB6YEWV9eo9vY5y Nba6hb/o/kXOiyk+Qfs99tFqAOIAf+fOAP2dOqmWPNvyqIuA+86coxP98lVyfnfuADAgz99h V3rO0Q4g/Wz4FX68kX4ujO8qPkUnDMq+baVZiwo/Lz/Oad2IyDy3Zf1m5GeUzGjLqg2qVliX oyImeSzgZzshCT1hu2u9x1UcV66A7sPTdl69Bri+jhw+6HNd0PLkCpis//pBPwNXjZnpD6pg ycgHwMXSlSoW4ee0vueL0MUNC9zVeIHS9esuHchziMkKE2Znx2Y272PgsjKxRi62EhARUkZv vnX+GZmLkSh8OfKRTVfKxhmXHO8RmNEOaglWBKDc2PEj9sPBpYUGYksNZnSULSo2FLZY/XTt IjaAcWAYQGMRxB8ifxhT0krHK2dMVGY/oTe5mwE/gd7c3AzsxwNnwZMI5tFkq2awcr2nlzT8 AJp92Evcrk8ve4EnafOty7oC2KD5vgj80fEXqk8Df+8q8EWePx/yXoG/GzBV3IXqE8QfHH8u +kzs9wttdlqL8RL7GpO0n4V8YvxlDB2uhNtTielmbZTtrV856+fX2De8b5GnA+TnyjW61bHZ 8bhx4+anOaFDVk05NUvYC9Xn4E2C9gN9iJ/ktB8U6GdPwQNOzwOFL9n9NIPmJLy+rOe1+jl6 cAdry8yOt6AHaiviU8lH5D0+Neo4sKkIXNZN76mPjA+7Lu+p035vrQ3r5+hnC6sM93K2LYj8 fFSfUF8ivlc8APlytDOHfNkA5+dPnz5GqqcmeZV0B85xp9Tro71Afur4W90nUTA6qeT8lvrg 5/KWJVzMJe4rksLsN1gm1U92xmhVb9HKfsvHFXUxpauV3lP+Hrcfpd7T5FdAfob9aH1h1wlV uy1iwn43qb9TOY6yDPjPD/z27Llz5wn8FEBtyA9bEkm/ttWP4thGTVky3RthT3IR+dXSDfab UvRqkVfTJi0MZGrHw3MotVo6gTCOuoPFfzc3DYvru4F+wRUlthee+Vntg/+PWWfi/NA/0E6I SQ3SceJBunIZ2G7ouHjxwgXAPueYCfzQ+0nWv4X81oz16zyi8D6IawrCy3g1Q8lsyStUacYg lbkXCy0GLmNvOBFjrB+ILNuodSd5dlzOWyE0hmomhNDEP5MXAZHCzJXSrKf7lVO6UnwWox1C UgB+RblB5Qvsh4PIzwzE1HsOW/0oZDM5qvSeH2v06B5MHUVexr5PqPiczezHoBYAcFOdOvwE 8quZx4COJeXF0/M9syqtfmjQN3VMy92o5n4YNt+4JleApQt2NhxsYOH1/C+z/NXgz0Y91Mzf BXRCZKtgixXEn4k+LezFeL9fwlxhb3Gh/YJZRxCRsfeIDRH0AzH93zOMH8naaDPXr9kjo6qW nf8fteEJ+T1ASiHzqSlfsePqtWtAfwLtj6j6dNDexH4OknxJodvvMWQIWNo032FNaD+t853a EjPQOiN0JPky5Gd6T4ojXN9CXbyNwOmsk0ut6Bd+29flPaXVjbwfVeHrIPgk8FNBb3JPNS1o fEfP/ydYfcLOl4Dvm2+g74TCE1yfDbx86QOcfZAXRjgL+LHzy5A1jBNg2bd3D5od1HqtGPn9 ZghlDJRw9vFVJoUvJh5t6X4wi9CX1xLxuS0PtpVhHrWe7qNj1oJnql8Guv8NLXgIMrFfBPRD A4suLQa9qGzPZYzmK8C/C+dRmNtx/vwFwD7gvquaPEQbwiPIPY3040B3vfzO+ulRwT9TVbzu jFSyIae6x9WqR7xog1w3nIXru26ntPAa1/4BIz9jIAZa3tk9+NF8D2SOMajFd8J4hPAM5UMU D1P+ehbdBZLLGu92GKlCn5D1l9M35J7W+1kjwWf7eQg3nUO/zwMmS1Jp0K9YhKUTj/EJ7cl5 /zW1Hd++ce3/rxvZGLvQmbgXsx34qtqN5FtaBs4/zamDwyJ2W3P6zX6aHK9uU5j9pPhkl0B1 jpUEDDUQ7Ufsp7YSkJ9Sg+8pYKWV8qLuAuOoyBd6QQuTnR6W93nsgWPqYyo+i9kvx/J5Moaa lc1zQKkFl7moR8FPidlRbt/hTPiw+lUpL5KdRswoq7TI9yL0kzRrrcIL2k/H5v/v0BVQTSnw p3WsDf6qUQ/J/J06rTbE1es3b0H1SWcFRJ8IDWFmCHk/5ScV2k8dnOgvhSmWuSEe1+QZn3Ws 2oRrsYF+PYJPq2fUwRKp5QkJ91DIul390kUeLJKyO64bR9Cu9jhunOsixfop6MWji0n7mfvY ab++kE88RxPu2tK/5PVYt7b07PhSW3r6UJB+kYVh4gi0H04dA5jFwLbUe/o6ua0fZ/r1WZf3 lPDnrTdB+q0Z9HO5IJ9b1H0AfsB9NPQJ9BXAR8RnVN/nHO3MKV/UeboRyBolABgEfqdOHBPl 52Uf8h1Wj/y60C9KOGiWTCWp8BIssiqSEvpxfY0grTLdYcciPv31bJVhR04gsCZALHwzpvfk dkHkt+UD2XAHhykbyvEajM1lrGjEfWhoKXwsW5G2qmFRE7J0cSy7BIJ+LLbQI/OyrdqMPBUn tGQb1m/60rSqvyHEMLvOtkA/yT1L8wAxsTaiD5ManDiumWMnkPMXKv2gKD6usd4G/KDgK8gP Q41ICdPop3757GfIR1y5B3xTl0sHx7WCvFrjVjlDk4SXtI7VYAMaXw1coSxroSvKBTU0vYy4 TOCw0O4e/SzTfr//gQ34dDbOZzt8zzYNlwJTi8VbGtt14FJDNfmS4j5Ae+Enh2uAfkiWBLvD KX2WuW/us7PVE/8Q/iWJRPissGYSJfHoPig34S6yvq4n4KhQ5nvOYvWjgoidwg/ef3/37t3E fqD9FGysk6gzbawj3Tb7SfFpqlOHn+D8GLCB6GJjHltWv7/ZaIdcycioWBROMiqNi7Sql3Xz c1/DK6CiErRfEH9UfSrss/b84Rn+kEm1DHyxOSMkwt1V/0QKm0HsxwUvab9gXDjfoSg+G7Fq E5eZDfRrQ78tLOK+UrJdjoJGIk0wdRxJazopClh4oEkuaZSsmi3s51kv5MdM8cl2mMojhnwq lZVpCBYepWyesMbtgNsPDy3X+em1JZKwFGFjn0kdPi3zCovGI5girCotuuwm6/Q6r8N7Snz8 J2A/6j3XhvWTsEDpDiS+jfIj8LOZDWT5xPFB2wlxJ46XBH2O+gz2KQrpNgm/6ywP2XDVFDlR fhJ70uQDhbPKPqv7sF7yjiz5CalLuHd2WZVEuVDaVQpgYgnXgH42AysiPq9ycuoRzinf0+j+ Lv+cey6BV2GV3vMjYthK91TrPS0XTKsYN4qo3CujlgZsS7BnPi1asnjAr2Uy9jQxS8sAuWej ESkJiq6VRn5n+W3JCmxr+WZ0gOM9q5XAb7IvNaFdzQGFbTWd9Gr4HCur8PNS4wJvWL9gsuyy A/rxwof6hVsXJcPg/DiiE4phvtmqp5t2UXlGq/8cB+iLHNmDkHpaaIecvt3mz9oIPvk8CPUg fuu9BrrKsGuEHjUm5+kpFfLJHogN9uuZ7vDbBRY6PKuth9WFmP2LWlj91M1qznaYMrAm/qEQ mVeTREvkt0U/OfQTQ2wtM5r9qPgU7QejJysmKskxz0ypwSA4zOoHjBopL2ovwDxikydiVDX7 BEB+u3YB/O0h7QfFp1D4zRxiGANHYbBBYWILHmUO1mUX7cdnFfBT+NNK7WQeFV+FplaMdkDN p28lMypdedzAWrq+9K0q16LNb17fK4BqgG8NDlN9DoA/PMUF/HHGO6hwOP4o+iT2q4z10ciV sMBWZKowzFAbg3T5kFJk0/RZTSu7N9CvA/22cFg30ZANhVIEa2UZo3yBXU05Y3DfErS7WNcS i7mYmCnOsZ+c8lyQXAaPjhLKSTW2NI1Rk3VkitFdW2B3GP3u2Cov/4D3OQdryxLyYsYG2+cU hmXiiCyPZ40aGn22S/qGdXhPEXNA6PcnQr/3gE2WWAbjIWrXCBNNVQZ8NN2AJZ9JZ0T5AfgZ 7gPqKyQfAZ9BPlB9mO38xKZ8EVbcBe4zghy0AIEf89wZ7mDiHYg98bkp9mTDXx1/nCpvx5Lu bP4YPNdVCbcbDXJpo8yu0hl+3J3uUGoARCjTSy0wI2PuNo53woXhncwGfKbN15ELX1ciL5F+ WxXtZ5JPhXS8YFCxxTPe8XRGZjPCt8xD2VUKr7qvwTXPM3M6Z81Wek+Jg3sVnxPsB/Zh1oLc aT4n63VKeW7L+o3ehdk/o0M/03tKBNfYCDWiz2P7he2O9h5HeBzm9JCDB4D7HPhJ791D+5uf Nc1lS1wMk8ua7WryGY337Z33sG5giCZlhpd8pt3nXyLw1og1tIxcU9lHQeZ7EC0QN70usNTF +5MpL7hMR6T9bpFxRkkm9GPF6IRcMdNVquyOhj3+obwf4j41P/BmY7J9mP0AvCSVEnaqxojS VazDw6MgtQRz2prqh2JLffZQ2LuKDb022AMA/HCA98OdcMXnLJP9dA6mOoXk0+EnNafGPDJk lDcSolWKtAL6URyv9ILSw8JZdCwssz1Jm7/1q7oCLGL43rD0wo5teS89zJ+Dv8NHmPci1acT fwX7xXw/7bdaYgz6oYfTmJ7ZVHxKbTeT2W8D/fqgn2hVYesg/SDRtAYWmkdmXGAenuegU78e oN38fsz51GoS2A9pGWaYYO8UfglqIdAbl0j30H5vjoP2w7wwc2iyEt62l0ZPq5N+b/25so6X 2tIHuLb0nlit1VyjgGReu+m2fcrOP8S3dEffU/BHRvutEfTzZj+Qn823RdUn4Ae6T+GdnwfH R8AHxGeY7/EjzrvU4JM7nv9AHxBpAUg9PdwB85mg3dldbH418lsV9KtLOM1BVwl3tVm8QMf4 PyzhSGWJ7GhlItB6Mk9nrfPIzfUHekg7nHzD8dLUe27ho+B/huCN9pNXi9gP40kJ/jCmxm4X ZrKVgWx37mhiDUKLDfjBe1BNG0J5FO6D6BOUMYgoK+sukNkPGiSpq8n4xq0bxYZzWrdTmutJ mfRNIz9jQj9p+Ez9wo0rNkKbDGkGPgN3wHc9x8GDAH0H9gv2cTT3XnI4av7Ugm8pXVQuzQ5O 9YCrB74KwScfCMy0ixm3kBkS+k2e6V4G+8V0B43OkwUiEhgW1gvG+8NhpdVWbaPuHtYBn43Z DtWFQusZqqNIhyhcQQuWxj/UuApada5iMJ+McpSmgfzksmCKTyw2bJijyoGx+AmqHFVN9BRf vACHTHbJqffsWP34kIVmPM4Oek9uGbvewwHst2evKz5jst8Us185B8FPyLSk07J5pWIeoZOn X1HQT6MdBI9bAPQT2qgisnxj9Zu0zPzav8aSkm9OL/jLIe+wrX708b79Bw4dPnrsxCkQf0X0 iaaIyWwMQlBKbd0lS2EoDaZGrBonYPbttsO3YwP9hqCfdjzIXKLX6Y5llrLc7+zgFKwzZyUe p284g9DRSaJPE6VSwX7UznFZ0Q+sk14Oc8ADZGTQEyichzSISJDh27bkr+hRzdqnbnP66FQJ 87nKp97zn+zv1V3EQZWXPsuST3hZP27H31MpPv+EYw1Yv9A7Njg/mPy+x5h2DmlXeCeAgzg+ kXyP4eoj5nv4IFAfYJ90nprfTMKvAD+GdKPsa1V9wfmtBPn9JqoXlkl4rAH9Pjl45HhjprvC 8Aj9aIsR9LPpDtEjr4sA+lg/7pg+Vt6isU/R4eQZtteT78mNwnkI3EmRt3SwQG3+HW4j7iLB nzsy7c7dB2TngV/vE/UB9j1+8vQZGL+Xn0N9EuNKY9aQNiJeKR4OlONqseR9WLrl/YrPDfRb 1vo15ufgKcolfpYRomwetNQvL5hQFtEdRuYfRWInGT2Au/7jEx779n388UfCfRXwg+Ab7emK 91876IdA3Q686g4EDbOf0d9/DVHlE74HdUoIoQNau7Wfbsz987/riwFHrWtNK4xkgaV1wCeW AtxICncdlBm4yoBPe0Whwih+3M6/pKtQaQ06Zj8f78B+oZv9NMFYLhnTBisAlrnB1iM31KUy CTUFDhrKVRxBpGkZNJ7gi9wAtQoQkE/sR9qPS/gsZj87hwd8YjlW1uEnNac8iZp5RKlG1g/G dkjp+gBojj5c+P7Nccs33/JaXYG+ojLTPivw9+FHGFVyALNKjoP449ATSaH1WOYYXSPUbUcP 6GfS7R/JTfsgXZckiUKS2W8WSdIG+g1Dv0BqKdDUUGoEFZpj/fDhw0eOALMD/AVoL9jPM3pC HTks+awGPPhc9x2g/Xw7oZfIkl5DeChlnCVheYMvPpFsYI1lsgQNVXao6PSv7bu7s++ped7W CfoZ6ZdqT2ZDGvCDqU+wDywfAR8AAgAfEB9hw11RR0J9DMBldAjneAH3IdWTxSHj3DGdyTZx WXxY9f0XbX7Id0CDTLdh+Q+JPdj5XGdSgToa0bdWSJ0MTgF+UcSFPIrSn/CedDpr29P/xbVx sKRq790qcCHtPaZb4ogt12PSHLBVaD9VVsTwgvAgbon+DL4DvOtuAvHheAzU9+QpcJ8Dv68q 5Ncm/f5t2M9KXg0bMo8Mx2Gl0i2RcgZOx6fZeP2W/8BP+Il4ikZBvy09Pu4sSfWLkjtiI8S7 feiQCTkJ7oYOgj7SfR/s2YO8DvR+5PRFsnEb+a1NTyDeuNgP9ybeIN8VzBrIInvf+LJl4FEz SsUTGFww+BbxFVcNvNMTbtWkL8Wp9cowkfVLIWWl/WYXiDcyZWJpY4twiO6pxT8f/1SY/aIq qCf7vTKzn9QA3meKBjfmYZlNBr5QzP9gghSDg5VlSEtTpFk0oF8oLYGZY1gZsmDxyPCgJSIc hw3Rfp/Zj3okU52KelQYLQAo44vtJArzyC69QT/UfA0hUzVCxjzLLWY0LtXm180VKFcAbzeO JvM3BP4OHAzij9rBfDm++lZCZAltfmY3V26UxipTMj7nkiRtoN8A9DPROpPDtBjZZNAL58y2 hA0POhYchw4T/CGj9fxFGf6A/eT3E07CzuB2P1TSFvUSuTESQ6AZBbgOgyYSjClr4NqivWG7 aT89pioLQuCSW12rtmzrPb1PZ3pPN5v2JbqXt2L9fqfXdMfeUyk+QfpBu7PTXj/jvLZqvGDI D3DBqSLZxIzjA97DIbXgLYA+cH0+9oSwT9PCPc4dnIABP9N6hsUnkR9XSN2DFTwa7eKlms3c O6DLiawCZlLO3EwuaTTJ567iZvzA2kSyah/g5DNrj/uESlGWfPW9/EuB8aL+LJlHkl3KduN4 BtQH2AfCD4wfgd+r7yhfNw1Dqk94of79b2I//CtWV7rOi2oyTuVSKHpqUAqn8Fu+avlpZqGf +CkqudpnJlerirLwXm7m+k16ovAYjbzsQgz/JI0DJqQSq1yFST39uwxuEaNHeNdz7MXBedyC fVTuGfALq2/x+lqlxKixne8J9K0bh+mnC76rb7BfI+JTIwpa1BpjQmbpx0++i1my5axSjdur 8Vhk/XrNyBeIVAG6M5WNzQnJhkrM5Ebx78dVyBuSWaLSyz+pJsqY4rMy+0G5yTkgoNw0D0vj sBQdbGkWPjDm/2fvPdjsqo6s4Re/HtvgscFkERVBIKGECIooEkW2DWN7PEy/M9///wnfClW1 9zk3d9/bQb77eWg1HW6fe84OtWqtWuWNhaSfMJd8WlshohyVGRhxzmCwMfYLL8KFwHWXQ5ZT slM2UmakxbfKbAWv4S6vAS2GgP2EP4H8xDyqaw0M2VOgBdKvhFldvm/C3GuPrG3e3O2/j/Md UECzMKhksxKqPlHxJ/4osB/q/VINHR0eOuinw9DUOua3tdtiXbqy3aXEBbWPbPv6RcIc8VKG GkFqScOEXfzKxffOvYOu1GhOpkzna6+9/ro9Wk3YMplE2yh6V2FHkTzSJFlsSCmRrFOUrxlO L9A10Dnw3wfVfvu0OLjFt7DAjmYua+/0nootORMlYe30nlbESduSebpw9YsMGQL7fXoju/wz B7hOofJltR9kAIcD+mWKWKQuQj5ge4kEQyNIexDauNxAedg1Aj5APmA++US6TwD7xEnn2dp4 BfDrtJ7jdL8ewC4f3txfmwhe5F70NluWwKTu3oPPs0YO1SqCTIQ0BWY6UttBnHvVpWNDaX82 PL39JqT3nMHJK4PuDlvNhIVERDi9+GkS+1m8Cywv+a7LNtmSw+MzDFj3fCHYB9wXwO8vhfx6 6AfkR+ynRGQis/RHuE6kPMPtlyH+ihhkC/3mzvLlvolptOJtN2JwlzTmQGRPBqv8yzgI4dyE gzAcO8noTRnowq3Bnmy0aETBFnHfH//AKj/sAcr+lOL7MEG//xNxUYGe4b5R9Q/UYzkl740z SoR/mCxZW5diMDaD0Hv2CoBEpa3noC5NVb+AfiljaB3rWjcwJZ0ntajDvyW9vEseLZpI8rMV +wn6wYNCtZdlBwvcxV7I8A9m0xjxGi1GYk5Jek9nxSdK/aj3BPTDrPmjsB8Vn2rvsESxHxyH e0tawU+2romLKOaxSv3+JmH8NAAa3ap0j4b4eLnFt/2pf7U7MA4qcX67yfuT7OJMQ3clMlDy B9+iIfa7i36TwH7spzTupMsjfXItQ1d+LrtPYi0vpyvfQr8prB/8DVsswxMP5cpk6C4U8qNV GcerEOu+SZues+9CrAvsFxJyihmcTfoHDgfmolJCl4r2PEbT6WVE+1EFh8mzP+slt/jSew5E FdR7hhvXiPTrQmNVjdf0K/v7Q6/3jBt8UOsUBZ6m/Q4B9KOkwAHMLyjZUJpCyI+U32dDW8gO 8PFMv0I9j7uDw0Cb/Zt73Gc3dxzgzz4jnBvOnl26X3d/M1M9Q7hBgy6b1E1xaS+LT2KNyqwh 9fPJ0Ear5vd+VOXi7gRWmuTkP2gu69Q8hd7TbwMPUweFZVhMaBP7CfwBzqtDR9efAy06iPg4 vvrq0aOvhfu+I+OH9rLJ+fXIj6Rf0H7FKYQrOjuaUfE5vcfnFvptZqovelVMo11CvwjlIVW5 cxtO+ZB76iCEjjsdOynknDXozWjUB+oGETzb2QD4SewZmwAOO552hygn0JYcGq52XWEuMWU0 YQ0smn0nM8azfEJGAGtXh3u/GbDvRDMfvdh7r3RpoIB+/X4m2vyDkmRPpLJyJvGPwadwUi9f 5GdmzrDxcG9glFPFfqT97oNyg9wS2A/gD31jALrkiADUBZOXWaV+3D6S1Adk1iGJiQPwB5GA RfvBwPbpuymd/Zhj1zW4IzOOKuHPuIiOeZTLi0i/cUwj1/zX1gXc885u//0XuANYPlxBOu+a 3efvfvdkB/7cruR1iD7PvM26MdX7UTpIq5eQfFJM3dF+ddomg38LidaZradm3+fY4saadqZ1 MuTvYoqdHWxvUTBcxbB949LqebUCK879ZYMyD979lV8fLsWO/KKUEiceCTq0JzutVCckLtK2 HHslKjVJ2Br73b5zr/G1gZUI/QL7uYy4VKQURnl3oYfUwdB+mp+6RRlbDkups0ssYktJj5t6 lXrPLDXN5iK5TZp0PjIZMtwE3QeGH/u4TlXs9wcMsn4oYl+jnznjqZVmvmSCO0r1y6jtJyO/ r3B8PkQ/gL4ZXAE+9gO/CKZPztlCfYB9KoaF+wO58WjjBeBnlJsVPq3Mb2NqT+56WvzVoKsF SpemWHxO93npi/3EajNJkxLD/Uht4C10z3EeJ682Y2riTPIyqsKxYWfa6ecEf6j5++5bd2gE /zccXxP1ffPtt98B9xn4/fVnqz1Vz/PfeQgJ+Yn2k+JziJRD8elGiCNb9FWn5Q6nZKbiqOHa Cj5nn+dzvrP6OcitoMRzbHHERm0g/SD3BOfHZi0s4JVxC7Hd9KEiLQn2ELuD70vgR8ovNgHt VN59Vz6pNzQxZu4b7u5QUsf0h4o0ixwYZFcyqFkbme/toURYd4k3qdXfRVc/9p24dQcx46jU D8tHW7qsN7ugzee1u9UQlD715GQZG+6CTpD2x7I9UIeAf4QToaqAif0K+kkgDMXnndu3gLuo DMEg8ruJAKmKYmiGN1nqdwuWcVHqp4y4pDE8I8GUPPc8PD6lcF1c7BeKT3aipOyU+JNtSz++ lhfRqbNQmtP0ntXMddDRZw1y3TnLc/utx+8OYLVi8MCbFlQi5HtGxkUwrW3Yj9JBWr2E5NO0 n6s4fKQL+rm9wwp1u5M3t9b2VvDZBJ9xc9O/EslOAOurzHUa+TmclcLlpZePoTljELas97t2 87b42pJ8BuunjBiFV1k4Ibc0ZcdJllWDh6z220faTxv84Dixpl9e1tdufoL2N1Ha0PSeZoVY CjnWe2KzBoTtjpJDr/eMVXEQ6xTKWAmg8lg7cOi3gzCBcTbmKXP9bEXCegkCP6g8r4V7J2xc DPiA+Nir9xxBHzs7A/XZA8ma6CT8CvhNq/DhfZ/cmNb0Fc7tX0dDPFt8hmQpC0XAz9sjQKm1 ZvEZtTF975KqZY2y3E79s7k3APCqPfrXvylOPidJeTAxg443wWoX5wcF/Az9+Dylw6J9HYk/ MX8//vDD94B/wH9CgMB6OfgVfON74L4Afj8Z+WEfo4E7kJ8rzhv0GziiuiMWE5HM20/2mVWY v1JGAn9wC/3WsBwwj1YEVnXf5Xyh6jViejxYp0CB/LJVg4uxWJA1HmRrMBC5083q90j9kPGj s6coP7s8RbVvl+I44CJQL7qy0VRXmFF3h2YNPLD4bEGZwgYtg+gHOkJYu9g0ajOQv+cfnwnX TXX169CYhWImC7B88BwntrOsXabLgFPOU6oQfRdQfUnRRGtt/045C8fO44ok034Uloo6o9ry IbEfDg7KRNg0VMjPfasRIEHQlnpPlvohkZzRxMAyzulRiOSI/cTARpPF3MPb9oestHPsLPZz YhpmMzy8dHYZfl6D5tTNs5N5tMsLN0iLstyaw/6sTl8Vp+HWWxs8sdaw0rcvcWjuABYsxhj8 /dbMn1WfdC5q2E/Swdt0oAOjPqL9lM7d0a5MFf4ojzO96/DsO7GFfglrwqyrdkpK1nVzlezE NsATj7nO19WeDBIXDvTnAEUW2I9eL/DoYblf+FfJ6cUxUyTfoyOCfIdDR6qGYXSNPyDazxs8 4+Pw90y9JyqimEm03pP61SHpxw2eJlrQw470nvAqDQAlINrfvxpEepj6s+ffofoOV+k+r9Nn gZIZFkVGM6P6C5ejPW/ZCdQ5vnQYrCB7lWCPrN+OwgSm+pH4+BGGkK7Wz9ytvNpo4wLAd46A j5APmO/s20Z9sPyz2fvr7t5cXbysa7XWs3f23Cjlh8nluT0pWaoiVvnMqVqFqCkVny35M+g0 dQCKZk9IPcbk5MuDCdU9pT5z7t341UalY9rP2C/A359/BPoj/iMAHAx8id/5EUpPSD3/+pOC M9tVEfkl6We9Z6/4rJi32xDcDeMF1R/Q4UJ8B3OgG5R57GZLwTQ5bJe0m7cx93d28x5L9yx1 xwPoPankPf8OrMmg9iTyc4++2MS4kU0OQj6M3wv2Cfc14DdAfhGMtAK75Jj2vhnyGJp7d0bf nLFvjJrnMdsSS45754xdIzSDZXXr9g4rXpCvT7tBbAZN73nyLbSrufLBIEurKkTsaBq4sCz1 60UMLg/q/LjtPdpuhe/CROaMfw057k+6Yr+/q6zFSaYEUD46MmmIsvBrQH4wwkvSj3YICf1+ bqV+fc9BWMYhKMoOSIJ+7NDzujv0+CIqMe3oJORVPL+gSYrji7JTGlATfgL53fqkZx4lZ/87 ST+C1kxnI6ZpAFSlfmy95WeHx9Bu0vaz7R2YcwcwVzDG4A+yz6dQ84cZDXM/Nask70fpICAE l5aceu2v0Wy7eaTvGPqBQtJMzcM2ug6HWyTPWiuSZl/ZFvrNgn42iSpog22Ahiww40QTPpx4 bDOKgSajqDsGaGe937n3LiEaI19bkk9IpUT7/cIh4ZVfV2xZNkI/fzYRu8oB4rntF2rSxOyP E6c40f2Mkn6q6UE+KwGB98I3g2H6Umk1VoBEkp8uGK1BLLfJI6P3jBXCVbq/6zTELKxjOASC TwQKIP1Ur+GsaSI/nJw2SbtkGxfU8xHvEfGJ6Tt9+lSgPlsgke8T7mtm7mT8emsHQVPd79nb 056/4+Cl6aMiq3GO2BpTe+zXkNCv217hFZDJn+Y3Hj5GigTWs051IwYf+N71BSKlXuI1i5Mf 6z0HtB+WbGI/Mn8o+kPZn/EfkV4/8GV+9y8GfrRhCOQ3gH6B/XwaYWubpvhMgeyQVqD6ZQv9 9jy1V30BLIWVb3uDfi5R0EYPe5C3kAJ97VUhP1lwSMcJbDdjgOnjeJLr34SfGT8AP+0CTgDl Wj1c0K/5aJ7sLT6bmUoU4jhtlssg+asOPowgFt/z6o+Q8RqfYpNgUv3I4uWkwJjLsgLALi/Y 0i3kyGBRu5mvi5mZYyNI2l8VLtFpmkgKV3OciAza9qliv/8y9KOyyYIR1ojfuwPcdQO2YBhA fpR70l/l62jtwO1l2NVPlcKSDKQaVeXwv7c5BsxmsIcj3ILdqvfw8uoaF/vJ4zOpR2A/gr+P rwF/tosI5hE7nKAfucdKZzPLEQH1ttRv1Zm6/fl2B3SIG/xx8eIsh+PLbwX+/h1kuupXzfvR MiQgBDuPJO1Hwc0vkZdWhilV7m2XmSjc3UI/3fbVj7yBPgKsVgozodwg8lN/MvaaiS6jfHDA fu+cQ50mrF7E17YyTT25wH4NM5EuQ+0EO6G7wcOA9kvUtPLp0Gbcsp9pex8cJ+HhfB5vJroY fZ35h0R+tE922iFPkibOHwV6/Vmy7DUd3M/t8zp1CTtIv6xjWF+iW0HVKsHemPST3BMddqnZ ue6uuOzWxzbtRHxnTnOcIuQ7eQKVfeh3YuNbmr0X7rM7W1g7lKffINm/yYedsUuFk5jbJ06j GXrftUT6qLDqK1GF8uRyQ4/Kj4+8UE+80UVLyWNh1uz6XXjGzf6YJNmYk1+o97TPCwM/JZ2w 9VDS9DMq/gD+gP4E/4wAgfY8iPkw8E38CBg/ij3V88pZfbF+wY02xeeOkHJ0dR8oPqcng7bQ b9eTZQ+/iKWwym6ww6eKc9AGnwNhP/sRoULhmH331a2FOs7pA3iPg5iPqI9Cz5B6FvBL5Bc4 o9bqGgufd8v6tWvxvpHWwJ+VwcnQ4nPArqmpe1atvcq71RdCYMWv+jTxK4Zi2c+9eZ70+9nQ naF7jiURk0pHbOQwVas0VndV+feGSFPb50fX0+7Gf47aJjkaqFgACMqUG6rEIRlhF6AbN24S +UHuKX+V1HsOoF8YB/RqVGbZ4AjLEYEy2ztoD2d5Y38RzrIjwR65yx+D9oPkk9dg/Cn4efd+ lBtGawdscRipyGqlftVbcFzd3d2j7af/gncAK3E85t0F/ayYvxH4A/EH7Md0Rg8hWDXWaD9k XkfQr3aZSEtHIoehydizafZVDbM6z6eWaGvzIsV652ISAI0nnlQuUdwA9Ef1OR4c6/3eOY+j QVKI9uBKB2/eL7R0kLW7XyAd08gnduUATSu5m8zg7Gc9/TuYlTxOQtWh8gFn1eiAr61V/p6q Jer7uUvQrzrTQsZT5V14/el/eP++Ol6kCy5JP74v61RqFomlDhX08+FtvQxLUoX8rl65fPFC tW2gshOAj4jPmO+N16HxlO+tYB+8H8iLh5k7S3yC8SMVvG/Arwk+Wa1iQzys1FNYqPZ5aa2p cnsV9Cvt1tjvzWW5VR5jZwTFS7ub5MOZ6TnHj93X8X8i/fIdgJNH0vuMe4yV3hPSqfT33Bno PdneIaGfsV+BP8G/hgAT8xn2JfBjZEbSbxL69bRfgIQ5EnA4Tjc1w5b127/Nr/4S9vndQb9a BJTixWmFKIMOHBbj2bDT4G7GR2I+gT7CPm4B3ASUnMrJ3q3Vg+/rV0LxUZUbkvIjuKF9g+Wv KZZnUlTUEZJmkMPIq9JNYXp6zXKYFTcN7ArYDEZZ2uzCFKLYDpKKjtzB0OrUZbFFh1Q6zGNV 0KHS/JKI9RelP0iG3tsnIp3aPj/sSkHg/8b8tqEfIxyXzKHaD3XixF0EfwR+QH6Ue5r06/Se KEJWqV8nsEizehkH0BPWAjkV+6G9g/fwwUVAfQuj0Sr2k+ITteq8BpuUGX/eQqFfu4g/gyFl qR+Rn+vbBzKPqZpYbM+1qraf/Ivdge5onvbprLvhn9UJ3zF/9PpER+fAfoAQsPlU1RjLrEKP ODzYU1cuZp29lOi9dU3S5I7DZ4u4reAT93wXR14vjYegMSyn2DVRJ166cyhiB/ajjuz4Sfqz QnP/sSSf6MyRZZp2Phb0gzAqyqAlJT0EtB/vj29QRcdsnOPyAfa9ht4TzDNjy17vGVp6G5ml qUMqNGjycij0ntMWZ/e1A1+nLzynmUQfhHAvO0DWLztARaYfKWK2xL2PilRwfldh6f7eeRB+ su9UQR9IPozXjflezcbOaPGl7s0N9/HcHgI/x3x6ELMewbq+rtU/q1pF+yuVRyz2G2TW2J45 TX7TewDlvpGjidwaaj9CV7GrHE2biDoRZn5QsNckXgO9J7TlpVhHvU3pQoxgURgg6Mf6Fyk+ Ed6we7KYP1J/NYD3yPPV+EmMn+33IIYaQr+g/YT9giWdervGQoBAynLQPRSdu2uS7eaMSNUN V8kGTEfr2tb1yW7eo1i/aYBeKVDuXmRk1KJP4G7yAzm+GkB9hn3EfQPgx1gaF7j6Sb2pp6C7 1fYNdZObAjdwJmrREfthrRVN6hLhwMpRItwpPnflDIz9QnkgIbGw5QtitPSen7fa5X+iMneH A8mfvEtDWLPYwYR/sdLCYZM1q87OPawU4LhQ/FuEOHJ6cTdYAL9PiPwefsamZST94B6Qek+X +lWL6ssQFVeLanQ7DlIZb9oXoeRXVhx2OyDrUaLYD7FxUo90m0HJ4S3iz1tAftKc+iICfhr6 EYDq1ItG2bqKqZrYLfRb1650tF4HS7DG4Lyur/KT6e/JP6LfMviT6vMppKSB/diuEhAC5X6o GqPYTnG3zXpp34bFjPwSDtuCfkgwkZlivRWkg1eqSadqUVpV6vRr4Vdjty0xUWSU/6VZP2yV Y0Y1zJ5IzbHwWJ5TLl5X6XF7cBLdy3whnF7gXqyMGIEfBndGa+GjLYISqY6R3pAmBD7Lg5By 9rNbz3did59TPlDHSSP9nNjL8y2s3OlT+orPt39vdaazVsJ6rn7eq/TL8ZCu08MF/RgmuKVl pG3VxRmpayO/8+cE/E6eBM8X0s5XifgwjoHqe/klNnam/RHpvuT75OlHuRdz/or7IubT05n3 +NbzPU/vSZ+XrjVVQL9QbgWWiXBpoPhUr7oziAVqlgvMMIO/OvbL2TmYmdP+h+eEoz2dEQMP ptt2cw+T0ngHwfopGA3SD9DvP1nsZ+gn7AfZJ0Zhve4TfYPwEMhPpF9AP8S49nlhnMvb9D8A f/wYpedjocSsdi9b6Leeqb3iq2Al7Ib1a2yRSKxWniBHAYXlzIBMH8R6NcT1me5L3Jf0tt5K LtUmslxfHmxVwWfgUNJdv8eygyLLkZHhxp3O4CRddbXcvHuKbxqXCNfp3mdFZ0SJU58sNwwB MWdNqqmfFABN7/kNbQEDkQb0a3kZpCkC1rRYkSZM4WCCnWx4XMefrO0TnRWGdXZN+Fq0nwMc +WvKHpq4686dTzDuCPlB7qlKP6Oupvfsi+xUAwPjAM0xZBdUJyraj6VR44tgVVS1v27QT0Si LarZnOjOJ7c17ty5J82pL4Lwk5J2sn5Z6ge+NgsOh4r1SPQN79HUh7X94mN4B/LIZgZm6qgf mL6u/W39ZgN/kDhQ8ykI8SbKdt8h7ffx9TzZlZbukrrMMDHBFNuyFNKEfoOe7p0h0ezHsIV+ lTSP9N3OMEvm3gUW0xrbQE0LhQTl59IguFBToP0E0oIoPoYkBKCdTi+TtJ+wnx4bcVP4R7Tj NE0+xSbsShQy+1FP/w6mY5F+POTCLpqCsjhOslPQyN8TOTXJR9L2bexjFmVQeP3pf3jTX/U6 09ubukwz6ph1gf79Ta/TQ8X67ewob022y+lP5pRA+l0T54eulm+fOQ2+702066O08xiGulu+ ZNAn1JewTzLW1sNrKvDbj5mR07tVq2Q8OTZDb5k1Y5liPLBQM17KHM2I9gP243RZYUp7drUz hCzIYNScNfIT6cdob7oHU+/m3jd0b8gPKaeAfkH7seQvRoN9+RUW+Q2gX9F+We1XqlJCv7kC 2fIuLsVngNlDoOvLJ4ZZsjIsSiblMWf9uBe0woeowlLBKw2pARoAZbC6k85LfDf135jhObdj EdS6yZPoMEyMtm8Uv2ZvEah6eLoDbgxTRkn7Se8YZ6N93ALHsJafLGkuA9yFVfYM3iz8iqZp ZupZ9SbpYxkWl96zopmd5CJLhuoCjeUcTNptsN3NlDq7xJql+ERuW6lDVvtRbgnsR/BH4AfO j3LPJP3C3xOYywrRcZGdlPUEpnQIQidswXBEyZPFfu0iBP3+Gc2nVHFo2Wnhz7v3UOj32RfJ POoahPyy1G9KweHQvmClnT63mO2/R/wOcAFy5O7FxTja0Pgt/9CMKeJv8sfwm8zohq0+D3b2 q4Ry8Oy7F2jZdLPT82QpB0/2hH7y0079tpkpJaXHXrSzb3rstrmXbGv9dnZ66MdjnWLajz+Q hY4S/iqklAbBu1FhP1q9hOQznF6sJSvaD3QioJ9qkOU8jD1GjRHY150mn68fAO3XnSdZDRVK +tFxMk3vqcwm+eb3UwrnNF3oPZnbnbEGZs/I9XwnFyBXWYxDuU4PI/QrWhqQB5V+IP0+eP8S 2jhD63nqpICf/TtJ8pHno74TVN9z9LwV2wfYh9SIcB+1YCb8Jhi/ivjW88RnvErGLiraUXJN 0ZKLdlrjkhLUCzgFlinFp2QVZWM7oP1S17wa9tP0HEzMUaick1UnhEi/aLyCahtHe82DKRSr kRoUJYc4lGfEDORn1q/DfoX46pMe+iEnDtjIaj+EVcH7peaTpF9Cv7pdmdLCtiaPT25rqicK khSHHt/SYYjwY9ZglmyhX2IZKxg5e5ReFofVlEXDowpAxqpnPNJuzs74NGc8/80dutsGDtNT wLWMpkTv8wITBiZ2wx/KMmsuuFB8RlsoG6+rDiezxl4GuWnwHszYt8Zf5o/irileZBor0kBS ProqX5tZp/fMUj9EHZmlCIGYdrLR0lSyefK8rtvQV4MMhK/4i/IBsNYyu+pRbfnDd99+Dckn sd99gD8Av/tAfgRdX3/7HZqG/jX1noR+c0r9RPqxhpSVUVR8zlLfDor9aE/EF9U1fIaSQ1wB 4aeRH+SecREd9DMATX2/orIIpwn9BNmPnGf5eB5t/3+Xd4ALECO3sNzh+m0vv+efnL6y/T3+ ZGE/zuoR7af0Uu+sX6UcU6HfdbB+57M4tpH4k8u5f+9b6DeF9WuyjRJIpM+vG8042SnXstyO mIpCiRxA+xStrmrBGTQJ+0VecIL2YyEhaL+uKZ7ZhP55rf1z7+2IxBL9t5Ra2EVP0XsyrUdV fDb1i9PtzdR7tsQmZvraL3mJF4zFl2vx8K7TIfSjb7XMyw6kr98ORqtWcaafqQmQfpcvEvmd PnXiOBg/+3dK2lmQz6CP3kdq35y9m4n7RPgR+OEp6IH44SzxFNfxI57fIZgs1oyyirKvzWI/ 9UNP6Ic7oYApcuUZxQ1pv8zgp+RzybmuG+C5yZmZqG+sjPOsFUwi6fd76kI0Q5hh6j2YQuJF 2lJt9xL4Cfm5zq84P2g4Desa6Vd4r/8kfigln6X5nBR9OhNZtwvzJq0kZig+9X57gfn65vxu U02YJVvoNw36dTXvzU8A8bA7gYOQSeQXazt33Pn/xvaMfwZL/DA9hW7fINygwQlTLoOUkdZd +EO1Yr/KgKRnCfKi775VlWtj2m94Cwb3o/sf3jHcU2wWnfabR3WQfn2HT+k9YzPY2dGWHtfU MtkVKnYFiNNgjW9Dq3kcCl/JfmbnWdwHZIaq0A40Hik3Yr/PgP0e3Md4YORHpaUq/YC6Qu+Z pX7Is2c/vWZaofQCod8Y8i4q9str+OrLz3kNwJ8YuIpPUW1YF9HrPQdBDeX9k/4888Pp7olt P32s7gAXoJYgd7b+1M7TOzBgbHz66ek3oL2QVnPoeYj9vJyb3u6zL1zsR+4oq/i30C+OpCXE Nnxgqx3rqndyQV6BG0Yx3L7thYwKh6eeUljbUlHcFN+g5BPt8KDV7Sx6flbDGeXL8dLMpPrF Ve0HvaRt00T70UOGqB0H6m/c/xiXP30GreervDu+PRMNo0flA2O9pwwgwy6sxXjlYlZ6z/Vc 52qvotWVCZpDvU4PH/Qj4DGwR/rTbnAfXLn0Hnp5Afm9+QaUntGvjyQfER+JPgyBPnSnV/Nm SKHl595w38EAv/SOYOzy5EjP3JRbKhRRVzwhp8QyUnyS88iIqW/E8vKLdDdskS+2fM66Jeap JqdPiMR9An2tWor/204UBHtNFqKENxJMiHoyM1h1LqzFK+i3s9MoP5b5TanzA9JrUs/+s4SA gn8J/iaIPwBMcX6D2zWN7xgrPvnW0NqIgZyynWtMd2yh3+wJuPI5SNCQ0G/oIk7ee6I2IYKe 2f9o4ncfJi51N1eYhNYSkcDE35v3BZ+LHeZBI3GYn7ESJzseDVJGhH59zeuwGkJGL4bL6u+Q tN8qewZubIsVg/xi4R1aLYRCLD0BeVSTJmilfmjR4RwWpOtI5n2squWGRlupHy5oeFd8H1pm mMlJN9WjYN4ecFVnZ49PFvuZcvseTi/AXZ9/SvBH4Pfp5wBdkHtOkH4EitlDeaKfXvgIKdaq eue+s19WHPad/XCKifaLa2j4E8RjdxEd6Yef/3M+trBmfet071y3LfUbzo1/of/rDm0CP5/O latt5zWDTe+A+o3pd6heLDI5Jeh5hcJBkkeoGRuT+DrafdYKQnBBV5Z1y/p5nYKcl83Ir3/t cGz30K94LVk0DxswQOdCPgOtGXvCNnfiSYseQ79FtJ8brCabwFk03ounz6bdfpU7e0PGzm6m XbR8hqqogakHar7oFxGq+JRGzNJ7bvzqZ7zrWlp8b4d7nQ6hHwvYD5T1S3FQxQm2oL2M9iNv nwHyE+UHvo8VfQH4njbmA+gj6nMFLJTQSoxgfcSumDuiHs0oupjxFNf05Ra7jJFGFfu5UCTS 90n7kf/MwFc9TDJHI0/0YP+x0TBJA6CmDZ/vbsFlt7kZM5Pnh1Ff2iPq/+o0cf9Xkn7GSUj0 9y2cGycvf09GewxBMSQxCH+XBH4EcwR2PdCb/Tl/kr/R0J9Vn83tJbEf/hpvV6S0yuEidOAl ZH/Kik9Cv99sod+CmbLubz+x6jk4gH6DwgeV+qWVXCT5hGI0uxd/mPHWdnOFuUbXDf3KbzTU MEl3nev8oUYpI0M/lwj/9c/yR3axiITPDWjl6b68VoB3VGeZhNJK0oIlUHEQc81MA7HNS+vC RM8VxooYSmRP67k5hDUEo9jDJvYv/uFB5jwbo0aXi3QCcFVL0n6UcAJHQW5J7PcFSLdPHwL4 ffb5F4X8/vLXJP38w00tkOGEto1QyKojZAu1Fhf7yWymuwZdAuEnkR+qDSH3/P7H9Bh1qV8U HKZpYjZkVMFhhJTT79GM6bz98uNzB2IFdgFlHds+vBnoRL52EOtMvwX5ctJvR+cUVvs5+rNu cGA/Xg5uq7J+0/8+vxoLO9V+21q/3CwVxQygX5WtSEwLC0siPyXk+7Ds1FsibI3aUw3R0X7G fh3td//O7evMwvUtw4bNERZFk7Of7uLveGf/NQOxUBzX9BtnHpq/5yy9Z6aCD1rvmQurAb9D u04PG/Sj1jknJ3R7WYr6HuSeRn6g/AD8gPsa4hPkI+iTBbdQXyyO2A1zL4zocPGsXOdPDGKX p+mkZZWUUuWVWkN3p1BVpIWywExHgErvhqgEtyILd8K0YQXsx5nJIC5nZsxLgj4KmmLg/7iz 4JsclV5SLTiNBpEYnKr3zGgPe1hQfszUFOFn2BdIj90cFgz/ZME/t3Z3SU9U/AXx1/Edg1zk 1J5mtnndO/S7TBlG5OTJpESx0kTsutRcwkMZxLe7y8Cs9ZKWuu5Vfmg377GxfoJ+czuBa25P /bDsVe7mCieh35qeAi5Gc2KSnK6UkVzc0oNhUvHp+kjxRxe4aUgl2wAzYIRTuwunLG+qtoxE flkbBJKgqzBhljadLv/ZWju0nExTLwiMTjfkHj2svA0Zn07W2bG80Ntnr/gMyi2x3+efYXye yC/knu7sgHYzLvXj/bonp3oVLnV24U6zY4+MIsfJi3iUFYets19Rjyz3I/cI/ImBqwD87DSn zd+TBYd5j9LYz/x2uvNM08SObtj2fx/DOxArMI9tiFaUrs1kLf/lib18ojtf0ALuir0dmkwR Mif001E7wfptbV6iLfr6WT82ZnVZtFNAIfRScEYxFviEjMtOhABjWdoPRhpoyaiQshOWZ2LQ Z8Pm1pLOFE8/1hLJQFCV40puVsNo2UX30C9K/yf0nparsqtIylU3d+0zXzmXVTJ+h3mdHjro N+BurPdEXgKT//TJ42xq+dILzz/7LICfpZ2i+QLz0YVN2KWQi2QRhfsOBPil4nNc7CfJ5JDW nqb4LBgs17dqxMIMPhs8ZBJoyPvNStVwXiqGyxNE5wfuFu8abl4N/G+eJTxPFPIE6WfZWek9 p0d7OzuN8jPwU4GfyT7gPTVvX+oDwSERoNi/vrs7iT/8GZxEch1rDhfYGSph1oVPXUmRkqOr Qr/EII7MJFkLi8KSyO9FjhVh/krOMxu+pJnb226/gam3Mrzd3/d4mK5QK3Vwv6rY7/1QYxlu gO4ywxYJEJUID+WVNAzBBlq2qKUVKOw3a8vgs+am0SO/LtqAQmRM+nVm8GL9lGqeovdE3zzL diN/NatAg38a3ASiHBUbV5eLc6E4L1UQRaZV7EddkCi37439QPxhfPGlOb/v5fHSSD/CRHeR DZY0mpRZAgV/TzuFWWGlKGXQamNYcVid/f6hFu1Acyo5JPdI/Gn4KeRXRjPl79n7F7RSv1aD syX9drv5HO3fixXIc5sxTeI+RTvtQx/3ZNSjxTttdeeiZjansksvwy4E3FFWc9TprtCEjf04 Wk6adgzZ12/b3MFmcusWfI6hn/ZuhBpgeDENuCtGHs5OL27w4Gq/tN/DvshUOYaa+yWzEkbC kLd7u0ujFAnJrCPDJNnYwvGZMpx9nYFgt6lO6j0zP6aUQ1Gizclv07B11k05Uuv0EEI/xAmT BW5nzyCvEsjvTwR+Ie1EUR/L+gL0FWIB2p6K+zY3k2fNhhBudbw2ZBUkzqp5STZhyfQ9dld4 VnKHbVFca8Ry9RIXajb45GwXxy3NJ2f8LIDrM4AhXA/8EvbpNsK7PFoXN70skZ/rid38R0on mk1MejCp1C9EXrh2pAaT8YOxi2BfgL4fNX5YMPxTPxIhCv4R/dGVgYYvndUnDyOMHR1IKZCd 6/zLbVO75iq1folBvkvL5YzMXHydMgnvOXGv5/wzmi2Ob7GTH55LGl3hGv4Xb3IAZXbHbKrm PQsrTLaSClnLGbWbK9zQxMDc4ULFyZh0l7uqZLFfdzKybW/kQXa8DGIHdf/0Ozevf4hNw1qB bFSXe4YLgzhRZz5gftObhjk/TNHcCmQrd+6CvH55QSD9yvEpS/0GuvWhU3E6F9TiweqZvBD+ dd6HlAWlKi17PzWrU6pMU/Epyo2ST2E/kG4aXz1inR+RXyf3DJTYEkZTlrY5lRZp8SLmF/th 7+M1BP6E3QwuAeDv8y8oOf3a1Ya6iCT98MOyXU+PKuo7+hIfi9Wn3qKZz277jcfjDvRr0MBP Bzfjnji5MwQS++fgJ4r++LsYEzeCXxSWDOinYivWE7Ov2hQfgv8aQb/ouZNE+TBbwjIU5ykm /m59Ybyuty3ddxzzDQSfU6GfUv2J/Wy2nNvi+UusBf+ERdDu7WclfGI/FREpMeiWYaT9rpBW pIBp1DIMu/6UeVPPb4+feF+3CYbQa76DVmmK3OYP6HuKkE+VftpSMe1aVXaqVav0X+daJMgm p/wer3jxr3tNaVXp6Yg2Ma1y6NbpYWvpzkAhUsQ5NUHdKGcNvdKrx8j5wd3ETS0L8JmliuMZ qK9gABYg6d8fI3EOPhKMxc9uAz+Bv5uxSxb72aa9TfEmWZJkMqCfs2tdjibUrwgJ3gYF6gK2 wH7WfFrBVW/Xb1jv3B98MyJzaDoPbB8mJXhT1knGEAB0sSQSiUJ+CPf++Ax7/1jv2WBr5wHW oB/TS4n81MUPtX2CfT/+KLz3/dJDPw4QSPxH8g/or8BfE30G9CukrOrz2f0+OUMYUu8JZ7nb ThWdDWUS3T1f/Kl4lfEUWaLkdgJ0rPOSNrIQ1gX9pqpr1nDFWKkrg9PNPQWs1oB+k/5QpYcZ NtTsMyDZ9pauKkn74YicrRWYtj22fYO7RiwaF/2+rK2gmkmx0i87O6hqWWiU7H+6VVXxYeRq pfeEWdWwjG3iKnL7rLQI2U9VG6siRAWGBTg72g/9INFcwdjv60ePvsJ4JMyVyC/lngZordTv I4Au1VO3njBuHMksWO0Z3R6OKkfEWYPOfpH2+tvPdHrhNXzzDS4h4ecQ+UU/d14vres61ek7 bzVNrIKard5zDav8CL4EliHPbp3cpPwM/BhN4uT2UGjZUraKgYbU33BlaWXrJSPjCMldergt B/1itko1KIv90yffgAVB2URuoR8f22oHitL9i6AfS0sc4vZRjPRYboee1X6N9gujF7w8d+O/ hWgyXBST9tPh0G3HSjMNZ8361o6mdJxv2Smo5R1s4FXYtYd+uUmyZ22JVRO1OuUwtWh8fZc+ +5WO0jpFV2RQaBBP/vGPTyO0P3ibF05NG3ym35qRPfOfmJrQvgDssKllgyYB+aI2TWQf7TwT 9h0o7uMsqdhl3Jpq1LgS2Q06ooesokVxmaOB8ThmO/l5qbcYxlEKJN7PXa3x3utta2tvH4z6 uNVTMsLjA3GMcJ9RH0xy0BWDwx6pOEmSSUW4o35Wbko44cGU1T00drCsIPxdWOSnOhrjPsI+ QL7vOL5dduinv/8eCJDwD+gvwR+Jvx777ewEUmbu3An8sGlnv6Eq2wm2Q8dnC+NWwlm2zLeW NDRrDl+V6JR1Rt7suf+2Z4PPeK732odlGLEGOjZySWvf81c+B/FEJyvpOi4kTynbqc3ekJf+ zm6ucGNPgVPCR2NV4qQJQ8M8bGlXik/5K8Xprp7m1sWA9rOoRxwSsmeYrhNagSm7ZExQTWIB PwcapfzG1ZSxgJvM11Fdjk/cCvgMqwQX6atwFhjrPWeJGbk4+hCh6uzcHec+bEUjxGGAMKD9 OuwH8AfgR8w1gfwK+jXxGjbYKXtGiMSp+KyLSPUDYa/aC1J2iqtQkbNpvyH+JPz85js6jJLz UyaLek/96KxSP+n6a3s5oBTm0qto+4PrvgM+IAL5+eTWoRz5WvvbpdmBAyNGQwoHIgzqTpuQ cOep0x87BR/msH47PGhLXpPuW1eyEUmqk7P8Yfa9qIy4JYtbm5cd3lpsl8tAPz5bBnISIlTX LVb7nU8Rxoj2+28NxNexHafKAT3jxa1EPjX3miyYW3sYEBNC2/og5gkPDF//nda2x7bJdo3A QQLol3rPj2ksK73nhBXWJvnKmVPaS+porNOXnj+00K9jbkxzgfQD1GFHA8idgfyisBk7oVgc p0G82xX+yYBmU/N35iTov+HYJapV4JLZvPpG7UtS8WlJfZWvRY7Gpjcqy4W4AqY3AYV77DfY 7SeAB/EwbpCAX5B5xH0GfTBKjUH4ZzktVSQYRH5B+gUkmaX3TEU5NhjsMKF4Qt4biW/APkK+ bzi+Xn7wx7/9FgiQ+E/oT/GSVJ/q74790oJPQb88kip3Hh6fb4TSzc0wMGMGGfxVoF+98hVJ XAgqfdqhwJjHnbIOvNMTY+J5+AvYL2KGdEUXK0G/zVySrqufx3v9HO9SIXwRJ0vc9iME/db+ FBr0C7WAK3HemTgbpfgkyUbds5dBJnabU1a/iTJ91nTilS7SEx9+8BR1ushLhsiP9D97gKXH S7P3dKVfFJfwYqT3jKvpZNhhkRQKo7m52lgcZNwm2U9DzmgISV1QQb/YfAJ3Yd8B4gLwGyI/ Qi5mp9j/veKJbBJM07gIhAa1NUsV+/UbYGI/7HsD+OmO8gJ+ypGp4DBaFROsR1e/DKZTQneg h9leN4Ht7+/iDmBNYiHWKrQOh7iv8rXO2dLvjiUbQH+MjkwN4RzKk2dybeM1ldDpCsZm1fql 4BOLepCRUyfMnK2NfdlCP93tFY+8JaBfaBoVZ6AGuivUTLXuZaQGb8OfFYqs71rpdcZmjfbD fhxmGnE4TNpkbgxBaUojGq1tnayTOgXZQPBOZxc9Re8ZBpDiK2fkEA9gm9SbOjrrVIVz3ELE +r24TMy5ZDymHWflYK8SSt9EGaqttm1solNQha6W4ATvTTyD4WA797mCfQcwBwbbe8QufWDf qYUGFbmIXRzCDcrXTPuxyIwkN5I0WKmkskbYz7ekbkTdB36iW6OblISfuTwdHk8/jT4Z7I+o wRaJBf4kIxHyQzt3mJOGHr+rs2k6J7Bw2l5S7MlE9s9g/IT7APuI+Zh7p/TKpTcLP1qlxWy9 8J/QXxTIsOIvsV/GvD1lrM1BdAflsaVEEUBDumBl6AcyupNJUCHvhFOASqrWhP0qBaG7Pfow gIODB4QjoisHXWoZkh/f3CXp4OKHwVzey/9gHay8Gyy51VDjvJdLi9/dzRVu8Ckw1ktJz6QD WlRz9IrPHUO/4tlCYjlVK0DlhNxLxumiePA1OzFnMYuxbSjirBwQXQWYY754RRxkq/SjU3Ey 8j3pV23zlGXuqfhyx+WWPfkYvX/222fmDDqrU9+GoP2CchOdJ9yFgj8NAL+ObpPSksjPLi8B utRz0I53DXSlLTDxZxWmtILtUXtBAtCJa/AOqI3MxCObS6jQL5ywvJaj1M+nXimbXdQ6ixid vGfbrzxGdwCrQmc4lyHOLcxBtFpCNpZBG49uDyRuQ7MD9EfFDtVQhf4K/tW61kvGDjNsERC9 Q12924GHTLIS+g2YKRovswol/K7ZblhpUPzRKes5n8yW9csGDGnUtbMM6zeEfkH7iVHo8vKs 9iuTHlIKafSiVFzp6r5wl9Wk/bomWMwzWTc55wnmk9zFv5rTzjuwdlz+njhR0mIoGrZ+/+e/ UtSCA4UD1dNRD93XjLdu91kzflB6z6O2TsGisSXeHw4h9MsK4oyxqSNnvloxtg9jhtYZT/eb Gp6Cxy5m5bp/BRcSkiU5JHRqobHic0j77ewog1/S7EdYqHDjJZy5eF7lfhMS2Lbbt9vC28Pb hMESN50d7fDg2fGnPz2L8ZwHPvuTRcChIEEpAeI9Jgac6ncjr6E5qTh5Qz8AP3N+vdoJuI8Z byK+L774gmZ7Sw/8PHz5VKbDpH2Gbv/h2l+KPnGfPFpZEVP4ulnTwkydiYJ+ketcJt0ROuRW EdRlJCihw3FHEbJyrXPRn58EP3rexqwdpV8PwyVV7mRNC+KJxxb6ITez/onhZRvQz0xTzQql dSsv2hSfXAci2rpNgw1ymlZgnC/qyYHJ8DD3jmTJk/1Hg5rX35S7J5JA3ApQ7ZY55tgLIC+y zW9r1lNJ5iK0VBjUlclOQ35NMJ90cVmdCnQquz0s9iPlRpcVlNpZ84liOw4oB5pwwCV2IUln kR0ZUqFkZNbKX0XHjdh87Z9djr1L37HYry96Fvc47RqAP3kZgp+J/P6BYb0nq1iqJSkyS2fH qtMIxta0Hrcvc0TugAIIkQkSq2TSFmdynt08v5G3dccr6D9ZrR/UX6A/nzZ9iMR0MOc0eZfW IYCevaEZvHMPWuok1Fspys6ORIkIwmGK63QJQhKvGWKHKt7lbJ26oOO2b6Ff3d7waGbAN4bV vLcDUWNAP3K5fIDTaL8rzomN2qxOof0o16UNGC2l9re/A4IBZrv7hB431CkGgjpPjPwIWd2w tgvuvEm2aXegJi9YYHwoR2Gdqlbs8EA/hC2Z569DMPQ3nbKOKaUmrRtsZ0z/1zgsO7uneeRn wJ5NKD5zjdKMKYxexrQfBc4MnRzGqcV9dLtAatrGN/1uP6RDFbUI9lWBOIWeZHqfAex77rnn n3/+hRj49DmcI8H82fgFP4mfE+mH5fk2/D0z6MoyGxmrE/VhMONtsedf02LPsA+Y7zP1tnq4 /PgUjbBgiG5fdlXJRE+uwn4IMWNERqtjwqIQuPrvMR8pfEbkV77IFVF/8LGSZXne1YZsCN4V LKEVavQMrGZpiBFVgEr0PWdYnIyPeCYcDK65XWi/KKvmNLu6cPnALsnLymtpPQsJy+AxZf1a Jdv6JoanBxYtI7Oor6PIkpkXVXN01RAsEm49NfvErlSMoRVgvmi6VmAQHnJG5tBFaOMQ5Sfk 9+xzL4j9d6EfLgVyT3V/Hth7Os5gJDO27Rrz5Qtztd4+s71D5YeDm+gbT2sXGko+hf2oO4Dg nBXDLBjuS+w66CdkSpDMVOOo1C+Wq/ZwJamnFvupvWAU+5n2k+y0roEA1ML1dhFEfgH9osHE gyhSzvYX2YkRRx62CqzI9SzH7asclTuAR86QkqlbU+8hw6mzG2c2Tu3neG4T/lmzE9Qfz6Ph cdMv7uH+glI/ae6qnqOMmyhHgguB5DWRYbXToturJUed/QEET7bQjw9utSNvNehHmNGHlRHI 6PHdHJwPDGVyS1a1H40yne2iDdjVrnpFleCIkjZK+2lK18VXFVT43l9HLo0xMRN6k/6eXSmY cojoEWRzIecQIz92ALvkkVqnVLSwQx5ZP5ZwPL+U0izRGeMKnVOR85H2rXkvKIm84szvoV9W ELPtyNhPg8egXr8BP9z4Ng7Vrh6xCzMcyTN1GY7hGo0YjshPxX7UMEpcIUdbOb3c+Bg77YVz 1emQLe75FCnzzxpvgo9CGYrd8AW5dSpnKOAXuA+o70WMl2K8+OILL+AF4whh9YDmxjOK+Frv GJX3DAuJyfoZ+anMT+Z28lansTlh36efPnzw4MH9+/dWGPfv33/w4OFDdkJWVy40xLJFAsRS ru3BjoYziQP7ZpBzvFlN8VnTJ1qIifZbHfr9XcLbofsQQ2n7zuIJxAOgK+rswSejwcfj+J5n cWSKIshfFvpt8pJiZXlNrWM9PbHqOYgHuuRWw4h4DZe4myvk+lz/xEioofQhoF/1UC/v9fL4 pNEL4EYP/WrTEJdVWgHYQ9EamBOW+aKyywpD+MxGeFIm9CydAC4C3YO9D7xCixc1c4cfxPVb iDJocRnasNR7gvfjgmzltwwT0+QFDebHhnKYcFOfImZgJoiXLfZj9sm1xmyvoGJjoL9yilKP GJQLl9Jyjr/KH1oNL9eo2wtSAWHt+5Tu15QnEX9KopTYj7p3AtAx/ORFME/mgsMUxWZiaaL9 xYxbtIa5v32JQ3sHMP+TTKDakwtRMpxnnbLl6c2BczvStorpkvoLU4R23NT6xpckfuH2Qsmd 6nfLuSnCb5sXEfrxmHVQ0iQwXboEEu5a0oZ+SlTMvqtb1m9PrJ/OZ8QNPe2H+MyirA8yPuvr cbAhhxAjlJNZ3sy27uffdeNXi9xj02OIPXVPnv1Ul/uOp7T302EqrWvXSgPBaXrPrmZcfGhv 5BDAYCMXveitHbF1aujn8J7EzjIMSJ7mG4V+npbqnZ317mN5EKfleCx6PAfx/TbPe8Vn6poj hss16hhO0C+MXuTIJEtbSz6j3A9WL8n7qeOFIrlAf+xv2NFPAiJs/epODkH4ke8D2QfQ9/LL Lx87duyVV17Bx5dffumlFxv4Y/04yUH8KHP9Zh06oarCvdJ7GvmJ81Oqm67mBH7EfYB9AH13 7965c+cTjtsLhn7oE/z03bv37hH/Cf2xJxYUU8jdJ/YLn0+cSybn7CmRu5oVnwNRAGg/jpVZ P0f4454jJ+S06iYpKrIvY9TWa3f8mf5+4r88iRlWan6gqHI16LeRSwIc1eESa2wN6wbLYLVE 0NGCfmt/CgzWMEkc7FVrFbLuqoRnkfAwK99SIGnj1rQCfb4ITXJklawmOX26iH9xMDhHuVKU L1KZ37PPv/AS9wEhPxf6Ue6ZV8KTOir9EGiYf8S6sUoHiSu2kWrqonGYgc182jzj/smZw+WB BHF3SHXFfj8iSpAfgFi/wl2s94PoE05THGgQmpSfMVcDXaFdY9lSnje+vEyAR34m03deotmd dUqxX8N+qjkk/gT6K/ipOr+4CF4F9ku1dhjRKL2CblvqN212PPZfw6rATpzJQSE/qXAA/JC0 5eHtgXMb+G8g2kE4oGxwwL9BOph7iwoHhfyykl8qbobfg9RSqpFwxuqUzXROypOnOCMlRz37 8dSqdmJr6/Cpe7uc4FPUFmdFMWfC7tFvp1RZZX4sWQiT5Lkpp0uAtxs7QHfYPYs1hd6nbsqz n+sy33lCD3+wp6eAfrJhdFb6RYmiD1q1LLowsG/Pi/4VY5ZlrmK9P3PE1imLlOjnSPWfNH0H DP1K6hzVWoR+oUNu5lEdF43brbHeh7jmV8MVOnZRyrivyK0YbrhGEcMJ++20wh3KKyT5fHBX 5X6wemnYD0l8EH9+ktrtp8APOXWyOpwwX4Sfjg6cHMR8r776mserr75C9IcjhKrPZ2z6SVmo Q77Qg6Tes/XcVK+FQH4ss2Ek8+MPqPEj8CPuu38PoI9479atmxw3Fg792M1bt27f/uSTO4J/ Dz8F9fcVujKPsR82TQ7JJQbeJ6X4bPlzJLSE/ZQ+HUaS89WVrjFOTBkhbCnognkl8zd3yDPV WNDoHLE20F8mYJkCgyJ4mWUovonq1g1d0hD87X1NPPH4Qr+1P4WWt4k8P9LyzAj0is9RIf9U 2q9pBWQPRWtgCChef5W2tKkViHQR8hEMBgdDGRLhvqj3Be7CRQj5weLFhX6Se7qbe7TfTXGR SD+nYpq4CGFiVrGxQGOh3nPYHeePT1N4rtsA3fn77mDFMkN3uRDhFtuQeT+6uID4A/oD7qvm MKL8gm8L0FUyAZYt9Y4VT5Zxr2i/xJ+4iBK/dwIlYV+xfgPsx2swAGWHGhi8QLRQF4H9Us3f R6V+XShWCjpENXtfidtXOEp3wOEDY/xIAyXlh6wtUrY4vWNU3rapdsLxk2KgUTqYsE8q7kR+ OnTKtLf3CRmqCpomscVoraNsny7Zsn4rH3nt5vZ1lJO1fgn9mBEY0H6Zm0coI6uU6LfDpJhz 5JRiLCHCF+23Me3kMCIu1OquhJl1mKb3hAmyThLWMHQmyG4m2V/zASzwo7ZOKfsJVd8hg35l uOYK4o7VTd/gI3MIYgdw1q7y1tnDJPgztgT+VlYFJd0i9hOaYQY/nY0efRnlfh9d7bAfk/iE apT582GqJTvzfTmMRQj7VOAHyxYRfswYHnsFoO/119+o8fprrxH9ifgj+OPQj7/4cvi5q+Hr OCmIYAcRl+r8OuT3zdcCfsJ9gH23APiuX7927drHy45r165fv37j5k3gvzt37t0D9Qfw9+jr byH6HPB+uFO8WYMyBBi9SMdOwbCiKHm1QxAu7EcmI+W36Rg4B/plMk7RWVoiK5I+gUiaLApF srGYXCE5+bFrvsuH4+MYsTaZFp7rv3sq6+2XgX4bviTg0QR/2NTWEHE+8VhCvw09BQZqRGEO zwC8wmE3u94OC/mFN8rxKNg290BCj/C0h6I1cMsXccvQjO3DQ8WH+NMcyk80nQB3DVL/x+jw cuqMkJ8L/Tq554D0s9xzSPoNLAXYO6EzeZkFazBxFOKU2FLtx1DzqN1TbhQlNqXWMjeixH4B /gS5iLmgFIdpHAb+KdA1NJQ+pdJyOlYIdLm8IFPsQ4VS39mviv1MPfbcI8lHoD/81xOP3VVU aweW+oVreW9MnDTKkTn1DiD6eiz/JKe/wwefEJRdMxVL4MfTG8c3B1O3r0K448Rt1etnPODz Rmu6PnBxO6eDcg6kdFjph2U1JSHdCconz1gG4bYJaS2UlojRIh9eNHq4h3NRS9EQ+ZyKiJzZ ZSjU+ctE86a+yHAFcnzDRxJOTTw4yHkyXbTwWF8d+gXtpz3phc6BPZJiacYgLQZYv1B82qEV 9QC99VZfVpXbHqbeGo7+8bqMKR135uk/UVGWWtUyEHTDaBDOyfohPzZwwprSuMub5CYuefwW Jv//yK1T6gQ5kEo6BILPYv0y6XGDdhrq2thLX5iO2MCMnHyc6/lKm+nR1b1fox+7B8twjQ5p v07y+eVn6PBw+8a1D4X9WO8H6IGqmeTp6PDsFq/GGfHRj5jGLj3hx5MDqO/NN48fP35C4/jx N994A693DC9o6QgbPhAo4qChzotHg3opk3NIP5QouhshP4g9H331xeefAviB7gPsA+r7+KOP Pvzwww8++ODqMgM/h5/+6OOPAQBv3gT6uyvw9+VXEH0W9iPfyD2NQwoz0wyNCpto+6kcqKAf epT1+rH50C/pRNMDrI0u44wA3y6QlEZ24oMKavlBjwKPRdhc6M9ES6N3VEgkSmGuzQtAxyYv SWRkqD5xhu19uT2x6jl4JASfG3oKkRcQAGOOgjP1OW4bQTVJFtMvwaHRS1T7lVZA9lDIF11E W5jUiUsrkOmKmI9MFgXk46eYo6UTIPCT2LOQHy1eWOgHe0vtXq7JF/8PXRHTyySmB21Jb0iA nfu5DEyQifnt/P7BmHtWTUSUmHV2ykH1LuZZ/WvsB+BlcEfiD8gLUk8DPyA/Qi6MgH4o9etc xS5Wpug5ItO6vB5/PtMX+31gimS4GxKAquCPf0S1fLwEEH5UnHbwswAoVBJJjU4r9Vsill7P YbV9lUN2BzT7O9IvkZ+An45vnt9vvomTG0e3EreQfvL0jvOIR44PnC4drMWNjSUCv5Rxv3WW ZPqHZl7StHdgIyXo1yzPyL90Li8TTouzb+ZwUT+/FXwqgMlUYgbA3AtmsX7OCahSJLPYMpEI I7AJWYjiJNF+iighJCvngv3t7+ANfUo3q5KqVimDRPzu7KBJl/eFJ0nm9F+GxXpL0hGsHkR+ 7GitU7u8GBccTug3Y+Yv0BLM3m8O5DsVu5SFY9ZUcpsNbcVM2k/8PBSUaDscKfwO+7195tQJ GLYDe1SFHrgnjEIZVHjSqSVgHyI4hHCRMeTBcfzEyZMnT506zXHq1MmTJ4D+cH7o9XB8cEga yrATepDe39N5OXowRbJd0RYT6YhjiPy+/OKzhw8I/ID7APs+BOJ7//0rV65cXnbgZ9+/ehUA 8CPAP3B/BH+fItJs2E/prF8K+nWReCS0qrYoFcOi/VT3mMaJC1m/BCEMpbVbomjJZjsRSBv7 KdUKltQy2ekf+SD4cHQc8yi2Ekcsi3lIe0gsgn6bviRykY34wwze826KrXG1FGi+xdC0znGU 4m6/hpW9+hXmJa5/YmhmBAoz9GtGDOS7qhoni4Sl6NnRCNqv0wpUvqhhv5yyNvPtw0OLBIj6 pBNgwkiMH5w9j2kToMPL+QuX3ofFC5DXA3rAU7PQ5J6IMYz8MsTIRMz1D69eYikdHSHYE4Xt MIH8MNPm7eh4Lpo6JZqA/kBiSzQvnpAfIBPkQcGl0B2BF9FfD/zkFh7Qb8y39T7ndARmKhmX F9RLsRRK4c8s9htdQ17CrKsI1WnbswbhXl/FsoZ5vn2Jo3QHPPtJHkmogiRQlF9AeM3jm+e3 xokTkbmlbIfhQKC/7PcnABiSIKaEcQSp+CNeLo738xfZEpzWTZ9bxZ31uz5jxUtFyjFL/djj tm/UuZw8uRb1ttavSNWVWL8IK4NWZP8fkWcnO91k7x0fKfJhSi4sUwZiDGbkSu2AbW8tZ2u/ 4gbxMK97kMwb7ug99BPpRwM/6z2HHSn+HUm632QOsf9r+/X5UVunLPXfQr9Nz46aFQpeBmtU Mdyd8kkAjsr8/YTk0+V+cK68d+eWeb8L553EJ/EX4C/gB3GHUAY/4HPpNkXfuTbchN9x4D6A vjNn3opx5szpUwB/Jv5cNO7WDxR6ASHB/+v8hRZ2IuCTB1OU2CDYQjRF5CeYSnnqg/t37xD4 Cfe9f+XypUsXL17geG/x0M9dvHTpMvHfBx9+dO36DYC/e/cfBvb7c1r/Fu2nmDccF3vfhi6P z2BTpe+gNMSldK4RM1k/RPj/NYxirTUH7ZfYb4CVBZiHH8ieYvA5EBriqaQ2N0hIK1DN7jAD aj+PA7sk6g0D/DHqxW69V3CFRfA4Qr/NTQyjv1JlUZQh+3UAr06T1Tpv1TLAdLW1Jg1W7PKJ /k3QEX6IlqDB+5VWwOQAJqTzET4N4kxgyih1AkwXvfLq60j/nAY1UMgPFi+fp7tn1LmxqMQB RiP9vpLhbiP9Sr8vVk0ardkhhrdPxr4SRLPYz/KgEltmEgqJoIJ+Up+b+AP4A/rDB9XXhYJI pGDmqSL93fFtdMJRM5jg27gKBvN3frFfhz95DST+cAkcvop2ERTIo9RP1GO6Wl/pqcdIaM+H x5s+wravf0B3IOLkgH48shKqYS0C9jFpe4aDqVtnbpm6hfCT5zc6PmS/v0E6WAlhhgZK6qCA VzkdaHrOIaVj0i+tm36mgTArxXY4LKxhctf8y6gTCTXcLQife2ZsoV/JpvYA/bwnZaOqNAmY 2d+BT1CPEOgd+crUGRSHlkL3YQn2Xo/+0dJ5IunKyuWNCqCYdbCBYOo9kcMTowB5hvfI6hGk PvSuGc+deu60G13L2v73qK1TOXxDDYCdYMv6rW0WTLxQzXWXq7C1X8i+J2k/WuR5n81qvwjj lPNg+jywH+v9jP1I/AX4c64PqCNhhjEfQJ/Iux73ke87dRqo7+2zZ8++o3H27NtvEfwdLyyJ 1OHz/KXI98Ne0F3FJvWe/9UV+jGMQTClK/3kFoHfB1eJ+y4C8Z0/f+7cu8uOc+fOn3/vwoWL gH/vXwX1B+bvk7vGfqj3g/evKcc8l+JgssZsYo+gtwX3CNB+VrOtBP1k4h9ac/ZXxG6JHhvw yz+D+9Vuv24Yb9rkQOcl9l5y9yXgv0B/RqJEfiHsY4T/mgx15gg+9VaJcjd2SRPYb2Jar/YF LIJB6Lyw8AFvEVGzHiYAGCDn36f9IWX9KGrc1FOQQIuqS27P0CYzOwq+i639UBFDxo1NFaqf eVsGPt0pthzki4D9oPk8xzkrrYDzFcwWURumhATCwRpKGVnvLZ0Akj9vngjkd1mc3+279wv5 RQsmkm5Cft62GGAwSJS9p0m/3gY+WLX5Heu4fdLPYFjsd+Zs11mhL/YL1IV/kvgz8hoBv4B+ ybeNrDWxWXSkpEi/gH4h2leGPbosgiQJu9VO9OrL4CUU+Qj4N4afbj6vbFnTMjWX0TIwyFK/ 1dbc9qeP/B3oYgepQrwPUIPz5vE4v3mA4+h++y0c3krdvonzyNRfxAPOOQ5XuPLBknE7r6uc zrn3Ll35IEk/bS3i8plPEfRTUslWi4YN6mSapX7HMl0ippwJwzm3fwv99gL9Ih1bUoQwP3bN HHfGkoXYRCLCSjzEpP0I30cWcfvU36Ht59HtrEXDvYHgn0NGIoUGKwfiKJn0cDgses/A4Udj nSISpg48Y4sUIs6JOZeOx0IjE7WcSxVVYWP5pytQ8xh8LASf/yczAtJsRI+uYQ+Wzqi9p/12 MHhTmD7PFL4RFer9PvrgfSTxEcix4o/oI3d7wo+EGYR8GPgK+jggcQ8M98prqPA77nPjbYC+ d98lwsIgJjt7FucHCgjfMI/IhkH6NSX8ofQ6F4SDem5W05+0tFMGW2gkkd/tm9evfYSIU7jv PP7AOzql3l5u4Gd5eYB/Fy8R/H187UbDft//iM0hjCX+O3OSRgs//UXi2LEyQCeTaD9gvwJa izFI4KwqW1KrtGuqnWIcjSYbuF+qsZfDtm/alI8vYBASEgAq2gb6k8uGoSgyMIrwV4B+G7sk ClF73g9TeN45PueIz29hw39cod+mnkLaxXpiQBgjvisUPS7kb97ATB1Hap57hhs84HinNbD2 DCRhiP3g9aItg/kdCbtNDgySRSKnn0H6iLtH5ou4a5yEwcs75967eJl1fjeB/KKjXzXflcsK owtdQGpOJWRktiQKb9Fb0FFi2gngsJg9v2L7bI1RESogNYK9SAHOvQeUpiERRH5CrSWCdjT2 E/AC76ZOCiLbsv8D2TgGFF2pX2jXSo/atGtm/QJ//nFhsd8Qf/oa/q4hjxmEM7oK4kKxfkHP fvpAeoKpLqNz71Gusu2/j9kdwLbJvIf1nkpWchsg8kMW5gzytjggY7yDs9W5W4QDb7z2Gk1f UPbncEBHjlUnuboZG2Bx92z+exevXEVSSZa1th8ovSdP2GKMMuF4787NVupHl5cB/zJ7SeMh baHfHqCf9gLtiwE30BH46dyU2P/nUoCoOh+0MypMGjxE6ydvI84uOzyXzqXI3H9pnYuqtvM+ lfemTrUJwDqp94R+ZKT3jJOk60K/zqtd9rWO2DqlqDegXwSdi8PgLfRbdjJ0P9fNC8gMS92M NVq0X5l8Mj9jp/ag/SqFryClw1TCfiL+iNYM/qj0EP4gzKhB+EbYZ0NPFfidOq1jw7SatJVU YQKc4fQw9kNcqJfib8IQRlKvLDMS3/Dt9+65Kb1neBpEoR8aUdBYEGLP6wg337986QJf+h28 9luSpkCdstSAFvVtnm7nzgv8fUDibyLg7OQovFdjxWerB47yooioke+Qb+LiOS/op5xEUhjY fdgqrYPezrS6NWK2Wpr896V4NoJ/QH+k/tKS1QkY6/qWY/02eEnkIiX6pNEnw15s2N2E3sWn WAOPJ/Tb3FMIdwarMij0UsznngIuEh7SfiX5JPZCvojpeWOKAfbrtQKZLlK2CLFgP0LrXYXB x09g05DYE/FhLkQU3rrQr+SeQXcpX0XakQIAJ0tUd9uRfpYVZYHG7Pnl7bPv7DfsrDDgPoN2 NPMYqk+ZqdDcJSBXEIKpThc4fijtGgOg0ycnrTW5BEz7DYv91GUx/Min4E9i4LwGYU9ZzCTw iz2z0npCyGx9eHFb6reLHeax/JUKHdyIVmZ8VF7DZpcnOBOj56N4AslbplaJ/lSyz9SO4gHA P+M/q060xpUPVjaYZ3uy+Sj0g9zTlX4k/ZJ5iZ1FKSWcr+Wyee/2TbfOHXciWeyzuYV+a4B+ zgtM7e+QJhLYnp0VU2qwp/1+Sq9U9VutrFxI3fvaudlb8y7WnGY0Q4EJvaecL1hlGpZZ7tSq 9FjoPbNovOk9Lc/gSXKgek/QO8nASn17+NepA0/GFuYbFofBW+i3y9ke6ZnguKM5VUIpCIa6 +V75e/Z3yBR+Jqg77Kck/gVk8U3VgXuSxRfwB0EHYIYH/4cNgNC97/XXA/cxX2g6jdV0HijE A0LD4UETQHECeh0zhTL2s//XtZtDR3VAVQ4nsJ1FZ7RHbwkhvyuXLupleSaxHuEk3USPLxhy HMXPshbR13rh4mWHnNB8NpnZmPYD24E7pazkVFU4ahGi+d5K0E9s4n8EQ8DCJbZXDNq17j5v /2uvzhzqv6Rn41ys6jJlsQve3fG9u2ta8MmSrnm1fpu9JOlQSfwF9ttCv1ygf6vSDK1NilI3 MzGYl7MmQ4J8enzCgp2tm+wuIp1hXhUrckj7Ff2trjBBasWeAd6PXDV0ygOtAMkBzkhT0qSl NfD/yhhx5yDjR5bh7XdY5lfLUGW3QH6i35NyE/TTbhCebCQdmamdIP3KTGBBatnHqov9ys5g ILbsiv0a9BP5aOAF2s3VddinApriCg39wIsKnN5l7ju8A5KV7AOKgH5l1c4CFSXvkGAfd/br LkLYz7JPXgTRJ/dL36V+08ywpvOue8n9L8pldK/pl10cXdtfOdg70OY+WgSwFByy72iwgjQM BTFIinpcRBm9M6w4aFmzX/FAlw7uF3ef1DnDpI7Z/Fv0bkrX3jhfRaQXXyRVDa2urfekc9OJ Pl1Snr1z7t0W+uXW3Q4UZuwcviwje8ORjJuYtN9Efwd4x6MSO5qe/hyMQuNuI0ra9/4Oumjr 90d6TwnKbtP4Qtv5NL0nSMopek8wWCkfWUOOes6cnfOto7ZOYXrxe3IgW+g356Gu4Vs53Z3p mEr7KX8PBSUmfOPmdzSUa3Oda/NPEaMm0aciOcIP7/aCf0j39QNoBCpPwL4s8COTJhklPVRg osnxvsvxSPwV9iOLRdQosRdS/tZ7xvJkkZGutkG/qMVVqElHeXJ+DjXjAu1CVm0EF3zCvhMo ZT+t/Oa59yLo1NGEfdNsAw1GEUhVyKv6sCxhnqYNwJzHlF9+zru/IoVZkseritGWicZ+8HpJ mQ0O29kjui+9ylSsgm1kYiH8ZDfAtNVg2T2bp73CFktzoN9+XJIbIMrrRbwf5vCeVgL2xseM 9dv8U8iZYejnqWFCONUCRfvFtpHrIPYMnu/9nkHsx4QFiT8qlR0eekZGfJhCZaSNImOExc99 AykYRIcUe37w0UB4zaJbtCjnthW4inirWy/yeCGbJWBFe0+JikT6LZOr9bE6KPbDXRgU+6Xb Dc2GGaZ640zwR+TVIa4EpwH95IQjcDrPpt4XMQ9/UiFnn1OZzegicCl4FLgfcQmjqzD0m1nq t0rt1J4W5/aXD+sdaNOOgXKQCZbgcDWqDh5HOAbssGmj5uxtnkhq1hRHTp8O5uJm8Ucmdd4K Hbdce5Va5fHaiag5kbWpUCSNzGomKryq3zp1vJybminu3BNjC/32DP0GlUTZ36H1/xk3nckw ic8xEpaV9WpifPmm2OGKJZvzy7B3sWoiFm4bKXoWqV2tChSrE70FZThTOCiKVzo/geqEb7sn 3Vyj6F1c6wq/cuTWaYTBrHtaUvy2Zf1WmA/1o5oYinzTjKmj/a6yPRaJLCqG/lLi+p0cWKoK EYirIo5D14T7d+Wgwjo6RHJg/iDUFPoT/ogmr2ChiPnYs90oisYupaCkeQp7533EgX57V1mT ZxYRvB+rBw0hgRshCVEfZ9YPe3n28iZENg72ohYXck+Y0YAYsyjSceapkzSfVvPZmcTY8Bu8 dvefsLglCAcKUtBMDKkhB50dVNatku9G9X0t96qKOJXvMNMNEV3WGM+i2CS7tZBUcTTUYX53 EUYTeRv8kdFcQGi+Wd2XVIcBCzZhP/XioJ/iM6R2EvoBZ09n/fbjkrgzqODv37z971nxiSXw eEG/zT4FNlx/xk5ATAzQ50XWfh3tl9V+Wom1bQj1MEzr9gx1WpHrUmVj3mOGR55OQQ5wqTPP Q40ARAJM+FAnINznwuCz70B3LcpvAvnRbom6b4EqQp04rSGQZhoIBqO3VE5y/qyCRFf6Zap2 cXSh7VMSoXCChzpFxX5YIDduU33e70ZJfWL/VLgq5KUtSpfnGJa3h1V2UsTC4/xTlC1JRtQJ Un2BGf1Y0WOzma7Y7xy2xIkgS/jT+3f8uUB/vIy4Cv5Tz8hOrC5jIUIextKBj+eG0nXWbD95 nO5ATn0WRtEmQMy/mq8D+bEK4spVneEfsl8u8reqqo/iCmeDGQ9YjqJsMJc21zZh32RShzru O/dhsVinq1o3UU5AxMB1bS6/+BfW7/atHbJI7Fdzqnf5gLbQb6/QD/dQs6OO1fKOHxqxD4zA RPvxQSaa2u/+Dp7QY73n6bdU+3T9pvRvdu0a6j25UWe+wSLjt06mIWn2CFqgHtnkvnDU1int DjW20G+T0yLXKFzqLHCerPZLbp5uBWqUlzzWDob23JAnGfuhko4d8xDIIYsPXo3gj0pNBXPA H8cx0OXVg//D9j+hnWTlXPimoGXCxx9fQ8f069evXfuYHRjepzqT3iW2DbV8kcjPBmC0fh4s z0j2E/npVHBuhnJPtqDoyuHweiqHE8Pg+FJB5uwPPqLifMLFk3NQ5HntRp5OWYyQ+SzeKp1O Vnx+JV9B5iVVO5N5yaxvtavt0tBPh16VTgF56+bzhvnmz69jPMUhsSsBMGF1gT+4K4arYoX3 ONtlqbMA+m3ukkhFEvsNJJ97WiPYG+uMWsr0Cc+SUypTzIfO4bOg38aeQuu5pzYLiPua+6tp P2wbmQPRtkH6O7CfcEVJGstxV9gPxF9mLE6fRr6CM1LhYemVmTJi3kV8n2l3Ab/LNFtieMh+ fl+SeWf6JZFfQr9AfrJkI6yC9JsZmLmk3zxOuc5ViN6oeXsxO/vRzWBSbBmkH7fOBH+CW/jA CJbDdwe5ZF+jteGWWrLr4LEJa80nMCyuml3sh96sjSfpLkJ/j0Cv4b7uIqois8Of7zisUevD ZjXzxLx7tKfFuf3lw3oH2qyjSwDnPj1ejkdvTZRA4AzHIe6BBK69tKu0nugP6xvBABa40q5a 2Vzcyqoeh6YGbH4ldbS0qeP+5rvprTo7xOBExciONvM5isLn3dTxaqKrNc68i/AulmGuNdzW sXtLkxqy1RlSoB0n++uWEehvL64yrKvCvd3kkcQdY7XXx7a0guAT74Ozw38DmQHKgTvv+MVG L6hT2Pf+DrGNll8Wrlh+5ikos0bVgrKByQs3aprSPJAw//KFd1GTLTsuOpb0e+TBbJJHbp0S +sFVnqyfj9SF7a2Xjsew9mNW1nm96MVXnvm1iA/7J57w2gdijWILd9nO+fDMZA9V93VHICWj Om14OxyKVMIKTtjv669k3ADij8wawB+YP9TThZEK2L9ThBk51LHdbRwS9/nMQKP0GzduetxQ 23XiSNtA4MDIcBCHBCweUOiDpn6gKMexVug9xcq3aA9yz2tqJNZMMOU5ZhealJXN/1eaM4lS VIdOUQpYh4/QSZo7hIuBi+7IO5WJSblPjxSfjOiiuk5MCjR0S0I/whAqPmn0Qg8bSj7J+8nE hjff7qWznEvdOLF1X9K9feUVOLC1xru02342azmWgH4bvaQR9sNaxhzeyzJ7YtVz8IhAv409 hRdI/LnhHnruuQeXCn2q2i9d2CV9tvY6sV+gm9gzUM4W2A8ZC8xayrClFbCjb4WHRIA5kDY6 TrW1EkZnWVbkYluJPY38Hgn5QfWNgqCB3POfvcUM/Z4+0V4AC5UzyNTSCbDO66UkRZg7GeCo pIW8OEoe0eQCmahBZwUpAEL1qg0Bm6fuBbEfP/MuURuqFnSU+t2Azd17KluaKPXD3McYnWcq 9mO2mvjTJSrVaKMcd3wRdQmJPneMSU09TsGfss1QqZ/apKmrPK5gLwtw+7tH8Q5o0iVHgpQx 0x4k/XAWXrjERMxHOMRximsggxsddCX8tLFaFtgjAdzSwVzcXt0EftJxh3eTFDWqplAF7z8k oebaYe4iz1ZXx061B1lWeherqRIpW+iHPWF16DeYH8oMKKykicSHH7v/D3ZpZ6QqQ67tLwpY kkkL5S6KNnP3W6bn6spLirvo9L1cgjJ2DbOEg3EdlSQYjrwojMjsmIQRp1cWGa98tcv/wuA5 HIV1SuSXTYOVTV2EzpaPx7bQr583NeOHtJ/d+rBIb6hFFnbcTvLZIpjUWkCghFgFa+DbryGj AvwA8ce+eQJ/udvL4hlQQ41e+YGwQ837EL5FdUAcGTdu3rp9+/YnGPjnlluvG/tFxwhmCpke ZKkPWDcAL+0nuTzDTp3Z7H6BshaXcs9qfyAKMc0EaTa27MiGFCAgwlgevB/qEehBRl+/7+xB Jk/UiOqkZcBtGvecRTDl5KBsbS2iQ2VdpcnmqCtR1BWKT+vDQvJ5R4rb1rOQ/THSaHvKv2id yMYWg+5LYP5gvs2Kv3DcJrHDMv7jC6Dfxi9JLT/N+4XTyx4jT6yA1VKgy281v1qgLeoX4pzP V7xCsH6bfwpihIH8BP2K9uu3jXRkqEYnRDhBdpl946Q19mPGomkF5LuLbJHEAsgWIVN0og38 H1NG2D3YYYX7BtNFsti9g6YOMloKzi8O6cb5KUJMAYDlntLovKPOUa/IaXdU6TcX1XD3HHT2 U6ZYxX6TYkui352dHT4ePB8N3BGN+F8sZ6sDsoIEyWTmiFIeIHD6JxTCPwXWO1gEzH5dRKtR mYE/B8Xa7Rr090065lXoIiy8sjBWDga0WQ/bjG2p35zV+i/yrZr5LPXL80qkn6pu0e/oOk5x HuM6wnGGG/1VOyWHA+r43qeDI6ej6g8U8CKjygpe0/lIqrqYwmx+SJSN/KLg3Vy+VdxM6GQ1 RbdmFmzKsZq20A9V2tSHc1dYGfqNaL9Sk2UXrmaakplBJb9i+4v6Oe1++9Xfwbto5jKEOdKu OdJ41Y+ikX42UrP1TWcqS72nhBGDjfpgNoYjt04R26mn2Jb12/CEicABU17dTESxvlwR/tVo 0Bz1a9WgymiGe4LyNJHDB/b7/ttvHn31Bap37t+F6pNN08E+xW6v/nyCGUAaHMAc8IAO2Kfu 6B/EiXH7kzt37t69e+/e3bt37nwC8Ef9qFoWoA7olGrzSALIHEak3+WxikCVAIZ+lIKkfKok XhfA+Z0+VX0CAfvU1bz3kJ/3Of3l3XkIIpcgHpHpl5t674n6n/90vMfdU6nJpvhkCc9Q8Rm+ KiytWwn6Je2X/erBoODeZ56VJfawWGOLjBkjWifqLFaVlboBvvySKv4I/thHDW/35eWh3+Yu 6Vlhv6ee+t3v7PKJXN3eSAfs+Y8r9NvcU3juWauBCf36aj8nBsR/u687y14jUMNK8KDCkBlT FbT9yFmrLeMeUhbQClAozm6b5yUWUEqC8WEbzBkhY4S94zyLihL43fqElB8kYUi8UHBNzs+F foZ+LQskglzunpB7qjA/aoKiE5OBFSv9Fk4tBwyDzn7obd93ViixZbR6EfJryAt7aD8S+jFF 5GTy/Sz1myG1xAZep7u0VUgaFVEx0mWX8VRehP+0nkp3FaOLGOFPydPVJq3hzw0fUtuXP3x3 oJt01jrT/vnEaTDeLrsl8OMxjnMcH3SIG/118cC77vgX6WCs8EgIa3VH3yTquG9E01wX+tHD bVDBy90kznjx5CL9bN1Ef8/BqsaixoKZdzu30G/vtX5UfNYEUW4gxfAunXMN8pfNAyvFCEn7 9f0dPmZT03eGRcY4/LPUed6zXP57cb0RBlcrQkPVaJLDriI1+Uz6yWVBMq69mMouf5mr/2Q9 BpfkujLj8K5TSGRp5YD+GuEbvG3pvvozX+43NOWD6KZLc+RnEL9gEyfVLSKL1dVZv9YxWQgX ECYI05D3iyQ+RZ+s+BMAQa4vZP6I5tigj+McBz95DxbQ9ICmr8vVDxvuA+i7/0DjPuAfzg2F hCn5FPZjueBx2jyQ9OOFgp9UfVFpm3q9p0vhOonXeZQNokP862oeTYyTBNfTC0bRYG47ewwm o+k0Q/wJKYNoP28Sknkl6/fLf6n4KmXsI/9pZInsnoFomn6aS7F+/4/5OFVGM1ZM9RwZFIK/ yLPirIXH2qwh/23bb0cRPmR2bKERok82eWcHbUI/FnMsYv02fEmgIiE2jHK/MnpZbq5P/ymc UY8f9NvwU6AauK8ETdqvbRsse5VBVJ6WYS4pmME5m9iPOnGw1UBipRXo0kVUK4uTboJl5YyQ Mup1AggOUeUnyo/EwBzkl1kgOiKhKpbSb8g9GVegji4ytawklZJxUZTICGc1saVJv/8J6IX9 M4a+wM8jQyQWPyVPLvWblFpGFFtRS/ajalLxqxm0lLTKqaiEfkU/1mXoGvIiWp6Kd2pkm9GX sUxfWduvPsZ3ICd+VydCSQg6ArP7OuEagB/PcQ2f4tTvRDxwRZ6fKEfQCucSz6F8MFVAly4h KkBMIMrvPuv8aPFCr/Ghba/ySJ0vkvq1XL0SKm70V3seJyv6qzW4MPexxBvbsn57Yv28M+bB Wp1vFD1ksKagMuwDI0OOcNI4vmW+yOBeot7AFXTPPfO0K+ikeliYm5v7qLtvPoHH3uKAp/9E iGTtPos8GdWF3jOKCAZ6z3CkGafyPenyJOn+2H5+etTWqUz8ttBvP6ZIBA5B+2UCT8I+eRsx eFBzP7YsUL7NQVwEC4X9wH0L+yGQcxaf4A+yT1J/H9OlEwDkMhgoUFA18H+X2cUBXmAqDXCi 8C5g38OHn3o8fPDAQAbq0atXLr6X3u+oCDjOmgC0V2Ce0Y2k2/JkVpCcn0JMHwuIL7s2Xu/S MAbIT8JG2lmWpUk4m8z/h+VvfyIeeina2Fp1SgCKkNe9h3BEKc0uKYODOsvYpwoEmJt0ARVp FBmmzRU5O3rzy5JBSeD96MsvPgPpSvDnkxbEK03W4LI2c9CAO/y3ZQoKOhSh8CvHXoLo02Qo SE40W1oA/fbhkkhFTmA/TOE9rBRs+nlCrbusmLH5Hq4sf3W1K9yHp4CJMcJ+YfLpbcPLUZW3 7CtgO2z7bAr5IV1R2C904sjWa9pyx6jwkNyfskVIFJVQWUkjpozI98EI+MOPoCwD8Lt7n5Tf lyjzQ3g4k/Mj8rNpJaXfjCoAaCKsyJbBK5B+Dfr9zmmzChi0I3WucNEZh9DvfzzyOVkBqv/D npriAMkU2HL+LpjJBVJLzI/hFJ5X7KcYKy6iLgF/uC6jXQTdFthVHrdKbjjqKj/VaiZn6vbf f5k7kHOO0I8uL6gGkMkLKv3cZAVLsg7yhzrGmcP1mRSuL1jgmQ9mMliDCWGlg2ERKhHQTVB+ Red3yI8FYhxCfk0hHQW8jfRjYWpDC2L95j6keGNb6LdX6NfPEJ6smZFSDbKs4306RPsfh0k4 G6TK59aTpc6hyT8l30xWYwvHL1WMPfdJ99/0Hiq957gbRQjKMqgz4xykn7fI3Kc/cL4hCnja pIscXf/39u3z/ikcgXXKR6vxpO2BUEI8NwzmybW1edndbELcHPkOVfuZ9sPtlluBnF5Yk1ud VKm1GGA/0n7M1MCzj/CDos/vvkHFH1SfAn9tt7fJs/r8gIbCUOM+NXFQRbgEIjouPv3ss88/ //yLL/Dhs0+NY9SxgLQfG7ujUSC9Qon83PGVFiuDzWSk94QJCu0k2rHARH8gPwSxzbGQpXbL DNc4MeBFsKfydvcWzASRfXHUdnaa4rMrCz7f/NJ1GYScy0E/RJDI2uP2Wz1X2I/quYcAfz5p Ab1tk5puaxP/sn8GoHkIcUD9qbNaYb/nn8MIeet81k8B5YYvCSWIIJxg84ktgtzMYgP+RcsC 8/8xg377MTGYE6h0CRIhWApYCdilaXIC0yWsR2wbKnul5FMrgcHadOzHLSO1AkwXNb7aySLq lSlY1r+UCQD2Gfdh58C+gSjzwcPP4OxJsSeqkuntmWpPRoiRA3KCxLpoOP0SzzBE7DxeWEdH eiBTtYuQOzfPKvbrOytcQGo7csWpecXbhwCgoJ+eksGXv4bPA/oxkP0LLxPUJLtPyDwgOpRN kVr6IqYX+8mVUFUqrTNrfxF5Ae3fnbgIeNg6/lKzYqbex1YzbK+1OJRetP623z+Kd2A85yxS 4eK/eBlUHZMxBH4+yX2OtzPJehSmg51zZDrYS/sCPlM+WEkdLW7ouIvOHyC/0nE78xkybtic KaNzQf1a0rqJnkStPHbuDY9YeQv91gL9+uI5FhJphpTRS1PD82jAzuNi586tFdv0TdY6e+8J h+P1035PdPMZqQyKrkI1z41cgrLmddhMXvqiRLGTg8v0pIsQZe6c29w3u/cVkj5CqUO8Tjvo Zx5qC/02Njs4ORi+WOactJ8bNDfJZwZx8DdK7BcFf4H9LOD6+a/QHZL4S/CXCIQ+nWzTQJhR A1373MNBti7Uh+i0AOr78suvML78EgjyMyvBIPn88P3LMvm0MfQJufzR/5l5xlyerVdM03u6 cCZJPyT6ASDRHJ6cH+kLIi73VVA/kWU+sPmeDC7ofmIyDAU+ulvcJor2syVqKD6Z0G/Nh5oZ sKQMVJuJ9hPyQ45skeAzcZZ4AjfYaIJbgL9PHzygygaJ1tu3bskrNdzWJv8hNlQHDaA/Flmh FyNuj7Dfyy+C+ON4gaV+C1k/g46NXhK4GUpjS/KJ2HNv3Brm/2MJ/Tb7FMi+YuFE9w9awFbf R2i+Lum87PpwNewn8KdsfWg+B1oBCMVRJQy18s3rEAuQHGBKAqP0ypkzcv+X6zdvSleGIPNz CsJE+UkSFjZsAH0Gftqf+LeM/D69L6df7CjKAB0g4t8CpdwT86qlFBbrPZviM8WWLUk5EFv+ VGbwPfTDculHQr+MfNwn2FLLeV0VfLyXLfkwbBniT6n1Af36PxvyU3+p8Ge7iJHVDBR0z42s ZjZ2Nm1f+LDegcmQknmfOARR9yDk9ykyuDjKNZDHxUleGUkkJFGMjmhAK1xLnCsbgwlh9vSV TwwWN2KCRucrqfN3OSza5IW6HnaK8cKWjJsO3oEVZLLv2YqEznKJwi30W0etn3dGn6wihns0 xcoYqaPoh0cpmQtjGCdZ8em0k3NfIXuwCXPZpzy5tCZ/qRXE6TwMAzqcmnpP5fCYxJS/53+y fMeSeLfgkSSeNYmVb2AWcb261KXeTP9DR3Cd/u63v/0tFZ9D9nWW2yHnjIhiPgqWSMxptsVY cfiUF+JKsdDSFFirpw4e7skGLx+dhK58OIo5UCU8dEOC9rO70UDy2QVx8raNwh3cdt55836B /YL4C/DXdnsBEABAcVDXMPiZWjjQBsxlAcwSfv45YN+jR4++xnj0COgPJwbCQVq/S/EJexa1 iLfRH/wegLiQZ8zlCSdSCS2Hek9mBHvSD3JPQBuqPRnACvihuhTDZPOCj/g54EM6ELEoL7Af GhoBg15Fd8HQhcO4OAO+wH6EflameIp+clNShuYxEbRfdNGLs3TGnA+mgBM/aL8stqTg1pCZ Ylk55dyhWSpA4IxBbOhMrMAfunEMsB/AH5DfS8tBv/8RdbHBS5Iuz+xMo/363W7Fz584etDP 1mMHOjHEvhZNzYXg7h/R4EF6RyZBEEZQKR5rkrzfNOzXaQW42oOwjmwRMkVNr4zP8P9IGWED UcLI+aLPEGI+YpVfE3sqN0vNNwZQZoqiWVnIBjREfjCtpIGAqkg0rdSIKWuClkF+TfGZnYLc GsedFW6NOiswsT1EXSMIxtXMTUIhBa/zISwr5pX6ea5jCmsDT/yZ0iqINjIlVsV+ph4Hf3fw Pw1/VsaMF5GlfuWYuC31W3Gfebx+PKcczOHMJiABytYOLhIB5S8BNlYlz3INHOXK48byBrdP QUqXDsbS5tpWO0D2hZAKSMBPdD5dewfID3uJl3aG4NT1YK6SfokC3grCNVuTyp//JGotOfRM 9mfb12/FAFhxJRURCCsziufB9da7bH2T8VoviVCYpHBmtANGEd24v8MaJD85FTydu2vNLbTU qel0uITe8zVbRXfcJO5F/qV9/vfIrVNkXjm20G8/JgpnByIH0X5cpEF3ixY+h+gBy1TlfvbX kngrNJ//7cXaYz8mQkj8fS/mLyGIzFqAPwA9bmGQhOK/7uBwB9EbdnjjPp4VX3/9zTffYnzz DchD6sA+VZd4RGpQfEKPiP7wbBDoxl7vAnCBY5Des5NjA5wq5lPE55phZq9vX2fhDLUg8P5i BbgNI2koC7ynSbfEB0JDoD/Zzwb2s7lZ2s18yo0i81lN8VnZCTWCCdv29959i41gjknJCB4F Q/I5nDlKo86P8CeBljnXOGg/fcgqi/u4/zPH3bvBDbIq0+0Ao4EivV6OocPfiy8A+RH6vUod sEyvRtaBdoFO3doEHF3nJYGplSMOaD+YfGYidw/rBNP/qLF+y0C/zU6M4stVniqmuiSfNohC YjeU4hPYD+BPtB8RGXIhf/uZBX9NK9DSRdgplCyiXqCGskbo+ondo+kEBPyC8rO15wj5/YNJ F1ID7H4J5KceLx+weJhZIPD/2goGOuLVoF+mtgfuAKNiv19+Kej3vwO8Ff8Tgs+QBihZtUSp X6Mef9vjT8RY0zr7LQ39wKRkxqwS76dPkh5VuQ3Y0dR7HlRYs4dFv/3VPd6BCik55RgxGPqd fRcSnA+voeKd5XmEbEjIeCCTy0RucH/M7qAWhPivSwdHRhgtfSMd/CBeBRW8Qn4/Q8jtrmo6 3rGDYAthzBFyz3LwZgHviSHpt6Qn5Bb6rYf125PRC2i/FrQllg+jK7K4CeURua4DVQVMTX/P nM4MdUZ6z3CN1rxzGh+xnHURJYkvU9mOad7jctv1rx+9dfrb3/7mN1vot+sHvtIvat4T+zE/ k8WViGCUxIOIUUFcJfBVuCMXFSfwdxDoN+yHAIvkEyO5Bv6426vOOyioOzXYv4GoD7APBwVl njwpvv0O43t+IHcI7Gfod52VOUQlbwv70QsaHi/vnr9wWYcN/D1Djq3CojgaEFsOUuipBVEz vUR+YPwA+36zwkhK+g/Rh8HtMHDuschJAV8aF4fESreJGX1HVCrjEXmMZllnw7yKDCSxHx1k onJKPvFzcBY5Niv7GESL92OxJVCzDtovXGXxKe7/rEEf1fvkWSizI/iDt77usoshjf3Q4P6l l1nUuAT02+wlBWBH4X5W++2VaX/iyEA/JNhtRLME9NuHpwCFsmg/NPdr4mcthJB8YiWg3E/p 0iHvR+CHITaOmMxbxg+ZIfgccmVLw5QtcqoIISKGlMtMGX3C9i/YOrBxQCfAbUPBIf1dVObX IT8d065ENvJDBd09FASBTVOhX7l7SkZcFaRLIb9g/Zwuxmbw7KBGZJrYUqzf/8YY4T9BP8Wy QF2t1I9VdgNv81a25I0eU9jpi8CfZTZzken1Mf5M6tHXMLoElg/v2GqBpX5xEWyulaV+pkex +qp2aqXTZvvDj8UdqCkX0I9T7s1s7YJcMaFfrEsd5zrMdSjhTGJyR4IUBAKRDtbCjpQwRUBO B1MFpMUtOt9CbvV1cGJXuSPmdIz8Su4p0k8ZncblN4XIgkzFIugHbxIkdUvAzeMXKV1GGSEt 4rEeXZuyvxuRygp1sRs+khjwrZbt9FskHFtB9sY/07alVYxeJHyoxFM2zJuipdx7pX+3gfKW pG7iRYs33mkE5VcO6PDco5176j1TnNH0nqQUVJKdW+Ra4Onuto16BkdlneJsw4Dicyv43N0T X+W3tEQJ/Zj0wAxBlau7sNDI33U78mxABRsT+A37sTQ3R0VyyOI38PddgyDwayH+EwcFGkqD /0svT5YEgO5L3Pf9Dx7fGz3C++8hFJ8o9jP0g+LTjb6A/CD3RGGRGQb6e6Z+gHrPCC0HbgUw dkCln8zcO/rIwO/fOH69cOjHPDt5s7ClqbgmameRJLp5W/4WckSd8PhkA6IQJYeY6yIuB7wD 9ws5jbKPXpYQukXYGPr9JzP3IRxjpAbkHQRKd+eF/phn/fIL+eUABE4fn+HJVBEG2wFCV0vs J03sa2h+Qd7vxZeo95wN/fbxkrrnNg6BV5n19bOrn4NLa8t/tZ49P69wIfTbx6fwWoilbUqb 2E8Fqijlp/ZZXS7vuNUJliVKOpCSwbnpGp1J7DfUCgj9DfTKEitTt4x4kSkj6QSA+6QTEPD7 UYKw/6DBi89n8f7gBSotIs6PLV7u3FJHPxb6QUZk/h/CbzpL/4ZkFvIJy0G/UnxW0FDlA53Y sosVRY0H8uv/IQRrqMspbzkSI1nltlZ9HJkMhmexYzkW+z35+yXw5442j+6P40/r/3gNuIh0 GW0Xoeop9dbKAoe+WXEtpe0n/zJ3oEJKbkpg/QbQD3z/XXZjoAYbGZk4z5HM7VKSU9LBWtr9 6mY22FmdHyz21Nr+T8beubTtLjfp2gsZN9e1+rXIETISFYt35KMI/RABMGOUkcWccidta3mg EA6ovGeuvmgHEYbQ7e6g3xBQpdGLYhon612hw1qAEJGxWiQYtTRo+DAzT5NGL9j89rzqPJu9 geqWpN5TPoet/3y0qMX8k14lfLCaDzMLEk01d6ayy54ke34X017gCK7TVaHf8pOfp/p+JD2m PYjD+TVGDrwlwn4C267JbXU76u6HBH5gP3m92K29wF9hP2ThIOEi8/fnH5KAIgQhAPlMOMNt G/gxnDxp6iJlCBKEOCd+/PHPHD/619HvWdAPaXr7vMCE5K0zZ06fQWfnsyT9IshsPRVorhLQ j0FfSAfc2SH2EC7QygjS2IHSwVXGv/0bUxOB/UjRtZznUHuKIHRJxaecM8D7zYJ+CWz/0Uf4 ytJjZw7sR/GcOFfceR60yLNihGWO6+0nP+rJCP25qbaw3znWQNnq5eWXMF4W9GMLQ8T1lwON 7v8lUcRTD87QDwt6L7s/Jv+KKdCVztk1LPm8wlnQ76CeQhgT/QEeScR+yVVHY2crxVuVsHL2 NmgQ7uOHqsKbTBeJHJiqV0bW6EFljKwT4LZh4Ad8SeCnzCzCQx/SJhZZUAi1p5Afe7lT+W27 J8+oRiRHN/elQorh2Uq2/lXum6p58k5g7TelCErZIGfToa72qVDXTh/2TC/1+0MntczJlRcx F39WiOW8UfvL7bMG/WLfzJT2oN7wOYFkLL6DNa/LN7/99wDuQM64rtavOwEB/Uz6KSXjA/1H nedGf4oHyP5FPpiJYFUk8BPmgxUaQAXEqIB0fmZ1am1zYTP+Fptv5MflItdek/mRTqUdNEm3 qg1YtKoL+hkXZa3fBbZ3A4HOopIuk7OTuGgR65fq6GWeFW7u8EiaK/PgJQyOJDdj6bUCacv0 619Ph34LX38u9FM7VN3joeEv3kZH+yE/0CQRvdHLD83oBW8l7mdTR7m/TfRNYIo8uq+u5fD3 01AArDuOI1b+npTtg/gI474ulR9y44B+LTl2q9mQqnhg1IFimae+kZ/hMxi/s2LnmaI5dOuU yE+xdV8g+va7FXMG/fo3Fxlxviw9+adAv83M/I08yk28qGb+r/6vZ0iHZl7LIK4S+IX92OMh sF+CP4Vy3o4p4TL4M3wLBooUFDko0lD+h18Q6lN1n3EfQN9fOAT+5PoOv0q0X07oB//Jt4n9 gPxE+rGDLKsRx3pPBZZk5VHhE92pwleFygEW16FmpQv3kOpfYQAndySp2A5Z5l4aNQCd9Pj8 u2popig+TfsB+6GFepjHmPW7OrSJH0K/UPYZ+znGJfgTcCb8U8kkIODMIWiICvxoxnGbVqru oHjmlFq7H3sZxB/+y+71C6HfJi9pVJdVB/ru1wU2x02es7u/sPrNvMKEfgAXBzwx5JFkk88/ 0iQJozyPXu2U4n2VcOvF3BF/AmcI4NqOUemiyhYpPnzYBv6fKSPoBIz7GBo24NeQn4JDUn56 dawJOrwwj8QAkb3c3dGPhX5BDih8IaBRNmG5fILP1rDXZHijqOEtRg3Ylmj51HWv+sViy4a1 us+KcINE/acmHlvY1Y/TxBeBDSnz+IU/JUCH5fCjtD5WiwlKBro/XZ/yGsz68SJGpX6snkKp H7fN7Ky1x6xLzfDtJ0fuDkyGlLB5UVrQGhyGlMBtgm0+0TObK/RnCzfpUUbp4FrdygYrGTyZ 1dHaTjY/kV+49qbHS7r2ttIAL+sFt3oM/Y7F+xpBvy70nCX4FPhMXHRkoR+puPmsX75F5IIG G0Igqs485UU0fxwbvciYD7s2N6ZG+41STzJ6sSmCE7/uwbMmoxdtnwwCKnXG/bMMae7cg1uZ GtSyU7Oyiko6yFa2S46VOGNkgbynzPSC2brw20dunf4GsrrDAf12P/MXPpVD8wOB/Uz7EftJ 8gl7W5b7oU0XE/is3IaGg7wfmzRnuTUt+wL8CfuRfQLVhlCO4sPEIIQgpKDEQZmFCucvWrrA 04XFfVB5gu77y1/+6gHwx4JBNfzCpm7BJxL1hn5vYbxt0s8mL4ixgv3Q8hzqPbuSlaqtU/ao tCDWeCFLteQAULZANnITHe2Xpnp9sKU9zUqqaYpP1iWAeoBh/rN/wni2h37vyaavvb1kD5ih 56Dkk3szomhFuSRQwLkS/QF4//A9ZLNzhu10dBCjp/bD+wiLif3YRiNov1dR7sdxrId+FLMd zCWljIeFWaRr98w8YN8/CtBP4CJarxj6HeTESJEki/0M/YT9qH1ma2cpxeF5RKsX5RXBfFVP LuWMtG9gxyjs18AfV32SA8wWKT7sxcoEfQOdALcNFvlZ6xmcXyA/Ar9oOMq9xMgPAkb1cqe5 rmVhJgc4oewctKTck6irYkVvBaIJTqdBABPGX0d0w7LfHYotC2r1n3Apa4doCW939evT90Zd vMhRkCXVBnQIbLBd+BNN1iJgzdCFNuq/gPWbfRGCfthJqJN3a0E1SutbC864iENznG0vZB/u QAspuz5op2HzQkJHBk+AfmDsINXE4qwjvVKSjgbUwEnp4FzgyAlzdSMhqar/yOpgdYeQ25E3 U8yR0/mpkB/ywzdRlHoFIbgaJoU8hIZg3bJedG9qOQfrN4J+7pFJn3MlUXT2UqDYErruxInj c8/QL3N9Akwd8TGQeVSAWoJP82TdtlHNWEas36zXL2KFOoV6/dXLGbU15uHa9qXePaXlpEod BRaHoUyqtdJDpQK3l17wZm3abw1yyoKo2j6rYDsns7p1OXUWjAdnH7Epk2OZw6d94Ll0bVjz BS6asvO+f9TWKZFfKuqsRs5E9zSlWU3OpSY/zszGgU598XXN/HlP5FB9D3OfM4SLVNEDIkyy 8w7i1K8O2I+l28Z+Wblj4q+Bv8R+giCq+Uv0R/KPCCQ5KHt+yceTsETVAFR5Cvf9pCHYaOgn wScRiWr9Cvq9ffbsu+feuwiTF+CQ3sug9XMvvSc042wOGi7BRfqxPVw7FkIMwbsxfwgelkCW 1TXPpzj8PchPpfPqgy0KvTiUPKs9jQpUtStVEQ1oyJdY7Ufs96xbxVuBHxF+CyFb9CboZ8ln YD++YaJu3njBP+A/AsA5gw8GwNx+OoH9PgoHjJOi/Yz9jr3yymuvv0mHTx7vhH4HcEk80gmS xTzEsxsEwauvK0x9nU6zzsHp52wB+EXn7OoXNPEbusKAfk//yZJC+jce7FN4lSx1QL/fu9Hl 0ywcicbuZ8+pu98A+3UpIxbreL+gKNNhnLUCThdpVmayyC0+EREyKKRKAHGh7aCwc0AejtAy gJ8EYRUdtvBQ3UbR9MRqT7Z1oLnn2TNl9Nvz/zwhsAFMPIfpX8DT0QSqjHEEarbXBPBt0c2A cfv/YiT8C8KtC3q0QUSp3yCMnEh44GpxDUpbzyz2m4o/dQ15Bf9L29GoN/T8/k77ZrZ2GMay E/hz+u3ZfvXxvAODkPKZKHdXcwfGCpnwCdPdv+aZXinJOHVyhasmgXUJtbiBGs3md6ubSu5Y 3PikY/PR1iFce9O7CetlrOsJLn/R4xgtZx7sJ5XJwdvq+B9DP5zrQipBkgsHAPq5PLdbs80O d9Gf5/fHR9JsmUcUk0yycjfoy5TGKOWJuQj6TeiL/PoTb7GcbLq3OMXJhttSHq6RF4tK6C5M Kn8G7I6Kk/DXVLk4lB3AjblMEQrKKgO2Z1Ktv0zpPVm/c/yklBuFN7h9qrFZsn62Dxx7tZ8I OVnqIoYpumUe/pp/pnsCf3j6KKzTf4OeLgR1QmdrnPw82HM+RpVr4so1z/w1P8QNvpwmv4MH ddQQmlEQp1D/Pdp8NuxH7luVO7ZT6HwbevAnEPKzQEhRUOSgGgnF/xEmUXFfwj78Cocowx8t +JRGC/EaAAn8RyT47Eg/XRr0ni3Ewup0Gbj0nr1uKSTjLBgLybhcmLhAGe0tPzSHUiKAPPtw t0ijl1ZeI+zX7WlDHlJSKtF+wH4Yzz2PDupq7iCH9uQR1ZyLEtJfmkt80n7GfkLdBn/k/gj/ JJ0FrJ41CA1Fs9BL1VWVLoSSBcabb8Dp5Rh5v4B+tv7pLCzwHvfzkhpszxIOPLul4/Qpa2jD 5+yUv7jqlxzXMynDg6mrJjvgpwCZJCTTYP2A/Aj+qPk09pNSnFYv7LqSYeB3tIia7LxQBXmx YSRl7WxRJIs6ubLSRtQJcPPgzlHAj1rPFhwC95kFd+8I7CSOD0FrE/nR3JMmti4dpSGbMwkr ebzwSXbhTYsbTr0V5nB9Sso5m0b7AXdNoK5yOOiERMgmh3uAssl0oiHXjc2qZlJeRMOflTdC 9+TB5jjAn+3v67PGPI70nh9kSnvQ2uHA45p6/9tP9vsOKKQMnfM491k6b/RksBQbmRkd6l1G MrLBE+ngFAGJ71MyuKV1cnXX0lYX4VzZrAlhdhgHF1175fFCcUiX3e3XzIw7NgX6nTCJH/rt wCpczdI7QboQxt061N2zCTilHD9QbFjQb8YfHX55ypF0nKh6nOtDJEBaDoOXMFiytORVSjl9 mXQXvGBxE4YBcETXs19fb7ERm/kWFxGb/EOOKmtfap3SP8ioJtVR9WYYyoybm3ZJ+0j8ul/6 OragyatU9q6r1648/ljvGZVEt6NDc5cc632w2j49fM778X9HbZ3Sc2MM/dY0+TlXRtBvUzN/ P57smv6GFmnDfohh+gQ+bT477Cf1VkZxTMMNwZ/dFRB2MZZjJj9BCMEHSKikofSpAAngCRUh P/mA+A+yVoZ+ZP0iYHNL9xH0OweTF8vKBpW4hn7ByrsUN2UDYVGeJSu9ZrCLpBbd1bxdzE5E O4yk/SR4YX8HINHvfgBCpsaq6SbGW7QsRyO0exnVU0PoB78IhJBQ0PTRm2XxEm2R9vt/Vnxi v8SGyfdMuW2gP9x5HrYaBIHTBwsDZaaqPhpoftjJZo6/8fqrrxD7Qe8J1o9aPlr3H9glybjN tVmo4Wiaj0VPbPb3p5yDa9pq9ohJ65J5NP3arB9VM8oyHOzESPs8kK/ATAiuMIz92ObymJTi mLnAfh922M9Nma3cKps+52hM/A0o6wnBMlBgKJedMhLsI+5zaCjgl7EhX8/Az6a3MHjJjSSR nzMbr4O8ZBJIEaLcPXVAYIHX7V/wSQQOTWzZjCHSxg4i+ZYEGttrGn1pIU/oPbP9y8IqO1+E tiMaLjI9YC+9aSKETByNcF+Sfq1qfrJllZmUTGmva4IvuMPbbx/CO6Btc1TGpePKvW1h76Tq kIB+xH081RkLDOAfAWCXDbYGiAnhWasb67pf2ji6uhChKhUypTNy7V1mWQf0q7LZcuwdEEBK d5KmEk5p8sQw5SVF1dI1LE0IjfZSTzLuLXN9sZjDOarL9ZXVDLHfCH0+KM3pqfJFmYB+IxmJ nKlmvD5Ci06M4FCKxGa+Rfk+1Vvsdk5uS4kyp+iC+zZY9EIX75dvp+kOoI5ia78K3aqx6IT6 Yam7O/4hBXMh/KFmQgx21q0anwarMKn3FNh/gHbRH0HviWJo2Ac6OUa0X5fX3ZHxH9/4/x+5 dUqzRagPlSx4urdNmzE5V5j8Af32Y+Zv/Lmu7Q8Elukkny73g3ElynIl3grsp/JtVm+b+EPA RQZ8AP6M/ay2KhQSGETgwwSUcYhxCQ4EHQyAfRqCftzWv/2a0M+lfqhAu/geWrrT5oWVfqX3 hMJShWdJyvOKOOD/ZdXA1zbLG7ReUbxX3alWJY64qUkh2+WzuD93nWCixsf9HSI59wsuCtkz G89AgxrGM2rvYMWnsF+yfvGC7hXYY8lfwCJmB3XW+lF2gv0/sJ/BH4SfPm153M4eeAByhcmy ynK+d7dr9HUn7YcR0E+invcP7JKGjXrXoDqLvXFT5+walijnmqFfK+TyTDvYp6D0a0E/gD+2 OimluKuEA/vdZ5MvcQAsyhu6cJr2M1YbZIvMV1eqqImW8SVsISETQEyJMqC//T0oP4eGxH2q OKbjbdtHMLfh8CLOj8gP4uFsFaK+Dl1F0CrQL4LF3z2ZnmTple4EySAJlLBrWPDnFI6QX9qa f4PG886uR/aeAlt1i5qW7+AUgeKz4U912EZRDQNxtxd8hG4zkCxF4kgA9H968MdroNwzGIQ0 iuceNd4315R0WcPS2L7EQd0Bz7jeGSNMES8gS+xmUCz2I9WvOlysUo6Afzz1cf4zEGAGuC1t gT6ubvN9jApqdTOvw9GWNuwA+uRwuPYiAofck7uTnC1XLOCN1dygX9OEuciBC8mN/QhVeOzi THdlWtNHD5j6PUC/kHkoj5MZV20ouITIKvsSGvps0GzEygGKKFnDYC82i5SRTLy+3qKz1vH6 7S1+qtKZKxcnxAijCuQqhO4zBOBZIkPwYbbBEu1HWFVhJOKYvKVumH77umvpkkkddHXH+9nL KuBMNj6lSVafWy2nrgzlen9PtYu2In5QSaRTsZJjB54dO3LrtIN+6578A+g368XXM/P3MiH3 +Xe5HSh6sMyWQYyDOFq9TMF+UHJoS68oDniPe4TGMJNP9Kf6M+f8iobi9i9EouOAERyHfhYn hPrCc19v9TnSe06U+l3NUj+vz6l67Efo4hypmZmluKvdcN2vShVhv+iNi5UqcsQXckjem0wQ TvaYz2I/Gr006MdSS7RIO4++zFE92MviqSAF4SfKbwfIr0E/Ho0B/oj+Ev/FXZ78h6Ccljqw 1njEHop0eoENBoUzqIWahH6Atwd2Se+6kPplemjV9vqrVXH74FFj4nfnIDg18yXrOmcHf2t3 /+Pduw/rw3n6oCaGnkKUXIove+qpJ598MrBflPuJHj5/gZW41HyaBIhIkOGckJozNPlRQZ1m rnl/7RQRIDIYrIGvefPAZNaOYeCXoWEfHUoRFtsIOrl/EuKB94T8wtyTMko6xhn58XxYKZjw 48G+ObTXTMVnJaVoD0f+P5M2wlr1QfYqoxqXygwp4rFEPeRro5CC21FkooZFNRIhhFEBtmyL s30R9afrE24mA4+FR6iNvItGGLIwyLArW1bt2WBpd6th+1uH4g7krGfqE1EUnW1hhWlrDBoD 3GW2Bz4vbMzgUlydRXkc4eDnEp5akDCxvP+uvA6PNQ/KWibZ/Bvp2kvvpkzpWO5Jyk0rZgmM wJUE2mGwmllZfSlYB2Zg6VYsXIRzHZmrrq4k07k4PE+fpMeoq9KLElvq2ekSpsk8MuOapsHB lDF5hoyyuliVq0FHPLI2DvtGmkNps5gqI5n6+mqQ7Lcoq3S9xWutdEa2Kx267e+xZkmESd00 SSfYoP26lH2C6XJpCBsVqqPGxX7ZMX2l3XryAXgmu1A6KsBCLU9xkwRc7X6bVUCIFaTCIzT1 u4cdclbziRXPksmr2+tX/O6cojkK6xQLVbRflLd0Gqepk9N8x9KT3xiHoZRmABwg499jE1BN ffG9zPy9Prf9+30sH6a7cNuN/ZjAt18fwszTb71D0wbwfvT5VCcQ2DZLxR9RXOm3CvqRgAoZ F6K5gH8zYIgPBSJEDf4UDoaWrA/Sj9YM55P0E+t3nlWIch/FQWN3HvccxApFIIlElRzKi/R7 /9J5OwQPLMp3pRePDYPM9DDZHxXMGfEhP9iSZ0gQag+FCNW1PPZ5eQ8XZc9EQD9iP7F+0M3R KhGJe9bN8/Ui39hJSHc8jPzM+oltJfbzTccdzTN3+r8In439kvbT3aaAgTUTJ950sZ9Yv1df g+ATk6EZ1+//JSEALZ8Xy/1HUfCqawYPMqCfOLUFu0Ec9cufs6tezpSf91TD7i1tcUsyHODE CEtaCz6h9wTyC+xXSnFUCcMhytgPtg9u8cxQMFJGBn9J0Mdu0dIWESNmiKg4sX3Al5nDwA9h fldkKE5AL0H2ENuI8kfOaXRlrKjzM/KztVJr8YLYaFW5Jx5XPh6cJ8nKph981LOIrxfsSltA pGwKcOETZXCsXCn3ACbvS0jErgp9FInLHAY8eRHTRQghiugSmgKg42toyC98y4N5/Ij+nhSd pt6zCdj2lnCfMtm3XzoadyAnnGf9M8/CFY4B81vvnr8EovkGdDgwOOppP54+dRZx8eLcmbG6 mRHm97282/oeA79SBf3/7L0HlyM3ska5b+aNRt67Vsu0XMt7L7W89xqj8fPO2f3/P2LjCwMg k0kWWWS51s1zuppksTKBCyAQDkBE8/uZRLbQL4Ivg0tnW4+OVaxslSHb8jl3BY52gDlyTHjJ 6hrNlOYqWXMUylaNK7bTEH7uOmK+PttqRnuZm7WUmoUXQQlOoetYkpQH6mem2bDcMFS97e/v epwH4X79i5Jr09bxBMe5XNJcPFYxtErXKf3AaPMLxjo6c4xJrcmFLO6Ucj3JamOXmJpx72t1 wv107d23zfSrfWvcns7Zf8/p38S3FN8sohtHLWPf11b2U8Nm+Z5/G3dANk95tngT0y3fcwRy 6q+ntbsA49ROWAsjpM2mB+z83fSrqXrTzffp+afe0Md/oI+Aue137/2xzWfZfmZllQe/HHom owcXvg/c/OHaXOZxbbREwuBrP9Pysz2bhwU6kaZVRzs8/XSe6mdL/XzzUfkYLaFM8lADVLs9 mPXjZ/rZWoDvLegn5/XgmpkdvWK13xGdhlR3D/ryGst48Sidpr61Mi38RTL9Sq9qSewP+WK/ Mv2MfB6Su3I/TTrmHvt/Ffkzq88jfmZzu8yUzZvabzf+GtvVFza9Zoi147b18pYU97LtqPXU 47ZePhM+Lz1kpp+d6W4x4JfPqkjKMfFzMEbhb9PNrq03NLYacs08qC3dfJ7909p51oKklhC3 YZ4dnnTclyW908kgJUv+9bNuBU+p0s6Yt5jld6NdZvyZFyQzxU0P1GawZfuly+iHtvGD8rgq STMkhffc1nXVU71vlo4oPTEufdL0wrliKPXQowJl+JVHQ+qhzi2RAyktv1QQFxb67dKfonnk pE8nUC37bdqiRJPMrsrQ0riNkL3C9nbpfVp+Mw3ubfNWxTmk00SieZ//n66/lHc9HEfrhqoL j3h6/PQyRMyvzE9pXZ/lFgaudUmhjnD7ATKtjzsc+LvzQGDocOn6jHQJnfoaG6/NV/vZaJaj Zmb+hQFYQ9v/XxnfmtDjiiktZ6zc/1t7e34S0fxXJns3HW/XXqtYmX4yBAZXoJJvcj7wwZx7 fsjyc1eJsv/SXzNzlXQf5VZNJ7bjlFS2SPr6dIKxRR7Dl+ROd5OaU0spdR0/iLPZImPUb9P9 v9T9tSeX2zpyzvn9bZnKoEu9+Vp4g2rXhOUqulbpqnys3ar98IawX7q07Wlm+/nqIX9gMbWo nwkhJZ3P/fbyP+1/tpN77roid+ewTrq7ViPdSrZpuCqbYdoyfNeK6b10k616y+YvXbRxqrO1 J6bfQTv/3PSb3fyAPX9zq5yr39ogDWPG/B+eW2YaRG310uN+llzptl87rzUS+c34M/Gc4yIc N3Ld+CVXfJPbLRLlc8DSjzRFLAXR93jRQVy+8Yjt3RUr/Z7Rce5rTD/TryRBfKqwR7nfyE5e kSNM8bVmZIUHfa8tIlOoKUaa7gnvRrYS7uXIE2hhOitRThIp01ooMtcvh/9Mew3a8Q7K+Lzn nntldNtCSztX0Y9SeD9OrygNMm0/D7HmD9nbxXvA7eHWJc79s7L9xj11bKs0d7LZqona4vOS TD9b+lmnO5xNkWJV5GY1eLdxFbJx1ow92BrzrFLl1IptHhw9kjbPWog0tuJYmWd3K8zit0t6 l2lxf9t54M13z7wVwvST5WeX236WKV5HPKTtZ/t8Xgvb79vv02XkS/5k/amvRrQuf7bOGz1U CqOpeuPlH8VvTRXsemH9pf0q8wYkQyKNWeqhW36SIra3p3dsDw3EFi/HTvdsC1rGZU+eqt2C 4775sBzbmQBQXpv/r1+RDK4FLqFELnmrckvipaV+FXrMxX7THRcjaylcGJ6pltLDjb9ehEga V1qCVvVoW2RLlmgSquXJZ/IYpt/iUP3tfBhCyVdx6QC8lvGpTcDMMdhX+9UmnzaC+8D1V/ox juv+Wr/pAzyHuMa6hnYafn2FgqWpfKhNqf28FvNWRlqILwmwNEffu0npnrM4+bqmsoqNWSCW yOo+lMp0afOBpxeZ6HIXs00HNmBC0dDZDiv+mhov6546+TzY/kG+JCVfxVqSwdf31beegdjc 3Cb47OzSGLPN+pyZZmOgPu4fU94W97fbhy4VMsH0sdx1RRuphgNwXHyxUpUypb0yeQyWR4e1 2k+n34RnLDU3nwb0RFOTZGsOpt/U2LQaHSKwNnTkaa5889wNSRtl+UlOb9o5fkzL38WNOGF3 kDdD9S7EOP29hZ9aDHaLzinbYvvOL9Pv932WPGpk7dPzD9J6p3OTMP0k9mTOmD0zOPBl+9le L8qunGpxbQOv1OJs3IbBN/7MwWwc5ZCPKwT7ys+YDJTtOVh+OqlVkl3be9oWL08//ZRdT1vG 5/MvKg21rSyQYRQbjyoUYP2hS8MM+i2mDBwr37MrWz3js69gtq0VUqYZIJPQ7s8yMjZRNCGq eSKEaB5W+shDOtnPMz7d9OunO/iaLjtUUc4+aZCZeWDGXsT6mtnXQ34d9Qrj+Qc1lx5h+sXp Dsr41Ox+VkXSvt2xhN+27e6exj3Ea86zasaTmGcPMHh7CSW8x02vzkErmOln+Z433vhHu9z2 y61etPQn4352xoOlike6gGUtW664FgC1Q9jDdkvDz/5zOZGSovqqdMG66jMNcrvy6/6fvbXf Roc2ERLaofat/dLVQzsexiw/EyKHtPxKErgTqCJumfGp4619PYsSo9194I5tH7cWrG+XD2M3 utLyKyVy3Neun2S8sMqueaJWMj7ddx3SSEn6oS+aLPJVNa0EkTlQ2WuhdPkq6xP0tx9gaHCL syKQKmUtIjKx5AlC2n7Kwn6+CMOXhvix7j7afcsWH8Qxgms8x/+y+/onNcZ9hNcPfSi7L9K4 Fc23YRJDe4zmb9i7aRtYVrGJ6VeBgQqfe3qRx8RC5zGRYy7mX03WdCulchNblLz5a7YpQUsh L19fpRG03cN9A53QBOR0d2UngnKWj2lubrc+bRnJomlmoiJTBLa8v6Sq5VDMDbF5+uWidZvP ai4CXwme+QguHW0li47lkmRy2y/keUG1Rh6kUJl+7l/dy3Hfm6HBaC782iGrGtzUrtjYx/yU 3fQL36/lkzVDeNyG+UARyV7MY7+6eONUxpmvOpta4gfp/Gb6uSPiFHr+sVvsDP7QB8GQ8rli +z0f56e7B9+yOVa1uObDHw2/yONqGl23SUKil5CXWLfLJoBYeVYxP0vVNJ+ereDOM/2uuuEn 0++q7/AZpp/tJZ3i0ASIcsk0SdgU4QJZ0tCsR99/N7YJsRPJfPOvJpGPkTGoMRX+rMlC957K 0Gw1t/1SRXUhGjnsHouU/yzPzNJug9rnJcJ+cbBfbYblWfHpHkvbr3IjinXozqUI53Q50F37 cqPplwmfdq7fg2b7TRf7dY/d6RXppKJ+UmGmosZOOXK9vTqWLO6cZ9s8uMU8e4CBXDP1sPNA 7Nw/aPXl9tAQnHlfTqBjjK3gy2nM8rNcAbf9hlXCsv203i+WCZvtJ2XQA3+D8ScFamrATfvw mn6bHbz9pb/Xd0s5lOHn2uG3X3vIz4SItvaU++goy29HR0LOrs2Lno7t8JDE8dbh2PakptAf hk2xwu5TVpUJB1Pg5Fs33717q2qBy8y5vuCtGjuJr1hpGkz0Y09CkOdItl9kVoXrKLMGIl3c 7O6u5aVvqjZ58URrj6UMLpcdUR1gNHCLc0GgT3/uJY4EoUhTUdjvHWkJoSTY4ezu6cnDm8q+ 87Fab4b/p+M9hnl85upB0w4smv/9t57sGXncFc1Py+/YezdZxZrp51GHnmOh+aBmdVkqoWiM A0b5nm1hiaKPc0Vjq7arsVxTktbHXfGtZrTY72M7yMrCft3P7UJPlp8Eh69tGfbk7VG5Ms1M z5uZflvdX5ZfJALE2hk/26Fkgk0CTZeaVtGfNWbQar2CLQq1eaEdAxKqmxGVk9w9eqG+9RqF AypNPz+w0TeuaVWaPnOXd618Kz4zc29PTnKMtYimbpkua20uJa5tIlG2vmhPMuLPOt9zyGe9 KONUWvW4J+whO//c9DvJnr9LLzzj74ZI2Gj7aeVOevBdixtc+DZsXRKGLtZ9+P1VaXQT468L ehfscunFWQNK1DKHT+bx+2nuL9nunrL8nrRLtt+ztvnMK+VhjJiYvHEqiS5pUXLFedqSC+QI +vXNCrq4OoYG0wSou4sUjQmZlqkMttov9jiTtiV/lou0tPx8S2rfTHOT6ac+r31e5H5S8CCM kIpsypZscFfZdrBHvKoYiZ3tp9w4TabjWr/HPOEzTT872a8v9juLIp3QWj9NTU30C7ufchSi X/NsGVbuU9BUn/OsK+ib59kDDOqaqa2jVVSprwI981aIYxHM8rNr0fbT+X49XUAuI2V9pvHn YkNYl8y/Zt7Nu3D7xfBC3+muo7/+uQw/jwvUMj+3/Hzf2suzbM9hi5ddhUG0z9iFPEnMNue1 je41clNdjJFrVY3E4fLZ+P+eD2A5Tmn5aX2Lp1XJLTTs72mB7jXqztBJxsSqsj/lpinn2OR0 jaEUcs9JQCnZPuSmmZ++yKa5212THbOZDtC9ucWFJNA7XO6J7zq9Vru/8LLF+S07yPd2koO4 Dfa0/obw3mDzhXCdD/V8P2oHcQrtDxbNt8UgK3nc7kHV/lO5xYtWuG2f7tlj+KPdpe1rlOkS fpwaRyG7pGjYgHGzq4/aOONt1UjZqqkLbZuS6pRO8/VpG4FSLDzHydSuVHYsRKZsgbn1ubqt wY7399u3KnpQsfmrHz6qioOalL5V30Pb9RrpbtZLSjJFdTzVV/67rr5NxJAtjFn13G+FdfFL wWJhpXaLMrUtXSdBP+V7Gu62rU+K6SjaKCF3nU0WS7nHh9XYlj4cZ1ec83HqAZXJZGrbHSqZ 4BCdv5t+LYFq08336vl7tNmp/2nZfkr5NC3OFu4oeatt1m45n+HBz6TPz790F37mbymBq1l/ GeJaNE1kpZTGVnJeE4Bh7oafLdGxbA4zjmIFtydqpeX35BO6zPa7+sxz5jnS7vG5n5hp6OFf 9MXiJo/L8rPAoWkwtUO5Noi8566WL7jgQd+OfAqNwWjIZQG+0N29c4rTuafdZokQaR6LdP+Z /HOTYGRF/WyHT9/i0xJocrHfq2/K2TcXkU1dLpr2fwHtE+Y4ty6+9u6dsH5Uctxsh89HHn7o kll+D0TYzw91f1brGc+oSCeyzcvE9OvzrG/Xs2me9XWo+3t5j+pv6aRtKSnKQZLf9Hy0gu3y Yh7fuCJTXKuEbSPSSwoSW9wvPTTvvq+kT3MZfW07//1Yxl+KjdD7oienH2Po1nrZuvbs8/ab Zvdp4Ifh59qhVvkp5BeLhZ97Jiy/S1ovag7asFxvKMtvywVB0xbrs2va5rXsN9TFpquV16Zl R6TrxkViOrrzoLJQ4N5+3bckbvvobUhyKhWmRa9Dw5IinmG/8GGEJ8pcUe6ja74jT7P1NCtX ZE38eqKVm5++4dOQZ32gRTZThry7YATG6S+cDdoRxVene8pn2n5+oKcCf4r86UyWPMF3wfxr I3z6Ykk5UK6n+4U9JUhDu0Xzw6dz57H3bqrBvGB3aT6QH0e+QGkacTiVfNXlNv28+Up8z+5x TwFlaW+ZXFRF8DSP3Gomzhi3XdblSvL1cUqSdK0rT2cKy29QKvyE8QU7qVtjaQxEw7mTOVxV Lipm92/rQVoVc3X7PBF92o/zYanLez6CSUftBStlflwUGmdFZ/fQmh9T36QF5iRrCyjdA7Vo +h3bvuosBr+qHO7mtlNzW4S15XtWPk2shpZ7LHfqq6L1oIIf5nFszXJKcM93F2ychnFWpt+h O3+Zfksjy520B+z5e7bb6f65jwOPt6bt52c0u+1nVoiyt5oH37Q4k0DhwjfrJiR7yPVYoS0F LXW46X+luTX53sw+BfzydPGff5IVYoO+iXbbls9jfk888bhdsv0s7CdTVA5GUynDdeTHCPkM YzeqnFF3oNe+Ja5GmbSaJgwcR3RoTEXGZ0mNaSqDe/vD9pvEIjVRTJ3qL8dBaZnwGaaf7fOS i/20D3KfdCwt3jTIWCg195OOpp0s6e2unDli9spdddq5flcefcQ2+DTLz64HH8yMT0vWOKMi ncy5fi1vtw50jXm2VOY04BfnWa1D9UziNfPsQQawm359cbJvkO2OsDNvBUur0slZMv3+YJfH /XS0u3aIMtvP5nhfJuyp4pYukLni5jJqxp+oRqDeem/IhJIQ4/9NWiy+KBFid+oCxMMCpgl9 +nFkhPVkT88JS8vP4mheetPMMjawuyxoqlrLqYnIsUlL6WpK0YqQWz/ZInIAWg2tVukUaqIh O9Y0zr3e6uo6TOWfl4NA9qd01mHHRY9X2DPb8/XCy5DOdrf80vwMlesJbUOloF9bYrvvruoH GRrc5KwIeKfvq3JMSZOzR74em5ZzVwDpCN0/bJZKWX+ZmGMRqyMvn8Q0R8XQtrnTlAMz/BTN b5v2Vh63jexZNF/ntewS9BsW2sW2GN0u0nxQHtiw/aw6dpmN0hJmzFeSmsawzq6N2l1Nv6ZY pK+vuZLc/HTbLIvQlB0dy2t73mjQrlifdeT6IK8ijWQUFX4m48r9FWnNnCDbTXWoYh6Ttb6K o5oUSypEVNaVB1Ldmh6VN2toXU51+sjcNrVH/SoDYluTemGotF48WPqe9POiB3k/+awODet7 9XlSvPJ+4nwuRRUq39ODCh5uztyMPUq2UNhjfdRqGDtQn/dx6sbZNEH4gJ2/mX7bj6zj9/xj NddZ/VHYfrG7qsf9mu2nCJTbfsqxtKRP3+3l08/Nha/8rfLhr6hxE92ivWnqm+T+INpdbRtk +xdzy++pJ594/Ipfj5vtl1HItq5Aq4iUR2YzjG3xEE1mvmvXYLQ3sOdO9aMBXFqVNDwG8a5s NY1PAaOeylDalgplk16JNJfScqrPVKvIVIkz3eNkP2nONpNmFNGCB5LIUUfdrs2fKybeZK/s I964mNXsZQujFPTzOGvMHc/ocFw728Esv/vvv99sP9PlK+PT58EzKJJt4LYq+7ecUhcbeWke 9LUIOc+myuwW99p5VsdFLsZmFh+564fN9FtImdGimtPvGL0VzPQL28l0LBl/ni1gO0R53E/O i7D9KukzXUZu/Cnt0/M+XSGcHOXVJMRRLyYSJBxHKUDkOvrKJIjleirkN13mpw2VPOZ3CMsv tcXyVNpuh6bc6PyNyLbMpASliYVnygeuFbzqFnXIzSsq6Tp0yFVtxw9mXrK6hn6cQZiwP81/ PY5VJWmEEyP07ixElcEjGJIEEk/m33e/Rh4vEVreJPK4u5m8a9/n++eUgPqb+8w8VV47ZNW+ vvMd4SrF28a6rD8f7R4wm8xb6oHD1X5n01eYAjGld8PPJirbBaBtAJfR/H0tv2b6KTAwBKnm YzmyWK06pmjEyaHda5pZ2sc+f3ZlKIdNPYuTKaEotR0rgozPGLTuMzJjZLIjWjPNZIxM7i8v nfusI6mux+Hi/lKnVqoY+Z5jAo7dPxInVqbiVJMmYT+t9msbAtmi0HCNBVLvIFLgQiPRck7f 509bjsfReS2Q6c+UYb/y0G3HTBXOpi3PcfPjKXVykvZVf+d9383AFK6+OZaW+sXuo8r3tLx8 LXysfDIpJlpjep7yPb2xL9Q47QGVmMcO2fkH088O9jvhnr9tJzwX37OR4ALdt/mc2H7GX7l+ ZW7ZTp/vffChjdnR+OtqXGR1SJCXejP/34V8iPcU7WX3uWxvmVptb88Xnnvmqlt+j+m6cuXx J56KVDLt8xIZn2aEhg36Z121rXtpMO6ZCf08116XtDqu5AgJWhqfu1NM1c1UhvAQprHm6SGa 8zImUUaWLaozB1pLZNDhDjrWz6443sHs7aZAxnbZbvvF2okyJsOkPO7PLFOujPKFUVL4hrMd LOgnyy9sP9/oxfbu8FDCmRQpwrbzbXqOP3wm82As2ZTvenGeleZS8+A4z+oIxOWMuOOXa/hL K6LvetWy9SeWxZm3gky/P5jlZ9fM9pMJFFLDkz7TZaSsTyWLN59RKITWg03Nc5mQKuBcaAxm SnyjBEjGBExd8GH/0w+KCsjw81xP1w51MoySPeXMsFNU7nPLT0cS7h3zi+VBQ/zfZ5TsQ6ZB aAfiqXIjt03lvakKrt2Gm1sZTu5++eiDTFEftumb6BRD//CXKY1Camu3/cH+jMQqZUZ019Gs EFkGQ5irrD3jooknD/qZuawor7f3+chmmkPg/akRKK3Zd7ZtW8L5jDWx/cwvFWP9J+V4y/rr 5p+GgV0xjOc//Vdu9dms6XZfBPy+19i2lSBy6rz/7po87hzZEksZ89vWSzGZD0I7bPOBJvUc y6FqWHX+9KfaTUojxkpUE7rJGV/51cLk25so7usrsG5Tjz5lZZ0qThZLpq0IJvRy0HbHrWUS 2RrhifXph+BZs01Mv9ozevBZr9x/WkXpLD35cpoJsFRFB5pxnB72i8xgiw4PSGMJuHUQzbHe 2OmLthXHtkWXtmpYVeAOYfo5ajf0IyJpy7SVjKp0jW++s4X+to1dP3RwOd9TJbucIdDYBuuc SMgLN04H02+bzrlL55flVxN1dcWNI2u/nn9qsvgQD7J+smr7+SHNQ/ZWBP604k9Zn278lRqX jr1M6i+Znppc+6+EvIR7yfYY7SbBLJujHPaTTK1nnn7KQn6PPeqX2X4V9tNiv4h8lDT8xS9P C4mc0ZLH43ngEzVq22lhijhQmelXLiNze0ZHkmUUeaiy/XwzHEuJlUxLkSb9TkE/edWbSHON VKbfXW773RcZn807FhK5L5RyhdkmxX2vVii3tz3QakdpyHN59Uk7I8mCfrL87rvPbL8HTZW3 sJ/y9F2nPYsi2VFCC+GHacvs9M7n2UinXC9qcl/K+TxrbucIkMbOsVo/lotIc57dqSTrvuyT p/pZc0Sb29St0zNvhdpMISy/Rdsv0wWUnK3dXt77wLSn0fgrjdD6ccmNEhwmKJrQqBclPPT/ ID/cJHcVSPKjDL+PPwztsJI91aHN8rv/vnss5Vu5qoew/PrWEBIE2Ydy2VPb7TCUtZ4e4VVN f01zCclzn5ZfSgb5uTPVsqwuV2ZX/dzeSVzDil4iX77rrMoa8AXRpsiENHLXkSng9twsgVLt y/cW66jc8lPnDkGgUWcubd8XeV+X2bpuzucXiUColJnxGSGTTPk0B3Et7zWnrC8MKUdPxPmb +df7n9t5w49xZPSh7bqBUj09mm8LeNuZT9q0d8zjHka21D0r7LZsm7Adx3Lk8ihzWimfpvJk rpOlLfxsKotrLDFi3GFTYXKdQiAJKd/YLpZATkm19djUi9NspciazyLU4kfTKUYzacH6LNNv 2Npk5iVK89bv/9PPPw9V9JSgoYoPm1AIL2wlX66Cjo4SmzbONxqJMyDH51l1zEHggjyE4Yog Gp6Zkcbj+u5LcJf3Xka2ycza1Od9P5fHj1CM0+1jQy5tgmz5nn7uqbaO9+xX3/O65Xv29t66 223bPXf+3kUbpzH+vHP6ViyH7PwSBWb6nVbP37mtzvQPrKMs235hiFzxpM/Q4nztThh/6dfz xE9Zf5nX4YpFyPNBYUsB78LdFQ4X7WG8p2xvDvv33qnz/K6aw95OGnj0kUcefviRRx599IqF IGvt4XBqmJJP4zIN0NcD2GpBc/tLg3nOTJlHU3CEK87182MLjpRpMv1M29I6MR0RGWE/6eSW 6aVNzsIi9UlPIs39c20doxtZMVO4Sqqo31123X33vWZIWqg1k+Jzu+y+vFK5ciK9/xVyNgxu basTQT8LRcpSNtelgn73+WW2Xyzf8jz9syiSVtQ1T+aYV7HHoJnOs7NoyXSerXlw4zzrO8vt NtUfUfpRG6nMqrPsGGMrhAtFyT62pkZxv9whynyolvOpHDALBFS6gOWK27Cw7V7S+Ps6Q39N I5Qbo/TBlBOD5IiXo/wIi2WmG373jSuHyge79n5IEIX84kwHS6s2A33R8ttFQZy2WE1XkfvW l1P03Q7DUd+WOLobqHw27hEKL7evYYoxKNe6UtS1Zsh9HWFlR1rVgswapFG3PyPt1JdeKTVC mcEZLXAnnT05CzGWQdZn02MjzWoM+g2K7NkrNtN24N0pEghFQSPe5z/Pn5IN4WH+ivL78t5y 9HiYX2M9dITsfKYD2NV8EPYiPvGeKb+kB9bSJyyfTkT8PNfT9nd55aV2XIsWy6/L494aTI3l WBpl0XM71L3n8ijDyG0/c8F+/8MPP+pyV5NGjJtdHvSTJ7DmqYmTebtixJRUZyb6Ksrm6wtP t+J+PpSzCD8AHSDi33wnlWIqOZ6wE3Cb5OjWyMzgiaTW7ktcvr+8abW40lKCUjvYqoopmLyf hIvAM4PTgxzmtMSjiSaTj9LffpY5/aOnbkye6euet5OGW3Kez6xxxnessbFViJ/arh8//PSn tfmeOoEnlvrXoWHm+Y32TgfdOZCQF2uc9t4ipXq7zrl15y/Tb5eRtUfP364TnptvOXozjXvO p5I5tHJn1OIU+DMX/jsm2c34c9EeapyP3LBKUq+Yy/Uy+eRljvS5EO0p2yViPFPLHfZvu2x3 te1JhfzM7rt8+fLDZv09qpRPW+3nxzv4ysOWRfaDru8lC32TBwVm3nzNE8UX5PF+meLuQ1gJ +8WhNZ6I2qeJEmlu3TYx7WK0RJpFI+6V5XenbL977g1rO2NsJZEVZI1Zx0WkBzj3+pFyduzh bil7dkUG/e6716/7tPWMafJnWqTMozkiBrLDeDLR6J19F1ETKUeykktDH+bZA5mkvQp9gvLF fqM24gEdz0I63Y4xtEKYArL87BptP2Ud2m5Fl+I0SKVnK/D3xlth/Fna5+fK+wzrz8Jh5cwI jdDVv1EfnL7Wrwfd0D0qPrI84JfKYRp+r73i2//Zzp7uyTD10Db4XY35yfI75kztDVQ5TWWc u9ml8HgN3bYrVmi/5ts2341+hkNoKhiGMSifkEeTx461WtLoJXl4cs6ZCvuFn+bN9I8p6TMz bSWm+yWEypQwQSDPW+yvZSsk0wWkoF/692+8YT+XWe/YvLrABLqSJo+HtITl3cAnjh51PZ8J vfPJb2lqQvkffEDHD32q37axoY45HduW65mH/c7zuPuxDm2Ll9Xhso58DqOuHWb03OwBD+GP gczvvrcriqURU9NBJiZ6xK3mqd2ifm77TfSKh9LXlxvouK1kwvO7SRFq25vSdhYlh0y/1fuX k9nvryZzdcrurwe0KvqMJz96VdHyPc3a2ZwErqdlml1q80Jq9ZGe1MRjbBzhqs2gwPWtfKpO c3Nzl2jqvM2HkoWZYTpu2+w/DvWzfM8/z/M941A/7e/52Sd++I0t9R929Yl8z70SUecF3ef9 xRqnUdr5XHqgzm9TfOuKzQtxgj1/n2Y7/b819MKzYPt5FEo+Pdvp0/fWdBe+jD/58KXGufWX st00iYhKbSPaw8nTZPvn5rA3MdpCfrZGx5I9ZfhdvvyQLjP+tPKwHRjtKZ+WexpFMHGVs4Td SOLYIoevSIOx4dmCfuOKle3nhWl7DB2pdHItmLZUPO1eFYsQU4aaSDMnoS6vZTmzRqPUfZb3 yPKzy20/hf2smr5lmqKIpuLHOqk0s8Pj557HPX70MsWmGJ1XBP10zrwdNH+PLT90209d4AyL ZJ5My6M5YOaZWnFF1MQayz7PKnhrOvM4D1bfijnpcaXlrWro0w5zzHdRwq7Ue15KSEM73eRM OsakFZTO5ErWqu2njT7lNbc9ouSoMZeRjYu3bJcoS/u0VDDpF1+H9efh+kj3WdUI3RAsay9N vgwImN2UTuJBfpgDPiN+b7xmu//ZKr/ICLM28mV+5pudZ3vuYfmNulSL/68MXYu5yVPvhpdS E8znkpe9ydiBG10ps7xfaSsFd91Xh19vdWUvmSqMOgXE0u/M5LYkjUn2XaRHVBFMAqsMMvwU MrW+rfMwpFpb3rcW2GTnrhDGPgrXMUcBf3a+CISi4M4e39tJJ0F5mF8TRG4KYDvCtSh/aQiK lsVg12iX+0HjfX7Zx/qtD23vl2n3fa4dez2NW/lAFs1/XtH8yuNWguW+edyaDubzgR+mo+3N bbmyDSOb1KM23/ilURs5Bjmf+8qSLYftUqOOU5ISyDPyaGs/NJJD4EucuPDMIsjd1VbIvKTV Gmu0HXvg/P73tsim318efdPpFu4v8KVNuWR6wNxomY6wVjKFNh/h4UhIiPSo3AzWXWMumlw+ apZtClxoJCWJtNSvTbMlifYxsZrIvLE2UPN8z9jKYFO+px3q97MO9fssz4vOpUTpHOsR1uNq lkud4rifXahxaoUdrbMDd/6p6edLM0605x+3yc7o7xK+xN8ke0tiPbU4CXZ34cv488hfqHFf fOWqzapsXxHucjaXZE+Vw0S7J3OYbA+9TTKm0jnksDfD76GHLtlBA5cuyfh7tNLIfMfRWEEk YSVVUnfyvJCJLJzKjQOsWPFu2iNGtclZ07ZKRoeC20RahjVj50EpV7F62ZQrD/rJ8jPbz1I+ FWj1vbDc4ai7adbJGOs33+YNZY4c+0opm+Td4hb3LJRWT6hUsfmM235KQlUFz6xIcyXURf8+ Y2U+D2babpxN3ObZNFIW59nwKmRcxFOJd1zbcUTx2ww1LCo9444xtIINJKW3ajeFmcfoNg8E RLqA1MFwGSlfIIy/5jNqYkMRAY//TVRCeY/qKhVxIkDSodLkhw37D9xzJMMvcj095Oe92bwr dpzfIS2/0qXmOU3axs7GSToQhoXRzQ8kX5Cu7lhvKqR7qzxFfeZSWGd1DXNm2p9auVLO9VBa u0YnN0Y8u35WGSJkGjqemc3PWXqvmZ9ya+TJDtm5bR49ot/y6+uaQHa40hK0G3gkB4Xt5+d5 lqPnQ9MQyj8cLjTrdjnaFe+fX+aSMEkQqoG7dKZj+10tBIlovtzCOoJIE5VFoPa2/OZ2kadb ZvRcxwj7OhfpO6ZsmLZhl608dJ0llx662bWfs6RPSUsjOeakECdSeLwIvu1NWmYxe7cUp1XT bN39bf82N2/Dy6wqtvtnFd3ye1VVnPqDNmpTU8nUMoPNHRhpWxOmpsCZBve1K3Bu5/sGzZbY a3m93Xl/pwz8MLGOn7eV+ls6y3LBTh3sFPmeti3zQr7n3379i5078e1Xn/u5p6+9HDuPXtLS zoyAZr7nuRj/F2ucDo1yAp2/25XTm59Qzz8X7b99IZZtPz/cvWlxT+pQvRdeevlVN/7kwzc1 Tk78cETJKnHfnjS59G8Pwl2uZv+F/Myp9oSxJgHjTj0t4J447HXIQB4wF4eLeyQhN/l0X5yH ESSsdH1R4jhklZlXocFE2lKOz1BY99BgXISWhzBX+6W2JRdhk9FurU1Fmrn2zZmlfNYSadLw TC2988477JLtF9lyrrult8/dcTWHhox0W2SvHyFl3W8pjTksP9tHOVb6adfRsPxi7xmzRkOd PKsihYU1iP6lXcW27+2ltkv+mzSwRDmLqfluPZ6O0tswOve6ebZ5I1fn2V3Ksvzdcer0xKp7 7iul/ry0Qpl+3WN0481G01PFlfRplupjytB+5jlTLtz4sw1flDAQvTnFhjkiutgwIdFkhlxF utoHg2oYcfSp/LBubMphGH4WFtDGnr6/i5I9pR5aSth0h5d9Yn7WaIMgiCklOpHFjn3HCxME FizwmH250pvjxur8rXm9SrWV1WpywTLUQ796LBKc0rW+0eryQshfp/w7Tzt1l2Y411elkQVb h0K0MoQOOZcDkpu5jqXvrYDptzxefyOfupIWyfJ/vFGbokipN8eZ/JW+KYBygzTW3/YovzQE t/4sVuWRfuVQyO+gjBVXB9oPfaLfuDfCXcJpX0k3MAtLqZ4RzY+Qn1akb8rj3qlBYhi1+eBO DeWHPHouN06LY0pwffa5rs8++ySTDDwDdUXVSBPFHGPbqhqrI9mdwJ5OVHqFp030IkhvEhr3 29bsnaO2rKTmNMr73xBrk81i9yq6p0q2n+stK/evPAptmTVqU8NUvMYKS20+PWMWbAlzWtuX p+3nbm0pcOogrsJJgasggKlJ5giTh9zM2cu2fNEijV2F24HrrB8IQyT8hNCOiT8297Z9mT/+ 7Evb3/MXy/f8h+3v+d//5i4v/458zx+//0abvOjUsNirwb1jBuOc5Xtqcop6Ov9zP057Z2nT 2AE7/yn3/FmHO/dvDb76StfilMk/anG+b4Nc+Gn8WVLHe8rgStkuT5Fku6JSleYoYT5ckusm 2M2fp2BfqG1urLlsD73NREykc0TI76GH4ng5P2bAthuJFUQmOlxWuS8uFEkTyJ9Jaozi2GRV WDJK9/KVuIpV7L0UN7upbW3hZkOToZYR6f4zV/lyOWQTaWmUXrOwxFSkqWx3y/K7/fbbzfhz 28+nUbubLMmcddzKNhGZN3RLd58fJmpdyobJ3ffVsd0QHzY7yyy/u33nGctBbQsQVcEzKVJl noWFdZDgWkqDQWNOUaOs1pgHXW0fpnqbZ10FGefZuUna5tkDjPco4mI3OyetoNrG5dkCUpwk ubVM2GxpqYOXtTxXWZ/KF7C0TyUMhM8olCiXGik2TDJIQJjAaNrg5IX9IgRI2k3uIh7kh2lA oRxKgCgsYNni1pctLmChqztvN7XB5mfzGVeiqm8BuI8hU/OVC4JbIvzhG2zaepbc8SJi9kpy zXDB1+2S216hA+W5990rXNVRuqcW2XX9KvrVUmG9l4QjqjsxpLTKuV49uUsjjxfMyvBFV7ey b5unvUUwhkG3Rsk7QF/nFheFQKgJkR3kKZ99UwDtA91zgyzKHxpCTtDyz6bjMpwPmbQSY1pv bFw3j0iOjfAJWzC/xralcYdTx0J+Dx0wj7vPB7HHZ9opSmL1oRyTutSdjz+JK2ZOK5c7q03V UK5lZUjLFNh1nmpFiC2DLR7lVkmYSjGSm+zsRZC/K5c/anPuKsIwak1Cu/W5en9z6ls2j5ti 6+8v9F5F8wv3Kk7ub31itfuGdOySSXrSfSkeSzS91Sr0qdmzUuCqwfVQmZvrH7q1ST0rWmKQ 0LaZSgawDhz041jtzAnt7/nt6v6e/7b9PSvfU4f6vfW6nxed2zDf0fJQfU6ZPfBs3l6wcbra OQ/Y+VdvfqI9/2wafI+nWl+Z234331panOnFyrb0c/XS+JNof0dOfBeH8kS5bHfn3sS1XEK9 CfYM7H/xucJ9Hu9L2e4Oe4uHeTqH9DY3/O7z/UbsnAFtNSldssmqNzS5KPaY8vjjj9xJ5bFD OYwmsqrl5K1Xo7ajFzJNjvaS0c1/FrafW2teLtNvjxZpCvrJ8CvbL1I+TXeL6GZkyhVnu2Hc 0SXlHj9MyA7oQ8zKmyoPm2vLCkV6EmpGIl2dPLMidU24xx+2a67lb61KAxM1tje/slrLr1A2 ymyeLVYb59nlp+706UoRo5udZcdorTDJ95T1N7X9tALI08As8CeXkfIFPPIn469phO7vbWLD nEEZkHKdUBphv/yjECCKB8jqixh/qQoWFHj7zTc8HUyGn1YCKSHMtMMW8kvLz0/9cptVEm+n Fpl9eRQEbnaVI90kVCW+haUb/rFw3JjTJS4Tf+6rMr+9qW8yulxmKZMtVchBv1prdamXuBPb w36Dc7315CYl3dqeFiLLUGqshUx9dxyz/Dzw2MzPcpkdV9+akePtxSXgvT7Cfp4z4Z6eyPn0 yTlygzzyZz1PGoJmaDOYpCJIR5D3QRFAv2zI+xXvzCcRHpHwS7YJysf2q9Y1tchPuZ6K5ts0 pYSZw+RxD8J2NpR9yjNnoA8jq8u1D03f+PDDa8ouD4M0VY3MAYngVAT9dvIEtpEcmSirptJr 4TgzjetDK4P98yKITe5pFbN3CGmzRlJIlzmycH/LzBjWaKZjLu6v28f95U+LHVVXpYKWe6dl udKj83ldTxrEo0+yvvVzqJBS4XRJgbv2vovDMDdLJbFKde997p5zLOGdQjuUN98Xyxztke9p h/r5/p7f/fCz8j3/+a9//6cF/f71j7/99c9Dvmccy6xdJCrf84YKKqyAOJsPLtY4XeicUz/B sTu/TVkLNz/Rnn82Db7HUxNRj/u5Bz+0OF/x5y58s7sU+Usffpft0uPC/stseLmWU743uR6C XUpbqD1SOZr8UjaH9mxOvc0MPxPutduILzmzHVD8iDnfPML8VNEdNLdIGNqtmjj2xT5m+YU4 Lg2mycL9NJjWk1zbEiBLePHVcGmtWfLEoN82kdYT0qyWWrzszn2FJGT53XbbbTL+Il7S7xbV 9Nt5PT+yy6XkXj90l4beZbvvh1hqZy4/VBLqmIWaVseZFElr+XMTt03zzbb9v7XhUfOs6S1+ tX6aq03SSl43z25bjg3fUxHNoqokJFMFJt3sfLRCCVaXGlbW1AYzXcACf9rqsxt/yhaXhvH2 u+++LxVjrhI2nbBUwvq/REjm3jbV0HqxVLB3IuAXymEZfq4deshvqh5mnqrk3Qb8W/yqdaIb bvRYQTjqlflW3qlhwrJRaz4E89zkZW9M1VnQdMry8/ymm288wuryea1tu+FLr9y5rpRxU7By i52Kv4j3ShmSYfjZw2OWssnVrYpg7Osy2wIoXzn/BLzDdSUho/x+pItneFu/84UhMw0hHbSu Iyh1RUs0NJjbpRwWfW6agXuEB93Ag/ka24r4ZTTfQ36+ae9B8rjbUPZIZszpygPxKU/OwFfk gpUl+977cTWh4xtKubPEY/WyUKZDZss2rZEsGeqpE7O9U1+qrAmzpsciyBWZG9+U6NBUecvc +uz3L2kVvsSSVmvvH0unJVVLY9lqKo7naQJLr9QdkwpZMNU1OFNt5B4wHU7XB++7NDcvnjnC XE1qnrCUhwqm7iGKWkMrZcuDfg9qTacdWmwnTkS+5/c93zPSPf9rh/q56ffjd5nv6ccyP5mr oT3fc2NW/pY94KBfu1jjtHfOw3f+JPG/2jJvt5F1zJ5/0HY8lZsZoh73M40z8jmkxSl9K+wu z9+ytE9L4Eo1Lqw/d+2FYmGi23LhJcVjBV7mJfoHbvMprG8OvbI93n17prdlrqcfLddWnN1t m01a4C9tP00uL6asctHhsvC9d1MHdNe1W36ROrUqjvdR+qqbllJuix1C2wrTSEGjmie2EGm+ DMkMv1tvvVXGn8HO5X416zhnm3Zy3vnArhCTe/y0e5iMjdnLYiXaD9E3TfO5o3JQFYccslDL HBX5rOGpFUmZ/p7+1vJo9rPeIxU+NeYN82zvW2lfrJtno1zrXaDHGMA5SZnASmlo3cwGgDbc ie12z7wVFDuT0IiSGs2y/ZQu4IG/cBmV8Wdr/txnJOuvnEaDSpgBqblOmMphaYaDaiizr7fL K3IcpXKo/aHkObqvVvkNyZ4Hs/wmnUixgnACmcKY2pSUmwhzeuzDnfVyuvjlviqZrQodrHQr 91bNVMhlmdV0mZrX1E2iDO6JGrTW9ytoMStD17bkAGpyU1vXanmNdEjt6eOtfYyOzJ9cTwSG 4d48PTVreW7QFeUGeZTfun/0/xCj8tDKb+neh0hY8WVz/iPeSzNw1SD9kqEbmBkwHdsezbc4 UOZxm39k3zxul2GDByUWMIawdRdKs2TffscvKS0+c7q3WpZfxuq7x2bXIaORPBTBpUmO5J4y //qbrgqoDFUE2UjPyTJLy286Vfao3Fb3f2P1/uGQ19LpSRV75scaF1pKpsF56TmsLh6HGSzm ArP/7DIFTl68lr5Rlcqg39SkXpaHR4y1hCAXZeR7KvA5zff84adf/vzr5Dz3f//rH9N8Tzsw 2vb3tHxPuX7vOIf5nv+PJidPCPEelR7Z8ztO5+PvkJ0/SBw5sg7Y84/og+fw19lbJh78iRYn w8vP1nPRPqhxnthRioUL99XMRHm7w9WdVp/UnhzoLtvNqWcCLDZnsKxDnS/gZ51H3qGvOXPb r20an+K4ZKGJQlei0j/oeSFyxM00GJeFxxIb2WTRTcOdFV6EQSkPV3sEN6TeLom0PGhaaV05 f8nw0+W2n3tQ/Sg9Oe4tUc6nUNchzf7TLQ9w+cwRs5fNq7k6qll+2nfGA5FpjZ55kQ4ef9hq Hlw7z/oGc5GWF1N9mqR9nt1/eE+lofKqwmsq2++MOsZKK6Tl55NMjwRkukB3GWXkTwkD3p1f 8difDw/zYIdK6H4jzxwI31HXCrtq2ARIZCOl2ffm66+/qoQBz/RUVMA3BpYAUUKYdeTY2XNF PdxHBnjzDoLArfPbUmFM20+727h5nspNBAzkupHjxV0vXf5N1Lem6WxhdcUEH/nnHoKRo04a o7sIFPhrWqtkR0YMsghy/1gZ3n7Tkro8oc5Fk8f8andPGc3lad/T37L/mOAOZ0/Ae70bKa7U 99ygwT2cxp/7h199PaauiJjJbamUSU9dMXWgXZ7uZ5qBjD736PSxMR/b65w6v5d3wkXSzpRW hW2b0xU+r0Sn16wupiLa9cbrPmLC2/RUs/xkdk08NjsMGZ+SuloxlSa+y4JrAuY4yyLI9GxG se9mHBrFmiIs3N9d1u6pivu/LGO93X/PKk7Fo7vGIjE4F4WGfIy54M233jLntv0QWa+VS/MV He5Ie/OIls929nxPbe+mEzT8xKQXXvZ8z8+++Lrle/5nJd/z+9rfs+V75slOVqyKRR5RgNP7 9cUapwudU0lOMZXu1/kNRCVQhXtUI+tEe/7pNfLBnhSQPM8sPfiDFhfnPFwO489yLl2NezGF RUSlXLEI4S7pPqYm+lsX7E2yy+yrgW56mzvsTYDFIr8w/LTezNMOPe/w7ns9ilD7BqZW08Tx Gy6OX/YIli8X1C4Ppv/5/uSH1GDUk7p/rinl8hEq3aXPE3IkmERzm7RqWiLNC9fS0W69RZcb f9Ifpbv53WKVlKZQiUhNon6ZjNzr8snLZGxMHcZeNncefp1likCkhyIN/pkXKeIPXQu1rrpX t+/SYNTaK1riGrMs7iPn2T2m+iPKPwisykoNr+kZdox5KzTTTyMibL+WLlCBP88XKOPv6dCi sjvLJpJ7RPafDEAXGspkbgphe6FPTYZEWndXDWtUufxwx1GeCOOeo2b4uflyw3SZ3379xxtv VRDEnKIJK3a3kfFXyo3JgYgYxE+JhS7/JP5yCPruFQukl/vL5m4ySiNp4JJGvRD2ZiyDJ9TJ ue/rfZWJPqqxe7vMlsvPpxeMQCoJtbq35wZpjtB6/ImG0Kau6Hwa7PI+tMyVzKb3DJbwR5gz Qt4IuSXTtJFuEGNbx/ya4ZdOndtvv9X3blLIT5r38S0/BUnGOd0j+JFkIcPItR3zobz0sg3m vF552S1SaS21lXDkpniupaVp11biW8uZaRFiDaU0VJcmbn+aL8nlSRVBdl8qTr6pVVp+Hqrv U2VZnxvv3xQ6yaul+8duyX6WhvvSlIle5s5yFV0ylZ4kH7kbs6HaTKDaA1+TcmOXaSQRBnB1 cK0ssrY63vwvBr6KYjnf8xPb37PyPdtKv8r3/Hkl31O7+sj1e/NN5y7fcxr2a5Ny27jxvI3T jZ1zv85fAmtwj6btV/N0mDKH6/kXTKJ7cUVpRYuzwJ/3GGV9atc+E+1avWNZHUI2yPYIv6Vw N+luV0tK1JtydYdkL9Ge4iv1tpnhl/ufKPGwjj5wh7ZvHeE21lQcv/Sikr58fz+FsMry80XP 4bs+gAbjjFyAeCB9Ok9I5esFK5Fmk1iJtGd8rpB65WapRyVsBtMl468GZ6yS8uSZxFw1fe0Q l0l3n7y6ziybuzZNs0iJBSKbNWrw3fbzhVtnU6Q109mxB9kGUZO7GVXXXpoHM71Ha899WUWf Z61vHLtMsz+cF9ETCm3mPC+tECPJqiuhMUoNGxVTl5GSxd34e1xa1NVnn30+dRi5bSLDyPS9 iU4YKyzrZ4gRlyCZFVQmS40q0w0t4GcbQJRy6Lme2tjTtcMM+Q3q4SGayavtOnDPqJE/cUVE SbkxxeaN9NcraiBH1SAVBg2y5ylUt9oos3o3SZ+mkmWym7gBWj66KMTmMsRKqpSbzfJLHe+Y 6tasW/P2ghPI0Z62X/b8ti4kjb+ZhiB7Ige7vD2RuqIUv34plUW5KBrZK7qBB/Pb2F6K5g9D +zh8l0aR236mHnpdQmy9YLaXXy/axOkWaaQZaEs6JRnMp4NdhkxJk8yjlSaglTZNmjSFK8vw osogozgzHVQEn5GUpO2iY2p9xv1bVn67v4z1bK5nXaFr93/hiPv7ojur4hpZWhXKlM9u+9UC 8IgfSIU03SYv0+DGp/oezb7co05lDXtzF7C9PxQC67R5FI7le9oep888//Jrtr/nR5988dW3 lu9pm7z8Y7rJi/I9f9J57trf880x39NaPJdVbpTSvQyn9soq6/4MpTq23OzzOk6rr5xA5xcH Wfyn2PNPrY0P+KDE1Dz4cy0u9tl0409qXFl/4YuSbK9Al7mWJcvHyz6SYG+SPWwPk6DPuviS 78yPcH8w1uhYqpYnHUYmZCyDMwOk7RmvpBJpNSY5QhwPojCXC8buz8r4Srd/yao9iU3niVjl k/NEF6IqmIu0V8zGkotwEGkycH2HssxHC8svjL+y/Xxdo9JrE7OZIlZTr2pKyeP/Z7OXaJmM janjybYh4hiHtPJMzdGzK5K3oa3pKE/j8ST/0OwhDTy9JmNqfZ6NBa3p2GidS7Q2zbPhdrb7 Dk/Z62UrYiwq9ZkzFoI2x7qPgNPrGAutELWV2Ki4Xyz4M9svXUa+Q2wYf+4zeuIpt/7Csu4q ofxGo04oP1Fd0g9dkpRqGAF+G1hy9WSzqA+746hyxSvXcwz52fR8zJSwpaaMWg9ziu90r8S3 3BA5fenuH7OIgem//XKx0Mpvie5+GIXUt8pQl/rWra51/aq6SVewwvbzwTrRwD1qMSlElWHS teUAUq6ELD/TajLd87wpNkvtwWenQmAY7KVTxroQOQgXNISwJ8JzKV9oOEAsbcVGfLvsbeai uEPEhrYiWk03sGC+tvyOsZ3R/DVOnWMxWBxFmtOVflOubpsSnn3ONA67bOJMrcXTDJSD6pZf mV193G5dnEGa5JGJNpDD9ku/mSTnchFSoQjLz9WdcapsQtqEX6558ijc9P5PuGRevn+tnZZx u3UVhwp115jPYDOoQvpCXJLmR4FVeNfuvTXY/sVoZZeUprW1fM+rz774iuV72qF+lu/5489/ +uvfbH/PhXzPb/w8dzvU7yU/z12nDdo2ElIuWwC0P+vsXwX/SsbxJji343ToK4fu/HbrrrAv 3vzgPf/s2/4YJShO3mFci5NmrGi91og20R4ATSCy36G/Mku6bJdzL/zbkuN2ZV5ivGmu7hZx crXt6lNSfMJhL7VDDnvpbaZ6ROgpUyFvv/POuxV6VNzD1xyGUbQkjUsUeranicLDajDelUZv vwIyC0J6o0jzrBWP+cnwu8kvmVpBekivvfKEW38S+lVVn332+6G5y2SsuQwbe98XI6fVW5o1 aiU6+yK5FrpVEGTLPj+TBjLfy/Zr86wMqyI+TvW2tbifgOHz4KHdCr38QxFXZ04NgFPvGOtb QWJDVtUwz2Tgr4mNBx986KGH5UK3Yj/lbpsuNswg6lJjphOGcjhohqkaerZAyI/eh0s57Iv8 bF4+mZCfGsprXYLAKuwDpR1rMWiMLgnM22KXggbxypwJXdG50ram6d1qK6trtZuENIoMDSvD IKXDe+SFiCLI/dPLEMmyJQZ6a0f04JjqVu/QvLo+CNRgV8dvjp71GkKNdffRmrvSnQ+WuaIE v/Gyj0wOyBth48P6ZdoAbX6Ksa0TZ++0aP6wgHeS7Hkci6BG8hAZUHVyTvcU1hhGVpV2Pd21 luEQmTJHs0yGavs27wpqyvssgvxm6W2XJuBlsJnb5m4JvidMcrhVbIpTiY5R3Wle0nWConbw 8yrW/b2aWUVfO+3+oLD8ZOvsJZomT9RccPUZKTe6nkmVpPx4kdwre3N4qs0zO4FtTSDCbvtK Vvv+npcu2yYvV59/yfb39EP9vslD/f7Z8j3/Y/t7/t2Odqh8TzvU7xU/z/0Rc9Npk5dbYy9V eRV3ae1WqBN7caHG6Yl1fhuAp9/zT6xNT/TG1WHmWlzo/834kxqXekWX7R6Ak3AP//YkM9H9 3eVmlkPPRbubHmn3TfU2E+6WcmjGkF9m/dmWI7lzhDm0TT8v3beL44kolA2ZonCS/3BMqTEy 39iVWmbbgkizlLR0XzaRpinMDL8b/brJrex+mqLqKZ+j1LcnTUaG1H9m/ysnjqeelN1X0VYH Zs5+T5JLY1QlKnM0zO4zKVJle3Rn6g5T6th07XWIGgv7tZhaTPVDcmKbZ/s8uPU8255z/BfZ y8pNOxyW3mNop9sxNrSCpMZC4E8alHls5j6jNEfctPawvQJSc53QHEV+pXrYNcNUDU2AuJ7g gyoSBuwg0Pvvv7flg5Ue5kuBhoywfftOa9NZE1mgs8Xsu7qmgZvKzXPD1fScptvWKib3B028 VRtllhci7M9VlXGQk1uVobTYjPltF3hsPHjxmyCwONbLQzhqCJq7HpfnUiqC/GjmrszUlUhZ MU1BV+avVC5KxtRWdQMb2zL8lH2gWfOQTp2aD2TLVr66235yoZSyo7pYZczos4mzz5zuLLEd XtxACbOrpSXuIGvWDORcQtk0ASuCyjAvwuhKXh62m+//cGkaa+7ft0sWeVs9c3QV/YGhR2qf as1gbs1OalRMn9bl9RLZkOe5rDMbfMunrh+CASCCfrdYSe6+7wEd6vfUsy9Yvqcf6qd8Tx3q t5jv+e1Xlu/5/jue72knXWh/zzhs0Gh4Ppndf/3Dz+A3Vp7VOfmcjtNoG1d21nYVlyW7dn5r kuCwOkVmPzyBnn8GjX2IRwrUtMfk2p00/my3lcjquFzWX8j2CEtJuEu6RxJmynRz5KWv+wWz +ZpkN6fVYHrEAe5DxE92nwfD0v7I508Ex/re0EVVWH6HsxqW3QixHs7PnQ8XXZhrZq8tirRh 33nNYXVZVW1smrrc8uRs2nlERrZqqpnHpx4TkftdPnHE5GXJHA8/JKW5FSnn1ShTmaNnW6Sh DQ/jXos+PhU18yZc37mOnmcPMBJ7EWWeTmZOGX9n0DFWWqFPdVbYkhqC6jn7VmSf7Qfjz1f9 eX8ulbBCq5XO7CIjNML+0z8MESIJ0iLWbja5nmBduDI9h3ww0xYiaTINP9lQh5yfo869Fymh pvxTrjGW8ivtNzw37kewHy4VQoN8zNz2GoJKePDCm4vb1autZFaWoRdiScHyrmwiY1MZLJg9 EQMbWvsAvZtbXFwCGkS/s6vF/Uyvz4krcoO6hpCeS1cRugfElIBK8XshL33kmoEcOmb1KaDV 3JJ9bIfhd3inTh/Jc2Fbys4jVhWbhq9cedyKZf5SG7UaMeGwWRi3MU91CXlkc2cRpgPZ56Qq QmoCVQQTfJq8y2VeCTtddEyLMN6/zSfL97+yWsW2FGQQTdP7r1Ywn+jB4bVPFNTHXbkx/UZs jewjIlvyfLD8XCAe9dTVcuQn3mm1yMOW+nm+p2XmP+KH+mW+55ffWL7nn+f5nnGo30/fK9/z 2vue73n1qSuPXtYmyOc439MqbfwvyjjNrnIynX+8+dp+KB3brsP0/LV98Hz/wkBVj1FLDFqc G1+WdRkp/a7GycwJ1560GxPaEbs397bL8vGHfZaubkn2Jtq7AL2vHPby6g3BMLNBwgDxEEJz K5rpGUaRtZc3WIrCiTSeRCqOLTRmDRZ8Zm6EpvIpVlfm2nqR1gS1LL8/5qWaVpTNklvvvd98 jqbkx/1y5rHK7n15J/fJy2RsCFl5VPvyKFmjXqaBvc0SZ1ckd/H+4WhP46yl1r5d04RLnSuk wY7z7NoHb/+LWRHT9juvrWClDanRFMKwV8P4GzRCM4m8P4c3Q64MFxsmGjK71nXBTEj0//wD SZLnRgFSqmGXH+688INJlDEgFcX8sScW8lNDzprIx276bQZ1rSs35nHJS36cx1PP6dpbP6us Oe6PlFnJPUT1OLEpSp/iI51HIY2qCAawlyF0rbbMOhPqcrHhkWXYvlPzzeuBwGSsjxpCrsl3 Mdo6X9hM8vXIb+neByWuaMT3yz6QVyQiP9kvB+NqNrZ9zvSVsKNTZw+0s5HchK0t5OjDyKZ1 G0m6HjHjpOy+LJqyZXYwi1bLGkXwjMTB/AzJqZEsfUuSM4sg+yiK4D6jnuNeoiOP4mzG51DF xftfmt6/V9FSKWIRzq5V3LZGBvSxuBxtI1tLf0Ylbl6rVY5rP9H85LaFte6Q7/nMar7nsMlL 5Hv+6Wdt8vLZR9c839MO9bti+Z5+qF/P97Tarn30Gf3CiuS23zSFr0/J52ecbttVdu383iRx c9fXT6nnn1F77/1YdZjeYxaMP4WkXCCGXSJhlK6bFO5S5mQF9ss/CMEuo88deuW0cv+OSxc3 PsLwu6lZH2aClEnUAn+u1LiNtSAKHwhRpSUBe0rjdSizL7k7K+PT4e7vRnEz11ymbRBpOYvd oEs1bbbfhLLUZYn96vp2w70uF+wy+wy+Tx0tTS515j+a2qcCNfa12rM1/GkWybV4t/wOpIZm D19RmCs3cd95dl3P2eHzHIXNwzCoI8PwOz+toPKmk7FcRr07ezCsZpqAa33ZjSKTBk0ldJnR 9cH+SpLEZEiPlclsSqf3qvxYNPwOHfKzptzYRKO6ZmPV5IB7XPKHvbUPpb3J9TLT3jxrbHRx b1Iqgvq6ia0UcJeT68ogH3s42XMp1Sg3XdnamHO6Q6fmq9cFgRrqq36ecA/n3KXOlwaFBsCV CO+Y78FMQLtsNOcV7xUEd9XAh3YEtNQtJ7qBIn4+HRzUqbNhJA9Sy7xWeT1kE6cVTYH66cxZ WQaKitpNd2lt+3qGUsvdngnz4Wx360+O4EkRCk+4bcP4zHTM+VS5fH+d3bShigvKwfZVHJ5o OrdvG3HroMOFPasaSbmJq6kk0eiV3nsABcALk0G/W3yTF8/3fLrne9qhfmvyPX/56QfL9/wk 8j19k5eHLz3gQb9bZGmfy3xPdT2r86jJS6NLDfO8jdOhq2QhD9j5l29+kj1/l3F/rr6rHrO+ y5QaZ0bARLZ7yDRj9028h1D33PTmZo5sicFppWEut5Vi+5HHPxpE1hUmBshGUXVYabymVZKO abixzn2dubZJpMWaumk9o6ZD7oxkslM2n59J/S73S/4f93/dS5OXZq8+s3q0xIrkeXIy/exy c/Tsi3ToAEQ04VRhVqZtLkyrebYm2qJVDlCtN2lO3lzUv+tUv6ZztY/nvcxtPyujHMFn1DE2 toKVdyI1pMDMZ5oot7uwfcaX10gmkYuNJjRKI2z/uxSxX0szVIRfVt9UfrgCZvJD7dIifrKe LCwgHegEDD9rqKxwEwTNPB+7kfWdUG7M39Iv03Sk5oTd50MwA5ZKtPRwpcqeJW99YuFFUq+u PFOw5KnpuN171MogZWtWhiHyXyFTx6eHLDybj36jBNQf1vh5TKksERUagk9dmgrlt0wHyON2 2WBul97buHbNIIZ2eSVtaAxj27KBVg2/Q4ztqk5N6SFsw99pQstrYuPILs2adsXEaUVr/uoa t8N0sNOYqSLIcWaic/ACuzRRETQt2XUpyuBF6HhCc1o/bJfuX5ZYVrHd3x+T9/cq1tY6EVPc sor2xGbNepVSUYppdtRtXLmRRtJUkiJbOskw9Rxvoo2iKN9TQb877tIRg5Xv+fZ7tr9n5Xv+ w/b3/O9//0/Xf//z78j3/PH7b7787JNr71m+p2/yMsv3/L0J6nMpINUCF2KctmKeROdfuvnJ 9vyLOy2ow5Ttl3pNySIzxiUQQ/0cZbsJ9whKNfe25HleEusS7O7qNqVNqQql9XS7r+ttaXz8 QdfUAFmQxiYwXByvl8auAYb+d4hGSTqpbQUZd1KsaOWbRFrF16x+Xk+vaVOWYwI196nmHZf6 IfZD8qvKx71crGvuMqvPJ9Zx+or8UyGfso88VM3pZ1EkxSBrujme4J83e/Zvb0I3UZr5Psyz OdFO5sFyUYSBoXJVwdQr5o/Z5/3Qy6a6wLltBZW4xIZ0qJnxt1FsdJ2w6YPDCxMjKUEUK5PV l6qhey6kG9amwBpVYTuNht8htMOFtlxsophU1I1G5cbk3exyoaXyj9qbghrd8kvH/eZulcy7 NCoFK6VRU1vDezQpRZVhULBHXeukuvYCSj66UATU87cY6mk0adKyfuceEPM82Bi2y7SBdsUn GtipGsgEqNnpiLHtRdkXXlZHg2hF2KauE9OwzZm6NGjdOulyJ8dtjZmd56kiWkVwJ06qFV6E 0gSiBCk4wjBzV2QTHctF2PX+YxW3uf9CE9gj5bzqoqks6tkUZu6puAqtapVkmyPPahXpvarI wsOO+EhFMbS2jc9Nt2S+58O2v6fyPe1Qvw8/+fyrb3N/z1m+px3q5/meOtTvrddffsHyPR+r fM9zeqhfRyFWF2GcVjFPpPPvevMD9PzeAhfulWjNuoybOK5WhGOviSNzRpmS7IpFd2+HMO8/ 5Wt2we5Gn0y1pvV4vM8DfuWwN43aTQ8b7KZALthEG6WxoodKG23LffaTGQttl2ymIq2Mv4lt tCDS5sUba2r1NuMvFs278SdTy80/GYCyAA912d00eYWMbeGSpjWL+sj+DIvkmnDq8WG+H0Pw zxuxurc34QR6ujVm86zjclqRg9JV9OV5dv6847zPMjZ1xB3BvkWXG1Gn2zG2agWVuKSGC/HB +OsFV8wyotkTsbGoE4ZyWJqhO41KgAyeHtMSxoCfPN/eYcaVQAfoNKuNuNpEJSDvmHtJJCOH ywSDDWUNwmmvMssvHR3b6jnFfFEaTQSlPXMogZw/q2VYkps7a7GroPjkOiOgXhdj3cLqPk27 FDXdXl7C0hA8P8FjZqkjVO6KVIHJpfwVeSXCGTHXDUancI7tjOYfyqnTKqO6TCaE220oaxjZ NGxyKy57aR+YddJmzvLYjNPBjiIngXacFfgzd7eK4AK/FcHlxk5FmNxfmobun5unH+L+qz08 nzi1/abdoys3oZGsVst0kolEPJ408vZdzve0Q/0++OhTO9Tvh5+1v+c/B9Pv3//6x99+/bPn e37+yYe2v2ce6reU77la/fPwiZrgIozTLOXJdP7JzU+l55+Hpj9uGUSrqXEp2iUsJNt10t7U MPG0RNcryrW8koro3maLVJny0TUOyU8Tn11vk+ssDD97ZrvC+LNne+ZhPDqlcQnjUKEmd8t7 NW/R8WTGEsBCEx01JorZjLci0lbNrKiq21hV01bRuJtq6kJZM4+mni74e72P80q30i01eWn2 6lNrWt1VIFneNVZcZp9NkWSHph5v7JeaZNfPsgmXRE0ZVtmEzvckpvqjijztZdJHUhdQ4P0s OsYWraAyLxp/aRLF2HUtxri2aLbJBckHExoTfXB40zTDEiCj1dTkRwtaq79MDL+DdJrVFsva rnSjQT4OkqD8NqblyPGyquYMCuT23b2QqxAarb2bZC9x2aHn6bnpP/KXm8rQnS2uXa9WnU9+ 2wTU7dYO9dQQmkURvp5wEpsGEBkrrhLYD3/nTonujMiQ2qAbrB/bh2iHqszqSPahbBUx28un 4Zg3feKU3OkZ5jZ1TqapXUXOYhHcOFMRNCuNZbDSaO4eJu80kawMSkAML+mIZvH+TZvz+9tN q479/ntUcfrIJUXCLVohrcuf6xphJ2t/uBdZo+BdVaafKbAR9Hvw8qOxv+cbLd/zF9vf0/M9 Pd3T8j3/NeR7frw+39NZj6jP02u1wfkfp1XIyfg7VOdfvPnJ9vzz1AN2Lot4tT4jTcrVCukV ocaVSAxvlCsWUm0G13IIeLf2BsGeyRLuNpPwSvEZQbpw8LjiZgLMLz26P3tiE62RxnEkYE/A 6FrUrtJ4HbQiEx11o0gLG0tWVhm5U5EWdfVKziuq+dOFvkt9VbYJ5hKUx/vf76SZJGYOFShj pJq+XMNvBZqyP6siWXFiPhP5da2yy+e9BQeFOe2TTfPsbB5s8+yhyjXWoZfRqt9GX4qss+gY W7SCytykRoUDymc0dR5kODuMkQxIucgolbD+H1VDiZgIWFvXT7e7Oy7UgcvZ42Oq6z9WoBHr IV9XZU1STZsohq4cN6XcyN3SLx+4TXtb6lW10O/osvdCqJ90aRT6d+l0emJ/vl4tl+Ek5eYh 0XOvMyagbrcw1EtDyKmiAlbdA6Ih7HqCws55xWfmjzA9orvZRt3gpMd21aXrnuFCkcyqaTjm YZ83ZXKF3VeKi2bOiYA8euDOGrAXIYWJe3FK2wqB7xIlpu7p5B3DdjCRVj02K/fP5SWTKlYd 7/Db9yquiIXV+8+qo7f9kWunsHqgKmVXPNcF4qiTTMguPOioj9RRjaoRzXzPBy7N8z1/+MlN v0nQ759/X8r31KF+Os/93Od7OhW1wfkfp1XGNpMesvOv3Pzke/5RHfJ8/17Awl8QW3m5+hlq nOTRINtDvcmgVPMshzyvn/Izh5u5kiUq3tTOchgCfmH25U8b92tU3yYJB5GhVM9yEc6k8cF4 F5n5RFFQLCiztUiTVROX6tkrmoxt3pHUlwdfVwjIvX7GjfyeErGOX8AiUS715vNUJKNixUlH 5s4z6nKj9xZ0AyUV5vXzrHC1CWmLeXb5qbt9OiujIjqDYnXaHWPLVlChl2eaygYLJ7b15PBk hNhoUqO0wfH/UTPsqqF7LiZt0hIGsru4enJyhp+15lDXGrs9NcIr6vFZG6/ub2k/fADPtKsY gYPI2kq7ijK4nJ5Ko1lf9ie259uLkCGzMkx69oGH3G6dn2+fewI+0qcRhZRR4R92q8lnruj/ 6X2QFhBX6QTxLr0RzSEil86CbnAyY9vroinGbl8jOYWtqzqStjEPx0ygsrXC9ZlzcDjt3nwl THYtQkze7rZ1Ia1qLMiOY1dxqhzsUsUNj5SqJKO6QxVYTbLV7EuP9Rsei6xMP23uf3Ps72mb vDz2hPb3XMn3/M9/2iYvlu/5V8v3/P5bO9Rvku8Zh/rZ/p431P6eu5fp9P7CoZ33capCqt+e ROd3AMe/uaLO3a2zMLJOrylP7UkN2dgirn8Osj3cUV24u2+5hHv97/7m7maexpuavz4Il56v trLL+kIJ47A7tZxgVW6MIkMKTJeEJ6DBNDC9bBOt3ERaCLL+cyzfspk1qahNO87Yqup19aln 9a79/ju8sqJEadLsW+BvZXHwjj5t/jMs0i7TzZajQ02Y/Wtxqp/MSolLwdGlCemEpEHrZdYU WcY++M6gY2zZCl7sYquCj/2nBm9IDXkyMpRtEqKEhTTCftWnTTPsmU6uJKhJuuMiRLQPeW+V EzX8rKutdqNmnzeVMYZmeFzyp38UvcoG+KQGxmtL0NXTWz9ZlUYbyhCl2qYMB/K2VHH5/7oh sHGom++hup/1tXRbyvngesDKj/JGtGhW+iRPaWy3QbQobJu0lb1ilw/aGraLHqdjtPGsCM0L HIrAQhF8OhqEn4uOQfbNyrDz/a0BU7Yet4qzR8bykaZIRPdwoKWQzNB2rbtXa1arbd5qqrc5 dCHf81Xle35i+3t+/2Pke/67LL/K9/z5x+9sf0/le77+iu/v+YjOc7/rjttvvfkmO0gjjxrc phRn9x1vhnVT8vkYp7OectjOv/PN9+/5Z9fYh3lydJnt+kwJ9/Rvj6Jd8j7dzDYDSOcYXDsu 2iVaFg2/FePPXXHRW8MmcsmxII3dUB+1qENqMLO+NBNpZa65V8urOi3fNLzpBkhaIanje9pW SEhVVVOorqrq3v/73fzGN/nMMa6wlAV6vopUBXLoh+nYQ6wkpvoFUTPiFjDjFbSOOw/uXPSx l4Xxd4YdY4dWCLERncj+zI2/oeTen60PhydjWSd0X1FlS0uWlAQJAVIWi7eJPCmtTZrjKAqx M/Nd/0CPqcE7tXJ95LZRayUeLx/C0an21K6swF7VLISVIU1tdx5NJOVYgAWxNFDcobF3Bcb3 rycCMcrGoZ69T67Qcl6qs1vf08Rvw3c5c0W/0BdCNRjNvlMa2+Mgap62cLVZPWIa9ikzfrSJ c5Q8zsFvdKw2nhehUBrJNUWQ8jQM21J3wuu1Uob5/XMlv1pqzf3j9stV3Eqf2uqRml39mqEd dMK9yFohzPRbyvd8+TXb3/OjT7746lvL9/zLr3/7xyTf8x/K9/xJ57lrf883X4v9PS9Wvmd2 Am+HmKhM4VH/rs51XsbpvKdU+dZ3zh06//zmp9DzV0bfhftgfZ+JNrHRaqN2EO4u3acCXmI9 BXsG9Eu0b7D79OCYUirmeERnSMV8Kgm7s2grSbV182zTl1Ke2X/rRdpgZamyNir7sLR5x6Wy xPLq3BP3PPZPv6ea0HhJtK81vCeS4myKFN3AkW/dQEd+cd6CR/Qu8WqwJm6FNfPskQXY4gte xtGyiEKe/1YYCt77T7P+rEM3sZEq4XqdMBITldG9ohoORtO8+0YBtkC891fm/WhxVumioF6t ioSowrGMrnkZqi/HtJ5qaz25/79VGQ4rN/fGzQ3OGYGFod6klKaXmLms07m3Q94Ht/BWfug3 /pWYLkvcLkxNJzS2+yDqIktPr1nYzaM+bQ4TZy2S8HnKb3PMNhpYzhWB0ARCFQg2gtvm7tUi LI3bQ1Zx6f4L1d5QJVWgQ3Wy4Yge6iUbZSISt3zspCRWBpl+nu95q5/nrkP9LN/zxVcs3/Pa R5/F/p5//Zvt77mQ7/mN53vaoX4v+Xnuly/1fE/DbhrcSaeWTCpz3DdDQ1T/Pl/jdCjg4Tu/ 3zz0yPnNoxvuObKO2yrn+++GJlnTZ1y3KOG+lJoosb7kZk7RlVuL1BDPE5jjuXNPReiPKQhb e7kDwNqwicKDiIxN7XJkX0pRVv9FB1ssX/TI+tl6pmoaM0/VNjvpwf6z0rjVZ0pnTR0zU3Q2 WM6wSNEbNrXIrr8b+nVjXsQT8WQ66p2rYDmdwxdsqMhQxhp7YVqcUcfYvrLxzaXRa7qU8E5V QpcaK+rg8EETICZnZLJY09hN5uMpu+/2xRxYH/elP2w2UCb9KHpR2FnN2oryL1Qh7uQ33b5E UWH/09aXfbAaIMFODWtNGUoONClwrDJsX1q+eV0RiM43HeqmVWb/y87nXc+9Dm7fLfzQL/1b OTRibK9MTfG0kwA4DKIStlUNNwA1TPrlQ3yYOYcxcxzzJCq0RxGahbQp0X2P+5tcGaXr1g2w 6ZFO08VT/fBPHG02/KxaWz92/GIG/Wb5nk9dtUP93nj7/Wt2qN83eajfP1u+539sf8+/21K/ 1XzPhx68X5u83HqzLfG8GPmeySJa4vyO0009RQ6Y6TUZf7NesjAA97j5cXv+2AUv6uvNfSYV uYlveUWyu9Bveo8PdGtJNd8a2Z7P1H8hVNUAMuhyTqm+ULdSv9ggMhY6w56tEQVsZVPRpmUr adZLuFy+ZunGvXroT7dLY8v+ctrx937nZdEPPcQL30R7K1Bjr5nQ4Z9ZkYL2nk02+/NNLbiK O4AlLPEY5vrZjQ/5dlbIi9QKY9EHXcpB9nj2sk7ovqKIAqQs6RJkohqulR+HbITN9xrrOYyT 6DAaqBNJ0N7oN5NOdfT8tb4cszKUpAzxoSctF0K/OFgZ1peO31znBMbu1yYLzSzqXNX53AUS OoB++oAuc88/1hdqtvReuSxtTyzIErWY6Rs+q/dpOEaL/VTt2sRZHtO4wz6NPZLULONT83Ta XShCFx2bDD8r1zGruPX9l6o+VqnNA2uqVM0eZPd6bCuKPV9BP+3vaZu83H7n3fc98NDDjz3x lG3y4vmen3q+pw71W8z3/Parnu/51BOPKd/z7jtvvyD7ezYI8WLeFJN54uzH6Vi8Q3f+uPfO g/swXXDWDBfp7YRbk+0avhqrUiBCo5lJ9y7n7ZX/Lr5m368xPrM68kFpqdW7NIqOkITdijmd 9orSNeMvpLTPCF651R/+u1mFU1Sv1jSFfsw8CXr1lsf+xMuSc5cVSQMtKVdR6v8O/4yLdPgB M7bgdFJanet7451O76raZjNcyFZYKbt3fpFUv21iQ5Khi4pSCev/9psuQBbkx2iJn5huWG0y /3+rfqTq5tVHrVg4lJVOtauzal6GRXFUBSiDTwVREQ5UhjkX3v9mCKwM9ZwsrG95b1fPa14P H8mTH/Urfc2/3zpln5nyESeJdLUW8zlP5bIrxuzixLln+TYUwc2leP6aIpQ2saEMe93/eE2w 4ZGtNv1FoVXDz3SSDdXa8Ct7/DTf837P97ya+Z4f2yYv3/34sx3qd2S+59WnHn+08j1tvzed pWElPPXpZkNdj/zValsEb+N/Dsbpauna+Nu/8+918/zjI/lej1/sfWdUU2nbrqKODo4gOoIo zYqoECmKIhBEiooSHUQQBhCQpkAooSc7Oo6i0nREEBgSIUKwACIDoWarDAakhBDpJSJCEgIE SEJI/wK+6z3vcL4f58cpP46/9rWevZ973/d11yeLvXBdYzplrKKrp6Ily0FgkTrvhutbd0Bd 1i7YMC+jglk/ebgtvLxw9Vl+3e3dg/jn3Zkhl/6KzVnz68agONxC6cdp2vXHxf36w3F4ZZYj T+aKUTiid77RY5fW5dQmIcc/Z/riXWamqP5Ll8/D+aDnUejjIe+mqecN99oG77lIeXNbsbMm R3uCE99ezdhae+naGVeuQgGF97xw+40/ft4cJT/8Pju1WeeaJkhVN2nafytIX1dSFIUrKgEq 0164bIgqUqkSJu+CZqla84M7cRZlihTLwDOT3h/Dru4QvI9yuLIXHy/jtGdYkJ1vvFP81NRO /sX4SXwYOfF1yKrndsFHHYrv70nnbyVwlAxHq0L7K/LXzV5T2SukisfnAUBW1XLvUjjL/gfa vgt5xVDPoo+XtP064E38OoSAQjpA4zTsoEX2ft0jP6teFWC80N6iBKIoY4otmOzSLTF/8wc7 qHHgxVb6uEOjsUAx+gpUeRRxqaohWipog+XRsTmXaKU6p0vuPLvFyi386/7rlQ5/EmQDpV3v vpR+cHW6197l/degZ1xiM5ryh3MdL2Yw7f1Cz0Bm23oz/SuSMklpghLcfcsLunKR7mHL+Zx9 92STytvPPHg8ieXCq31y0OhJOkQ8Mr4z5ZOyoOZa74Rao6s7cb5e2HBS1X+qfsJ7ihnwybBb NYwKeTPjHL3SsW7Tmj1qGYj3fy3MufDaDKzqiueItwOdTjvOxZS7je+7zLB/lJZP2JKNsr1k WCRqHEqa//quIachY2S3eiQ70vFK2Sp/F+rrqYb6HzgLIHoHaKE0hUpsDO14oZS1XdVXz75z xivFUEKTXiXoFsuih8KQTTOT8cfENVIfZ7Rb/BlUQtW7o8V0CYnW7RUcI7sd0L3hTs6lw5ek 2kQndPQk/UzZm76Ic0R6rTaSy1TzGpBiWgQYUMy9JZ9v5ygidq8UU9mcNJbgGf95OIOddQK0 +Fi5YsLEcv+LNf3un+uSqXEjF5seGxjFmkdvQw8M1VUxZMKkpJ6PiVOnG/N6bR6la428SUiJ JdO6XCTKLIOonsN+xV5p72PzIAjlQb3Knkq/nE8xqMRrhO0stycZP7zdlLgLet10EiK8RU/p QFPBIS9NwSt9sIPd68lbS05C9PKnjk01O+T7L4xdPnXrUhOHahgdeHs/6gTX8UK+zu6GolUG YCp7zEugORFdfCJ6X+cI6PZYw51RNEy7FrbvofPtraHI33u3gpfREnfsuBLtGGAcE+xRxHu5 ddXh/gDmz89VTeCvUSFxgdhrmcGPt5IiXnYs5KM5b9dMmmppE7g16MjMnVzQrYa+cFk2bsD3 YsxI7EaneojTXjRWdfT2LACFJrfykQby81wmWwCDkiUk9tR5EDZ5HjT15J2UaHXlAf7Cvjzg Iz99ZQTlN6DvUEroKDr1Q9CBwdPJ4OZ6gTUBBCyvfXXDnh7KXx9Tf80IlT6xp3dtTv1Q6K68 +WIMqlcbmtAF1s5mJIr80J9f7b4+PM+GZOTJ3Eq7B0evaMMwla5aorC5As6FZ1G2Ft30esA+ fIo2eN2yvzx9f+OFPUN8/slzyoa1FQO8iBDTnrMHiXuthB4TH0jW8Qzoi/eT3eaSUiXKc+GQ 2TOcFw80M9k8zXff1SHs7JjyeU24AV78vc+ZxkB/mo5UXTHQMGoLeezZBsRZj+VY+PmqpO46 Fl0tu/niKOrrX3aCUOHjeuyBC8FDoU185MwcziW1iS8mTC1+5ST5delbvMU/kyCLCkUJbkF8 gy+Xh54+1OrPsxsJDlOCs7ZL0vpRSpcfRlNjKdhCl3Kv6cHV5SAtlnPy0sQX2stH2586Z7pu YktiGrS5PwzeP4UuArfBv5biQdqEnJvOryMHbJOU99KOvSA4gsg5dqVV+NztJ5beSTs1Zw5Q A8gIvgCivDDoAT8M+XgapFUgtxNpSWbJDzZtaPj6ZuEN0VQcVEu7E4CRlro9FzeeH3ycSYVr vXlGPQ6P2HwWjGsyCiulGd3M8zonQqWMCmRUOA8Kdb9br9FS6piHaFGexk67/w7gx1xEw+gR dqa2iQwxopw2+zAH4HAGsbETWfS0XhrVMXphDM8G5ZExHGeszGtBkt3h1c2p0U1Ism86U0PS vAJlpkAfLR+GgV0y8dWJT2xQfK0Ub0B7g67paSulQ6fvFtafYL/AfpUd8GKgE9J/NNE9Kh7L zuSAR+v51xVNZLE9Cm0y6Q12jP4ZlOyG7RPaC61wOxk5yTgBbVfgBky+Ck5E1orfnkT2Oxx7 pGicZZhwXBIBNpfMjW507h3XOvljGrK6TZLKy92FHQTDXok49ht7bZ7GlGYdCDHLJsWMYoNr DoO1nut+0gc2OStSyRwLeDNncCowET8VuPY4WXLLjFyfGr3AlkloMgkfqijU15qIGfqa4Hha +dzr5nNNR3N9RCHg9uNtqvX+czzOiwrNQlv0SWeLnw5Nzw3sOKSuMZoc8YnVrO251fPRL6Ic 433CMzvan/5kPmd66krBaPE+xQO0hQ2/5H/UtX5bc8lrIkakGTM06iDB1L0oAOBgTLE+T9SV Gv161VCUhA6VpT4GiM0teG3UTEnI3Nz7chhpMRXrCnLpoQToQx9s4zkXux2j3IPZIz4WkRXU YOlXn67UTusVCrpWV5xPHXQHXtKO33wf5rDO6vPuH18pjT6GOc7NDooIp942tF3PFHqI/nbk iaQkry8XQbTMvhJ7GVj8hR0tYWGnriZWNrc4VIIB0E/kOQt4leWcRWbN3x+LfpVcYZIXJgnn rlRkcmHAwNUii9U6r88+bbnbVpohy4btWLFyndUKhQOrdzLotXWDEaypmGEUW5KpVekkwcRJ C1xoSLrkaBfkLIh2/USGOPC5Uxb6DD5PTVHYpsSjyo9Sn6SY8aK61N+AA4yFFQobb6xYrfNN 5sYbb213PCikbUDXzY67hxpT2cS1Bn2/gHhMiodnDZPPosm81bH+YsmAPjSErX4CVJbXMjl/ qKnzUFNJq1PcBavzjt8E/VtmD+Sm93Ovybm5tyerW1quw4kiqT0WKX28BykN1q2RtcnVzJrl QxrFB4eoBH7wCZBeYhnnF12EzQdcgR44Oc//nwqu2XnoCUBoP7KApB5ZCC6kecn8vaHqaJk4 EcIVjeG1kQXY34DSejEyeM4I+kmZylbgrb6v+K/d3wT9SlqdzYyhtoUKBT9gJcFrs4DFDyyn OHMv+wB/cdYI/gm2IAGQtbmUP6UViNgV8iQsJUssSkctrbr+rciiqJus3Bv6H5LKNUNNqKW5 UxsLsXuQ/W4gpI0rYmZCZbaVWHU0Gp6BnZqd6yP1mDPousfN5zpu8Qealfq/jtkNfL2NJLPq 2eeh/+Ds8/uNT7KB/s+cd4la1X8UYqMXxJMtpWCXD5Qgkfr3lKKdW8mdFqB0jgOLSCDTS/qb lZS94t/+BvSw8gC1Qlu9ff+DriUttyiocDnlmgcnTA0lnuUNmpOn+JD0WYF8JJFIhaxS/wXJ GBlsmhONvyRDJYz+BDgoeKFNB2xPgPIRjPkB2p0HTLKrrf9U/ofYlev+NLuZUkgbYHuIGE76 83K/9gFoaVIJVMbMxKLTxwKYmP7RMZ6L56unNFQGO85dc4IkxeCHn5hvXBZ0RjdNJKFV73qE fp/YhrAFJC+FQCvXt9w1GVBJg6CNWGyYXEfuKD9UgJobWcsmSu7kMgMGEpROgDn6DHnGtlQJ fl4m8vLGJzkAv9cNqsmUtnIg9UKheyW5hYQFQl9KiKIROZAK1GpbZ0QjIvgWTvltIGNa0N+i yk3odBE6d6Sd82zP3xO3dxmRFav9C2ke/EFdKjvcWOKJHIvSn+e8xvYBtJxZfMtPoFyzfn3w Ojuuhs4hm/P+9q3oZFcCb1YlCosL2iHL2dt/8zkzJjELUDbnzuDSoFG8ajUvYKqNYDEZoIf1 QnNy1dHRKPgdmqkXSlDdKJ78NZHgieYVqGHqhV+3hLCfP8ViJ62I9OdHdijf+g/T5TDsZzmh 0s/XJaGRVHbnmH2peRyvT03u8vYEbdeP9AAvpKDLlIYUTcXQsob4KbfFljKuL0E8HOvMxMAs pL0N1fUBayRHP7H3zYi1lhHLVHmSBRDJLX7He8nGll4JDe+BHkujAXaksZQ4z3oJAV8/oJG0 gZnh4/B67/WS9Om4sYctL09A5yxgpVviNi1jNEWeiXzSdjhxrNK8F5YkKbHkv28pJZakk69r A+J7ySCEKJ5rgRDDGsjWgJ/AQvRXp4XaLUBjgqBiAf6+zGq31XsX/x1USSOQqQVwP26GDdhB gkSoKzehxtIvQu6jNKhw5hafhhKdSxP0WYMZ08wAYWOzksZEjNuGpshl7tE49/YcSJOxtUMX RlNMhxbL7GAUvz66rmGXosjieg4yfpBdzy+Vx77cd9Kvj2CWR2rZ2eoAu04yzqpsZwsCSq/F kE/x6zjz7pEJsGLuLhoncAG5ajmdGx8w+bXy8CdW+CHdetnPAzAJI3v6AHi9ZDqBjQ6b6q9Q hopnsvtQoQv1s26XgbIO9nCt/CWV7nBi8y2grHm9AIOn/m6+ZpngC3Jm8fqW+pP4ZBi0SzKr iz0yQI5YdFgyuNgw6vlR9fySnQDctYktjymn1lJ9bvktzXVCzds5tJP/bAtH1yvIjA/OlyeT B6Y7tLDKv9YE62HfSILrsWuknmjqK5BAK2NNEWjxnLYeLzTvcaYnUlodgAHeXAbMOtmqvwEB lN/NN/9PCu4t9PpdgqzATnF9KrHF/PK3tAOlxHkhC143W+gBr/OOxtqKW2fKH2CnZubuwqfj yB7lCJg7055IvzApsFgWSdSdHfNxZSmerVzqNfCUAMktI8mnqgljI6lnfF8rWOdpWMteow4o CvqUIGbdO/TBnJA8eaNb8LokzL00MKuxrG25b2pqBMpI+PdAxlzQWnPzhY6GNPPosXu6fmKL gG5aEoT4tScplG8RyWPiMbHiMnttIvL5ZcC3RvcEqM/kHF4mDm/9NAcwo53IQU7cWNsHZGqX PYMZSzFHWOw+OiZhuJSOQV2Kpj2CmQNjFxzm67hWjeKaMVKzEr4zzHz1MuLmV/uU0dgywm3J wTGnSppE2bNG/Fod7YJ5wONzu166YOPG1UXMaGxBfM0I//Mq/lACoZSzvgVCtfhRGELGwq2X OXeNQqiwr1l+DInrJWeKCqb4D5JBUom5tCoLDbMsYDXrYl/HYrcDlR/ZN0VqB8F1wrLmFr2/ NNP+Uyk5fL1HXnSMJumJorhBttbx0ZF3Dv7iZmHC5Mctxium3si0Ez4pyA1XbGBj5PHbkBqh 7SPv8O6/0a//w7wVqx0fWimLJO/eA0GioFI1B2H6LL2btittnNe0S7lluvarCphwsK/8MoCu G1Euq6Wzm/jmjeOjF5ZJqdxx6I7EboBtYCq9KmkWl7O8jYUGLZPGtbDnGP4gip8bMwyIilU4 Di1pT2lHWgVKy+LJaa+8nV8SNUaAqvzyIc/p6h5rtL+kL6oZUh//GSgXvZ9JekBrMxXcBO4L CsZIZ0CnUButtf8oIVZXjFcaS6T0GFA0xMZXYpXiqqjJUIK0VczqQXnzh6Lw9Pj4JriP4OF0 dZYpeHtZOVNdvX8Sn+uJzIElifr6pglD0x+wr6DrpRUsrRbOX3uAmOG8u1h1QHXOvUy8Tphr e3zu7LKo277uai95FAgV9VGmTYeQSepob8lQXI+Hv6wrKjML9Ub0QwM7zZRhDjbNX2xVboGv CgHW/NOCz8Hrkiux3aJGf4iRdFBYK1FykAT3aBqJrvLj/i5NFL8WtxfOxu5fxt3UunRmJkuS zmXizV378ZfR/tLL3FIvQnVfQBbmDO9iScAd8V8NSSS52iGJufATywLSWcFpAKKANpIGt3ll o/1XVrIy3Aennd6SN4CYyXtjMS/aPjQsq9aT1lbyQUnwyRJLpOADUNmzLuNY9xvec83b6k7P Eu+N0HdAD4IeTzkey/Py7NMBoG1hPYvcBl0v25D5ytJYtPOzmgp4SG6aY3VXrMYy04bWVU2p 3QRNpJNP115Gu/Hxj9FTne6yQQA+EN8/bYAbIZmBQ1WckOXvOa0TDD6f1WVBWqEE3h1t4e1J y59AavAuzDLCr8AVIkdhSVJEc2uO52x1K/GnBdsXunTB1NAPg8tn9Xubn2xFE8eS4MI/MoYX sK+I/nzvhdzYlpkVy96+dveDD17jqPEMrDf9HFoY/VR4Af1uJ7jqyCrCb8uC7v3qbP2eV7UV kH6XMpFj1YWq5XX21mbG3tx6NxPxB7iGeHZw2Sgnz957bwOHihNQZ2xHDJfdWpR+aYq4GdAh JP7zxnf4HX6H3+F3+B1+h9/hd/gdfoff4Xf4Hf5/CRdkA3m+K1esWHHjhLSb2nthnfqhK29v rFz1w09bv4Pv4Dv4vwCeKK1WWP/xB0W/0KuRiAg/75BFBPe5pmh0zETnkM4iMjQ9Ymxs9O91 E9N/rZub60DO+oUGIAJ1jEyOyhd/0YFcjAvz04G4wnyu+fkidCBOUT6IpZXTId4B8otL0FX5 0ybHjupATvkFBQQidEwMdSAn4cHwCKcwb18/RYiNX3SQr599hHecfFMowi8iDB7sjfDTQURE yfdbByEiz/tFnISHhMFD/UIROnJBdkHB8sfk18XnbPx84Vf9dCwtFf9lTezKqY6b8hKzouGp wEl7ROH2ee//Q1SKb66EvV+x8r9hcomcJSYNjf+9eMT4v6HxyCLn/6s0GhofPvRvHo+YHlX8 DyJ1/vcQqfgPIofiMrfYVs6MRDOiAy9qqGtsVMlKP2F3wcbG5vzFi38O5CWKJND3tTFXMS+c /hLVD7yYm/fmPUIffXW3sB1VwiLsNDKCSZgwA4XV6zbqWN1YsfL/JXh7Zv0gfaf8Wq87oz01 UU8a27xZx+qz7MAMuvsTTfozv1b+WBj8R3F0q/RzRqg4j6/6BOZwY8XNX674DkqL/jCQpNPE u5WrFp8qXSf2b8zYT5Ds8BA2mIpnUnyUa+Trr4UK2xsq8oIcige6H5TIqlnQ0FnDS9qturut bljpvT7VFz/YfYuA0vQQZ12H+gnLHLAT5EVyBq8rOGzIya/srrLlVurhkuTb6GnYIzKu+hRk 6X6CQuS7cUxKpb41YR0tGoGQlquiEdI/mfbjZC+nhEBBfK+tXFHnn12Vuk5el3x8cu5yy1t9 H1MCnKU+tJVScadkCwJZVFuhFa6iY3WFt3rasYvR8zPV9lSmWc059aGNFNuTaj+mwA6hiy6z LqjJCbvkdcWge7B0X98+pkYnLzUUZkfCGkHCRsnttuzBjuqngiBVf3SUXNhnz42uNgdWHXEz u42ox0Xy7FYSKvFe9xl37jj+6LHahBL9yiutepGZbAVWXv/DkW2Hcx3MrONj7Al/UmbXDprm 16lSXAWpdxwdOmyha3tHl6xdr4BzxRVFniH9gZgOnK7GxeKQTqsJr7d5eN13VNHMEfDuOB7o IGnldGCaruOT5A5+qX/I7bAfq4xkVOB7rqabEnSsZgcup5QB2iM8746bIXYj9jN2YmCpLL0l 45yvfPyULtDFNGWk/uF/qhzHaqFMNQdeQgQdh2optzkJqvN25eGezlbvfYOns9SXtpy7olKk 50IpvsvcF3QHUYwrc9VISzMIQFCTKLa2agMCZiojP48yM/g27caHxJw6zCI3VyrWFLraVuQX Xt/jgUC4pRoEmJys6rtvsDNeFvtezyU/zsFkV42v/eD6NudAgxP2Vqumquuil8jqV8A5U14V MS92/vrHh3bLblxZMe0BpWJz4Tl/xAUK7257rYDSEbQl26GDQvaojaZXkBbd36W6tbi/4oCv 2Rmz4lP29mox9j1HeFkU/YN2o+hs9PsIm1HXIDkdRiab5BtVOiwS5sd5SE/IYkC/vq+AO49z Tpi3OWtcUL03pV7y6HoLJbwJEWNnSlD18LyfOoWcHKffTa1HHpFvZ5EfkncnGJZk/ipPLVfn m8kXP0wI6Dj3rM6fmG72PTE8Jzs83s60fmvuATN9W5KFXGXLY915Sb+Pf4n8FEkjoiCLufb6 owLl+VlkJSLd5KSZWXYLxdaOcw8vxuAfUoovIsryvA7aRh7H6nLUKQH2J33Xa69BMQsekiUi PvhlMY2vrbd5nj/X17kv6NVp0m/cvt7uNA8UxrCxEGhnrBrdUtjEKKzkzoI57PvDmhQ8xu16 4F6T9dkC87DPXXVKS9n6QgH3y1olm7KdBRfkiufjYBYVkfTRtLTkD6clnRjg0ZYUWZ+brS8U m3Y05TGjPZdjjSAP00n75WJWWsTOVFQpNUb9K/GarPyKlLSQvK6zTGkm6b7J8ewBIZ7dzuiu 5DqoSCIt920j3xv3zYedVRmyOIygnQr82YSj7m+fqrEUKI/XpGrcu+R3tvyZ0ykvDZaciNHh QEtTYcfJUc3CMjxt0AfxPB/dXBBoGQxqUAY/2p+MVBG6rTYRxU32ssLrRxbpeKF49Vmq5vF4 E/f4QMUgg1NeyB0ZOCc7zt0gcwCqeSikPl/5A8EIMs9xUGlrEwcy0uUhYJqqDQW+/H3v0WLa vXphZbL/DO/DKXnKryorS0u2BGP4JWXPsUbZEMNzSZSjOv2TbojwynQHSp1etgrKSDkjmqRJ cb37wcxke/zXwIMnaHcBjHncxKecuNzoRbO2rLHLc8w1izNyy95jEX/14Cnluk0tlNbAV3ak 06gSO18YFBOdrYbLOfrMy8w9Oy1DC41MZWDuBh60sT9pnFe2WnOlBWq8Nas8gIyJXJR3eE3+ ecpzKpyorpdiK09DhEkmjqWeckv4KtDArqc9E0Db0gfy5YHjed+Sh3hlg7+rFXu4O4/S4Xob k7yHwWTQqyPpZK8mlv5STsOucJliQSQ9v+By5zrmdid7L4tDRtl8u9FqSiMG8EwOjXAAf6Uw 9fCDZKikNbJ2frLtcaAdt4lSnfewY1/gJ86XxiQ4iZe6VIF0H8TdP1MfNWKdYWJtFsVlPDxZ Kq+stQE9kYI66ubtqjj354FESVaAA9WDUoalVSSw10OmW+5+2EDpoTVFMbKMs+QiuzmdBTEe 33LKITPf6WEnwehZQHtyKhGYbBppZRCPPidvLqw6bNbO5LQz6gporbOdrkl2tj1HuNRH+dXY NKrAxSif5Cl36sXgMbUf2wBPAFJ6YMm7T63mmRHpE507n1VrWYQjPzIOhP8iQ04yM1Vx192F bc4maQxSCAV5yUSZwUFaZubvyk80yq/eaJFgkJEHBzf/mPKbZ5xMwi/9V+ZQig7gnql3Egy+ EqWfmlsDgyd24VqSKPbaqIURZjoQzETzZzsRNmD4Se0Y20i9bSLBrTiYyU4z1XxcXmb5U5dS YOZdxfUeS8S3QMmHaSPDeNcyuHOuDz4QLRcjV3kcY6kdsy2J0tjgWF1Aw9wfvwME6cXH3md8 C7nsNRsqWT3QiG+RUeIFSkcSL3dW43yPmRnFm4SmlEDs1OgO1BSKvjOCqL9tu9Dc3c3r/vi7 zudUdQqBlrV9248pN4arwqlLGbylKnwUl2Z3Cp9K5ERPT8Do9RRcYmFj4LB6bnumqvIwPZKf sxBaN0iBJTooQ82H3e/DdzQTMgpr8xPTbG1o5pHT1pPju/LLlOqPbIrnjJO00UtF6oUiUjzb lrPrWU+ERbxgqOp4/I4jPLxjXXhwiGE2OXkauZPAlatYfAkR3x403EFfxY9zMeHLSx5hmMgN DR6XFz6VbWvqo1jUOsulHKhYbZdjWc9r1pWL9PXVHhDGQFKSx4spFY2BlpMIfgZQfp3CaygI t4aGMDh6+F/vYywTLAkctkfzbYa9qZ21MRZLjxpYahebtoYIJ8th+AfDC/uM4g8bbcsRcqrx WDUcVdDZ2wljd8JIDu7FjCr9bF0u9Y6042GcXnz4/cDgcfhgsh8Df6FjgACGLerkvCaUJhVz yG9wZaVyL6RTBql0H25TngCp58gk3eKPfmDMO5uEJo23YAVPnDQ6sEcfm9qOYgJf2cgJ29h2 x98aFH/85oWFuSTIzmd9lDS4o3pKAi6L4pqsZWGOhUxlw5ND3W1Hw4IGVVNcGKPelLI8cm1+ GRb8ea1DpE25vGPHTCOnlvqC4mA1p8tFvZMReJVr98pu9C7zl0lmpKFZe+aXhxRkFkA0NANX 1WTBt+Z6rkDNvAPFfhoUMsG2x5SLd0wrCLThupXYkKxNMuVZDicKxt2/FQudCS6vR6UTYm8H R216STnqc98dV7bVAnWtIcMS7A2SPADWb0kh2ZJcHv5NzU8ayKfesVRiROrFj13TOHhOJXdb 9hpJ+xLtPy/MD6xjuqaNl1ge4Wl71pqp4sIDEP2daQQr/HbcqIMdR7Njto7Blvh95Kx/ylEz GzPmU6n54e4mMAaMGDeP1NJvBKS47droOWYAYVd+DFHrR4llifZSLz58M5kaQ7M9hcOVaWjm CNN8YFBVXADNPAvPFagGAmXUo55uGp3wiS0dG7a07RKGV5kMqVpETC70dqQVMHhHc9MS8iNt wJYbUsY3KsUzJ39HtAcOb09xx1F9EMOdJPenox8CtSCNhNE2ksPARUrsPUulzC/HZ78cw5vn oVlT8hTlPHKPtPGFQLcJTZe4c/pM0l5USCJkuaYA0svD23JVcfCxDADo1kvNnKsWhRQxYlea eHn0z7oCW5rFfwUSqxA+/R0kDwqrGisTR4fScXk0khkXDl0aj14ooJNSxyNMTHkEaNotYdnW FE4BJwCXPyvs5KbsHn0AoPRrstSYPZ44sDY/riqdYAv5tQ5xjH1//BfuvJqTDf2OPFqXButX mLdkqExMheFwu3Cj3QzXZE8iYvZ9H1WXtBnHme3kFlG5Ufyc+IdAdb6girFgjY/tCNIw0ISq k48VhzCgbTn54a9NIDb21kvT8JWu1UYsCuUhpco0O0FYZ2xWyYWTUiizfzNuSgTObYIKRyrO UTAUKx9NudsksQyghEGUCDZJZuv0t+lyfU9C9W3BexLk9Hh5HigVxnwLvM89XuXyRAj/m+t8 0A6eoo/6s1Mu04mUphk31SUR2dliPV8w5IqyxW9Eormk2YwDZlpqKaXVaF5F7D3ppyxkO/Nj 12BHmpwKJ26iXv62mngZc8Fm9bpWhT55M9YyRKEC3JI/CDoft4T7muwXxl80UWZy1PbDI205 4ZRGETbcRrsU7YkMWCqipdPJErHrvXEzrvYSgflW3CB9HA2IpL8sKyA7CasMt0FuOiZyOTjH WdRuwVznl4FpND/TbIgQrl9TFGjJMPkv9r08HMr//TdKCpGMbYQsxdjGMmU3tkGRvVJkFGWk MIxsY4aKmMEgS8k6EqovabMvFUbEzNjLmilGQpgsY4wzfD7nd/75/XOuc51znT/677nmeuZ+ Xu/7ft2v93M/7/tOodOCQLK1zUtLwxTs1lkNGJYJur3yhYLd3Vlw3NvrpFyqR1J7HjXCVpYj vEu9ek8IlaGdurMk7zXsTdhECm46xN6JCubImx8UTHy+LptCtoxpMffqpA/3EdSjTX4ByAYw 2ERTPXGphf6OI62hIMz9YCMNAxkUToGp59E5QsQf2noDkFalYncJFclN7e3g/Jl0FRVti53/ GbXYLhfdsNfAWNNgkLgxvPVunj7kuefyc3o4ZfbnW2QNA2Y0DeBlcKQ6m7ikdYHco8TJFtMD PlYhDgV4qp9tAdkgGnIBFekFka0nS2+5Uq1lUpTy3t22KoAnVZch2NN1S5QtRg0dbdlcRHSx 3P7n9V3koQ4zUHTr989MdL+fBYykWrgRquheSVdovkgN90AtFbq4QmTFttxz1ZNL6M3st5G3 TYQ5DDE/psPZJOEYSX9qIC3c7wVs+z/EqBnx2eq3xI1rirb+1HrVnPu2K/GesK2hMzEtOL7P olsnVZkWR8E/5LbWzdNL3tJj0TyM7VdEDhPRlpVEVaZsCgEW06L22120MTOw93nZthXHS5TD jtT96SCOyijzuL55osUprWPjY3CnUu3kdqrbQuLx5J1SG7LP9U2sDx/n8gyXqLqfAKf0LpQr JB5SdOHYcOQrQ5z23qnJD3GJ3jr2yHynvDaF2QL3cswiDpQh9n4CcGxkcKtc6pXg1OymFqYw KZunOzYAjtT09p1iHsit8tVUO45zWRKDy4Ls/wvtL7S/0P5C+wvtL7S/0P5C+wvtL7S/0P5C +wvtL7S/0P5C+wvtL7T/A2ixmS/opQXYpYGhCczaRwJ2czYbvs1ew7JWCraZFzawsTv3s5R4 MM+JBaMs+kehiobNHvcZ+wI0jf7tLq8nZjausT4/ero8jwBdHbKWjVgHYzG/3/MuNG83bbIZ mxWbC/XbbF4Z9G8yNmI9zXqbOUwzLIhkfrkc5Rk+++OCoIwJs/1T38x45MyY6gUoiz6tFAJr JuPYROL2p20T1k3ufWzd2FpiM2u5bwLDYtcHNrN/4snQbpzn5Wd01RFP6n3sa6L4uGcFXXfi Ggyb0oZ4AVO32q7etgYqmU5CFVKFt2agbPYcGErAYVzOo8i3K2Cyl57RV2rFjAH+VF0yDDZR H3mrSuxyJT333w+md7glqRPP6FGLTdFXxqkzlyAqTMa7efprouG09FYkjGwv2mgyT19Er8yv QVkS/lSPJPvnVNH+lbQDh9cDxTsyERowb3UmTWgCu9mdF2GNnf9ZRn+MhDMo78voK3Oi0etF 6hPieapMn3HxaHZbNjziD4U65NAgKdrIGN8cqphYX+8jB2AjfE08O9W3MqjrL3a/ReeaWqI8 cezD1bBFdIThAn68BjO/tabRGP3t12MlT2gkfaAEt7A+V4z1goGtYNAE3Djz1+2jvaQsTJVE JjVzc7GdV97US+yhfI4tVc8DN0KEj7N/DZJ0K7CHRRtrPKnipEuMT3mEbWHRsbXO55XSiW/p j1bEJ2pZbF68BdPPtmDGthaYnLL7HfsON7W0qmB7JP7Q1n3ZBuxGb9uK71X1SMVB4iY7FWey 9L2PbFQdtYjfXPWFEQo6cRXSvQ7uTLcke8nufwzguJsrYKib9BnePJOa4I28Mno5rVI24pYr ai2EbLL1XWSkTix66lPpKyLYByYki8dN7y1G2jQP95KuQmRu52gzuyoN6nDbf9bt9h3wsSC5 2G+8RJjMQG7RV4JAMnUEnAwetzCx9mF8jGz82lg0+lh+HZb+zXoqCeNEzV6V7cC1e69F2DS/ K9nWXkia1oq+Drn9p6oy7N9DDnvoTDHRGyrra+sNilQ4xVi5a08iSGPmW9jhoSAVZv+7F7AZ nEkdrUrptr0/NdvTRNPTE2fBxGdPSxXT0CDCbGmSlbW1zcrK7lLNuZ1KC54mTGNMsom07hKk O+PDlxJxUw6bQqy3O/SKsZOxm7ob++mB53a+p1vnPZUqri0hZJsGYjcGOuij1ILdo6+zsVWH u7Ohi61c0UbTACXG0PIWGT9Typu3jKT6qdetJJJut/ozNhroT1WB4F6CdPQLGK1q03c5lhoe MTtggbQp0LUaeseoNtlk4Yf7sFu3NKxD3Bf/PQZ7WL+x2LS1OhfeOcvJrfqTTTjFU4zFhpMp 9CFZ8e639EjY4sT3SyhvWClpgVRsj2wA6Fp522KPk7OntkrSqIbIQEb9orU17e7ugiO5oazf W3puuEz6mwJZW2rX0uet2r45awb+QvbgING9AoEpd2logEj3ziw5N5yGvmNwnLbGWKJHB/xs TvyBuAdx+bkDDHfQJ7cJH0fXrc3bvvprZsV9KRiUQx4tyBXMXm2sCQtrsJIVGiOA26UMmd3n UOiT4wXb2k1AsOeTAhmJ5MX2LloJesHkHcNbC+gwjkX7X0pur2A/Fu5d3PUnLNaGrgsHy0fO 0R7L/rhMdcO1h9gH5rtt3qYuFfZx4tzkCVnET8dztLCZzuApdqIuhSr6EwzO6lqVqkcbaTPZ vEMVJF3Da1akYIZ9POTMLuTOg5Z58kV95ozXDitP6X/8V5xRXymEarquEf3NBo4929Q2BHGA W2vLhHYuKnySKt5oRTTsMxArXvqMGAV2n432gbz7Ax9LTN31Yzp3GmX4MynAJB/JXJ9Onqva caZekawUc2OL3HbXvgtutRw1ROwSjfYxeELmrDbK72svCbQVF84PEXwoX1xVXpBdrPAE/m+H GrznUKOo8JayPHBzo4FDEo0f8Sb5tQUTRLgJcaIfLLDR13wBNd9ODx8EiRcrFC92SzZufFIq aI9krIxUye8eAMJ2jsKNBosKMMufuvWJNARIJsRAEkwlgMW7D22hat7oESdScBXNe+uGe5uR U/2zr6tKCe7FaVR/WUxGPdONcN2GVrd7jP3sYJIBzDwwOr1+o0Ep8k9n1GI7tXfjdak3CFiJ bc/GN62zGOyZXuGt8yp14b9MVA2gYdvmDWcKKsFn8dSak0DJZIWnwwMTNfr3GX2I8t0elROH b+WI5Bza0hTMsrIMgRbYUtfzN9viMZjtEEyo33PRPMHZUvjeHIek6TnbjQ6EmlWIg+xzateF cfIPBArFN6uEHNvttni7T/tsLV9jhPcN+sAOiRFWqGiQgef2Z3gdIFCjTXfMwZrxOCIZUwc2 8PTsDAwFkmxpXUvLGRjPpOl8TA9Czfp1sXCvU+/jXdV+agqAZBVVCSbHN4nz2kpSh8kzzhCM 6JaeOxBOB0gxZ9/Rr8OL4c/prBNbX7Mwt7QMVhmPqNUaTSGzY13FnPA5Oe8elLpOMm3ooxTb RQ+0qoLB6gqtgrPLkAKdZOBUo2jx0wF07PYFg60oGAdKO2jrqlbkd7dxYPLZrY3RAQfpZJ5Z XlmPejH8P7acJr++LesfWCMZMJw1LMmk2yYKkWqCdJIzhJwlJsWcf4YYl7h8c7Zg7K1bkgxw p1PBWz+HY8Tvhc0EdvuGx5L+bhePemySC+RnZ1RVJlZXijkYt+JLy6d/ogUeNXx1BZQDpi6G o5rU6zbeIpoaMu4zaO30NyVkeBMAT52NAelETvW/ORqtOrizwt5/I6icGltndMTgJEScGOGA SkGYIKFg2EqYxg9n1Hw1dXvhQvZU+WY50V/XaiUqb9nWylsrh9cOaQ/Vjlzuf+zbk2sYJrdA SEn3xMF27amqBM32loQRC6sEGoMWRr/oUCkiIRxmQCdEpW2p5UQsJoidMn32PERwNkSLGZTb W6luFdbmXwhuzJU0Rn2nzwUehQpLd0dHjx7rTvdEb867Zf3X5lfmCmCwNmwQFRYOR7G0P8W1 edCX0ObvGHLFbAX9DUAajoIG0qvPU9GDs5VLcWsORhuumC56/oy4pDGaMTxKFfDLgjgDtXaz SpRH21GYEuKrUxRiQZA2RiNSEAsztIvU9cbQjZf03niMCDxprbRNbsstyQQCtio1jjaKhGoz O5/zwg0hoSg1mwmjaObnR9TekH8Zx1j5/KgvxNxbGnjImPX1/QX4p0xE0+bGTdYyeSlqTp7I UaUHQga3yujonWgg/VGd9KZsuL6mQaSi+JOq11Dk8vdyl8D20K//dHR0WOYZhC5/TxQhWZsT Wg0Yk895PSMiJhIQJio5wmMvAWPmMFq436hEN/xK9XDfIvrnLPIDg8WPdG7GLtC/CczOVVVD ZdSTH+46j8hNLVMekHJ64Y00RAXQ2dk0L9B5ojAV7coJuAZsJcjPKGR7MxA/fQnlijKAdxoW 9/1nt+UAqPQHPC8lLc3f+9E65ahxpJo7cO7f1DimEPprmFrsYk4ygACZzrk9i18OU//UE0ec qW5JKUkLHfDyhiyqR8p1a28zoFz0PKXoY9q/nFNVO5yHO0kvGuKwJJMgRfxCmVEgIh0g54mG sli0tVGQrLUtx122omMvJaSjmNIEsHadalaxC2d7f/2EY8RvsH/HSZkcJ8HKBa+bWZsPAev8 QcQIk+bwKUwK/fptRpc7c4m7z9mKNrs5c3t+vFHXEMjfGw32PQ3XPwxKnivcpb6KpkomVzKM 3rV5VTJnjtJYH+ZrWQBUpc76+FmiMN8xIWT9ZOu8YPWcwFiT9ZlZYwr6BuR8cYSzrK/dF6ob ISU1Jb2pAepuULF3lwM5LfKOmwqFFylplNEuQnx7yE4jR55a8hYrfEMnm+heTr9qCx1/WuDw cHl2M40Ks9Z5UquY7A/XsN3N7CuxdNdpFbEisJFsF6W2CGmLskRZGwVAxwDdCSnVUB3i46+U mRR2RRsd5Qj1hWQVU6lVx8Ze666upvUmzWb0sZL+aT8xtVTxzuQaq/dVhKwuUykb+lQQUWp1 5XElHe2Nujk7Y7z1kZB0dsu7rwKDglgA3TfHorRLqL01yyL/Jlqxk+RzAfrC5fr8qIUvb+On Q4gbUzPoV2/eAcYY8Rgjrbp3Epc76eEBO69v/8GqWOSo9ir7PYV451zAWO1yw86Lrx9xDqLa eVIJMliEdyc2S1O7b9GHVOveAKXBWj8k+9xSeuSkj0efcje4AZTd7WHKFJX4T+SpvczPfVUP yPfsD13+Nb3iDhu6QHQfplT6MmKNSgvOF4dYzaS030HNPPA+zUQ9hWSV7K64rqVsoM+FwwIS lZXSnBJSgv6KEaa2cW1dzybOiSa30eOTpkcKv1A9Uq/bFD951Ds84TC0nsDeKf/OiTyUOhkp OtaJNk472L3DxIbjkRcsqzliUsqg9dCdrVauUYx8gNLScsnpKRkpD3v0pQuo8B0/BXMLk0EF khRlug09Pj7ALTElIQCjfskXhUIJ97qlT4vKItL6BBp2+Q7SvJS59flOuwpKEfXCgmSOclcw OIeKOGkQkJLyg95PPeB3c56GI2uTUGgIllM1tqjw+7yyqideIbRnRm2UxLf3rXJU/s2RsQ/O qDodzl/H+62taLco5Zw9b/gLSVTW+8bsJceVfwIYzF3sjMekxFiZ6RTh46e/sS5ZVtcVEMJm s1cZaxNj1Boo8AKLBSpxsdMp2/VfTYvbnukjKBWEIkQw8yq4uapoRJga4dDcdLT7NTPCmBPe 8icutkM3DLBGWIWdV0Q+H+MZzLQ8hL9ulOKnCw2cqX5TAHdPsgf3E8DhQLLRf+5DbOsGe6v0 LiuGMjPYZziOFj3yUPXk9i2GPwBVJdDdyBqlzOPoDaXwLkTAHCkSdQ8SmGY/tK65Aj+Fsdu2 2uGDsJv9gDz8IqXqgeyahfihsaaEimuo8QHCSDE+dXrcpPKtEE12Z25i8YAd12N+g6yiMF1U 18jGaC8pcyIt+wLGfbYm2Myg0mbFZFb+6YrSsu7OGIAIdzG8D241IJbo/sKi+nmRreRlvtnh r4E3Z3t5lwmcLKyx3mcFHQqIt7IpPefNDlVTqJ4Dz2F/MXEQzFcWTRxbb01B23HK4y4ese4c dtO7fWOplPlbdARSuPdtQfOS98bOY168bLlUm7V9pTx45C134yb5IlN4idAFHYXuDIfIiA1L VNf3VXdvNy3dV2fPywyuUA8eXl8EuH33p01U1z78I1u9RGLuwl3hDv3NXk+LkiFvc+07wArj Yy1FMET+Pxh8+Z8Xk9ATv7f3YF4Dfvw3E0u7c0i7E0s62rqQ//r5pP5/N7Ok+b8xs3RSB/K/ RpY0Nf+vz37lzVwFDL2KW0S2nDrhe1dLMu3uAW65NDMfO8H9JNoKmxA09OxrVR/KQcZ1a2/y k0dp/ZvFN+a/irIXt3+9MvQKa1mIGeOq33ub95fgsPTL/0c/aC4Z/i5g5KwHeje33Fs0PWPx bekeVmdzSaR2L8+BZ9C8jsDrUJR2WOG9lgtLKphA7eairX7kRCxqTOHQRjFDf1tyDYyABv4K O1YR1mO28Xr9c9V2+upeUiQv68yMADrP40sYq6/bIyk0s33zI0uelEnQQ99VRYsV/M6M6g7H Om360er3BsRupRvuT7DAzOqy+o6K0zZPzislrwgqAwKqrv1QEJioU0XDmhbzn4OPzlTegPp7 hJkOnrrygWsyyE0hGzPVZKHprNH+B/+VLDkibXOIJ9v9fP5hZcEvzaxXaGiwHFh2BOwPRRiF HYuVNzO/uK7R3ED97VFWq6nW/tqRxgK9elrXQLUL2jjYurYRV6mnqa0hgEdqDOthzt/7IMkX ejQ/QbbX9rCTZj9h8viHB1e0UkqAI+TUHyzCixdAvivmaXuE/PnFm/ZpB2twi3lvlszzJq8K Wir3O+qdeLksmCiLZSHz6n//tjY9Uus49sgNT2VXrC541+0tXyt0nHxq8eae20He1khsWsqe +GF+pEJ828Pz/kbQE0BcZWsUxVFZRPPgnVbmH6lX/luRvPsP7a+1eZkaJkUGB0CvocIKj/Ax BQn7YodrkLQT2FujCeDDAkABqrimuoBn2VtNNavq895RvhctlXQkq4PjP2iZKciZ3mx/yyMO 5Rbi2uvh6NXikfFSYqQyEIoAhB2Lu2N3mO+GnQQudK5lX5qjzLs62+E94nvurppXFYp/etGm jLkQRV4ajQUuCj9yVHwXMBbvX++BfpNpZSHQHlknXMYvLB7fFn7+Viu0ZF9c52fZhrw9Iu7v YhLmR8J+f03Ey1YHimvewyM0jvjLLRpOTYyNYyzDjv2RSQWMR1EivIbMhr6lDdeGiFcWYNKF TD+GyAW0Rgi//wCYSRDz9wh8bJ5mwxcrr80lYnb0Nu3ra18haOohrr0p9wL2ebb62yPwCW01 bMFN/Y/1e48vfkOdaOS1fPpa5M6+iHXJIU+PddNTmGWPm2JqLXE3YRLVmmrx1TY0TOmBODwS /+Two9MzXMZc+lwnvBRNW8fhQfO0OIKlNyGIC2oeUnVl75q8vP4hPBL8XRPr+dMYl85hxTXz tOFq7DZ7b+Q3YcqwVM0wbsymhQNVU9xvdDHTPO0M35LM41NmPpEnvI6vciXc5RX6ZvAZKyhj ZKqZwd9hf7VoinuQc3tNdjACCo4UCvv9/qNmfE3V2oF47iZvISPe1D3C94Vk9YO/K1cqWAvK iml2xNUI32+rC83IhanFrxqOSCWvc0h2QzFOB5ByUB7JoI+OajVOT8fsb9HbE8Wlyz1QG/3Y jf+q3PtAl1wFzxanhuifxtqn3x9Ys/ojc1W51f4o95E9U+tLImwDzK/h3CC5gH3T8l5XpNKc Xgy5jevEEdVAEtXpebwCPGhS0UdrAneiiJJDvkHoT0ilS6l9vhHSoyam1hFMdLMZ/bCZGqjo 7YAZdGOrbMrdHY2lG984zlMYQ4wpOsYp6LhNc/VDBi9z6j+TEo+W5ATxpUH5jx+IYnfV+sLh UkVl2YDfMjeUJw3vJfb59uQbhrFZDR4z5AJDW00v8KSVoExhDSdP63EWbL/Qce9bJ0C5RTH5 hXl6IfttPpPhNfQK/pWVfXdXr3JKGYvf8ri2QfVX0HNtfu9fyFWO0sc1gDhFEXKgja5NwkiE kDLuo/V0Slria1NuS4+6X5W22RqeQR4tHoCqFitFoeguIemxCZ9Fo0lpZbMirQWJksl410Ze UZ5c3u/3NJGzyx8+ZKpeiLhcG3zt26tg5DTjk8hv+feXjgVw+RcVBYrTfHDZV7Qm65IZP14Z xNkZne1BFamayqVza7scivOe0k5082h4OjQl3+FWIxCFXFDr56nSO6D0arM0z/DdLdivx7xl GIWruJAnqgb3dB2KlG/aDAVSJKpHolqiHJ0oES1hMYnP8UNZWVnZlSuXPD0v1e3n+GeabHE5 V+9U6aD5y8m0hCta9waAZPeMBmujU2taAWkAAeeEtRiiXpiJJpd8wGj/3P6OY+IQ8Rlyiduv r5+OKTlY2iFTfM/xskDHlXGkaU9nTRuzRxE/IQI8iid+taYfQ84N3moMGKuLsODEOkZ8yc3r bp2UWY+yepD8kVPyyzRelsivHx+bOELWcXU0EhjvypcJSPKIWJTb4bDkeW7L0dq5SsPqTHyb Kv9v+Ts8x2eaGvVEYt9otun/GpCibpY4AhTb9mcCPsUDooQiCRv8mgCKyId9qTVhE/C1hfHG aKnVq7PAxoSPU5rE3CjJbu02fSLs6PJIVoN145OYNT3csbhwQhf/lJGX0sKexMxMXiEZI/T6 4e2K0WYhjYCxhib0IaLO+ztUtZuchQpGcFkv3RbGyWgFNMu1jd8dp3WeA/JpI7fZnXfvE4KM MSyJ7TsCQciZU1Vual6xIaEuucVubXLNvj+NnynyPKiQKFm/Bh9ONVjkyoxw+bUvqbWY5BBk HN2Jlb2Lz9xcW/iAd73i5JobdPHIu1S4Twc2t/EylqOonDwardJ3sNmKB6Q9j2hVnjRGKNMN ZVps9iT4siN/1sSI11Y1fH/R9okm4P7L4nYWqId9/ga6EjdevDF81Inj0OHUfF5OhmgCqieN OjiPfT1DxoYOrcyQ7+FFwzmKELfi6xClxglkYMTm5mlhnEb6nShCyQ8pXT/l1jCjqP2Kng2o ITwce1w8SAHHc1s+ex9/boYW4xbudXMbcOi586ITGBR+syL9wy0b8T1x4UJAvnVBTS5Fz8ZI 9aHnF8DvebphKTzFF3FxoB6kehAUqhRHfPCkZdyigVcgzvuOTUPEyvS8O2uFebI2nC3wU75K TOumEw55KdEG+lw3Z8hykaoMeojKtOWz0hmISiiKyTt2JHCiKZrELystTs63UmOx35gh22ku UhJaOaKBSxXCuMF07vtX7J29FuXG7/bQfthemRqLwnIl6V7VOCqW4F6TnADqEePX+VTaH0EI PuEpD9LwTD/kN2Xc6tgQmxm+zf54n9Bggg7f9uS4FuQlJyXskvvAY3W64DJv3CB/FhGg1X72 NHJTcE2GUJDQ+WQxvNSG1Y73SuV/iOcWG00AAEqnkdMHo9JzBlgjI2HWSF7ims1xHoPLcZHv FUUIvLImZ7hOy0k5LxhPGpcpeynfS5wwqcV7oW1eTtrvs7dcLY3EqGz2sVyNb+Ucbx5TZt+M Ij81PFyEOM5xwo/jcSOpneN7x2l/5qoDvxmasK1OmMzFWU9ObUX5qr80u1xLQgy+fb5QaCda mv+sWKXWQKcL4NvHlzIZdWhc4frU1vdiwMJwgzKIbpxbtL4ubIdms+qbTfjFZLnFCEfFgMwe 0VLpghSv2M3wLoRy7loZ9FS2nREYBGlXT+fegWwEyE+EMriPfojzMvu0ce8Kf7Nw0RTj/YuC 7+sZEbk5L0k9eCT2K2niOnh2RTCjsKyr9YEyj87SaFWEBshn0QxmZmFmuESSxdbNEaDBaod7 cG6uqj3OiZyAmGRXN2eXjBfLtzfqd7UaykeMZgBOJxna8KU9mjIyEsF+kwd2tgVSciliYGx0 ik5amd6cd67nDkuw/iNrz52V+bQWlEFPXj504rPh0z9FJgKuLXIpx3CnUfAeFA9lsUpP7ZtO jrkLrmOq9s956FEwXuyVT1GQ0xxxr7zk3IAFj1sc4glfH7kcLvGyZb+ok70N/32Yfrvfwai7 lXOmi453iPbO975jwDu5SAToCeDT72i7CMAszTuUr3LszpYbqNxXuxJYeE76d1v5WlkqoJf9 Ql6k8v6Twk5XZTZSvCXIDc1U/PZiCAx/gnvwSazNJRQefeO4/F6N4KHsUo6M8aRv2moFKIFS E0tJ03LteTdtBhxZoKa7Nqy15m1R7Q6evIRsMaLeD1Z/m17jlI8//qdEKainYm6EvBKX6JPh geiQvjr668abKIfZYQ/tJcXZM0RAElInd/Y4Z3/H7Stz1FR5WXYh97x8L/mOIO2kMO681oLi maL0O6RpFdBh2vUM+WzA1RMZB3/IfyQ6I2/IKB1ZddT3wYVI+I9uGO/mODopqic7Xv90bMbl 03VXZfJl4kEAedBLdnmRI4S9wWvyHdwMzUy2iZsSOBj1VM+wkn7YM9WcetFZkTR9/LScdp8U DvtDxZtqxQlax+Gs2hH3fgunm2aOeYnZRx9bOCOSDANspAGd+7ZFNVov9YPsjxZoeDi3+R2X HxsMRpA1zJ2ESzqAw63eK9fOc43By1OQFr4nxhXMne7DZGj9RvaqwpJfVcLQxdeVPTI4kukG FNNZ0j4d+/GlMqhV+4ldeAiXn/BaqVx7eelPDYILoDQzAeVBuWLUyM3nF9pmldg7oPzmGGX/ qSbPl6mJSunmy/69QdcXjNkk2z1yKgy5lg95CQzX3PMZRkkDARsyJx0BvTq2Triv3itq7Xlm cnaAKkpyQrseEp3TrnfR8fzjlyQJJVSV6PFqj+kAB/8Yc15Lv+LW4TstvlMnbXB0Y4nPrMpI IbLlQfyrqQwj+xO/1Gt6xP7gdJ5Oun3wrI4LRN8uNC99bIFgZj27J38rIyE/3Bk8nJF4nwUM u6Fh8MAuo0hZL01tR4KRb9sZ3ecdEcLl5JIgXtk2uwacRNg9eS3AsuYNfGTbrMr9F5Y+dsqK 0HjX37mnP4xOYOqn6xd9gBSDR/sVs7gfC83bvmfY+ZlRzjivBz19gRXGIdQjVXp+3jP+vpNc r5I+Rj98xGfKtR178O5DA8nR++bfVE2GBxLUD9woBjQqwibvvqFktVLCiHoWH8adi6cYB6OO KshjPwUF9jyLrkaoSMyIOb3feBMclO/GF2uuYvJ98iMMhHsU/h9F2EmxAZzLGcvcKTtby3du iR02iWfLbR4sNVCelJimuh+p/fLzTAhofzqgsapjJ1xJgJhnuuTCIPbHk+fGOvcj9AE3Q39c Okx/b332hKfQ6W9VCMfcSHRdcCXRUlH/XPWRtGcnpVn+kqKerjV+wQcBzpr0S5erEt4wJ4vf PlG+KlzC4/Jagvb5zkX8Bc7W3tQvPf7+f7B07uFM////75xDxcSkdymrZRhyqBZS2IoR5tSM HJclp9gHOZfCDsjkEBaZ8ynmkMghhzmUpsj52Igccj7m9H2t3+9Pl8vr9Xw+no/H/X67P7fr gqkzZJX3Bj1MD0a/6hzvlQZ9FJhXz1bCmOu9abWkVCnDdfoKjhF8BZde/hEmqKmvDtE6jD0L ERU0Top9Xf6JGesdk0Hk8N1UzbuHd8JIfBfHmH2xyv0Plh/UbkYdSspWUkVJeVxaMA9FhXDa qNEFyHRfkbBt092eJUOEsURSh6ywSMu3mBMP21hfUm18J2yiIaMYKgoHKbY0oscVXcMLdZTr 5rTcPbwdBrtrEvbL8DwtKUDqkdKiHWJ5pGjluABwbJkMfBIkWm7im7if9EUziVzNo6JuA3K7 z0+ehQj/EJ61MX7BuKnzU6c1PETV9I4TNZqTLwOSakJsSiaUniIJDt6iicg9zYhwRj6yM+bb 259BZgisOBLowYa3HkoLO2tcfp2e3RjcwfEmuxfDNkNEoAKlVQE12JyW0ksEuujdkLDgjwLP NE8687XuyKYJJ4cuKJSAD7PMrSGQghqXW+Yp/CMbxTF8N0TGjhz6aBSbGBaJ3GM27iaAKNhF UJrwWWhIMwTNDz54CP5NT9aUjouZ1UUiLJuECWP9azt3b0lYRDU++2biHJGruR02qyNCCYMo Y/7LfHDruQ4FAp7b+NEltqbXWyJEqxGtWQyBSlvmB2Pu5vLFJg4HDVaU15uR+2fQjxoevV3I G/prP6FVxcG/rNYML8lGdNrEiUCvyXmGuakY1326NJbYoUzLPHDiRZhd2MsOk4cb05XSd5HK GYj8fSGvhDn8OBdt/k947KFznIHRD4zxdOQ4LJOExXiExc4t/aDzzd2id//vP0GMiLIIxuTt wdPe54QT2UbbX33r1KGop2lg6uzGSiIgPubD6in/ZfNkZfx3FWL6Cmesx2KeZJtop2vuHOVn j1QXhkDyieVH7R6Q4s7E+DhJdAS7PLYcYyHdi5GNwoSUmeFtxTsowSSIDP4o5MQhJl9oJSj3 8ZbA5M1s5YThdgfoYd3vESHjfeL8WYiBONJrjrPVz8CaJKP95sw4kyfmz3jAZ3kOYFtaPgZ2 6n6NLwzeO3VJOISoiAEkwqrjyXc08q/5lFyhTvZjO+P1DNujwUWX3meEP1I0WRyXynDg3NwN zjG8K7HXtfU94bvlDzS19Lh+nhDN7XWTY9b0fW3tlCQMRjBJ7cB1n0RCBvmgRslQcM6p08KH nX5mHN5yT+ToibqMv8zLGXXPGYjXNNs4y1N6SR/N3A8yxQiKbAeJ7/Wsb2rPRsD0SbGCY3AY Ox3Wl0kKPxJ1WtquVDObpxhCPJ8rLWT8XZK/9Ysa+IYIAVU/7KBqeg584atJ29k77yMod+lv O83U7vDvlc8rmy2GKesKS+OvvOr6syUxAnM2oFI60cjQstkbw1myIm15T3uRlidNtA9Ry9IT fswmvZgNEQPnlBqyzOHo90I0cf7BnnIl6VMLcd8cMmWCC7RzNlam1kegZqCz2u8/7AQZUVGZ CP6DpS5GHtZ51uuMF5QrvscYrSK9CdNSpB4RjsYHBVMLmnFd7BlLJ2mdJasuSmc8aZDJGK9c PcPuMZauoWLgsxprc8uqnbr8Of0rlXZI8YvyaLmrVnp+KhbklseC2U9E77B6cDZ/n790mRv8 1f7d5xiH3YR0sSNMP8de+C5y+VQpOBMhA3ZytuYzadGpNEpNwN7cY4DcRAd+KMPHzbSrNCOb BsVf8LeEzFqjha0TbDGpiHtzA4OVNCGj9GAP43Y9HxUvvD5bw1Bh4sLwW037pJ8P4bN6VCfV T5Nl2HRePzOIoqLiLVTLt87Sr0uXDtV9NcF+C7lso6BoC8pgBX2JEOW/8Ua+f7ASU0QzfIbP j6JCPZb3OWlcrIWo8ti2DFRECTJH9+YktgQf8beWLfD6iUAhVyidE93HSWh9lBx8Le1U48co aCPzyUNcpP3O2cTx46NKFPmv/tou4Z2U6KOWO5XxqtKWnMzkxNu2dVV3kfCO+9rvrj1nnioe bbsGMaUoJcU4o1o9ZwZGeojSjSHCinD9VrmL018x50IQJTRz6lPUA3JLBd6oOJa00qyxK20I Gs9c0clr+74cNrXeV1ZPWH6kWIj/vTk0xZOOcmM5EmeWoGfrCcl8jczXW9baVaBqsYjDBi1P XBNvFzeNAdLhjIEUE7fMSo0GiuaaNcdQuxlmMYNCYoPSF0scUx2zefrOyGhqaha272Qxs9ub pT837VcvXJA4Q/h9CWpB1v5yeG7GEc26BwG28HY4PMn4FJV/lklWkdApJqkjn4MvIAxFX0sX PVSQ6pvoXmVp7EL6uxqBil/0GX7nr/fqWryb9qq7RMY1nd1JxUgkTpgSLXMJusXAy4Ba48vb 2xWlpcND8tB3dk4dpFNCTBKbtIotceH7+OOLCKjWgHfu5+R1LUk9Sanmz7oTFT8lbEa1alNP UEqwMc7GyMpgjAs8nUlWNmsUE0NHTWmlwxt/uYX+ydGmDuKOvb1MlS+IBQMM6fnm440RjISv MX8n9IvmAToOPq6SVHTUaEHC1Y9SrymlsetUTwHO7qOs7zzhnhh1VWj02A6foXlLN9bIHCsj y3nWApQadVkGDJWEQohXy9+tU8p9btvBS6mH2S2aDcG5V8HvynnTwKk8NunqjedSgO66OnOd PhlF+XDdc0CQT98L/li9kVVsaPHbAqz29S9WWCaU8tfmabuSI0ZNPQLVGmGMdHa9720SzNTW Mudo9bZwJnt5yawQDZz2uEUev6RwW64c6LoDcabyguEq5WkIO4L37HDnO8d3jhqnyxaOQlCs 1r0hrRjwata0OZlUVpeD699fA85+yyRtCTo8du2p2cMdfkuYvluX7y6jr9PrRzqxAIzJp789 VcoNjEG26srv2OzDxrKPLOjHquPCKchwAwlbgyxS1edlhAwl2t3/EXHmUVx1T3we85uURM05 mZLV7Wc8vvSNpah+L/BBWBtHl3yYiLATJ3QcaaZE+xW41o5IigSe48iElv5WTs5pHk6qC9N7 xSmt8NyRC9yZUbSX6NBU9Cub/lFeks3j4Fhj9Ttb1I5ut0Ld+3V0Q60ELGFb2HskSxmF74l0 scjv8t4pXv+rH4oyxzUm58+++jWt9Xr56+3qzcUppPDk8y1T4oxXs9kIcC6i+2NHClnBEWD+ uvxxujM9wVy9aYoanZdJ+hED+Eq+5Uqy9UWRGHAICK8myFsHzxF4xokxl1ATtN36L8j/s1X1 K4r7ES7G3xCtHDipBm77mc7Re24+dV0sCcICsxMTrhxX0E+y6HGptlBXVQKzbMyec/QyQtZQ HeJ0e1O6gbjS65AIbR0ujH5ZLfTBhaJecfB8ke1zsXw0KQzdG2h9LXfX5tuNKrNdcN95+R47 hRsUJQGHAAfZW+1SkMZgKATYxbUDIu0LHcFk8xAbMxO6miSR0vmSnkji4H/UT3Sb5nO+1Y4z H1OMb5ubNSGul17W+TuxOJUukvW14D+VE7vHlc4ZmdATh/Luy1p2eJvKPl2zPEPmCO//j65N cq8PS3d5HC0FuXNirrzCM9B9a++1LcaM7tc3kqQz4joXI55yhDX1cW2C109L7/0CFkvW3tMd bJdx4kKteIo+rEksnLUPChkJ5P6TpgsOkuolKVullVYXynXs6FBWjtZ0/W9NnV6L5A+c7W2d PAMqFBI/0f7muifnNbA4vlpx/hxj7+YsK3eHhk4ZYUl2K4D7sLzLnm7Rm1HqIgQV/0ctCvry sqcnu0V0gYEY+vT6AdYExg6YTZv4cky0T7vAm9zyW5i70Sd1A9UasmAPf+kh+jNUdNG9h84K rWPGMiDH8qahlF8ZKFS4UiSq+xShAvliWQtx0sYya1riEa28rsIWGCJ5/2UZNXAO59iD0NZF qUkc2J7e1iYdRwovWGTEkpTlZ21GAD0v4CAvf5GcveuNKQbeeOzo3vQxqjSLTNuHcdcvRaYz YRXvkfg/6/nqq3VwssNm7ZB69/CzR/DTaCTfjv6lnH8Zwx6z5O3U/ZSP6t6taLgbGg+uFpE8 uZZZAwPEMjb+Q0ohvqmehfhuXYgia892fH5xY+QIoaUuPw7VmvHiRgzJuUyIFvj0Ww8ea4j7 UId/91+WU0acNNtPptMEYodq3SkMaJDRxX5wpYcESvajZYWhROe13sR1sC7Sn7toJ2xPXY1I BupB7UnRsXBev2uGMWpvoBDRlQ2TRIc/w7FXrVYor7Ial9ZPeH0xa8i7Aa5BXnwflBLBGK9C jiNzEdfc+j9YqXySAUc72WJLn6ssS5zlhpvSj7VKf/OPUT24igi4fvi7x9a1XrJg8/rktlR0 0nqksXuc0NqjiW4dh7hXYE8oBDzmjCLHg0Xq8j8Lgd7w26BaC1znZtVb7b+XIAF8aLrc0BpP UguazjMovF/tT/OhXy131b7ooJ7+xP+0QVeD5VPgz8Ry1YeFaNd+CYGSLK5dvLRwVQz8AKAe 0HeaVioyXRl0z0P2dlTRve/TqvNF3kB1jwtQjsAzse7vpdHvKzwP2nAygFn8cYKLB59cksvi feH/kmO1oxRICgbM9LXzYQmlMGk2UHp7edCmoXVMW3ZILOkYD+p56WMlOUwMnNfPHLNkL2YY 2kQFovXCAb3J//DdkCESnkKcRiOHawI3ITdMrW+JE06P6b00cKFoE1aqSrMN6e+QyGZC2nH9 6KL4RkTWW+R4JkDUVuvi8gvYdCgEFxPuDlJ47ZmbicTjuL09w2SfrX2zGYVjJVyalThKkPZV AegnUnfo1xQX9XiMuwhpSKQd/aEz7UwKbowld368vYDFqID5QM6uAS5S45W21aYLxOlWHZPo 5gQYe2pqant0d2jgDyVa1rbwICqBCVBN4JojA0G94O7iej8sSc3P4GvR21ISFFJyuXzuGRBf X1QIgQvQyItN19/tfwCcYG1ToCT1Kgqf/T+kIwYG6qNLs6uQjUCVPXkzF7+qgZUsIB5774Ax UccmCCxSSlAYDyYSD0G1rnKdbcgmG4+NeW7ORDaW12nYU6dI7mChNbnkm35/0wUcpoRpd8+Q ZXb0e/sgcwZHP9rncbrKsPjmrJOyIClp7tF4KFaXtkx2M5khMHaK51MvBsLFdailB88X+LSZ Qai3soIoXnkVvcyFCjEhowQBKfGUCQX9s2SL77btwBodFTInXRThicJZIlCDdkbE7rUclp2v MCEHVmFKJgGL3icuLysdaSBDjZZUR11kF2yt+jyseq2PVi/ai08pOM7ep72QIU5NppQwkHjf yW5zcotgURRNS01QSpotBgfVDaoAL47iJcge+NeTaP0sEpbcMloehBtJfcN1vc7KwLTN6n/d oKRa7looxdawXcTG6CLf48gtb695e1mnbEaZY+jzAZiltLBjAcCBpy7Hc9GXQHQdkvPiJsVd xxwW5G6vTHsB9we3zWNVHbpUHIvMnJZFI5cqpvf+G2YtnpRYcSHONKFimiGm3Cmy9A56FKQ/ ofVIZLJNGAo89mdUnC0mA0EIcB0SAKxGwCiXWVThGTD4Wf431Aq3YkY3Vi1nA4Gj3d4BjsRt F70fGqy8h5DsnKgGnrYxo/jTu63I0FEDfvUBcSZSkkL8jEb6ikAL728dxOWYk7XvtEkXbWCK Wk5yO7F5S2XA4GUHwzAmn+trru/jy0dGhu1/Cq196wuWPZbu0XLFakVBX5qdMeNq2RgTRyoF rHW+Gocq/OKvfZRbyN2teZoeyDE5xtI6pop4lN2KDfibpkMNfMgugh0tscNwGZnoR1i9UoYd p5z86ievvzxYaWcwWVnhyVEieBY0rft9cYleGXaLWv1TgEqFmavO3rf84OviwyDOPPHPhULm h4u6vB+QeYprZG3dDJ8CAU0XucTAAz33OyJlrofwT4Ko0YSHrkO7AUD/20wowqsEyApsO3JL +kT3zrKAl0rQ5pkzrWPw0rqfg5XfOs0HRp2PuTyuKbuKGNIG+owiQsjjPrDn+IvZvnTOzS4K 0UEXqefuABirpDhV2bZQsckcExM+1jmVCBECkBvjcRN+sZC3icMvxVWuVs7a3uUGBs4dgMpd t/n8mmIwVc9df2hQhdcBWlBD5fLINcEoK9wPyVnTrwUNwjRr65q4EwtAvd9u3cyQX8OmU0q0 yC3/k2K/qllkSLH3uwPVVWgS6x+9CISbCNGddDw4kLlvduRn9ytHDXOp16bXuR1wZLyuWq2B oek+l0QTArELVEXsuDeK58+WYQ3d57x4/YxxMWciDeLfabonl+i0HiwWtJ7LQFVz79Sm0sdz 3lhc8x7/9iyg4wjB4liA6KuavZN7/n4mAUcV7b9LcKfSdKRdfjxPDBwDvjHZPZQUrdPq69+f h2xcQmwdKHsRAujgjHqguTylgxHAndGt4lPZG07/hMboZrnrcmZEV9k+IEjeaqmN2YziJgKI HZCEtlTGUh78f6mZ6P66gfb+uwrQS6QBwdN1qNIzW1KroPKXu1cwJJz6kG5xDw7y2UCIp+yu TSmdtgjPahi2BuKCi+dWoJeGO+TR91xYHxr5t2ZMabG+LUz4pYGkNdd1X6XCGhi33dnM45GA njg8u7Rs7MR8Lc4SS1ynlG5sT9nnASZn0dzinYtgEfQn9Ns7DGIHTO5DFA8SZ8Rv+j7em/uT 1FNS4bkF0I/NgRvgG9TorALk+BXFkmT1OHfQtTiuCbqLt4Ljiq5dFvx7BNAzaXZUkTeDCeuT nN1RAighJiV0ulMgkEJqsHNc5CtC+CX+88xTeEBmRQhMLl0cH8s02PP7YUeTYucK0e4Z8V9e szFT5bLtwdQ70kek0bvKTaey5m0Wfu5YmJywNSo2pkeB+eNhslHDFklF6197hLsBLvhfsxmL egPsSCbJo4fFnptnsfWSOP6xUvpoKpEArB/bdsT+OzamTYjGH18IDw2kt/+7ZbyDg0T/U+78 X4V+KceofKyEeBI8g7L8dcD7nHqkBq7Io6WsTkOmrD0lcKu35HhkLOlHgfeXQoCHD0IhTG7Z cXLeX7J8HBXSoBChMfxlJ41gc8nIrnju7RD5UEqcGH9KkWRBTXnsJWhWBwOw2M8GYfcC+v39 T9vTMxGq+T7UrDgmVqbhwWUUfostOEYPYeD/16vqM0iJtuD+Eo9dMaF/qeAg2/MdMfT4z6jW pPRFu0B/aVsquPxB7E0omqpJbpkwcU+GsRBata8UbGgpuUHRxqtVWUQiptgsJXD5Spr50vq7 pStui5N34OiCGoIdhUe/CzBUqufcRkxb2BNWRfLZUSKLbNOdYemuvzWokgTpAIWsADb+wFFh FQqRWY8KvpA1bUJvRlOIf3AODn2Dlf/7aqH2jgVRVb9xPYA4c1kOcqQEXAjsmdlbkCKUgdJw 7/5aYN+enwMH5bg9H+N+AubVZOdAjZ4fArFyeP0ASV+tv3ZTYVlCp95KnpUgnuJhpHh6dEcp +EX1xCmALpysBndrk2y/pyMKkOl7gPMX5rMg97jNsxbn9XQEIc02upxXjMSjJ7oV/pln0dwN q2nmb3OIYghxZloX6TXfz3TJi2j8w1w7PsL212Yglsc6J4RoIGl9R9BZfaSm7/zHcrfXzVMi WXEk+ishmhawJtuKgUCZBkY+gvov4PyJePNnsstOgUUpMcV4OA87oVrfgFY7GFdtBaaq75Qd Z0P10TVSxP2XfhyR3IiaEALJoOfCNRYPi1NzhUD/e9pDVLRT4IdCzGIsLYcDb7b7a6dw76nC zzeZ5yGsqRz/9LJpHS7/zsS/mPUUA4tQiCO7zzuVy989IJPuotngii3Jf1dFv6Qg7dtPi3Uu zUKzpoF1bXVcq6rnmmpFrS2lxSKycWdlq/e0/FUpfSBYYH+xR5YAMe2c6PasibDu51c8Z5SH IKQikf2jMUJrzhRt60YHrIkUWyzB4h6tqNwcwKeXnb4q3i/SwFQH1nVdIDfpehUC7He+QZda Izz58S1ib2kM0mQWkOvyWLx40c4oxvK1BcEYqfI2Sv2KEhgiGxg13WnF6+eJahUKKGaMr4Db OWPH+NFURLnrHU/uBpNYQKupxhc9vFI+JxVsbj9TNDkwuv3LV2XrKgJQMveCgZs30NQ4KKQ8 ExBESvRA4ZM8gi/c4T2yUQTqLQViVnje+N7CNdvrv6CQlrFSxngy1XrvBZft84phmz/TJMfc qkgd6d+mP+Y2DLPSYT7l4imu/UWBb0SgPUD68H7EfJ38oprB2YZFiFqIcAkjNMNtA5zzLZmd w8Hb85Pdd6vidwBeu99wdhtS+4v5miUEKv37LgFiByhRfaIYlbPo2DbmPDulVi9ES2SMZwrR Dm6tzW06Zkmxn31qKcrG0JUUyk+cXdP870wW4s9GqZvyo39qO90KIMbIl8HFECucyZkUMzDU AEgt3o5Vrw24+zp7r3qyExBXkcnSWFLvYGWyk+qnk4rcbJzKneClcTQXTPfpjqx0HKMWc/CY JeVY0vZ3VwoJSIAFPtT5Lq50GhlMuifnrqdxN0AtKwyiACmGYuynsi6NTo6r8DSDGNW2DNWO MbW5efX++tZGSDVkWaKMQuQD8l2kQd+RO9TosqwSfbQDZqkdPHYmpoMrho7EmSPVDUqbf3Hw 8Y3/vTyTwo4FPICBvAj+h2j1kxmoAo4z8IoaIVpohaeiRVPol9IGSSWwum2hnet9H0rLlx63 keq9DdByiY//tExYzTch0OZIQ1D/UFdCkFno4QwUHJQQC8CDMC21vYAfgRdwCOzy290PhUcL 0d7c9AEkDxKsxl6MJ51/WRJo5IHCLNkQZxRPSKtP+RAIm7xL6x5VoS9k62/jxzL/Vniu38t0 pbRE6SKlz2f/7YAX+r0cGbL/GWnwE/lQ9uJLoie7QObdzb0vG3kb1eLrXqG1X2tjgjxPj1mW 4ya7H3yZM4f5tyUrNfCPbOcRsIfOFduexAWkwXwMHpBbnktJg3LoFmEvbqQ09wHp03z+AG+I wSvJqyMDYruusuC+xSmdN5Di35JQAw2MB2CsJifK6DFnuis/7WuDFW7n/WxVqlqIqK3cfrad RKUQJwDPT1ElTr9I8iDjnv5hdnnPV3gGJnSy7p2JDup0+yuqPAw8N7PZzkxkEn21fO7D+7q+ TkuIUbh2xZVIYKGfqs56T93jKCmb/f3V9P6J7kbPbVaFWf9oizANC/HIPTVGX2KMn5f19e41 htVTZPaJh20w94XWPAr9o7FcmMxV1dq2Cs/rJ4tXaC/cVpeso+Z9/c1kwKaU5X6kMEHKtpAB q+jt9Jlcc7EQHMuXQ5/Qv/g8OG+O57Fao8Df1Rh+H8flvQ9iu++2PTnIhfigmQIUEAiEAci9 Wa7PNLzU+Pyzq1a8lSH2lfUGbrw+gdr1LMSYjpDMI7ubxZCqEhZyfGuJM2cEtt86zX49RFu4 5Z8VH/jZjefUk8ya8S+ZnL3t6hwTuqwuMnCPiH8V7ZRFMmkr0FqVugo56tde8Aq6GoQ4HpL/ 5Jbmkw0refVLYslUU3LIusSMVngJonyuqUB13Sz9OPvLvWhnzBU5zsjP1bEV7PaygdTL5cPL iL4MU4Mu85gzDDBgbYH2YsdD7DXbDpx/rPZCgMav/t1+MeQ/6iAuHavH5DgrlMsdd8ggzozu x6OUJlOTGy4savnSTrjJU7BtRYzZ1bwwP6RWogzbCwox7bZ70sTIZKKCiDN8i07kH6MvwVdS zQ7cyv/67pwgwtsyu/Jxd3B5QU/Bm1/zfnBGKYlCJAi1JZIrPGPAYekjOqx0/J99hWYH9nIZ gpd+6CEggXpyghBLUgXWE7tghoJHnyLosq6vMfBTRaK6SNfSRAtR/DNFiW7aBM1Ok7ZPcKZj pvkcvyXp/ejQ344IVHXpN+PV6uPEmeGqgPWf9rECYm84+Qa9HwezET2PvXm3Pg1l+L9tTl/m 0YOBZtxdRllHzyM/PLZCemUvnbBWF1nFKseT9ACj7xcCeefKYWGiWOxlCcNvht/0eYTESRFV Mcds9sv9vv0bdQbMxrYVP/6989HP8fs9cktMW4FuJskkjmRzgeGEPjO+FFqvJHHpgLIzn2jr 22qYDWhaz3ekLyEwlPvBpB4oBwbKwdAzhGjM4/E/tQd7nyxSANnF0CkhVCu/SQ2tVK9gKy1y 7xm5UQ25YFFbpO5OFB81wWoZXKvGfGsezjWyvmSLO/CL6FbtDB5KOC9kv/j7hf5Kzzz/wWPw b28FlKgP5UaRP4bzwfYYedkqDv1nhafz6lc8v2gk7sIiLyaBo9YtESEmGQy0Uy9YjqEh91Du achDatcD+KOih9Igjd9bi505MHTgac0RKKvV2FOM8Hu3pNNqoWMIRr9jEww+cMt5pCYgzHKg fEzppyYTJsb/ugds9uR9CicD5cby+dlR3+XUs2qy02p8Apa0sijlp9LDLuhU08fxJ/L38lec SoVd1oC0NOh7/+ndfzm3aPSItycPde9LRIg82tUUwkC1huP0amA+zLcILd/CAfTTIxUXH66m rZ9VPom0m2Tf/xBYz3qp6j33tLqXT/6AU6oq7S3cjF/kOpjjhXKfgEKajVg+bg8q0cg5YWp0 33RS6rxsUras8vkMgjWPOWX5bfIts62rEIlbsydEv/Xy+v0siopXreO1Zz7KhtnThKHzubLo 5GCAzOWTs7KmzTHFDcF7IxVFCxc8FB5CIUq2nKyhj+uzfcslH9dmh49TNYip3fWb5121foTk H7m/31Q44zAkSO1cVFv+KhAD8kxvSkSISshGNV/nJ84IwVsOf3pMc3FVK/rzdP5twnmhUdv5 4erahf6P65Mp67P7RRvt+F0iNqLOfXhpft/kEPyi+Jmi128YeGtI8ehpefFYq0dY3Lv8AfvP faHI92+WH+vt4z3AFOjZ3dkIw2/nYy82aVry1A/ru7LXjqT9cTNw2v8y4VBJ/110cpMQTSnr SS4b7Ec5vLPvQZqVUAnFy+4lhPn/vjr8XT0sZFlCGTzYhBCF1DP+BLxZnHwAOIKQ0Boa1brK 6xe015C+E+Sz4/YwvuqN8MEVdO/H7AhRmrPEG1FHWeVLITYZh96/me/VGNl/yQZ6q1HDMuzJ z7FnO1tBGp23zZSpGalyOnwvzU6KrFKIlJNr0mjku5acymSSIHVI/yoEKyWa9nrgvftIqh5M KOzEmIrHOM/NfeEHL4v+NVqUiKTM95CKsJ4mSEkOILvklogBQ/rLTMWm1gSt6MQM7CxHjpgk /vgyRcoP034o/1AUwmM8u/ZWk4Qds2fzHC9uQywhJimPQmFwYg6mg10eJ9/VDVeCsXVF083u l4XA5dIEjtmPRUeZFp08eoicdmdyIrLCyXUO9mEfuHZWRPWgvYSFhadE3kvKYJiwn0qz2v+x aO3xTH//353MZS7bKLctd3MXI+Qycs9lNMwlJCLmUi5RjDFz25Dccs+lhJXcUi7NrZB7KjRz L7mlki6+6/P7/f8+j/fr+nw9z3k9xzZL3dvivjw4VR5v09xzHLMtJ5Kfk248EiDHJ55CZhIY zC4b/3y45zs41N/LegC9xS+U3K9YDRvs+0U6EiR//kb8WnZCwU5yeXoMHIH26K4gWWhXvRMs nQOkWZ4NQ5IQYfSVYafwe/oxdGqYT6IyTzyX9/vWO2FqcjoXTzNAigHSDfICE0JkJ7ly5Q2A X1Vawn1PngvSNj0WCYSp2je7evFH0/W5uP5L7/qwVx6q+D11qiAKFQbHqCmNPDr7IDcnJq5T f69y5c3mfCf2wTbfKzvjcAl85DRTcvaV1y7TH9KWcdRCzStvSg2ituffPWFKwvT8VOMxvwwt dhIlDSf0P2gBfQFdMXPQiNW7Lf89UiKqz7NB048kdJbsO83loypdknnbT8nqY9iWyChbBlsC ogkyzASJE81gz2PHEJLhUnCtjKefvksJprzGuZr16z6SgUkuPo//Q5SB6bWN3SvjBh+G8qs0 zyADrBpZQz4wy9J0CdSfX79+hawUlZWdU0XX7ZDlC7gB5OKT85jLZ514x/z/if8CS93X1x4E bY53PKmFquQBOJRj1BHMaZZvw9wa2Ajt0Xt0Gcwh9tKtv2LXMlw0B5cPZ+zMrPtdGeT826lZ FpQzH6/y7p/urqOWcMfHB45O8LHT2IpPZGMuT56LZrJjb5II1ndVvF50NTcn3GYewP/8emUP drGMC1I5M5IRc1u1d9Q5UAnXUmc79yGKhq1EePR5Ci7/PkgrdL19FCbgmwtumsh2+orYme+k 2MBVPApqO6Qgg8B7ff0Bd7b0AuSG2AhodDtdhRR2Ak1IO8F7KiolJTORe25K9Ny3T38/T6Vi TwsGMcc57Ld+cfLIy7Ac1gUD7qqYyNsbwpDXMaq1am/uFZelFrbzwBo9PaY/f5pRwrEr2ywC TVnBD4sYZTutOKZ1KVsOJgLZq5zb8ZsfrHXUpabINYMLMFHXlzSOP5dN/Vmz9BQs2vXHWcBV PJ+1Sr99GpSeftHb2yhnpzTpeX2LZRpqSMLvzHuiSWwonj6yPvuT72YI0cLWYZ90v78b4Rx1 DTtZucIG2EI2eqzCTBW8faHqin9fx9e1Z7Eb+wQGxsT8PPr2+TAqcPM9zIuZpGVmelLSAnLh RMikC0Kx052mSgONpdYJWVICVKxKI9O4vtduZB0cUNzSi9/ebVJ+cIGWNeUxn+JoO84ocyDh VDiZxzsRchjXOM6XdF3G7lrjDcWrPiV4BdjXKRRsf5tXWO4luIe+eO+DToWuOASi6v1mOP2D /YMT2dTMYp3QRTo+W0cYIJL+9Yoz2juIaEtAnSJzS37A4H2cbDz84XFpFv9eyWs1L8zI6bWp 9NK3v7irQayFAXPXNSR6y9m+i11sNLIZt2JKc2/7w65GYKdy5bEnm80li4B6f11Gj6eO9M13 8k9qvdYlgwLsCgA/j2+D3C8gpf34reLrLeZZBBmdNfN5TNwo+crL9nG8FHpbAzfqwiZfBLrC QDfk2uyfO2OPnORw7f0v7/z6EaAyxC6W1t2+jHZRMoZtLzx783nx+TNvwoUbDhOa5mYsptEW vg52c6ZpFv3zel4wjb1Kv7Uwc7gEoYPm6Jta8exCMKJkGYtsaAd4c4HVwFiozZqeYe0Mq78S i1A0jVJQIUi+IFkYDEWXV/MU5a7Rx67NJRTrJKQE69SphAql/fpx0UWCFnu4Cz234aRgD2ky Cpl13DsDW3zofE0wewQd3f+uUl6X19+2XF7X21gVlq7sjS3ufc5RnQwzlpD4CfBGpJ5WqbZg r0KH5zQ6mzwsJIqla11VH434PO1Gw4gnAgoA4cxJzDPlEIkJK6YTTHuHe0IdEuduVTMZlz5o TniEIEeTbE953GKvQ3soLNb/wGZrBpF91A1O3DQcsOz/ObhTdu7PWsmQEptKKQCCCSUxG9e/ yrnFyqiS2u3YfTYMLdC+Fgt923wisJql7T7d/1GRakwgeRABkIFFWDpoWCNl33OkouPijv9+ +fC2yStWpZlWKSZByADCEqgMOMUa3P5bIlmKAzwAlpZZ5ESTucvSZVp9rps6OJZcYxx+y3G+ wcxHheo5Lpic7pmE1L/992E3E0dzAsXISMux4iYwSq8G1WC8uKYIKfYR0JR01DfMlIGVuEf9 fEXP2cnKEy9zDKtEoIjMf1fPrCRp1Bv2dxG6//7+mv3xNFgNEnmaRn/nBO/sppqTCBBVz65k g5jEWoRXlcqKHsDqtwRyzMZBruWSwcPk2YZPLylUM3909WRlHaL2coh4MzAM6o7CQr0JxeUP sdomCdEykGF7uMgP+ghZTxHrd/TlqqGYdV3dR4JNNv1gAIYGEAHbZsBOKQjmezSZa3f3vRf3 mGYNS1BKey2LQKhsCAwS9FVWV8PjS6rvCbBD2OxdgtiEIDk9V0VgD20UEa4KwwB5coy9evml WPS7er+Bp7t62/onvLthnLtpj9QUBXmI/AZglQHXJoSSFXJgIdqBYWHFGv3P2ZM8rjHfIFrA vpcf2nawzDxP5fQdvpqZX1WK5sM1FC/AJSI2QS2ghwYtohtD1WYOYXauaVwU+1HL68Y3jZOg 5olrzJBzN3/wed21rnPwJTsmRgBLqyXnBsVCbZt2K0adJan7mP9eX7/Ndw6GxxH90j+5JUBD kH5euVcBPtDKXAyXyFVQMiczPemZUUodf7KJr6rhHPd9+jgzODuRqN/S8f4lyODfoj2fgCmc r/a7OzQsrvicS/t0C4QpyS8ZUEZPj90722OSwa6nZYghG3C9XyU8QiTT1av6TO2PNu6bmaYN VVQj/XzMhgXSkwE4aMC44dDyx9/9TUKAu3N3HRNdC87DQIaEy6em8nizzTqQfp9RdwjRcKQH QbKityeL7aagJ461uxLS/cluSnrBKZh9zFgFCgGgLCCGos9DjBvyUnYRuWCnBgQovTvMxXym nuGRBFvc7y1V/RvoHrzFF40q9OuhJilQSc3v9GQlrZaOTxExrDx7xv80pPNtxyRhmbIpkVo7 K5d+3bGO63DBpeaVHvbeBCoBci4Kcie1lJJfZ5Slwz+pTACdqItDpfcf5BF2UQbeS+0JvUA1 /RPyidchL1jg3nB5+LTLhk2amdahgdKJWMOWtJJTd3+ELhHF+BwnotKGCtZmFcCLmARAmHSk zLDZxz7r7wpX4fI6f7auj5xnB1mM547LtkmdpE7a6eRH5DqRV8Nuff6PLcrqtqn4QENWQnFL Q/bCK17HZ0QEbKcUHHpPT3VKgf9GCG+PPPirJQIYY69zLhFSssofA/MxLhszEO6UcCMkXWa2 Etn/6JR1OClrvIad4rZU+m/VJneWcXffxVR7E47Y+PMq/lbyJlIIC7ORY0OPPpf3mRQ/isZe eDBQ+Ri58thGoENztuM6OzwPEKqhz7t0ujmh5XDkauKG8TZCEU6YKQU4TtiF2fmH3HsJKwAs kAk6Cn9ZEVRG8KVR86aQi9JfPbmM4V88l3Do/AinTKtymEX6DSdkqdwfO3NXGJ1yqMNuqv2w lPtd1ycV/IDJimwwfstG0sBe8ZUxvFv9acOolYoGHOXW0C/cFBeysIcKy7oeIq5hssp2RqxK kQ10PEnJq0N3rJsUg6kPMH/eq7p49yqQ3OL1fnZcFwX7VbFw/XQkc5cmlSv5luNEF3l8KpJK V+enJ2ndxoqK6Tnq6ZcHGxeEytw54Y43l+DnvU3PrddOuNhf9J6Frq3Spf4MhHP5dNjAr0X6 GsMvGK2ez+5vAcsAwCBvhCELY6aMJSEVsQjZilEfoJKyHPWjV4yXy0+Ipu+Sb0m8sIwvRC1H UCAVHzdkb3GugsW2zuic8hy3WBIa+NCrUxP+qrcB0RaiIQNTAMm87FUl8YVBryqJNJE4Grco +RwUE9n8Nx2UPoqs31XKkOB3u1Ky07c9uS1nb/LteiK3gdhDgI/rElqI/8jA0UFohNsJOSlI Dnvz6LVo3WGDt5Kaeo94oQsbxUe3gp1SNLGLPoAL6A6KXGkwFH8738kNfKw640DmoMDXawoT iTscvgI+JUGiI+/bY6xnP930ifiswfGqbAXVdaXYLpYkjblUiAY9XPxq/f8CB9Ef850aXO8u WuA/Jv1OwcB5o4NUml5TJ8P7SBFV4mhloYecIk/RIzi6TZ0RUaJ+CIfux5ptpV3G+46iowMd LsIeQ8Rpcq6wnHcpdDmT/o+CjA41bBFNQgfqVoCyzuSS4t/6TjiFuQjLZPuGeJCTD77CQGDq q/wbpAsako7FzVGVDmGfhiomBhFO0rsI+96kg09S+aCsb8PmKWZP6SUr850sJzZrs4jnjiPr 0VBMmNKbjnf3wFmu7ZXick/RfsQIhoOOfPuDVnj+6FQpl5ONzX2UGzx5/0Q69+i/L9+eme+U u/ASWyjACKeDheHDKlxmiL1dgK7O6tPtXVC2mVteVyODsAzJychJVfOvilElC8N93USpj/so fNJ+F/4T6tgIfR9gcCgzaAy8xqQeu8SdrC2zznF/0M0uAO/7Ti/qt/S/Tab22KNTfyzm2fAr lxKJ4e193IN6PvZxscrgwL7FvRw6z6QPNTdHCEw3vQMaNYYriSk1Rt5987yl7mIJ53/CLR+j dwi9LTMwvcqI3WpQGiOgQcnpo5Aicp/+ajvouoH1G6g07VtsX5s1E+k7fR7PgEDCTEnEywmp oAbXiLMS80804PLKNUEhHt5QQ3tFez0XHp87gEFGVQgBhnOt0diGzodiRbiO62SO4yGnCuca hhFBsyUNkXdTHdzUOOWCkdohV+UFRNfn9fhND9G2+NX5SNeDxTeM21pMGqEWZ19uYcGymOMB NW4g9lE8XBCzN/c+l5H/bUc1i91/rG/UEKIlDqoKiHACPrwPjViLCKnGt4GyZppi3+z804g7 OuRhXGGOC1O6Xq+gt2r4qqGY/6vadfrbcxX/xOAtD5Ar3061Op66ovawiFtJ7KHXwq3u5ftm y/N692A4t4SgxtqIkyNHGaWptx9bOshrilXGDC0q2i9FhIj8y9etuy82r0ukN564Wd8yPgKv oHfDf72eDY8uQyi+WiIWbZ9n2NyyO/rxdZxF+vKU+6Sm9YCZtKGf2IBJvfzq/LyqcNb90aJr dPRX+tvbOv/WSYUHo8nPq49QV8pSWAUOge9SM96jp+0ZeWEE/A8s6thOGTy8F0gCU0bs4y0s sVkj+JbXHQptu62CFdsWNJCn24GeIe+TC0936E+8wmIVle85Y7PcQidRfsbwzTx/vG/8o5h0 SAz8FVFopvaWkahbPZ6Po6jgjvZcBE7os/lzXX18YVcugqRPWH0mScG38fs424q9lJyja885 7Z8l/STVIeJTDe6ANVwMlJyPv60+9IZXPha5A3BwnQBSc/rUi5XvqH6RKruMriY6VeNv9Ca2 YA2pvAJkHrG83A77/GDTaZcMKtoP1YyUX5lHA3aMZ18sPb2DDqbtBRYg8fFc8Vw+rmEPYlFg yxEfpIq0/VISWtVL/65DDeUXmdHa8DDJjzBQ4KmSne63a88Dgim+tUGDw/FcxAtNcBVL1qTz GdgXVuYY2b1RJB/Pl4qqSkXC5dGiX+h9bdU9dLKgQBku9wgIKmH3VVeBVKLycIzudihA+I8W fYDfbFpn8yXX0MZTsZKVtm5VlITH7cc0AZYSVdxixjOSwPDoVcWCCF+873Nw2/EOpBlriHTX 2+G7BjFzVcu7/wQGpNkc+PO48oyGJuvAhA0xe/WPsSM6QYuBjP/Xlh++spJ01AB38rrOfo/V 570knvARn1HE/fbPEPcgMUin7w1ggH4WVFJPGV8mWQMe6BRjLA5VDVs47YIdL6J+dFhGhMzN iQcef3wUxotWJsyc02EG6JRl4Jwy8CGm1cEbB67Vl9MWI1WoOya/Bd7VVRZnojDmAVOyWd+6 922beFB1tAN2WIar1PboE6eZ4rtNhwfFtZHQjmYRXVDgEvraWCY469Fea+VmU+vOt3ZWPsC7 e1eTNTOADs91B185nXCdb199MK2U3G+hDR1zQS+hs8+I/W1LogxhuE67PutTYYsBFzaPPwGO fhS7LGZdz0DDpabYpigeFAFQMQ8/AYB8G1jMW99cJeDfLIoVvToIXfn3jedDxNYOpP6wVCbF Uird+ZNzuNDwYpnh6fq7d6DHGeboHiWZJSL/mfiQV7o62qkh3haxDtA/rm9Ko4pJzxw9RbJM zG3N/oMblUq5fMYwe7KWqC7fZVxOPwUufcBpec2s3EQHasWuAx2ZOvVlFmVjVhrxNUgjbGR9 nuHBJUvO4zz7XZrWWejryuKtVRv3pdYafslnYunqDntRTmOje1Wp/FtTNgzMPCXGccwnQfTp J20ZryTA34LGkjImXKRR6LFMr9aJWyPlQE5HvhhJg5QXsYbtuqKKOSXFi3jfjwVzYjxFTGYh ivJKrSFvlkFDg1Z2toNC+7PKQx+ddXWsLy4kHJhupT2NGGxVLp5PiPx8S0tEqOiv5CBN9hrA b8y+IAtOsY3Sb8XxACwH6WMHUxs/pBS1z90+OqwYX1/b/90xJZcFKj7jvjSXYCMvDCwyvnok Tigu/GJSDNNWxZjneGZEX1xfOKRNNRuC+0C3+O69oT72H00StN87mo+X/kKat3hs4mABt7tg jZcmnqmc85egfpppiJniKCu7gvcFPVzYt3a2L68qTXnm7Gxhy5Vts6BOuDCgeK8wS7bV0mlJ kxLZKrw+fgaUhd8iNjUg62Q43k0lnyALw7RmHIdEuU59ghZDYoobpaUjv/tbcj0JGbiz6iHw DzKDQam/LZPpQZAXPju2ZfR72S0oJ7JMzFlXB65rfM/shq4Zf9JkQLR/HVr4eWoL2qaC1jjd pkTyxqtyXfLTfP3Bhm/Q3MqsA7tVctknU4hbADT06+POs9gI+XBHfdkrvtDiqLzzNXmgk427 QoMN2OA6aelQlxbhIC32dLkNfSaosDGKME0VHaI/VtXKPAtEACMHT3pktX2Vcv43IK1nI+T5 X9vHDeZOMrHnNIsJ65Vlcfpa7L6IedZ6sTegVSpEj0ExeC/P3OyyDJUvGEhX95tkTXsCv0/2 HEa1/9ZfNzKf6DW5ZkbmDpwNFhqMbQgfDIVUYJ93CVlD7dU6PmSajtmavT+vGiVVBSw2xAgA BhWLzhz74X3FofIGBvYOizmOTlL2FR/4m7TWneTnOaorQZ+5HLteLxHj6HOiygKPS4onT0b9 NUnoq31HRfSbmze1shIjf6mXHfErG+S7AUszJlDSPhHCrSzupCOsmSeidZHBCaZoXsA6713F 9AAWbmQTsG7uyQ/ItuW7cWkCt9yZ5cipuaeujjHnJwhPtQnXXx/NH66KjQ2yccse3XRI7KiZ XFjYsTQLTLGt3z5HalbQPdYC3Z8lnr7fx2ikJ2tLRvaxd5OJOfVAh94vnHk1klbnHcJsTUDB HsZOid5t01XprKKb+gQtzCWhQStrXaoqibvM3mFX0iHwqo3mYfYIqr0GHSmlsmx+tiudIhJy 04zB2tN8TdnKPz1StMEnN4Ufh+02Jze1eGguX0Qo8dbA9IAVJtOyVejJiIi6swIX8KAsZ+VV YPearZnNVOR5nxAnt31JMbawJEcnFLu4hR0+AkrEP4EgWd+Wn3CNTid59P7u+sS86YLQRkiU EtuZE+sTpqf/nH+scP0XP+QT2GlPRJx7bn4hzXbHxBseLUhvJ8iaDpFuH1GT7A//kUTeF9+f 7pB0gcFGJlb9A6N7Nhm/+Ee7cdMZNSxuT2zYv34VeQxUgYkcyHUsbbDyq4NcEC7PCkx/mVfV Y41to+JUKrjPgNq2aeiMD45hUleV7G3kB1jQFtKvk8hzPMa+THrTiVpsFDu3pTn7IYv6XQpx ck+Xvx9Th3uAu3J/ukgBJMjA7sIPQJ+lL2bI09/kS7MaB6osGEHgxSfuF/uh1OpNWvxRIItu qxv3w5lwaPanNVUsnfRv7gJgLXALmNaXVNGYHEBjgWxzo5I5HcIPz4MmWT8q/oeJMQ6cf4h3 QfWzBzW4zWfbv+fF7+wzIdvuK4CakCF96LjfmXbJmGi16QDEvYrg6mg2+T7WN8jfIptA+a45 Kpgtc6GQllmKjgrx6M6HZF1r66Mwjw/ZsLfUfLai+S5sMhOoijQjaXRvfH0sCTJXSKRIgfvw rEl+hNFy04rzZKVy8qQD8L6ftA/ZUNDJYaQxulzGxBGhfREu9osvc7JhqOU0VBTEzpkjXq7Z oCC3AVOS0u5P8ubHPVLIZI8b+jXE3gPMrXA5ff/lMnlSIN66WXTPmIW9u6CkwH+J+3XHZvu+ 7QVVh15vfM1VsDgXn/U3LjYfTcc9MRQQ8AZ/kkeRRy+XKxWdRb0RrefH/1lgr7PK5wNdLcw+ 7i/ViaSjIUq9w+VheTSPHrOdKvrxt7SqUlopx7vfWLLByLNULEN9Pv7H4ivWTlLtXDE3WAsS +jGtV0rkQAYlyswXqocMR4lma0eXO2m23t949fqV7yvujLb437t/Fz7oTL5zzI+YurlQXEa2 J6c073dxd6tmorBXuCH7G8O5V3r6IgR6oo+ZL3q/7HVoFh+LRq4uPUrVEdtXd+OPYZNHOVOH /AN63lcpN50JCpGF/mxMqsRyOL6/C/vAMePjo1SnHcYNU0keMGnob1Kd9iScrhguHy0f28XW bQZQTbUCq9RkZFn6d8qoqJ7EITCSKtsm5QijLoI28lr7OyVlPs9/uVTIfZtD8PGZM5zp6vAJ 0FwhPZiHGXAyPTWbmjaOGffsisN/GQpK5XiHxWpNTUy1IZeZZWmGBWFJAsDFxIb55/ERhT5T PxqxqGDS764zsw0dpwSjb6QRK+emRfKR2pf5H/dknDoDppq0sI/gDwUoIlKm40ynIuVh2iwS LeKfXPVE+Xfce5JTTVpq0l2MXOCqOO63z+h3/YS/839sohjq/HFaetLcMoeQqASAwrVuHME5 +o1CJtGYbkvJ8J0XmhD6eSYO25RK4ycVWFIWG/83uI/+Ue8y/xUFQ4t17gBbavM2NAXUv9Yb fxNPHKVE4fFKeuFLwWaBgJyVXzuDEmwVo7m1M/hxNBPAglEnhwIJeyv1czxvOO6nIO4EnBUT X4gHLF/qAv49/H1im9Xe21vGtt/33d2rfrmP+3Sc518NS51rvDMsZd5PqvcOafML3sfyDLA8 IyX0K79hFz8B4hhmOunHesOUhxN+npyF27OIDAxd3itkDPRQJnwB97b1ppEKoYFkHihcbIL/ HLD/7eLsRDVABNQK859XWy6L6RoZixjAGbKh4SrKHqkdQJUNi+0mLlEj1uBqhrv50dIvzL63 qKyQt9xFfjEJ+SiQ8DKngHmZCx0KfEg/9uUFZ3dglY+94vjOkGQSDZvRh9tcUAMfQIn9znsw mklPe8SPbYPslKJMi9Q28d7o8VhCUMU+V2fLlrtVX56DutS/TAsTa7NFG2jBfQ/FYFTuiiQV g2xbUK4gtKqSX/GFYj4nlHjf3alVv5JCQGOAEcYqUqpsPEU8JGatPN45Xgz/pjPui5Q43Y1F wiDe2ke/K/TnYa86NB/n+NWwRZalOFLKzmVr4Un6mZqKmRpbsc8syfptLZq8hV1uWua+5Eth +Wt9YVBveVGdUGbeZmPENHb8IZdEFt+Om+PyxGgbl8zO4nN8RTT7D2OHPayZTf/kDLsYrnnK X0Vp9lboI+2zpxMhfijhBwNdlAT+RJpwUCLXemHE+tp6vycc0xF7new37o/pZo5iSTVBwMRb xEuzqNHRq+RT2SNtaicHogs+zrx6wY7sijeVrVPgwh/xFxBfQzaM1mhGuIZmZYtzRnnBZhUm FhnsTl1QxEyaUXgpQgZTwglREwGWXgR2M53sS+lb2sBGj99AvKXvbbyNBgqQYDb6P+x7bsO9 nnUm9PhjpRBqo/SFVvUvRM5r+LKfwDqait9L2RQ42tcKvoGU0s2WEFKx883mPk8fsmdEFJ8U yfbB4ZJ+J00Ar9C/qQRjXt/beidEEf6xbXR1EoXRz+6RFRtiVgcpKuHmWjIDz6EPw01s12zz zHp8VEfYmxHhkdsi2qflLtxzUbPgyORoGFhlf8+7pzAWCVdWvSjKX6uv9zNfysaY2uRH38wd jJRkweuAClknRPLPeH8hJt28pQh39O2lnto29VbeQBLYR/vJVUzLhycSEuM/FT5pETUynWMS UxCfiGbiPyORtj9ua33lEpHGSQbKSmldUqCdm0YZBWk0D2PbxAqIDT0KhGDjYN/3vNklxJZB 2TiCD8Wpi7CO42BlJBxpOmePyON7Kv50oGq4rf1aOqTmfjzgRpsR7gZLikkF8JjZmdlpyRT9 oa1mgvsOKN9jAg+4gPdHRytizjfYulPdouFUzx7vuv5y1cSJhJlyU6hYs1i56TVOMWs1iUrL Dq+0FzKaEqDJqgROlprHob2p57MlDOOawyXt519c/3qkUdEeuaTfdp/n0iYfshLk6SIC8oge X88hNlxIbOIir4wm4AsAe6ex0mxJfuMBPVfZ/rPVIJMTH3gnNEw9O3yc1R3iyS/R0MB04iQ3 3mdpkj3EyFtRpIEWoxAlFSmlqBQM0ACCXkzw5hzHlDai64SMW39cmM9IAIhk/OG0SClfeicl 3iymJn71bOXeRlrq5ETQR5ZlKIQu+WPjrLd8CMYLV4NujyT/Pa0OGkuk9aAu468ZH73EFQPD oI3HAq1QBfB0CY3le1+isQYb7+XlXYE+aP7LD3zf4L3RB9+V30qvOGhJ1IdemjatlMSxFST8 aOf+YSxvN4XquY14NIyN+mRkE3xjFSdB7QBegU+nyoMfCyW272LkRbREu7dOn3zFQStf5Yrs oUTrT0ez6Zfrx57Mhm+Qt91FtPHk9utCFhgvQVNmW/Xb2/AKROxGwgPuIiKOVV3xqAamDnYM Ptnc44JsxzISvbXIemX/q+djAVqCU4V7WCRieWm37rvy9b4W2EZifDqNWSIkgbB6WYoSjU/B FdEPLHfORbor1uD4qG8zRUFJ9lC52vlUJHw2NIEBjgFqXByYE2YppqzBXGLlL99lWelX7skf 5ustC/xQ7m2TUkwBaKycJLXHXl7av6wWtmgaRqBwS0eddfofO98V1VTXrY30EoEQBCkiJVQp gQRMEOklgdBRRGoooVjoCkrvoTchiaF3UXgFFRCQ3hOQogiv0rtY6ITm4T0X39V3cc7F+cd/ 8V3tOZ4x9lpzrf08c86LPZ4i9phR1oxL5zLs1/MR8ZK9PMh6J2Hl618Zdh+d4JBsQKGWitN1 D3jYfhBclXQP91nnmcFAUMBvua9T2++f7LFmFObBw39uEizfcCcEJv1xoh8isLadn1aVVsTU tOp3r/ZrMwquNeEL2wWdfs7nWtVa9VpdIgFBatN8aQCOGDVNg68NE0c83RO8PMjusqRU3HiF iaAkN+DWJpWlKrhYplCZErlLpxOUYibyBNQr2hVlC3yRFPh93cAJQsOIjsvUCqeNj6qOY/dW i1u2vczdFbv2pYeNdwUj4SRpMm5GvnITLTUR7lre+azk+UvmpG9nWjCeC2xborMlHTif+Q4z JUF+Jzp2Bt455gArfo40g4EGn78tvjZwx3rygLpwbDU7NLS6NDhLyW4zwfJjYW6A04MVRrDi JR9hfb2nlzuhIJf5v9L/ig0CjujR0J1rIaheJEdnvf/375qeaxwZQj9CkxjR0ZAyb4yuvUIY rahJPj1XX+qYWZBU1J+PjeV41qxLmKLmm5Vd2k1mkM9nSMicUaWSSnoKDVNe4hhw63dNWdnW 2mtvXy2OQY4mmm7coqbzzzUgxvkqjEE2VrODhqdo7p3VMaHd6gtPqQAw5J1F0VinLZsy7xzt c6tVVKEi98W6Ih9d1TXrxKCAPTkmduYrIk5EppvgYnYmuhtRoT+/fjUXnsd/EShsP9M5Ybou PGN1+dK3jMrOKKJl858h+U+RIqI6HznrReJK0Aap8VJphUbVMZ68s0qSvAeNBpr06RG/vhyw EQ5RcrGJrNBLpxizkFtYOQ95Nd7sPIBj5UAE1NdDSjD1fOwETAYJr2Uc8SRatrL/YzcYQU84 DD74aZ/ggDE1PL8MiKW53fJwweodXfk5JL4ht0grnmuu0No3rMxVzSp4qbekxXsgxpNr12cr 4KrirdXOv1SD4RFi+NC2k7rcR9oAPcbz/vSC9Vsk/uUaIOZDO2a+m8HUrLWDEyLI56zcXVQ5 7YGLv3/X9e/iMbrn01GQV9tynt3ZWhzz0bC5zguAhMNgjhCmvL79B3+/uz9Fb6xl1NGSqHvr fDEQyweyC7AR2VHYn3Bbxz7RX0ZczWJR0W42Ku9VMzMgQZjLSTSIgyM2i4iVYZzraIP5AM85 ZeVaSUOZq+ylu2DeZKHWeA/1Ti70iEewqb9nkVdEO71wxydTWy5Wc/40/lwqH07Dku3ATnAl Eo24wIxfUMPCbmVuaV3Wg205ri2ks9CPELYR26/iFq6Syd2pP35f6YxZIwsmOsmgb++yxYTb 0+obxi154T4nxImNmXdGP9ST7+yoDM7a8mjyLtr1ye3uj0l4YHsT9Fso2QF1aLhgzcpgHGs+ b/04PU2ajwFGAqRYWKENYrfM7Pljqu7bPpnviDiv4aOF8boTfJe7yhxFgLYq3jP0N4rQQVKN 0spSjFqFK2/5+A7pe0XbJnx2e6Nfp6pi7k5/zgkxSsZvw+SbwP0moioPwCBnKfBwyrf46Khm C+gl5e83PuYm+WSvM9eJgYQejiy4XFGfMe8uee5trnuooPDwMcaWhiudU0/rV4ectJyesww5 EhCj2ZVk+xG45eOgp7GW865U7Whfjv+Y011nKOpVipKWTgfFgDGWkBinfGWmwTAAMBU0Ycix ajvGwUpPpqe1HtQV58bKxDWctM54TgRZUXkeZ5suzsnH6B7q/lTrDm43q/zIbSyS01m49jZb 7DBMQPVoV66umpIST997osEuqEaBAlvitTFWyU4dza1uAmovDuRMgrNL4+nVDk1T4xtE/+Jk pafQh8a70KqOF669e+QS9EhSjRjrqbgGZC4K9OE9aNUt7o6xSVSUfbR6dRSXKuu80fC27ss2 R66D/AgtJdrhCPwJ9DXtiU6RGf7FWstDlydaf4KyQ43oxdUX6idWsvEQqd43vXQneJN/kq9p q4hM2/MbAXOZmHkgQRoPIxw/O6iu3PiIS/3a4PoSXOCKhK9izJKD7eN3F+Mi43+n38E5SQIS RV6Ndc+UxxiEcUkWUJcVwtEFgrOezuHJp3Mis5GN5Wfm7xduXj3mnV9MD1d82uzZSDdw9D7+ Znq/A+RieOQpe0kz3ZRzw7FrQFty686bb5G3ddF/KzxoG7nzSzMy4/XZ/WPM/1sr4H+A9lwf prOrO2sruf/OqPkf8+X/jpSuQ1X+BUOv/xujZij8f2PUjID/y6hZURH+f27U/FHxAg0NTWfh nukDwNUETUx7xAU6RsBliNN/gv9Z8FvoMqie5sK/4ch/f/d/IihU8V+gosq/YYjiP7T5nzIE CoX+iyEwZej/vZV3sA53H0+PI7q4l+HgUoa9Lr0WD5D+ks1Xn9mGy8bbpxqdN1ZnbD99o8Pf gN7U5rgVTh9SW15x3Ic4mHlR8/No9o+FET1XpK4wEPm/eGwI/zZqepXq/TCpZnnseH50OmqS h/c1NfaXdO2DMwZbknHgn1XikGzabI7BC2rvRnE1Yuck8MGTrbacUZWbfmfV94ZfZP4h11T4 NCmfhN2r+ST46rfxFItVpuPP0sVnrpO88i2IEI3DgMOozWuLNkvDL/3aepMSJsV5iXRbT5vk HrtSyw9bt9AyfRCST2OUD6rlg08To693EyWV/0OM4+UPaiQ0vCnx9M14Q/V8rLRh0wKzr+OH H7UNyxotCkKWH7QSBhum+b5QrZKL82vyn7KX2V2ptVS4C59oPy6Zub0TjCgXynfkDubxuZ2O lRuKyMwdvKcCMPylWW/M4dK3NE9VRpA+lRPcCdS/kYN6i0d0ndGUBh8pwVupQsGMgTImN18l evqDcry8n5X6grt0bG58RQ6py4cDI19oRqvhQOEjG2Pc+CdHxEcwK1ZDcT4Il5PBTkq8eQ0T B1flb24Sdp+WYoiCunjy8NpwlaVbpUcuAN+VGMMQ7UBq9GWLC4b5cVAFE0SDzGgyxF/21jPO i3mvvACcaZ43ZpD1I4OztH1iFqNSewO/USTiJGXjVjSfzU9gmnudVba2RU/QJp5WDfPDNVQu BM3ht3k5g9Xs7owPdgFWYZ0sYWpNi00V143avHiLSxwlYzDHGVZB9PSjF8ShUdlq0qZz3L6G BLAncjixwvpKAROeISchJ+FZlAVKpteywsToxnjQOB1JVa8cLKPGIOlcoTssSjHsIN9xPqkU SquLkYncPvTN5E51Csr5YbdorJ62SCODYzXtB8Gj4TZdUJ+VTuytUkJHzFt4kCuPdRJTtjDO SFIfopb2WfqHdquxRi/dHBxOpGEw7c+CJ8FKRqvBxqRrLllEtb7MDgsrVCY3GPHoEZcT7989 +sSQzPi1TbD5bzWdUFYTYAWjySg2Hxubzec0tqSVGy9tdNnOLKo0yiru27dvN1NUQnLCY2vk 6WSOuEkyw0jLlGHLroJmUQhlWQsfnNNHa5gZI9ShKby/v688/uTpVjxnKT1r5NjP7mD0y/xR wNjL1BF/+drRsjo1OnMZVAR38ukp3f3oFBjVNVzjjEeXNYXVdOFlkfSnG/5mZaVVEGm0ctOS 0BOSbEYAQBy1vwdcnBN/I/JmaO96GKBASLDbV9MqSJ+k92DaDOmxIFg9vyNIbuWHmDus2Dg0 aj4+2NdKj6ZBxXV1dVnzPziUTaUpFWbF7Vvk88onTPrDEGYGoa5jLznR/KhY6QvQOjUG+855 e96nTypRDKhEMTHrUX0Bz5O5fubUC8X0hqH7u+2beauYvbvEtqzyoxauwZdACXTYmpkB0032 nNVhOrfrZuwAs0waluSSEhcXl8kaewHv0nn/w901qXQuqSB2AI37QU/N8M5qMtagr0hH0Oa2 KZHRUhTLXd5jhGGJ1snW5hKOBAIkJWpKjD/PHr7GsQheQBrQjXRcwF9ZIHsI9cLtk4VKbYAF 7hA+RUXh3AjppnhZkaGzC1oI2n92zcqytBwfH4emvFlfr6qqGkAJi5ttl6ph9vMffrSqsI3k LmMpsGYpX9pODwVTSWqxQdKyIkaHT5c2vlxGZYoJz+Ddmm28F+Mffm1fjQzIVOvrpV8t60Du TKCkr5fAlBluMZaXFaDxEETczf6bE8vtcx/dCgWvsIE7tlYoTU1NVCrVNlAlxFWooCUYhKQz NV9dFrlzZVqXR7uVhXi5fHztGD6L6TG/pJQOIBOG6NDMWRIaT2t2Onvax8xMdDJoUIlsbEkp b2NjbRsiJoK08yHH/ZfKgre0KyRELn9zMgwEq9fyoEuv4vCiaKKg7HHVUHXJZK+kBMa7kCTW 39Pzd8Ovwm+vGrZ0GrwV5M9v2yI/C7TIKem5L8ameB875vrKs8dc+cUjGWgMuvz8FPbfWk8T cju3j8Dmw5QMMHymtfnNm4DajLiRb61sxUtVcMnaNEcxY9cih8unX21uPyfAXj2spUejViI8 5d1l3LthGHapIdz3dHGr4O+fF0SRUYvb29uDg16nD9wYClqYCh//lJVnNUmAjm0OlQ4MUMy8 lDxuM5fHkNf8UvCi5KJ5YNDJEbcbIpytmDtzqfHdo7aMd+/evWct7gTBV1ex3lKUDAz/TeS4 xcezU9VSMJk1efgWIaZKr7yxRZisiGGxkdd8NrE0KINQD/py52nESM0r7cKDnO5N/+veZM3n Ls4Bz1bWLd+q10qgAxG9GVJJnIpAyIDfEaONRY4wSzYNdW10sXe6xIDjqjrN8KdlN/zpPq1o hQcIFg1TfKEWJrviT9G8ZI6VglahY8glfWt+qOUEPITavQRTM0nSyblWPQHWrKnVwDy9a5pl +rJWI+yEGf5LJ49b0qNzPQs0qW+QHo0mSpomjLwdm2hK9fpi52R4hsF0i47bpdYhYxF0OR+X x27yk6QubK+Pu98f+e65jaswLVCz4SVBnhZ66l/lB0gnqLt/Gx5IlenMPulKx/FhfBGWiBgE Q86OK8qGMbv9sPj1/slUfQJooVQlIxZbLmycbUCMuuPl5VvKl1Dvc8u83Epf5E8hJFH+KrZb t51k8FMxx0wcxpKp4PjBq7Q1hLoQ+9suHFDLZry0+/w6Plo/DlrAG4W95SVWPaVM4NUub7SL DWaTnd865lj7XaGJyqx1bKtqaw073bgUpB6vOh84FjPOC1Rx51QmRLFqjcetKqnWJivpuOni AQTi0LpfqR/rzv63p0O9mVJaXIKzH0KtvZ8e8xSImc7BiEMHPzvXRClz/uR7dXBWt6fI1Rvh PvKDZCclVxnyh0ijLjGXxaxx8hIEsbjs8kzcnGvp+EhAnSG/NnbFUjX0wSVM1hgpH1ZQ/3Cy 0NOl0LDzTWQwgNC/vOAHXBmcPo1Pm/Tcsq6lXz7m8Lj6/d5J/9MO6salV+zEg8nbusTMqBp2 jp4F5HgTuROlWounMGDJGi+/9JwXb46rrzREhiatxM3CTg6rzva3SuZDjImmn6/ebKkdKx0h jDAdu4UIDe3Dva1Q+Nt1B/v1zta5Ys41L0Woujm6LOkF370Ps+dC2KqzJDLTkZahNVpZOz54 xJii2SXMz2/XGsLhZx2CN/oyBc+SjdHD5GEFZDd3VrX8LGh5dcSR37NAA7T6VHd4UsGxclSa Ehu8sqPIHgWZ6qA+So288/ZXAx+FVdoSM+ikNKRh3SeRPpQRFgXJ6Jv3rQMPavw52bkXerHg cJsB/kyiLh2VJb0msbH/uvolTJluICLzbcbFyBd0oBKUDLQ62actisoUO/pVrjHkVh0HXflr sGHUSXV+LwezSZG0fq7gm0TugHupWqBnEkrppf5VKTKsULQ/0q1bgOcyPs2hObXTY17lu2i2 3ohDS8ipfiBLDu22bejFpUjQAowoaozSauA1E2RB5/y4LeBZNMBHSSSz38sjXIzodLLIQuhI JJ2XsGw9BQ+/85b256haPf2zADxlpbmhXyuBiNQS8UiF5sUrmn3wqgWjCSvp1AaaHQknUdc6 h/DUBOlOgGzb5DmVLIkyFGuFAo3QbTz1ZFgUmt6e/Ba4mnKfq2YaUqbEL1BA1DobTWfJhTon QoqMmH8cH7R9fzDbJmDMf5oH3pWU+gqEESLhjAvdGZ/1Ld42ANHotm+6ZywiIHl3idwglpy9 zOyz0oFGFN57tn2V1t/GSTSv4RJagOY1ubtf8BkwE7HDoS3hh7D/JyXwUPjGg8PkjycgBHOP hJO6wcclYeRYsG1H9t8tJAo33gIrg14pWM0cIoSl9+vl7hXrhhexeCoV0a3cozd2LQRIsFFm HvLRYvTrxxT9oXjBP0glXvyGny6aGXT/7FUti3FWOYNxJC4gdXot7tYPPnKqjGQhjaV+Fh7r TqmBvB3MPhGTd9+uer7c9seCiNSWTQN7+CGp3V4l+1EDZYr80IsSjJqVU79kMTnREGXCvf77 yWWj3PgCQuQdzzoV56IBkfRkyUCfmsdPrz2n2EPk/mQD/MU7Xio4GXpvUfXdJPB75VfH0JAd RejUCdPBnh/oijT2LCLr+x9DiD0+JI8LfVXyXGrjsQOT0h27vn57/4H/A/8H/v8ElnPav2jH /+HJj6OJza+deWXP3jKlFag93drY+8eeJ/Rse3Wy7UPon+Nf4WfUhrP9EY3wP6enfzs6/jnZ pi7GP/Z2bHuytTmwyHTvmtFjnpWHaPurzaohnoUNzd9PpsYl067eGPNdm7t6fPDj9LTB8WCT usw7uXffXRJD/e7d9utbw5/2Dp0rBql58OCj++7WDR0kFTyHLc2OpRx5qur7JHO9KSafE8/E jb3kcVbcmQxJE7rhu0FGRCJ03c7s8ONA7GrTeMU25BbxhtXzCI8HI/k3uVdmTsMF4UGNYu2b 6wKX39exkA/Ep9UsV3TeUmUxDnz8a9/XN9QeM0LSOleYzr60WYeyl8S/y3PI+cUuaXEiLauH P3+bHt9nakHgheJ3kpIJXjvXvYdiqTPO5Z2kEScHbnxf2iNBdXo8gJiNTcWeiYbJT51cd29b XCo9lel8k86CrxjJb6PBR+fWJqd2rUQEey+HVTt9yKDf/X022HojKQah/sTN46/a1QWGAU2D NME42IWsMbCx55T4UvgxH3Jntu+wsSiyjMVy2zRiSgEi6R4mQ+brbFH7ctXJi5F1LBnmP2nW 0pJDSwm/9RNQ5xgubogZsDPJFfujSTgf13Pl05JTTIe/trwNOpjxGnrW9OTXz4UTCmFgazRj KPfoaXMRmt54jxp56hWQ4A/N1ztoSHSPUyqJn/UxtBEzdC0IRWvIJgujjVZy48TIy8w79gOK O/Z/ITAzomTFdtcHMYU4wx2pa8Y44tNwg6/g4ZeXamSav9yeI6fmh3rCgaTbHlEWNobyHCL+ NM9Gv3RPpDTZNvziWjkaX1VwaDXHO7blWLwJP/qdDynQsA8PCg+k/nzQTiJqfhoOOB+EqCRz kL77+aofO8tceXPtfdbhXUWLuesN8f4dI7NlP8pk9XLj9fD9y2SN02gLPhZy2fInpjSaHXFM WDfz2vdJb+O0iA9h1JN1McwHerIBx+3c3IezC5wJbzMYjbkNlJgtiGTt9oGcZsbWyqCU+WKj cj52gQ8GHz4Na5uyrOS8U3DBJaAwxa6/rjS6DpBKBpaVY6nvYfjZD5/b7WxXgjLfApU4o7HW kjuI4hXgeHmC5fCX4dka/RpZO2zjpoXntFbX499se83LugAxGCozvQxcIGag7GyIiclA6JwP 2iqw8DMuiEbIye4ym91MqdLFlXP1OOgQTIXW5+y8Sl4D2aV6VkWNS1iqxThGf3xeMtwtDgqe t/gxaFRq48pnvn28Z+Vzu9PcHCtrSoD0LLuAkCtNSjviqwiarB1BSucSuk+SsB40QGC/BsuI BHuwM3qOrWVI+BYPNH13+x0V487uvg7bi9jv6+Qd4GXMBC6eaXxkN8uRStTNdQquybp0w34Y USIQO1gpDnnl1RCgrhxZOBDC7vko/8ZT1TFdflWfCMmXuiVIf/iPJ3sLRlnYfLf0siJYZlwG mMHNSXqKSW9ljtM+LJQ4IEiVtMaGTfA1jmXz3ROjaArSpQDEGES8HOBp2/0eoj5Cqsh8j0ip mlhaZRIBPlQmbTDeZilhFFZ7V0BSTDIwXbjKUAunRfX8/N1eCx9A3QzJCTfjc9PZUXIK03+w e/ueGL0xtpBqc5uoRSRraVu+NCHRv9C96NHO11LDKzfpmAnz74TlyBhRVGjH4EKqgExN3IS/ ts2jzDJmf2751UMmMX+jlSKy7DUsF/ZlymfXgFRDENWulKWEiSipCcqoL1n8i+aibs92FBRU 8VHWkkiAiA0VGqZkyCAvTPl2m+WrpQQF51+ob3AUxfo0ZW+S+LFKuUqWEtPPiZ4NVY8iqdNK nFES14wP7cqmZof+CnZYkDAEL4BNaZRxifPiIrhJ6eH0iaEsrBb+hBU1n+0Wp0QXvHv5lnSd 7lt2+32lY0BaAuTTsoir19nrZp6ydvJDOx8A+JkEo1a2hD+nh/bz1e4NyQiQmpiZb8s8zJcV LZcxmIV9BWGTFZ9NaChCfjn+shXB1fPECbfpfyuG4I/4SdM6OshMJ8xnrBLGgXxIG3pa/BYI 5ezTJF3t/W1XxlIiQGFbHSm4RDKr2LYqnJBclGz9wEBRKsYKYSfEN9unSVXPWeLBLJlgvWfO vuPLnIOif5GIhIt0O32mrhDciZhbearE81jpWAko59AjK+LGjo2useLRx0Ivy5cP4R1QkEc3 qpqp4vlorJYNRJz9XuiA0s1Uf25xFFdppi779exv/TfpcmOW3+IG1gVefnHBgEWgX984KXmz ls8UyDIaHwqO+1wvl8QEuAZ41LfVVhw7W7fjlNaXUIdXNH0ZmAujQAsAGN+4H8woogkHEXe4 6yvf9HwFW6gWeLT7j6WA4laA/aZ+IyynZFLCCo8fmrB7eBCMoGSI7/Q+3BtsdYjGVbE3+Rep r8K+kpDQkikBH9FH+YjQI+6ITEk6Kd/O79pZJg2o97JF102hnRPBjia3B63i2APesGfCq8Ai hjooG3bRA7sm1ScUdD5LlqU+l5JRHK65lTAiTRE0di3SSqxfLa4EVUktSm+cXKBkhgx3ucpf z4I6bBRmMOZuGj++hjJ3M3WcpZEb/qqTA6N2PgBhpZIDiGLslOeW5VhhK6KFIIpVO/CNZonY fQeB5kQSezXH7gVJCnuDQX56xTz5zcBfNu9G6NBVioQB//cAZXG9KvC6tyLc3CLHlSUtelmQ 9VESnnRZH+M6voleseBTZs+KleANhHiMreZEWRG1/aNgtZqkqCxshVqK5KYJyXlPzZj/yqSx HFAHobI6OrFMDA0y1ZaA3q90QVTs0OpVvc6UUqBbXvsCX1y+6LrdcwOB+dzYMqq0MxvuFko+ 8BbxeDGC8O/eWJuxV1R9i1BUV2El5TK4ayQOP3wmec0U/HiOPO4aaZWOlYYEc75GYFZiB3BF 8PvZu6+Ks99AmaOvGd4J4ZKtMsLbrcJ18S1uHQPk9HB+oxVWUCw2BlXgPhYzClTxnsETiKWf Mj4xSLq4K3yrecRLQhBzYmBMboP37xKDc+Yd+GJxG0ouA7uvMuoaTMfYncsqt/ndEDeh1bI9 S2mf+RT9z9v0lBp6C8GkhdRKXzkS42OUpkzxASV9xzZ1MhOzK3RNBXhH18nrLca6nitcqlqw 7zui6CQ8dhuSBzQUAYqf5BmgbIaHKZa5TjhpdsAQn+ItPHmZR8ko2nPMqsTFDEXc8a8XHWYx d2/nW6p6JimZvRYwMwkv3TNXZ3h20dI+FYiIHZhyNLmY98nX5THH9vV7Ioc3LMsKY2R5ORVi xW/7VQ68klfKvU4K9/DnIa74z9wqgRE+Fjhf3nVKgf2SlW/fqIfuPokDdUDfX/HPU73J67FS RqC2oN3irNgxnUtauU2seVLxtf/8iXf/fsjJ0Z70i+3y/u1hroXl6ej4tMkC4gCfojFe5cwT TBBAXzzfARygeDQeCJDRAtkgu6XhBFxvX2+NaBBjQ7yqg7tm6vjay2+UNQynVbGSjnzueynm 8XJZoJzL54Ekv2mzRNlfr5bu6GdZ4p/QMct780j8osPBetYmJM7r1bUDK9KO2erF7uEWNeUg P3UWt4qPsJJVp430Olf8yjYdUzHEnAsn39Xuy5advTy4EfpJvFfdifqzK/68ywW6znCjt5qQ O+NMiqorN9JjNHfONga3W8tu7B6twMUDGIlcKtLG+sZGWgs7mU5xMiDIvVhcJjJQuoNLzID9 sYQZwO1FS6i7J4vU5E+NEN00o21Mq0nWasyUx9nraWRIfpZEp8SG2JiuSTw8Nzdnbu8uCdIc lBfI5VG8oMs1iAKJBbz6G0cDM0ogALHkZbRGv7oMGhB0Xzta/P3EM2UpoJyI0dJWimyZvJc+ XtGD0ZM4miJR91EsAZSRhatMGFd6SjKxKNEhZn70V0/jq9SDEMKCxKy98etL6Rcfy0aPiMXO 6rNXdIkYleaLGkERYlhPyAM0LnkYDJ4OMayuhvOpQklcqoFm3QOIrPM8JXZDqghDmnKR0k0k N+CvxMeLvfTu8e1jXgHSsjtS0kZ1uq/P+LP0dhuJaqz18yegbM9PGSuFSEsZ8N28Bdc1AFwc NMVpic06etLs//izLVNWCYoPrf/cKAO398nOoPQxOQ4+LtHlw/erEOnuVvUCIFXgPajEWv/6 RAxi7smKzvsZMeoPKyiZk12wcwWmqUoDvtT+zo/75p2k5a/zwMqC9kgB3/gsiUEA8yTBxYA9 KGZ5YyMUbufWxDfktC0RY5Ndftm+sxxxKj5mVhgcfkmvImHcoxg5VtVkFI1fnbDtyIm8yw7F 7qAJvO/TwxgZg+/RdmYjLl5RixMUcqVu9ujbjy3JkOucLIhF08kwR7UkuItDGh16WHw+h/Eh 554Phekz7z1VDoiLioItASiR+3pbkVX+izDZKKCJYsuYIyB3tmGs7jBYqNZXZ55rUOCunzt9 U/VKvRABruy3kYBMYffsXFWG1OOnWPFB75igPgCiqtIsTdZ1f8n7dcZxaiI4jbDtJb4XRuX5 d3Oc/cr9WOsBeNk0j101Y3BgGXXJF/nd533yZ8RBpKdJ59JYDUnpokTSI5N3tgQb/TyCsfsZ E/l7Vr86Jk7KmlMvyT2Y9F4W3+Kb83bsv9j77qCmom5fFaRIUQy9idIE6QkBpCig0gQEFIXQ SwiQhB6kdwTpLUCCSFdAFAiEphQB6b0lhCpdijTp5eE3c+/95s33x7tvvrkzb+b9tfZZa+2z 9l7nt/c+Z+a35ogMJt9cWaDB1TJrRGA5PwEpLdFJ+0BaAZaWtz00EtbpRFD3+W1DxiIUFpjT 47GVP+77SGURZDd8+2n6aPxWLmOquJmGRgVT12JoehMo10nHoOTzVQXBGRZZ0ZeBQtQRHlCR 8RcX8MXZLp5T4dJ6JcFjDPHD6Xdj+KCDi19HVNNYla3MVCkVM77tlsIN0z/FqvhVUPe8HF4E cNG7LM71Iro7Lxd8ejbz/XN1MDA6kL4dILYtwoHQoV34Hs12l1bQqIIkLBPCtjj8UiK4QnNy 8ABaG30Zx4YW1s4+fAfAVroMZSCNqBbkn/xCyahaSl3+06WJUJoOVpNau8zy1D0ZE5AjJdP1 kBPrRh7KH4K/8gOpsg2N64ZHdHgQcPxakl4aEpa7t4aGveJoC1qeioguOrxSmspJ0bttg04N cJXwUhXteqgmAssBJ3ogTXRa+CVK5X6rjD91ZlWx6qWzVn93t9M1brmcHC1nj8w63AoZxiYO 5U8kE/dfj+njaj4lDFFKpQV8J2OTvo3jw7Zl2Su1hRbocFg6f1YG8PJ8CkqAcyNVXY8SGYDR bW5krj1zcuge6iGL8FK2yo5Cq2RsmXcVtU6675K21qeM2ft8ps6wqClpG3yejV277fJj8t7F cZwmIG57q4nRFNfrLnZvstS5eWOftVtGuFui5jbZLY7Dj2JYWyNVgCWQ45rG1tkGnZONjQQD MD3QPSxDROTHp4RPXksHH2zF4iRwNbHOqqLMagNLoR0vJExqbsv4runwCb6V5Yj2UUrv4D9F W20HDLzaKwbRXB20m7IE2i9a3sH27SC9X72M1uD1WvtFGaZHLfYlqOax0lKgvh83uokHi+1B jGojDSwcFBlX+TEK3yeGlysl+LFu2ZTono9db77nikIWtxOFecNqUvoQr+nf7yi/n3Ezogxp HTVxiq/TZiiQwCXoGglMPwQOqzFLzz0v+/yUqhgqZfkrSfRB70L+XSB5T/fS8UKm8VPlrUIh DeXycW1DmEvTZWRi1y867HXm1DlNvaaIrtaMR3oqXdHIPwk9t4jRlC+9NgUokKWWiqmfY4/j dgH39gZDjXa96u93aqPg8QIb2ZF9CJQiYzpbd7TtDlHt/OYVIKupwQ2oQnwfG7AElCi/wnkp zAM7qxFdIiiniV3o3wIMyfnV14C24PWawCiMSUQk4/PNGj6eqdhkk6krlotu8YYbLlDcjwUR oi0Rettqe6vSyvQ5I1ROTFxzZ99kVmxwmBiromI3GTsgt1NjuA7eF9hHVVEXVPvSWLruiT5l ZaJBQQZ1pKUfSEzrY0TiZKd7j78dGg9xk8+0MOSlQwpalzx3ZPj4oWg2KbfO5DQhANa4smHo RXh5stYdgaVpK+E29URpAbQb4xIBwvu04+HA0uHHGklKe5UqpjFf7yIoQm9gSTTE/jbwE7qj RPF7st7U/KGgf7Mvw++0N/azrJJaBtAEgWhuFtR8dG96tYpXCyffk6pfdyE3eIFrRhTCt5N2 bhzCz7TtYkGnBFF3U6Y3bLmYtSQZL9aT+aUovpTUtnIqg3yhKnFXmdFrSWq+vg4hA3Nv00yG Lz5/GBbDd3O7GKyMnrfPt67kwDdiBPoed9+0RD4BXDch8G0xWxpQpGAGcMY4MGWKmpsjGiT3 ZqE2sfqZ1bbyrsTdKra9UotiWxFc6OcFPbFclmaBW4N9mp6QZjMAGPHIyNWD0aizn5Oo5vDU VBAAlBtzYC7KiQGs3bZQSfOuy2kJVmQkF6EXoQzz0q7T1cDgn/34Ds0U2DCDq6tw2KNvSFMb fJfQ5pbyEu2y2k5Q80Msij5o0qNKs1V7ehmTy4Y8gnr6pUDTiNHW7n4Rwv3zwrnaifHqRfYY bHnyh2B3DfyLtGHbNC/co1hPl1n0/I8RY9FraVhGbA2fDc3NPFScU3xpurZSyZ1mzcJJiLrB 2R1GqFkq/tcI+oZ1eQR3HC6N1CGFVUwsrcHBDGMX6AuMlNHyaCi/0cYzDJNtDa+9IXqBPs/I Ei0fC8032pDAMNnV5MIMMxfoc4gUIp60PXiLGlUYnrqLSxmHeLVxCYNocSXZ45m6EAVEqEhV CpRUNvEEg2h3JcHw/F2IHGKBSFUYlFQ+QYFBdG9/GII7oh+kQ7E4uHTPyVtPZaEoi6LyUZ5P YtvnJ7OdbD7C37Yqudl67nZ1fiJtAru98dHQ2cPKyabyMJ2qD5+Hpw9+h3sg5b0U9QrwR/6O ZWCybtOmbUF7t9RSOH+PhYcycbRGMIqixK1WH2S0OHq1yvorrQJExeD9SzrZKF2tFQ4Tz3nj 0ca8rfeiWWxTqfFGCp9fOtmZbjv1s2OUM/ZmgObGyYoiIwW1cCZtJexnur7NdXZTtM4Q9we0 2ulCIfBxYW1yWybpVartYDLLTxKZ6vM8kN9XSu4qz2tVcl3lP6F7GfxTcd89vftnItCzj3Pr lFMX7IH9obKRSTF3F1rTpPverX9c8lHP6h711Vk6A6sY3IJcfYx4xKbA/f7NRWpsZRX757t8 Ns2EOgHnrb+3FMfqwmyTQDt9l7q0apMFz+6VT2hzj70eSB6KKYALfN/3nsm309SfTnzDgpwH fyRq9Kmi2e7ttAkHFSClG8fyqJ6dRYjfcTzG3O0rN/owV2K3l6NeH6/72v/o7t1mNNNE2RWf obWsJfeoMfONBvaBAoX3YrrHXfLzu982Gu3XFYu7ZL64O7LX86q8b52m7otL7ULODWCyC53m AS71rfKWld989tHyhcuOEp4sXeEZYhz9nT598y9Mt5nXZZyaAHR8QYlOlWhF/81yQb/pJxNu kClStehvacLHvO3zVIoKNlgnDf0CU93E60b2Z7/MLh0VKft4auxNPSH+suaYYtBTqumJffVA 2+tF6teDaCephR+G4ub13zl2zMnmi1Pf3ixU83w4vN9oI2633gRZJaFtT3XGSgoW+OsmXLU9 Wy/p2otvYiB+ToqeW2+/NEaL1yLc0B5DLcUd2dr1xVG/uz/IZvfa9ZVRNkUt8RzuUt+7Q/x8 /TcPrgrsmnu9nv3rutGoVpK4d0Pku/Tydc4IgMJA5jVN5Aw/SaiFhW6DG+0xOMzy5MfYYtcG a9zYZUaE36kL4aOuuZGTOGJCutbGsEiQZqWu9sBQqZ4djZ1RaCywjOPGKXrv9uNThmKEqm2v Tb9qgCh8ZqunxxDFyMvdoma+nl96OMCtUO0kv9vRqz67fl4XZas4nly13QEmr30jU0UPMYXU 9eHx+CIs13i9OqFJlqSRXeKYYzWyMiZgvz1i5+uhVH5fBmJidvlZRUqKLREjDid4+GWIvEGp cfftuA/Nc/AeFphuTN05Fg1eGlS8YVrv6UQNeU/Uca0VGtywWfG8P93QkcrpesxMrL95/HKq pjiGT++Gy3FPdVzG13NXFq+v9SLkGGJBVEtNaXX1ayzdAwQAtmHTSUfvUdW+x626ePru9Oy9 zpjn0mrBS9oMfIDU66naytLSwPPevg7kb0IZ62ziQv7GyEjv3Fa0+ZbMLe3JsaAgt59HjDcH RCa4x3uIRDbZDBKTua1X4W+aqRgRLheDCmLU+jdxN5aF0hWFIM06yZCSt5GJ5fP3kB5ffoIz BYWLyg6+3HIAfq16hbJpPkNNqLH9ysjAYDIzLbGZmfrJd7Q2EKwyA2cdv6tFzUZQp6sN9q64 h18pMKR8N8EFx7kZLz99kkeEK2ekmk2HM7Enptb/7Di4Kspsfd8bti3dX3p0w0W4b4sa75LI +biUsz5a8x1zW0FfrYHmxJ9PKXV3h8269s6P20AL64fvsiIVTSiuLlF5hYO9R56poG0iY/RL a9o+71af8Qc8BPz2oezBLZV9e+YZvtNJFajJEXS3UPOJlrFCabT86oaYaeLSKMhDPBhoV8ar w8Jr92CY2suMm7v+O0U8D3XyTVF7F6QXmpT/er/sRBczEX3pZ+iYz1HyUv5tRGqyjfn1XNsP eZmTvdttINs+Y4alsKhGolYmGVkI/IA4LUjR8FrZplA+4c27fFSu2HnXStsN2du9uKU+8xu4 JMGIvRBejTuGqMsLh7iPEXx/1lDo83ztwTzZ1jWWujofldWN+rsUdhVPRaSzz3louH7Fr2No Ba2Xwj5/jsr2UE6OTpFL5nrznblVdIJWKHOP/tS2OEOMJD3wK0enc8dXMEJzda2lgXahY47w Po1ZV6RqWABPq0CLsLIDN1FXvVf0iX1E7L3M94g6RKtCYfw2VtF6p3oS4yOVCx9eVFoTJ8cw CHb7/9pdAZIXrdNq3Pnt3A2w6Yg5MK4GmKPq5Y+rtO1d5bX6n3voZ17ZrQAH5t1lsoVutbgC P6zSR8tltMXeeqCcla2c1BYXKcxkW/p6FfyTRPTufm8aA7ZNlS+rLUxqAigQHyZoq3Nbliq4 35BvM6p+KqLhAcCUKy4HhbzFzVG9TvwIOvMm56PLb0+8mMCLbA77tyPpERGAJsAsQFviWnts c1Enj5bl4eoXUcJV8O9sh5PM3Egu1hpJ0pQfo6CzFOrmxxv8L5zJ1Y84juGDs/H5Kb8i809q HO2ZXfTfw98yNHB+Ui68uHPP/YQCBLs6JkcnRfAkU1pd/7F9UXdYF3qt0ojOc6mvPHzRqcFO tinJv4/97NstbdrP6YINlPB0LGCpr1SzYcleyvlJBlUmnOej9nnNlwh9kUx3tvMZDtiVD+0A lExWJ0OizaClXIsF9QsHdl0R3i6TbzWUQQYtGhmdSQ9VAfF8Qnc7XONAh47zsVV1AT0VQrLA TIrnQkV8wESvZCEz6LWbmPIFmbwn+4OtsOeW2SvnGWy+ccYKZd2vMENk2k1sQewNByGfQpoA XQotB3UOwJ+gTOXsoLxgUIBqy17h6+TdKIaPrYX+Mr7E6z1yRj8P+Y18gdRsPeZSXtfK2yXf MDT8mMJyCZ863Xa9acBgst5wp52v61aHwBt7mpww7gf3nx+db/+iJTxNnX1P7AvtUuWZq1xw ymzOU0p4+JNVL/kgSk90K2LlWeTDO/FUfFf+7wT8XtA5mX4trfa/YEn/g/v8tyUpCQQB/1Mt 8x8E+3/mSctI/jd40pLS4P9i0ktJ/E8y6emu//uZ9AfsrBo8/5Jn/o+s/CODEtL/qZT9D+U/ 509W6r9TiSDxT5UIclL/g/lbt6f+/5UI/680ZsjI/K7/S1z+A21/WyCQ3H+BVfpfreu/RRH/ p7gEAf+5QkZK9to/AZPn3wPMa/97AcRztaHWnRZYtOSGPDKCSiwrIiLibnDEz/pZdmnM1+lz 3q9Lzz2mbVnJKx3C0wvPVJU1/nxbWios2iB5bneJS6oEPeNhpLr67xZZHIwH5uyTzuKTAdfT Ded+TwYscXm/icky9J/OlhmtTP2W2P9FyvDMa0yz317GUC23+lfDaEDO0MYXji9VKnmxRVt1 nddRufTv3HX5397P07YfPq84WdGpbftcNxqdfUVwp+jM7HD1xNz9HeM7N1Vq5cv8CUclYHbT 1LPc3pousTr9kQdAwH1psxSnefEd3V8BY7ZW7p3rEQeRj5iIi+EJMy+aOgLGhfaJL8aMgp7w dIY34kG0Z+lnogE6kpT4vRPIR1WAMH/ZdFQCFdQ5qESxYvATf8U8Ljr6K96QooHFndpkkRnp qNggDDoSkexqObsbvqk1cw2ZyE8GKS5j6r+W26RDzRaIKKb11XK9pkNjUg6xcBTFU8AGA9XN nracfaK98tw1USjsr1Y8veSKdmLuAa3/zaTLhL3xxltUspKc/iAXazRtVWWsGRAWmX7jePVL A4qRbDowO5i3qnH0/rORdEMVa1cb0dyOUIJOrGndvMymgTOIcxVSXVIEjapHBv5Y+1jD0M1I FIudlJrveifPxHmTXx5QxiFVLFbNq4EPJl2DdcAi2TgpLHyErfeRJ3phkL+DvFoCatOEWYGG gQfRRgktexuTL6O/+WxRXqJsvq2XU89f5xJ3b2KU3VUaBj+ozBmA2VCkJhDOTo+v5wWJ76+T ycnGTvSnwjyGfjITjIMQL2Aw9iZaMTKpzfuvN5+xU17/CQnOnU0TbEXqT1RfoYKfETCqBrlM 3eprm7O89pxKvss32ptcIrEEbZ/ExsW4tVRzwxCK3LLM9fyeiLX2hPr6XPvdP1xyKhcz3Z7/ bGolY3TlUSIcABIZ7A9Xd32E5APekffeJZTN2XPKo3Y/Bt6rLqvVcNGiqVJPzNzEyJZQIBok eMvn2nQzZNN/RALa4miqmzex46KlXlZFbWfMFYo+8ZwrOCVl1LbNuVB00OWz8YDtvMBV1Zzn yPbEu0g4fzPCI6anwZEecYxKBpXAIonUNzlYZf2Odnko/Hnr/APlwx95HTwrJ8VyBfVwDnQG FqtYNzR4vmelU+IF3uBQcFvsjo8F2gUieVwAdRoG5cDSEkbikW49tXY5b6K1FZjKornZri+z WdYH9fo1jGommWNNwEgfjZwFO2rSbY0Gh69R5Ub2NcJZG3vfN/DMnXhlcfROxAtIa1HgKcK4 6k1ZQHxtl/N+zFry1ElISWF+tLdfDeTgZm54pxD0S6BVtFTOuSjMhGy8STWR61g3iNgvkRAT a/bVfWWQlcK/Tva+pvPPKoNTwVgt9ESDeOkICHwO5ernk8/s7RYzY6/zPdyupvWVpHCOJK0E nV28W5dVWy78QHR8RCxWg2aqsiyvR+mQgdxj7Z71zeCiUh+udaZERhazAgAvP0eb14tMPJvu paXP0CTQk4MFLWiPEbDlg4E3GbIda+3z6tC5l5fgrtuY6A6NLDJZ5ySQ3OsjxigOSEfjYjhi sj8cVtFC21Lw+YOkx/q4zU+w6+wEMRsY1ENnSP9VDLas2kv7Lmzgb1gNHmy9y9wPWgp/bL0S /0VICxmbjqFlje8II8s302N0iIO1wwQ9AbULFKRjZZw6qr0A8wVfQjiG5pepMBpNKIXEPDJx 6hp6WJuuRUp4ogBxqzNUAlvj5YhC7eFpfV1oZtoRP68VcZTzldI5X71R2RNG2n/I8U2WIve2 zHdoFdSpr6enr2+6xs3O3x+5gXdWzQyd/NGfTA5mMRZa9lSuA4GVXFI69NIuE75/N40OuxoP QFaQRiJdmGUsOGirDrMggiDUybKqWBxQ/jtsk3jCdQPyVdCaYT6Z1B2TzE+GvS7x5FQHBlMt gIGkADb7qTYTDQHXZ9rXR3s4hgxgmv1JoaSMaj+ZCkeDIRC7H+o3d7zi67tzTSH5x/sbA05V dk69T3HVQvhs9cTF5VEaurrWp3HLqp91+yYw77DmDx0YbeK4FRdf727OhuTzHyAs/ZF7o7RR EAtgW/7lgEvjMWw2bfI0UZvEkDc8e/MdBtGCulSx/hCTal4jqVI5SYindrFsDD8dE0IvPYiA uwDygzZxng8TzHqT8fwDSaDadec1Dfb4E4YPZXnZOZPmwX2Zl4g7S+I28RnOIRcujoTexXFm gn/meJyytUbdmwtYPNzbXuh6yXqwfrUxiGOQr6znxeRfB8O3myH9rwbR3BED7Wsjruw8lMgK jtKy6qtg4HPbrFtvBIgMT3yUbb6YN/g3bx392ZaqUfR5+wvv/qA0RZPD/09uP+GNgm/L2sE2 f1rQGISNvOrryXY+VMOijgMJbMnP9r/GrolhpeueqvdL/UGqmn9Sp+FCA1/s9v+08P6ddVuf Uigx4QlZ+f7v6YDGRqffU9+Y6m5rlQsq32NDAvn3m3XqXqpodT9cc6K9/GHCTFKLAmxgQbvn djFgs8gBGK7h/OxuyMyMzMW2kw7AhVJAVdaGBK9SIoN6QtIYKmScng202L1X8juKDppW8g+d fjY59ZW6Kj0Xpx4HV22BvY0mUNFPDF94s2IZQIYVcbdaoeftNy6u0wyv2VHHPCErE5faDCNo l89DBDpYBjTYJUEh6Gh0OgNnmR9apCOTr5TtNs7+UG+o/4066ml3vRVfw0XaDB/zWH+gBt0Z SlhjRt7bBR9+Z2eXSBhrkDpgqgkjPX3FpOybJQQ8YydcK1yvdw4ylDK42JTkLaKHr8AqIBa4 lkXK9QZQCyqoBJd1um9ugeNbTOfGDezuf0SgJyYGrbkw46KJeXT37WDngrwTULJ7althBd0H xc5RfOm25zXTkKuipaecH8YDJu/DgkoETvp8hzRhQet26i/OSKMqNHCmlYCTLkNVGviD3qID cch10VKmn+fLLOuBF2hINjz6PU520Z8Rj1K+8Agq8eu/Qrpu7ShY0bgXQhinuTDdwKP+dg4s Ob0weVqTqP4KKxLrX2FJuvtXWJBkL0RtGYIPFoR4RwAzVzTixeAcdMYWEEp8DCWCi8D95+DD JcSjCzNdFeLpxfCwBLDwRQw6OAfLhRcT6Uk4M8GwCV+WfRVfQADfr2gcJSf9eHOhs1glv5jW ZYjdQxq4NPzdFdHSF6Ue9BWNF4aLaKKWqyKwIO1SD/aKRgr4O0rRUg++isy20UgdyNhSovvO 0LpO2OgQctUEphhdkpT9RwTfGz6aS7jPZaxrteoLU4wo4cj6w4nfCBy1JtReNda1XOWGKYaW YLP+0OI3gkd5CbV0xroWq0owxcASjmwPRfxG6OgCoZbJ+KX1qhnMNLoEm+0hit8IH80n1HIZ v7Ra9YeZRpSwZHlw4acCR20J3leNX1qucsFMQ0tSszzo8FPBo/wEbzrjlxarijDTwBKWbA8F /FTo6CzBm8lYzXrVFMYVXZKa7SGCnwofzSZ4cxmrWdHAuCJEszxmKE2Gs07xXl3o6aqzMgRp b10etTH+zW46KORNLKeif06AxWb3Zg1NbqqYeY33+lEMFufmuTFVdz4zO/eXq+pbebK4Xrd/ 6+zsYGtoqe/84kxaWB0LkDyby+J5Jznv6jVp3vCT+ezw5HCoLS4g4PXfn5Yu/K2t8Dk6mO08 X/2x2T/z8DxyTi2O8/5ri+mpyTrUBqHej4R/gD+rt+1anPY/RgwVmEs+mvm5Mwevh11BrOIR AQKwY+p11qx3ZpcRZVfW6bL8nsGyCvrvozEWx2plfrBG/Ov93om1Ho6xL6bfXA8Hl8Pcmu10 yEiSVqQGpziLYzcSvmSKgFE+Jus/G1f+sP7AeVl9ugwgqFsSiC99HbAyOyf4s2LMaSpy5GLV n+jaS+ePSkIBxadqX/hxpzuHQ4Jp6811nk5mUaRMBf9q9wAXy6t4gxdw+bPxM8HuxeiYYdic uQziaL2qB1t10nuiDpP3/E0s7o+VUanz8PG33JoabFbTzVQK2HI99JB+8DlrlE1DP/305QfD xfaxLnFzhYCj+YHmfJ8omp0qp5FJ1K/5LWs/NXouQgML8l4Z4kniMKeQxqCAtGaygKFWP2qd WPe7MbvZT40a4bx8cZpGWc8BkgyGgIHhOfjdGYa341Emw89GLCoxY/q2uTwcdeW2Np2fdo2l IMII8Wfj3Iqvaj336Ut7nupq60THmXLKBaCWu+0t5Mc9D25okriTwR4cWpAgbRt8M7rkyQd7 wTuGjmuPpCpyAAk56J3cijvSDoMxEkTGYPhz1xSa+T+uviOo0LASmPpbTiMUHz/Yna8RNe88 kAASR0CHHQyLF9s09VbN9YaLDhlOrYsc8sf6Y/PCQ+88dyfCMotN2L88p/jCpTjPYq92s9LT iaBm6GpjrZaoSbq8ol5O9N+XImkWl62o6RUvqFXEjZy8sj8yeDGEf+/XUKCOT2BCvnDmEHwJ Vn3ynhoYZPiabrLhOdj+fFVOSjoxRq7c/tjJFi8sbYxwdHjc4tCqGXNYVqufdMZQou7AM61J 2TGCsbJWzZnAJJGoZjRtiNaJbFrQ9rhrMVrgbIEoMJhvREkqBW81YijNcaSe2okG2BiNdBrm 2Z+nQRjERvKCfPm5+F46ZhUQLGQW0O1M5YyalbcgLkKtrQM2v6QE1KQAMPgpjcPTBPuSnvA8 vIO8x/ajDV5HOg0zx6hhMPQYPULPqRCtnZBEYLSHPyb80SKLxD8wuFc6gOxOSs/4qAdLGnEQ r/JlarV9Eb/VucCsVMbEAGNyKIwRYUY8viUn28gpREc9Nt6aU4IEUzp43dMqNsb9qXQ//ehg YoFb1x0uNfHZzyTAZA7WsTOJVustaLHbQAgXsa1hFlSJEakwdzbX0udDqRNOX1apG8pAar7Y qiAqyY02HjAb3tu7ZVtimB/OmF4WBKEzsZcTTnruII+/DzJLH579btMe7c7mK9DdYh8ooJ33 LGkx4Aw1RRh8DMk/Fk8db5AxBNPAK8k1ii3J9FExQ1eOX9Xcy6FZ4yBIZ5rHI+bmpQvUWwVQ ubPkJiOuj93050bFqoQq3IVeQFO+qls92ptVTMtm8trBrEpXnF2tDPMCn5cP9x4nlKsG54NR 6nnlKaQEPBSiXFJ+2QgUn2JqvXuHsNo3TFDNKf1mXECCyfQkVY9RuBb+kB4vUSSwZ2+9fy5s m98WmnaHF+jCPubY1x+j4B1xyiAEr2Q0Qp69JLV/3e8TVS1CLFd+JStEPKh6XJqa/029LDX/ Oix5/KdiR3weBdwZS1jvIVVFcmqaKOtEmThoX0MKm0JKO4Z/VUjJDEIxzDRxAza/nbVsBFYY +m9W5h+riHom1BzqHhun0N0kPhI7YuB1oG0OIFcRFWyHfotYe9gJHS0h/arkdz+DnQLAzgbO 99rLFPJecJ7rjZVVhoxrwgaloDYn+3tmg1Z3BNrR5hrejLC4W1ZNqN9iqDOP60a16n42Q4S4 5HuILsaaYGPV4E9Khs31krfCDT8qal48846kdM7+FKJ+kUnNAVIGz9QPktOMM2eWuhHSOmyz rBIY/YSsIpnn3nA1W/o1yFAKvkCdxcFrTtbg3s08kdFdajDqWINukup+QF475fLpLP5D37JM MJmc92cJUzG3eUMcNk8w4csf6L3CFGyMFw3fPrdKtBGDasQ336b5u915RbeVraYDkOg+x4fa t+IybS27tMBKI2KpcBMY8AMxr32+ksm2ZIshJkP+xpeyzz04rpqqR/BO7cYgk6tcJE3EMxuu 1MH5B+W2iehLiKZRWmMPSdESNZ23FayBkV2BtEo+JxEl7YOKAur6cxvqOeGU4BC663Bn5qbc 0heF0hArrem4mITg8d3uHiIJxFE6gOhcp+akdN00Wamdl1vsbIlBQYJKRqC80mXeKyAVVaSN 6P9i786/ofr/B4CXLFmG7MzYhxEa+5DsZIxl7GTPLmNIQkTWrBnL2KlkJ8Y+llCWwlgixjKD lKUQkS1Zv70/f8P3x36457x+uo97nud5n+f5Ouf5utfVkS01i7Fk4Oksqzv1vd/bVVP1jhJV 7KkkK9IUls3rGwzYeg/uH13Dq4Ig9ouOYwwNktzUhfT816MiY5b51JkDNm4hcxuFEPR+AZnN ICDsyYTDcyoUJ2yLzz2GixN+r1HcgFeNtz8iuveHmC9A8eiqQujRJbjrYzcpIVpsAdhsRgMg ikgKeiqK2N3Lh6r8NmdrKfQ9y5gKh76Mt6pc5+Z/qWKCcl2+mR/bq1CSBZjncG49GcwQrigf 3nwfOJLzRjjy7x6rynerPxtnFdO/Kv/SatnGELUznHm9M5dDxq9EAwK3a+s7vW5V0FtV+EtG BaeX2izxPRxF3KSziyV/82Dy2k8bG7cJAHMO1DtqsyoB0E1ND83mfkpSPE+rrjdfLOPTsR1+ vaDfKoM07ZvOx5VCDLxrPonD+37qbmyTHo3ftXTU3/xczOXDZwSWt/Zh8cQjtp7z3bbWwx23 9QvpQFAS+cx8o+KdCjefmqeBOaUcPJKes6BbTea6MSEsKwmMm04dDMaD7n77BWhz/ewRPFIZ G2SyrM4phtqtfPM0+5D7YXWCo+nph47e0V98D6rbnH+R5n32U59SV8toOvIIwoLA+lsaD/o/ vuW1yQC+YVbqGNItlrajKvC70qZMT+92p0g3qO3ulqQ780dPpS/lqf4sLdG2BqNWeFt2YME1 EmiaPe+a9q3MsFyvqBmKhIW8+DHfMatXiVPwj4V9IdNTleyxo2TvRrneN+UDYWt4tZ+8ezuv SxG5yAaHd1E3EjcUQkEpBQUD3V1uYfnyWfPg5uuN5n/8uXUNXs+6ZZQCxGRNzauz/paF3Tg1 FtdPAWmcoyL1Cc+6v/nSy3JBlbbocP2N/cs1jRH2ymPijt6X8bs74vyJjbw9RcwWCh8UCH8F uJ+AbpCW8RGtynHKDwqHOLBpebwfbcGNS2+dvOmJ1iRbm1lpXk8RWHPqvT94Jufv15X7jE0J bXyuwz3HZZ+FJCaEpHI3p0cL5BJJK1O0sZC/TTzBMoh/TGdazk0T82Oz0EeIuXj66E5q8hcB YePf3klPSXBZhX1h8xlaxpVIxmUO+FJ8R0azGP2VBTU9JurSNvb7FK8uONE+RYdZ4wiMDkaX F6b8bet0ntxkzGY9lNQs7TfpR9oPtGgmVFPJW+C/yoXlP4lObWLFE7XLtQc9cBcbxIkUDjPh kbhWWZYWGQL2S5AP3V9p0004UqtuzeLeTd9Q1dU/bqqVJk7eynjI+HtPd8+6dhNrWvF203lZ 3zDUhq2HQtz+oBXl+HvUzR2pCqHhg3xRvP53qfgNk9ngjVwPc/T3D74rQe4uSxtTeq/AKj3x IObf7IkZJ6KNpQbGAZR2agqJPH+M7UbKaWVtkLvLoTxfx2h4LyN94BkNwWUW1z8u8VJwPLjM 5aDwgIqQPmIyeQmAS7AF0O46bV1tlIKFXOh9/P3jspXK3WonV58O6SR5JYWgvBXKBctkPe6k tB3/ul57wkBFvZ3aSJYyy2H6lrRdLBCXnWR760VSyZ1IyMkz62fpXCeAA3bNBzvh7FwJDnys HmAKgNHwuBPeYnqi51ec9lXqQEws5gd+CQf7ELflynOo6a4Mb5XRYxQ0iJ672kOrVA8SVeVl 3S/kStNJXWmrzKi4QtWC8mJtwr/h1SOWvrZMAgKZlaTiaYjzhJkyrkQZJiybr+Tid/b5fXeG ayWjcMnKT7Ly33St8F2hQetxVn0F6Eo9joWEFnCebXgetYerO1gBQggnYLX7aHkGMY6Uysky vJ1MGu9xMo+EHnA8e9Bg918plQc9RTuwihGFNV9PNbMSxifkmlxEyrPoQ0ykozIY2reeXVK4 hU0DMNE2hQcIUSB3wYuuEi+J9bFEDMIclXXn1T5vZSY4CscUpJzX1uN36dFPFZVHzpRXcl72 6xTlYkUHHTqCumYbiYr6e6E8j5t5snCIdFypVfMZATWhphZh9dxwNUX68FddEymtV6T8zdO5 4Uf6tiuBX0//PLzuqQEZMXqhEvIceeHMhtcPL50CspS+mMm0DbEPG5B8ubso5QtuYRVNh9AY gU1Z5ndsXvXdlLqiKKAtIBvauIkcPL4U4m819nU9/Y481oy8s4uxUtBLx5Uf6iwuIJHqKTuD PRY3AduK7KHP7OOLZpw42MzXVTd4h0cLqWR04qLjAoGY7CKCAdqy2vL3KbJKzznjd8NDbWyD oAFdazgVjb9nXNzV1GU0UF9mStVBwK9OybW6s7DSY46L6AQjpIblSGtmnDnJGuDigulq9bW3 H3NRaMT19EwmGebyqmKfw+/l80+h3KPlQ3JHb9jVNq1CH1ehd/UBBnPnV2gY9bIpFYGMX4wA 3Q8raGT8SB9MkvcFOK+W5Owecr4c6PHZtfV6zNkmbaefDr2Bzmrsp8ZaAs5KVnSfXLb4qLhL apZ1fXTV/lJZWlLH6oL208u5DJLKIdFqrCW8twReJGhJLO7hbLYqug4NsmwX0I2g9keFboRo UM+LTdFbvX3dZd8FufA/Pz1AZO4mR87uXGOvu+6Cx1iCgCwyBaUI39TmKOChTqZtI/DzRWfq T1OmsiE+tZedyY5tJkSoc+Z9C1974TUambbN4J5kEcAWuEgvPKCBLAUgNpJKBZnRqNaYfRAZ WzLwpW1Z1CiNdz1LW2nprZPGlnzgxQ9xRxoOdDDvza7gsQoFfvFY3Crx7UpjP66mFyUizwWY MgQ+XmcUoV2iHu5gt23OvcZaIKhYDGAumXpFoOtYE0CyrEhR4f0JkO26qXoZJBbUE8Uznv6C wf4RX7RM4A17ctXC0ZGd44ti0g5BeOyuxTFz+WB2CzhfUA/A66afZv06ceoo+nQkIFwaameB XitDJ5btYujE20OvXlY6Pjb5KCvHhYssL4xJS+UbZoZqo3Scl7/zI0CJ32GbiC8KNy45KX6l 9tNiXBus5WoL4m5jhobNXzIwpj067TjSyHNrkdVpiQKCIsr6GyG0WAd1u/QlzIKMjK3tUz1S L26144Yv6K5GAlh/c1zzV57s5P5gcTbfBBF3uOeO7MyuLDtj3jqnAn0UWF4LXqLu472J8Neg mYExzEdCTNyMHbBMe06carKaDQ2Cmu59dknkU4MktBye+OxL33WTqXuwkNhr8e9WbbjVpp00 0kV0002eaFzd0HShOTTQnGsCiQAWwNkzwQWORWXUZp2H6imFC+O9EWPSs5PHsDJEPnR1UL3V syMdxNB6X51w+UXvMlWOtkn08+b8D64U+8K7epzH60hpO6N0frW1JNwUt1knZOze+bkAMVeg aWo/4/oKJYLcrbvQK2Ro9uqS+HbOXVNacS2Xk0NZxZ+fszDZr8rGauvPR5jNqvOhrn2gg/fl XmYMFSuRRl9/+Utom/Q+DeBpMTuitGekLcv5fFQku5snG5xqZ74ykGrf4MVKeu2uwJ/ook5P VGusKaMU88ajYXxnRsZlvyLNT0IuGYSJK45IVVFF0spoQkbOySmblesNTz1QeFmd16Tm5k8+ 77Pbi95e5rmhO5m4FYzDC97Az2S+MHDRxq6Ajk6tufOhsAupu+xdEXOVq2/5/0uTGtTNY5zU wJppdCdJsKtoqWpB9m0R0IJqSUNoBQ7RHU0xTOW2nUJx0DbCMVm47ripIAKAKmUlwWj2l341 uCHTQ27LfiO+7NekpDXJw/dXk+QQGyG+5A07gcrOoOtQxxYhD7Z3yaHdnU7urB5ustp94KHi XQaysI9hD3v9aLSu6mpWlIZyJjemH2sVYxWUBiHmu7oaCAWxvhM0FTIvLjPcDM7ST5t5Tv3z kqThfK7IgR9nar6x4VIZIzJ9lr9HS7lutpnXixWWDSNFu9kUvMPM3ICIJt1xDb4XP2YfQAtX Xz0xfFdNfZr12oQ3odnhCYSUTg8LQ8Uepk6PixPTwPStesbF82w8BNo3yamcdtyd4esKgQNK zhmpRhq/pcTMOhBiaK8XCx6oupz2gr97bJaVfTajkqF4F4IyBy2wMNOZKnvNwjf3rhk9I+qK CwKz1ISW/1PJrFZkeq/Ruqkh32xSoTEO+tC1mPJm5k3uTg3exz1Zd/c2JFWRUPUCv7DibKGH yhPTDHn5zDYuwy4AWn+X52eut2ruqiwIN0UbP+iwofpgeS1mlM4DWcRt6p0CwJXWXs69TsoT DhJ5e7vhCElGhgdITAordO/32XkpNKcj0lt9v/dmk9MPp2FF/R63T8IlpyG/OIB3k/XqGMt1 JxovZUBK2qbInCa3eaijKtnEn7E1P+cFPfeggppWdwBU9Zb6KeJ76PU3M1+di+c8D08PpDjN rl8fYN1VDTsEm88mZ35Wx826Xfmz50maQIU4SAAv5pOdEjGMuxtZDc8IqOBOm+fgNB25jLsy r+nWZoRSxQ+UlQeibWiReyXc+HxSrnBZm7svIpPrsSbtS3uXPqnOo076Ft27LN3fW4dCy9d0 ++scXbfHevuDntqlo4Xce6aP+bDD+HmtpZA1bXRyfY1DxxBllZW26fLA16UdGv+S2ndEfUAr btEj8La4kIFDQmazxWRN0fo5wtZ7GKJHQDIMDKfRi39ZHa45l6RX8a1Y81z4GpYTxrGW51yO 4GhpdvG+J7RqivRWvsACbRFe8HoaQmM/pZglNGIcXCQmh3wydYILx22YiDKuiAWlIHPzNj1W ATK+qX6DH62yQHfucz2WWb/T1Zv1bkkyTevZFcdjZ8LZFawQvv7BhzgcQiHd/cciB8rezWC5 DioclIKv0YvmWbt/ytDUfGwbMnaakX9TKOdatYwBXC7WKhfXDQkxYxWR0qx1p3pLXl0C3WQO BysoiQnzyzzcZVNT3OqtZGvRV248fXPvbM4QN52cXBTDAzTkd7YKHzf4TOXb+XX3ROsVpWH6 6nzl9vgkBwkCfydXmoxW/AnhFKlty6brXtLa40wENax7juxcXO5WRI699HTWVvYPVdtKeXWw eJXYZm+OIicnp2JeqlfzOyXPSEzo7n1nos/pzNnGn4fq8P0xy5LIGiHbahuEXmC+sLR77APr 5Leeyhj4fq+2QCMYm/h7fIXpClrA7YnoV4f3nz1q3j/q6WhlR7VzO9u4RqvcKBwZK85Ozhaf GpqrPU2cWKoTaRBSzAdB/+CPRE052lRCQ1Srw2Ordc+0sw2V/KXUy695gLh41ES3ruYjVFwz XiAc6tfhbgb8UzvQyjovEIvyeUh7i7QxCg3/CHBtiHOkrIj/pD70KXUpIroHEo5JPxh6d0cY pp+E7LWA2OhJ3tXbW3yg7KJ4pn55J4IyMjUzh03p5lN2O5SQ4jWYWoUecfZoLA2Yn24xnSbw e/NzuzajTdGihkECCB3+vfrMCzkCcSk4N/WRDW8iW8LO251K5pobvZLcnKtNO+qY4Ks2GHRK 8/5luw/eWsigU/d2CEa96perY5qAJlI9v+JQzXBZVfHsrammucri1emb27fefj+Y9HkVNxSn wHIxCRBDo3UlkxsPjOkVzu+D9mnthqsIocX5goHaz4h+xxrZ3rNjbxJgh+vmttPymsWvv7Yp Pu8/sYtnwKjvAtIXzl//Ar790+Wk7ZUxFPftLl1BM3jiOAbI10AgpbeYZeiSCvf1DiV42L+n qGd7y83G3l4e42AhWk/vcEsh0uxaZdVllcP3voEuJgCJPk72Qc4KpYPF9Q2Jt3+oQ04GrD32 3qeivZzBjVBH71fZLXC3dBzx2Liem+COqwe2z+q3MBfrXZ63KEUcnk+k+D1yizHry0CTxofs wNa1esuFVXpzY5SE01nMyM42fDSb3m7AzADzTgFcVaMXPn91uv5d3CuPuqqI96++1TWcMWiO OppfJGiO3nU94Y7O7yo/Z47Jf9d/KEcJC0WegalhEZgtz6uow/xjXQbUOXBu7BpxE3aQykU8 hbUUClaSvDf4ZSr/eKPVtU2aZojqLiZ7M7Ph/4B/wD/gH/AP+Af8A/4B/4B/wD/gH/AP+Af8 PwOht7VOAifvF7Sevj1I9Zm7ILd7j7298t9A22d1P4+j07XZLMIPRd/RhfbQi54S0THHTtvw vZ9n8amFahd7/82vXZxtv7vwJhxtv/u7PD4YVi9U/9+fQ/+bXXupGrL/5XxB+WGrr31hp6zC 4/CjkfVz1v8m2Orvj9W+iPBZPByYXmxFn/uw+m5FXDzMqT9gPTXGQYgtZ+1PBj4u6G/dvliX 81S8jp9JJLtobvWSsOSfL5RbLtqRlcwg3/qD1+ezyW3EwFQ3PNSuFUuuXQhdx7tqbUUH+1A7 2s0jHMH4ih1g1WjCTCa54a02zeH2QpdBpc+CWe7fqzlx+7hO6kI4V1Cdg9Z/oFY19De/yvyj zfdiwVu9a+5ug3k2RYdHYrIrP1rcByOGGWhRY4VqHKim0qA/S7FN2hXGL25OPzr6ct4VGrR1 3ax0BUHeUh5IDVmlOa9mn9Hh+8FdQAkcAtZA3DHElEKVwMdr87HPckRr08m9S/+L3+Il4jnc wRzFtC0lORJFxtOaKNOgRFNjbMXRWCHnlkWFhhacd821HRqBsJkIswI/hxzr03FIVHkXoqwm iuyEIbNUdbHVneEWBt/hfsDPmRYQu/lmobR1qvYsqMlEskCll3JxLOYswcVOUZG9DPLtkfNR LX+toXk34m4kwXZZsVRXi7W6oWYrh2N3pfvLTnu6wQ55f5T0J/YDQHvrSlc58Sd0ZOyzMN4A /D2OhuY41lY/Xdqul7oDpwQMrEYcO1yfPutbpcyqksihFV/kc4Lfi0DQJL69Owy0Hfy6B87p rxPHh+r7/PnvC6fijt56i6l6pQc5Hy+2mbY/v3WsNe24FS6GPzebPdwqIs2e0iu4EfDwKiud XrOZwBLrCyaOnme0kzB5+41vlgPZFOS77TEqQ439/fzEct/5TtWIVjG8FXTGqizo0fnhKMhc C4CLMEpfE2pwO5FznmvcwCjuGvaya2U7jBw/qPkhekc6I4/eaZXqyujrGHjJ5FWM1TKwwB0A XZllN+kIPPnYX3wICd36+WLOKw8TdJse9AaRi/ERrq9asOr6RTeuJcssHSOx4sCZfHBukpLv +TXTK/yyVcfnxTvcdnm8VMBDHbeGuLfvCv/e0O0zsH0Al/5dKmfRQm4lAkoGeu0Dq6YUdGdv MxZyr+luj20xy18oU4G2WgKz5uB1ZtxCd7Ap4h46Tb0/RBpfFhrITLKJyNlrvy0OGG07nqIO o/bwy9dSDrauKXeHws5D0heCUIXq52dfz+xMJqHQG034g3fyvapQvXT0OavCLPK0hfzC85WN RDGrP7uv3tLBuPX3MeIr9hE6N0or+x3+6mQfrghZZQrgHhiIwANZ3VDwNvvhubT7iyWgP6fc J2lQ9OkzX2Hz5W+Drg71RYluzn23QA6luRglrG/JQjdmJT9Vi0e8bM1qtcVI2PvCGiz/xxOb y9698jhkfXSgkGuHG9PinaqhPF/RdZW1NBOmcE5OLh11NTuZYETdVYs4vz434JXX9XT6Ljld whUr9AH9JL4Bp9MqY3CO5/3C5rB3whmS6Sh052u50sisD9BIu8/rqZV0Bn2PyDp+d0ivYv1S I6+yV3NXwN/nryaP2+yf2U4PeZQ2Fk1xoEIm31nXrwZRSrTsoRRqSCwKAdh9UDeM93XihnaQ hSFvTpvmhHgL3qG5tvAeHUYtpzM3wfLemWUyL+CK2lxXRWTQJuVcuDWAFntiE2ZkLn/+QcEt tEqP9c9aj6pKdXpvP1tiOKWH8oOa7jgrbEijGh2zLFL8dhCd5MMSKvt6Wjx1RdZIsCBKytHz 7e4LiQHJ5PebAi+CGBze2QJ4S2saHtpo09tINs7BoVJNZYkrL6dH16uqZzU4mmR06VpisCIE wIpVSg0NvohVrm1TcUt/Y3bavQwWUVlq9fct7XuP5aKyoegf/nZQ0dCh5tTUdZLGKye/oosn r9KqsHwA2g0BXyZa2Q22mGVAsMrpv91ePHnCUmDr0tITxQJq31po8jQ+82iiPnrx+lohltUP e52US2xIJHpT2IwxyceWE2RIhtDyzuD1tpgsV6nEy3nSP0omj2ly+cdS6zmrRBAK4AmtXdMg UFXDQY4nrBSSOlubSBLWZdyf9Hly3ZeGKXJOLQ38Jism6ZozJIehQkJFEW2JIifc08lYzTmM RcumnWdy1r4Ms0o+O0lMVlP2Z8NcnQC/KmLn/vDx1wpbS8pB+r2G5cJWQbvFPz+uKNyYnTiX YRJEJHXKwJRkwhOVWMoAvsoPTtc+gVfgfieJvh9eAYWr1vzntN4R4uj4OQcnoIHCHh4SlV7h mapOCwVYWJNCnEacgUGb35VLxJuM0bNFffGp+7yxn9j+pkyLUA3qplwxrdkj+H5epeQMWRva ev5GuVjsb7zkQQ9XSII98I5P9+OZonjGYYziggLmdGWrzQvo99n6BWKwdZ3S7zmjac1F10G8 9pF6OYK0Jl5fGTUqnXmoG8B5NhdVk5VeFD5oFTuk8qDF9EpNqmSjXdDs9wu3LCjTbPBnmo5z PBvhbx6BWNF9ntTGhRvxC4M4phTwmzhNXsrSerASxMB/Up6wNbzZkkSaNm+dPsqDV3uBo/cT JJ8++zY/ajDqQv2+mzfN5Mn+wSf3gZQ+z7PBFFryh4YHDcBQZt9kRHTNplZjDf6l7a8aauJO Pdx8ReVRmnPLr4ZnJZy5wjTpIoStIxlBmgBAzC0TJmdRvHGboHFxSeYNMaaQI0NY6wXco9pE G01IfRNYGFTRXOBZEKWmbSbAIPI0xapfJmVZgNptCH0VMxj76ZlrPr/N1HtUY+ANWrPCWnwW kL6gFLH+twB3VCmZ1b8A8bH4UtL4a8SbtruH6fFeMhvX29Ieo/Al+HZn83EgvMybuM2qhQeJ iWufVVvZ2qeKcILPOCK/orKu/aRcvi1j5LJfGD36pUnQQ1deiMIH9TjOEmA1KQduBj4SfEhP Mqv7dXslZwX/Wycp8284C/JeunhpY3k0H7D6SvN0O7Mp6sfdyiyBmFgb5SO/QmyweOgqQqZg 0BDtXfou8BRWIm1vOmVN1L/3ZkqzgJk78evjB2edmIwdSxmjBwxXZZ3hJQ4uj29fBJd4wNCe ZQPyOsuLvaKwPCAdaIbkT/eVlDGBjgbgMTZmbT1+FTQajCVtpPCe6wKCNLyDQzltuO7s40Fk Y4NO10yUO4bfORObb40sbFv71sWFzGW3/CGcITAQmTy5ysWj8tAjQUHbn60EY2zflf1q9XWc SFC6ACkZQU9yQd07a2et6lJ/Of1lkGm03wdXoJjg42K/FXTO093zwJM6qpbr8aJQ1JfhLOP2 ordbOtk3FiAAPWeFjS5qLP4iX5MO1f56dcDtDfPz6dEA7htwp2a2XQFBy/5rkYBC5CBcyuGN SriItmv4CodwNTBnNouSxIf6m5y6JfJzQkHnci0SyzlSDkCdl8I300B8FB1D3aPmV2QEk3X9 GuHj8lWzs3pWRi/Q4p2Hk7Ovx/0os5T7xdS/LZw0+34D3siBTrDA20DJTbc+Oj9Xj7gs6erL 5pExUyun+vmlp0S0qPdNWhtrpJU31BeeNM1P3PAI3UUoIBJ8PI6P8YRq1i/9KrR+nB+v8H4l jIdC4P7CKtCwRngarB3tMOGj0nUJ/a7pRBE2R4eyW01jn54ONurXlXzaDxB3zh7KDqYrFxLh 5gxIvsSVcNnGRSHwrN8wGoJDLKCqavD13F5aGAMFlU/ZPIlPoD1By8cWS9R+woq3KIJkJwB7 nz/E3Bb98t4vhN6wcPjBwvQ82vt79/2L21n5kMGkqcOtao3JOL4XcURoMF0ti2GbWMozzh4J Zm1U5+OtfOkOmLJuBXP+twGLKTMaEnnVtjz7zaA9qd7DNSXMr3D2m8f9heeCrd53nG/eTFnp /im0XhYF+n42GVP1kzBRO9+emaFl2eQTRxpi++MD8b7w0QQwSo7J7abLP7ONtrrxnMpmKLr7 fcdlUd4cpf6BurRZ4XRkn+d/Z/YWbC7Jc+Az+R9aslbjW2rSgQWIomwzYTLCC8HSEvu3846d k+9Birc/qL+iyvt4hsK0qSJy2MB/096/TylQmL1plU3vw8y33a1CBLF5W9dGotr2T4D5qzKd 2XaL1vcWpbeNbkEg3T82Sq9daXzPALezqJh69Qn15msqJamRQ9Y0gx3UgZCxYwfZspCR7Qu5 byVXIn+K+0ouim7bCFAUTqveSjHYNZ/3kyws/znxMKQGndXrcRv6+0xJ0+XEtAaiA4ABxgPi UUc8uVmx9LUsRtEobPOX+qofM7FcPtSFo9WfcvlooQepjb0frbzp8RPo2T8zE3EYqDBBxI1A 9RXeNzov0P7D3I83bCCq4INJXL7KZcb23fn6n5GXQa0Ff6QtyREw0HG6bdJpS8b0uV1anUkG u0Jr44rffHiA0L3b9XpZLeztdBmH11RV95woRCr9Hs5UVDjLBG96wKk9pMkTfbrcwKT8gDMS ynbadhtmFkMKGD38iQkQfh9ntKu22eInGtURyApjXCunTXWl02bG8g7zgZCS1yb6y5y0UzLj bkuAFBGnlTKa5Yyyd2DPU/qWRzujCnOZuaMS6yjZfDf7GahDelylue2p3Xo3NdnzOWAa3qlT SWx5o1YrCHnsWGFxBlsH9LOlHyKrqak1knHnngp3Utpm6Ya7bxKg4C4WbO5eHZSeFeTmo/jk RPS1Y7W5dnTmMv9I6pso43s5Unfbe32vvCdaC+tYadF3Xkp+z8YdVj7yUu/xihWHgkD7lSpL 3KpVtWkGzA4wJ9cAmhRm0PWrn5+f92kEq66KJrIeun5i9c2RerZAWaBmoKNdLDaRCjQX7khv jH3vAuW//SEPbgvd+vIjPF42ph3bFKnvdHmm81IJgWP7bwehHVSj5WpabY3Du0PNJciIbwgx n7p2dOg5QxDrO9qbWNaAvae6YXRp+06qkcM/bjm5+vQ1WeQDsqCmGXc6RLSz70v2Xl8MmiBH PLuGrGzYzpmRENYcMqVQyYqbdMvYIB/8MOuavT9uS8txir/kSJH8PpKhXUYmtL3zFP6c+p6Y +hCfcBG+/v/YO+9gON/330cQ2QiCILqoES3a6j3KRksIwUZvq6xOdIIQEUSNTnRhseyu3kWL stpavddVokaNI9/fzDm/M/OdOfOb+Z0/zpnPX/f9zH3f7/t+ruua63mueWZeTxlA9OiPoqaY mhBK7OdPgQ/TlG5KuW9Z6/yi5Im8wojWuWWr2GrpxTbEJlUeA9NIcMB8tZejX6XSXuYtObif nWi/LumVCt08rr7U+ZwVm6ArdTDzQSrKjoNzXL1J2aCTMLTNIjKFNXRIx6tMwXJi6BLLb2+P ymD7ATWoGXY6Sg/RdXt+s83X/bjM4ND5h/S+8cPkKdE7LQwFjkTIAz1OiU99BD7mYfpK9PHf qBhVCwtqk5mkg7uZZCm+ygz0Vw5dJ89aetHlJI39qSjAn1trSa7YUMWqbn0nwZ6O2Ui46rog ZpRmSN/WeJgucPiOWCRHuToaWVScsWb1kJAljf2yEPvNepilP3xG76sp25zzy2iVUERGnrfb 6/Str+JJqK3T4GDVupliflOnMYDGGw+7zKUt/xnYwbpDlTKeAw/i/YYUUaDmruqJ03NETPOs 9a4P3SVN9vs8jddAJ33q9N6hvs7QUbQDugH6xaKnw04MHnewFltS1pyOC5+4IywqvZJom9ET W7UpKBYhpGKVRmZX0akeDBBk7Wj3PUPK+wnMsjkYhWCSCQwLOJ06Vl1iCYamamcCD40uTw4I WwESOaVwdZS6en2jdW8Hpzhb2BuCNN2ffmxv6cDeOzQE5mW5ka/tL62yjoQoyXDLVMRMcctK Wg+RjQ1PSgUNeA/bSWR/eKvEAgSneAXVJ+HBGGApLETTLz6E/v7X3jYPhHFbDG0Cjyvv/QUU 2PvzJzZFjTgqe2Wy1MbCsU+zy841dLgzcG6FbkeEWe/cR50EsVJKUc0vPbEz3+v9vjY1sajT Cu7rmN0sgucWxCdnJucgG2nMCa0n+voKJXQc0h1BI057c5wdoO8aGwuSVeorWNPcvtlxEvUA BrE2y0R/pWCTBCYKZtLEeZGBiy+KA532R0YKsCeO9Xkf9FDNoV0TqSviT39ORdP6nOb66Rko raNC7/AEt1myhPefrkFtumLkYOXuryghfPwOL2C0QDh97bBLT6JaEovqaAlOp92qQB1rMG3j vFgyiAR967rf60SAEy2rOtuiT4vbOReZRpRdxZfAGUtogLJFcV89zijSGofyB+5SssO6SFSc /M0Uks9JXwuKf27ttHyhIam6G3FXeJLCTgCxhq3l6t0K56gJZpPgdqOdJU6W3HzlQTvIzj3m Qkdma3oYZ91oe89+RnbuzcVdQp/kAR2rLWRXe/LXSaw0poYXUT7skB+ulR/G2ZT7QNcMkeL9 OZW85FUKSFkXYupZUOiATAbDXpCAdGhuGeBVcvfO3NVyswZmrqnbvfIQ/MpE2j+rYp43kV++ PyDWyNhPlloSGKLo+1I3EZltYvWmUX/bDlpKA9xW6msI9RZTqSd/+VNbcv+WCkq28jP/z0fv H/PYWHwqcxLZZJq+AwMAuZ0saghIY9RXXoyuiuLBQTFWcjovEwblmiqw3SSw1xgUVewEb8nq Q25NK2TlfsJtUWU3ZgqB7hX3zjKHLdHJ/q9NsTMLFTcO6Zl5Ytwj97bwG1mJokPouI5SbgFf 3Y76mkpHm6tGkqebD6i1KeHyuWoxvLzXF+ZtTG7Nx6GWLQpM7x+L8RdWXqsh8rFiJoqkRLpJ measIooNyZkoLQC0bpaZqV6sO+85oVb27JMvhNRv/03PXAtCdS9Sl19ovUsB7eBpLy3e4ojh oXFeMnOwOiYwDDRY9DW6QAbaECJhanH+aQPubBusdZSpJhWYCUuX105OWZ7RY1ZScgqWJomS GDVetryh+OGpe3yrPStAC0on2rdsEjva+RIK6r1E+PldEXMbj322kTqY/L119zRWhT5iukLb gKoJtz3TPdbfvxBkclscAYl4QNbjqxRDiYUnQ8WjSimNtgVNqlpR/VFYAAgI7i3T1PoZhWp0 omygmul0JXgDSq76gg+cLeIt7pVoNArhlVJzVFzjONk7Jpq8M6B2+HCykXmY5u6qMXHj42qD gmQgXV3yYM9WZ36WdTZHHpLcyAuMAm+KgZIIJWBu9QzypvHM7W0O6m7tl158Clte+kiaRdee 8Ghyeshxu/4RW33oW8MqkFx8vRo1kAFvHQf5ga8tXTiIzj8rTimL4RV24EHcBrdBqVza+Sx5 Slarks//CF5thOHxw63hXVd/lgyM4Z1AI1gAj3JVlZ4XckQRfEGuGbc6XNoX+gh6EKVT2Hnv K1XPVH9ZPEcU6rlwQWHfi3fthRTYo1cxDALcWo3t9mksZ752CagWRBqTuTWZ+QrSOY1kHfGU eSTBtGotXdMbdCeiwrv+1oBarv7k7bgYOLlhryO+PM+O/iJnjPoColQjnZNQ1OtPPMukwpbD J++G11N/ZuT78pCcZHZHoawT9mQTZ78viVoHkqdeYfwby7GfNbIVHzsbLvMpNl+kDu7+pKeZ cVoR1p4df2OTlBzXgJxBjbcFbdJbrvB8D+FxL+C9YzXE7qcJVju5wg5Z6DlAWHjAX06DD3K/ 02ZRD70EwVpRtEnRXF98nlaJH4ZCYTNX60CKATlTp5HfVi6SSPENg8nH/FOXT+EYJkrDi3mV Xpgiv8CdFXOxyn29mgMs+3xLm4PupP1mgrULOoJ5Oay85VL8ZbO2boW9PqCqGV3ONB6vJDd1 tU4mtIxKdlRhVf0+eSBFc4Z+WxhOX9Qm/rS9DGYhFZjr9t73h8+OcUEX5b3x3+KfkEZxzO48 7QGWTlGv5TbSej/v9uifnc3Twp6BPQf0eZHHSviepjzras1P86BWO0+8QXyAl2ojpEy47Ora fo/J1bb4pSNG7aQeKV3kZTF6pc2IT25NPx/VDsz/GzMwvc0/+xoNPsy9Miv2MYmBz++B2ZD5 XeerDvPaNi7tsPxCQJV3JNuqarO+0a71eFY4NfH2FMjVstTuk+Oz6b4RfUdHqgLNi56DJsQ7 6dAPP6bkHFV0Ql5zTKkuXdhgSqH54V3MerCeWAOzr1eWSq9KZb6BiLdf8FjYIdewqG9sbV5W rkJVBzl8UMdeUgA1dOoK56NqxxoJe7Fzke+wrk2Muifqs901ntbo3cGnti2/5AOx5AopzM5U W922r861IYZxAxtFnjb0HPRwVkyNqBIlY90uYpXTzZQOhxgMUzStIFwRe+kNOYUAHTIXUfll opnxEcu68QrtSp9dFtErJ2XNhlQj1SrDwUuxH/pXz4WvHpEbI6kYQaqWF5yIg52dp4g+rt21 IvvVF7BgG5MxHTI67IgN4NBSuAj6HEICquKaxbhq5S36zkIZAbAJuOcTxFwXBo72pQUTKeGM HRlJYG/gnuKIuU7MPtqXHEwjj5NxNMaDTVR6AhBz7RhRtC8ATKOAY3Q0JoS9qfSkRcy1YjzR vnhgGkVcoKMxADYN9+RG7HZhkOh6WjCNEs7E0ZgEBoZ7SiB2OzHH6HpyMJk8TtZRBg82XXl8 F7HbjhFG1wPAZAo4JkcZQhi48vgRYrcV446uxwOTKeL8HWUAsFH48RPEYBemGi1JCyZTwr11 lCGB6cKPxRGDnZhDtCQ5WB7XOsQBgBzsa2YeuwrhaeZ46sffhwCMuMyJIYSIwTZq9FO0JCFY vlQBd98RD4ZnxGVGDOHJgfrfXAAQ0TF8OaIfUHA4IUIvB2rliAfVg9DTgOUv7iCiP/HlBFBO dXVSozHBKPKbGaLfoNI3MxjRQDpUMIofQk8MlgdzIaLD+HJg9FNdN1s140+p/G2Ip7pabxrK KZW/Db3Rxc1q5mCMkyPeTkQO8q++AmTnRjjwkdFFJSEiOxjDfzNUlIMkuhkCQXZuVgXSGeHg hCL4EFgXNVojB0kNlhcOwbxwxBu4b4SrJBRRgsxh/1zI0bZvtwQJNgdeHaz+/b4TdH66v0e2 N98UUH25tRplq80s5+tyPTcr5V4t5vy2xeu4b1U9j2Ywm5GOYUPO9XIjroOIbHu6wW9ikDEI Oo/aiYW1OE9W+Rw6t0CnjniI5mXEqPKFQ86a3Soa2+3WrqmNwvgybNQHSaZbCkZ7eEfyuMWC bk70MOXOYQdn7dFXyPOyXuQtsHx1+Bri1qmR5I6DfHXE2gc+V/xqgyKflxc/JEF/QldF7DYX piSpJ0gXpCu5xVmIIaSd7PmCqKFrtJMdGgKPXlXctYXLBJ3Znw1Mv9uTu7z63a2dLYsPXgoX aOU9YTIuvvKA8lQGnF4sq5qxidFOQuDm23iD/dCQ6JmRl3mEImQQuZZbD2qafIoMKex0WhfF pFMWE1LfOZ9C1nyk0wQLbRdREzozELEVkEJXkZ0FYgIw1eGdZXNv8P70Bdn2C6tWW+a5Q1qI vLC1HsDmw86snwu+OCtbdbA++eSfn9kdJyuThzQCX7+mcrRFLwRrpDQZmgSeLZ1Vc8WyyUwp XUQmW+3/CY2IzZYmRL1pVXHyaQxgm9z/cVh0Gyo4+BEbemFewzdnyoqyHTL9NHtLq4teCBzY u0aOTt4lEvGz+Xiah6X+uDNsaZY3m2za4cJQ0XbfFp6/TAbh72TfiLVsqDlaIK9mr8PLiHlj 1bV9urE40vTjg7ji+vNdIviAwAwhcCB+4YRiRX6bIxXk5S8POXTdHY6cOk9Y+d/5FzWRmlXs pfT3ufBNv9B+Dq/+jjdATLtcPg0lwe7OKLv6BW+drGyO2g4Fk7ZIU9mQ5ZOlthhLmPvzaz2i F7587FjjNDRraJA/27qzT/kFH84VuyhMFz2wvANehf8Ktunf7p4Byrg7UGN3+efAIfN3Y5aH 8yLIkl8O71aR1YnqZqySQU7QgewgLc2hytr30zKnO3itrtLyTo0Rn7wiAnr6j1774i3PuDQG D2s52rpB0zPSml0pDd3+DBqf7vy54qD9nUq/F0JbvXw0lt8sSomW/iK45usA7gIKRupTGFKM kwTii9NG9UcXQ+IZizi5VvSKgtcId/zg0dHaZoTyDe+npVvfz8w2EMvfyR4YgXjLQC0y9ooy 6WUp94rqXMFF01pR0/wx0ZaLQMIGQE2dz80NnkmYhwPDOKD+2xby7stJt4PIUHFRBs7C6lrE NZPTdv3ttsIidNXL2B/kkjsejYCtSKcArNYwdF21UvN2A0AsuMFHvUuThdImjVF1kEhE24zO jxEbk7nBhapehzeI3rk50sP77/6DMKXi9Fw5dHglyUF853Wj+46GkzFW6/Y0etKdJoWjO2l6 7FiksLBcM4R26oFNd7VSsNdBJzxPlfRH1EHMBiYK6nLX8KAdsuTl+S/sVW9p5OST6mW0mbx7 mF64CT14Hn5TS5LcZ1Vvd7oJBuPwxXINjbc/UlJqb6cbN3vYJapYdgdtrey7GJWUT7+Z70Jd L3xj68TIBfOCGqJbnS2/Kmh1W49VR5mp5MF9CBDNarFOlX2t8+0o22wzKd8MmV6WUvo6vJkC dctHpztLxc/yhhFkjxFX+4sCBc1aprD3O38RH63hvACnjo71u6QrHp/RNvEM2mxSS/h+56TM kpVB81mnnUxcBtZYJJxRoo+Xeyb85fwtfhIFIEE2SYaFV2cRLxUa1d3Nm0Th54+kBlKLTfG5 0zPJEnv8wk5WdxTb9n1WsQTdeAXClG8v2BIJ3WvGJyJjLJxNpKdYTf0mMngr9XQ7jC76pwgo Fg/GWTkkVmoxDXf4ndV0cZJX2+bURxJ5cLSpQHtqsfDQjS312M6LHcEodTuNrCi8uNT8wqG7 3Dgk2otNjK78+mHXLe/3j+I4bPpj/H5vT33QJv2chsmpGK0ZgF/VXVUwSiXMJqaHSKVGsFBm cwtDma4/D/l5tI898oI66syZ1eZ1m0kwdscwEgqtdIUSdULwYK/09/bSzabPu4H1JIY6pfS1 j18xbeJLMAaElFmFx59MnLikiX23vxyvLODtPUBdtyqE3AxGkDFLejyoiyPk44Ph3aTvfdda PfOAFhPCdGz0OMkMWovpgVuEVfAjXUubLln2nDNFI9omCaAVCJ7uwiYer47PP13zxp8zWxI2 KZiB0jEakisxv4AeJvO1OM+eE32i3w63cePC0TMQufl8eaSzXJ4pZTgMQajFZgWndZtERs+g ImfRycHT5bPsql4H004soQMUwtx2lx9/z/tesc2l/8QdF/FUctzUGH+d/csBnnrKS8+X4zNs KOqED7QBIenrBF+1uzK0R3V6XRJa8UI+DLfblX7HndDwwIedNBLKnAlU3ewW6FnV+7HhPde3 8rqvyR45OTaT19ICF/WD8Z+0Llc8+nRfswczjz8lZnX8p/QeShPCA2RTf5H2XArkUvlW4lTm T+17Q+3rFpvG/TLqFjzwTf1n7Zb/A8/ik0ZAIcfNo7uwDJdNgw2cfV6DR391pwNwY5ZQhjja yPuE0f0vRwjSwlyaeu7OFctTgZPo27glFjk6CQzxhc/kXI+Xrj+VvurBBJp2cM5ULY6550co xJqzpw/bWnvdh8CUuyZfOPbEp3Fx6L74/lr/nOcjyCZxpri/3Q62nmRTZkbpZC/OoarjU5ls /gBqQY2eunNTngadtij3PXh6D7JaoWfVxzti2dATOf3njYtut/VPqo0wA6/JikhDeQcaxDbq Xo0ppQRHUtCAV+cewEPegRlBASZhWBBZVPZIvZnCJdJvHAwhUH0x/uqsDWjqpmG6fkdI7+UZ 7t4zf9pc6APCLYPTzNvgs3X6lZBlofjbPADRPyA1pAIVhCCpZT7nK/1XPV0WyPjKR+f/bohn q+b7ayKUFl3gvwP7/sWi/gckGfjsfyFUgf8OoQr8ryBUhYVE/xNCVeT/dTTyf3fnkvT+l/p/ i7T9l5X/hVoW/0+o5X/nD/H/kj+Awv/THxLPJP6v+2OWyO+hKsWdBXeWR88kVEFWX8Iobse5 Dz7iYqgcar6+pty9+N7AVaYv/6o6J6nZJ6ta0CPay3Tre6mfzbs/h8yMFF+CCdhZ8ABq8rf/ D10zqrv+oq2WVL+afvORfjnBLwrc+2lkGFQb1jmBL5l86srzEzHUYNeyh7fYvI7YyZ5fJyz/ Mm/fPNTMMO8ReHQlODABV4SAnfP2/xjttaj+niaNzdKtCXS8cjOqcCO8VL0a3BJ7yy7ZGTBU 0qddGhR4nKYf7HxF3dfwfc7Wd5kkVRRfmk6O82pmyzpxQq9lxPxaL1B1XGqFnn9PjryCcSMu UOUs8nJzXL1XAIr9cIgTKEmYN9lxvJ20X98Fl/UW0UKWn+OdLMe/U2porE8KntXavEfnLP2Y PZlpek9Rdah3RFtNjkQOg6CxrLiFe56pU48H3cu428sx6rRx1MOlKfde7mfgBuv20b2I7HrV NO4kSknh0bxbztunT9ZXh1i8MYMl0S2niXg8HfWPjXWmnqq68fc9nHvNPB8Re/423duJTXsG JGV90lcFtP/J2FiROHIaBE+KXnn7RfOde3dE5hg24d1wlzrEcvonwy5FFQKhF53485bgEp80 yssLu7ndeYp3hNq24YDnNo2UgWZ7Nt9KYSq4EBJcq4qNAzE7jAybGicT4QmUM7Uls138ymEV HimjaRXzxbrHaiMpWUIICTCrEufZbk/3YOurwbjBj7pKNzOh2IzH6uS9mBOdCGy9WhDUM22k bCR5JB0It680YV9llKLYLR+M8WhmlHqSVZs63ToYaQyevt47NYr4OiX0YS+PL3rKHN1vK5ku FPbuEDs6aV7UYaeg5WwvXCPs9R2rX6k7ZCvgBYGdbX1NvIOQUGpP/L09+dPS1DYi02mI6SOX 0+idk4uyNwSeejIpo8WMdwb8VYTSD5oDLnwYFlyfeWNB2x4XJwoZc2pOK0CdaYp05fxBnCQs IrVea+ttke6+2SY2KzO1z0ZjXkmc9J3LL2np+ff44qK1USdeyeTsQJtui2inliom/a23cjrf 1to/wCKS7PKPTna4v70S/NIXfn+RTVxFUsKbMwPd2qYJLQRGoQwtvfJF17ssBiak8jHRL6Cr eRxN+En44xISbHHR3h4eHmXV+Fwdpmk+bA3VQLhfmYQoqZ8R11b82E7GHJySgw7dYysZ+/nB 2cZwXrcLw97Cgo9LPVzQN5R+fOWWjl8sh1eF6GhakhO2Om2s5OZEhMKspREFIt8GJlNA/re7 QQxFIURDbe6McqQuy8CdkMzDqbUuT5yjVOeIL6REVydoQJPzxgxwbii6f11wRShR8/ToppCR lHBhvQx4NVPLV0P2uJoPDsbUGRWVMQ1aZBar6xQpGq8ixkkfkiaSSCbQdtkOxRym3GX2Squ2 Hcp4L1b7LXpG5TH8aQirjmFRCfw1zlwTx2QPZNa0G4uJI2cXyaAUjuTi4hrKTN9aEH9HWpSW 8oh5aAYtKwkUCkmL/jSLUqGpUizGHcDtdEtG/X4zivckaqGLhlhSv91f3tykZapu69ASkpER JXRZlg34VJJJ0VA115h68RizP+z7cV0ZnPjmmI1DlIa/wSvP96Xv9hPhNDRl1/2lurq6w/Wh oQiyDIKitMxUwV3AChCein3CajOQFatO6zHhaUTmjKeQFUwngxyI1JetfD7T1J2v2v1S6hZ0 UM3mWcdp+4coaWrFiMyl9g9nPt6h6b0ysqSO6o7Vc9X0V0g+61rFGk723yxKdeEgQ+NxMn17 h8OT7dmgX2hyNbaCuGG1DTvxhNTOmyqi3v/sIAn9nnJBhJiYRoDuN68bPdZ26Bm8WyU2x2Rv 1lLXUgoGC7nP5plFBYoe/xlOIlHySvaEWTxsC89OffN+wCJrIsj/eAtJGlP6xvVpsID8hbSO n+895Yt+O6NYBomwLOff5U9hhrCIegN6z6fjZczcJepnT0bU7H5uRNFsaqziJpwXamklvcNx ExXGoWIIARMRR04vlE2dCsBOHzcTelNA84/5nFXF7UQMRGZQqMYy2WppZ6VnKWzeEslo01gG 1zjNkjKL9w6k/2r2iq6DpsoIZ5bFMmtysBd5yghWGZAJI5Psx2J1SgS5cocsdbJDRD51M7xA KIzS9rzbnWny+23yq5V7d6Yu4CLZzrTJwtqK3zDbAtCmU6jlcOJXgmQysQeylLyuDhSJr1fL Ts/6cHQ7Pw7tckf489580APZ3fnuyB6SHdzEFywxzdq6DV9FtacezN3ozQ/fu+s/6vFABb6H 1LtCq/kqZ+JSbVuCsZMPkB05i/dXb179PV2k/U8X8Gr36E5E1bd91o47//5yXhj2CjYZ5rgo 1DXVVPWR1tced/SM2+jiVV8ECPyCLW8v7TBPNZZZbnPB+/J0mG2UE8Vx0q5soG1u/9woz6ga MFnXkSzIE5JGnIJ00C0p51IeI2M/XnmIO7pdYCh1K9rjzuFo0ZC39PVKR3u2bMBBJ2Jv3tIi 72NOeEaE6OjUd88SlreChYSWRmlkdvr0niXMYN2r1q3VJ+vPH24dFo9yRicG/gpGmwX+uSSM /Zrtb3B6E8VZMhzAvp5Zqd7zpQ+H1aMaDg6KzwRzQ8x+QKjCDi3sFcKT6iV4cl/nBeafsHEd /2AdSOQUSTFt9h9v2z9YjaIZIrlYDL1IElW/OyIp+riMBWbRJFSM09HcWuYa3jDUMW3+tOW6 vntFRHVU+qbC9PqBrElL4PH3diCOfqLCRAUARwxSWrZYyCTSuE2+f93EVAIPVLiOw3V3SgxG qm3RK59PClsd8Qi1+Bxa/vI+vFPko+movm0V7TaQuj9DwKnCb4kNNXONCfjS1Si+Pfa21Ux/ JYupeDioMjBHJ/0IOma3ImIfoRB6VpQdeC7hsUAg9+cu1EIuKPzT1cLc7LSY89uGdkRWGuJe CBM7jUN/lGdNze1iWCl/Ad3x8oxIwlSfalzg8T0Aie2Tawppl09hmTBm2dp369TFqZiURzim /P6o8fDRZ7rrJhUKAUenJcJlzDTUZf4zDddoNzpkKC3JmqlrIwnD5+vVr2FX51SH58NKR/6V KkgtqpXTV+UWWz6uHC+rYSjrMwxUqjbIF23UVE1ZzFw2Jgbzl/Y5v/wA4tqocQ4iZnKet9kW e8IqkCUXYMHROXIu7feAB6MyoKyxe+JYJ95pmFlCX23xdHy0+pBmOHCm3n2vraNbO7vJuzcj XOTgrGY+MJbpNJ0VSEGPERAUk0VRhHCuLEn7PqB24H8kIeDW1FNQJ4qZcaabapY03rYXYUG9 tirhP15uy+P6EphUALhSvTy9emfBhXsjYKjohjQpjvLMdUKxoKLqKYongxPLz2fuX8TiipmL x/RlU0Y17BSvz9Yb0Pvr2eK9exqOa8ikL91ke3mAts4eC5nALsxaHWFJQ1OSArTJxIjHTT8j TaFE67gj/vyYTF9GQ1Li+rg34ooPLx3T78DzmBtWYdrkEfeDzsF9ena5sdZTfdyAjA8JffP1 to4uGF/oh87AKnHC+SRxMtmY3QvhvG+X7xbkTxve9fwNkau+78cBOIWXZdH1N1GcLen8xnar fmLZhJL6mfuh4/FLOaZvV60ZPQfmI2Gkz9ZfdgBxiZghwZvQd6HC3wI5KLjV1FQV+wA4nYGM tD8KyqsT7PQbfeh/0mh8qjAB6wgXPSaBXd8hywiJJHFIfFCKAd5kq+nGu/YIluguST6aV/LN TO2kKzxO710afBkFeEOmyonNiAh+um2LDrjqW5XajkXnh4tkXAMYxfFgugBzo7wQA3izT+Yh 60QUT5bkXvBnd1iKjfIJc9mNYZPHOBndUAtTaXZX+Ocyrx/wPhIUyCXsHYsY+fBoGo5azbU+ /lVwvFSmdeHbeBv/JuX56BOI4lS/jwU9Lnp/7LzRCthCoO5ZjGXQDIdUTi8ni2KeNe5zGpto jHVMhhy9dDfO+n1cO5lYMqxXpANNYH0qmiDJe7XXghSla84OsnC42gasKefJatuLYKzrsD1b VMoDPyxybSq673QaybxcP2/LV3lxLeDC0qjlkKf1Y6pYIA+u5ZCiCE1n4XlWCh6r2dOvttD7 vjxyfWGK0qJcrmh5fcja0JTmmz9FAKJxizhZWqIgXFkuxueGfuOGKRvTfOGoNhrL0hSwRqry iOiPPZbVriyWMfoGzyXd9wlR3hm+F03l+XGIktc+Vh9SVqzkn2X2yg+haKnMuHRIEDWVR0XH s/Ugm8tgjAmGNngVcSrdlnsC+dD1SbJzHUD9j+Q/kv9I/iP5j+Q/kv9I/iP5j+Q/kv9I/v8t qXK1U+OAKQe3mC8XDoBrdrBI2/n3SmyW3VpZtNlpEkH7B0j6mj1Z76OVyag3cv+Dne8ManKL 2lUREDyA4kEEhFBUFASUEnpT6QISpJPQpAUSRAi9WFAQRIrUQAAhlEBCgEAooYgivRNCB480 QyiHEpASuJxzZ26Z+b755pu5P++/PWuv9e5nvau8e/143qPfIzItx7uHgI1ZBn0v8nSanYs8 4VU7ZuzlRh4f7jlsHB/N781FMBaLAZFB9J8Tn/S41mebfde2vm/LLbcPZKsBgS9+fWlWJwV4 TzUEj7Rz0MZw4O212rkwBt3KIXh2seqanRmelb6XVQtXXPl2CsM0JzMDmXmSTDaXfH8gaRjJ 4EgOWTvYAHqL0k2e0bVBuaWYjVTssbI7fS5XpGzZvehWf7aaBvDFeFXIIaVvzmf675mDGn2v ZwrDIcFLCpAx7mgDO4Yw/eqTjVlSS36Oq+Vco7rHSqClVoQ080IOT+K+zZNcUXorIzRwY7oZ 0bOXpQWWuIA7BDgU2e5EStE3zh3QfO5izDGzVbgngBpsDsqhTvb5SsucVH5z8Fr3gyINW/Nl 575qN4hMPGruh7scXnsb/3vlKiCx36AP1ASLdqUnDRWIm6BQ2YbkwIzRAWUpTvTLu8bqwbvk 9wUFd8q2G62HJ7G8LVk6PiE/pnG5db+ZR1seepSRVzVLbTYHk4ZcxE1yUdk5Dy0dWgxWigcc +Ol2NC0V3Oj7gzWZu8IyuZrhOz9mBXtW6u+AAALqybaXrtKMBYDYWmi89DO21Z1Z2zNMC/Cj bH4FxkpWDtNgCiTa4DIOUgrAjKn6hlwn80qD6yMukhO0GUgbGDmSI/ZAoQTw6eAg1Yh3qUi8 wzS3c0Yolk6Uwgo/9gKGtcEBTRs1rfeEVw/E5SMCGPm/RbM6kIYN5aePE9BUZFopQ0d4kH0i jvbHalsYmx2kj5gTZxwRC1yJ3lufNiTXV5ZLdu6l1jgpzukxOAV8SMRrZwIQWwesRbxDYTZH dKQ/VsewOPt4Nhl5MePN7dFsngEnZj/qSrxd4HptyclqzsGAZkToIW1As9mAvLcx3eBLB9l+ y1aBf+ePu2ZE8+5r69fbODTcIEbs8eiPjS+2jSZU5do3ZW8dJHYtnqm24Erhwjoo3RFS8n+2 es1NB+voXRlEW2dE299tjtj+5ErXwlTahwWdSJfU2z+rTY9VmGoS/LUH9HlQfwxnHCC+SOvR i0prPX0aRG/fmrFNJ6QBvuVmOrxsyttaWZ2jrZ6Rp8kXDlFFMLgyos1lDn2vSiWPldzZRnh5 79CacU6Ncx+7syeMUjL2ri99LuTh7tXtqUVVGXadQiNaWP+WmIRH87utfO57IGXAS+KSmEEx WpfxhVMfqsUPo//AbN/qbJrCMLc2xtB/mu0K69PAqkQXsfOwTt0bwIrtpLknwZFh+PYZVtJD 2iNUYdYg4mo6b4w90YXp89CSGf9igSFUcpTy0ho/Ng3j1z+7z4C5tGCqheWWsa/HX/vOCaUl wjppG4qXBSYDnvp0dq7F77aayM6Y7RlOOcBNPBoTd/LZ70HufowX4GhIbs+/bqyQzA9WMKrp i8WcxQB39Rlz6wG7IcRdUG0graEvDit8B2fzILbGyedGoAr/QlAWGe643EYbnzSxWpYvvOIf sGRkKMP59V0jGxuD4aa1nL2UHWPC9UmUpidxGvMyIjK0hKmgnf9WrXAGb2W8imYP++v3lz37 uJNxSeNZLXrQef2NAhZ34M21D2CLVTgmyyAekITetMrOk/O7XHT/Y5+S7E75TKhwPKoohfxL s87yEcaENCrjUIAj8nwwOxmZiECgRilrFqqUcebMh8wGnvHxlwizrjpR4wvtTj/dTJ43drEA mVlcZvRXboBB/Jozw8py2zxbhT/Hq972TxELHvNSxQqUMcVuZppbVdOGCCRPmSSTIJi/pJwD 3a5SI1xvXTDT46kegnZqCp8i4uw2h0dC721l/yyCjVvweNoFmuMEDMBoqUIvj8Yc7IcxNheh rom8vfvFxvyp/LR05eoQ+y8VT7f5H8O1unUypDFzDCevjNzZlKtRcdeeJtZ7GnmlncKNFq3y Epedqt4/2DfRz+GeZg/q9/4GX0BE30SbrAhRU4aW7Lkz2x61V572dq3T7sfLQRf51J4dYxhv sHluhbU8oBCEOi2BnpOwvX6iVkNBe4S5rfRWMm+gdkVMaxo99e1FZZypkCLtIevexhQpsNbp oQDrnA6LIryxi5y9oPORHn4Tz1HyqRoOmpcZUfG0Y7ed7333kfkb90Ri4I9xNjelDZGds/oJ eSHXNbuUk1L5GXqTlIcM/SxjV8vHvE4qdUQPXt6ysjigjG2lCc95T5TRBazefcV8R6ZQruqk KdV9Ttm6RcWaKwG28+RgWNODWnJAtwpmJF9AEPwO6N6oJMcim9mnrA3AoMX7jQdEMb5s6VMh ARxjbt9fmafTRQOyB98I49xtHgy+zaAnRaGqW2E/LtUeFQV8dePritvT8ZzRsdwzWLFt8PfP PmMkwRTMNRy80Rx+KFWQOayXgNIyKXhSjG5HW48lyEpSJDM+Evi383lo9toVjo0pw0hKiYhe h64up8DucfjgbFx6wuM7bDndihVDqXeJ6/I4yZXqqQGc2ZS+YZw27Rd2pCL2rGujpfls5I8v 2lepSUn3/0y4AVv8JoEwgFK4pjO/zKwgVYK8zn0dmWGrf5mIRCHKT+sHF5WhcEVgvHf1DSvn 6lxu49mc+m17A++y8V5aABu19PXfavURFSDC/o808EOklKC7lqxcalLvE42gX4NOWgnnkHfi +XzPDVtqPMGYg6aIOeC1KpvKsu/ORW4ufcGXa19XEHRJ6bd07QEV3K9fqN+PWNrBXBH/eDb0 z/ForleqwQJK9X4uzhbo07jop1IEnyY+mHkM3RGiN5C0/Ni9b8vl6tmofEQp+bJ/dwnjHmUa /oUpM4TxkrxZa24gxGlbQIWNhkr2rS3lDVIltI/7RUSA28r0glJsjBNAUEDQFa7YZL4pPX4T f1/xRaYJbTpq8LZJH8HaUnxFF1SwrU+D9/yyR0qlcwHOym3z9d8VjMrJUFNUlwsUmulI9epD Q55qqvyicytQ7q2xf7X4QA9VxDso0OozqX6PvR1zH/FpD+nC35CCCpB5Qem9Sx//hOrn8Ns8 wNa72Y6UuKwoYMn1YVoqa5M25u7mwoZ+lrcIynbUe78w1AnlHs+UBHtMJtk+9eRAoDwgFTSj rMB7HyvsjfOzFaddXHaKb8vRcstlIXp+IgURgh6qOhXPtBQhDGkPBGuXHK4NUEygKQm2KoED 2Uw28u13s5L6e5dH3EG6psYDvf19DtZ1/osrCK+dYcOkT6L4LxURCz1gQfOp8NBg58ejk4Yx i/S3+/UT7FmT77Mm+nZ0AwSIqUnVBq8bl8gZbu26NUUgJVxw8i2EIXR35Gbx3rjsTQWBeo/E +gDdJJNB3jj5q7GrGCPQ8nFBb+xfkATmKK9rvXHUq12Wti5dMUtIysXb43xTIIHJ9ySJWzzA sTVXK5KEiKBV4i1EKQAovmtIKJP8njmRPczHM5ntvrS0tHw2nA/Brxy+p2ElUzfG0pOeTa6P GMeOi9TweM0at0ckGHduF2fwfaLXSKZfJBYCq80MOsGxbH6qeLh3AppYPqICPs4HWdmAV6Jv 1qQm4BqVemCqq76Oine0XbgfObhbuISdkxPZ5kudPzpiftMcssayUm2gWSjfo+dZSjsY4kEg ef2Yta+8nkXevGE31+i7VurkUEEuAnYHLPUXTi0ZrOr5JtxYpFva83mlXDL5UGgdqN1UEvF3 RGFY1yDa3BBQAy/o6m3QXmbnvxN+2K++IF+7g1x8Y4CCn9PGrKcgeaIC36RkJvUpbB3MoqZu i/IAa2yIWdOU1Dzm6rZ+yv5XawucEdfwaZ/AAASAz03uplsNN89cOFAhIorvsxWVJg1PbE1w H3TXeCleCN+bZSJTReO3Xu0WIP8001TJ5DGqdV+DiOEm3lpDNBsjuZhVneygDs/gBXCBvWel Nx/D7IiEmIyaVK8ihb0HpZSGgmq42bIJPomMFeqkNnZp/wKh3JdBKuLLZSVDij6fA4QL7YYx Yf4ocjCkmn1Y3yuF1s3/3ng1K21Sh/RTQw9GfGlt4Bx3w84Fap9NQfHQCkuMQFPlmn6ToJCw sBcvuifjQcB7VyCf5fIyh6IipjuphpMSCMMVzhU9HfCwSnri5MFmQfS7cIFxHYFPC2/30fEg WWXlfovDLm9UeZwIrjLRoPbBYugRi37fDFcZIOOKOWg+36mmJ+mgwT6HQLjp/zri75jv88Gl I56GvYtvUkPukYmXtw59LMsJCmmypkLqIYmVUjVmxKQpHVL11MQksdrsAci24HXeHMFY3C6L q/SlYwGmweX93hDayKbDdIFxAzi4qmg4o/92fheVPZQ2zOEpSb4NsAAFykmmYd28ULvZd3H1 vMnQTj950QTAYm/7HxODkDoPRNb4bVGsyPTwkmvlA/C6ikvlElBfj3yizfwXZnx1ojSbTIn8 WwPpP/DqJmKyXnLY+zMeUiB3kTUb5/90EF8p5G4ypTKEFjCYsTjbKnrLzM5WEefg8sLbscDj 4RS7wWgyujDehhB1D7cN/mOaHbP8nQWR3geJ4zdWwPiKcUic3ork8mEzTnSU3a/kwSVvhUko a2zH8DD4JkIVd2grAAQditAuVNPIS93tlNXg+Y023/4PHg8G7dKdwbaJA7rxx0xx6WETg8QC L0/LX0+VlHhFP3v9CjAp3kqSoGuV4KIW1lXGLt11gzTfHrfUM4SONQFtNSVFGp98KhlRdwfK cMYgedASwjS/f+7c0Nk5p7Gv29KekEhCLYEdlZer8c075gMxxSTuETz8aNMd7y9O/1Z1aiEt 0oU0ysyNeNQawZBwWc4HmyaNlfKo7lmb4cy0sdYb+BIbLdsRUYEaaXb9LJXwn1/hmcRQIV9x oXUu1fiDVhgoJaF6xAxJAilDPdI87T5aDd8mg8UVFLMloOsqTYcjWBzXXwvWLn7vehFRrlEo YMhlSZEMvo4BZ2dvkB2uv+c7VKDGDxoRqxxZ912jajSv/aYtKfut8U2TmHjg5NJXdmSNmGkM o1DVcCXAthaXOb76qLQXThSrXlroBGuWCTdij20wm12TpcyVCd4Ta9SjQfdm7btgjuXZE1dp G9uLabf8DT2rhcLRNhjVYiJ3VaeKRRIwwIb83OBbdXvqG4w/KxMGZlu96Az5iobgp9aKZuF4 nXi74DVIY9j8K9hxMYME9bSGyss2nO1TYXByIEqF7Jv8JWA8N9IvyY+5wVRNiRnaznuOhGfi tBRK+tXBqLDziEAYPfJAnuLJdT53wBTAXBEaHCwntLEpfFpz76qN3zFPNngW7YhS4ZgyaHw1 3LagVbf1mJ4ODIASPONf9EHB5nY4k3AFTcdB/Fkq+qkAQkFmyRnWo0MUDt3ESJFgyD31pSy1 OsaAsef6D1/SG69v0wHj/p2TZrF6ksXGDYSDpNiaQkSPivHHd/Ft5csdzn3GJVnZ18wtTSf7 WhsvT1nGYXDS6Y0NKB7Jle/fGw7G384oonw6vhk71+0Jr51MXYU8RIZ34H1sCrO+MzVFWySU F/La1cZdkFO1uux15NHH/QA6/cCmZGL1L3O5PCIkIRdpQDJGpa+wIJrkN6Qoq7vcCusd8zAh xW3mMzfocbw3iz/5vyvv9rdr+IbuJ/c19lPW2vqNdy+uuxTHsejGn3MWjAlveAl4UqrxByV/ veopwbJ2WUfaue6i83d+gFu5RpBTrUbRodrzvbP4mr/POdtG+w0ll/lDaqvj9LqpJoV2lLhY fYvK7dfvSKI8Cl4KKpdmH9hEJjKRjOsjdqQdVRq40IZedjL51ukJ4xSUgqL26i3EtPknH0wX ObhFXqqtUhFl2xiigQWFCA8zsGWizgSxsY/2A0dfJFmMoaSb4grCWMCoXuvVMa51GkJe0pJM n8ym6aAVVL12hI8WLPd/MWN4padQQo2WcZIxAZVAPJefXFO1f4cBuMScoyt4hthPRxrprcdU vMyznO9nlnbqVh+nWAB+sF7Pyk2CTK1xlkrR7HjQ9Y7edGFrZHpWcbCpEDyylxldn1Bb0mF0 xbmf2n8agD3awV1cPJJ5YRYsH0qhFdpVwFjbDhKqcKfD8S9gmRHJahfLa/xhWlcKwFaRtfW8 +OBh2ajxiiXNTCWh2p/6HPW7pb2VLs4pnfi8WnV1LlgEVeY/FV51butSrcaMGz5944tbIdF0 bTf3zxHE2SXnMIKnr+1U4XT7OmTU9k0DGtFg9SHwXiFJfRjxUsdrU7vYn9uUghMdJhw+Pc0E J7Y3pxOr/ifnSa+VqadceRE7f9LCwh3NbK0YOcYf6l9XTBCm1Et7YjBPXD5n126xIIfDcfuE yqF0OFdlvAbIxbYadNpMyhuSyHXnXVCQ5vJxeKkqaTw10HHtRDjDg/b+MkOohVQ0a1DTw4So KYe/elTb4ZaAg0w4QX1C/yh/PGaBzhxDsGH2no7ATL21rDUnDWDpzFtbzHNbKS1c7kPftz6u dAx7gpGXwob09p/4HWMvWt2nRtyPuHemb3Zgf5bfDTHrVLWSyQdN1z4qhfVhl44RDVTqWG6w 5j3NplbV3gzy2ukd1xHL+CIYutgcVQVaVcFcQQzI3nIQ/hHYsMkuRgSZ+8AERBbfnP3tmF+I WClLonhqN2eEXGru87tFU5MjYmCWbYsyNxAYMmJfH7CPb1F4hlHVUjGC2t2zJBey3TFqzzEu PvJUjph+C0gnZG3fxfkxU9NHjVNbjyaxoRhYq4divR2IMDJvae5i0rvINCebyRt7tFK1cli9 ohMcSIbRFHA3XSaMcGnLcYb6h2nmZcL6WO21+/STspXC8hXWT5MUGSrLqMbit3XDCrw7pruj 4Uj5Wr8DMOmtjCRF3MP4wx3c2lfeFq8PDlerg/o6jcXL+4f+9nWr5gbNsdmsH3Qy9CJzpCNr 84me91OhNxANa/xrehIA+9tEUkKElcNW9njdWNE39DqGgmCrlHHrVoxaeDFj3bnA5bwTppaH omBiAzCTG/bU4oqX6LLz8ej+eMhoOPktv+LNvAHCgz6ZeaOZjpc9rARS6pgXfx+CMN9j7nJn bF/Or95++Z3MwAcLtvtvI9TAxxAxjPIdIHrz/ozuZ7gUBDlFVud1sN1LQCBHjFfI9jJOYNhm qunrSb16D7DiWF2mylytRp7kubiTj/zDjdF4hMC9iwjbxrtIbhpHUzujeHVbgroeoLniPKNP cwavFS3hh3rGmrcCoJVEYFRcu4wH2MBuP0++Bac+E7Yt4jl7xQYuNN8H+O3tkeA/ZjAjg4/+ HvILHQ3ERz8J0cdFg0Ju46KfhlzARVuG/MJGW4d0YqNtQ0qw0fYhMdhoSIgH1urlTqI1/gL1 cwVEZPihY5MzOr2Jzp4MWaJIGobY2OHvUV29m36i03F09hRIEUUSFGJji39CdfVoci5MR9HZ 0yBuFEnbEBsb/HOq67Omn4Xp8XSJRMgtStmDEBtrPDfV1bEJim6po0skH3+llBkexNniZaky Hk0r6JYMukTK8QNKGeggzhoPosqcahZqkugSace9lDLbA4It/gV14FSzUDOrBs16Ug+OyKpT Xt7wJ7i33D0xlVPU1JmdwZfhba71Lg8RCOh9xd1gbJnMBf7Xpr8C0zua3PljEPNGUonjfCqR tDbZE+koSK70SehLyu5oGAuqOcjPYln+pJ/FEdxsK3l/PneR71wP41C9ofeviGX+xhp0XGgH ZYPfVMEJsoyfbtu7h/upoq7vFZEQqvH3W6s1n8ZuU//1w9GoXfXHDgtTr2LbHU9mXCFWDkXI So4G+oxzmU3DVH0lsUiWq1po0ehZT7pW8wbpu+Vzk+2T++BlxEHaD3bb4fgqMg4Rgux1CPh7 qnmbV+z0g9moSjtK7RXu19tID8f/XElKVnWeOZ7t2lmQcQNyuvmHbGW+aCgVFbSet5sZmf+8 GV/6O8dUKKrf9Is+1xdrurLx3yX0nh2OAyqp/T2MNW+tB1i2gXdIZfinDu7zOtF2GGNUPseg ckEuNYOKkBIj+u+44zlh0ldSI3FX3NZq7kp2i1ej2qNLvS1NUlybXmoej4ZzIQ/5KUE/DSIa BHMadN01WP80Tf1mRf9J5d3Vv21g95p1q2E/TEIjOoXrSpvmsJzWmvLZxffS6gnPrKmHQmvd ZidjxTZWc58HloHHL8WvChO2nQYM7nJtGA30e2oeOdcYRkIBoBwOJ9OSENj4DxY5wHFmrB79 l5RBeu8xurE851tSTjLbKmB2/JVDheHUFdh+9tLssjZuNrtor9h6Ss50iyCwmQ3WUENOazYS 9VhbgtKEqpA5siBNE2nN334WiOCbBSMtmq2TOTJ+UzlkGNdKxCb3pBqkOSwJxO8aMjRye0TM 0qpyp3ihRp0Tu3nGU+0sUHAgV7NMaCg7d8pKKKkk+xjND1KnXNOJSsjTgy7PU6/Ij+zXz+87 vQh7sD2xNf7DAjWS64gSEunrUMyPuZQ1SQ06ihm0VCtfZpU3arCoCKerqIeubVmEsqtXYlAf o7kuxPOIAsxScg4w2XCzSG/AcFjY/FdXtYlr78OX19WhxfPH6lpz7W8q8OA7pl8t6R7mJOya yPCyzF37hq9tLMCaEd89zrzMYSvpvzJbd3t9R6lC0IQa9WX4rtotPaPVrFr4DItiwlStz1nk nfifvhEBbtAXRx/c2iDQ6Br16+EhAXCh9xzeKUlZP5Z8P/VHQeruaSqqGnuGQh1o2uP7m725 8/V2cbMLsvvxCVkCm4+1NWKETPVyMx86XzmUqMbPffEV7Ldii0/JydKmJQHWOakMh59s7j3n iQM9vysUhGBqsiEppnqaqq/cBeQqOQ67R8Ps73sUycd2tE3IFZv8eD+fDPnAMKMEfZDHmuYK 5j5yFgBWy4CJ89zcB/naprlZ1zVDJ9H7vQPtYm80p8wPr7a0LO6oAqpmCQNCE+oBq21dI7dF P5m3aSSQ2yvPuKrk6ukWGBYEZWsE/7yW4yJJbY78DnCP1xsCaL4Xfd0G9PZYnj/K1pYrVBaZ LJhJHQnHaI5H38NzCfK1PnQ0e5Qx3paTiUIRXAICWPhgg7eFprtVX+gPMwo1GwfcB1aJXZff c6xuGniYGpsyXT/JeL29oASNLpS/1fbP73lxgLVylRnnE0eOCdLJF2216tA/CGKVAx9NH7+c +tjV9Z4thVOrYLtCVop6FT4QGfaFfyC/41u82SNds0oOgUmllx/mV/ne6KYKuW5+KaLmgHMZ 71vVfTz4TpajsYEbrq0avbEc3tBcjU8JI49/XelIGhbT4yQ83pjh8NSYAHu1NUfObxBmieHL 5TO3x/VXv4mJubh0PD5cuKNqgtyurKy8/JT6xlItYG1amtrcTVWc82lyEcfuVTozZSkITHfC n237HnEr8A9Gn43/2doRb3SgPryx8ZAIm3vVNksKPDl+80XjwVplwf61AjmjjlbGqpp10U0G hFqIU4TNNiLKbOQqX4V3Vuvprl37TEjlNPLMulQLn230/NTQuBe0hxcRAMIOIrbTcHdOU+BM dWv47wucR7RL3AdfjtlVCneKOASa7VrgChvIZlb+yOooert3U3ixccLjNaYf0h1n/YiTlX6h Fmo3GF0U5cpX8WwvNjSep7vMNTc9103qt5hEqhniwSS3vtq5iO2+MbVV/CZDMxzBoOY3Qkhw RuAcbDwjNsYiCUUq4Vh/sfpZDipf/JBWZHPqQGsb1b1JiHJXVN/b0eW1/NrMmY6T51/42FB5 RoaSxZr6TXUQMbwTilvVxWfuLPz1Fb7e5+V5ScO3hZKPK/xz64ewWeN2tSK1rShO2YIXef7C BRy2w4D53vvhUH0Tb8kJS70nBqVMvf7AX9nDyMua3CQYYw1Z41XWdgsYu7skZfekduSVw3Am n/GvlGGvoZCSvd8XNiBejngXZ0LsGYHJhXLOI/EIwuv+O1LUhMR1nMhceWVb/7jBVKOTd3eX sqt8Hg6VtqNnIFNVXilVkzmdNpvW+3j5qXId98Bg8rE+lUhXLCGljVvqWus/MUCyRrioc76R voNT+CluZzVeIqaUZye4K0DjH9T3NIis9pfDby7WPPZ2JLiJ1SjrAbmOOU/OMymVa3nNzbvU 0zTQ1lemquOzvlCF5VD/eHlx+po7xWGi2f4t2CvLZ19vRHn0Y8qwg4JJsUOzXp6nsbekGCY5 ZYf4rJ/qXSj28DShyhnHJa6wcR3SOXdfE9YT6cnBbmpEidERpKpf53xhm5LAtNTSz2w804UQ NnJhBImX9PyKusWHtlzDBoZc9F2ELuMYdI5vvUylhpoZxnsnPUp3ELQ8stGil/cV7qW4VXdU JbSfM0JNmBV/cmX3RuD99pYsl9lAacYE63lk4hGdux24ylQ8DIi0zksnzUVG/r7Lv5l0jhHU sxG+cEe+V/xJ0L6PA1rX6L+kr/0npDZ95mOunY7MtP+AIPgv7e9fgqD8fQX5/yWW/48ogvL/ HYrgfUX5/80RVFBSYv8/OILC/284guz/F0cQ5W73p9GYbnwGz+W2qIxLT87r6Dy+dklsKeqv EnG1jZMTto2mQIu9nTPdN95xlmmckej1x5f2fOe0aPK8wnTu0ssz54XPnL2gdeb/L/+z5Sv+ V338NZqbPP9TnGd9vtelR7cS/rLs7b/bsVes3SpdI7FK1+GAf03YtR0zGy1PXETWo+Ki/lUp 5bYWwUv5Yn+zskMtwGLTiv8Ip6+UBFo6V/UuH/h0MhjPX/172hOdczY2rteJqz2rgRZJ3Ht/ /Atk/9aTbbLsK9yRy5rddriRveC/UJ5+1MovUQmG9X1oiNRvzuK2XbzKrviPgfDY+fxc2f7u DOyu69LcvOnCQXmd0r8OlVx9xQO8yDKVJmgGVSh4Cyi9env96r+gtx4LZ9y5PyohHQe5eJIc BtDo2c5+Aftnp1Qvr9+tHFuCX6tJYoEebwx5HL8Znf8u+PCfF6QlzVaXmv+511IbXF6Vo/R6 7Kvms6h3Ay+UP9v/+Y+Thtyd41iI2/ue5IGlauTQdORvbLLRu6x3p64m6p0rQl/KKgR+qp12 UoWKKUkpIJt5chd9gfW3/gGbejNx5XHs1g/J7t6nRDnBXXEr2z+GHoffkv9J6Ja+Dr/+z+nl F+7W2hi7lVeBgfnk/CHog2/u9UhD6f9B1pWHQ/W+/e9PI1uihCJLyZJQDNLI2ErF0GoZhCwz YiwxQ8oSFYopJTQYQzKyFiNSqcSIzEKyDBHZdzJ26j3n8P2973W9f57L+dz3/dzL576f5znX 2Ar+LUngACKuBH0aHv2JgSrvOjVW5lImD4BVX0pPyYAvsPhPY514hUhmFej9tMxSrht/y84s tNPjUDeWUmJjJBiNyzznsQTdiwHN/aUGUjd9OiSprxOCuaqpwcd+0cY09k5tGvE9gHi/3BWX /JVhXe5HidDKzTGjFYuGJhfcG3CFIpVmpKsnpBuXRaJ7rC5MdslFf9AqqGxWOyH0H6nlOq/D slOyoKBwfne8DY0z1W2MucCJPOLoVe2pOTzyHylkIxsVoAjGQtVSfoRxCFtOsNdnFnphxOG8 GL7tXKqpfWILw1PiGf0fppVAVrjNKG8tEwxPPV9kKktNr4Cj9nWit/p2mNQK/pwrPLuyyeRi LI92aPLDqwOqkH3pRkxMFwOj/7iDgWvrGlfVd1fQY8bbiKWqei4V/hqP6YoBAybGo0NWrCZh pRZPkmQQ3ynbg1NdtcVStR7s64tlB2g9ctwKhtxLLBZBU1pP8NJOy6M0m8IDOZ8+XZHbsmXL +jqmLL6p8FY0O7/q1pubUGLLAzGuJuVIeZegnX/uC+a47H2cKq0uaKlYZtAjGsX+rZnoyAvl kZg/Ge3stjOd4wunY/JTGzAxfHwP9x4LuGRKebBt+1dPwWaUZ8a1WmySk/6P4yBi746ZLdIX ySH+Ej7U4/19xnkTdlqMq9We5z1rscdST2vwgh5/LQAje9yGv0ybn59flEMWfproKOlX/qwX 7ugEz0bHBtVv0Q61maTXdEPeFIlEkA/qWVwg+tKyvzywwJiaKutER0dbpSd82wWMGV9LXr6s sJV5MCA9B09xFACNEBR7McoIOudgmy3J2o7GKaWRjyQJx1yxSgRiD89CA65QfY9/QwBdEbLf BSGUAx9lRNHWV1u3ul6Wb8bU5FqRET6mlJgYpuf9phl0xlCCN5iX/0Ransf2tNsJsd4LnSjh NCQGcEj401f3ZO2glIRDLCV/GGYzxrgNn9dOZUZbYrBs+rWFCRLcVzuu6biRws+nKSEDiI3I 3xpnSEsbtO9Wxe5rve5aj1MiEdNF3NwHflTSlMoSlQ36X/BIIQuWVvoW9gHvD9wxyofr76iV Ni4MCLo+M6JJiKzHKNGamzWls7NLO2OFfOwUta0BU60wjxohQiPw9J0TjWPtJB9s96wm5Up5 wBtwOFxo6Npn3jD/HEWTuTsKs+hWW9FFEdBsSVjyOOryylV/3VDVDpTqu93R6UrZIXeoGUA1 xR0c2A8tziVRSrrovOE9Fq4Fra6nTxiaqF8u0WzAuf56TLx3714cBkhKc0/lmMJ9d5biCTCI QqWtPuGUyCGUDykstXZPH+LYlvP5s2sjb9yDRr8NDAx8//4EaX5V8rKnalYfTZiC1Nhgfx6g fr53vLBKSPA+HnDJckUinfiAxFTK1VA2NX93AAigEkW4ANTy+l8t8tlwbxz3G0knqraXgcNo vdOSqUs6lHL47BlPwSY1oE50Q3kq/4HI+AhPHsvEzU2FjC7WhGH7feENE2M6crYvrc46P2oy AXLD7gTUExJEeKhwGc7uVe4iJ4RYPsoIJA6zHl5++kY7pwml9S48DIMZWpn3bnf01DS6aMq/ XBeKOmD7H7BVdcLG8NS6up7bnaZFllgv2PlB3NqvnDMclFYaqbLP1ByeHXKLekcBWbDwu28K Cu/dT4LkeZnf30gBRNl0S6sGTDvWl8Fi9ZRp6t+siafG9w8oEu700t6jDrRvanDEvvbBtnXo iVpgqXBebDXmqN/VH+UiWp2MeD7PMf5qbKsT8ocBmLPvRevH1LijiyIv8Lp4rQGpJK/3NyxL OEyHiuk71xysEpvUjC6e4kc2Np4IkIEaj6V8Nq0jd5os74S4qBDLiy0lNUxMdR+TDp7u0czq Pvf/TA8go92yCVF3vnFy8g7ZvmQ/ZQ6U3lyc6v4YMZ0Rr5TVfekW9QGQRyn3NnM/7dMYgnYZ O8wqeNkcBfcAUjNv4s8W4bC3wyZpVVn/zy9A8ozj8McHpLC3mbLH4wH3ZXW/zQNe+z8Wu5BY v8rho6h3rEuIi8Wzdcyu4F1pBtf1DP/Wf1mriVEq069I8q/9vz6xy6O9mkQRiWMw0ttnjtlR 8ApO9ikhoYdyh9XUjt/QPpzF7K4KE6IMeshWbgfTRlz51X1W2SRDStqnnfPEHJufzkTjFk5r 3HQ1Nb/JrefRVtw7i6a3i1RA9aQMs2khlZOFKW1KXuOwkg35iblX6j2FNtIxQOvhBm3fFztN wDzUn1OQDpMkNHEGBgvak7wv+WNKgNfZGQbt1xcmRi+KddbwAQ2hYLMhSPM0EjBYRzR+KGzl GymJNTRluE335p+1u8J7mHcWPJ14gXb7A6UoyQOmyleYF6KlRV+cfJK8XA7X0c0XO1FZxyci B9AiST161sTk4kZAf4/19UA+j/40TcB0sZ7DD5ENnjpfx+k6OIYu/24tsD3srKGRCnCML/WR ENSmCTwF44ztvI9Y33Mj+jH1OsgQ1TQSw+ljuI8ZgPmzNiom3hTLzv9w500ERLXyM3zkq10c 7mvpLDymmvPrWcMEUfjgZA7YE2MODkhtsEwL1QxP/VD3RTa96jGjp/NI9hlPNgVg2NgNhhWB hRfA9fu9vDpXuEV4qmP/LwvOxGRXMNIdlLLcvyHlk0AhQJiReq2k4KjjIQuuzbiFqe7VIz1V iYBFdif/LfBDeIxI9gMEzdQY49ddlasbNihloHdz8Y/p7umfaWynR36ML9oB4lCOWfUuIloe EY2xnSfUAVJ90YvSXR3pr4lZnO7po+UflpsCp1AjJ/7CPFpXcDbriTc+LUywv/+UwKT6LNpJ 6fE4RMs+PN4jqJiojh22EuSqGz7VHPDn6laXuAIU65uj/ovQSHiilw1qotJ4p2Hni5t9ynfV DQNvhcojG1vcA9Qhaywyr5Dz8EPVnOGcnMO6A2VsQSAwhPbtwdtBH52CSTUD6Wdwc/abBZby A+Psc9pzSe0UvCEHmka1I7cSqHVmSYCRa++5dMeFyTQhYYr1jVn/OcgA00xNMt1KdBSVZ5bI WZxWKjtci10mnSmGgSvMESjMoaV58ZKcj5CrQlb/mPKzDsDldnZ+2zlPM38p5wuNVFagG/QD RYaqzhq2kjgTh4VPAgYot9R7QAYgIpXwC1NVgwAXaZPWl2YV+IlLhWMWsatQevPxMMcm4nAL 3e6Ymi1gUEM2UgMYl+AImpVoCyBwmE0BCsJ7syAUeJijjE6ugV4iE2d3a4EYnrCXqZwCpf8z WGormp8V/mfNYwvFGt/q3wUuMeBU5kFy3lnDMYYPxgRgku4nAcaQX09nKpKBuq7Yiiz49bgv AyqIR0aJCCGy/DcSB3V7Se1h4lcdY3ARspESeGq52eiEnPRS4Y1D0frQdG3BYzmO8lmRTa9k HQDK0JF1SJIXtMMVltpCmh/lI59M66PdL5L0lYT8JFBGpX1Ub196GY3cQRnEe1WqgZVivb/p FYvLZYkEqcSewt5jzqCT2gQXBcHQfoHZt5FMaH//rIpQBq/7VmpD5LS/KZrlDg+1ycr5XGQC zkzwyDrCQjmS41lCEv5FO372cPtW0ApVwBskcu7fi+9Yx1uB0ixFvTkLlaZy030WToxgia3F hlDcikVA43j5y3Jof9enIwakD706/eYkNDkqN5WyBjQ52yiDEfcrTSBj5ZtSWWUxiOY9s2jx ZIFFftDMaVhn+x5k4+rewDBogDbK3IKowYrbKf/YD7JeupjnGSyi37zB7DD5vGHjMiwwBHK/ caYBef3n33U5ZEGdSZ8G5P40oy4AupzhUrwdtEoHsApoeACZA8IUN4SN3GIBlIr84igLTX+i I3dYM2heCcEKyJafMMQzeGjy9JmhMTCNnlCMsPho9tePF96YgvZXKokS2lpoge1TBqsLiwvz Ittk9a/9/s55VCKUouFMrgzBTlWv9eeyJZ1jhsmcLa74zPCOYAl74xG+hvltgdcgu41cAps4 Qe0cp3ZOn0IjYeE04mZlNGBT/ivHN6dAJccURXHlhK6FDJn7rIUp/cwRtVYOvWE3QMpVf2eu jjZOP4MvXKxA0FO3gF3hP/xlFi6NyeoOFZWsoGnwDLX6Ba0Fy37oQVgwaUZ/5zy0TiROGHpf wE5a7TUEO84/PDo8j9GvSCksFDbmOEIaGcbCBw2memEXZVUQjWMTw16v4Ycyr/VYu5kXzD50 5mgf2dhVq/M4JHmhAoA2eEz7yHXuUsIoLtQE8e7aOKsq5qGsYSA5bK2MO9+1KPexdQ/SwQFL UPX2/rV0BRqkTgvgkhgm+efDiIKsQjwGAUyEPzyFgFhFLKDrPEZ31R7WFtsGvelJutXAcIX7 wTg/056wrMh79lQd0dQpGpkA/wVdhvZu8iO/tUSWl1bjm0LdwFTBTReYG2mNc674EPfpXSwu acs11AkLa8OXzwxwfhUcne6JWHtvVvpohTNNSP5aOFSaWToIryCDw9E/PEyxkUdMNd0utzRg F2ZhjnWTPHw5meXL7qY4X//9A7+QtQNQ6NjteY95gVTZeCEpRyx32QU6eDASgu1KPZmWFxDk KT+B0M+2SmjKnUa0ZMnnsf78tkmIWL/6/X6dzfYVadsd9mXo/fBA9CVSXKFvT9CmO6/y6Fti ZNNkRl5rhPFiw2uTzLFZZw0zrnkgVrnLjbbkax5kYkTTnlmOObm1Sy2JlKeWqmaVTr29Ybe6 aIeHFg2VjcMM69gPMoIBEk54Nal2Ais8to2ivoh+hd7G3EnK0YAn5sAr4v5da0fRPlKOrn7o icsryq3Ul47ZKaz3JZo4/Yv48ktxrD+r0x//rvt5UDXXhJfrEFkePsmPgO1wXkPoFA6xG+qD TdqRwC7bEqOpezG/+YEcMqytkztZawbMLXV13HMJ2pylU+QdFA9COQNjAxc6UzeiRVJjpFvG nI0durNpxI4OSQ8qqv+Khc52YQd/am4NanmHbVvHCFne7+f4uQR/npJW1p9CoAhnSeNq7lJu fLG2DJNozReF1JKwhg72xoEPlX+vXlNBKSfLhZbgtbdEwfg71e+UI+cekVRndvMHuomkdf+j he7YdMNRJZMCDu4u44eHpjycSA/R/7QhACPATW08QPtTk58mA0872PqiF+c6dj+AmIW3yQUm nz/3z04DaTaDtsHKprVyUFVyJUKnqvGiJEsyVSH+9maq3jeiNDJ2EpsxGV5lvagvo1gwhH8f Kou283nXYjXKcP5D1nC/f/IaGNYSJzH/mzmJsO1XuYeYKiSZY0Frd+iYUs6LTinx9NE7hwal hoGNHiUoGR9lNznxsNIMLo2EU0gsV38bLO15ziUfPYlE3od3l0ew/0raupXhIUHy8MH4AKWF 8etarinBD5HlLUe3UU6mVbI+04Rw7WUyNb8c2qtyvqumSDzmTIuvMD8rDxzZOFtMPSCfJHPG nZpRR7vPvKSXBiyEKB/ukv16NFdZN9rUWOo+wE1a1egq5sTe5FeGny8PqdKc1SZshdJEN2pP +1TvyHm6hyDjCXavzTPNTsYFYF+iGEbM8ObOcduR/aoOxsBudkCq//bgr0h2NabnwtgVdPwj neArJtrKm46M+jTbf4HkKOEBmDErJJZCPd7qWc0pdcwOjiq85u5mg01iH/3Thmnw/Wj39tLp oY92e4XEnh1rLtwspWs8yjmlfRdlSUSVZr3w8yQzGoeYVjEd3avG1KGeciyqjHtLLbv/BXse ezW/Wc65Vxk5LfJu3VXOKv6R5ZVUUUrilc2lWPU+qRuFY1kZBsNa71x032mFgb9qy+mdmLwp k+vHnipMYrVN4bZZFZSzn8O9vbXJPhV8ORiKc1M71jJHIuUu/uU9Rjit6c6mXQd5sLjTHgGk k5jHnJyGRl+4zuiXS27bWBNrfTZ4m8lQtyb0Bb2CCrReLL18FQDT64HIKNVSN0vFcsduzaQG D2OMuXa+UK0bfPJYy2hN0CdrfpZr8fkcmtJjomBz/l5KK57ai8rVbstQl3woDieFjGrVQXL+ W3C7kxrqdqUcPHLRXXcwi8Mo9JCaNuAPk2/LkdMl3+1Vm4Qt9++x3deyG2nTDmwOHSYaWs7k a4aUpxuotirAxw8SUkLicR/RHbs3cw4O0/B0xAOGpeRa66RVat4cD3IFbGuEYX9GLGW/6Ke9 kG5DE/ppKH8JISxBd66eoXvaM+ZO7s11SSBpmPybebfff/RbTkPDQbqH7ROMNumg9jv94J+u 8LM6H8JXp24bSCvZsLwq6+oINmiKegtHo8tviJ0814HStTh62m5Uq7ZeTFduM3uiPz2p8yAe ammZ0koh3cUsyjGUQXrqlLI+NvehLhlvY005SVbMM9Pf5v4zPGLvQ8ODrex61A3zIhHlNdes 5VdZx65srEwMVuxUFTS5Mr8nmFOkHzykph2nO/cZ4FL7Y3OObtlhK2eEi1Ln4X4tixphjTr2 /uVnq0lvjaKYT7DbtGjfclRTZPefdX79b5XDYcXeDM8fT4HRd65tssscrqqVyJCQNbS+mI2j FpvlSPmwSbas43pzc9y0ep3UFtVRWib8Z+DQZaJOGn04POYi/YeHhMLqYQmk3NFN9tWLRMsd 9dC6SHqn9hUI0/DhHxgbPdolN3W9OJ8Vy7HC+8gCtk50Lyqv7k+kscED7GllZMF/as+KzyVf iHsEuH+VGfVvUrwpunZK6Z1+7huUxlz9xD0TmmTcy11pAI+IPCu3xAoC8z7OBivOBTh4QOr1 7RuLU7vThUeqf36xPprI5C7xGFqrXa05L/fgr+sVsc+blMrPuPojscHRI9kjdK/7wgXdi5Kn d6blhMnLpr9+RhtbVmvmBPlkPUiCC7He+yulkYFVBtqVES4vO00mzDirae/TVfhvQG/zCX6V ZbENBQHjcLOtBUcbfRbm2n+SegtHRwpvzNMyaR3tb7wrjo4uylzwD5qobZoZ9aRd326BJ/3F 9M1lHdwMaD9sSEe2wV0i2SBENQXdPJGkLDXuSnvqhTvWblcdnlAmVsuStUrlquu1RMNzpNgO OMzDw298h1/d0U3freBtgjPf9Dss8osUpjSX/cPjHmMMTvSlHdDzPthuZwB0OgxRvuf5dDW6 jEN3gRvGKHKf5OOvapZa/pvm++SJpHr30uHDTmpvGwt5az0kbkpZH7XAJW/Fqg9IHRqm3SCj FWIrgKjh3PFrzzKcXR4mC+Xep2d8GzgqZCmwIUVKUf4e5/oVJYfQq2fq2v2iGO8FavW52czC As0ORhRNgmCTFw7sdaSk17lXpr0nDF7IfHc6JpRnRiMZ2k/5drz9kKmbLqoQI9Cc/l/GPGzp buwxVboodwAuwsStltExWac+hqVZ58s9p9LINgihSrPJY3NfSbzYi7bFW9O631F8E86Nfgsv mREoObPp3hqYk/f785eoe/vfLQ4BtWdCK2QidqYf7PPM6v5bRpj8GPHX+s3i4ktnw4i1pfHV ipcWFhRk+HVgcC6gD7Mz1I7fuB4xxSrikLxbUpSVNeLJhsFD3Jmme26ntvKtrG5fmPpZEcye uqwfPDUyyinOfYnr9mKH2ij0DTHTArQdsW0du4GNXLsnUb6tzTNMPrGUEy/75Ea7jwTAEG9t NUuZfJsxUJixMVUKTOJNCXMyd5cYw/RkUwRY9kwdm/xwoNsnsR47Zh+NinfmfkaXkVYM1+Ql GhgtVVeQOKv/lt2ilJy2mtoqF60RSLp7IpsQ6e7TZjXIwNmQl3B3Wb+otMTcsmE1GPaob085 wFFzk+Hlwd3fqlbon4dr/p18LEWXRpQSv/7wSAbojl6KdoXr93wFxPjbyFA88Jh3LHzyhwfe qEBiSmHB+WpO+hhmthb7c1KypSr131ZrZdT3VOQeA1XOHYxzBGZZidSDLSO63oZ6BfHsMQKG LD/mffzGcaaOvVyswWKXDyatnSAap3vaTvoBvX6zth7cQjPMjpAuUT8xFODTntuy0GRm5zaW 6i+4DvXF+Z8rXDe3bHL77hUp9XY9gqIAS/Zgy26Kc+ZtOxNpq6c7kOCO8ZbRbdjzI3L363Ew oAuYw4uVaFbPpTxo5t/ZWog5uPE3K1GZdr2g6gCiRDq6b+JMaLnj8Vh6eAl/SzW0wQEGp1tq wEB0hZSH0hBSl2+jUKIx1ZhJPmzSDJBvsuAxnpR0q8BOcyyiGNgy2L50GJyIlF1bv3TWPCxH QtQCfkPywbp99QbtmAmo5D6V2UlKU7tG+hZ/j2HCKbytW2AUCkR2vOUsnqpgXPd6FFVZ1xUs no7O1ywhGRy01qChSzibNE2Dqe2nZb1gfNbyYzkr0R50Fq4hHajwadie41IPYOdHgRnC3n9h jDB5Jq8kRxvFJwfuNI0yj/FQNYkuWnGNYDzjH6GfoE9pEZ2Qh1aX5alww9Lmx0Rgmh+FzX4j DUoVFc3ei4JHXPIaqsX+LdrP4N+UcYXnvOufBpTEpSEd2gkMuQLN6acVsiZq68pKNPFRjpaB wEjX8z7s775ONc54ClnsA3hsAK74DV1LqSAYvZ+2vQ6TM+3HGGGIyFvhMXy69sr1DGbXmDe3 d6JV2nvL+e4Jh5WlKDxyiWeDR5Rnzq6/2uWW6o6y4inJvm2a/CpQblKn8YZsybhautFe/NDZ mOblmjFYpSdZ3qvFtljzEtCgLHySo7/Mt3ymbHCHJo+x27yqxRYaqxFlr1bC1l3V8DI8ZziG Ovus7drKGbd+4UPkkJQPUbRF2fS7HQwPmzTBD1GQ4UMCHXnxnL63AnIIyUQP57z3oKMnn23v YrHSpWUW6+ocgqfRaR+ORtkNMm7TKOGCcUoa+kKhwlD5FInVP8Vd5qGpvP62MnEUoa9IRoNp 4tNOWtSxV4hVBXrWM6Y9RSd8J7TU/ZEIIkeutPo7IvSyDaUoj9Yk4AoOpagouE5fB6rw6dY/ Gz6xV3q1fcF++XE4YcHwemXG2cu5NO45UXLuyy2xBNfsFe7wVIyV6Lg31zEbPDpXZ+82BE8K /uHZw3OITMuI6PdzRFDWnbDlcZ3l5DPY8AOx+IXRwMfe31kEEWabmN7LDevHTTKfIC0IVFPj hQPNJPK1weHR1XIanw45JwduoXP/y1v/oZNQUriECTxpxh7CY9jPWGOMcnJOM+ebZJfJ+njK sFQJZ0XjqBN4M/rp7Q6VLLZUG0nGsLDOrB2tQs6iERw83x8B3UxQOoekAM9OWu+hezbHnSpk dhNao30PdL7kUiXwhIkdwVXZbnsJnUBTYOZDcHwy26POGjytsgvmGfy9B+GwyFsjDZZI/cHI C8vbyIP4pGto0GFtFCNSaDSrLaJqZjt0BmieeQJpig257O4oCarTEFV5CKiTTBbyA4lPvgJm 3g+I79KpuwuKH9kaWbq0jUxwez0jC8EtMg8A8OXLro57QHixqEoMALeVEPIDT+Xkv8DM+wB4 v3hdDgTfHqkFwrFFMxobt+KZMFC7k4ujNKR9h8oHAJ6SLOi3ZeOiXXAagI/P0+kQXCLy2SoA 986ZQUJwy8xeULuTE3RlH1m8Q6UcgLdLCPqB90XywzDBSQA+10ofhOCykftBuB95xgqCW2V+ ArU7OzrKQdp3qhSDa08R8ANdLb8IExwH4Kuv6bwgc44oRT5bAeCBSTNOEPxsZiao3dnecR+k facKFVy7pIAfdAb3D0xwFI63uZVEV4TgGpH7QXgwccYXhN83yrwFwE/a2TkqQNrFVDLAtafw +/GBcFGY4DAAjyXQT0Jw3chnQCAJN+/OhENw40wXAE63s3GEDseKxVSSwbVL8vuBKZ4pDxMc BOAJ1nQPCI6M3A/CI8JmHkBwk0wjUDv6kqMyCBeWP7cXSDthO9n3kLjPoirxgLgrbbskweNI FwX+XXQg7RRs+KYFQPF6MMFfgPh0RXoSKL5DlIc+swfRlUCvTgOfVUQjTYBAi3uevJYHqtON NtoBpJ0uxmemGFJ/IvMfUL39OcdDkPr9CRGgenup9+rgs8mO+ipAfVabmKQQqD6bf6AbUJ9t s3UafM60gwVMAeoLB2tbIfVHeJYXAPWv7lZLg1fJKrsjHYFIi+N0rlVC6h8YZYQB6n0vz7Ag 9WbyX0D1DijHw5D6A035bCthERnDoIEZo4if1T3rqwtTnCrvYZaMgUFXhU9XOWFcgsjU1X2t 2cTZqiHUIwV2nz5+fA/WwRvpXYNJa0L3te2UBD8PcVEQwLdhu8SBvV2b1XVAa4D1TA+k9VTm ZYrMmP51+SFp9e6Og8CCf6krFu8GKSF6pycHqxzzQM56feKcs18bljBIa2shjuBMJXn9wLP+ zFsw+0WOwBw6gsvxnb99YFJ+Mvh2Jo2n+IDGHlBA3U5PBnZOZJrdXamjH+iz8nug9m7J3DAr HXGQIvwVyydOUZwkzo/WJdfA8eUl3lHB4IH6uRM8zBXc2Df6bPOORY7mHLrosqEAu9DhY5FT GN6m9m6tDujNDhce4ZWJagM69mixc9XO0KAF7kyD2JcH2zoXaCu/0UXvSlpntpF9Zh73ToIs uOuxUQ3y3c1VDJn9OcjrMKXo9NFysYwsmkmxggbotk9mYp6fsGcpagzDN5Jhycns91XNX7Ek 33XGEPwZjZiB7oFuWF7zFw7Rpn9+DLu8sjbaHxPs5/zRPvQP9xoXHaZ/Wqn7zc0KmaDBbvkz gW5xSAVEQdvvfl9QOz7+EyVsYWjeYo6T/XahrnlHEjv6ElKoe6Vvpq5J+FcrTbeUOFLoJtYo BB3u7440XJ5YfzeItOg0ntD+1dTt2S2veTyOY4a3KVGsnYTO2HkjDZcmbocugP88SRM5F5RQ ForpI8ltvyCZQccpNNQ5MtQlodtac5jNLMf558eI1yukVdwsnfZc5kAy2+StpnTG6HlNg4Xn Tw90xbLyy6Le2G58nTEjTQm7RqkK65+Uf/2bFESh1xi7Xk/WPYrBt/0qWfnO+l2y/40g+Cr9 wKt89oewJMBXJW3bXUfNDCe+vjM2uZ68lyCeZtyJ2A0jiwf+51ordOdh0luBpAWFHabQ8dly PS9qij9ziD0/Rm6yC/c83wKsLDmRtxq6n1FRiQTa3/rGjC9eTgm77pziG9+Htjco8N7a4C7t cAgIW1SxnIb0xpWX2iKHLfcbrd699DmIwumTl8hQbKX5a8eSf4woX162Glu4YdyEdmrbsnF3 /QI2FpZ8B+ucjAwr813vxIxJt0+e10TY/8zYldigq/TQIC53TIwsTtjn3w191mWVOUSL+LOc q9ENmFy2rHaJzR2ByxS9VKag4bF4XU+O2bQP6j42SxJYa+gx/2UIZPEpdIFS9/GvOTai4MaC aSttsI8zmfYal03Z9my49vsN6aLrbVbeQJA+F8tqQJ8ThfN/X1Y7c/QG7QPrbekM46EvF+dW XqHpcNw7UEEH0cj26jUHR6VdyUaPfVE1cG/fNVfsbbvy2Uqs9PSP1PkiLOnXHsShifjAPtCA r2dc0NepuGydo/l7Doy22vplS7Ineuse0Q7dNOYmPC23l77H+lr56s0hMIrdiq9Q2PJFXMgs w2E+0UnUz2cvv8jsDxkH6WZ08HB88G1o0BKHjZUS54HksXZ+mLPglCDkNmzqnW3VKjIchX92 kTKCo6fPSG7sbY5H7s4ImcURyMzWUVy9/nwzeu75sgA0ptsZ8pzAjn9Jtt0YO4t3ZAa16Xx/ vwPaixTKRXogsmnX1s/NfYUkvfKFjQUQg9ROB/3k/A9lXx4O5Rv9XaKIyhYx2cqSb7QYRo01 FWWtlAxSknkGM8ky9iWEtknfQo1pDAnJEj2WrG0iMTPINtYsWce+b/k9M8P3en/X9b5/vP/O dS/nOfc55/6c7Z6ba+Ugf/5pGMOn4Db8Kz+nDo2fO44HqIbfZP4LvNrZwGURzMoRQoY1TJ9M /euL7vtjIl41u4XeRMc2JhFIGjbI8JeGa4SXvl0irNnpvPLpleteXFP/KI3ohRQfk9nNUxTH fC29O2j51dvr7/CfqWxxRITGU5n6a7d+Maa3zU109PoB3xOAbHaisYivsb3WkqBNKO6wpHWy VPeQXOgfxCMcwST4VfC8Q2OP9trkLC2pz2htmLxjfqKzzwjR1kfzlcTzvdhRyEID0I04grWi uJi2S2Z5eAdY7UC8E7plR5CdGxyeMJc2JNB2qg3aKbJ4NS20mEXVzTi/Pjbav9hzMuPVtbL9 Cbs921Yk9ywA3uS5vJVjI2ZeiDg3d3cjFhOKDW9cITGSHdTSKyOWVj6wvO4kEz1uYFvUsv8e pi3RFZtlIUPG42h+B1lH8+dgzkMqs4h8vRM9cflEwFStzJks4FvHhXeQ3zh0X3q3Yywo+Gqs PeMngya9h9b2U+M1OJ11ZJyXxYZC3szboBsajJ5wAl8cTdAJWh1K4gGMNZYTwDyPgS+oBt5n /ZI4cbwJ6a1mEnjbDDnBwlGJXtzNOZAT8oguQvp+uc/32p3mkutfiJKnvG+FQ7doMf7rLhZH f2iGNmHRSntssQNmhDmEyYq+ecIJ7/47IQUekbRpnV8ckKUmAnEnrhadm15vUWjMD3jbJC+E Cuz2tXWUfPW9vLLZAivPsB5IqSxjw1Ejrk8gkYyLbVXBbasWozXuuPmFccpEI1K10flOs+Hw 4zYGkqZxlAWzE0u5JXNQWen12NRdjbl3Ui87pu6p+AcgHjxlowoB5OlsjXEB1u2xLIRpRJf3 qTiCy5f7/vkCYd1P5/tiOfBbInQ7bkB1Ofhj05uboPUJflvaiCVh2I+g2v54CMsQneJ4sNbP 9R0R/DBaGFXxSAVCsFs/6ytKO+AEyQWbJnTP6qmGEsGN4506cdsUorDb6oetyv9gX2DRQbLt TH3BQol6hlrzqhBbAZof6WshTNr1P1wjyDW12t8x/OBelkpqYZWuXrjEpdpuaqQRT83rU7E9 YVIs2S5Aq0OdfwErZCN5Mq9XHRofASKgMygwn6HWsIGTUqgVDl01dPQRteEryuak69Ssw/rx BB8rGk/VNTZHxblwraZKGssMq/Op7ilUm4lt/9bVMYpNTxxlAbXEGO5pV+hMf/JUmW0Ml8pF +VaiohyhyxVPvGMvypIjZb5+BvoMkGLn0cGuI8XL1h0nLYlofZsfzuN/k1VMnAu7oGUbpTyo wGJszFP9clwkzfhj/0cFtj8EQWvEaWD02GCpPEdhfpRQ61BLzft92Jo2w+3hBvdqXjo/uJc9 /Yn+X9b0wqGPcqzpUkoXtpCSwCd05FE2VMVyP7wBkVxwpWqNdTxD6qEGrRBU9W/z02ENVzh4 QQAa/kxV6/YOFu1RfKIV6KHMbzO0GrYdEA99DQ2Pde1012SdCNIk8RhEHJnsa7+LY3tEq6Dh l/mjSaxilrqLXDwfJJCjQ7UzN9kG/EziOWi4k41fBz/rW8yFD8VA36KUltDC8nsvHOCSAhnZ ZC2fWa9lZ/J8Ba34S5+WSd78x70s2sgHLxwjCZHxt0f82JxROHBBHaJVWFX3NrsAsopXlAZt 7uhJZ8ONQ3tCexkQrcCcuxKb1rOJd1m0xgfasz/NmVe0HhquXhMNY9MqxxWRB9Fax5xRY9Nq kPiSRSsqpGMHi1aa4KG3EK1AKuUqu05HmOtsPnQ3VXP1I1hW3uuevgPEd6Taeikva7iH4KFs aPhJK1kf9gUtwr0TCx3TA57PrmzzyxN6oB0i7iafhwibOP3EOmg3KeutpdxsxRc8VABNl2iW XWCHEoK4eAolkK4hfJM7WcON9ROHoOEK1vc6uFjDC/hEu6BvGdP4zM9eXTe0F1p9b8hejx2s 4W0KF7ggTnmLb2XntRMnuX+yhGDR6ccudpTpub4yNpLWZsezeoK12muRQ1HQ5vUtci3s4Tpc CrnQ5m4Sk782wIMKtDnP9ft2uuzNeWMqoc2z8J/3sP0BROg0JCN7AxQ85tiby104wNpcjEuP 7U7Ucf+8BW0+lPLjO2s4Jlw/nbW5Nd/qIdZqB0QOvYA2/7flQAsbiuO5FEBo8yDlyefszU0T sazN7R/bIVnD4/hiaGjCKLOJ5COjqxq0NL/2XuZT8NoM/dP62sKn9fzaf2U4desE+Qu6pKxG RlLol2Ql8wQkXM27p+FPBlxzolbnZcjq7NLNRsbVYebg+0/htEmGYbZhFxuIZXAbY8B4mjez owzo/tul+4sxFU9Du9E73w8zZ15cBqQTekCrFmE9lht5o483ph4dUsd4+xoclmhhGDym6Qbb Ly+PlRgBYgnKnT84lm6ez6sFG1y2rLf6KWR9bZAS8vfv3OhgtExI0Pr8XE1DWrRMV1nQmsvU EqjEHy3dRSnxdPUeaJv9U/0AQid08kkdba/e1n+/hP4tDy9bWZjoBANaaGQtf/8Ct/YC3Giz qiQJh21LzPWbYdU64Nq7HOsZXWtlO3SQMCR+oGMo4kH68GgqGMVvoc1Y/Nun9Av1A1FMF7RZ yXh5lV3BJTz0sHm10xgAl4ewGuTO4oD1nmQlun1p4Np82VxYBbavu2vXTe2NiO/20EanavFR Zt6zNqYPEmblhRivZ2SVLEjr+q9eRoLNhnRE5SSTErKe//ggJ8iM1JfNJYbY66XENqEzhpmT //adbmAsTT2oPtxym/W/BaFecWiYjjY4TeyFi0hy5tgo5tiFS6RlRdcbu4J/kFp3Ji+s9xys ioy0MAHEU8C69Iky2QTc4x5ioNg9xbTjnPCbApcGPzrPCt6G5M0qRfAj2+MLwvafaAWQWu7T s4wZR3ElXB9qiOfiVK13QrpE/yOf8Jd0efWNALLZjaKVsGYXYxNCs3NSbCsaRR67BDi+Ay0b iBPJCWW4Mlm5dgxVlmJJIdZtsIIrtPFuOsPOOb1eOAnfDDgVoMg074lOn0RNQ2DKWhA/YjuF Df4SAOsuNQlK9V6T0QtW2yxwwC975p5NJzYIJ59NwjcAKQXEUVMYHdvNyD4D9MRk5Ewx23ZJ ecbeA9532xTX94Fu3Z/WnQwdN8srXm9LZtQ6Z+c9rkOOgx7t2CLaM8tsrAweg7s8pXILVuYf t8wc1eSjxlRuFAXwveFSz+JJO5ucJWiT1gs+a2cWss5qgicXm2wuZ58zQiw+9Zp+WX/ln2Se NGLLxgeKbr16o87mctvOpIgtWXDdwyXUN3C9Py4BFtHPCBCVb/Lr6Y0U8w+EdwnVwHsqkHDH bnn6++aeaD7rY0/vbfsQf1J1X5Zi3gWD0Vd0Yzcwk7ZaV2nj2kcU0sq/qAV5TRUZAN1epVyN UvaCrhv0t7Ris47h0G7eg7zH/rW5qe4kdXqXKo7PnR8vq334ExXhV3Dcc7s7BjdrVOE7xZxu GkXuuzVengb7A/8DMft5XS1mYPNYjWR31pWirfjd42HUGsycwehj+rsboBNyxjwooJdI4+HT oqfqaFt6JsfSVbqHtsbzjX0z2ph69jPXVhm0/ozN67xWVWnztzmKVfL6cJF8WMKVr5B4oNLK CxHLRbJpNJsC9+mHX+EamtBRBaG3to1qGp/8xzDA7dLGeT3nNg1F5/9Wt4yPbVAxyODBuPPH Z7zVoVz5hj6MFzPHaSftuLSSS3hx2jdukTk8I/5IUR3eZuu5oQrx8ok3Pidv9Yk3cn5Ql6ks n57oFNgcR/vnJuhPVqiya/pAkE5Aaf541QsuGUVTDvUMGQQopFQ7byQ1nt0N2xq9vcM5VR0e z6e6HTOn66qpnfGQGkZjWj9NICfl5xZa7HlTYHl/7EFjn/jRa/NefVlaYhTq4R6MATxZtTxw aXrvBh0KguEQFcpUQtxO3NlAtK6LjnbGY6oasj3Xs1CcfrOgnuKHSB0hpsDcOmLojd37ItCG AX97I84TNhOr97/cBT6KphbVi75W2GozSywMb50HC7yspEhFNC+Mo7+L44nL1xmG/HRDFW2S B4XaVRx0la9KNq/KIkE7aHlWYiPjp5R4QvaxoIB1ZA1MqHdciX7C5mtuuG7GU2rccO1DIA4n UEZw2S5RIku5Riz3XosMTN1CjUCsnztvRNgsqnh412Drnu39Gs/jJagB39cCd5qcSNWdWQO6 djf4+1opkJpYC7k0FRr5Vk7WBiJ6phhzRAbpImZnvTTNxFmS/78iF97tdi5d938bWtKO75f9 WAsklVy0ckn3tVImnQeCMclzYfeAisav8HZjHTXJIO8rPOri8RGYhfHuENlNm3WSa0Zun/WF hzXvEF024hHorTa+Bh61mm1wx2eTmXvJV2rQFwEXnEC0ds09IKno+CJ2+oPCfoU8hu3O+lt5 J0+abcqYJ7e0r/oNK3gKsZ7puzPgxnkyPY/S1kB4QLPhpf+DBi8DXfzC/jDHOVOlayiwfInZ W9Efw6e6byw1RjGt2mUzvXz35tZH2+X1M9rOJPMklQU/n0JhdkxNqiA0EVIJV6joU0BSfj1I OO87EECPjKQCg1WVV/Q9k67hk5XPlfhZbhJjyX276sbnN2hjz+SIGWWmfodNYNyyCh89vgn1 Byv2pNGHHIFNxumAk6adsm0mOF0tLY+ubeoi8QZ5Gdl5RCIRJgn+d1I7tqE1RvdGl1ASWreG zZ+p/g3Xku0/qjX2Dx+9P1URb3WKpKzd/sGpxqrbLy4SqAeMkukq+rCSOw5fT+fVXM02LfmV vcFqPq4WnO+xG8rZdfefYgev8FEDB5Yq67InSuiZ/mLelzTTwH/asKiCi03gy9t5i7WB3tON w3BAIe9iyv4rZ0q8nD08jB3iM9H2Gx8J5872f2iShc9FBdL22DVsDUun3wxwFE74jnW0RGa8 oQqTnb7B202C6hCWNQBS6taJnaqSY69fqz+PJyhvWJhT+l/uvkPE9V56JfYYPWjZyjcxTRwB HtI7AG/kuXOaCJmEK7/QNfgCzxdRwAP6kx/AaZYM3so7/qhBNO1aTPN/ZnrP9lIhh7bHaANL ITOFvArArdt5hZgGs21GncWJ4dFUWYfD0AXVvOcmZOCoBnngoKnzoJGZi2Pf/yHJmUJfSN+/ BdvvrR8YJ9ITdAOmLq3QGyZr3wHuo0SBpjsFue8QYHNlnsQZKsFb/Zyq7mjLMOEi5gsmO8/z 4EG0xsY3nb7RGB7q7nbm5bFkM1Kdiv4j3UdjsnM9xL30+DoUHhdXj5JMaFrCHuM1k2urduBv MKecPJiOerNxaQzwWh+TTY9oRorEk2X3BSI+/f4D2vhaUXDYY8iMHGoDNlkjfLGawFjMfH99 azy/2ckqkdOX4rWomRvzFXkPiU5iPmcg0OpzD1f4wr4AC6qdi6sR+FGlJlC+fShrmTCc+RMB JyswKp1027tddz05kodRVzYzh6cTN/kpEGop+fOOn4yBYNstX+4WsyZ6GF3s+Qiqw5g8ru16 DogtQL2Gdxvjhg1xqea9cLfWPQZa2hhDLX9WA1aVmYvuLcQGM0xl0R8bxkqDD4zn/YG5dZct yIokMOqXu951x9De4UCzTwtEik/KlqyJp1GYqGvOihrgptE/ABl9S7uft7+Plf48EWlkTKt9 JyW/i95VFg0d5iCEYpxlkRnFkMlTgVGqgZ11/nsMk+f2COxv3penv2FwzYR5v9zVOHAmiSyD p1y7qHc/ArDX+WU/UpcxwTDUKsy9SL7Shc6GZyR893JkfYVP0tlkv6epxvGRqM0VhKAVpm0d tN67YLy/rtxbPpVtvzBZGw9zhP8YTCnuRW1boeWgVNutJ+BHE8cYrgbtIfqGM7JU4eg4/1ub OWTtfReCayK8G8wrYumiFDN7qyXs/HznH0al6RQWR3YAzU5BmNopCL1LTiyRWBdWb+rsEZ8i LcE5CpVQQYFDZbGvCkWDvKcaLvPSx3VeXn0fzMRlTvCgLIFWU0QGP52Zc3iipXB71WWMWryy 2cX4KucBDXFS9cZH7BJ+uvXbuNJZzLtEMjIrMDkNtjehszQL/fQprvELgaIbcrHguLSnU1XY atFeblIR1aUJHgFIUBQMLO+n7qO+Vvex6dXwhG1Wm/z+9y7/2KSDll5dUOoOY/uXF3xTBypN C6a+GR1NQLkm602bFi8/pwcDYEqKhYxeacDKclPvDGAhJq1Tqucz2MyszR+ueS4iXkmjaHn6 +w5V5B4M37YWtCNgYaK7BFhgu8Kz2Kt2ID5j7nIrrZ/6RfT74pA49urtNdmaewNy8U5S15y/ uAjbmuFSNTeETF9f4sgV7O4lP5Nx+FEKao65TLD1+doMd4Lhj51j8kw1V+bvxlWg012vAUmB VjPEwhMjpjctkO8eo09fyvCjHtgUVmNZrwOt3vYzxD+wKItqwFH8so5lwUVb+oD4TRZiDrI8 eq6RIQMSWlXyUczt6Usq2zGK6lIfJgxBg/i5yEbCDc2NGojT3P06e3HMB8/qAStdmET+gKET DP4drqOQ2swvLP17qf3WQURNa2YXIJboFDFg/Mic3woObhhpCS6xXb6Fvr3gQaOswNRJ7Gqv ghPMkbU/6ui5ZOQ3NB5hEii2Le8yxsWjY/y4De8v0fQUG1BefhMcCBbqjT3ShWl7MO+N1saf Sn3fJE7PzD9+W3ulL1e2FUukxq1kKqqPtr8/SW2Ijgv5T0zldfXuVAemBgtCQFCbn1F5QdvE OyHCfG27VyTVqlVlDiWc6Pc8eXA/7rDNnTaP90Udi5w+a4JQDndL9uK9/vLT26KeQwS/3kvH DqKYPA+yCPPcdD3ptvtUq1wUFdBI8nssNoIZz5v8kqyhu4kM+0sbgebdvT2MSec5RGQvcZT5 gMz/zGvkfW60JCnLBb7mhGktjHYQsfkgQvU/ra5m3GfCMdlxd+cOnKH4Fbt/zgBGcHlWa638 rz1PmQITv4Iaex4A67Y4mAZihUwduRen0aaWxVM0xYmpxcvJrpzHjMPnRgN8xT4Qmt+9t39a 1zYUNfIp3yghC/9zL2IlnMqkuMjZBMXE8bUucmoG4hVkZ4h1/fDDFBRrlkuTjBTlZWlvFsF/ gOgzopkIxxZEUlcpozHoEIx322IwJxR4Sl93ZhHbcpuf3ihws4xgpe16CmjNFCJFTKB61P8r MrjhAafMzd6bzFxI9J+LheCb7EOaV20spQ2z8nbN+qmeVHo0VbIQtUxWpUv9V2HwgO7NnMUm zyFsppizqHyEf9pfctGOaGk96ggzSnJuvV75ao3tqRzUyKFyzs2QLfy0BXvaLTNhrHPwO3yC 56KroxVAd60n0mTtr0BUZVhWkVhRpLv6kfqTqFqE/5TKGQApfoa8XBCNPAOkwvXy6qMbr5sB rSrhsUc5VSo13Nra7QWqovRM8TchN+qe4GpHsH9zpYXASMgsvlB6UsjJOaiEvgXHIPiF9240 l6OdAXYNCZCckqY12GrnRWI1UlCLddxKWXnyrbyNQkP3oelSln85AnZNqY4PMpPZFjB27nkL 1xw3EuK3VXSMHofeBb68FLjeJRkSPqTZdyMIa5jIMq1OZ5ZY2e+tvNgtofNeA0dWutf//lpc 6A75uzQ4cf1T8N/FqZYFt+sv4nSDVifHx0avPqJTdFC+s5N/O8i2ILwl9aiFud0+rZDx2uGe JFZOcvfsghST3ZLYWeI93lH/C7y2Y9Wt08Xo/PIpO9iWe4Wc0MsBYcx54NNqraFU277tiMO9 tZ5UdhDrLKt/BZ1iI9QhwM5DC2OuQ5x/KkI/y44jiYc2e80X6sgqysNyUUVi3D7s8PpLbptm 1KwE4vBAqSc7BWdsmKhKJtYMOaswHv72ZqeTnukfRq6kD/r8hc5zD3KW/+SUnTo7KCeEsQKu f1qf++Y18B3+C1qkJez3bfaU5/p9yIA+i+TsYZV7EBEvZ2hX2ERIhCK80Lrf0Aq2ezp2s9YI E8aggHcJjMWo51k7kTN2CNaPl4Qw1sD7kWeEfxKK6DmodKttmmxic7htfhHnwiq+pH+LIAdw cmIPeNXTQPp1g8M/3n8SoTiAwqrbOfFLdz71LMizD3lrqRcJhDiCveY6V9khMFNumzoiTtvS dyB8kBTrfPzOUXaG2yTxPFk1aG1g5W04PdgB7KVpc4Zf5rZpIEYADpPM4UtZ22+zHxBw4FNP AaMpp73m+4BJhgXWqvXB4Fd2vPiRPoi0dE3+QJgmRsvo/V3+Ozba8P8bgxr7v8WgYh4dZp8Y JLIKda9ouqpBU72oSWK1AAmPL/aFcwSTrA9HBqwfH6r9CpdpxeLfrrIqEthaACJtl116GNcV 8z7loAqBRwsc5ekWxBhAeDZkcZYBEv6hOFu//reY4fZxuoUDEK5wuY4w5zvWliJYvUVl571S J1UEsM1N6b1U9oXye4G7uYGBfQe2uHUHXZgy7WG0uAm3aVYzaxoAf8kQelwIpyc9WwhjClgk HC0XQILY5EgW0bg4X3ZKSdA6XD8cGTDf+2dUc6LUt2D2e4QiUYiUtfVFCCf9d1sIcwbYI55w DvAPHgxwgukd7sQ48pHwrk98ZTZzIt+QoL3g4QQiPTDw7+zwNiA0k+/lRiLktuAiSEsFMvf2 9yRXNbe97YXOktXO+Ebx6cIrbBPhZK8Op6fTjMt1iLnMHCtJp6m0Y3RnpiAi+F5sriJkbQkU CpPTfdE9jKhoh0PqAQuRllElGhale9gsXv338wQe4d/T8Gd4FCwc75q5lex/yn4HJShnyv6B IXbeKG+VYyy8oj/vJEtJ7tP27+1Phx9MFldMDaNJ19q6Jj8EGhglCw6lcFJZ/4NjnSTlLj62 Df+rf+MKWYo+wqTp/CL6n9LWfl6HLc2vEyCtbVVZ5zSXd8pP2pLJM0PMNgicDLBW6+NfYJAK EV2lX9CdrxS6+DkZH9m6+7TS/CnGzPfvV9/bf4qr7lfjp9prh/wE01o+1+hx8qU+vKungD4R y6vZnR/9qhAJkNPWwzARaRu9+l4e/D7YmqllWVHCvmE/t3FbtTDq0uGDhlVKiu/tSEV+K9l7 6dJ6QYqUojr7sphaaO352amvq99WPH1uU2l2pHLtk+4OzNUieFpUlPl+LbUTdd0+OT7r5WUB 3hNtRZ5GFvR5HCTzncVnHUFC/vtHExtvrqif+r2A1JLxSg1qXJB+e2X9wZKpwYyDWkAYNf53 bSEbGX0uFn47jB3ktMihkv9OJfXAB2nR11+VBuLRVmWycTgvynmMJF0BzmDWr267CeLJ++1Z NoSFPHPsgB2uSBic7CyT75XaZbjAAAcl6XZoSF11Pxql5l6kBXIukMzDoZcBLVHyWGc3aYg5 WzTjKD5m/RRmpV2yfmyR6bzvJ1z3EkOAlDXaONm7WcXb5OXd31o3OQwOVjFjDs+F+foO6Aas VlQ6VpsmMdYCfIa5nPerd7OKk7ZwjZ6/sZcspevBeisNMKpkxmS4WkG2al5fNyAvRzZW9Rx6 5gOjo7N9Vj17sHGybXOLWOSoD5mMdI1CmNsXuTAqtTzH4XzUytXT/NSB8Y7y81HBfYlL5hx9 seCq8fL+/TvpLZgzVfuBIAYZWenIqc+3Us/0UWFMTVt6ek8+5wp25zrs1fxixJS8bK9NujIH ee3rrC54NaJyvW8fsiQNtoPqw+G9v7D1NaBqzFpwlId4iSUwuCXseJeO8lhX2ckXRGFCy3sP sR/+5rs2yhIJItbZoP1ZoDwaORtmalMwFbnEpF2TMOvLPoveSUVnXyv7Wm1FCB/Q4iRHdfhu eRW40ruCdrwB76jc90K4DIbZFY3owpMiHNQsMd645Z+ig/+bIZk07xKal8p9/EgVNjkCaNlL 6SxNkXveWYy3hGYggvxGhNN2a+6On+BcqnPyv5HtxbgA+hNyyRsIjRz3GgmYwhr0oCYZTKYZ DDSG+2O8/aYbztLqrv9v/ogh5/C87j8Q9h4UZX1SUc83u4EkRn/Fd/cE3l8nMOWsIgJI857r k2nMc2vhSeLy1Qhzu/hLgd5zbfmjam21c6y/+S5DZkkLKkjmMvzNBTZYRBU8Rsadf0ZAhi/e 9YoTpZdK3LrZEIg2AOVenEePbL342j0mDY84HT/BeWsIL59jAMxXwA8nKLcPNYGPBuAi8dGH rx4xQcupw076DIjSE+yrinpSNiuA02n+3m0iNzMtu58UIf07PhB20iuP2L36eMvgkaPLJbWZ Omy/CsJ1H7ybA4tGTRJT4SG/UZe0Tb6B9e4zjJTq6up05XTTI89rK1XrD5HI+5HuzB+//x8V aBkeL20R7dbdo4NNbAK2cB2Q7bYey2xOn/gOuVKOvt7B2NWwe4rJzqYva+zQxuoJcdQnjnAr Ts1Hf6h+GS1TvAIkhBtl+admNR4cNLqGEQ96WSNKJFhjEIHT3Iiab6IeuzgFIdpIS1aVSpZE xVc4PvwlvbKyam/ytX2aL3iI5Ep0pjRbC36IhBbfSh42ZRhqhLP0EZ5UjZFM9iAaoRXhsdQn 0idNO1UsPKvz2c3gxyCdb27DVNlJ5ZAbd9INiqdmieCgoSEt6riah7lz5a80c3LemYOIjMkP Pc3sjmDC3dHa+Ysr6YTj7ZgeYhosKtYtpq73RMD84+paA/hhkhDpD06tiE1Kk0LOJeC4Nr+u lt/Pe3ECPsQa5ltsc8j93Wv/vSNUznuG7JdW7gRbGC9EPz0t1+m7WlFX3WOpFr8rSFpaV8IJ 7QTHxr1P73dhN6ET7w6rMHxTgQpf+P0VZk4svRZQstgdlfQ+0vwQ9e07IiRoqNiWXQvsRnyA 2wU500v8CrbuapAJ9F6teCBn2VadJOdJROqH1S6vLPuf5JcHnlf/YXPiSCiSnNKDcrt+/dNS LZc6H7XKvcg0lHgA3Bcv9ftWxkg2jEMxjZebvHT8qpy2SQNhmnF3GRYtrRMn8N0pvbaRO4zq gYi1Y8O/f0R40+wUkDOTKqmwMplbdy7s1HqXZGG0XfUY+Jp4q7mE0pr5czQygN1BD+fKhjwL RhfoGOWVevvpY/r23TLSj/tyWD1JWxA1jDMeJzfeBmlCtZ6XCiygt50q/ZQbckPfEEw6uryy J+JHrVOliMO7Mg/OE0NFBwTxaIahnoS8CKUaCIraPZf2zQ7tbPicqNP1eJD0x0WxaB/7uSnF C7+IUYCxpuJSpWBi9Y0o7JBn96kilZ8CpCv+TRsPEhglDoDy2hlLtWpPduxNJlaH1RjcGlDr Y/xaIplmswtg8HyNXugeYvzc80XTXXIre85hqk/c0T8Cqvd16Ryv/5icBqwUQLpyu+nLAdtZ JEnzqvhB9lMJW7hgJrJD2Jpmax04xW+tVnK/groENap85xF+Nf4kCUR7a1FfJ1urZBWe1hN9 wrkpqK/1EWhDMNfC0Y231nsCstfq39DKZzectV2KN04amIjZ+IoFiYk8OaKuXKuTSpd+kU65 qNY+rHbw18cvnlXtHCxA0LcCNCh+PGYGlvfFTNE84NCHffEOoOSZjcp6gqIgXuwrWAHYn7Ks zL3N3BmK+gGPrx3iYgxV961xiJK7UIOwKT6+aDp4jSeJcUQdpkb8sy8LLTb9WE49Oe140g+A rZCtN7ge0EQTzlJQ34JF4/PHlBRN7JrBoAABag5jO13KbbOFvCYodUuWOUY6FmWNdie2SYTX xmAq0Br3A1mVKRCvWMcvTEFVQhyQs1GzcxpQi64VJuYG+CcD0QssQdoSeu6z1/+w8+1RSWfd 31MzTjU9ZVZmUYhmjpPXVNTEBCsvqCmVXSxvTWZKpmSSpgnkTI2OBl4yLbwwKUo9XYzySirN lGJTSECFea1M5auCYyAKCPwAe+Z53rVmrd/7rPd9f7/fu1b/HeB7zvez9/6cffbhnL1HWhWv 70BWkuzrjtT94qi5ynh+bESry2jj+V1f4uJjGQ274m5ynx9ztE/WOo7vH/Q9N9dXK/liYWl4 rCM8mZIWmJ3q/jXx1b7jrXL/Yx3uxNvgec9inAmjGFy39H0woOrpZNheOF4GK7t17VO9L7LX Cy28iyvJz/fzr+KGrXP9O6SLcScPABcfzxfmWpc5DA8krtlQnAHNbTcibIyd+VU/9XQlqbw9 Xi2EPjhw1FFZFmebEdzW2vNinsorOsGZ3rv9n+Fb28bU+5Sv+/oNTOZDw/1Wuy/vw2UfiL3f rTZqaxx7Ml/oZEWnReYljjSmtX0ONT2Yzwp7S/5U2q70vfrBpfqVtBi1NX6J/XyxOy/Sktur BdaEy0Pjo7xPz2U+slb/Pmdc9Olju3m+UejHmCT7Chv9grRg8bElX12O0fxU+8nhf64X+J81 YV5vNQtybkq3/UVVSn2lSX1ri7vTP6tSujn9RVVKN+d/pyqls8s/q1K6uv2/r0rZn1Zq7NMg fJciTInbt2HdhhVG14q2++7x9vbevW9fWe/1LKUK8VuEjVPqK/ueM5z7f29pdVeNQJajvEOU LazRGe9jx8QKPiX8q8UrzLzOf7Fg4X9nI1OjWjjTrG2fQn0z56fMQOXIX2h/miV8M0d4NoYh 5CgjtB+bRr/CP4wlnAp2U7841/V80bde570236NjCPt2leB/x+ALF+mkacr6Cu98LPB6r7rY XvVuPX7Wt26RvrfVV64N8TtfF59uvGMXoUkWEPreR/etOg7fpIURkOnDfq1sGGgRBQLvOeHK zfy8CMU+QoqRmddb09Whv3e/rK9/bsdoDLKMmEvKRRDm6uQ0TiIhSfd7xeqrFq5WCR8SuAwf ZYNFtYRSP1slGd2FcCKoQX07nwke22vlvH3j0elbpocDQ2UnrcNcE7kP3QlhDkAH6W4M1q5y aGf/Mll2rlYhNptPpd7x/a2mwv4wo4iXYA38RLJ3YtyIy/hBvpN9JI+h19Hi51zyqjWO6x3L wxgVPNFmYDZkJCZx7k2ztNwZ5gdFsH8Q1ere2WexMDcx5rFvMK34Lg27fDD77WvXmUBwfz73 ZmXuTzW9pOlxRxOt9AcOHGnd73E/wuJG8i6/wMlgoDgQpj6v9C0RwEDjgwVctDkDKdxyrs9H a6lz3ke8473P3AVCr3ZtZrNTvTFPMGNv17ymji/l3ayKPsis4KLBiu7oy72r0kRYrX6ODBv4 3q057SkLfY29vUuwF2YX4FaElZirZkhdz7jhRFJOsFGEVPI0yXN4o9f5R98s3VVNPqp5suoa 34h/El2Dxe1heFqy8+1F46zoqrRgRCx2H9YbChdQZdIMzyF9l29sQS7GNjxjT7Aju/huNbT4 0hCdN1yYmO7PWAwcjUL0gyOOQZ0qPOTcF7OnVr15oLdHy6OXtxYf/OqMXU1uUXCu9vHjS93W 83z8JiF5nsPpUEzecb/UiWxlZfMa9kVhXFyTZ4nAXq+syCMfrO8bby8/Sl7K737P+jtUNrM+ gJHytu5pof0OxgA3LQzhBLvjk2wOW8mIF4hbZE1ao937uNDi4MOUGJTfLtoZAAm8DwZ6xPBA xkVL9BxKggoVx5U5sbXquOSr6whixHIGWio44wb6N+474n3iwwlOhRD9Gnqwhv6UcDphD6yr TGwPjBygPlvKo9fmJaj6uPSbHF13Y9g35BMOHdOFej7Z5pf/HumpyaDaxJPtIgIBhQxvDUih QE0JNRlJMwCaEFrIVqwT2D3c8B9I58W9jZMx+peGm+29cp1TRrp6PNAvIHkP4zs0/Osrg4td AhhX8u1TZLkGaPG45DbcQzHRGTcxbFHp0Ar9hkHQqA/qJmFoWmb2/jp4MsiReAUILYavVyrp rRwLWnc/xxJ3pOXtasv+lwNwdaoEzHvooXgZEr+OnXPc+8Evi5a3kAXb9e8PPXJh7FFm9oGX 0KNa4FTpTVqKOGNuag9v68Oonj6ME3UKEbYUfXJC0kyjm/Y3J0eSxG+Uc6G52mGuLzJsWyO4 3rT8oU7zlQvf3Dj56tcfa9vILv2aj6ElxwOSCRppv2V/zwD+ZhWhaxFySM7NyJD+fLPqIe2S eL0xMfv49h9FnQVVeqI0PSqwKLg1ge7AngByo/drFdFnxR71h6THtbyDus6UhhXaX5Q6NJux R/8o8SCfU3TG2ftE5f50fEce+JznXTe9Or7PnHhJj/bLOx5sGGTHjgFyHZ5UYq3RFVuJVhKa pOZOlvTX2Y2j7R1aPM23IOvKrWEgRcfUEAtVtjWJp5t2xmuyd/ncHljrUh6WbpYyu4c3OiMe cEmZCfGXGNPQ/qBRn9KIAnsS+fR2shvyQRVqxJ0vbvIAPeOGEo/75m0gXhSuL3hx2QpVnu5c y//kj7Jf3gyxQvkGO9f45V2KATIPHt1DtiS6AFsfclzQJ8Usi92SQuwqlizQL0jizx/K44D7 V4GJw8LOuAPQNZVV12mcMvdk2cSbZP14t728rfeeUbDdqmroUHYxqWikEttKTcJSzNmWQE8S f9IQyMiFpsi0fKVVkKaFL7lf1nacgDqB4rmX6Ss8wUs8U8Vz8qVprXo3EPDNJe9yBEEc/gEa DbLDRQcAtxb5+kvg6G0oRncfJ5AXJBaV7IR5KorWK2mUtERBRWuzqW67CYuFWoOMiOcjW85O iZoGdB76iKXB/d1Gf2+0D++86htIKzL1PC2sv0k9NzORbg/5If3o40KsjTlbsFNyA83YCXOV PUyZxL1rx73hNrkrFOubQZ7J39qAjNjnIxnSu/Nz6hSwl2p9QnGgQfr8WgFPkAd2L7PsN4md SXu7utGf9RQ3YFk+Iyt1TwDZ8BYDPV349B+gbrKkSE1AirR7XGvUHE9VZeW1F88mh8+066z7 anWndwQpNOJwHfRgtRUJZYmz7BJT8tgqXiE2AcNszh+5rmryIXPyRwpwFd2jP2Cx0t0p0JKq WE77UakotbLSiGszydSo98/PHDOnMzFPoGGK1xf73lJg1yyJ/bgibJq/QlhliNhW3pvXqpqE J5CXi9zEE0PL0fbI6GjClsk8Xz/Waewx6Wlf6dgrQ3hTiqgna54oXpvGfjS8G8m+Gmn6jNf9 lqVlLvBrX9+o8+5of8bZhdYzst5VvL43DnZIQxQYPE8550rzVJXCb54Zj6bHBYi5LdEwGtY2 wM8/ryOBN20JvG9CM/wZ1fldjcjoWIpfkHYB2RYLOwPzUMg8kn2rKrkv1rsl6ha8e78tdEvM kHLjgCJe6kCXSAW0oNKlL+o2sR9S+Un899fmMjYRVkVRS8KUwG3gXRYrLGgqxlIezMdmSf+g C4WlsV0R2Qk4LPRAlcDXBzMwNzuE+jQr8xBtacl10sN3AxyY61MDHJ6I1S9/diPdsfOXHOKV oz4M4LUQX+UHGyLYHsqMNYjJ/JEOrct73VsyQIxQdcbZ+lhUNibiyIJYvaRljzr5tEa4/Fid NH3ij2iCRly9h9cSxGjYxLb6RTzQi0nxYeBfQ7smaOU4uKJoKY8fyxltU7faNG9QCTtuxK2R SloS9U7r9EILFAUnA17y1kN8/Gt9/aNTCXC3Ge2EhCWCzikBnBKoQ98yBzciJc/xPW8gMCcH pEMwWAuKWEpfq4JuTFfKTPSY7j0S9VII6kM1UNdZAaIsgFyqDC80dYdC3NqbVWe/JfRt6m/L 77DjZXhAKbgcC+Uq2sev0X0Q4nQcFlpcdY17W1gSpQvNtFaIwk/51EFDFFPsm9QkCjQQFMir yhodqomQBPESlqLLXIhh1Ckybps3LEWWlgV1lZW8L0OL445j90m7ymt1QVjooUyP1DaFdRho M7FwINsFXbY1IoeNs/dnJYVsCyA79HHc/EdLvN0kRCp/faUhfLaEeWmnUr4GUHSpXwJ0MyIp 8tm0MJQ0chRqrXU1gxnj887C+5c2NeywYvg74A7qaBDIKjipFFpMpaESuntHD3rdgfRizKlT a4HZjsKzOdikXGzPG1YBzh5ZG05MrrlZFaKl66BexvsLB/Hr7cC3eH0DLLH6cfxBViFUXBh8 TjlFFmIvYzM2o9s2wSosVK3MgjT8Tqx6jJaxgZCeA00sGLmmeurGqeBcrunuJmCHhlBw1UQK VtolqKocZE3/qPcb3+XjFOKHcWgqdE11dKpmj9bHFkonSq0kffCoVeza8yBaUG60MqjVgmFO TYtDdJFrwqh+JDDEQ0k3azUdnU4iYMXC1DcvIJ9UCcFnF3dZspXUpFLs4cKuc8qzQdi+TWx+ zax1q7wOXboD5NDDOhSSkRm5ba4oVoZp9bRDYvCn48VxJ8f8fDUjOt39/s3cbLQOUBQBHM/j IJ71UvmF0jt9vRxDr3Z0CLyQucwcjMkeyQ3yMH2Gsb1G2cgWkIN3eSibdqZ7uskog1043DGp MpSoFlnNe5+3mAJeeNGIWC0bTcIiiqlJfVj1yQvQyERyW9OxDb21tUg3yX1Vzy1ZahaUQ/64 BriYW2I/CuaF5w+oj44Jy7hatuq94pXVs/JRCkGBpmKLsH3fggN5z0rsI7eeU3w4W4jVOrAK ArltEyHEodchCwqxAEepVqMQxAc1Q1ZD72j15Spa2o/Qrmsjw8IbQn00fPsXrw7PvbAA0Ix/ cjIl1Z81oBY1+cMqNnneQzD73ZlfnEhXb2YiMRLz8sh6CGeIY97fiIiqQ1Q0Ioee4ycmtMGS G53OScAdlwqiNOJ54s0p4muggbDgsrYcS+AOvTEvWdnknz42S7eobWUQBhcD/EDz8gqCojyq gBCFzx04jWRFU6eGZ2vb1jj0UGCXDRERzWQPZVIWFJOv3nJmn+/Bj0xTSM4XmYfMQsiW7FW0 2sldgbytiYzT7omFvsiovPwROk59YCRhORruyzi7HbpcNKR6kTv5XOdENa/K6XTIuDaoVj/W Bw3G2d53rkh7MeIMF5ksLRHi5j9kxwW68Xj15raGTVEJhzP81JNqBU3pehdpYs6mUTqu48pc hvmzbnBTD2Ut86kBgEK0N8CdFaj5QPQtRHM1kBzIawqETYqGrs1tSwCxZFMGu+UNqrMbNXnL gF4jXsbs5h2KGLgCmjBxBuuj6Z2ia8m6eJcluFRJb+RY/fJ+wY3FQK/W+Kab+l/nBzu4tjsc JbGQLD4qKQ4SG5SWi6U/oKyhRnsqHPQv3Wt2GqTrHFp4d1JUG4Gb7N/akFfiTVvkz8qBUjoH G+6oetZXxpuDUYiIVtcuclt2LOV9J1zrqn+AwkcCPsp3a2fL4kxbdKI42R8mEkkW3Mgb0br0 wpFV8uZ6yg5F5+OpWf7rYJEkTLrGnB2V4VbBophalBuK3C5gx4SaTyHESKE6DIloSbekEHpW 8KZIcfj4p693KjoxP0FNLSK2qVabs7OQmjV+QdHbFbWEO5sohjoTrOgs7CiUlkR15Eh7t+ri AcJSYEAeo0xYhsbHPuXlSMX5I4f4LQ9M9mrqV5rdYyxMRhLY+eoVtKC0k4i2xmNon3SzQSOV Zh0vg4uH15nwXqkwLCsLryNrZu/kD/zeKLr4kmChlU+4ZDGa89RWS/OihTsO89Zqd9VeKC/k ueDjWvS/rF7BK+zQbbfTF+7oSXbSOaPq8/nF0K+1Pu/FqhW8isuHtGN8Z3Chjuqo245XnM+X lT3fqNtfm1Etibp9uvSrC3Wjx9bo9soLzO3Qf9Pu23+xMqN6Wj3QjrH7m8Vo/2jdht5zgbnI /ZpO8r1eyEDQl5+hfYb2GdpnaJ+hfYb2GdpnaJ+hfYb2GdpnaJ+hfYb2GdpnaJ+hfYb2fwDt UcBPUj6HOTs2jmEq37GYKumzWoJGiVDLOQTVrTnmI93z6scLmcY8VCJe+m7RwQHc6J1kGqot SfrHr186MKW/DURw4JKXXSyIcrwqb9tcCQIx+/bLmUHCII6gwAlwM/0EzZeG8NlR5ra5zioC bmKqHOWpmrjr6dAi/WizyBCCG/oAJGNaJeIrtyB4rOSyO3UwFkkw4mn+IGzEb1uwUHP50QZe FF4OYBB4TX9jFGG6fZRyHFlrf1F6JcEQeMxcx1uKcciSlk46URGsQugBajFVw9dYEFeZ/QFZ 1UlSSyAEzXQJxQ/J3LyTEetxkGpod1EqDy8wzTEGSkc3UicjWhtCC+5mYe0Bpv5YKyhzQoi5 KG1NHWzbghEl+4DMcem9DbJ1PLDkNd6TGkvLj6Q0yFLb5DIlBH/JGG3vT3MBTixU7Ptq8Vzj 0g/pUBMqfaNqKmuSqRrpaqlnppy5IGU3+aULj1yQyqfz4XMviicLusxxTpMFcM37Z7Ut6ULh uNXApfzI9ElVvACTMQfENjJbnCmuwwN4a3TGAf3fuHvMYDAHJCE7jJra1gKeQWLCmTL1uZKB tlMy9qpaiKd0bC8ydW6ai9hCNbGgQryRGFyKB0kUjWGGFloD1mrakLOR2Zalu8BsA3SZS7sd zwFDSBkfWi9AZOdHhhsCudE+ig9dLE12vvjc8CsB6UmO9Lk8dzIcr/mxna6qa+QM1YRf9g3Q H50EZSJfdndrEh53qR8bDjAzgPdyZ/pGz5U2PBwBiaSc/QjEVvS2zrTjlM5UFioGKSCJaK04 W39a4fH5AfZkRglgsBSZhI+ChDfPBV+QvpwS5LW47mAom2Mp+I8/J0QUwKc+hKzjmThRs/J8 kJLtvK0NUROiaH8QyivIUjV8cHMEV3M+Q0t2p6ohLi0jGwrBk1Nkaa9Xc4b8kNoeM5Pnvp8U j1a8qciHrzD8gJD+YZF0grkYCFQaHkMO/Ty3rSGqt5ewLtVf8hYeCOpVdr/VHxz+sPANjSIx 4tHpeVU1dLNWIw+lHKANsZYzU44QWrpXm+NOhB2gJiMh/VPdqzxoxkCgA2RtratWRe2BkiBe Ul/RopkQf4vqqmp5ml5Uu8zFL1EhfsnRlKW8qUh+k0/6uwne+sp1vPLmesKxsh7EH49UpRk+ 0sYdZNSHUQmKH8Tr62WFVTYy504UYYMB1Kcz4FDSSO/11Ped8ApcjrMyXv6DsF3C56Pka4G6 jf3yJ9Ee7/crM0hYvjmxRMR6DT9AnfJWO8vN0C090rHrWxs4pdT4c8owCk7tc1LMVLuaVDcz U3X/zMcY4J8nqFIH8coz2xRS7dzqBw2GrvRQpg6AsmTjeQUjOVhP6gzmtA/DkcpfJR+S07Ym 5JRS6Y3MQlbQVAr/O6C8CaXon7GontquF9g/E4KfxZc5t6dje7rzDIDhsxs0fcD0TmV7blC8 Dc8uC8pUb45MIJNEkrrNAw2Qc0qt0kqVZ60RqTODTyqhh8kuZ3TApr+6jxpsPy0t7RMQHF1l cuP0ZjM2awoVHBukjOx76BFZnzc6xWoUEu+oRnbA2vwmOYR1g1UmDr0ow8IOE2BYd/imHZy+ iZj1EdHmcsc/+pyGHQekfjqU3yctrTUBt05PsfM+LkfbIofe0dxQt3HrgbMKtNbOUX7kGWRy rEbJzMMqdvAWA7OvC+tHKTWlVP4A3NQSp/kxXjDk8ct9avSedKswkKMesrHBxt17uGh3xRta 2o9SRX3adphoglUqW1+B78lAarCD70vLaRi7dRzEsKD4QxAvoxA6sBIcyDtbDE28PCKGB4CU ylqxd6Bej/szb8RNjEWHQQzhuAxJx3S3Vpnosjd55aq5H4TvAdrwpK281YY3nA93AveOokPa eqEi0VCfekfLt6DRoD287n5OLo/Lq9X7tEOZDqOXBnJI+NVgIhE3YE4UkE/HQvKGOJgeB0gP ZsyNOAcM7mSkXMZu++JKIG8Pb2akcGDuw2VU9H6FXBRaor9HwFjYiCGY3uKiEPIPI33cJN5q Drz8komIVVIw0oWHxR/e0IPxQwqiVkZMiAa3Jo1J33T3sRJ43wH1hojfRbjbAQ+qk/p1dwKP GBj4/lJZ2Qh/moAbgLSmD7emDlGBuTd8uhlxZufQM2RUBj59OxZ4gbcxj9hWQDEvhzwlmEc2 ckpKayzRfd8SCzt+Djk5iekrC1OgP7zUn9Wtzt7GNmZfwq8d3VVV1UznGKAzPNRHYxFMMxiz u+5VfjBLxndYybbylwzXZBRBi6nNzXkuwLDN5GgldC+sXnq5KVF/hH164SFaeO5Ai2OM9ISO xFAPRpsZeDJrxOFkzgz5vXKKtlPJbjmB6LcA17oOzyCI/JqpoPS0RISDf3IyogS6pvoaLw7I BoLmbwaabQTlckOJvr6Duck1E3EnJ5K3g5g8/AYXYi0+p1yFzcU+qO2pvYjF9+ITMMyGTeBS pS0QZjLYLBUPF2jNl31Tt1DfsjmF24ftElan2rddAYPX6w48TahDBx3zMGcq2u5vSpUxNc8o ak+qFspQH56+yfO0LeZyh1idkThJK+q4L/3R8G5EbrV+LBvrU6LDF8bGlNEu6ZtLqkajoyhg zzV+sujtZL+g3HJVykUoptBeJuOID9v6G2pVjePRv2NrB4G+rp5kElzuzpbNX9bwkm12OjPc 2s1nlq7Djf8mf5BEkH6YciOB39wzY5uIUrfBBjf2z+VAoxJ+j1YmXcb29I46JOZYAtiBIkvP pBOHi9qMb+kk/IcFjTt9I0yNy53Iz7gtCFgqFNJBMaHKleTT2xmyMBFhJjdoyku9mldfSpUv 2y2vptI3sSU1W5shlp5pY2zn2K7yhytmAvx2ObTz9OO9Mm7CAjwPI27opcitqeKJa53Cn5u1 zKBM5pMMgNU8BGIr4Y7k250glqx5E25rl0hQTH343pNbEtlVaAo7LZ12I1Gyi0a+RiQWH9/l 0KZKsQ3+x+K374L1xnR1xj7owSorEnNKwe0TQLopUURmrACbhT2cT6plUVJlYUvR8C+mBbPk OauKDGvmFSxHkltoCk8/GYxugEaDXIgV+lmlu18XJ2x+cIjrXsUimcKhqVA32dTf0HM9DzOy sehY5s8YrpL/vhtv6w8hl1D5I/CK3yGWuOFXP9aCyXthxdWYCjhu5Hkn4P6JcSvTR54DzZV0 EPGSKV709latNiSJWo5zxeOEs/WpXG7adsZTGsX1Ahaus0ZTEOwKdvBZ7Ya1mz0Ln/G631O2 pn18edNtCCaav99wrDq4HJb28cnPQ1WVfkdd0v949WVtSwsGC4WYs0mJofmJ5tSkHmhi4Qjm UdhJcSp8Wrr1VLr64taHgwia9FSDdLr7AySvzBelV15EZue+J2PE7Nf0JhdYLFbzLKlr9ThX GAffoTW4CTXtNdSUpVE1IpN9YDtgYLfhCB7gCuhuDBIfKEtkxCJSDPDOwo9k6lnsTnz1aWrk l8NSJoTcm5XRLqB1uM1d4zMnhUIFmJewBG3r7+ef+mEyJtIGbR/gXE23JRa3pQhfvLvxiXOv 1mTvaw+Qvog34nbzWWzuc6GEy21CgMa55XmINouK9rzLNVp1VecnhhaS2CoSy8Sy3ziXt1m7 vK/jaweB/jimU9LftUraeGCRc2VVZfy6/vqX3G30qG2XEKlY5zDlcKvqbCv6JnXqiDr5Ycrk QOlmYgzQVuJcU7shm9xx5sX87cS113//qWOvdBhHX8t+JRzof/igCkWcFmJfQGEwBJHZnEXp kKCaN7IF3pA5ibQyDh4Eiudte5hnQduFvh3gF+i3K2qA4g4WLNBzYPcR7g0V98Ul4Y24xDE/ 3yE5d2sseTm5owPfAiYv5d25gKU3QjB9nEXB8iPq74CN1W944Vc76h1MaPqZ3eBFtc41DuSa VOS1C8u4TZ4wGMOi4gklMf+4H2v8+htukGgiOZ4gKMTCGJRAUC4PCYQWi9+sL527gZZhrU/g fT9dPIBdaf39J3G/szWoVNEpnJsTvuQuW69kZ2Hb/GEymWRE/c5P66Po6HOIvWQ7oqda7HmI 34kOly/5NNEKbk7sd8XO3I3geM5MHPaVyLkZzlh43OGw/MT0WETFpoiwQvsr2G0oXfg2iLhi xz6DfgKNJ3uybRBVem5YbXE5obttPEW2Ad3itou4g2LhSIps3Dzi8GXSwbKPnWjbgNFi0lV4 qTt4O9FwVGdM66WXwj1Ll+FGgG5erA/tkn3DtNyOOj7OtZuYEAQqvCr6UPG8ZmpyQPQhhuQp fQsOFg/KDdFJLF6QaXSbRssm5ZAeK8AEMGuX3ExdWZVroWTbIwU7QYG8ZZZsgY9zdbMtu9h3 14MaOpdyd8pIdVF/uWlL7IlNNrwrBuc22pDd/Jyr0s5J75IS0dthXSJWBK+6cKS3Mm1Eu1Qd BjmCXcCe5bkweBVzhT7qqKSEbH9w3Yi7h7tsXf89UzBY63br7AEkUFlN38K2gb+ovPHmrN4m +498sF5FNiLWC28IQ4mkYWFDCvYb4CMZ2/cdWMdrLq97iGVMiREDs3HqHTpqmnSeIGb4dJgS bdymA9cRF02xVFy0J+OiAYAt0XZteZhX2DFeGRJQVU1vz7OBdxTx62tGrPQ3140NfG+sWQJe Rsw+7mOyjj2kqCclnomGTPY6JIgnmR7VSbXQu7PykCBaxfEQvcVxmfS/Pb8oXM29EVfm2F6D j/ZtrKqSjOBxe8i0GcnfoYLqkF20srsGZ9Rn1b56F995vmsJuzrOF+texW/ADwgw6GjtIloe yYBEGbiYXjiMQXdg7WjRPzNujEk3q67oOGG5JeuEuhfZnS086kguVbhX9b7ipiUzD/D6BvP2 A3HoAfvyu1PfjzBPzl1VE3UdNt0Lv+Xzq1NldCBCTLR3YuDAETZASyukMcDEjh2Ej4yHdCBW 6BIZVl4FufphbX0nu4TFM9PNjXk2zN0OtXMp/KTh+9jIkhFPvg9qFPUBo8umOPiV7281zEv3 7KwbQ4mJB31LAhgveXTW4FV+teEHyJIVZqcmF1+6cLd/LbE4OJ41Nx66K1EQ9VrTPX0GPVcn ZzmoUyab5FTtjrNkqe19FxUuwZxxvbK3lFswVFkdjyAMsT7qXhOakFl/1k7zeK+wIR6cPkN5 ILV4DykhNBG+1RK91e4eHZMqwJRqcEOGYXO9rcuEfO2meXDzve+6O5iYZOg4InEob1o3zuyg 2W63yTyIfPDtqObrhV+pPQzUszsUS/5HZL/MN05xls5F+d5pO/gXWUv6TCRdy9HZyc31z6+d 3P4ia8lp67+RteQK/WfOkrb5z5Slb/7vpCyZ/S8pSy8WLPviiy9++0V9E2O4yOi7v63dcuTR +QVffj3fyJzJXJD5/R/v/0J+vUy6FtTxz++cHf9CeGddHtf/rvDOTq5/Su/o+F8gvuMCvfjT KBF6SbbX9/8i+//IxuyjLwpsv1jwF/bQq1nPx63/ZKPLX7HR5d9ho6OL25Y/LQJ1/C80SMLf IP8fGOS/p/EHeK3y9F/SQG9cXct5y5+plI5Ql3+hwbzZfc5i/UKwOmM5bN++exds+3az49+f TNZb4x9juf9rt3+wx12XrallT7CZs7arzpqJ+lHmubDXb8d/buTy4tR9qwUmrMHnJx3qIoo3 xvwHe2cBFNcS5nsgSJBAILhDcB+GGRyCa3AnQHB3DRpCgjsJlqCBIAGCa3AI7u4eXII7j+gl 9/J2t2pf7VbepYqhpntOn9Pz9Xd6fv8+/XUvV5bApDBUir6iQGjbgJJQHdTHymUVhCH1972t REalU2NEhUabrHL7NuYaJDypOJIwKsar9k/4eweclEdnUpNEjjw7bgfxjouTJ504EFSQJFDa yFkQD4plSIN3Dww+NVIyfamEgBV8egsMYVValtxNVW30NOeBFhiIZR/+RQsRanqP/qkaRI46 9HNgjMfyxaZAGC2aBMTTuh4ITkLeqAAbklbVI7QwyQTBmPhwal3s+7qAWOLWTGapk4bPHseu OtI4O/kvuPpFIgt8ozoirLFa8XZSXF+G3X0ZsA196vrSMjErgbwDM/EUVt8ZnBCBCOFN2kfu asHROkgl39ATZvZyEepBYopbI7VW3nOtp5/hIThFCgXpRCWimILKKCTxDA0xgU8TEhqjROnq 2Mclg6Ob9Bb1AtjqyCFcjw1U0WXCByL9MEd6Po309NQNotFfLO6FvE6oPMfRqzyb/8I82xXP FxjPOBo1zKgmRQ+RRV0IVq8youaENFJHeboywRh7zgMxjwhptH6y4oKd/0QsSlSQQUnp6Ogo EopnSE6pu2vVg8N1/9TlcIVLYuRJgmnT7kyaTYoq2rus9PE3WfgZ0TG0s1ZHkgEXhLMeBIeK aloL2oQt0gsBR/y76dh2rdB1LIUT/PEPSJtRmWHqqle3qpFOaOBw3GNN0Y3siSC5W9Codnsg t01RarqbIcTGvTYeJJxg8gdC5r/Ges+9b7whK3xwUXihPc28i9GJkQLQZ+Zkjm155b+jFzgJ H1MLhRYKZ5cIW/iUkAkWswaTDVJ5Gt6V7+7tWz3EhHRQj0KR8z2x570WHt+hgiJ/jDiMnFmr KQOH++AeG+xojZgV8iNo5VqQ1b3xWwKP0bluRUyDoj2Jb6PIkuCmwBoLwIbi6CHmETs2YyF4 kiY5UeGIez0PRVdDzvYST7RJxx1FAT2YEqBMtO3WTycqv3VHYK57s5sT25OaiWDw+R1t2mgY l9paK5aPd6W8sOolZvidgI9ghupEppUO8V0xquBRarumqaGJ9Z57LhFj3kbUvq8tChXu7xv2 ShQg59dP+lAUrjfokYh3KPw8PaxPknY0NmIgLQUEkKi+ke5TVsNLnUyAD1N2NEO7fTuTAdoO qkSjyeOOXIbhB2b44DuvQ+jrlHRW8+iHEYdfD8uumeIjN9XgzLyxgix1egRrgZODXoI3FMgZ sNoUNP1uy+kj7iTSpjdKve0WmiuqO+X57XMkdwhefw8B4nuF8MXQvPxQfKIqEulk+BRvKJDu froNFIRJhux5gS08jxp1t83XvgFZh8j6JZuAHBlO2LhoTwpSL64cRoafnaddwm64JMVqeFwL qh7kE1CZv+tLVz8uSXcJ2eRoueGXgv4v82NsQm0ibXy2w8VTceW4M+AV4O2BRZ7O8cehx8LB FIbUWFRNEerkyveHaFiJDx7FU1kSb5JXi7pnuKaeWh/xHMHDJD9LglL3fJsrlyQ887wuse4l 6cMeYYAkQD1P4UvurH4jpbgTuQC5Fnm8XFIvZOqO+H2W5+9EdPtKC+0LOUZhRqkIRFiT4XqB S+S7m0uVu2L65PouC9gLUAu4C/KtAkjPtZtv6+kBWrGbsEuwNxVYFD8qHNK8VohVgFV4p7iY 7py5rRig+FrRMrNKXjfzKFM/01zRVN4lMViWVTFEpkt56q07n5sOslvwKv7Gm1n2ps/jA09B kiBSUKQxfvdST3Rvf+/uELrxRj/XB/akxu7t/tbuzG6ObFDOwz6HIUwjZaOEHvdWBQNnQEG0 YjvD55Rgb6mnwQqG1VIfOgNzwjZcJ4rKO8pRdkWd6SoVKhEqpSrF3MzPZM4WjoOOHe/4wtJ5 2XkRwE7A9nkLe+d54yGNISVgZ+DC4NKDTFjKLSVB+0yaZo9MXeuhDeuYW1hGzG060MH2TA9Z swHrQK8O/A5og4qO4468z52f+XfUdvgQ/V9ECcULvW3MJa9nbrDJ1n+9YEvr9h76fbbShBJR NkFWQdZq1uYI1Qj0SFbRcu7RxGB/pKm6rkt9sMmiYUlrzsTGi8oY7in3kDNzuFiB9HpYHykf lGCpYJ0miiZrSrc0vTQNKS86Dto3iq3l84H2+w6aC669R9kBbwMaFqLbLHMwc2JyfDQS2kGx bQnqrI4ND4eC5oqnzJvjluPXqrrcmgWavOZkV780y3dFLKpusn/Wn301Y9+wWlZSVDJc0egS u16nWcuz6nV4eIJ+sntMc9R5kL3vtpS2GvV5aIl1eXO6uv3CDAJMzPbYtOZxogExay6JFXMz tZGQjDITORtNKcehrK+xL1vKfXTkOwgTmM4e8bVcMx+Lme5iYhfTr/GVyh7ObhHdt0KdQQWh htw3J40ScRDpSQ5PRhapDN4PZgioYp1yqrJzNwx0ldSRFGi3y5I2e7Im80Zx3L/0/ZeVL88O 96Fd+SX53er6oaZgxrACKTjIMMkn1YwKcx/PLAitBORjxomHS8+SEUh/omiiIJJy74Kf67d5 Jwcl75AqaTMyTjBuyCWtCWP5ZvMT42JIanlqZBqPmK3EWCQ4fiNMM4aH5DFiJgwjMxTzvoGk obc+YfubDv8Ok04KPUrDhLs08MAXGuxq7DDsZ6RA2TAjo7y22fUAysba2eNHVI7aFhXPg88l 90SDUldT659sPAE9sdzW3Q7BorrsupwjoxlGCvXMMqZ6LaO0I62j7BmGVKsMjrYQPmCcKPPT yis55PSqK5aa2BVdrAiYipoyD50WDjqbH40qr+oM2aObYOYw4KtuVlflieaIPmIprbWvnwyK DnoWVPl6Dbw+vpsXreya2lCekj/vRl2y28oKnlJwA1aw29taxuiOxNOX0tfRlxQ7m3Er5KhU FbrqqS8VDyIYCFk3vl8XG2NUHlXemOAbJZkAKGDIDVTJeyxGxm2+73tvOeg0xLLZO1xkPLRr MbnhyR3vErtvskE/cmKR8Hhq/ez8RN30jiktyjTyPIHTIyz5oTP61TFv573j8GMUuBdwPshC hCsmViZGbFnWpVmoFi/BwURiXDbrnAmbo6/pYvdZgbESwc/e9r6VrpY+Px/Mm9aNa1Jteu3O dKitjJidWophotHLMRI5Ce4nnJr0IF0SNPQxFWkLieQl5Mqwzf/8cjsjvy+l70WaYRcdN9Be yc5h9tFoWVhnSqfL4lzn1JL/0krlXdeZXqHqgMWKyvKuRzYVdtv5bQv3lFWUR3M4NM3XrZeM j1pm0iI1myYHedKq9k07hziOF/cTCLew2RwnFo8b8TxZcybfOBZcDJ6ql8Ddg/Ox2LHgLYuw X2yc+FgBPFCaappkdE/cStxO+lQ/mvDQ3YLQBp8DtAYc36Fa6alE3Wgu0LLxeMKrdhh9XGoj 6ZI147ceETHnPjcUz+DEcSy5a2aQvKTcqOXIzep+Xm8ZX70n+elhcNXd6uizyt3U0TavD2ta 9lIvpLld486cDcoPg0ZfC1iqWlZMNVbhvW7xCPHQ2qudF2hqmg45MCwwNLyAuBW9c3oN635D 0W/vwADQL9hl/ylC1S9FiYAAv7atvh7xd5aVI9b4q/B10oj9hzS6gdsbuL2B2xu4vYHbG7i9 gdsbuL2B2xu4/Z+G258DuVfh9iez/o62X3N/Q1v2f6ItkInpBm1v0PYGbW/Q9gZtb9D2Bm1v 0PYGbW/Q9n8Dbb+j6N/Rlpn5Z+7vcPuVZa/ALZDpmjlGQKYfc4xu4PYGbm/g9gZub+D2Bm5v 4PYGbm/g9gZu/6fh9uc87N/gFvxzSPYq3H5n2d/g9mdQwW9wy3IDtzdwewO3N3B7A7c3cHsD tzdwewO3N3D7vwO3X1H0H3DL+jP3d7j9vlXfFbi9JpwMyPTfDyd7oajui6eIfR7B3oJQ0dk3 OkCfIlBpR10hUYwxkVoYqx5RaIqbPzKAyVcQEaHXvkbWKdmL6EbzbDbgfZUY38dK+tvPep1r B+FO5DJklBxXSal4Cp34qHaFSr5wRuhRqJq81u9y3TmbOrJcTMBJ9izir8w5wUgmrwfbtqRv j/fottZwHC1fIowsLl26End4RyeaOz9tzlm1Om+oNJMy5YbZprJlGR6djQT59gRclVJhP/n0 PUHPApOJQj9Y71ppopJVqAB874dkt0+TaxbA3kHeWGOHIJGIrsZEdkS696/4UZ1gnFzzfBgP ph2QZWqkw/HG+xWEdklNB8VjOwkEXMp8ykSesJamsMoU7Ix52jdndhJ8skcqqpaja4CJh9aU RfRjnxZ5+gFU9EISbipnrAd/S1fwPC5oxRXaidUqU4/wDZw3UbWqcUr5YZz8q9OC6RLPi08q 7fjLaxry2djOYpy1UzlbhUuWvqJyLJxxl8cuP1Vtg+e2CRUXIpSGCLlVrZlNgMlek7YbM/Dm 3sdmw3UFcopt9NOFKASf/Jq3NdU23NS7vuRn6iUFcfgqzd1AUgadPLaSN84zPi/WxHlgCK1j LF4fdWoWP+pFfsd5LE1jIL6ls1lUvtFOZYN42CEs1R+s4tnyLEYUqt6QuC3oSY+05+vCadq7 abj0OootiQ/lqETE/GfVKO9FohmneM3k2jDhO2p0PC/oSqZxCooN7qiLtX+5HqeRza+fC6vh WEjTyE8keyueZhdu2H9VPgl7A3e69WIuLa4tKDgBF09buxjr4mSYbqzr3QgS9Rr1Pgtnzexj w2GeIUdMl3IMP1cLYvGxrjbfZoIJKJNqX1xzmsdnMP64qjk+VTl0IeBPXG04OzAPK7c/TXFX 9uYWrNBQHHM4z2tyo5xilhKqNJYTDlu5UXkmQOEdqotYflQzia/s07eWw5UqHEwbc8bUUIR+ tdLZSW7HJ9DxMe2znyZRlJTHUSKW+as4l/OV7tQ+ct0n/bpCWIfvY9RxOIAbeTNE9R7eyvWb L3iRLhgq6d1o3MjjoniiGCJINUIZxLUkpsSJJLRKjys6Ql32yZixbMm3MfsGsnNLhqJV2Gks o4gi57aRj2SfDCpSb/tykafNa+SaOXZ1vLZMLbHZXaBKtj+xXVSZVe15JM12a+osGqIjYJj1 1k6zytu5LePkKZ1JJA54882IoQzfF8PoEpYxG8aAHY2pWkEmwsBQtHGCN/BSMCjw426RXhWP X9fGLnXc2ZmhOaZZAPOSVFGivx+QjlUr06F1qZuhfHWbx+2RGN7KfKlct30jQNW/hd4C/MQ6 vMFRfu1+eYxtlU+VuTJXp7u30YWW04HbpnUTriAtZk/zHCGrt+PCrU20OBd+8+iOYt7to6r7 +eIuB2wHVUlUk1q8JWqsXwjxnAKMdjqUVhMO1LM7UKY9vJaenRMlJrgqXte5/QwnADCxsv8V O/sz9/fO7W/hBFd1+/cAWxltQ31bYsaH+nrG2vyWTsTqXx9vsbIzE4MBzBpfw6jtLeyIAcSM EsZ6tsTqxN8fYGlcCb8FMl2NUPh+UgFtO20zS8OfZ/+xGaqSvo2tsaUFMSOAgeVq/C7TtfPA foQ4SNvoXXaqlxUQsvjWo6pfZgOAYJbLOjAK21vo2l2e8dtFmX5Fcstrm1uZ6SOwfe2d/yrz 63VZUNDSXNvY4kf+ZVpO28LwmsPkjZ2/5l5eDoTw9XL/SQffUSfm8OzBXYjuE0vdfiQpAJos YEnOQObBF1zFiQ56V1W8VxahKxfn+48s8MrZow4wF97tOcgqUa3xb4sNi3tI85esvu3Otkf3 t9UWW1Q6n6ZZhAZWlbvFWE8wMLtbtmJls8prkgDlW+AMaOKIoi089iVLPsVTS0WTEATN16o+ g9Z9M3FO8BY5DTBIMKNwrvycjBIVzNUg9mLurlgwv+sxhIiyD2Q4PvSwAxEcj3vv2ZbnfAWK R2Vx9ZMH+Zu1vBpLvE+6YMI1sGjsE8eWlOFEHfBlyrykKhk503egxKyZ46/zxF9z/67sh/sr 87fW/P549E9qzYVaP9SauxBCtecVNhFsaDS9MMDNTVzbmIHP80/M+dT7I+f1zYXqb20/UwiF 7VWFbYbb9pIMtW+FXWn32bjOVj+dHMz8l6muie0BAn5MgPzTTZVj3wx9xMcTCtmriisK84SP MDSZxFRiO7k4scPUdjsLbDsG+/zltab6ZoG/m+pn9/abqb6PS/6LveqbBf5uquv4FfBj5sG/ 2Kt+DnhfNdVPRfCbqX78XP2LveonJlw11XVD/oAfQ/7/Yq/66UFXTXXNjvBAwHcS+zd71c9+ 6aqprpslBfihtf/FXvXz1+6qqX7+Kv5mqu8xFX8WJfvcqWNCF+opW66MkuG/o9vosEIXhUP3 pYGXo5DIHfxW0YI5udpY0q0HW50XcMBnvhLHYWMvciKsby6e+uidYLVcrHMSSzGb7oZfXf9z UhvRbh60870HoZP3+h2h9auF3L2iNOcGlJ2WyTXdPKPi5xonkNappZyfyRPNpYiw7ZFIOT+9 13VidNA8UDHfS7BdqnXkWf7yujb4CWcA0K+VwwDXhqwA/jyp8v/61v7J/H/5K+BXYNBvpvrX 64BvFvi7qa7TAd/mmf6re8FfM22vmuo6HcD85+mAP6UX/Gbaf/SC1ykM5j9PYfwxjfBrzcSr jXCddmH+87TLH9MIvxZSvdoI16ki5n+9Kvpmgb/33NepIub/T1TRf8NU/1RFvzTlXwPqwpYW V5c+VbCx1//+wddx/u8fSgirSPFJ0CobWxjqXb5s6eX0De3NtL9+k8vPBfVtdW2MrewsbRC+ rl37zejfbH15KDHjQ21duUtjWfyVI2xsY2snYHRZHMh82VzaVxLfFlz9+iwAwMTEhPDbo4Bv Z/5nzf+6+Pe0lLa5/n9YYTNtQ9tv1/p6ND+/pROCOhMxPTMAcNlKIHZiNnb2y4YSs9M2M9bl szA0++YWfLa63xZvvUR0xq8X/Jr4VoRRQNvqx8KwrOzsCIzydvrmSl9LqPzIBX0t8lDb6cdK siwswO8XvvQEfebLanzXWFe/5rW89kMFfE8DiIFsYKb/Qu+n7GGFPkBwUXXgYMnaEvaI/7ax lH4IiDqcU+cB2SkTvtiGpM0ABRmSY/oCAy9x2KXHCpzWCvb4R3WXYa4EKpGnGwl2cz/DxX4n kJcUk0ewGuhQKGNuOLukMhcoHyaVFu7uoCX6YvB84uxzQcLBWd7UQdVmZcfY2KCtNGdZRgg0 jDorZXlLWT7eA6HssRIcOWXkexltYDvLcbq9QGm/l3t4Fc6sotwueIdwBOt+4Iw+3lpWhxpi e4dbh6PBHWMOotwVmFmO5sZx24aOfI7mUmvRKwmdfKwb4mYWCf4iHvObk/kDG3DK+9Tjn+0P CqUbC6jCjIq5L6ry/bBZOscVhF2oXrM96VZD2FlsdT4041Mdpd0THzraY6ftXNWceHI6HVaJ tf5peEO83zGPZOd+Nn7mmF8JgZMUbbUveysucawr585b45D1IkZCO3m2QGHNHMIskPBhkIgp 1jMH9gZkCWfVXolwb7JKqmV2MTiy9SgFygyl3o7wTDIYckVxNRLjDLIoMqHw0IZnvA3RnZCG nrxQHhCT0Jpwmrc0YYIhfDxJpoUe824hbbEwQaxBqXnu1dx2UXzHQ7ocmoJFRvBy92OKIdmA qBr5MoUYRjiLWCYZg98zvt1dyC1CJthTWLZbgVCWEE1PtacxHt89xOlGLBxgaO9q7lIJx9Ue 87JXW3kaOfo+dd8og14tU0LCvFtuXW3Fgb5ISqKxUEGhQinhPd4x6FjROUwzHWvpyDl+o6fA viQ+Y7VcQtkuJ0JqUBJ1JuwdDWaeVJFcSmNulQWziIrBHIcE6H30K6wkUVvFJEVZky8T9wNj 3943Y+4Ylib8ovZkoGeuYXj+vstHefwAWb5lD80XUTGkdyopjZHV+XE3AryL2KsHp0NYamNt sqjHLv+9WDO6RR9Idjyn3KcvlqMw/Mp7s181vY+hhCR2MINGya1iXjv+lZ/zrKZWVmZNn8Yy esm4cmmfCz8JWFA1FdBmrqQKhKjYqMmsoRlLnQY9o8X7/IZaeaZzgWcTHsyysF3zJiCjUCvr 4v1q3Cb+Q/ZX8rQB23BHHIXufPSlvPCFkNLdPKNNPj38SPRQdIUry/fsAzHlQnS1BA+8TJc2 o0uJOCMx+qE8EJNFal9tFT3Dcc0uDLnDdgrBHTiuta3tHpvg8JE2rGQyOLTOZwAwvB7v2EO7 S8L5AumgR9MppI9zX775Y0hwNwwYpbeLx+DeR0gl4SWiJ2ASZ6JPJxLHT88/bauSS+RH+LbM oXDohlXukRigbwdHNHbaIa7qqKuguCCxN5VNB4TZI051wJU1SgdEy2UEl20/kihk0NM+lKan wsIYHbFIpdgd53ecCwxXXW9/u+vySfW+qQHBmjXYFxCYD9+szFWjrDNoflTmS2uxIG8fcUyn 114k7KLmSFIizkBD6uW/DKuAwU8UlJ4VtJHiQlCGApqURukWKEyAXYaoFDTm4KvOP0kp2CXR qFmbf7BWHpmbakZPBruszTlSHx1ybtlCuI+OZ0DJVFUy7OKKnBnZ+2JlgcrxC+UR4Bzzgv7C N2Sn6zDqmaC3CqNag5K1DD6aZUDJKzV9GfbEN/KdGZJFb2JabRcqNqz2BGALkcwj9nP35deN 1/faYVjw7I9klbmzhRQr0+fdRx+KGQ70ps9jV8LivO1a4yCOkH81PECnD6JrH3ygY0YQUNBh RjsG0OjZWYMBNwQnRR4QbxYUrDGufVhDFGGwwmKcTu3bA21RVEVazobsUB7Kn+qvNWu7h1d3 8QoGzZ1ymbSjPdGJLBV+LojdS2dxj7OBwVrwDaZhI/RgR/Z4igKN6UtOmRMc/UdH6LQtikmY 7wMG9EOR9xjs00Y/8HgRcCdJlY4P8xa329E7cq+MbuI6uE0fC79OxTCyJUEstMkWW+0tNvUp tF6/d2b1KTOwMzBekpcgeXU5iHZybii3YmresbQ13Teu0aJUfZ64tcY12KZk8FVPi896j/FD M0KlFWk7Pj0ZQXYB00bz/tRiX7p1W1wd9VdwI22kkj7LicVxcejWABLkzMacBRuPLcpGkmzl ANOExylafpUmPsVPs+VORu5q+bGW+4B6h9a4zm5zW87tLCNxC1eMOOCznezWm8FOTsvy+Oy9 7/J/25p4O4NzxF6F7wMHBWFSIwuiFu2OEcN+ufgRBEyUAl2Zdk/d9mobJvRp6s6H1wdn4bOm HWU8up0gZa0F+mPNmbVnqkfAHRtu9hHguGoMTvlnOYxanCMBAzYLFXJrCWqAqemtYguKx6Ku bXdLkKLroppUvM8eQeW0kXr5jlsJ6ckIw6bdj2lS4aOFcr+vhzu4aSLpqpZlGphcmfYpEGfw eV9VozEteTDzLf8uH8pAGW2RIO28UtT8ujHO8CSnhzVdvaoxAwb2LgY10svtdCwF3fl1Bo6x L2hj+qZnuvNZKN1gTQpXOmJDFQ1nZVNQG5MEXw90Y98ZcHKrUqmxzFtRKmgkPWmnsedPH13+ ZKOoHtsX1GOchL/C2nsu3+KJilLUIDFhbqA+u59OjtaMmm8jkf26A3f1s0sT4q1z1H1+2/7W dIequ8HyZ3pa5Tkf3lEYHHjPbctSuoLrDKc4NzBaZLTTtPkeUhCBsmo/pcethQ8ZNjXoiOJu iSiJuGEX4eAyrTEricQhhL7EiNSeLu5gkMcct/A2kziVqm9let8ePB9nTack25s8UFn1Vmiv di7C491xaJhZcCyPaepQILlJjviivI39ppVGd3rF+L2tNO4ym3d9I+zydw4CLVlH8xB6Fwvf WFW8kNWKNTEIac4qeDasmw0rjAai13ykPTVKSzWi5olRi6Eb3SPVrsW1rOq9Qlc0rIvbsvM8 6LGUq3sZOUDfGsOlM2K9sKRtN7JAZVZujIa+6HNXiaO/UlBqYzMNgZt1TfWEf/QEYb3/49Z0 En8fnbZWpgWehMrWs/t8Jp46eyDhVAuZgAMqmLatjPq54sV+8q4sUHHaZrjh8ZdSv3VXpCaS HjoJxpjzti/o7Uj2dAUqtRdWJRK8mgmhYUr9s3oChWRhaweRDRG3AGsrTJMresxmuDN6XDHY MWumgDshMZIipC0bdyeFVXub5zPcP2Dg+9ozSWYWiXZ6gwo4aD6OT8YYWX/whVn7UMpztNrC XrvukW7xpsAiF2BOQuM5PYTaaYPmdoiGevgc5MU+WiH5JIrbh+hVRIqU/9yabnJ+wL14eLUj mI2FIcbWvQXMExs3t2dVy3N2Yf15Hgq71LoODIuxWTXw51MMY4z4cG+5DJm/SEQg+JHOLGW/ J0015dwcHYY1u5NlMeUkrZzss6SVVheQdR2s/5rwwAL+JQJZrg7M/5dxXZRfWU1ahVbgkmF1 bIzp+S3N9K4h9R/DpQqWihbG39gRCPwxLHgF0IFXAB3EcgXQWViBxCzsIGJmMCsCCAwkZr7k c5bLE4Au0Rp0eW4w02X6UteyXDI1mBVMzP41zcZGDAYBicFAwOUxTJfvL3mblYUYBAZc5rFe vv7G/N8q9HcY/rbDxrda/sf4qxHeZlLPdFfo4ByBvk8ol24RXlhGDkpzl2/C/Sl9kFdi5Is1 utODyrfvqO2sMZuU75uytErvya9P0G2XsMV6G/RwWt5/OAfCRSPQeNOFQJ4F3OnoZQUWkrTJ jtP1SQqsn8gqKFIIngeHGwcHqHCP5r2FO9/HpRdaZNTZe2LSG/UZtw7rzrwhCTD7RSrhGHfJ TCqB6HyGnYb6vIXmYPqx+pc8aDQ2VBr/hPsxPb3oagJ5e1itNNT29jyrgR/PsDLUhYamIjP5 lcWNX5pJxClmPoeiZhUZvINOrJilThUq984ODkYuM76PG/1xnh73A8hicU6iJAg1q1F+yP5c BxmIiTxcqqfv4ujRHy9yp0HDiJZkcaMT69P3cHnt1vjD4qS4fkarZBb1w6hklmnz18ShOlBP VoZtvaDvob01kdJ2VilUZeiOcnAUYxqIreHMYpzJRb+4fJ5Th+3E4We5GJn76hr//bXxCRDE 9JdTX32m8Z+Jtuvd9pteY7kq1+hBAHZi+q9z1QDMlzcIgAn4f5ds7CDmq5INzH5FsiGwsYCJ /ynZwEDQVcn29ca8Ktl+7OVy1UuvG30A/hgt+yXZvt4E/6nPuim7WCkM4PAexNtuGmzqTlU4 Oha4sJ6UV4x08IRPmBGS4YmCw26ToEIJkj1AI+Tzgr4tTIfcfDubntqOLjHdKE/BvFY8wUGw Sc40bpBa92Kp0KhJLU4WPY3RmLZlcveNW6iMYTmwYpEzxKVq6sjt8s+R0mFjEpqmxh0CEnsE zIKMQLQiUtpijjNWUDacVg9xe3zpXVJQI090rbkBOgr6iQJuiWeP+b2DyONbpRqcxW4pXBdE 49IWeOUlhbxOcAfvNwhHizNKNUXiUS4SjkK2XDsO9zXupe59CN+b42R99UXHI7eaTfl8APKB tnpy5lPIj0gsTz+ZQ5lRddznkvisetzsFzU5Xqo5ZXOHjQYhgtEt/+ChzkfQ3ip5X9SO/Oh7 DDenbMxNmdPpRZa07SjI6fjYKtez0H0T7bRevaSwu9Ye8BC7IsRJlY8Rip5qesPJbwmcciO+ w4ZbMoBmEjqx8sCWzKMhXG2Yyk5EKZrbQ5n+wvoA7xTrbjSFlUrBXUFZbOxpJ0ghVE5khMd8 sC67UHhMUPemt3CozVYh61adXE0IcqdBBoGTCIIfCWeNgDCB9x5DnYbqpC/0e/UzGj/4kCzd y9hHVEfHhTzFz8ESzAAIVW3g6jyN0W8GrjAcgt/Wcxo9uLcE2bYFH6SpO2Pa04N7p+3Yzbqc J0VPLqOcTiNB6ZSHQANbwhA3n0mRsu/uB7pgPePetOkxYGUukCjxwAkrK13//xB3llF1LNu+ B4IEdw1OcJdFFhBcg+vCXYO7awju7h7cXYMEd4fgzsLd9Wbvc/Y599y97zvnvS/vQ/WomqO7 RnfXHKPnb/6ruorM5C+S6emyxXH8i+meY4l9qI6M5GEQUxBkaKZPdLncSk8b03m37YOOCK1X mJZ3mdlaDl/1HKdLFawfoJ4VpgU4O0/Q3VInQR/RE8v9NFQPMRR+nSI5uD+ljOekZXQu/6Jg Kr8JpN1zhBnU6XqCGknl8CB6/lINQSIP8XbRstcwIFs1z987K9eIoGhT/X0Eifukm189YK4g 1QiyHJQxHLNXEdU3jQPKjqyC9eGsz6Y3MmJW5M9vQIUjB8GaI5MHXHCzR6nRbop7RICIhVZN vDPeY0ErAU3Zko3xRQQpTH7mCntXyhV/KGCnZaYakSxKJEuInPbuiDmzzGRXENvHI1xrlPaa exfmVjw2yM6jcXQeadatZ6rGayHn3Ejs2USLW+s0MGqBw/8i2R0Li3qtB74rsfxJWCKYB8g5 s/J4xKS3//xGdd6D+tqaRtNKSbdIum6HP2ol1rFEPF8NbqxydUEuuvPODsc3W1Q13H0xfnDd twaaBJ4F/vss+RYp7psI6AH7hgYeZzDKy4vrWmcxP9GIpVZK6bZaMDADRHK6OjNba2osY3Cd 5N7C6UItIlskUMn1hBKHdbaYyP+8sM+O5eodMViunKoVKhUJhPGZWWt45MnjycIvvQ0spTtS IOT5sVqazIt5htWUZ7MZmdI/U+o/7uMNepbxK8wHv3ibJDw07j0YeqDwcdyMxmg8bKNeyDHS KtovxZHwf7+Z6clNyYvgyexNwyA5Y7lRUAI+jxIjFN4SDPtd4Mq0pU9bXN6imV6RlUca4nma 1Ec+1IDkLL+DVoSfI39q2ipeinakU7zfmtmdnXeFp24ltzvobuNVFmDxIIrUg/4mvNc+qH// JQETtnK7unapmLY80hThhqlLCVdRsSZ4AylGwVGjogHxoJHLQy2xW1Ynwe3NeM0dHFEp/Hnk 2/NF3kdW93B434bY+bQv6Z9ZNlsVsvq6mAhXJS4SiyDxi+PQvRXpzXt3keHg5njZ5trWxwwt zEEwlSkMX+EP+mGDUmqZFquMLZ4N59tbTboRs/gXX2cZmyUhnVooUJjQ4BlSPU2mb8DOnJoM yjIMW4rvMxvdGO7bCB1aGJaPx58vt+PuLw/fV25KJuAJPZ4RycYbiETrladuFSTHgz6CoCU0 J/kUKpSEaBuLWqCbB6JoCuPlMxjkSYJPlCWK43ohTNfVcF4nPF80FsQqkxgBEt+1G6SARYZ4 QU58kTXiB3g3asH+e12Z4FO+RkN9XMWVM6axNLaTPvTgspsths2Ltds+yWjRA2hivZPEUnqY dDnqoeyC1yGeEqmBn0TAII1dikslkc1Nx+CL8a3QgWZpKeXQPWLW8iOU1Qwk2FgmPxCJEJXc FFjKXVqeV/bSHiqq9V76yLKNV51S3lnkXkTOyfDM03iAVZzEXs6HlIBrIJrQQaZDty+IWML4 6qVgQJpYMWbXVycoi9wFxeIiLBy+LnECR5BOcsCmVr3j7SyDMG0+2iRDzFcdDmXY0a0XZY4j eV07gBSHkKfxx/UonubAs/jYCpRkU8vJKoNcUiytc1/mk/U5SUieSsSG2Un/lEdcBr4aDh84 1TYcwgcNcrKhazIAlnZ1LvPytQT190z2t0gUeEBfpyKbG4QtvS9NJ4mne8va2YhsHHLE+OJr xfRRma6ndxjLmZ533zF5D2ZLMp/fBaJcuZUmnpCQM3o9aR7cd61Oz3fc9lwhHiZmvNzKcfKz Nxc9theeNl02eyzhnPIKt2EkkkYWI0ajxRl1cIXfmeTeE7x1gNNZ5QdJCuVwSs/2qUpL38wX ZVG1upf0n37WTLHr8l/KXJnNjVx+O7EhIkRhPH/6bgxZxLV+ab6lZrsZzmPMd1mLL0CP0BvS TyZWvzjwU+yoWH5CdG48Hf5BcXTaIbmTNaSMWnc9IsXw8E9b1kOZelWmVh+n5VZb7TAebMS0 xn2uay2HVkrsVrC8oU/ecP8hF6FKnoCbRVJBesk97DYmgAz6fuRgMFPU5dp0tMVWycUTdN4d gQgnjVTqnVfDGeRQZnWDgHNAusdkBw7Li3XHDlXz4h5LfHjV3FZzdd33A4tzOyMz2F68PWxi mm38ztNct5pwhE9MdPLJ+cT74uZusb1MtHtCnuLCs8bCSthRfyZ1bwXYYqce6257Ocj4Oa0f XBbhQS67+u5GMqZMcRr0TqahIr3JytacpaJ2GCdj26WlW7Zrp7wOdvrEzM4bt3kcqgKeZOvt neQeOCSjMd1DJOWcXNGGCS2DlFLgeyf2ITpcVCzCV9nWUqIfV4UfBtgRI80bCe3OviHJr58d YTuiWChcwUqpqQ/Pj6jR3TlQ7GnNq64Cbdd6hRuxzFHmgDuJMXNHtkw0aBD1apqvbG4bAhVO p+M3P96hD+dlEjXCJpy02kczv+lqz6udB+AcpZmBPhVlkyRSInakxHxA02ArHMnHrYsNWNvg GGktA0xlmh8gpSVLXVmE085MToTzlLmrS/GkKobA4sKtFVaQT8aFUKZ95L7Cf+bb1toXkSlH Nuc5subt3ltxTs50U7J/h8C5SFDUwBrdmGradoZq0jpAOmmdAt/tghQ7wNJgFi3S52uTT5RH JeooW1LE1cSZFj9kRICQDa/8EJMb7AF9HZ+SVIN8Hkj3fbeoflEyrXu3kt2di8jKPA4a8zpk Ubkg6AH7+VKvPkGw7VOhTriN9YhlpBIjbK0vnsV7AduJA01bbIeQGXKHmNqLsDKTQNamvNUD R0qDfZWB9VAVUUXZniK3yU5WbNigGN4vvS162K878nfIYU8eP16zqvr8eo9L569QRHgC+xpQ TpcJLNb4xF5oXnAvqMrz/ipq/0NkZOME/GPPvL8O2v8NdIqLC4JkZP6I3v/Mm+x/Vy7/O2/+ XaH733gT+N94E8D+N5b8VRB+Z00u4C8G5frFnVy/19m5WH+vA9g+/CqA3ztn5/itDfgbh3L+ YlMOjr+1gb/O+XXtL45A+K39uw3wW/9s/7r85Pcb/FNk/3eJ69/zp6D10m/8yQ2TtE8+oVaX AY0GDQ0P5RrTULT0ZmB7AE1eCYqR2fOxPWcaa2+TkThI+CKuTNe5spWDqeIls7BqvhfZMFR9 fJoSzgmON7JYA8AUqX9fxYYj+6w1y3FaCRaVa+WQrrCiBx+Q1KUneTq5jNtx7+G+e0zM22Ul WlmpTPLCX9DdvW/M5GCULalwUIBL9DgFVz5/0tbWOHWJeWjSOt1/+LAFdgL1h+yprURiFRSB m1FTHx1nSrD3FxsbK6awXukBS5r9+nfJi2Utc2jqjxXmabAwMTIKUVCz5SrzNMEDcfuwMOgk Mo00wZaqBag02V1X6DCOhg9fvwwILxSJ+5mr3/tCcf/c9oUqKUCHcZ8vCIVaTEahyW6IATMh uVtRyIH8SzKG4mZJs6/dawikGxJ41ZGt82jUvQZbG3wzy2BnxZVqCMoYCowAaiXKgwc2bozZ 1KVdRkyJLg+PpDdGN/V8HUJN2yPMNK+Vnmged6z7YNyMwgUcmifIMZ5Oi79y9z9ERHbgh38a /1oT/WtI/ZOb/08+Jf3Fpyzsv/Hphz/4lI1TG+H/gU9J/5JPEf4dn/5JUvzd8icv/h+SIgcb 8D+QFDNU3SwJZ/F92G3GeE1cnJ1v2m2WQo5dmbMOndoatnoit5be232JgoBvJuRB7rFWTPcd UsmWoS2AFhL1kyTLycEmLcoOIM9mxJbwlUQ8JiEU9TWj11D55DxtY+KSYausXM9xWXHtsfbo tXZ668XeaPPK2ZNjQxY+MVMR8l3imSIzqAA8lDGvo0AYZ4GGwalVb2XQAhQD58how2D2ssb4 cjrOVjRbSG6xmrmcLLOraFBHsFSsAexkPvtcUeM9OssdLYKevp8zGT+tzQd0/HgI/e5hAg7t wM0M4GxwWWuo+W5LTExXkbAGJQR9lfEVFX/SIVj0fR1gL3CKG6Z0iFt41aTC1c69NOc+a2Cs OEzOq+5MM//yoJzZJYMnrSPlNVmqKzqIKNTnzOfo+30j2lQ60OXmCP7F0KlwKncRSLtzt0Yh shL1ZUbMMXYoB/7pLTe8HK43CX4RTUlvZd6oK4bVN4w9e0+UCOFWkTa/iiDTT/tK1weLGPds Gj+8Z+QyhbyT+QOj8iDaUTOne2TuPi5CUeOcfolGYaV5Y8hvT4rwwFEG7LR/U5Yc4yvSKSCG UUOKXOM/Xk/HRMhGxltDVmr+SJgqHIXOMSm3LOQp4j7Iu42oFtW4HnReqOx7kG2do5O9csXx TEjBZjhit4s64sYJS53zg8E7AkdPFQeQrVNHPILxnPuQDBNrPCrNIi9DlRej/FEniSwuRIKF NPpAizxhbN01I6jnbHhTOlC5D9r7+ElsOcl0QLhrLgZ4bIc34h5Ipc05PbRbZWer1NS8OGqQ 2MXR3zdV+ubQ2Rl61UC00dIuDTi23TBgHTP6GoMz9uKPM1avxDNO1C09vTuH1i7VHYPV/XGj eoE+7WmFAnZQ4jNlntmGWlxR2A4n2CZae4iYSZ3pJOFUFO1NF6JpsXAdPow8dE5V74+i+VAD fhxbFrSQb1Mi50wgzuDnGe9IlsDvq1U9Sh4Xp6edBLR79kHI0OLpOVc3Rf2q+2hFbpvjPZUa DLJ+P8oiqVMRmM/dM3NhCgO487CB4Vz+N3NPH/U8MAxCIeJ5ixBm3/ww8UN4eBPzLVmi9xki uUzguEskNxUJVhTGdN8gibzt2kuJfSVAaS4UgR49hYdTxbTYvFTa+iQY+yLyIcJi/OMaX3RN JaqL9srr0EJB9c1b1iX7HYECxRux4t4il96JrtWDnAr3OCquqrT35u6xFT9cq4qZX5231Gob 5U8lUQV6ZLTu3uXn8aLB0FjihOrIFb0YYV1ivdJlJo0Sn9lNjsdHfuNycD70vM1ZW57jcQWX Bh26WB452nMUABmpZ65HryKWuTNkZVfai10a+PX1AEjey2bs8LuhRQ57fh0kHa9P+6M1lVO0 EihxC5Tnk6lm/cgdWsmvvRsNEjJf0Xn15gcRTc/R9HBV7Cj8vavD8RyH/VRhMVAVCHg1g9HG a9yR829q0xfAVTAjWgEJR8qmWUla5Kpq3QQZNdtY908eZZn5n10VCnN1gvkCUrRx+bqU6kic kmSRlZUGyQkOjuNCzAs4Xsi5kTLN+W1fXZcyJ6lKEzcd09HWWGobvH8B6ocqr1uVN+cFxy5I KhE3nFJIogZiw+YW9lsRxcjw4ivrkSs8sFs9s2ntb4hvYCz1mc/8kHu+ZF4Furp7TZe4mpgV VL6eDUj6r9B/Fk0zgprQEmxsdXYC1rc3M62yAfPUbCBGVqFHoIaTGd/sqP4sWxYRRO/4dO5e YRvO/niMIDIx7cCBzOwZ769WoFw0tjK8j+XrSAgYDGH6RIeBOFYc4PACU1bSHK8EXS1NCxWc oIjVJVl0BbVaDe2tKpdGB9UeXZaP4EPbJnO4Hd1PwjrhbpBrq9FPsNGOHhZIxvA1ZU4CsvED nWLLjzz8sG4BQ9nhOGAW2ImhABkFkUuiQSMdVo90uVu0bXhfnxgv+bX+x8Poei/oiS00rwxj FmGfIsaoRsIbOwDoqhhxGOutEFrPphnuKNXGlNBXLpY0vYGderJ3mnqsm5Li4fr4xXj2ITAx 5ESFW7ZfqczhegA7JMQGVZS4CfDh+6LHQmADLyNnRqS+Y0tEecbGGP2i+00FsgsV5/uMk+w0 9kVk50aKvUQQEgmB+2pLTX2ug60TysTy27mHMymaexUkZXh8JIE67W2SmxgOCxudDyB2O3CD 0dLIlLHKc/O3CFOJuFU0K2Lrj7Y/s4hsrPE+l09VE+C8StSFuXv8tBoa4294fTBF4cQngkwj XZBWqOTf9Xma2YupLpFXiY5b9l3Z0RvlvWKaGM4lx8J+UTw6YABV98Dji5MnlQgTrHWHMtWS 92pLpRVY40fMyqxW159KJAI8rJyzQnyqntOa56rrtGXD6+41azIUeHrwRAXDifaI9nkvpgeb CyOdneriFtk+XBL5543GIS4sbzbgKBk/0lXZEjJoQZ2CyIqM3koov0hVQY62KHdLcKUqMhqd K85k8m/tLy9lZZxUTFZrwMYlzxaImdR4EC/O//zoYGDef8use0/afiMwvCvt+36wyGcFQDFb I2wC0/qJGd9Ro1VmiNBzc305bt5p28QHSMVIXHqykAhKboQOBwqOZ3PPBomOiAB68G4w6ukO ChlwFsi2MNMHC9d/LJS0WrAjcuEtWvGFGOdvOs4fr7wDezw5R6tIToKmJlopcQneja1pZeYc CprryfTvrGnOr9j3RmD6TlzjjmE8OyIro76MLyhx6yjGeryH/1Q0JmTU7lpQl1tcLemWKNcr jo3sy66W21BdkwuZOZURgrSs/lLC3t52euGMK6MjhtJ230FG7UNkHz5oXN8UYTmO6t4ByxXN zRjFWrmDgnQLaZtEP5Rje05UJaYxxmO8Au2lJ5WqsEvuXWh3E+Pl4d3GM8viYY+zeEVraiKu e3uTvrbQkmczGpke5WpzG/ehTNNrz/QxWxvxWOh200jY4NDgdLE3JLAnURToUGyL1IFiCsrF ocwM4/rwsFMUE5YguYAAqvOVN5Z4cvc8aNU0aG6wLDqShOhi4JGxFJWzeR0aTBMzLNy+k5hL gmzfQWkwZZLiCUbtOL+KYTIkRWcwGoIU8XqrJnCdu1NZPqI8wCsud3raZN2iXmKmq9LkYVvm 5p6zzXxBVsXpPQkShWwnHwq7YdsWft/tkD5LFHtcP9i3TilWkonQCOBsun6J1hTXh5LT+Eg+ fpne3EKd4VNHuIPr5fQ+IYyApXDy7Aum67zPBuYFdtXu68D8Nv05Y9ihhTiPOSOB5GC/SjnF dUIztylHq34T/7tyvGSSt+Wfy6LVw1njWTxJZ7WVUsqjDRf8Nros49G4nSsi8MqcHQboucLL psEcMEobEuS7yMrGYqlxmCv0jlQLRexq4bkrAxpHOLRqh6FUhu0CxuyeEOgDPhtK9rjXb82V 8UWKmyWUi+GlA7BUNkvLqKhJreQ5SplU+7aZxvZKixqcZU1XgpCoKN18ahnekdDcDxrdka4Y IzePEI5Oz1C5dNKcSbuuHLkrngW8Dxpoh5ylFxUU8/LHJlIcUJ0It9kBfGT8ibUUSesGwf/M pZNY21nzFFZyUTA1jJn9StVo6RQmfZpBB6leOw4b2qduMTdjsstDiurbmXJnzApkaWu/H3pH PSiQEn4//tDQENQfOPi8g9+bCrF3+FGtNhfPqUzDQjlOIVd5lqY+0EhGKh81zu1Lj9GGS/wq +qWrgbMfXZvQJDS1W/kJ6cwNDEIWBSB27fN1MEN71CaA++ZJLn4xYxMamXg2xRXJXPxH2DiP I/eFl06/fuw0XSKEJm5nLJpn04aBaEwieQwN+qd4i8ymb8AxA9ZaoycCE5WMburYESibngBT oOHAFnyyWyrpWQc+67pDgEjBmUOexOEI1KRACodrrSVm9irr3uXs9rvYRFifZDTBZeU7YvyC U9BMQxn6GZFCKBrbSOpHUFh/j5BFtZCma5m0xW5vjbv/nCXZwbndMrJutKwxyUBGr8h6ZW1w 1ruNLZAwsdA8Q2xWykjSDWuk2/dqeVJ5PJVOZLjsRWitTrHrsHg/ZtWZ2VnOqSXNWb5qh8ft 9uNXSBmMC/G/AqR/7p3+z3X3/1iz+X+VEFCUUlJU+Y8mjbL/WYr+Xfj+31MDv5Dmn6kBIBfb HwXhj/q/YPy/qOh/ABDHfyojR4+a95KiBdzy9TLY4OLGCeQgog8x4tbsoco8QohRC5qJsZrE NJ6aTWvu/QgAp49zRbZdyfHeI10wwvDoBQ7GSTUFMqp/RTeVyz3udEuL0pw9MsiNRkJ9TLXb /4yQHQ8RfRpexnVs6+6o39Oa+50qaHAaqXB8WD5BP+wcEfcbUsQEAaHs03JtCLOJYDQ2722k V9Ytu5JPSBQvuS0F1WKWJCdQK686GWmURnnazOm7ud/2izoci6x4jUX9wQkAE9Vq9JUbhlG3 TaVGU3K54CQHhxHm44aVCmsPW1WmjV2iLdFfOMHvr+Zv/174R07ob4P0n1Ly/2Hs/6zn/v+b fsvxJy33d8ufXOV/aLkANuBvD/Dvpt+qeckrqybyg9vHA3Fa0KvyFXQuzQy2pQSg4/XoOch5 2QW7qpf2FkeD/N5KooX0RZGmQr8j8hBLHwF+mpF2JMxLgUv+dGhSsCztuJCRMVRgXpNQtmDU GGqpWLtfnKoBUNKEvGm7nVBxod4d9wq69L7NdFhtvk33OPFo3N9fXUUA7b1B+TiakcPEUvGV VNDEwSbKwNGPH5WUYXXm2rVwodETpdPGs80QTFWbxSLy4NcwJx+2EFT5Frc+pvNoS+hHWcNY JpEJf07ixGR1vZtGlq3vA3xGDtH0Vrf4jGrDV25NmUej5+blivIl94LH/a+HrS2ahceTqJ2A 1JalW2iIbw3BIBrf7mgIJMsZOupz3CexqX2R6USdyi0ea2vpsiZaHuOtjWncSNmDiGo/yVCb Gr4TzOLoFlC3juqEg+KGEa/AE5lvscsWX3PeZP0DpXuZvJJwxPvWo2KVXMtJCSv0Lu83Z23w lSlnDphjqWfsmN7mP2gxZZOrpr5qYIKSq5aho+ATqJST5a2/mEHZQJlCuRPnc3mJeGbcZYW8 htx96Ol47+1/h9uDGzyOmUX5gn8Ov5kUokvOJ9KW1ZTiSmGH5aPf0q73gwtzLNl28auqjOvC V3PMxJSzYHhjKgmqt1QsmJ1bOTF8772zXMPvbEIq0XUpvePuyM9pzg97qEN8BNrimvIbaBZi LWkjRKrnaxVD02PJxfMH9GlrVEIdJWJkFL+phJYlkR9+kxAIvctn4FICbTfbt6RT8Wwrc6nL xlrZf7FM2DJSxzHWMWEbyB7d9hyZryL0WkwwOQPQLpbDAkLtSuc+f2khrH9PckeQxFNXQxiB LIJO8KyQTiD2tFory1g85AOPVpjJe5TeJwCh6PByu9Mkvl26do9jpEcr4chMnMC2GiNxakH6 uSdazPHXgdv2G3GoZ07XOmFT/+AzUZvuGe7jntV8d/kt6nDVR/n61R4FHBLxc+iMis4LZU3V fPRljCTDyks2VFecTQeoVBXtilHSua0xzcRGadXzugiJBIHNns8JhqcYSZdsmRmgBQnLQmUC nsPX6ePvHcAUIZqvJle1XpZE9d5QMo78sstCT4Z4X8g4JRlr/AwMIjSczlJYYEUnrAbC9D/o A55SMG7TyYp9qaY+xFyr/JCcAmCS76fqv0XFb4JDiT7lr1a44fRYmmCi7HBqCfhkqYxH0cx3 4e1KxNdHv62PS0h5TOkq5xP6EbUL5g4DjI68WYhneP1eNPt8cNykhjj3/oWA7+trj1FZD0u7 KOcnyyxWXIc6vppmyavMDdHbK6ujzvKfEXCDYOCWGrzbyhDsz08F1Y3NELq04SGfDIpnBHWi V2cIf9IKrSy5ZPuJWX+h3mhQXblUuRM3akJ4V43sE0z9GUWVVczRf6c6P94pI9JOcHXIh8kS R4eMAHNegnmQ/B5H4CuHfCcyIi0dc0R1KLmFH/X6Z39nhfBWfdSrbnggfOE6mAUpacPminWD 2xNJV9EZI+SqSbKacB4DJrjFjpk42xNpVTToXJSwd5ijY23zkcE/l7PYP/eDaXMWkSnugs0C f5XcT+Djm0dMuPSApQGA3VLT9DLXifaJdnsi/2DWJv8mP4b8RLg0ZcjgJqxd9F60UQynFNy3 UynmTx3hw0HqWKpMvSpwFrQlGViD1ni+VdXm3ViDoq7+Zkgv2f2CHACiEGIZLpAhcgUZwjo3 kgG1dTeRC7k79vi6eptEdZvcFaROv0/3ayc/wRUlpjrdcDOmLq+FnsWCyY3wjeENuUcEnX38 914+PRKl8K0jql68cUo72mWtseFZNIB9lB1P0/MyzInVCTdunlPtRdRZwhOB95te7wgSMH9h ghEUdVMAhj6rQlqV6E96pF8fANH+r8lm+Q+TnwuaRDx1PpJFhpKEYiqGxtMZY+xIBSj6z5Bd S4K/2e2z37cZp+SvTBElIYL1INvc1vi8/UseP1j6q0F8ds0o2fjEFFOGNQRWMUngZji2VM7K mPG9NMt/gWnfZljfquzSOGHdQ0ttct1HBIYt3XndEai+AW/UzYTZ2Aky9WXgLG9i1PL9tDtJ r1NCkMyalLaxFQ/gpCVJgvd3TWTMJ1qJKF3HWf3akRvj8dOzCRZOH8Jj35/9fVY/fp1/ZQ0S IZbOhthdXLrqzzDUaQTuANYTdRo/LO7yEX/pEifI2JAuJQ1QS1VTka2goLeO9dhTEJg3/nhM kV1bsm+Za3+sbiFSvZh2kD3uqKHnK/7cHTCMIQRqnPWrVqUGpnLdUXafaWl9vZu7LnIMqWMS aRHt+5LmeTGlK7DQt5b+KeHEtJPaq+TETJ5EMyW6bHJm1fOS0JtW84RInEPQfbFXkwYyjcaI mc+S2eWCmCmskxaTu9A592IJNrJ/qGrpvhWih/+sWzOQkEQ1H1Tft7Pzw1brI2CrOH+2SLtb TSlEzH/WFReVPdpUPlwjQ+N4FlRyRdO8sbwqHwbqGDotd27R8mvTQi5NnaVCvrIBRepDqfSx pKrlf+pjkWwV2+jMZkv3oPSkMfcv0IusF7WCL7+10Ar2dAV4RDYIlc+BPvKeDAxHbKaIdZgU s8m+Tcq2LrFxNdZ1chIgieBLGn+3WzvgOTe9Jct05FRHT+DUvQHGPt6m6zg5apjLX4KG2uZg nm9cPM1VL10VDiXuM+9Ah+QSFYeU0Ura10+FbCzR0cbwFJpkOLCvZ3wSicahZyzrOsioiKnj Hs8v9gngrsSwviplsipWQv5aMh0UR9bmDt6TjKq50JHROakatTZxB5LZtehn2LnkJYC6ZvAZ u7VsJstsCgmu8YvpAaizarVC7OelBA5J+41zbG8/JE2GTmALDJnx7DDjNTAW7HF0WSklnMlk C8kb6i7Tw8tIiTQeU+1Jftc6iU8PzFmyYqQWT+PXrcQqDk1MNAF9vpK6sPcAZC0aK3GQ5CMd PF/J69lB5i/vTKm6sRz4UR2YeZU+mej6UYHfuiLsFXV/adkdspIZItCedtF0AJ9nS+54xvAF QdCmpnuBmScTuaeXGtS6ZyoVGlPdF/l0jJNxlzfcfZxpPu6NoASiwhSVWJipBnUDShQxUQKF J4vbqVSqizf0s5iXd/JXzAKx/ou96wCLKtfCA4IgWBBBRFRQEcE6vYi9ITYURbA3sFIUVEQQ sLe1d0Sxu2sXFDu46trLWhBRsayKBewdRV7OcOMLuRe4+x6vbv7PIzOZO/lTTv6c5JZZfUj+ 9HrjGYYB7dxTZl/0H6bY9i128bOl7vUzHhmGZbvs9Dg31fyTotPdb6s35UZaPutrdH/9p4Vf 5j75oFk82u+EgdWb0r0v3F3XdENQk1ETx3g+eDpz2wTLTfdq5oZ/c8l5Gms4cPbhqXGGVh1P +ct8st0O2TRwTjycFbg8PeX0r63tp7hbnPq+bft8+5qaMTEGo12/zN4S9LDKeF/HF7qhVvMn eF796pl9sOmcDQ333DN0dzvpPaCz4wv57bJlI6JOTjAycwqce9q/gvLUyeTbTk6BE9s8vLB3 UgeDw6OTD88dt+9kQHL0CZ+OysZfnj56NbNawKkt0nnDTj869qj++inbI00D/L8F2uXY9v3Q bHOFBjs/uiYkjTgQ9HLa79L1H4e2ebOidkpKXE7pi0lr+8c1MTYwj1Rq3o5a8iFpoNH6tj2/ tPvV36RUW5dFy3RWHbpeOVCtjX+VZadM/U9qkhqsX9Rm06Y57SsO2bbS8+z6P2pkN565yLH9 ziUmbrPSaw3tUeX9V03Tw+Gp35dnutqU1r2+WWLDpVd3wv3TdvadWyapfoek1GsHgk6cuOyf eaShifXuExW8F6W8Craud/bF5WupssDIqElr5jQ9n3Xev1T9u109JidEnVVkb122RFdtttWz syvsXObEb7mQ5dt25VDHT25LVt9wTbPVLA6pOcSjzhbj1JDBvuctrDouibp4dfnGija2szw7 tL94qq9th5R3m4dETonNuX8wyPhQ2enmIdmfJn46nHk4cW9VnaVZk7QP2eYj7VccjF2zKHF6 xuaSEVl7blmbu8a7NvIO8r42bsbH5OauGWuyL2+89qD8Zf+h2Xcu6Ea0XXZix5AD8icbXRKq vlT+tsMzvfEL99Gba7uufvbyp/e6jLJdFdnXnkbZ3Ht7Qfpp9lfvee1ulH+8a8/Mj92cbn/Z 3DPk0l7n27Kjo2fPfp/l9dNpp6YpCWEbBq0/bnHzfJzN25DPTRJDLZ8djziTG3PyVt9aPv4N O3d98TTbKTzz86MJEfuGXl5z1qnehAGX3na9e2xZ5299Mx/FPYsN/yOpUd3oi2s+p209cbB6 s2Zdm2heyTulTIuv/WXdjHjLhHhP9ahZdgcMzLVVtqpWRWaFL8o4+vPWGwfvXT7rHp/YyvPw Z8OjzX6emvXYWPbHrNFbtxneCnufGO/19IXdntF9vQNz225a6pLW12Wn1WCbyA0jss9mn8rI aHfy8alyTvPnfs9ZteV5tRULD/a+s6pX3DCb172eXLzmZjIv89XAhzF1NvR3y02tdfX86uoz Gps5t++9f2+geUCa04fG+7zcOnj0Dt1WfaEmIP3ujjmPOr04Ov3kqOkLfCPuPP1Qumx0StL0 lJERupG39ze+2/JI/aCxmQ9vu7ZMl+SW8fPq/ZvQ2hHvFSgU0h+Xsf+4v/lPbSC07eTTrUP3 H9cDd9Sv6HibB0r+dQXKIq4rUOW7rkDuoFYpHdQKtZlSq3CQK+G11kEt1+ivaVdLNQ5wfbtK wV0joNXlvZahv1Ktg1Ktc1Co5frrC7SIWAV5yXRmWi3cAEyuLIWuJdA/WVPUtQQXA49LLUq+ CjOzv11itvvaaKs2W39eoH3vtmli9ICgLhv/aO1UZfzXS5VvtW9yYWD84XnNbn+Z8HVvmfRh b/ffPLz6p80vJs8Pfn75yqy08+vM0/ZKk0IeXryqCfWfXm/o+FDd3OA70xM1XkttFycrgis/ /O1Ok+zIhp+yX6gmzOqrXXH48ocGE9NWz3jQYZ5l28EJh9T9ei0LD5y+PMPZyWPD4h1b7s5d XqpbVFX75S1Kuw4aNCF9UebR2Omn3P2Pt4g/d+vQLf/nHSfneteZnXky6ei+itcOeW5fbTO2 h7Wx2Y1LvVIsjbeGpNiaPe04dp7hxbopJlZduvZdG92g+3Jnn5Hd3pkZbx3+S8n02qtHJLSa ZL90azXjmGtqI2OlV2+rLm4h7uOn9dzWXmuckrtsarftfka1Yo9nTanzwOr6NsvOA9Vepbz7 lWiwr712Wh0DXWZcq5TBqU/ehK9+WaWmZuXdLod8jx5pcOaVwi67hU27iBKeExO6CPnyj6sF VH+/WkDvb2L3QQpwYcFr2mV55/9l8MxSnQoekPqPXTIgsA1SxCUDSt4lA/oUnrPSdyFrtJBP Ea471jt8jFWKbXLoy9UrLzYdIndNSEjzr+av9re0tOyoPlx9/jQjy0UWRhdadazh+KuFY6lS js7rZno9zzQ1bdplr9f8ySkTto7v5fLb4jWDA4Zfb+mf+3uPJtU8MssP9yjXK8DDL2FVZOi4 2qUmZukUIfYJn76m3/s0MfnVpc8vm+ScmZw0x7Rl7xnhbgvfnBj64IpUqtxT/8qTyaZpoYGv Xh2tdcVN8bp0wIxJre1PND6X3rRxkibtntHlNesW7jgbNq/M8rKfXnbaOb/p9O/rVx89keNv WP2Z4523ublHTt2oX7mqrd3QoJob/Y7tCB8TmjzLJmuhevCIl07Vp65bPP3S8e93p8xp9cvP RrVCjSb6Xwh5HHTU682Z7PrBH5otSB307euL+VEDtn89fOLVmNYNTzftGNYzorKT54BpJ8vd sI6bN3Hmgg9pTx+vrOrS0K5urdpz3Sov7SJb03bm3blvh9eMmTpyQeRUp7N+B/q1WNx4fvYz zTDLE20aXdn4ukOld8e95o672n18ctlTcS3qP6qw8XWjRm5uXZKGuY08s8r52MTAmx3um5x2 MPCK9rIPPlG21sYateNrzNjTqpq0wsZjdlZpC34aM95tatSw3Xbelq+dK7fZdWxQ/c9lv5l/ q79/TfhU1xMT2x9/ZLpyfeOqa58880qafO+ih/lWi+lRXbuXjuh/v5ZP79bnrzRa2+uNy6lN 7rHOIyY327Ki7mXz6efOta/ZJ0x6//JC7eB6lczc2vUcXtHt/sWT7aYqsm2GTHDPvNDs4OHg kRrjsHS/pdsbdwodnpqSUXdV9tse9Xo7Wi6sfaTNhXK73qYE9V767heHg9ZDY+qZBsd0G93B sGHfHNeGbeo+Tb9SovWuu0euzo/yLa+7eXLJ7cf1+608vK73aBfHNom3veb83KjqpEOXbkaG THtUwWDolwTv4bV3rati1XzYnjXNY9wiWtcoHVKp9sf7FXNOut02ynp9qE81d8evg7vtD6l4 dsMheRWfY8lO41K2aY9unbv3QdDrpYY991nW8GkT0e1brSt1PEeMPTfm1qAKA64PsZ2nMtyw +NiLoccCKtbxjfwtpnVOUmzzg4b+2dFamw3aOQsGyJ58qvtTf9WV9y0WR2TUD8i6dcUi6qKt qXZPUmaXVM/URdbTfn2Z/e2TYkR24PgnizdfOvdT4uQPD6suHz3Bt0O36nf3HAlqtbHLp4yr Gw7e/ePjrIw/Ek+1v1g50O7B3vgbW9u88Qsbqzm12ftjyuOTv2XFNJiZ9Gvarl+q/jFWt3uD e6kgkzLNzEpXezgz7M4mv0lBFb5vGjdv9vNzd0vU/3qp2YFxJ/aEJnfT3Ul/ZO3iFl3ql+1j g0amVjihsnZNSh77sLWbT8V6jXUBIe3H7Rvl3uPr2YZxEY2yn1+c0HlhaoNt487W6m3W3jxm 3pHQe327lVO2XBz69L7m/rx5JUI7LwmQmpSuP6Bz7Jaf5t17ndU/Lk7Vrn2TD08qpNr3ify6 8kTyyuy7lz+mjPJomvtiTtVSjRp59J0wJnXVjBtuUb3Dm21UqI8oSlac/dPqkNzHtskestVL /BfJYgbZDL4s693n8LD9XUZM+n7vteuy1rcty422Xd9k2vQqMY5OWbMXdQgeVlaW1GdM8w77 zPfYDrM1HbJrUcXmC5bfeaAqeXGjfMq0vdKHo+2+z7SV3ppTfWRs+xhHSexuWXbSQPcnL2Iu 9NrzbrLX2iXpd898MLQcsi/qY91bl4eut3bfljpea9XDZ2q8qVS9a/cKP7MFM0u1//rLsApZ D15OWT24WXr/2xGvP/yaXXPh55XXu689PrncpmGzvcqO/fh+WePgZysTd3aLa3Zz1On6ZdZY NXr6u1+HSPfIrxtevdSNfzAqZJ59s7iFDQ5WWe8QFvsma29s1m/VTi+z76/L/rx/S/g1G5sJ V1fMdwg/seBoLXd7meNaj3d3HGtcNR5cKjp2znRjl06jJ08/+XHltxU17xzNmDnE8sTY3zqv DMg+mDY7Z9Z5+W13j4HTS5hOref+c3psm9IVK0Ra+IXWSWi8P/vb7FN11pqU2d0+W1Ves9/Y aVOZn07d3KsY0PKUt4+/V7uYC388K1Oh+5jLEaVLNT7Z5UNL38jYLvsbZ/U/Zr34db1Lc8+v yNizucN947QXHaeZ/vGH0fXOY9vFnJj80LbSKa/fBza9v/2dkVxlHrny9OIe+2t3G97+imfA O7sI50NTJi+rUM3x9fgxy2fN/23VxaWb2g51bv9ueMXNme5RgRndunayrG++o3EV00dfxl78 0GztkPKhPR1MJ690nBWYiCLf+RnnL/V4aK37kFZp1R2T2E3D51xtIk9K8/Yq/9HJacDIQdbb Sva4bGl/dtehDVuftb524eA05/pb79mFbw8edX9ZfKIi4I732mdGYzpKytzShU/r9yhhXdlV to3iSsVWb2G+ZGG/PiGPyrnN73wvYf2DdeXmVU0a3/9F+rTeHp2zmqh271376lHox6O7d8x0 /d79/b41O5cn6d6cTO734lnEm/NPTt2N3J6z+WG3mvuPhh85mnnydsdPzSv0k0QNWTvZN7Jf Zssz7Q81zzljrjrsMS9Z62FY8V3M/rLKjHSv/X5rP2c9+5iearNgS6P55bxOL512uGJ63UMf /f1vJ/SZ17eev63v0kU9k4yWtRr2IaLe44WDDPcNb5rR0+LZy3qLtvcN9Ep1ly6wMXWsW6n3 8RLrFo/YVGGn37bwHhc39Tn25UO89bOLrnY5B8emD+z/5WpEwPHqkb9HDM54/jrhyY2yO948 274gPmZe3fOa1CenI5MsZB5Vl76YsnBpTmad7ged4/cov4dHNQo7MvbC4PIP59jsyhpge0Me bmylslPVOnjeZbP7Y/lW77DdPu0+5iYcKrWxljzb19t3qNvSQL/KtZcG3NmXOKR3SIvdE4el dgmXXv90rIxxwMht3as9j11Q4+aynXf79N33i1xxU3Zk5IGaMzWhd5I3XT965smlcXUPnfxq /i2pnbffWLeAsLCNY8ek37rde45nk7QRsze2L+s8YeXBlXOOXzROqTr28WPVjpqljxpWGzB0 T6xjtnHLJ4qa83+RHzz2vPM3yTVTp9w3JSrabWujNtcN6F5rQ+nWpzOeutZrqYpu5BhvGX1F NzMz8Pd1x3XLmntdtOq2aGlk5NRxu25FTRifWa52j1LxgddXLVr18s7uN5c61XKSfHsTMLTc 9bZOkfEzrFa2HZr0dOKBT4cWrZkxoV2irmRiWph/mZuXplVStJ7d8nvteNdfOm461GDmnSan Jp3fuenWDofOHwyXye9svV3d8pv01KfgybEvg8MDfH5PW2heoY6PUaOAaufWz3hWaaN04Az5 7oNDPm59XXf3WWVw50pPHOUWpadVNH14pHXLDo80ljPOZ44ZcqCKY+TCOVG/pnXftdXv+e9N TrkeObSmwZsqO08fsJCGjTU2qzzDTtvnxBvPmA4eoQNGNPfd0jLGJmdDWMuN1365dLKUfMJP 86S7s5TDE8vcj24sKf/GyqG/4ZoYj5YWFxx9zzQN7els1SPN5cb9+nW7an2rR7Z75P8s5qVX vfcRbbVTOpTz61jePDbhWnxW7MyHo9PHmH83D3Uf18ullYV9v6SGnvv2m9lrTKcOtpvTsUpu zNclUatTmoVObvHufr2XG9Rptc5LL4RMvF4nM367q3PO8QY9B1ye3amSqvcpb7PpFap+jWn1 utaGX7c8O9Rpx8jbZt4fyqbf2v/1xqb6+8v6z2h4IqpE+ooNrYVC9B93TasVRIyOz1U6dxo4 2MGjm4OPg0zaQAa/DdB17MDgMRMcurRu2woFwH7jx7j8+JYKnyZ2bt1ILpWppSgml2nRglDb Syqtjf79OJR8smyX4CDfsYNRBJzHiuLjVqiE8FCp1vArLnm5otROQb75Ev4ebY8P9htiJkUf yMykP4AWpbDMHOIAaTKlUqlDy9a8TwL1aQg6uLCdTJMp5XAsfZxUCk95o78LT12m0uDi+fz5 yaRwsy0vP3hgbL7j0JJClz9NqpJLtbAbkD9Npv91yKLz00ip41Dd1PqnWeb7rkyuRosQKk1B 56dP49VDLlXDM86pNB08GpJMk6mVcvq7KE0Ht/0WWQ+lTKam21mGmpXuI5lMA0/rotN4fSnT waOfqDLL1Fp1/jTUKvrHWVJpOvhVgPz5SXU6ug1kAn2E0uBxjfl55UoVxYF6HDZM8reVVKGC zY/8fqDQP3kwX5paJtXQfSnUpnKdjN/nWjk8GI5KgxHES1PRx8llcHMJ7QcaNVVf5Ltaum5Q D3jOdL52lmu1dPnkyCXh0hrKd+VqXjvLVRq6TVEaPBWTKrOUPk6uUmrhwY3509BXeWNBo4Cf q6LS1FpeW2k08BB7ql2UdLvIUFvRviZDbaXi1U0hgwflU2lKnjahNLgCheKV0bxyNPZhhyZ/ Ghpa9DiXqeA2DDpNxW8XlQp+o5bi1f8OQr4+l0nl8MDB/GkyDa+PkIrxx5aS36YojdJxKIua 7xsqnYbHodLRfY58XA37N1SajqcbKE3DayskETxenYI3ZlCahldmpRYeLk6VTwYPNqHT+OXT KdW87+o0ML3TaWred2VauMWFGjMyfv8ioaTqi8aqgm5TGL9qHq+U7xsyqZbfflItPJya8med mt/ncg2vzEjZ6DQ5iAQvTcH/rkbDnxu1Mvi5EzoNHqpC5aeFy56oNB08fzT/d9U6/nykkfP9 SgP3EtFtoILbrKg0Lb+PFFoNr3xy/piWg6LyyqeCB6tTaVpefVEaj1cOXcc7DnUwL40fN0GA QKXJUXhAt4tcJVXCQ1Ly6aSG76dInnnzL5I6NfzGQf40jVTL00SljG4/lKamNQLiMN78K5dp 6DgC4hxax1EzK+lxjoaR/icQ86ep9b/fRc8LtL6guqloX5PrkA5R9VWAE9HzKuKAZ8xQaVpe 7ChV6qg5RR8rw+/Z0H1E1xfmVbrMCqlWSpcZWoqO9SDmomJqfVup+P2mofsXtIlXFlQ3nq+h tuIdh0YHr63QIoL2SXAN+N0Bqs95sSPEcLTuItlV0eMS2oAeMzBf8nRXqdTwYhU0ZugYCXyN 1nYYM/ScgsaCjDdmlEhPKV40T/PmKJVMLafXVjAGee2MHJVOgzbg+7NUQ48F4KA1G9ZHdEwN 8Rpv/KJYnp5r4UpWevyivlTz5lAIMWm90ipVWqp8MLZozQYf19DlQz6k5WmdkldfKAsdA4Ov UfMlGpcaDdXnaFyq6DkU0uBSXjpNTmk2SlPSbQppSmqtBmkyKuZHaQotNUdBGr2GgDT9LyLm T5NrqZgG0lRU/AJpcmrMyGB1Sc0BkKamNALSaD2ANKmKvwegoeI1SOPHrGoUKFLjQ63RqKk1 nUyqlGuptSlKQ7JGp6HBQPkGOk5G+zNaBSDJodMUMnrvAcono+d4lEavhdCMh6YAytd0KNyl tRil8WJgFHgr6HWPRqGT0vEapNG6pkHCBndG5PdnhYaKHWHukVJrRLTqhpbJnyaTqqU8v0ff 5fmzVKnk5YcGA/wKIN1v9FoD2oCKGfT9RrUL9JGSivX0/Ub5C/iBjppnoG4Kev4Av6L1Ra3R 8jQWTee8MqPVjIzak5Ep1DoZPaZRF9HzKpon5GpKnyFNR+8zoMUbb22FFrUq2v+gz+EZAvR3 6fkX+amaN8+g8UbPl6h4PL/XKqW0Zuv7nNJ7fUxDt4scrTSoNae+L2kfAu+j4hfwF3hAI6+t aN0FDtrH0QJRQa3PIU1Dr7uhz+k1BBqDUp6eotibnitAI2idRGl0m+r9gJqP9OOS2oNCHFq+ 36PQjJ4DoG50XAI+Se9RoLHF82fwIXqOhz6nfFxfD55OQphIjw/kG/SeBxozGnpMQ9vz+gON GUoj9G1PzwGgibT+Qd3oNTtoLLVu1M8L1DpUrxFUDAdaJ6N9EsYqb76EL9O+gWIGamzp06j4 CvaulXRZYD+bnt9g/qD20iBN/9gM2idV/DQZ/EAV7Ve8mAal8eMX1Hf8uVvO24NH8zk/VkE6 xE/TP4qSjiOoNac+3qDWxPq4hFpH6eMXKs7Wxzn88ilk1B6FPm6i9rj18RU/TSnjzaEoXqP2 CfVxHX8fWCXT8mNCFaXt+niSn6aW8fwFrd60/HMOan75dDIqzoY0La27KE1Jjw84jh7nSgUs GfjnU3hxBAxL3nFIFOk2RcfRsQUoGDWmUZpaR83JcN5FxfNnhUb/WzRUGn9sKTT0fp3+/Adv 3Y0GA68/lOBa/ON44w0cn5eGliR0f6A0Oi6Bc2ikX40JHjjc3y9YfxJP/zstyGUdGnoGBY1x yPvdcU+Hhu6BQ4L0v+YCr1s79HZoDHsLSj+1dKBC6acapBokReNLpVP4Sof4yuV+A6VNzYo+ JO/C0JAxA4PH6M/9oaKp0HA2q1WrjUdbs/ISiaQ0MlNkZsgsJH9HKe59UxeJ5K593nHk5+bc +45GEolnCYmkIpdXJWSW3GsDZNbca3SYpAyVRwfivTEyV64sdtRxPZHVI97ncoA885Bh39YF TCJpzOXRiuMVyjcO2eoi8o1DR8RJ2tr/7Ay2WjBfss6eyEYZ5NXZDeVBZCtZAInoIxMHSY1W koESf8lwySBJMPr/H4fUrs6kz2dzku2jXs2XvHs7vx16r12R9/qnw2/0f8efy0kOdnz9I+3k lLfGO+7vML754u18KNIDgw9QDUknDToeQYuOty29y3iA0mKSJPqtMaR38og36Ff99Xw4Fr4L x5kgg7zgzfgKH4y/oM+ykUG+suBrS66seTl/Ivr7M8rPKe6lnt/IUCLRl0tybQl8ZmRc0kSS mBp2PWpp2MzopWGS4KVhlc7nJFcJQZ8hbjgesKWHYQxZb99x+m6Q1CJ8DNofXgO6czYNfBj5 JVSseom846r7uDSf08uleTbq4NSqeWkdqXbFPtCF6+sBBBfy32iSF3MBB3AtF+DqZyyOqxv0 gwiuFRzXegGuBJFcYusFHMC1VYDLpqQ4rrYi67WN49olwBUgkgs0y0kE126O66AA13KRXE2Q 9RDBBRzAdVSA630x1yuJ4zojwFXNpHh9AziA64oA12SRXANFtuFVjuuGANdtkVz+ItsQOIDr lgBXSdPi5brNcd0T4JKJ5BLrG8ABXE8EuHqL5BKrUU85rjcCXLtFcvmJ9A3gAK7PAlxlSonj CuH8viiuLxwXJNJcPYqZy8Agj8tYgCtOJBfEF2J8AziAq5wA1zmRXEEidQM4gMtWgKu+mTiu QJFclTmuagJc80VyiR1fwAFczgJcB0VyidVe4AAuuQBXFfPi7S8Fx9VEgCtKJJfY/gIO4Gol wPVAJNcYZI1EcAEHcLkLcNmXFscVLJKrPcfVXYBrgEgusf0FHMDlI8B1QiSX2PmrJ8fVV4Dr pUguseMLOIDLT4CrUpnijUWHcFywnqO5AkVyjRXZX8ABXBMEuH4XySV2fIVzXFMEuORlxXEN FtmGwAFcswS4JonkEjuWgQO45gpwJYvkEjtXzuO4VghwPRfJJXYsA4d+rSfA1bFc8foGcADX ZgGunSK5xI7lLRzXLgGuNJFcESL9cDfHtVeAq6FF8dYLOIDriABXT5FcYmPsoxzXaQGuXSK5 Wopd63FcVwW4rMoXb2wDHPq1ngDXeJFcYvsLOPTrLwGu9SK5xO4D3Oe4Hglw5RZzvYADuLIE uFwsi9cPX3BcH4XiQ5FcYtd6nziu7wJcd0RyiV1/5XJcJQ35XLUqFC8XcACXmQBXoEgusfOX OcdlLcC1QiSX2PkLOIDLXoDrq0gusfMXcABXTQGuvlbFO74cOa4GAlwzRHKJ1V7gAC6tANcL kVxi+ws4gKupAJeHdfGuiZpxXO4CXAtEcvmKrBdwAJenANdbkVxiNaobx9VTqA0rFm8b9uK4 +gm1oUgusT4PHMA1TIDrkEgusTHAcI4rRICrmk3x+jxwANdEAa5okVxiNQo49OsvAa4/RHKJ XRNN5bhmC3BVr1S8fggcwLVEgGuQSC6x/bWU41opwHVSJJfQ/gZ5LleIF/iAd7UA72uRvEJj rSjeNRzvZgHeyrbFu1YCDv35PgGuUSK5xOrJNo5rrwBXjEguyEeMJgMHcCULcH0QydUC2QgR XMc4rrMCXAMri+PyETkWznFclwS4jovkEttfwAFcqQJcWSK5xK6VbnJcdwS43O2Kt17AAVyP BbhCRHKJ9cMMjuuVANclkVxi4xDgAK53Alx1qxTvPvB7jitHgKuHSC6x9QIO4DIpIXD9g0iu USLHl2mJPC5LAS7rquK4honkAg7gqiLAFSqSS+wcChzA5STAlSaSS2zMAxz6tZIAl2s1cVxh IuevhhyXQoBrgUgusbqh5LiaCXAdEskldk4BDv1aSYDLyb54fR44gKubANfMYuYCDuDyFuB6 LpJLrEb5cFx9hMayQ/HusQAHcPkKcDUXySX2PAtwAFeAANd8kVxir8MJ5LjGCHA9Fckldv0C HMA1XoCrdvXi7a8wjmuKAJenSC6x2gsc+nNVAlx7RXKJ1V7gAK6FAlwVaxSvHi7iuGKEfF4k l9g9Z+AArg0CXMtEcomNNzZyXFsFuN6J5BK7jt7GcSUIcClriuMaJ7IN93JcB4R0XiSX2PEF HMB1TChmE8klVg+BQ7/+EuAydPzHfaOodfo5jveSAG9/kbxF7Q84E7zk9eaj/k3Xm0vSJZIS d/Pew/XmknsSg+bodXP0epgDIkWf+ZzLSQb6dujv07M5yeXsKhnAdyENrlfvGNzdcPcXi0mQ hylxvfkCm5dhldD7Th7xxpCHWmIQ4Iz+SiS7f7yH69m3mybq31tUPhulrySy66u2RalLJuqv TceAdP117JLUsLzmQEhMDYv+BHlKJL9e3mG8AuUTei7BGNLxMSlvdhgjLggrJGfQ50LXm/+4 NoozNbI23Gc/9ubRm1BDcX1elerzf9d9EO/QF69YF57vO6Mr1u+MvGxSS4Jdsf535gu6ud3a QDIVrt1BbbkP/Q0w/Hv+d1DjRug7Ds7WYUQ3E3qNhwh0rBLZWuBBeS9Ff0O5sYVfG0gcJHCZ J3zORy7+x8DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA wMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA wMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA wMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA wMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA wMDAwMDAwMDAwPCXgSsyU2R2yCyI9J7I6hHvczkY/UjJsG/rAiaRNObyaIWsNDJjgXzfoS9e sS4833dGV6zfGXnZpJYEu2ItlG9F7nUlZM7cawNknshGGeS99v6em0vWcQEkoo9MHCQ1vCXD JYGSoRJf7m/IP9huUrs6kyQvJJISL/Pet4P3jyUGzdHr5uj1MAdEij7zOZeTDPTt0N+nZ3OS y9lVMoDvQtpn9L5jcHfD3V8sJkEepugY29K7jAcoLSYtWLVqUiX0vpNHvDHkoZYYjHVGfyWS 3T/ej0d/t5sm6t8PGKmO1lcS2fVV26LUJROhuX4A0iFfiSQ1LK85EBJTw6I/QZ4Sya+Xdxiv QPmEnkswhnR8TMqbHcaIKwBen0Gf+47Td4mkFtH23Tmbh6ytoUSyD/0NMMz7rLqPS/M5vVya d0Ol6WqTl9aRakvsA13Qa2iIcQZ/z7+MRBJN9rkQb2IhvL+XFMfrgGwzxfvvGhvFnW8Foo0w R6qJRGJlkscBdaU54NhUEysTH25c0Z+XQK/3lbQyOWvcE9lOk8LyOWtsawb5KAU+L6n/PMhs X8m9Zqkme82yTfeaZZQKQmZrVlieGaV2Flq2jFI9TbJNrUygDkXVsQnV/nHIVnPtLxX4HrRt HDoizhmsiX2cBGy1BOdD9wXwsD7+6/VxHMoks2ThfRxnnFkyzriaeXszsMySzHeY7xSn7wQj +7m6kWQ5+nsQ8kaJTsh+Qfm/R/kvQxnZ6h1GX10O0c2EXudyYZQ/11drgQ/lXQF98yPX1vi1 AWpRaGf4nI9c/I+BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgeE/BzhH+J82BgaG/14dMBRp cHmAWIOLCMTan8lXbFmZHjEw/PMaIUYHhMY0XFJFG1waRpvJf8CEyiFUXjFaJVZ7GBj+SjpR kD4IaQE5NuFySGylKDMjzFzA4BJK2soUownlL1QOspx0Hcj6FaRJQvpTmOYwvWH4X9KMonSi MI2gtYHWA6FxX5azcoRZcFaeMkvC4DJ7IbP6J6ygPEleuky4rGT5cZ2E9InWIVp7xGhOQXrD NIbhv0UzSL0oTCdIjaD1gdQFUg9oDYCxa80Z3M4IZkMY3NoIZktYZcLgNhEhq/JPWEF5krxk eXAZyXLjuuC6kRpF6hGtQaT2kLpDak5BeiOkM0xjGP7VmiEUX5B6IaQVtE7QGiGkDaQmkDpA jveqnFVDZs+ZA2fVCavBWU3CHAmD252FzEmEFfRdMn+SF5eFLB8uM64D1AfXjdQpUo9IDRLS HjIGwppD642Q1pA6IxTPMI1h+DO6QcYZtGbQ8QWpF6RWYL2gtQLrBKkRWB+EdAFrATn+8Tiv zRnczunCWR3O6krybkcFq09YA84aUialTPYnjP4unTfmJMuBywblxGXGdYD64LphvSJ1CWuR kP6QukNqDtYbWmtwX5HrKlJnitIYOo5h+vLX0w6xulGUZpB6UZhWkDohpBEwXkhdIPWA1AE8 7mEMyzlTSPJuGVdxpuZMg0xLmI6zRoTBrfGkwW3uBRncYl/Y53ReJA/mJssD5cNlxWWHekB9 cN2wVmFNIrUI6xCpP1h3hDQH601hWkPrDBnPFKQxYvWF4f9PO+h9jcJ0g9YMMr4g9YKMK0it IOMIUiewRpD6QOsCqQdYA8jxDmO7KWfwTIrmnLXgrCVn8PgLbK0Ja0NZ22IwOk+SjywHLhsu Ky471APXidQurE1Yj7AO0fpD6w60M6k3ZJxDag0Z15A6Q8YztMaI0Reh9RHTlv8/7ShMN/C6 BMcZtGbAPEfrBY4raK2gdYLWCKwPWBuwLmA9IHWAHPNuyNpx5s5Ze846EAaPiAPrRFhnyjyK 0ei8SV5cFrJ8uMy4DrhOUD9So0g9wjpE6g/WHmhPWnNovaG1ho5rsM5AP9Mag+MYvF4qTF+Y tvzv7nfQaxasHWTMQa5TaN3AsQa5LoF5i9YMmOcgxqb1AscUWCtwLEHrBNYIUh+wNpC6gLWA 1AA8Zrtw1pUwePwoWDfC8OMpwbwKsB7FaEL5k2UAI8uHy0zWA9eN1CdSj7AGkfqDtYfUHWhn Wm9wjIO1BvpLSGegf6GfaY0h4xjwEzKGIfWFXB+RsQutLeSaiO23/HfEHgXFHVg7yJgD4lY6 3qB1A69LcJxBawbMd0J6gWMKUitInaA1gtYHWhNoHcBj1pszeHQhNngEILZelPUuwPr8C6wg LrpMZHnJeuC60fpEahGpQUK6Q2sO1htSa3BsI6QzOJ4hNYaMY8A/aH2h4xe8B4NjF1pbhOIW FrP8Z/UD73fgNUth2oFjDiHdwLEGrLlh3w/mKxxn4PUI+BzMc3gNQutFQVpB6gTWCFIfaG2g 9YAe+30p60dZfwEbINIG/gkTk59QWcDoMtN1orWJ1iAh7RHSHFJvhLSG1hm8hoJ+xhoD/U/G MeAf4CfgLwXpCxm7FKQteE2E91uYrvx79UMo9iDXLLR2kDEHXqeQ8QbWDTLWgLU3jjOwZuC1 CI4vaL0oSivI2KEwfRDSg6LG+qACbHAR5vsvsKI4CyprUVolpEOF6Q6pOaTWYL3BWiOkMzie wWsnrDE4jgH/IGMYUl9w/ILXR2TsUpC24P0WOmZhulI8GiJGP/D5FbzfQccd0Jd4rQJzCF6n 4HijMN0g4wysGULxBR1XkFpRlE4I6UNhWlDUOPb7H7Q/q00F6Q+tOYXpDdYaOq4RimewxpBx TGH6guMXvD4iYxdSW3DcQu63gD+L1RWmKeL1A69fCtIPHHvg/Q7Ye4cYk4w7YJ7A2oFjDnKd UpBu4HWJkGYUphekVhSmE0Xpg9hxOOT/0P4ZDRLSnIL0htSawnSG1hgcxxSkL+T6qDBtAT8F fwW/xfst4M9F6YrQOuivritCGkKeeylKP+CcHRl7wH4HXrPAvhmOO6BPyZgDr1MK0g16XVKQ ZpCxxZ/Rir+aNvwntefPaA0d0whpDL1eKkhf8PqIjF1IbQH/BD8FfwW/JWMW8GusK+DvQrpC nhP6K2sKvQ9CxyB4/xTvf4BO0/oB+1xwzg5iD9B6vN8Be2QQa8K8UJh2QPwqFG+QuvFnNEOM XrBx/9+lNwXpjFiNEdIXHL+AfxWmLeCf4Kfgr3i/BfwY/Bn8Gvyb1hUYB3h/Be/b0rHKX0VT SA0h90GEYhDYl8L7H7R+4H0PodgDzvVBrFmQduCYg1yn0LpBrk0K0wymF/+fOiNGY+i1EtYX en2EYxchbQE/BX8VilnwWgj8nYxX8P4KjA8YJ3A+iI5V8PqH3Kv9q2gIPocLmgsxHZyjh30p WEfi9QuOP7B+wHk62O/Cex6g+fjcCq0d5B6HUMzxj+gGG4N/bY0pSF+EYpfCtAWfM8IxC/gz +DX4N6kr4P94HQTjAsYHjBMYLzBu8DnmgjTlfz1OIfdDCtIQiNdgPUjGIHBvFuxLwToS9k4h /sPxB9YPuBYA75fi2APWrXjNIlY7mG4w+1foixht+Rt75x1v6VWV4ViSSYIgapAOoYceeu9V ulQDSBFBRQUsYKGISlGw94axd7EFe+9RFMGCvRsL9i7W8wx35ff4ZZ+1J1l7JnfIOvNbf7ys 5H3O3POtN3vv7zuX2BPFeQvXcZzjcn1HrsR6hTlgHpgL5oM58VqFOYr9zztLpmzPVOM8ZF+G sB/kHhln2mQvazvOpTj7Zj/J+m+7/uDnHuelXnvs27Psy47Oja7jlS/Hki0+b+E63uaK1yvM AfPAXDAfzAnzwtwwP8zRvkw5Gc9TRvdl4kyVfd02Q2Ifwz0yzrRjDcIaj/Mp9pNZfnjt0dnR dbJmi9csWa4wD8xF7IGYF+aG+Yn9zzZTmDuf0W7v+5wMaxHWV5Eh7Of2ZQjrNvaFPP8Ra5DY w8T5R+xfjjU/9u1Z+lrvujyzZbsnOpZciX1QnK94D8S8MDfMD3O0L1PijJZ5jH3PYcyT7blI rEVYX8V9Gc6I2NexFttmCOs29oXcK+NsO9YgnE/5/CP2L7P86OzoOtmyJcuV2AfF+QpzEWsV 5oW5YX6Yo22mMG/MHfMXz6gwl16jHJY9T7YWYX3FvSvOm3muj30d97hYkzlDYh/DvTKeV/Ye xucfnR9dV9Rc8fmK90CsVZib2P9sM4V5Y+6YP+aQefS+57CsUbY5EmsRznxiLcI6i3vjnDtz VsT+LvYy5GlkCD+TuIdLBrPGi/PTzo+uzpV3zEGc2zIfzEncY3amMFex92HemDvmjzlkHmON EmezzO3lmSfbe728H57DYw3F/ozn9LhfxTqLe1icO3NWxLN+owxh/RbnIF6DdH50da78/1zx WiXOVZifUaYwb8wd88ccMo/MJfMZ5yjMbeSJ9zwnOkfiXi/vh/fFGor9GWc/sRZhvcU9cp7v 48yIfd4oQ+IcJFuD9HXWdUXNlWytss0UzgqYM+aNuWP+mEPOF5hL5pM5ZV4jT+Le8YnKE+9r IkfibITvC7CG4hka9mk8r0cmst5iL8f5M2dGcR7iDBntY3oN0tW1f62SZUqcpzBvzB3zxxwy j8wl88mcMq/MbZyhnKg82Z6POEfYg/FcL+c8rKX4fjVnQNwL56yZdRf3yjmH9nnIaB3S+dHV ddkyxXsf5ox5Y+6YP+aQeWQumU/mlHllbplf58nxPj/B0+esrIu2OcL3BjjvYU3F/W+vRVh/ cQ7dGdLVtX7/M8oU5o258xqFuWQ+mVPmdZsnPj9h3ldnic9IuI/E+S/7LNZHzhH2ZHG+ynch ORfxWiT2M50hXV3HN1O874k1CvPIXLLnYU6ZV+cJ88xcM9/M+fHY6/iMhPvS3K+Jc1b2XayX Ikd4n5z7sLaKcxGvRfpMtavrxJzReo0S5yjMJfPpPGF+meM4j2W+mXOfnaxck8Tehj0V33Pm 2RfOg3nGjv0X3xFwjnhP02uRrq7Ld43iPY/zhLllfplj5pm5Zr6Z89jrrFqbjPY27K24T839 Jc6FOc9hH8b6KXIk9jRxLuK1SH/mXV0nbo0S5yix54k8YV45j2B+mWPmmblmvkd7nVVrEs53 eVaOZ1xYC7HH4vkRfscc58Oc67AfYx1F/kWO9Fqkq+twrFEiT5hP5pR5ZW6ZX+aYeWaumW/m nHmP+zrVtUncu4lzEq9JuEfN2og9F8/EcE7M+Q77ss6Rrq7DnSfMKfPK3DK/zDH3dpjr7dqE +a/e04n9TdwDjnMSzmnIMJ59YW/D3ovvL3JeHOcjnSNdXYczT+L8hHllbplf5ph5Zq7jHNbn JtV9znZ/wxkv947YV/GMf6xJeGY39jacG8f5SOdIV9fhyxPmkznl7IS5ZX5jbcJeg/nmu8XM +3afUzkr8f6G361y9sGZL78rLs5JyDa+C03Wbfc2/Tl2dR2uPIm9DvPK3DK/cW7CXDPfzDnz ztzH/eHLembisxL2THxPme8X8t1l1kF8p5kzYJ7P5ftEcU7iNUl/fl1dhy9PYm0S5ybML3PM PDPXsc9h3pn76plJZAn3hOKsJO7f8HtWeA6X32vL2Q3rJNZLrJvIvM6Rrq7DnSdxbhL7HOaY eWaume+4n8PcM//kQCVL4tyV8xfuEfG9wpvqrITvC3FfifvV/N6nOHPtLOnqOjmyhLllfplj 5pm5Zr6Zc+aduff5azVLtueunM/wHWZ+5wrPvLDn4j2xB+v9TVfXybHP8ZkJc8w8M9dx/sq8 x/nr6izhbBcG96H53ZKc10SWxLlrZ0lX18mXJXH+ylwz3/x/7/heTiVL4tmSuB/MdwjxhgHL 93DiuZLIkv68urpOniyJ50ziXo6zhLmP+8KX9RkTZwnfG3SW8N1CmDzP31nS1fXOkSXMM3PN fPP8a2QJ8786S+LZ+c6Srq53jvvCWZYw75dXlsSzJf15dXV1lnSWdHV1lnSWdHV1dZZ0dXV1 lnSWdHV1lnSWdHV1lnSWdHV1dZZ0dXV1lnSWdHV1lnSWdHV1lnSWdHV1dZZ0dXV1lnSWdHV1 lnSWdHV1dZZ0dXV1lnR1dXWWdJZ0dXWWdJZ0dXV1lnR1dXWW9GfV1dVZ0lnS1dVZ0lnS1dXV WdLV1dVZ0lnS1dVZ0lnS1dVZ0lnS1dXVWdLV1dVZ0lnS1dVZ0lnS1dVZ0lnS1dXVWdLV1dVZ 0lnS1dVZ0lnS1dXVWdLV1dVZ0tXV1VnSWdLV1VnSWdLV1dVZ0tXV1VnSWdLV1VnSWdLV1VnS WdLV1dVZ0tXV1VnSWdLV1VnSWdLV1VnSWdLV1dVZ0tXV1VnSWdLV1VnSWdLV1VnSWdLV1dVZ 0tXV1VnSWdLV1VnSWdLV1dVZ0tXV1VnS1dXVWdJZ0tXVWdJZ0tXV1VnS1dXVWdJZ0tXVWdJZ 0tXVWdJZ0tXV1VnS1dXVWdJZ0tXVWdJZ0tXVWdJZ0tXV1VnS1dXVWdJZ0tXVWdJZ0tXVWdJZ 0tXV1VnS1dXVWdJZ0tXVWdJZ0tXV1VnS1dXVWdLV1dVZ0lnS1dVZ0lnS1dXVWdLV1dVZ0lnS 1dVZ0lnS1dVZ0lnS1dXVWdLV1dVZ0lnS1dVZ0lnS1dVZ0lnS1dXVWdLV1dVZ0lnS1dVZ0lnS 1dXVWdLV1dVZ0tXV1VnSWdLV1VnSWdLV1dVZ0tXV1VnS1dXVWdJZ0tXVWdJZ0tXV1VnS1dXV WdJZ0tXVWdJZ0tXVWdJZ0tXV1VnS1dXVWdJZ0tXVWdJZ0tXVWdJZ0tXV1VnS1dXVWdJZ0tXV WdJZ0tXV1VnS1dXVWdLV1dVZ0lnS1dVZ0lnS1dXVWdLV1dVZ0tXV1VnSWdLV1VnSWdLV1dVZ 0tXV1VnSWdLV1VnSWdLV1VnSWdLV1dVZ0tXV1VnSWdLV1VnSWdLV1VnSWdLV1dVZ0tXV1VnS WdLV1VnSWdLV1dVZ0tXV1VnS1dXVWdJZ0tXVWdJZ0tXV1VnS1dXVWdKfV1dXZ0lnSVdXZ0ln SVdXV2dJV1dXZ0lnSVdXZ0lnSVdXZ8mJzZLrTbLkmZ0lXV0nTZYwryc6S66iLDlHWfLQzpKu rneaLGGeI0uYc+aduWf+K1nyLpssuZqy5A67urey5EmdJV1dJ22WML+RJcw18308suR0Zcl1 d3WzXd1+V/fa1UN29ZhBlvBe+zPr6jp5soQ5Zp7JEuabOWfemXvmnxwgD8iFSpZceVdn7eo6 u7rprm63q3vu6sG7evSunrirp+7qGbt6VmdJV9ehzxLmlHllbplf5ph5Zq6Zb+acLGHumf9q lrzbro4ceL3Prq69q5vs6txd3WNXD9rVo3b1hF09pbOkq+ukyxLmlvlljpln5pr5Zs6Zd+ae +ScHyINqlrzHrt57V9fa1Y12dZtd3W1XD9jVI3b1uF09eVdP133hzpOursN9P5h5ZW6ZX+aY eWaumW/mnHln7pn/FVly2q6utKv32tU1dnWDXd1yV3fe1X2T+8K8586Trq7DlSOxJhndD2ae mWvmmzln3pl75p8cuKxZEveFTx08Y8IZb5y/ssfyPqfXJl1dh39Nst3fMMfM8/YeTjxbQg5c lns422dM4vw1zkxurH3O/Xf18F09drM2Ifs6T7q6Ds96hHncrkmYW+aXOWaeb3sw3z4riXPX Spb4zMT7nLN3dYuDZ1q2axP2X0/rPOnqOnTrkcgR5pM53a5JmGfmmvn2/qZyVuIs8T6H+8xx b5hzXtYmd93V/Q72W9yj5v5S7HW2edKZ0tV1+a5HmEvmkzllXplb5pc5Zk3CXDPfzHk8oxb7 m0qWeJ8T93O8NuGZfc5NuI/EGXDsdXj2hfvWnSddXYcrR5hL5jP2Nswt88scM89ek8T9m+r+ ZrvP2a5N2E9x34gzX9ZGPOPywIN7S5En5F/sd+I8tjOlq+vEZEics8a+hnmMHGFOmVfmlvll jpln5nq7Jqnub7b7nFibsH+66sEZL8/FsSa69a7udLDn4nmXyBPWUXF+wrkxf69eo3R1nZi1 SNyviRxhHiNHmFOel+ceMPPLHDPPzDXzHecksSZZkSXbcxPOdGOvc/WDe0c8b8vZCe+LPCHv WD+xH+N857zNnqczpavr+GaI9zTMH3PIPDKXzGfkCHPL/DLHzHPsbZjzVeckoyzxXod7RTwT x96K33MQecL6hHUT+zDOdXjO//EH959iz0NW+hylM6Wrq76fiXMRr0WYO+aPOXzYwVwyn8xp 5Ajzyxwzz8y19zYrzkmyvQ7PwEWecA/aecJ6if0X5zmcD/M95kdqzxNrlNG+pzOlq+uyZYj3 M7EWiT0N88ccMo/MJfPJnDpHmOM4I2G+V+9tZnly5gE/1iesk9h3cY7DuTDPvvC7VdibkYlk I8/+c/7DOUrsezpTurpqGRL7GeaK+WLOYi3C/DGHzCNzyXwyp8xrrEeYY+b5ROTIvrNY+LHf Yb/F+Q3nwdxfOvdgT8aaiufq+P0InPuwb2PdFZnCM3idKV1d+/PD5yHbDGF+IkOYK+aLOWPe mDvmjzlkHplL5pM5ZV5jX8McH4+z1su63+HchnNg7ivx3SB+nwprKZ7xJxM57+Hch3MU1l18 p8iZ4r3P9oy2c6Wr1yD//zzE6xDmiHlirpgv5izWIswfc8g8MpfMJ3PKvMb5yIlcj8zyJO7v cD+J+9PXPFhD8Ww/z+XyTB3nPXc/5R3fR2TdNcuU0X0fZ0rnStc78xpkdF9mliHMFfPFuQjz xtwxf8wh88hcMp/MadyvuTxzZN/9Hd4X96XjDIU1FM/jkoWc87BP43c2sd7i77rNlNj7xBkt 59De/3SudF3R8sP7GOYhzlRjLzPKEOaLObvVwdwxf8xh7GmYT+Y07vvG/ZrLK0f25Ql7LtZM XqNwvsP+7IYH6yz+jttMYU3GWTP7PM6MOH/mnjj3tGKt0rnSdUXLj1iDMAfMA3PBfDAnzAtz Exlyl4OzVeaLOWPemDvmL9YisadhTg9TjjhPRnueWKOwL+N30PJ7mlhncfbD70hgD+dMYX/H /W/OjDh/5juMsf8hi50rsQfalyudLV2HOTuONT9iDcIcMA88a8Z8MCfMi9chzBNzxXwxZ8wb c8f8eS2y3dMclhw51jUKv1OF9RVnPs4Ur1PY38UZLefPsf/xWmWUK/vWK/vWLJ0tXScqO7Zr j0uTH16DxD6GuWA+mBPmJfYyzJEzhDlj3pg75u8wr0WOdY0SmcI9p8gUnotxprAWi/MUzoo4 d+Y70NzLirUKv2OBtQr7w325Eucr+9YsnS1dhyE7uD7j/GNffnCdc71z3ccahHlgLpgP5oR5 ib2MM4T5igyJe73M4WFfixzLGsX7HmdKrFM4W2ZfxxkRz9BwDzz2P7FW4Xs+ca4Se6DIFe+D ONuOc9tYsxxLtvSeqKuSG8eSHVyPcX7Kdcr1yjNlXL/OD67vOAfhuvcahLlgPpgT5oW5YX5i HRL3Z5gz72dOlrXIsaxRZpnCvo4zIs6bz9b+J9YqnCmxL+SesnOF3I59EPtJzrb5fDinijXL sWTLseRLZ0znxig3jiU7vPbg+uQ65XqN/cs2P7jOud657r0GYS6YD+aEeWFuvJfJMuRkzZFL mylxRst5M/euYv9D9nJvnDMl9oWxB9rmSuyDONvmfMprlkuTLZ0vnRvHmhuz7GDtwXW3XXtw fXKdxv5lmx+xh+F657rn+mcOYh/DfDAncaZ6RciQY8kUn9Fyzsw9K9ZpXqvwnF6cq7C24+fr 9Ursg+J8he8wec0yypbtnijOWy5NvswypnPmcOfFvsy4NLnBdeM9S6w7ttnBdcj1yHXJ9Rnn H7F/8fqD65vrPM5BuP69Bol7u8yLz1SvCBlyrJmyb60SZ7XsC50rsV7h58/3p9lP8h1I7rPH moXPjLPvOGfZZgtrzTjH3a5dRvkyypjZOmZfznTeHP+s2ObFvnXGKDP25UbsV7he4ryU62ib HbFv4frjOoy1B9cn1ynXK9dt5IfXH1zncQ7C9b9vDXJFzZDsjHa7/9muVdgP7ssVfv7sI7kX xLlU7IVizcLZ9yhbYk/EeVect8TaZZsv/HfnWDLG5zD7cmaUNbO8uaJmzuxnMvo57ltfODPi s5plRqw3nBux5ojzDq6f2LOMsoPrz2sPrk+uU65XrlvnB+sP5wfX/XYNckXZxxyvtcq+XIl9 EPtIzrT5fQyxF+Ksiu8icPZ9rrIl1i2sMblXz5qTfSv37/lvifPF6xfvj7KMcc7sW8/sy5tj yZxjzZ7LI5uq7yn7+44yYpQT+9YXzotZZsQ+xesN5wbXCdcL1w3XD9cR11OsO5wdXH9ch1yP sXfhOuV65bqN/cu+/Og1yInJFdZ9Pl/hXCrWLHxWnHlvsyXWLbEn4rxru3bh+tiuX2J/5DVM ZAz/vcpy5liyZru2GWXONndG+XOsWXSia997HP19tn/nbUY4J2ZZkeVFrDMiM2KtEfuU7Xoj zjq4TnjmlOuG6yf2LLHu2GYH1yHXY+xduE59/sF13Plx/DNlX67EPsjnK9s1y75sYW8aeyL2 q/y3I/ZF23yJ9Qvn7VxPsYZxxngdM8sZZ80ob7aZ49zZZo/zZ5RDWSadiNr3Xrbveft38t83 fgbOiFFOOCtmeeF1hjMj1hp8znzeXm84N7zm4PqJPQvXVZYdXnv4/ONY8qMz5MTlSpzbbtcs Wbaw1ozzlli7bPOF/95wny72R5y9O2O265hRzsR6ZpQ1zptR5mxzx9nj/HEGbbNolEnHu7bs 7Xvz+/bfJ/6OzodRRjgn9mUFP/dRXmzXGc4MPt/Yp/C5x3rDuRFrjjjviD3LvuzYrj3i/DTO Pzo/Dsc+aLZm2Zct3KPnnCvOW0b5EusXztljf8TZuzPG6xiuQ9a+zhmvZ5w1cTazzZtt5mxz J7Jnmz9RMXPOIlfMqCvm97LUyG/E9fvy+3UuOBucD9uMGOUEP09nhdcXzgs+Hz4nrzOcGXy+ sU/hc4/1xig34ryD64jrKcsOn51us6P3L4c7V7J1C2vLOMeN85ZYu0S+xPqFZww5Z2fd6jVM ZIzXMVyHnPNuc4b/zsWeKbKGPbfzJtY228xx7jh7In+2GRQ55CxyJrk8t9Xaem/Z8Z7iPXrt ELngbHA+jDKCn5dzgp9nZEXsSfi5b/OCz4fPyeuMyAyvNfi8+dz5/GO9EbkRa44474jzUq6r bN3R+fHOmy2jtUvky3b9wrrVa5jImFjHsE8e5UysZ7ZZw557lDexh4rMGeWOsyfyJzIocigq ZjEyyRUzuy3meV/t+3e23ub6/cR7jPccf4fIhlE+OCNiTRH7kMgJfp7brIj1xSgv4lyDz8+Z EWsNPu/ReiPOOrZrjs6OK2a2bPdE+/Il1i/eH8UahmsszmBiHTPKmVjPbLOGPbfzhv9GOnNY b49yh/mhIn+cQZFDkUXbPHIxqy7m99LW1mPLcA5EFkQeOBNi/RB/t1E+xP4jMoKfl3OCn+c2 K2J9McqLWGfE2UZkBp/vdp/i9cY2N7Z7ls6OK+457ihfsvXLNmO8jtnmjNcz26xhz70vb9if U9vc2WaP8ycyKHIosijyKIr5jGJeR8Us76t9/459zYv3EO8p3mO858iFbTZs8yHOLPblBD/P fVkR+5JRXnidEZmRrTdmudHZ0fmS5Uu2htmuY/blTJY1zptt5jh3nD2RP86gKGdR5FEU87mt mN1tMddR+/6ZkV+wgh9Z4DxwJkQuOBucD9uMcE5kWbEvL7brjGyt0bnRr+ORL/syxuuYyBmv Z/ZljfPGa5vIHOfONnu2+RMZFDkUFbMYmbStmNtKjXzN9fuJ9+j37VxwNjgfIiO8pnBO7MsK ry8iL0brjFlmdG7063hmzKXJmX1Zs82bbeZscyfK+eMMcg5FFkXFfG6L2b0stc8vMiDK78fv 02uHyIUo58M2I7Y5sS8rjiUvOjP6dbLlzChrnDejzHHuOHtG+bPNoW0euWJOs/Jcb+c7qxFv +56273mbC86GUT44I5wT+7Ki86JfV7Sscd6McmebPc6fUQ7ty6RteYYvbWW++97L9j1v/07b v/P2ZzL6uXVW9Ktfed7MsifLoX15dKJq3/vZlwdZNnRO9KtfhyOHZjWb7Us777PqV7/61a9+ 9atf/epXv/rVr371q1/96le/+tWvfvWrX/3qV7/6dZxffAmcB4r4ksRV9b/zi/L48ma8/vfg xQMD73hddP0H35x6xxfK8eAXUfBAIw8ahS8PTPO/cQMwGG89csopZx15B+PsAYN/9q1HzjrC L+zii2PbPg8mvOG0s45ceOp5u3r9kcznwlOveSY+fLl12+cBqQtPff6ZbzjtgjPfeuSCM99+ +gVnXnTG83d1zTMzz4vOeH363i4647wjbz/9rCP8HWZ/R76U75//+bt63cHP/9zBv8fP9vzd P3H+OdS9rn/+KdTrjn65H5/tZwFn+xmfvzN522n5Z3z+qW877fxTr3elh51Jve20Y/Fdfe0c 72uSG9rBuHD3D7x+ck1yreXX0nlHuC75XPn8uQ64VvJrKb8+uR65Lrk+uU65XrmmZ+/z0lwP /fM9vj9fz/TeeWOmT3nw9b/pHOp1Q1++/Mr/tvXnZxt5uj+T+Hnx97vgzOy9v2hXL9nzHuMh kOCd8pajfy6hLzoj17y2X6CusK82YbtfZdsL/b4JC+1+lW2vETvTq9lXn7Ddr7Lthb5GwkK7 X2XbC33NhIV2v8q214id6dXsa03Y7lfZ9kJfO2Gh3a+y7TViZ3o1+zoTtvtVtr3Q101YaPer bHuN2Jlezb7ehO1+lW0v9PUTFtr9KtteI3amV7PPnrDdr7Lthb5BwkK7X2Xba8TO9Gr2DSds 96tse6FvlLDQ7lfZ9hqxM72afeMJ2/0q217omyQstPtVtr1G7EyvZt90wna/yrYX+mYJC+1+ lW0v9DkJC+1+lW2vETvTq9k3n7Ddr7Lthb5FwkK7X2Xba8TO9Gr2LSds96tse6FvhX7z0T+X YKHdr7LtNWJnejX71hO2+1W2vdC3SVho96tse43YmV7Nvu2E7X6VbS/0uQkL7X6Vba8RO9Or 2bebsN2vsu2Fvn3CQrtfZdtrxM70avYdJmz3q2x7oe+YsNDuV9n2GrEzvZp9pwnb/SrbXug7 Jyy0+1W2vUbsTK9m32XCdr/Kthf6rgkL7X6VbS/03RIW2v0q214jdqZXs+8+YbtfZdsLfY+E hXa/yrbXiJ3p1ex7TtjuV9n2Qt8rYaHdr7LtNWJnejX73hO2+1W2vdD3SVho96tse43YmV7N vu+E7X6VbS/0/RIW2v0q214jdqZXs+8/YbtfZdsL/YCEhXa/yrbXiJ3p1ewHTtjuV9n2Qj8o YaHdr7LtNWJnejX7wRO2+1W2vdAPSVho96tse43YmV7NfuiE7X6VbS/0+yUstPtVtr3QD0tY aPerbHuN2JlezX74hO1+lW0v9CMSFtr9KtteI3amV7MfOWG7X2XbC/2ohIV2v8q214id6dXs R0/Y7lfZ9kI/JmGh3a+y7TViZ3o1+/0nbPerbHuhH5uw0O5X2fYasTO9mv24Cdv9Ktte6Mcn LLT7Vba9RuxMr2Y/YcJ2v8q2F/qJCQvtfpVtrxE706vZT5qw3a+y7YX+gISFdr/KtteInenV 7PMmbPerbHuhn4z+laN/LsFCu19l2wv9lA17+17cr7LtNWJnejX7qRO2+1W2vdAfmLDQ7lfZ 9hqxM72a/bQJ2/0q217opycstPtVtr1G7EyvZj9jwna/yrYX+pkJC+1+lW2vETvTq9kfNGG7 X2XbC/2shIV2v8q214id6dXsD56w3a+y7YV+dsJCu19l22vEzvRq9nMmbPerbHuhPyRhod2v su01Ymd6NftDJ2z3q2x7oT8sYaHdr7LtNWJnejX7uRO2+1W2vdAfnrDQ7lfZ9kJ/RMJCu19l 22vEzvRq9kdO2O5X2fZCPy9hod2vsu01Ymd6Nfv5E7b7Vba90C9IWGj3q2x7jdiZXs3+qAnb /SrbXuiPTlho96tse43YmV7N/pgJ2/0q217oj01YaPerbHuN2JlezX7hhO1+lW0v9IsSFtr9 KtteI3amV7M/bsJ2v8q2F/rjExba/SrbXiN2plezP2HCdr/Kthf6ExMW2v0q217oFycstPtV tr1G7EyvZr9kwna/yrYX+qUJC+1+lW2vETvTq9kvm7Ddr7Lthf6khIV2v8q214id6dXsl0/Y 7lfZ9kJ/csJCu19l22vEzvRq9qdM2O5X2fZCf2rCQrtfZdtrxM70avYrJmz3q2x7oV+ZsNDu V9n2GrEzvZr9qgnb/SrbXuhXJyy0+1W2vUbsTK9mfxr6TUf/DNnuV9n2Qn/6hr19L+5X2fYa sTO9mv2aCdv9Ktte6NcmLLT7Vba90J+RsNDuV9n2GrEzvZr9mRO2+1W2vdCflbDQ7lfZ9hqx M72a/dkTtvtVtr3Qn5Ow0O5X2fYasTO9mv25E7b7Vba90J+XsNDuV9n2GrEzvZr9+RO2+1W2 vdBfkLDQ7lfZ9hqxM72a/YUTtvtVtr3QX5Sw0O5X2fYasTO9mv3FE7b7Vba90F+SsNDuV9n2 GrEzvZr9pRO2+1W2vdBflrDQ7lfZ9hqxM72a/eUTtvtVtr3QX5Gw0O5X2fZCvy5hod2vsu01 Ymd6NfsrJ2z3q2x7oc9PWGj3q2x7jdiZXs3+qgnb/SrbXuivTlho96tse43YmV7N/poJ2/0q 217or01YaPerbHuN2Jlezf66Cdv9Ktte6K9PWGj3q2x7jdiZXs3+hgnb/SrbXuhvTFho96ts e43YmV7N/qYJ2/0q217ob05YaPerbHuN2Jlezf6WCdv9Ktte6G9NWGj3q2x7jdiZXs3+tgnb /SrbXuhvT1ho96tse8X/r90+Ftr9KtteI3amV7O/Y8J2v8q2F/o7Exba/SrbXiN2plezv2vC dr/Kthf6uxMW2v0q214jdqZXs79nwna/yrYX+oKEhXa/yrbXiJ3p1ew3TNjuV9n2Qn9vwkK7 X2Xb62L9y0f/XIJ1sT7oL2EfeKG/b8SWdr/Kthf6+xMW2v0q214jdqZXs39gwna/yrYX+gcT Ftr9KtteI3amV7N/aMJ2v8q2F/qHExba/SrbXugfSVho96tse43YmV7N/tEJ2/0q217oH0tY aPerbHuN2Jlezf7xCdv9Ktte6J9IWGj3q2x7jdiZXs3+yQnb/SrbXuifSlho96tse43YmV7N /ukJ2/0q217on0lYaPerbHuN2Jlezf7ZCdv9Ktte6J9LWGj3q2x7jdiZXs3++Qnb/SrbXugL Exba/SrbXiN2plezf2HCdr/Kthf6FxMW2v0q214jdqZXs984YbtfZdsL/UsJC+1+lW0v9C8n LLT7Vba9RuxMr2a/acJ2v8q2F/pXEhba/SrbXiN2plez3zxhu19l2wv9loSFdr/KtteInenV 7F+dsN2vsu2F/rWEhXa/yrbXiJ3p1exfn7Ddr7Lthf6NhIV2v8q214id6dXst07Y7lfZ9kL/ ZsJCu19l22vEzvRq9m9N2O5X2fZC/3bCQrtfZdtrxM70avbvTNjuV9n2Qv9uwkK7X2Xba8TO 9Gr2703Y7lfZ9kL/fsJCu19l2wv9BwkL7X6Vba8RO9Or2X84YbtfZdsL/UcJC+1+lW2vETvT q9l/PGG7X2XbC/0nCQvtfpVtrxE706vZfzphu19l2wv9Z+hfOvrnEiy0+1W2vUbsTK9mXzRh u19l2wv95wkL7X6Vba8RO9Or2X8xYbtfZdsL/ZcJC+1+lW2vETvTq9l/NWG7X2XbC/22hIV2 v8q214id6dXsv56w3a+y7YX+m4SFdr/KtteInenV7L+dsN2vsu2F/ruEhXa/yrYX+u8TFtr9 KtteI3amV7P/YcJ2v8q2F/ofExba/SrbXiN2plez/2nCdr/Kthf6nxMW2v0q214jdqZXs/9l wna/yrYX+l8TFtr9KtteI3amV7P/bcJ2v8q2F/rfExba/SrbXiN2plez/2PCdr/Kthf67QkL 7X6Vba8RO9Or2f85YbtfZdsL/V8JC+1+lW2vETvTq9n/PWG7X2XbC/0/CQvtfpVtrxE706vZ /zthu19l2wt9yun7WWj3q2x7od9lw96+F/erbHuN2JlezX7XCdv9Ktte6HdLWGj3q2x7jdiZ Xs1+9wnb/SrbXuhTExba/SrbXiN2plezT5uw3a+y7YU+krDQ7lfZ9hqxM72affqE7X6VbS/0 GQkL7X6Vba8RO9Or2WdO2O5X2fZCXylhod2vsu01Ymd6Nfs9Jmz3q2x7oa+csNDuV9n2GrEz vZp9lQnb/SrbXuj3TFho96tse6GvmrDQ7lfZ9hqxM72a/V4TtvtVtr3Q752w0O5X2fYasTO9 mv0+E7b7Vba90Geh33j0zyVYaPerbHuN2Jlezb7ahO1+lW0v9PsmLLT7Vba9RuxMr2ZffcJ2 v8q2F/oaCQvtfpVtrxE706vZ15yw3a+y7YW+VsJCu19l22vEzvRq9rUnbPerbHuhr5Ow0O5X 2fYasTO9mn3dCdv9Ktte6OslLLT7Vba9RuxMr2Zff8J2v8q2F/rshIV2v8q2F/oGCQvtfpVt rxE706vZN5yw3a+y7YW+UcJCu19l22vEzvRq9o0nbPerbHuhb5Kw0O5X2fYasTO9mn3TCdv9 Ktte6JslLLT7Vba9RuxMr2afM2G7X2XbC33zhIV2v8q214id6dXsW0zY7lfZ9kLfMmGh3a+y 7TViZ3o1+1YTtvtVtr3Qt05YaPerbHuN2Jlezb7NhO1+lW0v9G0TFtr9KtteI3amV7PPnbDd r7Lthb5dwkK7X2XbC337hIV2v8q214id6dXsO0zY7lfZ9kLfMWGh3a+y7TViZ3o1+04TtvtV tr3Qd05YaPerbHuN2Jlezb7LhO1+lW0v9F0TFtr9KtteI3amV7PvNmG7X2XbC333hIV2v8q2 14id6dXse0zY7lfZ9kLfM2Gh3a+y7TViZ3o1+14TtvtVtr3Q905YaPerbHuN2Jlezb7PhO1+ lW0v9H0TFtr9KtteI3amV7PvN2G7X2XbC31/9C8e/XMJFtr9Ktte6Ads2Nv34n6Vba8RO9Or 2Q+csN2vsu2FflDCQrtfZdtrxM70avaDJ2z3q2x7oR+SsNDuV9n2GrEzvZr90Anb/SrbXuj3 S1ho96tse43YmV7NftiE7X6VbS/0wxMW2v0q214jdqZXsx8xYbtfZdsL/ciEhXa/yrbXiJ3p 1exHTdjuV9n2Qj86YaHdr7LtNWJnejX7MRO2+1W2vdDvn7DQ7lfZ9hqxM72a/dgJ2/0q217o xyUstPtVtr3Qj09YaPerbHuN2JlezX7ChO1+lW0v9BMTFtr9KtteI3amV7OfNGG7X2XbC/0B CQvtfpVtrxE706vZ503Y7lfZ9kI/OWGh3a+y7TViZ3o1+ykTtvtVtr3QT01YaPerbHuN2Jle zf7ACdv9Ktte6KclLLT7Vba9RuxMr2Y/fcJ2v8q2F/oZCQvtfpVtrxE706vZz5yw3a+y7YX+ oISFdr/Kthf6WQkL7X6Vba8RO9Or2R88YbtfZdsL/eyEhXa/yrbXiJ3p1eznTNjuV9n2Qn9I wkK7X2Xba8TO9Gr2h07Y7lfZ9kJ/WMJCu19l22vEzvRq9nMnbPerbHuhPzxhod2vsu01Ymd6 NfsjJmz3q2x7oT8yYaHdr7LtNWJnejX7eRO2+1W2vdDPT1ho96tse43YmV7NfgH6F47+GbLd r7Lthf6oDXv7Xtyvsu01Ymd6NfujJ2z3q2x7oT8mYaHdr7Lthf7YhIV2v8q214id6dXsF07Y 7lfZ9kK/KGGh3a+y7TViZ3o1++MmbPerbHuhPz5hod2vsu01Ymd6NfsTJmz3q2x7oT8xYaHd r7LtNWJnejX7xRO2+1W2vdAvSVho96tse43YmV7NfumE7X6VbS/0yxIW2v0q214jdqZXsz9p wna/yrYX+uUJC+1+lW2vETvTq9mfPGG7X2XbC/0pCQvtfpVtrxE706vZnzphu19l2wv9ioSF dr/Kthf6lQkL7X6Vba8RO9Or2a+asN2vsu2FfnXCQrtfZdtrxM70avanTdjuV9n2Qn96wkK7 X2Xba8TO9Gr2ayZs96tse6Ffm7DQ7lfZ9hqxM72a/RkTtvtVtr3Qn5mw0O5X2fYasTO9mv1Z E7b7Vba90J+dsNDuV9n2GrEzvZr9ORO2+1W2vdCfm7DQ7lfZ9hqxM72a/XkTtvtVtr3Qn5+w 0O5X2fYasTO9mv0FE7b7Vba90F+YsNDuV9n2Qn9RwkK7X2Xba8TO9Gr2F0/Y7lfZ9kJ/ScJC u19l22vEzvRq9pdO2O5X2fZCf1nCQrtfZdtrxM70avaXT9juV9n2Qn9FwkK7X2Xba8TO9Gr2 6yZs96tse6G/MmGh3a+y7XWxvvDon0uwLtYH/SXsAy/0+SO2tPtVtr3QX5Ww0O5X2fYasTO9 mv3VE7b7Vba90F+TsNDuV9n2GrEzvZr9tRO2+1W2vdBfl7DQ7lfZ9kJ/fcJCu19l22vEzvRq 9jdM2O5X2fZCf2PCQrtfZdtrxM70avY3TdjuV9n2Qn9zwkK7X2Xba8TO9Gr2t0zY7lfZ9kJ/ a8JCu19l22vEzvRq9rdN2O5X2fZCf3vCQrtfZdtrxM70avbrJ2z3q2x7ob8jYaHdr7LtNWJn ejX7Oyds96tse6G/K2Gh3a+y7TViZ3o1+7snbPerbHuhvydhod2vsu01Ymd6NfuCCdv9Ktte 6DckLLT7Vba90N+bsNDuV9n2GrEzvZr9fRO2+1W2vdDfn7DQ7lfZ9hqxM72a/QMTtvtVtr3Q P5iw0O5X2fYasTO9mv1DE7b7Vba90D+csNDuV9n2GrEzvZr9IxO2+1W2vdA/mrDQ7lfZ9hqx M72a/WMTtvtVtr3QP56w0O5X2fYasTO9mv0TE7b7Vba90D+ZsNDuV9n2GrEzvZr9UxO2+1W2 vdA/nbDQ7lfZ9hqxM72a/TMTtvtVtr3QP5uw0O5X2fZC/1zCQrtfZdtrxM70avbPT9juV9n2 Ql+YsNDuV9n2GrEzvZr9CxO2+1W2vdC/mLDQ7lfZ9hqxM72a/cYJ2/0q217oX0L//NE/l2Ch 3a+y7TViZ3o1+5cnbPerbHuh35Sw0O5X2fYasTO9mv0rE7b7Vba90G9OWGj3q2x7jdiZXs1+ y4TtfpVtL/SvJiy0+1W2vUbsTK9m/9qE7X6VbS/0rycstPtVtr1G7EyvZv/GhO1+lW0v9FsT Ftr9Ktte6N9MWGj3q2x7jdiZXs3+rQnb/SrbXujfTlho96tse43YmV7N/p0J2/0q217o301Y aPerbHuN2Jlezf69Cdv9Ktte6N9PWGj3q2x7jdiZXs3+gwnb/SrbXug/TFho96tse43YmV7N /qMJ2/0q217oP05YaPerbHuN2Jlezf6TCdv9Ktte6D9NWGj3q2x7jdiZXs3+swnb/SrbXuiL Ehba/SrbXiN2plez/3zCdr/Kthf6LxIW2v0q217ov0xYaPerbHuN2Jlezf6rCdv9Ktte6Lcl LLT7Vba9RuxMr2b/9YTtfpVtL/TfJCy0+1W2vUbsTK9m/+2E7X6VbS/03yUstPtVtr1G7Eyv Zv/9hO1+lW0v9D8kLLT7Vba9RuxMr2b/44TtfpVtL/Q/JSy0+1W2vUbsTK9m//OE7X6VbS/0 vyQstPtVtr1G7EyvZv/rhO1+lW0v9L8lLLT7Vba90P+esNDuV9n2GrEzvZr9HxO2+1W2vdBv T1ho96tse43YmV7N/s8J2/0q217o/0pYaPerbHuN2Jlezf7vCdv9Ktte6P9JWGj3q2x7jdiZ Xs3+3wnb/SrbXuhTztjPQrtfZdtrxM70ava7oH/u6J8h2/0q217od92wt+/F/SrbXiN2plez 323Cdr/Kthf63RMW2v0q214jdqZXs0+dsN2vsu2FPi1hod2vsu01Ymd6NfvIhO1+lW0v9OkJ C+1+lW0v9BkJC+1+lW2vETvTq9lnTtjuV9n2Ql8pYaHdr7LtNWJnejX7PSZs96tse6GvnLDQ 7lfZ9hqxM72afZUJ2/0q217o90xYaPerbHuN2Jlezb7qhO1+lW0v9HslLLT7Vba9RuxMr2a/ 94TtfpVtL/T7JCy0+1W2vUbsTK9mnzVhu19l2wt9tYSFdr/KtteInenV7PedsN2vsu2FvnrC QrtfZdtrxM70avY1Jmz3q2x7oa+ZsNDuV9n2Ql8rYaHdr7LtNWJnejX72hO2+1W2vdDXSVho 96tse43YmV7Nvu6E7X6VbS/09RIW2v0q214jdqZXs68/YbtfZdsLfXbCQrtfZdtrxM70avYN Jmz3q2x7oW+YsNDuV9n2GrEzvZp9ownb/SrbXugbJyy0+1W2vUbsTK9m32TCdr/Kthf6pgkL 7X6Vba8RO9Or2TebsN2vsu2FPidhod2vsu01Ymd6NfvmE7b7Vba90LdIWGj3q2x7oW+ZsNDu V9n2GrEzvZp9qwnb/SrbXuhbJyy0+1W2vUbsTK9m32bCdr/Kthf6tgkL7X6Vba8RO9Or2edO 2O5X2fZC3y5hod2vsu01Ymd6Nfv2E7b7Vba90HdIWGj3q2x7jdiZXs2+44TtfpVtL/SdEhba /SrbXiN2plez7zxhu19l2wt9l4SFdr/KtteInenV7LtO2O5X2fZC3y1hod2vsu01Ymd6Nfvu E7b7Vba90PdA/+zRP5dgod2vsu2FvueGvX0v7lfZ9hqxM72afa8J2/0q217oeycstPtVtr1G 7EyvZt9nwna/yrYX+r4JC+1+lW2vETvTq9n3m7Ddr7Lthb5/wkK7X2Xba8TO9Gr2AyZs96ts e6EfmLDQ7lfZ9hqxM72a/aAJ2/0q217oBycstPtVtr1G7EyvZj9kwna/yrYX+qEJC+1+lW2v ETvTq9nvN2G7X2XbC/2whIV2v8q2F/rhCQvtfpVtrxE706vZj5iw3a+y7YV+ZMJCu19l22vE zvRq9qMmbPerbHuhH52w0O5X2fYasTO9mv2YCdv9Ktte6PdPWGj3q2x7jdiZXs1+7ITtfpVt L/TjEhba/SrbXiN2plezHz9hu19l2wv9hISFdr/KtteInenV7CdO2O5X2fZCPylhod2vsu01 Ymd6NfsDJmz3q2x7oc9LWGj3q2x7jdiZXs1+8oTtfpVtL/RTEhba/SrbXuinJiy0+1W2vUbs TK9mf+CE7X6VbS/00xIW2v0q214jdqZXs58+YbtfZdsL/YyEhXa/yrbXiJ3p1exnTtjuV9n2 Qn9QwkK7X2Xba8TO9Gr2syZs96tse6E/OGGh3a+y7TViZ3o1+9kTtvtVtr3Qz0lYaPerbHuN 2Jlezf6QCdv9Ktte6A9NWGj3q2x7jdiZXs3+sAnb/SrbXujnJiy0+1W2vUbsTK9mf/iE7X6V bS/0RyQstPtVtr3QH5mw0O5X2fYasTO9mv28Cdv9Ktte6OcnLLT7Vba9RuxMr2a/YMJ2v8q2 F/qjEhba/SrbXiN2plezP3rCdr/Kthf6YxIW2v0q214jdqZXsz92wna/yrYX+oUJC+1+lW2v i/XPHP1zCdbF+qC/hH3ghX7RiC3tfpVtL/THJSy0+1W2vUbsTK9mf/yE7X6VbS/0JyQstPtV tr1G7EyvZn/ihO1+lW0v9IsTFtr9KtteI3amV7NfMmG7X2XbC/3ShIV2v8q2F/plCQvtfpVt rxE706vZnzRhu19l2wv98oSFdr/KtteInenV7E+esN2vsu2F/pSEhXa/yrbXiJ3p1exPnbDd r7LthX5FwkK7X2Xba8TO9Gr2Kyds96tse6FflbDQ7lfZ9hqxM72a/eoJ2/0q217oT0tYaPer bHuN2Jlezf70Cdv9Ktte6NckLLT7Vba9RuxMr2a/dsJ2v8q2F/ozEhba/SrbXujPTFho96ts e43YmV7N/qwJ2/0q217oz05YaPerbHuN2P/H3rkAbHZV5fmbwMw/8wMSyEAyBPLPhUvCNdzD Pdwi4RpukuEaEBUtNELpKKltGe3F1rSiqKgQB+MNFUKECS2WKreqYFoVtKmXttZLsEZFBVFp lZ7nz1np684+a3//7DMz/8y8b3yZWVmZ9Z7v+856Z+29z/ebxXNrv6Whrfleba1F/B2JFrHm e7W1Vk07i+fW/s6GtuZ7tbUW8VsTLWLN92prrZp2Fs+t/V0Nbc33amst4u9OtIg136uttWra WTy39vc0tDXfq621iN+WaBFrvldba9W0s3hu7e9taGu+V1trEX9fokWs+V5trVXTzuK5tb+/ oa35Xm2tRfz2RItY873aWqumncVza7+joa35Xm2tRXxVokWs+V5trUX8A4kWseZ7tbVWTTuL 59Y+1NDWfK+21iJ+Z6JFrPleba1V087iubV/sKGt+V5trUV8daJFrPleba1V087iubV/qKGt +V5trUX8w4kWseZ7tbVWTTuL59b+kYa25nu1tRbxjyZaxJrv1dZaNe0snlv7xxramu/V1lrE 70q0iDXfq621atpZPLf2jze0Nd+rrbWIfyLRItZ8r7bWqmln8dzaP9nQ1nyvttYifneiRaz5 Xm2tVdPO4rm139PQ1nyvttYivibRItZ8r7bWIn5vokWs+V5trXVL/PH1f26ldUs85mfRHmsR X1vTlljzvdpai/inEi1izfdqa62adhbPrf2+hrbme7W1FvH7Ey1izfdqa62adhbPrX24oa35 Xm2tRXxdokWs+V5trVXTzuK5tT/Q0NZ8r7bWIv53iRax5nu1tVZNO4vn1v73DW3N92prLeIP JlrEmu/V1lo17SyeW/unG9qa79XWWsT/IdEi1nyvttaqaWfx3NofamhrvldbaxH/x0SLWPO9 2lqrpp3Fc2v/TENb873aWov4ZxMtYs33amst4g8nWsSa79XWWjXtLJ5b+yMNbc33amst4o8m WsSa79XWWjXtLJ5b+2MNbc33amst4o8nWsSa79XWWjXtLJ5b+z81tDXfq621iH8u0SLWfK+2 1qppZ/Hc2j/f0NZ8r7bWIv6FRItY873aWqumncVza3+ioa35Xm2tRfzJRItY873aWqumncVz a/9iQ1vzvdpai/j6RItY873aWqumncVza//nhrbme7W1FvF/SbSINd+rrbVq2lk8t/YvNbQ1 36uttYh/OdEi1nyvttYi/pVEi1jzvdpaq6adxXNrf6qhrfleba1F/OlEi1jzvdpaq6adxXNr /2pDW/O92lqL+NcSLWLN92prrZp2Fs+t/V8b2prv1dZaxDckWsSa79XWWjXtLJ5b+781tDXf q621iH890SLWfK+21qppZ/Hc2r/R0NZ8r7bWIv7NRItY873aWqumncVza/9WQ1vzvdpai/i/ J1rEmu/V1lo17SyeW/t/NLQ136uttYj/Z6JFrPleba1F/NuJFrHme7W1Vk07i+fW/l8Nbc33 amst4t9JtIg136uttWraWTy39u82tDXfq621iH8v0SLWfK+21qppZ/Hc2r/f0NZ8r7bWIqb+ lBax5nu1tVZNO4vn1v5MQ1vzvdpai/gPEi1izfdqa62adhbPrf2/iT+2/k9VW/O92lqL+A8L 7fJaNN+rrbVq2lk8t/ZNDW3N92prLeI/SrSINd+rrbVq2lk8t/YfN7Q136uttYj/JNEi1nyv ttaqaWfx3NqfbWhrvldbaxH/aaJFrPleba1F/GeJFrHme7W1Vk07i+fW/vOGtuZ7tbUW8ecS LWLN92prrZp2Fs+t/fmGtuZ7tbUW8V8kWsSa79XWWjXtLJ5b+wsNbc33amst4r9MtIg136ut tWraWTy39l81tDXfq621iP860SLWfK+21qppZ/Hc2l9saGu+V1trEf+fRItY873aWqumncVz a//fhrbme7W1FvHfJFrEmu/V1lo17SyeW/tvG9qa79XWWsRfSrSINd+rrbVq2lk8t/ZiNdfW fK+21iLeUmiX16L5Xm2tRXxaokWs+V5trVXTzuK5tW/T0NZ8r7bWIr5tokWs+V5trVXTzuK5 tbc2tDXfq621iLclWsSa79XWWjXtLJ5be6Whrfleba1FvD3RItZ8r7bWqmln8dzaOxramu/V 1lrEq4kWseZ7tbVWTTuL59a+XUNb873aWov49okWseZ7tbVWTTuL59a+Q0Nb873aWov4yxIt Ys33amutmnYWz619x4a25nu1tRbx6YkWseZ7tbVWTTuL59a+U0Nb873aWov4zokWseZ7tbUW 8RmJFrHme7W1Vk07i+fW3tnQ1nyvttYivkuiRaz5Xm2tVdPO4rm179rQ1nyvttYiPjPRItZ8 r7bWqmln8dzaZzW0Nd+rrbWIdyVaxJrv1dZaNe0snlv7bg1tzfdqay3isxMtYs33amutmnYW z61994a25nu1tRbxPRItYs33amutmnYWz619TkNb873aWot4LdEi1nyvttaqaWfx3Nq7G9qa 79XWWsR7Ei1izfdqa62adhbPrb23oa35Xm2tRbyP+KPr/9xKi1jzvdpai/iehXZ5LZrv1dZa Ne0snlv7Xg1tzfdqay3ieydaxJrv1dZaNe0snlv7Pg1tzfdqay3icxMtYs33amutmnYWz619 XkNb873aWov4vokWseZ7tbVWTTuL59a+X0Nb873aWov4/okWseZ7tbVWTTuL59Z+QENb873a Wov4gYkWseZ7tbVWTTuL59Z+UENb873aWov4/ESLWPO92lqrpp3Fc2s/uKGt+V5trUX8kESL WPO92lqL+KGJFrHme7W1Vk07i+fWflhDW/O92lqL+OGJFrHme7W1Vk07i+fWfkRDW/O92lqL +JGJFrHme7W1Vk07i+fWvqChrfleba1F/KhEi1jzvdpaq6adxXNrP7qhrfleba1F/JhEi1jz vdpaq6adxXNrP7ahrfleba1F/LhEi1jzvdpaq6adxXNrP76hrfleba1F/IREi1jzvdpaq6ad xXNrX9jQ1nyvttYifmKiRaz5Xm2tVdPO4rm1n9TQ1nyvttYifnKiRaz5Xm2tRfyURItY873a WqumncVzaz+1oa35Xm2tRXxRokWs+V5trVXTzuK5tb+8oa35Xm2tRfy0RItY873aWqumncVz a1/c0NZ8r7bWIn56okWs+V5trVXTzuK5tZ/R0NZ8r7bWIn5mokWs+V5trVXTzuK5tZ/V0NZ8 r7bWIn52okWs+V5trVXTzuK5tZ/T0NZ8r7bWIr4k0SLWfK+21qppZ/Hc2s9taGu+V1trET8v 0SLWfK+21qppZ/Hc2s9vaGu+V1trEb8g0SLWfK+21iJ+YaJFrPleba1V087iubW/oqGt+V5t rUX8okSLWPO92lqrpp3Fc2tf2tDWfK+21iLen2gRa75XW2vVtLN4bu0XN7Q136uttYhfkmgR a75XW2vVtLN4bu2XNrQ136uttYhflmgRa75XW2vdEn9k/Z9bad0Sj/lZtMdaxC+vaUus+V5t rUX8ikSLWPO92lqrpp3Fc2tf1tDWfK+21iJ+ZaJFrPleba1V087iubVf1dDWfK+21iL+ykSL WPO92lqrpp3Fc2u/uqGt+V5trUX8VYkWseZ7tbUW8VcnWsSa79XWWjXtLJ5b+2sa2prv1dZa xK9JtIg136uttWraWTy39tc2tDXfq621iL8u0SLWfK+21qppZ/Hc2n+voa35Xm2tRfzaRItY 873aWqumncVza7+uoa35Xm2tRfz3Ey1izfdqa62adhbPrX15Q1vzvdpai/jrEy1izfdqa62a dhbPrf36hrbme7W1FvEbEi1izfdqa62adhbPrf0PGtqa79XWWsRvTLSINd+rrbWI/2GiRaz5 Xm2tVdPO4rm1DzS0Nd+rrbWIvyHRItZ8r7bWqmln8dza39jQ1nyvttYiflOiRaz5Xm2tVdPO 4rm1r2hoa75XW2sR/6NEi1jzvdpaq6adxXNrf1NDW/O92lqL+B8nWsSa79XWWjXtLJ5b+580 tDXfq621iP9pokWs+V5trVXTzuK5td/c0NZ8r7bWIj6YaBFrvldba9W0s3hu7W9uaGu+V1tr EX9LokWs+V5trVXTzuK5tf9ZQ1vzvdpai/ifJ1rEmu/V1lrE/yLRItZ8r7bWqmln8dza/7Kh rfleba1F/K2JFrHme7W1Vk07i+fW/lcNbc33amst4n+daBFrvldba9W0s3hu7W9raGu+V1tr EV+ZaBFrvldba9W0s3hu7X/T0NZ8r7bWIv63iRax5nu1tVZNO4vn1v72hrbme7W1FvFbEi1i zfdqa62adhbPrf0dDW3N92prLeLvTLSINd+rrbVq2lk8t/ZbG9qa79XWWsTflWgRa75XW2vV tLN4bu3vbmhrvldbaxF/T6JFrPleba1F/LZEi1jzvdpa65b4w+v/3ErrlnjMz6I91iL+3pq2 xJrv1dZaxN+XaBFrvldba9W0s3hu7e9vaGu+V1trEb890SLWfK+21qppZ/Hc2u9oaGu+V1tr EV+VaBFrvldba9W0s3hu7R9oaGu+V1trER9KtIg136uttWraWTy39jsb2prv1dZaxD+YaBFr vldba9W0s3hu7asb2prv1dZaxD+UaBFrvldba9W0s3hu7R9uaGu+V1trEf9IokWs+V5trVXT zuK5tX+0oa35Xm2tRfxjiRax5nu1tRbxuxItYs33amutmnYWz6394w1tzfdqay3in0i0iDXf q621atpZPLf2Tza0Nd+rrbWI351oEWu+V1tr1bSzeG7t9zS0Nd+rrbWIr0m0iDXfq621atpZ PLf2exvamu/V1lrE1yZaxJrv1dZaNe0snlv7pxramu/V1lrE70u0iDXfq621atpZPLf2+xva mu/V1lrEhxMtYs1Pae8dePtRc8/w6/aBjxl/PXvg6aP2zpXFYv/w+3Mr10mtG3fsXLlxx+HV T2w9vPq48c8/dvz1yaNGqVfqBNC5/8T7cTNuXLvoPHhrja2V6z808KpG3UPDf3FocdHau86F V1XrPnr8Pf/+FQMvGN9LfgXx62LvlsW28bcHXv96UVws7jXW4M+V17nuk+P7vLtynbx/N+64 ZuXS4deHVfJo3rjjttu/uP3i7TesXLz9um0Xb//E1tsOvGYlXs+FA88a+O3rX9dfLM4Yiv6B XNcg/+bsGte9vnGN6GXX+Imt+1eu27Zz5YaVnStf3M59s3+F15W/7l2r+eu+fPWL2w+v3rBy ePW6bdyHlw/ctdq6zvJe1ffnfeP7c96Wv/v+HKv79nqeUd6e171+6xXbr9/62R2f2QGv2H4s 675h4CVPPW3x9uHX3xm4bXifVrb8//pnDIVexxu9WH+7R7z5CbXfD7Lrv752/IzfOfDap5y2 uGjLzTr4Tvx+y/CJ4jnkb40vxf8ZhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmFsGI8ZuH3g2QNPl3+/f+D9Jf7SiNve8m9uXLvoPLhYPHas 8eSBtx+4tVL3+uFfXrE9r3v91iu2X7/1szs+swNesb1W967j788aeO74+y0Dnzfw67fc/Ps3 DvWeIhofOm39ly0ruxd7n7x45eK1i69dvGrxhuF/dy+eOfzv1yxes3jjBt+388++78HFGVsW t9mJ4mLxNOLPLbZcOPz+wuH3r9k9/Psh962f/Juf5b/4xuHXswbe8eyztvBn+XfnDvEz3/CC 067969MPUuOCId51+/duvexhpx98y69de/BpQ/ys57xvKzUuWGx5x6XDr4vFtbfE7xp+fff2 D6zHl93jbt+8fiHX/u36+/SIbR/gl1uAHnUXixvexO+38S8/cMObrv1Lai4WH/ml92z9haHO N3zy/Vv59ze/qsXi0y/79NsWb33p+n/+V0P+1QfWP5LFveS9f8HIwwN/d+DPDPz8mNtz6XkX ftuLz7vww0OFbTtu/nfPLN7LuAcuGT/Hy6T+HRaLN9e0PjRq/XxF6w4ry2k9Z+DXLaH1c6PW L1e0Xrek1guXfF1ooPXrFa1PLKlFna9YQuuGUes3K1qnb19O6+KB915CCw20fr+i9dAltZ69 5HuIBlp/WtF665JaX77kvfEno9afV7T+eEmtHZX38ET25dr7dO3Avxj403jP6NPxPl01eMMH l3if8PRlPn800Pp4ResLS2o9cUmtj45av1jRumhlOa1l+/WTo9avVrTesqTWsq/rU6PWb1W0 fntJrSctqfUbo9bvVbTO3z7v66JX0fqjita3LKn1/CU/rz8ctT5X0frYklpPrWi1eu3PRl1Y 6t5hx3K6x9OT5q57hrxHoXFwzzCerdyssbuiwX97cM/OlUvHObPM34b7bffOlQNr+wdes5LV ObC2a5U6D6vkGawOrF2+etnuw6sH9xxevXrv4dUr910+cNdqVvPKfdek13blvv0rV+/ducJr aL3GxxXv/6GBV43v//mVP8d7e2j4Lw6dCx+3dmgBr1pEnfKzQMef8an3GZ+5tljctC3/jM9c u2nbmWvn3O66ffCmbb53fO/Mee+8gXXrrtsuHj+86A+y5B1+vfeQuPtQ//ND/bcMhXat3zDr L3fEm59Q+/0gu/7ra8fP6p0DLx3+8J2GP/mF8b2O328Z3lHeZ/K3xpfi/wzDMAzDMAzDMAzD MAzDMAzDMAzDmA+c+R1PGoaxOfufbw0sQ475lyUPAyzDjdRc9jrtQ4bR5wvL9H+tn3kkSslj XTWuHGNOXUd5vct41LKeYxgno0dkvjDlBVO9z2OMQR7FD64WvF2FPPpY8g4zsVa7dg16jXr9 UF/blBdNec+U39hjjBPRJ2oeUXpD6Qk1Pyh7P/r1y4R3HHm68E7COxfksfiSOztYqwdVU68H 6rXG9etrKn2p9J/Sc2p+U/rMMh5jGMfSKzbiETVvUF+o+YF6QNnrdxnJ1w7hmSP5+iHcVfBu Qr7OUfLunazVVM3yerjGuGYYryNel/pT6UM13yn9puY1NY/J/MXeYvT6xTJeUfpE6RGlP9S8 ofSE8ALt/7LX7zHwnJFrI3eP3DNy78h9wnsK+SpyjXxNucWpPwujvurCuJ64vrjeuP54Pbw2 9Sb1ofDI8B31nPCb0mtKnyk9pvSXqfnF3mJs1C9Kr9A1R80n1CN0doj7XGcF9Qb1hPAC9YHo fe3x+4zka5bnjbzvwPuN5Gui8AEjHyh8kPD8Ch+8JGt/VmuHXlwDjOuK6+Sa4/p5LfG61KfC j8J/1HvUc8JvyjlHPUZ9Rj2m9JdynVR6i33l1PaMZf1iGa/QOaKcITJ/UF8ITwg/CC8ID4i+ 1x5/yMCHjuQr3A8f+YiBjxx5wchHjXy0kK+pK/nKeQ/LeqET2jCuJ66Pa43r5jXE6+G1hUep H4UHqfeE74Tn8J6q19R8Rj0mZhk+w414y0Z8xTi5PEPXIy2/KOcK9QqdJcInpjxC/aH0htIT wg/CC8IDou+jZ/kxFo8fyM+FgBeO5EdQ8SOvgvwYCsiPLQvy45yUF83AsiZUzbiOuC6uE8Z1 x+vgNfHa1JvCi8J/wnvCd8Jzal6jPqMzjXpM+IvOMJm3LOMrug6yp5ycnjHlF7pHEXOFekXM E7HOUJ+IGSI8ImaH8IfSG9QX1BPUC7T/td/58ZJPG8mP0IRPH/mMkfx4NvisgvwYzCA/wnQu al2omnEtMK4vrjeuP14Pr029SX0o/Cd8Rz0n/Kb0mvCZmGvCY/isSn+JGabmLTG3xLoo8xV7 yonpG+XaJDxDZ4xYj5RrEZ0tmHd1rgiviDVHzBOlT8QMUXqE+kPpDeEL4QmlF6gHaM9fMvK5 I/nRyZAfT6mMHwsJ+THENfIjJufgVH29Br22uGYYryNel/qS+lDpPeo54TfqNeozpcfELFP6 S8wvsUYKb+FeiHVRrImmfCXWQTqrlJ6iax/7yfGfNabmDPWMmDFif1P9gnuj9Av+juLvqvCK WHNw3/F3XOkTMUOoR9T8Qb0hfKH0g9IDyn5/0Uh+VGCQH7kXfLHwJQlfOjOndPR6oF6rvoZ4 XaUvqQep76jnhN+o15Q+ox4Ts0zpL3y26i2xPoq5peYrutcS+7iZp9TmFM8ox883Yj8j1ibl nFHzjJpf6GyBXzADq1fEmiPmiZpPtDwi/KH0BfWE0gdqPf8y4csrfEWFly3JVy7JZevVrqV2 zfqaap6k/lPzHPWb8JrwmSmPKf1F55dYI6m3cE/E3kvMLKWvxDqo5Smx9on9FPvJsfON2qzB mnTKM3TGiL2L2LfI/IIZOOYK9YqYJ9Qnpjyi5g+lN6gnTPlA1uOvmuBXLsFXz8xlNGvX2vKo mv+UnjPlNeVcU/MY9ZeYX0pv4V7gnsh8hXsq1kHcazqrTHlK7Keon3CP20/m2d8o542ab+h+ Rjln8DnqmiT2LmLfIvMLnStqXlH6RDlDlHND6Q1TvpD5QNa/X3UCcqOeNOU7Nb9Rr9G5RtdS 6jF8llPeonNL5iuxz8I9FrNKrIHUU2JOiTOgmp/Emqc2n9hL8pljap0SvhHnrDFrxHkJ++nM kzpnqGfEjBHrkZpfxGzB7KtzRc0rWj5R+sOUNxypH3z1Scoj9Z6W16jHtPxFvUXnllgX6cxS +kqsg2qeonMK9yr3bOyncC/H/iz3eG0+CT/xbJLPHHGWUps31DdYd+qswdqU/S/mSvbEYs7g 89QZI9YjMV/EfkXNL0qv0DVH5hOZR5yKvnA8/GYZj1F/0fllyltqM4v6CvdUrIOmPIV7k3uU ezX2U2JG4Z4u/aS23qmtdU4lLym9o1yrxL5o7G/wXpa+wR4Wfh57GrGfwbNIzJU6Z9Q8gxkj 9i0yvyjXHlNesYxPuOc3j89M+cuy3hK+UptXuLdansI9yr0a+yk6o0z5Cb2g+7HlWudU8JJy j7T0Dl2rsOcU+xvMejFvhG+wRuG9L2cNzkqYK6c8g78/dD1S8wudLTKvsE+cfP6yjLeUayL1 lVgH6axSekqsfbhXuWd1RuGe5t4u/ST2ZOkJekPXOqeCl9TmjnK9gr/qzMGeU+xvMOvVfIO9 LM7hYtaI/Ywj8YyN+oX779T1lilfyTyFe1A9hb3a2E+JGYV7mXu65if0AL0Q+7HlbBLrHD3T ORm8ZGrNEt4Rz3HEPofOHKxV2Bdlzch+FDPflG/ErBFnJfwdUPOM2oxhvzDn9pVyDTQ1p3Cv cs/GjDLlJ9z79AC9QE/QGzqb0Dv0kHoJPXaizyXlXmmsWcI7Yo+U2Yw1H/5azhzsZ7NmZNar +Ubsg/JZxKzBGjWbM0rPsF+YR8NXpjxF5xTdTwk/4Z4u/STWO/QCPVHOJuybxDonvIQei7mE 3iv3Xk+U2UO9I/Y7Yu5Q74h9Dp05ePaYvafY3yh9I9YoOmts1DPcA+bx9hT1kzj34d4u/ST2 T+gJeiNmE54/oXdinUNPqZfEfome42zmmWRqz4M9ZPZ/WLvFmqX0DtZ+PL/BfjW+i/+y9xT7 GzpvLOMbU2sT3+fm8fKUZWYUXfPofEIP0Av0RMwm9Ao9Q+/QQ+olscah5+g9elDPhDfbTDI1 e8S6hT1k9n/4DjVzF6+z9A5mNc69ypmDPajY34h1Sss37BnmieYpU34S6x16gF6I2YRzR3qF NT69U/MSeo2eo/foQV3flDPJZtv3iNkj1i3sIbP/w89+YQ2XeQf71TpzxPMauidq3zBPJT/h 3i9nkzjbiXUOPVR6Cb1Gz8U5TqxvYibRfZLjtbaprV1Ye+nswUzFGS17yewDsYbj3Eq9gzPz WK+wFixnDvuGaT+59WwS+yb0Dj2kXkKP0Wv0HL1HD9KL9CTnGeU+yfFY25T+EWuX2PdgX4fZ g5mK8yj2kmOvlPkr5o7wjlivlDNHuS9q3zBPNT/R/ZNyNlEv0bmEHou9V3ov1jf0JL0Z+yTH y0dq/hH7psxLrMHY14nZg9mKcyn2lNkPYi0XaxZef+yRhndkM4fvMfNU9JPabFKuc9RL6DF6 jZ6j9+jBmEnoTXqUXqVndY/kWPjIlH+wzuIZ3Fi7sBbjOwCcZ7N/zIzFnjL7QazlYs1i7zDN +bwk5hJ6jHMcnjGh9+hBepGepDdjbUPP0rvH0keoO+UfnE3z/BxzE/MT+zs8a4cfxrol9koz 7/B6xTSXX+eUXsJ+CT3GOQ49R+/Rg/Qi+ySxtqFX6dnwEXpZfeRoeIie37KGwrvUP9gDZu+D vRzmJ86w8UH8EF9kz4OZi32hzDt8r5hmn5fQY/QaPRczCfsk9CS9yc8eoFfpWfUReprePhrn vuXzH+zFsJaK9QueFv7BM/7s6bB2YW2GH8bsEecsXrOY5tFb48Q5Dj0XMwm9SE/Sm+oj9C49 HPsj9Hac+87pI7qG4WyZsyH2dtmbYW3FbBT+wfqLPZ1Yu9RmD3uHaR4dL6nNJOyT0Iv0ZOkj 9C49TC/T0/Q2PT7nmqZcw7Bu4oyZMyL2eNmjYY3FNXFt4R9x5sIarZw97B2mefS9JJ4toQfj 7Kb0EXqXHqaX6Wl6mx6fc00TM0i5huH5N77zwjNx7NWw1uLawj/Y27F/mObxn0nCR+hJ9RF6 lt6lh+llepre1jXNHLNIzCBxDsMzqDw7yzqKnwfJz4fk2Tj2bDi7jfWL+oeuXfw5m+ax8ZLo O/URepMepVf5/w1I79LD9DI9TW/T4+Us0ruOiX0QnUH42dTMQeyB8L1knrflGRfWXqV/ePYw zc3jI/QovUrP0rv0ML3MM2g6i8S+SM96JtYxcZbLWgmfYg8G3+K5FZ6FYy66ZDxLYg/H/mGa m9NH2GflvIZejTUNPUwv09P0duyLxFlvz3qGPxfrmDiL4RyItRPPvLEng49x/sz5EXMSZ0rs 5bAWs3+Y5ubxkdhnpUfpVXqW3qWH6WV6mu/V0ONxRkPv4wFH6iHlOobv/fG9HfZxOcuNfRD8 TGcQ3T/1Z2iam8tH6FGdRehhepmeprfpcdYzfAdf1zM9HsIeLc+x8bOROAPi2RS+E8i+Lme5 PAsX+yD4nP3DNDevj9CjsS9C79LD9DLrGXqbHqfX6Xl6/0g9RM90dS+EvVu+A8j3YXiejH2Z WMew1tJ9EH9uprn5PIQe1fUMPUwvc85Lb8f5TOyJ4AE9HhLPlXHew7NsPGPPeTLrJ77LE+e5 nD3jIbEP4s/MNDenj9Cj9Co9S++yJ0Iv09P0Nj1Or9Pzuq/a6yGxn8qeC3sv/IwTzpd5Dp/n VlhfxV6IPcQ0N7eHxJ4IvUsP08uc8Zb7qvGcSK+HxJkM3/HjTIazZDyktp/qdYxpnhgeQs/S u+Eh9DS9TY/r2cyRnu/GuW54CN/rCw/huzr8XBN7iGmeHB5CL9PT4SH0+tHyEJ5lm/IQn8mY 5ontIfQ2PU6v0/NzeEg8X1Z6SO3ZEHuIaZ4YHkKvHg8P4Vl69RB+Tpk9xDRPbA+J58ymPAQP sIeYpmkPMU3THmKapj3EHmKa9hB7iGnaQ+whpmnaQ0zTtIfYQ0zTHmIPMU17iD3ENE17iGma 9hB/VqZpD7GHmKY9xB5imqY9xDRNe4hpmvYQe4hp2kPsIaZpD7GHmKZpDzFN0x5iDzFNe4g9 xDTtIfYQ0zTtIaZp2kPsIaZpD7GHmKY9xB5imqY9xDRNe4hpmvYQe4hp2kPsIaZpD7GHmKZp DzFN0x5iDzFNe4g9xDTtIfYQ0zTtIaZp2kPsIaZpD7GHmKY9xB5imqY9xDRNe4hpmvYQe4hp 2kPsIaZp2kNM07SHmKZpD7GHmKY9xB5imvYQe4hpmvYQ0zTtIfYQ07SH2ENM0x5iDzFN0x5i mqY9xJ+VadpD7CGmaQ+xh5imaQ8xTdMeYpqmPcQeYpr2EHuIadpD7CGmadpDTNO0h9hDTNMe Yg8xTXuIPcQ0TXuIaZr2EHuIadpD7CGmaQ+xh5imaQ8xTdMeYpqmPcQeYpr2EHuIadpD7CGm adpDTNO0h9hDTNMeYg8xTXuIPcQ0TXuIaZr2EHuIadpD7CGmaQ+xh5imaQ8xTdMeYpqmPcQe Ypr2EHuIaZr2ENM07SGmadpD7CGmaQ+xh5imPcQeYpqmPcQ0TXuIPcQ07SH2ENO0h9hDTNO0 h5imaQ/xZ2Wa9hB7iGnaQ+whpmnaQ0zTtIeYpmkPsYeYpj3EHmKa9hB7iGma9hDTNO0h9hDT tIfYQ0zTHmIPMU3THmKapj3EHmKa9hB7iGnaQ+whpmnaQ0zTtIeYpmkPsYeYpj3EHmKa9hB7 iGma9hDTNO0h9hDTtIfYQ0zTHmIPMU3THmKapj3EHmKa9hB7iGnaQ+whpmnaQ0zTtIeYpmkP sYeYpj3EHmKapj3ENE17iGma9hB7iGnaQ47MQ6irHoKuPcQ07SH2ENM8dT3k2Q0PWen0EP58 zUPQs4eY5onpIZclHnKvGT2EP1d6CPXPn/AQrsseYponpoc8Zuzt8JAzZvSQ24/1zhYPQe+p o/4LB75kvC6uzx5impvfQ+hZepceppfp6QcNvOfY6/Q8vT+Xh9x54N3G+g8c+OiBTxn4LPGQ V9hDTPOE8BB6lZ59wdjD9DI9TW/T4/Q6Pa8eslGEh2wbeLuBdxq4a+DegQ8YeMHAJw185sDn D3zxeF2vGtcz/rxMc/OR3qRH6VV6lt59xtjL9DS9TY/T6/Q8vY8HHImHgNPGP7868PSBZw3c M/B+Ax8x8MKBTx/4vIGXDny591VNc1PPIPQmPfqysWfpXXqYXqan6W16nF6n5+l9PAAvOFIP 2Tpwx8A7DrzrwLWB5w586MDHj8+ZXVLsqzIr2UdMc/P5R7mfypkIPUwv09P09jljr9Pz9D4e 0OMhU8+IsK8aeyKsZ1hXlesZrts+YprH3z/CQ+hN1gv0Kj1L78ZeiJ7J6PNleMCRekhtXzX2 RO4v65mLBz534IsmZhH7iGkef//QGYReZf1A78Y6hp6OvZByP3WjZzK1fVXWRbGeYdZh5uF5 FM6DYhZhf2a/7IvYR0xz8/hH7IPQo/RqzCD0ML1crmNiL6TXQ8r1DGfGnPvsk1nkCfL9O855 mZPsI6a5ufwj1jD0aOyD0LsPH3uZnqa349my3nXM1CzCXm3MIvcZ11CPGvjEcS6K/VXOnsNH Yn/E+6ymeez2T2P/I/yDnqQ3Yw1Dz9K79DC9HDOInsf0zCDlLMLeLL6k+yKcAZ038CHjPPTk 8ZyIvRH1EdZgvBbPJKZ57GYPeo7ei/kj/IMepVfZR6V36WF6WfdB6PU4j+n1kNos8mXjvi3P wzL/cKb8sPE7NOEjXGusa1iD8Vp0beOZxDTn9w5du3BGSu/F+kX9g7/zOculd+lhepmeprc5 z51rBqnti7BPy7Nrsabh5xLxbCzrqdJHWHNxfsQeDnvBvKZY23gmMc2jM3uEf9BzPEdGD9KL pX/Qs/QuZ7mxhqG36fHYB5nLQ3QW0TUNz8KeOfoI58rhI1wjz84+bfw+D3vAnCWxtsEXw0vK mcReYppH5h212YOeo/foQXqRniz9g96lh+llXcPMOYOUs0j4CPMOe7fqI1wTsxHXyFqLc2f2 fjlDYo+EeSpmktgnsZeYZv+6JfY96C16jF6j5+g9vtdPL8b+Bz3a8o+5Z5Caj7BeqvkIa6v7 jufNfIeHZ2g5g2aOipmEvR18Ur1E1zf2EtNcbu4ovYPeitmDsxd6jx585NiT9CY9WvqH7oEc Lf+o7Y2UPsKairUVz7rxvAo/i4CzZ+YnzpHwQ74jyN4OazRmrdJLYi4p90vsJ+ap6hst74h1 Cz1Fb9Fj9Bo9R+/Rg3ynn56kN9k/pVdL/zgaeyDL+kjsj7Anc5fxOZXd4/dqWHcxP8VMwp4O azNmrJaXeDYxvV75u3ulmXfQU/QWPcbPO6bn6D16kF6kJ+lNepRejfXLsfaPqf0RroU9XZ6R 5Tk3vjscaxvOn/FB9ltZk/FsHDMWsxY//0S9JPZLdO81vMSziXmqzRzxjEfslXIuQY+od9BD eAc9RW/RY/RazB6xdqEn6U16lF49FvsfG/URzoR4fkTXNsxN+B/nNuzl8ExcrG/Y5+F161wS +yWcScU5zjKzif3EPNF9Y2rmCO+gJ2K/Q+cO9Q56ix6j1+i5mD1i7UJv0qP06vH2j5qP6B4J c5LOJOyT8CxcrG/Y3+G7NnhJzCXhJZxl87NR2FuOdY6eC9tPzJPZN2ozB71AT9AbpXfQQ/QS PRXrFnqNntPZo9z72Az+oT6ieySxttGZhDUYz9IyU7Gvw/P56iWxxmEtx3lwnONwPqWzSeyb tPzEnmJuZs+Y8o3Y5yhnDtYr9AS9QY/o3BHeQU/RW/QYvUbP6ewRa5fjsffRO5Ow9uIZWp7F jz1Xvt8TXqJrHL4DxH4Qe8r8rGmdTfAT1oDL+olnFHMzeMZGfYN7nHtdZw56gZ6gN+gRXbOE d9BT4R30Gj0X+x6bcfbYyEzC2kvXN7w+1mfqJcxfnF1zHswzapxnxzoH3+Wsij1YXeuUfqL7 JxvxFPuKeaw8Q/c3St/QtQr3Ovd8zBz0Aj1Bb9Aj9Ao9E94Rex70lq5bavsem9k/ajNJ6SXM VOolusZhDcc+EOc4/HxpZjSdTWIPNtY6Op/EeifOdviMYkZZxlM8q5gb8YuNekbMGrq/wT2r 84auVbjXdeagF+gJeoMeoVd0zaLeoXumsW7Z7LPHRtc3sVdSeknsvfJznzmPYkbDbzmj4pyb fRP1k3I+Yf8kznb4jGJGWcZT7CvmkfhF5hmxJ1rOGtyj3KvlvKG+wb3OPc+9HzMHPUFvcNZJ r8R+R+kdJ9K65UjWN+El5RqHtRvvB98/5hlcZrOYTXi2n3Nu1n7McVN+EvsnPKfHHpTOKHHG 0/KUjfqKveXk8opl/WIZzyhnDe5J7s3Y35jyDe5x7nXuee79mDlivcI5C70S+x26ZjnZvGOj XsL7wR4yz9DpbILvsuaLtU7pJ8x6PJPHzx1g7cjeE2uemFFqnhJ7KbH2if2UI/WVmrfYX048 r9iIX+jaJOaMmmfErME9yb0Z+xvcs9y7U77BPa8zBz1Bb9AjLe84Gf1jmf2Scp2Dz/Ke4bv4 L2s/9ROdT5j5WDPyfB57T5x74e98XnznOfZRap4S+7PlrFLzlcxbNuov9pij5w81n5iaK2pe MeUXOmPo2qT0DO417jnuPe5B7kXuSe5N7lHuVe7ZOFep+UbMHPQAvRDrlThnOVn2O47GbML7 U84mrPmY36b8hLUia0b2nDgrL2eUmqfwdwNzZezPskat+UrMKxv1lmDpLzWPyXzmVPWb1vtR ew+n5gn1Cj6nZbwi5gv1i5gxYj+De4d7KOaMmmforMG9yT0a+xtTvhH7HPFsx6k+c/Ssc2I2 mfKTWO/E/gl7Tpx3seaJPVn2szlLD0+JOYW1D98DZL6M/ZSYVUpf4e8a7qFYB7W8peYvLY8p fWbKa5bxm+PhR73XNOULpTeoP9RmidIn+BzCJ5bxCj7jcr4Iv4gZI/YzuHe4h7iXap7Bvcc9 yL3IPcm9yT0a+xuxTil9Q9cqOnPYO+b3k1jvxP4J+7E6o+yueErMKbH2YS+LWYU1aswq6is6 rzCrlt6ieyzch1P+UvOYms+o15R+U3rOlPe0POhYc+r6aq+lfL1T3qBzRM0jpnyinCvCK2K2 iPWIzhfhFzFjxH4G906sTWLOKD2DexDP4J7k3mTW4Owg9je4h+0bR9dLpvwk1ju6f1LOKOop fI7hKaw/Y+3DmlRnFfUVnVfYQ2dWLb0l9li4//g7q/SX2vyiHlPzmWDpN+o5pe+U3pP50LHi 1PWU113zhNIXSm8If5jyiJgnSp+IuaL0ipgt+Iz5rHW+UL/QGYN7J9Ym3FM1z+AeLGcN3d+w b2weP4n92NqMMuUpzJWxnxKzivpKzCs8HxjrIM7h+HtIvSXmFv7OijVR+IvOL1Meoz5TzjPh N6XnqO+U3qP+o9T+PJosdctr0+ue8oTwhdIb1B9aHhHrDz6LWIPoXKFewWfKZxvrET7zmC/U L2LGiP2MWJtMeUY5a8S+aMs37B3Hbr3TmlFKT4k5hXmSuTL2U6Z8hb9jOP+JdRD76cws6i06 t8SaiHsz1kUxv4TH8Pde5jPqNeo3pecES+8pPaj0ImX07ZGwVk97v/QA9YHwgmD4QTB8ofSG KX+IWSI8gvc81h98FrEGwSdirii9gs821iN85jFf1Pwi9jNibZJ5RjZreN7YvH6SeYqufcpZ JXxF55XYW5nylphbwl+Yd7k3Y10U80t4TMww3N8xx4TP1LxG/UY9J6jeE/6jHqRepNSe7WFZ t9SN69FrDC8IPwhPUF+oeYP6Q8wR+EPMErzHMU/E+iN8gs+GzyjmCvUKnS34rPnMdb4Iv4gZ I/YzYh+UeyqbMzxrnHyeEvuz5axS+krMK8yo5czCfRZzS+yzxJqIezPWRfzdFmujmGFi7yXm GO55/n4svSZmGvUc9Z3Se8J/woOC0ZPqSTVGH9c49WfK2qob1xI+UHqB+gGMuWHKG3iPwh9i juC9DI+ItQfveaw/1Cdi3yLmCvWKmC34rHW+UL+ozRgtz/CscfJ5Srn2mfIV/m4p10HqLbHH EnNLzV90fgmP4X6e8hn+ngyvUb+JuYa+KX0nvCf8JzwofCi8SBl9Gt60Ueqfj35Xhm5cR1xX XGdct/oBjLlBfSG8IWaIWG+EP/BeqkfoPFHziZgrYu9CvaJcj+h8UfpFuTaxZ5ya+7NTs8qU r5TeEnPLlL/EPq56DN8trPkMfz+q19T8Bsb6Sb0n/Cc8qPSh8CIlvVqSHs5Y+zNl3dDT/g8P CB/QWSHWFfH6Sl9Qb4gZovQH3lP1iNjfjPVHzSd0rgiv6PELe4Z9JZtXprylNrdM+UvpMbFG KmeZ0mvUb9RzwnfCe8J/1IPCh4L0ppJ+naL29BTLeqql1xDXFdcZ1x1+EJ6gvlB6QzlDTHnE lE/U5orMK+wXxty+UnpL6S/chzV/yTxGfUZnmfCa8Jua54TvlN6jpAeD0ZfqS3OwrKua5fXo nBB+UPOE8IUpb1B/0FlCPaLmE7pvkXmF/cI41t7S8pfSY6Z8Jrym9JvSc4LqPeo/pQ+pF5Wk b4+EU/VUs7we9QL1g/CE0hdKb5jyh9IjjsQn7BXGieAv6jE1n1GvqfmNeo76Tuk/6kHK6M8W o5/Lvm6xpqnXVF6vvpbSE9QX1Btq/qAeYZ8wTnZ/mfKZ0mtKv1HPqXlP6T81Lyqp3rRRTtUs e3/KB9QLap5Q+kLpDfYIw1jOazLPmfKezIeOFaeuJ3sdNU+wPxjG8fefFlt9vZE+b9EwDMMw DMMwDMMwDMMwDMMwDMMwjA2AL2TzMBBfYjhd/j0/lI4vVAa+NIID/5tx49pF58Gbv9xNDX4Y BA8h8pBQ1OXBZv4dh3mhcXDPYrFz5WaN3RUN/tuDe3au8EOy+EJXmefhgst271w5sLZ/4DUr WZ0Da7tWqcOXTcs8DzcdWLt89bLdh1cP7jm8evXew6tX7rt84K7VrOaV+65Jr+3KfftXrt67 c4XX0HqNfEFe3/9DA68a3//zK3+O9/bQ8F8cOhc+bu3QAl61/kV76pSfBTrlZ3zm2mJx07b8 Mz5z7aZtZ66dc7vr9sGbti1Td+5752jfkxxOh8aB4T25pnFPcq/l99L+Fe5LPlc+f+4D7pX8 XsrvT+5H7kvuT+5T7lfu6dZ1buR+8Pt7dN9f7emp93e9pxcXrb3rXHhVtS5fTOXflfV5b8NP pz2J94vXd3g1u/YDA79p4hrjgY7QW3xq/Z9bxVfuy2NQfrG5R/suDW3N92prLeK7JlrEmu/V 1lo17SyeW/vMhrbme7W1FvFZiRax5nu1tRbxrkSLWPO92lqrpp3Fc2vfraGt+V5trUV8dqJF rPleba1V087iubXv3tDWfK+21iK+R6JFrPleba1V087iubXPaWhrvldbaxGvJVrEmu/V1lo1 7SyeW3t3Q1vzvdpai3hPokWs+V5trVXTzuK5tfc2tDXfq621iPclWsSa79XWWjXtLJ5b+54N bc33amst4nslWsSa79XWWjXtLJ5b+94Nbc33amst4vskWsSa79XWWsTnJlrEmu/V1lo17Sye W/u8hrbme7W1FvF9Ey1izfdqa62adhbPrX2/hrbme7W1FvH9iX9l/Z9baRFrvldba9W0s3hu 7Qc0tDXfq621iB+YaBFrvldba9W0s3hu7Qc1tDXfq621iM9PtIg136uttWraWTy39oMb2prv 1dZaxA9JtIg136uttWraWfz/2LvvaEvo8urjd0CYGdBIIlEQdSjRgDFWxIqiKIgNu2DFLoqi qOBgA3tBBbsioth7QxOjWLH3kphojEYj9hY1dn3Pvlzm/Xrncf/uWvu3zHrf9TyH47179rA/ 554Z7vCHLmfbVxrY7FObW8r7GkuZfWpzq7Jdnm1feWCzT21uKe9nLGX2qc2tynZ5tn2Vgc0+ tbmlfFVjKbNPbW4pX81YyuxTm1uV7fJs++oDm31qc0v5GsZSZp/a3Kpsl2fb1xzY7FObW8r7 G0uZfWpzq7Jdnm1fa2CzT21uKV/bWMrsU5tble3ybPuAgc0+tbmlfB1jKbNPbW5Vtsuz7esO bPapzS3lA42lzD61uVXZLs+2rzew2ac2t5Svbyxl9qnNrcp2ebZ90MBmn9rcUj7YWMrsU5tb le3ybPsGA5t9anNL+RBjKbNPbW4p39BYyuxTm1uV7fJs+0YDm31qc0v5xsZSZp/a3Kpsl2fb NxnY7FObW8o3NZYy+9TmVmW7PNs+dGCzT21uKd/MWMrsU5tble3ybPvmA5t9anNL+RbGUmaf 2tyqbJdn27cc2OxTm1vKtzKWMvvU5lZluzzbvvXAZp/a3FK+jbGU2ac2tyrb5dn2bQc2+9Tm lvJhxlJmn9rcqmyXZ9uHD2z2qc0t5dspf2b5sZWlzD61uaV8+1X26tfCPrW5Vdkuz7bvMLDZ pza3lO9oLGX2qc2tynZ5tn2ngc0+tbmlfGdjKbNPbW5Vtsuz7SMGNvvU5pbyXYylzD61uVXZ Ls+27zqw2ac2t5TvZixl9qnNrcp2ebZ994HNPrW5pXwPYymzT21uVbbLs+17Dmz2qc0t5XsZ S5l9anOrsl2ebd97YLNPbW4pH2ksZfapza3Kdnm2fZ+BzT61uaV8X2Mps09tbikfZSxl9qnN rcp2ebZ9v4HNPrW5pXx/YymzT21uVbbLs+2jBzb71OaW8gOMpcw+tblV2S7Pth84sNmnNreU jzGWMvvU5lZluzzbftDAZp/a3FJ+sLGU2ac2tyrb5dn2QwY2+9TmlvKxxlJmn9rcqmyXZ9vH DWz2qc0t5YcaS5l9anOrsl2ebW8e2OxTm1vKxxtLmX1qc0v5YcZSZp/a3Kpsl2fbDx/Y7FOb W8qPMJYy+9TmVmW7PNt+5MBmn9rcUn6UsZTZpza3Ktvl2fYJA5t9anNL+URjKbNPbW5Vtsuz 7UcPbPapzS3lxxhLmX1qc6uyXZ5tP3Zgs09tbik/zljK7FObW5Xt8mz78QObfWpzS/kJxlJm n9rcqmyXZ9tPVP708qO02ac2t5SftMpe/VrYpza3Ktvl2faTBzb71OaW8lOMpcw+tbmlfJKx lNmnNrcq2+XZ9lMHNvvU5pby04ylzD61uVXZLs+2nz6w2ac2t5RPNpYy+9TmVmW7PNs+ZWCz T21uKT/DWMrsU5tble3ybPuZA5t9anNL+VnGUmaf2tyqbJdn288e2OxTm1vKzzGWMvvU5lZl uzzbfu7AZp/a3FJ+nrGU2ac2tyrb5dn28wc2+9TmlvILjKXMPrW5Vdkuz7ZPHdjsU5tbyi80 ljL71OaW8mnGUmaf2tyqbJdn2y8a2OxTm1vKpxtLmX1qc6uyXZ5tv3hgs09tbim/xFjK7FOb W5Xt8mz7jIHNPrW5pfxSYymzT21uVbbLs+2XDWz2qc0t5ZcbS5l9anOrsl2ebb9iYLNPbW4p v9JYyuxTm1uV7fJs+1UDm31qc0v51cZSZp/a3Kpsl2fbrxnY7FObW8qvNZYy+9TmVmW7PNt+ 3cBmn9rcUn69sZTZpza3zvv/tftTljL71OZWZbs8237jwGaf2txSfpOxlNmnNrcq2+XZ9psH NvvU5pbyW4ylzD61uVXZLs+23zqw2ac2t5TPNJYy+9TmVmW7PNt+28Bmn9rcUn67sZTZpza3 tuRPLT+2srbklX6KvbKl/A+Vjcw+tbml/I/GUmaf2tyqbJdn2+8Y2OxTm1vK/2QsZfapza3K dnm2/c6BzT61uaX8LmMps09tbimfZSxl9qnNrcp2ebb97oHNPrW5pfweYymzT21uVbbLs+33 Dmz2qc0t5fcZS5l9anOrsl2ebb9/YLNPbW4pf8BYyuxTm1uV7fJs++yBzT61uaX8QWMps09t blW2y7PtDw1s9qnNLeUPG0uZfWpzq7Jdnm1/ZGCzT21uKX/UWMrsU5tble3ybPtjA5t9anNL +ePGUmaf2tyqbJdn258Y2OxTm1vKnzSWMvvU5pbyp4ylzD61uVXZLs+2Pz2w2ac2t5Q/Yyxl 9qnNrcp2ebb92YHNPrW5pfw5YymzT21uVbbLs+3PD2z2qc0t5S8YS5l9anOrsl2ebf/zwGaf 2txS/hdjKbNPbW5Vtsuz7S8ObPapzS3lfzWWMvvU5lZluzzb/reBzT61uaX8JWMps09tblW2 y7PtLw9s9qnNLeV/N5Yy+9TmVmW7PNv+ysBmn9rcUv4PYymzT21uKX/VWMrsU5tble3ybPtr A5t9anNL+T+Npcw+tblV2S7Ptr8+sNmnNreUv2EsZfapza3Kdnm2/V8Dm31qc0v5m8qfXH5s ZSmzT21uVbbLs+1zBjb71OaW8reMpcw+tblV2S7Ptr89sNmnNreUv2MsZfapza3Kdnm2/d2B zT61uaX8PWMps09tblW2y7Pt7w9s9qnNLeUfGEuZfWpzq7Jdnm3/cGCzT21uKf/IWMrsU5tb yj82ljL71OZWZbs82/7JwGaf2txS/m9jKbNPbW5Vtsuz7Z8ObPapzS3lnxlLmX1qc6uyXZ5t /3xgs09tbin/j7GU2ac2tyrb5dn2LwY2+9TmlvIvjaXMPrW5Vdkuz7Z/NbDZpza3lH9tLGX2 qc2tynZ5tv2bgc0+tbml/FtjKbNPbW5Vtsuz7d8NbPapzS3l3xtLmX1qc6uyXZ5t/2Fgs09t bikvbfjTljL71OaW8rpV9urXwj61uVXZLs+2txnY7FObW8rbGkuZfWpzq7Jdnm2fb2CzT21u KW9nLGX2qc2tynZ5tr39wGaf2txSXm8sZfapza3Kdnm2vWFgs09tbilvNJYy+9TmVmW7PNve YWCzT21uKe9oLGX2qc2tynZ5tn3+gc0+tbmlfAFjKbNPbW5Vtsuz7b8Y2OxTm1vKFzSWMvvU 5pbyTsZSZp/a3Kpsl2fbfzmw2ac2t5T/yljK7FObW5Xt8mz7QgObfWpzS3ln5U8sP7aylNmn Nrcq2+XZ9l8PbPapzS3lCxtLmX1qc6uyXZ5tX2Rgs09tbinvYixl9qnNrcp2eba968Bmn9rc Ur6osZTZpza3Ktvl2fZuA5t9anNL+WLGUmaf2tyqbJdn2xcf2OxTm1vKlzCWMvvU5lZluzzb 3jSw2ac2t5R3N5Yy+9TmlvIexlJmn9rcqmyXZ9t7Dmz2qc0t5b2Mpcw+tblV2S7Ptv9mYLNP bW4pX9JYyuxTm1uV7fJs+1IDm31qc0v5b42lzD61uVXZLs+29x7Y7FObW8r7GEuZfWpzq7Jd nm1femCzT21uKf+dsZTZpza3Ktvl2fZlBjb71OaW8t8bS5l9anOrsl2ebV92YLNPbW4pX85Y yuxTm1uV7fJs+/IDm31qc0v5CsZSZp/a3FK+orGU2ac2tyrb5dn2lQY2+9TmlvK+xlJmn9rc qmyXZ9tXHtjsU5tbyvsZS5l9anOrsl2ebV9lYLNPbW4pX9VYyuxTm1uV7fJs+2oDm31qc0v5 6sZSZp/a3Kpsl2fb1xjY7FObW8rXNJYy+9TmVmW7PNvef2CzT21uKV/LWMrsU5tble3ybPva A5t9anNL+QBjKbNPbW5Vtsuz7esMbPapzS3l6yp/fPmxlaXMPrW5pXzgKnv1a2Gf2tyqbJdn 29cb2OxTm1vK1zeWMvvU5lZluzzbPmhgs09tbikfbCxl9qnNrcp2ebZ9g4HNPrW5pXyIsZTZ pza3Ktvl2fYNBzb71OaW8o2Mpcw+tblV2S7Ptm88sNmnNreUb2IsZfapza3Kdnm2fdOBzT61 uaV8qLGU2ac2tyrb5dn2zQY2+9TmlvLNjaXMPrW5Vdkuz7ZvMbDZpza3lG9pLGX2qc0t5VsZ S5l9anOrsl2ebd96YLNPbW4p38ZYyuxTm1uV7fJs+7YDm31qc0v5MGMps09tblW2y7Ptwwc2 +9TmlvLtjKXMPrW5Vdkuz7ZvP7DZpza3lO9gLGX2qc2tynZ5tn3Hgc0+tbmlfCdjKbNPbW5V tsuz7TsPbPapzS3lI4ylzD61uVXZLs+27zKw2ac2t5Tvaixl9qnNLeW7GUuZfWpzq7Jdnm3f fWCzT21uKd/DWMrsU5tble3ybPueA5t9anNL+V7GUmaf2tyqbJdn2/ce2OxTm1vKRxpLmX1q c6uyXZ5t32dgs09tbinf11jK7FObW5Xt8mz7qIHNPrW5pXw/YymzT21uVbbLs+37D2z2qc0t 5aONpcw+tblV2S7Pth+g/LHlR2mzT21uKT9wlb36tbBPbW5Vtsuz7WMGNvvU5pbyg4ylzD61 uaX8YGMps09tblW2y7Pthwxs9qnNLeVjjaXMPrW5Vdkuz7aPG9jsU5tbyg81ljL71OZWZbs8 2948sNmnNreUjzeWMvvU5lZluzzbftjAZp/a3FJ+uLGU2ac2tyrb5dn2IwY2+9TmlvIjjaXM PrW5Vdkuz7YfNbDZpza3lE8wljL71OZWZbs82z5xYLNPbW4pP9pYyuxTm1uV7fJs+zEDm31q c0v5scZSZp/a3FJ+nLGU2ac2tyrb5dn24wc2+9TmlvITjKXMPrW5Vdkuz7afOLDZpza3lJ9k LGX2qc2tynZ5tv3kgc0+tbml/BRjKbNPbW5Vtsuz7ZMGNvvU5pbyU42lzD61uVXZLs+2nzaw 2ac2t5Sfbixl9qnNrcp2ebZ98sBmn9rcUj7FWMrsU5tble3ybPsZA5t9anNL+ZnGUmaf2tyq bJdn288a2OxTm1vKzzaWMvvU5pbyc4ylzD61uVXZLs+2nzuw2ac2t5SfZyxl9qnNrcp2ebb9 /IHNPrW5pfwCYymzT21uVbbLs+1TBzb71OaW8guNpcw+tblV2S7Ptk8b2OxTm1vKLzKWMvvU 5taW/NHlx1bWlrzST7FXtpRPr2xk9qnNLeUXG0uZfWpzq7Jdnm2/ZGCzT21uKZ9hLGX2qc2t ynZ5tv3Sgc0+tbml/DJjKbNPbW4pv9xYyuxTm1uV7fJs+xUDm31qc0v5lcZSZp/a3Kpsl2fb rxrY7FObW8qvNpYy+9TmVmW7PNt+zcBmn9rcUn6tsZTZpza3Ktvl2fbrBjb71OaW8uuNpcw+ tblV2S7Ptt8wsNmnNreU32gsZfapza3Kdnm2/aaBzT61uaX8ZmMps09tblW2y7Pttwxs9qnN LeW3GkuZfWpzq7Jdnm2fObDZpza3lN9mLGX2qc0t5bcbS5l9anOrsl2ebf/DwGaf2txS/kdj KbNPbW5Vtsuz7XcMbPapzS3lfzKWMvvU5lZluzzbfufAZp/a3FJ+l7GU2ac2tyrb5dn2WQOb fWpzS/ndxlJmn9rcqmyXZ9vvGdjsU5tbyu81ljL71OZWZbs8237fwGaf2txSfr+xlNmnNrcq 2+XZ9gcGNvvU5pby2cZSZp/a3Kpsl2fbHxzY7FObW8ofMpYy+9TmlvKHjaXMPrW5Vdkuz7Y/ MrDZpza3lD9qLGX2qc2tynZ5tv2xgc0+tbml/HFjKbNPbW5Vtsuz7U8MbPapzS3lTyp/ZPmx laXMPrW5Vdkuz7Y/NbDZpza3lD9tLGX2qc2tynZ5tv2Zgc0+tbml/FljKbNPbW5Vtsuz7c8N bPapzS3lzxtLmX1qc6uyXZ5tf2Fgs09tbin/s7GU2ac2tyrb5dn2vwxs9qnNLeUvGkuZfWpz S/lfjaXMPrW5Vdkuz7b/bWCzT21uKX/JWMrsU5tble3ybPvLA5t9anNL+d+Npcw+tblV2S7P tr8ysNmnNreU/8NYyuxTm1uV7fJs+6sDm31qc0v5a8ZSZp/a3Kpsl2fb/zmw2ac2t5S/bixl 9qnNrcp2ebb9jYHNPrW5pfxfxlJmn9rcqmyXZ9vfHNjsU5tbyucYS5l9anOrsl2ebX9rYLNP bW4pf9tYyuxTm1vK3zGWMvvU5lZluzzb/u7AZp/a3FL+nrGU2ac2tyrb5dn29wc2+9TmlvIP jKXMPrW5Vdkuz7Z/OLDZpza3lH9kLGX2qc2tynZ5tv3jgc0+tbml/BNjKbNPbW5Vtsuz7f8e 2OxTm1vKPzWWMvvU5lZluzzb/tnAZp/a3FL+ubGU2ac2tyrb5dn2/wxs9qnNLeVfGEuZfWpz S/mXxlJmn9rcqmyXZ9u/GtjsU5tbyr82ljL71OZWZbs82/7NwGaf2txS/q2xlNmnNrcq2+XZ 9u8GNvvU5pby742lzD61uVXZLs+2/zCw2ac2t5SXNv5pS5l9anOrsl2eba9T/vDyo7TZpza3 lLdZZa9+LexTm1uV7fJse9uBzT61uaV8PmMps09tblW2y7Pt7QY2+9TmlvL2xlJmn9rcqmyX Z9vrBzb71OaW8gZjKbNPbW4pbzSWMvvU5lZluzzb3mFgs09tbinvaCxl9qnNrcp2ebZ9/oHN PrW5pXwBYymzT21uVbbLs+2/GNjsU5tbyhc0ljL71OZWZbs8295pYLNPbW4p/6WxlNmnNrcq 2+XZ9l8NbPapzS3lCxlLmX1qc6uyXZ5t7zyw2ac2t5T/2ljK7FObW5Xt8mz7wgObfWpzS/ki xlJmn9rcqmyXZ9u7DGz2qc0t5V2Npcw+tbmlfFFjKbNPbW5Vtsuz7d0GNvvU5pbyxYylzD61 uVXZLs+2Lz6w2ac2t5QvYSxl9qnNrcp2eba9aWCzT21uKe9uLGX2qc2tynZ5tr3HwGaf2txS 3tNYyuxTm1uV7fJse6+BzT61uaX8N8ZSZp/a3Kpsl2fblxzY7FObW8qXMpYy+9TmVmW7PNv+ 24HNPrW5pby3sZTZpza3Ktvl2fY+A5t9anNL+dLGUmaf2txS/jtjKbNPbW5Vtsuz7csMbPap zS3lvzeWMvvU5lZluzzbvuzAZp/a3FK+nLGU2ac2tyrb5dn25Qc2+9TmlvIVjKXMPrW5Vdku z7avOLDZpza3lK9kLGX2qc2tynZ5tr3vwGaf2txSvrKxlNmnNrcq2+XZ9n4Dm31qc0v5KsZS Zp/a3Kpsl2fbVx3Y7FObW8pXM5Yy+9TmVmW7PNu++sBmn9rcUr6G8oeWH1tZyuxTm1vK11xl r34t7FObW5Xt8mx7/4HNPrW5pXwtYymzT21uVbbLs+1rD2z2qc0t5QOMpcw+tblV2S7Ptq8z sNmnNreUr2ssZfapza3Kdnm2feDAZp/a3FK+nrGU2ac2tyrb5dn29Qc2+9TmlvJBxlJmn9rc qmyXZ9sHD2z2qc0t5RsYS5l9anOrsl2ebR8ysNmnNreUb2gsZfapzS3lGxlLmX1qc6uyXZ5t 33hgs09tbinfxFjK7FObW5Xt8mz7pgObfWpzS/lQYymzT21uVbbLs+2bDWz2qc0t5ZsbS5l9 anOrsl2ebd9iYLNPbW4p39JYyuxTm1uV7fJs+1YDm31qc0v51sZSZp/a3Kpsl2fbtxnY7FOb W8q3NZYy+9TmVmW7PNs+bGCzT21uKR9uLGX2qc2tynZ5tn27gc0+tbmlfHtjKbNPbW4p38FY yuxTm1uV7fJs+44Dm31qc0v5TsZSZp/a3Kpsl2fbdx7Y7FObW8pHGEuZfWpzq7Jdnm3fZWCz T21uKd/VWMrsU5tble3ybPtuA5t9anNL+e7GUmaf2tyqbJdn2/cY2OxTm1vK9zSWMvvU5lZl uzzbvtfAZp/a3FK+t7GU2ac2tyrb5dn2kQObfWpzS/k+xlJmn9rcqmyXZ9v3HdjsU5tbykcZ S5l9anNL+X7GUmaf2tyqbJdn2/cf2OxTm1vKRxtLmX1qc6uyXZ5tP2Bgs09tbik/0FjK7FOb W5Xt8mz7mIHNPrW5pfwgYymzT21uVbbLs+0HD2z2qc0t5YcYS5l9anNrS/7g8mMra0te6afY K1vKx1Y2MvvU5pbyccZSZp/a3Kpsl2fbDx3Y7FObW8qbjaXMPrW5Vdkuz7aPH9jsU5tbyg8z ljL71OZWZbs82374wGaf2txSfoSxlNmnNreUH2ksZfapza3Kdnm2/aiBzT61uaV8grGU2ac2 tyrb5dn2iQObfWpzS/nRxlJmn9rcqmyXZ9uPGdjsU5tbyo81ljL71OZWZbs8237cwGaf2txS fryxlNmnNrcq2+XZ9hMGNvvU5pbyE42lzD61uVXZLs+2nzSw2ac2t5SfbCxl9qnNrcp2ebb9 lIHNPrW5pXySsZTZpza3lJ9qLGX2qc2tynZ5tv20gc0+tbml/HRjKbNPbW5Vtsuz7ZMHNvvU 5pbyKcZSZp/a3Kpsl2fbzxjY7FObW8rPNJYy+9TmVmW7PNt+1sBmn9rcUn62sZTZpza3Ktvl 2fZzBjb71OaW8nONpcw+tblV2S7Ptp83sNmnNreUn28sZfapza3Kdnm2/YKBzT61uaV8qrGU 2ac2tyrb5dn2Cwc2+9TmlvJpxlJmn9rcUn6RsZTZpza3Ktvl2fbpA5t9anNL+cXGUmaf2tyq bJdn2y8Z2OxTm1vKZxhLmX1qc6uyXZ5tv3Rgs09tbim/zFjK7FObW5Xt8mz75QObfWpzS/kV xlJmn9rcqmyXZ9uvHNjsU5tbyq8yljL71OZWZbs82371wGaf2txSfo2xlNmnNrcq2+XZ9msH NvvU5pby64ylzD61uVXZLs+2Xz+w2ac2t5TfYCxl9qnNLeU3GkuZfWpza0s+e/mxlbUlr/RT 7JUt5TdVNjL71OaW8puNpcw+tblV2S7Ptt8ysNmnNreU32osZfapza3Kdnm2febAZp/a3FJ+ m7GU2ac2tyrb5dn22wc2+9TmlvI/GEuZfWpzq7Jdnm3/48Bmn9rcUn6HsZTZpza3Ktvl2fY/ DWz2qc0t5XcaS5l9anOrsl2ebb9rYLNPbW4pn2UsZfapza3Kdnm2/e6BzT61uaX8HmMps09t bim/11jK7FObW5Xt8mz7fQObfWpzS/n9xlJmn9rcqmyXZ9sfGNjsU5tbymcbS5l9anOrsl2e bX9wYLNPbW4pf8hYyuxTm1uV7fJs+8MDm31qc0v5I8ZSZp/a3Kpsl2fbHx3Y7FObW8ofM5Yy +9TmVmW7PNv++MBmn9rcUv6EsZTZpza3Ktvl2fYnBzb71OaW8qeMpcw+tblV2S7Ptj89sNmn NreUP2MsZfapzS3lzxpLmX1qc6uyXZ5tf25gs09tbil/3ljK7FObW5Xt8mz7CwObfWpzS/mf jaXMPrW5Vdkuz7b/ZWCzT21uKX/RWMrsU5tble3ybPtfBzb71OaW8r8ZS5l9anOrsl2ebX9p YLNPbW4pf9lYyuxTm1uV7fJs+98HNvvU5pbyV4ylzD61uVXZLs+2/2Ngs09tbil/1VjK7FOb W8pfM5Yy+9TmVmW7PNv+z4HNPrW5pfx1YymzT21uVbbLs+1vDGz2qc0t5f8yljL71OZWZbs8 2/7mwGaf2txSPsdYyuxTm1uV7fJs+1sDm31qc0v528ZSZp/a3Kpsl2fb31H+wPKjtNmnNreU v7vKXv1a2Kc2tyrb5dn29wY2+9TmlvL3jaXMPrW5Vdkuz7Z/MLDZpza3lH9oLGX2qc2tynZ5 tv2jgc0+tbml/GNjKbNPbW4p/8RYyuxTm1uV7fJs+78HNvvU5pbyT42lzD61uVXZLs+2fzaw 2ac2t5R/bixl9qnNrcp2ebb9PwObfWpzS/kXxlJmn9rcqmyXZ9u/HNjsU5tbyr8yljL71OZW Zbs82/71wGaf2txS/o2xlNmnNrcq2+XZ9m8HNvvU5pby74ylzD61uVXZLs+2fz+w2ac2t5T/ YCxl9qnNrcp2eba9tIO32ac2t5TXrbJXvxb2qc0t5W2Mpcw+tblV2S7Ptrcd2OxTm1vK5zOW MvvU5lZluzzb3m5gs09tbilvbyxl9qnNrcp2eba9fmCzT21uKW8wljL71OZWZbs82944sNmn NreUdzCWMvvU5lZluzzb3nFgs09tbimf31jK7FObW5Xt8mz7AgObfWpzS/kvjKXMPrW5Vdku z7YvOLDZpza3lHcyljL71OZWZbs82/7Lgc0+tbml/FfGUmaf2txSvpCxlNmnNrcq2+XZ9s4D m31qc0v5r42lzD61uVXZLs+2Lzyw2ac2t5QvYixl9qnNrcp2eba9y8Bmn9rcUt7VWMrsU5tb le3ybPuiA5t9anNLeTdjKbNPbW5Vtsuz7YsNbPapzS3lixtLmX1qc6uyXZ5tX2Jgs09tbilv MpYy+9TmVmW7PNvefWCzT21uKe9hLGX2qc2tynZ5tr3nwGaf2txS3kv5/cuPrSxl9qnNLeW/ WWWvfi3sU5tble3ybPuSA5t9anNL+VLGUmaf2tyqbJdn2387sNmnNreU9zaWMvvU5lZluzzb 3mdgs09tbilf2ljK7FObW5Xt8mz77wY2+9TmlvJljKXMPrW5Vdkuz7b/fmCzT21uKV/WWMrs U5tble3ybPtyA5t9anNL+fLGUmaf2tyqbJdn21cY2OxTm1vKVzSWMvvU5pbylYylzD61uVXZ Ls+29x3Y7FObW8pXNpYy+9TmVmW7PNveb2CzT21uKV/FWMrsU5tble3ybPuqA5t9anNL+WrG Umaf2tyqbJdn21cf2OxTm1vK1zCWMvvU5lZluzzbvubAZp/a3FLe31jK7FObW5Xt8mz7WgOb fWpzS/naxlJmn9rcqmyXZ9sHDGz2qc0t5esYS5l9anOrsl2ebV93YLNPbW4pH2gsZfapzS3l 6xlLmX1qc6uyXZ5tX39gs09tbikfZCxl9qnNrcp2ebZ98MBmn9rcUr6BsZTZpza3Ktvl2fYh A5t9anNL+YbGUmaf2tyqbJdn2zca2OxTm1vKNzaWMvvU5lZluzzbvsnAZp/a3FK+qbGU2ac2 tyrb5dn2oQObfWpzS/lmxlJmn9rcqmyXZ9s3H9jsU5tbyrcwljL71OZWZbs8277lwGaf2txS vpWxlNmnNreUb20sZfapza3Kdnm2fZuBzT61uaV8W2Mps09tblW2y7PtwwY2+9TmlvLhxlJm n9rcqmyXZ9u3G9jsU5tbyrc3ljL71OZWZbs8277DwGaf2txSvqOxlNmnNre25PctP7aytuSV foq9sqV8p8pGZp/a3FK+s7GU2ac2tyrb5dn2EQObfWpzS/kuxlJmn9rcqmyXZ9t3HdjsU5tb ynczljL71OZWZbs82777wGaf2txSvoexlNmnNreU72ksZfapza3Kdnm2fa+BzT61uaV8b2Mp s09tblW2y7PtIwc2+9TmlvJ9jKXMPrW5Vdkuz7bvO7DZpza3lI8yljL71OZWZbs8277fwGaf 2txSvr+xlNmnNrcq2+XZ9tEDm31qc0v5AcZSZp/a3Kpsl2fbDxzY7FObW8rHGEuZfWpzq7Jd nm0/aGCzT21uKT/YWMrsU5tbyg8xljL71OZWZbs82z52YLNPbW4pH2csZfapza3Kdnm2/dCB zT61uaW82VjK7FObW5Xt8mz7+IHNPrW5pfwwYymzT21uVbbLs+2HD2z2qc0t5UcYS5l9anOr sl2ebT9yYLNPbW4pP8pYyuxTm1uV7fJs+4SBzT61uaV8orGU2ac2tyrb5dn2owc2+9TmlvJj jKXMPrW5Vdkuz7YfO7DZpza3lB9nLGX2qc0t5ccbS5l9anOrsl2ebT9hYLNPbW4pP9FYyuxT m1uV7fJs+0kDm31qc0v5ycZSZp/a3Kpsl2fbTxnY7FObW8onGUuZfWpzq7Jdnm0/dWCzT21u KT/NWMrsU5tble3ybPvpA5t9anNL+WRjKbNPbW5Vtsuz7VMGNvvU5pbyM4ylzD61uVXZLs+2 nzmw2ac2t5SfZSxl9qnNrcp2ebb97IHNPrW5pfwcYymzT21uKT/XWMrsU5tbW/J7lx9bWVvy Sj/FXtlSfl5lI7NPbW4pP99YyuxTm1uV7fJs+wUDm31qc0v5VGMps09tblW2y7PtFw5s9qnN LeXTjKXMPrW5Vdkuz7ZfNLDZpza3lE83ljL71OZWZbs8237xwGaf2txSfomxlNmnNrcq2+XZ 9hkDm31qc0v5pcZSZp/a3Kpsl2fbLxvY7FObW8ovN5Yy+9TmVmW7PNt+xcBmn9rcUn6lsZTZ pza3lF9lLGX2qc2tynZ5tv3qgc0+tbml/BpjKbNPbW5Vtsuz7dcObPapzS3l1xlLmX1qc6uy XZ5tv35gs09tbim/wVjK7FObW5Xt8mz7jQObfWpzS/lNxlJmn9rcqmyXZ9tvHtjsU5tbym8x ljL71OZWZbs8237rwGaf2txSPtNYyuz/lL3n4nn+FXOPxccNi+c1Vj7utnjutGLvvH5p6fDF 53sXr1NbJ+218/qT9jpzh2M3nbnD/it//zVXPh64Yqz2VjvnnZzL/In349w7Z9NB++i5tbFd 8fpPXzxPG+yevvgZpy8dtOlVe+t5Wrl7yZXP9f6tNpa/x628R7sXhr72k/Z6w/rDFh/3Lfrt l/vzbThjz0M2nLjHIRuO2P2QDcduOt/i+Yb1572WAxbPXfS+bqv/qf3S0nsWH7+N17XgT3Cv cfn79OA1ynOv8dhNh68/Yved15+4x87rz9hTv+aHr9fX5b/uXXfwX/fRO5yx55k7nLjHmTsc sbt+Dx29eO66w+h1rv59xvfnLSvvzz7r/vj9+XP9ntus/37xBr+7edPxGzZv+tHGU/bS8/gN f87dYxbPJx64zdLBi/fo64vP37r4uH7d/93faTF0P73RS8tv98qdcO3q8wW7/PGolV/jFy+e 377uNkvXX3euo+8Z532+bvErqu8X6re+P5z3V19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX9+f9a6xeG5YPHdbPHfCjx++eF4G+Q8rd74tP3LOpoP20XNp6ZorGwcunudfPLcr djdvWlo6foPf3bzp+A2bN/1o4yl76Xn8hmr3wiuf77J4XnLl83WL561WnnfZdmnpG4uP9118 /NlKt8dh+xzwlNvtc8D9dl9a2n7juT9241Xvw3mv42aLz2+xeB6B/QssLZ1QWUeuWA8urHes 0Tp08bzPGqwHrViPKKxd91ibdes1fl0PX7EeV1jHrtHSzm3WYD12xXpiYZ21RuuQxfNSa7Bk yHpGYX1tjdZN1/geypB1WmEdsOfarIPX+Hvj1BXr9MJ6/hqtjcV7+P/b94Y7Lt6fny8+3mvx cft1f/w+HbL45/Uda3ifrrfGX38Zsh5YWC9do3WdNVpHr1gPLayfrtFa6z+vx61YJxbW/nvM /boetWI9qbCeukbrumu0nrBinVJYX5n8dZ28Yj2/sC6/59qsW67x1+u5K9aLC+sBa7SuX1j/ L39v2Bvvk/6sf8DK+3KPxR7fh3dts/xh3frdl/Y8cOkuS0ctHbl016VjFv+5++L9OnLpXkv3 Xnrwmv9NS8LS0uV3u/SJS49at7TtCefmGygfvG7dAYvPD1h8fu/dFz++6A772O/eo59xg8XH b3/0d++54G67rNPfqx/75SLf+JhbbfOmX+10ojY2LH7Orud/43ZH7LvTiSff8subd1nkmxz6 lu20cdWldd/be/FxaelNW/JDFx9ft+Hty/kzh7/oBG3o7z/5bY8/Yb/t3663649etXaXlr64 +dxXvLi3f3HzCb/Q5tLS+z79+u2et9g57mNv3U4/vuXn4D6y6O9+7PIvSfl9+UUrf26dUfwe fccaf4/+b/75NXv3QniPzjMuu/iCzt7xXOOqhbF++eecveM5G8/c6ZyNT77wsZv0PHOny17s 7B314/uves2n699NVl7z5Ys9vZ7TFz/j9L313H/T6Ut6nrZ03s7q16/X2u/L2t6Xsxa/WU9d ec1/6n05a+OpO5618ccX/tImPU/dsd/v//33+5jF83nH7be03SLst3geuvh+ddfFnxEfWuy/ bLG/cfGHzAE7Li/j2+AJ164+X7DLH49aPPfVn8/6vn7sfkuXXnzBL93m3D+jzvt83eLPm21X +q3vD+f91dfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX1/d/2Luz HlvKMgzDCxmVeUZgMwSQyQHEICigzIgIKJMKho2I//8n+N7pqlDpEA56tSZWX09yHe5eleyz O1/VZ2ZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZnb2dUc5AAAAAED+ 113yBxtXnnIVAAAAAHAhbLvgthn+t7rltk+uLfLqxTXj2lOuAwAAAAB263QPrBHWCrf98rx7 5fb85Non1xb5w/Gjcf24YdwIAAAAAFwYNcHaYI2wVrg2zLVZbs9Xnsc5yvUMZV203+p3e4ab xi3j1nHbuH3cAQAAAADsXi2wJlgbrBHWCmuGtcMaYi1xPVt57LnK9SzltlHWR/vNnqHnuXvc M+4d9437F5cAAAAAgN1Z+18tsCZYG6wR1gprlrXDGuK2VR57pnI9S9k5zbVR3ry00n67Z3lg PDweGY8tfgIAAAAA7NbaAWuCtcEaYa2wZlg7rCGurbK2uJ6pPOvWs5S9U955zVpov/Pj5bd7 jsfHU+Nn4xfjmfEsAAAAALBbNcBaYE3w6aUR1gprhrXDzlbWKmuKtcX1TOUx73zXO/sGZt/F 7F3vznE+uPTSnqFn+tV4YfxmvDReBgAAAAB2qwZYC6wJ1gZrhLXCmmHtsIZYS6wp1hZrjGd9 93t957t3yOue9c87Dyfvnj86fjqeW56lZ3t1vDHeWrwNAAAAAOzO2v9qgTXB2mCNsFZYM6wd 1hBrieuZyhrjWd/9Xjtl5zJ7l7xvYNZBHxpPLOc7Xxy/G2+OP4z3xvvjAwAAAABgt2qAtcCa YG2wRlgrrBnWDmuItcSaYm2xxnhMp1y/Tdl94n2Xsvt7es+8Lvr8eGV5jj8uz/fR+GR8CgAA AADsVg2wFvjh0gZrhLXCmmHtsIZYS6wp1hbXb1Qe0ym7k6f3yPv2Zec1e8e8b2TWR18b7y7P 07P9bXw+vgAAAAAAdqsGWAusCdYGa4S1wpph7bCGWEusKdYWa4xn7ZTrXd/9je757n3yS4eT u3s6v9m3MuukfxofL8/1j/Hl+AoAAAAA2K0aYC2wJlgbrBHWCmuGtcMaYi2xplhbXDvlWe78 Xjtl9/H0t+46nNwr3vvlfROzc5x9N7Ne2lnPOurl8c/x9fgXAAAAALA7tb8aYC2wJlgbrBHW CmuGtcMaYi2xplhbrDGeR6fsXp5tp+yu8b6N+c748/jr0k9rqT3rNwAAAADAbtUAa4E1wdpg jbA7dWqGtcMnx4NLU6wtnnen7G/3G2un7Le3nbKO2jP+GwAAAADYrRpgLVCnBAAAAAB0Sp0S AAAAAHRKnRIAAAAA0Cl1SgAAAADQKXVKAAAAAECn1CkBAAAAQKfUKQEAAAAAnVKnBAAAAACd UqcEAAAAAHRKnRIAAAAAdEqdEgAAAADQKXVKAAAAANApdUoAAAAAQKfUKQEAAABAp9QpAQAA AACdUqcEAAAAAJ1SpwQAAAAAdEqdEgAAAAB0Sp0SAAAAANApdUoAAAAA0Cl1SgAAAABAp9Qp AQAAAECn1CkBAAAAAJ1SpwQAAAAAnVKnBAAAAAB0Sp0SAAAAAHRKnRIAAAAA0Cl1SgAAAADQ KXVKAAAAAECn9P8EAAAAADqlTgkAAAAA6JT+rwAAAABAp9QpAQAAAACdEgAAAADQKXVKAAAA AECnBAAAAAB0Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn1CkBAAAAAJ0SAAAAANAp dUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIA AAAA0Cl1SgAAAABApwQAAAAAdEqdEgAAAADQKQEAAAAAnVKnBAAAAAB0SgAAAABAp9QpAQAA AACdEgAAAADQKXVKAAAAAECnBAAAAAB0Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn 1CkBAAAAAJ0SAAAAANApdUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoA AAAAQKfUKQEAAAAAnRIAAAAA0Cl1SgAAAABApwQAAAAAdEqdEgAAAADQKQEAAAAAnVKnBAAA AAB0SgAAAABAp9QpAQAAAACdEgAAAADQKXVKAAAAAECnBAAAAAB0Sp0SAAAAANApAQAAAACd UqcEAAAAAHRKAAAAAECn1CkBAAAAAJ0SAAAAANApdUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkB AAAAAJ1SpwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIAAAAA0Cl1SgAAAABApwQAAAAAdEqdEgAA AADQKQEAAAAAnVKnBAAAAAB0SgAAAABAp9QpAQAAAACdEgAAAADQKXVKAAAAAECnBAAAAAB0 Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn1CkBAAAAAJ0SAAAAANApdUoAAAAAQKcE AAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIAAAAA0Cl1SgAA AADQKXVKAAAAAECn1CkBAAAAQKfUKQEAAAAAnVKnBAAAAACdUqcEAAAAAHRKnRIAAAAAdEqd EgAAAADQKXVKAAAAANApdUoAAAAAQKfUKQEAAABAp9QpAQAAAACdUqcEAAAAAJ1SpwQAAAAA dEqdEgAAAAB0Sp0SAAAAANApdUoAAAAA0Cl1SgAAAABAp9QpAQAAAECn1CkBAAAAAJ1SpwQA AAAAnVKnBAAAAAB0Sp0SAAAAAHRKnRIAAAAA0Cl1SgAAAADQKXVKAAAAAECn1CkBAAAAQKfU KQEAAAAAnVKnBAAAAACdUqcEAAAAAHRKnRIAAAAAdEqdEgAAAADQKXVKAAAAANApdUoAAAAA QKfUKQEAAABAp9QpAQAAAACd0v8TAAAAAOiUOiUAAAAAoFP6vwIAAAAAnVKnBAAAAAB0SgAA AABAp9QpAQAAAACdEgAAAADQKXVKAAAAAECnBAAAAAB0Sp0SAAAAANApAQAAAACdUqcEAAAA AHRKAAAAAECn1CkBAAAAAJ0SAAAAANApdUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1S pwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIAAAAA0Cl1SgAAAABApwQAAAAAdEqdEgAAAADQKQEA AAAAnVKnBAAAAAB0SgAAAABAp9QpAQAAAACdEgAAAADQKXVKAAAAAECnBAAAAAB0Sp0SAAAA ANApAQAAAACdUqcEAAAAAHRKAAAAAECn1CkBAAAAAJ0SAAAAANApdUoAAAAAQKcEAAAAAHRK nRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIAAAAA0Cl1SgAAAABApwQA AAAAdEqdEgAAAADQKQEAAAAAnVKnBAAAAAB0SgAAAABAp9QpAQAAAACdEgAAAADQKXVKAAAA AECnBAAAAAB0Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn1CkBAAAAAJ0SAAAAANAp dUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIA AAAA0Cl1SgAAAABApwQAAAAAdEqdEgAAAADQKQEAAAAAnVKnBAAAAAB0SgAAAABAp9QpAQAA AACdEgAAAADQKXVKAAAAAECnBAAAAAB0Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn 1CkBAAAAAJ0SAAAAANApdUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoA AAAAQKfUKQEAAABAp9QpAQAAAACdUqcEAAAAAJ1SpwQAAAAAdEqdEgAAAAB0Sp0SAAAAANAp dUoAAAAA0Cl1SgAAAABAp9QpAQAAAECn1CkBAAAAAJ1SpwQAAAAAnVKnBAAAAAB0Sp0SAAAA AHRKnRIAAAAA0Cl1SgAAAADQKXVKAAAAAECn1CkBAAAAQKfUKQEAAAAAnVKnBAAAAACdUqcE AAAAAHRKnRIAAAAAdEqdEgAAAADQKXVKAAAAANApdUoAAAAAQKfUKQEAAABAp9QpAQAAAACd UqcEAAAAAJ1SpwQAAAAAdEqdEgAAAAB0Sp0SAAAAANApdUoAAAAA0Cl1SgAAAABAp9QpAQAA AECn1CkBAAAAAJ1SpwQAAAAAnVKnBAAAAAB0Sv9PAAAAAKBT6pQAAAAAgE7p/woAAAAAdEqd EgAAAADQKQEAAAAAnVKnBAAAAAB0SgAAAABAp9QpAQAAAACdEgAAAADQKXVKAAAAAECnBAAA AAB0Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn1CkBAAAAAJ0SAAAAANApdUoAAAAA QKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoAAAAAQKfUKQEAAAAAnRIAAAAA0Cl1 SgAAAABApwQAAAAAdEqdEgAAAADQKQEAAAAAnVKnBAAAAAB0SgAAAABAp9QpAQAAAACdEgAA AADQKXVKAAAAAECnBAAAAAB0Sp0SAAAAANApAQAAAACdUqcEAAAAAHRKAAAAAECn1CkBAAAA AJ0SAAAAANApdUoAAAAAQKcEAAAAAHRKnRIAAAAA0CkBAAAAAJ1SpwQAAAAAdEoAAAAAQKfU KQEAAACA/6dO+cB44ns65Vc6JQAAAABciE5ZC/y+TllLPO9OedOpTvnceGW8o1MCAAAAgE65 tMKaYe2whrh2ytriMZ3yiuXfXrf8rTuXv/34qU754fjsVKf8xv8VAAAAAOxS7W/bKWuDNcJt p6wh1hJrirXFGmOtseZ4TKe8cfmbl5bf+OV4ebw1Phifji/G5fG1TgkAAAAAu+6UNcBaYE2w NlgjfHtphrXDGmIt8Tw75bVLp7x93D8eG8+M3443x/vjk/G5TgkAAAAAF6pT1gRrgzXCWmHN sHZYQ6wl3rG0xRrjMZ3yyuVv3DBuG/eOR8bPx4vj9fHe+Gj8fXx5+PbOb60SAAAAAPb5zncN sBZYE6wN1ghrhTXD2mENsZZYU6wt1hhrjcd0ymvG9ePWcc94eDw9nh+/P3z3nd/1VK0SAAAA APbXKGt/33XXd62wZlg7rCHWEmuKtcUa41k7Zev+nasPJ/fxdH/4XYdv7/zuPfOXDiffqNy+ ++1MJQAAAADs/yzl9p3vGmGtsGa4veu7plhbrDGe5a7vbafc3qXTNyrvG48u5zdfGK+Od8df nKkEAAAAgAt1lrImWBt8bWmFNcPaYQ2xllhTXO/QOaZTnn73+5blvOZD48nDyR3j673f65nK 9TuVWiUAAAAA7K9Rrt+l3J6lrBHWCmuGtcMaYi2xpnjMtym3nXL77nd3iHdHT3f1rGcqf72c qVy/U/nZ4eQ+8svLGVCdEgAA/sPevfzIWtdpAC/nIh4Oajc04OXoAeUuIuJdPIIDchEUBC/g BU38D1yM24kLFybujcawmM2sjJO4mYWLQSaTzJiZySwwcT8mgxv3Jjjvc/r3Di9FVfVb3e9b 76U+T/LJuXZ31dtwKr9vfZ8qAIB59L0z88vsLzPA+nUpMxts7lLW7/OdWWKz832WOWVSd78z 96zfT+f6ysXFq69Tmfcbf3Dx6nt/P1t2P+1UAgAAAMC8+t6Z/dXv8Z2ZYGaD9etSZpcys8P6 /XMyUzxr57u5U5m9zHqnsvk6lXl/8TsrH6l8uvJw5Ymy81m/p45ZJQAAAADMo+9dv3dOZoCZ Bd5XZoOZEWZW2HxdynqX8qyd7+acst6pfGPlysVr3/v7lsoHym5n/Z46+t8AAAAAMN++d/3e OZ8os8HMCJvv8Z0ZYmaJ9S5lF3PK5VlldjWvqly9eO176mS3M+89rv8NAAAAAPPte3++8tky C8xMsPneOel7Z3bYfI/vrmaUzVlls/9dv6dOs//90bLrqf8NAAAAAPPue2cW2Ox7L793Tld9 7007lXX/+6Dscjb739n1zM6n/jcAAAAATG9Gedq+d2aFffW9N80qs7u5qf+d3c/sgOp/AwAA AMC0+95fKrO+dX3vzAj77nuvmlXqfwMAAACAvvcu+96bdir1vwEAAABgXnPKMfe9N80q2/a/ sxuq/w0AAAAA0+17f6jM/jIDfHuZCe66771qVqn/DQAAAADz7Ht/pcz0HikzvrH0vTftVOp/ AwAAAMC8+953l5nfGPrem2aV6/rf2QXV/wYAAACA6fe9b1yMp++9albZtv+dHVH9bwAAAADQ 9+5zp3Jd/zs7ofrfAAAAADCPvvf5Mgscyy7lqllls/+dHdDsgup/AwAAAMB4dymfK7O6p8vs bkp971Wzym3739kh1f8GAAAAgPH2vW8qM76x9r037VTqfwMAAADA9Pvet5bZ3tj73ptmlfrf AAAAADCNvvcU39+7zaxyXf87O6L63wAAAAAwzIwy2vS9319meVPqe2/aqcwOaHZBsxOq/w0A AAAA+t5DzSq37X9n19ROJQAAAAAM0/e+o8zwptr3XjWr3NT/zu5om/53vY/qvycAAAAAOFvf O7uUbfreF8osb4p97007lav639kdzQ6p/jcAAAAA7Lbv/UzlqTKTm2Pfe9OsclX/Ozuk+t8A AAAAoO+9i1nlWfrfmfPqfwMAAABA/33vKb+/9zY7lW3739k5ze6p/jcAAAAA6Hv3MavU/wYA AAAAfe8hZ5Wr+t957yD9bwAAAAAYru89p/f33manUv8bAAAAAPqbUZ62731lmd3NdZdy1axS /xsAAAAAxtf3zi7lnGeUzVml/jcAAAAA9Dej1PfebqdS/xsAAAAAup1TbtP3vr7M5jKju6LM 7PZhl3LVrFL/GwAAAAD0vYecVWaHNDuV+t8AAAAAcPoZ5Vnf3zszun3pe2/aqcxOad3/zq6p /jcAAAAA6HvvelaZnVL9bwAAAADQ9x5yVqn/DQAAAAD63mPYqdT/BgAAAIBu+t6PlVmavvfp ZpX63wAAAACg7z30rFL/GwAAAAD0vcewU9m2/53dVf1vAAAAAPS99b37mlXqfwMAAABAu773 18qMTN+7+1ml/jcAAAAAtO97P1lmZfre3e9U6n8DAAAAgL73GGaV2/a/s+Oq/w0AAADAPva9 L5WZmb5397PKbfrf2W3V/wYAAABgH/ve95dZmb53fzuV+t8AAAAA2KVc3/d+oPLJMivT9+53 VnlS/zs7rfrfAAAAAOh763v3Oats0//Obqv+NwAAAAD71vf+WJmR6XvvZqfypP53dluz46r/ DQAAAIC+t753n7NK/W8AAAAA9L1f7Xt/uMzGmn3vN5cZmr53f7NK/W8AAAAA9L31vcewU6n/ DQAAAMA+9b2/WWZc6/reF8uMLLMyfe/dzirr/nd2WJf739l11f8GAAAAYI5974fK7Evfexyz ypP639l5ze6r/jcAAAAAc+97X1tmZPrew+xUrup/Z8d1U/87O7LZldX/BgAAAEDfW7qaVep/ AwAAALCPfe/3lFmYvvc4ZpXL/e/suG7T/67nlGaVAAAAAAzd9653KfW9p7lTqf8NAAAAwD70 vT9YZl763uOdVa7qf2f3tdn/zm6s/jcAAAAAU+97v6PMwPS9xzer1P8GAAAAYM5977vKrEvf e/w7lfrfAAAAAOh7yxhmlcv97+zA6n8DAAAAoO8tu5xVbup/ZzdW/xsAAAAAfW/ZxU7lpv53 dmT1vwEAAADQ95ZdzCr1vwEAAADQ95ahZ5X63wAAAABMve99c5lpZbb11jLr0vee3k6l/jcA AAAAY92lzAxqU9/7tjLL0veex6xS/xsAAACAqfW931dmWJllXVNmW/re055VNvvf2Y2t+9/Z mdX/BgAAAEDfW3a1U7mu/53d2ZP633YqAQAAAND3lq5mlc3+d3Zl6/53dmj1vwEAAAAYou/9 hTKT0vfen1ml/jcAAAAAY+t7P1pmUuv63leWmZa+97x2KvW/AQAAAND3ljHMKtv2v7Nzq/8N AAAAgL639DGrrPvf2Znd1P/Ozm12b/W/AQAAAND3lj52Kpv978OyS6v/DQAAAMDQfe/MqvS9 92tWqf8NAAAAgL63DD2r1P8GAAAAQN9bxrBTqf8NAAAAgL63jGFWqf8NAAAAgL63DD2r1P8G AAAAQN9bxrBTqf8NAAAAgL63jGFWqf8NAAAAQJd97y+XWZK+t2wzq9T/BgAAAEDfW8awU6n/ DQAAAIC+t4xhVrlN/zu7u/rfAAAAAGaU+t7S9axS/xsAAACA0/S9v1FmRZkZrep7v6vMmvS9 pe1Opf43AAAAAF33vd9WZk363rLNrFL/GwAAAAB9bxl6Vnma/nd2e/W/AQAAAPZjTtnse3+1 zIi26XtnTinSZqdS/xsAAACANn3vp8uMKLOie8vsSN9bupxV6n8DAAAA0Lbv/ekyM9rU9/be OXKaWeWq/nd2ddf1v7Pju6r/7f9lAAAAgHn3vT9T+XiZGel7Sx87lcv97+zqrut/Z8dX/xsA AABgf/rej5fZkL637GKn8qT+d3Z69b8BAAAA9L31vaWvZM7dpv+d3V79bwAAAAB9b31v6Wun sk3/O7u92fHNrq/+NwAAAMD+9b1vKDMjfW/pc1ap/w0AAACg763vLUOnTf87O7763wAAAADT n1Hqe8uYdyrX9b9vWOh/AwAAAOh763vL7maV+t8AAAAA+t4fKbMgfW8ZKvrfAAAAAPOfU+p7 yxR2KvW/AQAAAPav7/1gmfncU2ZAmQXpe8vQs8qT+t/Z/dX/BgAAAND3Fukz+t8AAAAA+t76 3jKGncqT+t/ZAc4ucHaC9b8BAAAAptP3frbMcvS9ZSqzSv1vAAAAAH1vfW8ZOvrfAAAAAPPr e3+xzHK26XubU8rQO5Wn6X9nd1j/GwAAAEDfW6TLWaX+NwAAAMB8+t4Pl1nOur73uTIL0veW Me5UbtP/zu6w/jcAAADAuPveHyizHX1vmdqsUv8bAAAAQN9bZOhZZd3/zu7vpv53dof1vwEA AADG2/e+s/LeMtvR95Yp7lRu6n9nV1j/GwAAAEDfW2QXs0r9bwAAAIDp9r1vL7McfW+Z+qxy Xf87u8LZGdb/BgAAAND3FtnFTqX+NwAAAMD4+96fKzOauu99S5nhXFdmOvreModZ5br+d3aH 9b8BAAAA9L1FdjGr1P8GAAAA0PcWGcNO5br+d3aIm/3v7BjrfwMAAADoe4v0NavU/wYAAACY Tt/7qjLL0feWuc0q9b8BAAAAxt33fmeZ2eh7y9x3Kpf739kh1v8GAAAA6H5G2ex7Z5dS31vk tbPKuv+d3WH9bwAAAAB9b5EhZpX63wAAAAC77Xt/vcxY9L1FXrtTedr+d+b/+t8AAAAAJ88p 9b1F2s0q9b8BAAAA9L1Fhp5Vrup/Z8d4U/87O8r63wAAAADb9b2fKDMWfW+R1TuV+t8AAAAA 3fe9v1VmKKfte4vs46xS/xsAAACg211KfW+R7WeV2/S/s6Os/w0AAACwfkaZXcqvlRmKvrfI djuV+t8AAAAAZ+97Z1ZyUt/73WX20ux726UUOXv/204lAAAAYJdS31ukq1nlafvf2WU2qwQA AAD0vb2/t0iXO5XL/e/sIut/AwAAALTvez9aZij63iJnm1XqfwMAAADoe4sMOavU/wYAAADo p+/9ljJz0fcWab9Tqf8NAAAAsF3f2/t7i/Qzq9T/BgAAAND3FhlyVqn/DQAAALBd3/u+MjNp 9r2PFvreIl3sVOp/AwAAAOh7i4xhVqn/DQAAAJhRbu57f6rMSvS9RfqZVTb739lRzq6y/jcA AACg7/3avvdHy6xE31uk351K/W8AAABA33t13/sTZUbS7HsflFmKvrdI97PKTf3v7DbrfwMA AAD63q/2vd9kRinS+ayyTf87O8763wAAAIC+t763SN87lXX/+2Dx+v53dpz1vwEAAIB96Hv/ TZmF6HuLDDerrPvfVy/0vwEAAID96nt/vvLZMgNZ7ntnVqLvLbKbWeVJ/e/sOut/AwAAAPre ZpQiu9ipPKn/nd1n/W8AAABA31tE+p5VZod5U/87O9DZhdb/BgAAAKbc9/5SmXHoe4uMb1ap /w0AAADoe+t7i4xlp1L/GwAAANinvvfdZfah7y0yvlll2/53dqT1vwEAAICp9r0/VGYeN1be XmYh+t4i45hV6n8DAAAAc+57P1JmG/reItPYqdT/BgAAAPS9RWQMs8pm/zu7zzcsjnehsxOt /w0AAADoe4tI37PKtv3v7EpnZ/orC/1vAAAAYHx978wsVr2/901l1qHvLTKNncp1/e+7F/rf AAAAwDz63ufLDMQupci4Z5XL/e/sROt/AwAAAGPdpXyuzCj0vUXmM6tc1//ObrT+NwAAADCG GWWs63s339/7/WWmoe8tMt2dyuw+Zwf6YKH/DQAAAEyz731rmWnoe4tMe1a5bf87O9Z2KgEA AAB9bxHpalap/w0AAADoe4vIWHYqV/W/szN990L/GwAAABi+7/1UmU3oe4vMf1ap/w0AAABM pe99R5ld6HuLzGtWuan/nR3qNv3vei/bv6sAAADAWfre2aVs0/e+UGYY+t4i89upbNv/zq61 /jcAAADQZ9/7mTKD0PcW2c9Z5ar+d3ap9b8BAAAAfW8R2cWsclX/OzvUbfrfeb5D/xsAAADQ 9xaRrnYqt+l/Zwdb/xsAAADQ9xaRPmaV+t8AAACAvreIDDmr1P8GAAAA9L1FZOg5pf43AAAA MOa+9xVldmGXUmR/ZpX63wAAAMDY+t7ZpTSjFNmfWaX+NwAAADC2vnf6n/reIvs1p6x3KrNL rf8NAAAADNH3vr7MJPS9Rcwqs1Op/w0AAADoe4vIkLPK7FJnp1r/GwAAAND3FpGh5pSr+t/Z udb/BgAAAPS9RWTXs0r9bwAAAEDfW0SGnlXqfwMAAAD63iIy9JxS/xsAAADoqu/9WJkh6HuL yGlnlfrfAAAAgL63iAw9q9T/BgAAAPS9RWToOeU2/e/scOt/AwAAgL63vreI9DWr1P8GAAAA 2vS9v1ZmA/reItLHrFL/GwAAAGjb936yzAj0vUWk6zml/jcAAACwbd/7k2VmoO8tIl3PKrft f2fXW/8bAAAA9q/vfanMCvS9RaSPWeU2/e8nF/rfAAAAsI997/vLjEDfW0T6mlPqfwMAAIA5 5aa+9wMLfW8R2d2s8qT+d3a79b8BAABA31vfW0T6nFW26X/fv9D/BgAAgH3re3+szAb0vUVk F3PKNv3v7Hhn11v/GwAAAPav732xzAoyM9D3FpG+Z5X63wAAAKDvXfe9P1xmAs2+95vL7EDf W0T6nFWe1P/Orvf9C/1vAAAA0Pc2oxSR/uaU+t8AAACwX33vb5azvb63iIxxVln3v7PLvdz/ zs63/jcAAADMr+/9UDnz63uLyFhmlfrfAAAAMM++d71L2bbvfW2ZDeh7i8gQc8p1/e/sem/q f2dX/Nvl3zs7lQAAAKDvLSLSxayyTf87O+H63wAAADCfvvd7ygxA31tExjKrXO5/Z9d7m/53 Pac0qwQAAAB9bxGR084p9b8BAABgP/reHyxnfX1vERnzrHJV/zs74PrfAAAAMK++9zvK2V/f W0TGOKvU/wYAAID59r3vKmd8fW8RGfuc8qT+d3bD9b8BAABA31tEZBezyuX+d3bB9b8BAABA 31tEZJezyk397+yI638DAACAvreISN9zSv1vAAAAmM4uZc7i+t4iMudZpf43AAAA6HuLiAw9 q9T/BgAAgGn3vW8uZ/mc6d9azvj63iIytTml/jcAAABMt+99WznD63uLyFxmlfrfAAAAMK2+ 9/vK2T1n+GvKmV7fW0SmPqts9r+zI173v7M7rv8NAAAAw/e9Hy1nc31vEZnznHJT/zs75Cf1 v+1UAgAAgL63iEhXs8pm/zs743X/O7vk+t8AAACw+773F8pZXN9bRPZpVqn/DQAAANPqe19Z zvL63iIypznlcv/7cKH/DQAAAGPse+fMru8tInOfVbbtf2f3XP8bAAAA9L1FRPqYVdb97+yO b+p/Z/f8yYX+NwAAAOh7i4h0P6fU/wYAAAB9bxGRscwq9b8BAABA31tEZOhZpf43AAAA6HuL iAw9p9T/BgAAAH1vEZGxzCr1vwEAAEDfW0Rk6Fml/jcAAADoe4uIDD2n1P8GAAAAfW8RkbHM KvW/AQAAoLu+95fLGVrfW0Rku1ml/jcAAADoe4uIDD2n1P8GAAAAfW8RkbHMKrfpf2eHXf8b AAAAfW99bxGRrmeV+t8AAACwfd/7G+WMnLPyqr73u8oZW99bRKTdnFL/GwAAAE7X9366nJVX 9b3fVs7Y+t4iItvNKvW/AQAAoL++t11KEZF2s8pV/e/sqG/qf2fHXf8bAACAfZhTNvveXy1n 42363tkREhGRk+eUq/rf2VHX/wYAAMAu5fq+973lzKzvLSLS7axS/xsAAADa9b0/Xc7K+t4i It0mc8pt+9/ZdV/V//aYBgAAwJz73p+pfLyclfW9RUS6Tdv+d3ba6/53dt31vwEAANiXvvfj 5Uzc7HvfUM7O+t4iIt3OKvN8z0n97+y2638DAACg763vLSLSV9r0v7Pbnh13/W8AAAD0vfW9 RUT6yKb+9w2L1/e/s/Ou/w0AAIC+t763iEgfs0r9bwAAAPS99b1FRIaO/jcAAAD63vreIiJD R/8bAAAAfe/F4sFy9r2nnIVzJtb3FhHZ/axS/xsAAIB973t/pJyB9b1FRIaL/jcAAAD63vre IiJDR/8bAAAAfW99bxGRscwqT+p/Zwde/xsAAAB9bxER6TP63wAAAOh7v77vbU4pIrLbtOl/ Zxc+O/HZjdf/BgAAYCp972fLGVbfW0RkOrNK/W8AAAD0vc0oRUSGjv43AAAAc+t7f7GcYfW9 RUSmk9P2v7NDr/8NAACAvreIiHQ5q9T/BgAAYC5974fLGbbue7+3nHHrvve5cgbW9xYRGd+c ctv+d3bo9b8BAAAYc9/7A+VMq+8tIjK9WaX+NwAAAPreIiIy9Kyy7n9nB35T/zs79PrfAAAA jLXvfWc5y+p7i4hMc055Uv87O/P63wAAAIy9731LOcvqe4uITHtWqf8NAADAVPvet5czrL63 iMj0Z5Xr+t95j7Tszut/AwAAMNa+t/f3FhGZz5xS/xsAAIAp9L0/V86my33v68pZVt9bRGQe s8p1/e/s0Ot/AwAAoO8tIiK7mFXqfwMAAKDvLSIiQ88pV/W/szufHfrs0jf739m11/8GAABA 31tERPqaVep/AwAAMJW+91XlDKvvLSIyv1ml/jcAAABj7nu/s5xV9b1FROY9p9T/BgAAYIi+ 97fL2VLfW0REmrPKuv+dHXr9bwAAAPS9RURkiFnlqv53duv1vwEAAOij7/31crbU9xYRkeac 8iz97zwPpv8NAACAvreIiHQ1q9T/BgAAQN9bRESGnlWepv+dXX39bwAAALbpez9Rzpb63iIi smpOqf8NAADAmPredilFRPZ7Vqn/DQAAQJe7lPreIiJymlnlNv3v7OrrfwMAALBuRvmtcmbU 9xYRkW3nlPrfAAAA7Krv/e5y5tT3FhGRdbPK0/a/7VQCAADYpdT3FhGRrmaVp+1/Z6ffrBIA AEDfW99bRES6mFPWO5XL/e/s5Ot/AwAAoO8tIiK7nlXqfwMAAKDvLSIiQ84qu3z/b/NKAACA ec0nl2eUOQu26XsfVd5Szpr63iIi0mZOuU3/+9HKk5WvlMel5mtV1vNKAAAA5qM+7zVfkzJn wpwNV/W931XOlPreIiJyllnlSf3vByqPVZ5aHL8OSb1X+e3ymFXL65UAAAAwXc0zXs589R5l zoI5E+ZsmDOivreIiHQ9q9zU/35f5cOVS5XPLo5ffySvlZzn0PKaJHmsymso5zVKAAAAmI+c 9XLmy9kvZ8CcBXMmzNkwZ8ScFXNmbL6/t763iIicZU65rv+dnf2bK++vfHRx/LojeTzKfn9e iySvm5zXJclzavEMAAAAs1Cf83Lmy9kvZ8DsUeZMmLNhzog5K+bMqO8tIiJ9zCqX+98XF8ev M3JXeRzKc2bZ78/rJecx6gvl8SrPqwEAADAfOevlzJezX86AOQvmTJizYc6IOSvmzKjvLSIi Xc8qV/W/3744fp2RW8vjUN7H7ZOV+8pjVJ5Ly+PVI4vj99oBAABg+nLGy1kvZ76c/XIGzFkw Z8KcDXNGzFkxZ8acHXOG1PcWEZGu5pTL/e+8rkhzVpnnyu6sfHBx/PzZJxbHr5uc59Oy95/H LQAAAKYvZ7yc9T5Vzn45A+YsmDNhzoY5I76jclTOjvreIiLS16wyu/rnF8evL1LPKt+9OH59 5NsWx6+VnOfQ8jiV93f70OL4NZQBAACYvpzxctbLmS9nv5wBcxbMmTBnw3qPMmfGnB31vUVE pI9ZZd3/rmeVeW7s6sXx6yLnPdzymHRj5abF8fNo2ffP49XtAAAAzELOeDnr5cyXs1/OgDkL 5kx4fTkj5qxYzyj1vUVEpI85ZZ7/as4qs7+f1xo5WBw/X5Z5ZZ47y+PThcXxe7vl8SryGsoA AABMV32+y1kvZ76c/XIGzFkwZ8KcDXNGzFmxOaO0SykiIn3PKvMaI3k95DxPVs8r815ueXzK a5FcWx6vAAAAmI+c9XLmy9kvZ8B6PpmzYc6IOSuaUYqIyC5nlXmNkXq3Mo9Fec4sj0tXlceo 7PpHXpcEAACA6avPeTnz5eyXM2DOgjkT1juUOSuaUYqIyK5mlavmlXnOLI9L8aYij1UAAADM R33eq89/9f7k8nzSjFJERIaYV9Yzy3puCQAAwPzV58D6XGg+KSIiY5lZLqsfqwAAAJiHdec/ ERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERER ERERERERERGRU+feypsq76wcNH7/2cqdjV//ueSv/v93fn/xodtjsfhU+RwPVK6q/HXj815T fu8Nja9x15sXixfPH3+Nj6/4Gldc/jsvnv/9uV8e/P7cD6/724vxy4O7Lrx4Pr9/aek2P1/5 WbnNd6/4fLk9z1d/4/nb4tLF5xfxs0X9eZZvf27r8nX51bnF4qflNq+7Lr8699Pzvzr3x+t+ dzF+er7N5+36eg/1fXxwxde4snwf833L9+/4+/jD6/I9PVZ9T/Pnje/pENdsTPet+d/yuvt2 +b/lxUMX/+G2+NnKz3tb+flfVG6tvK38PPnHf//fyz/e3Pg7t1QuVP6y/J18jvrv1n8vf1Zf q3zM8m3/+VH1tQ6Pb/tNK257PubnR7cexvI1ua/cxuWPqb92lb+rf35F4+f5nH3evvpjX2h8 7A0rPjbX64Xq456pfnx8xZ/nNr1wdOHwn46uqT7/NYd/X/lJ9eufVB/zk6N7ql/fW/3+vdWf 33v4QvXrfK511+iW6ob+a/UF76h+/M0bXr3/XVyjbu7nPZfvR+5P7lfu3/H9vHD5fuf+5zrk ejTvZ30bXmpxG1464Ta8dHR4+OLRnw9+Xvlx5QfVr39QfcwPji4d/vjoieo2PFH9+ROHL1W/ zudad63fW12kf6m+4J3Vj//R8bXu5n5eunw/cn9yv3L/ju/n4WHud+5/rkOuR/N+1rfh5Ra3 4eUTbsPLR288/M+jP1Rf6w8HP6p8t/r1d6uP+e7RI4c/OvpOddu+U/35dw5frn6dz7XuWt9Y XaRfV1/wrurH/9pwrZv/ttU/z7Wu/52r/w37xdK/c/n9+t+5+t/C+t+5/N3m93DT962ba/bI 5WuSa5NrlGt1fM3eeJhrmGuZa5pr27xm9W14pcVteOWE2/DK0Z8Ofnf02+pr/fbg+5Xnql8/ V33Mc0dPH37/6HvVbfve4e8qr1S/zuda9327WF2kf66+4N3Vj//d4vuW78Omx6df/Fv7x6f8 3bb/v3VzzZ6+fE1ybXKNcq2Or9mfLl/DXMtc01zb5jWrb8PV1558G66+dvNtuPraPx78z9Gv q6/164Pv/R9tZx5uU9n//9rSGfaa7zXufc5RwkFJIiRRJEVEMkXmkqEUImWIlLEoQyJThhAH 0UOmzEIq/UwljzJHeBDJF/0+77Os33c9rmudtfq5zx/3da6uZ1/35/V6rWvvtc5xzv3QqqX/ h1a2WktvofbUhxHbMPUwLc1ooWKvoOuWSZG+ooH30tcdnD/b+Hi2yPWAD7zg53r+J9cb/uiA Hn5Pj6FYBIZiIQzFjMPKf/T5NGu+0plWef0wrWy1vN5B7axPJrbJ6n9oFTM6qNgrqHWSIq2k geXo6y7Orfl4dsj1gA+84Od6Hs71hj86oIff02OoFIGhUghDJeMn5X/0CTRrgtKaVmH9J1rZ amG9u9paX0Rsi9T/oVXJ6K5ir6DWDkVaTgPL09c9nFvz8eye6wEfeMHP9fwp1xv+6IAefk+P oW4EhrohDHWN75RbjUE0a5DSiJaof0crWxX1fmojfROxbVJvNTapdY1+KvYKam1RpC9pYEX6 +hOHe/b86z7787pn47VR79l8mvXLbYI2aIRWbrPvchuiJZqirb+Zx9AmAkObEIY2xnpFNbrR rG5KbVp/sfW0stW/2FC1tr6X2PaqqrFXbWMMVbFX0HUzKNISGliJvv4c4T2C6xC1NR/Pobke 8IEX/FzP9bne8EcH9PB7egw9IjD0CGHoYXypZBgtaVZL5SFah9mXtLLVw2yM+pB+mthOqxnG abWHMUbFXkGtGUX6ggZWpq//5vB8NH/LscjPR3ht1M82Ps3G5DZBGzRCK7fZl7kN0RJN0dbf zGMYGoFhaAjDUCNHyTZq06zayn20trMcWtnqdjZFvU8voOXQyjYKaEONKSr2CrpuKkVaRAOr 0tdfON9H+HhOUeEBH3jBz/XMyfWGPzqgh9/TY5gUgWFSCMMkY5pyr1GBZlVQStJayabRylZX ss/UkrpFbJZ2r2Fpk4zPVOwV1FqiSAtp4MP09SCP+8jm/36P5Hkf2fy/75GwzzY+zT5T0QRt 0Ait3GbTchuiJZqirb+Zx/B5BIbPQxg+N8YpDxp30Kw7lEK0ZrNxtLLV2exfaiH9TmK7U3vQ uFP73PiXir2CrptAkXJoYHX6epjzfYSP579UeMAHXvBzPcflesMfHdDD7+kxbIzAsDGEYaPx rvKYIdEsSdFpjWHv0spWx7A1qq5XJbaq2mNGVW2jsUbFXkGt0ynSXBpYg74e5XAfybnuPZLX fQSvjfrZxqfZGhVN0AaN0Mpt9m5uQ7REU7T1N/MYforA8FMIw0/GAKWBcUnO0S/JqbT6swFK f2Loz75RU/Wnie1prYHxtPaT8Y2KvYKuWypFmkMDa9LX3zjfR/h4fqPCAz7wgp/rOUCBN/zR AT38nh7DqQgMp0IYThk9lRbGEZp1RL7Cjsgvsp7Ki8TwItutXmEvENsLWgvjBe2UsVvFXkGt b6VIs2jg4/T1BOfWfDx3q/CAD7zg53r2VOANf3RAD7+nxxAzwxliZt4MMbOz0sH4gWb9IJ9l P8hNWWelKTE0ZQfUs6w3sfXWOhi9tZh5QMVeQa1voUgzaWBt+nqSc2s+ngdUeMAHXvBzPTsr 8IY/OqCH39NjMCMwmCEMptla6W6solmr5KNslVyDtVZqEEMNdlI9ykYS20ituzFSM82TKvYK ah2jSNNpYB36eppzaz6eJ1V4wAde8HM9Wyvwhj86oIff02MoGYGhZAhDSbOR0s+YQ7PmyD+z OXIZ1kgpQwxl2EX1Zzad2KZr/YzpWknzooq9Av8NkiJ9QgOfpK9nODyLzvs6+rMoXhv1+YhP s4sqmqANGqGV26yRgoZoiaZo62/mMVSJwFAlhKGKie9RxtKssfJ2NlbOZLWVTGLIZPieZimx LaXv1ZZqVcwCGvYKum5XadgUWvUp1jnOz6J8PPE9p+sDL/i5nvge1fVHB/Twe3oMDSIwNAhh aGA+pIwxBtCsAfJGNkBOYw8pacSQxiRtI/uG2L7RxhjfaA1MScNeQa0v07BJtBpQrPOcW/Px lHI94AMv+LmeDynwhj86oIff02NoH4GhfQhDe/M+ZYrxEs16SV7OXpLPa/cp57Vs9bzmaMvZ L8T2izbF+EVrbzoa9gpqfYmGfUyrEcX6k3NrPp5Orgd84AU/1/M+Bd7wRwf08Ht6DG9EYHgj hOENs6TymfEMzXpGXsCekX/VSiq/EsOvWhFtAfuD2P7QPjP+0N4wi2jYK6j1RRo2nlaTmNud Z2s+nkVyPeADL/i5niUVeMMfHdDD7+kxjIjAMCKEYYRZSPmX8SjNelSewR6Vt2mFlG3EsE0r rc1gqSxHT2X/MlLZCLO0hr2CWuNz40Naz8TczxOerfl4ltbgAR94wc/1LKTAG/7ogB5+T49h WgSGaSEM00ymrDHupVn3yuPZvfKXGlO+JIYvtUraeJZBbBlsjZHBppmVNOwV1Br3wzG0msfc ++SN/uxg7nXPNHn97ACvjfosyqdZJQ1N0AaN0MptxhQ0REs0RVt/M49hSQSGJSEMS8xU5Rsj i2ZlySNYljxDS1VmEMMMrYY2gt1DbPewb4x72BKzhoa9gq4bnj9H0WqBWDG+z/18PGto8IAP vODneqYq8IY/OqCH39Nj2BqBYWsIw1bzirzbSKdZ6fJAli6/r12hla2+r9XTBrJHiO0Rttt4 hG0162nYK6g1vq96n1armPv91o0+98/dFP25H6+N+tnGp1k9DU3QBo3Qym12JbchWqIp2vqb eQz7IzDsD2HYb56VDxgXpBz9gtSLXZD6aGflPsTQR2uu9WJNiK0JO2A0YfvN5hr2Crpu+NnD CFptYu7PJHjeR/h4NtfgAR94wc/1PCvDG/7ogB5+T4/hXASGcyEM58yj8knjAM06IL3EDkgd tKNyB2LooLXXXmKdia0zO2l0ZufM9hr2CmqNn6m9S6tdzP1Z2w3fRzYdjX4foddG/Wzj06y9 hiZog0Zo5TY7KqMhWqIp2vqbeQwpVjhDipU3Q4r1s3zR+JZmfSu1Zd9KDbWf5YbE0FDrqrVl bxLbm+yi8SZLsbpq2CvouuHnzsNoPR9zfx59o59tn1133fL6bMNro77f+DTrqqEJ2qARWrnN fpbREC3RFG39zTyGZASGZAhD0touFzCX0axlUhO2THpY2y4/TAwP0zu/CRtNbKNZAXM0S1p9 NOwVdN3w7zxDaL0Qc//9h+dnGx/PPho84AMv+Lme22V4wx8d0MPv6TGUjsBQOoShtLVRlsyZ NGumVIfNlEppG+VSxFBKG6zVYbOIbRaTzFmstDVYw15BrfHvl4NodYy5/67JszUfz8EaPOAD L/i5nhtleMMfHdDD7+kxVI/AUD2Eobq1XHbMD2jWB1I19oHkaPTfxOBoo7RqbAWxrWCOuYJV t0Zp2CuoNf6N/21anWPuv/3zbM3Hc5QGD/jAC36u53IZ3vBHB/Twe3oMjSMwNA5haGwtkIuY fWlWX6kC6ysV1BbIBYmhoDZJq8C+J7bvWRHze9bYmqRhr6DWv9Kwt2h1oVgK59Z8PCdp8IAP vODnei6Q4Q1/dEAPv6fH0CkCQ6cQhk7WDLm02ZFmdZTuYh2lM+oM+YyarZ5RZ2t3sUPEdoiV Ng+xTtZsDXsFtd5Pw/rTeiXm/t7XjT4ffbYx+vMRXhv1+YhPs9kamqANGqGV22yGjIZoiaZo 62/mMfSLwNAvhKGfNV6uZDaiWY2k21kjaZ86Xt5HDPvUxdrt7CKxXWSVzIusn7VYw15B1w2/ A9mXVreY+7uRN/p8NOe665bX8xFeG/X9xqfZYg1N0AaN0MptNl5GQ7REU7T1N/MYRkVgGBXC MMoaIdcwq9GsapLJqklfqyPkr4nha/UrzWSCnqMLeg1T0EdZX2nYK+i64XeOe9N6Neb+LjLP zzY+nl9p8IAPvODneo6Q4Q1/dEAPv6fH8GkEhk9DGD61Bsr1zbtp1t1SnN0tLVYHyouJYbG6 RYuz24jtNr2+eZv+qbVFw15BrfG79K/T6hlzf8eeZ2s+nls0eMAHXvBzPQfK8IY/OqCH39Nj WB6BYXkIw3Krl9zcTNCshHQTS0hT1F7yFGKYou7UbmLliK2c3twspy+3dmrYK6g1/kbkNVq9 Yu7fjvBszcdzpwYP+MALfq5nLxne8EcH9PB7egzfRWD4LoThOwv/pnQrzbpVOq/dKg1XX5KH E8NwFf8G9RixPaa3Nx/Tv7N+0bBXUGv87VMPWm/E3L+J4tmajyf+jdD1gRf8XE/8m6Lrjw7o 4ff0GA5GYDgYwnDQait3Nc+KOfpZ8bh2VnxNbSu/RgyvqSe041pzYmuudzWb6wetExr2CmqN vw/sTqtPzP27wRt9Ppr9D56P8Nqoz0d8mp3Q0ARt0Ait3GZtZTRESzRFW38zj+HPCAx/hjD8 aTWR+5j7aNY+cb+2T2ynNpHbEUM79YK2X3uZ2F7W+5gv639aFzTsFXTd8Pe4XWn1i7l/p3uj z0ezN0R/PsJro77f+DS7oKEJ2qARWrnNmshoiJZoirb+Zh5D3A5niNt5M8TtOvJgczPN2izu 0DaL9dQ6cj1iqKfezHZoA4ltoD7YHKjH7ZsZ9gq6bvib9ZfxPUnM/Vt2np9tfDxvZvCAD7zg 53rWkeENf3RAD7+nx1AoAkOhEIZCdjV5lPkFzfpC3Kx9IVZWq8mViaGyKrDN2kfE9pE+yvxI L2QLDHsFtcZZDC/he2105tyaj6fA4AEfeMHP9awmwxv+6IAefk+PoWwEhrIhDGXtCvIkcyrN miqu0qaKxdUKcnFiKK5abJU2j9jm6ZPMeXpZ22LYK6j1FvzsCD9DoljFObfm42kxeMAHXvBz PSvI8IY/OqCH39NjqBmBoWYIQ037Lnm2+S7NeldcpL0r6updsk4MulqYLdLWENsafba5Rq9p F2bYK6j11zSsA63BMffMEZ6t+XgWZvCAD7zg53reJcMb/uiAHn5Pj6FZBIZmIQzN7NvlxWYv mtVLnKX1Em9Sb5dvIoab1FJslraT2Hbqi82dejO7FMNeQa1x1kh7WkNj7pkjN/p8NOu6+2xe z0d4bdTnIz7NSjE0QRs0Qiu32e0yGqIlmqKtv5nH0CUCQ5cQhi62KX9lPkeznhMnas+Jvyum /LuSrf6uVGQTtd+I7Tf9K/M3vYtdkWGvoOuGc0ueozU85p5fcqPPR7M2HIn8fITXRn2/8WlW kaEJ2qARWrnNTBkN0RJN0dbfzGN4KwLDWyEMb9lxeYtZn2bVFz/Q6ot7lLi8hxj2KNXZB9oV YruibzGv6G/Z1Rn2CrpuOLekLa33Yu75JTw/2/h4VmfwgA+84Od6xmV4wx8d0MPv6TGMi8Aw LoSB9pB3mg/SrAfFQdqD4nrlJnk9MaxX6rJBmmrk6Kqx01SNcXZdhr2CWuOskda0RsbcM0du +LNt/X+/R/L8bFv/v++RsM82Ps3qMjRBGzRCK7fZTTIaoiWaoq2/mccwNwLD3BCGufZ56Rez BM0qIfbWSogLlPPSAmJYoDRlvbWixFbU+MUsasy1mzLsFXTdcG5JS1ofxNzzS3j+Dhofz6YM HvCBF/xcz/MSvOGPDujh9/QYVkdgWB3CsNo+Lp0wDZpliK9ohvixclz6mBg+VtqxV7T7ie1+ 44R5v7HabsewV1BrnFvyLK3RMff8khu9j3x63Xskr/sIXhv1s41Ps3YMTdAGjdDKbXZcQkO0 RFO09TfzGHZEYNgRwrDD3i9dMG+mWTeLz2s3i4OV/dJgYhisdGHPa3WIrY5xwaxj7LC7MOwV dN1wBkozWmNj7lkoPO8jfDy7MHjAB17wcz33S/CGPzqgh9/TYzgWgeFYCMMxe4d0s3VSyNFP Cs20k0J3ZYfUnRi6K6+zZlprYmtt3Gy1No7ZrzPsFdQa55Y0pTUu5p5fwrM1H8/XGTzgAy/4 uZ47JHjDHx3Qw+/pMVyOwHA5hOGyvVkSrB9p1o9CPe1HoZWyWWpFDK2Ut1k97VVie9UQrFeN y/bbDHsFtca5JY3xNxEx9/wSnq35eL7N4AEfeMHP9dwswRv+6IAefk+PQXHCGRQnbwbFWSVZ 1gaatUGooW0QnlBWSU8QwxPKSFZDG0JsQwzLGmIozkiGvYJa46yRhvhbH4pVhXNrPp4jGTzg Ay/4uZ6rJHjDHx3Qw+/pMRSJwFAkhKGIs0gqbC2kWQuFStpCoaKySKpIDBWVCaySNpHYJhqF rYlGEWcCw15BrXHWSANak2PumSM8W/PxnMDgAR94wc/1XCTBG/7ogB5+T4+hYgSGiiEMFZ1Z UilrIs2aKJTWJgpFlFlSEWIoosxkpbWFxLbQKGUtNCo6Mxn2Cmo9n4bVozU15p4TcqPP/TPX RX/ux2ujPovyaTaToQnaoBFauc1mSWiIlmiKtv5mHsMTERieCGF4wpkoVbSG0KwhQhFtiKAo EyWFGBRlISuibSC2DUZFa4PxhLOQYa+g64azRurSmhZzzxzh+dzPx3Mhgwd84AU/13OiBG/4 owN6+D09hlYRGFqFMLRy8DuAr9KsVwVHe1W4LH8gXZaz1csyfmfwR2L70ahu/Wi0clYw7BXU GueDPEFrRsw9J4Rnaz6e+J1O1wde8HM98Tugrj86oIff02PoHoGhewhDd2eQVNdqTbNaC5LW WjgmD5KOEcMxeROTtJPEdtKoa500ujubGPYKao3zQWrR+jTmnhPCszUfz00MHvCBF/xcz0ES vOGPDujh9/QYBkdgGBzCMNjpLTW16tCsOkIBrY6wQ+4t7SCGHfIPrIB2s0nfL5hNrZvNwc4P DHsFtcb5II/Rmh1zzwnh2ZqP5w8MHvCBF/xcz94SvOGPDujh9/QYPo7A8HEIw8fOK1I7636a db9wUb1fWC2/Iq0mhtXyPnZRNYjNMNtZhvmxs49hr6DWOB/kUVqfxdxzQm70ZwczrrvP5vWz A7w26vMRn2b7GJqgDRqhldvsFQkN0RJN0dbfzGNYEIFhQQjDAud5qYtVlGYVFU6qRYW58vPS XGKYKx9jJ9USxFbC7GKVMBc4xxj2CrpuOGvkEVrzYu6ZIzyfRfl4HmPwgA+84Od6Pi/BG/7o gB5+T49hfQSG9SEM651m0uuWSrNU4YCqCh/KzaQPieFD+Rw7oD5IbA+ar1sPmuudcwx7BbXG +SDVaM2PueeE3Oiz6Iy10Z9F8dqon218mp1jaII2aIRWbrNmEhqiJZqirb+Zx7AnAsOeEIY9 Tj3pbetKPEe/Et+lXom/JdeT3iKGt+SrbJdan9jqm29b9c09zlWGvYKuG84aeYjWwph75gjP +wgfz6sMHvCBF/xcz3oSvOGPDujh9/QYfo/A8HsIw+9ODWmk9RvN+i2+Vf0t3kWuIXUhhi5y mr5VfY7YnjNHWs+ZvztpOvYKao2zRqrQWkSxGvK4j6w9HP0+Qq+N+tnGp1majiZog0Zo5Tar IaEhWqIp2vqb/b//L6JEOMNNibwZbkpUkiZYO2nWzvhqdWe8mVxJakYMzWRdX632IrZe5gSr l3lTQtexV9B1w7kllWl9QbEac76P8PHUdXjAB17wcz0rSfCGPzqgh9/TY9AjMOghDHqitDTT WkOz1sS/UNfEa8qlpZrEUFMupH+hvkts75ozrXdNPVFIx15Brcfh7GxaS2PuWTE3eh+Zft17 JK/7CF4b9bONT7NCOpqgDRqhldustISGaImmaOtv5jEUj8BQPISheKKItNCaR7Pmxeeo8+Jl 5SJSWWIoK5fU56hTiW2qudCaahZPlNSxV9B1wxkouG7LQq7b/899hI9nSR0e8IEX/FzPIhK8 4Y8O6OH39BgqR2CoHMJQOeFIK6xxNGtcfLI6Ll5IdqRCxFBIvk+frH5BbF+YK6wvzMqJ+3Ts FdQa55ag9Yp8aM3H8z4dHvCBF/xcT0eCN/zRAT38nh5DvQgM9UIY6iUkaZM1kGYNjI9WB8bj siTFiSEuP6SPVrcQ2xZzk7XFrJd4SMdeQa1xbglar8qH1nw8H9LhAR94wc/1lCR4wx8d0MPv 6TG0i8DQLoShXaKA9IP1Ms16OT5EfTn+p1RA+lPKVv+UautD1H8T27/NH6x/m+0StXXsFdQa Z42g9eqIn/1hz0fT10R/PsJro96z+TSrraMJ2qARWrnNCkhoiJZoirb+Zh7DaxEYXgtheC1x UdxnNadZzeN91ebxg9JF8SAxHJQa6X3Vs8R21txnnTVfSzTSsVfQdcO5Jbhuaznds6ddd93y umfjtVHfb3yaNdLRBG3QCK3cZhdFNERLNEVbfzOPYXgEhuEhDMMTJ8Vj1mM067F4N/Wx+HfS SfE7YvhOaq13U2+1cvRbrWPWrdbwRGsdewVdN5xbguu2Ph8+2/h4ttbhAR94wc/1PCnCG/7o gB5+T49hSgSGKSEMUxIHxHNWOZpVLv6CWi6+XDogLieG5VJn/QU1QWwJ65yVsKYkOuvYK6g1 zhpB64350JqPZ2cdHvCBF/xczwMivOGPDujh9/QYFkdgWBzCsDixS7xq3Uazbos/q94W/1Ta JX5KDJ9KPfVn1buJ7W7rqnW3tTjRU8deQa1x1ghaf50Prfl49tThAR94wc/13CXCG/7ogB5+ T49hcwSGzSEMmxNbxTRboFlC/ClViI+StoqjiGGUNEB/Sq1GbNWsNLuatTkxQMdeQa1x1gha b8mH1nw8B+jwgA+84Od6bhXhDX90QA+/p8ewLwLDvhCGfYnVom5fTM/RL6bXVC+m95NWi/2I oZ/0nl5TbURsjSzdbmTtS7ynY6+g1jhrBK23cXo++uQfPB/htVGfj/g0e09HE7RBI7Rym60W 0RAt0RRt/c08hjMRGM6EMJxJ4G+2DtGsQ+mV1UPpnaQvxE7E0EnC33h1JLaOViG7o3Um8ZGO vYKuG84twXX7LuJ75J/8/IiPJ/4Gz/WBF/xcT/zNnuuPDujh9/QYCibDGQom82YomJwjlrS/ p1nfp5dRv09vLM0RGxNDY2m6XkbtS2x9rZJ2X6tgcrqOvYJa46wRtN6eD635eE7X4QEfeMHP 9Zwjwhv+6IAefk+PwYnA4IQwOMnJ4n32Cpq1Ir2YuiK9ujRZrE4M1aX5ejH1A2L7wLrP/sBy kvN17BXUGueDoPX/4fTc/8nq6M/9eG3U+wifZvN1NEEbNEIrt9lkEQ3REk3R1t/MYygVgaFU CEOp5GjxIXsWzZqVnlRnpZeWRouliaG0tExPqjOJbab1kD3TKpVcpmOvoOuGs0Zw3Xbmwz2b j+cyHR7wgRf8XM/RIrzhjw7o4ff0GB6OwPBwCMPDySFibXs0zRqdrqij05PSEDFJDElpg66o y4htmVXbXmY9nNygY6+g1jhrBK13c7pnT73uPZLXPRuvjfrZxqfZBh1N0AaN0MptNkREQ7RE U7T1N/MYGkZgaBjC0DDZV2xkv0mz3kwvqL6ZniL1FVOIIUX6Xi+ofkts31qN7G+thsnvdewV dN1wbgmu24/5cB/h4/m9Dg/4wAt+rmdfEd7wRwf08Ht6DB0iMHQIYeiQ7Ca2tjvTrM7pl5TO 6efEbuI5MVs9J+7VLykHiO2A1do+YHVI7tWxV1BrnFuC1nvzoTUfz706POADL/i5nt1EeMMf HdDD7+kx9InA0CeEoU/yBbGz3YRmNUk/rTRJ3y++IO4nhv3iEf20coHYLlid7QtWn+QRHXsF tcZZI2i9Lx9a8/E8osMDPvCCn+v5gghv+KMDevg9PYb3IzC8H8LwfvJZsaf9CM16JP2Q8kj6 VvFZcSsxbBXP6IeUdDtHT7d72un2+8kzOvYKao3zQdB6P6fnoyn/4PkIr416z+bT7IyOJmiD RmjlNntWREO0RFO09TfzGGZEYJgRwjAj+ZQ4wL6HZt2T/qNyT/oS8SlxCTEsES/rPypZxJZl D7Cz7BnJyzr2CrpuOGsE1+3XfHg+4uN5WYcHfOAFP9fzKRHe8EcH9PB7egxfRmD4MoThy2RN 8T07g2ZlpH+rZKRPE2uK04hhmphifKvcS2z32u/Z99pfJlMM7BXUGmeNoPXBfGjNxzPFgAd8 4AU/17OmCG/4owN6+D09hm0RGLaFMGxLVhY/slNpVmr6OiU1fYRYWRxBDCNEzVinPEpsj9of 2Y/a25Kagb2CWne81voIp2fRKV9FfxbFa6PeR/g00ww0QRs0Qiu3WWURDdESTdHW38xj+DUC w68hDL8my4jT7T/ScvQ/0pYqf6S9IZYR3yCGN8RMY6nyDLE9Y0+3n7F/TWYa2Cvour1w7bod y4d7Nh/PTAMe8IEX/FzPMiK84Y8O6OH39BjOR2A4H8JwPllMnG//QrN+SZun/JLWXiwmtieG 9mJxY57yErG9ZM+3X7LPJ4sb2CuoNc4aQevjnO7Zk697j+R1z8Zro3628WlW3EATtEEjtHKb FRPREC3RFG39zTyGtIxwhrSMvBnSMpLiMvsbmvVN2ifKN2lPiUm6i2WrT4lljU+UAcQ2wF5G d+20jLIG9gq6bjhrBNft93y4j/DxLGvAAz7wgp/rmRThDX90QA+/p8eQGYEhM4QhM0MRN9hL adbStA+VpWlVREWsQgxVxCrGh8pYYhtrb7DH2pkZVQzsFdQaZ42g9al8aM3Hs4oBD/jAC36u pyLCG/7ogB5+T4+hTASGMiEMZTIKit/b02nW9LThyvS0kmJBsSQxlBQfN4Yrc4htjv29Pccu k/G4gb2CWuN8ELT+Tz605uP5uAEP+MALfq5nQRHe8EcH9PB7egw1IjDUCGGokXFJ2GuPpFkj 0/orI9NM8ZJgEoMpPm30V1YR2yp7r73KrpHxtIG9glrjfBC0Psvp+WjSP3g+wmuj3rP5NHva QBO0QSO0cptdEtAQLdEUbf3NPIamERiahjA0zTgtHLF706zeaT2U3mkx8bQQI4aY2NLoofxA bD/YR+wf7KYZLQ3sFXTdcD4Irtsf+fB8xMezpQEP+MALfq7naQHe8EcH9PB7egwvRmB4MYTh xYxDwhm7Pc1qn9ZJaZ92SjgknBKy1VNCR6OTcoTYjthnqPaLGR0N7BXUGueDoPWFfGjNx7Oj AQ/4wAt+ruchAd7wRwf08Ht6DP0jMPQPYeifgXMxGtCsBmmtlAZpPwk/Cj8Rw08CztG4RGyX 7Mv2Jbt/xqsG9gpqjfNB0PpiPrTm44lzTlwfeMHP9cS5KK4/OqCH39NjGBOBYUwIw5iMb4UU pyrNqprWUKmatlH4VthIDBuFN42Giuzk6LKT4sjOmIw3DewV1Brng6D1JU7P/ZNWRX/ux2uj 3rP5NHvTQBO0QSO0cpt9K6AhWqIp2vqbeQyzIzDMDmGYnbFO0Jw7adadabWUO9M+F9YJnxPD 58Iwo5ZyB7Hd4WjOHc7sjGEG9gq6bjhrBNftMqd79sTrrlte92y8Nur7jU+zYQaaoA0aoZXb bJ2AhmiJpmjrb+YxrIzAsDKEYWXGUiHTsWiWlVZVsdImCUuFScQwSRhrVFUqEFsFJ9Op4KzM GGtgr6DrVv/adfs7Hz7b+HiONeABH3jBz/VcKsAb/uiAHn5Pj2F7BIbtIQzbM+YJxZ0CNKtA WjmlQNpQYZ4wlBiGClONckptYqvtFHdqO9szphrYK6g1zhpB65sL8G/Nx3OqAQ/4wAt+ruc8 Ad7wRwf08Ht6DIcjMBwOYTic8YlQ1jmdmqOfTi2hnE7tIXwi9CCGHsJco4TSkthaOmWdls7h jLkG9gpqjbNG0LpAPrTm4znXgAd84AU/1/MTAd7wRwf08Ht6DJciMFwKYbiU8aFQxdlLs/am Zil7U9sIHwptiKGNsMTIUroRWzenitPNuZSxxMBeQa1x1ghaFwxpHfWe/fE/uGfjtVHv2Xya LTHQBG3QCK3cZh8KaIiWaIq2/mYeg5QZziBl5s0gZQ4XHnc20axNqUzZlFpXGC7UJYa6wlqD KYOIbZDzuDPIkTLXGtgr6Lrh3BJct5SI75F/8jMNPp5rDXjAB17wcz2HC/CGPzqgh9/TYygc gaFwCEPhzP7C084imrUoNVVZlFpJ6C9UIoZKwjYjVZlAbBOcp50JTuHMbQb2CmqNc0vQOi0f WvPx3GbAAz7wgp/r2V+AN/zRAT38nh5D+QgM5UMYymf2EFo6k2nW5NQr8uTUYvTJX4wYigl7 jCvyfGKbT5+Y853ymXsM7BXUGmeNoHU8H1rz8dxjwAM+8IKf69lDgDf80QE9/J4eQ60IDLVC GGpldhI6OsNo1rDUs/KwVE3oJGjEoAkHjbPyOmJb53R01jm1Mg8a2CuoNc4aQWsxH1rz8Txo wAM+8IKf69lJgDf80QE9/J4eQ4sIDC1CGFpkthJedXrSrJ6pR+WeqVfjrYSr8Wz1avyUcVTe TWy7nVed3U6LzFMG9gpqjfNB0FqOeJ8N+x5rwsro32PhtVGfj/g0O2WgCdqgEVq5zVoJaIiW aIq2/mYeQ9cIDF1DGLpmNhTedNrSrLapP8ttU4/HGwrHieF4/C/jZ/kEsZ1w3nROOF0z/zKw V9B1w1kjuG5qPjyL8vH8y4AHfOAFP9ezoQBv+KMDevg9PYZ3IjC8E8LwTmYtYZjzJM16MnW7 /GTqrngtYRcx7IrfYm6X/ya2v51hzt/OO5m3mNgrqDXOB0Frlg+t+XjeYsIDPvCCn+tZS4A3 /NEBPfyeHsP4CAzjQxjGZ1YVxjoP0KwHUjfKD6SujVcV1hLD2rhsbpRZIkdnibEOS4zPlE3s FdQanbHMfGjNx1M24QEfeMHP9awqwBv+6IAefk+PIScCQ04IQ05mOWGqk02zslOXy/Q1Xk7I IYaceMKk/ya27AT974mczISJvYJaV7zW2s6H1nw8E2auB/nkepGf61lOyPUm/9wO1MPv6TGs jcCwNoRhbWYJYa7DaBZLXSCz1PHxEsJ4YhgfL2oukB8gtgcSc50HEmszi5rYK6j1fddaJzh9 Pzt+5aHI38/itVGfj/g0K2qiCdqgEVq5zUoIaIiWaIq2/mYew64IDLtCGHZlZglLnL9T6DMx ZYb8d8o78SzhHWJ4J36POUN+ktieTCxxnkzsyrzHxF5B163steuWkQ/Ponw87zHhAR94wc/1 zBLgDX90QA+/p8dwPALD8RCG45lMWOucoFknUj6ST6R0jTOhKzF0jT9gfiS3Jba2ibVO28Tx zAdM7BXUusy11ln50JqP5wMmPOADL/i5nkyAN/zRAT38nh7D1QgMV0MYrmamCtuc3TRrd8p7 8u6UFvFUoQUxtIg/ar4n9yS2noltTs/E1cxHTewV1Lr0tda35UNrPp6PmvCAD7zg53qmCvCG Pzqgh9/TY9Cywhm0rLwZtCycPbiOZq1LeUtel1IrfiVeixhqxXFW4TBiG5bY4wxLaFn1TewV 1LrUtdaFOX2P9dGK//7sz+t7LLw26j2bTzOcS+m2QSO0cpvhHEu3JZqirb+Zx1AsAkOxEIZi WWfjB535NGt+ymvy/JTy8bPx8sRQPt7cfE2eTGyTEwedyYliWc1N7BV03e68dt2K5MPzER/P 5iY84AMv+LmeZ+Pwhj86oIff02OoFIGhUghDpayj8VPOBJo1IeVFeULK7fGj8duJ4fZ4e/NF eRGxLUqcchYlKmW1N7FXUOsS11oXy4fWfDzbm/CAD7zg53oejcMb/uiAHn5Pj6FuBIa6IQx1 s36O/+UMolmDUtrIg1LE+M9xkRjEeFezjbyJ2DYl/nI2JepmdTWxV1Dr7Guti+dDaz6eXU14 wAde8HM9f47DG/7ogB5+T4+hTQSGNiEMbbK2x29JdKNZ3VIay91S/krfHv8rPVv9K72P2Vje S2x7E7ck9ibaZPUxsVdQ66LXWpfMh9Z8PPuY8IAPvODnem6Pwxv+6IAefk+PoUcEhh4hDD2y NsblREua1TLlCbllyuH0jfHDxHA4fbD5hHya2E4n5MTpRI+swSb2Cmp9x7XWd3H6HmvcdffZ vL7HwmujPh/xaTbYRBO0QSO0cpttjKMhWqIp2vqbeQxDIzAMDWEYmrU8nkjUplm1Ux6Wa6ds T18e304M29NHmQ/LBZI5eoFkIlEgOTRrlIm9gq7b7deuW+l8eBbl4znKhAd84AU/13N5HN7w Rwf08Ht6DJMiMEwKYZiUtSBeNFGBZlVIKS9XSFmZviC+khhWpk8yy8sWsVnJogkrOSlrkom9 glpnXWtdJh9a8/Gc9H/Zu7tQOev8DuDZtDM58zzmiVvMPHGeyZnBXGzX1BittQTbxmjMlRC2 UaPZhS1SiW8R8aIV4rsQll6oMeoiza6C0RgvZDkEfI3uhciBqIhSL2RRIxIIiAhGI0JJ/78z Z+o0epyxO0luPh8cEszwf77f75wzz0RIbEaP6BO9ol+v5x/y6B39Y4fYY7BnP8PUCBmmhmSY mtyVr2ydka51xoLli85YsCfble9JGfZke5rLFy1P2ZZXK1vLq6nJPc04a66t27Nb/+1x2Ho8 Pfc0o0f0iV7Rr9dzVx69o3/sEHsM9uxneH2EDK8PyfD65KP5Ba0iXatY0F1ULHg4ezR/OGV4 ONvb7C66MGW7sLqgdWH1+uTeZpw119at2a3/bky/x/rtj/g9Vjx31Hv2eDbb24xNYpvYKLbq bfZoHhvGlrFpbDu4WT/D+yNkeH9Ihvcn78vXtb6pP3vaN/XFi76p353dl9+dMtydvdpcvOiy lO2yal3rsur9yVebcdZcr9uS2dft78d0z/7tS6Pfs+O5o36/jWezV5uxSWwTG8VWvc3uy2PD 2DI2jW0HN+tn+GyEDJ8NyfDZ5L35L1oH07UO1rNFB+tbsnvzLSnDlmx/M1t0bcp2bfWL1rXV Z5P7m3HWXK9bc/Z1W3Uc3tvG03N/M3pEn+gV/Xo9782jd/SPHWKPwZ79DPM7wzPM7/xwhvmd W/Nftd5J13qnfrR4p35Vdmt+VcpwVfZe82hxW8p2W/Wr1m3V/M57zThrrq1Pm936guOw9Xh6 vteMHtEnekW/Xs9b8+gd/WOH2GOwZz9Dc4QMzSEZmp0t+ebWK+lar9QPF6/UL8m25JekDJdk B5qHiwdStgeqza0HqmbnQDPOmmvrv5rd+h+Pw9bj6XmgGT2iT/SKfr2eW/LoHf1jh9hjsGc/ w5kjZDhzSIYzO1fnt7SeSdd6pn6oeKZ+TnZ1fk7KcE72afNQsStl21Xd0tpVndn5tBlnzbX1 qbNbrx7TPfuRY977f+ieHc8d9Z49ns0+bcYmsU1sFFv1Nrs6jw1jy9g0th3crJ9h9QgZVg/J sLqzMb+99Ui61iP1D4pH6kuzjfnSlGFpdqT5QfF8yvZ8dXvr+Wp150gzzprrdStmX7c1x+G/ aYyn55Fm9Ig+0Sv69XpuzKN39I8dYo/Bnv0MG0bIsGFIhg2dS/PftO5J17qn/m5xT72RXZo3 UoZGNr98t3gjZXuj+k3rjWpDZ34ZZ8219SmzW689DluPp+f8MnpEn+gV/Xo9L82jd/SPHWKP wZ79DJtHyLB5SIbNnTX5jtZN6Vo31aeLm+pfNtbkXzZ+9tMvGwvL6eKjlO2jakfro2pzZ2EZ Z821dTa79brjsPV4ei4so0f0iV7Rr9dzTR69o3/sEHsM9uxn2DpChq1DMmztnJ//vrUpXWtT fV+xqX6gcX5+IGU40FhS7isOp2yHq9+3DldbO0vKOGuurSdG3HrUz/0P/4jP/fHcUe/Z49ls SRmbxDaxUWzV2+z8PDaMLWPT2HZws36G+0fIcP+QDPd3lud7WuvStdbVp4p19Tcby/M3U4Y3 G8vKqWKi/expE+09rYn2/Z1lZZz1575u/5/PR+PpuayMHtEnekW/Xs/lefSO/rFD7DHYs5/h iREyPDEkwxOd+Pvdz03XOre+uzi3/kKjm7+QMrzQiL8Pvp2ytdt7W+32E50VZZw1ru+RYZ+P Hn5x9M9H8dxR39vGs1n83f+9bWKj2Kq3Wfy/Anpbxqax7eBm/QzPjZDhuSEZnusszv/YmkzX mqzvLCbrTzYW50+mDE82VpU7i5Up28r2H1sr2891VpVx1ri+R37MfWQ8PVeV0SP6RK/o1+u5 OI/e0T92iD0Ge/Yz7B8hw/4hGfZ3snx/K0vXyurbi/RoZPn2lGF7Y225vVibsq1t72+lR2dt GWedjK3H0zPlb/X6RK+ZfjM9U9+i1z92mNnje7b+cIQMHw7J8GHnaPZe66vas6d9VdtWfFW7 vXE0uz1luL2xvtxWXJmyXdl+r3Vl+8PO+jLOOlH37IeOeT/6oXt2PHfU+8h4NltfxiaxTWwU W/U2O5rFhrFlbBrbDm7Wz/DFCBm+GJLhi87h7EDr43Stj2tbi49r1zUOZ9elDNc1NpVbixtT thvbB1o3tr/obCrjrJNxzx5Pz01l9Ig+0Sv69XoezqJ39I8dYo/Bnv0MC7rDMyzo/nCGBd1D 2aett9K13qrdXLxVu7xxKLs8Zbi8cU15c3FXynZX+9PWXe0F3WvKOOtkbD2enteU0SP6RK/o 1+t5KIve0T92iD0Ge/YzVCNkqIZkqLofZEdaL6ZrvVi7pnixtqbxQbYmZVjTuLm8pngoZXuo faT1ULvq3lzGWSdj6/H0vLmMHtEnekW/Xs8Psugd/WOH2GOwZz/D2SNkOHtIhrO772bzq6fS tZ6qbSqeqp3VeDc7K2U4q7G13FQ8nbI93Z5fPd0+u7u1jLNO1GfRHT/is2g8d9R79ng221rG JrFNbBRb9TZ7N4sNY8vYNLYd3Kyf4eIRMlw8JMPF3elsYfVgutaDtfXFg7XTG9PZ6SnD6Y1t 5fri5ZTt5fbC6uX2xd1tZZx1Mj4fjafntjJ6RJ/oFf16Paez6B39Y4fYY7BnP8PGETJsHJJh Y3dftqS6I13rjtra4o5arbEvq6UMtcb2cm3xdsr2dntJ9XZ7Y3d7GWedqM9HO14Y/fNRPHfU 97bxbLa9jE1im9gotuptti+LDWPL2DS2Hdysn+GGETLcMCTDDd2pbFl1fbrW9bVVxfW1zyem ss8nfvbTzyd2lquKT1K2T9rLqk/aN3R3lnHWybiPjKfnzjJ6RJ/oFf16Paey6B39Y4fYY7Bn P8OdI2S4c0iGO7u7sxXVFelaV9RWFFfU/jSxO/tTypB+LFcUX6dsX7dXVF+30/PKOOtkbD2m nmX0mOmTekW/2Z5Z9J7pn3aIPQZ79jPsGCHDjiEZdnR3Zquqi9K1LqotKy6qTU/szKZThumJ qXJZccrSZ087Zemq6pSlO7pTZZx1ou7ZDx7zfvRD9+x47qj3kfFsNlXGJrFNbBRb9TbbmcWG sWVsGtsObtbPsHuEDLuHZNjd3Z6trVaka62oLSlW1PZObM/2pgx7J/aVS4puytZdurbqLt3d 3VfGWSfjnj2envvK6BF9olf06/XcnkXv6B87xB6DPfsZXhohw0tDMrzU3Zatr1rpWq3awqJV e3xiW/Z4yvD4xHS5sDgvZTtv6frqvKUvdafLOOt4bx2Zj916PD2ny+gRfaJX9Ov13JZF7+gf O8Qegz37GQ425s17Le9lWPk916jNPOe1/N868fiP5sFGPF7L/9y9jt2iL3L8zffk+Mv//TcH O+t+Ho9vr33x7LmR9dhzH0uP3w0597H0jMfmres8/dfx+N33njv4Hvjr+LPRsz+PH0P/x3ln /GReffanv/zP/xq44v/9ujg254qF374Oa78nZzbznNfyFe14HfaeGq/Ft69HPPaeOvPrC7/7 2lw4+9r89+yf6/vn9Nr868BrcyJfj0Pp6+3IbM+5zj3UOJIfavy6+e+deBzJT+S5t6TH2/+w cebreHV6XJK22jD/2/O3LZ4371/ixZg38+0566748v/Oz9NlZ368MT3OS4/H43ssnf1i+gL5 p7/ofU31f/6T9A4Q7x3x6991tP8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/A97cCAAAAAAAOT/2giqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzNO0oDURiG4X+8gARv vUUsI1iKjYKFkCUIdulsrLIAcR8SYukyLF2JEMHKBcRvQqIBB9zA8zAv58ztPwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAA0OEi7aSjdLj2/Dadrt3Pl7Z+nrz3hydtVZfLGddpN213zJ2m yT9zp/liWsP+y6Bt0jl3nEYfvRo1VU/pc6PqK+v5XtXdQdVsv+pmczG5+T3l8aprn2MX6306 S8/pddarh/z/lv0grfZNHVc7tn3/13x1AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAHyzdx5KsjTBWb14D8IJBAIJEEYgPAjhhfAgQHjv0fu/AnPi 7gk+8q/ucT07s7tfRlTM7pju6qrMrPRZKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgU CoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQ KBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVC oVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQK hUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAo FAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKh UCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqF QqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgUCoVCoVAoFAqFQqFQKBQKhUKhUCgU CoVCoVAoFAqFQqFQKBQKhUKhUCgUCq8MvyLGr9wZfqdQKBQKhUKhUCgUCh9L30On+1Wn8atP 49ecxq89jV/3Nvibwft8zveqAxYKhUKhUCgUCoXCx9D51PfQ6dDxfsNp/MbT+M2n8VveBn8z eP/Xv+mAU/8rFAqFQqFQKBQKhcLrQep86HO/6TR+62n89tP4nafxu07jd7+98j/v8znf4/v8 rrpfoVAoFAqFQqFQKLwm6OtT58Of9yNvet6PncaPn8YfPI2feHvlf97nc/Q//ID4BtX9qvcV CoVCoVAoFAqFwuvpfcRqEtuJ/w6d70dP4w+cxh8+jT9+Gn/yNP7U2+ufOI2fetMB0f9+x5vu p9+vPr9CoVAoFAqFQqFQeC3Q14fPjthN/Hj49NDtfuY0/vxp/Oxp/Nxp/JXT+Eun8WdP46dP 4w+F7oefEN2xPr9CoVAoFAqFQqFQeE29j1otP3Iav/dNn8O/h47310/j50/j757GL5zG3z6N v3Yaf+Hbd//fT779ht9yDX1+hUKhUCgUCoVCoVB4Lb2PGE/8dr/vNP7ot+8+vb/6puv9o9P4 xbfxj990QPRBdD/iQIkJpeYL8Z71+RUKhUKhUCgUCoXCa+t9v/80/tibTvc3T+MfnMY/P41/ dRr/+jT+5Wn80zfdD73wz3z7ngeoz494UfIFq/cVCoVCoVAoFAqFwmvpfcRopt73F0/jb337 7t9D1/t3p/EfT+Pfv+mA/+Tb9/hPYkGp9YLPjx4P5PnR16+xnoVCoVAoFAqFQqHwGmA9T/x0 P/Lt/8V5Us9FvQ89D53vv5zGf37T/f7Fafz9b99z/f70t+85gb/n2/faMNT2bKxnoVAoFAqF QqHwXSZ24BtxIC+vRn7H373ac8zxWebw3s+4d7+j76veh6722950N+I2id8kh+8ffvvu7/sP p/Ff38Z/+vY95hOfH3VeiAlFV8RXSE+/z1Tf5dXp9JE48gq0/ZlwZoU38/N71ve9eMYr8bRL rnvtePRzvvecPtNZ/5n34dqz5tVlw3v35rPPofC15AFpGXkb+ZhBbBw1MRjI4Dl8n+/wXX7H kObfE0cnX/I55kie9AhdJddxbw638MNLrj957r3PeOkz3fNcW8D1wC1iNKnPQm8+anXSt4E8 PvL7iPPE3/ff3l75n/f5nO/xfX7H74315Lql02Pp4JH0t7r2Odzv+XgdzqwGnyfOXLq+r8CL 78XTrfnNOW7h5t51bxkreXprzd5jTisZ/71l4/c8B4/As2fjxb00Is/YO2v2zpxX48/n8Eg+ +UiedY4fvcccCl9bHpCeia3DN0JNDWRl6iESJ7cafMZ3+C6/keaT1h/dMzufI+UZ5sKzOJyb vOgo2sm1TP547RyOvv4967+SFef92O+j75uQOX746zLHD38efr1/8+27n0+fH/4//ID4A/EL Uv/T+i74DZnnR6rv8hHo9Fb6476X6BCrZ7/k2u/Bez4rzvB+4kyu8Wp9p09gj2/MPXuv/TqH S6zLiqdtPa+y2oonr573njFl6a31X8npj57Te9HcM87BI2lviw7u3YOj5Jot/En62OIbnK2M rTPnGfR+Dx7JC5In3HJ+XYonz5hD4WvKBFMegEah1x/59r2WBvUw6Jf9o9++x9kxkJ8Z/s9n fIfvIptD+9C7tC6dP4rGuV7yV+7JvZkDc+FZmBeve3O7J54naTfX8pI5eC5trc2115ffcn14 xLnr7z2TPJHrwHcSP7ifw/vyuTrF5En37O1WrCc1PX/pTdfLWE90QWp7/vybjkhPB3RGcPqj xHp+FDo9iv5W95zPLx4qc8xrJw4+mu+8Ks5MeVMZYtIueIAPfOLNxBe+A47t4cz0O8z9mvde 7ddRPOMSnubcVnjq2MKnfNbUaxPvlYPnNW8ZXGOu1+Tt59b+EXNSzle2dw9vOW/uOWe3eM0R 5+DRc8w9OHIf8llv4eUr/WNFu6uzxnMmx+Qf15w576GXzz3K52SOri/PK+/b4wm3nJlbMt2k 00fNofC1dL7Et5SjwDPoE3r9sTc5mVqIP/Hte20M5O0/Mgbv/eTbd/guv4HuoXdwFRwFPx+l //k8Sb/QBPdmDvAfnsXB/86N78F/7tX9lHtdT67Jc+/NAV4IDTMHaXfrTDp3fdZ76/rs67nr n5OP2Dvxg+uKH9RZYb95ZQ68D/7wPffcmMp7dCx+u4r1/Nlv32M5/9m377Gd1HUx1pP6LsR6 /r3T+Llv33u9g6Os10fo5fdR6HSL/sC9c/THPZXJVvSXeOi5yPNz7cRDR+Kgz7N17a9gy0u9 Rj1vhTPghXjj4H8Gn0FvPx50nvsnf1GuTpu1ckzia/KqPZ5xtHw+cSnxFFwST3lGx3zW1B8y TtbnnDw/nzWve+2Y67U6O1Zrn7ziEXNSvteWxL245yP38JHn7KPmmHg2aeBovEi55hLet6d/ qP8kfcA34Ad7Z43nzbX84z10l5Vss+JRyjY5zsk51+CVay6fdr2l1feYQ+Fr6Xx59ikTgGvQ NbIA9PpTbz6Sn36TmamLSLzcnxuD9/iM7/BdYvCge/gCtA6OwjcehZ/5PJ4DPgv8xmehtgev 8CPeh374HvNS93NO98xBHgJdcg/uxT1zDsyJdWaOrA1zZi9cly3ZV/6Q12edvT6Dtb/m+ntn F99XPoLHsJdcF17OfXge9ptX9xzexBkBTqXcfa/PL2M9retJzRbqehLrSS2XjPWkxie1Punr /jfe8JQ5Guv5yr38PhKdznmytlznHvrzXpfiobjPtcVB6ONIHPxotjzlTeQrdb09nMF/zgBP GPzN+z/zZmOhH0rS+cQZ5Tdjz/L+8AP2ZMWr2EOvxd7ym7QXHbVfl+IpdMHYwtW0jaQtJp/T 64mbrNu9w/mwXpO3Zwxd7r20wvq69vLtI+ckPvD87qHnzaP2kGfcOmePOgfvsUF7VsuzmePk WUftgXTE9SeumtNwSSxF6nvs48Rn7gffgB/AF7bOGs8beAjfg8fAP7bOnGmffo/YsLRnS7vM KWUbnjWH/E+exW/4bdo6LsH3tA3MOSSfVL46N4dH8s3C59L51JE8+8A1eAiyAPRMrXz6n1EX gx7YxNQhP9MvG1mbwd+8x2d8h+8SUwfdQ+/gKfgLP8pz/Si7W9KPZzk8D3qANuA1PAvzQUfg mfifZ+Rz5sW5kefBtTSTfCTPIq7tesL/uDdzYC7MgbmxNtA5eyDdzvjDrevDi7k+PPie6++d XXyf3/F7rsP12FPXlL1mcF/mwFzgS8wNfqRMfy8vylhP5sPzcw4xD3o1ZKwnvj70Pnx/xHr+ 4rf/v5cfuAGPZV6vGOv5keh0hSvn6A88Ye48g/QHnkz6mzIUZyPzQq5h75kzc+faXNdri4Os E8+CTKFe+RnPwy3fPM/N2kK3yAh7OAMNgR/iTeILn+Ev/8tvOIM8hxzH+rPH0LpyNftoXo/2 c/aA77AnyasYiX/sKXvLb5h/6upHynqrcyLXRZ6WuMp3+G7K0+Y5qV9Jmz5n4j3D694ypJ1c e+g152TsnHK7PJt1RXbkd3lOHDEnno9rcm3uAZ69xx6eO2fFrXvOwVvnmHwbGuQc9KwWz+RZ R+IFdMSzplyzd/5u+U7TribuSLfcDz6wd9bMM0f+QWyO/CPnmnYV9b9H+q62zhRwVzphjjwr PJLnZfA370mD9+B72vHV+eAfl85hxTdXuF3dr7BlK4O+oT9oG3wCv6BVaPfvfPseR0cvNGpk 4DuhZxr+FQZ/8x6f8R2+i4wNvUPr4Cn8Qt7LOSU/OsIOn3yW60F/8Hd4LHQBn4E/yZd45X/m Bf/le8wJmpFur7UDZq8B5V7WFPrlHtyL9XQOrg1zg75Ze+gW2ucZpnx66/XhD1yfdd+7/t7z yBfnmnJ97kddFfab+zIH1xXZ5951XeGvsZ7MiTXgHAVff+Hb91jPf/um76H3GetJLz9jPZk/ vBUcfNVYz/ekU/bwHjpVdpj0xzwvob89PJlyHjIBZyPnHGuAvIP8Ab4ra7AerAtnJmciMoV2 nUfJeq+g8xmflTaCKcuwXshe8ooVzog3iS/YVKAfaGzydtY5bWja7zNWiT1IXpX4cC+vuoVH g2fMEbwD/3JezIlnhK9JG85NPm0MsblazJXnZK1Zi6TN5JH3DtcLnM85qc9Aq+YEuf+sp3vP 75DTuc4Rc+IaXItrglfcg+eHPqFT7S1H+R+2zsHcw71z8Nw5e6ROoW1B+yy8CP4qnjG3o/CC 6yRNshbQG2vDGq10gYwNSDuRPi/wRpsdPFzc4V7wDfgBfGF11swzh+/BY+QfeebAP+DlyBbY TKZf9uiY3HlegQvSyTxTfFbmzeBv15rv8F1+w2+Z9zXy1da5Bv1cOoct3uQcPlLdusLj5QPo XJ6U+gNnFbQNbkGn0C2+EnKkkJ2pj0jc3GrwGd/hu9TSgN7hDdB56gPcSzu8dLIXh3DpWeAz wbc4f6EF7gl9INvAn+RD/A/v4Xn5HvTGfDgv5Y/XzCN5PdfgWvAC15R7sRbyR+YCDbPW8FR4 B2vCfthXPGl21rOER3h9zlvOuL3rw0v2rr+lX837Icf7PKwh95PHe0/W22dSvzoqpnL2cGde Wz3cV7GezBuZjDOG37rfr8QfZ/xHyg6vSKeT/pgr+87+gwfME7zYoj9wyjqr+vxSPvGMVlaH XyGPsOfMlzVArvDarAfnIucmchZ7raynDPpZ9L5V/Leymz4QZX7tNOyF6yXO/NIOzvA+n4Mz 2FUmzrC/iTPsPXqIeUvaKpIfiw/qlfINPpdv8AxH6urytJSzmNeKh/KM8DTWCfwCz1hDZHf9 KNZW0KfK+3zO95DrWRtpk2txzXsH13JOeXawXsrL4Dmv6qFJh0krR8zHOfGcPC/PzfNDn/Ar 86jBzSP0q71zlj08d85eew7eAtlzSBsYZxT6DTwp8ewovPD8Tb7KmoDf6t8ZS5F5ZcZo6K8G Z1JHBffhp8pQ3GuLb5BnkcP39/gHdM/ecS6nX33aHI/MCcqzVXlxdV4xV56VeTP4m/dW8tvk WXt4Ne0XPCt4yfOjx+W55npvzUG+OeXYz9SjuPAYeyc8CbkA+gbXwCvoFJolTg4fCjUz8J0w iKXL4ft8h+/yG/gBvAG8VRbzXEib4L2639SJzPuCj0CX8BeeB94jD+J/3odmmI89vW+N/UuZ Av7JusI7oWH4MM8PvcojmQPrAi+Fxs07UxeRZlPvy7Pk3PXZO64PX2DN4eF5/T2+lPGU4Aln N2c4ewZ/4dwCR7yf/J17ctbCr8Alzp2U54/S+1IPUMdAd+A5WQfmAS5mrCc4yXxZD85E5BLk NNby1XSBj0anK5sE+gZzBbfB8Ul/7AX3gv7AYfSFpD/3Q50mz2hje1kHcA2ccw14Fs5G1gY8 BV95Bvbavo3aYj+THW8VKwSOswfKw9ppWB/2ALoVX8QPbCQ5Em/EGX4nzrCvrDU4w37Ac/UX wzPMCYJX8Rl4BQ2yZ8qN8mPxQf0KnNd2fW+vzRVPU85KnsbaJE9jjshXPB98Q/ucOT3WyUk7 nHjJWvP7pM05eP+akXyWdfTsMGbF+ir6bDwHpUNonN/zfEfNSZrjeZHj0W1YB/b9Ujn4Wefs LTbeS/Es5XnwBvwBj8An8eyoPWA/p1zDmkw60gdkPLj50sYDG0vCb9N2wRqCy9JGnjNbvCP5 ByPPHPF46i+sEbLK0b6BFQ6lLMX94DtTXmSueZ7yN+/lWvMbfrt1hu3JrHxPf+OKViefzjmw F6v9/oxnXeExtjJ4NTTuWQWuJV2v6Dn/p5ZGDr/DNbiWegj4nP6gGQ9yS9zF6ixA9oCH8Eyc kdAIz8K8eIXvMB/OZ743ZcNr9QDnkHqSfcXhadAn93QOrAs0zdw4C1iPyTdmTMal13fduT77 iUwzZes9W9BKj0auUI/mHODcgvdwL/abV/7nffgQvAv+nf3yHnn2s9/Ib+wn5/5WrCdz5zwD 5/VFcu69UqznR6JTdTP3A9xSFmM/wG3pj3sk/YGz7Bd6CfcApyf9pd6nfxdc5JxFzkNmYM7s t/IFzwEO8Awzrjf3+rP5+ZQfjBVKu7H6HuvuWrH/0Aj0oY3Evxl8xkhcEV/YQ3VA8JDrcx9o S7u99T7MaWI+4BQ0yG/gF8pTzGvumXrDEX6ZLduEPA2dzzlJJ8xrC5fMf7WGpLKjNaYSL7me 6+yartb13HDdmZO2DWhAec8cS2suqtd6DkLX0mHu/b1z4nrun3LwSr86kvdfe86Cn6tz9mif yIxHAU9YB9ZjdXYm/c09uGYfeF6uCc6pfyvXyFf1u9pvfeZiQw8zPintBNqHxJ055tmyNRJv 1KHAHWgmfcZH+gb29HLtxtB34pD7Y9yQg/f4zDOM34B/+NsulSnSdq0Nytrk8FHWXTwWR1Zz kD+xV8o18FztLR+tR3HhMfLkylYGL4TOPfvApSlHTl/BHPn9yRfkv54N8D7uN/3j6ee6Rgbf qu8PHUMPPFPW9+eV//fq+1+r9618UFlvZMsHxRkA34De1T31QW3Ful1yfXvX6ePi+tYzmdff 86fNfgnwJHhd9kifa8r+Mq+0+Sq7HZnjMXUBZDjwinNvFesJXqODIJdxrhj/d6Rc8hXpNOOa El84C+2vcU4PV57O/hrqfSmvI68ht6FTIiOAi1nDlWvzfMi3yBHWcJ1n4UfX+4zTMp9PP585 KsZTartOvdt9gG4d0ony56Uy55Q3M77W2p/WhFDvs/6SMk3KUdJn2qmMUbtHPl+dEepEk6e5 Jsmj85yQDtT7jPHkevBI+C30k9f7HzH+e6x5rvcla67eB/3r07YvqXofuob1t4yDmOcgc7hk TpfgwErvgxc/Su971Dl7pN63qjmtDSzPpqPwAvrhObf0vszxs4/njCWBZrUrwjvzjGEOU/eY eJJnz4w3medN/lYekr7ZjJ+cut89Nden7KBNWzsiawevtA8w+/K/xuA9PvOcuTZ/ZOZFpG0A /sjayx9ZJ+73PzfmYA7Llv9gxo0Vvh5cYmMA3+AfMx7M2B4+NzfIwXvp/5dPpK1EuRL69szS N525AGnbvZSupw2Q5+K8mzUePX95ZS7KhvCY9P/co/cx/+wpzjOqh7AmnrfMIWVfZIotn0fq YpdenzXPeibwc69vzMeW3rdlr5QnyRdTnoE/qffBt7V/PaJX3tRN3XPup66f5/+U4Vbn/y0+ 3q9Ep5wnW3SaNZXAXffCuNtJf+DopD9wmfN92kpT79OXqC/fOj48u2c01+YZeEbWSR0/e3cc ZX94pq8v61JKp9a6QedL+4C+BWlBHpFypvuecUQzV2fGEWf81pT74evMxX4I1kvQt6Zco/65 xz/0VdzKPzJu2lhh+WfORxxFxkqeNnmGdYLso8z1pNHJf3g+5LT//TaU2XzmKTOvbDUO6Zu5 ZowZ8iZyu70KGNYo9Rnl29yLfXdOvPq8c07n5pNz2ovxPzLW45Hn7FG0mfwK+RudXH5lLArr zLpPvGDeSY+X4oVxf1xfP7A82zgmazNnzxFrtbGGGTcPjukXlm+kjSj5hTiQucAOzxvjJfUX pg4pzqUvW5uj+b7mrd1bJ2jaVKe9xvMk9+f/jMF78gfzR4wbu6RW+BaOpC2T9WKNuc/WHJgf 65c+DPnmo/C78HH1vi3/9oz9Nz4+c3GtywSOcT7zai04fm/cuvEt0rf8AvpW/uZ3eW7N2OhL 6TptgMikPhd63zzvoBVemYe1PtT7ptx5i96XcgW6ErwLPqpPQtsN6wEPZH31eWzRa+o5117/ 2vNuxRe3Yii9l7I2OAOewLu0QT+qX8KMj8/YwuSd0w/EeoPDj/RHfjU6tY7ktLuA08rUe/SH zKbe515MvW/G9HJO81ycd8gLKa+LizwnNlB9u9phP7reN3tmZE2A6RNmD6WB9PGkfKmvwJwb 8WjW5rO2gHWDtB+Igxl7aJ0B+3qyZ8qW+oCVr5yLtoDZazNznrMuxaXDXKaZG81agR9TztrC o7SlWzvTGjpp60g9kmdTblNW4z2eW1+Ztpppp5nDmg7we+h51kViXsjG9uozx3bqRMqSUw+d uHDpnOQ5WdPL+inTRnSU3veIc/ZIvS/PpRW/0h4w8UI6yByulQ1vhReZnz1rWtmTh3lZt9P8 AfCH+XFuZk6M8VHMSxvRxFvm5b09d3JYy8s6MBlnnvbGvHbaHNVfxadVradrcGqrNsDKR+D+ /PIYvMdnK5tC2rrPyVir+JiVzWhvDls2VONbXkmuKTzPRjzlSfBU3751IqBRaZn34OfWjbUP C79x2MPFmk+ZezTtzLzOGMRVbPQ158RK70Om37JzruTOI/S+aU+e55FyRdKreojnkfbtld53 6fVX590let+sMZU1NNj36bvhPvNePEvynvSxHBlHOW34W37JjPVkz/UDgavGknEuHhFL9hXp 1B5Ls17GPEuT/sDRW/U+7RB7eh/PoQ3is+l9q54ZWZcg8+e0z+hnnX4dc3LZH/bYGnvWWs8+ XNab5zOub81L68daF8gaA8Zo2U8a3c96nlyL7yqjz7hK8z4zTi37q/Ls5iidG/ZVt86pflHt KMY/KmfJ0/bkKf0O9ktQ797C+dSxtJFlvKZ6U9ppVsMa7qt+OdBF1nSxRseWTuSc5N/G6Vuj xfqQ9nvZmxN4YW+WS/sS3aP3XXMOXnPOHq33nbNTKdPLE1PvseaJutQeXjCs7W8/jexhwzqB r/BVeHTirHWN+K0xjsbJzLiAibfWcRUnPXdYY/uBMh/2Bhyxhqk2x5U/MW2OMy4sa5Zkv59L 925LZsCeOWkk7TWrMXWuPMfO6VzTZw0/2vPLb81Bv2PGtyjXwBOUa16tXnnhOX6EWaPR2rXQ pr4BZUhoFz5ir0rONs5zfuewFyzf4SyFB1hXS5lSe3PatLK2/jV1R6r3PUbv28qlslZBymr6 bjyvZrxD5pNnPb6j66atYj21m5nPkrGeGUu2V0+kdPpDH8yKTpFvMl+ket/7+PpWNX/gIZlP mXRqPF/Kb8aFwSOhW/tBQb/2gkYmYtjLnM/sPWYPL37PsC67tV2s6wk/tvez9S3Sti7OZWy6 9iO+b39Heycov0Kv5wbfg2faXw/cZF48y+z74lrN+CnjTuUV4Li9++xbcg7nMzbMXEZj8lx7 1o37gNurkT2boRf1anW+rDOzpfdl7Fjqoep86u7ZH+ySOYEf4GDW4X9Ef/SPpvft8SvxQnxT 54N+rXHJc4FT5/aAYT90/exZD5P1Yi/syW5vCejUnNvMjcjYAG2A1sgRR6Af1pN7s//gJDTA /Rn8zXvcAxyxjwzrYA1m6yh5z7Q5Zm5t1q2dPXku5eUZX5nyDesG35qxTBmfLb1MG87KlqzO BX+eOtdWbQL7UE0Za97Tkb565S/j0Vf1ytvPoXrf7G1uX07oUluNMqTnC/ThGc7ZB0454C98 hj3G3qnWw7V2Vea3G+di7sS5fLDqfY/X+87pUZ5ZmUvlfVKHZy3h8zO/+RF8Z0tPNX4LHpqx npmLvYqJeJXcr49Gp+yvOSPV+97H15c1l9JmP/1oK50vawln/XTolr21Hou+OgZ/g1t8xt4q y6kDwofUXcBRvsPvmB86APtm//BVLo32fuWorPWqT8u6JfBo8Izn3xt8J/1f0AS4D9+01ok6 svUTxM8Z4znrzECb4KT1EM/hfJ47+tD1jdrvnOeEhlnjrcH8WQvWknsyn+wlqFyP3Lmn9yVO zNqE9mNkj3km8GtvPqyLtVvdo1Xf7SPo7bPpfYlv6eNCB4DXJm+/BC/Yc/Dcnh7oR9pJsi87 3/Fsz7xDa/5kbIBzs2aMdXuhc3CW+7v/XJe1ZWjv4TPmZx9R7mkfIuiPPTMuZ+p+kxfcGxe2 V38s/f7SiHTievh35resekSZ37LqxzXz1c1PyTya5EeZg+vIOV1TJ63w9SB7cSP/QP/2goae oGF4jOePMiTf4RzBduR5C09z8J45BdaTM89kqzbRrK2S+RzXxgZW7ztG79uqkWl+iOuYMvbK Lv6oei6rM3avXkPWoMlYz9QJzEM8qm7gV6NT5oeMYx+o6n2P9/UljWaN+FkvJXW+9OtkzT97 7uk7Yu/AD/HIkT3Y4a98l30AB/k98ilDXUE9zevwe3HY+IGMq1LvSxkGfON79vRSvgRPlC3P DeYKrjMfnpH5Wb/CWunJ05J3gvMZt5796KyPcSnO69ORJ9tfx/7aScOs/9aATyWN68tRD1W2 T9zYOoOklazDbB1F+AxrxjNfMif7Rzgna4hk7cXqfT/kV+aJaTsFJ6FLzlGei9+yj8yXa12C F8gw3BseAT4wF20U2hGlw1n/Oukg7X5Zr5dngR44N8EP6wm5/zmYi2cOtAhOQSdZb9jat1P3 W9XM3Ov1eg6/Zv5E5rCknDjj4rP+VdbFSjvazPHbqtOw0j1X9ejStj7nkPPIdcrzdCVLN8fv 6+p92Q/a2BfoFhrQtuu5Cm1By+Cn9kTja+QlnjV8xvfgPWnXzRrZ2pLyzJm1QFa1u6v3PVbv y/qA8iPrXFnnfNqhsj5H9kc4uv76rTY8z1l9CtlD4Fl66kel01XNnjx7r/V9VO+73de3R6Oz Pkn6E9Sn1DlSfjMmjPVRbmed9B+Zx2aPcr7Dd8VHfYH6fvTzqZv4G3Eu6+4zn4z1zLxS68TY E14fFL/PeLK9YawZOMA6ZT9D7q2/MW3o2rL0ca/iwa+Nbea6yXvst8Xc1JFzvawVuhrSOHTC XOCxzIcBnbBXxv+e0/uStvWp6KvVZ8Qzn5uP+KKeYd4vfOxIWvtset9Wfjx4Dj0xT+jmUrxg HxIv2AcG8zEmOX19s8ZS6hpT75JngB8zvtj76ld08B6f2e/E/iLZ12XmI2de4aSZ7O15jc/v XHzltEGlrpU1bmc+onx1VZt6dZZl78C93L6sT72aQ/biyRjheUZn7YLm+H1NSNnBMwuc0A9g Dei022lL9Gwxpx7e5uA9r2cuM2dZ9kTJHIq0f858q1t661Tvu0/vSz1j+s1Wda7yXFj1Q588 +ZEy9qrH/FZOYvbyO8LPXDr9fh11TObwinqfORdH9xJ7b5y4lkYzlm/6E4yfRPbJ3LmU29Ul 1HGUH60NwX7wO2jOWE59hcaYqQ9wbb6bffOM9Ux5L/NKresHjrDXzBs8ha8b53xuWFsCXoBe A5+yD4p1JVIGVxfKPiCzToJ+rGtrGU0dCz026xTm+q+GPkb3wh7c0Ic1S/ncmhWXnEHSYfY1 hX+yl+wX+zftR3M+OafkO9IvuFu9b1vvm/w1dRt4VtbivGQfkv9b24jv6QeecTyr/NaMSRZf 0RPhGZyV1rRlH5JfrOoqyTd4BvuMIqNl/eGMN8m+htqB7u3tudc7YdYpz9pm2dfWHjb2QLUH of3Ts2/Qqo+fctYluX17c7AeqjqoOqE5fvfI0oXPqfdlXWvwD76nTWba7ZQh0263qpPN+8Yf 5ZmzsutmXPuq18AtPLl63+16X/bdXvUJzzy5jP1f9W6Ah9q7QV7z6DopuTarGqSJe7On/Wre j+g58ZnpdNa4eLbep1/FnAttn4mX2ft3tVZHyqmPsm9s5bKufH3Zu5I108+kzpe9vVgX9Qh5 A8M+jWk/UJZjPtANa6tvCPxMHUa/tX2s085uf4G0s6v7MW9rTFrfEJ4+68XvjawlDw5zP2MA VjryVr+XtGUp016r9035MPui6EdMW81quBfuzZ7t7pIzaK9mKXsnTpybz5zTI+joM+p9W33g snal/tNr9yF7q2Z90b18MnXRtOlmjSXwVXvf9Ouuzhz5xqqurvEm8Gnoe+Yma1++N0bn0t4J 1pdZ9TUBh7IPhX43bVTun/LErFHo+Tt7fKxiqrLGsXOwrwrz4H7Zf9f+h4nn5vjZk/rSehmF z6/7eYav7EXyknM8fEv23uuLMs8dz9iZj1q977F6n+dEXlu9yb7bM+ZcXjzlo9m74b38KsnT sxfryqdgrGf2tNe+mnj37FjPj0Kn1td/Nb1v9tsG9/Wr6MPQP5G28anzvIoeOOWWVe3azOuz 3lvmZ5ojo09Hnc+a6Hs+Gv9PWc7+HeAj+5N1NNPvzNAPlT2zkr8Y6yn/0tafco997sAnBr87 N/gevwHX7B1t/cDU+Wa+2+zVrt1cvrnVs/IczhsTzz7MOIP0C7jel4xJ27eeQZOuJx+8Zj6P gs+s92WM3vQvZ6+6a8as1bZFe0kLadM1PgBdhuewnu3so3AuxtKzLH2P1h4yZmEla8yeKlk7 bkU7q3nM3kjn4iuzl+C0O2XfW3U/fXHZO33KWp7T6uB7uX3yppwD+GvPJuZh/151P4Y5fvKX uUbPjmMqPFfvm+f3ym6U5/8l8mnWG9CPsNeTZMveiL6R5071vuP0vsw3lm+rU2TO0PT1reLe Z8ySvRu0UT6id8MeDs74iZVPIXv5rWqQZo/oZ8cCfiQ6zRrhr6D3reKPzaMyJyVrm2dfgIxZ mr6vo2pTHOHTPrdv2Tcga3zv9Uq99PkSN8VL+Ujq0a5dyju5h1u5w6mHZX95no99zXinc4Pv 8ht4ofFZ5hKqH6/qsis76ZODL9gLy+e6Re+bOJ+9vu61xz/yDHoVOELvY58elc99r953ZFz6 lBsy9jdjPLNnQMZ3bNl0ndO1fdM9y6a8of9Rn9+MLZKPrWJ0Lun7dU3vhPSz2dvE3qasBa/8 r+4HbsmXWK88H1cxApfm9q3mYD9N5sGc7YOR+ucR9TIKX0P/uyXOKe1J+vCtLa7usKrbln1s pzxpTE39fcfofavzjrWxJp0yLvcyBmvL/pY9faavzxiQrPH4qN4Ne+ebOGCtrmnX9DmUI1ex Ne8Zo/oZ6PQV9b6sx2jdROQE60xaCwdc5X7ZFyDrZhinmHlUz9D/ptxirCT7torxnHpM9klV j9nyJdyDmxkXmjFfGV+cche2FvnXlD99BmX3WduA/VUHXA11vYzHUt+TB2df5invbuUri5fG xj+id8l76X2rM+Kz6n2Td83arBmruDfO8d+j9L5Vftgt9Cnf0L8G7WvTVceaMZ7T532kTTdz 3FIX3ctTnrY8Y3Qy1nMPV/MMuSS+UrswuJS9FNGleOV/+08wJ/nRzJNlD5WHjH+wRvc53XNr DuybecrsH3idPr+tnqOvSs+Fj6MvzlifrBVhv1h4K7SZfYTlLymXpP6wssVV77svhid9NOpm 8H/uAf+xpzF86Fy8PdeefXX43qpP+3vHSRoHlzmKK96+ivWcPW9WMU6l0206faU4z9knzb6/ 3APdj/uAq9adhI64L/tuvfqtOvnGhb63/jdrEiRuZx+8VYznVjzzI3D80nizrVjP2c966n7m 5oKL+vzYYwb8yMH/6evTz5f12dX5fvntdeZZTXl32oKq930cvW/aPrA3mKeWua3WppnD2kbT j72Kib4nH/kRet+WvrPiGzMeedYp2epFfsu5NHPtoLPZ19N5rfT32Xs3a8htyQbcL/sSr3on yGf039nj1HpSvPI/7/O5cePncvyMfZ95lsonefbOOqE5B+tU8RvWgbnzO/W+zPFb5SY3x69w hBxpHT/oV1kSmgKf4WH2fUv7zZ5ccot9onrfZbXaOE/gNayPNffsacyz7/Vzm/EP9nsyBiRj JJ/RA2+v/+CsVTljPTOm64jz9qvRqXXDn633ZXxg9jRCnmLe0AB0xjPbaw4a4t7M197Isy+2 tezBCfU//QPvoftt1SSYckvqTKt6EeboPKN+0ZbNfVVfYsZfpr2J50S+ssYB+4/MxO8d/G9u H3zReCxjFlLvYxgTm/xS/WCrLp97Ur3vtfW+qcdgpwTnoB/W3h4JWStrNVax4LOeScbSv4Le dy3f2Kv1s9IdbuV7ntVZg3svfmHWwz1XN3PmJV8aI28NzYyNR8bhXqwZe8gr//M+n9t30Dy8 9LWlLXx1Rm7pnup9Xo97gd9ck7OLecA/uA/8zr73xsJnX63PINMUnitHmseRciS8Dds4+A1+ cfaBm+ApZwn4bO00aXhLLslYu2vkkup9+72ZtF/DN+y3yu9ZJwY8l3uj881+OvY/kBfN+Dlr JWYMyDP8ZHs57Ku86Yz1XMWzZA2HjxAX8Uw6VR56dv++jA80B5XPuA97zL3AbeNlwF/tuMwV PFEnhLagCWmF+7J+zMEY6fT9PRLXp44hXru+yd/Ul6T/V5EBpl2GtVzVk5+xnsbtam9yL3km nh26Zj8Z4Cav4AX7zDWtgZB9ocXvVYznpf7/6n2vr/dlrR75vH0TwTv4iLSN7mF/nDkyHtwe qfZVmP7/V9T7tvjGxNEtG99WH/J7z+qpi+3lHW7ZsVY5flPvuzRGPvuHGs8EPwFfkHPgn7zy P/fnt8zT3OGVr401t0eL/Wz28uqVtXIO3Ms5gLfMA1mO+YPz2mut63ntGhUKW34D6wmmHAk+ I/uBw/A26FZ8BPdTd5i107Z6B93C76r3/fD6GacPD+cefBe5VpkW2x/nALyEc4nPpx1rxryb N6weaZ8hcyXeM6/vEp+CPXqw82bOuLGel9Rsf+VYz/ei06k/ZK2LV+nbriw/9QX2WB8R3+dM BBd4nuwLoA7BujAnZB7OWuamjJi97rLu/iNxZKsW3ZSRWNetnMxVrYH3jPlZ2WX2bN4Zd2bM k75beBT0zDNph4evQee8gtvgnjFZrBH7Dg4kjrtW53yjM8azet/H0fvMDdNeyXfAHfAGPsae 6eNH9lgN48GRK+A/8D32HBlF3S/9wK+i9yXfMOd9i2/I7+2ZkLbQlS3+Xl63RT/g4F4/Idbu XL/nnNtebl/GlGb/hqwdynmnzAT/5BXeMGOiZo5f1tO0ByP3N94m685t5fZlDWZzFKBP5sG5 BP/TZsscwHvtY+rtzfErXHo+b/UPS78BtKYcCT6Cl+Ch52zGHU9Zcqvm3q0yd/W+9XknD+Mz 5BljFpBN4AfGLWS8uPJR6nwZb64OyZpZD95+Ps/y9a1se+aMw3fTjph2NfOFzvVofkX72CvR qb0lXkXv04fDfbIeNt8zJ4w95/7gg70BeMbsE8e5iRzGc3juYkeAv3CW6+vU1vEovJ81+cBp ZIoV7avLrGqUPFumv8Qukz3c3b/M1TTmif1nDcAzZD+uwwA3kHPYq7TNaxdf9brYygHbq+9b ve9j6H3p+we3oHHWH5zQtqOPn/NsNcCF9P+DF9nXXpuAtV9eSe87t1ZpL1rZP6wJmefhETEC K74OHc++NKs+stfwtCkbpn45e8hkbp/nHfQMDpgDwCv4wPvO0xw/7YtZT9NYKNaf+/OKDjZ1 z1VuX86Be3Jvrsc6wTvA3fy99au0ccw43ZkHWZ9fYfoOrP0HXZ6TI8FL8Jyzwxq30ELWA0lZ Mn0IyNvwumlfvebMqd73Q9kvbeXaoYx1y9go/maN4FXMxVyYrH2XslfGjL6Sr++cTyHPE+17 xnpq39SG+Or2sWfT6eyBzv2tGfMqep9yTOp+1gTh+1u1ILNPHNfmuXkG1g0aRSYDP1hbZCH7 F+v3OzrfL2kfGTDrwM04pVVO5sw3mbbxZ+XgnrPLZB0p83B5VmRRnoXf6IO1Hg+D54P/G7vO fnEOGLsu7U/72Kr+zV6t/+p9r6/3pT8341XYZ847zj1oA5yCvqGn1cAeqG8ZWR5ZwZ4w7D17 l7afV9T7pLX0MU2+4VzUXfbmcgQvuKZW1Sr3cFX/PeW2Pblp+jwzt2/27+Qe6L6sA6/QOe+b l7yV46cswfysFWYtBfNPZs/CzO1T9+Y61qJmD3nlupzFWZdVW722/mvyIAtfW+fTdwA9QkfQ 5IwTm3IkuDv7iaz64ipLZl4V9KEPYfb8vlQuqd63fd653tqiuJ+1EBj8zXt8ZqxA1r3jddZA Uf43b3nVx/VZoJ7geQKftR+hPgXjvVaxnnt1wl6BT74inUIr9od4Nb0v+79Nvc9hvX/P7uwR AF2xXqxb1gWFVtX9rNeW8V6P0JXU+zI/RR+Z9VD0dZ6L13qGH/uSWE/307irjNHLnGJ4D/gC fcOzwQ0GvNM8VtZJu/iqXu3M/zKXJm0bW3nm1fs+jt6XtZ6sdc/3PAuN+4bGV8NcUuiIfYOW 5IPGuktP9qt8tt4nra161s0eDup9rJE5weoM+Jlm7+8jYsNnbRfoGJ0K2l7VeVrR0FbNmdT7 Vn0skndmbt/sV8935DWsAXKlZ2v2PsocP3Ar6Qk80T8MPzG/Hpw9l9uXMUjck+eENnllrdib 1F+t7WKO37lY3cZ6VudTvoJuwAt4BeeZ9gnOwT050l4m5k6pN6Qsab6NNpEZL5g+hGviBav3 /fC8m3lO2oFm/XP+tv9L1rubsX4r2Qteot53S//nR/oU5lrNHGpjO5QFJq9f9Tt9hV5+r0in 9qN9Fb1v1oHU7gHub9X8V/8zVsZhfKh9lHgecz7U/ZT9Mt7rKPzf68HF3k75aOp9ma82cfoZ Nt9r7TKT91h3l2fR3wINZG2h2ZcG/+CMpxLv5cOJi9mLVNvGXKvqfR9D75v8QBvQKu57a7Bn afvhHEEWn3EP1vfMfkLP1Pu27EXS2ayfm3pf5qhpA32E3rfSyfbmN2vusvdpo521l1axpLNf ROb2TRrl+vZ83dLboB9z/MxDTl4FnqizqTfaQ1G/6yq3L+M0uSf3hl/yHPZgMl7VOXhuZZzo Nb0OC19P54OmwQno0DhkcJ7zDDzNOLGsk6beYGyg/MyRtraUJaEL7SngpD2gr40XrN53/ryb sW7p41DnSz/f1PvS3wcOKPeyZtmb9Gi591bZclW/GvnPs9fala7Lqt/p3Itn9r15JJ26z7fS qfVkXknvE+enfd/8PQd6EesDj3CNtJuqd2gzMT8InmIveON4buVdt8hH2sW39L5L8nSeFesz 7TIz1jPtMsZir/qt2H9Nmds+a/Agrst+ZIy3/r6M8xTfjYdd9YPOGM8Vj6ne97p6X/ZnnP5/ z0L9+1sj/f7gCPiJvL7Vs/YV9b6VvegWvYo1P6oW1FbfpemLu0QvhX9MvXSvvnfqStaOUe+b +YN8n+eH1zBH7aszRiFz/GZvY75rjGbGiU7dU71vVU/VniPwS155FnXYKdNo55z660p/b6zn 19X5PIfhXdpKwaus/WfPkowTS7/BlhyZ9va0mVujKHWHW23m1fuu0/vmWaecK+/JvUxdIPtg m2ucdvfMc3imzy99CikrZ+1mc9qnTyF73Gc8o77MZ9WrmTrfK9HpK+l9q9r/3H+Vz8Mwx5V5 oCPx3cyVMPYmY8SyttHK7n90L/QtvW8VD7XS+3jOV9H75JVplwFftuwy8qzMMU1/vHFL6Xe2 fuGU8zKPBhzMuC5lbmsxzLrn8yyo3vcx9b48C/X7ndP9Uu9j71Z6n/aBj6L3rfplvrfe98g4 VPPft+xLs1eE9oCZ26etk9/DU4whn71HZ46fuRHobdyT61gXhmeET+zl9vH77JmUtWGYB+dN 2v8yTkKemTFMWa/uVpwqfA5Q54OWU5a0h7c58dAAfMA4MXuF7Pn3MrYQPOZsAQehBegOfM36 CPfkyFTv24/zNF/ZvsfGu+XgvenrsJansTF8nrWwkdNYN/i1tveZ5/csPWn2B7KGdcpl6VOQ T85aXOfkv49Ip1Pfu5dOleNfQe+btf+5N2tibg7nMOc1z8XgXOU9PuM78AvOXNcvbSEZ/5q9 wMwH1e99pM/vljjPV/b3rewymdsz7TLK55mvojyG/DXjjfdqxpgDM2vGTHvPlCNX61S97/X1 vi37p/qeOl3mPayGcZ72ENmy97xqnOer+vserffN3vArPWmV25cygHkN0Dj7aU7Fqg9D5vil bdBa0PAH1pMzh98lT9rK7TO2gflDk/aC4P9Z19lryTNXOuwz63oVXsPXp7wGDthPUlkSXLWH N7IDOHVJPOeUIzlT+T3nKrTE2QIum5ef9dBv1Req923ns6vzuR+eYfAD9sVhfRc+N98p/YCe lVkLG/5srSl40EoveKbPT5/CXmx/xnqu4iv2avp9ZTpNn+4jZeBr+2ElfVt/lu8xF+Qp+3Vx njP4e/awZP/5nWf5qratZzNrZS1i5jbjgu/FlWvzdFLvW+X3vYLet8XPVjm48p6tPpviC/Kd fUz28gazR4T2/Vviu6v3fRy9b9Z1gV/YzxN+b22XrQGdWwcbWdwaj555Gf/wSnVdbsnvO6f3 HZnft9L7Lo3zPKf35Zk5z/+MKZC3z37Ss5cLPIV58rrVd33m+GWvSPu+m3ePDJI8aS+3z/XP 3u/8r5wrz0memXbPjFnlN3vx64XPrfMpT2kfNR8C2gBHwXtwafbw3pMjPZ+VI+0bkHWwwGPk D33nW7LktTJ+9b4f6n2edVm/2rr0xrs5+B/+MOPdUv8zN9Brmee0lev3zHjPLXunNjrXLHv5 zfoO80x5hqz86nT6anqfMZ6zFoh+S/bT/HgGtlz4hXX/7YeLjOeaZp8LaWr2V8rz+ci44Fvs 4qt6ntaofHZdl5VdJnNw3de0y6xqk2fckrgJjmQPyVWd0JTzVrX7Lq3nVL3vY+h9Gfdt3jLP yxnHPkC/8yycA9md67M++m7Ak6xplrnOH6Ge56qPwzV61ZHn89RLV3WKV/l9W/PjupnbN2O+ Z194z8WkhewRYZ9G9pl7TP5ivObM8QPH4D3gDt8DB7g/z8c9sq/MXm6ftmfube0q/s+6Bcnj kmfu1atqjt/X9PVJF/B4+BNyAXQHjoiX2dMZ+tjLC5p+A+VIe+xaDxdZC1ribLX/1z19j6v3 rfvV5llnTjpnGOsCr0C+R9bhLJMncT3OuuzxZk+/rHGYNS6y7seqvuczfQrso/k+7G/WwDK2 Pnv56SOa9dyfERvxqnQ6dflX0/tmrQ7raSP3+Exci+filf/N1+fZc20TR1xXdYatnLOja8Bu 9W3PGKPZuzPXwF5Sq1rer56Dm3FLW7Ge1vRkfYyBnrViLonxvEZ3r973MfS+7Ntu/B3fgyag H56ZszBjv+cAJ6E3eAg4Z21FfTDml6pvvHL/vj2+wVymLSR7vz26nudevar0R2Zdl5U/kuuu akfx7BkTaW5f2vKm79/8TeiTPYXe2ddVv8GZ4yeu8Tn3heZZe67P+mZd8b3cvowlhl/OmIbM M+T3mRe9ilvVR/1s21/heWeuthbognMIPqitWxzKGCp51Ywf3JMjoR95JfcCh6FH7p95Qrfi X/W+H14/5V/uYVwm/AxenvFu8A7Os4x3Y02SP9nf2xiC1CfRoVhrfqsNPmNfniU3KJvNMxh+ OvmkNd7Sj5OxEeDFe8d6fhQ6fTW9L89P+xdlLVLW0jNUH9HMmeQ3nJWZa5Y+1HNywpEyc9ov 9noPp6yrz1Pb8Zzfs2lzlYNr7NTMwc3a5NMebx8Nc1/AP+SkvRjP7M88eyxfun/V+15f75t9 iIy9g/fzrOAHe8C+gy/Gfs/BmQZfZK/AD863LXvYPfzqEXrfim+wVpNvuFbZtx3aeVQ9kFX/ vtRhVn3bt2ho9tpl/bfyh6dOyTUZMx864yO0k/Hs5lrMXoAzx89YT57Ds9a4KuYOHmQsyVZu X+IBz2PN4unDTV0+86Inj5s5fu3n8PV8fRljAz6sZJ0pS2ortbYduK0cCV5POdLeJ9CJdlnr bhsPf28sYPW+H16f11XfbfaFc4jfQ//Gu/E368Z+WSuE78OvwAd7kxqTIA7oH9MG/wo5cSub YvJJ7X4zr3pVM57vHnEGf2Y6fVW9b9o5PcPNP1U+yBqp5suv9I+8h/QLb5k5Z8lDjrCNJ38z ZmmLv6WPY8YtrfI7nnnmr2I9Zw6ufmzjDGasp/WErbfH/q3qrM8Yz1kjNOXbS/y11fs+ht6n TK/8ay1qZGXjvu3Nxt5vDfi/9RThE9wfnpSxSq+m902+YbzLllykjmx8+Er/kS6O0PtcJ66r /2yuE/PJel3TR5+xmPI0rrviK1kveFXX95zOxbXZiy37mzl+1kxPOyufM2dwlLU1Dz9jPPfi D9Rps2Zx1qtb9YDn2qu86JUdu/D59T5lYX3g4i+4k3JO2loyNzrzxbJWHvJo+g1SjuQsBc+k n+SV9/KQ6n3r66/qn8P/WB/3BZ7LMN7N3jDwYPYSXrHyK2W/G3mVOXHP0JPO6U4zzj/j8mes p3a/9BW9t43skXQ6/Xv30ukr6X3KeVmbf0uOUk6bsbSpX89+32l73uoldXT+xNSPzC1Z9aGy l8VqjV+th9O0+e/l4GaMQcZ6gsPgDXIjsqm9LNmL7Ac4YzynPDTx79zaVO/7OHrfrNMIXVuj GJzJuO/VgGcwuKd5pPCQFX98Nb1PvpE5aVt8Q5yYcQyPqAO5ld+b5/Kc25Yta9qZZz8X9d1J m+divlMeVOea/YpyPTPHz1oI6n7WDuIVHmD8VPYJ2uq1nv0hWfu0Ba/yDFOe0Va2d0Y11vPz Q8aOzbpnWSdg5oqlLJn9vYwdTDnSOLFH63vV+85f39oWyn3Zc8GY9RnvBk9Q9wMvZs3hrHEx 4yNmTPqz6wXnOZx2ReNJEt8z1pN9MdZzy4/zSF75kej01fW+abudZ92W/pExPHOtZ0zUI3sk rdZgqzZd6n2zN93Kp/XMM3/Gem7JaNYqWMV6wtPw+fE7eBYyTcbp7sV4rnIFL9V3qve9vt6n X37WabQ2vvX59d1ZE3ZrcF/1Cmu4aDuShl5N71vxjZXfS3vWtIk8qg7kyh47a1Mm/axi19F1 Zmz2qp9LxviII5nbp647da7JD2aPjlWOX9ZCSN0P/OOZuLe6YcZOTZ6UclTmY2fdoJRncg7W w0o7tjYP6zrPPPTqfZ9f71vZWWZNIHnBrIdl727ow57O8AXjxMy1gF/tyZFH4ln1vvV5t7KN KWdYn9IzzHi37BXAPfSNrXAjaydmTtyM9Xx2HtH0m2319TLWM3PHZw+d9/JhfiQ6/Yh6X+rt k77St7qXC8Paz5yQeaY+Ihdm1Ytq+iNnzFbmdzwiB/EIPE/ZdMpS5qxkrKf9s8E187P4LTKe +a/nYjwnfV+6b9X7Po7etxU/l7Wnlev3hv0BUtebOJLxi8/W+5zLVg7drJ2yko0e4SOSn+3V XVE3S5vmqq/61I2gIca0l66eOW3Xl+hc1uyZNcKzBqnxCbP/lX2TkZXkZbMv7Kynw7UnDjCH zF1ZzcG8wbRjG+P8yDz0wuvCVo3DLR1pxshnP8rs6Qx9mRf0Xvpe9b7t8y7tdlv6WPqtMt5N XcMza4tnzrWcMRJHyTNH+BRW8Rmpz1pPWRvZVs/T9+KVH4lOP7reN9c78yZWtVNWepXywqNy YbZq823ppSvb/aP6TYgvW+NSuwx7Yz33jPXULqMN3VhPc7WQeaCNvb7IezGek/dfEv9ave9j 6X3Tf7V1Dl4yLtG1XkXvW+W3zzjqVT7k9BFZ1zr1oFvxYi+Whfutannu5W2nvYa9NF/7nL1U vW8vLiLXXxlpZR/MHL9ZB0GZQl0w+8HKk9I2sVWvxvNwiwa27NiZi/PIPPTCa+t9s4ba5Jsr +SHrXUAb8ALOCH6fPZT25MhH+Ueq953X+1YxEfNM3+p5txfvJt98jzyne/Bj75xZ2cjuzf/5 SnT6FfW+7JWwZSc+MoZm2i7gcfaj2sqHSdrMHN/Zm+TWHvPai5RFpm9kxsBdYpfZ67eSsZ7G r/NM9kWGT7EH9l9EfjwX4znzdy/Vdar3fVy975HP+Gp635b9cK9m1aqPXNa1vqdH0yV2WOl9 VctzT84w59LaKz7vqu6JdqCVLJh50POsP8eHWU/z61K306/ne9lTdy+3j3tMWXAl7656E+7F L71KDYbC+/k+0l6xqgM7e7pMvAS/oCVoTlky805XcmQO5YEZL/HMPg4zj/er630r++BWntNe zx/5yivUj1jZ6RJHVrwy6/1N2+Kj8hYfTaezBt29dPoZ4jyviTva6o3+KH9frvEqt2TLF7+S 4cxXnXFuq76M5/Q9456sd8D6OTwLLqnXvNdvhXX12bKuZ8YxQxPgGs8GLrEe7JkymPb1rJU+ Y7ivlYGq91Xve3W9L/HUOOqsmct8Zr8EZYdZ1xo6yZrIt9iLsu7NzKWW16a/apXbl7bYrE2p fmaM55b8In7Yk2cVF7XyB+/V7VmtZ/Lh7KukHusZ4nl1SZzppXOY/eCzVt3sS3z0OVV4Xb1v JdfPWhEr/3rW7sieudCG9p+VHDltwuaTKRecsw2fi7tQZktb/S163yr+aU8u3soPelW9b5Wr nM+38ouZR7SqJZL4cUn9xGfyFdZvK19uxSuTFz+6P9tHp9OPXM/TtVbv2PMHr/D+PfL79mwy W/JS9puYNgzmyRqCF8pM5vpuxfomjqjvaVu3nzHXYWTNw0t69Zx7NmM97eVnbxL4OnsDf2P9 2Svkpv/L3rnFWrtedX1+u7ZFoXSXHmgt0g8UaTnIttRCKZUPWkvB1m6hSKkniuVgIFFrPBDT SDUaUqMxgeiNTTFRYwSxUdMrE+XGKGrQBOTC6I3RxMQL9AIlUbfvr2v+m8HYzzvnO+eac613 zvX7Z//3OnxrvsfnMMYzxjP+jPldH4vnkJynrs+Z9b5DdGf0+y7X75urU7I0z3PXGvXa/L6+ x6/m8NRcz6pP2n0Rrjsxv9G+yH31v/K86v64vD/eA22ua7eM1q9Ge5VrnD5rTrXmya69ffW4 uzTu6vrukr3WfW2c+aLyQ1v2+lsjTZnR+x9pH472e6f2etUlTvx27f1cnCeOQHsaxRHm8vhq HeSeK5R2U+3CakNmTZjzpjZWamfVteFuV9Zj9DyiMPZH6pFE23qka9zn4J4zwLNIXCR7hGPz 7tvjXWuHrKWuy1xdrro+lueeZ5kcidgy+DqjMbn6G3XcGuUR3HeeZ+y0kZZr111NrmfPi+96 OuesgXybftr3P5yzn9Yadmvz+3bp96Vvpy9z7VkjrrZI1gT6mviu9Y5z1f85ZJ9qz4+q8z7+ Dm2Z8S7ad6lpWHN/6xhXx960D/6W6+A+eS+MWYwrHIvvUx+2+n677MI5vZW5XM/oY9G2eP67 9LFqjueo9vAxGi36fZfl9+2r67Jrrl9S36XPM2vy++Zq5va+Vfe89Zgf8050oGgfPHuurdpJ /bn0dcSMs7EveDbMT9wv76/m3dTnk7ltX/5N/L6qxzPKH10yV8zVeNq31zprVLE3q5/Xyb+l fWZcmNPt21eHbC4/peoSj3Qq7mrfiliH37e0jtLI78t6cepc1Pm9xgiqjcAcQvvivIwXsOrh RB9lzq/rtmglx+Z4jGn09Vrvvtrz+3zZrIHTF2pd+8pe07nea2zHXg/wvnUc0tf5e94380n2 eeVesm7PO+L8+ArMPXwmtsxc3v3a9/eN5r88w5E+d/Zepy7mnP9wrlzP2/TTvh+/99P0s9v0 08zxNQa0Rt32rsGY+FbslYwlo/EDHztxtGqL1L1zvT78udt91ySpaxe1Bkpdu68xP9oyz4Tn xngTDQSeKfeeMS/PpuZt1mfF++FvedeMJYwVPDfeO1/5mWdQx5h9/aS/5663kr16qYVHW+/6 WPh7jFH0jegn15p5o/d1rH2t33c5ft9Ix6GuefDuudc+1++b+2OvrFW/r7fVUd9inqjriNl/ VvfCZr2INsuz47O0kdrH43fluYSx3fo4y3NhjSz2RdcIzvsb5S7V2iTpO31v3y5N84yNNRfi kDF8bo1qtGeSfoaP972N/K5rU+zb29f7wWhPNNfQ9dtrfvvSmKK4Loz2+e7qG3VNpOa80Tb5 bPUhooETPbhqI2Q9mP7EZ/hK30wtef42fTdjxsgWjZZq9MYhx+BYjCWMl/RBrrHuDRlpb9V7 or/Rb/g8x+H6OG49T87NdXA9mSuq3xQNhMQc71u3va7X0dexaTNmMwfErucr98g7is/Hc2S+ ytxQ80G6luouzdO11IsaaSMkL75r39Rcz9RA7mPyIXlh19BPaSd1f2C1ddbk92VPW95b9rTR J2nb3F/tz9wb90l7wB6kX/GZxPoyfhyy3+RUOld9PWCU0161Vvr+klo7gOvlmdOX8aX4DPfK mMB1YwPk2WRcCPmZZ8U74G/4W94zz5TP04/IDeDdRBsy62d1L9C+e9uXx5p1mVojnfvFbmV8 4l0lH7RqN4z2vtb8h0P7sn7f+v2+0Rpv4rzcZ8YDjkO7rnN95665v+5jTd7E2vy+rmVU1zx7 zK/q2tX1otTPje9H22UcoP3zjPJs6BOVsdtoU9wT7SvjLGMQ7yT2RWqu1DWr0furcfrMSXVv X/JZszei58j0WPAhY/hoP/KcLmL8vu9r5HdzNaHn9vbts2Vq3dKq336IPqC5nteJ2l521VKq sfDMmZkf6roPfSTazxkf+ZrcH8ZU+iDtkr9lvGG85SvnHtWVr2vLjBmxNRivOBafqaTfcWz6 OfdCXIZrnItRVduQe8KO7hpnjGkcl35Rz8X5uQ6uJ34T1x3bmXtPrmmPz9yl31fnu8Q9GBMY 16Lhxv1wL7Hxudc8R54DzyP5F3Ucqf7zqPbXWm2HuXqlva71KD+i1vo6pZbRJfbTvqd/bX5f 9cnSt7GlmBe5J+6Re+V5cF/8zH1y3NgirHXQHmq9n547GR+7a30cUhfymDhw34uYmF+PTyZv KzZO8j35d+4NG4pxhzbCs8HW5N0zDmSc431kfMhYy3ui3/AZnhfnZqyAfJ8xlOMkzrzPp9pV K6+2+apJXGuk075g18ZK7GJU2+A2do9+3+X4fXX9LnnOGQ/S5mnX3a7oHM39Wa+usb9RjaL7 9Ptq3xppNHHOqpeSvlP3xPJcuT7ugeeHjUVb6bZEzfXmKz/XuYXxNxqb8fkyzlb7oq9XpY3W vKWep5v9Prv0zLNHZWS7LN3Dv29/Xdeh6H5f4n2jmnhL43B13+a+vYwZJ3fVDL1vnWVxfr+v 5gqN8mm6rmXmh/R9+hFzBH2XPhxbqvpIfE+bYlyOni7zInMd5Pt8NjYlfSjrRfGhGDP49xyL PsHxaOMhx6ENR7uJsYHxqepoJuaeOkr1npL7xFzM57mvXF89D+fl/Fxz7KOsFWY9nPGCPnvf fl/mk/T12L/cH8+fd5574VjMM9wj18B1MwbiC3FtVTt5lHffc4BPqfVzar9vbq9Dtdcy/4xy Pe/q/o7tp8nnOFc/rfmiWeNek99XY93p2zyH6LxxXWn7tPncM+dn3ubvej3I7BHr9e6yHpDc sa79fa4c4BrzS55RaiNw7Rn30l/TPuL/xPfD1sDe4fr5bMa9OjaE9VnRX7hfPsNYyziBzZK6 mtGL5LqyF3aJ7Tpq87Fl6HtVb6XaprFr4gvWWul1/qrtjXvlnmoN+ENsa/2+y/D76jpQYt0Z D2hXfJZ77nN959zc33OZs49tTX5f7Vs95kdfxgfg2moude1f0TXi+fE3+A11zOD58Xx4NrRn 2k+YNUSeXcZZnjvjBu+B9xGfr9bZzHur+YmMATVnv+9dyN6+vk7adW5G+wFqnct99ZgP3YeR PM/q92Vv3676grv23S2pvV7ngNEYWPUq1rIfR5w/5lHbC22WtjCncTJaK84cT1tlns/4yFfG Ovod/8Y4xhjBvJJ62/xMG6UPJxaRegDJJ6I/0X8Tx6try/T/kGPRvxlLGDexZep4UmNUtY5S vafUhWNs4TlwPI5bz5P17MwV3CvXlzhKcuQYN3o9uvvw+7pvm5rn3Bv3wvPnGJDv+R3/xv0z JjM+pC5ecsUPWYs7xp66q3h3z9HoNeMTUxjVwtpVD+7a+2n281e/5i79vvi/Izuq69cn9slz 4N1yHtYzovXGffE9x+JaGTvoIxk7as5v953q/sHk0/J8DtH+PkXML3Hruhe37pXpvl/qevNs eP78HW0pz4f2TV/g+dDWwv6sGEd4/rxf3iHM+Mkxoh+SNfkl40Bt89WeGuki17GorkPF969t YVdOwrF9WL9v/X5f1njTZ+nP3GvWO+jvzFmjub5z19xf9XGyp21tfl+P+XFtiVNlTqH/pjZU xr2sq8T34/nyN7ThPqZyHPxI+gHPCPJz7LaMHYwRtDfGz9Rf2jXOMkYlX7+PK6kpCkd19Ua1 /Ua1Yg7VtRvt8avrx3UfBu2w+3232dvX+0KvVzDSKsy4P1eHjHnEPX7X7feN6sIlNzi2b3Kh +7740dhJW6dPJ9cHVl+MPsVx+XvI9/yO89FO6WtZP2O+yX4brgvblP5b15axZTlGyHjKcXs9 tzp+pQ5f/L6aOx4biPGM++I4HI/j1vNw3swVXE/fG5OcqOwznPP7DtUVqu9s13zX9cVi/9a1 Ou6N+2Ls5VnyeZjnyn0zTvK3XBvjbny+qkOaHMisoc6txZ1r/9up/anU8aj5LjXXM/Za3ft9 Tp2KtfbTzBE1zrkmvy99uz8H5jquJW2f5wH5Pv4Lz4rjxRZJvm+NK8V+5O+y1kF7YP7s2lZL 9fBuE/NL7brUxqMdVxsuvl+/D8aF1MTEPqAt8S547xnnMj7wFdZnlXGWZwuxXXjGfD7PJDbU UpvikJqldS2v10kPd9Ulu23M/tL9vroueGl+3yHz4Gg8oL3Tdvl77ns013f2uZ/2nfomiZf0 fMM1+X1psz1XgOtnzsZvq3s6ej713JhR7Qk+z/OhHYX0B9o698Vz5Hlzn5yDPpm9uDVOX8dZ /i57FlLDs9anTm291NXrWhVL9vbN1bjc1R/37a/r81L8vlrT5di9faNrqGNlrdOaNbLRHj/a ZK9n7B6/60Xay0g7k/affXGjvRQZO+MnZezMuMn4CPmZtkefot8xRtDe+Mpn6Bvpy8zB9BvG ueSDp7YIfZG+lLV4PptjhVwH18v8xXXVvf3d50u/q/NBrQ3H52PHpEZcmGvnOrie1EXg2WXP UPLYqxZpn4/m9EKX+H11bSfzXV3P6vNdfFvOxdjH+bgXxl6uK8w74p4ZC/nbavtWvyK+UM2R rWtxma/OqW1+Kn9qV8345Hr2vUG3qf9+yf20ayEc4/f1GntL/b66jyH7Nub20CeeX209zsWz StvnXuv9jsaOavPUZ5q8aXwhfIjUNufeE+s757pprRuYNe6RDcezr/H6uu+t7o2rY19/RqPx oT4rnkc+Gx31+H2HxvvS5ruG6D4txbk66aO6UzW/6TZ7dM/Z5u/CJzp0Dlqb37d0Hkw76LFu 2tCuub5z19xPGx1pyO1bpxppCZzT76u5ArX2OG2Q986YypgW3y9rvpkHk//C880zTC3d2BN8 lvYf8jPvhfEj42ytt1vHpOwnnBtn8atom4x1ySXqubW79vZ1bfq5WNuStt/312WcGu3DyB6/ WsvzNnv7+li5ZE9jxvulGvXiOmN+dd2Hd57ahrRb+hl9NTZl+mft991Pou/T1sPU1I6NkHpr WWtjTEi9her3pYYAbZE2HBuGdpoYVOq2VXKdjCVcVx1PMsdlXTh2YfyizAf1vjhO7JnKjHNc B9df7T7Gzuybit83l2eQc/Z9tnN7irvft6++Y93HWOc77i2177gePhPmHXGfXBfH4jNzY37i h1nfT23sXsthjXkDS2rGz+V6nqIW4KX2031+X9Y++7ojx87eCtrj0hqwVRuz7qHfpcWbdh9b O3ZEbfvcH/cK+Z7f8W/8TW33YT7P3/H8uGbm6dQF5LoZt7Kvr9a8Off6Reyd2HC0ScaRPm7G 1hr5s7lH7p2/yViX58TXPKeMD3lW+UzGg6wB9TrrS/Nea5vvtQcz1tX2VMf1ro2VWErVe07t hth3x9ZdPWebP6VPxDlOMQet0e87ZB6s4wF9YN9cf8jc3/eade3wOR+Ed5B4dK2xP8o3PNV4 0vM9U4eOtlJ9v+zr7z5axov6DLtNkRwAGNsiNlu1LUbjEP9Wx1mupY6zyR/IWmvVFd0Xe6vP fKT1c0isbZST3nO85nT8dtVBX7K3b3QNtJNRnLPu8ZvT8avnXEvtdXHe9eKuOZfa/bSb2JSJ x9N+opsbOyH9PmNjZfXHYk/UdeHUG4yWTurH0X5jv0RHoF5Lxo5OrinX2NeR4v/VvSCZj+P3 1fFsdPzcA+NZ9k5xfYxJPLvUBGPcSayya9+NYkijeoB13Mn76vlPiVHV/KeuwTNn2/G3lXlH sefqs6yf4/lzL4wp2FGpl5Gcl74Wd65ct1P4U30fEWN2tZFGuZ7RxEgdj3Pneq6pn87VLZnT x6i650v96L7uWGuQ9xyeqllX93z1tt/tvE5+39t9b/P0+ewBTn0krpl2wzVlj0/WOu7CVs6z qXXsaI/YR/H9UuOK/so91DbS13Tq+Dc3BvbnE394FAOt/sMh9kT82ZHeSurW1PoTfU9f33+c +jvRsjlF/Z1ztvnbtIdde47m5qC5mrRrzPs6Zh7MeBC/b0k7XzL3Z19vjfVH3y97b7OHrtYm qjWjsw9jX83oU/p9Nd8ze/3oD/H9uFaug+fJ9XLPyYOoc0u3lzKOjsbXjB2jteSqx9Jrx2Sc 5drmxtmlueHJ/+rjQupyHRpj3ZU31HPSu55q7Xt1PeqQNZclmsTp83lntYb9uduaWG/Mr677 pA4lc0Vsyqz70Efqek3lrv6e72n/jHe0w4yb0cxLn6bd0n/oe/H76Pcjv6/aavt8wL5+n7Gm 2sa7xv96f7FxuAeuq/p9qX/O14yh2YvF+Jl9Q7HB6X/cF895nyZ4tzNqPRKuI7WQE/fp9zd6 TyO/r7Ou5WUPD22Cc/L+8JWiE5Ccrl7nf41tf8lccYiNdK618bX1016vJ77ZXB3G1AhP28y5 aE/RY8qzHM151UYZaU+lhgnXPPJ599kko/Ye3zhtPvtYuNZaw5zrSI5X1vrvcq1jZMPF96M/ 0i+xZ7BD6K+ppVDzuKs9Nsfu69V1hFrngXNEKyb53sf4VnWto9atYazh+WMT8s5r/mrsyGpL 1naW+js1Tn+bnNxztvnb+EQ197TGPU4xB63F7zt2HjzU11s694/8vqzTjepxJYcyx6YP1dol iZWfS/+2ridmj3B8v6wZsT6S2sZccx03am5EHRt2cfQe8nyzzpj9CLTVPs5ybaNxdpffV9t9 jVvmmSc/odZqO6QuV68RlzGA6856LP2r5uJk/Z17rnXWj60HPbf+lP5Qa5TFlqt6JmuvwyfO F/Or9QFou7SD6LcxVtE3aMM1PzsxgpHPkN8nRyJ5Y7VfR/8zOZ61pgvf8zvsFsaf1CnIfuDk oy3hvvyNUfxjjtxHX/enj6fWYfR9omnMvUVXq+apxp6sMbP0v743Lv2v2hl9rxefz5p+fT71 3pKrNWJy3sLkfnKtyQvM3gbGEsYLxhXmp9Q1qxrNdS1urePH0n1EfV2WZ1I1Xuv8fI61sjX1 U2ysUb2ebqfH1kl9yRpvSr5p+tDc3sFRjnO1Z2uua/yZ3POStj/X5rPXp7Z5bB+uM7WcolnM fcYWSXz7rtc6evtg/ucdpC4Wz5V2Sn9NnV5sjT6W1jz5EWsseLQOhJ2DncXzSf5G1/xY+lzq Ona15fo7zzpHvf6054zVqWtUc9FH7ew248ep2/xtfaJuh95mDlqbDXjsPHjoXL907s8+79rW GatqbcloBVW9Oq4vY05q6s7ljp4j9y59rM4rdc2IdsPaGmPernGj77HZx7qWnGeaGjv009QR y3ry3DibuWHJ/MB1Z6zIHJeYYq0xUevFLOmL2eOXPMuujcEzy7uue5Pi42atjGfMPJ68+EP2 HM+tkfVxKHs5MrdnPbefV7/vYfh+6fu8b2zX6M/Rfuk7zJW0j9TtTv2Hui8oOdzVhuL3IxsK +yBawfGX6C9zGniJaTDO1vMz/tw1U+uT6+B5cF29HinjTjQHY5fX66evZ/9zXddKbYi5deie m8g5EhNNPhd9ObX2DnlGqXGROg5cI9fH+6q1unhv0TyKphv3zTUnzncJPl99nl2DJ3sys1ck +YPZJ1brPsd262t056rdf9/9tGo4VL+st83kvKRtVrshbZ9r7Hk8tTZ3z3Gu+/Yzt91mbNjX 5ulL0aOLpmd0nrEruNau3XVf8e3q+yXnk+fIe8j6QLSSUxe51u7leRzSTvj7qtvA8RgXeB+p cZV872P3O9Z3Hr8q4ynvo46nuf5ag4P3yliYGC19tY6xPWZ97PhxjjZ/irWsaofWOSjv/Jg5 aE3j9jnmwUPm/l7jOL47/a9qyfVau4mh5fpSQzfrJqNjnmuPZff9smbEM+Wa6W8814wbtGmu nX6/a9yYW2cbravxHGiDtE3mr2isZhyp42zifHUsqfuck7PKmBd9iuQ6pCYg75Frr32x7tE+ pC92n7O/65pnkXqEqX+zrz7Q0noBoxoAWSPjWdb+wH3nedc+z3O+q5pkYl2+X/RPEvNPbRX6 D/2QNsS4VGvypg5g5pEwNlRqJMeGit/A2Bb9g+jf0OZo75yfsYe5hz6U9Wo+x+c5f3SC6VN3 xdQ15/z9PjI+8dy4F75m7KQ/1+tPXfRoZfFcGXdG+4RG41vP92NeZ2yuOsqco9ap33VPlanX zrWlHjPvnGtnDI2mc/S/c8+1hvUl+Hyj+SK1GZIXldprtR5WaksnJ5/nfVd1ENbST/veir7m WveL0E5o28wv0YWMNkDOEV+h1gOqc0+vXZm5rfatfvxdbX/U5rme2uajdUGf4vjMjdhiPGfu i+vEPkj9vvv0+brvl5xg+iPPKm0ke45pr9gZdTzluUS/o9bgC9NG9q0DJdd9bh3o2HWZ2FTR RaWd551zHbn+XnM/2mJZu+h1IW5Ti+mcbf4Ua1lZGzrlHLSmcfuU8+CSuT/taTT313UExue6 /pLYe/Inub6Mz2kXWVuKLlQ/5jlzbUdrRpyXtpO5hfbTx43a7xgX4lfU+r+1HvDcWnK0hXgu 9GvmMZ4VfZ1xfsk4W+teZ72DY2Q9tM6HMH2RPso5GVNqvv4h9ej6ubH7UpOwrrNFBwfW9cS5 drT0nY/0XOse79x/+kP6fO79Evq8OH/cr677RIMcu6/2/Whw0n6izxIduGpD8W+0Odp3bKj4 DcxH9JGs5dBvaO98Ha070Ydpp9EY5xrumtE5r7ZgclS5D/os8y1f+TnXz9/x93yOsYDj8DXP I/uEGGuzR6D3+5H9m5gPfZzxMvrbHPuYe8t15R45HtfNuMQ90A6wVRhXq+2b+e5SfL7R+njd g5/8/FoPa5TreUwNrkvup3X+re95zjfLPleONWr7iRlzjl3xoVHtyqwLcXzaJ2310LEh1wJ5 j6M2T9/iPMyl3BPPO+PV2tY5qu+X9QHeGc+La4//xzPnnWQ8jR572gltgrYRpo1E3zoazX0d iOMzLpxiHaivc6RN0c57m+J6sEd3aWzXtYvqZ50ivnaONn/btaHYoeknp5iD1mKrnHMePGbu 7/sb4NzeOcaVasdArpUxm7EbnyG1gesxz10buI8bWX+nTUebasm4UfWAqz4w4wh/U9fVap/g 3umjtEHabGIBS8aRXXsV87xrW6hzXNaq6v7MQ/Zoj/bfJ8e+z8U8L1jfeW1Hda3skLGg7vGu 98/z7HNjH4dy73UcuiQbTpzOpqzrxbRj+mH2rNFPGFtpN7Qn2hBtmHYVnwHyO/obbbvbUN1v oL3S3mBy46u9wrn5HO2Ytsqx6FN3Tc7L+bmP6PXxbGIL0md5bpCf6/Xz9zw7jlGPE5uy2kvV hxr178zrWc9PXinvh2PmGe17Tvmbek2Q6+Q4HC81Snln3Gvycavtm3W4Sxsv6j6iqnlV62Hh 4+HrpXZEzfXsmjvnzPVcSz/dteZaY011zZhj9XZZ+1DWdefiQz2WFd+vHp+xgXve1/ZHbZ7P QY5R23z0RHubr89hbW0+z6q3kdhxPDPeK/M998r9006wgWgDtIW0lZCf+X18Yv6ez43WgZL3 eop1oNF4l+uvbYr3StsNuT5+xzvlHnmXdY3xVHm552zzp7imzKEZF46Zg9Y4np96Hlwy7++a +/vYmP5X1yy4vvS7asfA2k5Hx7yLMWbfuEF77dffx406v1RmnqnrahlD0v7yPOPv0S+WjrN9 vaM+7/TD2gb6et5t2v3c/uqsxWYu5rzcM8w7r+2ozrGHjpujXKDEHeba27nHIXFZdnAdU1OP mH4UmyE6C/QZ2jRtij4U2ymM30D7ou3N2VDxGzgnbXd0btow5+bz0fe7L8b/4XoS4+M66W/J 7edrrj+xv+z7q8dJLRue7ZK1rbl1OZ4nzzXnOPYZ8blcF/fI8Tgu15d3Vu/1Uv29bkPM1Ywn hyX6cKnHlVpcd13Xcy39NLbyrrZZ/dF6PbVdZi9snef7OZb4uxz/Nm0/7b23ea6L+8+11Tbf c1zXPJbX+HDsuDompQ4V7542UNtKJb/j3+9yHWjXeJf5gHfI9XNNlXm3eZ/c88g+P1U/PLbN nzpPuOcEnHoOWqOdcup58NC5v7epWod4rt3Wazt3Oz322fZxoz7fPm7U+SXrx30dua+r1TGk rp0nDrB0nB31w7rOlTbP9cL0xbT72+Zv7Otzedf9/KccC+byPHi2vb3Vc4/asLG+h+v7dR+s 2gyxtTKGxW6qjA2VMTI2VPICuw1VWe07/pZ2ybmTQ8mx7ovJ5Rz5QMnxyJjZr79eez/OaKw7 ZFw+xTPic/W6eFeJYVa/Nj762m3fpe09OUO1Lh/rlKnvQswvtZijK1t1d2ot73PVX1tLP106 /1Z/NO2SY2cNgevrfai3q7n5td9v9gWn/Z6jzXdf5hLafN0fOTempp1kbY22QJuo7aW2kdho o/d3Dp941Kbyzmubyj3A3sZ6Wz7lWtXIBzmkzZ/rena979r+j5mD1ub7nXoePGbu72PDvnY7 sgX4tzXk0PTrP2TcyJiRNeS+jlzHkD7X1PZ36L3vmnvyrDNOnLrdL+1z9fy75r9jxs65eO2+ 9nZNa/ji9HZl2lIdX2NvpV11Gypz7iE21MhWSQwt5+dY90XOn1rNuZc6TlXfNc+txgD7seae yaHvpp7j2GdU761eV7/HS/f1Rr5E1/8hdyU60dHASU1vvq+aYPH7mNu6xsG19tOlfsYxbX+J b3mKtp+/v/Y2399LbyexUdJO0lbC2kbiE9f3d+7ntO/asy+8ctTGzhGnvYs2fwq7/dRz0Fpt lFPMg4fO/XPvcLQ2N/cO4nvUcee+x5xDx40+v4zmmnOtqx3SD3u7P8bPvE2fO9dYsGScDM89 LorLt4trexqNsdUn6zbUnG90iA1Zz12v4a7Zr6HeS+0zfc2v9sXR8fpxjnk3t3lG/XPdh+33 d22Y0wlgXwL70KPDQ4wvNajZ+8e+depI4COO4n13reN2H/30kHa5prb/UNv8vnbS28pcG7kP n3ju2muOxeg9H9vG1tbmT3FNp56D1tamz2Ur7Jv7b9Mu+ntY4zs4ZNyo62l1num+xjnGkCVt /pxjw32ff8k4eQntTax7jB2Ns+e0oeqx7ounvO5zvqO7uK9radNdA4c9C+xZrzo8qXMfvSV+ /8zmZq92rcm+hlrI991Pl7bH+277jufPbye9vfTfr+XZrfkdr7HNPbR+sJa5/xrfwdy4MZpj 7nNd7b7HhjWMTc5/Qgjx/HGxa+CwL+Hx1vcj7kdcDz+v6h7gExLr67pgp6jJLoQQQgghhBDi tOj1z0c6PNShrtoH1IyPxuzada+EEEIIIYQQ4qFjlw5PtK+qDsLjzVj/Rw0cIYQQQgghhFi3 79d1eKIfWTWhUpd6pHt1Vzq7QgghhBBCCCGO8/tqDa45/ciRjlOtB+2eaSGEEEIIIYRYt++3 Sweo16e+RN0rIYQQQgghhBD7NaGuQfdKCCGEEEIIIcTYF1T/RgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGE EEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCEW4FUTP2fiqye+fvv9o4nfNvGPPrr5/i//v+eeq5/5J099+suj Fz/efPHbNx/c/NDmD2++Z/Ph6f+PN9+0+SPTzx864Ao4w2bzzGu/7KObn3y0ecFP3fz8Ln7+ jkePnkzfP5m+/4HH0++nf/vRn/2//5S/+NPT11dPfOlrX/2Iz/K7108/v/vD73vqk7/y9Ec5 xtdOP7/mc/7BC7/7TU9/9K/+wic/+q7p5/e89x++kGN83ebRl79/+rrZfPIzP//d6etPfdan Pv3z03/rs/8cx/jzX3JzlW9+0ade2K+a4242v/jDN1c84VO/+MOf/F8cc7P5mZ/7+y/8F9Nx /tTP/qMX8vvP/E3B/57+/UN/cvNZfM9p8uzft+WfmX74exN/fOIvbN/FF73/DU/+0gfe8OQt n7vZvONlN797dzvuc1s8O33/7RN/qRz/JZvNj4zO9Ve25/rbg3P9t4Xn4jj/ccG5/ub2XD85 ONdPvHTZub6F57/gXJyDc/3zwble9PSyc9EXXvBo/7l+ZnuufzU4179feK5fu/C+/uX2XD8/ ONcbXrbsXF+18Fz/YXuu/zI4179ZeK6l9/Wft+f6P4NzPf6807b5X96ea/PU88/1bxeea2k7 5Byc6zWDc331y5edCy65r1duz/W6wbl+ZeG5lr6vL9ye6y2Dcz37imXnevvC/vXG7bneMzjX q1657FzfuPBc37o91wcH5/rlhefi35aMhx/YnuuPDc71Y6867bl+cHuuPzFqh59/2rbxx7fn +tjgXH9x4bneufC+/sL2XH9jcK43vvq0z/Cvbc/1jwfn+rmF53rvREyafef65PZcPz84179+ zbJzfSdtrJ2r2n2j83I+zvufBud9/Nrj28lbp68YPNMhNk+Xz33XxK8YHOfXfOY3//V173wD 3Gy+fnsMxg2Oi2F27uO+vDyjnOOnp/Ht+5/afY6ffsX3P/V3XvKxF3/qtR97Md+/rV3nJyZ+ fHudzwyOwTV8YvqLT7wevu11n9jAj29ynH7NXJ/PYv5ZfGRqhG/dc50feclbn/rIS37pxV/6 BfCtT/mM7+cZf5jx43++bPMD0w+c/79Px/x309c/Ox3/m6fv//rkl3z8017Zc8W9+pFvGH3/ 3NaF/aGJb5r4ExP/2f942eYHXzDZVY9ufN98/2jyY1+w/ffn47n8J4QQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEtAfRQppZRSSimlfKhciz+GmkIn5SellFJK KaWU8qFx5B/dlR9XfbRcD/IFqA7AF0kppZRSSinlA2Z8I/yk6sOd01+rcbT4Z1zLizc3snJI Uf66LT9bSimllFJKKR8Q4wvhF+Ef4SfFd8N/qnG2c8XT4qdxbq6D60L6+3MnvnRzIyWOADf8 PCmllFJKKaW8Ysb3wQ/CH8Ivwj/CT8Jfwm+q/tqp42s177H7aVwL1/Xyia+c+KqJnz/x1RNf s+Wvl1JKKaWUUsorYnwd/B78H/wg/CH8Ivwj/KTur9V8yFP7aviCxPGI6cVPw5fkmrhGrvk3 THzdxC+a+MVb/kYppZRSSimlvCLG18Hvwf/BD3rt1i/CP8JPir+G/4QfVWNrp8x/TB0RfELy MF+yjfVxHfiTXBvX+ZsmfunEN0z88olfMfErt/wtUkoppZRSSnnBjG+Dn4O/g9+D/4MfhD+E X4R/hJ+Ev4TfhP+EH5V6I6fKg+z5j4mpkYtJfA+/kevBp/zN2+vlHn7rxDdNfPPEr5n4tRPf suXXSSmllFJKKeUFMb4Mfg3+DX4O/g5+D/4PfhD+EH4R/hF+Ev4SflNia8mDPKWvlrha99Ve sc17JOb3JRO/bOJXTfzq7fW/deLbJn7DxG+c+E0T377lO6SUUkoppZTyAhgfBn8Gvwb/Bj8H fwe/B/8HPwh/CL8I/wg/CX/pnL5a/LVaV6T6asT34qvhS+JX4mNy3dwD9/Q7Jr5r4rdO/J0T 373le6SUUkoppZRyxYzvgh+DP4Nfg3+Dn4O/g9+D/4MfhD8UXw0/qfpqtb7IOWuLUMuEvEv2 yyUHkvxM/Mhnttf69Vufk/v4lu39vXfisxO/beK3T3yflFJKKaWUUq6Y+C34L79768/g1+Df 4Ofg7+D34P/gB+EP4RclBzL1RfCfzlFbZG7PGpoBT2/3zFHvhH107KkjV5O8TXI6n2zvAf/z d23vj/v9PRPfP/G7Jn6g8PdKKaWUUkop5T2y+if4K/gt+C/4Mfgz+DX4N/g5+Dv4Pfg/+EH4 Q/hF+Ef4SfhL+E01//EcvlqNrdVakPiK6AngO1K7kjoo+JTkbZLDSWyQOCHxQ+7tO7b3y73/ vom/f+IfmPgHC79bSimllFJKKe+Q1R/BP8FPwV/Bb8F/wY/Bn8Gvwb/Bz8Hfwe/B/8EPwh/C L8I/wk/qNSBP7afNxdayb42YXupBfmHJhSRfkxopv31zsx8P35OYITHE79zeM/cf3+yDE79n yz8kpZRSSimllHfI+CL4JfHd8FfwW/Bf8GPwZ/Br8G/wc/B38HuS+4g/lPqP0VY7pw72yF/D J9xVvx9/MnvX8DPjr5HXWf01Yoz4rDyL+GgfKvxeKaWUUkoppTwjq/8Rnw3/BD8Ff4WYWvw0 /Jn4aYmnjfy0XvvxnDG1ffE14nr4jcmH/ILNja7A6zc3tSt/2+Zmzx01LpMPyf68Gl/r/lqe 3fdJKaWUUkop5RlY/bXqp9V4Gn5L8h7xZ/Br8G/wc/B38Hvwf5L3iF+UvMe7iKft8tdqbcha bwQ9gcebGz04NL3RHEA77snEd25ual5m/xp79sgFJc5IzLHG1/TXpJRSSimllOfw02o8DT8E fwS/BP8k+9Oo+4j/gh+DP4Nfg3+Dn4O/g99T64jUmo937adVf21JTiSxwJ4TyR68uoeNmirE FudyIo2xSSmllFJKKc8ZS6s5j/gnfW9azXnEv1ma83jXftqSnEhqnrxs4qs245r+aMahR/DN JSeSWpi15kiNsemvSSmllFJKKU/ppyWWlpxH/JGa84i/gt9CzmOvyY+fg79Taz3eR87joTG2 nhOJXje63eh3o+ONnvcbtzFEtL7RJiAn8tmZnMgeY7OdSSmllFJKKY/JeUwsbZTziD+CX4J/ gp+Cv4LfQs4jfgz+DH4N/s0o53ENsbSlMbbkRKau/0iHDY3v6LBRVwVtuX11Io2xSSmllFJK KU+R85h6/Pgh+CPRTcNPwV/pumm1Hv85Na7vKicSXzM5key7qzmRX7nNiUTvOzmR7N9jH9+u nEhjbFJKKaWUUspj6ofUnMfUD8EPwR/BL8E/wU+Zy3nEv1lrzuMxOZG17khyIqOdTU5k1c4m 5sg+PmKQqTtCbBLfd5QTqc8mpZRSSiml3BVLw4/An8CvSP0Q/A38DvyPqm2NfxLNtOQ84seQ 84hfcwk5j8fE2PZpsRFrrFpsPSdSLTYppZRSSinloTmP+BE957FqpuGHrFUz7S78tUO02Ig9 PtncaBkkJ1ItNimllFJKKeWhOY+7NNPwO/A/yHnEH8EvWaNm2n3lRFYtNmKNaBYQe0TDgFik WmxSSimllFLKY+uH7NJMw+/A/0jO40gz7RpyHo/NiaxabDUnEg0DtAzQNEhO5EiLjfegFpuU UkoppZT6afgFyXkcaabhV1TNtJrzWOuHXGPO49IY276cyGixkRN5qBabOZFSSimllFI+rJzH fZpp5DzOaabty3m81ljavhgb9z/SYiP2qBablFJKKaWU8tCcxznNNHIe8SuqZtoo5xH/5Npz Hk+RE1m12IhRonVAzDJabKOcyF53RH9NSimllFLK68157JppyXmMZhr+A34E/sScZtpDzHlc mhPZ644Qe6xabMmJROuAmCXaBz0nUi02KaWUUkopH04sreY8Vs00/AP8BPwF/Ab8B/yI5Dx2 zbSa8/iQY2mHxtiqFhsxSvb9EbOsWmzmREoppZRSSmnOY815rJpp+A/4EfgT166Zdhf+Gj4t zw0fNzmRXYsNDYQ5LTZin+wnHOVEWndESimllFLKy6sf0nMesfex+6OZRs4jfsEuzbTkPOJn 4G9co2baXedE7tNiI7apFpuUUkoppZTXH0urOY9dMw2/QM20+8+JrFpsxDbRSCDW2bXYiIlW LTb9NSmllFJKKS/PT0v9EOz7rpmGH4A/gF9QNdPMeTxvjG2fFltyItFIINaJZkJyItlXSEx0 pMVmTqSUUkoppZSXkfNYNdOw76OZht2P/Y8fgD/Qcx7xG0aaafppp8+JrFpsPScSjQRinc9s brQTosVmTqSUUkoppZSXXT9klPNYNdPwA/AH5nIe1Uy7+5xItdiklFJKKaW8Lj9NzbTLj7H1 nMg5LTZiol2LbZQTaYxNSimllFLK+42ljXIesd+rZhr2/Zxm2ijn0Vja/cXYkhPJfkFindFi IwaKlgIx0TeXnEi12KSUUkoppVx3zuNIMw17Hrse+x47H3s/mmn4AfgDNefRWNp6ciK7FlvN iURbgRgpWgvJiaxabHM5kdYdkVJKKaWU8m7qh9Scx6qZhv2OHY89j10/l/MYzTT9tHXmRNa6 I8mJjBYbMdKqxUYMlX2JxFRTd4RYK768OZFSSimllFLeTc5j10zDPsdOx16vmmnY89FMS86j mmmXF2M7VIut50SqxSallFJKKeX5cx6xu3vOY9VMI+dRzbTr8dcO0WIjlvpkc6PNkJxItdik lFJKKaU8f85j10zDHscuxz7HTlcz7eHkRFYtNmKnaDAQS0WTgdgqGg1qsUkppZRSSnk39UNG mmnY5djn2OnY68l5HGmmmfN4PTmRVYut5kSiyUBOJBoNyYkcabHRrtRik1JKKaWU8nA/DTs6 OY9dMy05j9jj2OXY5zXnsdYPMefxemJs+3Iio8VGbPVQLTZzIqWUUkoppdyd87hPM42cx6qZ hl0ezbR9OY/G0q4jxsb7HGmxEUtVi01KKaWUUsrz5zzOaaaR84gdXjXTkvPYNdPMeXx4OZEj LTZisNFiG+VEWndESimllFLK+ZzHrpmWnMdopmFvY3eT8zinmWbO48PJiex1R4ilVi225ESi 3UAMFi2HnhOpFpuUUkoppZTzsbSa81g107Cnsauxr7Gzsbexu5PzWDXTsNOtH2KMbU6LjRgs Wg7kRKLtQIx2pMVmTqSUUkoppdRPW5bzWDXTsLexu8l5VDNNdH8NH512wD7F5ER2LTZyIue0 2Ijlsj/SnEgppZRSSvlQ64f0nEfsY+zkaKaR84gdHc007GvsbOzt1A9JziN2Ofa5mmnmRB6q xUasVi02KaWUUkppLO0wzTTsaDXTxLlyIqsWG7HbrsVGjLdqsemvSSmllFLKh+CnpX4I9nDX TMNuxn4m57FqppnzKA6Jse3TYktOJJoPxG7RgEhOpFpsUkoppZTyIeY8Vs00ch6jmYadjL2M 3Yz93HMesbNHmmn6aWJfTmTVYqs5kdFiI3b7zOZGCyJabOZESimllFJKcx5/tWYadjP281zO o5pp4rY5kXNabOREHqPFpr8mpZRSSikvzU9TM02sLcbWcyLntNiI8XYttrmcSH02KaWUUkp5 CTmPI8205Dxi71bNNOzhOc20Uc6jsTRxqhhbciLZ/0jslv2QyYlEG4IY75tLTiQaEmqxSSml lFLKa8p5HGmmYf9iB2MPYxdjH0czDbsZ+7nmPBpLE+fKiexabMR0H29jvGhFEPNFOyI5kVWL bS4n0rojUkoppZRyrfVDas5j1UzD3sXuxf7FDq45jyPNNP00cRc5kbXuSHIio8VGzLdqsRET Zp8lMeLUHSF2zNqEOZFSSimllHLNsTTs1tQPwZ7FrsW+rZpp2L/RTEvOo5pp4r5jbLu02NCQ 6FpsPSdSLTYppZRSSrlGPw07tec8qpkmLsVfO0SLjdjwk82N1kRyIkd1R8yJlFJKKaWU953z 2DXTsF+xY7FnsWvVTBOXmhMZLbbkRKIpQWwYjQlixWhOqMUmpZRSSinXWj9kpJmGHYs9i12L fZucx5FmmjmPYq05kVWLjVgw+yuJDaMxQawYzYnkRI602OgnarFJKaWUUsq78NOwO5Pz2DXT kvOI/Yodiz1bcx6xd9VME2uPsc3lRLKvkphwtNiIFR+qxWZOpJRSSimlPHXO46Gaadix0Uzb l/NoLE2sMcZG+xxpsREbVotNSimllFKuMefxEM205Dx2zbSa8yjEWv21XTmRaE2QE1m12Igp R4ttlBNp3REppZRSSnnq+iGjnMdopmGfjjTTzHkUl+6vjeqOEBuuWmzJiUSLgpgy2hQ9J1It NimllFJKecpYGvbkSDOt5jxil2KfYqcm57FqpmHXWj9EXGOMbaTFRkwZbQpizGhVEHMeabGZ EymllFJKKc+V84gdij2KXYp9ip1KzqOaaeLa/bVadyQ5kV2LjRjznBYbsWn2e5oTKaWUUkop j815xJ7ErpzTTMMexS7FPk39kOQ8Ysfip6mZJq7JXztGi43Ys1psUkoppZTyVLG0Oc007E41 04QxtmU5kVWLjVh012IjZl212PTXpJRSSin100Z+WuqHYD92zTTszJFmmjmP4iHH2Oa02HpO JBoWxKLRtCA2TYxaLTYppZRSSrkk53GkmZacR+xL7EzszZ7ziF2qZpp4yP7aSIut5kRGi41Y 9DMTv2bzq7XYzImUUkoppdRHW5rzWDXTsCuxL7EzsTfnch67Zpp+mnhIPtshWmzEpo/RYtNf k1JKKaW8fj/tEM007Eo104Q4LMbWcyLntNiIWXcttrmcSH02KaWUUsrrjqXtynmMZhr245xm GnZnz3k0libEOMaWnMhadyQ5kVWLreZEqsUmpZRSSvmwcx5HmmnYi9iN0UzDnoxmGjmP2Js1 59FYmhD7/TViz12LjRj1423MGu0LYthoYSQnsmqxzeVEWndESimllPJ66ofUnMdopiXnETsR exG7seY8jjTT9NOE2O+v7dJiS05ktNiIYVctNmLcXYuNWDhrLeZESimllFJeT84j9h12XuqH PLu1A7EHq2Ya9mI005LzqGaaEKeNse3SYiOm3bXYek6kWmxSSimllNeR81g105Lz2DXTsA/V TBPi/P7aIVpsxLqfbG60M5ITOao7Yk6klFJKKeXl5TzW+iHJecTuw/7DDjxUM00/TYjj/bVd OZHRYktOJBoZxLrRzCD2/Y5tLFwtNimllFLK66gfUjXTsPOw97D7sP+wA7EHk/M40kwz51GI 88XY5rTYiG2zX5RYN5oZxL7R0EhO5EiLjX6vFpuUUkop5Tr9NOw07LU5zTTsPOw97D7sP+xA 7EHsQuxDNdOEuL8YW9diI8YdLTZi34dqsZkTKaWUUkp5vz4aPFQzDbsvmmnYg3OaafhpxtKE OH+Mjf7WtdiSE1m12J7ZqMUmpZRSSnmpOY+7NNOw86pmWnIeu2ZazXkUQtyNv7YrJxLtDGLg VYuNGHm02EY5kdYdkVJKKaW8//ohczmP2HHYcyPNNHMehViXvzaqO0Ksu2qxJScSbQ1i5Ght 9JxItdiklFJKKe83ljanmVZzHrHjsOew65LzWDXTsAOtHyLE+mNsIy02YuRobRAzR3uDGPpI i82cSCmllFLK+895xE7DXsNuw37DjsOeUzNNiMv012rdkeREdi02YuZzWmzE2tm/ak6klFJK KeXd5Dymfgh22JxmGvYbdhz2XDTTkvOoZpoQ6/fX1GKTUkoppby8WNqcZho5j2qmCXGdMbZR TiT7TpMTWbXYiK13LTZi8FWLTX9NSimllPI0flrqh2BvpX4Idhj2GHZZ1Uwz51GI64ux9ZzI aLH1nEg0OYito9FBrJ2Yu1psUkoppZSny3ncp5mWnEfsMewy7LOe84gdp2aaENfjr4202GpO ZLTYiK0/s7nJiaxabOZESimllFKeN+cxmmnYYdhj2GVdM63mPHbNNP00IS7XZztEi41Y+zFa bPprUkoppZTP99MO0UzDDlMzTYiHHWPrOZGHaLHN5UTqs0kppZRSH+35mmlzOY/RTCPncU4z DTut5zwaSxPiYcTYiKF3LbbkRFYttpoTqRablFJKKeVhOY9VMw17KjmP2FnPbO2u5Dxij5Hz iH1Wcx6NpQnx8Pw1Yuldi42Y++PNTQweLQ9i8mh7JCeyarHN5URad0RKKaWUD61+yFzOYzTT kvOIXYV9hZ2FvYXdhf3VNdPMeRTiYfpru7TYkhMZLTZi8mh7kBM5p8VGbJ+1I3MipZRSSvmQ cx6xh7CLUj/k2a3dRM5j1UzDvopmWnIe1UwTQuyKsfWcyKrFRk5k12LrOZFqsUkppZTyoeY8 Vs205Dx2zTTsKTXThBCH+muHaLERu3+yudECSU7kqO6IOZFSSimlfAg5j7V+SHIesZOwl7Cb DtVM008TQsRf25UTGS225ERWLba5nEjrjkgppZTyIdUP6Zpp2EfYSdhL5DxiPyXncaSZZs6j EGJpjG1Oi41YPZofxO7RACGWjyZIciJHWmyMY2qxSSmllPJa/DTsGuybkWZach6xj7CTsJew m7CfsKOwp9RME0KcKsbWtdiI2UeLjVg+miBogxyjxeb4L6WUUspLyXk8VDMNOymaadhPc5pp +GnG0oQQh8bYGD+ixfb/2TsPMMuy6yo/hM0Y8MCARRyD2iTLYKCIxsjChS1EhiZjcpZztpw0 jmBA5BzFEIVJIoucc3Ii52wymJyx+5/Xm1k6fe9+79Wpqn7h//Wtb7TnSGdXV70bdt9Vd/GM nt97LU9kZrFdbcxiU0oppdTleB4PyUwrz+OYmZaeRxGRm8xrnSeSLBCe6WcWG8/8K4ttyRPp e0eUUkopdYrvD1nyPFZmGvc/mZnG/RH3SXoeReQu57Wl947w7D6z2MoTSVYIz/wriy09kWax KaWUUurUnqWtZaal55H7Hu5/uA8qz2NmpnHf5PtDROS+n7EtZbHxzJ/sEDwAZIngCVjKYtMT qZRSSqlT9DxyX8P9Dfc53O9w38P9j5lpInIM81q+d6Q8kWMWGx6AtSw2vANmsSmllFLq2D2P 3K9w37KWmcb9Dvc93P9UZlp5Hs1ME5H7ntcOzWIjU8QsNqWUUkqd2rM0M9NE5NSfsS15Ivk9 2vJEZhYbXoExiw1PgVlsSimllDqGOa3eH8L9yZiZxn1MZqaV55H7Hj2PInKMz9hGT2RlsY2e SDJG8AqQOXK92XoIdmWx6YlUSiml1F16HndlppXnkfsX7mO4nxk9j9z3mJkmIsc6ry1lsaUn srLY8Apcbbbegcxiw1vA7+vqiVRKKaXUMXgeMzON+xbuX7iPGTPT0vM4ZqY5p4nIscxsh2Sx 4R24SRab85pSSimlbmNOOyQzjfsWM9NE5JyesY2eyC6LjWySzGJb80Q6symllFJq9lla53nc JzON+5rR8+izNBE5xWdseALGLLbyRGYWW3oizWJTSiml1F17HjMzLT2P3JdUZlp5HsfMtPI8 +ixNRE55XuPvmvAGjFlseAgebLaeArJJ8BhUFhveg8xiW/NE+t4RpZRSSu16f8ia57Ey08rz yH0I9yPcl3B/wn0K9ytjZpqeRxE5h3mty2IrT2RlseExIKsEz8FaFhteBf4uTE+kUkoppQ7x PHL/wH3EmJmG55H7Du4/uA/hfqQy08rzaGaaiFzCM7alLDY8BZnFhudgKYutPJGZxea8ppRS SqldnkfuG0bP45iZxv1HZqaNnkefpYnIJcxrh2SxlSeSbJPyRC69d0RPpFJKKeWctuR5zPeH lOeR+wruL7jPODQzzTlNRM51Xus8kZXFVp7IzGJb80T63hGllFLKGe2QzDTuJ7ivyMy08jwu ZabpeRSRS33GtpbFhveADBO8CGSa4E2oLLbyRI5ZbJyXzWJTSimlLndO4z6A+4GlzLTyPHI/ wX0F9xfcZ3C/wX0H9x9mpomI7JfFhgehstjwJpBx8r6bm2WxeT1TSimlztPzeEhmGvcR3E9w X1GZadxvmJkmIrL+jI3zYWWx4Tng93jLE5lZbFcbs9iUUkopn6XdLDON+4jMTCvPI/cd5Xnk fiTnNBER57XeE0m2CR6FMYsNT6RZbEoppZSZaaPnsTLT8DxmZhr3E9xX6HkUEdl/Xlt67whe hMxiK0/kmMWGt4H3jjzcmMWmlFJKXWpmGvcB6XnkPgHPI/cN5XnMzDTuM3x/iIjI3DO2pSw2 PAxkoeBpyCw2PZFKKaXUZXoeuQ/A88h9AfcH3Cdwv2BmmojI7c9r+d4RPArPbZ7MYsPTYBab UkopdXmZaXge1zLTuD8YM9PK82hmmojI3Lx2aBYbnkiz2JRSSqnLykzjep+ZadwPmJkmInK/ z9iWPJGVxYa3IbPY0hNpFptSSil1+nNavT8Ez+OYmcZ1PzPTyvPIfYKeRxGRu3/GNnoiK4tt 9ERmFtv1ZuuJ2JXFpidSKaWUOp4ZDe3KTOP6XplpeB65/o+eR+4Txsw07id8liYicvvz2lIW W3oiK4sN78PVZuuFyCw2vBL8/rGeSKWUUuo0PY+ZmcZ1nus91/0xMy09j2NmmnOaiMjdzGyH ZLHhhSBThWyVymJb8kSO7x1xXlNKKaWezpx2SGYa13kz00REjvcZ2+iJXMpiwxNJxgpeCTJX dnkindmUUkqpp5OZtuZ53CczjfuA0fPoszQRkaf/jA2Pw5jFVp7IzGJLT6RZbEoppdRxZ6al 5zEz08rzOGamlefRZ2kiIsczr/F3Z3gdKosNDwS/V4wn4sFm65EgawXPRGWx4aWoLLbOE+l7 R5RSSqm7zUxLz2NlppXnkes212+u41zPua5zfR8z07gPMDNNROS45rUui608kZXFhmeC7BU8 FGtZbHgv+Ls9PZFKKaXU3Xoeud5y3V3LTON6zXWb63dlppXn0cw0EZHTe8a2lMWGRyKz2PBQ LGWxlScys9ic15RSSqm7zUzj+ruUmcb1OjPTRs+j7w8RETm9eW3fLDYyWTKLrTyRS+8d0ROp lFJK3Y7nMd8fUp5HrsNcj/E8HpqZ5pwmInIa81rniawstvJEZhbbmifS944opZRSd5eZlp7H zEwrz+NSZpqeRxGR83jGtpbFhpeCTBa8FWS04LWoLLbyRJrFppRSSs1npjGnLWWmcb2tzDSu w1yPuS5zfeY6bWaaiMjlPGPrstjwWpDZgifyJllsXp+VUko5px2emcZ1l+sv1+HKTMPzaGaa iMjlPGPj/F5ZbHgo+L3k8kRmFtvVxiw2pZRS6r4y07juZmZaeR65Tpfnket3zmkiInJ+81p6 IjOLDY8FWS14LsYsNrwZZrEppZRSN89MK89jZabheczMNK6/XIf1PIqIXO68tvTeEbwV+2Sx 4dXg958fbsxiU0oppfbNTOO6yfWT6+iYmVaex8xM47rs+0NERHzGtiuLDU8G2S54NDKLbfRE msWmlFJKz+Oy5zEz07iecl3l+mpmmoiI7JrX9sliw6NB1gueyOuNWWxKKaX0PN4kM43r6VJm Gp5HM9NERCTntUOz2PBsmMWmlFLKZ2mHZaZx/TQzTUREZp6xjVlseDIqiw2vRmaxpSdyKYuN 65dZbEoppS4xM608j5mZVp5Hrqt6HkVE5NBnbLs8kWtZbHg8dmWx6YlUSil16p7HXZlp5Xnk +ojnkevlkudxzEzj+uuzNBER2TWvLWWxpSeystjwclxttt6OzGLD+2EWm1JKqUvwPHK947qX mWlcF7k+cp0cM9PS8zhmpjmniYjIPjPbmidyKYsNbwcZMWTFVBbbkidyfO+I85pSSqlT8jzu m5nGddHMNBERuct5bXzvSHoiK4utPJFkxOCJJDMGTyQZMumJrCy29EQ6symllDqVzLQ1zyPX O657XP+4Di5lpnHdHD2PPksTEZHbmNl2ZbHh7VjKYitP5JjFpidSKaXUqWempecxM9PK8zhm ppXn0WdpIiJyV/MafxfIvMbfDZYnclcWG96QymLDM8LfSS55In3viFJKqWPLTON6xXWL61dl pnFd4/rGdQ7PI9c9PI9cB/E8cl0szyPXS66bZqaJiMhdzmuHZLHhASFLBk/IWhYbXhKfsSml lDpGzyPXJ65Ta5lpXN+4znG9q8y08jyamSYiIk9rZtvlicwsNjwha1lseEkyi815TSml1DF4 Huv9IeV5XMpM4/qWmWmj59H3h4iIyNOe17ostgebrSeSbBk8kWTNXG+22TPliVzKYtMTqZRS 6r5mtNHzmO8PKc/jTGaac5qIiDyNeW2fLDY8IWMW25on0veOKKWUOobMtCXPY2amledxKTNN z6OIiBzTzHZoFhvekcpiS0+kWWxKKaXuOzONOW0pM43rU2Wmcd3i+oXnkesZnkcz00RE5FTm tUOy2PCOkEGDl2Qpi230RI7P2LzfUEopddP3PB6SmcZ1ysw0ERE5l5ktn7GVJ5Lfs8YjUlls eCLJoLnabDNpyKYxi00ppdSxZaZxncrMtPI8cl0rzyPXu5zTRERETmVeG7PYRk8kmTRk05BR g9dkzGJb80T6jE0ppdRMZlp5HjMzjevQmJnG9Yrrlp5HERE5l3ltKYsNrwi/f12eyLUsNrwn /D73w82TWWxLnkhnNqWUUjfJTOM6w/WG684+mWlcx3x/iIiInMvMdmgWG56TzGIbPZFmsSml lLppZtroeczMNK4/XIfwPJqZJiIilzav7ZPFhueE7Bo8KNcbs9iUUkrNex67zDSuN1x3uP6Y mSYiIpc4ry15Ipey2PCckF2DB8UsNqWUUnedmcb1xsw0ERFxZtudxZaeyMxiK0/kUhYb12Oz 2JRSyjltn8w0ridjZlp5HrkO4Xn0/SEiInKp8xra5Ylcy2LDs7Iri01PpFJKXZ7ncVdmGteP zEzj+lKZabs8jz5LExGRS5vXyhOZWWzpiRyz2PCqmMWmlFJqH88j1wc8j5mZxnWE68lSZlp6 Hs1MExERZ7bdnsjMYsOrQuYN3pXKYlvyRI7vHXFeU0qp8/Y8jplp5XmszDSuG1w/uI6YmSYi IrL/vDa+d6Q8kZnFVp5IMm/wrpCBg5eFTJzyRGYWW3oindmUUup8M9PK88j5Pz2PXB+4TnC9 4LrB9aM8j5WZ9tzj6016Hn1/iIiIyJMz264sNrwq/P433pXMYtMTqZRSl+15zMy08jwuZaZx HTEzTUREZG5e4+82uX7yd53lidyVxYbXpbLY8MDwe+VLnkjfO6KUUqefmZaex8pM4zrA9YDr Ap7HzEzD88h1pDyPXF+4zpiZJiIisv+8dpMsNjwua1lseGN8xqaUUufzLK08j0uZaVwPuC7g eazMNDyPZqaJiIjc3sy2yxOZWWx4XMjKwfMyZrHhjcksNuc1pZQ6zTmtnqVxXh8z0zj/cx3g epCZaXoeRURE7nZe67LYHmy2HheycvBEkp1zvXk5iw1vzFIWm55IpZQ63hlt9DxmZlp5HjnP c77nvM/5n+tAeR53ZaY5p4mIiMzPa/tkseFxISsHT+TV5uUstiVPpO8dUUqp08xMW/I8VmYa 53+uA1wP9slMc04TERG5vZnNLDallDIzDc9jZabheTQzTURE5DjmtbUstuc261lseGPGLLYl T+T4jM37J6WUur/3PC5lppXnkfN2ZqZxXuf8jufRzDQREZHjmtnyGVt5Ivm9cTwvlcWGF4ZM navNNmMHT6RZbEopdbqZaZzHOZ9zXuf8znm+MtM4/3MdSM+jz9JERESe/rw2ZrGNnkgydvBE krlTnsjMYlvzRPqMTSmlnn5mGuftzExb8zxWZppzmoiIyNOf17ostvJEVhYbnsjMYsNLw++n P9w8mcW25Il0ZlNKqdt/lsb5dsxM47zM+ZnzdJeZxnme8z2eRzPTREREjnNmOzSLDQ9NZrGN nkiz2JRS6v4y00bPY2amcb42M01EROQ85rVDstjw1Fxvthk95Yk0i00ppe7H89hlpnF+5jyN 59HMNBERkdOf1zpPZGax4aEhiwdPDdk8eGzMYlNKqePJTOP8zHm6PI9LmWl6HkVERE5vZtuV xZaeSLJ5yOghq6c8kUtZbNxfmMWmlFI3z0zjPLqWmcb5NzPT0vNoZpqIiMh5zWtolyeystjw RGYWGx6cXVlseiKVUmq353FXZhrn27XMtF2eR5+liYiInPa8Vp7IpSw2PDVjFhveG7PYlFLq /jLTOO9y/s3MtCXPI+dxPY8iIiLnNbPt8kRmFhveGzJ88OJUFtuSJ3J874jzmlLKOa3PTCvP Y2WmcZ7lfMt5dy0zTc+jiIjI+c9rS+8dwVOTWWzliSTDBy8OmT54c8j4KU9kZrGlJ9KZTSnl jPak55HzZXoeOZ9yXuX8ynmW8215Hisz7bnH5+f0PPosTURE5Pxntl1ZbHhv+H12vDiZxaYn Uiml5j2PmZnGeZbzLeddM9NERERkzGLjfoC/uy1P5JjFRrZPZrHh3aksNjw9/J78kifS944o pS4xM43zIedFzo+VmcZ5k/Nnl5lWnkfOx5yXzUwTERG53HntJllseHbMYlNK+Sxt+VlaeR6X MtM4f5qZJiIiIofMbLs8kZnFhmeH7B88PGMWG16fzGJzXlNKXcqcVu8P4Tw4ZqZxvuS8yfkz M9P0PIqIiMgh81qXxfZgs/XskP2Dh4csoOvNy1lseH2Wstj0RCqlztnzmJlp5XnkvMj5kfMk 50vOm6PnkfPrUmaac5qIiIiM89paFtvoiST7Bw/P1eYds9j0RCqlLvH9IUuex8xM43zJeXPN 82hmmoiIiOw7s5nFppRSh2em4Xk0M01ERETuel4b3zuSnsi1LDa8PmMW25In0mdsSqlT8jwu ZaaV55HzXGamcR7kfIjn0cw0ERERucuZLZ+xlSeS34PHw1NZbHh7yAi62mwzg8oTaRabUupS MtM473H+4zzI+ZDzYmWmcb7kvJmeR5+liYiIyG3Pa0tZbOmJJDMI7w8ZQuWJzCy2NU+k7x1R Sh17Zlp5HjMzjfMc5zvOe5z/1jyPlZnmnCYiIiK3Pa91WWzliawsNjyRmcWGN4jft3+4efm9 I3iI+DtqPZFKqWN9lsb5acxM4zzG+YzzWmamcd6rzLTyPHJ+xPNoZpqIiIjcx8w2m8U2eiLN YlNKHXNm2uh5zMw0PI9mpomIiMgxzmuHZLHhEbrebDOHyhNpFptS6lhmtEMy0zifmZkmIiIi xzqvdZ7IzGLDE0S2EB4hsobwDJE9ZBabUurUMtM4f3Ee43zGea08j0uZaXoeRURE5GnPbLuy 2NITSdYQnkiyh8oTuZTFxv2SWWxKqfvMTOO8s5aZxvmK8xbnL85j6Xk0M01ERESOeV5DuzyR lcWGZ+jQLDY9kUqpu3jP467MNDyPa5lpuzyPPksTERGRY5rZyhO5lMWGR8gsNqXUqWWm4Xnk fJWZaeV5HDPT9DyKiIjIsc9rnSdyKYsNb1FlsS15In3viFLqtj2PY2ZaeR4rM43zEucnPI9r mWl6HkVEROTU5rWl947gEcostvJEkkmEt4iMotETaRabUuouMtPK85iZaZx3OP9wHuJ8xHmJ 81N5Hs1MExERkXOa2XZlseEl4vfz8RaRUYQnkswivEdLWWx6IpVSd+l5zMw0zkucnzhPmZkm IiIi5zyv8XfP3N/w+/fliRyz2PBErmWx4VHi9/71RCqlDnl/yOh55DzC+aQy0/A8cr6pzDTO Q2NmWnkeOX9xHjMzTURERM5lXrtJFhseJLPYlFL3kZnG+cbMNBEREbnkmW2XJ3Ipiw1P0pjF hncps9ic15RSa3NavT+E88aYmcb5hfMMnsfMTNPzKCIiIpc4r+2TxfZgs/UgkWWEJ4lso+vN 1hNpFptSal/PY2am4XmszDTOJ5xXOL9wnhk9j5yPljLTnNNERETkEua1pSy29ERWFhuepKvN NuOostj0RCqlbuJ5HDPTOL9wnlnzPI6ZaSIiIiKXMrMdksWGJ/ImWWzOa0qZmWZmmoiIiMjh 89r43pH0RK5lseFdGrPY1jyRzmxKXVZmWnkeOS9kZhrnjbXMNM43o+fR94eIiIiIPPmMrTyR /F4/nqTKYsOrRObR1WabgVSeSLKRzGJTSs/jUmYa5wnOF5w3OH9wHhkz09Lz6LM0ERERkX5e W8piw6v0YLP1LpGBhJeJTKTyRGYW25on0veOKHV+mWnleczMNM4LnB84T3C+SM/jUmaac5qI iIhIP691WWzliawsNrxMmcWG14n3BzzcvPzeETxR/J27nkilzsvzyHHN8V3vD+G45/jnPJCZ aZwnKjOtPI9mpomIiIjcfGY7JIuNbKQxi230RJrFptR5ZaaNnkcz00RERETuf147JIsNz9P1 ZpuhVJ7IpfeO6IlU6jwy0zjOKzON49/MNBEREZH7mdc6T2RlsZUnkqwkPE9kJ+GBet3GLDal zj0zjeOc453jnuOf80B5Hpcy0/Q8ioiIiNzuzLYriw2PE+8NwPNEdhIeKLKUyhO5lMXG/Z9Z bEodd2Yax+lSZlp5HjnOOd457tPzaGaaiIiIyP3Na2jNE8n7AvA6VRYbHqhDs9j0RCp1HJ7H QzPTON4rM22X59FnaSIiIiJ3N7OVJ3Ipiw3Pk1lsSl1mZlp5HsfMND2PIiIiIvc7r3WeSDKU 8ERmFhteqcpiW/JE+t4RpY4vM608j5WZxnG8lJmm51FERETkeOa1pfeO4HnKLLbyRJKxhFeK zKXRE2kWm1LHm5mWnkeOX45jjufyPGZmGse/7w8REREROZ6Zbd8sNrxSZC7hnSKDCS/VUhab nkiljsPzyPHJccrxynHL8ctxzPGM59HMNBEREZHTmdfyvSPliRyz2PBOrWWx4bniPQZ6IpW6 X88jxx3H31pmGsftmJlWnkeOd+Y0M9NEREREjnNeu0kWG54qs9iUOs7MNI5PM9NEREREzmdm 29cTmVlseKzGLDa8WJnF5rym1O3NafX+EI6zMTON43EpM03Po4iIiMjpz2tdFtvoiSSbCY8V WU3Xm633yiw2pe43M608jxyHHI8cl6PnkePXzDQRERGR85jXlrLY0hNZWWx4rK4e6X0275jF pidSqbv3PFZmGscfxyHHI8flmufRzDQRERGR85jZDsliw3N1kyw25zWllue0QzLTOP7MTBMR ERG5rHltfO9IeiIPyWJb80Q6sylntOXMtDXPY2Wm4Xlcy0zj+Bw9jz5LExERETnPmS2fsZUn Mt87Up7IzGJLT6RZbErNZaZxHJXnkePr6vHxxnFXmWl4Hjku0/PoszQRERGRy5rX8FSNWWx4 rx5stl4sMp3wZpHxVJ7IzGJb80T63hFlZtrLnsfKTCvPI8cTxxXHF8cZxxvH3VJmmnOaiIiI yGXNa10WW3kiK4sNb1ZmseHdGrPY8HjxDEFPpLp0zyPHAcdDvT/k4ePjheMmM9M4riozrTyP ZqaJiIiISM1sh2Sx4Ykcs9hGT6RZbOrSM9NGz+OYmcZxZGaaiIiIiBwyrx2SxYaH63qzzYQq T+TSe0f0RKpL8Tzm+0PK81iZaRwvh2amOaeJiIiIyC5PZGWxlSeS7Cc8XGRB4el63eZJT6Tv HVGXnpnGccHxwXHC8cJxU57Hpcw0PY8iIiIi0s1su7LY8GyR/YSHiywoPF1kQ5UncimLjftZ s9jUuWWm8bleykwrzyPHBccHxwnHC8cNx4+ZaSIiIiJy03ltVxYb3q3KYsPTRTYUGVE3yWJz DlCn5Hk8NDON46My0zhu1jLTmNN8liYiIiIi+85sNa+NWWzlicwstquNWWzKzLS1zLTyPI6Z ael5FBERERE5dF7rPJFkQuHtyiw2vF+VxbbkifS9I+ocMtPK81iZaXzuMzON44LjQ8+jiIiI iNzVvLb03hE8XJnFVp5IMqPwfpEhNXoizWJT55SZlp5HPu987vn8l+cxM9M4Xnx/iIiIiIjc 1cy2bxYb3i8ypPCCkSmFN2wpi01PpDpVzyOfZz7XfL75nPN553NvZpqIiIiIPO15Ld87Up7I MYsNL9haFhseMt7LoCdSHdOMtuR55HPK53UtM43P+ZiZVp5HM9NERERE5D7nNbPYlJlpZqaJ iIiIyPHObJ0nsrLY8IRlFhuesTGLDW9ZZrE5r6mnOafV+0P4XI6ZaXx+MzNNz6OIiIiIHOu8 hkZPZGWxjZ5IsqbwjJE9db3Zesl2ZbHpiVRPOzOtPI98bvn88jkePY983s1MExEREZFjnNeW stjSE1lZbHjGrjZbD1lmsemJVMfmeczMND6vfG75/I6Zael5HDPTnNNERERE5BhmtkOy2PCQ 3SSLzXlN3dacdkhmGp9XM9NERERE5JTntfG9I+mJPCSLbc0T6cymbiszbc3zWJlpeB7XMtP4 PI+eR5+liYiIiMgpzGz5jA1v2JjFVp7IzGJLT6RZbOq+M9PS85iZaeV55HOL57HeH1KeR5+l iYiIiMgpz2t4xMYsNrxkDzZbbxkZVXjNyKwqT2Rmsa15In3viNrn/SFrnsfKTCvPI58/Pod8 Hvlc8vnkczpmpul5FBEREZFTn9e6LLbyRFYWG14zMqvwRK5lseFZ45mInkh1qOeRzw2fnzEz Dc8jnzc+d3z++BxWZlp5Hs1MExEREZFzndm6LDa8ZZnFhvdszGJLT6RZbOommWmj53HMTONz Z2aaiIiIiFzyvHZIFhuetOvNNuOqPJFL7x3RE6nWPI/5/pDyPFZmGp+vQzPTnNNERERE5Bzn tc4TWVls5YnMLLY1T6TvHVGHZKbx+eFzxOeJzxWeRz5n5XlcykzT8ygiIiIilzSz7cpiw4NG lhWeNLKt8KhVFhvetaUsNu7PzWIzM43PwVJmWnke+RzxeeJzxeeLzxmfNzPTRERERET2y2LD i1ZZbHjUyLoi8+omWWzONefrebxJZhqfp8pM43O2lpnGnOazNBERERG51Jmt5rXKYsN7xvsc yhOZWWxXG7PYnNFunpnG5ycz08rzyOetPI98DtPzKCIiIiJy6fNa54kk4wqvWmaxlSeSbKwl T6TvHbnMzLTyPFZmGp+TzEzjc8TnSc+jiIiIiMh+89rSe0fwpGUWW3kixyw2PG68N+Lhxiy2 S85M4+efnkc+H3ge+byU5zEz0/h8+f4QEREREZH9ZrZ9s9jwspGJhbdtLYtNT+RleR75+eN5 5PPA54LPB58TM9NERERERG53Xsv3jpQncsxiw9tmFtvleR75ueJ5XMtM43MxZqaV59HMNBER ERGRm89rh2ax4Yk0i83MNDPTRERERETuZ2brPJGVxYbHLbPY0hNpFtt5zGn1/hA8j2NmGj/v zEwrzyOfDz2PIiIiIiJ3N6+h0RNZWWyjJ5LsLDxwZGldb7beuF1ZbHoij8/zuCszrTyP/Jz5 efNz5+dfmWl8Lvh8mJkmIiIiInL389pSFlt6IiuLDQ/c1WbricssNjxzvIdCT+Tpeh4zM42f Lz9nft5jZlp6HsfMNOc0EREREZHbn9kOyWLDE3eTLDbntac3px2SmcbP18w0EREREZHjmdfG 946kJ3Ipi42MLbK2yNwie2uXJ9KZ7ellpq15HvfJTOPnP3oefZYmIiIiInL/M1s+Y8PrNmax lScys9jSE2kW2/FnpqXnMTPTyvM4ZqaV59FnaSIiIiIixzGv8QwFz9uYxYY37sFm65Ujcwvv XGWx4amrLLbOE+l7R+4nM608j5WZVp5Hfl783Pj58XPk58nPdcxM0/MoIiIiInJc81qXxVae yMpiwztHBhdeurUsNjx4POPRE3n3nke+z3y/1zLT+Dnx8+LnVplp5Xk0M01ERERE5DRmti6L Da9cZrHhpVvKYitPZGaxOa/dfWZaeR7HzDR+TpmZNnoefZYmIiIiInJa89pNs9jKE7n03hE9 kbfnecz3h5TnsTLT8DxmZho/r12Zac5pIiIiIiLHP691nsjKYitPZGaxrXkife/I3Wampecx M9PK87iUmabnUURERETkdGe2XVlseOrI5sJjR1YXnrvKYitP5JjFxrxhFtvtZaaV55HvO99/ fg78PMxMExERERE573ntkCw2PHdkd+GJvEkWm3PazTLT+H7zfef7X5lpeB7NTBMREREROf+Z rea1ymLDS8f7KcoTmVlsVxuz2O4zM43vd2amleeRn095Hvm55ZwmIiIiIiLnNa91nkg8d3jv xiw2PJFmsc1npuF5rMw0PI+ZmbbkeTQzTURERETkcua1pfeO4LHLLLbyRI5ZbHj2eA/Gw41Z bIdkpvH94vvG968y0/A88v0tz2NmpvHz8P0hIiIiIiKXObPtm8WGN4+ML7x6mcV26Z7IQzyP mZnG95HvJ99XM9NERERERKSb1/bJYsOrR+YXnsjrzWVnsc1kpvF9HDPT0vNoZpqIiIiIiNwk iw1P5KVmsc1kpvF9MzNNREREREQOndnW3juCN6+y2PDsZRZbeiLPPYttKTONP1+Xmcb3JzPT yvPI91PPo4iIiIiI7DuvoV2eSN6DgYcvs9iuN1uv364stlP1RKbncVdmWnke+b7geeT7NHoe +X6OmWl8332WJiIiIiIi3by2lMWWnsjKYsPTd7XZevwyiw0PIO/VOHVP5D6eR/6c/HkzM43v B98Xvj9jZlp6HsfMNOc0ERERERHZNbMdksWGx4+sMDLDKottyRM5vnfkmOe1Jc/jmJlWnscx M43vx1pmmp5HERERERGZndfG946kJ3Ipiw1PJNlh77/ZZont8kQe48y2lpm25nnkz8mft8tM 4/s1eh59liYiIiIiIrMz264stvJEjlls5Yk8lSy2QzLT0vOYmWnleRwz08rz6LM0ERERERG5 i3mNZ0LMazwjKk8k78vA6/dg83IWG17AymLDI1hZbJ0n8mm9dyRntM7zWJlp/Hn4c/Hn48/J nxfPI39+vg9jZhrfLzPTRERERETkrua1XVlseP4qiw0vIJlieAPXstjwFPLM6ml6Itc8j3xd fH1rmWn8ufjz8eeszLTyPJqZJiIiIiIiT2Nm2+WJzCw2vIFrWWx4CjOL7b7ntTXPYz1LK8/j UmYaf67MTBs9j74/REREREREnua81mWxPdi8nMVG1lhmsZUncum9I/fhiVzzPOb7Q8rzOJOZ 5pwmIiIiIiL3Pa/tk8WGN3DMYlvzRN7He0f2yUxb8jxmZhqex7XMND2PIiIiIiJyLDPbriw2 PIJkjeEZJHsMD2FlsaUn8q6z2JYy05jTljLT+LoqM42vl6+br58/B38eM9NEREREROQU5rVD stjwEJJFhqfwJllsM57HQzLT+Pr4Ovl6zUwTEREREZFTntnyGVt5InnfRnkiM4vtarPNJiOj 7K6y2GYy0/j6MjOtPI/8ecrzyJ8z5zQREREREZFTmNfGLDa8g2SQ4SUkkyyz2PAc3mYW26GZ afQfM9P4Ovl69TyKiIiIiMg5zGtLWWx4BnkPR3ki17LY8CDyXo+Hm5tlse2bmcb+9KHfmJk2 eh75uvn6fX+IiIiIiIicw8y2bxYbXkMyy/AeZhbb6InssthS+3geMzONvvTn6zAzTURERERE Lmle2yeLDe8hGWZ4Ea83h2Wxpd9x38w0+tCPvkuZaXgezUwTEREREZFzndeWPJFLWWx4Iskw w4t4aBZb6ZDMNPpUZhr9zUwTEREREZFLnNnWstjwGlYWGx7EMYutPJFrWWzMZqXx/SGZmVae x8xMK88j/fU8ioiIiIjIpc5raJcnci2LDe9iZbHVMzZmMnyOJep8fwj/+/I8ZmbakudxzEzj 6/RZmoiIiIiIXNK8Vp7IzGJLT+SYxYZnccxi45kZv4fG8zPeG8I/qfn3Y2Ya/3/2wfM4Zqal 53HMTHNOExERERGRS5vZ1jyRS1lseBYri+16s31Wxu+fMZM93GzfG8I/qfn3rJOZhoeS/x// fzPTRERERERE9pvXxveOpCeystjKE1lZbPWMjd8/Ix+NLGt+H41/UvPvWe8y09h/9Dz6LE1E REREROQdZ7ZdWWx4FvO9IzwrYxbjXSG815HfZ+Of1Pz7epZW7w/h/z9mppXn0WdpIiIiIiIi u+c1nnExr/HMqzyRmcXGMzJ+74z8at4VwlzGux35JzX/nnX+d/zv6/0h5XlkX/Y3M01ERERE RGS/eW2fLDaekfF7Z8xiPDdjLsPnyD+p+fesr70/RM+jiIiIiIjIzWa27r0jPCPj987IReN3 0B48ns34JzX/nvV6lmZmmoiIiIiIyO3Pa+N7R3hGxu+d8Y4Q3ufIszNmM/5Jzb9nnf/dUmaa c5qIiIiIiMjcvDZmsdUzNmYwnpcxjz232T4/45/U/HvW81mankcREREREZHbn9nGZ2z17hHm MX4PrURd7w7xWZqIiIiIiMjdz2vjzMbzMuaxUfUcLWc05zQREREREZH7mdlqbhtVa85oIiIi IiIiT29uW5KIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI iIiIiJwYr3mkd3mk5x/pufj3H/RI7x31lz7mnf7/v/niV73+vdBm836P9/jAR3rXR3rn2Pfd Hv87Qm6qx9teudm84RV9j7e98g2veOuzb37m7c+/+Rn++2uHr/PFR3rL46/zamEPvoYXH/0v Xnw1eu2rXtygt2xqn/Fr5usbvxcvPPvo3+34Ol949jWveOHZL3nmPd8dveYV++x729/ju/7Z ESRbPd766Hvy5mf6Hvzc+Jnxs+O/H/I9P4c/Q3421/Z/6bO5ef2rPvfV6C2L+77H43837s/X X8fPqxf2JwD47c/v97W/8ZHetPI1Vohw9dt80Uv/ean+4Kjf/vw7rlPnOoyBxYf0zr2oP6Tp RZ3rs71zL+oPbXpR5/ps79yL+sOaXtS5Pts796L+8KYXda7P9s69qD+i6UWd67O9cy/qj2x6 Uef6bO/ci/qjml7UuT7bO/ei/uimF3Wuz/bOvag/pulFneuzvXMv6o9telHn+mzv3Iv645pe 1Lk+2zv3ov74phd1rs/2zr2Wenf1bff+hB29c322d+5F/camF3Wuz/bOvag/selFneuzvXMv 6k9qelHn+mzv3Iv6k5te1Lk+2zv3ov6Uphd1rs/2zr2oP7XpRZ3rs71zL+o3Nb2oc322d+5F /ULTizrXZ3vnXtSf1vSizvXZ3rkX9ac3vahzfbZ37kX9GU0v6lyf7Z17UX9m04s612d7517U n9X0os712d65F/VnN72oc322d+5F/ZObXtS5Pts796L+KU0v6lyf7Z17UX9O04s612d7517U P7XpRZ3rs71zL+qf1vSizvXZ3rkX9U+n/sKX/vNEL+pcn+2de730d0ZD7/FryfXZ3rkX9c9o elHn+mzv3Iv6Zza9qHN9tnfuRf2zml7UuT7bO/ei/tlNL+pcn+2de1H/nKYXda7P9s69lnp3 9W33/rk7euf6bO/ci/rnNb2oc322d+5F/fObXtS5Pts796L+BU0v6lyf7Z17Uf/Cphd1rs/2 zr2of1HTizrXZ3vnXtS/uOlFneuzvXMv6l/S9KLO9dneuRf1L216Uef6bO/ci/qXNb2oc322 d+5F/cubXtS5Pts796L+FU0v6lyf7Z17Uf/Kphd1rs/2zr2o39L0os712d65F/WvanpR5/ps 79yL+sWmF3Wuz/bOvah/ddOLOtdne+de1L+m6UWd67O9cy/qX9v0os712d65F/Wva3pR5/ps 79yL+tc3vahzfbZ37kX9G5pe1Lk+2zv3on5r04s612d7517Uv7HpRZ3rs71zL+rPbXpR5/ps 79yL+jc1vahzfbZ37kX9m5te1Lk+2zv3Wurd1bfd+7fs6J3rs71zL+rf2vSizvXZ3rkX9W9r elHn+mzv3Iv6bU0v6lyf7Z17Uf/2phd1rs/2zr2of0fTizrXZ3vnXtS/s+lFneuzvXMv6t/V 9KLO9dneuRf17256Uef6bO/ci/r3NL2oc322d+5F/XubXtS5Pts796J+e9OLOtdne+de1L+v 6UWd67O9cy/q39/0os712d65F/UfaHpR5/ps79yL+g82vahzfbZ37kX9h5pe1Lk+2zv3ov7D TS/qXJ/tnXtR/5GmF3Wuz/bOvaj/aNOLOtdne+de1H+s6UWd67O9cy/qP970os712d65F/Wf aHpR5/ps79yL+k82vahzfbZ37kX9p5pe1Lk+2zv3ov7TTS/qXJ/tnXtR/5mmF3Wuz/bOvZZ6 d/Vt9/6zO3rn+mzv3Iv6zzW9qHN9tnfuRf3nm17UuT7bO/ei/gtNL+pcn+2de1H/ReoveOk/ T/SizvXZ3rkX9V8aeo9fS67P9s69qP9y04s612d7517Uf6XpRZ3rs71zL+rPa3pR5/ps79yL +vObXtS5Pts796L+gqYXda7P9s69qL+w6UWd67O9cy/qL2p6Uef6bO/ci/qvNr2oc322d+5F /deaXtS5Pts796L+600v6lyf7Z17Uf+Nphd1rs/2zr2o/2bTizrXZ3vnXtR/q+lFneuzvXMv 6r/d9KLO9dneuRf132l6Uef6bO/ci/rvNr2oc322d+5F/feaXtS5Pts796L++00v6lyf7Z17 Uf+Dphd1rs/2zr2o/2HTizrXZ3vnXtT/qOlFneuzvXOvpd5dfdu9//GO3rk+2zv3ov4nTS/q XJ/tnXtR/9OmF3Wuz/bOvaj/WdOLOtdne+de1P+86UWd67O9cy/qL256Uef6bO/ci/pfNL2o c322d+5F/S+bXtS5Pts796L+V00v6lyf7Z17Uf/rphd1rs/2zr2o/03TizrXZ3vnXtT/tulF neuzvXMv6n/X9KLO9dneuRf1v296Uef6bO/ci/o/NL2oc322d+5F/SVNL+pcn+2de1H/x6YX da7P9s69qP9T04s612d7517U/7npRZ3rs71zL+r/0vSizvXZ3rkX9X9telHn+mzv3Iv6vzW9 qHN9tnfuRf3fm17UuT7bO/ei/h9NL+pcn+2de1H/z6YXda7P9s69qP9X04s612d7517U/7vp RZ3rs71zr6XeXX3bvf/Pjt65Pts796L+v00v6lyf7Z17Uf+/phd1rs/2zr2ov7TpRZ3rs71z L+qXNljpRZ3rs71zL+ovN/Qev5Zcn+2de1G/oulFneuzvXMv6i/f9KLO9dneuRf1OzW9qHN9 tnfuRf3OTS/qXJ/tnXtRf4WmF3Wuz/bOvaifaXpR5/ps79yL+l2aXtS5Pts796L+ik0v6lyf 7Z17UX+lphd1rs/2zr2ov3LTizrXZ3vnXtTvSv35L/3niV7UuT7bO/eifnboPX4tuT7bO/ei /ipNL+pcn+2de1F/1aYXda7P9s69qJ9relHn+mzv3Iv6qzW9qHN9tnfuRf3Vm17UuT7bO/ei fremF3Wuz/bOvahf2fSizvXZ3rkX9ddoelHn+mzv3Gupd1ffdu+vuaN3rs/2zr2ov1bTizrX Z3vnXtRfu+lFneuzvXMv6q/T9KLO9dneuRf11216Uef6bO/ci/r5phd1rs/2zr2o373pRZ3r s71zL+qv1/SizvXZ3rkX9ddvelHn+mzv3Iv6VU0v6lyf7Z17UT9oelHn+mzv3Iv6PZpe1Lk+ 2zv3ov4GTS/qXJ/tnXtRf8OmF3Wuz/bOvai/UdOLOtdne+de1N+46UWd67O9cy/qb9L0os71 2d65F/V7Nr2oc322d+5F/eqmF3Wuz/bOvajfq+lFneuzvXMv6m/a9KLO9dneuRf1N2t6Uef6 bO/ci/q9m17UuT7bO/ei/uZNL+pcn+2de1F/i6YXda7P9s69qL9l04s612d7517UV00v6lyf 7Z17LfXu6tvu/a129M712d65F/W3bnpR5/ps79yL+ts0vahzfbZ37kX9bZte1Lk+2zv3ov52 TS/qXJ/tnXtRf/umF3Wuz/bOvajfp+lFneuzvXMv6u/Q9KLO9dneuRf1+za9qHN9tnfuRf0d m17UuT7bO/eifk3TizrXZ3vnXtTv1/SizvXZ3rkX9WubXtS5Pts796L+Tk0v6lyf7Z17Ub9/ 04s612d7517U100v6lyf7Z17UX/nphd1rs/2zr2oP6DpRZ3rs71zL+oPbHpR5/ps79yL+nVN L+pcn+2de1F/l6YXda7P9s69qF/f9KLO9dneuRf1d216Uef6bO/ci/q7Nb2oc322d+5F/d2b XtS5Pts796L+Hk0v6lyf7Z17UX/Pphd1rs/2zr2Wenf1bff+Xjt65/ps79yL+ntTf95L/3mi F3Wuz/bOvai/z9B7/FpyfbZ37kX9fZte1Lk+2zv3on7Y9KLO9dneuRf192t6Uef6bO/ci/r7 N72oc322d+5F/QOaXtS5Pts796L+gU0v6lyf7Z17Uf+gphd1rs/2zr2of3DTizrXZ3vnXtQ/ pOlFneuzvXMv6h/a9KLO9dneuRf1BzW9qHN9tnfuRf3Dml7UuT7bO/ei/uFNL+pcn+2de1H/ iKYXda7P9s69qH9k04s612d7517UP6rpRZ3rs71zL+of3fSizvXZ3rkX9Y9pelHn+mzv3Iv6 xza9qHN9tnfuRf3jml7UuT7bO/ei/vFNL+pcn+2de1H/hKYXda7P9s69qH9i04s612d7517U P6npRZ3rs71zr6XeXX3bvd+wo3euz/bOvag/uOlFneuzvXMv6g9pelHn+mzv3Iv6Q5te1Lk+ 2zv3ov6wphd1rs/2zr2oP7zpRZ3rs71zL+qPaHpR5/ps79yL+iObXtS5Pts796L+qKYXda7P 9s69qD+66UWd67O9cy/qj2l6Uef6bO/ci/pjm17UuT7bO/ei/rimF3Wuz/bOvag/vulFneuz vXMv6k9oelHn+mzv3Iv6jU0v6lyf7Z17UX9i04s612d7517Un9T0os712d65F/UnN72oc322 d+5F/SlNL+pcn+2de1F/atOLOtdne+de1G9qelHn+mzv3Iv6haYXda7P9s69qD+t6UWd67O9 cy/qT296Uef6bO/ci/ozml7UuT7bO/ei/symF3Wuz/bOvZZ6d/Vt9/6sHb1zfbZ37kX92U0v 6i9j7yyjNS/oNTqgIwYGJopKWIigqKAoKCiK3YkFWBgYYDcqKGJ3IliIATa2IgqSJnYXdnff s+fCunudeXnOh+es++n3e3nXOXs9M3v/eWfmCx8G723bLvig0IK9t2274INDC/betu2CnxVa sPe2bRf87NCCvbdtu+BDQgv23rbtgp8TWrD3tm0XfGhowd7btl3wc0ML9t627YKfF1qw97Zt F/z80IK9t2274BeEFuy9bdsFvxA+fd1rvRbsvW3bBb9oWXv5s3hv23bBLw4t2Hvbtgt+SWjB 3tu2XfBLQwv23rbtgl8WWrD3tm0X/PLQgr23bbvgV4QW7L1t2wW/MrRg723bLvhVoQV7b9t2 wa8OLdh727YLfk1owd7btl3wa0ML9t627YJfF1qw97Zt16J24tVuH7ZC23vbtgt+fWjB3tu2 XfDhoQV7b9t2wUeEFuy9bdsFvyG0YO9t2y74jaEFe2/bdsFvCi3Ye9u2C35zaMHe27Zd8FtC C/betu2Cjwwt2Hvbtgt+a2jB3tu2XfBRoQV7b9t2wW8LLdh727YLfntowd7btl3wO0IL9t62 7YLfGVqw97ZtF3x0aMHe27Zd8DGhBXtv23bB7wot2Hvbtgt+d2jB3tu2XfB7Qgv23rbtgt8b WrD3tm0X/L7Qgr23bbvg94cW7L1t2wV/ILRg723bLvjY0IK9t2274A+GFuy9bdu1qJ14tdsf WqHtvW3bBX84tGDvbdsu+COhBXtv23bBHw0t2Hvbtgv+WGjB3tu2XfDHQwv23rbtgj8RWrD3 tm0X/MnQgr23bbvg40IL9t627YI/FVqw97ZtF3x8aMHe27Zd8KdDC/betu2CPxNasPe2bRd8 QmjB3tu2XfCJoQV7b9t2wZ8NLdh727YLPim0YO9t2y745NCCvbdtu+BTQgv23rbtgk8NLdh7 27YLPi20YO9t2y749NCCvbdtu+DPhRbsvW3bBX8+tGDvbdsu+AuhBXtv23bBXwwt2Hvbtgv+ Enzautd6Ldh727ZrUTvxare/vELbe9u2Cz4jtGDvbdsu+CuhBXtv23bBXw0t2Hvbtgv+WmjB 3tu2XfDXQwv23rbtgr8RWrD3tm0X/M3Qgr23bbvgb4UW7L1t2wV/O7Rg723bLvg7oQV7b9t2 wd8NLdh727YL/l5owd7btl3w90ML9t627YJ/EFqw97ZtF/zD0IK9t2274B+FFuy9bdsF/zi0 YO9t2y74J6EFe2/bdsFnhhbsvW3bBf80tGDvbdsu+GehBXtv23bBPw8t2Hvbtgv+RWjB3tu2 XfAvQwv23rbtgn8VWrD3tm0X/OvQgr23bbsWtROvdvs3K7S9t2274N+GFuy9bdsF/y60YO9t 2y7496EFe2/bdsF/CC3Ye9u2C/5jaMHe27Zd8J9CC/betu2C/xxasPe2bRf8l9CCvbdtu+C/ hhbsvW3bBf8ttGDvbdsu+O+hBXtv23bB/wgt2Hvbtgv+Z2jB3tu2XfC/Qgv23rbtgv8dWrD3 tm0X/J/Qgr23bbvg/4YW7L1t2wWv4QecQwv23rbtgjdY1l7+LN7btl3whqEFe2/bdsHnCi3Y e9u2Cz53aMHe27Zd8NrQgr23bbvg84QW7L1t2wVvFFqw97ZtF3ze0IK9t227FrUTr3b7fCu0 vbdtu+DzhxbsvW3bBV8gtGDvbdsueOPQgr23bbvgC4YW7L1t2wVfKLRg723bLvjCoQV7b9t2 wRcJLdh727YL3iS0YO9t2y74oqEFe2/bdsEXg09d91qvBXtv23bBF1/WXv4s3tu2XfAlQgv2 3rbtgi8ZWrD3tm0XfKnQgr23bbvgTUML9t627YIvHVqw97ZtF3yZ0IK9t2274M1CC/betu2C LxtasPe2bRd8udCCvbdtu+DLhxbsvW3bBW8eWrD3tm0XvEVowd7btl3wlqEFe2/bdsFbhRbs vW3bBV8htGDvbduuRe3Eq92+4gpt723bLvhKoQV7b9t2wVcOLdh727YLvkpowd7btl3w1qEF e2/bdsFXDS3Ye9u2C94mtGDvbdsu+GqhBXtv23bB24YW7L1t2wVvF1qw97ZtF3z10IK9t227 4GuEFuy9bdsFbx9asPe2bRd8zdCCvbdtu+BrhRbsvW3bBV87tGDvbdsueIfQgr23bbvgHUML 9t627YKvE1qw97ZtF3zd0IK9t2274J1CC/betu2CrxdasPe2bRd8/dCCvbdtu+CdQwv23rbt gncJLdh727YLvkFowd7btl3wDUML9t627VrUTrza7V1XaHtv23bBu4UW7L1t2wXfKLRg723b LvjGoQV7b9t2wbuHFuy9bdsF3yS0YO9t2y74pqEFe2/bdsF7hBbsvW3bBd8stGDvbdsu+Oah BXtv23bBtwgt2Hvbtgu+ZWjB3tu2XfCtQgv23rbtgm8dWrD3tm0XfJvQgr23bbvg24YW7L1t 2wXfLrRg723bLvj2oQV7b9t2wXcILdh727YLvmNowd7btl3wnUIL9t627YLvHFqw97ZtF3wX +JR1r/VasPe2bRd812Xt5c/ivW3bBd8ttGDvbdsu+O6hBXtv23bBe4YW7L1t27WonXi12/dY oe29bdsF3zO0YO9t2y74XqEFe2/bdsH3Di3Ye9u2C75PaMHe27Zd8F6hBXtv23bBe4cW7L1t 2wXvE1qw97ZtF3zf0IK9t2274PuFFuy9bdsF3z+0YO9t2y74AaEFe2/bdsEPDC3Ye9u2C943 tGDvbdsu+EGhBXtv23bBDw4t2Hvbtgt+SGjB3tu2XfBDQwv23rbtgvcLLdh727YLflhowd7b tl3ww0ML9t627YIfEVqw97ZtF/zI0IK9t2274P1DC/betu2CDwgt2Hvbtgt+VGjB3tu2XfCj Qwv23rbtWtROvNrtx6zQ9t627YIfG1qw97ZtF/y40IK9t2274MeHFuy9bdsFPyG0YO9t2y74 iaEFe2/bdsFPCi3Ye9u2C35yaMHe27Zd8FNCC/betu2CnxpasPe2bRf8tNCCvbdtu+ADQwv2 3rbtgp8eWrD3tm0X/IzQgr23bbvgZ4YW7L1t2wUfFFqw97ZtF3xwaMHe27Zd8LNCC/betu2C nx1asPe2bRd8SGjB3tu2XfBzQgv23rbtgg8NLdh727YLfm5owd7btl3w80IL9t627YKfH1qw 97ZtF/yC0IK9t2274BeGFuy9bdu1qJ14tdsvWqHtvW3bBb84tGDvbdsu+CWhBXtv23bBLw0t 2Hvbtgt+WWjB3tu2XfDLQwv23rbtgl8Bn7zutV4L9t627YJfuay9/Fm8t2274FeFFuy9bdsF vzq0YO9t2y74NaEFe2/bdsGvDS3Ye9u2C35daMHe27Zd8GGhBXtv23bBrw8t2Hvbtgs+PLRg 723bLviI0IK9t2274DeEFuy9bdsFvzG0YO9t2y74TaEFe2/bdsFvDi3Ye9u2C35LaMHe27Zd 8JGhBXtv23bBbw0t2Hvbtgs+KrRg723bLvhtoQV7b9t2wW8PLdh727ZrUTvxarffsULbe9u2 C35naMHe27Zd8NGhBXtv23bBx4QW7L1t2wW/K7Rg723bLvjdoQV7b9t2we8JLdh727YLfm9o wd7btl3w+0IL9t627YLfH1qw97ZtF/yB0IK9t2274GNDC/betu2CPxhasPe2bRf8odCCvbdt u+APhxbsvW3bBX8ktGDvbdsu+KOhBXtv23bBHwst2Hvbtgv+eGjB3tu2XfAnQgv23rbtgj8Z WrD3tm0XfFxowd7btl3wp0IL9t627YKPDy3Ye9u2C/50aMHe27Zd8GdCC/betu2CTwgt2Hvb tmtRO/Fqt09coe29bdsFfza0YO9t2y74pNCCvbdtu+CTQwv23rbtgk8JLdh727YLPjW0YO9t 2y74tNCCvbdtu+DTQwv23rbtgj8XWrD3tm0X/PnQgr23bbvgL4QW7L1t2wV/MbRg723bLvhL oQV7b9t2wV8OLdh727YLPiO0YO9t2y74K6EFe2/bdsFfDS3Ye9u2C/5aaMHe27Zd8Nfhk9a9 1mvB3tu2XfA3lrWXP4v3tm0X/M3Qgr23bbvgb4UW7L1t2wV/O7Rg723bLvg7oQV7b9t2wd8N Ldh727YL/l5owd7btl3w90ML9t627VrUTrza7R+s0Pbetu2CfxhasPe2bRf8o9CCvbdtu+Af hxbsvW3bBf8ktGDvbdsu+MzQgr23bbvgn4YW7L1t2wX/LLRg723bLvjnoQV7b9t2wb8ILdh7 27YL/mVowd7btl3wr0IL9t627YJ/HVqw97ZtF/yb0IK9t2274N+GFuy9bdsF/y60YO9t2y74 96EFe2/bdsF/CC3Ye9u2C/5jaMHe27Zd8J9CC/betu2C/xxasPe2bRf8l9CCvbdtu+C/hhbs vW3bBf8ttGDvbdsu+O+hBXtv23bB/wgt2Hvbtgv+Z2jB3tu2XYvaiVe7/a8V2t7btl3wv0ML 9t627YL/E1qw97ZtF7zuB5xDC/betu2C16w95xbsvW3bBW+wrL38Wby3bbvgDUML9t627YLP FVqw97ZtF3zu0IK9t2274LWhBXtv23bB5wkt2HvbtgveKLRg723bLvi8oQV7b9t2wecLLdh7 27YLPn9owd7btl3wBUIL9t627YI3Di3Ye9u2C75gaMHe27Zd8IVCC/betu2CLxxasPe2bRd8 kdCCvbdtu+BNQgv23rbtgi8aWrD3tm0XfLHQgr23bbvgi4cW7L1t2wVfIrRg723bLviSoQV7 b9t2LWonXu32pVZoe2/bdsGbhhbsvW3bBV86tGDvbdsu+DKhBXtv23bBm4UW7L1t2wVfNrRg 723bLvhyoQV7b9t2wZcPLdh727YL3jy0YO9t2y54i9CCvbdtu+AtQwv23rbtgreCP7vutV4L 9t627YKvsKy9/Fm8t2274CuGFuy9bdsFXym0YO9t2y74yqEFe2/bdsFXCS3Ye9u2C946tGDv bdsu+KqhBXtv23bB24QW7L1t2wVfLbRg723bLnjb0IK9t2274O1CC/betu2Crx5asPe2bRd8 jdCCvbdtu+DtQwv23rbtWtROvNrta67Q9t627YKvFVqw97ZtF3zt0IK9t2274B1CC/betu2C dwwt2Hvbtgu+TmjB3tu2XfB1Qwv23rbtgncKLdh727YLvl5owd7btl3w9UML9t627YJ3Di3Y e9u2C94ltGDvbdsu+AahBXtv23bBNwwt2HvbtgveNbRg723bLni30IK9t2274BuFFuy9bdsF 3zi0YO9t2y5499CCvbdtu+CbhBbsvW3bBd80tGDvbdsueI/Qgr23bbvgm4UW7L1t2wXfPLRg 723bLvgWoQV7b9t2wbcMLdh727YLvlVowd7btl2L2olXu33rFdre27Zd8G1CC/betu2Cbxta sPe2bRd8u9CCvbdtu+DbhxbsvW3bBd8htGDvbdsu+I6hBXtv23bBdwot2Hvbtgu+c2jB3tu2 XfBdQgv23rbtgu8aWrD3tm0XfLfQgr23bbvgu4cW7L1t2wXvGVqw97ZtF3yP0IK9t2274HuG Fuy9bdsF3yu0YO9t2y743qEFe2/bdsH3CS3Ye9u2C94rtGDvbdsueO/Qgr23bbvgfUIL9t62 7YLvG1qw97ZtF3y/0IK9t2274PuHFuy9bdsFPyC0YO9t2y74gaEFe2/bdi1qJ17t9r4rtL23 bbvgB4UW7L1t2wU/OLRg723bLvghoQV7b9t2wQ8NLdh727YL3i+0YO9t2y74YaEFe2/bdsEP Dy3Ye9u2C35EaMHe27Zd8CNDC/betu2C9w8t2Hvbtgs+ILRg723bLvhRoQV7b9t2wY+GT1z3 Wq8Fe2/bdsGPWdZe/ize27Zd8GNDC/betu2CHxdasPe2bRf8+NCCvbdtu+AnhBbsvW3bBT8x tGDvbdsu+EmhBXtv23bBTw4t2Hvbtgt+SmjB3tu2XfBTQwv23rbtgp8WWrD3tm0XfGBowd7b tl3w00ML9t627VrUTrza7Wes0Pbetu2CnxlasPe2bRd8UGjB3tu2XfDBoQV7b9t2wc8KLdh7 27YLfnZowd7btl3wIaEFe2/bdsHPCS3Ye9u2Cz40tGDvbdsu+LmhBXtv23bBzwst2Hvbtgt+ fmjB3tu2XfALQgv23rbtgl8YWrD3tm0X/KLQgr23bbvgF4cW7L1t2wW/JLRg723bLviloQV7 b9t2wS8LLdh727YLfnlowd7btl3wK0IL9t627YJfGVqw97ZtF/yq0IK9t2274FeHFuy9bdsF vya0YO9t2y74taEFe2/bdsGvCy3Ye9u2a1E78Wq3D1uh7b1t2wW/PrRg723bLvjw0IK9t227 4CNCC/betu2C3xBasPe2bRf8xtCCvbdtu+A3hRbsvW3bBb85tGDvbdsu+C2hBXtv23bBR4YW 7L1t2wW/NbRg723bLvio0IK9t2274LeFFuy9bdsFvz20YO9t2y74HaEFe2/bdsHvDC3Ye9u2 Cz46tGDvbdsu+JjQgr23bbvgd4UW7L1t2wW/O7Rg723bLvg9oQV7b9t2we8NLdh727YLfl9o wd7btl3w+0ML9t627YI/EFqw97ZtF3xsaMHe27Zd8AdDC/betu1a1E682u0PrdD23rbtgj8c WrD3tm0X/JHQgr23bbvgj4YW7L1t2wV/LLRg723bLvjjoQV7b9t2wZ8ILdh727YL/mRowd7b tl3wcaEFe2/bdsGfCi3Ye9u2Cz4+tGDvbdsu+NOhBXtv23bBnwkt2Hvbtgs+IbRg723bLvjE 0IK9t2274M/CJ6x7rdeCvbdtu+CTlrWXP4v3tm0XfHJowd7btl3wKaEFe2/bdsGnhhbsvW3b BZ8WWrD3tm0XfHpowd7btl3w50IL9t627YI/H1qw97ZtF/yF0IK9t2274C+GFuy9bdsFfym0 YO9t265F7cSr3f7yCm3vbdsu+IzQgr23bbvgr4QW7L1t2wV/NbRg723bLvhroQV7b9t2wV8P Ldh727YL/kZowd7btl3wN0ML9t627YK/FVqw97ZtF/zt0IK9t2274O+EFuy9bdsFfze0YO9t 2y74e6EFe2/bdsHfDy3Ye9u2C/5BaMHe27Zd8A9DC/betu2CfxRasPe2bRf849CCvbdtu+Cf hBbsvW3bBZ8ZWrD3tm0X/NPQgr23bbvgn4UW7L1t2wX/PLRg723bLvgXoQV7b9t2wb8MLdh7 27YL/lVowd7btl3wr0ML9t627VrUTrza7d+s0Pbetu2CfxtasPe2bRf8u9CCvbdtu+Dfhxbs vW3bBf8htGDvbdsu+I+hBXtv23bBfwot2Hvbtgv+c2jB3tu2XfBfQgv23rbtgv8aWrD3tm0X /LfQgr23bbvgv4cW7L1t2wX/I7Rg723bLvifoQV7b9t2wf8KLdh727YL/ndowd7btl3wf0IL 9t627YL/G1qw97ZtF7zmPOfcgr23bbvgDZa1lz+L97ZtF7xhaMHe27Zd8LlCC/betu2Czx1a sPe2bRe8NrRg723bLvg8oQV7b9t2wRuFFuy9bdsFnze0YO9t265F7cSr3T7fCm3vbdsu+Pyh BXtv23bBFwgt2HvbtgveOLRg723bLviCoQV7b9t2wRcKLdh727YLvnBowd7btl3wRUIL9t62 7YI3CS3Ye9u2C75oaMHe27Zd8MVCC/betu2CLx5asPe2bRd8idCCvbdtu+BLhhbsvW3bBV8q tGDvbdsueNPQgr23bbvgS8OfWfdarwV7b9t2wZdZ1l7+LN7btl3wZqEFe2/bdsGXDS3Ye9u2 C75caMHe27Zd8OVDC/betu2CNw8t2HvbtgveIrRg723bLnjL0IK9t2274K1CC/betu2CrxBa sPe2bdeiduLVbl9xhbb3tm0XfKXQgr23bbvgK4cW7L1t2wVfJbRg723bLnjr0IK9t2274KuG Fuy9bdsFbxNasPe2bRd8tdCCvbdtu+BtQwv23rbtgrcLLdh727YLvnpowd7btl3wNUIL9t62 7YK3Dy3Ye9u2C75maMHe27Zd8LVCC/betu2Crx1asPe2bRe8Q2jB3tu2XfCOoQV7b9t2wdcJ Ldh727YLvm5owd7btl3wTqEFe2/bdsHXCy3Ye9u2C75+aMHe27Zd8M6hBXtv23bBu4QW7L1t 2wXfILRg723bLviGoQV7b9t2LWonXu32riu0vbdtu+DdQgv23rbtgm8UWrD3tm0XfOPQgr23 bbvg3UML9t627YJvElqw97ZtF3zT0IK9t2274D1CC/betu2CbxZasPe2bRd889CCvbdtu+Bb hBbsvW3bBd8ytGDvbdsu+FahBXtv23bBtw4t2Hvbtgu+TWjB3tu2XfBtQwv23rbtgm8XWrD3 tm0XfPvQgr23bbvgO4QW7L1t2wXfMbRg723bLvhOoQV7b9t2wXcOLdh727YLvktowd7btl3w XUML9t627YLvFlqw97ZtF3z30IK9t2274D1DC/betu1a1E682u17rND23rbtgu8ZWrD3tm0X fK/Qgr23bbvge4cW7L1t2wXfJ7Rg723bLniv0IK9t2274L1DC/betu2C9wkt2Hvbtgu+b2jB 3tu2XfD9Qgv23rbtgu8fWrD3tm0X/IDQgr23bbvgB4YW7L1t2wXvG1qw97ZtF/yg0IK9t227 4AeHFuy9bdsFPyS0YO9t2y74ofCn173Wa8He27Zd8H7L2sufxXvbtgt+WGjB3tu2XfDDQwv2 3rbtgh8RWrD3tm0X/MjQgr23bbvg/UML9t627YIPCC3Ye9u2C35UaMHe27Zd8KNDC/betu1a 1E682u3HrND23rbtgh8bWrD3tm0X/LjQgr23bbvgx4cW7L1t2wU/IbRg723bLviJoQV7b9t2 wU8KLdh727YLfnJowd7btl3wU0IL9t627YKfGlqw97ZtF/y00IK9t2274ANDC/betu2Cnx5a sPe2bRf8jNCCvbdtu+BnhhbsvW3bBR8UWrD3tm0XfHBowd7btl3ws0IL9t627YKfHVqw97Zt F3xIaMHe27Zd8HNCC/betu2CDw0t2Hvbtgt+bmjB3tu2XfDzQgv23rbtgp8fWrD3tm0X/ILQ gr23bbvgF4YW7L1t27WonXi12y9aoe29bdsFvzi0YO9t2y74JaEFe2/bdsEvDS3Ye9u2C35Z aMHe27Zd8MtDC/betu2CXxFasPe2bRf8ytCCvbdtu+BXhRbsvW3bBb86tGDvbdsu+DWhBXtv 23bBrw0t2Hvbtgt+XWjB3tu2XfBhoQV7b9t2wa8PLdh727YLPjy0YO9t2y74iNCCvbdtu+A3 hBbsvW3bBb8xtGDvbdsu+E2hBXtv23bBbw4t2Hvbtgt+S2jB3tu2XfCRoQV7b9t2wW8NLdh7 27YLPiq0YO9t2y74baEFe2/bdsFvDy3Ye9u2a1E78Wq337FC23vbtgt+Z2jB3tu2XfDRoQV7 b9t2wceEFuy9bdsFvyu0YO9t2y743aEFe2/bdsHvCS3Ye9u2C35vaMHe27Zd8PtCC/betu2C 3x9asPe2bRf8gdCCvbdtu+BjQwv23rbtgj8YWrD3tm0X/KHQgr23bbvgD4cW7L1t2wV/JLRg 723bLvijoQV7b9t2wR8LLdh727YL/jh8/LrXei3Ye9u2C/7EsvbyZ/Hetu2CPxlasPe2bRd8 XGjB3tu2XfCnQgv23rbtgo8PLdh727YL/nRowd7btl3wZ0IL9t627YJPCC3Ye9u2a1E78Wq3 T1yh7b1t2wV/NrRg723bLvik0IK9t2274JNDC/betu2CTwkt2Hvbtgs+NbRg723bLvi00IK9 t2274NNDC/betu2CPxdasPe2bRf8+dCCvbdtu+AvhBbsvW3bBX8xtGDvbdsu+EuhBXtv23bB Xw4t2Hvbtgs+I7Rg723bLvgroQV7b9t2wV8NLdh727YL/lpowd7btl3w10ML9t627YK/EVqw 97ZtF/zN0IK9t2274G+FFuy9bdsFfzu0YO9t2y74O6EFe2/bdsHfDS3Ye9u2C/5eaMHe27Zd 8PdDC/betu1a1E682u0frND23rbtgn8YWrD3tm0X/KPQgr23bbvgH4cW7L1t2wX/JLRg723b LvjM0IK9t2274J+GFuy9bdsF/yy0YO9t2y7456EFe2/bdsG/CC3Ye9u2C/5laMHe27Zd8K9C C/betu2Cfx1asPe2bRf8m9CCvbdtu+DfhhbsvW3bBf8utGDvbdsu+PehBXtv23bBfwgt2Hvb tgv+Y2jB3tu2XfCfQgv23rbtgv8cWrD3tm0X/JfQgr23bbvgv4YW7L1t2wX/LbRg723bLvjv oQV7b9t2wf8ILdh727YL/mdowd7btl2L2olXu/2vFdre27Zd8L9DC/betu2C/xNasPe2bRf8 39CCvbdtu+A1G51zC/betu2CN1jWXv4s3tu2XfCGoQV7b9t2wecKLdh727YLPndowd7btl3w 2tCCvbdtu+DzhBbsvW3bBW8UWrD3tm0XfN7Qgr23bbvg84UW7L1t2wWfP7Rg723bLvgCoQV7 b9t2wRuHFuy9bdsFXzC0YO9t2y74QqEFe2/bdsEXDi3Ye9u2C74I/Kl1r/VasPe2bRe8ybL2 8mfx3rbtgi8aWrD3tm0XfLHQgr23bbvgi4cW7L1t2wVfIrRg723bLviSoQV7b9t2LWonXu32 pVZoe2/bdsGbhhbsvW3bBV86tGDvbdsu+DKhBXtv23bBm4UW7L1t2wVfNrRg723bLvhyoQV7 b9t2wZcPLdh727YL3jy0YO9t2y54i9CCvbdtu+AtQwv23rbtgrcKLdh727YLvkJowd7btl3w FUML9t627YKvFFqw97ZtF3zl0IK9t2274KuEFuy9bdsFbx1asPe2bRd81dCCvbdtu+BtQgv2 3rbtgq8WWrD3tm0XvG1owd7btl3wdqEFe2/bdsFXDy3Ye9u2C75GaMHe27Zd8PahBXtv23bB 1wwt2HvbtmtRO/Fqt6+1Qtt727YLvnZowd7btl3wDqEFe2/bdsE7hhbsvW3bBV8ntGDvbdsu +LqhBXtv23bBO4UW7L1t2wVfL7Rg723bLvj6oQV7b9t2wTuHFuy9bdsF7xJasPe2bRd8g9CC vbdtu+AbhhbsvW3bBe8aWrD3tm0XvFtowd7btl3wjUIL9t627YJvHFqw97ZtF7x7aMHe27Zd 8E1CC/betu2CbxpasPe2bRe8R2jB3tu2XfDNQgv23rbtgm8eWrD3tm0XfIvQgr23bbvgW4YW 7L1t2wXfKrRg723bLvjWoQV7b9t2LWonXu32bVZoe2/bdsG3DS3Ye9u2C75daMHe27Zd8O1D C/betu2C7xBasPe2bRd8x9CCvbdtu+A7hRbsvW3bBd85tGDvbdsu+C6hBXtv23bBdw0t2Hvb tgu+W2jB3tu2XfDdQwv23rbtgvcMLdh727YLvkdowd7btl3wPUML9t627YLvFVqw97ZtF3zv 0IK9t2274PuEFuy9bdsF7xVasPe2bRe8d2jB3tu2XfA+oQV7b9t2wfeFj1v3Wq8Fe2/bdsH3 W9Ze/ize27Zd8P1DC/betu2CHxBasPe2bRf8wNCCvbdtuxa1E692e98V2t7btl3wg0IL9t62 7YIfHFqw97ZtF/yQ0IK9t2274IeGFuy9bdsF7xdasPe2bRf8sNCCvbdtu+CHhxbsvW3bBT8i tGDvbdsu+JGhBXtv23bB+4cW7L1t2wUfEFqw97ZtF/yo0IK9t2274EeHFuy9bdsFPya0YO9t 2y74saEFe2/bdsGPCy3Ye9u2C358aMHe27Zd8BNCC/betu2CnxhasPe2bRf8pNCCvbdtu+An hxbsvW3bBT8ltGDvbdsu+KmhBXtv23bBTwst2Hvbtgs+MLRg723bLvjpoQV7b9t2LWonXu32 M1Zoe2/bdsHPDC3Ye9u2Cz4otGDvbdsu+ODQgr23bbvgZ4UW7L1t2wU/O7Rg723bLviQ0IK9 t2274OeEFuy9bdsFHxpasPdzam+19N74rOaWS1/Pu/Te+ayv/NUoFzn7v7cs/aQ9l77fesFz 4jp2s303PHazQzc68oKHbnSDs37+Lmd93f2sxvLe8s7ZR2fbc/g8/vfO3HyPq/Jev7F2wfMf vvQ+bAXv4Us/4vA1e2x+1Na8D1vo5d+d7/n89lp673TW93zlzv66ZqsN1vDX2XCP3X9/Fdes uZIciz5nfs3Sc/L5HnPxc/6sd1t6b7r03mfpw95x6etvlkJnqLukP/D/63PfdpM1a7Zbm73b brLd2m032WujHTblvd3a/0/vAUvvvX+xds0pS5/VoUvfH7Qh/6up//PzYW3DL9Sa//Jb96w7 cNdF3y9l133db+m9w9L7CP7o/Xztmu2Xfv7RZ/3eOfv7DdZsse7PH/v699+z/5mbm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ub m5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5v7H/bO BV6vujrTO4EkXE24GkAloGBA0FQQL4BGUETuAiIiylVFRGVQUKxOYXqzIBbFO6Rhai92lErV Qe3oONYOY+lUZ4qVau3MOE4d25nOaK03vNC9ztkffXOystaW9UcP+/c8P1+TlQXr+XJyeM+X 7xwCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAch/fZps9efVbJjz+3z0Ey3zOw9b0/8rW9jznA0nVH DDeO7rNDn2XO3YN26rqDl8V3D9rp4GUH7XTOikNXWw5e5t3dffj+6j5rh+8v6XNqn0uXzH// 0v6e/hw/vnTumyUr1nT7Ht2d113SvaQ7v7us//813VHdK/r5wp/gLWaGrlu314FXd99e0m31 nfn5WJt/dcmS9f331/ffv2hN/+P97g13/OiT9le8pv92dZ+Ve61eYn+v/djafj7hstOX3vr9 VVfbjSf08x47fGDZuYeuuvr64/e58th+PvHkDy6zG4d3S844s/+26269d35v/+37t7ltbv7G 9ZdeZTd+cb/5R3nY8tvszbXJo7a7XXfXlfOPuOe2u6689bt2s+s+9blbln2mv/PqOz60zH78 3r9G+F6/v/CKuV+SzjSzt/3pQ77YD9f03361//bGYbfPmQesv/asA9Z/rP/1/8iy+R87YcHd 2fvAKcOv9blyf8euu8pzfWVw/Z3jWr7zONfTR7q+Prj+wXGdONJl759jXN8cXHc7rptHuuzO GSNc3xtcP3RcXxvpemaf/Ue4zGGuZUs3d+24yzjXMSN/XlstnXetcFynjXSN/XltM7h2dlyv Heka+z6/anDt6bjuGOl66kjXHoNrX8e1Zte274f7DK4DHdfFI11j/1leO7gOcly3jnRtO/J9 41GD63GO686RrrG/XuYw11Mc18G7jXM9e6TLHOY61nFdM9I19n3jmMF1ivc2HOk6duTPyxzm ep7jWrf7ONfJfS4e4TprcF3ouG4Y6Rr7MeX8wfUix/XVka6xffjiwXWp1/MPbvu+8YrB9RrH 9ZyRLns+OuZteMXgeq3junmky+uNn9bz7419NiR3N/Z/xcbumL3fu9aywb2rz7+9t5M9HzPP P/bf/v6Ct9MF/XOKly7P304njfw1MYe5fuy4Pj3SNbbzzGGu7ZZu7nr4LuNcJ/Z55QjXDkvn Xbs7rveMdB018ue16+B6qOP61kjX2I+9Dxlc+zuuI3cd5xrbeY8YXPbxfqHrupGusZ1nDnM9 1nF9aKRr7Pu8Ocx1pOPafbdxrmeM/Bh1xOBa77heOdI19rmSOcx1nON6+0jX2PcNe95irtMc 19+OdI39OG8Oc73AcZ24e1vX8weXfZxf6LplpMv72Jt1vj2HMe9Fjvc7I70/y4+N98drU97b 6dv9cOvwseRTC95Ot/cfr/ZZkb+dbDfmudEPBpf9fnuha6tdxrnGdpI5zPUgx3XBSJdljGvH wbWT47p1pGtsJ5nDXLs5rjtHuh4z0vXgwbWX41q1a9uflznMtZ/jOmSka+z7hjnM9RjHdUNj lznMdYjj+tZI19iP+eYw1+Md1567tf31Omxw2cfIha4jR7qeNvJtaA5z2cfhha53j3SNfc3i mYPrVO/Xa6Rr7O8VnzW47Pf2C11P2v2+/7yyzrff55vXPv5v9v4/0juF3zfOPlezVZ9HDm8v +/5wa+7b2c/PfnyX4fv2qZuFj+ns/gcvXj3/mNY5j8l8Zy+9ePWXt7Uct+fZSy0Xrz5yuDN7 fE8eHsdT+lzb31zR/0J8Yuk/P47up/h2PseeQw0/py3dPWfphtXnLN17z69sa9mw+qd59zJ7 W5+89dzb6s39zeX92+ojS//5/mv79+PXzn3S6B751NFV9pdv9v3Zr/clfQ7tc3Of60/aujuj v3XF8L4y+/6Sbs3c+4PtN+ee2f8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5ji8zzZ99uqzSn78uX0Okvmega3v/ZGv7X3M AZauO2K4cXSfHfosc+6es7TrNqyO756zdMPqc5buvedXtrVsWO3d3X34fn+qWzt8f0mfU/tc umT++6/q7z1NHB9fOvfNkhVrun2P7s7rLule0p3fXdb//5ruhP7/X9xd1L1q9FvMDF23bq8D r+5etrTb6uXzx4+1+dtLlqzvv7++//5Fa/q/rt+decePPml/x7H9t1//kx99cuVeq5fY32s/ 9r1+PuGy05fe+v1VV9uNbfq/Zo8dPrDs3ENXXX398ftcubqfTzz5g8vsxmHdkr9Z23/bdbfe O7+m//b929w2N3/j+kuvmj26z9/4vl84bPlt9uba5FHb3a6768r5n0HPbXddedV37WbXfepz tyx7Z3/n1Xd8aJn9+Oyv+Ytv3rLs8G7Jdfb9z/T7C6+Y+yXp9pO3/elDXtfnzf2b41f6b39z 6fxunzMPWH/tWQesf0//C7z/HvM/dsKCt+jsfeCU/vvPtscp93fsuqv019zz/vLgfZPjtXea Md7T+pyxwOu53ji43ua41o90PX2k662D6zcc1zUjXfbPxcK3p+e6aXDd7Li+MNK1bZ/9R7g2 Dq7fc1x3j3Q9deTP672D60OO68Tl41zP6HPxCNcfDK4/dFy/M9I19n3jY4Pr047r70e6Thr5 NvyjwfWnjuu4FeNcdmfhzyv75/qOwftZx3vDSK/3PvlA/pjnvZ1e2ec9vev1/bcfXvB2Oq2X fGHE28l8Y94Xfn5wWecudN080jX2n91fGlz2wWeh61sjXbYb88/TNYPrBse1bllb15sHl30M Weh62UjXM0d2rX0MMZd9DFnoun6ka2xPmMNc1usLXd8Y6Rrbtdbr5nq/4zpu+TjX2I9X7xtc H/Z+vUa6LGPeN+zjlLk+4bhuG+ka+8/XxwfX7Y5ruxXjXGOfX/zx4Pozx3XGSJf3McRz2ccp c33ecW0Y6bLO/kk/Xv354P2C4/3qSO/P8uNV67u7yNto5ripfx++e+W8Y53jsL//puV3r7xp +ek73769xb5/98ojFzxWew65YXisW7qzsf8rNq61HLn3xs6yoZvdWfi47THy9ojfHpf3j/XO 4bFu6e1x+fI7V16+/KM7H7iD5c6VvJ1/dm/ny+w1ktdv1d3Sf/u7/Q8c1eebfV7X3/9Sf/89 /YO9c+7li3vufUmgr5uneN/vtXPfXtLn0G7+94lveN1W3alL5j/e22sxs+8v6dZ0Ww37zbln 9j8AAAAAAAAAAAAAAAAAAAB4YGBfV7Aw9hUHhBDyQIzXafd3f87c9gVV9uVfFvtSM0IIeSBm 1mPWaQu79f7oz1l3mnt5nxXd/JfM2pfcW7YjhJAHSGa9ZR1mXWadNuvVWae26lPt0Fl/mtce x/CvKXUP6rOym/9XGAgh5IEQ6yzrLusw6zLrNOu2WZ9ql7bsUOts629z2mPYqZv/V9d26+b/ lf8Hd/P/qikhhCzmWFdZZ1l3WYdZl1mnWbdZx1nXterSWY/a81y7a31t3W3OXYfHsmefh/R5 WJ81Q/YhhJBFHOsp6yzrLusw6zLrNOs26zjrOus8675qj86ei9rzXOvoWYdaj9sfRbB3n4d3 838Uif3r/Qf2eRQhhCzyWFdZZ1l3WYdZl1mnWbfNutQ6z7pv9py0+lzUXjOw57v2moJ5rMP3 7fPIbv6PcXlMn8f2eVyfw/o8nhBCFmmso6yrDhm6yzrMusw6zbrNOs66zjrPus9+f39fn5Pa 36PPRe31WHvea8+B7XnxAcNjsD966ond/B+jZX82lf1Rh0cRQsgijXWUdZV1lnWXdZh1mXWa dal1nHWddZ4+J6326PbyXNReU7A/VtS81uv2WOxx2R83fmyf4/ocTwghizTWUdZV1lnWXdZh 1mXWadZt1nGz56TWfS161F5rtee3O/fZY3guaq8t2HNi+2Nbrd/tMdkf6XxKN//HYdt/SoQQ QhZjrKOsq6yzrLusw6zLrNOs26zjrOus86z7Zp9vuq89Ontt1F5zta8NsNdhH9Hn0X2e0Gd9 N/+ffThxeGz2x+6f2c3/8deEELIYYx1lXWWdZf+JHOsw6zLrNOs26zjrOus86z7rwBY9Ontt 1F6Dtee964b+tv/koT1PtsfznD7P6/P8Pi/ocw4hhCyyWDdZR1lXWWdZd9nzUusy6zTrNus4 67rZa6SVHtXP1dst+3rVhw6f17LPzdt/puWYoc/tP0V61vAYz+tzPiGELNJYR1lXWWdZd1mH WZdZp1m3WcfZa6TWebPPNc2+jvS+9qjdsK/zn32Oyb7myl5HePLw2oK9zmC9bh1/bp8L+lzY 54WEELLIYt1kHWVdZZ1l3WUdZl1mnWafu7eOm32uybqvdY/a16ra1waYy75uwP5Tv88aXm+w x2Q9P+vQFxFCyCLLrEutq6yzrLusw6zLrNOs26zjrOt+Vj1qz5ntMfLrRQhZrLGOsq6iRwkh hB4lhBB6lB4lhNCj9CghhB6lRwkhhB4lhBB6lB4lhNCj9CghhB6lRwkhhB4lhBB6lB4lhNCj 9CghhB6lRwkhhB4lhBB6lBBC6FF6lBBCj9KjhBBCjxJCCD1KCCH0KD1KCKFH6VFCCKFHCSGE HiWEEHqUHiWE0KP0KCGEHqVHCSGEHiWEEHqUHiWE0KP0KCGEHqVHCSGEHiWEEHqUHiWE0KP0 KCGEHqVHCSGEHiWEEHqUHiWE0KP0KCGEHqVHCSGEHiWEEHqUEELoUXqUEEKP0qOEEEKPEkII PUoIIfQoPUoIoUfpUUIIoUcJIYQeJYQQepQeJYTQo/QoIYQepUcJIYQeJYQQepQeJYTQo/Qo IYQepUcJIYQeJYQQepQeJYTQo/QoIYQepUcJIYQeJYQQepQeJYTQo/QoIYQepUcJIYQeJYQQ epRfK0IIPUqPEkLoUXqUEELoUUIIoUcJIYQepUcJIfQoPUoIIfQoIYTQo4QQQo/So4QQepQe JYTQo/QoIYTQo4QQQo/So4QQepQeJYTQo/QoIYTQo4QQQo/So4QQepQeJYTQo/QoIYTQo4QQ Qo/So4QQepQeJYTQo/QoIYTQo4QQQo/y60QIoUfpUUIIPUqPEkIIPUoIIfQoIYTQo/QoIYQe pUcJIYQeJYQQepQQQuhRepQQQo/So4QQQo8SQgg9Sggh9Cg9SgihR+lRQgg9So8SQgg9Sggh 9Cg9SgihR+lRQgg9So8SQgg9Sggh9Cg9SgihR+lRQgg9So8SQgg9Sggh9Cg9SgihR+lRQgg9 So8SQgg9Sggh9CghhNCj9CghhB6lRwkhhB4lhBB6lBBC6FF6lBBCj/40evS84TG+kF8rQsgi jHWTdZR11U+7Rx803HxYn7V9Dunz5D7H9jmlz3P6nN3n3D4XDI+TEEIWY6yjrKuss6y7rMOs y6zTrNus46zrdmvYo9sMPWo3H9rnkX0e2+fIPsf0OanP6X3O6vOC4fFZ19vzZkIIWUyxbrKO sq6yznr20GHWZdZp1m3WcdZ11nnWfZUeXSI9umOfXfs8pM9+fdb1eVKfo/scPzwvPmN4XNbx 9nyZEEIWY6yjrKuss6y7rMOsy6zTrNus46zrrPOs+6wDrQutE6s9ukufPfs8vM/BfR4/vJ5g PX7C8Hjseak9T7bXHAghZDHGOsq6yjrLuss6zLrMOs26zTrOus46r0WPbtVnRZ8d+uzUZ3Wf NcPrsPb81/r7qcPjsE6358f2WoM9PkIIWYyxjrKuss6y7rIOsy6zTjtw6DjrOus86z7rwGqP Lu+znXzO3l43sOe91tv2uS3zW5fb82J7TPZ6rX3uixBCFmOso6yrrLOsu6zDrMus06zbrOOs 61YN3WcdaF1Y6dFlw+uss9/b7zH0tb0Wa17rcHs+bI/FXqe1z3nZYyOEkMUY6yjrKuss6y7r MOsy6zTrNuu42e/prfusAys9OvucvT2v3X54Tmqfw7LXDsxn3W2/x7fHYK/P2uOxrxuwbieE kMUY6yjrKuss6y7rMOsy67S95OudrPNmv6e/L5+r1699mv3e3l5rtdcK7Lmueayz7fmvue11 WXsc1uf2tVf2uAghZDHGOsq6yjrLuss6zLrMOs26zTrOus46b/Z7+kqP6nNSu2fPce2+dbU9 77XXEOz1WHt+al8nYI/Fvn7V/l0AQghZjLGOsq6yzrLusg6zLrNOs26zjrOus86bPRe9L7+n X9ij1sezLrWOtue79tqBOe1zWua3r7WyLrfHQwghiznWVdZZ1l3WYfYc1L7m3rpNO3T2XLTS o1vqUnvNwFz2uSzrbutUiz0Oi/UrIYQsxsx6atZb1mHWZdZp1m2tO3Rhl2qf2uewZp1qz1Fn scdCCCGLOdpZs+60TtP+bNmh2qUL+3QWcxNCyAMx2mXan607dEudujCzx0AIIYs9W+oxAAAA AAAAAAAAAAAAAAAAeABweDf/haj2h5yskh9/bp+DZL5nwL7Yap6v7X3MAZauO2K4YX+Yn/2L AfbFrLO79i9d2Y/ZFxPMHDct77q7V8471jkO+/tvWn73ypuWn77z7dtb7Pt3r7Q/6Eof68Y+ G4bHuqU7G/u/YuNay5F7b+wsG+b+wCy7s/Bx22Nc+Pa4vH+sdw6PdUtvj8uX37ny8uUf3fnA HSx3rhxzt/Xb2Xvbbunu/Nv27J0/u73l7s0e7/15d5/hx6L79odILLxvX9hn7wf2/mDvF9Gv 4RV9XreFxzj7gpeZr7un++vupvn5BzLfvv2me5t1byz8YuqfxK23PHc0T8n9w8St+6pbb3nu aG7t/lHi1n3Vrbc8dzS3dv84ceu+6tZbnjuaW7vvSdy6r7r1lueO5im55z6wBG7dV916y3NH c2v3ksSt+6pbb3nuaG7tXpq4dV916y3PHc2t3Vslbt1X3XrLc0fzlNxbJ27dV916y3NHc2v3 ssSt+6pbb20y37i5a5P5xobuG+fn5VtyD7Puq2695bmjubV7ReLWfdWttzx3NE/JvU3i1n3V rbc8dzS3dm+buHVfdestzx3Nrd3bJW7dV916y3NH85Tc2ydu3VfdestzR3Nr9w6JW/dVt97y 3NHc2r1j4tZ91a23PHc0t3Y/KHHrvurWW547mqfkXpm4dV916y3PHc2t3asSt+6rbr3luaO5 tXunxK37qltvee5obu3eOXHrvurWW547mqfk3iVx677q1lsyf9lzyTy3b+Seu2Xzrr773ln3 Vbfe8tzR3Nq9W+LWfdWttzx3NLd27564dV916y3PHc1Tcj84ceu+6tZbnjuaW7tXJ27dV916 y3NHc2v3Holb91W33vLc0Twl956JW/dVt97y3NHc2r3XbH6379Z91a23PHc0t3Y/JHHrvurW W547mlu7H5q4dV916y3PHc1Tcj8sceu+6tZbnjuaW7v3Tty6r7r1lueO5tbuNYlb91W33vLc 0dzavU/i1n3Vrbc8dzRPyb1v4tZ91a23PHc0t3Y/PHHrvurWW547mlu7H5G4dV916y3PHc2t 3fslbt1X3XrLc0fzlNz7J27dV916y3NHc2v3IxO37qtuveW5o7m1e23i1n3Vrbc8dzRPyX1A 4tZ91a23PHc0t3YfmLh1X3XrLc8dza3dj0rcuq+69ZbnjubW7oMSt+6rbr3luaN5Su6DE7fu q2695bmjubX70Ylb91W33vLc0dza/ZjErfuqW2957mhu7V6XuHVfdeutTeZ3be7aZH5XQ/e7 Erczt3b/XOLWfdWttzx3NLd2PzZx677q1lueO5pbuw9J3LqvuvWW547m1u5DE7fuq2695bmj eUruxyVu3VfdestzR3Nr92GJW/dVt97y3NHc2v34xK37qltvee5onpL7CYlb91W33vLc0dza /cTErfuqW2957mhu7X5S4tZ91a23PHc0t3Yfnrh1X3XrLc8dzVNyH5G4dV916y3PHc2t3Ucm bt1X3XrLc0dza/eTE7fuq2695bmjubX7KYlb91W33vLc0Twl9/rErfuqW2957mhu7X5q4tZ9 1a23PHc0t3Yflbh1X3XrLc8dza3dRydu3VfdestzR/OU3E9L3LqvuvWW547m1u6nJ27dV916 y3NHc2v3MfPzX3Xv9N26r7r1lueO5im5n5G4dV916y3PHc2t3ccmbt1X3XrLc0dza/czE7fu q2695bmjubX7uMSt+6pbb3nuaJ6S+/jErfuqW2957mhu7T4hceu+6tZbnjuaW7tPTNy6r7r1 lueO5tbukxK37qtuveW5o3lK7pMTt+6rbr3luaO5tfuUxK37qltvee5obu1+VuLWfdWttzx3 NLd2n5q4dV916y3PHc1Tcp+WuHVfdestzx3Nrd2nJ27dV916y3NHc2v3sxO37qtuveW5o3lK 7jMSt+6rbr3luaO5tfs5iVv3Vbfe8tzR3Np9ZuLWfdWttzx3NLd2Pzdx677q1lueO5qn5D4r ceu+6tZbnjuaW7ufl7h1X3XrrU3md2zu2mR+R0P3O+bns7fkHmbdV916y3NHc2v38xO37qtu veW5o3lK7hckbt1X3XrLc0dza/c5iVv3Vbfe8tzR3Np9buLWfdWttzx3NE/JfV7i1n3Vrbc8 dzS3dp+fuHVfdestzx3Nrd0XJG7dV916y3NHc2v3hYlb91W33vLc0Twl9wsTt+6rbr3luaO5 tftFiVv3Vbfe8tzR3Nr94sSt+6pbb3nuaG7tvihx677q1lueO5qn5H5J4tZ91a23PHc0t3Zf nLh1X3XrLc8dza3dL03cuq+69ZbnjubW7ksSt+6rbr3luaN5Su6XJW7dV916y3NHc2v3yxO3 7qtuveW5o7m1+xWJW/dVt97y3NE8JfeliVv3Vbfe2mR+++auTea3N3S/fX7+F1tyD7Puq269 5bmjubX7ssSt+6pbb3nuaG7tfmXi1n3Vrbc8dzRPyf2qxK37qltvee5obu2+PHHrvurWW547 mlu7r0jcuq+69ZbnjubW7lcnbt1X3XrLc0fzlNyvmZ+/tCW37qtuveW5o7m1+8rErfuqW295 7mhu7X5t4tZ91a23PHc0t3b/fOLWfdWttzx3NE/J/brErfuqW2957mhu7X594tZ91a23PHc0 t3b/y8St+6pbb3nuaJ6S+xcSt+6rbr3luaO5tfuqxK37qltvee5obu2+OnHrvurWW547mlu7 /1Xi1n3Vrbc8dzRPyf2LiVv3Vbfe8tzR3Nr9S4lb91W33vLc0dza/cuJW/dVt97y3NHc2v0r iVv3Vbfe2mR+2+auTea3NXS/LXE7c2v3ryZu3VfdestzR3Nr9xsSt+6rbr3luaO5tfvXErfu q2695bmjubX7msSt+6pbb3nuaJ6S+9rErfuqW2957mhu7X5j4tZ91a23PHc0t3Zfl7h1X3Xr Lc8dzVNyvylx677q1lueO5pbu389ceu+6tZbnjuaW7uvT9y6r7r1lueO5tbuNydu3Vfdestz R/OU3G9J3LqvuvWW547m1u4bErfuq2695bmjubX7rYlb91W33vLc0dza/bbErfuqW2957mie kvvtiVv3Vbfe8tzR3Nr9jsSt+6pbb3nuaG7tfmfi1n3Vrbc8dzS3dr8rceu+6tZbnjuap+R+ d+LWfdWttzx3NLd235i4dV916y3PHc2t3TfN5rf6bt1X3XrLc0fzlNwbErfuq2695bmjubX7 NxK37qtuveW5o7m1e2Pi1n3Vrbc8dzS3dt+cuHVfdestzx3NU3L/68St+6pbb3nuaG7t/s3E rfuqW2957mhu7X5P4tZ91a23PHc0t3b/VuLWfdWttzx3NE/J/duJW/dVt97y3NHc2v07iVv3 Vbfe8tzR3Nr9u4lb91W33vLc0dza/d7ErfuqW2957miekvv3Erfuq2695bmjubX738zPX9yS W/dVt97y3NHc2v2+xK37qltvee5onpL7/Ylb91W33vLc0dzafUvi1n3Vrbc8dzS3dv9+4tZ9 1a23PHc0t3Z/IHHrvurWW547mqfkvjVx677q1lueO5pbu/8gceu+6tZbm8w3bO7aZL6hofuG +fmDW3IPs+6rbr3luaO5tftDiVv3Vbfe8tzRPCX3hxO37qtuveW5o7m1+98mbt1X3XrLc0dz a/dtiVv3Vbfe8tzR3Nr9kcSt+6pbb3nuaJ6S+6OJW/dVt97y3NHc2v2xxK37qltvee5obu3+ w8St+6pbb3nuaJ6S+98lbt1X3XrLc0dza/fHE7fuq2695bmjubX7E4lb91W33vLc0dza/e8T t+6rbr3luaN5Su5PJm7dV916y3NHc2v3f0jcuq+69ZbnjubW7k8lbt1X3XrLc0dza/cfJW7d V916y3NH85Tcn07cuq+69ZbnjubW7j9O3LqvuvWW547m1u7/mLh1X3XrLc8dza3dtydu3Vfd estzR/P95n5L4n5LQ/db5uf/tCX3MOu+6tZbnjuaW7s/k7h1X3XrLc8dza3df5K4dV916y3P Hc1Tct+RuHVfdestzx3Nrd1/mrh1X3XrLc8dza3d/zlx677q1lueO5pbu/8sceu+6tZbnjua p+T+bOLWfdWttzx3NLd2fy5x677q1lueO5pbu/9L4tZ91a23PHc0t3b/18St+6pbb3nuaJ6S +88Tt+6rbr3luaO5tfvOxK37qltvee5obu3+fOLWfdWttzx3NE/J/ReJW/dVt97y3NHc2v2F xK37qltvee5obu2+K3HrvurWW547mlu7/zJx677q1lueO5qn5P5i4tZ91a23PHc0t3Z/KXHr vurWW547mlu7/ypx677q1lueO5pbu7+cuHVfdestmf+ye/PmLpnn9o3cc7cCtzu3dv914tZ9 1a23PHc0t3b/t8St+6pbb3nuaG7t/u+JW/dVt97y3NHc2v0/Erfuq2695bmjeUruryRu3Vfd estzR3Nr9/9M3LqvuvWW547m1u6vJm7dV916y3NH85Tc/ytx677q1lueO5pbu/8mceu+6tZb njuaW7u/lrh1X3XrLc8dza3d/ztx677q1lueO5qn5P564tZ91a23PHc0t3b/beLWfdWttzx3 NLd2/13i1n3Vrbc8dzS3dv+fxK37qltvee5onpL7/yZu3VfdestzR3Nr998nbt1X3XrLc0dz a/f/S9y6r7r1lueO5tbu/5+4dV916y3PHc1Tcn8jceu+6tZbnjuaW7u/mbh1X3XrLc8dza3d /zCbr/fduq+69ZbnjuYpub+VuHVfdestzx3Nrd3/mLh1X3XrLc8dza3d307cuq+69ZbnjubW 7u8kbt1X3XrLc0fzlNzfTdy6r7r1lueO5tbu7yVu3VfdestzR3Nr9/cTt+6rbr3luaO5tfvu xK37qltvee5onpL7B4lb91W33vLc0dza/cPErfuqW2957mhu7f5R4tZ91a23PHc0t3b/OHHr vurWW547mqfkvidx677q1lueO5pbu7udYrfuq2695bmjubV7SeLWfdWttzx3NE/JvTRx677q 1lueO5pbu7dK3LqvuvWW547m1u6tE7fuq2695bmjubV7WeLWfdWttzx3NE/JvTxx677q1lue O5pbu1fM5l/33bqvuvWW547m1u5tErfuq2695bmjubV728St+6pbb3nuaJ6Se7vErfuqW295 7mhu7d4+ceu+6tZbnjuaW7t3SNy6r7r1lueO5tbuHRO37qtuveW5o3lK7gclbt1X3XpL5rs8 l8xz+0buuVs2r/Td9866r7r1lueO5tbuVYlb91W33vLc0Twl906JW/dVt97y3NHc2r1z4tZ9 1a23PHc0t3bvkrh1X3XrLc8dza3duyZu3VfdestzR/OU3Lslbt1X3XrLc0dza/fuiVv3Vbfe 8tzR3Nr94MSt+6pbb3nuaG7tXp24dV916y3PHc1Tcu+RuHVfdestzx3Nrd17Jm7dV916y3NH c2v3Xolb91W33vLc0dza/ZDErfuqW2957mi+39xvStxvauh+0/z80C25h1n3Vbfe8tzR3Nr9 sMSt+6pbb3nuaG7t3jtx677q1lueO5qn5F6TuHVfdestzx3Nrd37JG7dV916y3NHc2v3volb 91W33vLc0dza/fDErfuqW2957miekvsRiVv3Vbfe8tzR3Nq9X+LWfdWttzx3NLd275+4dV91 6y3PHc2t3Y9M3LqvuvWW547mKbnXJm7dV916y3NHc2v3AYlb91W33vLc0dzafWDi1n3Vrbc8 dzS3dj8qceu+6tZbnjuap+Q+KHHrvurWW547mlu7D07cuq+69ZbnjubW7kcnbt1X3XrLc0fz /ea+LnFf19B93fz8mC25h1n3Vbfe8tzR3Nq9LnHrvurWW547mlu7fy5x677q1lueO5pbux+b uHVfdestzx3NU3Ifkrh1X3XrLc8dza3dhyZu3VfdestzR3Nr9+MSt+6rbr3luaO5tfuwxK37 qltvee5onpL78Ylb91W33vLc0dza/YTErfuqW2957mhu7X5i4tZ91a23PHc0T8n9pMSt+6pb b3nuaG7tPjxx677q1lueO5pbu49I3LqvuvWW547m1u4jZ/Mbfbfuq2695bmjeUruJydu3Vfd estzR3Nr91MSt+6rbr3luaO5tXt94tZ91a23PHc0t3Y/NXHrvurWW547mqfkPipx677q1lue O5pbu49O3LqvuvWW547m1u6nJW7dV916y3NHc2v30xO37qtuveW5o3lK7mMSt+6rbr3luaO5 tfsZiVv3Vbfe8tzR3Np9bOLWfdWttzx3NE/J/czErfuqW2957mhu7T4uceu+6tZbnjuaW7uP T9y6r7r11ibztZu7Npmvbei+dn4+YUvuYdZ91a23PHc0T8l9YuLWfdWttzx3NLd2n5S4dV91 6y3PHc2t3Scnbt1X3XrLc0dza/cpiVv3Vbfe8tzRPCX3sxK37qtuveW5o7m1+9TErfuqW295 7mhu7T4tceu+6tZbnjuaW7tPT9y6r7r1lueO5im5n524dV916y3PHc2t3Wckbt1X3XrLc0dz a/dzErfuq2695bmjeUruMxO37qtuveW5o7m1+7mJW/dVt96S+QvdNZu7ZJ7bN3LP3bL5LN99 76z7qltvee5obu1+XuLWfdWttzx3NE/JfXbi1n3Vrbc8dzS3dj8/ceu+6tZbnjuaW7tfkLh1 X3XrLc8dza3d5yRu3VfdestzR/OU3Ocmbt1X3XrLc0dza/d5iVv3Vbfe8tzR3Np9fuLWfdWt tzx3NLd2X5C4dV916y3PHc1Tcl+YuHVfdestzx3Nrd0vTNy6r7r1lueO5tbuFyVu3Vfdestz R/OU3C9O3LqvuvWW547m1u6LZvOv+W7dV916y3NHc2v3SxK37qtuveW5o7m1++LErfuqW295 7miekvuliVv3Vbfe8tzR3Np9SeLWfdWttzx3NLd2vyxx677q1lueO5pbu1+euHVfdestzx3N U3K/InHrvurWW//E3nmAa1ZQV/sbRoYqM4zSxAEcRIqgqIhIERRFLFixm4j1j/nljyGJihUU S6zYxoJkSDFqorHFlpAYY9dEk2DvLcbYokajosh/9tzzkXVn9t37hr0x1/O868kKs1iy3o+Z Yc/57r0MHjvK3exHJmztq2zd8thR7mb/dsLWvsrWLY8d5W72WQlb+ypbtzx2lKfE/p2ErX2V rVseO8rd7N9N2NpX2brlsaPczf69hK19la1bHjvKU2I/ap6f4bO1r7J1y2NHuZv96IStfZWt Wx47yt3sxyRs7ats3fLYUe5mn52wta+ydctjR3lK7McmbO2rbN3y2FHuZj8uYWtfZeuWx45y N/vxCVv7Klu3PHaUu9lPSNjaV9m65bGjPCX2ExO29lW2bnnsKHezn5Swta+ydctjR7mbfU7C 1r7K1i2PHeVu9rkJW/sqW7c8dpSnxH5ywta+ytYtjx3lbvZTErb2VbZueewod7PPS9jaV9m6 5bGjfJWxn56wn97IfvpCfupS7DFrX2XrlseOcjf7aQlb+ypbtzx2lLvZT0/Y2lfZuuWxo9zN fkbC1r7K1i2PHeUpsX8/YWtfZeuWx45yN/uZCVv7Klu3PHaUu9nPStjaV9m65bGj3M1+dsLW vsrWLY8d5Smxn5Owta+ydctjR7mb/dyErX2VrVseO8rd7OclbO2rbN3y2FHuZp+fsLWvsnXL Y0d5SuznJ2ztq2zd8thR7ma/IGFrX2XrlseOcjf7hfP8NJ+tfZWtWx47ylNivyhha19l65bH jnI3+8UJW/sqW7c8dpS72ZsStvZVtm557Ch3s1+SsLWvsnXLY0d5SuyXJmztq2zd8thR7ma/ LGFrX2XrlseOcjf75Qlb+ypbtzx2lLvZFyRs7ats3fLYUZ4S+xUJW/sqW7c8dpS72RcmbO2r bN3y2FHuZv9Bwta+ytYtjx3lbvbmhK19la1bHjvKU2JflLC1r7J1y2NHuZv9hwlb+ypbtxbl p27LWpSf2sh+6kL+o6XYY9a+ytYtjx3lKbH/OGFrX2XrlseOcjf7TxK29lW2bnnsKHezX5mw ta+ydctjR7mb/acJW/sqW7c8dpSnxH5Vwta+ytYtjx3lbvarE7b2VbZueewod7Nfk7C1r7J1 y2NHuZv9Zwlb+ypbtzx2lKfE/vOErX2VrVseO8rd7NcmbO2rbN3y2FHuZr8uYWtfZeuWx47y lNh/kbC1r7J1y2NHuZv9+oStfZWtW4vyeduyFuXzGtnnLeQ3LMUes/ZVtm557Ch3s9+YsLWv snXLY0d5Suw3JWztq2zd8thR7ma/OWFrX2XrlseOcjf7LxO29lW2bnnsKHez35Kwta+ydctj R3lK7LcmbO2rbN3y2FHuZr8tYWtfZeuWx45yN/vtCVv7Klu3PHaUu9nvSNjaV9m65bGjPCX2 XyVs7ats3fLYUe5m/3XC1r7K1i2PHeVu9sUJW/sqW7c8dpSnxP6bhK19la1bHjvK3ey/Xcgf nz3FZ2tfZeuWx45yN/udCVv7Klu3PHaUu9l/l7C1r7J1y2NHeUrsdyVs7ats3fLYUe5m/33C 1r7K1i2PHeVu9rsTtvZVtm557Ch3s9+TsLWvsnXLY0d5Suz3Jmztq2zd8thR7ma/L2FrX2Xr lseOcjf7/Qlb+ypbtzx2lLvZH0jY2lfZuuWxozwl9gcTtvZVtm557Ch3sz+UsLWvsnXLY0e5 m/3hhK19la1bHjvKU2L/wzw/2WdrX2XrlseOcjf7HxO29lW2bnnsKHezP5Kwta+ydctjR7mb /dGErX2VrVseO8pTYv9Twta+ytYtjx3lbvY/J2ztq2zd8thR7mb/S8LWvsrWLY8d5W72JQlb +ypbtzx2lKfE/ljC1r7K1i2PHeVu9scTtvZVtm557Ch3sz+RsLWvsnXLY0e5m/3JhK19la1b HjvKU2J/KmFrX2XrlseOcjf70wlb+ypbtzx2lLvZn0nY2lfZurUon7sta1E+t5F9bsJ2cjf7 swlb+ypbtzx2lLvZn0vY2lfZuuWxo9zN/nzC1r7K1i2PHeVu9hcStvZVtm557ChPif3FhK19 la1bHjvK3ewvJWztq2zd8thR7mZ/OWFrX2XrlseOcjf7Kwlb+ypbtzx2lKfE/mrC1r7K1i2P HeVu9tcStvZVtm557Ch3s/81YWtfZeuWx45yN/vrCVv7Klu3PHaUp8T+t4StfZWtWx47yt3s byRs7ats3fLYUe5m//s8n+Ozta+ydctjR3lK7G8mbO2rbN3y2FHuZn8rYWtfZeuWx45yN/vb CVv7Klu3PHaUu9nfSdjaV9m65bGjPCX2dxO29lW2bnnsKHez/yNha19l65bHjnI3+3sJW/sq W7c8dpS72d9P2NpX2brlsaM8JfYPErb2VbZueewod7P/M2FrX2XrlseOcjf7hwlb+ypbtzx2 lLvZP0rY2lfZuuWxozwl9n8lbO2rbN3y2FHuZv94np/ks7WvsnXLY0e5m/2ThK19la1bHjvK U2L/NGFrX2XrlseOcjf70oStfZWtWx47yt3snyVs7ats3fLYUe5m/zxha19l65bHjvKU2Jcl bO2rbN3y2FHuZv8iYWtfZeuWx45yN/vyhK19la1bHjvK3ezZ+pitfZWtWx47ylNir0rY2lfZ uuWxo9zN3i5ha19l65bHjnI3e3XC1r7K1i2PHeVu9tUStvZVtm557ChPib19wta+ytatRfmJ 27IW5Sc2sp+4kNcsxR6z9lW2bnnsKHezd0jY2lfZuuWxozwl9o4JW/sqW7c8dpS72TslbO2r bN3y2FHuZu+csLWvsnXLY0e5m71Lwta+ytYtjx3lKbF3TdjaV9m65bGj3M2+esLWvsrWLY8d 5W72bglb+ypbtzx2lLvZaxO29lW2bnnsKE+JvS5ha19l65bHjnI3e/eErX2VrVseO8rd7PUJ W/sqW7c8dpSnxL5Gwta+ytatRfkJ27IW5Sc0sp+wkK+5FHvM2lfZuuWxo9zN3iNha19l65bH jnI3e8+ErX2VrVseO8pTYu+VsLWvsnXLY0e5m713wta+ytYtjx3lbvY+CVv7Klu3PHaUu9nX StjaV9m65bGjPCX2vglb+ypbtzx2lLvZ107Y2lfZuuWxo9zN3pCwta+ydctjR7mbvV/C1r7K 1i2PHeUpsfdP2NpX2brlsaPczT4gYWtfZeuWx45yN/s6CVv7Klu3PHaUp8TeuJA/Zn+xx9a+ ytYtjx3lbvaBCVv7Klu3PHaUu9nXTdjaV9m65bGj3M0+KGFrX2XrlseO8pTY10vY2lfZuuWx o9zNPjhha19l65bHjnI3+5CErX2VrVseO8rd7EMTtvZVtm557ChPiX1Ywta+ytYtjx3lbvb1 E7b2VbZueewod7MPT9jaV9m65bGj3M0+ImFrX2XrlseO8pTYN0jY2lfZuuWxo9zNvmHC1r7K 1i2PHeVu9pEJW/sqW7cW5cdty1qUH9fIflzCdnI3+0YJW/sqW7c8dpS72TdO2NpX2brlsaPc zb5Jwta+ytYtjx3lbvZRCVv7Klu3PHaUp8S+acLWvsrWLY8d5W720Qlb+ypbtzx2lLvZN0vY 2lfZuuWxo9zNPiZha19l65bHjvKU2DdP2NpX2brlsaPczT42YWtfZeuWx45yN/u4hK19la1b HjvK3ezjE7b2VbZueewoT4l9QsLWvsrWLY8d5W72LRK29lW2bnnsKHezT5znx/ps7ats3fLY UZ4S+6SErX2VrVseO8rd7FsmbO2rbN3y2FHuZt8qYWtfZeuWx45yN/vkhK19la1bHjvKU2Lf OmFrX2XrlseOcjf7Nglb+ypbtzx2lLvZpyRs7ats3fLYUe5m3zZha19l65bHjvKU2KcmbO2r bN3y2FHuZt8uYWtfZeuWx45yN/v2CVv7Klu3PHaUu9l3SNjaV9m65bGjPCX2HRO29lW2bnns KHezT5vns3229lW2bnnsKHez75Swta+ydctjR3lK7DsnbO2rbN3y2FHuZt8lYWtfZeuWx45y N/uuCVv7Klu3PHaUu9l3S9jaV9m65bGjPCX23RO29lW2bnnsKHezT0/Y2i/F3jh415F53PDH HQfvO3idvJ77DD58ide3oK/vf8qh5tns+HHj5HF3+8Fb724efGGyu3n4X2yenbL/qw8xX+ju HjJ+2/5+HjD4mPHb9kfT/I+zjatm9tuJm955vgAHHSQbW7/OLf8tjbULr/NI53Xaa3jFmkvX vm8X8+nrX7HGfOnaE8ad+Ws+afDeg19pf1/Dd/ptBv9w1X+zd5jNzvmlfd/b1/uuS77v1xyx bvOag9a/fxfzEet+mbtnDX7pl1fP3jj88fXD99Exg7+y6r/3Dxj+R9+zn7izy7f8/wWdc6L3 7QG75Y+PGHzU4IsG/+RLq2cvH/7KC8afP/Nvr5odsOWfCeu31eXz/0MIIYQQQgghhBBCCCGE EEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGE EEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGE EEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEJNOm7wjoP3HbxO/vx9Bh8u+fJRV7viz3x9/1MONc9mx48bJw/edfD2zu7mNbPZ Eevi3c1rjli3ec1B69+/i/mIdd7unuO39x580PjtVYNPH/3ewW8b/sRHhj9+YNVCd517H3rS s+576Eln7DCb/Xzdwp+741bfD/PXcZfh23cffE/Zv/psdo7H+vDI+qjDumiZrNsNvt4yWMYw 1qcc1ruXyTJv/feVfX9+cuR+1uGu23F53J2cv8eM+5mR+wWHe+QyuTe8EtwvjdyvOdyHXYV/ v18dud9xuE9bJtf+OTljGT+Xvj2yfuSwPrFM1nL/GfnByPq5w9pzp96/r0tH1upV27IevEzW KVfin5HtVi1w1zjc1yyTe2V+zmw/cndyuB9cJtf7Z8Rj7TKy1jqs2c5X/u/RY+02svZyWAcs k2U7y/n5uefIOsBhPXyZrFsu8+fnfiPrYIf1jmWyvH/usp8nB43cQx3uZYUfu6k9O9iv5x8a /sQnhj9+dqvvpwuHX2Nfv3v+/XTnwb+5jJ8LHx9ZX3RYP10m627L/Hn3+ZH1ZYd1ux2Xx1ru c4oxjGW/xmzNOnOZrNsu8/vwmyPruw7rg81/X8Yw1k8c1neWybrTMn+8jGEs+3Vla9ZpOy2P tdybZMFY9mvINj/nl8la7q3dcWTt6rC+ukzWcn+87NcrY+3hsNbs3PvjZQxj2a8hW7MetkyW 93Ne79UhwrV/7h85ch45/PW6efF2W/6waocDZhtPnj1w9ojZw2cPmp01/P8DZrea/daQH/I/ eHe4MHbkvoedO1u7erZ63eot+VTL52636qTh2ycN3/4N+xsfunt/6LJ32ms6dfjjNz542TvX 7rv3Kvtr7c/9ZMh3POv07d7w03Xn2saOw/9mn11fv/0ZR6079/y3fO7svYd82p3ftL1tHDtb 9cxDhj/OZm+4Ij9m+ONrd3zrlnzGtzadYxv215//lqedc/Sat9p5v0LGs93h3cvZ9u0teusn zz7nx7Y5m73ro6/b/qXDzqM/9Obt7c9f8b8RfWDoH/KoLb+EuL9W7D/+mB/o/Ji/e/gxf+My fsz/N39N7d69hnwfzRmbNgzP5GsXGEc6DPvrN224dO2mDaevv3ij2b596doTtv71f/CF42td amfz8L/YfIj5hP03z8wXzuY7W79ue418f8TfH2cOr/WS8bUu9f1x5oZL1p654e3rNx5ovmQt 38//e9/PZw0+77GrZ+uHE/2q4U+8avjj94c/PmrY/8ywf9HwYi/Zcs4vl3N3zonet+e/pDxi 8FGDLxr8tbNXz+46/JWvGX8tmn971fDriv2qYP22unz+fwghhBBCCCGEEEIIIYQQQgghhBBa WbKvH9ja9pUFGGP8q2bvnl3Vt3POti+asi/xMtuXk2GM8a+a5zfM7pl567vafTvnd9PYawbv MFv4klj7knrzzhhj/Cvg+c2y+2V3zO7Z/KZufUs7buj8fs5vp3HtdYz/CtJst8FrZwv/egLG GK90272yu2X3y+7Y/K7aPbU713VHt76ftm8cY9pr2H228K+k7TFb+O0G9pot/Ou7GGO8Um13 yu6V3S27X+vHe2b31G6pd0erN9Seb23X9o1jt/Oa42u51uBrD95v8AGjr4MxxivUdqP2H7xh tvCv99tdtXtqt9SeTXfZ6o5Wbuj8GdTev9vz5/x+2g03tr2OA2cLv7WI/ev6hw2+PsYYr2Db nbJ7Zb8tkt0vu6n2HGjPhPM7On8etefHK/ssqs+g9vFPe/9uH0ew+2m8jYMPni38liz2W2Te ePBNBx89+GYYY7wCbffJ7tRNZgu/ZdUR4z21W2rvped31J4X7bmx8ixqf40+g9pttvfv9t7d nocPHW+n/RZSN58t/HZY9ntM2W9NeSuMMV6Btvt00mD7bfyOHW/qjcZnU7uj9nxo7+vt46P2 LGr3r+OG2scH7BnUbrTdansGtvtpfLud9rpuM/jUwbcffAeMMV6Btvtkd8r+cxp2U+2W2vOp 3VF7HrX39fbxUXsWtffe8/fzlRtqG7Zlm/uMz6B2s+1Z2H7bVXsd9prst2S+y2zht9G2/5wC xhivNNt9sjt12mzhP3tw6/GO2vOgva+3Z1H7XI99vt7ez9vHMSs3dP6xUNuyTdu+7uAbjLfb nontP1Ngr8dem/0nH+49W/itqzHGeCX6XuM9tf80k91Rew609/X28VF7j22fr7f38/bxy/nH RBf+wydX/obOPxZqHyswhrHsGdRuuD0f2/2013W/wb82+NcHPwBjjFeQ7S6Z7z8+69kdtec/ e19vz6L23trez9vXG9nnzu1jopUbqp+Ttxtqd9k+Fmqfi7fPwRvT2Paf5rrH4PuOr++Bgx+E McYr0Haf7J7a854999n7evtYpL2nts/X28cp7WOi9rkf+xyQfV6pekPtDts9trtsN9TutN3r W4xsew32Wuz584zBDx5s/3HAh2KM8Qqz3Sa7o/a8Z+/r7T20fZ7JPi9uHxO1rx+1z/nY55Wu ihtqz7j2NU329Uz2dUz2sYS7js/FdkPttc3v58MwxniF2e6TPY/Ob6i9n7ePR9rHRO1zPHpD 7d8n+mXfUHtt9hr5scIYr/Qbah9/5IZijDE3FGOMuaHcUIwxN5QbijHmhnJDMcaYG4oxxtxQ jDHmhnJDMcbcUG4oxpgbyg3FGGNuKMYYc0O5oRhjbig3FGPMDeWGYowxNxRjjLmhGGPMDeWG Yoy5odxQjDE3lBuKMcbcUIwx5oZyQzHG3FBuKMaYG8oNxRhjbijGGHNDMcaYG8oNxRhzQ7mh GGPMDcUYY24oxhhzQ7mhGGNuKDcUY8wN5YZijDE3FGOMuaH8OGGMuaHcUIwxN5QbijHG3FCM MeaGYowxN5QbijHmhnJDMcbcUG4oxhhzQzHGmBvKDcUYc0O5oRhjbig3FGOMuaEYY8wNxRhj big3FGPMDeWGYoy5odxQjDHmhmKMMTeUG4ox5oZyQzHG3FBuKMYYc0MxxpgbijHG3FBuKMaY G8oNxRhzQ7mhGGPMDcUYY24oNxRjzA3lhmKMuaHcUIwx5oZijDE3FGOMuaHcUIwxN5QbijHG 3FCMMeaGYowxN5QbijHmhnJDMcbcUG4oxhhzQzHGmBvKjxXGmBvKDcUYc0O5oRhjzA3FGGNu KMYYc0O5oRhjbig3FGPMDeWGYowxNxRjjLmh3FCMMTeUG4ox5oZyQzHGmBuKMcbcUIwx5oZy QzHG3FBuKMaYG8oNxRhjbijGGHNDuaEYY24oNxRjzA3lhmKMMTcUY4y5oRhjzA3lhmKMuaHc UIwxN5QbijHG3FCMMeaGckMxxtxQbijGmBvKDcUYY24oxhhzQzHGmBvKDcUYc0O5oRhjbig3 FGOMuaEYY8wN5YZijLmh3FCMMTeUG4oxxtxQjDHmhmKMMTeUG4ox5oZyQzHGmBuKMcbcUIwx 5oZyQzHG3FBuKMaYG8oNxRhjbijGGHNDuaEYY24oNxRjzA39Zd/QB46v8aH8WGGMV/gNvc8v 8YbuNt7Q/QYfMvgmg28x+NTBdxl8r8H3H3zG4AePrxNjjFea7T7Zs54989mz390G337wLQcf Pd7QA8Ybuq7phu443tA9Bm8YfPDgGw8+YfApg+80+PTxudhuu91Re4126zHGeKXY7pLZ7tT9 Bt9zfAa0Z0F7X33TwYeNN3Svhhu6Sm7o1Qdfc/C1Bx80+MjBxw4+eXwOtvfz9nrsjtrzqN14 jDFeibY7Ze+d7Rn0joNvM/j48dnQ3mfb+217320fw7T34V039BqDrzX4wMFHjB87sNttz6L2 OuyO2vOovTZ7RsYY45Vmu0/3GO/naeMzqL2Pv/ngGw6+3visaO+77f139YauHrzD4F3Hj6/a xwjsOdc+r2Q3255FjW931J5H7X29PRvbPcUY45Vmu092p+xe3Xb8XJI9g9rnyQ8fnxHtWdGe Ge3Z0Z4h7VnS7uGVvaFrxo8JzD83bx8Ttffz9ixqXLuj9jxq7+vtltpdt8/XY4zxSrPdJ7tT tx580uDjxs8l2TOofa7HvvbIPhZqz4z27GjPkNUbas+x9jw7fz+/z/gsajy7o/Y8au/r7Zba 55ns8/V2UzHGeKXZ7pPdKbudx4xfY2T3095bbxy87/i5H3tmtGdHe4a0O3hlb+j8c/N2i3cZ d+3jBPasa3fUnkeNbbfUPs9k99Rekz2fYozxSrPdJ7tTdq9uMH4e3j4GavfTPg5q77Xnz6D2 Pt6eIa/sDZ1/fdP8/bzt2a59vt/uqD2P2vt6u6X2MQS7p/Zsap/XsruKMcYrzXaf7E7Z3bzu +PX09nl4ey6c3097z23vve3u2TOk3cEre0P1WdT2bNfuqD2P2vt6Y9rnmYxvN9xuqr0e+5gC xhivNNt9Mtu9svft9ixoH/+09+/2fGj3097D23vv6jOo3lDbmd9Rex619/XGsltqd9vuqb0G ez61u4oxxivVdqfsXtndWj/eTvs6Jns+tOdEvZ+VZ9DojhrDWHavjWv31Gyvw2y3FWOMV6Ln d8pult0veya0e2bPh/P37133c+s7qrfU7vT8nhp7bnstGGO8kj2/V3a/7I6Z7aZtfT+7buj8 jm59S+c2LsYY/yp6fsfmt637dkb3dGvPXwPGGK9kL3XDEEIIIYQQQgghhBBCCCGEEEIIIbSC ZL8BlH2hqf2Lo+vkz9t/8M5+Q9K5Lh9lX0y1oK/vf8qh5oXfwNQ27DcQtS/6ty9Une/av0xl f86+aGDO2LRhNrt07QLjSIdhf/2mDZeu3bTh9PUXbzTbty9da79hlb7WzYMvHF/rUjubh//F 5kPMJ+y/eWa+cMtvfGU7W79ue41bf3+cObzWS8bXutT3x5kbLll75oa3r994oPmStcvZ7f5+ 9r5vl9pd+L69//r3bDRfus3rvSp37Td4sD8X7dtvCrH1vn3xnv08sJ8P9vMi+jF81ODHL/Ea 51/YMufNLp99fvaKhfwzyRdvXNxb1t609RdL/0/YuuWxozwl9s8TtvZVtm557Ch3sy9L2NpX 2brlsaPczf5Fwta+ytYtjx3lbvblCVv7Klu3PHaUp8Te8gtLwNa+ytYtjx3lbvaqhK19la1b HjvK3eztErb2VbZueewod7NXJ2ztq2zd8thRnhL7aglb+ypbtzx2lLvZ2yds7ats3VqUL9iW tShf0Mi+YCGvWYo9Zu2rbN3y2FHuZu+QsLWvsnXLY0d5SuwdE7b2VbZueewod7N3StjaV9m6 5bGj3M3eOWFrX2XrlseO8pTYuyRs7ats3fLYUe5m75qwta+ydctjR7mbffWErX2VrVseO8rd 7N0StvZVtm557ChPib02YWtfZeuWx45yN3tdwta+ytYtjx3lbvbuCVv7Klu3PHaUu9nrE7b2 VbZueewoT4l9jYStfZWtW5I/57Ekb+mb2Fu2LF/TZ1+Rta+ydctjR7mbvUfC1r7K1i2PHeVu 9p4JW/sqW7c8dpSnxN4rYWtfZeuWx45yN3vvhK19la1bHjvK3ex9Erb2VbZueewoT4l9rYSt fZWtWx47yt3sfef55T5b+ypbtzx2lLvZ107Y2lfZuuWxo9zN3pCwta+ydctjR3lK7P0StvZV tm557Ch3s/dP2NpX2brlsaPczT4gYWtfZeuWx45yN/s6CVv7Klu3PHaUp8TemLC1r7J1y2NH uZt9YMLWvsrWLY8d5W72dRO29lW2bnnsKHezD0rY2lfZuuWxozwl9vUStvZVtm557Ch3sw9O 2NpX2brlsaPczT4kYWtfZeuWx47ylNiHJmztq2zd8thR7mYflrC1r7J1y2NHuZt9/YStfZWt Wx47yt3swxO29lW2bnnsKE+JfUTC1r7K1i2PHeVu9g0StvZVtm557Ch3s2+YsLWvsnXLY0e5 m31kwta+ytatRfll27IW5Zc1sl+WsJ3czb5Rwta+ytYtjx3lbvaNE7b2VbZueewod7NvkrC1 r7J1y2NHuZt9VMLWvsrWLY8d5Smxb5qwta+ydctjR7mbfXTC1r7K1i2PHeVu9s0StvZVtm55 7ChPiX1Mwta+ytYtjx3lbvbNE7b2VbZueewod7OPTdjaV9m65bGj3M0+LmFrX2XrlseO8pTY xyds7ats3fLYUe5mn5Cwta+ydctjR7mbfYuErX2VrVseO8rd7BMTtvZVtm557ChPiX1Swta+ ytYtjx3lbvYtE7b2VbZueewod7NvlbC1r7J1y2NHuZt9csLWvsrWLY8d5Smxb52wta+ydctj R7mbfZuErX2VrVseO8rd7FMW8mdnL/XZ2lfZuuWxozwl9m0TtvZVtm557Ch3s09N2NpX2brl saPczb5dwta+ytYtjx3lbvbtE7b2VbZueewoT4l9h4StfZWtWx47yt3sOyZs7ats3fLYUe5m n5awta+ydctjR7mbfaeErX2VrVseO8pTYt85YWtfZeuWx45yN/suCVv7Klu3PHaUu9l3Tdja V9m65bGj3M2+W8LWvsrWLY8d5Smx756wta+ydctjR7mbfXrC1r7K1i2PHeVu9j0StvZVtm55 7ChPiX3PhK19la1bHjvK3ex7JWztq2zd8thR7mbfO2FrX2XrlseOcjf7Pglb+ypbtzx2lKfE vm/C1r7K1i2PHeVu9v0StvZVtm4tyi/ZlrUov6SR/ZKFfP+l2GPWvsrWLY8d5W72ryVs7ats 3fLYUZ4S+9cTtvZVtm557Ch3sx+QsLWvsnXLY0e5m31Gwta+ytYtjx3lKbEfmLC1r7J1y2NH uZv9oIStfZWtWx47yt3sByds7ats3fLYUe5mPyRha19l65bHjvKU2A9N2NpX2brlsaPczX5Y wta+ytYtjx3lbvb/SdjaV9m65bGj3M3+jYStfZWtWx47ylNiPzxha19l65bHjnI3+zcTtvZV tm557Ch3s/9vwta+ytYtjx3lbvYjErb2VbZueewoT4l9ZsLWvsrWLY8d5W72/0vY2lfZuuWx o9zN/q2ErX2VrVseO8pTYj8yYWtfZevWorxpW9aivKmRvWkh//ZS7DFrX2XrlseOcjf7rISt fZWtWx47yt3s30nY2lfZuuWxozwl9u8mbO2rbN3y2FHuZv9ewta+ytYtjx3lbvajErb2VbZu eewod7MfnbC1r7J1y2NHeUrsxyzkzyzF1r7K1i2PHeVu9tkJW/sqW7c8dpS72Y9N2NpX2brl saPczX5cwta+ytYtjx3lKbEfn7C1r7J1y2NHuZv9hIStfZWtWx47yt3sJyZs7ats3fLYUZ4S +0kJW/sqW7c8dpS72eckbO2rbN3y2FHuZp+bsLWvsnXLY0e5m/3khK19la1bHjvKU2I/JWFr X2XrlseOcjf7vIStfZWtWx47yt3spyZs7ats3fLYUe5mPy1ha19l69ai/OJtWYvyixvZL07Y Tu5mPz1ha19l65bHjnI3+xkJW/sqW7c8dpS72b+fsLWvsnXLY0e5m/3MhK19la1bHjvKU2I/ K2FrX2XrlseOcjf72Qlb+ypbtzx2lLvZz0nY2lfZuuWxozwl9nMTtvZVtm557Ch3s5+XsLWv snXLY0e5m31+wta+ytYtjx3lbvbzE7b2VbZueewoT4n9goStfZWtWx47yt3sFyZs7ats3fLY Ue5mvyhha19l65bHjnI3+8UJW/sqW7c8dpSnxN6UsLWvsnXLY0e5m/2ShK19la1bHjvK3eyX Jmztq2zd8thR7ma/LGFrX2XrlseO8pTYL0/Y2lfZuuWxo9zNviBha19l65bHjnI3+xXz/CKf rX2VrVseO8pTYl+YsLWvsnXLY0e5m/0HCVv7Klu3PHaUu9mbE7b2VbZueewod7MvStjaV9m6 5bGjPCX2HyZs7ats3fLYUe5m/1HC1r7K1i2PHeVu9h8nbO2rbN3y2FHuZv9Jwta+ytYtjx3l KbFfmbC1r7J1y2NHuZv9pwlb+ypbtzx2lLvZr0rY2lfZuuWxo9zNfnXC1r7K1i2PHeUpsV+T sLWvsnXLY0e5m/1nC/nTS7G1r7J1y2NHuZv95wlb+ypbtzx2lKfEfm3C1r7K1i2PHeVu9usS tvZVtm557Ch3s/8iYWtfZeuWx45yN/v1CVv7Klu3PHaUp8R+Q8LWvsrWLY8d5W72GxO29lW2 bi3KL9yWtSi/sJH9woX8pqXYY9a+ytYtjx3lbvabE7b2VbZueewoT4n9lwlb+ypbtzx2lLvZ b0nY2lfZuuWxo9zNfmvC1r7K1i2PHeVu9tsStvZVtm557ChPif32hK19la1bHjvK3ex3JGzt q2zd8thR7mb/VcLWvsrWLY8d5Smx/zpha19l65bHjnI3++KErX2VrVseO8rd7L9J2NpX2brl saPczf7bhK19la1bHjvKU2K/M2FrX2XrlseOcjf77xK29lW2bnnsKHez35Wwta+ydctjR7mb /fcJW/sqW7c8dpSnxH53wta+ytYtjx3lbvZ7Erb2VbZueewod7Pfm7C1r7J1y2NHuZv9voSt fZWtWx47ylcZ+wUJ+wWN7Bcs5PcvxR6z9lW2bnnsKHezP5Cwta+ydctjR7mb/cGErX2VrVse O8pTYn8oYWtfZeuWx45yN/vDCVv7Klu3PHaUu9n/kLC1r7J1y2NHuZv9jwlb+ypbtzx2lKfE /kjC1r7K1i2PHeVu9kcTtvZVtm557Ch3s/8pYWtfZeuWx45yN/ufE7b2VbZueewoT4n9Lwlb +ypbtzx2lLvZlyRs7ats3fLYUe5mfyxha19l65bHjvKU2B9P2NpX2brlsaPczf5Ewta+ytYt jx3lbvYnE7b2VbZueewod7M/lbC1r7J1y2NHeUrsTyds7ats3fLYUe5mfyZha19l65bHjnI3 +7MJW/sqW7c8dpS72Z9L2NpX2bol+VOz52/Lkrylb2Jv2QrYbu5mfz5ha19l65bHjnI3+wsJ W/sqW7c8dpS72V9M2NpX2brlsaPczf5Swta+ytYtjx3lKbG/nLC1r7J1y2NHuZv9lYStfZWt Wx47yt3sryZs7ats3fLYUZ4S+2sJW/sqW7c8dpS72f+asLWvsnXLY0e5m/31hK19la1bHjvK 3ex/S9jaV9m65bGjPCX2NxK29lW2bnnsKHez/z1ha19l65bHjnI3+5sJW/sqW7c8dpS72d9K 2NpX2brlsaM8Jfa3E7b2VbZueewod7O/k7C1r7J1y2NHuZv93YStfZWtWx47yt3s/0jY2lfZ uuWxozwl9vcStvZVtm557Ch3s7+fsLWvsnXLY0e5m/2DeT7fZ2tfZeuWx47ylNj/mbC1r7J1 y2NHuZv9w4StfZWtWx47yt3sHyVs7ats3fLYUe5m/1fC1r7K1i2PHeUpsX+csLWvsnXLY0e5 m/2ThK19la1bHjvK3eyfJmztq2zd8thR7mZfmrC1r7J1y2NHeUrsnyVs7ats3fLYUe5m/zxh a19l65bHjnI3+7KErX2VrVseO8rd7F8kbO2rbN3y2FGeEvvyhK19la1bHjvK3ezZ7jFb+ypb tzx2lLvZqxK29lW2bnnsKE+JvV3C1r7K1i2PHeVu9uqErX2VrVseO8rd7KslbO2rbN3y2FHu Zm+fsLWvsnXLY0d5Suw1CVv7Klu3PHaUu9k7zPPzfLb2VbZueewod7N3TNjaV9m65bGj3M3e KWFrX2XrlseO8pTYOyds7ats3fLYUe5m75Kwta+ydctjR7mbvWvC1r7K1i2PHeVu9tUTtvZV tm557ChPib1bwta+ytYtyZ/0WJK39E3sLVuW1/rsK7L2VbZueewod7PXJWztq2zd8thRnhJ7 94StfZWtWx47yt3s9Qlb+ypbtzx2lLvZ10jY2lfZuuWxo9zNvmbC1r7K1i2PHeUpsfdI2NpX 2brlsaPczd4zYWtfZeuWx45yN3uvhK19la1bHjvK3ey9E7b2VbZueewoT4m9T8LWvsrWLY8d 5W72tRK29lW2bnnsKHez903Y2lfZuuWxo9zNvnbC1r7K1i2PHeWrjP3chP3cRvZzF/KGpdhj 1r7K1i2PHeVu9n4JW/sqW7c8dpS72fsnbO2rbN3y2FGeEvuAhK19la1bHjvK3ezrJGztq2zd 8thR7mZvTNjaV9m65bGj3M0+MGFrX2XrlseO8pTY103Y2lfZuuWxo9zNPihha19l65bHjnI3 +3oJW/sqW7c8dpS72QcnbO2rbN3y2FGeEvuQhK19la1bHjvK3exDE7b2VbZueewod7MPS9ja V9m65bGj3M2+fsLWvsrWLY8d5SmxD0/Y2lfZuuWxo9zNPiJha19l65bHjnI3+wYJW/sqW7c8 dpSvMvZzEvZzGtnPWcg3XIo9Zu2rbN3y2FHuZh+ZsLWvsnXLY0e5m32jhK19la1bHjvK3ewb J2ztq2zd8thRnhL7Jglb+ypbtzx2lLvZRyVs7ats3fLYUe5m3zRha19l65bHjnI3++iErX2V rVseO8pTYt8sYWtfZeuWx45yN/uYhK19la1bHjvK3eybJ2ztq2zd8thRnhL72IStfZWtWx47 yt3s4xK29lW2bnnsKHezj0/Y2lfZuuWxo9zNPmGen+2zta+ydctjR3lK7FskbO2rbN3y2FHu Zp+YsLWvsnXLY0e5m31Swta+ytYtjx3lbvYtE7b2VbZueewoT4l9q4StfZWtWx77/7N3JvB2 FdS5PzEyJIJccAIRElA0QVFUcGBQFIiooCg4gKggqKhULVoVcQgioqLWVkGjprG1g1qt1oEO YK3FuYP2vaqv2r7X9lFqR7W1iraWt9c959Dv3qy71n1ZC+w9/X8/PnK/LPL9T04ue+29z8m9 Ue5mH5uwdV5la5fHjnI3+7iErfMqW7s8dpS72ccnbJ1X2drlsaM8S+xNCVvnVbZ2eewod7Mf lrB1XmVrl8eOcjf7hISt8ypbuzx2lGeJ/fCErfMqW7s8dpS72Y9I2DqvsrXLY0e5m/3IhK3z Klu7FuTLtmctyJc1si8b5xOXYk+yzqts7fLYUZ4l9kkJW+dVtnZ57Ch3sx+VsHVeZWuXx45y N/vRCVvnVbZ2eewod7NPTtg6r7K1y2NHeZbYj0nYOq+ytctjR7mb/diErfMqW7s8dpS72ack bJ1X2drlsaPczT41Yeu8ytYujx3lWWI/LmHrvMrWLo8d5W724xO2zqts7fLYUe5mPyFh67zK 1i6PHeVZYj8xYeu8ytYujx3lbvZpCVvnVbZ2Sf7q6PXbsyTPz5vY812WT/fZN2adV9na5bGj 3M1+UsLWeZWtXR47yrPEPiNh67zK1i6PHeVu9pMTts6rbO3y2FHuZj8lYeu8ytYujx3lbvZT E7bOq2zt8thRniX2mQlb51W2dnnsKHezz0rYOq+ytctjR7mb/bSErfMqW7s8dpS72WcnbJ1X 2drlsaM8S+xzErbOq2zt8thR7mY/PWHrvMrWLo8d5W72MxK2zqts7fLYUZ4l9jMTts6rbO3y 2FHuZp87za/z2TqvsrXLY0e5m/2shK3zKlu7PHaUu9nPTtg6r7K1y2NHeZbYz0nYOq+ytctj R7mbfV7C1nmVrV0eO8rd7J9I2DqvsrXLY0e5m/3chK3zKlu7PHaUZ4n9vISt8ypbuzx2lLvZ z0/YOq+ytctjR7mb/ZMJW+dVtnZ57Ch3s89P2DqvsrXLY0d5ltgvSNg6r7K1y2NHuZv9woSt 8ypbuzx2lLvZP5WwdV5la5fHjvIssV80za/12TqvsrXLY0e5m/3ihK3zKlu7PHaUu9kvSdg6 r7K1y2NHuZt9QcLWeZWtXR47yrPEfmnC1nmVrV0eO8rd7AsTts6rbO3y2FHuZr8sYeu8ytYu jx3lbvbLE7bOq2zt8thRniX2KxK2zqts7fLYUe5mvzJh67zK1i6PHeVu9uaErfMqW7s8dpS7 2RclbJ1X2drlsaM8S+xXJWydV9na5bGj3M2+OGHrvMrWLo8d5W72qxO2zqts7fLYUb7J2Jcm 7Esb2ZeO8yVLsSdZ51W2dnnsKHezX5OwdV5la5fHjnI3+9KErfMqW7s8dpS72a9N2DqvsrXL Y0d5ltivS9g6r7K1y2NHuZv9+oSt8ypbuzx2lLvZlyVsnVfZ2uWxo9zNfkPC1nmVrV0eO8qz xH5jwtZ5la1dHjvK3ew3JWydV9na5bGj3M3+6YSt8ypbuzx2lLvZb07YOq+ytctjR3mW2D+T sHVeZWuXx45yN/tnE7bOq2zt8thR7ma/ZZpf47N1XmVrl8eO8iyx35qwdV5la5fHjnI3+/KE rfMqW7s8dpS72VckbJ1X2drlsaPczX5bwtZ5la1dHjvKs8R+e8LWeZWtXR47yt3sLQlb51W2 dnnsKHez35GwdV5la5fHjnI3+50JW+dVtnZ57CjPEvtdCVvnVbZ2eewod7O3JmydV9na5bGj 3M3+uYSt8ypbuzx2lLvZ2xK2zqts7fLYUZ4l9rsTts6rbO3y2FHuZv98wtZ5la1dC/Il27MW 5Esa2ZeM8y8sxZ5knVfZ2uWxozxL7PckbJ1X2drlsaPczf7FhK3zKlu7PHaUu9m/lLB1XmVr l8eOcjf7lxO2zqts7fLYUZ4l9q8kbJ1X2drlsaPczX5vwtZ5la1dHjvK3ez3JWydV9na5bGj 3M1+f8LWeZWtXR47yrPE/tWErfMqW7s8dpS72R9I2DqvsrXLY0e5m/3BhK3zKlu7PHaUZ4n9 awlb51W2dnnsKHezP5SwdV5la9eC/OrtWQvyqxvZrx7nDy/FnmSdV9na5bGj3M3+9YSt8ypb uzx2lGeJ/ZGErfMqW7s8dpS72R9N2DqvsrXLY0e5m/2xhK3zKlu7PHaUu9kfT9g6r7K1y2NH eZbYVyZsnVfZ2uWxo9zN/o2ErfMqW7s8dpS72b+ZsHVeZWuXx45yN/u3ErbOq2zt8thRniX2 bydsnVfZ2uWxo9zNviph67zK1i6PHeVu9tUJW+dVtnZ57CjPEvsTCVvnVbZ2eewod7N/Z5y/ MrrYZ+u8ytYujx3lbvYnE7bOq2zt8thR7mb/bsLWeZWtXR47yrPE/lTC1nmVrV0eO8rd7N9L 2DqvsrXLY0e5m31NwtZ5la1dHjvK3exPJ2ydV9na5bGjPEvszyRsnVfZ2uWxo9zN/mzC1nmV rV0eO8rd7M8lbJ1X2drlsaPczf58wtZ5la1dHjvKs8T+QsLWeZWtXR47yt3sLyZsnVfZ2uWx o9zN/v2ErfMqW7s8dpRnif0H0/wqn63zKlu7PHaUu9l/mLB1XmVrl8eOcjf7jxK2zqts7fLY Ue5mfylh67zK1i6PHeVZYn85Yeu8ytYujx3lbvYfJ2ydV9na5bGj3M3+Hwlb51W2dnnsKHez /2fC1nmVrV0eO8qzxP6ThK3zKlu7PHaUu9lfSdg6r7K1y2NHuZv91YSt8ypbuzx2lLvZX0vY Oq+ytctjR3mW2P8rYeu8ytYujx3lbvafJmydV9na5bGj3M3+esLWeZWtXQvyRduzFuSLGtkX JWwnd7O/kbB1XmVrl8eOcjf7zxK2zqts7fLYUe5m/3nC1nmVrV0eO8rd7P+dsHVeZWuXx47y LLH/T8LWeZWtXR47yt3sv0jYOq+ytctjR7mb/ZcJW+dVtnZ57Ch3s/8qYeu8ytYujx3lWWL/ 34St8ypbuzx2lLvZ1yZsnVfZ2uWxo9zN/uuErfMqW7s8dpS72dclbJ1X2drlsaM8S+y/Sdg6 r7K1y2NHuZv9zYSt8ypbuzx2lLvZfzvNm322zqts7fLYUZ4l9t8lbJ1X2drlsaPczf77hK3z Klu7PHaUu9n/kLB1XmVrl8eOcjf7HxO2zqts7fLYUZ4l9j8lbJ1X2drlsaPczf5WwtZ5la1d HjvK3exvJ2ydV9na5bGj3M3+TsLWeZWtXR47yrPE/ueErfMqW7s8dpS72f+SsHVeZWuXx45y N/u7CVvnVbZ2eewod7P/NWHrvMrWLo8d5Vlify9h67zK1i6PHeVu9ven+ZU+W+dVtnZ57Ch3 s69P2DqvsrXLY0d5ltg/SNg6r7K1y2NHuZv9w4St8ypbuzx2lLvZ/5awdV5la5fHjnI3+98T ts6rbO3y2FGeJfaPErbOq2zt8thR7mb/R8LWeZWtXR47yt3sGxK2zqts7fLYUe5mj/aK2Tqv srXLY0d5ltirErbOq2zt8thR7mbfImHrvMrWLo8d5W726oSt8ypbuzx2lLvZt0zYOq+ytctj R3mW2DslbJ1X2dq1IL9ie9aC/IpG9ivGeeel2JOs8ypbuzx2lLvZuyRsnVfZ2uWxozxL7F0T ts6rbO3y2FHuZq9J2DqvsrXLY0e5m702Yeu8ytYujx3lbvatErbOq2zt8thRniX2bglb51W2 dnnsKHezd0/YOq+ytctjR7mbfeuErfMqW7s8dpS72XskbJ1X2drlsaM8S+y5hK3zKlu7PHaU u9l7JmydV9na5bGj3M3eK2HrvMrWLo8d5Vli3yZh67zK1q4F+eXbsxbklzeyXz7Ot12KPck6 r7K1y2NHuZt9u4St8ypbuzx2lLvZt0/YOq+ytctjR3mW2HdI2DqvsrXLY0e5m713wtZ5la1d HjvK3ex9ErbOq2zt8thR7mbfMWHrvMrWLo8d5Vli75uwdV5la5fHjnI3+04JW+dVtnZ57Ch3 s/dL2DqvsrXLY0e5m71/wtZ5la1dHjvKs8Rel7B1XmVrl8eOcjd7fcLWeZWtXR47yt3sAxK2 zqts7fLYUZ4l9oHj/Cf2iz22zqts7fLYUe5m3zlh67zK1i6PHeVu9l0Sts6rbO3y2FHuZh+U sHVeZWuXx47yLLHvmrB1XmVrl8eOcjf7bglb51W2dnnsKHezNyRsnVfZ2uWxo9zN3piwdV5l a5fHjvIssQ9O2DqvsrXLY0e5m333hK3zKlu7PHaUu9n3SNg6r7K1y2NHuZt9SMLWeZWtXR47 yrPEvmfC1nmVrV0eO8rd7HslbJ1X2drlsaPczT40Yeu8ytauBfnC7VkL8oWN7AsTtpO72fdO 2DqvsrXLY0e5m32fhK3zKlu7PHaUu9n3Tdg6r7K1y2NHuZt9WMLWeZWtXR47yrPEPjxh67zK 1i6PHeVu9v0Sts6rbO3y2FHuZt8/Yeu8ytYujx3lbvYDErbOq2zt8thRniX2AxO2zqts7fLY Ue5mH5GwdV5la5fHjnI3+8iErfMqW7s8dpS72UclbJ1X2drlsaM8S+yjE7bOq2zt8thR7mY/ KGHrvMrWLo8d5W72g6f5pT5b51W2dnnsKM8S+5iErfMqW7s8dpS72Q9J2DqvsrXLY0e5m/3Q hK3zKlu7PHaUu9nHJmydV9na5bGjPEvs4xK2zqts7fLYUe5mH5+wdV5la5fHjnI3e1PC1nmV rV0eO8rd7IclbJ1X2drlsaM8S+wTErbOq2zt8thR7mY/PGHrvMrWLo8d5W72IxK2zqts7fLY Ue5mPzJh67zK1i6PHeVZYp+YsHVeZWuXx45yN/ukab7AZ+u8ytYujx3lbvajErbOq2zt8thR niX2oxO2zqts7fLYUe5mn5ywdV5la5fHjnI3+zEJW+dVtnZ57Ch3sx+bsHVeZWuXx47yLLFP Sdg6r7K1y2NHuZt9asLW+VJs+zLau02YRw4/7jp438Fz8nhOG3yPJR7fWNet27TRPBodNek4 dtK70+DFvdsGb016tw3/xbbRpnXv3WDe6vYeNPnYfj+LGfPfB2OPMeNQh2G//or9frjH1Qea T93riv3MP9zj6EnPlHfM4L0Hrx2esG3DE/a+4cfvrvpP9i6j0eab63nbYu/VnYt7t+x3yNyW /Q7a61MHmg+Zuzl7zx/89r9cPbrd8Bx9aHiOtg4//tWq/+xfP/xH37ZPutEN8/8ea/ODvY8H 7PyP5w0+bPC7B1//F6tH7xh+5TuHjzcMnn68arR+/vPZ5tvrhuk/CCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGE EEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGE EEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEII IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBC CCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCqElHDt518L6D5+TnTxt8D8k3THTLG3/munWbNppHo6MmHccO3m3wTk7vtsFbk95t w3+xbbRp3Xs3mLe6vbeffLz34A2Tj1cNfuzg568af/zCoe84YVx9i/kfVu2yfnTgsaOzRueN njV62uj84d/rRycO/37m6NzRC5f9jI3LDt334ItG9149Wn2f1fP5BMtvvMWqY4aPjxk+Pnf9 8EiG2Wu/+KNP2mN6yfDj3oP32HfvVfZr7ec2DPnE80+9xYd/MHeRdTxgyPvs9qGdzjxs7qI3 X3PAxScM+aRHf2Qn6zhitOr9Txx+HI0+fGN+7/DjB3a9cj5vvuOGzdZx8UHjR3m/na+0p+tG Gc96R6OvXWAfz+vKr13w4e9b52j0qS99cKfPDz0v/uJHd7Kfv/G/EV0/zM950fwfycgw0+f+ 1Ik3Dk/FlePf9uhzkz+LA5648ZjLTt94zGn7j0bfmhv/3ImLeqefAycPH58y+PHSv/totNlj HTphHeawtiyT9fDBd10GyxjGOtphfWKZLPPi35d+LnvcoybcYxzumnXL465xfo8Z98ET7rEO d+MyuffaAe7xE+7DHe6ZN+Hv94QJ97EOd/MyuXaMOnMZn0uPmbBOd1hfXiZruf+PPGHCOsth za3v/X09dcI612E9eZmsTTvw/8gzJ9znONz3LJO7I58zz55wn+twr1km1/t/xGM9b8J6gcP6 QeH36LGMYayXOax9Dlgey3qW8/l54YR1icM6e5mshyzz8/PiCesNDuujy2R5/9/dXOdPW/Yb jQ6Zi3u37HfI3Jb9DtrrUweaD5nb0fOnpw99+jzcZOdPw0Fj9Zly/nTVovOnYWbnPPaY7Fzo m19YeP50/RcWnj/tuuj8yc637PzJOobzpWvsfMvOn6bZzsns/Mny9PzJfv2bP/6azcs9f9os 509vT86f7PwqOn96/fBUfHz4iTc5n6PfW+bnqPf/+Sx+jt5s5/hnD5+j58jn6CcXfY6eUzjH //6+i8/xP7foHP9z/9XO8e85PBVfHH7i/sOP31h8rjScC39oz779cPiE9SCH9dllso5fJsvO tY21yWHtvm55LPv8XM4usvNcY9m54GLWk5fJOsl29TLPN431OIf11WWylnudZAxj2bngYtYP lsl61P/H+aaxnuWwTlu/PNZyzx3sHNNYz3dY71sma7mf83auZyw7D1vM+vYyWcv98zp/wrJz vcWs2xzQ++dlDGNd6rBesEzWw+y8m/Ovvt02nICvtj+Y6W772qLd9rLW86+vLDr/+sp/tfOv 1wxPxRdWjc/DFn+OfnmZn6M/zvOv7t7byHM0ZZyxdjS6ds2YcajDsF9/xtpr15yx9mO7XT1n to+vXXN0cD94qZ75+8EbzEev2zYybx1NexY/bnuMPB/x83H48FivmjzWpZ6Pw9detebwtXvv fvCe5qvW8Dz/+J7n8+3Y/51bjvYcwi1Xja8JnzT4qKH/00P/13ce3ysdmuVwt/nB3scDdv7H 8+x+9uB3D77T0P3O4Vd+ZrKLph+vGvaK1dp8e90w/QchhBBCCCGEEEIIIYQQQgghhBBCCCGE EPpxyd43hzHG+L+Xb67dYn/hxmxvqTbbm6oxxhjPrqfH++nx/6baPYt3jLHtrzHtPHiX0fiv FZntryZijDFe+Z4e1+0Yb7bjvR33p7tHd07nnpnumOl+sceydnTjX3ef960H74ExxnhF247l Zjuu2zH+VpPjvR337fg/3Tl6ndO9Z4xlXHscc4P3HI2/TMRtB99uNP6yOhhjjFe27Xhux3U7 vttx3naQ7R7bOXa9Y/tgum+6do3uGdtxxjS+PR77Um13HHynwfsN3n/wOowxxivWdhy347kd 1+34bsd52z17TY7/dr3RuW+m1zTWZ722Z+xaxpj7TB7L+sF3Ho2/fOTdRuMvy4Yxxnhl247n dly347sd523v2M6x6wzdN3Y/zfbEju4avaax+3PWa/22Z+xLlBrbHsfBgw8Zjb8M6n0G33c0 /tKgGGOMV6btOH7v0fjbi9mXn7bdc5fJNY9dZ9i+sddR7H6a7Yfptc2O7hrbVbaz7N6Z9Vq/ cWzP2M6zHWP75f6DjxhsX0r7QYPta1NjjDFembbjuH3rggcOvt9k79jOsW+BYvfX7jC5n2b3 uqbXNtVdY/fPbHfZNY29PmP3zex6xvaM7T/bMfbY7Fsp2LcUPWE0/pZIGGOMV57tGG7f/s2+ neNDJ3vHdo5d69x9ck/N7m3Z+wbsGsSuRaa7Zkfuo013jV0f2e6y9yHYvTq7ptk4uZ6xPWPf QtB2zCNH42+Fd/Lgx2CMMV6xtuO4fYvdR0x2jl1PPGDyWond05pe29jr93YtYtckO/qajf0a uwdn10f2Pje7f2bvR7CdZtc0dt/M+LZn7FtP2uOzb1f5hMFPxBhjvGJt3xbcjue2c+w6wvaN vUZi97LsNfoDJtcedg1ir+XbNUnXrrHrJXsfgt0/s91m1zR238weh+0Ze2ynDz5j8JMxxhiv WNtx3L4t9eMm+8burdk9LLu2sWsNu+awa4/pazaVXTN9D5rtGrsnZ+8/s9dq7PrJ7p/ZjrNr GrtvZvvP9sxTBp85+KzBT8MYY7zibMdvO47bzrF9c8rk3tVxk2sMe2+aXXPYazZ2v8uuRabv Ravsmul70Ox9AXaPzt77Zq8R2etF9hqS7Ty7b2Z70B7f2YPPwRhjvGJtO+epg580ubaxawq7 trD3ptl9Lds1dp/L7nd17prpe9DsvdX2vgC7Z2ev1dh1ld0/s/t7tgNtH9rjfPrgZ2CMMV5x tuO3XTPY8dyuIez1kUdPdo3dz7L3P9t7n3XX2P2vm3PX2C60XcOfF8YYr9xdY8fxxbvG3get u8ZeU2HXYIwxZtdgjDFm17BrMMaYXcOuwRhjzK7BGGPMrmHXYIwxZtdgjDFm17BrMMaYXcOu wRhjzK7BGGPMrmHXYIwxu4ZdgzHGmF2DMcaYXcOuwRhjzK7BGGPMrmHXYIwxu4ZdgzHGmF2D McaYXcOuwRhjdg27BmOMMbsGY4wxu4ZdgzHGmF2DMcaYXcOuwRhjdg27BmOMMbsGY4wxu4Zd gzHG7Bp2DcYYY3YNxhhjdg27BmOM2TXsGowxxuwadg3GGLNr2DUYY4zZNRhjjNk17BqMMWbX sGswxhizazDGGLNr2DUYY8yuYddgjDFm1/BnhTHG7Bp2DcYYY3YNxhhjdg27BmOM2TXsGowx xuwajDHG7Bp2DcYYs2vYNRhjjNk1GGOM2TXsGowxxuwajDHG7Bp2DcYYs2vYNRhjjNk1GGOM 2TXsGowxZtewazDGGLNrMMYYs2vYNRhjjNk1GGOM2TXsGowxZtewazDGGLNrMMYYs2vYNRhj zK5h12CMMWbXYIwxZtewazDGGLNrMMYYs2vYNRhjzK5h12CMMWbXYIwxZtewazDGmF3DrsEY Y8yuwRhjzK5h12CMMbuGXYMxxphdw67BGGN2DbsGY4wxuwZjjDG7hl2DMcbsGnYNxhhjdg3G GGN2DbsGY4zZNewajDHG7Br+rDDGmF3DrsEYY8yuwRhjzK5h12CMMbuGXYMxxphdgzHGmF3D rsEYY3YNuwZjjDG7BmOMMbuGXYMxxphdgzHGmF3DrsEYY3YNuwZjjDG7BmOMMbuGXYMxxuwa dg3GGGN2DcYYY3YNuwZjjDG7BmOMMbuGXYMxxuwadg3GGGN2DcYYY3YNuwZjjNk17BqMMcbs Gowxxuwadg3GGGN2DcYYY3YNuwZjjNk17BqMMcbsGowxxuwadg3GGLNr2DUYY4zZNRhjjNk1 7BqMMWbXsGswxhiza9g1GGPMrmHXYIwxZtdgjDFm17BrMMaYXcOuwRhjzK7BGGPMrmHXYIwx u4ZdgzHGmF3DnxXGGLNr2DUYY4zZNRhjjNk17BqMMWbXsGswxhizazDGGLNr2DUYY8yuYddg jDFm12CMMWbXsGswxhizazDGGLNr2DUYY8yuYddgjDFm12CMMWbXsGswxphdw67BGGPMrsEY Y8yuYddgjDFm12CMMWbXsGswxphdw67BGGPMrsEYY8yuYddgjDG7hl2DMcaYXYMxxphdw67B GGPMrsEYY8yuGe8ae2z2GO2x8meGMcYrc9ec7eyaTYt2zZ1ugl1z68mu2X/whsH3HfygwScM PnnwEyaP6czJY7R9gzHGeGXa7lE9dfCTBj9u8KMmu+aowYcOPmjRrtmlYdfYvrJdc7vJNdPd Bt9nst+MbY/h1MGnD37KZN/YPrTHijHGeGXZjt92HLd7VacNPmXwiYOPG3zE4HtNds2+g28j u2b1Du4a+zXTXWNdtr9sjxnD9poxjx38yMl9NLvOsn1j1zf2GDHGGK9M23Hc9oxd09j9M3u9 5CGDHzD4kMF3HnzHwXsN3q1519j+sm5jGOv+k9ds7NrGdp7tG7u+sftp9voNxhjjlWm7drDj ub1GYtcTx0/uZdlr9QcPPmDw3oP3HHyrhl1jv9Y6bG9Zp3Wvn7w/wO6j2bWN7TrbN/Z47H6a PTbbOxhjjFem7Th+0uBHTPaMXVfYNY3d07LXUey1+zsMnhu8dvDODbvGOqxr+l40e83G7qPZ tY3tONs39jjsfprtHHu/gF1vYYwxXnm2Y7i9v9l2zEMn7wN74OQ9YXef3Nuy12rsdRV7Ld/e P7bT5DX+yq6xDuua3kfbZ3JtY7vN9o1d39j9NNs5do1lj8t2D8YY45VpO47be85sx9xv8j7n e0yuM6bXNNPXaux1lumu2RHZrpm+F83uo9k9Obu2sfej2es2tm+Ma/fTbOfYtZXtHdt9dr2D McZ4ZdqO47Zf7D1ntmPs77rcZfJ3LO16w6477JrG7nlN3++8o7tm+r7n6X002122w+z+nO0b 49n9NNs5dk1le8eudewx2f7BGGO88mzHcLMdz+24bsd3O87b+5DtNXvbM3bdYdcf02uaHX2t xru2sX1j99Js3xjHePb6jbHtOsceh+0eu76y3Ycxxnjl2Y7hZjue23Hdju92nLdrDLtvZtcz 0z1je2F6TdOxa2xnTfeN9RvHXr+xnWPvT7O9Y68T2WOx/YMxxnhl247ndly347sd5+14b8d9 u2/WuWeifWP35+wax5h2nWN8s+07sz0mjDHGK9PTY7kd1+0Yb9cXdry3474d/+2+me0D2wtd u0b3je4cY033ju24qe2xYIwxXtmeHtPtGG+24723Y7r2jO6bxTtnamNjjDGeTU+P9dPj/3Qf dO+ZpfbOYk8fB8YY45Vv7ziPEEIIIYQQQgghhBBCCCGEEEIIIYQQQgjd7DpyNP7LOvbNCObk 5+2bf9oX95zqhonsjdZjXbdu00bz+AtPW4d9Axv7C6b2l32mvfbFDezn7I1yU8YZa0eja9eM GYc6DPv1Z6y9ds0Zaz+229VzZvv42jX2DQv0sW4bvHXyWJfq2Tb8F9s2mI9et21k3jr/jQ+s Z/Hjtse4+Pk4fHisV00e61LPx+Frr1pz+Nq9dz94T/NVa5bT2/08e8/tUr3j5/bq3T49Z752 u8d7U/baN/Ozn4v67Yv+Le63N/bb54F9PtjnRfRn+KLBL1viMU7fyDnljW4Y/fnoXdvnq+fi bFr8l80q7L9O2DqvsrXLY0e5m31dwtZ5la1dHjvK3ey/Sdg6r7K1y2NHuZv9zYSt8ypbuyz/ bcCyrPMqW7s8dpS72X+XsHVeZWuXx45yN/vvE7bOq2zt8thR7mb/Q8LWeZWtXR47yt3sf0zY Oq+ytctjR7mb/U8JW+dVtnZ57Ch3s7+VsHVeZWuXx45yN/vbCVvnVbZ2eewod7O/M83v9Nk6 r7K1y2NHuZv9zwlb51W2dln+l4BlWedVtnZ57Ch3s7+bsHVeZWuXx45yN/tfE7bOq2zt8thR 7mZ/L2HrvMrWLo8d5W729xO2zqts7fLYUe5mX5+wdV5la5fHjnI3+wcJW+dVtnZ57Ch3s3+Y sHVeZWuXx45yN/vfErbOq2ztsvzvAcuyzqts7fLYUe5m/yhh67zK1i6PHeVu9n8kbJ1X2drl saPczb4hYeu8ytYujx3lbvb8V5EN2DqvsrXLY0e5m70qYeu8ytYujx3lbvYtxvnPlmLrvMrW Lo8d5W726oSt8ypbuzx2lLvZt0zYOq+ytcvyTgHLss6rbO3y2FHuZu+csHVeZWuXx45yN3uX hK3zKlu7PHaUu9m7JmydV9na5bGj3M1ek7B1XmVrl8eOcjd7bcLWeZWtXR47yt3sW03zO3y2 zqts7fLYUe5m75awdV5la5fHjnI3e/eErfMqW7s8dpS72bdO2DqvsrXL8h4By7LOq2zt8thR 7mbPJWydV9na5bGj3M3eM2HrvMrWLo8d5W72Xglb51W2dnnsKHezb5OwdV5la5fHjnI3+7YJ W+dVtnZ57Ch3s2+XsHVeZWuXx45yN/v2CVvnVbZ2eewod7PvkLB1XmVrl+W9A5ZlnVfZ2uWx o9zN3idh67zK1i6PHeVu9h0Tts6rbO3y2FHuZu+bsHVeZWuXx45yN/tOCVvnVbZ2eewod7P3 S9g6r7K1y2NHuZu9f8LWeZWtXR47yt3sdQlb51W2dnnsKHez1ydsnVfZ2uWxo9zNPiBh67zK 1i7LBwYsyzqvsrXLY0e5m33nhK3zKlu7PHaUu9l3Sdg6r7K1a0Hesj1rQd7SyN4yzgctxZ5k nVfZ2uWxo9zNvmvC1nmVrV0eO8rd7LslbJ1X2drlsaPczd6QsHVeZWuXx45yN3tjwtZ5la1d HjvK3eyDE7bOq2ztsnz3gGVZ51W2dnnsKHez75GwdV5la5fHjnI3+5CErfMqW7s8dpS72fdM 2DqvsrXLY0e5m32vhK3zKlu7PHaUu9mHJmydV9na5bGj3M2+d8LWeZWtXR47yt3s+yRsnVfZ 2uWxo9zNvm/C1nmVrV0eO8rd7MMSts6rbO2ybF+LaymWZZ1X2drlsaPczb5fwtZ5la1dHjvK 3ez7J2ydV9na5bGj3M1+QMLWeZWtXR47yt3sByZsnVfZ2uWxo9zNPiJh67zK1i6PHeVu9pEJ W+dVtnZ57Ch3s49K2DqvsrXLY0e5m310wtZ5la1dlh8UsCzrvMrWLsnfGL19e5bk+XkTe77L 8oN99o1Z51W2dnnsKHezj0nYOq+ytctjR7mb/ZCErfMqW7s8dpS72Q9N2DqvsrXLY0e5m31s wtZ5la1dHjvK3ezjErbOq2zt8thR7mYfn7B1XmVrl8eOcjd7U8LWeZWtXR47yt3shyVsnVfZ 2mX5hIBlWedVtnZ57Ch3sx+esHVeZWuXx45yN/sRCVvnVbZ2eewod7MfmbB1XmVrl8eOcjf7 xISt8ypbuzx2lLvZJyVsnVfZ2uWxo9zNflTC1nmVrV0eO8rd7EcnbJ1X2drlsaPczT45Yeu8 ytYuy48JWJZ1XmVrl8eOcjf7sQlb51W2dnnsKHezT0nYOq+ytctjR7mbfWrC1nmVrV0eO8rd 7MclbJ1X2drlsaPczX58wtZ5la1dHjvK3ewnJGydV9na5bGj3M1+4jS/zWfrvMrWLo8d5W72 aQlb51W2dnnsKHezT0/YOq+ytcvykwKWZZ1X2drlsaPczZ7/GpsBW+dVtnZ57Ch3s5+csHVe ZWuXx45yN/spCVvnVbZ2eewod7OfmrB1XmVrl8eOcjf7zISt8ypbuzx2lLvZZyVsnVfZ2uWx o9zNflrC1nmVrV0eO8rd7LMTts6rbO2yfE7AsqzzKlu7PHaUu9lPT9g6r7K1y2NHuZv9jISt 8ypbuzx2lLvZz0zYOq+ytctjR7mbfW7C1nmVrV0eO8rd7GclbJ1X2drlsaPczX52wtZ5la1d HjvK3eznJGydV9na5bGj3M0+L2HrvMrWLo8d5W72TyRsnVfZ2mX5uQHLss6rbO3y2FHuZj8v Yeu8ytYujx3lbvbzE7bOq2zt8thR7mb/ZMLWeZWtXQvyFduzFuQrGtlXjPP5S7EnWedVtnZ5 7Ch3s1+QsHVeZWuXx45yN/uFCVvnVbZ2eewod7N/KmHrvMrWLo8d5W72ixK2zqts7bL84oBl WedVtnZ57Ch3s1+SsHVeZWuXx45yN/uChK3zKlu7PHaUu9kvTdg6r7K1S/LXPZbk+XkTe77L 8oU++8as8ypbuzx2lLvZL0vYOq+ytctjR7mb/fKErfMqW7s8dpS72a9I2DqvsrXLY0e5m/3K hK3zKlu7PHaUu9mbE7bOq2ztsnxRwLKs8ypbuzx2lLvZr0rYOq+ytctjR7mbfXHC1nmVrV0e O8rd7FcnbJ1X2drlsaPczb4kYeu8ytYujx3lbvZrErbOq2zt8thR7mZfmrB1XmVrl8eOcjf7 tQlb51W2dnnsKHezX5ewdV5la5fl1wcsyzqvsrXLY0e5m31ZwtZ5la1dC/Ll27MW5Msb2ZeP 8xuWYk+yzqts7fLYUe5mvzFh67zK1i6PHeVu9psSts6rbO3y2FHuZv90wtZ5la1dHjvK3ew3 J2ydV9na5bGj3M3+mYSt8ypbuzx2lLvZP5uwdV5la5fHjnI3+y0JW+dVtnZZfmvAsqzzKlu7 PHaUu9mXJ2ydV9na5bGj3M2+ImHrvMrWLo8d5W722xK2zqts7fLYUe5mvz1h67zK1i6PHeVu 9paErfMqW7s8dpS72e9I2DqvsrXLY0e5m/3OhK3zKlu7PHaUu9nvStg6r7K1y/LWgGVZ51W2 dnnsKHezfy5h67zK1i6PHeVu9raErfMqW7s8dpS72e9O2DqvsrXLY0e5m/3zCVvnVbZ2eewo d7N/IWHrvMrWLo8d5W72exK2zqts7fLYUe5m/2LC1nmVrV0eO8rd7F+a5rf6bJ1X2drlsaPc zf7lhK3zKlu7LP9KwLKs8ypbuzx2lLvZ703YOq+ytctjR7mb/b6ErfMqW7s8dpS72e9P2Dqv srXLY0e5m/2rCVvnVbZ2eewod7M/kLB1XmVrl8eOcjf7gwlb51W2dnnsKHezfy1h67zK1i6P HeVu9ocSts6rbO2y/OGAZVnnVbZ2eewod7N/PWHrvMrWLo8d5W72RxK2zqts7fLYUe5mfzRh 67zK1i6PHeVu9scSts6rbO3y2FHuZn88Yeu8ytYujx3lbvaV4/ynS7F1XmVrl8eOcjf7NxK2 zqts7fLYUe5m/2bC1nmVrV2WfytgWdZ5la1dHjvK3ezfTtg6r7K1y2NHuZt9VcLWeZWtXR47 yt3sqxO2zqts7fLYUe5mfyJh67zK1i6PHeVu9u8kbJ1X2drlsaPczf7kNL/FZ+u8ytYujx3l bvbvJmydV9na5bGj3M3+VMLWeZWtXR47yt3s30vYOq+ytcvyNQHLss6rbO3y2FHuZn86Yeu8 ytYujx3lbvZnErbOq2zt8thR7mZ/NmHrvMrWLo8d5W725xK2zqts7fLYUe5mfz5h67zK1i6P HeVu9hcSts6rbO3y2FHuZn8xYeu8ytYujx3lbvbvJ2ydV9naZfkPApZlnVfZ2uWxo9zN/sOE rfMqW7s8dpS72X+UsHVeZWuXx45yN/tLCVvnVbZ2eewo/z/2zgRe14Kq199hPocDHAfkMMgg gofBRCRABkEmAZkUUCY5CDiGZuQEDhxAkEEBUdMyhKwMTZPUvIN2y2t1w9u9WamYzYlkc5am lkTv2vv96L/3WWet77KW+Nvd5/n1j/NnyXq2+xy/xffuzaHb/bnErfOqW3d57qh3u38nceu8 6tZdnjvq3e7fTdw6r7p1l+eOerf79xK3zqtu3eW5o97t/nzi1nnVrbs8d9S73V9I3DqvunWX 9S8GLus6r7p1l+eOerf7nsSt86pbd3nuqHe7v5S4dV51664F/db1XQv6rY3uW+f772/IPXad V926y3NHvdv95cSt86pbd3nuqHe7/yBx67zq1l2eO+rd7j9M3DqvunWX5456t/uPErfOq27d 5bmj3u3+48St86pbd1n/k8BlXedVt+7y3FHvdv9p4tZ51a27PHfUu91/lrh1XnXrLs8d9W73 nydunVfdustzR73b/ZXErfOqW3d57qh3u+9N3DqvunWX5456t/uriVvnVbfu8txR73bfl7h1 XnXrLs8d9W73XyRunVfdustzR73b/bXErfOqW3dZ/8vAZV3nVbfu8txR73b/VeLWedWtuzx3 1Lvdf524dV516y7PHfVu998kbp1X3brLc0e92/23iVvnVbfu8txR73b/XeLWedWtuzx31Lvd f5+4dV516y7PHfVu9z8kbp1X3brLc0e92/31xK3zqlt3Wf/HwGVd51W37pL+pcnb1ndJn5s3 ued2Wf8n3/1g13nVrbs8d9S73d9I3DqvunWX5456t/ubiVvnVbfu8txR73b/c+LWedWtuzx3 1Lvd30rcOq+6dZfnjnq3+9uJW+dVt+7y3FHvdn8nceu86tZdnjvq3e5/Sdw6r7p1l+eOerf7 XxO3zqtu3WX9u4HLus6rbt3luaPe7b4/ceu86tZdnjvq3e5/S9w6r7p1l+eOerf7gcSt86pb d3nuqHe7J1vGbp1X3brLc0e9270sceu86tZdnjvq3e6NErfOq27d5bmj3u3eOHHrvOrWXZ47 6t3uTRK3zqtu3WV908BlXedVt+7y3FHvdm+WuHVedesuzx31bvfmiVvnVbfu8txR73Zvkbh1 XnXrLs8d9W738sSt86pbd3nuqHe7VyRunVfdustzR73bvWXi1nnVrbs8d9S73Sun/RbfrfOq W3d57qh3u7dK3DqvunWX5456t3vrxK3zqlt3Wd8mcFnXedWtuzx31LvdqxK3zqtu3eW5o97t fkTi1nnVrbs8d9S73Y9M3DqvunWX5456t/tRiVvnVbfu8txR73Y/OnHrvOrWXZ476t3ubRO3 zqtu3eW5o97tfkzi1nnVrbs8d9S73dslbp1X3brL+urAZV3nVbfu8txR73Zvn7h1XnXrLs8d 9W73Dolb51W37vLcUe9275i4dV516y7PHfVu906JW+dVt+7y3FHvdj82ceu86tZdnjvq3e6d E7fOq27d5bmj3u3eJXHrvOrWXZ476t3uXRO3zqtu3eW5o97t3i1x67zq1l3WHxe4rOu86tZd njvq3e7dE7fOq27d5bmj3u1+fOLWedWtuzx31LvdeyRunVfdumtBv3l914J+c6P75vm+54bc Y9d51a27PHfUu91PSNw6r7p1l+eOerd7TeLWedWtuzx31LvdeyVunVfdustzR73bvXfi1nnV rbus7xO4rOu86tZdnjvq3e59E7fOq27d5bmj3u1+YuLWedWtuzx31LvdP5C4dV516y7p93gu 6XPzJvfcLutP8t0Pdp1X3brLc0e9271f4tZ51a27PHfUu91PTtw6r7p1l+eOerd7/8St86pb d3nuqHe7n5K4dV516y7PHfVu9wGJW+dVt+6y/oOBy7rOq27d5bmj3u0+MHHrvOrWXZ476t3u gxK3zqtu3eW5o97tPjhx67zq1l2eO+rd7qcmbp1X3brLc0e9231I4tZ51a27PHfUu92HJm6d V926y3NHvdt9WOLWedWtuzx31LvdhydunVfdusv60wKXdZ1X3brLc0e9231E4tZ51a27FvSb 1nct6Dc1um+a70duyD12nVfdustzR73b/fTErfOqW3d57qh3u49K3DqvunWX5456t/voxK3z qlt3ee6od7uPSdw6r7p1l+eOerf72MSt86pbd3nuqHe7j0vcOq+6dZfnjnq3+xmJW+dVt+6y fnzgsq7zqlt3ee6od7tPSNw6r7p1l+eOerf7xMSt86pbd3nuqHe7n5m4dV516y7PHfVu90mJ W+dVt+7y3FHvdp+cuHVedesuzx31bvcpiVvnVbfu8txR73afmrh1XnXrLs8d9W73aYlb51W3 7rL+rMBlXedVt+7y3FHvdj87ceu86tZdnjvq3e7TE7fOq27d5bmj3u0+I3HrvOrWXZ476t3u M6f9rb5b51W37vLcUe92Pydx67zq1l2eO+rd7ucmbp1X3brLc0e9231W4tZ51a27PHfUu91n J26dV926y3NHvdt9TuLWedWtu6yfG7is67zq1l2eO+rd7vMSt86rbt3luaPe7X5e4tZ51a27 PHfUu93nJ26dV926y3NHvdu9NnHrvOrWXZ476t3uCxK3zqtu3eW5o97tfn7i1nnVrbs8d9S7 3Rcmbp1X3brLc0e9231R4tZ51a27rF8cuKzrvOrWXZ476t3uFyRunVfdustzR73b/cJpf4vv 1nnVrbs8d9S73S9K3DqvunWX5456t/vFiVvnVbfu8txR73a/JHHrvOrWXZ476t3ulyZunVfd ustzR73b/UOJW+dVt+7y3FHvdl+SuHVedesu6y8LXNZ1XnXrLs8d9W73yxO3zqtu3eW5o97t /uHErfOqW3d57qh3u1+RuHVedesuzx31bvePJG6dV926y3NHvdt9aeLWedWtuzx31LvdP5q4 dV516y7PHfVu9ysTt86rbt3luaPe7X5V4tZ51a27PHfUu92vTtw6r7p1l/XXBC7rOq+6ddeC fuP6rgX9xkb3jfP9tRtyj13nVbfu8txR73Zflrh1XnXrLs8d9W735Ylb51W37vLcUe92vy5x 67zq1l2eO+rd7tcnbp1X3brLc0e92/2GxK3zqlt3ee6od7vfmLh1XnXrLs8d9W73FYlb51W3 7rK+LnBZ13nVrbs8d9S73Vcmbp1X3brLc0e9231V4tZ51a27PHfUu91XJ26dV926y3NHvdv9 psSt86pbd3nuqHe7r0ncOq+6dZfnjnq3+9rErfOqW3d57qh3u9+cuHVedesuzx31bvd18/2L kxt8t86rbt3luaPe7b4+ceu86tZd1m8IXNZ1XnXrLs8d9W73jYlb51W37vLcUe92vyVx67zq 1l2eO+rd7rcmbp1X3brLc0e9231T4tZ51a27PHfUu903J26dV926y3NHvdt9S+LWedWtuzx3 1Lvdb0vcOq+6dZfnjnq3+9bErfOqW3dZf3vgsq7zqlt3ee6od7vfkbh1XnXrLs8d9W73OxO3 zqtu3eW5o97t/rHErfOqW3d57qh3u9+VuHVedesuzx31bve7E7fOq27d5bmj3u3+8cSt86pb dy3o16/vWtCvb3RfP99/YkPuseu86tZdnjvq3e73JG6dV926y3NHvdv9k4lb51W37rJ+W+Cy rvOqW3d57qh3u9+buHVedesuzx31bvftiVvnVbfu8txR73bfkbh1XnXrLs8d9W73TyVunVfd ustzR73b/b7ErfOqW3d57qh3u386ceu86tZdnjvq3e6fSdw6r7p1l+eOerf7ZxO3zqtu3WX9 /YHLus6rbt3luaPe7f65xK3zqlt3ee6od7vvTNw6r7p1l+eOerf7A4lb51W37vLcUe92fzBx 67zq1l0L+nXruxb06xrd1833n9+Qe+w6r7p1l+eOerf7Q4lb51W37vLcUe92fzhx67zq1l2e O+rd7l9I3DqvunWX5456t/sjiVvnVbfusn5X4LKu86pbd3nuqHe7fzFx67zq1l2eO+rd7o8m bp1X3brLc0e92/2xxK3zqlt3ee6od7s/nrh1XnXrLs8d9W73LyVunVfdustzR73b/YnErfOq W3d57qh3u/9L4tZ51a27PHfUu93/NXHrvOrWXdb/W+CyrvOqW3d57qh3u/974tZ51a27PHfU u92fTNw6r7p1l+eOerf7U9P+Zt+t86pbd3nuqHe7fzlx67zq1l2eO+rd7v+RuHVedesuzx31 bvevJG6dV926y3NHvdv9q4lb51W37vLcUe92fzpx67zq1l2eO+rd7v+ZuHVedesu658JXNZ1 XnXrLs8d9W73ryVunVfdustzR73b/euJW+dVt+7y3FHvdv9G4tZ51a27PHfUu93/K3HrvOrW XZ476t3u30zcOq+6dZfnjnq3++7ErfOqW3d57qh3uz+buHVedesuzx31bvf/Ttw6r7p1l/Xf ClzWdV516y7PHfVu9/+Z9mt9t86rbt3luaPe7f6/iVvnVbfu8txR73b/duLWedWtuzx31Lvd n0vcOq+6dZfnjnq3+3cSt86rbt3luaPe7f7dxK3zqlt3ee6od7t/L3HrvOrWXZ476t3uzydu nVfdustzR73b/YXErfOqW3dZ/2Lgsq7zqlt3ee6od7vvSdw6r7p1l+eOerf7S4lb51W37vLc Ue92/37i1nnVrbs8d9S73V9O3DqvunWX5456t/sPErfOq27d5bmj3u3+w8St86pbd3nuqHe7 /yhx67zq1l2eO+rd7j+e9mt8t86rbt1l/U8WuRd/LDqvunWX5456t/tPE7fOq27d5bmj3u3+ s8St86pbd3nuqHe7/zxx67zq1l2eO+rd7q8kbp1X3brLc0e9231v4tZ51a27PHfUu91fTdw6 r7p1l+eOerf7vsSt86pbd3nuqHe7/yJx67zq1l2eO+rd7q8lbp1X3brL+l8GLus6r7p1l+eO erf7rxK3zqtu3eW5o97t/uvErfOqW3d57qh3u/8mceu86tZdnjvq3e6/Tdw6r7p1l+eOerf7 7xK3zqtu3eW5o97t/vtpf5Pv1nnVrbs8d9S73f+QuHVedesuzx31bvfXE7fOq27dZf0fA5d1 nVfdustzR73b/U+JW+dVt+7y3FHvdn8jceu86tZdnjvq3e5vJm6dV926y3NHvdv9z4lb51W3 7vLcUe92fytx67zq1l2eO+rd7m8nbp1X3brLc0e92/2dxK3zqlt3ee6od7v/JXHrvOrWXZ47 6t3uf03cOq+6dZf17wYu6zqvunWX5456t/v+xK3zqlt3ee6od7v/LXHrvOrWXZ476t3uBxK3 zqtu3eW5o97tnqyM3TqvunWX9C9Mrl7fJX1u3uSe22V9me9+sOu86tZdnjvq3e6NErfOq27d 5bmj3u3eOHHrvOrWXZ476t3uTRK3zqtu3WV908BlXedVt+7y3FHvdm+WuHVedesuzx31bvfm iVvnVbfu8txR73Zvkbh1XnXrLs8d9W738sSt86pbd3nuqHe7VyRunVfdustzR73bvWXi1nnV rbs8d9S73SsTt86rbt3luaPe7d4qceu86tZdnjvq3e6tE7fOq27dZX2bwGVd51W37vLcUe92 r0rcOq+6dZfnjnq3+xGJW+dVt+5a0K9a37WgX9Xovmq+P3JD7rHrvOrWXZ476t3uRyVunVfd ustzR73b/ejErfOqW3d57qh3u7dN3DqvunWX5456t/sxiVvnVbfu8txR73Zvl7h1XnXrLuur A5d1nVfdustzR73bvX3i1nnVrbs8d9S73Tskbp1X3brLc0e9271j4tZ51a27PHfUu907JW6d V926y3NHvdv92MSt86pbd3nuqHe7d07cOq+6dZfnjnq3e5fErfOqW3d57qh3u3dN3DqvunWX 9d0Cl3WdV926y3NHvdv9uMSt86pbdy3oV67vWtCvbHRfOd9335B77DqvunWX5456t/vxiVvn Vbfu8txR73bvkbh1XnXrLs8d9W73nolb51W37vLcUe92PyFx67zq1l2eO+rd7jWJW+dVt+7y 3FHvdu+VuHVedesuzx31bvfeiVvnVbfusr5P4LKu86pbd3nuqHe7903cOq+6dZfnjnq3+4mJ W+dVt+7y3FHvdv9A4tZ51a27PHfUu91PStw6r7p1l+eOerd7v8St86pbd3nuqHe7n5y4dV51 6y7PHfVu9/6JW+dVt+7y3FHvdj8lceu86tZd1g+Y9nXru6zrvOrWXZ476t3uH0zcOq+6dZfn jnq3+8DErfOqW3d57qh3uw9K3DqvunWX5456t/vgxK3zqlt3ee6od7ufmrh1XnXrLs8d9W73 IYlb51W37vLcUe92H5q4dV516y7PHfVu92GJW+dVt+7y3FHvdh+euHVedesu608LXNZ1XnXr Ls8d9W73EYlb51W37vLcUe92H5m4dV516y7PHfVu99MTt86rbt3luaPe7T4qceu86tZdnjvq 3e6jE7fOq27d5bmj3u0+JnHrvOrWXQv6Feu7FvQrGt1XzPdjN+Qeu86rbt3luaPe7T4uceu8 6tZd1p8RuKzrvOrWXZ476t3u4xO3zqtu3eW5o97tPiFx67zq1l2eO+rd7hMTt86rbt3luaPe 7X5m4tZ51a27PHfUu90nJW6dV926y3NHvdt9cuLWedWtuzx31LvdpyRunVfdustzR73bfWri 1nnVrbs8d9S73aclbp1X3brL+rMCl3WdV926y3NHvdv97MSt86pbd3nuqHe7T0/cOq+6dZfn jnq3+4zErfOqW3d57qh3u89M3DqvunWX5456t/s50/5G363zqlt3ee6od7ufm7h1XnXrLs8d 9W73WYlb51W37vLcUe92n524dV516y7r5wQu6zqvunWX5456t/vcxK3zqlt3ee6od7vPS9w6 r7p1l+eOerf7eYlb51W37vLcUe92n5+4dV516y7PHfVu99rErfOqW3d57qh3uy9I3DqvunWX 5456t/v5iVvnVbfu8txR73ZfmLh1XnXrLs8d9W73RYlb51W37rJ+ceCyrvOqW3d57qh3u1+Q uHVedesuzx31bvcLE7fOq27d5bmj3u1+0bS/wXfrvOrWXZ476t3uFydunVfdustzR73b/ZLE rfOqW3d57qh3u1+auHVedesuzx31bvcPJW6dV926y3NHvdt9SeLWedWtu6y/LHBZ13nVrbs8 d9S73S9P3DqvunWX5456t/uHE7fOq27d5bmj3u1+ReLWedWtuzx31LvdP5K4dV516y7PHfVu 96WJW+dVt+7y3FHvdv9o4tZ51a27PHfUu92vTNw6r7p1l+eOerf7VYlb51W37vLcUe92vzpx 67zq1l3WXxO4rOu86tZdnjvq3e7XJm6dV926S/rn7S9e7JI+N29yz+2yfpnvfrDrvOrWXZ47 6t3uyxO3zqtu3eW5o97tfl3i1nnVrbs8d9S73a9P3DqvunWX5456t/sNiVvnVbfu8txR73a/ MXHrvOrWXZ476t3uKxK3zqtu3WV9XeCyrvOqW3d57qh3u69M3DqvunWX5456t/uqxK3zqlt3 ee6od7uvTtw6r7p1l+eOerf7TYlb51W37vLcUe92X5O4dV516y7PHfVu97WJW+dVt+7y3FHv dr85ceu86tZdnjvq3e7rErfOq27d5bmj3u2+ftpf57t1XnXrLus3LHIv/lh0XnXrLs8d9W73 jYlb51W37vLcUe92vyVx67zq1l2eO+rd7rcmbp1X3brLc0e9231T4tZ51a27PHfUu903J26d V926y3NHvdt9S+LWedWtuzx31Lvdb0vcOq+6dZfnjnq3+9bErfOqW3dZf3vgsq7zqlt3ee6o d7vfkbh1XnXrLs8d9W73OxO3zqtu3eW5o97t/rHErfOqW3d57qh3u9+VuHVedesuzx31bve7 E7fOq27d5bmj3u3+8cSt86pbd3nuqHe7fyJx67zq1l0L+uXruxb0yxvdl8/392zIPXadV926 y3NHvdv9k4lb51W37rJ+W+CyrvOqW3d57qh3u9+buHVedesuzx31bvftiVvnVbfu8txR73bf kbh1XnXrLs8d9W73TyVunVfdustzR73b/b7ErfOqW3d57qh3u386ceu86tZdnjvq3e6fSdw6 r7p1l+eOerf7ZxO3zqtu3WX9/YHLus6rbt3luaPe7f65xK3zqlt3ee6od7vvTNw6r7p1l+eO erf7A4lb51W37vLcUe92fzBx67zq1l2eO+rd7p9P3DqvunXXgn7Z+q4F/bJG92Xz/UMbco9d 51W37vLcUe92fzhx67zq1l2eO+rd7l9I3DqvunWX5456t/sjiVvnVbfusn5X4LKu86pbd3nu qHe7fzFx67zq1l2eO+rd7o8mbp1X3brLc0e92/2xxK3zqlt3ee6od7s/nrh1viH344bM/ccG Dh3+uMWQHYesko/n7CH7buDjm+e+XY7byzKZHDbuOHrcu+mQxXtvH3Jbsvf24T9x++S4Xe5c Y7nN3bvH+GP777PYYZ+fe5fPO/ZzHPbXn7fi3uWfWmX5+MrzVljuXX74uGfqO3LI6iHLh0/W /cMf7x7+eP6y/3BvPpmse7g+b2uH/07b2e9tGuxdu2K7FWtXXLPy06ss2614OPdeOuSOb2w6 2Xb4/Gw15JeHnLTsP/afs9lk8kL7yZo8YL/0RtYd4f140M798ZIhB9heK8Pu7w5/5a8OP1wz ZPrjZZNd534923x9Hpj+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAwP8zhw7ZYsiOQ1bJnz97yL7SHxjZ5ME/c98ux+1lmUwOG3ccPWTl kE2dvWtXTCbbrYj3rl2x3Yq1K65Z+elVlu1WeHsfM/549ZA144+XDXn2kFcsm//xK4d9x4jj UxvN/WHZ5rtOHnf05PmTSyYvmVw4uXT4/7tOThr+/4smL568cubP2Pyy/Xbc+8rJbRtPNn7v xnP9eOtf2WjZkcOPjxx+/OJdh49kmF332ft/xT6m1w5/XD1kmx1XL7O/1v7cmqGfdOkZG931 nVVX2o6Dh779yo9sesEBq6685TO7XX380E8+9aOb2o5DJsu+edbwx8nkrgf7ncMfP7TFJ+b6 uh3WrLMdV+8x/1EeuNkn7NP1IOazvZPJPZfZj+f4xD2X3fUt2zmZfPq3P7zpbw57XvPZj21q f/7B/4zw7WF+8avnfkomppl+7s8Yc/5QthnyoiH2X99mu52115E3nrPXkY/dajL56Ir5P3fS or3TXwOnDT8+fchzZP/wl63zXBePrpc7rufN6DrKPiczuF42ul7juD48o8t+DS926a9lz/uq 0Ws/GYu998/oXT5kz0Xeh+t/87cPuS3Ze/vwn7h9ctwud66x3ObuzT5PRwxl9yEnDjlg0efp O1tOJpdumX+eTh3y0hl+LZwwuk53XM9ZOZvLXqtm+XX3rNF1puN6/4yuE5yff89lDnNd4Lju ntH1jBk/h2tH10WOa8+tev97XTi6LnFcJ8zoOmXGny9zmOvVjusDM7qePqPLXhvM9Ubv1/yM Ltszy2vt60fXOsd15Na9P1/mMNcNjuuiGV2z/nyZw1zvdFyfmdHl/ZrPXq/ePnrf5Xh33WY2 7/fzdf178fdy3ufJPjcHDTl8yPGLPk+3DJ+j/Vf2/f3EoaPrGMf1uRlds/7v6ajRdZzjeszK 2Vyz/u/JHOY6zXEdMqNr1nt1yuh6tuO6YUaX9+vac5nDXOc6rg/O6LKfq1l+vs4ZXfb3nItd 98/omvV13W6iueyWLHadvNVsLpvN8t/rJaPL/v52sev6GV2z/jo0h7ns76EXu+6a0WXv6Wb5 HNr9NZfdksWu5Vv3/nxdMbquc1xnz+ia9XXj2tFld2ux644ZXbP+fJnDXHYbF7t+Y0bXrH9P /Y7R9V7Htec2s7m8m/+f8dnGC4Z9+nnofbYx/yxj7tnGVzeebHyfPNvYZ+OFzzaGmT2PsI/J nlN87e6Fzza+fffCZxtbLHq2Yc9C7NmG7ThksmwXexZizzam3Z6X2LMN69NnG/bX3/JL166b 9dnGOnm28e7k2YY9+4iebdivzQOHvM/5NXrtjL9Gv59/z9a991HyOZo6Lhl+4d67fN6xn+Ow v/6S1fcuv2T1x1f+1s4W+/G9yw8PnhtsaM/cc4M1lsN3uX1iuW0y3bP447aPkc9H/Pk4dvhY Pzl+rBv6fBy7+pPLj129eqtDdrF8cjmf5+/f5/lSe+3/+iaT64bX/02GP/G0jef/XvikYf+v Dfu/vNlw6+devh+Ql7t1R3g/HrRzf7zE3nMNuWPITsPu9wx/5a+Pt2j642XDXbG1Nl+fB6b/ BwAAAAAAAAAAAAAAAAAAAAAAAPD9wr5vjhBCyP9febhui/3TOxb7lmqLfVM1IYSQ/7yZvt5P X/+/V7dn8Y0xt/1jTJsN2Xwy/48VWewfTSSEELL0M31dt9d4i73e2+v+9Pbozem8M9MbM70v 9rGsmDz4j7vPZesh2xBCCFnSsddyi72u22v8luPrvb3u2+v/9Obo+5zuO2Mu89rHsWrIIybz v03Eo4dsO5n/bXUIIYQs7djrub2u2+u7vc7bDbLbYzfH3u/YPZjem65bo3fGbpw5zW8fj/1W bTsM2WnIY4fsPGQXQgghSzb2Om6v5/a6bq/v9jpvt+eR4+u/vd/ovDfT9zS2z/banbH3Mubc fvxYdh2y+2T+t498wmT+t2UjhBCytGOv5/a6bq/v9jpvd8dujr3P0Htjz9PsTjzUW6Pvaez5 nO21/XZn7LcoNbd9HHsPeeJk/rdB3X/IUybzvzUoIYSQpRl7HX/ykCdN5n/7abs9jx/f89j7 DLs39nUUe55m92H63uah3hq7VXaz7NmZ7bX95rE7YzfPbozdl4OGHDLEfivtpw2x35uaEELI 0oy9jtu/uuCpQw4c747dHPtXoNjzte3G52n2rGv63qZ6a+z5md0ue09jX5+x52b2fsbujN0/ uzH2sdm/SuG4IcdP5v+VSIQQQpZe7DXc/jWsx07m/5Xednfs5th7nX3GZ2r2bMu+b8Deg9h7 kemteSjP0aa3xt4f2e2y70OwZ3X2nmav8f2M3Rn7VwjajXnmZP5fT3fakGcRQghZsrHX8ZOH nDjeHHs/cfD4tRJ7pjV9b2Nfv7f3Ivae5KF+zcb+GnsGZ++P7Pvc7PmZfT+C3TR7T2PPzcxv d8b+1ZP28dm/rvK5Q84ihBCyZGP/WnB7PbebY+8j7N7Y10jsWZZ9jX638b2HvQexr+Xbe5Ku W2Pvl+z7EOz5md02e09jz83s47A7Yx/bOUPOG/I8QgghSzb2Om7/Wuozx3tjz9bsGZa9t7H3 Gvaew957TL9mU7k10+9Bs1tjz+Ts+8/sazX2/smen9mNs/c09tzM7p/dmfOHXDDk+UMuJIQQ suRir9/2Om43x+7N6eOzq2PG9xj2vWn2nsO+ZmPPu+y9yPR70Sq3Zvo9aPZ9AfaMzr73zb5G ZF8vsq8h2c2z52Z2B+3ju2jIxYQQQpZs7OasHXLu+N7G3lPYewv73jR7rmW3xp5z2fOuzlsz /R40+95q+74Ae2ZnX6ux91X2/Mye79kNtHtoH+cLhryQEELIkou9ftt7Bns9t/cQ9vWRU8db Y8+z7Puf7Xuf9dbY86+H89bYLbRbw88XIYQs3Vtjr+OLb419H7TeGvuaCreGEEIIt4YQQgi3 hltDCCHcGm4NIYQQbg0hhBBuDbeGEEIIt4YQQgi3hltDCCHcGm4NIYQQbg0hhBBuDbeGEEK4 NdwaQggh3BpCCCHcGm4NIYQQbg0hhBBuDbeGEEK4NdwaQggh3BpCCCHcGm4NIYRwa7g1hBBC uDWEEEK4NdwaQggh3BpCCCHcGm4NIYRwa7g1hBBCuDWEEEK4NdwaQgjh1nBrCCGEcGsIIYRw a7g1hBDCreHWEEII4dZwawghhFvDrSGEEMKtIYQQwq3h1hBCCLeGW0MIIYRbQwghhFvDrSGE EG4Nt4YQQgi3hp8rQgjh1nBrCCGEcGsIIYRwa7g1hBDCreHWEEII4dYQQgjh1nBrCCGEW8Ot IYQQwq0hhBDCreHWEEII4dYQQgjh1nBrCCGEW8OtIYQQwq0hhBDCreHWEEIIt4ZbQwghhFtD CCGEW8OtIYQQwq0hhBDCreHWEEIIt4ZbQwghhFtDCCGEW8OtIYQQbg23hhBCCLeGEEIIt4Zb QwghhFtDCCGEW8OtIYQQbg23hhBCCLeGEEIIt4ZbQwgh3BpuDSGEEG4NIYQQbg23hhBCuDXc GkIIIdwabg0hhHBruDWEEEK4NYQQQrg13BpCCOHWcGsIIYRwawghhHBruDWEEMKt4dYQQgjh 1vBzRQgh3BpuDSGEEG4NIYQQbg23hhBCuDXcGkIIIdwaQggh3BpuDSGEcGu4NYQQQrg1hBBC uDXcGkIIIdwaQggh3BpuDSGEcGu4NYQQQrg1hBBCuDXcGkII4dZwawghhHBrCCGEcGu4NYQQ Qrg1hBBCuDXcGkII4dZwawghhHBrCCGEcGu4NYQQwq3h1hBCCOHWEEII4dZwawghhHBrCCGE cGu4NYQQwq3h1hBCCOHWEEII4dZwawghhFvDrSGEEMKtIYQQwq3h1hBCCLeGW0MIIYRbw60h hBBuDbeGEEIIt4YQQgi3hltDCCHcGm4NIYQQbg0hhBBuDbeGEEK4NdwaQggh3Bp+rgghhFvD rSGEEMKtIYQQwq3h1hBCCLeGW0MIIYRbQwghhFvDrSGEEG4Nt4YQQgi3hhBCCLeGW0MIIYRb QwghhFvDrSGEEG4Nt4YQQgi3hhBCCLeGW0MIIdwabg0hhBBuDSGEEG4Nt4YQQgi3hhBCCLeG W0MIIdwabg0hhBBuDSGEEG4Nt4YQQrg13BpCCCHcGkIIIdwabg0hhBBuDSGEEG7N/K2xj80+ RvtY+TkjhJCleWsucm7NcYtuzU7fg1uz9Xhrdh6yZshThjxtyPFDThvy3PFjumD8GO3eEEII WZqxZ1Rrh5w75Mwhp4y35rAh+w3ZY9Gt2bzh1ti9sluz7fie6QlD9h/vm7ntYzhjyDlDzh/v jd1D+1gJIYQsrdjrt72O27Oqs4ecPuSkIccMOWTIk8Zbs+OQR8mt2fgh3hr7a6a3xnbZ/bI7 Zg67a+Y8esgzx+do9j7L7o29v7GPkRBCyNKMvY7bnbH3NPb8zL5e8vQhBw954pDdh+ww5JFD VjbfGrtfttsc5jpo/JqNvbexm2f3xt7f2PM0+/oNIYSQpRl772Cv5/Y1Ens/cez4LMu+Vr/3 kN2GrB7yiCFbNtwa+2tth90t22m7dx2/P8Ceo9l7G7t1dm/s47Hnafax2d0hhBCyNGOv4ycP OXG8M/a+wt7T2DMt+zqKfe1+uyGrhqwYslnDrbEdtmv6vWj2NRt7jmbvbezG2b2xj8Oep9nN se8XsPdbhBBCll7sNdy+v9luzFHj94E9dfyesH3GZ1v2tRr7uop9Ld++f2zT8Wv8lVtjO2zX 9Dna9uN7G7ttdm/s/Y09T7ObY++x7OOy20MIIWRpxl7H7XvO7MYcOH6f877j+4zpe5rp12rs 6yzTW/NQsFsz/V40e45mz+TsvY19P5p93cbujXnteZrdHHtvZXfHbp+93yGEELI0Y6/jdl/s e87sxtg/6/L48Z+xtPcb9r7D3tPYM6/p9zs/1Fsz/b7n6XM0u112w+z5nN0b89nzNLs59p7K 7o6917GPye4PIf/O3p2A615XZR/fqCggJk1yFAPUNDAtK3I2SYWsME3N1MrUzKEwjEzFCXBE cZ4nwmYrTVOzQW0ezQZLs8FmosnM0lJLo+d39t703eessxbvu9brdfle3/vqzzn3WXB/tpvT 81wbDuDj4/Op96zX8PWs1/P1ur5e39fr/Pp1yOvv2a/3mfV1x/r6Y/drmv/bv1cTfW2z3m/W X0tb7zfLWd76+zfLXl/nrI9jvfesr6/We5+Pj4+Pz6fes17D17Nez9fr+np9X6/z62uM9dfN 1tczu+8z631h92uaifea9Z61+36z9pez/v7Nes9Zvz5tve+sv0+0Ppb1/uPj4+Pj86n9rNfz 9bq+Xt/X6/x6vV+v++uvm02+z2TvN+uvz62vcZa5vs5Z/nrW+9161sfk4+Pj4/Op+ey+lq/X 9fUav76+WK/363V/vf6vv2623g/W+8LUew3fb/ies6zd9531Hrf7rI/Fx8fHx+dT+9l9TV+v 8etZr/fRe8zU+wzfbw58z9l9lu3j4+Pj8//ns/tav/v6v/t+MP0+c6j3nQOf3Y/Dx8fHx+dT /4le540xxhhjjDHGGGOMMcYYY4wxxhhjjDHGmE96brO1/Q/rrP8YwTH48fUf/1z/cs/dXLaT 9Qutt3PpCaefvJ7tf/H02lj/AZv1D5iuf9hnd3f9yw3Wj61fKLdrnLlva+uSI7eNmwXG+uPP 3HfJkWfue/PR7zx+Pev7lxy5/oMF/Fgv3jwX7Xysh9q5ePN7XHzSem53wsVb67lo/3/4YO0c +HGvj/HAz8dpm4/1rTsf66E+H6fte+uRp+3bd41bn7Cetx55RXanP8/R5/ZQu9uf27cd/e7j 13PJQR/v/8vd9R/zWz+W7a9/6d+B++sX9q+fB+vnw/p5kf05fNTmefwhPsbdX8i5621dtvVn W686uL/z+LyvHPgPm3Xsvy1s3rs2tyI769P2pYXNe9fmVmRnfdr+u8LmvWtzK7KzPm3/fWHz 3rW5tfo/JNbqvHdtbkV21qftfyxs3rs2tyI769P2PxU2712bW5Gd9Wn7/YXNe9fmVmRnfdr+ 58LmvWtzK7KzPm1/oLB579rciuysT9v/Uti8d21uRXbWp+0PFjbvXZtbkZ31aftfd/srY5v3 rs2tyM76tP1vhc171+bW6h9KrNV579rciuysT9sfLmzeuza3Ijvr0/a/FzbvXZtbkZ31afs/ Cpv3rs2tyM76tP2Rwua9a3MrsrM+bX+0sHnv2tyK7KxP2x8rbN67NrciO+vT9n8WNu9dm1uR nfVp+78Km/euza3VP55Yq/PetbkV2Vmftj9R2Lx3bW5Fdtan7f8ubN67NrciO+vT9mWFzXvX 5lZkZ33a3v9vkU1s3rs2tyI769P2YYXNe9fmVmRnfdq+0nZ/36Fs3rs2tyI769P2lQub967N rcjO+rR9lcLmvWtza/XDE2t13rs2tyI769P2VQub967NrcjO+rR9tcLmvWtzK7KzPm0fUdi8 d21uRXbWp+0jC5v3rs2tyM76tH1UYfPetbkV2Vmftq++218R27x3bW5Fdtan7aMLm/euza3I zvq0fY3C5r1rcyuysz5tf1ph8961ubX6NRNrdd67NrciO+vT9jGFzXvX5lZkZ33a/vTC5r1r cyuysz5tf0Zh8961uRXZWZ+2P7Owee/a3IrsrE/bn1XYvHdtbkV21qftzy5s3rs2tyI769P2 tQqb967NrcjO+rR9bGHz3rW5tfq+xFqd967NrcjO+rR97cLmvWtzK7KzPm1fp7B579rciuys T9vHFTbvXZtbkZ31afu6hc171+ZWZGd92v6cwua9a3MrsrM+bR9f2Lx3bW5Fdtan7RMKm/eu za3Izvq0fWJh8961uRXZWZ+2r1fYvHdtbq1+/cRanfeuza3Izvq0fYPC5r1rcyuysz5tf25h 8961ubWnv/xga09/+aD98u1+w0PZO533rs2tyM76tH2jwua9a3MrsrM+bX9eYfPetbkV2Vmf tk8qbN67NrciO+vT9smFzXvX5lZkZ33avnFh8961ubX65yfW6rx3bW5Fdtan7ZsUNu9dm1uR nfVp+6aFzXvX5lZkZ33a/oLC5r1rcyuysz5tf2Fh8961uRXZWZ+2b1bYvHdtbkV21qftLyps 3rs2tyI769P2Fxc2712bW5Gd9Wn7Swqb967NrcjO+rR9SmHz3rW5tfqXJtbqvHdtbkV21qft mxc2712bW5Gd9Wn7FoXNe9fmVmRnfdq+ZWHz3rW5FdlZn7ZvVdi8d21uRXbWp+1bFzbvXZtb kZ31afs2hc171+ZWZGd92r5tYfPetbkV2Vmftm9X2Lx3bW6t/mWJtTrvXZtb6H+69bKDLfT9 9yF7/9bqt4/tyzvvXZtbkZ31afvUwua9a3MrsrM+bX95YfPetbkV2Vmftu9Q2Lx3bW5Fdtan 7TsWNu9dm1uRnfVp+06FzXvX5lZkZ33aPq2wee/a3IrsrE/bpxc2712bW5Gd9Wn7Kwqb967N rdXvnFir8961uRXZWZ+2v7Kwee/a3IrsrE/bX1XYvHdtbkV21qftry5s3rs2tyI769P2GYXN e9fmVmRnfdq+S2Hz3rW5FdlZn7a/prB579rciuysT9t3LWzeuza3Ijvr0/bdCpv3rs2t1b82 sVbnvWtzK7KzPm3fvbB579rciuysT9v3KGzeuza3Ijvr0/Y9C5v3rs2tyM76tP11hc171+ZW ZGd92r5XYfPetbkV2Vmftr++sHnv2tyK7KxP2/fe7S+Nbd67NrciO+vT9n0Km/euza3Izvq0 fd/C5r1rc2v1b0is1Xnv2tyK7KxP299Y2Lx3bW5Fdtan7W8qbN67NrciO+vT9v0Km/euza3I zvq0/c2FzXvX5lZkZ33avn9h8961uRXZWZ+2H1DYvHdtbkV21qftBxY2712bW5Gd9Wn7Wwqb 967NrdUflFir8961uRXZWZ+2v7Wwee/a3IrsrE/bDy5s3rs2tyI769P2Qwqb967NrcjO+rT9 0MLmvWtzK7KzPm0/rLB579rciuysT9vfVti8d21uRXbWp+1vL2zeuza3Ijvr0/aZhc171+ZW ZGd92n54YfPetbm1+nck1uq8d21uRXbWp+2zCpv3rs2tyM76tP2Iwua9a3MrsrM+bX9nYfPe tbm1p7/kYGtPf8mg/ZLtfvah7J3Oe9fmVmRnfdr+rsLmvWtzK7KzPm0/srB579rciuysT9vf Xdi8d21uRXbWp+1HFTbvXZtbqz86sVbnvWtzK7KzPm0/prB579rciuysT9vnFDbvXZtbkZ31 afuxhc171+YW+p9EFvr++5C9f2v1x8X25Z33rs2tyM76tP34wua9a3MrsrM+bT+hsHnv2tyK 7KxP208sbN67NrciO+vT9rmFzXvX5lZkZ33aPq+wee/a3Fr9/MRanfeuza3Izvq0/aTC5r1r cyuysz5tP7mwee/a3IrsrE/bTyls3rs2tyI769P2Uwub967NrcjO+rT9tMLmvWtzK7KzPm0/ vbB579rciuysT9sXFDbvXZtbkZ31afsZhc171+bW6s9MrNV579rciuysT9sXFjbvXZtbe/qL D7b29BcP2i/e7s86lL3Tee/a3IrsrE/bzy5s3rs2tyI769P2cwqb967NrcjO+rT93MLmvWtz K7KzPm0/r7B579rciuysT9vPL2zeuza3Ijvr0/YLCpv3rs2tyM76tP3Cwua9a3Nr9Rcl1uq8 d21uRXbWp+0XFzbvXZtbkZ31afslhc171+ZWZGd92n5pYfPetbkV2Vmftl9W2Lx3bW5Fdtan 7ZcXNu9dm1uRnfVp+xWFzXvX5lZkZ33afmVh8961uRXZWZ+2X1XYvHdtbq1+UWKtznvX5lZk Z33a/p7C5r1rcyuysz5tX1zYvHdtbkV21qftVxc2712bW5Gd9Wn7ewub967NrcjO+rT9fYXN e9fmVmRnfdr+/sLmvWtzK7KzPm3/QGHz3rW5FdlZn7Z/cLe/KLZ579rciuysT9s/VNi8d21u rf7DibU6712bW5Gd9Wn7NYXNe9fmVmRnfdr+kcLmvWtzK7KzPm3/aGHz3rW5FdlZn7Z/rLB5 79rciuysT9uvLWzeuza3Ijvr0/brCpv3rs2tyM76tP3jhc171+ZWZGd92n59YfPetbm1+hsS a3Xeuza3Ijvr0/ZPFDbvXZtbkZ31afuNhc171+ZWZGd92n5TYfPetbkV2Vmftt9c2Lx3bW5F dtan7Z8sbN67NrciO+vT9lu2+x8fyua9a3MrsrM+bf9UYfPetbkV2Vmftn+6sHnv2txa/WcS a3Xeuza3Ijvr0/bPFjbvXZtbkZ31afuthc171+ZWZGd92n5bYfPetbkV2Vmftt9e2Lx3bW5F dtan7Z8rbN67NrciO+vT9s/v9hfGNu9dm1uRnfVp+xcKm/euza3Izvq0/YuFzXvX5lZkZ33a /qXC5r1rc2v1X06s1Xnv2tyK7KxP279S2Lx3bW5Fdtan7V8tbN67NrciO+vT9q8VNu9dm1uR nfVp+9cLm/euza3Izvq0/RuFzXvX5lZkZ33a/s3C5r1rcyuysz5tv6Owee/a3IrsrE/bv1XY vHdtbq3+zsRanfeuza3Izvq0/duFzXvX5lZkZ33a/p3C5r1rcyuysz5t/25h8961uRXZWZ+2 f6+wee/a3IrsrE/b7yps3rs2tyI769P27xc2712bW5Gd9Wn7Dwqb967NrcjO+rT97sLmvWtz K7KzPm2/p7B579rcWv0PE2t13rs2tyI769P2ewub967NrcjO+rT9R4XNe9fm1p7+goOtPf0F g/YLtvsfH8re6bx3bW5Fdtan7T8pbN67NrciO+vT9p8WNu9dm1uRnfVp+32FzXvX5lZkZ33a /rPC5r1rcyuysz5t/3lh8961ubX6XyTW6rx3bW5Fdtan7b8sbN67NrciO+vT9l8VNu9dm1uR nfVp+68Lm/euza3Izvq0/TeFzXvX5lZkZ33avqSwee/a3IrsrE/bf1vYvHdtbkV21qftSwub 967NrcjO+rT9d4XNe9fmVmRnfdr++8LmvWtza/V/SKzVee/a3IrsrE/b/1jYvHdtbkV21qft fyps3rs2tyI769P2+wub967NrcjO+rT9z4XNe9fmVmRnfdr+QGHz3rW5FdlZn7b/pbB579rc iuysT9sfLGzeuza3Ijvr0/a/FjbvXZtbq/9bYq3Oe9fmFvofbT3/YAt9/33I3r+1+odi+/LO e9fmVmRnfdr+cGHz3rW5FdlZn7b/vbB579rciuysT9v/Udi8d21uRXbWp+2PFDbvXZtbkZ31 afujhc171+ZWZGd92v5YYfPetbkV2Vmftv+zsHnv2tyK7KxP2/9V2Lx3bW6t/vHEWp33rs2t yM76tP2Jwua9a3MrsrM+bf93YfPetbkV2Vmfti8rbN67NrciO+vT9tbVc5v3rs2tyM76tH1Y YfPetbkV2Vmftq9U2Lx3bW5Fdtan7SsXNu9dm1uRnfVp+yqFzXvX5tbqhyfW6rx3bW5Fdtan 7asWNu9dm1uRnfVp+2qFzXvX5lZkZ33aPqKwee/a3IrsrE/bRxY2712bW5Gd9Wn7qMLmvWtz K7KzPm1fvbB579rciuysT9tH7/bnxTbvXZtbkZ31afsahc171+ZWZGd92v60wua9a3Nr9Wsm 1uq8d21uRXbWp+1jCpv3rs2tyM76tP3phc171+ZWZGd92v6Mwua9a3MrsrM+bX9mYfPetbkV 2Vmftj+rsHnv2tyK7KxP259d2Lx3bW5Fdtan7WsVNu9dm1uRnfVp+9jC5r1rc2v1fYm1Ou9d m1uRnfVp+9qFzXvX5lZkZ33avk5h8961uRXZWZ+2jyts3rs2tyI769P2dQub967NrcjO+rT9 OYXNe9fmVmRnfdo+vrB579rciuysT9snFDbvXZtbkZ31afvEwua9a3MrsrM+bV+vsHnv2txa /fqJtTrvXZtbkZ31afsGhc171+ZWZGd92v7cwua9a3MrsrM+bd+wsHnv2tza0597sLWnP3fQ fu52v9Gh7J3Oe9fmVmRnfdr+vMLmvWtzK7KzPm2fVNi8d21uRXbWp+2TC5v3rs2tyM76tH3j wua9a3Nr9c9PrNV579rciuysT9s3KWzeuza3Ijvr0/ZNC5v3rs2tyM76tP0Fhc171+YW+nsj C33/fcjev7X6F8b25Z33rs2tyM76tH2zwua9a3MrsrM+bX9RYfPetbkV2Vmftr+4sHnv2tyK 7KxP219S2Lx3bW5Fdtan7VMKm/euza3VvzSxVue9a3MrsrM+bd+8sHnv2tyK7KxP27cobN67 NrciO+vT9i0Lm/euza3Izvq0favC5r1rcyuysz5t37qwee/a3IrsrE/btyls3rs2tyI769P2 bQub967NrcjO+rR9u8LmvWtza/UvS6zVee/a3IrsrE/bty9s3rs2t/b05xxs7enPGbSfs91P PZS903nv2tyK7KxP219e2Lx3bW5Fdtan7TsUNu9dm1uRnfVp+46FzXvX5lZkZ33avlNh8961 uRXZWZ+2Tyts3rs2tyI769P26YXNe9fmVmRnfdr+isLmvWtza/U7J9bqvHdtbkV21qftryxs 3rs2tyI769P2VxU2712bW5Gd9Wn7qwub967NrcjO+rR9RmHz3rW5FdlZn7bvUti8d21uRXbW p+2vKWzeuza3Ijvr0/ZdC5v3rs2tyM76tH23wua9a3Nr9a9NrNV579rciuysT9t3L2zeuza3 Ijvr0/Y9Cpv3rs2tyM76tH3Pwua9a3MrsrM+bX/dbn92bPPetbkV2Vmftu9V2Lx3bW5Fdtan 7a8vbN67NrciO+vT9r0Lm/euza3Izvq0fZ/C5r1rcyuysz5t37ewee/a3Fr9GxJrdd67Nrci O+vT9jcWNu9dm1uRnfVp+5sKm/euza3Izvq0fb/C5r1rcyuysz5tf3Nh8961uRXZWZ+271/Y vHdtbkV21qftBxQ2712bW5Gd9Wn7gYXNe9fmVmRnfdr+lsLmvWtza/UHJdbqvHdtbkV21qft by1s3rs2tyI769P2g3f7s2Kb967NrcjO+rT9kMLmvWtzK7KzPm0/tLB579rciuysT9sPK2ze uza3Ijvr0/a3FTbvXZtbkZ31afvbC5v3rs2tyM76tH1mYfPetbm1+sMTa3Xeuza3Ijvr0/Z3 FDbvXZtbkZ31afuswua9a3MrsrM+bT+isHnv2tyK7KxP299Z2Lx3bW5Fdtan7bMLm/euza3I zvq0/V2FzXvX5lZkZ33afmRh8961uRXZWZ+2v7uwee/a3IrsrE/bjyps3rs2t1Z/dGKtznvX 5taefuHB1p5+4aB94XZ/zKHsnc571+ZWZGd92j6nsHnv2tyK7KxP248tbN67NrciO+vT9uMK m/euza3Izvq0/fjC5r1rcyuysz5tP6Gwee/a3IrsrE/bTyxs3rs2tyI769P2uYXNe9fm1urn JdbqvHdtbkV21qft8wub967NrcjO+rT9pMLmvWtzK7KzPm0/ubB579rciuysT9tPKWzeuza3 Ijvr0/ZTC5v3rs2tyM76tP20wua9a3MrsrM+bT+9sHnv2tyK7KxP2xds9z/cemZs8961uRXZ WZ+2n1HYvHdtbq3+zMRanfeuza3Izvq0fWFh8961uRXZWZ+2n1XYvHdtbkV21qftZxc2712b W5Gd9Wn7OYXNe9fmVmRnfdp+bmHz3rW5FdlZn7afV9i8d21uRXbWp+3nFzbvXZtbkZ31afsF hc171+bW6i9MrNV579rciuysT9svKmzeuza3Ijvr0/aLC5v3rs2tyM76tP2Swua9a3MrsrM+ bb+0sHnv2tyK7KxP2y8rbN67NrciO+vT9ssLm/euza09/RkHW3v6MwbtZ2z3VxzK3um8d21u RXbWp+1XFjbvXZtbkZ31aftVhc171+bW6hcl1uq8d21uRXbWp+3vKWzeuza3Ijvr0/bFhc17 1+ZWZGd92n51YfPetbkV2Vmftr+3sHnv2tyK7KxP299X2Lx3bW5Fdtan7e8vbN67NrciO+vT 9g8UNu9dm1uRnfVp+wcLm/euza3VfyixVue9a3MrsrM+bf9wYfPetbkV2Vmftl9T2Lx3bW5F dtan7R8pbN67NrciO+vT9o8WNu9dm1t7+gUHW3v6BYP2Bdv9xw5l73Teuza3Ijvr0/ZrC5v3 rs2tyM76tP26wua9a3MrsrM+bf94YfPetbkV2Vmftl9f2Lx3bW6t/obEWp33rs2tyM76tP0T hc171+ZWZGd92n5jYfPetbkV2Vmftt9U2Lx3bW5Fdtan7TcXNu9dm1uRnfVp+ycLm/euza3I zvq0/ZbC5r1rcyuysz5t/1Rh8961uRXZWZ+2f7qwee/a3Fr9ZxJrdd67NrciO+vT9s8WNu9d m1uRnfVp+62FzXvX5lZkZ33afttuf3ps8961uRXZWZ+2317YvHdtbkV21qftnyts3rs2tyI7 69P2zxc2712bW5Gd9Wn7Fwqb967NrcjO+rT9i4XNe9fmVmRnfdr+pcLmvWtza/VfTqzVee/a 3IrsrE/bv1LYvHdtbkV21qftXy1s3rs2tyI769P2rxU2712bW5Gd9Wn71wub967NrcjO+rT9 G4XNe9fmVmRnfdr+zcLmvWtzK7KzPm2/o7B579rciuysT9u/Vdi8d21urf7OxFqd967NrcjO +rT927v9abHNe9fmVmRnfdr+ncLmvWtzK7KzPm3/bmHz3rW5FdlZn7Z/r7B579rciuysT9vv Kmzeuza3Ijvr0/bvFzbvXZtbkZ31afsPCpv3rs2tyM76tP3uwua9a3MrsrM+bb+nsHnv2txa /Q8Ta3Xeuza3Ijvr0/Z7C5v3rs2tyM76tP1Hhc171+ZWZGd92v7jwua9a3MrsrM+bf9JYfPe tbkV2Vmftv+0sHnv2tyK7KxP2+8rbN67NrciO+vT9p8VNu9dm1uRnfVp+893+1Njm/euza3V /+IA+8CPhfeuza3Izvq0/ZeFzXvX5lZkZ33a/qvC5r1rcyuysz5t/3Vh8961uRXZWZ+2/6aw ee/a3IrsrE/blxQ2712bW5Gd9Wn7bwub967NrcjO+rR9aWHz3rW5FdlZn7b/rrB579rciuys T9t/X9i8d21urf4PibU6712bW5Gd9Wn7Hwub967NrcjO+rT9T4XNe9fmVmRnfdp+f2Hz3rW5 FdlZn7b/ubB579rciuysT9sfKGzeuza3Ijvr0/a/7PanxDbvXZtbkZ31afuDhc171+ZWZGd9 2v7Xwua9a3Nr9X9LrNV579rciuysT9sfKmzeuza3Ijvr0/aHC5v3rs2tyM76tP3vhc171+ZW ZGd92v6Pwua9a3MrsrM+bX+ksHnv2tyK7KxP2x8tbN67NrciO+vT9scKm/euza3Izvq0/Z+F zXvX5lZkZ33a/q/C5r1rc2v1jyfW6rx3bW5Fdtan7U8UNu9dm1uRnfVp+78Lm/euza3Izvq0 fVlh8961uRXZWZ+2t47Obd67NrfQ37P15IMt9P33IXv/1uqHxfblnfeuza3Izvq0faXC5r1r cyuysz5tX7mwee/a3IrsrE/bVyls3rs2t1Y/PLFW571rcyuysz5tX7Wwee/a3IrsrE/bVyts 3rs2tyI769P2EYXNe9fmVmRnfdo+srB579rciuysT9tHFTbvXZtbkZ31afvqhc171+ZWZGd9 2j66sHnv2tyK7KxP29cobN67NrciO+vT9qcVNu9dm1urXzOxVue9a3MrsrM+bR9T2Lx3bW5F dtan7U8vbN67Nrf29CcdbO3pTxq0n7TdP+NQ9k7nvWtzK7KzPm1/ZmHz3rW5FdlZn7Y/q7B5 79rciuysT9ufXdi8d21uRXbWp+1rFTbvXZtbkZ31afvYwua9a3Nr9X2JtTrvXZtbkZ31afva hc171+ZWZGd92r5OYfPetbkV2Vmfto8rbN67NrciO+vT9nULm/euza3Izvq0/TmFzXvX5lZk Z33aPr6wee/a3IrsrE/bJxQ2712bW5Gd9Wn7xMLmvWtza/XrJdbqvHdtbkV21qft6xc2712b W3v6+Qdbe/r5g/b52/0Gh7J3Ou9dm1uRnfVp+3MLm/euza3Izvq0fcPC5r1rcyuysz5t36iw ee/a3IrsrE/bn1fYvHdtbkV21qftkwqb967NrcjO+rR9cmHz3rW5FdlZn7ZvXNi8d21urf75 ibU6712bW5Gd9Wn7JoXNe9fmVmRnfdq+aWHz3rW5FdlZn7a/oLB579rciuysT9tfWNi8d21u RXbWp+2bFTbvXZtbkZ31afuLCpv3rs2tyM76tP3Fhc171+ZWZGd92v6Swua9a3Nr9VN2+3kH W6vz3rW5FdlZn7a/tLB579rciuysT9s3L2zeuza3Ijvr0/YtCpv3rs2tyM76tH3Lwua9a3Mr srM+bd+qsHnv2tyK7KxP27cubN67NrciO+vT9m0Km/euza3Izvq0fdvC5r1rcyuysz5t366w ee/a3Fr9yxJrdd67NrciO+vT9u0Lm/euza3Izvq0fWph8961uRXZWZ+2v7ywee/a3IrsrE/b dyhs3rs2tyI769P2HQub967NrcjO+rR9p8LmvWtza08/92BrTz930D53u592KHun8961uRXZ WZ+2Ty9s3rs2t1b/isRanfeuza3Izvq0fefC5r1rcyuysz5tf2Vh8961uRXZWZ+2v6qwee/a 3IrsrE/bX13YvHdtbkV21qftMwqb967NrcjO+rR9l8LmvWtzK7KzPm1/TWHz3rW5FdlZn7bv Wti8d21uRXbWp+27FTbvXZtbq39tYq3Oe9fmVmRnfdq+e2Hz3rW5FdlZn7bvUdi8d21uRXbW p+17FjbvXZtbkZ31afvrCpv3rs2tyM76tH2v3f7E2Oa9a3MrsrM+bX99YfPetbkV2Vmftu9d 2Lx3bW5Fdtan7fsUNu9dm1ur3zexVue9a3MrsrM+bX9DYfPetbkV2Vmftr+xsHnv2tyK7KxP 299U2Lx3bW5Fdtan7fsVNu9dm1uRnfVp+5sLm/euza3Izvq0ff/C5r1rcyuysz5tP6Cwee/a 3IrsrE/bDyxs3rs2tyI769P2txQ2712bW6s/KLFW571rcyuysz5tf2th8961uRXZWZ+2H1zY vHdtbkV21qfth+z2J8Q2712bW5Gd9Wn7oYXNe9fmVmRnfdp+WGHz3rW5FdlZn7a/rbB579rc iuysT9vfXti8d21uRXbWp+0zC5v3rs2t1R+eWKvz3rW5FdlZn7a/o7B579rciuysT9tnFTbv XZtbkZ31afsRhc171+ZWZGd92v7Owua9a3MrsrM+bZ9d2Lx3bW5Fdtan7e8qbN67NrciO+vT 9iMLm/euza3Izvq0/d2FzXvX5lZkZ33aflRh8961ubX6oxNrdd67NrciO+vT9mMKm/euzS30 d68/+EALff99yN6/tfo5sX15571rcyuysz5tP7awee/a3IrsrE/bjyts3rs2tyI769P24wub 967NrcjO+rT9hMLmvWtzK7KzPm0/sbB579rciuysT9vnFjbvXZtbq5+XWKvz3rW5FdlZn7bP L2zeuza3Ijvr0/aTCpv3rs2tyM76tP3kwua9a3MrsrM+bT+lsHnv2tyK7KxP208tbN67Nrci O+vT9tMKm/euza3Izvq0/fTC5r1rcyuysz5tX1DYvHdtbkV21qftZ+z2x8U2712bW6s/8wD7 wI+F967NrcjO+rR9YWHz3rW5FdlZn7afVdi8d21uRXbWp+1nFzbvXZtbkZ31afs5hc171+ZW ZGd92n5uYfPetbkV2Vmftp9X2Lx3bW5Fdtan7ecXNu9dm1uRnfVp+wWFzXvX5tbqL0ys1Xnv 2tyK7KxP2y8qbN67NrciO+vT9osLm/euza3Izvq0/ZLC5r1rcyuysz5tv7Swee/a3IrsrE/b Lyts3rs2tyI769P2ywub967NrcjO+rT9isLmvWtza09/7MHWnv7YQfux2/2Vh7J3Ou9dm1uR nfVp+1WFzXvX5tbqFyXW6rx3bW5Fdtan7e8pbN67NrciO+vT9sWFzXvX5lZkZ33afnVh8961 uRXZWZ+2v7ewee/a3IrsrE/b31fYvHdtbkV21qft7y9s3rs2tyI769P2DxQ2712bW5Gd9Wn7 Bwub967NrdV/KLFW571rcyuysz5t/3Bh8961uRXZWZ+2X1PYvHdtbkV21qftHyls3rs2tyI7 69P2jxY2712bW5Gd9Wn7xwqb967NrT39nIOtPf2cQfuc7f7aQ9k7nfeuza3Izvq0/brC5r1r cyuysz5t/3hh8961uRXZWZ+2X1/YvHdtbq3+hsRanfeuza3Izvq0/ROFzXvX5lZkZ33afmNh 8961uRXZWZ+231TYvHdtbkV21qftNxc274eyr7959v9um9xm8+0Rm+e4zXMMPp77bJ6bHOLj 286lJ5x+8nq2tm67s3HHnd3DN8+BuxdvnouK3Ys3v8fFW6ef8JqT1nNRuHvDne+v/z0HGuvz c8mR28bNAmP98Wfuu+TIdx6/njcffea+9Vxy5O12dna9UzfPZmrrvA3yidU3n7j7Hfa/9tU2 p0/W5+2szQdy7FH57ln7jj3qrH1PPfpdx6/n2KM+mbtnb55Xf/jwrWdtPlfX2HyOTtl8rs44 7H/373vVra0Hrz9ZW5etn3o7Oe/20fc37P5vz9w8p6zdVTbbH9/8kb+w+e5Jm2f3+4dtnbj/ 5/O6H5zLdv/PGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG GGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wx xhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM McYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhj jDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY Y4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG GGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wx xhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM McYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhj jDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY Y4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG GGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wx xhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM McYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhj jDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYY Y4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG GGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wx xhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHm/zi32TxHbJ7jNs8x+PH7bJ6b oF+2k6tc/iOXnnD6yevZ2rrtzsYdN8/Rm+fwYPesfVtbxx6V756179ijztr31KPfdfx6jj0q 2r3Wzvc3c1sn7Xz/sM1z983ziMO2v//Izd6dYLztSvu/OexqJ25d/45bD9g6c+thWw/cOnvz 2xO3ztj89iFbD9165BX+jF15/29vdtyNz9+62lW2rnzE9mfkzqvf4sqHnbr5/qmb7z/0xM1H srld8I5P/Pz6mB6z+Xbf5rnmcfsOW3/s+rGTNv2Ms+95pTd87Jjz18YtN/3aR7/+8Pufcsz5 zzv30efcedPvctc3Hr42br112O3vvfl2a+sNl/fXbL597RFv2d8/+LxHnLc2nnzD7Y/y5ld9 y/p0XZ7lrd2trfees76/P2957zlv+Mja3Nr6xd993eG/sdl59DvedPj68ct/H+Sjm/uDHrX/ T8nWYnY/9/fced6z+Txfc/MDf775dv3PX7fr3fvkUy+878mn3nTzE+GNR23/2BkH7O7+HLjb 5vv32Dz3wv41trbOi6z37ViXBtbDr6B1h/U5uQLWJTvWBwLr7VfQWj+HD7T4czly37/jfjBw r3HdK+YeuXludID7yfr/+Ys3z0XF7sWb3+PirdNPeM1J67ko3K0+T2/efH5usPmBt2++PeWA z9OHrr21dfbV68/T2rkiP+/eumP9SmDd6jpXzDrtClq/vGP9dmD9D3tnG6tZdd3355qYuXeu hxmGFAIGLgbXHuLYTPyGwaUecJgJOMQYgmPsJnHtJpWiiVQbKcqHfBjUahrnQ5U2cpU6mV4q otiu4g9VVct8i1pAMAgEjKC8CMKLsFCF1NZ1Ult1Nd2/e/cqmz3nuffce59znrffXyyeO/fl 7L3Xf+211lln732OtWwLv9jGxh/Jbf3XhrYeb9nWLUnuatHWM7kt5nDd1k3vbNfWTQ12PcxP 0BZ+om4LP9GmrV9uqUPaoC3ma93Woy3bur5lW/gi2vrfDW1dcvFobf5vcls/bmjryy3bassX bdDWWWed2dbxlm215Ys2aOuchra+37KtI0l+e4t+/R253X0N7X7yknbtjtOvd5HLNenpG8kW rk7fuDd9/mKlpx+nP/rgO0aXT/y73Na/b2jrmgvbtdV2Pn0rt/WXDW0da9lW2/lEG7T13Ya2 7m3ZVtsYQhymre81tEUcbtNWk103tUUbtPWfG9o6/6J2bbX1tX+V2zrZ0NZvtWzrjpZt0QZt nWpo67+0bKutHT6R23q+oa3d72zX1i+2HBdt0Ba59Bk6bNlW27zpldwW+XPd1ndattU2htAG bREjz9DhxaPl63/ltoj5dVu3tmyrrd+gDdpaOOvMtn63ZVtN9zxNbZ3ObS01tPVgy7bazuXF s9bbOrehrfMvGS1fe3Nb5zW09Wst22rLF23Q1qUNbf3Tlm19uiGXaWrrktzWexvaeqllW03z axZrUb+ZrlfqobNa1K/+1OCszxW1qH9e1aLSz6gf0SfqSq8//NZa1I8efmstarGqRVG7ohbF Na4dLPwOtStqUfFv6lvUovh31KL4+z/6T8ePta1FHStqUX+ySS2KWtVGtShs86PpG+9rsNFD l24/F+nLRkd93fMKHUUbP0w/OLl/vQ3+tm6Dv/vh4sn9v794w3nfW5Nzzz+4hNxw3tEk/Oy6 DWo+BxuuSZ/Waj4HkOtWVgfIiUFcpx4D/VU37XVzJP3j3tzvYbo5snjv/iOLv3f+Xy8h9+5X 55Oh869SG/vEwuDF9Pk/0zfenuSOFC8+nX7xz9P1/1n698NrLv904RKPfaLp69Ts2ufRJB9O cg/PF9K1P58+X83xKr5eSLGHy/LzM3E6/hNCCCGEmGWQCNXCnfsopamNedJr6IHUEyFN7lKi nSb9z6KOQ7eMnducs5PsyrcdIZQ4RiFxPa6P0BZtht5Lfc+Kjmv9Mm50sTvJ8nq5aE3OybJ3 hxLXievSBm3RJm036XsW9Bw6xqawsdAtOjk3lxJ+OsnfySXZUQjX4ppcmzZoizbRN32gL/Rp FvQctlzqmJIEY96fdUGJ+6IkF1P+T3JpkpUdCtfgWlyTa9MGbdEmbcPzLOk6bJl5GnbMOLGz C7MuLktyRS45vzeXaa7coXANrsU1uTZtoHP0TdulrukbfZxmPYct4xNLHWNjjB09oJf3J7kq yQeTfCiXyXYiXINrcU3KgLTx7mzr8IsvoS/4kNKmp1nPYcv4RuYtNsV4eWyCDtDHR5NcO1gv pf79JNQodyJcg2tdk6/987kt2qRt+oDPxoeFTU+rnsNnYC/YDfaDj2T+YluMG7tDv+iGcvLh wfqyDB4d70S4BksuWCaNztE3bdEmfoTyN/OKnIQcJPQ8jb6j1DM+Y1+SC7I94T+xMcZ/KOv3 5sH6I+xbk3xmh8I1WDrLNdE3bdAWbdI2faAv9Cl8x7T66NAzvpn5ic/AN16e7Yr5jK2hYx7N oh8e5/5qks/tULgG10Lfn8q6pq2PJHlfknflvuA7sIFp1zPxJXwzsYf5is/4QLYv5jU2hz5Y nsbjq3+Q5Nd2KFyDa3FNro0vYXnOx3Lb+A5icTwCxBZmRc/4Q3wzsYj5y6NC7Iz5je2hF3T0 xST/MMmXtin8LdfgWlyTZa7MF7Y9EQsO5jwHztEzfZsVPRNv0DP5MnktOQaPa1mKzRImlmZh g+jny0n+0Q4FfXOtL+Rr4/fxT+QgcAzXcE6f0DN9nBU9k2uUesZfkhcwr/Gn2B+2iJ5+c4fC NbgW3HFtuIRTuA090xf1PBj81jZFPatn9aye1bN6Vs/qWT2rZ/WsntWzelbP6lk9q2f1rJ7V s3pWz+pZPatn9aye1bN6Vs/qWT2rZ/WsntWzelbP6lk9q2f1rJ7Vs3pWz+pZPatn9aye1bN6 Vs/qWT2rZ/WsntWzelbP6lk9q2f1rJ7Vs3pWz+pZPatn9aye1bN6Vs/qWT2rZ/WsntWzelbP 6lk9q2f1rJ7Vs3pWz+pZPatn9aye1bN6Vs/qWT2rZ/WsntWzelbP6lk9q2f1rJ7Vs3pWz+pZ Patn9aye1bN6Vs/qWT2rZ/WsntWzelbP6lk9q2f1rJ7Vs3pWz+pZPatn9aye1bN6Vs/qWT2r Z/WsntWzelbP6lk9q2f1rJ7Vs3pWz+pZPatn9aye1bN6Vs/qWT2rZ/WsntWzelbP6lk9q2f1 rJ7Vs3pWz+pZPatn9aye1bN6Vs/qWT2rZ/WsntWzelbP6lk9q+dp1zPXbKtn+jrpeqZ/tbwt yduTLCXZm+T8JJcmOZDkQ5WeP9exnmkj9AzHcI2e4R4boI/0lT43jWXcOqVfIcy7Uuj3riTL Sc5N8jNJLktyZZIPJ/lEkpuSfKYnPcMp3MIxfVhJckGSfbmP9BWbrsdRjrEP3de6pQ/0C30i Z2ehvwhzkf5jy8zPdya5IsnPJflokuuT3JzktqznX+9Iz1wbLuH0UJKPJHlfksuTXJT7Rh/p K32O/sd4YnzBQa3zrnRc6jf0ybzbnfv6jizMR2yFcVyY7Qe/eFWSa5J8MskvJbk9yZ1Zz18a sZ65JteGy08luSHJx5J8IPcFP8Y8Oy/3FV9N3xkHwpgYW+i/1ncXei51DM+0TT9Cp9gEfd2f Bf0yL7EZdPzubEfM27+X5MYktyT5lSSfT/IbI9Yz10LPXJs2aIs2P5599M/mPqFr+kj8oM/0 HT/HWBgTY2OMjJUxM/audB16LnUM3/BPf7AHYgp6xT7oN36CMbwr2w46JtZjT8xf5jF+87NJ vjBCPSOhZ67JtWmDnAMfTdv04WDW9d/NfaSv9Jm+MwbGwpjQe9h6+JbQ9Sj1HD6jjG1wS7vw Tl/oV+iVWIfvw1aI64yFeYoNMT5iEXYVPgP/SZ77xSRfHoGOQ89ci2tybdrAd9DmL+S84+rc p/fnuIgt0Gf6zhhC74wNO2esjJmxhw8ZZc5d+oywZeYRHKNjfC99on/0lT5ju+gWm8FPMCbm KzkGOsZXhi0zryMGjkrPXINrhY+mjTtym8RedE1frs0xmT7SV3RO38k9sXPGxNgYI7pmzIwd HYSeR2XTtc+AT3wWvgKuyUPJI+gb/cQ3kLehW8aB7TBXGRs5LDbFeBk3MYqcALsblc+ofTS+ A5umrdA1PNMXYjF9o4/0lT7Td3ROXsSYGBtjZKz4EGya2Igu+tBz5BHMMeyYfjEPS9slvmO/ +EXG9st5/oaOGT96CFsetZ7Dpmtdk+fRF/pE3+gjfcWn0XdsHHthTNg1cZyxYluMHR10pefw G3AZ9kzMQM/4YfwEtoBdhP0yBuyXGMTYiPvcNzCPSx1jd13pmWszX0pd0wf6Uuu79CeMhfnJ 2Bhj6LnJnkeZb0QcpA3aYg4xlyIvRs/cA5CzYRuljyDe4YsZI/EfX9GVjofpOuyatukDsZE+ 0bfSl3D/hE2Hnss8mzHX/rmrvC7upYkJ5Jz4LuI0c4y+0Uf0jH2Qs+InQsfYE3EJ+2rS8aj1 3KRr2qYPYdv0jT7S19Az9kxsJCYytovzWOt79K7z59p3kH8SM4gf5G7MvcOFnsNXlHYc+u1C x8N0Xfpr+kKfQs/MPfpM34kx3LfWPiNqTqP2zcN8R9ynhE3Dd3m/h00Ty8mhIrcIPUdu0ZUd b6brsGn6EnGR+MF9E/OQvoctk2swNvLXrm15ozw6/DT3TvgwYjM+DT9NrkRcwe+FTeMXy1y5 Lz3HvClz6rhPJBbSR/pKbMH3RZ6BT2Rs3KN0lTe3zT3KmIiuIyaSG5X3fqWum3K5PvxGqWP6 UuoYu8A+sBN0zFhCx13lzLOg6810HDW8SdRxW12Xud44dD0LOp50Xc+SjidV17Oo441y63Ho uknHUX9uo+Ou60SzoOt50PG4dd1Wx7Q17Toel67b6Jhrz5KO+9b1POt4lLoe9gyglHnWcde6 LqWNjrl2Ux15FnTcpa5Dytr9Rjqu18TMmo5Hoety3QH6jOcDZb2+ScdcY550vBNdU3OvY2M8 JyifP22mY649Dzoela7L54s8M4hnTtQ21fH2dc2zo/Ahsa4GP8LzD6R8ftrkj+dVx1vRNc/l eD6H3uK5DM+VsFvWASB8zbNeno9F7qaOt6frcq0Cz6GxW3wJgu4P5ed5kR+r4+37EPTHc1Ge o6NvfEmsG+J7rIGK53nzkleMQtc8uy+fgfEcnTWn+BF0ynNShK+x93Idc5OOu3w2PSu6pu7O M+d6LSoSa2lZO8Kzf35XHW/Ph/Bsg/UhrMVB35dlvSJ8zfdYw8L6ivo5iDpur+tYZ81aIPSN X0CvCF/Henv2N/C76nh7ui73Z6BLbDb2v6B/vhdr7LvazzDrui73acSeo3I/V+yHKvdCzXte sRNdxx66cm9iucev671m86DrUt+h81K63jc5j/qu9+NOwh5sIYQQQgghRAfgoQQFAg5A2Fd8 n4fJPKQInM7gJmwd3185fCWy/pCDa/CgjsIDN8JxXQptfI8biWjjh+kHJ/evt8Hf1m3wdz9c PLn/9xdvOO97a3Lu+QeXkBvOO5qEn/FAsOz3apITud8HG65Jn1bTb6weQK5bWR0gJ9YeLHKd egz0t9bNkfSPe3O/h+nmyOK9+48s/t75f72E3Lu/zXVHrfMmnQy77ppOBodXvnUAOdF4XTaG 8jU33zxMpFDK1+ALf/rU2icPs+J3gnNuJus+fS/949zzN+YevuEd/uEazuEeG+BnNWc8XKNP ryT5m6Tg/5M+b3nbm31KOBZjoE8sSuFBHF/zCeJzcPlC/M3g+q/82VvmSlyvr3EdyuNCw6+n cS0m+Xwxrl1pXJNnSzeufPMA0mxLXV+3yd/8ZPdgcNeejbn5ye679nx299f3/MHu7+45tnRk 72tLX9v7xu4f7bl0+cJz+Nk4/I26Ga6b25YGg8O538N0c9vS4T23Lf3t3j9cRg7vUefqfF51 /lWu9/GFwY/T55fTNz6Y5JtJ7kzXvyVd/z0prnxj7QSV00XN9xhnKZzxdWp27fPoYH3BxT1J /sm1C4O70ycRk1gbXy8MLlvLCfj5mTgd/wkhhBBCCCGEEJOKSXlfheif8/KdGbFesek9GmI2 uS/XpsZ7Per3e5TrgLWF2eC/ftdH+T6VkFhvH2vCXQ8+W3O/fs9L7HNhz1xIvKsDeyjfQ6Md TP/cL9+NwuOV2N/EYyfeecAeMj75N9/HHrp8b4vo3++X7yRjT1u8t4XHduyFZb8mn+znZF9s vK+qy7P0Rfc537D3IsE9nLNflz3nLNFhb3T5zhtsIc5HL+1AXzC9c595zfxmrsd7xjh3gDMg OJcA4SwC9svHXnl8RJ/n5Itu5368x4+5DvcHB2++R4r3JiLxfiZsgeUR2EG8M7J+J4U2MLlz H57KuR/vEcPHw2u8ewnOWebDWTu8KwM5NFhf8sOZR9gIv39Zjh1xboYxYfrmPhwy9+P9ksx1 uIdzzlfiXCvOCuMdL/FuK5Ysxztq4nzBpnf1agfTN/fjvWtwH++040w+zuxDeIdOnB0X5/OR L8T7oMp3YxsTxl/r2crcj/eesvSSeV++z5DzL1nGyXmk8Y7BeE8pcYEzw8gfyA0iJnifMDlz P2o9Te8PjfP1WL5LzI9zOm8drL/fEM7jXFSE82jj3WXYAbGBeIHvIDdgm40xYTLnPudGcQ/H 3C/faxpzP86yZO5zVmj97rwvDs48fxg7wFbi/dB1TPA+YTLnPmfgkcOVc79+V3CcPx3vp4x3 +pXvRI333pfvYyeHNCaMl3/mfnlGXxn3tzP3h52rH3ZQvsOcHJGYwL2kMaF/G2g65zVqfZHz D5v7xPTyHdb13G96h0X4gzj3n5jAvQIxgb03G8UEnyd04wNK/8/8j/NQ8f345TLnZ+6Tx7Wd +/V7eZrej1bHhM3uE/QFo/cB9XupmXvwzz0fvh//HPf7W537G70ftikmxH1CHRPKd0j7jHl0 NlC/Az7el43/j/kPF+H7mafbmfvD3s+1lZjAPYkxoRsbYE5xD8g9QLybnvyP+E8dFy7gP3x/ 3O9vde4P8wXGhPHaQBkHyAO4B+QegPs/YgD5X/1u8WHv0tru+1PbxoR4nhAxAbs1JozeBphn zDfmHXV/7tfJAfABzE/8/yjfLb+VmMB9KTmKMaF7P1DaAPcBxAH4gJd4T2T4/1G8F3wrMQH/ hJ+K918YE0abD+BfuSdk/UfEAnQPB/gB7gPwA7UN7PS98MNiAnGnfJ5ATCifMRsTRn9fgG+l Lhg5ITEYvfMMMPIB5if3AnUsGJUN1O/lxO7wQfgiY0K39QH8KX4V/xr3htQGqAtuFA92mg9s ZAfYGjbHvUj5jBn/VMYEYlg+Sk5fMML7Q3wttZnwBfji8AXk7fAT94Wj8gVtYgJ1CuqVdUyg 3xET3K+0PV+AHy19QXl/QC4W9wfkaBvdH/QRE/BL+KcyJlDbivdKGRN25gvKvIB6MfU56nTU iqgVc6926wTEBOoWxoRu8oLyuUHcIxATqBmzzqfMD8uYMEpfsJ2YQB5rTBhtTIjnx+Wzg63U jMYRE+irMaG7mMC60XjfNDGBdSOTHBNcb9JNTGAdySTHBOyUmIDdNsUEsf2YUD5PpmZQx4So H/YRE2iDtmiTtsuYQN/oYxkT3Mc8uppBm5gQzxO7qhlgB/iCjWJC7FkzJow+JsT6smExIdYV 9BETsLMyJmCHEROwT2NCvzEBPzwJMYE+tIkJ+oLRxATmWMQE5h5zMGJCucakj5iA74mYgE8i JuCj8FX4LGNCNzEh1hpFTEDv6B8exhUTsL+ICeQqm8UEbWDrvmCjmBDPFiclJnDPQpwyJowO 5R6ENjGBPG0cMSH2KuGTyFfLmEA+a0zoNiaU608jJsR6k75iQuxfxQ65by1jQpxpYEzoLiZQ sy/Xm4wrJvAMw5gwnpgQ+xEiJlDHLWMCvmBSYgL1b2NCNzGh3pNQx4QufEEdE8ozDTaKCZ5p MJqYUO9P4/ltHRN4zktMiGeLfcYE1jyVMYHn3xETPPts575gsz1qkxoTWA9jTBh9TIj96pMa E+KcG2KCZ591HxNY3zkNMcFzbkbrC5rWpY8zJsR6k2Ex4WCOCZ5z019MiP1qsS593DHBs8+6 jQnoEp2WMQGdxxkGw2JCV2sQ65jg2Wf9xAR8ax0TYq/SOGKCZ5/1awflXqUyJjDvmmJCV3Vk zz6brJiAjsuYAAddnmfgOTeTGRPq/avEhFiXPo6Y4Nln/caEev/qJMcEzzToLiaU+1cnNSaQ txgTRh8TynMvJy0m1Ofc0C/PuRlvTOhyvUnEhHL/qmefTVZMoI43STGBe1rPPhttHbncv7rZ OTd9xoQ2Z5+VaxC1g+3ZQZtzbvqKCZ59Nr6YUJ5pUMeESTvnxrPP+osJcc4NMWGjMw08+2z2 YkKcczPsbGTPPpufmFCefVaeaeDZZ/MbEzz7bH5jwkbn3IwrJtTn3Hj2WXcxoe05N33EBHyB Z5+NJyZsds5NnzGhPufGs8/6iwmefTbfMaHt2Wd9n2ng2WeTFxM8+2x+Y8KknX3mmQb9xATP PjMmNJ19Ns5zbjY6+8xzbkbnCzz7bL7h2WdiGs4+a3vOjTGhm5jQdKaBZ5/NX0zw7DNjAjFh 0s8+85yb0ceEaTznZidnn/HzzWSefME8nX0W/PLzGHsp8f34+3mwhVk5+6zpnJuSx5J7fsZ4 EfwGwt/wyfdKe5gnO2gTEzY752YSzj6rnzGX8zq4h2/snd9DGDPC13y/tIV5yTHbnn3G3qBp OvssuAxhbME5v4PPw2ZC+B4/42/nca/TrJx9FrUj+Ix5HXMe22ZcxAxshfHhOxC+5u+wBX4v bGjenlFv5eyzpjMNxn32Wdwn0Gf4hG9sAYFbvgff/Bwfh30TQ/jk33wf24h1rPNYc5jGs8/q 2hE+CzvAH8T8RshvGAec4y8YD/cUCF/zPWyB3yv9yDzWHzc702ASzz6L+wTsk9yAfsJpzHEE u+B+l58RN7BnfpdP/h1/g51gM/Neg562s89i3RF9wg7wB8QueMUvIPwbvrFh+k+tESGXII7w LAqfgN3gC8r9z/NqA9N09lmsRSU3wA7oGzzDNwLH/Bv7IK/lnpLf434Xn8b3+T3yiaY98PO6 bnGazj4jJyE3wA7wB9hm8AvnfMI536fWha0gfE0NlJ9jI/W9xbzbwEYxYZLOPot1R9wvYgfE BWoY2AL2icA3feT75JDYCp/kEfw87i/LNcz6geaYMIlnn8X+BOwAf4A/4hkj9Uz8E4JdYKP0 L4R/YwvYRr0+JWJBeTbSPGOSzz4r7YD2uEflWQa2gE9i/QnC1/iJEP5NDoGd4AtiL0OcnVmu TWHcPotud87NOM8+CzugPXwCtoBfKIX+IHyNr8I26GusXWYMsd85zkijRuR6hOY68rCzz8Zx zk3pD7A32iMOYQ/4Bj5D+Dd9wk/hC2JdCvbLGjX8WrmHAZt3L9OZdjBJZ5/VdhA+AVuohT5E zIizcOLMTO4VuTeMtQixVnXe88HtxoS+z7kJOwhbCHuopb6PiPOQsFnuH/Fl5T2BucDWY0Lb s8+6WJde20ItdU0h9rDgr6gR0OfynoB8MJ4XaQObx4Ty7DPqbH2ffTbMHmrbCBuI546xp5H7 Wu4JzAd3HhPGefZZ23pCPGeIZ47cEzTlg7FvxVxg+zFhHOfcbGYDcS5enKXPPUGdD8ZZaNYH dxYTxnX22UY2EGuUY1+z+WB3MWHc59xsZgMb5YNlfdB8cGcxoT7npl6X3uWzxSbZKB+kRlzX B6M2ZD64s5hQrkuPOnKTL+g6LxiWD8Y5eHU+SE5jPjja/PCynG/FeuTyXIume4S+8sGm+qD5 YDd5QexXK+tG5T6lMh50ZQNlPhhrEM0H+7UB8q1yLXKcfVfvS+jaBiIfpGZFboJNxnmokQ9a G9oe98NiwbD16FEr6MMG6nwwzjyjH2U+GPvUzAe3lwfEHj74J5/CnzKnyrXobfasdlE3HpYP kp8OywfNBbbOPzor+Y/3sIcPoEYQ60vK/ap1ragrG4h8MM68Ix+M8y/jPBPzwe3fB8T9ID40 5n/wT5xlrS665p6grBn3UScalg9yb0J/qGXH+zLiWaH54Pbm/0b8s6aE3Iv4G+uOuzzbqskG yufFdT5Yrh80H9y6D4h7gHhOQD2AOYVeibPkAOSBxF5iAPqPs7DDB3RpA035IH6ozAd5rkHe Uq4d0wba+4BYT0YuxX0g8wmdkgNSD+A5AXGXeUceRixmLpKbNdlAF+9MiXww9iNFPsj+E9Y5 UMOKMwvMB3fmA4bFAPRN/OVegPpc2AC+GW6I1dhBrDsu1/7U60BGmQ/SP/LB8n2K5oNbrwnH WSXkUzxvYU5Rc+M+gHnGvSA1eWwAH0wugD8mNws7wB9gC/iEsIfSJrZrF23zwXLtmPlg+1pg WQuKeiA2wH122AD3AvgB7geJBcw/fAE84JN5dgcv+GjsgXgNV8zZsInSLmJd6GZ2Ua85j3ww 9iebD3bjB6IexH02sYB8kHyAmgC+ADvgvpA5yHNDfELs/SE+4BvCJvDZ2EXsC6jtAptoYxd1 bajMB8lTiFfmg6PLB9AhMZU5RTzAx2IHzDX8ATrHFojD5AfYA+s3uFcIm2COYhfEbPwEnMXe oO3YRbxDsX4fAvZoPjja+4KoDcS9IXaAP6AGT1zAFogNxN/Y8x/7v8MmmJv46NgXWtpF7BNs souIIbVdhPC98pwK7C7es14/K8Se3VvazgaafEHkBdgBOuUegVwLW8DfEnfReXn+B7GC3Jw5 iZ8gRsPPMLvgnq60C2JI5BVhF2VuEXsOyz1l5Xuy3Fs6Ol9Q2gG6xK+GLeAXiLfomjmHTZRn AXFvFueDhK8Iu4CrNnZBnlnmFuEvYu8xP+P34oyS+kxLc4Gd+YLyzM/y3EdsIc7/wx6Ya2ET cTZUnAtGTA5fUdsF+UTYBTGktos4T6LMLcJfIHzN9/kdfj/OrGp6p7a5wM7tIHxCnAWJPcR5 kGET6DvOhOSevPQVm9kFeQW13bCLyC3CLspzRvAXCF/zPWwG/vk74hE+YNj7L8T2bKG0hyab KM8ILc+Hrc8KjXMj6xhS20XkFqVdlOdMYRch/DvOnMK/kKuGD6Dt8pxz48DobaLpfPAmXzHM Lpin9XmidW4Bp9QkarsIIabAPT/HhvhbbCzOto76sLnAZNsFMWSYXeDTa7uAa2wD4Wu+hy/h 94J/bC3OJPb9N+PNJ2q7KN8lMMwuIreoc87SX2AbSJxTCvfYTpw/Wp9JLf+T6Sva2kWZc5b5 RXkeOd/nd7Chkn99wOzaBVyHxLnl/Izfi/eVzNP7KebJLuC3vB8ppX5XzTy9p2Ze7aLMPev3 Vcn9/NjFPL+zTgghhBBCCCFEz2CBJEVIHkztS7Ka5MRgfVEbDy8DpzMoWqym31gd3LjyzQPI ibWFDlyDRS8UOCloxXVjATw3ttHGT3YPBnftWW+Dv63b4O9+svuuPZ/d/fU9f7D7u3uOLR3Z +9rS1/a+sftHey5dvvAcfsbCi2H9PthwTfq01u8DyHUrqwPkxNoCDq5Tj4H+1rq5bWkwOJz7 PUw3ty0d3nPb0t/u/cNl5PCeNtcNbHTddXx/5fCVyJn9LXW+dS4Pr3zrANLMJQ+4+ZpCVfBJ sapu71jSz5G9G/MKl3AKt/AIn/AKv/ys5oNFVDw4+79J/nFS3pVJ/u3Cm33ikizUiT6xIJvF F3zNJ4jPweULaw9owPVf+bO3zIO4Xl/jOpTH9d/hJ43n6iR/WYxrV7rk5NlJuznfpy9ZSD+4 eXm9DRZp1m3woGVh8eblO3f9YPk7a/LsOXcmWVi8e++3F5895441+cHyt5Pwe+PwK+qpnZ6u SpPiijyGYXq6atcVy1ften3vBUvIFcvqX/2r/7de96tJXn9pYfBXg/V4+j/S51+kzw+l6783 Xf9U+vo/rgWT08XziGOsaT3j69Ts2ufRwfoiyHvQb7r276TPixbWF9HG1wuDy9ZyCH5+Jk7H f0IIIYQQQggxbXA913TwU+8BqddiyuPk8NW0f6uUpvW0Yrx8lXv2yz25SPy7aQ28GA9fTecr xD5IJPaw8DP3Lk0GX/AAH7Evcd/gzT2JCF/zPX4Gd7HvSN7Gxxf7v+JsM/aElmcPxJ5R9pLy M7iL/eLyNj6+4nzy8gyycq93uc8b7sp93vLWP19xjmycHwlH5bku5fkM/AzuWJYBx/I2Pr7K c3/hqDx7B+Hrg5lHlszALRzL2/j4wvcxtzjvhjPVOB8pzlLjeTGPujmTEe6Ye3ALx/I2Xr6Y R3G2fpyjyxIJhK8504plBMw7uJW38fEV70JgSSNzKs5Aj3NtkfIMwvIMOnkbL1/4wXh3CedG xlmiCGeHcn4k50vCKdzK2/j5wgcynzjfkzNe4yx5zgLma74Hl3Aqb5PDF/Mp3g1UnvnP13DH z+BU3iaHr3inY7zHp+mcdXmbTL7K9ySEyNvk8xXvOIl3WsjbdPBVSlvevH8bH1/1O6Ta8sb9 m7yNly95m06+5G06+ZK36eRL3qaTL3mbTr7kbTr52glvvLdqVnmbdL7kbed88fyrb77kbTr5 mnfeppWveeVt2vmaN962sj5qkvmaF95mja9Z521W+ZpV3madr1njbV74GgVvk7A/YBR8MdZp 4WvaeRu2/6sNX4wp1h/GerZp4asNb7HuNdYrb8ZbH/sW6/3LtMmeSfbgxf4v+kbtO/Y70HfG wFgYE2tDWSP6xWqONa27mTSeynVcJWeMBT/PemXWmrPOnD0D7A9gTw57ddiPwz4q9r+xtzHe T1q+n7gL3rge16YN9iSzf3nfYH3vJO/T5Z3b7P9izxDHYbI/5aYkn84+kTkGZxHHGGusHY11 iE38TcKcKnlCYq0rY2AswRl2iT/Br1Dv5v3y7K3ivePsf2PfIu+w592zxJPyveKj5qw80yHm WOyJZY7Ve4pYd3ZjtrdbM2eMh1gGb/gSxhlrtGv+au7G7QObeKLvjCH2BTA25hmcYaexF4e5 Fj7yPdkfsde06V3go+StjmPYB3MMe8FusB/2wGJP7M8jjsEZ/cbm8BeMJfarMOcYI7YZcy98 ZsS5cca6kq+SK/pY7t1gDNgiY2JsjJGxkovgY2L/FLGd/afU7tjrzd5ucgDmWlfv727yi/hk fHP4ReZ+cBZ798g/4I2YBnfYH/OO+FZzWPrNmHPjmGtNfJX+j77GHqngiDExNrhirIw59ioy z/A9cIZdh38kpmD3XfnHjTgjrsIZ/cE34geIZ/hH+oytMecYAxxifyWPjLfcg1TyNo65Niwv LH0ffYYffD9jIXYxNsbIWLFXYhm2SzwjDyE3Y57VnKFLdDrq96QHZ3HeTXBGu7TPfC/3oNNH /AH9hT/2xWJvjAEuGU/soYVDxo+9opPgLXLLcXAWcyzmF3zhE2LvIRyV3DAmxsYYGStjxt8w v8o9+MQzYj++kbgS86xLzmKe0U55zgP+Ed7oE7YEd9gVfYVDfCbyocwnY4FPxsiYh90TxFzr k7NyjtGHyOGZW8wruCJeww28xNkIjC3GyZgZO3kHukAn5PrwhY3X512Ebxw1Z033Zsw17IU+ 0BdyIvrF/KePcMj8CyG3xIdyv8KYGGvkLPDGfIt775hrfXIWfpE5Rtv1vTJ8RU4BR9hlnEHC 2GKcjBtBB/W5MsSTOBMIf9XVvXWZ68dcizOLaBubwU/CHfUQ+gaHzL9S6Dd1U8bB2OAu8hbm G34Se8aumWtR30KPfXNG28wxfCL5Bf4Q24ocMHwdY2FMjK0eLzpAF/giuMK+4/wtdBdzrMtc vzxzL3grzwZj3sEfdoTQx1KCV8bCOBlz3IfjJ5lr5CXoCX2Ni7Pwi8Qx5j1zjFyKOMX8Ks+H gRPGxNjq8aKDOCsN3aAjdBXzq+mcu67uq8uzEmkb7uoz+OhbLcRA7IzxxPk5cS9OfCOmox/0 hL7Q27g4wzfjo/GL5IbkwMyx8t6Y+QMv8MHY6vGW5xHGmYToKs6V7PpMyfLs2Dh3lPZot+ms yyaJeVnej3OfgI8kL8E/oh/0FDEN/Y2LM2IZuSI+m9yQ/Ik5Rr6FzcV9ccybYeMO3SDoquaq izk2jLuSv2HnypZS3t8x3/ApzDViOPogXqAf9FRz1kceEpyV+QexjHsvfDexF7/AHCM+1bn6 ZuOvz9jtmquN+GsrcY8Xz9yIAYwfPRAnyMmI9XCGvsbBGXlqcEYuBGfEWXJ7cg/8IvkFfiKe qcBX01nVG8m0gL5ib9gl42XcjJ8csuSM3HFSOCMnCs6Iu+Qe+HTyCmIV/m6U91Vy1g1n5Ipy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdyJmdy JmdyJmdyJmdyJmdyJmezytnbkrw9yVLB2aVJDkwwZ58uOPv5JO9JcnGSn86cYX/Y4aRzRv9C 4KGtMDbscjnJviQXJFlJcmWSDyf5RJKbknwmyefGxBlt1ZwdSXJdkg9mn4CdnZ9kb5LdSc7O Y2urh1J/XXNd84RPoK8I8weh/8MEvhgjcwzfclGSy5O8L8lHkxzagLOu+So5o004Y64z55n7 +ADsCvu6LMmFSfbnuYbfYGwbjT30E/pCdzWHXfBVcxU84B/oNwInCHOplndk24Svn8n2iq/5 QJKPJbkhyaeS3J7kziS/nuRLY+IMe8FusB/sCHvCrn4uybuzf2SuwRs2yNiaxhz6CP2gK3QW /AV3o+atnF+0QXvBFf2hv9gbfODzkHMbBK6IYfBF7nFFkp/NPufjSW5MckuSX0ny+QngDLu5 LdvRJ5Nck/MQ4i/+Ad4YC7EN7prGjC7QC7yiI3SFztBdzL+St1HPsZIvbIb26UvJB7ZHnGIs +I9S8IWMkxiGreJnrkpydY5l+CDixx1JvpDkN8bEGW1iL9gN9hO5I/7xI9kvwBs2x1gYE2Or x4sO0AU6CV7hEJ0xB9FhxMLIPUfFW3AW/hAboU3sh37E3CEHZv4wDnz+u7I9hjBGcmXGSwzD ZvE35GS/kO0ZuyaOEE/IBcjjxsEZ9oLdkIfgH2/Ovht/AG/YGmMgJ2FMjK0cK2NHB+gCnaAb dISuwp+iQ3TZxVzjOuUcizyCtrEj+kPf6Gtwgs9jTPh/5P3ZPhkrvpBx42vIx/A7xIyYY+EX 8VFw1kfOGAJnke+Hf4y5hh+AN2yM+EtOQv7PmBgfEuNl7PgRdIFO0A3xm/nIvMM34SvRJTqN vLMLzrALfCJzHJuBL+yJfsET/WYc3G/BC34PYYxwdG0eM76Q8RPDsGH4QjfEfeZY6Rf75Czu 0bCXmGvMe/IieMO26PP12VcyFsbE2BgjY8V3MHZ0gC9BJ/BHPMC24Q1fiZ+q59qoOQu/CGfY CXMscomITdgefceHMCbyLcYHP8wnfCCxAZuFK3IO8ungCx2Vc2wcnIV/ZK7Rl5I3+vpLue/c t8EfY2JsjJGxMmbGjg7gEO4iBkbuwlzD7tFll5yV8yw4Y75jP/gCfB584e/oO+NhXNgmY2Ss cIS9MnbiBFwRM/BBzC90hK7Q2Tg5o+3gDR8Jb9gUvhvu6Du+gbEwJmIxY2SsjBke4Y55yLxj vuGHsO+SM+ZZ5P6j9o1NdQzaZZ6VnOEj8Hv0mf7DE2NjjOQXcMS44QkdwBX6QC/4onHyFZw1 8YYtYVPEWvrMvGMMwSFjww7hkDHjR5h7zDfsmHgRnBFPiCvhG7uKZyVnxE3awyfTPvMd30i/ 6B+cMcewPfhiTIyNcTJexg1P6KDkCn9Y8jUOzsq5VvJG34I7+kzfGUPJIWOEO3hjzmG3cIZ/ jPs6Yj/xjHsj8rjI97vIG8v7M9oh5yFvJH8lrkY9Az+Ab6S/9LuMVYwv/F/NUxNX4+BrGG8l d8EfYyjnX8Q87BQfwzzDNxLjyUPI0/BLxBRiS1exbCtzjbnPXMM/Es/wD9gc4yjzi2FzquRq nHzVfnIj/oK3yFOYZ8Q38iz8DX5n2Byr68tdcdaU85dxjXsT7Ar7ws5iruH7sUX8SlPMmhSe 2sS54C44K+/jYo6RQ3IPQIzHlrHpiGN17tHl87dhvJV5P/O/5C3qG+Qg8Fbm8uX91yTztVlO iS0Sy7DNJr6acsXaJ3b5TGZeedsOX+TS4+Zro5xklnmbdr7mjbdZ4WteeJs1vmadt1nla1Z5 a8NXPE+bRr5mjbd54astbzwDmGTe5o2vaedtXvmaVt5GxVdTzXea1oRPC29lDXGe+ZoW3uRr uniTr+niTb6mi7c2fLWpb8w6X5PCm3xNF2/yNV28Gb+mizf5mi7etsIX67Tla7y81WtK4Sv2 lDXxxZp6+Rovb+U6xGF8sZZPviaDNziK9b6x/nAzvso90vLVL2/l+vJYV896UfnqhzfWRbfl LdYrw03st4m9D+X6XvmaHN5ify/7A1gzzx6B2CfG+vnYVytfk8MbXMAJ+/Vif2Lsx2S/w6F8 /2W+0T9v7KFq4g0u2I/Dfi+4w18i7M9hbxX7U7z/mgzeyn2m7KNi/xvcMe8QuIqzIdjXKF+T wxt7hdjjxZw7mPmLcyDiHA/O7GA/kXyNnzc4iDNKmEfsOYU/hK/jvBz268X+r5qvLvbsieF5 CRyw37Q+C4h4x9dwxXxkf2XTmRzy1e99d5zjFOduwR1zKc6Z4mu4gtc490a+xs9beWZaeb4d nwjfizPByv2w8jU+3sqzJMszJOPcxDgzsTzDTb7Gy1vJXdNZrV2fbym2zlvTmbulNJ0DLCaP vyYRQgghhBBCCCFGBh7kUozjAca+JKtJTgzWFyzx8DBwOoMC0Gr6jdXBjSvfPICcWFtAwzVY REORlkJRXJeCOt/jhjbaWEg/uHl5vQ0W1tRtUMxdWLx5+c5dP1j+zpo8e86dSRYW79777cVn z7ljTX6w/O0k/B4LB4aN4WDD9enf2hgOINetrA6QE2sLELhOPR76Xuvpql2DwRV5DMP0dNWu K5av2vX63guWkCuW21w3sNF11/H9lcNXImf2t9R/V9cNXikulbzevXczXu/eC5dwCrdwDIdw CadwC8f83lb4mPXxtZ+Xh1e+dQA5c17Oo97u3PWmrxk2vjt34Wu+tvc/LCI3N87Trya5J13w /vT5p+kbD8BH+rw9Xf+39775kp505aJ2d4wzd8/4OjW79nl0sL6Q7R7+sW/9QF4kDudFFtL/ KeS+haw3RxH//f/xCCGEmC985Su/q8yxCCGEMP4r8ydRn3gw1yceyvWJo7k+QW3C+oQQQgjz E8X6hBBCCOO/0kd94uFcnziZ6xPHXT8hhBDC/ESxPiGEEML4r/Rcn3gk1ycezfWJVddPCCGE MD9RrE8IIYQw/is91ycey/WJx3N94j7rE0IIIcxPFOsTQgghjP9Kz/WJJ3J94slcnzjl/g4h hBDmJ4r1CSGEEMZ/pef6xKlcn3gq1yfecP2EEEII8xPF+oQQQgjjv9JzfeLpXJ94Jtcnzl50 /YQQQgjzE8X6hBBCCOO/0m994tlcn3gu1ydWcn3C9RNCCCHMTxTrE0IIIYz/Sl/1iedzfeKF XJ+4xvqEEEII8xPF+oQQQgjjv9JzfeLFXJ94Kdcnbnd/hxBCCPMTxfqEEEII47/Sc33i5Vyf eCXXJ466fkIIIYT5iWJ9QgghhPFf6bk+8WquT7yW6xPHXT8hhBDC/ESxPiGEEML4r/Rcnyhq DGtYdf2EEEII8xPF+oQQQgjjv9JzfeL+9PlvFgaDB9LnNzh/Ytdg8Jm8fgKxPiGEEML8RLE+ IYQQwvivdF2feDDXJx7K9YmjuT7B2gnrE0IIIcxPFOsTQgghjP9KH/WJh3N94mSuTxx3/YQQ QgjzE8X6hBBCCOO/0nN94pFcn3g01ydWXT8hhBDC/ESxPiGEEML4r/Rcn3gs1ycez/WJ+6xP CCGEMD9RrE8IIYQw/is91yeeyPWJJ3N94pT7O4QQQpifKNYnhBBCGP+VnusTp3J94qlcn3jD 9RNCCCHMTxTrE0IIIYz/Ss/1iadzfeKZXJ84e9H1E0IIIcxPFOsTQgghjP9Kv/WJZ3N94rlc n1jJ9QnXTwghhDA/UaxPCCGEMP4rfdUnns/1iRdyfeIa6xNCCCHMTxTrE0IIIYz/Ss/1iRdz feKlXJ+43f0dQgghzE8U6xNCCCGM/0rP9YmXc33ilVyfOOr6CSGEEOYnivUJIYQQxn+l5/rE q7k+8VquTxx3/YQQQgjzE8X6hBBCCOO/0nN9oqgxrGHV9RNCCCHMTxTrE0IIIYz/Ss/1ifvT 579eGAweSJ9/wvkTuwaDq/P6CWoU1ieEEEKYnyjWJ4QQQhj/la7rEw/m+sRDuT5xNNcnqE1Y nxBCCGF+olifEEIIYfxX+qhPPJzrEydzfeK46yeEEEKYnyjWJ4QQQhj/lZ7rE4/k+sSjuT6x 6voJIYQQ5ieK9QkhhBDGf6Xn+sRjuT7xeK5P3Gd9QgghhPmJYn1CCCGE8V/puT7xRK5PPJnr E6fc3yGEEML8RLE+IYQQwviv9FyfOJXrE0/l+sQbrp8QQghhfqJYnxBCCGH8V3quTzyd6xPP 5PrE2YuunxBCCGF+olifEEIIYfxX+q1PPJvrE8/l+sRKrk+4fkIIIYT5iWJ9QgghhPFf6as+ 8XyuT7yQ6xPXWJ8QQghhfqJYnxBCCGH8V3quT7yY6xMv5frE7e7vEEIIYX6iWJ8QQghh/Fd6 rk+8nOsTr+T6xFHXTwghhDA/UaxPCCGEMP4rPdcnXs31iddyfeK46yeEEEKYnyjWJ4QQQhj/ lZ7rE0WNYQ2rrp8QQghhfqJYnxBCCGH8V3quT9yfPv94YTB4IH1+nfMndg0Gl7h+QgghhPmJ Yn1CCCGE8V/psT7xYK5PPJTrE0dzfcL1E0IIIcxPFOsTQgghjP9KX/WJh3N94mSuTxx3/YQQ QgjzE8X6hBBCCOO/0nN94pFcn3g01ydWXT8hhBDC/ESxPiGEEML4r/Rcn3gs1ycez/WJ+6xP CCGEMD9RrE8IIYQw/is91yeeyPWJJ3N94pT7O4QQQpifKNYnhBBCGP+VnusTp3J94qlcn3jD 9RNCCCHMTxTrE0IIIYz/Ss/1iadzfeKZXJ84e9H1E0IIIcxPFOsTQgghjP9Kv/WJZ3N94rlc n1jJ9QnXTwghhDA/UaxPCCGEMP4rfdUnns/1iRdyfeIa6xNCCCHMTxTrE0IIIYz/Ss/1iRdz feKlXJ+43f0dQgghzE8U6xNCCCGM/0rP9YmXc33ilVyfOOr6CSGEEOYnivUJIYQQxn+l5/rE q7k+8VquTxx3/YQQQgjzE8X6hBBCCOO/0nN9oqgxrGHV9RNCCCHMTxTrE0IIIYz/Ss/1ifvT 579cGAweSJ//ivMndg0GP5XXTyDWJ4QQQpifKNYnhBBCGP+VrusTD+b6xEO5PnE01ydYO2F9 QgghhPmJYn1CCCGE8V/poz7xcK5PnMz1ieOunxBCCGF+olifEEIIYfxXeq5PPJLrE4/m+sSq 6yeEEEKYnyjWJ4QQQhj/lZ7rE4/l+sTjuT5xn/UJIYQQ5ieK9QkhhBDGf6Xn+sQTuT7xZK5P nHJ/hxBCCPMTxfqEEEII47/Sc33iVK5PPJXrE2+4fkIIIYT5iWJ9QgghhPFf6bk+8XSuTzyT 6xNnL7p+QgghhPmJYn1CCCGE8V/ptz7xbK5PPJfrEyu5PuH6CSGEEOYnivUJIYQQxn+lr/rE 87k+8UKuT1xjfUIIIYT5iWJ9QgghhPFf6bk+8WKuT7yU6xO3u79DCCGE+YlifUIIIYTxX+m5 PvFyrk+8kusTR10/IYQQwvxEsT4hhBDC+K/0XJ94NdcnXsv1ieOunxBCCGF+olifEEIIYfxX eq5PFDWGNay6fkIIIYT5iWJ9QgghhPFf6bk+cX/6/BcLg8ED6fOPOH9i12Dw385Zr01Qo7A+ IYQQwvxEsT4hhBDC+K90XZ94MNcnHsr1iaO5PkFtwvqEEEII8xPF+oQQQgjjv9JHfeLhXJ84 mesTx10/IYQQwvxEsT4hhBDC+K/0XJ94JNcnHs31iVXXTwghhDA/UaxP/D927i3FoTUv4/Aq aFK50CE0GUaTMYjabfCA4gFFabdRPOABRQXdRlF6CJsMY5P7qqIOVEiyqCIHKqRS1E2TQZhV /V7UBOp/9TzwkiF8Hz++FQCc/1bcJ+bpE4v0iZk+AYD7iekTADj/rbhPLNMnVukTre87AHA/ MX0CAOe/FfeJNn3iKX3i5P0EAO4npk8A4Py34j7xnD6xTp/o9b2fAMD9xPQJAJz/VtsnNukT 2/SJQfqE9xMAuJ+YPgGA89+q+sQufeIlfWKoTwDgfmL6BADOfyvuE/v0iUP6xMj3HQC4n5g+ AYDz34r7xGv6xDF9Yuz9BADuJ6ZPAOD8t+I+8ZY+8Z4+MfF+AgD3E9MnAHD+W3Gf+NQYPky9 nwDA/cT0CQCc/1bcJ67Ov/930TTX59+fdf8/cdk0y7yf6KZPAOB+YvoEAM5/++o+cZM+cZs+ MU6f6N5O6BMAuJ+YPgGA898q+sRd+sR9+sTE+wkA3E9MnwDA+W/FfeIhfeIxfWLq/QQA7iem TwDg/LfiPjFPn1ikT8z0CQDcT0yfAMD5b8V9Ypk+sUqfaH3fAYD7iekTADj/rbhPtOkTT+kT J+8nAHA/MX0CAOe/FfeJ5/SJdfpEr+/9BADuJ6ZPAOD8t9o+sUmf2KZPDNInvJ8AwP3E9AkA nP9W1Sd26RMv6RNDfQIA9xPTJwBw/ltxn9inTxzSJ0a+7wDA/cT0CQCc/1bcJ17TJ47pE2Pv JwBwPzF9AgDnvxX3ibf0iff0iYn3EwC4n5g+AYDz34r7xKfG8GHq/QQA7iemTwDg/LfiPnF1 /v2fi6a5Pv/+b/f/E5dN833eT3SNQp8AwP3E9AkAnP/21X3iJn3iNn1inD7RtQl9AgD3E9Mn AHD+W0WfuEufuE+fmHg/AYD7iekTADj/rbhPPKRPPKZPTL2fAMD9xPQJAJz/Vtwn5ukTi/SJ mT4BgPuJ6RMAOP+tuE8s0ydW6ROt7zsAcD8xfQIA578V94k2feIpfeLk/QQA7iemTwDg/Lfi PvGcPrFOn+j1vZ8AwP3E9AkAnP9W2yc26RPb9IlB+oT3EwC4n5g+AYDz36r6xC594iV9YqhP AOB+YvoEAM5/K+4T+/SJQ/rEyPcdALifmD4BgPPfivvEa/rEMX1i7P0EAO4npk8A4Py34j7x lj7xnj4x8X4CAPcT0ycAcP5bcZ/41Bg+TL2fAMD9xPQJAJz/Vtwnrs6/k4umuT7//nf3/xOX TfOd9xMAuJ+YPgGA898K+8RN+sRt+sQ4fcL7CQDcT0yfAMD5b1V94i594j59YuL9BADuJ6ZP AOD8t+I+8ZA+8Zg+MfV+AgD3E9MnAHD+W3GfmKdPLNInZvoEAO4npk8A4Py34j6xTJ9YpU+0 vu8AwP3E9AkAnP9W3Cfa9Imn9ImT9xMAuJ+YPgGA89+K+8Rz+sQ6faLX934CAPcT0ycAcP5b bZ/YpE9s0ycG6RPeTwDgfmL6BADOf6vqE7v0iZf0iaE+AYD7iekTADj/rbhP7NMnDukTI993 AOB+YvoEAM5/K+4Tr+kTx/SJsfcTALifmD4BgPPfivvEW/rEe/rExPsJANxPTJ8AwPlvxX3i U2P4MPV+AgD3E9MnAHD+W3GfuDr//udF01yff/+r+/+Jy6b5Nu8nuukTALifmD4BgPPfvrpP 3KRP3KZPjNMnurcT+gQA7iemTwDg/LeKPnGXPnGfPjHxfgIA9xPTJwBw/ltxn3hIn3hMn5h6 PwGA+4npEwA4/624T8zTJxbpEzN9AgD3E9MnAHD+W3GfWKZPrNInWt93AOB+YvoEAM5/K+4T bfrEU/rEyfsJANxPTJ8AwPlvxX3iOX1inT7R63s/AYD7iekTADj/rbZPbNIntukTg/QJ7ycA cD8xfQIA579V9Yld+sRL+sRQnwDA/cT0CQCc/1bcJ/bpE4f0iZHvOwBwPzF9AgDnvxX3idf0 iWP6xNj7CQDcT0yfAMD5b8V94i194j19YuL9BADuJ6ZPAOD8t+I+8akxfJh6PwGA+4npEwA4 /624T1x1peGiaa7Pv//R/f/EZdN8k/cTXaPQJwBwPzF9AgDnv311n7hJn7hNnxinT3RtQp8A wP3E9AkAnP9W0Sfu0ifu0ycm3k8A4H5i+gQAzn8r7hMP6ROP6RNT7ycAcD8xfQIA578V94l5 +sQifWKmTwDgfmL6BADOfyvuE8v0iVX6ROv7DgDcT0yfAMD5b8V9ok2feEqfOHk/AYD7iekT ADj/rbhPPKdPrNMnen3vJwBwPzF9AgDnv9X2iU36xDZ9YpA+4f0EAO4npk8A4Py3qj6xS594 SZ8Y6hMAuJ+YPgGA89+K+8Q+feKQPjHyfQcA7iemTwDg/LfiPvGaPnFMnxh7PwGA+4npEwA4 /624T7ylT7ynT0y8nwDA/cT0CQCc/1bcJz41hg9T7ycAcD8xfQIA578V94mr8++/XTTN9fn3 37v/n7hsmp/k/UQ3fQIA9xPTJwBw/ttX94mb9Inb9Ilx+kT3dkKfAMD9xPQJAJz/VtEn7tIn 7tMnJt5PAOB+YvoEAM5/K+4TD+kTj+kTU+8nAHA/MX0CAOe/FfeJefrEIn1ipk8A4H5i+gQA zn8r7hPL9IlV+kTr+w4A3E9MnwDA+W/FfaJNn3hKnzh5PwGA+4npEwA4/624TzynT6zTJ3p9 7ycAcD8xfQIA57/V9olN+sQ2fWKQPuH9BADuJ6ZPAOD8t6o+sUufeEmfGOoTALifmD4BgPPf ivvEPn3ikD4x8n0HAO4npk8A4Py34j7xmj5xTJ8Yez8BgPuJ6RMAOP+tuE+8pU+8p09MvJ8A wP3E9AkAnP9W3Cc+NYYPU+8nAHA/MX0CAOe/FfeJq/Pvv1w0zfX591+7/5+4bJof5f1E1yj0 CQDcT0yfAMD5b1/dJ27SJ27TJ8bpE12b0CcAcD8xfQIA579V9Im79In79ImJ9xMAuJ+YPgGA 89+K+8RD+sRj+sTU+wkA3E9MnwDA+W/FfWKePrFIn5jpEwC4n5g+AYDz34r7xDJ9YpU+0fq+ AwD3E9MnAHD+W3GfaNMnntInTt5PAOB+YvoEAM5/K+4Tz+kT6/SJXt/7CQDcT0yfAMD5b7V9 YpM+sU2fGKRPeD8BgPuJ6RMAOP+tqk/s0ide0ieG+gQA7iemTwDg/LfiPrFPnzikT4x83wGA +4npEwA4/624T7ymTxzTJ8beTwDgfmL6BADOfyvuE2/pE+/pExPvJwBwPzF9AgDnvxX3iU+N 4cPU+wkA3E9MnwDA+W/FfeLq/PtPF01zff795+7/Jy6b5ofeTwDgfmL6BADOfyvsEzfpE7fp E+P0Ce8nAHA/MX0CAOe/VfWJu/SJ+/SJifcTALifmD4BgPPfivvEQ/rEY/rE1PsJANxPTJ8A wPlvxX1inj6xSJ+Y6RMAuJ+YPgGA89+K+8QyfWKVPtH6vgMA9xPTJwBw/ltxn2jTJ57SJ07e TwDgfmL6BADOfyvuE8/pE+v0iV7f+wkA3E9MnwDA+W+1fWKTPrFNnxikT3g/AYD7iekTADj/ rapP7NInXtInhvoEAO4npk8A4Py34j6xT584pE+MfN8BgPuJ6RMAOP+tuE+8pk8c0yfG3k8A 4H5i+gQAzn8r7hNv6RPv6RMT7ycAcD8xfQIA578V94lPjeHD1PsJANxPTJ8AwPlvxX3i6vz7 DxdNc33+/cfu/ycum+YHeT/RTZ8AwP3E9AkAnP/21X3iJn3iNn1inD7RvZ3QJwBwPzF9AgDn v1X0ibv0ifv0iYn3EwC4n5g+AYDz34r7xEP6xGP6xNT7CQDcT0yfAMD5b8V9Yp4+sUifmOkT ALifmD4BgPPfivvEMn1ilT7R+r4DAPcT0ycAcP5bcZ9o0yee0idO3k8A4H5i+gQAzn8r7hPP 6RPr9Ile3/sJANxPTJ8AwPlvtX1ikz6xTZ8YpE94PwGA+4npEwA4/62qT+zSJ17SJ4b6BADu J6ZPAOD8t+I+sU+fOKRPjHzfAYD7iekTADj/rbhPvKZPHNMnxt5PAOB+YvoEAM5/K+4Tb+kT 7+kTE+8nAHA/MX0CAOe/FfeJT43hw9T7CQDcT0yfAMD5b8V94ur8+3cXTXN9/v377v8nLpvm 57/8izbRNQp9AgD3E9MnAHD+21f3iZv0idv0iXH6RNcm9AkA3E9MnwDA+W8VfeIufeI+fWLi /QQA7iemTwDg/LfiPvGQPvGYPjH1fgIA9xPTJwBw/ltxn5inTyzSJ2b6BADuJ6ZPAOD8t+I+ sUyfWKVPtL7vAMD9xPQJAJz/Vtwn2vSJp/SJk/cTALifmD4BgPPfivvEc/rEOn2i1/d+AgD3 E9MnAHD+W22f2KRPbNMnBukT3k8A4H5i+gQAzn+r6hO79ImX9ImhPgGA+4npEwA4/624T+zT Jw7pEyPfdwDgfmL6BADOfyvuE6/pE8f0ibH3EwC4n5g+AYDz34r7xFv6xHv6xMT7CQDcT0yf AMD5b8V94lNj+DD1fgIA9xPTJwBw/ltxn7g6//7NRdNcn3//tvv/icumWeb9RDd9AgD3E9Mn AHD+21f3iZv0idv0iXH6RPd2Qp8AwP3E9AkAnP9W0Sfu0ifu0ycm3k8A4H5i+gQAzn8r7hMP 6ROP6RNT7ycAcD8xfQIA578V94l5+sQifWKmTwDgfmL6BADOfyvuE8v0iVX6ROv7DgDcT0yf AMD5b8V9ok2feEqfOHk/AYD7iekTADj/rbhPPKdPrNMnen3vJwBwPzF9AgDnv9X2iU36xDZ9 YpA+4f0EAO4npk8A4Py3qj6xS594SZ8Y6hMAuJ+YPgGA89+K+8Q+feKQPjHyfQcA7iemTwDg /LfiPvGaPnFMnxh7PwGA+4npEwA4/624T7ylT7ynT0y8nwDA/cT0CQCc/1bcJz41hg9T7ycA cD8xfQIA578V94mr8+9fXTTN9fn3r7v/n7hsmu/zfqJrFPoEAO4npk8A4Py3r+4TN+kTt+kT 4/SJrk3oEwC4n5g+AYDz3yr6xF36xH36xMT7CQDcT0yfAMD5b8V94iF94jF9Yur9BADuJ6ZP AOD8t+I+MU+fWKRPzPQJANxPTJ8AwPlvxX1imT6xSp9ofd8BgPuJ6RMAOP+tuE+06RNP6RMn 7ycAcD8xfQIA578V94nn9Il1+kSv7/0EAO4npk8A4Py32j6xSZ/Ypk8M0ie8nwDA/cT0CQCc /1bVJ3bpEy/pE0N9AgD3E9MnAHD+W3Gf2KdPHNInRr7vAMD9xPQJAJz/VtwnXtMnjukTY+8n AHA/MX0CAOe/FfeJt/SJ9/SJifcTALifmD4BgPPfivvEp8bwYer9BADuJ6ZPAOD8t+I+cXX+ /YuLprk+//5l9/8Tl03znfcTALifmD4BgPPfCvvETfrEbfrEOH3C+wkA3E9MnwDA+W9VfeIu feI+fWLi/QQA7iemTwDg/LfiPvGQPvGYPjH1fgIA9xPTJwBw/ltxn5inTyzSJ2b6BADuJ6ZP AOD8t+I+sUyfWKVPtL7vAMD9xPQJAJz/Vtwn2vSJp/SJk/cTALifmD4BgPPfivvEc/rEOn2i 1/d+AgD3E9MnAHD+W22f2KRPbNMnBukT3k8A4H5i+gQAzn+r6hO79ImX9ImhPgGA+4npEwA4 /624T+zTJw7pEyPfdwDgfmL6BADOfyvuE6/pE8f0ibH3EwC4n5g+AYDz34r7xFv6xHv6xMT7 CQDcT0yfAMD5b8V94lNj+DD1fgIA9xPTJwBw/ltxn7g6//75RdNcn3+/6f5/4rJpvs37iW76 BADuJ6ZPAOD8t6/uEzfpE7fpE+P0ie7thD4BgPuJ6RMAOP+tok/cpU/cp09MvJ8AwP3E9AkA nP9W3Cce0ice0yem3k8A4H5i+gQAzn8r7hPz9IlF+sRMnwDA/cT0CQCc/1bcJ5bpE6v0idb3 HQC4n5g+AYDz34r7RJs+8ZQ+cfJ+AgD3E9MnAHD+W3GfeE6fWKdP9PreTwDgfmL6BADOf6vt E5v0iW36xCB9wvsJANxPTJ8AwPlvVX1ilz7xkj4x1CcAcD8xfQIA578V94l9+sQhfWLk+w4A 3E9MnwDA+W/FfeI1feKYPjH2fgIA9xPTJwBw/ltxn3hLn3hPn5h4PwGA+4npEwA4/624T3xq DB+m3k8A4H5i+gQAzn8r7hNX598/u2ia6/PvT7v/n7hsmm/yfqJrFPoEAO4npk8A4Py3r+4T N+kTt+kT4/SJrk3oEwC4n5g+AYDz3yr6xF36xH36xMT7CQDcT0yfAMD5b8V94iF94jF9Yur9 BADuJ6ZPAOD8t+I+MU+fWKRPzPQJANxPTJ8AwPlvxX1imT6xSp9ofd8BgPuJ6RMAOP+tuE+0 6RNP6RMn7ycAcD8xfQIA578V94nn9Il1+kSv7/0EAO4npk8A4Py32j6xSZ/Ypk8M0ie8nwDA /cT0CQCc/1bVJ3bpEy/pE0N9AgD3E9MnAHD+W3Gf2KdPHNInRr7vAMD9xPQJAJz/VtwnXtMn jukTY+8nAHA/MX0CAOe/FfeJt/SJ9/SJifcTALifmD4BgPPfivvEp8bwYer9BADuJ6ZPAOD8 t+I+cXX+/ZOLprk+//5p9/8Tl03zk7yf6KZPAOB+YvoEAM5/++o+cZM+cZs+MU6f6N5O6BMA uJ+YPgGA898q+sRd+sR9+sTE+wkA3E9MnwDA+W/FfeIhfeIxfWLq/QQA7iemTwDg/LfiPjFP n1ikT8z0CQDcT0yfAMD5b8V9Ypk+sUqfaH3fAYD7iekTADj/rbhPtOkTT+kTJ+8nAHA/MX0C AOe/FfeJ5/SJdfpEr+/9BADuJ6ZPAOD8t9o+sUmf2KZPDNInvJ8AwP3E9AkAnP9W1Sd26RMv 6RNDfQIA9xPTJwBw/ltxn9inTxzSJ0a+7wDA/cT0CQCc/1bcJ17TJ47pE2PvJwBwPzF9AgDn vxX3ibf0iff0iYn3EwC4n5g+AYDz34r7xKfG8GHq/QQA7iemTwDg/LfiPnF1/v2ji6a5Pv/+ cff/E5dN86O8n+gahT4BgPuJ6RMAOP/tq/vETfrEbfrEOH2iaxP6BADuJ6ZPAOD8t4o+cZc+ cZ8+MfF+AgD3E9MnAHD+W3GfeEifeEyfmHo/AYD7iekTADj/rbhPzNMnFukTM30CAPcT0ycA cP5bcZ9Ypk+s0ida33cA4H5i+gQAzn8r7hNt+sRT+sTJ+wkA3E9MnwDA+W/FfeI5fWKdPtHr ez8BgPuJ6RMAOP+ttk9s0ie26ROD9AnvJwBwPzF9AgDnv1X1iV36xEv6xFCfAMD9xPQJAJz/ Vtwn9ukTh/SJke87AHA/MX0CAOe/FfeJ1/SJY/rE2PsJANxPTJ8AwPlvxX3iLX3iPX1i4v0E AO4npk8A4Py34j7xqTF8mHo/AYD7iekTADj/rbhPXJ1//+Ciaa7Pv3/Y/f/EZdP80PsJANxP TJ8AwPlvhX3iJn3iNn1inD7h/QQA7iemTwDg/LeqPnGXPnGfPjHxfgIA9xPTJwBw/ltxn3hI n3hMn5h6PwGA+4npEwA4/624T8zTJxbpEzN9AgD3E9MnAHD+W3GfWKZPrNInWt93AOB+YvoE AM5/K+4TbfrEU/rEyfsJANxPTJ8AwPlvxX3iOX1inT7R63s/AYD7iekTADj/rbZPbNIntukT g/QJ7ycAcD8xfQIA579V9Yld+sRL+sRQnwDA/cT0CQCc/1bcJ/bpE4f0iZHvOwBwPzF9AgDn vxX3idf0iWP6xNj7CQDcT0yfAMD5b8V94i194j19YuL9BADuJ6ZPAOD8t+I+8akxfJh6PwGA +4npEwA4/624T1ydf3/vommuz7+/3/3/xGXT/CDvJ7rpEwC4n5g+AYDz3766T9ykT9ymT4zT J7q3E/oEAO4npk8A4Py3ij5xlz5xnz4x8X4CAPcT0ycAcP5bcZ94SJ94TJ+Yej8BgPuJ6RMA OP+tuE/M0ycW6RMzfQIA9xPTJwBw/ltxn1imT6zSJ1rfdwDgfmL6BADOfyvuE236xFP6xMn7 CQDcT0yfAMD5b8V94jl9Yp0+0et7PwGA+4npEwA4/622T2zSJ7bpE4P0Ce8nAHA/MX0CAOe/ VfWJXfrES/rEUJ8AwP3E9AkAnP9W3Cf26ROH9ImR7zsAcD8xfQIA578V94nX9Ilj+sTY+wkA 3E9MnwDA+W/FfeItfeI9fWLi/QQA7iemTwDg/LfiPvGpMXyYej8BgPuJ6RMAOP+tuE9cnX9/ 56Jprs+/v9v9/8Rl0/z8l37RJrpGoU8A4H5i+gQAzn/76j5xkz5xmz4xTp/o2oQ+AYD7iekT ADj/raJP3KVP3KdPTLyfAMD9xPQJAJz/VtwnHtInHtMnpt5PAOB+YvoEAM5/K+4T8/SJRfrE TJ8AwP3E9AkAnP9W3CeW6ROr9InW9x0AuJ+YPgGA89+K+0SbPvGUPnHyfgIA9xPTJwBw/ltx n3hOn1inT/T63k8A4H5i+gQAzn+r7ROb9Ilt+sQgfcL7CQDcT0yfAMD5b1V9Ypc+8ZI+MdQn AHA/MX0CAOe/FfeJffrEIX1i5PsOANxPTJ8AwPlvxX3iNX3imD4x9n4CAPcT0ycAcP5bcZ94 S594T5+YeD8BgPuJ6RMAOP+tuE98agwfpt5PAOB+YvoEAM5/K+4TV+ff37pomuvz7293/z9x 2TTLvJ/opk8A4H5i+gQAzn/76j5xkz5xmz4xTp/o3k7oEwC4n5g+AYDz3yr6xF36xH36xMT7 CQDcT0yfAMD5b8V94iF94jF9Yur9BADuJ6ZPAOD8t+I+MU+fWKRPzPQJANxPTJ8AwPlvxX1i mT6xSp9ofd8BgPuJ6RMAOP+tuE+06RNP6RMn7ycAcD8xfQIA578V94nn9Il1+kSv7/0EAO4n pk8A4Py32j6xSZ/Ypk8M0ie8nwDA/cT0CQCc/1bVJ3bpEy/pE0N9AgD3E9MnAHD+W3Gf2KdP HNInRr7vAMD9xPQJAJz/VtwnXtMnjukTY+8nAHA/MX0CAOe/FfeJt/SJ9/SJifcTALifmD4B gPPfivvEp8bwYer9BADuJ6ZPAOD8t+I+cXX+HV00zfX59ze7/5+4bJrv836iaxT6BADuJ6ZP AOD8t6/uEzfpE7fpE+P0ia5N6BMAuJ+YPgGA898q+sRd+sR9+sTE+wkA3E9MnwDA+W/FfeIh feIxfWLq/QQA7iemTwDg/LfiPjFPn1ikT8z0CQDcT0yfAMD5b8V9Ypk+sUqfaH3fAYD7iekT ADj/rbhPtOkTT+kTJ+8nAHA/MX0CAOe/FfeJ5/SJdfpEr+/9BADuJ6ZPAOD8t9o+sUmf2KZP DNInvJ8AwP3E9AkAnP9W1Sd26RMv6RNDfQIA9xPTJwBw/ltxn9inTxzSJ0a+7wDA/cT0CQCc /1bcJ17TJ47pE2PvJwBwPzF9AgDnvxX3ibf0iff0iYn3EwC4n5g+AYDz34r7xKfG8GHq/QQA 7iemTwDg/LfiPnF1/v3xRdNcn39/o/v/icum+c77CQDcT0yfAMD5b4V94iZ94jZ9Ypw+4f0E AO4npk8A4Py3qj5xlz5xnz4x8X4CAPcT0ycAcP5bcZ94SJ94TJ+Yej8BgPuJ6RMAOP+tuE/M 0ycW6RMzfQIA9xPTJwBw/ltxn1imT6zSJ1rfdwDgfmL6BADOfyvuE236xFP6xMn7CQDcT0yf AMD5b8V94jl9Yp0+0et7PwGA+4npEwA4/622T2zSJ7bpE4P0Ce8nAHA/MX0CAOe/VfWJXfrE S/rEUJ8AwP3E9AkAnP9W3Cf26ROH9ImR7zsAcD8xfQIA578V94nX9Ilj+sTY+wkA3E9MnwDA +W/FfeItfeI9fWLi/QQA7iemTwDg/LfiPvGpMXyYej8BgPuJ6RMAOP+tuE9cnX9/7aJprs+/ v979/8Rl03yb9xPd9AkA3E9MnwDA+W9f3Sdu0idu0yfG6RPd2wl9AgD3E9MnAHD+W0WfuEuf uE+fmHg/AYD7iekTADj/rbhPPKRPPKZPTL2fAMD9xPQJAJz/Vtwn5ukTi/SJmT4BgPuJ6RMA OP+tuE8s0ydW6ROt7zsAcD8xfQIA578V94k2feIpfeLk/QQA7iemTwDg/LfiPvGcPrFOn+j1 vZ8AwP3E9AkAnP9W2yc26RPb9IlB+oT3EwC4n5g+AYDz36r6xC594iV9YqhPAOB+YvoEAM5/ K+4T+/SJQ/rEyPcdALifmD4BgPPfivvEa/rEMX1i7P0EAO4npk8A4Py34j7xlj7xnj4x8X4C APcT0ycAcP5bcZ/41Bg+TL2fAMD9xPQJAJz/Vtwnrs6/v3LRNNfn31/t/n/ismm+yfuJrlHo EwC4n5g+AYDz3766T9ykT9ymT4zTJ7o2oU8A4H5i+gQAzn+r6BN36RP36RMT7ycAcD8xfQIA 578V94mH9InH9Imp9xMAuJ+YPgGA89+K+8Q8fWKRPjHTJwBwPzF9AgDnvxX3iWX6xCp9ovV9 BwDuJ6ZPAOD8t+I+0aZPPKVPnLyfAMD9xPQJAJz/VtwnntMn1ukTvb73EwC4n5g+AYDz32r7 xCZ9Yps+MUif8H4CAPcT0ycAcP5bVZ/YpU+8pE8M9QkA3E9MnwDA+W/FfWKfPnFInxj5vgMA 9xPTJwBw/ltxn3hNnzimT4y9nwDA/cT0Cfh/9u7tx6/rPO/4nsolGTMh05waNHGGlJJYbhLb sesotONDnVixlSaxyzqKm0RxegIkjwxLhgUfYEO064Hli6AHtOgBwuSqiS96kwIqeE8SPIAE yQEJHkCCBzAwAl7pH2j3M/OuePvnoQ42Z80M+fmiT34iJc/stZ+91vvOM2vtAlD/qXM+cbPy iVuVTyzaPwEA0J+QfAIAoP5T53xikjGssGT/BABAf0LyCQCA+k+d84lD4+dH5obh8Pj5WN4/ sX0YPlb7JyL5BABAf0LyCQCA+k/rnU8cqXziaOUTC5VPZO+EfAIAoD8h+QQAQP2nHvnEscon jlc+sWj/BABAf0LyCQCA+k+d84kTlU+crHxiyf4JAID+hOQTAAD1nzrnE6cqnzhd+cRB+QQA QH9C8gkAgPpPnfOJM5VPnK18Ytn5DgCA/oTkEwAA9Z865xPLlU+cq3zitv0TAAD9CcknAADq P3XOJ85XPnGh8oltO+yfAADoT0g+AQBQ/6lvPnGx8olLlU/MVz5h/wQAQH9C8gkAgPpPvfKJ y5VPXKl8Yp98AgCgPyH5BABA/afO+cTVyieuVT6x3/kOAID+hOQTAAD1nzrnE9crn7hR+cSC /RMAAP0JyScAAOo/dc4nblY+cavyiUX7JwAA+hOSTwAA1H/qnE9MMoYVluyfAADoT0g+AQBQ /6lzPnFo/Hx0bhgOj58fzvsntg/DI7V/IhmFfAIAoD8h+QQAQP2n9c4njlQ+cbTyiYXKJ5JN yCcAAPoTkk8AANR/6pFPHKt84njlE4v2TwAA9CcknwAAqP/UOZ84UfnEyconluyfAADoT0g+ AQBQ/6lzPnGq8onTlU8clE8AAPQnJJ8AAKj/1DmfOFP5xNnKJ5ad7wAA6E9IPgEAUP+pcz6x XPnEuconbts/AQDQn5B8AgCg/lPnfOJ85RMXKp/YtsP+CQCA/oTkEwAA9Z/65hMXK5+4VPnE fOUT9k8AAPQnJJ8AAKj/1CufuFz5xJXKJ/bJJwAA+hOSTwAA1H/qnE9crXziWuUT+53vAADo T0g+AQBQ/6lzPnG98okblU8s2D8BANCfkHwCAKD+U+d84mblE7cqn1i0fwIAoD8h+QQAQP2n zvnEJGNYYcn+CQCA/oTkEwAA9Z865xOHxs/fnBuGw+Pnh/L+ie3D8Cb7JwAA+hOSTwAA1H/q mE8cqXziaOUTC5VP2D8BANCfkHwCAKD+U6984ljlE8crn1i0fwIAoD8h+QQAQP2nzvnEicon TlY+sWT/BABAf0LyCQCA+k+d84lTlU+crnzioHwCAKA/IfkEAED9p875xJnKJ85WPrHsfAcA QH9C8gkAgPpPnfOJ5conzlU+cdv+CQCA/oTkEwAA9Z865xPnK5+4UPnEth32TwAA9CcknwAA qP/UN5+4WPnEpcon5iufsH8CAKA/IfkEAED9p175xOXKJ65UPrFPPgEA0J+QfAIAoP5T53zi auUT1yqf2O98BwBAf0LyCQCA+k+d84nrlU/cqHxiwf4JAID+hOQTAAD1nzrnEzcrn7hV+cSi /RMAAP0JyScAAOo/dc4nJhnDCkv2TwAA9CcknwAAqP/UOZ84NH5+YG4YDo+fH8z7J7YPwxtq /0QknwAA6E9IPgEAUP9pvfOJI5VPHK18YqHyieydkE8AAPQnJJ8AAKj/1COfOFb5xPHKJxbt nwAA6E9IPgEAUP+pcz5xovKJk5VPLNk/AQDQn5B8AgCg/lPnfOJU5ROnK584KJ8AAOhPSD4B AFD/qXM+cabyibOVTyw73wEA0J+QfAIAoP5T53xiufKJc5VP3LZ/AgCgPyH5BABA/afO+cT5 yicuVD6xbYf9EwAA/QnJJwAA6j/1zScuVj5xqfKJ+con7J8AAOhPSD4BAFD/qVc+cbnyiSuV T+yTTwAA9CcknwAAqP/UOZ+4WvnEtcon9jvfAQDQn5B8AgCg/lPnfOJ65RM3Kp9YsH8CAKA/ IfkEAED9p875xM3KJ25VPrFo/wQAQH9C8gkAgPpPnfOJScawwpL9EwAA/QnJJwAA6j91zicO jZ/vmxuGw+Pn+/P+ie3D8Lc7V7OJZBTyCQCA/oTkEwAA9Z/WO584UvnE0conFiqfSDYhnwAA 6E9IPgEAUP+pRz5xrPKJ45VPLNo/AQDQn5B8AgCg/lPnfOJE5RMnK59Ysn8CAKA/IfkEAED9 p875xKnKJ05XPnFQPgEA0J+QfAIAoP5T53ziTOUTZyufWHa+AwCgPyH5BABA/afO+cRy5RPn Kp+4bf8EAEB/QvIJAID6T53zifOVT1yofGLbDvsnAAD6E5JPAADUf+qbT1ysfOJS5RPzlU/Y PwEA0J+QfAIAoP5Tr3zicuUTVyqf2CefAADoT0g+AQBQ/6lzPnG18olrlU/sd74DAKA/IfkE AED9p875xPXKJ25UPrFg/wQAQH9C8gkAgPpPnfOJm5VP3Kp8YtH+CQCA/oTkEwAA9Z865xOT jGGFJfsnAAD6E5JPAADUf+qcTxwaP98zNwyHx8/35v0T24fhTO2fiOQTAAD9CcknAADqP613 PnGk8omjlU8sVD6RvRPyCQCA/oTkEwAA9Z965BPHKp84XvnEov0TAAD9CcknAADqP3XOJ05U PnGy8okl+ycAAPoTkk8AANR/6pxPnKp84nTlEwflEwAA/QnJJwAA6j91zifOVD5xtvKJZec7 AAD6E5JPAADUf+qcTyxXPnGu8onb9k8AAPQnJJ8AAKj/1DmfOF/5xIXKJ7btsH8CAKA/IfkE AED9p775xMXKJy5VPjFf+YT9EwAA/QnJJwAA6j/1yicuVz5xpfKJffIJAID+hOQTAAD1nzrn E1crn7hW+cR+5zsAAPoTkk8AANR/6pxPXK984kblEwv2TwAA9CcknwAAqP/UOZ+4WfnErcon Fu2fAADoT0g+AQBQ/6lzPjHJGFZYsn8CAKA/IfkEAED9p875xKHx89fnhuHw+PnuvH9i+zD8 39o/kYxCPgEA0J+QfAIAoP7TeucTRyqfOFr5xELlE8km5BMAAP0JyScAAOo/9cgnjlU+cbzy iUX7JwAA+hOSTwAA1H/qnE+cqHziZOUTS/ZPAAD0JySfAACo/9Q5nzhV+cTpyicOyicAAPoT kk8AANR/6pxPnKl84mzlE8vOdwAA9CcknwAAqP/UOZ9YrnziXOUTt+2fAADoT0g+AQBQ/6lz PnG+8okLlU9s22H/BABAf0LyCQCA+k9984mLlU9cqnxivvIJ+ycAAPoTkk8AANR/6pVPXK58 4krlE/vkEwAA/QnJJwAA6j91zieuVj5xrfKJ/c53AAD0JySfAACo/9Q5n7he+cSNyicW7J8A AOhPSD4BAFD/qXM+cbPyiVuVTyzaPwEA0J+QfAIAoP5T53xikjGssGT/BABAf0LyCQCA+k+d 84lD4+evzQ3D4fHzkbx/YvswvGj/BABAf0LyCQCA+k8d84kjlU8crXxiofIJ+ycAAPoTkk8A ANR/6pVPHKt84njlE4v2TwAA9CcknwAAqP/UOZ84UfnEyconluyfAADoT0g+AQBQ/6lzPnGq 8onTlU8clE8AAPQnJJ8AAKj/1DmfOFP5xNnKJ5ad7wAA6E9IPgEAUP+pcz6xXPnEuconbts/ AQDQn5B8AgCg/lPnfOJ85RMXKp/YtsP+CQCA/oTkEwAA9Z/65hMXK5+4VPnEfOUT9k8AAPQn JJ8AAKj/1CufuFz5xJXKJ/bJJwAA+hOSTwAA1H/qnE9crXziWuUT+53vAADoT0g+AQBQ/6lz PnG98okblU8s2D8BANCfkHwCAKD+U+d84mblE7cqn1i0fwIAoD8h+QQAQP2nzvnEJGNYYcn+ CQCA/oTkEwAA9Z865xOHxs93zg3D4fHzXXn/xPZh+Pe1fyKSTwAA9CcknwAAqP+03vnEkcon jlY+sVD5RPZOyCcAAPoTkk8AANR/6pFPHKt84njlE4v2TwAA9CcknwAAqP/UOZ84UfnEycon luyfAADoT0g+AQBQ/6lzPnGq8onTlU8clE8AAPQnJJ8AAKj/1DmfOFP5xNnKJ5ad7wAA6E9I PgEAUP+pcz6xXPnEuconbts/AQDQn5B8AgCg/lPnfOJ85RMXKp/YtsP+CQCA/oTkEwAA9Z/6 5hMXK5+4VPnEfOUT9k8AAPQnJJ8AAKj/1CufuFz5xJXKJ/bJJwAA+hOSTwAA1H/qnE9crXzi WuUT+53vAADoT0g+AQBQ/6lzPnG98okblU8s2D8BANCfkHwCAKD+U+d84mblE7cqn1i0fwIA oD8h+QQAQP2nzvnEJGNYYcn+CQCA/oTkEwAA9Z865xOHxs+3zw3D4fHzHXn/xPZheKr2TySj kE8AAPQnJJ8AAKj/tN75xJHKJ45WPrFQ+USyCfkEAEB/QvIJAID6Tz3yiWOVTxyvfGLR/gkA gP6E5BMAAPWfOucTJyqfOFn5xJL9EwAA/QnJJwAA6j91zidOVT5xuvKJg/IJAID+hOQTAAD1 nzrnE2cqnzhb+cSy8x0AAP0JyScAAOo/dc4nliufOFf5xG37JwAA+hOSTwAA1H/qnE+cr3zi QuUT23bYPwEA0J+QfAIAoP5T33ziYuUTlyqfmK98wv4JAID+hOQTAAD1n3rlE5crn7hS+cQ+ +QQAQH9C8gkAgPpPnfOJq5VPXKt8Yr/zHQAA/QnJJwAA6j91zieuVz5xo/KJBfsnAAD6E5JP AADUf+qcT9ysfOJW5ROL9k8AAPQnJJ8AAKj/1DmfmGQMKyzZPwEA0J+QfAIAoP5T53zi0Pj5 1rlhODx+vi3vn9g+DB+r/RORfAIAoD8h+QQAQP2n9c4njlQ+cbTyiYXKJ7J3Qj4BANCfkHwC AKD+U4984ljlE8crn1i0fwIAoD8h+QQAQP2nzvnEiconTlY+sWT/BABAf0LyCQCA+k+d84lT lU+crnzioHwCAKA/IfkEAED9p875xJnKJ85WPrHsfAcAQH9C8gkAgPpPnfOJ5conzlU+cdv+ CQCA/oTkEwAA9Z865xPnK5+4UPnEth32TwAA9CcknwAAqP/UN5+4WPnEpcon5iufsH8CAKA/ IfkEAED9p175xOXKJ65UPrFPPgEA0J+QfAIAoP5T53ziauUT1yqf2O98BwBAf0LyCQCA+k+d 84nrlU/cqHxiwf4JAID+hOQTAAD1nzrnEzcrn7hV+cSi/RMAAP0JyScAAOo/dc4nJhnDCkv2 TwAA9CcknwAAqP/UOZ84VPsnDo+fv5L3T2wfhkdq/0QyCvkEAEB/QvIJAID6T+udTxypfOJo 5RMLlU8km5BPAAD0JySfAACo/9QjnzhW+cTxyicW7Z8AAOhPSD4BAFD/qXM+caLyiZOVTyzZ PwEA0J+QfAIAoP5T53ziVOUTpyufOCifAADoT0g+AQBQ/6lzPnGm8omzlU8sO98BANCfkHwC AKD+U+d8YrnyiXOVT9y2fwIAoD8h+QQAQP2nzvnE+conLlQ+sW2H/RMAAP0JyScAAOo/9c0n LlY+canyifnKJ+yfAADoT0g+AQBQ/6lXPnG58okrlU/sk08AAPQnJJ8AAKj/1DmfuFr5xLXK J/Y73wEA0J+QfAIAoP5T53zieuUTNyqfWLB/AgCgPyH5BABA/afO+cTNyiduVT6xaP8EAEB/ QvIJAID6T53ziUnGsMKS/RMAAP0JyScAAOo/ddJ7hmHYMepnZqKCT4z65WliULzh7/7mb+Yf fUs0DL9RX+M3R/3wqL8/qn3dH6+/+3uT7zE3/osDu1e/x4fX+B47V/6bA7s/sf3irv+9opd3 fmLU3I7Hdn5rx8s7P76ii7u+NSr/3Xvre81eRwKV2fEtjXrxVca3NP4XS8Oj83/1cPTia/q6 d/u+3c3rzddNNtR8+NNRv17/nM/QPocH54Zt9Y/PPfPMd6VGvzD5GrPXud6efmDUT486uHqJ w8vj57fmvnNN24fh+c3nyYfm//LhaG1P1vvrtrmX57V9jyf2DsNjO1/Zpyf2PrbzpT0v73zj 3ujirpf2XNz1xN4Du7c9eHHXX++NXt657cGXd+a/az6tNYa3r/H1c30rY3g4eu/80hC9OKzP HL6/79Pje4bhoRrDne7T43se2vn4nm/vfv+D0UM73X/33/3/7q+b3+F8+9rc8KcPDMNbxr/4 8/Hzf42fnxi//pvHr788/vP/WSkm39/vcD48fu2n83ugudU63f65/Q4n//6VfocDAAAAAFuM tX7IwebypykR8Kym/x6bw6v4kgghSkIxq/z9rH/YGL+aV/El8Vd+DbN9WI2jmvLn/H3+ff47 vm28X/Gi+fTGYTU2jH6kPhOV5u/z7+PddN7xbWP8al7Fo92j/sGwGoNHP1Z/zt/Hv/x38Tf/ O7719ytzJn7Fi3gSj35qWP11cI5OJO7PZ/78k+Xfrpp3+d/xrb9fP1R+ZR7Fk7yG403D6tGU h0oP1p/z9/HuJ4bVX9vkf8e3/n5lLYxfmVs/O2rvqF8c9Y+H1V+f/Up9vmVY3XYR7zL34i/f Ns6vf1hz6OfLm7eNeueod436tfp8x6i3Dqu/Xsy8i7/xeS3f9JPr79fPlV+ZT/Em26/yq+f8 nvgDo943rP46+5FRv1pzMGsm3/rXr+ZX1rz4lV/bx5v49KFhdXtE9Nujfqs83Fe+/hLfNoVf mVvZ0hGffnfU74/6aH3+s/Lun5avWTv5tvF+ZS49Vh7tH/UHpY/Xn39v1EdGfXDGt6yrfLu7 Py+/Vr9+Z9THyqNsu/qjUX9cn39Yf595F18zH/m2OfzKvPqXo/5kWN0e3pQ/5+/5tvn8ypx6 YtQnR/2r0p/Vn/m2ef2KR/HqX4/6N/WZP8e3/PtX801fsjF+xavo307++ZV8m+1L+Nbfr3gV /bs7+LbWOtl88/PbxvrV9Hp8ezffNtwvvm1Nv16Pb+3nbr5tvF9825p+8W1r+sW378+v2d9/ 9faLb1vTL75tTb/4tjX9mvVtmk/eL75tRb/utm+z+yc3s29b2a/70bd7wa/7ybd7ya/7wbdX 8yv7RbeaX/eyb/eyX/eib/eDX/eSb/eTX/eCb2ud17vX/drKvq3l1zSfb+dTXm3/4XQ/W9sf tdn9+kF8m57raOeoevmWrzk9v5zvm++f68j15LryXGX/UvbD5Lpz/dmP3fb3tv2is3vapnNt M9azpnatzbOMI+PJnuXsV/4Xw+o+85wbyPmAnOvIeZycs8r5uJx/y7nFnEtt54Sn5/LXY47l 62cPfb5fzrnmPGzOv+Z6cr7r7cPqeaKcQ3l0WD3f8M8ncyxja/Os+da8W8u/zeDV1Kfm1XS/ a8aTceWZzLOZNSVrS87n5CxVzsHl/NubR80Pq+dNc044NSW9QO7nepxZbJ5N18TMsazRs2ti m2PtjEo8y1jyHDbfMt8y1jyjU//W8m4j18DZOZVrjXLduf6MI/U543p84tn0LM6d1sjMtaxV 6zXX2ro4PbeXZyVnmPfUM5RnKecqp+eKcu1Z4+Nb1o3Mt4wt/k3PQtxpzdzI7Gq2brW9/7ne eJTrzzgynowr48s4Uwsyz6bnp/Is56xw+rPkQqn/6QPW+j3Aeq6LWZen62LOxTbPcq1ZG1LP cv3TM2F5DpuHeS4z5ox/um5uZH8y7TOm61+er1xnm085I5VxZDwZW+pYxpnx5nlN//WBmmfN s7Y+5llPXZldH9fDs8zjeJZ5PfUs15JrSv+RepZXP+d6M9/iXWpbnruMZdbH6do5e06it2d3 6gvbmag8Z82jrCHZE5nxtDOlGWe8Sm1ITc/zm3PBWRtTO3JGf+pZnv3m2d1cH1/Js3zvXEPm fNbrdgY9dTc9U9aFXHc8TD1u55wzpniZcca/3IPcj9yXzLe2Tvaea7NzrM2vzK129jA+tTO/ GUfGk7FljFHGm7mVZzf3oZ3BT++Yepa1MX1IL8/Wes9D+tfUtPQhWSPT7+ca41/63FxzFC+z RmQcGU/8jIcZe/uZIL61nwk2Yq41z/J9pz188yvzKWtHO1ufcaQeZFxtnBlzlPFn7cmznHUo fuX5ztqUHqTVs/XoHdf6WTr9zvTdN7mO9j6VvM8h/mXuZS3I9UbxM89a8zTjy7rRepY8v6l3 LSvJPdsIz6ZzrP2snOcpfrWzGHnu4ks8yXgyrjbOKOPO+HMfcj/iVe5P1qXcr/ZOoNl3Od3N etb6xulca+8syvfPOpleKNcU/9LP5hqnypqQa88Ypmtpxp81JbUgNa7NtZZvbYRnrY5ljqXe pnZlPcjzlTnV1rp4knqecWV80/HmHkzf3xSvcp8yv6bvcLrb6+Kd5lqejfiW7zt9N1j8y9zL tWX+zyq+ZgwZX9aKjDs/h6f25RnOXEuNz71q62Pu4UZ4lnUxc77lUalbWRfynLX3w7S5k3HN jjX3IGrvSsvPs7lPuV+zfq3Xz9SzvrV3hMW7zPFcR3sHX5Rnaapcb647Y8hzN/1ZPDUhtS3r T1sfc882wrNWy7I+Z11MHcsakLUgNTnrQ3ufT7zKeDKu2fFG7V5M30mY+9XeKTnr13rkV3d6 z2V71+Xs+y6navOyZV7xLWtKntnUtqw7uTe5R7lXuWcb6VlqWdbprNdZF9MLZo6lVk1/Lo4n zYs7jb3dm3av2vs/19OvWd+m7/19pXfKTtXW1PazQsuWU9tyL3JPcm9yj5pnuXcb4VnrP9Iv 5meRrNvpEdNzZE1PnVqrV38ltfu01nt2e/7Oevo9X03Tn/GyVrR8OfcgNT01Lf1j60Nyz3p7 1vr8eJY+qHmWXCe1LD1ieo6sEZljLS+cnS+vRVuFlllmrBlz6ndqQ57fPMfxLD3aZvEsPWP6 oniW/jae5eeZrIupYVkzsn7Er3uVjG0re5b+g2c84xnPeMYznvGMZzzjGc94xjOe8YxnPOMZ z3jGM57xjGc84xnPeMYznvGMZzzjGc94xjOe8YxnPOMZz3jGM57xjGc84xnPeMYznvGMZzzj Gc94xjOe8YxnPOMZz3jGM57xjGc84xnPeMYznvGMZzzjGc94xjOe8YxnPOMZz3jGM57xjGc8 4xnPeMYznvGMZzzjGc94xjOe8YxnPOMZz3jGM57xjGc84xnPeMYznvGMZzzjGc94xjOe8Yxn POMZz3jGM57xjGc84xnPeMYznvGMZzzjGc94xjOe8YxnPOMZz3jGM57xjGc84xnPeMYznvGM ZzzjGc94xjOe8YxnPOMZz3jGM57xjGc84xnPeMYznvGMZzzjGc94xjOe8YxnPOMZz3jGM57x jGc84xnPeMYznvGMZzzjGc94xjOe8YxnPOMZz3jGM57xjGc84xnPeMYznvGMZzzjGc94xjOe 8YxnPOMZz3jGs3vZs7lRD4zaPuqHR/1YefZQebZvC3j2S6P2jvrpiWd5BuNZxreZ7/1Uud7X oviVZ/KHRv3IqJ8Y9TOjfn7UW0e9e9Rvjfrd8uyPNoFn+0f9zqgPjnpk1C/XupBnLc9cnr0d Na6M77Xei+n96+HV1IM3lHLNTXnu1lLmV/zKOLMuZn35uVG/OOrto94z6kOjfm/UxzfIs3yf 5lnmeZ6dzPvM/6wDebbyjP3sqJ8ctbvW+fh2p3FH0/uT+5V71zxeL/+mfjWvmj/xItccP7JW RBnHrOLVrvIr480cyzqTGvHOUe8d9dujfn/UH5Rnn9wgz/KsNM8y7/Ms5Zn61VEPV03LXMta kTUy68ZaY47aPcn9yX3K/Wo+Nv/WY22d9Svfs/mU68o1x488dxlDfJlV1pKMMfMrfmXcmWN5 drPufGDUR0Z9bNTjo/54gzzL94tneWby7OQZyrP0vlHvqvXxF0bNj/pHo35q1I/X+GbHnHsR 5b7k/uS5zf3KfYt36+lb82zqV56deJXraX5k/sST1Og8h1NlfPEq62HmV/zK+DPH8gynlmUd Sg35w1F/MurPNsizPCt5ZvLs5BlKH5KalvUxcy29SHzLc/emGtfseKPch3ia+xJf42PuV7zL /Wu+3W3PpnMsXz/fp/mVa2hzJ55knY8nGUt8Sb1uSn+YWhCvsh5mfsWv3IfMsQ/XM51alnUp NSWepS/o7Vm+b56Z9CFtfXx01PvrZ5J3VK/7lhpPxjUda8Ye5T7kfuS+xMM2JzP34lubb22u 3W3P2hxrfUS+b56fXEuetVxjrv3NNZb4kucxcynji+JT+o14lfUw8yt+5X5kjqW3buti1qfU lt6e5fvFs+n6mLmW/jF1Lb6lx03vH+8ynowr48tYo4w742+e5nmNf/Eucy/P+bR/udtzbepZ m2NZm/O85PvHrzxb8SrX+7YaS9b+jCve5NmMMtb4lH4jXmU9zPyKX7kvuT9tjrVathGe5VnJ 989cy/Vk7n+0fEttSx8Z7zKOjCdrRRtjxptx/5O6D7kf8TDe5bmOb1mXUk+yVmUOZC7k/q6n Z3lG8qxkPWy9RPzKWp/rjTcZT8aVn0dTC6J4lGc1406/Ea+yHmZ+Nb9yn9oca5718GvqWVsf cx2Z81kj41ueq/wsEu/yrGV9yHjiYcaXseZZzLh/o7zMs5u52GpgepesTXnm8+xvhGd5dtL/ Zn3I9cWvXHPGkTFlbKnhGWc8Sm2IT3lu41XuRdbDqV+t9+g5x9aaa1Pfcn25ztS3XHeuP/5l PBlXxpdxZrzxMR6m14xvqQVZO/Nst58TZj1bj7UxX7PVs7Y2tnkWz7IGZI7l+cr1Zi5lHBlX 8yc9YcbcfEp/mHuRe5L1sPk1nWMb5Vm+/9S3PE+pb7neXHeuP+PIeDKuzMGMMx7GuzyvmXdZ O7NONs8yz1JTpmtjq2d3u9dvfWNqZssy8r1blpFryjyLZ5ljed5y/RlLxpW1r3mUscen3Ifm VepH82qj/GqereVbri/XmevNdef6M46smxlXxpdxxrfMuzyzzbPMs9SO9Gip/+kf08NNe5D1 /Pks62O+V9bHlmekB0mflJqbtTHXmmuOZ61WZWwZY1v/cg+i6bxqXjW/NsKzWd+ad6/kX/Ou 1bx4Nv3ZIPUsPWTqSNam1JWsVS1jvpu17E4/o+XZyLzO/J7OtVbT0n+k38ja2PrBjGlar9by aaO9Wsu3qXez/jXvpn1K5lnWxqw1bV2cnWNZo2bz5fXIi2d/Tpv2/Kmpra7lmcqzlWeszbWW bbSfu6Y9xmby6fXMvTbnMtcyz1LfsqZkjqUHSf+R+p7n+E51bL3m2PfTQzbf0vfGt/QhWevz LE5/Xt7IuvWD1rlpT5nnsfmVNXHqV35une3v13NN5NvW9+tu+rbWz86b0bcfxK/Zn8U2yq/7 ybd7ya8fxLf83LYVfHstfrW8f6v4dS/7di/7dS/6dj/49Xp8SxawmX27n/y6F3y7H/3ayr7d z35tRd/4tbV849fW8o1fW8s3fm0t3/i1tXzj19by7dX8yu9l+bV5fOPX1vKNX1vLt9fjV/av 8GtjfXu9fmWfPb821rfp3rbX4lf2QfNrY3xr+/Bm927za3P61vZzfbK8ymf2H/Jr8/oWX9r+ 8um+7LZflF+bx7e2n2t6NmB69mG6P4pfm8e3dr73o7UGRvEqZ93audr8/MWvjfVt9nxAznW0 86PtHF/Wzpx3yLmP/PzFr83jWzuvmDkXj+JfPvPnnE/JeR0/f20u39q7K6Zn7fOZtTDn4nKe qJ1P4dfG+5Z5k/Pl7b0jOYsfZf6193jk/FfOyeU8Eb821rfpOy8y5+Jd1r/MvXzGq9l3PPBr Y33L/Y8POT+ZNa+9Cyhr4PQdODlHnPOVPc/r4c6+tfcCxbt4E/8yp/KZ9TN/394zxa+N9629 M22t99tN3+cWb9t7Fvm18b61d6fNvkdy+t7E9s7E9XpfIl6fb9P3gM6+q7W9I3E932+J1+/b 7Dt3ZzX7HmBsLu/uJAAAAAAA7ir5ZW7CuLzs9EdHLY16cVjdtJRf7Db+X5EAaGn8L5aGD83/ 5cPRiyu/0M/XyC/yE8YmLGpfN7/cyt/lh9r2PZ7YOwyP7Vz9HtmsMfs9EvY+sfexnS/teXnn G/dGF3e9tOfirif2Hti97cGLu/56b/Tyzm0Pvrwz/102etxpDG9f4+vn+lbG8HD03vmlIXpx ZcNIvs7seHLts/fp8T3D8FCN4U736fE9D+18fM+3d7//weihna/l6zZe6euu8jfzj74l+t7r nd7/9fq6zdeES1NfD+x+NV8P7I6X8TTexuN4GC/jabyNx/nvXo8f9/r4Xvu8fHT+rx6Ovnde 3o/37aU931lr7jS+l/ZkrXlh964Ho8fWnKfPjvqLyQ1r//ul8es/tXt140U0/ptJfvd89qh9 zz+P/7OVz4Vh9YW8f5E//Ojqxo2o/X9IFc2N/zdB7neZ9Z2raP/v764HAHB/8cwzz9F9LACA +k/3n1o+8eQDw/A/54bhqfHzxfHzoHwCAKA/IfkEAED9p875xKcqn3i68onlyidyWF4+AQDQ n5B8AgCg/lOPfOLTlU98pvKJ2/ZPAAD0JySfAACo/9Q5n3im8olnK5/Yttf+CQCA/oTkEwAA 9Z/65hOfrXzic5VPzFc+Yf8EAEB/QvIJAID6T73yiecqn/h85RP75BMAAP0JyScAAOo/dc4n vlD5xBcrn9jvfAcAQH9C8gkAgPpPnfOJL1U+8eXKJxbsnwAA6E9IPgEAUP+pcz7xlconnq98 YtH+CQCA/oTkEwAA9Z865xMHKp/4auUTS/ZPAAD0JySfAACo/9Q5n/ha5RNfr3zioHwCAKA/ IfkEAED9p875xGLlE9+ofGLZ+Q4AgP6E5BMAAPWfOucTL1Q+8c3KJ27bPwEA0J+QfAIAoP5T 53xikjGssLRnGD5W+UT2UMgnAAD6E5JPAADUf1rvfOLJB4bhv88Nw1Pj5//I+yfkEwAA/QnJ JwAA6j91zic+VfnE05VPLFc+kWxCPgEA0J+QfAIAoP5Tj3zi05VPfKbyidv2TwAA9CcknwAA qP/UOZ94pvKJZyuf2LbX/gkAgP6E5BMAAPWf+uYTn6184nOVT8xXPmH/BABAf0LyCQCA+k+9 8onnKp/4fOUT++QTAAD9CcknAADqP3XOJ75Q+cQXK5/Y73wHAEB/QvIJAID6T53ziS9VPvHl yicW7J8AAOhPSD4BAFD/qXM+8ZXKJ56vfGLR/gkAgP6E5BMAAPWfOucTByqf+GrlE0v2TwAA 9CcknwAAqP/UOZ/4WuUTX6984qB8AgCgPyH5BABA/afO+cRi5RPfqHxi2fkOAID+hOQTAAD1 nzrnEy9UPvHNyidu2z8BANCfkHwCAKD+U+d8YpIxrLC0ZxgeqXwikk8AAPQnJJ8AAKj/tN75 xJMPDMN/nRuGp8bP/5b3T8gnAAD6E5JPAADUf+qcT3yq8omnK59YrnwiZzvkEwAA/QnJJwAA 6j/1yCc+XfnEZyqfuG3/BABAf0LyCQCA+k+d84lnKp94tvKJbXvtnwAA6E9IPgEAUP+pbz7x 2conPlf5xHzlE/ZPAAD0JySfAACo/9Qrn3iu8onPVz6xTz4BANCfkHwCAKD+U+d84guVT3yx 8on9zncAAPQnJJ8AAKj/1Dmf+FLlE1+ufGLB/gkAgP6E5BMAAPWfOucTX6l84vnKJxbtnwAA 6E9IPgEAUP+pcz5xoPKJr1Y+sWT/BABAf0LyCQCA+k+d84mvVT7x9conDsonAAD6E5JPAADU f+qcTyxWPvGNyieWne8AAOhPSD4BAFD/qXM+8ULlE9+sfOK2/RMAAP0JyScAAOo/dc4nJhnD Ckt7huFN8gkAgP6E5BMAAPWfOuYTTz4wDP95bhieGj//S94/IZ8AAOhPSD4BAFD/qXM+8anK J56ufGK58gnvnwAA6E9IPgEAUP+pVz7x6conPlP5xG37JwAA+hOSTwAA1H/qnE88U/nEs5VP bNtr/wQAQH9C8gkAgPpPffOJz1Y+8bnKJ+Yrn7B/AgCgPyH5BABA/ade+cRzlU98vvKJffIJ AID+hOQTAAD1nzrnE1+ofOKLlU/sd74DAKA/IfkEAED9p875xJcqn/hy5RML9k8AAPQnJJ8A AKj/1Dmf+ErlE89XPrFo/wQAQH9C8gkAgPpPnfOJA5VPfLXyiSX7JwAA+hOSTwAA1H/qnE98 rfKJr1c+cVA+AQDQn5B8AgCg/lPnfGKx8olvVD6x7HwHAEB/QvIJAID6T53ziRcqn/hm5RO3 7Z8AAOhPSD4BAFD/qXM+MckYVljaMwxvqHwieyjkEwAA/QnJJwAA6j+tdz7x5APD8B/nhuGp 8fM/5f0T8gkAgP6E5BMAAPWfOucTn6p84unKJ5Yrn0g2IZ8AAOhPSD4BAFD/qUc+8enKJz5T +cRt+ycAAPoTkk8AANR/6pxPPFP5xLOVT2zba/8EAEB/QvIJAID6T33zic9WPvG5yifmK5+w fwIAoD8h+QQAQP2nXvnEc5VPfL7yiX3yCQCA/oTkEwAA9Z865xNfqHzii5VP7He+AwCgPyH5 BABA/afO+cSXKp/4cuUTC/ZPAAD0JySfAACo/9Q5n/hK5RPPVz6xaP8EAEB/QvIJAID6T53z iQOVT3y18okl+ycAAPoTkk8AANR/6pxPfK3yia9XPnFQPgEA0J+QfAIAoP5T53xisfKJb1Q+ sex8BwBAf0LyCQCA+k+d84kXKp/4ZuUTt+2fAADoT0g+AQBQ/6lzPjHJGFZY2jMMf7trNZ+I 5BMAAP0JyScAAOo/rXc+8eQDw/Dnc8Pw1Pj5H/L+CfkEAOD/s3OvKQ2H6RmHX3HIp3YJg7qK 4hpKD9PQAy090NJSExNyIGmMaKNO0pjSJQxZxuAyhuxiyCLq37k/uAGfT9cFNy7hefnxj94n pk8A4P5bcZ8Ypk+M0idO6RPdbzv0CQC8T0yfAMD9t4o+MU6fmKRPnH0/AYD3iekTALj/Vtwn pukTs/SJ3o3vJwDwPjF9AgD332r7xDx9YpE+cZU+4fsJALxPTJ8AwP23qj6xTJ9YpU/c6hMA eJ+YPgGA+2/FfeIhfWKdPtH3+w4AvE9MnwDA/bfiPvGYPvGUPnHv+wkAvE9MnwDA/bfiPvGc PrFJn9j5fgIA7xPTJwBw/624T7ykT7ymTxx9PwGA94npEwC4/1bcJ97SJ7bpEx/6BADeJ6ZP AOD+W3Gf2KVP7NMnTn7fAYD3iekTALj/Vtwn3tMnDukTZ99PAOB9YvoEAO6/FfeJb43hy/G6 td+lT3TfUOgTAHifmD4BgPtvP90n7i5b+9+L1gaff/+v+/8T+gQA3iemTwDg/ltxnximT4zS J07pE12b0CcA8D4xfQIA998q+sQ4fWKSPnH2/QQA3iemTwDg/ltxn5imT8zSJ3o3vp8AwPvE 9AkA3H+r7RPz9IlF+sRV+oTvJwDwPjF9AgD336r6xDJ9YpU+catPAOB9YvoEAO6/FfeJh/SJ dfpE3+87APA+MX0CAPffivvEY/rEU/rEve8nAPA+MX0CAPffivvEc/rEJn1i5/sJALxPTJ8A wP234j7xkj7xmj5x9P0EAN4npk8A4P5bcZ94S5/Ypk986BMAeJ+YPgGA+2/FfWKXPrFPnzj5 fQcA3iemTwDg/ltxn3hPnzikT5x9PwGA94npEwC4/1bcJ741hi/H69Z+mz7RTZ8AwPvE9AkA 3H/76T5xd9na/qK1weffQ/f/J/QJALxPTJ8AwP234j4xTJ8YpU+c0ie633boEwB4n5g+AYD7 bxV9Ypw+MUmfOPt+AgDvE9MnAHD/rbhPTNMnZukTvRvfTwDgfWL6BADuv9X2iXn6xCJ94ip9 wvcTAHifmD4BgPtvVX1imT6xSp+41ScA8D4xfQIA99+K+8RD+sQ6faLv9x0AeJ+YPgGA+2/F feIxfeIpfeLe9xMAeJ+YPgGA+2/FfeI5fWKTPrHz/QQA3iemTwDg/ltxn3hJn3hNnzj6fgIA 7xPTJwBw/624T7ylT2zTJz70CQC8T0yfAMD9t+I+sUuf2KdPnPy+AwDvE9MnAHD/rbhPvKdP HNInzr6fAMD7xPQJANx/K+4T3xrDl+N1a7/RJwDwPjF9AgD33wr7xN1la7uL1gaff/+n+/8T +gQA3iemTwDg/ltxnximT4zSJ07pE/7/BADeJ6ZPAOD+W1WfGKdPTNInzr6fAMD7xPQJANx/ K+4T0/SJWfpE78b3EwB4n5g+AYD7b7V9Yp4+sUifuEqf8P0EAN4npk8A4P5bVZ9Ypk+s0idu 9QkAvE9MnwDA/bfiPvGQPrFOn+j7fQcA3iemTwDg/ltxn3hMn3hKn7j3/QQA3iemTwDg/ltx n3hOn9ikT+x8PwGA94npEwC4/1bcJ17SJ17TJ46+nwDA+8T0CQDcfyvuE2/pE9v0iQ99AgDv E9MnAHD/rbhP7NIn9ukTJ7/vAMD7xPQJANx/K+4T7+kTh/SJs+8nAPA+MX0CAPffivvEt8bw 5Xjd2q/TJ7pvKPQJALxPTJ8AwP23n+4Td5etvV20Nvj8u+3+/4Q+AYD3iekTALj/VtwnhukT o/SJU/pE1yb0CQC8T0yfAMD9t4o+MU6fmKRPnH0/AYD3iekTALj/VtwnpukTs/SJ3o3vJwDw PjF9AgD332r7xDx9YpE+cZU+4fsJALxPTJ8AwP23qj6xTJ9YpU/c6hMAeJ+YPgGA+2/FfeIh fWKdPtH3+w4AvE9MnwDA/bfiPvGYPvGUPnHv+wkAvE9MnwDA/bfiPvGcPrFJn9j5fgIA7xPT JwBw/624T7ykT7ymTxx9PwGA94npEwC4/1bcJ97SJ7bpEx/6BADeJ6ZPAOD+W3Gf2KVP7NMn Tn7fAYD3iekTALj/Vtwn3tMnDukTZ99PAOB9YvoEAO6/FfeJb43hy/G6tUH6RDd9AgDvE9Mn AHD/7af7xN1la5uL1gaff1+7/z+hTwDgfWL6BADuvxX3iWH6xCh94pQ+0f22Q58AwPvE9AkA 3H+r6BPj9IlJ+sTZ9xMAeJ+YPgGA+2/FfWKaPjFLn+jd+H4CAO8T0ycAcP+ttk/M0ycW6RNX 6RO+nwDA+8T0CQDcf6vqE8v0iVX6xK0+AYD3iekTALj/VtwnHtIn1ukTfb/vAMD7xPQJANx/ K+4Tj+kTT+kT976fAMD7xPQJANx/K+4Tz+kTm/SJne8nAPA+MX0CAPffivvES/rEa/rE0fcT AHifmD4BgPtvxX3iLX1imz7xoU8A4H1i+gQA7r8V94ld+sQ+feLk9x0AeJ+YPgGA+2/FfeI9 feKQPnH2/QQA3iemTwDg/ltxn/jWGL4cr1v7VfpE9w2FPgGA94npEwC4//bTfeLusrXni9YG n3//u/v/E/oEAN4npk8A4P5bcZ8Ypk+M0idO6RNdm9AnAPA+MX0CAPffKvrEOH1ikj5x9v0E AN4npk8A4P5bcZ+Ypk/M0id6N76fAMD7xPQJANx/q+0T8/SJRfrEVfqE7ycA8D4xfQIA99+q +sQyfWKVPnGrTwDgfWL6BADuvxX3iYf0iXX6RN/vOwDwPjF9AgD334r7xGP6xFP6xL3vJwDw PjF9AgD334r7xHP6xCZ9Yuf7CQC8T0yfAMD9t+I+8ZI+8Zo+cfT9BADeJ6ZPAOD+W3GfeEuf 2KZPfOgTAHifmD4BgPtvxX1ilz6xT584+X0HAN4npk8A4P5bcZ94T584pE+cfT8BgPeJ6RMA uP9W3Ce+NYYvx+vW/iR9ops+AYD3iekTALj/9tN94u6ytceL1gaff5+6/z+hTwDgfWL6BADu vxX3iWH6xCh94pQ+0f22Q58AwPvE9AkA3H+r6BPj9IlJ+sTZ9xMAeJ+YPgGA+2/FfWKaPjFL n+jd+H4CAO8T0ycAcP+ttk/M0ycW6RNX6RO+nwDA+8T0CQDcf6vqE8v0iVX6xK0+AYD3iekT ALj/VtwnHtIn1ukTfb/vAMD7xPQJANx/K+4Tj+kTT+kT976fAMD7xPQJANx/K+4Tz+kTm/SJ ne8nAPA+MX0CAPffivvES/rEa/rE0fcTAHifmD4BgPtvxX3iLX1imz7xoU8A4H1i+gQA7r8V 94ld+sQ+feLk9x0AeJ+YPgGA+2/FfeI9feKQPnH2/QQA3iemTwDg/ltxn/jWGL4cr1v7pT4B gPeJ6RMAuP9W2CfuLltbXbQ2+Py77v7/hD4BgPeJ6RMAuP9W3CeG6ROj9IlT+oT/PwGA94np EwC4/1bVJ8bpE5P0ibPvJwDwPjF9AgD334r7xDR9YpY+0bvx/QQA3iemTwDg/lttn5inTyzS J67SJ3w/AYD3iekTALj/VtUnlukTq/SJW30CAO8T0ycAcP+tuE88pE+s0yf6ft8BgPeJ6RMA uP9W3Cce0yee0ifufT8BgPeJ6RMAuP9W3Cee0yc26RM7308A4H1i+gQA7r8V94mX9InX9Imj 7ycA8D4xfQIA99+K+8Rb+sQ2feJDnwDA+8T0CQDcfyvuE7v0iX36xMnvOwDwPjF9AgD334r7 xHv6xCF94uz7CQC8T0yfAMD9t+I+8a0xfDlet/aL9InuGwp9AgDvE9MnAHD/7af7xN1la8uL 1gaff/+r+/8T+gQA3iemTwDg/ltxnximT4zSJ07pE12b0CcA8D4xfQIA998q+sQ4fWKSPnH2 /QQA3iemTwDg/ltxn5imT8zSJ3o3vp8AwPvE9AkA3H+r7RPz9IlF+sRV+oTvJwDwPjF9AgD3 36r6xDJ9YpU+catPAOB9YvoEAO6/FfeJh/SJdfpE3+87APA+MX0CAPffivvEY/rEU/rEve8n APA+MX0CAPffivvEc/rEJn1i5/sJALxPTJ8AwP234j7xkj7xmj5x9P0EAN4npk8A4P5bcZ94 S5/Ypk986BMAeJ+YPgGA+2/FfWKXPrFPnzj5fQcA3iemTwDg/ltxn3hPnzikT5x9PwGA94np EwC4/1bcJ741hi/H69Z+/8d/6BPd9AkAvE9MnwDA/bef7hN3l63NL1obfP5ddP9/Qp8AwPvE 9AkA3H8r7hPD9IlR+sQpfaL7bYc+AYD3iekTALj/VtEnxukTk/SJs+8nAPA+MX0CAPffivvE NH1ilj7Ru/H9BADeJ6ZPAOD+W22fmKdPLNInrtInfD8BgPeJ6RMAuP9W1SeW6ROr9IlbfQIA 7xPTJwBw/624TzykT6zTJ/p+3wGA94npEwC4/1bcJx7TJ57SJ+59PwGA94npEwC4/1bcJ57T JzbpEzvfTwDgfWL6BADuvxX3iZf0idf0iaPvJwDwPjF9AgD334r7xFv6xDZ94kOfAMD7xPQJ ANx/K+4Tu/SJffrEye87APA+MX0CAPffivvEe/rEIX3i7PsJALxPTJ8AwP234j7xrTF8OV63 9rv0ie4bCn0CAO8T0ycAcP/tp/vE3WVr04vWBp9/Z93/n9AnAPA+MX0CAPffivvEMH1ilD5x Sp/o2oQ+AYD3iekTALj/VtEnxukTk/SJs+8nAPA+MX0CAPffivvENH1ilj7Ru/H9BADeJ6ZP AOD+W22fmKdPLNInrtInfD8BgPeJ6RMAuP9W1SeW6ROr9IlbfQIA7xPTJwBw/624TzykT6zT J/p+3wGA94npEwC4/1bcJx7TJ57SJ+59PwGA94npEwC4/1bcJ57TJzbpEzvfTwDgfWL6BADu vxX3iZf0idf0iaPvJwDwPjF9AgD334r7xFv6xDZ94kOfAMD7xPQJANx/K+4Tu/SJffrEye87 APA+MX0CAPffivvEe/rEIX3i7PsJALxPTJ8AwP234j7xrTF8OV639tv0iW76BADeJ6ZPAOD+ 20/3ibvL1sYXrQ0+/066/z+hTwDgfWL6BADuvxX3iWH6xCh94pQ+0f22Q58AwPvE9AkA3H+r 6BPj9IlJ+sTZ9xMAeJ+YPgGA+2/FfWKaPjFLn+jd+H4CAO8T0ycAcP+ttk/M0ycW6RNX6RO+ nwDA+8T0CQDcf6vqE8v0iVX6xK0+AYD3iekTALj/VtwnHtIn1ukTfb/vAMD7xPQJANx/K+4T j+kTT+kT976fAMD7xPQJANx/K+4Tz+kTm/SJne8nAPA+MX0CAPffivvES/rEa/rE0fcTAHif mD4BgPtvxX3iLX1imz7xoU8A4H1i+gQA7r8V94ld+sQ+feLk9x0AeJ+YPgGA+2/FfeI9feKQ PnH2/QQA3iemTwDg/ltxn/jWGL4cr1v7jT4BgPeJ6RMAuP9W2CfuLlsbXrQ2+Pw76v7/hD4B gPeJ6RMAuP9W3CeG6ROj9IlT+oT/PwGA94npEwC4/1bVJ8bpE5P0ibPvJwDwPjF9AgD334r7 xDR9YpY+0bvx/QQA3iemTwDg/lttn5inTyzSJ67SJ3w/AYD3iekTALj/VtUnlukTq/SJW30C AO8T0ycAcP+tuE88pE+s0yf6ft8BgPeJ6RMAuP9W3Cce0yee0ifufT8BgPeJ6RMAuP9W3Cee 0yc26RM7308A4H1i+gQA7r8V94mX9InX9Imj7ycA8D4xfQIA99+K+8Rb+sQ2feJDnwDA+8T0 CQDcfyvuE7v0iX36xMnvOwDwPjF9AgD334r7xHv6xCF94uz7CQC8T0yfAMD9t+I+8a0xfDle t/br9InuGwp9AgDvE9MnAHD/7af7xN3l5y5aG3z+HXT/f0KfAMD7xPQJANx/K+4Tw/SJUfrE KX2iaxP6BADeJ6ZPAOD+W0WfGKdPTNInzr6fAMD7xPQJANx/K+4T0/SJWfpE78b3EwB4n5g+ AYD7b7V9Yp4+sUifuEqf8P0EAN4npk8A4P5bVZ9Ypk+s0idu9QkAvE9MnwDA/bfiPvGQPrFO n+j7fQcA3iemTwDg/ltxn3hMn3hKn7j3/QQA3iemTwDg/ltxn3hOn9ikT+x8PwGA94npEwC4 /1bcJ17SJ17TJ46+nwDA+8T0CQDcfyvuE2/pE9v0iQ99AgDvE9MnAHD/rbhP7NIn9ukTJ7/v AMD7xPQJANx/K+4T7+kTh/SJs+8nAPA+MX0CAPffivvEt8bw5Xjd2iB9ops+AYD3iekTALj/ 9tN94u6ytf+4aG3w+fc/u/8/oU8A4H1i+gQA7r8V94lh+sQofeKUPtH9tkOfAMD7xPQJANx/ q+gT4/SJSfrE2fcTAHifmD4BgPtvxX1imj4xS5/o3fh+AgDvE9MnAHD/rbZPzNMnFukTV+kT vp8AwPvE9AkA3H+r6hPL9IlV+sStPgGA94npEwC4/1bcJx7SJ9bpE32/7wDA+8T0CQDcfyvu E4/pE0/pE/e+nwDA+8T0CQDcfyvuE8/pE5v0iZ3vJwDwPjF9AgD334r7xEv6xGv6xNH3EwB4 n5g+AYD7b8V94i19Yps+8aFPAOB9YvoEAO6/FfeJXfrEPn3i5PcdAHifmD4BgPtvxX3iPX3i kD5x9v0EAN4npk8A4P5bcZ/41hi+HK9b+1X6RPcNhT4BgPeJ6RMAuP/2033i7rK1f7tobfD5 99+7/z+hTwDgfWL6BADuvxX3iWH6xCh94pQ+0bUJfQIA7xPTJwBw/62iT4zTJybpE2ffTwDg fWL6BADuvxX3iWn6xCx9onfj+wkAvE9MnwDA/bfaPjFPn1ikT1ylT/h+AgDvE9MnAHD/rapP LNMnVukTt/oEAN4npk8A4P5bcZ94SJ9Yp0/0/b4DAO8T0ycAcP+tuE88pk88pU/c+34CAO8T 0ycAcP+tuE88p09s0id2vp8AwPvE9AkA3H8r7hMv6ROv6RNH308A4H1i+gQA7r8V94m39Ilt +sSHPgGA94npEwC4/1bcJ3bpE/v0iZPfdwDgfWL6BADuvxX3iff0iUP6xNn3EwB4n5g+AYD7 b8V94ltj+HK8bu1P0ie66RMAeJ+YPgGA+28/3SfuLlv7l4vWBp9//7X7/xP6BADeJ6ZPAOD+ W3GfGKZPjNInTukT3W879AkAvE9MnwDA/beKPjFOn5ikT5x9PwGA94npEwC4/1bcJ6bpE7P0 id6N7ycA8D4xfQIA999q+8Q8fWKRPnGVPuH7CQC8T0yfAMD9t6o+sUyfWKVP3OoTAHifmD4B gPtvxX3iIX1inT7R9/sOALxPTJ8AwP234j7xmD7xlD5x7/sJALxPTJ8AwP234j7xnD6xSZ/Y +X4CAO8T0ycAcP+tuE+8pE+8pk8cfT8BgPeJ6RMAuP9W3Cfe0ie26RMf+gQA3iemTwDg/ltx n9ilT+zTJ05+3wGA94npEwC4/1bcJ97TJw7pE2ffTwDgfWL6BADuvxX3iW+N4cvxurVf6hMA eJ+YPgGA+2+FfeLusrV/umht8Pn3n7v/P6FPAOB9YvoEAO6/FfeJYfrEKH3ilD7h/08A4H1i +gQA7r9V9Ylx+sQkfeLs+wkAvE9MnwDA/bfiPjFNn5ilT/RufD8BgPeJ6RMAuP9W2yfm6ROL 9Imr9AnfTwDgfWL6BADuv1X1iWX6xCp94lafAMD7xPQJANx/K+4TD+kT6/SJvt93AOB9YvoE AO6/FfeJx/SJp/SJe99PAOB9YvoEAO6/FfeJ5/SJTfrEzvcTAHifmD4BgPtvxX3iJX3iNX3i 6PsJALxPTJ8AwP234j7xlj6xTZ/40CcA8D4xfQIA99+K+8QufWKfPnHy+w4AvE9MnwDA/bfi PvGePnFInzj7fgIA7xPTJwBw/624T3xrDF+O1639In2i+4ZCnwDA+8T0CQDcf/vpPnF32do/ XLQ2+Pz7j93/n9AnAPA+MX0CAPffivvEMH1ilD5xSp/o2oQ+AYD3iekTALj/VtEnxukTk/SJ s+8nAPA+MX0CAPffivvENH1ilj7Ru/H9BADeJ6ZPAOD+W22fmKdPLNInrtInfD8BgPeJ6RMA uP9W1SeW6ROr9IlbfQIA7xPTJwBw/624TzykT6zTJ/p+3wGA94npEwC4/1bcJx7TJ57SJ+59 PwGA94npEwC4/1bcJ57TJzbpEzvfTwDgfWL6BADuvxX3iZf0idf0iaPvJwDwPjF9AgD334r7 xFv6xDZ94kOfAMD7xPQJANx/K+4Tu/SJffrEye87APA+MX0CAPffivvEe/rEIX3i7PsJALxP TJ8AwP234j7xrTF8OV639vs/+kOf6KZPAOB9YvoEAO6//XSfuLts7e8uWht8/v377v9P6BMA eJ+YPgGA+2/FfWKYPjFKnzilT3S/7dAnAPA+MX0CAPffKvrEOH1ikj5x9v0EAN4npk8A4P5b cZ+Ypk/M0id6N76fAMD7xPQJANx/q+0T8/SJRfrEVfqE7ycA8D4xfQIA99+q+sQyfWKVPnGr TwDgfWL6BADuvxX3iYf0iXX6RN/vOwDwPjF9AgD334r7xGP6xFP6xL3vJwDwPjF9AgD334r7 xHP6xCZ9Yuf7CQC8T0yfAMD9t+I+8ZI+8Zo+cfT9BADeJ6ZPAOD+W3GfeEuf2KZPfOgTAHif mD4BgPtvxX1ilz6xT584+X0HAN4npk8A4P5bcZ94T584pE+cfT8BgPeJ6RMAuP9W3Ce+NYYv x+vWfpc+0X1DoU8A4H1i+gQA7r/9dJ+4u2ztby5aG3z+/dvu/0/oEwB4n5g+AYD7b8V9Ypg+ MUqfOKVPdG1CnwDA+8T0CQDcf6voE+P0iUn6xNn3EwB4n5g+AYD7b8V9Ypo+MUuf6N34fgIA 7xPTJwBw/622T8zTJxbpE1fpE76fAMD7xPQJANx/q+oTy/SJVfrErT4BgPeJ6RMAuP9W3Cce 0ifW6RN9v+8AwPvE9AkA3H8r7hOP6RNP6RP3vp8AwPvE9AkA3H8r7hPP6ROb9Imd7ycA8D4x fQIA99+K+8RL+sRr+sTR9xMAeJ+YPgGA+2/FfeItfWKbPvGhTwDgfWL6BADuvxX3iV36xD59 4uT3HQB4n5g+AYD7b8V94j194pA+cfb9BADeJ6ZPAOD+W3Gf+NYYvhyvW/tt+kQ3fQIA7xPT JwBw/+2n+8TdZWv9i9YGn3//uvv/E/oEAN4npk8A4P5bcZ8Ypk+M0idO6RPdbzv0CQC8T0yf AMD9t4o+MU6fmKRPnH0/AYD3iekTALj/VtwnpukTs/SJ3o3vJwDwPjF9AgD332r7xDx9YpE+ cZU+4fsJALxPTJ8AwP23qj6xTJ9YpU/c6hMAeJ+YPgGA+2/FfeIhfWKdPtH3+w4AvE9MnwDA /bfiPvGYPvGUPnHv+wkAvE9MnwDA/bfiPvGcPrFJn9j5fgIA7xPTJwBw/624T7ykT7ymTxx9 PwGA94npEwC4/1bcJ97SJ7bpEx/6BADeJ6ZPAOD+W3Gf2KVP7NMnTn7fAYD3iekTALj/Vtwn 3tMnDukTZ99PAOB9YvoEAO6/FfeJb43hy/G6td/oEwB4n5g+AYD7b4V94u6ytb+8aG3w+fev uv8/oU8A4H1i+gQA7r8V94lh+sQofeKUPuH/TwDgfWL6BADuv1X1iXH6xCR94uz7CQC8T0yf AMD9t+I+MU2fmKVP9G58PwGA94npEwC4/1bbJ+bpE4v0iav0Cd9PAOB9YvoEAO6/VfWJZfrE Kn3iVp8AwPvE9AkA3H8r7hMP6RPr9Im+33cA4H1i+gQA7r8V94nH9Imn9Il7308A4H1i+gQA 7r8V94nn9IlN+sTO9xMAeJ+YPgGA+2/FfeIlfeI1feLo+wkAvE9MnwDA/bfiPvGWPrFNn/jQ JwDwPjF9AgD334r7xC59Yp8+cfL7DgC8T0yfAMD9t+I+8Z4+cUifOPt+AgDvE9MnAHD/rbhP fGsMX47Xrf06faL7hkKfAMD7xPQJANx/++k+cXfZ2p9ftDb4/PsX3f+f0CcA8D4xfQIA99+K +8QwfWKUPnFKn+jahD4BgPeJ6RMAuP9W0SfG6ROT9Imz7ycA8D4xfQIA99+K+8Q0fWKWPtG7 8f0EAN4npk8A4P5bbZ+Yp08s0ieu0id8PwGA94npEwC4/1bVJ5bpE6v0iVt9AgDvE9MnAHD/ rbhPPKRPrNMn+n7fAYD3iekTALj/VtwnHtMnntIn7n0/AYD3iekTALj/VtwnntMnNukTO99P AOB9YvoEAO6/FfeJl/SJ1/SJo+8nAPA+MX0CAPffivvEW/rENn3iQ58AwPvE9AkA3H8r7hO7 9Il9+sTJ7zsA8D4xfQIA99+K+8R7+sQhfeLs+wkAvE9MnwDA/bfiPvGtMXw5Xrc2SJ/opk8A 4H1i+gQA7r/9dJ+4u2ztTy9aG3z+/bPu/0/oEwB4n5g+AYD7b8V9Ypg+MUqfOKVPdL/t0CcA 8D4xfQIA998q+sQ4fWKSPnH2/QQA3iemTwDg/ltxn5imT8zSJ3o3vp8AwPvE9AkA3H+r7RPz 9IlF+sRV+oTvJwDwPjF9AgD336r6xDJ9YpU+catPAOB9YvoEAO6/FfeJh/SJdfpE3+87/p+9 e43Rs7zTA/5MHAzYnJxADMFkbAcSCAmHQACHQwwEQggJJCZnNpvdbqvaGOqD7NpYtnxYj2xX qhZ1tVKlotm2qjYrtTTalbK11Gh3pXyoInXbaiKt8j1KpWo+rNIPbVVV6X15/k94MxlgzNiP 38G/n3Jl7Bnznmf+z3299/sOAI5PRD8BgPkvA/cTB6qfOFj9xHb7JwBwfCL6CQDMfxm4nzhU /cTh6iem7J8AwPGJ6CcAMP9l4H7iSPUTR6ufmLZ/AgDHJ6KfAMD8l4H7iWPVTxyvfuK0fgIA xyeinwDA/JeB+4mp6idOVD8x4/UdADg+Ef0EAOa/DNxPnKx+4lT1E7P2TwDg+ET0EwCY/zJw PzHSMZwxvb7rvlz9RPZQ6CcAcHwi+gkAzH853/3E1hVd9/mJrtvWPj6d95/QTwDg+ET0EwCY /zJwP/Fi9RMvVT8xU/1Eugn9BACOT0Q/AYD5L0P0Ey9XP7Gj+olZ+ycAcHwi+gkAzH8ZuJ/Y Wf3EruonVm6wfwIAxyeinwDA/Jdh+4nd1U/sqX5isvoJ+ycAcHwi+gkAzH8Zqp/YW/3Evuon NuknAHB8IvoJAMx/Gbif2F/9xCvVT2zx+g4AHJ+IfgIA818G7icOVD9xsPqJ7fZPAOD4RPQT AJj/MnA/caj6icPVT0zZPwGA4xPRTwBg/svA/cSR6ieOVj8xbf8EAI5PRD8BgPkvA/cTx6qf OF79xGn9BACOT0Q/AYD5LwP3E1PVT5yofmLG6zsAcHwi+gkAzH8ZuJ84Wf3EqeonZu2fAMDx iegnADD/ZeB+YqRjOGN6fdfdX/1Eop8AwPGJ6CcAMP/lfPcTW1d03ZMTXbetfXwq7z+hnwDA 8YnoJwAw/2XgfuLF6ideqn5ipvqJvLZDPwGA4xPRTwBg/ssQ/cTL1U/sqH5i1v4JAByfiH4C APNfBu4ndlY/sav6iZUb7J8AwPGJ6CcAMP9l2H5id/UTe6qfmKx+wv4JAByfiH4CAPNfhuon 9lY/sa/6iU36CQAcn4h+AgDzXwbuJ/ZXP/FK9RNbvL4DAMcnop8AwPyXgfuJA9VPHKx+Yrv9 EwA4PhH9BADmvwzcTxyqfuJw9RNT9k8A4PhE9BMAmP8ycD9xpPqJo9VPTNs/AYDjE9FPAGD+ y8D9xLHqJ45XP3FaPwGA4xPRTwBg/svA/cRU9RMnqp+Y8foOAByfiH4CAPNfBu4nTlY/car6 iVn7JwBwfCL6CQDMfxm4nxjpGM6YXt91N+knAHB8IvoJAMx/GbCf2Lqi6x6f6Lpt7eMTef8J /QQAjk9EPwGA+S8D9xMvVj/xUvUTM9VPeP8JAByfiH4CAPNfhuonXq5+Ykf1E7P2TwDg+ET0 EwCY/zJwP7Gz+old1U+s3GD/BACOT0Q/AYD5L8P2E7urn9hT/cRk9RP2TwDg+ET0EwCY/zJU P7G3+ol91U9s0k8A4PhE9BMAmP8ycD+xv/qJV6qf2OL1HQA4PhH9BADmvwzcTxyofuJg9RPb 7Z8AwPGJ6CcAMP9l4H7iUPUTh6ufmLJ/AgDHJ6KfAMD8l4H7iSPVTxytfmLa/gkAHJ+IfgIA 818G7ieOVT9xvPqJ0/oJAByfiH4CAPNfBu4npqqfOFH9xIzXdwDg+ET0EwCY/zJwP3Gy+olT 1U/M2j8BgOMT0U8AYP7LwP3ESMdwxvT6rntv9RPZQ6GfAMDxiegnADD/5Xz3E1tXdN3mia7b 1j4+lvef0E8A4PhE9BMAmP8ycD/xYvUTL1U/MVP9RLoJ/QQAjk9EPwGA+S9D9BMvVz+xo/qJ WfsnAHB8IvoJAMx/Gbif2Fn9xK7qJ1ZusH8CAMcnop8AwPyXYfuJ3dVP7Kl+YrL6CfsnAHB8 IvoJAMx/Gaqf2Fv9xL7qJzbpJwBwfCL6CQDMfxm4n9hf/cQr1U9s8foOAByfiH4CAPNfBu4n DlQ/cbD6ie32TwDg+ET0EwCY/zJwP3Go+onD1U9M2T8BgOMT0U8AYP7LwP3EkeonjlY/MW3/ BACOT0Q/AYD5LwP3E8eqnzhe/cRp/QQAjk9EPwGA+S8D9xNT1U+cqH5ixus7AHB8IvoJAMx/ GbifOFn9xKnqJ2btnwDA8YnoJwAw/2XgfmKkYzhjen3X/Y/Vc/1Eop8AwPGJ6CcAMP/lfPcT W1d03SMTXbetffxM3n9CPwGA4xPRTwBg/svA/cSL1U+8VP3ETPUTeW2HfgIAxyeinwDA/Jch +omXq5/YUf3ErP0TADg+Ef0EAOa/DNxP7Kx+Ylf1Eys32D8BgOMT0U8AYP7LsP3E7uon9lQ/ MVn9hP0TADg+Ef0EAOa/DNVP7K1+Yl/1E5v0EwA4PhH9BADmvwzcT+yvfuKV6ie2eH0HAI5P RD8BgPkvA/cTB6qfOFj9xHb7JwBwfCL6CQDMfxm4nzhU/cTh6iem7J8AwPGJ6CcAMP9l4H7i SPUTR6ufmLZ/AgDHJ6KfAMD8l4H7iWPVTxyvfuK0fgIAxyeinwDA/JeB+4mp6idOVD8x4/Ud ADg+Ef0EAOa/DNxPnKx+4lT1E7P2TwDg+ET0EwCY/zJwPzHSMZwxvb7r/lv1E9lDoZ8AwPGJ 6CcAMP/lfPcTW1d03YMTXbetfXw47z+hnwDA8YnoJwAw/2XgfuLF6ideqn5ipvqJdBP6CQAc n4h+AgDzX4boJ16ufmJH9ROz9k8A4PhE9BMAmP8ycD+xs/qJXdVPrNxg/wQAjk9EPwGA+S/D 9hO7q5/YU/3EZPUT9k8A4PhE9BMAmP8yVD+xt/qJfdVPbNJPAOD4RPQTAJj/MnA/sb/6iVeq n9ji9R0AOD4R/QQA5r8M3E8cqH7iYPUT2+2fAMDxiegnADD/ZeB+4lD1E4ern5iyfwIAxyei nwDA/JeB+4kj1U8crX5i2v4JAByfiH4CAPNfBu4njlU/cbz6idP6CQAcn4h+AgDzXwbuJ6aq nzhR/cSM13cA4PhE9BMAmP8ycD9xsvqJU9VPzNo/AYDjE9FPAGD+y8D9xEjHcMb0+q77i+on Ev0EAI5PRD8BgPkv57uf2Lqi6x6Y6Lpt7eOn8/4T+gkAHJ+IfgIA818G7iderH7ipeonZqqf yGs79BMAOD4R/QQA5r8M0U+8XP3EjuonZu2fAMDxiegnADD/ZeB+Ymf1E7uqn1i5wf4JAByf iH4CAPNfhu0ndlc/saf6icnqJ+yfAMDxiegnADD/Zah+Ym/1E/uqn9iknwDA8YnoJwAw/2Xg fmJ/9ROvVD+xxes7AHB8IvoJAMx/GbifOFD9xMHqJ7bbPwGA4xPRTwBg/svA/cSh6icOVz8x Zf8EAI5PRD8BgPkvA/cTR6qfOFr9xLT9EwA4PhH9BADmvwzcTxyrfuJ49ROn9RMAOD4R/QQA 5r8M3E9MVT9xovqJGa/vAMDxiegnADD/ZeB+4mT1E6eqn5i1fwIAxyeinwDA/JeB+4mRjuGM 6fVd95p+AgDHJ6KfAMD8lwH7ia0ruu6+ia7b1j7en/ef0E8A4PhE9BMAmP8ycD/xYvUTL1U/ MVP9hPefAMDxiegnADD/Zah+4uXqJ3ZUPzFr/wQAjk9EPwGA+S8D9xM7q5/YVf3Eyg32TwDg +ET0EwCY/zJsP7G7+ok91U9MVj9h/wQAjk9EPwGA+S9D9RN7q5/YV/3EJv0EAI5PRD8BgPkv A/cT+6ufeKX6iS1e3wGA4xPRTwBg/svA/cSB6icOVj+x3f4JAByfiH4CAPNfBu4nDlU/cbj6 iSn7JwBwfCL6CQDMfxm4nzhS/cTR6iem7Z8AwPGJ6CcAMP9l4H7iWPUTx6ufOK2fAMDxiegn ADD/ZeB+Yqr6iRPVT8x4fQcAjk9EPwGA+S8D9xMnq584Vf3ErP0TADg+Ef0EAOa/DNxPjHQM Z0yv77rfr34ieyj0EwA4PhH9BADmv5zvfmLriq67Z6LrtrWPn8r7T+gnAHB8IvoJAMx/Gbif eLH6iZeqn5ipfiLdhH4CAMcnop8AwPyXIfqJl6uf2FH9xKz9EwA4PhH9BADmvwzcT+ysfmJX 9RMrN9g/AYDjE9FPAGD+y7D9xO7qJ/ZUPzFZ/YT9EwA4PhH9BADmvwzVT+ytfmJf9ROb9BMA OD4R/QQA5r8M3E/sr37ileontnh9BwCOT0Q/AYD5LwP3EweqnzhY/cR2+ycAcHwi+gkAzH8Z uJ84VP3E4eonpuyfAMDxiegnADD/ZeB+4kj1E0ern5i2fwIAxyeinwDA/JeB+4lj1U8cr37i tH4CAMcnop8AwPyXgfuJqeonTlQ/MeP1HQA4PhH9BADmvwzcT5ysfuJU9ROz9k8A4PhE9BMA mP8ycD8x0jGcMb2+67ZVP5HoJwBwfCL6CQDMfznf/cTWFV1310TXbWsfP5n3n9BPAOD4RPQT AJj/MnA/8WL1Ey9VPzFT/URe26GfAMDxiegnADD/ZYh+4uXqJ3ZUPzFr/wQAjk9EPwGA+S8D 9xM7q5/YVf3Eyg32TwDg+ET0EwCY/zJsP7G7+ok91U9MVj9h/wQAjk9EPwGA+S9D9RN7q5/Y V/3EJv0EAI5PRD8BgPkvA/cT+6ufeKX6iS1e3wGA4xPRTwBg/svA/cSB6icOVj+x3f4JAByf iH4CAPNfBu4nDlU/cbj6iSn7JwBwfCL6CQDMfxm4nzhS/cTR6iem7Z8AwPGJ6CcAMP9l4H7i WPUTx6ufOK2fAMDxiegnADD/ZeB+Yqr6iRPVT8x4fQcAjk9EPwGA+S8D9xMnq584Vf3ErP0T ADg+Ef0EAOa/DNxPjHQMZ0yv77ovVz+RPRT6CQAcn4h+AgDzX853P7F1RdfdMdF129rHO/P+ E/oJAByfiH4CAPNfBu4nXqx+4qXqJ2aqn0g3oZ8AwPGJ6CcAMP9liH7i5eondlQ/MWv/BACO T0Q/AYD5LwP3Ezurn9hV/cTKDfZPAOD4RPQTAJj/Mmw/sbv6iT3VT0xWP2H/BACOT0Q/AYD5 L0P1E3urn9hX/cQm/QQAjk9EPwGA+S8D9xP7q594pfqJLV7fAYDjE9FPAGD+y8D9xIHqJw5W P7Hd/gkAHJ+IfgIA818G7icOVT9xuPqJKfsnAHB8IvoJAMx/GbifOFL9xNHqJ6btnwDA8Yno JwAw/2XgfuJY9RPHq584rZ8AwPGJ6CcAMP9l4H5iqvqJE9VPzHh9BwCOT0Q/AYD5LwP3Eyer nzhV/cSs/RMAOD4R/QQA5r8M3E+MdAxnTK/vuvurn0j0EwA4PhH9BADmv5zvfmJr7Z/Y1j5+ Iu8/oZ8AwPGJ6CcAMP9l4H7ixeonXqp+Yqb6iby2Qz8BgOMT0U8AYP7LEP3Ey9VP7Kh+Ytb+ CQAcn4h+AgDzXwbuJ3ZWP7Gr+omVG+yfAMDxiegnADD/Zdh+Ynf1E3uqn5isfsL+CQAcn4h+ AgDzX4bqJ/ZWP7Gv+olN+gkAHJ+IfgIA818G7if2Vz/xSvUTW7y+AwDHJ6KfAMD8l4H7iQPV TxysfmK7/RMAOD4R/QQA5r8M3E8cqn7icPUTU/ZPAOD4RPQTAJj/MnA/caT6iaPVT0zbPwGA 4xPRTwBg/svA/cSx6ieOVz9xWj8BgOMT0U8AYP7LwP3EVPUTJ6qfmPH6DgAcn4h+AgDzXwbu J05WP3Gq+olZ+ycAcHwi+gkAzH8ZKA92XXdZy43zqoJvtnx8tDEo7/3VZ34++eRtSdc9VKfx eMsVLZe09Kf7/vrce0bO4zsbuu7I1XPn8dQC57H6zL85cvUP1v/0qlUbkl+s/sH6X6z+zoan V6/c+IvVf7Yh+elVKzf+9Kr8u4frvOZfjhQq86/fdMtrb3P9ptu/mO6enPzerclrizrdc327 ncvLm9O9ZeR+mH8e5/v+2Nxyfctvrei6je3G+6P28U8n3rhMl3bd4fG7PZ+Y/JNbk4Vvz/N9 uv33TR5r/XmsW9t1P7t87jzy384/j/x369b+7PJ1a19Y9cya5JnV69YmP1p9xfU/WZWv9ffN Qpf7rgVOM5fpzOW+NXl4crpLXuvOz/fcxXfbbFzTda/X5X6z22bjmtcv37jmviv2XJ+8frnb 3G1+sd7meT7lR/99Rffj9pcVeT6lDbTH28fb2un/RTv9x9sw2Z0h9w6fT7m5nfaft//yn9Xz Kf2f++dT8vW3ej4FAAAAAAAAAAAAAAAAAAAYSyOvPwaAZTO7RpN31Jj/OfMNgHGfY5lfSd68 aX76r5lpAIzzHMvMytsl5m0Zk5Ujf87nR+eaeQbAOM2yfo718+vSbu6tfi+vj0k+l6/1M808 A2Bc51jm1qpu7u3qr6zkz/lcZltmWr9OM88AGJdZlrmUOZZZlV/7dVU39+tb3ldZ03J1zbV8 PfOuX6OZZwBc6FnWr8kynzKnMrMyv65rWTuS/D2fz4zLOi1zzzwDYBxmWWZResN0iFmPZV59 oOWDLTe1fKg+5ldt3lAzLeu0rNHMMwAutL5fzCzLmixrrsyqzLHJlg+33FzJn/O5dbVOy8wz zwAYl1mWfjFzKfPp+lqLZX7d1nJ75WMtH62Zlq/n35lnAIzDLMtzZZlF6RevrTXZhppjd7Tc 3fLJyp01024xzwAYw1mWPR/pF/PcWGbVJ1ruabm/ZVPlvpppH2/5iHkGwBjNsuz7uKab2/OR +ZQu8a6aYw+1fKZlc8sjLZ9uubfWbJlneQ7NPANgXGZZ9nRkNqVfzPorcysz7LMtT7Y80fJY zbes0bJ2sz4DYJxmWebR+m7uObGsvR6uOfb5li9UnqrP5Wufsj4DYAxnWfZ9ZJZlTqVbzHrs mZZnW55r+VLNtKzRMs+szwAYx1mWPfiZUZtrHZb59ZWW5ytfrvmWeZbn0KzPABiHWZb38pg/ yx7t5vrFrMe+2vKNytdqtlmfATDOsyx7GDPLnq512NdbvtXy7fqYv2eeWZ8BMM6zLHsWs/bK zMp67IWW71Qy0/p5Zn0GwHKYZd9s+a2W71Z+e948sz4DYJxn2ZaaZVmP/U7L79ZH6zMAluss +3uV/Nn6DIDlMsuy3yOzLGuy36v088z6DIDlOMv+/rx5Zn0GwHKYZZlXo7Ns/jyzPgNgucyy zLB/8CbzzPoMgKFkVqyo+bG6ZtkNNcvy+8kWM8vebJ5Zn735bd4n109ERJaWzLGsyS6rOfL+ bu53Sn+4Zs0DLY/XuuqtZpn12eLm1+jtnuuW5Pbvk+ssIiJnn8yxK7o3fg9n/zul7+zmfndZ frfLF7u59xN+q1lmffb2c6yfYZlbl9Ztn+uZpONNsj4WEZGzS+ZG5ti1tSZLv3hrN/d7OPP7 NvP7XvIe+Xlf4cykzLLMqYVmmfXZwrMsl310huV65bbPMcRVLVfXfZCOV0REzi6ZGekVsx7L HMssyZosa6X+d5fl97081829L37ei/G7bzPLrM9+c471XW7mWNZe/fFDrmOOIXL75/d553rn +UoRETm73Fi9YtZjmSXZv5g1WfrFPFc2/32FFzPLrM9+fW/N6BzLOizHEdfVdcztn/md65z7 YKOIiJxVssfj5poft9XaKHMsez6yJvtc9Yt5rmz++1e93SyzPnujW8zlzuXP9cj1yRpsXcv6 uv0/Wrd/jiOyfzS3gYiILD5ZC93Vck/NkqzHMscyX7JuyrzJ3OmfKxt9nfTbzbKLeX3W94v9 PtE8N5b1WL+/JscReV4y98HdLffW7Z/jCBERWXw2VR6sddHm6hWzHst8ye/fzPNk2b/Y/66X s51lF+v6bPS1e323mOfG0ilmTZx1WI4h+uOHzPHc/nk9X+4DERFZfLLnPjMk8+vzNVPSK2a+ ZI71v7Msa6m+XzzbWXYxrs/mvw49ez3SLWY2p1PMax7yWvTM7syv7Bftb//cDiIisrjkdWNJ ZteztV8xMyXPj2W+9Ouxpc6xi3F9lsuTy5Y9H+kXc7n791TJ82LpFPOahxxPZIblfsjtn9ek 5/YXEZGzS147ljVY5kn2K2aGZc/i6BxLt7jUWXYxrc/6WTb6nirpF7PXI9cnHe+j9ZqHHEtk huX6Zx2c219ERBafzJA+/fzKWinzpX9+rP+9m0udYxfT+mx0lvXPlWXPR65D9nrkOcr0u/3+ mhxD5Pr3t72IiJxdMrP6ZK6MrsP6GTb6O16WOssuhvVZvx8/ly2zLK8n658ry+seMqPzHGW6 3dH3VBn9nd0iIvLO08+u8zHDLpb12egsy3tUZS9+LnP24ee5stH3VMl1zXp49LV7IiJy7nKu 59fFsj5baJbl8mYvfj/Lsucjr3tIv9jPstwO5/s2FxER67PzNcv61+55TIiIvHvm2XJen5ll IiLm2XJfn5llIiLm2XJfn5llIiLm2XJfn5llIiKylPXZOMwzs0xERJa6PrvQfaNZJiIiS1mf jUPfaJaJiMhS1mfjsB/ELBMRkaWsz8ZhP4hZJiIiS12fXej9+maZiIgsZX02Dvv1zTIREVnq +uxCv57aLBMRkeW+PjPLRETkfK/Pzvc8M8tERGSI11Nnnq1tWdNyRctlLZe0rDgH88wsExGR 87Ff/7Mjrz/LPLu55aaaM9e0rG659BytzcwyERE51+uzzIyszzLPHmq5p+X2lg+33NhybctV I11j1mZmmYiIjNM8+1rLcy1PtzzWsqnlrpZba8b0XeO5WpuZZSIicq7n2bdanm/5UsuTI3tB Pl5rsw+2vL/2gfTPm5llIiIyDvMs8+G7LS+MdI1Zmz3a8kDLnS23tKyb1zOaZSIiMg7zrF+b ZZZlVmRmZB9IZtnjIz1j9jRmD8h1NXfOxXNmZpmIiJzvdVmeMxtdl/WzzLpMRETG+fmyr7Y8 2/K5miX9a836vYyeLxMRkXHrFvvXmfVrsv510+kXH2z5ZM2W9d3ce4D0r5m2j1FERMbp9dKZ Y5kVW7pf//1m/R7GvF46+z7658pWeX2ZiIiM2Xqsn2NfrL34fbc4+r6MC72Plff9EBGRcVqP ZY71z5H1+z0+Wt3iDd1vvr+w92MUEZFxXY/dX3vwR+dY9ntk72LfLXqffBERGff1WN6zKnOs f5+Pfo6dq/cUNstERGS5r8fMMhERWe7rMbNMRESW+3rMLBMRkaWux/o5dqHWY2aZiIgsZT3W 94oXcj1mlomIyFLXY5ljF3I9ZpaJiMhS1mMLvQ566PWYWSYiIktZj432ihdqPWaWiYjIUtZj fa94IddjZpmIiCx1PTZ/jg29HjPLRETkXL4O+kKsx8wyERHrseW+HjPLRESsx5b7euytZll+ V1oucz/Lnpo3y3K9cxv0c11ERJaW5boeG4c5Nn+W5bLl91b3s+yelkdqNj/b8rWWb9f1ztos t0NuDxEROTc53/NtObxP8FJmWX5PdT/Lburmfpf13S0PtTxR1y/XM9c31zvX/7siIvKOkjnS J2uDhdYH53KevVvXY71chn6W5XdWX9tyY8stNY83tTxWz5llbfZ8Xe9v1Rott4OIiJxd8nxN 8p2RtUE/10Zn2rmaZ+/W9dj8WZbLdkXL++pyb2z5eMunWh5u+WzL0zXPvlIz7avVO4qIyNnl 6zVHvjmyLshc62fauZpn7/b12OgsW1GzbHXLmpa1tZcxMznXKTM6z5tlnmUfyBfqun+pZpuI iCw+z9V+un5dkNmWuZKZlrVaZs3oPFvqLHs3r8fmz7LM2lzW7GXMc2brWj7ccnvLJ2tW57mz zS2P11zL82giIrL4ZP2T2ZHnbfp1QWZb5krWann+JvMs67PRvtF67O1nWS7bJSPPmaVnzNos +xnzvNnHalZnX+N99Rzap1seFBGRs0rWBHneJvMjexEy3zLXMleyTuvnWfrGpazNLpb12EJ7 GXN5c7lz+XM9rq95lufOsq8xr5/Oc2h31PVOMsdFRGRxyf7wrAuyFyEzJHPt0ZorC+0X79+b YrGz7GJbjy3UM/Zrszxvlq4x1yfrs8zo7NPP9cxcS/d4c63ZRERk8cm6IOufPH+T9UDekyI9 V+ZZ9iPk+bTsq5u/NjubWXaxrcfm94y5zJnB/TzL9clekFy3vB9I5lpmdq5v9u2LiMjik30I WRdkb13WBFkLfaLWaekfsxchz6Gla+zfZynPmy1mll3M67E3m2dZn2Ue571Ask8/1y3rtGtq tuX5tFxnERE5u2RvXZ6/yVzbULMkz9tkL0L21uW5s+wFyd7GzKGzmWUX63psoVmW9H1j5nI/ 03L9slZLMt9EROTskr11fd+VritrtTxvk70IWZvlubOsm/J6p/SM/XsGvtUssx5beJ7Nn2n9 Oi3Xr0/mm4iInF3y/E3WBplp/Wt5s78uz6FlvuR5s7zeKbMnrzvLc2aLmWXWY28900bnWj/b RETknaXfk9C/l3vmSNZmee4sz5tl1uQ5s2fmzbLsZZw/y6zHlj7fRETknaV/b4r+fZYyU/r3 DMy8yWvOsv8js+jtZpn1GAAXQv/eFJkhmWXZB5I9INmjv5hZZj0GwHKdZf37WFmPAbDcZlle Lz363h/WYwAs51lmPQbAcptl+d1m/SzLDLMeA2C5zrL+901bjwGwHGdZ/56MifUYAMtplvXv L5zZlbVZYj0GwHKYZfndL/0s638vZ2ZY3pvRegyA5TLLnu7m3is/7y+c+ZWuMXPNegyAcZ9l /e996X8nZ2ZX5lmSdZr1GADjNsuuWWCWZU5l3ZW5lbXZl+tj3m/YegyAcZ1lmUcfa7m35ZGW J7q5njHzK8mfrccAGNdZlt9hlpnU/z7OB7u558wyz7IOywzL74HJjLMeA2BcZ1l+H2fWWVlv ZV5lbm2umZaPD3Vz/aP1GADjNMvy+zivbvlAy00tt3Rzv48zPeOmWp8lmW353B3WYwCM4SzL LLq2m/vd0vl9nHnOLGuvdI2ZX/l4dzf3ezqtxwAYt1l2WcuVNZcynyZrbZZ5lvVZkhmW59Hy +Xx9/hyzHgPgQs2yzJ/Msiu6uefM0jNmbZa9+Te3fKSSP+dz6SCtxwAYF5k7mUFZU2UmZTZl RmUPyLpubh/I+lqHZYblubF87X3WYwCM0SxbUeuqPGeWtVn2gGSeZX2W9VeS153l73k+Le8P kj7SegyAcZllfc+Y9dXoPMvMykxLsg7L37MWy9fz76zHABinWZa1WfaA9PNsda29MruS/Dkz LGuxPLdmPQbAuK7NMs8ypzKvMtMyu/Ix6WdY/o05BsA4zrJ+fTY60/rk7/0My78xxwAY53k2 OtP62dXPrz7mGADjOs/6jM6tfnaNBgCW01wzuwAAAAAAAAAAAAAAAABgxIPd3JtU5heXXtMy 3fJayze7uV/C3ftlyZuoTLd/Md09MfkntyavdQ/VaTzezb15c94orD/d/IKCfC4v8OvPY93a rvvZ5XPnkf92/nnkv1u39meXr1v7wqpn1iTPrF63NvnR6iuu/8mqfO3ht7jcdy1wmrlMZy73 rcnDk9Nd8lrXn87865DLO/+22bim616vy/1mt83GNa9fvnHNfVfsuT55/fLFnG7vrU53zs8n n7wt+c3LO3qbn/19+eTk925NFr4v80vY8+e8cU5/f+bNB+af3zPt9nlh1Vvfr7k/c7/mPpy7 L3905r7NfZyvzb8/HunmflnTf2433GUtR9oZf3rijcvUHL515DL9dssD9ed8jP5jt3Gi/2+6 R3f+i1/7PuhPb6jrtbmu11+16/J/28d/2s74cyPX69J2vYZ6nGxp1+/Vun5vdrpb1ry6asua dav/cG3y6qohT3dXy/c+M9H9Tbt9Ptiyu91WH5l44/Q3rey6Y3OnPPI64sOfWejP7WzPfNze cm/LH+f82mn/ov2X7ebq8ljq/zzRrT/zmM/Xf9Mv+/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAjJ0HWy5rubHlmpHPf7Pl4yN//2V5768+8/PJJ29Luu6hOo3HW65ouWSB092yputeXfXW p7tlzaurtqxZt/oP1yavrlrodD9Qf76+5db680TLV1p2TMz9+WA7vdHr+B/fc+bDxKXru42P d7/Tbe+2dr/b7Wr/v757rPtH7e+/dxa3WC5B191148eOdMef7FZMPXnm70/l7zs/MLG5/Xlz +/M/XN8uSfvaiR//v7/MZdrXPl7fcvWN10/kv83nbm1/f2bX8+/5/v+55khO44H29xuu+PeX fPfea478wRc27H+q/f2Lz/7ZJTmNB7uJ67/RPnbd93/19++1j//2sh+c+fvf/cGOwzmNY7fM Xcr7Vv4gN9ev5Pxyul33t/vz5zN+8Lf7v/+/cppd99f/5d9d8p/a6fzjH//5Jfn8r/7NiP/d vv57e8/cJV3Opr/tc1/kz7nZn28fk4l2m3+wfXFV+/jRul82fOO2zf/kW7dt3vT+rrtq9dzn npl3Hv3j4bk8Hlq+NnJeV3bd4dHz7c/r0rc4r72LPK/Pt9y0iPNaXed13QLn9c8XeV6fy32x iPO6ts7rpgXO6+8WeV5fWuRtmPPIeX1kgfN68trFndejizyvW+q8PrHQbbjI88rXvriI87q9 zuuOBc7rvy7yvBb72LizzuuBBc7rfy7yvBZ7f+U8cl6PLXBeX7zunT8OR3++LnS+j9b5fnaB 8/3Xizzfyxe4PYeaQ+f6dN8/chv153HgQ+0+vHLuPPLfzj+P/HcHPvS1K2/60L+88nOTN1x9 /eQjV//15Feu/snkn171byb/5qp87eF5l3u65bW63HctcJq5TNPtX0zfmjw8Od0lr3X96cy/ Drm8bpvF3zY/bA/Y2+tyv9lt88Obbr/yhzf91dXvWZ/cfqXbfDxu810t33hgorthRft51z7x fPv4r9rHv2ynf3c7/U+3n2WHzxwj/nLksOfwZxb6c39oub3l3pY/bvkP9090x9vHP6pj0v7P E+34ckV9/Tf9sv8fAAAAwEJSKCw2vDvv8zRWo0nV1CfV2Pz0X+v/vcfH8vsef7P7fPR+TvWa rKxcOpJUo0n/93w9/7Z/fIw+Nhjf+3v0Pn+z+7u/r/N0W7KqZXWlnnb7teRz+Vr+Xf59//gY fWx4XAz7c/3NfqYv5j7P/djf57lv+/v8qparK9e0rGl5XyVPH11byZ/zuXw9/y7/bU4rpz/6 uPCYOLePg4V+ti/1e7y/z/v7u7/P+/v7um5uY9Pabu6p/xsqH+zmno5bV8mf87n8m/z7/Pc5 3ZxXzr9/XPhZce4eC6OPgf6+f6ff46Pf3wvd56P3d7ZofKhlsmV9y8aWD7fc3M1t3eiTv+dr +Tf5b3I6Oe2cby5PLmsuu58V5+7x0D8W+sdB7v+Fvs/f7nv8re7vDSP3ee7nj7R8tJt7ivu2 ltu7uaflP9FyZze3DaDPHfW1/Lv8tzm9nFcuRy5fLm8ex/3PCt7ZY2L+42H0sZDHQO7/3Ob9 /b7Qfb7Q/d1/j4/e3x8bub9z/+Z+vrvlky33tHyq5b6W+1s2tXy6m9vSkeTP+Vy+nn+f08hp 53xzmXI5c5lz+XNdzI+lPSbyfTX6eMj3XG7j/AzI937u/9z3/f0+/3u8v7/77/Hc3/33eH9/ Z/tLf38/MHJ/ZwtOtvlkz8zmbm5b6GPd3Jacz7Y8Ucmf8/lH6r/N6eVxkcuRy5bHbC535luu i/mx9J8R+Zmb2zNzIo+H3Mb5eZCf+/nez23f/2zvf6733+O5f/rv8dzf/fd4f3/nfuzv8/n3 dzbJZ7vpU93cdtqnW77QvbGNN9tek/w9X8u/z+Mmp5/HWh6LeZzmsZvLneOKXBePiXPzMyI/ e3O8kMdDfjbk50L/WMj3fh4Due/zvT56ny/0Pb7Y+/vZludavlzJSziy5T/bjL86knwu/y7/ bU4355nLkcuVOZXLm2OcXIccD+V6eUws7THR/4zI7Zrvufx8yG2d78P8TMjPgnz/5zGQ+7+/ 3+ff57nP+vs89/fofb7Q/Z2t719v+UYlWz+/Vfn2SPL5/NucTh5X+TmT2ZPHaeZX5kdmXa7D 6DEFS39M5Hgyx2w5bszxQo4P8jM6j4fMgPwcyPdpHgO57/O9/mb3eX9/9/d57tf+Pu/v6xda /j97ZwKv21mV94PeDK2GgyJVDMlNACEMgRBExmiADMyEQMJMmJ0QBRUHUHCKOMQRUZQYUJms nVs6UFppHVFxqJ1L59KWjra26Uz3/55vhYd917fec8+7z/R+z0rW79x117nr/53ve89+3nHv F678RSu/aeUvXjl/Js+/oy7tjHbI66Gtch3j9dIHjj6F20RffyK0I64T2iboO/C+oxVcH2gP XA9oC7QDPn/9XdfPnM97/pnH562f+UtW/lLxl4kT833UgEHb4zWgVfRh6ONEn4KxUvQz3Sb2 1i6ij4kG0z+jP8HvG9ditIP3m+uEtgmuD1wbaA+0BdpAfPbxuc8/b/3M9fPmEOfcXzFz/o5/ R11YcHkN6Bd9Wtot/WDaMq+fsVOMPWx71w/66jEORT8Yc/C7x9wCY0r6c1yr6UOg51wjuI5z XaA90BaiDejn3vq81V+5xslRi/pcf2gT9FfoU9BW6WcyPuY1e+yxvH7EtYKxR3atoD9BXwJN 57OhTXB94POKtpB99us+7934vE3QFtEu2if9TPrAjI9i7OE2sey1QucoYvwR/QrGoYw7+Cy4 dqPr6DvXCa7r0SZ620DVJmDRf6FNomOMhxl78BqZV+Ua5/Ho/s1dRX+TeQrGe/w+oiH0K+j3 87nwO4vGox3oRlwnlm4T1KQ+1yT6MPRnGAfTRpk3m49H3Sb620X0N+fXC+1bMObj/ed6jZZz rWDsybUi9EO1Y7/aBDz6M7RL5q7QNfo9XNPQvJijcJtYpl3M+5yM7aJvgWbTn+NawTiQfgWf Db+3XNP3u02gTVyPYjwKn2sWmhZzFLHu4Xmr5a8XvJ8x342G0H+jb88cFp8Bv5/8nnINR9+j TfC5Ld0mcG0T9GuzOQo0Tuco3CaW73OiydEm0I91bUKvE/vVJqincxRoFmNixkFct3hdzFHQ JnSOwm1i2XmsmNukT8F1gnEp44+D1g4de2TzVsy787p0jsLzVstfI3g/oz/BvCZaTd+e+Svm Kfgsoo/JtXw/xx3r5ih03ooxEW3W81b725fQa4TqBvOZjANjLMpnFPMT+3GNyNoEfRidt6Kt et5q/zQj1j5i3oq+G/165obiGoGWx5yVzmPud5vgWqTzVrRNz1vt/1ymakbMY3JtZr2JsR/9 iBhvxDVCdWO/2kQ2bxVr5sxRoG28Xs9bLT+3zfie95XfuehXMt4LzeCaHWsd837EfrSHat6K 9skYSPdRzOco3Cb2Nq8931cTfQjG/bzfXJ9jnWM+d6masV9topqjiHkr9oShc95bs9y4M+Yi WOOYz2VrHyLGnrrutZ/XiHVtIuYovLdm//qUzPXwfnL9jX0TjP1jffyg+xCteauYo+D10deJ eav53hq3ib33KdHh6FPGugbX5dYa6EG0h9beGtrufG+N562W61PqPAR7FLRPma1/Hlab0L01 Om/lOYq99ynn81Jcdw+7T1ntzYOZzVvF3pqYt9I5ijg/6jaxuz6E9iljXoo+pc5L6XrGfvUp 55+7+nxfZ+zhns9bzffW0CY8R7G7a0S2R1vXMuirxfrWQfQp521B9+/j8z3f/JnXEteJ+byV 99b09yn5ndI+JfM/upaxn33KuSbEZ851gM89zgDNzwLF+R9tE615K4898vYQ81KtPiV9+WxP 9tJ9iHl7iLYAk+sAn3t2dow/07/RM2G0ifm8VcxRuE20+5SxR4Y+Je8h11z6aLHHUvdjH2R7 4FqgZ0Pj7HCcN9SzhpGjj0mbYMw8n7dCGz1v1e5TMm6PPiXaG2udzPswT3xQfcp5ewg9gB1n yPm8uWaFc02Ic6l8JaYNo3VcJ6JN+EzY/vQpD6IPoe2BawO/+3zWfP68HnSMa1fcq4LPnr+P +xXwlZg8ukebiLlMnbfyHMXu91/zHkafkt/Jg+5TwoAV58Vpk3zOfP60U8aXcd8ivvK58/d6 P5P4XrSPPmZcJ7zfqu5TxrwUfcrYL8X7F2e6+L2MPXQH1afU9hDjB7Qrfue5fvEa0Ta9Hw5/ H+2D9ozzczC3zffEfWviHleb3iZ0/5zee6bqU+p+qYPsU8YcA/0H9IL2wDwZr4vxA7rG7zx9 nrhPGjHz17x+vU8SY2jaCzm+j75S9DGjTWzqHMW6PmXsn6v6lLqncr/6lPN5yDi7Q9+A9snv O+0h7mnHNY2+TzhtmrkU2jXfQ7vh2sDPRHugzcQ9z+g3RR9zU68T8z6E9imz/XNxNiP22B5G nxK9QrfQL20PvFbaAGswtGd+BpxrHZ832sBnTxunfeDMVfHvyPHvmH/Re2ZuWptYdx8J7VPG /jntUzLm3++176pPyWuIcWTcryzaA22BPlDcWxvX+/HFvRnjfpw4MX0m2g/fSz9qE++NWPUp 5/vnjkKfUtcpGEcyZuDaxTUMvYj2EJ9p3IM/7ulMW6d/RNugHzm/H3e0JdrQJt5vuTrfGWfB ua5m++fW3TdiP/uU8OZ9Svo29Ae49vN7zucc9zSkLcSzGOLe3/xddo9fHL3g35LTf79J92Vv ncmY75+LPuVBrHXupk/JGCPuexpzCnymsZ4Z99nX50HM7//M94a24MS8D7QHvUZsQps40zMZ B7V/rupTxl455pqYX6BPyVwJ+sa1P/qF0QeI32/1aBt63YjnQ1TPetm09tA6k5HtnzuMPmXs f9E+pd4vmzY9v7d+9nyZ7JkS0UbWPRdq5DbROpNxmPvn5u1hvvcl+pRoGZqmfcqYX2r1Cedt Y/58KX2G3CY8P67qUx72mYxWn5LXEX1KXh+vU+eg43znbscI655Fpr4Jz5s8kzMZh7V/bn7P W65PXKe4XkWfUtepYt9k9Cn3cq3f1GePHtUzGdmeau1Txr7q6FPSz6G/M+9TbtqYcT/mpfay f+4w+pSxB0rnKWMP7bo+pe3M+pStMxnr7lF4XPuUtroPEX1K3T93mGcy1vUp6dNGn5K+7rxP GfOUsafa7eHMrxHr+pRH4UxG1adkfSX2PjEvxXVtiT6l+xDt+5ce5pmMqk/JnJn7lEerT3mQ ++eyPiVz69GnnO9xcXvo71MetTMZ8z5lrHWy1kafkrVO5kt07dt9ymXmpY7ymQxd65z3KWOv bKx1Rp9S+xC2vfcpj+qZjOhT6v65dX3K+VqnrxHL9SmPypkM7VPqOax1zwZ2H2KZPuX8Hrax fy76lEfhTEb0KWP/nPuUh9OnXHcm4yD2z83PZNCnif1zerbCfcrl+pTZ/rnWmYzD3D9Hn1Kf G171Kd0m9taHaJ3JYA7gMM/5ZmcyYv9c9Cmz/XNuD3trD0fhTEbrnG+rT0m/2H2IZfqU2XMR jtOZjOhTah/C7WH37eFMzmRkfcrD2j8371PqmYy97J+z7b5PybzUYZzJmPch9nomw33K/nmp 43ImY96nrM5kuD2ceXvYy5kMPqvjcibDdmbzUkfpORneP3e0+pRH/UxGds6350yGbX2f8ric ydA+ZZzJ8P65/elTHvUzGfNzvuv2z7lP2T8v5TMZbg/ZmYxY6/SZjM3uQ+j+Oe1T+kzGZl0j Wmcyjuo5X5/JOLg+pc9kuE85ypkM9ymX7VMe9TMZaFZ2JuOildZ5/9z+9Cl5f4/KmYzoU647 kxF9yvn+Ob13nG3vfcqRzmS4T7l8n/I4ncmg/8PP4D7lcn3K+f45+pRH6TkZ2qf0mYzD6VOu 2z8X7eGwzmS4T3kwfcqj/pwM2uX8TIbun/OZjGX6ELt5TobPZGxWn9JnMtweRj6T4fZwZu1h r8/JOIx5qezZaz6Tsb99ynXnfI/zczLcp+yflzqOZzK8f27/+pTrzmRon9JnMjZnXspnMtyH aO2fO8rPyVh3JsP755bvQxylexpHn/IgnpPha8Qnx51zzcjmpXwmY2yLfsT8GhHntrgmh2a0 +hA+kzFOm+C907mIWO+M9W/dY6uasd9rne5THl5fQvuWoRtci/kd1H6E7qHbj2uEz2QcrTYR fYmYj2CMH/NTtImYr9yvfbY+k3F02wTvb8xR6Znf3Yw39toudnMmA+3ys9cORzt0/1TMU8Xa p/YxY15iiXbhMxlHs4+5bm5C1zd0PntduzjT/sVenpNx0apP6f1z+zs/sW6vJf24WAelX8Hv LO0irhe6n+pM5zKXPpPh9rC/85jR16QfF/slaBdxvWDeKOa3o11Ev3M3WnIm++f8nIzDaRPZ PYeYA9J2wfUCHWG+gs8r7hvAdR795zPdTR+j2j/n52QcvWtFaIi2i3jeK1pO/4LPid9f9rCg 94xHYs281ceo2sOZnMnw/rmDbxdxvQgdQcPp29HvZIzKmJD1J/p/2sfYjZZkfUo/J+P46Ejs rYn7GTKPzHWceW/WI/ns5n0M1ZJ5u2g9e83PyTj67SLug0ufjt9Trt/oequPwdxC7L8KLaEd 4Py56lP6TMbRbBdZH4Pf01Yfg7Ej13/6BTqPgZbQNmgLfM3mKX0m43j3MeK+dmg9fUA+R8aM XPezPgZaQtvA6T/QVmgP0af0czKOt5ZoH4O+H2OC6GPoPAb7XpgPR0v4/Oln0D74SluhPbCO 4udkbE4fgzUr+ox87vQXGLPSPvhKzPWB9qDP8/WZjPH6GIwToo8R41V0gf4jbYD2wVdi/p7r Q+yn9HMyNqOPwefNNYO2QR+SdoCu0B/l77k+0B5Y+3afcrw+RqyfRR+Dzxk94JpB22BMwXo3 Tn/0slU+2oP7lOO0C32eT5wN4fNFB9ASrhl89vRBuXbgXBsYX9B/iPbgPuW4fQydE2f8wGeO ntBf4JqA0xYYb9IHQS+4Pniecsw+xnxOnN992gZ6Ql+DNoDTVrg20Aeh/dCOoj24DzH2eJXP mrbBdYC+RjhthbZAH4T24/YwtpZEHyPGJbQNPnfaB/qA8+doC7Qft4fN6GPENYPPm8+d9qGu bcH9h83REh2bRH8DjzjagtvDZl0ztH3MXb/H5nZis9lsNpvNZrPZbDabbQOMjY5MIrMQeRf5 ezbRs5kh7BMrY2Jxxz528pr74TsbpKjBJn0WKZiEjLosZvF3TDYE4/UXbm3deN4Og387Z/Dv Xn/hjeddcOE7z7v25N23P+/kF29/6OT1279/8n13ftfJj9yZHJuw9HXfNvmtq9d9WVKT13Tb 9B23XYJfcfK2LfzWU5u5qDP/GXi98/fmgxdsbT1g9brXvTcfvOAB533wgl/c/rSL8Aect5u6 S7/n2Xuyru6p92TrmpPvvQS/Na3L5mr+zIRyfJ5MJs55Hzq5tXX9dv258jnyefK58vnyWfKZ 8tmSm38ebNhlwfxeE/zl05v3jOnr2+70ydc02ZvYyBmviUMgbM7jz3zF4uvWPe90aiENe+xr 3v4pvwdR76B+ritXP9fdpp/nxunnuWn6+h75uc6Zfq6j106uPvmeS/C8nex33exasj19Lled 2GHQDuYM2uz29lUntrffeOLmc994gsMg677vrlP+/ed8dPLrzqrqvf+ci8++9Fz8urOqepee e/KsG869feLefqJ6D7a3b59e3+Vn3bz9gRO81sO4tvmzOj6f1S3TxeH81fu47nXecs75J245 581nf3wbP/+E24DbgNuA20BW97WTv+XaE1sfnr6+evJ3T3/5C9PXt071L5iKPHH6By889ZTs T8ia4Zs4E3Hanyfsqa+v2trZFP+Oyf/wmhNbfzD9y1tW73v8+U5bF53qU5I/3T4R/9tsNpvN ZrPZbDabzWaz2Ww2m81ms9lsNpvNZrPZbDabzWaz2Ww2m812GKb332rdr22vnjFsNpvNZrPt Xbf13rvZ/XeXcr2P7/xevtZzm81ms9nOTLtDs7NnKvBsjXCewbEX1xrzZzSErutzGqzlNpvN ZrPVGq76Hc/KQmf1WVk8M41nquF32aPHv6cWTl0Y6DvM0HI/b8lms9lstt3rdzwDNZ6bjMai uzz3lOfg8pxcno/Mc3F7nBrUoia3IuQ5q+h6PGOX12Adt9lsNpttdxrO+Fv1G+1GY9Fcnm1/ j8kvmPzkyi/qcP79haua1IYBCy1nXM6YXHXcGm6z2Ww22+kWY3DmsEO/0VLGyegrWnvPye89 +X0nv9/k9+90alCLx9tQG03nNvaMz1XHeU30LTwWt9lsNptt/RictWjWpRl/o99o6sWT32fy B0z+oMkfMvlDJ3/Y5F+0R+ff8jiXyyd/8NbO42bQc7SccX7oOH0JXhNjcWu4zWaz2Wyna3is gzMGZ/2b9WnG3+g3j0lDu9FtHl/Lo994FO6Vkz92j86/pQaPgHvkSs/Rcsbm6Dh9B+bVWR+P sbjn0202m81myzUcnYwxOONg5s8Zf6PfjJvRbrT3qsmvnfyJkz9pj86/fcLkV680HS1nfI6O 02dgXp3HysdYnHVx5gms4TabzWazna7h6CR6yf7zu6/G4KxbM/5Gvx+30u6nTP70yZ8x+fV7 dP4tNaiFlvModnScvgLz6ozFmQdgPoB1cebTY03cZrPZbDbbJzU81sLRS3STuWz2r106+cNX 42/0+6krDb5h8udM/tw9Ov/2xsmfOfnTVjrOeJx5dcbi7HNjvzrz6cztM8dvDbfZbDabrdZw dBP9ZB79sskftRonP3ml38+e/HmTv3DyF+3R+bfPX9VCx+kbMK/OWJx9bsynM5fPnD5r4mh4 7Guz2Ww2m822Y7onnTEv+9HZG84+cfT0ismvWY2XGX+j3+jwSyZ/6R6df3vTSscZj1+3Got/ ydbO/jb2trEmzplxa7jNZrPZbLWGo5PoZexnYyzMWjj7x9FXdJZx8wsmf/HkL5v85Xt0/i06 zniceXXG9+x1u3JrZ28b6/AXrTT8Lls7e9Ot4TabzWaztTWcMTBjYcbEjI3ZR84+NPQW3UV/ 0eJXTP7KM3T+Df+W8TjjedbHQ8NZE0fDOYuOhrM33Rpus9lsNttyGo7+osNnqt+q46rhrImz 3m4Nt9lsNpvNGm6z2Ww2mzXcGm6z2Ww2mzXcGm6z2Ww2mzXcZrPZbDZruDXcZrPZbDZruDXc ZrPZbDZruDXcZrPZbDZruM1ms9ls1nBruM1ms9ls1nBruM1ms9ls1nCbzWaz2azh1nCbzWaz 2azh1nCbzWaz2azh1nCbzWaz2azhNpvNZrNZw63hNpvNZrNZw63hNpvNZrNZw202m81ms4Zb w202m81ms4Zbw202m81ms4bbbDabzWYNt4bbbDabzWYNt4bbbDabzWYNt4bbbDabzWYNt9ls NpvNGm4Nt9lsNpvNGm4Nt9lsNpvNGm6z2Ww2mzXcGm6z2Ww2mzXcGm6z2Ww2mzXcZrPZbDab Ndxms9lsNmu4Ndxms9lsNmu4Ndxms9lsNmu4zWaz2WzWcGu4zWaz2WwjaPhLDkDDL7aG22w2 m812xhp+4eSXHJKGP9wabrPZbDbbGWv4nddo+BP2ScNvmvx5ouGPW2n4A1cafvfJP8sabrPZ bDbbGWv4Qw9Qw5+y0vBHrDT8nqLhnzH52dZwm81ms9k+xe600vBzVxp+t5mGf7Fo+LMX1PCX iYY/a6Xhj5/8kZNfOvm9Vhr+2aLhn756vTabzWaz7VXzWn7cNfyCye87+eUrDb928usSDUeL ezT8xZM/f/IbJn/q5FdN/qjJHzT5vSf//JWGf+bk51jDbTabzdap3cznhqMp4fF3x03LVcPP SzT8ipmGv2BhDaceGv60ya+e/NGTXzb5F0x+j8k/Z/W60HBepzXcZrPZbHvV79Bs9IR9VuHE +FzPj5uGo5lo530mf8jkj5n8msmfPvmNK81Fe5fQcPoC1KNvQB+BvgJ9BvoO9CGY06dPwfwA 6/W8Tq+J22w2m+1MdS70O7SbcSG6F07Mmm3oeWj5UddxXh+vldePht918vNX42DGw4yLGR8z TlYNR4N7NJw+ABrO3Dx75Vhv5wwbe+geNvn9t3bu8/K5W6efL/NY3Gaz2Wy7NdVvdBrNRlPY a8VaLc6f+TvGi+ghenMcdFw1nJ8jNJz16Adv7axPs07NejVz3qxfL6Xh2Rnx2Jse+9q8Jm6z 2Wy23jG46jd6zZiV8SFnn3D+zD1S+Hu0nO+LvdRHWcdDw3mt/FzoJfvB0U90lH3i7Bdn3zj7 x9lHzn7yHg3HQ8OpFfvadE2ceXzm01mb1/l0j8VtNpvNdqYah3aEfqMn6DZrx5ynZr6Xr8Ro IFrOuBHNOQ46zmvjddL34Ofi/mjcY4Vz2txzhbExY2TGyoyZGTsvcc903dcWa+KcY4v59Lhf W5wTj7F4rItbx202m82223Eqmsw4Gz1hbIi2sP+LsSJfmYNG/8jxPXzvcdBxXhd9FDSc/gd9 kou2dtak0dIrtz71fqto+BJ702NNXOfT9Zw4c/nsrYuxOK9N38/jeJbPZrPZbAer4Yz7GP8x BkdHGG+j3zwbhPuJsXbM3DN/5u/QcnTwuOj4/F5t2X1e9uN82Xw+nT1z7H+HBTPG4ryvrIuz Vh/vZ+w3sI7bbDabraVvzKMzl4suo8+MDdFtdI7xKlrDs74YN6I55Pk+5taPuo63zpfN96Yv sa9tfsaM/enzsTj76eDzHjMvwBxH7G/jtR6XfYM2m81mO3wNj7NXjAlZp0Vb2PeFznCmma/c YwxNZ2zOWDZ05yjr+HxvOq+Xn5E+Cj/Pun1tsSa+9Fic8T5z91du7azH8xroT/B+ZvMbx+ks n81ms9kOVsMZ7+k8M2NU9I09X2g3z7zmPBTOn/k7cpyxPg46Hnvvs31tzC/wM6GnT5r8+q3l 18RjLB7r4vQTGPNzbxnm1OHTV4r3U+c3eL1xlm+u5SPcC9dms9lsfePT0La7bH3yuV6MC9lz xTiRe5mxlxrnPmPMAfPcTtWdo67j2leZP0d83Zr4i1f62zufHmNx6lGXPgJ9Bcb9nE3n/dX3 kz0H7Edgzj/OAOh5vvl98zLXe+ba7Xa7fTzXM2Uxx4x2MD5lvhxtY634sSutYc2Yr8ToDnuy jouOr1sTj/u1ze/1svR8eozFY06dfgL74DnTFjrO+8m8OufGL9ra2TtIX4P1jTibr/faifvn hfN+2+12u30znOs+WoB+xxgcXWOtG21mjpexN9rN+i16g3PGmfVjxuTHRcfn93phPp3+Cvvz 4pw4fZOYT49z4r3z6evm1GNtHB2HiY7zfvKeM//B/kHWM3hPWbtnfp1+R9xvh3UP3mM87qVn t9vt9s1ytABNYB0crWD8x/wy+9cYm3L/E/Sb9VvmmXH+rLpzHHQ81sT1nDh9Fuat0UvmHOIZ ZvPnn6C9vWPx+Zw6Os5YP3ScvhF9JfpM7DuIPQeMydFyXif9K/od6DmfF5rOGD2c99xut9vt m+Fc99EBNAH9RidYB0eP0WXWiNl3xbotOsNeLOaZ+arzwMdFx+d78HU+Pe6dPt+frvdsW2os nul4rI/Th4i1Csbk9KXQcvpVvE7mDehn8R7rvXdwPkO73W63b46jAegB2oB+x170GIMz3mbs jXazF4s5Zr6q7hwXHV83n6770xkHxz3bWLPmXPcSY/FKx2N9nLPjMcfBmPzK1X4E5vmZJ6Cf wefDXgU0nc+L9xpn/SOccbvdbrfbx3au91z/ma9FF9hPhVZwXhotY0zIHi+0Bd1Ga5hfxhk/ ojvHScd1Pn2+P533QO/3ws+95FnxdToe6+OxX52+Ev0H+PQleC2My+M8AHrOe8znxOtlPx6O vuN8hna73W7fDOe6jxZwtgl9QMMY/6EdMYfOmBstY0yKnuE6flyn43HfkqOk4zGfnt3vhdfM e8DPr/dPX3Isrjoe6+OxXx1O9I1ivQItZ1xOf4r3l7kRXh/rHLzXzLnzmaHvdrvdbt8s5/qP DqAJcYaMfefr9Bu9wefzwKHjaP9R1vH5mXjd28b8NOsIvB+tsfgSOr5ubl3nOeDz3rLPjtfD HgT6F3xG6Dr7FXitce7Pbrfb7ZvjXPvRAfQAbUCH0Qt0I9NvtEbngfW883HR8ez+suwJWzcW 13u+LDWnnul4nD2ba3nsP2CenXUNXhN7FPiccNbQ0Xe73W63b57HuTG0AY1AK9Ctdfod88DZ fUuOg45n96djb36MxWNdPO75wlhYz4svNadejclDy2OOHT3nPY49hbzXeGi73W632zfT0QEc TUAj0G40A81CR+b6reu5x1HHY29b9qyXuE987FFnzjrOi/PzLT2nPtfx+bh8rud8Jnjoejiv zW632+2b6aEFaAMaMR97q35nenMcdTxbF497xbPXm/35cb4unoWSzakvpeOZls/1PDRd9yWo x55Du91ut4/vcw0I3Z5rd6ZXmY4fl31uOhbXPerz+8XP97ft55x6peeq6erxGdntdrvdPtcI 1ZDdrOUeNx2P577Es1fj3m3ze8bHnHo8D+WgdHw32m632+12e+Z72ZN1XHR8Phbn3m2xvy3u +xJz6vE8lNinHmvjh6XjdrvdbrcvPTY8Ux2P+7mhm9z7lDlt9pkxNkbH0dmD0PF4Biv9CJ1T 53konBlnnzr3Uud8Nj9LnDeLPW7WcbvdbrePruP6nBTuDccecOateX4He8oYBzMeZlzM+Pgg 59QZ/+ucepwZ517qvFZec9y/Lu4/u07HreV2u91uH03H9Xln7Bdj3xgayTNXONuFdqKhOqd+ 0Pvb6EPEPnX6FswVzJ/lpveRt47b7Xa7fRN0nHPW123t3AONNWbWmllzZu2Ze6wwp56NxQ/i rJnOqTOnz9x+rI2zds/95bmHG3vc1un4fH3cOm632+32UXScPd2c0eLecOgg41rGtzoW534r rEujpQc1nz7fpx46zto4e+7oX9DP4BkxZ6LjXiO32+12+3HVcX0+F/qGzjGnrmPxR6zGuMxZ c65L59PR04O+f5uujcc93NjjdpHsVZ/reOxzY64h7m/nuXW73W63j6Dj8Vwu7gPHmDX2t3Ef NObTGd8yX836891mGn4Qa+LZ2rjucVMd557qMR5nHmHdc1rnOm4tt9vtdvtxnE8PDY9xOHp3 1Mbh63Sce7HOdZzxOK+Ze8CwX509epwfZ36B+8BwPzedW/eY3G632+0jrIejcfP1cM6YcY7r MNfDq73qmY7HPjdeP3vsOT9Ov4SfjTXy7Nlv2b3n3V7sdrvdfpT1W5+HwhicMSvz6I/a2nnW J/PTsS+d/eAHvS99LzrO62XugP4HZ+T4WZhXoG8Sc+v0V1g70HXydVpuPbfb7Xb7UdTvmEOP +7XF+XDuncKedMbg3FPlMM6H70XHY7866/fco4ZnpNAXYV2AuQV+vhiT8zOzTh7z6+ue6Wo9 t9vtdvtR1+/sfquHeZ+2vexzY66f+QJeM2v4nIuLvW78XNybNcbk7N3jeSnMr4eWx7h83TNe s+e8uo3Z7Xa7/TD1O9bA2QvGWjJrysxJ63NP9H7pR0HD1+k458fpc7CPnnX8WCNnbp17rDMm p6/CmsG1q5+fPW+h5THHHmPz0PN1mp7put1ut9vte31m2dL6HXPoR2UMnum43gcm7svKGnnM rbMuwJicn5G1As7O8XOz5w0tj3E57wvr5bxHMTZXPWe+Xefc1f2cXLvdbreve254z/PD182f Z/rN3rDjoN/rdDzWyHVunTF57HdjnTzm10PLY1zOvj7uDxNj89BzxufsZw9NZ187uh7arh46 b7fb7fbN9ZjD1THfunncTdVv1fG4L+t8bj3G5OyvZ52c55fy87Jv7zIZlzPHzno5780TVmPz 0HPet9B05txD1xmro+3haPzcee/tdrvdvnke470Y37X2Tffo93GZP2/peKyRz8fkrJOzx55+ CvProeUxLucsGvd5Y+9bjM15r2J8znuHpjPnjq5zTi20nfvN42i83W632zfTGeOF61hP12VD y+fnmUPTN1G/182tx5g81sk5g8b8OnveQsvZ98Yc+/22dvbkx9gcPed8OePzK1eazvk09hAw TuecGtrOeD30XZ0zbHa73W7fLGecF2M9tDfGd7Fnet09xqzf+Zhc18n5+eZazs/POXjeC86j 8b6onjM+Z+2cPe1oOmfoeR/Rdebe0Xb2xuFoPM57bbfb7fbNc8Z5zN8y1pvvscruFRpz63y1 fu9ufn2u5ayXs/eNsTlr5qHnjM/Zz858O5rOnDv3jQld5/1kvI6+s6aOxoczJ2+32+32zXLG eczf8hzNWJNl3jaep6nP4dLzy9bv3c+vz7Wc94C9b7wfrJmz/y30/MLVfDuazv3feP/Qdcbq 7Ivj7Dn6znsbjtbb7Xa7fbOcuVvGedyPJOZv0XS957c+Fzt0HGetPO5/bv2utVzn2GO9nL1v 7GNnbK56zvg8NJ05d9bQ0XXeR7SdvXHoO2fQcXTebrfb7ZvnzN3GOI8xHroeZ59Yf2WOPZ7B pfcUQ8ut33tfL9exeeh5jM/RdPa0x5w7us46OrqO836i7zjn0HG03m632+2b54zz0FrGdDwT W5/Bxdy6PhM79q3jzLFbv/eu5ev0nPcpNJ1xeug6Y/XQ9nDeWxytt9vtdvvmeYzx0HPmatFf 1luZW0eXmVOPtfE4k8bedc4rW7/3R89jzl11PbQ99D003m632+2b6THGi3NPzMuy3srcOuvk jMU5wxTP0GQ8jnZzFo1zytbvZfV8rumh66rtoe9zR+/tdrvdvlmuz99iP1U8D5uxOOeY2K/O WDzuHYZ2o+mcS7Z+H4yuq7arh87b7Xa7ffM8xnfM16K5zK2zV4qxOGeUWReP52DHWXK+sk7O eTTr99HTervdbrdvjqPlaC3rq4zFWRvnLBP72y5bjcU5b8Z4/MrV2BtdZ73c+m2z2Ww22+EZ GstYHN1l7zPr4txrhPn02KOOjnPeDGfszXly5tqt3zabzWazHQ0NZ38b8+m6t42xdtzvE+3m DDlnyTlbbv222Ww2m+1wNRzNZU2cvW3occynMxaP+7/grJEzx85ZcvLWb5vNZrPZDs/QWnSX PeqxJh7nzOLeL3FfN/580dbOXDs6b/222Ww2m+1wNTz2tXH/EDQZbeacGToe9+vmK/eBYd86 Gs+Zcuu3zWaz2WyHr+FxxiyekYmO6326cWL+nrE68+7Wb5vNZrPZDlfDY00cPdbnY6LVen9u 9q3z9+TRe+u3zWaz2WyHa9WzMdXRbjSetXO+1/pts9lsNtvRGIvHvdv0eRvq/F2Mvfle67fN ZrPZbIev4XMdj/uwotnxrA3Vbuu3zWaz2WxHT8fXPVNDtdv6bbPZbDbb0dPxlttsNpvNZrPZ bDabzWaz2Ww2m81ms9lsNpvNZrPZbDabzWaz2Ww2m81ms9lsNpvNZrPZbDabzWaz2Ww2m22D 7NFbOzd05wHnd5n8tslvnfy5kz9Qvu8TK+OmsbdN33Hb1tUn33MJfuvWY1Y1Hr+184AXbi4b de+6+jtucBOM7e2tratO7DAuSRjc2G57+6oT29tvPHHzuW888Zzi++465d9/zkcnv+6sqt77 z7n47EvPxa87q6p36bknz7rh3Nsn7u0nqvdge/v26fVdftbN2x84wWu9ongfL0tq8B6deh8v wa84edsWfutW1Jm/p7x/88/qlnOmP6/ex3Wv85Zzzj9xyzlvPvvj2/j5J3ZTN6yqu2MfO3nN /fDTX6+2gf2qG22LGyAG4/3Te3Lx2TuMeycMvpe2QHup2gFtirZF+6PWFybfx82UaaN8/jvt 4PKzaBe0nao27Yt2RlusXiftldd6Jm3C7/H+v8e7v0Zec/K9l+CnXyOpe/Hq7+b1eX9b18eb T70f7df+usnfsOY1xs1Dg7f1e6f+Oy2+eXW9XhdjeqNSXt9xZV/dYGu+l621MnYVL82+psHW fC9ba2XsKh6JfW2DrflettbK2FU8EvsJDbbme9laK2NX8UjsJzbYmu9la62MXcUjsZ/UYGu+ l621MnYVj8R+coOt+V621srYVTwS+ykNtuZ72VorY1fx0uynNtia72VrrYxdxSOxn9Zga76X rbUydhWPxH56g635XrbWythVPBL7ugZb871srXVH/Lun/juNdUe8yi/CXtVay14TL81+RoOt +V621srYVTwS+/oGW/O9bK2Vsat4JPYzG2zN97K1Vsau4qXZz2qwNd/L1loZu4pHYt/QYGu+ l621MnYVj8S+scHWfC9ba2XsKh6J/ewGW/O9bK2Vsat4JPZzGmzN97K1Vsau4pHYz22wNd/L 1loZu4pHYj+vwdZ8L1trZewqHon9/AZb871srZWxq3hp9gsabM33srVWxq7ikdgvbLA138vW Whm7ikdiv6jB1nwvW2tl7CoeiX1Tg635XrbWythVPBL7xQ225nvZWitjV/FI7Jc02JrvZWut jF3FI7Ff2mBrvpettTJ2FS/NflmDrflettbK2FU8EvvlDbbme9laK2NX8UjsVzTYmu9la62M XcUjsV/ZYGu+l621MnYVj8T+0gZb871srZWxq3gk9pcR/86p/1K25nvZWitjV/FI7C9vsDXf y9ZaGbuKl2Z/RYOt+V621srYVTwS+ysbbM33srVWxq7ikdivarA138vWWhm7ikdif1WDrfle ttbK2FU8EvvVDbbme9laK2NX8Ujsr26wNd/L1loZu4pHYn9Ng635XrbWythVvDT7NQ225nvZ WitjV/FI7Nc22JrvZWutjF3FI7G/tsHWfC9ba2XsKh6J/XUNtuZ72VorY1fxSOyvb7A138vW Whm7ikdiv67B1nwvW2tl7Coeif0NDbbme9laK2NX8dLsb2ywNd/L1loZu4pHYn9Tg635XrbW ythVPBL7mxtszfeytVbGruKR2K9vsDXfy9ZaGbuKR2K/ocHWfC9ba2XsKh6J/S0NtuZ72Vor Y1fxSOxvbbA138vWWhm7ipdmv7HB1nwvW2tl7Coeif0m4t8+9V/K1nwvW2tl7Coeif1tDbbm e9laK2NX8Ujsb2+wNd/L1loZu4pHYn9Hg635XrbWythVPBL7OxtszfeytVbGruKR2N/VYGu+ l621MnYVj8S+ucHWfC9ba2XsKl6a/d0NtuZ72VorY1fxSOw3N9ia72VrrYxdxSOxv6fB1nwv W2tl7Coeif29Dbbme9laK2NX8Ujs72uwNd/L1loZu4pHYn9/g635XrbWythVPBL7lgZb871s rZWxq3hp9g802JrvZWutjF3FI7F/sMHWfC9ba2XsKh6J/UMNtuZ72VorY1fxSOwfbrA138vW Whm7ikdi/0iDrflettbK2FU8EvtHG2zN97K1Vsau4pHYb2mwNd/L1loZu4qXZv9Yg635XrbW ythVPBL7rQ225nvZWitjV/FI7B9vsDXfy9ZaGbuK94X9kVP/rWev8ouwV7WIfyJjS6z5XrbW ythVPBL7bQ225nvZWitjV/FI7J9ssDXfy9ZaGbuKR2L/VIOt+V621srYVbw0++0NtuZ72Vor Y1fxSOxbG2zN97K1Vsau4pHYP91ga76XrbUydhWPxL6twdZ8L1trZewqHon9jgZb871srZWx q3gk9jsbbM33srVWxq7ikdg/02BrvpettTJ2FS/N/tkGW/O9bK2Vsat4JPbPNdia72VrrYxd xSOx39Vga76XrbUydhWPxH53g635XrbWythVPBL7PQ225nvZWitjV/FI7Pc22JrvZWutjF3F I7Hf12BrvpettTJ2FY/E/vkGW/O9bK2Vsat4afYfb7A138vWWhm7ikdi/0KDrflettbK2FU8 EvtPNNia72VrrYxdxSOx/2SDrflettbK2FU8EvtPNdia72VrrTvi3zr132msO+JVfhH2qtZa 9pp4afafbrA138vWWhm7ikdi/5kGW/O9bK2Vsat4afafbbA138vWWhm7ikdi/7kGW/O9bK2V sat4JPafb7A138vWWhm7ikdi/4UGW/O9bK2Vsat4JPb7G2zN97K1Vsau4pHYf7HB1nwvW2tl 7Coeif2XGmzN97K1Vsau4qXZf7nB1nwvW2tl7Coeif1XGmzN97K1Vsau4pHYH2iwNd/L1loZ u4pHYv/VBlvzvWytlbGreCT2BxtszfeytVbGruKR2H+twdZ8L1trZewqHon91xtszfeytVbG ruKl2b/YYGu+l621MnYVj8T+UIOt+V621srYVTwS+2802JrvZWutjF3FI7H/ZoOt+V621srY VTwS+5cabM33srVWxq7ikdi/3GBrvpettTJ2FY/E/pUGW/O9bK2Vsat4afavNtia72VrrYxd xfvC/s1T/61nr/KLsFe1iH8tY0us+V621srYVTwS+9cbbM33srVWxq7ikdgfbrA138vWWhm7 ikdi/0aDrflettbK2FU8Evs3G2zN97K1Vsau4pHYv9Vga76XrbUydhUvzf5Ig635XrbWythV PBL7txtszfeytVbGruKR2L/TYGu+l621MnYVj8T+3QZb871srZWxq3gk9u812JrvZWutjF3F I7H/VoOt+V621srYVTwS+/cbbM33srVWxq7ikdh/u8HWfC9ba2XsKl6a/XcabM33srVWxq7i kdh/t8HWfC9ba2XsKh6J/fcabM33srVWxq7ikdh/v8HWfC9ba2XsKh6J/Q8abM33srVWxq7i kdj/sMHWfC9ba2XsKh6J/Y8abM33srVWxq7ipdkfbbA138vWWhm7ikdi/+MGW/O9bK2Vsat4 JPY/abA138vWWnfEv3Hqv9NYd8Sr/CLsVa217DXx0ux/2mBrvpettTJ2FY/E/mcNtuZ72Vor Y1fxSOx/3mBrvpettTJ2FY/E/hcNtuZ72VorY1fx0ux/2WBrvpettTJ2FY/E/lcNtuZ72Vor Y1fxSOyPNdia72VrrYxdxSOx/3WDrflettbK2FU8EvvfNNia72VrrYxdxSOx/22DrflettbK 2FU8EvvjDbbme9laK2NX8dLsf9dga76XrbUydhWPxP73Dbbme9laK2NX8Ujs/9Bga76XrbUy dhWPxP6PDbbme9laK2NX8Ujs/9Rga76XrbUydhWPxP7PDbbme9laK2NX8UjsP2iwNd/L1loZ u4qXZv+XBlvzvWytlbGreCT2f22wNd/L1loZu4pHYv9hg635XrbWythVPBL7vzXYmu9la62M XcUjsf97g635XrbWythVPBL7duIPn/ovZWu+l621MnYVj8T+Hw225nvZWitjV/FI7P/ZYGu+ l621MnYVL83+Xw225nvZWitjV/FI7P/dYGu+l621MnYVj8T+Pw225nvZWitjV/FI7P/bYGu+ l621MnYVj8T+fw225nvZWitjV/FI7FPfULA138vWWhm7ikdib51VszXfy9ZaGbuKl2bfqcHW fC9ba2XsKh6J/WkNtuZ72VorY1fxSOxPb7A138vWWhm7ikdin2iwNd/L1loZu4pHYp/VYGu+ l621MnYVj8Q+u8HWfC9ba2XsKh6JfU6DrflettbK2FW8NPvcBlvzvWytlbGreCT2H2mwNd/L 1loZu4pHYv/RBlvzvWytlbGreCT2ZzTYmu9la62MXcUjsT+zwdZ8L1trZewqHol9XoOt+V62 1srYVTwS+84NtuZ72VorY1fx0uxt4l8/9V/K1nwvW2tl7CoeiX2XBlvzvWytlbGreCT2ZzXY mu9la62MXcUjsT+7wdZ8L1trZewqHol91wZb871srZWxq3gk9uc02JrvZWutjF3FI7Hv1mBr vpettTJ2FS/N/mMNtuZ72VorY1fxSOzPbbA138vWWhm7ikdif16DrflettbK2FU8EvvuDbbm e9laK2NX8Ujsz2+wNd/L1loZu4pHYp/fYGu+l621MnYVj8S+R4Ot+V621srYVbw0+4IGW/O9 bK2Vsat4JPaFDbbme9laK2NX8Ujskw225nvZWitjV/FI7IsabM33srVWxq7ikdgXN9ia72Vr rYxdxSOx79lga76XrbUydhWPxL5Xg635XrbWythVPBL73g225nvZWitjV/HS7C9osDXfy9Za GbuKR2Lfp8HWfC9ba2XsKt4X9q+d+m89e5VfhL2qRXzfjC2x5nvZWitjV/FI7EsabM33srVW xq7ikdj3a7A138vWWhm7ikdi37/B1nwvW2tl7Coeif2ABlvzvWytlbGreGn2AxtszfeytVbG ruKR2Jc22JrvZWutjF3FI7Ef1GBrvpettTJ2FY/EfnCDrflettbK2FU8EvuyBlvzvWytlbGr eCT2QxpszfeytVbGruKR2Jc32JrvZWutjF3FS7Mf2mBrvpettTJ2FY/E/sIGW/O9bK2Vsat4 JPbDGmzN97K1Vsau4pHYX9Rga76XrbUydhWPxH54g635XrbWythVPBL7EQ225nvZWitjV/FI 7Ec22JrvZWutjF3FS7Mf1WBrvpettTJ2FY/EfnSDrflettbK2FU8EvsxDbbme9laK2NX8Ujs KxpszfeytVbGruKR2F/cYGu+l621MnYVj8T+kgZb871srZWxq3gk9pUNtuZ72VorY1fx0uzH Ntia72VrrYxdxfvC/tVT/61nr/KLsFe1iB+XsSXWfC9ba2XsKh6J/fgGW/O9bK2Vsat4JPZV Dbbme9laK2NX8UjsqxtszfeytVbGruKR2Nc02JrvZWutjF3FI7GvbbA138vWWhm7ikdiP6HB 1nwvW2tl7Cpemv3EBlvzvWytlbGreCT2kxpszfeytVbGruKR2E9usDXfy9ZaGbuKR2I/pcHW fC9ba2XsKh6J/dQGW/O9bK2Vsat4JPbTGmzN97K1Vsau4pHYT2+wNd/L1loZu4qXZl/XYGu+ l621MnYVj8R+RoOt+V621srYVTwS+/oGW/O9bK2Vsat4JPYzG2zN97K1Vsau4pHYz2qwNd/L 1loZu4pHYt/QYGu+l621MnYVj8S+scHWfC9ba2XsKl6a/ewGW/O9bK2Vsat4JPZzGmzN97K1 Vsau4pHYz22wNd/L1loZu4pHYj+vwdZ8L1trZewqHon9/AZb871srZWxq3gk9gsabM33srVW xq7ikdgvbLA138vWWhm7ipdmv6jB1nwvW2tl7CoeiX1Tg635XrbWuiP+lVP/nca6I17lF2Gv aq1lr4mXZr+4wdZ8L1trZewqHon9kgZb871srZWxq3gk9ksbbM33srVWxq7ikdgva7A138vW Whm7ikdiv7zB1nwvW2tl7Cpemv2KBlvzvWytlbGreCT2KxtszfeytVbGruKR2F/aYGu+l621 MnYVj8T+sgZb871srZWxq3gk9pc32JrvZWutjF3FI7G/osHWfC9ba2XsKh6J/ZUNtuZ72Vor Y1fx0uxXNdia72VrrYxdxSOxv6rB1nwvW2tl7Coeif3qBlvzvWytlbGreCT2VzfYmu9la62M XcUjsb+mwdZ8L1trZewqHon9mgZb871srZWxq3gk9msbbM33srVWxq7ikdhf22BrvpettTJ2 FS/N/roGW/O9bK2Vsat4JPbXN9ia72VrrYxdxSOxX9dga76XrbUydhWPxP6GBlvzvWytlbGr eCT2NzbYmu9la62MXcUjsb+pwdZ8L1trZewqHon9zQ225nvZWitjV/HS7Nc32JrvZWutjF3F I7Hf0GBrvpettTJ2FY/E/pYGW/O9bK11R/zLp/47jXVHvMovwl7VWsteEy/N/tYGW/O9bK2V sat4JPYbG2zN97K1Vsau4pHYb2qwNd/L1loZu4pHYn9bg635XrbWythVvDT72xtszfeytVbG ruKR2N/RYGu+l621MnYVj8T+zgZb871srZWxq3gk9nc12JrvZWutjF3FI7FvbrA138vWWhm7 ikdif3eDrflettbK2FU8EvvNDbbme9laK2NX8dLs72mwNd/L1loZu4pHYn9vg635XrbWythV PBL7+xpszfeytVbGruKR2N/fYGu+l621MnYVj8S+pcHWfC9ba2XsKh6J/QMNtuZ72VorY1fx SOwfbLA138vWWhm7ipdm/1CDrflettbK2FU8EvuHG2zN97K1Vsau4pHYP9Jga76XrbUydhWP xP7RBlvzvWytlbGreCT2WxpszfeytVbGruKR2D/WYGu+l621MnYVj8R+a4Ot+V621srYVTwS +8cbbM33srVWxq7ipdk/0WBrvpettTJ2FY/EfluDrflettbK2FU8EvsnG2zN97K1Vsau4pHY P0X8S6f+S9ma72VrrYxdxSOx395ga76XrbUydhWPxL61wdZ8L1trZewqHon90w225nvZWitj V/HS7NsabM33srVWxq7ikdjvaLA138vWWhm7ikdiv7PB1nwvW2tl7Coeif0zDbbme9laK2NX 8Ujsn22wNd/L1loZu4pHYv9cg635XrbWythVPBL7XQ225nvZWitjV/HS7Hc32JrvZWutjF3F I7Hf02BrvpettTJ2FY/Efm+DrflettbK2FU8Evt9Dbbme9laK2NX8Ujsn///7J0JvCdVdef/ aL/uVkSg2Zf2vQaFBmXpVgRRFAQabG1pkUVA3DWzGGd0ZvDzmQ8ZGOKQzJLJLJlFJj3tDKMS Y2JWY9IxcV9wN9GYxSyaEGNiEhOVkI253/+r2x5vn3+d169uPfrd/p3H4b3zTr/7rfrVrXuq 6lbVP2Db/FC2bctj98UtsX80YNv8ULZty2P3xS2x3x6wbX4o27blsfvi2uwfC9g2P5Rt2/LY fXFL7B8P2DY/lG3b8th9cUvsdwRsmx/Ktm157L64JfZPBGybH8q2bXnsvrgl9k8GbJsfyrZt eey+uCX2TwVsmx/Ktm157L64JfZPB2ybH8q2bXnsvrg2+2cCts0PZdu2PHZf3BL7ZwO2zQ9l 27Y8dl/cEvudAdvmh7JtWx67L26J/XMB2+aHsm1bHrsvbon9roBt80PZti2P3RePwn7/9Gs2 u8tXYXdtEf+8xzaxzQ9l27Y8dl/cEvsXArbND2Xbtjx2X1ybvSdg2/xQtm3LY/fFLbF/MWDb /FC2bctj98Utsd8dsG1+KNu25bH74pbYvxSwbX4o27blsfvilti/HLBtfijbtuWx++KW2O8J 2DY/lG3b8th9cUvs9wZsmx/Ktm157L64Jfb7ArbND2Xbtjx2X1yb/f6AbfND2bYtj90Xt8T+ QMC2+aFs25bH7otbYn8wYNv8ULZty2P3xS2xPxSwbX4o27blsfviltgfDtg2P5Rt2/LYfXFL 7I8EbJsfyrZteey+uCX2RwO2zQ9l27Y8dl9cm31vwLb5oWzblsfui1tifyxg2/xQtm3LY/fF LbE/HrBtfijbtuWx++KW2J8I2DY/lG3b8th9cUvsTwZsmx/Ktm157L64JfanArbND2Xbtjx2 X9wS+9MB2+aHsm1bHrsvrs3+TMC2+aFs25bH7otbYn82YNv8ULZty2P3xS2xfyVg2/xQtm3L Y/fFLbF/NWDb/FC2bctj98UtsT8XsG1+KNu25bH74pbYnw/YNj+UbdvaG79v+rUPa2/c5auw u7ZmsmfEtdm/FrBtfijbtuWx++La7C8EbJsfyrZteey+uCX2rwdsmx/Ktm157L64JfZvBGyb H8q2bXnsvrgl9m8GbJsfyrZteey+uCX2bwVsmx/Ktm157L64JfYXA7bND2Xbtjx2X9wS+7cD ts0PZdu2PHZfXJv9OwHb5oeybVseuy9uif27Advmh7JtWx67L26J/XsB2+aHsm1bHrsvbon9 pYBt80PZti2P3Re3xP5ywLb5oWzblsfui1ti/37AtvmhbNuWx+6LW2L/QcC2+aFs25bH7otb Yt8XsG1+KNu25bH74trsPwzYNj+Ubdvy2H1xS+yvBGybH8q2bXnsvrgl9h8FbJsfyrZteey+ uCX2VwO2zQ9l27Y8dl/cEvuPA7bND2Xbtjx2X9wS+08Cts0PZdu2PHZf3BL7awHb5oeybVse uy+uzf7TgG3zQ9m2LY/dF7fE/rOAbfND2bYtj90Xt8T+84Bt80PZti2P3Re3xP56wLb5oWzb lsfui1ti/0XAtvmhbNuWx+6LW2L/ZcC2+aFs25bH7otbYn8jYNv8ULZta2/83unXPqy9cZev wu7aIv6mxzaxzQ9l27Y8dl/cEvtbAdvmh7JtWx67L26JfX/AtvmhbNuWx+6LW2L/VcC2+aFs 25bH7otbYj8QsG1+KNu25bH74pbYfx2wbX4o27blsfvilth/E7BtfijbtuWx++La7L8N2DY/ lG3b8th9cUvsvwvYNj+Ubdvy2H1xS+y/D9g2P5Rt2/LYfXFL7AcDts0PZdu2PHZf3BJ7sraf bfND2bYtj90Xt8Q+JGDb/FC2bctj98UtsR8WsG1+KNu25bH74trshwdsmx/Ktm157L64Jfaa gG3zQ9m2LY/dF7fEngvYNj+Ubdvy2H1xS+y1Advmh7JtWx67L26JvS5g2/xQtm3LY/fFLbHX B2ybH8q2bXnsvrgl9iMCts0PZdu2PHZfXJv9yIBt80PZti2P3Re3xD40YNv8ULZty2P3xS2x HxWwbX4o27blsfviltiHBWybH8q2bXnsvrgl9qMDts0PZdu2PHZf3BL78IBt80PZti2P3Re3 xD4iYNv8ULZty2P3xS2xjwzYNj+Ubdvy2H1xbfaGgG3zQ9m2rb3xe6Zf+7D2xl2+CrtrayZ7 RlybfVTAtvmhbNuWx+6LW2IfHbBtfijbtuWx++KW2McEbJsfyrZteey+uCX2sQHb5oeybVse uy9uiX1cwLb5oWzblsfui1tiHx+wbX4o27blsfvi2uwTArbND2Xbtjx2X9wS+8SAbfND2bYt j90Xt8Q+KWDb/FC2bctj98UtsU8O2DY/lG3b8th9cUvsjQHb5oeybVseuy9uif2YgG3zQ9m2 LY/dF7fEng/YNj+Ubdvy2H1xbfZCwLb5oWzblsfui1tibwrYNj+LfUryR3XMTen7+uRP7b6f lPyIjn1ZWpgb0s+bneWkrTsPv2zNnYdvWvvOdZvWXtT9/dO675d2jJJXcrLBecIMPRbtvvlt Z+D7MrgVvWx3d/JdQbu707/YPdk2f89mfJfbLuvOz+j34uQXdD/zHcvfJ6ccMr09G3vzm99s iJPJ40wbns5sM5bzsc5yLvYDNN4594KebfHOdV9cc9T629bcmZy2nuT8O5bv8MNvW3P4dLvt Sd+3zh1++P3pb+5f09f2tSl/1vr5ubPW75zrW86z1vt94eLkx0/4SKfJ5LuS/0jqFO8wuiQJ bl+pflG73aNMP8+MPWmFtswtMvjbksHf7Vm3ZW7Puo1rb03+wLq71t6yfuPa86fO77fMZQ29 /nyu0ybLNO3Pm/GL5ndP8F2Tvv1S2ixdm+3cm9It9yxttq87dC79u3VfWo8fOifNDwzNX5f8 A2lhP5C+f1/yryZ/V/LrmDNM7X9P+kdf5h9OHpz+f9Fuf4b3c8JOv7+6G2PfxHi4a3EZX9uN ofnnQyYL05pLfl97MP8nk8lkMplMJpONYRzbei6ro2u+zJYvtdkYl97DtEVTTvlwTi+t8zvy WXfpvH/6Zm3RksuEnEI/wjhxfkNF1ls6L03f3Heztuh5aHd54rDkj+6cn/ndIzu9+be5X0vn pelLH0U/tDwi+YbkRyc/pvvO5bEjk/M2FbRmW/A3/K10jvWlX9J30Q9tj01+wmTxkt3JnfMz l/vRnH9D32abSOel6Uu/pO/SX9F2Y3Km6Zh2OW2yOG1yavKFTm+0pl+zTaTz0vWlf9JX0RZd z0x+VvJzOufnMzq955Of2G0T6bw0fRkb6J9M/6Ijmj4x+fnJnzJZnDp9cvKtndand9tCOu+f vowF9N0tnbZMgVyc/JnJL0nO3AVTK2jNNmBbsE3o++wDB7POS9GXcffxXT+l36Lt5cmvTL69 c36+LPnTu359rnTer/6LvowNF3Z9Fj13JN+Z/Orkz0t+VfJnJ9/WbQN0ps8fzDovtf8yfcp0 JeMA48KzOj2fn/y65Nz+gfMzeqP9FZ3O9PmDVech+tJ3r50sTgfflPzm5C/sfkbra5I/t+vr 9PmDUeca+t7YacvtWS/pnJ/R+mDXebn6UtNKfdH1ZcZf2ulMjj4+S2eOTVrVeX+OH5aq78uT v6JzfuZ35CKdW+zP+3v80Dc+ZH2ztq/s/GDWudb48KIZ+r6qss5ce1pNOo+lb9YUfbMfjP15 f8bf5YwPVt+DUeeV7L+ztB5L5wNB61rHv8vVt/X+vNTjh/3Vt298OJh0fqjHh1rjBtf2DkSd 90dfW9/6zi9q6NtKfx7r/KKGvi3ofKCOD2Mdb6z0vNWs+Xn0ZZvb+SHGOK6v2+u/+fqkd/1h DH1n9Wfvel2+/pznU3i0Ztb84Jj3I2WNYeT7S7ingWVgWVgm+gDLyLKyzCw719C5vs46sW6s I9fMrL5jaTyrL7Mfcf35+u46/3O6uSzmrfL8IPOwzHdzXwH3b3AvDffJcD/SGPfX2XvQ7BgB +7jkj5kszsEzR3xech4hY67NjhH0Yatx2Y/HHCtmaZz7MvsZ+xv7HeMbdYR6wrjH/sk4yP6a r22M0ZdtH2Y7Rn2YOWP6BfNtaMx6sD55HmMldJ6lbx4rqAv0Y/YxNKY/0C/oH7YvL0wW76MZ uy+X40Qeh8vjiDyPnDVmuRnv2B/py+hs5zQ8nccYh+Hk/mv1Zdsz/8p4Rj/m0UrGC+41oL/M qn/5/sXaGpfjBPfzMU5wn5Sdq2f56Avsd8wZo3OeU87znnncsMcXNXXuG4PZzmxvtjvLxFiM vvQJji+4j4N+nDWm/9CPqOtjjheRxixHvp+HYzbGC3Sm7rH/Uftyn6bf2PGZdS9rYC2NvRpH 30Xb3HfpB/Rf9j30pY8wHp/dHV/Y42Wrce3jOE/jfMwGnzGLmsdxG8tGf6b2oTU1hOXP/dqO 0bYO2mPlGuNEHiNoO/df9iO2M9s791vGBpaRZaV/cIyc76Vj/+TYgvE4jxUrobE9bsvHFejM stCfuf+P5eM8hH6d9eZ4mfUpjzfyOUnuyzU0zuNEec5BbeOcg+3NfmZ1pW8w3tF3WQf6b75X kbrDfkvNG3M8tscV1Fb6MtuVe1Lz/cGMWxzH0a/Rm77NMqN3vm8tH9cxDjIm5uNm9MjjRa1x IvdhagBjFNs2H5+x3Rlzs64sK7qy7KyDd38zfZj9OPfhMTS2fdnqzDZGa5aHfs2ysf0Zq+04 Ys9P6E/0K9YfHex4UUNj9gv2D/aTfD7HWJXPM/J4S1+gv9I/WGaWnXVgXVgnxsSsbz5us89E 1NTY9mWrc35Wg+VAb5Ypa577N/2CsQ2dqSfUFsZD6g7rn8eL2hozTrCfsL9QB6htHFva4zL6 ge2vLDvrwLqwTuUzJ2P04bIvl8/EoHV+5ohlQXOcsSuPJawDOjPO0X/oy+yzrDd1iPGypsa5 3qExxxKMExxDsP/Qhxm72OboS59F2/xcCcvOeuDl81O5/475TGD53Jx9vitrnt0+05HPB+k3 rB/ryfoyPuYxGT3QpabGjPNoTH1lbGKcYD+iD5fnb/maj12HvucAV+Iap/cMaKl9PifMx9Ks F+tHLed4jr5FHxtDY2ooGjPeM+4zFjNGUXs5R6YPM5aV525WS+9Z1gNhfs9qTx9gf2M9WB/G C+oMfYk+Rd9CY/ramBrnesfxBGMxNZgax/5FH2afs8diq+l+IZab5ad2UFPoO/QhjplXWmNq rNWYYzNqBRqzv63We94OVI2pd57Gq82ksTSWxtJYGktjaSyNpbE0lsbSWBpLY2ksjaWxNJbG 0lgaS2NpLI2lsTSWxtJYGktjaSyNpbE0lsbSWBpLY2ksjaWxNJbG0lgaS2NpLI2lsTSWxvuv Me8O2eloPPRdkFljnnXn/Q19GvP8bqsa844FNM7P/uf3K9j3mi7X83sV8jP/PPvO+xx4hwbv 1GhRY/ZHnunk2U6eS6cv0afss//2/Xr5XU7L8fzulfyevPzMP8/A88w/z8TzPgWe3+ZZ6RY0 ZvnRmD5D36EPsZ6sb/meyPzuG7Qe4uW72xj3L558+5l/no3neXSe4+Z57vwusdWoMcuNxvl9 e6xXfvaf96AwJpfvgbOfF7Rcp43yvW08j26f+ecZ+SMa0Zjlt8/+884Tnkvn+fv8mWL5HWXU JrTmWGOIo21+71X+bDLes8NYzFjlPfPP8+irWWPWg/XJ7z6170ZGZzTI781iv0ab5Tp/Ty1l /7DvZqLO5s+8YSxm7KIW814C3k+wWjXO71fIdY/xgney0JfpT+jMujNOUvPZn9Gbd1sMcdqg LbaffTcTz/vzfgf2J/arXO/yexVWo5Xvj7TvZEFn1pnxkfepoQN607d5h8gQpw3GIsYGtmN+ NxP65s+XzX04j8Wr+TObos/bpf7k95Rx7Iwe6L5c5+/zO9oYk/J72hij6L9ZX/suvNX8+ep9 74Vj3GB8zu8pQwM0p6/h6LIcz39PW/l9YvldYivxnraHSuP8fiH7Lqf83qz8nrL8GejU+6FO O/nz1PP7xGDldzPZz65fzfrO0tm+G471pV+z7jh9LL8nbojndmjTvk8sv0csv+vKvo9ptVv5 brisdX4/XH5HXH5PXA3P7eX287vEVuIdbQ+lzt774bLmY3r5PrHWtF2K5rPeFTfEvfYP1s+k l8lkMplM1ogxqcaBOpNAXKzJxqQPF6yyPdgZB5uLdt/8tjPwxYuItMFLsjmp4kA/t5snJTlo yow96Yxgy9wig78tGfzdnnVb5vas27j21uQPrLtr7S3rN649f+r8fsscF4Xtcu9Ovqtbbi7g lW2yTLvTv9i9Gb9ofvcE3zW9uEw75TqwvKU229NyH9ot9yxttq87dC79u3VfWo8fOreUdmtr Pva25MA4Mx5Imty1tn9bsv3YjmxPth3bkG3JNiW3P9ugxXWyfXfWOk377mTb/D2b8V1uu3zY FL8r27/VrA8XS8v2OXG8Na3DLevx/mW/hX87YxnzSVPmTT47/XJj9v9ZsXfRYrns7wnY5Gux S5YXiy32GOx/FbDJ12KXLC8Wu132bQGbfC12yfJiscUeg317wCZfi12yvFjsdtn/OmCTr8Uu WV4stthjsO8I2ORrsUuWF4vdLvt7c/yZ6dc+LPLTuMsPYZcsL7YsscWuxX5DwCZfi12yvFjs dtn/JmCTr8UuWV4sdrvsOwM2+VrskuXFYos9Bvv7Ajb5WuyS5cVit8v+/oBNvha7ZHmx2GKP wf63AZt8LXbJ8mKx22X/u4BNvha7ZHmx2GKPwf73AZt8LXbJ8mKx22X/h4BNvha7ZHmx2GKP wf6BgE2+FrtkebHY7bL/Y8AmX4tdsrxYbLHHYP9gwCZfi12yvHjF2Z+efs1md/kqbMNy2TPi Vtj/KWCTr8UuWV4stthjsP9zwCZfi12yvFjsdtn/JWCTr8UuWV4stthjsP9rwCZfi12yvFjs dtk/FLDJ12KXLC8Wu132fwvY5GuxS5YXiy32GOz/HrDJ12KXLC8Wu132/wjY5GuxS5YXiy32 GOz/GbDJ12KXLC8Wu132GwM2+VrskuXFYos9BvuugE2+FrtkebHY7bL/V8AmX4tdsrxY7IOA /anp12x2l6/C7tr64Vlsk6/FLlleLHa77F0Bm3wtdsnyYrHFHoP9vwM2+VrskuXFYrfL3h2w yddilywvFlvsMdhvCtjka7FLlheL3S77/wRs8rXYJcuLxW6X/X8DNvla7JLlxWKLPQb77oBN vha7ZHmx2O2y/1/AJl+LXbK8WGyxx2C/OWCTr8UuWV4sdrvstwRs8rXYJcuLxRZ7DPZbAzb5 WuyS5cVit8u+J2CTr8UuWV684uxPTr9ms7t8FbZhuewZsdjD2T8SsMnXYpcsLxa7XfbbAjb5 WuyS5cViiz0G+0cDNvla7JLlxWK3y357wCZfi12yvFhsscdg/1jAJl+LXbK8WOx22T8esMnX YpcsLxZb7DHY7wjY5GuxS5YXi90u+ycCNvla7JLlxWK3y/7JgE2+FrtkebHYYo/B/qmATb4W u2R5sdjtsn86YJOvxS5ZXiy22GOwfyZgk6/FLlleLPYKsT8x/ZrN7vJV2F1bPzuLbfK12CXL i8UWewz2OwM2+VrskuXFYrfL/rmATb4Wu2R5sdhij8F+V8AmX4tdsrxY7HbZPx+wyddilywv FlvsMdi/ELDJ12KXLC8Wu132noBNvha7ZHmx2GKPwf7FgE2+FrtkebHY7bLfHbDJ12KXLC8W u132LwVs8rXYJcuLxRZ7DPYvB2zytdgly4vFbpf9noBNvha7ZHmx2GKPwX5vwCZfi12yvHjF 2R+ffs1md/kqbMNy2TPiVtjvC9jka7FLlheLLfYY7PcHbPK12CXLi8Vul/2BgE2+FrtkebHY Yo/B/mDAJl+LXbK8WOx22R8K2ORrsUuWF4st9hjsDwds8rXYJcuLxW6X/ZGATb4Wu2R5sdhi j8H+aMAmX4tdsrxY7HbZ9wZs8rXYJcuLxRZ7DPbHAjb5WuyS5cVit8v+eMAmX4tdsrxY7HbZ nwjY5GuxS5YXi30QsD82/ZrN7vJV2F1bn5zFNvla7JLlxWK3y/5UwCZfi12yvFhsscdgfzpg k6/FLlleLHa77M8EbPK12CXLi8UWewz2ZwM2+VrskuXFYrfL/pWATb4Wu2R5sdhij8H+1YBN vha7ZHmx2O2yPxewyddilywvFlvsMdifD9jka7FLlheL3S771wI2+VrskuXFYos9BvsLAZt8 LXbJ8mKx22X/esAmX4tdsrxY7HbZvxGwyddilywvXnH2vdOv2ewuX4VtWC57Riz2cPZvBmzy tdgly4vFbpf9WwGbfC12yfJiscUeg/3FgE2+FrtkebHY7bJ/O2CTr8UuWV4stthjsH8nYJOv xS5ZXix2u+zfDdjka7FLlheLLfYY7N8L2ORrsUuWF4vdLvtLAZt8LXbJ8mKxxR6D/eWATb4W u2R5sdjtsn8/YJOvxS5ZXiy22GOw/yBgk6/FLlleLHa77PsCNvla7JLlxWKvEPuj06/Z7C5f hW1YLntGXJP9hwGbfC12yfJisdtlfyVgk6/FLlleLHa77D8K2ORrsUuWF4st9hjsrwZs8rXY JcuLxW6X/ccBm3wtdsnyYrHFHoP9JwGbfC12yfJisdtlfy1gk6/FLlleLLbYY7D/NGCTr8Uu WV4sdrvsPwvY5GuxS5YXiy32GOw/D9jka7FLlheL3S776wGbfC12yfJiscUeg/0XAZt8LXbJ 8mKx22X/ZcAmX4tdsvbGH5l+7cPaG3f5KmzDctkzYrFXN/sbAZt8LXbJ8mKx22V/M2CTr8Uu WV4stthjsL8VsMnXYpcsLxa7Xfb9AZt8LXbJ8mKx22X/VcAmX4tdsrxYbLHHYD8QsMnXYpcs Lxa7XfZfB2zytdgly4vFFnsM9t8EbPK12CXLi8Vul/23AZt8LXbJ8mKxxR6D/XcBm3wtdsny YrHbZf99wCZfi12yvFhsscdgPxiwyddilywvFrtd9mR9P5t8LXbJ8mKxxR6DfUjAJl+LXbL2 xh+efu3D2ht3+Spsw3LZM2Kxh7MfFrDJ12KXLC8WW+wx2A8P2ORrsUuWF4vdLntNwCZfi12y vFjsdtlzAZt8LXbJ8mKxxR6DvTZgk6/FLlleLHa77HUBm3wtdsnyYrHFHoO9PmCTr8UuWV4s drvsRwRs8rXYJcuLxRZ7DPYjAzb5WuyS5cVit8s+NGCTr8UuWV4stthjsB8VsMnXYpcsLxa7 XfZhAZt8LXbJ8mKxxR6D/eiATb4Wu2R5sdjtsg8P2ORrsUuWF4st9hjsIwI2+VrskuXFYq8Q +0PTr9nsLl+F3bV15Cy2yddilywvFlvsMdgbAjb5WuyS5cVit8s+KmCTr8UuWV4sdrvsowM2 +VrskuXFYos9BvuYgE2+FrtkebHY7bKPDdjka7FLlheLLfYY7OMCNvla7JLlxWK3yz4+YJOv xS5ZXiy22GOwTwjY5GuxS5YXi90u+8SATb4Wu2R5sdhij8E+KWCTr8UuWV4sdrvskwM2+Vrs kuXFYos9BntjwCZfi12yvFjsdtmPCdjka7FLlheLLfYY7PmATb4Wu2R5sdjtshcCNvla7JLl xQcV+4PTr9nsLl+FbVgue0Zck70pYJOvxS5ZXiy22GOwTwnY5GuxS5YXi90u+9SATb4Wu2R5 sdhij8F+bMAmX4tdsrxY7HbZjwvY5GuxS5YXiy32GOzTAjb5WuyS5cVit8s+PWCTr8UuWV4s tthjsDcHbPK12CXLi8Vul31GwCZfi12yvFhsscdgnxmwyddilywvFrtd9uMDNvla7JLlxWKL PQb7CQGbfC12yfJisdtlnxWwyddilywvFlvsMdhnB2zytdgly4vFbpd9TsAmX4tdsrxY7HbZ 5wZs8rXYJWtv/IHp1z6svXGXr8I2LJc9IxZ7dbO3BGzytdgly4vFbpe9NWCTr8UuWV4stthj sJ8YsMnXYpcsLxa7XfaTAjb5WuyS5cViiz0G+7yATb4Wu2R5sdjtsp8csMnXYpcsLxZb7DHY 5wds8rXYJcuLxW6XfUHAJl+LXbK8WGyxx2A/JWCTr8UuWV4sdrvsCwM2+VrskuXFYos9Bvup AZt8LXbJ8mKx22U/LWCTr8UuWV4stthjsC8K2ORrsUuWF4vdLvvpAZt8LXbJ8mKx22U/I2CT r8UuWV4s9gqx3z/9ms3u8lXYhuWyZ8Q12RcHbPK12CXLi8Vul31JwCZfi12yvFhsscdgPzNg k6/FLlleLHa77EsDNvla7JLlxWKLPQb7soBNvha7ZHmx2O2yLw/Y5GuxS5YXiy32GOxtAZt8 LXbJ8mKx22VfEbDJ12KXLC8WW+wx2FcGbPK12CXLi8Vul/2sgE2+FrtkebHYYo/B3h6wyddi lywvFrtd9rMDNvla7JLlxWK3y35OwCZfi12yvFhsscdg7wjY5GuxS5YXi90u+7kBm3wtdsny YrHFHoN9VcAmX4tdsvbG75t+7cPaG3f5KmzDctkzYrGHs3cGbPK12CXLi8UWewz28wI2+Vrs kuXFYrfLvjpgk6/FLlleLLbYY7CfH7DJ12KXLC8Wu132NQGbfC12yfJiscUeg31twCZfi12y vFjsdtnXBWzytdgly4vFFnsM9vUBm3wtdsnyYrHbZb8gYJOvxS5ZXiy22GOwbwjY5GuxS5YX i90u+8aATb4Wu2R5sdjtsm8K2ORrsUuWF4st9hjsFwZs8rXYJcuLxW6XfXPAJl+LXbK8WGyx x2C/KGCTr8UuWV4sdrvsF+f4vdOvfVjkp3GXH8IuWV5sWWKLXYv9koBNvha7ZHmx2O2yXxqw yddilywvFlvsMdgvC9jka7FLlheL3S775QGbfC12yfJiscUeg/2KgE2+FrtkebHY7bJfGbDJ 12KXLC8WW+wx2K8K2ORrsUuWF4vdLvu7Ajb5WuyS5cVit8v+BwGbfC12yfJiscUeg/0PAzb5 WuyS5cVit8v+RwGbfC12yfJiscUeg/2PAzb5WuyS5cVit8t+dcAmX4tdsrxYbLHHYH93wCZf i12yvFjsdtmvCdjka7FLlhcfVOz3TL9ms7t8FbZhuewZcSvsfxKwyddilywvFrtd9j8N2ORr sUuWF4st9hjs1wZs8rXYJcuLxW6X/bqATb4Wu2R5sdhij8H+ZwGbfC12yfJisdtl//OATb4W u2R5sdhij8H+FwGbfC12yfJisdtl3xKwyddilywvXg77lOSP6pib0vf0Z5Ondt9PSn4Ey7Zu kXVD+nmzs5y0deu6LXO3rMfvWntR9/dP675f2jFKXsnJBucJM/RYtPvmt52B78tglct2dyff FbS7O/2L3ZNt8/dsxne57T6u+xn9SsYDRiP+tmTwbx9Yd9faW9dtXLtn6lvmzl+Pb1x7S3Jy pW4XJz8++buT3578a8n3mOVIyNsPPA0vn3/rZtzXcOx2jzJ9LTO2Lkwm927o3zZbF+7dsHXh jcd8a/6Nx7xm4chj70s/v23q/P7eDXnbeMt9rtMmyzRd7s34RfO7J/iuSd++IW2Wrs0d85PJ 3d1yz9Lmjvm7N9wxf+exp2/C794gzaX5war565J/4RmHTLanYv0X6RevTd+vS4XsB1P7b03t vyH97l4K+eRB/nlntz/D+zlhp99fnfxJyd+U/ILU9o3p+5e7Y4T88yGThemxBvl97cH8n0wm k8lkMplMJmvLOAGwni9F4vb3smH62ku8nB5a53e41Vy2fxpbbTnF5yr8usL5HbmsedZbtn8a Z325nPHI5Id2lzRwfuZ3j+g0z3pL6/3XOOuLrodPFi89HZl8Q/ed3x3WaY7ebBNpvf8aox9a ousxyY9LfkLnTPUcO1m8fIn+6C2t909j9KIPox/6ouvJyeeTM73J9ONC8sckP7HTm23x6K7/ M45I66VpzLiAflyqRlOmJbn0e2byxyc/I/lpneYbu/5N35bW+6cxYwT6ndppenbyrZPFS+/4 EyeL0w9ozjagr9PvpXU8HpcaP7bTcUvy8yeL0zFM1zx9sjhd85ROc7bB6V2/l9ZL15hxlz7K VBY6XjhZvM3hsuTbOr88+TM7vZ+c/JxuXEFrxuyDXeulanxWpzE6oueVyZ+T/Lmd70i+vdOe /k1/ZxyR1vvXj8/rNEZH9Lwq+fOTX9v5Ncmf12lP/2Ye9YJA64PhmG9/xwrGYTR+dvKdnbYv mCxONd80WZwivz751V3fvkJaL6nmWY1zP0Zj+ux1nb43J39R8hd339Eb7ennfVqXtbFFrWto jJ7o+pLkLzWO3i+U1lU1RteXJX+58aVqPeuYrwWta2uMrq8onN+hfaQ1x3wtaj2Wxq8sPNI6 H4dwzNea1ks9z4tq3iyNX9X5waz1Sml8MGu90hofjFo/VBofTFovR2NuXa6l8cGgdZ/GXKNf rsZZ56Vq3LLWy9WYa0JjaDxL61nnMqtB6wNV45a0PtA1bkHrWRofcYBpvJq1jjRm3p85U+bz mCNlLi9rzPVjqzHX3ahRY2q8VK25fp3nCpiXYQ6M+Ubm0pnbZR6dexZW6v6QrDMM5oDYvtzD cvRkce6f+X3m/JkzZX70km6uiTkm5j64Ls+6sY5Djt9qHIOwnbmWzXZn+7OvcQzEMT37IHM5 zJtxDYZ9lONTxkX6Ff2LfpYfna+ptTf/z/ZlO7O92e5sf/oB/YF+wTypd50+65yvcY6ptdW4 1DnPEzAnw/hBf+Aa38VdP6G/cD8D/Yd+RH+iX4051zirL3OvkO3L3F/BMrKs7Ifsj+ic55xY r1laj10H85iRNWbfYttbnZ/VjXVln2ZOra9P19Y5usbJuJzvAUBn+jPzp4yBdn4va53H6TH6 dTlW5HE592PGMfYzxjTqB/WQcQ6dmZvM9yp4NTGP0/le4Jo62/pXjhlWZ/oz4wbLy36I1vQV +jX9hnXLY7WtiVbrmn3ZapzHZPow+rL96Qfsd/Rlxjr6CDWc/pzvCeGevnLsGKMe5rGZtsux mX0q3zfEHBH9gD6N1tRClh29Oe7IerOOeRyxc1I1dS6PL2zdK/Vl36NfcGzHmMHxHX2GcYP+ jM7MmzNOojP3sdYeo20NtDrncYPjOcZnloc+jdYsI3rTt1lulp/1YH3yvRhZ6/IYpKbOs44t 0JcxguML+gJ9gj7MHBf9mBqIxtRB+hB9aSXuJyvHjXxfMvsRfZoxmm2e7+mkb7OcVvPcx9Gb PoTWjNmMIeiAHrXGDv7e9uV8XJE1tuMDfZdzKrTleKm8F9Xe+0vfGvM42h5v5D6dz1HQmn7N sqA3NQPNOWdhWVlmNGc90Lu8Zsf65z5da+ywOrMN2ZbluR99lz6AthwrsT/Sd+291eyr9GPG i/L+6ny8MYbOuU/nYzu2bb7fHr3Z5vRvlo26kXVn+dGbupKPrxmzGa/p0/k8sbbO7CNsw9yX GbO4V4/xjGNQ+q7tt+hKf2H56Tvom58XQGP2Y/bnsc4J7TNmuU/Do1/DznqzPPn5EZYP3Vlm ex8z/ZoxhD7NPkw/o7/lelhD5zw25zGDbck4xbZlGzMGU0vyfdP0CXSlr7Ds9vkX9GXfpV9l jcfoy16fts+aZb3z81D5maisPXrbeRXGEPo09SdfX6Iesn+PoTP7CjWXMYO6x5hM3bD336Fv 7rPe81ysY36OrnyGbgydvecm0Ttrbp/xy89KsexoTb9m3KZPU3foV9R8zhHYr7PONY45ss7s I3lsph4wZjAus63Z5owTjA1ojLb5Gbmsae675TOKK/Fc6KxngPOzqdnz+JLP0RlDGAOpN4yN nHNRk9ifOd5iHB1LZ46X2XfYh9iXGJfZ5mx7xojyXNq6XceH+rnb8hlsO5bn80f2TfoPYyL7 Lccd6EwtzDrnY7uaOjMmMTZxLMmxHGMzxxeMy4xn9OV8fmevwa2WZ8fzMTf7IP2FsYN6k3Vm nHwodGbMYuxCZ/Yx9jXGi3z8sNqsT2eO76SzdJbO0lk6S2fpLJ2ls3SWztJZOktn6SydpbN0 ls7SWTpLZ+ksnaWzdJbO0lk6S2fpLJ2ls3SWztJZOktn6SydpbN0ls7SWTpLZ+ksnaWzdJbO 0lk6S2fpLJ2ls3SWztJZOktn6SydpbN0ls7SWTpLZ+ksnaWzdJbO0lk6S2fpLJ2ls3SWztJZ Oktn6SydpbN0ls7SWTpLZ+ksnaWzdJbO0lk6S2fpLJ2ls3SWztJZOktn6SydpbN0ls7SWTpL Z+ksnaWzdJbO0lk6S2fpLJ2ls3SWztJZOktn6SydpbN0ls7SWTpLZ+ksnaWzdJbO0lk6S2fp LJ2ls3SWztJZOktn6SydpbN0ls7SWTpLZ+ksnaWzdJbO0lk6S2fpLJ2ls3SWztJZOktn6Syd pbN0ls7SWTpLZ+ksnaWzdJbO0lk6S2fpLJ2ls3SWztJZOktn6SydpbN0Xq06Xz6CzvwtOr/U 0fkZB5HOj+10vjD5Zcl3JL82+Y3JX9z1Q3Qa4mwrthnb7vrkO5NfaXTenPwxjs4s82rXeUPy E5Ofmvzs5E9JfmnyZye/uut36ILW9EX0Xo7zt2hMX2bbsQ3ZZxijLkq+NfnpyTcmPyb5o5Ov X8U6Y1nnQzudT0h+SvInJD+/Gy/pZ1clvyb5DclvSn7zQGd7oTHjEWMG25Jtyj50bvLTkp+c /OiGdF7b6XxE8uOTL3Tj4xOTP60bO7Z3+/bzO23o20OcsYJ+jMbP6foyYwbb9qxun2IMYyw7 rOsLq1ln6go6P7IbB9lP2V/pT4zRrDfrj9bUKcZq+jaao9Fynb9nrKAfo/ElXV9m256ZfFO3 zY/sxjR0pk+sZp3nujpDv6H/MEYzdrC+jJUXdOPmM7vjjyu6sQTdl+v8PfoyVrAd0Zj6R19m G7OtqYHsY/QB+sJq15n9MY/R9J/juvXk+O7xybckP6+ri4wjT++0GeK0wbZDX/YZticaU/8Y t6gTecygD9AXVrPO+Zgjjx3UHNaPfZbjKsZJjrGoi4wjaM6+Td8b4rSBttQ89GXfYbuiMeMy 4xd9mW2fx+bVeOxc6kx/yX06a02/puZzvsA4gg70N3THqZXLdf6ethgj2Jboyz5EP84aMy7T l1f7mJF1pp9krTl+ylpznMc6ozdjNpqjBf0cR//lOn9PW7RJ/2X/YTxm+5Ya5768mnW2WrM+ rBdaM4YwNnIMwpiN5hzLojuOJkOddmgTbWGgL9uX7Ww1pg+0orPVOo8hWW/Wm/6F7uiAo/9Q px3axGk/6wu7NY09rVm3rDfry3pn3XG0qOG5PTxrC9Pq25LGpdZZ76x51n1Mzxzbf7O3bnZd S/1ruceQyWQymUwma9KYdOZAnosAnJjuTr5rsjiBxEW0bA92xsHo7vQvdk8un3/rZnzX9GIm bXCxlxMvTgZyu5z08jsOqDJj68Jkcu+GRQZ/WzL4u60L927YuvDGY741/8ZjXrNw5LH3pZ/f NnV+f+8GLnrOWm4u0pVtskzT5d6MXzS/e4Lvml48pZ1yHVjeUps75ieTu7vlnqXNHfN3b7hj /s5jT9+E371hKe1m62t30e6b33YGvu/yWs33f1tum79nM+5vSy7w8TMnH3l7ctBc8l6TtuuR x/ZvV7Yl25Rty3Zke7Jd2b7kyu3BBW4uTl2T4N9M4n13+r7jYd9epmS3c9EwLxOTy0xo8DPf sfx9csoh+W8ml7z2h79jP8jtrdR6Xdyt1xVpfb6S1utfpu83mvVKJ9a3H3j9ZGn7/EqOJTtO nEwuW9O/3+848bI1nz9hz5odJ26d23Hi/Ws+t3D/GiZd6Tflv59OtG+6f805m+bnztm0c452 Z/27czZtWvuWqe+c62vvLZu+uObKTbcl7m1raI8bUcp/R7/bceJta1jWh2Js07ZaPdvq9Sek nzsdZ22r159w0prXn/D9az+3CT9pjfqA+oD6gPqA1+7rkv/QFWsm96QVek36+Q1JgLen77em 9jemRranP7h5Opv9oLkuejv3H+zzc8JOv796sjhx/qbk39i2ZvL19Jc/0Omdfz5ksjA9piS/ rz2Y/5PJZDKZTCaTyWQymUwmk8lkMplMJpPJZDKZTCaTyWQymUwmk8lkMplMJpPJZDJZPdM7 u2QymUwmW311e9b7TXlsvaaX7zgta7tMJpPJZLKl1e9cQ8t3wXvvged9/Mtx733ws94Fr1ou k8lkMtnS6nc+586fU0SdLT83J3/uzREDPH9uTv7sHBjUd5i5lquOy2QymUy29Pqdz71z7abG UnPtZwzy+YB8vuMQ9z5jkLrOsQK1nPPyso7LZDKZTCbza3g+/6Z+U0up3dRYai6fR81r2PkM 5fyZygsDPH8mM5/HzGc9w4BFLee8vKzjquEymUwmk+1r+Ry8rN+cJ1NfqbWbJosf63L6ZPFj Sc4c6Gd0bfERbqd0NZ1jBGo55/y2jnNsoXNxmUwmk8n8Gk6dpF5y/TzXb2oqtfu05I9Pfnby LcmfmPy85E9epvO3fGTZ1uTnTBY/Uo3jglO783zqOOfjHEswP65zcZlMJpPJ9rV8HZ06yTk4 57/MT3PtfKGrrdRu6jYf0c7Hm/Jx7xcnv2SZzt/yWaR8zOlTupp+bnd+Th3n2IFjCObHORfn +oBquEwmk8lk+9bwfB2desk5OPebcT7MdW7qNzWW2k3tvSz5FcmflXz7Mp2/vTL55V1Np5af 39Vxjhk4djjenIvn6+mq4TKZTCaT7VvD83V06ib1kzrKnDXn3xd2tZba/ezkVyV/XvKrB/jO 5Du6Wn5p8ou6YwWuq+dzca4HcF2A6+l5Tlwmk8lkMtm3a3ieC+ecl7rJfWzU0bO682Oue1O/ qbnU32uTvyD5Dct0/va65M9P/tyujj9zsnhdnXNx5t+5DsD1dJ5t4xo/1/pVw2UymUwm27eG c67LOS/Pd/G8F9fRqaecg3OezPk3597U3huT35z8Rct0/vamrpZTxzk24Lo65+Kc93M9nfvU uabPnLhquEwmk8lk/TWcc17OfTkH5rkv7kFnrnpbd77M+Tf1mzr80uQvW6bzty/u6jjHBDu7 c3HO97mezr1tC5PF+9OPmCzO06uGy2QymUz2nZafK+NcN9dwngfnXJhzYu5B5zo6dfb65C9M /pLkL0/+imU6f0sd51iAc3Guz3OvG3PuPHvGc2w808a8vGq4TCaTyWRLq+Fcvy5rOOfIXEen hnMdnPpLLX5l8lctw/lbzsep4cyPcz2da/XMiTP/rhouk8lkMtnwGs717VzDOWe2NXw59Run 9lPDuZ7OtXnVcJlMJpPJVMNlMplMJlMNVw2XyWQymUw1XDVcJpPJZDLVcJlMJpPJZKrhMplM JpOphquGy2QymUymGq4aLpPJZDKZarhMJpPJZKrhquEymUwmk6mGq4bLZDKZTKYaLpPJZDKZ arhquEwmk8lkquGq4TKZTCaTqYarhstkMplMphouk8lkMplquGq4TCaTyWSq4arhMplMJpOp hstkMplMphquGi6TyWQymWq4arhMJpPJZKrhMplMJpPJVMNlMplMJlMNVw2XyWQymUw1XDVc JpPJZDLVcJlMJpPJVMNVw2UymUwmUw1XDZfJZDKZTDVcJpPJZDLVcNVwmUwmk8lUw1XDZTKZ TCZTDVcNl8lkMplMNVwmk8lkMtVw1XCZTCaTyVTDVcNlMplMJlMNl8lkMplMNXxlavjVquEy mUwmk1Wt4U/qavizRqrhL1INl8lkMpmsSg0/3NTwM1aoht9gavglquEymUwmky27hh+XfL6n hlN3qb9j1fAnq4bLZDKZTLbkGk599Gr4eckv7mo4dXYla/hCIzX8kCW4TCaTyWRDajh1knpJ Dad+ntnVU+rq9q7OUm/HquEwcg2HzTKwLKuxhtv6zDLjDzeef4erjstkMplsSA1f29XJI7tz X65jP2GyODfNfWacI/P8l63h1OHl1nDqv1fDOefn3N/WcK4NcI1gtdRwW7up18xT4Cx/9vy7 XM9Vx2UymUy2nHpDHaGGH5p8Q/ITk5+a/KzkFyS/NPlzkl8zWbyHnOfBatZwrs8z1871+lzD uY7P9fzVVsPL2s0yo+265OuNE/N78raOy2QymUy2PzWHWkNNOSz5UclPSv645OckvzD55cmf m/za5Dclf0nyl1eo4dzbzj3uuYbzDDr3z3EfXa7h3COfazjLeSDXcFu/c+2mXnN9g+OjRxnn d7mWq47LZDKZbDlm72fj2fBjJovPlZ2efGvyi5Jfkfyq5Nclf2GFGs7f2Rp+ffKdXQ1/+mTx vTI8m85ysDwsF/WOGn6g1riyflObqdPUa5b/iMniPAXOz/yOuo7u/Nt8fKIaLpPJZLKl1h17 HZ3akufCmY+296R7z4bXqOEcE3BswDECxwocM2xJflryjcmP7q4PHMg1vKzfLCt6Uqep2awD 1xOYF+A7xyXMWXB9gX/Hv2cb8Peq4TKZTCZbat2hLlJD7HX0xyY/e/Kdc+Hl/WxDazjn8ZzP 5xrOtXqu2T81+bmTxWv5J3fLxLJxrnog1jivfnPuzfEQtZu6zf0FrAvHJHwnppZTx6nznK/b c3GZTCaTyZZ6Dm6fKWMOmuvYXEd/WvJt3TkydZa58Hw/29DnyqjhtEWbzLPvSH7ZZHH+neMH jiOoddQ5auKBWMP76jfn2iw/8wFc1+AeQdaJ7wvdsRL/hvN0/oa/1TtsZDKZTLbU+p3rDue5 nDPmc3DuR+eZsvxceHkdvcb9bLM+s4xzf/inJD+hq3Fcb87XmldD/eYcm/NtajfXE7g/j7kJ 3lvDz/yOYyXWj+sMnIuvpmfnZDKZTPbQ1h5bd/Iz4ZwfUmPyOTjXtjk/5jzZPlNWYy7cPldm nw2372g7UN/v8v/ZOw94y66qDj90ZqLGAlgT1JmHUQOWJIhdFBUClkjsoNixY1ewoMEKCqHb gDiAErBiF8VCr6EqsWIXG/YSG+L93tw9/n9n1l1rJmvfNzPrrf1YzPyz5q3v3nXKOnufffY5 nfpNf5tccj1y+c6Je/wYYwz8d65RRl+c++K9lmy3bt26dTvdusPY9JjHNt5xwjwyniejL7zs g+t89Fnz2aI56fpc2blS306nfjOWwXUItZt5geTzA9djG3w/6ji5Ht9xXKcw1tA1vFu3bt26 ac3R+Wte3WFdNmoOtZQ54uOZcPrg9Jmz4+j8ns5n4174cj7bmJPOZzrX5qSfSf2mVlO7Gc/g mXeMOff8N74jfXHGGhj/GPcLztV5e926devWbbs12rLlemHUCPq01EXqho77jrpDzWFu2ZiL Pu6Dz+yD671w1n6Dxfx3+qr0Ufk859p8tjOt38zNu/M6l1yfYNzvp45zncT1Et+T8XSuVcY9 cfriugZrW1tbW1td0/doDNP1ucc6n9QHag5j08yj4l4zzzqNusM9cOoOdWaMoTPOrXPRs3PZ luPoyzVWN71z9Gw/O32m9ZvxBPLIWAa5ZL4efzLHn+/JtQr3LMZ4OtuCayqurcaaL3zntra2 traDY5z7dV1u6gFjtNQGajf92vHME/OimR9Nf3D0G6k71NOrN4yhZ/rgYz768rlwXduF64hz 7V74zanfjCmQR+4RkEuMv1PH6Zcz1sG/Za76mNtGLOo4/XFdk7Wtra2t7eAY9RqjFlADqQv0 u6kRPMtE35u6wVqqjFuzNvnoN1J3qKmjfo8x9Oxc9NMdR6dvynUFNU3Xdjlb98Jvbv2mVpNH 7kWQS4y599Rx5u7RF2d+G9+X7cC4A9+Z/jjj6nx3rrfa2tra2g6Oce7HqAP0t6kJ1G3qA31b ajfjt9Qc5lVRR+j/jn7jqN+sx6b1e0YffMxlO91x9OVz4ftdw6P6rfchlvV7jGPwHcklf6L5 voyrj7441088e0Yd5944YyNcF7C9GCtpa2trazsYxnl/GPWFmk1NoG5Taxij1uedxpwr5lpR V0bdGfVb74HP7oOPtdnol3KPmHoWjaPvZw3P1m/uETDOwP0CjO9LHWfcgesk+uI8u8c2oI7T HycW359xiLGeW1tbW1tbbeN8r0YNoK9NPeD5Je53M2ZOjaSvS93gOSdqDrWENVwY5x11Z3b/ e9kH5/461wkwdW22sb7qGEcf89H3ew3xWfV7XAdhfGfqOHMEGV8n58wBoI5z/cL357qKbcQ1 FjWdfLS1tbW1HQzjvI9RAxgnp77Qx2O8nHvNjJmPZ52o3dyHpubQN6SPSI2h1myjfntz2XgW fbwv/Nh6/P9szUefVb9HHrlmwfg7NX3Uca5fqOPcRxjPnHFdRT0nJtdZbW1tbW0Hyzj/Y9QC aiN1gb4edZsxa2rGqN30B6k59Impq/QXqTfL+p0dQ7f64LCtuWzLdV32cxx9dv0eeeRPreP8 m9Ef5/eo5cTguoptRE1ne7W1tbW1HRwb64hQB+jfUhOo2YxXUyfo9zKnin73qN3a99bnx2b0 vzfdB7f64DxjtZzLtp/rumyrfo/xh3ENQw5Gf3zMc6OWs12IQ16YI8D2amtra2s7WMb5H6MW UBOoDdSIUbepG2OuFfVmG31vawx9zEVf3gfXtU6ok8ylX77Da9s1fBv1W6+Dxt9HHvg3/Fu2 Ab835q3TNyfWeBatra2tre3gGXUAoyaMZ5tG3aaOar9ba/fs+j3G0DfNRef+vNcH34+5bNuu 38O0juvY+pjvxnbROextbW1tbQfTRi2gLoyaTa1Y1u1t1G6t32MMfcxj45qCcQHqH/fox1x0 vQ+uffBtj6Nvu35b+VjW8lHPR00fNuazt7W1tbXVNz3/Dxu1YdSKTXV7Vu2OxtDHPDbu3VMP eY5q07u7tt0H36/6bV3bLOu53jNva2tra2tb1ohlzZ5dtzfVb2octY4x9DGPjbnyy/d2jXVV 92Mu+tmo3149b2tra2tr82wb9dqr3+Me+KYxdH1n11iTTZ8H348++HgXK33/Ub+X72HdRv1u a2tra2s7l0zHh/UeOHPqxjz0TWPo4x3h9IfHGPq2++BwuF7guoHrB+7FMx7AurTMseMzjvfA dP1ua2traztI9VvvgfPMG8+tj3no9HHHGPrZmsc2xtAZv+cagvfCcE3BtQVr3C3fw9r1u62t ra3tINVvnknnObJxD5y12nlHF/PQuee8HEPfdh981HCuE7QPzjPpfB4+F/PkWZuWz8vn9t7D 2vW7ra2tre18rd3L+99W/R7vyh73wHnHJu9SY0105qHv1xj6aGMcfdwH5zMwnj/64GMMnXF/ 5tAzjsD9gK7fbW1tbW0HpX7r+zVZi+3ynRPvUaNWMm7N+LXOQ9+vNVVHDR9z0fkcvLeV++DM k2e+POu/ah+cZ+7Henaz3gPT1tbW1tZ2tuv3WAOc+Wub6jf3l+njshYb9ZLnyMY9cJ2Hvl9r qo4azjUEn4X78tyfZ5yf8X7GDfQ++HgfzOiDd/1ua2traztfa/e49631m/Hm5fi51m/6uTqH bT/vgZ9pP1zvhVPDRz985vtY29ra2trazubYOXO0x/uwx/xzat+4/72s38wdYw7Zci22/arf p3M/nGfCeW+r3g9nfGF5P3w/n7tva2tra2ubUbv1/ZnM1aafyvot1DveY0IflvrN/e9zrX5v mpc+1mZjzZkxL53rEMYTdF461yxj7dqu421tbW1t58O4udX3HmPn1DjWQKHfylww6h/zz5m/ xv1vq37v5xy2TTXcej6czzvmpo/nw3V9l/Gu9a7jbW1tbW3nW+0e89aoZ6y9xtg5fVVqHePP 3EumH8vzY4xNc5+Z+9+b6vfZquE6nq7PiC/XWeU7jXVWGWvoOt7W1tbWdq7X7THfXGs3Y8nj vvfoe7P22pi7Rs1jThjrpPD8N/1a5nyfS/V7U1/cet8J34U15ca9cdaK7Tre1tbW1na26/Wm uj3ud1u1m3FzxpS57828NfrerJ3Ks1jc+2aNcWofNXCsgT7mn4/73+dC/da++LKOM7+NtWf2 q473u3ja2tra2k7HrHdVj/eKa91mrhr1iTFzrd2Mm/PMNLWMeWuj780z1Yydj3vf9GWphdxn 1vo95q+d7fqdreOZcXXv/eH9HvG2tra2NstGrdZ6jTG/XOs2fW7mqjEPmzHz0e/W2s1cL+57 M29t9L15fyhj59z7ZkyaWjjWbzkX6/fZqOPe2MfYLrpt2tra2toOrlGf1agzo14zRj5q9uhv j7pNbWKdFsaNma82ajdriDNuzjPfzPniOSz63swDo96NsXPufY/1U8/W82PnUh3fNE9w1Gu9 jhrbpq2tra3t4Bm1ZGnU6VGr6WNTr6k71GzGyZlfTn971G363Dznzf1unhUb/W5qN3WMcXOe +aa2ad+bsXP63jp37Vyv39uu46OWb5rnvxz/YNuM7TO2UVtbW1vbwTRqNEb/GqNeU3OYV07N ZpycOkR/mznm1G363NQo1mmhXjFfjX73qN2Mm/PMGM9iUeO0732uj52frTqua8uP+j3mHPB7 41pqbJuxfdra2traDpYx90yNOk3/evSxqdfMK6dm8+wz7yWhv81YOXV79LmZq8b9bsbMtXYz Z41xc54ZG/e9z8e+937Vcb3vTf0efe/lfMGxfdg2jIOwfdra2traDp5RV4ZRp+lfU6vvvK7X PBM2ajb3uJlfTn971G363Kx1cmx9v5sxc/rdm2r3+dr33nYdp2brXLXl+vJcc/F7497F2D7E ZPu0tbW1tR0s4/71MJ7/ok6PWk0fm3rNWqKjZjNOzrqo9LdH3aZO0eemZnG/m/q1rN1j3Px8 73tvs47T59Y5hWON2lG/xxp3XFOxrcb1FOMgbB/m/re1tbW1HTxjzVOMOk2toVbTx6Ze089m PTVqNnPLWVeN/vao26PPzVy1cb/bq92V6vfMOs5cNeYa6jP3zFPgfjfj5tRvrru4tqJmE4v1 2rmeYvsQv62tra3t4Bn1GeNeNnV61Grua1N/WI+Fms2aatzjpr+tdZt6xRot1C4dM69eu2fX cfrd1O4xf228441/p2vMc21FrDEOwjUV26itra2t7WAZtRnjPjZGncaoO9Rr+tmsZT5qNuPk PBs26rb2uXWuWrUx823XcearMW9tPCegY+jc++Yex3jHG9da1G2209g+bW1tbW0Hz6jNw6g1 2KjV9LExajZj5KNmj/621u2D1OfeVh2nZtP3Hs+NMf+ceYfcA+feN/c3GC+hfuuc/3FN1dbW 1tZ2MI0aPYxabdXrUbN1nLzr9pw6zjMB9Lmp2+NZfJ4d4xkB5rBxD5y5CdzfGO+JGevMj23U 1tbW1nawbNRmrdHDqNWjXls1u+v2vDrOfDXqNX3y8cz3mIfOfXD+HX1w7n8wH4HxEV1nfmyj tra2traDZ6M+L63r9f7Vcfrb1GzWv+Me+HiOjOf7mIPOHDbmLNAHJ854z5tuo7a2tra2g2fd zm4d53k+nvWmz03dHs/rU9uZi84zZIyj8zvMV2AMnT44sbt169atW7duZ7eO09emXlPL6Xtj 472tYy4b89CZx0YNJ1bX8G7dunXr1u3s1nHqM8+M0d+mltMvx/g7a7jwvD7j6DxLMO6Fdw3v 1q1bt27dzn4d51kx5qtRq6nl9MvH+njH1j7+Df+W3xnvXe8a3q1bt27dup3dOn7LnRPzzXlu jHrN+Lquk0dfffTBef5vzGfrGt6tW7du3bqd/TrOfW7mnFPL6XNTt8d6edRvfZcM89n4/Z6P 2K1bt27dup39Os48NdZtoVbTLx/r5mFjXfrlO9i7hnfr1q1bt25nv45Tm6nR1HLGy6nZ1tr0 ui591/Bu3bp169bt7Ndx7m9Tnxknp1bTNx9mvVem63e3bt26det2btTxZS0f9VzXvj3I74Xr 1q1bt27dztU6rrV81HNrPdxeW69bt27dunU7d2t5r43brVu3bt26devWrVu3bt26devWrVu3 bt26devWrVu3bt26devWrVu3bt26devWrVu3bt26devWrVu3bt26devWrVu3bt26devWrVu3 bt26devWrVu3fW8fvHPiZSK32Tnxos/jK7tuZfda2XvKv3vDurFY+fHVvzi+c9ejT7kUu27n Q9YxPnLnxMvFWNR8xOWF3/w3FlUbjKsu3tm5y6ETjMsNBr9/1cV3OXTjRc84dNXFdzh81cU3 HXr1sZsO3XP13y81/j0LsF6we9Ohy3aPHr5s9+rDxN307y7b3T1y/Z5dfdiLd/3uaw7dffea FfeaQ8S7xPh3LPh61cXXHOKz3snJ46bvuJfHS7E7HT2+g123M+Isc0r+ltvq/het/r7O46Zt df+LbnPo/hc9+Mird7HbHDqduKN5cU+01x698nbYqZ9X94FtxR37FtthMK7f3dnZPXKCsWmb 3Zztf0fj37GI/9j+mX110+cc++qZ7BOd4+3n+PTPkVcefeql2KnnSOLurv/bMj75HefHTd/v xovIR/zZ77eyB2z4jGPR6sHbedXezyn6xot8TVu+7OJ8Zd81YKs/y9ZYFtvTs9lXBmz1Z9ka y2J7uhL7bgFb/Vm2xrLYnq7EvnvAVn+WrbEstqcrsT8qYKs/y9ZYFtvTldgfHbDVn2VrLIvt 6UrsjwnY6s+yNZbF9nQl9scGbPVn2RrLYnt6NvuqgK3+LFtjWWxPV2J/XMBWf5atsSy2pyux 7xGw1Z9layyL7elK7KsDtvqzbI11Ur9y7+cU1km99k9hr2NtZG/Qs9kfH7DVn2VrLIvt6Urs TwjY6s+yNZbF9nQl9icGbPVn2RrLYnt6NvuTArb6s2yNZbE9XYn9yQFb/Vm2xrLYnq7E/pSA rf4sW2NZbE9XYn9qwFZ/lq2xLLanK7HvGbDVn2VrLIvt6UrsewVs9WfZGstie7oS+9MCtvqz bI1lsT1dif3pAVv9WbbGstiens2+d8BWf5atsSy2pyuxPyNgqz/L1lgW29OV2J8ZsNWfZWss i+3pSuzPCtjqz7I1lsX2dCX2Zwds9WfZGstie7oS+3MCtvqzbI1lsT1dif25AVv9WbbGstie ns3+vICt/ixbY1lsT1di3ydgqz/L1lgW29OV2J8fsNWfZWssi+3pSuwvCNjqz7I1lsX2dCX2 FwZs9WfZGstie7oS+4vQr9j7Mdnqz7I1lsX2dCX2Fwds9WfZGstie3o2+0sCtvqzbI1lsT1d if2lAVv9WbbGstiersS+b8BWf5atsSy2pyuxvyxgqz/L1lgW29OV2F8esNWfZWssi+3pSuyv CNjqz7I1lsX2dCX2VwZs9WfZGstie3o2+6sCtvqzbI1lsT1dif3VAVv9WbbGstiersT+moCt /ixbY1lsT1dif23AVn+WrbEstqcrsb8uYKs/y9ZYFtvTldj3C9jqz7I1lsX2dCX2/QO2+rNs jWWxPT2b/fUBW/1Ztsay2J6uxP6GgK3+LFtjWWxPV2J/Y8BWf5atsSy2pyuxvylgqz/L1lgW 29OV2A8I2OrPsjWWxfZ0JfY3B2z1Z9kay2J7uhL7WwK2+rNsjWWxPT2bfU3AVn+WrbEstqcr sR+Ifvnej8lWf5atsSy2pyuxvzVgqz/L1lgW29OV2N8WsNWfZWssi+3pSuxvD9jqz7I1lsX2 dCX2dwRs9WfZGstie7oS+zsDtvqzbI1lsT1dif1dAVv9WbbGstiens1+UMBWf5atsSy2pyux Hxyw1Z9layyL7elK7O8O2OrPsjWWxfZ0Jfb3BGz1Z9kay2J7uhL7IQFb/Vm2xrLYnq7EfmjA Vn+WrbEstqcrsa8N2OrPsjWWxfb0bPbDArb6s2yNZbE9XYn98ICt/ixbY1lsT1diPyJgqz/L 1lgW29OV2I8M2OrPsjWWxfZ0JfajArb6s2yNZbE9XYn96ICt/ixbY1lsT1diPyZgqz/L1lgW 29Oz2d8bsNWfZWssi+3pSuzvC9jqz7I1lsX2dCX29wds9WfZGstie3or7Jft/Wxmr/1T2OtY 6B+w2KLVn2VrLIvt6UrsHwzY6s+yNZbF9nQl9mMDtvqzbI1lsT1dif24gK3+LFtjWWxPz2Y/ PmCrP8vWWBbb05XY1wVs9WfZGstie7oS+4cCtvqzbI1lsT1diX08YKs/y9ZYFtvTldhPCNjq z7I1lsX2dCX2EwO2+rNsjWWxPV2J/aSArf4sW2NZbE/PZv9wwFZ/lq2xLLanK7F/JGCrP8vW WBbb05XYTw7Y6s+yNZbF9nQl9vUBW/1Ztsay2J6uxH5KwFZ/lq2xLLanK7GfGrDVn2VrLIvt 6UrsHw3Y6s+yNZbF9nQl9o8FbPVn2RrLYnt6NvvHA7b6s2yNZbE9XYn9EwFb/Vm2xrLYnq7E /smArf4sW2NZbE9XYv9UwFZ/lq2xLLanK7GfFrDVn2VrrJP6pXs/p7BO6rV/CnsdayN7g57N /umArf4sW2NZbE9XYv9MwFZ/lq2xLLanZ7N/NmCrP8vWWBbb05XYPxew1Z9layyL7elK7J8P 2OrPsjWWxfZ0JfYvBGz1Z9kay2J7uhL7FwO2+rNsjWWxPV2J/UsBW/1Ztsay2J6uxH56wFZ/ lq2xLLanZ7N/OWCrP8vWWBbb05XYvxKw1Z9layyL7elK7GcEbPVn2RrLYnu6EvtXA7b6s2yN ZbE9XYn9awFb/Vm2xrLYnq7E/vWArf4sW2NZbE9XYv9GwFZ/lq2xLLanZ7OfGbDVn2VrLIvt 6UrsZwVs9WfZGstie7oS+9kBW/1Ztsay2J6uxH5OwFZ/lq2xLLanK7GfG7DVn2VrLIvt6Urs 5wVs9WfZGstie7oS+/kBW/1Ztsay2J6ezX5BwFZ/lq2xLLant8K+Ye9nM3vtn8Jex0K/0GKL Vn+WrbEstqcrsV8UsNWfZWssi+3pSuwXB2z1Z9kay2J7uhL7JQFb/Vm2xrLYnq7EviFgqz/L 1lgW29OV2C8N2OrPsjWWxfb0bPbLArb6s2yNZbE9XYn98oCt/ixbY1lsT1divyJgqz/L1lgW 29OV2K8M2OrPsjWWxfZ0JfarArb6s2yNZbE9XYn9mwFb/Vm2xrLYnq7E/q2Arf4sW2NZbE9X Yr86YKs/y9ZYFtvTs9k3Bmz1Z9kay2J7uhL7twO2+rNsjWWxPV2J/TsBW/1Ztsay2J6uxP7d gK3+LFtjWWxPV2L/XsBWf5atsSy2pyuxfz9gqz/L1lgW29OV2H8QsNWfZWssi+3p2ezXBGz1 Z9kay2J7uhL7DwO2+rNsjWWxPV2J/UcBW/1ZtsY6qV+y93MK66Re+6ew17E2sjfo2ew/Dtjq z7I1lsX2dCX2nwRs9WfZGstie7oS+08DtvqzbI1lsT1dif1nAVv9WbbGstiens3+84Ct/ixb Y1lsT1di/0XAVn+WrbEstqcrsV8bsNWfZWssi+3pSuy/DNjqz7I1lsX2dCX2XwVs9WfZGsti e7oS+68DtvqzbI1lsT1dif03AVv9WbbGstiens3+24Ct/ixbY1lsT1divy5gqz/L1lgW29OV 2H8XsNWfZWssi+3pSuy/D9jqz7I1lsX2dCX2PwRs9WfZGstie7oS+x8DtvqzbI1lsT1dif1P AVv9WbbGstiens3+54Ct/ixbY1lsT1di/0vAVn+WrbEstqcrsf81YKs/y9ZYFtvTldj/FrDV n2VrLIvt6Ursfw/Y6s+yNZbF9nQl9k3oF+/9mGz1Z9kay2J7uhL7PwK2+rNsjWWxPV2J/Z8B W/1Ztsay2J6ezf6vgK3+LFtjWWxPV2L/d8BWf5atsSy2pyux/ydgqz/L1lgW29OV2K8P2OrP sjWWxfZ0Jfb/Bmz1Z9kay2J7uhJ77x84bPVn2RrLYnu6EnvnsM9Wf5atsSy2p2ezbxGw1Z9l ayyL7elK7DcK2OrPsjWWxfZ0JfYbB2z1Z9kay2J7uhL7UMBWf5atsSy2pyuxDwds9WfZGsti e7oS+0jAVn+WrbEstqcrsS8I2OrPsjWWxfb0bPabBGz1Z9kay2J7uhL7TQO2+rNsjWWxPV2J /WYBW/1Ztsay2J6uxL4wYKs/y9ZYFtvTldhvHrDVn2VrLIvt6UrstwjY6s+yNZbF9nQl9lsG bPVn2RrLYnt6Nvut0C/a+zHZ6s+yNZbF9nQl9i0DtvqzbI1lsT1diX2rgK3+LFtjWWxPV2Lf OmCrP8vWWBbb05XYbx2w1Z9layyL7elK7LcJ2OrPsjWWxfZ0JfbbBmz1Z9kay2J7ejb77QK2 +rNsjWWxPV2J/fYBW/1Ztsay2J6uxH6HgK3+LFtjWWxPV2JfFLDVn2VrLIvt6UrsiwO2+rNs jWWxPV2JfZuArf4sW2NZbE9XYr9jwFZ/lq2xLLanZ7PfKWCrP8vWWBbb05XY7xyw1Z9layyL 7elK7KMBW/1Ztsay2J6uxD4WsNWfZWssi+3pSuzdgK3+LFtjWWxPV2LfNmCrP8vWWBbb05XY 7xKw1Z9layyL7elK7EsCtvqzbI1lsT09m/2uAVv9WbbGstiersR+t4Ct/ixbY1lsT2+F/cK9 n83stX8Kex0L/e4WW7T6s2yNZbE9XYl9acBWf5atsSy2pyuxbxew1Z9layyL7elK7NsHbPVn 2RrLYnu6Evs9Arb6s2yNZbE9PZv9ngFb/Vm2xrLYnq7Efq+Arf4sW2NZbE9XYr93wFZ/lq2x LLanK7EvC9jqz7I1lsX2dCX25QFb/Vm2xrLYnq7EviJgqz/L1lgW29OV2HcI2OrPsjWWxfb0 bPb7BGz1Z9kay2J7uhL7jgFb/Vm2xrLYnq7Eft+Arf4sW2NZbE9XYr9fwFZ/lq2xLLanK7Hf P2CrP8vWWBbb05XYHxCw1Z9layyL7elK7A8M2OrPsjWWxfb0bPYHBWz1Z9kay2J7uhL7gwO2 +rNsjWWxPV2J/SEBW/1Ztsay2J6uxL5TwFZ/lq2xLLanK7E/NGCrP8vWWBbb05XYHxaw1Z9l ayyL7elK7DsHbPVn2RrLYnt6NvvDA7b6s2yNZbE9vRX2C/Z+NrPX/insdSz0R1hs0erPsjWW xfZ0JfZHBmz1Z9kay2J7uhL7LgFb/Vm2xrLYnq7EvmvAVn+WrbEstqcrsa8M2OrPsjWWxfZ0 JfbdArb6s2yNZbE9XYl994Ct/ixbY1lsT89mf1TAVn+WrbEstqcrsT86YKs/y9ZYFtvTldgf E7DVn2VrLIvt6Ursjw3Y6s+yNZbF9nQl9lUBW/1Ztsay2J6uxP64gK3+LFtjWWxPV2LfI2Cr P8vWWBbb07PZVwds9WfZGstie7oS++MDtvqzbI1lsT1dif0JAVv9WbbGstiersT+xICt/ixb Y1lsT1dif1LAVn+WrbEstqcrsT85YKs/y9ZYFtvTldifErDVn2VrLIvt6dnsTw3Y6s+yNZbF 9nQl9j0DtvqzbI1lsT1diX2vgK3+LFtjWWxPV2J/WsBWf5atsSy2pyuxPz1gqz/L1lgW29OV 2PcO2OrPsjWWxfZ0JfZnBGz1Z9kay2J7ejb7MwO2+rNsjWWxPV2J/VkBW/1ZtsY6qZ+/93MK 66Re+6ew17E2sjfo2ezPDtjqz7I1lsX2dCX25wRs9WfZGstie7oS+3MDtvqzbI1lsT1dif15 AVv9WbbGstiersS+T8BWf5atsSy2p2ezPz9gqz/L1lgW29OV2F8QsNWfZWssi+3pSuwvDNjq z7I1lsX2dCX2FwVs9WfZGstie7oS+4sDtvqzbI1lsT1dif0lAVv9WbbGstiersT+0oCt/ixb Y1lsT89m3zdgqz/L1lgW29OV2F8WsNWfZWssi+3pSuwvD9jqz7I1lsX2dCX2VwRs9WfZGsti e7oS+ysDtvqzbI1lsT1dif1VAVv9WbbGstiersT+6oCt/ixbY1lsT1dif03AVn+WrbEstqdn s782YKs/y9ZYFtvTldhfF7DVn2VrLIvt6Urs+wVs9WfZGstie7oS+/4BW/1Ztsay2J6uxP76 gK3+LFtjWWxPV2J/Q8BWf5atsSy2pyuxvzFgqz/L1lgW29Oz2d8UsNWfZWssi+3pSuwHBGz1 Z9kay2J7uhL7mwO2+rNsjXVSP2/v5xTWSb32T2GvY21kb9Cz2d8SsNWfZWssi+3pSuxrArb6 s2yNZbE9XYn9wICt/ixbY1lsT1dif2vAVn+WrbEstqdns78tYKs/y9ZYFtvTldjfHrDVn2Vr LIvt6Urs7wjY6s+yNZbF9nQl9ncGbPVn2RrLYnu6Evu7Arb6s2yNZbE9XYn9oICt/ixbY1ls T1diPzhgqz/L1lgW29Oz2d8dsNWfZWssi+3pSuzvCdjqz7I1lsX2dCX2QwK2+rNsjWWxPV2J /dCArf4sW2NZbE9XYl8bsNWfZWssi+3pSuyHBWz1Z9kay2J7uhL74QFb/Vm2xrLYnp7NfkTA Vn+WrbEstqcrsR8ZsNWfZWssi+3pSuxHBWz1Z9kay2J7uhL70QFb/Vm2xrLYnq7EfkzAVn+W rbEstqcrsb83YKs/y9ZYFtvTldjfF7DVn2VrLIvt6Urs7w/Y6s+yNZbF9vRs9g8EbPVn2RrL Ynu6EvsHA7b6s2yNZbE9XYn92ICt/ixbY1lsT1diPw793L0fk63+LFtjWWxPV2I/PmCrP8vW WBbb05XY1wVs9WfZGstie7oS+4cCtvqzbI1lsT09m308YKs/y9ZYFtvTldhPCNjqz7I1lsX2 dCX2EwO2+rNsjWWxPV2J/aSArf4sW2NZbE9XYv9wwFZ/lq2xLLanK7F/JGCrP8vWWBbb05XY Tw7Y6s+yNZbF9vRs9vUBW/1Ztsay2J6uxH5KwFZ/lq2xLLanK7GfGrDVn2VrLIvt6UrsHw3Y 6s+yNZbF9nQl9o8FbPVn2RrLYnu6EvvHA7b6s2yNZbE9XYn9EwFb/Vm2xrLYnp7N/smArf4s W2NZbE9XYv9UwFZ/lq2xLLanK7GfFrDVn2VrLIvt6Ursnw7Y6s+yNZbF9nQl9s8EbPVn2RrL Ynu6EvtnA7b6s2yNZbE9XYn9cwFb/Vm2xrLYnp7N/vmArf4sW2NZbE9XYv9CwFZ/lq2xLLan K7F/MWCrP8vWWBbb05XYvxSw1Z9layyL7elK7KcHbPVn2RrLYnt6K+zn7P1sZq/9U9jrWOhf ttii1Z9layyL7elK7F8J2OrPsjWWxfb0bPYzArb6s2yNZbE9XYn9qwFb/Vm2xrLYnq7E/rWA rf4sW2NZbE9XYv96wFZ/lq2xLLanK7F/I2CrP8vWWBbb05XYzwzY6s+yNZbF9nQl9rMCtvqz bI1lsT1dif3sgK3+LFtjWWxPz2Y/J2CrP8vWWBbb05XYzw3Y6s+yNZbF9nQl9vMCtvqzbI1l sT1dif38gK3+LFtjWWxPV2K/IGCrP8vWWBbb05XYLwzY6s+yNZbF9nQl9osCtvqzbI1lsT09 m/3igK3+LFtjWWxPV2K/JGCrP8vWWBbb05XYNwRs9WfZGstie7oS+6UBW/1Ztsay2J6uxH5Z wFZ/lq2xLLanK7FfHrDVn2VrLIvt6UrsVwRs9WfZGstie3o2+5UBW/1Ztsay2J6uxH5VwFZ/ lq2xLLanK7F/M2CrP8vWWBbb05XYvxWw1Z9layyL7elK7FcHbPVn2RrLYnu6EvvGgK3+LFtj ndTP3vs5hXVSr/1T2OtYG9kb9Gz2bwds9WfZGstie3o2+3cCtvqzbI1lsT1dif27AVv9WbbG stiersT+vYCt/ixbY1lsT1di/37AVn+WrbEstqcrsf8gYKs/y9ZYFtvTldivCdjqz7I1lsX2 dCX2HwZs9WfZGstie3o2+48CtvqzbI1lsT1dif3HAVv9WbbGstiersT+k4Ct/ixbY1lsT1di /2nAVn+WrbEstqcrsf8sYKs/y9ZYFtvTldh/HrDVn2VrLIvt6UrsvwjY6s+yNZbF9nQl9msD tvqzbI1lsT09m/2XAVv9WbbGstiersT+q4Ct/ixbY1lsT1di/3XAVn+WrbEstqcrsf8mYKs/ y9ZYFtvTldh/G7DVn2VrLIvt6Urs1wVs9WfZGstie7oS++8CtvqzbI1lsT09m/33AVv9WbbG stiersT+h4Ct/ixbY1lsT1di/2PAVn+WrbEstqcrsf8pYKs/y9ZYFtvTldj/HLDVn2VrLIvt 6UrsfwnY6s+yNZbF9nQl9r8GbPVn2RrrpH7W3s8prJN67Z/CXsdC/5vFFq3+LFtjWWxPV2L/ e8BWf5atsSy2pyuxbwrY6s+yNZbF9nQl9n8EbPVn2RrLYnu6Evs/A7b6s2yNZbE9XYn9XwFb /Vm2xrLYnq7E/u+Arf4sW2NZbE/PZv9PwFZ/lq2xLLanK7FfH7DVn2VrLIvt6Urs/w3Y6s+y NZbF9nQl9hsCtvqzbI1lsT1dib1zxGerP8vWWBbb05XYtwjY6s+yNZbF9nQl9hsFbPVn2RrL Ynt6NvuNA7b6s2yNZbE9XYl9KGCrP8vWWBbb05XYhwO2+rNsjWWxPV2JfSRgqz/L1lgW29OV 2BcEbPVn2RrLYnu6EvtNArb6s2yNZbE9XYn9pgFb/Vm2xrLYnp7NfrOArf4sW2NZbE9XYl8Y sNWfZWssi+3pSuw3D9jqz7I1lsX2dCX2WwRs9WfZGstie7oS+y0DtvqzbI1lsT1dif1WAVv9 WbbGstiersS+ZcBWf5atsSy2pyuxbxWw1Z9layyL7enZ7FsHbPVn2RrrpH7m3s8prJN67Z/C XsfayN6gZ7PfOmCrP8vWWBbb05XYbxOw1Z9layyL7elK7LcN2OrPsjWWxfZ0JfbbBWz1Z9ka y2J7uhL77QO2+rNsjWWxPV2J/Q4BW/1Ztsay2J6ezb4oYKs/y9ZYFtvTldgXB2z1Z9kay2J7 uhL7NgFb/Vm2xrLYnq7EfseArf4sW2NZbE9XYr9TwFZ/lq2xLLanK7HfOWCrP8vWWBbb05XY RwO2+rNsjWWxPT2bfSxgqz/L1lgW29OV2LsBW/2b2Ldd2ZuvmUw7fpOVffD6z9us7JZr9l1W H+Zeq79fanxOYt140V0O3XjR7pHrd3eP3Gn9+x+y/vMj14wlb8kZDc57bsjHifbao1feDjuV wVT0ZdzjK7suiHt89S+O71x59KmXYteZcfnu/J38fdbKPmD9d/6kjT93bnuLvenZtCc/+clC 3Nl5V4lh5Zltxue8xPicJ/YDcnz14Xs62+L63dccuvvuNYdefeyaQ8S6o/Hv+HxXXXzNoasu Zrs9Y/XnHQ5fdfFNq9+56ZAX+4Ldmw5dtnv08GWrz+B9zsv2Puep+8KdV/YOfMbVP/rC1Z8P XQV9muTlgp2dB+7XfjE77lvLfj4Yl6y26RWHTzD43SWD37tk94rDl+ze/sjrjt3+yL13H3vk htXfH7Nn/PcrDo8cWvvz5UZMPtPe/nwpdqejx3ew63a847Jzc/q5ufbYzs6F68+9KTfXHrvw 8OrfXfD6XezCw53zcyPnX83vP3pn5z6r886DVn9/8OrPp6/+fPgq/q1W8e+z+kd/xj/cecPe /59oD/ww6+8r7N6f912fY5/A+exROzufuPrzq9bn0PH3W+wc26u5+E9tbxj/69atW7du3bp1 63buN64Tl9btzHM3hqbG8JTqzmucR80d3SG6XWr8N2zktnO6OY8jhwyTXbDuRr6pGJr/PvKq Oe32/3nUHL7Zyi5c2Vus7C3F0Px38jpy2vm080iOGMogb7daD/G8zcredv3nrdfDJSOn7Kdj Hz3I+VzmkX2RHJFD8saQ9MUre0cx9Nuvc0xOyTv55/cPaj41j+OYZl9kvyNXDNcdW9m77JwY 0n+39Z/c9nnndU7fbp33g5xPa38kj+xr7IvkihwyhMhw53uv7LL1n++xsndf55T9lLyTT/bn g5ZPL4+sknR0vQ+SwytW9r47J27TfeDK3n/nxLDt5Su7/c6JW1nknXyyPx+kfG46rkceOabZ 59j/yNkHrexDV/bhK/uI9Z8M55PX91nnm+P+oOUz2h9HHjmW32+dM25P3G1lH7Wyj17/eeU6 p9wGId/vdcDyeSZ55DhmX7zrOn8ft7KPX9knrOzqtSan5JlbQgcpn6dzXFNjOAeSR+5tse99 7DqHn7yyT10ZUwL485PWOf2Yld1lnU/OqdXzeab748jjVev9kNx92sruvbLPWP/JrcxPWed5 5JPzQeV8ZvLIrVTy+Okr+8yVffbamIpDTsnvQcnnmRzXXO8s88jxzD5I7j5nZZ8rRk7JL3km 35XzeXPPj5vy+Hkru8/a+Dv55L9Xz2f2uN6Ux89fm+a0cj5nH9fLPH7BIqdV87mt41rzOKxy Prd9XGseK+dzm8e1lcOq+dyP8+NByOfpjvfMPK4r5nObdeZMcni6+TxX+0fWfa5xX2GM447x R8bNGO8Z4xSjf833m7E/Wvkc1596PW/1N8f40hj/fCcZn+d+x7gft637m3r/Gg48uPD5HHwe Phfbm+3O5+Vz8/n5HnwfvtfoX/N9x3fP5nGZz9E/gkP/nfEQxpvusR6vY1yZceY7rO95cD+E +x3c67zlzon7mxxz29o3rWP7rXZO3C/kPhf3X263vq/AuDfjtYzjMt44ju0xVjH62DNzuTzO te/ONuSY4NjgGOFY4dzDOYhzOscS5yaOLc5VHGvjWN/GvkmsTfsk55yxT3LssE8yVss+wL6w zOXYL7d1jI9zpo4rjVxy3mYbs63Pxr6px7eeJ637NJwnRy7vLmORHGMca9SdTfncxj7J9mM7 MobMuYb9cuRy030O67w5O5fLvg3HN/epeRyS2k0uOVfyGe+8PpbGfYZt5vN088h25VjhPM4x Pu7BkUvufVI7uae8rOnjON/2uZJcsl+O+7AcM5yH2DfJJ/dt+PzsD9xbWOZzxnXRyKU1vsn5 hfMMNZDjZOSR7c0xxLUbx/jYL8nlNs+Z3jUlbGq4zg0Y97XZ7lzPcTyNfZTvxX4y8sk5bdSh m5PLcXzrOXLsj+Rx3Gtjm7Jt2cb0w8Z99jF3gWNrzF3YtF/OzqXOn+Iczbmacyb55POwfann 5JTPOnLKtSb7BPkc++e4Rhr75s3N5Ti+9RqI7cV2Y1/kGohtSg45pqnd5JBtz3wFjivyyH7B scYxp/O+tnGMjzo+9s3lPCqujcgpn43PqPspxz3fh3yOa/fRByIH4zjPHN9jnxzX5mw38sjx zDYdOWQ/5Dji/MjnXc73WvZ/ZtYea99km435kfA5Lsgp86XYT9nOI6fMVxljHBxn7CvsM3zn 0Q8ax/nNzaX2c9gnObY5r3A8kEfqItt25JDtzvbn8465iOyPfB/2k23O7bTm7ZJPuBzvfAY+ y8jrOPY5n498cnxxvuLcRU3lO4/jfEYuOb7Z19nnqTVcl3F+YTty3hnzucaxzDHF57XmyC77 5LNzucznON7HPOgxl5fckledt0ad5xjju3Hc8V2pDZzbsrkcdYdcjrEh6g3HALWa8wzbc/S7 2dbkj8/JZx7zt0cO92P+9vL5hpHTkVc+hx7/et3EPsF34rvxHTmXjXMmOSAXmVxyzuXcSy6p bVyPc3xzLLBPjj7iyOM4jkfurOcK9mvczXpuRPPL5ySfo5/Jd+E7cS3C9R37DfvP7FxyDuZc zLmS8wl1j1rDPsm5ke1LHvUYXtq58izRyC/bmeOGz8534Djn3M9+wv5C/SGX7EezcznqDvWb cyXXaZwnOUY4L3LckMfz4XkWPh+flc/M8UQdYr9g/9h2LrluJZfUN80ldXssFcExM/s6p1ou ub5a5pJ6R93pXHYuO5edy85l57Jz2bnsXHYuO5edy85l57Jz2bnsXHYuO5edy85l57Jz2bns XHYuO5edy85l57Jz2bnsXHYuO5edy85l57Jz2bnsXHYuO5edy85l57Jz2bnsXHYuO5edy5m5 ZD2OkcurjVzenPXcDnIuWd+A52jH8/jLtQ3O1MaaBuM5fJ5NZ/0E1h+qlEue5eSZTp7t5Bly nptlf9Hn8XmGnH2TfC7XrY5srFfC9tDn8HlGnWfVWc+AtQx47prnnc/3XLI/sF+wf+jz+LqO yVgXhpyeqek6RGO9kjvv/P9z+Dy7zrPjPH/Nc9hjbZfzJZd8VrY/+wH7w/J5/PHOibFuEXng eCcnZ2r83liHiO0z1hLU5/B5hv2WO///7Pj5lks+sz6Pz5ohPEM+1s9j39G1tcgptf1MjRzq mlhsp7HuHecV6zn882Xtf83lWGOL+sM5k+OcfZN9hnyyxgHHOznl2CQfZ2L8DnWMfVzXIaLG sV4KxwLHBOeZsVYO6wTMWm9oP3I51jYY50yOc9Yx0fdG8X053qm3HJPsT+T2TI3f4/fZNqyf c/nOiXWI9L1TY707XTvwfGm6ZtlyHRPOX2N9Ldal47uTV/ZV1uM4U+P3OG9wTLONxjpE3vps 59O7Uqz1Mjn3k8+xZhk5He/Z49qTHJDfMzF+B2NfZz/kmGbfH2uzjTyO9SzH8X2+5dJaA479 c6wFpe9/JLfsRxi5OF0bv8Pvc9011hMj/lg/x1qb7XzM5XKdrbFuGTldvpeUWntzjN/V95oS V9cTg3u+v1tq0zpbY42tsXaZvjOXHJyp6bt2icn2GjnU9xif7++F3vQe7PEO4rGG2fJ9zmdq I8aIuWktsQrvj1uuBzdsrPs100bsg/Ded83tprXMztSsmP1O8m7dunXr1q3baTduvnCRS2eW wYfRuGnAoMtob1g3LuBOtNcevfJ22IkBL2Kw2DEdDy6SR9xxw4oLlMG4ZHdn54rDJxj87pLB 712ye8XhS3Zvf+R1x25/5N67jz1yw+rvj9kz/vsVhxmo1M99fGXXrT83A0/LmHym46t/cfxS 7E5Hj+9g1+0NeBJn+R34vMvcXHts1alaf+5Nubn22IWHV//ugtfvYhcePp24s3O+7W3JRehg 3Hu1LR97xN+W1vbTbXsm26Did9J9d9N32tt3d648+tRLsevMuLzggP+2jH+DfB8GApfx6Yzd sPr8rzuG+Z/9fit7wIbPODoog7fzqr0fU3P8b9JWJ7/Z5w/7JQEb/yz2kmXpZjd7G+wXB2z8 s9hLlqWb3extsF8UsPHPYi9Zlm52s7fBfmHAxj+LvWRZutnN3gb7BQEb/yz2kmXpZjd7G+zn D/3KvZ9TWPj39NqfYS9ZllZWs5s9i/28gI1/FnvJsnSzm70N9nMDNv5Z7CXL0s1u9jbYzwnY +GexlyxLN7vZ22A/O2Djn8Vesizd7GZvg/2sgI1/FnvJsnSzm12N/cyAjX8We8mydLObvQ32 bwRs/LPYS5alm93sbbB/PWDjn8Vesizd7GZvg/1rARv/LPaSZelmN3sb7F8N2PhnsZcsSze7 2dtgPyNg45/FXrJO6lfs/ZzCOqnX/ilsYZnsDbrZ5zf7VwI2/lnsJcvSzW72Nti/HLDxz2Iv WZZudrO3wX56wMY/i71kWbrZzd4G+5cCNv5Z7CXL0s1u9jbYvxiw8c9iL1mWbnazq7F/IWDj n8Vesizd7GZvg/3zARv/LPaSZelmN3sb7J8L2PhnsZcsSze72dtg/2zAxj+LvWRZutnN3gb7 ZwI2/lnsJcvSzW72Ntg/HbDxz2IvWZbed/bL9342s9f+KWxhmewNutl59tMCNv5Z7CXL0s1u 9jbYPxWw8c9iL1mWbnazt8H+yYCNfxZ7ybJ0s5u9DfZPBGz8s9hLlqWb3extsH88YOOfxV6y LN3sZldj/1jAxj+LvWRZutnN3gb7RwM2/lnsJcvSzW72NthPDdj4Z7GXLEs3u9nbYD8lYOOf xV6yLN3sZm+DfX3Axj+LvWRZutnN3gb7yQEb/yz2kmXpA8V+2d7PZvbaP4UtLJO9QVdh/0jA xj+LvWRZutnN3gb7hwM2/lnsJcvSzW72NthPCtj4Z7GXLEs3u9nbYD8xYOOfxV6yLN3sZm+D /YSAjX8We8mydLObXY19PGDjn8Vesizd7GZvg/1DARv/LPaSZelmN3sb7OsCNv5Z7CXL0s1u 9jbYjw/Y+GexlyxLN7vZ22A/LmDjn8Vesizd7GZvg/3YgI1/FnvJsnSz94n90r2fzey1fwpb WCZ7g57J/sGAjX8We8mydLObvQ32DwRs/LPYS5alm93sbbC/P2Djn8Vesizd7GZvg/19ARv/ LPaSZelmN3sb7O8N2PhnsZcsSze72dXYjwnY+GexlyxLN7vZ22A/OmDjn8Vesizd7GZvg/2o gI1/FnvJsnSzm70N9iMDNv5Z7CXL0s1u9jbYjwjY+GexlyxLN7vZ22A/PGDjn8Vesizd7GZv g/2woW/Y+zmFhX9Pr/0Z9pJlaWU1u9mz2NcGbPyz2EuWpZvd7G2wHxqw8c9iL1mWbnazt8F+ SMDGP4u9ZFm62c3eBvt7Ajb+Wewly9LNbvY22N8dsPHPYi9Zlm52s6uxHxyw8c9iL1mWbnaz t8F+UMDGP4u9ZFm62c3eBvu7Ajb+Wewly9LNbvY22N8ZsPHPYv8fe/f2ZNlV2Hd8S4AQoxEM SMyMQMxIgKQZdEeMkKwrSBouGmAQlwEkc7Udx8FBQOIkthOTmCoeUpVKVVJFKimVqMqD+B+S B+fuXB7zqCc/8GQ7Thw7JCFR1q/P3uhoafXsvqw9UXd/vsO3Tq9eZ/bvdO81JepXa+9dZ7XG smUvkf39mezM98qus1pj2bKXyP7dmezM98qus34+/o8bf16V9fPxON8ley2rmb3JWPbezv47 M9mZ75VdZ7XGsmUvkf23Z7Iz3yu7zmqNZcteIvt7M9mZ75VdZ7XGsmUvkf07M9mZ75VdZ7XG smUvkf23ZrIz3yu7zmqNZcveb9l/cyY7872y66zWWLbsJbJ/eyY7872y66zWWLbsJbJ/ayY7 872y66zWWLbsJbJ/cyY7872y66zWWLbsJbL/xkx25ntl11mtsWzZS2T/9ZnszPfKrrNa40ue /R82/myePc53yV7LamZvMpa9++y/NpOd+V7ZdVZrLFv2Etm/MZOd+V7ZdVZrLFv2Etl/dSY7 872y66zWWLbsJbL/ykx25ntl11mtsWzZS2R/dyY7872y66zWWLbs/Zb9nZnszPfKrrNaY9my l8j+9kx25ntl11mtsWzZS2Q/O5Od+V7ZdVZrLFv2EtnfmsnOfK/sOqs1li17iey/PJOd+V7Z dVZrLFv2Etm/PpOd+V7ZdVZrfKCy//3Gn82zx/ku2WtZzexNxvsl+5sz2ZnvlV1ntcayZS+R /ZdmsjPfK7vOao1ly14i+9dmsjPfK7vOao1ly14i+y/OZGe+V3ad1RrLlr1E9q/OZGe+V3ad 1RrLlr3fsv/CTHbme2XXWa2xbNlLZP/KTHbme2XXWa2xbNlLZP/yTHbme2XXWa2xbNlLZP/S THbme2XXWa2xbNlLZH9jJjvzvbLrrNZYtuwlsr8+k535Xtl1Vmss+xJl//7Gn82zx/ku2WtZ zexNxj2zvzaTnfle2XVWayxb9hLZX53Jznyv7DqrNZYte4nsr8xkZ75Xdp3VGsuWvUT2l2ey M98ru85qjWXLXiL7F2eyM98ru85qjWXL3m/Zz8xkZ75Xdp3VGsuWvUT20zPZme+VXWe1xrJl L5H9pZnszPfKrrNaY9myl8j+4kx25ntl11mtsWzZS2R/YSY7872y66zWWLbsJbIvzGRnvld2 ndUay5a9RPbnZ7Iz3yu7zmqNZcteIvtzM9mZ75VdZ7XGlzz732382Tx7nO+SvZbVzN5kLHv3 2Z+dyc58r+w6qzWWLXuJ7M/MZGe+V3ad1RrLlr1E9lMz2ZnvlV1ntcayZS+R/emZ7Mz3yq6z WmPZsvdb9vmZ7Mz3yq6zWmPZspfI/tRMduZ7ZddZrbFs2Utkf3ImO/O9suus1li27CWyPzGT nfle2XVWayxb9hLZ52ayM98ru85qjWXLXiL7yZnszPfKrrNaY9myl8j++Ex25ntl11mtsWzZ S2R/bCY7872y66zWWLbsJbI/OpOd+V7ZdVZrLFv2EtkfmcnOfK/sOqs1vuTZ/3bjz+bZ43yX 7LWsZvYmY9m7zz47k535Xtl1VmssW/Z+y35iJjvzvbLrrNZYtuwlsh+fyc58r+w6qzWWLXuJ 7MdmsjPfK7vOao1ly14i+8Mz2ZnvlV1ntcayZS+R/aGZ7Mz3yq6zWmPZspfIfnQmO/O9suus 1li27CWyH5nJznyv7DqrNZYte4nsh2eyM98ru85qjWXLXiL7oZnszPfKrrNaY9myl8h+cCY7 872y66zWWLbsJbIfmMnOfK/sOqs1li17v2X/wkx25ntl11mtsWzZS2TfP5Od+V7ZdVZrfMmz /83Gn82zx/ku2WtZzexNxrJ3n33fTHbme2XXWa2xbNlLZH9wJjvzvbLrrNZYtuwlsu+dyc58 r+w6qzWWLXuJ7DMz2ZnvlV1ntcayZS+R/YGZ7Mz3yq6zWmPZspfIvmcmO/O9suus1li27CWy 3z+Tnfle2XVWayxb9hLZd89kZ75Xdp3VGsuWvUT2XTPZme+VXWe1xrJl77fsO2eyM98ru85q jWXLXiL7jpnszPfKrrNaY9myl8i+fSY7872y66zWWLbsJbJvm8nOfK/sOqs1li17iexbZ7Iz 3yu7zmqNL3n2v974s3n2ON8ley2rmb3JWPbus983k535Xtl1VmssW/YS2adnsjPfK7vOao1l y14i+9RMduZ7ZddZrbFs2Utk3zKTnfle2XVWayxb9hLZN89kZ75Xdp3VGsuWvUT2TTPZme+V XWe1xrJl77fs985kZ75Xdp3VGsuWvUT2e2ayM98ru85qjWXLXiL73TPZme+VXWe1xrJlL5F9 40x25ntl11mtsWzZS2TfMJOd+V7ZdVZrLFv2EtknZ7Iz3yu7zmqNZcteIvvETHbme2XXWa2x bNlLZL9rJjvzvbLrrNb4kmf/q40/m2eP812y17Ka2ZuMZe8++/qZ7Mz3yq6zWmPZspfIfudM duZ7ZddZrbFs2Utkv2MmO/O9suus1li27CWyr5vJznyv7DqrNZYte79lH5/Jznyv7DqrNZYt e4nsYzPZme+VXWe1xrJlL5F9dCY7872y66zWWLbsJbLfPpOd+V7ZdVZrLFv2EtnXzmRnvld2 ndUay5a9RPY1M9mZ75VdZ7XGsmUvkf22mezM98qus1pj2bKXyH7rTHbme2XXWa2xbNlLZB+Z yc58r+w6qzWWLXuJ7LfMZGe+V3ad1Rpf8ux/ufFn8+xxvkv2WlYze5Ox7N1nv3kmO/O9suus 1li27P2WffVMduZ7ZddZrbFs2UtkH57Jznyv7DqrNZYte4nsq2ayM98ru85qjWXLXiL70Ex2 5ntl11mtsWzZS2S/aSY7872y66zWWLbsJbKvnMnOfK/sOqs1li17iew3zmRnvld2ndUay5a9 RPYVM9mZ75VdZ7XGsmUvkf2GmezM98qus1pj2bKXyH79THbme2XXWa2xbNlLZL9uJjvzvbLr rNZYtuz9ln35THbme2XXWa2xbNlLZF82k535Xtl1Vmt8ybP/xcafzbPH+S7Za1nN7E3Gsnef PcxkZ75Xdp3VGsuWvUT2SzdcPDvzvbLrrNZYtuwlsv/vTHbme2XXWa2xbNlLZP+fmezM98qu s1pj2bKXyP7ZTHbme2XXWa2xbNlLZP/vmezM98qus1pj2bKXyP5fM9mZ75VdZ7XGsmUvkf0/ Z7Iz3yu7zmqNZcteIvunM9mZ75VdZ7XGsmXvt+z/MZOd+V7ZdVZrLFv2Etl/PpOd+V7ZdVZr LFv2Etl/NpOd+V7ZdVZrLFv2Etn/fSY7872y66zWWLbsJbL/dCY7872y66zW+JJn/97Gn82z x/ku2WtZzexNxrJ3n/3fZrIz3yu7zmqNZcteIvu/zmRnvld2ndUay5a9RPafzGRnvld2ndUa y5a9RPZ/mcnOfK/sOqs1li17iew/nsnOfK/sOqs1li17iew/msnOfK/sOqs1li17v2X/4Ux2 5ntl11mt8U6y3108PGY+UF6vLL6zeGTt83yxeNsmn2/FT06ePR2H4cHxGI+Nx81HqI/7fPG5 meM+X97x/HD25I9Pxeeax71p/Do/T53xzHhtZzLyd+uMvPeZG//xFf/pxvdd8Q83vPsN793w fVf84Q3vuyJzD43HnLIfLR4vfqP88r5XXv9+ef1na5/jjeXbr73f4RMnXzgV27/DpY97zfi9 rLUp49xVw/DC0VXGRxsZV22854Wjzxz64bFzV/3g+Lmr3nL88In4g+M/O/HDY4dPvHD08ImT ZS6+cHQ6T62f4a7G8fP5Nn6GU/Ghk88P8bmhPt/Tz5PP7ve0s9/TmUPD8Oz4M2z2ezpz6Nmj Zw799Pi3TsZnj/r9+/37/b/yuN/Jf6++cdVwpAy+UP6D91j5b88/Kq/3luP/Zjn+zW8fhu9u 3NTgpbx95HuPtL4usRuv3yx+oPij4j//+lXDn5UP8w/K16eyT2H8+rLhho3/r5D5V/PS9D8A AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAF4rXOZXAAAAAAAAALxmSX9Xe3njewAAAAAAAOiDPgY91k/WTHxd5fT99TUFAAAAAACA nVP3MRfrZPQx2GztZJ28fvQNxStG83W+t76WrCEAAAAAAICdM9fJ5FUng4utnWndTGvmjcUr i28azdd1t2cNAQAAAAAA7Jy6z9usk8n31nsZnYx1s97nZW1knRwqXlU8XLx6fM0462haQ9YP AAAAAADA7tisl5k6mbqXmfZc6WUO9pqZ1k063nR105p5c/FI8a3Ft42vbxnXUd6T9ZO/M+3V AwAAAAAAwPaY9uit93np7tK/HBle2ctknL4mvc2050qvdzDXTN3nZc1kbWSdXFs8Wjw2mq/z vayfqddbXzsAAAAAAADYHlOnt77Xar2bSSdzfHx9e/GaYfNuRq93MNZLq8/LPrysjayTdxSv L54YzddZQ1Ovl0542qtn3QAAAAAAAGyfqZ/JHr3svUtXlz4v/d11xXcNr+xm8r3su8revXR/ er2DtVY26/PS12VtZJ3cWHxP8abie8dx1lF6vWndZK1lzeVY1gwAAAAAAMD2mDqaaY9e3c+8 e1j1Muln0tPcMLzcz2Rfll7v4KyTzfq89L/vHNdG1snp4q3F24rvK94yrHq9vCfvzd/JmtHp AQAAAAAA7Iz0Keni0tHkmsjs0cs+vOzJS4d3ani5n8lrxun4Tg6r3k+vdzDWyFyfl+43a+P2 4l3F94/m66yddH3piHNtbtZY/n6Oo9MDAAAAAADYPlOnl/ub5brbXBuZru6GYbW/Kh3N3cOr O5qbx/fk3ml6vf29PrbS52VvXtbGmeJ9xfvH13vH72c+e/WytrLG0h/r9AAAAAAAAHbG9Mzb qdPLdbfpabJHL/vy0uN9cFh1NDFff6B4x7Dal3XDoNfbr2y1z8v1tel90+E9WHyk+Gjx4eIv jOslaynvndZK1tq0TqwRAAAAAACA7TF1enlmQTq5dDW57jbXSqa3yz6rB4aXe5q8Zjztv9Lr 7U+20+el903fm7XxWPGJ0XydXi89cPZ75prt/D2dHgAAAAAAwO5odXp5Bkaurb1reGVXc3Z4 ZVeTfVl5j15vf7HdPi978T40ro+PF58cXzPO97OG7hxWPXH64uwFTaeXvaE6PQAAAAAAgO2z 3umls8nzMfIsg9xLL9dTZk/eh4sfHVZdTfzYsOr20vXp9fYXO+3zsj4+UfxU8Xzxk8Oq10v/ m/dkjej0AAAAAAAA+rBZp5eO7p7iQ8Oqv0uXN/U1eT1X/Miwuh5Xr7c/2E2flw7vqeJnRz89 rpHHh1UvnH44ez91egAAAAAAALun1emdHF7u9HKNba6hzB6s9c4mX+d7er39wW76vHS8WRMX il8YXz8zro/0wXluxtTp5bpunR4AAAAAAMDu2KzTOz2snleaTi+93cV6G73e3qZHn/fF4tOj +Trfy9699ME6PQAAAAAAgL7MdXq5Z166m/PFzw2v7G7S7en19ja9+rxfLH55fP3SuFYyn04v 12/r9AAAAAAAAPqxlU4vz8Q4P6z25qXLm/qbZwa93l6mZ5/3leJXx3WRNfL58T06PQAAAAAA gP5stdPLMw/S6aXHm/qbvOr19iY9+7ysha8Xv7a2JqZOL+tBpwcAAAAAANCX7XR66e4263D0 enuHJfq8b4yvGev0AAAAAAAAlmUnnV66vHQ4Ua+3t1iqz/ul8TXf0+kBAAAAAAAsy246vanH 0evtDZbs8355bS3o9AAAAAAAAJZlp53e1OPo9fYGS/d501rQ6QEAAAAAACzPTjq99Dl1l6PX e+2ydJ/3K2vrQKcHAAAAAACwPLvp9NLlrPc5er3XHpeiz9us0zs/nvep07tlWHV6yc35njq9 nGsAAAAAAABsjXQ96VPS9aRPS89zbNh+p6fXe+2e30vR59WdXt5/YXi503u4eM94vk8Mq974 yHiur1g71yRJkiRJkpw3XU/6lHQ9h4tvLR4fe7b0PGfGDu7jxafGfu7Lm3R6er2D2+dt1uml B04fnF44/XCybixe1zjX6fZIkiRJkiS5NXP949T15D5n6XreU7yt+MGx55k6vXQ8F+v09HoH s89rdXo531kzWTs5dtbS7cX3Dqvrb7Mf9G3juU6fnM9HkiRJkiTJrZlnFaTrSZeWPXq57jbP Mrhz7HoeK54b+7itdHp6vYPX503mPXl/1kiOkXOdtfP4mJN76uWa7uSn18t6y2dKt5c9oiRJ kiRJktya6c/Sq+R6yNzrLPuobh1W9z/Lsw3OFj9Z/FzxS2M/N9fp6fUOXp+33unlXGetZM1k 7Uz31Lt37IrT62UvaPrj68fznfVHkiRJkiTJrZk+JXum0qWlz0vfk34tPVv6ttwP7fyweo7p 02Nfk55nKx2PXu/g9Hl1p5fzPN1TL9ffZr/ng8PqHo05z+mNc65vGvu9fDaSJEmSJEluzfQp udY2/UruoZfrI3Pvs+zRe2K8djL92/TM2/Q9W+309HoHp8+bOr38vRwjx8oxc+xkJOvD47rK ec4zM7LWsm/vjmF1rz2SJEmSJEluzfQp6dHS9WQP1f3jdZK5B1r2V0179HItZe6Tll5uO52e Xu9g9HnTed7sHOca3Oz5TE+c/Kyx7NvL58may3knSZIkSZLk1kyf8sDYrzwy7qXKPfSmPi/3 RKs7n532PXq9/dvnrZ/jHCfHSwec67VzjpOV9ZTznLWVz5B1lu441+WSJEmSJEly66ZTyd6p 9CvpWZ4c91TlPmhTn5fuLR3ctEdvt52PXm//9Xn1+W31etnvmfOctZXPkHWWcx5zjTdJkiRJ kiS35tSppF/JPqqnxr4n/cvU56WXWd+j16v30evtnz5vrtfLOc7128nNszOyvtIZx3wekiRJ kiRJbs+pW0nPkm4tvUv2VqXzmfbnLdX76PX2T5+3fm7Xe72c46nbS27Odcwam0zfR5IkSZIk ya253qukZ0nnku4lPVt6mFaf17P70evtnz5v/dy2ur31fm8y550kSZIkSZI7c+pY0rlMPd56 59Ozz9Pr7d8+r+711ru99Y6PJEmSJEmSfa07mPV+ZonuZyu9Xp7Je1B7vb3W5811fCRJkiRJ klzWS9X36PX2b59HkiRJkiTJ/aleT59HkiRJkiRJvd5e7vX0eSRJkiRJktTr6fP0eSRJkiRJ ktTr6fNIkiRJkiTJg9zr6fNIkiRJkiSp19s7vZ4+jyRJkiRJknq9vdPr6fNIkiRJkiSp19s7 vZ4+jyRJkiRJknq9vdPr6fNIkiRJkiSp19s7vZ4+jyRJkiRJknq9vdPr6fNIkiRJkiSp19s7 vZ4+jyRJkiRJknq9vdPr6fNIkiRJkiSp19tbvZ4+jyRJkiRJktxdr3fdJez1crwcN8dPTvLS 51079ov6PJIkSZIkSer1tt/rval4xQK93tTnZY9ejp+cq8fc5N84fp67i/fr80iSJEmSJKnX +3mvd3bs9T5YvLN4S/Fk8XjxrcXDxSvHa2PTv/Xu9KY9ernmNnnHiifGz5HPk8/16Ng/flKf R5IkSZIkSb3ez3u9h4tnircXbyq+a1jd0y7Xwi5xDe76ffSyRy97AnPNbe6h957ibePnyefK 58vnzOfV55EkSZIkSfIg93oXik8Vnyw+XnyweM+wuoddrn3NNbBvq/bq9e70ct1tOsMjxaNr e/RyLXCuuf1w8ePFT4+fN587n1+fR5IkSZIkyYPY6z1d/Hzx/LC6V12ucc21rneMe/WuH/fq TffV63n9beu621zvmy4xnWK6xYeKT4x79HLN7ZeKXx4/vz6PJEmSJEmSB63Xy7WruYY117Lm mtZzxceG1fNl81yK7JXLnrnsncseuuyly566JTq97APMfsDsC8yzbm8tfmC87jb30ctzMT43 dpD26JEkSZIkSfIg79XLnrfsfcseuOyFy564XH/7/uLpYfWsjDyzIp1e9tIt1em19uml08s+ vbPD6tkY6fTs0yNJkiRJkuRB7/TqfXq5p94D4z69U1Wn13uf3vr99NLpJSNZyUx2PkP2DGbv YO73l/v+5bkeuZ9e9hhmr97U6en1SJIkSZIkud/7vPRh0/308tyJPH/iY8UPFe8r3lm8eXj1 s2+X6vTWn3ube/i9d1g9f/fe4iPj9bfZqzfdU2/9ubd6PZIkSZIkSR6EPi99WHqx7Hub9ujl uttc65prXnM/u9zX7h3Fa4pXD8s89zbHyjFz7NxTb7r+9oa1vXp59m26xnSO56trcPV6JEmS JEmSPEh9Xq65zb637H/LPrjsh5ueeZs9euvPx8i1sbnvXe5/17vTyzGzVy/7AKe9eu8cO8Xc Vy/39ss1uB8ufnzs9T6v1yNJkiRJkuQB7fPyPNmPFh8d98PdNe6Pyz65PIM2z6LNHr1cG5v9 dL2uu231etOzMtIh5nrfXIP7nnHP4D3D6j5/ubeeXo8kSZIkSZIHvc/Lda3ZB5frXPOs2zx3 NtfcZr9c9s1N99HruUev7vTSFa5fg5teL3sEp3vr3TZeE5xn8ur1SJIkSZIkqc9bXd+a61xz vWuue52ei7HENbdb7fVyb730enlOh16PJEmSJEmS+ryt93nr19wu0enp9UiSJEmSJKnP21t9 nl6PJEmSJEmS+ry91+fp9UiSJEmSJKnP23t9nl6PJEmSJEmS+ry91+fp9UiSJEmSJKnP23t9 nl6PJEmSJEmS+ry91+fp9UiSJEmSJKnP23t9nl6PJEmSJEmS+ry91+fp9UiSJEmSJKnP23t9 nl6PJEmSJEmS+ry91+fp9UiSJEmSJKnP23t9nl6PJEmSJEmS+ry91+fp9UiSJEmSJKnP27vs p15vyiRJkiRJkmR/9Xl6vZ79XbJIkiRJkiR5aVy659Pn7b9er+7xcm6n8xu/tmY+B0mSJEmS JHfmes8ydS9TF1P3e/o8vd5W+rz1Li9ZXxlzY87zMyRJkiRJkty16VnSt6R7mXq+qdvr3evp 8/Znr1ef16yhrKepw0tuzvEXihfGz0KSJEmSJMmdmX4lPUv6lvQu6V+mzqfu9nr3Pvq8/dHr tc5rjj91eVljnyt+pvjp8XPkXJMkSZIkSXJnpl95auxb0ruk30sPk64t+6ymXm+3nZ4+b//2 euvnNutl6vNybrOm0uN9snhu/Aw5zx8pni0+QZIkSZIkyS2bPiW9SvqV9CzpW9Krpd9L55M+ Zr3X281ePX3e/u718v7p3Ga9TH1ezm2ynhzX2uPjOX64+ND4mR4gSZIkSZLklk2fkl7lkbFn Sd+SXi3dXvZVZX/V1OvVnY8+T6/X6vSmPXo5ZtZPMpKVtZV1lvP7wfGz5DzfRZIkSZIkyW15 99irpF+5b+z5Hh338GVfVXq9dD5Pjz3NtFdvu12PPm//93p5/3R+s0cv98/Lfs+so/R56Y7T 5eX83j6e41uKNxdvIkmSJEmS5JZNn3KqeGvxjuI9Y7eX/VS5LvcTw+oee+t79bbT6enzDk6v N3V6ue522qM3nd+sp/R56ZFzfrP2biyeKF4/nmuSJEmSJEluzfQ8J8cOLf1eur30avePPdvH xr162XOVvVfb6fT0eQer15s6vfzdnON0wbmGO3v0sv9zOr/JT5f3jvEzXVu8hiRJkiRJkls2 vdmxsV9Jt5f9U1Pfk2sls1cvzyrNnqtcf5s9WOlt5vodfd7B6vWm851rs3Oe89zkXHebY354 3PuZfaBZX+nzjo/r70jx6tF8RpIkSZIkSV7c9ChvHrue7JW6rnjDsLrHWa6RTNeWPVbZa5Ue bup5po5Hn6fX26zTy77O7O/MPs9Hi2fGPaA5x+mPs96mc5zPlvNMkiRJkiTJrfmmsevJfql0 abm3WbqePMMge6uyxyrPOJjuqTfX6enzDmav1+r0coyc64eH1X0ac9/G7AXNvtCst/ockyRJ kiRJcmuudz1vG/fq5dkF2VN177jHKh1PrqPM9ZQX6/T0eQe319us0/vIsLqGO+c6+z+Tl/Oc /aHpk/OZ8vmmc0ySJEmSJMl5p67n0Lh3Knuospfq9Njx5Hml03MyLtbp6fMOdq+33unlWSr5 OznnU6d397B6Bkuyct1trvvO53i98wsAAAAAALBt0vWkV8meqXRq6Xgu1umlp6s7PX3ea5+l ez2dHgAAAAAAwKVjN53eepejz3vts3SvlzWg0wMAAAAAAFienXR66W2mLkeft7dYqteb1kG+ p9MDAAAAAABYlt10evq8vckSvV7WgU4PAAAAAADg0rDTTm/qcPR5e5Mler1pLej0AAAAAAAA lmUnnd5Xh1d2OPq8vUnvXi9+pfj0OJe1cHbQ6QEAAAAAAPRmO53ehWG1Byu9TfbqfXXQ5+11 evV6WQfp9vKa8efG9aDTAwAAAAAA6M9WO73zw6rTyx6sdDdTf6PP2/v06vXS92Z9TGvik8Oq 08v7dXoAAAAAAAD92Eqnl67u/PDK7ibq8/YPu+31si8v12ZnTaT7/UzxE4NODwAAAAAAYAnm Or2Hh1Vfl94u/d3U2+RVn7e/2G2vl/WQbi+vuVb7XPGJ4gPDy53e9YNODwAAAAAAYLds1umd Kt4zrDq9PLs0e66eGladTcw+LH3e/mM3vV6utU2XF7M28r3MpdO7q3jToNMDAAAAAADoQavT OzG83Onl+QbZa/XksOpp0tecH1Ydnz5vf7LTXi/rIesk+/Pymi446+P+4p2DTg8AAAAAAKAX m3V6twyrni57rKa+Jl1N3dfo8/Yn2+31sk6yHtL/Zm3Ex4fV/Rg/WLxjfH/Wh04PAAAAAABg d6x3em8eVn1c+prc++yuYbXH6tFh1c+sdzX5Xub0efuX7fR62dOZfjfXaqfbi+nz0vWdGd/z nnGNXDOsOr2sD50eAAAAAADA9ml1erk+MtdJZm/VvcPq2spHh1VPk9dcj3vfoM87CGy117t1 XA9ZL+n20uXlNXv08nyMPHPlxuJ1xbeNx9DpAQAAAAAA7Iyp00tXk04v10Wmn8ueqvQ02X+V /m7qabI3L/uu7hr0eQeFrfR6WS9ZD7lvXrq9XI8b0+fdPqz2febZK8fHvzd1etMaAQAAAAAA wNZJnzJ1erkeMtdFZi/VDcPqORnZq7fe0eTrfC9z+ryDtU4u1utlb2fWQ+7DmC44PV7MNbfT Wsl7slaOjGvlirV1AgAAAAAAgK0zdXrp4qaO5tjw8jWVuWYyvczUz2QvVvZc5TpKfd7BWysX 6/WyHrIXL3v2cu121knMOM9dyR69dMbZD3po0OkBAAAAAADslPQp6VXSx6WXSz+X62/fMaz6 mfR6UzeTnib7rdLPZF6fdzDXS6vXOzKuh/R22Y+XNZL1E9MPT+sl78v7c//G/P0cy1oBAAAA AADYHlOnlz1T6Vly/e36vqv1biZf53vpbdL76fMO7ppp9XpZD3n+Rbq77PXMNdwx6yXfy7qa 9uhNz8fIcQAAAAAAALA9pk5v6mbS0aV3STeTXi99zNTLpKdJN5O5vEefd7DXTd3rZT2kE063 l/4u19nGrJcj41zek/dO193q9AAAAAAAALbP1M1kz9S0V2/q9epeJuP0NdmTNe210udZO1Ov l/UwrZ+skXR4WUd5ndbM1OdlvbmXHgAAAAAAwM6pe5n1PVfpZOpeJr1Nehl9HtZ7vakXntZQ 1sm0XmK+v97nuZceAAAAAADAzqn3W029zNTJTL1Mepppb976Piu9jPWT9bPe7U3raN31daPP AwAAAAAA2B1TL7eTTkYvg3oNTetoWkvTmpnWjbUDAAAAAADQB50Meq6j9bVUrxlrBwAAAAAA oB/6GCy5pqwbAAAAAACAZdHFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABeUzxQvLL4zuKR4vPF54pfLN629r6XRl6/8Z7nik+c fOFUfG54cDzGY8XDxTesHfea8XuXrWWcu2oYXji6yvhoI+Oqjfe8cPSZQz88du6qHxw/d9Vb jh8+EX9w/Gcnfnjs8IkXjh4+cbLMxReOPnSRn+GuxvHz+TZ+hlPxoZPPD/G5YTpO/fPks9e/ pzOHhuHZ8WfY7Pd05tCzR88c+unxb52Mzx7dynEnLnbcFT85efZ0fPXnXf/9b/+8nj3541Ox fV5PjV+/rnhL8fj4dfi98fWmtfdM5//yxmd6pvwOf3js4utgtQZeOJpznXOec79aAz/YWBNZ G1kjeV99/h4eP9+15Rf9TPkAv1A+0N+7/OXPV/je9PPk832leN/4dV7D9Dq8+7Lp7wy/8e1v v+Lf0HS8/x8/46Pjz/jG8jN+qnyAj5Sf8Z+s/YxvLD/jpVpjL5af9cL4s2523BcPXTj24qE/ OPb9E/HCsUt53O8Uf/WPX5dTOXyr/I5uK7+r37r85eP/qCzW310dOf80R773SOvrErvx+s3i B4o/Kv7+H5VjXzEMp8d/J9PXlw03bPxbyPyreWn6HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADggPNA8criO4tH1r7/xeJta+OXRl7/8+/85OTZ 03EYHhyP8VjxcPENjeO+eGgYLhy7+HFfPHTh2IuH/uDY90/EC8daxz06fn28eNP49WXFz45e e/kwfKt4svjbl6/mbvzC6Uf/7pdOP/on1wzDfz62+t656vcwfY7z5etPFH9t7fhXD8P3Wlk3 jFmnG1nfuHZrWU8UP7+FrJvHrDsbWf90i1mPbzErGcl6fyPrz7eY9bHiu7aQdc+Y9WAj67q3 by3rQ42fa26dPDDmPtzI/fUt5r6p8TNeqn9Pzxefmznu8+Udzw9nT/74VHyuedxT49evK94y /r7y9Xisjdfp58v3rxm/vrzxmb57svwbP776THc1PlPyvnvywvE/vfn/sW8v4FFV997H1wCR iEFoqRillWhrC762+vjy2gsejEZuEgg3JSAqIAoiVYwWTd+qifRYq/UcTmstNyle0BZBKEhE RBGsN+wp9QJBud9CSIDc7zPZ57dmzWznjUMc2xx4n9Pv52HN7L1nZ6211/qvtffs2dj0/bPv 6mnTmNR/ieQTrV+/SD0GqsBfqqAuOphX231WD3MC23mmjumRyDEdL9+ZPR9Jndkz5ey6b9v0 SOqJzDfHtnVWh3Bb/bvaqLP+cHW7z/LP7WjMT20gGy/8Gmm+y+MtR/t7ulIfpUVKs4d1MNfa /CKxEl0OmLRwPNjPP8+L/gMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIKyvUrJS D6WuMdvHKl0Ys+5FdPC3FPUc0NsmYy6L5JGhlKKUFCffmT2NeSS19Xxn9nwkdWbPlLPrvm3T I6nx8u0eWVZWpldkOaA0UmlGwC3frfyuiiljXbvwW6Bjmjkvw0w0082tZpLJ0WuaydTrFDPV 3J1wi9kaGHNxjwvyzf8eaNr3GRheH2TXX+4eSNdyupanpqkm+ix7U2i9rdMgvRe/F1rfpUdq wP6t3Vav9cyc0e1WNHTNt3kka5+zUpYnTejTNX/2m+fOStX60KyVSTaPvibwXC+9G7PCX79X 70uTC8LreWf3ygsfpNLH81944NJTCmxz+ex2m68xhbl2OaygMDevzuZpzIbNy5LmKJ97Nq1K stuj+2ypWJZ0qQl0scvv6vPJM8NdYs6PaXvbF3bZGh1Js9ob8+9q98f0vqid2+/c7N7pj47r nf7KucZ89Sy3LbNF60bjYbiWr7F1jimrszF5sf0fW4doubY8W+4Tccrtfl5i5Y5SurZFufHK ejxS1pNxyro2wbL6J1jWgkhZz8Upa1GCZdkx0rI945X1bKSsP8Qp62iCZZ2q9O0Eyno+Utaf 4pTV9ZuJlXVFgse1IlLWq3HKuinBsuxon5ZAWa9EytoYp6zXEiwr0djYECnr/Thltf9WYmUN S7ANN0XK+ihOWRMSLMvm0/K4/ieeh25WfrHt8N92Hhqi81BmzHloc4vzUGabnodeanEeeine ecj+/ezVD+W11Xko1vHOQ9EY/TASo1vjxOgfE4zRePMX10r/QIxmKUaHx8ToRy1iVJ89HIlR G0825mJj1MZcbIz+oEWM2ri2MWrzUEyusbFoYzS6/odIjNr1aIzOsp0ricboipgYtTHYWozW f0GM3qHYfFptnav3VS1itCrNmL+04XnvnkhZ+XHKyjg3sbISPT/YMmxZj8Qp65kEy0r0+uvh SFm/jVPW/gTLGqP0UAJl2TJsWQvjlHXLeYmVlej53F5P2rLstVHLspYlWFai13qLI2X9MU5Z jQmWNTjBaz1bhi1rVZyyvvHNto1DW4Yt6/U4Zd2XYFmJXuuti5T1RpyyPk2wrESvl20Ztqz3 4vVXgmXZlEgcvhspy55PW5Y14FttO0f9LVLWp3HKeiLBshKN+W2RsvbGmzcSLCveNWy8svZE yjocp6zvnp9YWfY6gOvlNrwWuUPXIjNirkWqWlyLzGjT6+VNLa6XN/3/dr18SLH5lNq6NE6M 3pVgjJ7M6+WLtNK5c+v5XpTcufNFyXNPP7OTTZ07n8h8c+z16tcD5lO9j1dDnqb088Bn+e+J rCvnmO7LuzzesooNv09X6qO0SGlOj4B5Qu+5kbEVXQ5onLSPfP55XvQfAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATpC+SslKPZS6xmwfq3Rh zLoX0cHfUtRzQG+bjLkskkeGUopSUpx8L9JK586t53tRcufOFyXPPf3MTjZ17hwv3+6R5VSl XpHlgNJIpRkBtzym2fNij3G23aiPOqaZ88aYW83tZoqZHHm/60u3mK2BMRf3uCDfPDDQtM8b GF4fZNcbugfStZyu5alpKlSfZW8KrbfFD9J78Xuh9V16pAbs39pt9VrPzBndbkVD13ybR7L2 OStledKEPl3zZ7957qxUrQ/NWplk8+hrAh/20rsxK/z1e/W+NLkgvJ6W8U5e+CCVPp7/wgOX nlJgm8tnt9t8jSnMdc0hBYW5eXU2T2M2bF6WNEf53LNpVZLdHt1nS8WyJJW1yS6/q88nzwx3 iTk/pu1HR9IBpfHacJrSzyN9cW527/RHx/VOn62/+rfT3bbMFi0ajYHhWn5QaWbgs/wVMnn/ bDGaYSaa6YrPSSZHr3+PmBjNV4w+GBOjTS1i9ME2jdEtLWJ0ywmM0Q8TidGWfRobo507JRaj p9p6xuR/ImN0VjdjHktuPd9Z3R5LntXtjE4HzrDpseQTmW+OUtrEgElu5+aDAe3cfODnr/W8 cMeFmz4i7/J4y15kiExX6qO0yH46IWDW6f3eyNiKLgdMmmkf+fzzvOg/AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAMD/EH2VkpV6KHWN2T5W6cKYdS+ig7+lqOeA3jYZc1kkjwylFKWkOPnO6mbM Y8mt5zur22PJs7qd0enAGTY9lhwv3+6R5VSlXpHlgNJIpRkBtzym2fNij3G23aiPOqaZ88aY W83tZoqZHHm/60u32Jnh14t7XJBv/mOgaf/rgeH1QXY9cGYgXcvpWp6apkL1Wfam0Hpb/CC9 F78XWt+lR2rA/q3dVq/1zJzR7VY0dM23eSRrn7NSlidN6NM1f/Y935mVqvWhWSuTbB59TWBn L70bs8Jfv1fvS5MLwut5Z/fKCx+k0sfzX3jg0lMKbHP57HabrzGFua45pKAwN6/O5mnMhs3L kuYon3s2rUqy26P7bKlYlqSyttjld/X55JnhLjHnx7T96Ej6ajtjDuj9h3pPifTFudm90x8d 1zt9v/r/9E5uW2aLFo3GwHAbA0ozA5/l39mYvH+2GM0wE810xeckk6PXv0dMjP5GMfp4TIy2 bxGjj7dpjO5pEaN7TmCM7kwkRn8UidGMODE64YzEYvRUW8+Y/E9kjC4/x5glKa3nu/ycJSnL z7nk9N+l2bQk5UTmm6O056yAuaS94l0NeZPebUdF89+j5bxwx3l+F2vL5fGWvcgQma7UR2mR jVvl/YTe742MrehywKSZ9pHPP8+L/gMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAHH0VUpW6qHUNWb7WKULY9a9iA7+lqKeA3rbZMxlkTwylFKU kuLku/wcY5aktJ7v8nOWpCw/55LTf5dm05KUePl2jyynKvWKLAeURirNCLjlMc2eF3uMs+1G fdQxzZw3xtxqbjdTzOTI+11fusXODL9e3OOCfPPMQNP+2YHh9UF2/dQzA+laTtfy1DQVqs+y N4XW2+IH6b34vdD6Lj1SA/Zv7bZ6rWfmjG63oqFrvs0jWfuclbI8aUKfrvmz3zx3VqrWh2at TLJ59DWB4l56N2aFv36v3pcmF4TX0zLeyQsfpNLH81944NJTCmxz+ex2m68xhbmuOaSgMDev zuZpzIbNy5LmKJ97Nq1Kstuj+2ypWJaksvbY5Xf1+eSZ4S4x58e0/ehI+pf26gdtmKz3n0b6 4tzs3umPjuud3rWnMf/rdLcts0WLRmNguJZ/rjQz8Fn+nY3J+2eL0Qwz0UxXfE4yOXr9e8TE 6GLF6HMxMXpaixh9rk1jtLRFjJaewBgtTiRGW/ZpbIw+lpZYjJ5q6xmT/4mM0VzVcVq31vPN TZvWLTet8msTz7NpWrcTmW+O0p6zAmaS5oBT2hnzG71/t91n+e9R4+aFOy7c9BF5l8db9iJD ZLpSH6VFNm6V9xN6vzcytqLLAZNm2kc+/zwv+g8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMTRVylZqYdS15jtY5UujFn3Ijr4W4p6DuhtkzGX RfLIUEpRSoqTb26aMdO6tZ5vbtq0brlplV+beJ5N07rFy7d7ZDlVqVdkOaA0UmlGwC2Pafa8 2GOcbTfqo45p5rwx5lZzu5liJkfe7/rSLXZm+PXiHhfkm9UDTfuCgeH1QXb9K2cG0rWcruWp aSpUn2VvCq23xQ/Se/F7ofVdeqQG7N/abfVaz8wZ3W5FQ9d8m0ey9jkrZXnShD5d82ff851Z qVofmrUyyebR1wSqeundmBX++r16X5pcEF7PO7tXXvgglT6e/8IDl55SYJvLZ7fbfI0pzHXN IQWFuXl1Nk9jNmxeljRH+dyzaVWS3R7dZ0vFsiSVVWqX39Xnk2eGu8ScH9P2oyNpentjTmln zG/0/r127rNzs3unPzqud/on6v/Sr7ltmS1aNBoDw7X8r0ozA5/l39mYvH+2GM0wE810xeck k6PXv0dMjL6sGF0TE6PdWsTomjaN0doWMVp7AmO0KpEYbdmnsTF67XmJxeiptp4x+Z/IGN2t P+zQvfV8d3fo0H13h5+ljuloU4fuJzLfMyLLmgLMCBvX3zLmQb0P0XywUe+PtvusrKjvR5Jt Wzte7rVj51vuszTzFzNDf2OT/Sy6byA8utx+i7q4FFPnUCjk6q2F0tLSt9566/XXX1+/fv3G jRu1sG7dutdee23t2rXr2ohyfiNMC8r/tRja+M4772zatOnAgQPV1dXR9rSDX69NTU0NDQ2N jY1arqmpKSsrKyoqOnjwYHFYSUnJkSNHDredQ4cOuZxFy0VR7lM11L59+1SN5uZmVze93vm3 XL0Gg0G9artqqCO68847J0+efH3Y+PHjb7zxxgkTJlx33XVuyz9Oeer1hs9RQdnZ2SorNzdX Xamq+nVTe7pmFC2sXr160qRJAwcOHBLWv3//wYMHjxw5MiMjIzMz0238x1199dXKVq/Dhg0b NGjQiBEjtHHAgAFDhw7Vq7aoxHHjxikk/IB0/e7qrMZ84IEH9Cf6c/2JssoM0xb97VVXXTW4 jShDZas89aqmcKtZWVnaMnz4cFVby2qrn/3sZ4o3V9XYepaXl48ZM0b5aDfXjOoL9dG11157 8803q99vbCPqdDWXDlwFqUHULGpb19Subd3hqDKqp9/vLjL1qvE1evRo7anj0j7Lli3buXOn BpFiW6Gi1yNtZPPmzS+88MI111zjAkD1VN1UYbWqll2wjRo1Si1TVVXl2vPJ1w+6hbq6OvW7 Wk+V1G5jx47VoPOnBR2IH8ZtYvfu3RovV4e5eqqSrs5+1Kkyahy3/4LXD7qGra+v15FqmF9x xRUKEo27Y8eOuflK/HhuE8pN9VTvu1q5fndd76+mp6frQDSLuj+Z/1qkPd04coNd1J5qcxcP akktuMNpKxoLClQ1mrpPtXLjyNVQQ97F50033eS359x1B1RPN5eqAdWManPVUyNIzauW1Hb3 2ob9rkM+evSomsJNKaqhm5fcUHIDWcNEO2h0uD+Zs842rGs3/a1CwnWBFrTqf9S21DKqgOt3 VUwTiyrpJhlV2w0o1TN2vP/u1ZNQT6moqFBzuclTXe860YWoKqllfaT49Pv9t2tPQj1dv2va UUFqRk2kE8OmTp2qurkKi+JTJ303fB4/GfVUnupQ1VMtqa7Pycl56aWXNFdrEtAl02233eZO ghosGtqu33/9ysnpd1VADah66mSnKz0Nf7dd03hBQYE7BehAKisro+f3W058PTWBKHPNgaqn ZmzNM2o0TYOqlT7SgqYsxadO1ur3k1hPUb9rHF1++eWqra5CW3ykqUAfqba6Bj659VTmqoza U52rjlYbuu2ayVesWKGNilu9Kh5cBU5WPTUv6UrDXXgoUPUFRFVSAGzYsMHNq64OioTodd3J qaeqpBHkLjk0pWtZs71q7k6I7npPFdZuJ7Hfa2trFYTueunKK6/UZY+7QnbNqGrrxKRZVPGp ed6d042ZdLLmJV1CuBOlaqjR7b5x6FW1VcOqnmpPfaeLtuf4k1JPVUDj3TWjXnV5ryidNm2a Fvr166cY0Dyv9vSnAmPGnfh6ajJXPVUNFaRKqnpr1651X5A15+vs6b7QqcFVT3edNizme8eJ bE+NbnWrxosuil555RX/loIOQVXVjKR6qsH9cXRr+Pv7ia+nGkonR9VTjeYmT52J3KlcH2nU K2410HT5565+9T3Ofappyl0buEvW2Otk1/Ju3LXVdYjmT1XDXSn5J0dXE5Wrr5MaYjqlarxH 53nj3x5xf+t/79Ac63+khTb8iuSu69TjrnPXrFnjn4/0NU2raiX3Xcn1qf+92O2geiq2dYwt vsepPdv2e5ybl1SWaqKqahy98cYb+sqm1tu4ceOUKVNc7KlV/frfFo5P17lqcE0L7k6F6rl3 797/vu/FW7du1TlI8ak20VSvOrubTtqo3lT9NdvrOjnmus72uwsMzQyKbc1dLe4zSNveZ9BV 0NKlS1UT9Z1rUvdFSW2oGUk117Iqr9le05cfn/73TTWgmtH/SqV83H0b1bnN79uoQdxXdVcr nY9chd0dBtVQna5LPrVP9Lxp6+koaO+//37tNjSsxX0wdzulTajdlJv75q6CVCt3c0wt4y6i 9NEVV1xx5513qvH9fndjxL2uXLnS3WpwX/38Wz0ZGRnKsK3uK7qv6q41tOzfZdKqquduOGi+ evvttzWKXb/fER5H/tyoUHzvvffuuOMOxbBmDA0rd5NWAaDOGj1+5NgbJ4++fuLYm669fsKI G7LH3jxxwg2TR9x03S3jxk7SR9fecMPIa8eMG3/9+BtvGjZmXFbWlBsnT8oeP3zC+ImTb7h1 ZPaoUTeOHTn+ls/foXVUkAJPAXbfffe9+uqrmn/8E40bR/6042ZgjTI1uM4L7i60G0rSVHa0 7kjtkeJj5RXFR48UH95bebQ4VHyk4nDNJ4eqdxRX7ztSXVJVUV559EhVWUlD/bF6r+xI9f7S Y7tKj2rXI03HaoOlx0Il+/wMW1DgqTh3p13zZOz84Pd7Yjcyqr0GL2TvRmtZc66mbK++eq9X eyxUWVJbeqjpWLlX2+hVVdSW7aqpKawtP9xYWuY1NzXX762qOKS/DdrzW12C90xEE5GbD/15 Xi2pQ3Ab9WnsaV37R26QepW1mmlD9l9QOzY1hyo/3vq3Xx5bcGHl099pfOHb1X/81v7fn7P7 qZ4Hl/Q8uCx1y/NnbX/u7B3PnfXRH3oX//WnXuOOkNdU69X7I7cFhZ8r6/NNF/NbUqS2rVx4 lIdq6kPNTV5zvddQa5tJ2yrry18tXfn9D3+XtG2+2bfYfDzXfDLv1JKnU/c/0Sm0qL23LFA0 1xQvG+AVveo116gZGr+oOV0buqr655fUiye0aMDYBW3397djTR1t/6iuyTtWHKouqvKa6u2l mLfjvu2LexfOM0eXti96NunAwtMqFnYu/7XZ9XBKyVNdCp85t+xv/6H9KrxgjacO+XuuZ/zz UexPXccLGFtCddCW5lWWhRpqFWz6u4Mbiv50yY6FnfbOM6rkzmfP+vCpntue/0bRiu7H/vj1 Awvabf9toHjVkOCu1V5NrULU1vT4LRnbm8GwFtdLLfaPW89ir6baa/bCuze5EXFk6YdLv/fJ 04FDi0/ZOzel6LmB3s4VXmNxXdm2Iwdf/2hprx3zOwX/aEoXm20rflhx8LU6L3Qk3CVfOIJa j88vUh1SkNV5DXV2vFfue3374h95i03d4k6Fc8yOP10W2veaWkxh0dSsNi/39q7ftvyCXQtM /dNf3fWk+ejFPlU7X/LUEfrrRu3QoEOub/SqVXEde+j4Df0l61mmqaip0mvWtVZN1a4l+1/8 4f5FHXc+e9rW35mil64O7V7hBUvC006DmkOHU99QV7unYFfB93bMMUd++40dT3XZ+/ol3s41 dc12XNeUVzY3aFDaaAraPm3ti8OXa89mr0otoAgrWXr0T/+n7Jn2BxYFPpzfafuKvsFdy/Vp rRes947YejZ55U32uJqCXsWuP+1Z9aNDc83Rx03Ros7FKy8t2bXWdo1qGL4M16E1esGjrYbD l6un5pRmr3jXG9uev+LIXNPw3Gkfz+5SvOQHtruDJbW2NetqQkEbgHZuaPaClQ2aEjQX7Vtz 5OW0irmm9Imvv/+U2bEk3dv/vKqnMGporA2HU7C81Z8pvlQ9K+2hbzq8esiuuSkVz7Q/tqDj nsX9vAOr3GTV4B2tDjZVq4ZqKJWueAtp2qrXTBvS1LDn5UNr+hU+aQ491bnhWbPrxatCdZ9W hOzOXoMuhoNNbVdPe33f/NauxWeXLzSlz5jtS3/olb5kI9HOiA32X6Mtt9azE5eWK4P2xOoF jzU06kznlexdvWf1xTXzA5UaU4su8bw9asfaULibtF/b1fOYnYsO7XtjetnKS/asumr3tueb vIamevWYLU0xqe62LalK6hIs6B32Qs2N7tRQVe416str0/Y1h1+5rPD5flvX3KMJobbOhmb4 YJrqQ61V9MvFZ0143qzZ2VC+40j5QVstNZNtzAqN7rLGcEzqpdEOn31BVfio1xAM71AfVOWb 7GxWXbvNayr0ag5o2caFnY91bdRUZq9s2qieJw/1/KetZ/TZJPssU+cWz2mdqOe3bulozH1f 8JzVLR3v635Lx5tTN5xq030JPb/VVvm2fH7LnGPMW3rLbmdMu4Axv2z3WVlRP1D6bovntx7+ xmfPb43S3+wJuM+i+0af37L7xXl+6/+5eA3f3HTX3Pv27Xv//ffd41yvhrkHsPyFz4t9GCtW K89yvfTSSxs3bnz33Xf37Nnj7jx+4TME/g7ua6T+yn291Ov+/fuVz4EDB2KfuNJ3TvfNU9u1 6r79fin6qnzw4EH3dItrpS+spPvS5e9WVVWldpsxY4Z74urHP/6xlidOnDhu3LjJkydPmjTJ 3RTT13i9ui/2cZ/Kap2773DTTTf95Cc/KSgoKCsrcz+0tFJP/6u4e4Bj7dq1t91228iRI93d w+HDh48ePXrUqFFZWVn+40GDBw92v3+4VfdszfHuAcWVkZGhT9PT0/v373/33Xe//PLLX/hM hn8U+iqoHvnpT3/qfoYZNmyYu4HluOcYXMXcDTL/QRwtu7s8idNRZ2dn+8d+5513utsrrXR6 7B1zBaE6xT254j++8Hn+7SfXaKpn3N1cJnG5e1jqCPecmUJIsdrKLRX/5r5bcM9buCY6XiU/ z90ji+t4f6LqKbRcw2pVYV9ZWdnKbwzuI/djhg6nvLxc9Rw4cKD/mN0Xcq36Ze8Juj90dzCv uuoqDVL/N55WZiS/VdX47refESNGtNLvLVrGH19x63O8LnB3cl2oq9AWP/MfL0rdq/u9sJX+ im1G99iilseMGaNBoblLk9Wtt96q+cFFuHso092cdaHoHn5Sxfy/1c5a0HxSXV3dyj0p/9cp FwCao9zvhV9YyWuuuUZFTJkyJT8//4033lB0qePck7g6Df3iF7/QZOt+d3S1ck3nHl11o0+H 4OovahxNO61M9e4Q3D0O9b7GkVrGPfp5PK5DVbRquGHDBp2S9IflUaqwSlSFNXtPnTpV4edC yFXVtae7Z63D1Bb3W4Xi03/moJWq+lGqs6R7PqCVSroF9e/mzZvVWdu2bZs3b577+UGnGDXj woULd+7cqauFjz76aPr06dpZtfJj0g1zd+vfZeV+D/N/M2vlhpHf4Oq122+/vZX4VIkqSJ2u SxSdYTdt2jRr1izNKu6pLDd+daR33XWXdlCGa9as0RjxH8vzfzJx8elPwoqf1ud5/xFt/9w0 d+7c1vtd9czLy1PPbt++XWdn1Uptq7OD/xSm+3lp5syZak8F7UMPPeR+MnFPQrhOcbu5mmv5 8ccfdz9/ttKY/t1qV231po7ueJXUISiudMmnbnrmmWc0lt1JVlVVNKqd3ShWK6n+Kl29r0s4 TQh+iLqfytyE5gIgJyfngw8+aP2Xb3+8uytAV2cFWCvx6Z5bqqmp0eG4n4VcxaZNm6YAcI9Z a7Vfv36qgC6EdEQaJv7c7j9J7B6V0CEsWLDAv9F/3GcXwk+Q2n/hb+/aUB+sKC+pyX/kvlHX Z16Z2TdrTObAzCGDB43Iyrxm6GA7saieikxddrrHBdyP3NquGqpVdammmrtfGTWsFHWak7Wn azo3q2vna/r3u27oiKGDxuQ+8KtdpUer7A8DukyvtjfAg6FGz94AqWkO3zaK3pVSo9bXN9fZ 9tT1fFOo2Wto8nYXFv/8/l8OuzprQEb/a0Zcmzkka9jIUQOG2PqoYmol92SG6ukulrRRAaCW VN3Uzu4HTveEqELUPfPkns50Z/asGwdlDLlq1kOPfvjBR+GGqm+qbvDqvVBzsDnUEL5LGKwP huqjE1VIdWt0zVlX49VUhu8oNXpl2vz+xs23T5k+/OohmYMGjr5mVL/+Vw4aZX841JApDdOc 4z9q7z8nqhBV77tzk6YO98uuKn/FFVe44emm0x8NzMqeePOHH31gy66v8OprVJWgatccvr3k /oWCDdErk6NNjfZmTrOiVHtr1Wu0AatzWEXQq9v2yd9m3HHziOEDBg25clT2mMszbH00QP78 5z+rSefMmaNC3VnPnXTciUY7qAH1ReCxxx7TBPvmm2+6Z17dCHIXzzlT/u8nH28NeVUNwaqm kFdd59U2e9Ve+IefkCrY7NlhFfSid7Uavbpar9Le21V1644Fy3d51RVaq1e0NDccKa/ZWrj9 zrtzRo7K0qVk1hD77L4KevjhhzU6duzYoa8kGvL+VaV7StjV51e/+tWnn36q3TSJabt79N/V VjPVrm3vNwerG5rt3XQbkw1VXsMxr7KoMRhUTJbXe9XRi/foBahXFfSOKAxqy7ytvzm27urD 7+fUl/zVa6pqKrfVr6v0duw6nPfgg6N1Nu5vo1GFqn10Etcgfeedd+6//37X7/5lsxZUf01H muteeeUVN8+r2XVEanlVUhNvrVet8R2q8ZrrqmurCg5um1m4Otvb8m9e0N6/qw7ZqobvtEfr WekF67xgVXlt4bySFy/cNddsW3zqjlfTy/7zUc/bZW9GNtibeUVHDs2Z8+uJY8e6Z9fULHfc cYdmUZ0Xtm7dqlPDLbfcojOm5h8NecWDaqKZU0ehENWYcs+aaB9NQYWFhbZ5NFrLq7zKfd7e RZ8uv3Trs522zguUPtejtnCO17jF3seM/CIQjU87xou8HY/vfaFX4RxTuuj0qqe/cvBxU/hi 9/9cclnFzmd0Lq1uPlavIVZVtnaVPQm6CzNdPygC3377bQ0TXUKofzUFKWjd86y6INFFlHvE RN2tv9IksHr1avfgtb2iqN4fKn2xcGW//c9+7di8lMq53UrmfWXX/E4f/v7y+k/mqVUbI6fy 6LfgZq+2ekf5sktK5pudT33lwFPJe+Ynlyw8pWyhKX6qw+7F3zi8bpxXtFwHpJguqWv461/e n5Wff/XgIYOHZGYNGz5u7HU/fyDvtVfWuJ+uVT1dIaiG6lyNd/toeNaIoYOHPvKv9658563q mqqS8BNQ3p4369Z9//AL39y58PS9TyYXLep4YGHS/vkd9z/Zaf+CpMMvXhyqLinXUAp6VY2R B2XsD7c1O0qev7D0SbP99533Lmy/e17H4ieTts/96t4FX9k1J6lwbtLOpb0Ov/PjYNHG8MEF C7d8rJmn/8BBgwddPXCATgBZE6+3/1nLPenifqT3H4m4Mqv/DWNv2PbX92tUrne0fP9rRX/J +WDRj/Y8ffb2eV12zE3e9+Qph55KVj0PLNDraUULOxQt6dVcc6ii2d5qr7d3k8PPImterd++ 7+lvlyw0n/wXe+cDHVV15/E7GZJJQiDBKIJIQcRV99g97a67ruueFYRFakEUQQtWKhQXq2yt 1hahh1W3Z3v2bFu3u1vNn0lmJsQYG3ARsTlIra1/+SMH8Q//k8nfmUkyySST+Zv59/Z73y+5 zCZDyFAgSfv7nHnJmzfv3Xvfvb97373397vvV57TVC4ay0wuS9bxCtFim+Q2X+YuzmrFLWyb 0vz6Iv/7W9H6hgJ+yOG8OxYsXXbPkq8vRTuweIHsQyYP6slsVHbs71689qHv9LR7YpG++IF/ bXhtQcMr+XUvivqSXHtxdnNZdtu2HKQT2dhYmiXTaTU0Vc3Ugq0h2X7KlCqraS1Sb7de127J OG3JdsrkZTssJme1aLGKpuLJTvNU17b8Jouh1WYK7Li6p6st0OtBsy/7PPfcu3SJ7Kou1/sV ycNMVd3uXrR05Yr17u6ebv/x9h03NZkN3VYRrMx2WZGkbKTQVWFyWLOazROazNjJc1hEQ+UM LdgcRjrxaJKPKup29CX6Gu1Vf4kzT1lzOioFRBS36SqdjHu0y6tEQ4XhdLFoLssJ75wVCXX3 dnes/dYa5NWCf1y0+C7dFkcfp1MK1UQEdbbRn1ux6pud4XAg1tS2fZazTLjNGa6ygg6ryVU2 odVsbCmfgEJH6bdacp22SY34inIPOsLIy0jsTDpj0Wifq+PXS1EQkE8P0mkzoSodL7rKXp7X 9rLw/kp0V5nqi7IP/zLv84rpoYC73Wn/9ro1skc0b/6K+x9AbVIzJPSsp6RSslfcd/vKby13 egLdno668msbi0wtJRNPWXLbLVnO8kxkRYvF5LDlyE95DkT0dPmU3t8uTIQ8Ui6lfrM/nXgu RWM+7ZPvnSotPG0t6NomcHdN5oknbSZ7manlxSx3UU6PpcBlyauryLdvnx70tnW2Nz388OrF X7tzIfr2K1YuuVs+Lget/6ERgUzz4oWrH17Z1dkT83U7q69vLs9tsxQ0VBrbbHn4tNomtlhz 8UFmtiJLZZleo322QYtEpSGnfKT3y2dc1qq41vTTOsvVp22XeyCfsiAmt1uEu3yyo+TKRnOB 3SbsVoFGIFw5K+B1ersdDz30wF1f/xoGxqj1CxfdiTaKBJJSSzv91kv/sObb69b3drq0cF1L Tf7pUtFhzmuzGtAEIc0NZTn1paa6kixZoazZnRU5J203aU1bkSI0mFJCB8wBqA+V8Hx67K0l x2yip8rYas45Zs6vK5t2sqjgdMlEh21Sa0VOfbnRbjW1vprva/h9X7ij7LXX712/4f41K/5p 7fLH1z+4+oFVqx58MOXnuw+vq7T9ShZZ6/ZG21x/ufBW4K7z3ZBPi8lemllvyW6unCRz1Wzq sOV9uvObWmw/uiTdMdkFRfUZeMxHZY9TC4eOWr+wzGm2CU+1cJZPctSI9mrRXWHwmk3dJRPb iyc5LQXOqsuDh57VtM80X1eHw+/rjPa097g9vga319vpSflxexOu7mAi6mw79G/HzDM7LFIg PysttJdktVfmtm/LrCsVJ0qy68omO635vsrJPZ9a8HyMJRK+iN5tj6ruSCIoH50xrcsZ/ODf 0XahandVGttfEh6LsXtbZkeF0WUzygbEOrHVPPFE5W3hT34SbfyN1tui9XkTnqaI3+UPd/kj LSk/Wt+RQH2l/9DTrh1fhQR6qzJbyo2nzLm9NTlHSzIPv2TqqM6LvircRaJp2w3e/d+XwSYS 6LPL7mW/Dlgvd3T8EJ/mjcfCmqcldvAFe/VfnKiYEDRP7SwrrCvPO2LJOmKbcMKWiRbDUWJE ++aoNp2snmR/Y3rLrivRaDtrZjhqrnNWz0z5cbx6s+vlWb2vFLitAte22Ex1RbKqtlhEc+XE psp8t8UghaH6Ws+hnwRCLejQIx/DyEx9fKmrLvv7deGohuGJTwtF+gIyyY7dn7xxl70692iZ 8WiRscEyyVV5uatiChphpyW345UrGyumfG7OOm6d0GDLwKMKnYH2YpOrOCfl5/SLmW1Wk/tl 08myrE/Nl31RPrXenOevnmhH04Rri9AsFza/9VD7qR3SIAyjM2nrJW2b9B5IRPVDSC+L0ZwX vT7dIAB5He484jjwlP3NuxoqZnbbjMEK0VkmGktlB6Djl8L9oqHrpVz3S5e5i67oNF/WVTax SzaDE1N+8DR0bstptmahlI+b89Amd5QKX7HotE1x2GY075jfdvhnfp/dL5/gyEH0jiOoMrre PxSPJ9tS+ZHPQa9MOnrxnRFPKKpbPKAb0PW595OfO/csbaq51r6toM42GR2qOotorZzgfDmn zoo2JP9za96RcsOJKoO9wpjy4yo3omvhsBic1ow2W1ZbxZS2qtktldc7ahbFThVr0QZfJBCJ SpsVRBmUTaRe3HI4GUHK1VA5IvuiPpnaqD4CiQcikAE/KldXWOuT2vmQr891MPT5z72/Wdxe c5XTfL3bdrV7G9or0VaV4bAZm14SXmuusyw75cdhzW+xFjRXFHRUX+569UvO2kXdx//T6/69 Fm+LJ/yhWCQuh2ZyYB6NxIL9u3J4Ke0DpU1DCsMp6sGSCZ0shIFfIM245UDI6wt0ay07ej/7 r659P+h8d3XrG39nr5nT+Or0lppp7dWzXVVfclXPbq+Z63hlNgQGlcu3568a3l7tOvCU++gL AeevY/5jWrSTrBUo9uSJ7v54ddQk59kmGM/s/z9DoARKIRoP4Y4x9veGgv5gT7TPkwhJ6zgt 0K6FurRwe9TnDPc6YsH2aKgzFOgI+jvCOI5f0bZE+5BBEDu0NtJOUY4m+zNkmGQMnQ4dal+I kWksKufxZJ7LQqAKGJPtBt2CNL3Sa6QcLvYfkeYd0k5SHpazAgk8ReSsBZoUVNFATH7Q49Ut 7AZPbFICkufllNZA5bMqcWQ4chujs25Pj6dLTg15PB4MfIKhQFSaaqJfoIuOPsKKyyRA2mOy vyDNTkm2wvFEIJEI64mVFn8RrUdPoBw66LMHNBQeqRXmWNCXFxqFuOUceu1C4y1TC43/Pe2d CXK7ZUT68gsV7mB9+Vdm0Ht+7s0QYiv+v5BxJq4BpB781kH68j1XndGXVxqErjOXvw2cO6Av l+cN1pcnSxhNVZ86dSr5NSR79+5966233n777XfffZe05iNHXfL++++rxffULiTPS9I6JAgx pNbhcOBMDIaxTy8dIVV3WjidTrIEpzdS4KbU0lu15lUtG0Uit27d+thjj5Gueu3atTTKpYFu Wig10pNPPrlnz56himrVJr755psbNmygCVN6PYZaW0DDg7RYuHDh8uXLaR750Ucfra2txS1T ribnc3Nz85YtW2i6dpB28zx0yTSPhqiRgPvuu2/+/PmbN28epA4ZtHRMLURIRr0HhWZpSQVC x2kWHn9pml69xkOpwEntumbNGkQx+NGSFO/QG1SjL5qJk8NdfaKQNCh0BH9XrlxJL2aYN28e qQHU3Bx+RYkPf79KCUfr1Ddt2gQxo3kTteASX5F+iA3iopORElq/TrK0evVqGoaR1oReuTF8 vEr9g3LZt28f6gLJOULD5YgIKUeVROXq7e398MMP8ZWyF5KP4zgfDw8cRybQOJ8mJXG5WtqS Ml7SNeJ8pHn//v2odAjn2LFjuBFajLJq1ar33nsPVRvxHjhwAOHfcccduFlUAcSLcFBlPvro IxynkqX7PWe8CBl3SnUBQSF2iNC6detQv1Rx07t/7r//flo+SC+xwHEkCUdwCS4kYaCCo9Xb w8eLOouISBoRAs5H+LRMSk3oIFhEgTuiao4jpMhZqYPz8SspQZXAIJzhy5emqinfkF3d3d00 s6nE+5FHHkH24jiVI5KELKKXTOB8mgyFYFBFU8YBCBz3O0w9osRjB/F+8MEHiBRN9MGDB0lO EMiPfvQjJAPnIxycgDyh+QIIAMSPtCxIAC3uJN0q1SP16qCU8VLOUH5SjgG1io7q7NDaTRNA VOKr5BTBgyhfmsWg3D5n/aXkEeoNQ4iXVn3hFiB1aG83btyIjEWekDCQXQtCWK2DBKh4qRbj p0HmF0Plmc5HFIcPH8ZxVFXsIGqagkHsKF88xdDI49GMuyOFEHZQ3HjwqfqbXI/O2W4ApBZX 4S+1G4j3448/VsYKECR8xRMWlxw5cgT1a5kOjqt2AxcinWSoRA3XOesR7ogqLzVZpF1AGtTy NUStFqIht/HoJO0jfkLh0uvEqB4p86ORt1f0Mobbb7+dLqTCVRZjZFpBO4PEjJ4LymiMJklH Eq86U80DqmWLeJ5SI4ATUGHpp+RIVSJV8mjek/JZLdk/mzyjvUX50pOFDAuUfd5QKMMff/zx p59++oknnqDzqauD0qF0kpnO8PWXJHPnzp11dXUQHggtNVlnW7qKX/GXhjFoYcjMEV+PHj1a VVWFikb9ART98PmM5CH9DQ0NyR0/1fc7p1FRWIdGs3a7nV7pQU29evXR2fobahn90LVNQ4nq qDOxHwgE0EpjBxUQ8VLHAI0M7je5RzcoXpQFMoeWHdNY8ZwWACmHvqjFyuQLtQx5SJaXw8gz hIqWEY/wlQA0cCXUJXIVV1ubMhdA4MPLM9oK1H1q0ygDh39lV0rjEpJbCBiaHapiyPDhyxe1 Xr12Iq1XIFCJJF+CjEWfnOJFrRxkpjM0n+mVBkPXF57HUns0pOp+IWaXIF7cPqoz9QaJQeOy i3e/ECRUWxUvbj+5Hbio+Yx4qZ2ErCIZyRaiFy9eCpOeL2g36LUNakB68coXEVFvAbesXslD JvgX9X7p/U/0WFTPweSV4hfpftFuUK+MekfqeZQcIL12RfX9KioqcBVaePW886QJWp6amhp6 6NOzJrkeKbMz3C8NNsmkCV0aFA2NdLBDT/N0wbXUI0Jo2Ed7pRo0PGhIsHF3iJdeDkr9ZNUb Rw5QDyddaIqARrUInMxDqXxVbaqvryfZI/tX6iorA75hzJHPBpkqktkNmb6RXCU/ZegZ/eyz z6IDSeZQSkdOkaoe+Mihl7/SKAn7zzzzjHo1oBJpmkp655130KqQBS29eoTKmnIg3XjprbHo IuJy9O337t07aPZcTe6j3Gn5B9oWWtdBgyy07fQ237SAKCIQ/MWdIlhqppJNJymfVWJQd1AF UHGoo0KT3Q6HoytNUGsgq/hLxUr9vQv4WiO/nPD3xoLSEC8mZ921Pv9pLdKiRU/GIscTchVn Qto6ymWWAd+wS6LTIuiTplwxn5zsj2thLXb8UO2ik9uvOVn15UO7lml9dmkcmJBL+mMJzU9v nrgQROQaUnScEp5gQFp4hOtOlM7VigU+x4qu0+IOXzga6Lc07aG1pRcmn2Vl7JImggldE95X f6rqy31FIlYuTlRdr2ktPXIxEK2pjfou3P0GpeGdbhSk6+Ri8a7GI5vq/vdv67fPbzz0L/FY b4AURdJM1B+8cG8g0kPy6kr1aLAvEZEVpTforsdH03x42IZjcS3h180r3JHh1zKn9byLheNa KCpNoeQIIy6tjfqC8t6lnEdlhZVmEtGwrmwa0RtJRogvooU8Ia07LBenS5OcmEsq1SJaoq+H 7NU8wXhXkCSw38iA+SNmLOgXS+YKMfMcesCSuTOnlszdPG3hn8lt5oj0ixcq3FT6xSP4cneG EFEj+VMYiCsd/eIK1i+yfpH1i6xfZP0i6xdZv8j6RdYvsn6R9YusX2T9IusXWb/I+kXWL7J+ kfWLrF9k/SLrF1m/yPpF1i8yrF9MW7+YN0cIwzn0gHlzDFPz5vxg2vNz5WYYkX7xQoWbyl/7 z4zkr/1Qv35xIK6R+mv/Z1yz8Y/NXzuN5Me+v3b0sWhmh/ooY9ZfO7qP48JfO05WaR7L/trV 7CENJsesv3bErnrPY9lfOxI2Lvy1I/Hjwl87JHBc+Gunuxv7/tpxPOWk1Vjz1456dOnTSbMP aflrx5FLn87z8NeOG7n06TwPf+1nm1Qda/7aaTZ27PtrH638TNdfOx49o5LOdP21j1Z+puuv fbTSma6/9lFJ53n4a1evH7/07VJa/tpp3DH2/bWPSrmfh7925ULoEudnuv7aR6u+p+uvHQfH hb92NALjwl879efphLHsr/2MgmFs+2uHQI4Lf+1oH8aFv3aq6WPfX3tEC4wLf+2qd0o7Y9Zf u7LDS26Bx6C/9qDugWLEExmj5q89uYUcy/7ahz55x6a/dvXTGPfXPig9yTqvoQIziv7ace24 8NeervnHaPlrT68zNnr+2tMU5VHz1+6RNXbkVjCj5q89LUbRX3tajKK/dmnIM/LJq9Hz154e o+evXTr5GRdcnOmOCw4GI+MinSuXLRsX6Vy2ZMlYsN/aPUuILeews9o9a8vU3bPWTZs8R25b RmS/daHCTeWv/W4j+Wv/DyP5ax+Ii/21p+jRsr929tfO/trZXzv7a2d/7eyvnf21s7/2FNOR 7K+d/bWzv3b2187+2tlfO/trZ3/t7K+d/bWzv3b9GcT+2tlfO/trZ3/t7K+d/bWzv3b21/4n 7q+9NkuIXYXDh1ubtauwNuvWK3Zly21X4aUM9ymp477OIHbLPMrA3eH/zRlnwvcZhHjOoIes /yWeuz3VPqLV/2+UYWCzyV/nGkRZv05d6s8H9g1itq6jl78PRRv4MAzDMAzDMAzDMAzDMAzD MAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzD MAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzD MAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzD MAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMAzDMMwfxG3YsrHNwFaQdHwV tpuSvmv9TFBHnLMW3Sg3If6+P4wF2PKwZaYItzZLiF2Fw4dbm7WrsDbr1it2ZcttV2GqcKf2 70/DdkP/vgHbcmzfM9D+AwlNS77HX8iD+Mk0W8x5QHxHfFdsEOv7/38/7Ry7Uv/7lRl//rzY d6cw7r9T/75Yfp9+pWEe9udh/9HZiBS/feNg/Hcy+sX433Yg/rv8GdMM8lp5LIzvS55akfF6 X8HzMoxsnDM9b2fmwzcXPP+L96/58TR8X7rsjUwZxm3CcPUN+C/E6+r7M/i/I7tW/z57wb7n 9JvE9oV5+7N/k1Urs0shj8twhTi+mbJDZvjxzc+FZJhCvPvJa5nFCGfTwd2Z8vjAOUe9r2Ui rqDc34/f1/9QLxJxXVLer+jffottUoYQrfj/1xn02zXfuHHeT1ffOG+qSYivXkHHlgzK0QEZ uAf7MiN+aDgT/iQhnvtTk9EFYq3YCPlcJ57C3/MhSUYPQEYPJsnojEEyevAPkNFN1w+W0VmD ZHTWJZTRq0cio45+GXWlkNH/yR6ZjObIdCaFfzFldEB+MpL2jYPkajK2y/tDk3HL/f8TAAAA //8DAFBLAwQKAAAAAAAAACEA1zatMUZrBgBGawYAFQAAAHBwdC9tZWRpYS9pbWFnZTUudGlm Zk1NACoABmKQ//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////nm5v/zzMz/88zM /+mmpv/mmZn/5pmZ/+KMjP/ZZmb/2WZm/9lmZv/ZZmb/2WZm/9lmZv/ZZmb/2WZm/9lmZv/Z Zmb/2WZm/9lmZv/ZZmb/2WZm/9lmZv/ZZmb/2WZm/9lmZv/ijIz/5pmZ/+aZmf/ppqb/88zM //PMzP/55ub///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////22dn/88zM/+mmpv/ff3//2WZm /9VZWf/MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//M MzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz /8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//VWVn/2WZm/+KMjP/s s7P/88zM//nm5v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88/P/88zM/+mmpv/ff3//1VlZ /8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/88/P//ZZmb/2WZm/99/f//m mZn/5pmZ/+mmpv/zzMz/88zM//PMzP/zzMz/88zM//PMzP/zzMz/88zM//PMzP/zzMz/88zM //PMzP/zzMz/88zM//PMzP/zzMz/88zM//PMzP/mmZn/5pmZ/+aZmf/ff3//2WZm/9lmZv/P Pz//zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/2WZm/+KMjP/ss7P/88zM //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////bZ2f/ss7P/4oyM /9JMTP/MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//STEz/2WZm/99/f//mmZn/88zM//PMzP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////zzMz/88zM/+aZmf/cc3P/2WZm /88/P//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//VWVn/5pmZ/++/v//55ub///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tnZ /+yzs//cc3P/0kxM/8wzM//MMzP/zDMz/8wzM//MMzP/1VlZ/9xzc//mmZn/88zM//zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////55ub/77+//+aZmf/cc3P/0kxM/8wzM//M MzP/zDMz/8wzM//MMzP/1VlZ/99/f//zzMz/+ebm//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////77+//+aZmf/STEz/zDMz/8wzM//MMzP/zDMz/88/P//ZZmb/5pmZ/+yzs/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zz8//ss7P/4oyM/9lmZv/MMzP/zDMz/8wzM//MMzP/zDMz /9xzc//mmZn/+ebm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////88/P/7LOz/9lmZv/STEz/zDMz/8wzM//MMzP/zDMz/9lmZv/i jIz/88zM//zz8/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////55ub/88zM/99/f//VWVn/zDMz/8wzM//MMzP/zDMz/9VZWf/ff3//9tnZ//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88/P/6aam/99/f//PPz//zDMz/8wzM//M MzP/zz8//99/f//ppqb//PPz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////+ebm/+aZmf/c c3P/zDMz/8wzM//MMzP/zDMz/9VZWf/mmZn/88zM//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////88zM/99/f//M MzP/zDMz/8wzM//MMzP/zz8//+KMjP/zzMz//PPz//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////+ebm/++/v//ff3//zDMz/8wzM//MMzP/zDMz /9JMTP/ppqb//PPz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////nm5v/STEz/zDMz/8wzM//MMzP/0kxM/+KMjP/ss7P///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PPz/+mmpv/ff3//zz8//8wzM//MMzP/zDMz/+aZmf////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ss7P/2WZm/8wzM//MMzP/zDMz/9lmZv/ss7P///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PPz/+mmpv/S TEz/zDMz/8wzM//PPz//4oyM//nm5v////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88/P/6aam/9JMTP/MMzP/zDMz /8wzM//STEz/+ebm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////77+//88/P//MMzP/zDMz/8wzM//cc3P/9tnZ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////PPz /+aZmf/PPz//zDMz/8wzM//MMzP/339///PMzP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ss7P/2WZm/8wzM//MMzP/zDMz/9lmZv/vv7////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////zz8//mmZn/zz8//8wzM//MMzP/zz8//+KMjP/55ub///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bZ2f/cc3P/zDMz/8wzM//M MzP/1VlZ//PMzP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////6aam/88/P//MMzP/zDMz/88/P//m mZn//PPz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+ebm/99/f//MMzP/zDMz/8wzM//ZZmb/9tnZ//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+yzs//S TEz/zDMz/8wzM//PPz//5pmZ//zz8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////55ub/339/ /8wzM//MMzP/zDMz/9xzc//22dn///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////22dn/2WZm/8wzM//MMzP/zz8//+aZmf/88/P///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////nm5v/ff3//zDMz/8wzM//MMzP/339///zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////PPz/99/f//MMzP/zDMz/8wzM//ff3///PPz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9tnZ/9lmZv/MMzP/zDMz/88/P//ppqb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////mmZn/zz8/ /8wzM//MMzP/2WZm//nm5v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////zzMz/0kxM/8wzM//MMzP/0kxM //PMzP////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////+ebm/9VZWf/MMzP/zDMz/9JMTP/zzMz///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////+mmpv/PPz//zDMz/8wzM//ijIz//PPz//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////zz8//mmZn/zz8//8wzM//MMzP/5pmZ//zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////55ub/4oyM/8wzM//M MzP/0kxM/+yzs/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9tnZ/9JMTP/M MzP/zDMz/9VZWf/22dn///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////PMzP/STEz/zDMz/8wzM//ZZmb/+ebm//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////mmZn/zDMz/8wzM//PPz//7LOz//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////88/P/5pmZ /8wzM//MMzP/zz8//++/v/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////PPz/9lmZv/MMzP/zDMz/9xzc//88/P///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bZ2f/VWVn/zDMz/8wzM//ijIz//PPz//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////vv7//zz8/ /8wzM//MMzP/6aam//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////4oyM/8wzM//MMzP/1VlZ//bZ2f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////99/f//MMzP/zDMz/9JMTP/22dn///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////++/v//PPz//zDMz/8wzM//ss7P///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////55ub/1VlZ/8wzM//MMzP/4oyM//zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+eDg//PAwP/vsLD/5oCA/+JwcP/ZQED/2UBA/9lAQP/PEBD/zAAA /8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/9IgIP/ZQED/2UBA/9lAQP/mgID/5oCA/++wsP/zwMD//PDw//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////88/P/3HNz/8wzM//MMzP/3HNz//zz8/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////PMzP/P Pz//zDMz/88/P//ss7P///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+eDg/++wsP/mgID/3FBQ/9IgIP/MAAD/zAAA/8wAAP/MAAD/zAAA /8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA /8wAAP/MAAD/zAAA/8wAAP/VMDD/3FBQ/+aAgP/zwMD//PDw//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+mmpv/MMzP/zDMz/9VZWf/2 2dn///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////6aam/8wzM//MMzP/0kxM//nm5v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zw8P/zwMD/4nBw/9lAQP/MAAD/zAAA/8wAAP/MAAD/zAAA /8wAAP/MAAD/zAAA/9lAQP/ZQED/5oCA/+aAgP/zwMD/88DA//PAwP/54OD///////////// //////////////////////////////////////////////////////////////////////// //ng4P/zwMD/88DA//PAwP/mgID/5oCA/9lAQP/ZQED/zAAA/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/88QEP/ZQED/6ZCQ//PAwP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////22dn/zz8//8wzM//PPz//77+///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zz8//ijIz/zDMz/8wzM//ff3///PPz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////PDw//PAwP/icHD/0iAg/8wAAP/MAAD/zAAA /8wAAP/MAAD/zAAA/9lAQP/icHD/7KCg//PAwP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////zwMD/7KCg/+JwcP/ZQED/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/1TAw /+mQkP/zwMD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////PPz/9VZWf/MMzP/zDMz /+aZmf////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////PPz /9lmZv/MMzP/zDMz/+mmpv////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////+eDg/+mQkP/fYGD/zxAQ /8wAAP/MAAD/zAAA/8wAAP/VMDD/32Bg/++wsP/54OD///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bQ0P/vsLD/3FBQ/9IgIP/MAAD/zAAA/8wAAP/MAAD/zxAQ/+JwcP/soKD//PDw//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ff3//zDMz/8wzM//cc3P///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////55ub/0kxM/8wzM//PPz//7LOz//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tDQ /+aAgP/cUFD/zAAA/8wAAP/MAAD/zAAA/9IgIP/cUFD/77Cw//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////7KCg/9xQUP/S ICD/zAAA/8wAAP/MAAD/zxAQ/99gYP/pkJD/+eDg//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////7LOz/8wzM//M MzP/1VlZ//zz8/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bZ2f/PPz//zDMz/88/P//2 2dn///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PDw/+ygoP/VMDD/zAAA/8wAAP/MAAD/zAAA/9lAQP/mgID/9tDQ//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////77Cw/+aAgP/SICD/zAAA/8wAAP/MAAD/zAAA /9xQUP/vsLD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////bZ2f/PPz//zDMz/9JMTP/22dn///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////7LOz/88/P//MMzP/1VlZ//zz8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////soKD/0iAg/8wAAP/MAAD/zAAA/9xQUP/m gID/+eDg//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////88DA/+aAgP/VMDD/zAAA/8wAAP/MAAD/2UBA//PAwP////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////22dn/1VlZ /8wzM//PPz//88zM//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ss7P/zDMz/8wzM//VWVn//PPz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88PD/5oCA/9IgIP/M AAD/zAAA/9IgIP/mgID/+eDg//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9tDQ/99gYP/P EBD/zAAA/8wAAP/VMDD/7KCg//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////PPz/9VZWf/MMzP/zDMz/++/v/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+yzs//MMzP/zDMz /9xzc/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////+eDg/+JwcP/MAAD/zAAA/8wAAP/PEBD/32Bg//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////54OD/3FBQ/8wAAP/MAAD/zAAA/88QEP/pkJD//PDw //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////Z Zmb/zDMz/8wzM//ss7P///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7LOz/8wzM//MMzP/339///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////ng4P/icHD/zxAQ/8wAAP/MAAD/0iAg/+ygoP/88PD///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //ng4P/mgID/zxAQ/8wAAP/MAAD/zxAQ/+aAgP/88PD///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////339//8wzM//MMzP/7LOz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////mmZn/zDMz/8wzM//ff3////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88PD/5oCA/88QEP/MAAD/zAAA /9UwMP/soKD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////PDw/+mQkP/PEBD/zAAA/8wAAP/P EBD/6ZCQ//zw8P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /99/f//MMzP/zDMz/+aZmf////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+mmpv/M MzP/zDMz/+aZmf////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+aAgP/PEBD/zAAA/8wAAP/SICD/77Cw//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////6ZCQ/88QEP/MAAD/zAAA/9IgIP/pkJD///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////mmZn/zDMz/8wzM//ppqb///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////7LOz/8wzM//MMzP/5pmZ//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////zwMD/0iAg/8wAAP/MAAD/0iAg/+ygoP////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////zw8P/mgID/zxAQ /8wAAP/MAAD/1TAw//PAwP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5pmZ/8wzM//MMzP/7LOz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ss7P/zDMz/8wzM//ff3////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////+eDg/9xQUP/MAAD/zAAA/88QEP/p kJD//PDw//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////+eDg/+JwcP/MAAD/zAAA/8wAAP/fYGD//PDw//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////99/f//MMzP/zDMz/+yzs/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+yzs//MMzP/zDMz/99/f/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////p kJD/zxAQ/8wAAP/MAAD/3FBQ//zw8P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////5 4OD/2UBA/8wAAP/MAAD/zxAQ/++wsP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ff3//zDMz/8wzM//ss7P///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////77+//8wzM//MMzP/339///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9tDQ/9UwMP/MAAD/zAAA/9UwMP/20ND///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////++wsP/PEBD/zAAA/8wAAP/VMDD/9tDQ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////339//8wzM//MMzP/77+///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////22dn/zDMz/8wzM//f f3////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////mgID/zAAA/8wAAP/MAAD/5oCA //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////88PD/3FBQ/8wAAP/MAAD/zAAA/+mQkP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////99/f//MMzP/zDMz//bZ2f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bZ2f/PPz//zDMz/9xzc//88/P///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////PDw /9lAQP/MAAD/zAAA/9lAQP/54OD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bQ0P/VMDD/zAAA/8wAAP/c UFD//PDw//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zz8//cc3P/zDMz/88/P//22dn///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////PPz/88/P//MMzP/1VlZ//zz8/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////vsLD/zxAQ/8wAAP/PEBD/6ZCQ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////4nBw/8wAAP/MAAD/zxAQ//PAwP////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////88/P/1VlZ/8wzM//PPz///PPz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////88/P/1VlZ /8wzM//VWVn//PPz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+JwcP/MAAD/zAAA/9IgIP/2 0ND///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////++wsP/PEBD/zAAA /8wAAP/mgID///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////PPz/9VZWf/MMzP/1VlZ//zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ZZmb/zDMz/88/P//22dn///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////8 8PD/2UBA/8wAAP/MAAD/32Bg//zw8P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////54OD/2UBA/8wAAP/MAAD/2UBA//zw8P////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bZ2f/PPz//zDMz/9lmZv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////99/f//MMzP/zDMz//bZ2f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////bQ0P/SICD/zAAA/8wAAP/soKD///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+JwcP/M AAD/zAAA/9IgIP/20ND///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////22dn/zDMz/8wzM//ff3////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////6aam/8wzM//MMzP/7LOz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////7KCg/88QEP/MAAD/0iAg //bQ0P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////zwMD/zxAQ/8wAAP/PEBD/7KCg//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7LOz/8wzM//MMzP/7LOz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////22dn/zDMz/8wzM//mmZn///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////mgID/zAAA/8wAAP/ZQED//PDw//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+eDg /9UwMP/MAAD/zAAA/+aAgP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+aZmf/MMzP/zDMz//bZ2f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////nm5v/PPz//zDMz /9xzc/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////PDw/99gYP/MAAD/zAAA/99gYP////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////zw8P/cUFD/zAAA/8wAAP/fYGD//PDw//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////cc3P/zDMz/88/P//55ub///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////9VZWf/MMzP/1VlZ//zz8/////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88PD/3FBQ/8wAAP/M AAD/7KCg//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ZwPP/2cDz/9nA8//ZwPP/2cDz /9nA8//ZwPP/2cDz/9nA8//ZwPP/2cDz/9nA8//ZwPP/2cDz//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5oCA/8wAAP/MAAD/3FBQ//zw8P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88/P/1VlZ/8wzM//VWVn///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////4oyM/8wzM//PPz//9tnZ//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////zw8P/VMDD/zAAA/8wAAP/vsLD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////2cDz/7yQ6f+zgOb/jEDZ/4xA2f9vEM//ZgDM /2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9m AMz/ZgDM/2YAzP9mAMz/bxDP/4xA2f+MQNn/s4Dm/7yQ6f/ZwPP///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+ygoP/MAAD/zAAA/9UwMP/88PD///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////9tnZ/88/P//MMzP/5pmZ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////v v7//zDMz/8wzM//ss7P///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////+eDg/9UwMP/MAAD/zxAQ//bQ0P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////9nA8/+zgOb/llDc/4Iw1f9mAMz/ZgDM /2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP+MQNn/jEDZ/4xA2f+MQNn/jEDZ/4xA2f+M QNn/jEDZ/4xA2f+MQNn/jEDZ/4xA2f+MQNn/jEDZ/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM /2YAzP9mAMz/ZgDM/4Iw1f+WUNz/s4Dm/9nA8/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////vsLD/zxAQ/8wAAP/VMDD/+eDg//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+yzs//MMzP/zDMz//PMzP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zz8//PPz//zDMz/99/f/////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////54OD/0iAg /8wAAP/PEBD/9tDQ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////49D2/7yQ6f+WUNz/ZgDM /2YAzP9mAMz/ZgDM/2YAzP9mAMz/jEDZ/5ZQ3P+zgOb/z7Dv/9nA8//28Pz///////////// //////////////////////////////////////////////////////////////////////// ////////////9vD8/9nA8//PsO//s4Dm/5ZQ3P+MQNn/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9m AMz/llDc/7yQ6f/j0Pb///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9tDQ/88QEP/MAAD/0iAg//ng4P// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ff3//zDMz/88/P//88/P///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9lmZv/MMzP/0kxM //zz8/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////zw8P/SICD/zAAA/9IgIP/20ND///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////z7Dv /6lw4v9vEM//ZgDM/2YAzP9mAMz/ZgDM/4xA2f+fYN//xqDs/+PQ9v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+PQ9v/GoOz/n2Df/4xA2f9mAMz/ZgDM/2YAzP9mAMz/bxDP/6lw4v/PsO////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bQ0P/SICD/zAAA/9IgIP/88PD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88/P/0kxM/8wzM//cc3P///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////5pmZ/8wzM//MMzP/9tnZ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////PDw/9UwMP/MAAD/0iAg//ng4P// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49D2/6lw4v95INL/ZgDM/2YAzP9mAMz/bxDP/59g3//PsO//9vD8//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////28Pz/z7Dv /59g3/9vEM//ZgDM/2YAzP9mAMz/eSDS/6lw4v/j0Pb///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////54OD/0iAg/8wAAP/VMDD//PDw //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////9tnZ/8wzM//MMzP/5pmZ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////zzMz/zDMz/8wzM//mmZn///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////8 8PD/1TAw/8wAAP/PEBD/9tDQ//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////8ag7P+CMNX/ZgDM/2YAzP9mAMz/eSDS/6lw4v/j 0Pb///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////49D2/6lw4v95INL/ZgDM/2YAzP9m AMz/gjDV/8ag7P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////9tDQ/88QEP/MAAD/1TAw//zw8P////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+aZmf/MMzP/zDMz//bZ2f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////zz8//S TEz/zDMz/9xzc/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zw8P/VMDD/zAAA/88QEP/20ND///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bw/P+pcOL/bxDP/2YAzP9m AMz/bxDP/6lw4v/ZwPP///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////2cDz/6lw4v9vEM//ZgDM/2YAzP9vEM//qXDi//bw/P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bQ0P/PEBD/zAAA/9UwMP/8 8PD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////cc3P/zDMz/9VZWf////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+KMjP/MMzP/zz8///zz8/////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9UwMP/MAAD/zxAQ //bQ0P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////2 8Pz/n2Df/28Qz/9mAMz/ZgDM/4Iw1f/GoOz/9vD8//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////28Pz/xqDs /4Iw1f9mAMz/ZgDM/28Qz/+fYN//9vD8//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////20ND/zxAQ/8wAAP/ZQED///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88/P/zz8//8wzM//mmZn///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////9tnZ/8wzM//MMzP/7LOz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////32Bg/8wAAP/PEBD/9tDQ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9vD8/6lw4v9vEM//ZgDM/2YAzP+MQNn/2cDz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ZwPP/jEDZ/2YAzP9mAMz/bxDP/6lw4v/2 8Pz///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////9tDQ/88QEP/MAAD/32Bg //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7LOz/8wzM//PPz//+ebm//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////1VlZ/8wzM//ZZmb///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////fYGD/zAAA/8wAAP/vsLD///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+zgOb/eSDS/2YAzP9mAMz/jEDZ /+PQ9v////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+PQ9v+MQNn/ZgDM/2YAzP95INL/s4Dm//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////++wsP/MAAD/zAAA/+aAgP////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9lmZv/MMzP/2WZm//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ppqb/zDMz/8wzM//22dn///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+ygoP/M AAD/zAAA/+ygoP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////z7Dv /3kg0v9mAMz/ZgDM/4xA2f/ZwPP///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////2cDz/4xA2f9mAMz/ZgDM /3kg0v/PsO////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////soKD/zAAA/8wAAP/s oKD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bZ2f/MMzP/zDMz/++/v/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////nm5v/P Pz//zDMz/+aZmf////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////7KCg/8wAAP/MAAD/6ZCQ//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////+zg+f+fYN//ZgDM/2YAzP95INL/z7Dv//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////PsO//eSDS/2YAzP9mAMz/n2Df/+zg+f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////6ZCQ/8wAAP/MAAD/88DA//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////mmZn/zDMz/88/P//88/P///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////9xzc//MMzP/0kxM//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////20ND/zxAQ/8wAAP/fYGD///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////z7Dv/28Qz/9mAMz/bxDP/7OA5v/2 8Pz///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9vD8/7OA5v9v EM//ZgDM/28Qz//PsO////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////99gYP/MAAD/zxAQ //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////0kxM/8wzM//ijIz///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////88zM/8wzM//MMzP/88zM //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //zw8P/SICD/zAAA/9UwMP/88PD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////bw/P+W UNz/ZgDM/2YAzP+CMNX/49D2//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////j0Pb/gjDV/2YAzP9mAMz/llDc//bw/P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////zw8P/VMDD/zAAA/9UwMP/88PD///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////88zM/8wzM//MMzP/+ebm//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////1VlZ/8wzM//cc3P///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9lAQP/MAAD/0iAg//zw8P////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////49D2/28Qz/9mAMz/bxDP/8ag7P////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /8ag7P9vEM//ZgDM/28Qz//j0Pb///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88PD/zxAQ/8wAAP/f YGD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9xzc//MMzP/3HNz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ppqb/zDMz/8wzM//55ub///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////5oCA/8wAAP/M AAD/9tDQ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+fYN//ZgDM/2YAzP+CMNX/49D2 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////j0Pb/gjDV/2YAzP9mAMz/n2Df//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9tDQ/8wAAP/MAAD/7KCg//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////nm5v/MMzP/zDMz//PMzP////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////zz8//P Pz//zDMz/+aZmf////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////zwMD/zAAA/8wAAP/soKD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9vD8 /4xA2f9mAMz/ZgDM/7OA5v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////7OA5v9mAMz/ZgDM/4xA2f/28Pz///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+ygoP/MAAD/zxAQ //bQ0P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////mmZn/zDMz/9JMTP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+aZmf/MMzP/zz8///zz8/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zw8P/PEBD/zAAA/99gYP////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////s4Pn/gjDV/2YAzP9vEM//xqDs//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////GoOz/bxDP/2YAzP+CMNX/7OD5 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////fYGD/zAAA/9UwMP////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88/P/zz8//8wzM//ss7P///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////PPz/88/P//MMzP/5pmZ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /9lAQP/MAAD/1TAw//zw8P////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8ag7P9mAMz/ZgDM/3kg0v/j 0Pb///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49D2/3kg0v9mAMz/ZgDM/8ag7P////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88PD/0iAg/8wAAP/f YGD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5pmZ/8wzM//STEz///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////4oyM/8wzM//STEz//PPz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////5oCA/8wAAP/MAAD/9tDQ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////xqDs/2YAzP9mAMz/n2Df//bw/P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bw/P+fYN//ZgDM/2YAzP/G oOz///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9tDQ/8wAAP/MAAD/77Cw//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////PPz/9JMTP/MMzP/7LOz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////55ub/zz8//8wzM//ppqb///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////20ND/zAAA/8wAAP/m gID///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+fYN//ZgDM/2YAzP+fYN////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////n2Df/2YAzP9mAMz/n2Df//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aAgP/MAAD/zxAQ //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+mmpv/MMzP/0kxM//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////i jIz/zDMz/9JMTP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////VMDD/zAAA/9lAQP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////59g3/9mAMz/ZgDM /7OA5v////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////7OA5v9mAMz/ZgDM /59g3/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////VMDD/zAAA/9xQUP////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////STEz/zDMz/+yzs/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zz8//PPz//zDMz/+mmpv////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+mQkP/MAAD/zxAQ//ng4P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////n2Df/2YAzP9mAMz/xqDs//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////GoOz/ZgDM/2YAzP+fYN////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////20ND/zAAA/8wAAP/z wMD///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////p pqb/zDMz/9JMTP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aZmf/MMzP/zz8/ //zz8/////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+eDg /88QEP/MAAD/6ZCQ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////GoOz/ZgDM/2YAzP/GoOz///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9vP5 /9nM5v+zmcz/qYzG/4xmsv+MZrL/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9m M5n/ZjOZ/2Yzmf9mM5n/jGay/4xmsv+pjMb/s5nM/9nM5v/28/n///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////xqDs/2YAzP9m AMz/xqDs//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////5oCA/8wAAP/SICD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////88/P/zz8//8wzM//vv7////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PPz/88/P//MMzP/5pmZ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////2UBA/8wAAP/ZQED///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////8ag7P9m AMz/ZgDM/7OA5v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////j2ez/vKbS/5Zzuf95TKX/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9m M5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ /2Yzmf9mM5n/eUyl/5Zzuf+8ptL/49ns//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////7OA5v9mAMz/ZgDM/8ag7P////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9IgIP/MAAD/5oCA //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////5pmZ /8wzM//ZZmb///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////7LOz/8wzM//PPz///PPz//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////vsLD/zAAA/8wAAP/2 0ND///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////xqDs/2YAzP9mAMz/n2Df//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ZzOb/qYzG/28/n/9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/4xmsv+p jMb/vKbS/9nM5v/ZzOb/9vP5//////////////////////////////////////////////// ///////28/n/2czm/9nM5v+8ptL/qYzG/4xmsv9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/28/n/+p jMb/2czm//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////+fYN//ZgDM /2YAzP/GoOz///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////PAwP/MAAD/zAAA//ng4P////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////PPz/88/P//MMzP/9tnZ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////0kxM/8wzM//ff3////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////zw8P/SICD/zAAA/+JwcP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ZwPP/ZgDM/2YAzP+fYN////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////s5vP/n3+//28/n/9mM5n/ZjOZ/2Yzmf9v P5//lnO5/7ym0v/j2ez///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////49ns/7ym0v+Wc7n/bz+f/2Yzmf9mM5n/ZjOZ/28/n/+ff7//7Obz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////n2Df/2YAzP9mAMz/2cDz//////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////cUFD/zAAA/9lAQP// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////99/f//M MzP/339///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////vv7//zDMz/8wzM//55ub///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+aAgP/MAAD/zxAQ//zw8P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+PQ9v9vEM//ZgDM/5ZQ3P////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////xrPZ/4xmsv9m M5n/ZjOZ/2Yzmf9vP5//qYzG/+PZ7P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+PZ7P+pjMb/bz+f /2Yzmf9mM5n/ZjOZ/4xmsv/Gs9n///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////5ZQ3P9m AMz/bxDP/+PQ9v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////54OD/zAAA/8wAAP/vsLD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////nm5v/MMzP/zDMz//zz8/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////cc3P/zDMz /9lmZv////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////PDw /88QEP/MAAD/6ZCQ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9vD8/28Qz/9mAMz/gjDV//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////8az2f+MZrL/ZjOZ/2Yzmf9mM5n/n3+//9nM5v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9nM5v+ff7//ZjOZ/2Yzmf9mM5n/jGay/8az2f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+CMNX/ZgDM/28Qz//28Pz///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////5oCA/8wAAP/VMDD///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////ZZmb/zDMz /+mmpv////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////zz8//MMzP/zDMz/++/v/////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////32Bg/8wAAP/VMDD///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////28Pz/gjDV/2YAzP+C MNX/9vD8//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZzOb/glms/2Yzmf9mM5n/bz+f/7OZzP/s5vP///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////7Obz/7OZzP9vP5//ZjOZ/2Yzmf+CWaz/2czm//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////28Pz/gjDV /2YAzP+CMNX/9vD8//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PDw/88QEP/MAAD/7KCg//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////vv7//zDMz/9VZWf////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+mmpv/MMzP/0kxM//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////54OD/zAAA/8wAAP/v sLD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+WUNz/ZgDM/28Qz//j0Pb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////7Obz/59/v/9mM5n/ZjOZ /2Yzmf+zmcz/9vP5//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////28/n/s5nM/2Yzmf9mM5n/ZjOZ /59/v//s5vP///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////49D2/28Qz/9mAMz/llDc//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+aAgP/MAAD/0iAg//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////0kxM/8wzM//2 2dn///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9JMTP/MMzP/4oyM//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////fYGD/zAAA/9lAQP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////7yQ6f9mAMz/ZgDM/9nA8/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////Gs9n/bz+f/2Yzmf9mM5n/qYzG//bz+f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////bz+f+pjMb/ZjOZ/2Yzmf9vP5//xrPZ//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9nA8/9m AMz/ZgDM/7yQ6f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////SICD/zAAA/+ygoP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////4oyM/8wzM//ff3////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9tnZ/8wzM//MMzP/+ebm//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////ng4P/MAAD/zAAA//PAwP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////49D2 /2YAzP9mAMz/s4Dm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////7Obz/4JZrP9mM5n/ZjOZ/4xmsv/s5vP///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////7Obz/4xmsv9m M5n/ZjOZ/4JZrP/s5vP///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+zgOb/ZgDM/2YAzP/j0Pb///////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////pkJD/zAAA/9IgIP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////+ebm/8wzM//PPz////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////4oyM /8wzM//VWVn///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /99gYP/MAAD/2UBA//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////28Pz/eSDS/2YAzP+WUNz///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////Pv9//bz+f/2Yzmf9v P5//vKbS//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+8ptL/bz+f/2Yzmf9vP5//z7/f//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////llDc /2YAzP95INL/9vD8//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////0iAg/8wAAP/soKD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////9VZWf/MMzP/7LOz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////0kxM/8wzM//ss7P///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////+eDg/8wAAP/MAAD/88DA//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+WUNz/ZgDM/3kg0v/2 8Pz///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9vP5/7OZzP9mM5n/ZjOZ/4JZrP/s5vP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////7Obz /4JZrP9mM5n/ZjOZ/7OZzP/28/n///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9vD8/3kg0v9mAMz/llDc//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////6ZCQ/8wAAP/SICD///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+yzs//MMzP/3HNz//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////zzMz/zDMz/8wzM//8 8/P///////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////4nBw/8wAAP/Z QED///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////8+w7/9mAMz/ZgDM/9nA8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////28/n/glms/2Yzmf9mM5n/n3+///bz+f////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bz+f+ff7//ZjOZ/2Yzmf+CWaz/9vP5//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9nA8/9m AMz/ZgDM/8+w7/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////PDw/88QEP/MAAD/77Cw//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////zz8//MMzP/zDMz//zz8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ijIz/zDMz/9xzc/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////88PD/zxAQ/8wAAP/soKD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9vD8/28Qz/9mAMz/s4Dm//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+zm8/+CWaz/ZjOZ /28/n//ZzOb///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////2czm/28/n/9mM5n/glms/+zm8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+zgOb/ZgDM/28Qz//28Pz///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+JwcP/MAAD/2UBA//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////cc3P/zDMz/+yzs/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////STEz/zDMz/+yzs/////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////pkJD/zAAA/9IgIP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////llDc /2YAzP+CMNX///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49ns/28/n/9mM5n/bz+f/+PZ7P////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+PZ7P9vP5//ZjOZ/28/n//j2ez///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////gjDV /2YAzP+WUNz///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //ng4P/MAAD/zAAA//bQ0P////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ss7P/zDMz/9xzc/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bZ2f/MMzP/zDMz//zz8/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////SICD/zAAA/+aAgP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////PsO//ZgDM/2YAzP/ZwPP///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////j2ez/bz+f/2Yzmf+CWaz/7Obz//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////s5vP/glms/2Yzmf9vP5//49ns//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////2cDz/2YAzP9mAMz/z7Dv//////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////cUFD/zAAA/99gYP////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88/P/zDMz/8wzM//88/P///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+aZmf/MMzP/2WZm//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bQ0P/MAAD/zAAA//zw8P////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////95INL/ZgDM/7OA5v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////bz+f95 TKX/ZjOZ/4JZrP/28/n///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9vP5/4JZrP9mM5n/eUyl//bz+f// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////7OA5v9m AMz/eSDS//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////v sLD/zAAA/88QEP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////2WZm/8wzM//ss7P///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9VZWf/M MzP/6aam//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////99gYP/M AAD/3FBQ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////7OA5v9mAMz/bxDP//bw/P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9vP5/4JZrP9mM5n/eUyl//bz+f////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bz+f95TKX/ZjOZ/4JZrP/28/n///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////bw/P9vEM//ZgDM/7OA5v////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////zxAQ/8wAAP/soKD///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////6aam/8wzM//cc3P///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////PPz/8wzM//MMzP/+ebm//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////PDw/88QEP/MAAD/77Cw//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9vD8/28Qz/9mAMz/xqDs//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////28/n/glms/2Yzmf9vP5//49ns //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////j2ez/bz+f/2Yzmf+CWaz/9vP5 //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////GoOz/ZgDM /28Qz//28Pz///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////4nBw /8wAAP/ZQED///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+ebm /8wzM//PPz////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////77+//8wzM//STEz///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////7KCg/8wAAP/SICD///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////n2Df /2YAzP+CMNX///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+MZrL/ZjOZ/28/n//j2ez///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49ns/28/n/9mM5n/jGay//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////gjDV/2YAzP+fYN////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////+eDg/8wAAP/MAAD/+eDg//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9JMTP/MMzP/9tnZ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////339//8wzM//ijIz///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////3FBQ/8wAAP/icHD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////s4Pn/ZgDM/2YAzP/ZwPP///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////59/v/9mM5n/bz+f/9nM5v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9nM5v9vP5//ZjOZ/59/v/// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////2cDz/2YAzP9m AMz/7OD5//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9UwMP/M AAD/6ZCQ//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+KMjP/M MzP/5pmZ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////0kxM/8wzM//vv7////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88PD/zAAA/8wAAP/20ND///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+fYN//ZgDM/4xA2f// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////xrPZ/2Yzmf9m M5n/xrPZ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////Gs9n/ZjOZ/2Yzmf/Gs9n///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////4xA2f9mAMz/n2Df//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+ygoP/MAAD/1TAw//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////++/v//MMzP/2WZm//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////5 5ub/zDMz/8wzM//88/P///////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s oKD/zAAA/9IgIP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+zg+f9mAMz/ZgDM/9nA8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////j2ez/ZjOZ/2Yzmf+pjMb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////49DZ /7yQpv+fYH//jEBm/28QP/9mADP/ZgAz/2YAM/9mADP/ZgAz/2YAM/9mADP/ZgAz/28QP/+M QGb/n2B//7yQpv/j0Nn///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////qYzG/2Yzmf9mM5n/49ns //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9nA8/9mAMz/ZgDM /+zg+f////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////zw8P/MAAD/zAAA //ng4P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////zz8//MMzP/zDMz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ss7P/zDMz/9VZWf////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////cUFD/zAAA/+JwcP////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////6lw4v9mAMz/jEDZ//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bz+f95TKX/ZjOZ/5Zzuf////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////28PP/z7C//5ZQc/9vED//ZgAz/2YAM/9mADP/ZgAz/2YAM/9mADP/ZgAz/2YAM/9m ADP/ZgAz/2YAM/9mADP/ZgAz/2YAM/9mADP/ZgAz/2YAM/9mADP/bxA//5ZQc//PsL//9vDz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////5Zzuf9mM5n/eUyl//bz+f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+MQNn/ZgDM/6lw4v////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ZQED/zAAA/+mQkP////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////VWVn/zDMz//PMzP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////ijIz/zDMz /+KMjP////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////MAAD/zAAA //PAwP////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9vD8 /28Qz/9mAMz/z7Dv//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /5Zzuf9mM5n/eUyl//bz+f////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////49DZ/59gf/9mADP/ZgAz/2YAM/9mADP/gjBZ/5ZQc/+z gJn/2cDM/+zg5v///////////////////////////////////////////+zg5v/ZwMz/s4CZ /5ZQc/+CMFn/ZgAz/2YAM/9mADP/ZgAz/59gf//j0Nn///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bz+f95TKX/ZjOZ/5Zzuf// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////PsO//ZgDM/28Qz//2 8Pz///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////soKD/zAAA/9UwMP// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ijIz/zDMz/+aZmf// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////VWVn/zDMz/++/v/////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////++wsP/MAAD/zxAQ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////s4Dm/2YAzP+CMNX///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////z7/f/2Yzmf9mM5n/2czm//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9nAzP+WUHP/ZgAz/2YAM/9m ADP/jEBm/7yQpv/s4Ob///////////////////////////////////////////////////// ////////////////////////////////////////////7ODm/7yQpv+MQGb/ZgAz/2YAM/9m ADP/llBz/9nAzP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ZzOb/ZjOZ/2Yzmf/Pv9////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////gjDV/2YAzP+zgOb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////54OD/zAAA/8wAAP/54OD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////vv7//zDMz/9lmZv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////MMzP/zDMz//nm5v// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////99gYP/MAAD/3FBQ//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////eSDS/2YAzP/G oOz///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////28/n/bz+f/2Yzmf+z mcz///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s 4Ob/n2B//2YAM/9mADP/ZgAz/59gf//j0Nn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////49DZ/59gf/9mADP/ZgAz/2YAM/+fYH//7ODm//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////s5nM/2Yzmf9vP5//9vP5 //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////xqDs/2YAzP95INL///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////1TAw/8wAAP/soKD///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////55ub/zDMz/88/P/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////PMzP/MMzP/0kxM//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9IgIP/MAAD/7KCg//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ZwPP/ZgDM/28Qz/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+pjMb/ZjOZ/3lMpf////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////8+wv/9vED//ZgAz/2YAM/+WUHP/7ODm//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////s4Ob/llBz /2YAM/9mADP/bxA//8+wv/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////3lMpf9mM5n/qYzG//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////28Qz/9mAMz/2cDz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////4nBw/8wAAP/fYGD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////0kxM/8wzM//55ub///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+mmpv/MMzP/3HNz//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////+eDg/8wAAP/MAAD/+eDg//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+fYN//ZgDM/6lw4v////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////9nM5v9mM5n/ZjOZ/9nM5v////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////28PP/llBz/2YAM/9mADP/gjBZ /+PQ2f////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+PQ2f+CMFn/ZgAz/2YAM/+WUHP/9vDz//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9nM5v9mM5n/ZjOZ/9nM5v// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////6lw4v9mAMz/n2Df//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////88DA/8wAAP/SICD///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////3HNz/8wzM//ss7P///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /99/f//MMzP/5pmZ//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////7KCg /8wAAP/SICD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bw/P9mAMz/ZgDM/+PQ9v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /4xmsv9mM5n/n3+///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+zg5v+CMFn/ZgAz/2YAM/+pcIz/9vDz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////2 8PP/qXCM/2YAM/9mADP/gjBZ/+zg5v////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+ff7//ZjOZ/4xmsv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+PQ9v9mAMz/bxDP//bw/P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////8wAAP/MAAD/9tDQ//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5pmZ/8wzM//ijIz///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9VZWf/MMzP/88zM//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////32Bg/8wAAP/fYGD///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////8ag7P9mAMz/eSDS//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////z7/f/2Yzmf9mM5n/7Obz//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////49DZ/28QP/9mADP/bxA//+PQ2f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+PQ2f9vED//ZgAz/28QP//j0Nn///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////s5vP/ZjOZ/2Yzmf/Pv9////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////95INL/ZgDM/8ag7P////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////9lAQP/MAAD/7KCg//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////88zM/8wzM//ZZmb///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////8wzM//M MzP//PPz//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////1TAw/8wAAP/p kJD///////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////5ZQ3P9m AMz/s4Dm//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////glms/2Yzmf+p jMb///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////s4Ob/bxA//2YAM/+C MFn/7ODm//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////s4Ob/gjBZ/2YAM/9vED//7ODm//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////qYzG/2Yzmf+MZrL///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+zgOb/ZgDM/5ZQ3P////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+aAgP/MAAD/32Bg//////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////PPz /8wzM//PPz////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+ebm/8wzM//PPz////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////zAAA/8wAAP/20ND///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9vD8/2YAzP9mAMz/7OD5//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ZzOb/ZjOZ/28/n//28/n///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bw8/+CMFn/ZgAz/4IwWf/28PP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9vDz/4IwWf9mADP/gjBZ//bw8/// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9vP5/28/n/9mM5n/2czm//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////s4Pn/ZgDM/2YAzP/28Pz///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////PAwP/MAAD/1TAw//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////88/P//MMzP//PPz//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////88zM/8wzM//ZZmb///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////zwMD/zAAA/8wAAP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////z7Dv/2YAzP+CMNX///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+MZrL/ZjOZ/7OZzP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9vDz/4IwWf9mADP/bxA//+zg5v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+zg5v9vED//ZgAz/4IwWf/28PP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////7OZzP9mM5n/jGay//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////gjDV/2YAzP/PsO////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////zw8P/M AAD/zAAA//zw8P////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9lmZv/M MzP/88zM//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////5pmZ/8wzM//ff3////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////pkJD/zAAA/9lAQP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////n2Df/2YAzP+pcOL///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+zm8/9mM5n/ZjOZ/+zm8/////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////llBz /2YAM/9vED//49DZ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////j0Nn/bxA//2YAM/+WUHP///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+zm8/9mM5n/ZjOZ/+zm8/////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////qXDi/2YAzP+fYN////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////VMDD/zAAA//PAwP////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////99/f//MMzP/6aam//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////4oyM/8wzM//mmZn///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////fYGD/zAAA/+JwcP////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////eSDS/2YAzP/ZwPP///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////6mMxv9mM5n/n3+///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+zgJn/ZgAz/2YAM//j0Nn///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49DZ/2YAM/9mADP/s4CZ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+ff7//ZjOZ/6mMxv////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////2cDz /2YAzP95INL///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////fYGD/zAAA /+mQkP////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aZmf/MMzP/5pmZ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////2WZm/8wzM//zzMz///////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////Z QED/zAAA/+ygoP////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s 4Pn/ZgDM/2YAzP////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////28/n/9m M5n/2czm//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+PQ2f9mADP/ZgAz/8ags/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8ags/9mADP/ZgAz/+PQ2f// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ZzOb/ZjOZ/28/n/////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////2YAzP9mAMz/7OD5//////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////mgID/zAAA/99gYP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////PMzP/MMzP/2WZm//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////0kxM/8wzM//22dn///////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////MAAD/zAAA//PAwP////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////GoOz/ZgDM/4xA2f////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////z7/f/2Yzmf95TKX///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9vDz/3kgTP9mADP/n2B///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+fYH//ZgAz/3kgTP/28PP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////eUyl/2Yzmf/Pv9////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////4xA2f9m AMz/xqDs//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////zwMD/zAAA/9lAQP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bZ2f/MMzP/1VlZ//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////zDMz /8wzM/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////ng4P/MAAD/zAAA //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////+pcOL/ZgDM /7OA5v////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////n3+//2Yzmf+pjMb///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////qXCM/2YAM/9vED//9vDz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////28PP/bxA//2YAM/+pcIz///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////qYzG/2Yzmf+ff7////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////7OA5v9mAMz/qXDi//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////54OD/zAAA/8wAAP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////MMzP/zDMz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////88/P/zDMz/8wzM/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////PAwP/MAAD/zxAQ//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+CMNX/ZgDM/9nA8/////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////bz+f/2Yzmf/j2ez///////////////////////////////////////////// ///////////////////////////////////////////////////////////////s4Ob/ZgAz /2YAM//ZwMz///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////2cDM/2YAM/9mADP/7ODm//////////////////////////////////////// ////////////////////////////////////////////////////////////////////49ns /2Yzmf9vP5////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9nA8/9mAMz/gjDV //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////zAAA/8wAAP/88PD///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////MMzP/zDMz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////zzMz/zDMz/9lmZv// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+mQkP/MAAD/2UBA//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////9mAMz/ZgDM//bw/P// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////j2ez/ZjOZ/3lMpf////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+MQGb/ZgAz/4xAZv////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////4xAZv9mADP/jEBm//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////3lMpf9mM5n/49ns//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////bw/P9mAMz/ZgDM//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////2UBA/8wAAP/zwMD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ZZmb/zDMz//PMzP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////zzMz/zDMz/9lmZv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+aAgP/MAAD/32Bg//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9nA8/9mAMz/eSDS//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////+z mcz/ZjOZ/59/v/////////////////////////////////////////////////////////// /////////////////////////////////////////////////+zg5v9mADP/ZgAz/+zg5v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+zg5v9mADP/ZgAz/+zg5v////////////////////////////////////////// /////////////////////////////////////////////////////////////////59/v/9m M5n/s5nM//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////95INL/ZgDM/9nA8/// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////3FBQ/8wAAP/soKD///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ZZmb/zDMz//PMzP////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////mmZn/zDMz/+KMjP////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////99gYP/MAAD/5oCA//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////8ag7P9mAMz/llDc//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+MZrL/ZjOZ/8+/3/////////////////////////// //////////////////////////////////////////////////////////////////////// /////////59gf/9mADP/n2B///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+fYH//ZgAz/59gf/////////// //////////////////////////////////////////////////////////////////////// /////////////////////////8+/3/9mM5n/jGay//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+WUNz/ZgDM/8ag7P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5oCA/8wAAP/mgID///////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////i jIz/zDMz/+mmpv////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////mmZn/zDMz/+aZmf////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /9lAQP/MAAD/6ZCQ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /7OA5v9mAMz/s4Dm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////9mM5n/ZjOZ //bz+f////////////////////////////////////////////////////////////////// ////////////////////////////////////9vDz/2YAM/9mADP/49DZ//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////j0Nn/ZgAz/2YAM//28PP///////////////////////////////////////////// //////////////////////////////////////////////////////////bz+f9mM5n/ZjOZ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+zgOb/ZgDM/7OA5v////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////5oCA/8wAAP/icHD///////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////mmZn/zDMz/+aZmf////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////mmZn/zDMz/+aZmf////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9lAQP/MAAD/88DA//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////4xA2f9mAMz/z7Dv//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////+PZ7P9mM5n/eUyl//////////////////////////////////////// ////////////////////////////////////////////////////////////////////xqCz /2YAM/+CMFn///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////gjBZ/2YAM//GoLP///////////// //////////////////////////////////////////////////////////////////////// //////////////////////95TKX/ZjOZ/+PZ7P////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////PsO//ZgDM/4xA2f////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////88DA /8wAAP/ZQED///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////mmZn/zDMz /+aZmf////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////c c3P/zDMz/++/v/////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////88QEP/M AAD/88DA//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////4xA2f9m AMz/2cDz//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8az2f9mM5n/lnO5//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////llBz/2YAM//GoLP///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////xqCz/2YAM/+WUHP///////////////////////////////////////////////////// //////////////////////////////////////////////////////+Wc7n/ZjOZ/8az2f// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ZwPP/ZgDM/4xA2f////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////88DA/8wAAP/ZQED///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////vv7//zDMz/9xzc/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZZmb/zDMz//PMzP////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////8wAAP/MAAD/+eDg//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////2YAzP9mAMz///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////7OZzP9mM5n/s5nM//////////////////////////////////////////////// ////////////////////////////////////////////////////////////ZgAz/2YAM//2 8PP///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9vDz/2YAM/9mADP///////////////////// //////////////////////////////////////////////////////////////////////// //////////////+zmcz/ZjOZ/7OZzP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////ZgDM/2YAzP////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////+eDg/8wAAP/P EBD///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////zzMz/zDMz/9lmZv// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////ZZmb/zDMz //PMzP////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////8wAAP/MAAD///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////2YAzP9mAMz///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////4xmsv9mM5n/z7/f//////////////// //////////////////////////////////////////////////////////////////////// ///////////////PsL//ZgAz/4IwWf////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /4IwWf9mADP/z7C///////////////////////////////////////////////////////// ///////////////////////////////////////////////Pv9//ZjOZ/4xmsv////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////ZgDM/2YAzP////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////8wAAP/MAAD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////zzMz/zDMz/9lmZv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ZZmb/zDMz//PMzP////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PDw/8wAAP/MAAD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7OD5/2YAzP+CMNX///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /4JZrP9mM5n/49ns//////////////////////////////////////////////////////// //////////////////////////////////////////////+zgJn/ZgAz/6lwjP////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////6lwjP9mADP/s4CZ//////////////////////// //////////////////////////////////////////////////////////////////////// ///////j2ez/ZjOZ/4JZrP////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////gjDV /2YAzP/s4Pn///////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////8wAAP/MAAD///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////zzMz/zDMz/9lmZv////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////VWVn/zDMz//bZ2f// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////88DA/8wAAP/MAAD///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////2cDz/2YAzP+MQNn///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////2Yzmf9mM5n///////////////////////////// //////////////////////////////////////////////////////////////////////// //////+MQGb/ZgAz/8+wv/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////8+wv/9m ADP/jEBm//////////////////////////////////////////////////////////////// ////////////////////////////////////////////ZjOZ/2Yzmf////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////jEDZ/2YAzP/ZwPP///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////8wAAP/MAAD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////22dn/zDMz/9VZWf////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////MMzP/zDMz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////88DA/8wAAP/VMDD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////2cDz/2YAzP+MQNn///////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////2Yzmf9m M5n///////////////////////////////////////////////////////////////////// //////////////////////////////////////95IEz/ZgAz/+zg5v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+zg5v9mADP/eSBM//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////ZjOZ/2Yzmf////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////jEDZ/2YAzP/Z wPP///////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9IgIP/MAAD/9tDQ//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////zDMz/8wzM/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////MMzP/zDMz//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////88DA/8wAAP/ZQED///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////2cDz/2YAzP+pcOL///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////7Obz/2Yzmf+CWaz///////////////////////////////////// //////////////////////////////////////////////////////////////////////9m ADP/ZgAz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////9mADP/ZgAz //////////////////////////////////////////////////////////////////////// ////////////////////////////////////glms/2Yzmf/s5vP///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////qXDi/2YAzP/ZwPP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9lAQP/MAAD/88DA//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////zDMz/8wzM/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////MMzP/zDMz//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////88DA /8wAAP/ZQED///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////vJDp /2YAzP+zgOb///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////2czm/2Yzmf+MZrL///// //////////////////////////////////////////////////////////////////////// /////////////////////////+PQ2f9mADP/eSBM//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////95IEz/ZgAz/+zg5v////////////////////////////////// ////////////////////////////////////////////////////////////////////jGay /2Yzmf/ZzOb///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////s4Dm/2YAzP+8kOn///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////9lAQP/MAAD/88DA//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////zDMz/8wzM/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////MMzP/zDMz//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////88DA/8wAAP/ZQED///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////s4Dm/2YAzP+zgOb///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////2czm/2Yzmf+MZrL///////////////////////////////////////////// /////////////////////////////////////////////////////////9nAzP9mADP/jEBm //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+MQGb/ZgAz/9nAzP// //////////////////////////////////////////////////////////////////////// ////////////////////////////jGay/2Yzmf/ZzOb///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////s4Dm/2YAzP+zgOb///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /9lAQP/MAAD/88DA//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////zDMz /8wzM/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////M MzP/zDMz//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////88DA/8wAAP/Z QED///////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////s4Dm/2YAzP+z gOb///////////////////////////////////////////////////////////////////// ////////////////////////////////////////////2czm/2Yzmf+MZrL///////////// //////////////////////////////////////////////////////////////////////// /////////////////9nAzP9mADP/jEBm//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+MQGb/ZgAz/9nAzP////////////////////////////////////////// ////////////////////////////////////////////////////////////jGay/2Yzmf/Z zOb///////////////////////////////////////////////////////////////////// ////////////////////////////////////////////s4Dm/2YAzP+zgOb///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9lAQP/MAAD/88DA//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////zDMz/8wzM/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////MMzP/zDMz//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////88DA/8wAAP/ZQED///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////s4Dm/2YAzP+zgOb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////2czm/2Yzmf+MZrL///////////////////////////////////////////////////// /////////////////////////////////////////////////9nAzP9mADP/jEBm//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+MQGb/ZgAz/9nAzP////////// //////////////////////////////////////////////////////////////////////// ////////////////////jGay/2Yzmf/ZzOb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////s4Dm/2YAzP+zgOb///////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9lAQP/M AAD/88DA//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////zDMz/8wzM/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////MMzP/zDMz //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////88DA/8wAAP/ZQED///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////s4Dm/2YAzP+zgOb///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////2czm/2Yzmf+MZrL///////////////////// //////////////////////////////////////////////////////////////////////// /////////9nAzP9mADP/jEBm//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+MQGb/ZgAz/9nAzP////////////////////////////////////////////////// ////////////////////////////////////////////////////jGay/2Yzmf/ZzOb///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////s4Dm/2YAzP+zgOb///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////9lAQP/MAAD/88DA//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////zDMz/8wzM/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////MMzP/zDMz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////88DA/8wAAP/ZQED///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////s4Dm/2YAzP+zgOb///////////////////////////////////////////// ////////////////////////////////////////////////////////////////////2czm /2Yzmf+MZrL///////////////////////////////////////////////////////////// /////////////////////////////////////////9nAzP9mADP/jEBm//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////+MQGb/ZgAz/9nAzP////////////////// //////////////////////////////////////////////////////////////////////// ////////////jGay/2Yzmf/ZzOb///////////////////////////////////////////// ////////////////////////////////////////////////////////////////////s4Dm /2YAzP+zgOb///////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9lAQP/MAAD/88DA //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////zDMz/8wzM/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////MMzP/zDMz//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////88DA/8wAAP/ZQED///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////s4Dm/2YAzP+zgOb///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////2czm/2Yzmf+MZrL///////////////////////////// //////////////////////////////////////////////////////////////////////// /9nAzP9mADP/jEBm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////+M QGb/ZgAz/9nAzP////////////////////////////////////////////////////////// ////////////////////////////////////////////jGay/2Yzmf/ZzOb///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////s4Dm/2YAzP+zgOb///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////9lAQP/MAAD/88DA//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////zDMz/8wzM/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////MMzP/zDMz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////88DA/8wAAP/ZQED///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////s4Dm/2YAzP+zgOb///////////////////////////////////////////////////// ////////////////////////////////////////////////////////////2czm/2Yzmf+M ZrL///////////////////////////////////////////////////////////////////// //////////////////////////////////bw8/9mADP/bxA///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////9vED//ZgAz//bw8/////////////////////////// //////////////////////////////////////////////////////////////////////// ////jGay/2Yzmf/ZzOb///////////////////////////////////////////////////// ////////////////////////////////////////////////////////////s4Dm/2YAzP+z gOb///////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9lAQP/MAAD/88DA//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////zDMz/8wzM/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////MMzP/zDMz//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////88DA/8wAAP/ZQED///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////s4Dm/2YAzP+zgOb///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9vP5/2Yzmf9mM5n///////////////////////////////////// //////////////////////////////////////////////////////////////////////9m ADP/ZgAz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////9mADP/ZgAz //////////////////////////////////////////////////////////////////////// ////////////////////////////////////ZjOZ/2Yzmf/28/n///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////s4Dm/2YAzP+zgOb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9lAQP/MAAD/88DA//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////zDMz/8wzM/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////MMzP/zDMz//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////88DA /8wAAP/SICD///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////s4Dm /2YAzP+zgOb///////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////2Yzmf9mM5n///// //////////////////////////////////////////////////////////////////////// //////////////////////////////95IEz/ZgAz/+PQ2f////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////+PQ2f9mADP/eSBM//////////////////////////////////////// ////////////////////////////////////////////////////////////////////ZjOZ /2Yzmf////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////s4Dm/2YAzP+zgOb///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////9IgIP/MAAD/+eDg//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////zDMz/8wzM/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////VWVn/zDMz//bZ2f////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////88DA/8wAAP/MAAD///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////xqDs/2YAzP+MQNn///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////2Yzmf9mM5n/9vP5//////////////////////////////////////// //////////////////////////////////////////////////////////////+MQGb/ZgAz /8+wv/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8+wv/9mADP/jEBm//////// //////////////////////////////////////////////////////////////////////// ///////////////////////28/n/ZjOZ/2Yzmf////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////jEDZ/2YAzP/GoOz///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /8wAAP/MAAD///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////22dn/zDMz /9VZWf////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////Z Zmb/zDMz//PMzP////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////8wAAP/M AAD///////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////2cDz/2YAzP+M QNn///////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////4xmsv9mM5n/2czm//////// //////////////////////////////////////////////////////////////////////// //////////////////////+zgJn/ZgAz/6lwjP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////6lwjP9mADP/s4CZ//////////////////////////////////////////////// ///////////////////////////////////////////////////////ZzOb/ZjOZ/4xmsv// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////jEDZ/2YAzP/ZwPP///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////8wAAP/MAAD///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////zzMz/zDMz/9lmZv////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZZmb/zDMz//PMzP////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////8wAAP/MAAD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////2cDz/2YAzP+MQNn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////4xmsv9mM5n/z7/f//////////////////////////////////////////////// ///////////////////////////////////////////////////////PsL//ZgAz/4IwWf// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////4IwWf9mADP/z7C///////////////// //////////////////////////////////////////////////////////////////////// ///////////////Pv9//ZjOZ/4xmsv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////jEDZ/2YAzP/ZwPP///////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////8wAAP/M AAD///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////zzMz/zDMz/9lmZv// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////ZZmb/zDMz //PMzP////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////8wAAP/MAAD/+eDg //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////2cDz/2YAzP9vEM////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////7OZzP9mM5n/s5nM//////////////// //////////////////////////////////////////////////////////////////////// ///////////////28PP/ZgAz/2YAM//28PP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9vDz /2YAM/9mADP/9vDz//////////////////////////////////////////////////////// //////////////////////////////////////////////+zmcz/ZjOZ/7OZzP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////bxDP/2YAzP/ZwPP///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+eDg/8wAAP/SICD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////zzMz/zDMz/9lmZv////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////cc3P/zDMz/+yzs/////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////88QEP/MAAD/88DA//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////2YAzP9mAMz///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /8az2f9mM5n/lnO5//////////////////////////////////////////////////////// ////////////////////////////////////////////////////jEBm/2YAM//GoLP///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////xqCz/2YAM/+MQGb///////////////////////////// //////////////////////////////////////////////////////////////////////// //////+Wc7n/ZjOZ/8az2f////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////ZgDM /2YAzP////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////88DA/8wAAP/ZQED///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ss7P/zDMz/9xzc/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////mmZn/zDMz/+aZmf// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9lAQP/MAAD/88DA//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////2YAzP9mAMz/7OD5//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+PZ7P9mM5n/eUyl//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////vJCm/2YAM/+MQGb///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////jEBm/2YAM/+8 kKb///////////////////////////////////////////////////////////////////// //////////////////////////////////////95TKX/ZjOZ/+PZ7P////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////s4Pn/ZgDM/2YAzP////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////88DA/8wAAP/ZQED///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////mmZn/zDMz/+aZmf////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////mmZn/zDMz/+aZmf////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9lAQP/MAAD/6ZCQ//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////4Iw1f9mAMz/2cDz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////9m M5n/ZjOZ//bz+f////////////////////////////////////////////////////////// ////////////////////////////////////////////9vDz/2YAM/9mADP/7ODm//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////s4Ob/ZgAz/2YAM//28PP///////////////////////////////////// //////////////////////////////////////////////////////////////////bz+f9m M5n/ZjOZ//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ZwPP/ZgDM/4Iw1f// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////5oCA/8wAAP/icHD///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////mmZn/zDMz/+aZmf////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////mmZn/zDMz/99/f/////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////99gYP/MAAD/5oCA//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////4xA2f9mAMz/xqDs//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+MZrL/ZjOZ/8+/3/////////////////////////// //////////////////////////////////////////////////////////////////////// /////////59gf/9mADP/n2B///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+fYH//ZgAz/59gf/////////// //////////////////////////////////////////////////////////////////////// /////////////////////////8+/3/9mM5n/jGay//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////GoOz/ZgDM/4xA2f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5oCA/8wAAP/mgID///////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////f f3//zDMz/+mmpv////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////zzMz/zDMz/9lmZv////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+aAgP/MAAD/32Bg//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /6lw4v9mAMz/s4Dm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////+zmcz/ZjOZ /6mMxv////////////////////////////////////////////////////////////////// /////////////////////////////////////////9nAzP9mADP/ZgAz//bw8/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bw8/9mADP/ZgAz/9nAzP////////////////////////////////////////////////// /////////////////////////////////////////////////////////6mMxv9mM5n/s5nM //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+zgOb/ZgDM/6lw4v////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////3FBQ/8wAAP/soKD///////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZZmb/zDMz//PMzP////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////zzMz/zDMz/9lmZv////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+ygoP/MAAD/2UBA//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////7yQ6f9mAMz/jEDZ//////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ZzOb/ZjOZ/3lMpf////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+MQGb/ZgAz/59gf/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////59gf/9mADP/jEBm//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////3lMpf9mM5n/2czm//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+MQNn/ZgDM/7yQ6f////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////2UBA /8wAAP/zwMD///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////ZZmb/zDMz //PMzP////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////8 8/P/zDMz/8wzM/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////PAwP/M AAD/zxAQ//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9nA8/9m AMz/eSDS//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////bz+f/2Yzmf/j 2ez///////////////////////////////////////////////////////////////////// ///////////////////////////////////////ZwMz/ZgAz/2YAM//j0Nn///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////49DZ/2YAM/9m ADP/2cDM//////////////////////////////////////////////////////////////// ////////////////////////////////////////////49ns/2Yzmf9vP5////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////95INL/ZgDM/9nA8/////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////zAAA/8wAAP/88PD///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////MMzP/zDMz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////zDMz/8wzM/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zw8P/MAAD/zAAA//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////bw/P9mAMz/ZgDM//bw/P////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////lnO5/2Yzmf+8ptL///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////n2B//2YAM/+CMFn///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////gjBZ/2YAM/+fYH////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////vKbS/2Yzmf+Wc7n///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////bw/P9m AMz/ZgDM//bw/P////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88PD/zAAA/88QEP// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////MMzP/zDMz//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////0kxM /8wzM//zzMz///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////MAAD/zAAA //PAwP////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////+CMNX/ZgDM /9nA8/////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////xrPZ/2Yzmf95TKX///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////7ODm/28QP/9mADP/s4CZ//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+zgJn/ZgAz/28QP//s4Ob///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////eUyl/2Yzmf/Gs9n///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////9nA8/9mAMz/gjDV//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////zwMD/zAAA/9lAQP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////PMzP/MMzP/1VlZ//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////2WZm/8wzM//zzMz///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ZQED/zAAA/+ygoP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+fYN//ZgDM/7OA5v////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////28/n/9mM5n/49ns//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /8+wv/9mADP/ZgAz/9nAzP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /9nAzP9mADP/ZgAz/8+wv/////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////j2ez/ZjOZ /28/n/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////7OA5v9mAMz/n2Df //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////pkJD/zAAA/+JwcP////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////PMzP/MMzP/2WZm//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////4oyM/8wzM//m mZn///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////fYGD/zAAA/+JwcP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+8kOn/ZgDM/4xA2f// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////59/v/9mM5n/n3+///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////+fYH//ZgAz/28QP//j0Nn///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////49DZ/28QP/9mADP/n2B///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+ff7//ZjOZ/59/v/////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////4xA2f9mAMz/vJDp//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////fYGD/zAAA/+mQkP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+aZmf/MMzP/5pmZ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////5pmZ/8wzM//ijIz///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////pkJD/zAAA/9lAQP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////j0Pb/ZgDM/2YAzP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+PZ7P9mM5n/ZjOZ//bz+f////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////2 8PP/gjBZ/2YAM/+CMFn/9vDz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////28PP/gjBZ/2YAM/+C MFn/9vDz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bz+f9mM5n/ZjOZ/+PZ7P// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////2YAzP9mAMz/49D2//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////VMDD/zAAA//PAwP////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+KMjP/MMzP/6aam//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////88zM/8wzM//ZZmb///// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////zwMD/zAAA/8wAAP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////bxDP/2YAzP/ZwPP///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////+MZrL/ZjOZ/7OZzP////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////7ODm/3kgTP9mADP/gjBZ//bw8/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bw8/+CMFn/ZgAz/3kgTP/s4Ob///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////7OZzP9mM5n/jGay//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////2cDz/2YAzP9vEM////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////M AAD/zAAA//zw8P////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9lmZv/M MzP/88zM//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////+ebm/8wzM//PPz////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////zAAA/8wAAP/20ND///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////n2Df/2YAzP+pcOL///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////Gs9n/ZjOZ/28/n//28/n///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+PQ2f9vED//ZgAz/28QP//j0Nn///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////49DZ/28QP/9mADP/bxA//+PQ2f////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9vP5/28/n/9mM5n/xrPZ//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////qXDi/2YAzP+fYN////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////PAwP/MAAD/1TAw//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////88/P//MMzP//PPz//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8wzM//MMzP/+ebm//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////1TAw/8wAAP/soKD///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////xqDs/2YAzP+CMNX///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////eUyl/2Yzmf/Gs9n///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////j0Nn/gjBZ/2YAM/9vED//49DZ//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////j0Nn/bxA/ /2YAM/+CMFn/49DZ//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////xrPZ /2Yzmf95TKX///////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////gjDV /2YAzP/GoOz///////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aAgP/MAAD/4nBw //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////+ebm/8wzM//STEz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9lmZv/MMzP/88zM//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////4nBw/8wAAP/fYGD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9vD8/2YAzP9mAMz/7OD5//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////xrPZ/2Yzmf9vP5//9vP5//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9vDz/4IwWf9mADP/bxA//9nAzP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////9nAzP9vED//ZgAz/4IwWf/28PP///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////28/n/bz+f/2Yzmf/Gs9n///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////s4Pn/ZgDM/2YAzP/28Pz///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////9xQUP/MAAD/7KCg//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////88zM/8wzM//ZZmb///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////99/f//MMzP/5pmZ//////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////7KCg/8wAAP/SICD///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////4Iw1f9mAMz/vJDp//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////4JZrP9mM5n/s5nM//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bw8/+CMFn/ZgAz/2YAM/+fYH//9vDz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////28PP/n2B//2YAM/9mADP/gjBZ//bw8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+zmcz/ZjOZ/4JZrP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+8kOn/ZgDM/4Iw1f// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////88QEP/MAAD/+eDg//////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////5pmZ/8wzM//mmZn///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+yzs//MMzP/3HNz//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+eDg /8wAAP/MAAD/+eDg//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /8ag7P9mAMz/gjDV//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /9nM5v9mM5n/ZjOZ/+PZ7P////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////28PP/qXCM/2YAM/9mADP/gjBZ/+PQ2f////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+PQ2f+C MFn/ZgAz/2YAM/+pcIz/9vDz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+PZ7P9mM5n/ZjOZ/9nM5v////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+CMNX/ZgDM/8ag7P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////88DA/8wAAP/SICD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////3HNz/8wzM//vv7////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bZ2f/MMzP/0kxM//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9IgIP/MAAD/7KCg//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bw/P9mAMz/ZgDM/+PQ9v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////+Wc7n/ZjOZ/4xmsv////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8+wv/9vED//ZgAz/2YAM/+p cIz/9vDz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////28PP/qXCM/2YAM/9mADP/bxA//8+wv/////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////4xmsv9mM5n/lnO5//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+PQ9v9mAMz/ZgDM//bw/P////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////5oCA/8wAAP/fYGD///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////0kxM/8wzM//55ub///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////M MzP/zDMz//nm5v////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+JwcP/M AAD/32Bg//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////+W UNz/ZgDM/6lw4v////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s 5vP/bz+f/2Yzmf+8ptL///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////s4Ob/n2B//2YAM/9mADP/ZgAz/7OAmf/28PP///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////9vDz/7OAmf9mADP/ZgAz/2YAM/+fYH//7ODm //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////vKbS /2Yzmf9vP5//7Obz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /6lw4v9mAMz/llDc//////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////1TAw /8wAAP/soKD///////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////55ub/zDMz /9JMTP////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZZmb/zDMz/++/v/////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////++wsP/MAAD/zxAQ//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////PsO//ZgDM/3kg0v////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////vKbS/2Yzmf9vP5//49ns//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9nAzP+CMFn/ZgAz /2YAM/9mADP/n2B//8+wv/////////////////////////////////////////////////// /////////////////////////////////////////////////////////8+wv/+fYH//ZgAz /2YAM/9mADP/gjBZ/9nAzP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////j2ez/bz+f/2Yzmf+8ptL///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////3kg0v9mAMz/z7Dv//////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////54OD/zAAA/8wAAP/88PD///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////vv7//zDMz/9xzc/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////ijIz/zDMz /+KMjP////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////MAAD/zAAA //PAwP////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////bxDP /2YAzP/PsO////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /4JZrP9mM5n/jGay//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////z7C//4xAZv9mADP/ZgAz/2YAM/9vED//llBz/8ags//Z wMz/////////////////////////////////////////////////////////////////2cDM /8ags/+WUHP/bxA//2YAM/9mADP/ZgAz/4xAZv/PsL////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+MZrL/ZjOZ/4JZrP// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////z7Dv/2YAzP9v EM////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////soKD/zAAA/9lAQP// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ijIz/zDMz/+mmpv// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////vv7//zDMz/9VZWf////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////cUFD/zAAA/+JwcP////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////s4Dm/2YAzP+MQNn///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+zm8/9vP5//ZjOZ/6mMxv////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s 4Ob/n2B//3kgTP9mADP/ZgAz/2YAM/9mADP/ZgAz/4IwWf+MQGb/jEBm/4xAZv+MQGb/jEBm /4xAZv+MQGb/jEBm/4IwWf9mADP/ZgAz/2YAM/9mADP/ZgAz/3kgTP+fYH//7ODm//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////6mMxv9mM5n/bz+f/+zm8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////jEDZ/2YAzP+zgOb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////cUFD/zAAA/+mQkP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////VWVn/zDMz//bZ2f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88/P/zDMz/8wzM//8 8/P///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////soKD/zAAA/9IgIP// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9vD8/2YAzP9m AMz/2cDz//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////P v9//ZjOZ/2Yzmf/Pv9////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////j0Nn/vJCm/4xAZv95IEz/ZgAz /2YAM/9mADP/ZgAz/2YAM/9mADP/ZgAz/2YAM/9mADP/ZgAz/2YAM/9mADP/eSBM/4xAZv+8 kKb/49DZ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////z7/f/2Yzmf9mM5n/z7/f//////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ZwPP/ZgDM/2YAzP/28Pz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zw8P/MAAD/zAAA//ng4P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zz8//MMzP/zz8///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////1VlZ/8wzM//vv7////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////88PD/zAAA/8wAAP/20ND///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////59g3/9mAMz/llDc//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////qYzG/2Yzmf9vP5//49ns//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9vDz/9nAzP/ZwMz/2cDM/9nAzP/ZwMz/2cDM/9nAzP/Z wMz/2cDM/9nAzP/28PP///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////j2ez/bz+f /2Yzmf+pjMb///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+WUNz/ZgDM/59g3/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+ygoP/MAAD/1TAw//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /++/v//MMzP/3HNz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////4oyM/8wzM//ijIz///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////3FBQ/8wAAP/fYGD///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+zg+f9mAMz/ZgDM /+zg+f////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /4xmsv9mM5n/bz+f//bz+f////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////bz+f9vP5//ZjOZ/4xmsv////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+zg+f9mAMz/ZgDM/+zg+f////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9UwMP/MAAD/6ZCQ//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+KMjP/MMzP/6aam//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////77+//8wzM//STEz///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7KCg/8wAAP/PEBD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+fYN//ZgDM/59g3/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bz+f+CWaz/ZjOZ/4JZrP/28/n///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9vP5/4JZrP9mM5n/glms//bz+f// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////59g3/9m AMz/n2Df//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////+eDg/8wAAP/M AAD/+eDg//////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9JMTP/M MzP/+ebm//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8wzM//MMzP/9tnZ//////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////PDw/88QEP/MAAD/77Cw//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ZwPP/ZgDM/2YAzP/s 4Pn///////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s 5vP/bz+f/2Yzmf+CWaz/9vP5//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////2 8/n/glms/2Yzmf9vP5//7Obz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////7OD5/2YAzP9mAMz/2cDz//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////4nBw/8wAAP/ZQED///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9tnZ/8wzM//STEz///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////9xzc//MMzP/6aam//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////99gYP/MAAD/3FBQ//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////llDc/2YAzP+MQNn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////49ns/28/n/9mM5n/glms/+zm8/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+zm8/+CWaz/ZjOZ/28/n//j2ez///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////jEDZ/2YAzP+WUNz///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////0iAg/8wAAP/soKD///// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////6aam/8wzM//ff3////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+mmpv/MMzP/2WZm//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bQ0P/MAAD/zAAA//ng4P////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////7OD5/2YAzP9mAMz/2cDz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+PZ7P9vP5//ZjOZ/28/n//j2ez///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////49ns/28/n/9mM5n/bz+f /+PZ7P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ZwPP/ZgDM/2YAzP/s4Pn///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////soKD/zAAA/88QEP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////2WZm/8wzM//vv7////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //nm5v/MMzP/zDMz//nm5v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////VMDD/zAAA/+aAgP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////6lw4v9mAMz/gjDV//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////28/n/glms/2Yzmf9vP5//49ns//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////j2ez/bz+f/2Yzmf+CWaz/9vP5//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////+CMNX/ZgDM/6lw4v////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ZQED/zAAA/+JwcP////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////55ub/zDMz/88/P/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////VWVn/zDMz/+yzs/////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////soKD/zAAA/88QEP/88PD///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bw/P9vEM//ZgDM/7yQ6f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9vP5/4JZrP9mM5n/bz+f/+PZ7P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+PZ7P9vP5//ZjOZ/4JZrP/28/n///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////7OA5v9m AMz/bxDP//bw/P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////bQ0P/M AAD/zAAA//ng4P////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////s s7P/zDMz/99/f/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////p pqb/zDMz/9lmZv////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////zxAQ/8wAAP/soKD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////GoOz/ZgDM/28Qz//s4Pn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bz+f+CWaz/ZjOZ/28/n/+zmcz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////s5nM/28/n/9m M5n/glms//bz+f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////7OD5/28Qz/9mAMz/xqDs//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////99gYP/MAAD/3FBQ//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZZmb/zDMz/++/v/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////55ub/zDMz/8wzM//88/P///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////5oCA/8wAAP/SICD///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////jEDZ/2YAzP+WUNz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////28/n/jGay/2Yzmf9mM5n/n3+///bz+f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bz+f+ff7//ZjOZ/2Yzmf+MZrL/9vP5//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////llDc/2YAzP+MQNn///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////PDw/8wAAP/MAAD/88DA //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////zz8//MMzP/zz8/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////1VlZ /8wzM//ss7P///////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////PDw /88QEP/MAAD/7KCg//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7OD5/28Qz/9mAMz/xqDs//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////8az2f9mM5n/ZjOZ/4JZrP/s 5vP///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////7Obz/4JZrP9mM5n/ZjOZ/8az2f////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////GoOz/ZgDM/28Qz//s4Pn///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////5oCA/8wAAP/ZQED///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////+yzs//MMzP/339///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////6aam/8wzM//VWVn///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+JwcP/MAAD/0iAg//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////7yQ6f9mAMz/bxDP/+zg+f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ZzOb/bz+f/2Yzmf9vP5//s5nM//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////+zmcz/bz+f /2Yzmf9vP5//2czm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+zg+f9vEM//ZgDM/7yQ6f////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88PD/zxAQ/8wAAP/vsLD///////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9VZWf/MMzP/88zM//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PPz/8wzM//M MzP/+ebm//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////ng4P/M AAD/zAAA/+ygoP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+MQNn/ZgDM/4Iw1f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////7Obz/4xmsv9mM5n/ZjOZ /4xmsv/j2ez///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49ns/4xmsv9mM5n/ZjOZ/4xmsv/s5vP///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////4Iw1f9m AMz/jEDZ//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////m gID/zAAA/9IgIP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////+ebm/8wzM//STEz///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////9xzc//MMzP/4oyM//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////fYGD/zAAA/9IgIP////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////28Pz/bxDP/2YAzP+pcOL///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////Gs9n/bz+f/2Yzmf9mM5n/qYzG//bz+f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bz+f+pjMb/ZjOZ/2Yzmf9vP5//xrPZ//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////qXDi/2YAzP9vEM//9vD8//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zw8P/PEBD/zAAA/+ygoP////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////4oyM/8wzM//mmZn///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+yzs//MMzP/zz8/ //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////54OD/zAAA /8wAAP/soKD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////2cDz/2YAzP9mAMz/z7Dv//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////49ns/5Zzuf9m M5n/ZjOZ/3lMpf+8ptL///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////vKbS/3lMpf9m M5n/ZjOZ/5Zzuf/j2ez///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////PsO//ZgDM/2YAzP/ZwPP///// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aAgP/MAAD/0iAg //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////zz8/ /8wzM//55ub///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////PPz//zDMz/+yzs/////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////4nBw/8wAAP/SICD//PDw//////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////6lw4v9mAMz/bxDP/+zg+f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////Pv9//eUyl/2Yzmf9mM5n/bz+f/7ym0v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////7ym0v9vP5//ZjOZ/2Yzmf95TKX/z7/f//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+zg+f9vEM//ZgDM/6lw4v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////+eDg/88QEP/MAAD/77Cw//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////ss7P/zDMz/9xzc/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ijIz/zDMz/9lmZv// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////+eDg/88QEP/M AAD/5oCA//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+MQNn/ZgDM/4Iw1f/28Pz///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /7ym0v95TKX/ZjOZ/2Yzmf9vP5//qYzG/+zm8/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+zm8/+pjMb/bz+f/2Yzmf9mM5n/eUyl/7ym0v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9vD8/4Iw1f9mAMz/jEDZ//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////32Bg/8wAAP/VMDD///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ZZmb/zDMz/++/v/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////55ub/zDMz/8wzM//22dn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+aAgP/MAAD/zxAQ//zw8P////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////28Pz/eSDS/2YAzP+WUNz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////vKbS/3lMpf9mM5n/ZjOZ/2Yzmf+W c7n/xrPZ//bz+f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bz+f/Gs9n/lnO5/2Yzmf9mM5n/ZjOZ /3lMpf+8ptL///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////llDc/2YAzP95 INL/9vD8//////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////2 0ND/zAAA/8wAAP/zwMD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////bZ2f/MMzP/0kxM//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////3HNz/8wzM//ff3////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////zw8P/SICD/zAAA /9xQUP////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////49D2/28Qz/9mAMz/n2Df//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////Pv9//lnO5/2Yzmf9mM5n/ZjOZ/2Yzmf+MZrL/vKbS/+PZ7P////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+PZ7P+8ptL/jGay /2Yzmf9mM5n/ZjOZ/2Yzmf+Wc7n/z7/f//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////+fYN//ZgDM/28Qz//j0Pb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZQED/zAAA/9xQUP////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////99/f//MMzP/6aam//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////88zM/8wzM//MMzP/+ebm//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////soKD/zAAA/8wAAP/zwMD///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9nA8/9vEM//ZgDM/7yQ6f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+zm8//Gs9n/glms /2Yzmf9mM5n/ZjOZ/2Yzmf95TKX/jGay/7OZzP/Pv9//49ns//////////////////////// ///////////////////////////////////////////////////////////////j2ez/z7/f /7OZzP+MZrL/eUyl/2Yzmf9mM5n/ZjOZ/2Yzmf+CWaz/xrPZ/+zm8/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////7yQ6f9mAMz/bxDP/9nA8/////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+ygoP/MAAD/zAAA //ng4P////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+ebm /8wzM//MMzP//PPz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////9lmZv/MMzP/339///////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////2UBA/8wAAP/S ICD//PDw//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////GoOz/ZgDM/2YAzP/GoOz///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bz+f/Gs9n/n3+//3lMpf9mM5n/ZjOZ/2Yzmf9m M5n/ZjOZ/2Yzmf95TKX/jGay/4xmsv+MZrL/jGay/4xmsv+MZrL/jGay/4xmsv+MZrL/jGay /4xmsv+MZrL/eUyl/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/3lMpf+ff7//xrPZ//bz+f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////xqDs /2YAzP9mAMz/xqDs//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PDw/88QEP/MAAD/4nBw//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////339//8wzM//ff3////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////++/v//MMzP/zz8///zz8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9tDQ/8wAAP/MAAD/5oCA//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////xqDs/2YAzP9mAMz/xqDs //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////s5vP/z7/f/7OZzP+MZrL/eUyl/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ /2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf9mM5n/ZjOZ/2Yzmf95TKX/jGay/7OZzP/P v9//7Obz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////GoOz/ZgDM/2YAzP/GoOz///////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////32Bg/8wAAP/SICD//PDw//////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88/P/zz8//8wzM//5 5ub///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////STEz/zDMz/+aZmf////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aAgP/MAAD/zAAA //ng4P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////7yQ6f9mAMz/ZgDM/7yQ6f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////s5vP/2czm/9nM5v/ZzOb/2czm/9nM5v/ZzOb/2czm/9nM5v/ZzOb/2czm/9nM5v/Z zOb/7Obz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////7yQ6f9mAMz/ZgDM/7yQ6f// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////z wMD/zAAA/8wAAP/vsLD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////mmZn/zDMz/99/f/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ss7P/zDMz/88/P//88/P///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////VMDD/zAAA/9lAQP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////+fYN//ZgDM/2YAzP+f YN////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////n2Df/2YAzP9mAMz/qXDi//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////VMDD/zAAA/9xQUP////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zz8//PPz//zDMz//bZ2f////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////0kxM/8wzM//mmZn///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////20ND/zAAA/8wAAP/p kJD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////vJDp/2YAzP9mAMz/n2Df//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////+fYN//ZgDM/2YAzP+8kOn///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+aAgP/MAAD/zxAQ //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+aZmf/MMzP/2WZm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////7LOz/8wzM//PPz///PPz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////5oCA/8wAAP/MAAD/88DA//////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////8ag7P9mAMz/ZgDM /59g3/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////59g3/9mAMz/ZgDM /8ag7P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////77Cw/8wAAP/MAAD/77Cw//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////PPz/88/P//MMzP/88zM//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////9JMTP/MMzP/5pmZ//////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9UwMP/MAAD/0iAg //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////GoOz/ZgDM/2YAzP+fYN////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////n2Df/2YAzP9mAMz/xqDs//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88PD/zxAQ/8wAAP/cUFD///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////5pmZ/8wzM//Z Zmb///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /++/v//MMzP/zz8///nm5v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////ng4P/PEBD/zAAA/9xQUP////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////xqDs/2YAzP9m AMz/jEDZ/+PQ9v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+PQ9v+MQNn/ZgDM/2YAzP/GoOz///////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////c UFD/zAAA/9IgIP/88PD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////55ub/zz8//8wzM//22dn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////VWVn/zDMz/99/f/////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////soKD/zAAA/8wAAP/p kJD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////9nA8/95INL/ZgDM/28Qz//j0Pb///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////49D2/28Qz/9m AMz/eSDS/9nA8/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////+mQkP/MAAD/zAAA//PAwP////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ff3//zDMz/9xzc/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////z zMz/zDMz/8wzM//22dn///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////32Bg/8wAAP/PEBD/9tDQ//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////28Pz/gjDV /2YAzP9mAMz/xqDs//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////GoOz/ZgDM/2YAzP+CMNX/9vD8//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////9tDQ/8wAAP/MAAD/5oCA //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bZ2f/MMzP/zDMz//nm5v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////3HNz/8wzM//ZZmb///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////9UwMP/MAAD/0iAg //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9vD8/5ZQ3P9mAMz/ZgDM/6lw4v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////6lw4v9mAMz/ZgDM/5ZQ3P/28Pz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////88PD/0iAg/8wAAP/cUFD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9lmZv/MMzP/5pmZ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+ebm /8wzM//MMzP/7LOz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////ng4P/PEBD/zAAA/9UwMP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////+p cOL/ZgDM/2YAzP95INL/49D2//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////j0Pb/eSDS /2YAzP9mAMz/qXDi//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////VMDD/zAAA/9IgIP/88PD///////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////7LOz/8wzM//P Pz///PPz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+KMjP/MMzP/0kxM//zz8/////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////vsLD/zAAA/8wAAP/i cHD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////49D2/28Qz/9mAMz/bxDP/8ag7P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////8ag7P9vEM//ZgDM/28Qz//j0Pb///////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////99gYP/M AAD/zAAA//bQ0P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////88/P/0kxM/8wzM//ppqb///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////zz8//S TEz/zDMz/+aZmf////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////7KCg/8wAAP/MAAD/7KCg//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bw/P+WUNz/ZgDM/2YAzP+CMNX/7OD5//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////s4Pn/gjDV/2YAzP9mAMz/llDc//bw/P// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////6ZCQ/8wAAP/MAAD/7KCg//////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////mmZn/zDMz/9VZWf////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////vv7//zDMz/8wzM//22dn///////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////99gYP/MAAD/zAAA /++wsP////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////z7Dv/28Qz/9mAMz/bxDP/7OA5v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////7OA5v9v EM//ZgDM/28Qz//PsO////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////vsLD/zAAA/8wAAP/mgID///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bZ2f/MMzP/zDMz//PMzP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////3HNz /8wzM//ZZmb///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////cUFD/zAAA/88QEP/20ND///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+zg+f+fYN//ZgDM/2YAzP+CMNX/2cDz//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ZwPP/gjDV/2YAzP9mAMz/n2Df/+zg+f////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bQ0P/PEBD/zAAA/99gYP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////9lmZv/MMzP/4oyM//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////PPz/88/P//MMzP/6aam//////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88PD/1TAw/8wAAP/P EBD/9tDQ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////z7Dv/3kg0v9mAMz/ZgDM /4xA2f/j0Pb///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////49D2/4xA2f9mAMz/ZgDM/3kg0v/PsO////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9tDQ/88QEP/MAAD/1TAw//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////6aam/8wzM//P Pz///PPz//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+mmpv/M MzP/zz8///nm5v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////PDw/9UwMP/MAAD/zxAQ//ng4P////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////+zgOb/ZgDM/2YAzP9mAMz/n2Df/+zg+f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+zg+f+fYN//ZgDM /2YAzP9mAMz/s4Dm//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////54OD/zxAQ/8wAAP/V MDD//PDw//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////55ub/zz8//8wzM//vv7////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////VWVn/zDMz/9lmZv////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////ng4P/SICD/zAAA /9UwMP/88PD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9vD8/5ZQ3P9m AMz/ZgDM/2YAzP+fYN//49D2//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////j0Pb/n2Df/2YAzP9mAMz/ZgDM/5ZQ3P/28Pz///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////zw8P/VMDD/zAAA/9IgIP/88PD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////ZZmb/zDMz/9lmZv////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////22dn/zDMz /8wzM//mmZn///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////20ND/zxAQ/8wAAP/VMDD//PDw//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////s4Pn/llDc/2YAzP9mAMz/ZgDM/5ZQ3P/ZwPP///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////2cDz/5ZQ3P9mAMz/ZgDM/2YAzP+WUNz/7OD5//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////PDw/9UwMP/MAAD/zxAQ//ng4P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+aZmf/MMzP/zz8///nm5v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////7LOz/8wzM//MMzP/9tnZ//////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9tDQ/88QEP/M AAD/1TAw//ng4P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+zg+f+pcOL/ZgDM/2YAzP9mAMz/eSDS/7yQ6f/28Pz///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9vD8/7yQ6f95INL/ZgDM/2YAzP9m AMz/qXDi/+zg+f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////54OD/1TAw /8wAAP/PEBD/9tDQ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9tnZ/8wzM//MMzP/7LOz//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9xzc//M MzP/1VlZ//zz8/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////bQ0P/SICD/zAAA/9IgIP/54OD///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////7OD5/7OA5v95INL/ZgDM/2YAzP9m AMz/jEDZ/8ag7P/28Pz///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9vD8/8ag7P+M QNn/ZgDM/2YAzP9mAMz/eSDS/7OA5v/s4Pn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////bQ0P/SICD/zAAA/9IgIP/20ND///////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88/P/1VlZ/8wzM//f f3////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////zz8//STEz/zDMz/+KMjP////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////54OD/0iAg /8wAAP/SICD/9tDQ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////xqDs/4xA2f9mAMz/ZgDM/2YAzP9mAMz/jEDZ/8ag7P/s4Pn///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////7OD5/8ag7P+MQNn/ZgDM/2YAzP9mAMz/ZgDM/4xA2f/GoOz///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9tDQ/88QEP/MAAD/0iAg//ng4P// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////ijIz/zDMz/9JMTP/88/P///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////zzMz/zDMz /8wzM//ss7P///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////+eDg/9UwMP/MAAD/zxAQ//bQ0P////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////28Pz/xqDs /4xA2f9mAMz/ZgDM/2YAzP9mAMz/eSDS/59g3//GoOz/49D2//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////j0Pb/xqDs/59g3/95INL/ZgDM/2YAzP9mAMz/ZgDM/4xA2f/GoOz/9vD8 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////z wMD/zxAQ/8wAAP/VMDD/+eDg//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+yzs//MMzP/zDMz//bZ2f////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////5pmZ/8wzM//MMzP/9tnZ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////zw8P/V MDD/zAAA/88QEP/zwMD///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////s4Pn/xqDs/59g3/9mAMz/ZgDM/2YAzP9m AMz/ZgDM/28Qz/+MQNn/s4Dm/8ag7P/ZwPP///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////2cDz/8ag7P+zgOb/jEDZ/28Qz/9mAMz/ZgDM/2YAzP9mAMz/ZgDM /59g3//GoOz/7OD5//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////++wsP/MAAD/zAAA/9UwMP/88PD///////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tnZ /8wzM//MMzP/5pmZ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////9VZWf/M MzP/1VlZ//zz8/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////88PD/3FBQ/8wAAP/MAAD/7KCg//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////2cDz/7OA5v+WUNz/bxDP/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM /2YAzP+MQNn/jEDZ/6lw4v+zgOb/s4Dm/7OA5v+zgOb/s4Dm/7OA5v+zgOb/s4Dm/7OA5v+z gOb/s4Dm/7OA5v+zgOb/s4Dm/6lw4v+MQNn/jEDZ/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM /2YAzP9vEM//llDc/7OA5v/ZwPP///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////6ZCQ/8wAAP/MAAD/3FBQ //zw8P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////88/P/1VlZ/8wzM//ZZmb///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////nm5v/PPz//zDMz/9xzc/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /99gYP/MAAD/zAAA/+JwcP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+zg+f/ZwPP/s4Dm/5ZQ3P+MQNn/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9m AMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM/2YAzP9mAMz/ZgDM /2YAzP9mAMz/jEDZ/5ZQ3P+zgOb/2cDz/+zg+f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////fYGD/zAAA/8wAAP/fYGD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////cc3P/zDMz/88/P//8 8/P///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////22dn/zDMz /8wzM//ijIz///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////pkJD/zAAA/8wAAP/fYGD//PDw//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////Z wPP/2cDz/7yQ6f+zgOb/s4Dm/7OA5v+zgOb/s4Dm/7OA5v+zgOb/s4Dm/7OA5v+zgOb/s4Dm /7OA5v+zgOb/s4Dm/7yQ6f/ZwPP/2cDz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////PDw/9UwMP/MAAD/zAAA/+mQkP////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+KMjP/MMzP/zDMz//bZ2f////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////6aam/8wzM//MMzP/77+///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////77Cw/88QEP/MAAD/1TAw//ng4P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////20ND/zxAQ/8wAAP/P EBD/77Cw//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////77+//8wzM//MMzP/7LOz//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////99/f//M MzP/zz8///bZ2f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bQ0P/SICD/zAAA/88QEP/zwMD///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+mQkP/MAAD/zAAA/9IgIP/20ND///////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////22dn/zz8/ /8wzM//ff3////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ZZmb/zDMz/88/P//55ub///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////88PD/3FBQ/8wAAP/MAAD/4nBw//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////88PD/3FBQ/8wAAP/MAAD/3FBQ//zw8P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////nm5v/PPz//zDMz/9lmZv////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////88/P/0kxM /8wzM//VWVn//PPz//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+aAgP/MAAD/zAAA/9lAQP/5 4OD///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////PAwP/SICD/zAAA /8wAAP/mgID///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////PPz/9VZWf/MMzP/0kxM//zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////+ebm/88/P//MMzP/1VlZ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////20ND/zxAQ/8wAAP/PEBD/6ZCQ//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////5oCA/8wAAP/MAAD/zxAQ//bQ0P////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////1VlZ/8wzM//PPz//+ebm//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////bZ2f/M MzP/zDMz/99/f/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////PDw/9xQUP/MAAD/zAAA /9lAQP/54OD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////bQ0P/VMDD/zAAA/8wAAP/cUFD//PDw//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ff3//zDMz/8wzM//22dn///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////vv7//zDMz/8wzM//ff3////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////soKD/zxAQ/8wAAP/PEBD/6ZCQ//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////5oCA/8wAAP/M AAD/zxAQ/++wsP////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////99/f//MMzP/zDMz /++/v/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////7LOz /8wzM//MMzP/6aam//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////+eDg/9lAQP/M AAD/zAAA/9lAQP/20ND///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////++wsP/SICD/zAAA/8wAAP/cUFD//PDw//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////5pmZ/8wzM//MMzP/7LOz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+mmpv/MMzP/zDMz/+yzs/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////pkJD/zxAQ/8wAAP/MAAD/4nBw//zw8P////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////54OD/3FBQ/8wAAP/MAAD/zxAQ/++wsP////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ss7P/zDMz/8wzM//ppqb///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////m mZn/zDMz/8wzM//ss7P///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+eDg /+JwcP/MAAD/zAAA/88QEP/soKD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////PDw/+aAgP/MAAD/zAAA /8wAAP/mgID//PDw//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////+yzs//M MzP/zDMz/+aZmf////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////339//8wzM//MMzP/6aam//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////zwMD/2UBA/8wAAP/MAAD/0iAg/++wsP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////mgID/zxAQ/8wAAP/MAAD/3FBQ//bQ0P////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////6aam/8wzM//MMzP/339///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /99/f//MMzP/zDMz/+aZmf////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////+ygoP/PEBD/zAAA/8wAAP/VMDD/77Cw//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////7KCg/88QEP/MAAD/zAAA/9IgIP/vsLD///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////mmZn/zDMz/8wzM//ff3////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ijIz/zDMz/8wzM//mmZn///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88PD/5oCA/88QEP/MAAD/zAAA /9UwMP/vsLD///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////PDw/+mQkP/SICD/zAAA/8wAAP/S ICD/7KCg//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /99/f//MMzP/zDMz/+KMjP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5pmZ/8wzM//MMzP/4oyM//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////zw8P/mgID/zxAQ/8wAAP/MAAD/0iAg/+ygoP/88PD///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////ng4P/m gID/zxAQ/8wAAP/MAAD/0iAg/+mQkP/88PD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////339//8wzM//MMzP/6aam//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+mmpv/MMzP/zDMz/99/f/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PDw/+aAgP/P EBD/zAAA/8wAAP/PEBD/4nBw//PAwP/88PD///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////ng4P/vsLD/32Bg/8wAAP/MAAD/zAAA/9IgIP/pkJD//PDw//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////zz8//ff3//zDMz/8wzM//s s7P///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////ss7P/zDMz/8wzM//ZZmb///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////88PD/6ZCQ/9IgIP/MAAD/zAAA/8wAAP/PEBD/32Bg //ng4P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////zwMD/32Bg/8wAAP/MAAD/zAAA/8wAAP/VMDD/77Cw //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////PPz/9VZWf/MMzP/zz8//+yzs/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////7LOz/8wzM//MMzP/1VlZ//zz8/// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////vsLD/3FBQ/9IgIP/MAAD/zAAA/8wAAP/ZQED/7KCg//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////88PD/7KCg/9IgIP/MAAD/zAAA /8wAAP/VMDD/32Bg//PAwP////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////55ub/1VlZ/8wzM//PPz//77+///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////PMzP/PPz//zDMz/9JMTP/22dn///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////vsLD/3FBQ/8wAAP/M AAD/zAAA/88QEP/ZQED/7KCg//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////88PD/6ZCQ /9lAQP/PEBD/zAAA/8wAAP/PEBD/32Bg//bQ0P////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////bZ2f/PPz//zDMz /88/P//22dn///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////22dn/zz8//8wzM//PPz//88zM //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////ng4P/mgID/zxAQ/8wAAP/MAAD/zAAA/88QEP/ZQED/7KCg //bQ0P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////zwMD/6ZCQ/9lAQP/PEBD/zAAA/8wAAP/MAAD/0iAg/+ygoP/88PD///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////7LOz/88/P//MMzP/0kxM//nm5v////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PPz/9VZWf/MMzP/zDMz/+yzs/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //PAwP/mgID/0iAg/8wAAP/MAAD/zAAA/8wAAP/SICD/3FBQ/+ygoP/20ND///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////bQ0P/soKD/3FBQ/9IgIP/MAAD/zAAA/8wAAP/MAAD/1TAw/+ygoP/2 0ND///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////ijIz/zDMz/8wzM//ZZmb//PPz//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////zz8//cc3P/zDMz/8wzM//f f3////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////bQ0P/soKD/2UBA/88QEP/M AAD/zAAA/8wAAP/MAAD/zAAA/9lAQP/icHD/7KCg//bQ0P////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////20ND/7KCg/+JwcP/ZQED/zAAA/8wAAP/MAAD/zAAA/8wAAP/S ICD/3FBQ/++wsP/20ND///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PPz/9lmZv/M MzP/zDMz/+KMjP/88/P///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////4oyM/8wzM//MMzP/1VlZ//zz8/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////zwMD/6ZCQ/9lAQP/PEBD/zAAA/8wAAP/MAAD/zAAA /8wAAP/MAAD/2UBA/99gYP/mgID/7KCg//PAwP/54OD///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////ng4P/zwMD/7KCg/+aAgP/fYGD/1TAw/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/9IgIP/ZQED/7KCg//bQ0P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////22dn/0kxM/8wzM//MMzP/6aam//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////++/v//MMzP/zDMz /88/P//zzMz///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////+eDg/++wsP/mgID/2UBA/9IgIP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/8wAAP/ZQED/2UBA/9lAQP/ZQED/2UBA/9lAQP/ZQED/2UBA/9lAQP/ZQED/2UBA /9lAQP/ZQED/2UBA/9lAQP/ZQED/2UBA/9lAQP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/8wAAP/SICD/3FBQ/+aAgP/zwMD//PDw//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////+yzs//PPz//zDMz/88/P//zzMz///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////22dn/1VlZ/8wzM//MMzP/6aam//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////8 8PD/88DA/+aAgP/mgID/2UBA/9lAQP/PEBD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA /8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/MAAD/zAAA/8wAAP/M AAD/zAAA/88QEP/ZQED/3FBQ/+aAgP/pkJD/88DA//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////88/P/339/ /8wzM//MMzP/2WZm//zz8/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PPz/9xzc//M MzP/zDMz/9lmZv/55ub///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////zwMD/88DA//PAwP/zwMD/88DA//PAwP/zwMD/88DA//PAwP/zwMD/88DA//PAwP/z wMD/88DA//PAwP/zwMD/88DA//PAwP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////bZ2f/VWVn/zDMz/8wzM//mmZn///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////vv7//zDMz/8wzM//PPz//77+///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////6aam/8wzM//MMzP/zz8///PMzP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tnZ /9VZWf/MMzP/zDMz/+KMjP/88/P///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////zz8//Z Zmb/zDMz/8wzM//cc3P//PPz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////mmZn/zDMz/8wzM//STEz/88zM//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////77+//88/P//MMzP/zz8//+yzs/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////88zM/9JMTP/MMzP/zDMz/9xzc//88/P///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////bZ2f/VWVn/zDMz/8wzM//ZZmb/+ebm //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zz8//ijIz/zDMz/8wzM//PPz//77+/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////5pmZ /8wzM//MMzP/zz8//+mmpv////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////88zM/9JMTP/MMzP/zDMz/9lmZv/22dn///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////PMzP/STEz/zDMz/8wzM//cc3P/+ebm//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////ppqb/zz8//8wzM//M MzP/4oyM//zz8/////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////55ub/2WZm/8wzM//MMzP/0kxM//PMzP// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+ebm/9xzc//MMzP/zDMz/88/P//ppqb///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PPz/+KMjP/P Pz//zDMz/88/P//mmZn//PPz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////zzMz/1VlZ /8wzM//MMzP/0kxM/+yzs/////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////zz8//mmZn/zz8//8wzM//MMzP/339///nm5v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////+yzs//PPz//zDMz/8wzM//ZZmb/88zM//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////7LOz/9JMTP/MMzP/zDMz/9lmZv/22dn///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////5pmZ/88/P//MMzP/zDMz/9lmZv/vv7////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////+mmpv/STEz/zDMz /8wzM//ZZmb/88zM//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////zz8//mmZn/zz8//8wzM//MMzP/0kxM /+yzs/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //zz8//mmZn/zz8//8wzM//MMzP/2WZm//PMzP////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////PPz/+aZmf/STEz/zDMz/8wzM//STEz/6aam//zz8/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////55ub/4oyM/88/P//MMzP/zDMz/9lmZv/vv7////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88/P/6aam/9JMTP/M MzP/zDMz/88/P//ff3//88zM//zz8/////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////55ub/77+//9xzc//MMzP/zDMz/8wzM//f f3//88zM//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////ss7P/2WZm/8wzM//MMzP/zDMz/88/P//ff3//9tnZ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////77+//9xzc//M MzP/zDMz/8wzM//PPz//4oyM//nm5v////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bZ2f/mmZn/2WZm/8wzM//MMzP/zDMz/9VZWf/ss7P///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////PPz/+aZmf/STEz/zDMz/8wzM//PPz//4oyM/+yzs//88/P///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////nm5v/ijIz/zz8//8wzM//M MzP/zz8//+KMjP/ss7P//PPz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+ebm/+mmpv/ff3//zDMz/8wzM//MMzP/1VlZ/+yzs/////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////PPz/+yzs//VWVn/zDMz/8wzM//MMzP/zz8//99/f//ppqb//PPz //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////+ebm/+aZmf/cc3P/zDMz/8wzM//MMzP/zz8/ /99/f//22dn///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tnZ /+yzs//ZZmb/zDMz/8wzM//MMzP/zDMz/9lmZv/ijIz/+ebm//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////88zM/99/f//VWVn/zDMz /8wzM//MMzP/zz8//99/f//zzMz//PPz//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////+ebm/+aZmf/cc3P/zDMz/8wzM//M MzP/zDMz/88/P//ff3//6aam//PMzP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////zz8//zzMz/5pmZ /9xzc//MMzP/zDMz/8wzM//MMzP/zz8//+KMjP/ss7P//PPz//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////+ebm/++/v//ff3//1VlZ/8wzM//MMzP/zDMz/8wzM//PPz//2WZm /+aZmf/vv7//9tnZ//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tnZ /+yzs//ijIz/2WZm/8wzM//MMzP/zDMz/8wzM//MMzP/2WZm/+aZmf/zzMz///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //bZ2f/vv7//3HNz/9JMTP/MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//ZZmb/4oyM/+aZmf/v v7//+ebm//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////9tnZ /+yzs//mmZn/339//9VZWf/MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//VWVn/339///PMzP/8 8/P///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////88/P/88zM/+mmpv/f f3//1VlZ/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//PPz//2WZm/9xzc//mmZn/5pmZ /+yzs//zzMz/88zM//zz8/////////////////////////////////////////////////// ///////////////////////////////////////////////88/P/88zM//PMzP/ss7P/5pmZ /+aZmf/cc3P/2WZm/88/P//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/2WZm/+KMjP/s s7P/9tnZ//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////zzMz/7LOz/+KMjP/ZZmb/1VlZ /8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//M MzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz /8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/2WZm/9lmZv/m mZn/77+///bZ2f////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////88/P/88zM/++/v//mmZn/4oyM/9lmZv/Z Zmb/2WZm/88/P//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//MMzP/zDMz /8wzM//MMzP/zDMz/8wzM//MMzP/zDMz/8wzM//PPz//2WZm/9lmZv/ZZmb/5pmZ/+aZmf/z zMz/88zM//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////AA4BAAADAAAAAQFKAAABAQADAAAAAQE9AAABAgADAAAABAAGYz4BAwADAAAAAQABAAAB BgADAAAAAQACAAABEQAEAAAABAAGY1YBEgADAAAAAQABAAABFQADAAAAAQAEAAABFgADAAAA AQBjAAABFwAEAAAABAAGY0YBHAADAAAAAQABAAABUgADAAAAAQABAAABUwADAAAABAAGY2aH cwAHAAAH2AAGY24AAAAAAAgACAAIAAgAAf54AAH+eAAB/ngAAGcgAAAACAAB/oAAA/z4AAX7 cAABAAEAAQABAAAH2GFwcGwCIAAAbW50clJHQiBYWVogB9kAAgAZAAsAGgALYWNzcEFQUEwA AAAAYXBwbAAAAAAAAAAAAAAAAAAAAAAAAPbWAAEAAAAA0y1hcHBsAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALZGVzYwAAAQgAAABvZHNjbQAAAXgA AAWcY3BydAAABxQAAAA4d3RwdAAAB0wAAAAUclhZWgAAB2AAAAAUZ1hZWgAAB3QAAAAUYlhZ WgAAB4gAAAAUclRSQwAAB5wAAAAOY2hhZAAAB6wAAAAsYlRSQwAAB5wAAAAOZ1RSQwAAB5wA AAAOZGVzYwAAAAAAAAAUR2VuZXJpYyBSR0IgUHJvZmlsZQAAAAAAAAAAAAAAFEdlbmVyaWMg UkdCIFByb2ZpbGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAG1sdWMAAAAAAAAAHwAAAAxza1NLAAAAKAAAAYRkYURLAAAALgAAAaxjYUVTAAAA JAAAAdp2aVZOAAAAJAAAAf5wdEJSAAAAJgAAAiJ1a1VBAAAAKgAAAkhmckZVAAAAKAAAAnJo dUhVAAAAKAAAApp6aFRXAAAAFgAAAsJuYk5PAAAAJgAAAthjc0NaAAAAIgAAAv5oZUlMAAAA HgAAAyBpdElUAAAAKAAAAz5yb1JPAAAAJAAAA2ZkZURFAAAALAAAA4prb0tSAAAAFgAAA7Zz dlNFAAAAJgAAAth6aENOAAAAFgAAA8xqYUpQAAAAGgAAA+JlbEdSAAAAIgAAA/xwdFBPAAAA JgAABB5ubE5MAAAAKAAABERlc0VTAAAAJgAABB50aFRIAAAAJAAABGx0clRSAAAAIgAABJBm aUZJAAAAKAAABLJockhSAAAAKAAABNpwbFBMAAAALAAABQJydVJVAAAAIgAABS5hckVHAAAA JgAABVBlblVTAAAAJgAABXYAVgFhAGUAbwBiAGUAYwBuAP0AIABSAEcAQgAgAHAAcgBvAGYA aQBsAEcAZQBuAGUAcgBlAGwAIABSAEcAQgAtAGIAZQBzAGsAcgBpAHYAZQBsAHMAZQBQAGUA cgBmAGkAbAAgAFIARwBCACAAZwBlAG4A6AByAGkAYwBDHqUAdQAgAGgA7ABuAGgAIABSAEcA QgAgAEMAaAB1AG4AZwBQAGUAcgBmAGkAbAAgAFIARwBCACAARwBlAG4A6QByAGkAYwBvBBcE MAQzBDAEOwRMBD0EOAQ5ACAEPwRABD4ERAQwBDkEOwAgAFIARwBCAFAAcgBvAGYAaQBsACAA ZwDpAG4A6QByAGkAcQB1AGUAIABSAFYAQgDBAGwAdABhAGwA4QBuAG8AcwAgAFIARwBCACAA cAByAG8AZgBpAGyQGnUoACAAUgBHAEIAIIJyX2ljz4/wAEcAZQBuAGUAcgBpAHMAawAgAFIA RwBCAC0AcAByAG8AZgBpAGwATwBiAGUAYwBuAP0AIABSAEcAQgAgAHAAcgBvAGYAaQBsBeQF 6AXVBeQF2QXcACAAUgBHAEIAIAXbBdwF3AXZAFAAcgBvAGYAaQBsAG8AIABSAEcAQgAgAGcA ZQBuAGUAcgBpAGMAbwBQAHIAbwBmAGkAbAAgAFIARwBCACAAZwBlAG4AZQByAGkAYwBBAGwA bABnAGUAbQBlAGkAbgBlAHMAIABSAEcAQgAtAFAAcgBvAGYAaQBsx3y8GAAgAFIARwBCACDV BLhc0wzHfGZukBoAIABSAEcAQgAgY8+P8GWHTvZOAIIsACAAUgBHAEIAIDDXMO0w1TChMKQw 6wOTA7UDvQO5A7oDzAAgA8ADwQO/A8YDrwO7ACAAUgBHAEIAUABlAHIAZgBpAGwAIABSAEcA QgAgAGcAZQBuAOkAcgBpAGMAbwBBAGwAZwBlAG0AZQBlAG4AIABSAEcAQgAtAHAAcgBvAGYA aQBlAGwOQg4bDiMORA4fDiUOTAAgAFIARwBCACAOFw4xDkgOJw5EDhsARwBlAG4AZQBsACAA UgBHAEIAIABQAHIAbwBmAGkAbABpAFkAbABlAGkAbgBlAG4AIABSAEcAQgAtAHAAcgBvAGYA aQBpAGwAaQBHAGUAbgBlAHIAaQENAGsAaQAgAFIARwBCACAAcAByAG8AZgBpAGwAVQBuAGkA dwBlAHIAcwBhAGwAbgB5ACAAcAByAG8AZgBpAGwAIABSAEcAQgQeBDEESQQ4BDkAIAQ/BEAE PgREBDgEOwRMACAAUgBHAEIGRQZEBkEAIAYqBjkGMQZKBkEAIABSAEcAQgAgBicGRAY5BicG RQBHAGUAbgBlAHIAaQBjACAAUgBHAEIAIABQAHIAbwBmAGkAbABldGV4dAAAAABDb3B5cmln aHQgMjAwNyBBcHBsZSBJbmMuLCBhbGwgcmlnaHRzIHJlc2VydmVkLgBYWVogAAAAAAAA81IA AQAAAAEWz1hZWiAAAAAAAAB0TQAAPe4AAAPQWFlaIAAAAAAAAFp1AACscwAAFzRYWVogAAAA AAAAKBoAABWfAAC4NmN1cnYAAAAAAAAAAQHNAABzZjMyAAAAAAABDEIAAAXe///zJgAAB5IA AP2R///7ov///aMAAAPcAADAbFBLAwQKAAAAAAAAACEAIxY0cf8BAAD/AQAAFAAAAHBwdC9t ZWRpYS9pbWFnZTIucG5niVBORw0KGgoAAAANSUhEUgAAACMAAACJCAYAAACmXoHRAAAACXBI WXMAAAsTAAALEwEAmpwYAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAA AYxJREFUeNrs2NkRwjAMRVECjVBKSoFKMqkESqIEOgmTDxiye9H2cVXBmdix9NQMw3CKUudT oAIDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgyYZV2aprm1bfuK8mUe fd/fIh1TCND/nXEHzS+wK2jtb3IDbf3aLqC9d8YcdPTomYJSXmAzUGo7MAHl9CZ1UG6jVAWV dG01UOkIoQKqmWfEQbXDlShIYtITA0mNnSIgyRm4GiQ9kFeBNNJBMUgrqhSBNHNTNkg7xGWB LBJlMsgq3iaBLLP2Icg6+O+CPLYQmyCvlcgqyHM/swB5L4smoAibqx8oyhptBF2jYO5d173P QSDPCMf0g3hjJhBPzALihVmFeGA2IdaYXYgl5hBihUmCWGCSIdqYLIgmJhuihSmCaGCKIdKY KogkphoihRGBSGDEILUYUUgNRhxSilGBlGDUILkYVUgORh2SijGBpGDMIEcYU8gexhyyhXGB rGHcIHOMK+Qf4w75YkJAxvoIMAB7B7ADkx/IVQAAAABJRU5ErkJgglBLAwQKAAAAAAAAACEA ExRhP8YaAwDGGgMAFgAAAHBwdC9tZWRpYS9pbWFnZTE0LnRpZmZNTQAqAAMSIP/9///i3N7/ 5d/f//Dq6v/k39z/7+rn/+vn5P/k4N3/5OPf/+Tj3//k4+H/4+Lg/+Li4v/h4eH/4eHj/+Hh 4//m5er/5eTp/+Tj6P/j4uf/4uHm/+Hg5f/g3+T/397j/+fm6//n5uv/5uXq/+Xk6f/j4uf/ 4uHm/+Hg5f/h4OX/6ufw/+rn8P/o5e7/5uPs/+Th6v/i3+j/4d7n/+Dd5v/o5e7/6OXu/+jl 7v/o5e7/6OXu/+fk7f/n5O3/5uXt//Py+v/x8fn/8PD4/+3t9f/r6/P/6enx/+fn7//m5u7/ 6+vz/+zs9P/t7fX/7u72/+/v9//w8Pj/8fH5//Lz+P/09fr/8/T4//Lz9//w8fX/7/D0/+3u 8v/s7fH/6+zw//n6/v/4+f3/9/j8//X2+v/09fn/8vP3//Hy9v/w8fX/9vf7//X2+v/19vr/ 9PX5//P0+P/y8/f/8vP3//Hy9v/29/v/9vf7//b3+//19vr/9PX5//P0+P/z9Pj/8vP3//f4 /P/3+Pz/9vf7//X2+v/z9Pj/8vP3//Hy9v/x8vb/+/z///v8///6+///+vv///r7///5+v7/ +fr+//n6/v/19Pn/9fT5//X0+f/19Pn/9fT5//X0+f/19Pn/9fT5//v6///7+v//+/r///v6 ///7+v//+/r///v6///6/Pv/9/z2//b+8//3/PX/9/z1//f89v/3/Pb/9/z2//f89v/5+/b/ +fv2//n89f/4+/T/+fry//j58f/4+u//+Pn0//v1///79P//+/T///v1///59v//+fb9//j3 /P/4+Pj/+Pr5//b79//2+/X/9fz1//X89P/1/PT/8/30//P99f/4/f//+P3///n8///5/P// +/z///v8///8+////Pv///z5///8+f///fj///34///+9////fb+///1/v/99v7/+fj///j4 ///4+P//+Pj///j4///4+P//+Pj///j4///5+f//+fn///n5///5+f//+fn///n5///5+f// +vn///z6+//++vn//fn6//35+v/7+fz/+vj7//r4/f/6+P3/+/r///v6///7+/3/+/v9//r8 +//6/Pv/+vz7//r8+f/+//r//v/5//7/9//+//X//v/1//7/8//+//L//v/y////9P////T/ ///4////+P////v////7//////////////7////+/////v////7////+/////v////7////+ /////v////7////+/////v////7////+/////v////////39///9/f3//f39//39/f/9/f3/ /f39//39///9/f///////////////v////7////+/////v////7////////9/f///////+nj 5f9wamz/XlhY/3hycv94c3D/amVi/2hkYf9/e3j/aWhk/2loZP9paGb/aWhm/2dnZ/9nZ2f/ ZmZo/2ZmaP9lZWf/ZWVn/2RkZv9jY2X/YmJk/2BgYv9gYGL/X19h/2FhY/9hYWP/YGBi/19f Yf9dXV//XFxe/1tbXf9bW13/X11i/15cYf9dWmH/W1le/1lWXf9XVVr/VVJZ/1RSV/9RTlX/ UE5T/1BNVP9QTlP/T0xT/09NUv9OS1L/TUxR/0hJTv9HSEz/RUZL/0NESP9AQUb/Pj9D/zw9 Qv87PED/PD1C/zw9Qf88PUL/PD1B/zw9Qv88PUH/PD1C/zw9Qf88PT//Ozw+/zo7Pf84OTv/ Nzg6/zU2OP80NTf/MzQ2/zg5O/84OTv/Nzg6/zU2OP8zNDb/MjM1/zEyNP8wMTP/MDEz/zAx M/8vMDL/Li8x/y0uMP8tLjD/LC0v/ywtL/8mJyn/Jicp/yUmKP8lJij/JCUn/yMkJv8iIyX/ IiMl/ykqLP8pKiz/KCkr/ycoKv8mJyn/JSYo/yQlJ/8jJCb/KCkr/ygpK/8nKCr/Jygq/yYn Kf8mJyn/Jicp/yYnKf8wMDL/MDAy/zAwMv8wMDL/MDAy/zAwMv8wMDL/MDAy/zExM/8xMTP/ MTEz/zExM/8xMTP/MTEz/zExM/8wMjH/LTIs/y0yLP8tMiz/LTIs/y0yLv8tMi7/LTIu/y0y Lv8uMC3/LjAt/y4wLf8uMCv/Li8q/y4vKf8tLij/LS0r/zArMv8wKjb/MCo2/y4rNP8uKzL/ LSwx/y0tL/8sLi3/LS8u/yswLP8qMCz/KjAs/yowLP8qMCz/KDEs/ygxLv8wNjb/MDY2/zE1 OP8xNTb/MzQ4/zM0Nv80Mzj/NDQ2/zo4Pf85Nzr/OzY8/zs2Ov87NDv/OzU5/z0zO/86Mzr/ NjU6/zU2Ov81Njv/NTY6/zU2O/81Njr/NTY7/zU2Ov82Nzz/Njc7/zY3PP82Nzv/Njc8/zY3 O/82Nzz/NzY7/zk3OP87Nzb/Ozc4/zs3OP84Njn/ODY5/zg2O/83NTr/ODc8/zg3PP84ODr/ ODg6/zc4Ov83OTj/Nzk4/zc5OP84ODb/ODk0/zg5NP84OTP/ODkx/zg6L/84Oi//ODov/0BC N/9AQTn/QEE7/0BBPP9AQD7/QEBA/0BAQv9AQEL/QEBC/0BAQv9AQEL/QEBC/0BAQv9AQEL/ QEBC/0BAQv9GRkj/RkZI/0ZGSP9GRkj/RkZI/0ZGSP9GRkj/RkZI/01NTf9NTU3/TU1N/01N Tf9NTU3/TU1N/01NT/9NTU//VFRW/1RUVv9UU1j/VFNY/1RTWP9UU1j/VFNY/1RUVv9WVlj/ f39///z29v+Nh4f/sKqq/8K8vP/Bvbz/tbGw/66qqf+3s7L/ubi2/7m4tv+3t7f/t7e3/7e3 uf+2trj/trW6/7a2uP+0tLL/s7Sv/7Kzrv+xsq3/sLGs/6+wq/+ur6r/rq+q/6qrpv+pqqX/ qKmk/6eoo/+mp6L/paah/6SloP+jo6H/oKCe/5+fnf+enp7/nJya/5qamv+YmJb/lpaW/5aW lP+Kior/ioqI/4mJif+IiIb/h4eH/4aGhP+FhYX/hYWD/3N1dP9ydHH/cHJx/25wbf9rbWz/ aWto/2dpaP9maGX/YmRj/2FjYP9gYmH/XmBd/11fXv9bXVr/Wlxb/1lbWP9SVFH/UlRP/1BS Tf9PUUz/TU9K/0xOSf9LTUj/SkxH/0RGQf9DRUD/QkQ//0BCPf8/QTz/PT86/zw+Of87PTj/ NTcy/zU3Mv80NjH/NDYx/zM1MP8yNC//MTMu/zEzLv8yNC//MTMu/zEzLv8wMi3/LzEs/y4w K/8uMCv/LjAr/ystKP8qLCf/KSsm/ygqJf8nKST/Jigj/yUnIv8kJiH/IyUg/yMlIP8iJB// IiQf/yIkH/8hIx7/ISMe/yEjHv8ZGhX/GRoV/xkaFf8ZGhX/GRoV/xkaFf8ZGhX/GRoV/xQV EP8UFRD/FBUQ/xQVEP8UFRD/FBUQ/xQVEP8UFBL/ERMS/xESFP8REhT/ERIU/xESFv8REhb/ ERIW/xESFv8SERb/ERET/xERE/8RERH/EBAQ/xAQEP8QEBD/Dw8P/xINEf8SDRH/EA4R/xAO Ef8QDg//Dw8P/w8PD/8OEA//DxEQ/w0REv8MEhL/DBEU/wwRFP8MERT/ChIV/woSFP8IDgz/ CQ4I/wkOCv8JDgj/Cw0K/wsNCP8MDAr/DA0I/w0MCv8NDAj/DwsK/w8LCP8OCgn/DgoH/w4I CP8NCQj/CgoI/wkLCP8JCwr/CQsI/wkLCv8JCwj/CQsK/wkLCP8KDAv/CgwJ/woMC/8KDAn/ CgwL/woMCf8KDAv/CwsL/w0LDP8NCwz/DQsM/wwKC/8MCg3/CwkM/woJDv8KCQ7/DAsQ/wwL EP8MCxD/DAsQ/wsMEP8LDA7/CwwO/wsMDv8JCA3/CQgN/wkIDf8JCQv/CQkJ/wkJB/8JCQf/ CQoF/wABAP8AAAD/AAAA/wAAAv8AAAT/AAAF/wAAB/8AAAX/AAAA/wABAP8AAQD/AAEA/wAB AP8AAQD/AAEA/wABAP8BAgD/AQIA/wECAP8BAgD/AQIA/wECAP8BAgD/AQEA/wEBAf8BAQP/ AQED/wEBA/8BAQP/AQED/wEBA/8BAQP/AQED/wEBA/8BAQP/AQED/wEABf8BAAX/AQAF/wEB A/8AAAL/SEhI/+fh4f+KhIT/z8nJ/7q0tP+wrKv/ubW0/7y4t/+2srH/r66s/66srf+tra3/ ra2t/6ysrv+srK7/rKuw/6urrf+trav/ra6p/6ytqP+rrKf/qqum/6ippP+oqaT/p6ij/6Gi nf+hop3/oKGc/5+gm/+en5r/nZ6Z/5ydmP+bnJf/lpaU/5WVk/+Tk5H/kpKQ/4+Pjf+Ojoz/ jIyK/4uLif+CgoD/goKA/4CAfv9/f33/fX17/3x8ev96enj/eXt4/3d5dv92eHX/dHZz/3J0 cf9wcm//bW9s/2xua/9rbWr/Zmhl/2RmY/9iZGH/X2Fe/1xeW/9YWlf/VlhV/1VXVP9SVE// UlRP/1BSTf9PUUz/TU9K/0xOSf9KTEf/SkxH/0dJRP9GSEP/RUdC/0RGQf9CRD//QEI9/z9B PP8/QTz/Nzk0/zY4M/82ODP/NTcy/zQ2Mf80NjH/MzUw/zM1MP8zNTD/MzUw/zI0L/8xMy7/ MDIt/zAyLf8vMSz/LzEs/y0vKv8tLyr/LC4p/ystKP8qLCf/KSsm/ygqJf8nKST/JCYh/yQm If8kJiH/IyUg/yMlIP8iJB//IiQf/yIkH/8lJiH/JSYh/yUmIf8lJiH/JSYh/yUmIf8lJiH/ JSYh/x8gG/8fIBv/HyAb/x8gG/8fIBv/HyAb/x8gG/8fHx3/HB0h/xwdIv8cHSL/HB0i/xwc JP8cHCT/HBwk/xwcJP8cGyP/HBsj/xsaIP8bGiD/Gxof/xoZHv8aGR7/Ghoc/xsaGP8bGhb/ GxoW/xobFv8aGxb/GhoY/xkbGv8ZGxr/Fxsc/xcbHv8WGx//Fhsh/xYbIf8WGiP/FBsl/xYb If8WGhn/FhsV/xYbFf8WGxX/GBoV/xgaFf8ZGhX/GRoV/xgXE/8YFxP/GRUS/xkVEv8YFBH/ GBQR/xgUEf8YFBH/FRUT/xQWE/8UFhP/FBYT/xQWE/8UFhP/FBYT/xQWE/8UFhP/FBYT/xQW E/8UFhP/FBYT/xQWE/8UFhP/FBYT/xYWFv8XFRb/FhQV/xYUFf8WFBf/FRMW/xQUFv8UExj/ FRQZ/xUUGf8VFBn/FRQZ/xQVGf8UFRn/FBUZ/xQVGf8TERz/ExEc/xMRHP8TEhr/ExIY/xMS F/8TEhf/ExMV/xcXGf8XFhv/FxYc/xcWHv8XFSD/FxUi/xcVI/8XFSD/FxcX/xcYE/8XGBP/ FxgT/xcYE/8XGBP/FxgT/xcYE/8VFhH/FRYR/xUWEf8VFhH/FRYR/xUWEf8VFhH/FRUT/xQU FP8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/Dw8R/w8PEf8PDxH/Dw8R/w8OE/8PDhP/ Dw4T/w8PEf8AAAD/UVFR///7+P+CfXr/wb28/7GtrP+xraz/trKx/7Sys/+wrq//srCx/7Gv sv+wsLL/sLCy/66vsf+ur7H/rq+z/62usv+vr7H/rq6w/66usP+srK7/q6ut/6qqrP+pqav/ qamr/6Wlp/+lpaf/pKSm/6Ojpf+hoaP/oKCi/5+fof+fn6H/mpyb/5mbmv+Ympn/lpiX/5SW lf+SlJP/kJKR/5CSkf+KjIv/iYuK/4eJiP+Fh4b/goSD/4CCgf9+gH//fX9+/3J0c/9vc3L/ bXFw/2tvbv9pbWz/Zmpp/2RoZ/9kaGf/YWVk/19jYv9cYF//WV1c/1VZWP9RVVT/TlJR/01R UP9TV1j/UlZX/1FVVv9QVFX/TlJT/0xQUf9LT1D/S09Q/0NHSP9DR0j/QUVG/0BERf8+QkP/ PUFC/zxAQf87P0D/NTk6/zU5Ov80ODn/Mzc4/zM3OP8yNjf/MTU2/zE1Nv8wNDX/MDQ1/y8z NP8vMzT/LjIz/y0xMv8sMDH/LDAx/yktLv8pLS7/KCwt/ycrLP8mKiv/JCgp/yQoKf8jJyj/ IiYn/yImJ/8iJif/ISUm/yElJv8gJCX/ICQl/yIjJf8hISP/ISEj/yEhI/8hISP/ISEj/yEh I/8hISP/ISEj/x0dH/8dHR//HR0f/x0dH/8dHR//HR0f/x0dH/8dHCH/Gxoi/xsZJP8bGST/ Gxkk/xsZJP8bGST/Gxkk/xsZJP8ZFyL/GRci/xkXIv8YFiH/GBYh/xcVIP8XFSD/FxYb/xcY E/8XGQ7/FxgQ/xcYEP8XGBL/FhgT/xYYFf8WFxn/FBgb/xQXHP8TGB7/Excg/xMXIv8TFyL/ Excj/xMXIP8SFhf/EhcT/xIXE/8SFxP/FBYT/xQWE/8UFhP/FBYT/xkZF/8ZGRf/GhkX/xkY Fv8ZGBb/GBcV/xgXFf8YFxX/FhgX/xQYF/8UGBf/FBgX/xQYF/8UGBf/FBgX/xQYF/8UGBf/ FBgX/xQYF/8UGBf/FBgX/xQYF/8UGBf/FhgX/xgYGP8YGBj/FxcX/xcXF/8WFhb/FhYW/xYW Fv8WFhj/FhYY/xYWGP8WFRr/FhUa/xYVG/8WFRv/FhUb/xYVHf8YFiT/GBUm/xgVJv8YFiT/ GBYj/xgWIf8YFx//GBcf/xEQGP8REBj/EQ8a/xEPHP8RDx3/EQ4f/xEOIf8RDx3/ERAW/xER E/8RERP/ERET/xERE/8RERP/ERET/xERE/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/ FRUX/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQU Fv8UFBb/FBQW/xQUFv8JCQn/SEhI//r18v9/enf/vbm4/7q2tf/AvLv/wLy7/7i2t/+urK3/ tLK1/7Oztf+ysrT/srK0/7Cxs/+wsbP/sLGz/7Cxtf+qqa//qqmx/6mosP+op6//p6au/6al rf+lpKz/pKOr/6Khqf+ioan/oaCo/6Cfp/+fnqb/np2l/52cpP+bnKH/mZqf/5iZnf+Wl5v/ lJWZ/5KTl/+QkZX/j5CU/46Pk/+HiIz/hoeL/4SFif+Bgob/fn+D/3t8gP95en7/eHl9/3Z6 ff91eXz/dHh7/3F1eP9vc3b/bHBz/2tvcv9qbnH/aW1w/2drbv9kaGv/YWVo/11hZP9aXmH/ V1te/1ZZXv9VWF3/VFde/1NWXf9RVFv/UFNa/05RWP9NUFf/TE9W/0VIT/9FSE//Q0ZN/0JF TP9AQ0r/P0JJ/z5BSP89QEf/OTxD/zk8Q/84O0L/NzpB/zY5QP82OUD/NTg//zU4P/8zNj3/ MjU8/zI1PP8xNDv/MDM6/y8yOf8vMjn/LzI5/ycqMf8nKjH/Jikw/yUoL/8kJy7/IyYt/yIl LP8hJCv/IiUs/yIlLP8hJCv/ISQr/yEkK/8gIyr/ICMq/yAjKv8hISn/IiEp/yIhKf8iISn/ IiEp/yIhKf8iISn/IiEp/yEgKP8hICj/ISAo/yEgKP8hICj/ISAo/yEgKP8hICj/Hhwn/x4c J/8eHCf/Hhwn/x4cJ/8eHCf/Hhwn/x4cJ/8cGiX/HBol/xsZJP8bGST/Gxkm/xoYJf8aGCX/ Ghkh/xobFv8ZHBP/GhsT/xkcFf8ZGxb/GRsY/xkbGv8ZGhz/Fhod/xYZHv8VGiD/FRki/xUZ Iv8VGST/FRkk/xUZIv8RFBn/ERUW/xEVGP8RFRb/ExQY/xMUFv8TFBj/ExQW/xUUGf8VFRf/ FRQZ/xYUF/8VExj/FRMW/xQSF/8TEhf/EhMX/xAUF/8QFBf/EBQX/xAUF/8QFBf/EBQX/xAU F/8QFBf/EBQX/xAUF/8QFBf/EBQX/xAUF/8QFBf/EBQV/xMVFP8SFBH/ExMR/xIUEf8SEhD/ EhIQ/xISEP8SEhD/EhIS/xISFP8SEhT/EhEW/xIRFv8SERf/EhEX/xIQG/8VEiP/FRIl/xUS Jf8VEiP/FRMh/xUTIP8VEx7/FRQc/xQTG/8UExv/FBId/xQSH/8UEiD/FBEi/xQRJP8UEiD/ FBId/xQTG/8UExv/FBMb/xQTG/8UExv/FBMb/xQTG/8VFBz/FRQc/xUUHP8VFBz/FRQc/xUU HP8VFBz/FRQa/xQUFv8UFBT/FBQU/xQUFP8UFBb/FBQW/xQUFv8UFBb/EhIU/xISFP8SEhT/ EhIU/xISFP8SEhT/EhIU/xISFP8VFRX/QkJC//n18v+Tj4z/w7++/7ezsv+xr7D/trS1/7q4 u/+0srX/urq8/7m5u/+5ubn/uLq5/7e5uP+3ubb/t7m2/7e4uv+vr7n/r668/66tu/+trLr/ rKu5/6uquP+qqbf/qai2/6als/+mpbP/paSy/6Sjsf+jorD/oaCu/6Ggrv+gn63/nJym/5mc pf+Ym6T/lpmi/5SXoP+SlZ7/kJOc/5CTnP+KjZb/iYyV/4eKk/+Dho//gIOM/3x/iP96fYb/ eHuE/3Z5gv91eIH/c3Z//3F0ff9ucXr/bG94/2ptdv9pbHX/Zmly/2Vocf9jZm//YGNs/11g af9bXmf/WVxl/1hbZP9OUF3/TlBd/0xOW/9LTVr/SUtY/0hKV/9HSVb/RkhV/0tNWv9LTVr/ SUtY/0hKV/9GSFX/RUdU/0RGU/9DRVL/PkBN/z0/TP89P0z/PD5L/zs9Sv87PUr/OjxJ/zo8 Sf8wMj//MDI//y8xPv8uMD3/LjA9/y0vPP8sLjv/LC47/y0vPP8tLzz/LC47/yosOf8pKzj/ KCo3/ycpNv8nKTb/Jig1/yYoNf8mKDX/JSc0/yUnNP8lJzT/JCYz/yQmM/8hIC7/ISAu/yEg Lv8hIC7/ISAu/yEgLv8hIC7/ISAu/x4dK/8eHSv/Hh0r/x4dK/8eHSv/Hh0r/x4dK/8fHSr/ HRoj/x0aIf8dGyD/HRsg/x0bIP8dGyD/HRsg/x0bIP8aGR//Ghkf/xkYIP8ZGCD/GRci/xgW I/8XFyP/Fxch/xcYGv8VGhb/FxkW/xUZGP8VGRj/FRka/xUZHP8VGRz/FBcc/xQXHP8TGBz/ Exgc/xMYHP8TGBv/Exgb/xMYHP8XGiH/Fxoh/xkZI/8ZGSH/GRkj/xkZIf8ZGSP/GRkh/xcX If8XFx//FhYg/xcWHv8XFSD/FhUd/xYUH/8WFB//FRUf/xMWH/8TFh//ExYf/xMWH/8TFh// ExYf/xMWH/8SFR7/EhUe/xIVHv8SFR7/EhUe/xIVHv8SFR7/EhUa/xMXFv8SFxH/FBYR/xIX Ef8TFg//ExYP/xMWD/8TFg//ExUQ/xMVEv8UFBT/FBQW/xQTGP8UExj/FBMZ/xQTG/8TEiD/ ExIg/xMSIP8TEx//ExMd/xMTG/8TFBn/ExQZ/xQVGf8UFRn/FBUa/xQUHP8UFB7/FBQe/xQU IP8UFCD/FBMh/xQTIf8UEyH/FBMh/xQTIf8UEyH/FBMh/xQTIf8QDx3/EA8d/xAPHf8QDx3/ EA8d/xAPHf8QDx3/EBAa/xUWGP8VFxT/FRcU/xUXFP8VFxb/FRcW/xUXFv8VFxb/ERMS/xET Ev8REhT/ERIU/xESFP8REhT/ERIU/xESFP8XFxf/Pz8//+rm4/+FgX7/tLCv/8XBwP/DwcL/ ube4/7e1uP+3t7n/tbW3/7W1tf+ztbT/s7Wy/7K0r/+yta7/srWu/7K0sf+vsLX/r6+7/66u uv+trbn/q6u3/6qqtv+pqbX/qam1/6SksP+jo6//o6Ov/6Ghrf+goKz/n5+r/56eqv+cn6j/ lZif/5SXnP+Tlpv/kZSZ/4+Sl/+NkJX/jI+U/4uOk/+LjpP/iYyR/4eKj/+Dhov/f4KH/3x/ hP95fIH/d3p//3V4ff90d3z/cnV6/3BzeP9tcHX/a25z/2lscf9oa3D/Y2Zr/2Jlav9gY2j/ XmFm/1xfZP9aXWL/WFtg/1daYf9VWGH/VFZi/1NVYf9SVGD/UFJe/05QXP9NT1v/TU9b/0dJ Vf9GSFT/RUdT/0RGUv9CRFD/QEJO/z9BTf8/QU3/NzlF/zc5Rf82OET/NjhE/zU3Q/80NkL/ MzVB/zM1Qf8zNUH/MzVB/zI0QP8yNED/MTM//zAyPv8vMT3/LzE9/y0vO/8sLjr/Ky05/yos OP8pKzf/KCo2/ycpNf8mKDT/JCYy/yQmMv8jJTH/IyUx/yMlMf8iJDD/IiQw/yIkMP8jIy// IyMv/yMjL/8jIy//IyMv/yMjL/8jIy//IyMv/x8fK/8fHyv/Hx8r/x8fK/8fHyv/Hx8r/x8f K/8fHyf/HRse/x8bGv8dHBj/HRwY/x0cF/8dHBf/HRwY/xwcGv8aGhj/Ghoa/xkZG/8YGR3/ Fxcf/xcXIf8XFyP/FRcj/xUYH/8VGB3/FRgf/xUYH/8VGB//FRgf/xUYH/8VGB//ExYb/xMX Gv8SGBj/EhgW/xIZEv8SGRH/EhoP/xIZEv8UGBn/FBcc/xYXHP8WFxz/Fhcc/xYXHP8WFxz/ Fhcc/xkaH/8ZGh//GBke/xgZHv8XGB3/Fxgd/xgXHf8XGB3/FRgd/xUYHf8VGB3/FRgd/xUY Hf8VGB3/FRgd/xUYHf8TFhv/ExYb/xMWG/8TFhv/ExYb/xMWG/8TFhv/ExcY/xQZE/8TGxD/ FBoQ/xQaDv8TGQ3/ExkL/xQYCv8UFwz/FBcO/xQXEP8VFhH/FRUT/xUVFf8VFRf/FRQZ/xUU Gv8RERn/EREZ/xERGf8REhf/ERIW/xESFP8RExL/ERMQ/xMVEv8TFRD/ExUS/xMVEv8TFRT/ ExQW/xMUGP8TFBn/ExMd/xMTH/8TEx//ExMf/xMTH/8TEx//ExMf/xMTH/8VFSH/FRUh/xUV If8VFSH/FRUh/xUVIf8VFSH/FRYb/w8RDv8PEgv/DxIL/w8RDP8PEQz/DxEM/w8RDv8PEQ7/ EhQR/xIUE/8SFBP/EhMV/xITFf8SExX/EhMV/xITFf8NDQ3/Ojo6/+fm4v+NjIj/urm3/7m4 tv+1s7T/t7W4/7a2uP+0tLb/sbGx/7S2tf+7vbj/r7Kr/7S6rv+wtqj/s7qq/6mvof+rsKr/ q7Cs/6uwrP+rsKz/q7Cs/6uwrP+rsKz/q7Cs/6esqP+mq6f/pKml/6Kno/+fpKD/naKe/5ug nP+an5v/kZaQ/5CXj/+Plo7/j5aO/4+Wjv+OlY3/jpWN/46Vjf9/hn7/f4Z+/3+Gfv9+hX3/ foV9/32EfP99hHz/fYR8/292bv9udW3/bnVt/251bf9tdGz/bXRs/210bP9sc2v/XmVd/15l Xf9dZFz/XWRc/1xjW/9cY1v/XGNb/1xjXP9MUk7/TFJO/0tRTf9LUU3/S1FN/0pQTP9KUEz/ SlBM/z9FQf8/RUH/P0VB/z9FQf8+RED/PkRA/z1DP/89Qz//NDo2/zQ6Nv80Ojb/NDo2/zQ6 Nv80Ojb/NDo2/zQ6Nv8qMCz/KjAs/ykvK/8pLyv/KS8r/yguKv8oLir/KC4q/yMpJf8jKSX/ Iykl/yMpJf8jKSX/Iykl/yMpJf8jKSX/HSMf/x0jH/8dIx//HSMf/x0jH/8dIx//HSMf/x0j H/8YHRn/GB0Z/xgdGf8YHRn/GB0Z/xgdGf8YHRn/GB0Z/xYbF/8WGxf/FhsX/xYbF/8WGxf/ FhsX/xYbF/8YGhX/FxcN/xcYCv8XGAj/FxgI/xYZCP8WGQj/FhgK/xYYCv8SFAn/FBcO/xcZ FP8TFxb/ERUY/xIVGv8XGiP/HCAr/xUYJ/8PEiP/DhEi/xIVJv8TFiX/DxMf/xAUIP8WGiP/ DxQY/xIYGP8MEQv/CA4C/wwTA/8JEQD/CxMA/xkhCv8PEgf/EBMM/xIVDv8TFg//FBcQ/xUY Ef8UFxD/FBcQ/w4TDP8OEwz/DhMM/w4TDP8OEwz/DhMM/xATDP8OEwz/DBEK/wsSCv8KEQn/ ChEJ/woRCf8JEAj/CRAI/wkQCP8JEAj/CRAI/wkQCP8KEQn/ChEJ/woRCf8LEgr/CxMI/w0V Bv8LFgX/DRYF/wwVAv8MFQL/CxQA/wwUAP8MFAD/FBgH/xEVBv8NDwT/CgsD/woLBv8LCwn/ DgwN/w0NDf8HCQj/Cg8L/xAVD/8QFQ7/DRMJ/wsRBf8NEwX/DxYG/wwTA/8MEwP/DBMD/wwT A/8MEgT/DBIE/wwSBv8MEgj/Cg8J/woPC/8KDwv/Cg8L/woPC/8KDwv/Cg8L/woPC/8KDwv/ Cg8L/wkOCv8JDgr/CQ4K/wgNCf8IDQn/CA0H/w0TB/8JDwH/DhQG/wwSBv8OFAj/AAYA/w4T DP8PFA3/DBEL/w4TD/8RFRT/ExcY/xMXGP8SFhn/EBQX/xARE/8NDQ3/Pz8//+jn4/+NjIj/ u7q4/7q4uf+1s7b/tra4/7e3uf+0tLT/tbe2/7e5tP+6vbT/rLCi/7C3pf+stJ3/sbmh/6iw mP+utp//rraf/662n/+utp//rraf/662n/+utp//rraf/6mxmv+osJn/p6+Y/6Sslf+iqpP/ oKiR/56mj/+dpY7/lqCH/5WfhP+Vn4b/lZ+E/5Sehf+UnoP/lJ6F/5Odgv+Mln3/jJZ7/4yW ff+Mlnv/i5V8/4uVev+KlHv/ipR5/32Hbv99h2z/fIZt/3yGa/97hWz/e4Vq/3uFbP97hWr/ a3Vc/2t1Wv9rdVz/anRZ/2p0W/9pc1j/aXNa/2lzWv9ha1P/YWtT/2BqUv9galL/X2lR/19p Uf9faVH/X2lR/1dhSf9XYUn/VmBI/1ZgSP9WYEj/VV9H/1VfR/9VX0f/UVtD/1FbQ/9RW0P/ UVtD/1FbQ/9RW0P/UVtD/1FbQ/9KVDz/SVM7/0lTO/9JUzv/SFI6/0hSOv9IUjr/SFI6/0ZQ OP9GUDj/RlA4/0ZQOP9GUDj/RlA4/0ZQOP9GUDj/Q001/0NNNf9DTTX/Q001/0NNNf9DTTX/ Q001/0NNNf9BSTL/QUky/0FJMv9BSTL/QUky/0FJMv9BSTL/QUky/z9HMP8/RzD/P0cw/z9H MP8/RzD/P0cw/z9HMP9BRi//QEQr/0FEKf9BRCn/QEUn/0BFJ/8/RSn/P0Up/z9ELf9ARTH/ PUQ0/zc/NP8tNC3/Hygn/xcfIv8XHib/GR8r/xwhN/8VGTL/FBYv/xcZMv8YGjH/FRgr/xkc Lf8hJTD/ICUp/y0zMf80OjD/OUAu/0BJLv88RiT/OEId/0BKJ/84PiL/OD0m/zg9Jv85Pif/ OT4n/zg9Jv84PSb/Nj4m/zc/J/83Pyf/Nz8n/zc/J/83Pyf/NkAn/zc/J/82QCf/NkAn/zZA Jf82QCf/NT8k/zU/Jv80PiP/ND4l/zQ+I/80PiX/ND4j/zQ+Jf81PyT/NT8m/zZAJf82QCf/ NkAn/zI+Jv8yPib/Mj8l/zE+JP8zPSL/Mz4g/zM8H/8zPB//OD4k/zk+KP84Oyj/NDYo/zI0 Kf85OjT/SUhE/1RVUP9RVEn/RUs9/zlAMP8zOij/Mjol/zM7JP8zOyP/MTof/zU+If81PiH/ NT4h/zU+If81PiP/NT4j/zU9Jf81PSX/NT0m/zU9Jv81PSb/NT0m/zU9Jv81PSb/NT0m/zU9 Jv85QSr/OUEq/zhAKf84QCn/OEAp/zc/KP83Pyj/Nz8o/zlBKv84QCn/PUUw/zhAK/86QS// Nj0t/zk/Mf8XHRH/DBEK/w4TDf8RFhL/ExcW/xMXGP8SFhn/EBQX/w4SFf8NDQ//Pz8//+jn 5f+OjYv/u7m6/7q4uf+0tLb/t7e5/7e3t/+ztbT/srSv/6+yqf+ssqT/maGM/52mi/+ao4T/ oa2J/5qmfv+apXr/mqZ4/5qmeP+apnj/mqZ4/5qmeP+apnj/mqZ4/56qfP+eqnz/nKh6/5un ef+ZpXf/l6N1/5aidP+VoXH/nKp5/5qrd/+ZqXj/map2/5mpeP+YqXX/mKh3/5ipdf+aqnn/ mqt3/5mpeP+Zqnb/mal4/5ipdf+YqHf/mKl1/56se/+erHn/nqx7/52reP+dq3r/nat4/5yq ef+cqnf/pLKB/6Syf/+ksoH/o7F+/6OxgP+isH3/orB//6Kwf/+jsYD/o7CC/6Kvgf+ir4H/ oa6A/6GugP+hroD/oa6A/52qfP+dqnz/nap8/5ype/+cqXv/nKl7/5uoev+bqHr/nap8/52q fP+dqnz/nap8/52qfP+dqnz/nap8/52qfP+grX//oK1//6Ctf/+frH7/n6x+/5+sfv+eq33/ nqt9/6Ctf/+grX//oK1//6Ctf/+grX//oK1//6Ctf/+grX//n6x+/5+sfv+frH7/n6x+/5+s fv+frH7/n6x+/5+sfv+hrX//oa1//6Gtf/+hrX//oa1//6Gtf/+hrX//oa1//5+rff+fq33/ n6t9/5+rff+fq33/n6t9/5+rff+hqn3/oah//6Gof/+hqH//oKh//6Cof/+eqYH/nqiD/52o hv+VoIL/jpqC/4GOff9uenD/WGRg/0pVV/9ET1X/Q0xb/zA2UP8nLEr/IiVE/yQoRf8lKUT/ JSlC/ywxRP82PEj/YWZq/3d9ef+Jj4H/lJyF/56niP+cp3//l6N1/5yoeP+bpHX/m6N0/5qj dP+ZonP/mKFy/5ihcv+WonL/l6Nz/5ikdP+XpXT/l6V0/5eldP+XpXT/laV0/5eldP+XpXT/ mad2/5mndP+Zp3b/mKZz/5imdf+YpnP/l6V0/5elcv+XpXT/l6Vy/5imdf+YpnP/mKZ1/5mn dP+Zp3b/l6d6/5urhv+bqon/m6uH/5qqhv+bqYX/m6qD/5yogv+cqIL/mqSB/6Cnhv+gpIn/ l5uE/46Pf/+Pj4P/nZ2V/6qsn/+6v6v/rrec/6Krjv+bpIX/mqSC/5qkgf+Yon3/lqF5/5Sf df+Un3X/lJ91/5Sfdf+Un3f/lJ93/5Sfd/+Un3X/lqF2/5aidP+WonT/lqJ0/5aidP+WonT/ lqJ0/5aidP+Tn3H/k59x/5Ofcf+SnnD/kp5w/5Gdb/+RnW//kZxx/5Cad/+Qmnj/lp+A/4+Y e/+QmX7/lp6H/5GZhP9HTj7/DBIG/w4TDP8RFhD/ExcW/xMXGP8SFhn/EBMY/w4RFv8NDQ// Pz8//+jn5f+OjYv/u7m6/7q4uf+0tLb/t7e5/7a4t/+0trP/vcC5/7e7rf+vt6L/mKGG/5qk gf+ZpHz/oq+D/52reP+Ypmv/mKZo/5imaP+Ypmj/mKZo/5imaP+Ypmj/mKZo/5+tb/+frW// nqxu/52rbf+cqmz/m6lr/5qoav+YqGn/nK9v/5yvb/+cr2//m65u/5uubv+arW3/mq1t/5qt bf+gs3P/oLNz/6Czc/+fsnL/n7Jy/5+ycv+esXH/nrFx/6Cwcf+gsHH/oLBx/5+vcP+fr3D/ nq5v/56ub/+erm//nKxt/5ysbf+crG3/nKxt/5urbP+bq2z/mqpr/5qqa/+fr3D/n69w/5+v cP+fr3D/nq5v/56ub/+erm//na1u/56ub/+erm//na1u/52tbv+drW7/nKxt/5ysbf+crG3/ n69w/5+vcP+fr3D/n69w/5+vcP+fr3D/n69w/5+vcP+bq2z/m6ts/5urbP+bq2z/mqpr/5qq a/+aqmv/malq/5urbP+bq2z/m6ts/5urbP+bq2z/m6ts/5urbP+bq2z/nKxt/5ysbf+crG3/ nKxt/5ysbf+crG3/nKxt/5ysbf+dq23/natt/52rbf+dq23/natt/52rbf+dq23/natt/52r bf+dq23/natt/52rbf+dq23/natt/52rbf+dq3D/nadz/52ndf+dp3X/m6d1/5und/+ap3n/ mqd7/5infv+ToX7/i5l//3uJeP9icmj/SlhY/zhHTP8yQEv/Mj1P/ysyTv8iJ0f/Gh89/xsg Pv8eIj//ICQ9/yovQ/82PEr/VFlf/3F3c/+GjH7/kJiA/5ulg/+dqH7/m6d3/6OteP+ep27/ nKZq/5qlaf+ZpGj/maRo/5umav+bqWz/nKpt/5WlZ/+VpWf/laVn/5OlZ/+TpWf/k6Vn/5Ol Z/+Tpmb/malq/5mpav+YqGn/mKhp/5ioaf+Xp2j/l6do/5enaP+Xp2j/l6do/5enaP+YqGn/ mKhp/5ioaf+ZqWr/l6lv/5Gjc/+Qonj/kaJ2/5ChdP+RoXL/kKBv/5Kgb/+SoG//jJhq/5Cb cf+SmHT/h4xu/3h6ZP9ub13/bm9h/3F0Yf+Ahmr/hpBt/5Cadf+Un3f/kZxy/4yXbP+Klmb/ ipZk/5Gda/+Rnmn/kZ5p/5Geaf+RnWv/kZ1r/5Gda/+Rnmn/lKJn/5SiZP+UomT/lKJk/5Si ZP+UomT/lKJk/5SiZP+Vo2X/laNl/5SiZP+UomT/lKJk/5OhY/+ToWP/k6Bo/5Kebv+PmnD/ lqF5/5OdeP+OmHX/l6CB/5efh/87Qy7/DBMD/w4UCv8RFhD/ExcW/xMXGP8SFRr/EBMa/w4R Fv8MDQ//Pz8//+jo6P+Ojo7/u7u9/7q6vP+1tbf/uLi6/7e5uP+0trH/wMa6/7nArv+xup// mKJ//5mmev+YpnP/orF6/56ucP+er2v/nq9p/56vaf+er2n/nq9p/56vaf+er2n/nq9p/5yt Z/+crWf/nK1n/5usZv+brGb/mqtl/5qrZf+aq2X/mq5n/5mvZ/+Zr2f/ma9n/5iuZv+Yrmb/ l61l/5etZf+ds2v/nLJq/5yyav+csmr/m7Fp/5uxaf+bsWn/mrBo/5SoYf+UqGH/lKhh/5So Yf+Tp2D/k6dg/5OnYP+Spl//mq5n/5quZ/+armf/ma1m/5mtZv+ZrWb/mKxl/5isZf+csGn/ nLBp/5ywaf+br2j/m69o/5uvaP+armf/mq5n/52xav+dsWr/nbFq/5ywaf+csGn/m69o/5uv aP+br2j/m69o/5uvaP+br2j/m69o/5uvaP+br2j/m69o/5uvaP+armf/mq5n/5quZ/+ZrWb/ ma1m/5isZf+YrGX/mKxl/5erZP+Xq2T/l6tk/5erZP+Xq2T/l6tk/5erZP+Xq2T/ma1m/5mt Zv+ZrWb/ma1m/5mtZv+ZrWb/ma1m/5mtZv+YqWP/mKlj/5ipY/+YqWP/mKlj/5ipY/+YqWP/ mKlj/5mqZP+ZqmT/mapk/5mqZP+ZqmT/mapk/5mqZP+aqWb/mads/5mmbv+Zpm7/mKdw/5im cf+Wp3P/lad3/5Snev+On3v/hJZ8/3GDc/9VaGL/O01P/yk6RP8hMkL/IjFG/x8pQv8XHjj/ EBcx/xEYMv8VGzX/GB42/yMoPP8vNUP/SU5U/21zcf+IjoT/kpqF/5yliP+dp4L/nKV6/56o dP+dp2v/m6Zk/5ijYf+WoV//laFf/5ikYv+ZqGX/nKto/5KjX/+So1//kKRf/5CkX/+QpF// j6Rf/4+kX/+PpF//lKhj/5SoYf+UqGH/k6dg/5OnYP+Tp2D/kqZf/5KmX/+Spl//kqZf/5On YP+Tp2D/k6dg/5SoYf+UqGH/k6hn/5esdP+VrHj/lqp1/5arc/+XqnL/lqpv/5epb/+ZqG// mKVv/5aicP+Um2//jJJs/4OGZ/95e2P/dHNf/25wWP9ncU7/dYFZ/4mWa/+XpHj/mqh3/5el cv+Tomv/kaBn/4ybYP+Mm2D/jJtg/4ybYP+Mm2D/jJtg/4ybYv+MnF7/j6Bc/4+gWv+PoFr/ j6Ba/4+gWv+PoFr/j6Ba/4+gWv+On1n/jp9Z/46fWf+Nnlj/jZ5Y/42eWP+MnVf/jJxb/42c Y/+HlWD/jZto/5Cdb/+Fkmf/ipZw/5eigv9CTDP/CxQB/w0VCP8QFxD/EhgW/xIXGv8RFhr/ DxMc/w4RGP8MDQ//Pz8//+jo6P+Ojo7/u7u9/7q6vP+1tbf/uLi6/7e5tv+1uLH/usCy/7W9 pv+ttpf/lqF5/5elcv+VpGn/n69w/5qrZ/+Zqmb/mapk/5mqZP+ZqmT/mapk/5mqZP+ZqmT/ mapk/5eoYv+XqGL/l6hi/5eoYv+XqGL/mKlj/5ipY/+WqmX/mK1o/5itav+YrWr/l6xp/5es af+XrGn/lqto/5araP+Zrmv/mK1q/5itav+YrWr/l6xp/5esaf+XrGn/l6xp/52wbv+dsG7/ nK9t/5yvbf+brmz/m65s/5uubP+brmz/nK9t/5yvbf+brmz/m65s/5uubP+arWv/mq1r/5qu af+br2r/m69o/5uvaP+armf/mq5n/5quZ/+ZrWb/ma1m/52xav+csGn/nLBp/5ywaf+br2j/ m69o/5uvaP+armf/ma1m/5mtZv+ZrWb/ma1m/5mtZv+ZrWb/ma1m/5mtZv+itm//obVu/6G1 bv+htW7/oLRt/6C0bf+gtG3/n7Ns/56ya/+esmv/nrJr/56ya/+esmv/nrJr/56ya/+esmv/ nrJr/56ya/+esmv/nrJr/56ya/+esmv/nrJr/56ya/+er2n/nq9p/56vaf+er2n/nq9p/56v af+er2n/nq9p/5+wav+fsGr/n7Bq/5+wav+fsGr/n7Bq/5+wav+fsGz/oK5x/5+uc/+frnP/ na9z/52vdf+cr3j/m698/5mvgf+Po4D/g5d+/2yBcv9NYV//MENK/xsuPf8TJT3/EyM8/xso O/8UHzH/ERks/xUdMP8ZHzX/GyI1/yUqPf8wNkT/U1dg/4KIiP+mq6T/s7qq/7vDq/+6xKL/ s7uU/7C5iv+ttn3/qbN2/6OtcP+dp2r/maVn/5qmaP+bqWv/natt/5mpav+Xqmr/l6pq/5ar av+Wq2r/lqtq/5arav+Wq2j/maxq/5msav+ZrGr/mKtp/5iraf+Yq2n/l6po/5eqaP+Xqmj/ l6po/5iraf+Yq2n/mKtp/5msav+ZrGr/mK1s/5KnbP+QqG7/kqds/5Gnaf+Spmf/kqdk/5Kl Y/+SpWP/mqhq/5SiZ/+NlWL/hItf/36CXf96fV7/eXlf/3V4W/9zfVj/doNX/3+MXv+LmWj/ lqRx/5mocf+Tomf/jJxe/5GhYv+RoWD/kaFi/5GhYv+RoWL/kaFi/5GhYv+RoWL/kqNf/5Kj Xf+So13/kqNd/5KjXf+So13/kqNd/5KjXf+MnVf/jJ1X/4ucVv+LnFb/iptV/4qbVf+Km1X/ iptX/4ubXP+Gllj/h5Zd/4+daP+DkWD/go9k/5ikgP9MVzn/CxQA/w0VBv8QFw//EhgW/xIX Gv8RFhz/DxMe/w4RGv8MDRH/Pz8//+np6/+OjpD/vLvA/7u6v/+1trr/uLm7/7i6t/+1uLH/ u8Ky/7e/p/+yvpr/nKl9/5+ud/+drW7/pbZw/5+wav+drW7/naxx/52scf+drHH/naxx/52s cf+drHH/naxx/56tcv+frnP/n65z/6CvdP+hsHX/obB1/6Kxdv+gsnb/mq11/5itdP+YrXT/ mK10/5esc/+XrHP/l6xz/5arcv+YrXT/mK10/5itdP+YrXT/l6xz/5esc/+Wq3L/l6py/52u d/+drnf/na53/5ytdv+crXb/m6x1/5usdf+brHX/nK12/5ytdv+crXb/m6x1/5usdf+brHX/ mqt0/5qrdP+brXH/m61x/5qscP+arHD/mqxw/5mrb/+Zq2//matv/5yucv+brXH/m61x/5ut cf+arHD/mqxw/5qscP+Zq2//mKpu/5iqbv+Yqm7/mKpu/5iqbv+Yqm7/mKpu/5iqbv+Zq2// matv/5mrb/+Yqm7/mKpu/5iqbv+XqW3/l6lt/5mrb/+Zq2//matv/5mrb/+Zq2//matv/5mr b/+Zq2//l6lt/5epbf+XqW3/l6lt/5epbf+XqW3/l6lt/5epbf+aqW7/mqlu/5qpbv+aqW7/ mqlu/5qpbv+aqW7/mqlu/5yrcP+cq3D/nKtw/5yrcP+cq3D/nKtw/5yrcP+cq3D/nKxu/5ys bv+crG7/mqxw/5qscv+ZrHX/mKx7/5argP+QpYT/gpiB/2p/dv9KX2D/LUBO/xcsQf8PIkD/ ESI+/xYjM/8RHif/EB0m/xYiLv8cJTT/HCU2/yMqOv8sNEH/Y2p0/5ecoP+/xMD/ytDG/9Pa yP/W38T/0tm6/8/Xsv/EzJ3/vcWS/7G5hv+mrnv/nKZy/5iibv+Wo27/lqNu/5akb/+UpW// lKVv/5Omb/+Tpm//kqdv/5Knb/+Tpm//lKVv/5Slbv+TpG3/k6Rt/5Okbf+So2z/kqNs/5Kj bP+So2z/kqNs/5KjbP+TpG3/k6Rt/5Okbf+UpW7/k6Zu/5Kqbv+Qqmv/kapp/5GqZv+SqWP/ k6lh/5SoYf+Tp2D/l6Zj/5WjZf+TnGX/i5Ni/4KHXv99gV7/f4Bh/3+CY/+GkWn/hJFl/4WS ZP+KmGX/kqBr/5Wka/+SomT/jp5f/42dXP+Nnlr/jZ1c/42dXP+NnVz/jZ1c/42dXP+NnV7/ i5td/4uaX/+Lml//i5pf/4uaX/+Lml//i5pf/4uaX/+Lml//i5pf/4uaX/+KmV7/iple/4qZ Xv+JmF3/iZlb/4iYV/+Jmlb/hZVW/4uaX/+Fk17/gY5g/5SgeP9FUDD/CxUA/w0WBf8QFw// EhgW/xIXGv8RFhz/DxMe/w4RGv8MDRH/Pz8//+ro6/+Pj5H/vbvA/7u6v/+2tbr/uLm7/7i6 uf+1uLH/sLao/662nv+rtpT/l6R2/5qpcv+YqGf/n7Bq/5aqY/+drW//m61z/52sc/+brXP/ naxz/5utc/+drHP/m61z/5qpcP+Zq3H/nKty/5qscv+drHP/nK50/5+udf+drnf/nK94/5uw eP+brnf/mq93/5uud/+Zrnb/mq12/5mudv+cr3j/m7B4/5yveP+bsHj/m653/5qvd/+brnf/ mq12/52ueP+drnj/nK13/5ytd/+brHb/m6x2/5usdv+brHb/nq95/56vef+drnj/na54/52u eP+crXf/nK13/5ytd/+drnf/na91/52vdf+crnT/nK50/5yudP+brXP/m61z/52vdf+dr3X/ na91/5yudP+crnT/m61z/5utc/+brXP/nK50/5yudP+crnT/nK50/5yudP+crnT/nK50/5yu dP+brXP/m61z/5utc/+arHL/mqxy/5qscv+Zq3H/matx/56wdv+esHb/nrB2/56wdv+esHb/ nrB2/56wdv+esHb/m61z/5utc/+brXP/m61z/5utc/+brXP/m61z/5utc/+fsXf/n7F3/6Gw d/+fsXf/obB3/5+xd/+hsHf/n7F3/6Szev+itHr/pLN6/6K0ev+ks3r/orR6/6Szev+itHj/ pLR2/6K1df+itHb/obV4/6G0fP+gtH//nrSD/56ziP+PpYH/hJh//2yBcv9OYV//M0RM/yEx Qf8bKUP/HipC/yQuOP8gKS7/Iisw/ysyOv8vNkD/MDQ//zQ4RP88Pkr/am10/5ueo/+/wML/ x8nG/9HUy//c4NL/3uLT/+Dlz//m68v/3uK9/8/Trv++wp3/sbWQ/6mtiP+lqoL/o6qB/6Gq f/+fqn//nqt//5utff+arn3/mK59/5iuff+Yr3v/mat5/5qqef+aqnn/mKp4/5iqeP+Yqnj/ l6l3/5epd/+YqXX/mKl1/5updv+bqXT/m6l0/5qrdf+aq3T/ma1y/5asbv+UrWv/lK1r/5Ws aP+VrGb/latj/5WrYv+WqmP/jJ1X/5emZf+frXD/nady/5CaaP+Ij2P/iI9m/4yUa/+GkmT/ iphl/4+dav+Qnmn/jZxl/4ybYP+OnmD/kqJj/5WlZP+VpmL/laVk/5WlZP+VpWT/laVk/5Wl ZP+VpWb/kaBl/5GgZ/+RoGf/kaBn/5GgZ/+RoGf/kaBn/5GgZ/+Mm2L/jJti/4uaYf+LmmH/ iplg/4qZYP+KmWD/ippc/4WVVP+On1v/hJRT/4iYWv+Hll3/hJJf/5Cdcv84QyH/CxUA/w0V Bv8QFw//EhgW/xIXGv8RFhz/EBMc/w4RGP8MDQ//Pz8//+zo6f+QjpH/wLvB/768wf+6t77/ vLvA/7y9v/+6vLn/tLqw/7rCrf+st5n/nKl+/5qrd/+crnD/maxq/5muaf+arW3/ma1u/5qs bv+ZrW7/mqxu/5mtbv+arG7/ma1u/5mrbf+YrG3/matt/5isbf+arG7/ma1u/5qsbv+arm// m61x/5qucf+brXH/mq5x/5utcf+arnH/m61x/5qucf+brXH/mq5x/5utcf+arnH/m61x/5qu cf+brXH/m61x/5yucP+crnD/nK5w/5yucP+crnD/nK5w/5yucP+crnD/nK5w/5yucP+crnD/ nK5w/5yucP+crnD/nK5w/5yucP+crnL/nK5y/5yucv+crnL/nK5y/5yucv+crnL/nK5y/52v c/+dr3P/na9z/52vc/+dr3P/na9z/52vc/+dr3P/na9x/52vcf+dr3H/na9x/52vcf+dr3H/ na9x/52vcf+dr3H/na9x/52vcf+dr3H/na9x/52vcf+dr3H/na9x/5uvcP+br3D/m69w/5uv cP+br3D/m69w/5uvcP+br3D/nLBx/5ywcf+csHH/nbFy/52xcv+dsXL/nrJz/56yc/+esnP/ nrJz/5+xc/+esnP/n7Fz/56yc/+fsXP/nrJz/6CydP+fs3T/oLJ0/5+zdP+gsnT/n7N0/6Cy dP+ftHP/orZx/6G2cf+htXb/oLV6/6C0f/+etIP/nrSG/56ziP+fsYv/k6SC/36Mcv9lcmD/ UFdQ/zxBRP8wMzz/LCw4/zIzOP81NDn/OTg9/z48P/9CPUP/Qz5C/0I9Q/9CPED/XVdb/5eS lv/CvcP/y8nO/9fV2v/i4eb/5OXq/+Xl4//r7N7/5eTP/9/dyP/b2cL/3NbA/9fRuf/Mxqz/ w76g/6+vjf+qrIf/oamA/5mmev+SpnX/jqZy/42qdP+PqnX/lqh2/5qod/+XqXf/lKt3/5Or d/+Sqnb/kqlz/5Oncv+XqHL/mahx/5uocP+dqG7/m6ls/5urbP+ZrGr/mK1q/5itbP+XrWz/ lqxr/5esa/+Wq2j/lapn/5SpZv+UqWb/kqVj/5KlZf+RpGT/kaNl/5CiZv+RoGf/kaBn/5Cf Zv+Qomj/kKJm/5CiZv+PoWX/j6Fj/4+hY/+OoWH/jqFh/42gYP+NoF7/jqFh/46hYf+OoWH/ j6Ji/4+iYv+PomL/j6Fj/4+hY/+OoGL/jqBi/42fYf+MnmD/i51f/4udX/+LnV//ipxe/4qc Xv+Jm13/iJpc/4eZW/+HmVv/h5pa/4SXV/+GmVf/hplZ/4SWWP+FlFv/iJZj/4uYbf8+SSn/ CxIA/w0TCf8QFRH/EhYX/xMXGv8SFhn/EhMV/xESFP8NDQ3/Pz8//+zo6f+Sjo//wLvB/8C7 wf+5tr3/vLvA/728wf+5u7j/tLmy/7rBr/+stpv/nKiA/5qqef+crnL/l6xr/5muaf+YrWz/ mK1s/5itbP+YrWz/mK1s/5itbP+YrWz/mK1s/5esa/+YrWz/mK1s/5itbP+Zrm3/ma5t/5mu bf+Zrm3/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/ m65u/5uubv+brm7/m65u/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yv bf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+cr2//nK5w/5yucP+crnD/nK5w/5yucP+crnD/ nK5w/52vcf+dr3H/na9x/52vcf+dr3H/na9x/52vcf+dr3H/nbBw/52wcP+dsHD/nbBw/52w cP+dsHD/nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/5uwb/+bsG// m7Bv/5uwb/+bsG//m7Bv/5uwb/+bsG//nLFw/5yxcP+dsnH/nbJx/52ycf+es3L/nrNy/56z cv+es3L/nrNy/56zcv+es3L/nrNy/56zcv+es3L/nrNy/5+0c/+ftHP/n7Rz/5+0c/+ftHP/ n7Rz/5+0c/+ftHH/orhw/6K4cP+ht3b/obZ7/5+2gP+ftYT/n7WH/5+1h/+ltoz/mqqD/4mU cv9xel//XGBP/0lKQv8+Ojn/ODM3/z85O/9CPD7/SD9A/0tCQ/9OREP/T0ND/05CRP9MQkP/ V0xQ/392e/+mn6f/xb/J/9vX5f/j4e//5OPz/+3t9//x8Oz/7uzg/+rm2//t5dr/7uTY/+7g 0//l2Mf/3tK8/8zCqf/Ev6H/uLmX/6y0i/+gsIP/l618/5Ktev+UrHj/mal4/5yqd/+Zq3f/ lq13/5Oud/+Trnf/lK10/5WsdP+XqHH/m6hw/52obv+dqGz/nqps/5urav+ZrWj/ma5p/5it bP+YrWz/mK1s/5esa/+Wq2r/lapp/5Wqaf+UqWj/kqdm/5GmZf+RpmX/kKVk/4+kY/+PpGP/ jqNi/46jYv+RpGT/kKNj/5CjY/+Qo2P/j6Ji/4+iYv+PomL/jqFh/42gYP+NoGD/jqFh/46h Yf+PomL/j6Ji/4+iYv+PomL/j6Ji/4+iYv+OoWH/jqFh/42gYP+Mn1//i55e/4ueXv+Lnl7/ ip1d/4qdXf+JnFz/iJtb/4eaWv+Hmlr/h5pa/4SXV/+GmVn/hplZ/4SWWP+FlFn/iJZh/4uX b/8+SSv/CxIC/w0SC/8QFBX/EhYZ/xUWGv8UFRf/EhQT/xETEP8NDQ3/Pz8//+vn6P+RjY7/ v7rA/7+6wP+5tr3/vLvA/7y7wP+5u7j/tLmy/7nArv+rtZr/m6d//5qqef+brXH/l6xr/5mu af+YrWz/mK1s/5itbP+YrWz/mK1s/5itbP+YrWz/mK1s/5esa/+XrGv/l6xr/5itbP+YrWz/ ma5t/5mubf+Zrm3/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uu bv+brm7/m65u/5uubv+brm7/m65u/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+cr23/ nK9t/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+cr2//nK9v/5yvb/+cr2//nK9v/5yv b/+cr2//nK9v/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/ nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/52wcP+dsHD/nbBw/5yx cP+csXD/nLFw/5yxcP+csXD/nLFw/5yxcP+csXD/nbJx/52ycf+dsnH/nrNy/56zcv+es3L/ n7Rz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/6C1dP+gtXT/oLV0/6C1 dP+gtXT/oLV0/6C1dP+gtXL/orhw/6K4cP+ht3b/obZ7/5+2fv+ftoL/n7WE/5+1hv+qu47/ oLGF/5Gdd/98hWb/aG1X/1VXSv9JRkH/Qjw8/01DQv9QRUP/VElH/1dMSv9aTEv/WkxL/1hK Sv9VSUv/T0RI/11TW/94cnz/pqOu/8nI1v/Mzd//zdDj/9/h7v/l5ef/5uLf/+jj3//u5eD/ 8+bg//Pk3f/x39X/69nL/+fXx//g1L7/08yy/8XCo/+1uZb/qrKJ/6Gug/+eq33/oat5/5+s d/+brHX/ma51/5awc/+VsXT/mLJ1/5mxdf+YqnD/m6lu/52obv+eqW//nqlv/5uqb/+arHD/ ma1u/5mtbv+YrWz/mK1s/5esa/+Wq2r/lqtq/5Wqaf+Vqmn/kqdm/5KnZv+Sp2b/kaZl/5Cl ZP+PpGP/j6Rj/46jYv+RpGT/kaRk/5CjY/+Qo2P/kKNj/4+iYv+PomL/j6Ji/46hYf+OoWH/ jqFh/46hYf+PomL/j6Ji/5CjY/+Qo2P/j6Ji/4+iYv+OoWH/jqFh/42gYP+Mn1//i55e/4ue Xv+Lnl7/ip1d/4qdXf+JnFz/iJtb/4eaWv+Hmlr/h5pa/4SXV/+GmVn/hplZ/4SWWP+FlFn/ iJZh/4uXb/8+SSv/CxIC/w0SC/8QFBX/EhYZ/xUWGv8UFRf/EhQT/xETEP8ODg7/QEBA/+vn 6P+RjY7/v7rA/7+6wP+5tr3/u7q//7y7wP+5u7j/s7ix/7nArv+rtZr/m6d//5qqef+brXH/ l6xr/5itaP+YrWz/mK1s/5itbP+YrWz/mK1s/5itbP+YrWz/mK1s/5esa/+XrGv/l6xr/5es a/+YrWz/mK1s/5mubf+Zrm3/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/ m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yv bf+cr23/nbBu/52wbv+dsG7/nbBu/52wbv+dsG7/nbBu/52wbv+dsHD/nbBw/52wcP+dsHD/ nbBw/52wcP+dsHD/nbBw/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56x cf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/ nrFx/52ycf+dsnH/nbJx/52ycf+dsnH/nbJx/52ycf+dsnH/nrNy/56zcv+es3L/n7Rz/5+0 c/+ftHP/oLV0/6C1dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6G2df+htnX/ obZ1/6G2df+htnX/obZ1/6G2df+htnP/orhw/6K4cP+ht3b/obd5/5+3ff+ftoD/n7aC/5+2 gv+pu4n/orSE/5ekef+Fj2r/cnhe/15hTv9RTkX/S0Q+/1ZJQ/9ZSkX/XkxI/2FPS/9iUEz/ X1BN/11NTf9aTEz/UEVJ/0pASP9TUFv/f36M/6usvv+1us7/vMLY/9LX6v/b3uf/4eDl/+nk 6P/y6ez/9+vt//rq6v/65uX/+OPe//bi2f/w3tD/5tbG/9jMtv/Jwqj/vLib/7Kxkv+tr4r/ pat9/6Osd/+drHX/mKxx/5Sub/+TsHD/l7Fw/5mycf+Yqmz/mqps/56pb/+eqW//nKlx/5yr dP+aq3X/max0/5mtbv+Zrm3/mK1s/5itbP+XrGv/lqtq/5Wqaf+Vqmn/k6hn/5OoZ/+Sp2b/ kqdm/5GmZf+QpWT/kKVk/4+kY/+RpGT/kaRk/5GkZP+Qo2P/kKNj/5CjY/+PomL/j6Ji/46h Yf+OoWH/j6Ji/4+iYv+PomL/kKNj/5CjY/+Qo2P/j6Ji/4+iYv+OoWH/jqFh/42gYP+Mn1// i55e/4ueXv+Lnl7/ip1d/4qdXf+JnFz/iJtb/4eaWv+Hmlr/h5pa/4SXV/+GmVn/hplZ/4SW WP+FlFn/iJZh/4uXb/8+SSv/CxIC/w0SC/8QFBX/EhYZ/xUWGv8UFRf/EhQT/xETEP8ODg7/ QEBA/+rm5/+RjY7/vrm//765v/+4tbz/u7q//7u6v/+4urf/s7ix/7i/rf+qtJn/mqZ+/5mp eP+arHD/lqtq/5itaP+XrGv/l6xr/5esa/+XrGv/l6xr/5esa/+XrGv/l6xr/5arav+Wq2r/ l6xr/5esa/+XrGv/mK1s/5itbP+YrWz/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uu bv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5yvbf+cr23/nK9t/5yvbf+cr23/ nK9t/5yvbf+cr23/nbBu/52wbv+dsG7/nbBu/52wbv+dsG7/nbBu/52wbv+dsHD/nbBw/52w cP+dsHD/nbBw/52wcP+dsHD/nbBw/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/ nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/56x cf+esXH/nrFx/52ycf+dsnH/nbJx/52ycf+dsnH/nbJx/52ycf+dsnH/n7Rz/5+0c/+ftHP/ oLV0/6C1dP+gtXT/obZ1/6G2df+htnX/obZ1/6G2df+htnX/obZ1/6G2df+htnX/obZ1/6K3 dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3T/o7lx/6O5cf+iuXX/orh4/6C4fP+gt3// oLd//6C3f/+luID/oLN8/5mndv+KlWr/eH9e/2RoT/9VU0T/Tkg8/1tKQP9eSkH/Y0xE/2NP SP9jT0j/YE1H/11LSf9YSkr/VElN/0Y/R/9APkv/XV9u/4mQo/+jq8L/sr7Y/8rV6//HzuD/ 0dXh/97d6//q5PL/8efy//bm8P/44+z/+eLo//3j5v/64N//8tvV/+rUyf/ey73/08Ky/8q7 qP/DuZ7/rqyF/6msff+gqnb/mKly/5KqbP+SrGv/lK9s/5ewbv+YrWz/m6ts/56pbf+fqnL/ nap0/5qrd/+arHr/ma14/5qucf+Zrm3/ma5t/5itbP+XrGv/lqtq/5arav+Wq2r/lKlo/5Sp aP+TqGf/k6hn/5KnZv+RpmX/kKVk/5ClZP+SpWX/kqVl/5GkZP+RpGT/kaRk/5CjY/+Qo2P/ kKNj/4+iYv+PomL/j6Ji/4+iYv+Qo2P/kKNj/5GkZP+RpGT/j6Ji/4+iYv+OoWH/jqFh/42g YP+Mn1//i55e/4ueXv+Lnl7/ip1d/4qdXf+JnFz/iJtb/4eaWv+Hmlr/h5pa/4SXV/+GmVn/ hplZ/4SWWP+FlFn/iJZh/4uXb/8+SSv/CxIC/w0SC/8QFBX/EhYZ/xUWGv8UFRf/EhQT/xET EP8PDw//QEBA/+rm5/+QjI3/vrm//765v/+4tbz/urm+/7u6v/+4urf/srew/7i/rf+qtJn/ mqZ+/5mpeP+arHD/lqtq/5esZ/+XrGv/l6xr/5esa/+XrGv/l6xr/5esa/+XrGv/l6xr/5ar av+Wq2r/lqtq/5arav+XrGv/l6xr/5itbP+YrWz/m65u/5uubv+brm7/m65u/5uubv+brm7/ m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5yvbf+cr23/nK9t/5yv bf+cr23/nK9t/5yvbf+cr23/nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56xb/+esXH/ nrFx/56xcf+esXH/nrFx/56xcf+esXH/nrFx/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+y cv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/ n7Jy/5+ycv+fsnL/n7Jy/56zcv+es3L/nrNy/56zcv+es3L/nrNy/56zcv+es3L/oLV0/6C1 dP+gtXT/oLV0/6G2df+htnX/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ ord2/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHX/o7lx/6O5cf+iuXX/orh4/6C4 fP+guHz/oLh8/6C4fP+itnn/n7N2/5uqc/+Pm2v/f4dg/2pvUf9aWUT/Uks5/1xJO/9jSTz/ ZUo//2RMQv9iS0P/XkpD/1pHQ/9VRUX/U0hM/0Q/Rv8zMkD/O0BT/1lkev9xf5n/hpWy/52s yf+hrcX/r7fM/8HG3P/R0ub/3Nfr/+TZ6v/q2en/8Nrn//nf7P/43eT/99rf//LV1//p0Mz/ 4cjD/9nCvP/SwLL/u7SY/7KyjP+nroT/nKp5/5Oqcv+Rq27/k61s/5SvbP+YrWz/maxs/52r bv+dq3D/nKt0/5useP+arHr/ma14/5qucf+ar27/ma5t/5itbP+YrWz/l6xr/5arav+Wq2r/ lapp/5Wqaf+UqWj/lKlo/5OoZ/+Sp2b/kaZl/5GmZf+SpWX/kqVl/5KlZf+RpGT/kaRk/5Gk ZP+Qo2P/kKNj/4+iYv+PomL/j6Ji/5CjY/+Qo2P/kaRk/5GkZP+RpGT/j6Ji/4+iYv+OoWH/ jqFh/42gYP+Mn1//i55e/4ueXv+Lnl7/ip1d/4qdXf+JnFz/iJtb/4eaWv+Hmlr/h5pa/4SX V/+GmVn/hplZ/4SWWP+FlFn/iJZh/4uXb/8+SSv/CxIC/w0SC/8QFBX/EhYZ/xUWGv8UFRf/ EhQT/xETEP8PDw//QUFB/+rm5/+QjI3/vrm//724vv+3tLv/urm+/7u6v/+3ubb/srew/7i/ rf+ps5j/maV9/5iod/+arHD/lapp/5esZ/+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/ lqtq/5Wqaf+Vqmn/lqtq/5arav+XrGv/l6xr/5esa/+XrGv/m65u/5uubv+brm7/m65u/5uu bv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5yvbf+cr23/ nK9t/5yvbf+cr23/nK9t/5yvbf+cr23/nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56x b/+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/5+ycP+fsnD/n7Jw/5+ycP+fsnD/ n7Jw/5+ycP+fsnD/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+y cv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/ oLV0/6C1dP+htnX/obZ1/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3 dv+it3b/ord2/6S5eP+kuXj/pLl4/6S5eP+kuXj/pLl4/6S5eP+kuXb/pLl0/6S5dP+junb/ o7l5/6G5e/+huXv/obp5/6G6ef+htnX/oLV0/5+uc/+Wo23/ho9k/3F3Vf9fX0X/V1E7/2BJ Of9lSDj/Zko8/2dLP/9jS0H/X0hC/1lGQv9SRET/SD9E/zk2P/8lKDf/IytA/y48Vv83SGb/ R1t8/2J2l/90h6X/h5i0/5+tyP+3vtr/x8jk/9PP6P/e1Oz/59jt/+jS5//p0eH/68/e/+fL 1//jxc3/3L/E/9S3u//NtbP/zL6z/8G8qP+xtZr/o6+L/5etf/+SrXj/k690/5Sxcf+XrW3/ ma5t/5ysbf+crG7/naxx/5utc/+arXX/mq90/5qub/+ar27/mq9u/5mubf+YrWz/l6xr/5es a/+Wq2r/lqtq/5arav+Vqmn/lKlo/5OoZ/+TqGf/kqdm/5KnZv+Tpmb/kqVl/5KlZf+SpWX/ kaRk/5GkZP+RpGT/kKNj/4+iYv+Qo2P/kKNj/5CjY/+RpGT/kaRk/5GkZP+RpGT/j6Ji/4+i Yv+OoWH/jqFh/42gYP+Mn1//i55e/4ueXv+Lnl7/ip1d/4qdXf+JnFz/iJtb/4eaWv+Hmlr/ h5pa/4SXV/+GmVn/hplZ/4SWWP+FlFn/iJZh/4uXb/8+SSv/CxIC/w0SC/8QFBX/EhYZ/xUW Gv8UFRf/EhQT/xETEP8PDw//QUFB/+rm5/+QjI3/vbi+/724vv+3tLv/urm+/7q5vv+3ubb/ srew/7e+rP+ps5j/maV9/5iod/+Zq2//lapp/5esZ/+Wq2r/lqtq/5arav+Wq2r/lqtq/5ar av+Wq2r/lqtq/5Wqaf+Vqmn/lqtq/5arav+Wq2r/l6xr/5esa/+XrGv/m65u/5uubv+brm7/ m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5yv bf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+cr23/nrFv/56xb/+esW//nrFv/56xb/+esW// nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/5+ycP+fsnD/n7Jw/5+y cP+fsnD/n7Jw/5+ycP+fsnD/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/ n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0 c/+ftHP/obZ1/6G2df+htnX/obZ1/6K3dv+it3b/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/ o7h3/6O4d/+juHf/o7h3/6S5eP+kuXj/pLl4/6S5eP+kuXj/pLl4/6S5eP+kuXb/pLl0/6S5 dP+junb/o7l4/6G6ef+hunn/obp4/6G6dv+juHP/o7h1/6OzdP+ap2//i5Rn/3Z8WP9kZEr/ XFQ//2JLOf9nSjr/aEs9/2hMQP9jS0H/XUlC/1lGQv9TRUX/OzQ7/y4sN/8fJDf/Hik//yEw Tf8bME//KT9k/0ljhv9EXoH/WXGT/3eLrP+SosP/pbDO/7W62P/Gw+D/0snm/9TG4P/WxNz/ 2MLX/9e+0//Rucn/yq++/8Sotv+8pa//1cbL/8rCwP+5urL/qLSg/5uvk/+Vr4j/lLGB/5az e/+VrnT/mK5w/5qsbv+brm7/m61v/5qub/+br3D/mrBw/5uwb/+ar27/mq9u/5mubf+YrWz/ l6xr/5esa/+XrGv/lqtq/5arav+Vqmn/lapp/5SpaP+TqGf/kqdm/5KnZv+Tpmb/k6Zm/5Kl Zf+SpWX/kqVl/5GkZP+RpGT/kaRk/5CjY/+Qo2P/kKNj/5CjY/+RpGT/kaRk/5GkZP+SpWX/ j6Ji/4+iYv+OoWH/jqFh/42gYP+Mn1//i55e/4ueXv+Lnl7/ip1d/4qdXf+JnFz/iJtb/4ea Wv+Hmlr/h5pa/4SXV/+GmVn/hplZ/4SWWP+FlFn/iJZh/4uXb/8+SSv/CxIC/w0SC/8QFBX/ EhYZ/xUWGv8UFRf/EhQT/xETEP8QEBD/QUFB/+nl5v+UkJH/vbi+/7u2vP+6t77/urm+/7a1 uv+4urf/tbqz/7i/rf+ospf/lqJ6/5Skc/+XqW3/lapp/5itaP+Wq2r/lqtq/5arav+Wq2r/ lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/mKtr/5ir a/+Yq2v/mKtr/5ira/+Yq2v/mKtr/5ira/+arW3/mq1t/5qtbf+arW3/mq1t/5qtbf+arW3/ mq1t/56xb/+esW//nrFv/56xb/+dsG7/nbBu/52wbv+dsG7/nbBu/52wbv+esW//nrFv/56x b/+fsnD/n7Jw/5+ycP+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56xb/+esW// nrFv/56xb/+esW//nrFv/56xb/+esW//nrFx/56xcf+fsnL/n7Jy/5+ycv+gs3P/oLNz/6Cz c/+fsnL/n7Jy/6Czc/+gs3P/obR0/6G0dP+htHT/obR0/6C1dP+gtXT/oLV0/6C1dP+gtXT/ oLV0/6C1dP+gtXT/obZ1/6G2df+htnX/obZ1/6K3dv+it3b/ord2/6O4d/+it3b/ord2/6K3 dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3T/ o7hz/6K3cv+huHT/obd2/563dv+et3b/nrd1/522cv+es27/oLVw/6Cwcf+Vomr/hI1g/3J4 VP9nZ03/Zl9M/2FMO/9lSTv/Zko+/2RJPv9fSED/V0Q+/1JAPv9KPkD/NTA3/ywsOP8gJzr/ FyM7/xIjQf8QJ0f/FS1T/xYyWf8rS3H/L1Bz/zpYfP9OZor/Z3uc/4OSs/+epMb/rq/O/7Gu zf+8s9D/wbTQ/7mpw/+qmLD/oI2j/6ONpP+nlKr/w7PN/8G4zf+8vMj/sLq8/6C0qf+VsZv/ krGR/5Szif+Urn7/mK93/5uvcv+cr2//m65s/5itaP+XrWX/laxm/5yxbv+ar27/lqtq/5Sp aP+UqWj/lapp/5itbP+ar27/lqtq/5arav+Wq2r/lapp/5Wqaf+Vqmn/lKlo/5SpaP+Up2f/ lKdn/5OmZv+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/kqVl/5Kl Zf+SpWX/j6Ji/4+iYv+PomL/jqFh/46hYf+OoWH/jaBg/42gYP+Mn1//jJ9f/4ueXv+KnV3/ iZxc/4mcXP+Im1v/iJtb/4WYWP+Hmlr/h5pa/4WXWf+GlVr/iZdi/42Zcf8/Siz/CxIC/w0S C/8QFBX/EhYZ/xUWGv8UFRf/EhQT/xETEP8QEBD/QUFB/+jk5f+UkJH/vbi+/7q1u/+6t77/ urm+/7a1uv+4urf/tbqz/7i/rf+ospf/laF5/5Skc/+WqGz/lKlo/5itaP+Wq2r/lqtq/5ar av+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/ mKtr/5ira/+Yq2v/mKtr/5ira/+Yq2v/mKtr/5ira/+ZrGz/maxs/5msbP+ZrGz/maxs/5ms bP+ZrGz/maxs/5iraf+Yq2n/maxq/5qta/+arWv/m65s/5yvbf+cr23/nbBu/52wbv+dsG7/ nrFv/56xb/+esW//n7Jw/5+ycP+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56x b/+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFx/56xcf+esXH/n7Jy/5+ycv+gs3P/ oLNz/6Czc/+fsnL/n7Jy/6Czc/+gs3P/oLNz/6G0dP+htHT/obR0/6C1dP+gtXT/oLV0/6C1 dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6G2df+htnX/obZ1/6K3dv+it3b/ord2/6K3dv+it3b/ ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3 dv+it3b/o7h1/6K3dP+ht3b/obd3/563dv+et3b/nrd1/522cv+csWz/nLFu/5qqbP+MmWP/ eYJX/2ZrS/9cW0b/W1RE/1lHOf9eRjr/XUc8/11GPv9YRT//U0E9/0w+Pv9FPEH/LCky/yQm M/8ZITT/EB44/wsePP8LIkT/DihN/w4sUv8SNVv/FDdd/xs9Yv8pR2v/PFZ5/1Foiv9odpn/ dX+i/4qQsv+OjrD/ioem/3x3lf9wZ4T/bWSB/3pwi/+Ge5v/rqLI/7Gp0P+ys9H/q7bK/6C0 vf+Usa3/kLCh/5KzmP+WsY7/mLKF/5qxe/+dsXT/nbBw/5ywaf+bsWj/mrBn/56zcP+dsnH/ m7Bv/5mubf+YrWz/l6xr/5itbP+YrWz/lqtq/5arav+Wq2r/lapp/5Wqaf+Vqmn/lKlo/5Sp aP+Up2f/lKdn/5OmZv+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/ kqVl/5KlZf+SpWX/j6Ji/4+iYv+PomL/jqFh/46hYf+OoWH/jaBg/42gYP+Mn1//jJ9f/4ue Xv+KnV3/iZxc/4mcXP+Im1v/iJtb/4WYWP+Hmlr/h5pa/4WXWf+GlVr/iZdi/42Zcf8/Siz/ CxIC/w0SC/8QFBX/EhYZ/xUWGv8UFRf/ExUU/xETEP8PDw//QUFB/+jk5f+UkJH/vbi+/7q1 u/+6t77/urm+/7a1uv+4urf/tLmy/7i/rf+nsZb/laF5/5Ojcv+WqGz/lKlo/5esZ/+Wq2r/ lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5arav+Wq2r/lqtq/5ar av+Wq2r/mKtr/5ira/+Yq2v/mKtr/5ira/+Yq2v/mKtr/5ira/+ZrGz/maxs/5msbP+ZrGz/ maxs/5msbP+ZrGz/maxs/5uubP+brmz/m65s/5qta/+arWv/mq1r/5qta/+arWv/nK9t/5yv bf+dsG7/nbBu/52wbv+esW//nrFv/56xb/+esm3/nrJt/56ybf+esm3/nrJt/56ybf+esm3/ nrJt/56ybf+esm3/nrJt/56ybf+esm3/nrJt/56ybf+esW//nrFx/56xcf+esXH/nrFx/5+y cv+fsnL/oLNz/6Czc/+fsnL/n7Jy/5+ycv+gs3P/oLNz/6Czc/+htHT/obR0/6C1dP+gtXT/ oLV0/6C1dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6C1dP+gtXT/obZ1/6G2df+it3b/ord2/6K3 dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ ord2/6K3dv+it3b/o7h3/6K3dv+ht3f/obd5/562eP+et3b/nrd1/522cv+Zrmv/lqtq/46d Yv98iFb/Zm5H/1JWO/9JRzj/SEE3/0w/N/9QPzj/UT87/09APf9NPjv/Rzs7/0I3O/89Nj3/ JCIt/xwfLv8UHDH/Cxkz/wYZN/8FHDz/CCBE/wclS/8GKU//BypQ/wosUf8QMFb/HDpe/ypE Z/83TXL/QVN3/1Vjhv9TYIL/TlZ6/0FHaf85PF3/Oz5f/0tMa/9aWH3/hHyt/4qGuP+RlsD/ kqDD/4ykvP+GprP/h6mr/4qrpP+TsJ7/lrCT/5mviP+br3z/m690/5yvbf+br2f/mrBn/52y b/+dsnH/nbJx/52ycf+csXD/mq9u/5itbP+XrGv/lqtq/5arav+Wq2r/lapp/5Wqaf+Vqmn/ lKlo/5SpaP+Up2f/lKdn/5OmZv+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5KlZf+SpWX/kqVl/5Kl Zf+SpWX/kqVl/5KlZf+SpWX/j6Ji/4+iYv+PomL/jqFh/46hYf+OoWH/jaBg/42gYP+Mn1// jJ9f/4ueXv+KnV3/iZxc/4mcXP+Im1v/iJtb/4WYWP+Hmlr/h5pa/4WXWf+GlVr/iZdi/42Z cf8/Siz/CxIC/w0SC/8QFBX/Exca/xYXG/8VFhj/ExUU/xETEP8PDw//QUFB/+jk5f+Tj5D/ vLe9/7q1u/+5tr3/ubi9/7W0uf+3ubb/tLmy/7i/rf+nsZb/laF5/5Ojcv+WqGz/lKlo/5es Z/+Vqmn/lapp/5Wqaf+Vqmn/lapp/5Wqaf+Vqmn/lapp/5Wqaf+Vqmn/lapp/5Wqaf+Vqmn/ lapp/5Wqaf+Vqmn/mKtr/5ira/+Yq2v/mKtr/5ira/+Yq2v/mKtr/5ira/+Yq2v/mKtr/5ir a/+Yq2v/mKtr/5ira/+Yq2v/mKtr/5yvbf+cr23/nK9t/52wbv+dsG7/nrFv/56xb/+esW// m65s/5uubP+cr23/nK9t/5yvbf+dsG7/nbBu/52wbv+dsWz/nbFs/52xbP+dsWz/nbFs/52x bP+dsWz/nbFs/52xbP+dsWz/nbFs/52xbP+dsWz/nbFs/52xbP+dsWz/nbBw/52wcP+esXH/ nrFx/56xcf+fsnL/n7Jy/5+ycv+esXH/nrFx/5+ycv+fsnL/oLNz/6Czc/+gs3P/oLNz/6C1 dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6C1dP+gtXT/oLV0/6G2df+htnX/ ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3 dv+it3b/ord2/6K3dv+it3b/o7h3/6K2d/+ht3n/obd5/562ev+etnj/nrd2/522dP+Vqmn/ jqJj/4GQWf9pdUf/UFc2/z1AK/81Min/My4r/z01M/8/NTT/QDY3/0E3OP8/Njn/PDM4/zYx N/8yLzj/Hx4s/xgeLv8QGy//Chgy/wcYNv8GGjv/BR0//wYgRf8HJ03/BiZM/wcnTf8LKU3/ ES1S/xg0Wf8hOV3/Jjxh/ys/ZP8uQGT/MEBk/yw6X/8nNFf/JjNW/y03W/81PGb/TU2B/1VW jP9cZpf/YnWg/2SApf9oi6f/c5ir/3ugqf+MrKv/kqyh/5etlv+aron/nK5+/5utc/+ZrGr/ l6tm/5esaf+YrWz/mq9u/5yxcP+csXD/m7Bv/5qvbv+YrWz/lqtq/5arav+Wq2r/lapp/5Wq af+Vqmn/lKlo/5SpaP+Up2f/lKdn/5OmZv+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5KlZf+SpWX/ kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/j6Ji/4+iYv+PomL/jqFh/46hYf+OoWH/jaBg/42g YP+Mn1//jJ9f/4ueXv+KnV3/iZxc/4mcXP+Im1v/iJtb/4WYWP+Hmlr/h5pa/4WXWf+GlVr/ iZdi/42Zcf8/Siz/DBMD/w4TDP8RFRb/Exca/xYXG/8VFhj/ExUU/xIUEf8PDw//QEBA/+fj 5P+Tj5D/vLe9/7m0uv+5tr3/ubi9/7W0uf+3ubb/s7ix/7e+rP+msJX/lKB4/5Kicf+Vp2v/ k6hn/5arZv+Vqmn/lapp/5Wqaf+Vqmn/lapp/5Wqaf+Vqmn/lapp/5Wqaf+Vqmn/lapp/5Wq af+Vqmn/lapp/5Wqaf+Vqmn/l6pq/5eqav+Xqmr/l6pq/5eqav+Xqmr/l6pq/5eqav+Xqmr/ l6pq/5eqav+Xqmr/l6pq/5eqav+Xqmr/l6pq/5apZ/+Xqmj/mKtp/5msav+brmz/nK9t/52w bv+esW//mq1r/5qta/+brmz/m65s/5uubP+cr23/nK9t/5yvbf+dsWz/nbFs/52xbP+dsWz/ nbFs/52xbP+dsWz/nbFs/52xbP+dsWz/nbFs/52xbP+dsWz/nbFs/52xbP+dsWz/nbBw/52w cP+dsHD/nrFx/56xcf+esXH/n7Jy/5+ycv+esXH/nrFx/56xcf+fsnL/n7Jy/5+ycv+gs3P/ oLNz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0c/+gtXT/oLV0/6C1 dP+htnX/obZ1/6G2df+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ ord2/6K3dv+it3b/ord2/6K3dv+it3b/o7d4/6K2ef+htnv/obZ7/562fP+etnr/nrZ4/522 df+Spmf/iJxh/3WDUP9YYzv/PUMp/yosH/8mIiH/JSAm/ysoL/8sKzH/Lywz/zAtNP8wLTT/ LCsz/yooM/8nJjT/HB8u/xgfMf8SHTP/DRs1/wobN/8JHDz/CR0+/wgfQf8FHUH/BR1B/wYe Qv8IIET/DCRI/xAoTP8ULFL/Fy9V/xctVP8cMln/Ijhf/yY5Yf8jNl7/IDNb/x4xWf8iMVz/ Ji5f/ywzZ/8uPm//Mkp4/zlah/9Hbpf/XISo/22Sr/+DpLf/jaix/5qurP+ktaP/qbiX/6i4 i/+ls37/oLJ2/5Soaf+Vqmn/l6xr/5itbP+Zrm3/mq9u/5qvbv+ar27/lqtq/5arav+Wq2r/ lapp/5Wqaf+Vqmn/lKlo/5SpaP+Up2f/lKdn/5OmZv+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5Kl Zf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/j6Ji/4+iYv+PomL/jqFh/46hYf+OoWH/ jaBg/42gYP+Mn1//jJ9f/4ueXv+KnV3/iZxc/4mcXP+Im1v/iJtb/4WYWP+Hmlr/h5pa/4WX Wf+GlVr/iZdi/42Zcf8/Siz/DBMD/w4TDP8RFRb/FBgb/xcYHP8WFxn/FBYV/xIUEf8ODg7/ QEBA/+fj5P+Sjo//vLe9/7m0uv+4tbz/uLe8/7SzuP+2uLX/s7ix/7e+rP+msJX/lKB4/5Ki cf+Vp2v/k6hn/5arZv+UqWj/lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/ lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/l6pq/5eqav+Xqmr/l6pq/5eqav+Xqmr/l6pq/5eq av+WqWn/lqlp/5apaf+WqWn/lqlp/5apaf+WqWn/lqlp/5msav+ZrGr/mKtp/5apZ/+VqGb/ k6Zk/5KlY/+SpWP/maxq/5msav+arWv/mq1r/5uubP+brmz/m65s/5uubP+csGv/nLBr/5yw a/+csGv/nLBr/5ywa/+csGv/nLBr/5ywa/+csGv/nLBr/5ywa/+csGv/nLBr/5ywa/+csGv/ nK9t/5yvb/+dsHD/nbBw/56xcf+esXH/nrFx/56xcf+dsHD/nrFx/56xcf+esXH/n7Jy/5+y cv+fsnL/n7Jy/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/n7Rz/5+0c/+ftHP/ n7Rz/6C1dP+gtXT/obZ1/6G2df+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3 dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+itnf/o7d6/6K2e/+htn3/obZ9/562fP+etnz/ nrZ6/521ef+RpWr/g5Zf/2x5S/9MVjP/MDUh/x4fGf8dGB//HBgm/xweKv8cICz/HyMv/yIk MP8iJDD/ISMw/x0hLf8cHy7/Gh8y/xgfMv8UHzX/EB44/w4dOv8NHjz/Cx4+/wseP/8KGjz/ Cxs//w0dQf8NH0P/ECJI/xImS/8TKVD/FCpR/xMrUf8VLFX/Fy5X/xcwWf8XMFn/Fi9Y/xYu Wv8ZLln/FyZR/xknVP8WLFv/FDNi/xpAcf8qVIb/Qmyc/1Z9qP9wkLb/gpy3/5qtu/+vv77/ vcq5/7/Mrv+8yKD/t8WS/6K0eP+es3L/m7Bv/5esa/+Wq2r/l6xr/5mubf+bsG//lqtq/5ar av+Wq2r/lapp/5Wqaf+Vqmn/lKlo/5SpaP+Up2f/lKdn/5OmZv+Tpmb/k6Zm/5KlZf+SpWX/ kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/j6Ji/4+iYv+PomL/jqFh/46h Yf+OoWH/jaBg/42gYP+Mn1//jJ9f/4ueXv+KnV3/iZxc/4mcXP+Im1v/iJtb/4WYWP+Hmlr/ h5pa/4WXWf+GlVr/iZdi/42Zcf8/Siz/DRQE/w8UDf8SFhf/FBgb/xcYHP8WFxn/FBYV/xMV Ev8ODg7/QEBA/+bi4/+Sjo//u7a8/7izuf+4tbz/uLe8/7SzuP+2uLX/s7ix/7a9q/+lr5T/ k593/5Kicf+Upmr/kqdm/5arZv+UqWj/lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/lKlo/5Sp aP+UqWj/lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/lqlp/5apaf+WqWn/lqlp/5apaf+WqWn/ lqlp/5apaf+VqGj/laho/5WoaP+VqGj/laho/5WoaP+VqGj/laho/5uubP+brmz/m65s/5uu bP+brmz/m65s/5uubP+brmz/maxq/5msav+ZrGr/maxq/5qta/+arWv/m65s/5uubP+csGv/ nLBp/5ywaf+csGn/nLBp/5ywaf+csGn/nLBp/5ywaf+csGn/nLBp/5ywaf+csGn/nLBp/5yw af+csGv/nK9t/5yvb/+cr2//nbBw/52wcP+esXH/nrFx/56xcf+dsHD/nbBw/56xcf+esXH/ nrFx/5+ycv+fsnL/n7Jy/56zcv+es3L/nrNy/56zcv+es3L/nrNy/56zcv+es3L/nrNy/56z cv+ftHP/n7Rz/6C1dP+gtXT/oLV0/6C1dP+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+itnf/o7d6/6K2e/+htn3/obZ+/561 ff+etnz/nrZ8/521e/+RpGz/gZNf/2d0Sf9ETS7/KCwd/xgYFv8ZEx//Ghco/xAVKP8QGSr/ Exwt/xYdLf8XHi7/Fh0t/xUbK/8TGCv/Fh0v/xYdMP8THjT/Eh42/w8dOP8MHTn/Cxw6/wsa O/8THUD/FR1C/xYeQ/8XIUX/FSNI/xUlSf8UJkz/EyZO/xMpUP8QJ1D/DSZP/wsmUf8MJ1L/ DilU/w4rV/8SK1T/FChN/xUpTv8OKlL/CStY/wcvYv8RPHP/I02H/zJZkP9NbaD/Z4Cp/46f u/+xv8z/ydPS/9Dby//P2b7/ytes/7rLlP+yx4b/prt6/5yxcP+Vqmn/lKlo/5arav+YrWz/ lqtq/5arav+Wq2r/lapp/5Wqaf+Vqmn/lKlo/5SpaP+Up2f/lKdn/5OmZv+Tpmb/k6Zm/5Kl Zf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/j6Ji/4+iYv+PomL/ jqFh/46hYf+OoWH/jaBg/42gYP+Mn1//jJ9f/4ueXv+KnV3/iZxc/4mcXP+Im1v/iJtb/4WY WP+Hmlr/h5pa/4WXWf+GlVr/iZdi/42Zcf8/Siz/DRQE/w8UDf8SFhf/FRkc/xcYHP8WFxn/ FRcW/xMVEv8NDQ3/Pz8//+bi4/+Qjo//u7a8/7a0uf+4tbz/uLe8/7O0uP+2uLX/srew/7a9 q/+lr5T/k593/5Sicf+Upmr/k6Zm/5WqZf+UqWj/lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/ lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/lKlo/5SpaP+UqWj/lqlp/5apaf+WqWn/lqlp/5ap af+WqWn/lqlp/5apaf+VqGj/laho/5WoaP+VqGj/laho/5WoaP+VqGj/ladp/4+hZ/+TpG7/ m6l2/6GxgP+suYv/ssKT/7rIl/+7zJb/mqlw/5iqbP+bq2r/ma1o/5ytaf+armn/nKxr/5qu af+csGn/nLBp/5ywaf+csGn/nLBp/5ywaf+csGn/nLBp/5ywaf+csGv/nLBr/5ywa/+csGv/ nLBr/5ywa/+cr23/nK9t/5yvb/+cr2//nbBw/52wcP+dsHD/nrFx/56xcf+dsHD/nbBw/52w cP+esXH/nrFx/56xcf+fsnL/n7Jy/56zcv+es3L/nrNy/56zcv+es3L/nrNy/56zcv+es3L/ nrNy/56zcv+ftHP/n7Rz/5+0c/+gtXT/oLV0/6C1dP+it3b/ord2/6K3dv+it3b/ord2/6K3 dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/ord2/6K3dv+it3b/o7d6/6K2ef+htnv/ obZ9/562fP+etnz/nrZ8/5+0fP+QpG//gJJi/2JxSv9ASjH/Iigc/xUWGP8WFB//Fxko/wkS I/8JFSX/DBgo/w8bK/8SGyz/ERor/xAXKv8PFin/Exkv/xMbMP8RHDL/Dh00/wwcNf8KGzX/ Bho1/wcYNv8RGz7/Exs//xQcQP8THUD/ER5B/w4eQv8LHUH/Ch5D/xAmS/8OJkz/DCVN/wwl Tf8MKFD/DChQ/wsmUf8LJEz/EilJ/xMqSf8NKU7/BidQ/wAlVP8BKV3/CzJp/xY7cv8uTYP/ TWWT/3uOr/+ot8z/ydPc/9Xg3P/W3tH/0tzD/8/etf/D1aP/ssOP/6CzfP+WqG7/kqZp/5Sm aP+Wq2r/l6pq/5araP+Xqmj/lapn/5apaf+Vqmn/ladp/5Wnaf+Up2f/lKdn/5WlZv+Tpmb/ laVm/5KlZf+UpGX/kqVl/5SkZf+SpWX/lKRl/5KlZf+UpGX/kqVl/5SkZf+SpWX/kaFi/4+i Yv+RoWL/jqFh/5CgYf+OoWH/j59g/42gYP+Onl//jJ9f/42dXv+KnV3/i5tc/4mcXP+Kmlv/ iJtb/4SZVv+Gm1j/hptY/4SZWP+Ellr/h5hi/42ab/8/Siz/DRQE/w8UDv8SFhf/Fxgc/xgZ Hv8YFxz/FhYW/xQUFP8NDQ3/Pz8//+fl5v+QkJD/t7W6/7Gwtf+ysbf/s7K3/7Cxtf+1t7T/ rbKr/6ivnf+hqo//maV9/5Wjcv+VpGn/l6do/5erZv+VqGj/laho/5WoaP+Up2f/lKdn/5Om Zv+Tpmb/k6Zm/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/laho/5WoaP+VqGj/ laho/5WoaP+VqGj/laho/5WoaP+VqGj/laho/5WoaP+Up2f/lKdn/5OmZv+Tpmb/k6Rt/5Gd d/+cpov/n6aU/15mWf9YXVb/c3tw/87Uxv/f6dD/pK+H/6OxfP+hr3H/lqdh/6a2b/+VpmD/ mqlm/52uav+YrGT/ma1l/5mtZf+ZrWX/mq5n/5quZ/+armn/m69q/5uvav+brmz/m65s/5uu bP+brm7/m65u/5utb/+brm7/nK9v/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+dsG7/ nbBu/52wbv+dsG7/nbBu/52wbv+dsG7/nbBu/56zcP+es3D/n7Rx/5+0cf+ftHH/oLVy/6C1 cv+gtXL/n7Rx/5+0cf+gtXL/oLVy/6G2c/+htnP/obZz/6G2c/+juHf/o7h3/6O4d/+juHf/ o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/pbt6/6K4 d/+ht3b/orh4/6W7e/+juXv/nbJ3/5arc/+OonH/fI5k/15tTP87STL/Hysf/xEaF/8NFBr/ DRYf/xEbJf8RGyf/ERsn/xIcKP8TGiz/Exot/xMZL/8TGTH/ERgy/xAaM/8NGzX/DB42/wsf OP8LITn/CiI6/woiPP8MHz3/Dh4//w8fQP8PH0D/DSBA/w4hQv8NIUL/DSFC/w8jRP8NJET/ DSRG/w0kRv8NJEb/DSRG/w0kRv8NJET/ESZD/xAlQv8NJkX/CyVI/wclS/8EJE3/BCNP/wQj T/8OKVT/JT1j/1Vqh/+To7r/ws/f/9Pg6P/Y4uT/2eTe/9rl1f/R3cf/xM6z/7G/nP+ms4j/ nKx7/5qpcP+XqWv/mKhn/5aqZf+YqWX/lalk/5enaP+Vp2n/lqVq/5alav+VpWf/laVm/5Wj Zf+UpGX/lKJk/5OjZP+UomT/k6Nk/5SiZP+To2T/lKJk/5OjZP+UomT/k6Nk/5SiZP+To2T/ k6Fj/5KiY/+SoGL/kaFi/5GfYf+Pn2D/j51f/46eX/+PnV//jp5f/46cXv+MnF3/jJpc/4ub XP+LmVv/iJtZ/4OaVP+DnVb/hp1X/4SbV/+EmFn/iJtj/42ccf9CTS3/EBcH/xAVD/8TFBj/ FRQa/xUUHP8XFBv/GBYb/xgWGf8ODg7/QEBA/+bm5v+Pj4//trW6/7CvtP+xsLb/s7K3/7Cx tf+0trP/rbKr/6ivnf+gqY7/mqV9/5Wjcv+VpGn/l6do/5mqZv+VqGj/laho/5SnZ/+Up2f/ lKdn/5OmZv+Tpmb/k6Zm/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/laho/5Wo aP+VqGj/laho/5WoaP+VqGj/laho/5WoaP+VqGj/laho/5SnZ/+Up2f/lKdn/5OmZv+Tpmb/ k6Ru/5eggf9/hXf/RktH/09SV/9ZW2f/VVdj/2ptcv/Z3tf/3+jN/5ynfP+WpGn/o7Jv/5yr Zv+ermf/lqVi/5+wbP+aq2T/ma5j/5mtZf+ZrWX/mq5n/5quZ/+armn/m69q/5uubP+brmz/ m65u/5uubv+brW//m61v/5utcf+brW//nK9v/5yvbf+cr23/nK9t/5yvbf+cr23/nK9t/5yv bf+dsG7/nbBu/52wbv+dsG7/nbBu/52wbv+dsG7/nbBu/56zcP+es3D/n7Rx/5+0cf+ftHH/ oLVy/6C1cv+gtXL/n7Rx/5+0cf+gtXL/oLVy/6G2c/+htnP/obZz/6G2c/+juHf/o7h3/6O4 d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/ pbx4/6K5df+gt3P/orl1/6W7ev+juXn/nLF2/5arc/+LnnD/eIpi/1lpTP84RzL/Hish/xEd Gf8OGRv/Dxoe/xAaI/8QGiP/EBok/xIaJ/8TGir/Exos/xQZL/8UGjL/Ehkz/xEbNv8OHDf/ DR44/wsfOP8JITn/CSM6/wkjPP8JIT3/CyA//wsgP/8MIUD/DCFA/w0iQf8NIkH/DSJB/w4j Qv8OI0L/DiNC/w4jQv8OI0L/DiNC/w4jQv8OI0D/ECVA/xAlQP8NJUH/DSRD/wsjRf8JI0b/ CCJH/wgiR/8MJkn/FS5N/zhNaP9yhJr/qLjI/8nV4//Z4+3/3+jt/93m5f/Y39j/y9PE/7vF rf+st5X/oK2B/5elcP+To2X/mKhn/5ipY/+XqGL/l6hk/5enaP+Wpmj/lqVs/5albP+WpGf/ lqRm/5WjZf+Vo2X/lKJk/5SiZP+UomT/lKJk/5SiZP+UomT/lKJk/5SiZP+UomT/lKJk/5Si ZP+UomT/k6Fj/5OhY/+SoGL/kqBi/5GfYf+QnmD/j51f/4+dX/+PnV//j51f/46cXv+Nm13/ jJpc/4yaXP+LmVv/iJtZ/4OaVP+CnlT/hJ5V/4KcVf+DmVj/iJtj/42dcP9ATi3/EBcH/xAV D/8UExj/FRQc/xcUHf8XFBv/GhUb/xgWGf8PDQ7/QEBA/+Xl5f+Ojo7/tbS5/6+us/+wr7X/ srG2/6+wtP+ztbL/rLGq/6ivnf+gqY7/maR8/5Sicf+Uo2j/l6do/5mqZv+Up2f/lKdn/5Sn Z/+Up2f/k6Zm/5OmZv+Tpmb/kqVl/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/ laho/5WoaP+VqGj/laho/5WoaP+VqGj/laho/5WoaP+Up2f/lKdn/5SnZ/+Up2f/k6Zm/5Om Zv+Tpmb/kqNs/5Gbef9fZlT/QkdA/2Zqbf9aXGj/YWNw/1daYf+fpKD/8vrl/7/Jpv+Snmz/ n61w/5uqaf+frmn/lqVi/52uav+aq2T/ma1l/5mtZv+ZrWb/mq5n/5quZ/+armn/m69q/5uu bP+brmz/m65u/5uubv+brW//m61v/5utb/+brW//nK9v/5yvbf+cr23/nK9t/5yvbf+cr23/ nK9t/5yvbf+dsG7/nbBu/52wbv+dsG7/nbBu/52wbv+dsG7/nbBu/56zcP+es3D/n7Rx/5+0 cf+ftHH/oLVy/6C1cv+gtXL/n7Rx/5+0cf+gtXL/oLVy/6G2c/+htnP/obZz/6G2c/+juHf/ o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4 d/+juHf/pLp5/6K4d/+gt3P/orl1/6S6ef+juXn/nLF2/5arc/+HmGv/c4Nc/1RjRv81Qi7/ Hysf/xUgHP8UHiD/FR4j/xAZIv8QGSL/ERkk/xMZJ/8UGir/FRot/xcZMP8WGjP/FRs1/xQb Nf8RHTf/Dx84/w4fOf8MIDn/CyE5/wkhO/8LID3/CyA9/wsgPf8LID3/DCE+/wwhPv8NIj// DSI//w4jQP8OI0D/DiNA/w4jQP8OI0D/DiNA/w4jQP8OI0D/ECQ//w8kP/8MJED/CyJB/woi RP8IIkX/ByFE/wchRP8NJUf/CSA//xouSf9KWnH/gZGh/625xf/I0tv/1d7j/9ri5P/W39r/ ztnL/8LOuP+ywJ//orGG/5Wmcv+Nn2P/lqln/5WpZP+VqWL/lalk/5SnZf+Upmj/lKZq/5Sm av+VpWf/laVm/5SkZf+UpGX/k6Nk/5OjZP+To2T/k6Nk/5OjZP+To2T/k6Nk/5OjZP+To2T/ k6Nk/5OjZP+To2T/kqJj/5KiY/+RoWL/kaFi/5CgYf+Pn2D/jp5f/46eX/+Onl//jp5f/42d Xv+MnF3/i5tc/4ubXP+Kmlv/iJtZ/4OaVP+DnVb/hp1X/4SbV/+EmFn/iJtj/42dcP9ATi3/ EBcH/xEWEP8UExj/FRQc/xcUHf8YFRz/GhUb/xkXGv8PDQ7/QEBA/+Pj4/+NjY3/s7K3/66t sv+vrrT/sK+0/62usv+ytLH/rLGq/6eunP+gqY7/maR8/5Sicf+Uo2j/lqZn/5ipZf+Up2f/ lKdn/5SnZ/+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5Om Zv+Tpmb/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Tpmb/ k6Zm/5KlZf+SpWX/kqNs/3V/Wv9DSzP/Y2ld/2VpaP9aXWb/aGp3/2Vnc/9bX2L/sris//D5 3v+vupD/kp9q/5+tcP+ZqGf/mqlm/5mqZv+aq2X/ma1m/5mtZv+ZrWb/mq5n/5quZ/+armn/ m69q/5uubP+brmz/m65u/5uubv+brW//m61v/5utb/+brm7/nK9v/5yvbf+cr23/nK9t/5yv bf+cr23/nK9t/5yvbf+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56zcP+es3D/ n7Rx/5+0cf+ftHH/oLVy/6C1cv+gtXL/n7Rx/5+0cf+gtXL/oLVy/6G2c/+htnP/obZz/6G2 c/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/o7h3/6O4d/+juHf/ o7h3/6O4d/+juHf/pLp5/6G3dv+gt3P/obh0/6S6ef+iuHj/nLF2/5Wqcv+ElWj/bX1W/01c P/8wPSn/Hioe/xgjHf8ZISP/GiEn/xAXH/8RGCL/FBgk/xYaJv8YGin/Ghst/xscMf8bHTT/ GR02/xgeOP8WHTf/Ex85/xAeOP8OHzn/Dh85/wsfOP8KHzr/Ch88/wsgPf8LID3/CyA9/wwh Pv8MIT7/DCE+/w0iP/8NIj//DSI//w0iP/8NIj//DSI//w0iP/8NIj3/DyM8/w4iO/8NIj3/ CiI+/wkgQP8IIEL/Bx9B/wcfQf8QJ0f/CR47/xEiPP8wQVX/XGl5/4KOmv+irLX/tb7D/8bQ 0v/H0s7/yNLJ/8LPu/+4xan/p7eQ/5mpeP+Po2j/laho/5SpZP+VqWL/k6hj/5SnZf+TqGf/ k6Vn/5OlZ/+Tpmb/laVm/5SkZf+UpGX/k6Nk/5OjZP+To2T/k6Nk/5OjZP+To2T/k6Nk/5Oj ZP+To2T/k6Nk/5OjZP+To2T/kqJj/5KiY/+RoWL/kaFi/5CgYf+Pn2D/jp5f/46eX/+Onl// jp5f/42dXv+MnF3/i5tc/4ubXP+Kmlv/iJtZ/4OaVv+DnVb/hp1X/4SbV/+EmFn/iJtk/42c cf9CTS3/ERgI/xEWEP8VFBn/FhUd/xcUHf8YFRz/GxYc/xkXGv8ODg7/QEBA/+Li4v+MjIz/ srG2/6yrsP+trLL/r66z/6ytsf+xs7D/q7Cp/6eunP+fqI3/mKN7/5Sicf+Uo2j/lqZn/5ip Zf+Up2f/k6Zm/5OmZv+Tpmb/kqVl/5KlZf+SpWX/kaRk/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/ k6Zm/5OmZv+Tpmb/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/k6Zm/5Om Zv+Tpmb/kqVl/5KlZf+SpWX/kaNp/3qFWv9ASSr/V15M/1BVT/9maXD/X2Fu/1dZaP9aXWb/ Z2xo/9jfz//h6sv/nKd8/5ekbv+Ypmn/m6pp/5eoZP+aq2f/ma1o/5mtaP+ZrWj/mq5p/5qu af+arWv/m65s/5uubv+brm7/m65u/5uubv+brW//m61v/5utb/+brm7/nK9v/5yvbf+cr23/ nK9t/5yvbf+cr23/nK9t/5yvbf+esW//nrFv/56xb/+esW//nrFv/56xb/+esW//nrFv/56z cP+es3D/n7Rx/5+0cf+ftHH/oLVy/6C1cv+gtXL/n7Rx/5+0cf+gtXL/oLVy/6G2c/+htnP/ obZz/6G2c/+juHf/o7d4/6O3eP+jt3j/o7d4/6O3eP+jt3j/o7d4/6O3eP+jt3j/o7d4/6O3 eP+jt3j/o7d4/6O3eP+jt3j/o7l4/6G3dv+ftXT/obd2/6S4ef+jt3r/nLB1/5apcv+Dk2b/ anlS/0dUNv8sOCL/Higd/xskH/8eIyb/HyQq/xQYIf8VGSL/GBom/xocKf8eHSv/IB8v/yIh M/8jITb/HyA1/x0fNv8aHjf/Fx44/xQeOf8QHjj/Dx04/w0eOP8LHzr/Cx86/wsfOv8MIDv/ DCA7/wwgO/8NITz/DSE8/w0hPP8NITz/DSE8/w0hPP8NITz/DSE8/w0hPP8NITz/DSE6/w0h Ov8LIDv/CyA9/wofPv8HHj7/Bx4+/wgdPP8LID3/Ch45/xQkPf8qOUz/RVJi/15rdP98h43/ k5yh/6Wus/+qtrb/sr23/7bEs/+0wqn/qbqW/56vgv+VqnL/lKhp/5OqZv+TqGP/kqlh/5Kn Yv+RqGT/kqdk/5KnZv+TpmT/k6Zk/5KlY/+SpWP/kaRi/5GkYv+RpGL/kaRi/5GkYv+RpGL/ kaRi/5GkYv+RpGL/kaRi/5GkYv+RpGL/kKNh/5CjYf+PomD/j6Jg/46hX/+NoF7/jJ9d/4yf Xf+Mn13/jJ9d/4ueXP+KnVv/iZxa/4mcWv+Im1n/iJtZ/4OaVv+FnFj/h5xZ/4WaWf+Fl1v/ iZpk/4+ccf9CTS//ERgI/xIXEf8VFBn/FhUd/xgVHv8ZFh3/GRcc/xoYG/8ODg7/QEBA/+Hh 4f+Kior/sK+0/6uqr/+sq7H/rq2y/6ussP+vsa7/q7Cp/6atm/+fqI3/mKN7/5OhcP+Tomf/ laVm/5eoZP+Tpmb/k6Zm/5OmZv+SpWX/kqVl/5GkZP+RpGT/kaRk/5KlZf+SpWX/kqVl/5Kl Zf+SpWX/kqVl/5KlZf+SpWX/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/ k6Zm/5OmZv+SpWX/kqVl/5GkZP+RpGT/kaNn/5ikdP9OWDP/SlI7/1thV/9eYWb/Z2l2/2Jj df9gYnH/UFNY/4SJg//v9+L/v8mn/5Ofcf+dqnL/mKZo/5urav+aq2f/ma1o/5mtaP+ZrWj/ mq5p/5qta/+arWv/m65s/5uubv+brm7/m65u/5uubv+brW//m61v/5utb/+brW//nK9v/5yv bf+cr23/nK9t/5yvbf+cr23/nK9t/5yvbf+fsnD/n7Jw/5+ycP+fsnD/n7Jw/5+ycP+fsnD/ n7Jw/56zcP+es3D/n7Rx/5+0cf+ftHH/oLVy/6C1cv+gtXL/n7Rx/5+0cf+gtXL/oLVy/6G2 c/+htnP/obZz/6G2df+jt3j/o7d4/6O3eP+jt3j/o7d4/6O3eP+jt3j/o7d4/6O3eP+jt3j/ o7d4/6O3eP+jt3j/o7d4/6O3eP+jt3j/o7l5/6C2df+ftXT/oLZ1/6S4ef+itnn/nLB1/5Wo cf+ElGf/aHdQ/0NQMv8qMx7/Hycc/x8kIP8gJCf/HyIn/xgbIv8bGyX/HR0n/yEfKv8kIi// KCQz/yomN/8rKDn/IyE2/yAhNf8fHzf/Gh43/xgeOP8THTj/Ehw3/w4cN/8MHTf/Ch43/wsf Ov8LHzj/DCA7/wwgOf8MIDv/DCA5/wwgO/8MIDn/DCA7/wwgOf8MIDv/DCA5/wwgO/8MIDn/ DCA4/wwgOP8LHzj/CR45/wodO/8JHDr/CBs5/wgcN/8FFjL/CRsz/xkoPf8uO0z/P0tZ/09Z Y/9mb3b/e4SJ/3+KkP+Ik5f/lqKe/6Kwo/+ntp//pbaU/56xhP+ZrXj/kqds/5KoZ/+SqWP/ kahi/5GoYv+RqGL/kKdj/5CnY/+Sp2T/k6Zk/5KlY/+SpWP/kaRi/5GkYv+RpGL/kaRi/5Gk Yv+RpGL/kaRi/5GkYv+RpGL/kaRi/5GkYv+RpGL/kKNh/5CjYf+PomD/j6Jg/46hX/+NoF7/ jJ9d/4yfXf+Mn13/jJ9d/4ueXP+KnVv/iZxa/4mcWv+Im1n/h5xZ/4SZVv+Gm1j/h5xZ/4Wa Wf+Fl1v/iZpm/4+bc/9CTS//EhkJ/xQWEf8WFRr/FxYe/xgVHv8ZFh3/Ghgd/xoYG/8ODg7/ QEBA/+Dg4P+JiYn/r66z/6qprv+rqrD/rayx/6mqrv+usK3/q7Cp/6atm/+ep4z/l6J6/5Oh cP+Tomf/laVm/5eoZP+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5GkZP+RpGT/kaRk/5KlZf+SpWX/ kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5Om Zv+Tpmb/k6Zm/5KlZf+SpWX/kqVl/5GkZP+RpGT/kaNn/5ajbv9teE3/Uls+/1RbS/9JTUz/ Zmh0/2doev9VVmr/XF5r/1ZZXv+1u7H/1t7H/6+5lP+hrXv/nKpv/5ysbf+aqmn/maxq/5ms av+ZrGr/mq1r/5qtbf+arW3/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5utb/+brW// nK9v/5yvb/+cr2//nK9v/5yvb/+cr2//nK9v/5yvb/+fsnL/n7Jy/5+ycv+fsnL/n7Jy/5+y cv+fsnL/n7Jy/5+ycv+fsnL/oLNz/6Czc/+gs3P/obR0/6G0dP+htHT/oLNz/6Czc/+htHT/ obR0/6K1df+itXX/orV1/6K1df+ktnj/pLZ4/6S2eP+ktnj/pLZ4/6S2eP+ktnj/pLZ4/6S2 eP+ktnj/pLZ4/6S2eP+ktnj/pLZ4/6S2eP+jt3j/o7l5/6C2dv+etHT/oLZ2/6S4ef+itnn/ nK50/5ancf+IlWn/anZQ/0NOMP8oMBv/HiQY/yAiHf8hIiT/HyAl/x4eJv8gHyf/IyIq/yck Lf8qJzL/MCo2/zIsOv80Ljz/JyM0/yUiM/8kITb/Hh80/xsdNP8WHDT/FBo0/xAaNf8NHTb/ DB42/wwdN/8NHzf/DR44/w4gOP8OHzn/DiA4/w0eOP8NHzf/DR44/w0fN/8NHjj/DR83/w0e OP8NHzf/DR83/w0fN/8MHjb/CR02/wobNf8KGzf/CRo0/wkbM/8KGjP/Dh0y/x0qPf8xPU3/ QkxY/01WX/9aY2j/aHF2/2Jsdf9teH7/fYmJ/42akf+XppP/mqqN/5mrg/+Wqnf/kqdu/5Ko aP+RqGT/kahi/5GoYv+Qp2H/kKdh/5CnYf+Sp2T/kqdk/5GmY/+RpmP/kKVi/5ClYv+QpWL/ kKVi/5ClYv+QpWL/kKVi/5ClYv+QpWL/kKVi/5ClYv+QpWL/j6Rh/4+kYf+Oo2D/jqNg/42i X/+MoV7/i6Bd/4ugXf+LoF3/i6Bd/4qfXP+Jnlv/iJ1a/4idWv+HnFn/h5xZ/4SZWP+Hmlr/ iJtb/4aYWv+Hll3/i5lm/5Cbc/9DTDH/FBgK/xUXFP8WFRr/FxYe/xgXHf8YFx3/Ghgd/xoY G/8ODg7/QEBA/9/f3/+JiYn/r66z/6morf+qqa//rKuw/6mqrv+usK3/q7Cp/6atm/+ep4z/ l6J6/5OhcP+Tomf/laVm/5eoZP+Tpmb/kqVl/5KlZf+SpWX/kaRk/5GkZP+RpGT/kKNj/5Kl Zf+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/ k6Zm/5OmZv+Tpmb/kqVl/5KlZf+SpWX/kaRk/5GkZP+RpGT/kKJk/4uYYP+jr3//YWtI/zM7 JP9ZXlj/W15l/1FSZP9ub4T/ZWZ6/2JkcP9scHH/2N7Q/9bfwv+fqoD/oq96/5qpbv+aqmv/ maxq/5msbP+ZrGz/mq1t/5qtbf+arW3/m65u/5uubv+brm7/m65u/5uubv+brm7/m65u/5ut b/+brW//nK9v/5yvb/+cr2//nK9v/5yvb/+cr2//nK9v/5yvb/+fsnL/n7Jy/5+ycv+fsnL/ n7Jy/5+ycv+fsnL/n7Jy/5+ycv+fsnL/oLNz/6Czc/+gs3P/obR0/6G0dP+htHT/oLNz/6Cz c/+htHT/obR0/6K1df+itXX/orV1/6K1df+ktnj/pLZ4/6S2eP+ktnj/pLZ4/6S2eP+ktnj/ pLZ4/6S2eP+ktnj/pLZ4/6S2eP+ktnj/pLZ4/6S2eP+ktnj/o7d6/6C2eP+etHb/oLZ2/6O3 eP+itnn/nK50/5imcf+Jlmr/bHZR/0NML/8oLRn/HyIX/yEiHf8hISH/Hx4j/yEgJv8iISf/ JiQp/ywnLf8wKzH/NC01/zcwOP84MDv/KyMw/ykjMf8lITD/Ih8y/xwdMf8ZGzL/FRky/xIZ M/8OHTT/DB40/w0dNv8NHzX/Dh43/w0fNf8PHzj/DiA2/w4eN/8NHzX/Dh43/w0fNf8OHjf/ DR81/w4eN/8NHzX/DB40/wweNP8MHjT/Cx0z/wsbNP8KGjP/Cxox/woZLv8aJjz/FyQ1/x8r O/80Pkr/RU5X/0xVXP9TW17/WWJn/1VeZ/9eaHH/b3p8/4CNhv+Mmon/kqKH/5Olf/+SpXf/ kqZx/5KnbP+Rp2f/kahk/5CnY/+Qp2H/kKdh/5CnYf+Sp2T/kqdk/5GmY/+RpmP/kKVi/5Cl Yv+QpWL/kKVi/5ClYv+QpWL/kKVi/5ClYv+QpWL/kKVi/5ClYv+QpWL/j6Rh/4+kYf+Oo2D/ jqNg/42iX/+MoV7/i6Bd/4ugXf+LoF3/i6Bd/4qfXP+Jnlv/iJ1a/4idWv+HnFn/iJtb/4WX Wf+HmVv/ippc/4iYWv+Hll3/i5lo/5Cadf9DTDH/FBgK/xUXFP8WFRr/FxYe/xgXHf8ZGB3/ Ghgb/xsZHP8ODg7/QEBA/+rq6v+Hh4f/q6qv/6alqv+joqj/qKes/6iprf+kpqP/oaaf/56l k/+bpIn/l6J6/5Wjcv+VpGn/lqZn/5eoZP+SpWX/kqVl/5KlZf+SpWX/kqVl/5KlZf+SpWX/ kqVl/5OmZv+Tpmb/lKdn/5SnZ/+Up2f/laho/5WoaP+VqGj/lKdn/5SnZ/+Up2f/lKdn/5Sn Z/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5ima/+frHf/ k550/1RdQP8+RDb/VFhZ/1dZZv9kZXn/XV5z/2doev9UV17/gIV//+/34v/Fz6z/iZVn/5qp cv+frnP/l6pq/5yucP+esHL/nK5w/56wcv+crnD/k6Vn/52wcP+dsHD/nrFx/56xcf+esXH/ n7Jy/5+ycv+fsnL/m61v/5yucP+crnD/nK5w/52vcf+dr3H/na9x/52vcf+esHL/nrBy/56w cv+esHL/nrBy/56wcv+esHL/nrBy/6Cwcv+gsHL/oLBy/6Cwcv+hsXP/obFz/6KydP+isnT/ orJ0/6KydP+isnT/o7N1/6Ozdf+ktHb/pLR2/6S0dv+ks3j/pLN4/6SzeP+ks3j/pLN4/6Sz eP+ks3j/pLN4/6W0ef+ltHn/pbR5/6SzeP+ks3j/o7J3/6Oyd/+hs3f/orZ7/6S6fP+kuHv/ obV4/6S2ev+oun7/pLN6/5mncv+Ej2T/cHhT/1FYOf84Oyb/Kioe/yYlIP8mJSP/JiQn/ycl KP8kIiX/JSEi/ysnKP82MDL/PzY5/0A3Ov8/Njn/OC80/zApMf8oIiz/JSEv/yYjNP8mJDn/ IiM4/xwhN/8ZJTv/EiM3/xAfNv8QITX/FCM6/xIjN/8NHDP/Bxgs/w4dNP8NHjL/DRwz/wwd Mf8NHDP/Cxww/wwbMv8LHDD/Cx0x/wocMP8KGy//CRou/wkYLf8MGC7/Dhkt/w4ZK/8WHjH/ GyQz/yUtOv8yO0T/QUhQ/05VW/9XX2L/XGVq/1xlbv9faXL/ZnF1/3F9ef9+jH//i5qD/5Wm hP+brYP/k6d0/5Knbv+PpWf/jqRj/46lYf+Qp2P/kqlj/5SrZf+TqGX/lKdn/5SnZ/+Tpmb/ k6Zm/5OmZv+SpWX/kqVl/5KlZf+SpWX/kaRk/5GkZP+RpGT/kKNj/5CjY/+Qo2P/kKNj/4+i Yv+PomL/j6Ji/46hYf+OoWH/jqFh/46hYf+OoWH/jqFh/42gYP+Mn1//i55e/4qdXf+JnFz/ iJtb/42cYf+Il1z/iJZb/4mXXP+IlV//iJRk/5GZdP9LUDn/FBgK/xQWE/8WFRr/FhUd/xYV G/8XFhv/FxcZ/xcXF/8SEhL/QkJC/+np6f+Ghob/qqmu/6Wkqf+ioaf/p6ar/6anq/+jpaL/ oKWe/52kkv+ao4j/l6J6/5Sicf+Uo2j/laVm/5eoZP+RpGT/kaRk/5GkZP+RpGT/kaRk/5Gk ZP+RpGT/kaRk/5OmZv+Tpmb/k6Zm/5OmZv+Up2f/lKdn/5SnZ/+VqGj/lKdn/5SnZ/+Up2f/ lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5SnZ/+Up2f/lKdn/5im af+Zpm7/kJxs/3N9Wv9OVj//RktE/1hbYv9dX27/Y2R5/15fc/9gYm//bHBz/6Wrnf/r9Nn/ sr2V/42baP+Tomn/nrBy/5iqbv+hs3X/o7V3/5KkZv+Vp2n/nK5w/52vcf+dsHD/nbBw/56x cf+esXH/nrFx/5+ycv+fsnL/na9x/52vcf+dr3H/na9x/56wcv+esHL/n7Fz/5+xc/+fsXP/ n7Fz/5+xc/+fsXP/n7Fz/5+xc/+fsXP/n7Fz/6Gxc/+hsXP/obFz/6KydP+isnT/o7N1/6Oz df+js3X/o7N1/6Ozdf+ktHb/pLR2/6S0dv+ltXf/pbV3/6W1d/+ltHn/pbR5/6W0ef+ltHn/ pbR5/6W0ef+ltHn/pbR5/6a1ev+mtXr/prV6/6W0ef+ltHn/pbR5/6SzeP+itHj/orZ7/6S5 fv+jt3z/oLR3/6S2ev+ouoD/pLN8/5qmdP+IkWT/dHpU/1VaPP89Pyr/MjAk/zArJ/8wKir/ Lyss/yYlI/8jIiD/JSEe/y4rJv8/NzT/SEE7/0pBPP9HPTv/OzMx/zYtLv8wKi7/Lykz/zAs Ov8vLTv/Kyg7/yMmOf8dKDz/FSQ3/xAfNP8PHjH/ESA1/xIhNP8PHjP/Cxot/w4dMv8NHC// DRwx/w0cL/8MGzD/DBsu/wwbMP8LGi3/DB0v/wobLf8IGSv/CBgo/wsYKf8PGiz/Fh8w/xkg MP8cIjL/IScz/yoxO/82PUX/RUpQ/05WWf9YYGL/XGRn/1xlbv9faXL/Z3B1/3B8ev9+in7/ ipmE/5aliP+croj/laZ5/5Kmcf+RpWr/jqRk/4+kY/+PpmL/k6hl/5SpZv+Tpmb/k6Vn/5Wl Z/+TpWf/lKRm/5KkZv+To2X/kaNl/5OjZf+Ro2X/k6Nl/5CiZP+SomT/kKJk/5GhY/+PoWP/ kaFj/4+hY/+QoGL/jqBi/5CgYv+Nn2H/j59h/42fYf+QoGL/jZ9h/46eYP+LnV//jJxe/4mb Xf+Kmlz/iZlb/42aYv+IlV3/iZRc/4iVXf+Jk1//iZJl/5CXdf9KTzj/FBgK/xQWE/8WFRr/ FhUd/xcWHP8XFhv/FxcZ/xcXF/8SEhL/QkJC/+fn5/+EhIT/qKes/6Oip/+gn6X/paSp/6Sl qf+gop//nqOc/5yjkf+Zoof/laB4/5OhcP+Tomf/lKRl/5WmYv+Qo2P/kKNj/5CjY/+Qo2P/ kKNj/5CjY/+Qo2P/kKNj/5KlZf+SpWX/kqVl/5KlZf+Tpmb/k6Zm/5OmZv+Up2f/k6Zm/5Om Zv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/k6Zm/5OmZv+Tpmb/ k6Zm/5imaP+Uomf/jptm/5ahdv9qc1T/QEc3/1RYV/9TVl//Y2R2/1labv9jZHb/W15l/2Zr Zf/Z4cz/4+3L/5ekeP+YpnH/p7l9/5Ola/+TpWn/n7F1/5Wna/+XqW3/mqxu/5yucP+crnD/ nK9v/5yvb/+dsHD/nbBw/56xb/+esXH/nrBy/56wcv+esHL/n7Fz/5+xc/+gsnT/oLJ0/6Cy dP+gsnT/oLJ0/6CydP+gsnT/oLJ0/6CydP+gsnT/oLJ0/6Ozdf+js3X/o7N1/6S0dv+ktHb/ pLR2/6W1d/+ltXf/pLR2/6W1d/+ltXf/pbV3/6a2eP+mtnj/prZ4/6e3ef+ntnv/p7Z7/6e2 e/+ntnv/p7Z7/6e2e/+ntnv/p7Z7/6i3fP+ot3z/p7Z7/6e2e/+mtXr/prV6/6a1ev+ktnr/ obV6/6O4ff+jt3z/n7N4/6O1e/+nuX//o7J7/5mlc/+JkGT/dnpV/1pdQP9FRC//OjYq/zky LP85MS//NzEx/ycmIv8jIh3/JiMc/zQxKP9LRDr/WFJG/1lRRv9UTEH/Qzox/z43Mf87MzH/ OTM3/zs2Pf85NkH/NDJA/ywuPf8jLD3/GSY3/xEeMf8OGyz/EB0w/xMgMf8TIDP/Eh8w/w8c L/8PHC3/Dxwv/w4bLP8OGy7/Dhss/w0aLf8LGyv/DR4u/wobK/8HFyf/BxQk/wwYKP8WHy7/ ISc1/yctOf8lKTX/Ki43/zI3Pf88QUX/SEtQ/1JXWv9aX2L/XGRn/15lbf9faG//Z29y/296 dv99h37/ipeF/5ekiv+drYn/l6Z9/5Smdv+So23/j6No/4+hZf+Po2T/kqRm/5SmaP+Uo2j/ lKNo/5WjaP+Tomf/lKJn/5KhZv+ToWb/kqFm/5OhZv+SoWb/kqBl/5GgZf+SoGX/kJ9k/5Gf ZP+Qn2T/kZ9k/4+eY/+QnmP/j55j/4+dYv+OnWL/j51i/42cYf+PnWL/jZxh/42bYP+Lml// i5le/4mYXf+Jl1z/iZZe/46ZYf+Ikl3/iJFc/4iSXf+JkWD/iZBm/4+Vc/9JTTb/FhgL/xYW FP8WFRr/FhUd/xcWHP8XFhv/GBgY/xgYFv8SEhL/QkJC/+Tk5P+BgYH/paSp/6CfpP+dnKL/ oqGm/6Kjp/+eoJ3/naKb/5qhj/+XoIX/k552/5Gfbv+RoGX/kqJj/5OkYP+PomL/j6Ji/4+i Yv+PomL/j6Ji/4+iYv+PomL/j6Ji/5CjY/+Qo2P/kaRk/5GkZP+RpGT/kqVl/5KlZf+SpWX/ kaRk/5GkZP+RpGT/kaRk/5GkZP+RpGT/kaRk/5GkZP+SpWX/kqVl/5KlZf+SpWX/kqVl/5Kl Zf+SpWX/kqVl/5akZv+ToWT/kZ5m/6Gte/+JlGz/Vl9E/0pQRP9MUFP/WVto/11ecv9XWGz/ WVtn/11hYv+Fi3//6PDY/8PPqf+Uom//mqxy/52vdf+SpGr/ladt/6O1ef+fsXX/lqhs/5qs bv+arG7/m65u/5uubv+cr2//nK9v/5yvbf+cr2//nrBy/5+xc/+fsXP/n7Fz/6CydP+gsnT/ oLJ0/6CydP+hs3X/obN1/6Gzdf+hs3X/obN1/6Gzdf+hs3X/obN1/6S0dv+ktHb/pLR2/6S0 dv+ltXf/pbV3/6W1d/+mtnj/pbV3/6W1d/+ltXf/prZ4/6a2eP+mtnj/p7d5/6e3ef+ntnv/ p7Z7/6e2e/+ntnv/p7Z7/6e2e/+ntnv/p7Z7/6i3fP+ot3z/qLd8/6e2e/+ntnv/prV6/6a1 ev+ktnz/oLN7/6K3fv+itX3/n7N4/6K0ev+ot37/o7B7/5qkcv+Jj2P/eHpV/15fQP9JRzL/ QTsv/z41MP8+NDP/PDQy/ykpIf8lJxr/Kywe/z89Lv9ZVkX/a2ZT/21mVP9nYE7/VE09/0xE Of9DPDT/PTg1/z44Ov8/OkH/PDlC/zY4RP8nMD//Gyg4/xEeL/8MGSn/Dxwt/xMgMP8VIjP/ FSIy/w8cLf8PHCz/Dhss/w4bK/8OGyz/DRoq/w0aK/8NGiv/Dh4u/woaKf8IFSX/CBQi/xAZ KP8dJTL/LDA8/zY4RP8wMzz/NjY+/zw9Qv9DR0r/TFBT/1VZWv9bYWH/XmNm/2Bla/9iZm// Z2xw/3B2dP99hHz/jJWE/5mji/+hrI7/mqaA/5ilev+UonH/kqBr/5CfaP+RoGf/kqFm/5Sj aP+ToGj/k6Bo/5Wfav+Sn2f/lJ5p/5KfZ/+TnWj/kZ5m/5OdaP+Rnmb/k51o/5CdZf+SnGf/ j5xk/5GbZv+PnGT/kZtm/4+cZP+QmmX/jptj/5CaZf+NmmL/j5lk/42aYv+PmWT/jJlh/42X Yv+Kl1//i5Vg/4iVXf+Jk17/iJJd/42WYf+HkFv/ho9a/4ePXP+Hj2D/ho1j/42Scv9HSjX/ FhgN/xYWFP8XFhv/FxYe/xcWHP8YFxz/GBgY/xgYFv8SEhL/QkJC/+Hh4f9/f3//oqGm/52c of+amZ//n56j/5+gpP+bnZr/m6CZ/5ifjf+VnoP/kp11/4+dbP+PnmP/kKBh/5GiXv+OoWH/ jqFh/46hYf+OoWH/jqFh/46hYf+OoWH/jqFh/4+iYv+PomL/j6Ji/5CjY/+Qo2P/kKNj/5Gk ZP+RpGT/kKNj/5CjY/+Qo2P/kKNj/5CjY/+Qo2P/kKNj/5CjY/+RpGT/kaRk/5GkZP+RpGT/ kaRk/5GkZP+RpGT/kaRk/5SiZf+Vo2b/lqRp/5WibP+eqnr/fIZj/0ZOOf9MUUv/T1Jb/19g cv9NTmL/W11s/2Zpbv9QVU//rbSi/+Xw0P+dq3r/hJVe/6i5gv+hs3n/kaNp/6e5f/+esHT/ mqxw/5mrbf+Zq23/maxs/5qtbf+arWv/mq1r/5uubP+brm7/na9x/52vc/+dr3P/nrB0/56w dP+fsXX/n7F1/5+xdf+fsXX/n7F1/5+xdf+fsXX/n7F1/5+xdf+fsXX/n7F1/6Oyd/+ksnf/ pLJ3/6Syd/+ls3j/pbN4/6WzeP+mtHn/pLJ3/6WzeP+ls3j/pbN4/6a0ef+mtHn/prR5/6e1 ev+ntHz/p7R8/6e0fP+ntHz/p7R8/6e0fP+ntHz/p7R8/6i1ff+ntHz/p7R8/6e0fP+ms3v/ prN7/6aze/+ltHv/n7J6/6G2ff+htHz/nrF5/6K0ev+ntn3/oq96/5mjcf+HjWH/eHpV/2Bf Qf9NSDT/Qzsu/0A1L/8+MzH/PDIw/y4uIv8uMSD/ODkn/09OOv9qaFH/e3lg/4B8Y/98eF// a2VP/19YRv9OSDr/Qj41/z86N/9APD3/Pz1C/z09R/8pMT7/HSk3/xIeLv8OGij/ER0t/xUh L/8XIzP/FyMx/w8bK/8PGyn/Dxsr/w4aKP8OGir/Dhoo/w0ZKf8MGSn/Dh4t/wsbKv8KFyf/ Cxcl/xYeK/8kKjb/NDdA/z8/R/8+PUP/QUBF/0ZFSv9LTE7/U1RW/1dbWv9bYV//XmRk/2Jl av9jZm3/Zmpt/25ycf97gHn/i5GD/5qijf+iq47/nKaE/5qlff+WoXb/kp5u/5Ccav+QnWj/ kZ5o/5Seaf+TnWj/k51o/5Scaf+SnGf/k5to/5KcZ/+Smmf/kZtm/5KaZ/+Rm2b/kppn/5Ca Zf+RmWb/j5lk/5CYZf+PmWT/kJhl/4+ZZP+Pl2T/jphj/4+XZP+Nl2L/jpZj/42XYv+NlWL/ jJZh/4yUYf+KlF//iZFe/4eRXP+Hj1z/h49c/4qSX/+GjVr/hItY/4aNWv+Fi13/hYpi/4qP b/9ERzL/FxkO/xcXFf8XFhv/FxYe/xcYHf8XGBz/GBoZ/xgaF/8SEhL/QkJC/97e3v98fHz/ oJ+k/5uan/+Xlpz/nZyh/5ydof+Ympf/mZ6X/5eejP+TnIH/kJtz/42bav+NnGH/j59g/5Ch Xf+Mn1//jJ9f/4yfX/+Mn1//jJ9f/4yfX/+Mn1//jJ9f/42gYP+OoWH/jqFh/46hYf+PomL/ j6Ji/4+iYv+PomL/jqFh/46hYf+OoWH/jqFh/46hYf+OoWH/jqFh/46hYf+Qo2P/kKNj/5Cj Y/+Qo2P/kKNj/5CjY/+Qo2P/kKNj/5SiZf+WpGf/lqRn/4uZXv+ir3n/l6J3/1hhRP9TWUv/ S09S/1haZ/9RUmb/W1xu/2Jlbv9cYF//ZGpe/9HbwP/b6Lz/k6Rt/5mqc/+YqXL/j6Bp/5+x d/+Upmz/ladr/5iqbP+Yqmz/mKtr/5ira/+ZrGr/maxq/5msav+arW3/mqxu/5qscP+arHD/ m61x/5utcf+brXH/nK5y/5yucv+crnL/nK5y/5yucv+crnL/nK5y/5yucv+crnL/nK5y/6Gv dP+hr3T/oa90/6Kwdf+isHX/o7F2/6Oxdv+jsXb/oa90/6Kwdf+isHX/orB1/6Oxdv+jsXb/ o7F2/6Oxdv+ksXn/pLF5/6Sxef+ksXn/pLF5/6Sxef+ksXn/pLF5/6Wyev+ksXn/pLF5/6Sx ef+jsHj/o7B4/6OweP+hsHf/n7J7/6C1ff+gs3v/nbB4/6Oyef+otX//o615/5mhcP+KkGT/ fHxY/2ZiRf9TTDn/SD4y/0I3Mf9AMjH/OjEs/zM0JP85Pij/SU02/2BjSP94eFz/iYhq/5GO b/+TkHH/hH5k/3VxWP9hXEn/UExA/0hFPv9EQD3/Pz0+/zs8Qf8nLzr/HSk3/xQgLv8SHiz/ FCAu/xcjMf8XIzH/FSEv/w8bKf8PGyn/Dhoo/w4aKP8OGij/DRkn/w0ZJ/8MGif/Dh4t/w0d LP8OHCn/Ex0p/xwkL/8rLzr/OjpC/0JBR/9JR0z/S0lM/09NUP9SUlL/V1lY/1tdXP9dYWD/ X2Nk/2Rlav9lZmv/Z2hq/25wbf97fnf/i4+B/5ugjP+lq5H/oKeI/52lgP+ZoXr/lJ1y/5Kb bP+Rm2n/kZtp/5ObaP+Tm2r/kppn/5OZaf+Smmf/kpho/5GZZv+SmGj/kJhl/5GXZ/+QmGX/ kZdn/4+XZP+Qlmb/j5dk/4+VZf+OlmP/j5Vl/46WY/+PlWX/jZVi/46UZP+MlGH/jZNj/4yU Yf+MkmL/ipJf/4uRYf+IkF3/iI5e/4aOW/+GjFz/hoxc/4mPX/+Eilr/golW/4OJWf+DiVv/ g4hg/4iNbf9CRTD/FxkO/xcXFf8XFhz/GBcf/xcYHf8YGR3/GBoZ/xgaF/8SEhL/QkJC/9zc 3P96enr/np2i/5iXnP+VlJr/m5qf/5qbn/+WmJX/mJ2W/5Wciv+Sm4D/jplx/4yaaf+Mm2D/ jZ1e/46fW/+Lnl7/i55e/4ueXv+Lnl7/i55e/4ueXv+Lnl7/i55e/4yfX/+NoGD/jaBg/42g YP+OoWH/jqFh/46hYf+OoWH/jaBg/42gYP+NoGD/jaBg/42gYP+NoGD/jaBg/42gYP+Qo2P/ kKNj/5CjY/+Qo2P/kKNj/5CjY/+Qo2P/kKNj/5WjZv+Rn2L/kZ9h/5CeYP+Zp2z/mqZ0/3yG Yf9dZVD/SU1M/09RXf9ZWmz/Xl9x/2JkcP9na27/TVJL/42Xf//w/dL/wdKc/5Kjbf+ImWL/ kaJr/5Ola/+TpWv/kqRo/5aoav+XqWv/l6pq/5eqav+Yq2n/mKtp/5iraf+ZrGz/lqhq/5ep bf+XqW3/l6lt/5iqbv+Yqm7/mKpu/5iqbv+Zq2//matv/5mrb/+Zq2//matv/5mrb/+Zq2// matv/56scf+erHH/nqxx/5+tcv+frXL/n61y/6Cuc/+grnP/nqxx/56scf+erHH/n61y/5+t cv+grnP/oK5z/6Cuc/+grXX/oK11/6Ctdf+grXX/oK11/6Ctdf+grXX/oK11/6Gudv+hrnb/ oa52/6Ctdf+grXX/n6x0/5+sdP+erXT/nrF6/6C1ff+fsnr/nK93/6Kxev+ntH7/o615/5ig b/+SmGz/hIRg/21pTP9aU0D/TUM3/0g7Nf9DMzP/OzIt/zk6Kv9FSjP/W19E/3F0V/+EhWb/ kpJw/56beP+lon//lpN0/4qGaf95dF7/aGVU/1pYTP9NSkX/Pj07/zM0OP8kLDf/HCg2/xcj Mf8WIjD/GSUz/xklM/8WIjD/Eh4s/w8bKf8OGij/Dhoo/w4aKP8NGSf/DRkn/w0ZJ/8LGSb/ Dh4t/w8fLv8TIS7/GiQw/yMqNP8wMzz/OzpC/0E+Rf9QTlP/UlBT/1RSVf9XV1f/Wlxb/11f XP9dYl7/X2Ni/2Vmav9lZGn/Z2dn/21uaf96e3P/i42A/5yfjP+mqpP/oqaL/5+lg/+aoHz/ lZxz/5KZbf+RmWr/kZlq/5Kaaf+SmGr/kpho/5SXav+Rl2f/k5Zp/5GXZ/+SlWj/kJZm/5KV aP+Qlmb/kZRn/4+VZf+RlGf/jpRk/5CTZv+OlGT/kJNm/46UZP+PkmX/jZNj/46RZP+MkmL/ jpFk/4ySYv+Mj2L/ipBg/4uOYf+Ijl7/iIte/4WLW/+GiVz/hola/4mMXf+Eh1j/goVW/4SH WP+Bh1n/gYZe/4eKbf9BQy7/FxkO/xgYFv8YFx3/GBcf/xgZHv8YGRv/GBoZ/xgaF/8SEhL/ QkJC/9za3f96eHv/nJug/5eWm/+Uk5n/mpme/5manv+Vl5b/l5yV/5WcjP+RmYH/jph1/4yY av+MmWT/jZtg/4+dYP+OnGH/jZxh/42cYf+NnGH/jZxh/42cYf+NnGH/jZxh/46dYv+OnWL/ jp1i/4+eY/+PnmP/j55j/5CfZP+Qn2T/kJ5j/5CeY/+QnmP/kJ5j/5CeY/+QnmP/kJ5j/5Ce Y/+SoGX/kqBl/5KgZf+SoGX/kqBl/5KgZf+SoGX/kqBl/5mjbv+PmmL/jZhe/52mbf+RmmP/ lJxr/52jff9na1T/SUxD/0xNUf9hYWv/ZmZy/2tud/9XW17/XWFg/1FZSv+5x6b/3+7F/6i1 iv+RnnL/maZ4/42ZZ/+frHf/nqt1/5mnbP+Zp2z/madq/5qoa/+ZqWv/mqps/5qpbv+aqW7/ lqVu/5ekbv+YpW//mKVt/5ilbf+Zpm7/maZu/5mmbv+Zpm7/m6Zu/5umbv+bpXD/m6Vw/5ul cP+bpXH/m6Vx/56odP+eqHT/nqh0/5+pdf+fqXX/n6l1/6Cqdv+gqnX/nqhz/56oc/+eqHP/ nqlx/6Cpcv+gqXL/oapz/6Gqc/+hqXb/oal2/6Gpdv+hqXb/oal2/6Gpdv+hqXb/oal2/6Kq d/+iqnf/oal2/6Gpdv+hqXb/oKh1/6Codf+fqXX/oK57/6OxgP+isH3/oKx6/6Wvff+qsoH/ pKp8/5uec/+bnHT/jIlo/3VwU/9gWEP/VEg6/0w+Nf9FNi//PjQr/z49Kf9OUjn/Z2pN/31+ X/+Li2n/mJVy/6ehff+xq4f/oZt5/5iTdf+LhnD/e3hl/2poXP9UVEz/PT45/ysvMv8iKjX/ Gyc3/xgkNP8ZJTX/Hic4/x0mN/8XIDH/Ehss/xAZKv8QGSr/EBko/w8YJ/8NGSf/DRkl/wwY JP8MGCT/ER0r/xMfK/8ZIy3/Hygx/yktNv80NTr/OzpA/z89Qv9XUlb/VlRV/1hWV/9ZWVn/ W11c/1xgX/9eYmH/X2Ni/2Vmav9kZWn/ZmZm/2ttav95enT/i42C/5yfjv+nqpX/o6WN/6Cj iP+dnn//mJl3/5aWcv+UlG7/lJRu/5eVbv+WlG3/lpRt/5aUbf+WlG3/lZNs/5WTbP+Vk2z/ lJJr/5SSa/+Ukmv/lJJr/5ORav+TkWr/k5Fq/5KQaf+SkGn/kpBp/5KQaf+Rj2j/kY9o/5GP aP+Qjmf/kI5n/5COZ/+OjGX/joxl/42LZP+MimP/i4li/4mHYP+Jh2D/iIZf/4uJY/+GhF7/ hIJb/4aEXf+Dg13/g4Nh/4iIbv9CQDH/GRkR/xkXGP8YFx3/GBcf/xgZHv8YGRv/GBoZ/xkb GP8SEhL/QkJC/+Db4f94c3n/mZec/5eUm/+Qj5X/kZCV/5KTl/+UmJf/jY+K/42Qhf+MkX3/ jZF2/42Tb/+Nkmn/jZNj/42UYf+JkWD/ipJh/4qSYf+KkmH/i5Ni/4uTYv+Lk2L/i5Ni/4qS Yf+Lk2L/i5Ni/4yUY/+NlWT/jpZl/46WZf+Pl2b/j5Vl/4+VZf+PlWX/j5Vl/4+VZf+PlWX/ j5Vl/4+VZf+Qlmb/kJZm/5CWZv+Rl2f/kZdn/5GXZ/+SmGj/kpho/5SXbP+Ul2z/lJdq/5aX bf+Wl2//l5dx/5eWd/+XlXz/bGtZ/1BQRv9LSkb/V1dX/1xdX/9gZGf/YGVo/1RdWv9cZl3/ 4ena/9LZx/+TmIH/lZp8/52hfP+go3j/n6Fy/5yebP+cn2r/m59s/5mgbP+ZoW7/mKJw/5mi c/+ZonX/maB0/5qgdP+aoHL/mqBw/52hb/+doW//n6Fv/5+hb/+cnmz/pKNz/6OidP+cm2// npty/6Sgev+moHz/npt4/6Chf/+do3//nqSA/6Cmgv+jp4L/oqaB/6Kkff+foXn/n6J3/5+i d/+fonX/oaR1/6Smd/+mqHn/p6l4/6iqe/+io3n/o6R8/6OkfP+jpHz/pKV9/6Slff+kpX3/ paZ+/6OkfP+jpHz/o6R8/6OkfP+jpHz/o6R8/6OkfP+jpHz/pKZ//6Smf/+kpn//pKZ//6Wl gf+lpYH/p6SB/6ikgf+dl3f/l45x/4t/Z/98cFr/cGFO/2ZXRP9fTz//Wk08/21oUv9yclj/ g39i/5KNb/+gl3b/ppx5/6uce/+rnHv/qp19/6qfg/+fl4L/jId0/3p4bP9mZ1//SEpH/yov Mv8bIzD/GiI1/xoiNf8aIjX/GiA2/xogNv8aIDb/GiA2/xIZLP8SGSz/Exos/xQbK/8UHir/ FiAq/xchKv8XISr/Hygx/yEqM/8mLTX/LTI4/zU2O/87Oz3/QD5B/0JAQf9WVFX/V1VW/1lX WP9aWlr/XF5d/1xgYf9dY2P/XmNm/2Jlav9kZ2z/Z2hs/2VpaP9sbmv/eHt0/4uNgv+Zmoz/ oaCO/56biP+cloD/m5B6/5qOdv+cjXb/n494/6CQd/+Yim//lott/5aLbf+Vimz/lYps/5SJ a/+UiWv/lIlr/5SJa/+UiWv/k4hq/5OIav+TiGr/kodp/5KHaf+Sh2v/kIVp/5CEav+QhGr/ kIRq/4+Daf+Pg2n/j4Np/46CaP+NgWf/jYFn/4yAZv+Lf2X/in5k/4p+ZP+JfWP/iX1l/4l6 Z/+IeWb/intm/4h8ZP+DeWD/gHhh/4mCcP9GPzX/GxYT/xsWGv8cGSD/HBsj/xscIf8aGx// FRka/xYYF/8WFhb/QkJC/+Ha4f94c3n/l5Sb/5WSmf+PjpT/j46U/5GSlv+SlpX/jI6J/4yP hP+Mj37/jY93/4+Qcf+OkGv/j5Bm/4+QZv+Mj2T/ipBk/4yOZv+LkWX/jY9n/4uRZf+OkGj/ jJJm/42PZ/+LkWX/jpBo/42TZ/+Qkmr/jpRo/5GTa/+RlGn/kpNr/5KTaf+Ukmv/kpNp/5SS a/+Sk2n/lJJr/5KTaf+Vk2z/k5Rq/5WTbP+UlWv/lpRt/5SVa/+XlW7/lZZu/5eVb/+XlW// l5Vv/5mVcv+ZlHT/mpV3/5uUeP+alHr/gXxo/11aSf9LST3/U1JN/11fXv9eYmP/XGFl/1df Yv9TW17/mJ6e//H28P+4uq3/kJJ9/5CPc/+in3z/nJlw/5+cb/+fnW3/n5xv/5+ecP+dnnT/ mp92/5ufev+bn3r/nJ55/52dd/+dnnb/oJ51/6Cfc/+hoHL/oqBw/6KgcP+uqn3/op1z/52V cP+hmXX/pJt8/6OYfP+lmX//qaKI/52bgv+Ym4D/lZh9/5WYe/+amn7/n6CB/6SjhP+np4X/ np58/5ycdv+cmnT/npx1/6Kgd/+lo3r/pqN4/6Wief+loXz/pqJ//6ahgf+mon//p6KC/6ej gP+nooL/qKSB/6eigv+no4D/p6KC/6ejgP+nooL/p6OA/6eigv+nooL/qKOD/6ekg/+npIP/ qKOD/6ijhf+pooX/qaKF/6uihf+rn4X/pZl//5yNdv+PgGn/hHRd/3trVP91ZFD/cmNO/3hy Wv9+el//jIVp/5qRdP+mmXn/rJ18/66eff+tnXz/rZyA/62fhf+jmIT/j4l5/3t7b/9laGH/ RUtJ/ygwM/8cJDH/GyM2/xoiNf8bITf/GiA2/xofNf8aHjf/GR40/xIXLf8TGCz/FRsr/xYe K/8YICv/GSMs/xsmLP8dJi3/KC83/ywwOf8wMzr/NTg9/z49Qv9DQ0P/SEZH/0pJR/9XVlT/ WFdV/1lZWf9aXFv/XF1f/11hYv9dYmX/XmNm/2Jlav9kZ2z/ZGhr/2Roaf9obGv/c3hy/4aH f/+Tk4f/nZuO/52Xh/+dkYH/nIx8/5yJeP+finn/oYp6/6KLef+aiHL/mYlw/5mJcP+YiG// mIhv/5iIb/+Xh27/l4du/5eHbv+Xh27/l4du/5aGbf+Whm3/lYVs/5WFbP+VhW7/lINv/5OC bv+Tgm7/k4Ju/5KBbf+SgW3/koFt/5KBbf+Qf2v/kH9r/49+av+Pfmr/jn1p/418aP+Me2f/ jHtp/412bv+MdW3/jHht/4x7a/+Id2f/hHdm/4yAdP9IPzj/HhQT/x0XG/8eGSD/HRwk/x0c Iv8aGx//Fhob/xQYF/8XFxf/Q0ND/+Ld4/93cnj/lJKX/5GPlP+Mi5H/jYyS/46Pk/+QkZP/ ioyH/4qNgv+KjXz/i411/42Ob/+NjWn/j41m/42OZP+MjWX/i41l/4yMZv+Mjmb/jY1n/4yO Zv+Ojmj/jY9n/42NZ/+Nj2f/jo5o/46QaP+QkGr/kJJq/5GRa/+Sk2v/lJJs/5SSa/+VkWz/ lJJr/5WRbP+Ukmv/lZFs/5SSa/+Wkm3/lZNs/5aSbf+WlG3/l5Nu/5aUbf+YlG//l5Vv/5iU b/+YlHH/mJRx/5qUcv+alHT/m5R3/52TeP+bk3z/lo98/3NtXf9RTUL/T0xF/1paWP9bXF7/ WFtg/19kaP9aYmX/XmRk/7/EwP/r7uP/k5SC/5iWff+bmHn/lJBr/6Cbc/+gm3H/oZxy/6Cd dP+fnXb/np54/56efP+ennz/oJ18/6Cdev+gnnj/op54/6KeeP+in3b/o6B1/6Ogdf+fnHP/ o595/6agfv+mn4L/pp+F/6idh/+nnIj/oZqH/6qplP+oqpT/p6mT/6Smjv+ioor/n5+F/5yc gP+cnX7/m5p8/6Cgfv+opYT/p6SB/6Kgev+gnnj/pKJ7/6qmgf+loID/p6GB/6egg/+noYH/ qKGE/6iigv+ooYT/qaOD/6ihhP+oooL/qKGE/6iigv+ooYT/qKKC/6ihhP+nooT/qKOF/6ij hf+oo4X/qaKF/6mihv+roYb/q6GG/6yghv+ypo7/r6CJ/6iXg/+fjnr/l4Zy/5GAbP+OfGj/ intm/4mBav+Nh23/l5B0/6OYfP+rnYD/r6CB/7Cfgf+vnoL/rZuD/62eif+lmYn/k42B/3x8 dP9hZmL/QElI/ycwNf8cJjL/HCU2/xwjNf8bIjX/GiE0/xkgM/8ZHjT/GR4y/xQZLf8VGi3/ Fx4u/xoiL/8eJzD/ISox/yItM/8lLjP/MjlB/zY6Q/86PUT/P0JH/0hHTP9NTU3/UlBR/1ZS Uf9cWFX/WllV/1tbWf9bXVr/XV9e/11hYP9dY2P/XmNm/2Jlav9jZmv/Y2dq/2JmZ/9kaGf/ bXJs/31+eP+JiX//mJaJ/5mTg/+Yj37/mIt6/5qJd/+diHf/n4h4/5+Idv+biXP/mYly/5mJ cv+ZiXL/mIhx/5iIcf+YiHH/mIhx/5eHcP+Xh3D/l4dw/5eHcP+Whm//loZv/5WFbv+VhW7/ lINv/5SDb/+Ug2//k4Ju/5OCbv+SgW3/koFt/5KBbf+RgGz/kH9r/5B/a/+Pfmr/jn1p/418 aP+NfGj/jHtp/412bv+MdW3/jHht/4x7a/+Id2f/hHdm/42Bdf9IPzj/HhQT/x0XG/8eGSD/ HRwk/x0cIv8aGx//Fhob/xQYF/8XFxf/Q0ND/+Pe5P91cHb/j42S/4uJjv+Ih43/iomP/4qL j/+LjI7/h4mE/4iKf/+Jinr/iol0/4uKbP+MiWb/jIpj/4yKY/+MimT/jYpn/42KZ/+Nimf/ joto/46LaP+Oi2j/j4xp/4+Maf+PjGn/j4xp/5CNav+Rjmv/ko9s/5KPbP+TkG3/lZFu/5aQ bv+WkG7/lpBu/5aQbv+WkG7/lpBu/5aQbv+XkW//l5Fv/5eRb/+YknD/mJJw/5iScP+Zk3H/ mZNx/5mTcf+Zk3H/mZNz/5yTdP+ck3T/nZR3/56SeP+dknz/oJiF/42Gdv9nYFb/UUxG/1RT T/9WVlb/WFld/2RnbP9lam7/Ulpc/3F1dP/m6eL/wMGz/5+diP+ZlXr/mJJy/6Obd/+jm3b/ o5t2/6Obd/+inHr/opx8/6Kdf/+inX//op1//6Odff+jnXv/op57/6Seev+jn3r/pKB7/6Sg e/+rp4T/pJ+B/5+aff+hm4P/qaKP/7Krmf+5saT/u7Wn/7++rP/Cw7H/xca0/8LEr/+7uqb/ sbCb/6mok/+mpo7/oJ6F/6Khhf+loYT/paKD/6Wig/+mo4L/qKWE/6umhv+mn4L/qaCD/6mf hP+poIP/qqCF/6qhhP+qoIX/q6KF/6qghf+qoYT/qqCF/6qhhP+qoIX/qqGE/6qghf+ooYT/ qqOG/6qjhv+qo4b/rKKH/6yih/+soof/raGH/62hif+woYr/rp+I/6uahv+mlYH/oZB8/52M eP+ciXj/mYh0/5uQev+clH3/pJqB/6qehP+voYb/saGH/7Gghv+vn4b/q5uE/6mci/+imIz/ kY2E/3l6df9aXl//O0NG/yYvNv8dJzH/HScz/x0kNP8dJDT/HCM1/xsiNP8cITT/HCE0/xke Mf8bITH/HSUy/yEpNP8mLzb/KjM4/yw3O/8vOD3/O0BG/z5BSP9CRUr/SUpO/09PUf9VU1T/ W1dW/11ZVv9fW1j/X1tY/15dWf9eXlz/XmBd/11hYP9eYmP/X2Nk/2FlaP9jZ2r/Y2dq/2Fl Zv9hZWT/aWtm/3Z3cf+AgHb/kpCD/5SOgP+VjH3/l4p6/5mIeP+ch3b/nYZ2/52Gdv+biXX/ mol1/5qJdf+ZiHT/mYh0/5iHc/+Yh3P/mIdz/5iHc/+Yh3P/l4Zy/5eGcv+XhnL/loVx/5aF cf+WhXH/lINv/5SDb/+Ug2//lINv/5OCbv+Tgm7/koFt/5KBbf+RgGz/kYBs/5B/a/+Pfmr/ jn1p/459af+NfGj/jXxs/453b/+Ndm7/jXlu/4x7a/+Id2f/hHdm/42Bdf9IPzj/HxUU/x0X G/8fGiH/HRwk/x0cIv8bHCD/Fhob/xUZGP8XFxf/Q0ND/+Xg5P90b3P/ioiN/4aEif+Eg4n/ h4aM/4aHi/+Gh4n/hYWD/4WGfv+Gh3n/h4Zx/4iHa/+Kh2b/ioZh/4uFYf+Nh2X/jYdn/42H Z/+OiGj/joho/4+Jaf+PiWn/j4lp/5CKav+Qimr/kIpq/5GLa/+SjGz/k41t/5ONbf+Ujm7/ mI9w/5iPcP+Yj3D/mI9w/5iPcP+Yj3D/mI9w/5iPcP+ZkHH/mZBx/5mQcf+akXL/mpFy/5qR cv+bknP/m5Jz/5uSc/+bknP/m5J1/52Sdv+dknb/npN3/6CSeP+eknz/oZSB/6KWhv+FfXL/ YFlR/1NOSv9TT07/WFZZ/2Vmav9eY2f/WWFk/2FlZv+anJf/8vLo/66rmv+bloD/oJl//6Oa ff+kmXv/pZp8/6WafP+nmX7/ppt//6aagP+lm4D/ppyB/6adgP+mnYD/pJ2A/6eegf+lnoH/ pJ+B/6Wgg/+no4j/n5qE/6ijj//CvKz/zsq+/87Kv//Uz8n/4d7V/+7u4v/2+Ov////0//// 8//4+ev/7O3d/+fl1v/k49H/xMGu/7OxnP+hn4r/m5mC/6OeiP+qpo3/qaWM/6aghv+onoX/ qp6E/6qehv+qnoT/q5+H/6ufhf+rn4f/rKCG/6ygiP+soIb/rKCI/6yghv+soIj/rKCG/6yg iP+soIb/raGH/6yih/+soof/raGJ/62hif+toYn/r6CJ/6+gi/+unYn/rp2J/62civ+sm4n/ q5iH/6mWhf+nlIX/pZSC/6ebhf+onYf/q5+H/6+hh/+xoYj/saGI/7Cgif+vnor/qZmJ/6SY iv+bkon/ioeC/25wb/9NUlb/MTpD/yMtN/8eJjH/Hycy/x8nNP8gKDX/ISg4/yEoOP8iKTn/ Iik5/yIpOf8kLDn/Jy86/ys0Pf8wOUD/ND1C/zdBQ/86QkX/P0JH/0NESf9HSE3/TUxR/1RS U/9bV1b/XlpX/2FcWP9jXlr/Yl9a/2JfWv9hYFz/YGBe/2BiX/9gYmH/YGFj/2FiZv9kZWn/ ZWZq/2NkZv9jZWT/Z2lk/3Jzbf97e3P/joyA/5GLf/+Ui3z/l4p6/5qJef+chnj/nYZ2/5uG df+ciXj/mol3/5qJd/+aiXf/mYh2/5mIdv+ZiHb/mId1/5iHdf+Yh3X/mId1/5eGdP+XhnT/ l4Z0/5aFc/+WhXP/lYRy/5WEcv+Ug3H/lINx/5SDcf+TgnD/k4Jw/5OCcP+RgG7/kYBu/5GA bv+Qf23/j35s/459a/+OfWv/jXxs/453b/+Ndm7/jXlu/418bP+JeGj/hXhn/46Cdv9JQDn/ HxUU/x4YHP8fGiH/Hh0l/x4dI/8bHCD/Fxsc/xUZGP8YGBj/RERE/+fi5v9ybXH/hYOI/4B+ g/+Af4X/hIOJ/4OEiP+BgoT/g4OB/4OCff+Fg3b/hoNw/4eDav+Ig2X/iYNh/4qBYP+OhWj/ j4Np/4+Daf+Pg2n/kIRq/5CEav+RhWv/kYVr/5KGbP+Shmz/k4dt/5OHbf+UiG7/lYlv/5aK cP+WinD/mY1z/5mNc/+bjXP/mY1z/5uNc/+ZjXP/m41z/5mNc/+cjnT/mo50/5yOdP+bj3X/ nY91/5uPdf+ekHb/nJB2/56Qdv+ekHX/npB1/5+Rdv+gkHb/oZF4/6GRev+gkXz/n5B9/6ib i/+dkIf/enFq/15WU/9STUr/V1NU/2BgYv9XXGD/YWls/15iY/9dX1z/2dnR/+Tg1f+fmYn/ nJSB/6SZhf+nmIH/p5iB/6iYgf+pmYL/qpiC/6mYhP+qmoP/qZqD/6ichP+onIT/qJyE/6ie hf+onYf/pp6H/6agiv+fmof/ureo/8XBtf+sqaD/ko+K/42MiP+XlpT/nJuZ/6GinP+5urL/ 2dnR/+/v5//29u7/9PTq//Xy6f/29Oj/7+vf/+Pg0f/Oy7z/trOi/6agkP+gmor/pJ+M/6uk kf+pnIn/rJ2I/62ciP+snYj/rp2J/62eif+unYn/rp+K/6+eiv+un4r/r56K/66fiv+vnor/ rp+K/6+eiv+un4j/r6CJ/62hif+voIn/raGJ/6+gif+voIv/r6CL/6+gi/+vnoz/saCO/7Oi kP+0o5P/taKT/7Ogkf+xno//r56O/6uei/+soIr/rp+K/66fiP+vn4j/r5+I/66di/+tnY3/ pZeK/5uRh/+QiIX/fHt5/11gZf88Q0v/Jy86/yErN/8eJzD/Hygv/yEqM/8kLDf/Jy86/yoy P/8sNEH/LDZC/zA4Rf8xOUT/ND1G/zdAR/86Q0j/PkhK/0BKS/9DS03/Q0dK/0hHTP9MS1D/ UlBT/1lVVP9fWlf/Y15a/2VgWv9oYF3/ZmFb/2ZhXf9lYl3/YmFd/2FhX/9hYV//YGJh/19g Yv9iY2X/ZWZo/2VnZv9kZmX/aGpn/3Fybf96eXT/i4h//5CJf/+Uin7/mYt+/52Lff+dinv/ nYd5/5yGeP+ciXr/m4p6/5uJe/+aiXn/moh6/5mIeP+Zh3n/mYh4/5mHef+ZiHj/mIZ4/5iH d/+XhXf/l4Z2/5eFd/+Xhnb/lYRy/5WEcv+VhHL/lYRy/5SDcf+Ug3H/k4Jw/5OCcP+SgW// koFv/5GAbv+Qf23/j35s/49+bP+OfWv/jn1t/494cP+Od2//jnpv/418bP+JeGj/hXhn/46C dv9JQDn/HxUU/x4YHP8gGyL/Hh0l/x4dI/8cHSH/Fxsc/xUZGP8YGBj/RERE/+jj5/9xbHD/ goCF/3x6f/99fIL/goGH/4CBhf99foD/gICA/4GAe/+DgXX/hIFw/4aAaP+HgGT/h4Fh/4h/ YP+QgWr/kIFs/5CBbP+QgWz/kYJt/5GCbf+Sg27/koNu/5OEb/+ThG//lIVw/5WGcf+VhnH/ lody/5eIc/+XiHP/m4x3/5uMd/+ci3f/m4x3/5yLd/+bjHf/nIt3/5uMd/+djHj/nI14/52M eP+djnn/no15/52Oef+fjnr/no96/5+PeP+fj3b/n492/6CQd/+hj3f/opB4/6KQev+ikHz/ oo9+/6GRgv+klov/mIuD/3JpZP9VTUr/UkxM/1lXWv9bXmP/Ympt/1NXWv9UVlX/iYqF/+vo 4f/BurD/nZOH/6WXiv+nl4j/qJeH/6qXhv+sl4b/rJeG/66Xh/+tmIf/rJqG/6uahv+sm4f/ q5yJ/6mcif+pnoz/p56P/6aekf+zrKL/s6+m/4qJhP9AQD7/FBQU/xkYHf8pKi//Kyww/y8v L/9JSUf/bW1r/4uMh/+ioZ3/trWw/8rJxP/Y2ND/5eLb/+rn3v/p5dz/19PK/725sP+qppv/ paGW/6ujmP+rm4z/rZyK/66biv+tnIr/r5yL/66di/+vnIv/r56M/7Gejf+wn43/sZ6N/7Cf jf+xno3/sJ+N/7Gejf+wn43/saCM/7ChjP+xoIz/sKGM/7GgjP+xoI7/saCO/7Ggjv+unY3/ sJ+P/7Sjk/+2pJb/uKWX/7ajlf+0oZP/sZ+R/62ei/+snYr/rJ2K/6ucif+sm4n/rJuJ/6ub jP+rm47/oZSL/5SLhP+DfX3/bW1v/05RWv8sND//HSY1/x8pNf8eJS3/ICct/yQrM/8oMTj/ LTY//zE7Rf81P0n/NUJL/zxGUP88Rk//PkhR/0FKUf9DTFH/Rk5R/0hQUv9LUVH/SktN/01N T/9SUFP/WVVW/19aV/9mXlv/amNd/2xlXf9rYl3/amNb/2liXP9nYlz/ZWJd/2JhXf9hYl3/ YWFf/15eXv9iYmL/ZmZm/2dnZ/9oaGj/bGxq/3R0cv98e3f/ioeA/5CJgf+VjYL/m4+D/5+P gP+gjX7/oIp8/56Iev+ciXv/m4l7/5uJff+aiHr/moh8/5qIev+Zh3v/mYd5/5mHe/+Zh3n/ mYd7/5iGeP+Yhnr/l4V3/5eFef+XhXf/loV1/5aFc/+VhHL/lYRy/5SDcf+Ug3H/lINx/5SD cf+SgW//koFv/5GAbv+RgG7/kH9t/49+bP+OfWv/jn1t/494cP+Od2//jnpv/459bf+KeWn/ hnlo/4+Dd/9KQTr/IBYV/x8ZHf8gGyL/Hx4m/x8eJP8cHSH/GBwd/xYaGf8ZGRn/RUVF/+nk 6P9ubG//gH6D/3p4ff97eoD/gYCG/3+AhP97fH7/f39//4B/e/+Df3b/hX9x/4Z+af+IfmP/ h35h/4h9Yf+Qf2v/kH9t/5J/cP+RgG7/kn9w/5KBb/+TgHH/koFv/5WCc/+Ug3H/loN0/5WE cv+XhHX/l4Z0/5iFdv+Yh3X/nYp7/5yLef+dinv/nIt5/52Ke/+ci3n/nYp7/5yLef+ei3z/ nYx6/56LfP+ejXv/n4x9/56Ne/+gjX7/n458/6COev+gjnj/oI54/6GPef+jjnn/pI96/6SP ev+kj3z/qZSD/5iGeP+llIr/q52U/4R5c/9YT0r/T0dF/1RQUf9eYmX/Wl9j/1xgY/9ZWlz/ VlZW/6mlov/07On/rKGd/6WWj/+nlo7/qZeN/6yWi/+tlYn/sJaJ/7CWif+wlon/r5qJ/62a if+sm4n/q5uL/6ycjf+pnZH/p52T/6afl/+fmpb/WlZT/yAeH/8aGx//IyQp/xgbIv8QExz/ FBce/xITF/8XFxf/Ghoc/xsbG/8lIyT/Pz0+/2VkYv+BgH7/t7Ow/725tv/KxcL/2NPQ/9zX 0//Mx8P/r6qm/5qRiv+rm47/rpuM/66bjP+um4z/r5yN/6+cjf+vnI3/sJ2O/7Gej/+xno// sZ6P/7Gej/+xno//sZ6P/7Gej/+xno//saCO/7Ggjv+xoI7/saCO/7Ggjv+xoJD/saCQ/7Gg kP+qmIr/rJqM/7CekP+zoZX/tKKW/7KglP+wnJH/rZuP/6ubi/+qmor/qZmJ/6mZif+omIn/ qZmK/6qajf+ompH/npON/4+HhP97d3j/ZWRq/0NHUv8jKTf/GCEw/x0nM/8eJSv/Iicr/yUt MP8qMzj/MTpB/zdBSv86R0//PElS/0JPV/9CT1f/RVBW/0ZRVf9JUFb/S1NW/05TVv9PU1T/ UFBS/1NRUv9YVFX/XlhY/2ZeW/9sY17/b2Zf/3JpYP9uY13/bGNa/2tiW/9qY1v/Z2Jc/2Vi Xf9iYVz/YWJd/11dW/9hYWH/ZmZm/2lpaf9qamr/bm5u/3Z2dv9+fXv/i4iD/46Jg/+WjYT/ nZCH/6GRhP+hj4H/n4x9/56LfP+cin7/m4l9/5uJff+biX3/moh8/5qIfP+aiHz/mYd7/5mH e/+Zh3v/mYd7/5iGev+Yhnr/mIZ6/5eFef+XhXf/loV1/5aFc/+VhHL/lYRy/5WEcv+Ug3H/ lINx/5SDcf+SgW//koFv/5KBb/+RgG7/kH9t/49+bP+Pfmz/jn1t/494cP+Od2//jnpv/459 bf+KeWn/hnlo/4+Dd/9KQTr/IBYV/x8ZHf8gGyL/Hx4m/x8eJP8cHSH/GBwd/xYaGf8ZGRn/ RUVF/+bk5f9raWz/f32C/359gv9/foT/f36E/359g/+BgIX/fHp9/3x7d/9/e3L/gnxu/4V9 av+IfmX/iX1j/4x+ZP+PfGv/j3xt/5J8b/+Rfm//lH5x/5J/cP+Vf3L/k4Bx/5eBdP+VgnP/ mIJ1/5aDdP+Zg3b/mIV2/5uFeP+Zhnf/nYd6/5uIef+dh3r/m4h5/56Ie/+ciXr/noh7/52K e/+fiXz/nYp7/5+JfP+ei3z/oIp9/56LfP+hi37/n4x9/6CLev+gi3j/oYx5/6GMef+jjHr/ pI17/6SNe/+kj3z/nol4/5+Mff+jkYX/rZ+U/6ibk/96b2n/VUxH/1FMSf9YWVv/YGRn/1tf Yv9jZGj/YmJk/25qa//Nx8f/2tDP/5+RkP+jlJH/oI2H/66Xj/+ji4H/tJmO/7CUif+skoX/ qZOF/6aThP+smoz/rp6R/6iXjf+kl4//yb66/6efnP83MTH/JSMm/xgXHP8UFBz/EBMc/woO Gf8HCxb/Cg4X/xMUGf8SExX/EhMX/xMUFv8XFxn/Gxsd/yEfIv8kIiX/T01O/3d1dv+gnJ3/ q6eo/7q2tf/c2Nf/1M7O/6SamP+kk4n/uaaY/7qnmf+zoJL/sZ6Q/66bjf+wnY//taKU/7Og kv+zoJL/s6CS/7Ogkv+zoJL/s6CS/7Ogkv+zoJH/sJ+P/7Cfj/+xoJD/sqGR/7Oikv+0opT/ taOV/7Wjlf+tnZD/rp6R/66ekf+wn5X/saCW/7Khl/+0opj/s6KY/7Wllv+1qJj/sqWV/62g kP+wopX/tKab/62gl/+glY//mpCO/4iCgv9pZ2r/SkpS/zM1Qf8nLTv/ISg4/x4mM/8oLTP/ KzAz/y83Of80PkD/O0RJ/z9KUP9BTlb/QVBX/0dWXf9IVV3/S1Zc/0xXW/9PVlz/UFhb/1NY W/9WV1n/V1VW/1tXVv9gWlr/aWFf/3FoY/96b2n/gHZt/4R6cP93amL/dGpg/3NpYP9wZ17/ bWZe/2lkXv9mY1z/Y2Jd/2NiXv9jYmD/Y2Jg/2ZlY/9paWn/bm5u/3VzdP94dnf/jYmI/4+K hv+Ui4T/l42E/5yOg/+ejH7/n4x9/56LfP+aiHz/moh8/5qIfP+Zh3v/mYd7/5mHe/+Yhnr/ mIZ6/5uJff+biX3/moh8/5qIfP+aiHz/mYd7/5mHe/+Zh3n/mId3/5eGdv+Xhnb/loV1/5WE dP+Ug3P/lINz/5OCcv+SgXH/kYBw/5GAcP+Qf2//j35u/49+bv+OfW3/jnxu/4x1bf+QeXH/ jHht/4l4aP+Me2v/hXhn/4p+cv9LQjv/IxkY/yAaHv8fGiH/HRwk/x0cIv8cHSH/Gx8g/xsf Hv8ZGRn/QkJC/+bk5f9raWr/fn6A/359gv9/foT/f36E/359g/+BgIX/fHp9/356ef+BenT/ g3tw/4d7a/+JfWf/i31j/419Zv+Re23/knxv/5J8b/+TfXD/lH5x/5V/cv+Vf3L/lX9y/5eB dP+XgXT/mIJ1/5iCdf+Zg3b/moR3/5uFeP+bhXj/nIZ5/5yGef+dh3r/nYd6/52Hev+eiHv/ noh7/56Ie/+eiHv/n4l8/5+JfP+fiXz/oIp9/6CKff+gin3/oYt+/6CKfP+ginz/oYt9/6KN fP+jjHz/pI17/6WOfP+ljnz/ppGA/6GOf/+di33/o5WI/6qck/+UioH/bmNd/1FMSP9PT0// V1hc/2JjZ/9hYGX/V1Zb/1hWW/+blZn/5Nve/7qusv+ekJD/r52b/6aRjP+sk4z/qo+G/7OX jP+vlIn/rpiL/6aUhv+nlYn/p5aM/6uclf+2qaP/saWl/3RrbP81LzP/IyEm/xYVG/8RFBv/ EBMc/woOGf8GDRf/Cg4X/w8SF/8QERX/EBEV/xESFv8VFBn/GRgd/x4cIf8hHyT/JCIl/zo4 O/9kX2P/iYSI/5+anv+wrK3/wrzA/8zCwf+ol4//q5iK/7GekP+um43/rpuN/62ajP+ql4n/ s6CS/7GekP+xnpD/sZ6Q/7GekP+xnpD/sZ6Q/7GekP+xnpD/s6GT/7SilP+1o5X/uKaY/7qo mv+7q57/vqyg/76uof/Ar6X/v7Gm/7+xpv/Bs6r/wrSr/8O1rP/Etq3/xLat/8a4q//Hu63/ xLiq/8C0qP/Ctqr/xbiv/72yrP+xqKP/nJSS/4eBg/9lY2j/R0ZO/zI0QP8qLjr/Jy07/ygs OP8vMjf/MjY3/zU6Pf84QEL/PEdL/z5MT/9BUFf/QlFY/0hXXv9IV17/Sldf/01YXv9RWF7/ VFld/1ZZXv9YWVv/W1la/2FcWf9oYF7/cGZk/3pvaf+Ed2//in10/42Bdf9/cWj/e29j/3dq Yf9xZ13/bGNa/2liWv9mYln/ZGFa/2ViXf9jYl7/Y2Je/2VkYv9pZ2j/bm5u/3Rydf93dXj/ ioaH/42Ihf+Siof/loyD/5uNhP+cjH//nIp8/5uKev+aiHz/moh8/5qIfP+aiHz/mYd7/5mH e/+Yhnr/mIZ6/5mHe/+Zh3v/mYd7/5mHe/+Yhnr/mIZ6/5eFef+XhXn/loR2/5WEdP+VhHT/ lINz/5OCcv+TgnL/koFx/5KBcf+Qf2//kH9v/49+bv+Pfm7/jn1t/418bP+Me2v/jHps/4x1 bf+RenL/jHht/4p5af+Me2v/hXhn/4p+cv9LQjv/IxkY/yAaHv8gGyL/HRwk/x0cIv8dHiL/ Gx8g/xsfHv8aGhr/Q0ND/+Xj5P9qaGn/fX1//318gf9+fYP/fn2D/318gv+Af4T/fHp9/356 ef+BenT/hHpw/4h7a/+LfGn/jHxl/458aP+SfG7/k3tv/5R8cP+UfHD/lX1x/5Z+cv+WfnL/ l39z/5iAdP+YgHT/mYF1/5mBdf+agnb/m4N3/5yEeP+chHj/m4V4/5yGef+chnn/nIZ5/52H ev+dh3r/nYd6/56Ie/+eiHv/noh7/5+JfP+fiXz/n4l8/6CKff+gin3/oIp9/6GLfv+hi37/ oox//6KMfv+kjX3/pY5+/6aPff+mj33/qZSD/6SRgv+hj4H/npCD/6aYjf+onpT/j4V8/2Ve WP9LSkj/SkpM/1xcXv9XVlv/VlVa/15bYv9nZGv/wbzC/93T2/+lmZ3/qpqa/6iWkv+zn5j/ qZKK/6uTh/+ymo7/rZqM/6eXiv+qmY//pJaN/6ucl/+/tLD/i4GC/z44Ov8wKzH/Hxwj/xMS Gv8QExr/DxIZ/woOF/8GDRX/DBEX/w0QFf8ODxP/Dg8T/w4PE/8QERX/FBUZ/xkYHf8cGyD/ IR8k/yQiJ/89O0D/aWds/4WAhv+Lhor/qqWr/93U1f+vnpb/n4x+/6yZi/+yn5H/taKU/7Wi lP+olYf/s6CS/66bjf+um43/rpuN/66bjf+um43/rpuN/66bjf+um43/taOV/7ammf+5qZz/ va2g/8GxpP/Dtar/yLet/8e5rv/OwLf/zsG4/87BuP/Qw7v/0cS8/9LFvf/Txr7/08a+/9XJ vf/WzMD/1Mq+/9DGvP/Rx77/0snC/8rBvP+9tbL/n5mZ/4N+gv9cWl//QUBI/zUzPv8zMz// NDZD/zY5Qv8+P0P/PEBB/z1CRf8+Rkj/P0pO/0FPUv9CUVj/QlNa/0dYYP9JWF//TFlh/09a YP9TWmL/V1xi/1lcY/9dXGH/Yl5d/2lhXv9xZ2X/em9r/4Z5cf+PgXj/lYd8/5iKff+Me3H/ hXdq/31vZP90aFz/bGJY/2hfVv9mX1X/ZGBX/2diXP9mY17/ZmJf/2VkYv9pZ2j/bmxv/3Nx dv92dHf/hYCE/4mDg/+Ph4X/lYqE/5mMhP+bioD/mop7/5mIeP+biX3/m4l9/5qIfP+aiHz/ mYd7/5mHe/+Zh3v/mYd7/5eFef+XhXn/l4V5/5aEeP+WhHj/loR4/5WDd/+Vg3f/k4Fz/5OB c/+SgHL/koBy/5F/cf+QfnD/kH5w/499b/+OfG7/jnxu/417bf+Ne23/jHps/4t5a/+KeGr/ inhs/412bv+RenL/jXlu/4p5af+Me2v/hnlo/4p+cv9LQjv/IxkY/yEbH/8gGyL/HRwk/x4d I/8dHiL/Gx8g/xsfHv8aGhr/Q0ND/+Ti4/9pZ2j/fHx+/3x8fv99fIL/fXyC/3x7gf+AfoP/ fnl9/395ef+CeHb/hHpx/4h6bf+Me2v/jXtn/5B7aP+SfG7/k3tv/5R8cP+VfXH/ln5y/5Z+ cv+Xf3P/l39z/5iAdP+YgHT/mYF1/5mBdf+agnb/m4N3/5yEeP+bhXj/m4V4/5uFeP+bhXj/ m4V4/5yGef+chnn/nIZ5/52Hev+eiHv/noh7/56Ie/+fiXz/n4l8/5+JfP+gin3/oIp9/6KM gf+ijIH/ooyB/6ONgP+ljoD/po9//6aPf/+mkX7/pZB//6aTgv+sm4v/ppmJ/6CUhv+pn5P/ pJyR/4iBef9RTUr/SUlJ/1VVVf9XV1n/WVhe/21sdP9XVl7/gn+I/97Z4P/Dur//mIyO/6yd mv+1pJ3/s5+W/6WPgv+xno//qZmK/6eZjv+zpZz/q56W/6aYlf+0qaf/Z15f/y8pLf8qJSv/ Gxgf/xAPFf8PEBX/DhEW/woPE/8KDxP/DRIV/wwQE/8NDhD/DA0R/wwND/8NDhL/EBET/xUU Gf8XFhv/KScs/yknLP8vLTL/SUdM/2diaP9xbHL/ioWL/7mwsf/IurH/qpiK/7GekP+vnY// r5yO/7Gfkf+olYf/t6WX/62ajP+smoz/rZqM/6yajP+tmoz/rJqM/62ajP+smoz/s6OW/7Wl mP+5qJ7/va+k/8O1qv/Iuq//zL61/83At//Pwrn/zsS7/8/FvP/Pxr3/0Me+/9HIwf/SycL/ 0snC/9TMwf/Xz8T/1c7E/9HKwP/Sy8P/08zG/8rCv/+6tbL/oZ2c/355ff9TUVb/PTpB/zo3 Pv8/PEX/RkVN/0xLUf9OTlD/TE1P/0lNUP9FTVD/RE9T/0NSV/9DVFv/RFVd/0hZYf9JWmL/ TVtk/1JcZf9XXmj/XF9o/2Bgav9jYGf/Z2Fh/29mYf94bWn/hHdx/46Ad/+WiH3/nY2A/5+P gv+YiHv/kYF0/4d3av96bF//cWVZ/2pgVv9oYFX/Z2BW/2hkW/9oY13/ZmNe/2djYv9oZmf/ bGpt/3FvdP90cnf/gHuB/4V/gf+NhYP/k4qF/5mMhP+Zi4D/mYl6/5eHeP+biXv/m4l7/5uJ ff+aiHr/moh8/5qIev+Zh3v/mYd5/5aEeP+WhHb/loR4/5WDdf+Vg3f/lIJ0/5SCdv+UgnT/ koBy/5F/cf+Rf3H/kH5w/499b/+OfG7/jnxu/417bf+Ne23/jXtt/4x6bP+LeWv/inhq/4p4 av+Jd2n/iXdr/412bv+RenL/jXlu/4p5af+NfGz/hnlo/4t/c/9MQzz/JBoZ/yEbH/8gGyL/ Hh0l/x4dI/8dHiL/HCAh/xwgH/8aGhr/Q0ND/+Li4P9nZ2f/e3t9/3t7ff98e4H/fHuB/3t6 gP9/fYL/fnl9/395ef+CeHb/hnlx/4p5b/+Memz/jXpp/5B7av+TfW//k31w/5N9cP+UfnH/ lX9y/5aAc/+WgHP/l4F0/5eBdP+XgXT/mIJ1/5iCdf+Zg3b/moR3/5uFeP+bhXj/moR3/5iF d/+YhXf/mIV3/5mGeP+Zhnj/mod5/5qHef+biHr/m4h6/5yJe/+ciXv/nIl7/52KfP+dinz/ nYp8/6GNgv+hjYL/oY2C/6KPgf+lj4H/ppGA/6aRgP+nkoH/ppGA/6STgf+uno7/rqGR/6KW iP+lm4//rKSX/6WelP9raGH/V1ZS/1JQUf9gYGL/VlVb/2RkbP9gYGr/X11o/66rtP/d2N7/ pp2g/6GWlP+wo5v/tKSX/6+ejv+sm4v/rJ+P/6ebj/+1qJ//rqSb/6Walv+hl5b/UEdI/zcx Nf8lICb/FhQZ/wwLEP8MDRH/DRES/wsPEP8MEA//EBQT/w0REP8MEA//Cg4P/wkNDP8MDQ// DhAP/xITFf8UFRf/Hx8h/yUlJ/8rKSz/Pjw//1VTVv9fXWD/dnF1/5yUkv/Nv7b/t6eY/7Kg kv+ikoP/nox+/6SUhf+kkoT/t6eY/6yajP+rm4z/rJqM/6ubjP+smoz/q5uM/6yajP+rm47/ saCW/7GjmP+2qJ//u66l/8G0q//HurH/zL+3/83Duv/Lwbj/y8K7/8zDvP/Mxb3/zca+/87H wf/NyML/zsrB/9DMw//U0MX/08/G/9DLxf/Qy8X/zsvG/8O/vP+0sK//oZ2e/3dzdP9MR0v/ Pjk9/0ZBRf9RTFD/XVdb/2VgZP9gXmH/W1xe/1VZXP9NVVj/SVRY/0ZVWv9GV17/Rllg/0lb Zf9LXGb/T11o/1Vfaf9aYGz/YGJu/2Vlcf9oZWz/bmVm/3VqZv9+c23/i352/5SGff+ci4H/ oI6C/6GPgf+ikIL/m4t8/5GBcv+Edmn/eW1f/3BmWv9sYlb/amJX/2xlXf9pZF7/aGNf/2dj Yv9nZWb/a2lu/29sc/9xbnX/fHd+/4N9gf+Mg4T/lIqI/5uOhv+bjYL/mYl8/5eHeP+cinz/ nIt7/5uJe/+binr/moh6/5qJef+aiHr/mol5/5aEdv+WhXX/loR2/5aFdf+Vg3X/lYR0/5WD df+UgnT/koBy/5F/cf+Rf3H/kH5w/499b/+OfG7/jnxu/417bf+Ne23/jXtt/4x6bP+Memz/ i3lr/4p4av+KeGr/iXdr/412bv+Se3P/jnpv/4t6av+NfGz/h3pp/4t/c/9MQzz/JBoZ/yEb H/8hHCP/Hh0l/x8eJP8eHyP/HCAh/xwgH/8bGxv/RERE/+Li4P9mZmT/enp8/3p6fP98e4H/ e3qA/3t6gP9+e4L/fnl//4F4e/+CeHb/hnlz/4p5b/+Nemz/j3pp/5B7av+TfW//k31w/5R+ cf+Vf3L/lX9y/5aAc/+XgXT/l4F0/5eBdP+XgXT/mIJ1/5iCdf+Zg3b/moR3/5uFeP+bhXj/ l4R2/5eEdv+XhHb/mIV3/5iFd/+YhXf/mYZ4/5mGeP+biHr/m4h6/5uIev+ciXv/nIl7/5yJ e/+dinz/nYp8/6GNhP+ijoX/oo6F/6OPhP+mkIP/p5GD/6eSgf+ok4L/qpeG/6OSgP+nl4f/ rKGP/6ifjv+mn4//qqSW/6unm/+empH/bWpl/0lFRP9bWVz/V1Zc/1xcZP9qanb/VlZi/25u eP/NzNL/yMTF/5mRjv+pn5b/qp6Q/8Gxof+nl4f/sqaW/6Wbj/+upJr/q6Kb/6mgm/+OhoT/ Qjw8/zs3OP8gGx//EQ8S/wgICv8LCwv/DhAN/wsQDP8NEgz/ERYQ/xAVEf8OEw//DBAP/woP C/8MDg3/DhAP/xETEv8TFRT/ERER/xUVF/8lIyb/PTs+/0dFSP9EQkX/WVRY/314df+Ie3L/ qJiJ/66ej/+mlof/ppaH/6eXiP+omIn/r5+Q/6ycjf+snI3/rJyN/6ycjf+snI3/rJyN/6yc jf+qnI//r6GW/7Cjmv+1qJ//u66l/8G0q//Fu7H/yb+2/8rBuP/NxL3/zMW9/83Gvv/MyL// zcjC/87LxP/Oy8T/zc3F/9HOx//U1Mr/1tPM/9HRyf/Sz8r/zs3J/8HAvv+xsK7/nZma/29r bP9FQUL/Qz0//1ROTv9mXV7/dGts/351eP9wbnH/aWps/19iZ/9VXGL/Tllf/0lYX/9IWWH/ SFpk/0pcaP9NXWr/UV9s/1hibv9eZHL/ZWd0/2lodv9vaXP/d21s/35zbf+KfXX/lIZ9/52M gv+hkYT/opCC/6KRgf+nlob/pJOD/52Lff+Tg3T/hnhr/3xwYv90aFz/bWVa/21mXP9qZl3/ aGNf/2hiYv9oZGX/amht/21qcf9vbHX/e3Z9/4F8gv+OhYb/l42L/5yRi/+dkYX/mox//5mJ ev+ci3v/nIt7/5yLe/+binr/m4p6/5qJef+aiXn/mol5/5mIeP+Yh3f/mId3/5iHd/+Xhnb/ l4Z2/5eGdv+Xhnb/k4Fz/5OBc/+SgHL/koBy/5F/cf+QfnD/kH5w/499b/+QfnD/j31v/499 b/+OfG7/jXtt/4x6bP+Memz/i3lt/453b/+Se3P/jnpv/4t6av+OfW3/h3pp/4yAdP9NRD3/ JRsa/yIcIP8hHCP/Hx4m/x8eJP8eHyP/HSEi/x0hIP8bGxv/RERE/+Hh3/9mZmT/enp8/3p6 fP97eoD/e3qA/3t4gf9+e4L/fnl//4F4e/+Dd3f/h3hz/4t5b/+Nemz/j3lr/5F6av+TfW// lH5w/5R+cP+Vf3H/loBy/5eBc/+XgXP/l4Fz/5eBc/+XgXP/mIJ0/5iCdP+Zg3X/moR2/5uF d/+bhXf/loN0/5WEdP+VhHT/loV1/5aFdf+Xhnb/l4Z2/5eGdv+ZiHj/mol5/5qJef+aiXn/ m4p6/5uKev+binr/nIp8/6GPhf+hj4X/o4+G/6SQhf+nkYT/p5GD/6iTgv+ok4L/q5iH/6eW hP+klYL/p5yK/6yjkv+ooY//pJ6O/6illv+0sKX/iYR+/1dTUP9JR0j/VVRa/1paYv9maHT/ WVtn/1BTXP+QkZb/ysjJ/6+sp/+knZP/qaKS/7uwnP+onYn/rqWU/6mhlP+vp5z/qaCZ/6qh nP95cW//ODIy/zczNP8cFxv/DgwP/wUFBf8JCQf/DQ8K/w0QCf8QEwr/FRgR/xMYEv8RFhD/ DhMP/wwRC/8OEA3/DxEO/xIUEf8TFRL/CQkH/wUFBf8VExT/KCYn/yclJv8iICH/LCor/z45 Nf8+Mib/mYx7/7Gkk/+wo5L/t6qZ/7Cjkv+ypZT/qZyL/62gj/+toI//raCP/62gj/+toI// raCP/62gj/+toJD/s6Wa/7Snnv+4q6P/u7Go/8G3rv/FvLP/yL+4/8nCuv/NxsD/zMfB/83I wv/NysP/zsvG/83Mx//Ozcj/zc7G/9HRyf/V1s7/19bR/9PUzv/T0s7/zs/K/8DAvv+vr63/ l5aU/2hkY/9BPTz/SEJC/2RcWv94bm3/h3t7/5GHiP9+env/dXV3/2hrcP9aYWf/UVxi/0xb Yv9JXGP/SV1m/0peaf9NX23/U2Bw/1pjcv9hZ3f/aGp5/25rfP9ybHb/g3l4/4x/ef+Wh4D/ n5GI/6aVi/+olor/p5SG/6aThP+ql4j/qJeF/6aVhf+fj4D/k4V4/4Z6bP96bmL/cmhe/29m Xf9tZl7/aWRg/2hjYP9oY2f/amVr/2xpcP9ua3T/e3Z9/4J9g/+Qh4r/m5GP/6CVj/+hlIv/ nY+C/5uLfP+ci3v/nIt5/5yLef+ci3n/m4p4/5uKeP+binj/mol3/5uKeP+binj/m4p4/5uK eP+aiXf/mol3/5mIdv+ZiHj/loR2/5WDdf+Vg3X/lIJ0/5OBc/+TgXP/koBy/5KAcv+SgHL/ koBy/5F/cf+Rf3H/kH5w/499b/+OfG7/jnxw/453b/+TfHT/jnpv/4x7a/+OfW3/h3pp/4yA dP9NRD3/JRsa/yIcIP8iHST/Hx4m/x8eJP8fICT/HSEi/x0hIP8cHBz/RUVF/+Dg4P9lZWX/ eXl7/3l4ff96eX7/enl//3l4fv99e4D/fnl9/395e/+CeHf/hnh1/4p5cf+Mem7/j3ls/5B6 bP+UfnH/lH5x/5R+cf+Vf3L/loBz/5eBc/+XgXT/mIJ0/5eBc/+XgXP/mIJ0/5iCdP+Zg3X/ moR2/5uFd/+bhXf/loN0/5WEdP+Wg3X/lYR0/5eEdv+WhXX/mIV3/5eGdv+ah3n/mYh4/5uI ev+aiXn/m4h6/5uKev+ciXv/m4l7/6GPhf+ij4j/opCG/6ORh/+lkYb/ppOF/6aThP+nlIX/ pJOD/6ycjP+mmYj/pJmH/6uikf+mn4//oZqK/6iilP+lnZL/pJ2T/4F6dP9EPzz/S0lM/1NS WP9gX2f/Z2Zu/1dXX/9YV13/srCx/9PPzP+hnZT/s62f/6afjf+spZL/o5yM/6ymmP+4sKX/ qKGZ/6afmf9kX1z/MSsr/zEtLv8YFhn/DAoL/wQEBP8ICAb/DA8I/w0QB/8QEwr/FRgP/xcZ FP8TGBL/EhQP/xASDf8PEQz/EBIN/xIUEf8UFhP/FRUT/w0NC/8VExT/HBob/xsZGv8hHyD/ IR8g/xQRDP8uJBr/qJyM/7qunv+wpJT/tamZ/62hkf+4rJz/rKCQ/66ikv+uopL/rqKS/66i lP+uopT/rqKU/66ilP+uopb/taui/7arpf+5sKn/vbSt/8K5sv/Fvrb/ycK8/8rDvf/JxMD/ ysXB/8rHwv/LyMP/zMnE/8vKxf/My8f/zczH/8/Oyf/U087/1tXQ/9PSzv/R0Mz/z8vI/8C8 uf+vq6j/lpGO/2dfXP9DOTf/T0RC/3FjYP+GeXP/lIWA/56Qj/+GgIL/e3p//2xvdP9eZWv/ U11m/01bZP9KXGb/Sl5p/0tebP9OYG7/VGFx/1tkc/9iaHb/aWt4/3Bue/90b3b/jYKA/5aH gP+ekIf/qJeN/6ybkf+tm4//qpiK/6eVh/+ql4j/q5qK/6uZi/+mlof/nY2A/41/cv9/cWb/ dmpe/29nXP9uZVz/a2Rc/2piX/9pY2P/amVp/21obv9vanH/e3Z8/4N+gv+Qioz/mpWS/6Ga lP+fmI7/m5OG/5iPfv+ajXz/m4x5/5uMef+bjHn/mot4/5qLeP+ai3j/mot4/5yNev+cjXj/ nI14/5uMd/+bjHf/m4x3/5qLdv+ai3j/l4h1/5aGdv+Whnb/lYV1/5SEdP+Tg3P/k4Nz/5KC cv+Tg3P/k4Nz/5KCcv+SgnL/kYFx/5CAcP+Pf2//j39v/4p6a/+Pf3D/jX1t/4l8af+Lfmv/ h3xq/4qBcv9NRD3/JBwa/yIcIP8iHST/IB0m/yAfJf8gHyT/HyEg/x8hHv8cHBz/RUVF/+Lj 5f9lZmj/dXZ6/3V2ev99foL/fn+B/3l6fP96e33/dnZ2/3Jubf9/d3X/j4SA/46Be/+Nf3b/ koB2/5B+dP+UfnP/lH5z/5V/dP+Vf3T/lX90/5aAc/+WgHX/loBz/5iCdf+YgnX/mIJ0/5iC dP+Zg3X/mYN1/5qEdv+ahHb/nYd6/5uIev+dh3z/m4h6/52HfP+biHr/nYd8/5uIev+fiX7/ not9/6GLgP+gjX//o42C/6KPgf+lj4T/pJCF/6WUiv+mlYv/ppWL/6aVi/+nloz/p5eK/6eX iv+omIv/rZ2Q/6udkP+snpH/rJ6R/6ygkv+toZX/rqKW/66ilP+vppX/saiX/6iekv9/dm3/ VUtJ/1JJSv9aUVb/TkdO/0E8Qv87Njr/Hxsc/4WBgP+1sq3/tLGo/6Kgk/+qp5j/rKma/62q m/+3saX/p6Oa/4iDff9ZVVL/Lysq/0M/Pv8cGhv/EQ8Q/wsLC/8NDQv/CgoI/wMEAP8FBgH/ DQ4J/xYXEv8UFhP/FRUT/xQUEv8SEhD/Dw8N/w0NC/8LCwn/ExMR/xMTEf8TExH/FBQS/xcX Ff8cHBr/ISEf/ycjIP81Lib/s6mf/7uxp/+wppz/vLKm/7+1qf+0q5z/t66f/7asoP+2rKD/ tauh/7Wrov+0qaP/s6ii/7Kno/+xp6X/t6+s/7iwrv+6srD/vbWz/8C4tv/BvLn/w767/8S/ vP/Hwr//x8K//8bBvv/Gwb7/xsG+/8TAvf/EwL//xMC9/87Jxv/NyMX/z8fF/9LKyP/Sysj/ zsTC/8O4tP+6r6v/g3Zw/3RlXv9lVE3/Z1RN/3hkW/+NeXD/m4R8/5qJgv+PiYn/gIGF/29y ef9dZGz/UF1m/0xcaf9PYW//UmVz/09icf9TZXP/WGh1/11qc/9lbHT/cHN4/4CBhf+Oion/ m5CK/6KRif+mlYv/qpmP/6ybkf+tnJL/rJyP/6ubjv+wnpL/rJyP/6mZjP+nl4r/o5KI/5mI fv+KeW//fW9k/3drXf9zaV3/cWdd/29kXv9uZGL/bmZk/29pa/9va2z/b2pu/3t3eP+Lioj/ nZyY/6eooP+qrKH/p6mc/6ellv+akYD/nZB//52Qf/+bjn3/mo16/5qNev+ckHr/npJ8/5yQ ev+ckHj/m493/5uPd/+ajnb/mo52/5qOdv+ajnb/mIx0/5iMdP+Xi3P/lopy/5aKcv+ViXH/ lIhw/5SIcP+Th2//koZu/5KGbv+RhW3/kIRs/4+Da/+Pg2v/jYNq/4mDa/+Hg2r/iYVq/4qG a/+Ggmf/hoJp/46Lev9MSD3/JB8c/yMeIv8jHiX/Ix4l/yEfJP8hHyL/ISAe/yEgHP8fHx// QkJE/+Dh5f9iY2f/cnN3/3N0eP94fH3/eX1+/3R4d/90eHf/dXVz/3Bva/9/enb/j4iC/4+E fv+OgXn/koR7/5KBd/+YhHv/mIR7/5iEe/+ZhXr/mYV6/5mFev+ahnv/mod5/5uIev+biHn/ nIl6/5yJev+ciXr/nYp5/52Ke/+dinv/not9/56Lff+ein//not9/56Kf/+ei33/nop//56L ff+hjYL/oY6A/6KOg/+jkIL/pZGG/6aThf+nk4j/ppSI/6mZjP+nmYz/p5mO/6iajf+omo// qJqN/6mbkP+pm47/q52S/6udkP+snpP/rJ6R/62flP+uoJP/r6GW/6+ikv+0qZf/sqeT/7So mP+lm4//e3Bq/1FHRf9DOTr/RDtA/yQeIv8gGyH/Hhkd/11bXP/GxcP/tbax/66vp/+1tav/ rqyf/66rnP+2sqb/oJyR/4B9dv9KR0L/JCAd/zAsK/8MCgv/CAYH/wkJCf8TExP/FRUV/xER D/8SEhD/GBgW/xQUEv8UFBL/FBQS/xMTEf8SEhD/EREP/w8PDf8PDw3/FBQS/xMTEf8TExH/ FBQS/xcXFf8cHBr/ICAe/yQjH/88NS//tKuk/7yzqv+yqaD/vbWq/8C4q/+1raD/uLCj/7ev ov+3r6T/tq2k/7atpv+1rKf/tKqo/7OpqP+yqqj/sq2q/7Ouq/+1sK3/uLOw/7u2s/+9uLX/ v7q3/8C7uP/BvLn/wby5/8C7uP/Au7j/v7q3/7+6t/+/urf/v7q3/8O+u//Du7n/xLy6/8e9 vP/Ivrz/xLm1/7uuqP+zpJ3/jn11/39tY/9xXVT/cFxR/4BqXf+SfG7/nod5/52Lgf+RjIn/ goOH/3Bzev9eZW//UV1p/01dav9PYW//UmV0/09icf9UZnT/WWp0/15rc/9mbnH/cnZ3/4GD gv+QjYj/npSK/6OViP+pmYz/qpyP/66ekf+snpH/rZ2Q/6qcj/+woJP/q52Q/6qajf+nmYz/ pZWI/5qMf/+OfnH/gnRn/3hsXP92alr/c2db/25kW/9tZF3/bWVi/29nZf9uaGj/b2ts/3l3 eP+NjIr/n6Cb/6uup/+utKr/rrSo/66wo/+jnY3/oJeG/52SgP+Xj3z/mo97/5mRev+ckXv/ mpN5/5uReP+Zknb/mpB1/5iRdP+akHX/l5B0/5mPdP+XkHT/mI5z/5WOcf+XjXL/lI1w/5WL cP+Si27/lIpv/5GKbf+SiG3/kIls/5GHbP+Oh2r/j4Vq/42Gaf+OhGn/i4Zp/4aFZ/+EhWX/ hodn/4eIaP+EhWX/g4Nn/42MeP9MSj7/Ix8c/yMeIv8jHiX/Ix4l/yMeJP8jHyD/Ix8c/yEg HP8fHx//QkJE/9/g5P9fYGT/cHF1/3Jzd/9zd3j/dXl6/3F1dP9vc3L/dHRy/3Bva/9/fHf/ kouF/5OJgP+Thn3/l4l+/5aGef+cjH//nYt//56MgP+ejH7/nox+/5+Nf/+fjX//n45+/6CP f/+gj33/oZB+/6GQfv+hkH7/opF9/6KRf/+ikX//oZCA/6GQgP+hj4H/oZCA/6GPgf+hkID/ oY+B/6GQgP+jkYP/pJOD/6SShP+mlYX/p5WH/6iXh/+pl4n/qJiJ/6mcjP+onIz/qZ2P/6md jf+pnY//qp6O/6qekP+qno7/qp6Q/6qejv+rn5H/q5+P/6ygkv+toZH/rqKU/66ikv+wpZP/ sKWT/7Wsnf+7saf/oJWR/2NZWP81LC//KSMn/ysmLf9QTVT/cW51/4SDiP/V1tj/tLa1/6ao p/+2t7H/sa+i/62qm/+3s6f/lZGG/3ZzbP82My7/GBQR/xoWFf8PDQ7/CwkM/woKDP8ODg7/ Dg4O/wkJCf8JCQn/DQ0L/xMTEf8SEhD/EhIQ/xISEP8SEhD/ExMR/xMTEf8UFBL/Hh4c/xwc Gv8ZGRf/FhYU/xUVE/8WFhT/GBgW/xoZFf9HQjz/uLGp/763rf+1rqT/vris/8G7rf+4sqT/ urSk/7mzo/+5s6P/ubOl/7iypv+3sKb/tq+n/7avqf+1rqj/sKul/7Gspv+zrqj/tbCq/7ey rP+5tK7/u7aw/7y3sf+6ta//urWv/7m0rv+5tK7/uLOt/7izrf+4s63/uLOt/7eyrv+1sKz/ tK+p/7myrP+6s6v/t66l/6+lm/+pnZH/mIx+/4t+bv9/b2D/fm1d/4l2Z/+XhHP/oYx7/5+P gv+Uj4v/hIWH/3J1ev9fZm7/VF5o/09dav9PYW//UmV0/1Bjcv9VZ3X/XGp1/2Jsdf9ocHP/ dXl4/4WHhP+TkIn/opmK/6abif+rno3/raKQ/6+ikf+uo5H/raCP/6ugjv+xpJP/rKGP/6qd jP+onYv/ppmI/56Tgf+ThnX/iH1r/3pvXf93a1v/cmhc/29lW/9sY1z/a2Ng/2xkYv9rZWX/ b2ts/3l3ev+OjI3/o6Oj/7K0sf+7vbj/u8C5/77Atf+1r6H/qqOR/52Vgv+WkHr/mpJ7/5yW fP+clXn/mJN1/5mSdf+Yk3X/mZJ1/5eScv+YkXT/l5J0/5eQc/+WkXP/lo9y/5WQcP+VjnH/ lI9v/5SNcP+SjW3/kotu/5GMbP+Rim3/j4pq/5CJbP+OiWn/jodq/4yHZ/+Nhmn/iodo/4aH Z/+Dh2b/hYlm/4aKZ/+ChmX/goVo/4yOef9KSz3/IiEd/yIgI/8iHyb/Ih8m/yIgJf8iICP/ IiEd/yIhHf8fHx//QkJE/+Lj5/9eX2P/cXJ2/3N0eP9xdXb/c3d4/3F1dv9scG//cXNw/25v af+AfXb/k4+G/5ePhP+WjID/mo6A/5iLe/+cj3//nI9//52QgP+dkH//npGA/56RgP+ekYD/ npF+/5+Sf/+fk33/n5N9/6CUfv+glH7/oJR8/6GVff+hlX//nZB9/52Qff+dkH3/nZB9/52Q ff+dkH3/nZB9/52Qff+gk4D/oJOA/6GUgf+ilYL/o5aD/6WYhf+lmIX/ppmG/6eciv+lnYr/ p5yK/6aei/+onYv/pp6L/6mejP+nn4z/qp+N/6igjf+roI7/qaGO/6yhj/+ro5D/rqOR/66j kf+mm4n/saaU/66llv+vpZv/rqWe/4mBfv9KRET/Ix4i/2lmbf99fIT/c3N7/3Z5gP+nqrH/ yc7S/7C1uf+ssa3/sLGj/6ypmP+0saL/i4d7/25rYv8rKCH/GRUS/xIODf8SEBH/DQsO/wgI Cv8ICAr/CgoM/w4ODv8VFRf/Gxsb/xMTEf8SEhD/EREP/xERD/8SEhD/FBQS/xcXFf8ZGRf/ FhYU/xUVE/8UFBL/FBQS/xcXFf8aGhj/Hh4c/yIhHf9VUEr/vLWt/7+4rv+4sqb/v7mr/8K8 rP+7taX/vLek/7y3o/+8t6P/u7aj/7q0pP+6tKb/ubOn/7iypv+2sqb/sq6i/7Ovo/+0sKX/ trKm/7ezqP+5tan/urar/7q2qv+3s6j/t7On/7ayp/+2sqb/tbGm/7Wxpf+1sab/tLKm/7Kw pP+wrqL/rqyg/7Cuof+zr6P/s62f/62mlv+mn43/o5uI/5qPe/+Pgm//jIBq/5SFcP+djnf/ o5N8/6GWhP+Xk4r/h4mG/3V5ev9haG7/VV9o/1Beaf9QYnD/UmV0/1Jjc/9WaHb/Xmx3/2Rv df9rc3X/eHx7/4mLhv+VlYv/pZ6L/6ihh/+ro4z/rqeN/66mj/+tpoz/rKSN/6qjif+vp5D/ rKWL/6igif+noIb/pp6H/6CZf/+Xj3j/j4dw/35zX/95cV7/dWxd/29nWv9sY1z/amNd/2hj YP9pY2P/bmpr/3t2ev+OjI//pKSm/7e3uf/CxMP/yMrJ/8rLxf/Cv7D/sq2a/5+ahv+Xknz/ mpZ7/56aff+bmHn/lpNy/5iVcv+YlXL/l5Rx/5eUcf+Wk3D/lpNw/5aTcP+Wk3D/lZJv/5WS b/+UkW7/k5Bt/5OQbf+Sj2z/kY5r/5GOa/+PjGn/j4xp/4+Maf+Oi2j/jYpn/4yJZv+MiWb/ iYll/4aHZf+Dh2T/hopl/4eLZv+Dh2T/g4Zn/42Pef9LTD7/IiEd/yIgI/8iHyb/Ih8m/yIf Jv8iICP/IiEd/yIhHf8gICD/Q0NF/+Xl5/9eXmD/cnN3/3V2ev9vc3b/cXV2/3J2d/9obGv/ bG5r/2tsZv9/fHP/lZGG/5mRhP+ZkH//nZKA/5qPff+YkH3/mJB7/5iQe/+ZkXz/mZF8/5mR ev+aknv/mpJ7/5qSe/+ak3n/mpN5/5uUeP+blHj/m5R4/5yVef+clXn/mJF3/5iQef+YkHn/ mJB5/5iQef+YkHn/mJB5/5iQef+aknv/m5N8/5uTfP+dlX7/npZ//5+XgP+gmIH/oJiB/6GZ hP+gmoT/opqF/6Gbhf+jm4b/opyG/6Obhv+inIb/qKCL/6ehi/+poYz/qKKM/6qijf+qpI7/ rKSP/6ykj/+lmob/sqeT/6qhkP+lm4//saif/6afmf92cm//UU9Q/4GAhf+AgIj/aGt0/2du eP92fYf/xM3W/7rEzf+bpKP/ra6g/6mnkv+sqZj/g4Bx/2RiVv8pJh//JCAd/xkVFP8VExT/ FBIV/xAPFP8MCxD/DAsQ/w8PEf8SERb/EhIU/xUVFf8TExH/EREP/xAQDv8REQ//FRUT/xkZ F/8bGxn/HBwa/xoaGP8YGBb/FhYU/xUVE/8XFxX/GRkX/xwbF/9hXlf/vbmw/725rv+4tKj/ vLmo/7+8qf+7uaT/u7mi/7u5oP+7uaD/urih/7m3ov+5t6L/uLWi/7e0of+3tKH/t7Sh/7a1 of+3tqT/uLej/7i3pf+5uKT/urmn/7q5pf+2taP/trWh/7a1o/+1tKD/tbSi/7W0oP+0s6H/ tLOh/7S1o/+xsqD/r7Ce/7Gznv+1tKD/tbSf/7Cumf+sp5H/rKaO/6SehP+dlnz/mZJ2/52T eP+imXz/ppt//6Wdhv+amIv/i42I/3d7ev9kbG7/V2Jo/1FfaP9RYW7/U2Vz/1Rkc/9YaHX/ X212/2dyeP9udnj/fIF9/42Qif+am43/paOK/6mmhf+rqIn/raqJ/62qi/+rqIf/qaaH/6ek g/+tqov/qaaF/6Wig/+looH/paKD/6Kffv+al3j/lZBy/4N7ZP9/d2L/enFg/3NsXP9uZVz/ a2Rc/2hjX/9oYmL/bWlq/3l0eP+Mio//oaCm/7W0uv/Cw8j/ycrP/83Ny//Hxbj/trOg/6Kg i/+Yln3/mpl7/5ybfP+ZmXX/k5Nt/5aXb/+Wl2//lpdt/5WWbP+Vlm7/lZZu/5SUbv+UlG7/ lJVt/5SVbf+TlGz/kpNr/5KTa/+Rkmr/kJFp/5CRaf+Oj2f/jo9n/46PZ/+Njmb/jI1l/4uM ZP+LjGT/iYtj/4WKYv+EiWH/h4xk/4iNZf+EiGP/hIhn/46QeP9MTT3/IyId/yMhIv8jICf/ IyAn/yMgJ/8jIST/IyIg/yMiIP8gICD/Q0NF/+Tk5v9aWlz/cHF1/3N0eP9pbXD/bHBz/25y c/9iZmX/Zmhl/2ZnYf97e3H/k5GC/5mUgf+Zk33/nJR9/5iQef+Vj3f/lZF4/5WRdv+VkXb/ lpJ3/5aSd/+WknX/l5N2/5aSdf+WknX/lpN0/5eUdf+XlHP/mJV0/5iVdP+YlXT/lZJz/5WR dP+VkXT/lZF0/5WRdP+VkXT/lZF0/5WRdP+YlHf/mJR3/5mVeP+alnn/m5d6/52ZfP+dmXz/ npp9/5+Zf/+fmX//n5l//6CagP+gmoD/oZuB/6Gbgf+hm4H/p6GH/6ehh/+oooj/qKKI/6mj if+qpIr/q6WL/6uli/+qo4f/rqeN/62ljv+spZL/sKqa/6mlmf+ampD/k5SP/4GDgv9+goX/ foWL/3N8g/9weoP/n6y0/7rH0P+YoqP/q62f/6imj/+gnYr/e3hp/1ZUSP8pJh//Lywn/yQg H/8lIyT/LSsu/zEwNf8uLTL/Kiku/yUkKf8aGR7/Dw8R/xoaGv8XFxX/ExMR/xAQDv8QEA7/ FBQS/xgYFv8bGxn/Hx8d/x0dG/8ZGRf/FhYU/xUVE/8VFRP/FxcV/xkYFP9saWL/vrqv/7y4 rP+4taT/urek/7y6pf+7uaL/ubic/7q5nf+6uZv/ubia/7m4nP+4t5v/t7aa/7a1mf+1tZv/ uLie/7i4nv+4uKD/uLie/7m5of+5uZ//ubmh/7m5n/+3t5//t7ed/7a2nv+2tpz/tbWd/7W1 m/+1tZ3/s7ab/7a6n/+yuJz/sLSZ/7G1mv+1uZ7/trmc/7S0mP+wsZL/rayN/6qqiP+npIP/ pKF+/6Whfv+mon//qqSA/6mmh/+bnIr/jpGI/3p/ef9mb27/WGNn/1NgaP9TYWz/VGRz/1dk dP9canf/Ym94/2l0eP9xenn/gIV//5GUi/+doI3/paaG/6aogP+oqoL/qauD/6mrg/+nqYH/ pKZ+/6KkfP+oqoL/pKZ+/6Ciev+gonr/oaN7/6Ciev+bnXX/l5dz/4mEZ/+Ff2f/f3lj/3hx X/9xa13/bWZc/2plX/9pZGH/a2do/3Zxdf+HhIv/nJmi/62stP+6uMP/wsDL/8XFx//Cwrb/ tbei/6alkP+bnoP/m5x9/5icef+WmHH/kJZq/5aZbP+TmWv/lZhp/5OZaf+Ul2r/kphq/5SX bP+SmGz/lJdq/5KYav+Tlmn/kJZo/5GUZ/+PlWf/kJNm/46UZv+OkWT/jJJk/42QY/+LkWP/ jI9i/4mPYf+KjWD/iI5i/4aLYv+FimH/iI1k/4mOZf+FimL/hIhl/4+Sd/9NTj7/IyMb/yMh Iv8jICf/IyAp/yMgJ/8jIST/IyIg/yMiIP8hISH/RERG/97e4P9SUlT/aWpu/21ucv9gZGf/ Y2dq/2drbP9YXFv/YGJf/2FiXP94eGz/kpF//5eVfv+YlHn/m5Z5/5eSdP+Uk3X/lJN1/5ST df+VlHb/lZR1/5WUdf+WlnT/lpZ0/5WVc/+VlXP/lpZy/5aWcv+WlnL/l5dz/5eXcf+Xl3H/ lpZy/5aWcv+WlnL/lpZy/5aWcv+WlnL/lpZy/5aWcv+ZmXX/mZl1/5qadv+bm3f/nZ15/56e ev+fn3v/n597/6CdfP+hnn3/oZ59/6Geff+in37/op9+/6Kffv+joH//pqOC/6ajgv+npIP/ p6SD/6ilhP+ppoX/qqeG/6umhv+tp4X/qKKA/62nh/+yrZD/qaiM/6SkjP+pq5b/r7Gj/5uh lf+CiYL/Z3Ju/1xoaP9odnn/fo2S/7PEy/+suLj/q66d/6imj/+UkX7/c3Bf/0VDNv8mIxr/ MzAr/yomJf8xLzD/QT9C/05NUv9SUVf/VFNZ/1NSWP9IR03/OTg9/yAeH/8cGxn/FhUT/xEQ Dv8QDw3/ExIQ/xcWFP8bGhj/DQwK/w4NC/8QDw3/FBMR/xoZF/8hIB7/KCcl/ywrJ/9zcGf/ vbuu/7i3pf+2taH/trWg/7i4nv+4uJz/treX/7e4mP+3uJb/t7iW/7a3lf+1tpT/tLWT/7S1 k/+ztJT/treX/7S4l/+0t5j/s7eW/7O2l/+zt5b/s7aX/7O3lv+ztpf/sraV/7K1lv+ytpX/ sbSV/7G1lP+xtJX/sLST/7O6mP+tt5T/q7KQ/621kP+xuZT/s7mV/7G3k/+uso3/rLCL/6uw iP+rrYb/qauD/6mqgv+pqoD/qquB/6utiP+doYr/kJSF/3yCeP9ncGv/W2Vm/1VgZv9VYmv/ VmRx/1llc/9eanb/ZnB5/2x2eP90fXr/g4iB/5SXjP+hpY7/oah//6Sqev+lq3v/pqx8/6Wr e/+iqHj/n6V1/52jc/+kqnr/n6V1/5uhcf+boXH/naNz/56kdP+aoHD/mJtw/4+Ma/+Mh2r/ hX9l/3x3Yf91cF3/cGpc/2xoX/9rZmL/amZl/3Nucv+BfoX/k5CZ/6ShrP+vrbr/trTC/7m4 vv+5u7D/srWg/6mrlf+fo4j/mp59/5Wcc/+SmGz/j5dm/5SbaP+TnGf/k5pm/5KbZv+Tmmf/ kZlm/5KYaP+RmWj/k5pn/5GZZv+SmWb/kJhl/5CXZP+OlmP/j5Zj/42VYv+NlGH/jJRh/4yT YP+Kkl//i5Jf/4mRXv+JkF3/iJBf/4aOX/+FjV7/h49g/4iQYf+FjGD/hIpk/46Tdf9NUD3/ IyQc/yMjI/8jIij/IyIq/yMiKP8jIif/IyMj/yMjIf8hISH/RERG/9nZ2/9LS03/ZGNo/2do bP9YXF//XGBj/2BkZ/9QVFP/XF5b/11gV/91d2n/j5F8/5WVe/+WlXb/mZZz/5WSb/+VlnT/ k5d0/5SYdf+UmHX/lJhz/5WZdP+VmnL/lZpy/5SZcf+UmXH/lZpx/5Wacf+VmnH/lpty/5ac cP+WnHD/l5xz/5ecc/+XnHP/l5xz/5ecc/+XnHP/l5xz/5ecc/+ZnnX/mp92/5ugd/+coXj/ naJ5/56jev+fpHv/oqR8/6KifP+ionz/oqJ8/6Ojff+jo33/o6N9/6Skfv+kpH7/pKR+/6Sk fv+lpX//paV//6amgP+np4H/qKiC/6qogf+ppn3/op90/6ilfP+qqIH/n6F6/6Kmg/+pro7/ o6mN/56mj/+hrJv/go6C/3yMgv9ldHH/VWVl/4+hpf+8y8j/rK+e/6mnkP+MiXb/bmta/zk3 Kv8iHxb/MS4p/yomJf83NTb/RkRH/09OU/9QT1X/UVBW/1FQVv9IR03/Ojk+/yQiI/8fHhz/ FxYU/xEQDv8PDgz/EhEP/xYVE/8ZGBb/GRgW/xcWFP8WFRP/FhUT/xcWFP8aGRf/Hh0b/yAf Gv93dWn/vLup/7e2ov+1tZ3/tLSa/7a3mP+3uJj/tbeS/7a4kf+2uJD/tbeP/7S2jv+0to7/ s7WN/7K0jf+wtY3/sbaO/7C3jv+wtI//r7aN/6+zjv+utYz/rrKN/620i/+wtI//r7aN/6+z jv+utYz/r7OO/620i/+uso3/rbSL/624jv+os4j/pbCG/6axhv+qtYr/rreM/6y1iv+psoX/ qrGF/6uyhv+stIX/q7GD/6mvf/+pr3//qrCA/6yxiP+dpIX/kJiD/3yFdP9qcWn/XGVi/1dg Zf9XYWr/V2Nv/1tkc/9ganT/Z3B3/252eP93fXn/g4uA/5SajP+iqI7/oKl8/6GsdP+jrHX/ o652/6KrdP+eqXH/nKVu/5mkbP+hqnP/m6Zu/5ihav+Xomr/m6Rt/5ynb/+ao2z/l55r/5KS bP+PjGv/h4Nm/397YP94c13/c25b/25rXP9taWD/aWZh/3Ftbv9+fIH/jouU/52apf+opLL/ rqq5/7Cvt/+ys6v/r7Sg/6qul/+hp4v/mqB+/5Kacf+QmGn/jphk/5OcZf+SnWP/k5xj/5Gc Yv+Sm2T/kZtm/5GaZf+QmmX/kptm/5GcZP+RmmX/j5pi/5CZZP+OmWH/jpdi/42YYP+MlWD/ i5Ze/4uUX/+KlV3/ipNe/4iTW/+Jkl3/iJFc/4aOW/+FjVz/iJBd/4mRYP+FjV7/hYxj/4+U dP9NUDv/IyUa/yMjIf8jIif/IyIq/yMiKP8jIif/IyMj/yMjI/8hISP/RERG/+Ti5f9GRkj/ XFtg/15fY/9WWV7/XmJl/1tgY/9XXV3/WF1X/11gV/9maln/kZV+/5KTdP+QkGz/lJVt/5SV a/+PlGv/j5Zt/4+WbP+Ql23/kZhu/5KZb/+SmW3/k5pu/42UaP+OlWn/jpZn/4+XaP+QmGf/ kZlo/5GZaP+Smmn/j5dm/4+XZv+Pl2b/j5dm/4+XZv+Pl2b/j5dm/4+XZv+UnGv/lZ1s/5ae bf+Xn27/mKBv/5mhcP+aonH/mqJz/5uhdf+doHX/naB1/52gdf+doHX/naB1/52gdf+doHX/ n6J3/5+id/+fonf/oKN4/6CjeP+go3j/oaR5/6Gkd/+kpHL/pKRw/6Wlcf+jpXP/o6d1/6Ko eP+iqnv/n6qA/6Kuiv+PnH7/l6WM/3SFcv9fb2L/W2xk/1hrZ/+hrqf/r7Kh/6Gfiv+loo// VFFC/zUzJ/8bGBH/GxcU/ywoJ/88Ojv/SkhL/1NSV/9SUVb/UlFW/1NSV/9KSU7/PDw+/zg2 N/8eGhn/EQ0M/xUREP8UEA//FxMS/xwYF/8bFxb/GhYV/xYSEf8WEhH/GhYV/xsXFv8bFxb/ JCAf/zAtKP9FRjb/qqyW/9jawv+usZT/n6OC/7O3kv+xto7/rrOK/660iP+utIb/rrSG/660 hP+utIT/rrSE/660hv+utIb/rraH/622h/+ttIj/rLWG/620iP+rtIX/rLOH/6u0hf+psIT/ qLGC/6mwhP+osYL/qbCE/6ixgv+psIT/qLGC/6ezg/+mtIH/prSD/6a0gf+mtIH/p7OB/6ez gf+ns4H/qLKA/6iyfv+osn7/qLB9/6ixfP+osXz/p7B7/6avgP+gp4X/kpuA/32Gcf9qcmP/ W2Rf/1ZgYf9YYWr/WWNt/1lhbv9bY27/YGlw/2pzcv95gHn/iJCB/5adi/+dpof/oKx6/6Cu cf+irXH/n61w/6GscP+erG//oKtv/56sb/+jrnL/oa9y/6Ktcf+grnH/oaxw/5+tcP+hrHD/ oqt0/6Chd/+fnXf/mZZ1/46Nbv+DgmT/dnRb/2tpVP9lYlP/b21h/3BtaP9ybm//eHN5/4B6 hP+IhZD/kY2b/5aVm/+rrqf/p66c/6Spk/+dpon/m6KA/5ahdv+WoG7/k6Bq/5WgZv+ToWT/ laFj/5OhY/+VoGT/k6Fm/5WgaP+ToGj/k55m/5GfZP+SnWX/kJ5j/5KdZf+PnWL/kZxk/4+d Yv+RnGT/jpxh/5CbY/+Nm2D/jplh/4uZXv+NmGD/jJdf/42WYf+LlF//jZZf/42WYf+JkWD/ h45k/5GXdf9PUzz/JCYb/yQkIv8kIyj/JCMr/yQjKf8kIyj/JCQm/yQkJP8iIiT/RUVH/+Ph 5P9GREf/XFtg/11eYv9XWF3/XWBl/1pfYv9XXV3/VltV/1heUv9kaVX/jpR4/46Sb/+Nj2f/ kZRl/5GUZf+NlWb/jJVo/42WZ/+Nlmf/jpdo/4+Yaf+PmWf/kJpo/42XZf+Nl2X/jphk/4+Z Zf+PmWT/kJpl/5GbZv+Rm2b/j5lk/4+ZZP+PmWT/j5lk/4+ZZP+PmWT/j5lk/4+ZZP+Unmn/ lJ5p/5Wfav+WoGv/mKJt/5mjbv+apG//mqRv/5qib/+boXH/m6Fx/5uhcf+boXH/m6Fx/5uh cf+boXH/nqR0/56kdP+epHT/nqR0/5+ldf+fpXX/oKZ2/6Cnc/+hpG3/oaVq/6Kma/+iqGz/ oKhs/6Cqbv+gq3H/nqt1/5Wjcv+Xpnv/kqJ+/3iIbf9hcl//Tl5R/0ZXTf9hbWP/sLOi/7Ow nf+em4r/Ozcr/zIvJv8nJB3/GxcU/ycjIv8vLS7/Ojg7/0JCRP9CQkT/RERG/0dHSf9CQkT/ Nzc3/zo2N/8dGRj/DwsK/xQQD/8YFBP/HBgX/x8bGv8ZFRT/HBgX/xkVFP8ZFRT/HBgX/xoW Ff8XExL/HRkY/yglHv8jJQ//fYJk/6uuj/+nrYn/rbGM/620iv+rsYX/sLiH/661gv+ttYL/ rrWB/622gf+utYH/rbWC/661gv+ttYL/rbeD/623g/+tt4P/rLaC/6y2gv+stoL/q7WB/6u1 gf+ps3//qbN//6mzf/+ps3//qbN//6mzf/+ps3//p7R//6e2f/+ntn//p7Z//6e2f/+ntn// p7Z//6i1f/+otX//p7R8/6e0fP+ms3v/prN7/6ize/+ls3j/p7J6/6Wyff+fqoD/k517/3+J bv9rdGH/XWde/1hhYP9ZYGj/WmJt/1thbf9cY23/YWhu/2pzcP95gHj/iJGA/5aeif+eqIb/ oq95/6Kwcv+isHL/oa9x/6Gvcf+hr3H/oK5w/6CucP+hr3H/oa9x/6Gvcf+grnD/oK5w/5+t b/+frW//oaxy/6Gkdf+goXf/mptz/5KSbP+Hh2X/fHtc/3FwVP9salP/amlX/2tpXP9tamX/ cW1s/3hzd/+Ae4L/iIKM/4uJjv+go5z/nqWV/56mkf+cpYr/mqSB/5eid/+VoW//k6Bo/5Si Zf+Uo2L/lKNi/5SjYv+UomT/lKJl/5SiZ/+Uomf/kZ9k/5GfYv+Rn2T/kZ9i/5CeY/+QnmH/ kJ5j/4+dYP+PnWL/j51g/46cYf+Nm17/jZtg/4yaXf+LmV7/i5le/4yXXf+MlVz/jZdb/46X Xv+Jkl3/iI9j/5KYdP9QVDv/JCYZ/yQkIv8kIyj/JCMr/yQjKf8kIyj/JCQm/yQkJP8iIiT/ RUVH/+Lg4f9FQ0b/W1pf/1xdYf9WV1z/XF9k/1leYf9WXFz/UllS/1RcT/9fZ1L/i5Jz/4mQ Z/+IjmD/jJNf/4yTXf+Jk1//iJRi/4iUYv+JlWP/ipdi/4qXYv+LmGL/i5hi/4yZY/+MmWP/ jZpi/46bY/+Om2P/j5xk/5CeY/+QnmP/j51i/4+dYv+PnWL/j51i/4+dYv+PnWL/j51i/4+d Yv+ToWb/k6Fm/5SiZ/+Vo2j/l6Vq/5ima/+Zp2z/m6Zs/5ylbv+cpW7/nKVu/5ylbv+cpW7/ nKVu/5ylbv+cpW7/nqdw/56ncP+ep3D/n6hx/5+ocf+gqXL/oKly/6GpcP+dpWn/n6Vl/6Cm Zv+fqGX/oKlm/5+qZv+fq2n/natt/5mobf+ktYH/mKd8/5CgfP92hGr/SllG/z5MP/88Rjv/ i4x+/7azpP+mopb/PTku/zMwKf8pJiH/FREO/x4aGf8ZFxj/IR8g/yUlJf8lJSX/KCgo/y0t Lf8tLSv/KCgm/zQwL/8aFhX/DwsK/xQQD/8ZFRT/Hxsa/yAcG/8YFBP/HBgX/xsXFv8dGRj/ IBwb/x0ZGP8YFBP/HhoZ/ygoHv8XGwD/e4Nc/6Srgv+vuI3/u8KW/623hf+stIH/r7mE/6+4 gf+uuYH/r7iB/665gf+vuIH/rriD/6+4g/+uuIP/rriD/6y5g/+suYP/rLmD/6u4gv+ruIL/ qreB/6q3gf+otX//qLV//6i1f/+otX//qLV//6i1f/+otX//qLV9/6i3fP+ot3z/qLd8/6i3 fP+ot3z/qLd8/6i3fP+ot3z/p7Z7/6e2e/+ntnv/prV6/6e1ev+mtnj/prR5/6W0ff+grX// laF7/4KNbf9veWH/Ympd/1xiYP9bYGb/W2Js/15ibv9fY27/Y2hs/2txbf93f3T/h5B9/5ag h/+eqoT/pLN8/6S0c/+ktHP/o7Ny/6Ozcv+js3L/orJx/6Kycf+hsXD/obFw/6Cwb/+gsG// oLBv/5+vbv+fr27/oq1x/6Kpdf+jpnf/nqF0/5ibcP+OkWb/hIZf/3t8Wv92d1j/bmxT/25s V/9va1//cm5l/3Zxbv98dnb/gHp+/4F/gP+OkIv/kJaK/5Wciv+ZoYn/m6WD/5qle/+XpG// laNo/5SiZP+Uo2D/lKNg/5SjYv+UomT/lKJl/5SiZ/+Uomf/kqBj/5KgYv+SoGP/kqBi/5Gf Yv+Rn2H/kZ9i/5CeYP+QnmH/kJ5g/4+dYP+OnF7/jpxf/42bXf+Mml3/jJpc/42ZW/+MmFr/ jZlb/46ZXf+JlFz/iJJg/5Kac/9QVjr/IycY/yMlIP8jJCj/IyMr/yMjK/8jJCn/IyQo/yMk Jv8iIiT/RUVH/+Hf4P9EQkP/Wlle/1tcYP9VVV3/W15l/1hdYf9UWlr/T1ZP/1JaTf9cZE3/ hpBu/4aPZP+EjFn/iZFY/4mTV/+Hklr/hpNd/4aTXf+HlF7/iJVf/4mWXv+Jll7/iphd/42b YP+OnGH/jpxh/4+dYP+QnmH/kZ9i/5GfYv+Rn2H/kZ9h/5GfYf+Rn2H/kZ9h/5GfYf+Rn2H/ kZ9h/5GfYf+UomT/laNl/5akZv+XpWf/mKZo/5mnaf+aqGr/mqhq/5yna/+cp2v/nadr/5yn a/+dp2v/nKdr/52na/+cp2v/oKpu/5+qbv+gqm7/oKtv/6Grb/+gq2//oqxw/6KscP+dp2r/ nahm/5+oZf+eqWT/n6tj/6CsZP+frGb/oK1o/6Oycf+hrnb/nKp5/6Swiv+IlXn/UV1H/ztG OP89Qzf/TU1B/4iEeP+YlIn/UU1E/0E+Of81MS7/Hxsa/xYSEf8NCwz/DgwN/w4ODv8NDQv/ Dw8N/xITDv8UFRD/FBMP/yUhIP8WEhH/Eg4N/xYSEf8WEhH/HBgX/yAcG/8YFBP/GRUU/xoW Ff8fGxr/Ih4d/x4aGf8aFhX/Ix8e/zAwJP8jKQf/nqd6/7zFlv+1v43/uMKO/6+5hP+3wor/ rLd9/7C7f/+wu3//sLt//7C7gf+wu4H/sLuD/7C6hf+uu4P/rruD/668gf+tuoL/rbuA/6y5 gf+sun//rLmB/6y6f/+ptn7/qbd8/6m2fv+pt3z/qbZ+/6m3fP+ptn7/qbd8/6q4e/+puXr/ qrh7/6m5ev+puXv/qbl6/6m5e/+puXv/qbl7/6m5e/+puXv/qLh6/6i4ev+nt3n/p7d5/6e2 ff+jsX7/mKV6/4aSbv9zfWT/ZW1e/15kYP9cYWX/XGBp/19jbv9fY2z/Ymdq/2lva/92fnH/ ho96/5aghf+grIT/p7Z9/6e3dv+mtnX/prZ1/6a2df+ltXT/pbV0/6W1dP+isnH/orJx/6Gx cP+hsXD/oLBv/6Cwb/+gsG//oa9x/6Wsdv+mqnf/pKh2/5+jcf+Xm2n/j5Jj/4eKX/+DhV7/ eXlX/3l4Wv95d2L/endm/3p2a/98d3H/fXh0/315dv96fHf/f4V7/4qRgf+Tm4T/maOB/5um fP+ZpnH/l6Vq/5WkY/+VpGH/laRh/5WkYf+VpGP/laNl/5WjaP+Vo2b/lKJl/5SiZP+ToWP/ k6Fj/5OhY/+SoGL/kqBi/5KgYv+Rn2H/kZ9h/5GfYf+QnmD/j51f/46cXv+OnF7/jZtd/46a Wv+NmVf/j5tZ/4+bW/+Lllz/iZNf/5Obcv9RVzv/IycY/yMlIP8jJCj/IyMr/yMjK/8jJCn/ IyQo/yMkJv8iIiT/RUVH/+Hd3v9CQEH/WFdc/1laXv9TU1v/Wl1k/1dcYP9RWln/TFZO/09a Sv9aZEv/hY9s/4WOYf+CjFf/h5FU/4iSVf+Hklj/hpNb/4aTW/+HlVr/iJZb/4mXXP+Jl1z/ iphb/4+dYP+PnV//kJ5g/5CeYP+Rn2H/kqFg/5OiYf+TomH/lKNg/5SjYP+Uo2D/lKNg/5Sj YP+Uo2D/lKNg/5SjYP+WpWL/lqVi/5emY/+Yp2T/mahl/5qpZv+bqmf/nKto/5yrav+cqmz/ nqps/5yqbP+eqmz/nKps/56qbP+cqmz/oa1v/5+tb/+hrW//oK5w/6KucP+grnD/o69x/6Ov cf+eqW3/nqps/6Cqa/+grWj/oa5o/6GuZv+ir2f/oq9p/6+7ef+eqW//p7F//6y0jf+fpYn/ e4Bs/01QRf8+Pzf/NjMq/01JQP9oY13/U05K/0dDQP9EQD//NjIx/xoWF/8UEhP/EQ8Q/wwM Cv8LDAf/CgsF/wgJAf8JCgL/DAsG/xcTEP8UDg7/GBIS/xoUFP8VDw//GxUV/yIcHP8cFhb/ GRMT/xoUFP8dFxf/HRcX/xYQEP8SDAz/HxkZ/zAuIf89RR7/qLWA/7fEjv+otX3/rLp//6+9 gP+8yoz/rLp8/6+9f/+vvX//r71//6+9gP+vvYL/r72C/6+8hP+vvIT/r72C/66+gP+uvYL/ rb1//628gf+tvX//rLuA/6y8fv+quX7/qrp8/6q5fv+qunz/qrl+/6q6fP+quX7/q7l8/6y6 fP+su3r/rrp8/6y7ev+sunz/rLt6/6y6fP+sunz/rLp8/6y6fP+ru3z/qrp7/6q6e/+puXr/ qbl7/6m4ff+mtH//nKl7/4uXcf94g2X/a3Ji/2FmYP9eYmX/XWBp/2JkcP9hZG3/YmZp/2ht Z/90fG3/ho96/5eihP+hrYX/qbZ+/6m3ef+otnj/qLZ4/6i2eP+ntXf/p7V3/6e1d/+ksnT/ o7Fz/6Oxc/+jsXP/orBy/6Kwcv+isHL/pLBy/6evdv+orXf/p6x0/6Spcf+fpGz/mZ5o/5OX ZP+PkmP/hIVb/4ODXf+CgWP/gH5l/316Z/96d2j/eHRo/3Vyaf9sbGr/c3Vw/4CDeP+Nkn7/ l55//5ujev+cpnL/m6Zs/5ikZP+YpGL/mKVg/5ikYv+YpGT/mKRm/5ijaf+Yo2f/l6Jm/5ej Zf+Xo2X/lqJk/5aiZP+WomT/laFj/5WhY/+VoWP/laFj/5SgYv+Tn2H/kp5g/5KeYP+RnV// kZ1d/5CcWv+PnFf/kJ1Y/5CcWv+Ml1v/i5Vg/5Scc/9SWTr/IycY/yMlIP8jJCj/IyMr/yMj Lf8jIyv/IyQp/yMkKP8iIiT/RUVH/+Dc3f9BP0D/WFZb/1hZXf9SUlr/V1xi/1VaXv9PWFf/ TVdP/1BbS/9bZUz/hZFr/4SQYP+Djlb/iJJT/4eTUf+HlVj/iJZZ/4iWW/+Jl1r/iphb/4qY W/+LmVz/i5lb/5CeYP+Qn17/kaBf/5KhYP+TomH/k6Jf/5SjYP+Uo17/lqVg/5alYP+WpWD/ lqVg/5alYP+WpWD/lqVg/5alYP+XpmH/l6Zh/5inYv+ZqGP/m6pl/5yrZv+drGf/naxn/56t av+erWr/nq1s/56tav+erWz/nq1q/56tbP+erWr/oK9u/6Gwbf+hsG//obBt/6KxcP+isW7/ orFw/6Oxc/+grnP/oq11/6Oucv+ksHD/pbJt/6WybP+ms23/prNt/6q0df+jrHP/rraF/6qu if+srpb/qaqa/3BwZv87OjX/SEM//z45Nf9OSUX/TUhF/zg0M/80MC//NzM0/yYiI/8kIiP/ Hh0b/xobFv8bHBb/GBkR/xIUCf8QEgf/FRUL/xQQDf8VDw//HRcX/x8ZGf8cFhb/JB4e/ykj I/8fGRn/HRcX/xwWFv8cFhb/FxER/w0HB/8LBQX/HhgY/zQyJf94gVb/qbZ+/6q4ff+ntXj/ sL6A/7LBgP+6yYj/scB9/7HAf/+xwH//sb+B/7G/gf+xv4T/sb+E/7G+hv+xvob/r7+B/6+/ gf+vv4H/r7+B/66+gP+uvoD/rr6A/629f/+ru33/q7t9/6u7ff+ru33/q7t9/6u7ff+ru33/ rLp8/6+7e/+vu3v/r7t7/6+7e/+vu3v/rbx7/628e/+tvHv/rrx+/668fv+svH3/rLx9/6y8 ff+ru3z/q7t9/6u6f/+puIH/n616/4+bc/99iGj/bnVj/2RpYv9eYmX/XF9m/2Nlcf9iZWz/ YmZp/2dsZv9ze2z/hY93/5eihP+jsIX/qLV//6i2eP+otnj/p7V3/6e1d/+mtHb/prR2/6a0 dv+ls3X/pLJ0/6SydP+ksnT/o7Fz/6Oxc/+jsXP/pLBy/6auc/+prnT/qa50/6iucv+lq2// oKVr/5ugaP+YnWf/i41c/4qLX/+IiGL/hINk/359Yf93dV7/cW5b/2xqXf9iYmD/aGpp/3V4 b/+Dh3b/j5V5/5efeP+cpnT/nahu/5mlZf+ZpWP/maZh/5mlY/+ZpWX/maVn/5mkav+ZpGr/ maRo/5ikZv+YpGb/mKRm/5ejZf+Xo2X/l6Nl/5ejZf+WomT/lqJk/5WhY/+VoWP/lKBi/5Of Yf+SnmD/kp5e/5GeWf+QnVf/kp9Z/5KeXP+Omlz/jJdf/5afdP9UWzz/IycY/yMlIP8jJCj/ IyMr/yMjLf8jIyv/IyQp/yMkKP8iIiT/RUVH/9/b3P9APj//V1Va/1dYXP9RUVn/Vlth/1RZ Xf9OV1b/T1lR/1FcTP9dZ07/h5Nt/4WRX/+DkVb/iZVT/4mWUf+KmFr/ipha/4uZXP+LmVv/ jJpc/42bXf+Nm13/jp1c/5GgX/+RoF3/kqFe/5OiX/+Uo2D/lKNe/5WkX/+VpF//mKdi/5io Yf+YqGH/mKhh/5ioYf+YqGH/mKhh/5ioYf+YqGH/mKhh/5mpYv+aqmP/nKxl/52tZv+ermf/ nq1o/5+wav+fsGr/n7Bs/5+wav+fsGz/n7Bq/5+wbP+fsGr/obJu/6GybP+hsm7/orNt/6Kz b/+is23/o7Rw/6OzdP+jsnv/pLB+/6WyfP+mtHn/qbV1/6m1c/+rtnL/q7Zy/6qydv+4v4n/ usCS/72+nP/BwKv/ysi7/7GsqP9xbGn/VVBN/0pFQv9JREH/TkhI/z05OP8qJif/JiIj/ygk Jf8qKSf/JCMh/yIjHv8oKSP/Jigd/x0fEv8aHA7/ICAU/x4bFv8bFRX/HhgY/yQeHv8rJSX/ OTMz/zYwMP8hGxv/IBoa/yAaGv8fGRn/GxUV/xUPD/8bFRX/ODIy/1VTRP+ut4r/sb+C/7C+ gP+zwoH/tsWC/7XEgf+1xIH/s8J9/7PCf/+zwn//s8KB/7PBg/+zwYb/s8GG/7PAiP+zwIj/ scGD/7DAgf+wwIH/sMCB/6+/gP+vv4D/r7+A/66+f/+svH3/rLx9/6y8ff+svH3/rLx9/6y8 ff+svH3/rbt9/7C8fP+xvHr/sbx6/7C8ev+wvHr/sLx6/7C8fP+wvHz/r759/6++ff+vvX// rrx+/629fv+tvX7/rLx+/6y7gP+ruoH/orB7/5KfdP+Ai2n/cXlk/2hrZP9hYmb/Xl5m/2dn c/9kZGz/Y2Ro/2ZrZf9ye2r/hY92/5ijg/+ksYb/prN9/6a0d/+mtHf/pbN2/6Wzdv+ls3b/ pLJ1/6Sydf+ls3b/pbN2/6Wzdv+ksnX/pLJ1/6Sydf+jsXT/pbFz/6Sucf+mrnL/p69z/6ew cf+ornD/patt/6Gna/+fpGr/l5pj/5aYZ/+TlGj/jY1n/4eEY/99eVz/dHBX/21qW/9fXlz/ ZGRm/25vaf97fW//iIxx/5SadP+cpHP/oKlw/5ulZv+bpmT/m6Zi/5umZP+bpWb/m6Vo/5uk a/+bpGv/m6Vp/5qkaP+apGj/mqRo/5mjZ/+Zo2f/maNn/5mjZ/+Yomb/mKJm/5ehZf+XoWX/ lqBk/5WfY/+UnmL/k59f/5KfWv+Pn1b/kaFY/5GgW/+NnFv/i5hg/5Wgdf9TXD3/ISgY/yEm IP8hJSj/ISQr/yEkLf8hJCv/ISQp/yMkKP8iIiT/RUVH/9za2/8/PUD/VVRZ/1ZXXP9RUVn/ V1ph/1RZX/9QVlb/UllS/1VdTv9eaE3/iZRs/4eUX/+EklT/ipdS/4qXUf+Lmlf/jJta/4yb Wv+NnFv/jp1c/4+eXf+Pnl3/kJ9c/5KhXv+SoV7/k6Jf/5OiX/+Uo17/laRf/5alYP+WpWD/ mKhh/5ioYf+ap2H/mKhh/5qnYf+YqGH/mqdh/5ioYf+bqGL/mali/5ypY/+bq2T/nqtl/52t Zv+grWf/n69o/6Cwaf+fsGn/oK9q/5+wav+gr2z/n7Bs/5+wbP+fsGr/orNt/6KzbP+is2z/ orNs/6O0bf+jtG3/o7Rt/6K0dv+jtIj/o7OP/6S0j/+ltIv/prWK/6e3iP+qt4n/qreJ/8fS p//j7cj/3+bH/+/z3P/u7+H/7u7m///++//W0tP/T0tM/0pGR/88ODn/TkpL/1hWWf8+PD// Hhwf/xwaG/8lIyT/Hx4c/yIhHf8tKiP/LSoh/yUhFf8iHxD/KSMX/y4jHf8kGRf/JBYV/ywh H/8+MDD/TkJC/0Q4OP8lGRn/JBoY/yUbGf8mHxn/JB8Z/yMgF/8xMSX/VlZK/3l9ZP+6xJL/ ssCC/7vKif+3xoX/sL98/7PCf/+ywX7/s8J//7PCf/+zwoH/s8GD/7PBhP+zwYb/s8GG/7PA iP+zwIj/ssCD/7HBgv+ywIL/sMCB/7G/gf+vv4D/sL6A/6+/gP+uvH7/rb1+/668fv+tvX7/ rrx//629f/+uvH//rrx+/7G9ff+yvXv/sr17/7K9e/+xvXv/sb17/7G9ff+xvX3/sL9+/7C/ fv+vvX//r71//6+9f/+tvX7/rrx+/629f/+tu37/o7J7/5Whc/+DjWr/c3tm/2lsY/9hYmb/ Xl5o/2dmdP9jZXH/Y2Rp/2VpaP9xeWz/hI14/5iih/+lsYv/pbF//6WzeP+ksnX/pLJ1/6Sy dP+jsXP/o7Fz/6Oxc/+mtHf/pbN2/6Wzdv+ls3b/prF1/6SydP+msnT/prJy/6Ksbf+krm// prBx/6ixcP+nsG//pa5t/6Krav+iqGr/o6hu/6Knb/+eonD/mJlt/46PZ/+Dg1//eHdY/3Jw W/9hXFb/ZGBd/21qY/94dmn/hIZw/5GVdP+bonj/oqt2/5ulaf+bpWb/m6Zk/5umYv+bpWb/ m6Vo/5ulaf+bpWn/m6Vp/5ulaP+bpWj/mqRn/5qkZ/+apGf/maNm/5mjZv+Zo2b/maNm/5ii Zf+XoWT/lqBj/5agY/+Vn2L/lZ9g/5OgW/+Pn1b/kaFa/5GgW/+NnFv/jJlh/5Whc/9TXTv/ ISgW/yEmIP8hJSj/ISQr/yEkK/8hJCv/ISQp/yMkKP8iIiT/RUVH/+Dg4v87Oz3/VVZb/1VV Xf9WVmD/UVFb/1JVXP9QVFf/UldT/0dNP/9gaU7/k5ty/42XYv+Omlr/kJ1V/5WjWP+Pnln/ j55b/5CfXP+Qn1z/kJ9c/5GgXf+RoF3/kaBb/5moY/+ZqGP/mahj/5moY/+ZqGP/mahj/5mo Y/+ZqGP/m6hi/5uoYv+cp2L/m6hi/5ynYv+bqGL/nKdi/5uoYv+dqGP/nKlj/56pZP+dqmT/ nqlk/56rZf+fqmX/nqtj/6GvZP+bq2D/nKlj/5+ua/+ns3P/prR2/6Gwb/+bqmf/obFq/6Gx Zv+jtmf/p7pr/6e6a/+lt2v/o7ht/6S3f/+esZv/obav/52yq/+ftK3/r8S7/7vQx//K39b/ 5Pjv/+b37//X5t//zdnV/9Xg3P/j7On/6O7s/+nt7P/u7/H/iYiN/1BPVf9GRUv/T05U/2hn bf9vbnT/QUBF/yEfJP8sKi3/TUlK/z42NP9IPzr/PTAq/zEjGv8wHxX/MiAU/zwmG/9LMiv/ Wj46/2BHQ/9tUVD/b1VU/2JKSv9NODX/JhMN/yUXDv8yKxv/NTMe/yktEv9BSyn/g49r/7XC lv+1wor/tcOF/7bEhv+2xIb/t8aF/7fGhf+3xYf/t8WH/7bEhv+2xIb/tsSH/7XDiP+1w4j/ tcOI/7TCh/+0wof/s8GG/7PBhP+0v4P/ssCD/7O/gf+xv4H/s7+B/7G/gf+xvX//r71//7G8 gP+vvYD/sLuB/668gf+vuoD/r7p+/7K+gP+yvn7/sr5+/7K+fv+yvn7/sr5+/7K+fv+yvn7/ tMCA/7TAgP+zv3//s79//7O/f/+wv37/sr5+/7C/fv+tuXn/pLJ1/5qkcv+Jk27/eYFq/2tx Z/9hZWj/XF5r/2Nkdv9fYnP/XmBt/2Rpb/9zeXf/hY+E/5eikf+ir5H/rbqO/6q5gv+ltHn/ obFy/6CvbP+hsGv/o7Jv/6W0c/+msnT/prF1/6axd/+msXX/p7F0/6aycv+nsm7/prNu/6ez cf+ns3H/prJw/6axb/+msW//pbBs/6Sva/+lrm3/qbJz/6Sscf+epW//nKBu/5ibbv+RlGn/ hohg/4B9Xv92bVz/em5i/31zZ/+EfG//jYh1/5WVff+doYD/oah8/56ncv+dqGz/nKhm/5uo Y/+bqGP/mqZk/5qkZf+apGX/mqRl/5qkZf+apGX/mqRl/5qkZf+apGX/mqRl/5qkZf+apGX/ maNk/5mjZP+YomP/l6Fi/5agYf+WoGH/lqFf/5ajXv+Sn1n/k6Bb/5aiYP+WomT/lJ9n/5ih dP9QVzb/JSkY/yUoIf8kJSf/JCUq/yQlKv8jJCj/IyQm/yMkJv8iIiL/RUVF/9/g4v85Oj7/ VVZb/1RUXP9VVWH/UVFb/1NTXf9RUlb/U1VS/0lNP/9iaEz/k5ty/46ZYf+Pm1n/kZ9U/5ak V/+Solv/kqFc/5KhXP+SoVz/k6Jd/5OiXf+Uo17/lKNe/5moY/+ZqGP/mahj/5moY/+ZqGP/ mahj/5moY/+bqGP/nKdi/5ynYv+cp2L/nKdi/5ynYv+cp2L/nKdi/5ynYv+eqWT/nqlk/56p ZP+eqWT/n6pl/5+qZf+fqmX/oKxk/6i2a/+ls2j/oq9p/6Ovbf+lsXH/prJy/6Szcv+isWz/ qLhv/6e3bP+ktmr/obNp/52uaP+fr27/p7Z7/6u9lf+juLH/lqy3/4edqv+EnKj/kKe1/5mw vv+dtML/ornH/7PJ1v+3ytj/vc3a/7/N1v/Eztf/0drh/9jf5f/U2d//mJuk/4aJkv9XWmP/ U1Zf/1VYYf9/f4f/YmJq/y4tM/8xLDL/QTs9/1VLSv9WSEX/W0hC/1dDOv9WQDX/YUY7/10/ NP9uTkP/e1lQ/31cVf9+XVj/f11b/3ZXVf9pTUn/RzAo/ywcDf8eFgD/Li8Q/1NZM/+AjWH/ pLaE/7THkP+0xIb/tcOF/7bEhv+2xIb/t8WH/7fFh/+3xYj/t8WI/7bEh/+2xIf/tsSH/7bE h/+1w4j/tcOG/7TCh/+0wof/tcCG/7XAhv+1wIT/tL+D/7S/g/+zv4H/s7+B/7O/gf+yvoD/ sr6A/7G8gP+xvID/sLuB/7C7gf+wu4H/sLuB/7K+gP+yvn7/sr5+/7K+fv+yvn7/sr5+/7K+ fv+yvn7/tMCA/7TAgP+zv3//s79//7O/f/+yvn7/sr5+/7K+fP+tunX/p7Nz/5ymcf+NlWz/ e4Nr/21zaf9iZmn/XF5r/2Fkdf9fYnX/XmFy/2Nncv9vd3n/goyE/5Wgkv+grZP/rLiQ/6m3 gv+ltHv/orJz/6Gwbf+ismv/pLNu/6W0cf+ns3X/p7J2/6ixeP+osnb/qLJ1/6izcf+os27/ p7Ru/6i1cP+ltHH/p7Nx/6aycP+lsm3/pLFs/6WwbP+kr2v/qLJz/6OtcP+fp27/nKNt/5mg bf+TmWn/i45h/4aEXv9/c13/g3Nk/4Z2af+KfnD/j4h4/5aUf/+enoL/oKaA/56mdf+dqG7/ nKho/5ypZP+bqGL/mqdi/5qlY/+apGX/mqVj/5qlY/+apWP/mqVj/5qlY/+apWP/mqVj/5ql Y/+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ajXv+Sn1r/k6Bb/5aiYP+WomT/ lJ9n/5ihdv9QVzb/JSkY/yUoIf8kJiX/JCUp/yQlKf8jJCb/IyQm/yMlJP8iIiL/RUVF/97f 4f84OT3/VFVa/1NTW/9UVGD/T09Z/1JSXP9QUVX/UVNQ/0hMPv9jaU3/lZ10/5CbY/+RnVv/ kqBV/5elWP+XpF7/mKVg/5ilYP+YpWD/maZh/5mmYf+ZpmH/mqdi/5ypZP+cqWT/nKlk/5yp ZP+cqWT/nKlk/5ypZP+cqWT/nahj/52oY/+dqGP/nahj/52oY/+dqGP/nahj/52oY/+eqWT/ nqlk/5+qZf+fqmX/n6pl/6CrZv+gq2b/oKtm/6CtZf+ir2f/pbJs/6azbv+ksG7/pLFs/6Sz bv+mtm//mKhh/6Cvav+ntnX/p7R8/6i0hv+xvZn/wcuy/8nXyv+RpKv/hJur/4KZq/+InrP/ jqS7/5Cpv/+Jorj/e5Go/5Gnvv+JnrP/ipuv/42cr/+gq73/yNHg/9LZ6f+2vMr/lpyo/5mf q/9fZXH/QkhU/0FFUP9rb3r/eHiC/z8+Rv8tKC7/LSQn/11SUP9ZSkX/Z1NM/2pUSf9tUkf/ eFxO/3JSRf9/XVH/imVc/4VjWv+AXVf/fVxV/3pcVP92W1L/bFlL/2hZRv9jXED/cXJQ/5ad c/+xv47/tceT/7PHjP+0xIb/tcSD/7bFhP+2xYT/t8WH/7fFh/+3xYf/t8WH/7fFh/+3xYf/ tsSG/7bEhv+1w4b/tcOF/7XDhv+1w4b/tsGH/7bBh/+1wIb/tcCE/7XAhP+0v4P/tMCC/7TA gv+yvoD/sr6A/7K+gP+yvoD/sbyA/7G8gP+wu3//sLt//7K+gP+yvn7/sr5+/7K+fv+yvn7/ sr5+/7K+fv+yvn7/tMCA/7TAgP+zv3//s79//7O/f/+yvn7/sr5+/7K+fP+vvHf/qbV1/5+p dP+RmXD/f4dv/3B2av9kaGn/XmBs/2Fkdf9fYnP/X2Jx/2Jmb/9sdHb/fYaB/5Caj/+cqJD/ qraQ/6m3hP+mtXz/pLR1/6SzcP+ks27/pbRv/6a1cv+otHT/qLN3/6myef+ps3f/qbN2/6m0 cv+ptG//qLVv/6i1cP+mtXL/p7Nx/6ezcf+ms27/pbJt/6WwbP+lsGz/qLJz/6Sucf+hqW7/ n6Zw/5+mc/+aoHD/k5Zp/4+NZ/+JfWf/jHxt/459c/+Pg3f/kop9/5eUgf+dnYP/nqR+/5+n dv+dqG7/nalp/5ypZP+bqGL/mqdi/5umZP+apWP/mqVj/5qlY/+apWP/mqVj/5qlY/+apWP/ mqVj/5qlY/+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ajXv+Sn1r/k6Bb/5ai YP+WomT/lJ9n/5ihdv9QVzb/JSkY/yUoIf8kJiX/JCUp/yQlKf8jJCb/IyQm/yMlJP8iIiL/ RUVF/9zd3/83ODz/UlNY/1JSWv9TU1//Tk5Y/1FRW/9PUFT/T1FO/0dLPf9jaU3/l592/5Oe Zv+UoF7/lKJX/5imWf+bqGL/m6hj/5uoY/+cqWT/nKlk/52qZf+dqmX/napl/52qZf+dqmX/ napl/52qZf+dqmX/napl/52qZf+dqmX/nqlk/56pZP+eqWT/nqlk/56pZP+eqWT/nqlk/56p ZP+fqmX/n6pl/6CrZv+gq2b/oKtm/6GsZ/+hrGf/oaxn/5mmYP+grWf/qLVw/6i1cP+jsGv/ n6xm/56uZ/+gsGn/tMN+/627ff+jsHr/oayE/6uznP+3vLX/ubzB/661xf+Rorb/gpiw/4CV sP95kav/cYml/3uUsv+Em7r/epGw/3iPrv+BlrX/k6bE/42cuf96iKL/j5uz/6ivyf+bo7r/ h4+i/32Gl/9pcoP/MzxL/zxDU/9ESlj/cnSA/1lYYP8vKjD/LCMm/1RGRf9hTkj/aFFJ/21T Rv9zV0n/eVlK/35aTP+EXlH/h2FW/4RgVP+BXVH/f19S/4BjVf9/ZVb/kH5q/7Gli//BvJz/ vb+X/73Gl/+2xI//rcCI/7LGif+0xIX/tcSD/7bFhP+2xYT/t8aF/7fGhf+3xYf/t8aF/7fF h/+3xYf/t8WH/7bEhv+2xIb/tsSG/7XDhf+1w4X/t8KI/7fCiP+2wYf/tsGH/7XAhv+1wIT/ tcCE/7XBg/+zv4H/s7+B/7O/gf+yvn7/sr5+/7K+fv+xvX//sb1//7O/f/+zv3//s79//7O/ f/+zv3//s79//7O/f/+zv3//tMCA/7TAgP+zv3//s79//7O/f/+yvn7/sr5+/7K+fP+xvnn/ rLh2/6Oudv+Wn3T/hI1y/3R6bP9na2r/YGNs/2Bjcv9gY3T/YGNy/2Flbv9nb3H/d4B7/4qU i/+YpJD/qLSQ/6e1hP+mtX7/prZ4/6a1cv+mtXD/p7Zx/6e2c/+ptXX/qbV3/6qzev+qtHj/ qrR3/6q1c/+qtXD/qbZw/6m1c/+ntnP/qLRy/6ezcf+ntG//prNu/6axbf+msW3/p7Jw/6Su b/+iqm//oqpx/6Oqdv+gp3T/mp1u/5eVb/+ShnD/lIR3/5SDe/+Thn3/lIyB/5eUgf+bm4H/ nKJ+/5+neP+eqW//nalp/5ypY/+cqWP/m6hi/5umYv+bpmT/m6Zk/5umZP+bpmT/m6Zk/5um ZP+bpmT/m6Zk/5umZP+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ajXv+Sn1r/ k6Bb/5aiYP+WomT/lJ9n/5ihdv9QVzb/JSkY/yUoIf8kJiX/JCUp/yQlKf8jJCb/IyQm/yMl JP8iIiL/RUVF/9vc3v81Njr/UVJX/1FRWf9SUl7/TU1X/1BQWv9OT1P/TU9M/0VJO/9kak7/ maF4/5ahaf+WomD/lqRZ/5mnWv+dqmT/napl/52qZf+eq2b/nqtm/56rZv+frGf/n6xn/56r Zv+eq2b/nqtm/56rZv+eq2b/nqtm/56rZv+eq2b/n6pm/5+qZv+fqmb/n6pm/5+qZv+fqmb/ n6pm/5+qZv+gq2f/oKtn/6GsaP+hrGj/oaxo/6Ktaf+irWn/oq1o/6Owav+otW//q7hz/6i1 cP+ir2n/n6xm/6Kvaf+ntG//nqpq/5+pdP+jq4T/sLWf/8XGyP/Ixtv/q6fM/4OFrv9+jK// douq/3WMrP9vhqj/Z3+j/3aQtf+EnML/epG6/3CHsP90jLL/kKbL/5ut0f+Flbf/gpGy/4uV uP9+iaf/fIqk/2x7kP96iZ7/RVJl/zxHWf84QVL/XGJw/2xsdv8+OT//QTc4/0g5Nv9vW1T/ cVZL/3ZZS/+CYlP/f1tL/41oWP+JYlP/h2BR/4plVf+QbFz/k3Jf/5J2Yf+SemL/rZyA/8i+ m//Oy6L/v8KT/7fBjP+wv4b/rMCD/7bLiv+0xIP/tcSB/7bFgv+2xYL/t8aD/7fGg/+3xoX/ t8aD/7jHhv+4x4b/t8aF/7fGhf+2xYT/tsWE/7bFhP+2xIb/uMOJ/7fCiv+3wor/t8KI/7bB h/+2wYX/tsGF/7bBhf+0wIL/tMCC/7TAgP+zv33/s799/7O/ff+yvnz/sr58/7O/f/+zv3// s79//7O/f/+zv3//s79//7O/f/+zv3//tMCA/7TAgP+zv3//s79//7O/f/+yvn7/sr5+/7K+ fP+zwHv/sLx6/6ize/+bpHn/iZJz/3mAcP9qb2v/YmVq/19jbv9gY3L/YWVx/2Bkb/9iam3/ cHl2/4SOhv+Tno3/pbCO/6azhf+ntYD/qLd8/6m4d/+puHP/qbly/6i3cv+qtnb/qrZ4/6u0 e/+rtXn/q7V4/6u1dv+rtnL/qrdx/6q2dP+ot3b/qbVz/6i0cv+otXD/p7Rv/6eybv+nsm7/ qLNx/6WvcP+krHH/pa10/6atef+kq3j/nqFy/5uZc/+Yi3j/mYh+/5iHf/+WiYD/lo6D/5eU g/+amoL/mqB8/6Coef+eqW//nqpo/52qZP+cqWP/m6hi/5ynY/+bpmL/m6Zk/5umZP+bpmT/ m6Zk/5umZP+bpmT/m6Zk/5umZP+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5aj Xv+Sn1r/k6Bb/5aiYP+WomT/lJ9n/5ihdv9QVzb/JSkY/yUoIf8kJiX/JCUp/yQlKf8jJCb/ IyQm/yMlJP8iIiL/RUVF/9na3P80NTn/UFFW/09PV/9QUFz/S0tV/05OWP9MTVH/SkxJ/0RI Ov9kak7/m6N6/5mkbP+ZpWP/mKZb/5qoW/+dqmT/napl/52qZf+eq2b/nqtm/5+sZ/+frGf/ n6xn/5+sZ/+frGf/n6xn/5+sZ/+frGf/n6xn/5+sZ/+frGf/oKtn/6CrZ/+gq2f/oKtn/6Cr Z/+gq2f/oKtn/6CrZ/+hrGj/oaxo/6GsaP+irWn/oq1p/6Ouav+jrmr/o65q/6e0bv+ntG7/ prNu/6SxbP+ksG7/qbVz/7C8fP+2woT/pbB4/7nCl//Gyq//v8C4/7a0wv+xq83/pZzR/5KP xP+Kl8H/h5u+/4SYu/95j7T/e5O5/4ukzP+Tq9f/iKDM/4Obx/9qgq7/comz/42jzP+Zq9P/ mKfO/4+dxP96iqz/doel/3GFnv9/kKr/YnKL/zVEWf9BTF7/Rk1d/2dpdf9IRUz/Sj9D/zgp Jv9sVU//d1tQ/39fUP+LaFX/hWBO/5FqWf+KYFD/hV9M/45pVv+ZdmD/nX1k/52CZ/+ciGf/ uauG/8C5jf+9vIz/tLmD/7C7gf+wwIL/s8iH/7zRjv+0xYH/tcSB/7bFgv+2xYL/t8aD/7fG g/+3xoP/t8aD/7jHhP+4x4T/uMeG/7fGhf+3xoX/tsWE/7bFhP+2xIb/ucSM/7jCjf+4wo3/ uMKN/7fCiv+3wor/t8KI/7bBh/+1wIT/tcGD/7XBgf+0wH7/tMF8/7TBfP+zwHr/s8B7/7O/ ff+zv3//s79//7O/f/+zv3//s79//7O/f/+zv3//tMCA/7TAgP+zv3//s79//7O/f/+yvn7/ sr5+/7K+fP+1wn3/sr58/6y3ff+gqXr/j5l3/32FcP9tcmv/ZGhr/15ia/9hZXD/YmZx/19j bP9eZWv/aXFz/36HhP+Pmor/o66O/6Wyhv+otoP/qrmA/6y7ev+su3b/qrpz/6m4c/+suHj/ rLh6/623e/+tt3v/rbd6/623eP+tuHT/rLl0/6u3df+puHf/qrZ0/6m1c/+otXD/qLVw/6iz b/+os2//qbRy/6awcf+lrXH/pa1y/6atd/+kq3f/nqJw/5uZcv+ZjHn/mol//5mIgP+WiYD/ lo6D/5aTgv+ZmYH/mZ97/6Coef+fqnD/nqpo/52qZP+dqmL/nKlh/5ynY/+cp2P/nKdl/5yn Zf+cp2X/nKdl/5ynZf+cp2X/nKdl/5ynZf+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV// lqFf/5ajXv+Sn1r/k6Bb/5aiYP+WomT/lJ9n/5ihdv9QVzb/JSkY/yUoIf8kJiX/JCUp/yQl Kf8jJCb/IyQm/yMlJP8iIiL/RUVF/9jZ2/8zNDj/T1BV/05OVv9PT1v/SkpU/01NV/9LTFD/ SUtI/0NHOf9la0//naV8/5umbv+bp2X/madc/5upXP+dqGP/nahk/52oZP+eqWX/nqll/56p Zf+fqmb/n6pm/6CrZ/+gq2f/oKtn/6CrZ/+gq2f/oKtn/6CrZ/+gq2f/oKtn/6CrZ/+gq2f/ oKtn/6CrZ/+gq2f/oKtn/6CrZ/+irWn/oq1p/6Ktaf+irWn/o65q/6Ouav+kr2v/pK9q/6Ct Zf+grWX/pK9r/6excv+qtHf/qrN6/6Wuef+hqXj/rrWL/7C1lf+XmIj/YF5f/zk0SP86Mlf/ TkR4/1ZShf+QnMT/l6vM/4+jxv96kLX/fJS6/4ylzf+Xr9v/l7Ld/5Gs2f+Dm8f/gZnF/4qh y/+HnMf/f5K8/4GSvf+InMH/dIip/3GJpf9vhKH/coah/0NVbf9BUGX/RU1g/2Fkc/9YVV7/ RDtA/zUlJf9WPzn/eFxR/4NiU/+BXEr/g11K/45lU/+IX03/iGJN/5JuVv+Zd1z/l3pc/5qC Xv+ejGT/wLOH/7u1g/+9vYf/vMSI/7TAgP+xwYD/tsqF/7zQi/+0xYH/tcSB/7bFgv+2xYL/ t8aD/7fGg/+3xoX/t8aF/7jHhv+4x4b/uMaI/7jGiP+3xYf/t8WH/7fFh/+2xIf/ucOO/7nD kf+5w5H/uMKQ/7jCjv+4wo7/t8GM/7fCiv+2wYf/tsGF/7XBgf+1wX//tcJ9/7TBe/+0wXn/ tMF7/7TAfv+0wID/tMCA/7TAgP+0wID/tMCA/7TAgP+0wID/tMCA/7TAgP+zv3//s79//7O/ f/+yvn7/sr5+/7K+fP+3xH7/tcJ9/6+6fv+krnz/kpx3/4CIcP9wdmr/Zmpp/11iZv9hZW7/ Y2dw/19jbP9bYmj/ZGxv/3mCgf+LlYr/oauQ/6SwiP+otoX/rLuE/668fv+tvHf/rLx1/6q5 dP+tuXf/rbl7/664fP+uuHz/rrh7/664ef+uuXf/rbp1/6y4dv+puHf/q7d1/6q2dP+ptnH/ qLVw/6m0cP+os2//q7Z0/6excv+lrXH/pa1y/6WtdP+iqXP/nKBt/5iWbf+Xi3X/mId9/5eG fv+ViH//lY2C/5aTgP+ZmX//mZ95/6Cod/+fqm7/nqpo/56rZf+dqmL/nKlh/52oZP+cp2P/ nKdl/5ynZf+cp2X/nKdl/5ynZf+cp2X/nKdl/5ynZf+apWP/maRi/5mkYv+Yo2H/l6Jg/5ah X/+WoV//lqFf/5ajXv+Sn1r/k6Bb/5aiYP+WomT/lJ9n/5ihdv9QVzb/JSkY/yUoIf8kJiX/ JCUp/yQlKf8jJCb/IyQm/yMlJP8iIiL/RUVF/9jZ2/8yMzf/Tk9U/05OVv9PT1v/SkpU/01N V/9LTFD/SEpH/0NHOf9la0//nqZ9/5ynb/+cqGb/mqhd/5upXP+cp2L/nKdj/5ynY/+dqGT/ nahk/52oZP+eqWX/nqll/6GsaP+hrGj/oaxo/6GsaP+hrGj/oaxo/6GsaP+hrGj/oaxo/6Gs aP+hrGj/oaxo/6GsaP+hrGj/oaxo/6GsaP+irWn/oq1p/6Ktaf+jrmr/o65q/6Sva/+kr2v/ pK9q/56sYf+hrmb/qbRy/6+5ff+ttYL/nKR1/4OKYf9vdVH/cHNW/2ttWP9UVEj/Ozc4/zcw QP9FPFn/RTlh/zEsVP8lLk//WWqG/3+SsP+Jnb7/kajK/5Ss0v+Nps7/jabP/5Wu1/+Encb/ eZK7/4KZwv+No8z/iJ7H/4KVvf+CmL3/fZS2/2uEo/9ieZn/eY6r/2R4kf8+TmX/V2J2/2lv f/9sanX/Qz1B/0AwMf9GMSz/fmJX/4ZmWf94U0H/gVtI/41nVP+MZlP/kW1X/5p4Xf+Zelv/ knhV/5aDWf+hk2T/xr+L/7OxeP+0uHv/u8SD/7TAfv+wwXv/tsqD/7bKg/+0xYH/tcSB/7bF gv+2xYL/t8aD/7fGhf+3xoX/t8WH/7nHif+4xoj/uMaJ/7jGif+3xYr/t8WK/7fFiv+3xI7/ usOU/7nCl/+5wpf/ucKX/7jBlP+4wZT/uMGS/7jCkP+2wIv/tsGJ/7bBhf+1wYH/tcJ9/7XC fP+0wnf/tMF5/7TAfv+0wID/tMCA/7TAgP+0wID/tMCA/7TAgP+0wID/tMCA/7TAgP+zv3// s79//7O/f/+yvn7/sr5+/7K+fP+4xX//tsN9/7G9f/+msHv/laB2/4KLbv9xeGj/Z2xm/11j Y/9iZ2v/Y2hu/15ia/9ZYGj/Ymlv/3d/gv+Jk4v/oauS/6Swiv+otYf/rLuE/6+9f/+uvXr/ rLx1/6u7dP+tuXf/rbl5/664e/+uuHz/rrh7/664ef+uuXf/rbl3/6y4eP+quXj/q7d3/6q2 dP+qt3L/qbZx/6m0cP+ptHD/q7Z0/6izcf+lrm//pKxw/6Sscf+gqG//mp9p/5WUaP+ViXH/ loZ3/5aFe/+UiHz/lI19/5WTfv+ZmX3/mZ95/6Gpdv+fqm7/n6tp/56rZf+dqmL/nKlh/52o ZP+cp2P/nKdl/5ynZf+cp2X/nKdl/5ynZf+cp2X/nKdl/5ynZf+apWP/maRi/5mkYv+Yo2H/ l6Jg/5ahX/+WoV//lqFf/5ajXv+Sn1r/k6Bb/5aiYP+WomT/lJ9n/5ihdv9QVzb/JSkY/yUo If8kJiX/JCUp/yQlKf8jJCb/IyQm/yMlJP8iIiL/RUVF/93e4P8yMzf/SElO/0ZGTv9LS1f/ SEhS/0pKVP9GR0v/REZD/z9DNf9gZkr/maF4/5eiav+ZpWP/mKZb/5qoW/+bpmH/m6Zi/5yn Y/+cp2P/nKdj/52oZP+dqGT/nahk/5+qZv+fqmb/n6pm/5+qZv+gq2f/oKtn/6CrZ/+hrGj/ n6po/5+qaP+fqmj/oKtp/6Gsav+irWv/oq1r/6OubP+lsG7/pbBu/6axb/+msW//p7Jw/6ey cP+nsnD/p7Jt/56qYP+lsWn/q7V2/663gv+fpHz/foFi/4WHcf+ys6H/2dfK/+bk2P/q5+D/ 4NvY/6ulqf9SS1P/MCU1/0xIWf8tNEf/BxYr/zJCWf+ClKz/hJiz/5uwz/+ZsND/hp7A/4Wd wf+Pp8v/g5u//4ScwP+KoMX/gpm7/4aavf+FnL7/fJO1/3WOrf9thKT/f5Sz/3eLpv9hcYr/ Xml//2Fmef98fIj/ZWBm/0c4O/9EMS3/e2BZ/3haT/96Vkj/hF9P/31YSP+UcV7/jm5X/45w VP+kjGr/oo9l/6CSY/++tX7/wbyC/76+gP+6wX7/t8J9/7bDff+0w37/s8R+/7PEfv+0w37/ tMN+/7C/fP+3xoP/wdCP/7XEg/+quHr/s8GE/77Mkf+0wof/sr+H/8DNl/+5xpH/tMGM/8DM mv+1wZP/wMih/8rSrf+6wZ//srmX/6Ssh/+bo37/srqT/7W+k/+xuov/tL6K/77Jkf+xvX// uMSC/8LPif+vvXL/t8R8/7fDgf+3w4P/t8OD/7fDg/+2woL/tsKC/7XBgf+1wYH/s79//7O/ f/+zv3//s79//7O/f/+zv3//s79//7O/ff+uu3P/rrt1/666ev+tuID/pLCC/5Ode/9+hm// bnRo/2FnY/9eY2b/XWJm/19jbP9bYmr/XWRs/2tyeP98hYL/kpuG/5yohP+otYn/rryH/668 f/+quXb/p7dw/6e3cP+tuXf/rbl5/664e/+tt3v/rbd6/623eP+st3X/q7d1/625ef+runn/ rbl5/6y4dv+suXT/rLl0/6y3cv+st3L/pbBs/6axb/+nsG//p7Bx/6Sscf+gqG//nqNr/56d b/+Wi2//lod0/5ODdP+QhHT/kYp4/5SSe/+bnH3/nKN5/56mc/+dqWv/napl/52qYv+dqmL/ napi/56pZf+eqWX/nqln/56pZ/+eqWf/nqln/52oZv+dqGb/nKdl/5ynZf+apWP/maRi/5mk Yv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ilYP+ToFv/kZ5Z/5KeXP+SnmD/kp1l/5ihdv9SWTj/ IiYV/yQnIP8mKCf/KCkt/ygpLf8mJyn/JCUn/yIkI/8iIiL/RUVF/9zd3/8xMjb/R0hN/0ZG Tv9KSlb/SEhS/0lJU/9FRkr/Q0VC/z5CNP9gZkr/maF4/5eiav+YpGL/mKZb/5qoW/+bpmH/ m6Zi/5umYv+cp2P/nKdj/52oZP+dqGT/nahk/56pZf+fqmb/n6pm/5+qZv+gq2f/oKtn/6Cr Z/+gq2f/n6po/5+qaP+fqmj/oKtp/6Gsav+irWv/oq1r/6OubP+lsG7/pbBu/6axb/+msW// prFv/6eycP+nsnD/p7Ju/5unX/+rtnL/s7yD/6+2jP+ipYr/i4x8/4mJgf+inpv/k4+M/6ah nv/BvLb/3tfP//Hq4v/i2dL/mI+I/0M/Pv80OEH/PkhU/wcTIf8kMUL/lqe7/5KkvP+Ln7j/ kqfE/4advP+Qp8b/g5q5/4Sbuv+LoL//gpe2/4OYt/+Embj/epGx/32UtP94jaz/f5Sz/3yN qf9te5X/bHeN/2hvgv9tb3z/d3R9/19UWP8+LCz/Uzs3/4ZrZP+LbWP/gmJV/4ZmWf+CY1H/ jHBa/6yUeP/EsI3/wbOG/7yyff/DvoT/vr5+/7vAff+6wXv/t8N7/7bDff+0w37/tMN+/7TD fv+tvHf/uMeC/7vKh/+4x4b/uMeG/7fFh/+3xYr/u8iQ/6e0fv+5xpH/v8ub/7zImv+qtYr/ oayC/7C7kf+yvJf/wsmq/9vhx//m7NL/2d/F/7K4nv+XnYH/qK+Q/73Eov+8xJ3/vsea/73H k/+3woj/wMyM/8LPiv+0wXn/t8R8/7fDgf+3w4P/t8OD/7bCgv+2woL/tcGB/7XBgf+1wYH/ s79//7O/f/+zv3//s79//7O/f/+zv3//s79//7O/ff+wvXX/sL11/6+7ef+uuX//prKC/5eh fP+Ci3D/c3pq/2RrY/9fZWP/XmNn/19kav9cY23/XWRu/2pxe/96g4L/kZqJ/5umhv+ns4v/ rryJ/627gP+quXb/p7dw/6e3cP+tunX/rbl3/623ev+tt3v/rbd6/6y2ef+stnf/q7d3/625 e/+ruXv/rLh4/6y4dv+suHb/q7hz/6y3cv+st3L/pbBs/6axbf+osXD/p7Bv/6Wtcf+hqW7/ nqNp/5+ebv+Wi2v/lYZv/5OEb/+PhG7/kIpy/5OSdv+Zmnj/m6J2/56ncP+dqWv/napk/52q Yv+dqmL/napk/56pZf+eqWX/nqln/56pZ/+eqWf/nahm/52oZv+dqGb/nKdl/5ynZf+apWP/ maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ilYP+Sn1r/kZ5Z/5KeXP+SnmD/kZxk/5ih dv9SWTj/IiYV/yQnIP8mKCf/KCkt/ygpLf8mJyn/JCUn/yIkI/8iIiL/RUVF/9vc3v8wMTX/ RkdM/0RETP9JSVX/RkZQ/0hIUv9ERUn/Q0VC/z5CNP9gZkr/mKB3/5eiav+YpGL/mKZb/5qo W/+bpmH/nKVi/5ylYv+cpWL/naZj/52mY/+ep2T/nqdk/5+oZf+fqGX/n6hl/6CpZv+gqWb/ oapn/6GqZ/+hqmf/n6po/5+pav+fqWr/oKpr/6GrbP+irG3/oqxt/6Otbv+lr3D/pa9w/6Wv cP+msHH/prBx/6awcf+nsXL/p7Jw/6Wwbv+vuXz/pa1+/4qPb/90dWX/YWBc/1dSWP9XUFj/ WFFY/05FSP9jXFb/iYF2/6ukkv/Wzrn/4trD/8G7q/9OTkz/OTxD/zU5Qv8OFyD/S1dj/5Og sP+RorT/fpCm/4mdtf+Spr//hJqy/4Sasv+Jnbb/f5Os/4CUrf+AlK//e46s/4SXtf+BlLL/ hJWx/4KSrP94hqD/fomf/3Z9kP9ZXG3/RUNQ/0I7Qv9NQUP/UD4+/3diX/92XVj/fmNc/4tw Zf95X1D/jnhj/7mojP/IupX/xLyN/8TBiv/Bw4T/u8B9/7rBe/+4wnn/t8N7/7bDff+2w37/ tsKA/7bCgP+2xYL/tMOA/7bFhP+1xIP/tMKF/7nHjP+8yZP/uMSS/8PPn/+zvpP/o66G/5Se ef9gakj/Qkss/4KLbv/M1Lz/6e7a/9XZyv/M0MH/wcW2/7a6q/+ssJ//p6yW/7S5ov+8w6T/ v8ei/7G6jf+0vor/vciM/7fDgf+1wnz/t8R+/7bCgP+2woL/tsKC/7XBgf+1wYH/tcGB/7TA gP+0wID/sr5+/7K+fv+yvn7/sr5+/7K+fv+yvn7/sr5+/7K+fP+zwHj/sr93/7K/ev+xvID/ qbaB/5ynff+JknP/e4Nu/2hwZf9iaGT/XmNm/19kav9dZG7/XmRw/2lvff93f4L/jpaJ/5mj iP+lsYv/rLqJ/627gP+puHf/p7dw/6e3cP+tunX/rLh2/623ev+tt3r/rLZ5/6y2ef+stnf/ q7d3/625e/+quHr/rLh4/6y4dv+rt3X/q7hz/6y3cv+st3L/prFs/6eybf+osW7/qLFw/6Wu b/+hqW3/n6Vp/5+fa/+WjWb/lYho/5OFaP+Phmn/jolr/5GRb/+XmXH/mKBv/56nbv+dqWf/ napk/52rYP+dqmL/napk/56pZf+eqWf/nqln/56pZ/+dqGb/nahm/52oZv+cp2X/nKdl/5yn Zf+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ekX/+Sn1r/kZ5Z/5KeXP+RnV// kZxk/5ihdv9SWTj/IiYV/yQnIP8mKCf/KCkt/ygpLf8mJyn/JCUn/yIkI/8iIiL/RUVF/9na 3P8uLzP/REVK/0JCSv9HR1P/RERO/0ZGUP9CQ0f/Q0VC/z5CNP9fZUn/mKB3/5eiav+YpGL/ l6Va/5mnWv+bpWD/m6Rh/5ylYv+cpWL/nKVi/52mY/+dpmP/naZj/5+oZf+fqGX/n6hl/5+o Zf+gqWb/oKlm/6GqZ/+hqmf/n6lq/5+pav+fqWr/oKpr/6GrbP+irG3/oqxt/6Otbv+krm// pK5v/6WvcP+lr3D/prBx/6awcf+msHH/prBz/6u0e/+iqnn/h41p/2RnUv9QT0r/TEdN/0pC T/9HP07/U0lU/0I3Pf9MQz7/XVNH/1pSP/9zaVD/tqyR/+7m0f/k39n/joyN/0ZGSP8ODxT/ Excg/293gv+Cjpz/oK2+/4qZrv+To7r/hpat/4SWrv+JmbL/f4+o/3+PqP9/j6j/fIym/4KS rP+ElK7/h5Ww/4mXsf99iaH/h5Ko/4SMof81Ok3/Ghkn/yckL/8yKDD/MiYq/2lZWv99a2v/ h3Rw/4NvaP+RfXL/qpmH/7yxlf+8t5H/u7mJ/7y/hv+/xYX/uMJ7/7fDef+3w3n/t8N7/7fC fv+3woD/t8GC/7fBgv+9yYf/rr16/7LBgP+5x4n/ssCF/7K/if+3w5H/s7+R/7G8lP+Ejmv/ Uls8/zI7IP8rMxz/bXVg/7/GtP/Dybv/r7Kp/7m8tf/R1M3/r7Kr/3N2b/9cX1b/eHtw/77C s/+zuKL/v8Wp/7G5lP+4wZL/u8aO/6y4ev+0wH7/tsN+/7XBf/+1wYH/tcGB/7XBgf+0wID/ tMCA/7O/f/+zv3//sr5+/7K+fv+yvn7/sr5+/7K+fv+yvn7/sr5+/7K/ev+1w3j/tMJ3/7PA ev+zv4H/rbqE/6Gsgf+Qmnj/hIx0/252Z/9lbGX/X2Vl/2Bla/9eZW//X2Vz/2dtff9zeoL/ i5OI/5agh/+jr4v/q7iK/6y5gf+puHf/p7dw/6i4b/+suXP/rLh2/623eP+stnn/rLZ5/6y2 ef+rtXb/qrZ2/6y4ev+quHr/rLh4/6u3df+rt3X/q7hz/6u2cf+rtnH/p7Jt/6izbv+psm// qbJv/6avbv+iq2z/oKZq/6ChaP+YkGH/l4tj/5SIYv+Ph2P/jopl/5CRaf+WmWz/l6Br/56o a/+dqmX/napi/52rYP+dqmL/napk/56pZ/+eqWf/nahm/52oZv+dqGb/nahm/5ynZf+cp2X/ m6Zk/5umZP+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ekX/+Sn1r/kJ1Y/5Ke XP+RnV//kZxk/5egdf9RWDf/IiYV/yQnIP8mKCf/KCkt/ygpLf8mJyn/JCUn/yIkI/8iIiL/ RUVF/9fY2v8sLTH/QkNI/0BASP9FRVH/QkJM/0RETv9AQUX/QkRB/z1BM/9fZUn/l592/5ah af+Xo2H/l6Va/5mnWv+bpWD/m6Rh/5ukYf+cpWL/nKVi/5ylYv+dpmP/naZj/56nZP+ep2T/ n6hl/5+oZf+fqGX/oKlm/6CpZv+gqWb/n6lq/5+pav+fqWr/oKpr/6GrbP+irG3/oqxt/6Ot bv+krm//pK5v/6Sub/+lr3D/pa9w/6WvcP+msHH/pq92/6mwhP+PlXP/cHNe/1haT/9LSUr/ SkRO/1BIV/9VTVz/T0VO/1dMUP9SR0X/UUQ7/1ZKPP9dUD//d2pX/6CTg//Wy8X//PLx/6ag oP9VUFT/BQQK/z1ASf+hp7X/dHuL/4iTpf+RnrH/hJCm/4WRqf+Jla3/gIyk/4GNpf+BjaX/ f4mi/32Inv+Ejqf/ipSt/5GbtP94g5n/iZSq/5CYrf9OU2f/FRgp/ycmNP86N0L/PDU9/z40 PP9bUFb/em5w/5OFgv/JvLP/1cy7/8G7of++vpj/vsKQ/7bAhP+9yYf/tMR9/7TEe/+2w3v/ t8J9/7fCgP+4wYL/uMCF/7jAhP+xvX3/scB//7zKjP+9y47/s8CI/7bCkP+3w5X/qbSM/3qE Yv8jLBH/DBQA/zA3J/89Qzf/cXZv/6+0rv+an5v/kJGT/5GSlP+qq6//n6Ck/3x9gf9fYGL/ VFZV/3N2b/+RlYf/sLWf/7S7nP/CyqH/xM6c/7G8gv+2woT/tcF//7TAgP+0wID/tMCA/7TA gP+zv3//s79//7O/f/+yvn7/sb19/7G9ff+xvX3/sb19/7G9ff+xvX3/sb19/7G+ef+1w3j/ tMJ1/7PAeP+zv3//rruD/6Wxgf+WoHv/i5R3/3R9av9pcGj/YGZk/2Bla/9fZXH/X2V1/2Zr f/9vdYH/iI+H/5Odhf+hrIr/qbaK/6u4gP+ot3b/qLhx/6i4b/+suXP/rLl0/6y2d/+stnn/ q7V4/6u1eP+rtXb/qrZ2/6y4ev+quHr/q7d3/6u3df+qtnT/qrdy/6u2cf+rt2//qLRs/6m1 bf+qtG//qrNw/6ewb/+jrGv/oadp/6GiaP+blF7/mpBf/5eMX/+Ril7/kI1i/5GSZv+Wmmj/ l6Bn/56oaf+dqmX/napi/52rYP+dqmL/napl/56oaf+eqGn/nahm/52oZv+cp2X/nKdl/5yn Zf+bpmT/m6Zk/5umZP+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5ajXv+Rnln/ kJ1Y/5GdW/+QnF7/kJtj/5egdf9RWDf/IiYV/yQnIP8mKCf/KCkt/ygpLf8mJyn/JCUn/yIk I/8iIiL/RUVF/9bX2f8qKy//QEFG/z8/R/9DQ0//QUFL/0JCTP8+P0P/QkRB/z1BM/9eZEj/ l592/5ahaf+Xo2H/lqRZ/5qmWv+apF//mqNg/5ukYf+bpGH/nKVi/5ylYv+cpWL/nKVi/56n ZP+ep2T/nqdk/56nZP+fqGX/n6hl/6CpZv+gqWb/n6lq/5+pav+fqWr/oKpr/6GrbP+irG3/ oqxt/6Otbv+jrW7/pK5v/6Sub/+krm//pa9w/6WvcP+lr3D/pa55/5mfff95fGn/ZGZb/1xb Wf9PSlD/Qz1J/0Y+Tf9LQE7/RTpC/1BESP9GODf/QzYw/1hJQv9bTEX/ZFNM/4Nxbf/FtrH/ 5dfU//Xp6f/b0tX/Z2Bn/xIPGP9zcoD/iYyd/4WKnf+Nlar/goqh/4SMo/+JkKr/gIqj/4SL pf+FjaT/gYed/32Clv+HjaP/i5Oo/5Scsf92fpX/jZWs/5eftP+Jj6X/KS5C/xITJf83Nkb/ T01a/y4rNv9KRE7/dW51/8S8uv/48en/6+jZ/729o/+3u5b/tb+N/6u5fv+0xYH/s8R9/7PF e/+0xHv/tsN9/7fCgP+4wIT/ur+H/7jAh/+yvn7/t8aF/7jGif+0wof/u8iS/8TQoP+ptIr/ eoRi/0hRNv84Py3/Nz0x/ykuKP8PExL/PkJD/2Vobf8oKzL/LCw0/zs7Rf9cXGb/ZWVv/1BQ Wv8uLjb/Fxgd/xweHf9ER0D/cHRl/46Uev+lrIr/t8CT/7jCjf+4w4f/tcGD/7TAgP+zv3// s79//7O/f/+yvn7/sr5+/7K+fv+xvX3/sb19/7G9ff+xvX3/sb19/7G9ff+xvX3/sb19/7G+ ef+0wnf/ssBz/7G+dv+xvXv/rryB/6ezgf+apXv/kZp7/3qDbv9sdGn/YWdl/2FmbP9hZ3P/ YGV4/2Rpf/9rcX//hYyF/5CZhP+eqYn/p7SI/6q3f/+ot3b/qLhx/6i4b/+ruHL/q7hz/6y2 d/+rtXj/q7V4/6u1eP+qtHX/qbV3/6u2ev+pt3n/q7d5/6q2dP+qtnT/qrdx/6q1cP+qtm7/ qbVt/6m1bf+rtXD/q7Vw/6ixbv+krWz/oqhq/6KjZ/+hm2H/n5Zf/5uRXv+Vj13/k5Fg/5SW ZP+YnWf/maNn/56pZ/+dqmT/natg/52rYP+dqmL/napl/56oaf+eqGv/nKZn/5ynZf+cp2X/ nKdl/5umZP+bpmT/m6Zk/5qlY/+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV//lqFf/5aj Xv+Rnln/j5xX/5GdW/+QnF7/kJtj/5afdP9QVzb/IiYV/yQnIP8mKCf/KCkt/ygpLf8mJyn/ JCUn/yIkI/8iIiL/RUVF/9TV1/8pKi7/P0BF/z09Rf9CQk7/Pz9J/0FBS/89PkL/QUNA/zxA Mv9eZEj/l592/5WgaP+WomD/lqRZ/5mlWf+apF//nKNg/5yjYP+dpGH/naRh/56lYv+epWL/ nqVi/5+mY/+fpmP/oKdk/6CnZP+hqGX/oahl/6GoZf+fqGX/n6lq/5+pav+fqWr/oKpr/6Gr bP+irG3/oqxt/6Otbv+jrW7/o61u/6Sub/+krm//pK5v/6WvcP+lr3D/pa16/3h8Zf9gYVv/ XFpb/2FfZP9YUlz/TkhU/09HUv9QRk//TEFF/09DRf9XSUn/XlBQ/1lJTP9NOkD/WUNP/3Rf aP+FcXL/yLa0//bm5//36Ov///X9/6aeqf9kYnD/f4CS/4CCl/+JjqT/f4Oc/4GHof+Jjqv/ goml/4eMqf+Ijqb/g4aZ/4WGmP+RlKf/i5Cj/5Warv95f5X/lJyx/5mhtv+QmK3/anGE/xof M/8HCh3/MjRD/19ebP+PjZv/lZKb/9HNzv/r6OH/5+ja/87Su/+8xJ//q7mI/6S2ev+vwoD/ scV9/7HGe/+0xH3/tsN+/7fBgv+6v4X/u76J/7q/if+7x4n/uMeG/7LAg/+zwIj/uMWQ/6Gt f/9qdE//PUYp/1dfSP87QTP/ISYg/yAkJf8aHSL/Gh0m/yIkMf8REyD/BAMR/xUUJP8jIjL/ MC8//yopOf8XFiT/EREd/wsMEf8MDg3/LzIn/1FWQP9ka0z/jJRr/7K8iv+1wIj/tL+D/7O/ gf+zv3//sr5+/7K+fv+yvn7/sb19/7G9ff+xvX3/sb19/7G9ff+xvX3/sb19/7G9ff+xvX3/ sb19/7G+ef+ywHX/sL5x/668cf+vvHf/rLp9/6e0f/+cp3z/lJ58/36IcP9vd2r/Ymhm/2Fm bP9iaHT/YWZ5/2Nofv9obn7/g4mF/46Xgv+dqIj/prOI/6m2fv+ot3b/qLhx/6m5cP+ruHL/ q7hz/6u2dP+rtXb/q7V4/6q0d/+qtHf/qbV3/6u2ev+pt3n/qrZ4/6q2dP+qtnT/qbZw/6q1 cP+qtm7/qbVt/6q2bv+stnH/q7Vw/6myb/+lrmv/o6lp/6OlZv+moGL/pJxe/5+WXf+ZlF3/ lpVf/5eaY/+boGb/m6Vm/56pZf+dqmL/natg/52rYP+dqmL/napl/56oa/+eqGv/nKZn/5yn Zf+cp2X/m6Zk/5umZP+bpmT/mqVj/5qlY/+apWP/maRi/5mkYv+Yo2H/l6Jg/5ahX/+WoV// lqFf/5ajXv+QnVj/j5xX/5CcWv+QnF7/j5pi/5afdP9QVzb/IiYV/yQnIP8mKCf/KCkt/ygp Lf8mJyn/JCUn/yIkI/8iIiL/RUVF/9PU1v8oKS3/Pj9E/z09Rf9BQUv/Pz9J/0BASP88PUH/ QUM+/zxAMf9eZEj/lp51/5Wfav+WomL/lqNb/5mlW/+apF//mqNg/5yjYP+bpGH/naRh/5uk Yf+epWL/nKVi/5+mY/+dpmP/oKdk/56nZP+gp2T/n6hl/6GoZf+fqGf/n6lq/5+pav+fqWr/ oKpr/6Gsav+irWv/oq1r/6OubP+jrW7/o61u/6OtcP+krnL/pK10/6Stdv+lrnf/pquD/2hm Wf9YUlL/W1JX/2BWXv9VSVP/TkJM/1BDTP9LP0P/VEZG/05AP/9aTEv/W01N/0k5PP9MO0P/ WEZS/1I+Sf9MODr/b1ta/4JwcP/QwMP/7eDn//Tq8//l3+v/vrrJ/359jf+IiZv/f4CU/4OF mv+LjaL/hYqe/4mOpP+Nj6T/hIWX/4yOnf+ZnK//iY6i/5OZr/99hZz/maS6/5aiuP+Oma3/ nqm7/1BZav89RFb/SlBg/2ptfv+RkqT/n56s/6ystP+7vL7/4+Xg//f+7v/a5Mn/uMSe/6+/ jv+1x43/scSE/7PEgP+0w4D/tsKA/7fBgv+4wIT/ur+F/7jAhf+5xYf/t8WI/7vIkP/Bz5r/ pbKG/1pmQP8gKg//HCUQ/xMbDv8rMiv/Fhob/wkMEf8UFyD/EBAc/xMSIP8eIC3/DhAd/xsf K/8UFiX/HB4t/xocK/8SFCP/HR8s/xUYIf8LDxL/GyAa/y81J/8xOSH/ZW9M/6axh/+uuor/ sryH/7K9gf+yvn7/sr5+/7K+fv+xvX3/sb19/7G9ff+wvHz/sLx8/7C8fP+wvHz/sLx8/7C8 fP+wvHz/sLx8/7C9eP+uvnX/rLxx/6q6cf+runX/rbl7/6m0fP+fqHn/l596/4KLcP9xeGj/ Ymli/2Jnav9iaXP/YGd3/2Fnff9lbXr/gIqC/42Xf/+cp4f/pbKH/6i1gP+otnj/qrZ0/6u4 cv+st3P/rLd1/6u1dv+rtXb/qrR3/6q0d/+qtHj/qbR4/6u2ev+rtnr/qrZ4/6q2dv+ptXP/ qbVz/6q1cf+qtXD/qrVw/6u2cf+rtnL/q7Zy/6izb/+kr23/oapp/6CmZv+lpmT/pKBg/52b Xv+ZmV3/lppf/5ieYv+bo2f/nahm/52qZP+bq2L/m6tg/5urYP+bq2L/m6pl/52paf+dqWn/ nKdl/5ynY/+bpmL/m6Zi/5umYv+apWH/mqVh/5qlYf+apWH/mKVg/5mkYP+XpF//lqNe/5Wi Xf+Vol3/laJd/5WiXf+QnVj/j5xX/5CcWv+Pm13/j5lk/5afdP9QVzj/IiYV/yQnIP8mJyn/ KCku/ygpLv8mJyv/JCUp/yIjJf8iIiL/RUVF/93e4v8gISX/Pj9E/z09Rf86OkL/OztD/zw9 Qv89PkD/PkE6/zA0Jf9aYET/naV8/5iibv+WomT/mKVg/5mmXv+ZpGD/maRg/5ukYf+apWH/ m6Rh/5umYv+cpWL/m6Zi/52mY/+dqGT/nqdk/52oZP+fqGX/nqll/5+oZf+fqmj/nalp/52p af+dqWn/naln/56rZv+eq2X/n6pl/6CrZ/+eqWf/oKpt/5+nbv+dpHH/qK6A/6Knf/+nq4j/ eHZd/2daVP9nVFb/Y05T/15JTv9cR0z/W0ZL/11HSv9dSUr/VUFA/1RCQP9SQ0D/UUNA/05D P/9OQz//TUNB/01CQP9LOzv/U0FB/1hFR/9aSkv/a1xf/5aKjv/Tys////n///fw+P/b1t3/ ure+/7a1vf+Gho7/lZWd/4+Pmf+Dho//jI6b/4yPoP+Mk6b/i5Oq/5Cctv98iqX/h5ew/3+R p/+Gl6n/kqSy/4iWo/9odID/Ymx4/3uBkf+JjJ//f4KV/5aZqv+go7L/rrK7/8zR1P/w9+// 4OnY/9fgxf+uuJP/u8eZ/73KlP+rtnr/sr5+/8HOif+1wnz/s8B6/7nIg/+pt3n/tsWM/7zK l/+mtYr/j516/zM/J/8tOSv/FB8Z/w8XGf8PFhz/EhYh/xMVIf8VFSH/FxUg/xcVIP8WFh7/ Ehod/xAbHf8SGyD/Ehsi/xIbJP8TGyb/Exsm/xMcJf8KERf/JC0s/y82L/9HT0D/RE42/5ij hf+9yKb/qLOI/7C7g/+3wYT/vsiL/6y2ef+tt3r/tb+C/6q0d/+1v4L/s71+/7O9fv+zvX7/ s71+/7O9fv+zvX7/s71+/7K+fP+uv3j/rcJ3/7DBev+xwHv/sLx8/6y2ev+nrnv/o6h//4yS cP98gWr/aG5g/11jX/9bZGn/XWpz/2Btff9gb3b/dYFz/4WSdv+Zp4b/qbWP/6y4iv+qtH// pq92/6Sucf+psnP/qbJz/6mxdf+osHT/p7F1/6awdP+lsHb/pbB2/6y1fP+stXz/q7V5/6u1 ef+rtXj/qrR3/6m1d/+ptXX/p7Nz/6ezc/+msnL/pbFx/6KxcP+gr27/oK9u/6Gta/+dqGb/ nqdk/56nZv+dqGb/nahm/5yoZv+aqWb/mqlk/5qrZP+arGL/mqxi/5qsYv+YrWL/mKxk/5is ZP+aq2T/maZg/5qlYP+ZpF//maRf/5mkX/+Yo17/l6Re/5ekXv+YpV//laVe/5ekXv+UpF3/ k6Nc/5KiW/+Solv/kqJb/5ajXf+SnVj/kJtW/5KdWf+SnF//kptm/5mgdv9TWDr/KSsd/ykq Jf8pKC3/KCcv/ygmMf8oJy//JyYu/ycmK/8iIiT/RUVF/9zd4f8fICT/PT5D/zw9Qv85OUH/ OjtA/zs8Qf89Pz7/PUA5/zA0I/9ZX0P/naV8/5ehb/+VoGT/mKRi/5ilX/+ZpGD/maRg/5mk YP+ZpGD/mqVh/5qlYf+apWH/m6Zi/5ynY/+cp2P/nKdj/52oZP+dqGT/nqll/56pZf+dqWf/ nKhq/5qoav+dqWn/napl/52qZP+eq2P/n6tj/5+qZf+eqWX/oats/5+mcP+epHT/qK2E/6Wp hv+Wlnr/bmlV/2VSTP9mTVD/ZEpN/2FHSv9eREX/XEJD/15CQf9bQUD/XERC/1lEP/9YRT// V0Y//1NGPv9RRz3/UEc+/1BGPf9WR0T/XUlK/1xISf9UQkL/Tj4+/1hKSf9vY2P/hXl5/7+1 tv/j2tv/+vT0/+zo5/+GhIX/cG5v/317fP+Yl5z/iYuX/5CWpv+XnbP/lJ65/4ORrv9tfpz/ c4ei/2qAmP9sg5X/d42b/4SYo/+ClJ7/dIKP/2p2hv97gZf/kpiu/5KYrv+ZoLP/pKq6/7zD zf/k6ez/7/bv/+Pq2v/Axqz/rLSP/73Gmf+0von/sLt//7O/ff+xwXr/t8d+/7PDfP+4xon/ orB7/7C9j/+zwZ3/a3he/xonFv8nMiz/CxYY/w4XIP8OFiH/EBYk/xIWIv8VFSH/FxYe/xcW HP8WFxv/EBkY/w8bGf8PGxv/Dxoe/xEaIf8RGiP/ERkk/xIbJP8PFh7/EBgb/x0jIf8XHhb/ KjMi/2JsVP+epo7/tLuZ/6y0gf+tt3v/t8GF/7C6fv+xu3//tsCE/621ev+yvID/sbl9/7G5 ff+xuX3/sbl9/7G5ff+xuX3/sbl9/6+7e/+rvHj/qr53/62+ev+tvHn/rrh7/6qyd/+nq3j/ pKd8/5GScP+ChGz/bnJj/2BnX/9cZmf/XWpy/1xsef9fbnP/doRz/4WUd/+Zpoj/qLSQ/662 jf+stIX/qrF9/6uweP+ssXf/rLJ2/62wd/+rsHb/qbF2/6ewd/+nsHn/p7B5/6qxe/+ssXn/ qrF7/6qyef+psXj/qbF4/6ixeP+nsXX/qLJ2/6eydv+msXX/pbFz/6Kwcv+hr3H/oK5w/5+u bf+dqWn/nalp/52paf+dqWf/naln/5uqZ/+bqmf/mqtl/5mqZP+ZqmP/mapj/5erY/+Xq2P/ l6tj/5erY/+Zq2H/maZe/5qmXv+ZpV3/maVd/5mlXf+YpFz/l6Rc/5ekXP+VpVz/laVc/5Wl XP+UpFv/kqRa/5GjWf+Ro1n/kaFY/5ajXf+RnFf/kJtW/5KdWf+SnF//kptm/5mgdv9TWDr/ KSsd/ykpJ/8pKC7/KCYx/ygmMf8oJjH/JyYu/ycmLP8iIiT/RUVF/9vc4P8eHyP/PD1C/zs8 Qf84OED/OTo//zo7QP87PTz/PD84/y8zIv9YXkL/nKR7/5agbv+Un2P/l6Nh/5ekXv+Yo1// mKNh/5ijYf+Yo2H/maRi/5mkYv+ZpGL/mqVj/5umZP+bpmT/m6Zk/5ynZf+cp2X/nahm/52o Zv+cqGb/m6dp/5qoav+cqGj/nKlk/52qZP+dqmT/nqpi/5+qZf+eqWX/oats/5+nbP+fpnL/ p61//6muhv98fVv/XlpB/15MQv9iSkb/Y0pG/2RLR/9lSUb/ZEhF/2RGRP9iRkL/Y0dD/2FI Q/9gSUP/XUlC/1xJQv9bSkD/WEpB/1hKQf9WQz3/XEdE/2BLSv9dSUj/WERD/1ZEQv9ZSUn/ Xk5O/2xeXf95bmz/hnx7/5GJh/9iXFz/Ylxc/2BcW/9hX2L/bW97/3yDlf+Olq3/m6fB/3yL qv9qfZ3/bYSj/2iAmv9og5j/YHqL/2uCkv+Bl6X/hZao/3eGmf99h6D/kZu0/5Obsv+cpLf/ p66+/7K7xP/K0tX/6vDs/9zi1P/K0rv/rbST/7S8k/+xu4n/tL+H/7O/gf+1wX//uMWA/6Gt a/95hEz/a3RF/2t2TP99iGj/MDwm/wwYDP8XIh7/BQ4T/w4XIP8OFiP/EBYk/xIWIv8TFSH/ FhYe/xYXHP8WFxv/EBYW/w4XFv8OFhj/DxYc/xEVHv8SFiH/ExUi/xMVIf8SFR7/Cw4T/xYY F/8OEQr/ISUX/z1CLv9laFP/paqK/660hv+or3n/srmD/7W8hv+1vIb/t76I/7K3gf+wt4H/ sbZ+/7G2fv+xtn7/sbZ+/7G2fv+xtn7/sbZ+/6+3fP+quHr/qrp7/625e/+uuHv/rrN7/6yv ev+qqXn/qKZ//5qXeP+KinL/dnhq/2ZrZP9fZ2n/XWdw/1xqd/9ca3D/dYN2/4SSef+Wo4f/ pK+P/6uzjv+ss4n/r7KD/7Gzgf+usXr/rrF4/7Cwev+tsHn/rbB7/6ywff+rr3z/q698/6yu fP+sr3r/q617/6uuef+prnj/qa54/6mueP+prnb/qbF4/6iwd/+nr3b/pa51/6StdP+jrXH/ oqxw/6KscP+eqGz/nqhr/56oa/+eqGv/nqhr/52paf+dqWn/nalp/5unZ/+ZqGX/mahl/5ip Y/+YqWP/mKlj/5ipY/+YqWL/maZg/5qlYP+ZpF//maRf/5mkX/+Yo17/l6Re/5ekXv+VpV7/ laVe/5SkXf+To1z/kqNc/5GiW/+QoVr/kaFa/5WiXP+RnFf/kJtW/5KdWf+Rm17/kptm/5eg df9RWDn/KCwd/ygqJf8oKS3/Jycv/ycnL/8nJy//Jics/yYnK/8iIiT/RUVF/9na3v8cHSH/ OjtA/zk6P/82Nj7/Nzg9/zg5Pv85Ozr/Oz43/y0xIP9XXUH/m6N6/5Wfbf+TnmL/laFf/5aj Xf+WoV//lqFf/5eiYP+XomD/l6Jg/5ijYf+Yo2H/mKNh/5qlY/+apWP/mqVj/5qlY/+bpmT/ m6Zk/5umZP+bp2f/m6dp/5mnaf+bp2f/m6dl/5ypZP+cqWP/nalh/56qYv+eqWT/oKtp/5+n a/+hqHL/p657/6qwhP9qbEX/VlM0/2JRQf9mUEX/aVFH/2xRSP9tUEj/a05G/2pLRv9pS0P/ akxE/2pMRP9pTET/Z0xD/2VNQ/9lTUP/Y01C/2NMRP9jSkX/Y0pF/2JKRv9iSkb/YEtG/2BL Rv9eS0f/XktH/2FPS/9bTEf/WUtI/2ZbV/9ZTkz/Z11b/2ddW/9eWlv/U1Nd/1tgc/9xeY7/ mqbA/4GQr/9whKX/cYin/3ONqP9yjqT/YX2S/1l0hf9ngZL/f5Sp/4qctP+JmbP/iZSw/4yX rf+ZobT/q7TD/7K7xP+wurz/z9jV/8XNwv/R2Mb/1d7D/7a9m/+iq4D/sbmI/7W+h/+5wYb/ tr6C/5GZXv9tc0X/payD/5Sbef+Bim//MDko/yErIv8RGhn/Exwj/w4WIf8OFiP/EBYk/xAW Iv8SFh//FBce/xQYG/8UGBv/DxMW/w8TFv8QExj/EBMa/xMTH/8TEx//ExIg/xQSH/8RDxz/ FxYe/xYUF/8jIh7/Kiog/0dIOv9CQS//mZl9/7q8lP+xtIX/tLeI/7i7jP+4uov/uLqL/7e5 iv+1t4b/tLaF/7S2hP+2tYX/traE/7a2hP+2toT/traE/7S2hP+wuYL/r7qC/6+4gf+xtoD/ sbOB/7GwgP+xrIL/sKqG/6Gcfv+WkXv/goBz/29ya/9jaGv/XGVs/1tlcf9aZ23/cX1z/3+L d/+SnIT/oKmO/6itjf+rr4r/sLGH/7Szg/+wsH7/sa98/7GvfP+wrnv/r699/66tff+srn// rq1//7Cufv+vrX3/r619/6+tff+urHz/rax8/62te/+srHr/q6t5/6mref+oqnj/pqp3/6Wp dv+kqXP/o6hy/6Kncf+gpW//oKVt/6Clbf+gpW3/nqZt/56ma/+epmv/nqZr/5qkZ/+apGf/ maVn/5mlZf+ZpWX/maVl/5emZf+ZpWP/mqVh/5qlYf+ZpGD/maRg/5mkYP+Yo1//l6Rf/5ek X/+XpF//lKNe/5SjXv+Tol3/kaJc/5ChW/+QoVv/kaBb/5WiXP+RnFf/j5pV/5GcWP+Rm17/ kZpl/5egdf9RWDn/KCwb/ygrJP8oKS3/JSgt/ycnL/8lKC3/JCgr/yQoKf8gIiH/RERE/9fY 3P8aGx//ODk+/zc4Pf80NDz/NTY7/zY3PP84Ojn/Oj02/ywwH/9VWz//maF4/5Oda/+RnGD/ lKBe/5WiXP+VoF7/laBe/5WgXv+WoV//lqFf/5ahX/+XomD/l6Jg/5ijYf+Yo2H/maRi/5mk Yv+ZpGL/mqVj/5qlY/+ZpWX/mqVp/5imaf+apmj/mqZk/5uoY/+bqGL/nalh/52pYf+eqmL/ n6pm/5+oaf+iqm//p654/6eue/9rbkH/XVs1/2hYP/9rVkX/a1RE/21TRP9tUUP/bE9B/2xM Qf9tS0H/c05F/3JNRP9wTkX/cE5F/25NRP9uTUT/bE5E/2tNQ/9wU0v/bVBI/2hNRP9mS0L/ ZExC/2RMQv9gSUH/Xkc//1M/OP9bSEH/YlFJ/2ZYT/9URT7/V0hB/11OR/9fVVP/UlFZ/0pN XP9XXXP/kJy2/4mYt/90h6f/bIOj/3OMqv9wjKT/aomd/2WClP9jgJL/b4ie/4CVsP+Im7n/ iZi1/4WRp/+IlKT/nKi2/6y2wP+mr7T/uMHA/7G7s//P18j/+f/q/87UuP+psI7/p66F/6qw gv+6voz/tbmG/36CUP9OUCv/tbaX/8TGrv+jppP/Ky4l/xYbF/8CCg3/EBcf/w4WIf8OFiP/ Dxci/xAXIf8QFx3/Exgc/xMYG/8UGBv/ERIW/xESF/8SEhr/EhIc/xQSH/8UEiD/FBIg/xUR H/8UEB7/Gxgh/xUQFv8gHBv/NTIt/1pYTP9MSTr/mJZ//8HBn//AwZn/uruT/7i5kf+4to// t7WO/7u5kv+7uZD/vLmQ/7y5jv+8uZD/vLmO/724jv+9uI7/vbiO/7y5jv+4u4z/tbuL/7a5 iv+3toj/t7SJ/7izif+7sY3/u7CQ/6yih/+gmYb/jop+/3l4c/9oaWv/W2Jo/1hga/9ZYmn/ aHFs/3mBdP+OlYX/n6SO/6irkP+srY3/sa+J/7Owh/+wrH//sKx9/7Krff+xqnz/r6t+/6+r fv+uqX//rql//7Stg/+1rIP/tKuC/7Srgv+zqoH/squB/7Krgf+wq4H/qaR6/6mkev+oo3n/ pqN2/6ShdP+joHP/op9y/6KgcP+gn2//oJ9v/6Cfb/+goG7/oKBu/6Cgbv+eoWz/nqFs/5ug av+boGj/m6Bo/5ugaP+ZoWj/maFm/5mhZv+ZoWX/m6Rl/5ukY/+ao2L/mqNi/5mkYv+Yo2H/ mKNh/5ejYf+WomD/lqJg/5OiX/+Tol//kqFe/5GgXf+PoFz/kJ9c/5ShXP+Qm1f/j5pW/5Gc Wv+QnF7/kJpl/5afdP9RWDf/Ji4Z/yYsIv8mKiv/JCks/yUoLf8kKSz/Iykn/yQoJ/8gIiH/ RERE/9XW2v8YGR3/Njc8/zU2O/8zMzv/MzQ5/zQ1Ov82ODf/ODs0/ysvHv9UWj7/mKB3/5Kc av+Qm1//k59d/5OgW/+Tnlz/lJ9d/5SfXf+Un13/laBe/5WgXv+VoF7/laBe/5eiYP+XomD/ l6Jg/5ijYf+Yo2H/mKNh/5mkYv+YpGT/maRo/5elaP+ZpWf/mqZk/5qnYv+ap2H/nKhg/5yo YP+eqmL/nahj/56nZP+jrG3/pq5z/6GpcP9/g1D/cnFF/2dZPP9pVT3/Z1M7/2lQOv9rUD3/ cVJA/3ZVRP97Vkb/dU9C/3ZOQv91TUP/dU1D/3VNQ/9zTUL/c01E/3JNRP9sTEH/a01C/21P RP9xU0j/clZK/3JWSv9uU0j/bFFG/2NLQf9hST//X0k+/2JOQ/9jT0b/ZlRK/2RSSP9eT0r/ WVNX/0hIVP9JTF3/f4Wd/4+atv94h6T/bYCe/3SMpv9wiqH/bImb/2yJmf9xjJ//dY6k/3mO qf9+ka//hZSx/5CdsP+FkaH/ipai/5uosf+hrLL/p7Gz/6izr/+/ycD/5O3c/+Ts1f/Q1rr/ tbiZ/6mrhv+8vZX/qaqA/1pYMv8XEwD/UU86/4+OfP+YmIz/KSol/xwdH/8eIyn/Fx4o/w4W If8OFiP/Dxci/w8YIf8QFx3/ERkb/xEaGf8TGRn/ExQZ/xMTG/8UEh3/FRMe/xUTIP8WFCL/ FxMi/xcTIf8ZFiH/GxUf/xwXHf8VERL/Pzo3/1VQSv9VUUb/fnho/7Swlf/Jxqf/wbye/7ey lP+5tJb/uLKS/723l/+/uZf/wbiX/8G5lf/BuZX/wbmV/8K4lf/CuJT/wriU/8G5lP++upX/ vLqU/7u3kf+6tY//vbOP/8CzkP/DtJP/w7WY/7Wmj/+roI7/mpKH/4J/ev9sbG7/XF9k/1hc Z/9WXWP/Y2ln/3R7c/+Pkof/o6WX/62vmv+xr5b/s66Q/7Otif+vp4D/r6Z9/7Glff+xpX3/ rqV+/66lfv+upID/sKOA/7WnhP+1p4T/taeE/7Smg/+0poP/s6WC/7Klgv+ypYL/qJt4/6ac eP+lm3f/pJp2/6Kadf+hmXL/oJhz/5+XcP+gmHH/nplv/56Zb/+emW//nplv/56abf+dmm3/ nZtr/5yba/+cm2v/nJtr/5ycav+anGr/mpxq/5qcav+anWb/naJo/5ujZ/+aomb/mqJm/5qi Zv+YomX/mKJl/5iiZf+XoWT/laFj/5WhY/+SoGL/k59h/5GfYf+QnmD/kJ9e/5WgXv+Qm1f/ jplX/5CbWf+Qml3/j5lk/5afdP9QVzb/Ji4Z/yYsIv8lKyn/JCoq/yQpLP8kKir/Iykl/yMp Jf8fISD/Q0ND/9TV2f8XGBz/NTY7/zQ1Ov8xMTn/MjM4/zM0Of80NjX/Nzoz/youHf9TWT3/ l592/5Gbaf+Pml7/kp5c/5KfWv+SnVv/k51e/5OdXv+TnV7/lJ5f/5SeX/+Unl//lJ5f/5ag Yf+WoGH/lqBh/5ehYv+XoWL/l6Fi/5iiY/+Xo2X/mKNn/5akZ/+YpGb/maVl/5mlY/+ap2H/ m6df/5unX/+eqmL/mqZe/5ymYf+iq2j/pq9w/5qiZv+an2X/jIxa/3xyTv96a07/dWFI/29Z Qf9wVUD/dldD/35bSP+EX03/eE5A/3hOQP94TEH/eExB/3hMQf93S0D/d0tC/3RMQP9uSjz/ cE9A/3NSQ/9zU0T/clJD/29PQP9rTkD/a05A/3NXS/9yVkr/bVNG/2VOQP9iSj7/YEg8/2NL P/9kUEn/Wk5O/1JLUv9LSFP/bGt9/5CVq/9+iKH/d4Wf/32Ppf9zipz/b4aW/2+GlP93jp7/ gJWo/4KUrP9+jqj/fIqk/5ajtP+MmKT/hJCc/4qXoP+Wo6n/mKOn/7G7vP++x8L/xczE/+vx 4//r8Nz/x8mz/6+vk/+4t5j/mZZ1/z04G/8NBgD/CQEA/zApIf9KRUH/GBYX/xcWHP8ZHCX/ Bw0Z/w4WI/8OFiP/Dhgi/w4ZH/8PGRv/EBob/xAbF/8RGhn/ExYb/xQXHv8WFiD/FhYg/xcX I/8XFyP/GBYj/xkXJP8YFiH/Gxgh/xsYH/8dGx7/OjY1/0hFQP9PTEX/W1dL/5KLeP/Fv6f/ wrqj/7aul/++tp//vLKZ/7yymf++tJn/wLSa/8C1mf/CtJn/wrSX/8O0l//DtJf/xLOX/8K0 l//At5r/vLWY/7uyk/+6r5H/vq+Q/8Gwkv/Gspf/xrWb/72rl/+1pZX/opiO/4qDff9wbG3/ XV5i/1ZZYv9WW2H/YGVo/3V7ef+Vl5L/rK6j/7i2p/+7tqL/uLGX/7ivkP+uoYH/r6B//6+f ff+vn33/r59+/66eff+unX//rp1//7Gefv+ynX7/sp1+/7Kdfv+wnX3/sJ19/6+cfv+tnH7/ pZR2/6STdf+jlHf/oZJ1/6CRdP+fkHH/no9y/52QcP+ekW//npFv/56Rb/+ekW7/nJJu/5yS bv+bk27/m5Ns/5+XcP+fmG7/nZhu/52Ybv+dmG7/nZls/5yZbP+bmmr/nqFs/52iav+coWn/ nKFp/5yhaf+ZoWj/maFo/5mhaP+Xn2b/lp9m/5afZv+Un2X/lJ1k/5KdY/+SnWP/kZxg/5Se X/+QmVj/j5hZ/5CaW/+Qml7/kJlk/5afdP9QVzb/Ji4Z/yYsIv8lKyf/JCoo/yIrKv8iKyj/ ISsj/yMqI/8fIR7/Q0ND/9PU2P8WFxv/NDU6/zM0Of8wMDj/MTI3/zIzOP80NjX/Nzoz/ykt HP9TWT3/lp51/5CaaP+OmV3/kZ1b/5KfWv+SnVv/kpxd/5KcXf+TnV7/k51e/5OdXv+Unl// lJ5f/5WfYP+Vn2D/lqBh/5agYf+WoGH/l6Fi/5ehYv+WomT/mKNn/5akaf+Yo2f/mKRm/5ml Y/+ZpmH/m6Zh/5unX/+eqmL/maVd/5ymYf+irGf/pa5r/5WeXf+ts3X/m55n/6WdeP+dj3L/ jH1g/35qUf91XUX/c1dB/3dWQ/99WEb/d009/3hMP/96TD//ekw//3pKQP96SkD/eUpA/3ZK P/92UUH/eFRE/3hXRv92VUT/c1JB/3RTQv93V0j/fFxN/3FRQv9tUEL/a05A/2hMPv9xVUf/ cFRI/29TR/9rU0n/YE1J/2NVVf9XTFL/YVlk/5CNnv+ChZj/f4aY/3+MnP9wgI3/eIqU/3uN l/95ipT/foub/4iTpf+Ik6n/goqf/4+Yp/+PmaP/hY+Z/3+MlP+Om6P/k56k/8PO0v/R29z/ xM3K/+nw6P/o6+D/xca4/6yrl/+tq5b/j4lz/z84Jf8wJhz/HRIO/xIIBv8OCAj/FxIY/xQT G/8NDxv/EhYi/w8VI/8OFiH/Dxgh/w4ZH/8PGRv/EBoZ/xAbF/8RGhf/FBkd/xQZH/8VGSL/ FRki/xYZIv8XGiP/Fxkl/xcaI/8WFiD/HR0l/w0MEf8qKiz/JSUj/0VGQf9MTUf/WldO/3Rs X/++taT/wLem/7aqmv/Euaf/v7Kh/7qtmv++r5z/v7Cb/8Cwmf/Br5n/wa+X/8Ovl//Dr5f/ xK6X/8Ovl//AsZr/vLCY/7ysk/+7qpD/vamQ/8Grk//Hr5f/yLKb/8Gsmf+6qZn/qZuS/46F gP9ybGz/Xlxf/1ZWXv9VWF//YGVr/3d8f/+YnJv/tLWw/8G+tf/CvKz/vbWg/7ywlv+snIL/ rZx+/6+cfv+wm37/r5p9/6+af/+umX7/rpl+/6+Xff+ulnz/r5V8/66WfP+tlXv/q5Z7/62V ff+qlHz/pI52/6OPdv+ijnb/n411/6CMdP+di3P/nopy/5uJcf+ejXP/no1x/56Ncf+djnH/ nY5v/52Ob/+cj2//nI9v/6GUcv+hlHL/n5Vx/5+Vcf+flXH/n5Vx/56Wb/+cl23/oZ9v/6Cg bv+dn23/nZ9t/52fbf+cnmz/m59s/5ufbP+ZnWr/l55q/5adaf+WnWn/lZxo/5SbZ/+Sm2b/ kptk/5WdYv+SmFz/kZdb/5GZXf+RmWD/kJhl/5adc/9QVzb/KC0Z/yYsIv8lKyf/JCoo/yIr KP8iKyb/ICsj/yErI/8fIR7/Q0ND/97f4/8REhb/MDE2/zc4Pf8xMTn/LzA1/zEyN/8tLy7/ MjUu/ywwH/9RVzv/lp51/4mTYf+Un2P/kp5c/5CdWP+Qm1n/kJpb/5CaW/+Qmlv/kJpb/5Ca W/+Qmlv/kJpb/5GbXP+Rm1z/kpxd/5OdXv+Vn2D/lqBh/5ehYv+WomT/laBk/5OhZv+WoWX/ lqJk/5ejY/+Xo2H/mKNf/5ijXv+cp2L/nKdi/56oY/+fqWT/oKpl/6KraP+kq2j/pqly/6+r hf+1rI//sqeL/6KSef+Ld1//e2JM/3pbSf9/W0v/fVZH/31TR/97T0T/ektB/3pKQP97S0H/ fUxF/3xQRf90Tz3/c1A9/3NQPf9zUD3/cVA9/3FQPf9xUD//cVA//3dWRf90VEX/cFBB/2tO Pv9rTj7/blFD/3JVR/9zV0v/d1xT/25XUf9vW1z/YVJX/5qOmP+Vj5v/kZGd/5GVoP+Ei5H/ iJKU/4+Zm/+Pl5r/foWN/3N3gv9+gI//kpSj/4qRm/+Nlp3/eYKJ/4WPmP+KlJ3/jJaf/4+a oP+3wMX/4uzt/+Lr6v/s8e3/x8jC/6Kflv+3s6f/hX1w/0pCNf+Ngn7/dWlp/yEXGP8dFBn/ GRQb/xMSGv8aGib/EBQf/w0TH/8NFSD/Dxgf/xEaH/8RGxz/DxkY/w4XFP8MFRL/Dxka/xAa HP8RGh//Exwh/xYdI/8XHiT/GB8n/xkgJv8YHSP/Fxwg/xkdIP8UGBn/GB0Z/zM4Mv9JTkj/ SktD/1hPRv9fUkn/dmlg/4V5bf+Uhnn/uamc/8u7rP+/rZ//u6iZ/7uol/+9qJf/vKeU/72m lP+8ppH/vqWR/7ymkf+3pJP/tqWT/7qlkv+8ppH/vqWP/7+mkP/BppH/waaT/7ylk/+zoJH/ ppWN/5SHgf+AeHb/bmpr/19eZP9YWGD/bHB5/4yQmf+qrbL/ubm5/8XCvf/Mxrr/wLSk/6ma hf+pl3//qpZ9/6qSeP+okHb/p491/6mRef+sknv/rZN8/6uRev+rkXr/qo54/6eNdv+li3T/ oopy/6KHcv+gh3H/m4Ju/5mDbv+ZgnD/mINw/5iBb/+VgG3/lX5u/5N+a/+Xgm3/l4Nr/5aC av+VgWn/loJp/5WEav+WhWv/l4Zs/6CRdP+gkXT/n5Bx/56PcP+bjm7/mo1t/5mMbP+XjWr/ l5Jo/5iVaP+cmWz/n5xv/6Cfcf+fnnD/np1v/52cbv+Ulmf/lZdo/5WXaP+Ul2j/lZhp/5WY af+VmGn/lZln/5CTXv+Pklv/kZRb/5CVXf+NkV7/ipBg/5KZcP9QVzj/KCwb/yYsIv8lKyf/ JCoo/yIrJv8iLCT/ISsi/yMqIv8gIh//RERE/93e4v8REhb/LzA1/zY3PP8wMDj/LzA1/zAx Nv8tLy7/MTQt/ywwH/9QVjr/lp51/4mTYf+Un2P/kZ1b/5CdWP+SnVv/kpxd/5KcXf+SnF3/ kpxd/5KcXf+SnF3/kpxd/5KcXf+SnF3/k51e/5SeX/+Vn2D/l6Fi/5ehYv+Xo2X/lqFl/5Si Z/+Xomb/l6Jm/5ejZf+YpGT/maRi/5mkYP+bpmL/m6Zi/52mY/+eqGP/oKlm/6GqZ/+kq2j/ pKlx/5eXdf+no4r/t6+Y/7arlf+llIL/j3pp/4BmV/96XU//gFxQ/4BaT/+BVk3/gFRL/4FV TP+DV07/iFlR/4ddUf98V0f/eVhF/3lYRf95WEX/eVhF/3hZRf95WEf/eFlH/3ZVRP90VEX/ c1NE/3JSQ/9yUkP/c1NG/3RUR/91VUj/d1pM/2xQRf9yWVT/bVhX/5aFi/+voqn/lo+W/6mn rP+ipKP/nZ+c/5ubmf+enpz/oJ6f/5uZnv+akp3/lZKb/4qLkP92e3//eH+F/4uUmf+Kk5r/ hpCZ/3+Jkv+KlJ3/rLe9//T+///o7O//6uzr/+nl4v+wq6f/ZV5W/0I5Mv+Jfnz/kISG/2dc YP8yKDD/Hxoh/xMSGv8SEhz/DxEd/xUZJP8QFyH/CxIY/wgQE/8IEBL/ChMS/xAWFP8QGRb/ DRcY/wwXGf8NGBr/DRga/w8ZG/8PGRv/EBoc/xAaHP8XHyL/ERkb/xQaGv8WHBr/FhwY/yIo JP8/Rj//XF1X/0A5Mf9XSkL/joF5/4p9df99b2b/mYh+/6WTif+5p5v/t6GU/7ehk/+3oJD/ t52O/7aci/+2m4j/tZqH/7SZhv+xmor/sZyL/7Kbif+1nIj/t5yJ/7mdiP+5nYj/uZ6L/7OZ iP+sloj/oY+F/5KFf/+Eenn/dnJz/2xqb/9lZW3/d32J/5Wbp/+ztr//wL/E/8rGw//Ox7// wLSm/6ucif+nlX//qJJ7/6iOd/+mjHX/pox1/6iMdv+qjnn/rJB7/6mNeP+ojHb/p4t2/6aK df+jiHP/oYZz/6CFcv+ehHP/l31s/5d9bv+Vfm7/lH1v/5N8bv+Se23/kXlt/5F6bP+Se2v/ kntp/5V7av+Ufmn/lX9q/5aBbP+Ygm3/mIRs/6CMdP+djHL/nItx/5uKcP+aiW//mIls/5iH bf+Wh2j/loxo/5ePaP+bk2z/npZv/56Zcf+emXH/nJdv/5uWbv+Wk2r/lpNq/5eUa/+WlGv/ l5Vs/5eVbP+XlWz/l5Zq/5KQYP+Rj17/kpJg/5OTYf+Nj17/i45j/5OXdP9QVDn/KSsd/ygr JP8mKyf/JCoo/yQqKP8iLCT/ISsi/yMqIv8gIh//RERE/93e4v8QERX/LzA1/zY3PP8wMDj/ Li80/zAxNv8sLi3/MTQt/ysvHv9QVjr/lZ10/4iSYP+TnmL/kZ1b/4+cV/+TnV7/k51g/5Od YP+TnWD/k51g/5OdYP+TnWD/k51g/5KcX/+TnWD/lJ5h/5WfYv+WoGP/l6Fk/5iiZf+YpGb/ l6Jm/5WjZv+Xomb/mKNn/5ikZv+YpGT/mqRl/5qlY/+ZpGL/mqVj/5ukY/+dpmP/nqdm/5+o Z/+iqGj/oqdx/5WYe/+io5P/sq+e/7Sunv+qnpD/m4t+/5F9cv+QeGz/hWdd/4VkW/+EX1b/ glxT/4BaUf+AWlH/glpS/4JcUf98W0z/e1xK/3tcSv97XEr/e1xK/3lcSv97W0z/eVxM/3NT RP9yVUf/c1ZI/3RXSf90V0n/c1VK/3JUSf9zU0b/cVBB/2lJPP90V0//emFd/4x4ev+2pqn/ hHh6/5+Wl/+qpaH/o6CZ/56akf+jnJT/rqWg/7Cmpf+llpv/kYaM/4mHiP9WV1n/cXV4/4yR lf+AiY7/cHqD/36Ikv+cqbL/2ebv/9bg6f+zt8D/pKes/9jW2f/Dv8D/WVRR/4F5d/96cG// cmhp/2hfYv9BOkH/RkFI/yIhKf8HBw//DhEa/wwQGf8NERr/DhMZ/w8UGP8QFRj/EBYW/xEV FP8PFRP/DhcW/w0XGP8NFxj/DhgZ/w4YGf8OGBn/DxcZ/xAZGP8bISH/GR8d/xgeHP8aIBz/ GR4a/xYbFf8lKiT/QEE7/01GQP89Miz/kIN9/6WYkP+nmJH/o5KK/2VTSf96aFz/sJqN/6+Z i/+ul4f/rpSF/6yRgP+qjXv/qIt5/6eKeP+pj4D/qY+A/6qQf/+skX7/rpF//7CRff+xkn7/ r5KA/6iNfP+jjH7/m4l//5KFf/+Jf37/gHx9/3p4e/90d37/goqX/5yksf+4vMf/xMXK/8vK yP/Ox8H/wLSo/6ycjP+lkH3/pI53/6WKdf+jh3L/o4dy/6aHc/+oiXf/qot3/6aKdf+kiXT/ o4hz/6KHcv+hhnP/n4Rx/52Dcv+dg3T/k3lq/5B5a/+Od2n/jHRo/4lzZv+IcmX/h3Fm/4hw ZP+Jb2L/i3Fi/49zZf+Rd2b/lXtq/5V+bP+Zf27/mIJt/5uFcP+ahm7/mYVt/5iEbP+Wgmr/ k4Jo/5SAaP+SgWf/k4Rl/5WGZf+Yi2n/m45s/52Qbv+dkG7/mY9s/5iOa/+Yjmv/l49r/5iQ bP+YkGz/lpBs/5eRbf+XkW3/l5Js/5SMZf+TjGD/k49i/5SQY/+PjGH/jYtl/5WUdf9SUTz/ Kioe/ykqJf8oKin/JSkq/yUpKP8kKib/Iyoi/yQpIv8gIh//RUVF/9zd4f8PEBT/Li80/zU2 O/8vLzf/LS4z/y8wNf8rLSz/MDMs/youHf9PVTn/lZ10/4eRX/+SnWH/kJxa/46bVv+TnV7/ k51g/5OdYP+TnWD/k51g/5OdYP+TnWD/k51g/5KcX/+SnF//k51g/5SeYf+WoGP/l6Fk/5ii Zf+Xo2X/lqFl/5WjZv+Xomb/l6Jm/5ikZv+YpGb/maNm/5mjZv+XoWT/l6Fk/5miY/+ao2T/ nKVm/52mZ/+gpmj/nqVy/6Knkf+kqqD/p6ig/6KimP+cmI//mo+J/56PiP+kkYr/ln95/5V6 c/+Qc23/imxk/4ZlXv+CYVr/gF9Y/4BgVf+FaFr/hGlY/4RpWP+EaVj/hGlY/4RpWP+EaFr/ hGha/4FlWf+EaFz/iWtg/4puYv+LbWP/iGxh/4VnXf+CZFn/gWFS/4JiVf+EZ1//i3Ju/4dx c/+UhIX/XE1Q/2BWVf+dlpD/pJ2T/6aek/+kmpD/qZyU/6ydmv+jkJL/kIKC/56Zlv9wb2v/ hYWF/4OHiP+Ei5H/gYqT/5Gbpf+uusb/oa25/3eBjf+Di5b/mJyl/9fX3//W1Nn/a2Zq/6mj pf+lnJ3/g3p7/1VPUf9AOz//UlBV/zU0Ov8cHSL/JSgv/wgNE/8KDxX/DhMX/xIWGf8SFhf/ EhMV/xAQEP8NDw7/CQ8N/wgRDv8MEhL/DhQS/xAWFP8SGBb/FBgX/xUZGP8PFBD/FRcU/xET EP8NDwr/FRcS/x8gG/8lJiH/LCsm/yIbFf9GOzX/yby2/7iro/+ml5D/r6GY/2pYTv+Rf3P/ rJaJ/6uVh/+rkYL/qI59/6aJd/+jh3L/ooNv/5+Dbv+kiXj/o4l4/6WKef+ninj/qYp2/6qL dv+rjHj/qY14/6OId/+fiHr/mYd7/5OGfv+Ng4H/h4OE/4OBhP9+gYj/gIqW/5Sgrv+vt8L/ vsHI/8bGxv/Hwrz/urCm/6ycjf+ijXz/o4p2/6GGcf+ghG//ooNv/6OEcP+mhXT/p4h2/6SJ dP+jinT/oody/6CHcf+ehXH/nINv/5uBcv+YgXH/kHlr/4x2aP+HcWT/gWtg/31nXP94ZFv/ eGFZ/3hiV/9/ZFn/hGhc/4ltYf+Pc2X/k3lq/5Z8bf+Yfm//mH5t/5V+bP+Vf2r/lH5p/5J9 aP+RfGf/kHxk/497Y/+OemL/j3tg/5J+Y/+Tgmb/loVp/5iHa/+Yh2v/lodq/5WGaf+Zim3/ mYpt/5iKbf+Yim3/l4xu/5eMbv+XjG7/mI1t/5aJZ/+TiWX/lYxl/5WNZv+PiWX/jYho/5WR dv9STzz/LCkg/yopJ/8pKSv/Jygs/ycoKv8lKib/JCki/yQpIv8hIyD/RUVF/9vc4P8ODxP/ LS4z/zQ1Ov8uLjb/LC0y/y4vNP8rLSz/LzIr/yktHP9OVDj/lJxz/4eRX/+RnGD/j5tZ/42a Vf+SnF3/kpxf/5KcX/+SnF//kpxf/5KcX/+SnF//kpxf/4+ZXP+Qml3/kZte/5KcX/+TnWD/ lJ5h/5WfYv+VoWP/lKBi/5KgYv+UoGL/laFj/5WgZP+WoWX/l6Fl/5ehZf+UnmL/lZ9j/5ef ZP+YoGX/maFl/5qiZv+do2f/m6J2/6GsnP+hq6r/n6in/5ygn/+Xl5f/lpCQ/5iOjf+dj47/ ppSS/6SRjf+eiYT/moN9/5Z9eP+TenP/knly/5F5bf+cgnX/nIJz/5yCc/+cgnP/nIJz/5yC c/+cgnX/nIJ1/6SJfv+mi4D/q4+E/62Sh/+ukYn/qo+G/6eKgv+liX7/rpCF/7WZjv+vk4// uKCg/7mlp/+pmp3/kISI/4B4dv+el5H/qqOZ/7Gpnv+to5n/rJ2W/66cmP+plZb/noyM/6ad mP+blpD/lJCN/3Nzc/+OkZb/l56m/4WPmf94hJD/gpCd/5Sgrv+Xoa3/v8XR/9nb5/+np6// dHN5/7Sytf+spqb/qKKi/2VhYP9XVVb/Wlpa/1NUVv9KTlH/QENI/yMmK/8fIif/Gh4h/xYX G/8UFBb/ExMV/xUTFP8WFBX/DAwM/wwOC/8QEBD/FBQS/xkZF/8dHRv/ISAc/yMiHv8oJyP/ Ix8c/xkVEv8SDwr/Eg8K/xkUEP8jHhv/LCQh/zIpJP9WTUb/7OHb//Dj2//Sw7z/rqCX/1JA NP+UgnT/rJaI/6qVhP+rkYD/p456/6WJdP+ihnD/oYJt/56CbP+jiHX/ool1/6SJdP+minT/ qYp1/6qKc/+qi3b/qIx2/6aLeP+ii3v/nIp+/5aJgf+QhoT/ioaF/4WFh/+AhYv/dYGP/4eU pP+hq7f/srnB/76/wf++u7b/tKqh/6mcjP+ei3r/n4l0/5+Eb/+egm3/oIFt/6KBbv+mg3D/ pYZy/6WKdf+hi3T/oIdx/5uFbv+Ygm3/lX9q/5N8bP+RfGv/i3Vn/4RxY/99aV7/dGBV/21Z UP9oVU7/Z1NM/2lSSv95XlX/f2FW/4ZqXv+NcWX/k3dr/5Z6bP+WfG3/lnxt/5N5av+Remj/ kHln/495ZP+Md2L/i3Zh/4p1YP+Kdl7/jXRe/493X/+Te2P/ln5m/5aAaP+WgGj/lH5m/5N9 Zf+ZhWz/mYVs/5eGbP+Xhmz/mIdt/5iHbf+ZiG7/mYhu/5aHav+UhWb/lodm/5aJZ/+QhWf/ joRp/5aOef9TSz7/Lygi/y0nKf8sJy3/KSYt/ygoKv8nKSj/Jigj/yYoI/8iIiD/RkZG/9rb 3/8ODxP/LC0y/zM0Of8tLTX/Kywx/y0uM/8qLCv/LjEq/ygsG/9NUzf/k5ty/4aQXv+Qm1// jppY/4yZVP+PmVr/j5lc/4+ZXP+PmVz/j5lc/4+ZXP+PmVz/j5lc/4yWWf+Mlln/jZda/46Y W/+PmVz/kJpd/5GbXv+RnV//kJxe/46cXv+QnF7/kZ1f/5GcYP+SnWH/k5xj/5OcY/+Sm2L/ k5xj/5WcZv+WnmX/l59m/5igZ/+boGj/l592/6Wxp/+frLL/m6as/5Sdov+RlJv/j46U/5CL j/+Tio3/nJCS/5yOjf+bjIn/nIqG/5yLhP+ejYX/oo+I/6ORh/+lj4L/pY+B/6WPgf+lj4H/ pY+C/6WPgv+mjoL/po6E/7KakP+zm5H/tpuU/7eclf+3nJX/tpuU/7WZlf+0mZL/rZKJ/7GY kf+nj43/rZma/7qpr/+pnKP/tKuw/6Kcnv+loJz/q6Sc/66mm/+upJr/r6CZ/7Cemv+rl5j/ o5GP/6WYkP+hmI//jIeB/4OCgP+bnKD/i5Ka/3uFj/9/i5n/k6Cw/6Sxwf+IlKT/hpCc/7C0 wP+Zm6f/aGhw/7q5vv+WkpH/iYWC/0JBPf9QUE7/TE5L/0NFRP9GSkv/PkJF/z9DRv8/QET/ Ojs//zU0Of8xLzL/Lyou/ywoKf8rJSf/KSMj/yslJf8uKCj/Mi0q/zgwLv88NDH/Pzc0/0I5 NP9FOzn/NSwn/0A1M/9MQT//OC0r/yQZF/8rHx//OC0r/yIZFP8lHBP/oJaN/+HXzf///PP/ 9ujd/3trXv+Xhnb/qJWE/6mUgf+qkX3/p454/6eLdf+kiHD/pIZu/6GFbf+kiXT/pIl0/6aK dP+ni3P/qopz/6uLdP+rjXX/qY13/6uQe/+mj33/oI6C/5mMg/+RiYb/i4eG/4aGiP+Bhoz/ c3+P/4CQoP+ZpbH/rre+/7i8vf+3trH/r6ad/6iajf+ei3r/n4l0/5+Eb/+egm3/oYBt/6KB bv+mg3D/pYZy/6GIcv+ciHD/mYNs/5N/Z/+OeWT/hnRe/4VwX/+AbVz/fmtd/3hmWP9wXlL/ ZlVL/2FOR/9eTUX/X0xF/2FNRP93XFP/fmBW/4ZqXv+Ocmb/k3dr/5V5bf+Uemv/k3lq/5F3 aP+Qdmf/jXZk/4x1Y/+KdWD/iXRf/4hzXv+Jc17/i3Bd/45yXf+SdWP/lHlk/5Z7aP+VemX/ lHlm/5J5Y/+ZgGz/l4Fq/5eBbP+Ygmv/mIJt/5iEbP+Zg27/mIRs/5eDa/+Ug2n/loVp/5aH av+Sgmj/kIFq/5eLe/9TST//MCYl/y8mK/8tJi7/KyYt/yknLP8oKCj/Jygj/yYoI/8jIyH/ RkZG/9na3v8NDhL/Kywx/zIzOP8sLDT/Kisw/ywtMv8pKyr/LTAp/ygsG/9MUjb/kppx/4WP Xf+Qm1//jZlX/4yZVP+LlVj/i5VZ/4uVWf+LlVn/i5VZ/4uVWf+LlVn/i5VZ/4eRVf+Iklb/ iZNX/4qUWP+LlVn/jJZa/42XW/+NmVv/jJha/4qZWP+MmFr/jZlb/42YXP+NmF7/j5hh/4+Y Yf+QmWL/kZpj/5OaZv+Um2X/lZxm/5adZ/+Znmj/lp53/6e2sf+drbr/laOw/46YpP+KkJz/ i42Z/46Nlf+SjZT/j4mN/5KIif+Th4f/lImH/5iNif+dkoz/pJeP/6iakf+lk4f/ppOF/6aT hf+mk4X/ppKH/6aSh/+okof/qJGJ/6yVjf+rlIz/qpGM/6mQi/+pkIv/qpGM/6yTj/+tlI// vKSg/7OgnP+tm5v/p5id/6ygqv+nnaj/rqmw/6eiqP+opKP/paKb/6Whlv+qoZj/q56W/6eY k/+nk5T/p5WT/62flv+mnJL/k4yE/6unpP+goaP/hImP/5Wfqf+vu8n/jpur/4yZqf+UobH/ k5+t/8jO3P/f4+7/iYyV/6Gipv+KiYf/TEtG/xEQC/8bHBf/Gx0Y/w8UEP8fIyL/Jyss/zU2 OP84OTv/Pj5A/0NBRP9GQUX/RT9D/0Q7QP9CNzv/TUFD/01BQf9OQkL/T0RC/1NFRP9URkP/ VUdE/1ZHQv87LCn/MyQf/2FPTf+Ne3n/fWtp/2hWVP9rWVn/aFlW/x4TDf9QST//nZSL/5uR h//Dtq3/18m8/4t7bP+OfW3/pJGA/6WQff+njnj/po52/6eLc/+lim//pohu/6SJbv+jiXD/ pIpx/6WJcf+mi3D/qopx/6qKcf+qjHL/qIx0/6yRfP+nkH7/oY+D/5uOhf+UjIn/jIuJ/4iJ i/+CiY//foub/4iZqf+erLf/s7zD/7u/wv+2tbH/r6ad/6mdj/+ejXv/n4p1/6CFcP+fg23/ ooJt/6ODbv+nhHH/podz/5mDa/+Tgmj/j3tj/4Z0XP9+bFb/dmZP/3FeTf9tXEr/bFpM/2dX SP9hUUT/WUtA/1pJQf9aTEP/YE9I/2VSS/95XlX/gGJY/4hsYf+QdGn/lHhs/5V5bf+SeGn/ kHZn/5B2Z/+Qdmf/jXZk/4x1Y/+JdGH/iHNg/4dyXf+Icl3/im1b/49wXv+ScmP/lHdl/5V4 aP+VeGb/lHdn/5J3ZP+YfWz/mH1q/5h9bP+Yf2v/mH5t/5eBbP+Zf27/l4Fs/5eBbP+WgGn/ mIJr/5iEbP+SgGj/kH9r/5eJfP9URz//MSUn/zAlLf8tJTD/KyUv/ykmLf8oKCr/Jycl/yco I/8jIyH/RkZG/9na3v8NDhL/Kyww/zIzOP8sLDT/Kisw/ywtMf8pKyr/LTAp/ycrHP9MUjj/ kpp1/4aOX/+QmWL/jphZ/4yWV/+Kkln/ipFb/4qRW/+KkVv/ipFb/4qRW/+KkVv/ipFb/4iN V/+IjVf/iY5Y/4qPWf+LkFr/jZJc/46TXf+Ok13/i5Jc/4uSXP+Ok13/jpNd/46TXf+PlF7/ kJJg/5CSYP+UlmX/lJZl/5WXaP+Wl2v/mZhs/5qYb/+bmXD/l5p//6WvsP+cqbn/l6Oz/5Sb q/+Rl6X/kJKe/4+NmP+NipH/lpCU/5iPkP+Yjo3/mY+N/5yTjv+hlpD/pZuS/6qdlP+sm5H/ rZuP/62bj/+tm4//rpqP/66aj/+umpH/rpqR/6eTjP+lkYr/o4yG/6CJg/+giYP/o4yG/6eP i/+nko3/sJ6c/6KSkv+rnJ//pZqg/6iep/+zq7b/raiv/7Cus/+sqKn/qKSh/6qln/+up6H/ qJ+a/6GTkv+mlpf/saGh/6ealP+xqJ//mpON/6mlov+Hh4f/homO/6Srs/+QmqT/t8HN/7jE 0P+tt8P/srrF/5ifqf+UmKH/en2E/zo7P/9AQkH/FhgV/xcZFv8QFBP/GR0c/xkfH/8bISH/ DxQX/xMXGv8VGRz/HB0i/yUkKf8xLjX/PDo//0dCSf9OSEz/VkpO/1dJSf9WSEj/VEZF/1RE RP9SQ0D/UUI//1JAPP9DMS3/QS4q/3dkXv+ok47/oo2K/6KNiv+kj4z/iHVx/zAjGv9eVEj/ oZWJ/6SYiv+XiXz/b19Q/1JBL/+gjnr/oo16/6ONeP+ljHb/pYt0/6aKdP+liXH/p4lx/6WJ cf+iiG//oohv/6OJcP+kiW7/qIlt/6mKbv+qinH/qYtz/6uPev+ojn3/oo6D/5yNhv+WjIr/ kY2O/4yLkP+IjJX/jJqn/5Sks/+otMD/usPK/8LDxf+6trP/sKee/6udkP+fjn7/oIt4/6GG cf+ghG//ooNv/6OEcP+mhXT/pYh2/5J9aP+MfGX/hXRg/31sWP9yY1D/aVpH/2NTQ/9fT0D/ Xk5B/1tLPv9XRzr/VUU4/1dHOv9eTkH/ZVVI/2xYTf96X1T/gmRa/4ltYv+RdWn/lXlt/5V5 a/+Sd2b/jnRj/5F2Zf+QdmX/j3Vk/450Y/+LdGL/iXJg/4lyYP+KcF//jGxd/49uX/+ScmX/ lXVm/5d3av+Xd2j/lHdp/5J1Zf+Ye23/mHtr/5h7bf+YfWz/mHxu/5h9bP+ZfW//mX5t/5p/ bP+Zfmv/moFt/5iCbf+Tfmn/kH1s/5iIe/9URT7/MyUl/zAlKf8vJS3/KyYt/yknLP8oKCr/ Jycn/ycnJ/8jIyP/R0dH/9nd3v8DBwj/Li8z/ygpLf8qKzD/KCku/ywrMP8sLCz/HR4Y/ykr Hv9BRS7/j5R0/4KHXv+BiFX/g4pU/4eMVP+Iiln/iIpb/4eJWv+HiVr/iIdZ/4eGWP+GhVf/ hoVX/4J/Uv+DgFP/hoNW/4mGWf+Nil3/kY5h/5WRZP+WkWf/lo5p/5eNav+XjWn/l45n/5eO Y/+XjmP/l49h/5eOY/+dlGv/m5Jr/5KIZf+Wi23/pJZ8/6OUf/+ml4T/tKui/6SkrP+corD/ mZyr/5WXpP+UlKD/k5Gc/5SRmv+Xkpj/kYuN/5SMiv+WjIr/mI2H/5qQh/+dkIf/npGI/6CS h/+gj4X/opCG/6SSiP+nlYv/qZeN/6yakP+unJL/r52T/6eVi/+nlYv/qZWM/6mVjP+qlo3/ qpaN/6uXkP+pmJH/o5iW/6OZmv+km57/p56h/6iipv+qpKj/rKaq/6ynq/+wqqz/q6Wl/6ag oP+knp7/pp2e/6Oam/+dk5T/lo2O/7Wwrf+9ubb/trWz/5eWlP9ubm7/XV5g/2xtcf+BhYj/ jpGW/56hpv+xtLn/u7/C/5+gpP9eX2P/Pj9B/1FSVv8/REr/GB8l/w8WHP8UGyP/LDM7/ztC Sv8tNDz/LzY+/yIpMf8cIyv/Ehkj/w4SG/8OEh3/FRki/x4iLf8oKDD/OTQ4/0lAQf9PRkf/ TERC/1VLSf9iV1P/Wk9L/0c6NP84KST/RjUu/4h1bv+jkIn/s5+W/6OPhv+rlIz/d2NY/zQi Fv9iUEL/eGZY/2pXSP9nVEP/NyIP/3FcR/+xm4T/oIdx/6GGcf+hhnH/o4Z0/6OGdP+mhnf/ p4Z3/6SHdf+ehW//nIZu/6CGbf+ih2z/podr/6qIbf+qiG3/q4lw/7KSff+tkID/p4+F/6CN h/+Zi4v/k4iO/46Hj/+IiJL/lZ+r/6+7x//I0dr/ztPZ/9LQ0//Ty8n/v7Kq/6WUiv+gjX// oot7/6KId/+ghXL/nYJv/5uAbf+Zfm3/lX5u/4x8bP+BdWX/dGha/2ZaTP9bTUL/VEY7/1BC Of9RQDj/UkE5/1VDOf9ZRzn/X04+/2dVQf9vXUf/d2NL/3xmUf+Ocmb/kHJo/5Fzaf+SdGn/ k3Zm/5R3Zf+VeWT/lXtk/5N3Yf+Sd2L/kndk/5J3Zv+Sdmj/knZq/5J2av+TdWr/lXVq/5V1 aP+UdGn/lHRn/5R0af+Tc2b/k3No/5NzZv+Wdmv/l3dq/5d3bP+VeGr/lnht/5Z5a/+WeG3/ l3ps/5t7bP+ggW//j3Jg/41yYf+Ve2r/iHNi/4h2aP9PPjT/MiUf/y8lI/8sJib/KiYn/ygm Kf8nJiv/JSYq/yUmKv8hISP/SkpK/9nd3P8DBwb/Li8x/ycoLP8pKi//Jygt/ysqL/8sLC7/ JCUg/ywuI/9AQS//goVq/3Z6Vf98glb/goVW/4CEUv+DgVj/g4Fa/4OBWv+DgVr/hYFb/4WB W/+GgVv/hoFb/4B7Vf+BfFb/hn5Z/4mBXP+NhWD/kIhj/5OJZf+Vi2j/mopw/5qKcf+binD/ mots/5uLaf+ajGf/m4xl/5qMZf+gkG7/nY5t/5mIbv+ainP/oo+A/6WTif+sl5L/sqSk/6Cd pv+Zm6j/lpWj/5KSnv+Qjpn/jo2V/5KNk/+SjZH/m5KT/5qSkP+akYz/mo+J/5qNhf+ZjIP/ mYuC/5iKf/+VhHz/l4Z8/5uIgf+ejYP/o5CJ/6aVi/+rmJH/q5qQ/7Cdlv+unZP/rpuU/6yb kf+smZL/qpmP/6qXkP+ml5D/n5WU/5iSlP+WkJL/nJaY/6Odn/+jnZ//mpSW/5CKjP+hm53/ nZeZ/5uVl/+emJr/pqCi/66oqv+wqqz/r6us/7Kwsf+np6f/mpqa/5KSkv+RkZH/kpKS/5CQ kP+NjY3/i4uL/5OTk/+YmJj/j4+P/29vb/9VVVX/a2tr/5qbn/9FTFT/JS43/xggK/8QGSL/ FR0o/xskLf8TGyb/GyQt/zA4Q/8oMTr/HCQv/w8YIf8IEBv/BQ4X/wYOGf8LDxj/HRwh/ywo Kf80MDH/PDY2/09KR/9hWVb/V01L/0A1Mf8wIx3/RDUu/3xrY/+mlIr/uKac/6uXjP+xnZL/ UD0v/ysYCv9hTj//hXJj/5F8a/+Qe2j/VT8q/3xmT/+chGz/pIx0/6WKdf+linX/p4p4/6eK ev+oi33/qop//6iLe/+dh3D/nYlu/6CIbP+hiGr/pIdp/6WGZ/+ohmr/qIZq/6aGbf+kiHP/ o4l8/6CMg/+ej4z/m5GS/5yTmP+WlZv/p660/7rFyf/J0dT/y8zO/83Jxv/Ox7//wLSo/6yc jf+gjXz/oYx5/5+JdP+bhW7/l4Fq/5R+Z/+Re2b/jHlo/3drXf9tZVj/YVdN/1VLQv9OQTn/ Sz44/0w9OP9NPjn/XEtE/2BNRv9mVEj/bltM/3VjTf97aVH/gGxR/4NtVf+Qdmf/kXVq/5J2 av+Sdmj/kndk/5J3Yv+TeWD/k3lg/5R6Yf+UemH/lHlk/5R5Zv+UeGr/lHhs/5R4bf+UeG3/ lXhq/5V4aP+Ud2n/lHdn/5N2aP+Tdmb/k3Zo/5N2Zv+Tdmj/k3Zm/5R3af+Ud2f/lHdp/5V4 aP+VeGr/lXho/5l5av+be2z/i25g/4NnWf+HbWD/hnBi/5eFd/9mVUv/MiUd/y8mH/8sJyP/ KCcl/ygmKf8nJiv/JSYr/yUmK/8hISP/SkpK/9jc2/8CBgX/LS4w/ycoLP8pKi//Jygt/ysq L/8rKy3/JiYk/y0uJv9HSDj/hIZu/3x/YP9/hFz/fH9U/3N2S/98elT/fXpX/357WP9/fFn/ gX5b/4J/XP+EgF3/hYFe/4R+XP+Ff13/iIJg/4qEYv+PhmX/kolo/5WMa/+XjG7/n5B5/5+Q e/+gkHn/n5F2/6CRdP+fknD/oJJv/5+Sb/+klXb/oZN2/6KSef+gkX7/oY+D/6uakv+1op7/ r6Cj/5+cpf+Ymqb/lpai/5KSnP+Qj5f/j46U/5OOlP+TjpL/lYyN/5SMiv+Uioj/k4qF/5OI gv+Rh37/koV9/5OFfP+Vhn//loh//5qJgv+ajIP/n46H/6CSif+jkov/opSL/6mYkf+nmZD/ qZiR/6eZkP+pmJH/p5mQ/6mYkf+mmZP/nZWT/5uVl/+blZf/mpSW/5qUlv+blZf/nZeZ/5+Z m/+alJb/kYuN/4iChP+HgYP/kIqM/52Xmf+ooqT/rKip/66srf+mpqb/oKCg/6Ghof+ioqL/ nZ2d/5CQkP+FhYX/fHx8/21tbf9gYGD/S0tL/ygoKP8ODg7/DQ0N/xMUFv8WGyH/CxIa/xAX If8PFh7/EBch/xIZIf8PFiD/GiEp/xUcJv8SGSH/DhUf/wsSGv8KERv/CxIa/w0UHv8QFRv/ DAsQ/xIQEf8WFBX/IR0c/zo0NP9QSEb/SEA9/zMqJf8+My3/Rjkx/0s8Nf9bSkL/aVhQ/3hm XP+lk4n/STcr/1lHO/+Jd2v/opCE/66bjf+ciXj/YUw5/496Zf+dh3D/ppB5/6iPef+oj3n/ qY57/6qPfv+qj37/q46A/6qRff+fjG7/nY1r/56MaP+gimX/oIhi/6CHX/+hhWD/oYVg/6KI Z/+iiWv/oYt0/6GQfv+glIb/n5iO/6Cblf+dnpn/p7Cr/7fCuv/Ey8P/w8a7/8PBsv/Dvqv/ tq6X/6WZf/+Tg2n/k4Jm/5J/Yf+Oe13/iXZY/4VyVP+Ab1P/fW9V/3BkVP9lXVL/WVBH/09G Pf9LQDr/TEE9/1NFQv9YSUb/altY/3FgWf95aGD/gnBk/4d2Zv+KeWX/i3lj/4t5Y/+Tfm3/ k3xs/5J7af+Re2b/kHpj/495Yf+OeV7/jnlc/5J9YP+SfWL/knxk/5J8Zf+SfGf/kntp/5J7 a/+Se2v/lHtn/5R8ZP+Ue2X/k3tj/5N6ZP+Te2P/knlj/5J6Yv+Qd2H/kHhg/5F4Yv+ReWH/ kXhi/5J6Yv+SeWP/knlj/490Y/+Wemz/mX9y/5J7bf+KdGf/gm5j/4h3bf9MPjX/MCUf/y4n If8sJyT/KCcl/ygmKf8nJiv/JSYr/yUmKv8hISP/SkpK/9fb2v8BBQT/LC0v/yYnKf8oKS7/ Jics/yopLv8qKiz/LS0t/yUmIP88PDD/dHVj/3J1Wv95fF3/foBb/4CCXf93dlf/enZZ/3x4 W/9+el3/gHxf/4N/Yv+FgGP/hoFk/4uEaP+MhWn/jodr/5CJbf+Vi3D/l41y/5mPdP+akHf/ oZSB/6GUg/+hlIH/oZV//6GVe/+hlnr/oZZ4/6GWeP+il3v/oZV7/6WYhf+ilYX/nY+G/6yd mP+2pqb/qJyg/5+co/+Ym6T/lpae/5OTm/+SkZf/kpGW/5aRlf+Xk5T/k42P/5aNjv+Yjo3/ mY+N/5yRjf+dko7/oJON/6GUjv+fkoz/n5KK/52Qiv+bjob/mo2H/5iLg/+WiYP/lomB/6GU jv+jlo7/pZiS/6mclP+toJr/saSc/7OmoP+zqKT/p56f/6Odn/+gmpz/nJaY/5iSlP+UjpD/ j4mL/42Hif9wamz/bmhq/3Frbf98dnj/jYeJ/52Xmf+moKL/qaWm/5ORkv+Pj4//iIiI/3t7 e/9tbW3/YWFh/1paWv9XV1f/SUlJ/ywsLP8bGxv/FxcX/xUVFf8dHR3/Gxsb/wgJC/8ICxD/ Cg8V/xQZH/8XHCL/Fhsh/xMYHv8RFhz/FRog/xAVG/8RFhz/ERYc/xIXHf8SFx3/Ehcd/xIX Hf8SFRr/FxYb/xYWGP8SEBP/EhAR/yIeH/81Ly//NzIv/y8nJP8wJyL/Rjs1/0Y5M/89MCj/ Rjcw/1BCOf9wX1f/PSwk/4Fzav+klo3/q5qQ/6qajf+DcWP/U0Iw/5aEcP+lk33/oYx3/6GN df+ijHX/o414/6OMev+jjHr/pI19/6OOe/+bi3L/moxv/5qJa/+ah2f/mYVk/5mCYP+ZgV// mH9g/5uEZf+ZhGn/loRu/5GEcf+OhXb/ioZ7/4aGfv+Eh4D/l56X/6Wvpv+1u7H/uryv/7u5 qv+4s6D/qqKN/5qQd/+Uhmz/kYNo/419Y/+Gdlz/fm5U/3dnTf9xY0n/bGBK/1xTRP9VTEP/ TUQ7/0g/OP9LQDz/U0hG/15TUf9nWVj/c2Vk/3lraP+DdG//jH51/5CCd/+Qg3P/j39v/4x8 bP+SgHL/kn9x/5B9bv+PfGv/jXtn/4t5Y/+Jd1//iHdd/4x6Yv+MemL/jHpk/4x6Zv+MeWj/ jHlq/4x5a/+MeWr/i3lj/4t5Yf+NeWH/i3lh/4x4YP+KeGD/jHhg/4l3X/+Ld1//iXdf/4t3 X/+KeGD/jHhg/4p4YP+NeWH/jXhj/5J8bv+Qem3/lX90/415bv+HdWv/iHdt/5CBev9YTUf/ LyYh/y4mI/8rJyb/KCYn/ycnJ/8nJyn/JSYq/yUmKv8hISP/SkpK/9bb1/8ABAP/Kywu/yUm KP8nKC3/JSYr/ykoLv8pKC3/JCQm/xoaGP9CQjr/fX5w/3x9a/91d1//cXFX/3Z2Wv98emP/ fXtk/399Zv+Bf2j/g4Fq/4aEbf+JhG7/ioVv/42Hcf+Nh3H/j4lz/5CKdP+Ti3b/lIx3/5aO ef+Wjnv/m4+B/5uPg/+bj4H/m49//5uQfP+bkHr/m5B6/5uQev+aj3n/mY56/5+Thf+cj4b/ lomD/6OVlf+snaD/nZKY/5mXnP+Vlpv/kpOY/4+QlP+OjZL/j4+R/5OOkv+VkZL/kYuN/5KM jP+VjI3/lo6M/5iOjf+akI7/nJGP/5yRj/+bkIz/mo+J/5iNif+Wi4X/k4iE/5GGgP+PhID/ joN9/5eMiP+YjYf/m5CM/56Tjf+il5P/ppuV/6memv+pn53/qqSk/5yYmf+Sjo//lZGS/5uX mP+NiYr/a2do/01JSv9FQUL/TEhJ/1xYWf9wbG3/gn5//4mFhv+GgoP/gHx9/2poaf9aWlr/ RUVF/zY2Nv8xMTH/MTEx/zExMf8wMDD/ICAg/w8PD/8HBwf/AgIC/wAAAP8HBwf/CwsL/wAA Av8DBAj/AgUK/wAABf8AAAX/AAAF/wAABf8AAgf/AAAF/wACB/8AAgf/AAMI/wADCP8AAgf/ AAAF/wAABf8AAAT/AgMH/wMECP8CAQb/AAAC/wAAAv8JBwj/Eg4N/xQPDP8YExD/OjIv/0c9 O/81LCf/Qzg0/zswKv8oGxX/JBcR/3RnYf+Pgnz/lId//5mMg/94al//WEs7/5KFdP+Yi3j/ l4hz/5eIcf+YiHH/mYly/5mIdP+ZiHT/mol3/5qJef+XiXz/lYl9/5eHev+WhHb/lYJx/5WA b/+Uf2z/k35r/414Z/+Jd2n/hHZr/391bP96cm//dXFw/3Bwcv9ub3P/eX1+/4SIif+SlJP/ l5iT/5qXkP+ak4v/kYh//4d9cf+BdWf/fnBj/3hqXf9vYVT/ZVlL/1xQQv9WSj7/UEY8/0Y8 M/9COTL/PjUu/z82Mf9GPDr/UUdG/15UU/9nW1v/em5u/39zc/+IfXv/j4SA/5KHgf+Qhn3/ jIJ4/4t+df+Rgnv/koF6/5GAeP+PfnT/jX1w/4t7bP+JeWr/iXlp/4h4af+IeGn/iHhp/4h4 a/+Id23/iHdv/4h3cP+Id2//iHhp/4V4Zf+HeGX/hXhl/4Z3ZP+Ed2T/hndk/4N2Y/+IeWb/ hnlm/4l6Z/+Hemf/into/4h7aP+Ke2j/inpq/4p5b/+Dcmr/inlx/4Z4b/+Gd3D/gnVt/4B1 cf9SSUT/LiYj/ywnJP8rJyb/KCYn/ycnJ/8nJyn/JiYo/yYmKP8hISH/SkpK/9Xa1v8ABQH/ Kiwr/yQlJ/8mJyv/JCUq/ygnLf8pKC7/JyYr/yUlJf9dXFj/kpKK/5SUiP+QkYH/j458/5aV gf+Uk4H/lpOC/5eUhf+YlYT/mpeI/5uYh/+emIr/n5mJ/5qShf+blIT/nJSH/5yVhf+flYn/ n5aH/6CWiv+hl4v/npWM/56Vjv+elYz/npaL/56Xh/+el4X/npeF/56Xhf+dlob/nZWI/6CY jf+flo//nZOS/6OZmv+nnKL/oZef/5+doP+bnJ7/mZqc/5aXmf+Xl5n/mJiY/5uZmv+empv/ nZeZ/5yWmP+dlJf/nJOU/5uRkv+akJH/mY+Q/5mPjv+bk5D/m5OQ/5yUkf+clJH/nZWS/52V kv+elpP/npaT/52Vkv+dlZL/nZWS/52Vkv+dlZL/nZWS/52Vkv+blpP/pZ+f/5yYmf+Xk5T/ nJiZ/6OfoP+bl5j/hICB/29rbP+QjI3/kIyN/5KOj/+YlJX/npqb/56am/+YlJX/kI6P/5KQ kf+JiYn/gYGB/35+fv+AgID/gYGB/35+fv96enr/fHx8/319ff+EhIT/h4eH/4SEhP+Dg4P/ fn5+/3R0dP+Dg4X/h4iK/4B/hP+BgoT/h4aL/4iJi/+Lio//fn+B/4KBhv+Cg4X/hIOI/4SF h/+FhIn/g4SG/4OCh/+Cg4f/eXp+/4GChv+IiY3/iImN/4WGiv+Ghoj/i4mK/42Miv+Pi4r/ mZWS/5eSj/9+eXX/k4uI/5CJg/9zamX/joWA/4N5d/+PhYP/lYuJ/6GYkf+Vi4L/iX9z/6Oa i/+bk4D/oZaE/6GWgv+jl4H/o5eB/6OWg/+kl4T/pJeG/6OXi/+jmJb/oZeY/6KWlv+jlZT/ opOO/6OSi/+jkov/opGK/5yLhP+ai4b/louJ/5SLjP+Qi4//jouS/4uLk/+JjJP/hYWN/4iJ jv+Lio//joyP/5KOj/+WkJD/mJCO/5iOjP+Yj4r/l4yI/5WKhv+SiYT/j4WD/4yCgP+KgH// iX99/5KJhP+PhoH/jIN+/4uBf/+Ng4L/koiH/5iOj/+akZL/k4mK/5WMjf+ckpH/n5eU/6GZ lv+fmJL/nZaO/5uSjf+glZP/oZOT/6GTk/+gkpH/npCN/52Qiv+dkIr/nI+J/5mMhv+ZjIb/ mYuI/5mLiP+Zi4r/mYuK/5mLi/+Zi4r/l4yG/5eNg/+WjIL/loyC/5WLgf+Vi4H/lYuB/5WL gf+Zj4X/mY+F/5mPhf+akIb/mpCG/5uRh/+bkYf/m5GI/5eNhP+Qh4D/nZKM/56Vjv+hmJP/ j4iC/4Z+fP9taGX/LCYm/ysnJv8pJyj/KCYn/ycnJ/8nJyf/JiYm/yYmJv8hISH/SkpK/9TZ 0/8ABAD/KSsq/yMkJv8lJir/IyQp/ycmLP8oJy3/MzI4/yQjKP81MzT/JiUj/wQDAP8BAQD/ AwAA/wYEAP8DAQD/AwEA/wMAAP8DAQD/AwAA/wMBAP8EAAD/BAAA/wYAAP8GAAD/BgAA/wYA AP8HAAD/BwAA/wcAAP8HAAD/BgAA/wYAAP8GAAD/BgAA/wYAAP8GAAD/BgAA/wYAAP8GAAD/ BgAA/wYAAP8GAAD/CAAA/wYAAv8GAAX/BgAG/wICBP8AAQD/AAAA/wAAAP8AAAD/AAAA/wEA AP8CAAH/CAQF/wgEBf8IAgT/BwED/wcAAf8GAAD/BgAA/wYAAP8EAAD/AwAA/wMAAP8DAAD/ AwAA/wMAAP8EAAD/BAAA/wgEAf8HAwD/BwMA/wUBAP8EAAD/AwAA/wMAAP8DAAD/AwAA/wMA AP8DAAD/AwAA/wMAAP8DAAD/CQUG/w8LDP8LBwj/BQEC/wMAAP8DAAD/BAAB/wcDBP8IBAX/ BAID/wEAAP8CAgL/CQkJ/w0NDf8MDAz/BwcH/wEBAf8AAAD/BwcH/wMDA/8AAAD/AAAA/wIC Av8CAgL/AAAA/wMDA/8AAAD/CQkJ/wIAA/8BAQH/AwEE/wAAAP8DAQT/AAAA/wcFCP8FBQX/ BAIF/wAAAP8BAAL/AAAA/wEAAv8AAAL/AAEE/wAABf8AAQb/AgYJ/wIGCf8BAgT/AAAC/wAA AP8FAwT/BwYE/wMAAP8DAAD/BQAA/wUAAP8EAAD/BAAA/wYAAP8GAAD/BgAA/wgAAP8GAAD/ CgMA/wwGAP8GAAD/BgAA/wYBAP8HAAD/BwAA/wgBAP8IAQD/CAEA/wcAAP8EAAL/BAAF/wcA Bv8IAAX/CQAB/wkAAP8JAAD/CgAA/wgAAP8IAAD/CAAE/wYBB/8FAgn/BAQO/wIEEP8DBRH/ AgIK/wEACP8AAAX/AgAG/wMBBv8GAQX/CQQI/wwGCP8EAAD/BAAA/wQAAv8EAAL/BAAC/wQA A/8GAQX/CAIE/w8HBf8OBgP/DAQB/wkBAP8HAAD/BgAA/wYAAP8EAAD/BgAA/wQAAP8GAAD/ BQAA/wYBAP8GAQD/BQAA/wUAAP8GAAL/BwAE/wcABP8HAAT/BwAC/wgAA/8IAAP/CAAB/wcA AP8HAAD/BwAC/wcAAv8HAAT/BwAE/wcABf8HAAT/BgAC/wQAAP8EAAD/BAAA/wQAAP8EAAD/ BAAA/wQAAP8EAAD/BAAA/wQAAP8EAAD/BAAA/wQAAP8EAAD/BAAA/w4JBf8DAAD/BQAA/wMA AP8JBQL/AwAA/xYSE/8yLi//Kyco/yknKP8pJyr/KCYp/ygmJ/8oJif/JiYm/yYmJv8hISH/ SkpK/9TZ0/8ABAD/KSsq/yMlJP8lJir/IyQo/ycmLP8nJi7/ISAm/yUkKv9DQUb/KCYp/wUD BP8FBAL/BgIA/wMAAP8BAAD/AQAA/wEAAP8DAAD/AwAA/wMAAP8DAAD/BAAA/wQAAP8GAAD/ BgAA/wcAAP8HAAD/CAAA/wgAAP8HAAD/BQAA/wQAAP8EAAD/BAAA/wQBAP8EAQD/BAEA/wQB AP8DAAD/AwAA/wMAAP8EAAD/DQgM/wMABP8DAAX/CQYN/wMDA/8AAgD/AAAA/wAAAP8AAAD/ AAAA/wMBAv8EAgP/AwAA/wMAAP8EAAL/BAAC/wQAAv8FAAP/CAAE/wYABP8EAgP/AgIA/wMC AP8BAQD/AQAA/wAAAP8BAAD/AAAA/wEAAP8AAAD/AQAA/wAAAP8BAAD/AAAA/wIBAP8CAQD/ CAYH/woGB/8IBAX/BAAB/wMAAP8DAAD/BQEC/wkFBv8DAAD/AwAA/wMAAP8DAAD/CAQF/wcD BP8DAAD/AQAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wMDA/8AAAD/AAAA/wgICP8BAAD/CAcF/wEAAP8BAAD/AQAA/wEAAP8ODA3/BQQC/wIA Af8BAAD/AQAA/wEAAP8BAAD/BQQC/wkHCP8LCwv/AQUI/wABBf8AAAX/AAAF/wACBf8AAQT/ AAAC/wAAAv8AAAL/AwMD/wAAAP8MCwn/AQAA/wEAAP8PDgz/AQAA/wYBBf8DAAL/CQUG/wMA AP8DAAD/CQYA/wMAAP8GBAD/AwEA/wMBAP8EAAD/BAAA/wQAAP8FAQD/BQEA/wQBAP8BAAT/ AQAF/wMABf8DAAT/BAAC/wcAAf8IAAL/CQAB/wQAAP8EAAD/AwAA/wEAAv8AAAT/AAEG/wAC CP8AAQb/AAAE/wAAAv8BAAL/AwEE/wMBBP8BAAD/AQAA/wEAAP8GBAX/BQME/wUDBv8EAgX/ AgIE/wEBA/8AAAL/AQAA/wQAAP8EAAD/BgAA/wYAAP8JAAH/BgAA/wQAAP8EAAD/BgEA/wUA AP8EAAD/BAAA/wMAAP8DAAD/BQIA/wcCAP8EAAD/BAAE/wYAAv8EAAL/BwAD/wYABP8JAAX/ BwED/woBBv8IAgb/CgEG/wgCBv8KAQb/CAIG/woACP8IAQj/BgEF/wYBBf8GAQX/BgEF/wUA BP8FAAT/BAAD/wQAA/8DAAL/AwAC/wMAAv8EAAP/BAAD/wQAA/8FAAT/BQEC/wEAAP8AAQD/ AgEA/wABAP8DAgD/AAAA/w0LDv9CQEP/KScs/yknKv8pJyr/KCYp/ygmJ/8oJif/JiYk/yYm JP8hISH/SkpK/9fc2P8AAwD/JScm/yAiIf8mJyv/JSYq/yYlK/8iISf/JCMr/yEgJv9APUT/ JyUq/wEAAv8CAAP/AwAC/wQAAf8BAAD/CwsJ/wAAAP8EAwH/AQAA/wQDAf8HBgT/BwMC/wMA AP8EAAD/BAAA/wQAAP8EAAD/BgAA/wcAAP8EAAD/CwcI/wQCA/8BAAD/BQME/woJB/8BAAD/ AQAA/wYFAf8BAAD/AQAA/wEAAP8DAQT/BAIH/wEABf8BAAf/AAAE/wAAAP8AAQD/AAEA/wAB AP8AAAD/AAAA/wEAAP8BAAD/AQAA/wEAAv8DAAL/BAAD/wQABf8EAAX/BgAG/wUABv8FBQX/ AAIB/wEBAf8AAQD/AAAA/wACAf8CAgL/BAYF/wAAAP8AAQD/AAAA/wABAP8AAAD/AAEA/wAA AP8AAAD/AgAB/wIAAf8CAAH/AgAB/wIAAf8CAAH/AgAB/wIAAf8GBAX/AQAA/wMBAv8BAAD/ BQME/wEAAP8EAgP/AQAA/wICAv8AAAD/BQUF/wAAAP8DAwP/BgYG/wAAAP8GBgb/CAgI/wAA AP8DAwP/BwcH/wEBAf8BAQH/AQEB/wQEBP8BAAD/AQAA/wEAAP8BAAD/AQAA/wEAAP8BAAD/ AgEA/wYFA/8BAAD/BQQC/wQDAP8EAwH/BwYC/wEAAP8LCwv/AAEE/wABBf8AAgX/AgcK/wAB BP8AAQT/AAEE/wABAv8AAAL/AAED/wAAAv8AAAD/AwMD/wMDA/8AAAD/BAQE/wEABP8MCg// AQAC/wEAAP8BAAD/BQQA/wUEAP8SEQz/BgUA/wUEAP8AAQD/AAEA/wEBAP8CAgL/AAAC/wAA Av8AAQD/AAEA/wEBAP8AAQD/AQAA/wEBAP8BAQD/AQEA/wEBAP8BAQD/AAEA/wACAP8AAgD/ AAMA/wADAP8AAwD/AAIA/wACAP8AAQD/AAEA/wABAP8AAgD/AAIA/wACAP8KDQT/AgUA/wAD AP8CBQD/AAIA/wACAP8AAgD/BAUA/wMAAP8IAwf/BAAA/woGB/8MBgb/AwAA/wkGAf8DAAD/ EA0G/wsIAP8HAwD/CgYA/wQAAP8EAQD/BwMA/wQAAP8EAAD/AwAA/wcDAP8HBAD/BwIA/wMA AP8EAAD/AwAA/wQAAP8FAgD/BAAA/wMAAP8JBQD/BQIA/wQAAP8GAwD/AwAA/wMAAP8DAAD/ AwAA/wMAAP8DAAD/AwAA/wMAAP8DAAD/AwAA/wUBAP8HAwD/AwAA/wMAAP8IBAH/AgEA/wAB AP8GCQD/BgcB/wYIA/8AAAD/AAIB/yMiJ/85OD3/KSgu/ykoLf8pKC3/KSkr/ygoKP8oKCj/ Jycl/ycnJf8fHx//S0tL/9fc2P8AAwD/JScm/yAiIf8mJyn/JSYq/yYlK/8iISf/JCMp/yEg Jv9APUT/JyQr/wEABP8CAAX/AwAE/wIABf8AAAL/AwMD/wAAAv8AAAD/AQAC/wEAAP8BAAL/ AQAA/wMAAv8IBAX/DQcL/wUAAf8NBwv/BgAC/wQAAv8EAAL/AQAC/wAAAv8BAQP/AAAC/wAA AP8AAAD/AQEB/wcHB/8AAAD/AQEB/wUFB/8DAwX/AAAE/wAABf8AAAX/BAMI/wAAAP8AAQD/ AAEA/wABAP8AAAD/AAAA/wEAAP8BAAD/AQAA/wEAAv8BAAL/AgAD/wQABf8CAAX/BQAH/wMB Bv8DAwX/AAEA/wABAP8AAQD/AAEA/wABAP8AAQD/AAEA/wABAP8AAQD/AAEA/wABAP8AAQD/ AAEA/wABAP8AAQD/AQEB/wIAAf8CAAH/AgAB/wIAAf8CAAH/AgAB/wIAAf8BAAD/AQAA/wIA Af8BAAD/AQAA/wEAAP8BAAD/AQAA/wAAAP8AAAD/BQUF/wAAAP8AAAD/AwMD/wAAAP8AAAD/ AAAA/wQEBP8AAAD/AAAA/wAAAP8AAAD/CwsL/wMDAf8IBwX/CAcD/wcGAv8FBAD/AwIA/wEA AP8BAAD/AQAA/wMCAP8BAAD/BAMA/wEAAP8BAAD/CwoG/wEAAP8AAAD/AQUG/wAEB/8AAQT/ AAEE/wABBP8AAQT/AAIF/wIGCf8CAwX/AAAC/wAAAv8HCAr/AgQD/wABAP8BAwL/AAED/wAA BP8AAAT/BAQG/wAAAv8KCgz/CQkJ/wQEBP8AAQD/AAAC/wAAAv88PUL/iIuS/4SHkP94eob/ g4WS/31/i/+Pk5b/goaF/3p+ff+ChIP/i42K/4uNiv+DhYD/fH55/4aIg/+GiIP/hoiD/4SJ g/+DiYX/g4mF/4GKh/+DiYX/homC/4aJgP+GiYL/homC/4SJgv+EiYP/g4qD/4OKg/94fnr/ ipGK/4eOh/97gnv/dnt1/32CfP9MTkn/AAEA/wEAAv8JBwz/BAIH/wMAAP8DAAD/BQIA/wMA AP8RDwP/AwEA/xMQAP8/PCn/fXhk/5WQev+QjHP/k492/4uHbv+WlXn/jo9w/4mIav+IiGz/ j45y/5OTef+Vk3r/kpJ4/5iWff+MjHL/i4lw/4yMcP+Lim7/jo9w/4+OcP+GhWn/jox1/4mH cv+Rjnv/iohz/4+Mef+OjHf/jot4/4+NeP9+e2j/kpB7/56biP+TkXz/kI16/5KQe/9dWkf/ CAcA/wACAP8BBAD/AAIA/wABAP8AAQD/AQIE/xMUGP81Njv/KSgu/ykoLv8pKC7/KCcs/ygo Kv8oKCj/Jycl/ycnJf8gICD/TExM/9fb2v8AAQD/JScm/yAiIf8lJij/JSYo/yUkKf8iISb/ JCMo/yEgJv9APUT/JyQr/wEABf8CAAb/AwAF/wIABf8AAAT/AAAC/wAABP8AAAL/AgEG/wYG CP8CAQb/AQED/wEABP8BAAL/CQQK/wMAAv8NCA7/AwAC/wMABP8FAAT/CAYJ/wAAAv8AAAL/ BQUH/wMDBf8AAAL/AAAC/wEBA/8AAAL/AQED/wICBP8EBAb/BQUH/wQDCP8BAAX/AAAC/wAA AP8AAQD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAL/AQED/wIAA/8BAQP/ AwEG/wIBBv8AAAL/AAEA/wABAP8EBgX/AAEA/wABAP8EBgX/AAEA/wABAP8AAQD/AAEA/wAB AP8AAQD/AAEA/wABAP8AAQD/AQEB/wEBAf8BAQH/AQEB/wEBAf8BAQH/AQEB/wEBAf8AAAD/ AwMD/wEBAf8BAQH/AgIC/wMDA/8BAQH/AwMD/wAAAP8AAAD/BQUF/wAAAP8AAAD/BQUF/wEB Af8AAAD/AAAA/wAAAP8AAAD/AAAA/wICAv8AAAD/AAAA/wAAAP8BAAD/AQAA/wMCAP8BAAD/ AQAA/wEAAP8BAAD/BQQA/wsKBv8BAAD/CQgE/wQDAP8BAAD/AQAA/wEAAP8AAAD/AAAC/wAD BP8BBQb/BAgJ/wgMDf8DBwj/AAEC/wABAv8CBgf/AAEC/wMHCP8AAQL/AAEC/wMHCP8QFBX/ AAAC/wUFB/8AAAL/BQYI/wAAAv8EBQf/AAEF/wAABP8AAAX/ZmZu/7m7x//2+P//5un8/87Q 5//c3fn/5+j//9rc9f/V2On/2d3p/97i7v/f4e7/3N7r/9vd6v/f4e7/5ef0/9rc6f/a3On/ 2tzp/9nd6f/Z3en/2d3p/9fd6f/Z3ej/297n/9ve5f/b3uf/2t7p/9jf6f/Y3ur/19/q/9ff 6v/a4u//3+fy/9fd6f/a4ev/5ur1/+Xp8v/f4uv/q6uz/1dXX/8AAAf/DAsQ/wEAAP8BAAD/ AQEA/xIQA/8EAwD/MC4X/5iUef/m48T///3a//r20f/3883////c////2P/5+cX//P/G//// zP///8/////R////zf/8/Mr/9/nH////z//198X////P////0f/8/Mb//f/H////zf/6+sT/ ///T//v6yv///9b/+/rK////1f///9H//v3P////0P///9L////Q///+0P/7+sr////R//// 1P/z8sT/x8ig/2lrU/8AAgD/DxEG/wABAP8AAQD/BgYG/xQTGP8sKzH/KSgw/ykoLv8nKC3/ Jygs/ycoKv8mKCf/Jigl/yYoJf8gICD/TExM/9ba2f8AAQD/JCYl/x8hIP8lJij/JCUn/yUl J/8iIiT/JCMo/yEgJf9APkP/JyUq/wEABf8CAAb/AwAF/wIABf8REBX/AAAE/wABBf8AAAT/ BwYL/wcGC/8AAAT/AAAE/wQCB/8BAAT/AwAE/wMABP8LBgz/CQQK/wkECv8GBAf/AAAC/wAA AP8AAAL/AAAC/wAAAv8AAAL/AAAC/wEBA/8AAAL/AAAC/wAAAv8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAL/AQED/wEB A/8BAQP/AgIE/wICBP8DBQT/AAEA/wIEA/8KDAv/AAIB/wABAP8ICgn/AAEA/wABAP8AAQD/ AAEA/wABAP8AAQD/AAEA/wABAP8AAQD/AQEB/wEBAf8BAQH/AQEB/wEBAf8BAQH/AQEB/wEB Af8DAwP/AAAA/wAAAP8AAAD/BwcH/wAAAP8AAAD/AgIC/wUFBf8BAQH/BQUF/wQEBP8AAAD/ AwMD/wMDA/8AAAD/AAAA/wAAAP8AAAD/CwsL/w8PD/8DAwP/AAAA/wUFBf8JCQf/CAkE/wgH A/8FBgH/BAMA/wIDAP8BAAD/AAEA/wYFAf8AAQD/AQAA/woLBv8CAQD/AAEA/wcGAv8HBwX/ AAEA/wABAP8AAQD/AAMC/wAAAv8AAQD/AAID/wABAP8AAwT/AQUG/wAEBf8AAQL/AAEC/wAB Av8FCQr/AAEC/wUFBf8AAAD/AAEA/wcICv8AAAT/AAAF/wAAB/9PUV3/7O79/9PV6v+LjKj/ REdm/zEzWf8wMlv/KSpW/yYoUf8mKUz/Ki1O/ykpS/8iIkT/JiZI/ywvUP8rK03/HiFE/y0t Uf8tLVH/LS1R/y0tUf8tLVH/LS1R/y0tUf8tLU//MDFQ/zAxUP8uMVL/LjFS/y0xVP8sMlT/ LDJW/yoyVv8iKk7/LjRY/y0zVf8tMlL/JilI/y4vTf+bm7f/0tLq/+Di8f9QUFr/AAAF/wsL Df8AAQD/AQEA/wMCAP8EAwD/raqJ//LuyP///9f/9vLD//TuvP/69MD///jC//Drsf/w8av/ 8PSn//T2q//0+K7/9vex//b5tP/3+LT/9vm2//3+vP/z9rH/8vOv/+3wqf/n6aD/6u6i//L0 qf/x86j/+Piy/+rppv///rv/6+qn//f2s//29bL/8fCt//b1sv/39rP/6umm/+nopf/y8a7/ 8/Kv//DvrP/5+LX////N/+ztzf9TVEL/BQYA/wEDAP8KCQT/BQUD/xcWG/8rKjD/KCcv/ygn L/8nJy//Jygt/yYnK/8mJyn/JScm/yUnJP8gICD/TExM/9ba2/8AAQL/JCUn/x8gIv8kJiX/ JCYl/yQkJP8hISH/JCQm/yEhI/9APkH/JyUo/wEABP8CAAX/AwAE/wIABf8AAAT/AgYH/wQI Cf8ABAX/BwgK/wIDBf8AAAL/AQIE/wwMDv8BAQP/AQAC/wEAAv8BAAL/AQAC/wYEB/8BAAL/ AAAA/wgIBv8NDQ3/AAAA/wAAAP8CAgL/BwcH/wAAAP8FBQX/CAgI/wgICP8DAwH/AAAA/wAA AP8GBwL/Dg4M/wEAAP8BAAD/AQAA/wEAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAQD/ AAIB/wACAf8AAgH/AQMC/wEDAv8DBQT/AwUE/wABAP8GCAf/AAEA/wABAP8EBgX/AAEA/wAB AP8AAQD/AAEA/wABAP8AAQD/AAEA/wABAP8AAQD/AQEB/wEBAf8BAQH/AQEB/wEBAf8BAQH/ AQEB/wEBAf8KCgr/AgIC/wsLC/8AAAD/CwsL/wAAAP8DAwP/AAAA/wYGBv8DAwP/AAAA/wQE BP8CAgL/AAAA/wAAAP8AAAD/AAAA/wAAAP8DAwP/AAAA/wAAAP8ICAj/AAAA/wgICP8EBAL/ AAIA/wAAAP8AAQD/AwMB/wMFAv8BAQD/AAEA/wEBAP8AAQD/AAAA/wEDAP8BAQD/AAEA/wAA AP8AAQD/CQkH/wABAP8HBwX/DA4L/wAAAP8CBAH/DA4N/wABAP8KDAv/CgwL/wMFBP8EBgX/ CAwL/wABAP8AAQD/AgYF/wICAP8FBQP/AAAA/wgICP8AAAT/AAAH/zo8SP/LzN7/urzT/1FS cf8eHkT/JSZU/yIiVv8mJ1//MDBs/yMjX/8pKGH/Kypj/yopYv8pKGL/Kypk/y0taf8uLWn/ Kytp/yclZP8nJWT/JyVk/yclZP8pJGT/KSRk/ykkZP8pJGT/KShk/ygoZP8nKWb/Jylm/yUp aP8kKWn/JClr/yQpa/8bIGD/Iydm/xweW/8jI1//MC9o/yYjWv86NWv/Eg86/8PD2//h4+// BAcO/wECBP8AAQD/CwwA/wUFAP98fFj///zR///9yv/r5q7/7uis//72t//68a7/+/Gs//nz qf/8+6n/8/eg/+/xnf/w9J//9ven//X4qf/w8aX/6eyf//Hypv/2+az/8fKk//P2pf///7L/ //+t//P2n//z9p//+Paj//Hsmv///Kr/9O+d//34pv/++af/+vWj//75p//28Z///fim//v2 pP/0753/9vGf//v2pP/486H/7uum//r40f/o6ND/Dw4A/wECAP8OCwL/BQQA/xEPEv83NDv/ KCcv/ygnL/8mJi7/Jics/yYnK/8lJij/Iycm/yUnJP8hISH/TU1N/9XZ2v8AAQL/IyQm/x4f If8kJiX/IyUk/yQkJP8hISH/JCQk/yEhIf9APj//JyUo/wEAAv8CAAP/AwAC/wIAA/+io6X/ yc3O/7S4uf+usrP/q6yu/6WmqP+dnqD/ra6w/7a2uP+2trj/x8XI/7Kws/8uLC//BgQH/wUD Bv8BAAD/BgYE/wkJB/8AAAD/AAAA/wgICP8EBAT/AAAA/wAAAP8BAQH/AAAA/wAAAP8AAQD/ BAUA/wQFAP8AAQD/AAEA/wEAAP8BAAL/AQAC/wEAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAQD/AAIB/wACAf8AAgD/AQMA/wEDAP8AAQD/AQMC/wABAP8AAQD/AAEA/wABAP8GCAf/ AQMC/wABAP8AAQD/AAEA/wABAP8AAQD/AAEA/wABAP8AAQD/AQEB/wEBAf8BAQH/AQEB/wEB Af8BAQH/AQEB/wEBAf8AAAD/AAAA/woKCv8AAAD/AgIC/wUFBf8SEhL/AQEB/wAAAP8BAQH/ AAAA/wAAAP8DAwP/AAAA/wAAAP8DAwP/AwMD/wAAAP8ODg7/BgYG/wAAAP8ICAj/AgIC/wAA AP8AAQD/BAYD/w4QDf8KDAn/AAIA/wABAP8GCAX/EhQR/wABAP8NDwz/BQcE/wABAP8AAQD/ AAEA/wkLCP8FBwT/BQYB/wABAP8AAQD/AAEA/wAAAP8AAAD/BQUD/wACAP8AAQD/BggF/wAB AP8AAQD/AAEA/wACAf8AAQD/AwUC/wMEAP8DBAD/AAEA/wAAAP8ICQ3/AAAH/4mLmP/u7/// JSZE/yAgRv8rLFz/MjFq/yQkYv8kI2f/Kyly/yYkbf83NHn/LCls/yckaf8sKW7/Kypw/yEf aP8dG2b/IB5p/ykmc/8pJnP/KiZz/yomc/8sJXX/LCVz/y0kdf8sJXP/Kid0/ykodP8nKXT/ Jil2/yYpeP8kKXr/JCl6/yQpev8gJXb/MDOC/y8xfP8sKnP/JCFo/yQdYf87MnX/JR5U/0hJ Zf/7////c3h+/wABAv8EBwD/BwgA/2ZnSP/7+dD/4+Ct//Xwtv/27q3/+/Or//nwpf/x5pf/ /O+g///4pf/49p//+fmh//n5of/29qD/8/Kg//Tzo//49qn//fuw/+ronf/29Kf/9vWl//Tz of/39qP/8PCY/+rqkv/y8Zf///yk///9o///+Z////qg//32nP/89Zv/+vOZ//rzmf/685n/ //6k///4nv/y65H/+PGX///8ov///KL//fet/+7rvv///+b/oqCJ/wgFAP8EAAD/DQoF/xgU Ff83NDv/KCUu/yclMP8mJi7/Jics/yUmK/8jJyj/Iycm/yInI/8gIiH/TU1N/9XZ3P8AAQT/ IyQm/x4fIf8kJiX/IyUk/yQkIv8gIB7/JCQi/yEhH/9APz3/JyUm/wEAAP8CAAH/AwAA/wIA Af/Hy8r/7fPx/5SYl/9+goH/e39+/4GFhP92eHf/f4GA/4WHhv+Vl5b/4ODg//n5+f84Njf/ AQAA/wEAAP8IBgf/AQAA/w0MCP8BAAD/AQAA/wkIBv8EAwH/AQAA/wUEAv8HBgT/BQQA/wIB AP8BAAD/AQAA/wMDAP8FBQD/BgUA/wEAAP8BAAT/AQAE/wEAAv8AAAL/AAAC/wAAAP8AAAD/ AAEA/wABAP8AAQD/AAIA/wADAP8AAwD/AAQA/wEDAP8EBgP/FRUT/wAAAP8AAAD/AwMB/wAA AP8ICAb/DAwK/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AQEB/wEBAf8BAQH/ AQEB/wEBAf8BAQH/AQEB/wEBAf8HBwf/AAAA/wAAAP8QEBD/AAAA/wAAAP8DAwP/AAAA/wAA AP8YGBj/AwMD/wAAAP8HBwf/BwcH/wQEBP8AAAD/CgoK/wAAAP8AAAD/CwsL/wAAAP8AAAD/ EhIS/wAAAP8BAwL/AAIB/wABAP8AAgH/AAQD/wEFBP8ABAP/AAMC/wABAP8ECAf/AAEA/wAB AP8HCwr/AAEA/wABAP8JCwj/AAEA/xQTDv8BAAD/AQAA/wwLB/8EBQD/AAEA/w8QC/8JCgX/ AAEA/wUHBP8PEQ7/AAEA/wABAP8BAwL/AAEA/wUGAP8BAgD/AAEA/wAAAP8DBAj/DAwW/8jK 2f+xscv/JydJ/zAvW/8oKF7/JyVk/y4sdf8hHm3/Gxls/zMwgf8bGF//HBpb/xoXWv8cGV7/ KShu/zg2f/82NH//Kid0/ysod/8rKHf/LCd3/ywnd/8uJnn/LyZ3/zElef8uJ3f/KCV0/yUn dP8kJ3b/Iid4/yEoeP8hKHn/ISh5/yEoef8oL4D/HyR1/yEjcP8wLnn/KSNr/ywlaf82K2// OTJo/yMkQv+do7H/5+v0/ygsK/8AAgD/BQcA/8rKqP///tH/6eSs//z3tf//+K////an///z n///+KD///uj/+/ki///+aX/+vem//bzpP/z8KP/8u6l//PvqP/38q7/+fSw//jzr//t6KT/ +vav///9s//z8KP/9/Sl//77qv/z7pz/9+2Y///6pP/v443///ii//frlf/57Zf//fGb//js lv/26pT//fGb//7ynP//9Z////ii//frlf/y5pD//fOr///7zf/k4cL////o/1ZRPf8GAAD/ DAcB/xwYGf8xLzT/KCUu/yclMP8mJi7/JSYr/yMmK/8jJyj/IiYl/yImJf8hIyL/Tk5O/9fY 3P8AAAT/IyQm/x4fIf8jJST/IyUk/yMjI/8gIB7/JCQi/yEiHf9APz3/JyYk/wEAAP8CAQD/ AQAA/wIBAP/ExsX/19va/0FFRP8oLCv/P0FA/2BiYf9XWVj/WFpZ/xcZGP8cHh3/iYmJ/+fn 5/8zMTL/AwEC/wEAAP8BAAD/BwYE/19eXP9ZWFb/CwoI/wEAAP8HBQb/AQAA/wEAAP80MzH/ Pz46/z08OP8jIh3/BwYB/wwMBP81NS3/Xl1Y/wEAAP8BAAL/AQAE/wEAAv8AAAL/AAAC/wAA AP8AAAD/AAEA/wABAP8AAQD/AAIA/wACAP8AAwD/AQMA/wEDAP8lJyT/Njg1/wsLCf8BAwD/ CgoI/wABAP8AAAD/BQcE/wAAAP8AAQD/AAAA/wABAP8AAAD/AAEA/wAAAP8AAAD/AQEB/wEB Af8BAQH/AQEB/wEBAf8BAQH/AQEB/wEBAf9AQED/EhIS/wgICP9DQ0P/BwcH/wICAv8AAAD/ CgoK/w0NDf9AQED/Hx8f/wAAAP8KCgr/DAwM/wAAAP8AAAD/T09P/ygoKP8AAAD/ODg4/yoq Kv8QEBD/aGho/2tra/8zNTT/CQ0M/wABAP8QFBP/T1FQ/2xwb/9WWFf/LDAv/3Fzcv9SVlX/ MjQz/1ldXP93eXj/Njo5/wUHBv8AAgD/AAEA/zw7N/87Ojb/QUA8/3Z1cf9IR0P/AAEA/xMU D/9QUE7/CAgG/zI0Mf98fnv/TlBN/wsNCv8DBQT/AQEA/wYHAv8FBgD/AAEA/wYHAv8BAQP/ Nzc///b3//94d5b/GxpG/xoZUv8tKm3/MC55/yQhcP80M4P/NzaG/xUVX/+AgMD/xMP9/9LR //9/frr/KSln/xcXV/8lJGb/KCdr/ygna/8oJ23/KSZt/ykmbf8rJW3/LCRt/ywkbf8rJW3/ JCNn/yEkZ/8gJWn/HiVr/x4la/8dJW3/HSVu/x0lbv8gJnD/ICRu/ygqdP82NH3/JCFm/zAp bf8rImX/MChj/yUlS/86PFX/8fP//2prb/8AAgD/OTkf//PxyP/v7rb/9vOw//fxpf/48p7/ //mg//rvlf/67ZH///2i///3nv/585v/8OyV//Hsmv///K3///+3/+Hdlv+ZlFL/XVgY/2Nf IP9VURL/nZla/+7qqv/9+rf///+8/+Pjm/+OjEL/0cmA/+zjmP/OxXj/9+6f/+7jk//47Zv/ //un///2oP/+8pz///ee//vwl//88Zj///ui///1nP/16pH/+O+g//35vP/08sL/9fHM/7Cq kP8JAwD/BgAA/xMND/83Mjn/KCUs/ycmLP8mJSr/JSYo/yMnKP8iJif/ISYp/yImJ/8hIiT/ Tk5O/9nY3f8AAAT/JCQm/x4eIP8jIyX/IiIi/yEhIf8dHRv/ICAe/x4eHP88PTj/JCUg/wAB AP8CAwD/AAEA/wMEAP/Hx8X/qKqp/zk7Ov82ODf/hoaG/7W1tf+QkJD/eHh4/56env9ERET/ DQ0N/8bGxv87Ozv/AAAA/wYGBv8BAQH/paWn/+bl6v/08/j/n56j/wEBA/9sbG7/a2tt/wwM DP+enpz/iouG/6Okn/+HiIL/AAEA/y4vKf/e39n/qaqk/zIyMv9LS0v/VVVX/xAQEP9wcHD/ QEBA/wAAAP9MTEz/U1NT/05OTv9SUlL/UVFR/wAAAP8AAgD/AAAA/wcJCP86PDv/w8fG/wAB AP9FSUj/YmRj/zE1NP8nKSj/VlpZ/0hKSf8hJST/cnRz/zo+Pf8PERD/am5t/1pcW/89Pz7/ ZmZm/x4eHv9BQUH/Nzc3/ysrK/9NTU3/CAgI/w0NDf/FxcX/LS0t/zMzM//U1NT/FxcX/11d Xf8BAQH/WFhY/xMTE/92dnb/EBAQ/wAAAP8AAAD/BAQE/wkJCf+CgoL//////0pKSv+Ghob/ 8vLy/1VVVf9SUlL/4eHh/6Wlpf9JSUn/CgwL/wEBAf83OTj/7u7u/5GTkv9eXl7/r7Gw/7+/ v/+Fh4b/VFRU/+Lk4/+enp7/VlhX/wAAAP8BAQH/hISC//r6+P9nZ2X/4+Ph/7q6uP/y8vD/ U1NR/97e3P/h4eH/AAAA/+fn5/+8vLz/8vLy/ygoKP8AAAD/AgIC/wEAAP8GBQP/AQAA/wgJ A/8AAQD/goOH/+jp/f89O2L/Kydi/yomcv8oJHn/JyR7/yknev8rLXf/LzNy/zM4b//m6P// UFGB/2Rllf/5+v//T1CA/2pqnP9dXY//bW2f/yUlV/8uLmL/YWGV/2RkmP8nJ1v/KSZb/zMw Zf9/f7H/TE98/xwgTf9WXYv/bnSk/3V7rf9CSHz/NTpx/3uAuP9MUI3/IiZl/yora/8sLW7/ HRxe/ysqbP8zMHP/JSBg/zcvaP8TCzr/0s3t/8K+zP8DAAD/kI9w//j3wf/8/LT/9fOe//f0 lf/49JH/+/OR//zyk//+8ZX//vCY//zxl//384//8vOL//f3k//z9Jf/+Pek////uv9paSP/ trZ2/+nqrv/LzpX/6eyz/8zRl//c4qb/7fW5/8bPkP+qsHT/3N+o/5qZY/9QUBT/19aW//j1 rv/07qL///yr//nxnP/685n//POW//zzlv/885T//POW//zzlv/685j/+fSZ//HvmP/z9Kj/ ///I/9XRrP8IAgD/BgAA/xgRGf82MDr/KCYr/ycnJf8nKCL/JSgh/yMoJP8jJyj/ISYs/yIl LP8gISX/TU1N/9nY3f8AAAT/JCQm/x4eIP8jIyX/ISEj/yAgIP8dHR3/ICAg/x4eHP88PDr/ JCUg/wAAAP8CAwD/AAEA/wMEAP/IyMb/tra0/1paWv9CQkD/XFxc/xoaGP82Njb/JiYk/4eH h/9ycnD/Ly8v/8bGxP82Njb/AAAA/wAAAP8AAAD/7u3y/wAABf83Njz/aWht/0JBRv+hoKX/ 8fHz/5GRkf+Hh4f/k5OR/5KTjv+Bgn3/CgsG/zg5M//5+vT/rK2o/29vbf//////tbW1/+Xl 5f/CwsL/29vb/01NTf/Ozs7/6Ojo//j4+P/c3Nz/6enp/wkJCf8AAAD/EhIS/wEBAf85Ozr/ xMjH/z5CQf/p7ez/u7++/8LGxf+RlZT/+//+/66ysf/e4uH/x8vK/9/j4v9/g4L/8fX0/+ru 7f/u8O///////3Jycv+qqqr/ysrK/5SUlP/ExMT/AAAA/wwMDP+/v7//kpKS/3d3d//ExMT/ RERE/93d3f8CAgL/ysrK/0JCQv/V1dX/MDAw/wAAAP8AAAD/AAAA/1paWv+4uLj/ycnJ/01N Tf8oKCj/39/f/1ZWVv+JiYn/6urq/+jo6P9ycnL/AAAA/wAAAP+CgoL/5+fn/+rq6v9fX1// 8vLy/83Nzf/CwsL/e3t7/+rq6v/X19f/i4uL/wMDA/8BAQH/Pj4+/83Nzf94eHj/VlZW/0lJ Sf/X19f/MzMz/4yMjP/Gxsb/AwMD/1JSUv9VVVX/4ODg/wkJCf8NDQ3/CgoM/wYBB/8FAAT/ BgUB/wEBAP8AAQD/fn+B/+Ph9v86OWH/JiFj/y4pe/8pJID/IBx6/ycleP8pLHP/HSJa/xAW Rv/Mz/z/+Pn//4GCsP8oKVX/a2ya//n6///Awe//5uf//4iJt/+xst7/1NX//+Xm//+Mjbv/ LS5a/+bn//+8ven/7vL//19lif+qr9X/q7DY/+Xq//9ydqP/2t7//7q98P/Ex/7/S02I/x8h Xv8xMnL/MjN0/zEydf8rK3H/IR5j/zgvcv8PBD7/wrfh/7mxxv8EAAD/cm9Q////z//o6J7/ 9fOc//f0k//49JD/+fSQ//vylf/88Zj//u+c//vxmv///5z//v+Z////n//09Jr/8/Ki//n5 sf9bWx3/kZJZ/7K0gv+hpHX/u8GT/9HZqv9kbD3/maNx/4+ZZ/9veUf/u8GV/4WIW/9OUB7/ mpti//Pysf///7v/5N+O//v1n//685n/+vSW//zzlP/885T/+vSW//rzmP/59Jn/+PWY//// of/2+aD/6+qq//761P8gGgz/FAsO/xUNGP85Mz3/KCYp/ycoI/8mKB3/JSgd/yMoIv8iJif/ ISUw/yIkMP8gISX/TU1N/9nZ2/8AAAL/IyMl/x4eIP8jIyX/ISEj/yAgIv8cHBz/ICAg/x4e Hv88PDz/JCQi/wAAAP8CAgD/AAAA/wMDAf+ysrD/+Pn0/8DAvv+TlI//YGBe/z9AO/9kZGL/ X2Bb/wsLCf+ur6r/2dnX//X28f8wMC7/BAUA/wAAAP8AAAD/5+br/wAABf8tLDH/QD9E/wQD CP+jo6X/29vd/3R0dP99fX3/lZWT/46OjP+Bgn3/AAEA/wABAP+ys63/KCkk/3Fxb/+xsbH/ AAAA/9fX1/8PDw//wMDA/1FRUf/Gxsb/T09P/6ysrP9AQED/4eHh/xMTE/8AAAD/VlZW/x8f H/81Nzb/yMrJ/19hYP/+////0dPS/77Av/+kpqX/jI6N/yEjIv/z9fT/vb++/9nb2v9zdXT/ ury7/2psa/+ytLP/fn5+/3V1df9NTU3/1dXV/8rKyv9ZWVn/DQ0N/wAAAP/c3Nz/s7Oz/62t rf/19fX/JSUl/8zMzP8AAAD/ysrK/zo6Ov/o6Oj/Kysr/wAAAP8LCwv/BwcH/7S0tP/Nzc3/ 8fHx/66urv8DAwP/xcXF/1hYWP82Njb/EhIS/01NTf+/v7//1tbW//Ly8v9NTU3/HBwc/1RU VP/m5ub/TExM/wgICP/k5OT/dXV1/xUVFf9TU1P/zMzM/7m5uf/39/f/IyMj/7u7u/9jY2P/ cnJy/97e3v85OTn/FBQU/3R0dP/Kysr/AAAA/4ODg//c3Nz/ODg4/wAAAP8GBgb/BAQG/wcC Cf8DAAT/BQQC/wEAAP8CAwD/g4WE/97d7f8zM1f/Kydi/zczf/8uKoH/Ih94/yknev8rLXf/ KCxp/y0wZf8OEEP/YmKU/8HB9f/t7f//aWmd/7y87v8HBzv/d3ep/5KSxv/BwfP/Kytf/0VF d//k5P//Tk6A/8/P//8GBjj/g4W1/6ir2P8ICjr/qqzd/6Kk1f8/QXT/9fb//9HS///d3f// Xl6e/ygnaf8rKm7/JSRq/y8udP81M3z/LSpx/yYcYf8WC0f/tqrY/87F4P8EAAL/f3pm///8 0f/z8bT/9fGn//fynv/48pr/+fKY//vxmv/78Zz//O+g//vwof/+96b//Pqn//r3qv/u66T/ +va5////z/9wbj7/fnxV/319Wf+Wl3f/pqeH/+ruzf+fo4L/SE4q////4f9hZ0H/vsOa/8nM nf+GiFb/6+yy//j3t//n5J3//fep//74pP/685v//PKZ//zzmP/885j/+vOZ//rzm//68p3/ +fOd////pf/4+an/+Pa7//r20/8kHRP/DQQJ/xoSH/8wKjb/KCYr/yYnIv8mKB3/JSgd/yIn If8iJif/ISUu/yIlLv8gISX/TU1N/9jY2v8AAAL/IyMl/x0dH/8iIiT/ISEj/yAgIv8cHB7/ ICAi/x4eIP88PD7/JCQm/wAAAv8CAgT/AAAC/wMDA/++vrz////7/8PEv/9GR0L/FhcS/1ZX Uv9mZ2L/cHFs/wABAP99fnn////7//Lz7v80NTD/AAEA/wABAP8CAgD/v77D/8/O1P/t7PH/ wsHG/3t7ff/7+/3/2Nja/7e3t/+Pj4//ioqI/5CQjv+Li4n/AAEA/wECAP/LzMb/PD04/4GB f/+wsLD/BwcH/+/v7/+0tLT//////11dXf/Ly8v/QUFB/9XV1f9MTEz/2tra/ysrK/8CAgL/ o6Oj//r6+v+1t7b/vsC//z0/Pv/k5uX/l5mY/3Z4d/+PkZD/oqSj/ystLP/Z29r/ubu6/4yO jf9vcXD/wMLB/1xeXf+srq3/pqam/5OTk/8AAAD/8fHx//X19f8aGhr/AAAA/xUVFf/Dw8P/ MjIy/x0dHf/Gxsb/LS0t//j4+P+6urr/9vb2/z09Pf/i4uL/Hh4e/4yMjP8GBgb/AAAA/xIS Ev8TExP/19fX/01NTf8LCwv/zs7O/15eXv+Hh4f/7u7u//Pz8/+EhIT/AAAA/wYGBv95eXn/ +fn5/+np6f+CgoL/6enp//Dw8P/Hx8f/iYmJ/+3t7f/v7+//fHx8/wAAAP8ICAj/AAAA/9fX 1/9mZmb//////9TU1P/Hx8f/EBAQ/3Fxcf/Z2dn/R0dH//f39//W1tb/vLy8/zs7O/8AAAD/ AAAC/wUCC/8DAAX/AQAA/wEAAP8CAwD/f4F+/+bm8v88O1r/IB5Q/yonbP8sJ3n/LyuA/zk2 h/8uLnj/IiNj/ykrZP/c2///eHiu/wwLRP/Z2f//c3Kr/8nJ//8FBD3/i4vB/5KRyv/S0v// ZGOc/42Nw//c2///Ly9l/+rp//88PHL/pqba/6ut4P+bnNL/tbbs/xARR/8vMGj/4uP//0VF gf97e7n/MTFx/ycmaP8xMHT/ISBm/yQjaf8qKHH/JiBm/ywjZP8TCED/0cbx/7uyzf8PCA// gX5v//Twzf/39MH/9fGx//byqP/486L/+fOf//ryn//88Z///PGh//zxov//+7D/6eKa/+7p pf//+bv/9u+5/9vUpv99eFD/wb2a//Xy0//b2rz/8fDU/+jpyv9rbE3/R0sq/8jMq/98gVn/ w8aX/8LFkP9tbjX/+fm7/+7rpv/7963/9fCf//Tumv/88pv//PKZ//zzmP/88pn/+vOb//ry nf/68p3/+POf//TzoP/v8aj/+vjF/9HOr/8NBgD/BAAE/xQOGv8zLTn/JyUq/yYmJP8lKB// JCce/yInIf8iJif/ICQt/yEkLf8gISX/TU1N/9jY2P8AAAD/IiIk/x0dH/8iIiT/ICAi/x8e I/8cGyD/IB8k/x4dIv88O0D/JCMo/wAABP8CAQb/AAAE/wMDBf/Dw8H/7O3n/5iZk/8AAQD/ ExQO/ycoIv8eHxn/FBUP/w8QCv87PDb/+Pnz/+/w6v8xMiz/BwgC/w4PCf8ICQT/DAwO/4GA hf99fIH/AgEG/xAQEv9vb3H/bm5u/1ZWVv9aWlr/SkpK/1JSUP9KSkj/AAEA/wABAP9xcm3/ FBUQ/zg4Nv9UVFT/AAAA/zExMf+UlJT/XFxc/wAAAP9aWlr/LS0t/2JiYv8sLCz/YWFh/xsb G/8EBAT/CAgI/2tra/+Vl5b/CAoJ/wYIB/9WWFf/hoiH/1FTUv9HSUj/SkxL/wABAP9FR0b/ k5WU/2FjYv8vMTD/XF5d/zg6Of9RU1L/SUlJ/z8/P/8EBAT/tLS0/9nZ2f8UFBT/AQEB/wAA AP9paWn/Li4u/xgYGP9paWn/AAAA/2BgYP9/f3//eXl5/xkZGf9qamr/EBAQ/8rKyv8oKCj/ Dw8P/wAAAP8HBwf/CgoK/wgICP8AAAD/Hx8f/wICAv8AAAD/ISEh/ygoKP8AAAD/DQ0N/wAA AP8BAQH/LCws/yIiIv8AAAD/AAAA/0JCQv8YGBj/AAAA/y8vL/8eHh7/ERER/wAAAP8AAAD/ AgIC/wEBAf8VFRX/FxcX/ycnJ/8pKSn/AAAA/xUVFf8iIiL/AgIC/yMjI/8hISH/ISEh/wYG Bv8AAAD/FBMY/wgFEP8BAAf/AQAC/wYFAf8AAQD/TlBL//Dw+P9qa4D/LCtV/y8uaP8nI23/ JCFw/zAtfP8vL3n/IyRn/x8hXv9paKL/19T//9PP//+uq+T/Z2Oe/7Gu5/8QDEf/fXqz/42J xP9pZp//1tL//8TB+v9jX5r/LSpj/5GNyP+9vPX/1NP//y8vZf+6ufL/19b//8zL//9gX5n/ mZjU/+bl//+5t/b/TUuM/x0bXP8lImX/Kyhr/zEucf8vLG//LSho/y4nXf8+N2H/9/D//1pS Z/8EAAL/REA0////4//x7cD/9fC4//bxrf/48qb/+fKh//nzn//68p3/+vKd//ryn//w6Zv/ +/Ss//32sv/s56f/+PK4//74xP+FgVL/SEUa/1dTLf8wLgj/iYdh/7W1j/+Wl2//5ei9/42Q Zf96fkz/usCE/+fsqv9NUAv/1deO//f1qP/w7pv//fmi//jzmP/885j//POW//zzlv/885b/ +vOY//rzmf/585v/+POh/+/vpf/t77D/9PPH/6ejiv8GAAD/DgcP/w4IFv8/OUX/JyUq/yYm JP8kJyD/JCce/yEmIP8hJSb/ICUr/yEkK/8gISP/TU1N/9fX1/8AAAD/IiIk/xwcHv8hISP/ ICAi/x8eI/8bGh//IB8k/x4dIv88O0H/JCMp/wAABf8CAQf/AAAH/wMCB//IyMb/+fr1/3t8 d/8EBQD/AQIA/wABAP8AAQD/AAEA/wABAP8rLCf/8vPu//X28f8UFRD/AAEA/wIDAP8KCgj/ AAAC/wIBBv8FBAn/AgIE/wwMDv8AAAL/BQUF/wMDA/8AAAD/AAAA/wICAP8BAQD/CwsJ/wAB AP8PEAv/AAAA/wUFBf8AAAD/CQkJ/wAAAP8FBQX/AAAA/wAAAP8AAAD/AgIC/wAAAP8AAAD/ AwMD/wAAAP8CAgL/AAAA/xEREf8EBgX/AAEA/wMFBP8MDg3/AAEA/wkLCv8AAQD/BggH/wMF BP8AAQD/DQ8O/wYIB/8AAQD/AwUE/wUHBv8AAQD/AAAA/w8PD/8AAAD/ycnJ/2xsbP8AAAD/ AAAA/wkJCf8AAAD/AAAA/wAAAP8GBgb/AAAA/wMDA/8GBgb/AAAA/wAAAP8AAAD/AAAA/zc3 N/8JCQn/AAAA/w4ODv8JCQn/AAAA/xISEv8RERH/AAAA/wAAAP8AAAD/AAAA/wAAAP8JCQn/ CQkJ/wAAAP8AAAD/AQEB/wICAv8AAAD/CwsL/wAAAP8EBAT/AAAA/wEBAf8NDQ3/AAAA/wAA AP8PDw//Dg4O/w8PD/8AAAD/DQ0N/wAAAP8KCgr/ExMT/wAAAP8BAQH/FhYW/wAAAP8AAAD/ DQ0N/wgICP8AAAD/AAAE/wsIE/8BAAn/DQsO/wEAAP8AAQD/Dg8J/9fY3P+srr3/IiFD/y8t X/8yLW3/IyBn/yAcZv8vLXb/NzZ6/y8ucP8jIWL/MSxu/yUgYv8nImT/Mi1v/ygjZf8qJWf/ MCtt/zQvcf8jHmD/GBNV/zQvcf8hHF7/HRha/ykkZv81MHL/GBZX/x8dXv8uLG3/Kylq/ywq a/8hH2D/GBVY/y0qbf8pJmn/Hxxh/zMwdf85Nnv/LSpv/yckaf8qJ2z/PDhz/w0IMf+9udT/ 3tnv/w0KFf8DAAD/Eg8A/9HNsP///9r/9PG6//bysv/386n/+fSj//n1nv/69Zr/+vWZ//r1 mv/69aH/6uWU//Lsnv/++K7///q2//jytP/g26H/8/C5/+/st//t7Lb/8vG7/+Tkrv/q67L/ 5Oit/9/jqP/k6an/8Pau//D0qP/j5pn/5eaW/+3tl////6v/6+aK////pv/69JT//POU//zz lP/69Jb/+vOY//n0mf/585v/9vOi/+vsqv///83////f/1pXRP8HAgD/AwAF/x8ZJ/8zMDv/ JSQq/yUlJf8kJiH/IyYf/yEmIv8hJSb/HyQo/yAjKP8gISP/TU1N/9fX1/8AAAD/IiIi/xwc HP8hISP/Hx8h/x4dIv8bGh//IB8l/x4dI/88O0P/JCMr/wAAB/8CAQn/AAAJ/wMCCP+/v8H/ ///9/9bW1P++vrz/q6up/7i4tv+7u7n/wMC+/7+/vf+xsa//9fXz//n59/9EREL/AAAA/wAA AP8KCgr/CAgK/wUFB/8AAAL/CAgK/wAAAv8AAAD/Dg4O/wAAAP8JCQn/BgYG/wAAAP8AAAD/ BQUD/wEBAP8AAAD/AwMB/wAAAP8GBgb/BQUF/wcHB/8AAAD/CgoK/wUFBf8AAAD/BwcH/wkJ Cf8AAAD/AgIC/wQEBP8AAAD/Dw8P/wAAAP8AAAD/DAwM/wcHB/8AAAD/AAAA/wAAAP8DAwP/ AAAA/wEBAf8ICAj/AAAA/wICAv8BAQH/AAAA/wQEBP8UFBT/AAAA/wAAAP8ODg7/JSUl/wAA AP8CAgL/BwcH/wICAv8MDAz/AAAA/wkJCf8AAAD/AgIC/wAAAP8AAAD/BAQE/wAAAP8GBgb/ AAAA/wEBAf8AAAD/Dg4O/wYGBv8AAAD/Dw8P/wAAAP8AAAD/CQkJ/wAAAP8FBQX/CQkJ/wAA AP8AAAD/AAAA/wkJCf8AAAD/AAAA/wAAAP8AAAD/DQ0N/xUVFf8AAAD/AgIC/wAAAP8AAAD/ BwcH/xAQEP8AAAD/AQEB/wEBAf8AAAD/AQEB/wYGBv8AAAD/AAAA/w0NDf8AAAD/AgIC/wMD A/8AAAD/AAAA/wkJCf8AAAD/CQgN/wgEEv8BAAv/CwoP/wAAAP8AAQD/AAEA/4+RkP/Z3OX/ MDBK/yYlTf8vLGH/MzJu/yckZ/8oJWj/LSpt/yMgZf80LXr/JyBw/zQtff8oIXH/Jh9v/y4n d/8uJ3f/Mit7/ykicv8zLHz/Lid3/zcwgP8mH2//OzSE/zUufv8jHGz/KyR0/z02hv8rJHT/ Lid3/yIba/81Ln7/JB1r/zcwfv8xKnj/Lyh2/ywlc/8jHGr/MSp4/zs0gv8lHmz/HxlX/0tI Zf/59///b21y/wMCAP8GAwD/CQYA/1tYOf/u68D/8/K8//Tzsv/29Kn/9/Wi//f2nP/59pf/ +feT//n3kv///Zn/8u+O/+/vj//u7ZH/8/Ga//n3pP/6+an/9PWn/+7vo//z9qn/7vGk//T5 qf/9/7D//P+t/+3ynv/v9KD/+/+s/+brl//9/6z/+fyj//Pzmf/+/aD//vmb/+jkg//69JL/ +vSS//r0lP/69Jb/+fSY//j0mf/49Jv/9fOm//Lxuf/399H/v76i/xIQA/8MCAf/AwAH/x8Z Jf8rKDP/JSQq/yUlJ/8jJSL/IyUg/yEmIv8gJCX/ICMo/yAjKP8gISP/TU1N/9fX1/8AAAD/ IiIi/xwcHP8hISP/Hx8h/x4dIv8bGh//IB8l/x4dI/88O0P/JCMr/wAAB/8CAQn/AAAJ/wMC Cv9RUFX/Tk5Q/2ZmaP9WVlj/ZGRm/19fYf9YWFr/YWFj/11dX/9eXmD/VFRW/0tLTf8gICL/ AAAC/wwMDv8CAgT/AgIE/w4ODv8AAAL/AAAA/wsLC/8FBQX/AAAA/wEBAf8EBAT/AAAA/wkJ Cf8MDAz/AAAA/wAAAP8HBwf/BAQE/wkJCf8AAAD/AAAA/wAAAP8TExP/AAAA/wwMDP8AAAD/ AAAA/wkJCf8HBwf/BQUF/wMDA/8AAAD/AAAA/woKCv8HBwf/AAAA/wAAAP8AAAD/EhIS/xUV Ff8AAAD/Dw8P/wcHB/8AAAD/BAQE/wICAv8AAAD/CgoK/wgICP8AAAD/AAAA/wAAAP8EBAT/ AAAA/wUFBf8ICAj/AAAA/wUFBf8AAAD/BAQE/woKCv8ICAj/AAAA/wEBAf8ICAj/CwsL/wAA AP8LCwv/AAAA/wAAAP8JCQn/AAAA/wYGBv8TExP/AAAA/wkJCf8FBQX/AAAA/woKCv8AAAD/ AAAA/wgICP8BAQH/AAAA/wAAAP8QEBD/AAAA/wgICP8HBwf/AAAA/wEBAf8AAAD/AQEB/wAA AP8FBQX/AAAA/wAAAP8JCQn/AAAA/woKCv8AAAD/AAAA/wAAAP8CAgL/BQUF/wAAAP8NDQ3/ AAAA/wAAAP8FBQX/AgIC/wICAv8AAAD/AAAE/wEAC/8BAAv/AAAF/wUFBf8CAwD/AAEA/0pM Sf/n6O3/rK2//09Obf8gHUj/Kiha/yYjXP8gH1n/Kydk/yolZf81L3X/KCJq/yMdZf87NX3/ Lylx/yQeZv8uKHD/My11/zIsdP8uKHD/ODJ6/ygiav81L3f/MCpy/xMNVf8zLXX/MCpy/zMt df8kHmj/Lylx/zMtdf8oImr/LCZu/yokav8tJ23/Lihu/zArbv8sJ2r/Lils/yIdYP8kH2L/ VlKF/+Tj9f++vr7/AwIA/wUEAP8ODAD/AwIA/wsKAP+SkGr/8vHB//Pyuf/087D/9vSp//b1 ov/295r/9/eX//f3lf/8/Jr/+PiW//7+nv/7+p3/+vmf//r6ov///6z/6+2Z//j6p//t75z/ 7fGc/+/znv/z+aH/7vSa//3/qf/x95//7/Sg/+zxn//x9aH/8vai//v6p//+/Kf/6OSN///5 of/585v/+fOb//nznf/585//+POh//bzov/286T/8/Kv////1v/T1LX/GRgE/wMAAP8FAQL/ DgsS/wEACf85OED/JSQq/yUlJ/8jJSL/IyUi/yAkI/8gJCX/ICQn/yIjJ/8hISP/TU1N/9nZ 2/8FBQf/Gxsd/x4eIP8bGx3/HR0f/yAfJP8cGyD/KSgt/xMSF/8+PUP/KCct/wAABf8GBQv/ AAAH/wAABf8AAAX/AAAF/wAABf8AAAX/AAAF/wAABf8AAAX/AAAF/wAABf8AAAX/AAAF/wAA Bf8AAAX/AAAF/wAABf8AAAT/AQEB/wQEAv8FBQX/AgIC/wAAAP8AAAD/AAAA/wAAAP8CAgL/ AgIC/wICAv8BAQH/AQEB/wEBAf8AAAL/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wICAv8FBQX/CAgI/wcHB/8EBAT/AAAA/wAAAP8DAwP/AwMD/wICAv8BAQH/ AAAA/wAAAP8AAAD/AAAA/wAAAP8CAgL/BQUF/wUFBf8EBAT/AgIC/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAE/wAACf8AAAn/AAAE/wAAAP8AAQD/ AAEA/xocF/8/QEL/8PD6/+Hi9v+GhaT/RkRr/xYTQP8QDj//FhJF/x4aTf8ZFkX/GRZD/xkW Q/8ZFkP/GRZD/xkWQ/8ZFkP/GRZD/xgVQv8YFUL/GBVC/xgVQv8YFUL/GBVC/xgVQv8YFUL/ GRZD/xkWQ/8ZFkX/GRZD/xkWQ/8ZFkH/GRZB/xkWQf8XFT3/GhhA/xwaQf8YFj3/HRtA/0tJ bv+mpMn/9/f//7u7w/8QEA7/AQAA/wIBAP8BAQD/CAYA/wMCAP8LCgD/lpNy/+7rwP///9H/ 7uyv//LyrP/09an/7eyc//j3pP/19KH/9fSh//X0of/19KL/9fOm//P0qP/z9Kj/8/Op//b2 rP/196z/9fir//X4q//1+Kn/9fin//X4p//0+Kv/7/Kt/+3ysP/v8q//8PGv//Pwrf/0763/ 9O+r//bvq///+rb//PWx//fvrv/z7q7/8++w//Tzs//49rn/+vjF/8bGpP8lJxH/AQIA/wEB AP8IBgf/AAAE/xUUGv80Mzn/JCMo/yMkJv8jJST/IyUk/yMlJP8jJCb/IyQo/yMkKP8fHyH/ T09P/9jY2v8EBAb/Ghoc/x4eIP8bGx3/HR0f/yAgIv8cHB7/ISAl/xEQFf89PEH/JiUq/wAA BP8DAgf/AAAE/wAABP8CAQf/AgEH/wIBCf8CAQf/AgEJ/wIBB/8CAQn/AgEH/wEACP8BAAb/ AQAI/wEABv8BAAj/AQAG/wEACP8BAAX/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AQEB/wAA AP8CAgL/AQEB/wEBAf8BAQH/AAAC/wAAAv8AAAL/AAAC/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wEBAf8CAgL/AwMD/wMDA/8BAQH/AAAA/wAAAP8AAAD/AAAA/wAA AP8BAQH/AQEB/wEBAf8CAgL/AgIC/wMDA/8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AgIC/wICAv8CAgL/AQEB/wEBAf8AAAD/AAAA/wAAAP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQE BP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/ BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQE BP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/ BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQE/wQEBP8EBAT/BAQG/wQDC/8BAAj/AgEG/wMD A/8AAAD/AAEA/wABAP8KDAv/Fxgc/6+vuf/5+P//7e3//8zI6f/X1fr/2tX9/8LB4//Ly+P/ y8ze/8vM4P/LzN7/y8zg/8vM3v/LzOD/y8ze/8rL3//Ky93/ysvf/8rL3f/Ky9//ysvd/8rL 3//Ky9//y8zg/8vM4P/LzOH/y8zg/8vM4P/LzN7/y8ze/8vN3P/Hydj/3N7t/9DS3/+4usf/ 19nl//z+///X2eX/gICK/wsKD/8AAAL/BAID/wEAAP8BAAD/EA8K/wcEAP8HBQD/BQIA/5iU ef/9+tf////a////z//9/MT/9va6//7+wP///sP///7D///+w////sX///3G///+xv///cj/ //7I///+yP///sj///7G///+xv///sX///7F///+xf/+/8b//v/P//7/0//+/9H////R///+ z////s////3P///9z////9b///7T//73zf/69cv////Y////2v/599D/4OC+/ykrFf8AAwD/ BQUA/wABAP8AAAD/AAAA/xYWGP8qKS7/IyQo/yMkJv8jJCb/IyQm/yMkJv8jJCb/IyQo/yMk Jv8fHyH/T09P/9jX3P8EAwj/GRgd/x0cIf8aGhz/HBwe/x8fIf8bGxv/IyMl/xcXF/88PDz/ ICAg/wAAAP8FBQP/CgoI/w8PD/8CAQb/AgEG/wIBB/8CAQb/AgEH/wIBBv8CAQf/AgEG/wIB B/8CAQb/AgEH/wIBBv8CAQf/AgEG/wIBB/8CAgT/AAAA/wECAP8ICQT/AAEA/wMDAf8CAgD/ CQkJ/wAAAP8CAgL/AgIC/wICBP8BAQP/AQAF/wEABf8AAAT/AAAC/wEBAf8BAQH/AQEB/wEB Af8BAQH/AQEB/wEBAf8BAQH/AwMD/wEBAf8AAAD/AAAA/wAAAP8AAAD/AAAA/wEBAf8BAAD/ AQAA/wEAAP8BAAD/AgAB/wMBAv8EAgP/BQME/wUDBP8BAAD/AQAA/wEAAP8EAgP/BQME/wEA AP8BAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAC/wQDCP8AAAT/ AAAC/wQEBv8HBwf/AAAA/wAAAP8AAAD/AAAA/wYFCv80Mzv/mpqm/8bD1P+urMH/oJyz/7Oy xP+ytrn/srex/7K3s/+yt7H/srez/7K3sf+yt7P/srex/7G2sv+xtrD/sbay/7G2sP+xtrL/ sbaw/7G2sv+xtrL/tLaz/7S2s/+0trX/tLaz/7S2s/+0trH/tLax/7S2sf+ztbD/r7Kr/6+y q/+ws6z/oaSb/3V4b/85PDP/DhAL/wAABP8FBAz/DAsT/wAAB/8BAAf/AwAH/wEAAv8WEhP/ AwAA/xENBP88OCz/hoNw/7+7ov+8uJv/sK2O/7y5mv+5s5n/ubOb/7mzm/+5s53/ubOd/7iz nf+5s53/uLOd/7Wwmv+1sJr/tbCa/7Wwmv+1sJr/tbCa/7Wwmv+1sJr/trWg/7a1oP+2taD/ t7Wg/7m0oP+6s6D/u7Og/7uzoP+vppX/u7Kh/8G6qP++uKj/uLKk/5yZiv9cWkv/HB0P/wAC AP8CBQD/Cw0C/wACAP8AAgD/AgQA/xUXFP8mKCf/IiMl/yIjJf8iIyX/IiMn/yIjJ/8iIyf/ IiMn/yIjJf8eHiD/Tk5O/9fW2/8DAgf/GRgd/xwbIP8ZGRv/Gxsd/x4eHv8aGhr/GhoY/xoa GP9GR0L/MDEr/wIDAP8HCAL/BAUA/wABAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAEA/wYHAv8REg3/AAEA/wIC AP8AAAD/CAgI/wAAAP8BAQH/AQEB/wEBA/8AAAL/AAAE/wAABP8AAAT/AAAE/wAAAv8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AwMD/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wEB Af8BAAD/AQAA/wEAAP8BAAD/AQAA/wEAAP8BAAD/AQAA/wEAAP8BAAD/AgAB/wUDBP8FAwT/ AwEC/wEAAP8BAAD/AwMD/wMDA/8DAwP/AwMD/wICAv8CAgL/AgIC/wEBAf8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wkJ Cf8BAQH/AAAA/wICBP8LCw3/DQ0N/wkJCf8DAwH/AAAA/wYHAv8FBQP/AAAA/wAAAv8EAwj/ BAMJ/wAABP8AAQD/AAMA/wADAP8AAwD/AAMA/wADAP8AAwD/AAMA/wADAP8AAwD/AAMA/wAD AP8AAwD/AAMA/wADAP8AAwD/AAIA/wACAP8AAgD/AAIA/wACAP8AAgD/AAIA/wACAP8AAgD/ AAIA/wACAP8EBwD/BQgA/wEEAP8AAgD/AQQA/wgHDP8GBQ3/AAAH/wgHD/8PDBX/AQAH/wEA Bf8FAwj/AwAC/wMAAP8GAgD/DAcD/wkFAP8EAAD/BAAA/woGAP8HAgD/BwIA/wcCAP8HAgD/ BwIA/wcCAP8HAgD/BwIA/wYBAP8GAQD/CAAA/wYBAP8IAAD/BgEA/wgAAP8GAQD/AgIA/wED AP8CAgD/BAEA/wUAAP8FAAD/BwAA/wcAAP8JAQD/DQUC/wYBAP8DAAD/AwAA/wkIBP8GBwL/ AAEA/wsOB/8TFg3/Cg0E/wIFAP8ICwD/DRAF/xEUC/8qLCf/IiQj/yIjJf8iIyf/IiMn/yIj KP8iIyf/IiMn/yIjJf8eHiD/Tk5O/9bV2/8CAQf/GBcd/xwbIP8ZGRv/Ghoc/x0dHf8ZGRf/ HR4Z/xgZE/87PDT/Kiwh/wACAP8EBgD/BwkA/wMFAP8EBgD/BAUA/wQFAP8EBQD/BAUA/wQF AP8EBQD/BAUA/wQFAP8EBQD/BAUA/wQFAP8EBQD/BAUA/wQFAP8EBQD/AQIA/wQFAP8KCwb/ AAEA/wUFA/8DAwH/CQkH/wEBAf8EBAT/BAQG/wQEBv8DAwX/AwIH/wMCB/8CAQf/AgEG/wMD Bf8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/BwcH/wUFBf8BAQH/AAAA/wAAAP8AAAD/ AwMD/wUFBf8EAgP/AwEC/wIAAf8BAAD/AQAA/wEAAP8BAAD/AQAA/wEAAP8CAAH/BAID/wMB Av8BAAD/AQAA/wEAAP8DAQL/AgIC/wICAv8CAgL/AQEB/wEBAf8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/ AAAA/wUIAf8BBAD/AAEA/wABAP8AAAT/AgEG/wMCB/8BAQH/BgcC/wABAP8BAQD/AQEA/wQE AP8GBgD/AQEA/wABAP8AAQP/AAEG/wABBv8AAQb/AAEG/wABBv8AAQb/AAEG/wAABf8AAAX/ AAAF/wAABf8AAAX/AAAF/wAABf8AAAX/AAAF/wAABf8AAAX/AAAF/wAABf8AAAX/AAAF/wAA Bf8CAQf/BAMJ/wAABf8AAAX/AAAF/wsKEP8HBgz/AAAE/wAAAv8DAwX/BQUH/wgICv8AAAD/ AAAA/wgGB/8BAAD/BwYE/wEAAP8BAAD/BAAA/wkFAv8MCAX/BgIA/wMAAP8BAAD/AQAA/wMA AP8DAAD/AwAA/wMAAP8DAAD/AwAA/wMAAP8DAAD/BAAA/wMAAv8EAAL/AwAC/wQABP8DAAL/ AAEA/wACAP8AAQD/AAEA/wEAAP8DAAD/BAAA/wQAAP8EAAD/AwAA/wUEAP8DBAD/AAEA/wAB AP8AAgD/AAMA/wACAP8AAgD/AAMA/wADAP8ABgD/AAUA/w8VB/81OzH/ISMg/yEiJP8hIif/ ISIn/yEhKf8hIif/ISIm/yEiJP8dHR//TU1N/9XU2v8BAAb/FxYc/xsaH/8YFxz/Ghoa/xwc Gv8YGRT/HyAY/xETCP8sLiH/Jykb/wMGAP8BBAD/BwoA/wIFAP8HCgD/BwoA/wcKAP8HCgD/ BwoA/wcKAP8HCgD/BwoA/wgLAP8ICwD/CAsA/wgLAP8ICwD/CAsA/wgLAP8ICgD/CAkB/wME AP8AAQD/BQYB/wgIBv8LCwn/BwcF/wUFA/8EBAb/AwMF/wMDBf8DAwX/AgEG/wIBBv8CAQf/ AQAF/wMDBf8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/BwcH/wUFBf8EBAT/AgIC/wIC Av8CAgL/BAQE/wUFBf8GBAX/BQME/wUDBP8EAgP/AwEC/wIAAf8CAAH/AgAB/wcFBv8EAgP/ AQAA/wEAAP8BAAD/AQAA/wIAAf8GBAX/FhYW/xYWFv8VFRX/FRUV/xUVFf8UFBT/FBQU/xQU FP8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/ Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoa Gv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/ Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoa Gv8aGhr/GhsW/xUYD/8ZHBH/GBoV/xMVFP8TEhf/FxYc/xcWHP8TExX/FBUP/w4QA/8WFwX/ AQMA/wEDAP8EBgD/Cw0A/wUGAP8DBAD/AgQB/wIEAf8CBAH/AgQB/wIEAf8CBAH/AgQB/wED AP8BAwD/AQMA/wEDAP8BAwD/AQMA/wEDAP8BAwD/AQEA/wEBAP8BAQD/AQEA/wEBAP8BAQD/ AQEA/wEBAP8CAgD/AQEB/wYGBv8LCw3/BwcJ/wAAAv8AAAL/BwcF/xITC/8LDQL/CQsA/wIE AP8AAgD/AAIA/xMUBv8CAwD/DQ0B/wMDAP8ICAD/EREJ/wsIA/8DAAD/AwAA/xAPC/8FBgD/ BQcA/wUHAP8FBwD/BgYA/wUHAP8GBgD/BgYA/wkJAP8LCAH/CwgB/wsIA/8LBwT/CwcE/wsH Bv8JCAT/CAsA/wYNAP8IDAD/CAwA/wkLAP8KCgD/CgoA/woKAP8JBgD/BwcA/wcJAP8ICwD/ BgwA/wIKAP8ACwD/Ag0A/wQLA/8KDwj/BQsA/wEIAP8GDgD/Bg4A/xceDv8XHRH/ISMe/yEi JP8hIif/ISEp/yEhKf8hISn/ISIn/yEiJP8dHR//TU1N/9TT2/8AAAf/FhUb/xoZHv8XFhv/ GRkZ/xwcGv8YGRP/FhgN/xgaDf9aXUz/jpF+/5GUf/+ZnIf/n6OM/5mdhP+ZnYT/mZ2E/5md hP+ZnYT/mZ2E/5mdhP+ZnYT/mZ2E/5qehf+anoX/mp6F/5qehf+anoX/mp6F/5qehf+anYj/ nZ+U/52emP+VlpD/o6Se/4yNiP+IiYT/gIB+/5GRj/+bm53/m5ud/5qZnv+amZ7/mZie/5mY nv+ZmJ7/mZid/5ubnf+bm5v/m5ub/5ubm/+bm5v/m5ub/5ubm/+bm5v/nZ2d/56env+fn5// oKCg/6CgoP+enp7/nJyc/5ubm/+dm5z/oJyd/6Ken/+loaL/p6Ok/6qmp/+rp6j/ramq/66q q/+no6T/op6f/6ikpf+yrq//s6+w/6ikpf+bmZr/c3Nz/3Nzc/9zc3P/c3Nz/3Jycv9ycnL/ cnJy/3Fxcf91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1 df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/ dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1 df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/dXV1/3V1df91dXX/ dXV1/3V1df91dXX/dXZx/3B0Zv91eWv/dXhx/3Fzcv90c3n/enmB/3l4gP9xcXP/eXhz/3Fy ZP+UloD/m56B/6eoiP+nqIj/qKmJ/6Onhv+ip4f/oaiH/6Goh/+hqIf/oaiH/6Goh/+hqIf/ oaiH/6Cnhv+gp4b/oKeG/6Cnhv+gp4b/oKeG/6Cnhv+gp4b/oKWF/6Gkhf+hpIX/oaSF/6Gk h/+hpIf/oaSH/6Gkh/+anYD/nqGG/5qdgv+Rk3v/lZd//6Gji/+goor/lJZ+/52hhv+TmHr/ m6CA/6Gnhf+gpoT/oaeF/5yigP+WnHr/kZZ2/6qvkf+qrpX/lpmE/5qbi/+traH/qqqg/5aX if+aoIT/mqF//5qhf/+aoX//m6F//5qhf/+boX//m6F//5uhf/+cn4D/nJ+C/5yfhP+cnob/ nJ6G/5yeiP+bn4b/lp+C/5WggP+Wn4D/mJ6C/5iegv+ZnYT/mZ2E/5mdhP+Vl3//mJyD/5mf g/+XoIP/l6WE/5qqhv+VpYH/jp2A/4+Xiv+OlY3/l5+Q/5KbiP+XoYn/jZd+/4mRfP9JT0H/ ISQd/yEjIv8hIif/ISEp/yEhK/8hISn/IiEn/yIiJP8dHR//TU1N/9TT2f8AAAX/FhUb/xoZ Hv8XFhv/GBga/xsbGf8XGBP/ICIX/xASBP89QC3/am5X/2ltUv9scVH/d31b/3Z8WP95f1v/ eX9b/3l/Xf95f1v/eX9d/3l/W/95f13/eX9b/3qAXv96gFz/eoBe/3qAXP96gF7/eoBc/3qA Xv96f1//dntl/4GFdP98gHL/iIuC/1BST/9AQUP/Ojs//2JjaP+FhY3/hISM/4SEjv+EhIz/ g4ON/4ODi/+Dg4v/hIOJ/4eFiv+JhIj/iYSI/4mEiP+JhIj/iYWG/4mEiP+JhYb/i4eI/42J iv+RjY7/k4+Q/5KOj/+Pi4z/i4eI/4mFhv+KhIb/jYeJ/5GLjf+VkZL/nJaY/6Gdnv+loKT/ p6Ok/6OfoP+cmJf/nZmW/7CtqP/Ewbr/wL20/6Gelf+BgXn/BwcF/wYHCf8FBgj/BQYI/wUG CP8EBQf/BAUH/wQFB/8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/ AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAA Av8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/ AAAC/wAAAv8AAAL/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wEEAP8CBQD/AAIA/wABAP8AAAX/BQQM/wMCCP8AAAD/ BwcA/ygpF/99gGP/kZVw/5edcf+Ummr/m59t/5ifbP+RmWb/kJpm/5CaZv+Qmmb/kJpm/5Ca Zv+Qmmb/kJpm/4+ZZf+PmWX/j5ll/4+ZZf+PmWX/j5ll/4+ZZf+QmGX/j5dk/5CXZP+Ql2T/ kJdk/5CXZP+Ql2T/kJdk/5CXZP+WnGz/i5Fj/4iOYP+SmGz/l5xz/5CVbP+Ok2r/k5hv/4GI X/+Ql23/mqF1/4eOYv+Hj2D/j5do/4OLXP+KkmP/iI9j/4SLYf93fVf/dXtZ/4OGZ/+KjXL/ jI52/5KXef+MlGv/jJVm/42VZv+NlWT/jZVm/42VZP+NlWb/jZVm/4uTZP+Mkmb/jJJm/4yR aP+MkWn/jJFp/4yQa/+LkWv/gYlg/3+KYP+BiWL/gYli/4KIYv+CiGL/gohk/4KIYv99gV7/ iI5o/4ePaP94g1n/dYJX/36LX/98jF//cYBX/3+Jbv9vd2D/eIBo/2x1WP9xelv/bndY/3+I bf86Pyv/ICMY/yAiHf8gISP/ICEl/yAgKP8gICj/ISAm/yEgJf8cHB7/TExM/9XU2f8BAAX/ FhUa/xoZHv8XFhv/GBcc/xsbHf8WFhT/GRoS/xIUBv85PCf/foNl/36EYP92fVH/cnpJ/3iA Tf96glP/eoJT/3uCVv98hFX/fYRY/36GV/9/hlr/gIhZ/4KJXf+Cilv/gold/4KKW/+Dil7/ g4tc/4SLX/+DjF//gItg/4WRa/+Fj3T/bndm/0NJR/9ARE3/S05f/4WHnP+Fh5z/hIab/4KF mP+Ag5T/foGQ/3yAjP96for/fHyI/4R9hf+Kf4f/joOL/5KHj/+UiZH/lImP/5OIkP+Rhoz/ i4CG/5iNk/+Wi4//nJGV/5uQlP+pnqL/m5CU/4uAhP+GfH3/i4KD/5SLjv+blZf/o5qf/6Od of+im6L/oZuf/6Wfn/+uqaX/pqOa/6+tnv+4uqT/o6aJ/56igf9na1L/HCEb/xofI/8YHSH/ FRoe/xIXG/8PFBj/DRIW/wwRFf8PFBj/DxQY/w8UGP8PFBj/DxQY/w8UGP8PFBj/DxQY/xAT GP8QExj/EBMY/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xATGP8QExj/ EBMY/xATGP8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xIVGv8SFRr/EhUa/xIV Gv8SFRr/EhUa/xIVGv8SFhn/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8UFRf/ FBUX/xQVF/8UFRf/FBUX/xQVF/8UFRf/FBYV/xQUEv8UFBL/FBQU/xQUFv8UExj/FBQW/xQU FP8UFQ//DxED/0pONf+QlnL/mqJz/6CpcP+rtXb/nKZh/52oZP+apGf/mqNq/5qjav+ao2r/ mqNq/5qjav+ao2r/mqNq/5qjav+Zomn/maJp/5ihaP+XoGf/lp9m/5afZv+VnmX/m6Vp/5ul af+bpWj/m6Vo/5ulaP+bpWj/m6Vo/5ulaP+apGj/lJ5i/5afaP+Zom3/kppn/4uTYv+RmWj/ maFw/46WZ/+OlmX/k5tq/5aea/+Tm2j/kppn/5KbZv+PmGP/ipNe/4uUX/+Lk2D/jJRh/42V ZP+OlmX/jpZl/46WZf+SmGj/kpho/5KYaP+SmWb/kpho/5KZZv+SmGj/kpho/4+VZf+RlGX/ kZRl/5CTZP+PkmX/jpFk/46RZP+LkWP/i5Fl/4uRZf+LkWX/i5Fl/4uRZf+LkWX/i5Bn/4uR Zf+Mjmb/iY9j/4iOYv+GjGD/hItf/4KJXf+BiFz/gIhZ/3J7TP+EjV7/eIFS/3N8T/+Ci2D/ f4dg/3uCYP83OyD/HyIP/x8hFP8fIBr/Hx8d/x8fIf8fHiP/Hx4k/x8eI/8WFhj/TU1N/9XV 1/8BAQP/FhUa/xoZHv8XFhz/GBcc/xsaH/8WFhb/GBkT/xQWCP86Pif/eX5e/3qBWP96glH/ eIFK/3uES/99hlH/fYVS/36GU/9/h1T/gIhV/4KKV/+Cilf/g4tY/4KKV/+Cilf/gopX/4KK V/+Di1j/g4tY/4SMWf+DjVn/gY9c/36OYf+HlHb/W2ZW/zU9P/9KUGD/dXmU/5KVtP98f57/ fYGe/36Cm/+AhZv/gYaZ/4OJmf+Eipr/iomX/4yCjf+NgIr/jX2I/4t+iP+Pf4n/kYSN/5iI kv+Yi5T/l4iP/5WIj/+Rgof/m4+T/5mKj/+ekpb/mImO/5eLjf+Jf4D/ioB//4uChf+Qh4r/ loyU/52Tm/+im6L/pZ+j/56YmP+moZv/qKaZ/7Oynf+2uZr/oKR//5ecc/9aXz//GiEa/xce JP8VHCL/Exog/xAXHf8NFBr/CxIY/woRF/8NFBr/DRQa/w0UGv8NFBr/DRQa/w0UGv8NFBr/ DRQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/DxQa/w8U Gv8PFBr/DxQa/w8UGv8QFRv/EBUb/xAVG/8QFRv/EBUb/xAVG/8QFRv/EBUb/xEWHP8RFhz/ ERYc/xEWHP8RFhz/ERYc/xEWHP8RFhr/EhMX/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xIT Ff8UFRf/FBUX/xQVF/8UFRf/FBUX/xQVF/8UFRf/FBUX/xQUFv8UFBb/FBQW/xQUFv8UFBb/ FBQU/xQVEP8UFgv/DxIB/1peQ/+UmnT/lJxr/5KcYP+Xol7/kp5S/5mlW/+XomD/l6Fk/5eh ZP+XoWT/l6Fk/5ehZP+XoWT/l6Fk/5mjZv+Zo2b/maNm/5iiZf+XoWT/lqBj/5agY/+Vn2L/ lJ5h/5SeYf+Unl//lJ5f/5SfXf+Un13/lJ9d/5SeX/+bpWb/l6Fk/5SdZP+TnGX/lZ1q/5ef bv+UnGv/jZVk/5GZZv+ZoW7/nKVw/5afav+PmGP/j5hj/46XYP+IkVr/kJlg/5CZYP+QmWD/ kJlg/5CaXv+PmV3/j5ld/4+YX/+OlWH/kJRi/5CUYv+QlGL/kJRi/5CUYv+QlGL/kJRi/5CU Yv+QlGL/j5Nh/46SYP+NkV//jZFf/4yQXv+MkF7/iYxd/4mMXf+JjF//iYxd/4mMX/+JjF3/ iYxf/4mMXf+Mj2L/i45f/4qNYP+JjF3/h4pd/4WIWf+Eh1r/golW/36HTv+HkVX/f4hR/3qD Tv9/h1j/eoFX/3yCXv89QiT/HyMM/x8iEf8fIRb/HyAb/x8fH/8fHiP/Hx4k/x8eI/8WFhj/ TU1N/9XV1/8BAQP/FhUa/xoZHv8XFhz/GBcc/xsaH/8WFhb/FBUP/xUXCv9AQy7/f4Rm/36E Xv96glP/cnpH/253QP9/iFP/gIlU/4GKVf+Ci1b/g4xX/4SNWP+Fjln/ho9a/4KLVv+Ci1b/ gotW/4OMV/+DjFf/g4xX/4SNWP+DjVv/eodb/2x6Vv9/i3P/V2FY/0BHT/9aX3P/iYyr/4SH qv90d5j/dXiX/3Z6lf94fJX/en+T/3yBlP99gpX/gYOS/4mBjv+Lf4n/in2H/4l9h/+Mf4j/ j4SM/5WIkf+Wi5P/joGI/5CFi/+RhYn/nZKW/5iMkP+ek5f/nZGV/6WbnP+WjI3/kIiG/4mA g/+GfYD/iX+H/5GHj/+Zkpn/oJqe/6iko/+sqaL/s7Gk/7Szn/+rrpH/nKB9/5abc/9QVTf/ GSAZ/xYdI/8UGyH/Ehkf/xAXHf8OFRv/DBMZ/wsSGP8NFBr/DRQa/w0UGv8NFBr/DRQa/w0U Gv8NFBr/DRQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/ DxQa/w8UGv8PFBr/DxQa/w8UGv8QFRv/EBUb/xAVG/8QFRv/EBUb/xAVG/8QFRv/EBUb/xEW HP8RFhz/ERYc/xEWHP8RFhz/ERYc/xEWHP8RFhr/EhMX/xITFf8SExX/EhMV/xITFf8SExX/ EhMV/xITFf8UFRf/FBUX/xQVF/8UFRf/FBUX/xQVF/8UFRf/FBUX/xQUFP8UFBT/FBQW/xQU Fv8UFBb/FBQU/xQUEv8UFQ3/EBIE/3B0Xf+epIL/mqF1/5ukbf+YomP/lqFd/5ijXv+YomP/ mKJl/5iiZf+YomX/mKJl/5iiZf+YomX/mKJl/56oa/+eqGv/nadq/5ymaf+cpmn/m6Vo/5qk Z/+apGf/lp9m/5afZv+WoGT/lqBk/5agZP+WoGT/lqBk/5agZP+IkVj/kJli/5CYZf+NlWT/ lZxw/5yjef+WnXT/i5Jo/4yUY/+NlWL/j5hj/5OcZ/+YoWz/l6Br/5SdZv+TnGX/lp9o/5af aP+UnWT/k5xj/5KcYP+Qml7/j5ld/4+YX/+OlV//jpVh/46VYf+OlWH/jpVh/46VYf+OlWH/ jpVh/5CXY/+Ql2P/kJdj/4+WYv+OlWH/jZRg/42UYP+Mk2D/iI9c/4iPXP+Ijl7/iI9c/4iO Xv+Ij1z/iI5e/4iPXP+DiVn/g4pX/4KIWP+Ah1T/foRU/32EUf98glL/e4JP/3yFUP97hE3/ e4NQ/3iAT/91fFD/c3lT/3qAXv89QSb/HyIN/x8hE/8fIBj/Hx8d/x8fIf8fHiP/Hx4k/x8e JP8WFhj/TU1N/9XV1/8BAQP/FhUa/xoZHv8XFhz/GBcc/xsbHf8WFhb/EBEL/w8RBP89QCv/ hYlu/4iOav+CiV//fIRT/32FUv97g1D/e4RP/3yEUf99hlH/f4dU/4CJVP+BiVb/gYpV/3+H VP9/iFP/f4dU/3+IU/+AiFX/gIlU/4GJVv+AiVr/gY1n/3uIbP+OmYn/iJGQ/4aMmv+MkKn/ mJu8/4qMsv+Giaz/hYip/4OHpP+AhJ3/foOZ/3uAlP95fpL/e3yO/3x2gv+CeIH/hnyF/4qA if+Mgor/jIKK/4uBif+KgIj/pJug/6KZnv+Yj5L/nZSX/5aNkP+elZj/mI+S/5qRkv+lnJ3/ nZWT/5KJjP+JgIP/hXyB/4h+hv+MhYz/kYuP/6iko/+sqaT/srCk/6Cfjf+OkXb/k5Z3/5WZ dP9KTjP/Fx4X/xQbIf8TGiD/ERge/xAXHf8OFRv/DRQa/wwTGf8NFBr/DRQa/w0UGv8NFBr/ DRQa/w0UGv8NFBr/DRQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/DxQa/w8UGv8PFBr/EBUb/xAV G/8QFRv/EBUb/xAVG/8QFRv/EBUb/xAVG/8QFRv/EBUb/xAVG/8QFRv/EBUb/xAVG/8QFRv/ EBUb/xAVG/8QFRv/EBUb/xAVG/8QFRv/EBUb/xAVG/8RFBn/EhMX/xITFf8SExX/EhMV/xIT Ff8SExX/EhMV/xITFf8TFBb/ExQW/xMUFv8TFBb/ExQW/xMUFv8TFBb/ExQW/xQUFP8UFBT/ FBQW/xQUFv8UFBb/FBQU/xQUEv8UFQ//FRcK/36BbP+coYP/lZt1/5qicf+Vnmf/l6Fl/5Se Yf+Rm1//kZtf/5GbX/+Rm1//kZtf/5GbX/+Rm1//kZtf/5ehZf+WoGT/lqBk/5WfY/+UnmL/ k51h/5OdYf+Sm2L/k5xn/5OcZ/+TnGf/k5xn/5OcZ/+TnGf/k5xn/5OcZ/+KkmH/lZ1u/5Wc cP+OlWz/kJZy/5OZd/+Vmnr/mqB8/6Kpff+Wnm3/j5dk/5ujcP+mrnv/maFu/42WYf+TnGf/ lJ1o/5OcZ/+RmmP/j5hh/42WXf+Kk1r/iZJZ/4iRWv+NlGD/jZRg/42UYf+NlGD/jZRh/42U YP+NlGH/jZRg/5OaZ/+SmWX/kplm/5GYZP+Ql2T/j5Zi/4+WY/+OlWL/iI9c/4iPXP+Ijl7/ iI9c/4iOXv+Ij1z/iI5e/4iPXP+MkmL/jJNg/4qQYP+JkF3/h41d/4aNWv+Fi1v/hItY/36G Vf96glH/g4tc/3+GWv9+hVz/hYtn/4iNb/8/Qyz/HyIR/x8hFP8fIBr/Hx8d/x8eI/8fHiT/ Hx4m/x8eJP8XFxn/Tk5O/9XV1/8BAQP/FhUa/xoZHv8XFhv/GBcc/xsbHf8WFhb/GRoV/w8R Bv84Oyj/gYVs/4OIaP97gVv/eYBW/4OLXP+AiFf/gIhV/4GJWP+Cilf/g4ta/4WNWv+FjVz/ ho5b/4ePXv+Hj1z/h49e/4iQXf+IkF//iJBd/4mRYP+IkWb/d4Bj/5SdjP+Um5T/mZ6k/5qc sf+Zmrj/iIis/4qKsP+Li6//iYmr/4aHo/+Bg5z/fH6V/3d5jv90dov/c3SG/4B9iP+Gf4f/ i4SM/46Hj/+RipH/kImQ/4+Ij/+Oh47/joiM/4eBhf+Ff4H/nJaY/5mTlf+YkpT/k42P/6Kc nP+on6D/o5uZ/5yTlv+VjI//joiM/4yGiv+Mhor/jYeJ/6Ofnv+tqqX/tbWp/5aXhf+Fh3H/ l5p9/5qgfv9NUzn/FRoU/xQZHf8TGBz/Ehcb/xIXG/8RFhr/EBUZ/xAVGf8PFBj/DxQY/w8U GP8PFBj/DxQY/w8UGP8PFBj/DxQY/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xATGP8QExj/ ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xEU Gf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/EhMX/xITFf8SExX/ EhMV/xITFf8SExX/EhMV/xITFf8TFBb/ExQW/xMUFv8TFBb/ExQW/xMUFv8TFBb/ExQW/xQU FP8UFBT/FBQW/xQUFv8UFBb/FBQW/xQUFP8UFRD/HR4W/4WId/+gpI3/kpd3/5KYcv+Plmr/ maFw/52mcf+Sm2b/kptm/5KbZv+Sm2b/kptm/5KbZv+Sm2b/kptm/5Weaf+Vnmn/lJ1o/5Sd aP+TnGf/kptm/5GaZf+RmWb/kppr/5Kaa/+Smmv/kppr/5Kaa/+Smmv/kplt/5KZbf+OlWz/ lpx2/5Wbef+YnX//n6OK/5mdhv+anYj/qq6V/5qgev+fpnr/mqF1/5qhdf+iqnv/mqJz/5CY af+Xn3D/maFw/5igb/+Wnmv/lJxp/5GZZv+Pl2T/jZVi/4yUYf+SmWb/kplm/5KYaP+SmWb/ kpho/5KZZv+SmGj/kplm/4qQYP+JkF3/iY9f/4iPXP+HjV3/ho1a/4aMXP+GjFz/jZNj/42T Y/+Nk2X/jZNj/42TZf+Nk2P/jZNl/42TY/+HjV//h41d/4aMXv+Eilr/goha/4GHV/+Ahlj/ f4VX/3h/U/91fFL/gYhf/3h+WP95f13/h4xu/36Ca/8sLxz/HyEU/x8gGP8fIBv/Hx8f/x8e JP8fHib/Hx0o/x8eJv8XFxn/Tk5O/9XV1/8BAQP/FhUa/xoZHv8XFhv/GBcc/xsbHf8WFhb/ FRYR/xESCv8/QTP/iIt2/4yQdf+HjWv/gohi/4aNZP99hFr/foVZ/3+GXP+Ah1v/gYhe/4KJ Xf+DimD/g4pe/4aNY/+GjWH/ho1j/4eOYv+HjmT/h45i/4iPZf+Hj2r/jZV+/7/HvP+pr6// lpql/4uNpP+Njq3/goKm/5CQtP+MjK7/i4yq/4mLpP+HiZ7/hYib/4SHmv+ChZj/goST/4OB jP+DgIf/hH+G/4J/hv+GgYf/iIaL/46Jj/+PjZL/rKer/0xKTf8KBgf/NzU2/3p2d/+enJ3/ m5eY/52Zmv+inJz/pJuc/6Oanf+imZz/n5md/52Xm/+clpr/mpaX/6Ofnv+uq6b/urqw/5yd jf+Mjnn/lZd//4+Udv9NUjz/ExgU/xIXG/8SFxv/Ehcb/xEWGv8RFhr/ERYa/xEWGv8PFBj/ DxQY/w8UGP8PFBj/DxQY/w8UGP8PFBj/DxQY/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xAT GP8QExj/EhUa/xIVGv8SFRr/EhUa/xIVGv8SFRr/EhUa/xIVGv8RFBn/ERQZ/xEUGf8RFBn/ ERQZ/xEUGf8RFBn/ERQZ/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xATGP8QFBf/EhMX/xIT Ff8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/ EhMV/xQUFP8UFBT/FBQW/xQUFv8UFBb/FBQW/xQUFP8UFBL/FRYQ/3Z4bf+ipZT/mZ2G/5SZ e/+SmHb/l513/6Cnff+Um2//lJtv/5Sbb/+Um2//lJtv/5Sbb/+Um2//lJtv/5eecv+XnnL/ lp1x/5WccP+VnHD/lJtv/5Oabv+Tmm7/kZhv/5GXcf+Rl3H/kZdx/5GXcf+Rl3H/kZdz/5GX df+Wm3v/mp+B/5KWff+RlH//jI9+/2JkV/83OS7/MDMi/3yBY/+fpYH/oqiE/4+Vb/+SmHL/ mJ54/5acdv+aoXj/lJty/5OacP+SmW//kZhu/4+WbP+OlWn/jZRq/4yTZ/+MkWj/jJJm/4yR aP+Mkmb/jJFo/4ySZv+MkWj/jJJm/5GWbf+Qlmr/kJVs/4+Vaf+Ok2r/jZNn/42Saf+MkWj/ h4xj/4eMY/+HjGP/h4xj/4eMY/+HjGP/h4xj/4eMY/+LkGf/i5Bn/4mOZf+IjWT/hoti/4WK Yf+DiF//g4hg/4WLZf+AhmL/i5Fv/36DY/9+gmf/h4t0/3l8af80Nij/HyAY/x8gG/8fHx// Hx8h/x8eJP8fHSj/Hx0q/x8eJv8YFxz/T09P/9XV1/8BAQP/FhYY/xoaHP8XFhv/GBcc/xsb Hf8WFhb/Dw8N/xMUDv83OSz/a25d/2tvWP90eF3/dHlZ/250Uv9wdVX/cHZU/3F2Vv9yeFb/ c3hY/3R6WP91elr/dnxa/3Z7W/92fFr/dntb/3Z8Wv93fFz/d31b/3h9Xf93fWH/ipGB/6Sr pP+Ok5b/en6K/3Byh/9rbIj/c3ST/3p7mf9tbor/bW+E/25xgv9ucn7/b3N//3B0gP9xdYH/ cnSA/3Jxef9xcHb/cG10/29udP9ycHX/dXR5/3t5fv98e4D/fHp9/0NDRf8IBgf/AAAA/wUD BP8pKSn/W1la/5GPkP+TjY3/k42N/5ONj/+TjY//k42R/5SOkv+TjpL/k4+Q/4yIh/+JiIT/ mJiQ/4iIfP+BhHP/fYBr/3Z6Y/9SVkX/ERYS/xEWGv8RFhr/ERYa/xEWGv8SFxv/Ehcb/xIX G/8PFBj/DxQY/w8UGP8PFBj/DxQY/w8UGP8PFBj/DxQY/xATGP8QExj/EBMY/xATGP8QExj/ EBMY/xATGP8QExj/EhUa/xIVGv8SFRr/EhUa/xIVGv8SFRr/EhUa/xIVGv8RFBn/ERQZ/xEU Gf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xATGP8QFBf/ EhMX/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xIT Ff8SExX/EhMV/xQUFP8UFBL/FBQU/xQUFP8UFBb/FBQW/xQUFv8UFBT/Kioo/2ZnYf+OkIX/ hId2/4KFcv+IjHX/gIRp/4KHaf+Bhmb/gYdl/4GHZf+Bh2X/gYdl/4GHZf+Bh2X/gYdl/4aM av+GjGr/hYtp/4WLaf+Eimj/g4ln/4OJZ/+CiGb/g4ho/4OIaP+DiGj/g4ho/4OIaP+DiGr/ g4ds/4OHbv94fGX/io16/42Pgf+SlIn/mpuV/35/ev9XV1f/T1BK/4WIdf+eoon/mZ2E/4qO c/+Pk3j/jJB1/4KGa/+IjW//g4hq/4OIaP+DiGj/g4ho/4KHZ/+CiGb/godn/4KIZv+AhWX/ gIZk/4CFZf+AhmT/gIVl/4CGZP+AhWX/gIZk/3l+Xv95f13/eH1d/3d9W/92e1v/dnxa/3V6 Wv91elr/e4Bg/3uAYP97gGD/e4Bg/3uAYP97gGD/e4Bg/3uAYP94fV3/d3xc/3Z7W/91elr/ c3hY/3J3V/9wdVX/cHVV/3Z7Xf9vc1j/en5l/29zXP9vcl3/b3Jf/2psXv9MTkP/HyAa/x8f Hf8fHyH/Hx4j/x8eJv8fHSj/Hx0q/x8eJv8YFxz/T09P/9XV1/8BAQP/FhYY/xoaHP8XFhv/ GBcc/xsbHf8WFhb/JCQi/xwdF/8YGRH/GRsO/wEEAP8QEwD/ExcA/wcLAP8MEAD/DA8A/w0Q AP8OEQD/EBMA/xEUAP8SFQD/EhUA/w8SAP8PEgD/DxIA/xATAP8QEwD/EBMA/xEUAP8QFQH/ ERcJ/wMKA/8ABAf/BgoV/w4RJP8AABX/DxEo/wgKIf8JDB//CQ0Z/woOF/8LEBb/DBEV/w0S Fv8OExn/DxIZ/wIDCP8FBgv/CgkP/w0OE/8QDxT/DxAU/w8OE/8NDhL/DQ0P/x0eIP8eHh7/ GRsa/wgICP8QEhH/Dw8P/xEREf8LBwb/CgQE/wcBA/8EAAD/BAAC/wMAAv8DAAL/BAAB/wQD Af8BAAD/BQQA/wYIAP8OEAP/CAsA/wsOAP8GCgD/ERUU/xAVGf8QFRn/ERYa/xEWGv8SFxv/ Ehcb/xIXG/8PFBj/DxQY/w8UGP8PFBj/DxQY/w8UGP8PFBj/DxQY/xATGP8QExj/EBMY/xAT GP8QExj/EBMY/xATGP8QExj/EhUa/xIVGv8SFRr/EhUa/xIVGv8SFRr/EhUa/xIVGv8RFBn/ ERQZ/xEUGf8RFBn/ERQZ/xEUGf8RFBn/ERQZ/xATGP8QExj/EBMY/xATGP8QExj/EBMY/xAT GP8QFBf/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/EhMV/xITFf8SExX/ EhMV/xITFf8SExX/EhMV/xQUFP8UFBL/FBQU/xQUFP8UFBb/FBQW/xQUFv8UFBb/BgYG/w4O DP8VFhD/AAEA/wACAP8TFQf/BAcA/wEEAP8ICwD/CAsA/wgLAP8ICwD/CAsA/wgLAP8ICwD/ CAsA/xEUAP8RFAD/ERQA/xATAP8PEgD/DhEA/w4RAP8NEAD/FRkC/xUZAv8VGQL/FRkC/xUZ Av8VGQL/FRgD/xUYBf8GCAD/HyEU/xkaFP8NDgn/Ghoa/xsaH/8VFBz/ISAl/x4fF/8ZGw7/ Cw0A/xcZC/8wMiT/HyET/wwPAP8dIA//HSAN/x0gDf8eIQ7/HiEO/x8iDf8gIw7/ICMO/yEk D/8jJhH/IyYR/yMmEf8jJhH/IyYR/yMmEf8jJhH/IyYR/ygrFv8oKxb/JyoV/yYpFP8mKRT/ JSgT/yQnEv8kJxL/HyIN/x8iDf8fIg3/HyIN/x8iDf8fIg3/HyIN/x8iDf8fIg3/HyIN/x4h DP8cHwr/Gh0I/xkcB/8YGwb/FxoF/xodCP8PEgD/HSAN/xkcC/8aHA7/ExUI/x0fFP8hIhz/ Hx8d/x8fH/8fHiP/Hx4k/x8eJv8fHSj/Hx0q/x8eJv8YGBr/T09P/9XV1f8BAQH/FhYY/xkZ G/8VFRf/FhYY/xkZG/8UFBT/FhYU/xYXEv8WFxH/FhcP/xYYC/8WGAr/FhkI/xYYCv8WGAv/ FhgN/xYYDf8WGA3/FhgN/xYYDf8WGA3/FhgN/xcZDv8XGQ7/FxkO/xcZDv8XGQ7/FxkO/xcZ Dv8WGQ7/FBoO/xQZEv8UGBf/FBce/xQWI/8UFiX/FBYl/xQWI/8UFyD/FBgb/xQYF/8UGRX/ FBkV/xQZFf8UGBf/FBgZ/xQYG/8UFxz/Fhcc/xQXHP8WFxv/FBgb/xYXG/8UGBv/FhcZ/xQY Gf8WGBf/FBgX/xYYF/8UGBf/FhgX/xcXF/8aFhX/GxUV/xoWFf8aFhX/GhYX/xoWF/8aFhf/ GBYX/xgXFf8YFxX/FxgT/xcYEv8XGBD/FhoM/xYaC/8WGQ7/FRkY/xUZHP8VGRz/FRkc/xQY G/8UGBv/Exca/xMXGv8UGBv/FBgb/xQYG/8UGBv/FBgb/xQYG/8UGBv/FBgb/xUWGv8VFhr/ FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUW Gv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/wsMEP8KCw//Njc7/zM0OP8hIib/ KCkt/xwdIf8hIib/IyQm/y0uMP8WFxn/Jicp/xwdH/8gISP/HR4g/zc4Ov8VFhj/FRYY/xUW GP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUVFf8VFRX/FRUV/xUVFf8VFRf/FRUX/xUUGf8VFRf/ FhYY/xYWFv8WFhT/FhcS/xYXEf8WFw//FhgN/xYYDf8XGBD/FxgQ/xcYEP8XGBD/FxgQ/xcY EP8XGBD/FxgQ/xkaEv8ZGhL/GRoS/xkaEv8aGxP/GhsT/xscFP8bHRL/HB4R/xweEP8dIA// HSAP/x0gD/8eIBL/HiAS/x4gE/8gIRn/ICEb/yAgIP8gICL/IB8l/yAfJ/8gHiv/IB4p/yMj Jf8jIyH/IyMh/yQkIv8kJSD/JCUg/yUmIf8lJiH/Jich/yYnIf8nKCD/Jygg/ygpIf8oKSH/ KCkh/ygpIf8pKyD/KSsg/ykrIP8pKyD/Kiwh/yosIf8qLCH/Ky0i/ygqH/8oKh//KCof/ygq H/8oKh//KCof/ygqH/8oKh//Jyke/ycpHv8nKR7/Jyke/ycpHv8nKR7/Jyke/ycpHv8jJRr/ IyUa/yMlGv8jJRr/IyUa/yMlGv8jJRr/IyUa/yEjFv8hIxb/ISMW/yEjGP8gIhf/ICEZ/x8g Gv8fHx3/Hx8f/x8fIf8fHiP/Hh0j/x4dJf8eHSX/HRsm/x0cJP8WFhj/TU1N/9XV1f8BAQH/ FhYY/xkZG/8VFRf/FhYY/xkZG/8UFBb/FhYW/xYWFP8WFxL/FhcS/xYXEf8WFw//FhcP/xYX D/8WFhT/FhYU/xYWFv8WFhT/FhYW/xYWFP8WFhb/FhYU/xcXF/8XFxX/FxcX/xcXFf8XFxf/ FxcV/xcXF/8WGBP/FhkQ/xQaEP8UGRX/FBgb/xQXHv8UFyD/FBcg/xQXHP8UGBn/FBkV/xQZ Ev8UGhD/FBoQ/xQZEv8UGRP/FBgX/xQYG/8UFxz/FBcc/xQXHP8UGBv/FBgb/xQYG/8UGBv/ FBgZ/xQYGf8UGBf/FBgX/xQYF/8UGBf/FBgX/xYYF/8aFhX/GxUV/xoWFf8aFhX/GhYX/xoW F/8YFhf/GBYX/xgXFf8XFxX/FxcV/xcYE/8WGRL/FhkQ/xYZEP8WGRL/FRkY/xUZHP8VGRz/ FRkc/xQYG/8UGBv/Exca/xMXGv8UGBv/FBgb/xQYG/8UGBv/FBgb/xQYG/8UGBv/FBgb/xUW Gv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/ FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xUWGv8VFhr/FRYa/xcYHP8TFBj/WFld/2xt cf9JSk7/S0xQ/2Zna/+MjZH/Pj9B/21ucP9FRkj/g4SG/1xdX/9zdHb/ZWZo/3l6fP8VFhj/ FRYY/xUWGP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUVFf8VFRX/FRUV/xUVFf8VFRf/FRUX/xUU Gf8VFBn/FhYY/xYWGP8WFhb/FhYW/xYWFP8WFhT/FhcS/xYWFP8XFxf/FxcX/xcXGf8XFxf/ FxcZ/xcXF/8XFxn/FxcX/xkZG/8ZGRn/GRkb/xkZGf8aGhz/Ghoa/xsbHf8bGxn/HB0Y/xwd Ff8cHRX/HR8U/x0fFP8dHxT/Hh8X/x4fGf8gIRz/ICAe/yAgIv8gHyX/IB4p/yAeK/8gHiz/ IB4s/yMiKv8jIij/IyIo/yMiKP8kIyn/JCMo/yUkKf8lJCn/JiUq/yYmKP8mJij/Jycn/ycn J/8oKCj/KCgo/ygoKP8oKCj/KCgm/ykpKf8pKSf/KSkp/yoqKP8qKir/Kioo/ygoKP8oKCb/ KCgo/ygoJv8oKCj/KCgm/ygoKP8oKCb/Jycn/ycnJf8nJyf/Jycl/ycnJ/8nJyX/Jycn/ycn Jf8jIyP/IyMh/yMjI/8jIyH/IyMj/yMjIf8jIyP/IyMh/yEiHP8hIhr/ISIc/yEiHP8gIRz/ ICEc/x8fHf8fHx//Hx8h/x8fIf8fHiP/Hh0j/x4dI/8eHSX/HRwk/x0cIv8WFhj/TU1N/9XV 1f8BAQH/FhYW/xkZGf8VFRX/FhYW/xkZG/8UFBb/FhYY/xYWFv8WFhb/FhYW/xYWFP8WFhT/ FhYU/xYWFP8WFRr/FhUa/xYVG/8WFRr/FhUb/xYVGv8WFRv/FhUa/xcWHP8XFhv/FxYc/xcW G/8XFhz/FxYb/xcWHP8WFxn/FhkS/xQaEP8UGRP/FBgX/xQYG/8UFxz/FBgb/xQYF/8UGRP/ FBoQ/xQaDP8UGgz/FBoO/xQaEP8UGRP/FBgX/xQYG/8UFxz/FBcc/xQXHP8UGBv/FBgb/xQY G/8UGBv/FBgZ/xQYGf8UGBf/FBgX/xQYF/8UGBf/FBgX/xYYF/8YFxX/GhYV/xoWFf8aFhX/ GBYX/xgWF/8YFhf/GBYX/xcXF/8XFxf/FxcX/xYYFf8WGBX/FhgT/xYYE/8WGBX/FRka/xUZ HP8VGRz/FRkc/xQYG/8UGBv/Exca/xMXGv8UGBv/FBgb/xQYG/8UGBv/FBgb/xQYG/8UGBv/ FBgb/xUWGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYV Gv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xAPFP8PDhP/ XVxh/3x7gP9QT1T/QUBF/1JRVv9ubXL/PD0//3h5e/9CQ0X/dnd5/zs8Pv9VVlj/Xl9h/3V2 eP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUVF/8VFRf/FRUX/xUVF/8VFRf/ FRUX/xUVF/8VFRf/FhYY/xYWGP8WFhj/FhYY/xYWFv8WFhb/FhYW/xYWGP8XFhz/FxYc/xcW Hv8XFhz/FxYe/xcWHP8XFh7/FxYc/xkYIP8ZGB7/GRgg/xkYHv8aGSH/Ghkf/xsaIv8bGh// HBwe/xwcGv8cHBr/HB0Y/x0eGf8dHhn/HR4Z/x4fGv8gIB7/ICAg/yAfJP8gHyX/IB4p/yAe K/8gHiz/IB4s/yIgLf8iIC3/IyEu/yMhLP8kIi3/JCIt/yQiLf8kIyv/JSQs/yUkKv8mJSv/ JiUr/yYlK/8nJiz/JyYs/ycmLP8mJyz/Jygs/ycoLf8nKCz/KCku/ygpLf8oKS7/KSou/yco Lf8nKCz/Jygt/ycoLP8nKC3/Jygs/ycoLf8nKCz/JSYr/yUmKv8lJiv/JSYq/yUmK/8lJir/ JSYr/yUmKv8iIyj/IiMn/yIjKP8iIyf/IiMo/yIjJ/8iIyj/IiMn/yEhIf8hIR//ISEf/yEh H/8gIB7/ICAg/x8fH/8fHyH/Hx8h/x8fIf8fHiP/Hh0i/x4dIv8eHSP/HRwi/x0cIv8WFhj/ Tk5O/9XV1f8BAQH/FhYW/xkZGf8VFRX/FhYW/xkZG/8UFBb/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYVGv8WFRv/FhUd/xYVHf8WFR3/FhUd/xYVHf8WFR3/FhUd/xcWHv8XFh7/ FxYe/xcWHv8XFh7/FxYe/xcWHv8XFhv/FhgT/xQZEv8UGRX/FBgX/xQYG/8UGBv/FBgZ/xQZ Ff8UGRL/FBoO/xQbC/8UGgz/FBoO/xQZEv8UGRX/FBgZ/xQYG/8UFxz/FBcc/xQXHP8UGBv/ FBgb/xQYG/8UGBv/FBgZ/xQYGf8UGBf/FBgX/xQYF/8UGBf/FBgX/xYYF/8YFxX/GhYV/xoW Ff8aFhX/GBYX/xgWF/8YFhf/FxcX/xcXF/8XFxf/FhgX/xYYF/8WGBf/FhgX/xYYF/8WGBf/ FRka/xUZHP8VGRz/FRkc/xQYG/8UGBv/Exca/xMXGv8UGBv/FBgb/xQYG/8UGBv/FBgb/xQY G/8UGBv/Fhcb/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/ FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xwb IP8SERb/Kyov/y0sMf8ZGB3/ExIX/xEQFf8cGyD/BgcJ/yorLf8WFxn/Jygq/xITFf8YGRv/ Jicp/yQlJ/8VFhj/FRYY/xUWGP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUVF/8VFRf/FRUX/xUV F/8VFRf/FRUX/xUVF/8VFRf/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYVGv8XFh7/ FxYe/xcVIP8XFh7/FxUg/xcWHv8XFSD/FxYe/xkXIv8ZGCD/GRci/xkYIP8aGCP/Ghkh/xsZ JP8bGiL/Gxog/xsaH/8cHB7/HBwe/xwcHP8dHR3/HR0b/x0dG/8gICD/ICAi/yAfJP8gHyX/ IB4p/yAeKf8gHiv/IB4r/yIgLf8iIC3/IiAt/yMhLv8jIS7/IyEs/yQiLf8kIi3/JCIt/yQj K/8lJCz/JSQq/yYlK/8mJSv/JiUr/yYlK/8mJi7/JiYu/yYmLv8mJi7/Jycv/ycnL/8nJy// KCgw/yYmLv8mJi7/JiYu/yYmLv8mJi7/JiYu/yYmLv8mJi7/JCQs/yQlKv8kJCz/JCUq/yQk LP8kJSr/JCQs/yQlKv8iIir/IiMo/yIiKv8iIyj/IiIq/yIjKP8iIir/IiMo/yEhI/8hISH/ ISEj/yEhIf8gICL/ICAi/x8fIf8fHyH/Hx8h/x8fIf8fHiP/Hh0i/x4dIv8eHSL/HRwh/x0c If8XFxn/Tk5O/9XV1f8BAQH/FhYW/xkZGf8VFRX/FhYW/xkZG/8UFBb/FhUa/xYVGv8WFRr/ FhUb/xYVG/8WFR3/FhUd/xYVHf8WFRv/FhUb/xYVG/8WFRv/FhUb/xYVG/8WFRv/FhUb/xcW HP8XFhz/FxYc/xcWHP8XFhz/FxYc/xcWHP8XFhv/FhgV/xYYE/8WGBf/Fhcb/xYXHP8WFxz/ FhcZ/xYYFf8WGRL/FhkO/xYZDv8WGQ7/FhkS/xYYFf8WFxv/Fhcc/xYXHP8WFxz/Fhcc/xYX HP8WFxv/Fhcb/xYXG/8WFxv/FhcZ/xYXGf8WGBf/FhgX/xYYF/8WGBf/FhgX/xcXF/8YFxX/ GhYV/xgXFf8YFxX/GBcV/xgXFf8XFxX/FxcV/xcXF/8WGBf/FhcZ/xYXGf8UGBn/FBgZ/xQY G/8UGBv/Fxga/xcYGv8XGBr/Fxga/xYXGf8WFxn/FRYY/xUWGP8WFxn/FhcZ/xYXGf8WFxn/ FhcZ/xYXGf8WFxn/FhcZ/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/ FhYY/xgYGv8XFxn/Dg4Q/wgICv8VFRf/ExMV/wgICv8dHR//Jicp/xobHf8WFxn/BgcJ/xAR E/8XGBr/ExQW/wIDBf8VFhj/FRYY/xUWGP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUUGf8VFBn/ FRQZ/xUUGf8VFRf/FRUX/xUVF/8VFRf/FhYW/xYWFv8WFhj/FhYY/xYWGP8WFhj/FhYY/xYV Gv8XFhz/FxYc/xcWHv8XFhz/FxYe/xcWHP8XFh7/FxYc/xkYIP8ZGB7/GRgg/xkYHv8aGSH/ Ghkf/xsaIv8bGiL/Gxoi/xsaIv8bGiD/Gxog/xwbIP8cHB7/HR0d/x0dHf8fHx//Hx8f/x8f If8fHiP/Hx4k/x8eJv8fHSj/Hx0o/yEfKv8hHyr/IiAr/yIhKf8jIir/IyIq/yMiKv8jIij/ IyIo/yQjKP8kIyj/JCMo/yUkKf8lJCn/JSQp/yUkKf8lJiv/JSYr/yUmK/8lJiv/Jics/yYn LP8nKC3/Jygt/yYnLP8mJyz/Jics/yYnLP8mJyz/Jics/yYnLP8mJyz/IyQp/yMkKP8jJCn/ IyQo/yMkKf8jJCj/IyQp/yMkKP8iIyj/IiMn/yIjKP8iIyf/IiMo/yIjJ/8iIyj/IiMn/yEg Jf8hISP/ISAl/yEhI/8gHyT/ICAi/x8fIf8fHyH/Hx8h/x8fIf8fHyH/Hh4g/x4eIP8eHiD/ HR0f/x0dH/8XFxf/T09P/9XV1f8BAQH/FhYW/xkZGf8VFRX/FhYW/xkZG/8UFBb/FhUa/xYV Gv8WFRv/FhUd/xYUH/8WFCH/FhQh/xYUH/8WFRv/FhUa/xYVGv8WFRr/FhUa/xYVGv8WFRr/ FhUa/xcWG/8XFhv/FxYb/xcWG/8XFhv/FxYb/xcWG/8XFxn/FhgX/xYYF/8WFxv/Fhcc/xYW Hv8WFh7/Fhcc/xYYF/8WGBP/FhkS/xYZEP8WGRL/FhgV/xYXG/8WFiD/FhYi/xYWHv8WFxz/ Fhcc/xYXHP8WFxv/Fhcb/xYXG/8WFxv/FhcZ/xYXGf8WGBf/FhgX/xYYF/8WGBf/FhgX/xcX F/8YFxX/GhYV/xgXFf8YFxX/GBcV/xgXFf8XFxX/FxcV/xYYF/8WGBf/FhcZ/xYXG/8UGBv/ FBcc/xQXHP8UFxz/Fxgc/xcYGv8XGBr/Fxga/xYXGf8WFxn/FRYY/xUWGP8WFxn/FhcZ/xYX Gf8WFxn/FhcZ/xYXGf8WFxn/FhcZ/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/wwMDv8ZGRv/FRUX/xkZG/8nJyn/GRkb/xgYGv8+PkD/SElL/zIzNf8wMTP/ Ghsd/wsMDv8cHR//ERIU/xYXGf8VFhj/FRYY/xUWGP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUU Gf8VFBn/FRQZ/xUUGf8VFRf/FRUX/xUVF/8VFRX/FhYW/xYWFv8WFhj/FhYY/xYWGP8WFhj/ FhYY/xYWGP8XFhv/FxYb/xcWG/8XFhv/FxYb/xcWG/8XFhv/FxYb/xkYHf8ZGB3/GRgd/xkY Hf8aGR7/Ghke/xsaH/8bGiD/Ghgj/xoYJf8bGST/Gxoi/xsaIP8cGyD/HBwe/xwcHP8fHx// Hx8f/x8fH/8fHyH/Hx4j/x8eI/8fHiT/Hx4k/yEgJv8hICb/ISAm/yIhJv8iISb/IyIn/yMi J/8jIyX/IiIk/yMjI/8jIyP/IyMj/yQkJP8kJCT/JCQk/yUlJf8kJSf/JCUp/yQlKf8lJir/ JSYq/yUmKv8mJyv/Jicr/yUmKv8lJir/JSYq/yUmKv8lJir/JSYq/yUmKv8lJir/IyQm/yMk Jv8jJCb/IyQm/yMkJv8jJCb/IyQm/yMkJv8iIyX/IiMl/yIjJf8iIyX/IiMl/yIjJf8iIyX/ IiMl/yEgJf8hICX/ISAl/yEgJf8gHyT/IB8k/x8fIf8fHyH/Hx8h/x8fIf8fHyH/Hh4e/x4e Hv8eHh7/HR0d/x0dHf8YGBj/T09P/9XV1f8BAQH/FhYW/xkZGf8VFRX/FhYW/xkZG/8UFBb/ FhUa/xYVGv8WFRv/FhUd/xYUIf8WFCL/FhQi/xYUH/8WFRr/FhYW/xYWFv8WFhb/FhYW/xYW Fv8WFhb/FhYW/xcXF/8XFxf/FxcX/xcXF/8XFxf/FxcX/xcXF/8XFxf/FhcZ/xYXG/8WFh7/ FhYg/xYWIv8WFiD/FhYe/xYXG/8WGBf/FhgT/xYYE/8WGBX/Fhcb/xYWIP8WFSX/FhUl/xcV IP8XFhz/FxYc/xcWHP8XFhv/FxYb/xcWG/8XFhv/FxcZ/xcXGf8XFxf/FxcX/xcXF/8XFxf/ FxcX/xcXF/8YFhf/GBYX/xgXFf8YFxX/GBcV/xgXFf8XFxX/FxcV/xYYF/8WGBf/FhcZ/xYX G/8UFxz/FBce/xQXHv8UFx7/Fxgc/xcYGv8XGBr/Fxga/xYXGf8WFxn/FRYY/xUWGP8WFxn/ FhcZ/xYXGf8WFxn/FhcZ/xYXGf8WFxn/FhcZ/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xsbHf8cHB7/FhYY/xAQEv8LCw3/Dw8R/yYmKP88PD7/EhMV/xYX Gf8qKy3/NDU3/x0eIP8bHB7/ExQW/xYXGf8VFhj/FRYY/xUWGP8VFhj/FRYY/xUWGP8VFhj/ FRYY/xUUGf8VFBr/FRQZ/xUUGf8VFRf/FRUX/xUVFf8VFRX/FhYW/xYWFP8WFhb/FhYW/xYW Fv8WFhb/FhYY/xYWGP8XFxf/FxcV/xcXFf8XFxX/FxcV/xcXFf8XFxX/FxcV/xkZF/8ZGRf/ GRkX/xkZF/8aGhj/GhoY/xsbGf8bGx3/Ghgj/xoYJv8aGCX/Gxkk/xsaIP8bGh//HBwe/xwc HP8eHh7/Hh4c/x4eHP8eHh7/Hh4e/x4eIP8eHSL/Hh4g/yEhI/8hISH/ISEh/yEhIf8iIiL/ IiIg/yIiIP8jJB//IiMe/yIjHv8iIx7/IyQe/yMkHv8jJB7/JCUf/yQlH/8jJSL/ISUk/yEl JP8iJiX/IiYl/yMnJv8jJyb/Iycm/yMnJv8jJyb/Iycm/yMnJv8jJyb/Iycm/yMnJv8jJyb/ ICUh/yAlIf8gJSH/ICUh/yAlIf8gJSH/ICUh/yAlIf8gJSH/ICUh/yAlIf8gJSH/ICUh/yAl If8gJSH/IiQj/yEgJf8hICb/ISAm/yEgJv8gHyT/IB8k/x8fIf8fHyH/Hx8f/x8fH/8fHx// Hh4e/x4eHv8eHhz/HR0b/x0dG/8YGBj/T09P/9XV1f8BAQH/FhYW/xkZGf8VFRX/FhYW/xkZ G/8UFBb/FhUa/xYVGv8WFRv/FhUd/xYUH/8WFCH/FhQh/xYUH/8WFhj/FhYU/xYWFv8WFhT/ FhYW/xYWFP8WFhb/FhYU/xcXF/8XFxX/FxcX/xcXFf8XFxf/FxcV/xcXF/8XFxf/Fhcb/xYX HP8WFh7/FhYe/xYWIP8WFiD/FhYe/xYXG/8WGBf/FhgV/xYYF/8WFxn/Fhcc/xYWIP8WFSP/ FhUj/xcWHv8XFhv/FxYc/xcWG/8XFhv/FxYb/xcWG/8XFhv/FxcZ/xcXGf8XFxf/FxcX/xcX F/8XFxf/FxcX/xcXF/8YFhf/GBYX/xgWF/8YFxX/GBYX/xgXFf8XFxf/FxcX/xYYF/8WFxn/ FhcZ/xYXG/8WFxz/FBcc/xYWHv8WFxz/Fxgc/xcYGv8XGBr/Fxga/xYXGf8WFxn/FRYY/xUW GP8WFxn/FhcZ/xYXGf8WFxn/FhcZ/xYXGf8WFxn/FhcZ/xYWGP8WFhj/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FhYY/xUVF/8TExX/Gxsd/xYWGP8ICAr/ICAi/zIyNP8PDxH/ FBUX/wwND/8SExX/Jicp/ygpK/8UFRf/HR4g/wkKDP8VFhj/FRYY/xUWGP8VFhj/FRYY/xUW GP8VFhj/FRYY/xUUGf8VFBn/FRQZ/xUUGf8VFRf/FRUX/xUVFf8VFRX/FhYW/xYWFv8WFhb/ FhYW/xYWFv8WFhb/FhYY/xYWFv8XFxX/FxcV/xcXFf8XFxX/FxcV/xcXFf8XFxX/FxcV/xkZ F/8ZGRf/GRkX/xkZF/8aGhj/GhoY/xsbGf8bGx3/Ghkh/xoYJf8aGCP/Ghkh/xsaIP8bGh// HBwe/xwcHv8eHh7/Hh4c/x4eHv8eHh7/Hh4e/x4eHv8eHiD/Hh4g/yAgIP8hIR//ISEh/yEh H/8iIiD/IiIg/yIjHv8iIx7/ISId/yIjHv8iIx3/IiMd/yMkHv8jJB7/IyQe/yMkHv8jJSL/ ISYi/yMlJP8hJiL/JCYl/yInI/8lJyb/Iygk/yUnJv8jKCT/JScm/yMoJP8lJyb/Iygk/yUn Jv8jKCT/ISMg/x8kIP8hIyD/HyQg/yEjIP8fJCD/ISMg/x8kIP8iJCH/ICUh/yIkIf8gJSH/ IiQh/yAlIf8iJCH/IiQj/yEgJf8hICX/ISAm/yEgJf8gHyT/IB8k/x8fIf8fHyH/Hx8f/x8f H/8fHx//Hh4e/x4eHv8eHhz/HR0b/x0dG/8YGBj/UFBQ/9/f4f8AAAL/GBga/xkZG/8UFBb/ FhYY/xMTFf8aGhz/EhIU/xISFP8SERb/EhEW/xIRFv8SERf/EhEX/xIRFv8SEhT/EhIS/xIS FP8SEhL/EhIU/xISEv8SEhT/EhIS/xUVF/8VFRX/FRUX/xUVFf8VFRf/FRUV/xUVF/8VFRf/ FhYY/xYVGv8WFRr/FhUa/xYVGv8WFRr/FhUa/xYWGP8WFhj/FhYW/xYWGP8WFhj/FhUa/xYV Gv8WFRv/FhUb/xUUGf8VFRf/FRQZ/xUVF/8VFRf/FRUX/xUVF/8VFRf/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8YGBr/GBga/xgYGv8YGBj/GBga/xgYGP8YGBr/GBga/xYW GP8WFhj/FhYY/xYWGP8WFRr/FRYa/xYVGv8WFRr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/ GBga/xgYGv8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xcXGf8XFxn/FxcZ/xcX Gf8XFxn/FxcZ/xcXGf8XFxn/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8UFBb/ FBQW/xQUFv8VFRf/FRUX/xUVF/8WFhj/FhYY/wYGCP8QEBL/ICAi/xgYGv8MDA7/JSUn/y4u MP8MDA7/Jycp/zs7Pf8LCw3/HBwe/y8vMf8PDxH/HBwe/xoaHP8XFxn/FxcZ/xcXGf8WFhj/ FhYY/xUVF/8VFRf/FRUX/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FxcZ/xcX Gf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8YGBj/GBgY/xgYGP8YGBj/GBgY/xgYGP8YGBj/ GBgY/xUVFf8VFRX/FRUV/xYWFv8WFhb/FhYW/xcXF/8XFxn/GBcc/xkYHv8ZGB3/GRgd/xoZ Hv8aGhz/Ghoc/xsbHf8bGx3/Gxsb/xsbHf8cHB7/HBwe/xwcHv8dHR//HR0f/x4eIP8eHh7/ Hx8h/x8fH/8fHx//ICAg/yAgIP8gICD/IiIi/yIiIv8iIiL/IyMj/yMjI/8jIyP/JCQk/yQk JP8jIyP/IiQj/yMjJf8iJCP/IyMl/yIkI/8jIyX/IiQj/yQkJv8jJST/JCQm/yMlJP8kJCb/ IyUk/yQkJv8jJST/JSUl/yQmJf8kJCT/IyUk/yQkJP8iJCP/IyMj/yIkI/8jIyP/ISMi/yIi Iv8hIyL/ISEh/yAiIf8hISH/ISEj/yAgIv8gICL/IB8k/yAgIv8fHyH/Hx8h/x4eIP8eHiD/ Hh4g/x4eIP8eHiD/HR0f/x0dH/8dHR3/HBwc/xwcHP8VFRf/UVFT/9/f4f8AAAL/GBga/xkZ G/8UFBb/FhYY/xMTFf8aGhz/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcX Gf8XFxn/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/ GBga/xgYGv8YGBr/GBga/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/GBga/xgY Gv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/ FRUX/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/FRUX/xUVF/8VFRf/FRUX/xUV F/8VFRf/FRUX/xUVF/8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xQUFv8UFBb/ FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcX Gf8YGBr/GBga/xgYGv8ZGRv/GRkb/xoaHP8aGhz/Ghoc/w4OEP8SEhT/Hx8h/xkZG/8PDxH/ JCQm/y4uMP8TExX/Ly8x/zQ0Nv8RERP/IiIk/yoqLP8ICAr/ERET/xcXGf8VFRf/FRUX/xQU Fv8UFBb/FBQW/xMTFf8TExX/ExMV/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/ FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUV F/8VFRf/FRUX/xgYGv8YGBr/GRkb/xkZG/8ZGRv/Ghoc/xoaHP8aGhz/GRkb/xkZG/8ZGRv/ Ghoc/xoaHP8aGhz/Gxsd/xsbHf8bGx3/Gxsd/xsbHf8cHB7/HBwe/x0dH/8dHR//HR0f/x4e IP8eHiD/Hx8h/x8fIf8fHyH/ICAi/yAgIv8gICL/ISEj/yIiJP8iIiT/IiIk/yMjJf8jIyX/ IyMl/yQkJv8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yQkJv8kJCb/JCQm/yQk Jv8kJCb/JCQm/yQkJv8kJCb/JSUn/yUlJ/8kJCb/JCQm/yMjJf8jIyX/IyMl/yMjJf8iIiT/ IiIk/yIiJP8iIiT/ISEj/yEhI/8hISP/ICAi/yAgIv8gICL/ICAi/x8fIf8fHyH/Hx8h/x4e IP8eHiD/Hh4g/x4eIP8dHR//HR0f/x0dH/8cHB7/HBwe/xwcHv8VFRf/UVFT/+Dg4v8AAAL/ GBga/xkZG/8VFRf/FhYY/xQUFv8bGx3/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZ G/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xgYGv8YGBr/GBga/xgYGv8YGBr/ GBga/xgYGv8YGBr/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZ G/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/ GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xUV F/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/ FBQW/xQUFv8VFRf/FRUX/xYWGP8WFhj/FhYY/xcXGf8XFxn/FxcZ/xUVF/8SEhT/Ghoc/xgY Gv8PDxH/HR0f/ygoKv8aGhz/ERET/xAQEv8SEhT/Ly8x/y8vMf8SEhT/EhIU/xsbHf8ZGRv/ GRkb/xgYGv8YGBr/GBga/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcX Gf8XFxn/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8VFRf/FRUX/xUVF/8VFRf/ FRUX/xUVF/8VFRf/FRUX/xsbHf8bGx3/Gxsd/xwcHv8cHB7/HR0f/x0dH/8dHR//GRkb/xkZ G/8ZGRv/Ghoc/xoaHP8bGx3/Gxsd/xsbHf8bGx3/Gxsd/xwcHv8cHB7/HR0f/x0dH/8dHR// HR0f/x4eIP8eHiD/Hx8h/x8fIf8fHyH/ICAi/yAgIv8gICL/ISEj/yEhI/8iIiT/IiIk/yIi JP8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/ IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/JCQm/yQkJv8kJCb/JCQm/yMjJf8jIyX/IiIk/yIi JP8iIiT/IiIk/yIiJP8hISP/ISEj/yAgIv8gICL/ICAi/yAgIv8gICL/Hx8h/x8fIf8fHyH/ Hh4g/x4eIP8eHiD/Hh4g/x0dH/8dHR//HR0f/xwcHv8cHB7/HBwe/xwcHv8VFRf/UVFT/+Dg 4v8AAAL/GRkb/xoaHP8VFRf/FxcZ/xQUFv8bGx3/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/ GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/ FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcX Gf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8ZGRv/GRkb/xkZG/8ZGRv/ GRkb/xkZG/8ZGRv/GRkb/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/GRkb/xkZ G/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/ GRkb/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/FRUX/xUVF/8VFRf/FRUX/xUV F/8VFRf/FRUX/xUVF/8UFBb/FBQW/xQUFv8VFRf/FRUX/xUVF/8WFhj/FhYY/x8fIf8VFRf/ GBga/xoaHP8UFBb/Gxsd/yUlJ/8hISP/Ghoc/xQUFv8oKCr/Nzc5/ygoKv8VFRf/DAwO/w4O EP8WFhj/FRUX/xUVF/8VFRf/FBQW/xQUFv8UFBb/ExMV/xQUFv8UFBb/FBQW/xQUFv8UFBb/ FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8YGBr/GBga/xgY Gv8YGBr/GBga/xgYGv8YGBr/GBga/xoaHP8aGhz/Gxsd/xsbHf8bGx3/HBwe/xwcHv8cHB7/ GRkb/xoaHP8aGhz/Ghoc/xsbHf8bGx3/Gxsd/xwcHv8cHB7/HBwe/xwcHv8dHR//HR0f/x0d H/8eHiD/Hh4g/x4eIP8eHiD/Hx8h/x8fIf8fHyH/ICAi/yAgIv8gICL/ISEj/yEhI/8hISP/ IiIk/yIiJP8iIiT/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMj Jf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/JCQm/yQkJv8jIyX/IyMl/yMjJf8iIiT/ IiIk/yIiJP8iIiT/IiIk/yEhI/8hISP/ICAi/yAgIv8gICL/ICAi/x8fIf8fHyH/Hx8h/x8f If8eHiD/Hh4g/x0dH/8dHR//HR0f/x0dH/8dHR//HBwe/xwcHv8cHB7/Gxsd/xsbHf8VFRf/ UVFT/+Hh4/8AAAL/GRkb/xoaHP8WFhj/FxcZ/xQUFv8cHB7/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xMTFf8TExX/ ExMV/xMTFf8TExX/ExMV/xMTFf8TExX/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQU Fv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xUVF/8VFRf/FRUX/xUVF/8VFRf/ FRUX/xUVF/8VFRf/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8XFxn/FxcZ/xcX Gf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/ FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcX Gf8XFxn/FxcZ/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/GRkb/xkZG/8ZGRv/ GRkb/xkZG/8ZGRv/GRkb/xkZG/8VFRf/FRUX/xUVF/8WFhj/FhYY/xYWGP8XFxn/FxcZ/x4e IP8VFRf/FRUX/xgYGv8UFBb/FhYY/x4eIP8gICL/KSkr/x8fIf8tLS//JSUn/xERE/8TExX/ ExMV/xERE/8aGhz/Ghoc/xoaHP8ZGRv/GRkb/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgY Gv8YGBr/GBga/xgYGv8YGBr/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xcXGf8XFxn/GBga/xgYGv8YGBr/GRkb/xkZ G/8ZGRv/Ghoc/xoaHP8aGhz/Gxsd/xsbHf8cHB7/HBwe/xwcHv8cHB7/HBwe/x0dH/8dHR// HR0f/x4eIP8eHiD/Hh4g/x4eIP8eHiD/Hx8h/x8fIf8fHyH/ICAi/yAgIv8gICL/ICAi/yAg Iv8hISP/ISEj/yEhI/8iIiT/IiIk/yIiJP8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/ IyMl/yIiJP8iIiT/IiIk/yIiJP8iIiT/IiIk/yIiJP8iIiT/IyMl/yMjJf8jIyX/IyMl/yIi JP8iIiT/ISEj/yEhI/8hISP/ISEj/yEhI/8gICL/ICAi/yAgIv8fHyH/Hx8h/x8fIf8fHyH/ Hh4g/x4eIP8eHiD/HR0f/x0dH/8dHR//HR0f/x0dH/8cHB7/HBwe/xsbHf8bGx3/Gxsd/xsb Hf8VFRf/UVFT/+Hh4/8BAQP/Ghoc/xsbHf8WFhj/GBga/xUVF/8cHB7/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xQU Fv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8UFBb/ FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FBQW/xQUFv8UFBb/FBQW/xQUFv8UFBb/FBQW/xQUFv8TExX/ExMV/xMTFf8TExX/ ExMV/xMTFf8TExX/ExMV/xISFP8SEhT/EhIU/xISFP8SEhT/EhIU/xISFP8SEhT/ExMV/xMT Ff8TExX/ExMV/xMTFf8TExX/ExMV/xMTFf8QEBL/EBAS/xAQEv8QEBL/ERET/xERE/8SEhT/ EhIU/xAQEv8MDA7/CwsN/w0ND/8MDA7/DAwO/w4OEP8QEBL/CgoM/wgICv8UFBb/Dw8R/wcH Cf8WFhj/HBwe/xUVF/8ZGRv/GRkb/xkZG/8ZGRv/GBga/xgYGv8YGBr/FxcZ/xcXGf8XFxn/ FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYW GP8SEhT/EhIU/xISFP8SEhT/EhIU/xISFP8SEhT/EhIU/xYWGP8WFhj/FxcZ/xcXGf8XFxn/ GBga/xgYGv8YGBr/Ghoc/xsbHf8bGx3/Gxsd/xwcHv8cHB7/HBwe/xwcHv8dHR//HR0f/x0d H/8dHR//Hh4g/x4eIP8fHyH/Hx8h/x4eIP8eHiD/Hx8h/x8fIf8fHyH/ICAi/yAgIv8gICL/ ICAi/yAgIv8gICL/ISEj/yEhI/8hISP/IiIk/yIiJP8jIyX/IyMl/yMjJf8jIyX/IyMl/yMj Jf8jIyX/IyMl/yIiJP8iIiT/IiIk/yIiJP8iIiT/IiIk/yIiJP8iIiT/IyMl/yMjJf8jIyX/ IiIk/yIiJP8hISP/ISEj/yEhI/8hISP/ISEj/yAgIv8gICL/Hx8h/x8fIf8fHyH/Hx8h/x4e IP8eHiD/Hh4g/x4eIP8dHR//HR0f/x0dH/8cHB7/HBwe/xwcHv8cHB7/Gxsd/xsbHf8bGx3/ Ghoc/xoaHP8VFRf/UVFT/+Hh4/8BAQP/Ghoc/xsbHf8WFhj/GBga/xUVF/8cHB7/GRkb/xkZ G/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/ GRkb/xoaHP8aGhz/Ghoc/xoaHP8aGhz/Ghoc/xoaHP8aGhz/Gxsd/xsbHf8bGx3/Gxsd/xsb Hf8bGx3/Gxsd/xsbHf8bGx3/Gxsd/xsbHf8bGx3/Gxsd/xsbHf8bGx3/Gxsd/xwcHv8cHB7/ HBwe/xwcHv8cHB7/HBwe/xwcHv8cHB7/Gxsd/xsbHf8bGx3/Gxsd/xsbHf8bGx3/Gxsd/xsb Hf8aGhz/Ghoc/xoaHP8aGhz/Ghoc/xoaHP8aGhz/Ghoc/xsbHf8bGx3/Gxsd/xsbHf8bGx3/ Gxsd/xsbHf8bGx3/Ghoc/xoaHP8aGhz/Ghoc/xoaHP8aGhz/Ghoc/xoaHP8ZGRv/GRkb/xkZ G/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/ FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8WFhj/FxcZ/xcXGf8XFxn/GBga/xgY Gv8YGBr/GRkb/xQUFv8YGBr/GRkb/xcXGf8YGBr/GBga/xUVF/8TExX/ERET/xMTFf8VFRf/ Gxsd/xoaHP8aGhz/Gxsd/w8PEf8VFRf/FBQW/xQUFv8UFBb/ExMV/xMTFf8TExX/EhIU/xER E/8RERP/ERET/xERE/8RERP/ERET/xERE/8RERP/EBAS/xAQEv8QEBL/EBAS/xAQEv8QEBL/ EBAS/xAQEv8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xkZG/8ZGRv/GRkb/xoa HP8aGhz/Gxsd/xsbHf8bGx3/Gxsd/xsbHf8bGx3/HBwe/xwcHv8cHB7/HR0f/x0dH/8dHR// HR0f/x0dH/8eHiD/Hh4g/x8fIf8fHyH/Hx8h/x4eIP8eHiD/Hx8h/x8fIf8fHyH/ICAi/yAg Iv8gICL/Hx8h/yAgIv8gICL/ICAi/yEhI/8hISP/ISEj/yIiJP8jIyX/IyMl/yMjJf8jIyX/ IyMl/yMjJf8jIyX/IyMl/yIiJP8iIiT/IiIk/yIiJP8iIiT/IiIk/yIiJP8iIiT/IyMl/yIi JP8iIiT/IiIk/yEhI/8hISP/ISEj/yEhI/8gICL/ICAi/yAgIv8gICL/Hx8h/x8fIf8eHiD/ Hh4g/x4eIP8eHiD/Hh4g/x0dH/8dHR//HR0f/xwcHv8cHB7/HBwe/xwcHv8bGx3/Gxsd/xsb Hf8aGhz/Ghoc/xoaHP8VFRf/UVFT/+Li5P8BAQP/Ghoc/xsbHf8XFxn/GBga/xUVF/8dHR// HBwe/xwcHv8cHB7/HBwe/xwcHv8cHB7/HBwe/xwcHv8cHB7/HBwe/xwcHv8cHB7/HBwe/xwc Hv8cHB7/HBwe/x8fIf8fHyH/Hx8h/x8fIf8fHyH/Hx8h/x8fIf8fHyH/ISEj/yEhI/8hISP/ ISEj/yEhI/8hISP/ISEj/yEhI/8hISP/ISEj/yEhI/8hISP/ISEj/yEhI/8hISP/ISEj/yIi JP8iIiT/IiIk/yIiJP8iIiT/IiIk/yIiJP8iIiT/ISEj/yEhI/8hISP/ISEj/yEhI/8hISP/ ISEj/yEhI/8kJCb/JCQm/yQkJv8kJCb/JCQm/yQkJv8kJCb/JCQm/yEhI/8hISP/ISEj/yEh I/8hISP/ISEj/yEhI/8hISP/JCQm/yQkJv8kJCb/JCQm/yQkJv8kJCb/JCQm/yQkJv8jIyX/ IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMj Jf8jIyX/JSUn/yUlJ/8lJSf/JSUn/yUlJ/8lJSf/JSUn/yUlJ/8sLC7/LCwu/y0tL/8tLS// LS0v/y4uMP8uLjD/Li4w/y4uMP84ODr/Ojo8/zY2OP84ODr/ODg6/zMzNf8tLS//ODg6/zQ0 Nv8oKCr/MzM1/zY2OP8tLS//MTEz/ykpK/8qKiz/Kios/yoqLP8pKSv/KSkr/ygoKv8oKCr/ KCgq/ycnKf8nJyn/Jycp/ycnKf8nJyn/Jycp/ycnKf8nJyn/JiYo/yYmKP8mJij/JiYo/yYm KP8mJij/JiYo/yYmKP8iIiT/IiIk/yIiJP8iIiT/IiIk/yIiJP8iIiT/IiIk/xwcHv8dHR// HR0f/x0dH/8eHiD/Hh4g/x4eIP8fHyH/Gxsd/xsbHf8bGx3/HBwe/xwcHv8dHR//HR0f/x0d H/8dHR//HR0f/x4eIP8eHiD/Hh4g/x8fIf8fHyH/Hx8h/x4eIP8eHiD/Hx8h/x8fIf8fHyH/ ICAi/yAgIv8gICL/Hx8h/x8fIf8gICL/ICAi/yAgIv8hISP/ISEj/yEhI/8jIyX/IyMl/yMj Jf8jIyX/IyMl/yMjJf8jIyX/IyMl/yEhI/8hISP/ISEj/yEhI/8hISP/ISEj/yEhI/8hISP/ IiIk/yIiJP8iIiT/IiIk/yEhI/8hISP/ISEj/yAgIv8gICL/ICAi/yAgIv8fHyH/Hx8h/x8f If8eHiD/Hh4g/x4eIP8eHiD/HR0f/x0dH/8dHR//HBwe/xwcHv8cHB7/HBwe/xwcHv8bGx3/ Gxsd/xoaHP8aGhz/Ghoc/xoaHP8VFRf/UVFT/+bm6P8GBgj/GRkb/x4eIP8oKCr/Ly8x/zk5 O/8wMDL/Ojo8/zExM/9AQEL/PT0//zMzNf86Ojz/Ozs9/zs7Pf87Oz3/PDw+/zw8Pv89PT// Pj5A/z4+QP8/P0H/Pz9B/0VFR/9FRUf/RERG/0NDRf9DQ0X/QkJE/0FBQ/9BQUP/RERG/0VF R/9FRUf/RUVH/0ZGSP9GRkj/RkZI/0ZGSP9GRkj/RkZI/zk5O/9HR0n/S0tN/0BAQv9GRkj/ QEBC/0RERv9DQ0X/QkJE/0FBQ/9AQEL/Pz9B/z4+QP89PT//QEBC/z8/Qf8+PkD/PT0//zs7 Pf86Ojz/OTk7/zg4Ov8/P0H/Pz9B/z8/Qf8/P0H/Pz9B/z8/Qf8/P0H/Pz9B/z8/Qf8+PkD/ PT0//zs7Pf84ODr/NjY4/zU1N/80NDb/MTEz/zIyNP8zMzX/NTU3/zY2OP84ODr/OTk7/zo6 PP86Ojz/Ojo8/zo6PP87Oz3/Ozs9/zw8Pv88PD7/PDw+/z4+QP89PT//Ozs9/zo6PP84ODr/ NjY4/zQ0Nv80NDb/LCwu/y0tL/8wMDL/NDQ2/zg4Ov87Oz3/Pj5A/z8/Qf9FRUf/RkZI/0ZG SP9HR0n/SEhK/0lJS/9KSkz/SkpM/1hYWv9YWFr/WFha/1hYWv9YWFr/WFha/1hYWv9YWFr/ T09R/05OUP9OTlD/Tk5Q/01NT/9NTU//TU1P/0xMTv9FRUf/RERG/0NDRf9CQkT/QUFD/z8/ Qf8+PkD/Pj5A/zc3Of83Nzn/NjY4/zQ0Nv8yMjT/MDAy/y8vMf8vLzH/NTU3/zQ0Nv8zMzX/ MjI0/zExM/8wMDL/Ly8x/y8vMf81NTf/NTU3/zQ0Nv8zMzX/MjI0/zAwMv8wMDL/Ly8x/zc3 Of82Njj/NjY4/zQ0Nv8zMzX/MjI0/zExM/8xMTP/ODg6/zg4Ov83Nzn/NjY4/zY2OP81NTf/ NDQ2/zQ0Nv8yMjT/MjI0/zMzNf8zMzX/NDQ2/zU1N/82Njj/NjY4/zAwMv8xMTP/MjI0/zQ0 Nv81NTf/Nzc5/zg4Ov85OTv/MzM1/zMzNf8zMzX/MzM1/zIyNP8yMjT/MTEz/zExM/8yMjT/ MTEz/zAwMv8vLzH/Li4w/y0tL/8sLC7/LCwu/y0tL/83Nzn/MjI0/z4+QP8tLS//MDAy/zEx M/87Oz3/NTU3/zQ0Nv8yMjT/MDAy/y0tL/8qKiz/KSkr/ygoKv8tLS//LCwu/ywsLv8sLC7/ Kyst/ysrLf8rKy3/Kios/ycnKf8nJyn/Jycp/yYmKP8mJij/JSUn/yUlJ/8lJSf/JSUn/yEh I/8cHB7/HBwe/x8fIf8aGhz/EBAS/wwMDv8cHB7/TExO/+Li5P8CAgT/FRUX/0NDRf9hYWP/ ZWVn/2RkZv9lZWf/bW1v/2NjZf9ra23/aGhq/2hoav9vb3H/aWlr/2lpa/9sbG7/bGxu/21t b/9ubnD/b29x/29vcf9wcHL/cHBy/3V1d/91dXf/dXV3/3Z2eP92dnj/dnZ4/3Z2eP92dnj/ dXV3/3V1d/92dnj/dnZ4/3Z2eP93d3n/d3d5/3d3ef96enz/gYGD/3Z2eP99fX//gYGD/3Z2 eP94eHr/dHR2/35+gP9+foD/fn6A/319f/99fX//fX1//319f/99fX//hYWH/4WFh/+FhYf/ hISG/4ODhf+Dg4X/goKE/4KChP+EhIb/hISG/4SEhv+EhIb/hISG/4SEhv+EhIb/hISG/4+P kf+OjpD/jY2P/4yMjv+Kioz/iYmL/4iIiv+IiIr/kJCS/5GRk/+SkpT/k5OV/5WVl/+Wlpj/ l5eZ/5iYmv+UlJb/lZWX/5WVl/+VlZf/lpaY/5aWmP+Wlpj/l5eZ/56eoP+fn6H/oaGj/6Sk pv+np6n/qqqs/6ysrv+urrD/tra4/7e3uf+6urz/vb2//8HBw//ExMb/x8fJ/8jIyv/T09X/ 1NTW/9XV1//W1tj/19fZ/9nZ2//a2tz/2trc/+Pj5f/j4+X/4+Pl/+Pj5f/j4+X/4+Pl/+Pj 5f/j4+X/4eHj/+Hh4//g4OL/4ODi/9/f4f/f3+H/39/h/9/f4f/X19n/1tbY/9XV1//T09X/ 0dHT/9DQ0v/OztD/zs7Q/8fHyf/Fxcf/w8PF/7+/wf+8vL7/uLi6/7a2uP+0tLb/p6ep/6am qP+lpaf/pKSm/6Ojpf+ioqT/oaGj/6Gho/+YmJr/mJia/5eXmf+Wlpj/lZWX/5SUlv+Tk5X/ kpKU/5KSlP+RkZP/kJCS/4+Pkf+OjpD/jY2P/4yMjv+Li43/hYWH/4WFh/+FhYf/hISG/4OD hf+CgoT/goKE/4GBg/95eXv/eXl7/3l5e/95eXv/eXl7/3l5e/94eHr/eHh6/3p6fP95eXv/ eHh6/3Z2eP91dXf/c3N1/3JydP9xcXP/cXFz/3Fxc/9xcXP/cXFz/3Bwcv9wcHL/b29x/29v cf9xcXP/cHBy/29vcf9ubnD/bW1v/2xsbv9ra23/amps/2ZmaP9paWv/YmJk/29vcf9paWv/ bW1v/2RkZv9jY2X/amps/2lpa/9nZ2n/ZWVn/2NjZf9hYWP/X19h/15eYP9cXF7/XFxe/1xc Xv9cXF7/W1td/1tbXf9aWlz/Wlpc/1NTVf9SUlT/UlJU/1JSVP9RUVP/UVFT/1FRU/9QUFL/ UVFT/09PUf9NTU//TU1P/1BQUv9UVFb/R0dJ/y4uMP8ZGRv/UFBS/+3t7/8ICAr/BAQG/0ND Rf9gYGL/cnJ0/2xsbv9oaGr/ZWVn/2VlZ/9sbG7/ZWVn/2ZmaP9qamz/YmJk/2xsbv9tbW// bm5w/25ucP9vb3H/cHBy/3Fxc/9xcXP/cnJ0/3Fxc/9xcXP/cnJ0/3R0dv91dXf/d3d5/3h4 ev94eHr/eHh6/3l5e/95eXv/eXl7/3p6fP96enz/enp8/3p6fP9xcXP/g4OF/3x8fv9/f4H/ h4eJ/4GBg/+AgIL/goKE/4GBg/+BgYP/goKE/4ODhf+EhIb/hYWH/4aGiP+Ghoj/gYGD/4GB g/+BgYP/goKE/4ODhf+Dg4X/hISG/4SEhv+NjY//jY2P/42Nj/+NjY//jY2P/42Nj/+NjY// jY2P/4eHif+IiIr/i4uN/4+Pkf+Tk5X/l5eZ/5qanP+cnJ7/nZ2f/52dn/+enqD/n5+h/6Cg ov+hoaP/oqKk/6KipP+oqKr/qKiq/6ioqv+pqav/qamr/6qqrP+qqqz/qqqs/6ysrv+tra// sLCy/7Oztf+3t7n/u7u9/729v/+/v8H/x8fJ/8jIyv/Ly83/zs7Q/9HR0//T09X/1tbY/9fX 2f/g4OL/4uLk/+bm6P/s7O7/8fHz//f3+f/7+/3//f3///////////////////////////// ///////////////////////////////////////////+/v///v7///7+///8/P7/+vr8//X1 9//w8PL/6urs/+Tk5v/g4OL/3d3f/9vb3f/Z2dv/1tbY/9LS1P/Nzc//ycnL/8XFx//Dw8X/ vLy+/7y8vv+7u73/urq8/7m5u/+3t7n/t7e5/7a2uP+qqqz/qamr/6ioqv+np6n/pqao/6Wl p/+kpKb/o6Ol/56eoP+enqD/nZ2f/5ycnv+bm53/mZmb/5mZm/+YmJr/kpKU/5KSlP+RkZP/ kZGT/5CQkv+Pj5H/jo6Q/46OkP+OjpD/jo6Q/4yMjv+Li43/ioqM/4iIiv+Hh4n/h4eJ/4OD hf+Dg4X/goKE/4GBg/+AgIL/f3+B/35+gP99fX//eHh6/3h4ev94eHr/d3d5/3d3ef92dnj/ dnZ4/3Z2eP91dXf/dXV3/3R0dv9zc3X/cnJ0/3Bwcv9wcHL/b29x/3Bwcv9ycnT/bGxu/2lp a/9eXmD/ZmZo/2hoav9xcXP/bm5w/21tb/9sbG7/amps/2lpa/9nZ2n/ZWVn/2VlZ/9iYmT/ YmJk/2JiZP9hYWP/YWFj/2BgYv9gYGL/YGBi/2BgYv9gYGL/YGBi/19fYf9fX2H/Xl5g/15e YP9eXmD/W1td/1hYWv9cXF7/W1td/1xcXv9oaGr/W1td/zIyNP8QEBL/UFBS/+rq7P8AAAL/ AQED/29vcf95eXv/dXV3/2ZmaP9ZWVv/W1td/2trbf92dnj/aWlr/2RkZv9hYWP/Xl5g/3d3 ef+MjI7/jIyO/42Nj/+OjpD/j4+R/4+Pkf+QkJL/kJCS/5GRk/+SkpT/k5OV/5WVl/+YmJr/ mpqc/5ycnv+dnZ//o6Ol/6Ojpf+jo6X/pKSm/6Skpv+lpaf/paWn/6Wlp/+lpaf/tra4/7Ky tP+tra//tLS2/6+vsf+pqav/rq6w/6ysrv+tra//r6+x/7Cwsv+ysrT/tLS2/7a2uP+3t7n/ uLi6/7m5u/+6urz/u7u9/729v/+/v8H/wMDC/8DAwv/Dw8X/w8PF/8PDxf/Dw8X/w8PF/8PD xf/Dw8X/w8PF/8PDxf/CwsT/wsLE/8HBw//AwML/wMDC/7+/wf+/v8H/wsLE/8LCxP/CwsT/ w8PF/8PDxf/Dw8X/xMTG/8TExv/Hx8n/x8fJ/8fHyf/Hx8n/yMjK/8jIyv/IyMr/ycnL/8vL zf/MzM7/zc3P/9DQ0v/S0tT/1NTW/9XV1//W1tj/1tbY/9fX2f/Z2dv/29vd/93d3//f3+H/ 4eHj/+Li5P/j4+X/5eXn/+rq7P/v7/H/9fX3//v7/f////////////////////////////// /////////////////////////v7///7+///+/v///f3///39///9/f///Pz+//z8/v////// //////z8/v/29vj/7+/x/+np6//l5ef/4uLk/93d3//c3N7/2dnb/9bW2P/T09X/0NDS/87O 0P/Nzc//x8fJ/8fHyf/Gxsj/xcXH/8PDxf/CwsT/wcHD/8HBw/+4uLr/t7e5/7e3uf+1tbf/ tLS2/7Oztf+ysrT/srK0/6+vsf+urrD/ra2v/6ysrv+rq63/qqqs/6mpq/+pqav/o6Ol/6Oj pf+ioqT/oaGj/6Cgov+goKL/n5+h/5+fof+hoaP/oKCi/5+fof+cnJ7/mpqc/5iYmv+Wlpj/ lZWX/5mZm/+YmJr/l5eZ/5aWmP+VlZf/lJSW/5OTlf+Tk5X/i4uN/4uLjf+Kioz/ioqM/4qK jP+JiYv/iYmL/4mJi/+NjY//jIyO/4uLjf+Kioz/iYmL/4iIiv+Hh4n/hoaI/3Z2eP9+foD/ iIiK/4WFh/+AgIL/h4eJ/4GBg/+Dg4X/eHh6/3d3ef93d3n/dXV3/3R0dv9zc3X/cnJ0/3Jy dP9wcHL/cHBy/3Bwcv9vb3H/b29x/25ucP9ubnD/bm5w/2trbf9qamz/amps/2pqbP9paWv/ aWlr/2lpa/9oaGr/Y2Nl/1paXP9iYmT/Y2Nl/1tbXf9nZ2n/ZGRm/0BAQv8QEBL/UlJU//b2 +P8FBQf/EBAS/5ubnf+Tk5X/f3+B/4WFh/+Kioz/ioqM/5qanP+lpaf/mJia/5OTlf+QkJL/ jY2P/6amqP+rq63/q6ut/6ysrv+tra//rq6w/66usP+vr7H/r6+x/7W1t/+2trj/uLi6/7q6 vP+8vL7/v7/B/8DAwv/BwcP/x8fJ/8fHyf/Hx8n/yMjK/8jIyv/IyMr/ycnL/8nJy//Kysz/ 0NDS/9HR0//Q0NL/2trc/93d3//a2tz/4+Pl/+Xl5//m5uj/5+fp/+np6//r6+3/7e3v/+7u 8P/v7/H/7+/x//Dw8v/x8fP/8vL0//T09v/19ff/9/f5//f3+f/4+Pr/+Pj6//j4+v/4+Pr/ +Pj6//j4+v/4+Pr/+Pj6//z8/v/8/P7/+/v9//v7/f/6+vz/+fn7//n5+//5+fv/9/f5//f3 +f/39/n/9vb4//b2+P/29vj/9fX3//X19//4+Pr/+Pj6//j4+v/5+fv/+fn7//r6/P/6+vz/ +vr8/+3t7//u7vD/7+/x//Hx8//z8/X/9fX3//b2+P/39/n/9vb4//f3+f/4+Pr/+vr8//z8 /v/9/f///v7////////9/f///f3///39///+/v///v7///////////////////7+///+/v// /v7///7+///+/v///v7///7+///+/v///f3///39///9/f///f3///z8/v/8/P7//Pz+//v7 /f///////////////////////v7///7+///9/f///f3///Hx8//x8fP/8fHz//Hx8//w8PL/ 8PDy//Dw8v/w8PL/5+fp/+fn6f/m5uj/5eXn/+Pj5f/i4uT/4eHj/+Hh4//b293/2trc/9nZ 2//Y2Nr/19fZ/9bW2P/V1df/1NTW/9LS1P/S0tT/0dHT/9DQ0v/OztD/zc3P/8zMzv/MzM7/ y8vN/8rKzP/Kysz/ycnL/8jIyv/Hx8n/x8fJ/8bGyP/Jycv/yMjK/8fHyf/ExMb/wsLE/8DA wv++vsD/vb2//8LCxP/BwcP/vr7A/7q6vP+3t7n/s7O1/7Gxs/+vr7H/r6+x/66usP+urrD/ rq6w/62tr/+tra//ra2v/62tr/+np6n/p6ep/6amqP+lpaf/o6Ol/6KipP+hoaP/oaGj/62t r/+ioqT/oaGj/5GRk/+YmJr/pKSm/5SUlv+Kioz/lZWX/5SUlv+UlJb/lJSW/5OTlf+Tk5X/ kpKU/5KSlP+Dg4X/g4OF/4ODhf+CgoT/goKE/4KChP+BgYP/gYGD/39/gf9/f4H/f3+B/35+ gP9+foD/fn6A/319f/99fX//fX1//3Bwcv95eXv/e3t9/2trbf9wcHL/enp8/2xsbv8VFRf/ UVFT/93d3/87Oz3/MzM1/3Nzdf9fX2H/ZWVn/3x8fv91dXf/YWFj/2FhY/9oaGr/YWFj/2Nj Zf9mZmj/X19h/2lpa/9VVVf/VVVX/1ZWWP9XV1n/V1dZ/1hYWv9ZWVv/WVlb/1dXWf9XV1n/ WFha/1paXP9bW13/XV1f/15eYP9eXmD/XV1f/11dX/9eXmD/Xl5g/15eYP9fX2H/X19h/19f Yf9ra23/WVlb/1paXP9gYGL/aGhq/3Bwcv9vb3H/eXl7/3Nzdf90dHb/dXV3/3Z2eP93d3n/ eHh6/3h4ev95eXv/f3+B/4CAgv+AgIL/gYGD/4GBg/+CgoT/goKE/4ODhf+FhYf/hYWH/4WF h/+FhYf/hYWH/4WFh/+FhYf/hYWH/319f/9/f4H/goKE/4aGiP+Kioz/jo6Q/5GRk/+SkpT/ nJye/5ubnf+ampz/mZmb/5iYmv+Xl5n/l5eZ/5aWmP+cnJ7/nJye/5ycnv+dnZ//nZ2f/56e oP+enqD/np6g/6mpq/+oqKr/p6ep/6Wlp/+kpKb/oqKk/6Gho/+goKL/oKCi/6Cgov+hoaP/ oqKk/6Ojpf+kpKb/paWn/6Wlp/+mpqj/paWn/6Wlp/+kpKb/o6Ol/6KipP+hoaP/oaGj/6Gh o/+hoaP/oaGj/6Gho/+hoaP/oaGj/6Gho/+hoaP/paWn/6Wlp/+kpKb/pKSm/6Ojpf+jo6X/ o6Ol/6Ojpf+hoaP/oqKk/6KipP+jo6X/o6Ol/6Skpv+kpKb/pKSm/6KipP+jo6X/pKSm/6Wl p/+np6n/qKiq/6mpq/+pqav/qKiq/6enqf+mpqj/paWn/6Skpv+jo6X/oqKk/6Gho/+mpqj/ paWn/6Skpv+jo6X/oqKk/6Gho/+goKL/n5+h/5ycnv+bm53/mpqc/5mZm/+YmJr/l5eZ/5aW mP+VlZf/h4eJ/4eHif+Ghoj/hYWH/4SEhv+EhIb/g4OF/4ODhf9zc3X/cnJ0/3Fxc/9wcHL/ bm5w/21tb/9sbG7/a2tt/2trbf9qamz/aWlr/2dnaf9lZWf/ZGRm/2JiZP9iYmT/YWFj/2Bg Yv9gYGL/YGBi/19fYf9fX2H/X19h/15eYP9XV1n/V1dZ/1ZWWP9VVVf/VFRW/1NTVf9SUlT/ UVFT/0dHSf9MTE7/ZGRm/1BQUv9UVFb/X19h/1ZWWP9UVFb/UlJU/1NTVf9TU1X/U1NV/1NT Vf9TU1X/U1NV/1NTVf9dXV//XV1f/11dX/9cXF7/XFxe/1tbXf9bW13/W1td/19fYf9fX2H/ X19h/15eYP9eXmD/Xl5g/11dX/9dXV//ZWVn/1xcXv9hYWP/YmJk/1JSVP9UVFb/YWFj/2Fh Y/89PT//a2tt//7+///b293/1NTW/8bGyP+7u73/wcHD/7+/wf+kpKb/s7O1/6mpq/+xsbP/ rq6w/66usP+1tbf/r6+x/6+vsf+tra//ra2v/66usP+urrD/r6+x/7Cwsv+xsbP/sbGz/6qq rP+rq63/q6ut/6urrf+rq63/q6ut/6urrf+rq63/qKiq/6ioqv+pqav/qamr/6mpq/+qqqz/ qqqs/6qqrP95eXv/R0dJ/0FBQ/9FRUf/Pz9B/z8/Qf88PD7/QEBC/zc3Of83Nzn/Nzc5/zc3 Of82Njj/NjY4/zY2OP82Njj/LS0v/y0tL/8sLC7/Kyst/ysrLf8qKiz/Kios/ykpK/8hISP/ ISEj/yEhI/8hISP/ISEj/yEhI/8hISP/ISEj/yAgIv8gICL/Hx8h/x4eIP8cHB7/Gxsd/xoa HP8ZGRv/EhIU/xISFP8RERP/Dw8R/w4OEP8MDA7/CwsN/wsLDf8HBwn/BwcJ/wcHCf8ICAr/ CAgK/wgICv8JCQv/CQkL/xAQEv8PDxH/DAwO/wkJC/8FBQf/AQED/wAAAv8AAAL/AAAC/wAA Av8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/ AAAC/wEBA/8BAQP/AQED/wEBA/8BAQP/AQED/wEBA/8BAQP/AwMF/wMDBf8CAgT/AgIE/wIC BP8BAQP/AQED/wEBA/8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/AAAC/wAAAv8AAAL/ AAAC/wAAAv8AAAL/AQED/wEBA/8BAQP/AgIE/wEBA/8AAAL/AAAC/wAAAv8AAAL/AAAC/wAA Av8FBQf/BQUH/wQEBv8DAwX/AgIE/wAAAv8AAAL/AAAC/wEBA/8AAAL/AAAC/wAAAv8AAAL/ AAAC/wAAAv8AAAL/BAQG/wMDBf8DAwX/AgIE/wEBA/8AAAL/AAAC/wAAAv8DAwX/AwMF/wMD Bf8DAwX/AwMF/wICBP8CAgT/AgIE/wcHCf8ICAr/CQkL/woKDP8LCw3/DQ0P/w4OEP8ODhD/ CwsN/wsLDf8KCgz/CgoM/wkJC/8JCQv/CQkL/wkJC/8SEhT/EhIU/xERE/8QEBL/Dg4Q/w0N D/8MDA7/DAwO/wsLDf9FRUf/pKSm/6urrf+urrD/ra2v/6KipP+mpqj/rq6w/66usP+vr7H/ r6+x/7Cwsv+xsbP/sbGz/7Gxs/+xsbP/sbGz/7Gxs/+wsLL/sLCy/6+vsf+vr7H/r6+x/62t r/+tra//ra2v/62tr/+srK7/rKyu/6urrf+rq63/sLCy/7KytP+0tLb/r6+x/6qqrP+urrD/ srK0/66usP+zs7X/0NDS/+Hh4//09Pb/6enr/83Nz//c3N7/y8vN/8LCxP/R0dP/wcHD/7i4 uv/Hx8n/xMTG/7q6vP/BwcP/wsLE/8LCxP+9vb//vb2//76+wP++vsD/v7/B/8DAwv/BwcP/ wcHD/8bGyP/Fxcf/xcXH/8TExv/Dw8X/w8PF/8LCxP/CwsT/w8PF/8PDxf/Dw8X/xMTG/8TE xv/ExMb/xcXH/8XFx/+urrD/a2tt/2VlZ/9vb3H/aGhq/2xsbv9sbG7/cHBy/2hoav9nZ2n/ ZmZo/2VlZ/9kZGb/Y2Nl/2JiZP9hYWP/Xl5g/11dX/9cXF7/Wlpc/1lZW/9XV1n/VlZY/1VV V/9QUFL/UFBS/1BQUv9QUFL/UFBS/1BQUv9QUFL/UFBS/1BQUv9PT1H/TU1P/0tLTf9JSUv/ R0dJ/0ZGSP9FRUf/RUVH/0RERv9DQ0X/QUFD/z8/Qf89PT//PDw+/zw8Pv87Oz3/Ozs9/zs7 Pf88PD7/PDw+/z09P/89PT//PT0//zY2OP82Njj/NTU3/zU1N/80NDb/NDQ2/zQ0Nv80NDb/ MzM1/zQ0Nv80NDb/NDQ2/zQ0Nv80NDb/NTU3/zU1N/8yMjT/MjI0/zExM/8wMDL/Ly8x/y4u MP8uLjD/LS0v/y0tL/8tLS//LS0v/y0tL/8tLS//LS0v/y0tL/8tLS//KSkr/ykpK/8oKCr/ KCgq/ygoKv8nJyn/Jycp/ycnKf8qKiz/Kios/ysrLf8rKy3/LCwu/ywsLv8tLS//LS0v/ykp K/8pKSv/KCgq/yYmKP8lJSf/IyMl/yIiJP8iIiT/Kios/ykpK/8oKCr/Jycp/yYmKP8lJSf/ JCQm/yMjJf8lJSf/JSUn/yQkJv8jIyX/ISEj/yAgIv8fHyH/Hx8h/ykpK/8pKSv/KCgq/ycn Kf8lJSf/JCQm/yMjJf8jIyX/Jycp/yYmKP8mJij/JSUn/yQkJv8jIyX/IyMl/yIiJP8gICL/ ICAi/yAgIv8hISP/IiIk/yMjJf8jIyX/JCQm/yMjJf8jIyX/IyMl/yMjJf8jIyX/IyMl/yMj Jf8jIyX/Jycp/ycnKf8mJij/JiYo/yUlJ/8lJSf/JSUn/yUlJ/8pKSv/KCgq/ycnKf8mJij/ JSUn/yQkJv8jIyX/IyMl/xcXGf9VVVf/u7u9/76+wP/CwsT/w8PF/729v//Fxcf/wcHD/8LC xP/CwsT/w8PF/8TExv/Fxcf/xsbI/8bGyP/CwsT/wsLE/8HBw//BwcP/wcHD/8DAwv/AwML/ wMDC/8TExv/Dw8X/w8PF/8PDxf/CwsT/wsLE/8LCxP/BwcP/vb2//8nJy//IyMr/vr7A/8PD xf/Nzc//xsbI/7i4uv/Fxcf/1tbY//Dw8P/u7u7/6enp/+Li4v/c3Nz/1dXV/9DQ0P/Ozs7/ yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jI yP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/x8fH/8fHx//IyMj/ yMjI/8nJyf/Jycn/ysrK/8rKyv+Pj4//ZmZm/2pqav9nZ2f/bm5u/3Fxcf9tbW3/WVlZ/19f X/9hYWH/ZGRk/2VlZf9kZGT/YWFh/11dXf9bW1v/XV1d/1xcXP9aWlr/V1dX/1VVVf9SUlL/ UVFR/1BQUP9QUFL/T09R/05OUP9NTU//TExO/0tLTf9KSkz/SUlL/0dHSf9HR0n/RkZI/0VF R/9FRUf/RERG/0NDRf9DQ0X/Q0NF/0NDRf9CQkT/QUFD/0FBQ/9AQEL/Pz9B/z8/Qf8+PkD/ PT0//z09P/89PT//PDw+/zw8Pv88PD7/PDw+/zg4Ov84ODr/Nzc5/zc3Of82Njj/NTU3/zQ0 Nv80NDb/Li4w/y4uMP8tLS//LS0v/y0tL/8sLC7/LCwu/ywsLv8sLC7/LCwu/ywsLv8sLC7/ LCwu/ywsLv8sLC7/LCwu/ywsLv8sLC7/LCwu/ysrLf8rKy3/Kios/yoqLP8qKiz/KSkr/ykp K/8pKSv/KSkr/ykpK/8pKSv/KSkr/ykpK/8nJyn/Jycp/ycnKf8nJyn/Jycp/ycnKf8nJyn/ Jycp/yYmKP8lJSf/JSUn/yUlJ/8kJCb/JCQm/yQkJv8jIyX/ISEj/yEhI/8hISP/ISEj/yEh I/8hISP/ISEj/yEhI/8mJib/JiYm/yYmJv8mJib/JiYm/yYmJv8mJib/JiYm/yMjI/8jIyP/ IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/JCQk/yMjI/8jIyP/IyMj/yIiIv8iIiL/IiIi/yEh If8fHx//ICAg/yAgIP8gICD/ISEh/yEhIf8hISH/IiIi/x8fH/8fHx//Hx8f/x8fH/8fHx// Hx8f/x8fH/8fHx//HBwc/x0dHf8fHx//IiIi/yUlJf8nJyf/KSkp/yoqKv8lJSX/JSUl/yYm Jv8mJib/JSUl/yQkJP8iIiL/ISEh/x0dHf8+Pj7/vb29/7e3t//BwcH/wMDA/8rKyv/FxcX/ x8fH/8jIyP/IyMj/yMjI/8nJyf/Jycn/ycnJ/8nJyf/IyMj/yMjI/8jIyP/IyMj/yMjI/8jI yP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/yMjI/8jIyP/IyMj/y8vL/8vLy//Ly8v/ y8vL/8vLy//Ly8v/y8vL/8vLy//T09P/1NTU//Pz8//x8fH/7Ozs/+bm5v/g4OD/2tra/9XV 1f/T09P/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/ 0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0NDQ/9HR 0f/R0dH/0dHR/9HR0f/S0tL/0tLS/9LS0v+Ojo7/aGho/3BwcP9ra2v/aGho/2dnZ/9ubm7/ ampq/2lpaf9qamr/a2tr/2pqav9mZmb/YGBg/1paWv9VVVX/W1tb/1paWv9YWFj/VlZW/1RU VP9SUlL/UFBQ/09PT/9QUFL/UFBS/09PUf9OTlD/TExO/0tLTf9KSkz/SkpM/05OUP9NTU// TU1P/0xMTv9LS03/SkpM/0pKTP9KSkz/QkJE/0JCRP9BQUP/QEBC/0BAQv8/P0H/Pj5A/z4+ QP88PD7/PDw+/zw8Pv87Oz3/Ozs9/zs7Pf86Ojz/Ojo8/zk5O/84ODr/ODg6/zc3Of82Njj/ NTU3/zU1N/81NTf/NjY4/zU1N/81NTf/NTU3/zQ0Nv80NDb/NDQ2/zQ0Nv8rKy3/Kyst/ysr Lf8rKy3/Kyst/ysrLf8rKy3/Kyst/y4uMP8uLjD/Li4w/y4uMP8tLS//LS0v/y0tL/8sLC7/ Jycp/ycnKf8nJyn/Jycp/ycnKf8nJyn/Jycp/ycnKf8lJSf/JSUn/yUlJ/8lJSf/JSUn/yUl J/8lJSf/JSUn/ygoKv8oKCr/KCgq/ycnKf8nJyn/Jycp/yYmKP8mJij/Kios/yoqLP8qKiz/ Kios/yoqLP8qKiz/Kios/yoqLP8fHx//Hx8f/x8fH/8fHx//Hx8f/x8fH/8fHx//Hx8f/yAg IP8gICD/ICAg/yAgIP8gICD/ICAg/yAgIP8gICD/ISEh/yEhIf8hISH/ICAg/yAgIP8gICD/ Hx8f/x8fH/8jIyP/IyMj/yMjI/8kJCT/JCQk/yQkJP8lJSX/JSUl/yUlJf8lJSX/JSUl/yUl Jf8lJSX/JSUl/yUlJf8lJSX/ISEh/yEhIf8iIiL/IiIi/yIiIv8jIyP/IyMj/yMjI/8fHx// JCQk/yoqKv8vLy//Ly8v/ykpKf8iIiL/Hh4e/ycnJ/9LS0v/xsbG/8PDw//Ly8v/yMjI/87O zv/Hx8f/0NDQ/9DQ0P/R0dH/0dHR/9HR0f/S0tL/0tLS/9LS0v/R0dH/0dHR/9HR0f/R0dH/ 0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/09PT/9PT 0//T09P/09PT/9PT0//T09P/09PT/9PT0//Y2Nj/2NjY//f39//19fX/8fHx/+zs7P/n5+f/ 4uLi/97e3v/c3Nz/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d 3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/ 3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/9zc3P+hoaH/bGxs/2pqav9paWn/a2tr/2Nj Y/9jY2P/XV1d/2FhYf9gYGD/Xl5e/11dXf9dXV3/XV1d/15eXv9fX1//X19f/15eXv9dXV3/ W1tb/1lZWf9YWFj/VlZW/1ZWVv9RUVP/UFBS/1BQUv9OTlD/TU1P/0xMTv9LS03/S0tN/0RE Rv9EREb/Q0NF/0JCRP9BQUP/QUFD/0BAQv9AQEL/QUFD/0FBQ/9AQEL/Pz9B/z4+QP8+PkD/ PT0//z09P/80NDb/NDQ2/zQ0Nv8zMzX/MzM1/zMzNf8yMjT/MjI0/zMzNf8zMzX/MzM1/zIy NP8xMTP/MDAy/zAwMv8vLzH/LCwu/ywsLv8sLC7/Kyst/ysrLf8qKiz/Kios/yoqLP8wMDL/ MDAy/zAwMv8wMDL/MDAy/zAwMv8wMDL/MDAy/yoqLP8qKiz/KSkr/ykpK/8pKSv/KCgq/ygo Kv8oKCr/Kios/yoqLP8qKiz/Kios/yoqLP8qKiz/Kios/yoqLP8oKCr/KCgq/ygoKv8oKCr/ KCgq/ygoKv8oKCr/KCgq/yQkJv8kJCb/JCQm/yMjJf8jIyX/IiIk/yIiJP8iIiT/ISEj/yEh I/8hISP/ISEj/yEhI/8hISP/ISEj/yEhI/8iIiL/IiIi/yIiIv8iIiL/IiIi/yIiIv8iIiL/ IiIi/xwcHP8cHBz/HBwc/xwcHP8cHBz/HBwc/xwcHP8cHBz/HR0d/x0dHf8dHR3/HBwc/xwc HP8cHBz/Gxsb/xsbG/8bGxv/Gxsb/xsbG/8bGxv/HBwc/xwcHP8cHBz/HR0d/x4eHv8eHh7/ Hh4e/x4eHv8eHh7/Hh4e/x4eHv8eHh7/Kioq/ykpKf8oKCj/JiYm/yUlJf8jIyP/IiIi/yEh If8VFRX/GBgY/xwcHP8gICD/JCQk/ycnJ/8pKSn/Kioq/yAgIP9MTEz/xMTE/8XFxf/Nzc3/ zMzM/9XV1f/U1NT/3Nzc/93d3f/d3d3/3d3d/97e3v/e3t7/3t7e/97e3v/d3d3/3d3d/93d 3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/3d3d/93d3f/d3d3/ 39/f/9/f3//f39//39/f/9/f3//f39//39/f/9/f3//g4OD/4eHh//v7+//5+fn/9vb2//Pz 8//v7+//6+vr/+jo6P/m5ub/5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/ 5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn 5//n5+f/6Ojo/+jo6P/o6Oj/5+fn/+bm5v/l5eX/5OTk/+Tk5P9WVlb/FRUV/w0NDf8UFBT/ IiIi/ygoKP81NTX/OTk5/zQ0NP81NTX/Nzc3/zg4OP84ODj/NjY2/zQ0NP8zMzP/Kysr/ysr K/8qKir/KSkp/ycnJ/8mJib/JSUl/yUlJf8jIyX/IiIk/yEhI/8gICL/Hx8h/x4eIP8dHR// HR0f/yMjJf8iIiT/IiIk/yEhI/8gICL/Hx8h/x8fIf8fHyH/Hx8h/x8fIf8eHiD/Hh4g/x0d H/8cHB7/Gxsd/xsbHf8dHR//HR0f/xwcHv8cHB7/Gxsd/xsbHf8bGx3/Gxsd/x4eIP8eHiD/ HR0f/x0dH/8cHB7/Gxsd/xoaHP8aGhz/Hx8h/x8fIf8fHyH/Hh4g/x4eIP8eHiD/HR0f/x0d H/8VFRf/FRUX/xUVF/8VFRf/FRUX/xUVF/8VFRf/FRUX/xISFP8SEhT/EhIU/xISFP8RERP/ ERET/xERE/8QEBL/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8VFRf/FRUX/xUV F/8VFRf/FRUX/xUVF/8VFRf/FRUX/xsbHf8bGx3/Ghoc/xoaHP8aGhz/GRkb/xkZG/8ZGRv/ FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8VFRX/FRUV/xUVFf8VFRX/FRUV/xUV Ff8VFRX/FRUV/xkZGf8ZGRn/GRkZ/xkZGf8ZGRn/GRkZ/xkZGf8ZGRn/Ghoa/xoaGv8ZGRn/ GRkZ/xkZGf8YGBj/GBgY/xgYGP8VFRX/FRUV/xUVFf8VFRX/FhYW/xYWFv8XFxf/FxcX/xYW Fv8WFhb/FhYW/xYWFv8WFhb/FhYW/xYWFv8WFhb/FxcX/xcXF/8WFhb/FBQU/xMTE/8RERH/ EBAQ/w8PD/8bGxv/GRkZ/xUVFf8RERH/Dw8P/w8PD/8RERH/EhIS/w8PD/9LS0v/w8PD/8vL y//Q0ND/zs7O/93d3f/l5eX/5ubm/+bm5v/n5+f/5+fn/+fn5//o6Oj/6Ojo/+jo6P/n5+f/ 5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn5//n5+f/5+fn/+fn 5//n5+f/6enp/+np6f/p6en/6enp/+np6f/p6en/6enp/+np6f/q6ur/6urq//39/f/8/Pz/ +vr6//j4+P/19fX/8/Pz//Hx8f/w8PD/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/7u7u/+7u 7v/u7u7/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/ 7u7u/+7u7v/u7u7/8PDw//Dw8P/v7+//7e3t/+zs7P/q6ur/6enp/+jo6P9NTU3/Hx8f/ysr K/80NDT/NjY2/ysrK/8xMTH/NTU1/zY2Nv8+Pj7/SUlJ/1NTU/9XV1f/VFRU/05OTv9KSkr/ SUlJ/0lJSf9JSUn/SEhI/0hISP9HR0f/R0dH/0dHR/9BQUP/QUFD/0BAQv8/P0H/PT0//zw8 Pv87Oz3/Ozs9/zMzNf8yMjT/MjI0/zExM/8wMDL/MDAy/y8vMf8vLzH/Li4w/y4uMP8tLS// LS0v/ywsLv8rKy3/Kios/yoqLP8sLC7/Kyst/ysrLf8rKy3/Kios/yoqLP8qKiz/Kios/y4u MP8tLS//LS0v/ywsLv8rKy3/Kios/yoqLP8pKSv/IiIk/yEhI/8hISP/ISEj/yAgIv8gICL/ ICAi/x8fIf8iIiT/IiIk/yIiJP8iIiT/IiIk/yIiJP8iIiT/IiIk/x8fIf8fHyH/Hx8h/x4e IP8eHiD/Hh4g/x0dH/8dHR//HR0f/x0dH/8dHR//HR0f/x0dH/8dHR//HR0f/x0dH/8cHB7/ HBwe/xwcHv8cHB7/HBwe/xwcHv8cHB7/HBwe/xgYGv8YGBr/GBga/xgYGv8XFxn/FxcZ/xYW GP8WFhj/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZG/8dHR3/HR0d/x0dHf8dHR3/ HR0d/x0dHf8dHR3/HR0d/xcXF/8XFxf/FxcX/xcXF/8XFxf/FxcX/xcXF/8XFxf/GBgY/xgY GP8XFxf/FxcX/xcXF/8WFhb/FhYW/xYWFv8ZGRn/GRkZ/xkZGf8aGhr/Ghoa/xsbG/8bGxv/ Gxsb/xgYGP8YGBj/GBgY/xgYGP8YGBj/GBgY/xgYGP8YGBj/HBwc/xwcHP8cHBz/HBwc/xsb G/8bGxv/Gxsb/xsbG/8MDAz/Dg4O/xMTE/8XFxf/GRkZ/xkZGf8YGBj/FxcX/wEBAf9MTEz/ xsbG/9jY2P/b29v/1tbW/+Pj4//u7u7/7e3t/+3t7f/t7e3/7u7u/+7u7v/u7u7/7+/v/+/v 7//u7u7/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/7u7u/+7u7v/u7u7/ 7u7u/+7u7v/u7u7/7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//y8vL/8vLy//39 /f/9/f3//Pz8//v7+//5+fn/+Pj4//f39//39/f/9PT0//T09P/09PT/9PT0//T09P/09PT/ 9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T0 9P/09PT/9PT0//T09P/09PT/+Pj4//f39//19fX/8/Pz//Hx8f/v7+//7e3t/+zs7P9TU1P/ JCQk/yoqKv8uLi7/MDAw/ykpKf8rKyv/JiYm/yQkJP8mJib/KSkp/y4uLv8yMjL/NjY2/zg4 OP86Ojr/Ojo6/zo6Ov86Ojr/Ojo6/zo6Ov87Ozv/Ozs7/zs7O/85OTv/ODg6/zc3Of82Njj/ NTU3/zQ0Nv8zMzX/MjI0/zU1N/80NDb/NDQ2/zMzNf8yMjT/MTEz/zExM/8wMDL/MjI0/zIy NP8xMTP/MTEz/zAwMv8vLzH/Li4w/y4uMP8mJij/JSUn/yUlJ/8lJSf/JCQm/yQkJv8kJCb/ IyMl/yYmKP8mJij/JSUn/yUlJ/8kJCb/IyMl/yIiJP8iIiT/IyMl/yIiJP8iIiT/IiIk/yEh I/8hISP/ISEj/yAgIv8fHyH/Hx8h/x8fIf8fHyH/Hx8h/x8fIf8fHyH/Hx8h/xkZG/8ZGRv/ GRkb/xgYGv8YGBr/GBga/xcXGf8XFxn/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgY Gv8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/FxcZ/x0dH/8dHR//HR0f/xwcHv8cHB7/ HBwe/xsbHf8bGx3/HBwe/xwcHv8cHB7/HBwe/xwcHv8cHB7/HBwe/xwcHv8TExP/ExMT/xMT E/8TExP/ExMT/xMTE/8TExP/ExMT/xcXF/8XFxf/FxcX/xcXF/8XFxf/FxcX/xcXF/8XFxf/ GBgY/xgYGP8XFxf/FxcX/xcXF/8WFhb/FhYW/xYWFv8WFhb/FxcX/xcXF/8XFxf/GBgY/xgY GP8YGBj/GRkZ/xcXF/8XFxf/FxcX/xcXF/8XFxf/FxcX/xcXF/8XFxf/FxcX/xcXF/8XFxf/ FxcX/xcXF/8YGBj/GBgY/xgYGP8hISH/ICAg/x4eHv8cHBz/Gxsb/xoaGv8aGhr/Gxsb/wUF Bf9SUlL/vr6+/9fX1//g4OD/3t7e/+bm5v/u7u7/8/Pz//Pz8//z8/P/9PT0//T09P/19fX/ 9fX1//X19f/09PT/9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T0 9P/09PT/9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T09P/09PT/9PT0//T09P/4+Pj/ +Pj4//z8/P/8/Pz//Pz8//z8/P/8/Pz/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7 +//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/ +/v7//v7+//7+/v/+/v7//v7+//7+/v////////////9/f3/+/v7//j4+P/19fX/8/Pz//Ly 8v9wcHD/MjIy/x8fH/8RERH/GBgY/yQkJP8vLy//KSkp/zY2Nv8zMzP/Li4u/yoqKv8pKSn/ LCws/zAwMP8yMjL/LCws/ywsLP8tLS3/LS0t/y4uLv8vLy//Ly8v/zAwMP81NTf/NTU3/zQ0 Nv8zMzX/MjI0/zExM/8wMDL/Ly8x/zAwMv8vLzH/Ly8x/y4uMP8tLS//LCwu/ywsLv8sLC7/ LS0v/y0tL/8sLC7/Kyst/ysrLf8qKiz/KSkr/ykpK/8nJyn/Jycp/ycnKf8mJij/JiYo/yYm KP8lJSf/JSUn/yYmKP8mJij/JSUn/yQkJv8jIyX/IyMl/yIiJP8iIiT/Hh4g/x4eIP8dHR// HR0f/x0dH/8cHB7/HBwe/xwcHv8bGx3/Gxsd/xsbHf8bGx3/Gxsd/xsbHf8bGx3/Gxsd/x4e IP8eHiD/Hh4g/x4eIP8dHR//HR0f/x0dH/8cHB7/Hx8h/x8fIf8fHyH/Hx8h/x8fIf8fHyH/ Hx8h/x8fIf8fHyH/Hx8h/x8fIf8fHyH/Hx8h/x8fIf8fHyH/Hx8h/x4eIP8eHiD/HR0f/x0d H/8dHR//HBwe/xwcHv8cHB7/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8bGxv/ Gxsb/xsbG/8bGxv/Gxsb/xsbG/8bGxv/Gxsb/xgYGP8YGBj/GBgY/xgYGP8YGBj/GBgY/xgY GP8YGBj/GRkZ/xkZGf8YGBj/GBgY/xgYGP8XFxf/FxcX/xcXF/8TExP/ExMT/xQUFP8UFBT/ FBQU/xUVFf8VFRX/FRUV/xoaGv8aGhr/Ghoa/xoaGv8aGhr/Ghoa/xoaGv8aGhr/JSUl/yQk JP8iIiL/ISEh/x8fH/8dHR3/Gxsb/xsbG/8hISH/Gxsb/xEREf8JCQn/BgYG/wgICP8MDAz/ EBAQ/1FRUf+EhIT/xcXF/9DQ0P/c3Nz/4+Pj/+zs7P/w8PD/+vr6//r6+v/7+/v/+/v7//v7 +//8/Pz//Pz8//z8/P/7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/ +/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7+//7+/v/+/v7//v7 +//7+/v/+/v7//v7+//7+/v//Pz8//z8/P/8/Pz//f39//39/f/9/f3///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////39/f/6+vr/ +Pj4//f39//09PT/ysrK/8LCwv+goKD/e3t7/1JSUv8wMDD/Dg4O/w0NDf8WFhb/IyMj/zAw MP84ODj/Ojo6/zg4OP82Njb/Ojo6/zo6Ov87Ozv/PDw8/z09Pf8+Pj7/Pz8//z8/P/8xMTP/ MTEz/zAwMv8vLzH/Li4w/y0tL/8sLC7/Kyst/xoaHP8aGhz/GRkb/xkZG/8YGBr/FxcZ/xYW GP8WFhj/KCgq/ycnKf8nJyn/JiYo/yUlJ/8kJCb/JCQm/yQkJv8iIiT/IiIk/yIiJP8hISP/ ISEj/yEhI/8gICL/ICAi/x8fIf8fHyH/Hh4g/x4eIP8dHR//HBwe/xsbHf8bGx3/Hx8h/x4e IP8eHiD/Hh4g/x0dH/8dHR//HR0f/xwcHv8dHR//HR0f/x0dH/8dHR//HR0f/x0dH/8dHR// HR0f/x0dH/8dHR//HR0f/xwcHv8cHB7/HBwe/xsbHf8bGx3/FhYY/xYWGP8WFhj/FhYY/xYW GP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xYWGP8WFhj/FhYY/xkZG/8ZGRv/ GRkb/xkZG/8YGBr/GBga/xcXGf8XFxn/GRkb/xkZG/8ZGRv/GRkb/xkZG/8ZGRv/GRkb/xkZ G/8YGBj/GBgY/xgYGP8YGBj/GBgY/xgYGP8YGBj/GBgY/xkZGf8ZGRn/GRkZ/xkZGf8ZGRn/ GRkZ/xkZGf8ZGRn/Ghoa/xoaGv8ZGRn/GRkZ/xkZGf8YGBj/GBgY/xgYGP8aGhr/Ghoa/xoa Gv8bGxv/Gxsb/xsbG/8cHBz/HBwc/yYmJv8mJib/JiYm/yYmJv8mJib/JiYm/yYmJv8mJib/ IiIi/yEhIf8eHh7/Ghoa/xUVFf8RERH/Dg4O/w0NDf8SEhL/Hh4e/zY2Nv9UVFT/d3d3/5eX l/+xsbH/v7+//76+vv/Q0ND/4uLi/9TU1P/d3d3/6enp//Ly8v/19fX///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////9/f3//f39//////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////+/v7//f39//z8 /P/8/Pz/+/v7//v7+//r6+v/5+fn/+Hh4f/Z2dn/0NDQ/8fHx//BwcH/vb29/5WVlf9+fn7/ Wlpa/zY2Nv8cHBz/EhIS/xISEv8WFhb/Hx8f/ykpKf82Njb/PDw8/z09Pf8+Pj7/QUFB/0RE RP9AQEL/RERG/0hISv9NTU//UFBS/1FRU/9QUFL/T09R/1NTVf9RUVP/TU1P/0lJS/9EREb/ Pz9B/zw8Pv86Ojz/JSUn/yIiJP8dHR//FhYY/xAQEv8JCQv/BAQG/wEBA/8AAAL/AQED/wMD Bf8GBgj/CQkL/wwMDv8PDxH/EBAS/xcXGf8XFxn/FxcZ/xgYGv8aGhz/HBwe/x8fIf8gICL/ HBwe/xwcHv8bGx3/Gxsd/xsbHf8bGx3/Ghoc/xoaHP8eHiD/Hh4g/x0dH/8dHR//HBwe/xwc Hv8bGx3/Gxsd/x0dH/8cHB7/Gxsd/xkZG/8YGBr/FhYY/xUVF/8UFBb/Ghoc/xkZG/8YGBr/ FxcZ/xUVF/8UFBb/ExMV/xMTFf8YGBr/GBga/xgYGv8YGBr/GBga/xgYGv8YGBr/GBga/w4O EP8PDxH/EhIU/xUVF/8YGBr/HBwe/x4eIP8fHyH/FhYY/xYWGP8WFhj/FhYY/xcXGf8XFxn/ FxcZ/xcXGf8SEhL/EhIS/xISEv8TExP/ExMT/xMTE/8UFBT/FBQU/wsLC/8MDAz/Dg4O/xER Ef8UFBT/FxcX/xkZGf8aGhr/Hh4e/x8fH/8gICD/ISEh/yMjI/8lJSX/JiYm/ycnJ/8wMDD/ Ly8v/y4uLv8tLS3/LCws/y0tLf8uLi7/Li4u/ycnJ/8sLCz/Ly8v/ywsLP8iIiL/GBgY/xMT E/8RERH/ExMT/w0NDf8GBgb/CgoK/x4eHv8/Pz//YmJi/3h4eP+zs7P/tLS0/7a2tv+4uLj/ urq6/729vf++vr7/v7+//8zMzP/Q0ND/1tbW/97e3v/m5ub/7u7u//T09P/4+Pj///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////+/v7/ /f39//39/f/8/Pz/+/v7//v7+//s7Oz/6enp/+Pj4//b29v/09PT/8vLy//FxcX/wsLC/8vL y//Gxsb/vr6+/7Kysv+lpaX/mJiY/46Ojv+IiIj/ampq/11dXf9KSkr/ODg4/ywsLP8oKCj/ KCgo/ygoKP89PT//PT0//z8/Qf9DQ0X/SUlL/1FRU/9ZWVv/XV1f/15eYP9hYWP/ZmZo/21t b/90dHb/e3t9/4CAgv+Dg4X/hYWH/4SEhv+Dg4X/gYGD/35+gP98fH7/enp8/3p6fP90dHb/ cXFz/2xsbv9mZmj/YGBi/1paXP9VVVf/U1NV/zs7Pf84ODr/MzM1/ywsLv8kJCb/Gxsd/xUV F/8RERP/FRUX/xQUFv8TExX/ERET/w8PEf8NDQ//DAwO/wsLDf8VFRf/FhYY/xYWGP8XFxn/ FxcZ/xgYGv8YGBr/GBga/xcXGf8XFxn/FhYY/xYWGP8VFRf/FRUX/xQUFv8UFBb/ERET/xIS FP8TExX/FBQW/xYWGP8XFxn/GBga/xkZG/8XFxn/FxcZ/xcXGf8XFxn/FxcZ/xcXGf8XFxn/ FxcZ/x4eIP8eHiD/HBwe/xsbHf8ZGRv/FxcZ/xYWGP8WFhj/Hx8h/x4eIP8eHiD/HBwe/xsb Hf8aGhz/GRkb/xkZG/8lJSX/JSUl/yYmJv8mJib/Jycn/ygoKP8oKCj/KSkp/zg4OP84ODj/ OTk5/zk5Of85OTn/OTk5/zk5Of85OTn/Nzc3/zg4OP84ODj/ODg4/zk5Of85OTn/Ojo6/zo6 Ov8qKir/LS0t/zExMf8yMjL/Li4u/yUlJf8bGxv/FBQU/wkJCf8LCwv/DQ0N/xEREf8ZGRn/ Kioq/0BAQP9PT0//YmJi/21tbf+AgID/lZWV/6ampv+xsbH/t7e3/7m5uf+6urr/u7u7/729 vf+/v7//wsLC/8TExP/Gxsb/x8fH/9DQ0P/T09P/2dnZ/+Dg4P/o6Oj/8PDw//X19f/4+Pj/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///+/v7//v7+//39/f/8/Pz//Pz8//v7+//v7+//7Ozs/+fn5//g4OD/2dnZ/9LS0v/Nzc3/ ysrK/8bGxv/Hx8f/ycnJ/8nJyf/Gxsb/wcHB/7y8vP+5ubn/x8fH/8PDw/+/v7//vr6+/7u7 u/+wsLD/oKCg/5KSkv9XV1n/U1NV/0xMTv9EREb/PT0//zo6PP84ODr/Nzc5/05OUP9RUVP/ V1dZ/15eYP9mZmj/bm5w/3R0dv93d3n/i4uN/46OkP+Tk5X/mZmb/6Cgov+mpqj/q6ut/62t r//Dw8X/xMTG/8bGyP/IyMr/y8vN/87O0P/Q0NL/0dHT/8TExv/Dw8X/v7/B/7i4uv+urrD/ oaGj/5aWmP+Pj5H/hoaI/4KChP96enz/b29x/2RkZv9aWlz/UlJU/01NT/9NTU//S0tN/0ZG SP9AQEL/Ojo8/zQ0Nv8vLzH/LS0v/zIyNP8yMjT/MjI0/zIyNP8xMTP/MTEz/zExM/8xMTP/ KSkr/ykpK/8qKiz/Kyst/y0tL/8uLjD/Ly8x/zAwMv8qKiz/Kios/yoqLP8qKiz/Kios/yoq LP8qKiz/Kios/ysrLf8rKy3/LCwu/y0tL/8uLjD/Ly8x/zAwMv8wMDL/MjI0/zIyNP80NDb/ NTU3/zc3Of84ODr/OTk7/zo6PP86Ojr/PT09/0FBQf9GRkb/TExM/1FRUf9VVVX/V1dX/0dH R/9ISEj/SkpK/0xMTP9OTk7/UFBQ/1JSUv9SUlL/SEhI/0ZGRv9BQUH/PDw8/zU1Nf8wMDD/ LCws/ykpKf8WFhb/EBAQ/wkJCf8JCQn/FBQU/ykpKf9AQED/T09P/3Fxcf9+fn7/kZGR/6Cg oP+pqan/r6+v/7W1tf+5ubn/wMDA/8DAwP+/v7//v7+//8HBwf/ExMT/x8fH/8rKyv/FxcX/ xsbG/8jIyP/Kysr/zMzM/8/Pz//Q0ND/0dHR/9bW1v/Z2dn/3t7e/+Tk5P/r6+v/8vLy//f3 9//5+fn///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////v7+//39/f/9/f3//Pz8//z8/P/z8/P/8fHx/+zs7P/n5+f/4eHh/9vb 2//X19f/1NTU/9XV1f/T09P/z8/P/8zMzP/Ly8v/zc3N/8/Pz//R0dH/xcXF/8LCwv+/v7// vr6+/7+/v/+9vb3/uLi4/7Ozs/+8vL7/u7u9/7m5u/+1tbf/rq6w/6Wlp/+dnZ//mZmb/3R0 dv9zc3X/c3N1/3JydP9wcHL/b29x/29vcf9ubnD/bm5w/3JydP94eHr/gICC/4mJi/+RkZP/ l5eZ/5ubnf+qqqz/rKyu/7Cwsv+1tbf/urq8/8DAwv/ExMb/xsbI/7+/wf/BwcP/xMTG/8PD xf++vsD/tbW3/6urrf+lpaf/nJye/5iYmv+SkpT/iYmL/39/gf92dnj/b29x/2xsbv9cXF7/ Wlpc/1ZWWP9RUVP/TExO/0dHSf9EREb/QkJE/0JCRP9BQUP/Pz9B/z09P/87Oz3/OTk7/zg4 Ov83Nzn/MjI0/zExM/8wMDL/Ly8x/y0tL/8sLC7/Kyst/yoqLP8sLC7/LCwu/ywsLv8sLC7/ LCwu/ywsLv8sLC7/LCwu/y4uMP8uLjD/LS0v/ywsLv8rKy3/Kios/ykpK/8oKCr/MDAy/zAw Mv8wMDL/MDAy/zAwMv8wMDL/MDAy/zAwMv8/Pz//Pz8//z4+Pv88PDz/Ozs7/zk5Of84ODj/ ODg4/zo6Ov84ODj/NTU1/zAwMP8rKyv/JiYm/yMjI/8hISH/Li4u/zMzM/87Ozv/RkZG/1JS Uv9dXV3/ZWVl/2pqav93d3f/hISE/5mZmf+tra3/uLi4/7q6uv+1tbX/sLCw/7y8vP/BwcH/ xsbG/8bGxv/Dw8P/wcHB/8TExP/IyMj/w8PD/8PDw//CwsL/wsLC/8LCwv/CwsL/w8PD/8TE xP/Ozs7/z8/P/9DQ0P/T09P/1dXV/9jY2P/Z2dn/2tra/97e3v/h4eH/5eXl/+rq6v/w8PD/ 9fX1//n5+f/7+/v///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////7+/v/9/f3//Pz8//z8/P/39/f/9fX1//Ly8v/u7u7/ 6enp/+Xl5f/h4eH/4ODg/9nZ2f/Y2Nj/19fX/9XV1f/S0tL/0NDQ/87Ozv/Nzc3/1NTU/9LS 0v/Nzc3/xcXF/7+/v//AwMD/xsbG/8zMzP+/v8H/wcHD/8TExv/Fxcf/xcXH/8PDxf/AwML/ vr7A/8rKzP/IyMr/xsbI/8LCxP++vsD/u7u9/7i4uv+2trj/oKCi/6Gho/+ioqT/pKSm/6am qP+np6n/qKiq/6mpq/+ioqT/oqKk/6KipP+jo6X/o6Ol/6Ojpf+kpKb/pKSm/5ubnf+enqD/ oqKk/6Skpv+ioqT/m5ud/5OTlf+OjpD/goKE/4CAgv97e33/dXV3/25ucP9oaGr/Y2Nl/2Fh Y/9UVFb/UlJU/05OUP9JSUv/RERG/z8/Qf87Oz3/OTk7/z09P/87Oz3/ODg6/zQ0Nv8vLzH/ Kyst/ygoKv8nJyn/Jycp/ycnKf8mJij/JCQm/yMjJf8hISP/ICAi/yAgIv8cHB7/HBwe/xwc Hv8cHB7/HBwe/xwcHv8cHB7/HBwe/yEhI/8hISP/IiIk/yMjJf8kJCb/JSUn/yYmKP8mJij/ KSkr/ywsLv8vLzH/NTU3/zo6PP8/P0H/Q0NF/0VFR/9ERET/R0dH/01NTf9VVVX/Xl5e/2Zm Zv9sbGz/cHBw/319ff+AgID/hoaG/42Njf+UlJT/m5ub/6CgoP+jo6P/t7e3/7e3t/+4uLj/ urq6/7u7u/+9vb3/vr6+/76+vv/IyMj/xcXF/8LCwv/AwMD/v7+//8DAwP/BwcH/w8PD/8TE xP/ExMT/wsLC/76+vv+7u7v/vr6+/8fHx//Pz8//wcHB/8XFxf/Kysr/0NDQ/9TU1P/W1tb/ 19fX/9fX1//V1dX/1tbW/9jY2P/a2tr/3d3d/9/f3//h4eH/4uLi/+fn5//p6en/7Ozs//Dw 8P/09PT/+Pj4//v7+//9/f3///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////7+/v/+/v7//f39//39/f/7+/v/+vr6//f3 9//09PT/8fHx/+7u7v/r6+v/6urq/+fn5//n5+f/5eXl/+Pj4//h4eH/3t7e/9zc3P/b29v/ yMjI/9HR0f/a2tr/3Nzc/9bW1v/Q0ND/0NDQ/9LS0v/U1Nb/0dHT/8zMzv/Hx8n/xMTG/8PD xf/Dw8X/xMTG/8bGyP/Fxcf/xMTG/8PDxf/CwsT/wMDC/7+/wf+/v8H/x8fJ/8bGyP/Fxcf/ w8PF/8HBw/+/v8H/vr7A/729v/+8vL7/vb2//76+wP+/v8H/wcHD/8LCxP/Dw8X/xMTG/8fH yf/Jycv/zc3P/87O0P/Nzc//ycnL/8XFx//BwcP/s7O1/7Gxs/+tra//qKiq/6Ojpf+enqD/ mpqc/5iYmv+SkpT/kJCS/4uLjf+FhYf/f3+B/3l5e/90dHb/cnJ0/2FhY/9fX2H/XFxe/1hY Wv9UVFb/UFBS/01NT/9LS03/TU1P/01NT/9OTlD/UFBS/1FRU/9SUlT/U1NV/1RUVv9hYWP/ YWFj/2FhY/9hYWP/YWFj/2FhY/9hYWP/YWFj/3l5e/97e33/fn6A/4ODhf+IiIr/jY2P/5CQ kv+SkpT/np6g/6Gho/+np6n/r6+x/7e3uf++vsD/xMTG/8fHyf/BwcH/wMDA/8DAwP/AwMD/ wMDA/8DAwP/AwMD/v7+//7+/v/+/v7//v7+//8DAwP/AwMD/wMDA/8DAwP/AwMD/wcHB/8HB wf/BwcH/wcHB/8HBwf/BwcH/wMDA/8DAwP+/v7//vr6+/729vf+9vb3/vr6+/8HBwf/ExMT/ xsbG/7u7u//ExMT/zs7O/9TU1P/V1dX/09PT/9XV1f/X19f/2NjY/9XV1f/S0tL/0NDQ/9LS 0v/Y2Nj/39/f/+Tk5P/e3t7/39/f/+Hh4f/j4+P/5ubm/+jo6P/q6ur/6+vr//Dw8P/x8fH/ 8/Pz//X19f/4+Pj/+/v7//39/f/+/v7///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////+/v7//f39//39/f/+/v7/ /f39//v7+//5+fn/9/f3//X19f/z8/P/8vLy//T09P/x8fH/7Ozs/+jo6P/l5eX/5eXl/+bm 5v/n5+f/4+Pj/+Li4v/g4OD/3d3d/9ra2v/Z2dn/2tra/9vb2//c3N7/2trc/9XV1//S0tT/ 0NDS/9DQ0v/R0dP/09PV/8zMzv/MzM7/zMzO/8vLzf/Ly83/ysrM/8rKzP/Jycv/xMTG/8PD xf/Dw8X/wsLE/8HBw//AwML/wMDC/7+/wf+/v8H/v7/B/7+/wf++vsD/vr7A/729v/+9vb// vb2//7+/wf/AwML/wMDC/8DAwv/AwML/vr7A/729v/+8vL7/vr7A/76+wP/AwML/wsLE/8TE xv/Fxcf/x8fJ/8jIyv/ExMb/xMTG/8XFx//Fxcf/xsbI/8bGyP/Hx8n/x8fJ/8HBw//BwcP/ wMDC/7+/wf+9vb//vLy+/7u7vf+7u73/urq8/7q6vP+7u73/vb2//76+wP/AwML/wcHD/8HB w//BwcP/wcHD/8HBw//BwcP/wcHD/8HBw//BwcP/wcHD/8PDxf/Dw8X/wsLE/8HBw//BwcP/ wMDC/7+/wf+/v8H/vr7A/729v/+9vb//vb2//729v/+8vL7/vLy+/7y8vv+6urr/urq6/7y8 vP++vr7/wMDA/8LCwv/Dw8P/xMTE/7y8vP+9vb3/v7+//8HBwf/Dw8P/xcXF/8fHx//IyMj/ zMzM/8vLy//Ly8v/ysrK/8nJyf/IyMj/yMjI/8jIyP/MzMz/zMzM/83Nzf/Pz8//0tLS/9bW 1v/a2tr/3Nzc/87Ozv/S0tL/1NTU/9PT0//R0dH/09PT/9nZ2f/e3t7/1tbW/9nZ2f/e3t7/ 4+Pj/+bm5v/o6Oj/6Ojo/+fn5//p6en/6enp/+vr6//u7u7/8PDw//Ly8v/09PT/9fX1//b2 9v/39/f/+Pj4//r6+v/8/Pz//f39//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////+/v7//f39//39 /f////////////39/f/8/Pz/+vr6//j4+P/39/f/9/f3//j4+P/39/f/9PT0//Hx8f/t7e3/ 6enp/+bm5v/l5eX/6urq/+Xl5f/h4eH/4+Pj/+fn5//o6Oj/5OTk/9/f3//X19n/2Nja/9vb 3f/c3N7/3Nze/9nZ2//W1tj/09PV/9TU1v/U1Nb/1NTW/9TU1v/U1Nb/09PV/9PT1f/T09X/ 1dXX/9TU1v/S0tT/0dHT/8/P0f/Nzc//zMzO/8vLzf/Ly83/y8vN/8vLzf/Ly83/y8vN/8vL zf/Kysz/ysrM/83Nz//Ly83/yMjK/8TExv/BwcP/v7/B/76+wP++vsD/vb2//729v/+9vb// vb2//7y8vv+8vL7/vLy+/7y8vv/BwcP/wcHD/8DAwv/AwML/v7/B/7+/wf++vsD/vr7A/7u7 vf+8vL7/vb2//7+/wf/AwML/wsLE/8PDxf/ExMb/wcHD/8DAwv+/v8H/vr7A/7y8vv+7u73/ urq8/7m5u//Dw8X/w8PF/8PDxf/Dw8X/w8PF/8PDxf/Dw8X/w8PF/7+/wf+/v8H/v7/B/7+/ wf+/v8H/v7/B/7+/wf+/v8H/wMDC/8DAwv/CwsT/xMTG/8fHyf/Jycv/ysrM/8vLzf/Hx8f/ x8fH/8fHx//IyMj/yMjI/8nJyf/Jycn/ycnJ/8/Pz//Pz8//z8/P/87Ozv/Ozs7/zs7O/83N zf/Nzc3/z8/P/9DQ0P/R0dH/0tLS/9TU1P/V1dX/1tbW/9fX1//U1NT/1tbW/9nZ2f/c3Nz/ 3d3d/93d3f/c3Nz/29vb/9zc3P/h4eH/5eXl/+Tk5P/h4eH/4ODg/+Tk5P/o6Oj/6+vr/+rq 6v/o6Oj/5+fn/+fn5//p6en/6+vr/+3t7f/w8PD/8fHx//Pz8//19fX/+Pj4//r6+v/8/Pz/ /f39//n5+f/6+vr/+/v7//z8/P/9/f3///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////n5+f/4+Pj/+Pj4//j4 +P/39/f/9/f3//f39//29vb/8fHx//Hx8f/w8PD/8PDw/+/v7//u7u7/7e3t/+3t7f/p6en/ 6enp/+jo6P/o6Oj/5+fn/+bm5v/l5eX/5eXl/+Xl5f/k5OT/5OTk/+Pj4//i4uL/4eHh/+Hh 4f/h4eH/3d3d/93d3f/c3Nz/3Nzc/9vb2//a2tr/2dnZ/9nZ2f/W1tb/1tbW/9bW1v/W1tb/ 1dXV/9XV1f/V1dX/1NTU/9PT0//T09P/0tLS/9HR0f/R0dH/0NDQ/8/Pz//Pz8//zc3N/83N zf/MzMz/zMzM/8vLy//Kysr/ysrK/8nJyf/Kysr/ysrK/8rKyv/Jycn/ycnJ/8jIyP/IyMj/ yMjI/8nJyf/Jycn/ycnJ/8jIyP/IyMj/x8fH/8fHx//Hx8f/yMjI/8jIyP/IyMj/yMjI/8jI yP/IyMj/yMjI/8jIyP/Jycn/ycnJ/8nJyf/Jycn/ycnJ/8nJyf/Jycn/ycnJ/8nJyf/Jycn/ ysrK/8rKyv/Kysr/y8vL/8vLy//Ly8v/zc3N/83Nzf/Ozs7/zs7O/8/Pz//Q0ND/0NDQ/9HR 0f/R0dH/0dHR/9LS0v/T09P/1NTU/9TU1P/V1dX/1dXV/9bW1v/W1tb/19fX/9fX1//Y2Nj/ 2dnZ/9nZ2f/a2tr/29vb/9zc3P/c3Nz/3d3d/97e3v/f39//39/f/9/f3//k5OT/5OTk/+Xl 5f/m5ub/5ubm/+fn5//o6Oj/6Ojo/+rq6v/q6ur/6+vr/+vr6//s7Oz/7e3t/+3t7f/u7u7/ 8PDw//Hx8f/x8fH/8vLy//Pz8//09PT/9PT0//X19f/9/f3//f39//39/f/9/f3//f39//39 /f/9/f3//f39//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////v7+//6+vr/ +vr6//r6+v/5+fn/+fn5//n5+f/5+fn/9/f3//b29v/29vb/9fX1//T09P/09PT/8/Pz//Pz 8//v7+//7+/v/+7u7v/t7e3/7e3t/+zs7P/r6+v/6+vr/+vr6//q6ur/6urq/+np6f/o6Oj/ 5+fn/+fn5//m5ub/5eXl/+Xl5f/k5OT/4+Pj/+Li4v/i4uL/4eHh/+Hh4f/e3t7/3t7e/97e 3v/d3d3/3d3d/93d3f/c3Nz/3Nzc/9vb2//b29v/2tra/9nZ2f/Y2Nj/2NjY/9fX1//X19f/ 1dXV/9XV1f/U1NT/1NTU/9PT0//S0tL/0dHR/9HR0f/S0tL/0tLS/9HR0f/R0dH/0dHR/9DQ 0P/Q0ND/0NDQ/9HR0f/R0dH/0NDQ/9DQ0P/Q0ND/z8/P/8/Pz//Pz8//0NDQ/9DQ0P/Q0ND/ 0NDQ/9DQ0P/Q0ND/0NDQ/9DQ0P/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR0f/R0dH/0dHR/9HR 0f/R0dH/0dHR/9LS0v/S0tL/09PT/9PT0//T09P/1NTU/9XV1f/V1dX/1tbW/9fX1//Y2Nj/ 2NjY/9nZ2f/Z2dn/2dnZ/9ra2v/b29v/29vb/9zc3P/d3d3/3d3d/93d3f/e3t7/3t7e/9/f 3//g4OD/4eHh/+Hh4f/i4uL/4+Pj/+Pj4//k5OT/5eXl/+Xl5f/m5ub/5+fn/+fn5//q6ur/ 6urq/+vr6//r6+v/7Ozs/+3t7f/u7u7/7u7u/+/v7//w8PD/8PDw//Hx8f/y8vL/8/Pz//Pz 8//z8/P/9vb2//b29v/39/f/+Pj4//j4+P/5+fn/+vr6//r6+v/9/f3//f39//39/f/9/f3/ /f39//39/f/9/f3//f39//////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////7+ /v/+/v7//f39//39/f/9/f3//Pz8//z8/P/8/Pz//f39//z8/P/8/Pz/+/v7//r6+v/5+fn/ +fn5//n5+f/29vb/9fX1//X19f/09PT/8/Pz//Ly8v/y8vL/8vLy//Hx8f/x8fH/8PDw//Dw 8P/v7+//7u7u/+3t7f/t7e3/7u7u/+7u7v/t7e3/7Ozs/+vr6//r6+v/6urq/+rq6v/o6Oj/ 6Ojo/+fn5//n5+f/5ubm/+bm5v/m5ub/5ubm/+Tk5P/k5OT/4+Pj/+Pj4//i4uL/4eHh/+Dg 4P/g4OD/39/f/97e3v/e3t7/3d3d/9zc3P/b29v/29vb/9ra2v/b29v/29vb/9vb2//b29v/ 2tra/9ra2v/Z2dn/2dnZ/9ra2v/a2tr/2tra/9nZ2f/Z2dn/2dnZ/9jY2P/Y2Nj/2dnZ/9nZ 2f/Z2dn/2dnZ/9nZ2f/Z2dn/2dnZ/9nZ2f/a2tr/2tra/9ra2v/a2tr/2tra/9ra2v/a2tr/ 2tra/9ra2v/b29v/29vb/9vb2//c3Nz/3Nzc/9zc3P/c3Nz/3t7e/97e3v/f39//4ODg/+Dg 4P/h4eH/4uLi/+Li4v/i4uL/4+Pj/+Pj4//k5OT/5eXl/+bm5v/m5ub/5+fn/+fn5//n5+f/ 6Ojo/+np6f/p6en/6urq/+vr6//r6+v/7Ozs/+zs7P/t7e3/7u7u/+/v7//v7+//8PDw//Dw 8P/w8PD/8fHx//Hx8f/y8vL/8/Pz//T09P/09PT/9fX1//b29v/29vb/9/f3//f39//4+Pj/ +fn5//n5+f/6+vr//Pz8//z8/P/9/f3//v7+//7+/v/////////////////9/f3//f39//39 /f/9/f3//f39//39/f/9/f3//f39//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////wAOAQAAAwAAAAEBAgAAAQEAAwAAAAEAwwAA AQIAAwAAAAQAAxLOAQMAAwAAAAEAAQAAAQYAAwAAAAEAAgAAAREABAAAAAIAAxLeARIAAwAA AAEAAQAAARUAAwAAAAEABAAAARYAAwAAAAEAfwAAARcABAAAAAIAAxLWARwAAwAAAAEAAQAA AVIAAwAAAAEAAQAAAVMAAwAAAAQAAxLmh3MABwAAB9gAAxLuAAAAAAAIAAgACAAIAAH/+AAB EiAAAAAIAAIAAAABAAEAAQABAAAH2GFwcGwCIAAAbW50clJHQiBYWVogB9kAAgAZAAsAGgAL YWNzcEFQUEwAAAAAYXBwbAAAAAAAAAAAAAAAAAAAAAAAAPbWAAEAAAAA0y1hcHBsAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALZGVzYwAAAQgAAABv ZHNjbQAAAXgAAAWcY3BydAAABxQAAAA4d3RwdAAAB0wAAAAUclhZWgAAB2AAAAAUZ1hZWgAA B3QAAAAUYlhZWgAAB4gAAAAUclRSQwAAB5wAAAAOY2hhZAAAB6wAAAAsYlRSQwAAB5wAAAAO Z1RSQwAAB5wAAAAOZGVzYwAAAAAAAAAUR2VuZXJpYyBSR0IgUHJvZmlsZQAAAAAAAAAAAAAA FEdlbmVyaWMgUkdCIFByb2ZpbGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAG1sdWMAAAAAAAAAHwAAAAxza1NLAAAAKAAAAYRkYURLAAAALgAA AaxjYUVTAAAAJAAAAdp2aVZOAAAAJAAAAf5wdEJSAAAAJgAAAiJ1a1VBAAAAKgAAAkhmckZV AAAAKAAAAnJodUhVAAAAKAAAApp6aFRXAAAAFgAAAsJuYk5PAAAAJgAAAthjc0NaAAAAIgAA Av5oZUlMAAAAHgAAAyBpdElUAAAAKAAAAz5yb1JPAAAAJAAAA2ZkZURFAAAALAAAA4prb0tS AAAAFgAAA7ZzdlNFAAAAJgAAAth6aENOAAAAFgAAA8xqYUpQAAAAGgAAA+JlbEdSAAAAIgAA A/xwdFBPAAAAJgAABB5ubE5MAAAAKAAABERlc0VTAAAAJgAABB50aFRIAAAAJAAABGx0clRS AAAAIgAABJBmaUZJAAAAKAAABLJockhSAAAAKAAABNpwbFBMAAAALAAABQJydVJVAAAAIgAA BS5hckVHAAAAJgAABVBlblVTAAAAJgAABXYAVgFhAGUAbwBiAGUAYwBuAP0AIABSAEcAQgAg AHAAcgBvAGYAaQBsAEcAZQBuAGUAcgBlAGwAIABSAEcAQgAtAGIAZQBzAGsAcgBpAHYAZQBs AHMAZQBQAGUAcgBmAGkAbAAgAFIARwBCACAAZwBlAG4A6AByAGkAYwBDHqUAdQAgAGgA7ABu AGgAIABSAEcAQgAgAEMAaAB1AG4AZwBQAGUAcgBmAGkAbAAgAFIARwBCACAARwBlAG4A6QBy AGkAYwBvBBcEMAQzBDAEOwRMBD0EOAQ5ACAEPwRABD4ERAQwBDkEOwAgAFIARwBCAFAAcgBv AGYAaQBsACAAZwDpAG4A6QByAGkAcQB1AGUAIABSAFYAQgDBAGwAdABhAGwA4QBuAG8AcwAg AFIARwBCACAAcAByAG8AZgBpAGyQGnUoACAAUgBHAEIAIIJyX2ljz4/wAEcAZQBuAGUAcgBp AHMAawAgAFIARwBCAC0AcAByAG8AZgBpAGwATwBiAGUAYwBuAP0AIABSAEcAQgAgAHAAcgBv AGYAaQBsBeQF6AXVBeQF2QXcACAAUgBHAEIAIAXbBdwF3AXZAFAAcgBvAGYAaQBsAG8AIABS AEcAQgAgAGcAZQBuAGUAcgBpAGMAbwBQAHIAbwBmAGkAbAAgAFIARwBCACAAZwBlAG4AZQBy AGkAYwBBAGwAbABnAGUAbQBlAGkAbgBlAHMAIABSAEcAQgAtAFAAcgBvAGYAaQBsx3y8GAAg AFIARwBCACDVBLhc0wzHfGZukBoAIABSAEcAQgAgY8+P8GWHTvZOAIIsACAAUgBHAEIAIDDX MO0w1TChMKQw6wOTA7UDvQO5A7oDzAAgA8ADwQO/A8YDrwO7ACAAUgBHAEIAUABlAHIAZgBp AGwAIABSAEcAQgAgAGcAZQBuAOkAcgBpAGMAbwBBAGwAZwBlAG0AZQBlAG4AIABSAEcAQgAt AHAAcgBvAGYAaQBlAGwOQg4bDiMORA4fDiUOTAAgAFIARwBCACAOFw4xDkgOJw5EDhsARwBl AG4AZQBsACAAUgBHAEIAIABQAHIAbwBmAGkAbABpAFkAbABlAGkAbgBlAG4AIABSAEcAQgAt AHAAcgBvAGYAaQBpAGwAaQBHAGUAbgBlAHIAaQENAGsAaQAgAFIARwBCACAAcAByAG8AZgBp AGwAVQBuAGkAdwBlAHIAcwBhAGwAbgB5ACAAcAByAG8AZgBpAGwAIABSAEcAQgQeBDEESQQ4 BDkAIAQ/BEAEPgREBDgEOwRMACAAUgBHAEIGRQZEBkEAIAYqBjkGMQZKBkEAIABSAEcAQgAg BicGRAY5BicGRQBHAGUAbgBlAHIAaQBjACAAUgBHAEIAIABQAHIAbwBmAGkAbABldGV4dAAA AABDb3B5cmlnaHQgMjAwNyBBcHBsZSBJbmMuLCBhbGwgcmlnaHRzIHJlc2VydmVkLgBYWVog AAAAAAAA81IAAQAAAAEWz1hZWiAAAAAAAAB0TQAAPe4AAAPQWFlaIAAAAAAAAFp1AACscwAA FzRYWVogAAAAAAAAKBoAABWfAAC4NmN1cnYAAAAAAAAAAQHNAABzZjMyAAAAAAABDEIAAAXe ///zJgAAB5IAAP2R///7ov///aMAAAPcAADAbFBLAwQKAAAAAAAAACEAAXS0uCMJAAAjCQAA FAAAAHBwdC9tZWRpYS9pbWFnZTMucG5niVBORw0KGgoAAAANSUhEUgAAAOEAAAAuCAYAAADe DX4bAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJl YWR5ccllPAAACLBJREFUeNrsXY112joUNjkdwG+COhPUmSDOBCUTABOETABM4GQCyATQCXAm gExgOoHpBHlSc9XcCEmWJdlAcr9zdNwSbFnX+nR/LXqRA15fXxN2yFjjx2vFV3asvbBW9Hq9 bUQgEPzBiBezNmRt89oMFWs5EJdAIDgScAxk8sWcyEggNCNf6qD5bDTjmKRLILyhZyDgkB1y 1mLNV7ivV4Dvt0Of8++nrP0Av1F3/oq1EfMZ9/QYCAQFATVarGRt2sSkhGutNdfjWjYmiRMI 9QSsgHyxx3UzIPEBEUnqBMJHH1ClrdJA148hOHMQsCHpE4iAbwSRNdWyDXNRo2379BQIX52E 0y7NRAURK/IPCV8RPSBEwg4l+pxHPm9MkUupauY7HDme4cirZYoaIvLoK05XzNg5U3oshM+s 7OCfO+DZXqcFU4PJ2qRqpgIfMDXcFL5WRY+J8MlJmEET7l4mNCGf/MIUfGDa6F5lPrLDBGm8 puB5wXt27Z18U+ywRh/x3OEi0IA5+QfRW94yk/7MtfQv1hauuUq4vq0Jva3rB8zxtOm5uvPq LJEGY9jJz83jmSSaOeTUh6vM0NxzOc9GZsrroD7v4PgYIVYq/TLQfsuA1TJ9xY3hiOkyxIM2 5CZV9zR07GfdYOyZ5SqpwtLlvMBjKEMEzzTRcecIuavM4FzX52Qrsw2UfMZNAjJzBQFNpucS zu8jNTuGgu3ScN7QIMjK8yEPHetc5ydMwlfkSxyLhMpn11Rr1Vw7DkjC17ryyA5IaLeASRdM LQhYwkSPLW42Nax8MhHLOp/U84HYID9hEmqv0TEJK88FMijBXWXWMQnN40NaozIETGpXYwsy bky5QdCe1oLQrLJVjWmQw6JQ+ZDliCSsVCWDLZCwrBlb5jgP6gJ6mxZIqE19HYGEynz4BXIw t1IYFWsj7mBeuaYP+Iu9rF3xIIj0pzkS0Av63OUhjzXO8g7SLfz+eWBoxP5/iccrjdO3OoiP 8UbRQrzczMfXSgGFhCcmJ37P/wW6bxHMqJNt2sKrbrEU+GsL+Lk//Es9HGIuP78L9O9nFL2a SBPzJsQb8kCAhSSgCSKLDwYaUt3IUUKIWmFi8L55RPiS/e3B8z5+8/4ULdTbInwi5x1MKiGn X4EuN7D83l0LQ0mbuhqez/3esNDH0cfc+AcSCkyk/9+G3KICiIhJMQbiO/cBq6xqBX3Uhb1h go0gJfKXfGf0WtXQJ0DSMPz/U7O4Nb5nVRhf8Vlb5YvjLmSmWOj3dQvShULoWAgzy1xThpqN qXQr3dzQkwCZwUSoM5MXgeU/cfXPDNhrzJq0pTk04H5P9FZFJffReN8gmPyqeTFSfJYEqiNW ySxvUWY6Ij5qxphgEu6kyRyjQTxohJpAkGMDE2yNWoUqZTLDzc3QR/JqWzQcb6zpZ+cYPT21 tzpGms/b8g+TSP1C9t5wLyaotOkKyLy1/H4ImcUqn6xlFAYZH5CQC+NaMuX2igjkHFbIscHR jsH8WANRMwVBsPOagmC2gfzDEJPwZMBktZIWLXyfyw5vhT+jTZPtSWDFV2k24Ws+acztuCWZ 8Tl7UovsRfRecL2TSLVQ+F2lxravCySsNemNhfQ9fg/7UCVSHng+NScQItOFxhTPOyZi3sBk 1M2XlXQM7hsaZNY/pX2OvoEQJtw0QPbyFhMBbPq5wjRZwYrGiVOgmrqfIMRE8pW+Q2AGT/Yx IuGLo9O/063CRyB00SKJuS+9UWjq0H7OAmkofu2JwjTNDQTSBiGQ1ZUiV3mnGNNdnU/vKbOu Fi6dab2VJ2sJx4PKEUi0y8ntqWXFzFBRvjaVzFt8zamLU67ZEeCguAD6w0Gk3Dahqul3Haqg weSzWo41ZLJellvfpcwsQAVT0rXMPJL1U8X3dAUkG9kcVdnlf7Dzj1ZBvmL9TdrbRDMh8ngl mQQTMVDFNbZgyzc1O7YabXiHo2G8P5HLgZWo39CZPgWzdOsYHAkdabTRwAPPfu/OVWawgKw1 QcOnAxLqKmGA3YlEwG1DAeyh+gKTa2Jwpl0x0/gva0WdagzmtWqlXXimS66RVsctCUjERSBT zXYy5Q3JKWQ89Oy+f0Yy+w5aeYiCl6nGdVrYqNmpMFN9i6ol1VzKat+3HtHCTMA1hGtoVdM6 Q4f+gtWOGuS5ackc9S7kNhRrrzVt4+IahJZZB7WjmSowowxwwODF6j3zrZrh2oVdcxS91/EN JLMvRADlFq6farRinYBvz6VqBuQpgg7H2Jvn0cGU3IFVpNOcpWIsA8sA0DnIbKQqfpHL1p6R T5Qik+MhkBAKRLwMkS/Im9uoVKipT7cHAhbRGQFkdnuErhemYn5DsfZTzbNTka0fMrkOMuva pxaunNIMlUm4QmQRiftVYO0gHgT2NVcBhSx80JGldi1AQKvoDAHPatZRdytYrOomsS4gs7Cc GzKGgWW26khm4qceLk2WZE+xis25kKF2MIsC7vmCHH2xsxsnC8+jPLaVz0OrcqJYnYoTKAw4 KtrYY0Zzzb2NS6PxybT9e+6vo+orxB4zey/3Tah+5HyWLe7AndFPpREI9RGgTYjfFkR7v1Sh Iq4Ewmcn4RJpqz5KLywb7DEjqlIq/KMygV7vIRA+PQnH8s+XAanwHi2lRc7nw7ZvKH9Ev8ZE IETmHwnFAZSDbfHBqRUO6rUU8PgN55gKwe8DbCVBIHwpv9Bnk1y8gXBlW5xLIBAJ30uCRP1j BYRssu9ojkrGhi77exIIX9IcRUTihOEa8AZMTf7+H0/Gck1WgNn5RzrtR/Sem+MJy0d431CU C13Rb9UTCJYkBCKKIMo/vxDSC7y+FP8smsAzEHaFvj+H79+E3L2NQPgqZqmoPm+cuIdzxZsL lBckEDzJmNsm7oF82I9MSIIEgqM5KpFL7DnSB3+wAJ9wG73X8PGURQYm6ayFvT0JhK9LQkTG BIh2LfmE3Ad8id73lSQQCAb8L8AAZ37efQs3V3AAAAAASUVORK5CYIJQSwMEFAAGAAgAAAAh ALl/7nPtBQAAsBsAABQAAABwcHQvdGhlbWUvdGhlbWUyLnhtbOxZTW8TRxi+V+p/GO0d/BHb JBEOih0bWghEiaHiON4d7w6e3VnNjBN8q+BYqVJVWvVSqbceqrZIIPVCf01aqpZK/IW+M7te 79jjYkiqIkEO8czs835/+J315Sv3Y4aOiZCUJ22vdrHqIZL4PKBJ2PZuD/oXNj0kFU4CzHhC 2t6USO/KzocfXMbbKiIxQUCfyG3c9iKl0u1KRfpwjOVFnpIEno24iLGCrQgrgcAnwDdmlXq1 2qrEmCYeSnAMbG+NRtQnaKBZejsz5j0G/xIl9YHPxJFmTSwKgw3GNf0hp7LLBDrGrO2BnICf DMh95SGGpYIHba9q/rzKzuVKQcTUCtoSXd/85XQ5QTCuGzoRDgvCWr+xdWmv4G8ATC3jer1e t1cr+BkA9n2wNNOljG30N2udGc8SKFsu8+5Wm9WGjS/x31jCb3U6neaWhTegbNlYwm9WW43d uoU3oGzZXNa/s9vttiy8AWXL1hK+f2mr1bDxBhQxmoyX0DqeRWQKyIiza074JsA3ZwkwR1VK 2ZXRJ2pVrsX4Hhd9AJjgYkUTpKYpGWEfcF3M6FBQLQBvE1x6kh35culIy0LSFzRVbe/jFENF zCEvn/348tkT9PLZ49MHT08f/HL68OHpg58dhNdwEpYJX3z/xd/ffor+evLdi0dfufGyjP/9 p89++/VLN1CVgc+/fvzH08fPv/n8zx8eOeC7Ag/L8AGNiUQ3yQk65DHY5hBAhuL1KAYRpmWK 3SSUOMGaxoHuqchC35xihh24DrE9eEdAF3ABr07uWQofRWKi8pBbwOtRbAH3OWcdLpw2Xdey yl6YJKFbuJiUcYcYH7tkdxfi25ukkM7UxbIbEUvNAwYhxyFJiEL6GR8T4iC7S6nl133qCy75 SKG7FHUwdbpkQIdWNs2JrtEY4jJ1KQjxtnyzfwd1OHOx3yPHNhKqAjMXS8IsN17FE4Vjp8Y4 ZmXkDawil5JHU+FbDpcKIh0SxlEvIFK6aG6JqaXudege7rDvs2lsI4WiYxfyBua8jNzj426E 49SpM02iMvYjOYYUxeiAK6cS3K4QvYc44GRluO9QYoX71bV9m4aWSvME0U8mwlUShNv1OGUj TAzzykK7jmnyvnev3bt3BXUWz2LHXoVb7NNdLgL69rfpPTxJDghUxvsu/b5Lv4tdelU9n39v nrdjM47Phm7DJl45gY8oY0dqysgNaRq5BPOCPhyajSEqBv40gmUuzsKFAps1Elx9QlV0FOEU xNSMhFDmrEOJUi7hmmGOnbzNXZWCzeasObtgAhqrfR5kxxvli2fBxuxCc7mdCdrQDNYVtnHp bMJqGXBNaTWj2rK0wmSnNPORexPqBmH9WqHWqmeiIVEwI4H2e8ZgFpZzD5GMcEDyGGm7lw2p Gb+t4TZ9iVxf2pZmewZp6wSpLK6xQtwsemeJ0ozBPEq6bhfKkSX2Dp2AVs1600M+TtveCOYu WMYp8JO6VWEWJm3PV7kpryzmRYPdaVmrrjTYEpEKqfawjDIq82j2XiaZ619vNrQfzscARzda T4uNzdr/qIX5KIeWjEbEVytO5tv8GZ8oIo6i4AQN2UQcYtBbpyrYE1AJXxUm1/RGQIWaJ7Cz Kz+vgsX3P3l1YJZGOO9JukRnFmZwsy50MLuSesVuQfc3NMWU/DmZUk7jd8wUnbkw4G4E5voF Y4DASOdo2+NCRRy6UBpRvy9gcDCyQC8EZaFVQky/zda6kuN538p4ZE0ujNQhDZGg0OlUJAg5 ULmdr2BWy7tiXhk5o7zPFOrKNPsckmPCBrp6W9p+D0WzbpI7wuAWg2bvc2cMQ12ob+vkk6XN 644Hc0EZ/brCSk2/9FWwdTYVXvOrNutYS+LqzbW/alO4piD9Dxo3FT6bz7cDfgjRR8VEiSAR L2SDB9KlmK2GoHN2mEnTrP7bMWoegkLufzh8lpxdjEsLzv53cW/u7Hxl+bqcRw5XV5ZLVI9H s4uM2S39qsWH90D2HtyPJkzJ7N3TfbiUdme/RwCfTKIh3fkHAAD//wMAUEsDBAoAAAAAAAAA IQAP/8rB65YAAOuWAAAUAAAAcHB0L21lZGlhL2ltYWdlNC5wbmeJUE5HDQoaCgAAAA1JSERS AAABZQAAAI0IAgAAAOCH/LcAAAABc1JHQgCuzhzpAACWpUlEQVR4Xu29B9hu2VmXf77TppKe kF5IJFIEpBhQkQCKvYMiAlIupSehBRW89EK8vOyXHQgghAAaxY5BEBRRaRaKhPQ+mckkkzKT mTn9/O+17/f9fc+39lrv+d6ZOXHQ/z6TN/tbe9VnPc/vKWvttQ9e+do3n1iuq1ev5teU+qdP uU5fPRimnzx5cl3PlYMTBwcHS4n+OnPmTOqsN7nvWjl16tSwk2m3a+Dy5cuDVkna9vOY+Tej WtV18eLFYf2z9CtXrgzzM94hHWbjmtUjfdbXDTfcQCKz4K9Xm8fTp72noVwLeU4mm+nmt911 PafGw2r1rDsDP7RJHPGDNa+vyXRtejIsMZ73PVMrH9ais/RZ/69enfDhpD/zejYCuOc4+uxz Oo85vZOjA/FiDRZruTVFvEiR3MgfHevvwIth/m5wtbYOj7p2R3w2Gf8W+GZtdekzvLh06dJw 5mbpMzlP/iFeD0RugjszPgCXlfMgxW68IP8QL+zJ/zt4MRPL/1vxYsY/Hd8ewYu1wK9TwIu1 PgwnrfGi1TDSHFU86hygJ3fo27VQzcZ59uzZ4ZRfmMj5FHf3xPOZXTPDi9gj3dB22CPDHs3y i7NVzv0TOg/tC+yRIV5ov/y/gxf76vlf7fbFcfHiVa9/61D+h3byiStXTxazqBa0vbU8XyZt hBczvYqdPLRfqH+II7v16lA/Dy3omT0/sy/25aeZXqr4Uge4L17M7BrrXNsXOhrVGTGP9kie moeU2Cm1toOrJ06dGPsRU/472MsfuTLzy2b1g4R7Ivx1zT7x1q5rmw+o8mP6vwevf9NtO+II 60dIbfoz82KqbFya2M8zvSpeDLtUcWSIcZVQQ34CuWZ8NsMLRGJ4zei772TN7Kl9/edr2jUd ZHRGhMBRsaBCRnBkYF9M4g5TvJgQaGrf0avRHEzx4sQM4febmTkejfFxl58y46FRj/b1d/Yb VZGsruBsvH22t9x251A+1W8zvFinRx92j2Z4oT7c4V909QztnZrYDWwe79xPH87mel9+muGL evv4fta+OBL7IljQuRWdiWH+DiwYrDi+xovTs4DkhJFnCneKF6f2nK+HCC/2tWumcr4nfD3c 8eL2O99T9XZ4dwdeDJX/DC8uTtYpZvVXO7xKUVd/+nDNOGKPI1en6xRDDp/hxWxeZ3w2S692 TR2vOHL8a4d+WAu5zp0mxtolqaZH/JF1HMRqH254cfIh8kf+f7wYi8Odd92dB2v/eWD2F/9i Lc/r/LP44tB4oXjsgk7lrv18M8zwYmZf4AcN4ymz/DO8mOU/Di7UmVDq1vbFLF47Q5Bp/GW7 IFr9ESvp8MI/E6fIYqrpKZKCHwi8OLi6r9xeb7w4pp+/maZ5/2fzuDtufXz9sW/9x7SXD979 nnuGVc/052w858+fx2SFmmTA1+CXe1Lg4/vuu48bGPHcuXNatmTmIoWn999//80330z6vffe e+ONN3Z4Ue0dH6kYH/OYx7z1rW8lmH/LLbdQEBSgNmomD01TrfERHZa4LazvRjJrOjmzvktx rjwlntcVsdrZ/pFhPOIB4Jr7JtaounufxXoqEz+OlWGeum4aKOEm+zW0LHaDRayP4/PxjC9p a2i3Ltxyv2xjc8wOnYdtgFRSYDZ+vW/KYLLeL3/KcvQWPiEzZRlvhqm6koVgxTWOk2Ea55rE cRbKDEzaGR1mlJzh1ExOZ/Xs225Xz8F73vv+vfBi1j+oDymd9WXammZQbpFnbphRJZl0EIT5 MOeFCxeYxUc96lHvf//7GczMvqCT1EMlXPAKZR/96EeT+Z577qE2Jl60Eqrk8sh8hYATp1oP uUwMNFRwSXqjzOXDOE5wx+JrfpIRh3I+m78Z/639smDlsKpZPa6bWqTyCvSvMJH7m266yZwd XjzykY8M4lTombW7L786X2vSkczMyl3IPEzyjGc8I4s4ElwV4qScPbuR86oPxPc63tq9aDhR acEUtNf9CeJIeVllX3tnCBbdXBwHbWd0/kDjxfvee+9+eDEOPzW/QNYUpLUvuG5769sUbxWv SgAhNxv3ADy8+9Ef/dENh69cwQYZyiH5NUmogQq5nv3sZ7/yla/8wR/8QRAHmBCquDGSahNU qMawS1dOXD1/qWFZl57uhS2CI6wf45I4KxUvYux0LD5Ln+H6LD0tdvXP+PWaeFSFPPCxhgwp TIZoXf9MvNMi4fiDU/sF9HbHj7tRN5qfuIz8ohJ4BKs88YlP/NN/+k//ul/362AAIbVu/MWi PXf/BZHuaFzmxH33NSPFQclpzibzpWKTe6NFVG/RHOapoNYRfDaPJw7o5HW0L46DNQ9hnoMZ XszaGDr/spc8VHGdP9/0hjeaEhRH7LEUlG34AIXG/Sd/8ifDqVoHayWjGoFdyICG0ap873vf +0M/9EPvete7MqkCEJe4E1AgJZBx4dJFtoTwp8jCVRVUhxcHV66eOjjct1qHFrzvWDx806Xv K+dDIjwAvZR5CUZ4I6qu8QJqDPHCeakmxmakJ/dcX7zWtuYjdFuEjalk6mGbD1quz/7sz37a 056GjmEIzAL8o2+oDXvrrY842ayE05qiXHGTM9hAP6WqBy0bix0oIe8loLzEb/y7Y+HFBCwe 8Dw+hJL/wKo6eM973jcsOdV7k3agY9RveJ2UN7z+9bfeeqsmpXCgSPsnwm844zf+xt/I1Cqu VVTkHieYUAX4QhFsY0r963/9r3/u534OTopHSoXWLNM7x8EFYQUVo1bp8IKabSXos4G5bdCk MzGyfrHGi9rna87KjP+qnZIKxc1hnbv9grVxEfjoIAPq7caLzr4AQob9qX2uGaDvDpqsSXfr rTcTqHrCE56AwYjTevfdd6Ns3ve+98FUkEK8kPe4hxnOnLkBRoJVYBI8Vn65J+XpT3/6Ix7x iA/+4A9+/OMfTyLTJ3tQpyOA0dQ3IAU3j33so0k8d46/LgSMZOO95OWh8kcemL65Jvvtm+Hg Xe96935lJvyRWKNWn5DM9brXvpYZMuiglDIBpPsnqoNpZvI+5mM+xoBl9UcUYLunfPKUPLDF nXfe+fKXv1zJ508SBQunXCxQ+Ks/0lIWGEiiSoMU+mOfY2KIF/cvlrA98bI/MztIvZ2eJ/9M zqdydfT1v2Sb8c01+SkKwBshdX3NcIRZWxsXzZyccE/o0z2f4cUaKUy56aYb3v72tz/pSU96 z3ve89jHPpZu8yc8g5zbxFF/5OSNN94s48lsTjRV0X9UAhePwAsslGc961lw5uMe9zhsFvDo ycvFn8AKRgmF6qTblsDxsMKLqR80mZcZvx0TBA7uuKPt11pfc39s9h7hSeeGgnp6/vn2224D 1JFnFTgp6AcmEnsS4dcvhQ+Af83LOp4IKgUBBV1WphMTA8vif//v/809XgmqRldFTyQ3Vf4F Aq77lmCKoBB0SM7uUUOoBUcqWNgrcS24kBvxovbcbNhQQzqLU7NrXc9ufFnXk/wdXmhHzCDj OI9o6wHgBUI8HOxs3u+//16gEJGGVbAUIPu73/1uGIZKjFgJBwFB4532rd5UPJJJ4vyKBbAQ 9gi8ygVfPe95z6OVpz71qYAIkXSroqkZ7s/ldmxPXRPfOyrtH2cd89SDxYvbbrt9WPFs/BgP s/zOAQNz6cs/3/LmNxOjOn3q7PkL9994w80HJ6/ec/e9Fy6eOzhx6r7733/fvecICD3rmc9+ /BMee/9950+eOnHm9A2kXG1vtm5+T1xlR/AVaiA/runNt9z4jjve+SM/+sNXLp+4/9y95H/E I2+96cZbLl2+cPHCZXJevnSV+i9dvGINmJnUwK913nsfcg52EGfBsIfh4DYYC3UECjTOISW/ LefRdRCBAwrsiMtKn05hznABvbcDR7pKyAk+DvPP7OTKH1WEZkjRXLZRvDNxkM4f2de+uCZe dEOmP6iWu+66C12C8gc1oAA+CN0YrqfGEOhmAayJeqi2j+EwwMLagAPD58TFSAc4wIsP/dAP JcL6a3/tr4WTn/KUp+wlL9fbH/lA2xdvetNbhvzdabZDNTV6b50axGz0AIqUCVadQvTz5y8C 0hiGaHRAH/eQFav3v/8efkm5665333zzTayQwKLvfvd7zp4lEUlrM7s1Jwl58Ddmy8lz5+63 1L333veud73zSU968l13vevmm295whMeTw3nz58zPkVbtEJbqWfxOfhfsyouXUC/tdEsrknk +uq5c3R4kH7l6qE+rDSZyScW8JCeFReOiMTK2fEpI9Gojnulh1XbrfWAX2twISV20OFQd+5z m+0Ty36QeCUOc6b37Oe6S52/1vVq/Sd6hQublIbAC4ADvEDzp58do56/2Oy+6jrZzw5HIvMd DuZP8N1gZ6xmMeXX/Jpfgy/zER/xEdzgxdgNKu/2y6QD8b9EKyrE2bF1VBSJSyvtT6YF1sU0 H+LRvvbIsJIHn3jwxjcenn9RJ7hicJ312BdrPQBlQXEYBSIaJWJ2z527CELHaIRdsD6cfprA KWWzFvn5k3tu5Psm2eWyY5rQzh81UK17vWAjVEEC2gpY4q+d33H54sZfiKXgQOJHHE1f4q8t yu2MHgLMzC5txsnIH5nFNXR1LFLrFx1qnEUa1nbX+Ws/Q7Sh3M7smvSz463Krx1kDLkww+la jz7s5HyGI5cvNeF/5zvfCW/gLxDppCfEHaTP6rpy7sJ5j6ipjzK/1cQwQxeUifUEF7nbkDx6 Ljra8BsmCbxKInjBPoBP+qRPeu5zn8t97BTlH0ZgsoD8pZ6mxowBoU3JIDrovy8ZXOVtPw9r vHj969+4ZrI1xzu77dq6hd18K5YYipAAsuqM4GoSUmB2nSdlGAJpg5BIuJsJcAWLe/eADvmb avVXdXmYTpQMfxr6omYmQ4Vg1LOGwWpX8Tbq6MLWVl75bAsRLXDekaj2sJtd8WJI0poYesIm 63ZJEXC9pF66up6dLuVwslZ6NY8A3CFfzuzb4FQXF6h6pVYYenazObM70rGOr9guQ5Ff/uVf hrVgFbpN7BPhrJIflQCp7j/POnoT70CtOamEXxLlTJ/ySDqvp0aVA0NqYlgJ2cgPcrkqF+eF G+IddAzPhQu3RcjAuD7batgQBtZQ5y0rtVTbOs4z/myRoGWiEyvpZufhYl+IFx3JSJnZF+JF N6nmJ1HzzJFDWfDizJkbcQLldanvXGKJMCW4o0QrSeERrJDFxXjXsQ8hNOzihGlluK7ORQ2k qBC8kYFC8SoDBvSr+DmW7j3R7QCXSoiDHF2taGmzdcSl1XX+zHf3SOszibm5ZlxtPWXDlMpn NcNsHXdmd9T+VMjYYY+s+8NIbXdNn3BO5Ubu33/P/Xi1P/7jP46ra1Dswz/8w3kbwD0XQkAs UfiO/TWaZeTU0jSDNoKJXqZoz5o/v6SofrL/wl4p1dUkIYNmCNqO2qA2iy/PfOYzP/IjPxKf pcVKF8MBFUbBpbZ2IIQd3gLHxgGBYZcaOqDY/Dnjt33jF+Paj5168IY3vMnM3ex2M5qnOv2z /NHwDANnAVfz0Y9+nKzAZHBDBh0Hl7LdhCNmx6GQjv56WRyIIZEJ5t7NXVSC2gHsnWllXg02 428imHa+E9Hw69H0ZbBbvKijnuF94n8dPWdywjjTn0pz+19ZU7LXJaTaRPBx2O56vma4MMOR cFTnjMxwbcY/ib90/dT/X0PM2TM3veENb/j3//7f64OQ7aM+6qOwKGM/FuOC0lfYb6p9Ue2I wAq9XceDyEwiBIEb+dU+7eAjDCMd1GfyQGv1yhWc4tgsJC4WRLN2P+HjPx74YC/yzTcTYrsI 92JZs02ERhYHx/k/vKqeq+kPF7x485vfmm7V2RrCR5PDub3tkBBaXzDDzcPbfMpTni6UMhNa cTx107EbY7A+SFHmY8QGL2JoULPmA5mxRNAwi/F2evEGT7qnwx1fGiCZy3DhhoO3/kiHF+G/ CiVtO/KCF2tWnuL6UX8tBWdyjm6qPQnZlauqyZ2moZ1Puny2lrcZTvk+1fqq8dH6VPqs+zOs ZEd/un1u6bM1dyhDyrn7L772ta/9H//jf7BdAg0Et2DwgxeTuOzV02fRGYfum7NZKRxjRIq5 SK/FAV54ownMnzCbiUEf/RoKQhD1n0YH6WpBvRiNjoYIi+aj2/SfECl8C3+y9+zxj29Lwguh WuyMGoSYWfxiRucPsJ9ykPXUoUJYz1/i/+vZpetQGUaEHJASsMBIA1tlQX7dnEu6wQtVHPYb +T02kj918GTNqsq0HoWhd7zjHSySS2XfW3P3N5VYraQX+P31pumZbbzT/meAVd5K+rK4WPAi AjnVA8WgrNSr8lAFu8OLjqpr+Zdv1ukzf2eIU7L7kAVn/Cf3W6Ri5aye5Om6uu55FeZudE2e 77vw5je/GccWNwTHBGsUTY7U+V5c1StLz6+yvRORi2Wq5oj+iPrJDXAQDolrQwrcBSPBV2o1 /tT6oGBwRL7SEtH4tSHBQn/5/Llz+MtwqaBD0I2BABzKiGxvDdLhxhvH584+XPDi9tvfka5U /p5N83HwQkTAGQEvnvWs5/i2CEAu7hJbZrJBbiZDf49smgnixZA02eUFXmCgwjSkUIl2YN5H UldQVZAiVqIply4cec89shf7XLDYkqLHi+SfxhcmeBF6dtIORarAJFv1j9KlOkFdPdWer23N 5HbGf9H/XYbAd4cXs/w1HlS7GnzpxjLrJ/bF7bffDjXYAQFwcEPNxi8CCgk0AGgnT7flScXV S6RLtMvMXqRrZ3U40nBq2X+saawiFC+44RG8p4qS31RmDtNeyertbhvyoDn7LDzhoWAlofYe +cgPktTb5dXJC52TCftA2xfixW49doT/5vsvNMwkPVKtV3LjjQ13lS7IBKzyCNrpSQIcTBjT wOXUrvcLROdYBLBA22DgMX8YGuDFUD/4UqwzWvUG9oUp8VF9qh72ij0CYVr6aH1kCLKN8yb0 YXTpiVxFzfwSfxtywowPdkDGsJ4Zrs3wIn5KZ03E1osWVcyUqKrG/TP+VB5ZQ+IytULSa9y0 ciP2BSyBQmaif+VXfgU+IRxAZrdXUVDzYQtnV2+4ib08G/IWHDkgWK4kCyUSn1JwoJLse9LL GyjtbcZabUUTPV+tD6MegoX6rKZIH+At9AmKtXlftjgLGSz3cLNdhT1yxDGkkD8TVwrdZjN4 XdMP3v72O4ZgsdaHpuzYf6FWl9FV/hDoBvZ0LnihKPq+EOk6hJCMCdNpdIbkm6pyM36581Wv ehWIA32xUwAFDFRrlqxpSLxIeiAA+8LEQEa0hO0mZ6Bj6I/M5BZmDMDVG/FIG2dDSeVqsr9T fbW+IsZdB2ZxyjqPx+Ek9X8HFmJ9FZutfB45d0eBTFnribT4J2SvSJH7GOSd9rpwvulzNjhg yf/sz/4s2dj+5+JFrT+IgX0hXgSR7VLskRgXposjPOUCg3SZSfEMp2qnWKeLdHayTgGMrT6r QdOWYctGFBGYbIJk60cEUH5sLeHCqQGvAhASR9Omw/FK5ONM60OV5+Ctb71tyN9poONL3+9c FxEppAJX7AuiQnKJPBf7wqgSVPDFZC7hoCKFUxLpciJ/8Rd/kV+4B0Mj7zIr5BUvql8axU4f xIuYGM4NKdn30eEFrLm2L0ScId1m9DGz0xxUanbNnt9bq/HLKlozhpgx1m4cWeNFzt06qs+b XRBE4CZPI89d/oqVAQt5Y8yHV9sJbDgjCBWrJMgbhoYLamv8grqX2lbgDV4Ev8hpP4c4ElwQ HcxD0EEcEUT0g0hBqvk1qOllEaNpGq3ayzov7vfQGCGDZXWF4hOJGoAFYPSYxzyKX6MhgkVk qrLQ/zG86PaDd2y0hoYd+7WgRbQQeOGOWjzHIV4gz6K7K6mSWysjMFFFV7bjF6MUEw68+O// /b9jyJEY8at+hxVWHJEj8Ue6dJvzaR5t+3ClbWwf7e+0/o7F+RMfd8j39C2SI1qJmPDOUNTJ PEwP4nStzPwO5XZ97caLQFtuZPH1lRnPBJlnmD+1mcc/w/prepJy+lR7k5DdUNz/i3/xL7Ar sSgh3RAvmEDxIhBmrxS8mpi5CN7JXf6S33P6Ynd4Q4prIoYq1XZCBmG4wJPNyY20rdGBQnKp Rf0kNllW4PDmlltuYoxgogFdu61kPSzwou7Xqjw0vG+J8/2djkpyxx8JXiiB8UfIAMVFccCl qfHtUmgEuMo/VDMkeccdd6BtYJr/9J/+E6bpDC9i+Xd+ypX2JssGIEQH/7Tba7xoGVbxC7LF 3+64PHhRlT95ghc2oa/b1M+e8QtxYS1aM3yZpYf/OigJvkSMvens/8hhxYUqMBHIDmJSsEJG haduaOwHh0+e//zn8xo7eMEOKHSM0hi4SVuNMO0TM4vjXC7+NP4ayEjribN0dEB6FdTqv8jh yraQEbvDlxISBEkEBDygZjUEDKy3IkhpVlMnpRiUoRPBjntQA6WoOVknKzg7VAPXO/HgNa95 3VBPrvFikzI5Z1GkII8zEX8EjOZPzaqKF6yeYGFCFCaMdTLfdg/6rv0FygIx1ANNOVyHOv/j f/yP4EXiAnE6hACFSkGtfgr7wU2vVyRwjRdtenaup6Ytp6rbr9XR1vq1Ujcdm7zfPbMXsv4/ RI3js8sML8SXDixIcb0mMphsC4tvrooXFV+KPG820dSqvA9e13Fxf8/dbQnst//23/6f//N/ xh/h8E4X4+1/jIKt/F81flHp0I0l8rZb8BTULjMp4khAJP6L0k7fkHyj+FoiIEqcGgVEsOPy PAdujGtIMc4H0qZYfJPHYLZoaDxc7Itf+ZVXbxh9ZF1XQarysIYY8SLWafCC023EC8ec+AWv osEHICgk4wAl7A6zGXcITQ0+e4EX/MIxn/Ipn8KS7U//9E/zcrF8VsFCvHBuLFjtFPfyrMcV RLO4v/x/q2dkX1j/mnToo6EkMzrqVKU4OovP4hczea7x4NpQ7J0OMmbps/ozqE7MrGeNF8b/ YsknwyS+0OKOVQhzr7R04CteMOO/63f9ru/6ru/6L//lv7A44i4b7Zo0XfGibnnKcIb4Synt jlwZdbXLKimCj3XIFidb7A7xgj9BDm6gkjjCfdBTfnA51gAHnWR5VXwRkigFZLgXPq0EyLq5 /gD8efDKV75qyN9VEkL0JpmT/eDBC8khXjR8vaHxU6xo/RHycEAWr+WwyRcEef3rX4+5Idy4 k0KJUroi8y55cBIXh32yJv/zP//znT8SaJCNtCACFhsIaPs7EdTD97y8FyV8z9036EWVoXHR 5Hz0Xeg1fUI68tMT2aLGPvr9wNs53xF3GOJU+Kljmtl+lh32S2XHVGuja7wQdziXhJNN/OUN dH5vvunW3Jvi79kzN0LSpHjv+SaN1MtJJfmlZgjGhs7f/bt/91/+y3+ZQ5I4V8mtwBGeamK0 Hp7anGziKSf5xYFYcATtcuQX1U7K8tXV9rvYJi2P56GYsv5tIy7pqcFXTDQXOLkHTLv15g86 feYk57Nwbgs0uenmG6DAqdMHt97yCH4Ze3ttlUOoL51nLzvnvyyqrlkx+juJp/Iy28MCL171 qteEw9boHig5xOmttd+hjCrdhS5+kW0XL4j4KKjcswKK60E2BAbUAC/Ig0HBSVkGkyEQQENm kULRUuDJ5pa43/bbfhsnlxD1fMtb3vIhH/IhYR3RIUPIn90Nh2jIMZ6XU7kHuF8OUCIixbRt TtN51CMfqdEo5CvwjF37fN0KGRSquL4CKGMP8Cl4Wu/GfavF7nRUu6BiQfRhBlu7MdAwk3iT kJddIdrAAcE1J+TkRA118qsPb7751gWdkavDXwjDmExh9Nu9JsgkTNJyaumTx5zLPpcmPT5d 3shq55VAMejGjLP/4hu+4RvYbvNhH/ZhBjurDquj5myl6AM1gb/UPEyn3WG6vao1eE+IYpie EWXUUoD62cxBZHOJdbSIB/ekPPaxxDt4+wmjAwMEG3wzaj624tBgCUhtiET4wH/HW3GwMOom krvF8cHUX4ekg1e/+rVWu9ZaNX03XpBT+0K8YEaRMUyphR0P8QIjgq1WZCMD/EfsCnKAAgi/ zEdZ9/PHuKh44TnRhL7Yis8LzpgqaB6DoB1YkGIAtbsWvvFMrcOlE/Mgt84NjGwYRYHHyPEl AsPXcrpO7Kj+FleLmSPRhA9j41lXSzw8/ZTaNQRg/bU2/pzhFMhbzStyaqPBosN5jP0vigkf Ts2QE9x3b1UBxIVW4/1aZnM41iwmJi4QU8Wc7ow2j+ykmsFvJXiBannxi1/MjKMqoJguyVAc zp4ef0ey+he14Kyemb224/sJ1fjKvRFNRq3Me0OKh2BnGdXXJmGxBQuaLDB2smXJlrIUATL6 A3XKpFwHfOirPHjta18/5KdZ4uw8GIYHjZhLqBD7gnstR55yDzQQdyCb2/LxS0lkveN1r3ud vpwwId8HMqSdBghk/U2/6TexjMouDGjNNh7qDF7UG/l+dbUTOhIeqaEEZ5G+6UzqITfhXxQp 9WgZWmGVq42bs6QrdcG7PKJa/SwvJcTf4F0VRe49oCxsl5vufbDIMO1qlAXOJKB4sYaAxEG6 Lg0zkwdqOykadEEBYnydnCiZwZQOLxI3ldoBCOMRwop9kHqM93f8jt/B06//+q/nERpCZJ/J +WJfDK6p/G/tr67MLD9nYs3EMnNaoRDmcVwJkTpkAxlChkCwvGbSFkoW76Y3OQ2mksfz0NMW 78enP7M+P4Q4cjA7L6fiReWh9fup4UXG3/kjHV74NQCy4Yz4wSFGSPCCeCdNwMGwglwSyJBB xQvyQE0WR4gA8cIiwU5ORgOA7ECVxnS+w4vF7mWf5WbFpKpuemLT4dqNotsGJm1CL4mcmsTr K9JiHwIZiVnUImRgXJEcB+6la7Dq/+F3G+t4pYB4IcxRp3gxW//Wv4hzIQow5MxmJt0UvbCA XUTCeHbQQertwIvYEUKDYw/3a4lsKL/1fD/jMz6D87W+6Zu+ieg4HihMAvFneOF5Bce/dsSJ hpXgqu6uPEJb4SME8YbfrO8uMb4GE8tepDPwNlEL9mtxkQeCa3oLLtn0oanSEpfzNbpGjz/8 fXOe+pqv+do62VVa6n3mtUsMr4ugDM8JYISLfYVCbiqXUrIm2Riq3i/rI/yJfQHv2gfpEjby RmD2hjrhGIAWiMGdscUUqWVT6ujTBgqLz9wu82jyIVqCvXEKqqUzWj11PnhEBpVkrTlkydRm hcyqPEYsAilBvOxGnYUoW6s1g5mtNnIVWVXtWJuTsjHpF44ICuSGDO4dMCfpsiNdHXJ8AKX2 ZyFUqzyy0fGf3Yu02EqHJpLRWcjSY/0TO5RY1U/+5E+yT4/tlRRXVKRDd7WzJfa5MnEdF83S Wzhi5xWJcOCyk5XPhBP666H7Ght7u9SRdeLkHOeU9C3fGnxpVzdr+wLBMfMfvOUtbxvy0yzR 9ZE1/yk/6/gFyph0Bskcx2AmiIWhgeSTjmfhuzrc68xTVayMqp8VafwRpBru+YRP+ASedvG/ UDkFj+pz93Fvlu4rjayKrjJz2D62hfzcvbxra1SiLn2xxCUdvJxFWw9zWMT9OfqxSrtzLx7R Cr+aUVbixCufuUJw+haMyI0UM/MGJrKMtSR2zGf9aUhMFG6ynrKeYlHefkac3I/nn/mtPYy0 mEEiK+1rrKx4ZweYAg7IYWXkO7/zO9mnx4KaBJ+J38wfyXA6wZild/RPqR3xixA5XCEzVD7x kbMcyJMyTtSiEtpHmHA94DGsDNcN4r+QgXszoN1gnfBMICMp3WAf/J8Hb3vb29ecUYnYPZ3t R5JF1vELwg6KBPyhDJONIBZ8j94g5Zd+6ZfgV91yJUf6dgIfNGFrMPRlc+dv/a2/1XfkpUKd pIoRR+/dVbHZPFYfLaryyPtgm94uLEv9xlzkdYez5oPKMRaPrGJFyx/8ChZeRljlGPFFVIJR 7E+gRCBwvLVm7z0XH1Lzpx6TWna2P908gQlK0UOuWn8aku9DrmoysC1+iBcRiYw6gBI5iUFE DbHLhAyboEVkhj0X7Lzgc3Yf+7Efi59PBiZCE299scY1Tp/ER2e4M8OLHfGLyk519teT5dDk pYDFUtz3UJuKFRR0TOBADKtsPxd23dDB6orjzaTUPx88QHQ1NLxI0ho4Ksdshr3NXakQ5liv p54/3xR1FKm8hTuKSBB9YFZY6aC4+zt51MXhqt6Gm3n6cR/3cfz++I//+B/4A3/Alc4qP84Z KVWeAz1M02LpRVo3Wl35B33EO2aLdRyisBy4cNvb3qYQUif77YjPcxFwrf0s9Z/AUYqEU2dW 0VGMmFFUyyKR3yJRnrkxSG4Mz0PJGJeUpLhckv0/9I36eQp+UY991lggj0YcxYEDKm/LT8v6 tJOWG++5yI8Eeqo7O2JY7Y4cdqW0tmTfGnKj8b3wwsxxr6pBwdCCIFHLtAW1MSeZcSxKXzjy VLuhMMzsi9hfXakZLji/64vzQWdCKElj34UV18SPeKeIBflZlNPGzHQG9evxvoFOJotEMkND Hz3piU/oAKIDjocWMg5m75vFtulwwfjZmgWZYE1ufmFibnxT2Neg1R48WsT1KnzJU8JXQMBt t93mV1TV2y5GBJ6r7kUwKPipn/qpSBQvm/2W3/JbrG3dGVK0F7i0n/2lYjqPrClXpMB2vgvk eiQXIg2E/a//9b8Is3EU0jOe/nT37dptXqkGRyjFDiJSMJTYM0b/SWEgbFFHGTKpmkuMCGRk 7wDLgYyLPlM/AS3PucaeZESUYoVYR4BKeEXCLYyJq9MoAoMtxmoiNwyEJSHK8nounUHlaozQ bciOh4+9hgFPzZ5axnYRfSung8FSg2YOW4B+5md+BiD79b/+12OvIYfUD1MK7vrSbkbWGHnj G99ItaQTqGadwgnVH1EAvOp9EvPI98SjWjUluHJeVtW6pJOfwYIXXFiUYqiIM9QTp9s+i8EV fB9Kb02UnRyILFRFgC1gSaxPq/5IQW5ID39WwZnglG0dWaK2J0wWs6mTwqWTAq3Yz2GiQ1DQ IrwPLVg0svj9kUr6Clc9WCyEXMun9FXL8evOToYkXshYpOjGK2awOCYW7Mt7RJ4MTlnFW7xQ IcRg46nftvrNv/k3U5yoB4GMOhldr+JfWNUW9ZdXVC9f1DkyaGQlFgeJQAr8ZFCJLaQI8B23 396kblmdAQjoHnoY0f2+7/u+z/mcz2H7EAYFGajkR3/0R5F8UIzzJo14v+Y1r+GVB6pipOw1 4p5NBIqfNgLAxHEeDERvhVL//J//c74/vhxI34JBUObf/tt/i0kFudwXazod+Gf/7J998zd/ MyYPkES3Mdf5EAYYAaFYgHRfHIMCL2J3CJGiJwSnSz/2Yz/GYGG4v/f3/t7f/bt/F4K87W1v E+8oRX+o3PfHjfFxA33+23/7b0Sp0fZshOH7MmuwcOKSLgfLxBA8eJHQhnhRcSRFtLrpJ9t5 2YghXjCuxW4/wrfO4My+iHx2LN2xTf0zOY8UWb5HL4vO8KJLPwI3W1tvbb8s2XyPsT9qhBaX uEbzQYAG3rri8jOg+CPtd9lpLpGvK16cesELXtgNfg2fplQC1T9jCyjq/BozU3X43VpnK4Y6 rO8qg2pQUHT6c9NpIYilGY8+R5ciMAhV7Iv0bdjJLVi0UVCtu2I0sGmOmiE9E4DGBgtQYuhb bniK2JBNBOReQ4P8iBD5WQmmuILEhKEAMTpANESOcdFJhB8g+PiP/3hKEeEHPn7/7//9SCkQ SVXYKd/2bd+GDKA69IOg24/8yI/QOveADrBIN77ne76HFAELQ0ZrgqrAoN/wG34DcEPKS17y EvrziZ/4iT/8wz8MhDEcPCkIS1wZgaceGtXdIMULUrzsZS/7r//1v37Jl3wJkEcGdtmzcQ6U pBsUAREg8pve9Cap/cpXvpJS1ElvDTxxQ394Z3C4HOHiS678qQMi9+t9mOJcSMx6kc6fGE1Q ko8Dbdcd2xsZumlk8KY587jz2z/jx8WbS0qKcCMfatvXG3tYR2HOs+znHl3qnm5QWs11mA5N 3K/3saoWpdsEIQgr3Oh4di/FN9xvX0JqakDejn5Vmh7y69RXfuVXdXCwGxeCJmarmZVeeu8y B2Ra4GM5NXPxBrUvKOLL7GQgpzEIlY8DdpABS0nATKFFKYLNjLy5HNvhRe1MNSuCaPRkmdcG AU7kYlG3pU38AmyWP/pH/yh4xD31IzC80vbTP/VTyCRSR57ly91tMRjexSBH4KmENxqoFrnC WMA0QJLhWl2nf/JP/slnfuZnooRp5X/+z/8JcNB5qkXwqA0JJJEiIpE2NqqbTWg0YSiXnr/i Fa/4g3/wD3Kvvcao6Q/y82Vf9mVIMgVxgr7/+7//G7/xG/HvwAsyI/O+a8Mv8U6En874Ro9b 8vmFhoAFiPM7f+fvxFTBxgGAPKid/KAV3hO/0IH8dIxeAUNU4i5bxgts4TpBxchJdzOUqzWC JGWIF1oTdAZpBzcbImzf4FLITREsuBD6DimCJoeYEnBZ4MYa6mWARjDyyj1QV7HPzpMivogX AkF3E0SISOdGVlcEGOyyg/7QIlMcqFkDXPNQKWN+wQtSZOY0YVXX4zr15V/+FTsg4Jp6u5at eEFfIZl44QhFDeMIsJ3cL16QIi20L6yzogZPoRcaEq0CW6M8+RONas1dJ2NyBzLSSaZjmdFT vrWhWPIUtUk47TnPeQ7yjBjjqNONf/fv/h0BAjACdANBkBBEBZlkXAjbT/3UT1EELGBVWAHD GfGQWMpyg8bGAPkjf+SPABAME0nGf0HCXV4lz8tf/nIcDUoh3vyJZDLlYBBBE8IQdA+BpJ+8 x/3pn/7prs8LVfSKN3SxI6ADrbz0pS/9iq/4CmSJLgGpSL4OEQRkV9tLv/d7f+EXfgHDAThj aK9+9av5BW4MM3/VV30V4wJxPvdzP5eOURugAORh/DNwu4plxJ+YwcgMXaIPVE7NkAUEZJv7 UDwiLd1T6B9VHKQgc+eMiB3+0iLrIwAlrxpqFSqiuSLVzUbYxghrYgyK2CNBASqpdkpy0kRF kEAG+y8q5NkHYSJg0SFFJUU1ASpebBWkG2fbk3gWQklIpKTICcgO7hF/CljChES7HmDRhFq8 WBsLNeWYFoeBAD1zNfliUzT7Yo0XnjjmGp5j06DiproPGTZU0LWGcREqooZ+GG3mkogjsSy2 9dirtnZIhfxq5xtz/YIv+AL8ZLgEJEIe/s2/+Td/+A//YdQvUo2TT4dxWNDJ+B1IJpCBA8/i LqYHEIbrQfiAaAKme9Pq588TQUTsyQDMkYeGyIDsIfnMLhqeDQVf/MVfTLiRp7AjGbgQZvws OuCeFLwbLA4Kyotko6u4D7yCBQQwRkwD0kEi2v2hH/ohYrRUDvwxTNr9p//0n37pl30ZFgdr SQRW8Dh4MRwPiHvGRWbwDvQBMn7f7/t9jEjrj9f/6OSf+TN/hlYYOK2TzmIWFKAtYIsb+gni E2295557ox6jFTteX3N/UjqZqUo4Kpdhgmg4QXwxjO4JN8mpJs8FmYZ2TSfVyVNdkuqP5L7i DrxBY2JHzcCfVCiQVRAMjlS7I6ZHcKSOWn9FkK3g4jpA9Kjat8WhL2++XRIpFrmuk4mx+Tph Z70rhxG5aOyamKcm5tHwXsuiXoKIDBq84KarNk1DGs+/QKg8YTyIFiuju+n6L7k15HhEW3UN Au5HFJF8TAAkhxtsGSwOxAlVjJCwoIXrgYAhb4Qt/9pf+2uEFf0QBk+xzHmK4Mm41I+WJtFQ LhoetY/woxAQbPgD6OGTedQPgpDZsAgsaODKURtlJF17hHqoASDDJEF6ScdKJ/r4J//kn8Qs AkMxc1gZ4ddFR+CV8SJm/MlIgTA6I3hxg5dBt4EG7ukJv5g55KQneEnAMTeuKJMfQ2l5r6E5 icA0JCIzJApYy6ydXqm2Z566wWR9JXN3Q06Gz4wzIk1CqlLHRniqKVqx4wiOFEmuUQmdlOqz mOLKcXdBBGON0Meb+ieJXmo1L+7zJ6TjWte52UmhP7UNqcS7cRRaW0Fkhw8p0A1MJdMB0zJT /OlGoetkXxxuwqnzVCd+bXoEyepNBjDkkjytOj/WQfAibJcOBMhgGjhegdc6KA25qiq/GlXR uNisoS6MtWGvJRrbVgflOWYC7sEiYFcF0sif2L30h3klQED0kQVOXAkkk5kg3oZ/wQINk4rg UYp5Qv6JcoAmdIn5RvCox3ApCAKjw+KILm+70HMXNSkIDLFuQkMiBeaGQWI6QB6KkIeqtLaY fo1PHCX6TFwTAYY52PWIY4JDZHTTVx6pykNGgDmMF9joP/yH/0AkBRUNENBVfoUSHSV6AsrQ K9iagjyi4Kd92qdBH8qSzhgBCDAF2dByJIWyYCWNduyR+ao3lSUYppZUbvxT4V+jhgBBBnqy mKtN8SRn+CQpxgHWv8ra+ldh1Ev13l/9jPUvs8O5vIvMt19Wb7xPOilLULb9AkT+GorNL4GR BaSM1GrBbGKuWBWxO7Qy9C8EGg2ZChyqTyCDC2/UsKi8dD2uU1/yJV9a1bt0737zpzdVmAME PmIugTfYSOVDTowjz63gqbCnuQ706r9EV2hBaYOFTHKJ6UgFK/+k4J978sXSRNt/tUAPi5T8 vyESopjtbIulTuyX9us9fiGVExVjVvilG/ffd9/bCXBeuECkEwuPP5lh9kIxQ8959rOxJkjH gccHYWgkukuK2pBYlAlj+Ymf+Ik//sf/OE9JoXUmlX0NtEJZfAdGDXxgjGDD0z9IQZgADPqs z/os9YOwRUHqxDqAdORh7mE1mAPxBsuM2uDjvPCFL6R1AhA6R3/2z/5ZGIVKcFvwL5wOz7ZH ntn64VoMcEZV5OSGDtMBsIwe0jf8mt/7e38vtdEio8MUIhEYAkdoCCsJrMRbIT9kZ8qojS4x li/8wi9c5vpeTQBNBkPaua92hHyc6VZbaGOKAqnHGvyFFAZQCF4QPKI46fzKhOGNyMZyjgQn 7jDn7dWwdk4P51BwCs+S0pjrVDtlg9M2GjKcwb5uRyItZ3Fw3s/ydPltHLeUTf7mJZxmO3jz aPklXEANRGPOnAZWOOiGkORJEAZPBazgoIpH3PoInGZyktL+nT214E/Lj+NCCr+kUAP1NJho FmRj/s6cEB2qDdWQb+FpLqxSOgnL41vff/85yNbGecVzRqjqMJCBHU+emvIAAGVsX6xhvqas 9cBQM6RIfarC7PLv6Hd4IjdRL0slWQP3/ZzD7d4Y4AvDbX4XbXZop4lT2rdABiFGWZm++YYC VoacjYuBtf9FX/RFRAR5SlCDMKdfSwIXjFagK5A05G2ZvzPgPa4Nskrl/MlyBosLqH1dIS4E gHSXGySIkiNwuKWKOhFvMmtu8IgaiHGq1WkUkPo9v+f3qJuoBKhCoqgQW8BvOOENMS6WeF/w ghcAJYDC13zN1wBbmD9EJRqyXrqENYFrw0B0eSiL/0K8hlgvrgrBUaiBnUVDgIXThHGBqYJx hMVkfHcL3ItFV/5UYXQp+XN4I3DkVyjRrqRp//SK/VJb39qVyMuyxHhiMTyXXz+anZTGPNv0 RR0tTvExfhcQEUqO/J69oRmq699HPmrZLvHoRzBxj33co5maxz/hsVCVlOa5tCjcrbdw7FYz SJrRUeMpNXQiu6pN6710gAiwCtMBQ8I2rsHFK9HjB3PgugeAEbXIoX2hDPtMUc/9kUfbDPVp 7uVCJhgqWAk4hyiCydzrBTAM8hit9EpbwdE2d2WnoB1ACF28RGnD5Utm+7npbUUomXXNVVou Mhw9ceOmgQOojB5zvzN5eNrUwalTSNHygdzHI/YEI1HFQACxTJ7SCq4Beg8TgOL8icAjhIQV kDEqoRUWOBBXHvmhJsZFCrzirir7TH/4ZTppi8HyVAvcIAWNMnB2iH3pl34pOekAxg6WCFsn IDUsAmVoFycCh4Xi9JbiUBimee3rXgdAYJsg5/wSZAVovvzLvxwaMnbWHZB8mNUlanoLdhDH BXpYCcb/AivpM32gY+QHNegGmPLn/tyfw7VZZHszg5lKJ9pp9dcr93Veci9u1isMQ88xgnCa MLIEi+qNVkZt+3ebJbFp9JqykbJhthSJTK5vhtUyU7oP3ZXIaEIkbiEBC9xCIkAEGihukbrm wuRCmRrF0AZXrCQdN/I88+gGa+q85ZZbVXuLRQJkPNh11iPLvFItslrvpVqlZpezZqg5yaaQ LJ1uzXljK4FMzbDqhsQr8QZCRNQDsRVWur6l8oqAVGLQkcvdX9RJuwAEAMQGJDQBMQviAkgj okIeRBdFza84CMvCuMy0W6e4ISjIMgEeh1LBnCG05MfyR5IpQv2Ai9vSuEeSkToEMqMItFGc nniiB9moREpSFteDUCudRHjwEdgqgo+AZYRnQSt6auAIAAGXUNyVFHoFamApIO1UCzyBC6x3 CJR4E+Sh81SipWCMjfpBE3ajAhOUBRxpgvzsBPmX//JfkoHtYdQsxlWdf5z7WbwzQY1kMEX3 duH1tp6Vq8ZBhnXamU5trCHpmphyzAx6DetLedYuYPaNajM7xkHhN+wOjA6YDSaBA9EN3KCc UEJ+bMXoiL8JzYoyddlFdmLIzBRz7bZA2Bga9EdyHXNIo2xtPbUaOZ2105lA7enWHEpOaRSM EOGghXO8nI+42YshcLj3gfEHcfhTsISg21KbaHAmAEJgciO6FOfGLwkY2YqBVrtkhSmeMdI3 qIx4wIhBLj+AwiOqZaoQBtYp0WlaQ0ySvCtsM51gBF31LAYkClMfm8JRMHw2hmOJYNUzW0gy xYEY9TkZEHjCEMQ7YGXfsqOIPadj9IoMRmdojkc4LzAKi7h/62/9LQ9Gpn76wFovdKDnFCRC CQChl7QCMGTYFYrrhJnDL8YIHcaUwLKAejTNSP2gFFTFvqCTjI6+gTjEL9zKCRFgVuDGF0m+ 9Vu/lTn92q/92r/wF/4CdYIg5AHRCMYzhCjqen9U84/DmTE9LFjtkfwJBWB9cA0h0VtR31SL ZmvU8Ppoi3bX/oTN1oky20zr7DAxhkbH1pA68v8ZUafP4B8VIZPuAq2g4I1wsERe20UeKk2k s1OBkiJjiaGhicoMYsQseVq5B7mT63Czajp3zRtR7ZgXFHHk3jjm1KBCW6LQh3tyzWZiLkp5 z5itcHc3rNlOVuxwE4GGnKiB8GhxcIMEgvfsO+B0WWQeTYtsK2auPqCiYVk0HlKEOCHbyx7H Ju2k0zHqBCbY/WmsDgnEVYHF6Tb9YV5hfcwEnH8qIUUgc0TkgV18T4weasKAX7ROAFLTA8ig TpwFEvnTFRlEl24gwwwHQAGbGB2Q8Y//8T/GIiDg8g//4T/k/gd+4Ae+93u/F/tCawjjglVe zAe5jeLYFMQsaN19Im6NgX3pDKNjCymQ8d3f/d30CueLURh/GeJC5encBxQ6Ud9K+xH1r2lA W5BU5qkhj86m6MyTaxoXFacehLo9LDp0stQEUagVZSSaRgdDcxEXAyJ2B9qohTyWCwOEPzE3 fJnYVRLZWD9Is906QzR3BjBTmJJGF6DogxzsqRe96KsdT7Sx0iUf18SMPOlVgVuEy+4ysG21 m69daySTAZ5mqAxbMbM2jQuumpJH3MAQjB+bHPFATpC3CJvrZF1XY+90qO+8Uhaiu9JBQZgP IQQLaEIvgwt5YHcTN4gfHjuEtv/kZ/mD+SOiSbyDPRTYkH4/hYkHYpghCiJLVEsGghc2RHF+ 2UBB2JKtRxRhvGpLeEUth0ggsWzTBr8EERJ5SjQEtc/YEWlsV4wLN63zCARhjCyyAl4ofDqG cQR5sXowFojXgiC0BQyBhpippIB90JMABFu5gAbxAjcKR4yt5QRWdLZhU8fFPZyHDYWTRYs0 x/zS8+XQjc15fPb/mleUeYxBZ6r+RucrBnSYbhBVIV11LdxHQoQhQWfxmfvNwTuEhKq61s1c u3fNQe3IoB1hhtoNx9ihqkOTx4RIwxzMlzH1anrEtckQlALrhJEURr1gdBsdWdZNHlQIY4MU ClvVw7nvbuqfKVKLmyEpImhX/7rOWCsBDm/MKdEDKElPW+v6w0zhpOi0rOoBBCxDon6xIHiK ikaSCS4g8L7hgoSAUNQAdhgEZQp5pKXHfCAwoD6tU5z8/LrVApEGfUAHJtVvrCBddJv8CB4Q gwyTWdesDo2qyKmN6mYwfBN8DWoDC/yKAi+teQKAwkN/MBnssEEW/AsAC1RlpDAKMEE24IBH FNETAVAAR8CFanlKNjoJBciM7wP0gEf8SQeok1831NIEiAMRtG7o4V6yNJTMJMroFTjC+k50 pIub6POj6yOHar7TE8GUjjF2QMlej6o2rfcdKCjAkDQIkhRNJJ7SQ57CA5CdeXFvGEhNdAM/ FNbyQ19+0t1voAkoNVAqXlChO/S0cCtI7TW6ZD711V/9NXY9KBi177B9lJscXZAiPtXR0FaH FxmA+tbSGl0QgmyIiocFKf9aVrWJIfpQSrnlhqqg3YK+bf0i7lF1cxghGSCinXFTnTsaID1V 8RRVz0Zpdklg7eM1YCYgSzwimui2a/7knknyHTAlx9crEEhmmk0Kf+gP/SGtXyQWrQv0YHeA MgyfeKG7BtCQNI2AkY3ZZf6wUKjHaCK1Manc0zQFSce+oCH3iUMcN4nSGV454RGRTmwKzDR4 BWpQnPVRTRj0MAOHyaiQMAetvJrqXvMabBOK0BYWB4AFz9EZesvA6ZsIxVOgDTuFeiAO2MSo 3U5Gx6iZZR2a5hFlGQXpy6JyI2mdSvG9+oz6hl7RB4K+BatuCADJo9ABBPdLAhQnhcz0R4as WKOFsXy/ehMrETyYuKzQkcMi4V4eJSYawIotkCYCAdaQSlLPDvHrioTVaz0VYobyGASBjbNz 1HW06FStUYdMhUwr98aq+BPYIQNb/wzh0brZ6B6V8Og4CHLqhS98UYVtYXhdsktc57FhuqK7 ARw4qW3luxw9Qs3MPUwgF+YK/Ad3uxt4FO4EJnQZEMIFLFsFsT9rr8RXpzMEpVF26rrgBGYj DNQjVxnyJAMhT/Db9WD+xMNHhBiR0gsaYrRTljChG6uxk7Ep6D9P6SR7mciPQEIBVDr3umb0 HPEG77AXeE2LdKIkvDvPIihbJAiIUhshUnoCTrmZyi1t9IqaaRFPBOPiRS96kXaEEss9ntQf +2N/DOJou9IEwEf38IMQb9AQpwOTxBT8GqCQM9b9VhjDhxTkx6QC6XivBMiAwoydLWF0EgLS E4MFNAS+0B+ekqg2QxfI66J8vYmOqcqgUz9VTrr80UPgBZ1kcVcPdGcNbQ8VO/XWPYl5EjwK FqTC9DN4UXHB+yr8Fa1mwlarqnnoT+1J16tac8THxMrPakQmIgZ7BuV4A2eUAmgIgCxSszl9 zntFL/TZjRr9mcVDXKiJSvgaYpJen1Y4CBKZoYJFve/ANXRsrun2bTRr0BrvAC4p0oI/zcaf SpfhCdcm8QsQA8OECA8SCOkRb7Y5IRiIMdJFOhgBIiBIcC3H0iBpyBVVuZIab4uCaHIadTcU AEQYEtsEVKLnVEKKgVJadH3BFzGQQ/ZrUxaoAlaQYSCD+YMbVAXckJPFDiAGH8G1TC8gyeVe +gZkiNek06jN+XIB2TwLg/AnJgasw59ACb0lJ9gKXtCEp2ap7QVQ1/P4NXKh8QjwGcoxpju8 4mDWG2vWHonFkfs8qkWcR5uYoVIFnZkQxhsNs5kiSK2v3YIQsbymTt4NCtcsngx2GwlYvpZI wIsV2VuZdxgG/xcuJcQG/8BvHqWjhyJzwg8oiWW5/X0KAgPvwOuYPTk8vLgKXqf2gw4dcETs d8j/DBcU4zp5FYnWvdd2Il1PLEhf0aeimPjNU1W0y6XeI1qY8ZrlqFZScByw2LlhAnxNAyxA uhAqxBiRg8T4C6wvII2f//mfj6JG7AkTMEnUs5h5zTahWuYJ0XKZg/pBGb0to1aulqkNdHA0 xDD+sTt0KKjK/fK0TjZqgFb4AvSfl0p9+d1VHtw6VlIxFugtlfMnWANscU9mlml8Bwmrxx3i DI1VEhQ1nISpQtOQiPqpjabpLcOnIOnUACPSMZcw5T/ScWrIST20boSl+hr1vnM34npUsKhe zBpfzEkPGT5taVxIzFgiVRpNnPF9jXdosZuyQ07WrCXjdWAxQ4TkPKYo7s42rA2BgM1ZVcEi BizQHFqX/GnEmjoZKb9wFGpGQ5iqTPTSBjlmJ9v5WlXMhrBaoaSDlZSNcFZ/ZJnsTU9U9aS4 CsjEVzOhgkXFkSARQss9PE28jQxKkTPnqZzJ6Q0ksEXjYWpjhIF1bTiPp/C9ATyyoUt5GZya dXQRPP0RVwdAE8SVcACZOVAHDwJbHalG5LBEsAXcrYAsES/A5/era8wNMk9tCDNCzlNSyIwm R4xpi0R+qYRE0IqAiGdtkOhBG+ybQNpBJSIL3PNqPPYFT6mTDPSN3tI3zAQqB86sn1+K0Ar1 0yu+ZkFnuMGqB/sAJg7LoELqByaIvwCOpBP3ZccX/hHhDAioD8IvHcCuEXqoE/WF9aTvI2os Xx7eBL/WurrK9tDdiGmgPNQ/I/9gIg3hsjGb3DjvsniV1eVP36oYvFdSmbxyi9GQtbQsynwT H6myugaL3ZI2s19m6VWMI8/LjLRe0FP/2z7iHev2YfDlE61s6GRdtnn6yBdUkk+MTehuIALs CMNS8ykpEaJj4kX7vlnotTYf1lAS0gZ9Myrapn8ID8Dm+2YQBSCT3OQ3BQmBWdWr68uc3eyS 4mFWyCfmtDcLIZzsw/2/wZ0Fqg5fXkg6L5JBUJQ8UuTOC6AB2mEaeJyMClwqUwk3/KKTkRPM dVCGqoA8BJueUBDhRJywCamNbvOaiVvLwRQ3Mrg8IUiRh2rd9OkyjXYQKSARhgm9goCYjhRE dFHgZENdkO1P/Ik/QVdpjtpEItplewhGgV+HpHX1hiaYERx2OFKniyCk44jxFgkrqdTPkKEq U2ZUlcAtsRhfyYcsWLBgE52HJjQHpDIuz+NyiYSCmL733NO2nCm6+e3+jFSTHjmv0l6ZtWbm nlFwigfzxZvBEJ9hQpDOxJCGiwS28zt9uYNEUhImUDyCRxHXLiZihtrPihpJHw55KHIWX1/X jBekoDdaACyexA0Pnpqy2KwtJ1FOI3QwErPMZLnsIlcQMYMH5ENqTuzzuHjxute9YS2ctXCH C4ryDGLsZfBi8Z02b3ap7ekiOhAxmOFFyFFb4R4VCo8SJEfdMVTwYpE6D4k+fME5parFFVuU PrBGogBrIUNEquVXkwQNzxA8UMvwIWYeergJ3nKBFGKzCwcx/hkO0qsUIYd0g0nyjSyXuzxM kBqQOvWzke3EqLnx4DxsKEVR88cdnPzyJ4gGEJNHdKC4eegh/ZcDTNeq4p5tQL54ylNDttzD QzojnivtGgHDAaeIYmj9kQ2CuBXFxR2jP5SCCxkXeWiXl06q8HBvHxbTo38JSKk23St5aiX1 KX0juAM1eJ0XItATqNeZLfmz2RfLO6nBheDFDBeSoYMSVxDWXbX/dWi7JW2GF9JnfUWyZnjh tC5Q2PDRiwlcaN52POcinMVsYlp6IgHUg2k/6ZOeR1jdGrhkxd1DqE8POrzobLOBqh+Bhcbb XvaFjgBdqYGMZeSbV/c7nMJspgh4wSIoc8l+J4QKD5ciFS9Syi0SC+hu7C4I3UBhMRlgOzps qE+VpbbXzEYmKUsrHiShcU4RiA7jMtMggvzEL/kRMCQQ4RF6qF+Tb5nCdrnMqU1BZorQECJH K4glcyZ2yIt0kmwUx/gHQSJUjBdDw3VlOgMuG6cwlEBtgpoaQ2jmBjedp5SifpBLqwqYoC1X pkUxIUY40w4yhb5RyjN4KOW7CeRxB8cyUr8Dsukm3QcT+GWxe/ELWjopMe2jFTvIcOKqMvee Jn7gB76ftzo/67M+kzgMa+JQaxGVxZo4CdHaO+eu+7cSV5tVpTBIUltclvbbVXFBsYnwFNzZ fC/eLgXa+FN26oR5h7w95HjhzFawsPVlIXLTETgdW4P3OplcZgpdC8TDhEDGs571DGL5joJf mErdc8zrcD1VTo28RQ906QMEWWZa/IbD3KREJ7SHWYm3CBWSAiMigUQfYGLu6a6RJ26M8Mum RigVJLIZ4MWLoSCmPvVzv3S2qXrIlG47hChbbtS0tsJFpemJCMKlrWE6faYzCIZviwmFtEgf FCRVMSNiIHIY94iu6yD6HSoBZ0UkUoxJJ5Gx0xM4OEMWZTJ2qEcl7genD8tOk0YuWjQKiNCG cUkhZ2wKak5ImNaleZMcfSutD6wq5miBbNdT9ImxAO+5++5mQC07KUkUAZUQt3tRsInfdisE 4SBmAZkFeU4dMHcX+QfVD64y5PPn72dH+RVSGB+4wYINGAKkNVRjYtsc+995aiADZ0O098w5 A/3mW+5+3928700ezh696YabnvzkJ/J73333sFrazjFpv5c526SdfrLsM+AXxgnmNuYoDilD YCBJ0VqM42Z6zS8Z6xU22hwVZ+ULU7VTWHI605LSWl/+sz8biCnvO1l0I29GXAzGRXA38NZC MiBw80SWrQlgYwPGAg2k86RFbraJjZZLm7TBDC6vzz+aeyh9373v5+ijWDcMMJbUcSDj4A1v eFMQIVK3Gd5SQSRwc79NtPbAh4EoBAAlrD+igIEYIQ3sQR6sYpZ/yA/3I2NSTRdL/naqvAmt MatwDYjJscEB4eFmsUQ8hXzzyRJZxA6rb9f6hEm2ch/ZIteReS1hcDMr/I0rF/NHodU4ZzgI EsoWwVOo6F60Fn/SE4qQIq2WDjcLQqyhTn4NixhkpR4fuSVcIBZb9Tsa6i1vwTlY0rlxm3aG H62YCeq4IeRlXC5VUidVwVuAkcs9ksiBkzLkJybRNxoUNg06NQf5tVy4cZgknj41tn7JQIu2 RTYqxIB61rOeSUznpd/73dg4xGLJAD35VR+ES6sJIPcnJWqv3ixsubkYu/mledLX9SijvBmW +uuN461dqgIS+T4U9JExJZ8M63cel+4d2hELYTd/dnGSRa81rgbHzebrDnfcfhsHxAUjmKCZ ZzSc7s33zTpQSNYgiBlawyWYHF5UCTPTxjvhXeOdy/Q3I1ktp49Av1mGpJfYxprHPqU4lZjZ S+6XxKhQT9A0jui3FLUvhnhRsabOopYx1VLcthyFcc1uvknRGSGPrOwrWJJYgBD1tIMYuAYe 2eRsMxPmAFYovmzjb0BjBmUemmiDYPPTkE1QdnG4zohQS6SgEVBgogYyG6qs+98cmr8OZ4YX thjEpEKLmI7bpTtG94w0qYrXF+mCmnmcROthpEqREMmjBiUnxn47ow7o2HNa/7iP+1j2yLzk O74NArLfzGmCaFpMmS9bdO6SXoVfeiqNjjq4oPe+xguDQd1FTgzRyiRpuvopdsYrE5FSpid/ 7Tzp8u16aFWfbYfbkAKSm39b5BBNqodio0Q07nzH7ayUV5vCFlP/aJIP0zjkrr3L6MBy459J rOmq79AiNSl4wQsimsELtVNECEBB2jWq3bUJnymTqqAhXrhBgLVlFv+YY+4XNPEYzoF9kc6r r6J4/Z51lSIHvuDO5qAXMnv5SHRIJ50exFUBBi9kX7IhObr6pHAZIOTy5X09NX6p2fANBkUO 0bEtx079CI/5pQ91ZkYVXR65Ax2lwVMjJl5hIOk55ABHF0dM2JKJ7aHCj2JnXH7JYViPM0tZ 95Vo7GibyP3UY2zVEOnJA4g5WDLQphDBNXZA4U/7tE99xjOf9h3f8R0QEK2oahEoh3ixlkOh QXJF+GNKkD7DC+tf44XiWIXc+lOPVApkRHsnxRvxKFXlfoYXs/HGDtpWZev9XCGyTHiD7JNt UijljMvYxzcxpvZF+Ew+DmRoX1QEsWvK5Ho9FSQlMzPN9KtD4G8WDhg/YEHIDc6oeKHPEn+E spKSssQsgCEW/KjE8zU86SDfW4+QSzu73Qk/6yN0kkse4tc/Y+onvxLFIzd0Y+AYSqDndI/O Y0ORxz0a5IECyJUZDHygCXlEOonaViIINwIH2chAJfwaQJEtZBrXesnp6/Y8BSVZXRIdjCy4 s5MiRoLiPZHZCq1qfVFEH5B6jHHSGeUw2ju2g8g1rEdSK5a05fTxp3vANJ00QLAlyXPq5Lge yCVxZC21C1tLnvDBj2ObHLXlI29GW6t+7gQ4f8aOWFjlyEdJ8yh+TUBELKg2SFCjyfkWCmsi 6cpexD606vCi4sgQL+IfVUgSX2r9eYrFuq7H/PqG3VYs5EGA0CPWMEyvZlOc9Lb/QvkPBHgT +7PDC1DBwmarNzAfE4mCZeI9kGrRb5tIp691Iur4I5gJdHHojyiua7yguAuTftZUl9uQ0xAv eCpYCGQxMQirKmyiGL9GE+m2w+nmycVIanMxRdFK+EAZoJTGlOCiHIZutALr+yqnb/6oW1x8 JV0jy97q9dCW+/PISR4Bwhdn9BSgs8qWi+5tTbkN1mUU8v2QCWQaCmoRQAFpYmBVmWcgDJAb 0XBYD3DpAcX0mapkUyqnkygDpkxSwNb6WViEw3ocgo8cF91gaxynWvICMXjh5n0xV1zr5Mc/ 5f7uOmT3VZwi+QWIIUzU2jYhhNWScOgc2fMmYtKlZ7AVdxqejvws6gkedfwZU67DL0PmQkbq bDhy6gCtQykml8lK8WsixUY6XvOa1wUvqtWg27zGEYRvjRSk0CfmGKl297Riwxg431xTOfYF nrwH0g7jnTSqeGsPR4ZhXHgOKlBc+3YRLb/VujkqUovAy/icQpjfxosLK5PoaSL8ch9jtbKg 97CpPSEPnKo80z3whV/fFPaiezwiwkLTSLgCg5DwJ5mVOnrLvm+qZXlYC4s5M9IBlUgnDwhC ZuSQewTDfeUMmYUhusR+rYWq99Mc2ME6LltRtA7CHIw3tob7NdcX06Fq4ob8blqjOafGb0q7 7CoKzFQQvaVy+i+oybVChh+vd/jagzy6tN2v0XVJWNEm0haDmGwPu/mWG9l1QvdYXXYWtFmq /Fhzlc81ZCSlwwXjNUGKapIMK8FfSnO26G+VyRmtkt7dVFGvcbQMSk5Oc0nnRj5fP1KOLLVY GZul+ic98Qmf/MmfDP5CcIjp7zHBojX0qle9JjARdOBB4uGRQDutfVGRxcZoFRYBAmA1Zp0J duTvfe89LvAaFETkYHHfChVBrE2HXzlXvXiFFty7wQHmy3ZX8WIYvwjjQqzYZiSi/mhCjcda gBuWjBE40mqM8CdviwMKFKHPGk1yM1jD22iEYLUOGD4pHKvNxhAoIE3IyZZ+lq/co4VlxNES mgOUQnl6DA+PGAULxmx81pzRSlTz+yebLMnD3krfNweUGRQ37H1kFAATdUIcLS/r1N/5U3/q T824QZTRQoEyiCWv0rFVlA8g8QYtYSY6QB4uMrjKs77YWs7FvDMWDxxjCGAHtIIODJ8/ycC8 y9NXxmZKqxjaks1xaeywp5YTtyEsHQAcyePo6HOVmXqvjlmLOpVXyBAXJNQwvZPA5McCqfVX /pQ4HRZ0dlAIqASt5TzyXx9lyGm6a7cijgXhGWWKP7kXiJtiuOUm3maWmPSN5iTpMa+2Xyty Ej2sgqKKgMUhamytrICLI9cERSkhz+qBrbZvikJ0cCRwgwJPEY+NoQbu7b16xg4ouukewgAj em4V94ur7IeaN2ZF7Iv0R6teKVJJsgWAaCv8TdyU87U9F5tuUDNtweLWrJmtJw+hESTNIoED VU8cgW9/oO2pih4yKF7x8BwK3uAQs+FF9tJxBIZ72LGrMS7QtOACAs/xdih/tlSKrexDoy32 0vBpRSLYzrTiKpbxhsi3fMu3eHIv+d2QjoiCILz8IkNogtK094yO4zZ9XUX3h0eU9XQci1AP j3yXhAwMnJ3pdImOqb54Kh3IT0+4hzKKGb3ihVdO64Em7MLEDmKWPZqERinCUSCQhfzkBAts a8aaMr2MxFzQN3YuQy6IzJ8Qnw7IbAaShvXM4gXBlE6kO/HO02pS1Tw64Ws5T2c60XU6qhz5 ZwAoFo11atfX2ryPFdDJHX9WvEvH1GFc4QejSCcPrnI6vC428mKIQOf0OJCx2d9ZjfaIa8ZZ 5bC+P1K7zozSJFwoXji1C9g3PyV4wXiQKJfoII3bq73XMk9PoueTAsog1Z5VtXWzG14kftHN ChWSzUsTownA+fMYBYAOXMgrCfgFNK0bpXyqll3j8KxNCA1ZeV+LSgBmMiBXQAY4jfXhti4u tCjH5AE9CCc56TYQw8ujSAtrwMg573pxFAVVocmphOK8/aHxwp8U5wQ9nAu+7mFXFX7BlNqA Ib5pyptv9Bk1Lu5weC85gTMVuGpZFtQ84esh/+pf/SvfUqOTZINpADusEgZIHr9a5utkEATE 5M03Dknn1RKohNUgsri6Idm1CpVtqsIeoSz0pHWoQQf8sBAdxomgQnDEhXN5d3iF6eVdes4o ME8YJqhKWRwfqSGKXdOKjuTY3PBP0mllLZwSv0MWs222rK7iF7X+ChkCXCfkpGh0rzumfbRp a/UinB1L/UqTfKKGWMShteiSHClqWV3FJomXL/KRbfDCXkFYwwWVDjuAY9OGLXVdqbiV3szy 1DEc836vqpK5dnVHDQY1Y4ZBKUgDnwE6EheeJhGB0W9CbGB9NoPxxqevUTATsLsRBM2cLBPA rHjmwgTEhcV9Aw1o8MuGTAB1coMmR1apwd24KEnhBjFAFdNK+klmxIN9u1bIr/EI55UUOsM9 VakTGBpFgDMA2ugDLbqq5707VnRMdP14Sv3ADd2gwwi5IWcEkgF6do5lGQuEgue0DSlIhxVX 8mjb0zpN0Bzv4/rWCU/pD7++m6tFE1Xm3jyMweF/C+hv/lsMxnbPjXqegk4fFzf01vv1Rfek cH5N8aIP65thIkPzAJHuxj9zmSHZuId0XR4TacVfLykPV7irALbxkqm4GIK/Xp6ZYhHL2q4A Ef9dbQHRmA6mwLOCnTsapX6eBmopq+d7TLBoACRMVDjIn/Um2TpYmUlvl16bGALTUPJTybon tZKuch9pfcn9Wjra0ggJ2+kxFiCfb3+jWlHXhB6YHo/AwvdGhFCYFNfu9VNjxpMRHmOQpNAQ QiVai5LYF7oPlmUliD8BePBICVR0XTjwiwTMKxk8woAZJQ/KPwRXNdEWi9D8Upx6uKczrgG7 GdzBGg4UEGEygq/YLzRB60CMB/MzZOwdbkiH+fiTzGQjv5+bx7PAicAaAgUgglswaIh+0jS0 opOADgW5IV7DQKiNe24YL6jHL/lBKzDOhSE64CHX8O5eV+ZR3JTOO/i76qpMCok7dObwkUBZ jdx1ioazl8ECQS331bmw2+oArkg4NwmZC4VeXdO61RrL0EQ70RsvpgbCQmSPz2EKcAx98QKe Qakwm/AtnKbroSETe+SY9Gn7tZwJhx2TvsYvkt6aObr/IoaWbicd8ptdx/RHavxitz9C01pW nT+y8NCRo3fskmpNyXGAjhEU4QYjGdcahsaUYKQIMMEF7DThlmlAotSxqikSMf7hfuIR3AA3 BDupljCkvOIZ1rgYRDQ1GZTGz/u8zyMFkSacSc+/4Au+AB+ERtl9hBxiziCfdBKxpJ9f//Vf /2M/9mMaArTOL4l0gCaQRg71osN8/5lEKqRX/OJucHSFMRQGIh5pzyPSX/zFX0xxzgQTN3Ex /tJf+kvPf/7zaVefDv2jjUNnqJBgJ2AKZWA1auNVYKIq8B9Ao9FBZkj0N//m31QH0ij1ABb0 ykmnb/Zf1jT24ZIwGRYOed+QNSPnnT/ytKc9g27TtKs5tqL9NatHMciv2cSa9aOas8KK/J+U w0db6EmHzcYwU5WPTJfy3bVDOCPGHfCpFMUadYO8rRHNr9IBx2p7UhzkgkMQMUVGVfeRH/Fh eJ08ZYBar7k5DmSc+tqv/bo1yerIHfYhdVYzEVLSS7poUM2uLGVbVFaCai/YdacwnjD3PHWS cmWO7YOqRmtfwd7O6OFLOuEJ/fnMXDiGVugkoAYG07qfWUcaUZu+nAIE8BT591RVmkMCUZKE KsAL4guABezL9iF+sSTpBoP1LBnEDFxQyWsI4P97JhWIQFny8CfNcSwoxQEOclIDrWPXEN6j XWcXYoq5MiKzzuEUiCvFAQUXYsFEFjLoMCMS09VUOl+gFa3gDbliRSV0khd8+VTaX//rfx0s IBTCl4f4ejsuGOducT4oORmL5ybQIiYG9aOjCLUyKNfIaR3Q5HvRBFyoECsDQHTidJGMLqc/ cnNsQELU0bHDG/opASkInGHSMR262TySl8SL6LZ6U2c8jESi/Ump3Mi91lBhpcOXYEfinWko NURS6o1aKjVHsjRCk7PqNsgi0eBhzQoYSQsC4jML7YOsy4fRsNc8jB6+0u8gm2ygd+OKPoky M4DyER/x4XB+7Y+idxywIE+bR8aw/o2wOdPJ0yGlf5rhul7pQzhvd3Md1qSTwg1PfRGDe4kF KRFa/WFkAIrjHfB5ASXNz5SxuoE54JvdFPH1Cmfas/nBBSMdyjkpan51LHiEgGmjukLpoKiE ymnOnQ7yh7Kh0aeE0GHDltQAr4BHiJMOsMFIOIzWtTYpQn7q0TSgZldqAURWNBijB6DDTzAT N7Adg4XDuKcIZgWwgleigWCYkxooRbUQCgQhasuSChVSOSOlLR00+oCEJ8DmeOkhjAsUzviy ynwVYGO9gkhiPUrU8Kp84qTvZs5IbNjJlA7LaCsp63tSGL663enzPr+G6r0goBfTASMh5B6k aKwBNkBzoGZw62AYbD1PbAO4gWnOi+XoJlbocQOZL9Cf/OBFdsowg7AofOKxb4wFy5FqwRdB nPwCSmD3mEhhtn4T61AIA65Bx0rl2l4y1JthKRO7awcEdOC9xvJatjKcTQTXIJkyKQWZMz9g ycTA9zIKwsNhUyyOYkpAWRgO+WH+WDjEyHcDhZvE5SFKgQsCvEysRvW49+AFjRos0KLGpeQR YoAsIVTcIFHCB7U5BKGNRFqkTuSNJjyYB4ZwaUPmU/k4NFUTrfvSBy0aSuB8MPygr/u6r/vb f/tv83VFPnrGaisHjueLsK5rUERTDh+YSjRodZipSkLRZyqHFPxCQCPBWjd0GJOEG3oisHLR MboHrZT59RU/PP65NxK5KltzKpnri4boibOQmxm47EhPD8WpoNX23k8iG0RoXxuDGMs8tOOR 6y92gNaAv8s3Q9qnQ5785KcyKU95ytMWgHjGcmDvs+CxZz7zQzAzP+RDnrOAxXOZsuc+t+EC KTx76lOfvoSE2vn1+B/0AcqjMwQItBqADlgbROMp3MIUqGPUlEwWEwQ7yWl7gUWTo3e+s+2D jioLzMeIMiV/Jq5RZZIMrjKQzY/3MpFy6vkLm/MXEAYVBdymmBk44DJEVKMkadQbqiKDKE5x Cmp3Afr3vf9eDkyIaKWSxC+YSy+Kq2q4gbggAu46rXsAjNCrHiOF5niKnGB1Mw188ouz+dGl fpSEbEQT8Ca0UBBvPin24he/mNAGah8RYvggC5spmDCseipkyZP4CLEG+kAlLqaSmdroDyb9 V3/1V7tmgYhSIdUyRp07SUeHOfKfDIo0xTl5GGjj0FBSoCFtQXn4g3tiCrg/6CKcDgkID8Er QACD1WiiWqjE6Ni+QRwEx4QWPV+Hp1oENMGHVzEoEAIY8Rd+/udf+KIXMcWMHeIYtd2L56rd VwtSj275Mq3tXURGweZahqOXhHQxQHWjl8VTYVezfyZxZnIrOetLXpWHj6oi/2zHW23jY+0E Fu751dTOKT6kgGz8Yg+RP7/JKRaRh1/wzXOAlsM4+ZMG2rdUGAfyt3zKsC3mErUnpMYiDIst rJ8QDzKSBS+p20Q0YEUdAze6IgMlmcTP+9zPiQZVj+41fQe8FF8xItAQgIgESvoaB62QEZcS ZtJ1J38DtkvNGueG6acs46l4kWCyAWEq7PzM4IVsJF4oS4ulcOr8/eeGeCE6aLhGzzjxNOr2 SixqqjWmTZ+Na3JP5RREwGiOnQh8rBQLEJlhfxQ9xEZAU7CxAplBqKgQhkbgX/CCF2DAw9OU QpA4I5OYKBWKFwTt2B5GpAAxoyF2aoIdGvA0zZLEX/yLfxEiuN2baRZHyAn0+OljMAvh5ymk pl12drJhjDwgGgPU0ND8pgj+AhEWNBUtUq1bwrgSOUIpkY0/AUFq4xBgcIfaAG+hnD7TOoeG 4nTYAXwuMOXP//k/DxiBHaAJ/ZxxW+S5y5DAVpdu1E280L/DnAbd6CE3MD361hcfKpPsgIwZ jnTtkk2ZOQoK/fsaycNyZEOLcllQM9NH+eWGDvtn3Bkz6K9ZDY+8ISVSAEGCjOok/mRG1DH8 yayBHRRx/5F2q8aXyCvbi7B6xITAnv8pn/yg8OKuu5qTI0xUaNhtXwQpguLSfW1f8MVGTQNj cs3i2L7pIEX41ed3zipeVP3AfbUv4HXx4tKFiydaocOXRIQY1zgrH6R+bDZEGnfDV11pnb2e mANacWCBa1HUqeRwYREgMJiFjAJtjPcI6V0cIR2ZJHzI6oarJFjjgAti9sIXvtBQCMYF6axW uHua+inOEgz9ZO6RzG/7tm/7+3//79McvoZ9gErQCrZgIEAPoRMWO6lTjUc2ivDpY+TWTyWS LjjCRhQheInrQU+Ab6oinVEjePRf7tTEoH7wghcKiJlz00i0RHMoQn6eghcYTXSeIgyKMOc3 f/M3uylW5JrJ/yx9hiPqefGCtug2M0InwQhIhGUEzTHadWrooWGRzojoGOY4kCEQhE+G9z71 EW/zVmTxnnQ4KtmSKF6smTCsCP/IYIZp1F7KtrtFuFFw3NfDn9rjiictL05oewcvSCH0kAGQ hVbOHU2gqFite8qTn5gx1nGZeM3rgE+YkGktbxUvgiPkXPsjEfWKF9oXdPTEQfPVmXg9DgYQ vAhIhaBC7LDTVrK2L5YF3sM947GPmCfunYxc6i4UKYYuUSUEFXIDEywHEn1AjJFDUkAH7olW YO17fJbvlfEnfcMp+NRP/VQ42E3WNMSCJW4CgQAkirYwMZBh6mQ7JnmYMIwUhsY+SP5kSYJl C/xSd0BwEV/8R//oHxFNoCdQiRoUeyqnabCDbyDj2hBlAI+oB87AfAAsWNSgLHxA3MGV6egu HvG9JVBv0UKXyIbHRDYYjjwS01+Ks6ETMAIgABr3L7q2Smc4ZRfIo0uUAlBY7v2rf/WvuuDC wI2zDucrsto9nc2v6kq8oAjEwZrTxEBssK7ZVg9ogs4inZrTymtb63tTGiuOrln6rP8cAp1q ah7rqfjlvf2EgIxO7ag06VYj+UyxKODUCwfZWsa9ISGX1dXKUN4IDgbEsnrafBAukVQR8E96 BQ0pAg3h3s/5nM/h/AsvJ2I2HTPgOHjf++5RIdtM5G1fvJBelIKZ4o8sxtbmI10qBPECInLF lIjBRvbgcUDEG6Woxi8oDr04Dxr7ItCTsUDHJDpJNkf9SDIaFUYkhQoxEwj+oTaxeHXz4FSc dux/JhLVTa/wJljI5Eg4nn7f930f700ie+pzIOYHf/AHmT9UMWIJ3DBAIOO7vuu7cED4k9qA GESRWADT/w/+wT9AmRMrgQPkJL5swu6Pb/3WbwWVGsG2G7fpG1VRAyKK3BIzpwg1QBBAh/WL 7/zO75SxdDcYDkQGX0j59m//dj4N6+uh1IAtg/3yDd/wDX5LybUSqMq94RhuYKzm12yNQXrF 2PniCa4Bo6NRPCDqYS3W1dxM5UOCF5KCap0s8BerCo/PGQf4WB0g1Eqk0PBKcGo3auTpDNcg eIS8Snsn/3nEsaedvPinejQSJL+RIgro84oOogaD4oYUbrx02MmguaF+jRTQf61C5ojJMhi8 HAiOUdao4YxUcwk24E8VBrPMywof8zEfhZA/GLzQeDm8FF0v72tKl7M+quKdDpEhExYrTthT 2HIlKpm4dGLgrk51mwJhZS4S/fWq986KCEWd1ODyFSkKhthEryAlJgBlsQ7Q0i4ZIrrgMdJF PfxJVfAu8wQ6wMqEErEvsPfoJO2i/aiK2WW5CxFFsHE6sCAMTXND/ehGM5MCVLmsAPdzD6/w CyncAclFhfSWdt2Bww2xcX7xL3Tj6TbV0iLd5k+5x9UK1+dJp//c+w4uvMjQqJ8R+Q00MYJS 5KQe/iQd4rhaRCkmjrbIaQqVYIkgt67/UYr+8OvC/vqi1PCabe50Qum5IX3LaqUG6xUYus0w w07HvJkpzLgDBguUasG3PlLg+XW7d7ZyQ1V3OsA82ERun3VN2i/IEL3igh/4JV6WX7w87tFV qCI8LzLDeFyoW3iM+vX4RAfoAM0zNcwUhHI/hZMoUohcjtQgl5BBIsVB2xkRjp9+6hu/8Zuq TSL1OwSqKbQdS6ZL1xaCmvRVd4AMwJnWLL+keOPEmz9AY9MxczJ4b3xKqfg1cjkHM+cMrdgR i+mxWVSrwSTyQ0QUFwaChgA5mWMmzI+JIiewBWBBCive9o3pwb9g2wJBB2aOWSeOyGwxGUYQ aRdE4MYgFn8S+GQbJSgAJwEHL3vZy0B3ypKf1nFnZEonFaahIUrBK35tDOaD7bj80geuAS6D vVU10QdoSAo39B+175fT3OFOtewuY0RqKi76T82EAFyfhx1hdGaKIkZtuFwP5g0HWqFmXnvj zVdkmGy26/u1kM6AlFjcK5zt32ra9TUropdRA6jYNX5Ogb4hGEwN3Uu8UxDJjNepXydq+Rsa 6C59AZ2CejG5QMP6ZRD2Ved1D3voL5Rn+vA3uZg+vy/nfja3zEF2M0NwaoBhjFnG4pDJoQPo r3rLxfBdHXfhXIxYVKy7QjbHslGDhkk1ZAysLPs1ntvkerLP9ZiQQcSrWcVeAfJYVrmJ9Kq0 O2EWzxZ02KynJn5x6XKTBIZnBgVeooSlKK7FYQ1CQ2fLkB5/hPusjyR+EVPQvkFZ+Un+UCRM eclLXvKVX/mVBvxpBfnEX4CgCKerEkwM3jL+P2JGKaaWnPgLLHnCsvgCCBJYQIfdOkFvXf1G bgmLeKAxb466K4FQAtdLX/pSZxE/hSUGWAfuVHj8yBhc5bIubOQ6pX4sFdI9XBIEnj81OgjB yBmwI23Bf9prcDmts4z6ile8gk0WsCzZ9DWIoWBxUAl5GAUjpSqNVSqEm4mPsqRCLVCP/uB3 8MY9Os1zeuj5X/krf4VFJV6xpTYmNJwwZLVZvFMbe32RnwqZVuWHDgB5XAyK0UEQtif5uipU IjN5rESVU2+GiVQ4bJfmZPJc8o/e4jqd77nJRXIUl/BEl/g1RX4zPf3sesgoZPJF4BehX2x5 KKB0bD2OzbHDbqVRNLi2Y3H772aDZuV2xgXv0TqWCOkwM5YvPs2D9EewxtvxSoGAUF8/uUKJ f1Yuqaihf4VoybLKM1Tg244ZodRXbl1LN+rTsi3gatBhNq96EBDaNzIXlr109vSZxDurNlMR SeL8yvesfbKXwSALLXoCFR3WXnCXizthfImDbKwjYlISLkIJs/SAdddEa+FasjEEWqFmRVFf A/hAINHkrJWSgd0ZkAVIQm7ZJYUkU9yzf7hJBCuLYdodABB+x/d8z/f8nb/zd/xKFQ3pYSUk rjkK5bGDKMKLc0RnsGh4ywPDxKfr+kmB+AI0bRHvYPW3Cc+i5NGBxF8J67jnlcml80AeVhLr SmANrRv4YFKG8zVLL7x+pBxzp+1Jc+RBDKCV++U1hfABdYvoDJln8Qj5dn2R3ilF/xRHhIbK P5AieBGDhRSPVQqO+IgaoOGQ33ga71ubt1pYTo2XFpaL4qJ/zW8rlXrLffs0J4unFBGnJCOP YDxYixQ4nNAPViECSizl7JnpkQJDunWJU7ywbaE3dOTPmX0h69BLCOd398jcbOYLm/0wVhLc dUMXs6W5YVuUqnhc+2q4VOXvKgb37Xyt8xfWeGFVnZEiHeEbGJEwHma8doqbFzV/HGCcVTUJ XiVHSHz2Z382iwigBoBNNJQtukZYnCou4Yxf1K/aknpYAYXpKYtuR1EjdSxtsHELNNFyqZgb gOYGoSWMSmwCtY+jyx4QFmXVwMH3mt83U1gE0Uzg0B22VEAozyWtrVg842UKsLDoM19+hfl4 TZoMiCgQSQwYMAUESaHDnNONmYPQ6vII+jwd8tkMF3bghURjgrRN6Lkna3lyIoup2uQihXbB 8S/lObggV3f8XPm8Yke9B6tDz4iG/KY8y3UxBDSTlX8v8QLOIU8S4RzTtbJjdMTuILHDqaVX DevbIuSC+2KKravGqJYgFGDx1Kc+eZn0K2dOH/dVkfG0zuwLGGIHXoRk4V1u6KUrxh7J61Dv u3/zXQ9HK15wiab6b9FFKr1hRxVd6oRjPG1hsQAvc0Cg6yNekowb56PS3ZnQ7MehcBMBddJn bhq0LQaCgWvSrc2Pp2NQsPxBzeAFMT864M5uuBkmpmZHQaP6wFSI7CFj2P8gC+4PwAE6UAM2 C1Y9hoAxLRTmiA/atjHiBYQtkGRyAnDURnH5XuaI3iOFLgEZHKX9RV/0RUiarbCNXSyu+SUU I4WSEpxQBVDIDjTs/7Y58dQpioOS2FMs7vh+CsYLDg6LLHQDb9wYMNXO9PxMknfgxaIA2hKP WhcKQDGpjaGkJ6LKjZyvW1Gfra/KqFJAPomuSopl1U9CQP3FV1gnktL5F8IEZcER7wMWyoX5 5U9BRP60VKCn3is+8XcWyNY2P/KpJLvNlFGW8DYz+9zntkgn4TJWVPbbzrmi49S+qHZElcMI pOQO6bULdNGRJchh8A/7wkbJGa9PvGCo7lSVKGQwZTjfrapFJo07qNih15VLl4f2hfPhBDgH ohJY5hKMh8RQJ43CHFi8ThKJ0BoFa5iaC+eFUzBBCkwDFD5PPZAOtazBTCLcTCV0nkc0QR6Q AlFnzwXrsuhqQyGKARYKBckMEWio8l/Eif4TGaU4VZGNUggzYqzudWi1oAEFNomzT5Su8ohW QDpfOqpsF/JCcBGTAMoXfuEXwluIJWIEjjRD45572KVCozQNprRw3bve9e0veQkYxACpPOI9 nC/F7/gXfAVx6KeGj4FPmibCCqHc2Grobpn3lnlYufy5viqu1b7N8K5Kb1XyhtdkqrAWKXZ+ Lf/Bi6guS5k/ldgcly55rthBGnSRoK2d3r7GgiHLeB2I2SQdJi37krmwXdjewSOipdcLL2qn u3tl29+KFyoxWBBR8VW81u/lPGgRRxNdHmXuGSECoNaFUo5zZl9AXzKTDU6Fm3U3Wq0TvCBP 7WH6iWzYLvJAnfCi0GPYUrCAsqAS5EZjf8ZnfAZ+BNs3SdS0ITM2BfldieSdNMQMs4UukUIG p42CGAVoab8s70wbb6cJrplylrbgEdCDG4Lw0wR9oH4jlFXgc89YgAb6hn1Bb7GexGJRcl3E 6WDIVMu46Co1YzhgWUEQ101Id1yGMDAxWHPB4jB+YfGZfM7SZwgimC4242ZXEnQgEeuMRPaV QnBAWTWm9zesaoYjQVhLBZetp+KvjxivakY5DzRgdg/Tqz1b7QXtaIvXekyvOO59t28odq7x 1xWONPsIqRKAIJ2LaCTCPESaCPqw5Eq12PELGJ29XnghWe2fUxiM6JDCdL0MBQ+ZhLONaN5/ brNvV4ERL7gxYIn8wOXUT0Ht25k9CYOCLIwZ/5lSGi/tDZyyv7MSFPL5Z4x2RwEQ0LRCwvwh FRCX2ownc5Ffh0JeQcEyhX7EwMkzEsGQrcrQI/1HigAL7GceecIt9ghmhShDVbq4YMryeuKT tYS7uHKITLW0CKh5Nidb0VmRIfLi+4VrKLR7lAKhiJIi254t3NmJmUc6L0EMW8KO9BYiMDcu LVGhIQP+ZL40/TCL3E1PCn9CLge1vmbzuAMvlEyHpuHNBcfTB+JH9I2pt1pnZy+8UIEHGtbw IQrkMudazok5JF0IsEiNlwViaoWdPZKVY2cz4ubwIwvhXvVErVD+X4jU3kKSdfmDiWPeoRsb Lh7zmEe5oWFxWzwv6vrEOyXuDrzoUIM/VRH8ohJhRwwB+qd9EVPKfQcMgAzGGjH7HY/8Ices L3gU2aZXbnDaTs/BhXOE9DdwVnFNPVPBLmMR2oIL7v8JkFFKJhDdXFCEZUnxNXMSESF3T+hs u6uKG+o0rs7lG1MkwhkqW50RFReJjJ3MM3kzDkJBkZfM1DkjjpyUbZfGREW3mR42g/ju4jc3 ABl7AyxFV90D6tu63JNN64+nHpwBcWZHWszwoopHneUAmR2WtlTCLnisvJe//OUQH5Alm1Mz 8yNm4008cogLFQKUSRWSV4wLOlbfH7EqW6zV5l5eCvRUaVeAFQ3H7p9Zxw1kmIFfRfJo/1tx DmC2IbJBFgSENXiWn92VJ4tiIVENf2Y/+FDKrpk4jV/QrQyj3gQIHV7G6SxqeBPPh708UJf3 R4IXdD14gRi4GdlXMxhnw8nlJNsZXmhve4atTgTzdebU6eF6avDY2qS1PTECLykVZi53PWe9 g0cOEAlRwSI2Hpnhe6sMzZCYPXeaqYEb1CDjcj2V/JgYgKMsqLNDnXKAR2k0MvLVL1DvCrvb L5+4Srz7Cr+8zczXA8+dv+/GG26+eOk8X+74oEfcct+958zZ/d5w9qbTZ06++6738pv8nG1m bev8p0+dvXzlIr+0eOH8JVuk7KnTHNJ7H8bN3XeDCHzMrZmyqCn26eD7Aa2LNuMkd44saPeA 0nJ+LzJz5Hf5DvAgHXkfplMnfE9tzAzhTpfdofHHfuzHP+UpT3rZy76f/nD6Az4o5uBigcNX g/rp1TB9OaoWgWnfB8zvsnMBe2GTzj1PrdlfcvqUXw+7xZqUneSo3AS/ki6/qbcqUnjP8KLA ggjkXOJo8Ab/tU+D+QuzsBnQBnkKRuUXF0MfRNiCozxi54M/mB266LbmuAEW7FZbOv+g4533 3NN05vpiPMP0wESAwxuVFX2CcFitDIB9RAz+1MkWuOKRQqXEoisAP8ZGBjxtfQErubC8oltJ bP2InFviAM4mYMuOLJTQ5YsLr6/27cz6Wf3qmqfqw+hAbnj7Z125o0h61ZliEEMAX0AKOszQ MECMp66rgvuXxPYDN8AZ8gRcYkqCRfWpZyKYYll5yPQtkh9J7+onKp+21q2nhtSWnnT1dzl9 yu8iV4cEHpaqI2K3gaPQ/fXVZaTloz7qoz/hEz7+ZS/7vp/92Z953vM+ERYD1dE7PHVEnRSx ebqTKHvuORRV3rxPu11tyGfob87ltw0pRofGRcWOjm95FN6IxqqqSw/CS71FgEucqmjFPZ4f 6EwuERNwWByNi8t5tM1Yhs2wLAALNh+j2NLKUIofcCL7OsZ4scOerOIUGdBe0qNDtSI24EVb Aji12YghXpBHvECEgABuCLajb4MXKJUhXgguXHjyNkoN4IXxzrUoDju5lvAq6kN5ZjzD9Fki 2OcWKcaOJeLqj57IEF9QM5m82ueu/7WfnWXnn3VdMEZfZYuuwop3Q0CMUdk9TeUVbaMqa9O1 n12fZxOhgOm9evFKDtsH2PPG0g8rxJpp1R/p9Hlctk4+Y88r0lJGblxLsmpvKFSq8YoU4oUD rKy7Jn6lGJwvQGSwi5XR/lyQYnOlTk1aYaX6RwdLZhgMq5aIFRe+Mw3tcF0fMFi0zrD/Ylh+ t/+5lkbpLh0JiSEn7N4FCM6eaWtghieyoZCnpDAwEIToAOkOr5FsmcqK2c6BSwOYGCCoc4bv AF5k/0UnwGs7YgdYdPQ9IglLvevxxk+umclphMLx0mE3sMqXw3og2w5x7Qa1BpHI58JtRzzE Dgq7fkrVLrGm7MCFNVJs5m6LMfwZ+7TDna7FdFI8rXihbLBPn4MFODGAiyPOIKwxsg4XIvPy 7RoCaGidmPGuH83kLXjRiXRq6KQpww86mIIuyaNCIvetbiCsNuH6q3SWl1pMgqDBlbZ0wMs1 xCyQOCwLiT/DuwcDFo2w+KV74UXl4MqRjsGohycI0vsW0djihbFAGQK84BHRMrgEvECuEhjH SQxeBK1JMSZPCANzS2NkWUDa7Ndai9yML2ufax75YI0LvI0U+tT8mY+uSPQV6VEIEea1iIoX D6D/nRx29kukfdh5Z2o3Tu2Q8/WjjvVl64yrQs9sXuQNi1C2eSPLehnrTexYZUcZm+J5qT9x 5YyrMomi4qMOAqKBukeR/67ULG5ahaViROy7booNhFWLSWao+1PLEAS1AV5QD03I+cELUm65 +UYietjyQAbAETv9etkXM7yo+rmj0VqoMgaozDQTMwcFEGzS9UeWVeK21VdAAS/ACEZIImv+ 2GaH01PwwqmVmi6IgETgqPfLesQlz79Yy2Hly4oRVTjXeNdxcxtXCQZUARMv1qSgVzKHBAxL GRxdt87bVTWxG8iQ1OlklcNasEsf9nPWn06204HYR13lgUJv8rTmtwO1292QlXPnOtKlfQFA cFYQm8TYWsr3IuEZWCWgPLQjQuf6NEXqpHBf5aqDnsr2uc+6RqVqBrjGzax3BDIkVNZNYkTI 6QuVjuCFHXbbXlZk3IwDcZ75jKcBqSwh+U4DlZvneuEFG6CHdFnL2DpbJ5NSwRUQdgqAF20Z 4sTmNCRGklcDwAswhUEyMPHiULe0oNfAxHBzBJmhTt7VQzCJdrue2rHgzB+x8nV+JHydSIrx izWOzPSz22acuVbcVZzlvZVJu63jA5wq+nktXVUyOzmcgUjH39VfqPXP5HyGF5v1nU5Qlg0U Q1zriFzZbGhfkIGwBTvWeH2OXfy8fSemxF9eQ8YwZZZth/8ylAv3TdTh+qcrzU764jFs0NN5 X6dbT8Bii2LiyOExORXCrBZ28oVGTzb58A97Ln92XE2264UXrJbthRczeZOC9NLFQjY1ghdt eZXli+3paVnIBC98NYD8rKdmLzY5L1Jgsl4FmmK2sPkaZCXnMgdXTrEuMLEv1vLfjbST0iFe aF8MRX2YKDrIIloZpkR+Orllf8awn8G74dM1XkTPd4+GgwodhrhZ8SvoM6yfnMHZzr4IjlTp WiNjxQvnXXlLvBO7/dM//dNZRPsbf+Nv4OFyBImdr/bR0C7oACIGbJde43SdcA7logOLkAXe DlIo2FEYlc0y3uzXOtpKi18sa7f9ln/POqCH3LBTgaUQHZDHPfbR1uDT8N5x/KnZAHekY+fs hxc6FEMRoseM1kUQFAJ4gY108cImfstTt47wVLzA70IbixfU6WjPX9y8n9ZBLwXBURZTJBNP F069cvokr8z36yOSb9jJsEs3ipmd2eFFSln/mhQSQW/WPWDc6KZ1Urote7g/bchYHagNhZnE +EfJ703o0Mmq8nZ8vJjJ/8y+qP2pQ5j1RwYI6xu/0LflGET8UPCCADm+iXmCy4pWR9ua6FPj BUMrY53Y0a3Kj+83xV4QI6w5eKGeMI/7xK2h9tN9RoHj7c3Gvghy5QbmZ8iABZaFDgg7Ehb5 amuLigMVTmDoASDDuAgvcR361TVLB/zDR5XbjFDQdTdlsaTKwNq2yBMbP7+ShtoIiGJNuSXc tSUpbrxzzcfU77kvHhjjTBC/YD11aF/Y4XU9s8QZvgiNx6wnY0yRFNyMrpiy5sH2Gna1g4kO p2qRYc7a4XXnd/RzhmuzeIf29vqape/gK2VDqcuWBLax4IbAKhw+ioTw2Rd5rOJObb2zNaqI 7jWPnR8RXAjOmhJKqgi7a4eY1v2jlNrCX6tzCVM0rewYycmQ2XoLEVCW2NfL1+TcTrLsCfkA XpwEPZ7vHfM6pLtRKNe6jF940GPwwlKhr0fOkh97BMx20bHl2RKg43JyAhkgC78sGjFt2X8x 3K+1Ay/WwkzKVO9tJ2MIGeuqqvRWGla4rPf74sVa1EPYvXBnWA81BC+68RrvWBNhhgsVXyo/ XxMv7EOWlrBDOc4D85vDvuAQjgKytpm9nf50Wn1mD15zvNWUyEDCyZnuIV4UIOhlusY7BYul wx563F5+J5E8KEXjmn5oCpnyjZ68bfeBxot9/ZFOBsJDFS/gFRxOJLxFsw8273FUIaGU5/+Q B0MRyOjwYs2XLhTBtVSOMQZwADeYMu6/2IEOe8n5QP6XqmeVzPBinR4/v4Im9+LFuv6KO8fM MOzkDvwaVjuzszp/JOw/w4XEU3tB2fm3Qk4fhAxusEOJcbJJjy/L87Isn2IAEWYv3VDWPT42 Um9meDdLD926+ULbVzrnPjLfmRjZD25/0qWs4x4t6EtY7dVEkAIB8e1EWN0ToRdbgwBHIeKe 5wbsNR3rzNP9Fzv0wA6+1CthzCxkwEktornsB++0KykedefLFx7ZKEG1L9ZNQCm3QgE0vCHK LygLXrDgucO+WMvtDFmmErulWSfA8S9qb3cIdo0XVBZkRW/WpWHndyPL7OkM8q6ZPxk6HEl6 9V8qe838hRm/LtC5ubgPXvgJEs5eZj2VVVXinWgXv5+wg/XXkDGMN+8YfuyXTkHOAgSR/9gU 9sE4jgMrdsTmnUaXz3JRYrEp2lHvsLenMWFNLwf/1u+eICCb0bO/80FCwF7Fp/vBd+DFkI/l D6ijcvCQdV6Idv/FGi/c06lVptVAnmaktI36Y7zwtVSqBS8IkRq/EC92QNjxRWUot9mtvcaL HXK+bjR6rJJiybY5x2E4hFnn1+kze2SvTlbW2VHhzGY5DudFkrvMsE0VJ7mIhngPEMlhSzhH DfJWO6e/wCq+HzxsTn2uiOZXHhuSwvxr4utf1Kpyn5prE51ZUU2JgEVwwY7pcRgd51r2a7bj GjixwrersC+48Lv5wmEGi5wlwtrq+QDjBQcpDel+HLyohGY+HD+JjAf9zylb7GbnC0zJVvWq ACFkkN/lqA4vah+MdIAXBD6g6dYecUPVYH2kUwu1q5Vvkm1oL7QOb6nTsZT6ZCbk60fVf650 mOHFrD9h4rU87+hMnYLw/VC7Dte/1jiypmfHRbP4wizdgLcSZeUuMbjWzlvtfG6WT0C6SK/S Hl7Zd9BJ+wz+sk7RjajGFxRvK4ysdg5I8nTAUce1IEK7nFz+hKthaS4GxcUTtiOCF4Q2PVBK mWrbmJZreZdvM266w3/A6owU1yP94L3vbcdbra8deDHkM/EitEC2WVLlXY8bzjY76qiEtBG7 YEZ+HULwAspCmMvttcvNVecYymJfGPL0kOgFPs66PnJM+6LjiVp/J4eHAraZp34JeYYXMz+l DqqaGB1eVPyqvb02rk0WuWf4YvqabkO8EMq3LHuEFDN7YbZfaJYuM1QWyuoD847i4RAmPmhA 6Ip1N5TNrN30s8OLWf8NhazpYPGAgjekGGgLtCWDxFlbGVayFfsm+hbRGedXC4LfJeUUo8Oa MLQnn9hWAnxpaCskH1i88Pup++HFlsBtp/tyngEchEfhd+w1BHnRii86fehzP+zGszcw4k0+ 3uf3RCwSLl1maxa7rc7eeAP7U9h2QcqpM82dOZTVEsuBuL5i4BkzkJjIOatKi//MuRE4Mpfz e/WgpfDbnmx/SclJEPVUCO6xUPAcPQOi5qFOpvvKwZWTV0/yHRV+ufff6YPTw3TOrBimnzl5 xpLWw+/yFwzYANLTI3ybnXsMcazhLt2ns/Ra1hqU7weAF+lD7RWabtifml7PwOBovcHpFKwO 4rGuT8tg+PgLHBKFfQoXsZsAHlmkxUNSCGEQEeM7DAT/9EZn8ZGYHh1eJL2DhmqqdDZIcEGJ 9U/thYoX0ZFrsCAlNoWmtCYD6eACiODyh9EK7sELpox4Z7ZUiNQUNI7rVRUwlsnCO/35I9cp 5eCdd75niBczPmuivj2rpcnZIm2k8HuJUz1OnuL39MFJfn/5F3/pMY9/3FOe+CTzk7P+nj2F vG3ST1zmLJj2tNWzNUerEpZA0JpeCbS5NxvYcJleNPlGttv9mZOnc5/0th90dO4D1bfTabbb sreS25BwWX1pqMM/5mX5/13/OO1l+Bx0HKWf4PvyS63LQvKCpLYDbnnf/SZPl972ra3yQ7cm h/tcsN6w3XVPTGF9apgfTTBMn42rnXvE7G9HvZxu0/rdEGSr5/1+ElOPgK3jl0q7EmX0QfHW TrEShbbyWOPf7VlkCqfyLC6YOaWaUCwHVCkdkV5u3LtM3xB1W18avYLZ4Jf2LII17QaiJSpx A5aySEER8tNo4i/dpMU+Gk3mwwYvOjB28QLZttP1qSTWmvWew6mJ7nqG2vqqcxbL00kNzHeQ oSoIXmzuQaryHnfuU38FY+7bCUoBhmK/pN06LrRc+3O0ZLNz/gZzunu9oKNzOHJdUXJ2j2br FGfaOTqDa7gOqiuYLTC12I6QwbD+aX8m53rP4g4Hl9t+WZ38b/mWb8nRrUQE6zyGLL6/4yUZ lX/PSbSr6puN5j9oN76dFOVPHpqzEneOZb3m5JnD9Y6q8G2F36Pxy2Yz8nVkMcIlUpHCdxpS REgSoYb0jP4ePv2AJR7c+Y53X7N/IbSLF76BvWZxxVsqcMMpnlCHJdUhXphnfYUueRSBl2WN dAY7TrVz07aGwbZM5G0NJcxJzZ+x2243qKZs25AG453Jz25cWJM6B/91rc/waFb/1D6f7AAc 1r8DL2b1z/r5YOgTHuDm0rnzcJF2Ox+y5KhH/BHmxNcOAgfxF2g3akbxExfYFikuWJUCzJ+P +KDllNnlmwluNWb3IH/i7YoXIoWbQRoRTh35FlEgwziI/TF4ucQjTj75iU9spzotsTmPYvXk 2rzPbq8ExB2gvK9+uk4Icm28iMhF84AXM7CArFpWZOZUPn4JUPlnjAj/jHx2kOE413JOcVlB vBCG2+aWzXl246Niaj1Wuzm1rrRi+hAveNTW9LbjzahJn9mNM706m+9aZyX1TJ/U/JUnhvU3 l2ESP5/izsS+mPVnxuKzfs70Z+hmQ5tfnNzlSFdKId58iZJvsvD6GSJnHl0Ar/gg2iOUcie1 6dBHgQegkVUv+Oftt90BOoA+IoVHw8urAaPUQEpznLc4pfMiVNGQ99wIFh6zduNZtiO3PVf0 ippp0e55BqXmhl3VZ5nxycMHL6bxizUobOyLlbBFwj2NDnIzcr4MxgSA60M7InqgPrWeNViQ IkKLF/W+e7+4sx1S+aH2nsRTq6xWVU9jFcLy6KHCi2pP1XYfErxoFU7wYrrPaqKYZv2Z0WFf e8T+VMvCjuAPKEj88p0EPlzEV9cMeZo/Um3Z7KdiQt06qDfBm4r8Ag3wpAc7AhBtE8cSF3b2 401wQylr5tp4Lq6DLuaFiUkXJuhhsSw2+PX4xz9W6InHoanC1iQyu8NCGgpnD3d/5B13XMMf 6eyLjck6OW8CnF6OyWvHpfl9YPZKzOyLNY5ItbVRoCnBfKgf+GWGyMa9y04BmmCc/LrGi8T/ OjQMTlWhbe1u+1PTyTyb14m4TZOVkw6tquR0JWd6eyb/+l/ra9b/2W7B7HfqqprpvWvaETvG VVGD+YoOZ0fPj/7oj3IqH06u+iaIICiQ4tcPfCmJSyNCt0KqCgpaAXTy4oUj67iynwqvsyP8 89TZw++YCQFaH1kf5UajxgFiuLiZAsuFXuGPsMmA5WHXjy0uA4gXM1yepe/Lbw8y/8EdO+MX IxNj6ozQFTDbg/OgAi+qAxm8qz/EhZwf49OId4cXESQ9HZ66U6Mh/YIX8usaMmb1dHixxpcO L/gGhiRek2JI+pn8zPRt7PkOMva1L2b1z/Bi9t7HDC9m8r8vfl0zburADyFju2oAYYkpvOIV r+CzXayP+EEWzYcYERBBpSJTqdVjI4QPYyC0yVoMBn0K2lVorafaF4JCu04frphUP8iG+E2i RTjC231DYAS7zp7ylCfjlABqxjvrSGeUlM1+FeDFWkKaYG+lpHsqv2LmLa91tLMGObMAhcAC mMImKHgjsqxxJHlSJFIkBlW84D5KL1VFsKO306JV8dWQofBHP3fjmtkXM/mc2ecz+QzodO3u ixcznJr5IzM9M8OL2Xhn6Q+m/9W+QFP7uRk4ClVBCIOXGMlQ/Y4KtZuIwvJ/kX8yLLsn29Xh Al94CYdUL8N9n4ESCzb5b0vv7dJIiVeS9V1BKk+f/exnsWWTbakeWK3DTsyimjCyfXBqODUP G7x453h/Z/rX6b0YAp20I2+QT6kQF6AOH1KF7uZMhNmnmG2ujPqKOiloD341HFJJ5nLZndU+ oaxj6bLC0uLme2KhuD20nrSrscqV9RHzZxTZTpfJsxtZv0hO4WZqz0++9xs46Lhhxgcz/2KW v8ptlTfbrSmdudT1p8PNdPs47c4wqKbv65/THyTN0XGPBuKN1XwYcd2iMBHVrZCTompR7PNL yvlzF7M24dTLhNZMTkMSpIBWMMONt7SzV/hTO6IhyPLlquV0hc2Bo+wue/ZytUWZ7fprnQVr via5MoodOWd8NSuyr/3bs+sdO/EivclNhxf5E6pBPmdF4cQM49Qc+GMot66H03sPB+dyhSyC HflMcUUap9R3VZ22NV6YX7wQFAJVO/AiA+lwRHTw18v7qT6fvF88m9d94wLTOOUWpzpoCHo6 8Z0aWHNVBtjBysxuuibTdxlmdJvhEflp2tVH7tnlieZguWFm1yQc0E1ZMEIjIrbGSfbplpMT 8zT9MbOcSc4zN7Zv5QYm1HmkEJXA8MGO4OIGNUnmNrnL+U8VwrqJGBLwOEjRTdAxJ+LB4sXt d47fN6vzV1EjMlOVsxjhilEoi0jzIZJ8T1RyBw6yapWvhJrT885sJU2QkjAnGfzW2ZKNoNFh 5pgYIeUaL0R1a65DqJbRkaG174wdgYyHFi9m0zyThxleZI46VuP7T0N+neFXOz95ueqk8+cs 7nAcPVnHuC9e8AFDRgRvqOoxLph61yB3SIhmRZwIcqq3MvVhYzZsql3cmmH4Q2OZ9MRT1RBU cuFy+0iwxgVhFHwNzubg1w9oZwXXhlpVi4PXgTgpx6HbcVBjNo8z4sxw+Zj1HFwTLzqF09kX 0boS1ACkwWoutAFLJObp/BFI73K0FWLC+WfskVoz9zzSsmg24Y03srkDoAEsFkOjmTMBiyrt SQxOtc/IlXB0WkmpDkrYr93hhQR5kHTPdM7qmeHFbrtmzZfBi/R51qJdaucnj9ZrduvzHaLb PdoXL+g/RWhdESXMSYwMiUVWh40ORydzSoF6tZQT7SvZjk5Twmrd382fQoaISbvPfPaH8LEP vn7Ogih9sFekG5Iw8ipTbRpa9hOuJf+aeLGeyuF4jynn1+S3Y9Zz8Pa5fdFpmA0bbQ3yzr6Q QAo8tDbKAFhgYkSYq1/AUwSebK4/8Rkr6jey1SGFfxK8QLEwNxCabD/3cz/H4gsR6CW+0OMF VQkQa/sCvLDCDhf+T+HFzB+Z+fm75W3NZHnf9zjKKnixhoyZXTPr5776bYqby/4ouYtfpt5F 9B3tVuMiJob1d/NOCuup1OZuKyMR6jCwwHc9OK4G2+E5z3kOx3yxjnvDzW27BBd5XKrTrLjr rru8cZmWmuUo7AtWYKRGHeOvVry47R37xTsP/fijYi1FoLVx7JyFhSEwlFuo6V46gICCnJtE wWySrWrfaWbmeEopbgCOX/zFX2S/OcGLJVa62asrOlhWmF/bF6iAIV6sz3c1WzuPZ+SP7GsX 7Jt/Xz+z5j+CGltmrfy6w8TwLa+1qpjJ/77ps6Zn6Wc4smBxEFTd3Bt6cP/1+rLndYpN6fyX NEe80x2fNIGNgJ3LVwuIUxKGYGmPjWFsUNaWafkwn89sXjANswlJy+lNDW4EVpdITp5u+zvW eCGi7SbddbIv9p2vLv/BbrxY8w0iOJwPhqc9ZnQK8QNoCWG++tWvHuLFZtF8yY/8P+95zwM4 oPXQH5HXycliCu+w4Ziwgs3pbHfeeceCCwO8cF2j4oU2J/uL7X8FF/FlmN62VI/inTO6h2I9 oSf8sS8uzOpPPZ0dcfrs4dFM9dGMX9v37perm/pZuzM/ZV++nPWH4w5igmmfuh2LfT3DJuC6 Ou+ZZThHrwHhJ/7lHipSPvIjPgoLApjg4sZlWkqR05dKaB3aZn307nvfLxZkw4XReryk9RDa G7ft3IPW007+d+PFMcGiTtO+BH9g+XfhxQAsVLlLNxMwlLPAWIIWKAKcuQvnz/PZ0RtvuIFf TsFoJ2AhkDgILfzDW+vNBrgX+i6xSoJI77zzzud94ic+6pGPhO471kfYG8eeDuYbPGI6OXAJ MOI0ct+Tv3z1kr++137x/KXl7faDS1f4JjPbNC+2t9KvsiO44ctyugJ9aRHTBUbQWs1OWaej MipeZIZm8rMvXmzkbTl3w9M3/GVfQJfizuWZHV7TK7c1PbytM2d8LO+aH573Udut59xl4LR7 Yfvdxo7PmjAf7Xmt7fj34/60ATc3wTcyWjcuXOBARj9zN+N4csIkCD8GgodfksLqpnghWHD5 vhm/S6itvXvOzglUHiYCBsfZs/jFrH3wMhin794Eq5KH9BMHjW4EkS9eOs97ZFDy7Jkbz5w9 xVkM29Md2hYN8rQR+b71w8kfeWAwkVIHb37bXcMqhnzfiMq1nHbR/Z679z5TciKG51m84+23 33Pfve9/3933nT9HSnu9bzkL4z3vuuumW2+5cvESgH3rTTc//VnPfNyjH8O8ndyef9v1ShMg XjT37evn5+97xQ//MCjBv0vgxfJv+Wvzj1kzxV9msdmHSx+7s3Pef8998n33lNPLh/S5pv95 TPti4VTwt8eLy5eWc4y79HmcVbcueiyQwRtXnqeynCex+SWFtyKH56xcuNRWLjfv5BYrg/6s cNMNkWO8QJbsPxJ1KD/yxAhf0MPD8RoUcAcgiyPojBe/+MUAgcEsccQXWA0cfNCjHrkmwpqX gvtyFLhQqbQ9B6ohiDgSWqFXupz16aqeJhFrY4GUfeO++8r5TG/tW0/Pxg8ML9atxp73UbrL rnCMOjwIHQSjVmAOc880c++qB0vWID15Hn3ro4ZDghV0YeQGprnFSC5d/Mmf/AmkP35H7E/1 dv3TFPljbTplf3rX/0WlDDY9zuJ/s/kY25/Nujr0F2rZOT+Nz0eIP9/5Izcs65EVSiTgsD9Y ai1GIG4eviK02basHbmYmAt2LCcILYnjTaHDdmf+yyz90Y9+LKT2i1bMEW7I53/+54MX6/VU m+viu8GOblrXDFBzyqWZjqEf19F5TeFNCl/gGkHGzE68ZlzjmAJ/vfDiTW9917AHM/uiSfso UhP+rkYsNbvvzUiVDemF6hNCHSHALXRtk8X58XmEZNC+EHScUZiDlXjwQgyqIQn1rZydIGgd VNfP7C/oOIlGhvSZ7UfYDy8aoo1LzOd7vC+w9qcK6tllH3PHzRUxa/PNs2vzO8CL7T6ojSAt ZAV4FuAY4UXl+9qB2bhmeMEWapp2Nzfsge5hc6cLE47CyfW3jWWyP2qoJCiSddaORNa2BoUh dnTIcgR6trDTVfWr1b54w5vvPCZibRB6e15OV0p+XcO2O7ii0JhXt2YIFkF9Eyl+Zvl+4vrC 1UweChpkgjmISXseR3fV/vjI7s1wrcOLDGTJ3+z57nex2Afps3MTq9Va8kzP0Zitsy5lp9ca GsCLI+y7pfnQPmrnnhK3Lnix0OFwh/Xavli6MsC8WIK19RlOkT7H32bR+PaANqY7+sJU3NRF U49cWIv6mjNNsd013SpeDDN0RWb5scCGdtZDZUfsJbwPPvPB69/0jv1q2Rnn75Q2NRO2SDyZ p8o8qKH8K8Cm80vOmX0hq0WNbOo8syymrs6zWTNHxjjDi8hPV3bLx9cJL9rq/ZD+c34a40W6 3XHnma0x2KXvwIsW+ymnQogRW/3f+yMzvNjGBY6g1QPAi8UwbdaoIQxfDCdambhsp/Bn+00q Z4ZWDS8Wf/D4eFHBqBbcgRdD/PrViheve+Mde+FFW9SYX2tBff/997l/FgIFLKggeBHTA54A BQ4mx9OiWMwZY8H1bc4XGPpH60nqZqjrarUP6yNiasPhPlT7lLCP9qJ/IpFdqRm/nl707dqu rjKTqtb+SOwLAb2zL9p5xO0a2Bez9d1huzsoAF4QqnCDlnsu/ZJm9V+OyP92/biDgPgvtpUi nue4JtFU/ktfK1Wtf4077t+Zocx64PvSZ0a664RHB699w+3DJmfttVDx6DL/Gi+unNicgMoj N89pUyy7uTdbj2NSNopP8EL1suzO2hyx1Uqd5nVTqisnuG3PFKB+569ejbUn52W5r7RjpqWr SNwgYPPQxDs5A3wjcj1NZ/7IDC9mHClerFl5OL/gRcP0kX2xndzevljqGePF0A6fycMsHbzA GQEpmCCinoTDtDJYHcu4onKaTtqeuNBB5AwvTpTzkGuRmb3WpWeMM7xoGzyHODIR9Ic7Xrzm 9W/fCy9Ont51XtNa5DhF380trmgYzlBXNANh+yEWvRKE5Kble2jri0e+zMMjd9q1aWiL8y1+ 0YECf2b+AkZObZXDaqNquazxwu/Lr6998Xuc/6Bh6Gx9YdjuDC9m+pyNARUv0o2hfQRetJCz q57LFftiC+59vHOGF8HlTm5n8jB7/5Xxgg7suGGfHq8XuIZK5cP9Jo03+ETmSD5neBH1P+zn GvJmdsduvEiXrsk2v1rxoo6w4veiDw8hc0bQjSge8JGbI+f9b1nw0BJJijenroz9nWE8uX0M 5QrrfwPJ2ne9ahafr3hRAWU28fvpz/n6wqye2XqKQOysHZmvy5vvVDZfrwSYk6dKF3PVogVb vKAP4kUZeMGR5fsiy6OBCp3F/6u8VRoO75dObgzaTp7diLm+8v1dO58rxqxsth0a1hfR3QHL XVOwh613idQ7MR+PU/pYeT7A+HKNeGfHfMs+SCN/7apT6H2nopdvn/HdoMMt/VWlFw1W/MkJ Xgznbzm5u8U719e+8z2je+PX5VNbtbdHZOxo2/vjxXi9doZfM7yo9tSReVnwQhOv4kWV5+TH vhAv3H+xxotgRxvmg8CLmb7tQIFsy/6ozVWV00wfeJh7d6W5sN8hYPA9upFg7ss/M+G+3pDx gcaL2X6tIELVWhUvuqnVoeiEqoH9UbwIpnTAkbIz+2I4HzvwYl867sCL9bhImenPmZzP+zPe gDGvZ/qe0jXti+hYOjO257f2xfHxosHLVodWGXuo7ItlT+pgv9lMPmf2RdVnh2jSNFz7zuOD 1zc78OJYdsIDzbQvn8/aOSY+Hrzt9vcOq6iTVOxb5OQI2CfbbJ1y2RVcldWR17c6fGl8/BDZ F/P9C2OKTf2RDbM2qyp7LnyzYK99GfP9GuP+zPhgZl/EfOhMwpPL+RFuV/GR0uKehWiFTSf2 90cWug38kRn/0fSg3aP73I+qorr749rngxnvHJoYVVdt7Qvio9d4T/SBCvKWog+y/MOs+MHb J++zx4Q7yn9XT7cPKvf2IX9HX1XDAbDg9YguhGGG4XrYDrzY176YrV/sq/8X3t3sy1Lm/X2I 8GLKDjO8mMU7s+/oqD3I16LbNqfgRQA681Wl1/VU10cicu7X2vanWJHL/s4HgBcdSHXIsnJJ NgqqS5/NY4cXCXNWtiz2RcOLq6NPRj4kehvDi83g1/U6pl1wzT4cc7z/HxAIT4lAOWOWAAAA AElFTkSuQmCCUEsDBAoAAAAAAAAAIQABCUIPjhkDAI4ZAwAWAAAAcHB0L21lZGlhL2ltYWdl MTAudGlmZk1NACoAAxDo//////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////+f////v////8////+fv6//j4+P// /f////z////5///5////+/////z////////////7////8P///eT///vd//X////3////+f// //z////38///+O/////0////9/////n////09P/26dj/59m2/9fGmP/HtYP/vad4/7Wecv/A fk7/vntH/7l3O/+1ci7/r2we/6hmEP+kYgT/omAA/65gFf+xZRr/smwn/7d1OP+8f0j/wYla /8OQZf/FlGz/1a+k/968sv/u0Mb//OPc///x6///9vD//fbw//jz7//3//b/+P/4//n/+v/2 +/f/+/v9///+////+/////j///z2+v///P////v///r4/f/8+v///v3///z9///y8v////z/ ///9/////f////7///z9///5//v/9//4//T/9P////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////+/n8//j29//+/fn////4////9v/8+u7//Pru////9P//++z///nw//339//5+P//9/n/ //b+///1////9P/////4////+P////v2///86P//9M//6tWg/76nZP+chDz/pGYT/6ptEP+2 eAv/xIYL/9WVEf/koRz/76kn//WuLv/6yyf/+ssj//vLH//9zBj//c0R//7ODP/+zwf//84F ///LBv//yQf/+MYH//LCCP/qvQr/4bkK/9y2C//ZtAv/2KcE/8mWAP+xfwD/oG4A/5pqFf+l dDn/t4Zd/8STc//ewr///ePi///59v//+ff///b0///9+////vv////9//f/+//z/vj/8/76 //n////7//v/9vzw//v/7P/+/+r/9vXw//z59P////r////6////+//9/Pr//Pz+//7///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////v////8/////Pr/9/Tt//z88P////H//v/t //P44f///vv///7////9///++////vv///79/////v////7///jTtv/Zs47/r4hR/5JrHv+V bgn/sooQ/9ewJP/yyjT//8w7///NNP//zSv//80h///NG///yxr//8kb///IH//xwhz/8sMb //PFGv/0xRf/98YU//jHEv/6yA//+skN//zHBf/6yAX/+sgH//nICv/4yAz/+MgQ//bIEv/2 yBL//8YA///LAP//0wr//9UX///OHP/6vxn/6q4Q/9+kCv+5ghv/nGcJ/5FiEv+xi03/3sGZ //fjy//98Oj///f2/+33///1////+P/7//n/8//7/+3/+v/u//v/8v/8//L//v/6////+P/+ //L/9vfp//z47////P////r////3//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+/X3 //z3+////v////7///z////w9vT/9P72//j/+v/p9v//+P/////+/////fH//+nK/9u5i/+z hkv/lmcj/6l/Cf/GmSL/6bw////QTP//0UT//cs2//rFK//5xCj/4sst/+PLKf/jzCT/5c4g /+jOH//pzh//68wj/+zNJf/3zB3/9ssc//fKGf/2yRb/9scV//fGEv/2xRD/9sQP//PCA//0 wwT/9sUG//nHCP/7yQj//8oK///LC///zAz/9cgX//THEv/0xwr/88gA//TIAP/0yQD/9cwA //bMAP//yQD/+sAA//XAEP/puiL/v5Ya/5RuDf+UcyT/spRO/97OrP/25s////ny///6//// +v////z///7+///y9/3/6vD8//n////5//3/+//4//v+9f///f7///r////3//////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////+/////v////7////+/7///v+///7/v//+/////P4/v// /Pr/8uTX/8GqiP+cfEH/mnEZ/72JG//uszP//9JH//DJJv/xyif/9csp//jMLf/7zTH//cwx //vIL//4xSz/+9En//rQJP/6zyH/+c4f//fMHf/4yh3/98ke//bHH//wyQr/8cgK//HICv/z yAj/9McI//XICf/3yAj/98gI//zNDf/8zQv//MwI//vKBP/7xwH/+scA//nEAP/7wwD/7cgG /+/IB//wyQj/8skL//XKDP/3yg3/+soQ//rKEP/3wgD//8sD///MCP/9yAj//ccL//zIEP/v uwf/3qkA/7aEAP+lcwT/qnhD/9Klov/62PD///T////8//////H/+/3///P6///r9f7/9P// //f////7/////Pz+///9//////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////5/Ls//H69//5 /f///vv////8////+/j/9OTV/9TDr/+bYBr/r3Yl/82XN//pt0b/+stJ//vQQ//0yzX/7MUq //rSP//zyzb/7sYw/+/GLP/2yy7/+c8t//fMJ//zyCH/98Ik//jDJf/4wyX/+cQm//vHJv/8 xyn//Mcp//3IKv/zxyj/88cm//XIJ//1yCX/+Mkl//nIJf/6yST/+skk//C+Hf/wvxz/8r4c //K/GP/zvhb/9L4U//S+E//0vxH//8oA//7GAP/6wgD/+L0A//m9B//+vxD//8MZ///FHv/2 xwX/+MkH//XDAv/zvAD/+r8B///HC///xgv//70D///ACv//vA7/6a4M/8KRBv+jeg7/p4c+ /9O4jf//583///Py///8/f/+////+P////P+///4////+//6//n88f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////P/7///++f///fT///zo/+3RrP+wjFD/nnQi/7KGJ//+vT///8A9 ///GO//9yjn/+806//bOO//xzD//78s//+7DQP/yxkH/98xC//jOPv/4zzn/+s8z//zSMv/+ 1DD/9s9D//bPQ//1zkP/9M1B//POQf/yzT7/8c07//HNOf/4ziz/+c4q//jNKP/5zST/+Mwh //nLHf/6yxv/+ssb//zNG//8zRv/+8wa//nLFv/3yRP/9ckQ//TID//zxwz/+LoD//y+B/// xAr//8gL///LCP//yAT//sQA//vCAP/+0AD/9sgA//jHAP//zhD//80W//3BE//7vBX//8Ec //6+Fv//yAr//csA//HFAP/rwgD/4LQN/7yKGf+TXhD/vpZZ//DPov///OT///z6//j3/P/y 8/X/9/jw//n66v////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////6///58P/RvKf/jm1C /5psIf/qskX//9lK///LKf/sxzv/78k6//PLNv/4zDX/+s02//zJOv/8xj///cRB//zPQP/8 zT//+ss9//nKPv/5yj7/+8xC//7PRf//0Ej//c87//3PO//9zzz//NA8//zQO//60Tf/+tI0 //rSMv/4yzr/+Mw4//rMOP/6zTT//M4w//7OLP//0Cz//88q//nHGv/3yBr/98ga//bJGP/0 yRj/88oY//PKFv/zzBf/98oN//XIC//zxgn/8MUF/+3FA//txwL/7soC/+/LA//9wQn//8kQ ///JDP/ywAD/7b4A//DGAP/zywD/7skA//PNBv/uxgT/8MMG//fFDv/4wAv/9roE//29BP// yAz/258t/6VyGf+Zc0L/172w///6////+/////n2///87/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////u +O//+//4//z/9v/7/PT////7/////////f///v3////r////+///+f///+3/+f/y//v/+//9 ///2+v//8///3Jlk/7FyLf+xdhr/57I+///VUP/0xTf/6bwr//nMO//6y0H/+stB//nLQf/6 zEL/+M1C//fOQv/4z0P/+M9D//rPTf/6z03/+s9M//rQSv/60Er/+tBI//rQSP/60Eb/99JF //fSRf/30kX/99JD//bSQP/20kD/9tI+//XRPf/3zzr/9886//fOOP/2zTX/98ww//jML//3 yyz/98ss//nNLv/5zSz/+M0p//jMJf/5yyD/+csd//nKGP/5yhj/+MoV//rJFf/6yRT/+sgP //nIDP/5xgn/+ccI//rFBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//fFBP/3 xQT/9sQD//bEA//1wwL/9cMC//XDAv/1wwL//r4A///JD//urQn/s3kA/6BzFv/JrXv/9+7f //7////w////8P7///L1/v///f////z///76+//3+fb/+//7//z////7/P//+fn7//37/v// /f////7///z7///7+f////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////v////z7///++////vr//vnz//369f////v////9 ////8f/1+fj/8fT///z6////+/////Ld/9Cwdf+FXQj/2qA8/+21SP/4xEr/9MI7//LDNf/4 yz7/+81G//bHRf/7ykf/+stH//rLR//4zEf/+c1I//jOSP/3z0n/989J//nQUP/50U7/+dFO //nRTf/50Uv/+dFL//nSSf/50kn/+NJJ//fRSP/30Uj/99JG//bRRP/20UT/9tFC//bRQv/4 zz//+M8///jOPP/4zzn/+c02//nMM//4yzD/+Mwv//nNMP/4zC3/+Mwr//jLJ//5yiL/+Mod //nKHP/5yhr/+MoV//rJFf/5yBP/+sgP//nIDP/5xgn/+MYH//rFBf/4xgX/+MYF//jGBf/4 xgX/+MYF//jGBf/4xgX/+MYF//fFBP/3xQT/9sQD//bEA//2xAP/9cMC//XDAv/1wwL//9AL /+20AP/0twT//84w//W5Nf+3gx3/pHss/7+dXv/03uD///Lv////9v/7//b/+f/4//v/+/// //////r+//n////7//3//P/7////+/////v////7/////f////3///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////56fP///f/ ///7////+v3///77////+P////b/8vLm//L/7v/v9u7///v////2+//Poo//mWQg/8CIEf// yTH/6rsn//jJMf//1Dn//tE4//jMOP/4zEX/+sxS//nKVv/7y0//+cxP//nMT//5zVD/+c1Q //jPUf/30FH/99BR//rRU//60VP/+tFR//rRUf/60k//+tJO//rSTv/60k7/+NFO//jRTv/4 0k3/99FM//fRSv/20Ef/9tBH//bQR//60UX/+tFF//rPQv/60ED/+887//vNOf/6zTb/+s02 //jLMv/4yzD/98su//jLKv/5yib/+Mkh//nJH//4yBz/+MoV//rJFf/5yBP/+ccO//jHC//5 xgn/+MYH//rFBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//fFBP/3xQT/98UE //bEA//2xAP/9sQD//XDAv/1wwL/7MQC//jIBv//xAT//bkA//mvAP/1rAf/6qMJ/96aB/+o Zin/3a56///uzf/7/u3/9P/8//j///////v///v2//f/+f/5//r/+f/6//v/+P/8//b//f/0 ////8/////T///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////+/3///f9//v0/P///f///v7///f4/P/x8e/////7//v5+v// /e3/0bKG/41dEf/KkCX//8pM///COP/7uiz/+Mwv/+u/Iv/swSX//tI7///ZSf/4zUr/9MdQ //rPXv/6zVb/+s1W//rNVv/5z1f/+NBX//jQV//40Vj/+NFY//nRV//50Vf/+dFV//nRVf/5 0lP/+dJR//nSUf/50k//+NBU//jQVP/40VL/+NFQ//fQT//30E3/9s9M//bQS//80kr/+9FJ //zRR//70EX//M9A//3PPv/8zjv//M46//jLNP/4yzT/98ov//fJK//4yCb/+Mkj//jIIP/4 yB7/98kU//nIFP/5yBP/+ccO//jHC//4xQj/+MYH//nEBP/4xgX/+MYF//jGBf/4xgX/+MYF //jGBf/4xgX/+MYF//jGBf/4xgX/98UE//fFBP/2xAP/9sQD//bEA//2xAP/6r4D//LBA//1 uwD/9LIA//uzAP//vQD//78A//+6AP/1qwz/sXEA/59vJf/dv6f///r9///8///x8ur//P/q //j/+P/5//v/+f/9//n////6//z//v/7////+P////b///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////4+u3//v/7//v////s 8v7/+fz///7+////+/////z6//HLuP+Wajn/sn0d///NQ///wiX/5aoQ//W/Of/+y1X/9MVD //rOSf/+0k3/+9FL//XNSv/2zU//9s5U//fOWP/6z17/+s9e//nQXv/60V//+dFf//fSX//4 02D/+NNg//rRW//60Vv/+tJZ//rSWf/60lj/+tJW//rSVv/60lb/+dFX//nRV//40FT/+NBU //jRUv/30E//99BP//fQT//80kz/+9FL//zQSf/70EX//M9C//3OQP/8zj3//M47//fKM//3 yjP/98ov//fJK//4yCb/98gi//jIIP/3xx3/98kU//nIFP/4xxL/+MYN//fGCv/4xQj/98UG //nEBP/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//fFBP/3 xQT/98UE//bEA//2xAP/9r8K//O7BP/4vAL//8IH//y/Av/ytwD/7bYA//K8AP/wswD//8oY /+ymIP+mZA3/rHhI//jYwf///vP/8fbv///8+f////3/+v7///P4/v/0+P///v7////+//// /P7///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////4//L/5vLo//j////5////7u7w///88///79f/rpBu/5dcAv/mqEH//8pP //e4Lf/1uSf//Mk6//bMRv/wyk3/8sRV//zOX///02P/+c5b//PKVP/1zVT/+NFY//jSV//6 0GD/+9Fh//rSYf/402H/+dRi//jUYv/41GL/99Zj//rSYP/60mD/+tNe//rTXv/601z/+tNa //rTWv/61Fn/+dFX//nRV//50VX/+dFV//jRUv/40VD/99BP//fQT//60Ej/+tBI//rPRf/6 z0T/+84///vNPP/6zDn/+sw4//fKMf/3yi//9sot//bJKP/4ySX/98gg//fHHf/3xxv/98kU //jHE//4xxL/+MYN//fGCv/3xAf/98UG//jDA//4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4 xgX/+MYF//nHBv/4xgX/+MYF//jGBf/3xQT/98UE//fFBP/3xQT/97kE///GE///xRH/7LUC /+azAP/yxRL/+c4d//TLG//9xQ7/6qsA//2yAP//xRb/4JkN/5ZgBv+wkGn///fx///36/// /Pb///3///n5///y9v//+fv////9////+f////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////7//v/+//9//D08//7+PH///3j /9Kxe/+TYA3/z5Qw///IOv//wTj/8bcy//O8O//9ykv/9MRE/+vAPv/3z0z/+M5Y//DFUv/w xVT/+dBe//vTYv/3z13/9tFe//3YY//702L/+9Ni//nUYv/51WP/+dVj//fWY//412T/99hk //vTYv/702L/+9Ni//vTYf/71F//+9Rf//vUXf/71F3/+tJW//rSVv/50lP/+dJT//jRUP/4 0VD/+NFO//jRTv/4zkT/+M9D//jNQP/4zj7/+cw7//nLOP/4yjb/+Ms0//fLLv/2yiv/9sop //bJJf/3yCD/9sgb//fIGv/3yBj/9sgT//jHE//3xhH/+MYN//fGCv/3xAf/9sQF//jDA//4 xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//nHBv/5xwb/+MYF//jGBf/4xgX/98UE //fFBP/3xQT/+r4E//S6Af/2vgf/+8cR//fFEP/quQT/6roC//XFDf/ytAv//8MM//+9AP/z rAD/9rAA//m3Iv/PkST/kFYE/+XEpf/+5M3///zv////+//8/////P///////////v3///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////49/3/+Pf9///9/f/05NT/qYlY/6h1Gf/tqST//8Uo//W7Kf/4wTD//M0///XKQP/p vjv/88ZH///NVP/4xE7/989J//zUUf/91Vn/+tNc//nRYP/502T//ddq///bbf/61WP/+tVj //rVY//51WP/+Ndk//jXZP/32GT/+Nll//nTZP/502T/+dRi//nUYv/51GH/+dRf//nUX//5 1F//+tNU//rTVP/50lP/+dJR//nST//40U7/+NJN//jSTf/3zkL/985A//fNPf/2zDr/98s3 //jLNP/3yjH/98ox//bKK//2yin/9ssn//bKI//3yR7/9sga//fIFv/2xxX/9sgT//jHE//3 xhH/98UM//bFCf/3xAf/9sQF//jDA//4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF //nHBv/5xwb/+ccG//jGBf/4xgX/+MYF//fFBP/3xQT/9cAC//nEBv/7xQn/+sUH//nCA//6 wAD/+bsA//a3AP//ugT/+LYA/++yAP/wtQP/87UC//avAP/3pgD/+qEA/5NpOf/Do3r/8eDE //366f/7/vf//P/7////+v////b///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////8v// //L////0/PH////9///6////+v///Pj3////7P//+P////nx/9i0gP+odxj/0ZUZ//q6Nv/5 uDb/+bk9//bHPf/2xj7/9sdD//jISv/4ylD/+MtW//nMWf/6zFz/99Zl//fWZf/31mX/99Zl //fWZf/31mX/99Zl//fWZf/42mr/99lp//jYZ//42Gf/+Ndk//rXY//612P/+9Zj//fVZ//3 1mX/+dVj//jVYf/41Fz/+dJZ//nTWP/50Vf/+9BO//rPTf/6z0z/+c5L//jOSP/4zkj/981F //fNRf/4yzz/+Ms6//jKN//3yjP/+Mov//nJK//4yCj/+ccm//fIIv/2xyH/9scf//fHHf/4 xhn/+MYX//nGFf/4xRT/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQT/98UE //fFBP/3xQT/98UE//fFBP/3xQT/98UE//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4 xgX/9sQD//XDAv/1wwL/9cMC//TCAf/0wgH/9MIB//PBAP/3vQH/9rwA//a8Af/1uQD/9bcA //S2AP/1tAD/9bQA//+wA//aigD/jFwI/9/Mq//19fP/9f3///z/+P///+3///35///8//// +////v////L25//8//H//v////v4//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////2///+/////f//+Pf9//X36v////P////////6//// 59D/sZFi/550Iv/Woiz/+b4y//q9Lv/6vzX//cM+//bGPv/2yEH/98hG//fKS//4ylL/+cxX //jNXP/5zl7/99Vn//fVZ//31Wf/99Vn//fVZ//31Wf/99Vn//fVZ//32Wv/+Nhr//jYaf/4 1mj/+Ndm//rWZP/61WP/+tVj//nVZf/41GL/+NVh//jTXv/50lv/+NJX//nRVf/50VX/+s9P //rPTf/5zkv/+M5I//jORv/3zUP/9s1B//bNQf/4yzz/+Mo5//jKNv/4yTH/98kt//jIKP/5 xyb/+Mck//bHIf/2xx//98cd//bGGv/4xhn/+MUU//jFEv/4xRL/98UG//fFBv/3xQb/98UG //fFBv/3xQb/98UG//fFBv/3xQT/98UE//fFBP/3xQT/98UE//fFBP/3xQT/98UE//jGBf/4 xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/9sQD//bEA//1wwL/9cMC//XDAv/0wgH/9MIB //TCAf/1vgH/970B//a8Af/2ugD/9rgB//S2AP/2tQH/9bQA//u0Av/sqAn/5agr/5FfCv+/ m2n///fh///++v/8//////3////////09/D/+v/4//z//f/3+/z//////////f////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////jr///7///0 8P7//P///+715f/5/Of///36/93M3v+Xahn/yZg5//W+R//+xDX/97wi/+20HP/vuCj/+sY+ //fIRv/1yEf/98pL//fLUP/5zFX/+M1a//jOXv/5z1//99Vq//fVav/31Wr/99Vq//fVav/3 1Wr/99Vq//fVav/412z/99Zr//jWav/41mr/+dVn//rUZf/61GX/+dRi//jTYP/402D/99Jd //nSW//50Vf/+NBU//jPUf/4z0//+s1O//nMS//5zUr/+MxF//fMQf/2zDz/9sw6//bMOP/4 yjn/98k2//jJM//3yDD/+Mgq//jGJ//4xyT/98Yh//XGHv/2xhz/9sYa//fFGP/3xRb/98QT //jDEf/4xBD/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQT/98UE//fFBP/3 xQT/98UE//fFBP/3xQT/98UE//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/9sQD //bEA//2xAP/9cMC//XDAv/0wgH/9MIB//TCAf/2vwL/9r8C//e9Av/1uwD/9bkB//W3AP/0 tgH/9LYB/+u9CP/0uQX/9qwA//2pE//bjx//lWIh//zjz////f//9vL///3//P/7/+3/8/7u /+Xs9P/8+//////7////5f////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////v/////+v/1++//8PTz///8///w3Nv/6smm/4hjH//foiX/9bcy //W0JP/ysxr//8Yt///KN//vvjP/7b46//XJTP/2yk//98tS//fNVf/3zlr/+dBe//nRYP/6 0mP/99Rs//fUbP/31Gz/99Rs//fUbP/31Gz/99Rs//fUbP/31mv/99Vq//fVaf/51Gn/+dNm //nTZP/702T/+9Ni//nSW//40Vr/+dFY//jQVv/4z1H/+c5O//nOTP/4zUv/+MtK//jMSf/3 y0b/9stA//XLO//1yzf/9Msz//TLMf/2yDT/98g0//bHL//4xyz/+MYn//fGI//4xCD/+MUe //XFG//0xBj/9sQX//bEFf/2wxD/98MP//fDDf/3ww3/98UG//fFBv/3xQb/98UG//fFBv/3 xQb/98UG//fFBv/3xQT/98UE//fFBP/3xQT/98UE//fFBP/3xQT/98UE//jGBf/4xgX/+MYF //jGBf/4xgX/+MYF//jGBf/4xgX/98UE//bEA//2xAP/9sQD//XDAv/1wwL/9cMC//TCAf/2 wQP/9r8C//a/A//2vAH/9bsC//W5Af/1twL/9bcC/+/BDP/fpAD//70A//+nAP/4oAD/35gm /5ZjIf/ZtZH///z///369f/+//j/+P7+//X4///+/f///Pj3////7f////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////9/////L99//7////+vX8 ///r7//itZb/k1gA/+SjE///xTX/9a4e//+9LP//yTv/8LUr//G7N///0lb/+s5V//XLU//2 zFb/9s1X//jPW//40F//+NJj//nTZP/61Gf/99Rs//fUbP/31Gz/99Rs//fUbP/31Gz/99Rs //fUbP/31Wn/99Vn//jUZv/41GT/+NNh//rSYf/60mD/+9Jg//jQVv/3z1X/+M9T//nNUP/4 zUv/+MxJ//jMR//5ykb/+MpD//jKQf/3yT//9sk6//XJNf/1yTT/9Mkv//TJLf/2xzH/9cYu //fGLP/2xij/9sQj//fDH//3xBv/+MMb//XDFv/1wxb/9cMU//XCEf/2wg7/9sIM//fBCf/3 wQf/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQT/98UE//fFBP/3xQT/98UE //fFBP/3xQT/98UE//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/98UE//fFBP/3 xQT/9sQD//bEA//1wwL/9cMC//XDAv/3wgT/9sED//W/A//1vgL/9rwD//W7Av/1uQP/9bkD //26C//2sQD/8qkA//+0AP/nmgD//7gf/+CXFv+lXQD/vaJ3///66P/97fj///v///7+///0 9Pb///3////7//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////8f/v//b////58v////f2/62CTf+qcAT//8Qx///DI//ysBv/+7gp//y8NP/2 ujj/+cFG///TXf//0Fz/6bxH//bNW//3zV3/989e//fRYv/40mP/+dVn//rWaP/512v/99Vq //fVav/31Wr/99Vq//fVav/31Wr/99Vq//fVav/41GL/+NRi//fUYP/402D/+tNe//nSW//6 0Vv/+tJZ//fOUv/5zVD/+M1N//jLSv/5ykb/+ctE//nJQf/5yUH/98k4//fJOP/2yDX/9sg1 //XHM//0xzD/88Yv//PGL//2xC3/9sUr//XFJ//2xCX/98Mf//bDHP/3wxj/9sIW//TCE//0 wxH/9MEO//XBDf/1wQv/9sAI//bABv/3wAT/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG //fFBv/3xQT/98UE//fFBP/3xQT/98UE//fFBP/3xQT/98UE//jGBf/4xgX/+MYF//jGBf/4 xgX/+MYF//jGBf/4xgX/98UE//fFBP/3xQT/98UE//bEA//2xAP/9sQD//XDAv/2xAX/9cME //bABP/1vwP/9b0E//a8A//1ugT/9roE//quAP//uwv/87IC//G0A///wBH/9qsA/+yXAP/+ owD/sXsX/6d2Pv//9e3/+OTw///6/P/7+vX///7////2//////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////+f/7///++v//9+T/iVsd/9CZJP/7 viX/9bUV//CtFP/1vSj//8s7/+q1Mf/lsTn//85Y//HASv/ktjz//99i//fOYv/3zmL/9tBj //fTZf/51Gn/+NZq//nXa//52Wz/99Vn//fVZ//31Wf/99Vn//fVZ//31Wf/99Vn//fVZ//3 1Fz/99Rc//jUWv/50ln/+dNY//nRVf/50VX/+tFV//fMTP/4y0z/+MtK//nKRv/5yUP/+MhA //nIP//4xzz/9sot//bJLv/1yC3/9Mcu//PGL//zxTH/8sQx//LEMf/1xCr/9cQp//XDJv/3 wyL/9sIe//bBGf/2whb/9sET//TBEP/0wRD/88AN//TACv/2wAj/9b8F//a/A//2vwL/98UG //fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQT/98UE//fFBP/3xQT/98UE//fFBP/3 xQT/98UE//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF//jGBf/3xQT/98UE //fFBP/2xAP/9sQD//bEA//2xAX/9sQF//XCBf/2wAT/9r4F//W9BP/2uwX/9boE//m7Bv/i pQD/9LYJ/+2vBP/0sAf//LEI//+yCP/6pAD/854N/9CJF/+RXBr///nf//7x6////v////// //v6+P////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////X//+7Xx/+OaRH/1Z8Z//+/Kv/ztSL/77kj//PHKv/yxSz/9sk6//XJRv/0yE//9slU //fJUf/4yEj/+MpB//XPZP/20GX/99Fm//jTaP/31Wn/+ddr//nZbP/62W7/99Zl//fWZf/3 1mX/99Zl//fWZf/31mX/99Zl//fWZf/31Vn/+NRZ//fUVv/501b/+dJT//nSU//60VH/+tFR //jLSv/3ykn/+cpI//jJRf/4yED/+Mc+//jHPP/4xzr/9com//XJKP/0yCn/88Yr//PGL//y xDH/8cMy//HCNP/1xCn/9cMm//XDJP/2wiD/9sEb//bCF//2wBX/9sET//PADf/zwA3/9MAM //O/Cf/1vwX/9r8D//W+Af/1vgH/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3 xQT/98UE//fFBP/3xQT/98UE//fFBP/3xQT/98UE//jGBf/4xgX/+MYF//jGBf/4xgX/+MYF //jGBf/4xgX/+MYF//jGBf/4xgX/98UE//fFBP/2xAP/9sQD//bEA//2xQb/9sQF//XCBf/2 wAT/9b8F//W9BP/2uwX/9rsF/+i/Bf/7yRL/6KsA//iwBP//sAv/9acF//+zF//xqA7//54A //+xFP/Pkxn/i2go//vq4v///P//5ujj//7/5v////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////0//// /v//6Pv5//f//////f////H2//7////t//v/7M7E/41bBv/rnhL//8Ez/++tG//3yyT/570d //O9Qf/8vmf//8ha//O8Pf//zlL/9L9V//vJZv/0ylT//9pO//nUbP/51Gz/+dRq//nUav/5 1Gn/+dVn//nVZ//51WX/99Vp//fVaf/51Wf/+NRk//jTYP/50l3/+dJb//nRWP/40Ff/989V //fOUv/2zU//98xM//fLSP/2ykX/9clE//bIP//2yD7/9cg7//XGOP/1xTP/9cYy//bEL//2 xC///70i//+/JP/8yDb/68hK/6+aP/9OQRX/DAID/wQAF/8IABD/FQUI/2RYHv/BtSv/6dIg /+rAFP/ztg3//8AJ//XEBv/4wyn/7Lcb//nMAf/wwwD/77sD//W7D//6wQL/+cIF//nCBf/5 wgX/+cIF//nCBf/5wgX/+cIF//nCBf/2xAX/9sQF//bEBf/3xQb/98UG//fFBv/4xgf/+MYH //fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3 xwX/98cF//fHBf/1wwT/9cME//fCBP/2wQP/9r8C//W+Af/3vQH/9rwA//a4A//1twL/9rUB //azAv/1sgP/9rAC//WvAv/1rQH/+agR//akAP/9qQD/5JQA/6VkAP/71K3///z6/+n2/v/x //D/+f/7//z+/f//+/j////2////9v/x7/D///7///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+///9//T//P/u/+3v7P/6+/////z////8+P/h0LL/kmoA /+23D//7sgD/7aMQ///MTv/xz0r/yqcv/8OWO/+khhj/rY0c//3aZP/uy0v/+NNO//POTP// 12X/8shi//nUav/51Gr/+dRp//nUaf/51Wf/+dVl//nVZf/51WX/+dVn//jUZv/41GT/+NNh //nSXf/40Vr/+dFY//nRV//3z1X/+M9T//fOUP/3zEz/9stJ//bKRf/3yUL/98lC//XHPf/1 yDv/9cY4//XHNv/1xTP/9sQv//XDLP/2wyz/6L8L///gTP/dwV7/algq/wwDAP8AAAv/AAEO /wIPGP8ABQD/CAkD/wwAJP8LABL/dl8T//PXFP/4xgD/9q0Q///NCP/8wx7/8rsY//jHAf/0 xAD/+MEO//m/E//2wAD/+cIF//nCBf/5wgX/+cIF//nCBf/5wgX/+cIF//nCBf/2xAX/9sQF //bEBf/3xQb/98UG//fFBv/4xgf/+MYH//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3 xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/2xAX/9cME//fCBP/2wQP/9r8C //W+Af/3vQH/970B//a4Af/1twL/97YC//W0Av/1sgP/9rAC//WvAv/1rwL/76QA//moAf// rAn/5ZEA//CqLv+DVAL/7tiz///8+v/x+/r/8ffz//z/+/////v///7///Ty9f//////8fLt //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////L////3+un///7o ///9/f/2+/////3//9/Ao/+ZXxX/8aU1//SqE///xBv/9cIx/7ufNP9iUQz/FgAA/xkAE/8I AAf/DgAM/w8AAP+Ndkr/9+F+//jcXv/00V3//dJz//nTaP/502b/+dNm//nTZP/502T/+dRi //nUYf/51GH/+NNh//jTYf/30l//+dJd//nRWP/40Fb/+M9T//jPUf/3zlD/+M1N//fMSv/3 y0j/9spF//fJQP/3yD7/9sc9//XGOP/1xjj/9cU1//TEMv/1wy7/9sMs//XCKf/3wij/7NAX /9G3JP99ZQ//HAcA/woAAP8GAAf/CAcD/wADAP8GBBz/Cg4Z/wADAv8AAQb/CAAE/0onCf/o uz7/9cMA///IAP/2uwn//sIW//vBBf/4wQT/+8MW//jAEf/zwQD/+MEE//jBBP/4wQT/+MEE //jBBP/4wQT/+MEE//jBBP/2xAX/9sQF//bEBf/3xQb/98UG//fFBv/4xgf/+MYH//fHBf/3 xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF //fHBf/2xAX/9sQF//fCBP/2wQP/98AD//a/Av/3vQH/970B//a6Av/2uAH/9bcC//a1Af/2 swL/9bID//awAv/1rwH/7KoA//+4Ff/3oQ7/+aQN/+SZAP/orCf/fU4A//fQqf/8/v3//v// //7////1+fz//P////7////t7+r//v/0//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////X////8//3///79//jy9v///Pv/996//5llEv/kmiH//8Ew//atLP/o s1X/h2g8/xMJAP8AAAL/AAAE/wcEDf8EExD/AQoR/xUWG/8KBQD/h3tB//Tcgv/tzGP//NNq //jSY//40mP/+NNh//jTYP/402D/+NNe//jTXv/41Fz/+dJd//jRWv/50Vj/+NBW//jPU//5 zk7/+c5M//jNS//4zEn/98tI//bKRf/3yUL/98g+//bHO//2xTj/9sY2//TEMv/2wzL/9cMw //XBLf/1win/9sEn//a/JP/2vyT/9b0g/+iyHP/Pnxf/wZgi/8KcOf+wijn/j2ch/3lQEP8P AAD/DgUA/wADAP8ABQD/AAAJ/woADv9VOg//48hD//m+AP/wtAD//8IL//y+Cf/8vhH/+L4V //C7Cf/0xAD/+MEE//jBBP/4wQT/+MEE//jBBP/4wQT/+MEE//jBBP/2xAX/9sQF//bEBf/3 xQb/98UG//fFBv/4xgf/+MYH//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF //fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/2xAX/9sQF//jDBf/3wgT/98AD//a/Av/4 vgL/970B//e7Af/2ugL/9rgB//W3Av/2tQH/9rMC//WyA//0sQL/9bYJ//qyDv/snAD//acE //+vB//hlgD/76kt/5hXAP/b0a7/+vDn///7///5+v//6vPw//n/9P/8//b//v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////j2+f/5////8/v////9+/// 3Kr/lVwA/+2rIf//vib/4aQA//vLRf92XR3/CwcA/wABDv8AAw7/BxkJ/wANAP8ABAX/FCAg /xofI/8RDhX/CwAA/76ie///5YT/9dFF//rSYP/6017/+tNe//rTXP/601z/+tNa//rUWf/6 1Fn/+NBW//fPVf/4z1P/+c5O//jNS//4zEn/+MxH//nLRP/4ykP/98lA//jJP//2xzv/9sY2 //fEM//2xDH/9sQx//XBLf/1wS3/9MEq//W/J//2vyT/9b8h//W9Hv/1vR7/97Ak///AJ/// xxj/88AD/+++Av/xvRH/9r0o///DPv/3z0v/y60x/2pXEv8IAAD/BgQR/wULAP8ECQD/aGNQ //S9Gv/1vQj/+L0A//i6B//+vRn/+r0U/+25Af/zxAL/98AD//fAA//3wAP/98AD//fAA//3 wAP/98AD//fAA//2xAX/9sQF//bEBf/3xQb/98UG//fFBv/4xgf/+MYH//fHBf/3xwX/98cF //fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3 xQb/98UG//jDBf/3wgT/98AD//fAA//4vgL/+L4C//a8Af/2vAH/9roA//a4Af/1twL/9rUB //W0Av/1sgH/8rAU/+6qAP/8sgD/758A//qkAf/9qBH/6JQA/+GTAP+DYgX//+DB///n//// +v//+P/w//H/2f/7//T//vz///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////8///j5Pb//P7////oyP+WXQD/9KcN/++nA//rsxj/+dBC/31jDv8IBQD/AAQA /wACAv8AAAv/AQED/wAFAP8OAQv/FgwN/wcAAP8KAAX/GgMN/yoLAP/72XX/9NQ0//rRW//6 0Vv/+tJZ//rSWP/60lj/+tJW//rSVv/601T/985Q//nOTv/4zUv/+MxJ//nLRP/5y0L/+cpA //nKQP/3yDz/98g8//fGOf/4xTT/9sQx//bCLv/1wiv/98Ep//W/Kf/1vyf/9b4l//W+I//1 vR7/9rwc//W7Gf/1uxn/5q0V/+y2Fv/ruxH/8MMO//rPEf/3ygv/8cAB//G+Af/sqRz//80i //POHv/FrSn/alsY/wwGAP8AAgD/AwwH/9ilL//7yyP/7bkA//W5A//9vBj//8QU/++8AP/y wgb/98AD//fAA//3wAP/98AD//fAA//3wAP/98AD//fAA//2xAX/9sQF//bEBf/3xQb/98UG //fFBv/4xgf/+MYH//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3 xwX/98cF//fHBf/3xwX/98cF//fHBf/3xQb/98UG//jDBf/4wwX/+MEE//fAA//5vwP/+L4C //e9Af/3vQH/9rwB//a6AP/2uAH/9LYB//a1Af/1tAL//rke/+ajAP/1swD/+7EA/+6eAP/2 oA3//6kG//+sAP/RlAX/iVEE///q4v//8vr////v//T/3f/8//j/+fX///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////j//v///vj/9dq8/4lZBf/goRb//8Ab //u5HP//wTj/qpI8/w0AAP8AABn/CAMX/w8AAP9WMSn/l3hM/7WmS//PsjD/8Nhc//TidP/r 23z/0Lxm/8ClTP/hvlb//9ll//nRV//50Vf/+dFX//nRVf/50lP/+dJT//nSUf/50lH/98xK //jMSf/4zEf/+ctE//nKQP/4yT3/+cg7//jHOv/3xzf/9sY2//fEM//3wy//9sMs//fBKf/2 wSf/98Al//W+Jf/1viX/9b0i//S8Hf/1uxv/9rsZ//W6Fv/1uhT/+L8W/++6FP/rtxX/7r4c //HAG//mtAf/6LQA//vFCf/9vxb/7aoV//m5D//ywQD//dsY/7uiPv8kFAD/BAAA/4FVDP/w yDX/678A//vDCv/4ug///8YN//O+AP/1xQ3/98AD//fAA//3wAP/98AD//fAA//3wAP/98AD //fAA//2xAX/9sQF//bEBf/3xQb/98UG//fFBv/4xgf/+MYH//fHBf/3xwX/98cF//fHBf/3 xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/4xgf/98UG //nEBv/4wwX/+MEE//fAA//5vwP/+b8D//a/Av/2vwL/970B//a8Af/1uQH/9bcA//S2Af/2 tQH/9K8A///HEf/inwD/7KgA//y0EP/+sg//8qEA//WjAP//owD/8KMj/5RgFP//8dL/+fTu //z////29/v///7///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /+f/+///9dX/rHcr/9aQFv/9viX/6LEW/+yuJf/0qTL/EwAD/w4AJv8EAxP/VFAT/9K2SP/+ ylz/9MNM//TSPf//0VD/+MZT//LMYf/y2F//38w///HaTP/41WH/98lx//nRV//50VX/+dFV //nSU//50lH/+dJR//nST//50k//+MxJ//fLRv/5y0T/+MpB//jJPf/4xzr/+Mg4//jIOP/4 xTT/+MU0//fFMv/3xC3/98Ep//bBJ//2vyT/9sAi//S9Iv/1vSL/9Lwf//a8Hf/2uxn/9boW //a5E//2uRH//rQF//++EP//vhH//LwS//+/Gf//vBn//rQV//+yFv/tuAb/+78J//2yB/// txT/8rAC//bMIv/Rt0j/LxwA/yYAAP/cujT/78kE///SE//ytQX/+cAB//O/AP/7yRT/9r8C //a/Av/2vwL/9r8C//a/Av/2vwL/9r8C//a/Av/2xAX/9sQF//bEBf/3xQb/98UG//fFBv/4 xgf/+MYH//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF//fHBf/3xwX/98cF //fHBf/3xwX/98cF//fHBf/4xgf/+MYH//nEBv/4wwX/+MEE//jBBP/5vwP/+b8D//a/AP/2 vwL/970B//a8Af/2ugD/9rgB//W3Av/0tgH/+rgA/+qlAP/6tRr/760R/+WmAP/sqgD/+7AH //SiDv//nQD/954A/9CXEv+afj3//fD6///4///18//////q//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////O//+f/v //L////39f////b////03P/8/ub/7v/////1//+bcy3/0pAG//+yE//5pgD/8LcS/+TIWv9R Qx7/HAAA/3ZQI//WqFP//clP///JOf/8yDb/+MhA/+/ERP/1yUT/9spH//fLSP/5zE3/+s1Q //zOVP/9z1f//tBY//fQTf/3z0v/989L//jOSP/3zUf/98tE//nLQv/4ykH/+Ms8//fKO//4 yTv/9sg3//bGNP/3xDP/9sQx//fDMf/3wCj/98An//a/Jv/2viP/97wi//e8IP/3ux3/97sd //a7Gf/2uxn/9rsX//a7F//1uhT/9boU//S6Ef/0uhH/978U//a+E//2vhP/9r4T//W9Ev/1 vRL/9b0S//S8Ef/1vA3/9bwN//W7D//1uxH/9rsV//a7F//2uxn/97wa/yAIAP++ozz/58ce /+y9AP/4vQf/+7sT/++0Av/5wwH/978I//e/CP/3vwb/+MAH//jBBf/4wQX/+cIF//nCBf/1 wwT/9cME//XDBP/2xAX/9sQF//bEBf/3xQb/98UG//jGB//4xgf/+MYH//jGB//4xgf/+MYH //jGB//4xgf/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//bEBf/2 xAX/9sQF//XDBP/1wwT/9cME//XAAv/1wAL/9b4C//W+Av/2vAP/9roC//W5A//1uQP/9bQC //azAv/1sgH/9a8B//SsAP/zqwD/9KkA//OoAP/hrgD/6ZkA//+eBf/XeA7/vYVU///98f/3 ////4/Tu//v7/f/6//z/+f/9///+///+8P////j///n4/v/3//j///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////+/3/+//8//T+///2+v///vr7///+7//68+n///7//7iOZP+7 iiP/9bIb//+zF//unwT/+8Ir/72YMP8XAAD/u5lP/963XP/6y1n//8tE//3GNv/9yj3/98hG /+u/RP/2ykX/9spH//fLSP/5zEv/+s1O//vOUf/8zlT//c9X//fPS//3z0v/9s5I//fNR//4 zEX/98xC//jKQf/4ykH/+Ms8//jJO//3yTj/98c3//bGNP/3xTL/98Mx//bCLv/3wCf/9r8m //a/Jv/2viP/97wg//a7H//3ux3/97sd//a7Gf/2uxn/9rsX//a7F//1uhT/9boU//S6Ef/0 uhH/9b0S//W9Ev/0vBH/9LwR//O7EP/zuxD/87sQ//O7EP/0uwr/9LsK//W8Df/1uw//9bsR //a8E//2uxX/9rsV/5d3Lv+sjBP/6MAT//7MDf/1uAX/9rgP//7DEf/wvAD/9r4H//e/CP/3 vwb/978G//jBBf/4wQX/+MEE//nCBf/1wwT/9cME//XDBP/1wwT/9sQF//bEBf/3xQb/98UG //jGB//4xgf/+MYH//jGB//4xgf/+MYH//jGB//4xgf/98UG//fFBv/3xQb/98UG//fFBv/3 xQb/98UG//fFBv/3xQb/98UG//bEBf/2xAX/9sQF//XDBP/1wwT/9cME//XAAv/1wAL/9b4C //W+Av/2vAP/9roC//W5A//1uQP/9rUD//W0Av/1sgH/9a8B//SuAf/zqwD/8qoA//OoAP/m pAf/+qsI//eZAP/ymxD/u3wd/76eb////vT/+Pz////////5//3/5fLo//f8+P///P////X9 //f39f/4//b///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////+/v//9/X///3//v/5 //P/9//2//b3+f//+fj/0ayZ/6ZoAP//yzz/7KYG/+yhCv//zj7/5qwk/5NkAP/Xr2r/99FI //jNQv/0wzb/9L0v//vDOP//zUn/+s1M/+7FSf/3y0j/98tI//jMSf/5zEv/+s1O//vOT//7 zlH//M9S//bOSP/2zkj/+M5G//fNRf/3zEL/+MpA//jKQP/4yT//+Mo5//fJOP/4yDb/9sY0 //fFMv/3wy//9sIu//bDLP/2vyb/9r8m//W+I//2viP/97wg//a8Hf/3ux3/9rob//a7Gf/2 uxn/9rsX//a7F//1uhT/9boU//S6Ef/0uhH/9bsR//S6EP/0uhD/9LoQ//O5D//zuQ//87kP //O5D//zugj/9LsJ//S7Cv/0uwr/9bwN//W7D//1uw//9rwS//PLUv+5jQD/7r0I///KDv/4 uQz/97gR///HEP/tvAD/9r4H//a+B//3vwb/978G//fABP/4wQX/+MEE//jBBP/0wgP/9MID //XDBP/1wwT/9sQF//bEBf/2xAX/9sQF//jGB//4xgf/+MYH//jGB//4xgf/+MYH//jGB//4 xgf/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//bEBf/2xAX/9sQF //XDBP/1wwT/9cME//XAAv/1wAL/9b4C//W+Av/2vAP/9roC//W5A//1uQP/9rUD//W0Av/0 swH/9LEC//SuAf/yrAD/8qoA//KqAP/ynxP/+qoT/+yfAP/sngD/+68b/55fAP/duZn///n/ //n2/f/7////8f/3//T/9P////b///z0////+P/7//j///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////7//v//Pb////8///4//L/8P/9//v////31MH/o2EV//6tFf/3qQv/9awR ///GNf/rqyP/9r43//bAQv/3xFH/+Msq//jHLf/6wzX//sQ////ISf/9ykr/9stI//HLRP/5 zUr/+c1K//nNSv/5zEv/+s1M//rNTP/6zUz/+s1M//jORv/3zUX/981D//fMQv/4ykD/98o9 //jJPf/3yDr/98k2//fINP/3yDT/98Uw//fDL//2wyz/98Ep//fBKf/2vyT/9r8k//W+I//1 vSD/9rwd//a8Hf/2uhv/9rob//a7Gf/2uxn/9rsX//a7F//1uhT/9boU//S6Ef/0uhH/9rwT //a8E//1uxL/9bsS//W7Ev/0uhH/9LoR//S6Ef/zugj/87oI//O6CP/zugj/9LsK//S7Cv/0 uwr/9bwL//jEIP/lsAD/87wA//W3AP//wBb//b8W//S8A//ywQD/9r4H//a+B//2vgX/978G //fABP/3wAT/+MEE//jBBP/0wgP/9MID//TCA//1wwT/9cME//XDBP/2xAX/9sQF//fFBv/3 xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG //fFBv/3xQb/98UG//bEBf/2xAX/9sQF//XDBP/1wwT/9cME//XAAv/1wAL/9b4C//W+Av/2 vAP/9roC//W5A//1uQP/9LYD//S2A//0swH/87IC//KuAf/zrQD/8qsB//KqAP//pxD/45YA /+unBP/0qAD/8ZcA//+qJf+PUAn/8s62///5///y8vr/9f////X/+//v8+X////0///++//8 /f////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////3/+L///3////6///m6u3/9/// //708v+lczb/45EH//+nCf//sh7//7Yp//W4Kf/vuCr//8o8//7INP/ttxf//80////LRP// yk3//8lV//7HUv/3x0n/+M5E//vXRf/6zUz/+s1M//rNTP/6zkv/+c1K//nNSv/5zUr/+c1K //fNQ//3zEH/98xB//jLPv/3yjv/98g6//jIOP/3xzf/98gy//fIMv/4xjH/98Uu//bDKv/3 wSn/9sEn//fAJ//1viP/9b8h//W/If/1vR7/9rwd//W7G//2uxn/9boY//a7Gf/2uxn/9rsX //a7F//1uhT/9boU//S6Ef/0uhH/+bwW//m8Fv/5vBb/+bwW//i7Ff/4uxX/97oU//e6FP/y uQj/8rkI//K5CP/yuQj/87oI//O6CP/0uwn/9LsJ/+mvAP//yw3/8bQA//W3BP//whX//8MV //O9A//zwgD/9b0G//W9Bv/2vgX/9r4F//a/A//3wAT/98AD//fAA//zwQL/88EC//TCA//0 wgP/9cME//XDBP/1wwT/9cME//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG //fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//bEBf/2xAX/9sQF//XDBP/1 wwT/9cME//XAAv/1wAL/9b4C//W+Av/2vAP/9roC//W5A//1uQP/9LcE//S2A//ztQL/87IC //OvAv/xrQD/8qsB//GqAP/4oQD/86oF/+CfA//voQH//JoA/+qGAP/snCn/lV0G///08/// +v//8Pb///X////w9/D////6//v2/f///P////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////8/+H////6///7////+f////vz/6uJW/+9fg3//7sQ//6rEf/5qyX//rk3//O7Jv/v viT/5LEk//rEMP//2S3/+sJH//fASf/4wE//+cRU//nIUv/5zE3/+9FH//zWRf/8z07/+85N //vOTf/6zkv/+c1I//jMR//3y0T/98tE//fMP//2yz7/+Ms+//fKO//3yTj/98c3//fHNf/3 xzX/+MYv//jGL//3xiz/98Qr//fCKP/2wSX/9r8k//a/JP/1vyH/9b8h//S+Hv/0vB3/9rwc //W7Gf/1uhj/9boY//a7Gf/2uxn/9rsX//a7F//1uhT/9boU//S6Ef/0uhH/+boV//m6Ff/4 uRT/+LkU//e4E//3uBP/97gT//e4E//xtw3/8bcL//G3C//yuQr/8rkI//K5CP/zugj/87oI //e8AP//xwv/668A///EEf/3vAj/+cEK///HDv/wugD/9b0G//W9Bv/1vQT/9r4F//a/A//2 vwP/98AD//fAA//zwQL/88EC//PBAv/0wgP/9MID//XDBP/1wwT/9cME//bEBf/2xAX/9sQF //bEBf/2xAX/9sQF//bEBf/2xAX/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3 xQb/98UG//bEBf/2xAX/9sQF//XDBP/1wwT/9cME//XAAv/1wAL/9b4C//W+Av/2vAP/9roC //W5A//1uQP/9LcE//S3BP/ztQL/8rMD//KwAv/yrgH/8a0C//CsAf/1rAD/8KoA/+2lBf/2 pQ7/7ZIA//2fCf/vmgn/yH8A/8KUcP//+Oz/+vf///P7///7///////7///9////+/////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////vj/+/73//z//////Pj/27aK/5pdAP// tx7//qwI//m4HP/zsjD/+b05/+27Gv/xwSH/+cRE//3HS//lsR3/9sVF//fHR//2yUr/98tO //rOUf/70FD/98xK//PIRf/90FH//M9O//vOTf/6zkv/+c1I//fLRP/2y0H/9stA//bMPP/4 yzz/98o7//fJOP/4yDb/98c1//jGM//4xjP/98Ys//fGLP/3xCr/+MMp//fCJv/3wSP/9sAi //a+If/1vyH/9L4e//S+Hv/0vRz/9bsZ//S6GP/1uhb/9boW//a7Gf/2uxn/9rsX//a7F//1 uhT/9boU//S6Ef/0uhH/9LUS//O0Ef/ztBH/87QR//KzEP/ysxD/8rMQ//GyD//wtQ//8LUP //C2Df/xtw3/8bcL//K5Cv/yuQj/8rkI///EDv/1uQn/8LcI//i/Df/wugD/9b4B//vDDP/y tgb/9LwF//W9Bv/1vQT/9b0E//a/A//2vwP/9r8C//fAA//zwQL/88EC//PBAv/zwQL/9MID //TCA//0wgP/9cME//bEBf/2xAX/9sQF//bEBf/2xAX/9sQF//bEBf/2xAX/98UG//fFBv/3 xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//bEBf/2xAX/9sQF//XDBP/1wwT/9cME //XAAv/1wAL/9b4C//W+Av/2vAP/9roC//W5A//1uQP/9LkF//S3BP/ztgP/8rMD//GyA//x rwH/8a0C//CsAf/ssAL/860A//amAP/nlQD//78l/+GWAP/vnAD//64N/55jCf/ju4r///z2 //j8///7///////2/////f///f////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// 9///9/z4//j/9P/05c7/g04A//2vF//9qwD//a4e/+m4Ff/qtC7/8bww//vMHv/6yyf/77pG //S9Wf//0Ff/78Y2//XMPP/1z0D/885B//TOR//60VH//tJZ//7PW//+0VL//dBP//zPTv/6 zkn/+c1G//fMQv/2y0D/9co///jLPP/3yjv/98o5//fJNv/3xzX/9scz//jGM//3xTD/98Ys //jFK//3xCr/+MMn//fBI//2wCL/9r4f//a+H//0vh7/9L4e//S+Hv/0vRz/9bsZ//S6GP/1 uhb/9LkV//a7Gf/2uxn/9rsX//a7F//1uhT/9boU//S6Ef/0uhH/77AN/++wDf/urwz/7q8M /+6vDP/trgv/7a4L/+2uC//wtRP/8LUT//C1Ef/wtQ//8bcN//G3C//yuQr/8rkK/++1C//w txD/+8Ub/9+rAP/xvwD/9cEA/+2yAP/4uRL/9LwF//S8Bf/1vQT/9b0E//W+Av/2vwP/9r8C //a/Av/ywAH/88EC//PBAv/zwQL/9MID//TCA//0wgP/9MID//bEBf/2xAX/9sQF//bEBf/2 xAX/9sQF//bEBf/2xAX/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG//fFBv/3xQb/98UG //bEBf/2xAX/9sQF//XDBP/1wwT/9cME//XAAv/1wAL/9b4C//W+Av/2vAP/9roC//W5A//1 uQP/9LkF//O4BP/ztgP/8bQD//GyA//xrwH/8K4C//CsAf/jsBn/9q8F//ahAP/1pQD/3ZwA /+2wGf/nlgD//5kA/+KfHf+HWQv///nl//7////1/PT//v/t//r87v////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////P////n6/P// //3///z4///58////vj///35//759f/4////+f3////97f+kcin/6pQJ//+mAP/8txL/5rws //G4I//1vSr/+MEx//XCNf/vvzf/7cE+//LHR//2zU//9MtN//PKTP/zykr/98xJ//zMRv// yUT//8RA///AO//ruDv/7Kcy//GcJ//0oR///70o///QNv/2yTz/98dL//nLOP/5yzj/+Mo2 //jJNf/5xzL/+ccy//nGL//5xi//+8Qr//vEK//6wyj/+cIn//jCJP/2wCL/9sAg//W/H//2 vx7/9r8e//e9Hf/3vRv/+L0Z//e8GP/5vBb/+bwW//O4Fv/uuRP/670S/+rBEf/uvw3/9LkH //60B///sAX/+JcA//aXAP/0lgL/9JQC//eTAP/6kQD//Y8A//+OAP/nsQn/7bIO//KuD//x pwr/86kI//i0Cf/3vAb/8LoA//S5B//2uwn/+L0L//q/Df/7wA7/+b4M//e8CP/2uwf/9b0G //W9Bv/1vQb/9b0G//W9Bv/1vQb/9b0G//W9Bv/3vwb/978G//e/Bv/3vwb/978G//e/Bv/3 vwb/978G//bEBf/2xAX/9sQF//bEBf/2xAX/9sQF//bEBf/2xAX/9cQF//XEBf/1xAX/9cQF //XEBf/1xAX/9cQF//XEBf/1xAX/9cQF//XEBf/1xAX/9cQF//XEBf/1xAX/9cQF//XDBP/0 wgP/9sAE//W/A//1vQT/9LwD//a7Bf/1ugT/9bgF//S3BP/ztgP/87QE//SyBP/zsQP/868E //OvBP/1qgH/9KkC//SnAf/0pQL/86QB//SiAf/zoQD/9KAC//qfAP/jgwr/s3g0//f74P/w //////n////x9v/0/+//+v/+//r//v/2/Pr/8ff1//f7/P/8/////P////v9///6+f///v3/ //7+///5/f//+//+//z//f/7//3/+f/7//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////v////////////3//v37///7+P////3////9/////f/7//////36 /8+yiv+tdRb/+6wb//inAP//uxr/7rcm//e9Lf/3vi//9r8x//K+NP/xwTn/9cZC//THRv/x xkT/8sBD//jISv/+0VL//tFS//fHSf/ruDv/5Kov/9+hKP/ot0H/9rZI//iqO//jkxb/3psM //S+KP/5ykD/8MBE//nLOP/4yjf/+Mo2//jJNf/5xzL/+MYx//nGL//5xi//+8Qr//vEK//6 wyj/+cIn//fBI//2wCL/9b8f//W/H//2vx7/9b4d//e9Hf/3vRv/97wY//e8GP/5vBb/+LsV //a0F//4uRb/9LcO/+60CP/5uxD//74b//apD//cigD/95UW//aUF//ykhn/8ZEZ//OPF//2 jRD//IwM//6MCP/1mwD/9J0A//CkAf/tqQb/6a4I/+mwCf/ttA//8rkU//O3B//1uQn/97wK //m+DP/6vw3/+b4M//e8CP/2uwf/9b0G//W9Bv/1vQb/9b0G//W9Bv/1vQb/9b0G//W9Bv/3 vwb/978G//e/Bv/3vwb/978G//e/Bv/3vwb/978G//bEBf/2xAX/9sQF//bEBf/2xAX/9sQF //bEBf/2xAX/9cQF//XEBf/1xAX/9cQF//XEBf/1xAX/9cQF//XEBf/1xAX/9cQF//XEBf/1 xAX/9cQF//XEBf/1xAX/9cQF//TCA//0wgP/9b8D//W/A//1vQT/9LwD//a7Bf/1ugT/9bgF //S3BP/ztgP/87QE//SyBP/zsQP/868E//OvBP/1qgH/9KkC//SnAf/zpgL/86QB//SiAf/z oQD/86AC//KaAP/vlBD/t3Qb/823iP/9//f//P7////9///+//v///r////9/////v/////9 ////+/////r////6////+v////v//fz4//v69v/9/Pj////9///+/////f//+Pb7//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////9/////f//////+/z+ //7////8/////P////v//////P///+zQ/5ZjEP/rpyj/6KMK///BJP/trBT//bol//i+Nv/8 xD3/+cM8//O/OP/0wj3/+sxF//zQS//5zUj//9Ra///RVv/5x07/5bc//9qtOP/itET/+spc ///dcv/3y17//9Fp///IYP/upjD/2ZMN/++yI///0En//MxO//jKN//4yjf/98k1//jJNf/5 xzL/+MYx//nGL//4xS7/+8Qr//rDKv/5wif/+MEm//fBI//2wCL/9b8f//W/H//1vh3/9b4d //e9Hf/2vBr/97wY//e8GP/4uxX/+LsV//u2Gv/6shD//rUO//+8Ff//sxX/7qMU/+WeHv/q pTD/98db//3OYv//127//9ty///Uav/4w1n/67FD/+OlNv//kwz/944A/+qTAP/npAD/564H /+OtDP/krRX/6a8f//C0Bv/ytgj/9bkJ//i8DP/5vgz/+L0L//e8CP/2uwf/9b0G//W9Bv/1 vQb/9b0G//W9Bv/1vQb/9b0G//W9Bv/3vwb/978G//e/Bv/3vwb/978G//e/Bv/3vwb/978G //XDBP/1wwT/9cME//XDBP/1wwT/9cME//XDBP/1wwT/9MME//TDBP/0wwT/9MME//TDBP/0 wwT/9MME//TDBP/0wwT/9MME//TDBP/0wwT/9MME//TDBP/0wwT/9MME//TCA//0wgP/9b8D //S+Av/1vQT/9LwD//W6BP/1ugT/9bgF//S3BP/ztgP/87QE//SyBP/zsQP/868E//OvBP/z qwH/9KkC//OoAf/zpgL/86QB//KjAf/zoQD/86AC//GgCf/klAD/4pQW/6JgFP//6M3/7/3+ //T/////+v////r////6////+/////v8///39P/8+O////3x////8f/+/+/////z////9P// //r///79///9/////P////v///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////76/////f/19vj/9/v+//v////7////9/z///b6/f//+fL/vZNX/8uFCf/7 sRL/87cZ/+y1JP/1tyb//7Ud//S7Ov/+x0b//8tK//vGRP/2xEH//c1H///WT///11D//8ZO /+6yOv/Xoy3/37I///vTZP//537//+J9//rScv/802r/+s1o///LZv//vU7/5psb/+ScEv/8 wjz//s9N//jKN//4yjf/98k1//fINP/4xjH/+MYx//jFLv/4xS7/+sMq//rDKv/5wif/+MEm //fBI//1vyH/9b8f//S+Hv/1vh3/9b4d//a8HP/2vBr/97wY//a7F//4uxX/+LsV//e8Gv/3 thL//7cS//+4GP/0qhf/4aAg/+64TP//3X3/8998//LgfP/w4H7/7uB9//Dgfv/04H3/+N97 //vffP//r0H/950l/+mPB//plAD/76EB/+6oCv/nqA//36YR/+2wB//vsgn/8rYK//a6DP/3 uwv/97wK//a7B//2uwX/9b0G//W9Bv/1vQb/9b0G//W9Bv/1vQb/9b0G//W9Bv/3vwb/978G //e/Bv/3vwb/978G//e/Bv/3vwb/978G//XDBP/1wwT/9cME//XDBP/1wwT/9cME//XDBP/1 wwT/9MME//TDBP/0wwT/9MME//TDBP/0wwT/9MME//TDBP/0wwT/9MME//TDBP/0wwT/9MME //TDBP/0wwT/9MME//TCA//zwQL/9b8D//S+Av/0vAP/87sC//W6BP/0uQP/9bgF//S3BP/z tgP/87QE//SyBP/zsQP/868E//OvBP/zqwH/8qkC//OoAf/ypgL/8qUB//KjAf/xogD/8aEC /++gEP/rowH/7pcA/9hzB//Gj1n/+P/0/+D1+P//+f////39///9/////f////z////6//// /v////7//////f/8//r//P/7//7////7/P7/+vr8//z8/v/8+vv/+fj2//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////74///++//z9Pb/+P3///n////2 +////v///////f/gupX/rnMX//yvFf/9swT/8rgZ/+W0K//2uy///7ge//C7O//6xUX//81N ///MTP/9ykr//cpK//nIR//1xEP/0ZIe/+2yPv//1mP//+V0///dcP/0z2X/8Mpl//PNav/7 zGL/7cJa//LDW///xFb/86Ek/+ORCv/2ti7/9spD//fJNv/3yTb/98k1//fINP/4xjH/98Uw //jFLv/3xC3/+sMq//nCKf/5wif/98Al//bAIv/1vyH/9L4e//S+Hv/0vRz/9L0c//a8HP/1 uxn/9rsX//a7F//3uhT/97oU/+y8Ev/2wRv/9bcW/+amEP/orSX//cxW///hff/94of//dBz //vQcf/3z2//9c9u//jScf//1Xb//9l9///cg//21Xj/98Ng//amN//2kBL/+I0A//iZAP/v owD/4qUA/+msBv/srwf/8LMK//O3C//2ugr/9rsJ//a7Bf/1ugT/9b0G//W9Bv/1vQb/9b0G //W9Bv/1vQb/9b0G//W9Bv/3vwb/978G//e/Bv/3vwb/978G//e/Bv/3vwb/978G//TCA//0 wgP/9MID//TCA//0wgP/9MID//TCA//0wgP/88ID//PCA//zwgP/88ID//PCA//zwgP/88ID //PCA//zwgP/88ID//PCA//zwgP/88ID//PCA//zwgP/88ID//PBAv/zwQL/9L4C//O9Af/0 vAP/87sC//S5A//0uQP/9bgF//S3BP/ztgP/87QE//SyBP/zsQP/868E//OvBP/yqwH/8aoC //GoAf/ypgL/8aUB//GjAf/wogD/8aEC//CfD//rpAD/+J0A//+UDP+3aRT/0cmb//b/+P// 9///9f7t//v/+P/8////+Pv///r5///+/f//+Pf//+vq+v/7////+/////j8///y9v//+f// //n////4//j/9v/y//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////z2/////f/3+/7/+/////X6/v/49/X///32///16v+tbh//5aEm//GqAv/7uAf/5qsR //nDPf/wuC///MQp//LAPf/0wUH/+cZG///MTf//zVD/98RH/+q2PP/grDL//8xa///RXv// 12T//9xn///baP/61WL/9c1b//DGVv//xlL/98pX//DCUv//wEz//KIn//GWEf//vTH/8ss/ //fJNv/3yTb/9sg0//bHM//4xjH/98Uw//fELf/3xC3/+cIp//nCKf/4wSb/98Al//bAIv/1 vyH/9L4e//O9Hf/0vRz/9L0c//W7G//1uxn/9rsX//W6Fv/3uhT/97oU/+a4Cv/quRT/6bYf /+e1Lv/zxU3//9pt//vedv/s1HD//NNn//7aav//4W7//+dx///lcP/+3G7/+NNp//bMZv/j 5Ib/9+CC///JZ///pTv/+I4U//SPAf/znQD/7qYA/+aoB//pqwj/7bAI//G0C//0uAj/9rsH //a7Bf/1uwL/9b0G//W9Bv/1vQb/9b0G//W9Bv/1vQb/9b0G//W9Bv/3vwb/978G//e/Bv/3 vwb/978G//e/Bv/3vwb/978G//TCA//0wgP/9MID//TCA//0wgP/9MID//TCA//0wgP/88ID //PCA//zwgP/88ID//PCA//zwgP/88ID//PCA//zwgP/88ID//PCA//zwgP/88ID//PCA//z wgP/88ID//PBAv/ywAH/9L4C//O9Af/zuwL/8roB//S5A//zuAL/9bgF//S3BP/ztgP/87QE //SyBP/zsQP/868E//OvBP/yqwH/8aoC//CpAf/wpwL/8aUB//CkAf/wogD/8KIC//OgBv/m lwD//6kC//iQAP/kixP/mWoc///+4f/39Pv/8f/t//X/9P/1/vv/9/r////9/////P////v/ ///7/////Pf///37///9///8+///9Pf8//T9+v/y//P/7/7r//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////z4/////f/5/f//+/////j5+////fb///jp /8uwm//LdQD/97Ee//G3Df/lrAX//8Iw//e3M//6xjz/78ox//bGPv/0xD7/+MZD//3KS//2 wkj/7bZB/+22Qv/2vk3//NRl//7ZZ///3Wf//Npf//XSVP/yy0r/9clG//rJRv/9ujj/+8hJ /+m7Qf/6uD3//6Eh//KQCf/5tSb/6MUz//fJNv/2yDX/9sg0//bHM//3xTD/9sQv//fELf/3 xC3/+cIp//nCKf/4wSb/98Al//W/If/0viD/870d//O9Hf/0vRz/87wb//W7G//1uxn/9boW //W6Fv/3uhT/9rkT/+20A//nsA//67ov//rNWP/91Gr/8sti//DKXf/50V//69ZZ/+rXVv/m 2FP/5NtS/+fdV//s31//8eFo//bhbv/p3W//9+B4///cd///yGP/9a0///CdHf/ymQf/95oA /+OlBv/mqAf/664I//CzCv/ztwn/9boI//W6BP/1uwL/9b0G//W9Bv/1vQb/9b0G//W9Bv/1 vQb/9b0G//W9Bv/3vwb/978G//e/Bv/3vwb/978G//e/Bv/3vwb/978G//TCA//0wgP/9MID //TCA//0wgP/9MID//TCA//0wgP/88ID//PCA//zwgP/88ID//PCA//zwgP/88ID//PCA//z wgP/88ID//PCA//zwgP/88ID//PCA//zwgP/88ID//LAAf/ywAH/870B//O9Af/zuwL/8roB //O4Av/zuAL/9bgF//S3BP/ztgP/87QE//SyBP/zsQP/868E//OvBP/wrAH/76sC//CpAf/v qAL/76YB//CkAf/vowD/8KIC//GZAP/2nQP/5pUA//ioC//qjwD/ynIG/9mtfP/y/PT/+P/6 //n/+f/9/f3///39///79v//9OX///HS///yzf//67n//+vD///12///+/H///v7///9/v/7 /fr//P/7//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////76 /////f/0+Pv/+f3//////f///PH//eLN/4ViRv//pxb/968P/+OzC//+zC3/+7Yq///FQf/x wDP/7NU6//jJP//5yUH//cxJ//vISf/rtD3/4ak4//vDVv//53z/9thq//HTYf/u0Vv/8dRW //rYU///1Uv//Ms+//nCMv//syn/+8M8/+W2NP//vTv//6cl/+6IAP/sqBf/48Qs//bINf/2 yDX/9sg0//bHM//3xTD/9sQv//fELf/2wyz/+cIp//jBKP/4wSb/9r8k//W/If/0viD/870d //O9Hf/zvBv/87wb//W7G//0uhj/9boW//W6Fv/2uRP/9rkT//ewAP/4txv/98A///XJYP/4 zW7//M9q///NXP//yk7/+81V//3RVP//2FX//95Y///eWf/92V7/+tNe//nNYP/70lb/9dRg //Lcb//24Hr/89Fm/+6zP//wlxf/9ooD/+KjBv/lpwj/6qwJ/++yCv/ztwn/9boG//W6BP/1 uwL/9b0G//W9Bv/1vQb/9b0G//W9Bv/1vQb/9b0G//W9Bv/3vwb/978G//e/Bv/3vwb/978G //e/Bv/3vwb/978G//PBAv/zwQL/88EC//PBAv/zwQL/88EC//PBAv/zwQL/8sEC//LBAv/y wQL/8sEC//LBAv/ywQL/8sEC//LBAv/ywQL/8sEC//LBAv/ywQL/8sEC//LBAv/ywQL/8sEC //LAAf/ywAH/870B//K8AP/zuwL/8roB//O4Av/zuAL/9bgF//S3BP/ztgP/87QE//SyBP/z sQP/868E//OvBP/wrAH/76sC//CpAf/vqAL/76YB//CkAf/vowD/76MC//qcAP/wkAD/7aAW /+ChBP/5ngD//5EU/49PEv/r/Oz//v////37////9vn///Ht/+fMt/+xkGP/jWoo/4plFP+a bxH/h14P/5ZuOv/QrpP//+jj///5////+P////n///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////P0//f////p/+7//v/r///9///+9/7/v5Ze/92DAP/t rwz/97gb//a2If/1tiv//8E8//nAPf/yvTn/98dB/+bGNf//0Uf//8RC/+2nLv/uqzb//9Bb ///jav/s2l7/+NtT//nZUv/61kz/+NFF//rNPv/7yDn//MU0//vDMv/2uDH/9bcu//SxJP/7 qh3//Z8X//OXEP/wpBr/+8Ey//TFL//0xS3/9sQt//bFK//3xCv/98Qq//nEKv/5xCj/+MAh //jAIf/3vyD/9r4f//W9Hv/1vR7/9Lwd//S8Hf/0viD/9Lwd//S8Hf/1uxn/9LsW//S5E//2 uRH/9bgQ//a+Kf/3vjH/9r9A//XBS//2xFH/9spR//bNTf/20En/+dNO//rUT//51E//+tVQ //nXUf/42FH/+dlS//nZUv/300f/99ZV//LSYf/vzmf/+tBs///NYP/2sjf/3pEN//KUAP/x nAX/66IH/+WnBv/pswn/9r4P//m+DP/0tgH/9LwH//W9CP/1vQb/9b0G//a+Bf/2vwP/9r8D //fABP/3wAT/98AE//fABP/3wAT/98AE//fABP/3wAT/98AE//K/BP/yvwT/8r8E//K/BP/y vwT/8r8E//K/BP/yvwT/9cIH//XCB//1wgf/9cIH//XCB//1wgf/9cIH//XCB//1wgf/9MEG //TBBv/0wQb/88AF//PABf/zwAX/88AF//S8Bf/0vAX/9LwF//O7BP/zuwT/87sE//K6A//y ugP/8bkE//K3A//xtgL/8bQD//CzA//wsQL/77AD//CuAv/vrQH/7qsC/+6qAf/tqAL/7qcB /+6lAf/tpAD/7aMC//GaAP/6owb/+KEC//qkA//lkwD/5ZgM/9eKIP/Xijz//vj////79v/m yJT/o3YP/692AP/hoQH/97QO//i1D//7thr//7cV//uvDP/EfAD/n2MA/9y2eP//++//+PP/ /+n07P/2//7//P////Dy7f////P//vzv///+/f///P//8P/t//3//P//+P////b////7///+ //v//P75///+///p9Pb/+//////8////+/////r3//f48v/2////8f////T0///8//v/+//x //L58v/5+v////n///Do9////fj///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////z///T9+P/1 //b//P/4//r0+P//8+b/mmcW//qoFP/ytBP/87QZ//K0If/6vTH//8hB//rFQf/ywjz/8sY/ ///STv/xvDr/6a4w//K0Of/9xUz//c9V//bXWv/231//99pO//jZTf/51Un/+tFD//rMO//6 xzb/+8Ux//vDMP/2ti7/9bYr//OwI//6qRz//aAV//KWDf/voxn/+cAx//TFL//0xS3/9sQt //bFK//3xCv/98Qq//nEKv/5xCj/+MAh//jAIf/3vyD/9r4f//W9Hv/1vR7/9Lwd//S8Hf/0 vB3/9Lwd//O8G//1uxn/9boW//S5E//2uRP/9bgQ//a8LP/2vDT/970///fASf/3xE7/9slK //bOSP/30ET/+dNM//nTTP/61E3/+dVN//jWTv/510//+NhP//nZUP/61E3/+dZU//LUWv/t zVz/9tBj///RYv/9vkr/7KYt//CWBP/vmwf/66II/+ioCP/qsQj/8LgL//S5B//ztgP/9LwH //S8B//1vQj/9b0G//W9BP/2vgX/9r8D//a/A//2vwP/9r8D//a/A//2vwP/9r8D//a/A//2 vwP/9r8D//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/9cIH//XCB//1wgf/9cIH //XCB//1wgf/9cIH//XCB//0wQb/9MEG//TBBv/0wQb/88AF//PABf/zwAX/8r8E//S8Bf/0 vAX/9LwF//O7BP/zuwT/87sE//K6A//yugP/8bkE//K3A//xtgL/8bQD//CzA//wsQL/77AD //CuAv/vrQH/7qsC/+6qAf/tqAL/7qcB/+6lAf/tpAD/7aMC/+qbAP/ynwH/7JgA/+6bAP/r mQD/7p0N/9aGFf+uXgf//+ja/7KPZ/+kdSP/3qQn//q4HP/2rwX/+LAE//u0Cv/0tQ7/+LQJ /++nAP//uhX/9rgv/6F1Fv+fgU////zk//7/+P/+////6+zx//7////6/fL//v/z////+/// /f//7//y////////+f////H+//n0+P/6//z//P/////+///8//////76///34//ly6b/0rKD /8Skcf+6nmz/4cmZ///u0////e3/7uXm//7+///7////8/f4/////f/79/T///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9v7/////+v/7//f/8vv////8/f/Dl2j/xIEO//y3FP/3thr/8rIc //W4Kf/7wzj/98U+//TGP//1y0X/88xD///GUf/rrTb/46sw//rIS///2lf/9M9L//DQSf/8 31f/+NpI//fXRv/41EL/+c87//rLN//5xTH/+sIt//rBKv/3tSn/9rUn//OvHv/6pxn//Z0T //GVDP/uohj/+L8w//TFL//0xS3/9sQt//bFK//3xCv/98Qq//nEKv/5xCj/+MAh//jAIf/3 vyD/9r4f//W9Hv/1vR7/9Lwd//S8Hf/0vB3/9L0c//W7G//0uhj/9boW//a4Ff/1uBL/9rcS //e5MP/2ujX/97w+//e/RP/3xEX/98lC//bNPf/40Dr/+dJH//nSR//51Ej/+NRI//nVSf/4 10r/+NdK//jZS//91VL//NdT//XUUf/rzkz/8c9T//7TYP//y1//+rxV//SdEP/tmwv/6J0G /+mlBv/qqwb/7LAE/++zBf/ytgb/9LsJ//S7Cf/0vAf/9b0G//W9Bv/2vgX/9r4F//a/A//2 vgX/9r4F//a+Bf/2vgX/9r4F//a+Bf/2vgX/9r4F//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E //K/BP/yvwT/9MEG//TBBv/0wQb/9MEG//TBBv/0wQb/9MEG//TBBv/0wQb/9MEG//TBBv/z wAX/88AF//K/BP/yvwT/8r8E//S8Bf/0vAX/9LwF//O7BP/zuwT/87sE//K6A//yugP/8bkE //K3A//xtgL/8bQD//CzA//wsQL/77AD//CuAv/vrQH/7qsC/+6qAf/tqAL/7qcB/+6lAf/t pAD/7aMC/+edAP/uoAL/7JkA/+uYAP/olQD/45IA/+yZH//IdBH/p28k/7h9H//npSr//7ge //WrAP/8swD//8UV//+/Ev/wuAv//cAN//m4AP/4swD/+7oU/+SsJf/Bkir/tY04///35f/z 6uX///3//+rq8v/7//3//P/4//T28f//////+P/////+////+/////z9//7//f/3////+P3/ //v5////+f3/8Nq1/6ODLv+hcwT/xooa/9OPIP/dmR7/xYMA/41eAv/Zr33///fz///1///v 9O7/+f/x//v/9P/8//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////7f//////+P/8+fT/+f// ///06P+YVAH//7Mg/+yyBv/2tB//9bck//3ENf/5yD//7L43/+7EPv/70Uv/99BH//inO//2 sD7/+sRK//zVUv/22U3/79ND//PTQv/92Uf/+Nc+//jVO//50jn/+c40//nILv/5xCr/+cEm //q/Jf/4tCX/9rQi//WtGv/7phX//JwR//CVCf/rohf/974v//TFL//0xS3/9sQt//bFK//3 xCv/98Qq//nEKv/5xCj/+MAh//jAIf/3vyD/9r4f//W9Hv/1vR7/9Lwd//S8Hf/2vBr/9bsZ //W7Gf/1uhj/9rgX//W3FP/2txT/9bYT//e3M//3uDX/97s5//i/PP/3wzv/98k4//jNM//3 zzH/99E+//jSP//40j//+NRA//jWQf/510L/99hC//fYQv/90lD//dVP//bWR//uz0D/7s5F //fRVv/9zmb/+shp//+uKf/vnxb/4pYE/+SbAP/ppAH/6qoC/+ywBP/vtQn/87oI//S7Cf/0 uwn/9LwH//W9Bv/1vQb/9b0E//a+Bf/2vgX/9r4F//a+Bf/2vgX/9r4F//a+Bf/2vgX/9r4F //K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/9MEG//TBBv/0wQb/9MEG//TBBv/0 wQb/9MEG//TBBv/0wQb/9MEG//PABf/zwAX/8r8E//K/BP/yvwT/8r8E//S8Bf/0vAX/9LwF //O7BP/zuwT/87sE//K6A//yugP/8bkE//K3A//xtgL/8bQD//CzA//wsQL/77AD//CuAv/v rQH/7qsC/+6qAf/tqAL/7qcB/+6lAf/tpAD/7aMC/+mjA//qoAP/7J0C/++dAP/rmAD/3IcA //mlIf/nkSL/pWAA/+ihFf//vSD//bUI//+6Bv//vgr/+b0R///GH//0wRj/7LQF///FDf/+ vQH/5aIA//++Gv//wDD/u30A/6yPZ///++b///n7//f1///5////9f75//z/+//4+fT//P7/ ///7/////Pb////4//n//f/w/Pz//P/////8////1L7/lmcX/8CQAP/+xBr/+LIS//+2H/// tQr//LIA//myHP+wcgX/kWQr///y3P////T/+//4/+758//4//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////8v////n18v///vv///7//7KRaP/WhRL//6kG/+25Df/0syH/9bsr//7JP//4 ykP/7sI9//jMSf/9zkr/7r44/++fMP//u0b//9NT//XUSf/q0Dv/79U6//vYPP//1zr/99Yz //fUMv/3zy//+Msq//jGJ//5wSL/+b0f//q7Hv/6sh//+LIc//asFf/6pBH//JsM/+6TB//p oBP/9b4u//PELv/zxCz/9cMs//XEKv/2wyr/9sMp//jDKf/4wyf/+MAh//jAIf/3vyD/9r4f //W9Hv/1vR7/9Lwd//S8Hf/1vBf/9rsX//W6Fv/2uBf/9rgX//a2Fv/2tBX/9rQV//izMf/4 tTL/97k0//e+M//3wzL/98gw//jMLf/4zir/+NE4//jROP/30jn/99I5//fUOv/31jv/+Nc8 //jXPP/7z0j//NNF//jVPf/y0Tj/8M07//HMSv/zx1r/8cNj//++Qf/xpyL/4ZEE/+GRAP/p nQD/6qcB/+uuBv/qtAr/87oJ//O6Cf/zugj/9LsJ//S8B//1vQb/9b0G//W9Bv/1vQb/9b0G //W9Bv/1vQb/9b0G//W9Bv/1vQb/9b0G//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/y vwT/88AF//PABf/zwAX/88AF//PABf/zwAX/88AF//PABf/zwAX/88AF//PABf/yvwT/8r8E //K/BP/xvgP/8b4D//S8Bf/0vAX/9LwF//O7BP/zuwT/87sE//K6A//yugP/8bkE//K3A//x tgL/8bQD//CzA//wsQL/77AD//CuAv/vrQH/7qsC/+6qAf/tqAL/7qcB/+6lAf/tpAD/7aMC /+ymBv/pngT/6ZoB/+yZAP/3pAD/6pUA/+iUDf/AawD/5aEC//m1Ev/1swf/87YF///NHP// zSL/6r0a/+u+I//1wyT/8LwY//K6D//8vw7//bwM//StA//2rQn//7ka/51sHf/mvov///Hj ///9///5////7/n4//z/+//3+PP/+PX////9//////T////2/+/5+P/s9vj////6///77/+Z Tgr/+7c8//W5A//srgD//r0L//a1D//7vwn/8LkA//+2AP//xRv/154Z/4dgEf/64cv///X/ //j6///2//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////P///+7v8/////3//+7U/5ZhEf// riT/+6wH/+65Ff/ztij/9Lwx//fGPf/3y0b//c5M///RUf/7wED/5KQm//m3PP/9wkL/+8xC //LOOv/u0DT/9NQz//3YMv//2DL/9tQq//bRKP/3zib/+Mkj//nEIP/5vx3/+bsa//m5Gf/7 sBn/+bAW//WqEP/7ow3/+poI/+2SBf/onxL/87ws//PELv/zxCz/9cMs//XEKv/2wyr/9sMp //jDKf/4wyf/+MAh//jAIf/3vyD/9r4f//W9Hv/1vR7/9Lwd//S8Hf/2uxX/9boU//e5Fv/2 uBX/9rYW//a0F//2tBf/9bMX//iyLP/4tCv/+bcr//m9K//5wir/+MYp//fKKf/4yyj/988x //fRMv/30TL/9tIz//fTNP/31TX/9tY1//fXNv/5zzv/+NE4//jRNv/30DX/9Mw3//PHQP/v wUf/7LxN///HT//2rzH/55cO/+SQAP/rmAD/7aUB/+muCP/mswz/87oL//O6Cf/zugn/87oI //S7Cf/0vAf/9LwF//W9Bv/1vQj/9b0I//W9CP/1vQj/9b0I//W9CP/1vQj/9b0I//K/BP/y vwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/88AF//PABf/zwAX/88AF//PABf/zwAX/88AF //PABf/zwAX/88AF//K/BP/yvwT/8b4D//G+A//xvgP/8b4D//S8Bf/0vAX/9LwF//O7BP/z uwT/87sE//K6A//yugP/8bkE//K3A//xtgL/8bQD//CzA//wsQL/77AD//CuAv/vrQH/7qsC /+6qAf/tqAL/7qcB/+6lAf/tpAD/7aMC/+qgAP/yowr/8p4I/+WQAP/znwH/9KML/9mIA/+x YAD/8rQJ//O3C///yBn/+8cZ/+a4Df/xxiL//NQ3/+XAJ//ywCP//9Ax//HAHf/osw3//sUc //+/F//zrAT//7QN/+uoJf+XYAX//+nA///49P/7////+P////X39v///vv/9fH////+/f// /vL/+vz3//X8///+//////Le/8qrff/4pin/4JUA///DCf//xwf/6rMB/++7F//rvRL/9swW //+8AP/rpwD/87MA/9qeGv+cai///+7n///4///5/v////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////bx//n////8////yKVv/86GEP/0pA3//78k/+20Hf/1vDH/9sE3//TEPv/3y0j//89P //7CRv/1rTT/86Mq//jJPf/2yDf/9ck0//rPNf/70zP/+tMt//nTKP/50yb/9tMh//bRIf/2 zB7/98cb//jCGv/4vRf/+boV//i3E//8rxX/+a8S//apDf/6ogr/+ZkH/+yRBP/mnxH/8Lwr //LDLf/ywyv/9MIr//TDKf/1win/9cIo//fCKP/3wib/+MAh//jAIf/3vyD/9r4f//W9Hv/1 vR7/9Lwd//S8Hf/1uxL/97oU//a5E//3uBX/97UW//a0F//3shf/97IX//myJv/4tCX/+bcj //m8Jf/5wSb/+cQm//jIKP/3yin/9s8q//fQK//20Sv/99Is//bTLf/21S7/9tUu//fWL//4 0i//988v//jNMP/6zTT/+8s5//rHOv/2wjv/8b86///CT//8tjz/9aQf//CXB//ulwD/7qIB /+itCf/hsA3/8rkK//K5Cv/zugn/87oJ//O6CP/0vAf/9LwH//S8B//0vAf/9LwH//S8B//0 vAf/9LwH//S8B//0vAf/9LwH//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E //K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/8b4D//G+A//w vQL/8L0C//S8Bf/0vAX/9LwF//O7BP/zuwT/87sE//K6A//yugP/8bkE//K3A//xtgL/8bQD //CzA//wsQL/77AD//CuAv/vrQH/7qsC/+6qAf/tqAL/7qcB/+6lAf/tpAD/7aMC/+ydAP/0 oQf/96EO/+iSAP/qlgD/754O/82AAP/Wihz//8MV/+SsAP/vugz//9Al//fIIP/wwyD/+swu //fLLv/6xyD/+Mci///SL///1DD/8sMf/+q1Df/1tw7//bkO//+4Bv/WkxD/qoE////87P/5 +v//+Pz////+////9/v///z/////+v/8+u7//P////v+/////P//9Nay/5dpHP/ooQD//bkQ //6/Ev//yBz/9b8V/++6FP/8yCb/6bUU//K9Df//ww//86cA//+/Hf/Ffgj/sYE////55f// /v////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////+zf//X////z/f7/nHAl//qlF//4qw//8bUj //u8L//4wDf/+sY+//bHQ//3ykn/+sRI/+yqMP/xoCr//7I9/+jHLv/xzDP//tM3///VN/// 1TH//9Mq//fPIP/uyxn/9tEe//fQHf/2yxr/9scZ//fBFv/5vBT/+bgS//m2EP/9rhP/+64Q //epC//6oQf/+5gG/+uQAf/mnxH/8Lwr//LDLf/ywyv/9MIr//TDKf/1win/9cIo//fCKP/3 wib/+MAh//jAIf/3vyD/9r4f//W9Hv/1vR7/9Lwd//S8Hf/3uhL/97oS//a5E//2txT/97UW //a0GP/3shf/97IZ//ixIf/5syD/+Lcf//i8IP/4wCH/+cQm//nHKv/5ySv/9s8p//bPKf/3 0Cr/99Ir//XTK//21Cz/9tYt//bWLf/41yr/9s8p//bKLf/8yjX//8s7///JOf/8xTT/+sQw //S7Sv//ukP//68t//meD//xmAD/7aEA/+arCf/frQz/8rkK//K5Cv/yuQr/87oJ//O6CP/0 uwn/9LwH//S8B//0vAf/9LwH//S8B//0vAf/9LwH//S8B//0vAf/9LwH//K/BP/yvwT/8r8E //K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/yvwT/8r8E//K/BP/y vwT/8r8E//K/BP/xvgP/8b4D//G+A//wvQL/8L0C//S8Bf/0vAX/9LwF//O7BP/zuwT/87sE //K6A//yugP/8bkE//K3A//xtgL/8bQD//CzA//wsQL/77AD//CuAv/vrQH/7qsC/+6qAf/t qAL/7qcB/+6lAf/tpAD/7aMC//WfAP/qkgD/8ZgI//SbC//xnQn/5ZgK/7huAP/qojb/6q4A ///LHP/8xxn/7roP///MI///0yz//cgk///IJf//0SD//M0f//fOJP/10Cn/9M0n//nNJP/8 xhv/97sL//+wAP//vSP/mWoY/9/Ls////v///v7////9////8/r///7/////9v/7+/H//v7/ //78///97vX/882e/7B6GP/sswD//8YY//3BI//ssRX//MEd///GHf/2txT//74l/+W7Gf/y thj//7AQ//2eAP//xSH/oWoA/+HKmP/59Pv///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////7f/0 ///4///ttqL/vHkI//OyAv/zthD/+b8v/+21Iv/+wzn/8co+/+/USf/zzUj/+rY5/+qWGv// vjf//cAx//vLKf/4zSn/984m//TQIv/00R//99Ad//jQGf/7zhn/+MwV//jKFP/4xxP/98IS //e+D//4ug//97cN//i1Dv/6rgr/9akF//akAv/+nQH//5UD//qWCv/ypxr/8boq//LAKf/z wSr/9sMq//jFLP/6xSv/+cIn//fAJf/2wCL/9sAi//bAIP/1vx//9r8e//i+Hv/3vRv/+L0b //i9Gf/8vxn/97wY//G2Ev/0uRf/+70e//eyFv/xpg3/9aUO//axFf/2tBf/97cX//a7Gf/2 vxr/98Qb//fHHf/3yR7/+M4i//jOIv/40CP/+NAj//bQI//20iT/9tIk//bSJP/50Cj/+M8p //jNKf/4yyr/+ccq//nDK//5wSz/+cEs//y5N//+vTv//Lc2//WjI//ylRL/8ZcL/+WeBP/Z ogD/67AM/+2zCv/wtwj/87sG//W9Bv/0vAX/87sG//O6CP/0vAf/9LwH//S8B//0vAf/9LwH //S8B//0vAf/9LwH//S8Bf/0vAX/9LwF//S8Bf/0vAX/9LwF//S8Bf/0vAX/8b0F//G9Bf/x vQX/8b0F//G9Bf/xvQX/8b0F//G9Bf/wvAb/8LwG//C8Bv/wvAb/8LwG//C8Bv/wvAb/8LwG //O7Bv/zuwb/87sG//K6Bf/yugX/8roF//G5BP/xuQT/77gF/+63BP/vtgX/7rUE/++zBf/v sQT/77EG/++xBv/srAT/66sD/+ypAv/rqAL/66YD/+qlAv/rowP/6qIC/+qiAP/uoAr/6ZwA /+uZCf/pmwD/5JYO/7NiB//5uQ//87cJ//W7D//3wRb/+ckf//rPKP/60y7/+dY0//jXNP/6 0y7/+tMu//rRK//5zSb/+cok//jIIP/4xR7/+MMb//+0Jf/+sQD/66gA/4xdC///+v3/7vX/ //v/+///+uz//P/z//76+////vv/7vnp//f/////+///nmwl//+1Cv/3uBP/+LsV//fBGf/3 xx//+cok//nKJP/6ySb/+8cl//7KH//+xCT/97YU//m5Av/vtgD/6LYV/5dkEf//3sv/9PD/ //n////s+Pb/+v/8///++v//+fj///7///n+//////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////9f/////29v+zf1D/35wZ//W2B//6viL/8Lcq//bALP/2 wjv/+tNK//LORv/9y0j/5p0d//+uLP/2siP//Mkw//vMKP/5zSb/984k//TQIv/00R//99Ab //nPGf/7zxj/+MwV//jKFP/4xxP/98IQ//e+D//3uQ7/+LUM//e0C//5rQn/9akF//akAv/+ nQH//5UD//qWCv/ypxr/77sq//LAKf/zwij/9sMq//jFK//6xSv/+cIn//fBI//2wCL/9sAi //bAIP/1vx//9r8e//i+Hv/3vRv/+L0b//i9Gf/8vxn/97wW//K3E//0uRf//Lwc//iyFv/z pgz/96YP//axFf/3sxT/9rYW//a7F//2vxr/98Qb//fHG//3yRz/+M4i//jOIv/4ziL/+NAj //bQI//20CP/9tIk//bSJP/50Cb/+M8n//jNKP/5ySf/+ccq//nEKv/5wir/+cAp//26N//8 vDj/+rUz//elJf/1mBX/8ZYK/+adA//cogD/6a4K/+yyCf/vtgf/8rkH//S8Bf/0vAX/87sG //O6CP/0vAf/9LwH//S8B//0vAf/9LwH//S8B//0vAf/9LwH//S8Bf/0vAX/9LwF//S8Bf/0 vAX/9LwF//S8Bf/0vAX/8b0F//G9Bf/xvQX/8b0F//G9Bf/xvQX/8b0F//G9Bf/wvAb/8LwG //C8Bv/wvAb/8LwG//C8Bv/wvAb/8LwG//O7Bv/zuwb/8roF//K6Bf/yugX/8bkE//G5BP/x uQT/7rcE/+63BP/vtgX/7rUE/++zBf/vsQT/77EG/+6wBf/srAT/66sD/+ypAv/rqAL/66YD /+qlAv/rowP/6qIC/+qiAP/uoAr/6ZwA/+uZCf/pmwD/5JYO/7NiB//5uQ//8rkK//S8D//3 wxj/+sog//vQK//71C//+dY0//nXN//71jD/+9Qv//vRLf/6zyr/+Mwl//nII//5xh//+MUe //++Jf//vAb/9a8B/6x3D//YwKj///3///f7/v////T//v/4///+/////vz/9//0//n///// 8er/pXIf//+3Cf/4uRT/97wW//fCHP/4yCD/+Mwl//jLJ//6yyf/+skm//rIG//+xyb//b0d //SzAf/xtgD/8boV/7qFG//Kkl////v//+/u8//4////+/////76+f///Pv///79//r///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////v3///ngzP+X ZAn/9bQY//m5Ef/4uy3/87o3//vHNf/zyEX/981H///WU//tqij/8p8d//+xJP/ztxv/9cwm //vLI//4zCH/9s4f//TPHv/00Br/9s8Y//jOF//7zRf/+MoS//fJE//4xhH/+MEP//i8Dv/4 uQz/+LUM//i0C//6rQn/9qkF//aiAf/9nAD//5UD//eWCf/wpxr/7bop//LBJ//zwij/9sMp //jFK//6xSn/+cMl//fBI//2wCL/9sAi//bAIP/1vx//9r8e//i+Hv/3vRv/+L0b//i9Gf/6 vRf/97wW//K3Ef/0uRX/+7sb//ivEv/zpAv/+aUO//exE//3sxL/97YU//i7Ff/4vxj/98MY //bHGf/3yBr/+M0f//jNH//4ziD/988g//fPIP/20SH/9tEh//XRIf/40CP/+M4i//jMI//5 yib/+MYl//nDJf/5wSb/+cAo//+7Mv/4uDD/9bMr//iqJP/5nRj/8ZYK/+iaBP/howL/56wK /+qvCf/tswf/8bgG//O7Bv/0vAf/87oI//O6Cf/0vAf/9LwH//S8B//0vAf/9LwH//S8B//0 vAf/9LwH//S8Bf/0vAX/9LwF//S8Bf/0vAX/9LwF//S8Bf/0vAX/8b0F//G9Bf/xvQX/8b0F //G9Bf/xvQX/8b0F//G9Bf/wvAb/8LwG//C8Bv/wvAb/8LwG//C8Bv/wvAb/8LwG//O7Bv/y ugX/8roF//K6Bf/xuQT/8bkE//G5BP/xuQT/7rcE/+63BP/utQT/7bQD/++zBf/vsQT/7rAF /+6wBf/srAT/66sD/+ypAv/rqAL/66YD/+qlAv/rowP/6qIC/+qiAP/uoAr/6ZwA/+uZCf/p mwD/5JYO/7NiB//5uQ//87kN//W9Ev/4xBn/+ssj//zRLP/71TL/+dg1//nZOP/72DT/+tcz //rUMf/50i3/+s8q//jLJ//5yiT/+cgj//rFIf//xRv//7kR/92fFv+lfDr///X3//X0///5 //v//f39///+///5+vz/+//7/////f/m0Lj/tIAb//+8Bf/5vBb/+L8a//jFHv/5yiT/+M0m //nOKf/6zSr/+8sp//XKGf/7xyP//8Un//i4Dv/5uQD/9LYJ/+muJP+lZwL/8dvQ//3z8f/+ /////P////n3+P///fr//vr3//z///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////f//86tgP+8hwP/87UC//m4Fv/usjD/+8VH//rHNv/0z03/+cpI ///GRv/nlhP//6of//yxGP/0vxf/7coY//rLHf/5zBv/9s0b//XOGf/1zhf/9s4W//nNFP/6 zBT/98kR//jIEP/3xRD/98AN//i8DP/3uAv/+LQJ//myCP/7rAn/9qcE//iiAf/9nAD//pQC //aXCf/vqBr/67sp//LBJ//zwif/9sMp//jGKf/6xSf/+cMl//fBIf/2wCD/9sAi//bAIP/1 vx//9r8e//i+Hv/3vRv/+L0b//i9Gf/3vRT/970U//O4Ev/2uRP/+7oY//etEP/0own//aUP //iwDv/4sxD/97YS//e6Ev/3vxT/98MX//jGF//3yBj/98wb//fMG//4zRz/984c//bPHP/3 0B3/9dAd//XQHf/4zx//980f//fLIP/5ySH/+cUh//jCIf/4wCH/+r8j//+7Kv/2tSX/8rEj //isI//8ohr/85YL/+mXA//moQX/5KkH/+esBv/rsQX/77YF//K6Bf/0vAf/87oI//O6Cf/z uwb/87sG//O7Bv/zuwb/87sG//O7Bv/zuwb/87sG//O7BP/zuwT/87sE//O7BP/zuwT/87sE //O7BP/zuwT/8LwE//C8BP/wvAT/8LwE//C8BP/wvAT/8LwE//C8BP/vuwX/77sF/++7Bf/v uwX/77sF/++7Bf/vuwX/77sF//K6Bf/yugX/8roF//G5BP/xuQT/8bkE//C4A//wuAP/7rcE /+22A//utQT/7bQD/+6yBP/usAP/7rAF/+6wBf/srAT/66sD/+ypAv/rqAL/66YD/+qlAv/r owP/6qIC/+qiAP/uoAr/6ZwA/+uZCf/pmwD/5JYO/7NiB//5uQ//87sO//W/FP/4xRz/+8wm //zSLv/61zX/+to5//jaOv/83Dv/+9s4//vaN//71TL/+tMu//rQLP/5zin/+cwo/+7JGf/6 xCT//8Ab//+8Ff+rcwb/5L+s///6///v/f3///v////+///3/P///P/////++P/Gp3n/yJQa //++Af/5vhr/+MEc//jHIv/4zSb/+tEr//rQLP/70Cz/+84r//bPHP/yxh///8su///EIf// vgz/8bAA///CHP/NiwD/onxV///66P/89fz//P7///v6/////vr/9vXw//7///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////L//6F3Lf/osRD/8rAA //a1G//xtzn/+cZH//TFO//1zk3//81M/+mcGv/9pR3/+acT//++Gv/wvg//78gT//vKFf/5 yxX/9swV//TOE//0zhP/9s0T//nMEf/7yxH/+MgO//jGDf/3ww3/974M//i7Cv/4tgj/+bMG //ixB//8qgj/+KYE//ehAP/8mwD//ZUC//WWCP/sqBn/6bso//LBJv/zwif/9sQn//jGKf/6 xSf/+cMj//fBIf/2wB//9sAi//bAIP/1vx//9r8e//i+Hv/3vRv/+L0b//i9Gf/1uxH/9r0U //S6Ef/3uhT/+7cW//eqDP/2oQj//6UO//iwDP/5sQ3/+LUO//i6Ef/4vhL/98IS//jFFP/5 yBb/+MsY//jLGP/3zRn/980Z//bNGf/2zxr/9s8a//bPGv/4zhr/98wb//jKHP/4yBz/+cQc //nCHf/5vx3/+r4f//+5I//0tB7/7rAd//euIf/+pBz/+JgO//CXB//rnQf/4aUG/+SpBf/p rwX/7rUE//G4Bv/zugj/87oJ//O6C//zuwb/87sG//O7Bv/zuwb/87sG//O7Bv/zuwb/87sG //O7BP/zuwT/87sE//O7BP/zuwT/87sE//O7BP/zuwT/8LwE//C8BP/wvAT/8LwE//C8BP/w vAT/8LwE//C8BP/vuwX/77sF/++7Bf/vuwX/77sF/++7Bf/vuwX/77sF//K6Bf/yugX/8bkE //G5BP/wuAP/8LgD//C4A//wuAP/7bYD/+22A//ttAP/7bQD/+6yBP/usAP/7a8E/+2vBP/s rAT/66sD/+ypAv/rqAL/66YD/+qlAv/rowP/6qIC/+qiAP/uoAr/6ZwA/+uZCf/pmwD/5JYO /7NiB//5uQ//9b0S//bAFv/6xx7/+88o//zVMP/82Tf/+9s7//rcPv/94UD//OA///vePP/8 2jr/+tc1//rUMf/50i//+tAs/+/OHf/uwCL//8Ib///BCP/Zlgf/r31I///5+//x/P////v/ //v9/P/4////+v3////78/+ogUD/4Kkb//2+AP/4wR7/+cUh//rLJf/50Cr/+tMu//vUL//8 0jD//NIw//TQIv/yySP//88w///HJf/+wBP/+LcD//++Bv//uwb/kl0N///nvf//+v3//v3/ //7///////j//fz3//7///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////9rK/5xoA//0tgn//rYJ//WzIf/8xkD/7r44//TFQ//6yUb//7w5/+iSC//8 phX//7kZ//G7EP/4xxX/9MEO//vKDv/4yw7/9cwO//TNDv/0zQ7/9cwO//jLDv/7yg7/+MYN //fFDP/4wgr/+b4K//i5Cf/4tQb/+LIF//iwBP/9qQj/+KQD//igAP/9mgD//JQB//OXCP/r qBn/6Lwo//LCJP/zwyX/9sQn//jGJ//6xiX/+cMj//fBIP/2wB//9sAi//bAIP/1vx//9r8e //i+Hv/3vRv/+L0b//i9Gf/zuxD/9b0S//W7Ev/3uhL/+7YT//epC//4nwX//6UM//mwC//5 sgz/+bUM//i5DP/5vQ//+cIQ//jFEv/5xxL/+MoV//fKFf/4yxb/9swW//fNF//2zhf/9c4X //XOF//3zRb/+cwX//jJF//5xxj/+MQY//rBGv/5vhr/+b4a//23Gf/ztBf/7rEY//SuG//9 phv//pwT//SXC//slwb/3qID/+GmBP/mrAP/7LME//C3Bv/zugn/9LsM//S6Dv/yugX/8roF //K6Bf/yugX/8roF//K6Bf/yugX/8roF//K6A//yugP/8roD//K6A//yugP/8roD//K6A//y ugP/77sD/++7A//vuwP/77sD/++7A//vuwP/77sD/++7A//uugT/7roE/+66BP/uugT/7roE /+66BP/uugT/7roE//G5BP/xuQT/8bkE//C4A//wuAP/8LgD/++3Av/vtwL/7bYD/+y1Av/t tAP/7LMC/+2xA//usAP/7a8E/+2vBP/srAT/66sD/+ypAv/rqAL/66YD/+qlAv/rowP/6qIC /+qiAP/uoAr/6ZwA/+uZCf/pmwD/5JYO/7NiB//5uQ//9L4U//bBGf/5ySH/+9Ar//3WM//8 2jr/+909//reP//95UX//ORE//viQP/83j7/+9s6//rZNv/51jT/+tQz//rWKv/rwR3/+MQZ //e3AP/7tRX/oWYI//3ix//9/f////r///f89f/1////+fj////48f+ZaRf/7rYb//e8AP/5 xCD/+cgj//nOKf/60y7/+dYw//rXM//81jP//NQ0//HOKv/40Sz//tMu//XBHf/7whn//8UV //S0AP//wgT/0pIW/8WWUv//+vH//vv///z///////T////6///+//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////0Z9u/8KKD//1sQb//7UZ//m1LP/8 yTj/78Q3//bITv/9wTz/7qIb//uhFf/xogf//8cc/+e6Cf/+yxr//b0T//vKC//6ywv/98wL //TNDP/0zQz/98wM//rKDv/7yg7/+McL//jFCv/4wgr/+L0H//e5Bv/3tAX/+LAD//evA//+ qAf/+qQD//igAP/9mgD//JQB//OXCP/pqBj/5rwo//LCJP/zwyX/9sQl//jGJf/6xiX/+cMi //fBIP/2wR3/9sAi//bAIP/1vx//9r8e//i+Hv/3vRv/+L0b//i9Gf/xuQz/9b0S//a8Ev/4 uRL//LQQ//amB//5ngX//6QN//ivCP/5sAn/+LQJ//i5Cv/5vQ3/+cIP//nFEf/5xxD/+MoU //jKFP/3yxT/98sU//bMFf/1zRX/9s4W//bOFv/4zBP/+MwT//jKFP/5xhP/+MMV//nBFv/5 vxb/+r0X//m0D//0thP/7rQV//KsGP/9phn//6AX//mZDv/tlAT/3KAC/9+kAv/lqwL/67EF /++2Bf/yuQj/9LsM//S6Dv/yugX/8roF//K6Bf/yugX/8roF//K6Bf/yugX/8roF//K6A//y ugP/8roD//K6A//yugP/8roD//K6A//yugP/77sD/++7A//vuwP/77sD/++7A//vuwP/77sD /++7A//uugT/7roE/+66BP/uugT/7roE/+66BP/uugT/7roE//G5BP/xuQT/8LgD//C4A//w uAP/77cC/++3Av/vtwL/7LUC/+y1Av/ttAP/7LMC/+2xA//trwL/7a8E/+yuA//srAT/66sD /+ypAv/rqAL/66YD/+qlAv/rowP/6qIC/+qiAP/uoAr/6ZwA/+uZCf/pmwD/5JYO/7NiB//5 uQ//9MAV//bDGv/5yiT//NEs//3XNv/92zv//N5A//veQv/86En//eZI//zkRP/74UL//N4+ //vbOv/72Tn/+tg4///UM//vxxr/9MkY//G4Cf//uhX/yIwI/8OgZv//+v////v///f/7//y //v//fz////v6f+ZYgf/9LkX//W7Av/6xiT/+ssn//rRK//61S//+tk0//vaNf/72Db//dc2 //XQN//81jX//NYr/+/FGf/5yR//+8Ud//K2Bv/1twL//7YV/6JtDf//7tr///z///f9/f/9 //L////6//78//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////mmYb/++zLv/+tRD/+aoa//25NP/ywCn//tRA//fKU//6ti//7ZsT//uhD///tRT/5LUF //bPGv/zvhD//8Ac//rKCP/5ygj/9swI//TMCv/0zAr/9ssL//nKC//6yQv/98YK//fECf/4 wAn/+L0H//m4Bv/3tAX/+LAD//mvAv//pwf/+qQD//ieAP/8mQD//JQB//GWB//pqBj/5Lwn //LCJP/zwyP/9sQl//jGJf/6xiT/+cMi//fCHv/2wR3/9sAi//bAIP/1vx//9r8e//i+Hv/3 vRv/+L0b//i9Gf/vugz/9b0Q//a8Ev/4uhH//LQQ//ilB//6nQL//6MN//qvBv/5sQf/+LQJ //q4Cv/5vgz/+cAO//jEDv/5xxD/98kR//fJEf/4yhL/98sS//bNE//2zRP/9c0T//XNE//4 zBH/+MsQ//nJEf/5xhP/+MMT//nBFP/4vhT/+r0V//myDP/0txH/77UV/++sFf/8pRj//6Ma //ybEP/tkAT/258B/96jAf/kqgH/6rAE/++2Bf/yuQr/87oL//S6Dv/yugX/8roF//K6Bf/y ugX/8roF//K6Bf/yugX/8roF//K6A//yugP/8roD//K6A//yugP/8roD//K6A//yugP/77sD /++7A//vuwP/77sD/++7A//vuwP/77sD/++7A//uugT/7roE/+66BP/uugT/7roE/+66BP/u ugT/7roE//G5BP/xuQT/8LgD//C4A//vtwL/77cC/++3Av/vtwL/7LUC/+y1Av/sswL/7LMC /+2xA//trwL/7K4D/+yuA//srAT/66sD/+ypAv/rqAL/66YD/+qlAv/rowP/6qIC/+qiAP/u oAr/6ZwA/+uZCf/pmwD/5JYO/7NiB//5uQ//9cAY//fEG//6yyX//dIu//7YN//93T3/+99A //rgQ//96Uz//elK//3mSP/740P//OBB//vdPf/72zr/+9k5///NNP/zzBn/9dEb//S/G//1 sQ7/+r0k/41mF///9f////r9//n/6//u//b//v3////j3P+eZAP/9rkT//K6Bf/7xyX/+8wo //rQLP/51jD/+9o1//zbOP/82Tf//tg3//zWRf/61jf//Ngq//XQH//7zyb/7LgW//nAGf/x uAn/+60A/7N5C//hxqv///3///L4+P/7//D/9/jy///8//////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////z/+P/3 //j///j////3/////+z/7f////P2////3cn/sWgA//i2JP/qsRn/7bkn//LAO//7yEv//8tK ///HPP/4nAn/+aEL//eqDP/3tA7/+LwO//jBDP/3wwv/98QJ//fHDf/3xw3/+MYN//fFDP/4 xAz/+sQM//nDC//6wgv/+L0L//e8Cv/3ugr/9rcI//ezCP/3sAb/964H//atBv/0pQP//KUI //2gB//3lAL/75MC/+6fDv/trxz/67gh//LCIv/zwyH/9sQj//jHJP/6xiT/+cQg//fCHv/2 wRv/9cAc//XAHP/0vxn/9b4Z//a9Fv/2vRb/970U//e9FP/7vBX/9LsS//O9E//1tA7/9aMC //qdAP/+pAb/+aUF//ixB//5sgj/+LQH//e4Cf/4uwr/+b4K//nBDP/5wg3/+skN//rJDf/6 yQ3/+skN//vKDv/7yg7//MsP//zLD//5yRH/+ckR//nHEv/4xhH/+MMR//jAEf/4wBH/+L8Q //q3EP/5tA7/+rEN//mtDP/6pw3/+KMM//ieCv/4nAn/85sG/+2eBf/nowT/4agB/+KuAv/o swP/8LcF//a5CP/xuAb/8bgG//G4Bv/xuAb/8bgG//G4Bv/xuAb/8bgG//K6Bf/yugX/8roF //K6Bf/yugX/8roF//K6Bf/yugX/77sH/++7B//vuwf/77sH/++7B//vuwf/77sH/++7B//y uQf/8rkH//K5B//xuAb/8bgG//C3Bf/wtwX/8LcF/+q3AP/yvQ3/8rkU/+20D//1vAv/6rIA ///HDv/orQD/7bIA//G2AP/ytgD/6qwA/+ChAP/dnAL/5KIO/+ypGv/yqjT/8a0e/+mmAP/k nwD/6aIM/+ygFv/pnwz/6qAA/+afBf/bkgD/6ZgT/+CQAP/towD/6pgY/6hVAP/4shT/9rkR //vAGv//yyX//tEt//rUMf/22Tf/9t4+//fjQv/550n//OhL//3pTP//6U3//+dM//7lSv/8 4kf/+uBF//7RUP//1iT//tEW//zFKv/rtwv/6b4A/7WDBv/4t7H/8v/u//f////7/+7///r5 /+zPvf+lfgD/9bwX//+9HP/4ySP/+c0m//zRLP/+1zL//9w6///fPv/94UD//OA///zaOv/7 2Tn/+9U0//vRLf/5zCj/+Mci//jFHv/3whr/5rcR//isAP+3biH///j//+3////v+PX///n/ //v77/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////7/+v/5//j///n////2/////+3/7v////n5///UrYz/zYQA /++tGf/yuSH/7rop//TCPf/8xkj//81I/+2zJP/4nQj/96IJ//isC//3tA3/+LwO//fADf/4 wgr/+MII//fHDf/4xg3/98UM//jEDP/4xAz/+cML//rCC//6wgv/+L0L//e8Cv/3ugr/+LYI //ezCP/3sAb/9q0G//esBf/zpAL/+6QH//2eBv/3lAL/8JQD/++gD//trxz/67gh//LCIv/z wyH/9sQj//jHJP/6xiT/+cQg//fCHv/2wRv/9cAc//XAHP/0vxn/9b4Z//a9Fv/2vRb/970U //e9FP/7vBX/9LsS//O9E//1tA7/9aMC//qdAP/9owX/+aUF//ixB//5sgj/+LQH//m3Cf/4 uwr/+b4K//jAC//5wQz/+cgM//nIDP/6yQ3/+skN//rJDf/7yg7/+8oO//vKDv/5yRH/+ccQ //nHEP/4xBD/98IQ//jBD//4vxD/+L8Q//q3Dv/5tA7/+rEN//mtDP/6pwv/+KMM//ieCv/4 nAn/9JoG/+6dBf/noQP/4qcB/+KuAv/oswP/8LcG//a5CP/xuAb/8bgG//G4Bv/xuAb/8bgG //G4Bv/xuAb/8bgG//K6Bf/yugX/8roF//K6Bf/yugX/8roF//K6Bf/yugX/77sH/++7B//v uwf/77sH/++7B//vuwf/77sH/++7B//yuQf/8rkH//G4Bv/xuAb/8bgG//C3Bf/wtwX/8LcF /+u3Af/ptAT/87oR//C4Df/ttAP/6bAA//S4DP//xiP//rVE/+CXJv++dQT/sWgA/7pxAP/G fQz/x34N/8J5CP+zbQD/tG0A/9eNEP/3sCD/8a0C/+iiAP/rowP/6p4U/+afBf/hmQD/7Z0U /+aWAP/qnwD/5ZMT/7FeAP/upxH/97oS//zBG///zCb//9Iu//vVMv/32jj/998///nlRP/6 6Er/++lL//7qTf//6U3//+lN//7lSv/74kf/++FG//nSSf/92CX//9Yg///KMv/3whr/670A /9OeFP/EgmL/+//v//P4///8//T///f7/+vMuv+shAD/+L4V//+8Gv/4ySP/+c0m//zTLf// 2DX//947///fPv/94UD/++FC//zcO//82jr/+tc1//nSL//5zin/+Mkj//nGH//3xB3/6bkN //+5CP+0bRX/9uDi/+r8/P/5////+/P/////+P////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////v89//5//j//vr/ ///2/////+//8f/////4+f+jdD7/7aQX/+qoFP/6wSn/77wr//jDP///xUf//8dA/9+cDf/5 oAj/+KUJ//isCf/4tQ7/97sL//e/Cv/4wAn/+MAH//fFDP/3xQz/98ML//fDC//4wgr/+cEK //nBCv/5wQr/97wK//e6Cf/3uAn/97UH//ayB//3rwX/+K0G//esBf/1owL/+6IG//ydBf/2 kwH/8ZUE/++jEf/tsR3/6rgh//LCIv/zwyH/9sQj//jHJP/6xiT/+cQg//fCHv/2wRv/9cAc //XAHP/0vxn/9b4Z//a9Fv/2vRb/970U//e9FP/6uxT/87oR//K8Ev/1tA7/9KIB//qdAP/9 owX/+aUF//iwBv/4sQf/97MG//i2CP/4uQn/+bwJ//q/C//5wQz/+McL//jHC//4xwv/+cgM //nIDP/6yQ3/+skN//rJDf/5xw7/+ccO//nFD//4xBD/+cIP//i/Dv/3vg3/974P//q3Dv/5 tQz/+rEM//mtDP/6pwv/+KMK//ieCf/4nAn/9JgH/++bBf/onwL/4aYC/+KsAf/nsgT/77YF //S5B//xuAb/8bgG//G4Bv/xuAb/8bgG//G4Bv/xuAb/8bgG//K6Bf/yugX/8roF//K6Bf/y ugX/8roF//K6Bf/yugX/77sH/++7B//vuwf/77sH/++7B//vuwf/77sH/++7B//xuAb/8bgG //G4Bv/xuAb/8LcF//C3Bf/wtwX/77YE/+q0Cv/rtgj/+MEP/+myAP/wtwb//8Qe/9+gB//W lQX/p1sA/8F2A//imB//9aws//evJf/1rh7/9rAa//q1Gv/rqwv/6aQb/8R7Cv+1agD/2I8C /+2oA//ooQD/6aEA/+KbAf/mngD/7Z4N/+ucA//omwD/4pEO/8VzDf/glhH/97oS//zBG/// zCb//9Mv//3XNP/53Dr/+uJC//vnRv/66Er//OpM//3rTf//607//+lN//7nS//840j/+uFG //fZQ//83yv//9oq//3LOP/+yin/7rwA//a+I/+eWQ7///zh//Xx///8//r//vT9/+PCsf+3 jAL/+sAU//69F//3yyT/+c4p//3TL///2Tb//947//7gQP/+4kP/++FC//zePv/83Dv/+9o3 //rUMf/5zyv/+Msn//jHIv/3xx//78EM///BDv/FfhT/x6iM//X89P/5////+fX////+/f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////z7+f/5//b//fz////6///+//D/9f/////u4P+TWAj//bIj//GvGv/5 win/8b4t//zHQ///xkf/+LMo/+OXA//5ogX/96gG//euCf/2tgz/97sL//e+DP/5vgj/+L0H //XDCv/2wgr/9sIK//jCCv/4wAn/+MAJ//m+CP/5vgj/97oJ//e6Cf/2twj/97MG//ewBv/2 rgT/96wF//eqBP/2ogL/+qAE//uZAv/1kgD/8ZcF//GlE//ttB//6boi//LCIv/zwyH/9sQj //jHJP/6xiT/+cQg//fCHv/2wRv/9cAc//XAHP/0vxn/9b4Z//a9Fv/2vRb/970U//e9FP/6 uxT/87oR//K8Ev/0sw3/9KIB//mcAP/9owX/+KQE//muBf/4sAb/+bMG//i0B//4uQn/+LsI //m+Cv/6vwv/+MUK//jFCv/4xQr/+cYL//nGC//5xgv/+scM//rHDP/4xg3/+cUN//jEDP/5 wg3/+cAO//e+DP/5vQ3/+LwM//q4DP/5tQz/+rEM//mtCv/6pwn/+KMK//ieCf/4nQj/9pUG //GYBv/pngT/4qQB/+GrAf/msQP/7bUG//O3B//xuAb/8bgG//G4Bv/xuAb/8bgG//G4Bv/x uAb/8bgG//G5BP/xuQT/8bkE//G5BP/xuQT/8bkE//G5BP/xuQT/7roG/+66Bv/uugb/7roG /+66Bv/uugb/7roG/+66Bv/xuAb/8bgG//G4Bv/wtwX/8LcF/++2BP/vtgT/77YE/++3GP/p swj/8bsD/+awAP/4vhT/8bQb/8uJAP+ybwD/+7cW//u3FP/5tg3/97YG//W1AP/1tgD/97kA //q8AP/7vwn/87UI//SxHP/Yjx7/uWoO/9KDGv/1rhT/7KwA/9+YAP/nngP/6ZwC/+2fAf/p mwD/5JMO/9qKGf/Pgg7/9rkR//vAGv//zCb//9Qw//7YNf/73jz//ORE//3pSP/56Uv/++tN //7sTv//7U///+tO///oTP/85Un/++JH//vjQ//+5TP/+tox//THNv/9yy7/9MEG///KIP+z bQD/2sSf///5///8//v//PH//9izof/CkQT/+sEQ//vBF//4yyf/+s8q//vUL//92jj//98+ //7iQf/940T/++NF//3hQv/83j7//Nw7//rXNf/60y7/+c4p//jMJf/4ySP/9sYM//28DP/m oSL/mW0w////7P/7/////v3////9//////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////8///5//b/+v3////6///9 //L/+f/7/+/Utv+vZwD/+K4b//69Jf/0vST/8sIw//7JRf//w0H/6ZwO//WgB//4pgT/96oG //ewCP/2twr/97sL//i9C//4uwj/+LwG//XBCf/1wQn/9sAI//bACP/3vwj/+L0H//i9B//5 vQf/97gI//e4CP/3tQf/9rIF//evBf/3rAP/96oE//eoA//4oAH/+54D//qWAP/1kQD/8pgG //OpFv/utiH/6Lsi//LCIv/zwyH/9sQj//jHJP/6xiT/+cQg//fCHv/2wRv/9cAc//XAHP/0 vxn/9b4Z//a9Fv/2vRb/970U//e9FP/5uhP/8rkQ//K8Ev/0sw3/86EA//mcAP/8ogT/+KQE //itBP/5rgX/+bEF//mzBv/5uAj/+LoH//m8Cf/5vgr/+MII//jCCP/5wwn/+cMJ//nDCf/6 xAr/+sQK//rECv/4xQr/+MUK//nDC//4wgr/+MAL//m+DP/4vQv/+LsK//q4Cv/5tQr/+rEK //mtCf/6pwn/+KMI//ifB//4nQb/+JMH//KWBf/qnAT/46MD/+CqAv/lrwT/7LQF//C3CP/x uAb/8bgG//G4Bv/xuAb/8bgG//G4Bv/xuAb/8bgG//G5BP/xuQT/8bkE//G5BP/xuQT/8bkE //G5BP/xuQT/7roG/+66Bv/uugb/7roG/+66Bv/uugb/7roG/+66Bv/xuAb/8LcF//C3Bf/w twX/77YE/++2BP/vtgT/7rUD//S8H//hrAD/5K8A/++5Af/ythf/unsA/86LBv/joRf/9LYJ /++xBv/usAX/9rgN///DGv//wxz/+LkS/+ytBv/boQD/9bsA//u+C//4tSD/7qYw/8h7Ef+/ dQD/66MR/+GZCf/ongn/55sA/+yeAP/pmAj/5JQJ/+GUFP+7bAX/87YO//m+GP//yiT//9Iu //3XNP/73jz//ORE//7qSf/560z//OxO//3tT///7lD//+xP//7qTf/95kr/++RI//rkQf/8 5jr/9tk1//HJNP/7zTH//skX//u/D//qpQr/qIFI///4///4/ff//PT//82kkP/KlAD/+cEK //nFGv/4zSn/+tAs//zVMv/+2zn//+BA///jRP/85Eb/++RI//zkRP/84kP//N4+//zaOv/7 1TL/+9Et//nOKf/5zSb/+McJ//W4D//6uCT/lV4A///tz//7/v//+f/////7//////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////8///5//T/+f/////8///9//T/+/73/82oe//digD/8acS///CKP/uuR//98c3 ///JRf/7tjT/55ID//+kBv/3qQH/+K0E//ayBf/3uAn/97oJ//i7Cv/4ugf/97kG//bACP/1 vwf/9b8H//a+B//3vAb/97wG//i8Bv/4vAb/9rcH//i3B//3swb/97EE//auBP/3qgL/96gD //anAv/5nwH/+psB//iUAP/0kAD/85kH//OrGP/uuCL/5r0j//LCIv/zwyH/9sQj//jHJP/6 xiT/+cQg//fCHv/2wRv/9cAc//XAHP/0vxn/9b4Z//a9Fv/2vRb/970U//e9FP/5uhP/8rkQ //G7Ef/zsgz/86EA//ibAP/8ogT/+KQE//irA//4rQT/+LAE//mzBv/5tgf/+rkH//m7CP/5 vAn/98EH//fBB//3wQf/+MII//jCCP/5wwn/+cMJ//nDCf/5wwf/+cMJ//jCCP/4wAn/+b4I //i9Cf/4uwr/97oJ//q4Cv/5tQj/+rII//mtCf/6qAf/+KQG//ifBf/4nQb/+JEI//OUBv/q mgP/46EE/+GoAf/krgT/67MG/++2B//xuAb/8bgG//G4Bv/xuAb/8bgG//G4Bv/xuAb/8bgG //C4A//wuAP/8LgD//C4A//wuAP/8LgD//C4A//wuAP/7bkF/+25Bf/tuQX/7bkF/+25Bf/t uQX/7bkF/+25Bf/wtwX/8LcF//C3Bf/vtgT/77YE/+61A//utQP/7rUD//C4Gf/qtQP/6rUA //C4Cf/cng3/tnUA/+imHP//wCP/9r4J//3EEv//yBz//sQb//e8Gv/1uR3//L8o///IMv// 0SX/6q0F/+uvAf/7wAT/77MA/+KhAP/Thxf/tWIe/+CWE//onBL/6p4A/+qcAP/olg//4JIA /92SAf+tXQD/77IK//W6FP/8xyH//dAs//vVMv/53Dr/++ND//3pSP/67E3/++1O//7uUP// 71H//+5Q///rTv/86Ev/+uZJ//jeQf/64T7/99s5//bUNf/80jL//9Eo//G1B///yx7/mmMQ ///t5P/1++3///v//8aZgv/OlQD/+cEI//fJHv/4zir/+NEu//zWNf/+3Dz//+FB//7kR//9 5En//OVJ//7nSf/95UX/++JA//vePP/62Tb/+tQx//rQLP/50Cr/+MUK//S9HP/5uBT/wX0A /+C3i//+/v//9f/////5+v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////7///4//P/9//9///9///8/ff////1 /6V4P///pgf/9KkS//y7H//uuR///M49//3HQ//roh//8pgG//+cAP/4rAH/+a4D//e0Bf/3 uAj/97oJ//e6Cf/3uQb/+LcF//W/B//0vgb/9b0G//e8Bv/2uwX/97sF//e7Bf/3uQT/+LcH //e2Bv/3swb/+LAE//itBP/3qgL/9qcC//elAf/6nQD/+5kA//eSAP/zjwD/9JoI//WtGv/w uiT/5r0j//LCIv/zwyH/9sQj//jHJP/6xiT/+cQg//fCHv/2wRv/9cAc//XAHP/0vxn/9b4Z //a9Fv/2vRb/970U//e9FP/5uhP/8bgP//G7Ef/zsgz/86EA//ibAP/7oQP/96MD//irA//5 rAT/+a4D//mxBf/4tQb/+bgG//i6B//5uwj/978G//e/Bv/3vwb/+MAH//jAB//4wAf/+cEI //nBCP/5wwf/+MIG//jAB//5vwb/+L0H//i7CP/3ugf/+LoH//q5Cf/5tQj/+rII//muB//6 qAb/+KQG//ifBf/4nQT/+48I//STBv/qmAT/5J8D/+GoA//krgT/6LIH/+21CP/xuAb/8bgG //G4Bv/xuAb/8bgG//G4Bv/xuAb/8bgG//C4A//wuAP/8LgD//C4A//wuAP/8LgD//C4A//w uAP/7bkF/+25Bf/tuQX/7bkF/+25Bf/tuQX/7bkF/+25Bf/wtwX/8LcF/++2BP/vtgT/77YE /+61A//utQP/7rUD/+qzDv/yvgb/8bwA/+euB//CggD/350j//q6Jf/zuAT/+MYN//fFDP/4 xg//+sgT//zJGP/6xhj/9MAU/++7D//0uBr//8gs//y/Gf/wtgD/+8IA//q9A//inRH/1Ycj /9KFD//fkRP/7aEA/+eZAP/nlBT/3ZAA/9uTAP+zYgf/664G//K3Ef/4wx3/+s0p//nTMP/3 2jj/+uJC//zoR//67k7//O5P//7wUf//71H//+9R//7sTv/96Uz/++dK//zcSf/83UX/+t07 //naMf/40y3//9Au//O6E///yRj/t3cL/92+ov/4/+n///3//8aZfP/SlgD/+sMH//TKIP/4 ziz/+dIv//vYNv//3T7//+NE///lSP/95kr/++ZL//3pSv/+50n//ORE//zgP//72zj/+tcz //rTLv/70S3//MgS//W/Kf/1swX/86UF/7F8Rv/+////8v/////89/////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///6///3//H/+P/8//z5///8/ff////2/4hYGP//sgn/+7AX//KxFf/vvCL//9JB//vFQf/c lA7//qMO//uRAP/4rAD/968C//e0Bf/3uAj/97oJ//e6Cf/4twX/+LUE//S+Bv/1vQb/9b0G //a7Bf/3uwX/9roE//e5BP/3uQT/97YG//i1Bv/4sgX/968D//esA//2qQH/9qcC//elAf/6 nQD/+pgA//aRAP/zjwD/9JoI//WtGv/uuyT/5b4j//LCIv/zwyH/9sQj//jHJP/6xiT/+cQg //fCHv/2wRv/9cAc//XAHP/0vxn/9b4Z//a9Fv/2vRb/970U//e9FP/5uhP/8bgP//G7Ef/z sgz/8qAA//ibAP/7oQP/96MD//iqAv/4qwP/+a4D//mxBf/6tAb/+bgG//i6B//5uwj/9r4F //a+Bf/3vwb/978G//jAB//4wAf/+MAH//jAB//4wgb/+cIG//jBBf/5vwb/+b0H//i8Bv/4 ugf/97kG//q5Cf/5tQj/+rII//muB//6qAb/+KQE//ifA//4nQT//I0H//WRB//smAT/5J8D /+CnAv/jrQP/6LIH/+21CP/xuAb/8bgG//G4Bv/xuAb/8bgG//G4Bv/xuAb/8bgG//C4A//w uAP/8LgD//C4A//wuAP/8LgD//C4A//wuAP/7bkF/+25Bf/tuQX/7bkF/+25Bf/tuQX/7bkF /+25Bf/wtwX/77YE/++2BP/vtgT/7rUD/+61A//utQP/7bQC/+64Df/otQD/57EA/+WrC/+t awD/8K42//i5HP//xwL/+MYn//jGJf/4xyT/98Yh//bGHP/1xRn/9cYY//XGFv//wy3//MEf ///DGv/+wB//9bMh//WyG//7vQr//cMA/79xBP/ThA3/7aEA/+SWAP/nkxf/3pIA/96YAP/B cBX/6awE/++0Dv/2wRv/+Msn//fRLv/22Tf/+OBA//vnRv/67k7/++9P//7wUf//8VL//+9R ///tT//86kz/++dK///gVP//3Er/+t05//XaKf/xzyX/98su//zGJv/yuQj/3pge/7aUb//8 /+j///3//8iaef/WlgD//cMI//PKIv/30C3/+tIy//vXOP/+3j7//+NE//7mSP/95kr/++ZL //7qTf/96Ur//eVF//3hQP/83Dv/+9g0//rVL//50i3//8wa//G9LP/1tAD//7oO/5peIv/1 9vr/8f/7///99P////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////T/9///9v////r4//T/7v/y////58mv/7p0Av/7 qQX/9LUS/++2If/0vjf//8lD//GiEv/0mwH/9Z0A//upCP/5rgf/+a4H//qvBv/5sQf/+rQH //u1CP/6twj/+rcI//m4Bv/5uAb/+bgG//i3Bf/4twX/+LcF//e2BP/3tgT/+LAE//iwBP/5 rgX/+asD//mnA//5pQT/+qQD//qiAv/1nQD//JkA//uSAv/xkgT/7aIT/++3JP/vwCr/7rwn //fCJP/3wiT/98Mi//bCIf/2wiD/9cEd//XBHf/1wR3/9cEW//XBFv/0wBX/9b8V//a9FP/2 vRT/970U//e9FP/7uhT/970U//G4D//5thD/8ZoA//2cAP/5nAD/+KEC//qoBP/6qAT/+asD //muBf/5sQX/+bMG//i1Bv/4twf/97wI//e8CP/3vAb/97wG//i+Bf/4vgP/+b8E//m/BP/5 vwb/+L0H//m9B//4uwj/+LoH//m4CP/5uAj/+bUI//a0Bv/2sgX/97AG//auBP/3rAX/96gF //imBP/3pQP/+JsA//qYAf/4lQP/7poE/+KhBf/eqAf/5KsG/+uqBP/vtgf/77YH/++2B//w twj/8LcI//C3CP/xuAn/8bgJ/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/vtgT/8LcF //C3Bf/wtwX/8LcF//C3Bf/wtwX/8LcF//C3Bf/vtgT/7rUD/+61A//utQP/7bQC/+20Av/t tAL/7bQC/+WzAP/qsA7/7bMJ/8yFEf/blhf/9L0A//nAGf/8xx//+8gh//rLI//5zif/+dAo //nQKv/4zSn/+ckn//nHJv/5ySH/+scg//rFH//4whr/+b8W//m8FP/4uhH/97kQ//KuAf+3 Zwj/zn0S/+efAP/jmAD/3Y4A/+qdAf/UggD/wXIn//O5AP/9ywj/+8k2//fPMf/x0TD/+d1L //njN//65kX/++lH//7sTP//8E////FS///xUv/871H/++5Q//vhRv/94ET//98////aO//+ 1DD/+8wo//nGH//2wRn/+rQA/6JlDP//8vz//vz//7SeZf/amgX/+LUE//DGJP/40S7/+tQx //zbOP/+4T///uZG//3rS//67E3/+e1N//7qU//96lD//udM//3jSP/930P//do+//zYOv/9 1zj/9Mgn/+3QHf/vvBX//7IQ/72BAP/o3af/+fz////59/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////f/+v// 9/////v2//H/7f/2////1bKS/8iDCv/9rgv/8rQT//G4I//3vzb//8M9//GgEP/2nAD/9p4A //mnBv/5rAb/+a4H//qvBv/5sQf/+bMG//q0B//5tgf/+rcI//m4Bv/5uAb/+LcF//i3Bf/4 twX/97YE//e2BP/3tgT/+LAE//muA//5rAT/+asD//mnA//5pQT/+aMC//qiAv/1nQD/+5gA //uSAv/ykgf/7KQU/+64JP/vwCr/7rwl//fCJP/3wiT/98Mi//bCIf/2wiD/9cEd//XBHf/1 whv/9cEW//XBFv/0wBX/9b8V//a9FP/2vRT/970U//e9FP/7uhT/9rwT//C3Dv/5thD/8ZoA //2cAP/5nAD/+KEC//mnA//6qAT/+asD//msBP/4sAT/+bMG//i1Bv/4tQb/97oH//e6B//4 uwj/+LwG//i8BP/5vQX/+b0D//m9A//4vgX/+b0H//i8Bv/4ugf/+LoH//m4CP/5tgf/+bUI //ayBf/2sgX/97AG//auBP/3qgT/96gF//imBP/3pQP/9pwA//qYAf/4lQP/75kE/+OhBf/e qAf/5KsG/+qrBP/vtgf/77YH/++2B//vtgf/8LcI//C3CP/xuAn/8bgJ/++2BP/vtgT/77YE /++2BP/vtgT/77YE/++2BP/vtgT/8LcF//C3Bf/wtwX/8LcF//C3Bf/wtwX/8LcF//C3Bf/u tQP/7rUD/+61A//utQP/7bQC/+20Av/ttAL/7LMB/+a0AP/rsQ//7bMJ/8V+Cv/inR7/9b4B //i/GP/7xh7/+8gh//rLI//5zif/+NIp//jRK//5zyv/+cwp//nJKf/6yyX/+skk//rHIP/5 xBz/+sEa//i+Ff/5vBT/+LsS//CsCf/yqiD/tGcA/9yPDf/ckQD/7Z8J/9iIAP/pmAj/tGYU //y/D//4wgb/+8gx//vRMf/10zP/+dtH//njOP/65kX//OhH//7sTP/+707///BS//7wUf/9 71H/++5Q//ziR//94ET//98///7aO//+1DD//M0p//nGH//3whr//LUB/7N0E//11tT///v/ /7egav/TlQT//74N//HHJf/40S7/+tQx//zbOP/+4T///uZG//3rS//67E3/+e1N//zrU//9 6lD//udM//zjSP/930P//dw///3ZO//+2Dn/+s4v/+7PHP/1whv//7UT/8+TAP/Ds3f//f3/ ///8+/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////j/+///+P////z2/+/97P/8////upFj/92XE//+sBL/8LIR //W8J//5wDX//rox//GcC//5nAH/+aEB//ekBv/4qwX/+awG//muBf/6rwb/+bEF//mzBv/6 tAb/+7UH//m2Bf/5tgX/+LUE//i1BP/3tAP/97QD//e0A//3tAP/+a4D//muA//5rAT/+KoC //mmAv/6pAP/+qIC//mhAf/2nAD/+5gA//mTAv/xlgn/66cW/+y5Iv/uvyf/77wj//fDIv/3 wyL/98Mi//bCIP/2wh7/9cEd//XCG//1whv/9cEW//XBFv/0wBX/9b8V//a9FP/2vRT/970U //e9FP/6uRP/9rwT//C3Dv/5thD/8ZoA//ybAP/5nAD/96AB//mmAv/5pwP/+KoC//msBP/5 rgP/+bEF//mzBf/4tQb/97gI//e4CP/3uQb/+LoF//i6Bf/5uwT/+bsE//m8Av/4vAT/+LwG //i6Bf/3uQb/+bgG//m2B//4tQb/+LQH//ayBf/3sQT/968F//itBP/3qgT/9qcE//elA//4 pAP/9pwA//qYAf/5lQP/8ZkE/+WgBf/fqAf/5KsG/+qrBP/utQb/7rUG/++2B//vtgf/8LcI //C3CP/wtwj/8LcI/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/v tgT/77YE/++2BP/vtgT/77YE/++2BP/utQT/7rUE/+61BP/ttAP/7bQD/+yzAv/sswL/7LMC /+e1AP/sshD/7LII/7x1Af/rpif/9b4B//e+F//6xR3/+skk//vMJv/50Cj/+dIs//nULv/5 0i3/+c8t//nNLP/6zyr/+s0p//rLJf/5ySH/+sUf//jCGv/5wBn/+L8W//u6Hv/1uQD/5Z8Z /6paAP/soRD/25AA/+uZG//mlgP/rV4C//e2FP/2vQv//Mcr//7SMf/41DX/+ttD//riOP/5 5UT/++dG//7qS///7k7//+9R///vUf/87lD/++1P//viR//84kX//uBA///bPP//1TH/+84q //jIIP/2wxr//LkI/82OHf/Kpo7///r//8Cpd//KkAD//8gW//THJv/40S7/+tQx//zbOP/+ 4T///uZG//3rS//67E3/+e1N//3sVP/+61H//ehN//3kSf/94ET//dw///zaO//82Dn//9Q3 //HRHP/6xx7//7gX/+eqEf+afjT///v8///++/////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////j//v//+v////30 //L+8v///f3/pnQ1//OoGf/5rhT/7rIT//i/Kv/7wDT/9q8j//CaBf/7nQD/+6MD//SkBf/4 qQT/96oE//irA//4rQT/+q8E//mxBf/5swX/+bMF//mzBf/5swX/+bMF//mzBf/4sgT/+LIE //exA//3sQP/+a4D//mtAv/5qwP/+agB//mmAv/6ogL/+qAB//mfAP/2nAD/+ZcA//iTA//x mgz/7asZ/+u5Iv/tvyT/77wi//fDIv/3wyL/98Mh//bCHv/2wh7/9cIb//XCG//1whn/9cEW //XBFv/0wBX/9b8V//a9FP/2vRT/970U//e9FP/6uRP/9rwT//C3Dv/4tQ//8JkA//ybAP/4 mwD/96AB//ulAv/5pgL/+agB//mrA//5rgP/+LAE//iyBP/5swX/+LcH//i3B//4twf/+bgG //m4BP/5uAT/+roD//q6A//3uwP/97kE//e5BP/4twX/+LUE//e0Bf/5swX/+bMG//iyBf/3 sQT/968F//esA//4qQT/+KYE//ikA//5owL/9Z0A//qYAf/6lAP/85cE/+ifBf/hpwf/5KsG /+msBP/utQb/7rUG/+61Bv/vtgf/77YH/++2B//wtwj/8LcI/++2BP/vtgT/77YE/++2BP/v tgT/77YE/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/utQT/7rUE /+20A//ttAP/7LMC/+yzAv/sswL/7LMC/+i2AP/tsxH/7LII/7ZvAP/xrC3/9r8C//a9Fv/5 xBz/+skk//vMJv/60Sv/+NUv//nYMf/51jL/+tQx//rSMv/71C//+tMu//rRK//6zSn/+ssl //jIIP/5xh//+cQe//vCG//uuAD//8Aj/8+EH/+3agD/76MP/+qaDf/biQL/t2gB/9iRA//8 vxn//8om//zPLP/50zT//dw///zfOf/65EP//OZF//3pSv//7E3//+5Q//7uUP/87E//+uxO //zjSP/940b//+FB///dPf/+1zL/+84q//jJIf/3xBv//LoM/+SkHv+jeEP///n7/82yh//F jQL//8cS//fHJ//40S7/+tQx//zbOP/+4T///uZG//3rS//67E3/+e1N//3uVf/97VL//epO //3mSv/84kX//N5A//3bPP/92Tr//tU9//nVH//2xhr//rwd//e7HP+PZAj///Ln/////f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////j8////+//////z//j/+v//9vP/oGYU//6xE//zrBb/7rQV//rBLP/7 vjD/8KUW//SZAv/8mwD//KQE//OlB//3qAP/96gD//iqAv/4qwP/+K0C//muA//4sAP/+bEE //uwBf/7sAX/+q8E//qvBP/6rwT/+a4D//muA//5rgP/+a0C//isAf/4qgL/+aYA//qkAf/5 oQH/+Z8A//qeAP/4mwD/95UA//WUBf/xnw//7LAa/+m7IP/sviL/8bwg//fDIf/3wyH/98Mf //bCHv/2wxz/9cIZ//XCGf/1whn/9cEW//XBFv/0wBX/9b8V//a9FP/2vRT/970U//e9FP/6 uRP/9bsS/++2Df/4tQ//8JkA//ybAP/4mwD/9p8A//qkAf/6pAH/+aYA//qpAv/5rQL/+a4D //iwA//4sgT/97MG//ezBv/4tQb/+LUG//i1BP/5tgP/+bYD//m2A//2uAH/9rgD//e2Av/3 tgT/97QD//iyBP/3sQP/+LAE//exBP/3rwP/+K0E//irA//5pwP/+aUE//mjAv/5owL/9J0A //qYAf/8kwP/9pYE/+udBf/kpgf/5KsG/+etBP/ttAX/7bQF/+61Bv/utQb/77YH/++2B//v tgf/77YH/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/vtgT/7rUD/+61A//utQP/7rUD /+61A//utQP/7rUD/+61A//ttAX/7bQF/+20Bf/sswT/7LME/+yzBP/rsgP/67ID/+i2AP/t sxH/7LII/7ZvAP/xrC3/9r8C//a9Fv/5xBz/+8on//rNKf/60y7/+dgx//rbNf/72zj/+to3 //rZNv/82zb//Nk1//zWM//71C//+tEr//rNKf/6yyX/+cok//TBDv/zvwv/9L0L//+9OP+p WwD/3ZEI/96UAP/biBD/z34I/7JmAP//vin//8se//nKJP/6zzL//9w6//zcOf/64kL/++VE //7nSf//60z//+1P///tT//7607/+upN//zlSf/95Uf//uJB///dPf/92DL/+9Ar//nKIv/2 xhz/+rwR//OzFf+VYw7///Lp/9m8mv/BjQb//MAK//vGKP/40S7/+tQx//zbOP/+4T///uZG //3rS//67E3/+e1N//3wVv/97lP//utP//7nS//940b//d9B//3dPf/92zv/+dE8///ZIf/y wxX/+MEg//y/F/+nbQD//NrB//7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////z7////9/r////x//n////7 4t7/q2cE//+zCP/yqxv/8bcY//rBKv/6vC3/65wL//iZAP/7mQD/+6MD//SnC//3pQH/+KYC //epAf/4qgL/+KwB//itAv/5rwL/968C//uvBP/6rgP/+q4D//quA//5rQL/+a0C//mtAv/5 rQL/+asB//iqAP/5qAH/+KUA//qiAP/5nwD/+p4A//mdAP/5mQT/9pMB//SVBf/yoxL/67Qc /+i8H//rvR//8rwe//fDIf/3wx//98Mf//bDHP/2wxr/9cIZ//XCF//1whf/9cEW//XBFv/0 wBX/9b8V//a9FP/2vRT/970U//e9FP/5uBL/9bsS/++2Df/3tA7/75gA//uaAP/3mgD/9p8A //qiAP/5owD/+aYA//moAf/5qwH/+a0C//mvAv/4sAP/+LEH//iyBf/4sgX/+bMF//mzBf/6 tAT/+rUC//q1Av/3twD/97YC//a1Af/2swL/97EB//exA//3rwL/968D//iwBP/5rgP/+awE //iqAv/5pwP/+KQD//mjAv/5oQH/9J0A//qYAf//kgP/+ZQE/+2cBf/lpQf/5KsG/+etBP/t tAX/7bQF/+20Bf/utQb/7rUG/++2B//vtgf/77YH/++2BP/vtgT/77YE/++2BP/vtgT/77YE /++2BP/vtgT/7rUD/+61A//utQP/7rUD/+61A//utQP/7rUD/+61A//ttAX/7bQF/+yzBP/s swT/67ID/+uyA//rsgP/67ID/+e1AP/sshD/7LII/7x1Af/rpif/9b4B//e+F//6xR3//Mso //vOK//71C//+ts1//rfOv/74Dv/+t48//vePP/94D7//N87//zcOf/72jX/+9Uy//rTLv/6 0Sv/+s8q//THEv/4xiX/8b8G/++1DP/xpzz/o1gA/9+VAP/jkBj/344L/6hVAP/3ryf//8oV //jFHP/5zS7//9s0//vZOf/54UH/++ND//3mSP//6Uv//+tO//7sTv/96k7//OlN//vnSv/9 5kj//eRC///fPv/+2TP/+9Is//jMI//2yB3/+b8W//i1BP+pcAD/9NG9/+TFqf+8iwj/97sF //zGKP/40S7/+tQx//zbOP/+4T///uZG//3rS//67E3/+e1N//7xV//+71T//e1Q//3pTP/9 5Uf//eFC//zePv/93Tz/9c8+///bIf/zxRf/88Ei//y/D//Qhwf/37OM//n///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////9///89PL//v/x//j////py8P/unEC//+xAP/zsCP/8rod//rBKv/5uCj/6ZcF //ybAP/5lgD/+qIC//eqDv/2pAD/96UB//inAP/3qQH/96sA//isAf/4rgH/+K4B//utBf/6 rAT/+qwE//qsBP/5qwP/+asD//mrA//4qgL/+KoA//moAP/5pgD/+qQA//mhAP/4ngD/+Z0A //qcAP/5mQT/9ZIB//KWB//yphX/7bcf/+e8H//qvRz/8rwc//fDH//3wx//98Qd//bDHP/2 wxr/9cIX//XCF//1whf/9cEW//XBFv/0wBX/9b8V//a9FP/2vRT/970U//e9FP/5uBL/9LoR /+61DP/3tA7/75gA//uaAP/3mgD/9p8A//mhAP/6ogD/+qQA//mmAP/4qgD/+a0C//mvAv/5 rwL/+LAG//iwBv/4sAT/+bEF//mxBP/5sgL/+rMD//qzA//2tgD/9rUB//azAP/3sQH/9rAA //evAv/2rgH/+K0C//muA//5rgP/+KsD//iqAv/5pgL/+qQD//qiAv/5oQH/8p4A//qYAf// kQP//JME//CaBf/mpAf/5KsG/+atBP/ttAX/7bQF/+20Bf/ttAX/7rUG/+61Bv/utQb/77YH /++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/vtgT/7rUD/+61A//utQP/7rUD/+61A//u tQP/7rUD/+61A//ssgb/7LIG/+yyBv/ssgb/67EF/+uxBf/qsAT/6rAE/+a0AP/rsQ//7bMJ /8V+Cv/inR7/9b4B//i/GP/7xh7//Mop//zPLP/71TL/+t03//rhPP/64z//+uM///viP//9 5EL//ONA//zgPv/73jr/+9o3//rXM//61S//+tMu//XKJf//0jD/6rkF//S+Bv//wCz/wHMA /8d3AP/mlg3/344A/8FpEP/dkhP//8UK//jEGf/6zC7//dcs//vXOf/64EH/++ND//7mSP// 6Er//+pO//7qTf/86U3/++hM//zoS//95kj//uVD//7hP//92jT//NMt//jMI//3yR7/+8Ib //izAP/TlQz/x52E/+vLtP+zhgX/+b8G//3CJv/40S7/+tQx//zbOP/+4T///uZG//3rS//6 7E3/+e1N//zxV//98FT//e1Q//3rTf/+5kj//OJD//3fP//+3j3/99JF///XHP//0iH/78Mk //y/DP/wnQ//vIhY//X9//////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////8///48/D//P/x//f8///curH/x3gC //+vAP/3tCj/9Lwf//nAKf/4tiT/55UB//6bAP/5kwD/+Z8A//irD//3pAD/9qQA//emAP/2 qAD/96kA//erAP/3rQD/+K4B//qsBP/6rAT/+qwE//mrA//5qwP/+KoC//iqAv/4qgL/+KoA //moAP/5pgD/+aMA//mhAP/6ngD/+pwA//mbAP/8mQf/9ZIB//KWB//ypxb/7Lkg/+W9H//p vBv/87sc//fDH//3wx//98Qd//bDGv/2wxr/9cIX//XCF//1wxb/9cEW//XBFv/0wBX/9b8V //a9FP/2vRT/970U//e9FP/5uBL/9LoR/+61DP/3tA7/75gA//uaAP/3mgD/9Z4A//qhAP/5 oQD/+aMA//mmAP/6qQD/+KwB//iuAf/5rwL/+a4F//muBf/6rwb/+q8E//uxBP/7sQT/+7EC //uxAv/1tQD/9rMA//WyAP/3sQH/97AA//auAf/3rQD/96wB//muA//4rQL/+KsD//qpAv/5 pgL/+qQD//mhAf/6oAH/8p4A//qYAf//kQP//ZIE//KaBf/mpAf/5KsG/+atBP/sswT/7bQF /+20Bf/ttAX/7rUG/+61Bv/utQb/7rUG/++2BP/vtgT/77YE/++2BP/vtgT/77YE/++2BP/v tgT/7bQC/+20Av/ttAL/7bQC/+20Av/ttAL/7bQC/+20Av/ssgb/7LIG/+yyBv/rsQX/67EF /+uxBf/qsAT/6rAE/+WzAP/qsA7/7bMJ/8yFEf/blhf/9L0A//nAGf/8xx///Mop//zPLP/8 1jP/+t05//rjPf/65ED/++VB//vjQf/95UP//ORC//zjQP/73z3//Nw5//vaNf/61zP/+9Uy //zQPP/zyBr/+8sf//bCCv/zuQD/96w3/7hiC//bjgD/2YcA/92EMv/FeQH/+8ID//jEGP/8 zjD/+dMm//zVOv/530D/++FC//3lR///6Er//+lN//7qTf/96E3/+udL//zoS//+50n//uVD //7hP//92jT/+tMt//jOJP/1yR7//MUg//exAP/1sx7/pXhZ/+7Ouf+ugQL//8YN//vAJP/4 0S7/+tQx//zbOP/+4T///uZG//3rS//67E3/+e1N//3yWP/+8VX//e9R//3rTf/95kj//OJD //3fP//83z3/+9dL///UF///3Sz/68Ml///BCv//phH/pGs0//P9//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///99v/x9///9f/////1///QpHf/05MA//muF//1rBH/8bop//zBH//1rgD/75oA//qdAP/8 ngr/8pkL//CbDf/rnwD/96sI//qxDf/zqgb/7aUB//CoBP/0rwr/9bAL//2uAP/8rQD/+6wA //mpAP/4qAD/9qYA//WlAP/1pQD/46MA/+qqAP/zrgD/9qwA//KkAP/yngD/9p0F//mdCv// kwb/9JEC/+ydDf/utCL/7b4o/+W3G//suBf/+cIf//nFGv/5xRr/+MQZ//fDGP/3wxj/9sIX //XBFv/1wRb/9cEV//TAFP/0wBT/9L4T//W9Ev/0vBH/9bsR//S6EP/zuwz/9b0Q//e9FP/7 uxv/4ZgA/++bBf/4mQf//JcH//ihAv/4oQL/96MD//elA//3pQH/9qcC//epAf/2qQH/+KwB //isAf/4rAH/+KwB//mtAv/5rQL/+a0C//quA//6rgP/+a0C//mtAv/5rQL/+KwB//isAf/4 rAH/+KwB//WoBP/2pwT/9qcE//elA//3pQP/96MC//mjAv/5owL/8qEA//WcAP/6lQD/+5EH //iUCP/vnwL/5qoA/9+yAP/prAP/6q0E/+2wB//vswf/8LQG//C0Bv/usgL/7bEB//C0Bv/w tAb/8LQG//C0Bv/wtAb/8LQG//C0Bv/wtAb/7LIG/+yyBv/ssgb/7LIG/+yyBv/ssgb/7LIG /+yyBv/ssgj/7LII/+yyCP/ssgj/67EH/+uxB//qsAb/6rAG/+amEP/qrwD/6a0A/+OfIP/C fQj/+rsg//7DEf/7vhj/98wn//nPK//81jP//t06//7iQP/85kX/+uhI//jpSP/35Uf/+eVG //vnSP/+6Ef//uZE//vjQf/64T7/+N88//3UOv/2zCz/+88o//7LJP/8wiL//8Mu/+ehG/+r YQD/4ZIb/8p7BP+9bwD/7aYW///DG//8yRj/980f///ZNv/52Tb/+t07//3hQP//5Ub//+hK //7pTv/86U///OlP//riRP/74UT//eFC//7ePf/92jj/+9Qx//nPK//3zCf//rsU///EF//v uQ7/qmwF//q1jv+rag7/9LwP///HHv/1zyz/9tMx//nZOP/84D///edG//rrSv/57U3/+O5P //zuUP/+7lH//+9R///tUP//6kz//+ZJ//7iQ//84EH//94j//vQNv/2yCz//8gh//GxCf/8 xRD/mG4A///l7P///v///Pv///z8/v/+/v///v7+//39/f/+/vz////9//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////89f/z+f//9f/////3///Km23/2JcA//itFv/0 rhL/8rUf//+3Nv//pjL/+5gX//+jBf//pgD/+pkA//GRBv/5nAH/+JsA//mdAP/9pAD//6kB //+rAP//qgD//qkA//mgCP/5oAj/+qEJ//qgC//7oQ3/+6EN//yiEP/8ohD//6An//+bHv// kw///ZIG//+YBf//nAT/+5cA//GOAP/+kQL/85QE/+2jEP/ttSD/67wk/+e5Hf/tuxr/+8Qh //nFGv/5xRr/+MQZ//fDGP/3wxj/9sIX//XBFv/1wRb/9cEV//TAFP/0wBT/9L4T//W9Ev/0 vBH/9bsR//S6EP/zvhD/9b0S//m/Fv/6uRX/6ZwA/++XAP/5lwL//JQA//egA//4oQL/+KEC //ejAv/3pQH/+KYC//aoAP/3qQH/96sA//erAP/3qwD/+KwB//isAf/4rAH/+a0C//mtAv/5 rQL/+a0C//isAf/4rAH/+KwB//erAP/3qwD/96sA//anBP/1pgP/96UD//elA//3owL/+aMC //mjAv/4ogH/+KAA//iZAP/5kAH/9osB//KOAv/tmQP/5qcC/+OxBP/prAP/6q0E/+2wB//v swf/8LQG//C0Bv/usgL/7bEB/++zBf/vswX/77MF/++zBf/vswX/77MF/++zBf/vswX/7LIG /+yyBv/ssgb/7LIG/+yyBv/ssgb/7LIG/+yyBv/ssgj/7LII/+yyCP/rsQf/67EH/+uxB//q sAb/6rAG/+anDv/ssQD/668B/+ilIv+zbgD//8Eo//e7Df/+wRv/98wn//nPK//71TL//t06 //7iQP/95UX/++dI//roSP/45kj/+edJ//vnSP/+6Ef//edG//zkQv/54T//+N88//7XPP/5 zjH//dIt//7OJv/5wh///8Ip//CtIP/GgAD/wXIA/+SUIf+wYQD/76cd//e5GP/6xhj/9ssd //nSLP/52Tb/+9s6//3fP///5EX//+dJ///oTP/96E3/++hO//riRP/74UT//eFC//7ePf/9 2jj/+9Qx//nPK//3zCf/+7sR///DF//yug//un4Q/+6ne/+tbBD/9rwS///EGP/1ziv/99Eu //rZNv/84D///OZF//zqSv/67E3/+exO//zuUP/+7lH//+5Q///tUP//6kz//+VI//7iQ//7 30D//9si//zRN//3ySv//sgg//OyDP/6wg3/pnoA//vOy/////////////39///+/v7///// //////////3//v78//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////99f/4 +///9//////5//++jl3/354E//arEv/1rxP//boh//++Gv//qQr/8Y0E//WFF//9jhr//5sB //+lAP//pQD/+Z8A//ecAP/7nwD/+Z0A//SXAP/3mQP//6EN//epAf/2qAD/9qcC//SlAP/z pAH/8qMB//KjAf/xogD/75cA//igAf/8pAX/950A//OZAP/4nAD/95sA//OXAP/yjwD/85oK //GrF//tth7/57se/+m8G//zwh///cgi//nFGv/5xRr/+MQZ//fDGP/3wxj/9sIX//XBFv/1 wRb/9cEV//TAFP/0wBT/9L4T//W9Ev/0vBH/9bsR//S6EP/0vhT/8bsQ//vBF//4tQ7/8aQA //CTAP/9lgD//5EA//eeAv/4nwP/+KAB//ihAv/3owL/+KUB//elAf/4pgL/9qgA//epAf/3 qQH/96kB//iqAv/4qgL/+KoC//mrA//5qwP/+KoC//iqAv/4qgL/96kB//epAf/3qQH/9qgA //akAv/2pAL/96MC//ejAv/4ogH/+aEB//mhAf/4oAD/95gI//uWCP/+kwf//pMF//uWBv/z nQr/6aQL/+OoDP/prAP/6q0E/+2wB//vswf/8LQG//C0Bv/usgL/7bEB/++zBf/vswX/77MF /++zBf/vswX/77MF/++zBf/vswX/7LIG/+yyBv/ssgb/7LIG/+yyBv/ssgb/7LIG/+yyBv/s sgj/7LII/+uxB//rsQf/67EH/+qwBv/qsAb/6rAG/+anCv/usgL/7LAE/+yqHv+rZwD/+rol //O2Dv//wx3/+Msn//rPK//81TL//dw5//7hP//95UX/++dI//roSP/550n/+uhK//vpS//9 6Ur//uhH//zmRf/64kD/+OA+///aQf/60zb//9Yy///RKf/3xBv//MIg//u8If/npRD/tGUA /96OH//DcwT/0ocI//q4I//3wRf/9MYZ//fNI//41zT/+9o3//7ePf/+4kH//+VI///mS//9 5kv/++ZL//riRP/74UT//eFC//7ePf/92jj/+9Qx//nPK//3zCf/+70S//7BGf/xuQz/05Ua /9ePVf+xbA//+r0X//7AFf/2zCj/99At//rXNf/83z3//ORC//zoSf/66kz/+etM//vtT//9 7VD//+5Q///sT///6Uv//+VI//3hQv/730D//tci//zTOf/4zCv/+8Ud//a1Ef/3vAj/vo0K /9qqlv////////////7+/v//////////////////////+/v7//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+9f/6/v//9v/5///5//+zgEn/6aQI//SpD//1sBT/9rkj //q2I//7rRn/96MD//ujAP/9owD/85kA/+uPAP/rlgj/7pkK//aiDv//qhP//6oP//ylBv/6 pAH//KYB//WrAP/0qgD/86kA//GnAP/vpQD/7aMA/+ugAP/qnwD/6asC//CtB//yqAn/8p4H //abBv//mwn/+5EA//GCAP/ojwH/8aIR//WzHv/tuBz/5roZ/+vAG//3xiH//ssk//nFGv/5 xRr/+MQZ//fDGP/3wxj/9sIX//XBFv/1wRb/9cEV//TAFP/0wBT/9L4T//W9Ev/0vBH/9bsR //S6EP/wuxP/7bcN//m/Ff/0sgb/+qwE//KUAP//lwD//5IA//mcA//3nQH/+J4C//igAf/4 oQL/+KIB//ekAP/3pAD/96YA//emAP/3pgD/+KcA//inAP/4pwD/+agB//moAf/5qAH/+agB //inAP/4pwD/+KcA//emAP/3pgD/96YA//aiAv/2ogL/+KEC//egAf/4oAH/+Z8B//ieAP/6 nQD/+ZYH//uVBf/+lAD//5YA//uZAP/zngP/6aII/+WmC//prAP/6q0E/+2wB//vswf/8LQG //C0Bv/usgL/7bEB/++zBf/vswX/77MF/++zBf/vswX/77MF/++zBf/vswX/7LIG/+yyBv/s sgb/7LIG/+yyBv/ssgb/7LIG/+yyBv/rsQf/67EH/+uxB//rsQf/6rAG/+qwBv/prwX/6a8F /+mrCP/usgb/7K8H/+qqFf+8egD/3JsN//e4G//+wRv/+com//rNKv/+1DL//ts5//7hP//9 40T//OVH//rmR//46Ev/+elM//3rTf/+7E7//upL//3nRv/75UT/+uJA///fRv/62Dn//tg1 ///WLP/3yRz/+MQZ//zDHP/2uxn/z4QH/7hoAP/llCv/q14A//+8Mf/2vBz/9sQX//nLHf/5 0zD/+tcz//3cOf//4ED//+NE//7kR//95En//ONJ//riRP/74UT//eFC//7ePf/92jj/+9Qx //nPK//3zCf//sUW//zBHf/wuAn/5qkb/8N5Lv+xaAr//Lwe//7AE//2yyf/+M4q//rUMf/8 3Dn//uJB//zmRf/66Ej/+elL//rsTv/87E///+1P///rTv//6Er//uRH//zgQf/63j//+tUl //3WO//4zir/98Qb//m5Gf/0twT/1qIR/7qFW/////v////7////+/////3////9//////// ////+Pj4//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////9v/7////9v/1 ///5+/+pcjn/76kJ//SpD//zsRT/5LEY///EQv/zsEf/wXkV/7lwAP/loBX/+bca/+KhAP/4 ogD/+KIA//WdAP/xlwD/85YA//iZAP/4mQH/9pQA//ubAP/7mgD//JsA//ybAP/8mwD//ZwA //2bAv/9mwL//pUA//+aAP//mgD//5UA//+SAP//lgD//5oA//+bAP/ilQf/8KoX//W6IP/t uxr/57wV/+7EGv/5yiL//Mwk//nFGv/5xRr/+MQZ//fDGP/3wxj/9sIX//XBFv/1wRb/9cEV //TAFP/0wBT/9L4T//W9Ev/0vBH/9bsR//S6EP/stRD/67IJ//S6Dv/0sgT//7IK//WZAP// lwD//5YG//maAv/5mgL/+JsC//mcAf/4ngD/+KAB//igAP/4ogH/+KIA//iiAP/4ogD/+aMA //mjAP/5owD/+qQB//qkAf/6pAH/+qQB//mjAP/5owD/+aMA//iiAP/4ogD/+KIA//egA//4 nwP/954C//ieAv/5nAH/+ZwB//qbAf/6mwH//ZoB//uWAP/3kwD/85AA/++TAP/tmwD/6qUA /+msBv/prAP/6q0E/+2wB//vswf/8LQG//C0Bv/usgL/7bEB/+6yBP/usgT/7rIE/+6yBP/u sgT/7rIE/+6yBP/usgT/67EF/+uxBf/rsQX/67EF/+uxBf/rsQX/67EF/+uxBf/rsQf/67EH /+qwBv/qsAb/6rAG/+mvBf/prwX/6a8F/+uuBv/srwn/6qwJ/+WnCP/cmwv/uXcA//m4Jv/6 vRX/+com//rNKv/90zH//9k4///gP//940T//OVH//rmR//46U7/++tO//zsT///7U///+tM //3pSv/85kX/+uRD///iSP/52z3/+9o3//7XMf/60CT/98cb//bCF//0vhT/9q0i/7FlAP/X hh3/tGMA/+6lJf/6uyL//ccd//rLG//50i3/+tQx//zZN///3T3//+BA//7hRf/84kf/++FG //riRP/74UT//eFC//7ePf/92jj/+9Qx//nPK//3zCf//8wa//vBIv/vtgf/8rQV/7xxFP+t YAT/+bYf///CE//1yCT/+M0o//rTLv/92jj//eA+//3kQv/85kX/+uZH//nrTf/7607//uxO //7qTf/+50n//eNG//vfQP/53T7/+tQr//zXPv/10Cf/9cUb//y8Hv/2tQP/6LAV/6luLP/9 /vb////4////+v////v////9////////////9/f5//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9v/6/v//+//z///19f+jaSr/86sH//asD//ysBP/7LsY/9+vDf/v vC//77dY/61tPf9tLQn/h00N/8qYN//mjwz/+qId//+tJf//pRj/9ZkG//WWAP/5mAD/+ZgA //+dAP//nAD//5wA//+bAP//mwD//5oA//+ZAv//mQL//6UA//+cAP/1mA3/9J8o/++mPf/c nTz/uoUl/6BvEP/ioRP/7bEd//O+IP/swBn/6sAU//DGGP/2yh//+Mof//nFGv/5xRr/+MQZ //fDGP/3wxj/9sIX//XBFv/1wRb/9cEV//TAFP/0wBT/9L4T//W9Ev/0vBH/9bsR//S6EP/u tRD/7bQL//C2Cv/0tQb//rUO//KdAv/zkgP//pgS//mXAv/6mAP/+JkB//maAv/5nAH/950A //ieAP/4ngD/958A//efAP/3nwD/+KAA//igAP/5oQH/+aEB//mhAf/5oQH/+aEB//mhAf/4 oAD/+KAA//efAP/3nwD/958A//edAf/3nQH/950B//mcAf/5mgD/+ZoA//qYAP/6mAD/+5sA //uaAP/7mQL/+JoG//WdB//vogT/6qcA/+erAP/prAP/6q0E/+2wB//vswf/8LQG//C0Bv/u sgL/7bEB/+6yBP/usgT/7rIE/+6yBP/usgT/7rIE/+6yBP/usgT/67EF/+uxBf/rsQX/67EF /+uxBf/rsQX/67EF/+uxBf/qsAb/6rAG/+qwBv/qsAb/6a8F/+mvBf/prwX/6K4E/+quAP/q rAv/6KoJ/+SnAP/ysxr/rmsA/+yqIP/3uhL/+cgl//zMKv/+0jH//9k4///ePv/+4kP//ORG //vkRv/661D/++xR//7uUf/+7lH//+5Q//7qS//750j/+uZH//zkRv/530D/+dw6//zZNf/7 1C7/+Mwl//PDGf/xvhX//8Af/9uRCv+wXwD/1IIc/8d6BP/5tyX//8ki//vIF//5zyv/+9Et //3WM//+2zn//90+///eQf/930P/+95C//riRP/74UT//eFC//7ePf/92jj/+9Qx//nPK//3 zCf//9Ec//e+Jv/ytgb/+LkJ/8d7Df+qWQD/860a///BEf/3xiH/+com//zRLf/91zT//t47 //7iQf/85ET/++VE//jqTP/66k3//etN//3pTP/95kj//OJF//reP//43D3//dYz//zXPv/y 0ST/9sgd//69I//4tQT/87YO/6ZmDv/y9Of//f/0////+P////r////7////////////+fn7 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////9v/4/P///v/z///w7f+g YyL/9awH//iuD//xsRP/9bka//S8If/wvSP/6r8a//DKK//lvUv/kmA7/yYABP82AgD/Uh0A /3VBEf+TYRj/qHYV/7qHEf/Hlg3/0J4L/82TJ//Mkib/ypAk/8iOI//GiyP/xIkh/8KHIf/B hiD/iWId/4RdIv9vSh3/RSIC/xgAAP8VAAD/SjUY/4ZzU//mrR7/7LYg/++/H//uwhn/7sQW //HIGP/zyBr/9MYb//nFGv/5xRr/+MQZ//fDGP/3wxj/9sIX//XBFv/1wRb/9cEV//TAFP/0 wBT/9L4T//W9Ev/0vBH/9bsR//S6EP/2uBX/9bsS/+61Bv/3uw3/+bYQ/+yhCv/iiwb/8ZUa //mVAf/6lgL/+ZcC//qYAf/5mgD/+JsA//mcAP/5nAD/950A//edAP/3nQD/950A//ieAP/4 ngD/+Z8A//mfAP/5nwD/+Z8A//ieAP/4ngD/950A//edAP/3nQD/950A//ibAv/4mwL/+JsC //iZAf/6mAH/+pgB//qWAP/6lgD/+ZwA//eZA//0lhD/8ZUa/+yYG//onxL/5qYG/+SsAP/p rAP/6q0E/+2wB//vswf/8LQG//C0Bv/usgL/7bEB/+2xA//tsQP/7bED/+2xA//tsQP/7bED /+2xA//tsQP/6rAE/+qwBP/qsAT/6rAE/+qwBP/qsAT/6rAE/+qwBP/qsAb/6rAG/+qwBv/p rwX/6a8F/+mvBf/orgT/6K4E/+esAP/rrA//6KkM/+mtAP/wshP/w38C/9GOC//2uRD/+cgl //vLKf/90TD//9g4///ePv//4UP//eNG//zkRv/67VP//O1S//7vVP//71L//+9S//7sTv/8 6En/++dI//njQv/95UX//OA///raOv/81jf/+s4t//XIJf/3xiP//8EN//myGv+5aQD/zHoW /7VoAP/uqR3//MEb//7HFf/4zSj/+9As//7UMv//2Tj//9s8///dPv/93D//+91B//riRP/7 4UT//eFC//7ePf/92jj/+9Qx//nPK//3zCf//c8Z//O7Jv/1ugj/+7wA/96QFP+nVAD/6J8S //y7C//4xCD/+cgj//zPK//91jP//t06//7hP//840H/++ND//jqTP/56Uz//OpM//3pTP/9 5kj/++FE//reP//32zz//9k7//vYPv/v0CD/9ssd//69Jf/8tgb/97UH/61qAf/m6Nr/+Prt ////9v/+//f/+/z3/////////////Pv///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////9v/3+////v/x///s6P+gYR7/9KsE//qwEf/wsBL/+LAd//m2Hf/8xCX/9MMo /+e/Kv/z0Tr//eI9/+/YJv+dtGT/YXUu/x0rAP8ABgD/AQAA/wUADv8KAB//CQAl/wQAAP8E AAD/BAAA/wQAAP8EAAD/BAAA/wQAAP8EAAD/Aw0O/wACAP8WEQD/W00g/6eOPv/UsTv/6L8n //HGGP/qtSf/67kk/+3AH//vxRn/8McX//HIFv/xxhf/8MQZ//nFGv/5xRr/+MQZ//fDGP/3 wxj/9sIX//XBFv/1wRb/9cEV//TAFP/0wBT/9L4T//W9Ev/0vBH/9bsR//S6EP/8vRj//sEY /+61Bv/5vxP/87US/+iiD//UhQb/5ZAc//qUA//5lQH/+pYC//mXAP/6mAH/+ZoA//ibAP/5 nAD/9pwA//acAP/2nAD/950A//edAP/3nQD/+J4A//ieAP/4ngD/+J4A//edAP/3nQD/950A //acAP/2nAD/9pwA//ibAv/4mwL/+JkB//qYAf/6mAH/+pYA//qWAP/7lgD//6ME//GVBv/d fwv/z3MO/8l2Dv/Rig7/36IJ/+mzCP/prAP/6q0E/+2wB//vswf/8LQG//C0Bv/usgL/7bEB /+2xA//tsQP/7bED/+2xA//tsQP/7bED/+2xA//tsQP/6rAE/+qwBP/qsAT/6rAE/+qwBP/q sAT/6rAE/+qwBP/qsAb/6rAG/+mvBf/prwX/6a8F/+iuBP/orgT/6K4E/+OoAP/srRL/6KkM /++0Av/kpgP/3Jce/7l1AP/3uhH/+8cl//zKKf/+0TD//9c3///ePv//4UP//eNG//zkRv/6 7VP//O9V//7vVP//8FX//+9S///tT//86kz/++dI//XiPv//6kf//uRF//jaPP/51Tn//NE1 //vNL///0DD//sAA//exEf/omSD/plQA/71tAP/hnBH/87US///HGP/5zCj/+s8q//3TL/// 1zf//9o7//7cPf/93D///NtA//riRP/74UT//eFC//7ePf/92jj/+9Qx//nPK//3zCf/+MwV //C4Jf/3vAr//b4A//ChIP+mUQD/4JcM//e2BP/3wx//+cgj//vOKv//1TH//ts5//3gPv/7 4kD/+uJA//fpS//56Uz//OpM//zoS//85Uf/++FE//ndPv/32zz//9w///rXPf/uzx3/+M0f //+9KP//uAb/97QB/7VvAP/e4dD/9Pbo////9P/9/vb/+fr1/////////////v3///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////v//////u7/+//9//3x5f+mYAH/+qsJ /+2uCf/8qxH/9bQc//W2Hf/2uSD/9r4j//jDJ//4yCr/+csv//nNMP/93Tr/+ds7//LUPv/j xz//zbM4/7OcLP+dhiD/j3gY/3xlIv99ZiL/gGgi/4VtJf+PdSv/mn8y/6KHOP+ojT7/68Ex /+3AL//uwi3/8MMo//HFJv/zxiL/88ce//bIHf/1ySD/9ckg//fIIP/3yR7/98cb//fHG//4 xhn/+MYZ//jEFv/4xBb/+MQW//fDFf/3wxX/9sIU//bCFP/2whT/+L4S//e9Ef/3vRH/970R //a8EP/2vBD/9rwQ//W7D//wswv/97sP//e7C//uswH/8rUM//2+If/ioBT/sG0A/101AP+D VQf/toAU/+GcE//5oQn//5oA//+SAf//kAb/76AF/++eBP/vnAL/7pkA//CYAv/zmQT/9poH //qbCf//lg///5QM//6TB//7lgj/+poI//edCf/xnAX/7ZkC//mKAP//lgD//6IH//+mEf/y ohn/25Md/7x4F/+iYgv/cUER/3lIBv+WZQb/xJMS/+OxEv/rtAL/77UA//a7AP/usgb/7rIG /+6yBv/usgb/7rIG/+6yBv/usgb/7rIG/+2xBf/tsQX/7bEF/+2xBf/tsQX/7bEF/+2xBf/t sQX/6rAG/+qwBv/qsAb/6rAG/+qwBv/qsAb/6rAG/+qwBv/prwb/6a8G/+mvBv/orgX/6K4F /+etBP/nrQT/560E/+uuBv/mqgD/7bED/+mtAf/nqQb/9rUj/65rAP/loCn/+sQc//fCGv// 0Cj//dIt//zZNf//4kL/9t1C//rjSP/65kf/++lL//7sTv//71L///BV///wVf/871X/++5U //3mSP/95UX//ONB//zfPf/72jf/+9Yw//zTLf/70iz/+8Aa//O2EP/9vg//wnUA/7lhM/+7 bgb//9ET//m+CP/0xBj//9Iq///ZOv/70jj/8s02//bVPP//4kT//+pI//jkLf/34Sz/+N0u //naMf/72DT//NQ2//vQNv/6zTb/98Mf///KK//yuQr/9boA//+/KP+fVgD/2JMa/+21AP/4 xBn/+sce//zNJf/+1S3//dsz//3eNv/63zj/+N86//fiR//640f//OVJ//3lR//940T/+uBB //ndPP/32zr/+9ot//3ZLf/70Sf/9cUd//S9GP/2uBX/7qoJ/+CaAP/asZ///fT///j////9 +OL///b///r8///2//n//vj4//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //v//////u7/+//9//3x5f+mYAH/+qsJ/+2uCf/8qxH/9bQc//W2Hf/2uSD/9r4j//jDKf/4 xyz/+csv//nNMP/1yTL/+Mw3//nRPv/61EX/+NRI//PTTP/tz0n/6sxI//TdNf/y2zP/8Nov //DYLf/y2Cn/9Nsp//fcKf/53yr/8skx//XJMv/1yi7/98ss//fMKP/5zCj/+c0k//zOI//1 ySD/9ckg//fJHv/3yR7/98cb//fIGv/4xhn/+MYZ//jEFv/4xBb/+MQW//fDFf/3wxX/9sIU //bCFP/2whT/+L4S//e9Ef/3vRH/970R//a8EP/2vBD/9rwQ//W7D//wsw3/97oR//3BEf/4 vQv/87cJ//u9HP/6uiX/6qgc/9G2Rf+SciX/RyII/yYABf86Fhb/aU4f/5CCF/+inAb/5oki /+qNI//xkyL/95gg//2eHP//ohf//6QS//+kD//4pAD/9qQA//WjAv/vnwz/7JsW/+eYIf/k lin/45Ys/6WHGf+adyb/dk8o/0YbFP8rAgD/QB0A/3VYFv+fiCr/1akm/9mrIf/fshv/5rYU /+m0EP/prw3/6aoP/+mnEv/usgb/7rIG/+6yBv/usgb/7rIG/+6yBv/usgb/7rIG/+2xBf/t sQX/7bEF/+2xBf/tsQX/7bEF/+2xBf/tsQX/6rAG/+qwBv/qsAb/6rAG/+qwBv/qsAb/6rAG /+qwBv/prwb/6a8G/+iuBf/orgX/6K4F/+etBP/nrQT/560E/+irA//hpAD/7bED/+6yBv/t rwz/6qoV/8mGA//CfgP/+L4c//rDHv/7yiX/+s8q///ZNv/73T3/9ds+//rhR//65kf//OhJ //7sTv/+7lH///BT//7vVP/97lP/++5U//7nSf/95UX//ONB//zfPf/82zj//NYz//rTLv/7 0iz//cQf//y/Fv/0tAr/6aAf/7ViEv+tYAD/8LAQ//q/Df/zxBb/8cEZ//LFIv/6zzL//9k8 //7cPf/31zT/79Is//PYP//420H//N5A//7dOP/81y7/+dQk//rRH//60hv/7roO//W8Ff/2 vAP//8MA//+8Gf/BeQD/z4wA//K5AP/0vhT/98Ia//nJIf/70Cn//dYw//zbNv/63Tn/+t86 //nhQ//64kT//OJF//3jRP/94UD//N4+//ncOv/32jj/+dct//vXK//5zyX/9cUd//a9GP/3 uBP/8KwJ/+SfAP/Moon///f///j//////en///n///n9///2//n///v7//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////v//////u7/+//9//3x5f+mYAH/+qsJ/+2uCf/8 qxH/9bQa//W2Hf/2uSD/9r0l//jDKf/4xy3/+csw//nMM//+xj3//cg8//7LOv/9zjj//dA1 //rSMv/40i//+NMt//rSPf/50Dr/9s01//XKMP/0xyz/88co//XIJ//1yCf/9s8s//nPLf/5 zyv/+s8q//rPKv/7zyj/+88m//3OJv/1ySD/9cke//fJHv/3yRz/98cb//fIGv/4xhf/+MYX //jEFv/4xBb/+MQW//fDFf/3wxX/9sIU//bCFP/2whT/+L4S//e9Ef/3vRH/970R//a8EP/2 vBD/9rwQ//W7D//1uBL/9bgP//zAEP/6vwv/77QC/++zB//6vBv//8Ek/+y6AP/1xhb/7sQy /8KdMv94XRr/NiEE/xICAv8HAAn/GQUA/x4KAP8oEgT/Mh0I/z0oDf9GLw//SjQP/001D/9C OhP/QTkV/zowFf8sIBD/GgwJ/wwABP8KAAf/CgAL/xgAAP9KKRj/i20v/7qcLv/PsRv/2boI /967AP/guwD/5rYA//HABP/wvwH/5bIA/+KrAP/qrwv/77Ib/+yuH//usgb/7rIG/+6yBv/u sgb/7rIG/+6yBv/usgb/7rIG/+2xBf/tsQX/7bEF/+2xBf/tsQX/7bEF/+2xBf/tsQX/6rAG /+qwBv/qsAb/6rAG/+qwBv/qsAb/6rAG/+qwBv/orgX/6K4F/+iuBf/orgX/560E/+etBP/n rQT/5qwD/+msBv/fogD/6a0B/+yvBv/usA3/3JwG/+mnHf+pZgD/6a0R//zCI//4xCL/+cwo ///ZNP/31zb/99o+//rfRv/55Ub/++dI//7qS///7U///+9S//7uUf/87VL/++xR//zoSf/9 5kj//eNE//zgP//82zj/+tcz//vUL//80i7//cYl//rCE//xsg///78s/8Z9AP+gUwD/zYYS //u+Ff/2whb/9cIX//nJIf/8zyv/+c8r//XQKv/93TL//+5C//fYQv/62EH/+tc9//rWOP/6 1DP/+9Is//rPKP/60Cb//8o2//q9J//9vBr//74T/+6mE//ekhr/xYAA//i7Cv/wtQ//87oT //fCHP/6yyf//dIu//zWM//82zj/+9s6//reP//730D//OA///7gQP/+3j3//Nw5//rZNv/4 1zT/99Ip//jSKf/3zSP/9sMc//a9Fv/3uBH/9K8K/+2lAf+3jGH///r///b+/////+3///r/ //r+///3//n///v///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////v///// /u7/+//9//3x5f+mYAH/+qsJ/+2uCf/8qxH/9bQa//W2G//2uSD/9r0l//jCKv/4xi//+co0 //nLN//6xzr/+8g5//rKOP/6zTb/+c4y//nOMf/2zyz/9c4r//zPQP/8zz7//M47//vNOf/7 zDT//cwy//7NMv/+zTL/9M4j//bNI//2zSP/9swi//bMIv/2yiH/9soh//jJIf/1yR7/9cke //fJHP/3yRz/98ga//fIGP/4xhf/+MYX//jEFv/4xBb/+MQW//fDFf/3wxX/9sIU//bCFP/2 whT/+L4S//e9Ef/3vRH/970R//a8EP/2vBD/9rwQ//W7D//6vRf/8rUM//W5C//3vAj/8LUB /+yxAP/wtAb/8LMK//qvFv/2rgz/9rME//6+Bf//xxH//cAa/+erF//WmBH/kX0n/4t2I/+B ax//dF0Z/2hQFP9gRBL/Wj0R/1Y5Ef9iQBr/a0sa/3xeGP+QcxX/pYkO/7edCP/IsAj/0rwH //XCG//2wBb/8rkK/++wAf/2rwX//7MR//+xGv//rRr/5acA//CyBf/xtAH/560A/+asAP/s tQD/77cA/+mxAP/usgb/7rIG/+6yBv/usgb/7rIG/+6yBv/usgb/7rIG/+ywBP/ssAT/7LAE /+ywBP/ssAT/7LAE/+ywBP/ssAT/6a8F/+mvBf/prwX/6a8F/+mvBf/prwX/6a8F/+mvBf/o rgX/6K4F/+iuBf/nrQT/560E/+asA//mrAP/5qwD/+2wCv/kpwD/46YA/+SnAP/qrAv/25wD //SzI/+5dwD/z44A//a5Iv/5wyP/+cok///WMP/41TP/+tw+//zfRv/540L/++VE//zoSf// 60z//+1P//3tUP/87E//+epP//3pTP/86Ev//eVH//3hQP/83Dv/+9g2//vVMv/71C///Mgn //K9Df/0uBn//bwY/+qpAP+rXwD/sGIQ//i3Hf/9xRj/+MIX//nGG//+zib//tQq//vSKv/2 0Sj/9tQq///iPP//3Tn//tc6///VQf//0Uf/88RC/9+tMv/OnCP/vHkQ/7NtAP+9dgD/zYID /8p6Cf/ZiiP/x3wH//izKP/usQv/8LUR//S9Gv/5xSP/+84t//zUNP/71zj/+9k5//nbO//7 3T3//t4+//7ePf/+3Tr//Nk3//nWMv/50zD/9dAn//fOJv/2yiH/9sMa//e9FP/4uBD/9rIJ //WsBf+idDb///r7//b7//////H///v///n////5//r///n///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////v//////u7/+//9//3x5f+mYAH/+qsJ/+2uCf/8qxH/9bQY //W2G//2uSD/9r0m//jCLP/4xjP/+ck3//nLOP/xzDX/9M84//fTP//82Eb//dpM//3ZTf/7 10//+tZO//zbPv/82T3/+9k6//vYNv/51jL/+dQu//jRK//30Sj/9M4h//XNIP/1zSD/9Moe //PJHf/zxxz/8sYd//TFHf/1yhz/9coc//fJHP/3yRv/98gY//fIGP/4xxX/+McV//jEFv/4 xBb/+MQW//fDFf/3wxX/9sIU//bCFP/2whT/+L4S//e9Ef/3vRH/970R//a8EP/2vBD/9rwQ //W7D//1uBD/8rUM//W5C//3vAr/9LkF//a7B//3vAr/77QC/++/AP/uvQD/7bUA/+ytBv/q qAn/8KsI//mwCf//twr//8UA//3CAP/6vgD/97kC//a3Cv/2tRH/9rUZ//a1G//+vA7//LgN //u0DP/9sQ3//7ER//+uFP//qhP//qYR/+SnAP/vrwD/97QO//iyHP/1shv/9bQO//K1AP/t sgD/97AY//exFf/1sgz/8rME//K2AP/xtwD/67QA/+WvAP/tsQX/7bEF/+2xBf/tsQX/7bEF /+2xBf/tsQX/7bEF/+ywBP/ssAT/7LAE/+ywBP/ssAT/7LAE/+ywBP/ssAT/6a8F/+mvBf/p rwX/6a8F/+mvBf/prwX/6a8F/+mvBf/orgX/560E/+etBP/nrQT/5qwD/+asA//mrAP/5asC /+qtB//qrQf/4aQA/+GkAP/pqwr/5aYJ/+ioEv/dnQj/uXMA/+inF//8wSf/+8cj//rPKP/8 1zH//90+//zdRP/54T//+uRD//3nRv/+6kv//uxO//3rTf/66k3/+elM//3qTv/96Uz//eZI //ziQ//73T3/+9o3//zWM//71TL//c0t//jGF//3vR3/77EE///AAP/TiQ7/mksA/+WhHP/1 uA//+sAW//vFG//6xR3/+cok///SL///2Tn//9o8///WQv/3zTv/4rUo/7yNCf+ebAD/m2gA /7N/D//OmCz/5KE4/+CdKP/jnCD/6Zwo/9+SIP/YjBT/x4AA/9aRD//usA3/8LUT//S9HP/5 xST/+84t//zUNv/71zn/+9k6//nbPf/73T///t4+//7ePv/+3Dz//Nk3//nWNP/50zL/9s8p //XMJP/2xx//98Ia//a8Ev/3tAv/+bMG//qyBv+ZZxL///rw//b7//////T///v///n////5 //j///X///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////v//////u7/+//9 //3x5f+mYAH/+qsJ/+2uCf/8qxH/9bQY//W2G//2uSD/9r0m//jCLv/4xTT/+ck5//nKPP/x 1zz/89hB//XZR//32lD/9thU//PTWP/vz1j/7MtX//XYVv/22FT/99lT//nZUv/3107/9tVI //XSRP/z0EL/+dIs//rRK//50Cj/+M4k//fNI//2yh//9coc//bIG//1yhz/9coc//fJG//3 yhn/98gY//fIFv/4xxX/+McT//jEFv/4xBb/+MQW//fDFf/3wxX/9sIU//bCFP/2whT/+L4S //e9Ef/3vRH/970R//a8EP/2vBD/9rwQ//W7D//xtAv/9LgM//q+Ev/2ugz/7rIE//O3B//5 vQ3/9bkJ//KqCP/zqwv/860N//ayE//2thb/9rgX//K3E//vthH/8LAQ//GyD//ytQ//8LYN /++1Cf/stQP/57MA/+WxAP/juhL/4LYM/96yB//itAf/5rcH/+q5Bf/ntQD/5bEA//qsDP/+ swj/+7cA//GzAP/prwD/568A/+awBv/krhD/9LIG/+ypAP/npwD/7a0F//GzCv/vsAn/7K8J /+yuC//tsQX/7bEF/+2xBf/tsQX/7bEF/+2xBf/tsQX/7bEF/+uvA//rrwP/668D/+uvA//r rwP/668D/+uvA//rrwP/6K4E/+iuBP/orgT/6K4E/+iuBP/orgT/6K4E/+iuBP/nrQT/560E /+etBP/mrAP/5qwD/+WrAv/lqwL/5asC/+KkAf/qrAn/4qQB/+aoBf/rrQz/7a8Q/9ydAP/x shX/vHIA/9SPBv/3uiP/+sUh//bKH//+1zH//Ng5///cRP/33z3/+eE///zmRf/+6Ef//elK //zqTP/76Uv/+uhK//zsT//96k7//udL//zkRv/83j7/+9s6//vYNv/81jX//9U0///VKv/0 vhb/87cH//m7BP/6syf/nlMA/8d+D//5uBL//8AZ///EHv/7xCH//Mcp//7MN//2xTj/6roy /8CKHv+3ghL/t4MN/8+cH//wvjn//9BD//nJN//puiT/8bko//O8Gf/ztRT/9bEg//KvGv/q qgD/77MH/+yvFv/wtRP/87kX//fBIP/6yir//dEy//zWN//82jv/+9o9//rdQ//73kT//N9D //7gRP/+3UD//Nw8//rYOf/41jf/+c8r//fMJ//2xx//+MQZ//e7D//0sgT/+bEE//+1Bv+e aQD//+zZ//f6/////fb///v///j//f/5//b///X///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////v//////u7/+//9//3x5f+mYAH/+qsJ/+2uCf/8qxH/9bUX//W2Gf/2 uSD/9r0m//jBMP/4xTb/+cg9//nKQP/y00X/89RI//XTS//31U//+NVT//zWV//911r//ddc //HUSv/z1kr/9tpL//vcTf/83En/+9xG//vZQv/62EH//dU3//7TNv/80jD/+9Ar//nPJf/4 zCH/9ssc//fKGf/1yhv/9cob//fJG//3yhn/98gW//fIFv/4xxP/+McT//jEFv/4xBb/+MQW //fDFf/3wxX/9sIU//bCFP/2whT/+L4S//e9Ef/3vRH/970R//a8EP/2vBD/9rwQ//W7D//x tQf/87cL//m9Ef/1uA//664F/+yvBv/ztg3/8bUJ//+sAf//rwn//7ES//2wFP/2rg7/8a4F //G1AP/0uwD/96kh//erIf/3rx//97Ed//WzF//ysxD/8LEM/+2wCP/quAH/6bcC/+u2BP/s twf/77cK//G4D//xuBH/8bYQ//eqIP/4rBv/9KkS//CmCf/yqAv/964U//asGf/xphf/8rcB /+2yAP/ssAD/77IJ//CxDP/srAz/66sN/+6uEP/ssAT/7LAE/+ywBP/ssAT/7LAE/+ywBP/s sAT/7LAE/+uvA//rrwP/668D/+uvA//rrwP/668D/+uvA//rrwP/6K4E/+iuBP/orgT/6K4E /+iuBP/orgT/6K4E/+iuBP/nrQT/560E/+asA//mrAP/5qwD/+WrAv/lqwL/5asC/+CiAP/o qgf/4aMC/+mrCv/oqgn/56kI/+CiAP/srgv/1YgS/8J5AP/rqxb/98Ad//TGG///1y//9M4v ///aQ//33jv/+OA+//vjQf/950b//uhH//zoSf/66Er/+edJ//3tUv/+60///OhL//zkRv/8 4EH//Nw8//vZOf/61zX//9g0///UMf/3xBP//MMU//OxFf//vCD/zIUA/61gBP/+uhf/+bgU //m6F//+wib//8Uz/+yzLv/EjhT/o2sA/9CXI//lrzX//MdF///NQP/zwSr/6LsY/+3BFv/3 zB3/9cYe//fHC//2wgz/87cZ/+2vDP/1vwD//McH//3FJv/0vRr/98Eg//nHJv/7zy7//dU1 //zaO//63D7/+t4///ngSP/64Un//OFK//3iSf/94Eb//N1E//nbP//32T3//NIu//jNKP/4 yCD/+cMZ//a6Dv/yrwD/97AA//+2Bf+tdwD/8Ni+//f3////+/j///7///j/+//5//b///j/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////v//////u7/+//9//3x5f+m YAH/+qsJ/+2uCf/8qxH/9bUX//W2Gf/2uSD/9r0m//jBMP/4xTb/+cg9//nKQP/71FX/+tNS //nRTv/40Ez//NJM///WTP//2k///91S//LOU//00VP/+tRV//zXVf/+11T//dVP//rTSv/4 0Uj//dQ+//7SO//80TX/+88u//jNJv/3yyD/9cob//bJFv/1yhv/9cob//fKGf/3yhn/98gW //fJFP/4xxP/+McT//jEFv/4xBb/+MQW//fDFf/3wxX/9sIU//bCFP/2whT/+L4S//e9Ef/3 vRH/970R//a8EP/2vBD/9rwQ//W7D//ztwf/7rIE//S3Dv/5vBT/9bgS//S3Ef/0txH/8LML /+m8GP/nuQv/5LcA/+a2AP/quAD/8boA//W5Cf/3uBH/87kA//K4AP/vtwD/7bYE/+y2C//t uBD/77sX/+++G//zrRn/97Ed//q0IP/5sx//9rAc//awHP/5sx//+7gj/+W+GP/rwhj/68AR /+e2Av/ksAD/7LEA//GzAP/zsgD/4asB/+ivBv/utQz/8rgP//K2Cv/ytQX/9LYD//a4A//s sAT/7LAE/+ywBP/ssAT/7LAE/+ywBP/ssAT/7LAE/+uvA//rrwP/668D/+uvA//rrwP/668D /+uvA//rrwP/6K4E/+iuBP/orgT/6K4E/+iuBP/orgT/6K4E/+iuBP/nrQT/5qwD/+asA//m rAP/5asC/+WrAv/lqwL/5KoB/+WnBP/nqQj/3qAA/+epCv/howL/3J4A/+yvCf/hpAD/7aAu /7VsAP/gngz/87wZ//PDF///1C3/7MYn//7ZQP/33jv/+eA9//vjQf/+5kT//uhH//vnSP/6 5kf/+OZI//3tUv/87FH//ehN//3lR//84EH//Nw8//vZOf/72Db//dYx//PHKv/9zRX//8Ub //awKv/0sQr//LkS/6BSAP/clwD/9bEQ///EJf/zsx3/xYgA/69zAP/Mkib/971a//7KKf/2 xCP/8L4d//HCHv/3yCT/+Msn//XIJP/wwx//8sUk//XJEv//zSH//sEz/+qvF//+yAz/7rwF //K6L//4wiH/+sYk//zMKv/+1DL//dk6//3dPf/63j//+N4///fhTf/64k7//ORO//3jTv/9 4kv/+t9G//ncQ//32kH//tQw//rNKf/5ySH/+sQa//a4C//wrQD/9a4A//+3BP+6hAD/48qs //T0/v///Pv///7///L+9P/1//D///f///////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////n/////+P/////v///17P+ldTf/+KAI//qgBP/rsgH/9bMf//a2If/2uij/974v //jFOP/4ykD/+M5E//jRSP/50Uv/+dFL//rSTv/61E//+dRQ//rVU//51lT/+dZU//nXUv/5 11L/+ddR//jWUP/41k7/+NdM//fWS//31kv/+tZC//rVP//51D3/+dI3//jSM//30C3/+M8p //fOKP/6yRf/+skX//rJF//6yRf/+cgW//nIFv/4xxX/+McV//jFFP/4xRT/98QT//bDEv/1 whH/9cIR//TBEP/0wRD/+L8Q//e+D//3vg//974P//a9Dv/2vQ7/9r0O//W8Df/zugv/9bkL //W5C//1twr/9bcK//W2Cf/1tgn/97UJ//SxCP/ysgj/8rII//K0Cf/ztQz/87YN//O2Df/y uA7/8LUP//C1Ef/wtRP/8LYW/++3GP/wuBv/77gd//C5IP/vuyf/77sn/++7J//vuyf/77sn /++7J//vuyf/77sn//C6Iv/vuSH/7rkf/+64Gv/uthf/7bYV/+60Ev/utRD/7bQL/+60C//t swn/7rEI/+2vBv/srgX/7KwE/+ysBP/srwb/7K8G/+yvBv/srwb/7K8G/+yvBv/srwb/7K8G /+yvBv/srwb/7K8G/+uuBf/rrgX/664F/+qtBP/qrQT/6q0F/+qtBf/prAT/6awE/+msBP/o qwP/6KsD/+irA//nrAj/56wI/+arB//mqwf/5qsH/+WqBv/lqgb/5aoG/+WnCP/lpwj/5acI /+WnCP/kpgf/5KYH/+OlBv/jpQb/4aQA/9+VMv+oXwD/8rUE///GGv/yvRX/+MsY//7TL//5 1jT/+dg1//raOf/63j3/++NF//vnSv/86U3/++tO//3mSP/950b//eVF//zkQv/74kD//OA+ //vfPf/83zv/+9M2//DGIv/+0yT/+skU/+21AP//wxb//bcX/9WMAP+8axL/+atJ/+eeL/+w bAD/v4IA/+ewFf/zwSD/+cgj//nJKf/6yir/+cwr//rMLv/6zjH/+s8y//vQNP/60jX/98op //fKKf/3yyr/+Mwr//fNK//2zyz/99At//fQLf/40Sz/+dIv//jVM//42Dj/+ds///jdRP/4 4Ej/+eFL//vnUP/65k//+uVM//nkS//640j/+uFG//ngRf/54EX/+txA//rYOf/50TH/+Mkl //i/GP/3tw3/+LAD//isAP//pAH/m1og///2///4////+P/r////8//7+P//+Pv///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////n//////P/////x///17/+ldzz/+KAK //qgBP/qsQL/9bMe//W1IP/1uSX/978u//fENf/4yT3/+c5E//nPRf/70Un/+dJJ//rSTP/5 007/+dRP//rVUf/41lH/+dZU//vWUf/71lH/+tVQ//rWTv/61kz/+dVL//nVSf/51Un/+tU/ //rVP//51Dv/+dI1//jQMP/30Cv/+M8p//fOJv/6yRf/+skX//rJF//6yRf/+cgW//nIFv/4 xxX/+McV//jFFP/4xRT/98QT//bDEv/1whH/9cIR//TBEP/0wRD/+L8Q//e+D//3vg//974P //a9Dv/2vQ7/9r0O//W8Df/zugv/9bkL//W5C//1twr/9bcK//W2Cf/1tgn/97UJ//SxCP/y sgj/87MJ//K0C//ztQz/87YN//S3Dv/yuA//8bYU//K3Ff/xtxf/8rcb//G5Hv/xuiH/8boi //K6Jf/xvSz/8b0s//G9LP/xvSz/8b0s//G9LP/xvSz/8b0s//C8KP/xuyf/8Lok//C5IP/w uB3/77ca//C2F//vtRX/7rUO/+20Df/tswr/7rEJ/+2wCP/trwb/7K4F/+ysBP/srwb/7K8G /+yvBv/srwb/7K8G/+yvBv/srwb/7K8G/+yvBv/srwb/664F/+uuBf/rrgX/6q0E/+qtBP/q rQT/6q0F/+qtBf/prAT/6awE/+irA//oqwP/6KsD/+irA//nrAj/5qsH/+arB//mqwf/5aoG /+WqBv/lqgb/5KkF/+WnCP/lpwj/5acI/+SmB//kpgf/5KYH/+OlBv/jpQb/36EA/+WhGP+7 cwD/2JUJ//W5Df//zB7/8cAb///VJ//61DH/+dYy//rZNv/63Dz/++FC//zlR//76Uv//OlN //3mSP/95UX//ORE//zjQf/74kD//OA+//zfPf/73jr/9Mwu///aNv/xxhj//s0b///PIP/s rQj/8q0S///CL/+tWwD/wnQH/8iBBf/YlAv/8rYg/++3Gv/mshD/+Mci//nMK//5zCv/+c0u //rOL//6zzL/+tI1//rSNf/70zb/+c0s//nNLP/5zy3/+tAu//nSL//40i//+dMw//nTMP/6 1DH/+9Uy//rYOP/72zv/+t1B//ngRv/64kr/++NL//zoU//86FP//OZS//vmT//85Ez/++JK //rhR//64Uf/+tw+//rYOf/50TH/+com//fBGf/4uA7/+LIF//iuAf//qwD/rW4h//LZ3P/8 ////+P/w//79+P///P///v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //n/+////P/////z///59v+qfUb/9Z8M//yhCv/qrgL/9LEa//WzHv/1uCL/9r4r//fDMv/3 yDr/+M1C//jPQ//60Eb/+tBG//nSR//600r/+dNM//nVTf/61VD/+tVQ//rWTv/61k7/+tZM //nVS//51Un/+dZI//jVR//41UX/+tU+//nUPf/60zj/+NIz//jRLv/4zyn/984m//fNI//6 yRf/+skX//rJF//6yRf/+cgW//nIFv/4xxX/+McV//jFFP/4xRT/98QT//bDEv/1whH/9cIR //TBEP/0wRD/+L8Q//e+D//3vg//974P//a9Dv/2vQ7/9r0O//W8Df/zugv/9bkL//W5C//1 twr/9bcK//W2Cf/1tgn/97UJ//SxCP/ysgj/87MJ//O1DP/0tQ7/87YO//S3Ef/ytxH/9Lgc //O4HP/0uR//87oj//S7Jv/zuyj/87wr//O8LP/zvjL/874y//O+Mv/zvjL/874y//O+Mv/z vjL/874y//K9L//yvi3/87wr//K8KP/yuiX/8bgh//C3H//wuB3/7rUQ/+61EP/ttA//7bIM /+6xCf/srwf/7K4F/+yuBf/srwb/7K8G/+yvBv/srwb/7K8G/+yvBv/srwb/7K8G/+yvBv/r rgX/664F/+uuBf/qrQT/6q0E/+qtBP/qrQT/6awE/+msBP/prAT/6awE/+irA//oqwP/56oC /+eqAv/mqwf/5qsH/+arB//lqgb/5aoG/+WqBv/kqQX/5KkF/+WnCP/lpwj/5KYH/+SmB//k pgf/46UG/+OlBv/jpQb/4qEP/+KlAP/gmhj/sGUA/+yuD//9xRb/9sEj//3RGv/70S3/+tMw //nWNP/62jn/+98+//vjQ//85Uf/++dK//3lR//95UX//eNE//viQP/84D///N89//vePP/7 3jr//9o5//fNKf//2jH/9cUZ//fAG///yi7/8K4c//KtIv+4agD/zYMA/+GaDv/vrRj/+Lwe //O8G//xvRv//soo//rOLf/60DD/+tAw//rSNP/70zX/+9Q3//rWOv/61jr/+9Mz//vTM//7 1TT//NY1//vYNv/62Tb/+9o3//vaN//82zj//ds7//3dPf/930H//OJF//zjSf/95U3/++ZN //7pWP/+6lf//uhW//3nU//+5lL//eNO//zjS//840v/+tw+//raOv/50zL/+Msn//jDHf/4 uxL/97UJ//iyBf//sgD/yIki/8WlkP///f//+fv6//z8/v///v///v/9//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////b99v///P/////0///8+/+yiFb/75oL//2iDf/q rAP/9bAX//WyG//2tiD/9bwn//bCMP/3xzf/+Ms8//jNQP/6z0L/+dBC//rRRf/50kb/+tNI //nTSv/51Uv/+dVL//rVSf/61Un/+tVI//nUR//51EX/+dVD//jUQv/41EL/+9Q7//rTOP/5 0jX/+NAw//nPK//3zib/980j//bMIP/6yRf/+skX//rJF//6yRf/+cgW//nIFv/4xxX/+McV //jFFP/4xRT/98QT//bDEv/1whH/9cIR//TBEP/0wRD/+L8Q//e+D//3vg//974P//a9Dv/2 vQ7/9r0O//W8Df/zugv/9bkL//W5C//1twr/9bcK//W2Cf/1tgn/97UJ//WzB//ztAf/87MJ //O1DP/0tQ7/9LYT//S2E//zuBb/9boi//a6JP/0uyb/9bsp//W8Lf/1vjD/9b0y//a+M//1 vzj/9b84//W/OP/1vzj/9b84//W/OP/1vzj/9b84//TAOP/0vzX/874y//S9L//zvCv/87so //O6Jf/yuST/7bUW/+22Ff/utBT/7bMR/+yxC//tsAj/7K8H/+2vBv/rrgX/664F/+uuBf/r rgX/664F/+uuBf/rrgX/664F/+uuBf/rrgX/664F/+qtBP/qrQT/6q0E/+msA//prAP/6awE /+msBP/oqwP/6KsD/+irA//nqgL/56oC/+eqAv/mqwf/5qsH/+WqBv/lqgb/5aoG/+SpBf/k qQX/5KkF/+SmB//kpgf/5KYH/+SmB//jpQb/46UG/+KkBf/ipAX/4aQO/+WrAP/ppRL/t2sL /86JCv/zuRD/+MQY//zKHf/5zin/+s8q//nSLf/61zP/+9s6//vfPv/74UL//ORG//zkRv/9 40T//OJD//3hQP/83j7/+948//zcO//83Dn/99Eu///kP//4zSj/+ssn//bBI//zuiX/9bYr /7RxAP/hlwT/9q8Z//+9IP/ytBH/6K8K//XAGv//ziz//csq//rSMv/70zP/+9U2//rWN//7 1zn/+9g8//zZPf/72j3//to7//3bO//92zv//d08//7ePf/94D7//OA+//3hP///4UH//+JC ///jRP/+5Ef//+ZL///oTP//6E3//ulO///rWv//6ln//+lY//7oVv//51P//+VS//7kT//9 407/+tw8//raOv/61DP/+c4q//nFIf/4vxb/+LoR//a2DP//tAD/4qQf/6R7R///9vD///r/ //v7///////////6//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////f89f// /P///v/2//79//+/mWz/4pAG//+jEv/pqgP/9K8T//OxFf/1th3/9rok//bALP/2xjT/98o5 //fNPf/5zz3/+c89//rQPv/60UH/+dNE//nTRP/51Ef/+dRH//nURf/51EX/+dVD//jUQv/4 1ED/+NQ+//fTPf/31Dz/+tM4//rSNf/50TP/+c8t//jPKf/3zSP/98we//bLHP/6yRf/+skX //rJF//6yRf/+cgW//nIFv/4xxX/+McV//jFFP/4xRT/98QT//bDEv/1whH/9cIR//TBEP/0 wRD/+L8Q//e+D//3vg//974P//a9Dv/2vQ7/9r0O//W8Df/zugv/9bkL//W5C//1twr/9bcK //W2Cf/1tgn/97UJ//WzB//ztAf/9LQK//S1Dv/1thH/9LYV//W3GP/ztxn/9Lsm//W8J//1 uyn/9bwt//W+MP/2vjP/9L81//W/OP/2wDr/9sA6//bAOv/2wDr/9sA6//bAOv/2wDr/9sA6 //XBOv/0wDj/8781//O+Mv/0vS//87ws//O7Kv/yuif/7bYd/+62G//ttRj/7rQU/+2yEP/s sQv/7bAI/+2wB//rrgX/664F/+uuBf/rrgX/664F/+uuBf/rrgX/664F/+uuBf/rrgX/6q0E /+qtBP/prAP/6awD/+msA//prAP/6KsD/+irA//oqwP/6KsD/+eqAv/nqgL/5qkB/+apAf/l qgb/5aoG/+WqBv/kqQX/5KkF/+SpBf/jqAT/46gE/+SmB//kpgf/46UG/+OlBv/jpQb/4qQF /+KkBf/ipAX/4KUD/+2vDP/XlQD/45kg/65iAv/mphD/9cAC//rCJf/5yiL/+ssl//rPKv/6 0y7/+tc1//vbOv/73T3//OA///ziRf/84kP//eFC//zgP//73T3//Nw7//vbOv/82zj/9tAt //zVMv//3Dr/8cMl//rHLv/mrx7/s3gA/9idFf/2tRP/7awI//G0DP/5wRb/98MY//jIIP/9 zSv/+cwr//vXOP/62Dj/+9k5//vbO//82z7/+90///veQv/830P//uBC//7gQv/+4kP//eNE //3jRP/95UX//uZG//3nRv//6Er//+hK///oSv//6E3//+lN///qTv//6k///+pP///rWv// 61j//+lX//7oVP//51P//+VQ//7lTf/95Ez/+tw8//raOf/51jT/+c8r//jJI//4wx3/974V //i7E//5sgD/87IW/6BuF//73Mj///r///v9///+//////75//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////v+9f///P///P/4//v+///QrYP/1IMA//+kGP/rqgb/860P //SvE//0sxf/9bog//a/J//2xC//98k2//fLN//6zjn/+s45//nPO//60Dz/+tI///jSQf/5 00L/+NRC//nTQP/500D/+dQ+//nUPv/40zz/+NM6//fSOf/30jn/+tI0//nRM//60C7/+dAq //jOJP/3zB7/9ssc//bLGv/6yRf/+skX//rJF//6yRf/+cgW//nIFv/4xxX/+McV//jFFP/4 xRT/98QT//bDEv/1whH/9cIR//TBEP/0wRD/+L8Q//e+D//3vg//974P//a9Dv/2vQ7/9r0O //W8Df/zugv/9bkL//W5C//1twr/9bcK//W2Cf/1tgn/97UJ//WzBf/0tQj/9LQK//S1Dv/1 thP/9bcY//W2G//0uBz/9Lsm//S7Jv/0vCn/87wr//S9L//zvjL/9L81//O/N//1vzj/9b84 //W/OP/1vzj/9b84//W/OP/1vzj/9b84//LAOf/ywTj/8781//G+Mf/xvC7/8rsq//G7J//y uif/7rYh/+63H//utR3/7LQX/+2zE//tsg7/7LIJ/+yyCP/qrQT/6q0E/+qtBP/qrQT/6q0E /+qtBP/qrQT/6q0E/+qtBP/qrQT/6q0E/+msA//prAP/6awD/+irAv/oqwL/6KsD/+irA//o qwP/56oC/+eqAv/mqQH/5qkB/+apAf/lqgb/5aoG/+SpBf/kqQX/5KkF/+OoBP/jqAT/46gE /+OlBv/jpQb/46UG/+OlBv/ipAX/4qQF/+KkBf/howT/5KsE/+CfD//enQD/56EL/8d5Ff/B ewD/97wI//K3H//5xh3/+8gh//rLJf/6zyr/+tMu//rXM//82zj//Nw7//3gRP/94UL//OBB //zePv/93T3/+9s6//vZOf/72jf/9tAt///XN//twyP//dA1//PELP/MmgX/36sZ//fAMP/0 uRX/67IL//C6EP/9yh//+80i//bLJv/70TH//9c6//zcO//83Dv/+909//vfQP/84EH//OJF //ziRf/840j//ORG//3lR//95Uf//eZI//zoSf/96Ur//OpK//3rS///61D//+pP///rTv// 607//+tO///rTv//607//+tO//7qVf/+6lP//ulS//3oT//+5k7//eRK//zjSP/840j/+t48 //ncOv/52DX/+dIv//jLJ//3xiH/98Ic//a/Gv/2sQD/+rgM/7uACP/bsYn///r///v+///7 //z//vr5//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////7/9v/99///+//6 //f+///gwJr/xXYA//+lGv/uqgn/8qwM//OvEP/zsxX/9bkd//W+Jf/2wyz/9scz//fJNv/5 zjT/+s43//rON//50Dr/+dE7//rSPf/40j//+dNA//nUPv/51D3/+NM8//jTOv/30zf/99M3 //fTNf/30zX/+dEz//vRMf/5zyv/+c4n//jMIf/3zB3/+Msa//fKF//6yRf/+skX//rJF//6 yRf/+cgW//nIFv/4xxX/+McV//jFFP/4xRT/98QT//bDEv/1whH/9cIR//TBEP/0wRD/+L8Q //e+D//3vg//974P//a9Dv/2vQ7/9r0O//W8Df/zugv/9bkL//W5C//1twr/9bcK//W2Cf/1 tgn/97UJ//a0Bv/0tQj/9bUL//S1EP/1tRX/9bYZ//a3Hv/0tyD/8boi//K7I//yuiX/8rsq //G9LP/yvS//8b4x//K+NP/zvjT/8740//O+NP/zvjT/8740//O+NP/zvjT/8740//HAN//w vzT/774x//C9Lv/wvCv/77sp//C6Jv/vuSP/7rcm/+62I//tth7/7bUa/+y1FP/ttA//7bIM /+yyCf/qrQT/6q0E/+qtBP/qrQT/6q0E/+qtBP/qrQT/6q0E/+qtBP/qrQT/6awD/+msA//p rAP/6KsC/+irAv/oqwL/6KsD/+eqAv/nqgL/56oC/+apAf/mqQH/5qkB/+apAf/lqgb/5KkF /+SpBf/kqQX/46gE/+OoBP/jqAT/4qcD/+OlBv/jpQb/46UG/+KkBf/ipAX/4qQF/+GjBP/h owT/5qsP/9aWAf/npQb/2ZUA/+2jHv+wZQD/5qIZ/++xEP/5wxn/+sUd//vIIf/7zCb/+9Ar //vUMf/72Db/+9o3//3gRP/84EH//N5A//3dPf/83Dz//No6//vZOf/72Db//+BB/+bAIf/9 1Tj/+s8z/+G0Gf/0xiv//9A1//vKL//1vx///ckn///PKv/4zCP/88ok//XPLP/82jv//+FE //vfPv/84D///OA///ziQ//85Eb//eVH//3mSv/95kr/++dK//vnSv/750r/++lL//rqTP/7 603/+uxN//vtTv/+7lP//u5T///sUP/+60///utP//7qTf/+6k3//upN//zpTf/86U3//OdM //vnSv/85Uf/++NF//riQv/64kL/+t48//ncOv/52DX/+dMw//nOKv/4ySX/98Yh//fDH//3 sxL//LcE/+CfDf+zg0X///r2//n//f/5//n///n///////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9P/69P//+f/7//b8///oyqb/vm8A//+lHf/vqwr/9KwM//SuDv/0 shX/9Lgc//S9JP/2wyz/9scx//fJNf/6zTT/+c40//rPNf/50Dj/+tE7//nRO//40z3/+NM9 //rSPP/60jz/+tM6//rTOP/50jf/+dI1//jRNP/40jP/+9Ex//rQLv/5zyv/+c4n//jMIf/2 yxz/98oX//fKF//6yRf/+skX//rJF//6yRf/+cgW//nIFv/4xxX/+McV//jFFP/4xRT/98QT //bDEv/1whH/9cIR//TBEP/0wRD/+L8Q//e+D//3vg//974P//a9Dv/2vQ7/9r0O//W8Df/z ugv/9bkL//W5C//1twr/9bcK//W2Cf/1tgn/97UJ//a1Bf/0tQb/9bUL//W2Ef/2thb/9bYb //a2IP/0tyH/8Lkg//G6If/wuiL/8bsn//C8Kv/wvSz/8L0u//G+Mf/yvTH/8r0x//K9Mf/y vTH/8r0x//K9Mf/yvTH/8r0x/+/ANP/vvjP/7r0w/++8K//uvCn/7rom/++5I//uuCD/7rcn /+63Jv/utiH/7bYd/+y0Ff/ttA//7LMM/+2zCv/qrQT/6q0E/+qtBP/qrQT/6q0E/+qtBP/q rQT/6q0E/+qtBP/qrQT/6awD/+msA//oqwL/6KsC/+irAv/oqwL/56oC/+eqAv/nqgL/56oC /+apAf/mqQH/5qkB/+WoAP/kqQX/5KkF/+SpBf/jqAT/46gE/+OoBP/ipwP/4qcD/+OlBv/j pQb/4qQF/+KkBf/ipAX/4aME/+GjBP/howT/4KMU/+ClA//UkQD/5qIB/+unAP/Hew3/xHgW //O2Bv/6wRj/+cMZ//rHHv/6yyP/+s8q//rTLv/81jP/+9g0//zfQ//930H//N5A//3dPf/8 2jv/+9k5//vXOP/72Db/+tQ1///YO//40DP/+9A0//zRNf/4zC3/+84t//vOKv//zjH/+ckp //HGIv/50Cr//ts1//jXNP/y1Db/+t1D//zgP//74kD//OJD//zkRP/85Uf//eZK//zoS//9 6Uz/+uhK//roSv/76Uv/+elL//nrTP/67E3/+u5O//ruTv/97lX//e5T//3tUv/87E///epO //3rTf/96Uz//elM//vpS//66Ej/+uZH//nlRP/65EP/+uJA//niPv/54j7/+t48//ncOP/6 2Tb/+dMw//nPK//3yif/98gk//bFIv/5tSL/+7UA//q2Ff+YZBn///nt//f+9//5//j///v/ //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////5///8//T/9v/5///7//// 5tz/ll8A//evD//xngD/9KoN//SrDv/0sBH/9rQV//W6GP/4vhz/98Ie//jEIP/3yS7/98ku //jKL//4yzD/+M0x//jNMf/3zzL/988y//rNMv/6zTL/+s0y//rOMf/6zi//+s4v//rOLf/6 zi3/+8we//vMHP/6yxv/+ssZ//rLGf/5yxb/+csV//nLFf/5yRH/+ckR//nJEf/4yBD/+MgQ //jIEP/3xw//98cP//fCEP/3whD/9sEP//bBD//2wQ//9cAO//XADv/1wA7/974M//e+DP/3 vgz/9r0L//W8Cv/0uwn/9LsJ//O6CP/1ugj/9boI//W6CP/0uQf/9LkH//O4Bv/zuAb/87gG //e2BP/1tgb/9rcK//W3Dv/1thP/9bcY//W2G//zth3/87oi//O6Iv/zuiP/87sm//K8Jv/y vCj/8b0p//G9K//xvC7/8bwu//G8Lv/xvC7/8bwu//G8Lv/xvC7/8bwu//G8Lv/wuy3/8rsr //G6Kv/xuSj/8bcl//G3Jf/xtyX/7bQl/+2zI//ttB//7bIa/+yyE//ssQ3/7bAK/+2wCP/r rAX/66wF/+qrBP/qqwT/6qsE/+mqA//pqgP/6aoD/+ipAv/oqQL/6KkC/+ipAv/oqQL/6KkC /+ipAv/oqQL/6KoJ/+epCP/nqQj/56kI/+aoB//mqAf/5qgH/+aoB//lpwb/5acG/+WnBv/l pwb/5KYF/+SmBf/jpQT/46UE/+OkB//jpAf/46QH/+KjBv/iowb/4qMG/+GiBf/hogX/4Z8N /92bBv/YlwD/358A/+OiCP/PjAD/w34A/9GKFP//xAD/9LYJ//7BK//2vyf//c0h//XMGP// 2DX/+tFF//7ZMv/92jT//Ns2//vbOP/53Dr/990+//beQP/23kD/+tk8//nYO//52Dv/+dg7 //jXOv/41zr/+Nc6//fWOf/51jT/+dY0//nYNf/62Tb/+to3//ncOP/63Tn/+t86//vkSf/7 5En/+uVK//vmS//650v/++hM//rqTf/66k3//vBS//7wUv/+8FL//vBS//7wUv/+8FL//vBS //7wUv/+7lH//u5R//3tUP/97VD//e1Q//zsT//87E///OxP//zoSf/+50n//eZI//3lR//9 5Uf//eNG//ziRf/+4UX/+9s6//vZOf/61zX/+tMu//nOKf/5yiT/+scg//nGHf/uvgD/+akW //+tCf+7fgD/69Gu//X6///3//7////4//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////7///8//T/+f/9///8////7+X/mmUJ//GqEP/0nwD/86kM//SrDv/1rxH/9bMU //e5GP/3vRv/98Ie//jDH//5ySv/98kr//fJK//3yyz/980t//jOLv/2zi7/988v//rOL//6 zi//+s4v//rOLf/6zyv/+s8r//rPKv/6zyr/+8wc//rLG//6yxv/+ssZ//nLFv/5yxb/+csV //jKFP/5yRH/+ckR//nJEf/4yBD/+MgQ//jIEP/3xw//98cP//fDD//3ww//9sIO//bCDv/2 wg7/9cEN//XBDf/1wQ3/974M//e+DP/3vgz/9r0L//W8Cv/0uwn/9LsJ//O6CP/1ugj/9boI //W6CP/0uQf/9LkH//O4Bv/zuAb/87gG//e2BP/1tgb/9bYJ//W3Dv/1thP/9LYX//W2G//z th3/9Lkh//K5If/zuiL/8rsj//G7Jf/yvCb/8Lwo//C8KP/yuyv/8rsr//K7K//yuyv/8rsr //K7K//yuyv/8rsr//C7Lf/wvCv/8boq//G6Kf/xuSj/8bcl//C3Iv/ytiL/7bMj/+2zIf/s sxz/7bIY/+2xEv/rsAz/7bAK/+yvB//rrAX/66wF/+qrBP/qqwT/6qsE/+mqA//pqgP/6aoD /+ipAv/oqQL/6KkC/+ipAv/oqQL/6KkC/+ipAv/oqQL/56kI/+epCP/nqQj/56kI/+aoB//m qAf/5qgH/+WnBv/lpwb/5acG/+WnBv/kpgX/5KYF/+SmBf/jpQT/46UE/+OkB//jpAf/4qMG /+KjBv/iowb/4aIF/+GiBf/hogX/4qAO/+SiDf/cmwD/2JgA/+OiCP/lohX/z4oJ/7hyAP/u rwL//L0Y//G1Fv/0vRj//9Ai//DFF//3zSv//9lD//3YMf/82TP/+9o1//vbOP/53Dr/+d0+ //fdQP/23kD/+9o9//vaPf/72j3/+9o9//rZPP/62Tz/+dg7//nYO//61jf/+tg4//vZOf/7 2zr//Nw7//vePP/73z3//OA+//zlSv/95kv/++ZL//znTP/86U3//epO//vrTv/7607//vBS //7wUv/+8FL//vBS//7wUv/+8FL//vBS//7wUv/97VD//e1Q//3tUP/97VD//OxP//zsT//8 7E//++tO//zoSf/+50n//eZI//3lR//95Uf//eNG//ziRf/+4UX//Nw7//zaOv/61zX/+tMw //rPKv/6yyX/+Mgg//nGH//3xwX/+qwW//+vCv/UlAD/waV2//r5///5/////v72//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////8///4+/L/+//9//36////+u//pXUp /+afE//3oAD/8qgJ//SqC//0rg7/9LMR//a4Ff/2vRj/98Ab//fCHP/3yCT/+Mkl//bJJf/3 yib/98wn//fOKP/3zij/+M8p//nOKf/5zin/+c4n//nOJ//5zyX/+c8j//nPI//5zyP/+ssb //rLG//6yxn/+coY//nLFv/5yxX/+MoU//jKEv/5yRH/+ckR//nJEf/4yBD/+MgQ//jIEP/3 xw//98cP//fDD//3ww//9sIO//bCDv/2wg7/9cEN//XBDf/1wQ3/974M//e+DP/3vgz/9r0L //W8Cv/0uwn/9LsJ//O6CP/1ugj/9boI//W6CP/0uQf/9LkH//O4Bv/zuAb/87gG//a1Bf/0 tQb/9bYJ//S2Df/0tRD/9LYV//S2F//ythj/87ge//O4Hv/yuh//8rkh//G6Iv/xuyP/8bsl //G7Jf/xuin/8bop//G6Kf/xuin/8bop//G6Kf/xuin/8bop//G6Kv/xuin/8Lko//C4Jf/x tyX/8Lci//G1H//xtR//7LMe/+yzHP/tshr/7LEV/+ywEf/srgv/7K8H/+yuBf/rrAX/66wF /+qrBP/qqwT/6qsE/+mqA//pqgP/6aoD/+ipAv/oqQL/6KkC/+ipAv/oqQL/6KkC/+ipAv/o qQL/56kI/+epCP/nqQj/5qgH/+aoB//lpwb/5acG/+WnBv/lpwb/5acG/+SmBf/kpgX/5KYF /+OlBP/jpQT/46UE/+OkB//iowb/4qMG/+KjBv/hogX/4aIF/+GiBf/hogX/46EN/+KhCf/d nAD/2ZgA/+GgCP/tqhv/3JgT/7p0AP/PiQP//bwi//K2CP/xugX//80e//bFIP/zxiX//tMv //zXMP/81zH/+9g0//vaN//53Dr/+d0+//jeQf/43kH//N5C//zeQv/83kL/+91B//vdQf/6 3ED/+txA//rcQP/82jr//No6//zcO//+3j3//eA+//3hP//+4kD//uJA//7nTP//6E3//ehN //7pTv/+60///+xQ//3tUP/97VD//e9R//3vUf/971H//e9R//3vUf/971H//e9R//3vUf// 7FD//+xQ//7rT//+60///utP//3qTv/96k7//epO//zoS//+50v//eZK//3kSf/95En//eNI //ziR//+4Uf/+909//zcO//72Db/+tQx//vQLP/5zCj/+skk//rHIP/9zRH//LMY//+xC//u rRP/lXIw///29f/8////+vvz//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///+///5+vX//f/8///+////+/T/u5RZ/9KOE//8oAD/86YI//OpCv/0rAz/9bEQ//W2E//2 uxf/9b4Z//fAG//3xxv/9sgb//fJHP/2yx3/98we//bMHv/2zh//9s4f//jMIf/4zR//+M0f //jNHv/4zR7/+M0c//jNHP/4zhr/+ssZ//rLGf/5yhj/+csW//nLFf/4yhT/+MoS//jKEv/5 yRH/+ckR//nJEf/4yBD/+MgQ//jIEP/3xw//98cP//fDDf/3ww3/9sIM//bCDP/2wgz/9cEL //XBC//1wQv/974M//e+DP/3vgz/9r0L//W8Cv/0uwn/9LsJ//O6CP/1ugj/9boI//W6CP/0 uQf/9LkH//O4Bv/zuAb/87gG//W0BP/ztAX/9LUI//O1DP/ztA3/87US//O1FP/xthT/87cZ //K3G//ytxv/8bke//G4IP/wuSD/8Loi//C6Iv/xuSb/8bkm//G5Jv/xuSb/8bkm//G5Jv/x uSb/8bkm//C6Jv/vuSX/8Lgl//C3Iv/vth//8bUf//C1Hf/xtB3/7bIa/+yxF//ssRX/668Q /+yuDf/rrgj/66wF/+utBP/rrAX/66wF/+qrBP/qqwT/6qsE/+mqA//pqgP/6aoD/+ipAv/o qQL/6KkC/+ipAv/oqQL/6KkC/+ipAv/oqQL/56kI/+epCP/mqAf/5qgH/+WnBv/lpwb/5acG /+WnBv/kpgX/5KYF/+SmBf/kpgX/46UE/+OlBP/ipAP/4qQD/+KjBv/iowb/4qMG/+GiBf/h ogX/4aIF/+ChBP/goQT/5KIN/9eWAP/bmgD/46II/96dBf/fnQv/4p4V/9qWEf+4bQf/5qMW ///EDv/uuAD/+sUV///KKv/3xiP/8cIU//rTLf/71C//+9Uy//nYNf/62jn/+tw+//rdQf/5 30L//uBE//7gRP/+4ET//uBE//3fQ//930P//N5C//zeQv/+3D3//t4+///fP//+4ED//uJB ///jQv/+5UP//+ZE///pTv//6U7//+pP///qT///7FD//+1R///vUv//71L//e1Q//3tUP/9 7VD//e1Q//3tUP/97VD//e1Q//3tUP/+60///utP//3qTv/96k7//epO//zpTf/86U3//OlN //zoS//+50v//eZK//3kSf/95En//eNI//ziR//+4Uf//N5A//vdPf/82jr//NY1//vRLf/6 zSn/+ssl//rJJP/5yxb//roZ//+yCv/5tRb/jmMH///s2////v//9/3z//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////7////+/P3/+vn3/////f//+vT/2LqU/7x5Ef// oQD/86UF//OnBv/0qgn/9K8M//W0EP/2uRP/9r0W//W/F//2xxf/9scX//fIGP/2yRj/9coZ //bLGv/2zRv/9s0b//nLHf/5zBv/+cwb//nMGf/5zBn/+cwX//nNFv/5zRb/+coY//nLFv/5 yxb/+MoU//jKFP/4yhL/98oP//fKD//5yRH/+ckR//nJEf/4yBD/+MgQ//jIEP/3xw//98cP //fDDf/3ww3/9sIM//bCDP/2wgz/9cEL//XBC//1wQv/974M//e+DP/3vgz/9r0L//W8Cv/0 uwn/9LsJ//O6CP/1ugj/9boI//W6CP/0uQf/9LkH//O4Bv/zuAb/87gG//SyBP/yswT/87QH //K0Cf/ytAv/8rUN//K1D//wtRH/8bUW//K2F//ythj/8bcY//C4G//wuB3/77gd/++4H//w uCP/8Lgj//C4I//wuCP/8Lgj//C4I//wuCP/8Lgj/++3Iv/vtyL/77Yf/++2H//wtR3/8LMa //CzGv/vshn/7LIT/+ywEf/rrxD/7K4N/+uuCP/rrAX/66oE/+qqAv/rrAX/66wF/+qrBP/q qwT/6qsE/+mqA//pqgP/6aoD/+ipAv/oqQL/6KkC/+ipAv/oqQL/6KkC/+ipAv/oqQL/5qgH /+aoB//mqAf/5acG/+WnBv/lpwb/5KYF/+SmBf/kpgX/5KYF/+OlBP/jpQT/46UE/+KkA//i pAP/4qQD/+KjBv/iowb/4aIF/+GiBf/goQT/4KEE/+ChBP/goQT/46IK/9WUAP/dnAL/6agQ /96cB//XlQP/4J0Q/+ajF//CdRn/wHoA///CEv/wtgD/9r0O///FJf/5wh3/8L0K//nQKv/4 0Sz/+dMw//nWNP/72Tn/+tw+//veQv/73kL//uFH//7hR//+4Uf//uFH//3gRv/94Eb//N9F //zfRf/+3j7//98///7gQP//4UH//+NC//7lQ///5kT//+dF///pTv//6U7//+pP///qT/// 7FD//+1R///vUv//71L//utP//7rT//+60///utP//7rT//+60///utP//7rT//+6U7//ulO //3oTf/96E3//ehN//znTP/850z//OdM//znTP/+50z//eZL//3kSv/95Er//eJJ//zhSP/+ 4Uj//eFC//zeQP/83Dz/+9c4//vUMf/70Cz/+8wo//rLJf/wwhf//L8W//+0C//yrQj/rHgA //PTrf//+///9//4//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////v//v// /f////b3//7/+v/2+/X/8t3I/6trFP//oAD/8aMD//OlBf/yqAf/864L//SzD//1uBL/9rsV //a9Fv/2xBX/98UW//XGFv/2xxf/9skY//XKGf/1yhn/9cwa//jLGv/4yxr/+MsY//jLGP/4 yxb/+MwV//jMFf/4zBX/+csW//nLFv/4yhT/+MoU//jKEv/3yg//98oP//fKD//5yRH/+ckR //nJEf/4yBD/+MgQ//jIEP/3xw//98cP//fDC//3wwv/9sIK//bCCv/2wgr/9cEJ//XBCf/1 wQn/974M//e+DP/3vgz/9r0L//W8Cv/0uwn/9LsJ//O6CP/1ugj/9boI//W6CP/0uQf/9LkH //O4Bv/zuAb/87gG//OxA//xsgX/8rMG//GzCP/ytAn/8bQL//G0C//vtQz/8rQT//K0E//w tBX/8bUW//C2F//vtxr/77ca/+64Gv/vth7/77Ye/++2Hv/vth7/77Ye/++2Hv/vth7/77Ye /+63H//vth//7rUd/++0Gv/wsxr/77MX//CxFv/wsRT/67AM/+uwDP/srgv/664I/+qrBP/q qQP/6akB/+mpAf/rrAX/66wF/+qrBP/qqwT/6qsE/+mqA//pqgP/6aoD/+ipAv/oqQL/6KkC /+ipAv/oqQL/6KkC/+ipAv/oqQL/5qgH/+aoB//lpwb/5acG/+SmBf/kpgX/5KYF/+SmBf/j pQT/46UE/+OlBP/jpQT/4qQD/+KkA//ipAP/4aMC/+GiBf/hogX/4aIF/+ChBP/goQT/4KEE /9+gA//foAP/4qEJ/9+eBv/hoAj/46IK/+CeCf/fnQn/3ZsJ/9WTAf/dkyj/rWcA/+GgBP/z tQr/9LgM//a5EP/2vBL//8cY//fOKP/4zir/+NEu//rUM//62Dj//Ns+//zeQv/930P//uFH //7hR//94Eb//eBG//3gRv/830X//N9F//zfRf/83kD//N5A//3fQf/94UL//OJD//7kRf/+ 5kb//uZG//7nTP//6E3//ehN//7pTv/+60///+xQ//3tUP/97VD//epO//3qTv/96k7//epO //3qTv/96k7//epO//3qTv/96E3//ehN//3oTf/850z//OdM//vmS//75kv/++ZL//znTv/+ 5k7//eVN//3kTP/95Ez//eJL//zhSv/+4Er//OJF//3hQv/93T3/+9k5//zUNP/70S//+84r //vMKP/rvhv/+MAR//y4Df/vpwD/1poI/9Spcv//8/3/9//6//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////j++v///P////z9//z/8v/1//3///Lr/6NjG///mwD/8aIA //KkAv/zpwT/9KwI//WyDP/1tg//9bsS//a8E//1wxT/9sQV//bEFf/1xhb/9cgX//bJGP/0 yRj/9MkY//jJG//4yRn/+MkZ//jJF//4yhX/+MoV//jKFP/4yhT/+csW//jKFP/4yhT/+MoS //fKD//3yg//98oN//bJDP/5yRH/+ckR//nJEf/4yBD/+MgQ//jIEP/3xw//98cP//fDC//3 wwv/9sIK//bCCv/2wgr/9cEJ//XBCf/1wQn/974M//e+DP/3vgz/9r0L//W8Cv/0uwn/9LsJ //O6CP/1ugj/9boI//W6CP/0uQf/9LkH//O4Bv/zuAb/87gG//OxBf/xsgX/8bIF//CyBf/x swj/8LQI//G1Cf/vtQn/8bMQ//GzEP/xsxL/8LUT/++1Ff/wthf/7rYX/+62F//uthv/7rYb /+62G//uthv/7rYb/+62G//uthv/7rYb/+61Hf/utR3/77Qa/+6zF//ushb/8LEU/++wE//v sRL/6q8J/+yvCf/rrgb/66wF/+qpA//pqQH/6qcA/+qnAP/rrAX/66wF/+qrBP/qqwT/6qsE /+mqA//pqgP/6aoD/+ipAv/oqQL/6KkC/+ipAv/oqQL/6KkC/+ipAv/oqQL/5acG/+WnBv/l pwb/5acG/+SmBf/kpgX/46UE/+OlBP/jpQT/46UE/+OlBP/ipAP/4qQD/+KkA//howL/4aMC /+GiBf/hogX/4KEE/+ChBP/goQT/36AD/9+gA//foAP/4J8F/+WkDP/gnwf/2pgD/9+dCP/i oAv/2ZcC/9GPAP/jnRf/v3kA/713AP/zsBv/87UM//S3BP/4uwv//8ce//bLJv/2zCj/99At //nTMv/71zj//do+//7dQv/+4ET/+t9G//rfRv/630b/+t9G//neRf/53kX/+d5F//jdRP/6 3D7/+90///vfQP/64EH/++FC//vjQ//85ET//OZF//zlSv/95kv/++ZL//znTP/86U3//epO //vrTv/7607//ulO//7pTv/+6U7//ulO//7pTv/+6U7//ulO//7pTv/+50z//udM//7nTP/+ 50z//eZL//3mS//85Ur//OVK//znTv/+5k7//eVN//3kTP/95Ez//eJL//zhSv/+4Er//eNG //7hRf/83kD//No7//zWNf/80jD/+9As//rNKv/xwyf/8b8K//++Ev/1qwD/76wG/658N/// 8v3/9f/7//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////b/+v//+/////v/ //L56f/0//////z9/6FiH///mQD/8aIA//GjAf/zpwT/86sH//SxC//0tQ7/9rkR//W7Ev/2 whb/9cMW//bEF//0xRf/9cYY//XHGf/0yRr/9Mka//fIGv/3yBr/98gY//fIGP/3yBb/98kU //fJFP/3yRT/+MoU//jKFP/4yhT/98kR//fKD//3yg//9skM//bJDP/5yRH/+ckR//nJEf/4 yBD/+MgQ//jIEP/3xw//98cP//fECf/3xAn/9sMI//bDCP/2wwj/9cIH//XCB//1wgf/974M //e+DP/3vgz/9r0L//W8Cv/0uwn/9LsJ//O6CP/1ugj/9boI//W6CP/0uQf/9LkH//O4Bv/z uAb/87gG//KwBP/wsQT/8bIF//CyBf/xswb/8LQG//C0CP/utAj/8bIN//GzEP/xsxD/77QS //C1E//vtRX/7bUW/+62F//wtRv/8LUb//C1G//wtRv/8LUb//C1G//wtRv/8LUb/+21Gv/t tRr/77Qa/++zF//ushT/77AT/++xEv/vrxH/7K8H/+uuBv/qrQT/6qwD/+qqAv/pqQH/6qcA /+mmAP/rrAX/66wF/+qrBP/qqwT/6qsE/+mqA//pqgP/6aoD/+ipAv/oqQL/6KkC/+ipAv/o qQL/6KkC/+ipAv/oqQL/5acG/+WnBv/lpwb/5KYF/+SmBf/kpgX/46UE/+OlBP/jpQT/46UE /+KkA//ipAP/4qQD/+GjAv/howL/4aMC/+GiBf/hogX/4KEE/+ChBP/foAP/36AD/9+gA//f oAP/354E/+OiCP/bmQT/1pQA/92bB//ZlwL/15YA/+KhB//WkwD/3ZcT/6hgAP/wqib/87IM //7BBv/7vQr//bwY//XKJf/2yyf/+M4s//nTMv/61jf//do+///eQ//+4ET/+d5F//neRf/5 3kX/+d5F//jdRP/43UT/99xD//fcQ//52z//+dxA//rdQf/530L/+eFD//riRP/640X/++RG //vkSf/75En/+uVK//vmS//650v/++hM//rqTf/66k3//ehN//3oTf/96E3//ehN//3oTf/9 6E3//ehN//3oTf/+50z//udM//7nTP/95kv//eZL//zlSv/85Ur//OVK//znTv/+5k7//eVN //3kTP/95Ez//eJL//zhSv/+4Er//uRJ//ziRf/930H//ds8//3XOP/90zH/+9As//vOK//4 yzD/7b0F///DFv//swX/97AA/5RcEf//8v7/9P/7//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////f/////9/////T5//7/9v/q/vz//v///86gfP/chST/9asA/+qgAP/q oAn/8KkP//OwCv/3tQf/+rYL//iwDP/0wBL/9cET//XEEv/2xRP/9sgT//fKFf/4zBX/+MwV //nLFv/5yxb/+csW//nLFv/5yxb/+csW//nLFv/5yxb/98kR//fJEf/3yRH/98kR//fJEf/3 yRH/98kR//fJEf/5yAz/+cgM//nIDP/4xwv/+McL//jHC//3xgr/98YK//rECv/6xAz/+cML //nCDf/5wg3/+MEO//jBD//4wQ//+MEM//jAC//4wAv/+b4K//m8Cf/4uwj/+bsI//m7CP/2 uQj/9rkI//W4B//0twb/87YF//O2Bf/ytQT/8rUE//O0B//yswb/8rMG//KzBv/xsgX/8bIF //GyBf/wsQT/8rII//GxB//xsQf/8bEH//CwBv/wsAb/8LAG/++vBf/vrwf/768H/++vB//v rwf/768H/++vB//vrwf/768H/+6tB//urQf/7q0H/+2sBv/trAb/7awG/+yrBf/sqwX/66wF /+usBf/qqwT/6qsE/+qrBP/pqgP/6aoD/+mqA//qqwT/6qsE/+mqA//pqgP/6aoD/+ipAv/o qQL/6KkC/+mqB//oqQb/6KkG/+ipBv/nqAX/56gF/+eoBf/nqAX/5qYI/+amCP/mpgj/5qYI /+WlB//lpQf/5KQG/+SkBv/jpAf/46QH/+OkB//iowb/4qMG/+KjBv/hogX/4aIF/+KhCf/i oQn/4aAI/+GgCP/hoAj/4J8H/+CfB//gnwf/4J4J/9+dCP/fnQj/3pwH/92bBv/cmgX/3JoF /9uZBP/fnQD/4JoU/8F4B/+6cgD/8q8Y//a3CP/wsgD//8AW//fEHf/2xh7/+Mkj//jNKP/4 0S7/+NUz//nZOP/42zn//dw///3cP//93D///dw///3cP//93D///dw///3cP//73jz/+948 //vePP/83z3//N89//zfPf/94D7//eA+//riRP/64kT/++NF//vjRf/740X//ORG//zkRv/8 5Eb/++RG//vkRv/75Eb/++RG//vkRv/75Eb/++RG//vkRv//4UP//+NE///iRv/+5En//uVK ///mTP/+50z//uZO//3kTP/95Ez//eRM//3kTP/95Ez//eRM//3kTP/95Ez//eBH//7fR//9 3kX//t1C//7bQf/92j7//dk9//zYOv/40jH/9cAS//m8Jv/sthX/8LQA/75xAP//1c7/9v// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////n/////+P////v///7/9v/t //z//f7///TIq/+3aRT/76MA//CiAP/xpwr/+K8S//e0Df/0sgb/97QL//+8Fv/0wBL/9MAS //bDEv/2xRP/9sgT//fJFP/3yxT/+MwV//jKFP/4yhT/+MoU//jKFP/4yhT/+MoU//jKFP/4 yhT/98kR//fJEf/3yRH/98kR//fJEf/3yRH/98kR//fJEf/5yAz/+cgM//nIDP/4xwv/+McL //jHC//3xgr/98YK//fECf/3xAn/9sMI//bCCv/2wgz/9cEL//XBDf/1wQ3/9sAI//bACP/3 vwj/+L0H//e8Bv/3uwX/97sF//e5BP/2uQj/9rkI//W4B//0twb/87YF//O2Bf/ytQT/8rUE //O0B//yswb/8rMG//KzBv/xsgX/8bIF//GyBf/wsQT/8bEH//GxB//xsQf/8LAG//CwBv/w sAb/768F/++vBf/vrwf/768H/++vB//vrwf/768H/++vB//vrwf/768H/+6tB//urQf/7awG /+2sBv/trAb/7KsF/+yrBf/sqwX/66wF/+usBf/qqwT/6qsE/+mqA//pqgP/6aoD/+mqA//q qwT/6aoD/+mqA//pqgP/6KkC/+ipAv/oqQL/56gB/+ipBv/oqQb/6KkG/+ipBv/nqAX/56gF /+eoBf/mpwT/5qYI/+amCP/mpgj/5aUH/+WlB//lpQf/5KQG/+SkBv/jpAf/46QH/+KjBv/i owb/4qMG/+GiBf/hogX/4aIF/+KhCf/ioQn/4aAI/+GgCP/gnwf/4J8H/+CfB//gnwf/350I /9+dCP/enAf/3pwH/92bBv/cmgX/3JoF/9uZBP/hnwL/1pEI/9OLFf+vZwD/9LEc/+2uAf/4 uQn/+rsO//fCGv/3xBv/98gg//fMJ//30Cv/99Qw//jXNP/52Tj//Nw8//zcPP/83Dz//Nw8 //zcPP/83Dz//Nw8//zcPP/63Tv/+t07//rdO//73jz/+948//vePP/83z3//N89//rgQ//6 4EP/++FE//vhRP/74UT//OJF//ziRf/84kX/+uNF//rjRf/640X/+uNF//rjRf/640X/+uNF //rjRf//4UP//+FD//7hRf/940b//uRJ//7lS//+5Uv//udM//3kTP/95Ez//eRM//3kTP/9 5Ez//eRM//3kTP/95Ez//uFI//3gR//93kX//t1E//3cQf/92j7//Nk9//zYPP/71TT/+cUZ //m+Jv/uuhb/9boA/8yACP/mtaT/8vz+//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////v/+P//+f////v///7/9v/y//z//Pr////14v+YVxP/8KEA//ipBv/2qQX/9KsG //m1DP/xsQf/77IJ//7BGf/0vxH/9cAS//XCEf/1xBL/98YS//fJFP/4yhT/98sU//jKFP/4 yhT/+MoU//jKFP/4yhT/+MoU//jKFP/4yhT/98kR//fJEf/3yRH/98kR//fJEf/3yRH/98kR //fJEf/5yAz/+cgM//nIDP/4xwv/+McL//jHC//3xgr/98YK//bDBv/1wgX/9cIF//XCB//0 wAj/9MAI//TACv/zvwn/9b8F//S+BP/0vgT/9LwD//W7Av/1uwL/9bkB//W5Af/2uQj/9rkI //W4B//0twb/87YF//O2Bf/ytQT/8rUE//O0B//yswb/8rMG//KzBv/xsgX/8bIF//GyBf/w sQT/8bEH//GxB//xsQf/8LAG//CwBv/vrwX/768F/++vBf/vrwf/768H/++vB//vrwf/768H /++vB//vrwf/768H/+6tB//trAb/7awG/+2sBv/sqwX/7KsF/+yrBf/sqwX/6qsE/+qrBP/q qwT/6qsE/+mqA//pqgP/6KkC/+ipAv/pqgP/6aoD/+mqA//oqQL/6KkC/+ipAv/nqAH/56gB /+ipBv/oqQb/6KkG/+eoBf/nqAX/5qcE/+anBP/mpwT/5qYI/+amCP/lpQf/5aUH/+WlB//k pAb/5KQG/+SkBv/jpAf/4qMG/+KjBv/iowb/4aIF/+GiBf/hogX/4aIF/+GgCP/hoAj/4aAI /+GgCP/gnwf/4J8H/9+eBv/fngb/350I/9+dCP/enAf/3ZsG/92bBv/cmgX/25kE/9uZBP/f nAP/044F/9yUG/+1bgD/4Z0M/++uCv/5ug3/9LUI//bAFv/2wRn/+MUe//jJI//4zSj/+NEs //fUMP/51jT/+9c4//vXOP/71zj/+9c4//vXOP/71zj/+9c4//vXOP/62jf/+to3//raN//7 2zj/+9s4//vbOP/83Dn//Nw5//reP//63j//+99A//vfQP/730D//OBB//zgQf/84EH/+uBB //rgQf/64EH/+uBB//rgQf/64EH/+uBB//rgQf/93z///d9B//7gQv/+4UX//eNI//3jSP/9 5Er//eRK//3kTP/95Ez//eRM//3kTP/95Ez//eRM//3kTP/95Ez//uBK//3gR//94Ef//N1E //3cQf/820D//Nk9//zZPf/92Tv//8wh//jAIf/yvhr/+r4E/+OWEv+7imL/9/n4//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////7/8f/9+Pz///3///z/9P/3//z///3/ ///48f+hc0L/7ZsH//2tDv/1pwD/6qAA//WuBv/zsgz/6rAH//G7EP/zvhD/9L8R//XAEP/2 wxL/9sUR//jHE//3yRP/+MoU//jKEv/4yhL/+MoS//jKEv/4yhL/+MoS//jKEv/4yhL/98oP //fKD//3yg//98oP//fKD//3yg//98oP//fKD//5yAz/+cgM//nIDP/4xwv/+McL//jHC//3 xgr/98YK//TDBf/0wwX/9MMF//PCBv/zwQj/8sAH//LACf/ywAn/8r8E//G+A//zvQP/8rwC //K6Af/0ugH/87kA//S4AP/2uQj/9rkI//W4B//0twb/87YF//O2Bf/ytQT/8rUE//O0B//y swb/8rMG//KzBv/xsgX/8bIF//GyBf/wsQT/8bEH//CwBv/wsAb/8LAG/++vBf/vrwX/768F /+6uBP/urgb/7q4G/+6uBv/urgb/7q4G/+6uBv/urgb/7q4G/+2sBv/trAb/7awG/+yrBf/s qwX/7KsF/+uqBP/rqgT/6qsE/+qrBP/pqgP/6aoD/+mqA//oqQL/6KkC/+ipAv/pqgP/6aoD /+ipAv/oqQL/6KkC/+eoAf/nqAH/56gB/+ipBv/oqQb/56gF/+eoBf/mpwT/5qcE/+anBP/m pwT/5aUH/+WlB//lpQf/5aUH/+SkBv/kpAb/46MF/+OjBf/iowb/4qMG/+KjBv/hogX/4aIF /+GiBf/goQT/4KEE/+GgCP/hoAj/4J8H/+CfB//gnwf/354G/9+eBv/fngb/350I/96cB//e nAf/3ZsG/9yaBf/bmQT/25kE/9qYA//bmAP/2pUK/9aPD//MhQX/wXwA//i2Gv/wsAj/8rME //a8Ev/3vxT/98EX//jFHP/4ySP/+M0o//jRLP/50i//+9Mz//vTM//70zP/+9Mz//vTM//7 0zP/+9Mz//vTM//51jT/+dY0//nWNP/61zX/+tc1//vYNv/72Db/+9g2//raOf/72zr/+9s6 //vbOv/83Dv//Nw7//zcO//83Dv/+948//vePP/73jz/+948//vePP/73jz/+948//vePP/9 3T3//t4+//zeQP/930H//eBE//ziR//84kf//ONI//zjS//840v//ONL//zjS//840v//ONL //zjS//840v//OFK//zhSv/94Ef//N9G//zdRP/820D//NtA//zZP//82Dz//9Eq//nEHv/y wxv/+bwL//anF/+eaSf///v3//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////7f/6+P3//fz///z/9v/7//r///3////39//LsZD/z38C//WlEv/4qgD/6ZwA//GmAP/0 sA//67AK/+24CP/0vA//9b0Q//S/D//2wRH/9sMQ//fGEv/4xxL/+cgT//fJEf/3yRH/98kR //fJEf/3yRH/98kR//fJEf/3yRH/98oN//fKDf/3yg3/98oN//fKDf/3yg3/98oN//fKDf/5 yAz/+cgM//nIDP/4xwv/+McL//jHC//3xgr/98YK//XECP/1xAj/9MIJ//TCCf/0wgv/88EM //PBDP/zwQz/8b8I//K+CP/xvQf/87wH//O7Bv/yugX/87gE//O4BP/2uQj/9rkI//W4B//0 twb/87YF//O2Bf/ytQT/8rUE//O0B//yswb/8rMG//KzBv/xsgX/8bIF//GyBf/wsQT/8LAG //CwBv/wsAb/768F/++vBf/urgT/7q4E/+6uBP/urgb/7q4G/+6uBv/urgb/7q4G/+6uBv/u rgb/7q4G/+2sBv/trAb/7KsF/+yrBf/rqgT/66oE/+uqBP/rqgT/6aoD/+mqA//pqgP/6aoD /+ipAv/oqQL/56gB/+eoAf/oqQL/6KkC/+ipAv/nqAH/56gB/+eoAf/mpwD/5qcA/+eoBf/n qAX/56gF/+anBP/mpwT/5qcE/+WmA//lpgP/5aUH/+WlB//kpAb/5KQG/+SkBv/jowX/46MF /+OjBf/iowb/4qMG/+GiBf/hogX/4KEE/+ChBP/goQT/4KEE/+CfB//gnwf/4J8H/+CfB//f ngb/354G/96dBf/enQX/3pwH/96cB//dmwb/3JoF/9yaBf/bmQT/2pgD/9qYA//ZlQT/3JcL /9SPBv/alBD/s20A//CsG//rqgb/8bIC//a4C//3uw//970T//fBF//4xR7/+cok//jNKP/5 zin/+88u//vPLv/7zy7/+88u//vPLv/7zy7/+88u//vPLv/40i//+NIv//nTMP/50zD/+dMw //rUMf/61DH/+tQx//rXNf/61zX/+tc1//rXNf/72Db/+9g2//vYNv/82Tf/+9o3//vaN//7 2jf/+9o3//vaN//72jf/+9o3//vaN//82jr//Nw7//zcPP/73T//+99A//zfQ//64EP/++FG //zjS//840v//ONL//zjS//840v//ONL//zjS//840v//OJN//zhTP/84Ur//N9G//zdRf/7 3EP//NtC//zbQP/51Dv//9Iv//rIG//wxBn/9bYP//+xE/+ZYwP///jv//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////7//9/P//+Pr///v/+P/9//P///3///Pt8f/w 6tT/sGQC/+GXFP/7sAn/8qUA//GiAP/0qRD/8bAM//K5B//0ug7/9LwP//W9Dv/1wBD/9sEP //fEEf/3xhH/+McS//fKD//3yg//98oP//fKD//3yg//98oP//fKD//3yg//98oN//fKDf/3 yg3/98oN//fKDf/3yg3/98oN//fKDf/5yAz/+cgM//nIDP/4xwv/+McL//jHC//3xgr/98YK //bFEP/2xRD/9sUQ//XEEP/1xBL/9cQS//TCE//0whP/88AN//PADf/zvgz/8r0L//S9C//0 uwr/87oJ//O6Cf/2uQj/9rkI//W4B//0twb/87YF//O2Bf/ytQT/8rUE//O0B//yswb/8rMG //KzBv/xsgX/8bIF//GyBf/wsQT/8LAG/++vBf/vrwX/768F/+6uBP/urgT/7q4E/+6uBP/t rQX/7a0F/+2tBf/trQX/7a0F/+2tBf/trQX/7a0F/+yrBf/sqwX/7KsF/+uqBP/rqgT/66oE /+qpA//qqQP/6aoD/+mqA//pqgP/6KkC/+ipAv/nqAH/56gB/+eoAf/oqQL/6KkC/+eoAf/n qAH/56gB/+anAP/mpwD/5qcA/+eoBf/nqAX/5qcE/+anBP/lpgP/5aYD/+WmA//lpgP/5KQG /+SkBv/kpAb/5KQG/+OjBf/jowX/46MF/+KiBP/hogX/4aIF/+GiBf/goQT/4KEE/+ChBP/f oAP/36AD/+CfB//gnwf/4J8H/9+eBv/fngb/3p0F/96dBf/enQX/3pwH/92bBv/dmwb/3JoF /9uZBP/amAP/2pgD/9mXAv/blgv/1pID/9yYCf/Vjwn/wXoA/9KMBv/vrRD/77EA//e1B//2 twr/97kO//e9E//4whj/+cYd//jJIf/3yyT/+8sp//vLKf/7yyn/+8sp//vLKf/7yyn/+8sp //vLKf/2zyz/99At//fQLf/30C3/+NEu//jRLv/40S7/+dIv//rTMP/60zD/+tMw//vUMf/7 1DH/+9Qx//zVMv/81TL/+9Uy//vVMv/71TL/+9Uy//vVMv/71TL/+9Uy//vVMv/72Tn/+9k5 //vbOv/72zv/+tw+//reP//73kL/+95C//viSv/74kr/++JK//viSv/74kr/++JK//viSv/7 4kr//OJN//ziTf/84Uz/++BJ//zfRv/73ET/+9xD//rbQv/30z3//88v//fKFf/xxxn/9LQW //+1Cv+pcQD/+OLV//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////8/// /f//+/7///v/+v/8/+7///z///T1+f/4//L/t3In/9aRHP/xpwb/96cA//aiBP/2phH/968N //O1AP/0ug7/9LoO//S8Df/2vg//9sEP//bDEP/3xRD/+MYR//bJDv/2yQ7/9skO//bJDv/2 yQ7/9skO//bJDv/2yQ7/98oL//fKC//3ygv/98oL//fKC//3ygv/98oL//fKC//5yAz/+cgM //nIDP/4xwv/+McL//jHC//3xgr/98YK//nIFv/5xxj/+ccY//jGGf/4xhn/98QZ//fEG//3 xBv/9MIV//XBFf/1wRX/9b8U//S+E//1vRL/9rwS//W7Ef/2uQj/9rkI//W4B//0twb/87YF //O2Bf/ytQT/8rUE//O0B//yswb/8rMG//KzBv/xsgX/8bIF//GyBf/wsQT/768F/++vBf/v rwX/7q4E/+6uBP/urgT/7a0D/+2tA//trQX/7a0F/+2tBf/trQX/7a0F/+2tBf/trQX/7a0F /+yrBf/sqwX/66oE/+uqBP/rqgT/6qkD/+qpA//qqQP/6aoD/+ipAv/oqQL/6KkC/+eoAf/n qAH/56gB/+eoAf/oqQL/56gB/+eoAf/nqAH/5qcA/+anAP/mpwD/5aYA/+anBP/mpwT/5qcE /+anBP/lpgP/5aYD/+SlAv/kpQL/5KQG/+SkBv/kpAb/46MF/+OjBf/jowX/4qIE/+KiBP/h ogX/4aIF/+ChBP/goQT/4KEE/9+gA//foAP/36AD/+CfB//fngb/354G/9+eBv/enQX/3p0F /96dBf/enQX/3ZsG/92bBv/cmgX/3JoF/9uZBP/amAP/2ZcC/9mXAv/dmA//048A/9+cB//R jAP/0ooR/7VuAP/ysBT/77EA//azBP/3swb/9rcK//e7D//4wBX/+MMb//nGH//4yCD/+cgl //nIJf/5yCX/+cgl//nIJf/5yCX/+cgl//nIJf/2zCj/980p//fNKf/3zSn/+M4q//jOKv/4 zir/+M4q//rQLP/60Cz/+tAs//vRLf/70S3/+9Et//zSLv/80i7/+tMu//rTLv/60y7/+tMu //rTLv/60y7/+tMu//rTLv/61zX/+tk2//rYOP/62jn/+9s7//rcPv/53T7/+dxA//viSv/7 4kr/++JK//viSv/74kr/++JK//viSv/74kr//ORQ//ziT//74Uz/++BL//rfSP/73kX/+9xE //rbQv/61kL//Mwu//XMEv/zyxz/97gf//+3Av/AhwD/28Cv//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////+9P///P//+f7///v/+v/7/Or/+vb3//v////y//b/1ZNX /9aTKP/hmwD/8qIA//miB//7phX/+a0M//CuAP/zuQ3/9LoO//W8Df/2vg//9cAO//fCEP/3 xRD/+MYR//bJDP/2yQz/9skM//bJDP/2yQz/9skM//bJDP/2yQz/98oL//fKC//3ygv/98oL //fKC//3ygv/98oL//fKC//5yAz/+cgM//nIDP/4xwv/+McL//jHC//3xgr/98YK//nKHP/5 yR3/+Mgc//jIHv/4yB7/98cf//fHH//3xiH/9sMa//bDGv/2wRn/9cAY//bAGP/3vhf/9r0W //e8Fv/2uQj/9rkI//W4B//0twb/87YF//O2Bf/ytQT/8rUE//O0B//yswb/8rMG//KzBv/x sgX/8bIF//GyBf/wsQT/768F/++vBf/vrwX/7q4E/+6uBP/trQP/7a0D/+2tA//trQX/7a0F /+2tBf/trQX/7a0F/+2tBf/trQX/7a0F/+yrBf/sqwX/66oE/+uqBP/qqQP/6qkD/+qpA//q qQP/6KkC/+ipAv/oqQL/6KkC/+eoAf/nqAH/56gB/+anAP/nqAH/56gB/+eoAf/mpwD/5qcA /+anAP/lpgD/5aYA/+anBP/mpwT/5qcE/+WmA//lpgP/5aYD/+SlAv/kpQL/5KQG/+SkBv/j owX/46MF/+OjBf/iogT/4qIE/+KiBP/hogX/4aIF/+ChBP/goQT/36AD/9+gA//foAP/36AD /9+eBv/fngb/354G/9+eBv/enQX/3p0F/96dBf/dnAT/3ZsG/92bBv/cmgX/25kE/9uZBP/a mAP/2ZcC/9mXAv/dlxH/1ZEA/9qXAP/VkAX/148X/6pjAP/vrBP/8rQA//exA//2swT/97UH //e5DP/4vhT/+MIY//nEHP/5xh3/+sYi//rGIv/6xiL/+sYi//rGIv/6xiL/+sYi//rGIv/2 yyf/9ssn//fMKP/3zCj/+M0p//jNKf/4zSn/+M0p//rPKv/6zyr/+s8q//vQK//70Cv/+9Ar //zRLP/80Sz/+9Is//vSLP/70iz/+9Is//vSLP/70iz/+9Is//vSLP/61zX/+tc1//nXN//6 2Dj/+to6//nbPf/52z3/+d0+//viSv/74kr/++JK//viSv/74kr/++JK//viSv/74kr//ORQ //vjT//74Uz/+uBL//rfSP/73kX/+t1E//vcRP/92UX/98kt//XMDv/2zh7//Lwn//+5AP/R lgD/w6SS//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////7eDa/6dnDf/wmAD/3psA//S4HP/unAD//6kA//OsAv/y tAf/9LYJ//W5Cf/1vAv/9cEN//fFDv/4yBD/+ckR//fHC//3xwv/+MgM//jIDP/5yQ3/+ckN //nJDf/5yQ3/+MoV//rJFP/6yhL/+ckN//rJCv/6yAX/+skD//rJAv/4whf/+8Ud//fCHP/w vBj/8MAY//jKHf/4zRz/88sU//vTM//40DL/88su//DHLf/xyDD/9Ms1//nPO//900H/+8o9 //vLO//5yjT/+skv//nHKP/3xiH/98Qb//fEGf/yvyj/7rkd/+65E//2vw3/+L0H//S2AP/1 tAD//LkI//ixAf/4sQH/97ED//exBP/0sAX/9LAH//OwCf/yrwn/8q4F//KuBf/yrgX/8a0E //GtBP/xrQT/8KwD//CsA//trQX/7a0F/+ysBP/srAT/7KwE/+urA//rqwP/66sD/+uqBP/r qgT/6qkD/+qpA//pqAL/6agC/+moAv/pqAL/6qkH/+moBv/pqAb/6agG/+inBf/opwX/6KcF /+emBP/mpwT/5qcE/+anBP/mpwT/5qcE/+anBP/mpwT/5qcE/+WlB//lpQf/5aUH/+SkBv/k pAb/5KQG/+OjBf/jowX/46IG/+OiBv/jogb/4qEF/+KhBf/hoAT/4aAE/+GgBP/ioQX/4qEF /+GgBP/hoAT/4aAE/+CfA//gnwP/4J8D/96dBf/enQX/3p0F/96dBf/dnAT/3ZwE/9ybA//c mwP/25kF/9uZBf/amAT/2ZcD/9iWAv/YlgL/15UB/9eVAf/XjQb/15AA/+KcAP/WjgD/2o4W /8N2BP/RhwD/+rQW//i1BP/4twf/+rgM//u6FP/7vBf/+rsY//a4Ff/0thP/9L0I//S9C//1 vRD/9r0W//e9Hf/4vSH/+r4o//q+Kv/7xST/+cQg//jDHf/3whr/+MQY//rGGP/9yhn//8wZ //7JK//7xij/+cQm//jEI//6xiX//Mgn//3JJ//+yij/+cwo//nMKP/5zCj/+s0p//vOKv/8 zyv//M8r//3QLP/5zir/+c8t//nRMf/61DX/+tY4//zZP//820L/+9xD//zeQv/73kT//N9F //vgR//840v//eRM//3lT//95U///eRM//3kTP/840v//OFI//3gRv/94Eb//d9D//3fQ//3 2S3/+NI///TIK//0wRj/+cEU/+mzAP/srxj/yHlS////9v////j//fz6///////+/v//+vv9 //7//f/8//v///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////PP2/652Kf/y ngr/4ZgA/+unCP//qwb//qoA/+ysBP/ztAf/87UI//S4CP/1vAv/98AN//bEDf/3xw//+ckR //fHC//3xwv/+MgM//jIDP/4yAz/+ckN//nJDf/5yQ3/98oP//fKDf/5yQ3/+coL//nKC//5 yAn/+cgJ//nICf/yxwD//NAN///WH//90Sj/9cks//PHMv/3zT3//dJF//LJOf/3zj7//dRG ///YTP//1kz//NJK//XLRf/xx0H/8skx//TINP/0xzj/9cY8//bEQf/2w0b/+MFK//jBTP/8 yjf/9MMp//G9HP/yvhP/8roL/++zA//xtAT/+LkM//exA//3sQP/9bEE//SwA//zrwT/8q8G //GuBf/xrgX/8q4F//KuBf/yrgX/8a0E//GtBP/xrQT/8KwD//CsA//trQX/7a0F/+ysBP/s rAT/7KwE/+urA//rqwP/66sD/+uqBP/rqgT/6qkD/+qpA//pqAL/6agC/+moAv/pqAL/6qkH /+moBv/pqAb/6agG/+inBf/opwX/6KcF/+emBP/mpwT/5qcE/+anBP/mpwT/5qcE/+anBP/m pwT/5qcE/+WlB//lpQf/5aUH/+SkBv/kpAb/46MF/+OjBf/jowX/46IG/+OiBv/ioQX/4qEF /+KhBf/hoAT/4aAE/+GgBP/ioQX/4qEF/+GgBP/hoAT/4J8D/+CfA//gnwP/4J8D/96dBf/e nQX/3p0F/96dBf/dnAT/3ZwE/9ybA//cmwP/25kF/9uZBf/amAT/2ZcD/9iWAv/YlgL/15UB /9eVAf/YjwX/148A/+CZAP/XjgH/2o4U/8h7B//JfwD/+rMb//u4Cf/4tAf/9LIG//OzC//2 tg7/97gR//W2D//xtAz/9bcy//S2Lf/0tyj/9Lkf//a9GP/5wRT/+8QP//3HDf/yvgr/9sEP //vFGv//yCP//8cq//vCK//1uyn/8bco//vHI//1wR3/878b//rGIv//yyf//Mgk//fDH//0 wBz/9sch//fIIv/3yCL/+Mkj//nKJP/6yyX/+ssl//vMJv/5zCn/+c4q//rQLv/60jL/+dU3 //vYPP/72j///NtC//vdQf/83kL//N9F//vgR//84Uj//ONL//3kTP/95U///eRM//3kTP/8 40v//OFI//3gRv/94Eb//d9D//3fQ//52y//+NA9//fJLf/3xBv/+cEW/+23AP/ushb/vnBC ////9v////j//fz6///////+/v//+vv9//7//f/8//v///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////v3//9ClcP/Oggj/86II/+uZAP//rQD/+64A/+euB//yswb/87QH //S3B//0uwr/9r8M//fDDf/4xg//+MgQ//fHC//3xwv/98cL//jIDP/4yAz/+MgM//nJDf/5 yQ3/9soH//bKB//2ygn/9skM//bJDv/3yRH/98kT//fJE//41A7/8s8R//HMHP/0zi3/+dQ+ //vUSf/40k3/9s9M//7WU//801P/+dBQ//fOUP/3zlD/+dBU//zSWf/+1Fv//tJp//3RZv/7 0F3/+s5T//jMR//1yj3/9ck0//TJL//2xzv/9cU1//fFLv/6yCn/98Mf/++4E//psAv/6K8K //WzB//0sgb/9LIG//OxBf/xrwP/8K4C//CuAv/vrQH/8q4F//KuBf/yrgX/8a0E//GtBP/x rQT/8KwD//CsA//trQX/7a0F/+ysBP/srAT/7KwE/+urA//rqwP/66sD/+uqBP/rqgT/6qkD /+qpA//pqAL/6agC/+moAv/pqAL/6qkH/+moBv/pqAb/6agG/+inBf/opwX/6KcF/+emBP/m pwT/5qcE/+anBP/mpwT/5qcE/+anBP/mpwT/5qcE/+WlB//lpQf/5KQG/+SkBv/jowX/46MF /+OjBf/jowX/4qEF/+KhBf/ioQX/4qEF/+GgBP/hoAT/4aAE/+CfA//hoAT/4aAE/+GgBP/h oAT/4J8D/+CfA//fngL/354C/96dBf/enQX/3p0F/96dBf/dnAT/3ZwE/9ybA//cmwP/25kF /9uZBf/amAT/2ZcD/9iWAv/YlgL/15UB/9eVAf/akQb/148A/92WAP/YjwT/2o8S/9CEDP+9 cwD/9q4e//ezCP/0sAX/8q4D//SyBv/4uQz/+7wP//m7EP/2uA3/9r4H//a+Cf/2vQv/9bsP //S6Ef/ytxP/8LQV/++zFf/7vjD/+Lwq//O4IP/xtxX/87sM//jCCP//ygj//88J//S+E//0 vhP/+cMY//3HHf/6xBr/870V//O9Ff/4wRz/88Mb//PDG//zwxv/9MQc//XFHf/2xh7/9sYe //fHH//3yib/+Msn//nOKv/60DD/+tQ1//rWOP/72Dz//Nk///vdQf/73UH//N5C//zfRf/7 4Ef//eJJ//3kTP/95Ez//eRM//3kTP/840v//OFI//3gRv/94Eb//d9D//3fQ//72zL/9886 //rNLP/7xh7/+b4Y//O6AP/ztRb/s2Qp//z58P////j//v37////////////+vv9//7//f/8 //v///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////+f7///zix/+dYAf/+aYc //meAP/0nQD/+rIG/+myD//zsQX/87QH//S3B//1uQn/9r0L//bCDP/3xQ7/+MYP//bGCv/2 xgr/98cL//fHC//4yAz/+MgM//jIDP/4yAz/9coC//XJBP/2ygn/9soP//fKFf/1yhv/9sof //bKIf/00TX//dpC///dSf/51kT/8s89//PRPP/62UD//99E//PLSP/2zkv/+dBQ//zTU//7 0lL/+M9P//TLS//xyEr/7804//HNO//yzT7/9c5C//fQR//70Uv//NFO//7ST//3yUL/88M7 /+6/M//svCr/770o//PAJ//7xiz//8sx//S1Dv/ztA3/8rQL//CyB//vsAP/7q8C/++tAP/u rAD/8q4F//KuBf/yrgX/8a0E//GtBP/xrQT/8KwD//CsA//trQX/7a0F/+ysBP/srAT/7KwE /+urA//rqwP/66sD/+uqBP/rqgT/6qkD/+qpA//pqAL/6agC/+moAv/pqAL/6qkH/+moBv/p qAb/6agG/+inBf/opwX/6KcF/+emBP/mpwT/5qcE/+anBP/mpwT/5qcE/+anBP/mpwT/5qcE /+SkBv/kpAb/5KQG/+OjBf/jowX/46MF/+KiBP/iogT/4qEF/+KhBf/ioQX/4aAE/+GgBP/g nwP/4J8D/+CfA//hoAT/4aAE/+CfA//gnwP/4J8D/9+eAv/fngL/354C/96dBf/enQX/3p0F /96dBf/dnAT/3ZwE/9ybA//cmwP/25kF/9uZBf/amAT/2ZcD/9iWAv/YlgL/15UB/9eVAf/b kwP/2JAA/9qSAv/YjwT/2Y8M/9eMDf+1agD/7KIf//KqBv/yqwX/8q4D//WxBP/3tQf/9rcI //S1CP/xswj/67AA/+6zAf/ytwP/9boG//a7Bf/0uQP/8bcA/+60AP/0uwr/9bwL//e+Df/3 vg3/9r0M//S7Cv/wtwb/7rUE//S7DP/4vhL/+L4S//S6Dv/xtw3/9LoR//m/Fv/7wRj/874W //O+Fv/0vxf/9cAY//bBGf/2wRn/98Ia//fCGv/4yCD/+Mkj//jLJ//5zir/+tAw//rUNf/6 1jj/+tY4//zbPv/82z7/+91B//zeQv/94Eb//OFI//3iSf/840v//eRM//3kTP/840v//OFI //3gRv/94Eb//d9D//3fQ//82zT/9844//7PK///ySH/+b0e//e7Af/2txD/qV0P//Xy6f// //j//v37////////////+/z+//7//f/8//v///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////+fz////89v+nfEf/04MS//+mCf/tlwD/9LAH/+yxDf/zrwT/9LIG//S1Bv/1 uAj/9bwK//fAC//3ww3/+MQO//bGCv/2xgr/9sYK//fHC//3xwv/98cL//jIDP/4yAz/9soH //bKCf/2yg//9swY//bMIP/3zij/+M4u//bOMf/200X//dlN//3ZT//10Un/9NBG//zXSv/6 1kL/8s44//3VP//+1kD//9g////aQf//2kH//9pB///aQf//2j///9hM//7XTP/81Uz/+9BN //nMTf/3yU//98ZP//bFT//8y0r//cxL//zLSP/7yUT/+cg///nGOf/2wzL/88Eu//O5Gv/y uBn/8rcV//GzEP/wsQr/768F/+2uAf/urAD/8q4F//KuBf/yrgX/8a0E//GtBP/xrQT/8KwD //CsA//trQX/7a0F/+ysBP/srAT/7KwE/+urA//rqwP/66sD/+uqBP/rqgT/6qkD/+qpA//p qAL/6agC/+moAv/pqAL/6qkH/+moBv/pqAb/6agG/+inBf/opwX/6KcF/+emBP/lpgP/5aYD /+WmA//lpgP/5aYD/+WmA//lpgP/5aYD/+SkBv/kpAb/46MF/+OjBf/jowX/4qIE/+KiBP/i ogT/4qEF/+GgBP/hoAT/4aAE/+CfA//gnwP/4J8D/9+eAv/gnwP/4J8D/+CfA//gnwP/354C /9+eAv/enQH/3p0B/96dBf/enQX/3p0F/96dBf/dnAT/3ZwE/9ybA//cmwP/25kF/9uZBf/a mAT/2ZcD/9iWAv/YlgL/15UB/9eVAf/clAH/2pIC/9iPBf/YjwX/2pAJ/9mPDP+2awD/3ZAa //OpCP/zqwf/86wC/++rAP/sqgD/66gA/+qpA//sqwn/768F/++vB//urQv/7asO/+uoEf/q phX/6KMX/+eiF//hogn/46QL/+anDv/pqRP/6qoU/+mpFP/oqBP/56cS//CxDP/1thH/8rMO /+usBf/wsQr//b4X//7AF//0tg3/9bwT//a9FP/2vRT/974V//i/Fv/4vxb/+cAX//nAF//4 xRz/+MUe//jHIv/4yyf/+c4q//rQMP/60jT/+tQ1//zaO//72j3//Ns+//vdQf/830X//eBG //zhSP/84Uj//eRM//3kTP/840v//OFI//3gRv/94Eb//d9D//3fQ//92jb/+c02//7QJf// ySH/+7wj//e7Bf/2uQn/qmAA/+7r4v////j///78//39/////////P3///7//f/8//v///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////+/f4//38///kzrn/pV8J//6iD//2 owD/7aUB//GpBf/zrwT/9LAF//WzBf/0twf/9rsJ//e/Cv/4wQz/98MN//XFCf/2xgr/9sYK //bGCv/3xwv/98cL//fHC//3xwv/+MoS//fLFP/3zBv/+M4k//nPLf/40Tb/+NM9//nTQP/z 0TH/99Q6//nTQv/40Er//tJV///WXv//0lr/+MdR/9WcS//LkkH/u4Mw/6tzIP+haRT/nWUO /55mD/+gaBH/nmcK/6VvD/+xfBb/wowg/9aeLf/mrzj/87w+//rDRP/9x0n//cdL//jCRv/y vED/8rw+//jDP//8yED//Mk8//W9Kv/0vCf/87oi//K3G//ytBP/8LEK/++vB//wrgL/8q4F //KuBf/yrgX/8a0E//GtBP/xrQT/8KwD//CsA//trQX/7a0F/+ysBP/srAT/7KwE/+urA//r qwP/66sD/+uqBP/rqgT/6qkD/+qpA//pqAL/6agC/+moAv/pqAL/6qkH/+moBv/pqAb/6agG /+inBf/opwX/6KcF/+emBP/lpgP/5aYD/+WmA//lpgP/5aYD/+WmA//lpgP/5aYD/+OjBf/j owX/46MF/+OjBf/iogT/4qIE/+GhA//hoQP/4aAE/+GgBP/hoAT/4J8D/+CfA//fngL/354C /9+eAv/gnwP/4J8D/+CfA//fngL/354C/96dAf/enQH/3p0B/96dBf/enQX/3p0F/96dBf/d nAT/3ZwE/9ybA//cmwP/25kF/9uZBf/amAT/2ZcD/9iWAv/YlgL/15UB/9eVAf/clQD/3JMG /9eNCP/Yjgf/2pEE/9aNA//BdQD/yXoR//asDf/0qwf/8KkA/++pAP/tqQD/7qoJ//CrEv/y rBn/66cI/+KdBP/UjQD/xHoA/7dqAP+uXwL/qVgH/6hWDP+kWAD/ploA/6pgAP+yaQD/wHgA /9CJCf/gmhT/6aQb/9eQAP/qpBH/9a8Z/+6pDv/qpgf/8a0K//e0Df/3tA3/9roO//a6Dv/3 uw//97sP//i8EP/5vRH/+r4S//q+Ev/2whf/98MY//jFHP/4xyL/+Msn//nOKv/60C7/+9Ex //vZOv/72Tr/+9o9//3cP//83kL//N9F//3gRv/94Eb//eRM//3kTP/840v//OFI//3gRv/9 4Eb//d9D//3fQ//+2Df/+s81//3OIP/+xR7//Lom//W3BP/1twD/tW0A/+fk2/////j////9 //v7/f///////P3///7//f/8//v///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////zt//H5/////f//rnQ0/+aPCv/4qgz/550A//igAP/0rQP/868E//SyBP/1tgf/97oJ //a+Cf/3wAv/+MEM//XFCf/1xQn/9sYK//bGCv/2xgr/98cL//fHC//3xwv/+soe//rMIf/6 zSn/+9Ex//rTOv/71UL//NdI//zYTP//2Eb//9VI//rMRf/jsjL/vooQ/6NtAP+jawD/sXkA /8yaAP/ToQT/3qwN/+q4F//0wyD/+cgj//rKIv/6yiL/+MQj//O8If/nrxr/2Z4U/8mMDf+8 ewf/sm4D/6xnAP+zeQD/ypAV/+WqNP/3vkr//8pT///NT//4wz//6rYs//fBOv/1wDb/9r0u //S7Jv/zth3/87MT//GwDP/wrwn/8q4F//KuBf/yrgX/8a0E//GtBP/xrQT/8KwD//CsA//t rQX/7a0F/+ysBP/srAT/7KwE/+urA//rqwP/66sD/+uqBP/rqgT/6qkD/+qpA//pqAL/6agC /+moAv/pqAL/6qkH/+moBv/pqAb/6agG/+inBf/opwX/6KcF/+emBP/kpQL/5KUC/+SlAv/k pQL/5KUC/+SlAv/kpQL/5KUC/+OjBf/jowX/46MF/+KiBP/iogT/4aED/+GhA//hoQP/4aAE /+GgBP/gnwP/4J8D/+CfA//fngL/354C/9+eAv/gnwP/354C/9+eAv/fngL/3p0B/96dAf/e nQH/3p0B/96dBf/enQX/3p0F/96dBf/dnAT/3ZwE/9ybA//cmwP/25kF/9uZBf/amAT/2ZcD /9iWAv/YlgL/15UB/9eVAf/blQD/3pUK/9eMDP/XjQj/2pIC/9CHAP/Pggz/t2cI//msDv/x qAT/7aQA/++oAP/1rQn/8qsT/+WdE//akRD/tWUC/7prBP/DdQb/0IQK/+CWD//xqRf//7kf ///CJP//uxr//bgc//iyHv/uphz/35UY/82CD/+9cAb/s2UA/8p/Av/Wiwz/45kU/+eeEf/k nQf/450A/+ynAv/3sgz/87QH//O0B//0tQj/9bYJ//W2Cf/2twr/97gL//e4C//2wBX/98EW //fDGP/5xh//+Mkj//jLJ//5zir/+c8t//vXOP/72Tr//No7//zbPv/93D///N5C//zfRf/9 4Eb//eRM//3kTP/840v//OFI//3gRv/94Eb//d9D//3fQ//91zj//M80//rLG//7whv//bot //GyA//ytQD/wnwA/+He1f////j////9//r6/P///////f7///3//P/8//v///////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////zh//X////3/P//2Kh3/9B+Af/wpQz/5pkA //+dAP/0rQP/868E//SyBP/0tQb/9rkI//i9Cf/4wAv/+MEM//XFCf/1xQn/9cUJ//bGCv/2 xgr/9sYK//fHC//3xwv//Mso//zMKv/8zjD//dI4//3VQP/92En//tpO//3bU//Yozv/sHoQ /55mAP+8gw//5Ksq//W8L//9xCz//88u///KJP/+ySP//cgg//vHHP/5xRf/98QT//bDEP/1 wg//+cAR//nAEf/6wRL//cER///CEv//wxP//8MT///DE//nqi3/2p4k/8KFEP+vcQD/tHkF /9OZHv/yvDj//8xF//nEQv/3wj7/9782//a8Lf/0uCL/9LUY//OyEP/ysQ3/8q4F//KuBf/y rgX/8a0E//GtBP/xrQT/8KwD//CsA//trQX/7a0F/+ysBP/srAT/7KwE/+urA//rqwP/66sD /+uqBP/rqgT/6qkD/+qpA//pqAL/6agC/+moAv/pqAL/6qkH/+moBv/pqAb/6agG/+inBf/o pwX/6KcF/+emBP/kpQL/5KUC/+SlAv/kpQL/5KUC/+SlAv/kpQL/5KUC/+OjBf/jowX/4qIE /+KiBP/iogT/4aED/+GhA//hoQP/4aAE/+CfA//gnwP/4J8D/9+eAv/fngL/354C/96dAf/f ngL/354C/9+eAv/fngL/3p0B/96dAf/enQH/3ZwA/96dBf/enQX/3p0F/96dBf/dnAT/3ZwE /9ybA//cmwP/25kF/9uZBf/amAT/2ZcD/9iWAv/YlgL/15UB/9eVAf/blQD/35YL/9iNDv/W jAf/25MB/8yEAP/ZjBj/rFsA//msDv/wpAH/6aAA/++mAP/zqwv/5JwK/8R5AP+nXAD/5JsO /+igDv/vqA7/9bAL//i1BP/4twD/9rYA//S1AP/7uwT/+bgE//a1Af/zsgD/8rEB//OxA//1 swf/9rQI/92NHv/GdgP/vm8A/9OGAv/qnw7/7qUK/+qiAP/qowD/77AD/++wA//wsQT/8LEE //GyBf/yswb/87QH//O0B//3vxL/9sAV//bCF//4xRz/+Mgg//nKJv/5zCn/+c4q//vXOP/7 1zj/+9k6//zaO//93D///N5C//3fQ//830X//eRM//3kTP/840v//OFI//3gRv/94Eb//d9D //3fQ//71Df//tI1//rJF//5vhj//bou/++tAP/yswD/zIcA/97b0v////j////9//n5+/// /////f7///z++//8//v///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////36 //f98//6/v////f9/41SFv/6rRP//KwA/+maAf/9sAz/96sH//GoAf/wrAH/87QE//a7B//1 vQb/870F//K/AP/zvQX/+cMb/++9EP/+0g//8cgA//jQDv//1iL/78wm//jRNP/70T3//9NC ///XRv/xvzz/xIwf/6BjCP/HkAD/460N//zJIv//zyL/+ssb//bIG//2xx//9MUh//fONP/3 zjb/9s01//bNN//1zDb/9cs3//XLN//1yzn/9MUx//PEMP/1wy7/9MIt//TBKv/2wCj/9b8n //a/J//0wwT/88AD//bCDP/4vxb/6q0W/82MCv+3cQL/rWUB/+CdMv/xszz/+b04//C4I//r tRf/8b0c//O+IP/stxv/77IA/+qtAP/pqwL/7q0J//CsC//sqAX/7qkD//SwBf/wqwX/8KsF //CrBf/vqgT/76oE/+6pA//uqQP/7qkD/+qpA//pqAL/6agC/+moAv/opwH/6KcB/+inAf/o pwH/6agG/+inBf/opwX/6KcF/+emBP/npgT/56YE/+alA//kpAb/5KQG/+SkBv/jowX/46MF /+KiBP/iogT/4qIE/+OiBv/jogb/46IG/+KhBf/ioQX/4aAE/+GgBP/hoAT/5aYA/+WlBf/d nAT/5KIO/9SSAP/hoAT/3J0A/9udAP/hpAD/36IA/96gAP/foAX/4KAL/+CfD//cmg7/2ZcN /8+JBf/Qigb/0YsH/9ONCf/WkAz/2JIO/9mTD//alBD/4J8N/96dC//amQf/1pUD/9STAf/T kgL/05IC/9OSAv/hlhn/2o4U/9eLEf/Yjgn/zYQA/9GHAP/Pgg7/plYA/+2kB//yrAD/8aoA /+mdE//Pfx7/sWAF/8R5AP/7thH/9rgN//a4Df/2uA3/9rgN//e5Dv/3uQ7/+LoP//i6D//4 uhH/97kO//e5Dv/3uAv/+LYI//e1B//4tQb/+LUG//q4Cv/8uRD/7qoJ/9KLAP/DdwD/zH8A /+OSHP/yoS7/7qYE/+2lA//upgL/86wG//myCP/7tQj/97ED//OtAP/2uA3/9rkQ//a8E//2 wBj/+MUe//jJI//4yyf/+M0p//nTMv/61DX/+dU2//raOv/63Dz//OBB//vhQv/740X//eNI //7kSf//5Ej//+RI///iRP//3z///Nw8//vZOv/51jD/+dEx//fLKv/6yiD/98AN//m8C//1 sRD/1YoA/9C9rP///vb//P////v////8+/f///r0//v7+f/3//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////v///f98//5////++zv/+KyhP/IfwD/5ZMA//+wCv/0 pgT/86YC//CnAP/yrgP/9rcI//m+Cv/2vgf/870F//3FGv/zvgD/778A//7QC//wwRP//9Iw //rPIf/qwwb/+M48//3VOP//20H/5bQx/6t1C/+nbwL/16IU//zNG//suR//98Um//7PKf/8 zSX/98si//jNKP/4zCv/9sot//jPOf/4zzn/+M46//jOPP/3zTv/9809//fNPf/2yz7/9sk4 //fJOP/3yTb/98c1//jGM//3xTD/+MQw//fDL//2wCD/9b8e//fAHf/5wiH/97wi//CyIf/p qSH/6Kcl/717Df+wbwD/x4kC//u/Lf//0Dn/8LYk/+WqIv/ztzX/8bIN/++wC//nqAH/5aUA /++sBf/4tQ7/864I/+WgAP/wqwX/8KsF/++qBP/vqgT/76oE/+6pA//uqQP/7qkD/+moAv/p qAL/6agC/+moAv/opwH/6KcB/+inAf/npgD/6KcF/+inBf/opwX/56YE/+emBP/npgT/5qUD /+alA//kpAb/5KQG/+SkBv/jowX/46MF/+KiBP/iogT/4qIE/+OiBv/jogb/4qEF/+KhBf/i oQX/4aAE/+GgBP/hoAT/4aEB/96eAP/hoAb/3ZwE/+CfB//bmgD/4qEF/+amCP/ioA7/5aIV /9+bEv/KhQT/sWsA/6RcAP+oXwD/smkD/8+BH//Nfx3/yXsZ/8R2FP+/cQ//u20L/7dpB/+1 ZwX/ql8C/7NpCP/CeRL/0YoY/9qUGv/dmRT/3JkN/9qXCP/hnAD/25UA/9aPAP/VjgD/zIUA /9OKAP/WiRX/tWUG/+mdE//lmQ//140G/8R6AP/GewD/558V//q1Gv/sqQD/9rkQ//a5EP/2 uRD/97oR//e6Ef/4uxL/+LsS//i7Ev/4uxL/97oR//i6D//3uQ7/97gL//m3Cf/4tgj/+LYI //m6C//ysgj/9rIP//23G//vpxT/2IwC/9CDAP/Zigv/4ZgA/+ifAv/wqAj/9KwI//StBf/0 rQP/97ED//u1B//2uA3/9rkQ//a8E//2wBj/+MUe//jJI//4yyf/+M0p//nTMv/61DX/+tY3 //raOv/63Dz//OBB//ziQ//740X//eNI//7kSf//5Ej//+RI///jRf//4ED//Nw8//raOv/5 1jD/+dEx//fLKv/6yiD/98AN//m8C//1sRD/1YoA/8+8q////vb//P////v////8+/f///v1 //39+//5//////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////j///z/+P/1 //j/+vr6///q1f+fXwj/9aMP//SZAP/tngD/7qAA//GlAf/2rwX/+rgK//q9DP/2vgn/9LwF //C3Dv//zQ//+MgA//vNBv/1xRv//9E6//rLM///1jX//9s6/+KxLv+veBH/tX0Q/+y5Kv// 0yX/9MYR//rHHP//1DX//9M0//rOLf/2zCr/+NAw///WPP/+1kD/+tI///rRQf/60UH/+tFD //nQQv/50ET/+c9F//jORP/4zkT/+dBE//jPQ//5zkP/+M1A//nMPf/5yjz/+cs6//nJOf/0 uzr/9bw3//O6Lf/vuCD/8Lgb//e9Hf/5vx//+b8d/+yzAf/wsxr/0o8a/6pjCf+9dSD/+LNL ///LQ//0uBn/9LEi//SzG//0tRL/8rMG/+yrAP/mpAD/7KcB//SvDP/vqgT/76oE/++qBP/v qgT/7qkD/+6pA//uqQP/7agC/+moAv/pqAL/6agC/+inAf/opwH/56YA/+emAP/npgD/6KcF /+inBf/opwX/56YE/+emBP/mpQP/5qUD/+alA//kpAb/5KQG/+SkBv/jowX/46MF/+KiBP/i ogT/4qIE/+KhBf/ioQX/4qEF/+KhBf/hoAT/4aAE/+GgBP/gnwP/3JsD/+GgBv/ioQX/3JsA /+alC//joQ3/35wP/9uYDP/aiy//w3UT/7JlAP/BdgD/5ZwZ//+4KP//uiH/9LAR//WxBv/1 sQb/9rIH//ezCP/4tAn/+bUK//m1Cv/6tgv//LUl/+2mGP/VjQf/v3UA/7JnAP+wYwD/tWcD /7prDP/HfAD/04cN/9+UF//lnBH/15AA/9OMAP/TigD/uW4A/9qKG//djiX/wXMH/7xzAP/s qAX//8II//W4AP/5vAv/9rwT//a8E//3vRT/970U//i+Ff/4vhX/+L4V//i+Ff/3vhX/+L4V //e9E//4uxL/+LoP//i6Df/4uQz/+LkM//O2Bv/3uQz/+roQ//26FP/7txj/9a4U/+afB//b kQD/25MA/+GaBP/pogj/7KYI/+2oA//wrAH/9rME//u4B//2uA3/9rkQ//e9FP/3wRn/+MUe //jJI//4yyf/+c4q//nTMv/61DX/+tY3//raOv/73T3//OBB//ziQ//85Eb//eRJ///lSv// 5kn//+VJ///jRf/+4ED//d09//raOv/51jD/+dEx//fLKv/6yiD/98AN//m8C//1sRD/1YoA /8y5qP///PT/+/////v////9/Pj///33/////f/5//////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////n///7/+v/1//P/+P/////x8f/Jlmv/1okT/+2RAP/vnAD/76AA //GlAf/0rQX/9bMH//W4B//1ugb/87sG//G9AP/1vgn/+sQa//XDFP//4Cr/+80g//HAM//u ukr/vIQX/7qFA//grxT//c0l//LBHP/4xyT//9cy//7OJP/+1jj/+dM0//XOMf/0zzb/+tU/ //3ZR//51kj/9NBG//3TSf/80kj//NJI//zSSv/70Uv/+9FL//vQTf/6z0z/99FM//fRSv/3 z0n/99BH//jORv/4zUP/98xC//nLQf/6wkn//cZH//rEPv/0vS3/8boi//S+Hv/zvBn/7bcP ///DIP/ysxb/8bAe//SwKf/VkBH/sWsA/8N6B//zqjf/+rU2//e0KP/ysRX/8LEE//GwAP/w rwD/8KsF/++pCf/vqgT/76oE/++qBP/uqQP/7qkD/+2oAv/tqAL/7agC/+moAv/pqAL/6KcB /+inAf/npgD/56YA/+emAP/npgD/6KcF/+emBP/npgT/56YE/+alA//mpQP/5qUD/+WkAv/k pAb/5KQG/+SkBv/jowX/46MF/+KiBP/iogT/4qIE/+KhBf/ioQX/4qEF/+GgBP/hoAT/4J8D /+CfA//gnwP/25kF/+inD//fngL/4qIE/+SjCf/rqBn/0Y0I/8J8AP+5aQD/24wT//+0Lf// wij//bcK/+2pAP/sqwD/87MA//OuAP/zrgD/9K8A//WwAP/2sQD/9rEA//eyAP/3sgD/7KMG //SrDv//thn//70d//+7G//4sBD/6qIC/+GZAP/PgBn/vm4N/65eAP+6bAD/zYID/96UEf/c kBj/u20A/8p3G/+8bQb/140Q//azHP/ytQX/8bcA//vECP/5wQr/9sAY//fBGf/3wRn/98EZ //jCGv/4whr/+MIa//jCGv/4whr/98EZ//fBGf/4vxb/+L4U//e9E//5vRH/+LwQ//a6DP/6 vhD/9rgL/+2vAv/0tAr//8AX//+9Fv/yrwj/6KAQ/+ObCf/fmAL/4pwA/+qlAv/yrgX/9rIF //azBP/3uQ7/97oR//e9FP/3wRn/+cYf//nKJP/5zCj/+c4q//rUM//71Tb/+tY3//vbO//7 3T3//eFC//ziQ//85Eb//eRJ//7lSv//5kn//+ZJ///kRf/+4ED/+909//nbO//51jD/+dEx //fLKv/6yiD/98AN//m8C//1sRD/1YoA/8u4p///+/P/+v7///v////+/fn///74/////f/5 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////r///Dw7v/4//T/6Pfw ///9////8Ob/k1IC//WhC//0oQX/9aIE//OlA//wpwL/76sA/++wAf/ytQT/9LkH//bCAP/q swH//8sq//bCIP/xwRX//s8r//HAN/+XYwD/y5UP//C/Jf/3yRv/9cgT///WK//7yi//7b4o ///QPP/71zn/+NQ4//fSO//51UP/+dZI//jUSv/y0Ub/781F//vUS//71Ev/+9NN//vTTf/6 0k7/+tJP//rST//50U7/9dBO//XOTf/1zkv/9c1J//TMSP/2zEb/9spF//bKQ//2xTz//ck/ //zIPv/3wjb/9L8x//fAL//1vSr/7rYh/+qvFf/ytxX/8rgM/++zA//1thH/9bEg/9mPFv+z ZgD/1Y8T/+6qI//7uST/8K8L/+qoAP/xrwP/9bAK/+6pBv/vqgT/7qkD/+6pA//uqQP/7agC /+2oAv/tqAL/7KcB/+inAf/opwH/6KcB/+emAP/npgD/56YA/+alAP/mpQD/56YE/+emBP/n pgT/5qUD/+alA//lpAL/5aQC/+WkAv/kpAb/5KQG/+SkBv/jowX/46MF/+KiBP/iogT/4qIE /+KhBf/hoAT/4aAE/+GgBP/gnwP/4J8D/+CfA//fngL/4J4K/92cBP/ioQf/4qEH/+WjDv/R jgH/yoYB/8mEBf/6twD/9rMA//KuAP/1sQD//LcE//+9Df//wBP//78V//awEP/2sBD/9a8P //OtDf/yrAz/8asL//CqCv/vqQn/97IA//WwAP/yrQD/8awA//GsAP/0rwD/+LMA//u2Af/x rgD/+rQW//KpHP/flBT/vnIA/6xdAP+1YhL/tV8i/6hYAP/jmRT/9LEI//CzAP//xSL/+8Am /+63Ev//zxb/+MUe//jFHv/4xR7/+cYf//nGH//5xh//+scg//rHIP/2xSD/+MUe//fEHf/4 wxv/+MIa//fBF//5wRb/+MAV///FGf/yuQr/8LcI//3BE///whL/9bgH//O0BP/5ugr/9a8c /+ymEv/inQT/3pkA/+SgAP/sqQL/8rAE//SyBP/3uQ7/97oR//i+Ff/4whr/+cYf//nKJP/5 zCj/+s8r//rUM//71Tb/+9c4//vbO//83j7//eFC//3jRP/95Uf//eZK//7nS///6Er//+dK ///lRv/+4kH/+98+//nbO//51jD/+dEx//fLKv/6yiD/98AN//m8C//1sRD/1YoA/8u4p/// +/P/+/////v//////vr///74/////f/5//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////Pz+///+//////v/9fz0//z/////+P//wZJm/7x6DP/1oAX/9aIG//OjBP/w pAD/7aYA/+2rAP/vsgL/9LcG//3EG///yhf/468A///NKf//0En/wowO/5ppAP/uwiH//9oJ //XKGf/+zjz//9BE//LGKf//1jD//95E//LGP//61Tz/99I8//jSQf/61Un/+tZM//jUSv/3 1kn/+9pN//rUS//61Ev/+dNM//nTTP/5007/+NFO//jRTv/40U7/9c5N//TNTP/1zEz/9MxJ //XKR//1yUb/9clE//bHQ//yxS7/88Uy//PCNf/wvzb/8b02//O9N//yvDX/8rox//bBGf/1 wBj/870V//C1Ef/rrQ7/66oQ//KvGv/8tSX/yoYB/9CMA//joBH/9rMe//WwFf/mogH/6KMA //WwCv/uqQP/7qkD/+6pA//tqAL/7agC/+ynAf/spwH/7KcB/+inAf/opwH/56YA/+emAP/m pQD/5qUA/+alAP/mpQD/56YE/+alA//mpQP/5qUD/+WkAv/lpAL/5aQC/+WkAv/kpAb/5KQG /+SkBv/jowX/46MF/+KiBP/iogT/4qIE/+GgBP/hoAT/4aAE/+CfA//gnwP/354C/9+eAv/f ngL/5KMH/8uKAP/npRH/3JkK/+CdEP+ybwD/15QH/+2qG//ysgD/8bAA//KxAf/2tAj/+rcR //m1FP/zrhL/7qkO//a5AP/2uQD/9rkA//e6AP/3ugD/+LsA//i7AP/4uwD/8rMA//KzAP/x sQD/8a8B//KuC//zrhP/9a8b//avH//2uAD/9rYA/+2pAP/3sg3//bcX//StF//nnRr/0oUR /9iMEv/mogH//MAA//zCBv/usxv/+sA6///NNf/wwg3/+Mkj//jJI//4ySP/+cok//nKJP/6 yyX/+ssl//rLJf/4ySX/+Mkl//fIIv/3xiH/+cYf//jFHP/4wxv/+MQZ//bAFf/3vxT/+MAV //zCFv/6wRL/9roM//S3B//0twf/+rUZ//eyFv/xrQ7/6KQD/+KeAP/logD/76wD//i1DP/3 uQ7/+LsS//i+Ff/4whr/+cYf//rLJf/6zSn/+s8r//vVNP/81jf/+9c4//zcPP/83j7//eFC //3jRP/95Uf//eZK//7nS///6Er//+hK///lRv/840H/+98+//ndPP/51jD/+dEx//fLKv/6 yiD/98AN//m8C//1sRD/1YoA/867qv///fX//P////v//////vr///74/////f/5//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9v/z///9////9v/////2//n++v/6 9P////jo/5prJ//tmAD/8ZwB//KiA//ypgP/7qcB/+2rAP/wsQL/9LcH//G5DP//yRr//9oy //G6Kf+mbgD/1J8f///TNf/txgf/7sQa//rSGv/0zhH/78kg//vRSf/4z1H/8c07//raL//7 0z7/9s09//TNQv/71Ev//ddQ//vWSv/72Eb//95J//nUSP/400f/+NJJ//jSSf/30Ur/99FM //fRTP/20Ev/985O//jNTf/4zUv/+MtK//nKSP/4yUX/+chF//jIQv/6zT7/98o9//bGQP/2 xUL/9cNA//TAOf/zwDP/9cAy//K8Pv/tuCz/7roY//fCEP/7xA//9bgP/+2sFP/rphv/8a8b /82KAP/BfQD/4pwW//21K//1rxn/56IA/+aiAP/uqQP/7qkD/+2oAv/tqAL/7agC/+ynAf/s pwH/7KcB/+emAP/npgD/56YA/+emAP/mpQD/5qUA/+WkAP/lpAD/5qUD/+alA//mpQP/5aQC /+WkAv/lpAL/5KMB/+SjAf/kpAb/5KQG/+SkBv/jowX/46MF/+KiBP/iogT/4qIE/+GgBP/h oAT/4J8D/+CfA//gnwP/354C/9+eAv/fngL/4KEA/9GQAP/koRT/3JgT/8eDAP/CfwD/7q0R //6/GP/9uyf/+Lcf//OyFv/xsg//87UM//m8DP//wg///8cR//y/Fv/7vhX/+bwT//e6Ef/1 uA//87YN//K1DP/xtAv/97Qn//azJP/zshr/8bER/+6wBf/tsAD/7LAA/+yxAP/4tQT/+7cO /++qB//xrQL/9bQA//OzAP/6ugD//LoC//iyFv//vBP/9bcC//a9Dv//zC//98Et/+q6HP/9 0iT/+Msn//jLJ//5zCj/+cwo//rNKf/6zSn/+s0p//rNKf/3zCj/98wo//fKJv/2ySX/+Mkj //jIIP/3xx//+cYd//C7E//7xR3/+8Ud//G4Ef/yuRD//8Uc///DG//0tw//+roS//q6Ev/3 tw//8bEJ/+qqAv/pqAL/7q0H//OyDP/4ug//+LsS//i+Ff/5wxv/+scg//rLJf/6zSn/+s8r //vVNP/81jf//Ng5//zcPP/93z///uJD//7kRf/+5kj/++dK//zoS///6Er//+hK///nR//9 5EL/+eA+//ndPP/51jD/+dEx//fLKv/6yiD/98AN//m8C//1sRD/1YoA/9G+rf///vb//P// //v////+/fn///33/////f/5//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////9f/x//jy////8v//+O7l//z/9v/8/v////n7/82qgv/njwD/7JcA//KiA//1pwX/8aoE //CsA//xsgX/9LcH//rHAP//yCH/5qks/7p+DP/dpyH/9MQi//3SIf/xyBT//9c9//XKLv/x yiT/9dIe//DTF//v0SH/89NA//fTWP//1kT/+c5B//fNRf//1U///9hP//fSRf/xzTf/8c40 //jTRv/30kX/99JG//fRSP/20Ef/9tBJ//bQSf/1z0r/+85N//vOTf/7zk3//M1L//zLSP/7 ykf//MpF//vJRP/5ykj/9cVF//bGSP/8yk3/+8lG//PCN//xvyr/9MMo/+7BJv/ywjL/8r09 /+6zPf/qrS7/7K8Z/++zA//wtgD/6KgK//m3I//zryr/1o8T/8+GBv/lnhD/9bAN//GuAP/u qQP/7agC/+2oAv/tqAL/7KcB/+ynAf/spwH/66YA/+emAP/npgD/56YA/+alAP/mpQD/5qUA /+WkAP/lpAD/5qUD/+alA//mpQP/5aQC/+WkAv/kowH/5KMB/+SjAf/kpAb/5KQG/+SkBv/j owX/46MF/+KiBP/iogT/4qIE/+GgBP/gnwP/4J8D/+CfA//fngL/354C/9+eAv/enQH/2ZsA /+enCf/dmg7/4Zsf/6plAP/tqhv//r8Y//O3Af/zuQD/9rwB//i+Bf/3vAb/9rsJ//a6Cv/5 vRH//MAU//e9Hf/4vh7/+L4e//m/H//6wCD/+sAg//vBIf/7wSH/+L0H//i9B//5vgj/+b4I //i9Cf/2uwf/9LkF//O4BP/yrwD/+bQO//GrD//0rg7/97MI//CtAP/1sQb/+LMQ//WyAP/4 tQ///74m///IL///yyX/9scZ//fMHv//1TD/+c4q//nOKv/5zir/+c4q//rPK//6zyv/+9As //vQLP/3zSn/+M0p//fMKP/4yyf/98sk//jJI//4yCD/+Mgg//vGIP/zvhj/87wX//zFIP// xyX/+8Ae//W6GP/3vBr//b4O//m6Cv/2twj/9rcK//i4EP/2tQ//8bAM/+uqBv/4ug//+LsS //m/Fv/5wxv/+scg//rLJf/6zSn/+9As//vVNP/81jf//Ng5//zcPP/93z///uJD//7kRf/+ 5kj//OhL//3pTP//6Uv//+lL///nR//95EL/+eA+//fePP/51jD/+dEx//fLKv/6yiD/98AN //m8C//1sRD/1YoA/9PAr////vb//P////v////+/fn///z2//7+/P/5//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////+ZaAn/1Y8J//+mDf/9mgn/66AA/+65AP/prgD/+q4a//+/Ov/gnxH/05kA/+64Df// 0B7/9skW/+7EGP/1zCT/+c0s//rOLf/6zi//+s8y//nQNv/60Tn/+dE7//nRO//51UP/+dVD //nURf/51Ef/+dRH//nUSP/51Ej/+dNK//nUSP/51Ej/+NNH//jTR//400f/99JG//fSRv/3 0kb/+tBI//nPR//5z0f/+M5G//fNRf/2zET/9sxE//XLQ//3xkP/9sVC//bGQP/2xD//98M8 //bCOv/3wTr/98I4//O/Lf/0vir/870p//K6Jf/xuiL/8Lcg/++2Hv/wtR3/7K4F/++wCf/w sQz/7asM/+qlCv/noQv/6aEO/+ujEf/tqAP/7KcC/+ynAv/spwL/66YB/+umAf/rpgH/66YB /+qkBv/qpAb/6qQG/+qkBv/powX/6aMF/+iiBP/oogT/6aMH/+mjB//powf/6KIG/+iiBv/o ogb/56EF/+ehBf/kogb/5KIG/+SiBv/joQX/46EF/+KgBP/ioAT/4qAE/+GeB//gnQb/4J0G /+CdBv/fnAX/35wF/9+cBf/fnAX/2pgA/+WkAv/dmA//tmwD/+GbF//5vAH/9LcA//azHv/4 txH/+bgS//q7Fv/5vhj/+8Id//vEH//8xyP//Mgk//rMIf/6zCH/+swh//rKIv/8yCT/+8cj //vHJf/8xiX/+sce//rFHf/5xBz/+sEa//m+GP/5vBb/+LkU//e4E//3tw3/97cN//e3Df/3 tw3/97cN//e3Df/3tw3/97cN//rDIP/6xSH/+cgj//rLJ//5zir/+dIt//rUMf/51jL/+9Uy //vVMv/71TL/+tQx//rUMf/61DH/+dMw//nTMP/50TH/+NEu//rQLv/5zyv/+c4p//rNKf/5 zSb/+c0m//rJJv/5yCX/+sYi//nFIf/4wx3/98EZ//bAGP/2wBj/+bsS//m7Ev/4uhH/97kQ //a4D//2uA//9bcO//W3Dv/2vBD/9r4R//bAFf/3xBn/+Mkh//jNJv/50Cr/+NEr//vaN//8 2zj//d08//zgPv/95EL//uZG///pSP/+6kn//O1S//zsT//9603/++dI//vlRP/64T7/++A7 //rfOv/11Sj//9k3///RH//xwhT/9sUq/+68Bf/5swP/ymkC/+3t6//5+ff////9//7+/P/9 /fv////9/////f////3///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////huYj/sXMQ//agD//8ngD/8J0A/+mmAP/0 tAz/9q4M/+uoG//mphD/7LEP//rFF//9zBj/8sUU/+7EGP/2yyb/+c0s//nNLP/6zi//+s8y //nQNv/50Dj/+dE7//nRO//51UP/+dVD//nURf/51EX/+dRH//nUSP/51Ej/+dRI//jTR//4 00f/+NNH//jTR//30kb/99JG//fSRv/20UX/+c9H//nPR//4zkb/981F//fNRf/2zET/9ctD //XLQ//2xUL/9sZA//bGQP/2xD3/98M8//bCOv/3wjj/9sE3//O/Lf/0vSz/870p//K6Jf/x uST/8Lcg/++2H//wtR3/8LEO/+6vDP/srAz/66kM/+ynC//rpgv/6qML/+ihCf/spwL/7KcC /+ynAv/spwL/66YB/+umAf/rpgH/6qUA/+qkBv/qpAb/6qQG/+mjBf/powX/6aMF/+iiBP/o ogT/6aMH/+mjB//powf/6KIG/+iiBv/noQX/56EF/+ehBf/kogb/5KIG/+OhBf/joQX/46EF /+KgBP/ioAT/4qAE/+CdBv/gnQb/4J0G/+CdBv/fnAX/35wF/9+cBf/emwT/3ZsA/+CeAf/d lxH/t20A/+qlHP/ytQD/9rkA//azHP/5uhP/+bwU//m+GP/6wRr/+sUf//vIIf/7yiX//Msm //nPJf/6zif/+s4n//nMKP/7zCj/+8sp//vLK//7yyv/+ssj//nKIv/5ySH/+cYf//jDHf/4 wRz/+L8a//i/Gv/4uxL/+LsS//i7Ev/4uxL/+LsS//i7Ev/4uxL/+LsS//rGIv/5yCP/+ssn //nOKf/60Cz/+dMw//nWMv/52DX//NYz//zWM//81jP/+9Uy//vVMv/71TL/+tQx//rUMf/5 0zL/+dEx//nSL//60Cz/+s8r//nOKf/6zSn/+s4n//rLJ//6ySb/+cgl//rGIv/5xB7/98Ic //fBGf/3wRn/+bwT//i7Ev/4uxL/97oR//a5EP/2uRD/9bgP//W4D//2vBD/978S//fBFv/4 xRz/+Mkh//jNJv/40Sv/+dIt//zbOP/83Dn/+948//3hP//95EL//uZG///pSP/+6kv//O1S //zsT//9603/++dI//vlRP/64T7/++A7//rfOv/21i3//9U4///QIv/zwRT/+MMn/+66Av/7 uAn/vGMA/+/v7f/6+vj////9//7+/P/9/fv////9/////f////3///////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// 9/r/vY9e/8mCBv/8pQD/+aEC/+2cF//yqhr/8K4A/9+eAv/urg7/+8EX//3IFv/5yBT/9MYY //PHHv/1yib/+c0s//nNLP/6zi//+c4x//jPNf/50Dj/+dE7//nRO//41ED/+NRC//jUQv/4 00T/+NNG//jTRv/400f/+NNH//jTRv/400b/99JF//fSRf/30kX/9tFE//bRRP/20UT/+c1G //nNRv/5zUb/+MxF//fLRP/2ykP/9spD//XJQv/2xkD/9sZA//XFPf/1wzz/98M7//bCOP/2 wTf/9sE3//O/Lf/0vSz/87wr//K6J//xuST/8Lci/++2H//wtB7/8rEV/+6tEf/qqQ3/6qgL /+6pDf/uqgv/6qQG/+agAv/spwL/7KcC/+ynAv/rpgH/66YB/+qlAP/qpQD/6qUA/+qkBv/q pAb/6aMF/+mjBf/powX/6KIE/+iiBP/oogT/6aMH/+mjB//oogb/6KIG/+ehBf/noQX/56EF /+ehBf/joQX/46EF/+OhBf/joQX/4qAE/+KgBP/ioAT/4Z8D/+CdBv/gnQb/4J0G/9+cBf/f nAX/3psE/96bBP/emwT/350A/9uYAf/XkBD/vnUC//OvIP/srgD/+LoD//e1Gf/3vhX/+L8W //jCGv/4xRz/+ckh//rLI//6zif/+s8o//jRLP/40Sz/+tAs//vRL//70TH/+9Ex//vQM//7 0DP/+dIs//rRK//50Cr/+c4p//nMKP/4yyf/+com//jJJf/4whr/+MIa//jCGv/4whr/+MIa //jCGv/4whr/+MIa//nMKP/6zSn/+s8r//nSLf/61DH/+tc1//rZNv/52Tj//Nk3//zZN//7 2Db/+9g2//vYNv/61zX/+tc1//rXNf/41TP/+tQz//nTMv/60zD/+9Et//rQLP/70Cv/+s8q //rNKv/7yyn/+ssn//nII//6xiL/+MUe//jDHf/3whr/+b8V//i+FP/4vhT/970T//a8Ev/1 uxH/9bsR//S6EP/2vhH/+MAV//fDGP/3xx3/98si//jPKf/50i3/+dQu//vbOv/83Dv//N89 //3hQP/95UX//uhH//7qS///60z//O1S//zsT//9603/++dI//vlRP/64T7/++A7//rfOv/6 1DP/+884//vPJv/zwBX/+MAh//C4AP/7vRL/rV0G//Pz8f/7+/n////9//7+/P/+/vz////9 /////f////3///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////P///+Xd/6NqG//wpgf/8ZsA//+uI//fkgj/8K4C /+urA//ytAn/97sL//a/Df/2wxL/+soe//nNJv/4yyj/+Mwr//nNLP/5zS7/+c4x//jPNf/5 0Dj/+NA6//jQOv/40j//+NI///jSQf/40kH/+NJD//jRRf/40UX/+NFF//jRRf/40UX/99BE //fQRP/30ET/9s9D//bPQ//2z0P/+c5E//jNQ//4zUP/98xC//bLQf/1ykD/9cpA//TJP//2 xkD/9cU9//XFPf/1xDv/9sI4//XBN//2wTX/9sE1//O/Lv/0vS3/87wr//K6Kf/xuSb/8Lci /++2If/wtB7/8rAc/++tGP/sqxP/7KoO/+6qC//tqQb/66YB/+ijAP/spwL/7KcC/+umAf/r pgH/6qUA/+qlAP/qpQD/6qUA/+mjBf/powX/6aMF/+mjBf/oogT/6KIE/+ehA//noQP/6KIG /+iiBv/oogb/56EF/+ehBf/noQX/5qAE/+agBP/joQX/46EF/+OhBf/ioAT/4qAE/+GfA//h nwP/4Z8D/+CdBv/gnQb/35wF/9+cBf/emwT/3psE/96bBP/emwT/4J4A/9mVBv/Kggn/zocL //azHP/trwD/97kG//m4Fv/2whf/98MY//jFHP/4yB7/+Mwj//nPJf/60Sn/+dMq//nTMv/5 0zL/+tQz//nVNv/51Tf/+dc4//rXO//61zv/+tky//rZMv/52DH/+tcx//nWMP/41S//+NUv //fULv/4yyf/+Msn//jLJ//4yyf/+Msn//jLJ//4yyf/+Msn//rVL//61DH/+dYy//rXNf/7 2jf/+9s6//nbO//63Dz//Nw7//zcO//83Dv/+9s6//vbOv/62jn/+to5//raOf/62Dj/+dc3 //rXNf/71TT/+tQx//rTLv/60y7/+9Is//vQLP/6zyv/+s0q//rLJ//5yiT/+Mci//fHH//4 xR7/+sEY//nAF//5wBf/+L8W//e+Ff/2vRT/9r0U//a9FP/4wBX/98EW//jEGf/4yCD/+c0m //rRK//51C7/+NUx//zcO//73jz//OA///ziQ//+5kb//elK//7sTP//7U///O1S//zsT//9 603/++dI//vlRP/64T7/++A7//rfOv//1Df/9cs5//jNKP/0wBT//L0a//S3AP/zuRn/pmUh //n59//8/Pr//v78//7+/P/+/vz////9/////f////3///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////2//r///r/ /+C8nP+obgD//bIB//GbAP/2pQ3/6KMA//SyBv/xsgP/8bQE//O6C//2wBX/+sce//vMJv/7 ziv/+Mwr//jMK//5zS7/+M0w//fONP/4zzf/+NA6//jQOv/50Tz/+dE8//nRPv/50ED/+dBA //nQQv/50EL/+dBE//nQQv/50EL/+M9B//jPQf/4z0H/985A//fOQP/3zkD/+sxC//nLQf/5 y0H/+MpA//fJP//2yD7/9sg+//XHPf/1xT3/9cU9//TFO//1xDv/9sI4//XCNf/1wDT/9cAy //O+MP/0vS3/87ws//K6Kf/xuSb/8LYk/++2If/wtCD/760b//CuGv/wrxf/7qwQ/+yoCf/p pQL/6qUA/+yoAP/rpgH/66YB/+umAf/qpQD/6qUA/+qlAP/ppAD/6aQA/+mjBf/powX/6KIE /+iiBP/oogT/56ED/+ehA//noQP/6KIG/+iiBv/noQX/56EF/+ehBf/moAT/5qAE/+agBP/j oQX/4qAE/+KgBP/ioAT/4Z8D/+GfA//hnwP/4J4C/9+cBf/fnAX/35wF/96bBP/emwT/3psE /92aA//dmgP/3pwA/9yWEv+6cQD/4pwY//SzEf/ztAT/9bYJ//u7E//3wxj/98QZ//fHHf/4 yh//980j//nQJv/40in/+dMq//nTMv/61DX/+dU2//nXOP/62jr/+ds9//rcQP/63UH/+948 //vePP/73jz/+t48//rePP/63jz/+t48//rePP/51jT/+dY0//nWNP/51jT/+dY0//nWNP/5 1jT/+dY0//zcOf/63Tn/+946//vePP/73z7/+98+//nfQP/64EH//d9B//zeQP/83kD//N5A //vdP//73T//+90///rcPv/72zv/+9s6//vZOf/62Tb/+9g0//zWM//71jD/+9Yw//zSMP/8 0jD/+9As//rPK//5zCj/+ssl//nKJP/4ySP/+sQc//rEHP/5wxv/+cMb//jCGv/3wRn/9sAY //bAGP/3wRf/98MY//nGHf/5yiL/+c4p//nSLf/51jL/+tc1//vdPf/83j7//eFC//zkRP/+ 50n//upN///tT//+7lD//O1S//zsT//9603/++dI//vlRP/64T7/++A7//rfOv//1Db/88k5 //TNKv/1wRX//7oU//e1AP/gqRj/tIFW/////f/9/fv//Pz6//39+/////3////9/////f// //3///////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////7//P/9PP7///6+P+pgTz/05EF/+2dAP//rAj/7J8F/+2qAf/v rAP/9LYN//m/Fv/3wRn/88AZ//bFIP/+zyv/98sq//jMK//4zC3/+M0w//fONP/4zzf/9885 //jQOv/40Dv/+NA7//jQO//40D3/+M8///jPP//4z0H/+M9B//jPQf/4z0H/+M9B//fOQP/3 zkD/9s0///bNP//2zT//+stB//nKQP/5ykD/+Mk///fIPv/2xz3/9sc9//bHPf/1xjz/9MU7 //TFO//0wzj/9cI1//XCNf/1wDL/9cAy//O+MP/0vS//87ws//K5Kv/xuSj/8LYk/++1I//w tCL/7qwY//GvGv/ysRn/8K4S/+unCP/opAH/6qUA/+2oAv/rpgH/66YB/+qlAP/qpQD/6aQA /+mkAP/ppAD/6aQA/+iiBP/oogT/6KIE/+iiBP/noQP/56ED/+ehA//moAL/56EF/+ehBf/n oQX/56EF/+agBP/moAT/5Z8D/+WfA//ioAT/4qAE/+KgBP/hnwP/4Z8D/+CeAv/gngL/4J4C /9+cBf/fnAX/3psE/96bBP/dmgP/3ZoD/92aA//dmgP/3JsA/96WHf+wZgD/76oe//S1CP/3 uAv/97cP//m6Df/2whf/98MY//jFHP/4yB7/98si//nPJf/50Cj/+NIp//nRMf/60jL/+tQz //nXN//62jr/+tw8//vfQP/64EH//eFA//3hQP/74kD//ONB//vjQf/75UL/++VC//vlQv/7 3z7/+98+//vfPv/73z7/+98+//vfPv/73z7/+98+//zlQf/85UH//ORC//vjQf/740P/++NF //vjRf/740X//uFF//7hRf/94ET//eBE//zfQ//830P//N9D//zfQ//73T3/+909//rdO//8 3Dv//Ns4//vaNf/72DT/+9g0//zUNP/81TL/+9Qx//vRLf/6zyv/+c4p//nNJv/4zCX/+sce //rHHv/5xh3/+cYd//jFHP/3xBv/98Qb//bDGv/3wxj/+cQc//jIIP/4zCX/+dAq//rUMf/6 1zX/+tk2//vfPv/84EH//OJD//3lR//96Uz//uxO//7uUf//71L//O1S//zsT//9603/++dI //vlRP/64T7/++A7//rfOv//1DD/8so3//LMKf/4wxX//7YO//20AP/DkBD/0quc/////f/+ /vz/+vr4//39+/////3//v78//7+/P////3///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////+/r//P///+/x8P// 6tX/oGYd//WlHP/rlQD/+aYI/+eiAP/tqQb/9bQS//u9HP/4vhz/874a//PCHf/5yCP/98sq //fLKv/4zC3/+M0w//fONP/3zjb/9885//fPOf/4zzn/+M85//jOOv/4zjr/+M48//jOPv/4 zj7/+M1A//jOPv/4zj7/+M4+//jOPv/3zT3/9809//bMPP/2zDz/+co+//nKPv/4yT3/98g8 //fIPP/2xzv/9cY6//XGOv/0xTv/9MU7//TFOf/0wzb/9cI1//TBMv/1wDL/9MAv//O+Mv/0 vS//87wu//K5Kv/xuCn/8LYm/++1I//wtCL/8K8X//CvFf/wrxX/7qwQ/+2pCv/rpwb/66UF /+umA//qpQD/6qUA/+qlAP/qpQD/6aQA/+mkAP/oowD/6KMA/+iiBP/oogT/6KIE/+ehA//n oQP/56ED/+agAv/moAL/56EF/+ehBf/noQX/5qAE/+agBP/lnwP/5Z8D/+WfA//ioAT/4qAE /+GfA//hnwP/4Z8D/+CeAv/gngL/4J4C/96bBP/emwT/3psE/96bBP/dmgP/3ZoD/9yZAv/c mQL/2pkA/92UIf+uZAD/8q4b//m7CP/1tQv//bwY//a3B//3vhX/9sAW//fCGv/4xRz/+ckh //jMI//5zif/+s8o//rPK//60C7/+tMw//nWNP/72jf/+t07//vfPv/64T///eBE//7hRf/9 40b//eVH//3mSP/86En//OhJ//zqSv/750j/++dI//vnSP/750j/++dI//vnSP/750j/++dI //zrRv/860b/++lH//zoR//750j/+uZJ//zlSf/85Un//eNI//3jSP/940j//eNI//ziR//8 4kf//OJH//vhRv/84EH//OA///vfPv/73jz//Nw7//zcOf/82zb//Ns2//3XNv/91zb/+9Uy //vUMf/70S3/+tEr//rPKv/5zin/+soi//rKIv/5ySH/+Mgg//jIIP/3xx//9sYe//bGHv/5 xBz/+cYd//nJIf/5zCj/+tAs//vVMv/62Tb/+9k5//zgQf/74UL//ORG//3mSP/96Uz//+xQ //7uUf/+8FL//O1S//zsT//9603/++dI//vlRP/64T7/++A7//rfOv//0yj/9Mw2//DNKf/8 xBX//7UM//+0Bv+ndQb/9dbe/////f////3/+fn3//39+/////3//v78//39+/////3///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////9///+//6//f/+v//8/3/6LCf/61bAP//qg7/8p0A/+mjBf/tqAz/8K4S //O0F//2vB3/98Eg//fDH//zwxv/98sq//fLKv/4zC3/98wv//bNM//3zjb/9885//fPOf/4 zzn/+M85//jOOv/4zjr/+M48//jOPv/4zj7/+M4+//jOPv/4zj7/+M4+//fNPf/3zT3/9sw8 //bMPP/2zDz/+co+//jJPf/4yT3/98g8//bHO//1xjr/9cY6//TFOf/0xTv/9MU5//PEOP/0 wzb/9cIz//TBMv/0wC//9MAv//O+Mv/0vDH/87wu//K5LP/xuCn/8LYm/++1Jf/wtCL/9LMX //CvE//sqw//7KoN//CrD//vqwz/7KYI/+iiBP/qpQD/6qUA/+qlAP/ppAD/6aQA/+mkAP/o owD/6KMA/+iiBP/oogT/56ED/+ehA//noQP/5qAC/+agAv/moAL/56EF/+ehBf/moAT/5qAE /+agBP/lnwP/5Z8D/+WfA//ioAT/4Z8D/+GfA//hnwP/4J4C/+CeAv/gngL/350B/96bBP/e mwT/3psE/92aA//dmgP/3ZoD/9yZAv/cmQL/2pkA/9uSI/+xZgD/8K0W///BCv/ysgr//8Ig //S2A//3vRT/974V//fBGf/4wxv/+cYf//nKIv/4zCX/+c0m//nMKP/6zyr/+9Et//rUMf/6 2TT//Nw5//vgO//64T7//+BH///gR///4kj//eRJ//7nS//96Uz//etN//3rTf/9603//etN //3rTf/9603//etN//3rTf/9603//etN//vuSP/87Ur/++xJ//3rS//86kz//OhL//vmS//7 5kv//eRJ//3kSf/95En//eRJ//zjSP/840j/++JH//viR//74UL/++FC//zgP//73z7/+948 //3dOv/83Dn//dw3//zZN//72Db//NY1//vVMv/60y7/+9Et//nQKv/6zyr/+8sj//vLI//6 yiL/+ckh//nJIf/4yCD/98cf//fHH//5xBz/+cYf//nKJP/6zSn/+dIt//vVMv/62Tb/+9s6 //zgQf/74UL//ORG//3mSv/+6k3//e1Q//7wUv//8FX//O1S//zsT//9603/++dI//vlRP/6 4T7/++A7//rfOv//0yT/9c41/+/OJ//9xhT//7MK//+zCv+UZQD///L//////f////3/+fn3 //39+/////3//f37//39+/////3///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////x+v//+/////Hz7v///v////n/ /6yEav/Hghv//6YD/+uZEf/0qQ//868C//e5Bv/epAD/8LgZ//nCKv/vuSH/9MQm//TEJv/0 xij/9ccp//bKK//2zCz/980t//jOLv/4yzD/+Msy//jLMv/4yzT/+Mo2//jKNv/4yjf/+Mo3 //nMNf/5zDX/+cw1//jLNP/4yzT/+Ms0//fKM//3yjP/98Y5//bFOP/2xTj/9cQ3//TDNv/z wjX/88I1//LBNP/xwzD/8sIw//HBL//yvy7/8r8u//K+Lf/zvCz/87ws//C5KP/wuSj/8Lgn /++3JP/vtiH/77Mf/++zHf/vshz/8K8X//CvF//vrhT/7qsS/+6pDv/tqAz/7acL/+ymCv/r ogX/66IF/+uiBf/qoQT/6qEE/+qhBP/poAP/6aAD/+ehBf/noQX/56EF/+agBP/moAT/5Z8D /+WfA//lnwP/5Z8D/+WfA//kngL/5J4C/+SeAv/jnQH/450B/+OdAf/knQf/5J0H/+OcBv/j nAb/4psF/+KbBf/imwX/4psF/+GZB//hmQf/4ZkH/+GZB//gmAb/4JgG/+CYBv/flwX/25kA /+aaIP+4aAX/8akX//i2AP/1sgP//rkW//m1Cv/2vhP/978U//fBF//3wxj/98cd//fIIP/3 yyL/+Mwj//vQLP/80S3//NIw//zUNP/72Db//No6//3dPP/93T3//N4+//zgP//94UL//OJD //3lR///5kv//+hM///oTP/+6U7//epO//7rT//87E///O5Q//3vUf/98FL//fBS//vrTv/7 607/++tO//vrTv/7607/++tO//vrTv/7607//ehN//3oTf/96E3//OdM//znTP/75kv/++ZL //vmS//85kX/++VE//vlRP/740P/++FC//rgQf/84EH/+99A//3dPP/83Dv/+9s4//rZNP/6 1zP/+NUv//nULv/40yz/+M0o//fMJ//3zCf/98wn//bLJv/2yyb/9ssm//XKJf/9zCf/+8wm //nMKP/4zSj/+tAs//vVMv/92jb//9w6//bdQ//54Eb/++RJ//3oTf/87E//++1P//rtT//5 7E7//OtT//3qUP/850z//OVJ//vhRP/63j3/+dw6//jbOf//3Bz/47ok/+m/K//1wwL/5KQA /9+eJv/GnHL///3x//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////3/v//9vv3//7/+P/3+Pr//fb+///34v+ocCP/04gI//+wDP/4qAv/86UN/++lDv/4 thr/7bMT//K8G//3xST/9MIl//TEJv/1xSf/9MYo//XJKv/2yiv/980t//fNLf/4yzD/+Msw //jLMv/4yzL/+Ms0//jKNv/4yjb/+Mo2//nMM//4yzL/+Msy//jLMv/3yjH/98ox//fKMf/3 yjH/9sY2//bGNv/1xTX/9cU1//TENP/zwzP/8sIy//LCMv/ywjD/8cEv//HBL//yvy7/8r4t //K+Lf/zvCz/87ws//C5KP/wuCf/8Lgl/++1I//utSD/77Md/++yHP/vshz/8K8X/++uFv/u rRP/7qsS/+6pDv/spwv/7KYK/+ymCv/rogX/66IF/+uiBf/qoQT/6qEE/+mgA//poAP/6aAD /+ehBf/noQX/5qAE/+agBP/moAT/5Z8D/+WfA//lnwP/5Z8D/+SeAv/kngL/5J4C/+OdAf/j nQH/450B/+KcAP/jnAb/45wG/+OcBv/jnAb/4psF/+KbBf/hmgT/4ZoE/+GZB//hmQf/4ZkH /+CYBv/gmAb/35cF/9+XBf/flwX/3JgA/+SZGf+3aQD/66Ea//WxBv/8ugT/+LQH//u3Dv/3 vRP/970T//jAFf/3wxj/+MUc//jIHv/4ySH/98si//vOK//70Cz/+9Ev//vUMf/81jX/+9k5 //zcO//93Tz/+909//zePv/84D///OJD//3jRv/+5kj//+ZL///oTP/96E3//ulO//3qTv/8 7E///e1Q//3vUf/971H//fBS//3tUP/97VD//e1Q//3tUP/97VD//e1Q//3tUP/97VD//+pP //7pTv/+6U7//ulO//3oTf/96E3//ehN//znTP/65kX//OZF//vlRP/740P//OJD//vhQv/8 4EH//OBB//vePP/93Tz//Nw5//vaN//61zP/+dYw//rVL//51C7/+M0o//jNKP/4zSj/98wn //fMJ//2yyb/9ssm//bLJv/8zSf/+8wo//nMKP/5zir/+NEs//vVMv/92jj//9w6//jfRf/6 4Uf//OVK//7pTv//7FD//e1Q//vtT//67E7//+xS//7pUP/+50z//eVH//vhQv/73T3/+9s6 //raN//4yh3//9E9//nILf/psgD//boT/6NjC//w0Ln////9//////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////x9Pv//v/7//L26P/7//v/+/////vy6f/9 3rL/lWMa/+uaAP/0oQX//KYb//ejHf/xphn//8Io/96pAf/8ziD/9L8h//PBIv/0wiP/9MQk //THJv/2ySj/9sop//bKKf/3yy7/98su//fKL//3yi//98ox//fKM//3yjP/98oz//jLMv/3 yjH/98ox//fKMf/2yTD/9skw//bJMP/2yTD/+MU0//fEM//3xDP/9sMy//XCMf/0wTD/9MEw //PAL//xwi7/8cIu//LALf/xvyz/8r4s//O8K//yuyr/87sq//C4J//wuCX/8LYk/++2If/w tCD/77Ic/+6xGv/usRr/764W/++uFv/trBL/7aoR/+2oDf/spwv/7KYK/+ulCf/rogX/66IF /+qhBP/qoQT/6aAD/+mgA//poAP/6aAD/+agBP/moAT/5qAE/+agBP/lnwP/5Z8D/+WfA//k ngL/5J4C/+SeAv/kngL/450B/+OdAf/jnQH/4pwA/+KcAP/jnAb/45wG/+KbBf/imwX/4ZoE /+GaBP/hmgT/4ZoE/+CYBv/gmAb/4JgG/+CYBv/flwX/35cF/96WBP/elgT/3pYD/9uSCP/C dgD/1IgQ//myGv/9vAD/97YA//m0D//3uw//9rwQ//a+E//2wBb/98MY//jFHP/4yB7/+Mkh //rNKf/7ziv/+9As//rTMP/71TT/+9g2//vZOf/72zr/+t07//vePP/83j7//eFC//ziQ//+ 5Ef//uZI///mS//96E3//ehN//7pTv/96k7//OxP//3tUP/971H//e9R//7uUf/+7lH//u5R //7uUf/+7lH//u5R//7uUf/+7lH//+xR///rUP//61D//+tQ///qT///6k///+pP//7pTv/7 50j/+uZH//zlR//75Eb/++NF//vhRP/74UT/++FE//zePv/83z3//d08//vbOP/62TT/+tcz //nWMP/41S//+c4p//nOKf/5zin/+M0o//jNKP/3zCf/98wn//fMJ//9zir/+s0p//nOKv/4 zir/+dIv//zWNf/+2zn//947//rhRv/75Ej//udL///rTv//7U///+1P//zsTv/7603//+pP ///pTv//5kv//eNE//3fP//93Tz//Ns4//zZNf/5yzD//9g6//bBE//ztQL/6aQj/6x0Q/// +fj/9f////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////+ ////9fTv////8//5//j/8v////P7/f///fT/zLOd/7NjAP/2pR7/7ZoA//+zHP/2oxn/6qIY //vDJP/nugX/870f//S+IP/0vyH/88Ei//XDJP/1xSX/98cn//XIJ//2yCr/9sgq//bIKv/2 yCz/9sgt//bILf/2xy//9scv//fJLv/3yS7/98ku//bILf/2yC3/9sgt//XHLP/1xyz/98Uy //bEMf/2xDH/9cMw//TCL//zwS7/88Eu//PBLv/ywC3/8sAt//G/LP/yviz/87wr//K7Kv/y uin/8rop/++3JP/wtiT/77Yh//C0IP/wsx3/7rEa//CwGv/vrxn/7q0V/+6tFf/trBL/7KkQ /+ynDP/rpgr/66UJ/+qkCP/qoQT/6qEE/+qhBP/poAP/6aAD/+mgA//onwL/6J8C/+agBP/m oAT/5qAE/+WfA//lnwP/5J4C/+SeAv/kngL/5J0D/+SdA//jnAL/45wC/+OcAv/imwH/4psB /+KbAf/imwX/4psF/+GaBP/hmgT/4ZoE/+CZA//gmQP/4JkD/+CYBv/flwX/35cF/9+XBf/e lgT/3pYE/96WBP/dlQP/3ZMQ/9WNAP/WjAn/umwA//mvKP/3tgD/+roA//SvDP/2uA3/97kO //i8EP/4vhT/98EX//jEGf/4xRz/98cd//rLJ//5zCj/+c4q//rQLP/60zD/+dY0//rZNv/6 2Tb/+9s6//zcO//73jz//N4+//3hQv/940T//uRH//3lR//+50z//udM//3oTf/96E3//epO //zsT//97VD//O5Q///vUv//71L//+9S///vUv//71L//+9S///vUv//71L//+1S///tUv// 7VL//+xR///sUf//61D//+tQ///rUP/76Un/++dI//vnSP/85Uf/++RG//vjRf/84kX/++FE //3hQP/93z///N89//zcO//72zj/+tk0//rXM//51jL/+c8r//nPK//5zyv/+c8r//jOKv/4 zir/+M4q//fNKf/8zyv/+84r//rPK//5zy3/+dMy//vYNv/+3Dz//98+//vkSP/85Un//+hM ///qTv//7E///+tO//7qTf/86Ev//+hN///mSf//5EX//+FB///dPf/92jb//dgy//zXMf// 0Tv/+MQW//e8AP//whz/rGsN//bMtv///f//6f////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////5/fz////6////9P/5//b/7f36//L////f4+z///v/ /82Kbf+9fBj/66cA//SlAP/8pxb/8KAl//GwIv/rugj/8bka//K6G//yvBz/9L4e//TAH//0 wiH/9cMi//bEI//3xyX/98cn//fHJ//3xyn/98cp//fGK//3xiz/98Ys//jHLf/4xy3/98Ys //fGLP/3xiz/9sUr//bFK//2xSv/98Mv//bCLv/2wi7/9cEt//TALP/zvyv/878r//O/K//x vyr/8r4q//G9Kf/zvSn/8rwo//K6J//yuCb/8rgm/++2If/vtiH/8LQg/++zHf/vshv/8LAa /++wF//vrhb/7awU/+2sFP/sqxH/66gP/+umC//qpQn/6qQI/+mjB//qoQT/6qEE/+mgA//p oAP/6aAD/+ifAv/onwL/6J8C/+agBP/lnwP/5Z8D/+WfA//kngL/5J4C/+SeAv/jnQH/45wE /+OcBP/jnAT/4psD/+KbA//imwP/4ZoC/+GaAv/hmgT/4ZoE/+CZA//gmQP/4JkD/9+YAv/f mAL/35gC/9+XBf/elgT/3pYE/96WBP/dlQP/3ZUD/92VA//clAL/2I0O/9qSAP/ckgv/uWsA /+SYHv/1sgP/97YA//GsBv/3tQn/9rcK//e5Dv/4vBD/978U//fBF//3wxj/+MQZ//nII//5 yiT/+Msn//nOKv/40Sz/+dMw//nWMv/51jT/+9o3//raN//72zr/+948//zgP//94UL//OJD //3jRP/+5Uv//eZL//7nTP/850z//OlN//3qTv/87E///OxP///vUv//71L//+9S///vUv// 71L//+9S///vUv//71L//+1S///tUv//7VL//+xR///sUf//61D//+tQ///rUP/86kz/++lL //vpS//750r//OVJ//vkSP/840j/++JH//7iQ//94UL//OA///zfPf/83Dv/+9s4//rZNv/6 2TT/+dIv//nSL//40S7/+NEu//jRLv/30C3/99At//fQLf/8zyz/+9As//nPLf/40S7/+NUz //vZOf/93Tz//+BA//nlRv/85Uf//+hK///pS///6Uv//+hK//7mSP/85Eb//+NH///iRP// 4ED//tw8//7YNf/91jH//dQu//zTLf/7ySz/8rsA///HBf/bnhD/qng5///57f/2+vn/8P// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////t9+/////7 //Hr6//8/Pr/+P///+v7+//4/////fj////l/P+5kVb/vooA/+ymAP/xnQb//7Iw/9qTB//6 wRr/8bcX//K4GP/zuRn/87wb//O9HP/1vx7/9cEf//bCIP/1xiL/9cYi//XFI//1xSP/9cUl //XFJ//1xSf/9cQp//bFKv/2xSr/9sUq//bFKv/1xCn/9cQp//XEKf/0wyj/9sMs//bDLP/1 wiv/9MEq//PAKf/zwCn/8r8o//K/KP/xvSn/8b0p//K8KP/yvCj/8ron//K4Jv/xtyX/8bcl //C0IP/wtCD/77Md/++yG//wsBr/77AX/++uFv/urRP/7awU/+yrE//rqhD/6qcO/+umC//p pAj/6aMH/+iiBv/poAP/6aAD/+mgA//poAP/6J8C/+ifAv/nngH/554B/+WfA//lnwP/5Z8D /+SeAv/kngL/450B/+OdAf/jnQH/45wE/+OcBP/imwP/4psD/+KbA//hmgL/4ZoC/+GaAv/g mQP/4JkD/9+YAv/fmAL/35gC/96XAf/elwH/3pcB/96WBP/elgT/3ZUD/92VA//clAL/3JQC /9yUAv/clAL/1YwC/+ObC//Yjgn/zoEN/8h8Av/tpg7/7KgA//SxAv/3swb/9rQI//a3Cv/3 uQ7/+LwQ//i+FP/4vxb/98EX//fGIf/4xyL/+cok//fMJ//5zyv/+NEs//nTMP/41TH/+dgz //rZNv/62jf//Nw7//vePP/84D///eFC//7iQ//95Er//eRK//3mS//+50z//OdM//zpTf/9 6k7//epO//3tUP/97VD//e1Q//3tUP/97VD//e1Q//3tUP/97VD//+xR///rUP//61D//+tQ ///qT///6k///+pP//7pTv/66kz/+upM//zqTP/76Uv/++dK//zlSf/85Un//ONI//3jRP/9 40T//uJD//zgP//73jz//Nw7//vbOP/72jf/+tMw//rTMP/60zD/+dIv//nSL//50i//+NEu //jRLv/80C//+9Ev//jRLv/40jH/+dU2//vZOf/+3j7//+FB//jkRf/55Ub//eZI//7nSf/+ 5kj//eNG//vhRP/530L//98///7cPf/92Tr//dc0//3TL//70Cv/+s4n//nNJP/8wiD/+b0D //G0C/+eaQn/89W5//358P/5//j/9//2//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////1//r/7vDv///7////+////v////X89f/+////9u75//z+//// 9d7/nnco/9uaHP/wnwj/55QA//2zFv/urBD/8bUW//G1Fv/ythf/87kZ//O8G//0vRz/9L4d //W/Hv/1xB//9cQf//XEIf/1xCH/9cMi//XDJP/1wyT/9cMm//bDKf/2wyn/9sMp//bDKf/1 wij/9cIo//XCKP/0wSf/98Ep//fBKf/2wCj/9b8n//W/J//0vib/870l//O9Jf/xvif/8rwm //K8Jv/yuiX/8rkk//G4I//ztyP/8rYi//C0Hv/vsx3/77Ic//CwGv/vsBf/764W/+6tE//v rBP/7KsT/+uqEv/qqQ//6qcO/+qlCv/oowf/6KIG/+iiBv/poAP/6aAD/+mgA//onwL/6J8C /+eeAf/nngH/554B/+WfA//lnwP/5J4C/+SeAv/kngL/450B/+OdAf/jnQH/45wG/+KbBf/i mwX/4psF/+GaBP/hmgT/4ZoE/+CZA//fmAL/35gC/9+YAv/elwH/3pcB/96XAf/dlgD/3ZYA /92VA//dlQP/3ZUD/9yUAv/clAL/25MB/9uTAf/bkwH/2pMA/9+WDP/bkBD/2o8P/8F2AP/R hgf/6aIK//m3AP/3sQT/9rIF//e1Cf/2twr/+LoP//a8Ev/3vxT/+MAV//jFHv/3xx//98gi //fLJP/4zSj/99Ar//jTLf/40i//+dYy//nYM//62Tb/+9s4//zcO//83j7//OA///3hQP/9 4kn//eRK//3kSv/95kv//udM//znTP/86U3//OlN//vrTv/7607/++tO//vrTv/7607/++tO //vrTv/7607//+pP//7pTv/+6U7//ulO//3oTf/96E3//ehN//znTP/7607/++tO//rqTf/7 6Ez//OdM//vmS//85Ur//OVK///lSP/+5Ef//eNE//3hQv/93z//+948//zcO//72zj/+tQz //rUM//61DP/+dMy//nTMv/50zL/+NIx//jSMf/80jD/+9Ev//nRMf/50zT/+NY2//vbO//9 3z///+JE//biQf/340L/+uRD//zkRP/84kP/+99A//ndPv/42jz//Ng5//vXOP/71TT/+9Ev //nOKf/4zCX/+Mkh//jIHv//vh//9rMM/8CCB/+7j2j///r///T+/f/8//b///b0//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////y//j//P/////5//// +f//8+/u//z+8//9+vP///v7/+P/8//4+vX//+XS/49NA//qmwr/86MA//SoAP/uphP/8rQV //K0Ff/xtRb/87cY//S6Gv/zvBv/9L0c//S+Hf/1xB//9cQf//XEH//1xCH/9cMi//XDIv/1 wyT/9cMk//bEJ//2xCf/9cMm//XDJv/1wyb/9MIl//TCJf/0wiX/98Io//bBJ//2wSf/9cAm //S/Jf/0vyX/874k//O+JP/yvCb/8rwm//G7Jf/yuiX/8rkk//G4I//ytiL/8rYi/++zHf/w sx3/77Ib//CwGv/wrxf/764U/++sE//uqxL/66oS/+uqEv/qqQ//6aYN/+mkCf/oowf/6KIG /+ehBf/poAP/6aAD/+ifAv/onwL/6J8C/+eeAf/nngH/554B/+WfA//kngL/5J4C/+SeAv/j nQH/450B/+OdAf/inAD/4psF/+KbBf/imwX/4ZoE/+GaBP/hmgT/4JkD/+CZA//fmAL/35gC /96XAf/elwH/3pcB/92WAP/dlgD/3ZYA/92VA//clAL/3JQC/9yUAv/bkwH/25MB/9uTAf/b kwH/4ZwA/9SKBf/nmyH/2I8E/82DAP+yZAD/7aQa//q5AP/3sQT/97EE//ezBv/4tgr/97kO //i8EP/3vRP/+L4U//fEHf/2xh7/9sch//bKI//3zCf/+M4q//jRLP/40y3/+dYy//nWMv/5 2DP/+9o3//zcO//73jz//N4+//zgP//94kn//eJJ//3kSv/+5Uv//eZL//znTP/96E3//OlN //npTP/56Uz/+elM//npTP/56Uz/+elM//npTP/56Uz//ehN//3oTf/96E3//OdM//znTP/7 5kv/++ZL//vmS//77U//++tO//vrTv/86U3/++hM//vmS//95kv//OVK//7mSP/+5Ef//eNE //7iQ//84D///N89//zcO//83Dv/+9U0//vVNP/61DP/+tQz//rUM//50zL/+dMy//nTMv/8 0jD//NIy//nRMf/30zT/+dc4//zcPP/930H//+NE//TiQP/24kH/+eNC//riQv/64EH/+d0+ //fZO//31jn/+9U2//rUM//50i//+c8r//jLJ//3yCD/9sYc//fEG//8sxn/6aEO/6FhCf// 8PH/9vX///L////z9uv///f///////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////79P/x8v//9P// //v04f+AVAD/7JsL//CQAP//oiD/8aYV/+ijCv/tsAj/7bkD//G/Bv/tugn//8or/++xIP/1 uxv/9rwc//W+Hf/2vx7/9sAf//bCIP/3wyH/98Mh//LAIf/ywCH/8sAh//LAIf/ywCH/8sAh //LAIf/ywCH/9b0i//W9Iv/0vCH/9Lwh//S8If/zuyD/87sg//O7IP/zuB7/87ge//K3Hf/y tx3/8bYc//C1G//wtRv/77Qa/++yGf/usRj/77AX/+6vFv/urRX/7qsU/+2qE//sqRL/7agM /+ynC//rpgr/6qUJ/+mkCP/oowf/56IG/+ahBf/pngX/6Z4F/+meBf/onQT/6J0E/+ecA//n nAP/55wD/+edAP/nnQD/5psB/+abAf/lmgH/5ZoD/+WaA//lmQX/45cF/+OXBf/jlwX/45cF /+KWBP/ilgT/4ZUD/+GVA//hlQH/4ZUB/+GVAf/glAD/4JQA/9+TAP/fkwD/35MA/9uUBP/b lAT/2pMD/9qTA//akwP/2ZIC/9mSAv/ZkgL/3JMG/9iPBP/Yjgf/25EM/9eMDP/LgAP/xXkA /8d7A//8vgD/7q8A/+6tAP/5tg3//LkT//m2EP/4tQz/9rQI//C8EP/zvxP/98MY//vIHf/8 zCD//c0j//zOI//7zSL/+c4p//nPK//40Sz/+dMw//jXNP/52Tb/+Ns5//ncOv/83kD//N5A //zgQf/74UL//OJD//vjQ//85ET/++VE//zlR//85Uf//OVH//zlR//95kj//eZI//7nSf/+ 50n//eZK//3mSv/95kr//eZK//3mSv/95kr//eZK//3mSv/85kP//OZD//zmQ//85kP/++VC //vlQv/75UL/+uRB//vhQv/74UL//OA///vfPv/73jz//d06//zcOf/93Df/99Yx//fWMf/3 1DD/99Qw//jSL//50i//+dIv//nSL//9zzH//tAy//7SMf/+1DL//tcy///aM//+3DT//t4z //vhLP//4TP//+A6//3bPP/51jz/+NQ4//3XOP//2jf//8Y7///XOv/6yBn/98kU//jFGv/9 xiH/97oS//a3Cv/lpBT/jlwD//jgxv/7////7f/5//H/8v///v////f///////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////759v/8////9Pn9///27f//5Lr/iEcA//2uL//zngX/4JIA//qtEf/y pxj/8a0a/+qsCf//xRv/3qID///DMP/1uRr/9bsb//W7G//1vh3/9b8e//bAH//2wiD/9sIg //G/Hv/xvx7/8b8e//G/Hv/xvx7/8b8e//G/Hv/xvx7/9Lwh//S8If/0vCH/87sg//O7IP/z uyD/8rof//K6H//zuB7/8rcd//K3Hf/xthz/8LUb//C1G//vtBr/77Qa/+6xGP/usRj/77AX /+6vFv/trBT/7aoT/+ypEv/uqBL/7KcL/+ynC//rpgr/6qUJ/+mkCP/nogb/56IG/+ahBf/p ngX/6J0E/+idBP/onQT/55wD/+ecA//nnAP/55wD/+acAP/mmwH/5psB/+abAv/lmgH/5ZoD /+SYBP/kmAT/45cF/+OXBf/jlwX/4pYE/+KWBP/hlQP/4ZUD/+GVA//hlQP/4ZUD/+CUAv/g lAL/35MB/9+TAf/fkwH/35MB/9qTA//akwP/2pMD/9qTA//ZkgL/2ZIC/9mSAv/YkQH/2o8C /9yRBP/ckAb/2o4H/9eKCP/Thgb/zoAE/8p8AP/dlBP/+LEh//e0Df/qqgD/87QA//u7Av/3 tQn/+bUU//G7Ef/zvRP/9cAY//nEHP/6xyD/+skk//rJJv/6ySb/+c4p//rPKv/60Cz/+tMu //nWMv/62Tb/+to3//ncOP/93T3/+909//zePv/84D//+uE///viQP/740H/++NB//rjRf/6 40X/++RG//vkRv/85Uf//OVH//zlR//85Uf/++RI//vkSP/75Ej/++RI//vkSP/75Ej/++RI //vkSP/75UL/++VC//vlQv/75UL/+uRB//rkQf/540D/+eNA//zgQf/84D//+98+//vePP/8 3Dv//Nw5//zbNv/82zb/99Yv//jVL//41S//+dQu//nULv/60y7/+9Et//vRLf/90TT//dEy //3TM//81TL//dc0//zZM//92jT//d00//zdLf/62i//+Ncy//XRMv/0zTD/880u//TNKv/2 zyn//NMX/+KyCv/8xDH//cEt//3AGv/2twf/9bEE//21Ef+sdh7/4LWI///4+P/+/P//9P/8 //j/9P/3+PL///r///////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////+74+v/9//X////v///8/f// 8Pz//+HO/4ZQAP/WlAD//60A//OcAP/5oRz/6JMS//+6Kf/tqQr/87MT//S1Gv/1txj/87cY //S4Gf/1uxv/9L0c//W+Hf/1vx7/9b8e//K+Hf/yvh3/8r4d//K+Hf/yvh3/8r4d//K+Hf/y vh3/9boe//W6Hv/1uh7/9Lkd//S5Hf/0uR3/87gc//O4HP/ztxv/8rYa//K2Gv/xtRn/8LQY //C0GP/vsxf/77MX/++wFf/vsBX/7q8U/+6tE//tqhH/7KkQ/+2oD//tqA//7acL/+ymCv/r pQn/6qQI/+mjB//oogb/56EF/+agBP/onQT/6J0E/+ecA//nnAP/55wD/+abAv/mmwL/5psC /+abAf/mmwH/5ZoB/+WaAf/kmQL/5JgE/+SYBP/kmAT/4pYE/+KWBP/ilgT/4ZUD/+GVA//h lQP/4JQC/+CUAv/glAL/4JQC/+CUAv/fkwH/35MB/96SAP/ekgD/3pIA/9uSBf/bkgX/2pEE /9qRBP/akQT/2ZAD/9mQA//ZkAP/14wA/92SA//ekwb/14sB/9aKA//ZjAj/1okH/86BAf+z Ygf/v3EE/+2kGv//wh//9bIA//GvAP/6twb/8KwB//rAFP/3vxT/9bwT//K8FP/xvBb/9L4d //XBIP/3wyL/+8wm//rOJ//6zyr/+9Is//vUL//61zP/+9o1//vaNf/72Tn//No6//vbOv/8 3Dv/+948//vfPf/73z3//OA+//rgQf/64EH/+uBB//vhQv/74UL//OJD//ziQ//84kP/++FE //vhRP/74UT/++FE//vhRP/74UT/++FE//vhRP/74kD/++JA//viQP/64T//+uE///rhP//5 4D7/+eA+//vdPf/73T3/+t07//zcO//82zj/+9o1//vYNP/72DT/+NUv//rVL//61S//+9Qv //rTLv/80i7//dIu//zRLf/80TX//NE0//vTNf/81DT//NY1//vYNP/82TP//Nkz//fSK//4 0y3/+dIv//nRMf/60C7/+c4q//fMJf/3yyD/6cYA//7QI//+wC//7aYM//iyAP/6tQD//bck /6JZAP/IqpL///b4///0////9v///P79//z/8//s8uj//v////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////L////8/fX///3t///8/f/8/f//9/T7/+/Up/+WYwf/5Y4A//GZA//xmAD//6kP //GbCP/3qBf/+7Ya/+iqAf/zsxP/9LQU//S2Ff/zuBb/9LkX//S6GP/1uxn/9L0a//K7Gv/y uxr/8rsa//K7Gv/yuxr/8rsa//K7Gv/yuxr/9Lkd//S5Hf/zuBz/87gc//O4HP/ytxv/8rcb //K3G//xtRn/8bUZ//G1Gf/wtBj/77MX/+6yFv/ushb/7bEV/+6vFP/trhP/7awS/+2qEf/s qRD/7agP/+ynDv/spQ3/7KYK/+ulCf/qpAj/6aMH/+iiBv/noQX/5qAE/+WfA//nnAP/55wD /+ecA//mmwL/5psC/+WaAf/lmgH/5ZoB/+WaAP/lmgH/5JkA/+SZAv/kmAT/45cD/+OXBf/j lwX/4ZUD/+GVA//hlQP/4ZUD/+CUAv/glAL/35MB/9+TAf/fkwL/35MC/9+TAv/ekgH/3pIB /96SAf/dkQD/3ZEA/9qRBP/akQT/2ZAD/9mQA//ZkAP/2I8C/9iPAv/YjwL/2IwA/9uOAP/c jwH/2YwA/9mMAv/bjQX/2owG/9eJA//WiRX/y34M/7NlAP/Hegb/+7Eu//+7I//zrwL//8IG /+itAP/usgL/9roM//zCFv/+xhv//MMa//bAGP/yvBT//Mki//vLI//7zCT/+88o//zRLP/7 1C7//Ncx//zXMf/71TT//NY1//rXNf/72Db/+9o3//vbOP/72zj/+t05//rdO//63Tv/+t07 //vePP/73jz/+948//zfPf/83z3//N5A//zeQP/83kD//N5A//zeQP/83kD//N5A//zeQP/8 3z3/+948//vePP/73jz/+t07//rdO//63Tv/+t07//vbO//72zr/+9k5//rZNv/72DT//NYz //vWMP/71jD/+9Qu//vULv/60y3//NMt//zRLP/80Sz//dAs//3QLP/80TX/+tI0//rSNP/6 0jL/+9Mz//vUMf/61S//+tUv//TIJ//6zSz//9My///UMv//0Sv/+8sj//nGG//3xRj/9sER //3BFf/noQD//8ED//SxAP/jqA7/klsJ/++4o////f7///v///Hl/f//+f///Pfz//v77//4 /vr/9/////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////T//////f////r6//z38//1//3/9f/9 ///37v/tyL//pFcR/+CWGf/rnwD/+qcA//WdAP/ynQ//7qUL/+2vAP/xsA7/8rEP//KzEP/z tBH/87US//K3E//zuBT/9LkV//K4GP/yuBj/8rgY//K4GP/yuBj/8rgY//K4GP/yuBj/87cZ //O3Gf/ztxn/87cZ//K2GP/ythj/8rYY//G1F//ysxb/8rMW//GyFf/wsRT/77AT/++wE//u rxL/7q8S/+2sEP/trBD/7asP/+yqDv/tqA3/7KUL/+ylC//rpAr/7aQJ/+yjCP/rogf/6qEG /+mgBf/onwT/554D/+eeA//mmwL/5psC/+abAv/lmgH/5ZoB/+SZAP/kmQD/5JkA/+SZAP/k mQD/45gB/+OYAf/jlwP/4pYE/+KWBP/ilgX/4JQC/+CUAv/glAL/4JQC/9+TAf/fkwH/35MB /96SAP/ekgH/3pIB/96SAf/dkQD/3ZEA/92RAP/ckAD/3JAA/9uPBf/bjwX/2o4E/9qOBP/a jgT/2Y0D/9mNA//ZjQP/2o0B/9eKAP/WiQD/2o0B/9qNA//YiwH/2YsD/92PB//dkQj/1okJ /9uLGP/KeQ3/rl4A/8t9AP/4rR7/+bAV//+/D//8vQ3/+boL//a5Cf/0uAj/9roK//a9Dv/3 vg//+sQa//rFHf/6xx7/+soi//vMJP/6zyj/+9Is//vSLP/70S//+9Ev//rTMP/71DH/+tQx //nWMv/61zP/+tcz//nYNf/62Tb/+tk2//rZNv/72jf/+9o3//vaN//72jf//No6//zaOv/8 2jr//No6//zaOv/82jr//No6//zaOv/82zj//Ns4//vaN//72jf/+tk2//rZNv/62Tb/+tk2 //rYOP/51zf/+tc1//vVNP/61DH/+tMu//rTLv/70iz/+tEr//rRK//70Cv/+s8q//vOKv/9 zir//M0p//zNKf/5zy//+c8v//rOL//6zi3/+c4q//nOKv/6zSn/+s0p//bBI//8yCf//84s ///LJf/4whr/8bsR//K6D//0vBH//7wd//GkAP//xw3/8bAA/8KNA/+HYRD//ePK///x+f/0 //z/8vj2///+/////Pr//fTt////+v/7////9v////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7////07vz///v///3++P/4/+3/6/ni///+////9v///9HB/4NQAf/kqRH/76YA/+WPAP/6 pBH/+KsP/+WkAP/xrQz/8a0M//KuDf/xsA7/8bIP//O0Ef/ztRL/87US//K3Ff/ytxX/8rcV //K3Ff/ytxX/8rcV//K3Ff/ytxX/8rYX//K2F//ythf/8bUW//G1Fv/wtBX/8LQV//C0Ff/y shT/8bET//GxE//wsBL/768R/+6uEP/urhD/7a0P/+ysDv/sqg3/7KoN/+ynC//spgr/66UJ /+yjCP/sowj/7aII/+yhB//soQf/6p8F/+meBP/onQP/55wC/+ecAv/lmgH/5ZoB/+WaAf/k mQD/5JkA/+SZAP/jmAD/45gA/+OYAf/jmAH/4pcA/+KWAv/ilgT/4ZUD/+GVBP/hlQT/4JQC /9+TAf/fkwH/35MB/96SAP/ekgD/3pIA/92RAP/dkAL/3ZAC/92QAv/cjwH/3I8B/9yPAf/b jgD/244A/9uOBP/bjgT/244E/9qNA//ajQP/2YwC/9mMAv/ZjAL/3YwF/9aFAP/VhAD/2okC /9qJAv/WhQD/2IcA/9+OB//NfgD/2osI/8x/AP/EdwD/1ogC/9CABf++bAD/w3AK/+ulCf/u qAz/8qwO//ayD//3thD/+bkP//i6Df/3uQz/+L4U//jAFf/3wRf/+MQZ//fHHf/4ySH/+Mwj //jMJf/6zSr/+s0q//rPK//70Cz/+tAs//nSLf/60y7/+dQu//nTMP/50zD/+tQx//rUMf/7 1TL/+9Uy//vVMv/71TL//NY1//zWNf/81jX//NY1//zWNf/81jX//NY1//zWNf/81jX//NY1 //zWNf/71TT/+9U0//rUM//61DP/+tQz//jVM//61DP/+dMy//rTMP/70S3/+tAs//vQK//6 zyr/+M0m//fMJf/4zCX/+ssl//nKJP/6yST/+skk//zIJP/4yyj/+ssn//nKJv/5yCP/+sYi //nGH//5xBz/+cQc//e9Hf/5vx3/+8Aa//i+FP/2ug7/9rgP//m6E//8vRj//KkF//+7Hf/k ohj/p3UW/62LXv//7uL/8/Lu//f/+P/u//D/8v/u////8//9+e7///76///+///1+P//+f// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////07////f//+////+vw9P////j////2/+vq7//5 //////z6///43/+KWRf/1Y8g//+yHv/ikQD/76MA/+6oCv/wqwj/8KsI//GsCf/xrQr/8K8L //KxDf/xsg3/8rMO//K0E//ytBP/8rQT//K0E//ytBP/8rQT//K0E//ytBP/87UW//O1Fv/z tRb/8rQV//K0Ff/xsxT/8bMU//GzFP/xsRP/8LAS//CwEv/vrxH/7q4Q/+2tD//trQ//7KwO /+yqDf/rqQz/7agM/+umCv/rpQn/7KMI/+uiB//rogf/7KEH/+yhB//roAb/6p8F/+idA//n nAL/5psB/+abAf/kmQD/5JkA/+SZAP/kmQD/45gA/+OYAP/jmAD/4pcA/+KXAP/ilwD/4pYC /+GVA//hlQP/4ZUE/+CUA//gkwX/35MB/9+TAf/ekgD/3pIA/96SAP/dkQD/3ZEA/92RAP/d kAL/3I8B/9yPAf/cjwH/244A/9uOAP/bjgD/244A/9qMBP/ajAT/2owE/9qMBP/ZiwP/2YsD /9iKAv/YigL/24kJ/9iGBv/VhAH/1YQB/9SDAP/UgwD/14YB/9qJBP/YiQb/yHoA/9OGAP/h lAr/0YMA/8V1AP/LeQv/z3wU/65eAP++bgD/14oK/+6iG//7syP//LYg//eyF//wrg//9bkN //a6Dv/2vBL/9L4T//bCF//2wxr/9sYc//bHH//5yib/+ssn//rLJ//5zCj/+c4p//rPKv/5 0Cr/+tEr//jRLP/40Sz/+NEs//nSLf/50i3/+tMu//rTLv/60y7/+9Qx//vUMf/71DH/+9Qx //vUMf/71DH/+9Qx//vUMf/71DH/+9Qx//vUMf/60zD/+tMw//nSL//50i//+dIv//nTMv/5 0TH/+dIv//rQLP/6zyv/+c4p//rNKf/6zif/9cki//XJIv/2xyH/98Yh//fGIf/4xCD/+MQg //nEIP/5xh//+cYf//nEHP/4whj/+cAX//m/Ff/6vRT/+b0R//m8Fv/3uBH/9bcM//e4Cf/6 uw7/+rcQ//WvD//vqQ3/9K8j/8OGG/+VZyv/2b6p///7+///////+fv6//z//f/7/////P/6 //7/+P/4+Pb///7///n4/v/t7e3//v/6//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////57P// //b/9P////j////57P///+76////+//y//T/9f/4///2////2eb/tG1D/79wAP/0pQD/658A /++kFf/xqQf/8akH//CrCP/xrAn/8a0K//CvC//xsAz/8bIN//KzEP/ysxD/8rMQ//KzEP/y sxD/8rMQ//KzEP/ysxD/87UW//K0Ff/ytBX/8rQV//GzFP/xsxT/8bMU//CyE//wsBL/8LAS /++vEf/urhD/7q4Q/+2tD//srA7/7KwO/+upDP/rqQz/7KcL/+ymCv/rpQn/66IH/+uiB//r oAb/7KEH/+ugBv/qnwX/6Z4E/+idA//nnAL/5psB/+abAf/kmQD/5JkA/+SZAP/jmAD/45gA /+KXAP/ilwD/4pcA/+KXAP/ilgL/4ZUB/+GVA//hlQT/4JQD/+CTBf/gkwX/3pIA/96SAP/e kgD/3pIA/92RAP/dkQD/3ZEA/9yQAP/cjwP/3I8D/9yPA//bjgL/244C/9uOAv/ajQH/2o0B /9qMBP/ajAT/2owE/9mLA//ZiwP/2IoC/9iKAv/YigL/2oYK/9yIC//YhAf/0X0A/9B9AP/W gwH/2IUD/9WCAP/SiAD/2Y0A/9SECf/MeQ//0n8X/9iHEv/UhgD/z4MA/9yFKP/MeBb/u2gA /7BgAP+3aQD/y4EA/+WeEv/4sSH/87UK//O3C//zuQ3/9LwR//S+FP/0wRb/88MZ//TEGv/5 yCP/+cgj//nKJP/6yyX/+c0m//jNJv/5zif/+c4n//nQKv/50Cr/+dAq//nQKv/60Sv/+tEr //vSLP/70iz//NIw//zSMP/80jD//NIw//zSMP/80jD//NIw//zSMP/80jD//NIw//vRL//7 0S//+9Ev//rQLv/60C7/+tAu//nRMf/40S7/+tAu//nPK//5zin/+s0p//nNJv/5zSb/9cYe //TFHf/0xR3/9cUd//bDHP/2wxz/98Ic//bBG//5wxn/+cMZ//nBFv/5vxX/+b0R//m6Df/4 uQz/+rgM//6+Fv/3tw3/8rME//e2Bv/7twr/8awH/9uSAP/GfAD/rHYS/9Wocf//7+j///r+ //j/8//7//H///3///zt///08P////3///7////8/////P7///n5//////r//fzn//////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////k //T45//8////8Ovo/6eMbv+veCX/8p8T//+iAP/johT/5qIA/+2iAP/0oAD/+KEG//mmGv/z qRb/56YE//GtDv/xrQ7/8a0O//KuD//yrg//8q4P//OvEP/zrxD/77AN/++wDf/vsA3/77AN /++wDf/vsA3/77AN/++wDf/uqgv/7qoL/+6qC//tqQr/7akK/+yoCf/sqAn/7KgJ/+qlAv/q pQL/6aQB/+mkAf/oowD/56IA/+eiAP/moQD/7J8B/+yfAf/rngL/6p0B/+qdA//pmwP/6JoC /+iaAv/omwH/55kB/+eZAf/mmAL/5ZcB/+SWAv/klQT/45QD/+WTAf/lkwH/5JIA/+ORAP/j kQD/4pAA/+GPAP/hjwD/4Y4C/+CNAf/gjQH/4I0B/9+MAP/fjAD/34wA/9+MAP/cjAH/3IwB /9yMAf/cjAH/24sA/9uLAP/aigD/2ooA/9yIAf/ciAH/3IgB/9uHAP/bhwD/2oYA/9qGAP/a hgD/14YD/9eGA//WhQL/1oUC/9aFAv/VhAH/1YQB/9WEAf/YhAf/1oIF/9OAAP/RfgD/0X4A /9OAAP/WgwD/2IUB/9puAP/jgAj/zHcD/8J4C//GfRb/yHYS/69RAP/EXAD/n3AA/8ORAP/k rRT/8bMU//WxDv//tw7//7kO//+1B//8whn//cMa//3EHf/5xB7/98Mf//PEIP/zxiL/9cgl //bRHv/0zxz/884d//bOH//3zyL/980j//PJH//uwxz//8wj//nJH//4ySH/+cwo//nOKv/4 ziz/+tIy///ZO//4yyf/+Msn//jLJ//4yyf/+Msn//jLJ//4yyf/+Msn//jJIf/4ySH/+Mkh //fIIP/3yCD/9scf//bHH//2xx///8Qb///BGv//whn//8Qb///DE//4vgX/9LkA//K4AP/1 vhv/6rAH//m3Cf/9tAD//7QA//+zAP//tAD//7IA//+tAP//sQD//7UU/+ShHv+scg//ilkU /62CVf/nwZ3///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////zw/////f/2+f////7////76v/OoWj/qWMB/9yHCv/8 ogD//KMH//CbDP/sngb/8qsB/+yoAP/oogb/9Ksh//CsDf/wrA3/8KwN//CsDf/xrQ7/8a0O //KuD//yrg//764M/++uDP/vrgz/764M/++uDP/vrgz/764M/++uDP/uqgv/7akK/+2pCv/t qQr/7KgJ/+yoCf/sqAn/66cI/+ykAv/spAL/66MB/+qiAP/qogD/6aEA/+igAP/ooAD/7J8B /+ueAP/rngL/6p0B/+mcAv/omgL/6JoC/+eZA//nmQH/55kB/+aYAP/llwH/5ZcD/+SWAv/j lAP/45QD/+WTA//kkgL/5JIC/+ORAf/ikAD/4Y8A/+GPAP/gjgD/4I0B/+CNAf/gjQH/34wA /9+MAP/fjAD/3osA/96LAP/cjAH/3IwB/9yMAf/biwD/24sA/9qKAP/aigD/2ooA/9yIAv/c iAL/24cB/9uHAf/ahgD/2oYA/9qGAP/ahgD/1oUC/9aFAv/WhQL/1YQB/9WEAf/VhAH/1IMA /9SDAP/Xgwb/1YEE/9F9AP/PfAD/znsA/857AP/QfQD/0n8A/817D//DbAD/3YAH/9RyAP/H ZgD/tl0A/9iGMv+cTgT/3LGr/9epmf+9kGn/oW8w/5pnC/+xfQX/zpcJ/9ukC//stAD/7rYB //K5CP/2vQ7//L8W//7BGf//wx3//8If//a3Hv/8vST//cIm//jCIf/2xSD/9soh//XLH//y yhv/+tYq//PNIv/txxr/8sod//zRI///0ST/+Moc//LDFf/5yiT/+cok//nKJP/5yiT/+cok //nKJP/5yiT/+cok//jIIP/4yCD/98cf//fHH//2xh7/9sYe//bGHv/2xh7/+cAX//a9FP/0 uxT/9LsW//i/GP/7wRj/+LwQ//K0B//wpAD//7sO/+akCP/YmhH/tHkB/8CIGf/DjSH/pG8F /7N4HP+dZRD/l2cd/7iPV//nx6D//+zW///57///+fb///////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////z///Ls9v/8 /v///v7////39f//+eT//NCj/5JaH//ofgD/8o4F//WdGP/qoA3/4aEA/+epAP/vpwX/65sO /++pC//vqQv/76kL/++pC//wqgz/8KoM//GrDf/xqw3/76sK/++rCv/vqwr/76sK/++rCv/v qwr/76sK/++rCv/tpwn/7acJ/+2nCf/tpwn/7KYI/+ymCP/spgj/66UH/+ujA//rowP/6qIC /+qiAv/poQH/6KAA/+efAP/nnwD/654C/+ueAv/qnQH/6ZwC/+iaAv/omgL/55kD/+eZA//m mAD/5pgA/+aYAv/llwH/5JYC/+OUA//jlAP/4pMD/+SSAv/kkgL/45EB/+KQAP/hjwD/4Y8A /+COAP/gjgD/4I0D/9+MAv/fjAL/34wC/96LAf/eiwH/3osB/92KAP/cigL/3IoC/9yKAv/b iQH/24kB/9uJAf/aiAD/2ogA/9uHAf/bhwH/24cB/9qGAP/ahgD/2YUA/9mFAP/ZhQD/1oMD /9aDA//WgwP/1YIC/9WCAv/VggL/1IEB/9SBAf/VgAP/034B/9B7AP/NeAD/zHcA/8x3AP/M dwD/zXgA/7l3Fv/New3/x2EA/+FuAP/leAP/xm4U/41SGP/2zqr///j////4////+P////Xy //3j1P/py6//yamD/6uKX/+eZg//oWkM/691Cv/JjRH/56ka//q6Gv/+vBD/+rcE//+4AP// vwb//8MO//+/E//6vRf/+sIl//zGLv/7xzP/4b4c/+nDIv/xxyP/8cQg//LCGv/3whr//sYb ///HHf/5xh//+cYf//nGH//5xh//+cYf//nGH//5xh//+cYf//jDG//4wxv/+MMb//jDG//3 whr/98Ia//bBGf/2wRn/67wU/+y8Ev/wvRT/9b8X//S5Ff/vsA3/7asM//CuD///wQH/+6wH /9KWHv+dcyn/5cig/+XPt//LtqH/8NrC//fi3//+7Or///Tz//74+P/9/P//+f////f////z //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////r////5///+/v//+/////f4+v///fv///jy/+3Sy//FdTj/zoAc /+idDv/ypgP/5ZUA/+qZAf/2pgf/658A/+6lCP/upQj/7qUI/++mCf/vpgn/8KcK//CnCv/w pwr/7qgI/+6oCP/uqAj/7qgI/+6oCP/uqAj/7qgI/+6oCP/spgj/7KYI/+ymCP/rpQf/66UH /+ulB//qpAb/6qQG/+uhAv/roQL/66EC/+qgAf/pnwD/6J4A/+ieAP/nnQD/6p0B/+qdAf/p nAL/6JoC/+iaAv/nmQP/5pgC/+aYBP/mmAL/5ZcB/+WXAf/klgL/45QD/+KTAv/ikwP/4ZIC /+OQAv/jkAL/4o8B/+GOAP/hjgD/4I0A/9+MAP/fjAD/34wC/96LAf/eiwH/3osB/92KAP/d igD/3YoA/92KAP/biQH/24kB/9uJAf/biQH/2ogA/9qIAP/ZhwD/2YcA/9qGAv/ahgL/2oYC /9mFAf/ZhQH/2YUB/9iEAP/YhAD/1YIC/9WCAv/UgQH/1IEB/9SBAf/TgAD/04AA/9OAAP/R fAD/0HsA/895AP/OeAD/zXcA/813AP/NdwD/zXcA/8dxAP/WdwH/4XoD/9x0A/+zWwH/rHE1 ///nzP///PX/+P/p//j/6v/z+ur/8/Tu//75////+v////j////3////6fL//+Tk//XOvf/Q pH3/qHg4/5ZiDP+hawH/s3wI/+KlAP/pqgD/87QH//m6Df/4uA7/9rMK//WyC//4tQ7//8gq //7CJP/3ux3/9roc//3BI///xyn//8Mn//a6Hv/4whr/+MIa//jCGv/4whr/+MIa//jCGv/4 whr/+MIa//bAFv/2wBb/9sAW//W/Ff/1vxX/9b8V//S+FP/0vhT/67oV//bCF//2vQ7/7rAA //SxAP//vg7//7kM/+2mAP/1pQb/zIoP/66GPv//8d3/+PT///z9/////f////j//+7z9//7 ////+f////f////u/fr/7//6//L//f/x//3///////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////f4///+/f/8/vn/+v/6 //n//f/y9/r/7e31///8////8PP/q4lc/6BqAP/rnAz//6oR//GRAP/slQD/+KkG/+6hBf/u oQX/7qEF/++iBv/vogb/8KMH//CjB//wowf/7aUF/+2lBf/tpQX/7aUF/+2lBf/tpQX/7aUF /+2lBf/tpAf/7aQH/+yjBv/sowb/66IF/+uiBf/rogX/66IF/+qgA//qoAP/6qAD/+mfAv/o ngH/550A/+edAP/mnAD/6ZwC/+mcAv/omgL/55kB/+eZA//mmAT/5ZcD/+WXA//llwH/5JYC /+SWAv/jlAP/4pMC/+GSAv/hkQT/4JAD/+KPAf/ijwH/4Y4A/+CNAP/gjQD/34wA/96LAP/e iwD/3ooD/96KA//diQL/3YkC/9yIAf/ciAH/3IgB/9yIAf/bhwH/24cB/9uHAf/bhwH/2oYA /9qGAP/ahgD/2YUA/9mFAf/ZhQH/2YUB/9iEAP/YhAD/2IQA/9eDAP/XgwD/1H8C/9R/Av/U fwL/1H8C/9N+Af/TfgH/034B/9J9AP/QeAD/0HgA/9F5AP/SeQH/0nkD/9J5Bf/RdwX/0XcF /+x3AP/acAD/x28N/5NQCf/KoXX///bi//79+f/5////+f////v//f/7//3/9/z2//r99v// //j//v/3//v78f/4////+/////n59////fv///r6///4+P/529v/4b/A/7uRYf+gczj/lGMU /654DP/WmxH/8K8J//24AP//vAD//7AC//+xA///tAj//rYK//u4D//4uxL/9r0U//S+Fv/5 vBT/+bwU//m8FP/5vBT/+bwU//m8FP/5vBT/+bwU//i8EP/4vBD/97sP//e7D//3uw//9roO //a6Dv/2ug7/+LsV//GxB//6tQD//74D//+5AP/xqQD/7qkA//y4Df+ygSX/q4hG///53//+ /v//8v3///D3//////////nt//z/8//8//P/+v/y//b87v/5//P//v/4//7/+P/9//f///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////4//j47v////b//f/1//L58f/5////+f///+Lp8f/i9Pj///77/9m2mv+U VQb/0YIA//2oDf/okgH/7pYY/+ydAv/snQL/7Z4D/+2eA//unwT/7p8E/+6fBP/unwT/7qED /+6hA//uoQP/7qED/+6hA//uoQP/7qED/+6hA//sogX/7KIF/+yiBf/sogX/66EE/+uhBP/q oAP/6qAD/+yfBf/rngT/654E/+qdA//pnAL/6JsB/+ibAf/nmgD/6JsB/+iaAv/nmQH/55kD /+aYBP/llwP/5JUE/+SVBP/klgL/45UB/+OUA//ikwL/4ZIC/+CQA//gkAP/4JAD/+GOAv/h jgL/4I0B/+CNAf/fjAD/3osA/92KAP/digD/3YkC/92JAv/ciAH/3IgB/9yIAf/bhwD/24cA /9uHAP/bhwP/2oYC/9qGAv/ahgL/2YUB/9mFAf/ZhQH/2IQA/9iDAv/YgwL/2IMC/9eCAf/X ggH/14IB/9aBAP/WgQD/034B/9N+Af/TfgH/0n0A/9J9AP/RfAD/0XwA/9F8AP/RdwD/0ngA /9N5Af/UeQT/03gG/9F1Bv/Pcwb/znIF/9JjAP/BZwf/klgZ/+LJq/////r/+f////H5/P/1 +/v//Pn///36///+/P////7///////////r//v/z//z+8P/k/ff/7f/+//H////1////8fv8 //T3/P///v////3////4////9P///+Xh/+XCpP+5jFH/mmYS/6ZrA//DhBP/+a0K//euCf/7 tAz//70P//m8C//wuAH/77kA//PAA//3tw3/97cN//e3Df/3tw3/97cN//e3Df/3tw3/97cN //a4C//2uAv/9bcK//W3Cv/0tgn/9LYJ//S2Cf/0tgn//LcR//+6Dv/4rQD/66AA//iwA/// wSP/2aAV/59pAP+8qI3///7s//Py7v/y+///9f////X5+P/39OX////m//z67f///vP///74 ///9+//99Pf/+/D4///1////+f////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////9Pfu////+v////r////7/////f/2 +Pf/8vj2//n////5//b/7e7y///7////7Nr/rIVE/6BlAP/fkBf/9Zgf/+uaAP/rmgD/7JsB /+ybAf/tnAL/7ZwC/+2cAv/tnAL/7Z8B/+2fAf/tnwH/7Z8B/+2fAf/tnwH/7Z8B/+2fAf/r oQT/66EE/+uhBP/qoAP/6qAD/+qgA//pnwL/6Z8C/+ueBP/rngT/6p0D/+mcAv/omwH/6JsB /+eaAP/nmgD/6JoC/+eZAf/nmQP/5pgC/+WXA//klQT/5JUE/+OUA//jlQH/45QD/+KTAv/h kgL/4ZEE/+CQA//fjwT/348E/+GOAv/gjQH/4I0B/9+MAP/eiwD/3YoA/92KAP/ciQD/3IgC /9yIAv/ciAL/24cB/9uHAf/ahgD/2oYA/9qGAP/chQL/3IUC/9uEAf/bhAH/24QB/9qDAP/a gwD/2oMA/9iDAv/XggH/14IB/9eCAf/WgQD/1oEA/9aBAP/WgQD/1HwB/9R8Af/UfAH/03sA /9N7AP/SegD/0noA/9J6AP/TeQD/1HoA/9R6Av/TeAX/z3ME/8puAf/FaAD/wmUA/6BjIv+4 iln///Xd/////f/3////6PH2//n79v////H///76///++////v////7////+/////f///v3/ //79///0/P//9v////n////5////+f/6//n/9P/4/+7/9v/q//f7/v/4+fv///z7///8+/// +vj///fz//TX0//au7b/toxA/591If+dbw//vIgY/96lJP/rrx3/8LAS//azDf/4tAn/+LQJ //i0Cf/4tAn/+LQJ//i0Cf/4tAn/+LQJ//a0Bv/2tAb/9rQG//a0Bv/1swX/9bMF//SyBP/0 sgT//bkM/+SeAP/vqAD//8Im/+CkIv+gbRH/q4RL/+7Nqv///P//9PDx/////f/8//j//v/4 //7/+f/8+PX/9vHu///+/P///v////3////9////+/////v////7////9/////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////+f/5//7//////v///vf////8/////v///f75//j+9P//7d/////z//L99//0//////3/ /9u3l/+jXQD/0nYA/+qZAP/qmQD/65oA/+uaAP/rmgD/7JsB/+ybAf/smwH/7Z8B/+2fAf/t nwH/7Z8B/+2fAf/tnwH/7Z8B/+2fAf/roQT/66EE/+qgA//qoAP/6qAD/+mfAv/pnwL/6Z8C /+ydBP/rnAP/65wD/+qbAv/pmgH/6JkA/+iZAP/nmAD/55kB/+eZAf/mmAL/5ZcD/+WXA//k lQT/45QD/+OUBP/jlAP/4pMC/+KTAv/hkgL/4JAD/9+PAv/fjwT/3o4D/+CNA//gjQP/34wC /96LAf/eiwH/3YoA/9yJAP/ciQD/3IgC/9yIAv/bhwH/24cB/9qGAP/ahgD/2oYA/9qGAP/b hAH/24QB/9uEAf/bhAH/2oMA/9qDAP/agwD/2YIA/9eCA//XggP/14ID/9aBAv/WgQL/1oEC /9WAAf/VgAH/1HwB/9N7AP/TewD/03sA/9J6AP/SegD/0noA/9F5AP/WfAL/1nwC/9R5BP/R dgT/y28A/8NmAP+8XwD/uFsA/87Dsf///fP///////f7///z9//////9////7///9t3///7z //377//6+vD//v/3//7/+//8//3/+/////v//////Pb///r2///29P/89vb//fj+///8///+ /v///v7///b99f/7//v/+//7//H69f/w+fT/+P////j////4//////j///zs+f/02dL/4LiV /7mCQv+cVgD/r14A/9aAB//4sQf/+LEH//ixB//4sQf/+LEH//ixB//4sQf/+LEH//ayBf/2 sgX/9rIF//WxBP/1sQT/9LAD//SwA//0sAP/87YD//e6Cv/VlwD/o2cA/6d0G//jvZn///X/ ///1////+f////3/////9P///+3///7v///+///+/f//+fr//+/09//5////+/////v////7 //z//P/9//z/+//6//n///////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////9/P//8/P1//7+////////9vb2/////f/z8/H/rK2o/6xcAP/ahw//75kS/+uRAP/x lwD/95wD/+2VAP/nkQD/2pMA/+mfAP/ypgD/8KIA/+yaAP/xmQP/9p0P//mdFv/qnAT/6pwE /+qcBP/qnAT/6pwE/+qcBP/qnAT/6pwE/+iaBP/omgT/55kD/+eZA//mmAL/5pgC/+aYAv/m mAL/5JYC/+SWAv/klgL/45UB/+OVAf/jlQH/4pQA/+KUAP/hkAH/4ZAB/+CPAP/gjwD/344A /9+OAP/fjgD/344A/+GJAf/hiQH/4IgA/+CIAP/fhwD/3oYA/92FAP/dhQD/3YQC/92EAv/c gwH/3IMB/9yDAf/bggD/24IA/9uCAP/ZgAD/2YAA/9mAAP/ZgAD/2H8A/9h/AP/YfwD/134A /9l/BP/ZfwT/2H8B/9h/Af/XfgD/1n0A/9Z9AP/WfQD/13IA/9p6Cf/WgQ3/zH0H/8h3Af/Q dgD/3XcA/+R3AP/BewL/xG8A/952AP/ufQD/xmEA/5ZRDP+2lXb//fTt//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////6//v89v/7/Pb////6////+v/8/ff/4uPd/8vMxv+1h1X/pnU6/5pkGv+i ZQj/vHkI/9eNCP/nlwT/65gA/96bAP/joAD/6qcA/+6rBf/qpgf/4ZsI/9WNBf/OhQT/k2QW /5x1NP+6onL/5Ni+//v47//8+vv///r////8//////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////v//+vr8///////+/v7/8/Pz/////f// //3/8PHs/+vSqv+qgUP/sm4N/+qPC//1kAD/8pAA//ScBP/nmAf/+asV/+aXBv/biwD/4Y8F /+mYCP/pmAD/6ZoA/+yfAP/pmwP/6ZsD/+mbA//pmwP/6ZsD/+mbA//pmwP/6ZsD/+eZA//n mQP/55kD/+aYAv/mmAL/5pgC/+WXAf/llwH/5JUE/+SVBP/jlAP/45QD/+OUA//ikwL/4pMC /+KTAv/gjwD/4I8A/+CPAP/gjwD/344A/9+OAP/ejQD/3o0A/+GJAf/hiQH/4IgA/9+HAP/e hgD/3oYA/92FAP/dhQD/3IMB/9yDAf/cgwH/3IMB/9uCAP/bggD/24IA/9qBAP/ZgAD/2YAA /9mAAP/YfwD/2H8A/9d+AP/XfgD/134A/9R6AP/UegD/1XsA/9V8AP/VfAD/1n0A/9Z9AP/W fQD/23IA/9ZwAP/QcgD/zngA/9B9B//KeQb/xXAD/8FqAf/adwD/3n4O/8BoBP+bUAD/tXpC //fTsf//+u////v8//////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////P33//v89v/7/Pb////6////+v// //r//P33//X28P///f////j2//fq4v/u28z/5cuy/9q5mP/LpX7/v5ls/7eJV/+yhFD/rH9I /6x+Sv+2iFf/yJhw/9uqiv/ntZz//+G+///py///9eT////2//v//f/5////+f74//j79P// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /v///Pz+////////////+vr6//v7+f////3////7//j//////vj/0bSM/51oGP/Adwb/6pYP /+6WAf/vlgD/2oYA/+eUBv/znxv/8Z4e/+mXEP/llwP/5ZkA/+acAP/pmQT/6ZkE/+mZBP/p mQT/6ZkE/+mZBP/pmQT/6ZkE/+eXBP/nlwT/55cE/+aWA//mlgP/5ZUC/+WVAv/llQL/5JMD /+STA//jkgL/45IC/+KRAf/ikQH/4pEB/+KRAf/hjgD/4Y4A/+CNAP/gjQD/34wA/9+MAP/f jAD/34wA/+CIAv/giAL/34cB/9+HAf/ehgD/3YUA/9yEAP/chAD/3IMB/9yDAf/bggD/24IA /9uCAP/agQD/2oEA/9qBAP/YfwH/2H8B/9h/Af/YfwH/134A/9d+AP/WfQD/1n0A/9R6AP/U egD/1HoA/9R6AP/UegD/1HoA/9R6AP/UegD/znUB/9J4AP/VdwD/0nQA/9JzAP/Rdwf/zngR /8h1Ff/UZgT/p0wA/6NnMf/dv6X///34///+///49f7///n///////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////7////+/////v////7//7/+v////v////7////+//l+/j/7P/+//T////3////+f// //z////+/v////3///zz9v/+9fb///r4///9+v///fv///z////7////+/////b////7///+ /v//8vv//+79///1////+P/2//r/8P////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////v///f3///v7/f////////////z8+v/09PL/9fbx ///9///09fr/+f////z/8f/Cs4j/mGkb/7hoAP/xiwX//KgI/+yYAP/fiwD/4YwA/+iUAP/r lgf/55QI/+WSCP/nlwL/55cC/+eXAv/nlwL/55cC/+eXAv/nlwL/55cC/+aWA//mlgP/5ZUC /+WVAv/llQL/5JQB/+SUAf/klAH/4pEC/+KRAv/ikQL/4pEC/+GQAf/hkAH/4I8A/+CPAP/g jQH/4I0B/9+MAP/fjAD/34wA/96LAP/eiwD/3osA/9+HAf/fhwH/3oYA/96GAP/dhQD/3IQA /9uDAP/bgwD/24IC/9uCAv/agQH/2oEB/9qBAf/ZgAD/2YAA/9mAAP/YfwH/134A/9d+AP/X fgD/1n0A/9Z9AP/WfQD/1XwA/9h+A//YfgP/130D/9V7Af/UegL/03kB/9J4AP/RdwD/w34X /9CCFf/VegX/z2sA/9JpAP/WcAH/y2sF/7ZbAP+oXyj/57CH///03//+/P3/6fX///P////5 /////fz///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////7////+/////v////7//z9+P/5+vX//P34 ////+//+/+3//v/v//7/8/////b//f74//z7+f///v////7///X////1//3/9f/7//X/+//1 //r/9P/5//H/9v/w//b/9vL///79///5////8vz///T////4////+//4//3/8v////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////v////// //n5+//39/f//////////f/+/vz//v/6///35v/3+PD/8/////H////5//////La/+Gzgv+h YB7/t2YA/9mIA//snQL/5JYA/+KQAP/umAD/8ZYK/+iJC//mlAL/5pQC/+aUAv/mlAL/5pQC /+aUAv/mlAL/5pQC/+WTA//lkwP/5ZMD/+SSAv/kkgL/5JIC/+ORAf/jkQH/4o8B/+KPAf/h jgD/4Y4A/+GOAP/gjQD/4I0A/+CNAP/hiwL/4YsC/+CKAf/gigH/4IoB/9+JAP/fiQD/34kA /96GAf/ehgH/3YUA/92FAP/chAD/24MA/9uDAP/aggD/2oED/9qBA//ZgAL/2YAC/9mAAv/Y fwH/2H8B/9h/Af/XfQL/1nwB/9Z8Af/WfAH/1XsA/9V7AP/VewD/1HoA/9d9Av/XfQP/1nwC /9Z8BP/VegX/1XoH/9V6CP/UeQf/2H4M/8lpAP/VcQH/7Icb/9J0Ev+iUAD/q2gh/9yiY/// +vH//vfv//f07//29vT/+v79//z////8//3//P/9//////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////+fn3 //39+/////3////9//7+/P/8/Pr//f37//7+/P//8vz///j////6////+v////v////6/v// +Pv///j5//v////7////+/////r////7////+/////v//f/7//3////9///////+/////v// ///+/////v///vj6//rx8v////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////9/P/////////////6+vr//v7+/////f////3////7//T/7//8 //b/+vrw//fw6v///fr///z9//Ht7v/w7vH/46eF/7B0OP+kaAb/05MN//CqDP/hkgD/3ocA //OYA//lkwH/5ZMB/+WTAf/lkwH/5ZMB/+WTAf/lkwH/5ZMB/+SRA//kkQP/5JED/+OQAv/j kAL/4o8B/+KPAf/ijwH/4Y4C/+CNAf/gjQH/4I0B/9+MAP/fjAD/34wA/9+MAP/hiQH/4YkB /+CIAP/giAD/4IgA/9+HAP/fhwD/34cA/92EAv/dhAL/3YQC/9yDAf/bggD/2oEA/9qBAP/Z gAD/2YAC/9mAAv/ZgAL/2H8B/9h/Af/XfgD/134A/9d+AP/WfAH/1nwB/9V7AP/VewD/1HoA /9R6AP/UegD/1HoA/9F3AP/SeAD/0ngA/9N4A//UeQf/1XkK/9V5DP/Weg3/3WcA/+d1Bf/N aQf/nkwA/5tfKf/NrIn//vHe////9P/t////8v////v///////b///jr//746v/9/fP//P/6 //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /f////7////+///+/////v/7//j+9P/z+ev/7/jn//r28//++vn///7////9/////v////z5 //n27//18un//Prr//r46//9+vH////6///9/f//+P3///X+///2//////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////6+f7///////////// //////////7+/P/7+/n/9vfy//f////r8Oz///r0///89v/78Oz//v37//j////x//////X7 ///59P/oyK//nnNA/5JaB//JhRb/658Y/+COAP/lkAH/5ZAB/+WQAf/lkAH/5ZAB/+WQAf/l kAH/5ZAB/+WQAv/lkAL/5I8B/+SPAf/kjwH/444A/+OOAP/jjgD/4owB/+GLAP/hiwD/4YsA /+CKAP/gigD/4IoA/9+JAP/giAL/4IgC/+CIAv/fhwH/34cB/9+HAf/ehgD/3oYA/92EAv/c gwH/3IMB/9uCAP/agQD/2oEA/9mAAP/ZgAD/2H4D/9h+A//YfgP/2H4D/9d9Av/XfQL/1nwB /9Z8Af/VewH/1XsB/9V7Af/UegD/1HoA/9N5AP/TeQD/03kA/9N5AP/SeAD/0XcA/890Af/N cQL/y28C/8ptBf/JbAT/wGUU/6JTDv+uckD/7MSq///78f//////8fz//+7////4////+v// //3+//////3///77///++////Pn////9//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////5//j/+f/4//n/9v/5//b/+P/z//n/8//5//H/+f/x ////7/////H///zz//369f/++/b///32////8/////H//v/6////+v////r////7/////f// /v////7////+//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////v///Pz+//v7/f///////////////f////3//P34///8/f///v//+/3/ //b+///4////+//7//f75P///+H/8f////f/////+/////X///fIwv/FiFv/rGYO/7JnAP/k jwD/5I8A/+SPAP/kjwD/5I8A/+SPAP/kjwD/5I8A/+SPAf/kjwH/5I8B/+SPAf/jjgD/444A /+KNAP/ijQD/4YsC/+GLAv/hiwL/4IoB/+CKAf/fiQD/34kA/9+JAP/giAL/4IgC/9+HAf/f hwH/34cB/96GAP/ehgD/3oYA/9yDAf/cgwH/24IA/9uCAP/agQD/2YAA/9mAAP/YfwD/2H4D /9h+A//YfgP/130C/9d9Av/WfAH/1nwB/9Z8Af/VewH/1HoA/9R6AP/UegD/03kA/9N5AP/T eQD/03kA/9qABv/XfQP/0ncC/8xxAP/GagD/wGMA/7teAP+5XAD/ro51/+nSxP///P3//P7/ /+/2///2/f/////9///98f//8+v///v4///9///1+f//8vj///v//////f////r///////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////9/f3//39/f/////////////////9/f3//v7+///////7+/n///7/ ///+/////f////3////6////+f////v///z////8/////P7///z9///8/f///P3///z+///8 ////+f////n////5/v//+f3+//f9+//1/vv/9P/7//P/+/////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////v7+//7 +/v////////////8/Pz/4uLi/8vLy/+sazH/pmQY/7RvCP/SiQn/5JMG/+OJAP/kgQD/7YUK /8yFAP/XjQD/5ZcD/+uZB//rlQT/6I0A/+iJAP/ohwD/4YUA/+GFAP/hhQD/4YYC/+GGAv/i hwP/4IcF/+GIBv/ahAD/24MA/9+CAP/jgQL/44EC/+GCAP/ehAD/24UA/9t/AP/cgQD/3IQA /96GAf/dhQD/3IEA/9l8AP/YeQD/2n0E/9p8Av/aegH/3HgA/993AP/heAD/5HYA/+R3AP/L fQ7/zHwL/8l4Bf/JcgD/0HYA/9t7A//adgD/0WoA/9t2AP/afAD/yHgJ/6RjCf+JWhb/mntM /9PAoP//++P///////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// /////////////////////Pz8//v7+//7+/v//////////////////Pz8//X19f//9v///+bl /9Sxkf+sfTn/o2gE/7lvAP/RewD/2XwA//CKAf/viQD/6ogA/+SHAP/hhwD/4IoA/+KRBP/l lQj/35EA/9+RAP/ekAD/3Y8A/9yOAP/bjQD/240A/9qMAP/fig3/4YcM/+SFDf/lgg3/5IEM /+CACP/dgAf/2oAF/95/B//egQj/34IJ/96BCv/dfgj/2nkE/9d0AP/VcgD/zHgA/897Af/U fgX/1oAH/9h/B//VewP/0XcA/850AP/YZgD/324A/+V3AP/mfgX/3nkF/9JyAv/KbQP/yW4F /5pPDP+kXiL/vYBR/+Gzkf//5NP///n4///6///+9/////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //7+/v/////////////////u+P//+///////+v//8uP/99m9/+jBmP/Jl2T/pHA2/7hcB//B Zg3/0HYV/96GGv/ljxb/448L/9qHAP/SgAD/2YMI/9uDCP/bgwj/3IIH/9yCB//eggX/3oID /9+BA//aiAH/2oYA/96DAP/efwD/3X4A/9x9AP/ZfQD/134A/85yAP/QdAD/1XcA/9l7AP/d fQL/4X8E/+KABf/igAX/34AA/9x/AP/WegD/0HYA/8xzAP/IcQD/x3IA/8ZyAP/rdAD/5HIA /9VvA//BZwf/plgF/5ZTDP+hZyf/tIBG/+zKwP/63NT///Lu///5/f//+v///vn///j4///2 +v////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////z8/P/5+fn//Pz8///////9/t//+vzn//79+f// /f///vz///v8///09///8fj///Xax//YuZ3/sohe/5ljJf+ZVgX/rmAA/8pzAP/dgQb/4ocD /+OHAv/khgD/5YUA/+eDAP/ogwD/6IEA/+qBAP/WjAD/2IoA/9mHAP/dhAD/3oQA/9+EAP/e hwD/34cA/9eCAP/YgQD/2X8A/9l9AP/WegD/1HgA/893AP/OdgD/2GoA/91xAP/hegP/5IAO /9+AFP/UexP/yXMQ/8BsCv+jYiD/llgb/5diLv+4jmT/5ciq///v2///+u//+/jx//38+P// //v////9//7//f/7//z/+/////v////5//////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////+fn5//39/f////////////7+/v/8 /Pz//f39//7+/v////r/+vj7//j2///7/v//+P////L////y//v/8f/0//T////4///////4 ///65///6Mv/8sig/9ajdP/DiVf/o2US/6ZlEf+raBH/sWoQ/7lsEP+/bw7/xXEO/8hyDf/N iBP/zIQO/81+Bf/OegD/0HgA/9F4AP/Regb/0n0J/9SBCf/Ufgf/1XsJ/9N3Cv/Pdw3/yXYO /8V4EP/BehL/vWcS/7RfDv+mVwr/nVUN/6BfH/+vcjn/wYlW/8yYZv/fz7//9efa///98/// /vj//vz9//b5/v/3/v//+P////j////4//7/9/73//n/9f/+//T////x//z96//3+eT///// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////v////9P////f////7////+/v9 //358P//+eb///vf//v/+P/6//n/+v/8//z////8/////P7///z9///7/P////r6///59f// 6+T/8tbL/+HAr//SrJf/yZyF/8KUev/Bf0X/wHk7/75xK/+6aRr/uGMS/7ZfEP+3XxX/tmAX /7JfD/+4YRT/wGUf/8ZsLv/KeED/zYZS/86SYP/Ommr/37iX/+fCpf/z07r//+XU///06v// /Pj///z9///9//////v////7///8+f/79vL///r3///8+v///Pr///z4//f7///8/////v7/ //38///29Pf/+vb1///++v///fr///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////AA4BAAADAAAAAQEUAAABAQADAAAAAQC2AAABAgADAAAABAADEZYBAwADAAAA AQABAAABBgADAAAAAQACAAABEQAEAAAAAgADEaYBEgADAAAAAQABAAABFQADAAAAAQAEAAAB FgADAAAAAQB2AAABFwAEAAAAAgADEZ4BHAADAAAAAQABAAABUgADAAAAAQABAAABUwADAAAA BAADEa6HcwAHAAAH2AADEbYAAAAAAAgACAAIAAgAAfzgAAEUAAAAAAgAAfzoAAEAAQABAAEA AAfYYXBwbAIgAABtbnRyUkdCIFhZWiAH2QACABkACwAaAAthY3NwQVBQTAAAAABhcHBsAAAA AAAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLWFwcGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtkZXNjAAABCAAAAG9kc2NtAAABeAAABZxjcHJ0AAAH FAAAADh3dHB0AAAHTAAAABRyWFlaAAAHYAAAABRnWFlaAAAHdAAAABRiWFlaAAAHiAAAABRy VFJDAAAHnAAAAA5jaGFkAAAHrAAAACxiVFJDAAAHnAAAAA5nVFJDAAAHnAAAAA5kZXNjAAAA AAAAABRHZW5lcmljIFJHQiBQcm9maWxlAAAAAAAAAAAAAAAUR2VuZXJpYyBSR0IgUHJvZmls ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbWx1 YwAAAAAAAAAfAAAADHNrU0sAAAAoAAABhGRhREsAAAAuAAABrGNhRVMAAAAkAAAB2nZpVk4A AAAkAAAB/nB0QlIAAAAmAAACInVrVUEAAAAqAAACSGZyRlUAAAAoAAACcmh1SFUAAAAoAAAC mnpoVFcAAAAWAAACwm5iTk8AAAAmAAAC2GNzQ1oAAAAiAAAC/mhlSUwAAAAeAAADIGl0SVQA AAAoAAADPnJvUk8AAAAkAAADZmRlREUAAAAsAAADimtvS1IAAAAWAAADtnN2U0UAAAAmAAAC 2HpoQ04AAAAWAAADzGphSlAAAAAaAAAD4mVsR1IAAAAiAAAD/HB0UE8AAAAmAAAEHm5sTkwA AAAoAAAERGVzRVMAAAAmAAAEHnRoVEgAAAAkAAAEbHRyVFIAAAAiAAAEkGZpRkkAAAAoAAAE smhySFIAAAAoAAAE2nBsUEwAAAAsAAAFAnJ1UlUAAAAiAAAFLmFyRUcAAAAmAAAFUGVuVVMA AAAmAAAFdgBWAWEAZQBvAGIAZQBjAG4A/QAgAFIARwBCACAAcAByAG8AZgBpAGwARwBlAG4A ZQByAGUAbAAgAFIARwBCAC0AYgBlAHMAawByAGkAdgBlAGwAcwBlAFAAZQByAGYAaQBsACAA UgBHAEIAIABnAGUAbgDoAHIAaQBjAEMepQB1ACAAaADsAG4AaAAgAFIARwBCACAAQwBoAHUA bgBnAFAAZQByAGYAaQBsACAAUgBHAEIAIABHAGUAbgDpAHIAaQBjAG8EFwQwBDMEMAQ7BEwE PQQ4BDkAIAQ/BEAEPgREBDAEOQQ7ACAAUgBHAEIAUAByAG8AZgBpAGwAIABnAOkAbgDpAHIA aQBxAHUAZQAgAFIAVgBCAMEAbAB0AGEAbADhAG4AbwBzACAAUgBHAEIAIABwAHIAbwBmAGkA bJAadSgAIABSAEcAQgAggnJfaWPPj/AARwBlAG4AZQByAGkAcwBrACAAUgBHAEIALQBwAHIA bwBmAGkAbABPAGIAZQBjAG4A/QAgAFIARwBCACAAcAByAG8AZgBpAGwF5AXoBdUF5AXZBdwA IABSAEcAQgAgBdsF3AXcBdkAUAByAG8AZgBpAGwAbwAgAFIARwBCACAAZwBlAG4AZQByAGkA YwBvAFAAcgBvAGYAaQBsACAAUgBHAEIAIABnAGUAbgBlAHIAaQBjAEEAbABsAGcAZQBtAGUA aQBuAGUAcwAgAFIARwBCAC0AUAByAG8AZgBpAGzHfLwYACAAUgBHAEIAINUEuFzTDMd8Zm6Q GgAgAFIARwBCACBjz4/wZYdO9k4AgiwAIABSAEcAQgAgMNcw7TDVMKEwpDDrA5MDtQO9A7kD ugPMACADwAPBA78DxgOvA7sAIABSAEcAQgBQAGUAcgBmAGkAbAAgAFIARwBCACAAZwBlAG4A 6QByAGkAYwBvAEEAbABnAGUAbQBlAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGUAbA5CDhsO Iw5EDh8OJQ5MACAAUgBHAEIAIA4XDjEOSA4nDkQOGwBHAGUAbgBlAGwAIABSAEcAQgAgAFAA cgBvAGYAaQBsAGkAWQBsAGUAaQBuAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGkAbABpAEcA ZQBuAGUAcgBpAQ0AawBpACAAUgBHAEIAIABwAHIAbwBmAGkAbABVAG4AaQB3AGUAcgBzAGEA bABuAHkAIABwAHIAbwBmAGkAbAAgAFIARwBCBB4EMQRJBDgEOQAgBD8EQAQ+BEQEOAQ7BEwA IABSAEcAQgZFBkQGQQAgBioGOQYxBkoGQQAgAFIARwBCACAGJwZEBjkGJwZFAEcAZQBuAGUA cgBpAGMAIABSAEcAQgAgAFAAcgBvAGYAaQBsAGV0ZXh0AAAAAENvcHlyaWdodCAyMDA3IEFw cGxlIEluYy4sIGFsbCByaWdodHMgcmVzZXJ2ZWQuAFhZWiAAAAAAAADzUgABAAAAARbPWFla IAAAAAAAAHRNAAA97gAAA9BYWVogAAAAAAAAWnUAAKxzAAAXNFhZWiAAAAAAAAAoGgAAFZ8A ALg2Y3VydgAAAAAAAAABAc0AAHNmMzIAAAAAAAEMQgAABd7///MmAAAHkgAA/ZH///ui///9 owAAA9wAAMBsUEsDBAoAAAAAAAAAIQBgy1gg5AsAAOQLAAAUAAAAcHB0L21lZGlhL2ltYWdl MS5wbmeJUE5HDQoaCgAAAA1JSERSAAAHgQAAAEsIBgAAAH7o8QEAAAAJcEhZcwAACxMAAAsT AQCanBgAAAAZdEVYdFNvZnR3YXJlAEFkb2JlIEltYWdlUmVhZHlxyWU8AAALcUlEQVR42uzd 73HcxhnA4d0FlIwsy2EHcQksISkhHTCV2K7AJcgdpASVEJfgEjKWZX3hYYMFsPhzd7Qoi6RI 8HnoI3C4O4p349EH/ebdja9e/+1tCOEfAQAAAAAAuFnOIc+nw9nP/e2fH96/+99e3/LLV6+/ 7Q//iTFe1mtx+Bb9/wDweP3Q/vUvL3wMAAAAAADsRv7MF2zujrE31O/lbgnA46277Lr89uWr 17sMwf37KuH3bUrpIsYYllt5NIY5A6+C8Nk0/Im9WF4G+HztixciMAAAAAAAz1M+OVnuDN/r 9G/eBuCu3LqSK7vL3HW7C8ElAMcY36YYL1KTQoopnITgcizJNq7D7SrhxpMrADwQERgAAAAA gOflZPJ3e2Fa6nk5z+Nz5gDc5RBzNwfRLoTLLu9nIngOwCldNCmFNN/iJgQP08AlAK8ngY+W iY6r78enANyf9kXb+hQAAAAAANilfNPi0PmG5+bteZ4mgZcloHOIMYeUY+hiFw51CrYrS0M/ /YngTQBuUhgjcHM2AteJ4GUaeBn9jedq740BOGrDAHesbZrGpwAAAAAAwDOynvQ9faxeGwPw KgZPy0CnWI7TNOxqSeT+CZddCCUE/+vD+3e/PLVPpQbgJqWL1DRDAC4hOK2mgct7Tutp4DgG 3DoBXPcLXtsOB8u9AA+hbVsRGAAAAACAZyRvDpsLdTfgMQSv9gEuX12ZAM6hS12I3RJCu3I8 jMsjh8OhTAT/d5oI/vmpfCRzAG6aaQK4mQNwXRI6lmM8Pw1cl4aep3rn1nu0ILQGDPAgTAID AAAAALAf+TYPnV0Leg7A83mNvzUEx2k56CEA56P9cRf9vYvDsjT0ow/B6wDcNjX+novAZQo4 nS4HXaeA60T0SQg++nTCR1qwUAzw2dryFzcAAAAAAOxW/uOLeXOS62EOwEsMzqHrpvjbdVMA PW6WORzGkycRgvvf76p/Pz82TZoDcBkeW8ffVJeEjjcsB73ZF7hYPpTTnhv/8C4Ad6NN0d+w AAAAAADsWPzji0sEzsP1ZQo4jscc5whcJoDHEBzGieAwLQO9+bf2+fxRh+ApAL9p5vg7BuCy FHQ6mgJOqcTeepxudQnoWCd/42rZ51tM/AJwb0wCAwAAAADwLOR8fq3odbgsTxky8HReloCO NQRPy0Gv9ww++Rn13tSGwyFeHA6HRxeCTwNwswnAS/xdIvC5paDDOgav3vvH4m80oAZwr1p/ 0QIAAAAAsHfjFO/H/z08xmkgeHWeS+jM097AJW+mrj8vA1Z5WRL6eF/gdRQN+eJweDwTwecC cJtqBF6WgC7nZfq3mfYDPrsU9PRm4/y+b98c9AmA+9P6CAAAAAAA2LtPjZN1arieLyG4TAan 0M1LQ48jvzF29cXTAPB4PcXDNBR8uLh+BBPBJQCnlN4M8beG380k8JkJ4JRuDMDrz1XUBXg8 rAUNAAAAAABH5tg5nS8BtEzFpmFp5HKtRNJ1OC3nNai29dj2x3Y4XvTPKSH46ku8p2UCOC2/ V9NsA/C8N/BqSeg4heC0LAedNstCRwEY4JExCQwAAAAAADeocXNZTrpMCMdxxCqnkLrcH/K8 PXCsewHXw6qNTkn5ov9hb16+eh0+vH/300O9jxqA26NAPYbfZorXJfo2y/6/m+Pp9K/wC/B4 icAAAAAAAPARm2WPw9h8h1sKoctlm+C0WXuz7pU7yMc/rQ3h+vrBQnD/53yfUvpungA+nv6d JoDHAJyWCFyibzpaBjqIvwBPgQgMAAAAAAC3VPcIXofQ0n6HBrwJweXxLpzPpdN08QOE4P7n v0kpXY3xN51f/vl4D+DV9G8UgAGeJBEYAAAAAAA+we1C8DL+m+e1oo9+UP8zrg+HewvBJQA3 JQCXvX9Tjb/pdAp4HYCnPYCjAAzwpInAAAAAAADwiU6CaH9/3B+4G9aIjiGHaRvd8eGw3VM3 xsP8usPh8Oarr78Jv//260939fsNAbhprjZLPw9Tv0sI3obf7R7AcfO7ir8AT40IDAAAAAAA f9IcSHOeim/qv7rNVHDO51+7vn6XIXgMwOmqbVf7/5b9fqeln5cAfDT9m8Z9gJPpX4AnTwQG AAAAAIDPsITSUnXLxG8KqZtCcE7rlaHXrwq52V45jEtDf/vh/bvv/+zvMgfgpg2bKeBVBC7R tx7nvX+PloHevi8AnhoRGAAAAAAAPtMmBOf+PI0heOi/KU3PWS8PXfcKXgpxuXYdwncvX73+ +4f37/79qb/DZgnodr0M9Hb/37Ic9PHyzwIwwL6IwAAAAAAAcAdOJoLTuBZ0DF1/K1E4DMtD j08OYRkE3gbX6xCuXr56HW4bgvvnXvR/9o8ppTkA1yngti79vJoC3u4BvMRfARhgP0RgAAAA AAC4I6d7BIchtA57A4ejpaFX5/H4cs63CsFTAH6bUrrc7AE83dJmCjgKwADPhAgMAAAAAAB3 aA6qYQy63bA0dA65jAKXPYKHR6bb+F84xOl8CLJjPz5cH66++vqb8Ptvv54NwTUAN01zWeJv 226Xfx4j8GoC+GgJ6OFr/jPFX4A9EYEBAAAAAOCOlaiay1LQMQ4rQHflWx5jcFkXOs7rQoch xpYaG8N6EneMtNeH8yF4CcB1AridAnDaRuDNBPA09buaAg7B9C/AHonAAAAAAABwD45D8DgV XBpw6o9d2SV4+/zxRaEe4liFw+EoBJ9MADftOAWcxgh8sv9vjb79+fC7CMAAuycCAwAAAADA PVmH4KJOBadhWehxIrgG31hXiV69NsZDmFaKvnr19Tehy/mH/vp/2rYE4HH6d1kGOg0huMbf EoLXyz8n+/8CPBsiMAAAAAAA3KNzITgPJ6k/5unO8Mz5VvcJHqPtvJ/vVdflq2Gp52EJ6O0e wMf7/6Z0Gn8FYIDnQQQGAAAAAIB7dhyCi3kqePhW0m+eJ4IP5djF0HVxDrol9pZoXKLuetp3 2ft3vfyzAAzwnInAAAAAAADwAE7ja4m0eQi7/SF0sRyX6d8udiGnPOwf3OQ8ROQwheQ4h+Al CA8Tw3P4HSPw8NwQNhEYgP0TgQEAAAAA4AEtE7lD0w1le+Dcf4v9na5E3vIVuyHodl0eAm8J wOOq0fXxsCwVvZr8HeKw6V+AZ08EBgAAAACAB3ZueehSdlOuk8Hj48Ok8HRt2Tt4fG4NwUMA 3oTfIAADPHMiMAAAAAAAfAHHcbbcK513nAwutzjF32kKOG+fPC71fHP4FX8Bni8RGAAAAAAA vqCTWFsC7rAHcFhNAOe5Acf6ffzv7NSvAAzwvInAAAAAAADwha2jbZ0IHvcMLqU3h5p+j14V 6svEXwDWRGAAAAAAAHgk1jF33DN4uDdc204Cn74GACoRGAAAAAAAHqFzewYDwG0kHwEAAAAA AADAfojAAAAAAAAAADsiAgMAAAAAAADsiAgMAAAAAAAAsCMiMAAAAAAAAMCOiMAAAAAAAAAA OyICAwAAAAAAAOyICAwAAAAAAACwIyIwAAAAAAAAwI6IwAAAAAAAAAA7IgIDAAAAAAAA7IgI DAAAAAAAALAjIjAAAAAAAADAjojAAAAAAAAAADsiAgMAAAAAAADsiAgMAAAAAAAAsCMiMAAA AAAAAMCOiMAAAAAAAAAAOyICAwAAAAAAAOyICAwAAAAAAACwIyIwAAAAAAAAwI6IwAAAAAAA AAA7IgIDAAAAAAAA7IgIDAAAAAAAALAjIjAAAAAAAADAjojAAAAAAAAAADsiAgMAAAAAAADs iAgMAAAAAAAAsCMiMAAAAAAAAMCOiMAAAAAAAAAAOyICAwAAAAAAAOyICAwAAAAAAACwIyIw AAAAAAAAwI6IwAAAAAAAAAA7IgIDAAAAAAAA7IgIDAAAAAAAALAjbX/72ccAAAAAAAAAsAu/ /F+AAQAfdOWYls2O6gAAAABJRU5ErkJgglBLAwQUAAYACAAAACEA5VH/LcAFAADKHQAAIQAA AHBwdC9ub3Rlc01hc3RlcnMvbm90ZXNNYXN0ZXIxLnhtbOxYXY7bNhB+L9A7EOpj4Vg/lCwZ 8Qa2104W2CSLeHMAWqJtwRSlUrSzmyJArtUeJyfpkCL9t4vWm7gF0vjFGg2Hw5mPH0djPn9x VzC0pqLOS95zvGeugyhPyyzn857z/nbcih1US8IzwkpOe849rZ0XFz//9Lzq8lLS+jWpJRUI vPC6S3rOQsqq227X6YIWpH5WVpTD2KwUBZHwKubtTJAP4L1gbd91o3ZBcu6Y+eKY+eVslqf0 skxXBeWycSIoIxIyqBd5VVtv1THeKkFrcKNn74V0ARmmE5ap53Te/L6jM5Rnd4CT63pgQbra Mx0ygdaE9Zzp3HPaF8/bxthIanJd3QpKlcTXL0U1qW6EXuHN+kaAT3DpIE4KQFg50APGTL/y tRbaB9PnViTdu5ko1BPgQRAh7OO9+m0rHb2TKG2U6VabLt4+YpsuRo9Yt+0C7Z1FVVZNcA/T 8W06ryjJgCA3jKR0UTIla4y0sQ2+rq7LdFkjXkJyCosm141FA4B6Vgsk7yvwu8gEMPNjz/lt RQRQ0Exp7LSwDfJ4hPwk9j0vaTLHEY79/fRJtxK1fEnLAimh5wiaSs0Esr6uZWNqTXQczepV V94NyuxeWU7hCSjBoYP5i1J8dBC74nXPSXyMIwdJ/YIj3w8cJHZHpnsjkg1LtsmA1XIi7xnV 8pp5sCwibA6Hmun4Mjp7ByqFmAcsN1kZy0be8VBpUHh2QwRR0xhR9YDy1vuJmVnp7GxWOtG/ Z0RgGXFJJN3jg38KPmTSMWfzyUwI4iT2XP9H4YP4Wj7MWKZ38vcgDIJBcOm24uFo3MLRwGsN Ih+3xtEAj8ZBEo9H40+O3RjYbpkXdJzPV4K+XTXwiANSobqQQ0YJ3yQgL2Iox20vUrFIHdFM leNT8xJbXk5YnlF0VZD5Pj2Df6YnSO9KaaThAoKi/boCKhzH3ZplV8Xc8FefhqfxF/uJ25Sz KIkSTwe85XDkJZELSs3hAMeRF34TiQl8+cc5Yw3NOPqgGNSBADQ0JaCoRq3b7bcRIF2adXes FNH4f3UyEOEp+Ok5qdQfjC3J9cu/UPVCy643qlva4xU+RdlTEO1/BxsWaQ48iUVRHHtxUwQx 9sJOclAKw9ANcWiaAuzFQRB/b7Vwu8mqGkKt21hoQI6pSUOWp0skS0SzXCLT/UqFUa1WqLfF qimizWp7S+ptfcKSE5qWPEOMrik7wr2uH09wf7vIxfHeTW052vu4XAm5ONq9PhNPcZ/PHvV+ 6mMc2WM8Lku147vnODzFOZ7Jg3a2OcYaj69oa+PYT5Ko8z9oZjYle/qd9Lmd/X7izaqYHhAm OgVhoGcA149xRvPxqxvgH5E5394RjxI86F+O3NZgGEJHHEbjVr/TT1p993IwjobuCPeHm464 VsTgsHnHVrkvn//45cvnP0/QCOuHvYmA3YXNMRJaiRwSGQySyB/Gg9bAw5DIZdJp9cdR2BqH AcbDQdwfBqNP6nLEw91UUH1vcpXZGxcPP7hzKfJUlHU5k8/SsjCXN+2q/EBFVeb6/sZzzSWQ bhO9OEzcUO2soTHEZp86WnUuzL1MysRrUqHp3IPTL6H5lncgZUuQpnNf6Xyl85UOJJKmlEuw MILV+FazsQmsJrAabDXYakKrCa0mshrg5ILlfAlgqIeDZiV71Sis1JQAfYX2gJQFEdcNgU1d Q0DNWzKdADMTD2PV6wPNtQkl13wglvqvh7oD4+YVhtTfkJzPb1a8+R/yGMfRkgp176fkB+37 weUWgPuwfYeo1aqa2TMocT3n14K3mDT1gxwMUGJumeqDgbQ2vpsI94+eFv0tNDjs6ODP+ChQ DD7BFh8LwhkfBYrBB2/x8YKOF50BsqgYgMIdgGI/js8AWVQMQNEWIN+PgUBngAwqBqDODkAd HJxr9AYVA1C8BUihcy7SG1QMQMkOQFHYORfpDSrNP7mdftG+NndQF38BAAD//wMAUEsDBBQA BgAIAAAAIQD0ug0m4gMAAHcNAAAlAAAAcHB0L2hhbmRvdXRNYXN0ZXJzL2hhbmRvdXRNYXN0 ZXIxLnhtbORXXW7bOBB+X2DvQGifFUnUT2QjThFJcVugP0HTHoCWKEsIJWpJ2rVbFOi1do/T k+yQEpM4DXazaR520RdzNJoZzjf8OBqfPNt1DG2pkC3vF05w5DuI9iWv2n69cD68X7qpg6Qi fUUY7+nC2VPpPDv99ZeTYd6Alm/UayIVFQji9HJOFk6j1DD3PFk2tCPyiA+0h3c1Fx1R8CjW XiXIR4jfMQ/7fuJ1pO2dyV88xJ/XdVvSgpebjvZqDCIoIwowyKYdpI02PCTaIKiEMMb7IKVT wFheskqvq/X4+47WqK12UCnfD8CCzE1kmjOBtoQtnNU6cLzTE28yniTtLIf3glIt9dvnYrgc LoTZ4c32QkBMCOmgnnRQYx3AvJjMzGO/NYJ3x31tRTLf1aLTK5QHQYZwknv962kd3SlUjsry Rls2b++xLZvze6w9u4F3a1ONakzuezjYwnlBSQUEuWCkpA1nWjY1MsY2eTm84uWVRD0HcLoW I9Zri7EAeh0apPYDxG0qAdz8tHB+3xABFJxcRjsj3CT58ArhWYqDYDYij5IkCqMD+GQ+CKme U94hLSwcQUtlmEC2r6QaTa2JyWPcfZirXcarvbZcwQpVgmsH/g0XnxzEXvZy4cxwFCUOUuYh SjAOHSRuv1kdvFEs5+waAZPqUu0ZNfKWBbAtImwN15qZ/CpavwOVrlgALJ9QTZajfCvCYIrS VxdEEO3GiO4ItHc/XE6eg0FnURmgf8+I0DKiIIoe8AE/BR8qdUiH6aL+a1qE6SwNfPyzkEM8 lhw1q8yxfj6OshDPlrmLszR1o2UWuWdFkLvniR8UeZjMlrj44thTgrNXbUeX7Xoj6NvNWB5x h2FIdipnlPTXANRpCr3ZCxKdizIZ1bo3PzVJI0vSJef6u3abpuFT0LRWd9rWyFNzBR7RvtIU z2bJ8T/x1KT+3+YpIn0JceAb+j/pZ7GlyiVrK4rebLrVHcKY7vCjhJGsgtD3cWY81Mf2tp+R OT/e7HARZcvMj924KKDZFTl2z86ywvWzKC/O8zgP4ptmJzUxeji8h/a4b1//+O3b1z+foMeZ xU6ccLpwOJOENqIFIFk2S3CeZm4WREsAMjt2z5ZJ7C7jMIryLD3Lw/MveggOonkpqJmPX1Z2 sg6i72brri0Fl7xWRyXvpiHdG/hHKgbemjk98Kdh34zKMU7jxI+m+pvU7GqS1ddiGr9LJl6T AcFwDZdfwaCsdiBVVyCt1ljrsNZhrQOJlCVM9GAxCVaDrebaJrSa0Goiq4msJraa2GoSqwFK Nqztr6AWenFQzdmLUWGlCdzBn6XTvwAAAP//AwBQSwMECgAAAAAAAAAhADGRRDCfJAAAnyQA ABUAAABwcHQvbWVkaWEvaW1hZ2UxMS5wbmeJUE5HDQoaCgAAAA1JSERSAAABLAAAAQYIBgAA AN9KqCUAAAAEc0JJVAgICAh8CGSIAAAACXBIWXMAAA4VAAAOFQHUajXPAAAAGXRFWHRTb2Z0 d2FyZQB3d3cuaW5rc2NhcGUub3Jnm+48GgAAIABJREFUeJzt3XmUVtWV9/HvrqKqoKqYhwKZ xQJRBkEcQVDQiKISREUxyiCIoICABAQZhGIQCqrK/kPfTtudxMRkmWjb6ZjESGJWom/b2lET o8aY+LaJGrVjzGDUtMB5/zgPylBVPMPdd3r2Z627siLU2aemH+feewZxzmFMIUSkFJgEjAZO yFxDgDeBZ4HngJ8Cjznn9kbVT5N8YoFl8iUivYHrgHlA3yw+5FVgK/Bl59zHmn0z6WSBZXIm Iv2AncB0oDSPJl4D6oB7nP0AmhxYYJmsiUgZsAxYD1QF0OQeYJZz7s0A2jJFwALLZEVEegHf A0YE3PS7wDzn3EMBt2tSyALLHFXmWdVjQK1SCYcPrX9Wat+khAWWOSoReRwYq1zGAec75x5V rmMSrCTqDph4E5Er0Q8rAAGaRKRNCLVMQllgmRaJSDtgR4glhwKLQqxnEsYCy7Tm82Q3vypI G0Wka8g1TUJYYJlmiUhffGCFrTOwKYK6JgEssExL7gAqI6q9QESGRVTbxJi9JTRHEJEzgSci 7sYe59x5EffBxIyNsMwhRESApqj7AZwrIpdE3QkTLxZY5nCzgDFRdyJjl4iUR90JEx8WWOYT IlINbIu6Hwc5DlgadSdMfFhgmYOtBXpG3YnD3CYiPaLuhIkHCywDgIgci9+JIW46AFui7oSJ Bwssc0A9UBF1J1owV0RGRd0JEz0LLIOInANMi7ofrSgBGqPuhImeBVaRy+zHnoQwGC8il0fd CRMtCywzn+A35dOyU0TaRt0JEx0LrCImIp2AzVH3Iwf9gRVRd8JExwKruG0AukXdiRzdKiLH RN0JEw0LrCIlIkOAG6PuRx6qgO1Rd8JEwwKreDUAZVF3Ik+fE5HTou6ECZ8FVhESkQuAC6Lu RwEEaMws1DZFxAKryGTOFtwddT8CcDpwddSdMOGywCo+NwLHR92JgGwXkSAOdDUJYYFVRESk G/7NYFr0BlZF3QkTHgus4rIZ6BR1JwJ2i4j0i7oTJhy2RXKREJHhwLNAqWadcePgyithwAD4 /e/hP/4DvvQl2LdPsyr3O+dmqFYwsWCBVSRE5AfARM0as2fDP/0TlB4WiY8/DuefDx98oFmd s5xzj6tWMJGzW8IiICLTUA6rrl1h9+4jwwr8qGuV/pOmJhGxn+eUs29wyolIBX6vK1V1ddC5 c8t/vnIl9NN90jQamK1awUTOAiv9lgHHahYYMQLmz2/977RrBzv0D73fKiLt1auYyFhgpZiI 9ATWaNdpamr+VvBwM2b420NFNcBtqhVMpCyw0m0boDriuOwyOPvs7P9+YyMoL6i5WUQGqVYw kbHASikRGYM/Y1BN27ZQn+PTsZNP9m8TFZUTwjM7Ew0LrPRqwi8SVrNyJfTvn/vHbd0K7XWf NH1WRCapVjCRsMBKIRG5CjhTs0afPrB6dX4f27MnrF0bbH+a0ZDZr96kiE0cTRkRqQR+CfTV rHPffXDVVfl//N//DiecAK++GlyfmrHIOXeXagUTKhthpc/nUQ6rceMKCyuAiorcn3/lYVNm 33qTEjbCShER6Qu8DLTTqlFSAk8/DaNHB9PexInw2GPBtNWCRudcHE+0NnmwEVa67EAxrADm zg0urMBPc8hmDlcBbhSRtOz/VfQssFJCRMYCV2rW6NgRtmwJts1sZskXKC07rBossFIhs7e5 +unN69dDjx7Bt7t5M3TSfdJ0QWYfe5NwFljpMBsYo1lgyBBYvFin7W7dfBgq253Zz94kmD10 T7jMYt9fAT0163znO3CB4hjl449h+HB4+WW9GsAy55z6SNTosRFW8q1FOaymTNENK4CyMti1 S7cGsCGzr71JKBthJZiIHAu8CFRo1Sgrg1/8AgYP1qpwqMmT4ZFHVEvc5ZxbpFrBqLERVrLV oxhWAEuXhhdWAA0N0KaNaonrM/vbmwSywEooEZkITNOsUVMD69ZpVjjS0KGwSHf8Uwo0qFYw auyWMIEyi3qfBVRHCvfc4yeKhu2996C2Ft59V7XMNOfcQ6oVTOBshJVM16McViefDHPmaFZo WefOcPvt6mXqRaRcvYoJlI2wEiazmPcVQPVt1xNPwJmqG9S0bt8+GDkSXnhBtcwq55z+TvMm MDbCSp6NKIfVzJnRhhX49YUN+k+abhORGvUqJjA2wkqQzCLe5wG192hVVX7yZu/eWhVyM3Uq fOtbqiX+2Tl3nWoFExgbYSXLbhTDCuDWW+MTVuAnk5brPmmaLSIB7j9hNFlgJYSIXAiozjcf MABWrNCskLvjjoMlS1RLlOD3vzcJYLeECZBZtPs8MESzzgMPwKWXalbIz1/+4qc5vPOOapkZ zrn7VSuYgtkIKxluQjmszjknnmEF0KED1NWpl9kpIqqbH5rC2Qgr5jKLdV8B1HaMKi2FZ5/1 uyXE1f79fm7Yc8+pllnvnNusWsEUxEZY8VeHYlgBLFgQ77ACv5d8o/7GMKtFJEavHMzhbIQV YyIyAngGv/5NRZcu8Mor/n+T4PLL4ZvfVC3xFefcNaoVTN5shBVvjSiGFfglMEkJK4CdO6Ft W9USV4vI6aoVTN4ssGJKRC4FztGsMWwYLFyoWSF4AwbA8uWqJQRoyuyTb2LGbgljSEQqgJeA gZp19uyBSZM0K+h4/32/x/ybb6qWudY5d69qBZMzG2HF03KUw2ratGSGFUB1NWzbpl5mu4hU qVcxObERVsyISC/8oRLVWjUqKuCll2CgYiR+9BH8+c9+WU3nzsG37xycdpo/hVrRFufcbaoV TE5shBU/W1EMK/DLb4IMq5dfhi98wW/2d/zxPhDbtYOePf0D/Y4d/YGpN90Ejz7qT8gplAg0 6S+oWSEi/dWrmOw55+yKyQWcAuwHnNZ1zDG4998vvLsffID7l3/BnX567n3o0AG3ZAnu9dcL 78fMmXpfq8x1f9Q/F3Z9ekXeAbsO+mbAE8q/fO7eewvr5scf47Zvx3XqVHhfKipwCxfi3nor //787ne4ykr10Bof9c+GXZnfkag7YFfmGwEztcPqjDNw+/fn381nn8WNHh18v3r0wD3ySP79 2rhRPbCeAUqi/hmxywIrFhdQCfxO85dOBPfUU/l38667cG3a6PZv1Srcvn259+2DD3B9+6qH 1ryof07sssCKxQXcrvzL5ubMyb+L993nA0W7j+BvEfPp49e+pt63t4EOUf+sFPsVeQeK/QL6 AR9o/rK1b5//c6LvfhdXVhZOWB24Nm3Kr69jx6r3bUfUPy/Fftm0hujdAajuw7RunT8UNVdP PgnTpwczDSEX69f7aRK5amz00x0ULRWR41QrmFbZxNEIicg44CeaNWpr4Re/yH1f9BdegPHj 4Y9/1OnX0ZSW+h1Qp07N7ePmzIEvflGlSwd8yzmXY69MUCywIiIiJcBTwMmadf793+Gii3L/ uAkT4Mc/Dr4/uWjXDn71K+jTJ/uPeestH9Lvv6/XL+A859we1QqmWXZLGJ3ZKIfV5Mn5hdVT T0UfVgAffgh33ZXbx/TsCWvX6vTnIA0iorrtj2meBVYERKQ9sEWzRllZ/geR3h+joxi+/vXc P2bZMt11ksAwYIFqBdMsC6xorAV6aha46Sa/ri8fv/51sH0pxGuv5f7Qv6IC6ut1+nOQTSKi sKzbtMYCK2QiMghYplmje3fYsCH/j3/jjeD6Uqh9+/I73uvSS+HsswPvzsG6AhtVK5gjWGCF rx5QPct4yxa/Q0K+ysqC60sQ8u1PY6M/vELRIhEZqlrBHMICK0QiMgn4rGaNUaPguusKa6Nd zE7ny3cP95EjYf78YPtymDbAbtUK5hAWWCHJvFVSP6iqqanwUUVaAgtg8+bCRptZmCwiU1Qr mE9YYIVnAf7tkpoZM+CsswpvJ06BVVKS+6TXg3Xv7mfOK9slIjG7kU4nC6wQZN4mbdKsUVnp j8AKQpwCK4gjvRYvhsGDC2+nFUOAm1QrGMACKywb8G+V1Hz+89C3bzBtpS2wyspg167C2zmK 9SLSTb1KkbPAUpZ5i3SjZo1+/XxgBSVtgQV+xv9nPhNMWy3oBNSpVjAWWCHYjX+bpKa+PtiQ iVNgBdmXhgZoo/qdYJ6IjFCtUOQssBRl3h5N1qwxYQJcfnmwbcYpsII8lv6EE9RPug7lTXAx s8BSknlrpDpHp6RE56irtAYWwMaN/ugxReeIyDTVCkXMAkvPYkD13dT8+X5yZNDSHFhdusDt twfbZjPqRaRCvUoRssBSICLdAdXZP506QZ3SI944BZZGX264wd8eKjoW5fWixcoCS8dmQHV+ 9caN0E3pJXqcAivoERb4B+/5br2TgzUiorojRzGywAqYiIwEVFewDR0KNypOlEh7YIGf4nDx xTptZ7QHtqpWKEIWWMFrRPnr2tio+3q+GAIL/GRS5Z0pZouI6q6yxcYCK0AiMh04W7PGJZeo T4CMVWBp9qW2FpYs0WsfEEDhPW7xssAKSOatUECr+ZpXXg67Q9jMJE6BpTnCAn8EWvfuqiXG isiVqhWKiAVWcJYDqjuJL1sGgwZpVvCKKbA6dtR723qQHSISo69qcllgBUBEegFrNGv06hXK aTBAvAIrjL7Mm6czn+0gfYGVqhWKhAVWMLYB1aoFtkH79poVPhWnwNIeYYFfMdCov6BmlYjk cMKiaY4FVoFE5BTgWs0ap54K16pWOFSxBRb4AyumT1ctUQncoVqhCFhgFUBEDrwFEr0acOed /n/DUoyBBX4DxArdBTUzReQM1QopZ4FVmJmA6g/gNdfAaadpVjhSmCFxNGGG58CBsHy5epmm zD90Jg8WWHkSkUpgu2aN6mrYrlqheSLxCa2w+7FmjX/BoUj9EUKaWWDlbxWg+hB17Vr1X54W VVVFU/dwYd+eVlf7FxzKtomI6kuatLLAyoOI9EP5NfWgQX7eVVSU94zKWucIDoO/9loYM0a1 RC/gVtUKKWWBlZ8dgOq//bt2qT8AblVX1SMzshdFP0R0NkY8zHIRGaBeJWUssHIkIuOAGZo1 zjsPpk7VrHB0cQmsqEZ6Z54JV12lWqItUK9aIYUssHKQebujOsWwTZtQJjEeVVxuCaPsxx13 +PMeFU0XkQmqFVLGAis3swHV7UIWLVLfDTMrcRhhVVVFe1vcty+s1F9Q0ygi9nuYJftCZUlE 1Ddk69rV7yQaB3EIrDiM8oI8oLYFJwHXqVZIEQus7K0BVLe8rauL5q1YcyywvMpKf2uorE5E VLfUTgsLrCyIyECUDxUYMcKfghMXcQisOPQB/MP3M89ULdEDWKdaISUssLJTD6g+TWlqgtJS zQq5iUNYxGGEdUBjo/p6zsUiUqtaIQUssI5CRM4GLtWscdllfreAOLHAOtQpp6jvmFEO7FKt kAIWWK3IvL1RnWTQti3Ux3A2ThwCKw59ONi2bX7pjqKLRUR5x/5ks8Bq3XWA6l6UK1dC//6a FfITh7CI0wgL/LrONar7ygLQICKKZyIlmwVWC0SkA6C623efPrB6tWaF/FVWRr9jQ9wCC/z2 MwNVd+7nBOAG1QoJZoHVsnX4tzdqduxQn0ldkKgDIw6jvMNVVPiN/pTdLiIxjOvoWWA1Q0SO A1RPrBs3Tn2tWsGiDoyoA7Ml06fDBN0FNV2AjaoVEsoCq3m78G9tVJSUhLIbQMEssFrW1OS/ j4oWishQ1QoJZIF1GBE5F7hEs8bcuTB6tGaFYEQdWFHXb83Ikf54MEVtgAbVCglkgXUQESlF +YekY0fYskWzQnCiDow4j7DAL6XqqLug5nwRmaJaIWEssA51PTBMs8D69dBD9VF+cKIMrKoq KFe7KQ9G9+7+qHtlu0WkTL1KQlhgZYhIJ2CTZo0hQ2DxYs0KwYoysKIe3WVr8WKo1V1QMxi4 SbVCglhgfWoD0E2zQEMDlCXo38ooQyPut4MHlJf77ayVrRcR1Z/NpLDAAkRkCHCjZo0pU+CC CzQrBC/K0EhKYAFcfLHf1lpRJ2CzaoWEsMDydgNqY5+yMti9W6t1PXZLmL2GBr+9taL5IjJc tUICFH1gichk4ELNGkuXwuDBmhV02C1h9k48EW7QXVBTivJC/CQo6sDKLDJVHfvU1ITyJkmF jbByc/vt6kE7UUQ+q1oh5oo6sIBFgOps4q1boUMHzQp6unRR37Su1dpJ06VLKHvy14tIhEdz RKtoAyuzuHSjZo2TT4Y5czQr6CotVZ8Y2aIkBhbAwoXqpx4NApaqVoixog0s4HZA9ciHO++M boQSlKhuzZJ4Swj+wXsIL1huE5Ea9SoxVJSBJSLqew5dfbX6wQWhiCo4kjrCAjj/fLjoItUS 6kfOxVVRBhZ+vaDaS+iqqlCOhgpFTUT/jndL+DTJXbvUJwnPFpEELKEPVtEFlohcBKjum33r rdC7t2aF8PRUPYkxfnWDMniw+jIs9fMG4qioAiuziFR1IcWAAbBihWaFcEUxwqqogE6dwq8b tPXr/QJpRWeJyBWqFWKmqAILWIxfTKpm167o90IPUhQjnaSPrg7o2BE26y+o2SEiKfqJa13R BFZm8eh6zRoTJ8KlqicYhs8CqzDz5/tTvRX1B25RrRAjRRNY+MWjarOKSkv96cBpE8UtYZoC q6QklJ+L1SJyjHqVGCiKwBKREcB8zRoLFsDwFC5NtRFW4c45R33kXQVsV60QE0URWPhpDKVa jXfpEsqzikhYYAVj507/MkHR50TkVNUKMZD6wMosFp2oWSOERa+Rqa7288rCFNXcL03HHgvL lqmWEKBJJOlrK1qX6sASkXKgXrPGsGF+/ViahR0gaRxhAaxdq/65nQ7MVK0QsVQHFnAzfrGo msZG/8A9zcIOkLQGVnU1bNumXma7iMT4PPHCpDawMotD12rWmDYNJk3SrBAPFljBmTULxoxR LdEHWKVaIUKpDSxgC6C2E1VFRSiHD8SC3RIGRySUaQ4rRaSfepUIpDKwRGQUoLoT1YoVMHCg ZoX4CDNAOnSAdu3CqxeFsWPhyitVS7QDUrL8/lCpDCz8olC1z+2YY2DNGq3W4yfMwErz6Opg O3aoB/OVIjJWtUIEUhdYInIZMF6zxh13hP+qP0ph3hIWS2D17QsrV6qXSd00h1QFVmYR6E7N Gmec4TfnKyY2wtKxahX06aNa4mRglmqFkKUqsIDlwACtxkXSse1xriywdFRWhrLR4zYRqVav EpLUBJaI9AJu1awxe7b6K+lYsltCPVdd5UftinqiPL0nTKkJLGAboPYvSfv2oUz6i6W2bcM7 PafYAksEmprUR+3LRCQV77RTEVgiMga4VrPGunXpXOOWrbCCpNgCC+CUU+Caa1RLVKC8RC0s qQgsoAm/+FNFba0/br6YWWDp2rbNL91RdKmInK1aIQSJDywRuRJQPVBr924oL9esEH9hjS6L NbCOOcYfXqKsUUQS/Tuf6M6LSDtgh2aNyZPVz5hLhDCCpKRE/dCGWFu+3B9iomgkME+1grJE BxawEuir1XhZGTQ0aLWeLGEEVteu/uTkYtW2rd/oT1mdiIT0CiV4iQ0sEVFflX7TTXD88ZoV kiOMW8JivR082GWXwYQJqiW6A+tUKyhKbGDh97BW2/ene3fYsEGr9eQJI0wssLzGRn97rGix iNSqVlCSyMASEfWdFbdsCW/uURJYYIXnpJNg7lzVEuUoHyisJXGBlVnM2YjiNIZRo+C667Ra Tya7JQzXli1+qx1FF4vIeaoVFCQusIDPAadpFmhqUh+SJ05Njf4aSgusT/Xo4ScrK2sQkURt 8J2oX0sRqcIvwVEzYwacdZZmhWRq08a/xdNkgXWoJUvguONUS5wI3KBaIWCJCiz8W8HeWo1X VobyWjmxtAPFAutQ5eWhbMN9u4h0Vq8SkMQEVmaP6ls0a6xa5TdWM83Tfo5lgXWkSy6Bc89V LdEV2KhaIUCJCSz8jHa1TWX79QtlB8hEsxFWNEI4Sm6RiAxVrRCQRASWiIwDZmjWqK9P/+EH hTpV8SD08vL0np5dqBNPhBt0nzS1AXarVgiIOOei7kOrMtMYnsZv96piwgT40Y+0Wk+Pt9+G /v3h738Pvu2TT4b/+q/g202Ld9/1u4a8955qmSnOue+oVihQEkZYs1EMq5ISP43BHF1NDdx8 s07bdjveuq5dYeNG9TK7RaRMvUoBYj3CyuxF/Qp+m1cVCxbA3XdrtZ4+f/mL/5f+nXeCa3Pa NHjwweDaS6u9e2HECHjpJdUyy51zsV3yH/cR1hoUw6pTJ6ir02o9nTp0CPZrVlMD//iPwbWX Zm3a+L3ZlK0XkW7qVfIU28DK7EG9XLPGxo3QLbbfmviaPx9mBXB4VL9+8PDD9j3IxeTJMGWK aolOwGbVCgWI7S2hiHwTmK7V/tCh8POfF/f+S4XYuxeuuAL+9V/z+/hzz4Wvfc3CKh8vvwzD h8PHH6uV2AeMcs49r1YhT7EcYYnIBBTDCvzcFgur/LVp45873Xmn33guWyKwZg088oiFVb6G DPF7tSkqxW8wEDuxG2Fl9pz+KXCSVo1LLoF/+zet1ovPb38LX/wifOlL8Oqrzf+d2lr43Of8 rWT//qF2L5X+9Cf/Nf3DH1TLTHPOPaRaIUdxDKz5gNpj2PJyePFFGDRIq0Lxcg5ee83P13rn HfjoI794t7ZW/USYonT33bBwoWqJ3wAnOOf+V7VKDmIVWCLSAT+NoYdWjVWrYPt2rdaNCc++ fTB6tH8Wq2iVc071oJdcxC2wdqK4wLlXL//Asn17rQrGhOuHP4RJk1RL/BWodc69rVolS7F5 6C4ixwFLNGts22ZhZdJl4kQ/8VZRe2CLaoUcxGaEJSIPAVO12j/1VHjySf1dM40J26uvwgkn 6KzxzNgPjHHOPatWIUuxGGGJyCQUw0rEv363sDJpdOyxems8M0qAWKy4jXyEldlT+jlgmFaN a6/1r9yNSau//hUGD4a33lItc4Vz7huqFY4iDiOs61EMq+pqeyto0q99e3/SjrKdIpLDNOHg RRpYItIJ2KRZY+1a/3bQmLSbPdvvK6aoP7BCtcJRRHpLKCINgNrd96BB8MILUFGhVcGYeHn8 cfVTn/4GDHbOvalapQWRjbBEZAhwo2aNXbssrExxGTfOH1WnSP2ovdZENsISkYeBC7XaP+88 +P73tVo3Jr5++1s4/nj48EO1Eg443Tn3lFqFFkQywhKR81EMqzZt/G4MxhSjfv3gFtUD8RCg MXPeQqhCDywRaQOobsG6aJGfSGdMsVq9GnqrHTkMwBnATNUKzQj9llBEFgN3arXftSu88gp0 TsxZtsbo+OpX/ZY+il4HhjjnPlCtcpBQR1gi0gXlU2br6iysjAGYORNOP121RB9glWqFw4Q6 whKRfwDU9kocMQKeeUb9lFzTit/8xu+J9T//48/Sq66G7t39qc7DhkFZrA+RSp+nnvKhpfhr /iF+lPU7tQoHCS2wROQE4Gf4U2ZVPPYYnH22VuumJd//PnzlK36rkzfeaPnvVVb61+5TpsD1 1+e2tbLJ37XXwr33qpb4unPuKtUKBzjnQrmAR/CvQ1Wuyy4L7VOxK3P97Ge4z3wmv+9Xv364 L38Zt39/9J9H2q833sBVVen97mWusWF8MqF8xYCLNL9Ybdvi/vu/o//BKJbr9ddxc+bgSkoK /96NHo37wQ+i/5zSftXVqQfW02Tu2DQv9a8UUAa8rPnFWrcu+h+IYrm+/W1cZWXw38OFC220 pXl9+CGuf3/10Jqt/Ymof6WAZZpfpD59cH/7W/Q/EMVwPfggrrxc73s5axZu377oP8+0Xvff rx5YbwLVmp+E6lcI6Aa8p/lFuu++6H8QiuH65S/9rbfyD7y7447oP9c0X+PHq38Pt2p+Aqpv CUXkLuAGrfbHjYOf/ESrdXPA/v0wfjw88YR+rbZt4bnn/GGhJnjPPgtjxvjvqZK/A0Odc/9P o3G1iaMiMhyYr9V+SQk0xWLT1vR7+OFwwgr8WYabVHdIK26jRsGcOaolKoCdWo1rznRvxB95 rWLuXH8mm9F3zz3h1nvwQX+ysdGxZQt06KBaYrqInK3RsEpgichngYkabQN07BjKdrAGfxLL ww+HW/Ojj+A73wm3ZjGpqYHbblMv0ygigedL4A2KSDlQH3S7B1u/HnqonQ1tDvbaa7B3b/h1 f/3r8GsWk6VL4bjjVEuMBK4LulGNEdZSYJBCu4B/GLt4sVbr5nCvvVZcdYtFeTnUqw4rAKgT kUBvPgMNLBGpAVQHmw0NtoA2TFGdlG0ndOubOlX9mPsewLogGwx6hFUHqD3OmzIFLrhAq3XT nAEDiqtusWlsVN/dZImI1AbVWGCBJSKjgLlBtXe4sjLYvVurddOSmhr1nSubpXxclckYNgwW LFAtUQ7sCqqxIEdYjQG3d4ilS/3JtiZcIjBrVrg1Bw3yk4JNODZtUt/08mIROS+IhgIJGBG5 DBgfRFvNqamBdYHeCZtczJvnH9KGZeFCH5QmHF27woYN6mUaRKTgm8+CAytzdLXazFaArVvV J7qZVgwcGMq8HQBGjoQlS8KpZT51443+aDBFJxLAMr2C1xKKyBpAbRrnmDF+m1f7FzdaH3/s b9OeUjyJrrLSLwE66SS9GqZl3/0uXKh2+B4A7wK1zrn38m2goBGWiPQCbi2kjaNparKwioOy Mvje9/w/IBqqqvzsdgur6FxwgXpgdaXAQ2gKvSXcClQX2EaLrr4azjxTq3WTq86dYc+e4I9C HzoUHn0UJkwItl2Tu9271ec5LhKRoXl/dL770gBjgP0o7atTVeW34o16/yC7mr+efBI3blxh 3+OaGtzdd+P27o3+87Hr0+vmm9X3zPpuvp3L+7MCHtf8pOrqov/G2XX068EHcbW1uX1vKyv9 ttZ//Wv0/bfryOu993DduqmH1oX5dC6vh+4iciXwtZw/MEsDB8KLL9oxUEmxdy88/TT8+Mfw +OMtn0s4Zoy/7Rs/Hjp1irpdQtyAAAAEEElEQVTXpjV33QWLFqmWeBkY7pz7OJcPyjmwRKQd 8EugX04fmIMHHoBLL9Vq3RhzNPv2+c3+nn9etcwy51xjLh+Qz0P3lSiG1cSJFlbGRK201G80 oGyDiHTL5QNyGmGJSG/gV0Bljh3LSmmp33N6+HCN1o0xuZo2DR56SLXEXc65rG8+cx1h3YFS WIFfhGlhZUx81NerL8u6PnP+Q1ayDiwROR2YmVeXstClC2zerNW6MSYfgwbBzTerligFsr75 zCqwRETwuzGozTnftMmHljEmXm67zW9AoGiSiEzN5i9mO8K6Gjgt//60btgwuEHt9EJjTCHa tw/l0JddmfMgWnXUh+4iUoWfM6G2jduePepbtRpjCrB/P5xyCjzzjGqZzzvnWt35JZsR1ioU w2raNAsrY+KupMRvp6zstsy5EC1qdYQlIv3wk0TbBdwxACoq4KWX/Mx2Y0z8zZgB99+vWuIe 59y8lv7waCOsHSiFFcCKFRZWxiTJjh3qS+bmZM6HaFaLgSUiY4GANxL5VO/esGaNVuvGGA39 +8Mtt6iWKMHPSGjxD4+QmcbQpNUj8HM7qqo0KxhjNKxerX5u5HgRuby5P2hphDULUD1oaVSL gz5jTJxVVUFtYCcNtmhH5ryIQxwRWCJSjd9JVFUUZ90ZY4LRq5d6iQHAisP/Y3MjrDWAenf2 7NGuYIzRsH8//Od/hlLqVhE55uD/cEhgichAYHkYPXnggTCqGGOC9uST8Ic/hFKqCth28H84 fIS1E6gIoyc/+hE8+GAYlYwxQXEONm4MteQ1InLKgf/zSWCJyARgepg9mTsXfvObMCsaYwpR X+9POArRITMWxDmHiJQAPwVCPxWubVu44gqYPr31fXdaW/IY9p9Zf47enwMOnCkZ9P8mte2k 9v/tt/0OpN/4hn+GFYGrnXP3HQisecAXIumGMcYc3evAIME/2HoV6BFtf4wxplVTSvHPrWZF 3RNjjDmKvSWAnVFjjEmCM0uAsVH3whhjslBdgt8E3hhj4q4qn4NUjTEmCh+UAG9F3QtjjMnC iyXA41H3whhjsvBCCfCTqHthjDFZeFqALvhZpGp7txtjTIH+F6gpcc79Efhq1L0xxphWfN85 96cDbwnvjLQrxhjTunshs72Mc+554JuRdscYY5r3czL59MlBqiLSC39oaofo+mWMMUe4yDn3 MBy0gZ9z7vfA6si6ZIwxR/r2gbCCZo6qF5H/A1wfdq+MMeYwLwOnOef+fOA/NBdYpcADwNRw +2aMMZ94BzjLOferg//jEWsJnXP7gMuBLcC+cPpmjDGf+CFw0uFhBc2MsA75Q5HTgQXABGBg FoWy2en7aH8niDasL8XTl2z+jvUl/n35APi/wKPAN5xzze4c//8B29hC9inMp4kAAAAASUVO RK5CYIJQSwMECgAAAAAAAAAhACq1yhwlxwEAJccBABUAAABwcHQvbWVkaWEvaW1hZ2UxMy5w bmeJUE5HDQoaCgAAAA1JSERSAAABmAAAAooIAgAAAI+v2g8AAAABc1JHQgHZySx/AAAACXBI WXMAABcSAAAXEgFnn9JSAABAAElEQVR4AeydB6AVxdX4X8FCNQrWWAB7SxBsxEgs0c+ChUgk nwELJH/UqImaYMEk2BVjCRYknxWNEUs0scRYYoQQoyBi74A99kKR/v6/mbN77uxsuXvLe+8+ fMtl75kzp83ZnfPOlN1bP3DgbnVpR1NdXb2tA8hxCG0OwpYiqYZBcRn5nFFXl5eupbwRXEur zrQqwb54Y3Mbl8pan6Qot9iSCFNt8KQktNyjSC9m8voGZBJHdOSnhK0kYlGTwJKAipjE/ZJB klFlpVhXFCOK6gujjY/NLjc11jU11DV1yKLyr0sWLXWe2SVyFxHe9qql/Z5T2l4zclos7Wzd a66+bi0zMKBM1SXdLCURJ18/dVVydSXY0APNqCJBdEMuk7FNzAuNzMXV6kS0N6HJrW5Waxng +aLFrqXePS3W8CIXXgzSc0lmFWtMxMnlqSjJnmYiLuLBVK202Ha6iBtSqf2KoloDsXoRrDor JTMj8/WUVo63paC2NEnt1NXyANfEvQjA8atULV2BnFBBfeZIpcpKrbhQc6TJzaFoRZOpjiux Ye6tVSJrOeSiTs7ZQ0tPeoTRq6vhIpelAg/rRa1ARg07J2ra16qx0aZXsVT+DRd0yiraUp6o 9Htd75AEwVl1CeSpqGw5UhuzsIPLFatN1WVCg8uZTlgTNSmNrwnbVigjcHTGTdRaN02Ryy8W l3Q7ayNL4mqVS+1b6JerZZS6pFoC88qhQXwiQ0vKJZhT+vUXH5agIm9b8tGV1jxfphjvY4uW tbVl8hdV0KIEOa5gqpctb8sPMNU/RS+AXiplafOA12ZtoYfP084EliaVl0dAVWlca6wVkUBW VVXtwtqEB7gL3JuiiM357lwEZhBKVQlKi9hUpWo7hZdgdlmGClNBWo20uay2JPq30LTE6mwk Znj8cUy2hHitH8i8pnr64vyBRR5bAl1toNTO4g2rDYNbyQrxU5qTsmtbyeQaVIuf0lyYZa3y 6N2aRZ2vrt7KKiJQFSfKLMKcyNNySD+QtYBmdUi231rAknYV1gNyHfSyVMUrIi3hCodqWnGM mdHA0LoISUIrIvUrUCGx/U77quAKURFXJJiyFbj7yBKEID2u0mlYO9g2PVDZdeVGSbhXSvZE yTJq8FYUV6S3pAZMDq91EVPS22AvrDS0tGvsaQwNyRLisQhpEUZTXd+B/47g+jrJQR1ULlBl JBpSlds+sCNZQS4jXSIRo2a7VV8fGCdkekB9nUiVXVvUi5a9IDhtl5lqEYFescBfVF+rEXgm u3Y0p/lR/2YYgUGRGKAGGp7Awmx25XABYSmb0RUlMKIy/BUfWkJchva4XsVkaFea/IBIq66F +bWvAJRp90PJ1z3HdU3TlejGiAHhBc74u2p6n5DlsCRRYy6kLAKE9uRiyU1Ukn9yS60OYUVO bR53mcvtmuUWY4FMTHDJw9sF/2TcVtXx3gosRVzaTFd4BfJb6KHgXpMiZ/wncHhvht+xv7ta 0Va9Erog0mtzNkZ5c9InOaupVCE5dTUnWSyQGWVJjWsGI6L3ZUkKSrWwDV6ZkvxRGnGa4/Fq sqMUm+h3rRUrojRURhEpploh7h9KelM9/1X4cocRibJYYEVzMlRMi1iSQjeUssNXNpi3FaUr 0PbFWatnfly2xaTrLkd1urQU9WWhPS0UBZMYyMLKcppTgnXNLN61BFWeB2wtuBY0wjWoVmDx SsEJAiX5Kt1i5U5h83WkSzI1Qq1RTIsuFxqJeQz6qCWi2VMhfpmypS5NsaugeeBijsqrVdqV QJ1UkYRLYC2gSmYwrGUxFXRWDqUEMhGMder7ylW1soSUlpgrYPrE1/rwLzTuSL4zXWyaz1wa vBqS+TriDoei8Gky2ZnNwowAYOcwJbvcXs+5qclMltVzWArJyySTEwzUAjgS2jAYdUXYkGSs 57eQGKd5HvHLBcoMKEVnBkczVmUGsmbUW1Oi9YavKata1xh8UvUbFYFeByq00VUGzIcoZvKy AolBWn4Ts6jlvMx0SRPObHJmSQMOM/QM6ZXRkdUORjxgXGVdrT6LVHsFS+nhWrnYHsjsBZAr k9rLqnGRavDiV6NZrgzPf6W2GPrgY9MxiWKCcbUAg0SXPZtvCWpAptAU5mYBiflSFguuWCe8 kHIk14g7lMUSJVMqTbmAiPUU5hEGY6lc7YFMHYvrmumCqoq2BRRxSNxZiTdflMwkUHEvKA3A 8nBQCax4WDw2t8oKtNYSxJqalhMCLbXV9TXNy2L+MU5KRFrvuZVQec4OSex3ppACpZIpUKjL AQlXlh1RIcUCWanyotLbWMn0svLc3sYammAu7U64awRVkU9UaihFvhUd2ALWfgzeUgQEQp1g sEVJLWeZMrO8MNopskBAZIyZJqcYPpBVjKzi+uzWxsWn0Kego/yWKIUSdHKTU+ijkotETJ84 o5xqR4ynWCCLMazgCDPr+XWd+5ebNOEGjqOS7+dkbPSOCWnCb9thwoJRBKyfKGtCSSzjDIs5 G0EBGHwbJpOfEduULEFQOqpG7wbT0oQjBe3M7qdR+MIKdAUooMGRCUeMLIGmDFRcbKL6Vghk iXaU0cJmYxED4w5sNoVtTzAuqpZ/ZNuEyYTlo84QHbG7JUEvKMhkpiwMW0Zag1RYiSrHwamq KgOoSDvUjDSCbHyG5GzGsmtjGitsQdmGFGFshUBWxKL26q+pB2wPCXbAltxbJDxJLLN9T0aU yNGeaOCS5ZZ4LVQZfGKSYkS1FKUqQzYrFhm1ZVapKY5TyhRVe2ztgSzpmphL/nWdL5PbvXg/ yqBwekyxPiOkhC9Zo0y6GIoLxKYpDkUZepkyMxg776ksYIDlrHIrBxBodIWHwsuNNjkUFylr dUhmvhOjWIG/ALlMybChFR2lcKmsGFOivUreXEAerS0ayPIYVJIzXEdXXbj9+12NGRLXypKa 14rE2Fx9h2a0J1BWuavE8HCYaeILQY2ihLa0d2ykWJbLBWqzB9giJxESbm8LNJlKKoTFUAiU YkdOdLKMKDZayik4lQxp0rzqivX0ecJFo0fTooHM011h0WtehdJS2Mu4TGWwpChvq+jEO800 xl6yyHVzCgKq91KFFPUKgjSdNtti7c4yi3S0OVISsfG/YIkGCS9nBcJmmh1t2CFTgIE2gzBH +G2YwPCVKNzS5j2JAXmpU+hiQrLsEmKPxSum6ElFZ+kLmVSFS5wvkClrKKsVv8WWoA3yZVER fBXtK1uuMFbRkhYW5dnv3jWlWOKJSWSFRj7R2ghrHv0wQCZscpai4K1wrQ/IXI3CIhiHJSDR WrFEiwLYwGeiln1iKmiOalcRYAwyiGRSb/b8wEih+KFaHdIknFMdgjnJQvLkb7WzKtKSdeTG qjFw5AtkuUU3N6GYzjlt2lb8m+ueaG5bv5byzTOP9fXLli/zOqZcF+uSyMURvNYqkOg84RQa FxZiR1S9zvqHg8pIZIEe4piEwh7CWJXRIEjhNWV7IMfqDXiJYmqGqYqtXYAwcmzYY0K/IQhi Nro5KgLp4ZfIDEt5v5VLgQzOPDQZ7FJVuRAkqJ+LqnMJ2lggM6abhkpjg7RdW04XYiBBtetQ rTW8ZR7O1EqaOFel0eLR+dVlGlIFNs+w3BKdFqT9FTGyuAT19cvtcA5NyhQfqVnFwRUEhtIS C8ZltYRysmt55uU+4SGNkXLII7iQwkYKOMwqZh0BDtpgRVClCJBoYSjLtFi1qGgwgkSsDWGG XJFSJRhhAUMqZs+2sqluuUnNAtnyZURED5UTKEurzYePUgWlgooAEbfCVAiZEisQMFXpK0Ns 3CwlbolAFldfXpPF6MINZ+5Ng9PGGLE2lhmNTm21DDDyRZknMWKBoVqxjyDrcJyAA0xXbmio D57glrFTIT1Rh0AJX9xhglG8XD1HQyAgkVfqLK/hUFEuO0jhFaQW5XYSFuVVRsGH0UfrRSGK TAPNkmvwcKjBe6ISMdYWW2OpNZYZ/sQjFBp+F4jAqLWCjdMUqJOgPPR5aJJkVxkXb6wqaIlA psrKBqJ+tM2xd7r++fYkGwrn77ZX2xrFCm+21jC5qM4w/xVCSYeXLWcwx/sozF5U+VD0LoWh CA7jFv5LwgM9h7l2XFyD9/iC2oDGlAqH5Q3iJlgjxJ5D2YE0izSV/JcP3waIJplg9LCmuAip MWgTwsyXwAZvRJnv1ENrAYhftFEWVRVWAhFB0cPERSuBbZ1fr7V+RUSyaUL88Hi9ovB4yLiQ 6mJcda7RuQKZy1Bds0qVxt8+c+/Uk5I3cAN5hpk6epcR2rR8eRP5AaT8By99o1R1qfSuO1OJ VtgKaT3zO+LVpUuX4WpBMlqi2QFMnmK8b/wgmIJH5MpJlYFNUhJcKUNtkjvGpwV6Q2EOObuA EBleS8BJAM6WGMMCK4QGPVQpjZtMhQIi33CZ0bJlCW6usN7ISY9iOMferdaKkEW+xbbwbGQL Ebc1h88gtlpOBxRJpiFKD+wWA4qvx1euQFaeK9S/5bHHubgtOqy0ckNDw9JlS5YuWdLQ2CF6 q5sramIZm4YaGlftuMqiRYtMCGuqa2hsWG4zBZVpiJKOqtucpKQN4zy/hX3VBB5cT+jh74fp lg3mvjLERBEBnEYbKsi4LmYoat7Cs9ywGvLGRhIU/++TsFpp5lQoWkhQMsoLK/1vaAhGNq6a uEY1/zWEhRK4f+LX35iFTZzt3WVsK4SzMIoZafajiikG92KI90SLQHbMekmZ0SL2SWQP2SOS tWABQ+8cUvTUOfW5QE9mIk8emkTGaiExQJvZjIGsiuaKKG5B6Snmtrco2wxz6aXoepY0QbDc bLbXFNqcYZjrmgyyiqvU/yrJtV2R1QXiSkuQ79oXwAQvI9JO7dv+ZvJe+qV0eVvncqkyiBrt VJqNWKa/NnCp5F/ItXz5MgkrcaMVg3CRbzUG4hM1qmqtjUYxk6NxaK3QW0XmRJLJFwYGqg1d QMtXPIZKnT0HHAUGEW3PENjqILZaXEBvPWPuWw6RJgDVbmMti9abkuoLhVuS2CnkUfIIRVgb QVIQ6rRan7pFyhgj9rSBQKYO4c62f8mXEceYVJa/4WFDlMoA/MVfWreUqCdYvVwJ18D0vAha CsoSkesUIjzhNXbqywXlFo6aVK6sqvF5jUVugDHxKBh3cTkaOnTo0LgS6dWSxYu56+NcoUE2 4GkB73E1zTA0WHSmRqJYSJL+HfatNF2Ch8oCwVXl9kEiGPsJkZlKQnbzzf+AJzpKdQVYeoOI AyFvQG6lmUiqN6K0HQwuNeGdW8KMUgv0rljHUaZVQiUqQo6AMedXNld2bU4VzUFW64FMHWcA k9Obfxb07gffOTKWDK+o4VFRBrYVgQjb5QI4JJLvAOnIDusdlAXT6H261LKoioiPFFIZi1bE G1GUJYHANcbC0rtMXzM5AnvHljWZGX7byflGKx/h8iwAaZicI7ioDkbkRBGRkvJLVBIVIF1d ArsYFWFsMB9TqaK01mMRApAhYEHzJzCB15HmiVHxPgCLCrd14h0yVTPLa9ZPaCSzkKFo+Q5L Kk3UBeEsKlBpFBBiLWYBMUVZxK1VVySQldDclmmB1wPyKeVKaEMkhMGHJGaULeBcdKELL12E 0dOlEgUfsnhU+YtGl6Rj+XlahNJtWQG2m8XQby+IyaQwnvPSZSTCBi7VtDgDGOOTmKCCDUZ9 IQRE8JYrZDeSpNZCJv2xHyNb8DElCQgoDXtQY3j1EGRYJUaZSgejtBFACYTYWBYeJkiaPxBM BXdYuhSvhhXhtxiTgi6odg2NEYeyqvFdhnDXtgpNKBLIypNeRfvEgDJ8pIzGGP6HIkxSF7Mv rDSE5pAvi+XkcIdVQqZn5VdM6UDMqHQRbpiI3+DpfGXUaMsCwFoZ+ISIxYFL7Oy3BDLm8cvQ AovIFN5Aly24cLwW5XECIdOzEASXtJBDGURRXhUCIBLkbPBGFAIiBiSmeK4BrkCFlUDtCQCj wOyZNdtZcKz1s3JZwBCiNGhdUFcoAanMKKNfUrJCA32Smi4nB7LabIz4mnNJ5ll6bga5DEG/ N6IKt4UINgQR4bDYmkJ1qLiAsVJDdHDTaNFWJpw8drWNG9ZQc/sWFaFS5R5ODmf5pai4ZMA1 WPuqCWI2kAX9SPyZbElxsVCIlmyj1RILFGgVn6zJYoVGzy5LQVCE3yUJKkBBHFYEfFIUz0QE FCg9tF+0Eow0FR6osMHSULt/vaLcdnLNVMOi7MIQCFF7w1vNaHKOkMygXNghKYBFCQqkxaA0 UZ55xcSY+uRAloczTlOG+rgQF5PWTpemKCzDHCMq6HUBRzD80RslFARlckPsrVKhSYbdBFUJ rOjBpohIU8FOBlmvCk0q/p0Vzopzp1FELLNEYARphpFpbGXh4z6XuGAnMI3EmLo4RzHFBRGl 8zqyEWOuXIgJgQSZUpVQEfLGv0NppiaAradjQsLKQATFINQZyCIDCgPHuAOuhC/hKoEhQUYr oIJAVpt2x64Hl9TgSvV1EMsMW+HiZvTEgnz2ORXoCl03MpyIXzXuqAJtUO0mWazrmQjG7wWZ jVSB70FQamxshMHb9RbXoBi4VEJ4vxbaqGTlA8Y6a2HBD0ZYto7s2kRjlAVlgUesEy0+RFhO pRQ5NN84IcUkiC2zXDFDJpQWmWiIIAMlaWRqg8jXokqMY7QqG0gTmMalzXE1urDHKC1KI9D2 ihnCm0bsSa5iUTWqPUWFVzMjK6qsDAJtEkBi6p5DZtAFY7lXEVajmnjEl3WnWpLNFiiz3csI EOroBTEl4pdswwrFmS0ITU3LlvnvjQjrk7/DMOjWRpW5Nblht7HSIhejYhKRWlsekCGTqnjb AodnKovKNDKimEzm9EoRYs8mUDrFdJ4cNSInB2FAIj6RAaagkBB3lFap5DhNqapVVKsD1Qlk cY9UpWHuncH92tDYyJkjj/DApOArJ1MgWKglRkjCk0ul5Q7yI1dh1DvU2B3tBgvMoc0xmZqd K3eSLK1MA6LS06hy4At2KLFJduwufDqGXeHVmpYB4ibFMbktgTW8G3Lz5CMMEvRNe2+yzZZb r7vOusL1/n/ff/6lF16b9Xo+IclU2VdXa03bgsFD8TZCIW4UUvGLYDBCZSYbVKvYDrVm9/AR xx48aDDuumjsuZMnP2IvEFuc8TPJkf3kcGVyo5KwSThzT6QpKTKoTGNz8EF8dOKXVoZzZwFi 1133HDVqNIWxY8+dMgVXpB/2Nrzn3n+kU5iad955+8UXX7j33rtmz3qNot67iVzG42yvr29c eeUORFibKiYStgBSLE29KGJBdrXMSkKZ0uoIOluUqIMBMmHbpPcmJx134uabbR73xdvvvH33 PXffdd9f4lVVx6g92ZKvvOTKLTbb/OVXX/nZST8TSrfxLpwtpwVqPWMSrwtIPhVlZIlym695 tMprWJquNdbovs02fah9/vmZn372SRpZUTwNzK80UZo7NRYSONNuFtViblx//Q347L33Pjfd fP2kSTehXPyZGJ2J5ouXLO/Aw0Q8/7i8rvkCmdt87HGLocci3znvgQhP2FIPWXZRbLDn+n59 +o0ZPaZjx46J0jZYf4Pjjzm+z7f6/Pb8MxMJirY3zpXI4qb2EOTxktAkSosrrXFMRYGsZdoW 5i4JM+hpBhDFNJeZnJ3LpIkQfJibuXeJ1kSGhTE5rXV/fPLJJ5MnPxozp65z5y79+u3QvXt3 qoYNPer99957LPRMEG1j9z5DYOIKIcy2tOQGlcxQJIoF9nlic8+cxpoX91ExDKpFSgjUd1+j u0axKVOnTJ465ZHJQV6854A9Buyy66677IpUzseOOPqqa68upqFQ7zUzrKhCK+bMmY00OYdi 28a3Nj7unDYQyNRoBbK9npMsW4itRRIf471wAiL6h45RokRZM1x0neysK4AuZpByZphUhMZR 8cknH1173VVpok479cxdbNfaa+99NZAlEhO87Joqzx4xb5ccLhy1iTKSkfm5PEp1ggIoEBoX k6w1BeupSKHy0VadYT1q6FGSi91x1x1enCKi8Rk2ZOhRw46EcvCgwZPuuv2TT8sfH/hGlFse O+535bJG+MrzeXkOjyhOKtgdmEkV2TisaSaDsvUWrU2zKgg1+D76kWm3lDN9Wd6zwWAwc4LO VKvkQhQr70oXbWNRAoaK8olTnn/Bb7/6agH4LTbfkujMEadxMKbWOiHYuEBZPw6ZDypNIqDU 1HIk0ghSKT0gXiuiXLI4jVtbHiwX1J7NcJzPDv12QBRZsBfFVP5Nk26eMXOGFAf0/67ixbw0 s+N4ub2ao1FqUpsGaj8j426p79Nn+67dus398sunZ07H3T8aMqx3703WXHNN4Dlz5txz712z 7Ow1l1lmxzbdNJh2VSA+wBwwYM/t+vTr2bMnQj766KNZs15/8KH7P7V/MM1txMt/li9fffUe 227bh3ni559/5tNPP4Zll10GoHfixOtmzpzeZ7sdunbFqi+emvEkycuPhhzuWsWculhl73sk Fo41Vu++99779e4VNGHBggWzZ8969NGHZs02c/BVPExvoweY9hSOt99+a7PNtiCPMC8DY8+a RGHbUYQo0TOffPapisDyDdbfkOLb77yF3xSvAFdh222+TfE54zdykCCho+E/GDSkV6/enTt1 ovb5F56fPuNJc02tnWqmZe8D7rnnZ5LCbNx70z1332vrrbfhqixYMP/Z5569xU7wQS/tY3xn 1dU/a+nVDABoqP2WNebZ55+JJ0TU/nDQodakztak56Y9Ne0pe5upPa5ANIZ6DVqG6h998rFL 48HPPPds3z59QeqCpkewx4A9+vXp26tnL/AffvThG7Pe+NtDf4ub2q/P9qt16/bll19inpi9 zdbbzp4z+y/33rXB+hvhjDffefv1pMsBcR/rgZnWA9v36bdat9W++PKL6TOf8iyB8tBBP+xt LpDxBsKJwv8IB8vW2wUOj/i5F4zr4jILDBYSIYm+9SgzinEheQNZhYozbMpTdfjhw+l7r776 MsQnnniK3D3CCN7MXt90/a325tbZMakdZBdAgQlkdFv6LAf95NdnnA2j0HAGZsA1ePCQ62+4 9r777zKZ2LLlHTt27rvdDieddAoErBv26dMPRcLStdtqAIcPO8pa9crKq6xy3M9+gVip5RxY Fc6pKx6AKDz4kCEdO5qerEefPn0x9cEHHxh3+VhF5gEkVGVTptF4i6RcYppwRpZn7hZFO+3Y f9jQI4GnTp1y7vljWPc3eLm5DFR3+NDh4qvjTxj56WdBJ6fhP4w2HC/9YNDgp2fOuPiS8+VP iOWu23abPqfY5doLxp7LH5v/Cd0utdv16bvH7nuecvrJdHVsRi1x6jRLf97Ycx8Ne50Qc6b2 9JTaoUOGHTqYa1GYp2fl8ZBBg+m9Yy+5wDVJpEkTbb6r4g2w4QYb0qvjoUeI7n/ob++9/x7w W++8JRg9w3X2GWe5y53ATKgNGTzkmhuu+Uu41im9b/jhw6l95dVXYP/ViaO0F+y0Q/8j7eiV STpZUvB664ihR+1jfTjyhKMxEjmyaukFnYP3P+gnR/7E8waMhxx8yG/O+Y3XOobMGOkRM3zG dRdccqFHrO1tPiBvIGs+C/JL7t59zdFmeagT2wimTXsCRv5K0xkAhg07atq0/0gGlChQexl9 9fzzLmHxDjK60JzZswB69upN90Dysccc37VLl1tvnQiSd/sR0UTawQcP3swurqOapIAsTAV2 79HjV788nSsqVjFY22orrDIpIXPq0578zxs2z5Iut/9+g0CKzJkzZ5CIAZMObL45KVInOv/8 +fMyZriEsewzNtN88dir9Ae93y1AunRe6BnXNoJs4JmuXeSvxa2TJg4+5FCQW2yxVRDFQptE JKsKIIyQWa/ZtM+Eb2k4o7CnnppGM3XxAc9fcN4lp51+UjxwDD3scK7UV1999dSM6R9++AEs A3b9Hq5mKfDYkcefff4YtGgjBHaLYATpAVIkih1h+z8mkUpgUpfOXba36yEkUBedd/Go009W k3CdXHF3shAMuyswplPHjqeddMqE6/6QuGuMXs1kmRjmmkcUu/i838GOPfT/WfZmIBtCO21k rbNrl6432z/PYrCcO3Xq9Fu7SIpb3nr7LZImaCSmbLXFVkIjpiqXjH9RkWiekBHF0AiM2Okz pn/w4Qd4A0bCJdHzrDPO0r0a0BDFJHSK6+ZZ1wkxxtOok0//ZQvHsrYVyEzKo8mXXICfjDhW 0q7dd9+LQMbWsymTH9l1gLMDa/Ij5rqGd9BJJ51m+8aCc84dIwNVuUU37r3ZKaPOoIqY+OS0 x99441UmueWnNOAmMBGnLhx7TjxWcju6VjWwQb+uacTwY9QqCWRyb/Xvv4uYfcavRzE4FZgz QeTSS6/mphkwYPfmC2T4YOTIE0Tpk08+rtoFUM+ce94Y17bevTYdJZ6xcVnGvzNmPEUOi8Hb 9dleiEMH1zHilmTh+eeeESQzAxLFpk6dwiRdQW9T3Qh7+XD70SNPOO98p8oSgcftJF8aUCbe fN24S8cjv1/f7VWOqlZMGgClXAiGaRLF/jV1ypk2IMIickaOOIakjPjyszBWBtKkujAFatDs EZP+TweeMO5q4toT05545bVXZRAXMKZ8nXrSKWghcIw5d8xTziiPXWmjR42mimDxn2mPe6NF CXx33nXH1deORzDN4UPoIY/DLQwbybOkjdRiMhi5HIxwPUOkQSC5h8nFALBfYxC14AlhBDI+ /axkaBCoCeCY6J6SY0YcTVKGhcePPM6r8lS7FnpV5RX9yX6sT/yUJ73qXHfddYckBSr52muv ktlr8hqxXKvigJ39MbMVThSjZPjemPXaBWPPEZYDBv7APjBknogUDH95SBniUUxqXasYlcKl VpHrCY2cyT4A6M9upADDZjfZMyH3nMuSBjOeSxwzkreyqTj+OfW0M2+7/V5ZssSA226baFpn n1Kk/QN23ZPMC11eFAND5BobembgwEFgoJ86dbIYNmDXPTxL9tlnIFVclFtvu0mm5w4fNhwM CZpGMdwqn2uuvQpjqMUwd2wuwnH7qdFMjYj22ORHqSVnIRjFr7hg9Cxy4uejDjcmkaRIFHPl TLh2PNGN2u8SGuxfqeAmwGbbHiUGuPu+v7BeqfLpw/Tk0aNOv33ipBuvvn7UCb88fMjQHmt0 h9I7mBcj9oH0ohgYIte5Y88V+oMHDorzulFMyNj2IcAeA3YXQM8H7Gsux4KvvmLZQZEewLwY /gR5xdVXuJkU8KVXXCrEktYBMzLljOvioWr8tVczvKXWRFVnpkUkNM9Z7qPKNsQ2j2VRqdHL yH3vVkulzF6TcrtVLixktJgJF/CMKMNczKWqI04xDcfIq2fPnlQwrtQ7mCijSUGExxZcq2Bx rZJZbWW50N6g78bmSpSgcoBQqDODidIIHOef/xv2iDntq2MGEGJizTMzp4v9Lu/s2QXPSC1P GowYcTS6ZBTpEvfta0SRsgmSZFMGs3fceatLpvC/pk6W8Mr8pn2WQ2vqiFnW7RGLXn3NTBJx dOvWTYBSz0QWUgy4br9jkojmrBcO/JSpk4liAKwhFCbd7KhSbgm9MaCh9z706MODBh4sYysw chDUJHti3HffA/dBFtaYb2b3ORMO3FxMCYhlzIVhpKwAKB6ADI5cTA2QoS7z8UePGMnlwAat Ei5JXRmbu0I8eHcb/jDGmzWDDEuITWutuRYjTYqEJ3HdrXdM8hSJTEIqUQz429t8W7bURS6e EDlnEZJNEyN3ECFYc48ohYa534HHZLLfrSgV3mqrrWFZMH/+9wbsmcjL8iW9TjqeS6Cdx0UK 7Fllp4TCZYUYtSyeupeNYVe3rquxurrPPvvFyBMQiVlYAl06iqhx2mlnXXjhGJdEPDN//nye i3LxCvueaapjqotJPToPTdAEc7/9BzF3BtffHrhHePv3HyAAzSTvEzixD2y26eZeIHuNmCUx RtiqdN6lv+lpHITC3QbsAeBeEVsTnDBJ1+ygSjQbUnr7ReN+B8CoUB633HbrbVkBkDSHM2na TjvsdOTRR6nwre2tiMNJzRTpAh999CEhQ6KGi2deTIoSwtQkpvmYmDexLBwDQjZo/4OYvwO4 52/3ukJcmNjEAUYm6QA8b5wZjB9NOrpruIOEdU92/LpyPHjzTTeTQObhm6lY63NkXCfPrZU4 gjkX2OnJkgJkiNL7I4MmpcraK1PcSRRkKGxBYJliA3Ojp2WRCCnTBALryScdG2h2fLe63fNx iF03pPmHHjrstttuUgPze0ZZ2F8iS5O7DthDA9m3vmWeDGNIqJh1woeo5VkLZU8EvDZTlO6a SFwq0kozTLoNQtY6i8qxVhVc6RnpshPR+CiG6aSB+w6UDIXsjCkk8jIRJMkaVVKrLHmARLfc de/dsjRJeqWJFY9GIZDLoZi4fFInQTK1F6/1MOo6hs9eVesWG2yH0UvcusY0r/bCndhsegr7 Swuj0ogyFu/+MOFGhn4kfRrFuM8Y7slUkVCXYWpBdURhofDZZ5/wfOWdd04SVO/eG8NSlKvA H4NYkXznnbdBu6PLvnZcmfiMVExAG0KUcUFM6wgfTCSdO/Y8aSpJWXltjoXOBHtenfU6U/XI 39EuGYsiGVc+amcVy1NtuSqKDxUxFzMaR9hPU01nZHK5nKto8hynWKyVKfXMzcuslopitkhe rWPmxVJiUIowHy2hIVEGy3+694Kw9eyzM999723NXFi/U1nRlTGDThvVaCRSwFKrJB948MH7 h9r9Hz16rNXY2Eg1+36VCM9cl/54k5Ip8M9HHx467CgGJjK6HDJkmERnNvcqjQIDD9hDHV6F qxjKRWZBbIjM+b33wD2VMhQiN12AtsgCBidze+hNyC6E/jv1h/S6idfFUx5lY5bt8MOGyZSZ IkUBCwWy+EjRqwossF8ZVdSHltc9/OgjPA7F5ZC1S8yTcSVTeK40gbNlxuk9zJ4Dvw9GVXu1 LV8kI9MDq2rHMLXKBcw4Qy+AAbQgVF7RYZWVNckgdCVRycPoU3nzbSA0sTBB1AF2yQ+j2HvB +h07bzWKGUsTOJwGJIGBMltldOY4yMuUapk5gigmnmHlV2vzADwLIWSMLgG22dYMUlgxcB9R +O9/3xcagp0A5Z1pnnxKZWeey2PhTWGC6dtn+zSxid70nNylSxeZxtIVPU+RFnl4Q2EBJHti 15iHTyu69qjNXDwXz85bYZe1y29v+y2KTOFnbB+DQLfpMquVqJ3VYfvsgbl86jpiJUXtQYmM LYl0A1lL6i1Tl40QwbUzewcAS/Hlm2/OQfEWm5s9tHI3qB1sm+A456yLLrvkKvamKT4PgAnm E1hiwksiV8+ePcEzh+XGL0Nt6JtKDSKI0vhrTHcSq0TtMaR5G+2yZUsFL55hX26MLECcffbv Lr74quHDI5757FPmwmZAwVrB6jwHY1fieCzJFfLSS89LsV/fHV28wvvvP+jSS67i07v3poqs IhAPFi+EJrkBSO4HOR+4/0G8tOuKS65k8j7DEubXpZap/Qwyqpj458wcgpLNsbfilptvqRgP uPCci6645KqjRxzj4aUo95q565wPuyUIWxCwksAUvmzviG8f8wQyqSeG4SiR5hHweg8ejWAb B7UvJrnOpWd54apLruTDayZdfHXhuJ01HcgkicdoPSysiDB0aDVAvIlOrex+YvhDqIoR1v/0 Jz/bbru+zF7NmzfXYSoLVBtj3J3sU2yKJhhx9Omzg0QBxecHjCoemzS/5VraIaqFRz3jhSqp BYl5eGb+/LneX4DHH58KDWsFgwYNAWD7mLzpTBg5k53Jwi57fVnoULwA7B0bcuhhSGb7G1v5 vNqcRR4/FMp48kU2IXv3XFF0XXnQZ7cBu9Ph3Sr+onRfY43DDj2MVKtH9x7uzL1LJjcPOyck BEDMRL4g9az0vz3tt7J8+eLLL1qkiZbs8AAGf8yIY4RF6QGIX4QhxM6bN48iDNDkOabay8Ew dsigH0KfvX1MBUpERiO7XhUpwNEjjhbjeQIUjLqOJYWY68zmDFzH809rdu+RnQZ6Wiov1nQg C/JmLmN40Pekz9JtjenFLu/ee+/LLn8+xEQ+7H6QTsV0u6RdIoDu9NMRx/LcHyIZZHl7bkPl lX6/8ILJTejzI5y8hr5NcfTpYyqR7rlB0orEc5oW9oWpZ9xYxlonRdwFI57xghTI+++7SzYk y/YR3T7mKGq6++47KTJ3w8NhTBRqFfuTwYAHM+m2WxRfKjBj5nR2V8G13z77M1pUdrZW/Gb0 GC0C4Cj5/PnuOyiimkeRSLsUzxjqd+ddLCb9KYdJt4Q0bLAgiTto/4O0eyN26JChIGVdEgv/ OOmPagy7OiSY8hSBm3bBThEklAw/efxIbn85C7tcWRXlAryKluAFBldw9raPaTNdFuDrbr5e HHjc0ce5sQz7aRcExGt9WOrO0HU8iiSuE2nsxrjkvN+J69QtqijDZqVJB4Tb9YFPW9OT/b6x /GnSvdXUOfNlHiUvhqV3kXmRR0imo2+/OOecX8sThXRO+h6baeElIxAJcI2/+nJPWrWKd901 CY1YhWrSE14cRnYm+x7Qy0S7xIurx9/46D8fdkMG9x9H1mUs3USaTJByp8yKembChGTPELx2 2WVXmebX7WNikbW5nhefrbveeix00NjLx00gIPK8KimY3PRQTp065d777tJGlNHSvz1wH3+H yB3OP+dC+j9zUuRTIv/vDz4gj52LG0ULE/DrrftNnlIieRk/boLHAg2b+/9y390uC8j4XhCe 6+aJSHlkR+bL5IklbYsAhAl28L8eTTl/c86vCZoYQNgi7sgGMYQoy5VXXwGMDeJGT2ZakeBF 6Cy6fcxlZ9cxz6hjOcZcGHMglBOc3byEYFxHkyGWp7LmL1hACqZXkw20LfNqb7cJ8YwMp8nH JasVOLix1MaopYrmiZ87wn0GnulUnX76SfQc8PQ9+rNGMVKSUaecyAQWWuTj8VZYRDUPAMlg hKuOXoliGHPKKSdee914SW1Adunc1dVFu3QGzgBqn8DURv3g8nowhDKrBX7o0BHqMYBsz2Ah j0MYepvbumcNXjTNnf5zVZPkXjX+cmk7DaTtct9LBD839pSlyyuwNtqtUuQfrh1PwJIqOhjh APmEjyvHX/608xij0gPwLiBqxSRlQQJcPAN0Fm/1sLdBXJ2LAb550s2nnHGKpFdeFUXkszR5 5MgjePeOqx2Y8PGr00+Wx6EIwRIHRQLSTjrlF/I2IXzuGmKLQpV81r2vqI6vpSbz1NURkc8b e17cG2BOPeOUwuMNlp/s7HLHdYwl5WqSDNLYtJd6p6muCr7+gP13SxGEq1v5KHrNPPvoXe7B qE3e3P8Or82KveqrV69Nd9xh5y5dTMiYN2/uk5kvz3DFKhzV5t5sZI5KlQAwvS0bCz29zHbv sfteMPyDd5Px3oiQlQE1oF0TCFFp38qTRpADz+hvhx13lmA6b/5cXuAR9x5ivB0hnvNFj3UD P0QV/L2kCWzu15ksnpeQrfy+t7zJz8Q14KSG8D443mnDYiKVrJbec9/drmTgRPcwAsUkocSk f9oXAbmMSAuLgYCwGDGCUeF3+39Xt4zOmzfvpVdekmAkdInaqWKAtnNoNlzug+JWUcHTiXoj RiQV0vQm4hlcb2aXL6ll7sy1X2SrDeSnEOtaJ/tpi27lT9SI2DR82BrVGSCUHqBDHZvImlbk QBZ6Ifnb+Mb3TzJlIlZdWah1UNmBrMAil9C+xBFkMPueaFXwY1+srZo3UFs+gaM5tWODr8Ut VwMudC9HWjycEbz05+/M0qptXWITVQyRT2EDZFNHSC11lFvqCzIs5JFIbYHG6PRIClZA5lKq fp9BKxyAS5z4BymRN7Qq8HSiUkd2KpgoHOo0vLQvrVatUn35DUuTmYYPVfgalB5AAlntzpH5 todtqua3+KMampDkiqEn5oplhsy8xLFTpy7c4osXL1qyZHFjYwfvXjfCrbiGhsbOnTsuXLiQ iMBqR8fOqyxatCjYeCFtqaZ3fFmJkcsj8mjUJ2Y87FgooNb6Qryy49vg9WcpnPEwiiTjPdZ1 M9M6oXEMLFigqoRGKly4QFpVSPQST9WAqopPFZboBKV2jRE4m14ZywVche4d5Mur3UDmW1oD 5bRrJni543C8253c6xDmGUQvGmNrDLVpGPu5zN/qcC+YFcgpCIaWJGj/kiVL+SEBy9+0dGnh 1Y9Btf0ynG65NWA1QJxTuAeDsrHJAQMTQ67wW9CRGBhQJrIX6qKQKlJA61WTVGkiRlGrlFiQ ela8B4SiPLQp8guh0hqhcSkUg15RrcZAFjfG5fVgFeXhpZhem1dJ2YYl2lMVZHsgq8iN6fdE glgblsxdGumYpiC/VGRen2/fgxbexjEZJF9Lly4xP0huD/azxkgMIu/9mMhcJaR6piRjlCvb igJZ3tQ3W15yrWpxmwCSolS5eBGhLBSF0hMdufRenVsMFcRVuFS1AKuFbtvjhmXXxulLxXRI +LOIDLWuVHmtSh/kRM3tM9vGcpUYvqh3zcyYeR2jiA3TNinGz8FA0lbwMu44gYcp186ImDKH N1Y3J5OC2ijuGRP1Q0SjFiIscQb54xAhUtYAiDP5FMXKnniKlcj0pHnKVbK70QhkNpcnJK2Y LsSoTa8N5IW2mXs0hNNUtSDe2t2ekeX1eNHLLIKErNTL7E2K5bWpLdARamykTnBJTpfWbCvz XOt4G8Hgizg+4iA7eBNMBN/KvgisxqRasy0lkBmDxdSow1vQqShuIW3axNz6lCPrvrINaLlW ZJlSZl1piViKU4hiZapXttzXRTlKBtTG0nVlsyIvkSCuJ4opzfclt9dhUPMcnA9a23yTxOA8 7L44p5zCHnWG40OHNQKmBLIITWsWaKffplLMqZA9QZU4vhKbYkJVWMpFjTG0MQTta4WWqVfT vOURuBPYaSw58THJhi/bBcpigQKt4nOq9sgKgiIVpUlN9ExpIiLam6VQNJClGZziomYxMlOo GGLHLwEdGDueMUU7h5LJ3yyVxgQE268ALuihxsyLgWijI8q0oWKhiTGoTbc31poSEOYyRw+J C7J0TU2sg8U5ovzNXDJ3Z6jC2qalEMvaqwUTKgokZUMxf+STVDSQRcXEbS9Tb1RsjhJ93v29 DOkYBb6oYUG3oZp4kRLLlKPQAkEVygXxFUIIVqmYw45WjngUExo1rKjSRCFFuTII/MFDlFS8 Ci7Qm89Qe+HqG2MvcYzKLrPk7nRJFaGuT6XIW1GGJGXBW6HDzB1p8SHC6ldKsUacDIWHT7Q1 IiiRIkAGwjLopQo6AIVVJPg89ig9QIYulywRzs9bYiBL1NZsSJqhXpNepH0pWacwsAQYBgnj iMrnaORiRKyx+tW4qDUaDtxuptzShNDAKGeJpaoIyakz0GWtL0mvbCixO0XM1WgTR8qFrcj2 DJlUxV1TkpMrsizG7Jhq7mUpOsgYQw0gyg5k0q5wW0yLtNIGKOuz8LLLd0F5kLXT2yLRq0BQ rsfNtnD2eFl9ofIisgxZuJvcM0AbEjWziMDKq6VvhK7J2Y5ArZiKhFBICexm45sdjbRweyv3 WDNJ8O4HtMQxzaQ6v1jpTGKYa14JFz5dWbaQ7FpXKoaJbWUHMldaM8I0yXFirCPY5MdptgOW bZTIcLRaSWH3d8WqNp/YEAkOEoCYyFhDXLGlwmqGw5iEM0NChyQCahYZwcYK8DcxLo7hsxF2 z282SUptkmMhdVPdOGcKU0CYXRuX1pwYsaWIO4tUF7Ev0tw8omCATNgizEUUtU41pkqjqhTI 1EPN0HSRrYIpCmz7kyoO/KhkZfhVJStvIF0qfFVKFQH8Pmb/rgUGq+UhRyXWhjJa+lvckMfy fA5raftbTJ/bfNzlFhNtyOPSRMYqIsUGew7+tJVtVdH2xs0ug0WFRN+doOi8AM2UT16GyunU s0yZmk9oQbIdFpsz3cC2ZFciJKwIv/12EL/k41dEy7CLBLV2O/Mu5sJLTaPkLVfq1XtT3qOr +sS8jLNS1g6g1pZkEn9o5JOfSy5i0bMrUC66i3HgwPDwDgpuJYcgG9R2JwLZvEGtmhcC4Xcu 7tKIEJ0kXY0vQZorp0oZWQnaq02KB6pxmGBnHeN6pyDYanGrIpmXW1HgyYKEg3c9nzJq9E03 Xe+9j5DQ1q9f8FMd/G7N449P5iV8ieKQIK/34sVhT6a8OEwYeREYv2cOPG/+vGlPPh5/xRg/ oAvBtddeVVBkkl71r4UpuYi6uoyXlykhAiHb3b5qDZg3hZkWOb/nVNDoQfV18uPkvPI3F32U XV5IN/fLL3glZLSmUDKvMNuxf5fO5hVmvIzsMfsyssTr+T372jLIeGXYE9Mef8P5IV4Rp1zy grM8lMKojlIAvEhzMUKc86zG5KQXMqvOsIresrWXpLQ8YmmgNrP+gIG7lScoyqUCo+iKPVGx gII9kdBTQFtI1Wg7FONQaiW4LGkOi4BGWJLAiTfeTs3hR5jfiZCDXw/49Rln60trBclrVO+4 Y5L3SwIEu6OPPl7eMRty1z344AO/HzdWiwLkoaRpp512Zt++/XgTLO909CQkFjH1pJNOi/9m CjaMu7xgA9EkkYxXe19b7Dc0+TUDef332LHnTpn8iJqR6Py4g/ffb9CxxxzPi39P1J9ej14H frdBfqhBJfNC1IsvHesFPhx4zNHH8RZZJQPghbSXjbvIxWAAvxiQSHlpjNJjTCoGt1u8XS5x tEGFGvdeLWAzIauoMHoppjdZVpreNLzYn14b0eKRUeTTWN/UWNfUuMVmPb3qCGveQjVk5NVV Jp00O/hLF8ooXLcQk/gd8Lp1FbeYXtS37/b89PfzLzyrgi+79OpevTamyPuvn3pqGj8p8I1v rN6t22rf/vZ2vLZMKQkiZ465YJ111iHGkYhB2djY0L17j4033mTNHms/8YT5ZSM5simffGKq Nu2999498MAfbLzxpn//+332JjY/kGfXByAxL3H01gowVQLu0zNn/OfxqS+//OJaa63dqVMn bNhoo97/+tc/xYDRo8+WYMcrtvnJJWkRZFtuuVXHjp2ffjr4RbXAXOeL38EcftRPV1ppJXB4 4603Z2tlYHP0EgjSPR9z9An45JNPPqZFHi9k7s/NPPzIQxi23nrf7Nat23f6f3f6U09+/tmn Ior3vp415nzr6q9w9XTj6kbEbrLxJmvh6ienkrbKx6Fc8ISlbGhs4KcDoJSLorZhjMIAlNyi xQQEarYHePTxokfvFuPEqjFMBBP/7LoyUmERFa9Owwtldq1KSyTDd0yQNfPQUjSXF9vV/KoC aZELS9PMTHRfyUZFXUF84YdICEP6G7cI/NGQYZJh8Xr7+8If44CSnxoCP3jwEE3KfjBoCG9J h/3cc8do+kBkHDRo8N577zN58j8UWaA8bwxRg/1c3bp9Y9jQ4QcccLChnPKohhJ+jY3khdi0 3/6D0N7Y0GG11brMnz/fhLO6+i5dOn614Ktl8r6N+qip9we/G3LNdVedfuqZ/BAJH4aE/OAL Z4liN918vf6cCjma/v5LWlIGzdEjj5cfNElztXcpzeWzTmYYu+WW2+y5516a2MYvrvgfDkLk eReMERU33XzdZZeOx7Ejho8cfcav5CWOhww6NMPVj01JcPU54UXBJAmX/PoJg1a9KGl3lN6B rsEuLHZW/Sx67Vxh1WVnCUzzQxaPW+fwVzjZ70ptqzDeEIcIED83R8OGDR1BL+X3h9zJr512 6o+ud955W6MYRQj+es/dANAzIybGEAQBpkyZPOMZ+4MgNgr/37VXEdrA77vvAcEf9Pr6fezP gkH59NPTJVTzEscbJ17DT2wYyn3Mr67alMIIfuKJxzkfeMDBnFlHkZc42p1j9iWOTqjfZhvz o+JEgfvDKEaR4+oJ48SGXXYZQLGP/Z1EWqRRDCSzXffYFgHLFBiAd4wceQKxW0R5VfEi/VBD AKPRceMmHHPM8RrFDH2YNEnqxJn4LlESgy23kfHpZx9Pnvwo5PwU5sbh78uqq91fpWEmUWzb b58D9IbZN7woOuNJ1TUh5f5clOiRvc4AL4d7jnKXUFILBRCxCovrMEYlqjMVkwHEhbvEWusi LWwc7ly3WL2D8IS4RURIMQhkbp0joR1sFg+QDuy6q+nn/7K/0urp4KfSPMzcucEP0Aqe3y6R TmhmpqM3nfys5BZbbGWXdJv23+8g+XVVcjTDa/pzPe+VXbp06YwZZv7bUJq7yb5ztq5O0kMi CLNCxC9evW32sprVYfOz5LIVVmyQX2ufNfv1qH4TpOQX9tZcc00oe/bsyXnatCeES89eixQv AHNb5HREijvvmORVJRbdu5dFD/JK+WTEwR122AlRjHb5QTxlB3j00YdExY477kxx4H6BqwMH OurV1YLDZrkok6cYV8MrB4BLKXg9A3ifkM985yRzWcqBxYKcQaUcBc3IIy5CQbWGlnI/q9io 6YL2bvkoSZsrybgmcda5aFv69x8Q3PTOBDZcL7zwPHkEH+KIDkPA8zPDnOmW8ptD66yzrqiY YSeY3KmrDz78gCqGQpyJZQXKYNkO2gZ5HeOHBUq7h8VeI7I/GV0OGLAHBhDvRBGxjDfTukFT otXLL79kCbi0hl+us/tT6hNvuq5b19X4FatATvgl66eUWI4MccE3A8MjjxxBgSj23vvvebWp Raub022TbuIjZBdffJXkZeC9u0+G8LNnz/IE6mKu+REpx4GaZAWNrKtTB0qr9ceT9MIJHvke peDjJoklUqvWppF5ZqcVRVparWqpwZc4ut5Q+wvOsRB9kG/ya45qBTLV1Q4U98AmG28KESHD I/3zXZPIFOhjo0ePeeCB+9kN0LVrt/79d2GkAyULl0Lfq1dvAMZrbgiTqtdee0WA7w1giuof sm4ApSA5wyKJFcIFOWDA96fYJELwc+bMofNvtdXWyqKADXhB6cSTj1W8PE0pRYaKEiMIymAK /T+kZvJr0KAhzOWBYOEyvqli1KgziPJTp05hNOpubQsFlPktfUCYWUYQgI0gLl6QEsq33nob qgquDtVq51dX02RmA5UyJCx8q6u5KI9F/3QViKIQqlWR1IidHlKZ4q1wuZTMBQqibDiQYgHp ktYwjMFisx/I1CPVb5KKFr9UX0EN+1tNs06QARe/z6xoAUiITjv9JDYrELmkqwueXGzc5ZdK Ogamc6dOnOMjUCHWM4EpkdIdIQqxi5k/fx5ICUYqCsClcfFuFV36+ONPBMMmBn5W3SPTvRSC 97ZfSIZ7/AmjUE3knWCmrtIP715KJ0ys6dp1NcEnjHCjtyWrq1AWdTU0+Sk1p/NjVdRWmhi1 xVTHkeV5QiVbwFs1idpR1VJ51gYt5ytqt2uaH8jcumaC1ZjyW9VMlrWU2A022BBVc2LjGpBH jzxB8i+CF8M3hml0bDKUE44/cb1119NVy7ItVeenSdD0wRveptELnjxr2NARLINSJIpdetmF 8VTLkyCT6LJqKXcC+ZdImHD15Z+lbAD2hNRIsahXPTvdmXWvyi16HUS0eEiXPies1lqgEMUU n1OOR5ZiWDlSVZQAngitdQ1IDWRQe/wuWztciQdkgiwu4ecnjGKSGzzZCqtdQsDPj58y6gzC 2bBhR5Xxc+hxLTkxXbsFaUtRenaNDD4kWARkSEgylRjFiFl8CHlMEcreCLJOBney7rn6Gt0l m6PtM5+ZXkhbVH14/w4Pd8lqDYPBk52hruJXMCCxV0sbQ98UaXGsRxeiWBHOmq9ODWRY3ryx LHxF5orjy/SLrfdZ7E6K8Eg+QizQKEY1++wvHHvO5eMmAB8wcNBlsY37ERFh4e3Y/HpY43/H Z+J9ivQyWRu7vWQcSjS5++47mS1KJzc1xLj77r+Lz4033M6iBNvZ7rc75hhQC9kaXgAAQABJ REFUE98ZVDL3tOuuwS4TXRMQYO7cL+KTbtnqyq796KOPPN60hR3fgenXOP9FQXWamMRw5hHr /ZYmR1NCVxqwJ8fzgBRd4YkEITIQlofeo9Gi+NwUi1mWFchCg1rzu9Ck1rSiJXTrHrH4ngxi mcxAy+Ta8+HiZtws7fnymFF+yrioohii2OjTxxB9GEve/7e/MuzVi6W8zJoBx5+UhJIdW2Rk BEFZdZI5Joo88qnsCsiMIU4gkLFDQifahYAAV7jR40aolBCYMuUR0YK7gEN08C0LnbLU+EIe V882T3RlUMrDsNDIRfHUFeuhHnmuYoZMQlgOD+XSUgtEtEWaU+uBrBacVXUb6PkkI53tg8pl CGc4JlyMOr2+sfZaa1NFhxeC/JRxM/xEI0rBJgmJYuRQLFAkjiXhkHgxngcVwn2zab3ozTlz ohpMSaYIAdDCjDsrqsCzZ7/GByDxkD6cpkVZEEjQ5JkqxQjAW0AEkFipDgSvOzOEQHjV1Tzb L/j4RfEohawlz9YnBZd4Yc4rtqRhVdRV3UCmPil4raitXsZuOFVMUebWJtBxsdeKbLs++eQj AplJr8RPtr0aOLbr008XKFVOsD4wZw4c/358Ms9CU7XH7nu5gYx9tn379gNPIiaMRSnJI1SF ANnpQ2CweZpqqORiRDHZU+rJkaLEC57flKI0l+tLVsD+BpAQSNXll4+NX3bGmBIKb7llYjx1 EkY5e/5HVKDLJXLgF198gUCGu1ZfvTv2mxqrXl7RwUqLPKPOWzqOsa4G7wYyZvrE1ThQzIYy flGoil8Ux4oqgEVbKuaFnSrilbCqYEakuoDOCUXk5RTlkfnFiEjfDJe4yCNKkLrUvqSyyiKz VLGl0pdlWgsxSfjo3t3sfdeDkCR/3tn0z6hN8QCnn3amrA/cc695qpFdGlOnTgHgmRiX8piR J0BGJ2Q/mrDnp4RePCx5IpbIZVK85/8tttiKKkaUabmYGDDN7umXFqkEohgT9jKC++c/HxbK qp8zu0DdvdaTuItnoVQ1+8tkLZVNfIJk8VRcDV53n1EFl+/qzwqU2RdF1VULoKXep6hkoS9K 1oYIcmVk3ILZt0UVG6yK9L5X4S1phiptDuCpGU8OGjSYpIw/7G4gmDjxOrbC0kPOOYc3ycyQ /RkDBuwOJWbwehzNv8ZPGEdGAOUZo8fwHCWvGNvR7qSF7PY7JhG/1GyPkm1isucWAnbYQun6 GVi2wmqmJrXuGUbGlWLSsKFH8VFdLkAoZCXxuuuuEnVnnz2W54FkJ70aAI3uwnd5qw5zU0kT VDKDU5ZHuQosE/MAAO1lACguJUl0N8GxCCt4htK4OuLAOye5l4/HNgNKe1FcSrkoOsWuZjQT IJ3Ia7LVxeMeiUcSbQJhCncCZSrK0yTFkuR6EkRT4+ab9UzVWX5Foq7c4uDmqcDc5OUTWkVG k/cpQ2Ip5v73v+/t8z8Dmd7m3RL6Zh50guctMez77969B4+88KIbPpCRZN1771/GX32Z2sUj 36+99urmm20BJa/NgYxX/UD2p1tv9vaaLbSUpD8e5a0hpZn7DT+Mg4444idoGT/+9599/qni C4C1YNttt5NnwtWeOPDJJx8/+OB9CP73v6dsvfW30M7zUtIiTIX+oQcfuPKKixcu/CrOqxhe BySKSIveemu24nMC//M/+6MXS/7+oHmNj3eJeO1Hx46dMQkazhtuuBGvDCK2/va3p5KImbGq /Xy10Lg6wYGTfFcbylcTKAsXBV97RuRsSbOTVWRW6KrCbZIhzqsKiiIido0S2+1JaLCv8ak/ MN+LFUsKmfnsCYxMk6zTT25j4sTSqjje5UqFPZcoXenivDkaleQBKvgndjMUadcZv/5lPN1l wpj5L+GNvyFWhUDAUy+yUjlv3lwe+XZzMa9x7rtkH3zwfkklPBrZfE/qZKzKfXhCEvkYl/Xt u6NQMoPOjFIwM+VQu+1y0LnAPLyJdvbqtSnPh3fmyUqe7n7qSd3eEb+grMAGrp4/Vx3oG2ft UFfPjV4U3ugWoXef+YpUmEJ2i7RWgZiAZEQKfdSwZNZUo3Iyi1SPWIqBt/OlrJ6EDvbFis0U yBJtTnZPimeTiX1s2PL4bedTVl7ONDSnASqDQeUfJtzI2PD4E0YWZpG1OtPaPFSRix0pBKIF 59XcYPd2nXDCyIxlwQzTPGlQ8gOjBmkSkXilLylPu3yesJzGC95V7MIBawpn9gVNYHJQDhja Z7+rGMhUrupSQKtKBdIkJDgtt2iP1yvmFJPNJYGsyGS/asqWpWRlAEiWTxm8bZeFhOj6G67F fs28qtiWwsVyPKt+VlyBzOreb79B3bt3ZyauKlGMXsEbGTuuuirBurGhEbiKDWwX1e4BzwN5 Axls3n3vCUoqcjPLJ6mySrhmV1AlO0WMBhGKbK1iRoblMLKzkpS4QuKMhcsUQtn0KoHHhphl u/lmE15LPUJVesVJaAzMSxyXLVvCDxLbt61qbaniK6JHaxUPaUOpAhk5hIOHvKxy1ULHFufK eZWLC6qMQs1We1xMqXeACilqVAmBrKisViBQJ7WA7kynmvvUfkoy5PIrLoWet5UGXJkq8khG QEFUKakuO7aYz77hhmvjU1ehxOTvDJMbGup5HaN9qRk3cMG0ZEEtj02KSSYA2081zREf1Z4D vDaqmR7gkVVUVNEVSUlgzjtHpqxc/dKPcq5hWYpKN61UjmJmZc+tiLYiMopUBxbHqQpeLkCG OFoK2DPwBYpikCM5bo5h1tefZUoKxCSLyOTUyjRewaudChjGJJ6ily+JyVrhVDigrTLZaUSz xRoDfMqgIvKVTePVesWIoGYuJLXQqHTx6t7Epby4gS5vvFYw8itKHbJbHhckmGyumEolj8uL 0dY4Qlugbao1g62FnGrBwIy3mFXLbdVqpvaxRMNStUQroqVESVVG6v2YLbeKhqVpTMO7hhWN X3mEuAIVzrUhVqkVQF8VXaNiXcBrUnOrc1W3w+0eaPdA3ANel4wTtCKmzEBWrsUSjmrZIeW2 rEb4rGtb0L81+vfFNcv1Bni3WCMXrQXMqNlWV8uwIoHMvSFcd6OeT1qtS7nCwnIFmsMFem0z hSvVCuvhZmpY1KvZI8pmMqH6Yu0iMWLTxm7RRpepv5ZvuSKBrMwWNwNbmhOrcoWawd4qi7xt 0j0rrdR8F4ufg1uWbrH42F6BpgZ+aqSktEanyQCcX0uR64lk5sGTVTtXXED05l1kV6XpjSqt xrE8wshPfx465IAIqr3QGh4os29UFj48bueObQ0XVKRTbffalCm0DKZVVlmlQ4cyL1amLVKp gYxmqHXKp23j737zBTJfdfgwgOCxik/NBbKGhkZxk/rIFgMfFkn31NNRZvW7AEKVSWL/HHhs XlF1efiMYvJSawZDQlUZahOkpKEc6c3XN9KUVxnvtMVILnK9q6y85cSVnWIIo7sNIjm5oM+Z YYnnTreBsr0Kggwalz43XES1BK9qK81tXTZh2dclW2x7bakeaPOBrNQGtyV66bzViM1ufwOO xTKCBZua8gSLPDQ5fSwNQ6CEyBiX94h1rL4mEWX5R5mqca0T3ZI2d5ZI3AaQ6rHQ1loIZGlX L2ZsaHT7d04PuPGrGAuxLPtxyLzDumKKpN696BmquQfabwPjsbgXXA/m83mzUMUNaxY1xYTW QiArZmMp9Z5ba+Ril9KCatLKiNINZ7FczFXHdA8OMz4TRqfO86tTkw+MCfTYTJSUH0EnDwvf /ofSuF6ibSLeE1hCsZhtJYhqJ20tD1T3z2x1WyGdSs/VFV5tadK54v2ucj2ld1uJXJyXLFmC fglevH9Ceqy+iIIHIQW2VYSPpbbYwNBz4cLFrE4uX85T33A1CCXsHAgEj2SVI010w6ULw6KW CKVgQIo0zjZ4LV+0aCm6Fi/GDKq4Mw0jD5wTWzmENx7axAwlMAzwR4QbmwVDFW2R5oBEMRja Ym0okIW6cn3LDWoNMxIqOhDgfjJluYStCGfaWL1Kr4UxwStaRuY1kOa7h/YGF7miwtI5OdNv eXK7oaGBc2OjWWX7/PPPWQalD4Ps2LEjnfyrrxaC56U7S5YsZnl00aKFMFEFO7WQAcAOi108 BUG8MwcYGIUAgKLopUroee0qGAiEEnaqoJTDRpVlixcv4rcCGhvNn1Uj1B5WDkXzAaYKYtFL OFIDABzDDCUHAkQd8KJFizjLmq+ps7WcRZcYzBt3AbS91ApejGw/174HVvBAVvsXoJkspCeb LmujDzDdmBAmnZNzly5dONP/wXOmG6+yyqorr7zS0qXkaGRhTZ07d7bRqWHBgoVNTctWXXWV r74iwDVKOCDaSGBCPgBNsJEnCE9IlijDGaVEH+SvjHQb0SSqAsMFJQQIIQ+xAptQRzjD9iVL TKgiftoYZsIKKiyNATADDBIMhbUBDJLBUFRKmoYiqgQpQqilCEwihlXCqLYhRGBokNbcBzoK QT2uLMOELLa4oFrFZDSwRJPbUCDzLl31fFCiy2qcXDoqZ+zkTI+lr9Lh6aLABA5+KGC11VYj T6GfS3Tr2tW86JmDKqhWXXVViElPFi5a3KnTqlJF6KCqrm4pMhEII3iJHQAiB/kSMpAMLFEG YuImNIsXLyZGQAkNB7yQkRgSUIifK6+yMjTEMyKeBFNrPicW3JoaSNbseBZGCWecpY2wIxNR YDgQCw3awaMamVSBIWYBuwe1kIER4wEgE3uwE+EUXfp0OCdZuoD2moo90IYCWcVt/XoIkO4n /ZC+KgDdmwOYrk4UwxP02Jdeemn99dfv0aPHBx98+Oyzz7744iv8dsZrr7/ys58dv/9++0P/ 1fyFTz4xff68+T17brTBhut36dKJEMMP5WrOIgKRJlpQTWgAJjRwRrsYI2fio1wBbACglgOg sbHDqqsawGZ8Jj4S62SYCaxHfYMfjESsREbiMpQEXxGO8WIMSAIZeOyZO3fuyy+//MYbbxDj 1l133Y033njDDTcUG+D68ssvcchmm23Gr73AC72qbgdq3wNtN5B591n7X8XIzSadnP5MP6ff AhC5QNLhP/vss9tvv/0vf/kL8Wj8+PEffvjxSSed/MjDj378ycfLli3q0WPtzp26sl+djOrB Bx8aNWoU7PzOEInSTjvvsO++/8MhnZzOTxVhgmRHej5RjLgABgKQjz766HXXXcfPqq+55poS 2sBDQCpGTOG3lPjRpi+++PIXPz+R38q9/vobpk+fRpRcMP+rjp14RbaJesS45cv4x2tmOZNh Na6++mprrbUWr+ReZ511tt56aySvscYa6DL548KFGIAiUj+0cHzxxRfgGSbPnDnzlltueeih hz788EPsQfI3vvGNbt26Ech22223gw46aNttt/3nP/958sknX3bZZQMHDsRdEhAjPs1fYOE1 P3F5lO33e9RvzRXI1M/NfkWj7ckuYVVN2ZNtbXm1BAuNYsQUOjZy6OT0dkaOdGZi09tvv01E O/PMM7/5zW8eeeTwW265WXR1aFz1yiuu2mPPAYS+ObPnnHraqW+9PavnRpt88unHH374wYyn p48ffyUs++233/7777/DDjust956MBLOiBoo5UwoIQRgAwe53q677vr+++8/+eST6IVMW7TK KisfdNDBO+20c8dOnYmwnTuvssUWm5GovfPOu3/72/3Pv/CMpTSW81tfkgB2WAnBZGqNLEQw 6QYS7b179x42bNj3vvc9AEm70AsNDSeckXsSua644oobb7zxrbfeInLtvPPO3/72txlKv/fe e0888cS//vWvRx555MorrySu4ZwFCxYgRKIhctTadsBeiOq7oYourj8g38/BldqIFg9kqrCI pVX0naupPLH5ue7+89/puqJR+xiAxCzBA9MJOYMnTgGQ1/z3v/8l//r4449POOEEEg2iD10a +rXXXvuOO+6gM59yyingwZDdnHXWWT/5yU+IR3TpY445ZuLEieRf48aNIyL85z//IcOaPn36 a6+9RnSAvm/fvocffviQIUNIkZAgsQzVHJLOSL5GaCBGoIV4gUnEU2w7/vifjxt3GZT8ZVmy bBFz+hJ9Ghs6zJ4z68ADB734wstELqbatt++7+jRp/LruWRhjQ0rffDBR8888+ytt/5pypQp SBYVe++994QJE3r27IlAhGMMirABb/zqV7+66qqrsJZgd/755/fv3x8k9hDLIPvHP/5x8cUX P/zww+KBDTbYgJC3++67ixvh4kCUAIlnDDho0D5+VbkZWf77wdeYXs6yPp2rVWrKa35jXRMf M1tR9cP1nQtXXZEj0HSJPPlWS9njmNZsoNfH6H70XpIRDkIYkYVUaPDgwb/4xS/uueceYtNf //pX4hqhhCoGUHRj+jl9mJD0ox/96Lbbbjv66KPhZdxHOHjssccwnF7NtBEjxPvvv3/o0KGw IOqiiy5C7IwZMxiLnX766RAj0AQwG1ixSmAiL7EGIQzuvvvd7zLlL/EFJAM68EQBjkYzRF3K 1WORE/vX/+ZGm222iYke9np+85vrkf99p/+ATcyx2S677HLsscfcdNNN/+///T94pS0PPvjg 8OHDmfxCPs1hkovmcxDCiMUgiV8MLTljKrYRxeAF2GuvvcATviHGHg5Go5ylIRbRfmobHqja 0DIjQGRUqZPKC8bK3g7QXaVj4woiGgfjxyOPPJIJbDD0TzCkVNKBwTz11FOvvvrqhRdeuP32 2zNVxJQT4YYoRiiR6MCQ7Zxzzvn9739PLoMQYgeRa9q0aTvaY9asWbAQKZhamjNnzpZbbgkv YiWioQsYUVgFnohGukR8mTdvHqEEAI2sPVDLwY/FsaRJClW3fNniJYtXWaXTeuutT65mF0nr Fi1cwh63lVfqhJwlZvvYSuyY3WijjcikSAzvvvtuUjkiI027/PLLMZhwybQ9o0isuuGGG9AI hgDNOJREDGIM4wBg7IkxJJunnnrqBx98wAgUg7GTWgBimaFrP9qIB6qTkeUJVdkOqVxCKF/y Mj2H6BX9m45H+OBMJyRwkJjQOWfPnk1koekMJOnYL7zwAgQEImbH6OQMLX/5y1+Sc9Ht7cYx EwFZCmBCDa6TTjqJrI0ZLtIu2T/BvBLRhKDGzBfZGXPtRBAGrc88Y6a0CEkSuQS2McrGKRs7 YJToxhks6SFT/thJuMDqhnqWCFhUrV9uX03Gb8hZIebmRGqHRjOm7tC4MvJZzezYcRXYMemn P/0ploMkHiGKjJLYDaVY+/jjj7/yyiskX2RbNIQoJpkaBsCODbQRLgzDJ6eddhr5HkVm35DA AVKAks48d28+JfG0FWK2JXOFYp8aaW3VMrK2cjlWVDslhEn340xWxYzPpptu+txzz9Fkei/D Qzo8OcuIESNIpshHoJEzs2OkbP/3f//373//m0BGRtOnTx/i3c9+9jPGayBJxFjXY8sCIzhk somB+EUQJBGTDQ2oIMchOgAQWTiLJcRTKRI7CBngOdALCcugwGSIrAEAS1yTsNuhg4lZEvj4 fV8WHqGU9QrkSFaFtAEDBtBGpvwIUjASc999913JDVFBvgkNw2QCGWcWN2ksoYoD4cBYK7Zx pvaoo45iFs9Y03pDy+r9OacRbe9wm1/qH4MqZGSu+kqchxzvU4m0luGtkcRPogZdlM7JIW1n eZGBoSwsMiok4jD4Gj16NKkZIzI6P2T0/3feeYfpMKIb82Us4dHtiQ5EPWbWCBmMKJllp3v/ 4Ac/AEnxN7/5DVGMDE5CG2M32dAgeok+EHMmiHDGMA0NAhA1qJKABYENaoxAWWdkpMndaIxf aSUzixe2wwQ7a6qZQSPDIg1koZMQSebFEFVWMJEJDVGYM2I5iz34BCTT/GISXBzIQS+HGCn7 Nvbcc09EyWSZ+BMhK+Cht2ypQIYv8ojKYC+7SvRa9ooCmcSdss0oyhj0yKJ0WQROW7PI2lKd iVX2oL/xjelSpItKDyQAscH1+eefZ9hI6GHnJ7GA+TKGhOeeey7A2LFjZVvsXXfdNcgebEQg KMDO5D1jNObm6d5M8Pfr1++CCy4gfCDnjDPOQBcDNAZ0rFRyMPUOhgEs8jkIFliCEACCBbCm aTYwBdeT8AGxmAqNpEhsyGAwZ2MZkWuxJTD0iCJ7AmDujFraOG+eCcGEIc6sXUirIaNIYsUZ mZwlghOYsIFx9Nlnn00ExAwJXtCgglqEk6gCMPqmmbIgC7uYB7AiHfgl9glGwzImzj4nuiKb RWsTeauIrCiQVdGONFHi97TarzmeYCEekK4rcQSY4+mnnx4+fDgbQffYY49LL72UWMYE2b77 7kswYuZom222gZe++qc//YkdFdttt92f//zn3/3ud+z8YvqfhOvHP/4xksndCGeHHnoo4zVm 9wkHIBFCUCB8IIohGxiGouRlYgyqCRwgAeSseMGA5JAEyqkyuSEEQmODCKBpHUNOyZIsC9kc z06tCiPRhxaBBOYMO6GZTA0WIiOu2HzzzckZMUwiHUuThxxyCCNlIqBYCA0DVYrEZbhoO9uD 8Qx4ZIol4NuPNuGBWg9k4kTTJyo6NPetSIrLXEmmVy1r6PASvDCMzILOTFFiBLHp008/PfDA A19//fUDDjiA1IwJoKlTp0JD1/3+978vbWHJkq2kpCGMHJkkIjowX86kPtvN6MzkdEQ9+jn7 RenYMJKOsXGMRUBguj3b0JADF7FMki8MkDCBbXKIImCqgAE4I1zweha8FAmGRDGRIzGFWls0 c38MipnRI7pNnjyZ8TIYxpjYQGOJXORZRC64SD/ZXwYjluMTzqSftIt5fQK02ElzoBQWYDbN sR4qdqpheQBzQW3ukYe4ZWh4QjX+SZqYb6FUIVglqFbjY93Pv5+qpajqciqOZVW3qDUF0j/l oB8C0Pekr1LkIKgx7iMxISoRntjCyrARc8HTn9k1ttNOO1Ek26KWrWHMkZF2ESDY4Hrvvfcy 08+MPgcdnilz0i5CG8Mu5v4ZuxHdYKRIvCBKoo6sBwwCEQ5SAM5UgQHgEGsFBilBSop6hkZg A4TDTJZhCU12tq3ezus1kXkRxUgh2fxBqwlDhFFyxp///OdUiTdwCJaw8Er+CAFFkjWUMl9G ykmAY/cGxqOOyA4eYpxDfCQgcoBXy9W8dqAlPVBqf28zgawlnVjjurTDEynoohwATAAByBQ+ XZc8hUBGQ9gTe9xxx8kOCchYebz22mt5VhxKikwMkYMwc/+tb30LYgIBM/2S2TE7RphgTZCs hx5Ob2fTLJKZQSPYYQPsPO4DnhCgJonrqOIQ2KsCSRVhwo0UQmMx9gZuauBnnZayS5ZXpK28 qo1BxGszPUfEYUWC5wSOP/54QirNxEgSTHb2YzAeoNWYhJ3gmSZjKZZHFJBAqAVPLY4isvOc FnsyOJNyigNpBZkdAiHGHpBif/u5TXigLW2/kCAd/NUu07vCXWq4z6Msl0yTaVTpoLNx2IBQ eHUi/ZAwQYen35JZALASx4hSppkIUqxjbrXVVvRSKAlYMrdFraQhJCz0f4IFCdf3v78nu96Z QWM/GqPUnj17UkXuw34rOj9iEb7bbrvxtAChQcMW9khckFZioQICQ0BAsTHL1ChgCgzPiB4m AJr3kFlfNcx5863bJt0BB897fvzxR+y/ZQVWViexn4jMWgULFKuvvjryUY1hxGVMBQbD0i1L lqxdyHItouGi7YQt5st4RIGElGyUzJQ9KLAgWabMIoYZ42r98O8/v1yx/eTIVkZFdzB3rAgJ U/UyzYqZ0pYCmbSZJlTkyjI9V6Ns9FW6HAfRQaIJPZmcgo5N/2TXGDC7GdghQS7GNBkPe7PZ ihEixAQ7YhDJC7D0XhIW+jnbTsmZNtqoJzJ5AGDKlMnIJGbRyQFI4phHJ6Ej3iEHA2AhBOAg MJyBsQdAzomOi1chBw4bvDgbObzGEbJnnn36t7/9DXrnzvvi88/N7gqCLOfDDjuMqTomxZi/ o0hbaAX2i2RMEs8QoEkzIWZAfckll/DODyYECWQ0jQNGwiILI+wNZq2DrXOy10R4aQgyBYay /ahlD7TJoaWE45pxK+YUsYg+Kh9LKfTuuZym0GPlgBmAHER6HX1YMGwE22ef/ejJc+fO5wWw o0adShSbNOn2I444atasOQQ4ot+iRWZbLEkYC49wrbyyeeTQPPlYV/fNb27Qp0/f2bPnvPvu e4zJ9ttv4Kuvmkkl4ghbTxGrUYOZuI8++ogqer6Ng2YZEZMkugFQhW0CgCTeUQQpMULxRkCT Ub148YI6GrRs4ZKlX+2yy8433HjNH2+Z+Kc/3UL+BTGqYSd+EXeIvwiBBY1yJh0j24KAOIUi jJRhJk+M/uEPfyB/ZPcJuSRViOIAhpgdvz/84Q95h4+0izN2ckamRGcAaQ6Adxj1rXfobVSZ CSKmiIzwHg7IVHUu5iKyK61uk4Gs0kZXwC/XsnXvXTVfuqL0ZHosAIcEMmhILm6+eeJhhw1l Inv77XfYZ599Jkz4w49/fBgzRGRVixezi0reI2Y2uBPOYJEkhRwOuFevnmwTYzJ9jTV6EPXI wh5//D/ggRnj8dZ/hMi+LZRKnxfVFCHjwDzOWrS4rBOUwiJcAjPi69//OyxBYj+T99BgLVXM 9DFVR5QhvhDFGB2rItoCTI4GmcQyACwEZpWDtPTWW29l7ZXGwkiYw3XAZGo8ucUuDbSLN+SM KDnQm2x9LfTjZMuqivXilrm2NXSkXJsasjDZlBpzY7KRLYClc9LN6Kh0MwB6Jgcw0YpXgBHL /vCHCYMHH0qvvvLKK0444ed0eFYwe/RYY968BaRabC5lZz9TYCRZCGFq/6WXXvnoo495W+yC BV/xuDhN+OKLz8hWunbt8thj/6TIfitSMPo/U+noAkNoc/u8GAOeA5hD4OyztEKyHsKKNAcW tnpJlAQ44ogj9thjD4pSy0Y2WbIAQwyFizMSRBRWCRmmcsggmjk+ALZZsCeOg90YpG/UwsVg HC+xp+S+++5TadIEavFztv3tta3rgbYayMwd1rKek1ysVJ35uGiK98mlhx5LX6UDA9Ab4SFO yYiPRyxHjhx54YUXde7ciX38dPUrrrgcYsaSDNCgfPbZZ3g/Iit9dOYtttiSTbNsF2P7Po+C 9+mz3c4778STjKziHX74kZwJZHPnzvvoow/XXHMtNjrQ4ZHAYE02xDL7RnYGBjM40ELwAhAM 55yHsEBM1JCIBqxZHk0jAeQBTzA2PNaznMpoEVjil/gBRjDYQNqo02EENTxAzGIgifHEX6Sx SkBOxxNXksGRY6KOeUDmyyRAyx8JxCIwZxO+VmTB1rnQN3IH5/RAsMctJ3UOsjYcyHK0bsUn MZHDhgy6LgB9j+5Ks1mtAzjrLMZK59APiT4NDeYnSOiiTC0xC0Z3JZaRW9FR2XRGx/7ii8/J tghtrAzMnfvlc889ww7Sa6655q9/vZe49sADD7AqyIoncZD0DRUMNuUpSyKdzFVphwewdplY lv+AiwN6aZHAtIjQQ3jCcvC84pXtbDRN8jJe+sgSKpFIaonmNIdmIoTtsuy9IDxRlJBELgYj UU/8gEzMZjjJgwpEf4KdBE3m/mWLGcRotEYFvyaXvy3tlC3sgYoCmaQbpd2tLdy+ZlQnf4HC v0dRRRV7RoULEJXulOhm0u2lA1Okl4Ih3LBat2DB/N//fhy7rnhWifhAz2QHxhFHHE5H5bWx rADQgenMzKMfddRREPBiHLZcMC216qrmhYi8hZWB54AB31199W+wH43FAV6bQYeXQMYQlcVE yAg0RApRTXTgEJOwRKIANGqn2E5RAYj1QI7gOYPkTHAhUNI6DiQzAORBBUkqqcUS8k3RouqI cVRh+cMPPyyhlioOJBCvOSOZothJ7GMnLXvNJMDhELZlkM0hAQIhA6Ao9gCsuIfedSU00bvV i4koVl+C5ghpRYEsIqm90OIekK4lQUHOMibizKIenRaL5s+fR/I1a9Ys5nlY0WNT1RprrP7Y Y5M//PC/ffv2I2a9+eabRAx2J3Tu3LVnz54UyWKIFCxZvvzySzyMiRD21rMPg4SPTf8QECNA kp2JOkIh0U1bL5YQkjiwUIIdwQUagghnQYKBkiBIKAGQOCW8bsgAQzQR4cBUkVEyWQYGmLhD 63i4HUByNNQBU4tAxp5m38bcuVDKQUgSIcjEPyAliWMZgSoM5kx+KqkZciCgjWqAtrEdiHhA olME1dKF9kDW0h6vuj7p/CqWXsfBaIst+zLbThVddMMNe7Kt7Mc//t/PPvucJT92RPzylycf fPDBixYtJLodfPBBZG0UWdSbN+9LXprKNrRly5YSv5gdmznzaXIfotsBBwxkPz2dn2c50cuz TQgnS2JVAYAoQAgAzwHA9Dw5oMQLMBLXiAsECOaqsBAMZBxiPFFDYhBcYKDhDAwLVSKBwEeC Rv7IYJmhIlXM3/OsEme0E7YIlBI6SR55NwZhjv0iBDVEIYEzZPhHQhhnqpBJ3Cemg8ckFjGs 64I1XJBwiQEA7UdteqA9kBW5Ll7mnEatZAKkkZWLNz0wfkjPFDw9TTobSADCBA9Rs44n+Q79 lx89O+64Yxn2kY5Nn/4keQd79P/3f/93jTW6//3vf3///f9usknvF154fubMZ5AAMeyEjL// /QEeb2Ih79NPP2YRc+ONN2YHKRq/853vkL6xaAjMTL/0drGHWMABTIzADM4UMQlKYhYwqZMQ EFM4oKQIGTAAZKR4nCWcIUHjDjSERcgwg3f2Q8MBO48uMIVHXMNgohjRTfDQ8+gSA0yK+EHO iEWCEMCLcGQyV0goFO0kpyxfQKA0GC8sgsx/9u6KosX8kpVSZSqmGoCkWMl3XbnyRWYJ3GpE qh2OyPZAVoJna42Ufkgf4wAQmP5GN5YOyVwSb+MhqxKzeUU121Yh4/2IYBigMclFPCKi0fnv vPMOkPfeex9rfd/5znd5dyGzafvuuz8j01tu+dOcOW8Cn3jiiWRtvOkMShIipp/YRwo7O7zA iF6MwQaiBoAsERIgiF/EFKIeQQQDSLtI1mARO6EntGl8AS9BBwnA2MYBDIFwUYRx+PDhLLAi jRSMsTBPKTHrT5EqYp8wEqFIyljoxGZiHDGLYIcxyOeAkgMAYl7Yz/OkAPgEyQBUQc8Z1YgF 037UsgfaA1mlV0f+JFYqpSx+6WN0MwC6HMGCGMFBXyU6MFxiU8V5553PZBZLlg8//ODzz7/4 6quv8bgi02FDhhz6jW+sxrBp3333WbJkEXP5CxYs5PWK8+bN5RfhmE3r1q0LI03s4ilxXvLz xz/exIImE+HyJgz2yrL7jFjJXDt7uzCAA0vkwBLBEFNkhPjvf/8bk4gj4AlJvFcDyQQarIUY PEVCEkVCDyGJojDyQBUHNEIPO/EFUWRt7JwAJhJhLYYxQJ49ezZLHEIMAX6Ai4ySYfL111+P XoqoQC+GoQ69GMyjS0wFisfGjBnDk/AEZWkO9BBwRhHn9qNmPRBMT1Ron/nTySWvUEqbYa+h htLNJGRwNpcgHKaRvNBR2alKPsILBW+88cZrrvk/fpvSvpbni969N+nVqzeTXwsXLuKZSngn T57CzyYx6uyxptmvT3rCIJQsZu211/3gg/fffe89JsJAkpFBTIDjLWaETvaUEi8IAcBEDclf 6PPS+UkAISbQMNFGNMQ8kinO2DZx4kRSOVIqdMngETLwRDEoSfQgk01qhCH2WDCQZBqOTV5M YBGGCEmI4okrNrj98Y9/lBEubcQSHqskEmEtM1+QEQ1RQZhDAjODPD3OQwIYj5EsWXAQ4GSm r1evXjzUxRs+xI3qSYq0Imcgk44AS3mHx14D95lngmdgpJXyOLhh8Kk8IRGuahWq+QO9LWFv tN2+x6K1aaXwMf60+gg+SUWkoUkEEQlVKdz95wdIJUQU/SouE6QENSICAYxubPMyVi3nr776 atAzPGSEdfXVEwhnn332yerfWKNnr14EizmzZy1dtnSzTTdldvztt96e/eYciDfdZFN+hO2d d98G7rTqKiOPPuaii373+WefnHPuebxVg6e1ee2PRCuCBRkQMF0dpWokeB4tYHKNZwx4xwbj UKGXeEQYIh4Rccjy2PNBLCMeQc+SgkQlREmqhQHkR7SIyXim7XhSksl7hqKwcGbfLy8pIgJS hAwb4OJJcvnZFBLS0aNHw8ieMoIpb5RlXwVDXWTqgZeY7Ntzzz0ZUdoddub9P5I5SpILJfER yWK/MgqAugN/YEbWciRcmLCqjO/IfVaMvyTiYsLS6ou3z5hhqRzSdNN4G2Waqig+g8z+Om9T /cCBu7ks6TpdqmS4Et5kicWwGc1LZA3pc1kaEgeStMgbZkBpMVFRSci4qLh9biArKlyDGtGE EECHpL8ROOiQ5CC8mefRR/8xbfpTH3/8yUodGrfeavPt+22/7957bbHllm+88fqtf7r1uRdf mv36a59/8eVGG264zbZb7/X977P7f6111iFHq2vosPIqqyKNji2HGCMaBSYQQEAkIoFibz02 kBOhnbhDLCDqYQ80nJEAhjc4UmT8CItkZ1QhSgKHnMGggvjCzB0tEgMQBSB7emma2IAoNLL+ QLwmgBL7ZIiKQPagvPjii8Q+BsWohoyUk3E3r8nFBthVryiFRlqUccYACWTxi5jBVV5V/K7I kFMScYaczCqv0Uan+W/RXl2mHPMCp6JHmsD2QFbEdZ7jtFj7gcxrGF2UTku3lzkjqf3gww/J Tdggv+6667BwCbJpycL6lczWs4XzviDekeYw+lvHPM9k5qeWfjVveWOHBn7+g5+hbDAvzBE5 cpYgImdiCtGEWODRGCHh7ye5vGRnCCQ8uchEmKiBTLRQi3wAQo/bKJeLJlNL7MMeGAmRwuXS KAwlZCITYzgQzlkJ0oD2QOZ4pjUDWXXmyKQxTld3Wtc8oOpqDvEpwnP81UixJkVgCnWV0j0J K3KWkRfdlc5Jj0Xxmj16rL3WWmLB4sULyZHseGoZjVy5Y8dNtthaqpYsXrh08Tye3+nA9lEz yGrq0OA/e4gKiDkLICEMWBQBEL/QKyNQoZEzBIon7lDEQiIasUkJkCbCRayEJ0RxwAsZLJwp ckaC0KMRLoliYKilKOo4E30gltAJJQfxUUIkaSOU0Isc4KJHqRe3qMA0AldR+fdimvRy8LVh hbXcD2TqrBqysRwXV5NHfNJGHSLdmz5PdKADSywDpj/Taem9VPEasuUd+Hnv5bTRvJu1gWx9 GRkZtSZedOxsAoEJE8uaCGQrmaCA2EQXgycEyCGqJXyAoSgBBRuIHWAogpSwhRlgRDIEQi/S kCAASGkIZ2jAY6HIFwIEQgOGIIUKaMBDDF6SMqogYJwLHl3QcCbeiV63SgSCb6NHm75py/C5 H8jKENHOUmsekE5It9TuSrCgP5OXgeGgh2MzgCQjpDlU2R1nTez4YmTI0K1jp85IYLpreRMI +r8ZzRFSGpYvg5Nop60GLzCAwKKCM0qJNaoLgJgCUrIhCMDAQpThjDFUAQgeWMRivEigSkIV BELDmbYIgdDImRgtlDQNDOooSpXQI4oicU3ZAVz51LYfbcgDqYGskoguvHghuMFb2x9qT1UM ySMtD01VjEkTIv1ceimhRPsteIE5y/S/dGCuFOPHZUuWkr00LWPsybYJNqY1NNoEjBhHzDHp T9NyXsBSZwIaoc0EHQ61QYMLAIGDMAEgZ6ISGC0CwCgYDSUiCkoOCBDLWWCpQpQUwUtgAgNA rRBwVsngqZUIbuvNXlnYESvEUOrEGZSKVAJtV9lAebdBwaHpil3JGfQumWlXusDKa8yNwSWr XFCKhLjxrq7UQJYirR3dBjwgfRJD3ShAUfDSmenGQgCS3i73BDvwbdEfPHboEGRV9XbgiCQC gix6iDtEGrAACOGQWANGipw9YopSJXjNvASfeFb5wuK2RTDCZVpkgyAEqHC5hEXIBO+yCMy5 /WhbHmgPZIXr5Qb4ArYtQxo7tBGKSQDCSCfEQkBXN0vjNuoZPLAJR2FMEtLMsypSKg+jRQ0r Slk24IpSWBWpWBejZFrbVgDvvg3+XLSA9Z7iSjSKqBJNd8mLBDI11eXJb3BZ5hURryYVoUuu LqEdoaKg04bFZLmKzUmm9DUFLDcbegousj+TawYLii3U1ZTdNWNMVa5+opCqeN6TXBWZ6ntP uOLzAGpJ2UIKU7Z59LXTtJYH3NyhWW3QX94MAJuo6O0FIJ9mtaENCW+x69KGfNIqppKR5YqG cisraUm2VsKrikSIFnMC5XF5wvMIyUPjiS2p+P/ZexN4O4oqf/wub39JICSERcCwBgQ0JiDD MAFZZEIgCuqQkQFkcUQY8a8wIr8IDuPCCA7LgD8xM4oojGMcEEcUGVS26B9liQEDmEAIkkAQ SEKW9/LWe3/f6tN1urq6qrr73r7v3ffS/bmfe6tOnfM9p053n1tVXV2Fx3B4wpZKBMzG7pLx 3iP7Ebz0FllYJS4AlYELo4qMWphfTURlUWoUN3KqUJmkjaptyIPe1nmNPvvQHlVR282oVkTH TPXungqUVVoaIEYz0h1FvKJ0rBTR6yXpwW9q/EA0iJcKLUUy3jgTWETKVQONWWZdIqxTMjNh FBJJDGUeanBxVjPXRtfYZNZc+5QgEsz7VRBTwChSAZqRiGIzXVLxhCKAkClZKPPy10aX5Q35 Ndhn0pOQTYjKOGKCGVFaqkBWKlTRr4wZIxtR80dP2ahciKNX3Vyz3QP2+z7FRZKCNWyJXXuY L0VOs8WlQSvTJFPorJuVVWsm2YHVQEZCjGEQ4rLE+AEIyzLJDRLlZ8H0CbeqEB7r5T4UU0J8 MuMulVwj8UuWuKuqWctZt9RIWO/pYHvq0cggtVUqVbuEddVjcG2yRtW1VZkN0DDrRGPYtAnW q9njwMkH+x3OyYtyD+QeGBseUFtkZHGiaEiRkllrq2vycJsWvzZkTUrLaja4SzVmQzaJfE3+ JeC0opoUW5cMh7lYTtQ4lFEeKqne0HjUolRpI05yotBF3FwVp3oDsoGkQ6Qa+hGGpDGJlGlW JKuNbqef1xYLS9VStUCmJdPbAizlcGA0kLFUnsg9kHtgvHkgy0jXBL5BpKZgnQeyJjgbuQnN 6gHttm9WM2u3S61gXc232k2oV5Kq4L9kZ6qDRlOr7OtmksZar2lZyrtMY/uzVOjGSqWSmF01 sCpjPXZpKmFGK1RWBSk12Q3PyqBMcJy1cnSFYpULYLsPgj6XnQcAmnVO3jiLtJ4mrNPQ4wDq L3fYnw/21+/eHCH3QO6BUfZA8q4lRUNzECaqI16OWC3N9jnVm0RcVTHxOxXYC91QLiPsmFoJ q0iClopZU+RlSQnDmFhiaEnMtEKQYobQ7NCyGkrCsWw3CGEm4dG0p81GVXCtHVCaVBKRWLQ6 QRz4qYr8QJZtDVNZsL0way6maruvAhJRBd38DXAlKR9xtYlqojomkYCbKW0lHerTQrkNM5Zq KqLGaAxGkDBRw4gHYA5NMgybKMdQibgNTMlbZAbhnJR7YBx7oP7bc0w7R6t+3aGmsc7wB/uh RDWU66ASPUM0AjOKQs5oTJ5gY79YtVQTY0KEX8rZf2sQEWBhsVSjvxqzqBKhxVSusM/e+x13 7Puef37Fw0se4AqR6L5e0crnVzziF/lYHzvvQnA+8OAvXlz9POvZd+/9j/VwHlnyK8IB97x5 p+26624AXyKJrOK88y7itJcQOnt6tj722KOrPVgqXbDg7O7uCUuXPr5sGTbiDVVmwYKzwLN4 8e3EOWfO8fvvP+PBB39B4oR/992LsS8nMfD3+edd5NVX2Mku32fv/eGHgw8+hNiWP7OcK8iC Abc05CMLzprQPeE/br0l4FEwVWI0rZ0yjYEN0+i1ZaW9nnRkJJ4wBY9RqyfMJSGolNYIEEXe qtEIqwgayxMSYUPeIkvoq7HEtucee33wtA//6O471UDGFTjttA//ftlSGcgE+d0zDwORGCiQ URpRDPTb7/gOZen7nHPO7+zsWrZsaTSQMYjKj/SZZ557xx3fWbz4e0R/z3uOPOCAAw8//C8u vPBsjRNFoHAgQxQDJiIUBTLCRxC8+eZrNUEU3S3q6wdclH7svIuIf+3aNb29PV1d3fAJueVb t35DE1ezR7znyBkHzNACmcqQp5vQA0Ego/CcMkQyO0n7FawJqkbnhBQLDDYpHjAiGy9SG0cm ijSQFPVUjH5x9QvY9HuvPd+u0AqzZx2OLPaXnL73Pip92rRdkH38sd8yEc0xRDEgzJw5a/Lk KdGW0cqVf7z00lC7DK2qM844G7FsxYrnli17gqC2bevdY489zzvvH251xhTWywkInnji3CVL HmAoFLFnyCfIUhSDMTd//QYOzXvvvf/ll12BWAYRNZYlHOZnG4wJtkEtNRI9htrOHmH7qBq4 EZF5jKVsKrMRxc3MUsYEQ9UDYkR2E2OmX8AstswNlJfqHtB8hxNb/7nNAuSPf3x2ypQp6H6y wQcffCii2B9XPPfumbOYiMSBB74DMYsDAShHHnkUvn/+85/g+7TTFuA79kDD7aGHfgm2WbPe w8xr1rz8m98smTt3HoILE5Mk7rvvXph0wQUXOy5L9CjRFkND7DOXXqQaj/TlCy9BKDzm6GMD XeTS5KeGTmtUfRanJrAqw5TRMK4FJRKoUyVi2I0aNZkkPJqIMxsTyJyyeeGY9MBTTy+D3dSJ Q2KnyVMOOGDG0qVPLF/+NLInzzuNaoVwgHj35JMYxvIPcKIhhgCErh/CweGHHyFLYn5fffXV KMeiRTeBeN55F0SL3JRvf/ubaM1hUMzGNv8UUYX//L7fk1XZNmxc/3MRCt9A7VR6nh7rHtAD mRp3kaaDiZIQ/TUEWJbiRFSsZkptmHFSVAt813GEdWD0VwwA1wdptCasx8hiIELq/390CQp2 mbYrFR955BwkXly9CkPySOy3r3+HH3SQGCN/YdXzEKGDmmBPe3Fw6dInEU0Stqcw1AWE115b J5HEL7qld921GJER3VWVHpvGkwdqzSEYkRNYhLLveMfBiLP8gAKlKhs6lZ+mlppKlRCg0aEm kBbnEF1QpjKbd36jY/xgDPPSRcDfnjwx2b+NJWRL9Ftjlgb6v3Qd8rdW6jvIqyDqyFA6m8yD IfYgXY248o2qgzEyY3FOHIse2Lxls8NstErQ7cLdTjwUuRDFaPhMoz/66CMMhSYYAsTP7r0b t+N9991z1FFz8DRAfRwJToypY1CMRZCYOXM2RrUwXHXvvXerdKTRskPD8PTTz4AWxDWt1JFF a27Rou+iNff5K/8xyoYIC3UqHSEPD0BUyh+WL9uwwawRTwbQ0VaZ83TzeyAmkHHoxbWb4GAu lgsJaVTmDjE5MxqCwlsDmCKdddJuZ9aa5D+/Wv/fe2PqeNhnU/bss88guKCriKA2e/bhiGuI YmBGRxJ03PYYTkJEAx0MoKM6eLKJAHH//fcRJsbaMVZ19NHHaqP14Lnsss9rehH+vv71GzQi ZUG/6aZFZ555fvRBpJGfiLDqzrsWn3XmuegII7A6OKkIkzBojJ85r7n2Kw89EjziZDoSq1e/ iHCsUpBOeEIjbOpp0SAzz4Z0+XvHSCWhMkmM/kbsj7I0KSUmkGlWcz0T+kUTH4tZrnJq45vY R+gwnliYe8gh71q79mUMhN1/vz8QRnS0khDI1LCFuh895zh8d3d38+AUwhN4Zs48TH2AiNj3 /fDgFE2huOaaG04//ZSoD9Ggw7QJjM1rDyI1zuhZQGsO8yQWeK05iraaCLIsheljHNb/6qij 0ZYUzKZV+aMgRopATn5+2Q4jlmKnXm4X1DqzyW0hFSwe7SwLBk2vCV1lMZXrVWl0Pl0ga7Q1 Of7IeADDZBddeDFCzAHe6BXiF+l91KMfcsg7j35VdA+ZjvScOUfj2w8BxO19z507Xw1k6Jdp 88uQxTQOCKLLqRURDNp0aNnhQeSFF35UAY5PUmvurDPP/7fwtDL0KzFPDe3N9bK7iriMDyG+ e+bseOicY6x5oMZAxvHYEow1MrOH3GOmhliSZDRdBhFNkZY1CIxBEleK3LFy5Yo/LH/KVg80 YdB0OuTgQ3t6e8Dzs3t/TJygQ/DAGQe9tPpFj+732tCDw/QxNJ1o+hV7/Lu3/fesWfFx4fXX /2yzhOh4EIkOaeTFAKsQVXaVbM2pk3sh88wzyxHITjxx3n/JNwRUIHSl1ayaJli89oA5t4E/ vRRnVX5Om0o9J5kKTDRGik/44hKFzwVJBk2tcIvRtmkW80M82jojJT5d06RYCjZboUDwyqLg CkAGSf2pZQaQOUQTeAAP5mwdLrLuscd/h1kXiFmY5a/a+8wzf+js7Jw792RENKbT9DF00JhC iUceeRABLu1jRw0EWbTUfuNNK5syZedoqYOCwIqhuk9ccLHK86O7F6Pb++EPLYjOsfj85f+M rrTKHE0/tOSBG27+WpSeU5rZA/UGMkRcCtvNXMntzTYMzN943Tf+1ntv0VZ3GjNCzMLYtnoG n1wqxstAR0Tz/kyLO02eiomyaMFx74wx8RYk0ghz9V8GNK2Mo0xywG9508rYJCTQo/zvuxYj wn7tmhs+ffFlx8w5Hh94Az5BDxcRU2WOpj9z8Wf/7TrrO0xowohWjKMFQqabKmCiRfWno6ja kEbDhz7itkypj6qmttFCpjgBuRAJ8+FwmlkgHTVpIEvpE80IqoTt5GvMCbONwEyouqnZcKYm TpyE1hbefHYYyq9hUuRiTjzxpMkH6GER8YOnnY7Eg97sfGajBEIbAhzmgmFASitSsz09W5A9 8cSTVKKWpmllGtGY1W4Vmlamcf5g8e14Lon3B/AQ9nOXfR6fs888F88iQbxl0c1g1kBU8enT 98a7lkxJeeU37WUpDKO68DfX0Z1Iy29EywTEiEzE4rxgp3EHm19kC0U2egQR1cnqSKwzctXa jTBg2pktFfEExJcBzCLSGHIq/XHMITe4md2lCesa0qfI2OgKSyhIIcIeeshMlK5Z+7JsUVqH a1TwIB2khBJjgyVgMRZL4wI2Scn81+D8EClkQqhEMcXmIJ/fJiYRXOX8XquLSQIl+6WFP9IF MkbWzNCyzJYsEXKuIlIfaiR+MXJEn0tRhJlhLAlPQHy5UC2ymZJr0J9AJOSPBPxJ3RDCjfjB XaqxW5mpoBi6T2OYI1eRFql0ca3Ys0zn0cyVWcGWwKEh66Ws41eH9PMho3QeguOgo6FLbvmr FTsrwZg2YR0sPk+BLGnXMh4v58g9kHsg98AoeaDG6ReatRzes4uzmoY82yQeoDPMJzzeqhSs 8WAxHDG66pgBG6MYxSbdJpqCVNvdoknF6PDtCoSIP8gr9iRMskYLiEsDi7iYEtoRYssmkIUg U2e4cqklcwGHB7K+VAyqGqeCkA0q6yAlxEzIFjaklmu4JkV6wKxFsTCd5HwT2JIkaMxDUpwN O8Saq03KCicL8q6l9ET+m3sg98CY9UAztMhGznn8zxNWyeS0/y5hmLGfq80RLEUOqMeJGhQA CS1KV53tLhWcxJHEMjkarWGKbBJx1SxbmkanbaUp6drTBdujAK6OXwk/X5SV4nJFvbRTw2RW oousB5rKPWx2KinFOD25fQUyvfZ5fjv2AN+Q27EPGlh1dm9Wocpta8aBjKwfGdPdFRu10mar /PZ8SkbgZmIVygVnoinFDU3y5WcxgsjMlaitStwWwNja6BpjBWpiqDGQjYxxqWqExRWwht/0 6dMh9cYbb6xe/QKmdxsRMEnyg9568+oOFMSJxWqwIIS3aZhYnyt6YNu0rT1bbcjHzDmOVkON CoKCufI0n/7vvb3XNB7A/s5b3VCjR7NYbv94scvZoSjCahN4x+iuu39oe7PyY+fzPm+hGpGp WLX1p/KNcVaEIjjhW3I/NNop7kchFf6NgF+fc4AAAEAASURBVCK86qTuXQQQLBurbsKGV7if XPoYLZFGKrAzCOuKJrb2bIF7+U6jKw1vTQIzyvwruX8dFeE9pAndE6NsRPGYQ04A/Qxv87d/ v/UWvk9ZtV86YcK/f/sWQpgyecqHvfccvimdwx3OY48+bsb+B/zywV++8KKugmSPOxpe9Ri8 pd/OWnBm9NWLx5c+/sSyJ4k/+n3YzNmHzzoc18nti+/wMecIpVFOppA9Z0LXhNBrHmodBc/q F/bbe78Tjj2BBSkBXffdfy8vIqJKgYE9pkmlymYVSWoMZKlsbTQztvO54oovYcEDKKKlQWfN mo236t773hO+uehmdZEZsgRRDAtgIa3dYKDgBkYRIg4tNEj86jfW58Pb1LZAhiimLeCnyvL+ bDaes88853t33GZcs4FxPn3xZ//6xLnIrhG7nPViPyS8CHnS3JO/c9u37omEJLx0ybq0GpGp eBvp2eeWR4vgBA5k5CssCPFvkVepURS7CRt48MEbjld/9Z+oFgTINdISOINR9+6xx15GKRCx 1uONchmfv/A2mtMAOWs8rYgmcBHu2P+M/O3tu89+Hz3rnBXKy/OIYh/yrhxEnCfljlCEj4CC ohXPr7QFMkSxD4tLayWiBkSO9DadY9soAQaou/LLX+DYoTIs+NCCWTNn4ZRxIINSiKg8Wlqo e/GFI48QG9xpRZwVNq9+ASvoUtWYTonTP7Tgh3ctjjpHYxv17HgIZFdffT1W+MMdpW7dijVh cJV/5tOf+8xnPqG1VrBkM5ZMwPvJaH+pLYWM/mMKeKGP32S0/WvhesUCFerpRzvo7844G7EM uxmFrQq4KIphvYpv3bqIow8E/7+LL8H6YmtfXasJHjPnWAijsqgyB6YAzkudLxaM/qxGRBaW 8z8wbh68tPjIkgc1fJLiEePzz7sQPsfbl9dc+2X5PhB2C94fa1Ljf2Xh5f9Msezk+cexOtq3 7dprv0JL7LO7OMGcSPA6QlSKMH3hBRfDMHhbNWwe8H15UQOR5JqocF4azTQEskMPeWfxB34Z q0azF6Tf/u5RFnqPvHLeO+dYLZAxT6rE8fODRhDaRO879gQEpuuu/tdLF/7j+vBK3FN2moIo RtftqfM+8ON7/weKbrn1m/iwxl/d80tcVxdd+g9MUet9wimBLpXOzEjcdfedSmOz8IF5p35g /qkfPfMcFCGWkWe0sX8h7hXQ+L0NWbDZD/Z5beIAHvPTLxCwKIphfT513Xdkcd0jWmm7luHq Bz/WdMb9RosF2t07oiW4Gx98SCy+fJi3y2RUNwIW2mK4Uhde+VmOYmCD4L/dfD0Sf/MhfX+2 o+ccg4bbE08+vucee6LiUUysEoEG3SnzTo0WqZT77vsZbqFPXPBJlail0eGlKPZ/Fl7CUQw8 SF9x5T+inYVYdnR4OX8NIW0Wwesn94iV1GYrG82lBVm1+gW4CE7YaSf9vXeELUTw//3FvYQ5 e+ZhcCOcCf5j5hyTVlEsP5pFiEp33n0ntJx+2t9o/ES55957QD/K25RPY2hE9if3/viyhZfi 1KNdhm51PSoQqjha1YNjkx3zgQyLi2LxKW3lePIaGmi4f9AnUitPSzbf89O7H3/8d1jphXc/ U3lGK/3qq684VGONZpR+9/ZbozyIZb/+zRJtpfn5807FajwIjg8veRAi1DrTZNGJQ08ZC0a7 l6+AFK2WQ+NlGghlT5GbsGntXyq9+8d3IeFeAMMI6yZucW6zIhpi9FFQ6NpQbyr6/6DBL2ac 5YWtJ5c+wS0jtMJQ+uOf3o2l3OBYtFaYObNEtXDLt7+J6HmsuvOmh36E1xhEp3LpsqVomomw QjWJ1W1q5ESdEMCorvHWRHpIrDrXOffEeQGPMeUC9QUSsBih44ljO5BhXBltrhUrQlvmcKVx R11y6UU3yQEUoqMVhrYYmgm0TOC73imWRjAd/vk03Qsm9ixotPC0tm0aAx904Dtwiat9KC5C 4itfvUrrq9JqiP97/70QwZ+qbWXUm75+PXx49pnnqWjRNFZhxTgXFlxUd/YlNro6sVkJzAMb eprRD5bkx/8NRvTYn5RQEXyPR3VbKAi+FBkjKz76Ssgwi3RAxng2Mto2ne/1QsmS3zzCfNS8 RQvul94qbDOtVw5LGBJJTHpuxXM4I/vtsx/LY5gfzbTHvT1Gn/6D2H503vtcayKxYBJ1zCwT 8J5/kPgT3hJ1++69rySbf8npJILv2g4Wp0RykLE9RoYxYFQVj+0SVpiWbH78cXHhIpZhsGnW rNm4H4yNiISYUTYMdZ12qj8Eq55RNdB0dXWhq6jKYi156jlGx+yJTYRsZeBZlY2mUSl0l1BB qtrDjzyIkSBoRNtNY0YvFU8hUIqGmy1KkgienPy7twnbFaYxNXTY1UVlNS3IYnUweiATLUpI Qev74IMPYeY999wLbepv3HKz2pNFKRZQJB7V+S+9tPrGyMMKYoOL0J79q6PmYHR/lXzmeNjs wxH9H3rEd9f7TxbNW7TFIIJYhmbR7FmHoVm0fsMGAsnw+8XVL6LNtdcee/FzA2qgPfjIg9CC RtmCDy/A+D0P+SdU/X+v/79RztUvrb7upn+N0lUKjQbuvPM0ldhs6RpbZOrfabNVyWHPX3qD C1gKmXiWL38KdwIWd3eI1FlkcxT+YC+/7PPqB1EMLRq0j+rUSOIf8mYJPProbyiLIW0kqHMa xcdzANy0FzqHwCCFGx6bsCE+nuzsVdF/afSbhtw1etSY5JTeXrH75Pvnn6osaS1aE6wiIRT4 afd1Gt2H1HuPPg5/GxgOE2iY4F70h6XuvPuHhPmH5U8jrp30voyunDiLMSQnxjrlzIwnlj6B p5B+k41kE1bVxAYA/aA6Wx6RUCG+tYMMERc83o6Qu/xqPGmz7Bg1YQQZ2y0yY5VsRDRSsJYp 7liaRAY2Gj7DrmiFyKN3G0gS+n9+/3tawyd6reC6BJuKhn4lmkX/es2NHzRtm6ZyJklTR2nX XXfjOWuIkrNmGcb7CQ1DYFhGFUNgtoebxIYxNbkJ25JoMxbNTIdtU6ZMhQ0OhtgitCu1qX+Y OIalX70Hr//I4p++5CLLPcgsegKj2n97+hnHHH0sTRmb4w1H/s9P/b1X0PJC+MaVw+NodOUc eug7C/5/og5YT57ml23evIlATj35AwiamGpz4fmfIAo25UMCjzi5yZZEHZ5m+mE+CbfCQ8P8 mLGo0OpN0h0RCYa1w47tQIZNK7D7Dm5abbCf/IE/amz+umzZUjw1A4UeX+KfFg/XVIfhGgWn 1j1RGRqRxnWpBTtksW0aOjjGDiBsQL8S/8O2jvAdt/0QcYSCIB5QosUHEURGzXjc+dFZWuCB drTXMB8tMt6kARRu/vr1N9+06Kwzz9OmlaFfifW1beZhZA2e1zY60aHT51GX4957As5gEtHo 34kqhfYXGsUY40dPCt1G/NNwN5PiF+zXZlqhA4hmUapoomq0pQ/2Rhu5/UXPKHHqtblg6G/i yYANJEP6UUeKbUDR4c0Qk6C0M1JPXEvXtYQm+tiq5C61SdVDR5zC6AxG/VUQMuNYbx4Q74qG eIfx5rPP/hvMY+LP7Xd8B4LGWeOyj+ID11M1ksW3+3Bvm/aM2A2k8NemjjBiH24zPGIjfHpA +dVrv3LS/OP588lPXYBSTJiy2UCL2aN1wwy4zrRLDUUYU8O8Fsze0uZzkHm0wD8jcII8vHw5 BqoTOkOIkgFRGxgWCb+l4PeG1JJkaa8fhK4QmnsQmHfSKZjrjxbQAw+KqTB00DyMj5x9+onz j6fP++af8N3bb0NpdDa8L1PrD14AwJ8QOo8EQNPH8B92/CknqJ8lv1mCM46HAL4e8hRl1HQy M8weFjiiX/2+408EDD3iUPF8l4cva1LOgFpWFa85zZicAFS6QFaz7sYJ3n//zwF+2WVXYH6/ qgU7YM+dOw/dgV94z6SQRbxbuvRJrUOEv3REN+2JlYrTPGm8h4SuGSaLaREEjSA8XoCd9973 U7IWz9dQca3FhwCEBhEaL+A3VgqeoWlluG+NDEykMTVtWhneYYJSPNbUzIMUKDTFzNgYZNga EkDGA4RMGnpLlz2BVhjaYu9Eh7FQ0KaPiXkYcrtfsvOOxXfgdMT6KlWlELbOPuMsiNyx+D9J kKaPPapMyiX6T38uznV0lgaVZviN15vQEsTDEHohIUPkbKGSdi3DYTdbG+pCQ+8Sb9vgPrnh hm9im0Xa5QwvXdJk1xtuvIYiF00fe/rpZVFliG6Yq4lbgp/ZoZNFMyFUZn4BE2M90elUeMeF 71KIG9+49F5L1B8aqircaVQEE18xif/KhVc9suTh33tDv7ATIzv4c8a7TWQ/TR8DA6GpJw5D 1AhkaDTZBsJQBe8tH+vrLGwhjalxFgmYd8ON135+4VVf/tI1mKiB4XNM8sJ+TpjgAvdiysv/ WXipyk9j/2FKkOO/9IBUKBxy8CHqe5q7eBuYI5rgEQSxkdTfe6+XqoKUxhMPPHCM0lkWDyXR eYSLcN9q08eWma4cRDcMBcyeOftJOQx/9FFz8NqQZrzjBcwLz/OHvWADqnPYrMPQGLzt9tu4 u4rpYyi69xfi31o90PHE3wYeAnwt7pkjS6m6mIiEah72bP6EHIlDEcI0moeI719f9HVvEF/U TL2ikOXKanQUqQezEdHNrAomTCcNZAnhRoUNA2SYe3X66Weog1+YCvu922/lFy0R13Dif3av P3yr2olbzpt0HryuhKzKQGl+Uw9RIzr2pL6AaRQHCL9rGQUnCqIhEn994klaY4r5Qd+8ZfNH zzoPozn4EB31whQEnrRB08d+Igeq/QvNu3Duv/9evAKFq9MWyACIx6Zfv2kRa7QlMF8M8Vqr KSLpZZ/79N8uOBN0LkKgQVzD1A36R7EBJqGj8aVO4CDk/1p8x4tyzgSBRM8O0XEGHYEMPGjz 0igYPcQkKWre4mkAZdVvRDcEMsw440CGrMpAaXrhMUoHRXtTErM6fn7/fQ/IOR80fQy9SI6q Kgimlc09cS4eBfz4Z+J1Jf3gyCFjhqaL+VXztJE4XFp4aem/7/5vrTXKsn6CVLBGonJWGqBL RfIsESnRo6eBIeF2cAmNScgWtSMTCkbKaGbZ8uXL8LqSzS82epwNfuVqFQ/g60dA9/BQPGz1 dzmztjLAgNEfcdR3YmqQpiYwGmXczvXsiH6ZnWGmBtKeRRGm6JwAkogwBkDcorDxGDHF8os2 AaWRoqgRSSOUV6AxZpo1nTz/qrDo0SWCvKhzkAuLWzFNAiZaGC5xruT51bodXCpNqZgTW1gv o/1K85FjGcIWhGqZUjaMJHOZgEgw82/IaDNLPDUTkHg1Hoc3A8nBq9gi3Sd+FXJUWDJGS4Ko Y+MxRp/aApmvPhoDbbpN9tZIM/lH0EyqTbzk4RC3kc2G6T5BRqiENaVANuYH+xPWNmfLPZB7 YBx7oKWeWDiO/WKqGv8dCZ+x35hqEomhZQJi08HgNoamoituHFuGN5UX0xnDPk/scWL05ehH k2VMNkVjYLqa0KSSiKji4K9xsD+tJlVrns49UK8HtAu/NrhMQEyq+e5omAaT1tpoZGvYUMpx LXxg5tELIoo1BhI0g0ZkayXkXctaPZfL5R7IPdA0HohpkWmxtWnMTmQIG8//JZoYMdhKNWYl G/pzqRVEwVM6qkRNb1KAxrUOSHWn2J4MwRmzduuio+ZhrAxUhAGVnBjuF4fxWYDC1yxJ9oXp FPqVkHUim60SXGUPih/OmIAFErH7zzQZlHRYZDQu4o1+q9J5iyzqn5ySeyD3wBjzQEyLLOva uEOtGmGz0YytlYyT7B8M775DyjA5CwtjTN97n25vFYeXXnrphVXPG+fQYslmLB82ffreEHzj jddfXL0qumOIh3b63gJNrFWw/Jk/8LsBXDdv158JPD01+sIAOJ9c+jjenmERvFaJ2fzRDYHI d3g32/LeqABQXz9gQCTIDFspWWV7LYFKo1UjSzAHFVNnVV2cRkVwaqKCMAZr+NHqV1hEDC8w aNODydr/kDsbESC8jZWL4G1aJheCq1Y9r81i3dfbfQomPRQxCev2wBgx9V/OrcXbQgDcRwLi 9OFlQ/d8WnUjJbxMjtcwcbl/M/JeN+1X9Atv76Lj4rZBEmwvvsDrXrD31AS9Oi62ZZowAbNk +W1z5kER0rR+mW1+PzFv3Sq2aEp5H/rs3DQjqJQgbGyKBEUT+h7nTy1xdarT/dlJIOJ18cXK 6j1Yc/Hcc87H8mSYzbx+/RvgxHvRJxbmYrkrLEKvzkrHJhqYto5p5VgpEGyzZh2G7LHvPR6v 4ICN3IoXnq5YeBVeN8GrOVjoQqxLcdqH8cGLRPwmE2TpfSAOZMYp6SDineEvfvlKsoFW++HX DLhGlMBeOEYQKlVfP1AFyQzUSLWNGFARAjS+loBSdq+6jQBkMTMZRXi9XAtk5B8w4NQAGfGR BYF2yacvw4sT7FtxCsTnpOuu/6qovidM1v5HsCFbAW9lnXvOx+BtnLk3178JcO+1h7nz55/6 Oe+kUF3IOahINJCxVymQYQ2ML3xenD68nUOnDzP+8fnuHbc59hNSN1LiTYnWvbbuf8Iz77Fi IibZ095Fsdsg0bZMtkn5VK9veLGStkrCK03nfOJcovM3ipCmQOaGwpV2+w/v0CaX0SkzBCY+ l4YyVu4nuD9K+VQ9TR0rnIdyfEa4RRY2YaRyvEkPKUR76vzzP3HWmec+/thvafUeULALEd4e xwZItJ0POKmBhrvxX66+nmMZmgMIW9o7N2iVgO3KK770GbkxEm5IIKjbKaGFcvllV+ANoXWv vqI1MVQ3INaoC8lC6iPeGz9oHai3rioSTeNe5eAYLTVSEDtw32IXEm2bSyykQUVGqaPnHAs6 wgfeuk+rUQNETRH6QVRjPU4B9kmCwy+95HLjVk/gR8vOO3fbsNoHO5YaaAiU11x9nRrLNKW2 7D9+Rpy+f7n2K1ghlu5AtOYWXnYF9hPCvgoPRhp0Nhy47ozTz/j1o782vmMEKfM2SJf8QxQQ IeYiE52DCUSgDq9GovnmWN4HS2gIcC/0oHWGuPaVa69+IHGNooY1CSWrMTL4M8nHXWsNwc2c rpTCNskgVN37858gTev8oOhj538CUewrV+Nl7GDxFjQBsIwf2hRYNoPXYhSrMKK/sOimDRvx z08GF3APo+WF1bhwNwIN/+doVixZ8jDfVxBBu4O2/MErimRGkm9I0eo6eJtXrQKl1e8kaA4e tC4Rj6I7GGCl/6VySZmo+Jw5x6Di2JIKLkJ7KsqgUnxnqSQl/alPXoJIetPN16utQpwC7EWA 4I4Xud/9LjP+34tzt+1LV1+lehuCiPsI6LixeTVERZsrSacPb93zOtfgRqfyf7wdm2jNRfa8 C6hQWHznYlwJ5555bpQNCPUcfKswCCh/WvMyXsycN/dkdb1/ZgglnCcDsVt8QgKG2zso99HI Kz7ZqcHDJy3qN8kYvwNl5lRWgcyM3rTUda++yrahU4mr7b77xCYdTOQE1sVGjMOKQESh4TMu 5QR24sH9tsMOO4KCJR+YribQ2AFPT0+6lTZFl2pEDsSjWeElZBGX4Rn1DWrVECx4jdCDimO/ S9CpdaYyJE9DEf4GsBqPGoxY/O4f3wm/zZhxEFM4gU4lLPz5fT8znjusTI0Yh9UimT9JYtIk 8+nDiBuaRalO36vrXsX2bni1ezYvHJbEgjp4bhLLVBQuOO/jdWCMSdHtNJBhgAana2vPFnzv u69YlBG7jhtPIOLIH1f8EWNntDD8M88sBxs6m9o+cmhHoF9JtxO2AsD9g8EdLDONW1SFRbfR tgWGyqamaTT9t489qhIbkcbmI9S7ZHA8N0BFtM4ml9IyG1hRA7VGa864S5P658qC0cR73iMG cWybyCC6YfVq0VIL/eULGDp3tM2PCkt6vXP3HCqFjqFa6k5jJU7UGqNsHz//QmxHgtEcMaCD T6Fw8aUXXaftYEIm2dtXi779TTjnk5/4pFtp8lJpi1kCfVg0A7F0LVbFIE43vxmFqHFVY3wf RM+7sM1lautMS8vuDytBQvaIBBjGyASlKQ8yzH6NJDaawhazY7UyRBm0s2jNxenTp6MIC/6Q pqg7Xlr9Iro2GL3GgBoaaAcffAgWk8G4DD5YLIgebj76aLCGPe4frJD14Q8twMAZPriOX17z J9yleP5obDiwYUhgZyDeBAjZKVOmosVx//33qR0uld+Yxgpl6IpGi7AnpsMAikfoXXLkwoI/ tn4lBqHgE7ShqMGIleBQU6x4oQ3tR20wUmiVelpLzsjARJwd9QTRg2NHpeB22Imhd/cDR8ZH ArHgh3cuPv3DC2iAn04fFnpGuDTtLh5/lS769qKFly3EOl/RJ5iqXnd6rz33+oa3DZJafYhg zUVtOyVkMbqPsblH7GNzbl1cGl83Zg0SoRtWe5TJXCEmptaeqCKQjf8D95hWSVydvOaiVuTO 4r5FywvjQdjdGhENcQdBDQ838dQMwYvDDRJoqmB/pn323vftb58uhnjEioYfRheJnz+6FVEp oi2iGYaiorMQkoin5UHvkhtWaEti5IvG9aI4tKQ179KEWRRwMob/agtkUfzRpXx/8e1YIfav 3zdv332C04e4hq7lVV++MmZxrojpWF9szlFzTp57srqEYYQrS8INX79h0U3fPP/Mc69NvOxi lupHA6v5Axn/A9UexDFgr/7bb96yiRdcZJ+jiUGNC6ZwAnuCIL1li7+rDdJoAnArAEENLRHE mrPOPOexxx7lyQRAQzgj6wGOoEbzBvAYDgPYDK4lMOiuPrVEKfDxOO9TF19iHD/SxCnr7TZ0 i7HITUTvEm1VaETt3P1KWhx8t113o54vYNEdm+UNsfEJc+tKVCqx6NGhTYTOneQNcdG5w2qU IWqCDNplCGfEiDllCGp/ccSRWHfwHy64+Iv202cDxgqrty267ePnffyyK8Tz0BqOl9e8TE8t jdXUAJ9/8QWMzeGJ5AOPPEjTyiClCqa6lzTn+zMnFJUqMsjEIKWwW7N2CHZNhDkizFxiSEgV omi7GCNDFMOK2PjgoSQ+WhR7xhv2OvJI68PEA8UW370UubDUMmZgqE4F/d9uvpZWW6bJqIhr uL3V0TEKaohQaAliMoEqHpsGPh6AYqAH8wximetkgC5YSHuXOPqViHRorEEXWmH8gYU4NOck tIf+ZjDH2MgPzJ/f8yve107lecbbkIW2+VHpnKbt2dUZxVxkS2ByLI2OMQOCGqaPYYAMzjGu AcuctgQPXX3g5A/YeLKlY3IZrL04u7G5bM3LHG27CGTsNcR7+jAFCRrmP/7496lETmOKGUap sK4/UfD4ct5J7+dSTmB6EacxuxK3Nw1gM5ES673pmhoxNktLYMeyZcJAvUvqV9qeV9IDSsyS O3n+8fy52Nul6RD7Lk0O89DYRIOOe7UBp3e20BQChfYYDoq8FA3zH+9t86MVIfve8OZSNA/2 YB49VC4FvBIAfppvgdOHXuQRhwul2kGzbTWinwWa88BmJeiZYuhq4sSJPiOaJfTRBMmwOEBN KJr95rcXYfbJRcoa/FEen2I0w8YdZ54PxrXzEqk02DQ76GMokDXKFWigYU85DHUt8Jpa6mlC n4WmmP1g8R3kREQ0xDV1Cwyi4+pHAtO48Y0BI3zPO2k+xAmNeJDFmBomXlE24TekMHiP+zx5 1zIhspENvUtUELNwoZFH/TVO9KPxb68Nh6FP7d6lSQPRsphCAb2fv/wqjY7mGM3M4D67yoAm JJSix/eRcDMZPPAbTTHDov4sQsxoUap3GSaO0YMLYqOIecq8+ehRsiAS2KcWI+6Y668S5flN dHFi6Ap1PHX+qYSgXmkqZlbpXz3yAE0r23nKVA0zkbmajMyy6yQh7S/X25Bg8CQJVXHzj5Gp 1jYqff31/3L11ddjrj+20f7dY4/SLDPeigkTZXn7XkS0WbNmo8GFwRc0WLAm/e677w4pxEFE KO/FzCJuOTxnxGDTjTfcgsd5eJ0IdqPfhPsfnS/b8DnVbUp4iyY8ziMpzHdXK2/cqIkCKNjw yJKHrlQp29uUKg/1LuntBZXOaZo+ht4uUzgR3aXJaAk6ktGgjEnFaBZBLx7aYq4J3n/gHZgQ O/71+q+yFi2Boq9efR1emaBzR01jeBubhoATE2XV55XY7+7AGQd9YeFV9973MzovszxORG08 qSRkvKX0v/ffh+kXN99wy0Py9BEbTh9Ni9VsSJjFW5M0dJWQX2WbOmWq7Y1LekVJZeY0ppV9 d9FtiJ5v1NQVYJzmT2TzriXC50gdrArhPLMDY1gLF16CrcjRc0RIYly01O686we4t5mCiHbZ 5z5z8Sc/g1uOR7swgobnCZiZ4bEJC7ELd0/PVmzyiJDHsnhkibmd0XuYGZDANUfvNjIRjQjs 3alJsWpmQ4IfaKAJg49aRGkYwM9Vo6VMQe8SUdjWr6TpY/f89G4+EywY3aXJaAkm3GvVIQS8 hIT4i/mrqvHYmQ3vNtiew0AQRZcvvBSvcEEQTTM2Bn5D2NJGx5BFaMM2VOg8Mid6fN/93q0q 5/U3fQ1BH1PkNbYf/fjOBO8nwTEh3/CVCipmYGAzSpxl1p4wARHba5KOQEZjc+eedY5bi2+u tDo6Pm8UV8fawRB9CEBSKrgmosF6jmJvaYWGLJCJW8w5m3/Kew0s6UnSCekla5RIUeGoBoe1 2Mp30sQdIMKvKxmZ0XM55JCZYMPTTDXSSV2+eejF0ER/zJLFLWeEkiJj4Fd1euPqwk4zxjuj m8gYdBInea9VRF8LV6XAjCmymFwG4pq1L9NucsbqCEBvov/Ty59yzLrQZUVedZWvXGeTNllv 77BAOCeFG/CbMJBpmm2BLMRm8EpQ7iwM2LRUS6HaWqjkgUxziyFb0wVkPik1QRlMGi2SWquG 1iUJeBIeo6NCgnI1wRAxIhaUqi6QbEEpUUTewKezsbiBV5bhV4rJX6WoMUndHD1v1qpzJTFX lzEjO6gAoECW2RhZ1KQkFXGYGFfE8FHNcaKjV862svWjZ0stmseo2bVUNSwz1k9cuDYxOe0s c93dYrVJuTGTl46hp5bJK5Vz5h7IPbB9eSCzFlnUbdFArsXsqEhzUqgiKY1n9qgbRC1rwmxO 92RpFXstS1CJZQbHQDExmIulcKpfPucZYiYzoDaFbK9RSZVAJZP8NfIGRPPAn+zI+3w2cxPq CLRtHzP7lfrmyXHiAdstME6ql1cjpQfyrmVKh+XsI+KB1lJp3rSJc4eGWktlVojgxR8m5onc A/DAiAYyNBjTtxnNp8lbJAoPfMUz3+b+c3YZmKFDzG4aO1TVTV1tbacN9R/3yE+62nqHq5Xm rwSdx6yu7drqqzowLQLJRr9DOLIYPU3/U8Otp60yJrMhRchIXXpC5wvyDRwjC5TkqdwDiT0w ecKEs/p6pry6rNo9aWCovRo0yBJD5IzbnwdGIZDxHxfC7hg66jOb68owY6jqDTSV/UI6pu24 w9kbX3vb+pUDnd3btvUNi39mjSW1MfXKp1aYsYDbfndpnaZo4MZrNwlPrBkaiI3faAAxj2jX 0mZfTs89AA90tbScuWH9Tm+sHGhpa23vrBQrA5WhgpxmnvBazz05ch7AKaFP/SoRopJ8WKNM 8N/cKLTI6q91jjD+PNDd2fF3W3qmv7W80t7RMdDx5lBva0tLYXgQl/cYGCRr7vOBu95xwMNg wPeYO1SzY14ad7ugzpqT7zJRQSCxJyMTXXXWOirOZjeneVGDM6Folf1QS3XGhpWllomlgeFN xb5SqVQZqlaGh2vQpSHXgDAmRNJVky8yY92SYWlcASQVeHmNh7UFzExKnzDOTQMyPnnXMr07 cwmTByZ1d3e2tZlK4mnzd9ll9oqnJrZ1tFXaetvK5WJLeXBwuFwtbdlWlF3LeJScYzv2QEzX 0hZHbXF3e/Ak+WT79AC2xZs6PNzd1lJGk6laKZdEi77U19s9XNntxVW9nR0v77ZHtb2tBXMm MFCPAYxSsVitFsvwlvg39X78YQ38FCuloWpx187Ok1Ys72zrQNAaLg91DBcH8Dtc6Sp2l/s3 HD515paegWJ5GIWD5ZbnNmx1XGPb50lxOKShRUZvp40YNv60lscEsrRwOf/49kB/X9/UqTtP +9WvplU3FUotwy2tpY7SxM7O9t6+tsJQsdC127Ov7VTuOnTXnYtDm/srlc5SeWDrNkQrmnqE 0a6hcqXqHXBUb/dQoa84udpVbm8ZxIjY0DAua/BUKv2tra2lofZicfPsJT/aYYfh6lC5dbBl XbH7uelip/cxc9BtarzjG1kHoTBxhCBml43ae0U2yzWIxAbY8FLRyzMOmJ5KoGmYDX4ykJrG XGnIWLBR2hr9RSvrtd6eA2bM6F/1h+GJ7RMLrcXKcLFSaGltL5baWqutO02Y9OZA7/rebW2l CRs7Ojbi0WNbR2+hv69c3NZS6CsXelsK/UgXCxuwJXulZVrHRHikr1REeEOwo7mWhUJrpTLU V+7duHFgc+cOU1paBjDFv1zdMlxZOnmPqFUjSkl6ApPyCePT8MZW1o8nmWJGldrgA3qQikoH lGRcAb+WgjgmGpYLte5rSeq1EKzpSJjlmtSPxgiMmdCGEWRz2chmM9MIGpZCVXep9a9232d5 z597C8N4tthfGKqWi5PK7YPoD1aG9+ucsLZtwt27vu2p0vBQsVgqlIZKZaVqVcSsYqk0uaPj E6+umdi3tdo63DZUqZQKA6UKFsiDHUPVUrVY2TbU2zt5zycPedcvq4WZbS1HP/mz9uqQ0coR cJdQwXWIGGEzgOg2OePQNWO7MZlNT9iU6Xxp8jZMk4kBzUsJUZu4Z0LAr1jklFD4lGTetVSc kSeTeaA0OHjALvu+srm8cc0bHa3D+EucUO7snji5AzMnqqWhrb37DFd33Lzhz23tz1YqaGSp qJw5etfd3t6zCVf5YLU6XKwOYxAN42lFjK0h+G1rGy4+trH9qSPesW4Dmm6FDbvuVunZMtw9 QYXK09u5B+haou9ReGoJxfTZzk/D2K1+a2Fwy+bNpcn7VD54WqVfTGRt2VbtHxwoloYxuI/x /+H+zTtvfP38nr6TOydNlbufqSf90CnTPvjcs9XWCtpmvh+8niUNn6G/uuLPPWuPP23Nli1U 2gq2Is+N9a+f7epCGqOVZbM50aDLXl5GNcGjBah+asJoiBB5rSHQOShOerEwVBkaGijd89Kr a4+b/8bmwfbOQkt/X3+lOlwqlCdOGpq600BH+w6bXp+34fWTBoZ285a9Z89N7u4+d8vGaqm3 NNymrAZGQazaWqyuWd//xIEzH39tDYvgCQCU5lMx2CFaQjxNoY9W0LCsuMVYKUUBm670dyNH PXeCFBJPXYHMZnlOH98eGBatIwyIDZZaWn756ivrj33f5n4MyG8rbdo0MLCt2Nvb3jfQWmjF 1pKtlb4TB/tO+dO6vSb5u9KiyfaR/s7pb7zQ3blDsYB5GbgOxYGBs0HsIlEpbe3tf2HPQ1ZO niKG/+WByxSDIJjJIQn5b+CBZnAKbFA/gXEjlRqFQMaNuHrqKP9+XCeRPVuPIptsJrWwgTc5 fQiD8pVt2zowsiVeH7r/jY2vHDZ7eEv/cGV4aLCv0lquFEqVMiZRVNoKbeXNm44tDM5/Zd3b J4hYdszb337chnXF9h0Lw0OlIibuw5HiKBVbkUUv9Ym3Bp7c/W2btobmi6G72oJno4USnVMS yeY77iqhdoc0M1an4bqI06Bjpquj0uPWgUYwL6rtWULfBnfJWrE31ET9luaD/fX7cHtEQNsI sy4oCKFP+GDf4I577r/n+lWYAjvYOtg5OFRoKQ8VBsWQWaG9q7t0fN/Q0NrXVh48429eWdde QBBsKfaXKgP99GoJrunWQrGr3PrbdetenjN37Ztvaj4V8RK75bR0aPQ8Cw/Ae6N+aDb4/04j aNZoBjKqPNfZvytGsPK5qto8IHp43ogWi2/YvPlX++07d+umvfr7B7oHO8UQPh5GoutYGWwp DGJCa/vwcdXyCctXdXYWBjvaSgPoTBbRJCME/FSrPWvWD6484D2/3/QWw3JCBDI09JovkGk3 MBvsTtQm5cZMUppWL9+bScDr4bEZltyALLuW0EqfeqrUCFm4iT7NZCFZZK5uc7pRsbU67AUz tQfx0muvPfrOmUOD5YH+vuH2sngc0FroETP50cksdgyXuluKHVPatra1DJTb2odaKkMD1YI3 lR9dEkS84YGntg0/u8OUIdOL4uJCb21v7cp0+oXrDAQj2UqtM0pmcRUGA+0ZGZUtjHBt+FGA OIM4yOd+hkjZfGcZyLKxKEdpeg9gGL6/MliJTE996vXXn/jLI1qGWvoGtqGJ1TJUaCuVh0t9 1fLwcLlluNCONlhnpdCGWfstfYX2CsZTyqXituH+9kJp5euVPx177NqNeqeSnIFnocW29o4d d2p63+QGGjxAgYuDGCUMfClJhEP/C6Jxb/ykxAyxM2CIGskQG1cvUp49oRG6qBbZ29rEiHjU iPmr/MBRtfS+199Yv+v+A72b4Wr3gcmvrW2dg5WBCdWh17dtfOJtb3/ydUMUCy7WwYH+TRvd mPWUqi0IpFMeoUs+28uM0FLa47OzJbWBaOK1gcAU4U7lUYB4IKBBW6qncWlZVShvkaneyNOJ PIARq4qIZYYDL0XetWN736S3F7C4a9yBVl2xrdRWav99X2XV3m+HrE0Cd0LL0EChz58fa2PL 6c3pAQQgHI4wVL/ZjQ1k9D9Vv5U2hND/oI0pp2ftAVyR6BZWxf5G4r9WO9a+uf6X06bhRSW8 MA4GMWPCdGB262BfL94HeP2NbesOOuylN98wcfk0qGktDLeZhs8cUuYieT/V1wQzY9dDlXa5 MIQvvbEnF9OYKFNG0MSJ4MpTIn0VrIGs0TEoaipVIX1sqrXqUQtySnIPlNqGh7Buj/l4rGfz wwcdXOrvxfh+Ce+DI2jxgcGMopgPVqxglZ/W0kDr0xMnLS0MmoEkFQ3AcrG9BfPSmuPg+645 zDFY0bi7guveOBWG+sSRrIEsTjAv3449gFeR/MYRLmbz8atCYd0u+w9W+vrxQqXP4l/5IpKh YVEsthfL/cOD6/bc8c3eHjOKQqUxFoWQJ3MPBB6ICWTp20cBdMJUJiqooep1wxOqDbGRDSHS CGVc/2qZeKYR9ahitbBBLFoB42Gj+di6re+u3aeWhgfasV4Z1sDwDxG/cGB9WYgND1V37Or8 qz++fPye+ipj5Bd8y0PIQFBm0/0ymkjITk06CMlNUDKH39C1EylVGFl1iGbNsM1WDlNBbVIm pKQ01uiuewwcX+uUYNAYsaA4JpAFjHkq94D0AILS0DANzOOKsx6Tii2t/f1bvEuM4hhYRTDy whESlc6u6uDA23ZtP/Q3D+2/0xQrUFDgSQbZPDV+PMCxq7aAOK4CGYf1tKe3Nt+l1TJu+IeK 1cHKcD+GaO1NJDS13r/yuWprZ7mExWO5PYUnBNgcCTNkS5j2Xx7qH25pH6yUD+luO/KZpdN3 mWZzUamIVTGwQNBovohis43oI3AJiUkhaE667UhayvdK8kRS6Az4ZKuZvJrEt0kDGVW3NhNT ybLpqaQUw5LUWmHPKMmXQ0Z4TQ0DF+N5pJhHJnqX5uPoHaZ0bPrzQEepPNgn1hKTB5pmSFID Detbo4WGzZKwSvah5cFDXljV3tZmO39eSy7AkXihX5KNfoeYasowppTO8oTbqix1Zf/L1UmV SGIHAyZhzpAnaSDLUGUONeY9QHEIIcnSIttzytTDnn262t22w7ZSsbtFXZDHE/WHzBDf0MHE gSlpu7d3HPHaK0fs4K/2o7kItwfYlHiolefZ7d0D3p8l/7vE/OGJC4k+jXCbhkyhvTZFdY79 16a0cVKaZxqnKCmyODfiMPKDeky1PLF/444Dna+3tU/o82KQxwoJkhOyomPqPYoUF1WxvzC8 y+6T9lny64N32S0KKzzgHdEiUOhSMVtjFEhAZExKKBKhs8FsCkMkKTtKkQIzIaLRzKZR3VL4 z1E/mmyyrI+QjDk4KW7DEqKZ2RgaE3rMHDk194DdA9VitW9om9gG3BTLDp2288xnl7W0Tajg 2WR5sB8r+7SU24fKhXLHEAit7UPYEbMN+yaVxOrYmGXW2lpsby+2d2GljJmT2/d55g9TwivK whD0ZLF3b7GE7QHyYzv1AEUt/oYXkOZjPAcy+uvEd35k6wEEsqHCcAXRJXIgdh3/xlvVcl+x 1DJYrnYiOFULlYHKtuJAudKPqflvbd3agvfJsSz2cKWMNcuGh/sHBhDf+gqYFFuZ1FU6aOu6 GZXo/NhquVrGawIRheOcIO7VlA26xnuEbyxONF5nRAN7hkoiVwbbRomIPBGchWYZBjYXN4pK EbxR6FHcGjzTmL5R1LTMKIhg4iNe/NWP2bvssvuK54pl8XgRrhAtKQQgTNXoxqPLoVVbNv9g 6rTnO7o7sJpFC1pjeHG83NbaWunvx2Kzxc6OoeGBfScUdnniwf2nRp5g+t3QkMYMzy5B8XdI jciM0vUbsWPUCeyiVM5nqWztJ1icm0ggy1ZPjjYuPeANdEXHyDra245Zt3ZwUrk4jKVccY3J o7XUUi28uaFv8eQd7+nr/cWUaRu39RWxjxz6l3hnE027oUpr3wDiXW+1PFhuPaK7bZ9XXm0p Kx1JMZ5W03+ENCH/Hd8eiAtkzv8hZ6HVb24pd6kV1Fkg2+Z1Tup26mh8YSM8U5vVw9UCRr4q Vf3iOXzXXbqff77U0VlE3JLHMFaJLQwXNlceLrc9jfVhC4VH1r/5fFcXllXEctjFYcxIGxRd Rjx26h8sl1urbV07dU2Y/sKTB0zcAcxe/MI3Xs/EWJoPix/6SCXpfllcTUQg2N+U8MtVEaTd BzMb2dylRpEo0Q3ilYpB+qhgVpS0KsjgrLQTDqpnWI8sWx052rj0wJD31NHrcPn1m9TddcCL f+zobsNLQGW5hg+usGHsRl4d+v3Gtx6Yvsumbb3g7hse/s2++3X1Ya8STDHDLDIsTVaplBGs MPiG5RqHtxVK++/Utscfn+pqa+d2X7GaD/WPy0spm0rpf6pAbWD0zsbmHGWUPeBPohDL+ATH X0yessealb0FvAZeKXnbHaEMf7+dpfLmt3of3nefVd5i/NTCeui11x/HutV9fWgsKG9iii4r sqWOjvbOjv23/GkfrEHmHd48DdMgWaA/T23XHjAEMrM/EN5GNsI1UiH3MSlhrnE9VDI+vcOo 3Y3v5j6EmSEjJ3d17/MMXkgqt5Y726stgy1iMX4ciD2DA4MPTux+AjtYKgceVv50pymDhdZq Rczh8GaVCUiRKhQHBnuGyh37Tpq456qnp+2woyfn4aHNFhp7UxDtSRJRvy28fNIooXPVoFqH cObZQidXXmj2QOJAZhbPqdujB6oYpC+X1fn6x+zY1fXnNZWOHUqFFrwMPlwVyymWShhMG175 1sCSPXbv6cP8CnF4oUok/ri156kpewxXBobK2KoELbFt3j8l5CpD/YP9/f2tHW0zytt23yxW hcVYf0cb5p61C8n8yD0Q8UDKQMZ/WmEg819YmCeaSyJlURgFq4fC/4Vaoh5MXzZJHdOqaQRm KhuGi8WhYgm79FJUmjpp4q7Lni53laoDeHmyMlwcaq+0YY5YS6WyZXP/I3vs/tJbhh3eBiuV X3ZPGOxH+OrH65bY1hcPML1AV2kptZeHBzb1bNhlYvceLz4/sXtC//BQuVoc9juaMcYmPot8 cWXvUbLBZqi71CaVij4CKjR7UmkkZnxndZgDmXqGs9LUzDhqfTndzAaPrm20HpmYBQZnFQp/ OWGHttdeK7e0eVtKoGuIwf5KZQDzW9ufKXUt7TBfYxBc/taGFbse0N6/cai1pVTp8qadCUBE tFIZDzAxh6OyR+WtQ6ftWEJUHC60tCoTMgTjSByZ33LJjab7vNa7feQv5JHXGPjSepExi3et ci5P5B4oiEA2hJn9FSR2mjhp58cebZvSXhHzKcSBdlV/a7WjWFi1YeNv3/H2LZjsSgWRb9B/ Mql761B7oYwd4YKJZ+JRZrFcausY6u/dq9y764qlF777yJZJO1HcjMDkhNwDNU+I5eBLCc+T TEvl14RSip5U8LUza7PPageqRRL3uO329+HYb5yoRU9NMnhEgrn6A5jMKobBqqWdd+/p31pp GcRUMDywrJSqQ+XBnsG+p6dO/eOmTW4NKza8uWzfwwc3bRyo9mCXSzDD7QiQ/UOD/X0DaJe1 lyrFl5994Rc/LXZNGrJvs0Ra4r3mW2O9mghB/Xbbr5WyoEbPs432QHyLrNEW5PhjzgNYGrEf EafUjmeOm7Zu+cnUnUoT92odGiiJLZMqmA07sb+0str1+F5vG4wLPaj7TwpDWzomt2PLJbFj L/5asSwGXjQvYsxsuFLd2tq6V2f7K08/NDQw0NravAsrjrmTOM4MzujKwAWIA/9HdRxJMIin blW1WalVj22JR2NWDSJOktkZwCVBTCzjYq2vrFgtV4ZL7ZVNu26d0LN5S2tXR8/BB0z97VtD bYOTqh0tA+Wtw+0bdn9bS6Ww0+BwZ2d7Yct6RCfoFBb6U8LExTJQaC0jfLWUtuy259QXni90 Yv5F2LJqAW+e71Qov1zoe61nU2unebWysEw0l8h7UbHMKVrlGN9GZwZjojYpI9Q4ICYKZOqF sN26T3UCTvx26wfUHR3IrrZyZdPLM19bu/NAcfNLy4Z2aB/CGBbaUoWWvuHim9PaJlfe+NtX BoYmdHS+uLqzuhVzMcTbksVCm2hpiUM8KSh3Tulv39K3qaW9v9DV2oogJ1pheCQKZ4s5Y4Br xaz/wsDklsILW1/ftxPr+tNeAdnfetvzCc3emyOOmCiQqVbhEstPueqQ7TA9UGpd9dZg56Ty 5JbiKky1KHVt3lLdtnXDobvvPjg81Lvzzpt6+6sTOl5r6el+bWu1d6hdPNAU+1kiQHWUMdFM BCrRNOvZsK5Sat/cLpYs6662YCnZAiaoDbf09JVaCtUO0VWtDlW3Dhf27Oxe0f9WBZv47jZ5 O3R4XuVYD6QOZC5E2WgR84FqjncSxB0vmYvsGfnY6k0yJxs1W+I9lN5akkikiJjSq3CZrZWt 6mzdcthRg339uHrEkFahiun5u7xtj6lDlT02r36xq+vuastwz1B7567Dkwfbd+vYsn49I4Cf 0viZ9s7ZXRMn4OkngtobL63uf2sL5le0lgqTp095d7Gw/59WT+h/ZXOlr7PUiYcK/Zt7fzl3 duGVFxmKE/bKxnvMLsvw8YlYkFiGeB0RDveJru36jChJQSCNKQQyZc00kGVqWQ7WtB7YjP10 u9tbuttxL+EWxQfPjN7o63l86i47bimv7py0bWAjhr8GUNLR0lsYqk4R61hoB6TWbNxQwIcO LGE2ZfI2L71+W+WFQmHS7vu9c/LMvV95edobz3Vv3YKHmluGogsuaqh5djv1QPnAGdOzrzou cHQkxJf4jMAxkrriqhNf41qtjUeOs62u8thmRX+puEPL5McrA30JHlbGmtJfqbzc0/d0uf3V afvt2L37Dm+tX9fZ+Xq6CUMN91isT2Kr2XiGhjuBqpBKDZjpU3/10RbD+k6NCWR1WMc1zKqe ddgSL6pZi+yIhG5Pj9M6NszJlXFh/9DQhva29X3bsr29Nw0NLSuWevaeMfTG1g3tqfoQLkdl a6TRlYlV8OkyJozYyYkuJyRHsXF6FuOpTLojLb8DnQJZqsvCR1ONSHyqHJbkRePEAxjtWtcr 3vFuxLFyy9bCJLy0lB+5BwweqCWQJQ1eMuDR2D+UJxVU7JQY4km8OOIgmF/BiBVSeetNyyFP rrQLkK2Nq5YGorEzjMYmslymyRhYm49Ut80EwD4QNawbc+TdpNnv1yBEtRjl8Qj+RiwSKy91 i+6RJdcSyFQPjsHLYmQdnGvLPZB7oPEeQCCjWKRGpxRqITYysYztGxl1KVxgYSWDR8RaVsJO Mtg0gvYYtOek7DygnWU++y4NWuspVQNNk3WpGZ0yeKBaS4sstbXs+UQ+t8CTLEMxVwJMTSiB BKPXnGAlmnIzIDGxjJkpp9boAfZronNRo5I0YmRQbdawFNcqjeZR42WzG2RB/tJ4gxybw+Ye yD0wch4YkRaZrI73Zgq9PixJaX/DbWLxp6SF+gT/U5oEm5BAlHmTJrRmedh8HUQzLL09qoQG 5utiqsqq2zFu81ql2RmpK6wBpZbPUkCrRSLTtMsyS3PCWJpxKNTsizKEAZLmOJBp+Kp8jC61 2IGiIubp3AO5B3IPZOgBDmQOTEQnNVg5OPOiGA+wH8d9xB/3FYw501kU42qhey+NM/kSYwvS SLPQWEskCWQZ14k6mAD1HVyHn8VJC4ubpxiHeWz10S6BZEI2sAzobE9NltiEGDUDCxsNwbba KlOfATZUVlsfvF2aFNjU2+VCJZmAhBAbkInWsUHOzQf7G3D2csjcA7kHRtYDoxnIEJtFeKaf jAI1JtSrH9+ZrEJLOH2t8XLWKZS0kNAScqdijsPEf6T4APPG677x7pmHxfFnXH7GgrM+c/Fn CRTpS0xplPpWykTGRsTAxSvP9mKQtWS9MfapxQksYRY1oWI0JK0qU9PZKiNkYCbsWsLF6gFx 84ECsNK3mSOnNo0HDjhgxqSJkxphjna5qComdE+YPn1votjSKv92nqY7jb4dXt0evERO0GrK xISBTBNXXcpQPg/l6Vvl0yDyLDyQeym/DEwe4PsmdHMhgwL6NkmlooWQI5JsQKSkkQS3TW7N tQUyN2a60sB6L+VtUpEOwcGtvbqtPwoIdCsYcSeRhOK4FMCMkmxsRqoZhhIMn5G5KWF+9eAv nlj6eEqhkWGv3T/sU/a1arG7VOVMkmY0YjZqTIKTlkfTm1Y8K/7RD2RZ1STHqd8DO02ecugh 7yKcPyx/asPGYIlqDXyfvffbc4+9QFyz9uUXV2M913qPVRaQfffeby9P0ctrX7bxQPd+0p6n lz+13m52vVbm8s3qgaYLZBlOzoj6PKaBRgK2v5jwf5zGFS6ManZR0kIRfz0aVWsIbfLknS68 4FNHHTVnvTjenDJl6pQpU1auXPHFL1/J4ezvz7vw4IMP/e7tt370rPNmHDBjzdo1wNlzjz0h cN2N1/5+2RMq7Px5p75//qlTp0x9ec3L+O7q6npy6RPfWHSzyqOmMfC/67Rdr7/5ayB+/LwL Dzn40Ntuv/WciKJ/vfHaJ8OK3j/v1I+cfgasXbFyBbTAHiS+c/utGhvrYm+ndCCzM4CAzPZc sJEywUqJEFItecy/blYNV4PwVnfWaFll3Zpr11J/IINlVqehgIobZX7tFc8lAw+gIfYvV1/f 2dl1zbVfeXjJA1RwzJzjPnXxJV+44kufvvQiZkVIunLhVW+uf/MfPnUBNcTQNPvYeReA+KWr r+JYhqh09pnn/OjuO//91ltI9r1zjvu7M87+9qLvIpwxmppQB/5Bh6IveIou/NQF1BBD0+zj 510A4hevvoqD1N8tOOujZ57zv/ffd9sdt6IhhssMTbNPf/KSf1p41T8rbKqiMZ2mO41uqzFd ERhvjRo1VSyT6Re4fvijW8Gu1wvyfNN44IOnLdhjjz2vv/EajmIwDenv3PYtPNlEqGJL0fBB FLt84aXcnURi4ZWf7e3t/ZsPLSA2REBEse/dcRtHMdAfWvLA5xZeCtm/OmoOozkSpOiyhZdy dxKJz3mKTpeKjp1zHKLYXXffed3NX+Pu5AurX/jkpRehGfjZT1/mwB/rRbit1E+zVUe1zZbO ymbg48Bug75HssLNCocMC05XVrgKjjrjLEgrDKEke0pLeEwmWkg6eYah3CLMRgk3s7t0+t77 /H7ZUq86DC5YAABAAElEQVQ9xX9IIvHTe38MQRoLY4Tvf/973Nlk4sOPPHjgjIMo+9cnnoTO 3fcX386llIDULYu+zsRYs+/4/vc4PLHUQ4qiuZ6ib8pGH3gY88avX49Q+IF5p7JgNMHM0aLM KW5d7lLFGPXsKOT0SdJo+06Pl1zCptNGT4qcSYssqbKcrzk9sHz5U/ff//OobehyasRt27ap rTYuXfn8is7OTsq+e+as3z32KBepiaXLnqCRNZVoTEMRGnHRIk3Rby2K0C6Dov323T+KkFPG pQeCMTKERByI+U11kFXCJC8VmBeksrY3vNSO0BMYYdJlKuWnCo0zUzOFrahB4w+81hMQILvP 3vtTE2y33Xc/7r0naFrWrHlZo2hZ9CtBsQUyFD377DM8IVaTVbPoG6rZaBr9ShARyMhslYFc AUV7y5m3amkj0gmd72bjUrKwhvPYiKqNCqbmCocNzBkEMgd3JkWsEmjb80lK7kzy2Aj4Ci2v T1zwqVmzZmO8n8zbtq0XMetPf3oJY2fJDWZOHthiCid6erZyuv7ELTctcoCgh+sopSK+LEfA z7HGpGEI2et4zhjiS6PAwctOc/DUV5Ta6swDGSxANenbWhfisBbnBSPoAXpkiRGlO+9a/LvH fvvi6udV5ffeY+jfqQyjm/6Xa78CA7Srnm+zTVs2j655zaCdvdEMxjTOBj2QcbW1i6NxFqRC DswLUqkAUjMLPSZf6C8JaMDSPP9XIshfjduVlUiCJ4k48ydhBuaJJ85Ds+uKKy/DYL9dxF4S tn2zFzsw2cI4wgVezEQLS7g67o66kCJ881QMwKpWzp552KZNb2m6HFnSpSKEmdmWMDmcYyY7 jhCI0xXwIOWGEqzicHCxUcQ5ut/6fWO020iE3Y6alEa3Wrn2UffAhO6Ja9eu4Slgqj2nzDtN zSZJAwfj9O+eOdvIjLlgmElrLEpLpPjFj0qj4phKdsKx74vSc8q49MBYDWSIzf4HwwNBRlIb f66C6RrewkExCqWFxWJV/cRI1VdMOlNhSDN9oROOjwYC/FniT5U+ZmxMeT16zjHRJ57gxtRZ s0wcVTOM2DFl5JST5quiXOUzF5yFp6iPZ/PyJqOqqmLSbLBDOAkP1GhsnI2xoFmLxQWk2MbV SZJQ5PRk5oEM9uCgb12ZmlftVul52uEB1WnxLnYAKUXrXluHruXRc45XaCL5+cv/+YADDtSI SbL/tfgOsF1z9XVaLMOLR5iZgfZaEpAkPPfd/3MM7X3h8qs0ZnQqMWkWI/1qr1PjsWU1D2fl ZJu6EaFT6GiS70bVWB8jS68ng3MNCDVIp7chl6jdAz+79+53vXPm5y77PPqDv1/2JIAO2H/G 0Ucf29XV+b07voP5+ieeeBKmYtAUjSRqMNcfryvhpSW8kPTIkoeBCcDDDz8Cb0H++jdLXn/9 z9FhsiSwUZ4Hlzyw++5vw+T+m6/7xi9+df8Wb3hu1szZaA/iFYJ/+vKVUZGcMl49UD5oxvSa 6ya6V0rHLkE7rGZVMYLaH6m1OU58MWC1FBsMSACDTjF9vJ8EAmGWJLVhw8KiItfV2f3U07/f +NaGJb9+qFKp7DJt19mzDzvowHdMmzbtiSceu/ZrX378id/++bU/l0rlgcGB5c88PXHCpE2b NyERgSqWy+X+vv6lv/ffo3zttVfv/+X/trW24Q0nD3CX559fiaei3/v+dwCyefOmP3gganpS mA5FxKPpKnmKnpSKwLN27Vq8mHnoIe+EInza2toeePiBL1/zxW19dTb9fM85HKjZ5simOlNJ mKGLDUvI7zAvkyLNHnc2E43khBZsM44Rm9PmH2METdJE8qZ9wmD/0B9ISHqS3yTqkuAQTwxa THFyPVbOtK7wJ+HWZFhCoYRsapViRSRDcA2wuCxiQqJErFQsg6omFbMq6KX1StWHJiBTIaRi TgvuVTDjL91fGcOb4aC0vVBpL1b0riW7j+emmwGam2rzqV87W7FWKfaFRk+S1WRZo4Xub5gq 2eqJa0ms2054pDv96mq+tztBk7MzpizRcBPbk0iNBp5IZuwzodZUcT2QyaqNtFtUfdmeYFmj Ef1VqwPFDa0R62qoFqf7WDPbEhpm4GInSKLCQIHHniFyrPoRVq2pg3kjWdlYbzSIIVrrhIps gSy502pWbbVQQ0xuihUxL8g9kHtgXHsAI2Wh+skgIn9DhSOUCVuUpVJjrazqjNxsjlWMOYIE 99P9sTOW5URYF/U0MeUsgECKmUPUIEPcNi5zKWswiTkLhd4IJqGwXGBbwhRLmswxYEQMMPAw icGJklAFi2uJ+tHSImj8mdRCq1T9WaOR9cPGIFSt28ElP8vZW64hJjclprZ5ce6B3APj1AO2 rmWi6qZ9NpcIdMSZtLjJ+mMCaG1iNlCN7oH7TwBEU8zPs20ioYmEyqwZttqXZhAq4KwVwFCg YxpYUpMagakZwSqoZVlT1TXIurKKPSGcUTcsZE0zZVSP1RXIvEol97OqN4U/IJZcRwrc0WDV XNCIepGKRiAndhgr96vb6DPIXmXFiU3NjJFtAOJImqHqzawyYweIq19/IEteacf5ZXvMaFox gEBxwJlRcmrugdwD49QD1kCWKEwkYmLPaeGI6fGJqJ4oxUepXYluhg3JqpoANDEnt5WXpGQx 9zFJQ5KephS1hntiCKwLa/R9IYtj0XTfRfKMgBKJGmEyEVTBWNlUzPJZha81pazJVknToCQ5 XcVZKls0hh2ZhM34zLVbA1nmmpwXcEx9tWLcCaCkuh8aUJ0cMvdA7oFm8cBIBjJHnaNBSYtd IVkq0ziiECGZsZDhGmVYF8LMCjAlGqnlavnnAPms7HGfVV2xxz0yqo2GafaMoiVG88YokdzY Mt686a6PdinVdOo0DLdCf6oVK4rhZj4voTFLxf4sMw1algYQmnhQEKRYyOdlESrQiwNBY4rY GcPIUycxUxWapVxbYWMoM1KRN5VzNAtTyWo1Z9l6MBlkVBKZr0c2KrXIleYeyD2wXXugSbqW I3UObP9Eqv6U/0pGdqse4rYW+3aYuVjKK+YnAP7Yv1oFSisolASZMTR2hdcrIT4Wkwmf7P24 oRRdzChRwu0dLtZMcmQDIMVYB79apMmiSBogf1VukRYSUSnisslQqfu7EZhujVxqU80MYy7R tIHMcYWYz4JGdciPuZOUG5x7IPeA2wNNG8gcZttiVCiUhTIemE3MoWn8FZFbmsoVTWjS6J73 6KWr2tNU5041rJ60u8pJkMdiIEtSrzp4Yq+UBF7XWHRILtYLQmYzF1EDXkrJYvPYPyNJNp8Q oDBH6kTwapoTjTQrLGG7E6pNYL/GwsCKaqYZEkZxRVZJBtK+kFEWXEaZQDpPZeQB+J+G+fPB /ow8msPkHsg9MHoe0JfxGQlLbP9iI6E7Cx3p/225xulFA4N1EMbyCuLH/gnJZ/bbDIyhFIqk T+diqZt+mayPgQcFhCe+pajE5F+fhcsDkVBKw3Szh5k13nBhSEk0o8kygwSRv1zgJ3w5o7hN Rsdw5o3IUYlMdEVhQUlogFG2IUSvqs3ZtXT7ynaObHTfe9jow+bHGEmbWE7PzgPaucnPSHau 3S6QMpgQq12C8W6Lv0hNHIGaIOXUFQWJUnyAKCJYQbQKWOWcFjVfIVc8rqYjbTobxoqbzUI2 rDkTUQc2p531W4ULA5/mbJHVX7smRdAur9puTgIJZCkloVP1MW2hOk6FcG9gADtb2uATwhyW QmbSyhk0nGB2lcyinFBLpYixEIyyXJWxpuNAbGBCLk7WqjQviPVAPtgf66KcIfdA7oGm9gD+ PVqq8i/E+HchC/1qGHmsVUzHbYXxCzRTjOzZajSqyJTI9iapnKZZl2UIWRAzLUODM2Ulkmyz hFXopVEE5qAiFveyVKjQlKRg0IQJwvLtFrUgsRDvqKCic6lKdKSNShQQJRmg+EJGWeYySnJp nhAesK/Zn8I/qqO1U+IoSqFAZ1VRtTJVv5rW2CjrwPFvowgErnlVSk1HVUSkoyw5JbEHNG+6 XZ8YNWccJx7IeIxstC+vVPq1W0M7o4ACgwaIqaBuqQAkHPKIToBJEQKsPBXxQNSJ2qmKSOSE 8eyBIJAluQ5sPNGrSvjMxm3zpxnFxm2iJ9dYvy6T/pppZE5y81VFflWUQX6/1CtQyKY6Sxp3 r4w2EFdQxClfhWqO/bTrKEJK6vcRGDhy9WiMIY16RkEJFYUxglyQ8tg9cY3GODZsZlATcSAa mJndTJVqNAhJbpZft/H1W8n4+WB//c7MEXIP5B4YHQ8gjtMnGOwnQzjCGSM9l2pW08t3tlKN 2Zo1qrRx16vMhjv26RbPmMf+0/icgQOhIOX5zeMwsKlO5WIihhG0QrDIcvmrt+FU6Lg0Y2iM mlYtS8xS1lmo4VqzFhCpQ5czsvtMrjIdZ5zm4bZMBvsTusd2liA+CidDWGO3yDfIzpCgztHR NMCBqIB6BGHGKDjAVgMyRTHSxth0dIcTx2J1ms6/zW1QMEY2inZqt7KWHUXDTKqT3xSOO4uA iSGWzWRFTkvjAdXFyc9fGg057yh7IHhFiU62+zRrpcH14RVopdGaBfxUpuVJXiNGUYgSq8yo woam0ZOAJ7RTQ3Zm3ZAxRsmFYoM1djRdvrwNJqScM0Zuaylxy2L6NSIEpklmW/uYy0lEPgvW yAFeLSmjiZoGLRsW0QrZhjAXk80JGwh3HSSandEMPP6p8Ew+2D/+T3New9wD49UDCOqIYvgE y/jIeG+usvFfQBNhHm4UMIVAiZ+J9FIBZ33FGqjZnKTDSjQiZYXUdduUjSW6u8pc44hPIoRQ pVnORfUhGMkT0iS5kIB4yFCjh9QoGYkWYpeNUYWv/mRIgwJHFkg7bA1JEmAuRV4kbdgam5aV aImkG+ITzSAvy/N7TIUjQxPNdL9rKX00MooNWhKdHIPc6JFiLeZ71LOR2BWhUXd5IteRlYrZ iaSamcnh9/FUzWY+BY2wrTGD/XRFOC6ZuKo4Lqk6UOO0ZlruqIKnx1E+VqqYqb9ysNwDtXoA 95I/jwwpx92DIsdtZ5AkbrT4FFBOalCc9RmYz10rFnOyqQYYGD0QVmiFZA4DhJ1khfNEasO0 a2toCXcfLHXyK0M/AU+QCqyz1Vujm0QDEC3F5hHdJKvBawB+NspkgDKQzGgOalSRypyFBtyU mcCodjVrGhWt5oP9zXp2crtyD+QeSO6BlIP92l8JB32PzjlSr/HG2kTi4ZElu1BadDuSZraB 0c2RnSUG1Q0jGa12V1SxxSjtl3NZYjQFOIskG0Bgo2VGzVXR7B+jtai5+rUIJpzZ77gUhNMd xUoRJw3nyUCqpToGGdZqKJOkxmh3o/IycNII9VcabYAwkFTJRqdJvbSvgdqyVpTEZINvNVIS lAY6JYe2e6Axg/12ffWX4GLC5UXf9aM1FKHW6169fTQMLQvzVeaG1iYHzz3QvB7QXxrXLdVu k/B9RAFFiEi6yi5pASSV8gB8wKywKkkhGPBImKJHyrIHqqmUivzfqAUag11ciFrE7UKQ8QtN PBY4zaTxko3W1uSTmNpGQUggAqURDHJRkiYTY0odxVHVRrARs8eoPTkxYXWMgFod0bnBx/qK kq9JClH00dTLwuBuJYrGZrSmZiJUAJ++awYZGUH2T0p1qv80DC0LYJU5pZ6cPffAuPAA7gp9 QizdKIabwyuI3kbkB41fY6M2VNRjGpsRKiqFGEaC+Fb1iqyaN0jWRDJaqSLZldpLhDzZb4KX NPmragtX2loSVW0GCwMkzEXBIZghvsMMTXVKpZq0Q0/SIg0xpT1JteR8Dg+Qz/2nlsho54Cy fJ6MLTJG12RZihko4bNJbhubL+UV86B4jUFK6tIsCWVj7Ajxps64DXCqthW6IVNbqAiwxjgV XM4SCopMUhmzSnKz/LLpTWthDZ7iStUgO1ZEDHWMfWo5ns7xWDlPuZ25B3IPpPWAebAf8csP e96P+PJCmhbXODRqdLcRmhRnac3BqnwWIOk+NtElUdVADF4JkiYOldtPg42NjpVyYzKOQY0k 2RAssjrZJi7h/V9dTCtOk02oMXBi4HjNCl5gUqOnscbKS2ZGkJNaT7gadwTNqj1aEAulMWgI 9ajWoLarLPymj5Glqj/73X16kmIyXFIB5TbyRFSAbExKbEkso2obMxuJXGpJuIVQbzA0W+0t VcnJuQfq9gAud3zi5pF5d433ZVXoumlMZYRmKrGqqKEAWlQVWtYVAlmZKs9EZ8LtKKdoJoWw mCoaa0hc3WIBYG8cRiZVGtMgaT1k5E9yKsa0l+o1Hg4S0y88P+FLd6KeF+pMNEEnX3MpZUUB HeE8s0UKRQm/7EoLKnHHRDIzlgdDEopU6D11khHfUamgLD7F0kZWrT5GniiCU4oKA6EgZUQP Ey3IGtkNmYo5rD6a81VpmBqftMfNpQn5WZaRIPLXzB5DJTSGYHCjGLPJUje75Np+fyMOS+SK GK8CNGiRkQaW0BQSnYnMpprhLlU583TugdwDuQcy8wC3yOpE1OKaHxNB9VJ+VugQSWpqISWl BNGbXSEIwcqWPPMCVHFIdj/joQoUkvKogsmjh5mVHEmFoHxJ8ROWtXEpAoGQRtSyYSihhlRp bJwN8zM5UUJDllAaOQlUjEhMcVQDmRKc4SiH3S+yGiaZRtAS6pNVYhNSO4UltStcoY+nZEK/ Jq6yN6sUTg9aZLqodkbCZ0ydVqYxAifMq4QRXUdj84FhXkp8KW5UksKMgJm5VJK0NETTICTP 6P2SdSEbpTFNZ6s0LP+N8YB25oxnNwZifBfDI948MnKU7x+jmzRXxrpFA0kirje/OJrYlCUB tcl6dM1IlddRpLKFgl+owMvUbWEUsg5K0jrVb7qt3oEFQaqOCo28KFXMbbyt8tlZa9TgNio7 5c2JJFyizyMzugl8vqeSOcyfhS+Z6Rff2si9RPV1FvUXwYkuUXwTfGZ6T0lk/BAYoktkboH5 pZLOmHRiZCljEFnOaKOclJU566sGBC4xPfZomJYo8jfErquSTOFfTSRcGORkXYld5oJyR4o1 6J5wyLiKalPuQtTK2GCNbsymssaIwETW6+42M3+eSOyBRGcJTPo8MpbjcwOVRqJqCjEEIrEC qnDzpMeo2c3jwNyS3AOj4gEx2O8pxncQhoym8E1OpV42RgqIHhsjy9e9meAluCHm/e9zGTEH KqhAtm38XGCqpylSC6JyW0++HuAzS2nOSnt8AtM9Rq0JJi0hnUqbRTONslKV/8vIspQJxCDJ mlgoq4ko/zchNs4kwWRmLRHRpZU7slbRsD3hHPBCcqGMQ5m5KIJtZoujJjCiKK+KBLxx6vLy JB5AmPAiBV4a931OP+ZzrlLBp2YTKHMhJxD3WXwzkwuMNqfbYLcPs3FZbR5wW6ZiqjVMLqUi 5OlsPKB5Xz0x2ShoapQqDr9FptpJI1mKL0TEC3kqVCZEQ6XKn6naiFGEwiJcoKGoNo2/NNfa XbVR8ElCy2D3KBjn9lZeSh4YgROT/Cpp9EnhFllIEezDJ94RJg5NEF1G0doDZ1AgxFjUaxKG CSFbRIakVTIFR9mODNCIB6pwsApKMTPFWOJRGH0C9UAVZo9FoklrfaLyo+AJaqDc4/FK1Yiu SKoxP0QmycCUEKafkTRNfRTHpyTlMwFIXaayGFpU1DfEaY/SVY/B94qjSqxSTrVWqbQFKQyS 0CNjmNQ23n6DFhm7nhNqXTUv++NaEVZiC8iUCvIqZK1pXUetOGNdjk9Jtu4d627J7d8uPeBP v8C9wPcFEsga7w7mcfuKZAUzYSERgvNh5GwMPxu0P+zoIRiPzReWIr5q5vOKOSe5+DdUrEGF mRQHcYE5QTC+TmrHyfcN4A+is0VSp/mfQWNjzLBi33HMHC7lXFw5MxoS0kxDEUj1IJsRaUkn UebWLKWTcXncCY1NjJgQT1pq+k2syyTspmVgnVvB6JaS5zBEJmb2i7qyK72Ku0KK0TMkzkUh NGRQwCRZ8RBBhjRZ6PolQdZlZmX0GL6wNEuFyX4uFZQRoQai2yQAjopVaSoSW4M0YDlvs3ig ea47TEXwAhlfaIFpSKmxTBRwITUxSAhEpjscbNCgcYfHn2IwY4o16ATZePsSgIwWCxuvGZC5 lzR8PWuzQ+fz8iNtnNGInDiKHkh1uSSxU87sx6WVAFu7AN0SApIEPD5PA0lIGJ5B5lmq8Iq8 O6tZKxE1cpwHPLGwFbqIsDhsCusSrEqnMSwZ8o2SUZKMjIRP5tKwSoIODA2ZoNtn+3Nh7LCh lHMWSg0mQUFzCmu2xrH7upyQNjvqosdpjNajLnWqcCOg/erotdLzqhkjmrY+/kplhbglRJWC 6RdaBS19PeZK6noSsHBTq89WI6doqtrambk+dpbGloxEJRtbgxw998CoewC3kWyRSVs45iR5 /h00ETxxLSwgy2gEL2eoMSOVc1ZwaSJBmVZAiPLbWhjIC1bKacxhFonIv+AOc4RzEYtZUEmo HXWFLCuLnrVmE6nUiIFiSvnF3CgkZIwYSBWCQcOQRVqdmGxJMKSl3EW2WWCT8XRpQvXot+nR 6IHGIKWy+CaMgCWq1th0s9kTa7DPYLslkspLPll/fRkfebrUk6ndZSiS0pyS7PJXqlF+AxmP WDunBuShaTQf3KFDMayupKY4ijUCNkSVghJrmFEKxBQGJ9JhYgIthRrFUg2sNhAFL09m4QHt rGQBmQIDIREfPZCZAMTlQrZ6F45IaqbzBUV0hVngcanIpD+AViOCZqVDdY0KHIhjtii507Qq pvNhzWpUrRpIOgtUoDxdjwdGwO/amdasRanetdQ4KAu+JLZqPJpulMqHk4JRYFInSOOTFhjR mEhQPJSnYHhJfeCNy33VUon4ZUw9PBNTpN8X8HsMDE3s/jczmYt9rqCt62QLIQcZXyYAoaIA SqSCnF9RhaDUvap7LFCTNhVSELbABcUeMzFxoQ5uYq6NFiAHqdqQGiuln+7Gahsj6Lz6Beyl a4VPIl86alXqKVVxkqRJl2aG24AANilfIOFKGU1xCSjxQ6uAW2p7Lq3Byduzu/K6Sw/gwsEH q1/4BPkry52/ftTju9QkzP/x1HoCi2xA+dzBqLSny4QRGMGqiERT5D3MgMdLRRgDvczJqgSz 8hcXojO3n5CF8lcvl3kq18yQhfTrLAxY3ZoYxM3GcL67WUwUyDYyUhpKiM27VOBHjcjQmSV0 KzIBTmZ1Mi6+XTKxrBYQ7a5JBaGd41SyI8Sc8DSo1uAiVltkVGTBUT0AFv16s0iJs07cBgZJ ImiZUw0M0qp6p52BiJqKF49yqPKcdlvJbKaEpoGQdD96gqxEibA+IhdRnjA1okn5iNC0Gtas s/b6aBbUDlSz7blgPR7Qzl9yKBHIbNx0j8lrQbalJLdyC4HFvx8ls8+kmkVpliJOzkpU8ctS GprKo6aNICpDlmk2TgVlCxJarMrWk2ZjRlhvPTaPqCw7aES11qcsP5c1+i9msB/XgnAtmrPB VaH5OijwmdkSL+9xc5+EmL3WsSilrBDweFnSS1j1EJsPJWV8KBLioWvSoFoPfkRlqVj++gp9 lRJa/Io+LJM5KfgFVZFnJT63YBGHBKMcFQpeCe7RVRlR4OW5vcalijqCE99GIosQH/Nok84C FD3FEl4BncCAFqRYziNpakmWWUIJAwSVWwtC4iJj0qYwyeLkgIqwLSlBzeWZqjKrSEiNNucT CjaULd4/8RxhA3EjQcTRIguz+3e+6SyC5lJe8a434mBxTqhawBOiM2qIqkpklI5VxNYzp1Fz Ejs1hCQiRl05Md4Dmq/jBZqAI78gajwJwWA/AQQnX7oUFCQpF5R63FrDRkqow+eCL6B7SW4U RFfQJ11kCX3zHwuD+HTJZKZLQ7VSTVZi+L/cbtToflZiaqVkoaYo4A1SmpyXlWI6VzgfzvkO laL+3whnTWo8mo5iZQwKAtCEwhqbJ6/RJHqA7VtHfBrZwi3J+a/NA3xvGhks5yTCazkbEb5R JqA6wcKKZIvRcu7jSB6fS7jDcxhL6Rejl9eJXiTTRCQy/YpvkkKCTgn33Og+lp08n8tXIUAJ OESXRJQR3S9lutAHjeF6Sib56wF7mZAKkhVQPmOIX1OhVstTSdIsQsjCFglLv0xX+SVR4/VY dJqFV5LD2pQc4dR4V8SiK4pqSeqVrAUjW5mENQ4ZHpIJlWRrWzOgheoaucprtNBrSuiD/exI TaVdBxhFAFD5k4AwDyUgLoAUNSqgQm6+JFdAM02tjFaE7JipXtT0nJJ7oOk8oA72073lvv9E BcDhs4phcys/eNQyIaVoQJLbMOQV7kWqTkJbQIKQMOn3WYR+Pyl+YQvv/IYsG8CKJDOLS4KH balKVC9JMV2gBWaSb1DolxuYPfWCTp1rLyu+2E4WlkUeCCv0PEW4HoMHRQBSAL8+e9CgFQTG IEbdbCnuswHYSym6JEeiX7ecgFYMIES5hq6GHyBpNdD4tGwgFi5IBRISNV6lIY60GZuNaXHS 8Nvq79vCxclsS8aVxr40vNCOO1dvkTECGcc1YnokARbBq1YmgZTgx4c5ORHBdxFIaW2yLtz6 y6h6wLEZZ6RTfWxS7tL6bW4ShOY9qU3ioNwMgwf0MbKAxbue+Hbjm4gYeFw8zIXbVhC4aUPi JBsW8fWE8KWOkJQ0SBYiNIhyvyXoNTdQJIfMhHIpoaQs8cTMKuWlbT4X/xXrdOKXWL4HJIgM ZLKY6T5ciO63RoSCEF2a7xOp7syh1923T5rJGs2YGpuPGrSLWE2AE5fSIOPYzeU16AVQGtU2 DW4MKrXJmusy5qgpq6d5jO+UEao3rBUz+6XRfr+G44133ctC/Qrx6bLYP7uyQtrJlmQEOCGg 3njIBwq9ektIX6OWZdcw3QNkchBDiaRZEvB5Kd8wtk8r1rKqSrXILW6UcosA3CjFSmPFPU4f IwwVzumnNZJnlSkSgYogZRR3Flvr6JQy6jEQU4GETUklalA9siQeekmmlqoa/I0lkxp1LpwT a9dSM45OX/iUaizWLGRVQb4SQOQ0hFUexkqiNxaE0RqSSGJiQxRbQJvNHouZDSGrl4KqwHht qQx5esx6AOccH7TIxEnWYopHEXR9LJYvCO+KCXJeCtFfvZBA87NeKVpjsi0myF5pUAAKHR5J JFVZr0hiy18Q+f8mrNkQExUhAUZatO4dq/bUSQMoo3yHDNNw2WyFH0nm8lUgLzvFKiM/qZD8 PrvyEECwcyOaZLW6E1F0P7X6UEHwLZRovQD2p2KyECB7PDwTqCIG5qIElbUQCIbDhBSwxQgH jPEpKEqAZjfHIGxnjjfH4zABSDfGnjmpw2CYLJK/CVgkq/IrLVFIKZIkXZvmFGqIFWpwA1RL fouMtbKD/x973wEgR3GlPXk256iwq9Uq54wESAIBJhgbE40M2DhhwHeOZ/s/22ef7TsHzgl8 DjgbY8BwJgsThUAEARLKOax2Vyvtaleb0+zMzvxfxa6u7p6wQUig1mq66r3vfe9VdU11VXUY JpFZWwdWKxWmMiANKlWiIrU0A6tCZsgk8UNSrU6/NCuntfyyJCNeeLVmpRckRtyRSn4mbVsD Z46FbbUkJ7RMLW1rUzRrqRQCeyfJwEwYmWF8GIEoEm0RTXUpUfHjUU1YWhqqqtRINAotC94k 6JhREkARptWL0Oj7FEh105OUT74sTgGd+mV0ivxdJx/+wRxmlThfteTEsrGQUOWQk8dtUhqR qF0PkPpQU1ixvVMVcJRQsz2EQqDHx/JcK1zYDgKlUuPSmHUHZrUk0T0a1UBTZisDbJabgjcY OMiwoirmWhLISAw7VksSoShswVJvsZBwoqFa+iHFzFI30/OC32wmG5NQ2+25iWQ0U8BCauys 2cnEAWKhsmUYJaFDTNSbtpKQUgTxeFUi+8oX0mRZVMahpod9GBAsHujWR2SyCMPmJwWTbKyU I8I51Ao76Xas8CNYZlmbI8g5tFqRkWjm73hgWjxnsu+ZGtAfGpcFFyu2VODUcCFX265MU7zM SQynMVFzhwBbxAQurg/QpDoooHbEihOYd5pUZFlIIifjMtsacVO5RJtRhlgjNcPsczDWvDCc FBrsNgSaUsuqw2GrsQ62IpiE4zQ4RycXpoVanO+5Que2YSXXMaSYmpmMSIaonYcwJjj3K3aa TvGjJAU4tb1W0tSMLWgtUKq3k9mF7RSJnb38CtorLXFph8aqT0qSrDMHMpij4yD3kdkB7KrE DpecjLlIgdMck/31N0ZnRg6zZjmZ4DQ80FQK8YtqEUwi77BPEgbrFGJInjQ1XocynBGfqYF3 rgbQ2PWpJQtG/RYk+PJQqMS7yXgAOfZpKpnEQGrlTF7LzO17N8HC9tILGdbxjO29CqY43R7q gVzTpTSCRXCbwEPP2NIJX060tkYSnMhaAi2J+LwWOBcM3R8lYE6HSeIU2zsrH1p9phQzrzdj /E3HrifBsU2U74xXcyD8PjIplLcysTmbY4jm9sdy6qVGEGLEx1GChcPMtoZrChNYvbfTjBgM n5pcy7KZiQeHGwp6MZT2gNyJ4YsGARDdKCk6skFSCKLRcBRsOLbVMozTp4hSmnKByLO9QAkW mRcwoTDtnZTSWkXL6bytVkWqae5C9cTsVYlqYJvWwXoeRvy0aDFXoCSpZAk0flkI2BZhsBgp Qhd/s6WKbzI8LWvSzC0ZN4gAMInEPaHKiZqWIpWiyLgEpV6x0hdHDomc20of0utQE6RCYm77 EdlQObkdCjhycQ4xFtKrul1er8frc/d19oVDA9FoNCs/1+tzRSMYbKH4xtkMPtAIfAHPYHiw v6s/PBAOpKdn5qQNRmKwQuN4x4szxFpI3ow1ypTKmRy4MDI4sT9cHBkMRmNht+uE31sX9DcE RqXhJV/c0xTpdnt9PnLCRbMcjAz29fUNhkNozG6PxxcMpgfT/T4vec97NBoZjPIpxWla1KTD Zs1QPmvJOnr97Gb6rhOlaLx09CW18ltAxbwbU88OiAqWrD+Qb/4x2FjQlJvAWJbvEhTIFoWu Bz0YDmRvV0/9wV3zly7Pzs9Dx7XnzW19LT1Fk0sDWWm4Ad3t9aBRRDH0irmig4O1b+0qqh5f Mm5MTn5uW0vL9g2vlFRMzMjJ8bi80MvC8uiEY1EjpjiNnk/AuJqhNaEssolD1IMQknVbas6s db8ybyEXBPH2/MAJiCQTArqXUuZCOoJcqoRBWjR2fmfvys7esQMRITP2bT7vK9npz+RldnjJ TN5xgwsLsyNYKNS4hIzuKRX5kAiTekiZEaSK6x+nZGyh0EDTkbr+9raMnLy80vLx4yvSszI9 bs9gJNLd2XGk9lDrsVpfIC09Jze/ZLzP6xpM0J1Zo1eqW4z2DJCRihtrfCVpx8kegoQO0W5j ZKThcs+et4r65b2KUg4iVr69jJML+HUigWZ7keOND1kOow6IliKYkCcVDKOmcuqaNjdRmWp7 JpEwmAKmPqTc7R6MDnpc7rS04MSJFQuWLsvMzgZV3d6Du7burGuoGxgcgLu+1g6XazCYlevx eF3hyJRpU2cunl9YWpyemdHZ3rHjrTcOHazt6e2HP7Qire5lEDIGHgHdGR2ZKkXaFi0xcbVE SQH8SEgrljDbmnMEYZWYpGbSpMDMrx31uV19HznRmT2I+3vibTgGjxdkPZmXNWjvj9raqViw 8ahtTe2oEpKcAgCMt9zhECYKobSMrKKigsKcvMLS0rySksKikrQMdGTuwcFIT3dPc2ND45Ha zq6uru6exqamWHQwmJ7hcZMzOvmu22xWoVJHImkFaUwJASY868hMIsdMQmYUrKfX29OHiVaK G6hFARNYsiCcwGqITpgEDsxdi0qCA9/fHw6mpVVMrLrxlk9UT5kc8AdwLLtXdK954okjf76/ v7M/LSMt1NEVdUX8aRkYlIU7+pdffvGq912YmU1aRiQSmTlvzoP3/G3P1p09Xd2+rAxMMs0O 9ZwerRqQrhv1vFq9cDYysWikdoXACP9TzR3ndPXZKXVZIBa75kTX7J7Qz8vyu22HZiMTt+73 tMpj4oA5zODgYDgWjRQWFZ1z/gXTp88qLS/PzslOT0vz+f0AYP0jHB7o7e1rbDx2pK6u5uC+ l59/uqOzA0MynITp8U/i4A21XnCURpE9uaiM2y/0ER9rQyJAPjISDYuLhZb7Elq1zwWEDbUI luH5qI5/uwwOI0X5KAwywcrVImsqn2rqJiPtqDvimjCu8ktf/2r1pGqMyXFOQltAl9TacuJE V3Nxeen8RYtLyss8Xk9Xe+fx2qPbnnmzpaXZ7XGnp6UHggE0jiWFhfn5effd9cen7n04fWY6 hqzkxIbNHIHq2ojJXqrrOZMgZPQWD9yKjPIUWpnk1sgLHsMNSXGgPpGnIGXITI0FKdsrfBaB yQc3Qy/2+ab2eb0hkzJRZmr/wNePnvjBmMIu2peJEIgZCUBWij2PEqMFwKmSfYpd2sfjlKAh JdTCJSLAV478ebAc1nniyKx5S5Yuv2DVRZeMGz8OQlvjggLXuHHjFi5cFA6HL77sA888tWbt Uw9jdSUjOy/mwlcgSi4GJNgUgJK0NxpaPSWkxTFPkRltxD1LTC11W5qXQp4whKZwmFZ0UMYX is8iJQutDwuMh81JRJ1pMPmVM5OpvoglOiC/31f79v6Lr//AWSuXXX/jRyBER9Z6ovXwwUO/ +tkv5p+1cO6C+WPHjc3JycnKzoZ2IDTQ39d/orl569atB3bvmT1v7rLl5xaXlqDbQht64eln 1zz82GvPvlQ0viQWpfdkaBEQt3abLUwIWfXxnFkILiEw09pLFbA9gLiiGhu1cZFaoZFeFQNT vBLAE+LrcXNL5wWdvbo2ufye9AD6Mm3QS9uAqaUxMkWkxOjkSHZkTgBdngSnbpJkXgk8kQXO qYCg8+ntbPvYrf+6YPGSKVOnBQJBdlYWYwIzC+hJ30cM0XR7urvWr1v39OMPb3prQ2HpmEFy 2SrBZN9Mx3OOQSv15IixZUwkTL4jQxeGqWW3MrUUjVH4YEvyRnw0aAvIXFSJZmBBZRbLIYJQ i+qQMJVUKI0Dx2HCBcuqgXm83qbB9sKxxeVjx+Cog23vnj1b3t5yaN/+1R+7cerMaXn5+cEg aRBerxdav9+fkYnF05zCkuJJU6fUHz78/LPPnbV06YTqKgDyCvJLy8vajtcWV5RG2ZiMupSB sWi1qte1vEh62bmVXnIUlheL2bE+XQ5NRJ/OnXBrUQWKayVJiDQ3VGvIjJQSLGcQRAIj8ryH pMWY2xsaci8Gj9P6Bt7f1v1Efqb0LiI2nEHCMqIGOESEpZoq6QRqBcmTKRtYKRwkprJoGFko 4d4TCQ8M9HZdvfqjF77v0sLi4rS0dHRPsCJdlS2TWZiVnXP28uX+gK+otOSZJx8uKBlH7s+g zUi40ELgWUetmd/eOJHUkVw1TAqkGERxQyyzSSVE1Ut8O86dyAX0cXgSWfPyGCSkGwhHcHUa 12yi0f379j/zxNOBgH/6jJnzFy/ML8hnBmgNOKj9/f2BQACdGrq2ouKiNKw6BIMH9u57+YUX I9HBisoKMOCSkCeG9Ryl4pJJ2uLjlDMZzvgYW4+ayegEANYbWjs1V6lmP9jevS4nvVNdLEum RMm4GZ1SJ+N5aBg0yFB3N1rmpNnzzrvwfWVjyn0+P6jYaCsZTobMyy+YPXd+MBDYs3PbidZ2 nx9rJmSOmQxDYswQjs6IHwgRg5hsI6/+JS4ERwgeJwMWeOLwh+Rcd8pI0PVk+ANd7R0nWk5g RvnaK6/u2Lw1Jzf3/PddUFBYABu+1EWH303HjmFeiQE827KzsydPnYJx2f69eze8+vqxhob2 1rb29s70jCLrWr/uPpm8Wk6k0aLwh8Qob5rbEfe2sKe/PGxzm0VKjnDHxkUdvaZ2OFI1o5X/ lMra1ZHHi6tVvf6Af8m5K6qnTEUvxtpnSh0Za+dFxSXTZ82Zu+jscH8fForZjNXO59BlI3WU hh4B7isoLquCvd7TiLzY6y5ohXKlgTFSBK/MtojCUBopUgN0lAwRl1pGzaZakhmGlkxqAsOw nKy8cCTSeKxx3759//7Nr//op/9zzopzMRbDGA3nOgSPDYd5YGDgpz/6CYZdUPlwoyG5jD2I RG5e3tjK8dded213R9fh/QdrDta4ArjnzGu/8Cx9k0JbNrNWxm/CiYmCoSWTSfyXAjMLNSYQ vrEUMZHVKFSiWkne0DIDiWE6NaulBZ4xiJwCurate8ywOzLwFQwOPpujzC4triwCGoS91Igv kd5AjmoKYdj8WYIjjRNzJb9vQnX1dR/5KHoitFXSZJVDnkycwOOkjgbvDwSysrKfe+IfHn8Q N4iTDs6YX1jcK0GqrSeuR9lQrQ0wrp2utAlGh7C8WEhBbiDiGQjTJSR76DskRZUotTKkIGKx QFqwq7N7+/Ydv/7tb/79q1+bM2d2bl4ujh9bFFNJMZfEkZYSuWpWNXHi97/3369t2PDCiy/2 9/WhKQw/LunlXZZA9c3oT+1KpVMNlIYHSyLk0bDUNtZo5GdqxqccGve+dne0VlVPnjlnPiaV aJ+45TXVXoyVilnh3Dy+onLmwqUY2eHCFr0p8pQr9TADMr7DFiJy8tDahsyiUyAb/XLjk28i z/bokFjXL8QaCnrw40+iKICiJbXAYHRC/8Q5gnGyaZnkVxMYnON+/GCPa+lZSzOzstAYaLwi VLnHWc7uNIAls8VLlpR5s4P9LjQiFFQlN6VlAdSEqBleNqEinTT+LJsupnnFVqttemgEJ9WR D6MiqTmvXBGJpuWRMMfCVBPKrOCWOFMBiiKDuBPPJBpGpmIADzKJkYs8/CIhQ0opweJPycQR nErR2CGQnwanmcQoLyk4Oh9vb1tLbk5uUXEZnpQjWCCGtIELGxo/JhnjKibEIuH+nk7SKTrV p9kLgxlhs9Zixug50aJ0KynXDYaXFyHxG2KRVTcUwNgSVWJcLFOSTwkzkUs3ibxIYJIJNqgu zC8sLikms0KnDWHJyBQMjjUW1IryC3DDNK4ZKJpRSGoBjHRVWCNWHQ7Fm2rvcuUPYQxljUlI 8iOjXNvC0amyN1cmO7HGBkI+nxdrZOiDRiRODMrS09Nxr/+gvgJgdp+0syGaJeBPmtUCTOLO fs0mbsMHFnr2SWOWOY0lQYGsaoXTqtQlOAeFege8Pv/UBbNKMTinF8LQNwHHxi8yrVvSPNMW FRWNmzW5pa+rv6/XHwzSO/tt4SdLKKsw7iE4WdEYfvA0uJEZdiqI4dOpvI1ydKDHXzQSQSNE Mx6pmiBvT8DpHI9e4l7/YW6yBk6RdkjjkQ+Ni9ErDY6qyIcMFUNRmuWF4FmtzSloXldMwo3E 0IcK8SHEFCsyRE5ne0ygDN+IM2S5nDvgO2HNszj+4f4BT3owryg/K5PMKyWctA/ao0GC+SPO ezLLMDKbkZWZU5CLNddQ6wA6MnO4kk+pI0Wmg1k9SIBNKWgJWGBaYaQVI8UMm2ENOU2JSwOy xvjFFo1Ny2okTlkZv515r8ON5k5k8eW9qAQ7L3ZWrBkyjQxRa1hEq+jsaOxlyQYhrE1OTBlr BPG5ozF/Rk54IBIi19Ojw+rOaFuBN5yMO9rbvGjHaZnkvm4RtL53VOjAxHnZEM1QJrb40StM NVIuG6pikgYP+0tiRKbbngZ5Uk20U8Cj41HlrhnMN5ubm3GHGVZPcW9gqD/U0tSM5zlsiwQw RuLoNtR+0BZ5SggtTeOkRdWM1yyM3NYyomwjF9dJY8L8L5pVVNLU1Fh3+FBHRweWt+Bbnl9T ioM1CjTkEyda9+/ZhaaclpWNbEokpwXY6MhYmY1u1K6LlF8WoeR7NsLQbC1gUSG6QpA5nyeE pYHQbGSWITF/9PrJi5m62zp7e3tzc3LYaQ191o7tO/q6e+llBjceTsotyNMuXJJVc7r19fR1 tnYOhCJ45kkKZSRGQhbHECkpLTJFY5M0qIwUgdmRmBF2EDOC5eyYaCBMYTaxI7WJGq/iOeH1 Fg5/zkLPrjVBcudnspsWcLJmFOdYFymxmMAjQEm+S9FgWnpzfW19WhD3OeIWyKH1YjIy3NHd UF/XVH/Q5cvAwlvcRRKbCpWF0nXaSMn4/kvPNgmdhEMcxEwbV8lG4EZHZvFJ4mcMtCSCDHtR MiGSAgsHRbDyCiMLxioQMy+qQXdE9oovkuddJ0WoHwwGhC8YwE1htfX17SfaSkpKfHR2iXNR R3tHT1cX6Zg8brx9bvbcObYNBYC2ttaGhobu3u7MjAzymFrczal03MzBWmsJmgd7TgcqaZty bUvLOAnNqZZ1ubamB1fh9DDs7UDQ302mlnBgX3ruweY7Y4lp2MGkSBA3gLhKzRHaHh6ba21s aPB5d23fPn7ChLS0NGCG1p3hPS54r8+WTRs721pzCoMYPOO9orJy48UlQVp8NKsq7UnspYJL tRcy6z4+B8ELRJyOzEorJMKY580xMSX7pBqmxqdmJtji7hWeuDizEnfqB9OCHV0duw/sqa2r q548CTeIoX3gws1V11xlxtrkgESX13DkyK6afej18vLzQr398b9ZNiynl2goB8co4UuZ6SPS kb2UlW6QvodT0cFYekFpn9v/wjNPzZk3b8KkSejF0CZTWuUAHlYd7e0H9+175onHskvG48aO FC7Bx28S5m/9O36svMUlVQjC6KJFRDxOI1yk2NiInixJjuYpgKGMT7paz7KUG0k+sAK9kHNP xtKuWSFycIqkcC3MmdaQikrnchpdtH/Qc8JVOL5w0VmLcU4jJzTABK8oqGmPLgwwbFhnfej+ B+s3HwzEfP70AGkTJqBzhuNEQJo/nUWF0YI6E0sN5zBTmXOaV2kq5ApaHdwQsaKSZpCxPynR Em1e76SBcOnw7sPAWtsfC3KithFwf7KKeDiy+tR4ZLQyIa1V2AimdUcWahYnYEltpJ3G8KAl 3jF2tOZQKBqbPGUKXq7HHlRC44xPgjbMAOj1ujo7X1v/8prHHj2wc3tGRg55HTLhNghY5Ka8 zMhS2SYkzL7JqE4UKJIJwqfgZDCCld3Z7y0urSISYSn2QiDzdvxcKVqXgRUpumcVb9S/UIpA pHOGFmIJYwnbrPWYSjAGZT6/N7Mw6/nn1yxYtCQLW3YWW/g3QhG++B6HmDYCDMXfeH3DD//j GwHMKnP54qgMQDPSszrOnDfnFFuqcNQqQHN1SYVmqmV1mKJWkvSgq3lhZicTOrGvCfhX4k2d IpvqHl+uuwtzj/rjTxFEU4vL7hitoyIuXRLKJImThLHvHjmneryBjLQdr67v7guRB+9yczMz M2lHpHRFlvDQvFkLP3q04bGHHnz2sYd3vb0xp7Bo0BVx7l0ES7IhylYoDJPfJ+MiGYzwyDuy ItaRCalk4AmZN9cBE2sYA2ukcFBQ6XQsJIRiz10iyyV0J7UiQY4Z0iLLEzLLWGRWJohXvOXX 521paKmYUFlUXFg+ppwdYPYpSmzeI9xorOlY4zNP/PPt197KycvHagVbHJXMZoOEOWHH9iJn MXNUEKRZyXO2wkS8ZiOd26plfE5y1Vu3x9Ph9S4Y6rNKz2RnPpuFu9gdXEmxTFDfyFn/1Kis aWsfYKa0WiSWJMnAYQnRDEAmB/jmePAel76envY2vLygraSsHI+pOFUSCxRL+/hRkoP79699 5qmNr73W1HhsEItuGN+h5A6Fh8NkYxOVYWUSGrqPU0auikeg3lZjorXLhOizlo4nQOZHnXcQ kjjxKbXErRzAsgRCL+BsSCykdjEbMguJoZIpgom5MvzZdTW1eIC8p6cHw3XcOybH3qxHU7O4 jokNr804dOBQli+X/OyIGKhLj4w/UZgO+gRl1JzIotglEmJZCBLmEJEddWoySfxyRjqGrx/u 6ErN3uVan5l+fx55yWXiTRYnMTRBc02GwA5jikCW3Q5pyBLBzHrhAW0PkwS8J+/I4cPHGxoO 7983c+784tJStGrcGIQ3tmDlV66aAYt1ffRiXZ1470vzhvWvPP3YI3hdqD+IOy5y8SJsZXnG CExPCdeq3JCZw1Qx1jTDGrYSwUSpUElTmwTYKKFjR2ZjM1QRHI1U2KmGEHVFa3vqLrnyMrwM 9pWX1hcUFi5askh9dByHXx2gvf3Wpq7OLrxy8eZbP7H58Q2DA4PeIHknOmlRZ7YkamBNVmaH x3Nze2eS729DtT6Wk/VwbtaZ+rWv3ZgrEg4Xjh3Xfqjm2Ntb8aZFwHBPxvHGxp7e3tKyMsw3 cc8+1nDxNqqjR+oPHjy4f9eO3Vu2bnx+bfXCeVl5BVguSbYXs4/g9JC6p89eZRup1vXw1Sgx QjNpycIFaYdSKBNUyLoKAyAXthhMgkWWN2kJY8zMhQzVYiU1JAGtL+Dr7O7cV7Pvu9/57vnn nf+Xv/7lD7/7/fiMss9+/fPLVpyDV5tjyQx3kAGMIVgoFGppbln3/Nqf/dd3jrW2Tp8//+c/ u7PhcN03v/vt/s6eiWMrB/rtb5rlzsjOtMnwLN9PJnBY6zFXr7SVbLY+7LXicMTXglAFqGnV l6PcQYFV/xs6OuclmmZiWe2vedkHAnY3jglmWQlqPEZawIREVC/N29rqFsIypb1sjdarZIxn RLwwKq/X19VyfPKs2QvOPmfVxRdv37r1qQcf2Pv25s7W1vyi3MziMr8/gAFab0fbibqjocHB nJKi3LIScge/i6wJ09V9S02Y47OoRWVQmKJlSSIlKTOJsKF7obLYmlAyo8CkzMRjlvIcrDDA 6O7zd/f5RqIjIyUS5aIFEKUg/qCiYx4BgESo2V7keLXIJiJhlAQfpjZjsSK+5AYtTlM4R7Ud b/3oZz6K4ffbb769/e2tRSWFzb1tlbnjZsyeMWnW5PFVFT6vr7m5pelI4+Z1G7c3bMtJyw4P DKZnZCxctKBy8sQ1Dz3W3dWdk5uDhwEkuZ6QoSgKKbMcISZ4l3dkqAkcx4pwZEVv3+z+UJm5 9tq8np3B4CuZabuCeDmSwyZq0FKBZryACamoXpq3tdUthGVKe9lKTY1SoRgRL4wPE4LIQKik fExxeTleG7t78xYvTsD4epC7MXBBwO/CA3iYMuCJgDAu+eKFY16v34c7wMnrQukXU4lLJM3x 2VYUgVKYojWql6TMJILatOe2QCIWZ7ziwmQexwQ4WMmObKSnluAmQauFZOEzqTnK5HLOxY9r H3Ohk8pOz649WIu1z662ztzs3GB6emv9wUjTQCQSbevqOFRXg1cMdDW3tzW17t21tznUUjK5 LCPgxjMi+/fsH8DTmlFP0B9MeDds3DgclOqhG2IJObNkGh6NQ5y6mHmzcWUV1fl99+Zmu3Kz 06Ox4sHBIF5Ajl8a93q76M9qgJgNQGX8JldWOpP6PZRBF4XXH6ANHz969PixY83HjpVUVqRn Z+P0jEfAY+TVLKQK8ebPQDp5OSi5BxL/5StbToWaZMfYeqRHLjb39FliamkmNed4u5GjJH5G EiB5giI4jDYQsRhzAEJzUJCrMFRPPrExa41TUDIIwagSCib1IYXsyyBJmBm0OPw4qEgc2V2f XZCdkZsZzAq6wjFfmh/Hvqe9G48f1XTWAl/mKsbvKRVUFQcCvlAozL5l4b7+xkONpRPKAxno yMiNhTwgxbWU2CQMuI1SEdFj6wQWcrFX7OySHMZ24vxn2BopYsxzAibynJdpzRZMxSrfRmMR 0aJxPrajEPJhUpkyEm+hYxrLCMjeWtLQhGiLZqkWhq4cUt4h6iFxSSNKGh4IYyE/mJ6G577x RAraJIlfbZe0zUsjliC1Ezcmvfp0sEmvZigzQ6ti3Z1ZZ0TH5bo7A2CbsrJB0t3LppancEfG iqkWNvmOjFWEO+ryBn1gwLHHdR76ikTUNcbdblzwwR2GIMS0Eacv/AryUAAAQABJREFUqNH3 wYq5Iz+x5HNHwnicA0I1BHPGtr4li5PWkNNDY6I3dNKTk16BkiSHsZ3ooQxbI6WABUwYc0qG NVswFasiG41FRIvG+diOQsiHSWXKSLyFjmk42NDaW0samng3dGTkrEwvOrFWai6gY47UjlFX NjC9+nSwSa9mKDNDq2LdnVlnBMDlujsDYJuyskHCOjL9B3plsZmNdMTHXIKJnxiNr4GpSNJK j0aYc7nJSK8CCwk11hjEd0Ksklscop8KD0ILO9IOqJ5cg8Tdgei6wmTli1PSXkzak6E5JkJE ZwlEguIkOKlA6BxmteGFyiVYoPheyMVekGt7zUponaqI682ehRH2go5XhOHcSKkUiqWoOQmk VAYfh3K1RFGxBWUGi4Olw8wkIhbHlSIBSH0vHCWo1fjEgkSiNAEvHd2hzcYvhuOP73IWwS32 zClr4uJ7bPFgBss4eYIdBTNGHBkdKxqDRW4W6AfUrLXLEfewGuk1MsoKXtFnMC9wlnqEImrC JtK2+/ha2zMYO2Ky0u0ZpNrW67tFmLB635mCJmwv9sfsnQn2PehVrf6Ex8qxfuJbqj7iUoBm iB1ZUi7gGx4weWOfw+jLHEvxrlTIo5tsLQ+rFixOpHtGa9Eb5xUNqYUhDePDNCuelcaq2kRk yhgxqfjTLq2VaVTij+PDttLtgojDYQcfqkxzEzc8dGRczwYpxlDZbMYGn3yCaQ2MuVRMIFBy VgMq0azkfFWFGywyZSqflKpGMq1ptayEqQkTO1VoVlYAUBpGEuq1yoDKpQOBtGUVSrYXELZ3 8mjY2CIECYdpGE0ruDSUENvvjcI5sNm6dhz+ct/2XGz1y9A5sphDTak8ZlOWM74mdtpkZUbc yVoQnINvJrZQiqLqVlq1WuxYRFSs6wQlD9qslkr9soyESQS3T2knWaQVoxvRlxRL7jOJMzVw pgbO1MBJrIGYMbXUO0ra98luVdPyM5/T5aCUSmB0sjSlexJcUs5i0s8wAmbeM25palYmu3CX gISSGoXQnZnyfDXVQBNjgqAos9ju1MvIJM7EzafuhkzClAiFVujEXsjVcKgZ+zBgIsWBRK23 At44FCQjYZ/Sk1kvxHzdWSw/y2Mk9GIvKAmLlJkpBcS6TxZnteQSjUAGYITiaGqr0PhsMULo iKVRGN8LFpRAiz1j4e1QUPKwzRjHssSFGUojRdzInsR2hcnxSoWI0EwmpKBFSYjObXRkhnJk UywEfBpHOzUHQ7VLzct7Fs2OzDCOz6lRc6yZabGcaTpahZzWWdtDzIXKiGzUysi+I+g5lWbF zxtkOUVIoSZJltXPGMMOjjkSoQybTiUgVzNs69gojAofVlrzo2UZtahQkyMDyVIGyEiZDGTG sJQiXjBdo+cVvDmZyKUZbeQ0u8T+4iM0OsPPiKXgATf9gA6BWK+eUxVR4wb9EXM5gkROtTf6 9SYL4RSCBMgERmQczHZakPpAVXY7zEr6YWYiy0nMXMiZBYiB9G24N5VGI5SEhPZ6hm+ix81f FCZIhC8mlJ+CRQpkwk0eLEh0M45EGwnaEEknq/wak6ElDZX4NJqpEhhuvCUaNFQRtagDBURK y/6rrCQtQbaFiq9VuHjSlkSFgTAhRsUjbYu3FRqGMm5DRFLiNMevJ0kSDjfydvZCy/Z2CLOz kcsJz4JR8422QZoH+Y9HIZVDSvB4xoiXOsLMBZnYC9J4e+WUT33LAMxfH41CeuBww4oAZU6z ss8KtNgLlPTBBIaapMThFmBDyyRmY3NO2JiQoz+1NLs15fCKEtya2j+ABy7w0BhTBdPxAiV/ wOsJh/mt9iaToWbIDa6xKN7eRDuXpFnok2vsxYq41592WYYtOi88qRuLRPEonCGlKbzTEboI XrrijuEpXs1QA5/JvitrAGc4vHWn+cB+/NpubvnYnNKS6CB9Ryv9WuLhkpbaulBHRywSLps9 Gw+apNh/vCvrbAiF4v1G0h0ZwxvdPOskRUfKteY4hNL+xI2BisuVFgxm5OXgcX3+Y+Aud1tr e2NTQ1dvW/X4qaTTEQMxjSReH61EwWD49Pr9cEKfRhqkJ0gF5JBEQ0QXht+a9/t8MMG7NBAw qFgd4EyIh9Khw09k9vb0un1k8MXaIgyjEfI7EfiJX3R//X19tKwObmzFtvVpi0xaGJ9Sr0+K 1oUOvnSYnncwM4tly+KtRuQ5GZeKL7vmQmjNlA4jRh1kzTM6zYcVRiT2nqlpJBQqLCs/e+UK vMvz+PHmt9e/mpWfz95UgeY00Nt7zmWX5ebhp95cG994q7+3Fw2GtUycBek43vzLXcDh+4Cm BZ35hynJA3f0VElPrGikdKORaSp1HAQTNlyUYzqSEOUhXz2qjvcKDe7Jace5BKWE0dqRUvtq lmqjLCRlA+ZsPh66DUI6tknEgVtUTIBPIzj0XAMD/W1tzVdffc2k6okenxsPO5J6i7l6e/qP NTU0HK3fu+1wMOhhNqhWLzoTGggZBZGfUKDPhBMbMumkP/ZGZ46048MBJ8eBrD5gyEcsJk+e NHFK9f59+zatx/vLye+HQ8VntfBBOHkLIMcXbcrtAqbu6JGp06bOnzcfP0j+l3vuKcovTA+k RcNR/BpAzdG6aVOnLlmyeFzFeLwg6IUXn8d7MvJy8vBEJ37kPDsvt3RM2VnnnIXXNP7zwadi 3piH9HSEWNYmeUmB7KaldPgJXs2ytlm1SV4tSyLQRBJKE0RpAUhyM9aUk0YWsEVA7Ci8avrU sVWVyK3/5zMmstHI2IaRqiNZSsUQrRItqr+zq3DOnOXvuyi/sPDwgUNvPb8WrRYtGQcd73LN yM5eddmlpWPKQ/39u3ft6W5vD6SloXlAiRcWkCd9yTmSvIgFEpwOYYvnhftD/d6AH2dleIMc n0CSp4jxbthwOJCejizkrKdDGo8QY1oAgDcQwNuuMSkhVvi+AIbnjyNh8Pv8fvJqRvm2DMpJ 3kBL/xAVjg0YR6OpKnVmSg7hyCQ9IjM5SjbDjjI+2Z80Q7/QH4o0tzacfe5i9AUY7LS3d5B6 j+JdYOl4z+GxhmM/PnRXZ19HwBcgR9dFXuMrzN1eMlLjBxIXbkEeJi+ogBfag2HGCjC6I/rW fgyrcETw6rFlK8/uDfW+/NiLGZmZGGfhiA5Ewui2sFABQ1J35D/SZDkDc16P39PY2rioaPE5 553jD/h/8LMf5eXkeL0ZZC7p9zW0NMxbMn/ZinMXL12UmZv18KMPZqRlF+QVoZH29PRWVE+Y NmvaFdd+qL72yNP3PBkNxrwBtFEEFka48AMvXnLJeAiHTFTDMPYLzjnr5ls/pRIgnsMHDz3+ 4D8O7drL5Gs2vfLI/Q/+4ce/UGEppR/buP7RBx7804/vSsbq3Mvet/qTN4+rqGDgr3znW6+t e+nuH/+s7XhzfPOf/vkPAHzp5k/i88k3Xn3kgQd//7M745uMpNbuAJIhlcvV392bk5dbVV1d Pm5cTk5OJn77JoJ3q/hxzPv7Q+OqJsxZML+4rAw/15aemYFOirSFGB4NDsfw/gK3B10QGidp nqSlY+UFzScaDYdJp0PEOCPSDjMSISd28uBwOIpOR35NcILHy6pgSVXkywUkX4+mXR26yMgg OYFjVgvPoCdRk/YfxbsSIICK2uJ9WGSwQFotQZyam+jI5PGIH6oBkylWLpKlXQrNinkB0xk5 So4PDHjon6e8vAz91FtvbX553fqc3Gy8k3fMuLHLzz17+cpzcfZYfcP10ybNyg7mtJ1o3bpv E2Xz5Wblz5k6Az+v298X6mvvG+gOBXOCO49uBz47I3tG5YzIQGR77faByECmP6M6f2Le2AIs WB090oDXWB+ta8grKWyvbwtkBtzZni2HtiLuMldBXlZu+ZQKHDf8PnkkFD7R3rqrfneRK6vb 1ZeRkVFYUuTHezLI8hq6UPyAeYQNr9Iz0nILcrJzcxYuXlgRnNAfG8DBDwQD2+p3XfHRq846 d2lRcTFGZK4BtytIyoxWuGPb5tZBzDRdeBvL4unz/QG8I4isDtrXOqlUsrF9kq2Igy2UwgXR 41WRU6dPe2Xdy8ePNVIPLrwvd/mq8/B3yzU3tDa1MCH9ZHyKQERLvkZ2G2n0ZKOf+BAEHG02 YspLV19z65e/sGXjpt/+5M6tr76RX1J84ZWXX33D6v/+1V3fuO3zpC8TbYhZMw9mJiMUQy5C MHQsZSB0Dc0nUNvaCCEvLRnBRML4jYi+/n6sLaRnZl70kev/ccePgoWFvvyCmoP7bv7cv6Dl 9+KHJLq68WYenBoH+nsHenr6jh1deNXVnSdO7NnwOt7bM27mLKxfNO8/kJaVlVtWOmPlwuaj x3a8st6Xll44fpzH5Tmy+e3K+QsKqypQaXs3bz62eXNmaWluRQX6tbqNG8tnzRo/ZQqGhHiR 2c41a/KnTk3D75Z7PMcPHvQFAmOqq3NLSmr37OlpaykcV4HeE63R4/cffPW1sbNn5peV5eXm b1zzWLCkLAc/ce3HL16TvlUeUFZkUmClwnj5IVTnsQpGAEx7kWGUyidlNrRGimN4Wxvys5aK qyElERCNCT1+d3f3W5te//uD91WOmRxID9bU31NXd90nP/mpSZMn4Uj39/SnedPHV1Tc/oXP FBQUtLa17dqy69n/ez6tIDBxclVZeVluXs6RIw1fvviLwUDweNPxF595ET/Ne9tXb8vPz+ts 73zrtTffWPtmVn4m3kvXcrylp6snqyDrvPefj7dbt7W23fLFz5SWldYfrj+899C6R18smljc dqw9pzB72fKzv3L+V4tLirZs3Fo+tgy/cenOoMePnJdI3Kz6cJbDiL62phZrZe+/5YNvPfvG vrf3lM8Zt7hq3pzps0tLSw/sP4C26MnCMH4w1BUKNfd86ZvfmDxtaijUd7zx+DOPPtXV3hlM D+Ici3Y/pHocltEra9etW/Mca4T4fPzv//jfv/7hqptW/34Yo7AhBIRv4MduuwW92Ldv/Twz R8/14G//dOxIA8ZlV960+o8/SWpMNwTXo2iCc1o44vege+pvb21tbGo6e8Xy/73rzpyYa7zL Oz6tYNbsWft37y4qLU3LyMBpsrO2vnLenEnnnXf51VfR1/B7j9TV7du+/cFf341fVL34phvn LV40Zfp0BIwXW9cdPrz2qTWvrX0x0tv/2R/dsXDZUvzYIb5KmGe89vLLb6x7aduGDRjlfe7n P5+3cGF2Tg4OLn50Z8vq1X///e+P1OBlot4rPvnJiy69FD/IhOtsPd3dnR3t/aHQusceeemJ x71ZOf9yxx0LlizJzc0lk5mvfOWxhx9e/+zTGDnml5ZhSjGKlTYMajEiGwYFNWVfB/FtFHu1 qyYwJmdYZubB7yeTaWNnT/v+2p0Y8Qz2BQPe3MyMzKMNDfh6Z2ZlTJsx5doPX51XlNfW0oYR 3Mzp0ysqx//wf364+NxFy5Yvmz139pG6enQwJSUlk6dMnj17dmdXJyakeQV5EyZUTZ8140RT a93+2gmVVedftmqtb23NtkNLzjprbOWYToyV3C68tn/a1Glti9rS0tJ/85e7z5q1eOVF5597 /vLMjPTmlpalZy/BKgZGZPW1xAUNmZaCJtHPQtbZ2dHX3Ytpwu49e+teP+o94L/ww+8rLitG oRqPNlVWVWBC0N5wfOyE8bd859MzFs5uPt5UUlI8bRpKUfmL7/4Uo3+snuFER8b2cTep5/Un qlGvVAcaHWbxdWjXPsgAw5/gFofM5frEVz43c+4cAFqOH//nw49tfeUNSVA1Y8r7r7+6cuJE SHZt3fbYPfe3NRnzQUaVX1r8+e98E4A7v/1fJq3bddGVl+Pd4n++61dAytiRfuWpZydPn9bd 1UUWnGIuLJ9dft01ldXES3NT09//9Jea3XwWTCKRlkr6suuvXbZiOX4LEnX+wB//cmgPwU+c NnXVpZes/efT0+fOgfYf9/5t8+tGWQiVtonBoCZOlEXUXvz2Ddazevv7d2zefOFlly0/+5z6 XbsG2k8su+by7Lz8t954E9ezqiZNwgSvs7drxUUX4Mcievv6/var34yfMnnlhRcuXHZ2Z2f3 z3/5i29esCo/L3/fgQM//elPP3rDjUuWnjV97lyctvv7es+98IJD+/bv2bHj1eef+9dvfHPu 4sVN9Uf279xZPXvW8lWr6mtrn//HP+p27TrvhhvOXb580+uv4yIUzrtXrV59oqVl+yuvHD1y ZPLMWasuXHW04Wg4LaPR5fn4NdcuX3X+nl27Xzt0qHbf7qs+9omLLrus/tChmoMHcREWoznj i5CoCqA3wOoBgsJoYfFYNCN+lO1sjbVnzgdT3Tqep1R08C//hLdoLBhMq6ycsGjRwtlzZ8yY OR0HqaKyAoPYvXv2Yb2xbExpVfWEsePH7Nmze/uO7TU1h3EOmbtoTl5BbsDvzy/IGzNuDDqj 3Xt219fVh/pDU2ZMwZWgfQf37d2+p/no8crKytKK0t5Qjz/oLysry8rODPWG8vJzy8aUo6fb s3fPtm3bsJZWOqZ0ypypbV3t4ydVTJo+Kb8of+dufCW3HqlpCPeF09PwrmZxMUgpMBlmu8l6 HK5NFBYV5hcX+LOCIKmajMsX3t7evq6eLozaeqN9eD9tecWYafNn1tbVbt+xA+R19fWTp04e V1UZjmEuG+KXHRTyISdZFTuba3p2vMnn9Z+5GVZrn8Iqu9oI3AWlxb9+5L5LrrgcXRgqpaJq wvfu+sl1t36Cweaeu+QHv/3FwqVLoKo9dOjiKy7/3m/IEhWbeDJn6MW+9+s7p86c/shf71N7 MRZk1eTJrS0th8XaHBOyEP70k7se+u0fIZl79lk//M3/Tp8zi3g5eGjBksU/+vX/YijHwaJh ySwS/37H9z9+6y29Pd07t26rrKq649f/O3/ZWZBjcerK66/7wHXX3P6lLxQrDKrtCKZxkgr3 h+oP12IcNGnylMzMrIFYtGrmTCxANTc29Xb3YMUC7+/MKS6qrJ5UWj4Gw7fjx/Hbb0fCkQgu GU2dM7svHM7Ly8PaMUxampvRodQdONjV3uENBjDfzMvPx9HCFLWpsXHvjp2YeIZCA/60tGBm Zmd7+6H9+2sOHDh29CjGU7n5+Rn4lerc3PFVVSWlpWiH27Zu3bNz19atW1F/aWlpeKN22Ouf NmdObm5e24kTGEmcON4M2vKysvLKitzCgt7OTtrkLdXD2ov8tOitAollCSsgVclIjcgMv2i7 2NinIbVL4Tw7MBAuLi688YaPXHbZJbhQg1X53Nwc/KwRRkAP3fsPvN73vAtWLl685ERb69e/ 8XV0HONKxl+w8sLPfvm2Kz9wFYbE5HaKyODa59fe9cu7Fs5ZuGLFii987QtbNm350Y9/GGz3 L1u67I6//mTq1Kl/f/De1u6WCKCD0e6eLnxJ8FviO3fu+OrXvoqltLt/fffiRYsxdkOMl3zw ssmTJu/YtuOmmz+KXxkv6M+7/Yu3f+yLN/s8NhWF+MkXNeZZt3bd7Z/77Jzps5YtXPz0uhfm LJiHeSt+tQQtD/d8HO5puOqDVy5btgwd6E0334SpNAzRqz74wIPXferDX//mN0NdvdXjqwYH yS99nczthk/efOXq65hHFHZcZcWvfvJzudgvI7nyo6uh+o/P/Rsbhf3R9Yvv3v3zq2+8/vlH nkCvdOOtn+7r7f3STZ9GGrWx9Y2N//a9b11768f/7zd/Zgzoxb77a9K1ffaaGxhGMrNEUWkJ fsJKE2rZS6+8Al5uv3o1kx/Yt++2L31h1sIFThc3V1x68TnnrfzmF77ERltY/v+vX9710c/c Igdfy88/T2o1XyOUJd9QLBjgVfp4r/qW199sv6l98TnL9tYcPL5/cOHiRccaGhobGnq7u9Gq 8fu7y95/edXUKRmZGSdaW1d84P2d7R1o3pgwTpk2tSgtrbH+yITq6snVkz53++37du588E9/ wvUxXObHpUj8Lhyum6dlpGfl5736/PNvrn8Zy264Rtne3Px/993XVFuXU5C/9Kori4qK4AhD Kvwu4ooLL8Q494c/+EGa11uQm/v4i2svu/z9WLfBaAsz0PkLF+ELGIlG80tLJ82c0XCk3htY Pm/RosFQaPPzz09bumzQTa9LjFA1jQgNGp7x/Uym6zE6KDrPkSZsHZpl8YljiI1kjZSQkG++ 7OawdO7Bauixo401hw9j8o9LLyUlpYUF+VjhGj9xvGejB+cizBkLi/Kff+55rKPjIjEWUHPy cmbPmbXxzU0YgrW2tm58feOMMdOKC4oB6Gjv2L1995TyKe5yV974Akz63D7ikAfiduXl5eNO nLraur3b986vmrO5ZlsPztq93bgpDCEWFhTgCveRhnr8wPil51/y8hvrD7bX1Nc34AyHIQZK JP9IebBhSuiO/eWBe1Z/bHVldSUG87Ub6saNGXvf2pfw09BYa2OoyqpKNMMxY8c89uijpJi4 fhSLlY8p6+3rTU9PC/X0435IFiHDk6pz3nhZVAMFzLWKhCbl0qvBXVtzWC72M/jHb7vlaO2R zcq0EROkFRet2vLWpi2vbJCWD//1/u/e9eMLr/zAxpdfnTJj2qP3P9hGrg8Q/StrnsPnkZpa to6IS3XoxdAPfvHGT7Y10vmmZGEuZSls4yZCYvDPRx7HH03HMBArHzOGKxiJ5fOc81dijSkn L2/lpRcz5eEDBzEQw7ySZde/uE52ahZrs0DWnFlsnzPNQ8kXHtFj1b/7RMvuHTunz5o5qbh4 oL6+tLzsofvux7Adt0QAg5/VxcwxEEzDRcwPXXMNOUHixotYFHdmHKmtmzVl+h9/8YtzVq1a cdGFH7r2Wt/11zcfP/7SCy+8/OyzW5566o9lZR/48IfHV1bOnTf/xptv3rlj59on12CaiRW6 6z76UQy+yK1OGKSFyQV6LNiBHAtz6MiyY7GszMxs3NpWU4MVZMhZiXDT+Jhx465bvRqLbmTx BLcEoF8L41beWJDdrAUgx1ILcUC1WSS5F4BsQk0z9IMay1o11RgHGfRGyrCX3qFE1CxwoyNT gCOftJYGPlBSXJHB4OXB/3vwD3/4PSoaMWEIc9utt33s5ps/eOXlf3/kflQlKrTxWBOGwdnZ qHy0CvKL8G9ueBOr+7grAlaZ2ZkNm+oHK7AMSX57GTPNvhPduC6JS8+Y2cEER8MIgKZghS3S T+60hgtyxz8tNKoFCXLnBjks5B+JE/9tK5RIgSf62pq6MWPKFyyaG/3qjZHo4PMvv4Drleet Oo/VMghxcbKjo3PHtu1kDO/CyuDg1i1baw/WFPhy/ZmecOhkD8cQs2mxP+b6vesXP7/3d7d+ +XOfeeUGaOVWWFT08nNrZRYJNjTDhU52z9f+XXtU7StPkr6M1eeFl1+GryKyWET75be+r8Jk uqXp+Pwli2RWTVz7mY8j+9Ddf8KlzE/82+duuvXT4/EDQhkZmIqqMGsaP8eNOzm++p/f0lSY VzLJ5rc2aqpRyKLdkUGZLy2jsLJi7Zo106ZPu+BDVy5YsbK7s3PNr38168L34dIhOiyfx9vW 3tbb27N3+47/+c53X925HcGct+SsseXlWErzZ6RNnzNv/Rtv3Hn3b8ZnZKy89NLrP/GJZStX 5ucXNNcdwX1eX/t//6+ruXlSZuY1X/7y5Vdc0d/dhVt7qqdOmz1v3oP33PPM888frKtbWF39 mwcewNcBJ9GmxmPjFy0O49plY2NXezu+CBiO4SvAagBLN7t27PiPb33r0J7d5bhfcmDwUzd/ rK25GeuSRVNmkMdC7b8Lo1B/qVAm25HhzGymZQ1VCPmeCdGKhZzaiOGQmYDm6HkgFurxRPuy qyeV4e6HnXu2YY0AZ4yysaXoXjrx7W9vD4UHvvO979JfCHdPnjzl9ls+09neVVhEbslBh4xl iFiY3rIHOnL5Dxdb8Jvy2EGprG2JkSDiQaB0eR1a2lvBiMbe0nwCQ7axY8rSBiMvv76+IJA3 eeyksvLy401NvFdTCsHOBmz57M3X3lxx3oo58+Zg9aHmYM2JlhPof+EDs0tY1GMEOHZMSXHR H++4u6HvOKLD0sZXvvxvOAl3dmDJdiAzO4OURdQfkthEjmaG+sGopLXOaVZjOYlNNjUY5jjq Ic0vLZKESACsalUV+rgffOnfr/jY6itWX4dZ5ytPPqtqSdrtwqgQfdPcc85CbyV5WFy4A2Pv rt0PuWL/+p/fOHfVef/42/1//c1vt772xvLLLsYFTWIu45cJIiVrRvt27/nSx8jNZYaGlgqz TgpRPwyIKmVpoeNVotWMjmcDDdggEcL9DHjig96Lmp7x8LPPXH79h6dOmzZ+UvXWt9/e0dY2 CyMyXGj0+dKzMtevefL8VedPmDTpg9ddG30U96gGrrj6muKSkqbGo/f/4Xf/8tWvLFlxzq6d uza+9NKJE614DACrXf70tLIJVdd85CNjq6sPHzjQePAQOia0OgyFcAtFSXlZMC0tPDg4dsyY isoJq84/D5PK8dXVfQMDLzzx5IqV533929/GDL2ttbVy0qSKCRNwfwZWezF22/TWWyvPP/+S 973v0IQJ7c3HL56/4JJLLnn8kUeajjWiy2NDTLXU7FRNJHQIJqoLeZaUFaZoCFpk6V5kiIJs wkiXM63dJ++GdRUI2J+uGE5ekhrhoWowHMInZna5Ofn5OQU4rhhpY8tIz4D86JGj+MPpIj8v LxgI4ApUXm4uDkl7SxsZatGNDi7JSJbc6YXOD7VAaxd7ImDfMpIiz42TUR8GUcQn75xJit4k hrLhXorujs7ioiJc2RxfMW7OnDkTJkxIz0y39mIAU0Nq7HLt2bu7uaUZlxRwH9zhmsN9vX0k DChd7nRXWsPBI7X7D6OV5OXnYf6LFY3sHAzq88n9seKJguHUbBK2JBr6p2HVgxJD68fFLDPC jXnlwmVLhDkhufCqDwDz9mtv7HxrMxJzyXgKX1zyV1Ba9Ojm9R//6r8yX1ibx7rYn++4C+Oy j3/+dqyXmclJ7vG/3o/1rxtv+7SmwnAMHdyOzVsgv+jyy555/MmH7v4jOju0TNxSoIHVLEKs OXBwyvRpBcpaPvqvn/35D6pENRnhNG3gWC7AFXms2eO+VNR9Z0tLS1NTJBz2eTwNuM6OK5rk jtRBzDDQaDtPtB0+eBBrhZOmTV22dOnZy5ZVVU9Ea+nq6Ax196B7Gjt27FlLl85bsmQCvTqM Cy9H6+sH+vqC6RlopUuWLp2xaFFxcQlO/PDScvQoBq24o6J87Fhcx1+4cGH5+PG4oQ09Y1ZO zp49e3ADx4yZM+cvWjRnwYKZM2eSu2YRDR4qGBjYu307luemT5sGznlLzsLaLn4NFqO8vp5u xMl6q6Sqy9SyeHciZUkxpAJKdkSWCmeyWDKDwzcg6hp09QzEWkN9IdSmK0oeVBwID2DVAMv/ LzzzUkdL921fuOXev93bdKwJ97ZgQbSupm73W7smTK7C7Rp0TIfvEGjwGBrqCwL8CLMYI9Ae KOrGBJN0W2ji4GeTQVKnUURALifDK7S42/WZR9fgh5svuvx9v7v3Ply1CaQFiwoLWV8DJDmK pH8iH8iSFDlArky397m1z02YVHXu8nNKS0teeubFztZ2PKIEQ9yNXeEfs/W5jd3HOhYsXfTD P/ysof5IWno65mW4cbdm/6GM9EK/H90Z4TrJG77qNHziFmWZPGPaOeetwN38WhjPPr7mq9/7 1nd/+/M/3fmrmp37rrvt41jp37drD5tgPvfEUxd94DI0/b/ccRf6qU997YvoldatwaVP0/a7 H9/5nV/85COf/fQvv61PMNHTPXzv/Tfc8snv/ObOh/96H7khtrT4iptW4wIoRlXovEAEzkXL lj5acl/r8WYMx3DfmYndknnk3vsu+eDl3//VXXf8x38e3L13/tln4coGHomFuQU78gLSJnBu zsvo6+5pbjxGntIdCE3wevdv347zcU5u3tY3NlS60yK9fSea8Xu7R3GGK8orXPfPZ3Aj0VU3 3HD5VVdhSIYbI/bv3vPIPffmp2WjE8eFgllz5169+nqc6RsbGze89PLrL7x4bM/+l559Fndg YI1s3oKFWKrftmXzW+teenvdS7geWlVVdc7Klfg+YCa7+e3N0GK6gJ8r37Bt219+97sPXXfd tBkzMGOoPXwYNzxmZKTj5I5Fmxcef6wMnea55+K+EDYgeOqxx95e/zKuexZVVkXC78AaSDJH KFFHRo4J29gXWOZlQuid9/QLL3oW+p2JhCKukD87Mv6lF9ehb2o92lmeOyGC111EoyXecccP tj39+LO4WWzBlIUdzR14OvI79Y3XfeLa3Lw8zDpxQ+zf7vwb7r04duToG6+/iRXr7o7unIpc 3FNTu//Q00/+s7G+Ib0oA+Mv3D37zD+f3rNzd3VuZeex9ueefm7/nn1p+WlvvLEhHA4fOXwk Kzd9cseEg9sO9Hb14jfmZxdP727tfvzvj23buO2Say7D+XDH1h3tbe24MoqnmqoiY/whT9iP 2/ddof6BKte47sOd69a+FPD5JpROKfJ2th5q/sff/1FUUtRwsH5MRnmeN2/DaxtqD9e5C3yl 2WPb+9q/fNPtn/raZ6unTna1taFZPPzX/9v7yq7cyvxAhp/8MB2qSVYqqzKHKmVKOyyTEb1V K2dthJWqrxKXLJkfjMXQi/3+DvPdp7HY+iefxdMLN99+y533/oEh0Yt9/0v/To+k62+//B3u q/zQ6uvwBy16nHt+9dvDO/cyJD5ZtNtfeeOx+x8kE8w3bSaYD/3mT92dXdfefON37vqJNHzu yafu+9XvyDjP5cKk8sZPf/LPTz2KNMYaLIvZ5cuWHpOZo8P6769/84vf/PpdfyH9IDb0id/7 yv8jBWdVIxPQ0ZMTRZEPpmdhE6VhICE2CWbFFeSNPa68saXbN23a+voGpN0Bf9XCJW++9Orr /3wBzxX7C3JLZkw6UnPogV8fwM9Fu4O+gspxGHy9+twL/3zoofnnnIth2p6tm8MDodKx40um THz10SdefeDvgTT/lFUX9fd07d20CSu7OYXFpdMm/+lHdzx+7315GGtVjGusqzu0bWtmfn7u uHE1+/f/2xVXTliy2JOejutOGzdtnDNlGs6fmJBed8WHJk+fftPNN4fa2vD9H8zMfPLxx3v6 +voHBtBLjqme9Kvvfe+B0tK8oqKSMWMObNrU29qaN3Fi/tjx6HDpHMNUfGOyQo+UqD8cN1mF FM+13Nacg5DXn3knWo/JoYCahe5pM1cxidktR0khS5A5srLpWqqCkD3/yE1EMKJB8JYNLMay B+pb3O7motyiopxS2tWRZ2p7O/q7O3ravMemjJ2O12LgtBAa6K9pOYQ0FqTSfGkVBRVen2dw INLSc6Kjr3NK+SRSv9FYd6inof3YlOJqrEzAO7KHj9dNypuQlpXe1Nnc2tU6OX+CLyOtprkm 3ZdWnFnkC/oxoutsag+FesOe3jEVk9Cm0Zl29/fUnKjHklzGgCsjmu51BfrcHWOJFoMyEj9q AYPJvjZyS3Sft3Pc2OmYL/S39XW3dzd5GqdVzEQ3Gukf7Dze2RhtqB47NRjw43hjxrz76AGU AmksnVQVVWCRhB9uVlmybmlWk5mVxuFkMPrJjo7JTmbY8oZGgqxizk42hMSw4gZEsOLyi/CJ K5KHd+7jYrqDDqtmsxbPR866CiapTE1H2ks1lcw59yzcPEV41vDVNG7lJhcrZy5agAons0vM Z88hN4VtoWliqvLIpuZyzTv7rOzcvCOHDx9S754lBsqm2oqvlCKzD1yxJ0kVpNqysTaWLli7 IYN0XF/CPdDEAKMlbFhdoS0KrQvdCqZ5A/QpSzzhSN594EGbJ/MGjJ0wAcRDQpjg+cmjcowR bQkPYhJlOIzVOComjR/fCPIkOR7hRApPU5LrWe6Bvn6syo2ZUPEfP/gB7hPA5BSL0dVTp2Ka efedd+7etg03heQVFGD+S+aZ1CPunsXrq1ivxPsmpXi04LLoTMGzekcGqLIl6Mgk0uyLiaU/ ko25e/r9Pf14Qc2QNo1faTmETvvOmBqZcEeqFzdDZAVc7jy8UoJ0kfTQ4tD5gt60rECuJ4/x AOnHClp6HvvO4659vBiAeHG70/1pghy5WMCL4XwO3JMZIM3mZ+WySwTpwfS8aB7p4Nyu7PTs AJ4Ix/EBDk/xZvhd/nT0LMSG0HrwyEh+ei7mjujo/K4AWgEpIFoCC55NUdHI8N60wQx6yZNO NdM8wexArruAtDBw+Ty4cpobyyevLiBFQ3MKFGTm0lKiXdFXF/nQb5NZre0mxVptDx9swyCd 2eh4Ha+nlyOhl/HIBG6/sHZhGpMEMzl3KP1S9bZXNliaOFXE3MTFmmdxjqTm7q2vvikjkRzc o5JHT2ch5KiTskMrp34QEv7QKrxoS3RjbY20Qbkhg9vO3FE8zouED6+xc5PxGmmSHtIT4XFx XEBA0yHvvyMqUHq8/qgLHV8MZqQpenEFDL0QlircngBUZEPLBRv6JX8AN1DEWpuaXl330vgJ EzDTxEWntEDg1XXr9u3ahfUBXEPA8g6eRsC9AliDAT8MYU/W82gjBhuE5k0pAVGILMMZOYud mUXNGVAjpepFmvY73I/TiEwEwG1YVnZYrPolxpBTuCIneQ1MzjuiNgJBHyofA2nye+D8mOIG Y9xhg80z0D+AegcaGH8wwPTkrDRAnvjH0cXrdNA14S4Z4gVHzutBL0eswI/uBp1UwBcZwM1n EYyZvT7vYAjrrlHcI0ZOY7jnjxzymN+PaSVCdg+EBhAD5fGCx+XDS1RwsiMBQB0K4ZfHjQ0O QEjcw7Afbwsg977iqita4EDfALJgQhYyGLJSgCaI4R3es4g8loFx1yGubMbZhD+xN0FthUAw uTwi0ob1AIiWSaQ5x9PmoAkVNklDKxY4WitWvMSx0R1nAFhCBYI6FBmOw46ICVwUgJ01DBwt hiLkeAaw7bNshQYhc6nmWdoSsBVCJaZyaEa0IEQmewHUA/6xkzbk7HDILCEkIvIVQROilUFk bGONE32TpqKtl3SS8EI2gSeVyOsRHlBn+MaQ2y/6ujrHVVcvv+ACrBjgfNrb27vh5Zf3btmC e0GCuMOJvj+DfA+wEXPyJZGUSKRWn6JGTGUkzCqlVlA9a4KKDK1bTMPcvf14CMznOLU0O+J+ ResiBcQmMYaculHkFKaAkaQ5UjU6jNkKKTgFmCrEhxCK+hR4oTdopUQmLFipsUmYjh7TJ21v Y8sZHDU2EQh3Ym+C2AqBYHJ5RKTNEDsyGq/ii+RFlrUC4kFIpDckeEntVMRArwiOI2L8J98g Sqb0WTR/unVkNGjLh32lWGB2Ar3egDGz2QAED3oT0rfhrRudnZsOHgiFceslGSXMr5qYV1QI Q5xZeRcmTLDXCMUXT0GYkya8iG2YHZmJU7pDIxEdWYKpJQtDBCMJEiQ0K/YVgg3noTt86DDK qoOFK63rhBhlIwy0iIwKOZ6QeWGe8h4HnDvgpvqRcGQkvqV/+wPgaGtWSGNJZ9YnldPbnSAV e0Hi4MMsJsMFGEJIzHUKRsUtjF5OHirhihoymEHBUtKKZ3UvYnAg7LTwhNhUaCE0jooMhCZY n6n3mNLKDOY5w6+RgirZRmImN0Vr6y6+UPNqikizJI0as5mMnJyVi5eQgSJZosPd2mRpjsxD 6XRSs5FZHrU5eFmrmphZieNFqPGfYFh4ZjTPCQizVT+tZYIJCiP5E3RkKleSaatLqyEwycCs hkwCW1IMJ/WIyFnV8goWjKPrUng5pfZaDbDYbIVa2BpGy74Ha1Krn3c0i+ki5pjsIKBfI/3Z OxpPQue24alCvSNTGhiDKQLFmxw3QQaEPI8qED1JYLqM5K1CVWKkRdRMonk0YHYuRkRGXIgY OCH1qslGxJdOYncopF+j7FJEIuViQ6sGrTtAXhozCy3LDZhUcIq9zsZQkkFXk2NOlALgRKNA JAU77sJSii0JhojDbLiHbVyczk2prRFwjiSprPa6G5lPAcpsNAO7iMgYji59aVjpNE5CN9Hy du7ApqFs+W16Uwc2xZwjsPBsvznJ7dG0KbDmaQUwKkkoO0EuEQqx50UWWc4XPyudMpisEW6l GUu0XUIbp1MIs9dYnA6NSc5sDBFLaUwiDCk28FQV10gYp7rXI0vV3hEvg5fFcYQqXQi3shiT yazN10DA2T4ZT1aWJK3iRD9SqpRKEdeprL+4KGel2T6lOa/ZVLqQYlndTMKzUi0MJEwIktjD hl5CTAKqQjRXWlZFIh1fq4G17HBsNaoz2TM1cKYG3o01QHpC/NenlpaimnpMrWdRsgLG9kIh 9jqrKmcDNCmRc0ZIpFDaS6Ec1jGVgaQpljWE5ugkG08YOCJgQwCq4mZ2YzRuSvFGGinhyiQ0 ezBUtmBDPaop3bcWoynLakARKUkEaU8lZ7fWYhgGRkpDSYXZFfclWol5jqpRKIFpJAwoXbCs LcZCaWmVgoXv6c5pbmLDpoioKfmIGwn3o9jZJg2YkaJAhVzT2PBQRPxxmROJkHN/IouDokQA l+accsxIOOTJQrq3wKiYowl3wo6MG6S6U8KDG+TYpx6PAjM8MKGqkmmZMNBnUiNeA0ajG3Hq M4RnasCogZFoaOgSSK+QoCNLtuPQIpJZYs9OT+x2BqMMyaeSiSEZDA0lKbcy/ARo4JJ0nIBo yGrbSFOLSS+EmZLllFGqbahkTdKCsYZhppZM1Fic6aR0RBOiGCNKOgJkDjUyPGZrxSfiG5Uw RtZpohB5R6aUPZGFfXyEQA6oGRs+ZYIZsQU5JqR4ExcHa/4FWuwlJxNoaDEyFWgHkMmvMTPi 81VhzF0Z5VLNLI65UhqzvBOMaTWw5LcPW3KlZsZZmbWckvOscCm5hYDsnfwYNaaiLWl2ycUg MVIWqLNAm9dbnuCjpDJ6WTxnQqmR4UhrqUolYaLhVJJRKlNhtMVKSlsthLYAW6ETQ5JyJ04u F2ptBulILvAMoB1foXSsR8w9WTMbymK/bUyaK2Q1ia3VyRGyYE6deE5OqW29iJZhqzwjPFMD p10N8BatTy2dvu1MLrVi8MUFFi2vDnaClFZMKsc9tlZWsICRiOkiLxEYp16zAc/J7yvNO4F5 lGLHVxbJM+c2m6RkOonR5JqlhDF5fLBmq2WlraxAdrKQYxbmS8AspZAKwitWyzUf8bOCQaKY QEwqdbWIh9cBr1eS05GS0JpgVkZhzMM8nYjhxPG2aCk9D8cShIYWMGtIqkQxUg2kWAqlRLUW aYmigrhQS9iCQ9sPh0S3NeeNY2F2aUZZDrK5jNJUs9KyEsYSVq28oqR3ZJplwqxDeOpwDN6B 4sW3xVuFTGKVO8WTPNKJ4T0ttzaQk1wdLAD2+a47lie7duHvFKtDFtGo1sNwOzLZ4BNXnbkc OGs6mcQfLThZyUhGKcH8mguR7GlnlEKy0CZfN+ZyqHZco4osfuwF0sRMbjOGYEgNxkmZ1F5n 79eQJmWlgWTUBs3pn5KjdFaUk1tGrYJZCLbCEaxo2ZENzRG30ipKy8pwbeVSKBOy8lUJTxOH 5L+qsmYZA/k0F0uZlKkQ+1JIhJlDinlCiyRJcHyY7iPJ/KiQ2vhmfrSCW3G24bCpIQEntKeM nERysbOcYOE5wzfFCbBFS3BCadjYpzRcctEKqqTQhgeWMhsZWkGq7RMCNLyaTclWA2tZlTZO 2slKl5vz5ly8NjMCi/3m+o9TFkMFE83KmtUkhvGZ1JkaOFMDZ2qA1wD6OvJHXvLHJGrHoaZV rQRLoRUJFRghZ38MiU+ZlSYsIbM6J42LaClCAxsLzDx87oez8R0X6jthwpeGmQMCogqzFlJG xsQascDqHhLkpZlGJ8ykXghMexG2SYgMe3uqdq1ChM0rTLzmQE7f7V3ZTk0olESsRS0phJzt pZjHqeSVpF4IK5hILAbcFR+ZidV9EQDHC63Jh4bRqaXaZGS8LkYvvBnmnGO8lnI4G2gaJ0sn uWbOsvHB8bVg4ACJc6grW19iDK3H5XTpwJZEN6YhIRwEIqeWVgyXWKOVEpnQjDU5suxPg8ms qtVsJeZMYvRqQLZM1iaGdggkCeJMlYH55QwykyrL6FVQ0sxqJSRtNMrA0a/GU6HUiTuylKpZ VhoSMp0Sw3DAKTk9FWp/OIUdpi3rLmxIUImWqnEE29gTkYXAhNMaBgPHNzHZn5KZdzh+rU5H oYpQwHe4jHELlaAji18/UisTzJeWlQEwudRqWcOWVpgOE7XIJkXaJNewlc6SSAgS6YrYCD+8 I5bZJPgIhHGlasXIE1iZwlTDkQpKwOZZ8lc6jAKpJiStuhNTdSKGXDJKGwImILJn0wQJk7ZE Z2wJZq/cvdWTwWCXoj6c5iMsAHMYSjmpL12rOZFqc2Ayp0+RpELjYVkzm+VCvVQTtCljyUp6 DSblWsIWZitUDeMAbFRUZMjNVWHIVQeyXGYwgziZSAK98sEmbBJ0ZJIi+YQaIUvjUxWCSstK cie5BJxJnKmBMzVwpgasNZBsRyYGLyYG1hvK3gcJmVZxmlxiZIKBGcxWCACTa1rViyQhCdFP awFJsdnQJJYutNKZTQwPmpxlNRIdI8YwJsc6SMlLOkUmbe2UCs4hGb90zEi6YFnDkUjJ86EO oHl7F8JWutC8MLnUqlmSNptzrRyhUa2EaJcsdKrRz8cpGpwrAzQKFGhZmmQCFEb2WCetg1zW nD0bk2q28aPVwAav1nSEIlU28DMXSXVkTuVT5UirWRGYsVe1ahoIlnUU2lWGBjbcJJ2yMtj5 SUAnSYitzCQwegfU8istYuRlZd8lISSBQUGzUsaQPMt4pE6UhLOJrKbXsnBh4I2UMLZvDVLr kLDhcUAmK7Yy6uVIlmmYOGsghHAUgrF3NMzo45qPoMekOjI1GFmBMqFqZVpoWQ/Lu18hlCie cJLrOJpPCWzLcEYYvwZwzNDCUM+kqkewrcX3enpqT8fqQcynY9jxG4j+zn7eTYi5D39HhoWD tXIOFqcHa1ZKQMDqjhkKPiITriSEK5mtZJAJrhZ0mlzLagdMaIWY7uOPZrk7y05QGeViEEHN DRhME1rITGBkhhaS6HmIN/mzXvIdmzxgvgSvjopYEagVCYSHjDxNkQ+GphKu5TiaI5Zs4ym+ E1C2B50BFAY2+/ggEbfg1AiosVJ7IgQFZrWM75GZOmKYwkqqeCRJM8yWTZ9pCiNbJk0oPWhy B0dAJYyYMDmbK37MIHGRSQHQpBllaG3ltkLDxpxCSfCX8oiMkVirwSpR3TFnkMSHOZGrVGfS J60GWHtK5pCdtJDOODpTA7Y1oHdkSqtNoVtUrAwvViEk7I+BGEA+JKXhWVa7yKCaG56c+0fb hyulIf+iioIqZ3ICkQMIJpfhCTinYXJNKF2whGErU1Sh25q1GolTlpfCrJbxyJsg9NMr9SWX XLVIZBYJULEsPEha5k3KWZZXlADxvQYyx5kwJ8gEUPPBxdyHdgSFjYiAlpYSUok8wAKn7nW/ qs6almjhygqxSqSRUsEqSnIRoAImGOvwjVlqMCakn5JNkYmkk5WTnNkJrdibpVqhnEZqDCYG 2pZyUk6Hwyqix96NERk7poqQJGVsWvGl3IRXpcRAMzJhRSYZjMAae2KlejM0I5CSIaXgQdoI /1KQAomwTWI/BFaTCWsxdtN5LXCRxbedEIisUvuSV+oc4pdAB/1QxaPFm1w8o+c9KWYV9E4d gLgVpQYYFzgySn1Elgyrpd5MArFSzAsCnaqGVM2qadW1k1zFvPPp0yPKpOpJOy4mG7WYJ7l5 muI4k0m2Bt41RymJgrDWqTw0bqokccpW2zAAmKdoEuUMbVEJRt1El5NogWEwW7BVaJUwViaX 5RdZKRC+4+6FFQfFz8Zl4soEY2NjjsNc8aowxtvJ+EiEUedkkpn7I8NcfhTEceA1JqYwUkvc MB1sOUhzLUnNcibWTCRWk5tNrY6kHQNya/11smYWURYhlUfFqH+hErWAvBEYSwnPtsWRaMlt MIJKcNlqcdSFnnCLNJLCJZVppSBZQDUL4lVakYy2KeSGxlYItZNcWNpVH6x0/zYhCgbsOVr1 ZaSNlGJBk6hS/MF4KCMylUyPVuiYHJ8aQMsyuBUmaM7sT14NsNZie4BOXhBnPJ2pgSHVQLId Gdo3GnpKrdy5e+IdLCN04tTkWlYrrHEyozHGB2u2MsuseHCQmllkzgBIyzgJaRYHMxIqGVV8 hzpMoqWCBsNyUskClBAnOYNpWlk4aS4lSNgKVUD8tMWcCZxCcCBjgwf7gQVvBRZHDlQnUZxS SEmCk4TZllK31fPcyDJSsyWzFzpQEnBSHRlrF0rrUAiJVNUwFYlWkRJPVgmRWjbFintRJBb0 8ASMeWg1S2wRoNKDDiEWy6UcpWKHQGdnIhl5NcralAqzlTLHZAqCk1hyDRQZ+mkIdQZz3pKT IRgaSWuISEq6MIvf0ZyMyaYYjoFxo1RMrFzapFIFUP6hsMvSqGzx00maJAlTfQ3BRJon1ZFJ NE1wd0q1EYmSJSgGkkIkZFqCNSExO702tUinV+TDiZb13bTsRgXEb4MGztlxMhhn6zOa93gN GB1ZMg2JYvChDWKMe5X4zVe0Wcu+TGE22juEijyFo8CthLHYSwbpVkoMR4Z7QznEFKHCf4t7 TmeW0xyzEAo6kWGZEYyKBaUWSfjTTy38EArf7BCKnDgRCSITCUDI0+GBgRdI+72Co6YWFJMS NxJKMnKTUikxJ0xgBw5+rByp9EZtAkoHhpSlpMIcUEo5gzMJs+GANVstqzl30jrJmbmT1pCz FK03Q6j5FtmEAAFMbmrJ0OKQ6eTW2ZVASi9GQqrAItNSbZVI1amYOM3CHaEqZKXWyq43CrMv DWxW8lwyGFvDM8L3cA3IdmeMyJxqw9pPOSEh561Ra5TSWxzLd0SlxTmiMTBueaMD53ZYUU7e c/y6hFMA4hRLmnOMgMo7A1gkTKyDzVGatIIHEClXqaRcAZrpRiMnQ1G8yqRUjoZne07pUgZh jzNJpZFJqmS0oaSiMZIJSQyo5QiqKmt69JilrwQuUJnyzn5pIxNaVWtZ1lopg7RInNBJzBa2 2iRc2BZTCM2kLCd0ZvcyZzaR4gRWEudgLvVxEglcJGC2WNMGrkk1DqnV5TQvhbbdnCyIJGES aSUBakIDKypNI7Px+RSCkU3K7mHY555k4xIllp6TNVRwgkMR2SWThDHTlMDSm6OV3fF0BEu6 uAmYyxGZQWXnyIYGMBWppoGWWk3OiGyFNj7EySF5vC3JSArf0VCMg+RQJAbA58iGKf2OLK1D Ic6IE9eAPCKJoe8BBJqlfI0Pb6J2LdWm0vjyvtBoVjIrSAWO1ik/wwmQ5YRnArOjAJGA85SR TeU42VCr5smQqhQmvFRIqZSoPlJJSyZhBAEldWRmAG6n1aw+QCMk8kkNNgqQFswBPgUViUB4 R9IcgHkIgdk0tyJG2Ew5syUDsE8KkxFQGRUxC07ibG5QmfwxsYmDIyUsAae5apiVNJHxamXm NSR9GNE5piSnGrJEa1rl+hp3pQGSIXEijy+3dQSTJOXa6F76Ygm9GjW1c9ZmROYM5hrt6MTP JmQ7zQBaaU9u9E5tRUbBAPh8R8OU4ZCEFvOpE5gpytMto9Xq6Rb+iMWLemBVgY7spNcJa8vS rbVpM5WUa9nhVYJktdLIiKwqLrExthpxiVXhSDsKCs27TeDJOR0aj2aluRpyMBrPqZVlZU6l bPFrybF0mguZHRLdkIwcQ2OK0eCM6xIOY/prfORQWbNk1SUrjWnV8S0ksDUDRrVEccnNcZhz +nCFaUHHEvgkFSOyKFdcTwm0WjVqWZ1ZD1TCdaBUpJAwH1r55ljGwCvBfESNC9Z0xK9fgZW+ zcxGIXjUMniiiT93MGwpubSUruvdNZcAAEAASURBVJJJSCuNTT9UQi32nFuam3zJuM2FNWES ZQxmltIcS3OpdQIwJLQGIxUpeG0GpwGlKy0RH6ZptaxGpWXjgw0tSykFAY+h1Uhllly1HOpm 9pWAJQ7YLvIEbEmq4RRvbcQn8w5HEZdrgH6G6WeU+saXFzC/yxWg1z68Lhf+YBKlNcg+k/T4 3oTJdsbq+b1ZCaNYatKI6WIm6pc04hj5QwsedLnCsRg+2YZWG3CTdozvtBcJasKbb4y3ZoF9 9+0tHZlTY5StldaBPUo7WbFuQvQjSt0JhdHDKEokNXYtS7HmcLgFgKxXAgRHEMe6O+bqc7l7 SI8WQz9V5nEVumNZLlcaPdw+GjBaQsTt6o+5Ol2uNpf7RMzV6nKjy8txxdLdrkyXK0jBgMEp /sBss9kFKWHydG5IZIoldHOtfBp6JLK07IYbnuI7Fo7UGr8AEN+zNFAKpZSMqRUBgZlsTBnF lzE21BuHAko1qTkTcYk9p9NQbEjpWCEMLa6hyGGReaRrLrM1bEQAA3RM2CKxWEfUhRbc5XL1 ulwZLleF15XrdWe5XUEPmqbbLw5kJOrqd8V6Yq6eWKw7Gjsy6ArFSCPOANLlzvaQbo71a9GY DIw518vIpOJT02pZgbLfO4Ed5Vrtm1mdrICydGTUUmVT02baeLmhWcVjjKvDSQt/KCcGXF0x HHQ3OqxcV6zK5yp2DZZ4YznuWKY7lu1yZXuiaAwBd8zrjuHshQ19FjopGPbE3J0xd3/MDYa2 mKcl6j4RdTe63E0ud53LVehy5dKBG6oM7cG+O4sb5NCUcQ5e8oQayageHenLyYsEqPE7gVXM uzyNKiB/btp5DcbayLfTPd7nmex3FQU9WV53ps+V7/XkeN0ZXneal3RMQTGnQp2iEYdisb5o NDTo6ovGOiPoAQfbw9HOMNLRhohrX4S0YPRrWR4yXsN8hPVrI1Gttsd0JIiT5bDvyJK1Hgnc MFswM8dB7KfBoG/KdZNua6w7WuR2TfTESr2DYz2xLDeGVzGMrXDog2Rp0OVBX0ZNYIsDSpuB O0THcejLOmPRhkFPs8dTF3Pn4iUVMXcw5kZfORhz91EGpNmmHUItK1Cn1l4LMtVDMExz27oY DU5bR6MkZHWolSK+L1ntfMDOTo/hGBlAZXldfo8r3euZ6PNMCrjLgp5cnzsXYzGfB3K/x41P D50/oiGCCI5hjplmJOoJR9FMYwOkL/O0RKInBqJt4cFgOBYKx3yDLh9GY5h9EC98DSWloEWR hmQkjBPtUyOn9eiTg15erWYOWdcOI3qBFnsWIbeiO2gEieNicaJyqXo+KAYn+4MOiR63q8Xl xuRxpie20BOd60PnFcl2xwq85B24ps0cKlTozvCHHjANg3QOJqD53kEM1jA57Yi6j0a9mwZ9 Wwa9tW5Xjcs1gY7x0YQITuOHRNksk0runhlZtIpliknOa7GKG52Bto/EgdSJMzkSSUpoxCRM RiK1UkISmtQpAJNNqhnpw8zOclLJWUVR2RxT1ybpmpnBAfFBBmKublesOepe6PfOyfDMzHQX +D1FaZ4Crzvopcu9tLbwNaJ9EakUmQABGrHPg404x7canABg2IXJaTg62BoZbOoL7++LHhuI 7uyL7QjHKj3/n733gNMkJ++Epao3ds7dk/Ps7MzmZfOyEdjFRGOCzxwf5mxzDofP/jgbm7uz z+n84QQGfLbBCQfA8DPY8LGA2cAGNoeZndnZmZ2dHHpCT/d0fkNV6f6SqlQqVdUbOs3M2urq eqUn6dEj1VOSSqWi6J2h3aPZwwkmBaNcRjKJI4QZxEYypDNijdKFbNJ+9Iorb5cwbkwEIciP SwsLsIRIHgCCpJ+tGKZzU8ugIpIsSPq7b2lCOF5Of2hAX4jkFQQcEiT9HKX3mRVTB5jVemPG u9l2V9veJRm33/IENSrcZ5I8OAdCdIE8juDLDeKgDIgFBgnMnXn2KKMvepmHHOs+z0Ib6OMd QN6bwyGDLgeQQIUAHcnHxBq8iQKVICOSyAuaoBQGeSQZp/EhgVCDoHYSom2b9fVXlg2Vevuq He3VYovb0upKrlLJnpmxJ8Yz58ZyJ4fzp08VnKouz89SB0V0FQVKx0ZoGySL8CCRxBZYwqSV 270orKG9gkuZKulHcGHwa4OyMZcdYvTWPN2Uz1zfbm1qs/pyNGdxLrRiTH6BQR74UV2PuKqR DAQlJIji0IyQJnpq7plqde9k9ckJd2fZO+yQAUK6bO7y/CzCMip5EqQn9XjIoMUMAiOpEUai kqxBYsnpOZZbteHIbpNp/d4YFF+rUyE7cEmA87QwEeeWEYW1AkUkmYJLMmQUREIhHGJmwSUj SGI/ThmkYWCIqc9TjKyl7DLbuzXrXmVXu2yGSQPu4PwagTg+GJxngDAuSBwuobh1YTZtwqM7 WOZl13rKs37gWqspwewbAtyZKITpoQJwqIskU2XzkyE+jKWh0uAhZ81YxKo1KYH0iYMsdV6J RY2uWTuz7bLJbdsm12+YXrN2NptNuctH83JdevxY4eD+1pd3t+9+qf3Vva2ex8UbWUSZYE4f X5usNlbJrE0WZKXIeSSwhA9UG2TG4FEulRMieNI065HThD+NuqdgX99pb2ml3VnSlUGr5W1O yVJcMmM9GREfTYBdp5TSBASVhWed7mjVHS47r0xXX5h0Hi7TQUJaKZ93q/DME4MO1+M6cRwe h6TR16bUuWRc0sOReVUrwZHJ4utnziaYlF/QHZkG9PNSQ7RERwYDSxZdCM/OzMKXhh+pDLjQ k8dwb5LRAcrW2O7mjLfF9jZb7qDlwYWJfr7s7PvNQDKGguYUg15SDleQdz6py8gZzzrB6MsM jswedq2jjOJJKB4lAc17Z2bGnFUPfjogM9EBaRoc+BqogLvWb5BzAk0c5UOCLBUBvNW1rxu/ 5dbRG28a7enBU+L5hsmJzPPPdj35eM+Tj3fPzqBKI0Hle8E6MqluYCelpl8KDkcZ0I5xezzt 0WWY9spYvXlyW5u9pYX0ZPnMF1ZOyAFjpOgLmoAOuErQO5t2vZFydX/JfWKqemKWnHPZjEe6 RT8k6TakygVt9LiuXBweh6TR16bUuWRc0l+gjowbWagpz1JjCYTeuPXBwrilvN5y35ivrra8 PsvDEA9BWl6xS8aFPUvD4SwdMRzWFCGvevYD1ex9rgUPmyWU+1Oup1HTkjVUx08HhTTRAWEy XHAlowLG1N+ALcg5lVAiJJlPrPFu3jz1lreduuPOs21tKPfCh0rZeuIHPd/51uD2Fzp5lRuB qU69gYgkmypjhFNLNNUj0/h41Fc80IOLgg1xoOlMWvQuTIS1WJcUrdWttGD5M1+4SSIELDy+ 4EHWo025EXFFldzq0ZnyI+Pu7pJ3qMLyHn8KJhWQlIECKqUiASb8jaPikJBaGEMla1MqMhWR 9OiOwZfRK4M5MoWWRdC7S0AFQJ9KnxSTKEUjIjwLwP0jUNCgDPplXKaBUhAJxzmDJTKiASyz vPdm3DvyFdw5pBrctWkSuLhFDigQDp6p0A8jzYec7P2u9aRn49lChzbGjNZU4N0EF3QMDJOq biJB4qWVKsJAJEoMaAK9gnTMqpbFbrtt9H3vO75lC3z4UoRjR4tf+8ry+7/bX6nI9iIzDRxZ k8XRNY4XVsca8TSb+/nLhhir0ADrVzSW/BA8UsSSRZqx399j39FFu3K0aPFZMHk7gE5NqWVo 2VRSmc6GOhZWaVQPzFZ2Tle/fNbNebQoHi8Ir6oIlfg4BKhEYBpLIrEGjFhBgyt5YQRejGFo OR9HJnNT7UtlDico4/45eBioEXA9GnRkIAPjcYYnkt7NGeeOnLM542bFkxY9l7BkSxUT9sUw gM9pVCmebFp7XfvvnezTjC4Xy2gxm2bUr18lgSFq15DJHJQr7aIK8DV/a2YZ6BVKUBB4jjvv HPngB4+uXo1HLEsdzo7kvvLFFd/65lDwZOAidGR5yg67pN+2rm6x7+2xL2tjGEii+fD3S/QJ 6qW2rfBAjNhQBivR3MruqZmvnnFeLuFxJx2y+dq0mEZxCEgSgYrVwBpJSaYBVbvjGA2u5IUR 9MiYY9lDQ2tCmIhJGfoZYDOJtJy09yPcV0kaEBuujTc6QSwjhjTJpXiFCv4JcmBdXDfDhN6V cf+fQuX6jLvS9jAjidLhMYwQrHMsaVzkznXgvoxi0TUbsNhm6pX4owDrJCGYyJN1wF2PdtSu mLQyhFwQlR5CsnQahakpyVcZxJs2Tf/mb+5997uHOzsXZSCp9EmLtLS4191w7va7Ro4fLQ6f wGykamy8BGmlCPpJplTQp7Fw0iScZFHnGE2ASeJFI8Yoju526E1F6+6uzBu7rY2tfAMtXlWi ungjOn9Bz9yieGBqr8oTPtxh3u4q7RMObh7aGQ3SSMYEc0vGaGIAjY2/NexRe2jZGtQKLKkO WUmydKqMNZI8ZyHXIAZMhysyBZcRnUaI8U/wYhiqY3kzKvx62313zrnKdrEuDIvFRDi/le8r of9AW1xhvZQvyCgJ14YnAB2ieE31ocxKk4bTz3quzcZ1OaLSeSXphyYQYEyB/fR/PvzRj+4f HMRi4fMcOjqcu990Bo9HX36pA2s4oJ5sYiKSoFuzcF9EGpueQxqNAUcSzQJPQfDW2xVF+209 1lXtdFWR4las5s8uhIYMHYJmZ2Wp1ZmlHZbVlWHjLsMrAXhTb5FDkDmyaTovhsfcDI5M9MhM 7qCJcyOLQ0aUzSW9PBv9L1lknUDFZUQpi6Q8FETyyqRsAJgXG7TYB3Lu7bkq7Al6lBk5KlGK 5TxGVCmgG979WG558F9oq094eCVOPKJtWF2tRoMCNcwbMDTxW1v2NVeP/9Ef7b722nG5yrIJ uYtJirUdb37rqdGzuQOv4kVYXoK0UjQL97VOY9MLlUYThePRD8UADbe12Qz9yW775i7an+Or hzD3hGsJxFF6PYeljktlcPaYlbfs3hy6Zox6zlMlUmCY3VPX/iIr1rRFuCPjPbKoI1PFkeoq qTIiPYiI8ytOS3Jy6exQNzIiRXE4R2q1pggkhTjrfRaIlccORv5Lznl/rnpbvgoIslQyhcgL 6yR1g5JwwWss71LLW2bRTzFrlXgfDliguNUaD0Fpa3PVxjaem08pMsWK1g996Ogv/dL+1ha+ mORCC9ksu/nW0cGh8vPPdruOeYlJs+FsBAOuknUiSQ5HsfDWHrRwZCeaNvQRUDRZNIW9jLTm 6K8P2G/o94eT/OEUmC7UAN1Q53gDqtXObWqjG2znWzMsi3f0Fl5nren6Fg0gwW9NI/lEaY5M 51W6+/nouKD+dBqJlxDJAohK1ojrKNkXgxf7dL78tkJlg+1ikgFKq4xkLhfmGUpKVQsW2WC5 NxDyd56Fl+eKc3Nk56OQ3d3V3/2dPffec+ZCvtxgmA0bp2+8dfTFF7omxuUKHN9Yae3EgBvJ VEvXpkvEAii92POu9eEe6/091k3dvBcmW0YiS2r25wMBDaEqDryZvq6FbLTcJ8rsmEPw9jKA ixLmYZTajgyChWxfcZk0cpNJBTQi/MYEkH4WJhAwHpP0IZdAYA4Uu02MUPqLuerbscaCv9rN SRSZkHFBn6AqtxrFa550iLJuSvEc8xiheBWkqe6N3kuNF7hui6pLEJcJzdetnfn0p17auAFj +osgdHVX73rT6Vf3tJ0c5k8AZDCaCpLyCPDJZAY2NRmVriTz1q540GRdSvd61k/00rf00A0t YpnrxdaIUR7RhmwMhzss2m67GGY2PPdvND8tKW1mnH28hCpDGhFNiIaRjmzZ0Bowq6DiKgKU ks6BMiHO8o7NgSIYEUkIjITXxkoy3Maw5xLeyuuj7D/l0Bfj6/VlUOwB4ML/5ebBvF6GkRcZ neKL3vhr7QioD704ydUDOp1IMC726crLJz75B7t7uhdgjf5iq6rk53Ls9rtH8Cjz0AFMmfFg mC2eBMQASsbaZ58rjVPBEYH9KoxkM9Z/7CEbWmhbhnfH4prVzu+CwVotGb7OmxF3T9nzPP6e +bwCt1Rqm29eMtV7ZIpdrw4JBCQOBMqHBx0upGX/i6MEg2KU7PIsGfWzDocjO0gonlF+OIv1 YnxeTAZFEwAu9F8oLHXGeZnFlhELjzLv8+wBAcWpoYqUIpaqrNdde+4Tv/syFjosVYYLlg+e Rdz0+lGsNdu/D5tmhs1VZmBY0Ug2rUQav4Kj1Z5jpIwxRa91Rw82PhQrxWJqNZ3x+WCQhcJS f2yINpj1uoj7wDR/Kg+/5j91FVqpstfQUbZ4TtkIdQ1BMRQcGX9quWw1lyzckO+JgiQHCi6V sxFJxQoETgG9f9nyJx+BvwvzElmg9mEcbP71Btv5D7nqXbmKuAdwCYGQWAEueAA0R8lxXml5 K/nCHOsZRrvE/IneDOLlCOwVx3CIj40iE4FRklqpK6+YgBcr5GvrVUvC+cWhOd1w8+ipYf7+ udFgaidRP0Hbj0TSigNp/BCXhpLsA8GTp/SkR9fm6D3t1rsGxf6FQpIiTZN7wcKhOW/EeJeY ZlcVXVZxd5f5FEnRCn1ZUulCm/hFEwAYrvlQp22jzQpHtkZKNnKQSf0MMkWjww0gJxMgnBQq UJ5jJFChJAS6Yp0SrvYP5SuvyzjYKIlbL2C7eH9RBNgZThn7066h3h5sBCS20FCdzVpFW6ry r18/86nff6mleLF6MWlDtK0bbxnDmgwsmtWtaljRSAatVedoIB6TwnlQqXj9qC9D7+q0fqiH YCsLXPCgTCRuIJMLhQT686ZB+bKMFYXq/hlSwYtWXrCmt8ECCisshikwl8wd2XK+IJarKcyG szxESrikoA8FhO+HxO1IZ/GJg75CmiNTWShezohvf2DvEEpOU/Jz2cqNWadLrOxt6FKXGV/Y Z5QazQDFwUaPbYR+07Mq2EI92jeXJTDvPNJeQelMbD14gE/5ldVMSf9A5TN/uKur6/ws2U9R bo5g4ctGtz/XdfYM9j+NtGQlURk1MIACKBIeCbBmJEKkElIGHq7vZ/StXfSOTrK6yEeUybIV 28UTCQpitWexzQs767r7KgSrJeW9L8DWLI8gSqCMtOtIoqY4IH1i4cgWwV1IXXE2jqhaUEIe AIsNphke8F2acbBL9SLoFM37fKRgDFxbWyjfdxtbUWE/NWmeWrooA9UiqoNTdk6MZHPe//6N Pf394q3QOpIuDnS+4P3339qDp5lxdZMNjrfI/ENdGZLVaL5IJgSfiP9Q/omQ3gxZXyR81evi rVRIUGOJQPDMGZpZW8ysytOuDD5ywe/PyYbRNFqIZqyJS46KV5QESupjaGUAFVaHG0AIU1iF 4jnoHTogRBK1jxXwJ/GD7pjt3pmvymV3rzFfJorLbdBrsRyzjzP6LOPbMeJ+FjERJ4mF+hQx lkYAQux/+4UDt9yE18BeUwG70V6ydfLB7w5gxKEXzE/guhIhguOQGEDSqXMNPJ/8puSARz7c Te7opL1Zvm91DXol8+KKoEQus3tyDLvC55jz8AztR8kbDMIci2ETObRctmwNhGNwx50JYsGh JzlchODXp5T04syrLcQaxD63T6CTIY6PhvRQcovt/mS+jO8byaBoAsBr5BflWkXxBBs3b4pP PalWEFxcycUMsZpdQmASU4gFS9IBgrvvGPnpnzySxH3RwwaGsGkD3bUdXw0Kg2Y8DjSSAZ1s 1KbNFIO8UCLcuOviPSSP0a0F+qFB2pfjlwfsm5JBkNHF+ot37qx2O9OXq7w6RWawXk678vUy hU3QNx5vhtwm0i5RtM6o4pyEM/lHcs3wCTI8ijjPXR+sq9pF8IK990NZtwNbywVaq7K8liKo ELgwzJRdh/La3vZgF8bzUsa+3sov/cKB85L10mT6Hz54dPOlS7JpGhZYoFN7kpK3d5HBAh9t zW92DI7BJnaW8kPsCrY0BmssF/gNh1kFO7OiULinm+xjDBNDGEef72A6ssD7mXpxv+dPasHb xA/Bx31zeIgeX6R3L9mkaDAgieWv6wm7jHrrqSNUAew1HlDMIepeQZ1NhGFqCq6t2aCbsS6v JI6fP/pfD7S3vxYm+NMsgD0gf/5j+zJYjhwLspHHwE0A1GWCngDFd3DbKdmQxdpX/nx6fgHd HUzaTbHSSW/ytDdVxlZbF17XjjcnfJduY4u1MYsiM3zCboG7IMrACdZUjVnHYUxZy04hVsSU m/K7e7qk9LjMWOFDPRhfOXgN8S6j7iA+6xEZniry11QEVkTAisL1lncD9dBhkA/ojUIqExmm 8+8gBnU0abJEsTL1+ltGb7tlNAnzmoKtXT/zw+87zoukGzRWRNnIg7MijdBxrBjC8PczfBML Dpwmsc+9Ta7Ik+X8USnPa05BKoANryHAoxSbnuJA4OkLLeA7ZXhlZWXBvibP50ew0z+0V8G3 j0prEYlKLJFCqUhQbxp/QlTazeyRJRAuDgjZw4nuofSNOffKjIc5fvRNdGssTrbnWSoKiGJi H5cewt5muwcZ/yTwEtcBvhjykZ8+dH4NwUiXa//82dlvj1Z2ea0OaUenxj9YmzdJzp4tPehY H2dk5Tz1fO8HjnX3LOYzWeyKNsz4iPLOTtIhXkWSF1aTevPLgeA7hnicXcpa2fe03/nJvo/8 794PX5/fCgie5KdMRDWZzYKQQ1fxnNfuzebu6KbTGb59M8bX5zXYmOyXCojBo6+LrAtdtSDu Y4RZef8MzkeZWIw9I6WRXKAAIT+LgF9curiecQ1fTdgHc+UVlodrGyEgEYnX7olbAF+Qo+yg Z8/i3itWzCbepUwbgDPdRoYEI6kY3/Ou4TfeNWJKXsJ0lXykxP5nruWtmdyl+cJAJiMr39cA fZBMJpfNLbNz22Yrtzresoy1m29VOaeADX9aWrxnHsfzpDDocUDjSUBkgxURk0Cy+K1/ltEN OXJrO7m+g+TFYndDXJhtrRgmxc6wyayVe0vrzT87+IHbOm9Y07JyRWFoXWH1CzMvzXozUEKM OmsJWXIctTts90yJZDw2iW+Yi5KbzY5bL24SCVTnmOZxjiQpgk32lHVHFkqLiwkg/q/80c9g DmhMOXEytFxsYH2Q0A9lnJvEOv5E9lDQaygGa6CuccY9bILZj3oW3ifHYLOhybK4iRu3jOAt FNzf+fVXioWGcmtcdoOUjrd12v18rvX9dvZS2+6x7ZyN6exYwOeybcx0Wx2WvdrKXleq3sK8 Uxlrf4ywIcDaDdPf/9f+6anQXRpWTEka4FheuBujO/aqw97cya5pJ2vmuAIW2WQIPvw8eW3h 0ttar35nzz3L84MF7PzEF2lZLXZLFp+2Kb9YJW4rzYlP9cY0WXoAlMaBUXbB9qarrOS5T5bJ kPbS0nxVSjJ+Egz5SEdmDmukhmlqSGwoUKXTIimCpNfGxivYvbroP0ZIIX3tgvHE9nLqdovu GEoZWrVGkWG42B1PwmLgZCnvfNup7q6ExaLJ1DFoFZ7I+V8V6/Nl+gnEY/gaAOrQ982yTxfa fsjOmL2wNDZ01rLZnnzLnY79iYr3njSy2nDM97/nA8fiNEGbDX55DehHA3YFCbrWm4tkMMvn Cxqsg5gqDsEj+7abW696fdvrVuSHcpTvL4EuIRxZ0cpf13bltty6Tto67ZUvtIl/vj52TQEH QWuWN0eYcOGCrI9G5KEe/NoLfhWAR0QH2+9ECwK/doMMVGXLSL0cBRvEVfH+PMWKKoadVEWH FIh/cwH3kFWWBwu0UQbXUtcEyta1LZVKxj+Uw977ruHa7KlY2lPxfqjMfscufszK/7iV/8UK /b2ye2MqfRThkDc79m8X227PZpveBQburKXtyqr9W2V3jr7szjed6exGo1NNPaqcMJmcxfcn 8pURg4jCSiGcH9ctNufpt9nyHGlP6FdG80hO8euL0RmvvDo7sLVl8/riWkAw3c+9GLVwILKy sOymwrahTO80ttTgjvPCClZvzsZTDnTH8OySP69LMXKgdWjAAKL/1sbqlHocXGaPTEcvUhy5 jnPR7HbLW2G5aAJz036R1FsCsbK8OGN3/xupN0gZniCiJgBZ1HDrTWODA5iZnEuoejdX6G8U 2t5aKBRERylbaL23Qn670oAvq7pbZ92fz+bWGdNhjeuBibNiyybH/rjjbWucS1Hm8t69bz+p kgsQQW3Bi+Gh++uLZGWetNhzW8qPx5IevhLHzt1YvGIo24cRpccwsR9elfAN8GX3dN1+eeuW As1rH0FcgELMVwQmxR3P7s5m1uQzWwts/PzMV8hS+CZTl5Yqm4RoSbmOTAHkrUolUyJCilxQ hlJKHnRCTzCK99Juxh7W8QcEKZLmAua583sbsbCuENOpGZLBEADvweVJNnYAyFFYF4MpC0HP 1wgZZpiLFmk8sAasf7nFsDEGHl/GOypBb8C3WygnQIhnR75ZeTxpcBPQcuyb7zkdCmkmVnZv nq7+ZLH1at0TYXqrtePOWfa7ZffW2sJc+u5C612J02G1GXUsJs5a2rY61s/pwMbjb3rrKd6/ kYMMsZBCTGnw9pdSxxKMczQIg2JIBQ9EzzByfRtpR4NpcI4zKorfurDsiB5kMz2ZnqzfBJBB GECADtpQvv/u1ut/tOOe3e4Z2U0LKc5vDNpnLasnl93aQvZxR8avmEjwzYiC4OAlFsGHRij1 hGq2OtCM+91kAQ5nQE2qRUtjFSa+VdpJ2SqKqFwlEyv+3HMXFsNWe/5tzePLrB1MlVb5uTJD SlP45ijfw1N6VmQkjQpLYPeXfJvwcQXu1ODO8NVSeBt4YlDzN4uEt+A+YQGCvNkOEXeQWBhd ygVlCyM6SbvODufGG+byWqVH1pXJ/9fRfQtciSEYkPbO2ybG/5i6P5eznxRY9LBRlDB4bGW2 eIsdHVG6rjs5OdnW1qY84/T0NIAdHfhMux+mpqbg+4rFcE8eSnP5ljd4MystkjDnFfAl/+Kl pcuvOvfi89gOLjX4F1kqPqh40KE7hgOLV1fg/leXL10iwU7uZJDmptxplzcBXO4xadwB0FWF FTdTeuPMs8PVs0V8GZx7wMVrLDUUjqGgXMHKDOUpvoTIVYrpH+NYDMC8KmEOCqGU8F54BQ6b WeNRnfARcxATY+HWExZEO4BvrFaIi2aBBz8ewQOgjM2PQo64GAXkCbaexXbafGPJQA5YsQQ8 h0fIRWJlePcNKP4h+5Lwd1j8Z+GlEf+mwrmkRwvY5/jLFcb34nos0gOVlTJzlCZaEXiFGeIy 3nDXSDZpmXuc0oDMOj/V2vG6uBeTZIB3dV8zNvp/CPmpnP0cpneMK7Hsvt1iV+tzSHBYcFIT ExOO4/T19aHHgTggECh9GfxXpVKBp4NwxHM5dOL94LLeqvdjRev3AkATv7feNfLi82h6KQZq QFLIiZsaZre6Lb52LIQ2ICJKIuqcdZDchDvlMFwZqaHFKgzk+rbm1x1zzsCFXUCz/ujSopfY laW9uM/5PVwUY/7N2bRFikSYHweqwccnVkeANGXOJS38BnLBDjaXUHK1RfrhZYQSiVk3kQXn hxHFLUr28CpTZArvZbukPUs6VpChtaSrh7R3kq5u0t5BiuhwoeDaxQUu1yGzs2RygkxPkfFx MnqanD5Kxs6RaWwjh7WaraTYqbUfcUdEtinGbUR5Weouy7uEeVcRa6/YpAxAiGxKqkFsJJUm eEVcxZuKVLzX5Vl84BuR0d1z9djo31v0nRmUIxrKTl/e4ztQy4BN30ulEhzW0NAQ/BfimP7f u3fvlVdemc/nt2/fvnnzZnTTxsfHe3p6QCw7bkBJdsbaZkqXFNXuAoHYRn5vuu3sn/7hBn5n SgxRwxltknfK9TBDGLZtuSnL+oRl0H4MAp04PY4ZMVwB/VbLwcrRKTbTR/CRCrPbix6Pxzzu K+z2eztvf2jmedk+ZFNJl70kGFzUKAOGLv0Za0vOO1pmtpjiC+3hmzUENKRXxJoqIWWpZCgJ H/oJE0sSg/MYw6781MUmEEXhJhPUalwTMKMDgL4S3NDZ42R2ijgu2XQVuf5esukS0t1Dli0n A0Oks4NkcwSjm1yeFPA5eM2F6Xl5LilXSLXKO3TlMvdoZ+DOTpORM2T/PvLcE2T/LlKeJm0d pH89sXOoQ7/fpwtpOC4LjvVC2G5mJWVPMr7b4iKFYsHdhiXicwotxe607pgur7tny9jZL3Tm ftgimFYPvYJFsbAeI3l/hIheGLpgcF5nzpyBqzp79uzy5ctbW/l3Q+C2EIEXg/NCEj4O/gsd vNnZWeXI0E+2LMyvziXgweWmLZP7doej17lIAQ/m2iY8fFiIrMqTPDrvYWGbFSinF9poYX/1 2Eh1bCDT2263SaAuCkaAO7OpvSw/sNLuPe2MucLlLci4QM9oLnFs+4GrsJjJrC5UXqkQ1CTs w8fdSxrMoWXtLlizTifwoH6pwA4XMsL4R9JW47GzaO/NygzNg4l5tCGnTI6/RPrWkJvfSFau Jpdeju8dksEh3v9CtwvzXBhU+tP2wuupkY/R/gCHgysU+AEUPzyyei2Bd3McMjVJTg6TQwfJ 6ZPkpR3kmR+QU0dJK3p5mOCifPZtTgF2QfH7KVuLWR+XKpsIcFyiqXGUQt3zlEV9s4Psissn 5zauBC/WcpnDxWjGKtXde8Pk2B+1ZX6c8rc2/GBbE/BFhPjuA+PEcrk8PDzc29t74MCBbdu2 wa8hfurUqf7+/u5u7jQlCm5uZGQEfg19t0AYjD1VzO1SyWYjV103rhxZWlNX5tOFR4hx98fb hW0WW4dHRlh2EH3TUGdrKM5aaG6Xe+KV0tEu2nFJaxsMYhicVzx2UWbVXVOv7HaPd/O7cQa+ rCHxi00kdLOKtr0uT8+goyp2EI1Mk9bXQNpctNdE89eRAJ759siazRb0LmF4O6cdk5XzCZjJ Kk1zd5O1yevuIJdfS7ZdQwYGyYrlpLuXYIYYXTD4JuPaR46ASF+mPJpSQxEDxbGYFxM4xAtF 0tJGevsIOgurVvOO3u7tvLN2DitJLJLHqu4mq05lyvsqrJN4Dn/0tVjh2qvFipc5iefjmsYY cQU67DbRqEJHVsw9RuyDmNFWMtpFQBIOC2dctMpVqan99evXA9XVFZmb51c4Gc1nnpjzJbz1 CthhldKE564nGo/jmrMxyyu/udo4WyIlnCTF7OWJ8vBxu2dz63rTi2EimVLMoI07k8/O7Mxg lImHDHPUO1GBhQCiu4g9Y/V554WQ2riM+ToyfRCRlKu0tzwLh8uJsHW92yYaI0BN1wgYcFRn 8d1APmZctoLc88Pk6mt5LwydqeiLe75KykMhHfdfPpH4SaPEsLSzkx8g2LCBbLuCvLidvPA0 2f4UGRkVymCkmeQ3deGxuCw+nuG2E+4sEq2hrBbjjgF00qhZr7lq7o6sUpmxMl6DiycYw4NR XQ9ccy9WKs9Y9Fr07GIaNweoVMqVmafbMzubY9Oot2ybpNj2zr+HRm2kkdWJyvLhvoMPVs5V hsqC9/wZvuJcPFA53GYXbvZex99PigZkMulOHa4ce2xmB54MYO3HBTGo1JWES4c1Cri6fNWU YSKtQWdZ0Di2j68lr/ZVb3AqJ6DKIAlkDhKIBzO4oaD7if6Swd5ccuwQufvd5KY7yHU3ks2b g8UWuIiC8kjVVQEAlyisouARHFhRIfLk/Q0og/l72RGTQJFUOimxgBRayJp1ZPUacv1NZOcO 8q1/Jt/7IulcyxegBbWo+BqJgK1ACOavsc9o8o3FN1XEYkE5VQ6qJn2MIrBttmkDdn6bY3Cq M+gKNcKM66uj8HnqxQbaDj7peTfJbG1ESA2abOZ4Jvt3UT9ZgzwB1dLmDi0rDR+DvRsNEaOj gpHGBBAmKzBlkWuwq1onL0y1dtPW3ZXDJerdWx7eUFyLxoq2qLMdK514amL7Puf0pZkB9JEv OEdGKXZbJL1449+/0IwWwx2cuMwkXGFlIVVSFlmV3IDrBlFxEKPpJ184imjBIxiAbSJkAKtA g0eWzWWBaazqDDl3mPzIT5MP/TTvhbW28FbFb7Ki+Mpz6XLHRvmDyIlxgmf8mO3C08kKJvUd UhUjIAxC4YPyWYKHYW3tvFvX3k76+klPb9h908VKP4hMBwbIrbeRzVv484QvfZrYraRzGXGa 2DRGVhi2MOqx2EYxgdhIzeklayS+euUstu5phDKRxnOPM77EqW5TYTPjn22x/lxM7Uck5awH Zmc/M+3+TitmFecaKpUJZ+avW+zvz1WAz7dmw3RTjiwhO9gSX1pebjH0QeBS5h0gAn7AYd4Z Z+zxiefgyHQvhnjFq+yvHHmutHON1Ym6WIAs562zIQDLdq3WjNVreVOif4CWvbRahq1TXlSh fmY6xCTEUpXWEbzLgJt1NxZPEZrnfkfHJkg1QZi5x/NEPC685k3kgx8ma9eGzx/hVowgOxE4 Hz5EPvsH5JXtZPgQ3ziJ98iwuEx8ACYrFHDEmjJcqhACh9VlkeVd5NIbyM/+Ilm/iU+3QYju yHhcWgd9yzxZuYp84D+R/a+QQ6+SiUnuDfkStiYCnlm0ENbHN/Ln3kLZJc06Bty4OftYRYR3 WlfOcQ8cWQaLnhBfVjDHO3oJ0WWbnfhM0fo1QaljZLxayPztdLlzhv5aS8tclk7gCWZ56q87 8p8WyxDj8puALOfWkNUnbSTjPogLEmAfGhPMKx+3v3aLt5MC7qAxijkBsBq2n7RV3epXph66 of2q9cU1eB8FksRaBqxizHZYHX1Wzz4yXKQ5yntkF1ygRYviA3Ez4jUqDLvMoCBc90jCpExN S67Esseu/1QhIQLi1BFCG4thaIkLAsdc5kswwT81y78MeuXryCAeF2Jcrg0GDQUkCj7lpZ3k 8afJkZPEy5FilrTmSFuBtGLyvsidDg5EWgsCmCMtonc2NkN+8BR54Xm+rMzwYom5oPt2xbX8 Ieaps7xzp2rJIE5J4okCDCJHO4mVlMLXEBgCh4bCqfeGeKJErfldeFYYhRkppzL160XrN6l8 idZAiiQaeNY+py9tTaJKgGG5Rml2v1X5qfbcb1O+BnG+YWj5vNw6zx42RfMtiCmS+arj8+Nu xLeDxfZW3uzT0zumvVm0bQQxTuPDzOW5/q3FTRhUgkE0+iYb2QLpmSaGP4/Aw208w4V2sM+S axf2yKSKUgHjcloorSBWDlEwMZ6Zw70MPbLpMvdHWy8jLXzlEQ+89tMDFoXt2E4OHCadbWTN KsI/Q2v0YDReKQkLZSemyCsHyAvPkRtv5mPMtCwkHF08jEYvvYw8+Qw5PU42Z/wRqya4dhSO TEwazsEitQX72IH+eTkym9xHrY8RsiIxM88948x8Mkf+THyBI5GEA8vObU7mg/nERzEpTHzd rHMgTz6VY09YdJ/oCKWQNgPu0T7iWbPppAtFfwgzQfBlmO83LpV0pkYwNrVsz31s6vmb21/X arVkqC0bK/Qcyg1c3ralY6K96rnYqg2QBc25Ee3SaaAKFMJSLuyxpy7ygFwaebG1NdeRBbnX /RWKNacdp8YNBYXFIwa51kAWsm5mPgF3HDBWjvT2k9h7fxEhshuF9V9jZ8kLz5DNq3m9V2Yb GvRhgFnMkMs3kl0v8rVjK1byXlvtfhny7u7mZAjxQW5Es0hCFh93MVgji9ct8eX3CD5IJNpZ Te6btz9F7TchvGUZCJrLL/pZ42OvtHRsTdyBh7Epyp6htM5bnJ51bb54ncwenayZ6ZFi9kHb Gi87l1ac9YR2yqeiWPGPZbH57EuF7AG7+kCG7cxQPKOcl/5GmTvEdmzCNNI+6t0Wg9BP+kQ6 EguIZIXh6oGxEyh06kbjWBeGrlaOZu4v7bxq7JF39t0zkO3luwaKfll3pvNya/Mv9r3/V858 rp/kW/hLc/7DqkYzWCQ6WXzYAdaQMyMiI9k8+bORhoOg5a0XUzkNM3FCUJs9sqb450AsFYRb wNGktkFu4MQ6/jTPwuXCEmJWC6vzDx8hDz5OtqzlazWwVKuRwHkxQZEljzxFXj1ANm3xHZni TeygwWnOYymZrD2Vw8JG5unIoEzO/j4ld+IF2bhilj3gZd5L3PvjKAXB5hkk+24sbYWfqlSm qfP5AvuO7e6j3mzOw0ZW+IBBG3XRK0W94XWwasY7RasjWbwZ3lx7VhnWirQt1Lej0EzSO/e1 NEjHQR7c01Z74B8mv7e8sPzq4pZVheXy/SQw5a08tsD+FWfyz8a/cdqdWWa1V2q+npmez2sQ k+7IhEMIW5JM1rRA3VYHAtQTvsGMASYf63PXG+ZQU7ZAypUT5RI5cpTcgOXUovsiPZdyLjKC M2bH8JjypRf5y0bImN8gGiiDr5Twg/BNB/fzpfx9ffwNASPIfAGUOR47Ss6d4yQNukshTRYf psBgpZLel0vUmy8O1YKWisChHz6MphHOJVqwv1apvo9at8RXk1GKHZjfOzPxeEv2b9JEu/T9 xZabZmdP2d6XMu6jGfogtYWtsNcjPR03LZczX5XTdMHjGXR8REjJQmINI0bE4ZkQGjHe8ufr MERTrkUdYa2bgFJ43TLH2PcmHjtZPfWj2bd1iJeWJCOWmL2h65ZxNn3/1NOvVo+ts3qq/CFm SknqZrYgBDJzXNhQBAuIZDLQyU+iPgMTyV+lcQD2VVFwmTaIa+ibPLQ0pGv8RkYaprEoHCf8 SolYVcLwKlBjTAEVfBNm5bF+Z9cO8pa3kA7sZKAFuDkccHPT0+KNopPkyCHy2PfJMr58XDys 1IhrR+GksOBg5RB5+UXySA9fuoG3ZPjb5i38hc18LnxaKuXAV+7ZRWbGyUA3f5+p2WKJ6R9M QaMxIMCvNSlAKhE5hxIYFqg09xRVE4SGwCVRctIpP04zr7PthGeO2MuH5X7D8XZk6Asarx/1 vNz42BPVytnWwm6bfIPSua9oiws/DxDYA+NKPH3HZlDoPoavwy+MLhCPkSseTb5aPlLyKhvz q1/fcQMmy6R0jD17s913tl+PfamsaetIZbjPaqnRMQQ9GAOvsjAaJkiR/gLWKIl2h1u7+NUp JUkMrJPMMQ7JONJ7ZHMUW4cNFYL37jD5jJbQdMDYrQOrxijZ/SIZHSF40xhjQDgdwOE+4E3g xc6eJaeOk+FTZN9ecuwI2fUCWd7PvVhTD6x5bwuObJAc3U8e8cipk2TDFrJikPRh2Vq7Px0G f4rHpnKqbnyMO7LSJFney/NqMmDEC4PALLJKmuQ2yeNtpYpti+YdctY/Viu3ZTI3xl8gB6S1 bWVp6n9l2DsS8sE+Re3/ks8twAPHBOHnBQRzYrEgLtq5NOL6GmN9UJZmxr3JI87Jx8af3da2 ZcD219/BJcE3YaHZ672S5bHPVY65DM/N+Nx/sLw7lA81ZWMQ7kyNIEKCBYxhHZmHLiqcO7KE NksekntkoRr+ZRG/OkKSujHJLAsIRzZK2ASWHcl0XWadAA4Lr7lgX51HHyUPf5/c82ZutZkp MjbGX+c+dEhsU7Gb7LyfHHD5fA6eVPZvnoNn8fPEo247T15+nvzgW+Q4IesJufQWMrCarNtI Nmzii/vxghR6hVho9ugj5OFH+Zu8K1c2+8gSeVUZnWTWWYZVONxUYrjCVeAJM0gCE1ojDYYK 361+biFUIWttr1Tvc92rsFFrkiwLu2CXxu4pZL5rYC1azufm9djUELjUydAGPGduStz90YJH GZ11GeZSFzogCwwY+62OGVb54syjg2d63z/wrjZhdvgJHBjaXt56Kb4U10JyfzT+T4Ok2IZ1 mdGtFuHd0JDKrILpXvERXctd1C0p0AmbccmkcGSxaRhhoagdldEkWM7PKGA0opqvTxtglUQQ LHWPDNV+kBBctPgeIPSBKkrLQL2av5jmxxL8TRvI5z9FHvwO33Jn9Cx5YgdxPdLr8U0T24bI 4BVkCItMxRBNrLupKbEeEov1u5aTDditxSFnRgnmwh76OjmN5mGRdSvJ5nX8ZYADe8jKZRyC rTiaCbL4GGufY/QlQm4Q9aGqpxlJtWhLpeSWVYsnCZe376uU32hZt8ZnykCOObsS/ZLl3puz n07ivlBgU5PzbvMw51kMKj2KS5dfgQteY/yiwFvi2HBqs937R+e+3mK13th+5abievStkJnw FvjgSeuPDb6zI9P+J+P/vN8ZXUe78Ekj7uh474yNetNl6q7LDJZY5awziTXf3XY71i1LV7jg lQGn6U053jA2BRGLiRp7rraAapg9sgWsk0RRaAOwZYlPk801oOng0TNuS/tfFW6QkY2ruSws 00cXm28TxptB0LwStWg8a7DjwO1GNB6s40eXsNBKuoX7xcYbJ0/4zZhvip0wNdBITo6YNMS2 TnCWQq7PpOJ+GVQ6KtTH+j/hnUEBzo3P+9IVOWIKzHX/ulrdYtuDURV4CqsEurq6x0a/TOm7 0H2LE1wgkKkJf59cZU5pKJWsr6eNJuhSzNjOznnysX4m0AoH3nBfTTu+MPHdo87Im6szV3dc Bj2lwmiR2Ob/9s4bPcvaXXr1oamnq14VX52Y5Vsbk+vym27quGZdfnXZKw9XTj468ezT1X14 Nb3I55ht9M7qa9AUBYaWZZfgE63or0edu9Q2FCbSytoBNvhtrmPDuSAK/r3BJq7yVfqojBWk oYgQRNEHaa7rYsqGw7L4K5PoBGGNJYaQCHwWTNxvMEsl7ksm09zSXKqQzM0lv2CC3RlFOfCA soJPATikpdDcHFxUE8wtYIIMQcxlRHE81aip0+jOjS/Y8Cdv/SOzbva8D1kpQ6runnXj5/66 lX0gQ3fFS3IhQCbOhdaAxcyWnWZERRkQYNtWUlpod5BgIKxMyR92R/eWDw1kuta2rOrKRDaG 7Ml2XVncVLSyRyonT1RPZuBJLDtvt1zZcsk1xW1Duf4qqw7a3RPO1PHZCdeZxWIOlzlYeSvu zAn5zREEcXDreJgLg5o2bVqkEhAYu76EBh1ZfUENUqDmoeUIs0b4Vxewc/5cA5wLFvdLF4N9 DRfQc6VqhLrCA6UAjdsOtMd28tiFGZN3cwqy+JhYOOXxdbS4keK84OHEySY2e6iXe8kr/02p dGmxLeFbJJK3s+uqyfE/L7IPZ6zddb2wh/1x0SQwKiUT9bJeGPyp4dAac2x+qCcELDUYwad1 VYNYGPUMKcgKD7NW0579lcN7nCP9dtcbu1+Pr/ai8YmbNp/731hctyq/fHNuzX1jD427U2vy K7YUN1zVfpn80C8E9md7N7Ss23Ju3dcnHjhYPXHWnewj2IeWy4b2C1OAiuedEZchNFoYiYYl 6iTtVctW6ySoWnHwMY52IGoEDakT+lQcCxPLw+CE6B6CXdzZNfgcnIFrKon5L1TEUriwFLV4 K4ACsl2n0NQEw0xg3unZT7r2GUIjt9pYC+NVogXRWtCao9AkrvY25633ntZY5xXle9m6p0vV O/IFQ99QbL6wanL2Wps8aVO4p7T5krzjbZx0/n7WeZ+d2Wix58RGsqGQRYo9/K/9r77cLq2m 206aEhB5xHMPiRErUwZn0ml513fwm0+Ii/MtDASr9QrM/sr0Y4OkdXluoMUu4uKCaJzRBLGt YW+254aOazDSvLJt64r8MkD4i5ncq/CZMUyfrS2uuq71imuLW6nrPFDZ2cJyoMHeobiK5qW+ KD6bdCv3j7FzFXwhjeul+TKkhPzQGyRkF4CEx6hrMU06FsMwdC+p6chSZAT5pKBj4Fr0YuaZ oh5usF2UGkrVoo6Jfs0AZMFnGH3GzTzhZrAgNhzzJBYywUwJIJOVYvN7+wM/etyEzyOdtfYR doZm34qPHKWJKRRXjk+/BW+JU7YbKphktN3L/NR45W+7e7cUW1dn8jePTr69YH91CVaZff2L K08Py6mBSMODKaU102wagWNvQ+yoh17N69v5tv0Ii9+OMTXXSfL3lV7w3HKH1YIFZRghynX/ 0p0JF8I9l7Q2ds4QfsF/yQn33IKd7811X9G6ZbO98rgzPOXNlli5QDG77LOY1VQ3DT4Lm3EQ d7Rcue8sK2NkIbWIc0bsZ6JDZBgzaVLSviNbvWw1WOtx18ObeaTSA4FqR+8D5b3dcvF1S7Cm UptiX2tpFHyUWQ951sOe3SHmSGUJk5tVgpkSQKaNhCN719tPtRTnOP41BYp0xjpJaB/NXJOI lcBiS5eVvaPqbiTe0xYVS/llVdNOh/7MRPljPT3hO0/FYs+56ffkrS9R/u3mRQx/9Zn1lTJa Hw/qrCIqY82yiPJDXKB+nK+JxbzIGPHe0ME6xIbXqDONR8lZ2Ag8F1ZmwAHhmSaWbvVmuzLY EiYI0oX4ziuqDUfBofGrzypahVa7WLCw06w9483OeOUMnzKbY8A3UfhqkaPlylfP8S1ckEwO afAoNdexRkhQE46M+zLuixOwEKcf6HxGjvSsJJfCm9KRxooXbHB1gNGT/CXZ8zs4VHqehwi/ DVJylpBDzDqIj5wKFRKqgt/4+RGtAW7ngFivKRVXJeKQXS8v+Ar0M7T6qcrsd1Q2KRE7W3zH lHufw+5U5XPZtmnnF7u6Qi8GFHYW7O5Ze676sMeWCcpFGbBhS0U8tUxUFWZKDHGD8usFnWes NznqWacrvBrqXH6JgpsGiupmeMXycHUYzyi/Nf7Aztm92AI7vhQ2UbQqIK46zKnd23H77W3X rcoOnWEz3Mkl8jQCRI8Mq3JPldlBLEaBKRL9SR1Bkm8OOnAW2EXsLlgnj4VFi8rga/WwBvgg /xgdLDgPIy6scksrDQVHhsNeZpzhbcg5VGIT6j5T8wvbTQgKSfFW3csZ52PV2W+FsKQYNqlq 77zEy/991f4T4D16wwz72/b2ftE/iDDwBRzdm89Vv+OylWLyUDaWCM08E7tfjLzWNo8MUF/Y lcKlR0r8pct5CGqqRJhRrTJnpdU57U7fP/P8Z05+4dnJXRMOvlLOOwV8UqxmENcab2nYx7Ez 27Euv3J5fuVL3jn+hoxojTW5U5CYY5v1nBMV/uD+/F3K9hoxtISOvGb0Q15nvvIRDKhkOqVk PtioXJVEBKvX8HoR5iDvylTF/RHy/s0FdLEwL/Yv1cxej+/2j46q2QxTrKIsqZuMAzV63oOT hwCWSta733FSp1+IOLzvacpe8FivlbmshkB4KDvTTu1tNPd+mvuP2dzq+HtOkh2UuXzfxMwN OXq/xR8ULHD4xj+uOLTP38lOGiiegbSiPAPrR6J3Gs4Li2f5/JB7dRtfjpM6pIrnMF8INvzJ W9l2WjjnTn975inPKVXd0mCuPyfWxEi3Grl8Yxli+gxCXprZ9+zkDtebbOHTs4nNKsZpAOAA K8w7Ua7cP8K3rcWcd2pIRnFL6ixNukLwyqGljTkyXU4Yj4gPwfOPwWBoSlg59TSxfthinaI3 AuCiZTh/lRdYAgrLD0oPuZk/cLJHmNUf92LIs1mLJNILIJaS/cjbTxaLpqucf8EoGaHe3qq7 wc5urC0NXTN8VBtbj8X7YjojfFw2t3xy9vos/YFFMfJesIBZjD/7gw2lWf8BhbSWspkRMZJG ZXAsrmHM9z/jsFtbWJeN/fv5lhiKbcG0ThYEb4UmlKN2C8s+Vdn35OzuU7PH++yermwHnkVK L8Y/Yy70MZwaum/YjfbgzJHvTD/+4OyzfCkGn+FpPkB81nJPlZyXZypfG8eXR3h2qYIaM81c HRlqgwdkoh8cxC817eAgMygWExFyxjACIMqEFwzpqx4mLwGK3u+SmV5TUHTHcAM76NFR7H0i HoDEG4Ayf52SR6tBchksaKdPPoOPJSxKoGwXxphO6esVfNJlIQJ2LmvvvGmy+vsu2bYQ8nwZ +/e2jZ3lu55FQqNWjjDxBMyO54h41e5YmY6JDfJiJIsM4E0GKuQYddzyzvL+fxj/9qPjT++b OXCuOg5PJ66yUAU1AIa/wbd+X5h56Xh5mL+Q2aTvCCUihgX9pyvokRFkiBsE12jpgl5A35HQ f6mYAABAAElEQVSlZR69RtKomoZDLDLGw57dzMIq/6W7kTWt6eIxUGydgEGlQ/DYya8R85pS aSMSVUoio7AwBRcmj2/9K7p9ixUsssOu/rJV+c/j2PJoIQJ8WWvHvSTzY4S2L4Q8LuORB9Af NLpWDchOtK8CZhnFV9xGqnymbMkDpqcwQsROPp1W7qQz8vXJh787/uiTU9tfKR0edyfKDN9A 9/vgvBUgyLZAvdPVs8/M7DhVOY0PWXNvNGfNHeYeL+EQiwX9ZjxnYXUZ47WnIOlDS0PqgiqJ hQDwYv2U7GT0Nttto3yGCNZc0EyMAlwoSVlMtK8jnvWHlTzW8KD4zQ35DDMZyZSCDp8svOOH TrW2LuQiDD0rfAPcItuZu69cvTSbG5jXfV7IxavpFnbQdh7EXhN6RnOLYx78s5/YNDMdvlws zaaMZ0SMpNE2ORYViaPHsg45rCNLVuf5h8dhXcU5N0Wb5xLrwkkLzfXRtp3Owcdndz44/dTZ 2TOz2GIGGkJNyjfMQAReb9YrHS4f+8tT//hkeTf6Za20AGDTeQqxeGHPPVOtfO2s90qJ9GGM IQySKqsxuzTZPYRQuY5MTLXH8lZ5CoU5Wj3ql7QK7rMqBl4a8e8j+E9ihwvrPtAVfZbRp91M gThbMPn4byngVdOnnexThG6i+O566uJ33SRyqGBaXtjXJwtrIcInE3gD9dvfG/jgjx3TcQse L2b+qexMeOUfL3vvnNuX35RK2Nrfcl6xiFyApsBzjDz3dPeZU7hd8sap7KQiCUIDQwe/PpfJ gm9r73as3TPeJTZbJq/mBGFLABL+yFtmdaHbheUQ35598m9nHt5o923MLl+ZGVifW9VhtZ11 RofdkcdLL552xvBJYBRpXm+PM1rdNeG+UPZOO3Rrhm8zef5Cwz2y2iqa1WtQJ6NRbjSDKUa6 iLfO8v4trPJHkWELbP4xzKzPVbBNFy3ySQrT9Rvm85PJVtRo6xGcPpN/zzuHm7znafIbi2as A9T7gVM9UXV7CB1M3POnEUml0ojlfMoiLzVCXJfmLz+77vgRfyc1aSdlrdrJQLJvNsXlw1Gj mHbD52kniHtNC1/lLy9nky4QsxS//JaXJ/gUJn/n4Jw3ecgZ/kFlzzdnX9hd2X+4egIPWrGL C9YES02b1ghsfEExZaOV8ldPs4kqgV3R060jrjGLNNk6IVT2yOrMkTVcSBRCHhEOXKRJ3TFO iX/0aDsJ28+sQ8QawwXOSwrwaz1Q/iHek561l1mY/sETpiUoM7c4IQePFJ94erGm/PVqo+RU S+azGeejrPyZSulZfNgN30bSCerGmXc04/2xRZ6rS9kIwYljhad+IHY8j1FLy8hzDNkAAMVq wcsIHj1UsUb4ijJzjr0BGQtIImbBuDx8jamd5rG9osOq0+4MvmF+0jl71h2f8rD8FZ/s8vcy mnvW+OL5mQrbX2F4XtCyJI24pq726qHVEYLG/GaEBYkoF1IBIPjVGNBoVCgS8jLjs92DFt1s 4ZPfsneSwKVYLuYIik49yl5yMw9UMl/3bKz7hKV0g8jSGRAj6VsgZiSfLAbXLXbqTP5tb16w F8h1yfG4bR21yb8yd1epNEtp1WOdeHk5bQWZzs68Y6z02xnvU8Ln65g5xv/2z9fuexlTkX6Q ESMZIM1fcYMFrXJQnE/xcuqcRcaYddr1ltvskhb0VmIUpswlSMvnAFA+SzIttDBgta61Onus FkyloZ2ohwBz04RPgGKy7Tuj7n3T/KPr+OJ6/ftUxGap+dbukckmHkoCtXg/CXs5L4Yj07QM 89SAYRQTY5jyP03oUUZupZ7c6xntpA5bKOBiiqEWYPdhz/5nJ/NlJ7tOzPGr66PpkqTZKA0u Mhg+lb/myonly+a3HVwzulr0WN7+rs2+Wy6XPbeUzUw5btZx+eQsrgd+SWihWi1b5HlS/l3L /WsNPK8o9u351O9u8rD0PXBAMkuVsRGJYX18QMZ/g7hQDNcwFsS2UOvZMrulhXVmsFCWX9gR onkVYT7M6KPBbWEGTXyvEB1j6QzmKhIjrCz1Jh3nQKny5yfJMnyQtcFxVGPmiLaHZC1DSZya Dy3hyNYMNfLSuF8rhg20JASGhxhOyqSmidn1wCI8PvCEHbDz9QjD3CO52naRFPdAjfG1EoVF UN4vVbLfd7L7mIWZYX4bAzQImj05yEgGVP5viNUkhDShtXlFwKTyAMGhI8V3vOVUIw0mlDbv GCVTOeuRLP0icf6xXC5NT510qmdz2QlKz+JblphuIeyo5w5Pj3+7wN6DtwXmnWEo4POfWffq Hv6qqbQTN0eAVBAB4CaStuLnwGYGseRWQF8SX0JFrWMu9r/2VmO/dfEaeZDLa+oXJccDgpem q4+MuTtLtEPMTYVtsUZZTZslk4p2KSekJAPOJmeY5tR8Zb+3yHv2yxxrFxPLqfA9Zezz8nkn e6XlXWc7bWKd8ULN3iXba2mhst8NL7bdyf6lk51mdDV/01a4KsM6YSUlqGjQJlA0ANr1cvs3 7huEL2uAdhFI2HjR/n35UXZ/dx/rbrxySrzdqPFO/lyx8QBj1THJvj1t939nEEQ17dp4jimU vP/F2CrL/voUW1Fwb7O85XlS4duBvaYCWnDOqu6crH5v0vneFB0Q3zCrUwNLYQCokOwugJDH PLVIEYLqDWsYbQCPfXCgX/aMZ4/g46f1Wuc8tTov7Cgm5vifd+3TDB1h/pwH5/MRuPE/87k1 4ymbQGgqoW0kNw+NZs5R3HTRjeGBeg/Ai8l4M2dMMtdRD2OqP/3UBpwXJKQ0ZiEbOIQipZOe tadEj1V8LybhAnlxn2Th0c3H9MDeWe9YiU27/M3KC6aAsTmyNHuHnieNotFCGWWHYEAwZYJd Ox/zrK0WW84nHPhjzQbyTFXmwkHgOkJB0OV8xbV/q5LH9gsYRANo2MFXOLnMgCYjwmIGeCXW 5wngISWUKVuTk9nbbh7VgbE4JClhMeS8AfO+CDC7WEe9b35t2be/MaQMICNGUpRDDip9EysC oBAPkjIqRj5ABDkH6cAceJF0b4VP/6/Ist6cvxF2ICIgujh/MfC2qHt4tvwXp72xKu0T3bEm ilLbCr55G5IXSvKHluga1LmnNSR33kS4qnHIScO/rObuczJ4DROaAXixBxQBBcFYcrdrf2K2 MMW/X8Ih571o/3Lf4LMvRPa0udhNbeiPJRd/8+drdWDgfHSYH09DpcETRACESuXLqZj1+IT9 F6foaJUncdU1JyVZ9vmEQn+b9yy8U6XZvxjG8jFepKVZN9RwsZMn+1PdY+gLG86hXj3KWsYZ zaCLr8ageJaNDztcZbt8ClXkM6dsm9BwkUihvPRZ36jmv+lk/4ll1vJiqqnMeLHEjLzfD9Cx Mo4zP6RNgu4C5c89JT6wlQT4ZAIVsIQFRbt8+vmut917Op8/70411GqhYq5Lf+2Xt506wXer VLaREWUKH85Nzt0NkopS55IqKZSKmKpKBB7Dt1lk1LNedUjOYVvxCV3qN4JUTlPShZWGvXAd 4qnnyXLpmyPsu1Osx+YOmu+t0VRIKz/gaagU+SG53yPDZD93ZCnkSeBQRBI2gDVZwoBNFAi8 +BY9HmJuoGzI8uAIkCeAjeUcijq/MWkBqfOLbvYfqpkd2DpFvAAt3UZKcWJgHxCD8+IFwOA3 ucjp2OkZ+9WDrffefcYcHyULupign/+TdY9+39+BVtWFsoSMaEkejQH98qbBTXMocXIbbbiv EZesy3tYjYGRJsJF14hDnal7cNbdOV39/8ep57H83IqjDGRYLg1ukGnJkCMcWiY7Mln3GmsQ DUUEkOhvKmOUTE/pLLif4cs844Qe4V8mpZdmPEyWyTnhejnrIi+UOHwWpvb/oZL7jps5y6x1 lOERLQqSXpYEjLBPAA9+RQmDRPCbXOxkLKD8OHoML4nRa69amC0rkhVYcuhD3+uHI0O2quh+ aQNNJFzD8mgM6FMb8EBGKNykQ61jFjxP6X7sbOKxQXww0CJFsae8ylJJufAjWBI36lTvH3Oe mva2l8hK8Q4WGmWsLPqFnFSsGEPEcEkcabBQkubIzAWxKcyGlkYyUSWDxkiCxYcohOje41LH izs4vs7sAY+usbxW4cvQPEL9U5S8QMAokFR1jNGvlPN/6OSwgQ5WDmK+P1YEABJGmoFJODbC 5PNHgZLGRwVWjdsiIDAwz+/oXLWitGnDjAG/SJN7drf/5v+41MFLIprh9KIjridFMX2AjlI0 KiINopIq4htKpRGRve4hy/r+LM3gVQ6XrcF+OWLdoCLz2S7UH9kE0feqsvL3zlb/Zsx7pUIu yxB8uxIqa6UI2mrdgigeRFQc0sJ4XRE+QcjRvCOrm4dRvLr0CQSBfuiXYfy9jpCveraF+TLP 2iDmy2TzCKgSBFwIICiJ2kcRhj3r78uFj7u5bYRhcUnaxx2b07lG4WugZB7pBI892XP51smV y+FpL+5w6GDLr3z0spmpcE8XWejEs7KHuIHy60kehrUUWW145HqUPGgE+Lzks2W6u8zaCdvY wqeWEHCpGEKl6AvnDA35LrMUX6ss3zfifHIEX6KluBWjlzH3kFbmNHh6TiFHuiMz/GvtpMrK mG/24QGz8RaOBPOzjEEtcUQmDynBPRVPzh/zMk8x7s42Wa78GKFiUrlfCBFoJQ/MkIwzitn9 r1Rzn3OzlwWvx0u1a6tam4Zjwyr0jRcKDFGBQUOciAkChQsiaAqY96APPtJ3zZXjQ4NL9+qS od38k8ePFX75Fy4fG8Xsuh9kRJYUIJUM8PxXAPn1ILEBRCdRZCHQZ5BsOnNIImK4rXVaWBhp P4gOb5Usy7KCzXfIwGJolZ/Bct6TYtUrmXbco7Olr55x/s8YWUPFDh9xzRJKHmvD/oAjBlfS EgyRTiy4Qo50R6bENx5BroarMnnDjE0MT6djMTsGd4Yb2xm+GoMOUg/dc6zSqMkk0OfjhBsY tuGf8Oi3q7l/cexdnoXm2iH0n7M6Zo2m20ozYwqRAKfgCMZiD3y/77KtUyuWXZT9sqOHix/9 r1eMjqDvG1pCFlYVOT0ZcWSqsnR6JURijaRiSYjIKV6HUMz9Y6IMnO3wZWK+PIH6vIKgGw58 UAWvUj476T4/5TwxwyoexQpPwNEWcW461OWpSxDLMuRYUEfG8wlFx3KdBxYuDJ+txV1tF7Hw zbQ1FkOnDFNmGd7NQRnmaNokFecD85XBV/2mGdnjZL5QzT/q2Wf5pomJ82J18kpwXjCvPGqw hlUQxiLkApyC44RVx7r/+33r186sXYMvw1xMYc/L7R/7fy9TfTFVRhlRSRQJcZXUsDxqwGX5 AdTIQpso4hCUFkPzhS9rp3Rnlcyib0Zpd5Z1ie3NZU03ISstj4WAQxl54LPh+2ad751znp9h Byt0nc2n/OauaqR4UkxU3QhBFJWSCjkacGRJWZpyJU2c0ocgP3kEfHLwqNFztJbkdFqSYzEq RzPAZPkeQv/OzZzx7BWMrrBddNAEJWjCJhjks0S/SlU+OiNkv5t5qJr/SDl/GhoSMiS+FMX1 04OZ1nEp8boL2H0+bi5+JGUR4LQsksiw/OqBh/taW7zLt01qpBd09LFHen/tVy+d0ubFtHrh mquCygjHSnMExfJNZgID3ig8YIr8Ssk6yNdB8iKBe/JKm55wrOdLdMcMHaBsWZ73y3Aloukg xEXo4hY1LnTFnhawA75QWX1yrPyJk+xwCY8o6DIbH6D1y4JrM6qkgtfULsqTQMoJGhMVMIci UxxZc+ICsam/YX5pJLUpfCy0QjPo8ZfLWt92MxNuZpntdll8Wh1EUu3astI0mBtc5cgNSekx 1/qrcvEz1dxfOnzJK9bLo3Fidj9BpQRQPRWaZWmQPoUMw2N8b+nEcOGm68cy8959r17Z5oXH S5Rf+KvVn/7kRuyJbQhShUNEj0syCVFwXoUxMoNGI+YyaidDZXQ6NIhWCwMKOuGyf562p0qs P4d3sEmL7a+Y1ZULRSxaTDXiDD47arnD5erT49Wvjzi/d5YMQFVM4ojZfb0IerxRvery1CWI 5RRy8IrD5yT5Nj6rh9agXsTcozzH2ARAllrhjKSEx4FxiKBE7vyQuz9oMn14gPUxEAIEzmit 2IgRE09PEeu7rt0phGDJTkEsbpd5yTPoFzxIyVKsVLTE+OZiDzuZT1Ty3/UyUwxfbeQvjcLt NhuMe12EXXQYmihRSCrVjAgLE4JMUsTP+/a3PvpEz9VXTnR3zetJVZjdQsfOjuR+7X9c+p37 +M4WKogy8ZSMyLMiSMQKYn49pAUfhR/9iFKj+ozDJ46S+WqhiWDPgF1Va8csPYUtjFzSkSHF DB96QBGoi6OGQobMOSSlfPgv7AGJbdrOVasvTFS+MOL+YMo9UOZdhpxvEGk63jjlUTMvSaxI pEtRSSMSYCFX8jVUYMxBBzedUCE4Mtuj9qrBNTyPRscvhj6+Fia0TjpN6WQ4h4rCIoI2gM7O MKNnCO1meA5EXUqLFM+18Z0YlJFPnYEsWVAdrRpEQxU+4MV7VEeYvdO1f1DN4NHqmMfVwDbS UI9TNChMkTXI0AhZIzTIV5DVoB0dy33zvsFC3tt26ZTfrpW25zvywP39H/+VbVhsIfVXpTAi RlJqDaCEa1ge1ZKcUCUllwExsWZaMUUjaBk40FLR2TnjkUm8+IMZKY9vxIjWI7+rC1ENSovK biIl5OO7qmzGZSMVb1+p+syUt32ajDn4xjDtwWy/eNauJNbTB2VKCvXYIjyNESdRWfBiHqW3 XPl6KTDQRvjKSB48EWD9uJ5UtHGgAZFJlUFSjywQpuF0IYijGeDRFHo9rzCKLf/XWexHbOeW THUVXzqLewmTjzWFgPk6NWQnFZEGxHQ+8p3xKL7k9rSTedazn/Ss/Z51GWXYRwtDBzndgTIk GTwoWtKv6pHphTUIfVQgOo1SiQrYUwiFnEBYQBv9ldhLL5n61f/26iWbpqLI85M6frzw2U+v f/KJHtkipYaqFH4kaGEhXNggTIoKwuUqg5wjS+VNKii/Y+rwSEJHJMSRLa8jvqbM4+5s3GMb c+zeDratlfRlyfIcwRINZKAaE2Qo+WBW8QTZGkinDErKLx4I8Kg36+Krut7Rkrtr2nlymuyu skvwLFWIxpAnCDIWa1E+OqDzJ9GCpMJGFPVFRSWLFMcY5jRECQJOm6hJxqFZhzuyWzkJlxUE oUCYFGA9qccljwFJTAqgLJuPlz+qDBEuLaFFfQ0hBUB0z/EaPi6vvYyupezdtrsN+zJmnPVY cYbuJkiCcksJ8hyxblBi9StpkASZTxm091mPHvVsLHNFF+zLbmaPGEiuogyjXSy+AiOO2sJV LgmRgFMpoNNEgA33nYPS+5Jq8yX2uQKliGWRt9x76qc+dGSg/7wtNJueznz5Syu+8uUVlYq4 HIVRpIZKTxWRZZZVB6CK+HDxo4jFzIRfdxpQ2c2P4EdhjbiiUASRKouiFYpvkIwhBlYeznpk j8uWZ8jqDLm3nV3ZRlYW+Daz6KPhgGfBV+kRGu/tyzxgJyjED8yCcTnYTQz7iGE3MeeFCef+ KXbAIdMeu8SiRYvhwymB61QaSsWNhqSwKuKT8SsgDPK6joA0J6PBeVQ5AcmvYX2BEmJoIjPk jgxdjIvXkYnmzMuCuQX0hk6JEV8n9d5A2a0ZZ6PldvPXzlmR8g/NhSFupBAXaaqo2VlmnfWw GTM94lqPuNmHPIonkti+Yo34KKfkg2zfyhFuXWgD8UDDRO0iwNoOScvKqPXafLUdmZSay3nv fNvJ97/v+ODAkrozPJH8+teWffUrKyb1zSCFUaTZAuNFHA10Dv2XuFDiZD67sJQpKjC64pJG UEkV0UweKhBw60i/fSiU7OxzHt6UxZbBfL8EvAhikVvz5NoWNpAlQ3kymKWtGd6Dg8uTw0/0 gSBFCpJnpY14EMpzAhyey+HOi5Rc73TFOz7r7p5lh6rsyYqH1WFrKH/jBISiRxo+mwwEK9WN hiQzBFZFJKVfnIBtKR1ZBo7sZtEji+ikjBLTNdDYVzbCFSPWsFyiSqoCJxY1LloyyrNSTUmT dx0k/ZGdoMCtpcAYPmVyicU2UrbZ9rrwHVzKCsRrI3wxGkaCuBdiZg3Z4SkzBoz4xOQMY9OE VgidFd8QOOjahz36KiPHGCAW5mNkpxs5gF1qotSQaiv1/FLU/Ykx6AL1eCiptkMK6YKYvJqD lPFr5h+k05jg77IZdvedZ979w8Pbti76Eo0jR4rf+Jdl931rcGYGdyvf5n4RhHWkvoHWPkYp b2DT4ZxQEfvSAuv7SV92jCyAN/QrZEFwINtnQteMT/ECioYrH65kKStjogpbjFpsS9ZamyP9 WdKTIb34somNrxZRLN3AKwx8j6BAQcy1VeC2+EHwyaqSi1l870TFO1llp6vkJQcfGWft2FWX YSDDO4O4DMTFg4e/ECFVMhWTCgY5JGI1II/W7lspYhWROdfmEmK5KoZLlUqjR6Y5skBXTq4F LT8fqkP0ONBpyZiWPmGaI9NvDkoXyaPUNPICnHfSRUsYw0y8x30TBn2rbLacsQ2210lJG/GK lGE7jS6sqhXvP2JCDfKrDO+QkBmCnheZYdyR4Yxe2DHPOsnPuEci0BWUYWcO5IKAxqYUUCpx IoFt4iQYlCiDsT68kfzU5WtIF0lTQJBWTAGAU/O4QhCycd3MvfecvuvOkQV/sWl8PPvww733 f69/xw7UWxj0uKwACYnANR0NrNI9BucAJSSGDRXQyYy4TqREAcgrUUsn1il3ZJIMlNjCEPFZ xk5zx8STq22KUSfW0HbapCuH+zBtyfBdz+CJ+CMCyMfNjfE7+azLphnWgvGj5HFHNlpl/HDJ fo97gQHe9P3H/LhCVJ8COYpgqOcnA/0TsRqQR2MXe03JHNkMV6CJLjRwZFfd6gvzkZEfTUud NyEOkEGskrGy+RjdkSU6L10VyaMKooTrNIiDAAc+3w0C4Z74I07Mo4XDf7zCiSeews3lhcrw SnKu7UBYBj7SGiDc5eHzO+h/wUViNAUhEKt0kFnrST1uKJacFAxpZakPbyQ/dfkmaWAKCNKK KQBwZh5XiCAKS23cMHPNNeeuvXr8qivHW1txfcwlYObrpZfan3uua/sLnbt3t2NprpQSUSBm EYnVacCldDSw6XBOqISkccX10bkkNvkciI6p718yvH+kBe5x4JrwZBPNziUM7mwCzwQYmeRX Cb9q8ClJcTeGI2NY6wd6NHi0Y3THzhFONgVKIXOQEtwLpMvDC1K4JPCwUn0SLlBMZR7RQ13R AVkiVgPyaOxi92VrZByiJZvhCjTRhWZc0SO7STgyH6H9qJxUREP6emhKS210EsSj9SOsDaji 0iU36MiMDHhSlxJFo9Q4cMfCVAC/bwnXhurGpcYrlEe4YYBCg0FXKydmvmQSWFBKzyVz4KRa qJ2UhDpNupqCVidNKVOChCiXpl1SVNRGWCVRXj2lx+MFAcQgkEmcbZtt2ji9adPUunUzK5aX li0r9fVV2tthbDNMT9tnz+ZOncoPDxcO7G99dX/r3j1t/iy+oDWykPyh8oE8g8zXJGYpHy4l B1gNyKNKuAbnDDIpWEUyYJcQA6vI/EgUHWX1RQugOAWTBpLMH0ZBAtJ4KQ+LIkQjhhvicxw4 i4MhyGsA02dwVbKhgxgNmlPizPGQIcVCMR6pqZiilGRhUpRKJVVEFtZXQyZ4LpE8FLGKBFwB g/araFTEJ46I9ItkC0cmh0qajAsyapSnQR0lFy4j1KayAICI68VWKFDKa05BGszo38mkBdCN 2rO3DYduEIyN0E3DSwLFolsuW/BWs7M23lG/WIwsG4xeooWK661aj8flY80s90eydUqFYD7x Crrwd4Et8QvnhQBPJ4lxsQvRvluMi36tQOIvoQRGiZYwxdA+OIaNCNGwHK4lo3mIVG1syNAY naRStOh5qXhExWjWkkYSKLIajOBWWKmh4goVrh0T/Ivb2nzpgabiN9QzjHFFVffE19rAqrIE wiQgSuUTYW5mcpLfOMbG5Ao/xRyJJPJGKJISMn+DVykVwP1f1WWQC8e0JBetjC/LroSobKWU NLgiqxFRWRg0kBkRK3LyIfJHUgTl8amRVBApMSLFyCQhmUaeBq+XidQm4PbtaKiYoAYHBVR1 R2acOMiBx0UAQO+aBOAEyhClOE2Qlo5lxHGJQMlUQ/t0rqDoWr5pUUUqpakWbNDL9i2AidlG xCgKBTWkIalo4qimIKlygKiRfTSPBgkTyRKBSvx8sErIgkSkoWrro4wpyVQSCugQXYg0sy9c R8yvilXWhoNTcG4TMY8fr+XwkhH6RFiEKeMQAU4+NUKcRpMGVznVJVCU84kkO7L5SGyQN6yJ BhkWmky3b7RxLnROry15S2orvZKWyozIE2WUOccLK7G6LnGIjk2LS/lp2Nrw2rxxLCBxYO0s LjqsfOaRoLZRciMpGWLAyIhEYeMRsOtzJNKpKbJk4cZtK0Hl+iCZhfZKig8wspZLveWzJKBk aw6mYtEoBCAoayAzkrspMH5L9cl9wuhPkGVE5BwT2qXIM9GSvkAfIjRQWBWRREFZE9h1mQaX z+vnM6cfQ6JvJl2UpDAQPpvseiMRoDkcDc/vkkdbVEgma1pMVoPRl6XlGUjjIInVIRqhFo1K MeiDeXEfrLAyopJSHLTWIYrXBwYZaTQcpDMBpWE1JRVcCInTGBAjqdQLJAaqiHQicUCZqo8i qBGBZBjh33tk3EQRk9ew2b+jltgCtZv/giqDrGo0g7pYqUsNCYnKxssXh+iMwNYmkMQGjZHU Bb5m4qmOrMHC1yZLw6bAeTOITWA12zYSqkZlZ8qK3pNVQ5b0sl+m5r19IMRLKYpXdFdSs/DV qYdP0DoE+RmGAC2mBAMm6MwyarR1o2m8aXApMAGrayWIEmjqajNXApV5YqZxrIIYxQFcl2CQ xYkB0elrqO+LilIDmJhFg8BEMugQLFJTmXHCZGJFUkP1NN4YS3IWAVltbEDVxG/8qWUtZi17 GY0UXcNGhKTBJVFtrGFy5T04bx1OThLRjwN4UHwGVsINoKJX8DQyITv5pHJMRi8JNHiUEeqi SoT89bhSxwAaSUVmRBokM7gaTiaID4ZXKEVYOiGQEyuQxpkMV5TgklMfgODQqTUhPAefJYCa M78BnJPGgp4dj0eJdSyQRlIJS4MrAhlpkMzgaoo3yCJajESJOlCQq7mLQIhOocVT0ACn9sg0 7gsoiqtRTa5xp4b+m9l25qgt5AadwSCLBZI8R4UuEjaj2RrJi6IQuAwaV9sgNq4sI6mLVYxR Gt7YOCTa2BSNilwUljyPStbpkaXZUd4D07G8RGlYVVqDIDmp2oLIErWOA59thxfLWFYmY9vU qlQdxwVICDCkqMxERCIjrhCN2IfyCJeBhiUzFXB/gIniCDqBF7JCxXiMu0EtCxnncBVLjmg5 aQS8eAiBTA0z/6hfeqPzYuipkjKikjJ7lVSRZtSaE1OjGQjhQQ7KOUiAX0NBpfi1DMniDhYw JeTEK11DSzkaQGOJQlWOkiLMUaYhFPQ48wxCVyZvqAYvJ9DyQVQmA2DYTqNUKsUJDQUCXq6F ZcMV4BoKriPBpwiUlGYj85dQN0dkgWPpemSRIkUSdVUVBNh8wmXlUrVS9XLwYZZ19NRpz5uk pOx5y9ZvwAa9ePV2DnJ5S4JnrExXsjk7k7WrZadcdm3s2dmW9/eBakzB80+F0qNJynNT2uhm i16KXIyOTRcb50unvaAxyorQUhVK2kAlF6YAzKtOVpxp7FpA8v1t+OKhGWR+sVzrVkhdAiMj j3lTY+fsbCabz1kZvDFg4C+CZEOObD7lAi8qgkuYsxTwe3S6VBno6x4otuYLxVwW75LRnu4R pzruODOjo4XZWSeXsy2AhS9Df92/hYq7jF4PEoWzpMQZL6/lc4WVy5bPlKZPnz7R2to5ONjt Mvfk8KlCgbtMqTmXyPtsvCDixKVCNex8DrjAqZdx9QyXNi6NjLPe+iUwTRGdEjSC2IAlsvKy JyIuTqBhpLpFM+ibLjQGFlWvs6urfagde/gMj2I/PfSLzGxlO5ZtNcxCUPkoQAXa1wdQgQCJ 5BKtFUQcKmmwVT9vw+JK4VhssZHJtHa08T38LYqWH1TsHIs4R7aweHpMGaSOVNOR1SEPsjDI aicDJv83RhzRVcMKOB9RUvR3Dx4eufv2G+6689arr758dnamWpW7KLGZ2dnHHnviT/7ka+1t LJ/HQJO3BQw0LezjzV9Q43UjXkDjgkUV4xc7ziGOCL4ySNH/WrNm8Oc+8sEnHn/qU3/8+3ff /cZ3vONHxs+N/+rHP7l6ZU9ri8272w428/Q8F19rQGMLhgFiPAlHiAywqRn0lC4NbSRoM37T 8UseNBCVlBE5TjeAPKlGAo2NMYW9TDGJQEEkMZq9uXoRclUKJVSi9bNCIeIzR0SaMnV6xKO0 SkRIZRKEmISYSSwUwsmHi58wGQgQLUERcaiSg4hfKEFsJAMBERoF1COqJgHkDYVYLj795Nk3 vvG2u975JsB+62f/+3R5mtjMRsPlFS/9Dra0gFvBxnl8Cki4JLQtHjx8rM3DF39RRfjn7UNV FsP4wvM8/o0x3lQ5QqJ5AlHmorUybGvGNwxC03Zdt7O795prrxkbGzt6jP8Vi63SwelFQBxi 4iEE6paK09WEhEJqktVAxruzNYjPEwp3CuwGVz7R3981MNAHJR555Invfu+BZ595/vjxEy3F 4s/8zE/+z//xE3ip9tDhk7lcBsPDfa+M7Nzx3Is7ntm9+zBm1CxsDCCCbdsjI5Mvv7x9x47H du16enKyBL/nOPh0QWbNmtW9vT22bU1PTZ0+efLMmdO9bW2z06XpydnSdOXQy2ee3/H4Czv3 7jtwUtWXjdtXyT208+RzOx5//sW9J0+Nilsa8IrkPFmsXrbvff+PPL79kZ/4mR83CC/Ztvmx 7Y98/Ld+xYDryf/ysY98f/ujOmQ+8bvf9sYHdzyCY9O2zXE5v/HJ335o+yN/+sXPxVEGBGQ/ +7GPAAiBiONsENRI1r6KJBZnFYEomZQQlUzMQjFqWO7JRveMXHPn9Zf/3/auBD6q6twnmX3L OkmQkIUkkBBCAiQkLLKrUDYRxFZcChZUQKxdtO0DtS3U1l/7rK0+bauvogi0hqAC4oKioBCS gCyRLUCAxJB9n5nMnve/98w9c+fMwoQExVdu8ps559vPd8499zvfOTMzLjc5JTkxOXHC7VNC DI6Oiy3c75IgMpNLzMbu+vr6/UcOfHHkQFtrq8Nmk8jCMAFJpNwk+HXtpfIjJXsPH2i4WOd0 2AGETbhPMAG21DWcOoIRWdpQXe+wOUPD8AsAIaYuo6Gzy9BpaKhvOFBeUnKopMtghCKsJTrb OqVS6YyZM0aNHqVWq08cP4EHNGfid+pik/20b5hW+IQzQKbKSECVIfBT9fYg9xjhuDGbWSxn z1f/Y8O2uuqj3PeaSCR6feyvf/O7qdMmHzl2quKrU00NrV/XdC1YODE7e0mYRFJTXb/17b0R WolKKYOUysq6adPyRo68IzxcazZbSkqO7N9fGR6ulMgkVovVbreBpu5y45HDFWarVamVZGZl YAlqNHWPvTkve8TDzc3ttTX1JfsPa3RYc4Y2NHaGhEnv+tHs9GHJTfUtJ45VVp6qUmplcjl0 uVpBn5PEG0yTWRd5N52l6EXdpzAA8V+0qfihVctHjs6lNKQwY84MKNjz0R4B7nonrSAV3Ayn T54W28HEiwIvSERFMYOv8q1zZpw7Ucl3Mo8ODYmJ1+cV5vui9QGDSbhRfSDEo443B13AGAwu DsgYK+oqWuTIxALF+pieFqOYMkRIe9pCLo0Yk4NZ5nDpYalcOqog74Pioo62puiwgRJZaNOp hrS89JGpecuGrwT38YNfVp++1Hy2ST8ktq2xIyou6rZZs5OHDNZqtWdPnjn43sF2Y0d0eqzV bLEYLCNGj75ryT26mIjzp84d3l9u7DJqonUZOVlSidRmt+l0upXZq0wm08HPS5oam61W6+Ah qVOmTYkbEIcbzGK3dpvNDXVNCB3gENwOuGjzSTuYqr9OJryEhb66eQVvuyGUiNMooN1AAvFJ zlnILi3djP1RImp9K++1fNKSUJlUGhOp6TYkqpUybFbihzG2vbMrNyd7RHZGt6njUtWJNWt/ MmH8KG5khoZOnqjIzh7xj1c21l1uwSJz2bIFc+fNQC4NgZhUGjZp0qTNm9/ZteuLpqZObk2K B1pISFr64NtmTmvv6Phs74f5+bcPH57Nbej0OCIjwiMiIrq6DAMHJbz0whZlqCRv3IhbZ08c k59r7jarx2luntByrrLq1VfedMphFDeu2dRGr5vcBwZPp9NxQQvlpYcmT50UG69vauC/AZdX NXZ8YXNzc+nnZZTM24I3Xn7t9ZdfC0DgzXJFSM2l6qm3TX352RfElLMWzEGAAJQY6K+8YvGD /lDecPjmivYHQwPJhMzT2ZxCIp/CqTqMSSznLEbbiMJxKalpjY2NlSfPyBWy22bNzM4rkKsi zEazobpj4vypt9x+mz5e73A6scQoLCisOHK8/IuDn+/5OG/chO/dMScpJUkmV+DRO3bs2MyM YaeOntj97gcDMxPv/dH9SSnJUfooS7dl/IQJ2TnZ23fs+OrkV3f+4M7CcYVdXV1YSKqUarVG XVBQcLCk9HDZYa1WA7LoqGi5TI4xe6nqYs2FGrlKgSiB+6m64C7a0uDI+5+Kjcj6rsFf13qM nSDaTUnoICC2YRpSKRUqlVajVtmdDofdWV1TZ7fbtTpNVDTWnjFjxoxoaeluba1FLkyv12cP TxuUcFN7m8lisefn5+j1USdPnjQaujQaTUFB4fDhabt3f2GxmKCFS0yEhOh02psGDlAo5Rar MSoqHIE/IrtDZcfq6y4j9o6MCs8Ylm4wmvU3xaWlJaenD25v7bpYfS4yKiomOiYje+jAhAE1 l2tU3DaBxOdDqe8e7hcJRw59iYls7oK5/3z5NQhEw4cOH5qUnPTWliIif+E9C2+ecjO8ZDQa v/js822bigkZVm0ZWZkvCZMOqpOnTYmNjzMZjce+PLbxJU4aufInFsxZOC8uPg4S3n93154d uwUM+/7JBx8veeiBaVhmimhumXnL55/ug2QxNa9uMgFWHKv494YtzfxEvOoXq8+cPP2xiJ2O HzE7KaOxwOL1Ki5/YsVwKpkAiTqXam7z3W7u7srOG6FUKlqam0+cOiGVSWfOmZ2QlNze3lVx 9LhcIhk6alh8wk3IdZ06dRITGSadpNSUhsb6ru2GtKz0lPTBiKQunD1jNpsLx45NzUwzdHVZ jOaExEHpmUNwL5w/f95oMGYNz0pJSx2YmHDu4vnwcF1qetqF8xcwdV68eEoXrhs5auSQIem1 tbXVFy+1tbbhNIDRZESarLmpxbWuDHr4itvuy6XEH1ei8sXpBWNcy+GJXL85MqyNuH+eztsE AqdqmCqFkwIjRFSFWVyY75udhbriTYQ5docDZ8cQR9u4E2SOtjaD1eZA8jJhYMK8eYtSkpPW PvX3J5548oknfv7oo48g7TV71sS8/OEDEgYUFo4uLzvym1//5qGHHv7pT392/PjJxMQEjcYZ FmakZrgKfC9yxzFk0o6OrnVPPb969eqioq1nzpwdnJLiCHXeOm/8uEl5TnvP79c/t3btmoce Wv7erp3RURELvz/nYk01xhn3QOOahga6/xnPBF3lHMUQExALZYj8V4s2bcP6AqtLXjInbMac mSD/cOeHeF3/5/U/fvzHKFQcrcDrjx9/bN2ff0f6KWNY5qK77yLl+1csXbvuKUxVXx09jjtn 6UMPPLH+V0TgfSuXPvvinzRaDZGwZv2T961c4nYE35nU+NqaWkRek6ZPhi7SriFZQxOTk44e OgIId/G9cv+KJWvXPcnJPFbR1NC46O5F6//8DMGjjOmVlK/4SroYwYarr30WEDnx/64bgdwO xDjPV0LAKCWSCdCtBUIkoRaHpbnhYu64fLuz5+hXFUXbt20pfquzqyMzJys5c3BVfVVSXtq4 m8fX19XteHf7wytWLH9wecn+A5ieElMGm1Rh02fehrXDm5veXPLA0lWPPrL97XegJTI6CgN1 5u2zNWr1zvd2rli5Ys3aNf/8+z9xoKIgf8zNheOtSLGFScrKyjZt2rT6x6vvve/ec2fPpwwe nJMzYs++PUVbii5cvFBaWrb1reKijcVKrQprFu60Ju8Z2jSm6oK7m8dRg4f8U67ABTIkAtME g722S8tgLOg1DT+MuIcGtx+J3clQlUIllYSazGZEVEMz0mJjo1/9x+P8d2ViR8aZmppqNHZj azJjaHO32b7t7Q80mvicHD1+4/mHP/xtenqE2SJJGZwM9/NjFeZwXYHewYWAr76uvqrqwtdN RwcNzDJ0djc2NMXHDRgYGYlwLDFx4KDEhPXP/gohm9VqiYXiqOhuiAtzfYMg1hGCJF7cdfZC VpfUqJzcEdWXqitPVN4699ZJUydhcL/4B9daDwn+RYsX3TL31k9EIY9+gP779/3gy/LDjy97 jAhZ8YvVdy6+6+0t29paWoHaurnob4KEh3+5GpD3i3e21LtXslQ1CgjKQBAzQE8I7rh7AaKV t98svnU2l7Yj17yF8xCjPfWTtaT6xLpffm/uLAHZ13f0OEaW98XAmao3PSBk8HijuEHbEyrp kUdJkoZnD4+Oirx93tyc7OGgjI6N0enCW9tbQxWyEWNzZHLpwb0lp0+cHJ+dL1Uq//cPf5Mq ZHKd8rbx06Ojow+VlrVXtyQrbho6JmtX0a697++1dlukYfL0Ien6WP3yZcsXLlwok8tgByA4 F9ZlMOCxWl1T/a+3/lV1vmrKzVM+/uzjLw8fHls4dlDCoNxho9U6NaY5hVyu1WnjEmP57XJ/ jfBu1nUB4X/Jlr+DmScP2sH9UxSp+nn12RSXBAHHVAEmEAGPd/Kk84YTEpjCkSD9pFLKtRpl uFbV1d719cWvs7NSseavu9yMf6VCjocPdp8xg3BJstBQLCQPlpa3trXGxEQiqsd2AfZo5HKF UqlMSlJFRiqlEnQ5tkV96AUQknCYw9kT3VKP3QAkZ7mdI7sNJ6HlMMuBbSFOF5fIaGluqaio OFR+KDkhUS6Rk08biFrHFakWUmCwV1el8QFhZ6pUpsu5tB4S8u627agtumchnopIx2RmZZbu L0V5yrTJCNYwi1FR//PsC4BMmj6F9hHuydkL5iKH9e/Xt1CRRRu2PLP2t+3NrUhvqdTqypOn p827lfzX1V4G5HsL51Bi4guowIXXXdt2ggCMhGDMuILykjJSpq8vP//yxlfeIIwI2eIGxHMo uFK4qFcZP7NVflS7hhuxgJfAkgn9xcRuqNJ/fyzuG4feQXCZNNTUacKpi6n3zhyYkGC1W6Oi o7NH5GRn5yClFR4Rnjk0Y8H35odhnxE/S8itNnr4U5MyRYxGFa1W61QaHX4EKRSnwiVKmS42 Cue/lFqlIlyl0KnkGiUGts1mQxYMrYE2DFsyICtPVeKkK46tcWsYrF3k8oGRg5zcKQwnPhyj 0qhxlBItQo4YSxDcHPwySfCp4AS0tJcXPEv+OT6yLuFKbhhXu9qLCkeBm6b6ISLzbqE35GrN FfNxUnFABkuYytMXjcYGuNxmD0O6ZNLEsd3d5tOnjre1d4weNdxk7C4uLurq6oTPZDLJxInT u7stRiOXI1PIZUlJCeVlFzs62jQa7axZt0dF6YqKdhgMrZDtCsMQkKFX4XleoRCehfGfgsIR HzgtRCrHKQ085wyXLpk3vL4BqTXMmKmp6clJKdDV3WmXRuGUDifjW7+4fvZzIamP1P7o/FFb 3yyey88gW/hZCUvF6ovuFDuRAAjgYklanQ7VQ5+XUiCCqT3bkQgLJaj/Wv8kRZECgTNAUgUv oq3pM2/Z+NKG+fcujNHrEdkxlMfKjzzwyLLBaamYc4FCyMYQ9Kp6xc4Ru44Q0y4Vo4JXipnC YDMqNaoh2cMsVsvrG9/obG/HQxLDDXPQ4sX3qJWqzKyscyfPABYbH1tbV/vVua9w+mje7LnR MdE2h+2j3bvtDltUVHSoXNLY1dR90TKucByCu/am9g+r3sfhR7vNXnaorLSsVILIL7RnwtgJ JgOeQSakkrUR2vTUNJPBePZcpcHSFaOPwdElPH1xkiMxKQEtQsatvb2tpa0pNi4aJmHkY1z7 a90VveeP8RrB+zqR9aI9vSD12VjECpjW8XGiEMxlPT1IQ3Xr45KHZGYXFubV1TVUVp7u6Oys b2g2GEz79++/fBnJ/h7sT+fnT0BvtCKdaW8Ee1bWkOPHSqxWU2SkesaMqZiAtm7dZjDgxzBR 5LsNL+7u4yo8mHvK8QiOTKWVX65taGpqlUide/Z8AlPwMLtlunNgfAIWs4Z2iyZczrP1tc0+ HdGPwLKSsinTp0Bg7ujcw+WHm4V1HyJcRotGo8bDgAEGrt6SMykwAYPd98neiVMnpQ8fOjJ/ FI5TnMVpDM/ruX88D8Dbb7393Po/YQmMBD8WvJ4k/VljOg9DgXvACRcZI6ChBWDEZVrlOAgi NMTcY5Ur1WlD0zFhbHpjU0tTIw4+4tcILRZzXn5+bk5u+tD0T975wGK2JqYkNrU1GQ90g7dg fGF8fHxjc9NzLz5vMBq4JEZcNH7krdPUmZWdNWHihJqqmh1vbr9cdxlkp0+f3r17N+IymUyW lZmF5Bp2Qh12bLtH5ObkWMzmA6UHNJHqhEEJCM2aWpq/rv0aqwpuWCNX09Njc+Azf/xpc85u 98V4w424PkquicyflW4400UBradctOBJTmR5wPxQEhrQ44yy0m7vUSlVY8eOeP/9TThljzhZ pVIrFEpstbz08gabA8eRJf9668PRo3M2bd5cd7kefYkeV2vCX3nltTNnKmqqL3x1x9w7F84r GDMKKS0sLRMTEzdvLu7sDBkwIBKxG9eRpD/xOEOqnjuIi6Uk1rJAOW0I1fm+liskyalxm9/8 qNvUs3TZHXv2fHb+XBUO02o1GqvVduz4GyotNh5cuyi0XT7a7BWxYap2XT6pXXcDSCidQB/0 OxVMCns+3DNr7qwHVi7JG5OH3DARg/Q8JghsYtKpBKdVkXpHzgsWEkYUsFoE/fx773x341bC ePt9C1c//tgvHvl5+YHSOxcvmn/fwnc3cnuduJD8+s3zzxRvLvp0+25/1mPL8uHHVty7/H5M Z68JxhB2vGK/EjasX7uO5umwT+3CEol4Jf881J8WKhAFQkOeX2K4uEw9JhZIymIIIRNDqHwi DWPL0m29KXLAsGHDk1ISP/vos2i79qbE2LhkboF89EBpTeWF+Ji4IRlDsaJE5nHitIn5Y8fc NmOGTClLSkw6ceIEshawePeuj+feMXfVI6sWL16M4xQZmRmY9E+dPVVlurDrnV0rHl3x4IMP Ll26tLGhMS0tDbHYv98sunShBtGZVCZfsHDB9Fumt7W3RUZGxcbqjxw5Wl5yKFZ3E47gYKE5 fsK4kSNzE5OS3tvxvkqjwjcy4KksdoXPMtNknob6zCcHDxTYhHf/lMFh+hqRBaelT1Tckq8n VJ+QWF3z9bHjx3FUDydOcY4fe8Z19Y1nz176+992KrUhsXqtVqcyGNp/8rNnVq34QcbQVJVK WV/fWLxtQ/HWfRqNJDYufeXKZ9asWZKVlQEU4otXXtnw6qvv6HQyZMr27y89d+6czaapr+s4 euQYTkE7HJFnzlR1dhob65vjYwYp1NKO9ubKynOI0rFhOihZW36otKm57t775yPlj63r0tJD Bw9+ubV4T3bGQEyByKz1qdnfCDNZXSKJDm07tu0kOrHAnD1/9lO/f+r1V17HgQbMID9c/kPu ltjgToeB8p2NxfPvumPZquVdHR1YUaZnD51/1wJsPh7ex+W2cBjiR6uWd3Z0YuYC6p7lON+U dLxM2IUkmrxeP/3oU8yA3SYTUmYMsrO9A5DJ0yeTiQzhWD9m+hld4ip6Efcl7UvxPSoui1l8 ljEcbFY7PtLYI3Ee3F+699PPIgbE4GFp6sImVUhC8uATFacMpu78cWMGj0h9et1TS6qX5uTm pqSmIJjatrW45OOSivLjo7NGv/XClpb6lsLJhSmDU6Kio77Y98Xrf3m9oa5h9Ii840cq/vrn F/IK8kaOyo2IjDh95vQ7xds//3xfe1ebWqW+UHUBCX5EW7kjc82W7k2bNpftP3T2zNnkIYMu 19Xt3PFeVvaw+Lg45N0wf2HB626zz/ZcZ8DQUaMmik2iHSYGussULfShC8C/USSl94BwySXu 8gASkBjoiSY1xAHYQESmXRJilobhc0Vcbh7pAItFYrMhsY4gGjEQv6LHx8eQfHe0KBQyxE8o myw6JL1kONYlwY8q4uRZk1qtRMBlt+MHypQqdRg+bY5f47VZ2ySS+J4eC75jA0n9np4wpZI7 pWa34ziYTKfm9kgRojmdSMJ2qJR6NAN9jard2alQKNACp03eY5M7QnHgUMYvg4W28e+CwzyA /iqBYwTiQX7vw4doRhGN8gicYml19S9W37V40b5P9619zLUbCKGFEwseffxRREDEQmSjnv31 Hw7xM9TKX2JrctF0ftmYP6nggZXL6LkHzGIv/vGvZCLDniZCMIqChD/++g8EJe5hbAUglfYM 4iwuuRaCKe/vm19FsuxpwZiXtnCfT1pxN3fe9bfPr0ewRkxCGEIiRxQeuvvBvcf2FW0uevHZ F7C1+uT6J9c9uW63aIOVsPTLK3UgpKEsbguCcFTFBEQjR8ND+Q2oMFuIvcPSrlfpuQ86ChhE Pgj+bU6bwWqIVkThc5ddViM+LalSq8ClaJeGYHwrMVZliPodRodD4XCquPWgyWjSSDRyfDhA IcMEhHvA6rRYeyzcCLfZdcrw2vpanLF9/rm/4GMqTz/99JkzZ3RaHWRKcG4bAxpb7DIJ8r8W kyNEYg+VOMOcCqkMKxHI9miduKXudpES++rhA09Gz5qnA6kYIe6nAFeBZebB/I9+hl7NRMaJ 8zDVZY63Gg9IHyYyXmGoBXOI1eiwc58RgwX8diEO0SujY/D78T040sVB+SVdR1sdNhvRFbgk Mr1WI+eiOqRUQ0Na2moxSwHegw/uOnR6vRZtsdnMhq4WhRwfr1R0m6xGozk0TBoTo+3s7LBa cfRHFhOjQlQI/dzkaemMjIjnVpyY/+yW9o5GnOuBC2QStVym1WgxxBDIezSdN5g3mpYCFvo+ kbn7RzCEQCjcZ5UaRRbGYyYW4MGOUKicn8IYXhATCGafpNRkZJrJPEXJQABUYmoyJBAUkS9Y RLVxBQYoDBYPOGiwyE1OTb5UdYksezFtoYx8mVgW5RUD+7GMBhJrxS0l8r0hHFyYEdCteLKa rZY2Y2t85AB8swqH4mRhMOJR7bTYLB2mzhhNtFypaGxrACWGGWg0Dg22LBVaJaIziVRiaDGY bCZrmBWs2P5CwkwuU+B2wKxkt9kM3QbMg/i4JP7io+Prm+oNpq7//tNzw4Zl/uyxx0+cPBml jwCXGuJUKjzvuekvTNLRarA5zM4QO04E6CKwjRNgQUFa79E1fPN9t95FzVOIXvwJ4UiuyUQG hW4DabzpBvG28VZ5W+wBEcaXB1BomRvoLpEmuSjQ3/jyHpyvkcmknEE9XLSF07C4uA8qidby GC5KhQy5LZABbDPjOAbs5uQiqEL8hW9j5CWE4DwFPjGOsYDhgg1NbE2jKpVw39eIh6XN6gAx 91xyOrFpDTfg85WgBL/ZYuUcgFkyLEyOYBAZsZ4Q2AFxgVeUjNtcbfN6u04mMmIXZzPfKdR4 74K4BRQrBorLnj3swjBAYbB43C0MDZXJwCkvJejfAhpI7rg78wAABnZJREFUNPpsKQNkjEHP YgRJFBK72c7l1MnFP/cwtDAT4VyrzWwFCgOdq+K4D/egtTk5chc9N4K5USeBGdyo484buZ6c HAuw2DPnzzCCpaa2Gl99sOZXa9KGpD7/+xdqqmsSUxOQEcM6F8sTQSY++SfBohLjGztXGMWi e97beS5/M24XzxNiHi8ygvQnhMNezUQ20nNpKbaAKhT3jdgsd9ldInZ4i+GmHipQjPZkFcaI QMFi/ThYeOYJWsQWQ5QgxQX2xLp5BeEEL4K7rBHzictAu6ukxGgUmkPf3fQUJC7waL80gnDC QexkiJkqKAmEwtkqL5PBCvJdlnljKYTK50g9zRO5xiWHwRMoA3RVPfuAoaGqhJEVSL4L52Ud hZOCuEUMymf1yvRXpnD1DQ0SXIoERrbV/uCe9lGf8OvZEJx0VSgVHe2deFhzz2ZPYuIV7mPi vbm8hHgwB8YKpK75V6i6DPDHS+DUSlLF0hLfpPUdSPYLjbzxfsMD/1ke8Hc/98oLXGgWGtrR 0elow7FtZNpI2qBXMr4DxPwyTWxnvzhPLFBUDk42M+GK+LlHl0uGV/ApcAnvHmy0wmKJNBZK yV0Fgndbz9dpFp2l9qgHp0CIlzxYhaZ6I1l7PNm+9Rp1J2m822+8ZRTbBzupSBp3EGEUHlh2 ADKgGAOZKiM5gCiGMoiqSxVyW5TYXaIgvuAP7kklDCFsXWHNyX8xWSBGivNsMwUzwn1WgyQO ksynChYIa/2d7GfUMFVW0FXVr4XMqzLk22EizScDhrrCc/x8O4YxWq9DkxgLA1SpYwPQeKN6 wSXyjqgoTB9ecyLRdUX5VyTwttkNEdvhhiKdy138hwhEUHahTTX7keLB2i8VD0VU/VWI9rG0 7Iu4QBaIbb5WOgLpv4H7Tnvgmxgy4iFKnMUnrrzBHNI39Dr1MTJluL5bNvfKlV4TGdM9foYP A3ZF+AxU6G0hi0nRjA5Pg2lczSwbeKrgRHgKRM2PQj8fJROUUC5iCTXM/cR1KxJ4BFWU103i o0S5CI5UfbAydD4oiE0cgq6+iUyWlhHlwygfIJcQL16xwRTp1ugu+ZDpD0Tl+CTwifUGEog3 PHiZYkpvOd4t86aBBJ9ATjLrUEaeR1W4fcQW+Sj70+WCe4j0ZvdEC7KC4RVovWX2P8TTSsGL vJ+9JrL+135D4g0P/H/zALl7mfvqWjQymGkiGJprYdt1JfMaTmT94l86VhhpTJWS9cm5rpjL JYyq8Lkr7cYGobJXxG55Aht5d7dRgLspr3HJZQC1wNMAWqN4lzkutkDGUV6GyB/cRSZo8kkG oE+4PxXBEDO83lXBIm9MMBAPE8QrQB5BZAs0wrs7IAleg6eVVFIwAvqL5hopvdJERlt+lfqv kq2/vNYrObStveJiiEmD+yKKuiywEBFWVOSsIVUqhjHQX5XjoqsYKhFSaNkfJwPvrWKGXVz1 Jyow3BvrDYEWFzBw8wJiqVhQ0bLY/t6VBV29FeVBTyuCtN7ZwFAHIYSSUM2MjG+m2v/f2f/N 2H1Dyw0P9IMH6F3YN1nkHu4XYd/udNA3N3w73PAY/vHpQ/by6Uo2380y8XUqixVBEB5Qv7RU MlnoCSl/Sk/xwRfcvHzJnbVn15IuQvLGZM291FGpHu3yIusDIKAGqpVSiTXx3/8oBiCwohwc 3KMiAOjuBwnNGMkMC4OlMr3hnHjhYoQIYJc9gbEgJgTeZD7hDJmPKkCBzaX2BVFg5HMcVxDO oKkAWiBaCZlA7B6+HJYhvYJGSi0IIwqYV0rlkh6QmOH1V3XL9EURGOuLww2Ddfi/EZG5PXKj 9B/ngf64Rf/jnHadNRiTIP6vlCNjjKYd35cpFHohh5NAxTFq+qfaW+m9pfdpZb8IIZKJj/tP IJFEe46pMq1xq+UZXFxuqCgWEAMZKQGq1A5vGqCYzwP6JPYJhLTewr0N+HYg1O6rcygxOjgh lCqolvqj7oudQSnuBVGwExmx2V+LfCr0bmav2F0yaSAtrDF96vIL9DYCpG6guySSQM30iXUR Mis1Efu1KgZllug2DmR9kDZSlZ70FOxTBcV6Ml2h5o+LgfscBQwN1eQPTggCY6mQPhWoDk9P edbozOsH7MJTLC30oR3EMEZSn5rKMtOms4hrUw92Irs22q9jqehjdEXgnv6G++o68BZxyRUd 0xdLiVP737XBdGhf7L7B+6164P8A8/eIzNxIs/gAAAAASUVORK5CYIJQSwMECgAAAAAAAAAh AI/dQZdOjAEATowBABUAAABwcHQvbWVkaWEvaW1hZ2UxMi5wbmeJUE5HDQoaCgAAAA1JSERS AAABmAAAAooIAgAAAI+v2g8AAAABc1JHQgHZySx/AAAACXBIWXMAABcSAAAXEgFnn9JSAABA AElEQVR4Aey9CbwdRZ0vfpa73ySQXMK+JezbEBJAeZiwCYTNRxSJzyE4wsxD+AzMgDOgoH/x oajMUxiYj8iMoALPMQ5OnAERUWBIJiKEhICALJIgayAbSW7uepb/t+rX/evq6qreTp9zz01O 56TPr357/ar6d6qqq/vmzz77xJztqOZyeUkDEOMg3hiMjWLJwqGgjnjByOXi8jUqGk5bSnOi Vgb/gpWN7ZxVNG8yFFttIkarD5oWQ801DnsxVFZ3IJTZZyM+J8QSMZMZg4gB5XMJ/SWEJYQk tchQRDH57bnZRseGl6vFXLWQq7aFcentEsYLmuZ2QukI5eOPTPXXgjL+qhHTY6rn2LY5x3qs 3IADKU0n6iyJmM3tx6Eyk2vBuhGoowmD6kIsl+Ebuec6GUtqzJlQX0OVx9ytsXJAi0XD2pJ7 T8MqHtHw5BCfE7kVVRlfkNOZSORPnZgjImi1ihrLi84XBiu3Toi06qjlRpDmpJbQEZluJ1k5 WBfPbDJNLe6sIoA2URsBcLCVsrLl6HEN5ENnKhkblepcy74q18PQtqaTA5ewYmrXSiiahp3M 0Tl8aqlp9wlqtCYuollqiDA3ag06mjg4fte2q8r6q55hKX2Hcy7KDH1Jp8re17mHGBSH0Qzs VlS4HqIGPGxTpQJUqy2RGlRJO2NTUCyVbwrftiknEOiQTjRWnSai+cnjRN2ZK5lIakyaWvdQ L2flFIckK4Vx9aBC+PimligncCd5+1MME5iIW5d4fMmqp+sk53VsZJlrm1I+0kBDGWK0oDXK UrbxE0yOT2QDcFOxyLgHtDpzDTV8nHoaRKqsL46CTHlUb6QXvkSWqamWsnERAfQCtVNE+Byv 50JhCCOREhiN8CkjslzCM7idylES8rQ1SZ1T1cUYX69qRnI4Em5o8kFMuIYgVU9kWlU1e0F5 xyNNzMDXHCj2M7pizeHwGHlBcbIFKZw6Ri43oVnEyRbCMG9ZhntrGHc8Wl7qilDIho06I4SN Mo1D6omsAZY5IOFxa4AnLRMyAtQO3CyZRIW0GVrYNTOGc8yQCrre+VgMtfDRt6GCsf5K/TII BZkIGiJMagPqPjKDEmgPmlQq1gLHZwRqa1d0FENfSRyJxDqasCtSKOw1aQKX3baOcMVeB9mw VNFkbaxZdB0JU6KJEGuEoCDn2/BfUZzP0RhUQcUCWYfRkUy6veOH2UAsJ1UmUsNuq6TtB0YQ QiPAsTZyhVMjoyjFPcW2XWZshRRqRU8+0t6YMWguq37U031/fEOcgEO+HMAOChnHw3BxllAB EkktqKoiGKpC4hWcWoI5hfWgXcaEWGee+ABpy9bD+Na3AU5bf0jc7jHa1WbLGEafA24Dh/yu iquP2GJ4YrQYC0k3AVx/YonEZkoUn9has2GsKaj1CZdobtUttRhIZOSCyu52F8QnpFtlE71t WAuFtE4tvA3FzY2Q09eoiDPiR7DbN93vwO8uE8ZrVNwQ+K7amJVh2Zj8pmBVkyqJaauebIFE JoyZKlcHJ/z9MpGBpB6Ow5ZJFI9kzLbAI6rmQDHWGHemkhd+HhD9CIurUon6Q4mrKY//rLyi CEIj3SyQqnESXFgWkSzeZUhlRS41GLcWyQ1w/YKi2bkf1C0xdttpTNu1WcynQmtWUCSMMZG5 xDTVSeBdndWrnsCUFgFJBa6BTqgONQtMUfGCQJApVnaPWdoiptuwaxIU4uYsxkVVChaR8zDp AxUZTZ68/CXKkjuZYdVAfeCoQMW1SvUycJsIJpxB1EMlFhCiqYQ8m7VDlkRGiuEdx752U2Os wVIT0QLimtiuD72hEQ5zz1SxtpipPIiqy6bbCAYcHN6nKkZnchQmFABWDlGSt9vzOFerYrEs j0Ny0LiMRnKEATcBioZxDPpD4VbEjNXi5jIjaFpE9LLHGQJZbIZI1JEUmsjqaLepVHOHbyqv xtYZxCTzjgqF2gXk1VE1BhgfZDExLvNYBFLKi5wFKs5lcUmKdCYHZ5LVkRBTT5efBRVdLdAX AREqGWqOmY+sFSSnhhvjYiuRyQaglrFeZVk0UhM2fhbVUnVo8UtaY/A7HzkcoyxGGNUKYCBh S57FNyU1QKJQdcdmDov4YhEJblsnRMFymCkUDhaRTGZO5kkLkFrNYBxlEEwq1UpkHFiErk4N yibGFxARkGCwjJ3PzyYGUMEoMA+AijupBMx4iGhiKkkqlN4iiVWrFaRAyS1tbafjskB8RJCM SBk9lQguLdgui/wOVeJxMhsDHi0GRFJhfviVRCWypPr82sdZSVxl6cI+zipqcBf1NvQaQtUU E9bqaqFvRju+ACs/Ai85HAbiNjgsUUTFmZbMpCwE5RKZo8A3x7TpicI7uqLYaqaH1zao3sJv QfvlJZOFE2hzlS38fs0RGVNnDilb/QjIRCWygMA2jhCrntvr2j91UkMHDqLM/dmM9fcYl8f9 lheMWxCGAPPHL2ookWc4Q0SchSIHdL6FkBifIbcxm0GRHdWkvUHU1HBY0Mrqvo1DV+bxeZDD g0AajgCbgScFKqjWaH4MEpnRjxQ1rJsIORgMYN0Mjj/FCFFW8aFtE2IkTB8OBtkI9BaDXaDA RitlbtoS2gpEkBpZj4JjUxkDMGE72A0bQzg+RHO4YGpqwGKNNUjtSITgGCSyCI9a5O00AvIK cXbAJr5aKD1RLpPXHs0ooYevRAEn1puwLdgY5MglxpBpKhIpRDfuWIRQU5LYFSUoKVU1n1gr kZnaRDT59rpeRt09+joK4VCumKhrhliRvugepakxGOeotRl2VQl+WjITGLnuySLAAKYz660d gEJhyz0YrghrdDDOV2ayyya+jVnMk/cgVcgMC16ykUSKdQWEjP4ye72AOFYbmsjiOJQoGGqg M1cuf7+zWCFRvUxUvTFkhs/ZBzSkPo6x2kNFjrvTTJFfkNRQpNRme8eGxbNYIWCfNUAWcSIl 7vY2x5IggkAigoMgix8x0WYdfqy/FFOxlQ3aqHrZqtXsacrJosbT0ESm2a6xqFWvRm0W8RTN lELEYny8oo09TVRGNpmv3ZQCgRw9q5LIqEARD6fFtli5s0wiFWuKFiM2+AtmdIhkcWbArabY 0QY/aAnQsSYQ4nC/hRAw+DIql7xxT+RAXG4LX0BJmF/ErIloRYsdKzrMnivEJlTmeImMRV1d Y/hNvjh1oC+J8uEz9C+1XhLM0JMGq9L8V3tNEk80NUZR8NDHT/WJxrEPAbCRGJ2pSHipnOkO m2qRRAijiDgsTCVPuEiATHwia8knppzqsHVWAYxAOpmM6GLPDwRRiD7YqsJqwilkF4zJ5rKb v9nPTLSZbcTGsjOQiJfIYquuNyO5jrNt2ZbiG6tP1NvX7VK/eOYxny9XytqFSe0iQ+JrHMIz lQFj8EiSeFSYmBVVeV71dyeVvswCfjAHNHh7CAMkYYGQJCvK8oAeadeRRRZjNwQpcO8CCKFH pj0s6BecJCazm2LC0e5+kU63FPebpRgIkYzDEyJOpNqVQAPHOdKcyjDOEplwXVSUKusM27nm uIQwkQBZDShThWzKQ1lasalTTQorGp9OTulIBmKaY7E1KjWw/YoIXWiCfL4ip3OwxELBmZo0 7LQgYHBKZsKoopKRTvJenni5j3tQZajsyhDO5ZCZAhLiLmYOCQ68zh1B1kKA0UNXl6gxW2HV wBASamUKE+yMJBJhSAQYDMXkWRKruYoYmjm66Uuo8B+sxzFmo8bD+7mckmfCQQS9EARiY2YG HKGMvkLUBt1i5kYksqD5dFUmp70OJ/qmwHFlhFqZy4RFhZqVA0I/GdM0+jwQXNv24Yw6lCAg AOJSLhTyzhPcNHfyhiccEHBCLhgwwjCeWk+x4CgwyhJNygoJVqWKA0myhOQidScSYVkWJLyb fZhOBmFIVFDccnUeDhV4TZURI32RFMnNuUzIGw9XqfvtMQHD3hI2yONxm6A4/HF4TLozxgUr ywYakcjYWGrAH0dZHdnT+edb0yw4lN9tjToWxRo721i4HGnTHf8SIw2HyxVM5vA+CrEXlT4o ak0hOJxDhAX/acADfhyi7dC4Aq/JOVSHR5S8Q8o6eRNYoUSeXd2ONokURPynD74F4B9kAsOH dEVFEEWgRQoTXwQLvFAlvq0HUwEgf6GOdFOVYWYgFShqmKBqZpC10+lM1Qk+zaIKwUOT1Yok oyGDSrLFqOZUp2MlMlUgW7eSasNvn+g7eQzJC+hAmmOChqtLKK1WKlWMD8CK/8DTtZHUnJVf DaeVaZslUO2xvkNRLZXKCDUhMVtCtR0Y4xQRfREHwngRoZYjkoDFoMRpKcEtBneYn3r8gkMc dFYBYhKykgEnAnCWzHDM8YJ4YAck5lEHU64C3zekxGxZijidy6ULPfYshuDI3iq9cEXom3xz z0I3MaFb49AFyFcpqYCkSVSE+QGrRYdj+/iKlcjShYLjm048KIVu0dbeUSgUSuXR0uhoodjm 7+qiRUUuw6ahQrGru3N4eFiksGquUCxU5EiBdQom05G5zyYj4xinxc29VkXiQeiRevD7IS7L guhXghlZhACl0oILbGgXMRUVb+GpCFHBXixigKL/PpGo1CZOXlFChKJZnkvUv8GDZCTzqshr IOM/pzBXA/pPsP2FW/AJZ9m7hG9eOnOzmNAmP2wYRacvunhNNSnEjlltUCaskH+U2V1xn2Yu SEDwKwcVNXMKPRao6TTKxOExCmaFhANczTomsgzdJVXognSliG4vUbIaoumpqEYWwwTCorPJ q8arc4hjamhC2GomcfxZk+o7I7MFgkYT6Ff9c2AkL6FSLu3L602Me3Fd0iUvaaoUGwNTUS6l yYwlrtcCmor+uVKVSpnSStBpxkA56ZcWHfVGi2yaqf4sJsZoOJhK/NKQOGGQiS846JgWfA4v voI5lGjy7Eh4AqRansEgyU5ulTiHX0ZG9FscpI0AkNXKShGmixLbc5VLlsDJlWF2H4dL9SFR IG4bVeduSBnOkD/jIJFxQNCz5S95GXkMi8r0G+5WhLkEgF/8Uq6ErEdYbi5DG4grz4emAov4 9CoFn4zbxgo9LUhd2O9SWl2ZyWmVhV4HI/KRM+9CcxTa2tqK7RhejY6MoNcHpVyHZMLjAqKH 1hTTUOemMyiUxVwW+7d7bdlsER5cEnBaFd0HGoGRHxcZasQVF9/478j4Z6mqAskvEEHAlXXY pTaRSbkjUt2BQUhFekeXELNUj19VqwRK1Iq4yIQr4QjG/AqXCqfGNFEPtmZPZBw4AYgxvfgn Qa0/6MGhuaTbokKGVQlYEhwV8pJzYJeJvh2kotulKygJ2vh1PmuZTPnU+wpWwUhCsBKRIgYG 1RkJ09UlrjUxRsDesXJVrPDLixzfsIoPSWkeACmElMNpVAVDevwIX4nlKSuRCSBVWwSrGFYh fBAfQWRVTNVEiAFIF5Cg+Ak0yCraNDWsXgcgwsoljaKDkapY5RX3T1BJrEK6qunbLbE2Muek M79C5mGAmLkYBgQMhTGPFS0ikSWobmNqoF0B8YyiJbgilMIgB01YUZaA0ujE5zadT1CzxRoJ 74poXPGLwhYNx+LLNIRTrZkHy81isC8bRIyk4DzOpTIGwgJO6lpQABgRk4Aizwdh3ksBPryU csWFJqJKSAx/5EfoJnzAiAEBTiHuUIQsH4R0SeSUICoY5vUBzEDMwjP3EElS/EBgKbitVEJU XYL7Tc5Y0J5p1dEAs6sri+8UylXfanQhIpGl056hf+RAihixoHAG/10VYlAX8M8lCkZx0JfE 4qRIuyRi4zPLMyY5EHDKrkJNE8EObpdLQeGaOYD00okJMhYOhESuflMiwzp+CisQIZ0k69iS BRUOUmE8yEBsfCYGp0m9MZRARMqyEgCkgc4CL1RBgc8B4xBPdUBVyDAzsD8OIAyIPbNiOwsC K+PMUhIQjDDq1M6heSVArNMvqJeYzaugztLUZXMia87KUKxxTuSe5EdnoGZwrnuhyusWpFgw +JRDRFI8smvYw0itLtrpNFyURMNJE2ff0GEFN7pvpArWSn3YnM7ia2F1ZkB1mK9VkcRkInOu I4qn2ZNoteAgK+FOsycS8HgZb7YkscTDZ1XEU+STV1kcAlBgdgmOHBUpMj4FHqeG1otSg9DG yh0TMlkKbvXXyy8tF9cEGSIsTgKOEvbX7WrCknK4bAKlwgqLB0YyeKxRkE2V5l6UGkE3J7I4 kkGeFOaDSlSMrZ4qTyRM0xyhyrnqHAln+sMdxVUETnNFZFep0SUhLpIqJVbYgU8+lYKAnQx0 v8p1Kfo7LJ1FS9s4fJ5JJmAIKaaRNrFU+GDMKS/IBUyhMWAuKBFl2FORXFbRDTWi5VyMCxh0 EslAcGWD3642QXFgGemAEpfoqEDRSXUCkkiHQ8ABaUfK8EVSCQQMOsYA5SSy5vQ70B5oUoFL Gmsnlwkxr3FDrkRPP/Y5eXzepeubTgRbDT3K43XI6iAL9/VEBsPfCxIbqZzYA4FSsViEgLbr LWiBMZBiDW5/9erIbOkB4Z300IuDUBZuI5xqdIZFYMyJiAyixLsIKcmcpAfVF0GwuARmKUwt JtiIUyKNjhDSMWJjYx9IPxdZYxDDpHDAptAmxdVRLaqwJkg1sjFwfckNkrUxa5ozLLJF9idS eZYjskhjKRi4SgCMQ/cYOp1LMDD2ihAVppGP8CXDyZ6EiznG5OUlFBC3v0FECfmLtmG56sQW hGq1XNbfG+HSzd9uGlSpfmMqJTasVpZqpGJYjRHJ1HRAiE6QgnVzAh5qzK9T6PBjQoXtRFIi zyJRKkW7TAwK6YnB6LBQTGiCSShoCAaKSaw5yJPUNKsacyCbRBaMSCYVU3sG+muhWMQZRxzl jkvOV0whRzFxU46gAU8sk1LaGR+pBv3RAUXuaBdYwDi4OmKkJtfKlUEWE22AX7uNKwbe84OZ xWBH7sLHhSHv8DKlMUDQpSAmticQdXtDbJl4jM4AHdo9G/EkI7nCW5epwq4zeYiuI/kJ08RK PuNMB+t0EePjWz6O2NSuooGceYEcH3HAw5w2NwawAQLhNLQwKdIYfXyG4IrTbX3oBAUnP/pT GMljgYyOBOok6/33P4rPt7/z3XDB2XNOuf+BR/G56OLLwIlQqh9NFiRsr8fzOR0dnW3t7Uz9 q4su/eX9j/zygUcYU3+A3Iywww2mASQmYish6DIdaiScGSjxm5gFDgLhDDbB+uFj+sMRoDpT XdgrXyBkNZnUeEBzxugAao1PTSOymIEzmk+B5LinkE0nggrWaFRdGnN9UJbdJKoBYQy4IVeV 3G5qTM1IqSOjlTY8TITnHys5Oed1a5Dpt1p9RFstGu2AJ8WRTspmiLTJsxO81Poj6xv0wSii Du3BEMcf4jFqCxptckxNiawxdXPnXoYV9Lo7IAdmsKL2EjIKihhU2T1ohv4RyF/srvCOnXfY uOxyYQqMvIIUJmuauEKJBSKymOOfpjb2ymmgem4143/DNGlxAc2X+JqiOS2qM6hFtO1m5eDK B4MzDhIZO81AeJxjsoUrkVRowkdEj9IWAA6lYMBkhVKZmLUwRcJcAgBE6MG8oVyxiPbMpYtH GkXykvdU8ewR1u3M6SKqZrpRKseX0jjZZwagkHhUjNmqBauZsHDpaGlOiJLd1NZ1veOqnK7W 6QIeGZiUiaxO3kS6G8lgc4xzjqYhtDFAxAdJTA6+JKtZv29k5qn0IM1q3YraJNGe17xNG5HD Snr2HkGI73U4K4cFbIBDmJlTM00iKpVUqWxBHpWaDiaL8uxFWnUjvlpbrW14ypl2anzL2yZn ykTWwGCgn8jmi9GGMVhiOS704OU/eNUGBiKiEPcljuht2B2GGZnauVVYNZ+Vt6pODaarzZjO YJ1y058dOWvSxB02b970zMqnIf6p+QumT99/6tSpgF9//fX7H1i0atWrgIO1CPp/1IyjJ02a BOY333pj1ao/TpnSd8ThR6L4++dXbti4fvq0A04+6dTDDzscmK0DA79//tl/XXiPo0RqVxVC 1axZxx4mmQcGBlavXnXfooXrN2yALB8nzTkZ8ObNm5evfBoKRHXkL8r+0/ffa8+9QXru+WfX b1jP/ABmSQ9JhItbtmx++hlR9wvmL9hv+n5Tp+4MePXrq//jgUWvrfojYPUQhpRoBMOiMjcM dn5rw34UMvAlk8qSErWtU3gWVBI3kdVoOIWvtYuoHQ7a3H4epVhcDtVKudLd3Yv+MTo6gk8x 9CWOvb3dQ0NDSHzYG9bR3T6Cl9g4U84oWzXTvYGBXZWNRzxFkM9duOCiAw88+JVXXoKCK6+8 pq+vjzUBf9ppc++55wc/4YwjL2NmIIDuKn/q/AULFnwWmLfeevOL116FKCKLXXP1dcB866av HzVjFlSpgkfNmHnyiR/9wrVXbfDnGqS/z1/1RVA15jPmnvnLhx785ztvB5768f+++HPwdv36 9f/rM+eL/umOLf98/gUfOX42ED9bdN/3JD+r+vsrr4bIfy9dgtwH5GcvvOigAw96+ZWX0VxE Yk7g554290f3/PD/LbyHkWS35hvXrC8uEH71Ca/cugev8Lg2xjlf3ETWtNW0tTHhnSEJGlrh o8amGrkTJlx3QEgKTvJbvNsP16j7FLRUgBOlKOdaIiWjoyV6qAjbZ0t4W5opWELShB9LnBKT vr6p1113fXd3D9LQsmVPwiuMhpDIACA9PbXsd6tWi3GZelD+IgzGcQsu+CxgiF977VUbN6yH blb/55++cM899xocHFixYvn777/X2zth9uw5sAXkpZdcceM3vqKq/eaN3wEeGGSoxxc/BmDn nXeZNfNo8H983nmQvfnWfyD+P7z0IhIWEtN+0/fHABDhJYuHHHwoMRx+2BHsAzAYjlGafm3V a8RA5536dvqKqHv3m2+9+ZSsOwSRyED9zIK/eHLZExiXQTk+ONTFQsJIdPRJ9STIbadGGHG9 gkpPR4RM0Pz4x4yjROa1U3jY4/JJLTItod2R6BQ5OVaRi9x4SyeWk6Je4lgaFXtZ5VERW/MN R5P3LbrC77n3BwuVAcjFF102b955qAymhKuDicyt5Xwti23coIRSMCExUYLDBJOE7r33zptv /h6Mzpw5y1Ujvv/y4ssoi/37ovu+f6ezLQ65A8O0b9747b323Ov00+Y+s3L5fy1+FPF89rmV NPI67pjjkMjIKObFVBdo23svMcHk4+hZxxD8y18/yEgAxK8Nvi65+NJPyLqfctKpzgSTDCR9 QES1VB+Yu1YQ0BpCsx9O1ZizLbKrWfkgX7eg+Ai9xo/CMlYg193qAHluJVsJQg7alQ+GYkhe SGIiPaFgFZUETCqZQYg4gzZHIZMYSOsnKxAAPLbNGX18loIYgsJP11VwLVp030+VLAbMnXd9 F8MoANOmTQ+qoVqIGaV/LEY61SEwxlYYpnEWg6r1G9cvXvwYAIyzsBxGypGt5s49EzDmuZzF iITp5xeu/fzg4CCKp592Bs6wvvSJJUSdPn0/bqEPH3MckBhb4YxBFkZhxIPzdFkLkLSFM5Aw CVWnkMDcceftZA5S3PNo9x03HwExz+yGBrA2DU/90U4V7OyYjEdAwXaBoKsWy9hNfoS2JIhx jlAdVgVYdnBXHqw8QYLSt4LEhmHieEG3Yj3Ou+4SIyCKFZ/ffPMNIHt6ehij1gFjsQvcdTGa UapUhpGz1CxG+FdefZmAiZN2IOC0U89EXgP8m0d+TRj1jFy2eMnjwPDyGTBY3gJmn332ZU6s 1gN+8cUXKJfxKAzIgw86BGdMHoN1oaU3xhPwhlP3Xke5Mqv0oubQGv0FB8gH6RT89ZJavX0j 0/HP4aEhPeE8CjVo1iE6jyhxEyoyzQPC++hDNGbkIZlicUaqsjCI0Zs7gqtlxGRR7wzEojS7 VRTOKB9PqcvgYmix3y3F+p5//oIL5FiMBlxYF7OJvermLBsD4XfZZTcCHvjFIgGw54TN5d57 bw2BM91x1gsv/B4YTDkxmiMSLZD98bVXkcuAoVEYANzixAANwLLly7T+JBb7pbB2lUicOBEe DmmCzJA5EKi6wYIckQuXXPcED3kYR9yg0UWRuFvibwyyhXoLldnGBmj2ERk1TERs6hBa6hyx rOvOwRu0tlhmU6dXOldEWSqJ4KmFnKpmfoM0FgMOa0yHHz7DTzSXwqO67777QkxNqXStsq53 3n2bYNrkAfjp5csIc/xx4jZl3xT4IjIaZp3IZQD23msfYjjwALF4j5xL9yvJEyJFniWzl8VQ rOWg3spnVxV5pJ5div/b5TD0kBod89sxlyiXmWljikUicyMzpn5EGBet5luOj+A3kZ2Wl1+B XiD6ANbCIpfDTIo9nCeeZlaq6PHAOkKyuoFIJDGIJXx8IHHxxZ9LIpcZ74qVTyM3Qd3++x2A M6UzWgWjFTTkNdzTBAk3InHGjU6cUWf6AKZDy5h0SbhEfNcUJUVPSpAzlAsY/CGSVq+U9nQx Lx7SijjFN+QJ62ozKJMbSK9NPSIjL2XsqCu5c7YMIuDrm1jytl3VSZvB1QPfkx2uoJBS74xh JKB+NKUkRdkEWyic/uU2r8Y8caLYrYpjzZp3IViUB2FSnGEU62I//vHdkEW+oDdqABYzkMja U6MmtDrJ9R87WlmUctOhhx4GDKUzmlRiRZ+WyWj5n7ZTrHxupfDQ/bASOdAQNz7cjEYRZLoD IGiAIitH3KQieNaVOu74mk7jIYtwz2iaqqOJhBfJq3AeG9Xog425YXg1kaUISKP8FKvu8hab MiwTAVWDGto4nAtUj1maOmiKpX1Vm4TFSEwconcmOxy5JEIkAkvr1q2FHLLJtGliYGI79pPD FlDfeectyOJpcNpiYuMPx9Pq/pLFjyxdKu4eYqPGtOlh1sO1gbp2rajFXv49EyyFarL/GIgx HpswhNSee2FeSemMJpVAUkbD8v/HzjqX+P/jFz9nQRUItlYQA37RsGN0kGF5FpNc+uBmOeEb 5hRdMjzB5CuoYQ7YDKmJzMbTBHgx8BBuUD4jh0RiQzNKfMyAgk30AnlQV3AKQjM2UYiDMfEB oRYfxwmRXuLLCm7Br7kTSwHn39WrnR2eJ510qk1y8uQ+bEMFFTsqVq58GhvfZCIr2fgj8by6 f8cdt9Iujb/+6ysjpUIYsBcMVNy4PGHOKUY2ugVJdyqZ4T/d3HT6qWcinQHP2zIoo+Ge5gEy g69YuYKlggC3QZqWCKqrF8bpv9TXnI5H3U+eazHL2oxKwqlGkfohyRlVf1MnMjFDwVjf8VcM xiTsIjh1qBUCkT4q0oXRR3GQfIBLJEscLm/cb7NAQDvZDaJdo0GKM6OM9AOSixb9lFIJhkUz 3Dt6muAll1xBmxseekhsB0UsXdMaY+IiMhrpxJMA539qgVE+PDsQ9VfuPtV5534iqOTEOSfT Qv6TTz6hUZ+RGerkk0T6U7eJUUZDdqOR2urVqzRBUzHcU0eCWiv8bFJOODLhnFmJnV/8yoGt qQ4elDWJV02dyJxxs1y3oHjh2sOf68CeEfEBKl7z0qqNSIv0UeRYgUJskqZJ4MbGjU4qgcwN N9x00UWXHTnjaLpQMNk8f/6C22//0fHy8UPku0WLFiZQHY/1rju/iyUz8J73iflTJjs7IeKJ elzYF/bwww+hjIR43Re/quo5Yc7Jf3P5VSBhaf/H/l27QK6SGYqGYzSdJKW8TEak3zz2a25l bnfiVPEME2nMz2hHHPLsDMeoZVM4lqJqkSJgiHOk9lkqJ2kZA4uxcfOIEtpQ1kauI1PwlPUy Y+0kq5HiQ3JLhMXJJ9HoAtI3zT9DDGMXPp5JpGyFcRk9WqTxI4vdeOP1yHoaPpMiVv2vvvo6 DPow9PvGN7+i6owf2LvvvROjJzylhIrgQ7NIPAtJYzFstf/2zTepmgl+5LFf0+NEKGI6yQ2K IvIaZTGM1LRXWahsAZ0+l3n04U0PAgJ+hE/cT4pbgnukxQVC/Y2r1cxnUZ1BLcz26oANjsjg PX3qYK02lQi3E3H20Q/4SpbGCXGB9BvPNqnkRkI06crU6njTaEx+PRfdXC5Zv/GNr+BhSdqO EDSDJflrrrkS7+pR1QLmQ8NTMUj1MLi+lc/iJc6qPxLQnNnmRS6WtQHyUaSrfiXHZeDBrUZ8 KIshqd3w9evhv1d7d4SNxTWuNS+QkQl14T8oyG6AhCtB/QATPEhDEB8TE3TAaEXTJttIMFJj 0VnjaRXz55x1oiUKcYJsEc0InbTNYg7ByDuhPKkBf730ACnlJMv9fqVKifVhRCacjaNUymCZ 7KCDDpnQO5GUYWP98/KNYIruDEC+bUK6jMGXARZP3Ts8XAV/5P0l5Kf89Gn7H3vscRN6J0Cw v7//pZf/QK9LS+q3qhkwhzSoR+UE1VJ0FGjUgDYzPcR6QIODkIq8SJv12oRdvM2uDU+1t1HZ Bx6fMsY1aP226bThXUW6BeYH0Jar4tNKZG6sEn5zKD05BcUXrEe1QEJIvsRRfMtDv4ZIUM4u 0cPwtke8gVpekgT7x9SKD6pBC1plSQx7l5ciGkxnyL/85+/ETWHZJ/WOqWgAiMznQ4Rz+1iF tDFdeTok5DfghNzjMWlhKgCGVeOaTpXEMK0ScJEBoyxZ4SVio1HWEAIYlYPfhqf62ajsFVuM 75hNpw3vmtAtMD8ASmTNu0am++7WKctvikcWlqBJVYMrMVYuE2ziJY49PRPQxUdGht2XOKrK RIej4VihUFRf4tjd2zk8POxsGaG6ZBkdXZcxc2lMGg9XQ8yBFQ8JZKquRCsrsXVegmaRDKZR aBLRw7QxdGsf8SgOeh6wKeIhggp7rJlCZJezWKa6w5QZg8ACHA1gCA7nZ8G0gGpQ7UG6vuZN ZLqnTVC2tRnh6RpG4NXLSW0Hd5yB7IXKSIrgFhUrl0vit9rdxSYV4uQkQ8ni1N/3EseS+PtG DkH5EpJKcUxAdoCC4/VBpyycUkDHR1fK/Sa0Lwc6nEZxj+aH2BADTGdLROLhHIpMYmZC8pnx GuCq0tCiiO17VBviUTkYA7tkmp0BW9AZVVaDWZWGp6KdGtdIaseM/mSCbCWymsJo7xMGtTLn iF7quzBFgf5SUeKXOJab+CWOHJm4F4cMGEsZwqegPLa4Q19FODbIVtQqAIkikVQ8aWURFIlT s+Zreo2mFl0DQRMqVzPA7KFa96Bj4dQgf1JMm+FnETrYu6T6xpTfGRPVO2ayjmmNCDl/dMXC GL3BESTA4SFUnz2Qfwk8nN3cvBEyAbI2YQzQLQhZFZzEEFRmca1u/jiYlfhEggL04+Bj0vUE hXSOqLKmHsVadGraNOOsmV/iCAYgw6U0JbaiXYkwa6c6+lzfRB91YZupBuKl360RWdyIRzYz KSK2pM1snCHG9ay5+ZBqZKY2hCRmSJu2fnHaOlhHYBCLIN4XIDl5I4wPP8axcLyGS83mmyWR CYfJVX/AGxhUGG6QNa5ibHssEdavZAUaV4swV1LSkg3ELEGJHGNGOxe7XaJV2TjY+eS2wkWh z8gQtOPHJIu9rVpx8OxeCLP0TXeJHI4jHqLZIu4PhhJDmypLIrOxNxyPeup1SuJDjeIGUxT4 WnwKKGVllkYNCIwzBOo3BjXjqNqipTGoC9g2kZj4gGYhFx4CFpGAx8v4mKY1Nk+Rj5BMqzEy yVT4rNelEJnIbA5bQlQXJ0OVkiNy/uLwASPnM6Io11BC5etCFC5AsfxyYM8OKBimAA3vbOH1 uJsQsk0VQ1wd1/UNqVckSTSz/6C8QLeuQQn0gKCEX77OJdE7XRPSNy65WNx7laCB4LGkhgLx iKcpMpH51QR9T2nXrzZGCde8+Ave7pVPF4Yn53fMuWxAtt/VYgmvBoTyyp76GiEoZq2oAXa0 4uC6sHLiYccYbwOMSmzMcfD65MEvQ1EFzrEbz1HZcOIljhBU71T4dacsqTtdrCo49FaOuIQU mlgE0XIDJjqxxLsIaZ85yRsKMjg0vNFXnyIjh4N0lIXwEwl8ABhmlcDH8Yf5AYTYUtmMcHzZ hInMaK1uSFSDo0ZXEV9LZpskgFuAbpIQgYi6D2hW5cdKPao3kszOacwuXr3MuC5UBddBv2TC UiZKYtp0bEnvE9mVf1hPvMSxti4d081s2NwGzEYbaQnRCZLoYP4jUZD9orWWFFfFTxsVFWSt +ushnzqRUb3cbTENqaVMUDIIbrPTt2fcGbXjavNlL48hbQjFtnA8OCPtucYjdAk2dze55gBX xO9mhMLayXRtuKGJWQ/HLLkKDa6SBOLirxfL2UiD61t7xOqkQesPsBLE1Ml0fLV0MZFjqnsJ Gt5uLFxJOFXVCsfIt9SJTNVWRxhVUoIYuBDkXEiptgKmdop0KFalJvfyV9WyNZ1ZMBEOLAAC KgMVUdUmhdkNRdCEE1NChcUHhk8qmRXyVcyLuRwPkHt+47FqXKbAgkUd6moSghpEKZhwqsLY AJB8iQhnBDnCTV9146iCANhIzCccYWhsyHCVKpVRIuMI1aHqpJsVo0iwvJ7YsBNHZksRV9bM so52IuimmMsH6NeY/F1zHGbPXYlavHV1NPqbwhDH83gBa7T/DbOnVh/hUotGH+KE1CiYIZJ8 kGfnpy21V5H1DbqdQoSV+N+dwOi4AKpJn7gCtfNxZLFkKj6uB2Y/JDbmcAO+mUMJJS7B/dbr gfxFH53gL0OcNLC3R804Gh8/1xiU8HdDZitvyif3Qs5j4GKUSfY2itFHxw8NfXzY0AI1YuRZ 1UGNrmIU2HHc7UFOV1IYwkGutxEIl3Wo7J4LuN+xpJMxQbVJOzufQJuqJ6MRWQLrWbMiAlkc ItnJwKjR8RRLKyrJN/JSCZ5MGEQSc+accs3V191zzw/w10BUbqS2WbOOJcy7a9594onFeOOg ysAwNNCfnu3fuuWpp363arX4q7TGAy87PED+kdr+rf3LnnoiyIn3u4Lhzju/64mLQS/HV8Io qQjJitefzZrpeIt3n+ENi6SBGamIV1efetqZ9JY0eLvM7m18Ts9VEwQ9+MvBWzZvCnmX2fTp +3/IffHZK6++/PjiR6HJ2J543bYT6v7+J5c9ob1vVpXCnxeIyUlec6AYYG0qhphjno1ViJSV 5oQo2U1tPdJQ7QxUQa5m/pyzT6xdqaXp3XjUYCDDUPpSj+YSm+HAMEbhZCJwYdoUEQKFMpPC u3/0b6Bc+JlPssSUKX1f/tINeGk9YwDgFdX33bfwJ/531SPZfe5zl+Ot0Con3nn/j7fqL4OO w4mqffGLX505cxbeIrtqlTUbqrZwuSNTfCngLV7WevMt39JS8/z5C/A6f/rrJ6wE3t56m+6t jfM2pV7G4AcDfNaZ8y679HL86fIrr7qMjapsf3nxZR+fdx6TAMB5vE1bS3wI4KWf+2t6ZTYz 4zW2t9z6D1wEAM0zLZw3Bzg1QVPR6W6qwyqbC5vpal91OSO+pSJv9mLWG6HD/BsAIbs/wo6d 6rOnsaGITzFfLeaqxYMP3Fcj+0TjFrLQEddWSj6qthYzr91CtTqyKk/NNcZVNHPm0T/72cLn X3iOFd9y8/emTdsPRbyZevnyZW+++caOO06eNGmHI488Cq8tY07ku69e/81dd90VOQ4DMXAW i4W+vp3222//qTvt8uSTS1lhOOdTTy7lqr3zztsf+9jH8bcjf/WrX8hOjLcKVeT9AbCIlzhq 9wqg+Rs3fgfesg8YNu699z49PT1HHjnz5z8XOZoO5KYFF3y2vb0df6DkkUd+/dJLL+LPC4AN 3pYrlReU6odwovrM6fjsbwJCqudLP3cFYrJ+/TrUyPVFtD99/srNYvDqN4/8GqHeffc9Jk2a 9D+O+8jTy5/6YOMGYsOfy/w/139DhnoQoX5ahLoItfvvt//OCPVTSzFspY/COfCk5CwUC/iD A+CkRmHTcIZhACipRYlxGNhtDdD4g0WNXy0Gmdmi9EvwpstiECRVqjmCbfg4VNZmVILYYYGs zlNLspw6KlyD7ABb5oKnNjeN4UvskT8UyAJz556JFPCw+zfQoPBT8xfQCOu7t9/2i18sIhOU L4A/77z5PCj7+Lz5eJM9xL8uX2NPnMiM8+add9ppcxcvfpTHFB7njdc/88wy7OeaNGnHBRdc dM455wrOJY8BSeKvrXoVgxcMBs88ax6sFwttO+wwYevWrSKd5fITJnQPDgyWK9gO5vTWz11y BbzCEOb6r17LE1UMXr52w03wDSlpoRxCTp92ALIYhBYtug9/IYVsAfjaDf93xoyZZ57xMWID XuXEn2UiTgA3fE1wnnGmx0kkrSlF88kgQ88hhxx+yimn8sAWaK1xKf6QwA/Gjd+8nhTec+9d t9x8O5y/+KJLrvvS39NLHD8x7/yQUD++xBDqr7mNAqOULk8/bS4mrdwo1BfIqHpmJ1WHVVhl zhAmu3KtMEOt0apscYiWJA5FvsbF/rgWm5kP0aCAEBA818P5BRdcjHnWihXL1cWvD33oONjC AIGzGIpg+M/7xd/HBj9WxMgZJEEAS5YsXvGs98dE/uXO7yK1AX/GGeeIKolPfu7cs4jzmWee pqsZL3H80d3fx18kEpxzz5aMYkSAg/5k5MfOEX+XG/dR6CWOcudYtYSXOCrZAJNK/JERsN15 5/c4i6GIa3Wl/CuTRxx+JIo4zj57Hs5IkZzFJDp3389+AgA5gv8Qp43zZ/fpnKSBz7gOOQVc fNFlt956x6WXXs5ZTLC5gybUkz7I7zTP/d4dt0ppoWPDxnWLFz8G9qNmzNxv+v6kn0ONybIT VFFrJ9Rnzj2HkWe4jcLTapC+73KehUbxH+H3GahF1LNfOkGJPSQAkowBTKGDM6yRg8mYEIBV sXKVmakqUsIi4K7xANGP0JSoRaigopPIVJpfSauUfQQwHKA/+v3fSxcHtQ8MbNWQW7ZsVjFn nTWPLkKxMu3vdMiM4Dz44EPlLd3qWWf+z+7ubmAwRhMaxGWcR0oqlUorVojbC4JT9KYKqaHh IcZZGFghf+HV22Ivq7g7LLbm01ZYoSeXO+00kUmRcx93l/YlWpzuuuuOm276OuUpFGfNOgZn zCgFTTlwtYMNnzf+tJrQkZx/esPhVNQIUO29uI2ApEkfSusaMxWPOeZDAJBz8cfxWBzAY485 fh577IdRPPtMJ9ROABVdHGrCYT2OGmXxEt/tAihROVHEwWcA2oe00TkmmyqSBiYPYiaVNAbq KEMhgoGsppZ0IbBav+uEJhY/ZfyWaF5jXHWOrNRxx81xOv1i5wYfibzwwvMYR+CDPMLTEJBO O+0MnHFZLpb8u+66G/GvkLNCdenqvfffAwnDHJyRyzxO564oeAv0Osb3PU450pJthNEfzS7n zDkZDiDfkSHkslJpFGc+8FeOAD+17HcSUz1qxjETJ+6wZcsmpCcM0HiMhlkeOfOLB8VMmW4j AqC/6sT3N4Fhzgd/sQi+TJ4ibjgSJ/6S+RJ/oIDXD+k/Tj9deA8+RP32t79L4zLgFd8FEcka 59WBvz3Onou7q0oAeZDlJKFcjgMoLed2cxuFG47wsKJxEj7oknDLzXHsrY2NmCPP7IORk600 4UscyWHNfyoKtyWEaxDfNJvIKpEZA9VCmiOw/34HgICUoZH/fdFCjBRwjV133fUPPfQgdgNM nDjpuOOOx0wHnLhxSfzTpk0HgNGQmsKIhN0PBJww5xQMDei+ATgJiTNEaGAF5YScM+ejS+Qg gvCvv/46Ln78lVwWYUCdWk6dOhX4NWvWYCQyf/6nsc5NbMi28JxnkXvuuTfwcAApDH+4l2aj xInq333PXZwgmBMpLMh5z90eJ4knPauXBE9m16x5V8WzY4jAYYcdDpIXatceX/wcauxrQUZm TpfR++ZQo1Eej8zIUg6m2RApIj81JNsI1kKVYjYV8FTJdEBFD6myNjEMh8lnPZFxRLKvEqum uGRvoInjza7JIOy7775AbB0Q61nqgQHRF6+96qqrvojMhWV7JiE73HrbzTQcA7K3pwfn4AyU +QlAYjJyqjNE5mTZrVv7AdOAhZEANCka6XCSpaS81157Y6QJz3FTkv7YOO1cg/jNN38PQzPc GVi/fm1PTy/0Q8N1117/9Ruvp1wWznntddff+HWHU3il9SWBSnBg8Ejc2pxdIP3dErdWgYsM NXjic3rO+20J68qBKgbpQWS6SLBmCWh3TRQnsgbTeSu8IEm/36p3eiJTaXWC2Zn0taqTZ41S iwsepl4PzGuAxK1AGn8heWFDAF3zyA5XXH7l7rvtznctU3vKwbdp4OGDNr018sNVpLDb/ulm mpH1ucMujLz4riUEkbZQHfWuJUYxl19+Jep15d9e85m/+CT3BObku5Z43oA4//bKa/5C2XBn 9GeskJFR1RxTV9Y1klrksBCSrGhIlT8mzN5KwMtijI+pR2OzOJZGK6siQFPBVNUBayIDtyav irXgWiJAC2RBDX9zxdU0+cI1j7tdxDB9+gHXXP0lXOELFnwWa1KrYu5WDWpPiJk4yRm2hMhh fHXD1768YaPz1AGAO+64debMWaggtsvzvgpoUOebKGIuhiEYxm4YpiGpLVHuGIDzLuzScHsr SMyJpIbiRReJXSaqV0imn//8ZSpmm4SNVzXV1I1WRL0DV7SXxSIkm54ctv0iZnRS1tF9tCyl +LgSQyTpE+41NnaBYenSJZzFUETm+tZNXyPBc86eF+iLZpVvvvWGmRDAvhWbMyCaw0ZczmJE RZFu0tHck0UWLXIW+BjD9wfFpFIZokRwsnydgbVr12oWcGPHeG9HD6C9heI3CkxDDX00N4wd iZmDIiqJVSHeFHJVG+A4B4kEzwFZxxeVM8DjIFQeFaaYix0z0mObOPDWEVmITCNJqBUdiMq2 ffAeseCeDOQyDDqQGmhx7Xn35mYwILzSRAO3+JxBVeEYjMUwmKIFNY2TbtIREpshCNDyHZp1 tTu0FB03n2NO7IfQFK72P0CKDMgL7cSJu6Xe9IF7jKZFKWJYhwdLgUC41MEgsVAKplq8ECfU 0r0QTnruEsqNo+l6dOwQnUgIMSKkBKu5QdF5pIfNnsiaO4wpvaMs0Ns7IZ087rWRIGad2rWx y867gERL7wDicwY90Qcafg6s2SORGatASCyKQeLdd94hOdy1pFzGVxHuTqoqmXPy5D4tlwGj ciKvaalNpdI1zFZUkgrjRipm67gpoSIB4y0ghKFcyQEEnndmEAPJcqjxbD/hg42icRJbI88y Jl5ItDSnFRvpWIa2wqaWyc0gJvRJIEqjRz7z4kgCFWPHSiPepCsNyAJwWQyv0LvcDsaJ46gZ s4IVcu4PvP462H/7xGJiOPmkU1VO7LPF+hQwGIgRPpIT4whVA+Dw4QM7TIK0hZUq4dbD2QFL E0yshVFGw3svoNzhkbMa2lILJM0xMTIiTsazY4zh2SiTGPD6j0RFXpwvvvgCGBEuL0vKnnuS DCk8oZ1reO8ImSA8m0NeplAjDmSLOdVGAQn5WmsUVpIJEFlTlwHfLugaDqK4KUMAVzr4Tfqc M2sI8qkYYmOMXqQZpe64ww5mPiISmaaXxWoBSKfqRBxtSfnj6BwrHsoCfX1iKxYfNH9EEZv+ cceQ8QCu/eJX6f7A/Q+IbaXYpYF1NAB4JkblvPSSK8CGixD70Ug8Pif4KcI0nsJAg5qJ8Vr8 YQKG+vr6rv3CV8kWnfGEEJCAl7oPLWDxHkW8+oJdxdwG6eMTn5gPPAzx8Io4ged9XmAwcgIf eVg6vyP3gIwkwoU9a6wKdumBJPIEeOzFpVADr3oFKT3UGz1Orik0BBuFzWUF+PJHMF2ZzJCI iTJecfmPxXuNT3i3CNRe6/YBukRYdUqCUYVVxGyhcViMCOIc5D86Op6sBv+CCz8pJlxurYDH VljKWc+sXEH7M+bMOYlSA7+iB+wYfP3LHT+iawlPXOIVY8fKnbTQefc9P1B3aWicWNWiPbfg xHvQwKk5/r3v/QhzLrFVwr1t6quXwk1vqgAVM2V6RJE1w9Xb3PfzIBPdeON3oBOcSApYe8L8 9yh5ZxOp8AvXXMmJbMcAJyZlGM5QNfF+Ieb0uSQLbgh9lO/Inf3IlVd9/jLFcYeH736CAT8t bAuzzmuvvQopjPgwpLpDCbUvgPf6Qz25758tnNQociTq/mJAu3Ta6LlLdFwNfrEUA0EeqrLG oBVdqWB4XIrv2yLt43EKNo0aXnNSo5oUu+N6l9ZGr/E56MB9XUyG33H8sZuDNO5T2OmZUaQh YUn7pDCQxN01a96Ze/rZ2EKJd0vwm3lgE3i8JQb7/vv6dsIjL4cccig+YMMF/8AD/3H7925h v/DI96uvvnLQgQeDEy/DARte9QO2f/3JvWoWA/+Q5MQCtsb5E5dTrP26H2S9z3zmLyF1++3/ uPGDDYz3APYgl8NLdTZt2owXEyLPkqvwAXQkwTvucFyF4qGhwaW/XbLzzrvhDT/4gHOvvfeh V/rccstNL73kzW0HhwZ/6+cEv5FT8SIMPP30s1Dr9XiNz8O/AJ/WRHjtR3d3L/wBD85kC0nt K1/5ArKY+GWSH3iFUBsCuFAPteB8xcDpNQpirTkR5n4jaTW55YbK6yYh6jSSUyQVgTYyhkDT UJCv8RnLERl5aUvyxoWnIDPVKog3hkBHaiFhcnJ1iUZksPOXcjMUhl1f+vLf8YiM7WPBmJda gm+IVb3DUy90p7K/fwse+cZckpVolVPfJfvwww9qS+8khYnhvHnn4VFq4VXsA08p0UOdW7du gWZtqZ7VTJvmVWr5iqee9b8UF2xcL3DymtSKFU/xY0ysKgiwbJDEGC0ghIctPB/eiycr8XT3 cs9WsEGx380Jtaymdh/WsSL94FBv8TcK3ujGzghAfebLRyBiAKUguL4MKMQw0MLvd8yqwCwd U5i0asxUdKLtDFmt5o0aaERWp0RmtGj2zxwbM28A69Y82O0CrDUjQh2N6QDrwGoxTUMuv+IS 73YYk0OdjcPl6y6+gqOacBrlhz/8NwyvrrjikpBJXIhrmjZw4g+MCqQYiASJuqY49dJl3LJN FnjVsAo7ohbJ8AY1CCkoBXT9k98ZJjLWy7YYYFJSwKbBELTYqjVZrRhTTbgUJbKIxX62FK6L 2VIA0EyfFLLjVwS/5z/44Z3wn0deGdbFaywlshxnxnls0vaZZ85DFsPyViZZDFcF3sjY3dWF Fa5ioQg4wwq2VLUioEUgbiKDmNbvNUWmIjozfUzEjHB1N5CRn6SGkwiKeLMNVmRwOwyjs0RG VCVBQa+ZXCicnzXglapYZbv3XpFekx6uKW5xDGgEjJc4lsuj+IPE8m2rTE2qviZ+WM3woDok VSh3EbhBiidMrRZfhvjj6a4jF7vN/qiYpD2AlUR6nCCRReoaAwYOUgNshwY13YYyPG4Nx/G2 Usf9UBNxqggFnqokQ93Zs0/BevYPf3inbYXL1at/h7hcKOTxOkb5UjN0YM81XcVYlU05SSRg y6NI6d2kGDVfALQasZsaoLHVVGTVNWkxCMddI2NRtH7yI00bpjKU3LWkElFuha+tkLUIHRFk x+MglxdlDxLM/pIjHoL3OKIgRXPQHSHMrz8L1eSoMasIlWSiTZbw7CcDQtAkE9l8JiHphUJQ QEkSo1OfZYmNWOx3eMxuMlGvhG7aY6w7ZKqhMKriObzGW3lBF1XZIJUw9FeU2sJrHlREmHCp gElmD+oL8DY5gmvAdWo2h6WHODWDg9pbzOoRqqyqydeY0UmrFT/BXzJqyhjJ/TFcb4aO2Sza 8KpjkfkrjhJVIcMpn7WEvQxDw96ogFaleptTTbfgVgRaEQhGQLskgwxjiEmZyNJ6TOmomQOS tmZNIidD28D4Nunvi+qWGg3g1WKTNFoD3GjaWmflWEQiUzuEGm6Yx8dGVTm3WZhaoB4h4LYN Vc5c22yE61Qxf1TDZ5R1ciF7tfImMdTa5m7+D3to1QAAQABJREFUSqe038xdLiKRpaxxHcRs Qcykherg71ippDi1ouLEX+02KjxWzdOyW6cIpExktV0omvR47mDsu1an0OZKJRSqkYjaEzAx JGpgSVLhCDOsigMTIdBIMjunG/UT/CWnIhHDPa6uX1gzRFyhLGJyxMo0cacYQTYJReo0CWm4 FGY1DWFFRXvKRBamvbE0pS7CcER7N9a3lrWxjYDaN1R4bL1qWa9HBMZ9IqtHUJpFJ118aXKz T5IUZHQlp/FmTOKp1teB/b5HDJdSOq2aja2ChfwexpaPZrStnUVLNicHR8x1rxkSma31As66 Tre+WxEIj0DtXcfWKcPt1o8arFGTeBh0rH5BCNHcDIksxL3EJC2sTdLYiavREoiKQPyW1bpE lOIWfVxGoJkTmdZXm7tD1s87VbMWErXLKSv9IVyqRJPAGXpLqtSAqXAm9dVMKM5nYUrToWgP Oq/xBhm2KUxUbZs5kWXQEFr1QztGBuZaKloRaEVgTCKwjSeyMYlpHY1qiZksWdIzv8vQ9iJS kjOqjFkFtlyLkpi2YrKpnngwO4r72h42pko/m6LKT0hTgi9h+kJcDRNL48nYyIRUMKFD4yiR aU2XXQwShqzF3rQRUPuECidyWOtnmmxAbQChCbSKDYnAOH8fWUNi1DLSikArAk0egXE0ItMi qf1wbsc/jJaqawHiooVdC2/di+xPLZZYiVYprViLCZLVDEVseneffKzdrlVD5jW0WhofhHol Mo4z94BmiAe8aip/miEm24AP1Nm4cbnvbQNVa54q1COqGV6M9UpkzdMAjfEkwyapt8PkKvdL 9pwxoQ4wF8sJdl/B8qocjSfUShhR1cPesA8qRtPSVMv87JvqsFo1ZqgRUPXXqCpzcc23Wqpf l0Sm+ge4Fv9ix46NqMYN0o3yx2C6hap3BCLaPtQ8dyAjl6JZAY2sLeRYRCCzRBbSvCEkrnJ4 N2K2FtCKAEcA/Yq7TZw+xoItYNuLQDaJrPZupHbK2qLMfZvU1O5abe40ThoVt1WW8Fpk6uhZ Qks2t80eatxa0SxTA5bqwlbCq1br7LUGP+suKm5wGGov0BydujthNZBNIrOqbxG23wiE9G7D 9ZAuTiE20ikcW6ltrDpJg6lWP2kXySCRqeaTuq7yB/UkrYyqrTFwk3lYpW0BwUgGo8Gex2EO irujP1YDlviazJyMVZWaTCfGbcsDpaTByDy4cCCOTm7dpA6H8JNdqbmmRFYP31S3oT9OiFSR AKzUNUDb9hAY/EdscbLXOVWkMusCqqIs2t1ezwAlXh9THQyoGCcIUx3i1d5eQeN8M8ieulsG VRkxNSUyo8ZskRT6WoOdrU/NrU12LFOPTei2MeYZ6DW5EVQLjNEBk3QL14pArtkTGTVRnG49 e/YpM2bM2mffaRBZt3btqtV//OnCu90W5otCXDKTJ/fNmzcfwF13fddlcL6h5IADDnrssV+v Xv2qRqLiRRddtnXrloUL72GNKtscKa5iVPjVV19evOQRYC6+6DIVT3D/1i1PPfW7VRa7Kv/0 aQecfNKphx12OJBbBwZeX73q3xct3LBxvcJD3onK/uVFl+L86GO/RkBcBkGFqwcecNC7a979 xYOLUBSs8gCNanGnGxzydtGihRt9JgQ3ooFKLZGVInGcp0074CTXPRRfeOH5FSueWrnyaWaA FMNslzGIw08X3oMikagmpJN5GNBaav78Bb29E5mqAWAOhhciE3onft+tLIuQ3U+5VCpOmdL3 8Xnng+f7d97OnABAPWHOyYjnI744qyy5E2b7GP6X0DzBx5HLPb1i2TNKoDTqUTOOPnrmMf1b +/9VxgdU0qmxqUXR7qv+KGoxQbfFbJLn1enTRadiJAH9/Vse/vWDGzaoXUtjiVvMY6qAI5/R q2qpPRTj4yORiQjYf6InT97pui/dcOCBB4PtlVdewvmombP+x/GzTzzxo3fccduzK5cp9RUg sti8eecB0C4wYJDFQMLFaUtkoMIEEplQFDhIPIB2EIsW3UeJjKwH2RZc8Nl77v3BTyzKif9v Lr/6tNPmAn7rrTcHBrbuvdc+R82YOXfumT/44Z2UkhS11aNmHMO2lEQmWHDVgTQ4OPCHPzyv Xd5UC05kpKG3d8Jtt92kKBcgSKiUmsiQpIif3Ovp6UURn6VLl3zzm18hcWLQVHER4aVExhgA e+65t1EKyIcffogdO/bY46gbqLIMo1m1moKELAYlyJ7BsOMH48ILPks9ipQgi31c9pzly/WM g3iC9IowwT8YbFkAGsOHjj3uoAMP8nHkctDw8isv/5+vfdn/s+RwffIT89HWg4ODnMhIp6ZE LYoqr/rjhz+EsOi2mE3yvLrXnntT1RhPwCfPm/9v9y0MBkdjy7wYcr0bbY2bRGb0npBfv/E7 e+65188X/duiRT/duHEdIXFFnTvvk1f+7TVXXvk5RhLpmGM+tH79+r6+vtmzT1ZHCiEmEpFu uunrlLBCpHB5XPl5b2ACToyD/vzTFyKXvfzyH2w/y5TFnlm54q677uBrEoJXXH7lZZde/s47 b2qCc2afBM2oLKr8/bt4EEFjHce7iy665Etf/rsQV0FCvkP2XLLk0fBwURZDCrvppq/xLwEG UzBx/PGzv/CFr1IuO+eck9kD2Uzn/cNNX1ezoc0ZJE11ED1jxtGXXHJ50DHodzS4v9shi/0Y piGRHX74kbnA7weNUH731BPsz7FuzzlhzklaqJknEXDGOacw//Rp+59y0qnIJt+88dtfuPbz Wi6bMrkPWYz67Tlnnnv/gz+H4L/cdTs+rOGX9z+CPPi3sl8FRz5nnu3ZYhEN+PdF933/Tm+a cvZZ8z52zrkXLvgs2BqfyzTfwovj6e0X6P18AXCtcCVQFkMXVxMWikhtU/owixRzAfeoHjnj aPDjFxXX2+zZc1x87d+ad1TUz7iy3ItLt4jc99h//QbYWTOP1WmyjISFixYZEHmHsxgoELz1 tpsBfOITn9IEUUFUE5VFlY+aMQvLZ/whzvt+thCXx9lnztMEteJDDz2ISwhZQ8OrRSQsZASY u/baqziLgQHwl7/8d3AbuQwzdy1MqoakMLLq/feL63mmJWLhCqktXlv9KnxGEJApNH6kLWTw hx/+pQxbDjM7peecoDHXXsRQDlkJqWSvPff6hK/TCt2E+cUv7wd83HHHB80hsDi4w3kQEVQa M6mAFPepyOceeHDRF669Ck2PcRmm1cTOjGmAahVzTGeamUbelQm4Mp4SGVUCVVCPOXNORm9T f6iZigEarh/MiRgDgAYpDzywaNmyJ7u7e86MuoZV2XrD77zzToiJjxwv0u7d99wV5EEuW7p0 SW9Pj0o668x5qCCS4+IljwI/Z7Y7TlGYMEdGiM4//9PBy1jhEuCdd34PlzF+NjQ8F88+W2TD H//47uBSGvA///nPcD7ttDOYPxNgy5bNteuh34+Py2VT1kZpa8WK5bxChFEYqP/5wKKnRM/p Pvusc5k5QwC5DJNHsqWqpWkEJpUYjxvTrsqcIYyB4eOLH0NHOu3UMzNUm7mq8ZfIEALOZRgF YMz18stiXSx4YID2d5+/lBdQiOEjs0/ALzCGCZhTAPNnfzYjKJgQE/h1CMjTj78cizEzAVwU MljywBkL8AEFAnHwwYciZdtmNDd+8yvaXJV+t3/98IMYueBHddasY4xq/+mfbsYs+4ILLjZS GYmpH3IlFuMQc0aqwKGHHgb3bDNE4EHFip4qUiOMmzaUGakpU2t7+OEHIYtMQRqosbCOjuJ/ L13MamfLnoMlJ6yOA3mk7DnEzDyZAC+9/Ae0CGaarA1ZFcO0p5eL1d7fP/8czqef5qQV7kbM nAqAGuuxfMVToO03fX+tsmza14mtaupLGN9rZFgDRnheX/1azCBh/IXflmXLRMdFLlu5csXM mbNwPRgHESE60aIhx6c/feG554qbCdqhJpqenh5tiISpH80cA2v2jhp0boyeNJ22Ii2p4Neb lloWL34M8z5MToOLd5ilYu0JVAzcgktgage/445b77jjR1jwwlQxaBfjtXD33nzzjZCV+KDC IGbOnJMOk/dqibTXXnujNW+//TZ1JgvSt7/93aDs66+/fmvgZgWxIUTI0Zj5YnWf5+zI+8j+ j4sbsiIGGH9hFIaxGGDkMgR25syjMdtaH7iTGzSdFLN69SqMubD6zvcNTpBrnY8veQyqMCjD qj/uFfCSf0z9t5jDsvqW2/4hXAP9dk6dOtUbQZBA+GUQrjRr6rgckSEI6gUWPyYfPu4jYMZO AhJ5/vlnxZjZ/XGLr6d2Tlz211x9nfpBFsOY5bZ/EqtdtR80UXriiaWkisYsx8vJaVA5blDi ov1c6BIYpJDuf/azhTNmzEwxH0/XXkFXVczAwCCK55xzrm2QqDKHw88+txIMvP/ghNmn4GcD a4ssRcPbf1/0U8L8/vfPIa81bLY1Z/YJb77l3clZvuJp3PFUh2zs53YLjOMRWdJrA7s0cBFu WL+eNpGhyWn5DHesbNsp1G4R/+cH60S0LAVxmxSmt//vx3er+jGvxLDopm/dct75Z9vlVIkw mCZKu+26G+9ZQ5bE8NMmgyWwq6++Dsy868IYXgQKWxywpvbEE4uDw1hstgjqZz079U2FD0GG +BiMK7XFUOwCu+CCz2qDxM+7t4NtwQ9axCh4/vmfxoiPNpTRciSWw4gTIy8MkZDraRMZkNRz jjjiz/7VyWxBlekxpHyzu/yHe5RImgMDA38ltwRK6yLOuMXJQ7Y4xuhuZhxOjYfWT7FjUcPT vWDRvjLQ1NAxY+7cVI35WIBm2FQcx4kM1cHKy99f/aWjj/mw1r+ppvih/sdb/xnzx//vy58H hm5fyvuYvnkfshs4temJKVZZ4tAvOdmRXhR33nkXTHAw5QxOAMGDiRumZuhV2o15Er/7h//W 09Mtk6Bzfw14ZEai8hlXvjFrwyLGa1gCi1xvwprarbfegTU1bfGR3LPN0xFhRB5twZ5kAqAu 2C2IFqxdG8ZfGBRjNWrFyqeR8fFLw9NMyl8Yo2k7rZDdMCxKlE3i+ClXGwd5MZQGgxiCafvO cENA3XsRR3M6nv9xnLjLhAlvOvHGSNU0tUT2pU9jfDVawbWBaZpxcoH95RDB/JEEke8wIvjM hZ/EPiP+3HvvD0AlTqN+OxK/QPQxsKSLzPvvv+fqYuWeiRdeeB5U40QYi1+4zFasWE7itPqG 7Wxnn3Myf6644hJQj8CGKcuBJTBQMLqx0B00Mj7W1HDNYxuXyknu8WhXJQHW2kKj1lLEruCk 4sZO+7i8t3vG3HOwDx4LDo/KrTCkWe7DGLzgwvOxFYs+Z5x9yt33/hBUDIuSWg/nx00GrOtj 8khstNaJ3WHYcaZ+/nvpErQ40m64tlRUdDnf8dFTRB3pFoePIAtaV+eOG+SUmCi6RSwSXVMi i9TeAAbclYOVv7/6y5g5quaOnHHM6XPPwkSSGFBEvntmxXJ1rxn48ZOO7MZ3rFQNzQbjOSS4 ep7Y3u3rvujr2EkLb3/5kNhkhAPbxzAP0oZ1GF8g6WPwQjMF4lTPGOhhWxkYIqOB8S/0a9vK sPIIJMZ0WoKDCezdO1duMQtu2VcdSAHDFkapmQz0MALCKAxjMcr1dCsTLiHa6DkrVjzN+zDI T6y1Y59EZKwSVYqb8l8X3kuCtH3sSWVTLuEffOgBAHQTIJGJpMxI64gwbobw+NSggbKTgdA4 1PieWiJOmF3ikRps4r/55u8tXvwonrcAcsaMWdhmAeDmW75FmYu2jz333DPB0GIggwkdLgm+ Z4dJFnRqnJhzUVv29U3lhSfmwRNwPGUzioMTz69o00kWjwMg0WDjKzbxX3ft9UuWLH5mpRh/ YWUNKzv4ccazTTQZoe1jYAjq/P3zzyJPYdDEC2EaD6qA22Fx7i3SmpoqjiWzW2751rXXXn/D DTeh3z/33Eps8po0cRI2uOBxMeSI6669SuVPAeOWpbqRjWbiSO4/+9lPVG0qj4rnFlSRKoyb kpg8YsII/3n+Tlu66G6AygwY46aPHD8bmY6ngVhcoz00KmfIA5i87AV+VGfWzKOxHIaxHk9X KVH+Sv5aqzphET8buAnwj1H3HFmKnrrlIgPiWUv3sarDDztCZcNQFEkcbXe7HK2zSBMC4z6R IaYYIKxZ8+755/850hmHGEs299xzFz9oibyG0dmD8gFp5iEAl5zcdO49roSixoMiP6mHrBFc e3rllZf5GQ6jODRgRhaeyJANwYa9UQE2Z7QPPLIDHhnBzA4fchId+ru338abNmhJ5f4HFmHM j8ORlDAGp3gECteGLZGBi5bAJHvYCb8fyNdaTfFLcM01V86ffwHwTEKi+e3SJZi3amNhVzu5 SWcXZ/lGhlWTLDQj4yxceK+2vhlsHdLHLWhRn8OYl1bBRNpyPcL2MUT4gV+IRwhwqE87oecg kWFYpCQyQ8/BD9hrbqYQGqQeOmmLbtjV8auHf0mTXDAgRWKaiVkkZ1VFNIdtZaefNvds93El taFVNoY1W4yXYXGeD8UjmepTmag4njQIvJKARRMBkQ7q2lQBNWgen8KRP+fsEz1CWkhRmFZF Kjmtelgpo51lWBezXDbCTKJXI2kmFDd9lbazKRKZgVXMQQ4/XGzlfeutN8LG/P5EFse+r1Zx BEw8UIKnkUDZvGUT/5aYGFWc2XItgbXJGvE60iv7HFMTmeq9EfZ0GMkBpM9SgBqOqEXWrjlB DbSnOwOSJgdj37UMaPNcLuaq+GxTicyrXCiUbSILCXGoF7UQE9jUug9Lanj2xoZnhkhA0cDW IoWCDI6aWlTYZI14HemVhSf+UtBbM8aTMtN1rBI6nRRZrkXWrjxBDcY2kWUztaTq1ieU9iCP GWXMK6o5kKC3jVnMGms4i4hoQY41uK3RriYe8KCxQRTWNBc0B33+aNvKFJqmRKFkB477u5bZ haKlqRWBVgTGZQSQX9u0HNuI5Dl2sdIqG+6IxsxFChEXw5XEoQZVJWwFI3tQaxxfMuEZQ9Nh /tvcsuHDdAVomSjRtGo6jc3MIomYWSohoLlQs013lSdy5RGGNWOa560RmRaQVrGJIrBHb8/u Xb63MDWRcy1XmikCWSYypEz6NKCCdTVkUY5fBfokrh9HxggE1cVkCwoqGPaWAYU4HsBDJ004 573XJhUqY+xsaPy4pRrgJNsC0BwHh4aAsXRKT2QcrLF0qslsU0y40ZrMuwh3GtugZC3CpTjk 2ZN3/MTLy3d479VcV3sc/vrxZFal+rlo0jxO3TZVJRZOT2SxhFpMrQjUMwJn7Lrb6c8v6SgO l/M7lEv4BWkdrQhERMC6/QIZHUe6TkSyqcWl5SxP7E8mSuNoi8OT1BlNZ/KmIQlHDX0lV2L0 WnPNyBMXec6uu374mV+2TeqtVoubtqzNFzPyMab92FWJwxiHJ+hXnAqrmkP4VTYYCuEMupEU Q/vINItJlYTwB51XbbVGZCGha5EaHYETOrqPX/lYvqc3P4S1sUp7sa08OtJoJ1r2xmEEWonM azQkePp4qBbUwAjM3n2Xj779YltXYcJQvlLIlUqlYluhPFqK70KWLYgBAH0U86wfQPMcqlcN dSxDw6QqYUzV9rFOLUknxyU4rotjlMTTydr0s0s2hlB8Al9cQ3mScYuh6qN2u0QIJyGzPzGr xPxJjDSO95CpO5/y+6enFKvV0oSNXUPFkUqhWCmNlgtO+NN7Yqu4DU+Wwqk2b9JJadqMSmK2 sqZKK2qaM9HJJjTljI8DsCeplUQksjhOtHi2wwh0d3VPqJTzRaxgic2M+Vy+UKm0l0v7dHR0 b+r/wyQMqnJ4lJeHuEhHhYLspcApjwpjYaVcyU/s6Zn/3ju7lUpDXe3lfKmrXCjlq23DWOdv 271YGeidUMWaP8Tzuc3l/MDQ0HYY8FaVwyOARBYrG1KmZNZwpRq1FllWlS5Vp5NiowTEURKH R1ObVZFNx2kdZBy3Uiznc4Swkaqq1er+ueLUZU9N7imUcoVcd2dnZ7F3eBh/oaQ4qWvP9ydO 6t7x0KlTqqUt5Uq5I1cc2TpURTKDGDJXvlIpVKsVkeZGuipDpcrkNZ29hcpoT2euXBbegKcw NDHX09Fb6F25eMHkLsw0cyWkysKPpxw40NHh87gJCuZQZupY0ERkG0Xa13W6++wjBevF4DoQ udE/4EC+eOCB0wJYK6KW2NUia3UoMSGFFylEEruViUAcRzUerchu2PDMUCqX3s/nDu4obnh/ VXux2DYwWBkZKubbOjqRjTp37Or+YGDT5s1bJlU6thbzg5ghVivDI/2lyuhoeWQUoAT6IVIq 7Vbo6KxUhgr5shjBVSv4j0FbpW00NwzOP31QmtJdLAxuLowO50cGny5PGJpg+BMn7FhmQM1T 2sw8sSiKbCOSi8mWgtniVxboJE6DF5/W1FLEXf9pyqIttnkdI6XSQXtMr65/+63ScKmtrb1Y 6M+NtnV05yu5zmp1v+5Jb7d337fbns/mS9VCIZcvlgsF500veTEcw4b97o72c0vlqW+8VurI t5XL1XxpRNyrFL14pFootpc2rhvYOOvEuydOmFxs+9jbz/W+/TJGcvUNrP0SSmA4Aau/Nnbr fr4EJc2XMAsaTZNMYLNmVjatuWRXrCYyEmIdBiGmxdbvKWFZRoUrCfKzYHIg3JRPH9tVZmE+ Bq3A/Bq+8UXyJLyqmrdcDJcy1gUiPeXKQXsfuuqd19o3byl0Vifku3p6duzF25oL7aXNW6dj zvjBhjXtHS9hsGU6dtlh8qyN77fnq6VKtZSrlpGkMA7K58rVXGfH0KZ11ZV7HvEClsc2btic y4n7l8VKta1o0uTD1VIpKHLnNz6dtgLbsjHUD280naIdVQ81nTVqUzUngtmu5k+Iktb2i5Dg tEhhEcD9xEpleNPareUT5w7NPiG/ebSzUhjFHDMn0lZ7e9tIbnDKpvf/qn/g4xN26pswUdO1 Q2/v/16D+5MbMVhzSRipiQP9GH/X45nOXV/ZdY+SXDVrb2vDlFPcMWj6GZ9bl9Z3QyMQTGTo RfQJ8wOZMn6ytCkiJbazTSoOnnXGYWYektKKQBqPdCY8VSwfAnjcCSDSl0BAsmpS7FSIHsFT rHaOVFcNj/znluHNhx07mKv0lkdGRrD1q1zs6qnusEO5u3fi8Acnrn9nbqmys5LL8vn8hZ29 U4bfylV7c+6rRaEQBxbI2iulF7d0vnD4oR9s3sQOQEQM1yyJTPOfpEKQZIuVC8DI7ePwCsTr U8IoH9YTERbkLd6ws+uFo4N0+nREFFQv7I5EKHHImrfxhLLlQtdQPyHKg4kshLlFakXAiwBu QI6Wq6PFgdHh0ujo6GMTe9+bdtjo4ED71i3Dg/2V4YH2wVIBuzIm7dhdKs3d9MH/fOudPSY6 7+Q5eac9Zr/0Ev4yebvYVSEO/HjiNuZwtTIx1/mHdVtePemMP32wgY1hINZRrWJUJu4EtI4a IpBlpqvBjaxEeczVSmRZhXR71FOuIJGVCvJu+cb+rb/bacrWibtWhgaroyPlNrHZIlcp54ZG xRay0ZGTOzrmvb1htwkTd99xx/kbNrRN6Cjn27EyRoHDBdZe6JjUlnt/YMvv9z3s2Xff1gJa wPiv0Ib9ahq+rkX1sq+robFSvg1UkKogfg/xMR08x+Ssp3NxFHRCE5WtzsPHMfA/kUliThXM GHbCIhPXJlIVLLnHO++vXXzknw1UCvnB4eHKcL6CG5G5EdzFRLIqdhUL+aPzo3+xrv/vh/M7 f7B2uC3fVujCKAx+OEd5pDSS+21b1ys7TS2XMfryPBT7z9raqx09DU5krmf279BAa7NIuxYD RSimyZ3SUT1rHmSQZRRzEcD4NIA20/SaLY2ydDLUIdQz62no7xtbbQHbSgREhlHXrZ57950n PnRCtb9SHh4uF/P5Etbuy6PVUqmSK1WLnR3549pKe3+wfms3XjPWWxgoV70OmC8UB597b+ub R35k/RbcpfQdFZgptufaulVbPo5WYfuOgNePouLg/TwGOTPI90GlqTApPOFfLcVggyrLpo2A 4k96kDXHUZGIGSvv5UoFW1vzYk8YHSJuv3tvzWsfPm54GM98iw2ueA8PvgpiT0W5rdpRLhSr HYUiZLFXrB3IEtIdBm/tufa160dfnnn082vekmMxV6X8xlpbtVjsnNzXs+OOPoK/QP7zL7af GLGaz8vKmpRWJBMaUismCqMmG7PIJhiII8jMBMQRCeHJREmI/kQkJ5FlW8NEHmwvzMZm52vO CFBo1LZpeLCMXrMX2Itfxt5W97aj42+1ev9g/3Df9MEtG0UKK+eQqip5Mc2sYGcsdrpW8+1i IIcnjiptxY5KvloYHRwu9S9r2+G5NnVjI9vBIlsBM9TqKG4GwCPnyDgw1ASu8ujvkNBwa0Zr ScuhmVBjEeJYqDVNRyivJGo+RAvYOVhVOGBXEH9EZtfRomyvERCJDHcb1XUyGYrNAwMP7D6l 1DmlSs9OBuKDa0YcVTylWai25Sa2tT+/uf+VGUdu2LKFKNoZea8dk9T+D0YGBzRS/YqOk/Uz 0NyaE+e1Ma2Os9ivtRnXIeCbljB9dLuUj60ehYBp9tNsjfjNNAs2YMLCp6H9YolWf3Vm1CmF 364/FlFzoDRmfyVcjdId+Wikh5GQ0Pnqe+8v3nt6ZWCQbgcAZTiwiX94eGhkaEt/6c29D3t5 wzoDj4tqz1U6KqN4s4+LsH7bvDULxOOOx+Usz5sNua3HqmoEfFYCK/GkXPAYzUhhpvhUJSwI JYp15d5NDEXm3hdD0M8CH1ojMn9IWqX4ERC9EFu7MOnjNTKf8JLNG56cNj0/OtiW6ypiv34e u8GcQ2xsreaKuJ/ZDhXtL5ban92hFytuPnl/oZovdFbEg5ytoxWBYAS8REbpOcgRijFn1FSq Qu3YiQFb5JJdQKEEZBVapiAZwrmWg5XUx+0EceNa4BU9+AdJ44Hl8191da+fvPdIbnik3V97 d48+3pyB3PTGbj3vDkXMGUUKRNI0/eJzZNLUQQxZxO5xYxXiI42Nwo4FqORpurPjlF255zXz eCgTxGwBP03coThWFcqVPdFLZEbdtVfMqHa7QGqxS3eRaZHKRImmM0lRrRN8KeN11KUSkLZj 09at/zl9j86RgWIJ4zaxiQIHmHEXEnlJrOCXqu0dbce/s/Hkvj6bEuCFlMhjGAPCbC0z7IAR CqnQGu+gEATrTHri6Wgol9ExrgUBMRxSJSLYjRY1mTg8mkhoMSKRhcq2iNt7BOSAzNmab4vF btVCfqTUjzuXMh9RIpPpCIhctasLD4rvNLXj8GVLDpsclsvAjZcB2ay08Nt5BPREpuZdwHQw 0kUEv9HD9E7GUgwExVJj0umMkqJa6BVJ5qTfBq2DBmKTTKWR22/HyGJAJpKKZMa7d4ZxY9K/ /UK1useOO5z0zNOjPRM7sQcDAzC5SibfRoZxHO54FvOjo9VC20il/cCJPcf9/smDdt9NFWcY w7c23N7M47knnzHykNm0YgTexM1VBkAHYUTPkFNQF+1S3XVuHS+HjQqSuxYBkqIaM8EmHAQ1 VU5RY1ZMC1BdjwesH64w1dEt6VxcBkPkUb+ebzStJzIjUwvZioAxAkhG4jDSJPKUYne1srVa wKutfX/VTYpJUQjn8R6ffKVYPKK7/ZDlz+D1PkZ9YolMfIzEFnJ7j0BEIovMzf748W+FH+2W WBsBLjrBN2sIyESYDvDXF2H3M3u7qYMZ3xWjCSDFYpX9OGLXPQ7+w9NtnT3dox2FTjwf7nLj WXK5XIYTZSdkKNAmFvPHlPpn4ZlMOfPUFDucGraGIizSJ46OmMwBtkZ2S7YlAPYkfh0Rh0TM ceLWMJ6IRKb5wdHR8NtwMX2VqV81a2gsXZYvhjC/WVa83QLvt1B227NYR1vbnA0fdOfKPaOd 6zoL3fjbI5hZ5rCrv0C3OfEnkrDmhVdew6TYuF8ojra179DXc8CTT83YRZ9gwiL+KpNc7WcL 0UBE27lJNFpRgENolpPKAMWEYD80wOXV0Fx08gqXFUABw39NXBv+b55p+tFuKYZ2lcUVG8vv ZIlsLD1t2W6yCCABlaqjQ6ND4poOHB+e0rfvn14sdEwYba9MqI72iy38eOASCQlQsS1XKLXh fbLVYWRC8UR5Lt/VVW7rqJZGDtmlZ99nntzZ/0wlZqFtZfxVgHa6axmw1kJs7xEwP9oWGRXk YzoMXVgQNDSzO1L0Zcb6WOIUNFsGEc2QVjQIjEMUVyo6HLFqR2pYq5DhAtGQfTCaEjv7AyZ7 urs/8srrpfZKB/WEfK59JD/SVu7sKuMPJr24pb8ysfegkSoeN28vtuGdZtgKmx/N4dZBqaOt Nzd66NYNb36wbm2+HXNPclY8HoAJpzvlZE9iVUVjYuGA20zxVVZiVZKmT2VWSFK7ScyEU+Si QEfc1aJVgttCW020PV/B/DArpqP+gxAOXrOkcILNRhQaJC2oXFGQAdgakWUQxO1WBeaUSGd0 kahBOHnypM6Nb7Xleyj7oTeLG5bthfZ8/rWNmxfutdcdU6ZsxCPj7XiWvIQnyfFKfvyVuMLQ KMCBkZGpPe2HvfzsIbvsruqUecx2vaiMLXh7jECtiQx9VCTd1jE+I0DNZ29BJA76mKuHh8ZL 4q6lb2l5px13OPDFPxQmdlfwt8bpwBt8iphYVgc2Dj/SN3Vl/+bXN216ZOKOQ6XhAl5RVq2M jgzjT8UV8YT5cKnc0V3tmog7mFNfer6ro5MNY4EsZmeNqBQtjbmDO9YfE8AQRoxibBmVbRPg V2rC+TmSlzSDaAn6iMsyoT2qmjpG87kTqpCJAMxHSNDMAsmwMftG0phoTlAlbI2vMccs1kNn TNNNzcZdqgFe4g+4jWB6qbwdEUaP7e3q3bA2X+xsw3RRHljUL+Hf0Oijo6NLJ3TShPHxns5C 26RSFX9AvFREN8xX8dxloYKMh9cwVgs9XYeve2W/dieRYTiGGwVt4h2O7myzhupRiGIqSMTs 5v1su3pMT8PZxPXCfSNRpVgq3EA4NRMlISbiJrIQFS3SdhsBMRrz/8btNnnK4c8tq3aV8KeU sHuMIoN1tN5i25vrNz1xyP4btvYT8u3NWx7Yaef8pg1iDOEd8mkkbJnt6t5jYvseLz45sVPm MjHsk4d1LLTdNkKr4iICyRKZ3m0Tx5CHUSpg06LyBGGblIeP7S0r92S3N4hiZa+1L0QeM5bH sE6Gsnt8CJskNq4vtnd3VtrKWMeXJDyetHnL1t8cOO3FDeuJETkJwG9Ght+etAue2HTzGO2v FaVSZaize/JBg2sP7eoGp/POCyFUw+H57SkhXJDizdE8XgMUFAwysYkgScUINvc5gRBAFQnC bIsB54fGKRvaERTtcKxrWPcny9McYBhDRLJENoaOtkw3WwTQoStFbAoTe8HItwN27tvnuRXV SZNzuQ7xPDh+JjGrLJTL5dKTlc4n290lM1wSMsNtHB5e2rdrqYQ/Id4m9pRVBuV4C0T8Mbnh odHRvXaZsvPKpTt09+DP9Ha0tbcXOpvuj480W6tsr/5kk8iaM0lvr21a13rTT7pjopwvYF8r b5KYOTxSGdwo3kldqZYL2GnRViwUOiq5t9f3P7nfPh9s3cr9hIHFw0PrOvsKlQHxN+XaxDux 6Ye/o9hVHtk0WB7ZpzJ00IRJIvHhDukoHgkIqx2ptXLQMr+VXBvBZNuEU6zw8IgBhWgFmdnX FFZ23Qe9bBW0EkgDzpYjzAI7H8Zk0RuKziaRhZqIJHLlNCBSsMUQFoGsu4puC62FvazlkvP2 i2m77LLbspWd4klJp48XkH1GS4ND+ad33/PFLd5f21UVbR4e+q899unq7y914i+SqNs1Km0d PVgY65vYsfMryw7Zdxr+9khbWxteSJb6oIA4ztm1MBsBdkaVwl1XRUbAqQz5Z4oRFkLI5LDD wJ6ECDCJq5okPizt+O+VM4KaIZFlVJWWmoZHAFmsVHKsHjUwOlRYX3FfhYE1piH80aRc9fnB wWd2ncyjtqCPj/d/sHrKtFx5C97Kj8xFDGL9X2w+K7aX+nd/b9VH+6buMbEv3+auugW1tDDb dwS2r0Rm+Q1J9IO0LfeXpIEYacNDR/lRueL1+uQplcrESrFfvMqiUMWffssXR9YMbV1+8AHv bDAPxyiUgyMjj+57YGnT4EhhKx5jkrs58ABneRSPLmFtLF/s6yq+8sCPtqxbVyrk2+Bi4Ih2 mzgCggaEuIcq9yn4aUIB7SDz49OU3BX9NLIBGe22QIDuIPQQOWUeXZnkLH6yKgqUnPS7g3CT GiPOdj/ByBwHuX0lsjgRafHEjwD+lPhAJdeLHp3LLX/jj6vnzm3fiue/q8VKFU9F9vS3/3Hy 9BXDQ5EKF7/9xuv7HdE1JBWJvVjisSc8C4DvYewf62qfPLBh9Xuv93R00e3OSIVxGOiCjMPZ 4kkRAc53KWRTiKR81tJmSfRouSnQxrDt4525UdNUtG5NAsX4uyHFCYUdXnzm6LcH2nuKXV0j bZ3t2OPaW+gtjBbf7u6oTiyc2tnb/97aSbnh4qZ3xU1MmaCK4k/0imnkQLGrc7hjdIfO7jb8 qltil6/s1J5/bevaQ/p2x03SBJGlukMgiVAC/WBlE4qYCaeQ6wpyTS1OEJq5HP+9ssk5oloU mgR8ON2ij5hZIWUia4xzmdWypSjjCFDXzrcPVkaq5V0+eKNnx048NTny9Nr13b07tU8QO/47 O4Yndk3OD0zcuKYbmzHWrMMZqUo8c5nHbgvcoBRK8qWRnuHh/Lrh0Q/Kpa72jnxuBJv38Td7 R0Zy7SLtFSt5kRmLxXWV/rVbthTcJTmqUJyLS/KEX6lCGauKZlWY65kjqYrJzolqoah2Kk17 ArUI2HQyXtGTGCQlmsXEWvCbmkKmJdKKACKALviHafu9tm7DhGI7HjOqFvHgZbk313PulF33 3bJu4659P1+7ufRBrtgxIbd5sL1z1/716+iVDG15vLRaJCTs05i8x6477b9LTj45vuZPfxxa u7GnvdrdXjhgt+n7rl3TOfxBf/tQqVycUOztrWz9j862rbvtnBv4oBX/VgS0CLQSmRoQ/o2p 9ReC5VmjaqaRMBab6HC/YxmP8zuJJf7Vg5sLhx806KrE7zn+ptt/7bzr/Nc2vFbsXL3DBIcy QezOz+2yg8voff8J4Gb3r4v37VTt24lov83l+nafPHNCzwEb/tT71iubqxvKI7k1u+z9/qY1 YIiOqsORoNLO+lwc5Z779YHCqxevTtTugjdcG9WAeFzNLOEiJBNWLOmbySSLs8R4FhkfG2CV PouxxcFYPODAaUn4fbw2qza8T7ipC+O/BoHwpqhSTBGNbcvw0H6Tdl3R3rZ+eDjghY7QZFXy YKW6amjkmWLve1P3m1js2+mD9/7U1bGxa0IpfFOsqoLXxkLM+PhDC2YlZmyYouQSPm1JxG28 ZnwAG0AIR4xIJlipsg7h1DDlUtx4Ip3bZiLjBG+seQxkZMBj6GgylhRViimiseHvV67v7n5r az9WyiJjoMkG+bEBbUO59Hxb+8Zph/VuHF07PDLaEXsaIbby61detE9BJwhj9tWMNesIOKOz pXAu1L4ghho1S7tY99vnphHJHIIaziFZbSw2POsPAiQSu08EFWzLGOpQIkQc2RR9bFuOkFI3 JTJOxN7cskmGjoNH3AqjK25AuSTt++Ut/bmJHRrSUnTsxldu0ZMxuvH+sEWtJewVI0ZHjr5i yvoklQvHbstAYYeJFtM0mFv7yAzRbKFaEWhFYHxFIOWILH6mbKpwaD8aDfCt8RYbUKlwE9qP qsKcPhh2nYp6gHLBWTAn6aCk3CbBd0v8ltylbz82ZSlu9Uzqw713JbyVeL8ts7SNW2rjgPDt ETLiqZKQp8P1IcW331lHgbGlWiOyFOFtibQi0IpATRFAhjImqdRKU47IUttrCbYiMFYRyPbK GatabEt2tRYxDrVi1jdZIou0FMkQ060a2cgNLUzJdZICp05ctRRqa5FN7nZmElxT9j8L1ayM 1Vu1RnM4ojVM9KwPRlm9akZCMFIc5hjukrQuIbACV3XnkBqDN3lUrCugMMxFTVbQ0h6skxVA eWtqydFoAa0ItCIwXiMQd0SWYUIdb6HiH4AMYkAqWGMDQpGB0/XyMiwYUSEyVytKKqwmtciG 6W0mGtfRHD6rqw57oicxNWVsmvAJHdCUGYpxE5lBtIUaFxGgHpR5x/n/2fsSODuqKv3e9707 3UnISnZIQkISIEDYRUEch0UREWR0xm3GZXR0/qM44z7KjBs6Ko7jPi6oKDqgIAICIsgSQiBk Ifu+dqe70/vyP3c7de+pW+ur9/p1p96v+9W953znO+eee+vWrXr16uVD28nOASFNyGbGSzUm h+REVFGrkaOMWGgQj6KVMzodWrjdBIaUTmTupKWSiZYBnz1kojV1grbHpwfFHOd5jQzU+p9/ fhDpD8sTbYbRCvNM2pJhANFcB4X7pc9/bfmyldE4M0a/4fqb3vvuD3Kawjdcf/N73/0hMdxE 2WfUqlFpRAB4uPCM9zcZunyqwEVz9pfjkFh2qEuZrpChmAyi5qJUXeDmNM1FKEhiU9Jow9Q9 J7IwxilmAmRg/vwFdbV1OW5ITXXNrFmzhVNXeVaOg0ndTYAMlLgn0AnQquw0AQ9CLGeYN5TG cJoIiZdfJPcC5JVcpJG/Q+DjK/a8SmSEYHDohk63AEo7sSG2yIlxEADK9QKxCmOimwM+5jWy qJ50r2k5zYBXBh586PfPPPuUl9aRk4HvKKKUEiGxOcS9I2sebF7jyUSsZqCihq2QxIihCpdj AhCGdlKXbVxBzIksrrvUbhxkoKmxecniM0Sg619Yd6z9qFfQp86eO23aDNDu2bNr2/aXvWDh 5V4k4Gg6d7Tb1xHC/MMOH0+KHC8ZCJjIyNw6Xlol4sTg8VhC4hcALy0Ba1Xj4BKXRONznUpF D8lhw1Y7otAlmMLe+fZ3n3femqPsdaS5uaW5uXnz5k2f+NRHxXQG5H/7lneefvqS7//g2zff 9Ba4vrZnz26gnzZtOhh88Uu3rX3uad3bq6/86796zV8Dz+7du+C9qqrq2Wef/sYdXxEY0Uy9 sfAhwOTWyV/6yn8AABwtPn3J937w7Te7HH3hi9yRdj//a6786+tf/0aIdtPmTeBl+rTpUADb Z8149NgyK6uL9vn/EYOeayjbxodshGpTgAU2mVOJm8s8iBmTgMtvB+id7W1DUIzF9tKbEjCR 2cxT2cTMAMxin/3M5ysrqz5326f/+OiDopEXrrnkPe9+/7/e+sn3feBd2GyYkj7y4Y/BTPfu 97xdrKFgKfSWt7wdhJ/+zMdwLoNZ6aY33fLLX/78W9/+urC9YM0lN77x5m/e8T2YzpBNL+gX /kEOjm7ljv5Bc/TWt7z91o987FOf/tjadZLkhutvuvlNt9x3/+++/8NviwkX4nnPP7z/ox/+ 2Cc/87GszWV64Gl5jDOQ408tYar1+RvjXOSPezjU6H9hAkN8GLAVc83Vr4eF1Re+dBvOYgCD 8ne++y1YecHUgFaw8IFZ7F8+/AE8E4TCrR/9YE9Pz7XXXi9gMGfBLPaDH34XZzGQP/Log2AF trDoQzafgnD0/0xHH+GOrrvuenHchqkWZrG7fvlzWMfhWTDEAzPvrt27PvA+uLEjfYXNgNg5 w6IlTg49smNHJIkDR49gDD+CauwzpBqH/qS0wbyN39bPnn3q2ueexfUUNuT/7v0VlMUlKhT+ 74++j7MGCh955KGFCxaJ6uWXXwHnpD/56Q9QKwpH249+/Y6vEqFP1XCkRu4fNUevvPwKOIv8 b7Xo06lu/+oXYCqEs05dmI/lDEaPSknoZgkDK9wjDE+LKL7hBFP/k/6RwdOHNVBDKKLO8YrM iCCt5FUG1r/w/P33/9YdEpxyEmFvby+srYgQqpu3bKqs5D+YVFCwfNmZT/7lz24MSGCuFFfW rFpdCI705SGqQjrauv3l3Xt2z50zDw3TwkTNQFLXyGBGzfxFSGCqTeaFRMSBYPfXekeAZEjA sKKCOm/zCBrDQQS7aFB99YQf/02ZesolF11KiODKPZGQKpxXguQv5kSm52TDhhfxhlhiq1cd R7qxhoDzSqh5zZigCulIowxVxB7xiMuXRF1Tx4vmvmi70u2XSDDCAHsbTgam4hQMhB+EjqnQ yR+Bl0Aps7v3+BqG6dEwdZwZYqwkNZEhYVoYrxkQH1meeeZKXFXBggimkp07d8C1sxitwito btvuE91uYWzJf91+h48tnHj6aFPVxMhAOpFlpR/x+OE+jmXFX8ak4iNL+JTwZ7/4KaykyBx0 72/+EMND8m3HtJrRfPa2T5sCo9bZ1WnUI1bEfQOsLVbvKLS1VihtGo8gQhiEZCMwDNPDsU2M NoRLYVEsgbSucOG32v00YYzkLR3cPUxk6D+MbS4xIjBMZ9ZdC095m46stv/yy6+EZddHPvrP 7ov9Mfx28bkDzvusV7iAEG4Qi0ELJqR3xCQF7yRshJ25bOXx4x3xfIWzyvUoDRdVMqhYbTN2 WLzLjARkgIguTnU0vdgfJ20TzwZu4IIL8GQ6EM28KvqnfsADp6XLl62wJgouwMH9HFZVVKEI GD8qdZvDrWSXXvwKtzyVTLAM5P9EBkcF8Ze3mc/z8DLN22WXXh6JQqQDbnlds+ZC9yeeQAV3 tEYg5HTyk3ubGdwy8uorXgMa4VfvjDdefxNc73s6zJc3bcwTSaYnB8rOS8+XIzVK+m0T1g8o KDmvKyGsvcgfI1daWjAcB1VEYAKV/xNZUGtSfRIZOHBgP5xaig8Bdb6P/L+PxVs9/finPwQe +KoAmcvgi0dwZwas13QvmZTvu/+3cLMYxElI4KTydddeD1f60zv7SWYmZPXkutiPZ+ZwQEhf egbgrtczli775w99BM4H1z73DKjmzVtw4QUXw/cWv//D78KMADe4wq0YP3Xd4KqT6GX4uOBT n/kYfMHov+/43qOP/hE4gfCsVWfDdPmnPz168NDBsJfJsM90dq0Ml+GmTj0Fbu7/8ue/9sAf 7heX56AVF6y58MjRIx//1Ec1rFkUzEkNhRhs6Jq0EasIMANPviYcoV9/BwjzCE+KTa1YyqGp v4cY2uL582fFMBs7k+ylQrYJHIi/uG00IsyMKm4IUewqK6vXPb+2vePYo489PDwy2tbatmLF qkULT2ttbXvq6Sdv+49PP/X0EwcPHCgqKh4YHHjxxedrauo6O4+/8OLzbidFxcV9ff3PrpVf gTxwYN8DD9xXWloGazpBuGXL5p//4qc/+NF3amvqjisS//J6m6Pi4uJ+zREEs2fPnpbmliWL l4Ij+CsrK3vojw9+5nOf6O2zLP3MXcz+aaS7dVacq3+N3reQaCJhywwiGGn2yRWl/4hhhITr 5LwMbz5/EVolmOGkEv4Kr7rqogimYw8VwWcaBxnKVrowGJuhJcK4VDb6MZVZ2qbFk41mhueM iVQ3YfqbM6134x1b2zUkR6vlSi/ajLjeZmmT6WRxyrJl3g20ksq7H6w6TShYQ6/IIrRPMJcU jBYXjCbzhNgIzrUWxiqiq4hZj+4MHaDLcBwCjtbMCCsRqcI5HCNUVtuSVfIsJsx211lSvZ+9 nEhm5UDeoh+UJjL/es1rOjkxIR54ojBbRGmpArNAw/1nyVzsj+DcEk8qSjOQaQbUPpgpT2o/ vjIA/S66/uS62D++OimN1j8DuZ68hL9cHrSFr1y3U80NmP2QTSYwa9hEaJoQJfr3KSBBYhMZ MqLXGGGhbYgC0rs9h7AeIwjGitGPUSAx3Y7TsGO2VjMb7x2nNSW4SHoZ2+5vGc/KnzO8NplT y/D+UmSagTQDaQYSz0BiKzJ3ZO6JnMzZbpP8lIiGRAwe4e40sFbG4szP9CQZFWYtSVLFZSfH Lyrb1co40hb7PEHOcAHEc4jxWp2MClIFUlsr1hHar+urz4glzivckD4cb+wOjPSVZmD8ZcBr Fxh/LUkjTiIDWVyRJRFeypFmwMlAOnk5uUhLZgZyOpGJBWMiw5EsUaMvRc00ZLEmmmsPMMGE ZLEFOaFOZFTkJFKLE+zdMWxFJq69bLFdrM0KpLby+oiBseTGFOGJPBE7pFxBqgj2dpaeWmKS 0kKagTQD4zUDOV2RiSThrOo17eZnLjMLG9uKNPnZylxHhXnJnuMcuMhe8MDsH7+/NsPACLl1 7IbBBIZBSLzw1gAEeAwmMq8oU3maAZ8MhBzrPgypKuEMYJf4TDAhXYZkQI+Klgm4bTqRqZSk 2/zLgGvc5l+I4yEi/zTCPACAkDNJXjVXDzvgS+P+KciwVSJ3ibgQJIGdkYivDFvtNsew8zM8 d8CJSLLX2OwxJ9LwpEiiNRMHmdV9OC6CciiFgtcJBr05YBRFL1jvTQNm+Esv9kdPZ2qRZiDN QJ5lIODU0mse9Zp386x1WQlH5ORkzkBW0poEadopSWQxLIc121FnDC982CAULmAiU7B0m2Yg zUD0DIzRQY9NMaFnCAG2zkqyweSmTa80EIrQAXjxRZKnE1mkdKXgHGWA7BQ58joh3GQjdW7O 3E5TwR0TcyJL8EiDGXEnKzh8E4EMyGnq86HmFyOGjaB8iDjZGLLRtGxwklYzF9g9ROd9q5cI zMvOeukaub0a5SWXhl7OkDdGwYvTFooj4yVm6mXOI3HwWmC+FhpOK8acyDSGtJhmIM1AmoEx yICYBMX7GExkOAfHmHfHIFupy4QygP2eOV+CVJkHkxuGcdpkd9hZ2uszmshITO6gc9PHbi8i EhKeG5ZK8jAD+TOK8jA5XiH5n6V6WWUiZ92k7WCs6NVz0fdGLyZrwACGv4wmMitvKkwzkGYg lxmItNtnKTASgzbFZckhpR2DiSyRRorHgfD0efJhcj0RNBsR6siJXiIYp1BXBkKmMSTMRe8t CGKMuNjBceF4DPLgIEUpGr6QLYyimVCHCdRZs0nTSUyi6vUYn4xDGIOJLOOYU4I0A2kGnAyQ GcNR5LBEYiBzWg4CGcuJTM3Rspmi8SQjOUhB6iKrGUikQxMhyUYz4wUWzyrz+KP6zdl85BVY +ACSnMjQq1dYmfdEPAaMJ58iFEFhREbLhBTDNnRpJakM+OY34hlllJjsfR6FAc4lkyCJ5jIK mqVWixCK8AsmTIA517RRiD2xSU5knk5SRZqBNAMncQbE9IWTmMhE5lOZIAQe+PN8jA/xGqkX MER/EgFDDFpF8hUJjL4iWfmDSSv8wanWnQH/TvHXutliSzJb4xiDN9mYM2HLxBYyaTU3mhou 3WAC6TUMCbWhc0gJylG4SumKzJWSVJBmIM1AohkQ8xGZlTzmrpiOszuRiVhJA2JGajPDXGTP hc1tKss0A2PZX8p3ZkuwTDPgtldxuTWOBDCFHncwOKBxUSKtIA/YwB07dFs8J7Jsz0HuCEVH YhPC9CsnIXZu4lSSZiDhDIQenAn7DU+XvQgJM+6w4WPLBjJ9Qmw2sppyphlIM5DTDHiuyEQU ON2SaTjBGBNxEeZGf5+YRQzZa6O3a+ETc2AAUToWgRmRxKtkEnYmtu5oDTZMqxsXQmJQMbxB 59IajJFOZv2pDF6tEs9KI4hcJB6NdIQnI2ZISuTehAETmbdhqkkzkGYgzUBiGcC5SzCGnsFk ABNqIsPGk6QEJjsqPpAwBfhkYEJmOweNEgu6hBzhvuLTUUSVkGfCaq2SjwI4xj/isBOZYInX lEi26CKSlZYNQeDfag2eUBH9YfwJEZ9cNBlmL0Nzn1y7mLHDfYzCqlzkYQ1j4+J5DNNmZA4D jh2/2zC92O/OSSpJM5BmYJxloMS8WOlxM69qFM6yOO8qTQJbQY7MWIhBneG1/xges2pCMpNV X5mTZ9Jx8W69VVwAAEAASURBVLxnw6M3J+4ELFhvmNYU24mSpqbFUJzUKCAScp+WyzqMoFAE FrI1pBVG1sJ4C4NRAcEkFvbUMgxtikkzkGYgzUCWMuCeGUGC8+NEnsiwkSQFWUp0SuuTgbQL fJLjo2L7asglkA9LwircsZB3DLqXudQy45rISJAeEQqUhxKbZxSQOJKVQRGnIryh8zgUkWxi ZEY7QcldnJEalQNwvFERz8ranCCqk7drSLpIokLmBa1C4olTryrQwh9wphf7vVKUytMMpBkY NxlwrchI5Dh/4oyqAXyVGs4s+lv5a02msDVtBSpM5GXLsPb5gctGZpJtmW2MJOtBsmXoKJw5 5ttoQjjbUHFGojKC0Cr+JFxrb4jGkVERXbj2MjutCDjZmIDN8jwy/9TYo0ulaQbSDKQZGLsM WE4tk50sx65pqec0A2kGTpYMBJ1aYh7E9JbD1Vo2HZJv7yZ/pokHg4gJQzgSYAdMzAI2OGTz ouKBNrRJQM5D84RsCoVlm5/6m1h1y4psYjUwbU2agTQDEz8DoVdkIhV40DIPH0JsyoJzF8bK w2EweRSEV+DoPAqZiQ3TRtMiuJYNzmCv4wfh1Z2uFiTQvy5OKfCPwV/rxRlJngMXJB7hMWRO MbyQeOLLXbVPZDo7unQbTxiJ3l5s1MnQcGxsWvDKwBgOA+E6bgDWQe3VykTk6DFuyBlEEXxq idFl4CU1PakzMAbj+qTO98nYePuKLDgTZHrjQxVlkQZuSCsBi8Qc3ApfBLkvJomv3fr6M5Si oZgbQycqbl0uk6MHlAO/IV2EhGlf0dPbwcqhGaihqGdobidNpSEyELwiC0GSQtIMpBlIMzCW GYi7IiMxJ7FeCsOBy5CxOPQRnxgLyYWlilBCYYEaIoQjgaEmFQFCG6JNsIouQoXl4RhJPPQJ ijMJM8EwPJd78VIRzyrJ9uQTV6iJTB8IJ2369CRAD560ecin0ZtkLGmHJpnNnHNFPrUk+3PO A04dphlIM5BmgGYg1IqMGnnV1SQn7pSPeYhTJP5rHkSJWGL68mpICLn4KID7JbH4GQto9GiF RShHcV34hZ3nOu98BmfM2zZCowNJAgERnCmof0fHG5+KO86WfDgWhyIDm8grsgx8paZpBtIM pBnISgYSXZFhhPxggd9gjHY4ioaWLvHIG8sa445XID4xFk82RBBLT4P8ULijdUvyI9LcRZFm IF6ucReIZ+62ys5E5vYTWkJamOcDhUQLrcxmwMjtdkvziwi0oYiTvp6DzIR2gd1l7ZXQNFbr LAt56GMfYZyJTM/62Lcgy/2U0qcZSDOQ/xmIM5GFnbzUhBfzHJMnT3EUyCfvBPlGvJ76ICMd m2lZXfLERvsRYrQRIyRwpLH4Qh2xsUDzT5RxzIIAc8BamDFn7tNE4pctMKQeQXEMw2fjeylq qHv4zq04zkSmZ3AcDovcJjj1lmYgzUD2MwATmZiL9Nkpglswy81chvHlxl2EFHhARcA5iRad YJIsMeUwHov3VJRcBkgvY+/7eSCrp0gLNGLr52ZsdJCB0TgrssjRYuZD5dyDXtgiFaJCcBKj EBbIHruATohzO6EAoY0dlEpjZgDzGqovYjqJYiYCihcNWmGrongeMyyGnaUI0vvIspTYlDbN QJqB3GUgJysy1Rz4zWR4jWZyKDHXxIyJTPUhyImFii4r58hkWW6Gj55lgQQWoimEQbcgZNSF DiUsE7dKGm1PUZjmE6IwJlnDkFaECo0My6zFRvdOcETiI9HHjgQnMsKvEwb40tU+LDpjWk4z kGYgzUCCGcCJzIcTZid9svJBpqqADGAeJ/yMP+EbGNDTSahhtIh9L0oycYhhBFGs0Wi8FcJM ZAm3SZxgAqlMcAZ5Zp1mmpMfepOhmxiv9pAhEM7IiywBOcYTKxIvI2RNIMJsU2CsXo3JLAAv VnSbGb23tXDg5d7bztAkQmIwZqHibmOWkpte7M9C76WUaQbSDOQ2A2OwIsMGykMKTtHu2Ruh oQvkhnq5QEMXhMfXYywj4sCzKtvuqTcUkcCGpaUi21zILxf4JsBinDPRmAZGnFsGAooING5+ CA3SB/MhlFBolgjRZORERtckVLZ6TYjboQEvwlHIiYxkyTNIUABUvDve0tJJlgEyXE6y1ifZ XLGnifeTPKsiCSS5KAw5kRFzPaVIJTGiLt51HKFIq5CBNEvpMLBlAPcbY+eCCijEu80qksxg dlliAC5NNgX+Mfl7jjeR+XNG0zrR81JGd5m5PNvPNBHm+EYR/fRAU8iiMMp9V2OwCbkmNEjv bvFJLhGJipMftCG5Fgn110ZNOrIJQ6vHqJxh8MRvGJNsYNKL/dnIasqZZiDNQE4zMPYrMtLc BG/OIMxQDVigCQOvQ4x5jCMoU+n27CeJSiXwmXjEaND1qLz6iwKEjIMCBh0mJ5HAWuORGwmY UlRQp+ETKRJiw7W/A38o4SVU4oMgIkyo6u85vpPMJzKIzDNpoBDqbIUfv+GpZZqB8ZcBsaeJ 3Wr8RW9G7DlrmLCQtcwnMnCkT1M0vImU+pA5TWFpBrKdAbKb6Xtgtl2H4SfhhTGJjRG+StBl fubCuVM/C/GRM02ZSq8v1GKmSMp5YESZSbBI5U+CMBGOP5iE7F0lNIYTrBCQN5ufRrB5Uflr kVeYY2AhrYR5JDB6jFfw9+Wv1Tzq2RJGmjJKMSPjKI5c2Kie9Sa7yDRBerFfS0ZaTDOQZmB8 ZsA5tQx9WMhpQ50JnJec+dkpJR2P+agd5scJwubLpsW1XvbCJKFgFPE8CnOXLQqQnrgd46o1 bIwVo892lCE9+sNQK6LNWfDZTk4MfpIKHwZEOhOZDzoRFboEtpO5k8InU2QszVX4jMVA4rAc b3k24vX5nNHAxUiQzQSTZlMmIoscdeITGUQAzRTvnk0SCE91qkgzkGYgoQxkf9JJKNDMaOhE hs2OPCVmFkdIayc8pxTSNCaM+bHlwvkUwkqswpNbxaC2Vhu7UDExbRhzxIcB211apEiG9BZQ DBHSoQOdxF+LSAKzUiHYqyBIvG3RiRcBkyPIm8eBhcEA2h/G6NjLB4VBCeTYvtP9xhq3VQhx +7Qkvdg/tv2aek8zkGYggQzQFVkClDmhcOZmXqJTOK0nHxNezhfU9EBDHKpwya0dowFmhCVa VfiMlAkVps/xnfEpGMlBtPAioZVHn8AYX4wmhwgDnYfAKgixsfZCGAw2ShE7Wyuno87Xkggb 246FDONNfCITgQWHpyPGaZdkmPoY5nrSwDxv8wZx5m1s/mknGc7nJPs3RNOO067QWhCimPlE 5u76EG5NyPgd92Y70lqagTQDY5OBjCYycmqRzfOkgOyQ2TQgkiwcouKlolCZyXvXIgYmWu1v hJnxh5H8hmHWVl3ohNBEqIbzGIoQo4nUZBe1pEmELUzr0JGIJDD4qHhXAxMWkHgSZg+iSy/2 B2Uo1acZSDOQ9xmgKzI8Dqi1Qt63wBag18FBts5LTagwF0Qepkps0aOHXH4IoGDxFmhh4jqp MCqdstEk996pIHbewIgawhs6nlBuCHkom/EPglaLhtOJTDUt12nR/SXbwapFOd3qzQHHWW0R +sqqF9/0oWeMBT/ZZHao9iUJpXQccHiCzIHuc+yauIPwctnYwGxkCeBudUhHXhNZ+KTFdu0Z IWEMH4onY6pIM5BmYEJnoITM82oSUduxaHz2Zi5rqzzdWdGYEE8zRDgFPE+Xn0KgLRZMX+JM cxSfliuYEOwQGyXB4YWya9GvzcxXyVy7OAUL2hnhhamgpS0cC4ErAAsGRUguJCFdoDkpZM4W lYHgE2kFaVTmVWuQmdMGMIwWpCuygBSl6jQDaQbyPwNeE1moyAPucgjFMfYgr2NIwBE7npkX KZFzcvwagLz2TzwSk3CJRA5pjSRCgdVwbAJFOaPYemGzwUl8oQuxsozVdEKZUVWLx+AZ88CM aPKpomcso4mMNyp8nnW/EfIBZuF9ROAdCyhJQTbaJVxkgzl0wtC5bG62exCzio5Dh5oYEGMA xlyGoftNrDHjhwibn/lEFr7RPv2L8djZiBqIQOJDZ2dJpWkG0gxM0Ax4TmShpolQIMwcmY5Q Hlxw+3FLJEt8JzQMLyZP14KAmPmiPbHCSqnxHFN4CHOmqUw9p3sBcKIzPcpcKHUgG82dq44M oFGsLpBNoBsG2kYCq88qpNeItrZYlYxQKXG0hqNVsmxIm5uCV/CJe/ecyBL35DuAA9pL1LAn gCTS/pCF5qSUaQbSDORLBnI5kfm02T0pkbnLsBU6gnBTGDbjoYItSrAtgjMpwohswi02S/YB 1JOKx79XqWOOzo1ra2AknjGMxBreOBWKNJZMtGz6t4cMpVhdRzj8HRp3uIO7ALQZEAErx/Iu M0KttA4FMXcUTgmNJBZNhIKqHUNrScCRw4rJUJioCxIptpbFaFQi9luGbQxpTiIMaSVgpOVo mwknkoxJIf3S+JikPXWaZiDNQJIZyJNTyySb5MfldSTSbSIelaxwTz8C7amWcdhRaMXV+AmA vPavN0GUNRZRBDFyELiG5RqBQzNVkGK+8afSfCFQsZjrHVSTkHyqDpEWrA9eVxFbUKkA1FZH szKzcFsJlJeN0Pq/Z4PT3yNqvVwjYNwV8nYi8xkh9l4gUh/7cddJacBpBtIM+Gcgbycyn7C9 5ihjKjMqnMzLzMfTxFOJtORVKvIwpLHtd/fQ1ePJq77TA8uk7N/kMMzjcSIL064MMIEjJUTW CYRSopoqjLARJaQOVpSU2n7tH5kUTAocFkRELjhfTfNlE541iBl3SLch4icQJNZco8xSsJpr tlrRsZZGVltAWW0c67SUUAYg/+Iyf3qxP6GMpjRpBtIMjF0G6GN8chGJ11EsF76T8BH9aIst jm7qBExJkIsrgq/9CyYJlmsG5NCUrCjlqFa+xRbF9Bq4oxB87F2ZKk7cSgjqHROjRDj94SaY YE2l4cRdIbYIUCRqiwpZkHZWcy8byuFbtzK7LRLx5aYFScgArLZZEfKm5ueppX+uvPrISy6z V+jdBQGWWUl/SmpkgHR52iNGdtJKUAYSuCGWDMEgj3i49wHahrHjxin5UNjc2Gg5hZsRoCD0 NJCO3Xa+EeWfEhsQ1NJch46BoeN8ixADy8+CO4H5GWfmUcHAgL/8XJFl3ro8ZSDDK97OKUgc W1FS1JHOMb2m6iAXLL1OAJhsFYMUmAgPJYKIHknNAsJ1MZpiQdcqE6sSgEqv23iWg0i8yJhd kK2n01QRmIH0Yn9gilJAmoE0A3mdATh6lIyqQ4j1cKGUshlWjGcTo6E9aaSChGKFJ+vR6iJR IcYbpnHEM7VFCqUIuC2D0NmqikmtWUwXVOtmQIRQoTmvCqUm04oMQIwFhce7v6kHExrhLyro 7KjVhT5lqxONRCs6LNLIaosoqyVq0wLLgPcz+yPkR0806RIfVQQHFKqzEp3uXy8TmKj68Mjd yEUBY1630stuFy5rNySVhM4AyaZ/6kOzpsAJkoGEr5GN9fCK5J/sGqRHgQoAhBBuBfW3ckjM KU/IBWFYBocrLbky4E4i6SqXRSqYyBlwJrIw48AL4x5VLGdeaK982lm80DZ5eI+Z+7L5jy0T 4YQPX3ckm6Jd5JdartDEtjYrGZ5eWWMQKEeFJelCD8e72ykLs1L+JQMSu0YPARoeaUVjMVQm h1NzShzOzYkMeby4EaAXgkgImR1ulyo3hEKJ82XrH3zmUSJ/erE/82SmDGkG0gyMTQZgHhd/ zsV+EQjOcNaZHrUkavHlOy8tAXtWrS690Jk68+Id/3KPzNiv/UfJORI7Rk6J540jLDA9qagW QpOBKAGi9GpL13A6dVAZOQiQeCVVAVa2vkrC61n1IFE+qJ0VLkF+OsozQeuQtkQu9odMj1cv gfkYdAaLxjsiGZA3IESb3VfTgA6EGikXsDDGIAFeLRChaEF6AfNO7pPE8dicvMtvfgfkXCMb wzjJrkyqYxiYzXX4ncJnzxLEAhAIs0WRyqJkQE9x+P6L4iHFjnEGnK8oic7272aidcYHVxCt u2UOXuhIXdgToZtFSAKdWV14sRF5GPKQcRJm36o/ZUBQ6kGxzjN2iC9p70VjOMeKFe2pFWil FlsrgxOaAnutj1EvTNRnwUTs8MUpWUMkHkjVNCFKjMFEodhe8CLBUwfF5g20E098KWQmvdg/ 8bs5bWGagYmaAZjUYRaDP+cxPmq+tzfZehQgJojBRQFKBKnAo1B8qQCr0jEhtYcT9rKSuCLl SUl9ezkbT3L/JmOLXTlxCYxGo52fVFIgEzcilqgURHjJkMgNN1pFsRlwtRjVcJkXDQ8anYhA xeG1kBQGiNLsWdGLm8BIVbGFss5KTkhAvIr399iUuZGxZbo8tVQ5yo1ji5dQnWOxGztRYMS4 j/IYBVwzGvOUh0qdiFILO5RVPoN88j6RmpnPXZCN2LJzsV+MCJ8hE9QUnyGVAWuQ10T1Pk3g fnz046WJieYrJUszEDcDsC/J+8ig5LP3gMpnt7NYCjSs+DRSLBIqrEoA4vxbhWa+MD0AC5CT oENPSkRYKLxFnnTcJB6nt7esavD0waNNsjFi42CckhOdV7uJ3GbqkJAShifkNltCTwhk1Q2y UFlEdjYfqduRDk7CA+yUidDoceVrGRo6ml7sz9feSeNKM5BmIHwGIl7sJ4cSnPS5HGvCPcEG xiTMzStL3kZR2b2ZSNgWoD8iuUgsrrMmskbt31AtFqu11KMuNJtGnEQRAxBkYxVG7KaQ+Mdp K2I3P45hyDv7fYYCS7qPWlNh0dJPFlGc5lhs0KtFp0TZ8e7Pio+BU0HoWxW0hcIi0i2zXRbu VXxZ9Ja0ozAhW3JLRGFYspiUlNo7A9m52O/tL3MNDCYYXuI9c7asMsQd9/ruQzhIFcLXwVlt TUqeZiB/M0C/NE4jJbuJuR+JCYWZKLkOVzKHUmjxArwD1qBakRk6GEVTyEVJnoESl8qR3Loj IABvc2bqYe5tBDZSacN40JGQJkrV3VpbTgJa6yYRBi4qIrDYuUXEJiCUDNRu11aynMVj9R5e GLI5VkLSRji5gT/PryhJT8pIzD7EvVI6e6uQEJg1mthCcAH84j02SW4MMT8R3en5IxykCsQ6 OKKfFJ5mYEJkAPYKekOs2FEsOwdXuHcjkQeCJzCxhnJnjMCsVG4rmMOEIbzrfllVr1ssY4ms UepM3k69NcxexG+jVzK11b2ZjfbUuF3byUyCkDU3ORgmyO8TBnEd0Smx9vETVkUYI8YT1kuK 88mAyLn81BIqpA9EFfvJuiJDdmKLVggQBQlTaC+YtOJqvCgec5JSvkgkRjUgDgMbueIfgK9r L6U/ZeQINQP0GOQC9Wihsaii0CFUifNli6HnbYQxMoWNimE7XkwsbQz81HIi9fF46ac0zjQD aQaiZsB+sR/mLznt8Q1741MamddwaiRy/yCIFVbFMwdH1WcBSi65hVwJdQ8CwDVQtCF0tCwD DIMOtPLnRB6LGyXyYvCwpWIvc0Uvt9SMqKNUQ3p0kugknkSBD5gk8ijReGJFmC7msNELXoJ2 sXl6dysCqQiAMGTimlCdVFXIG71GFqn9mHf/7gnLiXRhDbTdiJvoBMmEFDqSQKAeG4KtQtR6 FPyNoN0AyLfWezQlFacZyDgDMNzhL+g+Mr7X8DdPh347jU0n2GwaTxcxFOBFd0GqflMgOtPt Uehb8E+Ur2kiSohYNDQwkKC2BRJAvEEciTRpXJNEzZAVH6YrxnWWMg0eEsRuv+B5gjeaRFpn 7mwyJhe5Rq2oMoV4mXWEuZRMg192FQ9UwhMTBUYuTiMsNCvje+rChr27rRxdcAmtrVDSHivG zeBrJZSOkVOysptCD2Yi9qeMBDbdu2vSFeEkOBWPP4oYySraKBK1tcMDpIINKZDcaoYwpfWH K9TJu3UlLFQqArIKpM6KTHhAC+JQyFGIMD0Mf62OTMtpBtIMpBlILAO4IsuQkcxrck4EKS/J KvPBimKpBSVlxYT87gomcJ5siXdegJS9FFxWOCtjEVZcykBcboK1mrAyqKQl25i2XijNwDEi QlI1qZgb4YrAsGriURyqQJgVFRGHoQowCVC7PYhQnB52I7zzopphs8mGLKQ/1SQMIXJS0JKM cE0+kYoh8xq6yfyuUki6syKjpqRHzB7TbysjQOAxsdo0Qn1kt+4ExkvsTUujVmRhOGBE6SIV qSEjFAozdlsRnRGjCibvYlWBpduADJCes/ZuAMXEVkNG+H1kIlEyP9Y0kVQGpoWQhDGnyy+c TbychSH1suVyEqSO9VHpMGPyMxS8knGEbsoMJGHblHnoXu12InBKGTQo96aiYf7BezU+uWit HvyDSs55fjKxlND7yKxpApzMVLiEybvwFVhs4Z1cuVes0mch/SK4kCsWGYIEi+8psYqcAg25 YsYVmNQqOXKKjlFa5BBidUebqClbVfP8qoEgV5wc7p6mFYvaGnDqSoHMLTExlU5NtVXAVc3R +5TQA82Ej42fKp5zP0aiw4CJ3FqNFI2VAYXo1/+0GfFpIXQGQvUSgOh9ZGiHfQMurUI9FAFw TAINdOP8KY/TsPMngWkkaQbGJAPsYj93DO/ONGQNBXdyoeXVACtg5DBkVl/3RgEv4EKMH/dR J8COC6FQaxtZc0LlnlytEFJc66mvB0iwssaqikcKUM6BZAmmIhE+tTULCU1UlSu5RWalRYEA KDExM6rERDveGDCshOFEMCm4fBG9T9XT1IzHrAGfYWdUfJzZVS5uOyxIGiKIQjUqQmCD3KX6 MBmAaYLPFPClcZlzsbH3uS4FnF4N4cyPOYS5hMgwwxuMNdI/YP8cJpOyeBnwj0zn1FsY3kpn SMvJZIBkX++YZBzkNcsovOSKTI9TXMnScsFmPCNTho6ZGlrtYKovYjQj0wQVhEWPaeKVsdX+ TRuDnISMDOIeg+D8s5VqRQZy0DHhR0m2OwVXZIYjiA/+ghNhQxBDOGVkqz1AOgpmhqZ8SWgK jFhYRVjrYjE5qnWkwyYw4Ape6EKUECzmWIHRgFIgzkA1MIcoNhWtFGobjY9JHeccw7X6jK5Z 6nO+IRaWTigGp6woGXHv5pGSsDgbgfJl0wXI3KYyEN94tFP1AH6udjvxtPJ162kVVREhIEWd m8CUt4m2dVZkmHos6G0lWZbXtVxQAXPEouTUdcq4ZeojLs94t8MuSTa94z0tafwnZQbk7Rew L+B+AQWoWvcOxPjnStgysOCCgkEnadTdGLLqrD+82Q0aDpPGykS6RhxXY02hcGuoCZUJ0hKE CntB0EifYh2nvm8A+RByjEj5tB8ZCAw5TccycQg2tVgL0iPQUlBhWlQgyoTZzige6cR0/p6V dTgUR4cMNjRjSD4VqW0b2pfN2F+WQHT+DsZWKzIHl8jYnf2srZhK3nC/KcWaGWGOKoMNKqBA kWq4IVBTmlL6bYUh+rJDkT0AZ1qjlSmWtUhUVoYYQv+QgHBMoorSkMAWRCFLsfmSgfwZd3Ar Ap/IcKA5oUFJn8uYApViiSGMQIhynwRbPBC0ef0pgDNATahDVIPjC0EyVhAMngSQeJYIP616 xUFxvJ7r4KxBpMIxzECk4RImTnVnPwytENxkAPpbMEphwHHcg7BQNHgHGY9Uw7K6f5VEqxiJ OCgD3MyMgpqwiM1Q0BeDaieNpqWRG62iFZEZClKMWtOloHYCNUKg8XkdXJDbDFTUfJXKg82Q yXyNSaxBcOnLl9IrjozkQR7d7cjInW6cDWrZHNoqWtfDyGnZ8+OvSFGwXYI1ybn9gjTQ41wP UWFTLww80GLV59UiX9NIrfUGY3u8IdnV5KKR2W1Byp5mYMwzALuRWpGpWHDOCfP5t7NE4OZk WoAqsgl6dYcaAoUeqwxFTBwdUQhG9e6pdOwZVNQI2IQoRtwC2kSYNVfEaKgV9BN1TawaC2fW JCbhkggdx6Ik1bgoFMxwxUC5YADCoVSkTSj2KCClh95P7BWBlw33RYwy8e/lh8gdj05Jh8gQ chCJ7jWwnG/xBAYsAV67RFh7hVPtp4/xUd2ldybZy0ClrLGk4Gqr3Ghbx4YL4yMJEWcjMknu 40MLLKMicezmykEMbqcgCQzMagXCCAGH8mEDgSyCGy1SQhaPRONLi0lkgPRKEpQROGBKhD86 kdkI2HARsfKBw4okdBxQQq6BGR9qWSX6C9hiMpAofVzHdODDOG5V4ZNGmhgth7Hd6F4JSbQI dKK0nEkGcpB30tMkWtDSU0uCEFXAhYmVYIhv0KoPJxmQcYqTIIJTEVjZUCio8FKexsGL9MIb 6qVr5YRtkZNOzwLkOu9z8ByA1AIu3xFkV0uUs9b1hRnMTkXaOCRC5VCxklOTDdUEWttHacYc N1FLhgMzAj8qzJgNhEpKbgPHkznMTikeU3ataHdn19s4YcenX0C8YqxgJ+LQ0ZuSiVbnCVMW vkgY/gE4tGFxjoVfyRqKn4E2f5AG+FudzNoYST6Z05W2XWUABg78wdMvpEBtld53K2c93Ett xniMF6sngKgFlEQ7V6W5LxuHEwS6EiJxizzndDC85AI6fhGJrhhYO8QZckTLglKqLdWrutCT MJRSbH2VDtTfE5L4w5BOphvNmEKtkaFEWAwYHyqQRyJE6sQKNIpEiMNFHQ6Fu0sikcUhIXtN JArSx5FscwQO2Q16NDCI9RWZUHnw6BkACB1vHlas1wXaAlAiQa1qeoBOWXfvG6djopeCzd0I 3R7L/lEizFYgHgQTzSM3RCfaDCsZUSXqgpMIbc5zIiMtjO0zfntIBPGJYseeGmaSAdJ/4anY ROaFFvuYGgtqLaXQ2i4EELk/KrAE6WGJMloJJFYVK9uiFWHTMXrZSqIDkixjcDopRhAyYt02 kzIGk2O/mcScU1tMUE69ZuYs7cuY+Qu42A9jgaUWlrPOqCC5dhQSjJHwOkfjOYkA89Ux04oq M+BYtOQFTz8CJqmUjaQSRnjpWnjQowc8zMrKsdpKh9KlomZbdg6LYiwyPJNq9uhEohmEvRSZ qAklwypyLtdtmILXcb2GWs2doGPvViGaCBxiyE1nDgstoQVXiA50ZE4J7biIuBW2CDEKFgqh 91QY5qxi86aBlDo8oWbsVVSkdn2iruwuQkrdy/mQhlmFBecnGGEGCDsSmPisyEy43PNtvQgy P+cjfLwJBJpjQfcCGEOOrIZUt0ioHOgIo0ek1XOYOAlDGBOrr1QYnAGS62CDPECkAyJmJzgX +wWB0/kqpSCBoqg5Wo4mCxtloV8+ZzhHzou4KHA/QV/4EpGIdzywIImUK5BdrgIlWmKrOOQW 141ELquKk2hFhMSRg3VKxI5XlRlFmXWzJhOqTOVhBKs2N1xGWTyBjsIhDWlMYNyeyBS7wy2j Ezgi9kArcbr1ygDum1aAR5+4sB694cKNsQCa4zxYUcRijRzPcRRGolg6eMLQig5GXqdCPpMR E8UstuxdWEFBdAmeuYn9WJ3kSZR0wUgFsSFXQtAJudSinPkDj2Y7FUhtOTGvGC6ELaOSQANP XOjN4i6FNZoIZhaLohVblOt4JSRYDqEyD6wSm960muCJuVcEsmuO4hRpI+NwJGsTssVG4IaN oUk2tnxgM9rqGuUxI+RLCXqxHxNJXHr7ACCbAHR8GBLEiAKYMyLNjU6oifOviA0goemNISqo jpvmuUNPJWkG8i4D+sV+sW/573+sAYCQUHbZ3BMPGF3HrDQPUMQ1jMgKnkXqSYK1gCIRxsK/ hDD/ssi2EAv+8htUMQB0pMBorgSc26Mpbr/CCuWMzQlT5AaUUm8Bc/dMLk6ueZW9YZxorFSc BB3yTAleDuBUgkAZwFbCnQUtEyCHANKwlbmEATEvab4UItTW345RawEIRvUMXcLvMJEWEByp OmamIhKJYWodpQYiasUrxqg8UfBe7ZexoDpcbOFQUeKLggXvsOfSFRkyiOCwRSh3FQDCsHpj QlgxPPwhEgsufj+BcBrP1o83c51oHvB4BWeVi/Z4WflrM485Txjyt1PzJEFpGJYM0GtkDoSP J9zdcCcSALwubqJgt2UCXNoIc2Frmkg/Br/yYVipgJQSpgamlytBvtwAlbpkxpwrC63kMZ/Y ocpexSZReCimcoFXXDIDikRNZEqNcklnyOVqhDkw5Cp8KRRtRwRtu4xPhYke7ZwEJlmddRG6 cXiCSoQyCG7Xx/ALRFFce3nw5xBaL1t7W8adNGLzSMZwT8lRuyFadme/Clqe1+B8w8e9UtIR IuVKLXtXNYh0thLDBMcM9B0P6o5D3m5FKT2SKqYG5ZwQxc4cKkQkEgfHSzIwjI+oSVV3qav8 za1W/iZAbrVCp4HmHCk5TCqzRrvVVUeXEQqOC6dkNfdVe7bR18rqxyKMRGKGEsnU4jq3Irz0 Es6taKpzGAtnNeYo6BPPU0sSnOg+s0sJxLMKtrohjgQQYhmMdQxyhfEbSIJsWSmECTErjj1I 8y0ejzCzItaHgu7AOrZ0QFoetxmAPoc/WJGxTiZzCpcwOb0WiwOCjxinxksw++sDCWSyyrWw GlNrMSbmWkcBEvHiIlbUbblKcastCPF4Y3q2zImaESMTXsjpHbrm7lQAoqK9G4ERXgxbw0MR UdIF1NVJsQ7ETyoUXsK1DwEYHBfRwpa0XQjZ6Sdpj1A478wJOQvAfGohMwMRD+ezkWpmAC5U pKoVjMHysjE5sABjBxhcAkch2LzDsRh7g4PD4QgbgUpjYM8pH5bAlEptQ0AUVNuqSDRRhKKw juc5ghsBBTewA4wWyRUZesUECwlWrQ7cVjpMZ4AyUOkSHUnKAqwLhaGQ+IekW42/sminu/3Y ksQbr2cWvUAhcUc6eVq2ZiDtC2tawgldp5bWbKphjUolsDsJAzMwWBF8sALRJOQimu4SUf7x 6CaijIa6KhoJoSBV4A1BJ4xCAFWYbi9KQ7cRSKlpjurh2+IVUP630SvyCSfPvDMzTIn3p5aS GAcLCxWXnDJuQ+lEok89gKRLTWUltl4pkCilFlsQKgGNT9SlVrmwLgJRSbgIM3VgqpGEenTS wEumlQM25UbwDoMEOVZcJVwjAUbi2IksIUJTWMGod1kgnGm4lr+hWFhSM1pX/KYZDialtm2l CTKaFGCBGpu1OJh4QFxUVoYsCT1i4t7IlYRIEfjx6kT25CtpWBadMW45426AYOEL3XRFhk3I mJ81DNlEKxPhjJuwnNuJxifYZsxmgpzxsoKREPMxD4zEk1ZPmgzQL41jw9UVWy7wGrgg18cu ljkea4iRNAa1dAhgl5jB1ecDvKgvCrgds5IE5oZIVVWEpGoYl2nrxM3liDZRjpiQmjB7DYyJ F4FDocNuISBKUtWXw25jCnYjhETiCFyiw4XpolbHe6mg3BZW9jkGirmZYcQqTO29hDHg0q/a EJ3mRysqcLQtaWk0YxeaBMr1NpktbK9IbPa4C9qVrrhI17j1oSRhnXmQgTlMHOw+MhvAlhIb LpxMuIjAacZk//xN0JnIDDMryRSn44GXIsSv0qKYVN1jGxIG1hFiCE8ajdejDak4zcDYZQAG Oz21FMHoe0HAzsOhiC9k6wGoiXejZYgBqZszvFaY22c3xSK26IUt62TFeq+CEWdhEffAPtPl NIpFcRvg+BUrnfLlRWs1QnCQNQJdBX9eF1wK4vvjBMJphiResY2tPF4+I8Us8+asv/naNQeO LVGOjVczEHkfGQrxViZxzuYZojn+RE3/qBEIYcUnUYpFwkxbxzWHKSyd7YiRgME7kZOqODMp gu4GBf8wlM+A0onjiwcBIP7ipDCRDbNGMA3BcbDj2KoVGK93FSWaSoGqi61CKRasK5hSGFsv JVrraDydt2p1pF6WLnRPwl6X6AbWMgXTOhjJw6LLXIOyolZlUP+2MLAV4bA4JUbn/7JS+Ztk phVDWrhl6wYVAJxEwj2h2oGatyJKUzAuRUkTi74kMha5tEUf6DVugSVktNC+IovLKe2ggcnF GTMWNqsWFhQXFxWXFPZ29g72D4yMjNQ01heXFIwMwWILmu8czcAHDIKSsqLhweG+rr7BgcGy ysrquorhoVGwgsEx5s2JmYXwZmJQRmpnOHDz0PCpfYOThobLR0YHCwuOlhbvKi/dW5aVgRe+ ueMUWVhYXFLCDrgwLIeHhnt7e4cH+2EwFxYVlZSXV5ZXlpYUs+e8j4wMDY/IU4px2tTQYYth iN+1FBM9PboZ+zpTqsHLV1+oxb2Ai+U0ph8dICqwFPMBPvnHYRNBc24GE1W5CWiQFQVTD8xg 0JE9XSd2b92w/Jw1tY0NMHFt/MvzvUdOtMxrK6upgBvQC4uLYFCMwNJrtGBkeHjnUxta5kxv nTa1rrG+/ciR9U881jrj1Kq6uqKCYtBjY2V0yrHKiBGnM/MpmFQLNBFikw0OlQclZNdtubmw pn6x7iJXBH5b2XEKgmRKwLcoFS7QEchRpQwqRkYv7uy5sLPnlIEhJXO27SXFj9VW3tdQfbyY ncl7vsCFi9kTrBR6XErGt5yKvSHCUMeqJEjl6x8OyfDq7x84uGdXX0d7VV1DQ9uU6dNnVNZU FxUWDQ8NdXce37Nz27H9O0vKKirr6htbp5cUFwwHTGfu6LV0q9WeA3JKvrH6K9k4DtsFgQ5h 3I6ylUZB4ZJll3C/clbR2sHE2t4rOKVAfk6k0GKranLwQVXCuAOm5QghlEUNI6i5nLvmw00l Ux/PLBIB08DcB8oLC4dHhosKCisqyk89dcaZ56yurq0Fql2btm5Y9+KuvbsGhgfAXe+x4wUF w+U19UVFxQWDQ/MXLjh91fLmtkmV1VWdHcdfeOrJbVt3nujpA38wikjuMQiMQUbAN85Epkuh bEUjxlfLlBwgewKtRMG0NWsM4ZYYUpM0FFj4tVGf39X7xqOdtcNwf4/fC/rg1001/9dQM2z3 x21tKhGsH7XV1EYVSJIHAFhvFQ72w4lCf0VVTUtLU3NdQ3NbW0Nra3NLa0UVTGSFw8NDJ7pP HD6w98CenZ1dXV3dJw4cPDg6MlxeWVVUyI7obF+3vNxCLUeq6AYRpkCAgRcTmSHyrAQyQ8NO 9BSf6IUTrYgvoFYNDLAUQXiB9RC9MAEOzKlFJ4GO7+sbLK+omHHq7De97S1z5s8rKy2Dvuy+ oPue3/xmz3d/3NfZV1FV0X+8a6RgqLSiChZlg8f71lz1yksuv6y6lo2MoaGh05ctvfP7/7tx 3YsnurpLaqrgJNN0SGs0Wj0gqst6XU8vOEsmFkJqawSs8P/28PHzunptSiorGx297mjXkhP9 X5rc2G1dmiUTN/U7rupw4gDnMMPDw4OjI0PNLS3nXXzpokWL26ZMqa2rrayoKCktBQBc/xgc HOjp6T1wYP+eXbu2b938yAO/O955HJZkcBDm/R+i8+LmBXopi+zhonJuv6ArPjGGVIByZaQG lhQrrfSltPqcCxCx1GJYgZerOrl3ORxOifNxGMgUq1SrqtE+3bSQrbRHCocKZk2b+f4Pf2jO 3DmwJodjEowFmJKOHTl6tOvwpClty1euap0yuai4qKuj89DOfc/f95cjRw4XFhVWVlSWlZfB 4DirubmxseFHt3/73h/eVXl6JSxZ2YENXmYEumsnJruU6iWTIhT0Lg/Siq3yNFosSmuoKx7H DStJID2R5yBtycyNFanYanwugeFDmsEs9t6DHct6+g1lUGVB38CH9x3996nNXXwuUyEwMxYA JsXOo8XoAkiqsN9iR3s/TgTFKuiNCyKAXY79FcHlsM6jexYvO+ucNZde8opXTZs+DYRW46am gmnTpq1YsXJwcPCVV77mvnvvefDeu+DqSlVtw2gB7AIj7MOAgJcG0Ip2o3h5CqSFPo/IDGOk cLE6taS2vI5CWXCERjhCqyYoZ4eSZ5HIwvPhgsmwJYnKGYHhLmeS6b6YJUxApaUlO5/d8so3 vObsC1e/4U1vBCFMZMeOHtuxddvXvviV5WevOOPM5adMO6Wurq6mtha0A/0Dfb19Rw8fXrdu 3csvbVyy7IzVa86f1NYK0xaMoT/87v577rr78fv/2DK9dXSE35NBImBubS8rTAlF+mTNFAKX Epi0dqkGtgOYK66xqJ0PqTUa9KoZGPEiQBbU7nHLkc5LO3uoNlx9Y2UZzGVk0cvHgDHSBJkm 0mL0coQTmReAykNwUpOQdS3wIAs4pgIEJp+ezvY3v+PdZ646a/6ChWVl5eKorNYEJgvQs7mP GcLQPdHd9ejDD//u13c989QTzW1Th9nHVgEn+yadrHkGreXJE2NlDBKGn8hgCoNTy27t1FIN RuVDXJJ34uNBu0BmUxEtwIrKFOMSQalVOhCmkyql03ESplyIqh5YUXHxweGO5lMmTTllKvQ6 sG3auPG5Z5/btnnLDW9+04LTFzY0NpaXswFRXFwM2tLS0qpquHha19w6ae6C+bt37Hjg/t+f fc45s+bMBkBDU2PblMnth3ZOmtE2ItZk3CUGJqIlqada2STadmlFWw6Nlc0SdmJOx6WJmtOl E2mtUqC51oqMiLjhWkfmlLRgJYMiUhhVlzMkb8YZPf2xZzHwuLB34NXt3b9prEbvKmLHGUhE RWVAQlRYuqlWDlBrSFmMbOCm8JAYbSEYbJRyXzQ0ODDQ03XtDTdfdvkVzZMmVVRUwvQEVmyq sjKZwpraunPXrCktK2lpa73v/+5qap3G7s/gw0i5ICHIqqfW5LcbB0k9yXXDUCDNYARuiBU2 UULUvfjbSe4gF6D34Qmylu1xSNg0MDgEn07DZzYjI1s2b7nvN78rKytddNrpy1etaGxqFAYw GqBT+/r6ysrKYFKDqa1lUksFXHUoL3950+ZH/vDQ0MjwjJkzgAE+Eioahes5WuLCFK14n3aG 4fTHWD0Sk+wEAKw3HuskrqJW/6qj++G6yk79YlmYFoVxk51Wh/EcDwMDsr+7G0bm3CXLLrrs 8slTp5SUlAKVWG2F4RTIhsamJWcsLy8r2/ji80ePdZSUwjUTdo4ZhiEYE6N3Eu8IFYM62Ya6 /hfcCIlQPF4GIvDg8GM5p04FCUw9VaVlXR3Hjx45CmeUjz/2pxfWrqurr7/48kubmpvARl7q 4svvg/v3w3klLODFq7a2dt6C+bAu27Jp0xN/+vP+vXs7jrV3dHRWVrW4r/VT92HqejuhDCMK /qCQ5Rdxm7i3FSf6pgxabrOI5Aju2HjF8R5jHCaVGdL+vKraclRUDJ9W9ZSWlZ51/gVz5i+A WUyMz0gTmRjnLZNaFy1eesbKcwf7euFCsThjtfmML0uql+JHAPcVTJo8G+zpTKPqaktd8IRK pYNxSgyvnW0xhaN0SiwDfJUMIil1rZqNLGFFoJFJL8AyrK6mYXBo6MD+A5s3b/6XWz/8uS/8 x3kXnA9rMVijwbEOgocXdPPAwMAXPvd5WHaBqgRuNGQfYw9Dob6h4ZSZ01/3+td1H+/asWXr 9q3bC8rgnrNi+4Vn9M0a7XqZWozfwKkTBUfLTibhHwUmCzdmEPkSJWaCaVQqlVZWd7TCADFC p1dJWeEFg6ppoNe1d0/NeCIDvqbh4fvrtLNLlyuXgAdhlzrxBekdZFZLEIblzxUcG5xwrlRa MmvOnNe/8WaYiWCssiGrdXmYOAEPB3UY8KVlZTU1tb//zS+KSsvhBnE2wTnnFy73WpD66PH1 iAPVPQB97ajSEgyFiLq6kAK1gaGigUF+CckOHSMppETLSqwgRkfLKsq7OrvXr3/h69/8xr98 6J+XLl1S31AP/ScuiumkcC4JPY0SvGo2+9RTP/PJTz/+xBN/eOihvt5eGAqZx4VeJlgB0nda X7RPKr0y0DY43DrEvhoW7SUGDb5HM847NNz72n382Ow5805fuhxOKmF8wi2vUWcx0SphBcfm 6TNmnr7iHFjZwQdb/KbIvGt1hgE5+7CLiB08yNjAKkwK7MV3bniXL1UXW5iQxNSvxAQFeuCH P0RxAEcjtcLA6oT/qWOE4BSnZcivF2BxDvfjl58oOOfsc6pramAw8HhVqLiFo5ztMACXzFad ddbk4tryvgIYRNBQndwoYwP0gsqMbJtSsUka/lwvKuZ1zZZkm3eN4uQ69uYkkpvL5KpIiFZG IhwrUyLEquJGnNGAlqFhuBPPEGVQmTEAX2RSKxfsflXAkCIVRPyRTDzBUZomugDfHU6TxGkv azhMPsU97Ufq6+pbJk2Gb8oxLCBivYALXjD44SRj2oxZo0ODfSc62aTolU/Ti4A5YYvRYmJo TY0oaoVyapBZXYUkb4iFqv6CBjivoCT6YoWSvSPMIEc3QV4QGLIgFtXNjc2TWiexs0KvF4SF kWkY6Gu4oNbS2AQ3TMNnBpomC0USQNKpcEesO4zjTbcvKGiMsYZyx6QkjUNZzrZylC9bM5ni wDo60F9SUgzXyGAOSiROWJRVVlbCvf7D9AqA6T60s5hmAfyhWV3AEHf2ExvfgQ9Y0It3HjPW CEtAg9xqjdOtpBI4BvX3DBSXlC44c3EbLM75B2EwNwFOrF+wTC15XWhbWlqmLZ53pLerr7en tLyc39lvhedKiCn07YJcReP4gW+DO5WMS+WwfMrnV5ajA3r4GxkagkEIwzipTLCnJ8DhHL56 Cff6Z/jCDOTJOOTx4JfG1eqVB8dV7A1DhaUor8pGyCoZcxpa5kpIpJFa+nAhvCkxx6oKk/Oz PSHQlm/MGVSlXDqQG2Utq9D/g30DRZXlDS2NNdXsvBLhbHzwGQ0kcP4Ixz2sCgxWq2qq65rq 4Zpr/7EBmMjMcJFPy5Emo2CRBwRYWsFbIAIjjUErQQpn2ALryHlJfTSAGZMfthA2UiUkXlWM 32be43GjuReZv7wHkmDzYrMSw1BoMEQysJhW09lo7LKwQShrw4lRcUfgzz0yWlpVNzgw1M8+ Tx/JaDrjYwW8wcH4eEd7MYzjimp2X7cKmm49FRQYXMeBaEKF2OWHJkw30j421MWsDDziL8SK jNqOgzpLE58U4KvjI9pdM3C+efjwYbjDDK6ewr2B/X39Rw4ehu9zWJsEYFiJw7Shz4NWZF4I XUMjZ1EdhscsJPc6kihbcnHljAnO/0ZqWloPHjywa8e248ePw+Ut8I3H10hxiEEBA/no0WNb Nm6AoVxRUwvVSCTjAuxMZKLNzjRqmyJxZ1FKuRUrDGLrAquEUIUi8z5OKEsHQWywKpBw/lhc yh7M1N3e2dPTU19XJw5rMGe9sP6F3u4e/jFDIXw5qb6pgXxwya6a81fvid7OY50D/UPwnScU YiROAZvjiLQSiUzTWIoOlVNiMBuJibBBTISo2Zh4IEJhmthILVHDo3iOFhc3Z37Owo+u28vZ nZ9hXyTgsGYc55mLSCwGOAFKti+NlFdUHt69c3dFOdznCLdAxpvFMDK4o3vv7l0Hd28tKKmC C2++F0ksCcVGUR1ZKTn7P3q2FCiJhHiIhdZXKVbgzkTm8sniFwy8JYoMtqplSoQCFwdHiPYq IxfGLVBnXlwD0xHbar5YXU6dHKG/CRggSsrL4Kawnbt3dxxtb21tLeFnl3AsOt5x/ERXF5uY igrh6XNLzlhqHSgAaG8/tnfv3u6e7uqqKvY1Nd+XV+ukmYc1GQnEg53TgwptI2cbLX0KxCmp FhSsqyy/BA4PGb9eLi/tZqeW4MDeeunBss+4Yso4mIgEvgH4KokjGHvwtbljB/buLSnesH79 9FmzKioqABNvOoPnuMBzfZ575unO9mN1zeWweIbnimJy/eJCEImPV3WlncQuVVy6vZK5t/4c DK8QPhOZm1ZJlLGsmzEJpXjnGqGGd2Km2Hy3Go8vzlTCnfrlFeXHu46/9PLGnbt2zZk3F24Q g/EBH9xcc901JtZSAyRMeXv37NmwfTPMeg2NDf09ff57loVlfInidI7Twj9WVyYykf2xptIh PYlLI8OjlU1tvYWlf7jv3qXLls2aOxdmMRiTka5yAB6sjnd0bN28+b7f3F3bOh1u7IjwEbz/ kDD3+jHvq+JJrbMhCGeKVhHJOJ1woSTWRvxgyWq8zgEC5bzzq/WiyrmhKBdWQK/k0pNzaddU qBo4haJyrcyF1pGqpEs5j26kb7joaEHz9OaVZ6+CYxo7oAFM8aqGGluYwgAGL7jO+rMf37l7 7day0ZLSyjI2Jgygd0XiVEDEH2XRYbyh3sSokRwmlVkjXtFUyTW0vrhhYk2FZiATfyghhfbi 4rkDg22Z3YcB19q+3VQ3Yo1A+sMUyXAwfXo8GC0W0FqHJVimjlzUIk6AhXqxcToKX7SEZ4zt 276tf2R03vz58HA98UUlGJz+JDCGBQBmva7OzscffeSeu3/18ovrq6rq2OOQGbdDICI36ljB VlkLCLMPGd2JBoViQPgcHAajWMWd/cWT2mYzibJUWyXAuo1fKtXocrCqxLci8U7+lVIFgs4F WokRJgrWqrtPEQyLspLS4urmmgceuOfMlWfVwKu2Rlz4d0JRvuQWupgPAliKP/nnJz770Y+U wVllvbw4igEQI1qlOLNu1jRbrvDUakAzXaggpqRKYZpaK/JO1+vKzCZTOrXdXlZ6ITypU1Wj bmHnuqO5fl+p/ymCGmq+7J7Reip86UIoQxKHhIl9jx1Ti4rLqipe+NOj3b397It39fXV1dV8 ItKmIld4MLzFCN+3b+/dP7vz/rvv2vDs03XNLcMFQ96zi2IJGyKOQmUYfhvGRRiM8ignshYx kSkpMsgC1s0cCDHBOFinBJ0CSedrISVUW+kSqlLCN6hVBdZnUFZVWcCqYMEqFphXeMpvSfGR vUdmzJrZMql5ytQpooPFu2qxuYVwR0YP7j9w329+++zjT9U1NMLVCnFxFJlNg8CashNbVXOZ eSoY0lTKmlUYxGsaUW63VvB5yXVv3UVFx4uLz4z7XaX7aqvvr4G72D1coRgL3DfU3H96VO6y ew4wKd0WwZKQDBIWiBYAdnIAe04RPMel98SJjnZ4eEF76+Qp8DUVrySJQOHSPvwoydYtWx68 796nH3/84IH9w3DRDdZ30HKPxoPDsLGpZLiZlIZvfdooVX4E+m01Bq2t0s+/a+l5ABR+9PMO RuITn5YlaeUBxhYovYKLJbGS2mJ2ZC4SR4UlhhktqCqt3bV9J3yB/MSJE7Bch3vHcO0tZjS9 Cp9jwgsem7Ht5W01JfXsZ0fUQh09Cv6gMD30AW0kTrAptkIgVoSAMI+IbNTRZEj8SFUlLF+v P94Vzb6g4NHqyh83sIdcBr+wOcHQgOEahsCGMSLAttuQjiwIZuqVBxh7cJIAz8nbs2PHob17 d2zZfPoZyye1tcGohhuD4IktcOUXr5oBFq7rwyzW1QnPfTn8xKOP/e7uX8LjQkvL4Y6LengQ tnZ5xgmMlpRrXe7IzDB1jLsssI4tIoQoChWaWgrAxgk9JzKLTVwROEoq7KghjBSM7Dyx61VX XwkPg33sj482NTevPGul/tVx6H59gfbsU890dXbBIxdvecdb1v76ieGB4eJy9kx0NqLSV4gM 3FNTfbyo6JaOzpDPb4O03l1Xc1d9TZpfe3ZHC4YGB5tPmdaxbfv+Z9fBkxYBBvdkHDpw4ERP T9vkyXC+CffswzVceBrVvj27t27dumXDCy89t+7pBx6cs2JZTUMTXC4JO4vZIxgf0sJFSy6x RkqmHnk1Sq3QDC27cMHGIQqxwIViqnAAeGFLwBCsqnJII0wwCxcYqssKNawA2pKyks7uzs3b N3/i45+4+KKLv/eD7/3Pf39retXkv//we1dfcB482hwumcEdZACGJVh/f/+Rw0cefuDBL37q 4/uPHVu0fPmXvvjlvTt23fqJf+vrPHHqKTMH+uw3zUpnbGO8MDzX/ikEHtd6zPSiLbJZfdi1 qjv8tUCoA/Sy7stT7qGAq/43Hu9cFnSaCZfVftBQ+3KZ7cYxxYxJ0OMgRnQ2AABAAElEQVRx ygqmJCq9vG61pRbKMtIWR6P7UzLBk4gXQVVcXNJ15NC8xUvOPPe8S175yvXr1t175082Pbu2 89ixxpb66kmTS0vLYIHWc7z96K59/cPDda0t9ZNb2R38BeyaML+678qEGZ9LrZLBYZpWFJmU lUwSZcO3SuWyNVBY0WAoM3hMqayBFSwwuntLu3tLkpjIWItUu3gDVCuYP1DxNY8CgESpxVbV ZFpwiCCMk8CbMWZcVswXvkALhyk4RrUfOnbz22+G5fezf3l2/bPrWlqbD/e0z6yfdtqS0+Yu njd99oyS4pLDh48c3HNg7cNPr9/7fF1F7eDAcGVV1YqVZ86cd+o9P7u7u6u7rr4OvgyA5LSA oWgKlLl6SAgm+EQGmYB+nDE4dEFP75K+/slm9tqLi14sL3+sumJDOTwcyeOlMuhKoIlXMCVV 6eV1qy21UJaRtjhKjUGpUSTiRfDBCcHQQH/rlKmTpkyBx8a+tPa5YjgAw+7B7saADwRKC+AL eHDKAN8IGISPfOGBY8XFpSVwBzh7XCjfMbW4VNGMz5ooBuUwTeukl5VMEkVtbKUtICEWb7zm wjD3MQEcWOFElvSpJXCzoPVGivCF1IwyXM27+b72owUwSdVW1u7cuhOufXa1d9bX1pdXVh7b vXXo4MDQ0Eh71/Ftu7bDIwa6Dne0Hzy2acOmw/1HWudNriorhO+IbNm4ZQC+rTlSVF5aHng3 rG8cHkq962K2UDIjU2Y0HnFSsfBmceUW7Sot+WF9bUF9beXI6KTh4XJ4ADn80nhxcRf/WQ0g FgtQjN9w5aYz1CdRBaYoePwBjOFD+/Yd2r//8P79rTNnVNbWwuEZvgI+yh7NwlIIT/4sq2QP B2X3QMI/PrIlHzIp+tjd08nFVrhosTq1NEnNmhw3uEqSRyQFwgMUw8FqAyJWaw6A8Boo2Kcw XM/e4SWsCaeiFBCG0SUczPKBQrEzIIkwAy10P3QqFPa8tLu2qbaqvrq8prxgcLSkohT6/kRH N3z9aHvnTsBPLpgEv6fUNHtSWVlJf/+g2MsGe/sObDvQNmtKWRVMZOzGQhmQ5holloIDtyg1 Ee9bL7CSq61mZytKmNio459j65SYsawpmKpLXqE1LYRKJN+icYl40ySf2HAIezNURgXxLjqh ca2A7NZIwwtqLJpSEgZVxqp7RB2LC4046eDAIFzIL6+sgO99wzdSYEyy+PVxycc8GokCy45v TDR9FGzo9QpnFmhdTN2ZOic6KafuHIC15GYDSXePOLXM44lMNFNvbPiJTCSicKSguLwEGKDv 4XMe/ohEyDWsuwvhAx+4wxAI4bQRDl+ghrkPrIQ79hNLJYVDg/B1DhDqIZgVa76RxUvryHnX GPSODj156TUoK0qY2KgZyrF1ShpYwZSxpBRY00KoRIosGpeIN03yiQ2HsDdDZVQQ76ITGgl2 tHZrpOGFiTCRsaMy/9BJjFKzgZ41lh0nVxYYTR8FG3q9wpkFWhdTd6bOCUDKqTsHYC252UAi JjL6A73YbGGDjuSaSzHJA6OzGxhNQisajTKXcsOIpsBFwo0Jg9on1FVyl0OYpwaHQQt2bBxw PfsMEu4OhKlrkF35kpR8FkN7tjSHEyGmcwWCIJ+CJFUIymGqHS9cjmCFklslV1tFTrbESmm9 UiT1pmdlBFtFJxPhOHdKOoVmqTKHQE7l8EmoVCOKi10oE6w6i8JMEhWL55UiBYi+VY4CsupP rEgQRQSydXwDY9a/GZ4/vitZFLfaCqdiiKv92OXBBGOcsiB6wcSonqFYNRhcclNAO9TU2mrM PVglfY2MswKvmjOEF3AWPUIVNWNTZevWX2s9gokew6TbGVBt9TpRhIHpHZuGBo4Xe5+NTbAn oVc9/YF95Zkff0vdhy8F0MScyEK5AN/gAU7exHsGc5lnKyakAns3bJYzyoLLCboXtC69c1wh SBIGGvrDiJWsorGuNoiMihOTjh93ZdKmrMTv48OadFsQPhw2eFwZceMbHkxkUi8WKc5S2TQT i095gukOTLjUTECg1dwGXEKs8HxVhzssWDLah1LdCMtES6oI0wsGO1cQKzcAUASDhDSrAqh9 dKCQVlalFFsFEVsvj46NFaFIJIxgiFZxEZQS27dO4zzYrK49l7/St51LXP1ydJ4sZqiR2mOa ipqzm9i0YWVO3GEtGM7DtxC7KFVTqRVJq8tORMTFVKcoZdCmGpX0YxmEIULaR9ogC1oJukQf UozcaSHNQJqBNAM5zMCoc2pJJ0o+9+G0SrTyyOf1cVCkFjiTLC9RT4oL5SImeoRRMHMruNHU VIa9cBdAwkmdRlBnRl1eTXXQzJghOMoU2w69ggxxBrc8dXdkCNMiVFqlU1sl18PhZuLNgamS BDI1HQVycGhIQSLe0ZOpV2J53VldfsY+Unq1VZSMBWUmpYK4t2FxbkspIQQYgBOKp6lVQfis GCX0xPIonP1CBKXQaitY5DhUlDJsE+PZFl+Yo3RKzA3OJNYrTJ6fVKgITTIlBVpoCdMVOhOZ o0y2JEKAd6e3ozmIaxfNy0mLFj2TQf/kR+bEMCOxpEOHJGRcV61dLIXaiixrbRT7CMyc2rCS xw12OUVJQc2KokqPGBkHJxypUDKm0wnYpxnWHDuN0eEZlYkfUhXUKqGGIwcpSg7IKRkGWHEs USQbRjW0ruHNYpBLE+3UiF2wP38EoXP8JFYCD3DTD9BBIO5Pz7mKqeEG/cRcJkjklb3s5w0b 4RUCArAAKzIJFhsSJF2o4rQjrNCPMFNVSWJyQc0UQAxsboN7U3k0SslI+Kzn+GZ6uPmLwxSJ 8iWE+K5YUICFQvbFgqCbcRDtFPhAZJOs9mtMjpYNVObTGaZaYHDjLdPAQFVRqxxoINZa8a+z sjKCrI3y12pcsmgl0WFAGIjR8VC24q1CxxDjdkSspA5z8vMkJJFwp26zV1qxtSFMZ8nVlGfF SHzD2GDDg/3DVyG1LmV4+I6RbPWQMFdkaqtI/bbaIZ/7xgDM3YdQoAcJd6wYEGvEyl5VaLVV KPQhBI6alVR3K7CjFRLT2KwpGwOZ/VNL061Rg0eUwK2pfQPwhQv40phQlVfCA5RKy4qLBgfl rfaGSdwKu8F1dASe3sQnl9As/Jtr4sGKcK8/n7IcW5i84Ju6o0Mj8FU4R8pL8ExH0A3BQ1cK R+FbvMSQgNPqhMwAHOHgqTuHX94Cv7ZbP+WUurbWkWH+jFa+W8KXS47s3NV//Pjo0ODkJUvg iyYR548JmbMYjZLzRuiJTOCdaV5MkmoilVozDqW0H7hhoVJQUFFeXtVQB1/Xlz8GXlDYfqzj wMG9XT3tc6YvYJOOWogREr85WotCwOC9uLQUnPBvIw3zA6QG8ijCQIQpDH5rvrSkBEzgWRoQ MFCJHMCREL6UDjr4icyeEz2FJWzxJcYiGI4Msd+JgJ/4hemvr7eXt9XDjVVszacVGVroT0nz ydFU6OGLwmjdw8wU48iSo0bVJZmUqp2duFBak9JjxUhB7rqgIz7cMCaxe+amQ/39zZOnnHvh BfAsz0OHDj/76J9qGhvFkypgOA309Jx35ZX1DfBTbwVPP/lUX08PDBgxMuEoyNfx5i93AQ72 BxhaoDN/mJJ94Y4fKvmBFQYpf/HIiEpfB4GJWC7imo4VVHvYrsfVfo/QkJ68NpJLUSKMZwel 9jSj2mkLK1nAkq1Ehm5BoGNLwQfuUgkBvDvBwcw1MNDX3n742muvmzvn1KKSQviyI8vbaEHP ib79B/fu3bd70/M7ysuLhA2ktRgmEx4IWwWxn1Dg3wlnNuykk//YGz9z5BMfdDjrB3b1AZZ8 zGLevLmnzp+zZfPmZx6F55ez3w8HlTyrBR+MU44A1r8wpgoLALNr354FCxcsX7YcfpD8e9// fktjc2VZxcjgCPwawPZ9uxYuWHDWWaumzZgODwj6w0MPwHMyGuoa4Bud8CPntQ31bVMnn33e 2fCYxt/eee9o8WgRm+kYMWaTPaQAp2mUZl6QacZsi7QhL6myCIgIobzAlC4AkptYo4ZGLrBL wOw4fPaiBafMngm1R397n0GWjYo1jKiOsJWaIYxKGFF9nV3NS5euufwVjc3NO17e9tQDD8Ko hZEMnQ7Pcq2qrb3kyivapk7p7+t7acPG7o6OsooKGB6ghAcWsG/6smMkexALSOBwCLbwfeG+ /r7islI4KoM3kMM7INm3iOHZsIODZZWVUAW5mOmgDF8hhtMCABSXlcHTruGkhFnB/gIw+P7x 0CDwl5SWskcz4tMyOCd7Ai3/g6igb4AxG0NVy5lRjNEzoVdkhqOwFdHL8C7+0Azmhb7+ocPH 9p57/iqYC2Cx09FxnOV9BJ4FVgnPOdy/d/9/bru9s/d4WUkZ690C9hhfZV5YzFZqsiPhg1sg H2QPqAAvfAaDM1YAw3TEn9oPyyroEXj02OoLz+3p73nk7oeqqqthnQU9OjA0CNMWXKgAQ5Y7 9g9ldjkDznmLSosOHDuwsmXVeRedV1pW+u9f/FxDXV1xcRU7lywt2Xtk77Kzlq++4PxV56ys rq+561d3VlXUNjW0wCA9caJnxpxZCxcvfO3r/nr3zj2/+/7/jZSPFpfBGIXABiFc8ANeitlH xjG6TKUhg+2Z5519yzv+VieAeHZs3fbrO3+xbcMmIb/nmcd++eM7/+c/v6LDIpXvfvrRX/3k zu/85+1hrM6/8vIb3nrLtBkzBPiDH//Xxx/+4x3/+cX2Q4f9zb/w3f8BwPtveSu8/9+Tf/rl T+781he/7G+SpNbWgWxJVVDQ191T11A/e86cKdOm1dXVVcNv3wzBs1VKoc/7+vqnzZ619Mzl kyZPhp9rq6yugkmKjYVR+Grw4Cg8v6CwCKYgGJxseLKRDldeYPiMjAwOskmHieGIyCfMoSF2 YGdfHB4cgUkHdxM4wMPDqsCSq9jOBUh5PZpPdTBFDg2zAzic1YJnoGdRs/E/As9KAAGouC08 D4stFtioZYj8fKmJDPvDP1QHhiXRLlblUwqvqvMCoXNqnBzeYMHD/4qmTJkM89RTT6195OFH 6+pr4Zm8U6edsub8c9dceD4cPW648Q0L5y6uLa9rP3ps3eZnOFtJfU3j0gWnwc/r9vX293b0 DnT3l9eVv7hvPeBrq2pPm3na0MDQ+p3rB4YGqkur5jSe2nBKE1yw2rdnLzzGet+uvQ2tzR27 28uqywpri57btg7inlzQ1FBTP2X+DOg3+H3yof7Box3HNux+qaWgprugt6qqqrm1pRSek8Eu r8EUCj9gPiSWV5VVFfVNdbX1dStWrZhRPqtvdAA6v6y87PndG1578zVnn39Oy6RJsCIrGCgs KGdthlH4wvNrjw3DmWYBPI1l1aLlpWXwjCB2ddCedZZU9hLbkKNIgl2UygXTw6MiFyxa+NjD jxzaf4B7KIDn5a655CL4e9t1Nx47eEQI+bvg0wQqWrYb2V5s0LMXf4c3RSDRppFQXnHDde/4 wPuee/qZb37+y+v+9GRj66TLrr7q2htv+PTXbv/IO9/L5jI1hoS18GAyOaE4chWCoxMlB0E1 vB6gttoooWwtW8EMDcJvRPT29cG1hcrq6le88Q2/uO1z5c3NJY1N27duvuU9/wAjvwd+SKKr G57MA4fGgb6egRMnevfvW3HNtZ1Hj2584s/w3J5ppy+G6xeHt7xcUVNTP7nttAtXHN63/4XH Hi2pqGyePq2ooGjP2mdnLj+zefYMSNqmtWv3r11b3dZWP2MGzGu7nn56yuLF0+fPhyUhPMjs xXvuaVywoAJ+t7yo6NDWrSVlZVPnzKlvbd25ceOJ9iPN02bA7Amjsai0dOufHj9lyemNkyc3 1Dc+fc/d5a2T6+AnrkvhF6/Z3IodKprMGqwlTLYfhPp5rIZRAGOrKoJSe+fMjtYpSYwca7G/ a6m5ilWEgHhMMON3d3c/9cyff3rnj2ZOnVdWWb599/d37Xr9W9/6t3PnzYWe7jvRV1FcOX3G jHe97+1NTU3H2ts3PLfh/p8/UNFUduq82ZOnTK5vqNuzZ+8HXvmP5WXlhw4eeui+h+Cned/5 oXc2NjZ0dnQ+9fhfnnzwLzWN1fBcuiOHjpzoOlHTVHPRqy+Gp1u3H2t/2z++vW1y2+4du3ds 2vbwrx5qOXVS+/6Ouuba1WvO/eDFH5rU2vLc0+umnDIZfuOysIr3HzsusbhF+uAoByv6ndt3 wrWyV7/tr566/8nNz26csnTaqtnLli5a0tbW9vKWl2EsFtXAMn64v6u///CJ99/6kXkLF/T3 9x46cOi+X93b1dFZXlkOx1gY97HymJHRYw8+/PA9vxeDEN5//dNffPUH/3PNTTd8K4NVWIyA YA988zvfBrPYv73jvcIcZq47v/md/Xv2wrrs6ptu+PbnQ63pYrjOogkc0waHSotgeurrOHbs wMGD516w5qu3f7lutGB6QfH0iqbFSxZveemllra2iqoqOEx27tw9c9nSuRdddNW11/DH8Bfv 2bVr8/r1d379DvhF1Vfe9KZlq1bOX7QIAoYHW+/asePBe+95/MGHhnr6/v5zt61YfQ782CHs SnCe8fgjjzz58B+ff+IJWOW950tfWrZiRW1dHXQu/OjOczfc8NNvfWvPdniYaPFr3/rWV1xx BfwgE3zOdqK7u/N4R19//8N3//KPv/l1cU3dP9x225lnnVVfX89OZj74wbvvuuvR+38HK8fG tslwSpHFpGVArVZkGVBwU7E7qL1RbfWpmsGEXGCFWRH8fjI7bew80bFl54uw4hnuLS8rrq+u qt63dy/s3tU1VQtPm/+6669taGloP9IOK7jTFy2aMXP6Z//js6vOX7l6zeolZyzZs2s3TDCt ra3z5s9bsmRJZ1cnnJA2NDXMmjV70eLTjh48tmvLzlkzZ1985SUPljy4/fltZ5199ikzp3bC WqmwAB7bv3DBwvaV7RUVld/43h1nL1514SsuPv/iNdVVlYePHDnn3LPgKgasyHbvZC54yLwV vAjzLMg6O4/3dvfAacJLGzft+vO+4pdLL7v+8kmTJ0GjDuw7OHP2DDgh6Nh76JRZ09/28b87 bcWSw4cOtrZOWrgQWjHzK5/4Aqz+4eoZHOjY2t73hXqZP5VGmlQPGgpz+dq2YTPIAAZ/ilt1 WUHBWz74ntPPWAqAI4cO/fauu9c99iQSzD5t/qvfcO3MU08FyYZ1z9/9/R+3H3TOBwVVY9uk 9378VgB8+d8+ZWgLC15x9VXwbPHv3v41QGLsUH7s3vvnLVrY3dXFLjiNFsDls6tef93MOczL 4YMHf/qd721/SZ4Fs0jQUitf+YbXrb5gDfwWJOT8J9/+3raNDH/qwgWXXPGqB3/7u0VnLAXt L374v2v/7LSFUZGXWgwScVAVoi6G376B61k9fX0vrF172ZVXrjn3vN0bNgx0HF193VW1DY1P PfkX+Dxr9ty5cILX2dN1wSsuhR+L6Ont/d+vfWP6/HkXXnbZitXndnZ2f+m/vnLrpZc0NjRu fvnlL3zhCzff+Kazzjl70RlnwGG7r7fn/Msu3bZ5y8YXXvjTA79/90duPWPVqoO792x58cU5 SxavueSS3Tt3PvCLX+zasOGiG288f82aZ/78Z/gQCo6719xww9EjR9Y/9ti+PXvmnb74kssu 2bd332BF1YGCor+57nVrLrl444aXHt+2befml65581teceWVu7dt2751K3wIC6s5Z0cISgHo HbDeQaBwRpgfCzGSvWyzda49Sz4wpdZ+nqLowD/+KW8jo+XlFTNnzlq5csWSM0477fRF0Ekz Zs6AReymjZvheuPkqW2z58w6ZfrUjRtfWv/C+u3bd8Ax5IyVSxua6stKSxubGqZOmwqT0Usb X9q9a3d/X//80+bDJ0Gbt27etH7j4X2HZs6c2Tajraf/RGl56eTJk2tqq/t7+hsa6ydPnQIz 3cZNG59//nm4ltY2tW3+0gXtXR3T586Yu2huY0vjiy/BLrluz/a9g72DlRXwrGb1YZDWYLbM LmTX4+CzieaW5sZJTaU15UAyex58fFHc09PbdaILVm09I73wfNopM6YuXH76zl0717/wApDv 2r173oJ502bPHByFc9l++bGDRh67KFLsbU70or/Z+xvefgtYPXgvXGXXB0FhU9ukr//yR696 7VUwhUFSZsye9cnbP//6d7xFwM44/6x//+ZXVpxzFqh2btv2ytde9clvsEtU4sRTOINZ7JNf //KC0xf98gc/0mcxEeTsefOOHTmyQ12bE0IRwnc+f/vPvvltkJxx7tmf/cZXFy1dzLxs3Xbm Was+9/WvwlJOgtXAwioU/uW2z/zNO97Wc6L7xXXPz5w9+7avf3X56rNBDhenrn7D61/z+uve 9f73TdIYdNsEy3CQGuzr371jJ6yD5s6bX11dMzA6Mvv00+EC1OEDB3u6T8AVC3h+Z92klplz 5rZNmQrLt0OH4Lff9gwODcFHRguWLukdHGxoaIBrx2By5PBhmFB2vby1q+N4cXkZnG82NDZC b8Ep6sEDBza98CKcePb3D5RWVJRXV3d2dGzbsmX7yy/v37cP1lP1jY1V8CvV9fXTZ89ubWuD cfj8unUbX9ywbt06yF9FRQU8UXuwuHTh0qX19Q3tR4/CSuLoocNAO2Xy5CkzZ9Q3N/V0dvIh 70qPGC/47tK7BYgVBTcgqiSpFZnjF8YuvMS7I7WV4Dg7MDA4aVLzm25845VXvgo+qIGr8vX1 dfCzRrAC+tkPfwGP973o0gtXrTrraPuxD3/kwzBxTGudfumFl/39B9559WuugSUxu51iaPjB Bx68/b9uX7F0xQUXXPC+f37fc88897n//Gx5R+nqc1bf9oPPL1iw4Kd3/vBY95EhgA6PdJ/o gp0Efkv8xRdf+NA/fwgupd3x9TtWrVwFazeI8VV/deW8ufNeeP6Fm265GX5lvKmv4V3/+K43 /+MtJUWWREH8bEcdLXr4wYff9Z6/X7po8eoVq3738B+WnrkMzlvhV0tg5ME9HztO7L3mr65e vXo1TKA33XITnEqDIcyqd/7kztf/7fUfvvXW/q6eOdNnDw+zX/rK5evGt95y9Q2vFx6hsdNm zvja57+EF/sxkqtvvgFUH33PP4lV2LcLvvKJO7507Zve8MAvfwOz0pve8Xe9PT3vv+nvoAzZ WPfk0//0yX993Tv+5uff+K5ggFnsE19nU9vfX3ejwCCzKLS0tcJPWBEhqV5x9WvBy7uuvUHI X968+Z3vf9/iFWd6fbh5wRWvPO+iC2993/vFagsu/3/qv26/+e1vw8XXmosvQi3xlVCV7aFw wQAepQ/PVX/uz3/puKlj1XmrN23femjL8IpVK/fv3Xtg796e7m4Y1fD7u6tffdXsBfOrqquO Hjt2wWte3dlxHIY3nDDOX7igpaLiwO49s+bMmTdn7nve9a7NL75453e+A5+Pwcf88FEk/C4c fG5eUVVZ09jwpwce+Mujj8BlN/iMsuPw4Z//6EcHd+6qa2o855qrW1pawBEsqeB3ES+47DJY 53723/+9ori4qb7+1w89eOVVr4brNrDagjPQ5StWwg44NDLS2NY29/TT9u7ZXVy2ZtnKlcP9 /WsfeGDhOauHC/nnEgmlKREaGHjO/hlm6nEmKH6egybiOrSowjv0IbxY1SkpCdvzcZqDS+dF cDV0/74D23fsgJN/+OiltbWtuakRrnBNP3V60dNFcCyCc8bmlsYHfv8AXEeHD4nhAmpdQ92S pYuf/sszsAQ7duzY039++rSpCyc1TQLA8Y7jL61/af6U+YVTChqmN8FJX2EJcygDKSxoaGiE O3F27dy1af2m5bOXrt3+/Ak4avd0w01hEGJzUxN8wr1n7274gfErLn7VI08+urVj++7de+EI B0sMaBH+sfbAC04JC0e/95Pv3/DmG2b+f/a+A0CPo753dvfr15vudOrVKrYkS7bc5YKNDRgw jm0gxsEmQIC85IUQQl7eCwRIwgsvBcwLgTiEBIxNeQHjYINt3JvcZVmSZav3ctKdrt9Xdvf9 ZmZndnZ297vvu6JitDp9O/Pv85/Z/07b3Xmz0JnftXb39M5pdz3yOD4Njbk2TjVrziw0w85p nT+/5x5aTKwfue7Uzo6h4aFsNpMfHMF+SG4hp6euiz+8sqgMCrGHVSAsKadefdm7duyUk/2c /LZPfnz/rr2vKMNGDJDWXHXFuhdeWvfUWsn50+/f/aXb/+7K9737xSeeXrhk0T13/7iHrg9Q /FP3PYTfvTt28XlELNUhiiEOfvpDv9tzkI03pRSuUpYi0m4KpAy//Nm9+GNpFx2xqZ2dHoIL Cf1edPmlmGOqb2y89B1Xc+TOrdvQEcO4kmeffPQxGdRC3EGA9FwQHJ0LjEPpBQ/rMes/cPTI 6xs2Lj5z6fy2tsKePe1TO35y193otmNLBGjwWV2MHFPpDBYxr7vhBnqDxMYL18HOjL27dp+5 cPG/feMbF11xxZqrrrzuxhsTH/hA1+HDjz/88BMPPrju/vv/raPj3e9//4xZs5avOPtDt966 ccPGR35xH4aZmKG76Xd+B50vutUJnbQiXaDHhB2EY2IOgazOdWtrauqwtW3HDswgA85LhE3j ndOn3/TBD2LSjU6eYEsA4loRW3ndNN+sBUKPlnGICtVGkXQvAD0EmmXYD2OWXg14zCPyxfsp n19qBxJWc8P9QKYQTnwyXBroQEmxIoPOy4//34+/851/haNhE7own/zEJz98663ved+1P/rZ 3XAlHHrwwCF0g+vq4Hy0CvpF+OfXPo/ZfeyKAFdNXc2+l/bYMzENSb+9jJHm8NEBrEti6Rkj O7CgNnwDWApcOEojdKc1VNAd/6zQcAsSdOcGrRb6j9qJ/5EOpVDQU/yuHbs7O6euPGe586cf Kjn2r594GOuVl11xGfcyBGJxsre3b8P612gfnmBm0H513au7tu1oTjQka8xi/nh3x2BzYLLf Jf9KvvG1O+/4xGf+8PeeuhlYebS0tj7x0CMyiwTvmmGhk+/52rJps4p96hc0lnF/XnntO3Ep IotJtH/6/N+oZDJ95NDhs1efI7Nq4sbfuw3Zn3z7u1jK/Mif/OEtn/jYDHxAKJfDUFQlC6fx OW7s5PjTv/y8hsK4kkNeeeFFDTUJWbQ72ilLZHIts2Y+ct99ixYvett171u55tKBvr77/vmb Z175diwdImAlTKvnWM/Q0OAbr234P1/80tMbX4Mxl60+b9rUqZhKS+Yyi5etePK5577+7W/N yOUufcc7PvCRj1xw6aVNTc1du/din9fn/uzP+ru65tfU3PCZz1z73veODPRja8+8MxadtWLF j7/3vQd+/ettu3evmjfvWz/8IS4H3EQPHTww45xzi1i7PHiw/9gxXAjojuES4B7A1M2mDRv+ 4vOf37759anYL1mwP3rrh3u6ujAv2bpwCX0sNPpamAT/VSOy0kCGO3NQLG+oAuidORCtWMAZ j+gOBQWwHLsPuPlB0xmumze/A7sfNm5ejzkC3DE6prUjvPTh6j92LF8sfPHLX2JfCDcWLFj4 qY//Xt+x/pZWuiUHARnTEG6RbdmDOLr8h8UWfFMeJyCVuS3RE4Q9MJRNrwPLohWYmO1Huo6i yzatsyNjl5549snmVOOCafM7pk49fOiQF9WUQvC7AZ8+e/6Z59dctmbZimWYfdixbcfRI0cR f6EDo0tw7EEPcFrnlLbWf/vqt/cNH4Z1mNr47Gf+BDfhvl5M2RZq6nK0LMJ/SOIQOZYZ6w8X Jbl1mUE0ppP4YFMjwxhHrdKm9lYpEAkQq1gVhRj3lT/+H+/98Aff+8GbMOp86hcPqliaNgh6 hYhNyy86D9FKyuF2YQfGG5te/wlx/+Av/+fFV1z2nz+4+/vf+pdXn3nukndejQVNyi7tlwkK pXNGb76++Y8/TDeX+RhWKow6GYn645OoUJ4WOM8lmmd0et7RAA8SeexnwBMfbC9qNvfTBx+4 9gPvP2PRohnz57368ssbenrORI8MC42JRLa25sn7fnH5FZfPnj//PTfd6NyDPaqp9/7WDW1T phw6uP/u79zx3/70s6vXXLRp46YXH3/86NFuPAaA2a5kNtMxe84Nv/3b0+bN27l168Ft2xGY 0OrQFcIWiilTO9KZTNG2p3V2zpw1+4rLL8Ogcsa8ecOFwsP/9Ys1l17251/4AkboPd3ds+bP nzl7NvZnYLYXfbeXXnjh0ssvv+btb98+e/axrsNXn73ymmuuufdnPzt04CBCHu9iqqXmt2oK YV0w4S7keVI6TMFQapFlZ5GhCHoIJh3OsVG/XhjWURDA/3TEePJSqG8eXIPuEH4xsmuob2qq b0a9oqeNI5fNAb5/73784XbR1NiYTqWwAtXY0IAqOXakh3a12ME6l7QnS3d6IfjBC8y7OFMA v8poij43Tnt96ERRnV5wpim2SQxlw16Kgd6+ttZWrGzOmDl92bJls2fPztZkw1EMxIyRMROy +Y3Xu450YUkB++B27tg5PDRMzQCSGFmS2bdt764tO9FKGpsaMf7FjEZdPTr1TXR/rHiiYDye rYCXWsP+NFq1Uly0fixmBSkMjCtXXbBasFMhV17/btC8/MxzG194BYnltD+FC5f+Nbe33vPK k7f96R9wXZibx7zYv3/1dvTLbvvvn8J8WVA4zd37/bsx//WhT35MQ6E7hgC34ZV1gF917Tsf uPcXP/n2vyHYoWViS4FGrGZh4o6t2xYuXtSszOUjfv3jv39HhagsE5xmDRzTBViRx5w99qXC 931Hjhw5dKhULCZMcx/W2bGiSXek2hhhoNH2He3ZuW0b5grnLzrjgvPPv/CCC+bMm4vW0t/b lx8YRHiaNm3aeeefv2L16tlsdRgLL/v37CkMD6ezObTS1eefv+Scc9rapuDGDy1H9u9HpxU7 KqZOm4Z1/FWrVk2dMQMb2hAZa+vrN2/ejA0cS5YuPfucc5atXLl06VK6axbW4KGCQuGN117D 9NziRYsgc8Xq8zC3i6/Bopc3PDgAO3m0qshdgZblhRMJq0hCNUSV9siqkVkpLR3B4QpwiE0G C253fjgPbxKHPqhYKBYwa4Dp/4cfeLz3yMAn/+jjd/7gzkMHDmFvCyZEd+/Y/foLm2YvmIPt GqxPh2sIYvAYGvwFAD7CLPoILAI5BgaYNGyhiUM+HwxSnzqwgC4nQyuw2O36wD334cPNV137 9jvuvAurNqlMurWlhccaUNJapPGJ/iBLU7SCSI1hPfTIQ7Pnz7n4kova26c8/sCjfd3H8IgS GLEbe2ay89WHXhw40Lvy/HP+93f+cd+evZlsFuMybNzdsWV7LtuSTCKcUVnH+cClzsynalGW BUsWXXTZGuzm18x48N77/vTLn//Sv3ztu1//5o6Nb970ydsw0//mps18gPnQf91/1bvfiab/ H1+9HXHqo5/7NKLSY/dh6TNw3PF3X//iN/7+t3//Y//0BX2AiUj30zvvvvnjv/vFb339p9+/ i26IbW977y0fxAIoelUIXhAEmedccP49U+7qPtyF7hj2nQWkhzI/u/Oua95z7d988/av/sVf bnv9jbMvPA8rG3gkFuwh2okH0DaBe3NjbnhgsOvgAfqUbiE/27K2vPYa7sf1DY2vPrd2lpEp DQ0f7cL3dvfjDtfa2PLYLx/ARqLrb7752uuvR5cMGyO2vL75Z9+7sylThyCOhYIzly//rQ9+ AHf6gwcPrn38iWcffvTA5i2PP/ggdmBgjmzFylWYql+/7pUXHnv85ccex3ronDlzLrr0UlwP GMm+8vIrwGK4gM+Vr12//j/uuOO6m25atGQJRgy7du7EhsdcLoubOyZtHr735x0ImhdfjH0h vENw/89//vKTT2Dds3XWnFLxBMyBVFJDowUyWif84BewzMuEwMef2QUvIgu7Zkr5Eskn60oz Hn/0McSm7v19Uxtml/C6C8eZYk0/vK3nV/c+iM1iKxeu6u3qxdORX9xz8KaP3NjQ2IhRJzbE /uDrP8DeiwN79z/37POYsR7oHaif2YA9Nbu2bP/VL355cM++bGsO/S/snn3gl7/avPH1eQ2z +g4ce+hXD23Z/GamKfPcc2uLxeLenXtrG7ILemdvW791qH8I35g/q23xQPfAvT/6+foX119z wztxP9zw6oZjPcewMoqnmuaUOpN5s5jE9n2SHynMIdMHdvY99sjjqURidvvCVquve3vXf/7o P1untO7btqczN7XRalz7zNpdO3cbzYn2umnHho995pZPffRzvz/vjAWkpwfN4qff/39vPLWp YVZTKpekH6aDm6RTuctiXMqRUbQcRvFhrBy1UakMfb1YsuR60BdDFPvXrwZ3n7ruk794EE8v 3Pqpj3/9zu9wSkSxv/nj/8Fqkvzgn+7AvsrrPngT/oBFxPneN/9l58Y3OCV+ubWvPfXcz+/+ MR1gPh8xwPzJt7470Nd/460f+uLtfy8ZH/rF/Xd98w7azyMEg8oPfex3//3+e5BGX4NnMbp8 IhQxOTsC1l//+f/69P/689v/g8ZBHIiJX/7sn9GCc9fIBHDs5sSo6A/Hc7Mp0meQJBEJzuUh 6Bt7SOO09tdeeunVZ9cibaSSc1atfv7xp5/95cN4rjjZ3DBlyfy9O7b/8J+34nPRRjrRPGs6 Ol9PP/TwL3/yk7MvuhjdtM2vvlIs5NunzZiycO7T9/zX0z/8USqTXHjFVSOD/W+89BJmdutb 2toXLfju33713jvvakRfa+b0g7t3b1//ak1TU8P06Tu2bPmT975v9upzzWwW604vvvTisoWL cP/EgPSm9163YPHiW269Nd/Tg+vfrqn5xb33Dg4PjxQKiJKd8+Z/88tf/mF7e2Nr65TOzq0v vTTU3d04d27TtBkIuGyMESi+P1hhNSX8h3qTLmT0HtbjDeYA9PwXPInWE1AoSINAY9HSKzgk qNajkkCeoGNk5dCxDAUgf/7RYxHGiAbhtWzQoi+7dc8Rw+hqbWhtrW9noY4+UzvUOzLQO9hj HVg4bTFei4HbQr4wsuPIdqQxIZVJZGY2z7QSpl0oHRk82jvct3DqfOpfxx3ID+47dmBh2zzM TEA7sjsP757fODtTmz3U19Xd372gaXYil9nRtSObyLTVtCbSSfTo+g4dy+eHiuZQ58z5aNMI pgMjgzuO7sGUXK5Ack7WIqlho3caxaJTRu2HF9CZHO6hW6KHrb7p0xZjvDDSMzxwbOCQeXDR zKUIo6URu+9w30Fn37xpZ6RTSdQ3Rsyv79+KUiCNqZM5rTMxSeJVN3eW9C3LarAg0q9OTsZ+ ee0E+GSGT29oQpBV2PnNhgrxuTwGClhz7VX4xYrkzo1vemB2Ag6zZmeeezZy4VkwKSrQdCS/ RDPIsovPw+YpKuc+bzbN4zLoYuXSc1bC4XR0ifHsRXRT2DqWpqyqHNnUCFlx4Xl1DY17d+7c ru6epQzKofKKS0qBRRuu8NOkSqTy8r42pi54u6GddKwvYQ80ZUBvCQdmV1iLQutCWMEwr8Ce ssQTjvTdBybaPB03oO+EASAeEsIAL0kfleMS0ZbwICZFFouYjWNg2vhxRdAnyfEIJ1J4mpKu ZxmF4RHMynXOnvkXX/kK9glgcIrJ6HlnnIFh5re//vXX16/HppDG5maMf+k4k2nE7lm8vopH JS82KcVjBZdF5wgvqwcykCrHKIFMUgZ1cbDUR7OuMTiSHBzBC2rGdGjylZZDxWnXTKCRCXXU vdgMUZsiRiNeKUFDJKtaVF0ibWVqUw1mI5cDyiRm0LKN/JrHrn28GIBqMYxsMiOEI+emLHTn 66GejgBZtqm2gS8RZNPZRqeRBjiD1GXrUngiHPUDOjzFm0uSZBaRhfJQsSYeGWnKNmDsiECX JCm0AlpAtARuPB+iopHhvWl2ji15sqFmxkzXpRqMZtrCICthYuW0wW2iry6gRUNzSjXXNLBS ol2xVxclELfpqDbykGDN2+MnjpAglUXgPB8/yZYjgZf2yAS2X4RDmCZJEnO4p1DqZej1T60N NXGGcA2q4r4HcY9k7MarTz8vLZEyPI1KHpEuJNCjOi4ntHKmBybhD63CQltiB29rtA3KAxls OzMcPM6LRAKvsTNof402SZNGIjwujgUENB36/juKgkjTSjoEgc8FG22KFlbAEIUwVWGYKaDo gZYLaYhLyRQ2ULjdhw49/djjM2bPxkgTi06ZVOrpxx57c9MmzA9gDQHTO3gaAXsFMAcD+WAE P53PY40Y0gAMHkoJKEJkOZ2fC/EFpag5n9RPqXiRZnHH0xPXIxMGeDw8KwMWd7+k8eGMXIHT vEZM7zvCG6l0As5HR5p+D9yrU2wwxg4bHGZhpAC/gxo0yXSK4+ldqUCf+Eft4nU6CE3YJUO1 oOYsE1GOckE+wg2CVCpRKmDzWQl9Zith2XnMuzrYI0ZvY9jzR6vcTSYxrITJRiFfgA1MjgU5 JIGXqOBmRw0AOp/Hl8f9AwogkKoH4wjeFkD3vmLVFS2wMFxAFpKQBQyMvBQQk0b3Du9ZRB7T wNh1iJXNMofQJ84B0kggKDhc1ojk4REA1nKIZPfoWXPQgIo0KYY5FnTMK2F6Scd7d54EEEtS QcEUioxHhxMFU3JRAH7X8OlYMRSgR88JImNWJNAXyFWqeZ4OGRwmYZBAOTQmVhAKk1EAfsA/ ftMGnFeHzFKBFEQvETQh5gwK4wdvnIhNGoq1XhokoYUegp460fMjNMBnuGLo9ovh/r7p8+Zd 8ra3YcYA99OhoaG1Tzzxxrp12AuSxg4n9v4Meh3goOz0IpEikajOn8IjgTJSyapIraB6NkAq Msy3GIYZQyN4CCwRO7QMKvL0itZFC4hD0vhwpkaBMzKFGEmWo67RyTivgEKmIGYI8SOAwp+C XuB9sRIiEyFaiYlIBGqP4yvmj+D1JMRiIiwQ6sQ5QBIJBAWHyxqRPGMMZMxeRRfNiyxvBVSD gEhtSHgljUJRBt0RHh0F4z+9gpgwJWax/KkWyJjRoZ9op4TIogC630ATlBZBIOQgmtDYhrdu 9PW9tG1rvoitl7SXcPacuY2tLWDEndULYYIFZ02guPAUimAyQC9sG2cgC8iU6tBIRCAbZWjJ zRDGSAGjJDQufgmBx5PDTvjRyZhUnVio0kInwCgblcCKyEUh5yVkXrBXfUaFewo8Vr0mYiVS 3VJ/dAXE8gYRklmKC+IryuntTggVZyEkRkcQTLsLYASQsusiuCiPw49ysqqEKsbIyXwRPCW5 vKyuRXQOBJ9mngAHCi2Afq1IQ1iCx0w9YkquILGX8/X6KaAqbSRB4QFrI9WVB2paAxZpnLRR YzSTq6+/9NzVtKNIp+iwW5tOzdFxKBtOajwy61kdNF56VQNzLlFfVDT+UxpuXpDaywkSzqv+ hssEFhRGyh8lkKmyKkyHVYYZQVMJWZiRQ8BLixGHnhA4d63nYCFxclUKLSfVWfMAty0SqJmt 0WjZ30BPav45oVkMFzHG5JWAuEbj2Qm1Z1TlkeapQD2QKQ2MkykARZvsNwEGCnkfVUj0JCXT YTQfBqoQPy2s5hBNo08WpWJCYFSFsMETyLRqsAnRpQuJqgqp1y+7BFFLPbCPVY3WFSAvmTmH lvUYOFTIFGddGqeSEnQ0rXOKFARxYhQSKYLXu+CU4FCCU5SR7KsHb1k6XTYTHbbAk1GhqDC/ rkbmqyDlPBpDlEW0D8emvjRaqbRMQmfR8lHqIE2jipQfEU1jpCnsHgUmnqOPOHg0NWsKvHmG CbgoKVAGQQ8iEOLsFVlkPXnls1IpJ5Me8bg0ZkkdldD66YyE82tS4qomAOc8PoinNEnCDAn2 6RmqLJNgrvasW1Ytfyy9NF4WJ5ZUCSEeV4iZDmYjLgNBzs+VaApLqZCrjPUThaqqFGWVSv+V pYpHBvmrGvMGWaUKCZbu5hAvK9GCQZIJQAVn8LAlxApIVRJNlZZVKZEuj9WItex4eDVRp7On PXDaA29FD9BIiP/60DJU1EDE1CKLkhVk/CwQ4qxLVeG8gyYhcswIiARKfgmU3TqO8ilZimd9 YNA6Kc1L+HQUwLsADOWxRfXRPFZG76eREqoCwKAGHxVJ7KMnNaXr1mwMZLkHFJCShJHRouTo NlwMn8FPaVQSEVTl6RKtJDhG1UQohmlCOKFUwbORNCGRoVYppHhndoobm0RIU0CMlf6UtcTT o/BFJn0yP8UIFeEaJkIOoyjfL4sTIuCePpFFpSgWQGUwp9QZNYc+WcjOITIG9qip7FEDmcdQ 7UkxD2qQ47+6PQqZr4EDVZRMy4RPfTo14R7wG92Eiz4t8LQHfA9MRENDSKBRYZRAVmng0CyS WcrPb098O4NfhspTldhQCQ0zpSK10vxRqEFXoeJRBI0ZHWlpdTbphQiK5DmllxppKp2TDNGE zQiKlpIYs7jTSeiEJkQxJlToBAiL8cj4JIcdP5q8STFjYpWOZqIXyJSyj8YRbR8VIDvUXBp+ ZYIz8Qk5DmT0AVkesaZfUIuzlMkBGrXomQrqGKKAXn9k5I1XBbOnyi+XyhZS7CElM8/HkXGs RizlR5stZVXH5knl3HJI7mWFSilbAOg5To/vMZU6lOZLLr4QPxUijQdo4/rQE3xMqLReFi9e oMRIcyS3RFWTCIjxREmJElmNxEhaKTISC2AkQSQwTkKF8DiZHlygtRFkrHBBzwm0+hXIWD9i 7Mmb2Vgm+yNt0lQhq0EiuY4PkBtz8thzfEodqUW0jEjkaeBpD5xyHvBatD60jLvaOVxiRefL A4Swnjv4DVJycajs90RyhYkFGbWYTfJSgH/rDTJ4OXm9snwcsWelOHkzi/SZ84hDiuQ4SaPB NU5JxuHliTVeLSt5pQP5zUL2WbguQRYqhURQuWK2XNNRPiskSCoOEINKHS3s8Xzg+ZXmdEop MJzgXH5hgt08XRCnE/UdwjLxnjkhIzRqQRY2SYUoTCqDBEughKjcIi2pGKAsachsIUM7j0eI zhvM+3URVBmkClVysIySVePSspKMJ8JYuaKkBzKNc9RsjHlqdwzaQeUVP5I+DOSQMDzOnsop 4yT8RsPDDeQ4u4MbwH/fcnV5vL0LfSeZD7lFk+qH8QYy2eBHd12wHLhrxrGU7y3EcUlLJinB 9QYLUeltZ5JMComt3DfBcqh8HkYFhfREAyRLUHhEH4JTamSeUA6NxkXr9aEVcWlE0mpfzKmf kr10XpTjW0bNwdyESOAEOloGsrEp8rg0R2lZaW4kXAJlQjpfhXhpqpD+V1HhLJdAf4PFUgZl Kkl0KSRFUIYEewnNkgqJy5PpOirMT4rQCN1cj1bwMF2kOXxoSIlH5WcSPSFSFr/LCSleztfN 6ARxCEvpBNLniU5pdJVZK0RVRO1r4Kkgk48VQrXzqAQavZqtilcj1rKq2DLpOC4dHswHc+Xa zARM9gf9X6YsPgosGlc4q0F85tOp0x447YHTHvA8gFhH/+hL/jhEDRxqWsVKYgkMUwIFiYDz P06JX5mVLDwhs7pMZhfFMgqN2J9g9sz39HjSvJMH1E+CxZsa5gooEUMEsYByYRysCRa0uoZR 8pJNEyfYJF4AAmdhdgCIDH97qrZWIcz2HCZecyCH79GqIocmjJRarFktRQg4P0uwZ6eSV5J6 IcLEFBJi8FR5PTMxuy8M8OgFNqBDo9FFS3SAyX9djF74IFl8jssNlSOeQcPEccbBNXaeLU9c HgsJHoGki/FVpC7Rh9btils6iBSiMzOTYA4MkUPLMI0HCVsrITKhMWtwZPmfRiazKlbjlTSn E5PnAdkyeZsYWxVIIbCzWglcrydBZqqVMnkOqliy6oSKmSaZcPLdeDKUevRAVpWbpdOQkOmq JIyHuCqlJ4P3x1PYcfLycBEhBE4MuSaWOIKfgkICAnRaw+DE5VkC/Cdl5gTbr/l0ElyEAp7g MpYt1CiBrLx/JFYmuC4tKw3gcInVsj4vc5hOJrzIB0XaINfnlcoqSAghUhXlEXq8QCyzFcij JFxWtVxc+ChcATNVcySCCeDjLPmVDr9AKgtNq+rEUJ2CAZcSJQ8lpkT0zIcJkkzyUpx/jDJ6 9dSHNfkSolJMR9x4hBsQNEMpJ9OlYzUlEh00TOb0IZJEaHJ4NigttFAv0ZQ6kAllpXiNTMK1 RCRZJFBlLEMQgWIgHx50hQ9XFchyBYk5SRyLFKA7H9IEzyiBTIqoPKFayNP4VYEQpWWl8Di4 JDidOO2B0x447YGwByoNZKLzEpDAo6GMPkjItEqnwSWNTHBiThYJBAGHa1hVixRCEyJOawZJ cJAxAJYqtNIFWXwNGpxnNSE6jejDBBTrREpeilNgkjcKqdDFJMuXjjNJFTzrKxIpeT/UCVg+ WoXglSo0LRwusWqWpoPsHlb20BhWkmhLFrqoyc+XKRqUKx00RiioZWkqMVAwRdPGYWPg0nPR 0jhU4y1vrUbsy9WajkBUKw3yuYqKAllc+VQ40mpWGOafVayaBgXPxgKjnKER+2oqToUlROkZ RZwUQnllZhSmE4CWl7Sw0Ssrv5YEkBoGBMtKGKf0slyOxImSeNJEVsNrWajw6f2UYI5uDRIb k4iQE0NZKTgsUS9HpZLGSRc2hAqcBGOiFY3T+rLsE6ixokCmGiMdKBMqVqYFlkdYL/wKoKTy EnFwnY7lqyKOlHAaWN4DqDO0MPiZunoC21p5racm9lR0D2w+Fc0u30D0d/Z7YUKMfbx3ZIRk 8FbuEYvbQzgrIRDAfccZhTwKE6okiYfkvFKCTHhoIU6Da1mtwgRWgNm5fG/WUxc6CVF+uTiJ EO0xcDINGBIWIEZmbCaJyEO1yc96yXdsegZ7U/Bqr4gXgXFRQzyTkWcp+sOpGcTDenQsRzn5 4aW8kyDlZ4jzCQVDxLk8kbBbyNQEMGbFe8IEhSzMWV4jZ42l4YiwUEUjTQbJIqXpI03BFClJ A0oNGjxGEahGtZhKimdX9ASJxCKTQsCSQSofGwmPBPo8wRRKgr+qe2RcSNgNYYiqjisDpDxZ nHBV1On0cfMAb0+VVNlxM+m0otMeiPSAHsiUVltFWFS4fC1hICD8jxNxAvmQlEbPs9oig8ru a4qPj5EPV0pG70IVBVXu5JREdiA4XJonyD0xHK4BpQqe8HlliiF03iBWExKX9UoRREt75CYI /fbKdMkpV80SmUUCongWGqRYrk3CedZzlCDyzhpR0M5Rc0KYINR0eGBPh1aDgkdYwErLBDKI rGBBp551vSounJbUQlWYJAyRTIqDVSopixIqxJQm3H3jnBoZB7JfKU2BiWQcVxyc8wmsOAeh WqHiemqcTHS0Q+VkMmOqVViPs4EeGa9TBUiT0jat+BIeoFehlEFjCtCKTCU0gtY/Uy5Vm4+Z gJQ0qQoNkkfol4AqhAjeCs5jkBpg4S0majivGS6yuNqpAJFVvC/lSlyM/ZIwBj9W8GTJrcye ydNekWSV6ERVQFlHqQaWJZwYpN4jq0RqyG8BgJgp9goCnIoGVM2qaVV1HFylOfHpU8PKivyk 1UuARy3mcW6eATtOZyr1wFumliooCG+dykPjASeJW7bahkGAcYoGUe7QIZSQqLPocGotaDhZ JHEYGIZwqRwuyy+yEiB0lz0LLo+ofLasJA85St/YH+NwVZ4r/P52JTpGo1HHZFKyp492c71a EPXgeUwMYSSWquE48HpEmmopNAjnYI1F0mrwIGtYkeTjhB63/jrZoBRRFgGVteL7X6CEF5D3 DeMpoTmyOJJayvYlQpSQFYlFrQs8lS3SSAqVDKaVgmZBqnFQrZKLZrRDEe5jIoFAx8EFZ5T7 wKXrjzBRSMDZo1Z1+Wk/pXCwJFyKPzCPpUemCtOtFTgOx69GoGU5eZhMiDl9Pn4e4K0lsoKO nxGnNZ32wJg8UGkgQ/tGQ6+qlceHLr28HgAAQABJREFUJy/AcoFxMjW4ltUK69/MmI3liTVe meVcnnGABqXInE8gOcskJFsZmolASavKK9TJJLVEMGN4TiK5gZIkDs7JNKwsnGSXECQigSpB +XSInQPiTIgRxjsP0R0LrxWEFMWIOo7gqkyqkLhCsshS6rx63mMK9dQihUUDY0RS4ooCGW8X SutQBFKoiuEoaq0CpZrCEAoNHQqXp0WBhKjHB+CSx+ZZygsDlQg6BltCSzmKY8cgLopFSvTc KL0pEUEuZYzJEZRO0tI1UGTYrw/UJQTzoZw0wcdIsT6IpqSKIPiE5qRNEcWINcxjqoYlLEsb VKoETP5YpMvSqNLKpytkqZBM1TUGFsleUSCT1CzhqVPcRiFKllJxIglEQqYlsQakbKfWoRbp 1LJ8PNby2M3K7jugfBv06eIVV0ITz30a8xvuAT+QVdKQGA1+tE6Mv1fJ23zFmrWMZYpkv70D qMCrqAWPSzCLs5Qg1UqIr8hX7yPHmKKi8D+k3hMXhLMc5xAINpDhmQm0ihulFkno028tXhUK 3bwKRU7ciISggBAQIc+6Bz69oIw+K3SMNUTFoVSNJKUZeUiohAQTAeIYGV5dxYrSG3WAUCrw oTwlEUGDqsr5MitgGw+xxqtlNeVx2Dg4Z4/D+nCeYn7zgZpukR2VQBBWNrTk1KLKdOHh0ZWg lFr8hERBikxLdBgiUSdj4hQzd4JcyEutlV1vFEFdGnEQ6eUqoYlkPA38DfaAbHd+jyzOG+E4 FUcJuNcatUYptZXhPCEozc4JtYHLlhsdPNkxM8qVay7vSygFQZliSXaPRpDKnQHcEg7WiYNW BrBCDkgkXBUl4QphUNxk5KQpilaZlMjJ0BwtU6qURkTTBaCSKQBVMlpXUsH4yVGF+KShGlRR 4fTkSZa6RlEBZ8qd/ZJHJjRXa1neWpkEyTF6QhcS5IjEVqAispgCGBTKcwIXVC9zQRYJHoVL 0sWwS3yZxCgqRpEc4mYNXINqMiRWh7O8BEaGOVkQKYRDJJckUBMasYLSMDJbXp4iYGKTMjyM +95TqV2ixFJzpYwKnZChgKKSFZJx1qqIpbZYrqj6jCWW4somwC57ZL6oKEURYkCmUqppUEus BueCIoEROsTNoXL6SCETCTyhpviVFFMkToDfiTVT6p1YsTGFOA0e3QOyRkYn/Q2gQLOUr/Hx mmhUS41wmje9LzAal8wKoYKO+dS7wwmi0A0vQMxrASBB7qX8bDX1FCFaZa9EqCoiQC8REioh qo5q0lKSYAKACY2VzAk8Ps2zegeNCpFPavBegOTgCvArRFELhHYkgwYEuxAYTXtclAlHIBfk 5AT8l5FJCxiMgTiHJySe3RcV0MfBARkepSQbRWbQNZxLskh7tTJ7HpI6fOtiU1KmarKk1rDK +pqnSiOoREic8PLwSEVgqRCu9e6lLp7Q3aih47MRPbJ4Yg+j1U757KjSTjECrbTH1/q4tiKt 4AT4PaFmSnNoQrP55DEsYOWpltG8eqqZP2H2wg/cFQhkx90nvC1LteGmzVESrmXH5wQpNSxG WhRGeZAI5jCTBwkjYsVOAkLTHmF4ZUrHJkfj0lSN2RhNzsmV5WWupmzlvRRbOk2FzI5J3JiY Yk3jiMmQWVYlFLr6a3xkV1nj5O6STuNYtX8LCHiDBJNaorLCg3YEc3p3hWMhjifwSx0jsihX WU2jYDU3alldsm6oJNcJJaKKRLBq5ZtjuQTPCcEa9ResWY9fX4GVuoOS/UJ4VkvjKab82MHn ZcIlp1RVSUJyadL0qhJocfZkS/aALml3sLABmtEyvmSe0hRLdomNI+CUwPoSGUih10ZwGqFU pSXKk2lYLauJ0rLliX0sTykFgRwfqwmVWbpqOdYjqGsUKWWIoywfRVqFaCjFWxvxy7VDUYmQ Avstsl+H6cbFC7IkISm29mERgj+wOMyD/LdCjb+ZZLKdcT//ZjphEktNGzGbzIR/aSN26R9a sE1I0XXxyw+02pRB2zGuaQsJxuI1X9drzYL2rXcOBbK4xihbK/NBNJV2s+JhQsQRxXcC4UcY BYmkJl3LMtqgOR4HCHlUAglqEHU94JJhYgzSiOYiTnWYpMVwawnJsOpOMIPREkoGGXFJHyE9 xDjqkm5iIOTVEzdrkBpC0owYZFCKP0iOOKKMlGTydu5DZIondHatfBr1RGRZ2X01Xso7cXMk 1v8CQHnNkkEplFIyjlYAlCzAE8gouvy+od44FKJqk5oyYZc4e+I0Kt6ljHUIpxZrKLJbFOzp BsscNhsWgAGBCUfJdXsdghbcT8gQITlCZlqkwTJqDZI20TSNpKjIkkNGiDvokkHXHXDcvTbJ u7QR50BJjDqThjke1xxXGsaV62XkUPGrYbWsoIo+xxHHwjXvB6XGcYEqFMgYpypNTQfFlsuN jaucxLI43LTwh3Kiw9XvotINBKwG4s5JkDZiT7HcesOtMdw6QupMB40hZbiW4eLuhQMxC0EK jIOu0ecaI64BCT2uecQxjjrGQWIcIsZuQloIaWAdN7gM7SE6nJU1cmzIMpVXuUBNyKTWjtQV p0USqPbHEas0b/E0XED/DBa8bLeHXp3GjIS5IEla02atZdQkSJNl1ltGzjIyFg1MaTGmgk/R iPOuO+w4eZsMO25fCRHQPlZ0+opIO/tK5M0SbcGIa7Um7a9hPMLj2kS4NbJOJ0JwpTKiA1ml 3BNBN84WzNlRiSPMGMSmBoOGrWmG02qQuabbbtnTTLfWQPfKRd8KVZ+mU4PERCxjLOBFhbJm YORZPw6xrM919tlml2nudo0GvKTCNdKugVhpu8Ywk4A0P7Qq1LKC6uQ6a0ZWWwXjZI/0xWTI jFQ0SUDuQ60U5XVJt3sddn57LLq0A1VrkaRJspY5N2HOTxkdabMhYTSgL5YwAU+aBn5NNn5E Q4QgKAY7Rpolxyw6aKZugcYy80jJOVpweop2uujmi27CJgn0xjD6oFq8OZSqjBZFGhOTYB7t XJ1w5seE7PR6bg3KkL6O6dELanHmFnpc7ASMEBI7WTxauVS81ymGTP4HHBKDBjlCDAwel5ru KtNZnkDwKtUZbrNF34EbOIKmAoVwhj9EwAw66R4xJTrbstFZw+C01zH2O9ZLdmKdbe0yyA5C ZrM+PpoQpdPkA6IcoUGlp54zhbAKZ5VJT26Iq6x1PnW0JTFC42RWJkQKpWLEIExaIrESQhMa NM6AAE+1GakjKJ3nJNKTKorKx5g6tkLVnA0KqA7aESMDxO1yjFVJa1nOXFpjNCfN1ozZbBlp i033Mm/hMmKxiDpFJiAAjThh4qDKcVVDJgjQ7cLgtOjY3SX70HBxy7BzoOBsHHY3FN1ZpoHe Gdo9mj2CYNShlUvLRnH4MI1Yy/p0WqpSOp+N+89YtvxSDqPOxMEEeWnuYQbmEM4DgMh6atkw nbqaHzLByUTWe/uWIoTi+fSHAvSEcF5GQCEi62nk0WeYTR1gVuuqhHOhZc+0nDMSdpvpMGpU uMfEefArhKgCaRqHJ1ekQSmIGQYZzJ05VrdrrHcSj5bM+x0TbaCVdgBpbw5//FDlACJMEOiA Hh2r8UYKlIK0RCQvaEQpNPJANkzjQYRQjaB8FqIty21tK0ztGGlpLdbXFbM5O1djc66REWto yOrrTRzrSR08kD58KFMqqvI8lSooYCsrUDw2QFshWYAHmSg24Qmdlr/uRWI16yWcy5RZL4EL g14bhttjuztd4+K0sSCdWF1nLqg1W1NGyqRcaMWY/AID/8NJdj3CpgYUMEpIYMUxEkwa66nZ XcXiG/3FtX32a3lnV4lMIaTRoiHPU+GXUcrjIDWrpn0GJaURaFmFMJDkZBUSc06nZNpFC4Fs Dc+r90ZRfKVOmWwRkgCneeYiys0TEmsKQziZhHMyKBIJXwiF6CqoZByc2EsbLqRhYIipz0Mu mW24Z1rOxUl7hVVstFxMGtAA59UIxNHB4DgPCKOC2J9NDNy6MJvW5xivuonXbfM5x3zaNmca BLNvOBDOWCH0CCXAvi2cTJbNy/p4PxWHioP7nGVTAa+WpQTSIxYqVV6ORY3Omj209Mz+pUv7 584bnDV7OJmMucsHddm2sW9vZse2mtc31W3aWLf1jRrHoeI1FUEmuNPDlycrj5Uyy5MJVZKc JoQnPKB8QWYIHuSSmpDAStOwQw4Tuhp1dcZa3WAtqjGakqQxgVZL25yUJbm4YjUbEB/MgF2l 5NIYBJWFtU67u2gfyJfeHCy+0l96PG+0E1Jj0Hm3AlUeeahwNa0Sh+FhSBx9eUqVi6c5PQKZ UzQjAhkvvvpL2RiTjAtqIFOAni45RIsMZHAwZ1GFUHW6Ck8aTtwYcKEnj+Fev2tMMdxZlr0w 4SyynIWm3W46CGGsn887+14z4Iy+oDGlYBeXQw2knU/DdkmXY+53jdddBDLrgG3ucQ2shGIp CWjaO9MVU1b18PKCTEcL0jg48GVQgrvcWWiOoAmjPIhQKQkQrVad03vRxd3nX9Dd3IxV4vEe /X2Jl19sXPtM89pnmoaHUKWBQ+o9aQMZN1f4SZrplYLCUQa0Y9weDzvGVEx7JcyWNFlTay3K keYknfnCzgk+YAwUfUIzsAFXCXpng7ZzJF/cNmI/O1DcP0yO2e6QQ5pYPyTqNiTLBWvUtGpc GB6GxNGXp1S5eJrTn6SBjDqZmcl/ucUcCLtx64OHcUu5xLSvShdnmk6r6WCIh4N7XrJzxon9 5Y7DLw/ECFgDhGx1rIeLyfttExE2SQwaT6mdWk1zVt8cLy8KqaMFYTSccUWjBGPsWbAJzbGE HMHJPGKFd+HCgXe9+9Bllx+trUW5J/4o5M1nn27+1X3t615poFWuHa7s1GuIQLaqMgY4lUxV PTKFjyY9w4UdVBR8iD80nX7TuAITYTnzjKw5s8bImN7MF26SOAQLTU/4wevRMqgTcUWN2MU9 Q/kneu1NI87Ogpt26CoYN4BTCgNkTiYExj+HUWGIT82cIbPlKSWZTHB6dMcQy4zlYo5MonkR 1O4SUALoUamTYhwlaViCqgDc+xMGapSiX0ZlaigJ4XD8JrBFhjWAqaZzU8K+LF3AnYObQUOb IoGKm+QDBcIfVcrsw0jz0VLy17a51rGwtlCvjDGDNSWiG+OCjcIxseZGEkReWrEiNESkREEj 7BL5kFdN012zpvv979+3aBFi+PE49u7J/vTHnb9+oK1Q4O2FKxWBrMriqBaHC6titXSczz39 vCGGKlRgvYrGlh+CJUVsWTQS1s3N1mWNRmPKyJp0FozfDmBTVWZpVlaVla6zYI6JXRrF7cOF 1waLPzxqpxwjy5YXWFSVhFJ8GAJUJDCOJZJYAQa8oMClPD+BKOZiaDmeQMa1yfYllSMI8rT3 KxYDFQJqR4WBDGRg3OdiRdK5MFG6LFVamLCTbKVF1eKX7HilmH8xDKBzGkUDK5vmG7Z1Zyn5 vGt0sm20mE3T6terEuGI8jWkM4tyxV1UAl/2XFalsMuXICGIHJdffuTDH94zcyaWWI73cfRI 6sd3TbvvvzrEysApGMjShrvLJm2WeXbOuqbZOrPWxUASzYc+X6JOUB9v37II5BILxmAnml3Y NDD0k67S6yNY7jQ6LLo3LWRRGAKSSKBk1bBalpMpQNnuKEaBS3l+Aj0yt2RaHR2zfBhLcRnq L8B6Fnk+ae8laKziNCDWQhttdIyYJzRpnEvyMhO8H8iBd3HdHCDGFQn7dzKF1Ql7uuVgRhKl wzIME6xyHNc0005toLHMwKZrd4rpLjScEboUYB4kBBN5vA5o6FH+yldMXBl8LoiKP3yyeBqJ KSvJMxnECxYMfulLb9xww4GGhkkZSEp74hK5nH3ueccuveLIvj3ZA/sxGykbGy1BXClEP0mX Cvo4FkoaheMs8jdEIzBRvGjEGMUZm0rGBVnzbY2Jq5rM+TX0BVq0qlh10UZ04g5VuWlgwdSa kSZ0uOM6m4pGKwtw47BOa5BaNiSYejJEEwIobPSpYcewOqbOQq3Ak/KPVxIvnSxjmSzVzORq xICpcEkm4Tyh0jAx3g+iGIbq2N6MCl9t2TekSissG/vCsFmMHSe28j0j1BOsxRXWYtANGSMs tGEFoJ4Vr6o+lF5p3HHqr6q12rQqh1U6rST1TxEIMKbAPvF7uz7zmW3t7dgsfIKP+vrS297e heXR1zfWYw8HzONNjCUibKsW7omIY1M1xNFocGTRLLAKgqfelmWtdzebK+qMGVkDt2I5f3Yy NGTYIJqdmTTMhqRRb5qNCbfXdvFIAJ7Um+RDKIeaqnW5WOZ2EchYj0znFk2cOpn98YT0Oafn v1r/ixdZJZBpnpDGIsv/JITz8ixvAJgXazfdW1L2paki/Al6lBkapSjJcgITshSwDc9+dJoO 4hfa6rMOHoljS7QVm6vUqChQxbyCoYpzedkrz+79h3/YtGpVL99lWYXcySTF3o53XHuo+2hq +1Y8CEtLEFeKauGe1XFsaqHiaIJwLP0YGKDhtjacMD7aZF3YaLSl6O4hzD3hWgJxkF7VcLzT 3Bj8Oq6ZNq2WFLpmruGUnhshGReze/Lan2TDqvYIDWS0RxYMZLI43FwplSd4BGFpesUpWUrO gx3qhie4KAqnSKXWJAGnYL9qnwVi+d+rLvlvqdLNqeKadBEQqJQymciT64fbBiMRgmeZzmLT mWoaX3PNGex5OGCBol6r/BClLc9VHlu5No+SKcWO1ttu2/PZz26rydHNJCfbkUy6F17c3d6R f/nFJrukX2LcbfjVDg0us6MkogKOZKGtXbRwqGNNG/YwKJosmsIbLqlJGV+YYl3Z5g0n6eIU mE7WA7ahzvEEVI2VWlBrzLNK9w25STyjN/E2K03X86iAiHNZJ3lEcYFM5ZW2e3pUnKg/lYbj OYSzACKzZdIqivfFEMVuT+ffnSnMs2xMMsBoqYhrOTl/YSQ3NWOSeaZ9HiHfd0w8PJcdWyA7 EYVsaip+5a83X3N118l8ucEx8+YPnn9x9/pXGvt6+Q4cz1lx7USDa9lYT5eni8QCyKPYy7b5 8Wbz5mbzgibaC+MtI5IlVv2JQMBCmIo/PJk+J0fmm/azeXdvieDpZQAn5RiHU8oHMghmsj3D eVbTxrMSqCXojQkg9Ze5gMFoitP7XAyBOVC8beKIYXw6VXwP9ljQR7spiSRjMk7qH5hKvWbg MU+jw3CbDAPrmHuJgUdBqureqL3UcIFHbVGjEoRlwvI5s4du/9rG+fMwpj8Fjsam4hVvP7x1 c+3BA3QFgB9aU0GW/wl8NJmGjc0GpUvJtLVLHjRZ2zDecMzfbTHe1WzMy7FtrqdaI0Z5WBuy MByuN406y8Yws+K5f635KVnuM+3Xw3OodKSWUIQoGB7IpnbMArM8ZFomgJLSKZBn2C+/Y1Mg O7QEJwSGw8tjORluY3jnEp7KazXcj6TQF6P79fkh2QXg5D9T92BeL+GS9a4xQDe90cfacaA+ 1OJEVw/oVCLGONk/y8/q+8e/29TcNAF79CfbVCk/lXIvfdsRLGXu3I4pM3pobgtnAdGAnLH8 r8cVxynhSMB/BZckE+aHmsm8nFGboN2xsGXl9Z00WDOXoPu8XWJvzjuOQ58zH9dBPRXb5quX bKg9MsmuVgcHAhIGAuXBRYcLed7/oijGIBk5O//ljOqvCkcg20EMrFF+PIn9YnRejB+SRgBO 9jMM5jbjd6rpTiUmljLvd6wpDIqfiiqSizheZT131bG//crr2OhwvBROmB6sRVxwSTf2mm3b gpdm+s2VK9C8qGWrNiKOX8LRao+5JI8xRYt5WTNefMh2ioXMqlrxiWDghcJWf7wQrT3pNBL7 4UG6Ko+45q26Mqtk2cvYyFs8payEuoygEAqBjK5aTp1JJbMw5EUikaVAxiU1a4lYLEPgR9B7 ly1d+RDxztfFVKD24Ry8/OtKq/TBVPGKVIHdA6gEISRUgJMeAMtRcvxON53pdGOO+YJrNLL5 E7UZhMsh/BXGUIiHDSIjgUGScrnly/oQxTLp8naVk3BicWhO513YfegAff5cazDls6gf0fYD ibjiQBr9Y5eGlOwBwZM2jIOOMTtlXF1nXt/O3l/IJEnSOLknLRyW00aMZ4mN5Iys7RbsTXk6 RZI1/VgWVTrfJ17RGACOq/4YpW2jzbJANotL1jTwrPoLMkmjwjUgJWMg/EiUMJ5iOFCiOAS2 Yp8Srvbb0oVzEiW8KIl6T7CdumcUAX5GUMb7aWcZzma8CIi9QkN2NssV7XiVf+7coa/9n425 7KkaxbgP0bbOv6gHezKwaVb1quZFLStaq8pRQTokhfKgUvH4UWvCuKLBfGczwasscMGDMpK4 AiUnCwnsp03DoNsypmWK24ZIAQ9aOWJPb4UFZF6YDFdgLpkGsk66IZaaydyGX/7HciwkiT4U EF4cYrcjlcUjFn2FuEAmVUheyohvf+DdIQY5bJDfTxbOT5Ya2c7eii51rvjk/kWp0QxQHLzo sZYY/+WYBbxCPdg35yXQ7zzcX6J0OnY0uMDHnHk1G6RtSuEbf7+hsfHEbNmPMW6MYBbLute9 1Hi0C+8/DbRkKVE6VThAAiQJTQisnggQyQyXgcX1ba5xbaNxWQOZmaUjymjZku3USYiCmHVJ vObFPWrbWwoEuyX5vU9gy5aHEUVQBtp1IFNWHJAeMQtkkxAuuK341f6CZsEI/gcwe8G0iwW+ xYkS3lI9CTYFdZ+IHJyBa2uRQd+7jVdR4X1q3D3lbJEOKkc0Ck76OTKRTDl/88XNbW3sqdBR JJ0a6HTG+Z9f3ozVzLC50Q7HU2Ten7wyOKvWfJGNODwiejLoJ0JaEmRultBdr5O3UyHCjOME QmROGInZ2cSMtNGYwEcu6P052jGKRRPRjBVx0Un2iBJDcXs0qzSgxKpwDQhhEitRVIPaoQOC ZVH72AF/ECd0xyz78nSRb7t7i8UyVlzqgxbTTbnWPtd40aWvY8T9LOAiShI6RqcIsVQCYGL/ 5I+2X3QBHgN7Sx14G+0ZS/ofeWAKRhxqwbwMrit2BHAUEgJwOvlbBk8nvw2y3SEfbyKXNRgt Sfre6jL0UuaplUCJbNdqTrl4K3zKLT0+ZLSh5BUezB2T4RM+tJw6dRaEY3BHgwlS4k/NUjg7 xNmj5PTsl1abj9WIPW6PQCVDGh8NaTbIRZb90XQe3zfih6QRgLfIGeWaYWAFGzdvA596kq1A XFzRxfSxil98YBSTjwVL1B8I3nbZkU98dHcU9ykPm9KBlzYYG9bhq0H+oTiPArWsoOONWveZ ZOAXSoAbd108h+S4xpKMcVu70Zqilwf8G6NAKDpVz3jmzqyzEq2pwtYBMoT9csqVr5bJb4Ke 82gzpD7hfgmiVUaZpiSUyfuLrhk6QYaliBPc9cG+qg0ED9g770za9Xi1nLBaluWtlECFIIRh puxclNdy1om3MJ6QMra2FD77R9tPiOrjo/SDH96zcPFxeWkaNligU3vQIO9pJO0ZOtoa3+wY AoNFrKRB/9hbwY6PwyrTgrhRcs2MlZiWyVzdRLa4LiaGMI4+0YceyET00+2icc+b1EK0Cf8x Phqb/T/W4wv07jkbFw0GZLH9dS5xzzScuUaJmQLYW/xAMTsMe5lRWkBcTE0htFV7qG4clZcT h38/89+319W9FSb44zyAd0D+4ee2JLAdOXTwRh4CVwGQlwl6Aga+g1tnkHlJ7H2l69PjO9Dd waTdgDty0Ok/7Azk8aqtk69rR5sTvks3P2fOT6LILj5hN8FdEOngCG/KxqziMKYs5ycfy1Iy THndPVVSfJorlnjfDpfuHFxJnDMNux2f9QgMTyX5WyoBL+LAjsK5pnOe4aDDwBfotUJKF2mu 8+4gGnUwq7MEsTx3yUXday7qjsK8pWCz5w697/37aJFUh4aKyBu5+JWkATqKZUMY+nyG52LG gZ9+vOfeIsvSpJMulVJdYzq4AXjhNQQ4hoGXnuIPB82fbAe+U4ZHVqZnrJVpOj+CN/3Denl4 /pF5JcFRkSWSKJkQ9abwRyS53/QeWQTh5ICgHkF0s2FclbKXJxzM8aNvonpjctSeYKkoIIqJ 97g0E/fdlr3DpZ8EPs51gC+G/MEndp5YR7ik0bb+8OjwL7sLG5yaEqlDp8b7c2udfnL06Mgj JfPPXTJ9nHbedMvepubJXJPFW9EOuHREeXkDqWePIvELq0q76eVA8B1DLGePJM3kjXWX/2Pr H/xNy8dXp5cAgpX8mImoKtVMCDlsZeu8VksydVmTMZigr2/G+PqEHhYm+7kBbPDo2cLrQjVN pD0McyvtnyH4SBezsWegNJwLFCCkv+zAGZcurmdcw2cT98Op/DTTwbWNQ5CwzFv3h3oAX5Az 3B2ONYx7L9sxG3mX0n0AzngfaRK0rGS88foDV11xRJd8HPNF8gcj7l+kctcmUovTmSmJBK98 zwL0QRKJVDI11UotHS5cXHKmJsxN9FWVYzrwwp9cznnhGawn+YeaBjScBYQ3WJbQCTiL1/qH XWNeilxcR1bXkzTb7K6J89WWS2FSrMvtT5qpd9Vc+Kn2W9Y0nDcrN31apmNOZuYrQxuHnSEY wUad5YQcd5xh1Vt21whJOG4/vmHOSq43O+q9sEs4UP6GLA9zRElhbLynrAYyX1pYjIB4Z35S f8EsaHQ5YTK0XLzAegcxbkuULmD7+CPZfUFvoRS8gbrGL+5hfa71pGPieXIMNiuaLAu7uHLP MN5Mxv7rL7yZzVSkrXLZFVKWnCWD9h2pmput5GLLaraslIXp7NCBz2VbmOk2601rppk8d6R4 kescSpjbQoQVAWbPG3zswbbBAT9cal6MyWrgkC7cjdEd21py39Hgrqwjs8a4AxZqEgQffu5f lVm8pubs65qv7ky3Z/DmJ7pJy8xZuSQ+bZNfXyR2jZFin+oNWXL8ATAafxhlZyxnsOiOOPba POlQHloar0lRzo+CQQ8PZPqwhlsYZwbH+gJlPi4RI4hHbbx4BW+vznrLCDGkb10wVmzPMuwm 1h1DKX2vlikyHBe643FYCBwt5bp3H2pqjNgsGk0dghYRiUp/WTDvyBt/i3QIXwZglIz3D7u3 Z2rfaSX0XlgcGzpryWRzOnd5yfrbgnNjHFl5OOb7b7xlb5hGtFlxpjWg/lXgV5Cga70wS9qT dL6gwjoImVIiWLKvvbBmxSW150xLd6QM+n4JdAkRyLJm+tza5UtTcxqMmkEnf7JN/NP9sbMy +CNozfzmCBdO3MHroxJ5qAev9sRZAmiCdbC9TjQj8GpXKJCVzROjaWRsEFfE8/MGdlS5eJMq 65AC8Rt34B4yw3TggVrDRWgZ1QXS1+U9FUtGP5Tj3nT9gfLssVijueC8M+/+tZX9nJm+1Ux/ umB8NW+fH0sfRJTIO0rWX2VrL00mq34LDMJZrnZ50fpy3h5jLLv87V0NTWh0sqkHjWMu47P4 3kS+dKJISCwXQvlx3eLlPG2W25kidRH9yqCO6By9vlxjyMnPTE5Zkls4NzsbEEz30yhmmPhD Ynpm6gWZpR2JlkG8UoMGzpPrMFtSFlY50B3D2iVdr4txsrDad6CAqOfyWJVSTYNL75Gp6ElK Q2svFe1eajrTTBtNYGzWT5J5x0EsLy9+8Xb/8w2n3XCxgoiaAGRSj4sv6GmfgpnJsRxF58KC 8cVM7bWZTIZ1lJKZmmsK5K8KFcSyor1k2P7DZGqONh1WuR2YOMvmFpSsPy85SyvnkpSptHPN ew7K7AQkUFuIYlh0vyRLpqdJzhrbVn4sSzr4Spx77Pzsso5kK0aUjouJff+qRGxALLu68dKz ahZljLTyEcQJKMR4RWBSvORYTcnErHRiScbtPTHzFbwUnsvkpSXLxiFKlu8jkwB+q5LZmAST wjeUoZScB53Q/a6B59IuxDuswwsEMZLGAqba6b2NmNhXiOnUBElgCIDn4NIkGfoDkKKwLwZT Foye7hHS3DAWK+J44A14/yzTxYsxsHwZ7qiI3oDnN1+OQLC1I8+tNB01uBG0FPuOqw/7QqpJ 5e0LB4sfzdacrUYiTG/V1F8+7H4lb19cXpht3JCpuSJyOqw8o4rFxFmudknJ/H0VWHn67dce ov0bPshgGynYlAZtfzF1zMH4DR7MoRhSIQIZXS5ZXUvq0GAqnOMMiqK3Lmw7Mna4Q82J5qTX BKDAP0CADlpHuu1tNas/UH/1JruLd9N8ihObgvVJ02xOJZfkyBYayOgVEzg8N6Ig+KMlZocH DVCqGdlsVaCe9rrJDOzPgOpUk5bHLkx8q7TBcGcYSPJdMqHij1078xhetefd1hy6zbqEqdIi /S0MkZEBfHOUvsOTR1Yo4k6FJ/D2l3Qti3EZGtQQzvDVUkQbRGJQ0yeLWLSgMWECDn6z7SB2 OzExuuQbyiZGdJR1DfWl888by2OVDpmTJ/+7vukihBJNMCB1DWv6er9u2L+fstYyLHrYKIp/ OO70ZPYiKziitG27v7+/trZWRsbBwUEA6+vxmXbvGBgYQOzLZv138hhGKp270hmabpKIOS/B F33GQ0tnrTi2/mW8Di728C6yWLyoeNChO4Y/bF6dhvvfqHzxEgne5E7ajdSAPWjTJoDLPSSN BgBjRmbahYZx/tCLB4pHs/gyOI2Ak9dYyhgcQsG4jJnoSBv4EiI1KWR/iGMyAOOqhDEYhFIi euEROLzMGkt1LEaMQUyIhXqPeRDtALGxWCA2mgUWfhyCBaCERf8yKWJjFJAmePUsXqdNXywp 5IAVW8BTWELOEjNBu29A0Q/Zj7B4h81/Jh4a8W4qlItHNME+xjM1GN+LazZJM0yWxoxRGmtF 4GVuCMu48oojyaht7mFKDTJc+lhN/TnhKMbJAG9sWtnT/U1CPpayXsL0jnYl5u33mO7Z6hwS AhaCVF9fX6lUam1tRY8DaUAgkMcyxK9CoYBIB+FIp1LoxHuH7bYUnd/Oml8VgCrOF19xZP3L aHoxDqpAks+Jmxpmt5pMunfMh1YgIkjC6tytJ6k+e6Dk4sqIPXJmZkqqdUl6zt5SF0LYSTTr jy4teomNSaMF9zmvh4tijL85676IkQj34w/V4OEjq0MgdZljybO4AS14g80ZBjnbJG2IMsyI SNVVqKD8cCK7RfEeXmGADOC5bJvUJUn9NNIxmzQ2k7oG0thE6upJFh0uFFy5uMBll8jwMOnv I4MDpLeXdB8mh/eQnmNkEK+Rw17NGpJtUNoPuyNCbYxzKzGel7rRdM5wnRXEfIO9pAxAiKxK qkasZaUleERcpqtKFJxz0m544BuQ0dR8dk/3naZxXQLlCB75UmvaoW+g5gde+j4yMoKA1dHR gfiFNKb/33jjjeXLl6fT6XXr1i1cuBDdtN7e3ubmZhDzjhtQnN11a4dGzsjKtwsIsZWcL1hz 9J//fh69M0UeQcdpbZJ2ytVjiLh4bcsFSbeVeQbtRyNQiePTmBHDFdBm5nYU9gy4Q60EH6nQ u73o8TiuQ2OFVXdNw6WPDr3M2wdvKvGyjwsGFzXKgKFLW8JclHL25F2LTfH5/vDc6gMqsivg TZnhsmTWl4QP/fiZ45JC8OjBW/kNGy+ByLIwGWFW5ZaAGR0A9JUQho7uI8MDpGSTBSvI6mvI gjNIUzOZ2kmmdJCGepJMEYxuUmmSwefglRCm6nJski+QYpF26PJ5GtG6EM4OkyNdZNsW8tKz ZNsGkh8ktfWkbS6xUqhDr9+nCqk4zQuO/UJ43cx0w13r0rctTtKRzdhLsUV8TEcu2xTXHVPl NTUv6jn6Hw2p95kE0+p+VDANbKzHSN4bIaIXhi4YgldXVxdC1dGjRzs7O2tq6HdDELaQQBRD 8EIWMQ7xCx284eFhGcjQTzZNzK+O5cDC5YJF/Vs2+aPXsUgBD+ba+hx8WIjMSJM0Ou9+YasV yKcXao3MtuLeI8WeKYmWOquWA1VRcALCmWVYU9NTplsth0s9Ngt5EzIuUBWNJY3XfuAqzCYS MzOFNwsENQn/0HH3cT30oWX5Lli1QUdEUK9UYEcIOeLSj6TNxLIza+/VyvTdg4l5tKFSnuzb SFpnkQuvItNnksVn4XuHpL2D9r/Q7cI8FwaV3rQ9i3py5KO1P8AR4DIZ+gcU/XPIzNkE0a1U IgP95OABsnMHOXyQbHyVvPA0ObSH1KCXhwkug86+jemAX1D8NsOdjVkf25A+YeCwRN3iIIW8 50mPem4H2bKz+sc2rgQv9nLpw8WgYplrajmvv+cfahO3GvSpDe+wzD7EIkK88IFxYj6fP3Dg QEtLy/bt25cuXYq4hvShQ4fa2tqammjQ5CiEuSNHjiCuoe8mhMHZA9nUBpmtNrHi3F4ZyOKa unSfKjxAjLs/ni6sNd05WDLCtoPgk4YqW0VpN2ekNtj73xzZ02jUn1FTC4doDqcVj7cou8UN A29usvc10btxArGsIvGTTcRsM7OWNSdtdKGjyt4gGpgmHd0C7nPWXiPdP4oE8Iy3R1atWtDb xMXTOXWYrBzPgZmskUEabpIWOecyctYqsnQlmdJOpnWSphaCGWJ0wRCbtGsfGgHhsUxGNGmG JAaKYjEvxnBIZ7IkV0taWgk6CzNm0o7epnW0s3YMO0lMksau7iqrTiqlfRW3gTgluvQ1Wceq s9mOlzGJp+OayhhxBZbcNaxR+YEsm3qKWDswoy1l1LEDWQQs/OKilaFKTu3PnTsXqMbGwNw8 vcJJdzrx7Jgv4SXL4IcZ0hKqXc1UnsY1Z2GWl39ztXK2SEoESQOzl/vzB/ZZzQtr5upRDBPJ hoEZtN5S/4tDryUwysQiwxjtjjRgIoDoLuKdseq880RIrVzGeAOZOoiI0sr9zX9ZwKVEeHW9 XcsaI0BV1wgY8FccxncD6Zhx6jRy9fvI2atoLwydqeCDe55JMkIhH45fHhE7xVFiWNrQQP9A MG8eWbqMrF9HXnmerHuOHOlmxmCkGRU3VeGhNC8+1nDrCA0Wkd6QXgtxhwAqadCtK1eMPZAV CkNmwqlw84TrYmFUtQPX3PpC4QXTWIWeXcji6gCFQr4w9Hxd4rXq2BTqRUv7Dbz2zruHBn2k kI2S5OXDfQcfrByrDKmC9vxdfMU5u72wq9bKXOicQ59PCh5Q0m8P7CrsfWroVawMYO/HSTGo VI1ESIc3Mri6PNOkYwKtQWWZ0DReH19OXvmrXuOUQUCWgRNwDRyIhRncUND9RH9JY68u27OT vO0GcsFl5NzzycKFYrMFLiJRHm66LADgHIVdFDSBP+yoYDppfwPGYP6ed8Q4kGWlTVIsIJkc mTWHzJxFVl9AXnuV3HcPeegu0jCbbkATtSj5KkmALUMI5q/xntHoG4vnqoDHRDmlBlmTHkYS WJa7YB7e/DbGo1QcQleoEmZcX/WZOwwnNNAu4ZOebyOJJZUIKUOTTOxLJL8fjJNlyCNQuVq7 Y+rIgb3wd6VHwOmoYOQxAYTJCkxZpCrsqo6iC1OtTUbNpsKuEcO5Jn9gXnY2Givaosq2d2T/ c33rtpQOL05MQR/5pAtkhoG3LZIWPPHvXWhai6EBjl1mHC6xvJAyy4ssS67BVYfINIjR9KMv HEk04QkMwBYQMgW7QMWSZXUqMI1VHCLHdpHf+gS57RO0F1aTo62K3mRZ8WXkUuX2dNOFyL5e gjV+zHZhdbKASf0SKbIREAahiEHpJMFiWG0d7dbV1ZHWNtLc4nffVLE8DkLplCnk4jVk4SK6 nnD37cSqIQ1TSamKl8bwCsMrjJpNdz6bQKyk5tSSVZKeOX0Yr+6phDKSxrH3uXSL06hNxR3q /b8589tsaj8gKWU+PDz8jUH7r2swqzjWo1DoKw19N2c9NlYBHt+seYNVBbIIdfAlvrTcabro gyCkjPuACMSBkut0lXqe6XsJgUyNYkgXnMK2wu6XRl6bZTagLiZA5bht1gRg265ZkzBbTGeA 9Q/Qso+vlX7r5BeVb5+e9zERqVijVQTtMuBm3YTNU8RI07ijYiOk6iDM3GM9EcuFK99OPvxx Mnu2v/6IsKIdvBOB3107yf/9O/LmOnJgJ31xEu2RYXMZ+wBMkhlQYnvKcKlCCAJWo0k6G8ni 88inPk3mLqDTbRCiBjKa5t5B3zJNps8gt3yEbHuT7NxK+vppNKRb2Ko4sGaRI24rfZE/jRbS L3He0eDazdnDSiI80zp9jO/A4WUwjf3sywr6eEctIbpsw33fyJqfZ5QqhqeLmcT3BvMNQ8bn c7mxbJ3ACmZ+4Lv16dvZNsSw/CogndQbvPq4j3jaA1FBDOxBQ4Jp5eP2V2fSdpLBHTREMSYA dsO2kdqiXfzxwKPn1a2Ym52F51Egie1lwC7GZL1Z32o2byEHskbKoD2yk+4wsqaBD8QNsceo MOzSDwmhtgcyOmVsnnNFlj10/ccK8REQJ/98aGUpDC1xQeBvLPMlmOAfGKZfBl1+DmnHciHG 5cpgUDOAoxBTNr5Gnnme7D5InBTJJklNitRmSA0m77M06OAPiZoMA6ZIjvXOeobI08+RV16m 28q0KBapBd23ZavoIuaho7RzJ2tJI47JYkUBDuGjnchKiuGrCAyBHR3+1HtFPEGimvQGrBUG YVquVBj4Qtb8ksEfotWQLIsGnrSOqVtbo6giYNiuMTK8zSx8rC71Vwbdgzjeo6NzXGGdqodP 0XwzbIpkvOZ4/Lgb0dfB4vVWzvDzg68OOsNo2zjYOI0OMztTbUuyCzCoBANr9FU2sgmyM04M XY/A4jbWcGEd/HPcrfN7ZNxEboB2OU2UVRDLhyiYGE+M4V6GHtlgnsajJWeSHN15RA9a+/EH NoW9uo5s30UaasmsGYR+hlbrwSi8XBI2yvYNkDe3k1deIudfSMeYcSo4HF08jEYXn0nWvkAO 95KFCW/Eqggun0QgY5OGY/BIecEedkrbuAKZRe43zM8RMi1SmWN3lYb+MUW+xb7AEUlCgfnS mlLiw+nIpZgYJrpvtrQ9Tb6Wcp81jS2sIxRDWg24WfmIZ9mmEy8U/SHMBCGWYb5fu1TimSrB WIZpOfZTAy9fWHdOjZlLGBZvrLCzIzXlrNpF9X11RcfGq9oAmVDNlVgXTwNTYBC2cuEde/Ii F+TcyZNtrb6PTGgf9cwMq846So0bCgqLJQa+14AXclRlHgENHHBWirS0kdBzfwEhvBuF/V89 R8krL5CFM2m9F4YrGvRhgJlNkLPmkw3r6d6xadNpr618vwy6m5ooGY7wIDdgWSDDi4+7GLyR xOOW+PJ7AC8ykX6Wk/v67U9Se00IT1kKQWM5o5/V2/Nmrn5J5Bt4XHfAcF8wjFGe4nTMVens uVw9OllDg0eyyUcsszdfWlwozSVGA18VxY5/bItNJzdmktut4sMJ97WEgTXKcdmvlbmevY6N uYb7Rz7bohF6WY9IRWIDEa8wXD1wdgSFSl1pGvvC0NVKGYlfj7y2oueJ61qvnpJsoW8NZP2y pkTDWebCT7fe/Gdd/9JG0jn60Jy3WFWpgkmi48WHH+ANPjPCFPHmSddGKj4YLW29mMqpmIkS glrvkVXFPwZibiDCAv6qtFZoAyf28cdFFioXnmCzWtidv2s3eeQZsmg23auBrVqVHJQXExRJ 8sRzZOt2smCRF8gkb2QHDUFzHFvJeO1JDRObGGcggzEp6zGDXI4HZMOGmdYUJ3ETsX8dRkkI Xp5BkjdgayviVKEwaJTuyLi/suwthjOccvAiK3zAoNaw0StFveFxsGLCOWQUjyTxZHh17Vkq LJeonahvR6GZxHfuy1kQj4M8hKcl1pQf9D/Umek8O7toRqaTP58EprSZxiuw/6zU/63eew/b Q1PNukLZxzPj9bwFMfGBjAUEvyXxbFkPjNrqQIB6wjeYMcCkY30aen0NZWUzJN85kR8hu/eQ 87CdmnVfeOSSwYUn8IvZMSxTblxPHzaCYnqDqKAMnlEsDiI27dhGt/K3ttInBLSD6wWQa9y7 hxw7RkkqDJdMGi8+XIHBSiG+LxdpN90cqhxKLgCHffgwmkI4lmTG+mmh+H7DvCi8m8ww8Abm m4b6nskl/z1OtG3cnM1dMDx8yHLuTthPJoxHDIv5Cu96NA6HXUvljNfkOFuwPIOODztiVHCs 5sSAOKwJoRHjKX+6D4M15XLUAdZRMzAKj1umXPehvqcOFg99IPnuevbQEmfEFrMrGy/qdQd/ PfD81uLeOWZzkS5ixpRkVGUTQsCV48KGIdhAxLPCJi+L+hQu4mdpsQB7pkg4z2vEZeyNHlpq 0hV+TZGCqSyJwIm4MkLMInHxKFBlTIIKsQmz8ti/s+FV8q53kXq8yUA5EObwhzA3OMieKDpI du8kTz1GptLt42yxUiEun0SQwoaD6R3k9fXkiWa6dQNPydCnzXP0gc10yl8t5XIQKzdvIEO9 ZEoTfZ6p2mKx6R9MQaMx4EBcq1IANyLw60twsUGlulVURRAaApVkkIOl/DNG4hzLilhzxLt8 3NQXS86rCeMVhddLOk6qt+fZYuFoTWaTRe41jLHvaAsLPwEQ+APjSqy+42VQ6D76j8NPjC0Q j5Erlia35nePOIX56ZmX1J+HyTIuHWPPlmTT5XWr8V4qc9DcXTjQaubKdAxBD0YRVSbGwggp PF7AGyOs3eHWzs4qJScJgVWSMaYhGX/xPbIxih2FDRWC5+4w+YyWUPWBsVs9do0ZZNN60n2E 4EljjAERdABH+EA0QRQ7epQc2kcOHCJb3iB7d5MNr5DONhrFqlqwpr0tBLJ2smcbecIhhw6S eYvItHbSim1rdd50GOIplk35VF1vDw1kI/2ks4XqqvLAiBcOgVt4lVTJrZOH20oRry0a95Ey f1QsrEkkzg8/QA5ITe30kYG/TLjvjdCD9xTV/TydmoAFxwjhJwQEd2KzIC7asTTi0S3G/qCk keh1+neXDj7V++LS2kVTLG//HUISYhM2ml3ijJiO+y+FvbaLdTM69y+2d/vyYSZvDCycyRGE TzCBKewjc9BFRXCHSlhz3I/oHplvhndZhK8On2TUFGfmBUQg6yZuH7Yd8fyozCoBAhYec8F7 dZ58kjz+GLn6HdRrQwOkp4c+zr1zJ3tNxSby2q/JdpvO52Clsm3hGCKLpxNL3VaavP4yefo+ so+QuYQsvohMmUnmzCfzFtDN/XhACr1CbDR78gny+JP0Sd7p06tdsoSuomv0u+ZRF7twqKvY cIWaQDP6wQl0aJk8GAr0bfVjO3wTkua6QvF+216BF7VGyTLxFuyRnqsziQc0rGnk06lxLZtq Ao931vcB1Uxdibs/WnC3awzbLuZSJ/qACgwY28z6Ibdw19CT7V0tN0+5vpa5HXECfxjanlWz GF+Ky5HUP/T+ZzvJ1mJfZvBVi4huaEh5t4DpXvYRXdOe1FdSoBM2ZJN+FshC0zDMQ0E/Sqdx MJ+fkcBgQjZfj1ZgpUQQHO8eGap9ByG4aPE9QNgDU6SVwryyZ0zzYwv+gnnkjq+RR35FX7nT fZQ8+yqxHdLi0Jcm1naQ9mWkA5tM2RCN7bspK3E0JDbrN3aSeXhbS4l0dRPMhT36M3IYzcMk c6aThXPowwDbN5PpUykEr+Ko5uDFx1j7mGtsJOQ8Vh+yeqqRVI52ZCS6ZZXjicKlrfsL+atM 8+LwTBnIMWc3Ytxt2tekrOejuE8W2ED/uNs83HkUg0rHwKVLr8AJrzF6UeApcbxwaqHV8g/H fpYza86vW74gOxd9Kyhj0QIfPKn57fbr6hN1/9R7z7ZS9xyjEZ80ooGO9s7cbmcwb9hzEu0j buFoqR97vpusOuxb5qFwwisDQdMZKDkH8FIQtpmosnW1CTRD75FNYJ1EikIbgC9H6DTZWA80 HSw947a0bSsLgy6ZP5PKwjZ9dLHpa8JoMxDNK9KKylWDHX+43bDGg3386BJmakgTC7948cbB /V4zpi/FjpgaqERTiU0a4rVOCJZMrsck014ZZD4o1MN6J//OIAHHesd96TKNmAKz7e8Wi4ss qz1oAs1hl0BjY1NP9w8N43p038IEJwlkoM97T650J3eUzI5up4UmaBuYsR0e8+Tj6EpgFf7w hPtMo/4/+h7YUzryjuLQ2fVnwk5uMFokXvN/acP5jmluGtn66MDzRaeIr04M01cbk3PTCy6o XzknPTPv5A8UDj7Z9+LzxS14ND1L55gt9M5Gt6AqCgwt8zbBJ1rRXw8Gd26tL4zlpbcFVpyr 69hQLohCfK+wiUu90h6pWEIqSjBBBvog1XVddNkIWCZ9ZBKdIOyxxBASB50FY/cbzFKx+5LO NLY8lcokU3fxL5jg7YysHFigLOBTACWSy1Q3Bxe0BHMLmCDDweYygjiaq9TVcXTHeids+JM2 f+SaFzrObWbMkKqpeU7vse/WuLckjA3hkpwMkL5jvjfgMb1lxzlRUgoCvLaVjEx0OIhwEHam pHfZ3W/kd05JNM7OzWhMBF4M2ZxsXJ5dkDWTuwsH9xcPJhBJTCtt5ZbnzliZXdqRaiu6xXar qa80sG+4zy4NYzOH7Zaw85bdmSP0jREEcQjrWMyFQ3WfVi1SChDOHl1ChYFsdEEVUqDmYeUR 1zxCv7qAN+eP9UBwweZ+HmLwXsMJjFyxFqGusKAk0LjtwHq8Th5vYcbk3ZgOXnxMLBxy6D5a 3EjxO+HH/oNVvOxhNO0jTv7fR0YWZ2sjvkXCeRsaV/T3fjvrfjxhbho1Cjt4Py6aBEalpG80 1RODP3TA98YYmx/qCQe2GhzBp3Vlg5gY8zQpUIXFrJlG87bCrs2l3W1W41VNl+CrvWh87KZN 5/7nZ+fMSHcuTM26v+fRXntgVnraouy8FXVn8g/9QmBbsmVebs6iY3N+1vfwjuL+o3Z/K8F7 aKlsWD8xBSg4The7DGHRxEjUPDFK1poxdaZKgqplf3SMo/whqR0KUiX0qCgWLuZ/GidENxO8 xd1dic/Babiqspj/QkUcjxAWYxZtBTCAt+sYmrJguAnMrznWWtvqIkbgVhtqYbRKlIO1FrTm IDSKq662dO01hxXWcSXpu2ztwyPFy9IZzV5fbDozo394lUXWWgbCU9x8SbrkzO8v3Tlcer+V mG+6L7EXyfpCJin1+INtW1+v415TfcddCQj/C2v3iZHKGy6CSYPprK6nNx8fF+abGAh262Vc 68eDT7WTms7UlJyVxcUF0fhFE8RrDVuSzefVr8RIc3ntkmnpqYDQBzNpVKEzY5g+m52dcW7N slXZJYZderjwWs5NgQbvDsVVNC7zWfHdfrvw6x73WAFfSKN2KbEMOSbfjwYR6gSIRYxRPaZI x2YYF91LQw9kMTKEnhh0CFyOns08G6iH8ywbpYZR5ahDot8yAF7wIdd4wU48ayewIdYf80QW MsJNESCd1cDL761bPrBPh48jnzS3ELfLSF6LjxzFiclkp/cOvgtPiRvuJpigkxl1TuJjvYXv NbUsytbMTKQv7O5/T8b6yXHYZfazu6YfPsCnBgIND67k3ozzaQCOdxvijXro1VxSR1/bj2Py 2zGm5hpI+v6RVxw7X2/msKEMI0S+75+HMxZCaOTi3sabM1hc8B5ywj03Y6VbUk3LahYttKbv Kx0YcIZH3HzGwOyyx6JX06h58Jl4GQexu/OF+4+6eYwsuBVhzoD/dLSP9FM6TUzeC2Qzp84E 62jco+F1HbH0QKDa0ftAeS81bXzdEqyx1LrYt1oeBe92zUcd83HHqmdzpLyE0c0qwk0RIN1H LJBd/55DuewYx7+6QJZPmAeJ0WokVkZiOTCbazSTlxXt+cR53jTYVn5e1UZDyfhkX/5zzc3+ M0/ZbPOxwRvT5t0G/XbzJB7/9o25hTxaHz3kr0xIxYpnkaR/7AL10nRPLOZFeohzZb1bz154 jTpTeKSciU0gcmFnBgIQ1jSxdasl2ZjAK2HEwUOIF7yC1lAUAhq9+sysmamxshkTb5q1hpzh IUGAzXgAAEAASURBVCefoFNmYzzwTRS6W2RPvvCTY/QVLshGH3HwIDW1scwRYSYCGY1lNBZH YP9/e98BYDdx5i+9utVbvPa6r3svuGDTm2mhgyF3ISSBBEKAkOQuF1Ig5HJwyfFPLuEOEi4h BUJLMDbdQAwGDO427r3X7d769nXp/5sZaTQaSe+9LW4EWX77zdfnm9FoZjQaQZ14ovNpO71N MSlOl7UjjRUv2OBqj67WkJdkT+zgkPt5AgByG1SVRkXZp/v24iOn1AWXoiA3fnLaS4DE2WQW S4rDPEcEs2lrj69Ar1eTjyaib3MzHoA/mH9te3pBSr+Q5y+tT4ik/qW01GrFQMLOgmXlQ5uT H2p6f8p5TAZs2FIRTy1dXUWYXA9nQMn1gs4z1psc1Hx1CVIMWS4/V8WdRtLi1vGK5f5kNZ5R vtny3sbodmyB7VwK66qaZxBXHebULu91/vlFpw8O9qvXO0gj5yqTCxI9MqzKrY3re7EYBaFw bU+yKGJyXfCBiCAudHfBLDZ6lkwLg6zVwxrgveRjdIhgN4LYs84dX23IOAxWa4EWHW9DdqEQ O+Huqoxf2O6EIosVb9VtDaS+n4y+aeHcIGxSVVwyRgs/m/T/BnRNndWh/6W4uA/tH9gEyAKO stHNybfT+iA6ecgqi42nm4ktG2yvtXXDAMoLu1Kk1QMx8tJlNxR1KkeYUU3qqUG+kkg68m7H J4/VPL26bVNrCl8pJ50CMimW8aDXGqlp2MexJNhrWHjQgPCgzVozeUOG1saM0h5EzLFFtdSR BHlwf+IuZX8VHVrCR1Iy4smuM8N5GwVcLO2RMwMtFS5PAsDqNbxehDnIiwJJen+Evn+4A10s zIu9mgxs18hu/+ioytXQIyo8kmLICFLgJz04dlJkLOa78doakb8nYLS+daq+VtN7+wITMyhE C+UPFKv+CWroi2rolmBoiPM9JyYOzlC4orVjVkh910ceFPTw8drfBu7baexkxwLkNMCiyH5B NQD7nYbIIuJBMj+UnlpEluN4DqmcFrqLwYY/YV+wWM1rTkfe6lihpWLJdKwy1CdE18SwZtV2 +ToMYvoMSjZ37Fzdtj6ttRWQ6VnXauWQlBBoABO6diSeeLeBbFuLOW/Pw51EIimKdLIphCwb WvoxRybqsWCbegvdfQgBQ1XCyqmViu96n15CeyNAHjOD3Xe5hzUgs+RU1X3pwC9TwQO6r4+z FYPNzkbElZ8isZRszjU1+flyU9n9jKlKg6ptT6ZH+IMjM2tD1wwf1cbWY86+mCiINi4YGtAW nRlUl/hUjLx77MAsxv/9ckQsajygYNHiMZMAKSkVBqHiGsZ8/6qUfk6BXurH/v1kSwwu1mNe uytCa4UqFFL9BXpwRWLn8uiW2ujhCn95abAXnkWyVox8xpz6IzVq6L5hN9q9HQfejixdFF1N lmKQGZ7OH1Af9KVrY6mtHYn5LfjyCDHnqSi30HS1IUNpkANGxJOgyKUmnAQlH1xEJliSDgpF 0DzhBUN1l4bJS6Ds9zt3oU8VFt0x3MD2aupR7H1CH4A4KwAPf5ac24uBSUkiqKfLV+FjCcfk UPVNGGOmYi8n8EmXnjiwc1lxyZltyV+klQk9oc/QsXt7UVMj2fXMduQaZZsQSSDseI6IV+0O xdUmukGeg+UYI0iVgQshXU2l4xvju59reeujlpU7O/Y0J1vQ0tGrzHKBD4DR3uBbv2s7Nh+O V5MXMjvZdlgaAWFBf10CPTIFBnGDIB4dv0PMoNGQeRm3XyNeXJ3GQy0M42HPFt2HVf7H70bW aU+PnYCKrRMwqEwpeOxklIh8TfG0BNidYkQ7zkqhCWPnm39Ht+9YHT5lvT95ny9xZwu2POqJ A21ZYa/LlcDNilrcE/qIjsXvoT8oda1y0O0aX44M6iq+4taQJDNlx/3A9BRGiNjJp8QXqkk1 vNz24TstHy1vX7cjtr8l3RrX8Q10ow9OagEOVhdUrS7ZuKpjfW2iDh+yJq1Rlz1P6enDMZx0 saBRjbusLKugs/Q4xntoKWntUSexEACtWB9V2air5/nTRSqZIUI0e9SIlIGTJcmyifp1QPP9 dyKMNTzIfueGfFKYpKRHRqtr8q69orawsCcXYYim8A1wn7JOT++MJ8cFQ327dZ+nevFqug87 aKcWYa8J0VDXYMyDP/7IqI6I9XIxCxsPngRISaluEioKEme5z7cvpfcKKkPC5MPjiC6X7Jqj nZei68KVAjVUoRZtTO1dGt24KLKiMVofxRYz8BBuqmTDDABo9aJabH/80B9r/7Y8vgX9skI1 D8hO26Rq8cJeuj6ZmN+o7YgpFRhj0IB46sotLp3sHkIpW0dGp9odtrlN6jAh80f9jJfjDVEu QHJD/xsE8se1w4V1H+iKrtbVlelAnpIai8nHf6QDr5quTAVXKOooFd9d91z8LoaEDRXkyNP4 GmxWKdjkWAJvoL61sO9Xbj4k0noczg/Mi6datfitce26rn35jbuErf19qR0+hS1A4+guAmtW ltXX4nZJKiePEwdclJqBNv8aUrIIvq29JeXb0qGN8ev92dXsouw4oGh7pPX3laLbheUQb0WX /6Xjw5H+ipHBAYMCfYeHBvfyFTWmjlanG5bGNtSlmvBJYGSpW2+P62pyU2t6bVyrS6njA2Sb yRN35Nwjy+yiXLwStzsZ+UY1aNeVUkUb5tP+EVb5I8uIBTb/qNZ9v09gmy41n0xSyE2/FD4j 6R5FgTcbQ119+Kbrqjt5zxP05wYGfHtUbUkqeSSZLlfUStc9f3LRFIs1+FKP+pTNuTBn5fnj 48MOHzB2UmNx4tHKnDQ1G2HjUgYeJYppN3yetlVJTysgq/zZ5SzzmWqOx19yywsr+BQmeeeg WWvbl6pektj2enTtlsTu/ckjeNCKXVywJph52mmPIEYWFKv60UR8bp3emlQQV/R0s6jLLSKd rJ1QynpkWebIcs4kMsFOmwQuUrfuGOHEf/RoSxR9t+7bp/iacIGTnAL9aT9U8iHeGs23Xfdh +gdPmI5DnknEFWXvgfxlK4/VlL9YbKpSWxB4PJD6rh5/LBFbjQ+74dtIIkNWWNcOBrT/8Slr snLmwnDkUN6KJXTHcwc3iwz7dRBzQCBbBXgZQVP3JXwNZEWZPMeeg44eZKGzYEQfvsZUrIax vWJKT0bSHfiGeU2qsTHd0q5h+Ss+2WXsZdR10/jieX1C353Q8byg4LhU4oy++of0G2JjyK3d tIkgYZdCykSYfwUBVBp+5CvKVp3Mdlf61NE+fPKb9U5cpLjIqQwg66qm6pvTgfcSgZc1P9Z9 IlJiQFjuJIyUNCLgCJLB5sCLEautD1/9uR57gVzU7IT9voN+5e96elMsFlXVpKaX4OVlrxVk oriuHdJjDwe0R2mbL1K6CP/ld0N3bsVUpHEwQEqaRPkvvcGClzdQRI7LEu6QT2nSfXVpbYBf H1OA3oqDQ9Z5HNLsOQCcDyqBAjWvr69wqK+k3FeAqTTUE/4QoGuekAlQTLa9fTS9IEI+uo4v rme/T9li5mk3c4+MVXFLE7jp+0nYy/lYNGSCl5ZNAWmBmBjDlH+doh7UlXNUje31jHqSRcxS cCpBKAXEvVrzv5IK/DUVHEbn+Pn10emceMXIC08NVNeGp01pHdC/e9vBdcZXn3oo7H/Hr78T j8e1dCwYaE+lg6k0mZzF9UAuCeFIJuM+5RMl/nNf+s8Culsg9u159OejNCx9NxsgZpIblgAH 1aCbbOSvCVPHcA1jQWyB6lsd188u0EsCWChLLmwbU7ey0B1h9NHQbGEGjX6vEB1j1hh0VSVG WEFVa0ul9sQSv6tR+uODrDmOo3ILh70+uHtpaSLcZGiJhqyqXy4vjRulIsVASEKhddLhJEsK nshdDyzCIwNPxAE7XzfomHtUpvrTSNJ7oCD4aQEREeT3hUTwg1Rwp+7DzDC5jQFrHkI8CUpK mlzGX4sqaLB4rGiTgkBI2QmGfQfyr72yNpcKY2nrNqQq7SHf4qD6vJL6Wzwei7TXpJKNoWCr qjbiW5aYblH0g1q6OtLyVp5+E94W6LZBS8GTjw3btY28asriRMJhEjmGIkiIWKzIrxkziZlJ c6ShiSyhUn2H0tj/WhuC/dbpa+SmlU/VX+QcDwg2R5KLm9IbY2ovOjdl1cUMeZVj5s5K6yWb kGIC+JUlrTThJiv7tWO8Zz+zmDmbWE6F7yljn5cnU8EpPu10f6qIrjPuqdk793gdXyzrd6MV W5cK/jEVjOjqEPKmLW2qpOhYheTiosTrwpEDatPW4tcWVKIty4H3GLDoLfn+X7CPshu7+/hm 45VTRduCEi8hzxVzPxCsLCHZua3o3bcrwZQxrrlb9OAk/S9dH+zzv9yuD8xLn+fTBoSVBNkO 7FN1oAaHfMmNbcmFbamF7Wpf+g2zLCVwPAIAF9ybCxDY2U0vPJSgeK0SRh3AYx+c6Jet0vwN +PhpttrZTa9OiDiyiTn+T9L+Oh0dYfKcB78n4iDBf+z3VS0em0AILqFuuFcPgafLIG666MaQ Q9XeQyvG4M78YpI5i3sYUz3x6Aj89sjhUZmpbtBw5Ktqm+bbFlMPJYxWjOEp8dT+YZlHNx/T A9uj2qGYHkmTNytPmgw65si84m21PF4cuWZKyjsUA4MpE+za+bHmG+/TB5AJB/JYMwebns6c PARcR8gIupw70v6HEmFsv4BBNJBSHAyH3fMMrDvByqZJ52oNGRNvccKZuK+tLXjeWUdFpAOG Jq7MQew2otsXAWYXs7j3+vz+b73WjweAAVKS5oMNKo0QcwaQAJtJBtKRDwimZTNthgMvkm5P kOn/gUG9d8jYCNtUYTKdmn8x8Pap6f3R+B/qtKakWkG7Y53ISuYoGOHNSZ+lyRhaomuQ5Z6W k95uM+GqxskmDf+YDC1IBfAaJjwD8lQ/kAVkBGPJLWn/I9G8dvL9EoI54Vl7dUHl6rW2PW1O 9VBL/mPJxVO/GyoizcZHxBmwF8kL76ICKBQqWU6l+5a2+v9Qqx5NkiSuus5pcdd9IrHw3096 FlptLPqHaiwfI1k6PuuGcs62+2S/Z/NotYU5W8hWjqyU8YtqUEpWY6h4lo0PO5zmT5MpVGqn S2Y74eExYoXzrM16LRl+PRWcpweGkmzyqUxntuiMvNEPEKkMxi85WUzM7oJKnnsyuhkrhjDY KMkUsTKKernyk9KrL68Lh094o2p51VNQOq0+eN+E2iNkt0oeGwbwUBh4EnLS3CDJOUUp5hIn cUB2lRHwGL7IpxzVfLtSSiilj8cndFWjEnhKyppOrjTihesQTz1r4rHXG/R32vVyP2mgyd4a nTq88g+8F8lDv8Vu9Mgw2U8aMg92N7Slwo1q4jqZQ1OMZgiy+BY9HmKOUPV+Pg0NAWwCmZtl S9WJhVgEmM8b0sHnkoH12DqFvgDNmg2P7DjQBsKBJ9kzkeZf9yx7UyMd/l17Cy+fXS+Pj9wV nUrYJ38z7KMPjB1oeVnwSDBASBLQgTTy64WXw8HVsW200Xw1pJVhYQ2rMTDSxHHKVWLLZzW9 N5reGEm+0aJqmh7uWnZ4gKTIeeElNiFpSVhDS/eGjJW9IGqClgoTY//rKWhnE1OiCO5n+DJP i6IeIF8mVccFNEyWsTnhbJZFlScLjDYLU/vPJUJvpwONum+YquMRLTLinRcXCo2PiTf/0hya CfOve7bdqcCS8+AhvCSmTj+tZ7ascHfguGPfX9gHDRnM8qwbuTU9YXiBSkAH0uCW8KYOS7nM h1LHLHhYVXdjZxNNr8QHA31KPt1TnpvkWk5+AEvijqaS7zalVkS0dTFlEH0HC5XSkRfxQnbL lkPAFjg3CS+cpUloyOQFsR7CkpdS0tUliUdKQsTAcALt3uNSx4s7OF/W/X01tcqnFdK2DNXD 8t/DyZMEjQwxV5t09cV4+L9TIWygg5WDmO93ZAEIl5GmGRJCtQkZ8nYk4zFIZlSdsTAZJMon 60sGD4yNGtEh4U/R5LYtxf/xwLgUXhIRAidmHbCYpNk0ECKJ83CABYQnOWAEiqcBsF53P5/v g6gawKscab0K++XQdYOczRA7Wf+wKoi+V1KPL2xMPtWk7UgoEwMKvl0Jl4VcmHU1a0a4DAAO Q5sFZ1VhMFgSnW/IstqQspeV34XB9A/9Moy/hynKXM3vw3yZ5htB58tY9TC5XBScDCg4idJH Fqo137PxvB+lQxMUHYtLvD7u2DmfM2Q+A4nZ8Gb4eHn5pPFtgwagpT21j317C37w3Ykd7dae LizTrr88HvQGSq4ndkrR4myZ8bbrkcmgEuDzkqvj6pa4XqzoIwvI1BIOXCqSUqb65PmFh2SX WRVfq4wvaEj9ugFfolVxK0Yvo+uHV5698N6WLAnvhkxqXzMnuSlpvtnAm8LSWzgMTX4ZBLfo aZs8VBXcU/Hk/GMtsEInzdkoX5p9jJALcesnAwCv2IkZkhZdxez+i8nQ79PBiebr8cztzK5m 5iFUqwiN4FkKLZIZUItGIcrAaSaAqoB5D3XR4oppU1r6VR6/V5ck77qfPHwo777vTGo6itl1 42AAyylQPGnSyV+KJNcDo5oYkYWzWUhDgImJwhYLhXBbK/FhYaR/ETq8SaV/UM/zkx0ysBia 25NETniSrnpVIqn0wWhsbn3qt01KlUp3+HB65pJzRx02BhwOPNfmEghvZiplSXg3ZFx97gCs Sk2VLGsZlikk7U3F7BiaM9zY6slqDLVS1dA9xyqNjEKUfCJ+cAPDNvytmvpWMvRqyr9J86G6 9qL+d9kduUS9YyWE0YOJoj1oCsZi731QMXF8+8D+p2S/7OD+/O9+e/LRBvR9rUiwzPIseydt DRkvLJGfK2FUKclFXAA2xZtSVMz9Y6IMksVoy+h8uQv3CUXBN5z4oApepVzdlv6kPbWsQ09o KlZ4Ao+6iN9OH1llsjI4TFoSPdqQETuWaofVblDRhOGztbirbVJ8+GZalU9HpwxTZgHSzUEe uhhaNxe7gzOcwVf9IrqyLRV4Ohn+SPM3kk0TXefFsthyabwQXnZmELWKwIJs7BTtQSOMyZTv 3Q8qhg/tGFqFL8OcSse2rcXf/9eJvC/G88gAnkSWAPOkQCWghGf5B1Jgs2LCmS2UF4Tqi7as WFU3JpUo+maqWhbUS+n25qykO6HLy0ZP4OEMO/HZ8J3R1MLm1Ccd+t6EOsxPpvy67qote0yN 3V0bg53kkbIkcmjI3EzKehmPk9PAwB47TTk2eBT4CVlIEj4hSagYlaMaYLJ8m6I+kw7Ua/6B ujrQn0YHjXKCx6qCpp3j9Je7SkZnirI7HXg/Gb43Hq6Dh4rSj34pivgnHnJapHnAWRewG3Ik XOR0M2HSBBNubFh+9d6HFYUF2qQJbQLrSQ1+vLj3gz8c1y7MiwnlQjznGWUAobJwmNkyQiYj TVk73hSy/WWaRZThA5NFAvfkQX71SMr3SUxd36H2VfX+YdIvw5WIqoPDqUJUd0xh6iv2tEAc 8IXK5PKm+CM1+v4YHlGo/f34AK2RF1ybdic5PqN3dhkXVsKQmypT2FLp0ZB1Tp2p1vOvZc+L JTOHQYVXqAblxnJZ31vpQGs60N+fLvWRaXUwMbcz6/LyoGt4bpEEUlUPpX1/iuc/lgz9MUWW vGK9PConZvddXHJBZXOhsyI58nuwYXiM7y0dqc47c2ZToNu772XLW7foeIny6T8N+d9fj8Se 2JIinjkAIszYGIbjSRE62CQegZnoyJy0nBH5UCEKfRhQqK1p/ZWIvz2m9wnhHWylwG+smBWd s1QcM4hX4gA+O+pLV8eTK1uSLzek/l+j0heuYhKHzu6LWRDhXP3KKpOVwWHJkiAFh89Jkm18 hvSrQrnQuUf26xCjCJZrTpOSDO9EOjGUE9bJyXZ/EHQaeJNqUKAEBPyitmIjRkw8rVB876T9 JVQJluzk0cXtzBb7BX+PH0wzU8scjelkc7EPU4FHEuF3tEC7jq82kpdG0ex29pDudTZx2mHo RI4sVuamTZmVoGyMw/m7c3fhR8vKp05pLSvt1pMqy1xPQ40NoQcfGPf2ArKzBT9onkiKAeyX M7hSKTO5HrwOg4Q/4mnnRvFJp8FsZzPcQhXBngGbkr71UbUWWxillV4BJT9Ahh5wBO7izOCQ pLMLSaYf7Rf2gMQ2bc3J5NrWxNMN6SXt6T1x0mUIGQFhoSOVk50ZbTFmzsKaFJ6UAJMKvUwu pwxjDtq86VgOoSHza6p/cGUVsZHr+EXyx/BCxmZJezntjidYmlkAqAPo7FTrar2ilul4DqSm VTVfxXNtfCcGeSRTZ2BzV5TFqxzJcIUMePEe1QHdvzHtX5IM4NFqk0bcwDbScI9w5KiMs+Uo kAtbLjywS9ky8B5tCr2+oDIvrE0Y127Ua+7tiQbee7fPj34wAYstmP88FxIgJZnXQDK8QCWg kCSMPMmkJIxMldNcyA6gZuBETUVnp15T2vDiD2akNLIRI2oP+64uVOWoza67EymqH99V1TvS ekNC2xlLrmrX1kWUphS+MayWY7afPmvnGrP5gzy5HdnEbDK5Mbtx+dCKaap69pRzmULTG9pW 2myQhEk1YDHJeZ1ICcOS3IBbj8xUJtBEJYBRDfBoCr2eHbqKLf+H+fQ5/tTZgeRgsnQW9xKd PdakCrrbqMEcc4QFENP5sNuhqfiS28pUYLXmX675dmu+iaqOfbQwdGDTHciDW8DNrLn95T0y MbMSo0EyVXtxclWmuAcj1WMqM3ntfxl13Jj2H/7brjGj2u3EE5M6fDjv8f8dvnxZOauRzEOe CwMwa5iFpzGwkrSAcLmyg82Recq6ZZTcMUW8LSESXGCYJWVE1pRppDlr0fSRIf3yXvqEQqUi qAwIKViiAQO8MkEH1w9hDrvoFlAip5lTcvFAgaZq0TS+qqsdjKU3RVLLI8qWpD4Gz1Kpagx5 zINBjhplkE0+YxLNTHKqzVFDlV0zTRGKFE5JFWUgvK6eBFJqMEUasnMIC9FlHtQBK0nRYlKE mYyEcU1SJMubQWd/eB5sUkJCAA0PoQVIdM/xGj4ur+26OlTVb/SnJ2BfxkBqOFacobsJFjPf TAP7tUXXzDH/y3iQBJvBadb3qKYe1PxY5oou2F/TgW10IDlY1THaxeIrCOLMrJxbcQFMSe6A yGND5tx3NnNvaMos59rnMp1SfD7lystr77jtQN8+J2yhWSQS+OsLA1/868BEgl6ONCjMQ+4n B1ieWdEByQEDT/9wZjozYZSdgORxMwD84VQJ5hycwVZkdjInkQ2SMcTAysOopmxL6wMCypCA cnmxPqVIGZRHtplFHw0nWhZ8lR5H7r19ZgNxgkPkxCwY0YPdxLCPGHYTS61tTb3bru9JKRFN H+NT8306PpxiNp3cQ+a4VJE4lQMGG7kCrINd1zaU0MgIeALyRoDJC1RDIcNInjCDpCFDF+PU bchodSZ5wdwCekO1dMRXomoXq/o5gdRIX7qMvHau56vkQ3PW4QySRbNVVZRsVPc1atiMWT2Q 9i1OB9/XVDyRxPYVVfSjnEwOuo0o26RFpTnApoeu3tmQmRskwZRU6pnlMjdkTGsopF13dc0X /+lwZd/j2pzhieTL8/vPfXFgm7gZJA0KC5sZPFtDA5+t9oteKE42Q5xGSlZlBp1LsSDwJAeE kFsOmNIi0agfnMQ6+0SGVGW6ZTDZLwEvgviUc8LK9AK9b1DpF1Yqg2phgPTg0OSx4Sf6QNDC FLFf7g19EEosAY+WK0UaLyWW1uoS2uFoektU35fUlyc0rA6rUskbJ2CkPVLr2aSpmLsuVSRm EFQOME4jO6bY8WzIAmjIzqI9MptPPCgOX02PDWdtUg5mgUo08iTPsGtWnaqZIPvlrnFt7K6D pDGyoxy4teTpOj5lMsanj1T10X6tFN/BVfU8RStSyGI0jARxL8TMGszhKTMGjPjEZIeuRxQ1 oahR+g2BvWn/fk3dpSuHdGB8mI9hnW5YgDjzhLvB3ObuGbnI+schICoUYUtT5gbJ4jMhdjWb KemvbN9MewmhvQsG9NkX1t94ffWE8cd8icaBA/mvvdp/wZuVHR24WxkxN7JAo8P8Nb02KNx5 ieqNJ4yc2dBmRt9IGrodbCY+p79UFxSbug0hdM3IFC+wqLjs4UpQ1eOYqMIWoz59bNA3NKT0 CSrlAaU3vmzix1eLVCzdwCsMZI8g00HMtSXQbJFTwSerYmnM4mtHElpNUq9LKptT+Mi4Xoxd dXUMZEhnEJcBvXjw8BcqmEuyY8xB04IrVUASMHPfijNzgFnOLEXVElekJpU5jR6Z0JCZvhJ2 4RDsGVgRI8IgeyUdXhqMXg2ZeHPgvjAZ7qZkC3jSSac1oQkz8RppmzDoG+zXB+j6CL9WoipF ipav6thOoxSraun7j5hQg/6kjndIlA4FPS+lQycNGX7RCzuk+WrIL+6RONSBqo6dOWAFByob d4C7RJgotRM/VICrkgSz43Oxxy9fSTtNygrMNBcyEYSbwJygKCOHdVx+Wd1FFzb0+ItNLS3B Dz/s/e7CPuvXo9ysQ4RZATCMDS/4KFG57w48QXAlDqrlgMgmwSITVwUkKUQh7VqmpCFjbODE FoaAo7peRxomkhziVzHqxBraEr9SGsJ9WC0IkF3P0BKRRwTQj5ubTu7k0bQe0bEWjJwxjTRk R5M6OdPKbo20An1J1Tce8+MK4X0KWKSH5J6RNP13pQpIAjou9oyaCbEzUqYnolKzITvtHEOZ QbT9EbwUZV1goCRmnnTkzaCIDZlr4yW6wmR4RrhykQcwGHDi891goM0TecSJeTRr+I9XOPHE kzZzYeoyWiU217bHygMZafVVSJOHz++g/4UmEqMpKIFa7gMzLSZFWHLMPUkFvPKSHZ+LPX75 unkgKzDTXMhEEGECc4IJIlIjR3RMm9Y8fWrLaVNaCgtxfXTlwMzX5s3Fa9aUrltbsmVLMZbm Mi02BxwRYVSRB1LcR4nqjSeMXImXlNMfUYpR3X9N1Q73jUuG9I+Eg7Q4aJrwZBPVLq3oaM5a 8UxAV9rIVUKuGnxKkt6N0ZDpWOsHflR41GN0x5oVwtYOTqqzUlVwL2BNHl6QwiWBh5X8k3Cm Y9y4zQ9+RZtsrlQBSUDHxW7oFtgIRkh2Rsr0RFQaSNMe2Zm0ITMIwh9uiQMC0fBDcJp5I7IA tpcPjTawXErUnGNDJhkgSVGLnYxc48QdC1MB5L5FmzYUNy41UqAEIIEBCRUGXa0QnfliSVDB yVouZoGwCkfmJGMUebzdpLwiq0eeXDTYpQTv3EBaGlaR2GXFlAg7MwKMxMCS+PX79VEjI6NG tQ8b1jFwQKx//1hFRaK4GMGWj0jE39gYqq0NV1fn7dlduGt34fZtRcYsPuWVTDB5y3lTn8Rm eOKIlIFnmk2qgCQgVy7giQBLUlGaNMUZRqJyNgOwk+2ihmqKpD/mpAFjM4ZR0IA0XsrDogha idEMkTkO/NJTx8GuAUyfoaliFR3MqNCEE7+EDh1MLRwjQEbHOCdjs5I0VzzJAZZZww2WIFZs NjgzB0wpU0D4y3k4YDDbVBpZ8tOGjA2VBB0nJSjlJ0cfmRQuI5QmjwCQgMVscxI42TXHMTka +oyNRQDdqG3bi3CKAcHYCN00vCSQn5+Ox31oraJRP95RP1WCzCqMmKOegsVaLcJO/VgzS9oj VjuZQwgffQWdtndmLPEXjRcOtHSMGRc7VW00i07VnxaM8yUUMyj2HHoE2kA7qDYlApXghaTd Bk1lploCufExLs6LnheHbS7aTTMexsDZMghCmlOZh1zKcjgzROWPbW0ztJue0r+WnxZEHOXd E8NricrzYipjCDuXwYS5mbY2cuNoamIr/LiwDXCVtXG4JZh9SZY7ZeKNv7zLwBaOCUmimgef 5Z0r4WaZFi88Z8sAcBMSD3Ta1FJLBob9YRxmfgxuJDmGabRpkYy4JL3YvfDZjDBvTGkjjpKL Lm4QlMmVdWRGmE0LBKYHEGLXxES7cFokLimjhLTDEKG5IplQBu+9pcysC3a9QM7KtPEaLPGz +k2RrmZtajgHx0rakOQ8TlKnMJ56QMhg3m4jR0ZXNlckV98dKlfSIwALVGZ/eDAZG0/CAREj KmFhNpSLhO4VMTctNXAcT2JC5/GdpWxdMtQfmwgNpRND0e4/uTB78XjhuaWsDJyzO4B7Q9Yd jTnKWiWRo0BPs4nxtVfOnrb06dJ3XGMlFtLxCiNsIo/MsjOzjCr64sSIVC+Y6feiZsZnlnVS gXEiM5s45ajsmYeL21LOpSQTcCBtIxJOdQIQF+dIWKPG2dyVS7ctF5ezo5gJ4ZUUAyGZZku9 2bMkkFhtNqdiUSkowsyrqdNmXVbovKUa7Aaj/Y9p0qayiwnhUiRGhKSh0MBQDziVA4zJzKuL uKhTkjJkDTtd+iNpNMIkqmIcEsEQY11vJEwywaPiGV1ye42y2FhJ08lqCBq6BJumNoJiVBEj MAqgXYvEb86LG2hOZQBPMnXwWsRwWQNpGhJ4CEoUAkmgCk5yPFXi5JEwUpK7Z2o0XaFpV2aT 09MfzpABgGYE4bMeGQmRLeQZYvYZ6ThHIHP171FnYCpDNchKZb5k0ODqrDN/TowoCGpmBsYs 8UhJUeGnBvZsyHLMfGY2L6oHnlQDxwRWZ+uGS9Fwc7Iu+z2ZV2TGz/plfN7bQEI908JlaXfF 04ThTja6i9cWyjBoIQSIKwaO8sl5FHizgl6yXnim0IUqekWZXHiyetNVBm7c1aiTyjFSdoAX NUhsTmZgRP4M7huq7NxAuprIEenKBh/MRWrcGGF0Z+YsGVz3knWIuJsw2TJTTa5O/HU+tcwk LJhnoC3rAtWmxAvPmDJTpZDz1oPIZpEkLDb/CIIcXE6iMryE5Pwc78VGdbv/cIvu5OOCNR9l WL7wHMG+CHN3JKSU5GwSkCObJJVz0kW9ObxCLqzcUYWEmaMESXc854QUm/oABqfILSghFgwR EyvP/Jp4wuo4RHMEtjOLVBClJFfmhecMDMiRTZLqlKxpwp4NV40ikrLzuQtTicghwB5koD17 ZIL0SQTiauSTa6RRQ/9Nrjtd9BZ6zc6gaaKHNHfRoVNETKq2UvKUyAQug9zdlpilK0tKimq5 oJ2HVDaCsVc2zsOBUyKSJ9DJLD0yrziye6A3leTIi8pzKzG4J3ldoCZR6jjx2Xa0YgGfLxDw +1VfIplKpYGiCiQt3BgFGNHWFKISG1gCEB2oWMwoxRsDTGSH8lE61WU5RiDSDAomGEzwHHIH BEsCA8keDlOnQOk+aORe6rxIfvIkA3iSmedJDnTGrS4J5WqAKjct8MaBIYwSMgvFKGVopncw U8jFEil0gcz0CAhBxI7lFhmHZZGloRT8+CUGrKaM3VAlWcIg2AHIkibSqqd2Lp4ijJIDpizx wudHU4BryLyOqBxn4Fo6C3RfQ1aLMIHz+PXIbFmyJbK6Shmw+URaj8eSiaQWQhvm8x2srdO0 NlWJa1r/4SOwQS9eve2CXlKT0DImIolgyB8I+pPxVDye9mPPzqKwsQ9Ubg6eeC7kHlWS/XbK GzFs9kuRqBGp3mqdct68JzWFRxFe8kyxGPBkz2RA15JtiVQEuxYo4T5F+OKhfDB7DqtZCyQr g2RI07X2pmZ/MBAMh3wBvDEg0U+BZE4NWXfyBVkUBNHQZS2Q19RILNG3oqxvfmE4Lz8UxLtk anlZQyrZkkp1HD2aF42mQiG/D2jalqG/btxC6V1GLAdGwi/jxC9eXguH8gb1H9ARi9TVHSks LKmsLEvr6Zrq2rw80mQyz4lG0mcjGaE/RCtcw87nwFMafxlXNHh8YRZk/Iq1nyG9HBE5wUOZ JZyrKMm7K+HUREpBypo1ib/TmcbAIqmVlJYW9yvGHj7VR7GfHvpFsllWj1ldtUxQLoMELCUb /gBLCWBhUrS2golgGQ+26id1mF4phIotNgKBwl5FZA9/n4qabxZsF7PYRTEreyLEA5JFq9yQ ZWE3TUhsmZOmkPHXwWzzVaBSPBlRqujv7t3fMPv8WRddeM7UqZOi0Y5kku2ipHdEox9/vOw3 v5lfXKSHwxhokrqAgaYP+3iTF9RI2dAX0IhiWsT4ix3nAAPAVwZV9L+qqirvufcry5auePR/ fjF79iXXXjunpbnlhz/69ZBB5YUFftLdTmEzT01L42sNqGzmMICOJ9EQwgA2NYOfrElDHTHr jFF1jJybFYQnGcDG6RKSJPlIILcxJo2XrMYVSZkYRYg3cc/GznPBlTKy+MtJAAxhm0pZp8gP 2M7LVVhcMoNFcYFkZuoQfgw8/WMlTQW0JnAmguV6ABiZosxS0lRg4+FIEeAlCSSpKIovjU8/ af4zLjnvousuBe6hu++PxCOKX/ej4pKCZ+0OtrRAs4KN88gUEG2SULfIoeFjbRq++Isiwn9S P3hh6RhfaJpGvjFGqiohMDJJANTTqK06tjUjGwahaqfT6ZKy3tOmT2tqajp4iPzLzy9kDZyY BcBQ4zwspBgpJ19GjKUkI1sGorM7m4H5BJFwp8BucPEjffqU9u1bAScWL172zsL3Vq/65PDh IwX5+XfddfuPH/gaXqrdt78mFApgeLhzR8PG9Ws2rF+1Zct+zKj5sDEAPfx+f0ND29at69av /3jTppVtbTG0e6kUPl0QqKoa0rt3ud/vi7S319XU1NfX9S4qikZikbZoLJLYt7X+k/VL127c vnNPDS8vP25fsfS+jTVr1i/9ZMP2mtqj9JYGOmc5QRHLZvbzX5yzdN3ir911q8Q4ZsLoj9ct /tFDP5DwYvKb37/3g3UfiZjuwLOvvmTR+sU4R00Y7dTz018//P66xU88/3snScKA7e7v3wsk FALGr8SQIZn5KmJU/HIAqliSYXjS1QQXFKikJTu6rWHahTMnnTmlamjV4KrBZ197gdKebtnX SL5Lgp5ZyB+LRGtqapasXfrx2qVNR4+mk0l/0IcGyB8gjeChw/tXrV324ZqltfuqtXQKSPiE 6wQNYGN17da1qJErag/UpJOa6sMXAJSOtkh7a1t7a3ttTe3SVcuWrV7W1h6BIYwlWptaA4HA ZZdfNnXa1IKCgs0bNuMGTVw8pQ55sp+XjZQLV7yElJKSBiQlBo+kM4LkNkKk0ZrF4zt3H/j9 U/OrD6wj+5r4/RUVff79p/954UXnr12/deOmrfW1Rw8dbLthzrkTJ97q8/sPHqh56eUPS4r8 +XlBaNmxo/qii6afdtr1vXoVxWLxZcvWLlmyo1evPH/Qn4gnUqkkeKqP1K1dszGWSOQV+ceO H4MhaKQjesY50ydO+kZDQ/PhgzXLlqwpLMaYU62ta1V8gc9/7cqR46rqaxo3r9+xY+uevKJg KARbRi74fZJFQ8qyHCJn1mWOTqRdlQGJc+5z8+68547Tpk3hPAy47KrLYGDR3xeZeOMvywVL 4GLYtmWb6IfUXzRlwSKAooAbfMlVl+3avIMWMiWrSu/KiumzZrjxuuDgEi5UF4JY66g7KALJ YUgRpOSsUFQcJGyiQtGeVNIiSYKhIqA3KfsnnT4ZrcyaFWsCocDUmdPfnje3pam+3DfAH1Tr t9aOmD7ytOHTb59wN6Q3LP/kwLb9DTvrK0b1aaprKetbdukVV1aNGlZUVLRzy/blby5vjrSU j+yTiMXj7fFJ06Z9/tYvFvcu2b1115olqyJtkcLy4jGTxwf8gWQqWVxcfPfEezo6OpZ/tKy+ riGRSAwbNfyCiy7o268vLrB4KhGNxWqr69F1QEBwOeDg2Wf5kJJehcxkmQj/tWTNaFsYzkQs mmQLyTCu7MRDeWhpCfYExMy6G++0fpYTNRgI9C4tjLYPLsgL4mElPowx/5UFUyZPnDRxTLSj Zf+ezfc/8C9nnzWV1ExVPf/c8MSJk37/5DPVRxoxyLz99huuvuYyzKWhIxYI+M4777znn39l wYKP6+tbyZgUNzRFGTFy2KWXX9Tc0vLBh+/MmHHthAkTyQMdPV1a0qukpKStrX3AoIG/feyF PNU//cxJl1x57ukzpsSisYIzC885u3HXjj1/ePJZLQSnSL2WpzY6neVuCNiDzusFB1atWH3+ hef1qayor6U74FJTZ5w1q6GhYcVHKzmb04O/PPHnp5/4cwYGp0hWzMH9By689MInHnlM5Lzi hqvQQQBJRHrBd938dS+SE4/YZPU/Fx5oZmz2YBODTD/Hc3OokxjOxSPJSbPOHDp8RF1d3Y4t 20Ph4KVXXD5x+sxQfkksEms/0HLudRdefO2lFZUVaU3DEGPWzFkb125Y9fHyjxa9O/3Msz93 /VVDhg4JhsK49Z5xxhljx4zbum7zwlffHjB28C1f+/KQoVVlFWXxaPyss8+eOHnia6+/vmnL phv/+cZZZ85qa2vDQDI/r6CgsGDmzJnLl61Ys3JNUVEh2MrLykPBEOrs/j37Du49GMoPo5dA PlWX28Fzmht7z3PJPbLuW/AqWlvdySHfnIVXAuYbmqH8vHB+flFhQX5KS6dT2oGD1alUqqi4 sKwcY8/ep58+qbExevToYcyFVVRUTJwwYtDA/s1NHfF4asaMyRUVZVu2bIm0txUWFs6cOWvC hBELF34cj3fACpmYUJTi4qL+A/qF80LxRKSsrBc6/ujZrV65vqb6CPrepWW9xowb2R6JVfTv O2JE1ciRw5qPtu07sKu0rKx3ee8xE0cPGNjv4JGD+eQxgd/1ptT9CPeIhrWrP0FDdvUNV//p iT9DITI+esLoIVVDXnxhLtM/54tzzrngHEQpEol8/MFH85+bx9gwahszfuxvzUYHyfMvuqBP Zd+OSGT9J+uf+S3Rxo4Z5868as41fSv7QsNbry5Y9PpCkyL/fe/td2+986sXYZgp8Fx8+cUf vb8YmkVuau58hty4fuPfnnqhgTbE93z/3u1btr0riPP6I4ozGJkFFb9dOLzUiniumSGZOcM0 efieikXbJk6flJcXbmxo2Lx1cyAYuPyqKwcOqWpubtu4bkPI7x89dVzlwP6Y69q6dQsaMjQ6 Q4YPra2raXutfcT4kUNHDkNPau/O7bFYbNYZZwwfO6K9rS0eiQ0cPGjk2FG4Fnbv3h1pj4yf MH7oiOEDBg/ctW93r17Fw0eO2Lt7L5rOffu2FvcqPm3qaaNGjTx8+PCBffubjjZhNUCkI4Jp sob6RmNcmXP1FfPuFlIWj2xcbpIOnBRaQmd6PefIMDYiJ+VzusDw3IyU5HgGSEqEJNwi3Xx3 cRlr9DfRzUml01g7hn50kqwgSzc1tSeSaUxeDhww8JprbhpaNeSBB393330/vu++f/vWt76J aa8rrzh3+owJ/Qb2mzVr2qqVa3/67z+9885v/Ou/fnfDhi2DBw8sLNR8vgh3wwBoKZLlGMFA S0vbQw8+eu+9986d+9L27TuHDR2aVrVLrjnrzPOmayn95w//6oEH7r/zzjveXPBGeVnJnH+6 at/BA6hn5IZGsoYMWqcUmZyTJFASM0PJWInJOzn3ufkYX2B0STUTZZdddTnY33njHfw+/OuH v/29bwPYuG4jfr/9ve889Ov/ZOU0ZtzYm77weQZ/+a7bHnjoQTRVm9ZtwJVz251fve/hHzKF X7r7tkce/2VhUSHTcP/DP/7S3bdagaCFyZ0/fPAwel7nzT4ftli+Ro0fPbhqyLrVa4EhBy2V L9916wMP/ZjoXL+xvrbupi/c9PCvf8bogNG8MjjrLytidDaMsnYF0HOip3EhsMuBOWf/ZQyS UaaZIS0rUOJX4+l4Q+2+KWfOSGn6uk0b5742/4V5L7a2tYydPL5q7LA9NXuGTB9x5jln1VRX v/7qa9+46647vn7HsiVL0TwNHjqsI983+/JLMXZ49rlnb/3qbfd865uvvfwKrJSWl6GiXn7t lYUFBW+8+cZdd991/wP3/+l3f8KCipkzTj9n1lkJTLH5/CtXrnzuuefu/fa9t3zpll07dw8d Nmzy5EmLFi+a+8Lcvfv2rlix8qUX5819Zl5eUT7GLGS1Jo0Mz5qUNPBW9gg3ZNjJpTIDrEpk 5smFemyHlrl40GkeWo3ITYM8j8TTSTU/nB/wqx2xGHpUo8eM6NOn/A+//x7dKxNPZLThw4dH IlE8mhwzuiEaS81/+e3CwsrJkyvwjeevfOU/Ro4sicX9Q4dVIfy0rsIdUhQoHRzo8NVU1+zZ s/dQ/bpBA8a3t0brausr+/YbUFqK7tjgwQMGDR748CM/RJctkYj3geGy8ijU+YwdBDGOMDVR dSfZDxtdcqcmT5l0YP+BHZt3XHL1JeddeB4q9+P/ZYz1MMF/0803XXz1Je8JXZ6KfhX/9KV/ /mTVmu/d/h2m5K7v33vjzZ9/+YX5TY1HQXrp+bn/Z2r4xg/uBeateW801lgjWW4aADplYOjd r4IxXP+FG9BbefnZeZdcSabt2HHNnGvQR3vwXx5gyfse+sHnrr7CJHb3L0ocNct5SHgp6eQH hlUeJ4lUWl3166Ey/5AJEyeUl5Vee83VkydOAGd5n97Fxb2ONh9Vw8FJZ0wOhgLLP1y2bfOW sybOCOTl/fG//i8QDoaK8y49a3Z5efnqFSubDzRWhfuPPn38grkLPnzrw0Q0HvCFRo4aWdGn 4o7b75gzZ04wFIQfwGBdWFt7O26rBw4e+OuLf92ze88F51zw7gfvfrJmzRmzzhg0cNCUcdMK igvQzIVDoaLior6D+9DH5V6ZcGbrpMDQL9nSK1i68yAf5OQklvT4dc2KocGkSUmgGcak4y+7 0znxjAWuEBZMP+XnhYoK83oV5bc1tx3ad2ji+OEY81cfacCZFw7h5oOnz2hByCSZqmIguXzF qqNNR3v3LkWvHo8L8IwmFArn5eUNGZJfWpoX8KPI8VjUxS6Q0ITFHJpe3liDpwGYnCVPjlJJ rIQOwa00HgsRW2Qio7GhcePGjatXra4aODjkD7G3DYTcEZBbYYBE7VqS9w+YuJTkOo3g8rSi vDr/NaRu+uIc3BUxHTN2/NgVS1YAvuCi89FZQyvGVf3mkceAOW/2BbyMcE1eecPVmMP629Mv cJVzn3rhZw/8R3PDUUxv5RcU7Niy7aJrLmFn9eEjwHxuzlWcmcUCJnDgd8H8N8AAQcZw+pkz Vy1byWD++8SjTzzz5F+YILpsfftVEhJCaR48qlKc5SSt1UZ1Yx5QDTKbWV5S3w1JfnqJWBcO v4IQsoDa0dqBVRcX3nL5gIEDE6lEWXn5xEmTJ06cjCmtXiW9xo4ec8PnrvPhOSM+S0hGGzpd NRkM9y7MLy8oKM4vLMZHkFSsCvfnBYv7lGH9V15RXrhXfrg4P1SYh4qdTCYxC4bcwBqqLauQ O7buwEpXLFsjYxiMXUKhAaWDNLIKQ8PLMfmFBVhKiRxhjhhDEFwcdJhkxtQMAnLayQORZSeR Y+MSAlk4kurqwZUDIM1UD/TInDl0YrrqrihHtGKBDIYwO7bti0RqEfJkyofpkvPOPSMajW3b uqGpuWXa1Akdkei8eXPb2loRs2DQf+65s6PReCRC5sjCoeCQIQNXrdzX0tJUWFh0xRXXlpUV z537env7Ueg2umHokKFUEXlq0Oye+ehbUFjig6ApgRBWaeA+175/f+ypp5/C1BpazOHDR1YN GQpb0dZUoAyrdIiOE36QcvY4MKmPqf1pM6a+9Oy8q2kL8gJtlTBUPLDPmmJnGoABXtRUVFyM 5OqPVnAkOlOLXsNEmMpIP3r4x5zEAIaXkCwJWfS2Zl9+8TO/feq6W+b0rqhAz07iXL9q7Ve/ efuwEcPR5oKELpvE0Klk1sIRQ8eYeZGKpNyNoqVoT0byCvNHTRwXT8SffuYvrc3NuEmiuqEN uvnmLxbk5Y8dP37Xlu3A9ansc7j68KZdm7D66Jorry7vXZ5MJ/++cGEqnSwrK1dD/rq2+ui+ +JmzzkTnrrm++Z09b2HxYyqZWrl65YqVK/zo+an62Wec3dGOe1AHppKLSopGDh/R0R7ZuWtH e7ytd0VvLF3C3RcrOQYPGYgcYcatubmpsam+T99yuISaj3rtlbus0fMSPEb47jZknchPJ1hd M4u+App1vE6koC3TdUxDRSv6Vo0aO3HWrOnV1bU7dmxraW2tqW1ob+9YsmTJkSOY7NfxfHrG jLNRGkcxnZmqg/j48aM2rF+WSHSUlhZcdtmFaIBeeml+ezs+hgmQFht+rOIjCYomdzlKIGz5 RaEjh2vr64/6A9qiRe/BFdzMLp6tDagciMFse3O8sFeIinU3z66B6EHkymUrL5h9ARROmTZl zao1Dea4Dz1cyUphYQFuBhIyc/LiyedlZpCoi9/78NwLzxs5YfRpM6ZiOcVOrMawH7/6/aNA vPziy796+JcYAmOCHwNeO0tPpqTCQ1UgNzjzYHUEPBwARYR5kkgwgqrE9EQor2DE6JFoMJ77 y3ON9XVY+IivEcbjsekzZkyZPGXk6JHvvfJ2PJYYPHRwfVN9ZGkUsjPPmlVZWVnXUP+rxx9t j7STSYy+5fjIW2tH6/iJ488+9+yDew6+/uxrR6qPgG3btm0LFy5EvywYDI4fOx6Ta3gSmk7h sXvJlMmT47HY0hVLC0sLBg4aiK5ZfWPDocOHMKog1RpzNbqeTOOdP7ranPhtHVI0LMLJARkN mZeXFl4qoozecykO2NmZLhvOg5PxgB9rlPNSKT0/L/+MMya99dZzWGWPfnJ+fkE4nIdHLb99 4qlkGsuR/X998Z1p0yY/9/zz1UdqUJYo8YLCXk8++eft2zcePLB30/VX3zjnmpmnT8WUFoaW gwcPfv75ea2tSr9+pei7kYJk5YnbGabqyUJcDCUxlgVJS6KrTss6FPZXDe/7/LN/j3bot91+ /aJFH+zetQeLaYsKCxOJ5PoNf8kvwoMH4ykKz5dLnh09NjTVxuHKbVwNYOF8Jn/Of7liBix6 Z9EVV1/x1btvnX76dMwNMzWYnkcDgYeYvCnBalVMvWPOCx4yQQAYLYL/ultufPWZl5jgtV+a c+/3vvP9b/7bqqUrbrz5puu+NOfVZ8izThyY/Prpoz+b9/zc919b6OU9Hll+4zt33XLHl9Gc /dl0honjF88r4cPDDzzE5+nwnNqgMo34ZSfFelnhCgEwHnb/EvEizCMmKmSwiGFsIobrZ9pQ t+LRRP/SfuPGTRgydPAHf/+gPFXUf3CfvlVkgLxu6YqDO/ZW9u47asxojCgx83juRefOOOP0 Sy+7LJgXHDJ4yObNmzFrAY8XLnj36uuvvueb99x8881YTjFm7Bg0+lt3bt3TsXfBKwvu+tZd X//612+77ba62roRI0agL/a3Z+fu33sQvbNAMHTDnBtmXzy7qbmptLSsT5+KtWvXrVq2uk9x fyzBwUDzrLPPPO20KYOHDHnz9bfyC/OxIwPuymIoXGEpy5SHx8xVgiJNMfOvN2dulO72yHKz 0i0uMuTT1YqBgw8cPLR+wwYs1cOKU6zjxzPj6pq6nTv3/+7/3sgrUvpUFBUV57e3N//Ld392 z13/PGb08Pz8vJqaunnzn5r30uLCQn+fviPvvvtn999/6/jxY0BC/+LJJ5/6wx9eKS4OYqZs yZIVu3btSiYLa6pb1q1dj1XQ6XTp9u17WlsjdTUNlb0HhQsCLc0NO3bsQi8dD0wHVRWtWr2i vqH6li9fhyl/PLpesWL18uWfvDRv0cQxA9AEYmatW9k+LsJsdIlJdFh7ff4bzCYGmFded+WD P3/w6SefxoIGtCBfueMr5JJ4ypoOA+crz8y77vPX337PHW0tLRhRjpw4+rrP34CHj2sWk7kt LIb42j13tLa0ouUC6Yt3YH3TkA0rzaeQzJLj9/2/v48WMNrRgSkzidja3ALM+bPPZw0ZumM9 ONMv2RKTKEVcl7wsxWtUhEURVxjVIZlI4ZVG3a8tX7Liw/cs/MEYAAALq0lEQVQ/KOnXGzfL jjY8pFIGVg3bvHFre0d0xpmnD5s0/CcPPXjrgdsmT5kydPhQdKbmvzRv2bvLNq7aMG38tBcf e6GxpnHW+bOGDhtaVl728eKPn/6fp2ura6dNmr5h7cb//fVj02dOP23qlJLSkm3bt70y77WP Plrc3NZUkF+wd89eTPCjtzXltCmxePS5555fuWT1zu07q0YNOlJd/cbrb46fOK6yb1/Mu6H9 woDXyrNrfk4ypDp16rmiS7zARKQFc7JZhgaC/uFEzm/DkMklctiQDCUi7WSWQj8ADxAx0+5X YgEf3isic/OYDojH/ckkJtbRiUYfiI7o8foYJt/TjeFwEP0nwB3xYkx6BbGsy4+PKmLlWX1B QR46XKkUPlCWl1/gw9vm+BpvMtHk91fqehx7bGBSX9d9eXlklVoqheVgweIC8owUXTRNwyRs S35eBbKBskYypbWGw2HkQEuG9GQorWLBYZAOg8280b9mwGxIr0TmPgKLIH324aJaMsR7eQzP qTx57/fv/fzNNy1+f/ED3zGeBkLprHNnfut730IPiHmI2ahH/v2/VtMW6u4f4NHkTbPpsHHG eTO/evftfN0DWrHHf/G/rCHDM010wTgJGn7x7//FSGIJ41EAptJ+hn4WmVxT0OT97vk/YLLs J6Yzv32BvJ901xfIetf/ePRhdNaYS+iGsJ4jgDu/8PUP1y+e+/zcxx95DI9Wf/zwjx/68UML hQesTKRHfnkAoQ2wmBd0wpEUGZhFwkOx9AGUL6mkWuLNFfkV5EVHk4KeDzr/SS3ZnmgvD5fh vcu2RARvS+YX5EMq3BxQUL/zUFeD6PWnI+l0OK3lk/FgR6Sj0F8YwssB4SAaIFwDCS2e0OOk hidTxXm9DtccxhrbR3/1P3hN5Sc/+cn27duLi4qh049126jQeMQe9GP+N96RVvwp1a/5tHAg iJEIdNtyJ+bUyheD5F9bDOyC9pQ9gFyN2e/nCAOQhSmafvRT7UpDRtTZXDXccZqxYbrRkFGD ahxtSCKSTpF3xOABfVyIRfR55b3x/XgdS7oIlg7pWpqq8bARRYHDH6woKgyRXh2mVFWlsekw Wingdby4my6uqChCXpLJWHtbYziE1yvD0Y5EJBJTfYHevYtaW1sSCSz9CfbunY9eIeyTxjPe WlpSSUacaP9S8eaWOqzrQQiC/oJQsKiwCFUMHXlb1qnD1GkOZQS635BZ5WM6wjAc75rkTrGB 8ennzsSNHV2hVbQJk2TBzDBofYYMr8JMM2unOBsYQBo8vAoaGInpNz3i1gggIc3KYsODB4Pc quFV+/fsZ8NeNFuAMV8m6uKyIrIHYWSQeSvmlOl3YgjebBFQrLizxhLxpsjRytJ+2FmFkIgu VEbcqrV4Mt7S0dq7sDyUF65rqgUnqhl4CtOFeGQZLspD78wf8Lc3tnckOxK+BETx+AsTZqFg GJcDWqVUMtkebUc7iNcl8a+yvLKmvqa9o+2/f/mrcePGfvc739u8ZUtZRQmkCqAuPx/3e9L8 +fwtR9uT6ZimpLAioLgEj3EyDChY7m1FQ7PvnnuDm3IIP15KCMsxachg0HKQ9zctFPWNeuX0 2IYx65cNaebMQloQy5LBgfLG5j1YXxMMBohDOultYTUsDvKikjCWR3XJCwcxtwU2oJMxLMeA 30QvOlXof2E3RqpBwXoKvDGOuoDqggeaeDSNZMBP9mvEzTKZSIOZ3Jc0DQ+tEQa8XwlOyMfi CRIAtJI+XwidQcyI6Qr8gLrMI0opbEbeHH9OkoaM+UV8poXCnXcCYg44VUSKsL2EDYqENCuL 7WqReLhOCc9lOUPPAsggs+iaUwkpOYOSRQ3yh/2pWIrMqbOD3vdQtdASYV1rMpYACRWdJLHc h9xokxphN/hJDSa1zg83SK0j642MOycRARXPzOkaRogcPHwAWx/c/8P7R4wa/ujPHzt44ODg 4QMxI4ZxLoYnpk68+efHoBL1G0+uUIuFa94ZPCPeUtjFdkKUcbAxopcSQu1KQ3aafWgpesAN imUjumXBFsT8cKohTQ9XKJLtomYdMTlkqkeAzXueaUX0GKpMLQbaTrVkTeWMLuANb0Q5EQbZ SjJIsmhmh/+1+DlKBCjZk8dUziSYnxKzlAQnw3C8nKQ6Jaqp3/DMSeUYrp+w2t0TQmPokegM KyGNpL0MJB5uyqxZmfQbNId3HM8AMUcSyTWZnT87h1E2vJNgGDIF5Vx74e3+8ZjQ8ayCla7h vHBLcytu1uTebGdmUSGviXfmcCixCWemmqxG+2smDQe8ZBmee8mSGFpiJ61TYLLfzORnfz+L wD9WBLyu505FgXTNVLWlpTXdhGXbmGlj0wad0nEKMNNhmuhnjwRPVCjAuemWGlxBnty6DB2O zqcpZf61ifGETGXaZCxnNwBGt7ynaT6LLnPb0rkZMPtLNlEzq06i7I9d7ISneDhZ5q24Uc84 tRt+cpW838GUcXxm3RnYQJIclJKS5gyqJM4ckoYpzG1xZgviKAp44e1cZhXCoyuMOenGZJkE Oc2eZ46WlLsmc2TOkc3VhIyEt14r+yUzUlJW1KX0sdDZJUdOjBDLPqswPBT2+nNiHJOsnoQu SR5mSPLAZuBxkjohJURHAM3mw9EmMltZ9WdlcPpsYUQ/LCymc8lBXyIQsPJAm1v20GIT7ZGE zRA33wXVLkPL7qjL5IHo87Gykcn+Z7RTOgLHo8qIVZQFi05cOdGE6I49SWOMmTIcp5bPnQql oyGTisej+khoo4cvYc3SNmcxOVmyYXeY96ulYQPlyk2FXSFSHgY9XiUzjXAp5gl3zLrjWoZM GdMUl7VYXCAuxWgs6SIq8blwMJ8IgY++mU6ZV1Ll4pQLylDikBUd5kTLogW56PRCcT2uDK5U J5JhnPjcdYqcTj3OnDl5oMEVSTTLAZX02ZLm5SN65AJ72TLwNpVOcTvZ1JWLrMnr1NnzGLuX ZhRpnB0NWc9b/0zjZxH4tEWAXb3SdXUsMplLM5ELz7Hw7aTSeQwbsh6JL68rkjYpydm6FVyj z2Uo4yZcn0pb1BxMdorZ0meKsb9WHk28xXmMIcMB7oHdAZ7idMMdQyyTc1xWYvLCG2ymJVc2 IF3xXiZyYZZknUnTIyclF4zNBXEESAlMt8lj/rU6JLlbsHvJNeWioKd4jpHRbA0Zz3kX7XdR rKei1ik9PK+dkpKYWYa7o4qHLLMSgSqAxBuW5GokB72SRIqPYrhGaOGwl6SE76xhSVxMeqnK jHdSnRhYMZCZs5eRytWCi8Oi/52DTVudVWXj5wlTW+d8kLhzUMJZuGVJx/FJ9vye/cfH78+s fBaBHogAvwq7p4tdwz2i7MQ2B90Lw4mRRsRw4u1D+XANpTzfLQvRNNclq2AEG9aTl2tmAz1z yp/zc3rugCVLIWvWXh5LGozsjzRr7jDHtdry5WDrBiKjBW6Vc4mW6P6PIgIdKy5B8LaEieBP P1jXTNIsiUhUrtOJJ+rNQ1Jiog1/MlPBzBicbK54ic0lCVRmd7l/OQCSfiKRRblE5go4wKwy NpPZqr6EKrFmsci5TWXMgPTLuQztGZklWa+kpdONIzPVTcLCwTucn/XIrIh8Bv3DRaAnLtF/ uKCdZBlGI4gz2xyZ5DQv+O40obALPUQDVyeZ6ZlkZ7V3lt/Vyx5RwjSzGPecQqaJl5yUlHJj maUChpSFFfoCIlLSkiHJ/XDygCS9D+jK7IqEts7inQ6cGAz3u2sBZU7npoRz5ZRTL+7u+JmT 4U4w5dqQMZ+9cuRq0JnNTokbOnlH2hxjutryRDqdAKuFtCBBA3fTlWowSiM1QfxYgTm5JVzG mbzP0Udu0s7P0a4mONUulCXlJSXhXWuBxMMteeEZQ2YqV9ItgNuwR8qe4i2vB9qgcyoHupEP 5pikqVtZlYV51mXCsUnn2pAdG+snsVaUMYoic0kf57I6CaLFQpI1MN3xlAW150ObS4F2x+/P ZE9oBP4/iJkLAS5nbRkAAAAASUVORK5CYIJQSwMEFAAGAAgAAAAhAJ3tNlNpBgAAnhwAABQA AABwcHQvdGhlbWUvdGhlbWUxLnhtbOxZT2/bNhS/D9h3IHR3LcmW/wR1ili2261NGiRph54K WqYtNtQfULQTo+il/QTDdt9hwC5DtwHrsEOzfZlsw7od+hX2SEm2FDOp27TYgCUBLJL68f1/ T4/S9RvHAUMzwhMahR3DumYaiIReNKLhpGPcOxhUWgZKBA5HmEUh6Rhzkhg3Nj/+6DreED4J CIL9YbKBO4YvRLxRrSYeLOPkWhSTEO6NIx5gAVM+qY44PgK6AavaptmoBpiGBgpxAGRv9ne6 Wzu9itU4blcs86HVfGibVt3YzPn0GfyEIpELHuP7kgs5sxl2NNSO0aElLwmfDF3G0QyzjlGz a1bNMqqb16sLABOruIH6y3AZYHRor+Bapvxf0FMAJlZxptk03RyXAbDngS6rvM263XDcDFsA pcNV2v1Wa2CW8QX6NY3M3XYt160ASof1i3UsgNKhc7GuBVA6bKzKDx6xmyW8AvmMhocXU19A xhG7pYW3THMp/BJVLcRPuj8UpWi6Ox5TjyCX4SShHrJVRAX4UcQHAFVuxoKGSMxjMsYe7Nji FDPJCG8QXFhPl7xkZUnyRInHaSw6xqcxhjRYQl6fPH998iN6ffLD6dMXp09/Pn327PTp95qN t3A4KW7866cXf39zogcmReCrl5//9ssXeqAoAn//9bs/X371x/OvYcerb7/U7NjieFjcUTBF mTIZ8nVwBz6mRZwb8RHFaIccacB94ZfAO3PMsAbXJWVD3ecU6pkGeHP6qCTlvs+ngmqAt/2g BOzhabhLQl8HlawK0INpONHz5tMibg/jmY61e8aZ/WkMwUt1JF2flKTcZeBfPCEhEUjeiw4J 0Wx7QGnJrNvU41ESjQV6QFEXU61FDuiwFDrLTbdoAG6Z6wQEb5dss30fdSOmI98jszISYl8f QISVzHgTTwUOtBLjgBWRd7DwdULuz7lXMngiOHAnLEL9EUkS3Z67fF4S9zaG4qN1+zabB2Uk F/RQh7yDo6gUc9Gh6+Mg1spMIRYL2E+SwyhiGO1GQitEVE4QOQc/4PBcd9+npOTu8/L5Hp2U BFmGhbwz5bpEIFE5CedsjEmYFfJSIQ5oeFWVr6ryVVW+qspXVflfrcrLQqya7bylVmQCXX+t uuoxZWxfzBm5k6gSnoB6owEsqonatGjnYx+GGbsSbsKxGiMeic+o8Pd9HAMbS3GYJBnpSYLi KIFDhFrW0lZnTQo6qzUHjg/q9ABoLLajUXaMlMv5qWJBRs0m6nCaM6pJAusyqzUvx8xKgWty s5Roq9wWKmu5qUtmTcgbhOUbAqthp6whUDAjI2n3lEDulvfuosTHI5L5SOq9qoil7LaG2eQR cX1ubUn2EtzWcVKRXf0cdrn3LuOlnMDSSzJvz6QjC8szdARSObZjIA/HHWMMHRcMgxjoJbJU YTYJO4YnMlXemMxnFdaHpWWeq3CJRcwT0cOJn+5St/K3LuFSftupSzu8HwU01Wg9KWot61+U Ql2KriXjMfHEOSvLaXYvmgrC9/3RERqyKd/DILcMVdBnRBN4VKhYkxMOGaruwKyc+VkWlN/u LLIDs9jHWU2SKZprmMLVeCGDmhXEW8zOyP6OqqiUf0+qFMP4f6aKjFxocGsjdfSCNoBjJGO0 Y0Rc+BFUodin3oBD46B4gVwI0kKKhJh8MS1lJbNl3UpppEVu4os9OkGcQqUTPidkV2R6voGY lVXFLDMyQlmdWYibxOl1SGaEHcjsbUj9DeTn1SQzhMKddVp5nhljOJGJ+l/tfNKwedv2YMko 3b8us0LRLzwK2pcT4S0ftWnFWmFnO2s/amM4piD5A4Wbco8t+9uDaA+8jxYdJYJArKSNB5Kp mI6GIHO6mHKTpD5sG7V0wYLvB2w+C8ZetEtnjH0xu3c3djYq2boYRxpTV1dTVLZH+UFGzVa+ SkXDR8C7B+ejKRNJ+t7pGA6lbv61Aejkq/lT9ligKacd47HpbNVd23ErZsvpV+q1ullpOVu1 ypbj1Kw+9Lm9rv0E1BR+YDkp7wEcoNk8+/6m1le+wQX5ue6aFwXVSB28qmqz+gZn2dpvcLtW I/0Od0CCGAonMRCFp8njhu323O5Wr9K1mr0KZLlVaVttq2K1aoN+vTVwmq3WEwPNFBhuNwcD 1604LdCq3u62K616r1exbdOVX7nsfrP2JPMAmCG/5rZWQm7+AwAA//8DAFBLAwQUAAYACAAA ACEA5jO4odcBAADaBAAAEQAAAHBwdC92aWV3UHJvcHMueG1slFRNb+IwEL1X2v9g+d7mA0TT iFBttdq99FAJ2rtlD8GrxLZsQwO/vhMHaMKHRG/2+M2b92ZGnj43dUU2YJ3UqqDJQ0wJKK6F VGVB3xd/7zNKnGdKsEorKOgWHH2e/bqbmnwj4fPNEiRQLmcFXXlv8ihyfAU1cw/agMK3pbY1 83i1ZSQs+0TiuorSOJ5ENZOK7vPtLfl6uZQc/mi+rkH5jsRCxTyKdytp3IHN3MJmLDikCdkD STM0p1pg9dFZXGm7e2F2jlhsQc0aWcsdiABEEq8tiFdYeuJ2BU3HSZZQwtZe/xb/184XNKZR H7rQJiCfsOTjBWQ0LN+mukoK+L7yeSX22pxiZqH/WSna7PDYS+OsgtmU5a4h7XhHOE3EJXGo g+HthXB0zDO5trKUijQFHT2llGwLOh4fQL065RrlvTp/PBNMxN7iGLB1lBjtkH6S7hvRQUIw zbID3zdJS3502Aka+lfag1tA43stuep6FMylfce90GW3cfB65jRM5qy009aDvUVK2+FLAxiG fyrptH6Q+LNlIRtc77YmigjxE+HtRp/rHkav7E0yyYLyJM6uL87+YTj0Ex8lyp4bxvEHIRyZ H3GfsCl8ezh2JN23NPsCAAD//wMAUEsDBBQABgAIAAAAIQA/YaXUDwUAAHpEAAATAAAAcHB0 L3RhYmxlU3R5bGVzLnhtbOxaWZOjNhB+T1X+A8VztBZCXFPj2RJXkqrJPmwm+44NtqnlcAHZ ma3U/vcI8NjYBhsweH3wggVu9UWr+0Otx49vvsd8c6LYDYMxy32ALOME09B2g/mY/efFBDLL xIkV2JYXBs6Y/e7E7MenX395tB6Sifd38t1znuOEoVyC+MEas4skWT6MRvF04fhW/CFcOgH9 bxZGvpXQ22g+siPrlXL3vRGCUBz5lhuwjO3Mxux/goaQgDEBkmGIAPMYARViGciCqmuKqXMa T36wTwXZVDd6/dOmkyVDEXlFx8DgDQSwzmOgIBkDgSBOEVReh7r0IzWGTvhk+dSWZ3e+SJic D8rYvi5Cz3mZeJmI6ctb9l96MwuD5LMzY1z7bcz6bhBGGX08jeYTzYuYaMxSz82z6yS9jp4e R+tpOSn1iJPSfrO8MZu8cSuaLTnJtDBU7SgdeM4syX6DtQbcSnoFy4wyH63mRqmpbZmsJyfh si2P1dRJmCSh35bJZrYbxK7t/JEzSq9BaLqe9z4h+ynQ5MMvNci/rN7JyvczSrVLnz/LqFYv a7QdORO6XLhMbtnrvBQnbszcMWWjfjbKvHbJcXnYkEz9dISu25Bcfc+KEy3czk9pwgmDlOm+ ee8pZsOrwGHmRqdyK7JIOX8OX2tz21oMzOuYFaAMaf6c+kuaz+2Jl7sv9Fw7XXwHfVmg2qzo jHmlUwvqZlZUqN5L9p/Ma2X/zG1puqkbUiva8teUGZj+saqdFXW0XhEu1tG/HNv9138vpAxg yHTqBAmTK9u0pi7TiFo7yrOmX4+60/7aopimEcchaRNxcTA/GnFecjDiSrJBH2L2C3IfUkqq TR9iKop6H6KqEEF/sirgxCG+VrZ48rWTuHQZZU8pVobveWU9oUT6CeBknW3aaYhP0XAbc6Aq /crq4hGk8tOtOgJAKqw6Vu27TaCbWK5Xj+r6smx9lHqqJiq5MatroqefYvVeeeFlrvvy0jY5 Ngqs01Bevy7era5de3n/a6/PWK4JMRVdUpGoCQBzUALYNDRADF0DnMSJKhIg4QyzequmHaw8 81ZNxSZDCUCsoOwI49X5ROoA4x0Rc/UbN7VrQOqI9LHlLRdWB9DtAoBRLybd/m5GL0u1VYjX rIGVZp0rO7QyrkndQbpAVFp5ABRkWnc0HgJZURSgIFPmTB3yUNK2686nMC86vzF09Hvk2nda eyoIS8pHBeVVVIDjEcSrWFVkFQIREg1gpCFATCIAVZA1XZJMilyEA8jl1L2xOwUxh8Box0Cm hqj7ATPFLZEbAjS9mTWAmtZL9zqBTYNs0Tu4ERQMRUkgtBZJCsAiNICCdQ4IGCGkibwp6Dt9 mw24ebEmlNe14Js+MGhXnZsjYu7hq74PUZ12bmrJOgeahBJPoE4IEInJA8wTFciCLAPN0Dgd ipqEVOVQq3Xorw791aG/2nBnOw3my+2t7mt37X3VPiy6x57qJgnfSz+1kcVDL7VNIhz6qD33 UZvHcN29bM7AxCAYyLpJACayAmTJUAFWNB6JIiKmAesd0xtg5AAjBxjZ7oBEvnYu+Zjeroa3 cUyve6vu95geustjeg2sHqBl2+Q4wMuzHNNrGss1IaYpEJXTRAWIhk6BpWlioMi8CThZ1RGn GCaPUD2IyQ8Qc4CYA8RstbjztXPJEHNXw9uAmN1bdb8Qk79LiNnA6gFitk2OA8Q8C8RsGsv7 ELNw8xwnT/8DAAD//wMAUEsDBBQABgAIAAAAIQBC9MMzYwIAABIGAAARAAAAcHB0L3ByZXNQ cm9wcy54bWyslNtq2zAYx+8He4fge9U6+UiTItkyDNYxRvcAmq0kZj4hKW3H2LtPdpysaV0o o9aFZL7T7/vrcH3z2Dare6VN3XdrD11Bb6W6sq/qbrf2vt8VIPZWxsqukk3fqbX3SxnvZvPx w/WQDloZ1VlpXehXvXKJOpPKtbe3dkh935R71Upz1Q+qc7Ztr1tp3a/e+ZWWD65A2/gYwtBv Zd15c7x+S3y/3dalyvvy0DqAYxKtmonE7OvBnLINb8n2tI8LpI1r0uz7B9fcOH2RWk9OTqfJ Ngf6k19TsaaZlq5C1ujNtXQOxrrl6l42a0+rynN2/5/DkKpH+9nYebU66Hrt/RYZCiOe5yBG MQaU8QgwkWVAcAqJIIxzEv0Z6yOaNtIoPVaY20X0RcNtXere9Ft7VfbtrJw/9A9KD309iYfg qV2ZGr37cSYuCui+I/STYlMPjvcSGxc5xyGMAIpiCqgQHPAoiUEkeBCTUIg8ZifsUc1bVdUy s7ox7wJ/JEazwhPdcZ709U8bOTKXjb7VhxfdomQcY4JnBoIJIlPm5xFhIvJgwSDiuIDZggFy Jop8yUBxFixGBDgM+FINkcV0KYIQmi+miuE4ZoVOIrxyBqMwEwllIIQkAxRRDHjidjTMEYmg E53h8xmsalNKXX1q5U6Jqra5tPIdt/QE/OLA5QQxGGIG3CljgBKcADZeG85ZHIQhhgGCZ0a1 lYfGToz5UL8jHsavAhZ5IArGcgBFJgANiABJTBCgIceECzcRegQM0nIvtb3Tsvzp3sVvasvd XavOmMH/YOJXVby8GJfP+OYvAAAA//8DAFBLAwQUAAYACAAAACEAJYacEcgFAACRHgAAEwAo AGN1c3RvbVhtbC9pdGVtMS54bWwgoiQAKKAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAvFldc+I2FH3vTP+Dx30ONhgIYZbsZCE7k5lNu9Oknb7tyLIMamzJkeRA/n2v5A+M wQFstslDsKVzdHU/jq7Ip8+bOLLeiJCUs5nd77m2RRjmAWXLmZ2q8Gpif779hNUUc6YIU8/v CXnCKxIjC17+mNm2FaPyb2XS7ygmM3vBcRrDm/row2Jmuxu3D7/u/H44ngxH4+F4/rXvwWfv evj1bjSaj+YTzxt7dezfpbX1kQWRWNBEmdG5IEgRC1mMrK0gt6NXhzxhnpDc+twNxjY88Aaj MfZD/8btjzxMMNhKyNC7vgndycS2wG9MTrGa2SulkqnjSOMV2YspFlzyUPUwjx0ehhQTZ+C6 YycmCgVIIaeyfkEUozZEiQDrhaJEmnd3Sgnqp4pI+/bXXz5tZDDNyCyFxJIoHROZIEy6rWWc JTiHvSuREvMYUhIFUrsODYfXA3ccIN8Fz4UT/yac3AyGI2/Uv/HIBNsWk/0sY7Ktg5mlPev1 urf2elws9ep955/Hb1m2bSefPjfpus2MBsw9QiRXSJCEU6acN690PY0TLpTFTnT6LolTsJCI 6MQ1NDO7Yl0xAbBJRDY6mcqgk9cUqrh83uUoauERMbQ0Ax9xoSiq0wgSzmwdxO+pH1G5Aq14 ggRTC6g3SAbK/sA4FRAod38bB7D3m4QKpIu2icCpGGI+1+w07/IVyueqE04HmdB0Kp7dOFr5 Cl+5iBckRGkEVfOaoohCxQQ/vQSCeDv5eBHsZ4ajwFtlJST4NDLKQp4gtdKs1853SA1GxBxE T/Bom7hn1sdJhpb51o78Y8MbavJwFaApZQHZzGw4KxiNIuRHpKKXAZVJhN6zU1LHLEgjYLAM hVVyBNUTzbxZ0SAgrMIEiUYEQ1FGdciYMp2pLoBqcQsi4cTAmt7ykdTiEMvpX+yF8TWr1N4u sl45H7lkr7hLv9yc5Zd7FlzEKzV7frZr2osK6DyDqgtBN5CSpsRh3guk+14zIchV9dQ6ojio aBJ2JqSsMsWPOH4ph34D5c0V4IJWthI+enzyFWVSIdD9UgK3opWkIjKQADu5l6TT7/Wd7VzI mopkVgFmpJzJQYKOaEqRgg73g+Oi94FtGf03jk3elohAJzXTjjW43AgH7JPOK7CAXzzHHTru ADh7sPgJ6nhow5dY3nDt2rCrGJrneyU9tJxDD//8ozZQwiuneU6xP/lYDxPgKda3BC5qXQco yKZ46jc0MfmmMgZdNS0YphRUS+mqO9OCwmmVe8QH8NybRn2g+NmyqsNm8q7u6hNPr2KIG21X VEVH1t2uMtxf5dngG+ll6v9LsL45tvBr5YRo49gX8r7mItA3nXO82mhOhNgyBVFsFWTIriUX 711tydjyO+5lyAR5oy3YyrJkjCsjKsWboq8rXloNP88rKq03FKXEgvyi2kXSUitQgjT2ibB4 aEn0Bu+4sAojZQ9gxEJJEmmAPteBBI75BMYodCEWnGJWmsBxpRsOtV0ChVDpFkF4VZL1DtuW nff1XeT3l53dHu+hIiTVIw/Mkfylc/R3JCvOaTtoDnSXKm1VHydd5qotU6fvMD7u6C/QK13y ZnTOBS/3Ta3vhuqGcszH9m7ztS8GdpMjwdPFVp5rkb3VYdnN1z30HcY8ZeqhnlZnYA+cZHto /Vi72x9IoYb1Mjft7LPI0lKdjsIrG20NznZ6PvzLYn4nJcdU9xz30Duo99bhBq6cobmMU+aD uQFk+tFAwGNZL+Ua2QJl0eYs5bwTcCdDnt6lIvFD3v6fBS1cCuLchDspzbbMWbTqu28IeLOB dZq2DAd805Kp7qoTafayuGPuZvBugpVxFE75k4RE6BXbMwW65W2LHXTA6v+RtMXqzrwtdvQ/ iPWBSJ8vm42hbk2lY90ePOgC9rqAh13AozbgZ91zti50jX6ArukyZ1SL/CsN6LKDlgpl1j7a T11ok21rqzDyKNLYWTb2zqF/Kt/+BwAA//8DAFBLAwQUAAYACAAAACEAPPtMvpcAAAC6AAAA EwAoAGN1c3RvbVhtbC9pdGVtNC54bWwgoiQAKKAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAATIyxDoIwFAB/pXl7sUUJDgKDk4MJCcS9r7xGEugzbTHw90YXWS93d2nmyNKy T+RTv72oqS/d0wQarn8m1nnysYL7aANHdin7KS2PPmW9WdnzvGW7oNu8BdHxEizdhgqKo8HB IUmlMZenQjmJhbFSlaVGRMKzy0HsBt9IrUorDaIN9B55iQ8zLVSBM1MkONQfAAAA//8DAFBL AwQUAAYACAAAACEATJ1NcPYAAADrAQAAEwAoAGN1c3RvbVhtbC9pdGVtMi54bWwgoiQAKKAg AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArJG9boNAEIRfBV1vDttSEiHARZIu liy5SXs5FlgJdk+3i+HxA/l1ESkp0m0z38zOFId56JMLREGm0mzTzCRAnmuktjSjNps7c6iK kIfIAaIiSLIoSPJQmk415NaK72Bwkg7oIws3mnoeLDcNerC7LLuxA6irnTr7TTEfmFnwCzRN UzrtU47tKtva5+PT+Y29QRJ15OFTFfzf3JEaDk67lXdrTy4qQbxn0si9mKqo2Y8DkB4duRbW qypO40uP0i0FPM4Bo9OlmQen8G79i690LkJgJLWX/ZJWMCfsS6NxBGOv4Wdd0vwb1/70ib2e rXoFAAD//wMAUEsDBBQABgAIAAAAIQB0Pzl6wgAAACgBAAAeAAgBY3VzdG9tWG1sL19yZWxz L2l0ZW0xLnhtbC5yZWxzIKIEASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAjM+xisMwDAbg/eDewWhvnNxQyhGnSyl0O0oOuhpHSUxjy1hqad++5qYrdOgo if/7Ubu9hUVdMbOnaKCpalAYHQ0+TgZ++/1qA4rFxsEuFNHAHRm23edHe8TFSgnx7BOrokQ2 MIukb63ZzRgsV5QwlstIOVgpY550su5sJ9Rfdb3W+b8B3ZOpDoOBfBgaUP094Ts2jaN3uCN3 CRjlRYV2FxYKp7D8ZCqNqrd5QjHgBcPfqqmKCbpr9dN/3QMAAP//AwBQSwMEFAAGAAgAAAAh ACA5h1oNAQAAkgEAABMACAFkb2NQcm9wcy9jdXN0b20ueG1sIKIEASigAAEAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnNA7b4MwEADgvVL/g+Wd2GBMAAFRYkDq 1iHtjoxJkPBD2KFBVf97HfWRPdudzv7uUeyucgKLmO2oVQnDDYZAKK77UZ1K+HZsgxQC6zrV d5NWooSrsHBXPT8Vr7M2YnajsMATypbw7JzJEbL8LGRnN76sfGXQs+ycT+cT0sMwclFrfpFC ORRhnCB+sU7LwPxz8MfLF/co2Wt+m86+H1fjvar4xVcwSDf2JfysKatrimkQNRkLQhwegoxk 2wCnGEeHiLXZvvmCwNweRxCoTvrVmVbO97ihL71XF5dP5sO6ucJX7A2MWRMnaUyTOGFtSHxM tnG7p5RRlhKSkALd/xTobyof3o9ZfQMAAP//AwBQSwMEFAAGAAgAAAAhAOdb5zIgBAAAhwkA ABAACAFkb2NQcm9wcy9hcHAueG1sIKIEASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAtFbdb+M2DH8fsP+B8NOGIXHc9NIPuO6ytFmNtbmgcXuPB8VmYqG2 5Ely0txfP0pu3GTnDeiA5SUUSfHjR1J0eP1aFrBBpbkUV17QH3iAIpUZF+sr7ymZ9s490IaJ jBVS4JW3Q+1dRz/+EM6VrFAZjhrIhNBXXm5Mden7Os2xZLpPYkGSlVQlM3RUa1+uVjzFG5nW JQrjnwwGIx9fDYoMs17VGvQai5cb81+NZjK18ennZFeRvShMsKwKZjD6/Xb223h205sHo14w er3o7SWh3+qEiTSsSHiJUXA6PCNJew6/SJXpKBiMzkO/ocNxVRU8ZYYQjB54qqSWKwMPLOXC SJ3DXG5RzSWdQv9QlyBETSG709RlFH0WPZ0qRAGLXG7hp2B0efFz6HdohnOm2FqxKqdwPg1J 5/0cLgqeIfGJ/UaGM2no7zT0GyK841mG4k06CP2jc/jwMCl45QR7MlykrMAJwRqtWKEJsHdG eIfMtsyccUWaG3O5wdRIBZp/o6YZebBkGm0xrrwNU5wJ4zVqzcHRRaWNiqZSGA1PGrPQb5mO PNQ9pPlpNHQKRPyrYmMroU7CD9gOPmDbwQcJNwXqj7j4h/jdwQFJ9DHEjY/PK6q66UA8ODuE 3EXRAN4ENCYHxWGALTVhBV8q3i2TteKoOmX7uXIzFQy+BmdfTwbBaafuVLESt1K9AM0xkMcC nslt5tobbrimMdzBWBgOi0rKFWUNvtNDdajpAzzKpUytgQdu+Lph298jT3OmMjtF6Qvu2v+J FLoujLV4fz+BSU5oloymLZ4DDVZdgmpu/qqbG/1awy8BnA2G8OliCCej86FzYH+dyd3R2GY8 gy3CGg3kqLDfrbmgeSbrcgWLJH70F3fjP25nLk0bni3s7jDb+JZe43ESL/w22E6ziXUJXIOQ IA0dYEtokhfNdtawyflRb7ZUrHVNr7mRsESgB0cWG8yACxdevzsFkjQFnBZyq7vryQzbF7XT yJecGcislkDM9gGkTFGzOf+UBBRME5iygnj2HCe3QBsJtjbTTpPdgP9vXIIcxvql3wd4TyaT tgcUEhw7KoEwLo/UNmBJRaEsNeI1QKytgErGoFK4IkqkLZ/KyN6goNGuMOW07Ki4VCmqryHz f9Zc2bI2S1pl/JuDnQzAmIw2ptc1vUvUVra8uQ1qXdOmk0q/BeZiAU77D+0SxcxebwJ7V97B qh1cXduty0n32BETO5jHMdg+mM/iJlJXUnfN5ErW69zesZiVkq4sFaMaV3ZJWsBSmkZGW3Jn LzkAbBBLNAZV/7uxO3oh//YmTmRZUTwkaKl7Ll70U5XIG7vn39bYMTNc0PhjRt8T7ZprGeEd PaeqsPr0cog1Znud7wX2s+C5+a6i/dwfDE5O3frf8+xS33/wRH8BAAD//wMAUEsDBBQABgAI AAAAIQCgQxqKfAEAAO0CAAARAAgBZG9jUHJvcHMvY29yZS54bWwgogQBKKAAAQAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEktFqwjAUhu8He4eS+5qmuk5CrbAN ryaU6djwLiRHDbZJSTKrb7+02upQ2GU43/n48yfp9FAWwR6MlVpNEBlEKADFtZBqM0Gfy1k4 RoF1TAlWaAUTdASLptnjQ8oryrWB3OgKjJNgA29SlvJqgrbOVRRjy7dQMjvwhPLDtTYlc/5o NrhifMc2gOMoSnAJjgnmGG6EYdUb0VkpeK+sfkzRCgTHUEAJyllMBgRfWAemtHcX2skVWUp3 rOAu2g17+mBlD9Z1PaiHLerzE/w9f1+0Vw2larrigLJUcOqkKyDLdQ0m11K5IDdgfWLmfNkp 7omG5QaY0yb7kHzLjAgWW813cGypbtZ0XjDr5v551hLEy/EWv0WaLQN72bxwNk5apD93ytz4 fCCyOCJJGD2FJF7GhEYjOkpWvbSD0nPJp2AgAl8OPVXZTb6Gr2/LGTr7RiEZL0lCh175vGru 9Gf/IizPsf81jsM4ao0xjYZXxk6QtaH/ftDsFwAA//8DAFBLAwQUAAYACAAAACEAXJYnIsIA AAAoAQAAHgAIAWN1c3RvbVhtbC9fcmVscy9pdGVtMi54bWwucmVscyCiBAEooAABAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIzPwYrCMBAG4PuC7xDmblM9iCxN vSyCN5EueA3ptA3bZEJmFH17g6cVPHicGf7vZ5rdLczqipk9RQOrqgaF0VHv42jgt9svt6BY bOztTBEN3JFh1y6+mhPOVkqIJ59YFSWygUkkfWvNbsJguaKEsVwGysFKGfOok3V/dkS9ruuN zv8NaF9MdegN5EO/AtXdE35i0zB4hz/kLgGjvKnQ7sJC4RzmY6bSqDqbRxQDXjA8V+uqmKDb Rr/81z4AAAD//wMAUEsDBBQABgAIAAAAIQB78wKjwwAAACgBAAAeAAgBY3VzdG9tWG1sL19y ZWxzL2l0ZW0zLnhtbC5yZWxzIKIEASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAjM/BisIwEAbg+4LvEOZuUxUWWZp6WQRvIl3wGtJpG7bJhMwo+vaGPa3g wePM8H8/0+xuYVZXzOwpGlhVNSiMjnofRwM/3X65BcViY29nimjgjgy7dvHRnHC2UkI8+cSq KJENTCLpS2t2EwbLFSWM5TJQDlbKmEedrPu1I+p1XX/q/N+A9slUh95APvQrUN094Ts2DYN3 +E3uEjDKiwrtLiwUzmE+ZiqNqrN5RDHgBcPfalMVE3Tb6Kf/2gcAAAD//wMAUEsDBBQABgAI AAAAIQAMxBqSwwAAACgBAAAeAAgBY3VzdG9tWG1sL19yZWxzL2l0ZW00LnhtbC5yZWxzIKIE ASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjM/BisIwEAbg +4LvEOZuU0UWWZp6WQRvIl3wGtJpG7bJhMwo+vaGPa3gwePM8H8/0+xuYVZXzOwpGlhVNSiM jnofRwM/3X65BcViY29nimjgjgy7dvHRnHC2UkI8+cSqKJENTCLpS2t2EwbLFSWM5TJQDlbK mEedrPu1I+p1XX/q/N+A9slUh95APvQrUN094Ts2DYN3+E3uEjDKiwrtLiwUzmE+ZiqNqrN5 RDHgBcPfalMVE3Tb6Kf/2gcAAAD//wMAUEsDBBQABgAIAAAAIQAa7QvobAEAAIMDAAAYACgA Y3VzdG9tWG1sL2l0ZW1Qcm9wczIueG1sIKIkACigIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAKRT22rCMBi+H+wdSu7btCr1gFXUrCBsMMYG3ob0rw1rkpJEuzH27kurGypj bvMq/An5jsl4+iJKbwvacCUTFAUh8kAylXG5TtDTY+oPkGcslRktlYQESYWmk+urcWZGGbXU WKVhaUF4boO7dUkS9HaTkjCNO8QP+7PU76Ux8efDGfEXvcEiisgs7szJO/IctXQwJkGFtdUI Y8MKENQEqgLpDnOlBbVu1Gus8pwzIIptBEiLO2EYY7Zx9GIlSjRp9OxuP0BujsdG2kbzL5Zq o8sWM2MYSmjwDI6CCCP888VPeYIzrYzKbcCU2CvbKRJgaRMLrrTzoC0H8z9QU1ANleLO6rZ7 DuLQkAUtzK+dfBN0RdkzXZ/6Ya5m/1JTh0ll+ybvqHRsbaf2tboQmctcVdQWDUUf31NtJeiF klar8ixyXddB3W0zWN3d4mg4HGBJBRiXCPylgowJ3nhpW8AnD7OZjz7O5AMAAP//AwBQSwME FAAGAAgAAAAhAL2EYiOQAAAA2wAAABMAKABjdXN0b21YbWwvaXRlbTMueG1sIKIkACigIAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzOPQ7CMAyG4aug7tQDGzLpUpgQUy8Q QqpGquMoNj+5PSmCAanzY72fsSPhreOoPupQku8MnjjT4CnNVr1sXjRHOTSTatoDiJs8WWkp uMzCo7aOCWSy2ScOUeGxg29Naw3G2pLGYB+k9orp2d2p4jlcs81lmUL4IR5vQddPPoIX/1zn BRD+HjdvAAAA//8DAFBLAwQUAAYACAAAACEALvZR0vMAAABPAQAAGAAoAGN1c3RvbVhtbC9p dGVtUHJvcHMzLnhtbCCiJAAooCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABk kEFrhDAQhe+F/gfJXRN1rXZRl7W2sNfShV5DHNeAyUgyLi2l/72RnrY9DW8e877H1IcPM0dX cF6jbViaCBaBVThoe2nY+e0lrljkSdpBzmihYRbZob2/qwe/HyRJT+jgRGCisNBhnvqGfVXF Ls+rx6f4mPZZvCu7Ij5mRRGXfZd1qXgWaVZ+syigbYjxDZuIlj3nXk1gpE9wARvMEZ2RFKS7 cBxHraBHtRqwxDMhHrhaA968m5m1W5/f61cY/a3cqq1O/6MYrRx6HClRaLifpIMFdQi/5lyh pcChzwX4VsMz3tb8D2TTN09ofwAAAP//AwBQSwMEFAAGAAgAAAAhAEMyR/v3AAAAQAEAABgA KABjdXN0b21YbWwvaXRlbVByb3BzNC54bWwgoiQAKKAgAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAXI9Ba4NAEIXvhf4H2buuMXFjghpiRcihUBoLvS7rGhfcGdldS6T0v3el p/Q0fPOY997kp7segy9prEIoyCaKSSBBYKfgVpCPtgkzEljHoeMjgiwIIDmVz095Z48dd9w6 NPLipA78Qvl5qQvyzepNnW7PLEyTKgl3h2wXVmybhWnFzvt9kxwaxn5I4KPB29iCDM5NR0qt GKTmNsJJghd7NJo7j+ZGse+VkDWKWUtwNIljRsXs4/WnHkm59vm7fpe9fcS12mxUQV6VMGix d9F14Ea+oQIXtfyOgHqJXhCct26XSV4XEISWOf3nuvLD1+UvAAAA//8DAFBLAwQUAAYACAAA ACEAmd2TBoABAABGBAAAGAAoAGN1c3RvbVhtbC9pdGVtUHJvcHMxLnhtbCCiJAAooCAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0U8tOwzAQvCPxD5HviVNahYJIUUOphAQS 4iFxNc6mtYi90XpDQYh/x0l74SHx9sXatXdmdsc+OHywdXQP5A26XAySVETgNJbGLXJxfTWP xyLyrFypanSQC4ficLK9dVD6/VKx8owEJww2CgkT9pNZLp6me8OjsMZxNptP41E6msdFMR3G u1lWjI7HRZoW2bOIArULMD4XS+ZmX0qvl2CVT7ABFw4rJKs4hLSQWFVGwwx1a8Gx3EnTTOo2 0NsbW4tJp2ddfQGVfx120loy71is0YQeK0402g3BGtgCq647qdFxoLt6bEDIP0NtKDRIbMD3 uSkzmduWwX/GsVqtktWwn0dAHMibs9PL/u6/iPsZqF8qggZNMOl++Htd5cbxM+XUAnrvObjx Q3EbZOMqbBQvO4pdea6IHdBR8Jqw/jLyB4+0UfouqHz3iAjir4+1aanu0Uotoe5b9nKQDOR3 ChnI+k8rPh5SsA7IqVribdkhyDd/q4tf/f3JCwAAAP//AwBQSwECLQAUAAYACAAAACEAG8MO +2oCAAD5FgAAEwAAAAAAAAAAAAAAAAAAAAAAW0NvbnRlbnRfVHlwZXNdLnhtbFBLAQItABQA BgAIAAAAIQD2YJWSEQEAAHUDAAALAAAAAAAAAAAAAAAAAKMEAABfcmVscy8ucmVsc1BLAQIt ABQABgAIAAAAIQAPijb9lwQAAKgMAAAWAAAAAAAAAAAAAAAAAOUHAABwcHQvc2xpZGVzL3Ns aWRlMTEueG1sUEsBAi0AFAAGAAgAAAAhAKA6qIP2AAAA8gEAACAAAAAAAAAAAAAAAAAAsAwA AHBwdC9zbGlkZXMvX3JlbHMvc2xpZGUzLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAEv1Pey9 AAAANwEAACAAAAAAAAAAAAAAAAAA5A0AAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU0LnhtbC5y ZWxzUEsBAi0AFAAGAAgAAAAhAODDzaYXAQAAHgIAACAAAAAAAAAAAAAAAAAA3w4AAHBwdC9z bGlkZXMvX3JlbHMvc2xpZGUyLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAF727IajAQAAiw0A AB8AAAAAAAAAAAAAAAAANBAAAHBwdC9fcmVscy9wcmVzZW50YXRpb24ueG1sLnJlbHNQSwEC LQAUAAYACAAAACEACjDRHtgAAAC/AQAAIAAAAAAAAAAAAAAAAAAcEwAAcHB0L3NsaWRlcy9f cmVscy9zbGlkZTUueG1sLnJlbHNQSwECLQAUAAYACAAAACEAzMPG6ysEAABsEQAAFgAAAAAA AAAAAAAAAAAyFAAAcHB0L3NsaWRlcy9zbGlkZTEzLnhtbFBLAQItABQABgAIAAAAIQAdYe62 2AAAAL4BAAAgAAAAAAAAAAAAAAAAAJEYAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMS54bWwu cmVsc1BLAQItABQABgAIAAAAIQA2qdKT1wAAAL4BAAAgAAAAAAAAAAAAAAAAAKcZAABwcHQv c2xpZGVzL19yZWxzL3NsaWRlNi54bWwucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcB AAAgAAAAAAAAAAAAAAAAALwaAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlNy54bWwucmVsc1BL AQItABQABgAIAAAAIQAUazuFvQAAADcBAAAhAAAAAAAAAAAAAAAAALcbAABwcHQvc2xpZGVz L19yZWxzL3NsaWRlMTMueG1sLnJlbHNQSwECLQAUAAYACAAAACEAXG/+qeEAAABJAgAAIQAA AAAAAAAAAAAAAACzHAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTEyLnhtbC5yZWxzUEsBAi0A FAAGAAgAAAAhAPEPVJTsAAAAVgIAACEAAAAAAAAAAAAAAAAA0x0AAHBwdC9zbGlkZXMvX3Jl bHMvc2xpZGUxMS54bWwucmVsc1BLAQItABQABgAIAAAAIQC1w07Q7AAAAFYCAAAhAAAAAAAA AAAAAAAAAP4eAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMTAueG1sLnJlbHNQSwECLQAUAAYA CAAAACEAeJFXswQBAADuAwAAIAAAAAAAAAAAAAAAAAApIAAAcHB0L3NsaWRlcy9fcmVscy9z bGlkZTkueG1sLnJlbHNQSwECLQAUAAYACAAAACEAHL9IWesAAABVAgAAIAAAAAAAAAAAAAAA AABrIQAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTgueG1sLnJlbHNQSwECLQAUAAYACAAAACEA mSFsXpwEAAC+DgAAFgAAAAAAAAAAAAAAAACU IgAAcHB0L3NsaWRlcy9zbGlkZTEyLnhtbFBL AQItABQABgAIAAAAIQB30F+ibQMAALYQAAAUAAAAAAAAAAAAAAAAAGQnAABwcHQvcHJlc2Vu dGF0aW9uLnhtbFBLAQItABQABgAIAAAAIQBn0WNUWwQAAHoMAAAWAAAAAAAAAAAAAAAAAAMr AABwcHQvc2xpZGVzL3NsaWRlMTAueG1sUEsBAi0AFAAGAAgAAAAhAHWomXCUBQAAiBcAABUA AAAAAAAAAAAAAAAAki8AAHBwdC9zbGlkZXMvc2xpZGUxLnhtbFBLAQItABQABgAIAAAAIQAa uh+HXAUAAGkRAAAVAAAAAAAAAAAAAAAAAFk1AABwcHQvc2xpZGVzL3NsaWRlMi54bWxQSwEC LQAUAAYACAAAACEA2qxjizMFAAAxEQAAFQAAAAAAAAAAAAAAAADoOgAAcHB0L3NsaWRlcy9z bGlkZTMueG1sUEsBAi0AFAAGAAgAAAAhAH/svG+OAwAAjgsAABUAAAAAAAAAAAAAAAAATkAA AHBwdC9zbGlkZXMvc2xpZGU0LnhtbFBLAQItABQABgAIAAAAIQD73XY5/wUAAAETAAAVAAAA AAAAAAAAAAAAAA9EAABwcHQvc2xpZGVzL3NsaWRlNS54bWxQSwECLQAUAAYACAAAACEAD3os icMEAAA0DgAAFQAAAAAAAAAAAAAAAABBSgAAcHB0L3NsaWRlcy9zbGlkZTYueG1sUEsBAi0A FAAGAAgAAAAhAE91yNjOBQAA8hQAABUAAAAAAAAAAAAAAAAAN08AAHBwdC9zbGlkZXMvc2xp ZGU5LnhtbFBLAQItABQABgAIAAAAIQCvZndMnwUAACAQAAAVAAAAAAAAAAAAAAAAADhVAABw cHQvc2xpZGVzL3NsaWRlOC54bWxQSwECLQAUAAYACAAAACEATH/597QFAABjIAAAFQAAAAAA AAAAAAAAAAAKWwAAcHB0L3NsaWRlcy9zbGlkZTcueG1sUEsBAi0AFAAGAAgAAAAhAGob0Veh AgAAXwYAAB8AAAAAAAAAAAAAAAAA8WAAAHBwdC9ub3Rlc1NsaWRlcy9ub3Rlc1NsaWRlMy54 bWxQSwECLQAUAAYACAAAACEALR9zMp8CAABcBgAAHwAAAAAAAAAAAAAAAADPYwAAcHB0L25v dGVzU2xpZGVzL25vdGVzU2xpZGUxLnhtbFBLAQItABQABgAIAAAAIQCzWVETdgYAAPAqAAAh AAAAAAAAAAAAAAAAAKtmAABwcHQvc2xpZGVNYXN0ZXJzL3NsaWRlTWFzdGVyMS54bWxQSwEC LQAUAAYACAAAACEAJLMgcKECAABeBgAAHwAAAAAAAAAAAAAAAABgbQAAcHB0L25vdGVzU2xp ZGVzL25vdGVzU2xpZGUyLnhtbFBLAQItABQABgAIAAAAIQA7U86k3QAAAEUCAAAsAAAAAAAA AAAAAAAAAD5wAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0MS54bWwucmVs c1BLAQItABQABgAIAAAAIQBHuKJr9QAAAMAEAAAsAAAAAAAAAAAAAAAAAGVxAABwcHQvc2xp ZGVNYXN0ZXJzL19yZWxzL3NsaWRlTWFzdGVyMS54bWwucmVsc1BLAQItABQABgAIAAAAIQBs TwLjoQIAAF8GAAAfAAAAAAAAAAAAAAAAAKRyAABwcHQvbm90ZXNTbGlkZXMvbm90ZXNTbGlk ZTQueG1sUEsBAi0AFAAGAAgAAAAhADtTzqTdAAAARQIAACwAAAAAAAAAAAAAAAAAgnUAAHBw dC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQyLnhtbC5yZWxzUEsBAi0AFAAGAAgA AAAhADtTzqTdAAAARQIAACwAAAAAAAAAAAAAAAAAqXYAAHBwdC9zbGlkZUxheW91dHMvX3Jl bHMvc2xpZGVMYXlvdXQzLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhADtTzqTdAAAARQIAACwA AAAAAAAAAAAAAAAA0HcAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ1Lnht bC5yZWxzUEsBAi0AFAAGAAgAAAAhADtTzqTdAAAARQIAACwAAAAAAAAAAAAAAAAA93gAAHBw dC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ2LnhtbC5yZWxzUEsBAi0AFAAGAAgA AAAhAOznoHjUAAAAvwEAACoAAAAAAAAAAAAAAAAAHnoAAHBwdC9ub3Rlc1NsaWRlcy9fcmVs cy9ub3Rlc1NsaWRlMS54bWwucmVsc1BLAQItABQABgAIAAAAIQDLgoX51AAAAL8BAAAqAAAA AAAAAAAAAAAAADp7AABwcHQvbm90ZXNTbGlkZXMvX3JlbHMvbm90ZXNTbGlkZTIueG1sLnJl bHNQSwECLQAUAAYACAAAACEACFFp3NQAAADAAQAAKgAAAAAAAAAAAAAAAABWfAAAcHB0L25v dGVzU2xpZGVzL19yZWxzL25vdGVzU2xpZGUzLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAC80 TF3TAAAAwAEAACoAAAAAAAAAAAAAAAAAcn0AAHBwdC9ub3Rlc1NsaWRlcy9fcmVscy9ub3Rl c1NsaWRlNC54bWwucmVsc1BLAQItABQABgAIAAAAIQC9SmOtKgYAAPQUAAAhAAAAAAAAAAAA AAAAAI1+AABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0MS54bWxQSwECLQAUAAYACAAA ACEAgcBZhb0GAAC2GAAAIQAAAAAAAAAAAAAAAAD2hAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlk ZUxheW91dDIueG1sUEsBAi0AFAAGAAgAAAAhAKIH96i8BgAAOR8AACEAAAAAAAAAAAAAAAAA 8osAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQzLnhtbFBLAQItABQABgAIAAAAIQCP lgUm5wAAAMwCAAAsAAAAAAAAAAAAAAAAAO2SAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3Ns aWRlTGF5b3V0NC54bWwucmVsc1BLAQItABQABgAIAAAAIQBNjpSwPwUAAPANAAAhAAAAAAAA AAAAAAAAAB6UAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0Ni54bWxQSwECLQAUAAYA CAAAACEAJnC3zcYHAADWJgAAIQAAAAAAAAAAAAAAAACcmQAAcHB0L3NsaWRlTGF5b3V0cy9z bGlkZUxheW91dDQueG1sUEsBAi0AFAAGAAgAAAAhABsKQASpBwAARykAACEAAAAAAAAAAAAA AAAAoaEAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ1LnhtbFBLAQItAAoAAAAAAAAA IQANuMn63h0DAN4dAwAWAAAAAAAAAAAAAAAAAImpAABwcHQvbWVkaWEvaW1hZ2UxNS50aWZm UEsBAi0AFAAGAAgAAAAhALTPWBm5AAAAJAEAACwAAAAAAAAAAAAAAAAAm8cDAHBwdC9ub3Rl c01hc3RlcnMvX3JlbHMvbm90ZXNNYXN0ZXIxLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAJOq fZi5AAAAJAEAADAAAAAAAAAAAAAAAAAAnsgDAHBwdC9oYW5kb3V0TWFzdGVycy9fcmVscy9o YW5kb3V0TWFzdGVyMS54bWwucmVsc1BLAQItAAoAAAAAAAAAIQDXx6PswCgAAMAoAAAXAAAA AAAAAAAAAAAAAKXJAwBkb2NQcm9wcy90aHVtYm5haWwuanBlZ1BLAQItABQABgAIAAAAIQDg 2BvwGQYAAJcaAAAUAAAAAAAAAAAAAAAAAJryAwBwcHQvdGhlbWUvdGhlbWUzLnhtbFBLAQIt AAoAAAAAAAAAIQDPRlVmAiIBAAIiAQAVAAAAAAAAAAAAAAAAAOX4AwBwcHQvbWVkaWEvaW1h Z2U5LnRpZmZQSwECLQAKAAAAAAAAACEA2EapjlnpAQBZ6QEAFAAAAAAAAAAAAAAAAAAaGwUA cHB0L21lZGlhL2ltYWdlOC5wbmdQSwECLQAKAAAAAAAAACEAuWNEGt/aAQDf2gEAFAAAAAAA AAAAAAAAAAClBAcAcHB0L21lZGlhL2ltYWdlNy5wbmdQSwECLQAUAAYACAAAACEAbScaYJqG DwCgopwBFAAAAAAAAAAAAAAAAAC23wgAcHB0L21lZGlhL2ltYWdlNi5lbWZQSwECLQAKAAAA AAAAACEA1zatMUZrBgBGawYAFQAAAAAAAAAAAAAAAACCZhgAcHB0L21lZGlhL2ltYWdlNS50 aWZmUEsBAi0ACgAAAAAAAAAhACMWNHH/AQAA/wEAABQAAAAAAAAAAAAAAAAA+9EeAHBwdC9t ZWRpYS9pbWFnZTIucG5nUEsBAi0ACgAAAAAAAAAhABMUYT/GGgMAxhoDABYAAAAAAAAAAAAA AAAALNQeAHBwdC9tZWRpYS9pbWFnZTE0LnRpZmZQSwECLQAKAAAAAAAAACEAAXS0uCMJAAAj CQAAFAAAAAAAAAAAAAAAAAAm7yEAcHB0L21lZGlhL2ltYWdlMy5wbmdQSwECLQAUAAYACAAA ACEAuX/uc+0FAACwGwAAFAAAAAAAAAAAAAAAAAB7+CEAcHB0L3RoZW1lL3RoZW1lMi54bWxQ SwECLQAKAAAAAAAAACEAD//KweuWAADrlgAAFAAAAAAAAAAAAAAAAACa/iEAcHB0L21lZGlh L2ltYWdlNC5wbmdQSwECLQAKAAAAAAAAACEAAQlCD44ZAwCOGQMAFgAAAAAAAAAAAAAAAAC3 lSIAcHB0L21lZGlhL2ltYWdlMTAudGlmZlBLAQItAAoAAAAAAAAAIQBgy1gg5AsAAOQLAAAU AAAAAAAAAAAAAAAAAHmvJQBwcHQvbWVkaWEvaW1hZ2UxLnBuZ1BLAQItABQABgAIAAAAIQDl Uf8twAUAAModAAAhAAAAAAAAAAAAAAAAAI+7JQBwcHQvbm90ZXNNYXN0ZXJzL25vdGVzTWFz dGVyMS54bWxQSwECLQAUAAYACAAAACEA9LoNJuIDAAB3DQAAJQAAAAAAAAAAAAAAAACOwSUA cHB0L2hhbmRvdXRNYXN0ZXJzL2hhbmRvdXRNYXN0ZXIxLnhtbFBLAQItAAoAAAAAAAAAIQAx kUQwnyQAAJ8kAAAVAAAAAAAAAAAAAAAAALPFJQBwcHQvbWVkaWEvaW1hZ2UxMS5wbmdQSwEC LQAKAAAAAAAAACEAKrXKHCXHAQAlxwEAFQAAAAAAAAAAAAAAAACF6iUAcHB0L21lZGlhL2lt YWdlMTMucG5nUEsBAi0ACgAAAAAAAAAhAI/dQZdOjAEATowBABUAAAAAAAAAAAAAAAAA3bEn AHBwdC9tZWRpYS9pbWFnZTEyLnBuZ1BLAQItABQABgAIAAAAIQCd7TZTaQYAAJ4cAAAUAAAA AAAAAAAAAAAAAF4+KQBwcHQvdGhlbWUvdGhlbWUxLnhtbFBLAQItABQABgAIAAAAIQDmM7ih 1wEAANoEAAARAAAAAAAAAAAAAAAAAPlEKQBwcHQvdmlld1Byb3BzLnhtbFBLAQItABQABgAI AAAAIQA/YaXUDwUAAHpEAAATAAAAAAAAAAAAAAAAAP9GKQBwcHQvdGFibGVTdHlsZXMueG1s UEsBAi0AFAAGAAgAAAAhAEL0wzNjAgAAEgYAABEAAAAAAAAAAAAAAAAAP0wpAHBwdC9wcmVz UHJvcHMueG1sUEsBAi0AFAAGAAgAAAAhACWGnBHIBQAAkR4AABMAAAAAAAAAAAAAAAAA0U4p AGN1c3RvbVhtbC9pdGVtMS54bWxQSwECLQAUAAYACAAAACEAPPtMvpcAAAC6AAAAEwAAAAAA AAAAAAAAAADyVCkAY3VzdG9tWG1sL2l0ZW00LnhtbFBLAQItABQABgAIAAAAIQBMnU1w9gAA AOsBAAATAAAAAAAAAAAAAAAAAOJVKQBjdXN0b21YbWwvaXRlbTIueG1sUEsBAi0AFAAGAAgA AAAhAHQ/OXrCAAAAKAEAAB4AAAAAAAAAAAAAAAAAMVcpAGN1c3RvbVhtbC9fcmVscy9pdGVt MS54bWwucmVsc1BLAQItABQABgAIAAAAIQAgOYdaDQEAAJIBAAATAAAAAAAAAAAAAAAAADdZ KQBkb2NQcm9wcy9jdXN0b20ueG1sUEsBAi0AFAAGAAgAAAAhAOdb5zIgBAAAhwkAABAAAAAA AAAAAAAAAAAAfVspAGRvY1Byb3BzL2FwcC54bWxQSwECLQAUAAYACAAAACEAoEMainwBAADt AgAAEQAAAAAAAAAAAAAAAADTYCkAZG9jUHJvcHMvY29yZS54bWxQSwECLQAUAAYACAAAACEA XJYnIsIAAAAoAQAAHgAAAAAAAAAAAAAAAACGYykAY3VzdG9tWG1sL19yZWxzL2l0ZW0yLnht bC5yZWxzUEsBAi0AFAAGAAgAAAAhAHvzAqPDAAAAKAEAAB4AAAAAAAAAAAAAAAAAjGUpAGN1 c3RvbVhtbC9fcmVscy9pdGVtMy54bWwucmVsc1BLAQItABQABgAIAAAAIQAMxBqSwwAAACgB AAAeAAAAAAAAAAAAAAAAAJNnKQBjdXN0b21YbWwvX3JlbHMvaXRlbTQueG1sLnJlbHNQSwEC LQAUAAYACAAAACEAGu0L6GwBAACDAwAAGAAAAAAAAAAAAAAAAACaaSkAY3VzdG9tWG1sL2l0 ZW1Qcm9wczIueG1sUEsBAi0AFAAGAAgAAAAhAL2EYiOQAAAA2wAAABMAAAAAAAAAAAAAAAAA ZGspAGN1c3RvbVhtbC9pdGVtMy54bWxQSwECLQAUAAYACAAAACEALvZR0vMAAABPAQAAGAAA AAAAAAAAAAAAAABNbCkAY3VzdG9tWG1sL2l0ZW1Qcm9wczMueG1sUEsBAi0AFAAGAAgAAAAh AEMyR/v3AAAAQAEAABgAAAAAAAAAAAAAAAAAnm0pAGN1c3RvbVhtbC9pdGVtUHJvcHM0Lnht bFBLAQItABQABgAIAAAAIQCZ3ZMGgAEAAEYEAAAYAAAAAAAAAAAAAAAAAPNuKQBjdXN0b21Y bWwvaXRlbVByb3BzMS54bWxQSwUGAAAAAF0AXQC4GgAA0XApAAAA --B_3554648623_772130753-- From nobody Mon Aug 22 03:04:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37DEC12D0B3 for ; Mon, 22 Aug 2016 03:04:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PWj311cIZKVv for ; Mon, 22 Aug 2016 03:04:14 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD79412B04E for ; Mon, 22 Aug 2016 03:04:13 -0700 (PDT) X-AuditID: c1b4fb30-ea88e980000009f9-17-57bace1b5cd3 Received: from ESESSHC004.ericsson.se (Unknown_Domain [153.88.183.30]) by (Symantec Mail Security) with SMTP id E6.40.02553.B1ECAB75; Mon, 22 Aug 2016 12:04:12 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC004.ericsson.se ([153.88.183.30]) with mapi id 14.03.0301.000; Mon, 22 Aug 2016 12:04:10 +0200 From: Christer Holmberg To: Richard Shockey , David Frankel , "stir@ietf.org" Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQAGjCGAAB7l1oA= Date: Mon, 22 Aug 2016 10:04:09 +0000 Message-ID: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <24B61E30-571F-426A-BC0E-CA1936F42504@shockey.us> In-Reply-To: <24B61E30-571F-426A-BC0E-CA1936F42504@shockey.us> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.5.160527 x-originating-ip: [153.88.183.18] Content-Type: multipart/alternative; boundary="_000_D3E0A966D418christerholmbergericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrBIsWRmVeSWpSXmKPExsUyM2K7nK7MuV3hBrc+Mlmc/j2BxWLGDwOL 5Wu3MTkweyxZ8pPJY+LHM8weDT1f2AKYo7hsUlJzMstSi/TtErgythzfw1jQ2Mdc8eddO1sD 491zTF2MnBwSAiYSp65/Zuti5OIQEljPKHHkyxd2CGcJo8SGhTMYuxg5ONgELCS6/2mDNIgI 5EvMvnIBrFlYwEpiytRFzBBxa4kdHYuZIGwrib+NrewgNouAqsTxY3/AbF6g+K9JvWwgtpBA tsTpGz+ZQMZzCthJPF/GChJmFBCT+H5qDdgYZgFxiVtP5kPdKSCxZM95ZghbVOLl439g9aIC ehLfv86GiitKfHy1jxGiN17i6ZVXbBBrBSVOznzCMoFRZBaSsbOQlM1CUgYRN5B4f24+M4St LbFs4WsoW19i45ezjLMY2YFsa4mFVsgqFjByrGIULU4tTspNNzLSSy3KTC4uzs/Ty0st2cQI jL+DW34b7GB8+dzxEKMAB6MSD6/Cm53hQqyJZcWVuYcYJTiYlUR4Q87uChfiTUmsrEotyo8v Ks1JLT7EKM3BoiTO6/9SMVxIID2xJDU7NbUgtQgmy8TBKdXAOGXZ/+3O/unfdqis2fvlkUvH Dd63a47+jo0Xj74d/6huPvdOrm1vbC+dvHc/9famrvPqy0VCgoS/pjGyiMg9/SedW7L9+GeH PTVNH5+u7V3548PTxhW/XmgJZnLItZ/ZfLj3vvinqZNWTrEUcGzLm3gnbI8dY/rFa/tuyc5I 4E/mC51t//BCt6ESS3FGoqEWc1FxIgBJHx2LuwIAAA== Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 10:04:19 -0000 --_000_D3E0A966D418christerholmbergericssoncom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi, I don=92t want to tell the draft authors how to handle text change suggesti= ons, but one option would be to use GitHub, where people can make pull requ= ests with the suggested changes. Probably would make life a little easier f= or everyone involved :) Regards, Christer From: stir > on behalf = of "richard@shockey.us" > Date: Monday 22 August 2016 at 01:23 To: David Frankel >, "stir@ie= tf.org" > Subject: Re: [stir] My Editorial Suggestions on RFC4474bis Dave once again, thank you for your deeply thoughtful comments. You are clearly taking out of your busy schedule as a C level executive to = think hard and fast about what is going on and more important you have skin= in the game because you actually are delivering a real product and real se= rvice. You are part of this industry. You like ATT, Comcast, Sprint and VZ = and others are going to have to live with some of this construct so your vi= ews are clearly important. Let me try and set some things now in context. Right now a process is being put in motion that has multiple parts, multipl= e actors and the IETF is only one of them. In the US right not the principa= l actor is the FCC Strike Force. US National Policy will be driven out of = that body. Protocol decisions will be determined in part out of the IETF a= nd this WG but there are multiple actors. Implementation issues may derive= from joint activity from the ATIS SIP Forum TF and other ATIS bodies but h= ighly critical issues may derive from the proposed work in 3GPP. They are = IMS after all. I have been convinced from the beginning of this process th= at unless we give the consumer adequate signaling as to the results of the = validation process we are not going to succeed. Attached is my Work in progress on what I think User Agent Validation Displ= ay should maybe look like. You ann assume BTW that this activity is being monitored by other NRA=92s. My principal worry at this point is setting unrealistic expectations to the= FCC and other NRA=92s on what SDO can do and how the vendor community can= implement solutions in a reasonable time frame. As I have privately brief= ed the usual suspects there is not a =93Silver Bullet=94 nor is there a =93= Magic Wand=94 by which we as technical professionals can make this scourge = go away overnight. After all this process is now 4 years running for some o= f us. Anyone familiar with the modern phone networks knows there is a IP t= ransition in process and considerations of security, reliability is utmost = in the minds of service providers and our regulators. This is a multi-layered approach over time. First deal with the NANP E.164 = layered issues between SP=92s that can be controlled. That IMHO is where w= e can achieve first order success. Let=92s postulate Sprint trusts Comcast= and Comcast trusts Sprint. That is what the JWT signed object can deliver= right now. How certificate credentials are created and passed among US ca= rriers are NOT THE BUSINESS OF THE IETF. That is high policy. How Sprint gets the validation data to its UA is where 3GPP comes into play= . How that data gets to IP PBX=92s or hosted UA is something I think the = SIP Forum can take up at the appropriate time. How this plays out in other= naming and addressing schemes like WEBRTC is for another time and place a= nd Jon and his folks will tell us when they are ready. We are no longer in the business of ending world hunger. We have a specific= challenge and a task laid out by Chairman Wheeler and Randall Stephenson a= nd IMHO they have done exactly the right thing. BTW I also believe there are some unique business opportunities here. Clea= rly there are some unique models for validation analytics here that no one = wants to actually talk about since that may involve real money :) From: stir > on behalf = of David Frankel > Organization: ZipDX LLC Date: Sunday, August 21, 2016 at 1:17 PM To: > Subject: [stir] My Editorial Suggestions on RFC4474bis Since my last notes, I=92ve gotten some constructive feedback here and priv= ately. Now, hoping to also be constructive, I want to volunteer some commen= ts about specific content in the 4474bis document. I=92ll preface this as follows: My interest is in how, and to what extent, = the proposed functionality will address abuse of the public telephone netwo= rk. By =93public telephone network=94 I mean that evolving set of networks and = technologies which permit any party to make a =93telephone call=94 to any o= ther party, from and to anywhere on the globe, using conventional telephone= number addressing and involving either conventional (circa 1970, perhaps?)= telephones, or something emulating such an instrument (mobile phone, smart= phone, web phone, IP phone, etc.). If we could start over today, we=92d no= doubt design the system completely differently, but with an installed base= of perhaps six or seven billion endpoints and associated addresses, and st= ill growing, it seems likely that this network is still some distance from = retirement. By =93abuse=94 I mean (1) the use of the network to defraud, steal from, or= deny service to a call recipient; (2) placing of programmatic unsolicited = marketing-related and similar calls that, intentionally or not, annoy or ha= rass a call recipient. I note that the prevalence of these abuses compromis= es the beneficial uses of the network by promoting suboptimal behaviors on = the part of telephone subscribers (refusing to answer any call for fear it = is an abusive call; sending all or most calls to voice-mail or CAPTCHA to a= void abusive calls; etc.); this impedes the flow and utility of good (non-a= busive) calls. Rather than parsing the document section by section, I=92ve structured my c= omments categorically since several of my suggestions touch in multiple pla= ces. OBJECTIVES / PURPOSE I want to reiterate some text from the SIP WG charter because I need to con= firm that we are all on the same page regarding our goals. It states: =93Si= nce it has become fairly easy to present an incorrect source telephone numb= er, a growing set of problems have emerged over the last decade. As with em= ail, the claimed source identity of a SIP request is not verified, permitti= ng unauthorized use of the source identity as part of deceptive and coerciv= e activities, such as robocalling (bulk unsolicited commercial communicatio= ns), vishing (voicemail hacking, and impersonating banks) and swatting (imp= ersonating callers to emergency services to stimulate unwarranted large sca= le law enforcement deployments). In addition, use of an incorrect source te= lephone number facilitates wire fraud or can lead to a return call at premi= um rates.=94 (Paragraph 1) And =93As its priority mechanism work item, the = working group will specify a SIP header-based mechanism for verification th= at the originator of a SIP session is authorized to use the claimed source = telephone number, where the session is established with SIP end to end.=94 = (Paragraph 3) That strikes me as a noble undertaking and I=92m reading the document in th= at context. 4474bis states at 3. Background: =93Per [RFC7340], problems such as robocal= ling, voicemail hacking, and swatting are enabled by an attacker's ability = to impersonate someone else.=94 I don=92t agree that RFC7340 states that th= ese abuses are =93enabled=94 by the =93ability to impersonate someone else.= =94 First, =93enabled=94 implies that if there were no such ability, then t= hese attacks would be =93disabled=94 and it isn=92t that cut and dried. Imp= ersonation =93facilitates=94 (or as the charter states, is =93part of=94) d= eceptive and coercive activities. Second, RFC7340 is explicit that both imp= ersonation and obfuscation (or obscuration) contribute to the problems. At = Page 4, it says: =93In general, number spoofing is used in two ways: impers= onation and anonymization.=94 When explaining the context and how 4474bis fits, caution and precision are= important. Here=92s my attempt at replacing the first paragraph of section= 3: =93Per [RFC7340], attackers often take advantage of the current ease with w= hich calling telephone numbers can be spoofed, and the singular reliance so= me call recipients place on that value. This allows abuse, for example, of = a voicemail service that compares the identity of the caller to a whitelist= before determining whether it should allow the caller access to recorded m= essages. Another example: an Internet telephone application that displays t= he calling party number (and/or an associated name retrieved from a local d= atabase) of a caller, which a human may review to make a policy decision be= fore answering a call. In both of these cases, attackers might attempt to c= ircumvent these authorization policies through impersonation. If the callin= g party number could be verified =96 that is, if the receiving person or ap= plication could know with reasonable certainty that the calling number was = not spoofed =96 then additional screening could be bypassed. The voicemail = service could give the caller direct access to the mailbox without demandin= g a password; the Internet telephone application could tell the human that = less stringent verbal verification procedures can be applied because we hav= e confidence that the caller is who they claim to be.=94 Obviously any well-designed use of current calling number information shoul= d recognize how readily this can be spoofed and should not operate without = some additional form of verification. It is incorrect to say =93The mechanism described in this document provides= a strong identity system for detecting attempted impersonation in SIP requ= ests.=94 What is strong about this mechanism is detecting that that the cal= ler is authorized to use the claimed phone number. Since most calls, for th= e foreseeable future, will lack the Identity header, the mechanism provides= no real means of detecting attempted impersonation. Whether a call without= an Identity header is or is not an impersonation cannot be determined. Cer= tainly a call with an Identity header that does not verify can be assumed t= o be either an impersonation or a technical or operational failure, but it = seems unlikely that impersonators would go to the trouble of sending an Ide= ntity header that will not verify. There is some related discussion currently in section 12.5, but I believe t= his needs to be brought forward and made more explicit because the =93trans= ition=94 will not be quick. We should also be careful not to assert that this mechanism universally pro= tects the CALLER NAME that is presented for many public network calls. If t= he NAME is being retrieved from a LOCAL DATABASE (such as the user=92s cont= act list in a mobile phone) there is less concern. But if the name is retri= eved, as it so often currently is in real-world deployments, from some netw= ork database populated by any number of different contributors (including a= busers), this mechanism provides no vehicle to prevent a caller with a veri= fied NUMBER from linking that number to a NAME like =93Card Services=94 or = =93FBI=94 or =93Frankel David=94 when they are in fact none of the above. T= he existing text says =93the calling party number (and/or Caller-ID) of a c= aller=94 but =93Caller-ID=94 is not defined and is ambiguous. Section 12.6 discusses signing of the Display Name; the text indicates this= is out of scope but offers some thoughts. I think Display Name generally i= s out of scope (RFC7340 states: =93This effort does not consider how the di= splay name of the caller might be validated.=94) so 4474bis shouldn=92t ind= icate what action =93should=94 or =93could=94 be taken with respect to that= field. Note that the Display Name field is only applicable for end-to-end = SIP calls. I suggest replacing 12.6 paragraph two as follows: =93Many current telephony deployments use the calling number to derive an a= lphanumeric Calling Name for display to the called party. Given the nature = of many of these deployments, even a verified calling number could result i= n the display of a falsified or impersonated name. The verified calling num= ber will be most useful when the name is derived from a local database (suc= h as a mobile phone contact list) maintained and trusted by the call recipi= ent.=94 We still need a discussion of the other half of the problem (per RFC7340), = which is ANONYMIZATION of the calling party. What I see today in 4474bis ad= dresses forms such as =93anonymous@example.com=94 where the caller explicitly declares anonymity. This is really rela= ted to privacy, which is why 4474bis has it in a section with that title. For abusive calls, the calling party generally achieves true anonymity eith= er by spoofing somebody else=92s phone number (often, in fact, just using r= andom numbers, or using a number similar to, but distinct from, the called = number), or by using one or more numbers that they have acquired but which = are challenging to identify (because when called, the number is not answere= d or yields only a vague voice-mail, and/or because the service provider re= sponsible for the number doesn=92t know or won=92t reveal who the actual cu= stomer is). The 3. Background section of 4474bis should include some mention of the ano= nymity problem, just as it discusses impersonation. I suggest: =93Today, be= cause it is easy to originate calls with any value in the From header, abus= ive callers can populate the field with random telephone numbers. Abusive c= allers (and their enabling service providers) are likely to be the last ado= pters of the Identity header. Until the Identity header becomes prevalent a= cross the universe of calls (and that will take some time, since it initial= ly will only apply to end-to-end SIP calls, which are a tiny minority), the= anonymity problem will remain because the abusive calls will be lost in th= e sea of normal (but unauthenticated) calls. Additionally, when a significa= nt number of calls generally ARE authenticated, abusive callers may seek to= obtain telephone numbers which they can authenticate, but which still are = ambiguous as to their ownership. It will be incumbent upon service provider= s and the regimes in which they operate to prevent such abuses (through mea= ns outside the scope of this document). If it is easy and cheap for abusers= to obtain quantities of telephone numbers and associated credentials witho= ut providing true identity information linked to those numbers, they will b= e able to remain anonymous even with valid Identity headers in their calls.= =94 As an aside, there are about six billion valid numbers in the North America= n (+1) Numbering Plan. There are currently probably on the order of one bil= lion of those assigned to end-users. Of the remaining five billion, some fr= action are allocated to service providers already (but unassigned to end-us= ers); the rest are currently unallocated. Abusive callers have, and will pr= obably continue to have, a variety of options for finding numbers they can = use to keep themselves anonymous until all the loopholes are finally closed= . DOMAIN vs. NUMBER AUTHENTICATION The Charter of the STIR Working Group states: =93The STIR working group will specify Internet-based mechanisms that allow= verification of the calling party's authorization to use a particular tele= phone number for an incoming call.=94 (First Sentence) =93The work of this group is limited to developing a solution for telephone= numbers. Expansion of the authorization mechanism to identities using the = user@domain or other name forms is out of scope.=94 (Fifth Paragraph) Given this, 4474bis should not contain, to the extent that it does, referen= ces to authenticating From headers containing alice@example.com or jon@example.com. (These appear re= peatedly in Sections 1, 4, 6, and 7.) There is also text about =93signing f= or a domain.=94 This is explicitly outside of scope, and it distracts from the stated purpo= se of the WG. If nothing else, I think we want the document to read very cl= early, to the greatest extent possible, how the spec is used to achieve the= goal of authenticating telephone numbers. I suggest that other than to briefly reiterate that it is out of scope, all= the references to authentication of domains be removed, and that all examp= les be restricted to that which is in scope (phone numbers). Certainly there is value in what has been (speculatively) documented regard= ing signing for a domain. This material could simply be archived for retrie= val later, when we are ready to tackle that. If there is insistence that it be included here (despite the mandate in the= charter that =93expansion...using user@domain...is out of scope=94), then it should be collected and placed in an appendix o= utside the primary flow of the document. I do realize the value of being fo= rward-looking. At the same time, there is such urgency in getting STIR depl= oyed for telephone numbers that I don=92t think we can afford the distracti= on. I must admit that I personally have had a terrible time reconciling how thi= s all actually functions for telephone numbers. =93Domain=94 appears 81 tim= es in the document and I can=92t tell which, if any, of those occurrences i= s relevant to the telephone number use case. ERRATA In going through the document I encountered a handful of typos. If you sear= ch for each of the text snippets below I think the issue will be apparent. those JSON object in a manner following PASSporT implementation the authentication service at an which contains a JSON representations of and add a corresponding an Identity header to the request is OPTIONAL baseline PASSporT objects in SIP as authentication service creates a PASSporT that uses [=93object=94 is missin= g] verification service performs the procedures above on each [should be =93be= low=94] verifier MUST inspect any optional "ppt" parameter appearing the Step 1, is understood), the verifier follows the procedures [=93supported= =94 instead of =93understood=94] prospect that a verification services could receive The verification of an Identity header does not entail [suggest =93The succ= essful verification=94] encoding of the header and claim component of this it conveys any canonical telephone number formats canonicalization of the numbers and compare them [=93numbers=94 plural?] unless they have some more other implementation-specific way role for a range of telephone and a user agent belonging to Alice included in a PASSporT object in, for example, an "uri" claim. correspond to any field of the SIP request, but then the optional legitimate request for one user is cut-and-pasted into a request consult some sort of directory that indications David Frankel ZipDX=AE LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir --_000_D3E0A966D418christerholmbergericssoncom_ Content-Type: text/html; charset="Windows-1252" Content-ID: <6D6A721E41AAA2418E3779FC71627922@ericsson.com> Content-Transfer-Encoding: quoted-printable
Hi,

I don=92t want to tell the draft authors how to handle text change sug= gestions, but one option would be to use GitHub, where people can make pull= requests with the suggested changes. Probably would make life a little eas= ier for everyone involved :)

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of "richard@shockey.us" <richard@shockey.us>
Date: Monday 22 August 2016 at 01:2= 3
To: David Frankel <dfrankel@zipdx.com>, "stir@ietf.org" <stir@ietf.org>
Subject: Re: [stir] My Editorial Su= ggestions on RFC4474bis

 

Dave once again, thank you for your deeply thoughtfu= l comments.  

 

You are clearly taking out of your busy schedule as = a C level executive to think hard and fast about what is going on and more = important you have skin in the game because you actually are delivering a r= eal product and real service. You are part of this industry. You like ATT, Comcast, Sprint and VZ and others= are going to have to live with some of this construct so your views are cl= early important.

 

Let me try and set some things now in context.<= /o:p>

 

Right now a process is being put in motion that has = multiple parts, multiple actors and the IETF is only one of them. In the US= right not the principal actor is the FCC Strike Force.  US National P= olicy will be driven out of that body.  Protocol decisions will be determined in part out of the IETF and this WG = but there are multiple actors.  Implementation issues may derive from = joint activity from the ATIS SIP Forum TF and other ATIS bodies but highly = critical issues may derive from the proposed work in 3GPP.  They are IMS after all.  I have been convinced fr= om the beginning of this process that unless we give the consumer adequate = signaling as to the results of the validation process we are not going to s= ucceed.

 

Attached is my Work in progress on what I think User= Agent Validation Display should maybe look like.

 

You ann assume BTW that this activity is being monit= ored by other NRA=92s.

 

My principal worry at this point is setting unrealis= tic expectations to the FCC and other NRA=92s  on what SDO can do and = how the vendor community can implement solutions in a reasonable time frame= .  As I have privately briefed the usual suspects there is not a =93Silver Bullet=94 nor is there a =93Magic Wand= =94 by which we as technical professionals can make this scourge go away ov= ernight. After all this process is now 4 years running for some of us. &nbs= p;Anyone familiar with the modern phone networks knows there is a IP transition in process and considerations of security, = reliability is utmost in the minds of service providers and our regulators.=

 

This is a multi-layered approach over time. First de= al with the NANP E.164 layered issues between SP=92s that can be controlled= .  That IMHO is where we can achieve first order success.  Let=92= s postulate Sprint trusts Comcast and Comcast trusts Sprint.  That is what the JWT signed object can deliver right now. Ho= w certificate  credentials are created and passed among US carriers ar= e NOT THE BUSINESS OF THE IETF. That is high policy.

 

How Sprint gets the validation data to its UA is whe= re 3GPP comes into play.   How that data gets to IP PBX=92s or ho= sted UA is something I think the SIP Forum can take up at the appropriate t= ime.  How this plays out in other naming and addressing schemes like WEBRTC  is for another time and place and Jon and his fo= lks will tell us when they are ready.  

 

We are no longer in the business of ending world hun= ger. We have a specific challenge and a task laid out by Chairman Wheeler a= nd Randall Stephenson and IMHO they have done exactly the right thing.

 

BTW I also believe there are some unique business op= portunities here.  Clearly there are some unique models for validation= analytics here that no one wants to actually talk about since that may inv= olve real money J

 

 

 

From: stir <s= tir-bounces@ietf.org> on behalf of David Frankel <dfrankel@zipdx.com>
Organization: ZipDX LLC
Date: Sunday, August 21, 2016 at 1:17 PM
To: <stir@ietf.org>
Subject: [stir] My Editorial Suggestions on RFC4474bis

 

Since my last notes, I=92ve gotten some constructive= feedback here and privately. Now, hoping to also be constructive, I want t= o volunteer some comments about specific content in the 4474bis document.

 

I=92ll preface this as follows: My interest is in ho= w, and to what extent, the proposed functionality will address abuse of the= public telephone network.

 

By =93public telephone network=94 I mean that evolvi= ng set of networks and technologies which permit any party to make a =93tel= ephone call=94 to any other party, from and to anywhere on the globe, using= conventional telephone number addressing and involving either conventional (circa 1970, perhaps?) telephones, or so= mething emulating such an instrument (mobile phone, smart phone, web phone,= IP phone, etc.). If we could start over today, we=92d no doubt design the = system completely differently, but with an installed base of perhaps six or seven billion endpoints and assoc= iated addresses, and still growing, it seems likely that this network is st= ill some distance from retirement.

 

By =93abuse=94 I mean (1) the use of the network to = defraud, steal from, or deny service to a call recipient; (2) placing of pr= ogrammatic unsolicited marketing-related and similar calls that, intentiona= lly or not, annoy or harass a call recipient. I note that the prevalence of these abuses compromises the beneficial uses= of the network by promoting suboptimal behaviors on the part of telephone = subscribers (refusing to answer any call for fear it is an abusive call; se= nding all or most calls to voice-mail or CAPTCHA to avoid abusive calls; etc.); this impedes the flow and utilit= y of good (non-abusive) calls.

 

Rather than parsing the document section by section,= I=92ve structured my comments categorically since several of my suggestion= s touch in multiple places.

 

OBJECTIVES / PURPOSE

 

I want to reiterate some text from the SIP WG charte= r because I need to confirm that we are all on the same page regarding our = goals. It states: =93Since it has become fairly easy to present an incorrec= t source telephone number, a growing set of problems have emerged over the last decade. As with email, the clai= med source identity of a SIP request is not verified, permitting unauthoriz= ed use of the source identity as part of deceptive and coercive activities,= such as robocalling (bulk unsolicited commercial communications), vishing (voicemail hacking, and impersonating = banks) and swatting (impersonating callers to emergency services to stimula= te unwarranted large scale law enforcement deployments). In addition, use o= f an incorrect source telephone number facilitates wire fraud or can lead to a return call at premium rate= s.=94 (Paragraph 1) And =93As its priority mechanism work item, the working= group will specify a SIP header-based mechanism for verification that the = originator of a SIP session is authorized to use the claimed source telephone number, where the session is establish= ed with SIP end to end.=94 (Paragraph 3)

 

That strikes me as a noble undertaking and I=92m rea= ding the document in that context.

 

4474bis states at 3. Background: =93Per [RFC7340], p= roblems such as robocalling, voicemail hacking, and swatting are enabled by= an attacker's ability to impersonate someone else.=94 I don=92t agree that= RFC7340 states that these abuses are =93enabled=94 by the =93ability to impersonate someone else.=94 First, =93enabled=94 imp= lies that if there were no such ability, then these attacks would be =93dis= abled=94 and it isn=92t that cut and dried. Impersonation =93facilitates=94= (or as the charter states, is =93part of=94) deceptive and coercive activities. Second, RFC7340 is explicit that both impersonati= on and obfuscation (or obscuration) contribute to the problems. At Page 4, = it says: =93In general, number spoofing is used in two ways: impersonation = and anonymization.=94

 

When explaining the context and how 4474bis fits, ca= ution and precision are important. Here=92s my attempt at replacing the fir= st paragraph of section 3:

 

=93Per [RFC7340], attackers often take advantage of = the current ease with which calling telephone numbers can be spoofed, and t= he singular reliance some call recipients place on that value. This allows = abuse, for example, of a voicemail service that compares the identity of the caller to a whitelist before determining= whether it should allow the caller access to recorded messages. Another ex= ample: an Internet telephone application that displays the calling party nu= mber (and/or an associated name retrieved from a local database) of a caller, which a human may review to = make a policy decision before answering a call. In both of these cases, att= ackers might attempt to circumvent these authorization policies through imp= ersonation. If the calling party number could be verified =96 that is, if the receiving person or applicati= on could know with reasonable certainty that the calling number was not spo= ofed =96 then additional screening could be bypassed. The voicemail service= could give the caller direct access to the mailbox without demanding a password; the Internet telephone applic= ation could tell the human that less stringent verbal verification procedur= es can be applied because we have confidence that the caller is who they cl= aim to be.=94

 

Obviously any well-designed use of current calling n= umber information should recognize how readily this can be spoofed and shou= ld not operate without some additional form of verification.

 

It is incorrect to say =93The mechanism described in= this document provides a strong identity system for detecting attempted im= personation in SIP requests.=94 What is strong about this mechanism is dete= cting that that the caller is authorized to use the claimed phone number. Since most calls, for the foreseeable fut= ure, will lack the Identity header, the mechanism provides no real means of= detecting attempted impersonation. Whether a call without an Identity head= er is or is not an impersonation cannot be determined. Certainly a call with an Identity header that does n= ot verify can be assumed to be either an impersonation or a technical or op= erational failure, but it seems unlikely that impersonators would go to the= trouble of sending an Identity header that will not verify.

 

There is some related discussion currently in sectio= n 12.5, but I believe this needs to be brought forward and made more explic= it because the =93transition=94 will not be quick.

 

We should also be careful not to assert that this me= chanism universally protects the CALLER NAME that is presented for many pub= lic network calls. If the NAME is being retrieved from a LOCAL DATABASE (su= ch as the user=92s contact list in a mobile phone) there is less concern. But if the name is retrieved, as it s= o often currently is in real-world deployments, from some network database = populated by any number of different contributors (including abusers), this= mechanism provides no vehicle to prevent a caller with a verified NUMBER from linking that number to a NAME= like =93Card Services=94 or =93FBI=94 or =93Frankel David=94 when they are= in fact none of the above. The existing text says =93the calling party num= ber (and/or Caller-ID) of a caller=94 but =93Caller-ID=94 is not defined and is ambiguous.

 

Section 12.6 discusses signing of the Display Name; = the text indicates this is out of scope but offers some thoughts. I think D= isplay Name generally is out of scope (RFC7340 states: =93This effort does = not consider how the display name of the caller might be validated.=94) so 4474bis shouldn=92t indicate what ac= tion =93should=94 or =93could=94 be taken with respect to that field. Note = that the Display Name field is only applicable for end-to-end SIP calls. I = suggest replacing 12.6 paragraph two as follows:

        &nbs= p;     

=93Many current telephony deployments use the callin= g number to derive an alphanumeric Calling Name for display to the called p= arty. Given the nature of many of these deployments, even a verified callin= g number could result in the display of a falsified or impersonated name. The verified calling number will be m= ost useful when the name is derived from a local database (such as a mobile= phone contact list) maintained and trusted by the call recipient.=94<= /o:p>

 

We still need a discussion of the other half of the = problem (per RFC7340), which is ANONYMIZATION of the calling party. What I = see today in 4474bis addresses forms such as =93anonymous@example.com=94= where the caller explicitly declares anonymity. This is really related to = privacy, which is why 4474bis has it in a section with that title.

 

For abusive calls, the calling party generally achie= ves true anonymity either by spoofing somebody else=92s phone number (often= , in fact, just using random numbers, or using a number similar to, but dis= tinct from, the called number), or by using one or more numbers that they have acquired but which are challengin= g to identify (because when called, the number is not answered or yields on= ly a vague voice-mail, and/or because the service provider responsible for = the number doesn=92t know or won=92t reveal who the actual customer is).

 

The 3. Background section of 4474bis should include = some mention of the anonymity problem, just as it discusses impersonation. = I suggest: =93Today, because it is easy to originate calls with any value i= n the From header, abusive callers can populate the field with random telephone numbers. Abusive callers (and the= ir enabling service providers) are likely to be the last adopters of the Id= entity header. Until the Identity header becomes prevalent across the unive= rse of calls (and that will take some time, since it initially will only apply to end-to-end SIP calls, whi= ch are a tiny minority), the anonymity problem will remain because the abus= ive calls will be lost in the sea of normal (but unauthenticated) calls. Ad= ditionally, when a significant number of calls generally ARE authenticated, abusive callers may seek to obtain t= elephone numbers which they can authenticate, but which still are ambiguous= as to their ownership. It will be incumbent upon service providers and the= regimes in which they operate to prevent such abuses (through means outside the scope of this document). If= it is easy and cheap for abusers to obtain quantities of telephone numbers= and associated credentials without providing true identity information lin= ked to those numbers, they will be able to remain anonymous even with valid Identity headers in their call= s.=94

 

As an aside, there are about six billion valid numbe= rs in the North American (+1) Numbering Plan. There are currently proba= bly on the order of one billion of those assigned to end-users. Of the rema= ining five billion, some fraction are allocated to service providers already (but unassigned to end-users); the = rest are currently unallocated. Abusive callers have, and will probably con= tinue to have, a variety of options for finding numbers they can use to kee= p themselves anonymous until all the loopholes are finally closed.

 

DOMAIN vs. NUMBER AUTHENTICATION

 

The Charter of the STIR Working Group states:

 

=93The STIR working group will specify Internet-base= d mechanisms that allow verification of the calling party's authorization t= o use a particular telephone number for an incoming call.=94 (First Sentenc= e)

 

=93The work of this group is limited to developing a= solution for telephone numbers. Expansion of the authorization mechanism t= o identities using the user@domain or other name forms is out of scope.=94 = (Fifth Paragraph)

 

Given this, 4474bis should not contain, to the exten= t that it does, references to authenticating From headers containing alice@example.com or jon@example.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) = There is also text about =93signing for a domain.=94

 

This is explicitly outside of scope, and it distract= s from the stated purpose of the WG. If nothing else, I think we want the d= ocument to read very clearly, to the greatest extent possible, how the spec= is used to achieve the goal of authenticating telephone numbers.

 

I suggest that other than to briefly reiterate that = it is out of scope, all the references to authentication of domains be remo= ved, and that all examples be restricted to that which is in scope (phone n= umbers).

 

Certainly there is value in what has been (speculati= vely) documented regarding signing for a domain. This material could simply= be archived for retrieval later, when we are ready to tackle that.

 

If there is insistence that it be included here (des= pite the mandate in the charter that =93expansion...using user@domain...is out of scope=94), = then it should be collected and placed in an appendix outside the primary f= low of the document. I do realize the value of being forward-looking. At th= e same time, there is such urgency in getting STIR deployed for telephone numbers that I don=92t think we can af= ford the distraction.

 

I must admit that I personally have had a terrible t= ime reconciling how this all actually functions for telephone numbers. =93D= omain=94 appears 81 times in the document and I can=92t tell which, if any,= of those occurrences is relevant to the telephone number use case.

 

ERRATA

 

In going through the document I encountered a handfu= l of typos. If you search for each of the text snippets below I think the i= ssue will be apparent.

 

those JSON object in a manner following PASSporT

 

implementation the authentication service at an=

 

which contains a JSON representations of<= /p>

 

and add a corresponding an Identity header to the re= quest

 

is OPTIONAL baseline PASSporT objects in SIP as=

 

authentication service creates a PASSporT that uses = [=93object=94 is missing]

 

verification service performs the procedures above o= n each [should be =93below=94]

 

verifier MUST inspect any optional "ppt" p= arameter appearing the

 

Step 1, is understood), the verifier follows the pro= cedures [=93supported=94 instead of =93understood=94]

 

prospect that a verification services could receive<= o:p>

 

The verification of an Identity header does not enta= il [suggest =93The successful verification=94]

 

encoding of the header and claim component of

 

this it conveys any canonical telephone number forma= ts

 

canonicalization of the numbers and compare them [= =93numbers=94 plural?]

 

unless they have some more other implementation-spec= ific way

 

role for a range of telephone and a user agent belon= ging to Alice

 

included in a PASSporT object in, for example, an &q= uot;uri" claim.

 

correspond to any field of the SIP request, but then= the optional

 

legitimate request for one user is cut-and-pasted in= to a request

 

consult some sort of directory that indications=

 

 

David Frankel

ZipDX<= sup>=AE LLC

Monte Sereno, CA USA

Tel: 1-800-FRANKEL (1-= 800-372-6535)

Watch Our Video!

 

_______________________________________________ stir m= ailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--_000_D3E0A966D418christerholmbergericssoncom_-- From nobody Mon Aug 22 07:32:52 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA57812D612 for ; Mon, 22 Aug 2016 07:32:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wlarFvwvNwCs for ; Mon, 22 Aug 2016 07:32:43 -0700 (PDT) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D135D12D611 for ; Mon, 22 Aug 2016 07:32:36 -0700 (PDT) Received: by mail-qk0-x22c.google.com with SMTP id z190so84729914qkc.0 for ; Mon, 22 Aug 2016 07:32:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=3V4bvL7Q7XvWhKBAaYL82rfy66Y62DsPHR7chkOjwZg=; b=R5NPVFm7gqkbU1YkQzIXtUb+I8Xb+YgFnSPk/6vOM+gS/LedXAK4KGe7k67K6hvh59 P+IHsOEwjjNaGeQuYKVDnMqvOWkChpbSBEY58RyDNlfWoHjhjIDe0WfbSXqPCakj+dT9 Y8iMKzg2MlkRVmGYBRU71dZptBb2dhvtZ6b9DUnihgHChTnNJLmmmi9j7CWQhzTKVfye 034b5jT58BK3OxT8JEuylUEjsBoyJraCPZk1F/sA7dnDOD8/VTg6fO8y1wDhrPMOqmHB MNfu7LeCeQF8GGh1TFDyB6eG73HteyyjEHagHAbX9PI1wKrpzwNw8lG3DN4bgQKJSdih 5FSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=3V4bvL7Q7XvWhKBAaYL82rfy66Y62DsPHR7chkOjwZg=; b=YAjbx8jZQfjePkr/b1MyVg6/Pili/cNT7yqw9E3VoPJps8a/GBxlSRLrmhrCHxy/WL wPKzTJjtGWf5x44mElKqz+g5hpZyF8dVVs0eSv1T7FtHh9EOyzHZlfIcnRJQHQW3QN74 ymrlwNqvDjulcQjpzv1WrZtIojgJLIsfDpd3QUXqGRizokP3BV4EXrJ2uakjxrvYcWDA DD/d/t5q0zct9fCDAmtXg1ASp39mUJTWuAqfDb1Eb1MUUtZaweLm+sJSDygVRkeiCfsR t257amYWE65gcp/ODmRwqnhGPtoVEk6iAtIVap347joNeCXIj2X3FY6w7n23jQbCCQ7Q 5h2A== X-Gm-Message-State: AE9vXwPJoyhaiWtTlyhKTfvu84e2AwLgK7SejKZZEOgQheRGZaBAmwG2Atov9mYsAyEB6w== X-Received: by 10.55.127.1 with SMTP id a1mr23612696qkd.80.1471876355970; Mon, 22 Aug 2016 07:32:35 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id k65sm5391520qkf.7.2016.08.22.07.32.35 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 22 Aug 2016 07:32:35 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <24B61E30-571F-426A-BC0E-CA1936F42504@shockey.us> Date: Mon, 22 Aug 2016 10:32:31 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <24B61E30-571F-426A-BC0E-CA1936F42504@shockey.us> To: Richard Shockey X-Mailer: Apple Mail (2.3124) Archived-At: Cc: stir@ietf.org, David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 14:32:50 -0000 Given that this isn=E2=80=99t SIP Forum/ATIS/3GPP, there are two IETF = related items I would like to comment on: One is that I really don=E2=80=99t think that a device that can do the = kind of intelligent display of the results of the validation can do the = validation. Therefore, I don=E2=80=99t think it=E2=80=99s worthwhile to = have some signaling path that states that the carrier validated and = =E2=80=9Ctrust me, everything is okay=E2=80=9D. Just send the = signature. It might be helpful to have a cert with a stapled OCSP = response in the body if there wasn=E2=80=99t one to begin with, which = any convenient B2BUA could add. Having that would be much better in = many more circumstances. Since there is clearly a trust boundary = between the network and the user, P-Asserted-Identity should not be = passed to the user. The other thing is that we can get a whole lot of value out of stir when = the termination network is POTS. You dismiss that as not feasible, but = it is if the validation is applied at the transit network. That would cover SIP origination, POTS termination, or even SIP = origination. SIP termination with a POTS transit in between. You need = to emphasize that in the IETF work, the originating device or network = has to sign, but anyone along the path can validate. Since = interconnection between networks is subject to interconnect agreements, = they can stipulate that valid signatures must be present. As I have = noted, this could be phased in by expressing the requirement as a = percentage good signed calls by a specified date. In fact, I believe that if deployment was initially on interconnects, we = would get much more bang for our buck than large (trusted) carrier to = large (trusted) carrier. And, one more comment: I think we=E2=80=99re going to get much earlier = interoperability testing at SIPit then we can expect from the 3GPP test = bed. Brian > On Aug 21, 2016, at 6:23 PM, Richard Shockey = wrote: >=20 > From nobody Mon Aug 22 08:01:17 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2B7512D610 for ; Mon, 22 Aug 2016 08:01:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nKrFvAeXO5nV for ; Mon, 22 Aug 2016 08:01:13 -0700 (PDT) Received: from resqmta-ch2-12v.sys.comcast.net (resqmta-ch2-12v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3AC412D6A6 for ; Mon, 22 Aug 2016 08:01:12 -0700 (PDT) Received: from resomta-ch2-01v.sys.comcast.net ([69.252.207.97]) by resqmta-ch2-12v.sys.comcast.net with SMTP id bqigbg2eexBKTbqiubCi8b; Mon, 22 Aug 2016 15:01:12 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-01v.sys.comcast.net with SMTP id bqitbrNo1m3k1bqitblsw0; Mon, 22 Aug 2016 15:01:12 +0000 To: stir@ietf.org References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <24B61E30-571F-426A-BC0E-CA1936F42504@shockey.us> From: Paul Kyzivat Message-ID: <2a4a3f93-ccaf-20c0-9bf1-aef39d7fe463@alum.mit.edu> Date: Mon, 22 Aug 2016 11:01:10 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfL2EHnNjcRsQQFo7Vsz82eitfQ2OmqoJ2x/01bIvqER+JntnsVOkcQjgt++6hDHFWEpeT7xlByeX5x7BwJR7Hobd7pnIOs2Kx9Ox/tdDjadBeErHtRsx UIeYNaldZqcNXHpjzYG+XQ+qqu8Qks0ndXMBPOHT0EnP5j2ITbCYxyPbkOvbQM/eZR7tFMHdVQEyqw== Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 15:01:16 -0000 Brian, I support almost everything you say below. But I think you accidentally got one statement wrong that almost inverts what I think you intended to say. And I another smaller comment. On 8/22/16 10:32 AM, Brian Rosen wrote: > Given that this isn’t SIP Forum/ATIS/3GPP, there are two IETF related items I would like to comment on: > > One is that I really don’t think that a device that can do the kind of intelligent display of the results of the validation can do the validation. s/don't/do/ > Therefore, I don’t think it’s worthwhile to have some signaling path that states that the carrier validated and “trust me, everything is okay”. Just send the signature. It might be helpful to have a cert with a stapled OCSP response in the body if there wasn’t one to begin with, which any convenient B2BUA could add. Having that would be much better in many more circumstances. > Since there is clearly a trust boundary between the network and the user, P-Asserted-Identity should not be passed to the user. I agree with the above statement *if* the caller requested anonymity. If the caller *did not* request anonymity, then there is no reason to strip P-Asserted-Identity. Most likely trust is asymmetric in this case, where the carrier doesn't trust the user but the user may have some degree of trust in the network. So having the P-Asserted-Identity can be of value to the user and discloses nothing that the caller desired to hide. Thanks, Paul > The other thing is that we can get a whole lot of value out of stir when the termination network is POTS. You dismiss that as not feasible, but it is if the validation is applied at the transit network. > That would cover SIP origination, POTS termination, or even SIP origination. SIP termination with a POTS transit in between. You need to emphasize that in the IETF work, the originating device or network has to sign, but anyone along the path can validate. Since interconnection between networks is subject to interconnect agreements, they can stipulate that valid signatures must be present. As I have noted, this could be phased in by expressing the requirement as a percentage good signed calls by a specified date. > > In fact, I believe that if deployment was initially on interconnects, we would get much more bang for our buck than large (trusted) carrier to large (trusted) carrier. > > And, one more comment: I think we’re going to get much earlier interoperability testing at SIPit then we can expect from the 3GPP test bed. > > Brian > > >> On Aug 21, 2016, at 6:23 PM, Richard Shockey wrote: >> >> > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Mon Aug 22 09:00:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F222612D66A for ; Mon, 22 Aug 2016 08:59:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.198 X-Spam-Level: X-Spam-Status: No, score=-1.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cS2RkN-71ENS for ; Mon, 22 Aug 2016 08:59:58 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 756DF12D75E for ; Mon, 22 Aug 2016 08:59:52 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7MG01jx026458 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 22 Aug 2016 09:00:01 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471881601; bh=FjYzKLn54wM40Xik80otUT6c0hSQHHBTe4M/1IGS7I0=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=B3GPcpCncT4a5PLiK6KS9ETYgsVIiP6Uw69c7kYyPVPs1eUf9ayt3CywZUfjREHOc XHIZdgTmeXVg/SxmwxjR31nOj9beC6ndL1CyaYojy0GniZAJFoLjK9YlJSGrg0D9UK Sam3ATD1pYMaOeB7B/6zT6pVb8gvjxbrg+6jCSNw= To: Eric Rescorla References: From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> Date: Mon, 22 Aug 2016 08:59:33 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 15:59:59 -0000 Eric, et al, On 8/21/2016 6:50 AM, Eric Rescorla wrote: > On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker > wrote: > > [*] Use of certs for the web are famously problematic. First, the > only serious reliance on them is to prevent MITM attacks. Second, > are all of the operational problems with root CAs. Third are all > the times sites do self-signing. ... > 1. I'm not quite sure what you mean when you say that the only serious > reliance of Web certificates is to prevent MITM attacks. In general, the > purpose of Web certificates is to authenticate the endpoints involved in > the HTTPS connection, thus preventing attackers from impersonating one > of those endpoints (whether the attacker then does an MITM attack or > some other attack is kind of a detail; for instance an attacker might > just impersonate a site without ever connecting to it). What purpose > would you expect these certificates to serve that they are not serving? First, apologies; my comment was much too cryptic. Second, my comment was on current operational realities, whereas your response started by noting intent. This disparity evokes the cliche about the difference between theory and practice. Now to be less cryptic: The TLS specification supports server authentication, client authentication and channel encryption. Its primary use, at scale, is only for encryption. Server authentication is performed, if possible, but only to make the encryption protect against man-in-the-middle attacks. (My understanding is that client authentication has no significant use.) Absent that authentication, opportunistic encryption protects against passive wiretapping but not MITM. Hence my previous, cryptic summary. As for serving other purposes, certs are also used to validate the target (server) domain name in a web session -- that is, it the obtained server authorized under the domain name used by the client. While I believe that the mechanisms for this are in relatively widescale use, there's been little-to-no demonstrated efficacy, which limits the amount people attend to any possible problems with the certs. (Why spend time worrying about something that isn't useful?) There are also the significant domain name matching problems with the mechanism, prompting a significant revision effort. I haven't been its status, but the work is recent. Certs are also used for OAUTH, which looks like large scale use but is only large-scale on the client-side and rather tiny scale at the side of the services getting validated. Worse, I believe these are all pre-registered with any server choosing to emply oauth. Over the open Internet, at scale, I'm not aware of other significant uses of certs. > 2. It's certainly true that there have been a number of high-profile > instances of misissuance by trust anchors, but I'm not sure that this > speaks as much to inherent problems of PKI as to the scale of the Web > PKI and the number of trust anchors in the system. Therein likes a really basic disconnect between the security technical community and the real world. 1) The history appears to be much worse than you indicate[*]. 2) Your comment appears to imply exclusion of human factors from analysis of cert issues. In fact, the root -- well, actually, 'bush' -- cert system has so far demonstrated a failure to be safe or manageable. And the end-user experience with certs remains much worse than problematic. By the way, the ATIS-SIPforum texts I've seen about use of certs appears to only cover North America. What is the operational model for certs planned for global use? > 3. I'm not sure how self-signing comes into things; self-signing is > largely a response to difficulty in obtaining valid certs. My > understanding was that STIR was going to have a more straightforward > (and initially less distributed) issuance story. I was noting an operational reality, in the environment that is the largest users of certs. It is the ultimate demonstration of the failure of that model. My point is not that STIR can't work around it but that STIR has not documented any of the design issues and has not specified any operational constraints for ensuring success. Hence, whether STIR can produce acceptable use of certs is currently unknowable, but should be counted as high risk, IMO. > More generally, if STIR authentication merely worked almost as well as > the Web PKI, that seems like it would be pretty significant improvement > over the current situation. That does sound appealing, doesn't it? Except that I believe there is no documentation to support even this modest a claim of efficacy, while there is quite a bit of documentation of failures and problems with Web PKI. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 22 09:15:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B5EB12D799 for ; Mon, 22 Aug 2016 09:14:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fhAsVyTPbyvA for ; Mon, 22 Aug 2016 09:14:57 -0700 (PDT) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3221A12D74E for ; Mon, 22 Aug 2016 09:14:57 -0700 (PDT) Received: by mail-qk0-x235.google.com with SMTP id t7so86839526qkh.1 for ; Mon, 22 Aug 2016 09:14:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WETkZmzfSojvAUqF8Xx5AnmCBrQXziTfRQ84JjDldkE=; b=x1bylLJYObCPp7m8YtQL2l4GYAV+Kgn+vBPBl1GJ5+W2JU+uhnE6ehiCJS87zIe2Va 8OF5M7tcPvqxpe8DhPNLzUqihHFmNotxO30vl8ZbipYNMGNLShFopMvetzhrGN1kYnxm 9y1N2QrkvLXLy1+fbnMqvz3H7qepippDS6XwsWOrNnz6YH2soe/nJ7eNH3ip1QObiAFw 5ucbDdtKyQfObq3EXCfjmTJufolcs5bK4Fxus3X/6vxrWr2ISKo/RoYk/sFEUNv3Wmku AdxGkRYNdMTDXOimPO4SEcaAfKyiedzJYUp4lBmZ86ztwqbz3x+5k8VJz2JHvXq9qQR/ BWgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WETkZmzfSojvAUqF8Xx5AnmCBrQXziTfRQ84JjDldkE=; b=XS853EaWCn452B3VV3neMPQqV1hhEFlODuMJukOH2yzH8e7P289jeCB2Qd7szIOmId cIy7tgqNGo0aSAbEobQcR/IH4BzVMm8vII+sLWKAY5vy59V8G4cqkOddfNGv3LUCzGg8 aWJ0BGsyEloyqdp48txYBFGPNRULhUrhVVBerpA+3CIEsdvzj4OvnM+V3dWDMD3bdi8M pq+1MaXckBG3q6JXhF5y5FZidWXKyRrfvCqW7R5Qv5kWYtXQPJsdelGikfn9AQjCoeQ2 Uj78qgXGoIfJAK8Rq/+PqTHbS6KoPQD1U6NJXcT+1CEyCFHg/VM7an9iclqbhE32eR8Q 65zw== X-Gm-Message-State: AEkoouuKT9aA6aS1L23u0aBiSF/0GBsz886KBcl+bMa+9yWQfWInCtpbIp47P6T5tpk/cA== X-Received: by 10.55.103.145 with SMTP id b139mr25114066qkc.108.1471882491467; Mon, 22 Aug 2016 09:14:51 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id t36sm10023290qtd.3.2016.08.22.09.14.50 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 22 Aug 2016 09:14:50 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> Date: Mon, 22 Aug 2016 12:14:47 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Eric Rescorla Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 16:14:59 -0000 The primary premise of stir is that in every country, there exists a = delegation process for telephone numbers. It can be multi-step, it can = be formal, informal, or most commonly, a combination. The root of trust for every country is the regulator. They are the = ultimate source of telephone numbers for that country code (there are = some more complex issues for country codes like +1 that encompass more = than one regulator, but the formal delegation processes for TNs in those = cases are well controlled). In every country, the first delegation is a = formal delegation: the regulator or some entity operating on behalf of = the regulator is delegated a block of numbers. =46rom there, delegation = processes vary, and they can include number portability (which is a = delegation of a single TN from one service provider to another). =20 Our premise is that issuance of certs follows the delegation process. = When you delegate, a cert is issued (or the scope of an existing cert is = changed).=20 The goal to to provide authenticated source of calls, but in reality, = what we need is a way for the authorities to find bad actors. By making = the PKI follow the delegation path, you end up with someone holding the = bag. If a delegation was made to someone who is a bad actor, then = either the bad actor can be identified, or the entity who did the = delegation to someone who was the bad actor is left with the bag. = Everyone can make mistakes, but if the authorities keep finding the same = service provider not being able to identify their bad actor customers, = then steps can be taken to address the situation. I believe that=E2=80=99s deployable at scale. Brian > On Aug 22, 2016, at 11:59 AM, Dave Crocker wrote: >=20 > Eric, et al, >=20 > On 8/21/2016 6:50 AM, Eric Rescorla wrote: >> On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker > > wrote: >>=20 >> [*] Use of certs for the web are famously problematic. First, the >> only serious reliance on them is to prevent MITM attacks. Second, >> are all of the operational problems with root CAs. Third are all >> the times sites do self-signing. > ... >> 1. I'm not quite sure what you mean when you say that the only = serious >> reliance of Web certificates is to prevent MITM attacks. In general, = the >> purpose of Web certificates is to authenticate the endpoints involved = in >> the HTTPS connection, thus preventing attackers from impersonating = one >> of those endpoints (whether the attacker then does an MITM attack or >> some other attack is kind of a detail; for instance an attacker might >> just impersonate a site without ever connecting to it). What purpose >> would you expect these certificates to serve that they are not = serving? >=20 > First, apologies; my comment was much too cryptic. Second, my comment = was on current operational realities, whereas your response started by = noting intent. This disparity evokes the cliche about the difference = between theory and practice. >=20 > Now to be less cryptic: >=20 > The TLS specification supports server authentication, client = authentication and channel encryption. Its primary use, at scale, is = only for encryption. Server authentication is performed, if possible, = but only to make the encryption protect against man-in-the-middle = attacks. (My understanding is that client authentication has no = significant use.) Absent that authentication, opportunistic encryption = protects against passive wiretapping but not MITM. Hence my previous, = cryptic summary. >=20 > As for serving other purposes, certs are also used to validate the = target (server) domain name in a web session -- that is, it the obtained = server authorized under the domain name used by the client. While I = believe that the mechanisms for this are in relatively widescale use, = there's been little-to-no demonstrated efficacy, which limits the amount = people attend to any possible problems with the certs. (Why spend time = worrying about something that isn't useful?) There are also the = significant domain name matching problems with the mechanism, prompting = a significant revision effort. I haven't been its status, but the work = is recent. >=20 > Certs are also used for OAUTH, which looks like large scale use but is = only large-scale on the client-side and rather tiny scale at the side of = the services getting validated. Worse, I believe these are all = pre-registered with any server choosing to emply oauth. >=20 > Over the open Internet, at scale, I'm not aware of other significant = uses of certs. >=20 >=20 >> 2. It's certainly true that there have been a number of high-profile >> instances of misissuance by trust anchors, but I'm not sure that this >> speaks as much to inherent problems of PKI as to the scale of the Web >> PKI and the number of trust anchors in the system. >=20 > Therein likes a really basic disconnect between the security technical = community and the real world. 1) The history appears to be much worse = than you indicate[*]. 2) Your comment appears to imply exclusion of = human factors from analysis of cert issues. >=20 > In fact, the root -- well, actually, 'bush' -- cert system has so far = demonstrated a failure to be safe or manageable. And the end-user = experience with certs remains much worse than problematic. >=20 > By the way, the ATIS-SIPforum texts I've seen about use of certs = appears to only cover North America. What is the operational model for = certs planned for global use? >=20 >=20 >> 3. I'm not sure how self-signing comes into things; self-signing is >> largely a response to difficulty in obtaining valid certs. My >> understanding was that STIR was going to have a more straightforward >> (and initially less distributed) issuance story. >=20 > I was noting an operational reality, in the environment that is the = largest users of certs. It is the ultimate demonstration of the failure = of that model. >=20 > My point is not that STIR can't work around it but that STIR has not = documented any of the design issues and has not specified any = operational constraints for ensuring success. Hence, whether STIR can = produce acceptable use of certs is currently unknowable, but should be = counted as high risk, IMO. >=20 >=20 >=20 >> More generally, if STIR authentication merely worked almost as well = as >> the Web PKI, that seems like it would be pretty significant = improvement >> over the current situation. >=20 > That does sound appealing, doesn't it? >=20 > Except that I believe there is no documentation to support even this = modest a claim of efficacy, while there is quite a bit of documentation = of failures and problems with Web PKI. >=20 >=20 > d/ > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 22 09:26:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BB2712D576 for ; Mon, 22 Aug 2016 09:26:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VEHSsaoVvdeQ for ; Mon, 22 Aug 2016 09:26:45 -0700 (PDT) Received: from mail-yw0-x22a.google.com (mail-yw0-x22a.google.com [IPv6:2607:f8b0:4002:c05::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95A4D12D552 for ; Mon, 22 Aug 2016 09:26:45 -0700 (PDT) Received: by mail-yw0-x22a.google.com with SMTP id r9so55759059ywg.0 for ; Mon, 22 Aug 2016 09:26:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=uURC8HvmTcxElQ4d9khRcXd0ThBh64Le27mmH19Hz44=; b=nGFjpB+u47+DO2mFSMnp9WhBzB1w1yhs8lww6FOCy3eaF11VIseqKj5QWNHmQ9+E4R g9yRdiXDr8mFCti0P4ZiPz1CUcLKtbc5HCMq6+IkBU/moeW5FCGn6Erye8wcr7W1C07g s+VCtU8YUI0gaZhDqluJa61WgqXyFtqiw1/9R6CO8bnDdyJDFY3984Vxm2GfC9mQ33D/ VU2F8OGAuvC0I6PmnO1sVurWops8fhl+Kw+Sb3T2JMzdeiF/qyM0N7RGQD0dt7oMZtd/ rBDLqCjLmkWShry0QTcIcIJfO75+u1582rne0w8HhpFE9LMOv3z0gNCMxzbFuDxG0htd f1qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=uURC8HvmTcxElQ4d9khRcXd0ThBh64Le27mmH19Hz44=; b=DPPZBBbLlGJEmaQX2ArpiYnD7/5Idgm9034UKw+TpQECj6o1CNPxZ2da+3oq9S/iyB A2AVENP2fxeC3VppA2tReNSh/OUQNUhD4Y5sNBylzB+hAN7IhYiS4UyokQlI42JjCyip qeMh7PHXl88eCO4Ykll7pztDvxmJcRRwWNZVB8wAGSDDGWclxW4AyCJULVskE49Kh3cI Ahxj0Cb49/TmxgJjLZaPBMmYW8RJ6YKWE2NVsAsFlj02K9ekdEDBngF+l7J/fRjx/CgN ZJsVoENW1MSvY45IdWOVdHqw5iEcTyQGAheVmzqM/+uSwSLHao0ZEe3Hf41df2RBs5Rm dHNg== X-Gm-Message-State: AEkoousTwXwBxrgWnSHhKb05MOpeaQFtpxP9hzWcW6C/L3IgJRKtvt1MlQQ2LQ3wG9924eseOpUrHab31ONo2A== X-Received: by 10.129.161.129 with SMTP id y123mr19556067ywg.214.1471883204761; Mon, 22 Aug 2016 09:26:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Mon, 22 Aug 2016 09:26:04 -0700 (PDT) In-Reply-To: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> From: Eric Rescorla Date: Mon, 22 Aug 2016 09:26:04 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=001a114f8db2924b2b053aab835c Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 16:26:47 -0000 --001a114f8db2924b2b053aab835c Content-Type: text/plain; charset=UTF-8 On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker wrote: > Eric, et al, > > On 8/21/2016 6:50 AM, Eric Rescorla wrote: > >> On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker > > wrote: >> >> [*] Use of certs for the web are famously problematic. First, the >> only serious reliance on them is to prevent MITM attacks. Second, >> are all of the operational problems with root CAs. Third are all >> the times sites do self-signing. >> > ... > >> 1. I'm not quite sure what you mean when you say that the only serious >> reliance of Web certificates is to prevent MITM attacks. In general, the >> purpose of Web certificates is to authenticate the endpoints involved in >> the HTTPS connection, thus preventing attackers from impersonating one >> of those endpoints (whether the attacker then does an MITM attack or >> some other attack is kind of a detail; for instance an attacker might >> just impersonate a site without ever connecting to it). What purpose >> would you expect these certificates to serve that they are not serving? >> > > First, apologies; my comment was much too cryptic. Second, my comment was > on current operational realities, whereas your response started by noting > intent. Thanks for clarifying. Responses below. > This disparity evokes the cliche about the difference between theory and > practice. > > Now to be less cryptic: > > The TLS specification supports server authentication, client > authentication and channel encryption. Its primary use, at scale, is only > for encryption. Server authentication is performed, if possible, but only > to make the encryption protect against man-in-the-middle attacks. (My > understanding is that client authentication has no significant use.) Absent > that authentication, opportunistic encryption protects against passive > wiretapping but not MITM. Hence my previous, cryptic summary. I don't believe that this is an accurate summary of the situation. Certificates are routinely used for server authentication in settings where the primary target is not confidentiality of the traffic but rather integrity of the data between the server and the client (or vice versa). A typical example would be software download (or alternately, embedding of JS libraries into Web applications) where it's obviously important that the user get the software they intended. As a specific example, Mozilla distributes Firefox over HTTPS not because Firefox is secret but because we don't want attackers tampering with it. Encryption is generally used in those scenarios as well merely because that's how TLS is customarily operated, but primary target is integrity/data origin authentication. I'm not sure what you would consider "significant" use of client authentication but I can tell you that it's in sufficiently wide use that we had to make special accommodations in TLS 1.3 for some variants of client auth because it was so important in enterprise use cases. Incidentally, it would probably be helpful here to avoid the use of the term "MITM". I appreciate that that terminology once had wide currency, but it really only refers to a specific class of impersonation attack, and not necessarily the one of interest. For instance, if I impersonate Mozilla and send you malware instead of Firefox, I don't need to connect to Mozilla's server, so it's not really a MITM Attack, just server impersonation. As for serving other purposes, certs are also used to validate the target > (server) domain name in a web session -- that is, it the obtained server > authorized under the domain name used by the client. While I believe that > the mechanisms for this are in relatively widescale use, there's been > little-to-no demonstrated efficacy, which limits the amount people attend > to any possible problems with the certs. (Why spend time worrying about > something that isn't useful?) There are also the significant domain name > matching problems with the mechanism, prompting a significant revision > effort. I haven't been its status, but the work is recent. > This seems to be raising a separate question, namely whether the Web PKI system actually meaningfully achieves its security goals. I'm not aware of any definitive research in this area, however, I also think it's fair to say that HTTPS is widely considered to be best practice and that both browser vendors and TLS implementors take authentication failures seriously. 2. It's certainly true that there have been a number of high-profile >> instances of misissuance by trust anchors, but I'm not sure that this >> speaks as much to inherent problems of PKI as to the scale of the Web >> PKI and the number of trust anchors in the system. >> > > Therein likes a really basic disconnect between the security technical > community and the real world. 1) The history appears to be much worse than > you indicate[*]. Does this footnote go somewhere? > 2) Your comment appears to imply exclusion of human factors from analysis > of cert issues. > Hmm... Can you elaborate on this? 3. I'm not sure how self-signing comes into things; self-signing is >> largely a response to difficulty in obtaining valid certs. My >> understanding was that STIR was going to have a more straightforward >> (and initially less distributed) issuance story. >> > > I was noting an operational reality, in the environment that is the > largest users of certs. It is the ultimate demonstration of the failure of > that model. > I'm going to have to differ here. I certainly wouldn't argue that the Web PKI system is perfect, but it has also become vastly easier to obtain and deploy certificates (thanks in large part to efforts like Let's Encrypt, SSLmate, Caddy, and Amazon's CA), and our telemetry shows that we're approaching 50% of browser transactions being HTTPS, despite the browsers strongly discouraging self-signed certs so I think "ultimate demonstration of the failure" somewhat overstates things. More generally, if STIR authentication merely worked almost as well as >> the Web PKI, that seems like it would be pretty significant improvement >> over the current situation. >> > > That does sound appealing, doesn't it? > > Except that I believe there is no documentation to support even this > modest a claim of efficacy, while there is quite a bit of documentation of > failures and problems with Web PKI. Hmm.... What kind of documentation would you consider to support this kind of claim (leaving aside the question of whether such documentation exists). -Ekr > > > d/ > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --001a114f8db2924b2b053aab835c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker <dhc@dcrocker.net>= wrote:
Eric, et al,

On 8/21/2016 6:50 AM, Eric Rescorla wrote:
On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker <dhc@dcrocker.net
 <mailto:dhc@dcrock= er.net>> wrote:

=C2=A0 =C2=A0 [*] Use of certs for the web are famously problematic.=C2=A0 = First, the
=C2=A0 =C2=A0 only serious reliance on them is to prevent MITM attacks.=C2= =A0 Second,
=C2=A0 =C2=A0 are all of the operational problems with root CAs.=C2=A0 Thir= d are all
=C2=A0 =C2=A0 the times sites do self-signing.
...
1. I'm not quite sure what you mean when you say that the only serious<= br> reliance of Web certificates is to prevent MITM attacks. In general, the purpose of Web certificates is to authenticate the endpoints involved in the HTTPS connection, thus preventing attackers from impersonating one
of those endpoints (whether the attacker then does an MITM attack or
some other attack is kind of a detail; for instance an attacker might
just impersonate a site without ever connecting to it). What purpose
would you expect these certificates to serve that they are not serving?

 First, apologies; my comment was much too cryptic.=C2=A0 Second, my comment= was on current operational realities, whereas your response started by not= ing intent.=C2=A0

Thanks for clarifying. R= esponses below.


=C2=A0
This disparity evokes the cliche about the differen= ce between theory and practice.

Now to be less cryptic:

The TLS specification supports server authentication, client authentication= and channel encryption.=C2=A0 Its primary use, at scale, is only for encry= ption.=C2=A0 Server authentication is performed, if possible, but only to m= ake the encryption protect against man-in-the-middle attacks.=C2=A0 (My und= erstanding is that client authentication has no significant use.) Absent th= at authentication, opportunistic encryption protects against passive wireta= pping but not MITM.=C2=A0 Hence my previous, cryptic summary.<= div>
I don't believe that this is an accurate summary of = the situation. Certificates are routinely used for server authentication in= settings where the primary target is not confidentiality of the traffic bu= t rather integrity of the data between the server and the client (or vice v= ersa). A typical example would be software download (or alternately, embedd= ing of JS libraries into Web applications) where it's obviously importa= nt that the user get the software they intended. As a specific example, Moz= illa distributes Firefox over HTTPS not because Firefox is secret but becau= se we don't want attackers tampering with it. Encryption is generally u= sed in those scenarios as well merely because that's how TLS is customa= rily operated, but primary target is integrity/data origin authentication.= =C2=A0

I'm not sure what you would consider &q= uot;significant" use of client authentication but I can tell you that = it's in sufficiently wide use that we had to make special accommodation= s in TLS 1.3 for some variants of client auth because it was so important i= n enterprise use cases.

Incidentally, it would pro= bably be helpful here to avoid the use of the term "MITM". I appr= eciate that that terminology once had wide currency, but it really only ref= ers to a specific class of impersonation attack, and not necessarily the on= e of interest. For instance, if I impersonate Mozilla and send you malware = instead of Firefox, I don't need to connect to Mozilla's server, so= it's not really a MITM Attack, just server impersonation.


As for serving other purposes, certs are also used to validate the target (= server) domain name in a web session -- that is, it the obtained server aut= horized under the domain name used by the client.=C2=A0 While I believe tha= t the mechanisms for this are in relatively widescale use, there's been= little-to-no demonstrated efficacy, which limits the amount people attend = to any possible problems with the certs. (Why spend time worrying about som= ething that isn't useful?) There are also the significant domain name m= atching problems with the mechanism, prompting a significant revision effor= t.=C2=A0 I haven't been its status, but the work is recent.

This seems to be raising a separate question, name= ly whether the Web PKI system actually meaningfully achieves its security g= oals. I'm not aware of any definitive research in this area, however, I= also think it's fair to say that HTTPS is widely considered to be best= practice and that both browser vendors and TLS implementors take authentic= ation failures seriously.


2. It's certainly true that there have been a number of high-profile instances of misissuance by trust anchors, but I'm not sure that this speaks as much to inherent problems of PKI as to the scale of the Web
PKI and the number of trust anchors in the system.

 Therein likes a really basic disconnect between the security technical comm= unity and the real world.=C2=A0 1) The history appears to be much worse tha= n you indicate[*].


Does this= footnote go somewhere?


=C2=A0
2) Your comment appears to imply exclusion= of human factors from analysis of cert issues.

Hmm... Can you elaborate on this?


3. I'm not sure how self-signing comes into things; self-signing is
largely a response to difficulty in obtaining valid certs. My
understanding was that STIR was going to have a more straightforward
(and initially less distributed) issuance story.

 I was noting an operational reality, in the environment that is the largest= users of certs.=C2=A0 It is the ultimate demonstration of the failure of t= hat model.

I'm going to have to dif= fer here. I certainly wouldn't argue that the Web PKI system is perfect= , but it has also become vastly easier to obtain and deploy certificates (t= hanks in large part to efforts like Let's Encrypt, SSLmate, Caddy, and = Amazon's CA), and our telemetry shows that we're approaching 50% of= browser transactions being HTTPS, despite the browsers strongly discouragi= ng self-signed certs so I think "ultimate demonstration of the failure= " somewhat overstates things.


=
More generally, if STIR authentication merely worked almost as well as
the Web PKI, that seems like it would be pretty significant improvement
over the current situation.

 That does sound appealing, doesn't it?

Except that I believe there is no documentation to support even this modest= a claim of efficacy, while there is quite a bit of documentation of failur= es and problems with Web PKI.

Hmm.... What = kind of documentation would you consider to support this kind of claim (lea= ving aside the question of whether such documentation exists).
-Ekr




d/

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

--001a114f8db2924b2b053aab835c-- From nobody Mon Aug 22 09:28:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2327012D731 for ; Mon, 22 Aug 2016 09:28:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.988 X-Spam-Level: X-Spam-Status: No, score=-0.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_MSPIKE_BL=0.01, RCVD_IN_MSPIKE_L5=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B0tV10F03U8g for ; Mon, 22 Aug 2016 09:28:24 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1995B12D552 for ; Mon, 22 Aug 2016 09:28:24 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7MGSUxC028126 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 22 Aug 2016 09:28:31 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471883311; bh=sQUmqQmi7p84g6ZyCKpXGnUMLsVb6bb2ril5Sk9VRfY=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=ogJb0IiLY/mTIWGqQN5uQiYR9dLuU4YWLVknSaot1fKO3YE7dQvddJ2iH6mQ18HwT I/6hWHWbgAvGbzJmjN8p2OpW9CkVis2FouIpFXGCAWXcUEjqlmeFmdOD51K0dyBSM2 sg2G6YbkNC/tZVcGFn/WjCWTGjJpC459a1dT1ank= To: Christer Holmberg , Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> Date: Mon, 22 Aug 2016 09:28:03 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 16:28:25 -0000 On 8/21/2016 9:03 AM, Christer Holmberg wrote: > I agree with Ekr, and being able to use something pre-existing is the > reason I asked the passport authors to consider JWT. If you think there > is something better pre-existing, please say so, but if you want to do > something from scratch I think we’d need some really good justification > for that. I don’t agree with your earlier statements that JWT is > complex, and there are tons of tools to test and verify JWTs. Christer, Just to be thorough, I'll repeat that I agree with the goal of using existing solutions, where they represent a high-enough point of departure (if they aren't a perfect match), preferably with enough track record to establish efficacy. And I'll repeat that my view of the passport draft did not criticize the use of JWT. (By the way, is it only JWT or is it actually JOSE, and if it isn't why not?) It's not that I didn't question the use, it's that I didn't indulge in that questioning at that point. This came later, as I watched the documentation efforts to integrate use of JWT. > In Berlin I did raise an issue on how STIR uses JWT in SIP (the encoded > object is “split up”, and different pieces are placed in different SIP > elements), but Jon promised to make sure it’s clarified and well > explained in the next version of the bis draft, so I think we should > give him a chance to do that. There are at least two major problems here. The technical one is that the current approach requires doing encoding and packaging twice, from what I can tell. Once in a JSON context and the second in a SIP header context. By itself, that should be worrying. That the latter hasn't been fully documented and agreed to, yet, raises a question about how anyone thought the documents were ready for last call. The other major problem is that the introduction of JSON/JWT has produced levels of indirection in the documentation that made it essentially impossible for me to understand and analyze the specification details. And I tried pretty hard. So this does not bode well for other new readers of the specifications. (More generally, the documents make cross-references and indulge in cross-dependencies that defeat the benefits of modularity and create really serious reading complexity.) And now, yes, I'll indulge in the dreaded "DKIM" reference... DKIM is another existing mechanism that provides exactly the needed functionality, with more than 10 years of field experience (counting the predecessor Yahoo's Domainkeys) and a relatively simple design. As I've noted before, the list of 'topics' for the STIR work is not long. I'll do an abbreviated listing here: 1. Calling value acquisition -- getting the string to validate 2. Key management --getting the key and validating that it is authorized for use with the calling value. 3. A bunch of crypto-related computation -- including canonicalization of the data of course 4. Packaging the result -- for use by the validation mechanism. Step 1 is not part of the crypto work, but it is of course fundamental, as well as being specific to STIR. The crypto subsystem just uses it as input. The choice of JSON/JWT, DKIM, or whatever is irrelevant to this step. Step 2: a) For non-telephone URIs, DKIM's DNS model can be used directly. b) I'm unclear about the role of the domain name in the URIs that have a phone number in the left-hand side. In any event, as I've noted repeatedly, number-based key management is an open issue, with demonstrated high risk, given that the previous effort failed. Step 3 can use DKIM almost directly. Step 4 can use DKIM almost directly. So the DKIM approach is dramatically simpler and offers by far the highest point of departure for STIR. In particular, the hard parts of doing STIR aren't solved by this choice -- JSON/JWT don't help either. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Aug 22 10:57:59 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7937D12B039; Mon, 22 Aug 2016 10:57:58 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.30.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147188867849.8301.7751648124004093616.idtracker@ietfa.amsl.com> Date: Mon, 22 Aug 2016 10:57:58 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-passport-06.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 17:57:58 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Persona Assertion Token Authors : Chris Wendt Jon Peterson Filename : draft-ietf-stir-passport-06.txt Pages : 16 Date : 2016-08-22 Abstract: This document defines a canonical string object or 'token' for verifying with non-repudiation the author of the token, their authority to author the token and, minimally, the asserted originating identity or persona contained within the token corresponding specifically to the originator of 'personal communications', or any signalled communications between a set of parties with identities. A cryptographic signature is defined to protect the integrity of the information used to identify the originator of a personal communications session (e.g. the telephone number or URI) and verify the assertion of the identity information at the destination. The cryptographic signature is defined with the intention that it can confidently verify the originating persona even when the signature is sent to the destination party over an insecure channel. The Persona Assertion Token (PASSporT) is particularly useful for many personal communications applications over IP networks and other multi-hop interconnection scenarios where the originating and destination parties may not have a direct trusted relationship. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-passport-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-passport-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Aug 22 10:58:38 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 951C812D5AD for ; Mon, 22 Aug 2016 10:58:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qI4HraMpeVF7 for ; Mon, 22 Aug 2016 10:58:30 -0700 (PDT) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DBC312D7E1 for ; Mon, 22 Aug 2016 10:58:28 -0700 (PDT) Received: by mail-qk0-x22c.google.com with SMTP id t7so88736460qkh.1 for ; Mon, 22 Aug 2016 10:58:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=mbLV7fUmnfyScOBTUNmiCN2j2EmMV+jK+Ax0rU3F4Es=; b=GT4tSMRHOd1uWNtYf/gySoK5HOuTBevrxf6F8n326wurNN3dgGA2mCzXQ1nLoBvri0 ABTjUTpBs++WmKsaNKh05anSztClDE6VOIn/sAgaOO5eWacC3uNPJpumQISSIK8j+qGX W9PiLcSQwWNNFIQ1w2mJ7lf+8S6KvW6e1yA8SmVGJHVo/Rzp+5E+YxfhZtjqGSsUeRnO mCz/OG0DsTTsHiWWYo2t8LmdCN5OJ96XKeeHTZALKRhvtKgP5oIzXqejp8vgbD7gJuIv mDgk6lGPzcgZUMP0ItuPLDTY3CybV4IFfGUsHdhV7RE3cmvgLWIkxD2CjxPiKyDQ6j/V pyiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=mbLV7fUmnfyScOBTUNmiCN2j2EmMV+jK+Ax0rU3F4Es=; b=VzlOYg/t82rkevEExG1tMT6LTvXsy9aZbBTRo8ZbNpx4coVFWcaehdZpjAURB/H4CO EP+gKIBg9o5EoynIhIoQoRYjNxXaRQDxV9N1cjyXZq7gneJ1qrvti00Cn1QqDypn24Vb BM7bhvoBtZ3y1y8Ov6Qr02vEXGtZmRjiHwOquDuKCTdM5ege/mIl+WuROuLTeLjveHUM hruZLf++3mhyRWRABTGxWm023nabXyzYTUJeNRquJQIXnFUKgYtTKaVqQn9oHQZIt3t7 UcK8sO0FmxiS8J+RGj7XR0sVOddXmGKK3Y6S0z0MAXVoMnjg2mUzBdLEniTvDBJi0gyT EzlQ== X-Gm-Message-State: AE9vXwPFsoVpqoGmEV172v2SJcuTx4lwFSoDUadThpG5qn3Vqj2ALws8wCQrbIfwE13Wdw== X-Received: by 10.55.114.193 with SMTP id n184mr16613518qkc.4.1471888705822; Mon, 22 Aug 2016 10:58:25 -0700 (PDT) Received: from ?IPv6:2607:fb90:1399:97bd:4109:85eb:a89c:c015? ([2607:fb90:1399:97bd:4109:85eb:a89c:c015]) by smtp.gmail.com with ESMTPSA id b142sm11834333qkc.43.2016.08.22.10.58.12 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 22 Aug 2016 10:58:25 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> Date: Mon, 22 Aug 2016 13:58:10 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2016 17:58:36 -0000 Hi Dave, Thanks for the review, and apologize for delay for proper response, i = just got back from vacation on Saturday. i have gone through all of = your comments and will be submitting a new 06 version of passport, just = to make it easier to diff. Many of the comments/ambiguities were related to some relics of how = passport has changed over various revisions, so appreciate the chance to = clean them up. Of course included many clean up of syntax in general, = so good to clean them up as well.=20 There are a couple of places where I left the text the same, and look = for further comment. In addition, some of the reference and more = proceedural stuff i will plan to update in next version. Comments and actions i took are given inline below, but refer to 06 = document for specific changes in text. Again, thanks for detailed comments. -Chris > On Jul 28, 2016, at 1:37 PM, Dave Crocker wrote: >=20 >=20 >=20 > Review of: draft-ietf-stir-passport-05 > Date: 27 July 2016 > Revied by: D. Crocker >=20 >=20 > Summary: >=20 > The 'Persona Assertion Token' specification defines an object = containing > multiple attributes that are intended to be used for authentication, > integrity and non-repudiation, such as validating the originator of a > SIP telephone call. The object is intended to be application- and > transport-independent. In effect, the object links certification = details > to application details and/or transport details. >=20 > Although the text provides details of 'how' to compose a passport = token, > it never actually says what passport is. There are some later comments > that imply what it is, or seem to assume a knowledge of what it is, = but > it's never defined as a technical construct. By way of example, how = does > it differ from the function of an X.509 cert? >=20 > The specification has problems with its explanation of purpose and its > apparent scope, as well as occasional lack of clarity or > correctness. It even has quite a few typographical errors that would > have been trivially detected by a spelling corrector. >=20 > The document was only first produced in February, with 4 revisions in > the last 3 months, including one during Last Call. And the recent > revisions have included quite substantive changes. Discussion about = the > draft on the wg mailing list has been thin. Also, during the wg = session > in Berlin, discussion seemed to include a fair amount of reference to > what 'might' be done -- eg, tailoring use through profiles or encoding > for SIP or... -- rather than clarity about how this specification = would > definitely be used. It suggests the possibility of less stability in > community understanding of the specification than one would wish for = an > IETF proposed standard. >=20 > The document is /not/ ready for publication. >=20 >=20 >=20 > This appears to be a specification for something that is for far more > general use than simply doing caller-id authentication; as such it > appears to go beyond the scope of the working group's charter. This > might be acceptable, if the solution provided adequately covered what > /is/ in scope and were still timely and sufficiently 'efficient'. = However the working group has taken 3 years to produce this work and = there are no other use-cases presented and no other specifications for = use, to justify the purported generality. As such, the generality is = purely theoretical. Worse, there is a poor track-record of such efforts = proving successful at being more general. Instead, they impose the = overhead of generality without the benefit. >=20 > The document is written with the apparent expectation that the reader > has quite a bit of prior knowledge but it isn't stated explicitly. = This > needs to be written for a wider audience than just those already in = the > wg and more than those already familiar with the work. If there are > specific details the reader must know ahead of time, state or cite = them > early and explicitly >=20 > As an example, the document is really built on top of JWT but doesn't > introduce the reference or details about this until section 3. (The > passing reference in section 2 does not explain that JWT is = foundational > to the current work.) >=20 > As to the choice of JWT, it seems odd, since it isn't natural to the = SIP context, which is essential for the chartered work, and therefore = requires an additional layer of translation for use with SIP. >=20 > The document title and the content use the term 'persona' but there is > nothing in this document that pertains to any of the normal, technical > -- or even informal -- uses of the term. So it might be a clever turn = of > phrase, but it appears to be significantly inappropriate, or at least > misleading. (Perhaps the goal is to sustain the unusual choices that = SIP > made, such as with the term 'identity', deviating from usages in the > world of online identity?...) >=20 > The document desperately needs a carefully-written terminology = section. >=20 > The specification is dominated by heavy focus on the details and > mechanisms, without much that covers purposes and functions. The text = is > heavy with redundant acronyms usage, to the point of distraction. > (Imagine specifying http by having every paragraph say that ASCII (or > Unicode or whatever) is being used. Assert packaging-related details > only where needed, rather than feeling that every bit of technical > information must be seasoned with references to JWT, JWS, or whatever. >=20 > Algorithmic details often are specified in non-linear sequence, eg, if = B > do C after doing A and before doing C. This makes it difficult to > acquire an simple understanding of the sequence. Algorithms need to be > presented in as linear a fashion as possible, and preferable include > pseudo-code, to be that much more concise. >=20 > In terms of pragmatics, here are two operational questions that I = can't > answer, based on this specification, and yet they are fundamental to = the > utility of this work. >=20 > How is key rollover done? >=20 > How is delegation done, such as for use by authorized third > parties? >=20 > As an example that the document needs much more careful proofreading, > the terms header and headers appear to be used inconsistently and > possibly incorrectly. >=20 > Also I note that a revision of the draft was posted during Last Call. > This can create confusion or extra work, to reconcile things. =46rom a > quick scan of the revision's diff, it doesn't appear that the changes > affect this review... maybe. >=20 > Also, having a Last Call that overlaps with an IETF meeting is not a > good way to encourage adequate attention to the production of reviews, > although the document really needed them. >=20 >=20 >=20 >=20 >=20 > Detailed Comments > ----------------- >=20 >=20 >> STIR C. = Wendt >> Internet-Draft = Comcast >> Intended status: Standards Track J. = Peterson >> Expires: January 23, 2017 Neustar = Inc. >> July 22, = 2016 >>=20 >>=20 >> Persona Assertion Token >> draft-ietf-stir-passport-05 >>=20 >> Abstract >>=20 >> This document defines a token format for verifying with non- >=20 > [format] remove or remove [token] replied with token object >=20 > Is the timestamp the basis of claiming non-repudiation? Partially, depending on your interpretation of how non-repudiation is = achieved. The digital signature based on a certificate is the = non-repudiation of the original assertion and signing of the token. The = timestamp and including the destination identity adds the ability to = further validate that there wasn=E2=80=99t someone illegitimate that = simply replayed the sending of the token. >=20 >=20 >> repudiation the sender of and authorization to send information >> related to the originator of personal communications. A >=20 > 'info related to'... what does this mean? Yes this was a bit too broad and the abstract text wasn=E2=80=99t = updated when the scope was reduced. replaced with: 'non-repudiation the author of the token, their authority to author the = token and, minimally, the asserted originating identity or persona = contained within the token corresponding specifically to the originator = of personal communications' >=20 >=20 >> cryptographic signature is defined to protect the integrity of the >> information used to identify the originator of a personal >> communications session (e.g. the telephone number or URI) and = verify >> the accuracy of this information at the destination. The >=20 > 'accuracy'? validates authorship, not validity, I suspect. >=20 > A signature's primary purpose usually is authenticate origination, = authorship, or the like, where integrity is a side-effect of the = methodology. Integrity as the primary function would typically occur = only when the identity of the signer need be no more than something like = 'whomever I interacted with previously'. I suspect that such a = session-limited identity semantic is not, in fact, the intent here. replaced with =E2=80=98assertion of the identity information=E2=80=99 >=20 >=20 >> cryptographic signature is defined with the intention that it can >> confidently verify the originating persona even when the signature = is >> sent to the destination party over an unsecure channel. The = Persona >=20 > unsecure -> insecure (unless the intend is reference to a loan?) fixed >=20 >=20 >> Assertion Token (PASSporT) is particularly useful for many personal >> communications applications over IP networks and other multi-hop >> interconnection scenarios where the originating and destination >> parties may not have a direct trusted relationship. >>=20 >> Status of This Memo >>=20 >> This Internet-Draft is submitted in full conformance with the >> provisions of BCP 78 and BCP 79. >>=20 >> Internet-Drafts are working documents of the Internet Engineering >> Task Force (IETF). Note that other groups may also distribute >> working documents as Internet-Drafts. The list of current = Internet- >> Drafts is at http://datatracker.ietf.org/drafts/current/. >>=20 >> Internet-Drafts are draft documents valid for a maximum of six = months >> and may be updated, replaced, or obsoleted by other documents at = any >> time. It is inappropriate to use Internet-Drafts as reference >> material or to cite them other than as "work in progress." >>=20 >> This Internet-Draft will expire on January 23, 2017. >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 1] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> Copyright Notice >>=20 >> Copyright (c) 2016 IETF Trust and the persons identified as the >> document authors. All rights reserved. >>=20 >> This document is subject to BCP 78 and the IETF Trust's Legal >> Provisions Relating to IETF Documents >> (http://trustee.ietf.org/license-info) in effect on the date of >> publication of this document. Please review these documents >> carefully, as they describe your rights and restrictions with = respect >> to this document. Code Components extracted from this document = must >> include Simplified BSD License text as described in Section 4.e of >> the Trust Legal Provisions and are provided without warranty as >> described in the Simplified BSD License. >>=20 >> Table of Contents >>=20 >> 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . = 3 >> 2. Token Overview . . . . . . . . . . . . . . . . . . . . . . . = 4 >> 3. PASSporT Definition . . . . . . . . . . . . . . . . . . . . . = 4 >> 3.1. PASSporT Header . . . . . . . . . . . . . . . . . . . . . = 4 >> 3.1.1. "typ" (Type) Header Parameter . . . . . . . . . . . . = 4 >> 3.1.2. "alg" (Algorithm) Header Parameter . . . . . . . . . = 5 >> 3.1.3. "x5u" (X.509 URL) Header Parameter . . . . . . . . . = 5 >> 3.2. PASSporT Payload . . . . . . . . . . . . . . . . . . . . = 5 >> 3.2.1. JWT defined claims . . . . . . . . . . . . . . . . . = 5 >> 3.2.1.1. "iat" - Issued at claim . . . . . . . . . . . . . = 5 >> 3.2.2. PASSporT specific claims . . . . . . . . . . . . . . = 6 >> 3.2.2.1. Originating and Destination Identity Claims . . . = 6 >> 3.2.2.2. "mky" - Media Key claim . . . . . . . . . . . . . = 7 >> 3.3. PASSporT Signature . . . . . . . . . . . . . . . . . . . = 8 >> 4. Extending PASSporT . . . . . . . . . . . . . . . . . . . . . = 8 >> 4.1. "ppt" (PASSporT) header parameter . . . . . . . . . . . . = 8 >> 4.2. Extended PASSporT Claims . . . . . . . . . . . . . . . . = 9 >> 5. Deterministic JSON Serialization . . . . . . . . . . . . . . = 9 >> 5.1. Example PASSport deterministic JSON form . . . . . . . . = 10 >> 6. Human Readability . . . . . . . . . . . . . . . . . . . . . . = 10 >> 7. Security Considerations . . . . . . . . . . . . . . . . . . . = 10 >> 7.1. Avoidance of replay and cut and paste attacks . . . . . . = 10 >> 7.2. Solution Considerations . . . . . . . . . . . . . . . . . = 11 >> 7.3. Privacy Considerations . . . . . . . . . . . . . . . . . = 11 >> 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . = 11 >> 8.1. Media Type Registration . . . . . . . . . . . . . . . . . = 11 >> 8.1.1. Media Type Registry Contents Additions Requested . . = 11 >> 8.2. JSON Web Token Claims Registration . . . . . . . . . . . = 13 >> 8.2.1. Registry Contents Additions Requested . . . . . . . . = 13 >> 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . = 13 >> 10. References . . . . . . . . . . . . . . . . . . . . . . . . . = 13 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 2] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 10.1. Normative References . . . . . . . . . . . . . . . . . . = 14 >> 10.2. Informative References . . . . . . . . . . . . . . . . . = 14 >> Appendix A. Example PASSporT JWS Serialization and Signature . . = 15 >> A.1. X.509 Private Key Certificate for Example . . . . . . . . = 16 >> A.2. X.509 Public Key Certificate for Example . . . . . . . . = 17 >> Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . = 17 >>=20 >> 1. Introduction >>=20 >> In today's IP-enabled telecommunications world, there is a growing >> concern about the ability to trust incoming invitations for >> communications sessions, including video, voice and messaging. >> [RFC7340] As an example, modern telephone networks provide the >> ability to spoof the calling party telephone number for many >> legitimate purposes including providing network features and = services >> on the behalf of a legitimate telephone number. However, as we = have >> seen, bad actors have taken advantage of this ability for >> illegitimate and fraudulent purposes meant to trick telephone users >> to believe they are someone they are not. This problem can be >> extended to many emerging forms of personal communications. >>=20 >> This document defines a common method for creating and validating a >=20 > [common] delete fixed >=20 >=20 >> token that cryptographically verifies an originating identity, or >> more generally a URI or application specific identity string >=20 > 'identity string'? what does this mean? >=20 > 'app string id'? what does this mean? Removed and replaced with 'URI or telephone number' >=20 >=20 >> representing the originator of personal communications. Through >> extended profiles other information relevant to the personal >> communications can also be attached to the token. The primary goal >> of PASSporT is to provide a common framework for signing persona >=20 > What is a 'persona'? Where is this construct introduced or cited and = explained? =E2=80=98persona=E2=80=99 replaced with 'originating identity' >=20 > 'profiles'? Where is this construct introduced or cited and = explained? replaced with 'Through extensions defined in this document' >=20 >=20 >> related information in an extensible way. A secondary goal is to >=20 > It seems to also be primary. >=20 > (PPT provides a framework for signing related information) ? >=20 >=20 >> provide this functionality independent of any specific personal >> communications signaling call logic, so that creation and >> verification of persona information can be implemented in a = flexible >> way and can be used in many personal communications applications >> including end-to-end applications that require different signaling >> protocols. It is anticipated that signaling protocol specific >> guidance will be provided in other related documents and >> specifications to specify how to use and transport PASSporT tokens, >=20 > specs to spec... awkward phrasing >=20 > as always, a specification that declares what is 'anticipated' moves = into purely hypothetical, which too-often proves to be wishful fantasy. = The reference doesn't specify anything and it creates a dependency that = well might not be satisfied. >=20 > 'tokens'? Where is this constructed introduced, cited or explained? = Use of a term like this implies that there is some distinctive meaning, = but really there isn't. This is a format specification. That's all. >=20 > If there is a claim that the term token does have significance here, = then please explain it. For example, how is this token to be used? >=20 > If the term is used merely as an inheritance from JWT, then cite that = early, to justify the term. Cleaned up phrasing and defined tokens. >=20 >=20 >> however this is intentionally out of scope for this document. >>=20 >> Note: As of the authoring of this document, >> [I-D.ietf-stir-rfc4474bis] provides details of how to use PASSporT >> within SIP signaling for the signing and verification of telephone >> numbers. >=20 > remove Note. Or make it a note to RFC Editor to remove it, or = rephrase so it's useful 10 years from now. Would probably like a reference here, don=E2=80=99t want to just remove. >=20 >=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 3] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 2. Token Overview >>=20 >> Tokens are a convenient way of encapsulating information with >=20 > Why? What are the alternatives? Why is this the starting point? >=20 >=20 >> associated digital signatures. They are used in many applications >=20 > Such as? >=20 > Anyhow, this section seems to take the construct of 'token' as being = an established term of art. It isn't. Or, at least, I've no idea what = is meant here that distinguishes a token from anything else, such as = other forms of encapsulation. Say/cite what a token is, if it is such a = distinctive thing. Say/cite how it differs from alternatives, if its = superiority is going to be touted. >=20 >=20 >> that require authentication, authorization, encryption, non- >> repudiation and other use cases. JSON Web Token (JWT) [RFC7519] = and >> JSON Web Signature (JWS) [RFC7515] are designed to provide a = compact >> form for many of these purposes and define a specific method and >> syntax for signing a specific set of information or "claims" within >> the token and therefore providing an extensible set of claims. >> Additionally, JWS provides extensible mechanisms for specifying the >> method and cryptographic algorithms used for the associated digital >> signatures. >=20 > Note that there is nothing in the above text that actually explains = what a token is or how it differs from things that aren't tokens. I would challenge the fact that =E2=80=98token=E2=80=99 is a term of = art, but i suppose maybe it depends on what crowd you run with. In = either case, I defined it as a canonical string object at the beginning = of the document. >=20 >=20 >> 3. PASSporT Definition >=20 > This section is not a definition. It's more like structure, or = format, or foundation or encoding. =E2=80=98Passport Components' >=20 >=20 >> The PASSporT is constructed based on JWT [RFC7519] and JWS = [RFC7515] >> specifications. JWS defines the use of JSON data structures in a >> specified canonical format for signing data corresponding to JOSE >> header, JWS Payload, and JWS Signature. JWT defines specific set = of >=20 > specific set -> a set fixed >=20 >=20 >> claims that are represented by specified key value pairs which can = be >> extended with custom keys for specific applications. >>=20 >> 3.1. PASSporT Header >>=20 >> The JWS token header is a JOSE header [RFC7515] that defines the = type >> and encryption algorithm used in the token. >=20 > The section starts with structure detail and ends with purpose. This = should be swapped. swapped example and added some text to preface the header parameters >=20 >=20 >> An example of the header for the case of an ECDSA P-256 digital >> signature would be the following, >=20 > How is reader to know what that long string means? Is the doc only for > the cognoscenti? if so, which cognoscenti? removed cognoscenti terms >=20 >=20 >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >=20 > *** EXPLAIN EXAMPLES, PLEASE *** >=20 >=20 >> 3.1.1. "typ" (Type) Header Parameter >>=20 >> JWS defines the "typ" (Type) Header Parameter to declare the media >> type of the JWS. >=20 > media type? IANA citation needed. (It was in an earlier version of = the draft!) was guided to remove it >=20 >=20 >> For PASSporT Token the "typ" header MUST minimally include and = begin >> with "passport". This represents that the encoded token is a JWT = of >> type passport. >=20 > Is it possible to begin with it and not include it? That is, = 'include' is redundant. 'minimally' is also not information, but it = raises the question: The other two attributes aren't required??? Yes, missed this in last edits, fixed it to only be =E2=80=9Cpassport=E2=80= =9D no other option. >=20 > Also, this subsection is part of an Overview. Why does it have = normative content? Or is this not really an overview? >=20 not part of overview, overview is section 2 >=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 4] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 3.1.2. "alg" (Algorithm) Header Parameter >>=20 >> For PASSporT, the "alg" should be defined as follows, for the >> creation and verification of PASSporT tokens and their digital >> signatures ES256 MUST be implemented. >>=20 >> Note that JWA [RFC7518] defines other algorithms that may be = utilized >> or updated in the future depending on cryptographic strength >> requirements guided by current security best practice. >>=20 >> 3.1.3. "x5u" (X.509 URL) Header Parameter >>=20 >> As defined in JWS, the "x5u" header parameter is used to provide a >> URI [RFC3986] referring to the resource for the X.509 public key >> certificate or certificate chain [RFC5280] corresponding to the key >=20 > So this service uses a classic X.509 authentication hierarchy? That's = a key design point, only mentioned in a third-level section. clarified this in overview >=20 >=20 >> used to digitally sign the JWS. Note: The definition of what the = URI >> represents in terms of the actor serving the X.509 public key is = out >=20 > 'actor serving the X.509 public key' ? what does that mean? removed >=20 >=20 >> of scope of this document. However, generally this would = correspond >> to an HTTPS or DNSSEC resource with the guidance that it MUST be a >=20 > [a] remove fixed >=20 >=20 >> TLS protected, per JWS spec. >=20 > This /object/ specification (that is transport independent) dictates = /transport/ security??? This is probably wrong, but at least needs = careful explanation. >=20 This is mostly a comment towards security consideration recommendation. = I could remove the comment if it=E2=80=99s bothering folks. >=20 >>=20 >> 3.2. PASSporT Payload >>=20 >> The token payload claims should consist of the information which >=20 > [payload] remove; at best it's redundant >=20 > 'should'? not MUST? why? fixed >=20 >> needs to be verified at the destination party. This claim should >> correspond to a JWT claim [RFC7519] and be encoded as defined by = the >> JWS Payload [RFC7515] >=20 > should? why >=20 > correspond??? what does that mean, in technical terms? fixed to be follows the definition of a JWT claim >=20 >=20 >> The PASSporT defines the use of a number of standard JWT defined >=20 > "The PASSporT" is an affectation. Both the 'the' and the use of case. fixed >=20 >=20 >> headers as well as two new custom headers corresponding to the two >=20 > header/s/? >=20 > corresponding? referring? describing? identifying? addressing? fixed >=20 >=20 >> parties associated with personal communications, the originator and >> terminator. These headers or key value pairs are detailed below. >=20 > These headers or key value pairs are -> This information is >=20 fixed >=20 >> Key values outside the US-ASCII range should be encoded using = percent >> encoding as described in section 2.1 of RFC 3986, case normalized = as >> described in 6.2.2.1 of [RFC3986]. Matching of these values should >> use string exact match. >>=20 >> 3.2.1. JWT defined claims >=20 > When something like this is imported from another spec, there needs to > be a precise pointer to the specific part of the spec defining it. This was the text provided by Ted based on discussion in Berlin, but = beyond that i=E2=80=99m not seeing what isn=E2=80=99t specific enough. >=20 >=20 >> 3.2.1.1. "iat" - Issued at claim >>=20 >> The JSON claim MUST include the "iat" [RFC7519] defined claim = issued >> at. As defined this should be set to a date cooresponding to the >=20 > issued at -> "Issued At". >=20 > It would be better to explicitly cite section 4.1.6 in that RFC. = Readers should not have to search an entire document to find the detail = being referenced. fixed >=20 > Also, note the MUST here. I suspect this conflicts with the normative = language above in the 'overview=E2=80=99. I believe i resolved this. >=20 >=20 >> origination of the personal communications. The time value should = be >> of the format defined in [RFC7519] Section 2 NumericDate. This is >> included for securing the token against replay and cut and paste >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 5] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> attacks, as explained further in the security considerations in >> section 7. >>=20 >> 3.2.2. PASSporT specific claims >>=20 >> 3.2.2.1. Originating and Destination Identity Claims >>=20 >> Baseline PASSporT defines claims that convey the identity of the >=20 > "Baseline PASSporT defines claims" ? First reference in a 4th-level = section??? Removed baseline >=20 >=20 >> origination and destination of personal communications. There are >=20 > 'personal'? so this can't be used by and between companies? Really, = there is nothing about any of this that pertains to the type of users or = even the content of the communication. defined =E2=80=98personal communications' >=20 > What is the exact definition or origination and destination? For = example, there is an important distinction between the person making a = call vs. the device they are using, versus the provider they are going = through. Which is meant here and how is the reader to know? (cf, call = for a terminology section.) we don=E2=80=99t want to make the distinction here, it=E2=80=99s only = about the identity, URI or TN. whether device or network. we don=E2=80=99= t want to predetermine what the end to end architecture is, this is = protocol only. >=20 >=20 >> two claims that are required for PASSporT, the "orig" and "dest" >> claims. Both "orig" and "dest" should have values that are JSON >> objects that include identities represented by key value pairs, = where >=20 > 'key value pairs' aren't 'claims'? >=20 > should and not must? why? >=20 changed to MUST and clarified >=20 >> the key represents an identity type and the value is the identity >> string. Currently, these identities can be represented as either >=20 > So, there is expectation of other types? There needs to be a pointer = to an IANA registry. we do have IANA request for these types, will add text once i figure out = how to point to that >=20 >=20 >> telephone numbers or Uniform Resource Indicators (URIs). The >> definition of how telephone numbers or URIs and examples are = provided >> below. >>=20 >> The "orig" JSON object MUST only have one key value pair = representing >> the asserted identity of any type (currently either "tn" or "uri") = of >> the originator of the personal communications signaling. >>=20 >> The "dest" JSON object MUST have at least have one key value pair, >> but could have multiple identity types (i.e. "tn" and/or "uri") but >> only one of each. Additionaly, in the case of "dest" only, the >> identity type key value MUST be an array signaled by standard JSON >> brackets, even when there is a single identity value in the = identity >> type key value. >>=20 >> 3.2.2.1.1. "tn" - Telephone Number identity >=20 > A document that uses five-levels of section numbering warrants = reconsideration of its structure. fair point, looking for suggestion >=20 >=20 >>=20 >> If the originating or destination identity is a telephone number, = the >> key representing the identity should be "tn". >=20 > should and not must??? why? fixed >=20 >=20 >> Telephone Number strings for "tn" MUST be canonicalized according = to >> the procedures specified in [I-D.ietf-stir-rfc4474bis] Section 7.2. >=20 > Actually, this dependency on 4474bis seems odd. >=20 > Given that the phone number construct is at the core of the work here = and this is the essential data object, and this object is presumably = intended for use outside of 4474bis, I'd expect that canonicalization = algorithm to be here. >=20 > If 4474 needs to cite/use the algorithm, it can cite here, which it = already will have to do. There is no other normative use of 4474 in = this document. >=20 needs discussion >=20 >=20 >> 3.2.2.1.2. "uri" - URI identity >>=20 >> If any of the originating or destination identities is of the form >> URI, as defined in [RFC3986], the key representing the identity >> should be "uri" URI form of the identity. >=20 > should and not must? why? fixed >=20 >=20 >> 3.2.2.1.3. Future identity forms >>=20 >> We recognize that in the future there may be other standard >> mechanisms for representing identities. The "orig" and "dest" JSON >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 6] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> objects with "tn" and "uri" allow for other identity types with >> unique keys to represent these forms. >=20 > Recognition is dandy, but where is the specification detail to support = the extensibility? clarified text >=20 >=20 >> 3.2.2.1.4. Examples >=20 > *** Explain these examples, so they aren't merely syntax detail *** >=20 >=20 >> Single Originator to Single Destination example: >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> Single Originator to Multiple Destination Identities example: >>=20 >> { >> "dest":{ >> "tn":["12125551212"], >> "uri":["sip:alice@example.com", >> "sip:bob@example.net"] >> }, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> 3.2.2.2. "mky" - Media Key claim >>=20 >> Some protocols that use PASSporT convey hashes for media security >> keys within their signaling in order to bind those keys to the >> identities established in the signaling layers. One example would = be >> the DTLS-SRTP key fingerprints carried in SDP via the = "a=3Dfingerprint" >> attribute; multiple instances of that fingerprint may appear in a >> single SDP body corresponding to difference media streams offered. >=20 > difference -> different? >=20 > The above text belongs elsewhere, explaining the overall set of = capabilities, use cases, and the like In a definitions section like = this, focus on definitions, not discussions about use. >=20 > First use of 'SDP', with no explanation of its meaning. Added citation >=20 > 'DTLS-SRTP' citation? >=20 > And again, how does this citation slip into a transport-independent = object signing spec? Meant to be a useful/likely used example. >=20 >=20 >=20 >> The "mky" value of PASSporT contains a hexadecimal key presentation >> of any hash(es) necessary to establish media security via = DTLS-SRTP. >> This mky value should be formated in a JSON form including the = 'alg' >> and 'dig' keys with the corresponding algorithm and hexadecimal >> values. Note that per guidance of Section 5 of this document any >> whitespace and line feeds must be removed. If there is multiple >=20 > forward pointer. Sometimes these are necessary, but in general they = impede reading comprehension. >=20 > Redundant specification. Saying here something that is also specified = elsewhere in the document invites divergence in reader understanding. = Cite, perhaps, but do /not/ summarize. >=20 > Is all of this summary? Anything new here? The reader can't tell. >=20 > "If there is multiple fingerprint values, more than one,"? huh? >=20 > Where do 'dig' and 'alg' come from? They are not explicitly = introduced, even with a citation. clarified >=20 >=20 >> fingerprint values, more than one, the fingerprint values should be >=20 > should and not must? why? fixed >=20 >=20 >> constructed as a JSON array denoted by bracket characters. For the >> 'dig' key value, the hash value should be the hexadecimal value >> without any colons, in order to provide a more efficient, compact >> form to be encoded in PASSporT token claim. >=20 > "in order to provide a more efficient, compact form" is marketing = language. It invites debate while offering no useful technical = substance. removed >=20 >=20 >> An example claim with "mky" claim is as follows: >>=20 >> For an SDP offer that includes the following fingerprint values, >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 7] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> a=3Dfingerprint:sha-256 02:1A:CC:54:27:AB:EB:9C:53:3F:3E:4B:65: >> 2E:7D:46:3F:54:42:CD:54:F1:7A:03:A2:7D:F9:B0:7F:46:19:B2 >> a=3Dfingerprint:sha-256 4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E: >> 5D:49:6B:19:E5:7C:AB:3E:4B:65:2E:7D:46:3F:54:42:CD:54:F1 >>=20 >> the PASSporT Payload object would be: >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "mky":[ >> { >> "alg":"sha-256", >> "dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442CD54 >> F17A03A27DF9B07F4619B2" >> }, >> { >> "alg":"sha-256", >> "dig":"4AADB9B13F82183B540212DF3E5D496B19E57C >> AB3E4B652E7D463F5442CD54F1" >> } >> ], >> "orig":{"tn":"12155551212"} >> } >>=20 >> 3.3. PASSporT Signature >>=20 >> The signature of the PASSporT is created as specified by JWS using >> the private key corresponding to the X.509 public key certificate >> referenced by the "x5u" header parameter. >=20 > 'corresponding to' vs. 'included in=E2=80=99? corresponding to, public key vs. private key >=20 >=20 >> 4. Extending PASSporT >>=20 >> PASSporT represents the bare minimum set of claims needed to assert >=20 > represents vs. is or has? >=20 > (FWIW, this isn't quibbling. It is an example of the difference = between regular prose writing and direct, specification language.) changed to includes >=20 >=20 >> the originating identity and support the secure propoerties = discussed >> in various parts of this document, however there will certainly be >> both new uses and ways of extending the application and usage of >> PASSPorT that requires the ability to extend the defined base set = of >> claims to represent other information requiring assertion or >> validation beyond the identity itself. >=20 > there's that 'certainly' again and this time it's predicting the = future. > tsk. don't do that. also, new and extended tends towards redundancy, = as > does the entire sentence's structure. I think the technical statement = is: >=20 > Passport can be extended to support additional claims. >=20 > If you want to get really flowery, you might 'as needed' at the end=E2=80= =A6 I re-wrote the last sentence here and included 'as needed=E2=80=99 just = for the ability to be =E2=80=9Cflowery=E2=80=9D ;) >=20 >=20 >> 4.1. "ppt" (PASSporT) header parameter >>=20 >> For the extension of the base set of claims defined in this = document, >=20 > For the -> For fixed >=20 >=20 >> a new JWS header parameter "ppt" MUST be used with a string that >> uniquely identifies and points to a profile specification that >> defines any new claims that would extend the base set of claims of >> PASSporT. >=20 > extension =3D=3D profile ?? >=20 > What is a profile of Passport? Where is this defined? >=20 > ('jws header parameter'.) >=20 > What is the purpose of a profile and a profile label? How is it used? >=20 >=20 > 'identifies and points to'? what does points to mean? clarified this text >=20 >=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 8] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> An example header with an extended PASSporT profile of "foo" is as >=20 > profile of -> profile name changed to PASSporT extension >=20 >=20 >> follows: >>=20 >> { >> "alg":"ES256", >> "ppt":"foo", >> "typ":"passport", >> "x5u":"https://tel.example.org/passport.cer" >> } >>=20 >> 4.2. Extended PASSporT Claims >>=20 >> Future specifications that define such extensions to the PASSporT >=20 > [Future] remove >=20 > [such] remove. there's no context for it. removed=20 >=20 >=20 >> mechanism MUST explicitly designate what claims they include beyond >=20 > designate -> specify (it's defining, not appointing) fixed >=20 >=20 >> the base set of claims from this document, the order in which they >> will appear, and any further information necessary to implement the >> extension. All extensions MUST incorporate the baseline JWT = elements >> specified in Section 3; claims may only be appended to the claims >=20 > If all extensions include the baseline, then 'must incorporate' is an = odd way to say that changed to include >=20 > This seems best and first handled by earlier in the spec, by providing = a syntax (and text) that shows the base set and then an optional = extended set. With that setup, it is clear that extensions are always = /in addition to/ the base. JSON sort of provides this capability inherently, so would prefer to = keep it simple rather than adding more protocol. >=20 >=20 >> object specified; they can never be subtracted or re-ordered. >=20 > What does it mean to be subtracted? Perhaps 'removed'? Or are they = subject to arithmetic modification? changed to removed, it=E2=80=99s simply just new key value pairs, no = manipulation of values. >=20 >=20 >> Specifying new claims follows the baseline JWT procedures = ([RFC7519] >> Section 10.1). Note that understanding an extension as a verifier = is >> always optional for compliance with this specification (though = future >=20 > That's not a 'note'; that's a fundamental construct. It needs to be = stated much earlier and much more distinctly and as an explicitly = normative assertion. >=20 > Also, this seems to be the first reference to the verifier! >=20 > Also we need a description of the handling of a passport object in = terms of creation and consumption.) modified and clarified >=20 >=20 >> specifications or profiles for deployment environments may make = other >> "ppt" values mandatory). The creator of a PASSporT object cannot >> assume that verifiers will understand any given extension. = Verifiers >> that do support an extension may then trigger appropriate >> application-level behavior in the presence of an extension; authors >> of extensions should provide appropriate extension-specific = guidance >> to application developers on this point. >>=20 >> 5. Deterministic JSON Serialization >>=20 >> In order to provide a deterministic representation of the PASSporT >> Header and Claims, particularly if PASSporT is used across multiple >> signaling environments, the JSON header object and JSON Claim = object >> MUST be computed as follows. >=20 > The implication that there can be non-deterministic representations is > pretty odd and at least needs explanation, assuming the issue is real. JSON as a canonical format can include spaces and line breaks, etc and = make it, from a string format non-deterministic. We are simply defining a method of authoring JSON deterministically. In either case, i clarified the message here. >=20 >=20 >> The JSON object MUST follow the rules for the construction of the >> thumbprint of a JSON Web Key (JWK) as defined in [RFC7638] Section = 3. >> Each JSON object MUST contain no whitespace or line breaks before = or >> after any syntactic elements and with the required members ordered >> lexicographically by the Unicode [UNICODE] code points of the = member >> names. >=20 > mumble. ? >=20 >=20 >> In addition, the JSON header and claim members MUST follow the >> lexicographical ordering and character and string rules defined in >> [RFC7638] Section 3.3. >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 9] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 5.1. Example PASSport deterministic JSON form >>=20 >> For the example PASSporT Payload shown in Section 3.2.2.2, the >> following is the deterministic JSON object form. >>=20 >> {"dest":{"uri":["sip:alice@example.com"],"iat": = 1443208345,"mky" >> = :[{"alg":"sha-256","dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442 >> = CD54F17A03A27DF9B07F4619B2"},{"alg":"sha-256","dig":"4AADB9B13F8 >> 2183B540212DF3E5D496B19E57CAB3E4B652E7D463F5442CD54F1"}], >> "orig":{"tn":"12155551212"}} >=20 > Perhaps explain the steps followed to produce this? Perhaps show the > intermediate forms? >=20 will discuss the need for more explicit instructions, to me, it=E2=80=99s = following the spec, but could improve if folks think it=E2=80=99s = necessary. >=20 >=20 >> 6. Human Readability >>=20 >> JWT [RFC7519] and JWS [RFC7515] are defined to use Base64 and/or = UTF8 >> encoding to the Header, Payload, and Signature sections. However, >> many personal communications protocols, such as SIP and XMPP, use a >> "human readable" format to allow for ease of use and ease of >=20 > And email and FTP and HTTP and... >=20 > Actually the use of the form has nothing to do with the purpose of the > application. As noted, it merely makes debugging and monitoring = easier. >=20 >=20 >> operational debugging and monitoring. As such, specifications = using >> PASSporT may provide guidance on whether Base64 encoding or plain >> text will be used for the construction of the PASSporT Header and >> Claim sections. >=20 > The section is mislabeled and probably out of scope. It's trying to = say > there there can be alternative encodings of this json object and that > this spec won't prohibit that happening by other specs. >=20 > In all likelihood, this section should be removed. It doesn't specify > anything. removed >=20 >=20 >> 7. Security Considerations >>=20 >> 7.1. Avoidance of replay and cut and paste attacks >>=20 >> There are a number of security considerations for use of the token >=20 > I suspect they are not 'security considerations' as much as = 'mechanisms' or 'provisions' >=20 >=20 >> for avoidance of replay and cut and paste attacks. PASSporT tokens >> must be sent along with other application level protocol = information >=20 > Huh? You are trying to dictate application-level transport behavior? >=20 > This smacks of layer/scoping violation. changed to should and removed along, but don=E2=80=99t want to remove = this consideration. >=20 >=20 >> (e.g. for SIP an INVITE as defined in [RFC3261]). There should be = a >> link between various information provided in the token and >> information provided by the application level protocol information. >=20 > Why? explained >=20 >=20 >> These would include: >>=20 >> o "iat" claim should closely correspond to a date/time the message >=20 > The semantics of iat are defined earlier. Either there is compliance = or > there isn't. The discussion here, therefore, should probably say > something like "a valid iat claim aids in detecting re-use at a later = time.=E2=80=9D i am explaining the =E2=80=98why=E2=80=99 here, added a sentence about = validation and correlation to network time variances. >=20 >=20 >> was originated. It should also be within a relative delta time >=20 > What is a delta time? How is the reader to know? Where is it = defined? I suspect what is meant is that it's deviation from time of = origination should be small. If this has a more precise technical = definition, then cite it. removed delta >=20 >=20 >> that is reasonable for clock drift and transmission time >> characteristics associated with the application using the = PASSporT >> token. > > >> o "dest" claim is included to prevent the ability to use a >> previously originated message to send to another destination = party >=20 > the ability to -> using (or use of) fixed with =E2=80=98valid re-use' >=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 10] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 7.2. Solution Considerations >>=20 >> It should be recognized that the use of this token should not, in >> it's own right, be considered a full solution for absolute non- >> repudiation of the persona being asserted. This only provides non- >> repudiation of the signer of PASSporT. If the signer and the = persona >=20 > huh? So the originator isn't really being validated, as claimed??? This is only a statement to recognize that you are only trusting the = signer and certificate owner to tell the truth about the originating = identity. If you are familiar with how certificates work, this is an = obvious statement, but just a word of consideration. >=20 >=20 >> are not one in the same, which can and often will be the case in >> telecommunications networks today, protecting the destination party >> from being spoofed may take some interpretation or additional >> verification of the link between the PASSporT signature and the >> persona being asserted. >>=20 >> In addition, the telecommunications systems and specifications that >> use PASSporT should in practice provide mechanisms for: >>=20 >> o Managing X.509 certificates and X.509 certificate chains to an >> authorized trust anchor that can be a trusted entity to all >> participants in the telecommunications network >=20 > Touching this sort of topic is, at the very best, redundant with > specifications devoted to X.509. Just cite them and don't attempt to > repeat them. I see this as helpful, we can discuss if it=E2=80=99s not needed, but I = recall being asked by working group to include text to inform the = reader. >=20 >=20 >> o Accounting for entities that may route calls from other peer or >> interconnected telecommunications networks that are not part of >> the "trusted" communications network or may not be following the >> usage of PASSporT or the profile of PASSporT appropriate to that >> network >=20 > Passport doesn't do calls. Dictating activity involving calls is out = of scope. >=20 > On the other hand, perhaps this qualifies for a discussion about = transferring passport objects across administrative (trust) domain = boundaries? >=20 > At best, this section seems to be trying to compensate for the lack of = a framework discussion about the problem domain and the practical uses = of the various specifications being produced. similar to above comment, this is meant to be a cautionary statement and = something to consider if you are an implementer. If you understand the = limits of what X.509 based certificate signing and PKI can represent in = terms of trust, these are obvious statements, but I think it=E2=80=99s = good to include none-the-less. >=20 >=20 >> o Following best practices around management and security of X.509 >> certificates >=20 > cf, above, about redundancies. Perhaps this is the bullet that should > remain, while deleting the other one? same comment as above. >=20 >=20 >> 7.3. Privacy Considerations >>=20 >> Because PASSporT explicity includes claims of identitifiers of >=20 > explicity -> explicitly >=20 > identitifiers -> identifiers >=20 >=20 >> parties involved in communications, times, and potentially other = call >> detail, care should be taken outside of traditional protected or >> private telephony communications paths where there may be concerns >> about exposing information to either unintended or illegitimately >> intented actors. These identifiers are often exposed through many >> communications signaling protocols as of today, but appropriate >> precautions should be taken. >=20 > intented -> intended >=20 >=20 > awk. >=20 > Illegitimately intended? What does that mean? changed to illegitimate >=20 > More fundamentally it isn't clear to me what this is really saying. pure cautionary/disclaimer text that potential privacy information could = be exposed, user beware. >=20 >=20 >> 8. IANA Considerations >=20 > This section just sits here, uncited anywhere else in the document? = Each item specified should be referenced in the body of the main = specification, with a pointer into this section. ok, need to investigate proper way to do that >=20 >=20 >> 8.1. Media Type Registration >>=20 >> 8.1.1. Media Type Registry Contents Additions Requested >>=20 >> This section registers the "application/passport" media type >> [RFC2046] in the "Media Types" registry in the manner described in >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 11] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> [RFC6838], which can be used to indicate that the content is a >> PASSporT defined JWT and JWS. >>=20 >> o Type name: application >>=20 >> o Subtype name: passport >>=20 >> o Required parameters: n/a >>=20 >> o Optional parameters: n/a >>=20 >> o Encoding considerations: 8bit; application/passport values = outside >> the US-ASCII range are encoded using percent encoding as = described >> in section 2.1 of RFC 3986 (some values may be the empty = string), >> each separated from the next by a single period ('.') character. >>=20 >> o Security considerations: See the Security Considerations section >> of RFC 7515. >>=20 >> o Interoperability considerations: n/a >>=20 >> o Published specification: draft-ietf-stir-passport-05 >>=20 >> o Applications that use this media type: STIR and other = applications >> that require identity related assertion >>=20 >> o Fragment identifier considerations: n/a >>=20 >> o Additional information: >>=20 >> * Magic number(s): n/a >>=20 >> * File extension(s): n/a >>=20 >> * Macintosh file type code(s): n/a >>=20 >> o Person and email address to contact for further information: = Chris >> Wendt, chris-ietf@chriswendt.net >>=20 >> o Intended usage: COMMON >>=20 >> o Restrictions on usage: none >>=20 >> o Author: Chris Wendt, chris-ietf@chriswendt.net >>=20 >> o Change Controller: IESG >>=20 >> o Provisional registration? No >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 12] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 8.2. JSON Web Token Claims Registration >>=20 >> 8.2.1. Registry Contents Additions Requested >>=20 >> o Claim Name: "orig" >>=20 >> o Claim Description: Originating Identity String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> o Claim Name: "dest" >>=20 >> o Claim Description: Destination Identity String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> o Claim Name: "mky" >>=20 >> o Claim Description: Media Key Fingerprint String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> 9. Acknowledgements >>=20 >> Particular thanks to members of the ATIS and SIP Forum NNI Task = Group >> including Jim McEchern, Martin Dolly, Richard Shockey, John = Barnhill, >> Christer Holmberg, Victor Pascual Avila, Mary Barnes, Eric Burger = for >> their review, ideas, and contributions also thanks to Henning >> Schulzrinne, Russ Housley, Alan Johnston, Richard Barnes, Mark >> Miller, and Ted Hardie for valuable feedback on the technical and >> security aspects of the document. Additional thanks to Harsha = Bellur >> for assistance in coding the example tokens. >>=20 >> 10. References >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 13] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 10.1. Normative References >>=20 >> [I-D.ietf-stir-rfc4474bis] >> Peterson, J., Jennings, C., Rescorla, E., and C. Wendt, >> "Authenticated Identity Management in the Session >> Initiation Protocol (SIP)", = draft-ietf-stir-rfc4474bis-10 >> (work in progress), July 2016. >>=20 >> [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail >> Extensions (MIME) Part Two: Media Types", RFC 2046, >> DOI 10.17487/RFC2046, November 1996, >> . >>=20 >> [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform >> Resource Identifier (URI): Generic Syntax", STD 66, >> RFC 3986, DOI 10.17487/RFC3986, January 2005, >> . >>=20 >> [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type >> Specifications and Registration Procedures", BCP 13, >> RFC 6838, DOI 10.17487/RFC6838, January 2013, >> . >>=20 >> [RFC7515] Jones, M., Bradley, J., and N. Sakimura, "JSON Web >> Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May >> 2015, . >>=20 >> [RFC7518] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, >> DOI 10.17487/RFC7518, May 2015, >> . >>=20 >> [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token >> (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, >> . >>=20 >> [RFC7638] Jones, M. and N. Sakimura, "JSON Web Key (JWK) >> Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September >> 2015, . >>=20 >> [UNICODE] "The Unicode Consortium, "The Unicode Standard"", >> . >>=20 >> 10.2. Informative References >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 14] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, >> A., Peterson, J., Sparks, R., Handley, M., and E. >> Schooler, "SIP: Session Initiation Protocol", RFC 3261, >> DOI 10.17487/RFC3261, June 2002, >> . >>=20 >> [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., >> Housley, R., and W. Polk, "Internet X.509 Public Key >> Infrastructure Certificate and Certificate Revocation = List >> (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May = 2008, >> . >>=20 >> [RFC7340] Peterson, J., Schulzrinne, H., and H. Tschofenig, = "Secure >> Telephone Identity Problem Statement and Requirements", >> RFC 7340, DOI 10.17487/RFC7340, September 2014, >> . >>=20 >> Appendix A. Example PASSporT JWS Serialization and Signature >>=20 >> For PASSporT, there will always be a JWS with the following = members: >>=20 >> o "protected", with the value BASE64URL(UTF8(JWS Protected = Header)) >>=20 >> o "payload", with the value BASE64URL (JWS Payload) >>=20 >> o "signature", with the value BASE64URL(JWS Signature) >>=20 >> Note: there will never be a JWS Unprotected Header for PASSporT. >>=20 >> First, an example PASSporT Protected Header is as follows: >>=20 >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >>=20 >> This would be serialized to the form: >>=20 >> = {"alg":"ES256","typ":"passport","x5u":"https://cert.example.org/ >> passport.cer"} >>=20 >> Encoding this with UTF8 and BASE64 encoding produces this value: >>=20 >> = eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9j >> ZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >>=20 >> Second, an example PASSporT Payload is as follows: >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 15] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]} >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> This would be serialized to the form: >>=20 >> {"dest":{"uri":["sip:alice@example.com"]},"iat":"1443208345", >> "orig":{"tn":"12155551212"}} >>=20 >> Encoding this with the UTF8 and BASE64 encoding produces this = value: >>=20 >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >>=20 >> Computing the digital signature of the PASSporT Signing Input >> ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' || BASE64URL(JWS >> Payload)) >>=20 >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >>=20 >> The final PASSporT token is produced by concatenating the values in >> the order Header.Payload.Signature with period (',') characters. = For >> the above example values this would produce the following: >>=20 >> eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly >> 9jZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >> . >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >> . >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >>=20 >> A.1. X.509 Private Key Certificate for Example >>=20 >> -----BEGIN EC PRIVATE KEY----- >> = MHcCAQEEIFeZ1R208QCvcu5GuYyMfG4W7sH4m99/7eHSDLpdYllFoAoGCCqGSM49 >> = AwEHoUQDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH78YTU8qLS8I5HLHSSmlATLcs >> lQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END EC PRIVATE KEY----- >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 16] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> A.2. X.509 Public Key Certificate for Example >>=20 >> -----BEGIN PUBLIC KEY----- >> = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH >> 78YTU8qLS8I5HLHSSmlATLcslQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END PUBLIC KEY----- >>=20 >> Authors' Addresses >>=20 >> Chris Wendt >> Comcast >> One Comcast Center >> Philadelphia, PA 19103 >> USA >>=20 >> Email: chris-ietf@chriswendt.net >>=20 >>=20 >> Jon Peterson >> Neustar Inc. >> 1800 Sutter St Suite 570 >> Concord, CA 94520 >> US >>=20 >> Email: jon.peterson@neustar.biz >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 17] >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 23 04:58:51 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D02012D937 for ; Tue, 23 Aug 2016 04:58:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JMHJo_RZ2flV for ; Tue, 23 Aug 2016 04:58:48 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C686012D93B for ; Tue, 23 Aug 2016 04:58:47 -0700 (PDT) X-AuditID: c1b4fb25-ca31e98000001071-d6-57bc3a75026b Received: from ESESSHC007.ericsson.se (Unknown_Domain [153.88.183.39]) by (Symantec Mail Security) with SMTP id FD.38.04209.57A3CB75; Tue, 23 Aug 2016 13:58:46 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC007.ericsson.se ([153.88.183.39]) with mapi id 14.03.0301.000; Tue, 23 Aug 2016 13:58:36 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Eric Rescorla Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR/JI0ubFrdbKggkCO9F2iW0BZU6BWhCyA Date: Tue, 23 Aug 2016 11:58:36 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> In-Reply-To: <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.5.160527 x-originating-ip: [153.88.183.17] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <43CC03A14B31A347BA3F632E3C6AD5E3@ericsson.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrBIsWRmVeSWpSXmKPExsUyM2K7um6Z1Z5wg9ebGC1+f/rAZrHi9Tl2 i+VrtzE5MHtc2nmSzWPJkp9MHpMftzEHMEdx2aSk5mSWpRbp2yVwZTyYdo294IFGxbnv35ga GFcrdDFyckgImEhcnX2AsYuRi0NIYD2jxLZ5D9ggnCWMEn8mNDN3MXJwsAlYSHT/0wZpEBHw lNjTcoEVxGYWUJd48egNO4gtLBAo0XPhLwtETZDEyRcv2SFsI4np0xrBbBYBVYlHmw8wgYzk FbCSeP61CiQsJPCHWWL5m0oQm1PAQeLNrRVgYxgFxCS+n1rDBLFKXOLWk/lMEDcLSCzZc54Z whaVePn4H9g5ogJ6Et+/zga7WEJAUWJ5vxxEq57EjalT2CBsa4kp33dAXa8tsWzha7AxvAKC EidnPmGZwCg+C8m2WUjaZyFpn4WkfRaS9gWMrKsYRYtTi5Ny042M9VKLMpOLi/Pz9PJSSzYx AuPv4JbfqjsYL79xPMQowMGoxMO7wHZ3uBBrYllxZe4hRgkOZiURXnPLPeFCvCmJlVWpRfnx RaU5qcWHGKU5WJTEef1fKoYLCaQnlqRmp6YWpBbBZJk4OKUaGG22lV7/5qzHK7a16e87iwab Us/fK9bGdQfIvGM6bewirhrV3fb2rp6XwcZJd861TxPhjxFJeuLkVpTulf2ns9HN/YYM874o sZrzkaeXb+dNXvKu99rBtf8uBbIvTM+LObN7K/vzHd/Nl17S7AplS2dtnBJkLVhjKmB//tjx 0lrdSYfSJ+ctUmIpzkg01GIuKk4EAPerrnm7AgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 11:58:50 -0000 Hi, >>I agree with Ekr, and being able to use something pre-existing is the >> reason I asked the passport authors to consider JWT. If you think there >> is something better pre-existing, please say so, but if you want to do >> something from scratch I think we=B9d need some really good justificatio= n >> for that. I don=B9t agree with your earlier statements that JWT is >> complex, and there are tons of tools to test and verify JWTs. > > >Christer, > >Just to be thorough, I'll repeat that I agree with the goal of using >existing solutions, where they represent a high-enough point of >departure (if they aren't a perfect match), preferably with enough track >record to establish efficacy. > >And I'll repeat that my view of the passport draft did not criticize the >use of JWT. (By the way, is it only JWT or is it actually JOSE, and if >it isn't why not?) It=B9s actually JWS (JOSE is the name of the generic framework). It=B9s probably something we should fix too. >It's not that I didn't question the use, it's that I didn't indulge in >that questioning at that point. This came later, as I watched the >documentation efforts to integrate use of JWT. > > > > In Berlin I did raise an issue on how STIR uses JWT in SIP (the encoded > > object is =B3split up=B2, and different pieces are placed in different = SIP > > elements), but Jon promised to make sure it=B9s clarified and well > > explained in the next version of the bis draft, so I think we should > > give him a chance to do that. > >There are at least two major problems here. > >The technical one is that the current approach requires doing encoding >and packaging twice, from what I can tell. Once in a JSON context and >the second in a SIP header context. By itself, that should be worrying. >That the latter hasn't been fully documented and agreed to, yet, raises >a question about how anyone thought the documents were ready for last >call. The latter is the exact issue I raised, and it must be well documented (together with examples) how it=B9s done. However, once you done the JSON encoding, I don=B9t think you need to do further =B3encoding=B2 (no need to escape characters etc). The idea (afaik)= is to split the encoded string into different pieces, and place those in different SIP header field/parameters. But, HOW that split is done, and how the string is re-generated on the receiving side, must be clarified. =20 >The other major problem is that the introduction of JSON/JWT has >produced levels of indirection in the documentation that made it >essentially impossible for me to understand and analyze the >specification details. And I tried pretty hard. So this does not bode >well for other new readers of the specifications. (More generally, the >documents make cross-references and indulge in cross-dependencies that >defeat the benefits of modularity and create really serious reading >complexity.) Assuming PASSPorT is supposed to be something generic, I think we should avoid normative references to the draft-bis from PASSPorT. (draft-bis draft obviously have to normatively reference PASSPorT.) As I have zero knowledge of DKIM, I=B9ll let others discuss its=B9 applicability to STIR, and whether it=B9s better/worse than what we currently have. But, in general, I don=B9t think WGLC is too late for a beauty contest.=20 Regards, Christer >And now, yes, I'll indulge in the dreaded "DKIM" reference... > >DKIM is another existing mechanism that provides exactly the needed >functionality, with more than 10 years of field experience (counting the >predecessor Yahoo's Domainkeys) and a relatively simple design. > >As I've noted before, the list of 'topics' for the STIR work is not >long. I'll do an abbreviated listing here: > > 1. Calling value acquisition -- getting the string to validate > > 2. Key management --getting the key and validating that it is > authorized for use with the calling value. > > 3. A bunch of crypto-related computation -- including > canonicalization of the data of course > > 4. Packaging the result -- for use by the validation mechanism. > >Step 1 is not part of the crypto work, but it is of course fundamental, >as well as being specific to STIR. The crypto subsystem just uses it as >input. The choice of JSON/JWT, DKIM, or whatever is irrelevant to this >step. > >Step 2: > > a) For non-telephone URIs, DKIM's DNS model can be used directly. > > b) I'm unclear about the role of the domain name in the URIs that >have a phone number in the left-hand side. In any event, as I've noted >repeatedly, number-based key management is an open issue, with >demonstrated high risk, given that the previous effort failed. > >Step 3 can use DKIM almost directly. > >Step 4 can use DKIM almost directly. > > >So the DKIM approach is dramatically simpler and offers by far the >highest point of departure for STIR. > >In particular, the hard parts of doing STIR aren't solved by this choice >-- JSON/JWT don't help either. > >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Tue Aug 23 05:04:04 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BB7C12D93F for ; Tue, 23 Aug 2016 05:04:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DTwRROoSOi3a for ; Tue, 23 Aug 2016 05:04:01 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 550E912D93E for ; Tue, 23 Aug 2016 05:04:01 -0700 (PDT) X-AuditID: c1b4fb25-ca31e98000001071-d6-57bc3baf485d Received: from ESESSHC022.ericsson.se (Unknown_Domain [153.88.183.84]) by (Symantec Mail Security) with SMTP id BD.A9.04209.FAB3CB75; Tue, 23 Aug 2016 14:03:59 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC022.ericsson.se ([153.88.183.84]) with mapi id 14.03.0301.000; Tue, 23 Aug 2016 14:03:04 +0200 From: Christer Holmberg To: Christer Holmberg , "dcrocker@bbiw.net" , Eric Rescorla Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR/JI0ubFrdbKggkCO9F2iW0BZU6BWhCyAgAABQIA= Date: Tue, 23 Aug 2016 12:03:03 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.5.160527 x-originating-ip: [153.88.183.19] Content-Type: text/plain; charset="euc-kr" Content-ID: <9BED230098D9AC4FAD2ED667F078D7D9@ericsson.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrJIsWRmVeSWpSXmKPExsUyM2J7iO566z3hBqd3G1j8/vSBzWLF63Ps FsvXbmNyYPa4tPMkm8eSJT+ZPCY/bmMOYI7isklJzcksSy3St0vgyljddI+xYAFzxZcrXA2M U5i7GDk5JARMJA5dnsDWxcjFISSwnlFi+pON7BDOEkaJyb+/snQxcnCwCVhIdP/TBmkQEaiX 2HjzJROIzSygLvHi0Rt2EFtYIFCi58JfFoiaIImTL16yQ9hWEg8ffGYDsVkEVCWmrH0DVsML FL+56gzYEUICa1kktux1AbE5BawlLn+5DFbPKCAm8f3UGqhd4hK3nsxngjhaQGLJnvNQD4hK vHz8jxXEFhXQk/j+dTZUXFGi/WkDI0SvlsSXH/vYIGxriUN7N0PNVJSY0v2QHeIeQYmTM5+w TGAUn4Vk3Swk7bOQtM9C0j4LSfsCRtZVjKLFqcVJuelGxnqpRZnJxcX5eXp5qSWbGIEReHDL b9UdjJffOB5iFOBgVOLhXWC7O1yINbGsuDL3EKMEB7OSCO8vqz3hQrwpiZVVqUX58UWlOanF hxilOViUxHn9XyqGCwmkJ5akZqemFqQWwWSZODilGhi5A7fLBE4M13xyKTlB+scHS/5QP6PN Lo3XDnK2NLyyPFhj0bEk+LSLdpBmqsjptmVbJ1zo7tlSlPatZOWz61s2Nuc1HjG5sTKo6Jl/ V/J6Rv+gxS+/byxgE+kyfBGz68QfxtL3WfFba49KbN/idsbC9YBCgvwOVY/uOMUbU/tjqld3 qX2MlFZiKc5INNRiLipOBAAdHxhLvAIAAA== Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 12:04:02 -0000 DQo+DQo+QXMgSSBoYXZlIHplcm8ga25vd2xlZGdlIG9mIERLSU0sIEmp9mxsIGxldCBvdGhlcnMg ZGlzY3VzcyBpdHOp9g0KPmFwcGxpY2FiaWxpdHkgdG8gU1RJUiwgYW5kIHdoZXRoZXIgaXSp9nMg YmV0dGVyL3dvcnNlIHRoYW4gd2hhdCB3ZQ0KPmN1cnJlbnRseSBoYXZlLiBCdXQsIGluIGdlbmVy YWwsIEkgZG9uqfZ0IHRoaW5rIFdHTEMgaXMgdG9vIGxhdGUgZm9yIGENCj5iZWF1dHkgY29udGVz dC4NCg0KDQpDb3JyZWN0aW9uOiBJIERPIHRoaW5rIFdHTEMgaXMgdG9vIGxhdGUgZm9yIGEgYmVh dXR5IGNvbnRlc3QuDQoNCg== From nobody Tue Aug 23 06:40:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02BA312D18E for ; Tue, 23 Aug 2016 06:40:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aiqkLpK8r1_M for ; Tue, 23 Aug 2016 06:40:23 -0700 (PDT) Received: from resqmta-po-09v.sys.comcast.net (resqmta-po-09v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:168]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0460112D18D for ; Tue, 23 Aug 2016 06:40:21 -0700 (PDT) Received: from resomta-po-07v.sys.comcast.net ([96.114.154.231]) by resqmta-po-09v.sys.comcast.net with SMTP id cBwCbugYdS0FEcBwCbi4Uo; Tue, 23 Aug 2016 13:40:20 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by resomta-po-07v.sys.comcast.net with SMTP id cBw8bfCHYvfELcBw9b5vk4; Tue, 23 Aug 2016 13:40:20 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Tue, 23 Aug 2016 06:25:15 -0700 From: Alex Bobotek To: David Frankel , "stir@ietf.org" Date: Tue, 23 Aug 2016 06:25:14 -0700 Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQAOsXmg Message-ID: <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> In-Reply-To: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_4B1956260CD29F4A9622F00322FE05310128F703471ABOBO1Abobot_" MIME-Version: 1.0 X-CMAE-Envelope: MS4wfJ34BJv4iemCk1mN8KubesLUCLS8mDl7l2L/lI6SA7e1Nf3t7fDCieZFADh4GmDwUFGIkgKC66ZaF9g3XOA9r+01zoIMvlLNP8S3JH3yn+BogZ+E9rsc WXk3W2xcl7yePWtTYS99YgRF4/uskIV/3HLwXUJ8gnOJ11wFm2+3befMwqr3Ix3oad0BIKlz/K9UQw== Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 13:40:25 -0000 --_000_4B1956260CD29F4A9622F00322FE05310128F703471ABOBO1Abobot_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable David wrote: > I don't agree that RFC7340 states that these abuses are "enabled" by the = "ability to impersonate someone else. +1 --- I don't read RFC7340 as saying this either, as my earlier comments t= o this group stated. Further, I don't believe that RFC7340 is completely a= ccurate. In my experience, most North American telephony abuse is facilita= ted by anonymity and accessibility. In this context anonymity includes i= dentity masking achieved by random impersonation but excludes targeted impe= rsonation such as of the IRS using 800-xxx-1040, and this combined with ac= cessibility is exemplified by the fact that no government issued ID need be= shown to easily obtain low-cost service at a retail store or over the inte= rnet. An anonymous caller proving to terminating networks or their users that the= caller has been assigned the calling number doesn't, on its own, do much t= o change this. What really helps is having some control over the attackers= ' ability to (1) obtain service and (2) complete calls. Knowing a party t= hat can be held accountable that happens to be in a position to mitigate th= e abuse helps with the first, and reputation-based filters and indications = help with the second. ----Who's the Authority?---- A point that may be pondered relates to the ambiguity surrounding the "auth= ority" implied by the charter's use of the word "authorized". "As its priority mechanism work item, the working group will specify a SIP = header-based mechanism for verification that the originator of a SIP sessio= n is _authorized_ to use the claimed source telephone number, where the ses= sion is established with SIP end to end." One interpretation is that any signer may be an authority. An originating = telco, in that it can choose (perhaps with guidance from regulators) whethe= r or not to allow a call to be originated, is clearly in a position of auth= ority. And such a statement of authority has significant meaning to reputa= tion-based filters and displays as well as post-call traceback and mitigati= on efforts. Another is interpretation is that the authority must come from proper assig= nments and/or delegations traceable to the root authority for that type of = identity. This of course has a different meaning. It seems that the group has been more focused on the latter, but I do not h= ave the history to see how this emerged. Could someone explain whether and= how the latter became the dominant focus? ----Per-TN Certificates---- Signing with per-telephone-number certificates seems to be lacking support = for implementation by network operators. If anyone has a contrary view, pl= ease express it. Per-call queries to verify certificate validity would nee= d to check revocation status, and the infrastructure required to maintain t= imely revocation status is expensive at the per-TN scale. If a large servi= ce provider needs to check 2,000 peer service provider certs for revocation= every 10 minutes (which is somewhere around the reaction time of many spam= filters), fine. But scanning CRLs for every call (to check for a cert wit= h service cancelled or delegation revoked) is burdensome, as is CRL publica= tion. Yes, optimal implementations can ease the burden, but a substantial = burden remains. So putting all of this together, it seems that the _pressing_ need is for s= igning by the originating service provider using a key assigned to that ser= vice provider, but little more. There is urgency; both delay in standards= approval and additional complexity that slows or inhibits widespread STIR = adoption are undesirable. Regards, Alex --_000_4B1956260CD29F4A9622F00322FE05310128F703471ABOBO1Abobot_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

&nb= sp;

David wrote:

> I don’t agree that RFC7340 states that these abuses are &= #8220;enabled” by the “ability to impersonate someone else.

 

+= 1 --- I don’t read RFC7340 as saying this either, as my earlier comme= nts to this group stated.  Further, I don’t believe that RFC7340= is completely accurate.  In my experience, most North American teleph= ony abuse is facilitated by anonymity and accessibility.    = In this context anonymity includes identity masking achieved by random impe= rsonation but excludes targeted impersonation such as of the IRS using 800-= xxx-1040,  and this combined with accessibility is exemplified by the = fact that no government issued ID need be shown to easily obtain low-cost s= ervice at a retail store or over the internet. 

 

An anonymous caller= proving to terminating networks or their users that the caller has been as= signed the calling number doesn’t, on its own, do much to change this= .  What really helps is having some control over the attackers’ = ability to (1) obtain service and (2) complete calls.   Knowing a= party that can be held accountable that happens to be in a position to mit= igate the abuse helps with the first, and reputation-based filters and indi= cations help with the second. 

 

----Who’s the Authority?----

 

A point that may be pondered relates to the ambiguity surrounding the R= 20;authority” implied by the charter’s use of the word “a= uthorized”. 

 

“As its priorit= y mechanism work item, the working group will specify a SIP header-based me= chanism for verification that the originator of a SIP session is _aut= horized_ to use the claimed source telephone number, where the sess= ion is established with SIP end to end.”

 

One interpretation is that any signer may be an authority.  An or= iginating telco, in that it can choose (perhaps with guidance from regulato= rs) whether or not to allow a call to be originated, is clearly in a positi= on of authority.  And such a statement of authority has significant me= aning to reputation-based filters and displays as well as post-call traceba= ck and mitigation efforts. 

 

Another is interpretation is that the au= thority must come from proper assignments and/or delegations traceable to t= he root authority for that type of identity.   This of course has= a different meaning. 

 

= It seems that the group has been more focused= on the latter, but I do not have the history to see how this emerged. = ; Could someone explain whether and how the latter became the dominant focu= s? 

 

----Per-TN Certificates----

 

Signing with per-telephone-number c= ertificates seems to be lacking support for implementation by network opera= tors.  If anyone has a contrary view, please express it.  Per-cal= l queries to verify certificate validity would need to check revocation sta= tus, and the infrastructure required to maintain timely revocation status i= s expensive at the per-TN scale.  If a large service provider needs to= check 2,000 peer service provider certs for revocation every 10 minutes (w= hich is somewhere around the reaction time of many spam filters), fine.&nbs= p; But scanning CRLs for every call (to check for a cert with service cance= lled or delegation revoked) is burdensome, as is CRL publication.  Yes= , optimal implementations can ease the burden, but a substantial burden rem= ains. 

 

So putting all of this together, it seems that the _pressi= ng_ need is for signing by the originating service provider using a key= assigned to that service provider, but little more.   There is u= rgency; both delay in standards approval and additional complexity that slo= ws or inhibits widespread STIR adoption are undesirable.  <= /span>

 

 

Regards,

 

Alex

= --_000_4B1956260CD29F4A9622F00322FE05310128F703471ABOBO1Abobot_-- From nobody Tue Aug 23 06:46:39 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FECC12D195 for ; Tue, 23 Aug 2016 06:46:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LaGfqexdeWvn for ; Tue, 23 Aug 2016 06:46:35 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C6AE12D1C1 for ; Tue, 23 Aug 2016 06:46:34 -0700 (PDT) Received: from pps.filterd (m0049459.ppops.net [127.0.0.1]) by m0049459.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7NDiAEr029758; Tue, 23 Aug 2016 09:46:31 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049459.ppops.net-00191d01. with ESMTP id 250mmc13tu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 23 Aug 2016 09:46:31 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7NDkUie032113; Tue, 23 Aug 2016 09:46:30 -0400 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7NDkML4031833 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 23 Aug 2016 09:46:22 -0400 Received: from MISOUT7MSGHUBAD.ITServices.sbc.com (MISOUT7MSGHUBAD.itservices.sbc.com [130.9.129.148]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Tue, 23 Aug 2016 13:46:06 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAD.ITServices.sbc.com ([130.9.129.148]) with mapi id 14.03.0301.000; Tue, 23 Aug 2016 09:46:05 -0400 From: "DOLLY, MARTIN C" To: Alex Bobotek Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQAOsXmgAE6NIO8= Date: Tue, 23 Aug 2016 13:46:05 +0000 Message-ID: <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com>, <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> In-Reply-To: <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_3BF607540E184E22AE4155B135C55754attcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-23_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608230138 Archived-At: Cc: "stir@ietf.org" , David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 13:46:37 -0000 --_000_3BF607540E184E22AE4155B135C55754attcom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable The a SHAKEN framework supports a pool of certs per carrier, not cert per T= N But it is ok for the RFCs yo have a broader scope for as long as they are d= elivered on time Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 23, 2016, at 9:40 AM, Alex Bobotek > wrote: David wrote: > I don=92t agree that RFC7340 states that these abuses are =93enabled=94 b= y the =93ability to impersonate someone else. +1 --- I don=92t read RFC7340 as saying this either, as my earlier comments= to this group stated. Further, I don=92t believe that RFC7340 is complete= ly accurate. In my experience, most North American telephony abuse is faci= litated by anonymity and accessibility. In this context anonymity includ= es identity masking achieved by random impersonation but excludes targeted = impersonation such as of the IRS using 800-xxx-1040, and this combined wit= h accessibility is exemplified by the fact that no government issued ID nee= d be shown to easily obtain low-cost service at a retail store or over the = internet. An anonymous caller proving to terminating networks or their users that the= caller has been assigned the calling number doesn=92t, on its own, do much= to change this. What really helps is having some control over the attacke= rs=92 ability to (1) obtain service and (2) complete calls. Knowing a par= ty that can be held accountable that happens to be in a position to mitigat= e the abuse helps with the first, and reputation-based filters and indicati= ons help with the second. ----Who=92s the Authority?---- A point that may be pondered relates to the ambiguity surrounding the =93au= thority=94 implied by the charter=92s use of the word =93authorized=94. =93As its priority mechanism work item, the working group will specify a SI= P header-based mechanism for verification that the originator of a SIP sess= ion is _authorized_ to use the claimed source telephone number, where the s= ession is established with SIP end to end.=94 One interpretation is that any signer may be an authority. An originating = telco, in that it can choose (perhaps with guidance from regulators) whethe= r or not to allow a call to be originated, is clearly in a position of auth= ority. And such a statement of authority has significant meaning to reputa= tion-based filters and displays as well as post-call traceback and mitigati= on efforts. Another is interpretation is that the authority must come from proper assig= nments and/or delegations traceable to the root authority for that type of = identity. This of course has a different meaning. It seems that the group has been more focused on the latter, but I do not h= ave the history to see how this emerged. Could someone explain whether and= how the latter became the dominant focus? ----Per-TN Certificates---- Signing with per-telephone-number certificates seems to be lacking support = for implementation by network operators. If anyone has a contrary view, pl= ease express it. Per-call queries to verify certificate validity would nee= d to check revocation status, and the infrastructure required to maintain t= imely revocation status is expensive at the per-TN scale. If a large servi= ce provider needs to check 2,000 peer service provider certs for revocation= every 10 minutes (which is somewhere around the reaction time of many spam= filters), fine. But scanning CRLs for every call (to check for a cert wit= h service cancelled or delegation revoked) is burdensome, as is CRL publica= tion. Yes, optimal implementations can ease the burden, but a substantial = burden remains. So putting all of this together, it seems that the _pressing_ need is for s= igning by the originating service provider using a key assigned to that ser= vice provider, but little more. There is urgency; both delay in standards= approval and additional complexity that slows or inhibits widespread STIR = adoption are undesirable. Regards, Alex _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_3BF607540E184E22AE4155B135C55754attcom_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
The a SHAKEN framework supports a pool of certs per carrier, not cert = per TN

But it is ok for the RFCs yo have a broader = scope for as long as they are delivered on time

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 23, 2016, at 9:40 AM, Alex Bobotek <alex@bobotek.net> wrote:

 

David wrote:

> I don=92t agree that RFC7340 states that these = abuses are =93enabled=94 by the =93ability to impersonate someone else.

 

+1 --- I don=92t read RFC7340 as saying this eit= her, as my earlier comments to this group stated.  Further, I don=92t = believe that RFC7340 is completely accurate.  In my experience, most N= orth American telephony abuse is facilitated by anonymity and accessibility.    In this context anonymity includes id= entity masking achieved by random impersonation but excludes targeted imper= sonation such as of the IRS using 800-xxx-1040,  and this combined wit= h accessibility is exemplified by the fact that no government issued ID need be shown to easily obtain low-cost service at a retail stor= e or over the internet. 

 

An anonymous caller proving to terminating networks = or their users that the caller has been assigned the calling number doesn= =92t, on its own, do much to change this.  What really helps is having= some control over the attackers=92 ability to (1) obtain service and (2) complete calls.   Knowing a party tha= t can be held accountable that happens to be in a position to mitigate the = abuse helps with the first, and reputation-based filters and indications he= lp with the second. 

 

----Who=92s the Authority?----

 

A point that may be pondered relates to the ambiguit= y surrounding the =93authority=94 implied by the charter=92s use of the wor= d =93authorized=94. 

 

=93As its priority mechan= ism work item, the working group will specify a SIP header-based mechanism = for verification that the originator of a SIP session is _authorized<= /i>_ to use the claimed source telephone number, where the session is established with SIP end to end.=94

 

One interpretation is = that any signer may be an authority.  An originating telco, in that it= can choose (perhaps with guidance from regulators) whether or not to allow= a call to be originated, is clearly in a position of authority.  And such a statement of authority has signifi= cant meaning to reputation-based filters and displays as well as post-call = traceback and mitigation efforts. 

 

Another is interpretat= ion is that the authority must come from proper assignments and/or delegati= ons traceable to the root authority for that type of identity.   = This of course has a different meaning. 

 

It seems that the grou= p has been more focused on the latter, but I do not have the history to see= how this emerged.  Could someone explain whether and how the latter b= ecame the dominant focus? 

 

----Per-TN Certificate= s----

 

Signing with per-telep= hone-number certificates seems to be lacking support for implementation by = network operators.  If anyone has a contrary view, please express it.&= nbsp; Per-call queries to verify certificate validity would need to check revocation status, and the infrastructure required to = maintain timely revocation status is expensive at the per-TN scale.  I= f a large service provider needs to check 2,000 peer service provider certs= for revocation every 10 minutes (which is somewhere around the reaction time of many spam filters), fine.  B= ut scanning CRLs for every call (to check for a cert with service cancelled= or delegation revoked) is burdensome, as is CRL publication.  Yes, op= timal implementations can ease the burden, but a substantial burden remains. 

 

So putting all of this= together, it seems that the _pressing_ need is for signing by the o= riginating service provider using a key assigned to that service provider, = but little more.   There is urgency; both delay in standards approval and additional complexity that slows or i= nhibits widespread STIR adoption are undesirable. 

 

 

Regards,

 

Alex

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_3BF607540E184E22AE4155B135C55754attcom_-- From nobody Tue Aug 23 06:49:05 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 280AA12D195 for ; Tue, 23 Aug 2016 06:49:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -22.52 X-Spam-Level: X-Spam-Status: No, score=-22.52 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paypal.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VeZVh7-6VXRJ for ; Tue, 23 Aug 2016 06:49:03 -0700 (PDT) Received: from den-ipout-01-data1.paypalcorp.com (den-ipout-01-data1.paypalcorp.com [173.224.160.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31A7E12D17E for ; Tue, 23 Aug 2016 06:49:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=paypal.com; i=@paypal.com; q=dns/txt; s=pp-dkim1; t=1471960142; x=1503496142; h=from:to:subject:date:message-id:mime-version; bh=ix+oyUDrc8mN2/sDQA1hRniYOnLVVmj+vj09AlPXRps=; b=Hf6RldXGacZBidKd9z9n0FS4c1t8/tyEJycsi8Mta5F1avpaNqZenQtP AvMvzvJ/VAHGGAMr8aND232r1vXdqypWObHZLDhDhac64iDkGgK0rpQt/ U13vqcaNVI21p3zawwV1v4MkXVEwT6PTRe57ci6A4DxL7BmQ2agUSwiyH lSEPJkAim7SaXn0nt1WgGV+K+r5CvCBPW4pimIdD/5wssmA2Vvqjj8OBg kT8uGZkiMwQ9LozhJiVv38SZEksFGP2aH/RnXZNtSETWf4nmOULQ5aOC1 2+0yNKgrpOsazBB6fitj3PnnOPxdPTig3ZIiHJlC0loyDrdoNUZdo+6Ko A==; X-IronPort-AV: E=Sophos;i="5.28,566,1464674400"; d="png'150?scan'150,208,217,150";a="20288061" Received: from unknown (HELO lvs-ipcld-01-data1.paypalcorp.com) ([10.184.246.166]) by den-ipout-01-data1.paypalcorp.com with ESMTP; 23 Aug 2016 07:49:00 -0600 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,566,1464678000"; d="png'150?scan'150,208,217,150";a="384425" X-CloudService: Office365 Received: from mail-sn1nam01lp0111.outbound.protection.outlook.com (HELO NAM01-SN1-obe.outbound.protection.outlook.com) ([207.46.163.111]) by lvs-ipcld-01-data1.paypalcorp.com with ESMTP/TLS/AES256-SHA; 23 Aug 2016 06:48:55 -0700 Received: from SN1PR06MB1853.namprd06.prod.outlook.com (10.162.133.22) by SN1PR06MB1855.namprd06.prod.outlook.com (10.162.133.19) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.587.13; Tue, 23 Aug 2016 13:48:56 +0000 Received: from SN1PR06MB1853.namprd06.prod.outlook.com ([10.162.133.22]) by SN1PR06MB1853.namprd06.prod.outlook.com ([10.162.133.22]) with mapi id 15.01.0587.013; Tue, 23 Aug 2016 13:48:56 +0000 From: "Andrews, Dar" To: "stir@ietf.org" Thread-Topic: Please remove me from distribution Thread-Index: AdH9RRZKsSpjM4/3STmTX+SUGbK3aw== Date: Tue, 23 Aug 2016 13:48:56 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dmandrews@paypal.com; x-originating-ip: [173.224.163.83] x-ms-office365-filtering-correlation-id: 625098b2-8848-4985-021b-08d3cb5c3a72 x-microsoft-exchange-diagnostics: 1; SN1PR06MB1855; 6:KZ54GF8e9HBAG9lSnWi6c9JTr+/BO6kBWBH/beQV0osbQ/h0kxg/d3xFvL1qG9oR/VHsx5BcNGPRp4Ws1za91FAIK5yupME2GA+e5fiBEZKjMJZ80h7fWAAi6QfZWVesJ0FcRhmvVjeiPIIaqrLjtTAn2D79HqX3zMbs6EPmPZGoX9DRmW/lx3OicsufiUlyls8jBW3VNCqG1vMvsn6XwWg3NvYgVcQU1LVJOBwqezR5T+TBi1yR3PfqHnyej8TsqSJZgi0CL6DCLEfWT3TJ2fLFsaJ5od5GtIT9+bmEOmKaNNdpEZT8GPo8mU1fnxXQPutiOsca49mbBlpK72zj3g==; 5:vgGrObzNvqH6FtvCGbWBb9iUL4sFrIjO0GzBzx56g7c7Fex6m9dLSzx9LaZkzGjJlDDGm1bhjWzySCN10dy8K3Ql9hZk3wqE5Ni0KcuG+bauKh8JhGF8iWuEG8D8GCwsUBd9RwxTHzKrYTlZLSwsKg==; 24:IhTABxeQus8crGpymJrBQ4pitWAAo8gtIfU2U6wJRTvOcGMDGGkIHx8cNSNVcda2iWdkZs5237Y5gSHgsvh2SFYq0J1Jtel7NhEv7kf+UKA=; 7:69v8O/EMUrQ/x6q84aJePzX9Vryrh8r3SgVqqsH8Gy9ZKId4k/UCOSrZSW/t1Co3USCI+9FzdgrJSfIiRHDlsAq+9X3SZKDODUoLT7H+cuW9B5Y2gvVuXpC0Z7Kvk13MV24QNiwtPxO6ZfUl5AE1Z3Jy8aJbVQkc9xeHgproodlUrCfyF4b8I0S/NoLRNZOA2/fXq3CwdTEw+9z4vLqq0dnyTVzyQOt2iH+xGVi47m7M/6DvklIrWLfWfBODNdCc x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:SN1PR06MB1855; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(252895345309445)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415321)(6040176)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026); SRVR:SN1PR06MB1855; BCL:0; PCL:0; RULEID:; SRVR:SN1PR06MB1855; x-forefront-prvs: 004395A01C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(199003)(558084003)(5640700001)(66066001)(19580405001)(5630700001)(3660700001)(3846002)(102836003)(790700001)(2906002)(6116002)(10770500004)(76576001)(68736007)(586003)(82432001)(3280700002)(10130500003)(18206015028)(19625215002)(77096005)(73692002)(101416001)(229853001)(5002640100001)(15975445007)(2351001)(122556002)(10400500002)(86362001)(450100001)(10300500001)(19300405004)(10290500002)(5660300001)(2900100001)(97736004)(189998001)(110136002)(107886002)(77072002)(16236675004)(105586002)(2501003)(19580395003)(106356001)(99286002)(54356999)(33656002)(99936001)(17760045003)(50986999)(11100500001)(19627595001)(8936002)(4500500003)(87936001)(9686002)(7736002)(74316002)(8676002)(81156014)(1730700003)(81166006)(7846002)(7696003)(92566002)(10630500005)(56826009); DIR:OUT; SFP:1102; SCL:1; SRVR:SN1PR06MB1855; H:SN1PR06MB1853.namprd06.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: paypal.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/related; boundary="_004_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_"; type="multipart/alternative" MIME-Version: 1.0 X-OriginatorOrg: paypal.com X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2016 13:48:56.5150 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fb007914-6020-4374-977e-21bac5f3f4c8 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR06MB1855 X-CFilter: Scanned den1 Archived-At: Subject: [stir] Please remove me from distribution X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 13:49:04 -0000 --_004_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_ Content-Type: multipart/alternative; boundary="_000_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_" --_000_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dar Andrews / Sr. Director, Service Delivery & Engineering direct 402.952.8222 / cell 402.304.1413 email dmandrews@PayPal.com skype DarAndrews [PP_h_logo_30x123] 12312 Port Grace Blvd LaVista, NE 68128 --_000_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

 

Dar Andrews = / Sr. Director, Service Delivery & Engineering=

 

direct&nbs= p;402.952.8222 / cell 4= 02.304.1413

email dmandrews@PayPal.com  skype DarAndrews

 

3D"PP_h_logo_30x123"

12312 Port Grace Blvd

LaVista, NE 68128

 

 

--_000_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_-- --_004_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=6928; creation-date="Tue, 23 Aug 2016 13:48:55 GMT"; modification-date="Tue, 23 Aug 2016 13:48:55 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAGMAAAAYCAYAAADu3kOXAAAABGdBTUEAA1teXP8meAAACkFpQ0NQ SUNDIFByb2ZpbGUAAEgNnZZ3VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQR KVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTC dFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/ f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZ zhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifIC AAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9v lkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVV ALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77Vjum Fz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5k CoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n +h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMu SAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJB qpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2E EZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FE QpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZm EDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7 gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0 UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64k nyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOr kWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1 xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5Rzl GuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWd qm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTG NRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPO E12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOq kavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtag OcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1 rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HT SaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9 uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX 8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxgu LDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowg pj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70 X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMp M6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZ C7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+ 649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1 YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5W YVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQ a61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7 E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x73+mA050dzh0t P5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737 /FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e9rp95Y7/nRsD iwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+G uEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR 65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3 hPP7MjpZfgAAAAlwSFlzAAASdAAAEnQB3mYfeAAAEGVJREFUaAXtmVtwXdV5x/97n31uOpKlY0m2 LOObwMY2tikYbLcOhlJwU5rQMMWBScikDJNp+9AkM33ptBk2232JXzpJ+9AyCTMlEwcMmGScEBKG MECxnZqaxAZfsY0BR75JOpIlncu+9re2Lr4gDKFNms6wZs7Z+6y99lrf+i7/7/+tY3meJ9Pcbclc JU1/o0R/rSQqyUrq4it9eP7LUmJFdPfT9Ybs5AU5jae9O+y3zg/5+O6jasC+4MVuDLFQtlOQlaHb yvKVu/hj+pICBumUnVspq+l+BaWN7pPWbRfM8/HtR9SAM/lebM9AyXMlG0tY6FzGIuON35PN3FvF 9GM5Mxm6VMzibo1Pau/f7SfSLo2myTc/vrm8Bs5HRuS0YoE2KeYN86FZKN5iyHs+9MehFIFkmbyl TG4tplsnbTg/39gMH3//GhpII8N1H7S0YlMXxuhQYgwx4dzj17RvillNvzFKnLSqEcyUnqRj2RQD p+5yt+WLqtRLKshWccIDCgzGyFKoSi3QsU3V33a0uQ+ij03HmlRGqnrdVqHAviqIVJaK9US9tYgf Da/xTM0I+lGbu+rBnPbsb2YVY4doDKZ6NjWTlGeRK5rHogLPt3HyoC7LHxlTuIkSA18XNX47yEPk WFZiIbGJDCPoB7bUEHF4l1rzNylhsTDmddNiS3bReEFVrYXjWvHQDndz/xve59sb6ePfxtem7WWV Z22Qk1mpluZEURjLbjfbtxTxe2bzML5y0K3eu10vLjriLdv4ofZ8oehpADxybK26W29n4hmq1f0x Y5Q1HT/sxBhoF0+faCH7bwwRKOjJQNWFLTUOHUMQq/bOUrJy+Wr98/DN7q3Nr3gbN/oXDp3y3gln KcjeKbtwh5KEdRMWyJCnuLcQIkmM8nFH+3YVnG+5m1ue8z4/+Bs3iOu6lh65f56c7AYVS2vkG1Jp A8WOg1wJSIDi7RrXPsW1XfrksYfdlgd3egc2jjvTlLt9b+fXKwXF8c1y8l8kTZfVqDfGjCFjCIsY vKClEBTgqKw9ofjJxxPwRccIxrqiO6/FC9eqpr/SiyO99B6cHDrFzTgsdkONFyBMi2Jsl0QslAww HMPEHbKzTdyWWbuHzY+oMPw2z/ZOMd3/btc3DxmdzGHd+co3l4gKowMfMwzilFl8paxcrgknagee exQ1+lQ5doJ3jHwfvpUroJA1n31281Ik2zo5Zow4xBhZkjdtMl0YQ49HRJrA0dFEmzCOj6NmmGJm p5J5Pc2qNm5Rn7/CbVt1xBvcdUGITbw4fl30FUdxFwrP5DACyzR8RdFrsqKfogRjmTVsep2sXKsy EDeFK/i6hs9v3hhLO7M6PjQTz88oJCr8+jkFjVcwynag29D9daplVqtQKhE9GCe8QapdRf+vZwwn 26LIbzWup9A/Q5r4+ZgxIrtDjs0DnhhjGOXHREUKT/QRpanD8j3ZfHQ2TD7pAEsXLyS3QcYG+vMI 3qVCJ16tc5NjL70JuzMqxTOwZIl6hbVqwwj1gvzg3xQO9Kul6yZSxzTkuTl1iCQy9U5KtV33jYx6 VhY1qz5NYSGv4XpVJ2vn1NkdKezNqlxEYQVfPT0N7cHZwlqOvGswNtDunrrnHbgITtzNbTnG5FWo O8xDBJC453V0seeicpAJJ3taYeMHqhzfrOLcQE06hBN14IQrgBl8OmJQzswvt//erIrDRfWgDKeY 0dneERXPkl96Ys1ycoCuo3IZxT3vqxKU5TgdQCF69EeJsrfGjJERTMiabiYct4Yss5CBqMlQSR+O fdXxGGMI4xirV+KzS7EugeA3MKW5KV+04QveHL+tZBS1ziRBEqq0JBpiwYPePdYpEhCnAfGgLKeR OocpQG27jwR/yt3Z5ui6627hhdtULeABVpPyxdOak3tNmdF+xa2LMCL9ek2HDj9NyXq1Srk/UmR3 Mf9+rTz2fXfJkkPegTGDQCJaVBr+jJIskViYqabaC9p3eIeWzyWH4iXGMeMI6LSOeI0dVTV2yC18 jt92IyU4xlmVQebgjNt1X0Hd8Z9K028m9c2VFeY1o/1tJe2vMsmoztkrgOW5Gh56ReHKH2PkdvZf UjY1QRUkODpmDGOIRHgic5voMB8fljRI/oRR8eKYTRKkMwKYaycs+MbrpU+slaa1wH2qRnAG26dU P8z1Mq1cLCiyUJBaUpiKIoSJRziS6cR32hTbJHWKScMnzFqyOHqJK+od3aBM9i9l59mYySeID5wD b7dyM0R0A7e5GQpH5yD0y8qGC8DkT8lpvkpR7Sh1UQXK2qs7NZRGRGGUBJr9qpy2q+UPkx/84yo7 O9jDdNChoAAd+FUUn1goG/RQF+j+x8i2IJUrBD2U/DKl4nbuAeVKfAqL5ORQMjobHSLhx7cBeaPI 3U09VtbIAKgR7sKIRFcunxo8RNl25rjjPpovqDVmcY45TI4wmze1g7lvIYRs47zGSrQM0VgEw2cS SEsWScuvkZp5HhBBUaq0d2QHxy+bL8w8TmEaYckkMdVFSpBQrP1pRdkbFTsctdg3odQrxpRdO6XE /y8EWcCG/lZOE6GIHFG9V1ZwlM0gpBZjIAxgHIlIslBbNjQwuQ8HGaIwJRIbC/h9AxTyhwzAcANL oNAPyG66HuWhz+RVBcFPdMu1ddX8mRgRyMXBomg2G78H/axHebNxkHVqau1gLvbdOKjA38sR0ioV p31FpbaF9BmEOIYTv4Mu2xm1mGfZFPrTSEp8uCLKFzBtt6S6C4NRhZkzDljZoTiPlXAzM9iQGvO5 oltawL6bsJE/nosLWLutTYkxxnTIl4GxGkFQIvcnPlDjvKQweTcV9HJftbANTyDrJxneQzfObIS9 P7W5Of4yJzLGZZLgJEr4DsUO1+JdJPOV5LIYQ+zBYbYoq5flE0mO82kSKVHDPkKgMkGGSnhKTvkt MPyX8gdvoM+E0UIKrBb3G9WiZrfegXLXo0gM0XdGwei3vS93Pu+2lNfozGgXacBO95fNX4k8VxJ1 AhKRjatx1DA8jGz/zk1M6rtLpdaFGj3nqz7ynyT7xxkIPIWzlc1tUBj8mYp4dmMkYI9vajgcVGce BSN7g+iLQ6AvX3FMSkEbpDiUkIYlyjG5YPkSac21OAWKgeykDaqdRkeEMD4haq45BExIMGEDNqRt Ku8eECh6+RazptOeerGhtZbZHXOY4DKHxXFagh8D53/IvI8wdh0Kh10hY1wjofr/quroE1TneP8T nI4BPbloBfN1AFnUADpN9d7wvmo13K2ZPcDPaWUKszDIVcy1WHPIN5ncpzBuk6JqyDuPAcvP4nlS f3UuUWt0giwGJVK5jHw43jlj6CowfhBJtxAB2yAgn1M+vzqF9sB/E118U2X7J/rslVVteOI1rV9e k5W/DvmXKHSGiYDTKtaopUqzIAFNaTqQfVaaNYB2wVnD6U14G083iTtP2Bp2BFnhOMBoCNkMBBiv MF7L1RgpyzXwY6z7Itj6MFj/KsmRSd6/gdUwl1FTYLaMHQwbWhbvRknPsw6swBSAcb9sNqbksOrT +1UYWYgXzpepA+PobdbZ7n2xaUjyWOhA4m5JKmyYhI9MFiwOzp6yK0oDZcL9zHOAgbPSvUbJF4C0 FiLi+rSyjqJX8MzHMewJt+voNOAWKOKcDpTCiEae7RiLMRZGS4vRs8DXm6rXDqlWttRuXQ3sTlcN D4/8I6rWt3u9T40q/WviQOTG1w7KMe+mehtgLfYDtMbxTJwe+AzBwqTindoInZNDkoOVpLCAIUwr IkgOLzR1xIgZS5+ht0mD8xHrHLBSgwkMEyUnmWyvGtWfQv12wjiM5S7fWirkCZiLLE6kWD6CKSXh c8pED/Mii9UtDQ+McvxB6Fkwqxp8PCUYQJpxCraicMxzecF9tKtZ5cqfYKAFY45CPhCRoaMMBrJt HcbTyR2NW1kPKLbWI38O5WQV148Cgd9S/cwvzPmXW4fETOMkOpfPAy9EQtJLFP5I9fAxzqciaCkK Ko9MVNtu293zYGFgtNENPpgkTUgHmxnDBrftPghJ5nZyEo5Ai4DONApaYK7J9BSOLSFv+v8QIOWo h9DCGKwTG60zsckTJjpMNKQn6ljVMIIkfAbPIZmS2SImie1fETn7vcGn2PyHbkShSIpWfnzuPuY8 4N3VODk2A2saJZ5vZpeGXpL0wETLp2p3/sLdyhFOJq6pdehGqOkGnGVuuodEI8h2Vtd+gg0REJ3l M+olb2ScXt7n/M2mtjFeT22T+D/ggPPZ8+deI5zRdUC54Ztp3sKotn2I/XHmQ7sUfgsFIAuWZ5J2 AR5Rz1yD4r7kdn/2ZxCRhHlga87drA31RLcJ8/lZExndKJbUgDMmRLXtAFOEBQMWc4VimsEowlTU hkXlDT7TZ4TKMHEQHVececQ79Z3nzIsfuQVOM0hHUrQoMlkL/8Oo/a77NWuq01nvzkbV3ZqljtDr CLSKJA1+Jg9g0D/EidACsCIKVgOdKe0m7LPhWT25IdayjfJ+fzAkb+xlndd5TjGXJUNxvhRHLykT fM+7x65M7qVQIOLi+bA2nJT929YwsoF179NMfqxct5OoWIM8V6nY3A1kfxnlwQzDBEpsIG9aOpdh opY9oNAUaE1ziJYZKfpE8TAP+swKNga4HjxuTaHInNUZ5bcQKDkDIThl6iFgnpJ3wK1LfeN9pLxs tymmoLZk7mA0YCMnqCHOTGWIyVlC/yWi8TEIBpADj84UOLgrzgdqqI+iN4GgA3yghxy5J8G7csI+ z9uIJ002KmsUa5wtJQHB6zCcx9Wzb8/kCHPjQDXjuAQjCjVcCbhnzwbypm5pfqzb2yA4WzTc34sB YgySV760EGVTSwHhfm2faiMNDQ8G3L+jWoEIz5cxeAAJCYHBt1F0r1nBuKahcCMYpMoDjorhcNOa C1gNbEf69FyKxGVZZ8DqD84JU8t9vjfktNNxtgAxUMA6UBLtpgo1Ap0fc8kdlXm/u63+GB7yK0S+ gaHteC000Xodhe1jLni/vZR9ZDHsTo5JGEfQ0Kiym4iqPyC8b4RBsdc6nhh+X/nwGW/ZsosXzdrH FcSPyvc5I/MTWOt/cITBvt+/eYPfPeE6d3+b3HEEJ/s9rE3OSGogzS6McQjGOZf9LQNZIkjOswAB kJt5lazwDVVHyAUJ8paPmRU4Fra+jnB0kqEbdV8zurp1RSdVq7M8NYbBNZu/KkJrAML5PzfG/nKf Vla2Ak55FcGVcnHYuwli8AHNu9M67bp//5TWPrSDjNCiQhIoW+z1/jyqccRha9O+l9UgyYXloYmj 9rHT4X+8lULxC9QC89ICM278mAJwq/cZ673w0xke1+GW73Fyn1OtkvCfxjmv8d0Plq3vqeNu272b FVReVBEnNjVCuP2ENwhEtq3arfoiIrseada+Qa8PhlW67+ewsb38sQYdKQx5p/4lXcPg9EVqcBd+ aanC6J+w8PrUGA7JzubMqDa6Se+eeNSzfnYeYy9683frh+tioJXHlgNN/wBXuBtIayisUgsFD+kX X3v+srD4f7QVksQlrbOTf7MSjgICvIxUYf5cqdf6MRDnNrtJPv9P2iJObGPdgiethkWxpxEOEoOn NeTs+l00hNHqfwMb+Pbmtn5+dgAAAABJRU5ErkJggg== --_004_SN1PR06MB185389C7648A77192837B9C7D1EB0SN1PR06MB1853namp_-- From nobody Tue Aug 23 06:51:25 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 232DB12D1ED for ; Tue, 23 Aug 2016 06:51:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FPVuunj59Fgo for ; Tue, 23 Aug 2016 06:51:23 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC38C12D501 for ; Tue, 23 Aug 2016 06:51:16 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NDpNTQ006736 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 06:51:24 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471960284; bh=gF0PAOyshj62JiJL+5IVg8rP0cgJnVZ54CcZ9WNQR48=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=O2EeRb03bz4BcBOwS47UB0TnnURj1m9jV156mWXiz/nKdtppy3XRQgW0gVpELPJzo saoeBnVfo1F5CeA5HUNbNbFRSKUFCfKTnkIC8z/mNA6x3/PgJBFxnRrgNJSKvfdoEV i8MUjH6b1iRyJWvPG3DcK/gGf4l8Wp0feO29BU/8= To: Christer Holmberg , Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <2ed46620-eb87-db28-1e2f-8fc3a8021bb4@dcrocker.net> Date: Tue, 23 Aug 2016 06:50:50 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=euc-kr; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 13:51:24 -0000 > Correction: I DO think WGLC is too late for a beauty contest. It is much too late for a debate about aesthetics. It is never too late to fix significant problems. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 07:27:15 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C567512DA08 for ; Tue, 23 Aug 2016 07:27:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jEOGWHvqDr4h for ; Tue, 23 Aug 2016 07:27:09 -0700 (PDT) Received: from mail-qt0-x22d.google.com (mail-qt0-x22d.google.com [IPv6:2607:f8b0:400d:c0d::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6010012DA1A for ; Tue, 23 Aug 2016 07:17:32 -0700 (PDT) Received: by mail-qt0-x22d.google.com with SMTP id w38so41642876qtb.0 for ; Tue, 23 Aug 2016 07:17:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=1Fiu8kFGrr3ZGgVophjmKvIlBc6icxpQfF/zyRkP1ag=; b=YlyfSP54lubhCCqK1WxY01Wb9TqZ9nUS+FiKrWs21XzmMMOBNM59fvs5onkjElOs69 b0XA8g08d2K1eW68TvPRylqsZgXPd8fFvI9GXB4B7vPDqZC8A7JzBRt6C4M7o0V5ojKd MZxg3/QX38U1GjPmsafDgtMyUrQDhv+M5CHET7Z+8eTjWSCNolzdr/tJspjJ9pVIKOYs 3DlXesxy2r7WPLF8k21Y55G4NsqDNptaDX6gTSjkh/6tHCROoelESBdmgJkA5DQnZE7n F/qpnOu7jBZIApLHHSKph1R18YDPT4BwnXeraDEM37WAxpvM7/3QHh6z98nkFmuZFYDh JJMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=1Fiu8kFGrr3ZGgVophjmKvIlBc6icxpQfF/zyRkP1ag=; b=jBNJapBLPElROiteN/E/Y/lqdxKHvjCmrMYM4oLljmtArHkrtv2wHlD1QnhlNnVRdV RQIaSh8iQ8LJjodAXvQIfFzmybaWuaGA63zpxSfSJRKXWakKiWpwpMyetUz14E73X07F RMhqz/z5QIEojqs01p31TjSFNriRZ7tADzu4i+VhpsiHPI6Ul1q27nrvesDkSXMya+mQ eNk3171y1kMa43ZZbuOUDnhRq2kqv043F8+2P7ENiSDv2Sf0SdRLifuZZl+CcoqXVNrO Gzl5H1t1C5Wz3na0c+YcG9hWqyT9jEavhZDRmgkA4uqNtgsj98QvQKhKV4ttSUu4F88w tl+w== X-Gm-Message-State: AEkoous8hrjT7J1IC8nCofJ1raOLLLfCy2CUIc2Z9hB1igY6TOncleSnRRf/mSHN5Z8+hQ== X-Received: by 10.237.47.225 with SMTP id m88mr30780348qtd.106.1471961851353; Tue, 23 Aug 2016 07:17:31 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id v126sm1844724qkh.30.2016.08.23.07.17.29 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 23 Aug 2016 07:17:30 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_F3DE9905-C23B-40A9-A9F4-7C5A89FCF18C" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> Date: Tue, 23 Aug 2016 10:17:26 -0400 Message-Id: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> To: "DOLLY, MARTIN C" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Alex Bobotek , David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 14:27:14 -0000 --Apple-Mail=_F3DE9905-C23B-40A9-A9F4-7C5A89FCF18C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 The work we have done has always treated the number of TNs per cert to = be a variable. It can be one1 per cert, it can be one per carrier, or = anything in between. The way this works is that a cert is valid for a set of TNs, and that = set can change over time. We provide an operation to ask if a given = cert is valid for a given TN, because the list of TNs associated with a = cert changes over time due to porting, new delegations in, etc. It=92s pretty tough, but not impossible, for a large carrier to manage = one TN per cert. On the other hand, it=92s also tough to handle keys = securely when there is one cert per carrier if the carrier has lots of = infrastructure that needs to be able to sign. So the =93pool per = carrier=94 idea is pretty reasonable. Brian > On Aug 23, 2016, at 9:46 AM, DOLLY, MARTIN C wrote: >=20 > The a SHAKEN framework supports a pool of certs per carrier, not cert = per TN >=20 > But it is ok for the RFCs yo have a broader scope for as long as they = are delivered on time >=20 > Martin C. Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards > AT&T > Cell: +1.609.903.3360 > Email: md3135@att.com > =20 >=20 > On Aug 23, 2016, at 9:40 AM, Alex Bobotek > wrote: >=20 >> =20 >> David wrote: >> > I don=92t agree that RFC7340 states that these abuses are =93enabled=94= by the =93ability to impersonate someone else. >> =20 >> +1 --- I don=92t read RFC7340 as saying this either, as my earlier = comments to this group stated. Further, I don=92t believe that RFC7340 = is completely accurate. In my experience, most North American telephony = abuse is facilitated by anonymity and accessibility. In this context = anonymity includes identity masking achieved by random impersonation but = excludes targeted impersonation such as of the IRS using 800-xxx-1040, = and this combined with accessibility is exemplified by the fact that no = government issued ID need be shown to easily obtain low-cost service at = a retail store or over the internet.=20 >> =20 >> An anonymous caller proving to terminating networks or their users = that the caller has been assigned the calling number doesn=92t, on its = own, do much to change this. What really helps is having some control = over the attackers=92 ability to (1) obtain service and (2) complete = calls. Knowing a party that can be held accountable that happens to be = in a position to mitigate the abuse helps with the first, and = reputation-based filters and indications help with the second.=20 >> =20 >> ----Who=92s the Authority?---- >> =20 >> A point that may be pondered relates to the ambiguity surrounding the = =93authority=94 implied by the charter=92s use of the word =93authorized=94= .=20 >> =20 >> =93As its priority mechanism work item, the working group will = specify a SIP header-based mechanism for verification that the = originator of a SIP session is _authorized_ to use the claimed source = telephone number, where the session is established with SIP end to end.=94= =20 >> =20 >> One interpretation is that any signer may be an authority. An = originating telco, in that it can choose (perhaps with guidance from = regulators) whether or not to allow a call to be originated, is clearly = in a position of authority. And such a statement of authority has = significant meaning to reputation-based filters and displays as well as = post-call traceback and mitigation efforts.=20 >> =20 >> Another is interpretation is that the authority must come from proper = assignments and/or delegations traceable to the root authority for that = type of identity. This of course has a different meaning.=20 >> =20 >> It seems that the group has been more focused on the latter, but I do = not have the history to see how this emerged. Could someone explain = whether and how the latter became the dominant focus?=20 >> =20 >> ----Per-TN Certificates---- >> =20 >> Signing with per-telephone-number certificates seems to be lacking = support for implementation by network operators. If anyone has a = contrary view, please express it. Per-call queries to verify = certificate validity would need to check revocation status, and the = infrastructure required to maintain timely revocation status is = expensive at the per-TN scale. If a large service provider needs to = check 2,000 peer service provider certs for revocation every 10 minutes = (which is somewhere around the reaction time of many spam filters), = fine. But scanning CRLs for every call (to check for a cert with = service cancelled or delegation revoked) is burdensome, as is CRL = publication. Yes, optimal implementations can ease the burden, but a = substantial burden remains. =20 >> =20 >> So putting all of this together, it seems that the _pressing_ need is = for signing by the originating service provider using a key assigned to = that service provider, but little more. There is urgency; both delay = in standards approval and additional complexity that slows or inhibits = widespread STIR adoption are undesirable.=20 >> =20 >> =20 >> Regards, >> =20 >> Alex >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir = > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_F3DE9905-C23B-40A9-A9F4-7C5A89FCF18C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 The work we have done has always treated the number of TNs = per cert to be a variable.  It can be one1 per cert, it can be one = per carrier, or anything in between.
The way this works = is that a cert is valid for a set of TNs, and that set can change over = time.  We provide an operation to ask if a given cert is valid for = a given TN, because the list of TNs associated with a cert changes over = time due to porting, new delegations in, etc.

It=92s pretty tough, but not = impossible, for a large carrier to manage one TN per cert.  On the = other hand, it=92s also tough to handle keys securely when there is one = cert per carrier if the carrier has lots of infrastructure that needs to = be able to sign.  So the =93pool per carrier=94 idea is pretty = reasonable.

Brian

On Aug 23, 2016, at 9:46 AM, = DOLLY, MARTIN C <md3135@att.com> wrote:

The a SHAKEN framework = supports a pool of certs per carrier, not cert per TN

But it is ok for the RFCs yo = have a broader scope for as long as they are delivered on time

Martin C. Dolly
Lead Member of Technical Staff
Core = & Government/Regulatory Standards
AT&T
Cell: +1.609.903.3360
Email: md3135@att.com
 

On Aug 23, = 2016, at 9:40 AM, Alex Bobotek <alex@bobotek.net> wrote:

 
David = wrote:
> I don=92t agree that RFC7340 states that these abuses = are =93enabled=94 by the =93ability to impersonate someone else.
 
+1 --- I = don=92t read RFC7340 as saying this either, as my earlier comments to = this group stated.  Further, I don=92t believe that RFC7340 is = completely accurate.  In my experience, most North American = telephony abuse is facilitated by anonymity and = accessibility.    In this context anonymity includes = identity masking achieved by random impersonation but excludes targeted = impersonation such as of the IRS using 800-xxx-1040,  and this = combined with accessibility is exemplified by the fact that no = government issued ID need be shown to easily obtain low-cost service at = a retail store or over the internet. 
 
An anonymous caller proving to = terminating networks or their users that the caller has been assigned = the calling number doesn=92t, on its own, do much to change this.  = What really helps is having some control over the attackers=92 ability = to (1) obtain service and (2) complete calls.   Knowing a = party that can be held accountable that happens to be in a position to = mitigate the abuse helps with the first, and reputation-based filters = and indications help with the second. 
 
----Who=92s= the Authority?----
 
A point that may be pondered relates to the ambiguity = surrounding the =93authority=94 implied by the charter=92s use of the = word =93authorized=94. 
 
=93As its priority mechanism work item, = the working group will specify a SIP header-based mechanism for = verification that the originator of a SIP session is _authorized_ to use the claimed source = telephone number, where the session is established with SIP end to = end.=94 
 
One interpretation is that = any signer may be an authority.  An originating telco, in that it = can choose (perhaps with guidance from regulators) whether or not to = allow a call to be originated, is clearly in a position of = authority.  And such a statement of authority has significant = meaning to reputation-based filters and displays as well as post-call = traceback and mitigation efforts. 
 
Another = is interpretation is that the authority must come from proper = assignments and/or delegations traceable to the root authority for that = type of identity.   This of course has a different = meaning. 
 
It seems = that the group has been more focused on the latter, but I do not have = the history to see how this emerged.  Could someone explain whether = and how the latter became the dominant focus? 
 
----Per-TN = Certificates----
 
Signing = with per-telephone-number certificates seems to be lacking support for = implementation by network operators.  If anyone has a contrary = view, please express it.  Per-call queries to verify certificate = validity would need to check revocation status, and the infrastructure = required to maintain timely revocation status is expensive at the per-TN = scale.  If a large service provider needs to check 2,000 peer = service provider certs for revocation every 10 minutes (which is = somewhere around the reaction time of many spam filters), fine.  = But scanning CRLs for every call (to check for a cert with service = cancelled or delegation revoked) is burdensome, as is CRL = publication.  Yes, optimal implementations can ease the burden, but = a substantial burden remains.  
 
So = putting all of this together, it seems that the _pressing_ need is for signing by the originating service = provider using a key assigned to that service provider, but little = more.   There is urgency; both delay in standards approval and = additional complexity that slows or inhibits widespread STIR adoption = are undesirable. 
 
 
Regards,
 
Alex
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_F3DE9905-C23B-40A9-A9F4-7C5A89FCF18C-- From nobody Tue Aug 23 08:03:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FC7612DAE5 for ; Tue, 23 Aug 2016 08:03:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id stdC_epFslBi for ; Tue, 23 Aug 2016 08:03:22 -0700 (PDT) Received: from mail-pf0-x22b.google.com (mail-pf0-x22b.google.com [IPv6:2607:f8b0:400e:c00::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42D9812D97E for ; Tue, 23 Aug 2016 07:40:29 -0700 (PDT) Received: by mail-pf0-x22b.google.com with SMTP id p64so44434722pfb.1 for ; Tue, 23 Aug 2016 07:40:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ELmFzRNDph3/yf+Iqi/H4ZqMCz9lTCVmmv9SxkoGa7M=; b=FgEcKrETobq40cZFac5Mnl24mhRhiEPA1kS4OtFvts2wuT/5yK08P1eRBnpROLuBEY scwMzNlu2KROpbAfsTrmLuw537lmfOKYpnQoV3uCcO8/a1oOsQJTSiSRUYMxzHn54u0C Poz8uyxcK5jl0vLtJcDiN3jYPS1WzfPx/TNZji9q/KeUSJ2yKRwW0fVFppq4eAbaBGku h3QHTjmkmpj2cKGA7H3VZR13hqx2WKAgIP0kiSJBN9dgN/cEhTklOFxS4UPLSeasdj8n NezecoC9Ljuovsx3c1sCDEKCnY7uSSsMRT51WBfdIpp9MUxkAxrdvK2+U2U49Ze4+9R+ JEuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ELmFzRNDph3/yf+Iqi/H4ZqMCz9lTCVmmv9SxkoGa7M=; b=hfRum26Ky3X+1UUX9iczTkkcllHDeXG5aq0Vl89vT/lnaWjl+3OkzTy68pEftONO9n n1T0Z2QLIgTuQJIqxdp9xnDy6+KaVSockkt68mDfJdw7KVBuq0eyCG6xJGlKh7rTtgKO 0LQOrNXAejKyPIkJFf+dEq+93hvu2KV36WzrwfGoWIe8lr/TedDMycwG+WCaabagShz/ HmQ6ui3kqxJDpLb/ohD37ltXmo8XeeHLFykiNLt8Ae4DrK4a14rKFsrXW00unKVJpqUK YHc6Kzqm00S3y1huffvRdNCl/zctPpmqnrk6oFopgS8unPFRMb1M76ifrJfMwlAcSTMf G3yA== X-Gm-Message-State: AEkooutzqp7m1QwCuFdx6J8ta4aqkAUf6vEqEyAbLqjU/wyFy4QMTAd0vHRrepp7AiYCJQ== X-Received: by 10.98.36.15 with SMTP id r15mr54445103pfj.1.1471963228884; Tue, 23 Aug 2016 07:40:28 -0700 (PDT) Received: from [192.168.1.105] (c-24-19-245-25.hsd1.wa.comcast.net. [24.19.245.25]) by smtp.gmail.com with ESMTPSA id 75sm6377503pfw.92.2016.08.23.07.40.27 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 23 Aug 2016 07:40:27 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-FB5FC4EE-A185-4955-9159-4FC5D3DDAD12 Mime-Version: 1.0 (1.0) From: Bernard Aboba X-Mailer: iPad Mail (13G35) In-Reply-To: <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> Date: Tue, 23 Aug 2016 07:40:25 -0700 Content-Transfer-Encoding: 7bit Message-Id: <90DCAECF-41E9-4212-8894-A2799E733F90@gmail.com> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> To: Alex Bobotek Archived-At: Cc: "stir@ietf.org" , David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:03:27 -0000 --Apple-Mail-FB5FC4EE-A185-4955-9159-4FC5D3DDAD12 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable On Aug 23, 2016, at 06:25, Alex Bobotek wrote: >=20 > So putting all of this together, it seems that the _pressing_ need is for s= igning by the originating service provider using a key assigned to that serv= ice provider, but little more. There is urgency; both delay in standards a= pproval and additional complexity that slows or inhibits widespread STIR ado= ption are undesirable. [BA] If we only have signing by the originating service provider, what are t= he expectations on the provider that come with signing? Is it only that the c= all originates from an authenticated customer (but not necessarily that the T= N is authorized for that customer)? Or can the provider only sign for TNs t= hey are assigned (or for TNs assigned to that customer)? Trying to understan= d what claims made in the draft remain for the most likely initial deploymen= t scenario.= --Apple-Mail-FB5FC4EE-A185-4955-9159-4FC5D3DDAD12 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
On Aug 23, 2016, at 06:25, Alex Bobotek <alex@bobotek.net> wrote:

So putting all of this together, it seems that the _pressing_ need is for signing by the originating service provider using a key assigned to that service provider, but little more.   There is urgency; both delay in standards approval and additional complexity that slows or inhibits widespread STIR adoption are undesirable.


[BA] If we only have signing by the originating service provider, what are the expectations on the provider that come with signing? Is it only that the call originates from an authenticated customer (but not necessarily that the TN is authorized for that customer)?  Or can the provider only sign for TNs they are assigned (or for TNs assigned to that customer)? Trying to understand what claims made in the draft remain for the most likely initial deployment scenario.
--Apple-Mail-FB5FC4EE-A185-4955-9159-4FC5D3DDAD12-- From nobody Tue Aug 23 08:16:20 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9D5212D77C for ; Tue, 23 Aug 2016 08:16:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A-BZwX3Hw9Lb for ; Tue, 23 Aug 2016 08:16:15 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0109.outbound.protection.outlook.com [104.47.38.109]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5088812D96E for ; Tue, 23 Aug 2016 07:50:09 -0700 (PDT) Received: from BY2FFO11FD001.protection.gbl (10.1.14.34) by BY2FFO11HUB005.protection.gbl (10.1.14.163) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.587.6; Tue, 23 Aug 2016 14:50:06 +0000 Authentication-Results: spf=pass (sender IP is 144.230.172.39) smtp.mailfrom=sprint.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=sprint.com; Received-SPF: Pass (protection.outlook.com: domain of sprint.com designates 144.230.172.39 as permitted sender) receiver=protection.outlook.com; client-ip=144.230.172.39; helo=plsapdm3.corp.sprint.com; Received: from plsapdm3.corp.sprint.com (144.230.172.39) by BY2FFO11FD001.mail.protection.outlook.com (10.1.14.123) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.587.6 via Frontend Transport; Tue, 23 Aug 2016 14:50:06 +0000 Received: from pps.filterd (plsapdm3.corp.sprint.com [127.0.0.1]) by plsapdm3.corp.sprint.com (8.15.0.59/8.15.0.59) with SMTP id u7NEWcdp039771; Tue, 23 Aug 2016 09:50:05 -0500 Received: from prewe13m03.ad.sprint.com (prewe13m03.corp.sprint.com [144.226.128.22]) by plsapdm3.corp.sprint.com with ESMTP id 250q45gp7q-1 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 23 Aug 2016 09:50:05 -0500 Received: from PLSWE13M04.ad.sprint.com (2002:90e5:d617::90e5:d617) by PREWE13M03.ad.sprint.com (2002:90e2:8016::90e2:8016) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 23 Aug 2016 10:50:03 -0400 Received: from PLSWE13M04.ad.sprint.com ([fe80::2c01:fcb8:e729:4a7a]) by plswe13m04.ad.sprint.com ([fe80::2c01:fcb8:e729:4a7a%24]) with mapi id 15.00.1210.000; Tue, 23 Aug 2016 09:50:03 -0500 From: "Gorman, Pierce A [CTO]" To: Alex Bobotek , David Frankel , "stir@ietf.org" Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AQHR/UTJrkmIR+/bu0yokDlMVqLw0aBWmXqg Date: Tue, 23 Aug 2016 14:50:02 +0000 Message-ID: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> In-Reply-To: <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.214.116.37] Content-Type: multipart/alternative; boundary="_000_b3a252120b05417a9d908793e3625208plswe13m04adsprintcom_" MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:144.230.172.39; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(438002)(377454003)(189002)(24454002)(199003)(108616004)(102836003)(86362001)(6116002)(3846002)(790700001)(626004)(19300405004)(19580405001)(87936001)(2900100001)(586003)(2950100001)(5660300001)(11100500001)(7696003)(15975445007)(260700001)(81156014)(84326002)(7846002)(356003)(19580395003)(81166006)(33646002)(512954002)(8676002)(7736002)(8936002)(68736007)(24736003)(19625215002)(106466001)(16236675004)(97736004)(5001770100001)(92566002)(107886002)(189998001)(76176999)(2501003)(4546004)(106116001)(2906002)(54356999)(50986999)(5250100002)(21314002); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB005; H:plsapdm3.corp.sprint.com; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11FD001; 1:Ik35bNWSQ9YAipesri8+pt5yF81cqC1qB5tjp/xpa2x2DENBj+jbTRaqvt+qO7HZWxNKTHR324gehxNXtsNRlHQVjDctD5CQt2v0XW2VJ5AwPwFndBuiC+snbZP0tE/C+q3X34gruPpjfPoSIEm1UcPt0/fut5jQklQKvnPvHR64WBoP1s389zslvRIZqxQ2K/O2RJdwT2SaL8lgO94QYH8tIudc4d3jNUMnAm9VL/C8nfcnPwNIqUFk4mqQe3wufDhyagLguKTpxvUPmNOgHNbVEfhYhedhI4M5Z0C4jMLAb02R5rePBuIyJ4bO/06jH5OtmeIPebJBNxCXZb/ajgnXm5hXnqAL7CDiq1pNMlfa98y8VNTZNwN1WYh30GfQUGXgBvxNC7/cSA3u+B6xe6oxMhDnzDe3ImW6O+wsRyOFkaXFHEDFS0etMjPlR1a+oQB5tBGOpXPn3gqLiJ02qUygJcekPqsBpD9LwFxgR9B8n9QprqWPbxFaGlpf4y9OkH0sJ+QaS0csvd9OvdcbzOSIB5hfZm4+5FbthGlHyue89McIjf9+OUonJATPf5NCjtpmRkuKnEkQKsdqDqn5HWnnaifh1Pyf+/RuFWWBDys= X-MS-Office365-Filtering-Correlation-Id: d728e144-d6df-4304-206c-08d3cb64c5b4 X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB005; 2:/4BPpwjRNuXfpUOeatNtPpigB4DY38cOM6oJXZW1on0sIMqdJXpNJnMXd2Sood6QO0tRBg0S4poABRzptcO+LtJcVQxVLzUHcokQOZL0bRe+HOXve5z8jKoGMMwm1S00CIWBxYb/1PaSOW/5HhlE8r0oyYSQ2zIGkH7JZb6ZfYkqUjpMymkxacxModIj7RNl; 3:WigW2v+cjGqbzttKn5zB/Jptu0h2jNZqjCn3ve2iWfHOhfBBcvA1X9vy6TY9DQrvUCLypXAtbmCbilkNHpdywEVAxRsu2SO/xrjBkVqsgSVf40ePmiXt5vlrIyRCFn8HSKMILAwqi+jWaQrxu/ctk+Nt3w8pAhyroURbPVUkVGDLuTkOoYauNGhXoDmPR+03r8L7HYeWYD3mJUZ8ZTAtjspCUpOzHt2szyxEsKhjxjQumZnK/7Q9Gs2Xf5KDoMrm37FtnL/dHlVQRN92dhfxng==; 25:n9MzfvUOs+JflQggBODdD4Dp/8vZogS0hqX8/74QlXOwQAFE8B/D0PXCLp6PzUq4Hd0xaG25NJTPefIe1Hl0zCNFGnZMk6rxjm2+LjXb/70wMSmXEIkV62kW0T/aHpVhHAr3/vOoy5CZHfwyO58HHer4GFLaPIpcGJ3ZWbBq0NCJ+Eg5uEE4JvXP1p8I2qzYnkAaJ66TGErhmcxqaSv2Hgb5WxXjIA4OHDkTrk4fFwxY0rS2JbnXgeNjUcUOGDMxjlQsAQrA3C8KHEJeSdR93Yvo9Y1h9CW9m+wOjbNmsrFM/C3op78p+gNvfAMWXzmjQa+j8S6e2XsXVlGpOyqL7hO7FIaXlovOASdqz+ijSN4DR9p01OPDXwVJFL/HyGVkXRnFXDKDvYPugAbVzfuHPSMCAFA1n2bBaXeOw+2eT1HAh9T7w9RZnfdhn2Mt0wHO X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(8251501002); SRVR:BY2FFO11HUB005; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB005; 31:mm/M0J/X9UPbbgyIkh7msDgWZvqD+69/MRzb50eQBJlkyX/NSC7WrghVyR/rGv9aSVbe43ciyzHAx6ytkqyp4ix1CREuWGvNFYqv9B1Ia6CIBGj80OQ1khHCDIe8JXhKYhxu4eAtpukuFVE8omnes+6vMVYWBy7dtCBfYcgJ2ZDPFOcqNEtLFUTCmakdQ8tlCxtz9tHOuniWOOFvZ+GVI2akw4ZfhTXaE4ChRIsaG2k=; 20:e/Ak6F6AJfJ0WJ9A8k0ksG+7SZsKuTg511vvupwULNFmo2L227dQJ7aBfHQeNfq4tGRTF07B9kvCsmom2S15w41hwf5nMLZZ1eWP8c9QX3LQaT8umx1P0g8+FxSt/VXd/oiVkLu605zoo7kMhDVikuCt2sL0eazJKmrXUxBvIs3peR1Ufs0bc8au/PWZuPp60Ul3LLC0lq6C6m7vkKKasTLSIlnf6Vl2A9OKDIkDHLG/PN66nR8z+p6cyMLIAHUrAcY+KoNXYCqpAKCXwzSY04LVUCX5ev3TeYQcDPr1NfoaRJ5QTTDlp2X/2Yap2UbyHKQcqGv2KleWLcqLqCQcQiyOEHNg4d+TJDQRXlBXTi5/CVPnqZSPGA4bU+8/XVCIAFjnVA14bwso/pdcuANP6y/8setc33amy6uSoi/x9oc= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(13017025)(13015025)(13023025)(13024025)(13018025)(8121501046)(5005006)(3002001)(10201501046)(6055026); SRVR:BY2FFO11HUB005; BCL:0; PCL:0; RULEID:; SRVR:BY2FFO11HUB005; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB005; 4:PuUl4zi+0gTOocgnMnSiu/a9qg1S8Bd/gMI6rNWqHiEnUmvNjLOKP43SQckFgqtp5cKdmnNxsPFpnjihiqQ0ZLxaZzeaPgyE05VOPH79eSHOPX9XWQ/m/mXw/BlOL5NjMig11NQ3t76xBrS5NJuf8huBtsOhKQV7T3PuqGx/NeKeh2eGUcpZNLYpIlxcNAEgd4V0LQm6GLCS20j0tx37OShq2CjELyCTiX3cEKfixxJn35bJ4ZanY0Qj7tXnCUGRO3WYXmEd4gDvOzRpXExVXE6jglEJCem+mP1XMWytwlW9pwau+FVmqdjxtjdoxKpzR85KgsHLm+O5buWLviHWOFhzK1mupfHh3HKQuIdQRuU7nOFCywhM4+1OF/7DPNImNkPgw/d8VIUaXNsalwi//YWIkNrWn7ZIaWVQddQ2GVcVX0sXmJxXTFom0CTsLvOH2f9hNvH4bktM7PQTER/IU1YsRvhf5yfRrbeOLP1uJaG7w27bQbWKr/CdzPKmyuARdPdjCouZ4/kYHVaYTqjqLHOu/zdxNrHfeV1/qlsxjDY= X-Forefront-PRVS: 004395A01C X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2FFO11HUB005; 23:Fp9Uxe1S1anmZ4XDq9ltwAYPtTZQFFFmJDPcjAL8?= =?us-ascii?Q?GEHOQwIV85MKF775roIQ7tFpXa6+rPaxuSHjEpisSEA1F+wn4kf9CTm/QFBJ?= =?us-ascii?Q?6ix3u/rDf5OoX0xAJGZ4ry4z5+wM+3YRszoQkcKR6f34LWWxRzlTR+FBQWE6?= =?us-ascii?Q?7luYHq6JN7m58kJTV+DN7x/bmDz4S0Vs4W6DmZJsKDpUtQpu1JUdXYXmzBV7?= =?us-ascii?Q?Y1tr4C1ELzirX/86rfCFdyvstyrMsxU3vUr31OhFX3LwwTGUD8o0kuCDqWFF?= =?us-ascii?Q?BlEn+uOGYKjd8mpeOUpYIl3TUlH+T3jc6zeUgGT3UXa5aJ138xHNQZbhhSxc?= =?us-ascii?Q?ccFjubWbQn9kDqdC40jKCdAmtbqMsU0XT85ze1/x0HmFFYQKZ0XeScBsOkz6?= =?us-ascii?Q?vE18bSm2+nCxLb/fRFa8OxTsjkHRu6x79Pn82lTgWaanQiviEazs6tTOT4zZ?= =?us-ascii?Q?gs4Od1JvAgji0isk5r/+JVR0zPJRzleCPN3k7N7ypfFfFZEpBy6mpnGHLMuI?= =?us-ascii?Q?nffWLrfm9mhoqfu/3XuI1z3nP2rS3cB1eKxB6EsQy3hSqhndwgqbDOh0dP7Z?= =?us-ascii?Q?EQq3Y3fRm6+niLQj5iH1+XUTaeZuen4hBOEWmlbULPtDJl8iXvDOaUVsFc2Z?= =?us-ascii?Q?v5J50VzODgR9N5CL7bOAhJbmTIVmE3Was9rXPHzZ9lc8/p2NtUSx7IML9jAK?= =?us-ascii?Q?dwNYZLOfI4n6UzEKMyX3HFUihpwwbFEJUMWzO/qKqhxvWfiqwl+JDNGX1xqg?= =?us-ascii?Q?zvvtUIPYANtKcRrvVGSpzLpwV3lblSVnDOuGGjJ3ZyYWzN7i4hDkQwX1YKvG?= =?us-ascii?Q?3BTG98N5tLgXSrl30wco0dnJ6YEn13+bYwJCVPWS+YMkz9HQ9rSH8bi1ZBFA?= =?us-ascii?Q?FRmjU2cOVWRJTWUoYpVLI/1I52Gp5VhgGaAhAk4MHe7s+5HTQvjTc/GvecYA?= =?us-ascii?Q?RPF1TMDFKjk3DvXJ3om+BQRPSkYZJhQtK1ygZbn+8GRFo0BnqH1UYdiOuiPM?= =?us-ascii?Q?OPen1gIhQfdaO3uYVzNVGOub0OVP3vFDyxl/S7rHzJkmCpbxkKHAktjQButy?= =?us-ascii?Q?pJgsgMY4QgvDl3H+HFFZuQMJVC+AWPYcdf1he34fxEK5HJKjo3UiD7PWQWlb?= =?us-ascii?Q?uUYJVMsYGz1VOWhdRgMjsXL4wzupcf7a0QVwfkltabojrElNF0kK3z3X1nnN?= =?us-ascii?Q?x9jKBZWzcohEdmMR9CZG3irFqhALw3If2mEevB+jYqjLCSK93W6rsUhMHeXU?= =?us-ascii?Q?/TW2qyXKL/N7nqsg4EmldMS+//8o48RYbDoIKuLsZA0m4RBs34oHz29iZGGx?= =?us-ascii?Q?nH17yi+dNJyvJmSiZVglAa8WrArMQR7ZV3e7ja36XGBxO3/IW4Up7jc9hXNx?= =?us-ascii?Q?nNPYkA=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11HUB005; 6:D/WIa6jpApwZRdUPn6mdDbhRQUEIguNnAiux9FhhambmIL+2BLz9I+R8TNtDb5EGtgp2R3n66ivyO2jhC9FYxygQcVrqXXqM7za6yX849WxDo7P6Aa9d2UZG5hcjH0HzJKFAFcJPG4dDE1WgLNDzj8GJy+UQHPvYXgxYetZ3ymcbyO4nL2oD/rvr8OC+2qUDpk3MttZ5dIG7Oj02vQW/yiyWHQilZEYC4ZRqroI20o7ys8jP9g4o/hETKpCcH9lf8AfNCAunqnE826AZnZIH5eyE6hsBR3qPQLOshs4kCsNJNxq2y+wENhYosUnRQDuGrTLBnr46rqiytWVwv4mN8w==; 5:eGYdOkDfsQuzP4PsP6ieWT2CS4D81SJ/etRWbjRNWscouG2aFHXUiUPACQqtjU4NiVYvHGbIU1s5M3ZrpL6t83yt4IuLwYByWj7vXIAbg5UIbSK7aJN08kFh/ogY/2jAXejLocHuxzWd2/bDN0p5hQ==; 24:PRMKC7td8frRhwBrIIbsDT4mQ6NzvLwOQwaVN2tTW+XzwC9BMgHH4nYMSkFcHdevjZLDjJqmJ+M59jj9t09mnDYziERMmNaGENpgwV1HFU0=; 7:CELGWU4gjVarVFK3U2cP4pJdt4gP2cEqpjYguJG2jlPjn1YENtshTCISHGCZy4lCGSe9J1ksLeOKtlVxy3rhf007vFKQ4XnkdCN2BnPP8iM1qpdLtyxcV1MvXqvP51BvocPNodQ7juEg0dkxzBtua8GQOzzvxoRudJIarDXKZ6/9ZDDStstlW33Qf8xXczIoDpYNexq/q+Wd+80MhdMGUpq4EOxmIzgfJLbegHwPyjSJuLx6McEG7NcUtGhJ8oYD SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: sprint.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Aug 2016 14:50:06.1428 (UTC) X-MS-Exchange-CrossTenant-Id: 4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4f8bc0ac-bd78-4bf5-b55f-1b31301d9adf; Ip=[144.230.172.39]; Helo=[plsapdm3.corp.sprint.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2FFO11HUB005 Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:16:20 -0000 --_000_b3a252120b05417a9d908793e3625208plswe13m04adsprintcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Alex wrote: ------------------------------------------------------------------ ----Who's the Authority?---- A point that may be pondered relates to the ambiguity surrounding the "auth= ority" implied by the charter's use of the word "authorized". "As its priority mechanism work item, the working group will specify a SIP = header-based mechanism for verification that the originator of a SIP sessio= n is _authorized_ to use the claimed source telephone number, where the ses= sion is established with SIP end to end." One interpretation is that any signer may be an authority. An originating = telco, in that it can choose (perhaps with guidance from regulators) whethe= r or not to allow a call to be originated, is clearly in a position of auth= ority. And such a statement of authority has significant meaning to reputa= tion-based filters and displays as well as post-call traceback and mitigati= on efforts. Another is interpretation is that the authority must come from proper assig= nments and/or delegations traceable to the root authority for that type of = identity. This of course has a different meaning. It seems that the group has been more focused on the latter, but I do not h= ave the history to see how this emerged. Could someone explain whether and= how the latter became the dominant focus? ------------------------------------------------------------------ My opinion is the focus on the latter, if there is a focus, is a legalistic= interpretation. A number of contributors have pointed to the idea that si= nce carriers transport calls and often delegate or assign Telephone Numbers= to their enterprise, government, and consumer customers, carriers should b= e held liable for calls placed by or terminated for bad actors. To me that is like holding turnpike operators liable for crimes committed b= y criminals who've paid for the opportunity to drive on the privately maint= ained roadways. Yes, turnpike operators admit criminals to their network, = and may have had reason to suspect them, and victims might have wished the = turnpike operators had not permitted them access, but one person's protecti= on can be another person's discrimination. And the ambiguity of knowing, to a legally liable certainty, that a calling= number was "authorized" to be used by a call originator can be more or les= s difficult depending upon the circumstances of the call origination access= and delegation of numbering (and signing) authority. I assume that the fastest possible way to implement call signing and interp= retation using STIR technology is by US carriers (because of the intense pr= essure from the US government because of the intense pressure from US voter= s). I also assume some sort of safe harbor guarantees need to be included = in recommendations to government law and policy makers to address liability= concerns of carriers. Pierce From: Alex Bobotek [mailto:alex@bobotek.net] Sent: August 23, 2016 8:25 AM To: David Frankel ; stir@ietf.org Subject: Re: [stir] My Editorial Suggestions on RFC4474bis David wrote: > I don't agree that RFC7340 states that these abuses are "enabled" by the = "ability to impersonate someone else. +1 --- I don't read RFC7340 as saying this either, as my earlier comments t= o this group stated. Further, I don't believe that RFC7340 is completely a= ccurate. In my experience, most North American telephony abuse is facilita= ted by anonymity and accessibility. In this context anonymity includes i= dentity masking achieved by random impersonation but excludes targeted impe= rsonation such as of the IRS using 800-xxx-1040, and this combined with ac= cessibility is exemplified by the fact that no government issued ID need be= shown to easily obtain low-cost service at a retail store or over the inte= rnet. An anonymous caller proving to terminating networks or their users that the= caller has been assigned the calling number doesn't, on its own, do much t= o change this. What really helps is having some control over the attackers= ' ability to (1) obtain service and (2) complete calls. Knowing a party t= hat can be held accountable that happens to be in a position to mitigate th= e abuse helps with the first, and reputation-based filters and indications = help with the second. ----Who's the Authority?---- A point that may be pondered relates to the ambiguity surrounding the "auth= ority" implied by the charter's use of the word "authorized". "As its priority mechanism work item, the working group will specify a SIP = header-based mechanism for verification that the originator of a SIP sessio= n is _authorized_ to use the claimed source telephone number, where the ses= sion is established with SIP end to end." One interpretation is that any signer may be an authority. An originating = telco, in that it can choose (perhaps with guidance from regulators) whethe= r or not to allow a call to be originated, is clearly in a position of auth= ority. And such a statement of authority has significant meaning to reputa= tion-based filters and displays as well as post-call traceback and mitigati= on efforts. Another is interpretation is that the authority must come from proper assig= nments and/or delegations traceable to the root authority for that type of = identity. This of course has a different meaning. It seems that the group has been more focused on the latter, but I do not h= ave the history to see how this emerged. Could someone explain whether and= how the latter became the dominant focus? ----Per-TN Certificates---- Signing with per-telephone-number certificates seems to be lacking support = for implementation by network operators. If anyone has a contrary view, pl= ease express it. Per-call queries to verify certificate validity would nee= d to check revocation status, and the infrastructure required to maintain t= imely revocation status is expensive at the per-TN scale. If a large servi= ce provider needs to check 2,000 peer service provider certs for revocation= every 10 minutes (which is somewhere around the reaction time of many spam= filters), fine. But scanning CRLs for every call (to check for a cert wit= h service cancelled or delegation revoked) is burdensome, as is CRL publica= tion. Yes, optimal implementations can ease the burden, but a substantial = burden remains. So putting all of this together, it seems that the _pressing_ need is for s= igning by the originating service provider using a key assigned to that ser= vice provider, but little more. There is urgency; both delay in standards= approval and additional complexity that slows or inhibits widespread STIR = adoption are undesirable. Regards, Alex ________________________________ This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message. --_000_b3a252120b05417a9d908793e3625208plswe13m04adsprintcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Alex wrote:

-----------------------------= -------------------------------------

----Who’s the Autho= rity?----

 

A point that may be ponde= red relates to the ambiguity surrounding the “authority” implie= d by the charter’s use of the word “authorized”. 

 

“As its priority m= echanism work item, the working group will specify a SIP header-based mecha= nism for verification that the originator of a SIP session is _author= ized_ to use the claimed source telephone number, where the session is established with SIP end to end.” =

 

One interpretation is that any signer may be an authority.  An or= iginating telco, in that it can choose (perhaps with guidance from regulato= rs) whether or not to allow a call to be originated, is clearly in a position of authority.  And such a statement of autho= rity has significant meaning to reputation-based filters and displays as we= ll as post-call traceback and mitigation efforts. 

 

Another is interpretation is that the authority must come from proper = assignments and/or delegations traceable to the root authority for that typ= e of identity.   This of course has a different meaning. 

 

It seems that the group has been more focused on the latter, but I do = not have the history to see how this emerged.  Could someone explain w= hether and how the latter became the dominant focus? 

-----------------------------= -------------------------------------

 

My opinion is the focus on the latter, if there is a focus, is a leg= alistic interpretation.  A number of contributors have pointed to the = idea that since carriers transport calls and often delegate or assign Telephone Numbers to their enterprise, government= , and consumer customers, carriers should be held liable for calls placed b= y or terminated for bad actors.

 

To me that is like holding turnpike operators liable for crimes comm= itted by criminals who’ve paid for the opportunity to drive on the pr= ivately maintained roadways.  Yes, turnpike operators admit criminals to their network, and may have had reason to sus= pect them, and victims might have wished the turnpike operators had not per= mitted them access, but one person’s protection can be another person= ’s discrimination.

 

And the ambiguity of knowing, to a legally liable certainty, that a = calling number was “authorized” to be used by a call originator= can be more or less difficult depending upon the circumstances of the call origination access and delegation of numbering (= and signing) authority.

 

I assume that the fastest possible way to implement call signing and= interpretation using STIR technology is by US carriers (because of the int= ense pressure from the US government because of the intense pressure from US voters).  I also assume some sort of = safe harbor guarantees need to be included in recommendations to government= law and policy makers to address liability concerns of carriers.

 

Pierce

 

From: Alex Bobotek [mailto:alex@bobotek.net] =
Sent: August 23, 2016 8:25 AM
To: David Frankel <dfrankel@zipdx.com>; stir@ietf.org
Subject: Re: [stir] My Editorial Suggestions on RFC4474bis

 

 

David wrote:

> I don’t agree that RFC7340 states that th= ese abuses are “enabled” by the “ability to impersonate s= omeone else.

 

+1 --- I don’t read RFC7340 as saying this= either, as my earlier comments to this group stated.  Further, I don&= #8217;t believe that RFC7340 is completely accurate.  In my experience= , most North American telephony abuse is facilitated by anonymity and accessibility.    In this context anonymity includes id= entity masking achieved by random impersonation but excludes targeted imper= sonation such as of the IRS using 800-xxx-1040,  and this combined wit= h accessibility is exemplified by the fact that no government issued ID need be shown to easily obtain low-cost service at a retail stor= e or over the internet. 

 

An anonymous caller proving to terminating networks = or their users that the caller has been assigned the calling number doesn&#= 8217;t, on its own, do much to change this.  What really helps is havi= ng some control over the attackers’ ability to (1) obtain service and (2) complete calls.   Knowing a party tha= t can be held accountable that happens to be in a position to mitigate the = abuse helps with the first, and reputation-based filters and indications he= lp with the second. 

 

----Who’s the Authority?----

 

A point that may be pondered relates to the ambiguit= y surrounding the “authority” implied by the charter’s us= e of the word “authorized”. 

 

“As its priority me= chanism work item, the working group will specify a SIP header-based mechan= ism for verification that the originator of a SIP session is _authori= zed_ to use the claimed source telephone number, where the session is established with SIP end to end.” =

 

One interpretation is = that any signer may be an authority.  An originating telco, in that it= can choose (perhaps with guidance from regulators) whether or not to allow= a call to be originated, is clearly in a position of authority.  And such a statement of authority has signifi= cant meaning to reputation-based filters and displays as well as post-call = traceback and mitigation efforts. 

 

Another is interpretat= ion is that the authority must come from proper assignments and/or delegati= ons traceable to the root authority for that type of identity.   = This of course has a different meaning. 

 

It seems that the grou= p has been more focused on the latter, but I do not have the history to see= how this emerged.  Could someone explain whether and how the latter b= ecame the dominant focus? 

 

----Per-TN Certificate= s----

 

Signing with per-telep= hone-number certificates seems to be lacking support for implementation by = network operators.  If anyone has a contrary view, please express it.&= nbsp; Per-call queries to verify certificate validity would need to check revocation status, and the infrastructure required to = maintain timely revocation status is expensive at the per-TN scale.  I= f a large service provider needs to check 2,000 peer service provider certs= for revocation every 10 minutes (which is somewhere around the reaction time of many spam filters), fine.  B= ut scanning CRLs for every call (to check for a cert with service cancelled= or delegation revoked) is burdensome, as is CRL publication.  Yes, op= timal implementations can ease the burden, but a substantial burden remains. 

 

So putting all of this= together, it seems that the _pressing_ need is for signing by the o= riginating service provider using a key assigned to that service provider, = but little more.   There is urgency; both delay in standards approval and additional complexity that slows or i= nhibits widespread STIR adoption are undesirable. 

 

 

Regards,

 

Alex



This e-mail may contain Sprint proprietary information intended for the sol= e use of the recipient(s). Any use by others is prohibited. If you are not = the intended recipient, please contact the sender and delete all copies of = the message.
 --_000_b3a252120b05417a9d908793e3625208plswe13m04adsprintcom_-- From nobody Tue Aug 23 08:16:38 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B887512D9A1 for ; Tue, 23 Aug 2016 08:16:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8lgMSRLo9ADe for ; Tue, 23 Aug 2016 08:16:19 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A143212DBB8 for ; Tue, 23 Aug 2016 07:50:13 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NEoKv0009380 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 07:50:20 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471963820; bh=zOAqJ6eOm5y3Wu5JO1IlYDKcL8t/pBrQTmubn4VxhL0=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=fLwTvrHA0Y4WDMQw38F1Y0pwpH/0SvNvFIZ+nk/+3UgEhJxfvJnXw2nBisqNmf1pC NiTC2AYSZJRXYZBxhR9La8B2hJZta7c2WlvSBxsfGpCYWTFFEztKRpfe2shboU+Xjm C5ms6r6iy4E3m7/M/lSrkJNLZlTP5d6CDJherXp8= To: Brian Rosen , "DOLLY, MARTIN C" References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <6c5ef832-1315-6af7-2eb7-a3c9fbd44f9a@dcrocker.net> Date: Tue, 23 Aug 2016 07:49:47 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" , Alex Bobotek Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:16:24 -0000 On 8/23/2016 7:17 AM, Brian Rosen wrote: > Its pretty tough, but not impossible, for a large carrier to manage one > TN per cert. Where is the operational history that demonstrates meaningful viability for use of certs *in this way* and *at this scale*? I am not aware of any. In theory, there is no difference between theory and practice... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 08:30:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A28B612D1D5 for ; Tue, 23 Aug 2016 08:30:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3oovxhn60BiE for ; Tue, 23 Aug 2016 08:30:35 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4A2212D98B for ; Tue, 23 Aug 2016 08:09:23 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NF9Vrw011133 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 08:09:31 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471964971; bh=F+b3UAQsNrbfwEo/ZANg5V4IONfD8j7ZQefz7nK+zNo=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=AYJ28l4HWzfrVN7LL8iYfCCG2iI/plTg4cl5i4JOjM09IlwccDyygKHLNmxaP7FYP 6+OwF64SIbckekpLZhWuwwJiKW4+pqUTcUB2bOxrwXtYHOJAl/YIi27V01uLM0tC9O nAHS6OmdcYkwORA7M7aLqP4lyxWVF4UxYYz3GM38= To: Christer Holmberg , Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> Date: Tue, 23 Aug 2016 08:08:58 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:30:36 -0000 On 8/23/2016 4:58 AM, Christer Holmberg wrote: > The idea (afaik) is > to split the encoded string into different pieces, and place those in > different SIP header field/parameters. But, HOW that split is done, and > how the string is re-generated on the receiving side, must be clarified. The need for this additional packaging is a basic specification requirement. (Again, I don't understanding submitting a document for last call that is missing basic specification details.) I also don't understand the need for breaking the json result into multiple SIP header fields. Why isn't it just stuffed into a single header field, like STIR-Signature: or the like? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 08:36:07 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8608612D5C3 for ; Tue, 23 Aug 2016 08:35:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xrS9o0tgPcX6 for ; Tue, 23 Aug 2016 08:35:53 -0700 (PDT) Received: from mail-it0-x230.google.com (mail-it0-x230.google.com [IPv6:2607:f8b0:4001:c0b::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 090F712D5A2 for ; Tue, 23 Aug 2016 08:25:47 -0700 (PDT) Received: by mail-it0-x230.google.com with SMTP id x131so153932739ite.0 for ; Tue, 23 Aug 2016 08:25:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=OLP6/j9YwVOHMz9cYc4uCpQsVU/OknF7bbx92YRWtzw=; b=Eq8LHl3WTMKu3HSO0cgzL8H8xAA7hWcxHqmrrMfqNuuYA2ET+NQrO7NjSrdk0j3o1A W2/RJPqiYIi/ywu81L/RoFLzzNalG0r0/EIQ2rMRCV4wnVtedyccdkeX6aaxD0D+KZiv f/3nq9ypxiyYTzvk4QKqV2MtabOzW+wOHQkckcxHmLWUXLfYJKDEeT3KNcFYS3vzSrAt sIeUFrbiJLwPje/X1Btpxg75YD2r2Rkh1Vqf4fHj3F3pCw3bNMvtuaOYnWDwEgl7BXk0 mDuiw56csxxJfajqsLWzXIHQw8HRbCEmyqjCQEpkN1qpbi4jSml1NDxVpoNaqWoOzkxI KnOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=OLP6/j9YwVOHMz9cYc4uCpQsVU/OknF7bbx92YRWtzw=; b=LZgcci232UstViGGM0R49u0kKa8ycJfivRD+WzHgeOnZv83bKUpmjpi0IsSGFd7knA kNM2W6Zf9yrBifc86ZAx+rwxfvh+Ju3PL8cbbh0WQbfy0i1UGenbJ45cuy2FyvxIcKu8 hFUtGKLUpuHjgabmxl2mMr2ZC1T0s1qBqV9T2SjpkJYYpPYWxW6GCNJzVY17T4Imlasm Pvgun2gj+mOKkGVY1/9aEVdXdyp66t0vuy4V3FoMPjNGr7wHjS4Bj0hf2l3bNozcjo8+ yLwxTR+pyRBCbVHTlaEz3L5hV3THENGVPvDzWV7vId+kfRKk+B0ak0RcEZ27Wte2qSqG nyPw== X-Gm-Message-State: AEkooutc3r0d+7lRZSJvSX0YWMi+Lq6w+4HVFoRvq1tGuOHL9gADSpYI/yN9otWZuCDlJQ== X-Received: by 10.107.15.145 with SMTP id 17mr34023096iop.77.1471965946287; Tue, 23 Aug 2016 08:25:46 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id u63sm1547234ita.0.2016.08.23.08.25.45 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 23 Aug 2016 08:25:45 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_1F09A16D-4754-4479-880E-B84F47E50F3F" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <90DCAECF-41E9-4212-8894-A2799E733F90@gmail.com> Date: Tue, 23 Aug 2016 11:25:43 -0400 Message-Id: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <90DCAECF-41E9-4212-8894-A2799E733F90@gmail.com> To: Bernard Aboba X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Alex Bobotek , David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:35:55 -0000 --Apple-Mail=_1F09A16D-4754-4479-880E-B84F47E50F3F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 There isn=E2=80=99t any real way to say that a particular service = provider is a =E2=80=9Cgood=E2=80=9D SP and another one is a =E2=80=9Cbad=E2= =80=9D or even =E2=80=9Cquestionable=E2=80=9D SP. The only way to make = a claim that means something is =E2=80=9CI have a cert that covers the = TN that the call claims to be from, and my signature is proof that it = came from me, the service provider who was delegated the TN". If you = don=E2=80=99t want the authorities taking action against you, then you = probably want to make sure that you delegated that TN to the customer = that is sending the call via your service, but the signature doesn=E2=80=99= t make that claim. It claims that you, the service provider, was = delegated the TN. If you, at some point, arrange for the customer to get a cert with your = delegation of the TN to him, then he can sign, claiming he was delegated = the TN. =20 We sometimes use the expression =E2=80=9Csign on behalf of the = customer=E2=80=9D, but that isn=E2=80=99t the claim. The claim is YOU = (the SP) were delegated the number, and it comes from your service. Brian > On Aug 23, 2016, at 10:40 AM, Bernard Aboba = wrote: >=20 > On Aug 23, 2016, at 06:25, Alex Bobotek > wrote: >=20 >> So putting all of this together, it seems that the _pressing_ need is = for signing by the originating service provider using a key assigned to = that service provider, but little more. There is urgency; both delay = in standards approval and additional complexity that slows or inhibits = widespread STIR adoption are undesirable. >=20 > [BA] If we only have signing by the originating service provider, what = are the expectations on the provider that come with signing? Is it only = that the call originates from an authenticated customer (but not = necessarily that the TN is authorized for that customer)? Or can the = provider only sign for TNs they are assigned (or for TNs assigned to = that customer)? Trying to understand what claims made in the draft = remain for the most likely initial deployment scenario. > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_1F09A16D-4754-4479-880E-B84F47E50F3F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 There isn=E2=80=99t any real way to say that a particular = service provider is a =E2=80=9Cgood=E2=80=9D SP and another one is a = =E2=80=9Cbad=E2=80=9D or even =E2=80=9Cquestionable=E2=80=9D SP. =  The only way to make a claim that means something is =E2=80=9CI = have a cert that covers the TN that the call claims to be from, and my = signature is proof that it came from me, the service provider who was = delegated the TN".  If you don=E2=80=99t want the authorities = taking action against you, then you probably want to make sure that you = delegated that TN to the customer that is sending the call via your = service, but the signature doesn=E2=80=99t make that claim.  It = claims that you, the service provider, was delegated the TN.

If you, at some point, = arrange for the customer to get a cert with your delegation of the TN to = him, then he can sign, claiming he was delegated the TN. =  

We = sometimes use the expression =E2=80=9Csign on behalf of the customer=E2=80= =9D, but that isn=E2=80=99t the claim.  The claim is YOU (the SP) = were delegated the number, and it comes from your service.

Brian

On Aug 23, 2016, at 10:40 AM, Bernard Aboba <bernard.aboba@gmail.com> wrote:

On Aug 23, 2016, at 06:25, = Alex Bobotek <alex@bobotek.net> wrote:

So putting all of this = together, it seems that the _pressing_ need is for = signing by the originating service provider using a key assigned to that = service provider, but little more.   There is urgency; both = delay in standards approval and additional complexity that slows or = inhibits widespread STIR adoption are = undesirable.

[BA] If = we only have signing by the originating service provider, what are the = expectations on the provider that come with signing? Is it only that the = call originates from an authenticated customer (but not necessarily that = the TN is authorized for that customer)?  Or can the provider only = sign for TNs they are assigned (or for TNs assigned to that customer)? = Trying to understand what claims made in the draft remain for the most = likely initial deployment scenario.
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_1F09A16D-4754-4479-880E-B84F47E50F3F-- From nobody Tue Aug 23 08:45:50 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BCDC12D0E6 for ; Tue, 23 Aug 2016 08:45:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q56cTxvy1Zfx for ; Tue, 23 Aug 2016 08:45:47 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0132112D0C4 for ; Tue, 23 Aug 2016 08:45:46 -0700 (PDT) X-AuditID: c1b4fb3a-c91fe700000009bd-5c-57bc6fa7e101 Received: from ESESSHC024.ericsson.se (Unknown_Domain [153.88.183.90]) by (Symantec Mail Security) with SMTP id D7.FF.02493.7AF6CB75; Tue, 23 Aug 2016 17:45:45 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC024.ericsson.se ([153.88.183.90]) with mapi id 14.03.0301.000; Tue, 23 Aug 2016 17:45:43 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Eric Rescorla Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR/JI0ubFrdbKggkCO9F2iW0BZU6BWhCyAgAABtACAACpqMA== Date: Tue, 23 Aug 2016 15:45:42 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> In-Reply-To: <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.149] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjkeLIzCtJLcpLzFFi42KZGbE9Sndl/p5wg5cNAha/P31gs1jx+hy7 xfK125gcmD0u7TzJ5rFkyU8mj8mP25gDmKO4bFJSczLLUov07RK4MvZ+OMZc0MdZ8fTDcaYG xoXsXYycHBICJhLTz2xn62Lk4hASWM8oser7F2YIZwmjxK1nD4CqODjYBCwkuv9pgzSICHhK 7Gm5wApiMwuoS7x49AZskLBAoMTKrStYIGqCJE6+eMkOYTtJ7NxxhxHEZhFQlXjU1gPWyyvg K/F58wY2EFtI4DGLxLl9cSA2p4CDxOS9e8B6GQXEJL6fWsMEsUtc4taT+UwQRwtILNlznhnC FpV4+fgfK4StJLH28HYWiHodiQW7P7FB2NoSyxa+ZobYKyhxcuYTlgmMorOQjJ2FpGUWkpZZ SFoWMLKsYhQtTi0uzk03MtJLLcpMLi7Oz9PLSy3ZxAiMnYNbflvtYDz43PEQowAHoxIP74Ow PeFCrIllxZW5hxglOJiVRHiVcoFCvCmJlVWpRfnxRaU5qcWHGKU5WJTEef1fKoYLCaQnlqRm p6YWpBbBZJk4OKUaGCN+3dyYVbT0xcS5ql9N4j4/TZppalnjvz0m63rERQEWoW3uFUlyL7hC lJc2/qxdujr9bZfNvYjlvto3jA5fDuZQ/PBOpX2/W53gjNNMbTaPDPWtbh68pX+pdabDt6BX V/jcD4g2Pqm4wq/83ail+r6wH/ur2H3/Ug/U3IxtmnGO6ejEojk5P5VYijMSDbWYi4oTAQps EUmZAgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:45:48 -0000 Hi, >> The idea (afaik) is >> to split the encoded string into different pieces, and place those in=20 >> different SIP header field/parameters. But, HOW that split is done,=20 >> and how the string is re-generated on the receiving side, must be clarif= ied. > > The need for this additional packaging is a basic specification requireme= nt. (Again, I don't > understanding submitting a document for last call that is missing basic s= pecification details.) > > I also don't understand the need for breaking the json result into multip= le SIP header fields. It's actually within one single header field, but one piece is sent as a he= ader field value, while another piece is sent as a header field parameter v= alue. Example (simplified): Identity: ;param=3D >Why isn't it just stuffed into a single header field, like STIR-Signature:= or the like? That was my question too. Something like: Identity: But, at the end of the day, I want something that works, and Jon promised t= o describe how the "splitting" works in the next revision of the draft. Regards, Christer From nobody Tue Aug 23 08:49:22 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6721412D0D3 for ; Tue, 23 Aug 2016 08:49:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JQkewhZrMLLi for ; Tue, 23 Aug 2016 08:49:19 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C69C812D0C4 for ; Tue, 23 Aug 2016 08:49:19 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NFnRFP012149 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 08:49:27 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471967367; bh=NT3mbzUFejsBpcRQrISs206hvADNSoVApw3iXqiZW9E=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=RGjkjIAyd2n1ieGS0TqcT5PlDpxVRTLH6PIixq03ma1T9oExGpNqyBn9XyPS66N08 fwL9BjwHUI4i5cR/ZMuRqNt3Wjotg/L4byDwX1Zh94tQquG3e7cRA6pKWJQv7X5+py vwS9EHvx5Htop23k1DGad/GBJyPSEq7XG5ab96Xg= To: Christer Holmberg , Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <3b89d32f-3090-d883-b0d1-26c021f94ce9@dcrocker.net> Date: Tue, 23 Aug 2016 08:48:54 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 15:49:20 -0000 On 8/23/2016 8:45 AM, Christer Holmberg wrote: >> Why isn't it just stuffed into a single header field, like STIR-Signature: or the like? > That was my question too. Something like: > > Identity: > > But, at the end of the day, I want something that works, and Jon promised to describe how the "splitting" works in the next revision of the draft. Not just how, but why. What you and I are describing is simple and direct. Splitting things adds another step. Extra steps need justification. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 09:18:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 441B712D596 for ; Tue, 23 Aug 2016 09:18:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fgQcxauCyI0f for ; Tue, 23 Aug 2016 09:18:11 -0700 (PDT) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5876D12D5B9 for ; Tue, 23 Aug 2016 09:18:11 -0700 (PDT) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.03.0123.003; Tue, 23 Aug 2016 09:18:10 -0700 From: Michael Hammer To: "br@brianrosen.net" , "md3135@att.com" Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQAOsXmgAE6NIO8AD8NNAAAKh2hA Date: Tue, 23 Aug 2016 16:18:10 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.242] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0199_01D1FD38.68710BD0" MIME-Version: 1.0 Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 16:18:13 -0000 ------=_NextPart_000_0199_01D1FD38.68710BD0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_019A_01D1FD38.68710BD0" ------=_NextPart_001_019A_01D1FD38.68710BD0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Soon, we will be talking about E.164/6 or /7 . /10? :) On liability, I assume liability ends when the operator definitively ID's the organization delegated the TN who is initiating the robo-call. ________________________________ Michael Hammer michael.hammer@yaanatech.com +1 408 202 9291 C 2016 Yaana Technologies, LLC. All Rights Reserved. Email confidentiality notice. This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen Sent: Tuesday, August 23, 2016 10:17 AM To: DOLLY, MARTIN C Cc: stir@ietf.org; Alex Bobotek ; David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis The work we have done has always treated the number of TNs per cert to be a variable. It can be one1 per cert, it can be one per carrier, or anything in between. The way this works is that a cert is valid for a set of TNs, and that set can change over time. We provide an operation to ask if a given cert is valid for a given TN, because the list of TNs associated with a cert changes over time due to porting, new delegations in, etc. It's pretty tough, but not impossible, for a large carrier to manage one TN per cert. On the other hand, it's also tough to handle keys securely when there is one cert per carrier if the carrier has lots of infrastructure that needs to be able to sign. So the "pool per carrier" idea is pretty reasonable. Brian On Aug 23, 2016, at 9:46 AM, DOLLY, MARTIN C > wrote: The a SHAKEN framework supports a pool of certs per carrier, not cert per TN But it is ok for the RFCs yo have a broader scope for as long as they are delivered on time Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 23, 2016, at 9:40 AM, Alex Bobotek < alex@bobotek.net> wrote: David wrote: > I don't agree that RFC7340 states that these abuses are "enabled" by the "ability to impersonate someone else. +1 --- I don't read RFC7340 as saying this either, as my earlier comments to this group stated. Further, I don't believe that RFC7340 is completely accurate. In my experience, most North American telephony abuse is facilitated by anonymity and accessibility. In this context anonymity includes identity masking achieved by random impersonation but excludes targeted impersonation such as of the IRS using 800-xxx-1040, and this combined with accessibility is exemplified by the fact that no government issued ID need be shown to easily obtain low-cost service at a retail store or over the internet. An anonymous caller proving to terminating networks or their users that the caller has been assigned the calling number doesn't, on its own, do much to change this. What really helps is having some control over the attackers' ability to (1) obtain service and (2) complete calls. Knowing a party that can be held accountable that happens to be in a position to mitigate the abuse helps with the first, and reputation-based filters and indications help with the second. ----Who's the Authority?---- A point that may be pondered relates to the ambiguity surrounding the "authority" implied by the charter's use of the word "authorized". "As its priority mechanism work item, the working group will specify a SIP header-based mechanism for verification that the originator of a SIP session is _authorized_ to use the claimed source telephone number, where the session is established with SIP end to end." One interpretation is that any signer may be an authority. An originating telco, in that it can choose (perhaps with guidance from regulators) whether or not to allow a call to be originated, is clearly in a position of authority. And such a statement of authority has significant meaning to reputation-based filters and displays as well as post-call traceback and mitigation efforts. Another is interpretation is that the authority must come from proper assignments and/or delegations traceable to the root authority for that type of identity. This of course has a different meaning. It seems that the group has been more focused on the latter, but I do not have the history to see how this emerged. Could someone explain whether and how the latter became the dominant focus? ----Per-TN Certificates---- Signing with per-telephone-number certificates seems to be lacking support for implementation by network operators. If anyone has a contrary view, please express it. Per-call queries to verify certificate validity would need to check revocation status, and the infrastructure required to maintain timely revocation status is expensive at the per-TN scale. If a large service provider needs to check 2,000 peer service provider certs for revocation every 10 minutes (which is somewhere around the reaction time of many spam filters), fine. But scanning CRLs for every call (to check for a cert with service cancelled or delegation revoked) is burdensome, as is CRL publication. Yes, optimal implementations can ease the burden, but a substantial burden remains. So putting all of this together, it seems that the _pressing_ need is for signing by the originating service provider using a key assigned to that service provider, but little more. There is urgency; both delay in standards approval and additional complexity that slows or inhibits widespread STIR adoption are undesirable. Regards, Alex _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir ------=_NextPart_001_019A_01D1FD38.68710BD0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Soon, we will be talking about E.164/6 or /7 … /10?  = J

 

On liability, I assume liability ends when the operator definitively = ID’s the organization delegated the TN who is initiating the = robo-call.

 

________________________________= <= o:p>

Michael Hammer<= o:p>

michael.hammer@yaanatech.com= <= o:p>

+1 408 202 9291<= o:p>

© 2016 Yaana Technologies, LLC. All Rights Reserved. Email = confidentiality notice. This message is private and confidential. If you = have received this message in error, please notify us and remove it from = your system.<= o:p>

 

From:<= /b> = stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian = Rosen
Sent: Tuesday, August 23, 2016 10:17 AM
To: = DOLLY, MARTIN C <md3135@att.com>
Cc: stir@ietf.org; Alex = Bobotek <alex@bobotek.net>; David Frankel = <dfrankel@zipdx.com>
Subject: Re: [stir] My Editorial = Suggestions on RFC4474bis

 

The work we = have done has always treated the number of TNs per cert to be a = variable.  It can be one1 per cert, it can be one per carrier, or = anything in between.

The way = this works is that a cert is valid for a set of TNs, and that set can = change over time.  We provide an operation to ask if a given cert = is valid for a given TN, because the list of TNs associated with a cert = changes over time due to porting, new delegations in, = etc.

 

It’s pretty tough, but not impossible, for a = large carrier to manage one TN per cert.  On the other hand, = it’s also tough to handle keys securely when there is one cert per = carrier if the carrier has lots of infrastructure that needs to be able = to sign.  So the “pool per carrier” idea is pretty = reasonable.

 

Brian

 

On Aug 23, 2016, at 9:46 AM, DOLLY, MARTIN C <md3135@att.com> = wrote:

 

The a = SHAKEN framework supports a pool of certs per carrier, not cert per = TN

 <= /o:p>

But it is = ok for the RFCs yo have a broader scope for as long as they are = delivered on time

Martin C. = Dolly

Lead Member = of Technical Staff

Core & = Government/Regulatory Standards

AT&T=

Cell: +1.609.903.3360

<= /div>

Email: <= u>md3135@att.com

 


On Aug = 23, 2016, at 9:40 AM, Alex Bobotek <alex@bobotek.net> = wrote:

 

David = wrote:

> I = don’t agree that RFC7340 states that these abuses are = “enabled” by the “ability to impersonate someone = else.

 

+1 --- I = don’t read RFC7340 as saying this either, as my earlier comments = to this group stated.  Further, I don’t believe that RFC7340 = is completely accurate.  In my experience, most North American = telephony abuse is facilitated by anonymity and = accessibility.    In this context anonymity includes = identity masking achieved by random impersonation but excludes targeted = impersonation such as of the IRS using 800-xxx-1040,  and this = combined with accessibility is exemplified by the fact that no = government issued ID need be shown to easily obtain low-cost service at = a retail store or over the = internet. 

 

An anonymous = caller proving to terminating networks or their users that the caller = has been assigned the calling number doesn’t, on its own, do much = to change this.  What really helps is having some control over the = attackers’ ability to (1) obtain service and (2) complete = calls.   Knowing a party that can be held accountable that = happens to be in a position to mitigate the abuse helps with the first, = and reputation-based filters and indications help with the = second. 

 

----Who’= ;s the Authority?----

 

A point that = may be pondered relates to the ambiguity surrounding the = “authority” implied by the charter’s use of the word = “authorized”. 

 

“As = its priority mechanism work item, the working group will specify a SIP = header-based mechanism for verification that the originator of a SIP = session is _authorized_ to use the claimed source = telephone number, where the session is established with SIP end to = end.” 

 

One interpretation is that any signer may be an authority.  An = originating telco, in that it can choose (perhaps with guidance from = regulators) whether or not to allow a call to be originated, is clearly = in a position of authority.  And such a statement of authority has = significant meaning to reputation-based filters and displays as well as = post-call traceback and mitigation efforts. 

 

Another is interpretation is that the authority must come from proper = assignments and/or delegations traceable to the root authority for that = type of identity.   This of course has a different = meaning. 

 

It seems that the group has been more focused on the latter, but I do = not have the history to see how this emerged.  Could someone = explain whether and how the latter became the dominant = focus? 

 

----Per-TN Certificates----

 

Signing with per-telephone-number certificates seems to be lacking = support for implementation by network operators.  If anyone has a = contrary view, please express it.  Per-call queries to verify = certificate validity would need to check revocation status, and the = infrastructure required to maintain timely revocation status is = expensive at the per-TN scale.  If a large service provider needs = to check 2,000 peer service provider certs for revocation every 10 = minutes (which is somewhere around the reaction time of many spam = filters), fine.  But scanning CRLs for every call (to check for a = cert with service cancelled or delegation revoked) is burdensome, as is = CRL publication.  Yes, optimal implementations can ease the burden, = but a substantial burden remains.  

 

So putting all of this together, it seems that the _pressing_ = need is for signing by the originating service provider using a key = assigned to that service provider, but little more.   There is = urgency; both delay in standards approval and additional complexity that = slows or inhibits widespread STIR adoption are = undesirable. 

 

 

Regards,=

 

Alex

____________= ___________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir=

____________= ___________________________________
stir mailing list
stir@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/stir">https://www.ietf.org/mailman/listinfo/stir

 

------=_NextPart_001_019A_01D1FD38.68710BD0-- ------=_NextPart_000_0199_01D1FD38.68710BD0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIR8DCCBBkw ggMBAhBhcMtJjF+YRSnnsKbZUFt6MA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUG A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4 BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkx RTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8K DcLVLNtnuS3llCfdpb7gsE2Ps2FWPNZ8w/TNPobLooji4dikacW14r/BpkdQXkY5i9WWurVvFL8Q zicTngVHmzF6E9gf2dMCN4utLEfwjoEGpw0wDOv3PA8gHdxyRu6lAshbw8lWaUzFGMGRewvVEwCb vO/DSD5GYCCFKtWQts2LoMwy3bf9QFWyUBxWrsyNd03HIE2nMXbvaJKKkB4IgVayrWmjUtDLHMQj PR+Z/kzoFmOOxgiO9jH20vrldt21HJKjSc3NAc1ozalpuqPrHQ2cpCCmwaDF0UZMF23SrGY/lozg hNQ2/yJZxfkRYKhfBH3yGvYlQmEPxEq4PokCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEANCYVPMCN TUNJHb3pIZLXZpy33sW40ORdX3YiwCb5hDo6+Yy1++xg8ejOBLDI3acDjzDzmN+k5qQx39McC0bc ciA/ru4FPKQzPws5rHB4c0uZK98wwlSwqDtVof4WKM1CvXRugNsnRKfORF3UG5CYDR5ClLEALATQ dKMCBSJjY82DtfvBbWJraXX9XXBBufW/fN++wTJzIiGLWIF7FZF6uuNkSLB/+zYl2pXQ8SQUF90Y gGtGIzlU9Y5iCQQdlJCmm+Yl4kJFqriQrb4Ij6kLQhiUz3I54bFD4CjPt+dabBNrSbP/4xh8iYsz Xawz16f52jpVyVgQ+arvWrbPS0vfKjCCBmAwggVIoAMCAQICEHaFyweo4MwP0sVNjzk1sxIwDQYJ KoZIhvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3Mg MiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTExMDYwNzAw MDAwMFoXDTIxMDYwNjIzNTk1OVowgckxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBD b3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xh c3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFu dGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3+D8MK4MjIIWmTUkBUTra3VAzvuMEpDo+o2Fm TDTC6HRwdUmlt0ns3bOSnN15DeK5+rg5PL6F44zvbXmjprcIv5xMvj6YjqzbfJor7AUoMF8pGzNN RNVw6FYimaY+nUJb6yOnY50tLLAuPxjzKc0aNomEksdXcFtwheY4oXxQ4zc4iGVba8s5KgSxgqoZ BP+gfz+j25FFdmaja/OFI15O2YVddaegFffBAHTg5cqUQmWawjd6i6hQrL+XdGd30TKnr43Lk6kl QrQwGnQK4iUQEMt0Z1UPyxT8QVAKpHxNCwv5Bak1+UWnMfGAu6LJPs52OeEq/3ZQ5+hRIt8tz7gz AgMBAAGjggI/MIICOzASBgNVHRMBAf8ECDAGAQH/AgEAMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6 Ly9jcmwudmVyaXNpZ24uY29tL3BjYTItZzMuY3JsMA4GA1UdDwEB/wQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRVmVyaVNpZ25NUEtJLTItNTYwHQYDVR0OBBYEFNhIKahfKheS4vqee+9v YIP4uLjcMIHwBgNVHSMEgegwgeWhgdCkgc0wgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJp U2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMp IDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8 VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt IEczghBhcMtJjF+YRSnnsKbZUFt6MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDov L29jc3AudmVyaXNpZ24uY29tMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcC ARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5z eW1hdXRoLmNvbS9ycGEwDQYJKoZIhvcNAQEFBQADggEBAKYqmwdAyez/s4joRdo00RcPKC23pYVn Mc3B5tUphjis4vBZGwzhoUXOJHjvacGwTGGiSNloT7r+dVQ3ulhp6sF2pTZC6p5meJAg2ZVqJHlU zd5aGoo7rhiVctAl2NJGvjQwp4Ce8VbOIB5sZ8lNT3mHieIugNae7SZhZaID0MXi8yi5K0lpgmfs 1ek0pC7cYiKkhU1I42oClPLN/eRnyEm8qtXH5zzeh7EQa10HXBnka6D0T5nL3LVbDMwy+WrkdMAq WDd5s/vNwzRv4XbdEAcAY4sHTicXkkebDr7eDROFEfyiL2V9zDqsHlRrVmfE7qWHIiMXK3BWw/Gu d1wnwTkwggdrMIIGU6ADAgECAhBMAzfzqk7mKu8vbItErxUIMA0GCSqGSIb3DQEBBQUAMIHJMQsw CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFu dGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1l ZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTE2MDIyOTAwMDAwMFoXDTE4MDIyODIzNTk1 OVoweTEXMBUGA1UEAwwOTWljaGFlbCBIYW1tZXIxDzANBgNVBAsMBlMvTUlNRTEgMB4GA1UECgwX WWFhbmEgVGVjaG5vbG9naWVzLCBMTEMxKzApBgkqhkiG9w0BCQEWHG1pY2hhZWwuaGFtbWVyQHlh YW5hdGVjaC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWEk4s5ORfNfQ/oXDD k4mHDQDDpO3s2oEy7055JdLoleNQXEJGsv8EsqPagYul55uVZ57tmx2H1LjM6QfD7N821joisKa4 +l92JImsffrTnll8gxJ9VV9/WmGpPWwFg4ipw3qRdDhQJnQiNKzlqPMSIDE76uhrKv3hYE30tVIO R8U9erAprCBoHd2Ch1+pIGlFjl91//BR1sehnJR9Z1gZHMEqjto/jYPR1uEapueR6W+YuL9O9HmW RLA925xiZmzwKqB8HS0wG+PjLnMRnohdIh4e+/FKWksC82rP7vmP3SHOzQKdgdapaavCTx/1ZYiR N6cMT95ZCgB1aHXR1lCfAgMBAAGjggOcMIIDmDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF oDAgBgNVHSUBAf8EFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwHQYDVR0OBBYEFFaFSmgtcRDwfRFi qt3Vq8LJCLn5MCcGA1UdEQQgMB6BHG1pY2hhZWwuaGFtbWVyQHlhYW5hdGVjaC5jb20wHwYDVR0j BBgwFoAU2EgpqF8qF5Li+p57729gg/i4uNwwggFxBggrBgEFBQcBAQSCAWMwggFfMCcGCCsGAQUF BzABhhtodHRwOi8vcGtpLW9jc3Auc3ltYXV0aC5jb20wggEyBggrBgEFBQcwAoaCASRsZGFwOi8v ZGlyZWN0b3J5LnZlcmlzaWduLmNvbS9DTiUyMCUzRCUyMFN5bWFudGVjJTIwQ2xhc3MlMjAyJTIw U2hhcmVkJTIwSW50ZXJtZWRpYXRlJTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHklMkNPVSUyMCUz RCUyMENsYXNzJTIwMiUyME1hbmFnZWQlMjBQS0klMjBJbmRpdmlkdWFsJTIwU3Vic2NyaWJlciUy MENBJTJDT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQ08lMjAlM0QlMjBT eW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNhdGU7YmluYXJ5 MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2NhXzA3YmI3ZDY0 NzdjZjRmNmJlOTZhZjFiMzZjYWJkMzE2L0xhdGVzdENSTC5jcmwwbAYDVR0gBGUwYzBhBgtghkgB hvhFAQcXAjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEF BQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTBCBgkqhkiG9w0BCQ8ENTAzMAoGCCqG SIb3DQMHMAsGCWCGSAFlAwQBAjALBglghkgBZQMEARYwCwYJYIZIAWUDBAEqMCwGCmCGSAGG+EUB EAMEHjAcBhJghkgBhvhFARABAgIBAYabp24WBjE4NzIwOTA5BgpghkgBhvhFARAFBCswKQIBABYk YUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3DQEBBQUAA4IBAQBX iSRv04vVx/Y5lWWITUJhWXUTnhM70UUqIEinNF+cV9+zY0lomYqoB8ovCfWrvx232tzX86NtreSn 9UjhBRj61oqSyK9v6P14dunX1MjRZmOVeKws3+XDS3NPsopui5YOPjSy02qhyVN4tIDCokj71db1 wO7uZ/DehNWkwFUgMKdVKM5LAGIDHgWn2dvzGi+ipdDNjMD2SxMnCSOiZ3z9gh/Yy+flNaXn5vLL O0AJEW5xCl2tbuPh/DghqlaiVeCLaCar3cj2Ka6ew5wRhNpvmno47b0C5w6JDxx++ijXjGPzYr57 J8QvCDs9f3Cn5doEF3bTQmcab+s3VEgIhAt1MYIE4zCCBN8CAQEwgd4wgckxCzAJBgNVBAYTAlVT MR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3Qg TmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmli ZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkCEEwDN/OqTuYq7y9si0SvFQgwCQYFKw4DAhoFAKCCAtkwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwODIzMTYxODA4WjAjBgkqhkiG 9w0BCQQxFgQUJJm+7oT2+yYpdn0FR0+wHyapRhkwgZMGCSqGSIb3DQEJDzGBhTCBgjALBglghkgB ZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0DAgIC AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAhowCwYJYIZIAWUDBAIDMAsGCWCGSAFlAwQCAjALBglg hkgBZQMEAgEwge8GCSsGAQQBgjcQBDGB4TCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eQIQTAM386pO5irvL2yLRK8VCDCB8QYLKoZIhvcNAQkQAgsxgeGggd4wgckxCzAJBgNVBAYT AlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1 c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNj cmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBD ZXJ0aWZpY2F0ZSBBdXRob3JpdHkCEEwDN/OqTuYq7y9si0SvFQgwDQYJKoZIhvcNAQEBBQAEggEA CiwSVUZEdUjkPUiuZml0aIqW4aCwWwlvWoBKdssUmeMRmxNbNMn6WNUA5+6QkICbDPCspDXbtQvS m3sNtFjzmZ00HxzFa0oSOPaehVmudxemXukFbU8g+/VJ5cEeu01kvP3hCDZqjQjFIPcr/Gc8/FYK XnFgz/cXZ8otV+V93kVfcvG25sRqVw9wzZ94auuS4KCyJj+klxJfzYB5RV1oRbJWta7GOwRL5G4Z fzz3LOzqaeGIaS71a9GCUavQtNYu9VEro/7o/VOeBJoST4s7ykfbwO7LKnPh9+xlPG54EJ4MvsFs aXpSUaAIL7F9tAVw1vbSvdL1goPY+K+vEC1MDwAAAAAAAA== ------=_NextPart_000_0199_01D1FD38.68710BD0-- From nobody Tue Aug 23 10:10:07 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C492C12D0C0 for ; Tue, 23 Aug 2016 10:10:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eKB7kSBIrq_A for ; Tue, 23 Aug 2016 10:10:02 -0700 (PDT) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 423C012D596 for ; Tue, 23 Aug 2016 10:10:02 -0700 (PDT) Received: by mail-qk0-x232.google.com with SMTP id l2so112973537qkf.3 for ; Tue, 23 Aug 2016 10:10:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=C1kjlKRaYHkFyKCdVfGFsj8vTh44/emHAHGNSmOmq3c=; b=FUm1iFA6DjMRDKdjAv5khFnefmT9c7WOK1gUoyeQvdlelsYfYLkfJdM/Z2diYWdA2j Y/Xy6V1o+waacuKTfVegaszdkMOEne8XXbipy+Qnp/+7YEfKSez0uQDyjE9LIoAT30Qi dskn32TpRYUd2HW1M90FEKxVXOJyZqa8WiwI0I2/nNbfhOvv+yLg9r3dp4afHIIAP3n1 CcCzNGiItfBQsZnunP+S3u8Ijblqa8Jknm3nGbZ+B7lIAAL9aaVJkxZ23Q05XzKQ4+7k rBro93cZcFNx+3O2BE6ppPpf+hymli77i+b25zErK+A0N3t9T4E4VttYnP0PgY2boyEU s8NA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=C1kjlKRaYHkFyKCdVfGFsj8vTh44/emHAHGNSmOmq3c=; b=bkaVRX+gJXmjUFuavvOnVL1uO5wuczSEx85MNiWe/pO/5cki32TwU0PI0BhTw260j4 VyFHFwcaGwHxvRBaFbcOy67ZUwa2jUfsDQ9AgEQYnHHzg5cq6EWqMLARvT2flyxlqB3/ YhN0t2FlIOsfMFx75zOWmsvSKSOlp1eNi0tHZP3CoYV2K1VOsCPH0U91JDC0+ddP9t0/ IOf6cVa56Df6E/SLWw31hKbDY6ovm3jLi9WdnNYJHQ2f0yQyfYaYQedHE1ih5c/CTJ/m 6Q8exnvGg+0WALWQpUzh8xKqsWFpKBHJMe3MWYIWlhwU91013BYhfUFq1ae+hBda3xyV oC/A== X-Gm-Message-State: AEkoouvFgOHNueH9iflMp8/Gmcqqwc1IquBkLnfVooBWuup6val+RQGp8nADH7DnqEFfmw== X-Received: by 10.55.73.145 with SMTP id w139mr30505698qka.37.1471972201215; Tue, 23 Aug 2016 10:10:01 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id u44sm2265145qtc.27.2016.08.23.10.09.59 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 23 Aug 2016 10:10:00 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_1C960AA9-47EE-43BE-91CE-6EE1F2840B28" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> Date: Tue, 23 Aug 2016 13:09:57 -0400 Message-Id: <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> To: Michael Hammer X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 17:10:06 -0000 --Apple-Mail=_1C960AA9-47EE-43BE-91CE-6EE1F2840B28 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Recognizing that we are beyond the IETF=E2=80=99s purview, I would say = as long as the SP has someone to hand the hot potato to, then its hands = are clean and cool. And I like E.164/6, but of course it would be decimal digits and not = powers of two. > On Aug 23, 2016, at 12:18 PM, Michael Hammer = wrote: >=20 > Soon, we will be talking about E.164/6 or /7 =E2=80=A6 /10? J > =20 > On liability, I assume liability ends when the operator definitively = ID=E2=80=99s the organization delegated the TN who is initiating the = robo-call. > =20 > ________________________________ > Michael Hammer > michael.hammer@yaanatech.com > +1 408 202 9291 >=20 > =C2=A9 2016 Yaana Technologies, LLC. All Rights Reserved. Email = confidentiality notice. This message is private and confidential. If you = have received this message in error, please notify us and remove it from = your system. > =20 > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen > Sent: Tuesday, August 23, 2016 10:17 AM > To: DOLLY, MARTIN C > Cc: stir@ietf.org; Alex Bobotek ; David Frankel = > Subject: Re: [stir] My Editorial Suggestions on RFC4474bis > =20 > The work we have done has always treated the number of TNs per cert to = be a variable. It can be one1 per cert, it can be one per carrier, or = anything in between. > The way this works is that a cert is valid for a set of TNs, and that = set can change over time. We provide an operation to ask if a given = cert is valid for a given TN, because the list of TNs associated with a = cert changes over time due to porting, new delegations in, etc. > =20 > It=E2=80=99s pretty tough, but not impossible, for a large carrier to = manage one TN per cert. On the other hand, it=E2=80=99s also tough to = handle keys securely when there is one cert per carrier if the carrier = has lots of infrastructure that needs to be able to sign. So the = =E2=80=9Cpool per carrier=E2=80=9D idea is pretty reasonable. > =20 > Brian > =20 > On Aug 23, 2016, at 9:46 AM, DOLLY, MARTIN C > wrote: > =20 > The a SHAKEN framework supports a pool of certs per carrier, not cert = per TN > =20 > But it is ok for the RFCs yo have a broader scope for as long as they = are delivered on time >=20 > Martin C. Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards > AT&T > Cell: +1.609.903.3360 > Email: md3135@att.com > =20 >=20 > On Aug 23, 2016, at 9:40 AM, Alex Bobotek > wrote: >=20 > =20 > David wrote: > > I don=E2=80=99t agree that RFC7340 states that these abuses are = =E2=80=9Cenabled=E2=80=9D by the =E2=80=9Cability to impersonate someone = else. > =20 > +1 --- I don=E2=80=99t read RFC7340 as saying this either, as my = earlier comments to this group stated. Further, I don=E2=80=99t believe = that RFC7340 is completely accurate. In my experience, most North = American telephony abuse is facilitated by anonymity and accessibility. = In this context anonymity includes identity masking achieved by random = impersonation but excludes targeted impersonation such as of the IRS = using 800-xxx-1040, and this combined with accessibility is exemplified = by the fact that no government issued ID need be shown to easily obtain = low-cost service at a retail store or over the internet.=20 > =20 > An anonymous caller proving to terminating networks or their users = that the caller has been assigned the calling number doesn=E2=80=99t, on = its own, do much to change this. What really helps is having some = control over the attackers=E2=80=99 ability to (1) obtain service and = (2) complete calls. Knowing a party that can be held accountable that = happens to be in a position to mitigate the abuse helps with the first, = and reputation-based filters and indications help with the second.=20 > =20 > ----Who=E2=80=99s the Authority?---- > =20 > A point that may be pondered relates to the ambiguity surrounding the = =E2=80=9Cauthority=E2=80=9D implied by the charter=E2=80=99s use of the = word =E2=80=9Cauthorized=E2=80=9D.=20 > =20 > =E2=80=9CAs its priority mechanism work item, the working group will = specify a SIP header-based mechanism for verification that the = originator of a SIP session is _authorized_ to use the claimed source = telephone number, where the session is established with SIP end to = end.=E2=80=9D=20 > =20 > One interpretation is that any signer may be an authority. An = originating telco, in that it can choose (perhaps with guidance from = regulators) whether or not to allow a call to be originated, is clearly = in a position of authority. And such a statement of authority has = significant meaning to reputation-based filters and displays as well as = post-call traceback and mitigation efforts.=20 > =20 > Another is interpretation is that the authority must come from proper = assignments and/or delegations traceable to the root authority for that = type of identity. This of course has a different meaning.=20 > =20 > It seems that the group has been more focused on the latter, but I do = not have the history to see how this emerged. Could someone explain = whether and how the latter became the dominant focus?=20 > =20 > ----Per-TN Certificates---- > =20 > Signing with per-telephone-number certificates seems to be lacking = support for implementation by network operators. If anyone has a = contrary view, please express it. Per-call queries to verify = certificate validity would need to check revocation status, and the = infrastructure required to maintain timely revocation status is = expensive at the per-TN scale. If a large service provider needs to = check 2,000 peer service provider certs for revocation every 10 minutes = (which is somewhere around the reaction time of many spam filters), = fine. But scanning CRLs for every call (to check for a cert with = service cancelled or delegation revoked) is burdensome, as is CRL = publication. Yes, optimal implementations can ease the burden, but a = substantial burden remains. =20 > =20 > So putting all of this together, it seems that the _pressing_ need is = for signing by the originating service provider using a key assigned to = that service provider, but little more. There is urgency; both delay = in standards approval and additional complexity that slows or inhibits = widespread STIR adoption are undesirable.=20 > =20 > =20 > Regards, > =20 > Alex > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_1C960AA9-47EE-43BE-91CE-6EE1F2840B28 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Recognizing that we are beyond the IETF=E2=80=99s purview, I = would say as long as the SP has someone to hand the hot potato to, then = its hands are clean and cool.

And I like E.164/6, but of course it would be decimal digits = and not powers of two.


On Aug 23, 2016, at 12:18 PM, Michael Hammer <michael.hammer@yaanatech.com> wrote:

Soon, we will be talking about E.164/6 or = /7 =E2=80=A6 /10?  J
 
On liability, I assume = liability ends when the operator definitively ID=E2=80=99s the = organization delegated the TN who is initiating the robo-call.
 
________________________________
Michael = Hammer
+1 408 202 = 9291

=C2=A9 2016 = Yaana Technologies, LLC. All Rights Reserved. Email confidentiality = notice. This message is private and confidential. If you have received = this message in error, please notify us and remove it from your = system.
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf = Of Brian Rosen
Sent: Tuesday, August 23, 2016 = 10:17 AM
To: DOLLY, MARTIN C <md3135@att.com>
Cc: stir@ietf.org; Alex Bobotek = <alex@bobotek.net>; David Frankel <dfrankel@zipdx.com>
Subject: Re: [stir] My Editorial = Suggestions on RFC4474bis
 
The work we have done has always treated the number of TNs = per cert to be a variable.  It can be one1 per cert, it can be one = per carrier, or anything in between.
The way this works is = that a cert is valid for a set of TNs, and that set can change over = time.  We provide an operation to ask if a given cert is valid for = a given TN, because the list of TNs associated with a cert changes over = time due to porting, new delegations in, etc.
 
It=E2=80=99s pretty tough, but not = impossible, for a large carrier to manage one TN per cert.  On the = other hand, it=E2=80=99s also tough to handle keys securely when there = is one cert per carrier if the carrier has lots of infrastructure that = needs to be able to sign.  So the =E2=80=9Cpool per carrier=E2=80=9D = idea is pretty reasonable.
 
Brian
 
On Aug 23, 2016, at = 9:46 AM, DOLLY, MARTIN C <md3135@att.com> wrote:
 
The a SHAKEN framework = supports a pool of certs per carrier, not cert per TN
 

But it is ok for the = RFCs yo have a broader scope for as long as they are delivered on = time

Martin C. = Dolly
Lead Member of Technical Staff
Core & Government/Regulatory Standards
AT&T
Cell: +1.609.903.3360
Email: md3135@att.com
 


On Aug = 23, 2016, at 9:40 AM, Alex Bobotek <alex@bobotek.net> wrote:

 
David wrote:
> I don=E2=80=99t agree that RFC7340 states = that these abuses are =E2=80=9Cenabled=E2=80=9D by the =E2=80=9Cability = to impersonate someone else.
 
+1= --- I don=E2=80=99t read RFC7340 as saying this either, as my earlier = comments to this group stated.  Further, I don=E2=80=99t believe = that RFC7340 is completely accurate.  In my experience, most North = American telephony abuse is facilitated by anonymity and = accessibility.    In this context anonymity includes = identity masking achieved by random impersonation but excludes targeted = impersonation such as of the IRS using 800-xxx-1040,  and this = combined with accessibility is exemplified by the fact that no = government issued ID need be shown to easily obtain low-cost service at = a retail store or over the internet. 
 
An anonymous caller proving to terminating = networks or their users that the caller has been assigned the calling = number doesn=E2=80=99t, on its own, do much to change this.  What = really helps is having some control over the attackers=E2=80=99 ability = to (1) obtain service and (2) complete calls.   Knowing a = party that can be held accountable that happens to be in a position to = mitigate the abuse helps with the first, and reputation-based filters = and indications help with the second. 
 
----Who=E2=80=99s the Authority?----
 
A point that may be pondered relates to the = ambiguity surrounding the =E2=80=9Cauthority=E2=80=9D implied by the = charter=E2=80=99s use of the word =E2=80=9Cauthorized=E2=80=9D. 
 
=E2=80=9CAs its priority mechanism work item, the working = group will specify a SIP header-based mechanism for verification that = the originator of a SIP session is _authorized_ to use the claimed source = telephone number, where the session is established with SIP end to = end.=E2=80=9D 
 
One interpretation is = that any signer may be an authority.  An originating telco, in that = it can choose (perhaps with guidance from regulators) whether or not to = allow a call to be originated, is clearly in a position of = authority.  And such a statement of authority has significant = meaning to reputation-based filters and displays as well as post-call = traceback and mitigation efforts. 
 
Another is interpretation is that the authority must come = from proper assignments and/or delegations traceable to the root = authority for that type of identity.   This of course has a = different meaning. 
 
It = seems that the group has been more focused on the latter, but I do not = have the history to see how this emerged.  Could someone explain = whether and how the latter became the dominant focus? 
 
----Per-TN = Certificates----
 
Signing with per-telephone-number certificates seems to be = lacking support for implementation by network operators.  If anyone = has a contrary view, please express it.  Per-call queries to verify = certificate validity would need to check revocation status, and the = infrastructure required to maintain timely revocation status is = expensive at the per-TN scale.  If a large service provider needs = to check 2,000 peer service provider certs for revocation every 10 = minutes (which is somewhere around the reaction time of many spam = filters), fine.  But scanning CRLs for every call (to check for a = cert with service cancelled or delegation revoked) is burdensome, as is = CRL publication.  Yes, optimal implementations can ease the burden, = but a substantial burden remains.  
 
So putting all of this = together, it seems that the _pressing_ need is for = signing by the originating service provider using a key assigned to that = service provider, but little more.   There is urgency; both = delay in standards approval and additional complexity that slows or = inhibits widespread STIR adoption are undesirable. 
 
 
Regards,
 
Alex
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
 
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_1C960AA9-47EE-43BE-91CE-6EE1F2840B28-- From nobody Tue Aug 23 10:37:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B461712B056 for ; Tue, 23 Aug 2016 10:37:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A5aj1a_o_wRj for ; Tue, 23 Aug 2016 10:37:19 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CCFB12B024 for ; Tue, 23 Aug 2016 10:37:19 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NHbOkI015727 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 10:37:24 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471973845; bh=jB1Wmaujsw7Si2FHWVxPaTrpFdnP/zSlgApY2Wjl3ZE=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=N/Q4DuGC5S/tYkw3TAv6aC1VAH9Mn8W8c6/8b4hKCs9Rt36o+2ktWgHDWNcfPrRRo cXMZXB5V5FQlXKH5wODarHb2dzFVyOvypvX5fLiKDkRIkvj6fVM+q8IyGdiYdmDU+v cwuS0yNNjB6UP/doDmrZNfdLdccQN+AjoU4gsWwY= To: Brian Rosen , Michael Hammer References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> Date: Tue, 23 Aug 2016 10:36:54 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 17:37:19 -0000 On 8/23/2016 10:09 AM, Brian Rosen wrote: > Recognizing that we are beyond the IETFs purview, I would say as long > as the SP has someone to hand the hot potato to, then its hands are > clean and cool. There is a piece of this that is essential to the IETF work, namely sufficient and explicit clarity about usage alternatives to ensure that the technical specifications can support them. Specifying a cert subsystem that relies on a timely and accurate revocation list, at the scale and granularity of per-number, would be an example of something that has never been done, where the relevant history strongly indicates it won't work. That level of consideration and design choice is very much /inside/ the IETF's purview. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 10:49:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C31F12D11C for ; Tue, 23 Aug 2016 10:49:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EERzR3TzVRlK for ; Tue, 23 Aug 2016 10:49:12 -0700 (PDT) Received: from mail-it0-x22c.google.com (mail-it0-x22c.google.com [IPv6:2607:f8b0:4001:c0b::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E326A12D115 for ; Tue, 23 Aug 2016 10:49:11 -0700 (PDT) Received: by mail-it0-x22c.google.com with SMTP id f6so148152689ith.0 for ; Tue, 23 Aug 2016 10:49:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UKsGc0O+qmkMy4+pUFyLYERVz5QzDO6Wu5NTsQdIMNE=; b=F1vnzLhEfrhshHFHpWRNTmNFXqv2uvY5m05HXaEcsahHrWyRfszLZPuM59qoECw8k+ 5x4yX1OKUyJoVx5hQJfk4Ln3WTr36O6bnTZi5uMRwANy9iR+91//HccFiL3BbbOUxc1K xcBpEHiFHkIUvRbFE8ikHwF2PlTLZki7nsUXxrvQShlfgcRb/YiD749xMK6WAEZjTF2J rcnRkQ4vaKQOGBsseSSbLu15i/RgTTlFIcFc6p8TY3CQGAfX1AWmOvl3eFxKQy5YUrKK ZIv/J4wvPz2SYKSrtvgeWzOgZwj6bv6MtNLpNqzL40BSJpww0MClcuU2UpuFYBrWaAhr zz9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UKsGc0O+qmkMy4+pUFyLYERVz5QzDO6Wu5NTsQdIMNE=; b=mdq2ZmSU9To8i4SchRf2iDzq59JzfulCcLTQj2rbEaqfkVAZo+DyEGovjqzC+NH1r0 9OsjaK9JOeNBT9ZjhCi1Ox0dwDlwN6YoRN6TrIVw5J+yn02aU4oZZNX5n01+UXGPE3Bj mcCgiaOEDyK6SDoDjfSYBrtUZJRUqra/xEdukXoTGllsoTc9KaeS6SkXAdPOND9qY1B9 IVhbEx8PzTvp1TJFn+ayrwEfxyTecgSb/AsHqW79vrGn3VzZGWMjvU28mk4sweMsofxO labrSs+gLBHHi2Fg3T6AoIqK+mezFA4oVKnCaks/s3shjiCyJFNcWo1OKJL1zNlKDbyU ILhg== X-Gm-Message-State: AEkoouv4G9zslJN3N3ZBOACyprPRGBZbC36SGvJ32YBwRr3abBFbtOiqc3SdzP6kE+25yw== X-Received: by 10.36.204.68 with SMTP id x65mr29170162itf.54.1471974551268; Tue, 23 Aug 2016 10:49:11 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id h63sm10008966ita.12.2016.08.23.10.49.10 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 23 Aug 2016 10:49:10 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> Date: Tue, 23 Aug 2016 13:49:06 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , Michael Hammer , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 17:49:13 -0000 Yes, of course you are right. We specified OCSP for this purpose. Brian > On Aug 23, 2016, at 1:36 PM, Dave Crocker wrote: >=20 > On 8/23/2016 10:09 AM, Brian Rosen wrote: >> Recognizing that we are beyond the IETF=92s purview, I would say as = long >> as the SP has someone to hand the hot potato to, then its hands are >> clean and cool. >=20 >=20 > There is a piece of this that is essential to the IETF work, namely = sufficient and explicit clarity about usage alternatives to ensure that = the technical specifications can support them. >=20 > Specifying a cert subsystem that relies on a timely and accurate = revocation list, at the scale and granularity of per-number, would be an = example of something that has never been done, where the relevant = history strongly indicates it won't work. >=20 > That level of consideration and design choice is very much /inside/ = the IETF's purview. >=20 > d/ >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Tue Aug 23 10:53:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46DDF12D649 for ; Tue, 23 Aug 2016 10:53:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z93DsPZFb52J for ; Tue, 23 Aug 2016 10:53:40 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A12612D648 for ; Tue, 23 Aug 2016 10:53:40 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NHrehD016059 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 10:53:41 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471974828; bh=mpsKXP43QWAnQ/76yR4eTGgspsBa3NOKXmwItLXUoEI=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=KnyyKs1TFlsNplxk8+c36BrHXAavAH7Asi2owOh/qBhNfnAkGgn4DfkB/+T2On7I1 TlqCg7lIJqoi2cKNR7/kT5klmAFl6zgP9x31S0FFVSnJ3RZvNEF2nonEGWxkzTnVat /zTfPFkZGjQGHXrE/+wR+e107SLTFQJnpakXDQCg= To: Brian Rosen References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Tue, 23 Aug 2016 10:53:11 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , Michael Hammer , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 17:53:42 -0000 Brian, I did not choose the example randomly, nor did I generate an artificial comment to go along with it. With your response -- which I expected -- my example moves from theory to fact: So, please provide some documentation about its successful use at scale. d/ On 8/23/2016 10:49 AM, Brian Rosen wrote: > Yes, of course you are right. We specified OCSP for this purpose. > > Brian > >> On Aug 23, 2016, at 1:36 PM, Dave Crocker wrote: >> >> On 8/23/2016 10:09 AM, Brian Rosen wrote: >>> Recognizing that we are beyond the IETFs purview, I would say as long >>> as the SP has someone to hand the hot potato to, then its hands are >>> clean and cool. >> >> >> There is a piece of this that is essential to the IETF work, namely sufficient and explicit clarity about usage alternatives to ensure that the technical specifications can support them. >> >> Specifying a cert subsystem that relies on a timely and accurate revocation list, at the scale and granularity of per-number, would be an example of something that has never been done, where the relevant history strongly indicates it won't work. >> >> That level of consideration and design choice is very much /inside/ the IETF's purview. >> >> d/ >> >> -- >> >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 11:02:16 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4391412D576 for ; Tue, 23 Aug 2016 11:02:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.449 X-Spam-Level: X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id drx-8aUivI6a for ; Tue, 23 Aug 2016 11:02:12 -0700 (PDT) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9149712D668 for ; Tue, 23 Aug 2016 11:02:12 -0700 (PDT) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.03.0123.003; Tue, 23 Aug 2016 11:02:06 -0700 From: Michael Hammer To: "dcrocker@bbiw.net" , "br@brianrosen.net" Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQAOsXmgAE6NIO8AD8NNAAAKh2hA///b+ICAAAeHAIAAA2kAgAABJICAAHNvYA== Date: Tue, 23 Aug 2016 18:02:05 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BC1F42C2@sc9-ex2k10mb1.corp.yaanatech.com> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.242] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_01EA_01D1FD46.ECE650B0" MIME-Version: 1.0 Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 18:02:14 -0000 ------=_NextPart_000_01EA_01D1FD46.ECE650B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dave, I am sure the Wright Brothers heard the same statements=20 before they ignored those statements and invented the airplane. That line of logic leads nowhere. ________________________________ Michael Hammer michael.hammer@yaanatech.com +1=A0408 202 9291 =A9 2016 Yaana Technologies, LLC. All Rights Reserved. Email = confidentiality notice. This message is private and confidential. If you have received = this message in error, please notify us and remove it from your system. -----Original Message----- From: Dave Crocker [mailto:dhc@dcrocker.net]=20 Sent: Tuesday, August 23, 2016 1:53 PM To: Brian Rosen Cc: stir@ietf.org; alex@bobotek.net; Michael Hammer ; md3135@att.com; dfrankel@zipdx.com Subject: Re: [stir] My Editorial Suggestions on RFC4474bis Brian, I did not choose the example randomly, nor did I generate an artificial comment to go along with it. With your response -- which I expected -- my example moves from theory = to fact: So, please provide some documentation about its successful use at scale. d/ On 8/23/2016 10:49 AM, Brian Rosen wrote: > Yes, of course you are right. We specified OCSP for this purpose. > > Brian > >> On Aug 23, 2016, at 1:36 PM, Dave Crocker wrote: >> >> On 8/23/2016 10:09 AM, Brian Rosen wrote: >>> Recognizing that we are beyond the IETF=92s purview, I would say as=20 >>> long as the SP has someone to hand the hot potato to, then its hands = >>> are clean and cool. >> >> >> There is a piece of this that is essential to the IETF work, namely sufficient and explicit clarity about usage alternatives to ensure that = the technical specifications can support them. >> >> Specifying a cert subsystem that relies on a timely and accurate revocation list, at the scale and granularity of per-number, would be an example of something that has never been done, where the relevant = history strongly indicates it won't work. >> >> That level of consideration and design choice is very much /inside/ = the IETF's purview. >> >> d/ >> >> -- >> >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --=20 Dave Crocker Brandenburg InternetWorking bbiw.net ------=_NextPart_000_01EA_01D1FD46.ECE650B0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIR8DCCBBkw ggMBAhBhcMtJjF+YRSnnsKbZUFt6MA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUG A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4 BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkx RTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8K DcLVLNtnuS3llCfdpb7gsE2Ps2FWPNZ8w/TNPobLooji4dikacW14r/BpkdQXkY5i9WWurVvFL8Q zicTngVHmzF6E9gf2dMCN4utLEfwjoEGpw0wDOv3PA8gHdxyRu6lAshbw8lWaUzFGMGRewvVEwCb vO/DSD5GYCCFKtWQts2LoMwy3bf9QFWyUBxWrsyNd03HIE2nMXbvaJKKkB4IgVayrWmjUtDLHMQj PR+Z/kzoFmOOxgiO9jH20vrldt21HJKjSc3NAc1ozalpuqPrHQ2cpCCmwaDF0UZMF23SrGY/lozg hNQ2/yJZxfkRYKhfBH3yGvYlQmEPxEq4PokCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEANCYVPMCN TUNJHb3pIZLXZpy33sW40ORdX3YiwCb5hDo6+Yy1++xg8ejOBLDI3acDjzDzmN+k5qQx39McC0bc ciA/ru4FPKQzPws5rHB4c0uZK98wwlSwqDtVof4WKM1CvXRugNsnRKfORF3UG5CYDR5ClLEALATQ dKMCBSJjY82DtfvBbWJraXX9XXBBufW/fN++wTJzIiGLWIF7FZF6uuNkSLB/+zYl2pXQ8SQUF90Y gGtGIzlU9Y5iCQQdlJCmm+Yl4kJFqriQrb4Ij6kLQhiUz3I54bFD4CjPt+dabBNrSbP/4xh8iYsz Xawz16f52jpVyVgQ+arvWrbPS0vfKjCCBmAwggVIoAMCAQICEHaFyweo4MwP0sVNjzk1sxIwDQYJ KoZIhvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3Mg MiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTExMDYwNzAw MDAwMFoXDTIxMDYwNjIzNTk1OVowgckxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBD b3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xh c3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFu dGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3+D8MK4MjIIWmTUkBUTra3VAzvuMEpDo+o2Fm TDTC6HRwdUmlt0ns3bOSnN15DeK5+rg5PL6F44zvbXmjprcIv5xMvj6YjqzbfJor7AUoMF8pGzNN RNVw6FYimaY+nUJb6yOnY50tLLAuPxjzKc0aNomEksdXcFtwheY4oXxQ4zc4iGVba8s5KgSxgqoZ BP+gfz+j25FFdmaja/OFI15O2YVddaegFffBAHTg5cqUQmWawjd6i6hQrL+XdGd30TKnr43Lk6kl QrQwGnQK4iUQEMt0Z1UPyxT8QVAKpHxNCwv5Bak1+UWnMfGAu6LJPs52OeEq/3ZQ5+hRIt8tz7gz AgMBAAGjggI/MIICOzASBgNVHRMBAf8ECDAGAQH/AgEAMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6 Ly9jcmwudmVyaXNpZ24uY29tL3BjYTItZzMuY3JsMA4GA1UdDwEB/wQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRVmVyaVNpZ25NUEtJLTItNTYwHQYDVR0OBBYEFNhIKahfKheS4vqee+9v YIP4uLjcMIHwBgNVHSMEgegwgeWhgdCkgc0wgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJp U2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMp IDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8 VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt IEczghBhcMtJjF+YRSnnsKbZUFt6MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDov L29jc3AudmVyaXNpZ24uY29tMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcC ARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5z eW1hdXRoLmNvbS9ycGEwDQYJKoZIhvcNAQEFBQADggEBAKYqmwdAyez/s4joRdo00RcPKC23pYVn Mc3B5tUphjis4vBZGwzhoUXOJHjvacGwTGGiSNloT7r+dVQ3ulhp6sF2pTZC6p5meJAg2ZVqJHlU zd5aGoo7rhiVctAl2NJGvjQwp4Ce8VbOIB5sZ8lNT3mHieIugNae7SZhZaID0MXi8yi5K0lpgmfs 1ek0pC7cYiKkhU1I42oClPLN/eRnyEm8qtXH5zzeh7EQa10HXBnka6D0T5nL3LVbDMwy+WrkdMAq WDd5s/vNwzRv4XbdEAcAY4sHTicXkkebDr7eDROFEfyiL2V9zDqsHlRrVmfE7qWHIiMXK3BWw/Gu d1wnwTkwggdrMIIGU6ADAgECAhBMAzfzqk7mKu8vbItErxUIMA0GCSqGSIb3DQEBBQUAMIHJMQsw CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFu dGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1l ZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTE2MDIyOTAwMDAwMFoXDTE4MDIyODIzNTk1 OVoweTEXMBUGA1UEAwwOTWljaGFlbCBIYW1tZXIxDzANBgNVBAsMBlMvTUlNRTEgMB4GA1UECgwX WWFhbmEgVGVjaG5vbG9naWVzLCBMTEMxKzApBgkqhkiG9w0BCQEWHG1pY2hhZWwuaGFtbWVyQHlh YW5hdGVjaC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWEk4s5ORfNfQ/oXDD k4mHDQDDpO3s2oEy7055JdLoleNQXEJGsv8EsqPagYul55uVZ57tmx2H1LjM6QfD7N821joisKa4 +l92JImsffrTnll8gxJ9VV9/WmGpPWwFg4ipw3qRdDhQJnQiNKzlqPMSIDE76uhrKv3hYE30tVIO R8U9erAprCBoHd2Ch1+pIGlFjl91//BR1sehnJR9Z1gZHMEqjto/jYPR1uEapueR6W+YuL9O9HmW RLA925xiZmzwKqB8HS0wG+PjLnMRnohdIh4e+/FKWksC82rP7vmP3SHOzQKdgdapaavCTx/1ZYiR N6cMT95ZCgB1aHXR1lCfAgMBAAGjggOcMIIDmDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF oDAgBgNVHSUBAf8EFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwHQYDVR0OBBYEFFaFSmgtcRDwfRFi qt3Vq8LJCLn5MCcGA1UdEQQgMB6BHG1pY2hhZWwuaGFtbWVyQHlhYW5hdGVjaC5jb20wHwYDVR0j BBgwFoAU2EgpqF8qF5Li+p57729gg/i4uNwwggFxBggrBgEFBQcBAQSCAWMwggFfMCcGCCsGAQUF BzABhhtodHRwOi8vcGtpLW9jc3Auc3ltYXV0aC5jb20wggEyBggrBgEFBQcwAoaCASRsZGFwOi8v ZGlyZWN0b3J5LnZlcmlzaWduLmNvbS9DTiUyMCUzRCUyMFN5bWFudGVjJTIwQ2xhc3MlMjAyJTIw U2hhcmVkJTIwSW50ZXJtZWRpYXRlJTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHklMkNPVSUyMCUz RCUyMENsYXNzJTIwMiUyME1hbmFnZWQlMjBQS0klMjBJbmRpdmlkdWFsJTIwU3Vic2NyaWJlciUy MENBJTJDT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQ08lMjAlM0QlMjBT eW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNhdGU7YmluYXJ5 MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2NhXzA3YmI3ZDY0 NzdjZjRmNmJlOTZhZjFiMzZjYWJkMzE2L0xhdGVzdENSTC5jcmwwbAYDVR0gBGUwYzBhBgtghkgB hvhFAQcXAjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEF BQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTBCBgkqhkiG9w0BCQ8ENTAzMAoGCCqG SIb3DQMHMAsGCWCGSAFlAwQBAjALBglghkgBZQMEARYwCwYJYIZIAWUDBAEqMCwGCmCGSAGG+EUB EAMEHjAcBhJghkgBhvhFARABAgIBAYabp24WBjE4NzIwOTA5BgpghkgBhvhFARAFBCswKQIBABYk YUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3DQEBBQUAA4IBAQBX iSRv04vVx/Y5lWWITUJhWXUTnhM70UUqIEinNF+cV9+zY0lomYqoB8ovCfWrvx232tzX86NtreSn 9UjhBRj61oqSyK9v6P14dunX1MjRZmOVeKws3+XDS3NPsopui5YOPjSy02qhyVN4tIDCokj71db1 wO7uZ/DehNWkwFUgMKdVKM5LAGIDHgWn2dvzGi+ipdDNjMD2SxMnCSOiZ3z9gh/Yy+flNaXn5vLL O0AJEW5xCl2tbuPh/DghqlaiVeCLaCar3cj2Ka6ew5wRhNpvmno47b0C5w6JDxx++ijXjGPzYr57 J8QvCDs9f3Cn5doEF3bTQmcab+s3VEgIhAt1MYIE4zCCBN8CAQEwgd4wgckxCzAJBgNVBAYTAlVT MR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3Qg TmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmli ZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkCEEwDN/OqTuYq7y9si0SvFQgwCQYFKw4DAhoFAKCCAtkwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwODIzMTgwMjAzWjAjBgkqhkiG 9w0BCQQxFgQU7vZ9cWjZV2YYqOclRZAK9x6YUcMwgZMGCSqGSIb3DQEJDzGBhTCBgjALBglghkgB ZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0DAgIC AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAhowCwYJYIZIAWUDBAIDMAsGCWCGSAFlAwQCAjALBglg hkgBZQMEAgEwge8GCSsGAQQBgjcQBDGB4TCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eQIQTAM386pO5irvL2yLRK8VCDCB8QYLKoZIhvcNAQkQAgsxgeGggd4wgckxCzAJBgNVBAYT AlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1 c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNj cmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBD ZXJ0aWZpY2F0ZSBBdXRob3JpdHkCEEwDN/OqTuYq7y9si0SvFQgwDQYJKoZIhvcNAQEBBQAEggEA yZ9X0x7Y0KefyEQWgiXf0SOAzzY2ibppph56Riaav3oTjDrjsN8NKBLzxlDuBugV0Xtp6/XQP11t XUn0S4D+AQz4qI3UWWiBFnAqQuQNSuCDslomcMEpE8AAuoHO9TEPbzDfCwyvBMI2B6mr/lvA8sVU N4pzISnPZ/U8tS1qb5qcRfvIF0YP6dT2Z8ZIfwBKCW/Emm4Up89zBsD6mL736pALz/u5jDEBWKim gCqyKlPXJoJtCOF9vpSLK/BuRMPmCAFeG1dau2ZWzrfQG3dWo0jUmC9K9FC6V7Nh1ikqjfMztKSL nUjmS/Rv8iNUvCChyhGcaSXoEds52fQQ7U2v2wAAAAAAAA== ------=_NextPart_000_01EA_01D1FD46.ECE650B0-- From nobody Tue Aug 23 11:21:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E13412D672 for ; Tue, 23 Aug 2016 11:21:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9z50seQlPH1G for ; Tue, 23 Aug 2016 11:20:59 -0700 (PDT) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01D0B12D696 for ; Tue, 23 Aug 2016 11:20:49 -0700 (PDT) Received: by mail-qk0-x22a.google.com with SMTP id z190so114911447qkc.0 for ; Tue, 23 Aug 2016 11:20:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Dp7bLCOgs4jDdjL/n+cftyg1JQHlaQiQSMCRfg52MoU=; b=uYNIvcwLnlTDMgWxrT/spB4RkMoBSA9CjdsqnM63iDm5j6dOsGCiuF5SxvM72CLMkf 2EgDV/iOWhQY2DTf7TeDW7fCSuEg62rG42+rGsKpLKHaboiibd+ETjrmRPDU+K/qXUHi ipE1GsaNgp5cLNXwRsHFYgFJNIVsr9Kenmg/2zO/rSpBpxsATqD5hoY6PfCvjX+nUr8z lhM4PqM4ISFmme2vFmitWvWOyol1jFGrIO/TOrPa4yHiEUXdwUhMqZ8mq9j4cYHr7PR2 YtMBgUgbvDAjD4YTlGNI6G8QWSPJamx1Cu7V966oVvRXw+OWEUn8Mp+McB6iwKTagBuO LomQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Dp7bLCOgs4jDdjL/n+cftyg1JQHlaQiQSMCRfg52MoU=; b=hkwj49IrAxGK9mhYHAcg3gMzyN7/z4/NUL+84b5Fd/VZ1+qeuwGwZ8banRytuo6OEk kPhxB/sgA3fm/JiJ4YSaul9A3/z3MEnFJbAJZCUEQKnSzw9zimLNcBkf1Z92wUkWLbkf iKLludDyWeW5WkgvPSId2CR7Ui1jgsd4ZdXqta+aSOPNfnxiHkzWc12FWTMQle1NzJgM kNSt1XQNcu6ekRKWMCRtwaeRr9M/lZZYbWANeC83ApB3RBYbFJSxCq9coDBMsqs41Rm3 inj6bxJhrFTVEJeQ/gCCPf1dRzn4dJ4iqmghDdHexEpOFBRsQF8VijraV+rL7bz/sSM4 zQyA== X-Gm-Message-State: AEkooutDi4grav7P7ffaJ4PAz6t6X9FxhvMMc7RckrCQrcSMJipqhitgPOcus7pBe7HivQ== X-Received: by 10.55.137.67 with SMTP id l64mr30587404qkd.21.1471976448031; Tue, 23 Aug 2016 11:20:48 -0700 (PDT) Received: from [10.0.1.3] (dynamic-acs-24-154-119-181.zoominternet.net. [24.154.119.181]) by smtp.gmail.com with ESMTPSA id o5sm2435378qko.12.2016.08.23.11.20.47 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 23 Aug 2016 11:20:47 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Tue, 23 Aug 2016 14:20:46 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , Michael Hammer , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 18:21:00 -0000 Scale here, at least initially, is a relatively small number of = participants (service providers) with a relatively small number of certs = (pool per SP) with a relatively high volume of OCSP queries (one per = call, but clearly disbursed to multiple redundant responders). =20 What scaling are you worried about? The protocol? The database? The = compute load? I know of at least one DoD deployment, and a couple of cert providers = who do better than that. Brian > On Aug 23, 2016, at 1:53 PM, Dave Crocker wrote: >=20 > Brian, >=20 > I did not choose the example randomly, nor did I generate an = artificial comment to go along with it. >=20 > With your response -- which I expected -- my example moves from theory = to fact: So, please provide some documentation about its successful use = at scale. >=20 > d/ >=20 > On 8/23/2016 10:49 AM, Brian Rosen wrote: >> Yes, of course you are right. We specified OCSP for this purpose. >>=20 >> Brian >>=20 >>> On Aug 23, 2016, at 1:36 PM, Dave Crocker wrote: >>>=20 >>> On 8/23/2016 10:09 AM, Brian Rosen wrote: >>>> Recognizing that we are beyond the IETF=92s purview, I would say as = long >>>> as the SP has someone to hand the hot potato to, then its hands are >>>> clean and cool. >>>=20 >>>=20 >>> There is a piece of this that is essential to the IETF work, namely = sufficient and explicit clarity about usage alternatives to ensure that = the technical specifications can support them. >>>=20 >>> Specifying a cert subsystem that relies on a timely and accurate = revocation list, at the scale and granularity of per-number, would be an = example of something that has never been done, where the relevant = history strongly indicates it won't work. >>>=20 >>> That level of consideration and design choice is very much /inside/ = the IETF's purview. >>>=20 >>> d/ >>>=20 >>> -- >>>=20 >>> Dave Crocker >>> Brandenburg InternetWorking >>> bbiw.net >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >>=20 >=20 >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Tue Aug 23 11:45:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54C9512D757 for ; Tue, 23 Aug 2016 11:45:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ulz_0wosTmVw for ; Tue, 23 Aug 2016 11:45:51 -0700 (PDT) Received: from qproxy1-pub.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id DB95112D74F for ; Tue, 23 Aug 2016 11:45:50 -0700 (PDT) Received: (qmail 24862 invoked by uid 0); 23 Aug 2016 18:45:46 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by qproxy1.mail.unifiedlayer.com with SMTP; 23 Aug 2016 18:45:46 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id aigf1t0131MNPNq01igije; Tue, 23 Aug 2016 12:40:45 -0600 X-Authority-Analysis: v=2.1 cv=aqYhV0pV c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=kj9zAlcOel0A:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=JMHYQVG13d8A:10 a=7z1cN_iqozsA:10 a=VfgTrTGYAAAA:8 a=48vgC7mUAAAA:8 a=l0HRthSk83dBOp8NJRgA:9 a=bp58LwoCR-umc2AU:21 a=lwDZrkZn3jso7fZU:21 a=CjuIK1q_8ugA:10 a=ORFRI7aeUVbPhtmlmiRh:22 a=w1C3t2QeGrPiZgrLijVG:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Message-ID:References:In-Reply-To:Subject:Cc:To:From:Date: Content-Transfer-Encoding:Content-Type:MIME-Version; bh=QjOSPzFJvoF8bqmwIO2BP1UiINalmVi9HWMpbJ6Dlec=; b=DVCzJLMThdUwIgYOievCzgil4d RLwj5rqh577zg2BMa7wicqkPZhUQSdiqD4tERgKzB6aUxjsdibi3vwknOOIHneaiWvFkaiPqofwKU wfKESENOk5OuRNkWCGIONeUEe; Received: from [127.0.0.1] (port=47067 helo=box462.bluehost.com) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bcGcr-0005lb-9H; Tue, 23 Aug 2016 12:40:41 -0600 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Tue, 23 Aug 2016 12:40:41 -0600 From: richard@shockey.us To: Bernard Aboba In-Reply-To: <90DCAECF-41E9-4212-8894-A2799E733F90@gmail.com> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <90DCAECF-41E9-4212-8894-A2799E733F90@gmail.com> Message-ID: X-Sender: richard@shockey.us User-Agent: Roundcube Webmail/1.0.6 X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 127.0.0.1 authed with richard@shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 127.0.0.1 X-Exim-ID: 1bcGcr-0005lb-9H X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (box462.bluehost.com) [127.0.0.1]:47067 X-Source-Auth: richard@shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: stir@ietf.org, Alex Bobotek , David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 18:45:54 -0000 Expectations will be determined my national policy (this is fully Title II Telecom) and ultimately codified into bi-lateral interconnection agreements among providers. There are already some safe harbor provisions in place at the FCC that permits the carrier to block at the direct request of the consumer. If there are clarifications needed then those questions, including additional enforcement issues will be outlined by the FCC Strike Force. As for secondary users of NANP resources we can presume the SP of record may issue a credential to the ( OTT provider ) that will have some indication of secondary providers identity [ aka a OCN number ]. You can bet this will apply to the International Wholesale gateways. We don't need to specify every corner case. In fact the IETF should not specify ANY policy consideration. As for the larger issue of distribution of credentials I think you can assume that for the first order instantiation those entities with direct access to the NANP will have access. Those non facilities based carriers can apply for direct access to the NANP in the usual way at the FCC they way Vonage did or work with their business partners. We start with circles of trust and build out. Example of large scale PKI distribution schemes are well documented and this is not even large scale. We are not talking TN level except for some very very specific use cases that are outside the scope of these drafts. Its been suggested btw that the certificate draft needs specific language indicating that National Regulatory Authorities need to take approproiate steps to assert their authority and control over these resources surrounding their portions of the E.164 consistent with appropriate national laws and regulations. On 2016-08-23 08:40, Bernard Aboba wrote: > On Aug 23, 2016, at 06:25, Alex Bobotek wrote: > >> So putting all of this together, it seems that the __pressing__ need >> is for signing by the originating service provider using a key >> assigned to that service provider, but little more. There is >> urgency; both delay in standards approval and additional complexity >> that slows or inhibits widespread STIR adoption are undesirable. > > [BA] If we only have signing by the originating service provider, what > are the expectations on the provider that come with signing? Is it > only that the call originates from an authenticated customer (but not > necessarily that the TN is authorized for that customer)? Or can the > provider only sign for TNs they are assigned (or for TNs assigned to > that customer)? Trying to understand what claims made in the draft > remain for the most likely initial deployment scenario. > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 23 11:46:59 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3E7A12D5BF for ; Tue, 23 Aug 2016 11:46:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z2Rse3GU5Fs1 for ; Tue, 23 Aug 2016 11:46:56 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 11FDF12D75C for ; Tue, 23 Aug 2016 11:46:55 -0700 (PDT) Received: (qmail 27311 invoked by uid 0); 23 Aug 2016 18:46:54 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy2.mail.unifiedlayer.com with SMTP; 23 Aug 2016 18:46:54 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id aiho1t0071MNPNq01ihryi; Tue, 23 Aug 2016 12:41:54 -0600 X-Authority-Analysis: v=2.1 cv=PJecp5aC c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=JMHYQVG13d8A:10 a=7z1cN_iqozsA:10 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=48vgC7mUAAAA:8 a=ePXwuIbfLnJ3Hwzm0u4A:9 a=di1ufcb6OZIXHOR4:21 a=bU1ihEncaiXGCvP5:21 a=QEXdDO2ut3YA:10 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 a=w1C3t2QeGrPiZgrLijVG:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Message-ID:References:In-Reply-To:Subject:Cc:To:From:Date: Content-Transfer-Encoding:Content-Type:MIME-Version; bh=HO7I1XUNSPcssw4xF68Mhkjb7dLOs2FeEzX7UDatkHg=; b=pVH4DRZuK10ZExhsqN4dnPrXM6 OCUg964/CAb4UQYqYmW3z+MYSG99thfflTpsVFOeMS6Hw63VPJphrkWQyqFx+BBQqlZOwIWQjw0yd d4FVwQGZBuGgE+P05Q/neXlJS; Received: from [127.0.0.1] (port=49151 helo=box462.bluehost.com) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bcGdv-0006Oo-TN; Tue, 23 Aug 2016 12:41:47 -0600 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Tue, 23 Aug 2016 12:41:47 -0600 From: richard@shockey.us To: Brian Rosen In-Reply-To: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> Message-ID: <3ba4b5781f958b8e4ff3b1b63e8b9abf@shockey.us> X-Sender: richard@shockey.us User-Agent: Roundcube Webmail/1.0.6 X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 127.0.0.1 authed with richard@shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 127.0.0.1 X-Exim-ID: 1bcGdv-0006Oo-TN X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (box462.bluehost.com) [127.0.0.1]:49151 X-Source-Auth: richard@shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: dfrankel@zipdx.com, md3135@att.com, stir@ietf.org, dcrocker@bbiw.net, alex@bobotek.net, Michael Hammer Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 18:46:58 -0000 +1 On 2016-08-23 12:20, Brian Rosen wrote: > Scale here, at least initially, is a relatively small number of > participants (service providers) with a relatively small number of > certs (pool per SP) with a relatively high volume of OCSP queries (one > per call, but clearly disbursed to multiple redundant responders). > > What scaling are you worried about? The protocol? The database? The > compute load? > > I know of at least one DoD deployment, and a couple of cert providers > who do better than that. > > Brian >> On Aug 23, 2016, at 1:53 PM, Dave Crocker wrote: >> >> Brian, >> >> I did not choose the example randomly, nor did I generate an >> artificial comment to go along with it. >> >> With your response -- which I expected -- my example moves from theory >> to fact: So, please provide some documentation about its successful >> use at scale. >> >> d/ >> >> On 8/23/2016 10:49 AM, Brian Rosen wrote: >>> Yes, of course you are right. We specified OCSP for this purpose. >>> >>> Brian >>> >>>> On Aug 23, 2016, at 1:36 PM, Dave Crocker wrote: >>>> >>>> On 8/23/2016 10:09 AM, Brian Rosen wrote: >>>>> Recognizing that we are beyond the IETF’s purview, I would say as >>>>> long >>>>> as the SP has someone to hand the hot potato to, then its hands are >>>>> clean and cool. >>>> >>>> >>>> There is a piece of this that is essential to the IETF work, namely >>>> sufficient and explicit clarity about usage alternatives to ensure >>>> that the technical specifications can support them. >>>> >>>> Specifying a cert subsystem that relies on a timely and accurate >>>> revocation list, at the scale and granularity of per-number, would >>>> be an example of something that has never been done, where the >>>> relevant history strongly indicates it won't work. >>>> >>>> That level of consideration and design choice is very much /inside/ >>>> the IETF's purview. >>>> >>>> d/ >>>> >>>> -- >>>> >>>> Dave Crocker >>>> Brandenburg InternetWorking >>>> bbiw.net >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> >> -- >> >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Aug 23 12:14:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64FEF12D984 for ; Tue, 23 Aug 2016 12:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SKe_yniYYbqY for ; Tue, 23 Aug 2016 12:14:43 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B92012DA7E for ; Tue, 23 Aug 2016 12:12:26 -0700 (PDT) X-AuditID: c1b4fb3a-c7bff700000009bd-d7-57bca01765fe Received: from ESESSHC011.ericsson.se (Unknown_Domain [153.88.183.51]) by (Symantec Mail Security) with SMTP id 27.84.02493.710ACB75; Tue, 23 Aug 2016 21:12:24 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.179]) by ESESSHC011.ericsson.se ([153.88.183.51]) with mapi id 14.03.0301.000; Tue, 23 Aug 2016 21:12:23 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , Eric Rescorla Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR/JI0ubFrdbKggkCO9F2iW0BZU6BWhCyAgAABtACAACpqMP//4L4AgABXHuA= Date: Tue, 23 Aug 2016 19:12:22 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC35CC8@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> <3b89d32f-3090-d883-b0d1-26c021f94ce9@dcrocker.net> In-Reply-To: <3b89d32f-3090-d883-b0d1-26c021f94ce9@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphkeLIzCtJLcpLzFFi42KZGbHdWFdiwZ5wg7kTDSx+f/rAZrHi9Tl2 i+VrtzE5MHtc2nmSzWPJkp9MHpMftzEHMEdx2aSk5mSWpRbp2yVwZfxvSi+4xlnx60Q/SwPj ZfYuRk4OCQETiSWNF1i6GLk4hATWM0ps3fwYylnCKDF7wW/GLkYODjYBC4nuf9ogDSICnhJ7 Wi6wgtjMAuoSLx69ARskLBAosXLrChaImiCJky9eskPYfhLH1t9jBLFZBFQl7p34C1TDzsEr 4Cux1BVi011WiUUdm8BGcgo4SBydvAbMZhQQk/h+ag0TxCpxiVtP5jNB3CwgsWTPeWYIW1Ti 5eN/rBC2kkTjkidQp+lILNj9iQ3C1pZYtvA1WD2vgKDEyZlPWCYwis5CMnYWkpZZSFpmIWlZ wMiyilG0OLW4ODfdyEgvtSgzubg4P08vL7VkEyMwbg5u+W21g/Hgc8dDjAIcjEo8vA/C9oQL sSaWFVfmHmKU4GBWEuHVmgMU4k1JrKxKLcqPLyrNSS0+xCjNwaIkzuv/UjFcSCA9sSQ1OzW1 ILUIJsvEwSnVwFiqs7Fr7k6VKRNbEqaruj39f2rlvzL7moIfG44t3NNVEGX+xOqQ0UKVS34O 64V4jfMsT6o7m91ry/bhPyeednCm6ke+7HNRxZl7BXPFY9dyrPWyml3isDZmn9jSDf8amLie mT/IjdGSyvr9eCNH07VMrwOH/4Q7PD/B1SDJlCwT4vJ2xY01P5VYijMSDbWYi4oTAZJPKyOX AgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 19:14:44 -0000 Hi, >>> Why isn't it just stuffed into a single header field, like STIR-Signatu= re: or the like? >> That was my question too. Something like: >> >> Identity: >> >> But, at the end of the day, I want something that works, and Jon promise= d to=20 >> describe how the "splitting" works in the next revision of the draft. > > Not just how, but why. > > What you and I are describing is simple and direct. Splitting things add= s another step. Extra steps need justification. I guess Jon should reply to that question, but one reasons was related to t= he suggestion (I don't think that WG has made a decision, but please correc= t me if I'm wrong) that it should be optional to send the headers represent= ation of the JWS, as that information (cipher suite etc) can be found in ot= her SIP elements. However, Appendix F of RFC 7575 is unclear on whether it'= s allowed remove the headers representation from the JWS - the Appendix see= ms to only talk about not sending the payload representation (which, in the= case of SIP, can also be found in other SIP elements). So, there could be = cases were one would only send the signature representation of the JWS.=20 Regards, Christer From nobody Tue Aug 23 15:52:06 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83D8712D144 for ; Tue, 23 Aug 2016 15:52:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ET4iyHWhRROw for ; Tue, 23 Aug 2016 15:52:04 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E969312D0E8 for ; Tue, 23 Aug 2016 15:52:03 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7NMqBdC026419 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 15:52:11 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1471992731; bh=nNm0vaKF8afBhmNkt1O+HtNu1ydH5Ru4dcoscIoSycM=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=lh7xDC+o+PYVnFhrfxKVPy0FIY7f1oS8tYkEiIxM5m8X9lfZwqTlgXUotaf3SoqWg wt8NVkkNPaG9c8ZePptSGoR8iQur9ewTv+Hf7Bzb1aBeUnQ79ckZRojTXrohN9Fpq9 Vv5Kx2xqZ3acqgmfq1tJFTR+zxh+YahnJvYxlOL8= To: Christer Holmberg , Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> <3b89d32f-3090-d883-b0d1-26c021f94ce9@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC35CC8@ESESSMB209.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <99a81130-9229-6fdf-ba1f-131762cb238f@dcrocker.net> Date: Tue, 23 Aug 2016 15:51:41 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BC35CC8@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2016 22:52:04 -0000 On 8/23/2016 12:12 PM, Christer Holmberg wrote: >> What you and I are describing is simple and direct. Splitting >> things adds another step. Extra steps need justification. > > I guess Jon should reply to that question, but one reasons was > related to the suggestion (I don't think that WG has made a decision, > but please correct me if I'm wrong) that it should be optional to > send the headers representation of the JWS, as that information > (cipher suite etc) can be found in other SIP elements. That just extends the question: Why are things such as cipher suite in a SIP header field, separate from the JWS header-field? I believe 4474bis gives no insight about the motivations or efficacy of any of this. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 20:14:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0171D12D73E for ; Tue, 23 Aug 2016 20:14:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cMtFVTndjX8k for ; Tue, 23 Aug 2016 20:14:19 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D65012D1AD for ; Tue, 23 Aug 2016 20:14:19 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7O3EJ8c002281 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 20:14:19 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472008463; bh=5N7rp07O5/EE0dx/cMQTNBAkwcPLONyDkLMalW5yZg0=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=LjTeEJ+gE/kbTkjlEHa7Kgz997L6sM5GJGUuhVKLaPDRjwi2h5/0elIlmf3py3kO+ 9OJfOsB5L+BHChuS+qbold54p/ko0MHySQAPRB7VAcP3KnxzDM+XA0wBCVyxM0HZHa dJR3bcP0ZqnO9bzQO+ffUwFLo4PVtXCwJKXspJMA= To: Brian Rosen References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Tue, 23 Aug 2016 20:13:48 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , Michael Hammer , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 03:14:20 -0000 Brian, On 8/23/2016 11:20 AM, Brian Rosen wrote: > Scale here, at least initially, is a relatively small number of > participants (service providers) with a relatively small number of > certs (pool per SP) with a relatively high volume of OCSP queries > (one per call, but clearly disbursed to multiple redundant > responders). So this system is intended for use with only a small number of tightly-integrated participants? But wait, we certainly know that they are expected to be /administratively independent/? So the scale and implied tight integration are not not what I've been hearing, where some folk even believe this needs to support verification by independent end-user devices. And your response leaves open the question of what is expected for global operations. Anyhow, what is significant is that no one has bothered to specify and gain consensus on the operational targets. And of course, the larger flaw in your response is that we don't use 'initially' as the design target when asking about scaling. (We do use it when talking about early adopters, but that's an entirely different topic.) > What scaling are you worried about? The protocol? The database? > The compute load? None of those. The task here is for a query service that operates on a global scale with perhaps some thousands of /independent/ service providers and perhaps billions of (potentially independent) verifiers, based on the aggregate of comments people have been making. (Yes, I believe that is a reasonable summary and yes I fully expect folk to challenge the summary; that's fine. Get the goal documented with consensus and people won't be pulling out stray targets they find convenient.) Now, please point out the large number of query services successfully deployed on the Internet that conform to that operational target. The only one I know of is the DNS. And then there the failure of ENUM to perform pretty much exactly the query task needed here, albeit returning different information. Unless that difference in what is returned is offered as justifying comfort for this new effort -- with an explanation for why -- I remain mystified and the lack of concern about the technical and operational details of this key functional requirements for STIR. > I know of at least one DoD deployment, and a couple of cert providers > who do better than that. None of that is relevant to the operational requirements here. Seriously Brian, is the issue of large-scale, independent administrative control that foreign a topic to this working group? d/ > Brian >> On Aug 23, 2016, at 1:53 PM, Dave Crocker >> wrote: >> >> Brian, >> >> I did not choose the example randomly, nor did I generate an >> artificial comment to go along with it. >> >> With your response -- which I expected -- my example moves from >> theory to fact: So, please provide some documentation about its >> successful use at scale. >> >> d/ >> >> On 8/23/2016 10:49 AM, Brian Rosen wrote: >>> Yes, of course you are right. We specified OCSP for this >>> purpose. >>> >>> Brian >>> >>>> On Aug 23, 2016, at 1:36 PM, Dave Crocker >>>> wrote: >>>> >>>> On 8/23/2016 10:09 AM, Brian Rosen wrote: >>>>> Recognizing that we are beyond the IETFs purview, I would >>>>> say as long as the SP has someone to hand the hot potato to, >>>>> then its hands are clean and cool. >>>> >>>> >>>> There is a piece of this that is essential to the IETF work, >>>> namely sufficient and explicit clarity about usage alternatives >>>> to ensure that the technical specifications can support them. >>>> >>>> Specifying a cert subsystem that relies on a timely and >>>> accurate revocation list, at the scale and granularity of >>>> per-number, would be an example of something that has never >>>> been done, where the relevant history strongly indicates it >>>> won't work. >>>> >>>> That level of consideration and design choice is very much >>>> /inside/ the IETF's purview. -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Aug 23 20:49:25 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C9C112D1C7 for ; Tue, 23 Aug 2016 20:49:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ku1TKHMqXPnC for ; Tue, 23 Aug 2016 20:49:22 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1B9912D1A5 for ; Tue, 23 Aug 2016 20:49:22 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7O3nWAN002784 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Tue, 23 Aug 2016 20:49:32 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472010573; bh=f+96AG91887ptHomVSnzSmanBNNleP57BaNg91zayqY=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=L/obYihacHCGRUDhntJzKMUe6v8Lyfi+qL8VqEVA+gXkYGlueDG0GvamZNCjmzcd8 EYmeTC9WUWWaBpVTjVCnVG7K4Wdx/vo+WsULr9yQMNHawwE/EqfV6AcnYgw30RmNaN 6RDnbbSsgqIoD5hz6S7wQg1O9FwK70FatTn3AKGE= To: Eric Rescorla References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> Date: Tue, 23 Aug 2016 20:49:01 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 03:49:24 -0000 Eric, On 8/22/2016 9:26 AM, Eric Rescorla wrote: > On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker > wrote: > > Eric, et al, > > On 8/21/2016 6:50 AM, Eric Rescorla wrote: > > On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker > >> wrote: > > [*] Use of certs for the web are famously problematic. > First, the > only serious reliance on them is to prevent MITM attacks. > Second, > are all of the operational problems with root CAs. Third > are all > the times sites do self-signing. > ... > > 1. I'm not quite sure what you mean when you say that the only > serious > reliance of Web certificates is to prevent MITM attacks. In > general, the > purpose of Web certificates is to authenticate the endpoints > involved in > the HTTPS connection, thus preventing attackers from > impersonating one > of those endpoints (whether the attacker then does an MITM attack or > some other attack is kind of a detail; for instance an attacker > might > just impersonate a site without ever connecting to it). What purpose > would you expect these certificates to serve that they are not > serving? > > First, apologies; my comment was much too cryptic. Second, my > comment was on current operational realities, whereas your response > started by noting intent. > > Thanks for clarifying. Responses below. > > This disparity evokes the cliche about the difference between theory > and practice. > > Now to be less cryptic: > > The TLS specification supports server authentication, client > authentication and channel encryption. Its primary use, at scale, > is only for encryption. Server authentication is performed, if > possible, but only to make the encryption protect against > man-in-the-middle attacks. (My understanding is that client > authentication has no significant use.) Absent that authentication, > opportunistic encryption protects against passive wiretapping but > not MITM. Hence my previous, cryptic summary. > > I don't believe that this is an accurate summary of the situation. > Certificates are routinely used for server authentication in settings > where the primary target is not confidentiality of the traffic but > rather integrity of the data between the server and the client (or vice > versa). A typical example would be software download (or alternately, > embedding of JS libraries into Web applications) where it's obviously > important that the user get the software they intended. As a specific > example, Mozilla distributes Firefox over HTTPS not because Firefox is > secret but because we don't want attackers tampering with it. Encryption > is generally used in those scenarios as well merely because that's how > TLS is customarily operated, but primary target is integrity/data origin > authentication. So, yes, I take your point, although there's some irony to your explanation. Your example for data integrity is concern with tampering. Discounting my imprecision in saying "MITM" that you note, I believe your example falls under that very same concern as the one I expressed... > I'm not sure what you would consider "significant" use of client > authentication but I can tell you that it's in sufficiently wide use > that we had to make special accommodations in TLS 1.3 for some variants > of client auth because it was so important in enterprise use cases. Dandy. Let's see some citations for its successful and continuing use at scale over the open Internet (ie, with lots of independent administrations.) > Incidentally, it would probably be helpful here to avoid the use of the > term "MITM". I appreciate that that terminology once had wide currency, > but it really only refers to a specific class of impersonation attack, > and not necessarily the one of interest. For instance, if I impersonate > Mozilla and send you malware instead of Firefox, I don't need to connect > to Mozilla's server, so it's not really a MITM Attack, just server > impersonation. Point taken. And for careful technical discussions about very specific attack vectors and mitigation strategies, careful labeling is of course essential. My casual use of MITM was actually meant to refer to 'anything that has an active attacker participating in the data stream with the client, at the level of generating responses'. (Otherwise, it's just passive monitoring.) It would be nice to have a single term that covers MITM and server compromise. > As for serving other purposes, certs are also used to validate the > target (server) domain name in a web session -- that is, it the > obtained server authorized under the domain name used by the > client. While I believe that the mechanisms for this are in > relatively widescale use, there's been little-to-no demonstrated > efficacy, which limits the amount people attend to any possible > problems with the certs. (Why spend time worrying about something > that isn't useful?) There are also the significant domain name > matching problems with the mechanism, prompting a significant > revision effort. I haven't been its status, but the work is recent. > > This seems to be raising a separate question, namely whether the Web PKI > system actually meaningfully achieves its security goals. I'm not aware Well, 'efficacy' is meant in a somewhat higher-level way. Is the nature of the use of that authentication -- that is, the consumption of the produced data -- at at least the same level of trust as is being targeted here? If the goal here is for use that requires more trust that that established use -- e.g., greater downside if there is a problem -- then established use isn't comparable. > of any definitive research in this area, however, I also think it's fair > to say that HTTPS is widely considered to be best practice and that both > browser vendors and TLS implementors take authentication failures seriously. Sure. For protecting against wiretapping and MITM attacks. (Except for one of the many servers that self-sign their cert, in which case MITM protection is largely absent.) > 2. It's certainly true that there have been a number of high-profile > instances of misissuance by trust anchors, but I'm not sure that > this > speaks as much to inherent problems of PKI as to the scale of > the Web > PKI and the number of trust anchors in the system. > > > Therein likes a really basic disconnect between the security > technical community and the real world. 1) The history appears to > be much worse than you indicate[*]. > > > > Does this footnote go somewhere? darn. yes. sorry. see below.[*] > 2) Your comment appears to imply exclusion of human factors from > analysis of cert issues. > > > Hmm... Can you elaborate on this? There are serious and continuing problems with the global operations of CA roots -- that's a human factor. There is large-scale use of self-signing certs, indicating a major and widespread hole in the official 'CA root' model -- that's a human factor. Analysis of working systems needs to treat all of the human actors as part of that working system. If there are serious and/or persistent problems with those folk, then there is a serious or persistent problem with the system. > 3. I'm not sure how self-signing comes into things; self-signing is > largely a response to difficulty in obtaining valid certs. My > understanding was that STIR was going to have a more straightforward > (and initially less distributed) issuance story. > > I was noting an operational reality, in the environment that is the > largest users of certs. It is the ultimate demonstration of the > failure of that model. > > > I'm going to have to differ here. I certainly wouldn't argue that the > Web PKI system is perfect, but it has also become vastly easier to > obtain and deploy certificates (thanks in large part to efforts like > Let's Encrypt, SSLmate, Caddy, and Amazon's CA), and our telemetry shows > that we're approaching 50% of browser transactions being HTTPS, despite > the browsers strongly discouraging self-signed certs so I think > "ultimate demonstration of the failure" somewhat overstates things. I note that you don't offer a metric on the amount of self-signing that is done. > More generally, if STIR authentication merely worked almost as > well as > the Web PKI, that seems like it would be pretty significant > improvement > over the current situation.> > That does sound appealing, doesn't it? > > Except that I believe there is no documentation to support even this > modest a claim of efficacy, while there is quite a bit of > documentation of failures and problems with Web PKI. > > Hmm.... What kind of documentation would you consider to support this > kind of claim (leaving aside the question of whether such documentation > exists). Reports of tiger team efforts to crack a variety of web traffic -- and failing -- would be nice. Certainly it would be nice to hear fewer stories about server data bases getting compromised. My point is that from what I can tell, most of the confidence in the Web PKI system comes from theoretical analysis rather than active operational measurement. d/ [*] A few articles on certs: o Phishing sites exploit trust in valid SSL certificates http://www.infoworld.com/article/2992605/security/phishing-sites- exploit-trust-in-valid-ssl-certificates.html o Microsoft move to revoke trust in 20 root certificates could wreak havoc on sites http://www.pcworld.com/article/3017157/security/microsoft-move-to- revoke-trust-in-20-root-certificates-could-wreak-havoc- on-sites.html o What You Should, But Don't, Do About Untrusted Certs, CAs http://www.darkreading.com/cloud/what-you-should-but-dont-do-about- untrusted-certs-cas-/d/d-id/1322111 o IT pros don't get cybersecurity risks around certificate authorities http://searchsecurity.techtarget.com/news/4500253216/IT-pros- dont-get-cybersecurity-risks-around-certificate-authorities o What you need to know about Dell's root certificate security debacle http://www.infoworld.com/article/3008422/security/what-you-need- to-know-about-dells-root-certificate-security-debacle.html -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Aug 24 00:31:58 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0994312D520 for ; Wed, 24 Aug 2016 00:31:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I0oLn7YTNBTp for ; Wed, 24 Aug 2016 00:31:44 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EFC512B035 for ; Wed, 24 Aug 2016 00:31:43 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7O7Nhxr002593 for ; Wed, 24 Aug 2016 03:31:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=iVZ8kin9eIIStcOoxZQCJ3BhHoRV7wKAvt6l+j/XYDU=; b=jOSKPtHLvzRiYN97YKBeC1Q9D+tDjb5sX4HnbVRpx5qHBmHSgf6TwRvGZQfhAdlBVp0o 5DVpRWSPJUMZlFCCFLAF5/Vp4cosuh+4i0573dPVEg0t9WfE+MOp+cTCbeP5FcxBswZv YTlcTfHd4VDpZXiYJdCqMulxfyJ1xIT6/8VRP5QGDn40kIJWBUzgX6oD/O6Ww1TMCiPb 67iTcINEKeQiexPGTWNa2lJXJars3quAPYWl0cHN575egwbJrGvDApZ6ycGtsqnIwDi2 2LRius42W5qT1HKnFOhdefgQRyungck92KToU4LZnDjvSg4K2jsIZpHMTunybTPYdnom DA== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24xkaqsdf8-7 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT) for ; Wed, 24 Aug 2016 03:31:41 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 03:31:40 -0400 From: "Peterson, Jon" To: "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBRJ7GAgAZ1NQA= Date: Wed, 24 Aug 2016 07:31:39 +0000 Message-ID: References: <7021ff80-371f-759c-c2a9-3b914a7ee397@dcrocker.net> In-Reply-To: <7021ff80-371f-759c-c2a9-3b914a7ee397@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: multipart/mixed; boundary="_002_D3E298EB1A9ECEjonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240067 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 07:31:57 -0000 --_002_D3E298EB1A9ECEjonpetersonneustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-ID: <64DB8BC5972C0643B99FB250CCCECE7D@neustar.biz> Content-Transfer-Encoding: quoted-printable I did read through this review of my responses, or a re-review we'll call it. Although it does appear that I neglected to respond to some comments in the initial review, I don't think they turned out to be very major ones. I did try at the end to singe out the points that the re-review considers with special emphasis; but again, I'm not sure I see these as showstoppers. Tha much said, I hae been making numerous changs in going through the spec after readig this and some other detailed reviews I've received, so I'm sure ths is influncing the changes being made, even were my initial reaction here is to push back. Jon Peterson Neustar, Inc On 8/19/16, 2:54 PM, "stir on behalf of Dave Crocker" wrote: >Folks, > >This note responds to Jon's responses to my review. (I'll be responding >to Russ's request separately.) > >Correlating Jon's responses with the actual review (and therefore also >to the full specification), to get a more complete context, proved to be >an excessive burden, as well as making it essentially impossible to >determine what was skipped. > >So I've integrated: > > > Jon' responses into > > >> my original review note, > >to elminate that burden. I'll apologize now, for the inevitable >miscorrelations that are sure to hav occurrd. Also, I'd advised Jon >that skipping the small stuff would be fine, ut he seems not to have >done that, except sometimes... > >(In a meager effort to abbreviate things however slightly, I've deleted >text of Jon's, at the beginning of each his response entries, meant to >provide context for the response, since the context will now be readily >evident. I realize that readers will miss his colorful annotations used >to introduce my comments, with really spiffy choices like: warily asks, >squints, alleges, interjects with sound and fury, exclaims, denounces, >condemnation, confesses, defiant, blurt out, gamely notes, and well gosh >so many more clever choices. But my favorite was "interject with >bafflement"; that was really creative.) > >I've put "{{ No resonse from Jon. }}" as needed. Again, for the minor >stuff, in a nomal review discussion, I wouldn't worry about such >omissions. Alas, given the relities of this particular exchange, it >seems worth marking things explctly for the record. > >I'm also sorry that I think it necessary to inludeall of the original >material. Again, in a normal exchange I'd elide asmuch as possible, >but am afraid it would be risky here. > > > > >> On 8/8/016 8:46 PM, Dave Crocker wrote: >>> eview of: Authenticated Identity Management in the Session Initiation >>> Protocol (SIP) >>> ID: draft-ietf-stir-rfc4474bis-0.txt >>> Date: 8 August 2016 >>> Reviewer: D. Crocker >>> >>> >>> >>> >>> Summary >>> ------- >>> >>> SIP needs to support a mechanism that validates the identifier used for >>> the originator of the request. That is, to ensure that the entity that >>> placed the identification value into the field was authorized by its >>> owner to do so. This specifications is part of a collection of >>> specifications intended to enable such validation. >>> >>> >>> Taken on its own and also when taken with its companion documents, the >>> specifications are confusing and incomplete. It is quite far from >>>being >>> ready for pblication. >>> >>> >>> >>> Terminology is used inconsistently. It ofte is introduced with no >>> background or citation. Many uses of 'header' are probably supposed to >>> be 'eader field'. My sens is that quite a bit of terminology is used >>> equally loosely. >>> >> There is no integrative architectural description, so the reader has >> difficulty understanding what all of the pieces are or how they fit >>> ogether. In fact is appears that the document itself gets confused on >>> this matter.>>> >>> Algorithms are all offered only as prose and often in a form itigating >>> comprehension, such as tendig towards negation or disjunctin, which >>> humans process less well than affirmatives and conjunctions. From what >>>I >>> can tell, the algorithms often ae incomplete, but serious analyisis >>> difficult. >>> >>> The documents appear t rely on a reader's having quite a bit of prior >>> knowledge and are certainly not usable by an implementer who is not >>> already deeply embedded n the community that produced these >>> specifications. My impression is that being embedded won't suffice >>> either, both from my assessment of the documnts' deficiencies and >>>given >>> back-channel comments I have heard about the expectation of the work to >>> be doe after these specificatons are published. >>> >>> >>> Overall, the writig impedes comprehension and the documentneeds a >>>very >>> diligent pass by a technical editor. I suspect this will uncover quit >>> a number of semantic deficiencies in the text. >>> >>> >>> There is a possibl tendency to support more alternative behavior than >>> appropriate. Successul ineroperaility usually benefits from fewer >>> choices, not more. Common, mandatory cannicalization is an example. >>> >>> Credentials: the specification neiher definesnor references a >>>standard >>> for the specification of credentials,here. That means that the >>> technical details -- as distinct from the operational policies -- of >>> credentials are out of scope, although they are fudamental to proper >>> operation of this serve. This is a showstopper, in terms of >>> specification cmpleteness for the service. >>> >>> How is the recipient to know what credential 'standard' is used? How >>> does this ensure interoperability between two participants who have not >>> interacted before? >>> >>> t base, these specifications appear intended to roughly chart out a >>> system structure, leaving most of the diffcult work for later and >>> elsewhere. By way of example, there are few if any cross-orgnization >>> key management services on the Internet that demonstrate the utility >>> neede here. I am pretty sure that Web certs don't qualify. We know >>> that DKIM's operation does, of course. However DKIM strictly uses >>> domain names as identifiers and they onveniently align with their >>> administrative authorities, whereas telephone numbersdo ot... >> >>> [[[ The mailing list just had an extensive regurgitation of >>> critical commentary about ENUM. What appears to be getting missed is >>> that whatever mechanism is going to be used for finding and validating >>> keys is going to have no operational history of reliability, safety or >>> efficacy. ]]] >>> >>> There is remarkably little f the oiginal RFC 4474 substance still in >>> this document. Calling it a bis is a bit like tearing all of a >>>building >>> except its fireplace or its front door and calling that a remodeling. >>> The previous document does not ave an installed base, so I strongly >>> suggest removing all references to it. It wil allow some of the text >>> to be notably simpler and clearer. >>> >>> The document is heavy with forward references. These force the reader >>> to stop what they are in the middle of, try to hold that place, and >>>look >>> forward to understand what they've just been interrupted from reading. >>> As a literary style, forward references create useful tension. In >>> specifications they just interrupt the flow. The document should be >>> reorganization so that integrative text comes /after/ the text >>> describing the pieces being integrated. And opening overview, design >>> summary, or the like can give a non-normative description of the >>> architecture and the service, so the readr has a basic sense of the >>>big >>> picture, before diving into the detail of those to-be-integrated >>>pieces. > >{{ No response from Jon. }} > > > >>> Detail Comments >>> --------------- >>> >>>> Abstract >>>> >>>> The baseline security mechanisms in the Session Initiation Protocol >>>> (SIP) are inadequate for cryptographically assuring the identity of >>>> the end users that originate SIP requests, especially in an >>> >>> an end user originating a SIP request >>> >> cryptographically -> adequately >>> >>> 'cryptographically' s not the issue here That is, it is a means, not >>> an end. > > >The very first interjection in theline-by-line review rejects the >> assertion in the Abstract that the ecurity mechanisms of SIP are > > "inadequate for cryptographically ssuring the identiy of end > > users," instead arguing that we shold substitute "adquately" for > > "cryptographically". This would however result intext that reads > > "nadequate for adequately assuring the identity of end users." I > > think "inadequate for dequately" is a poor change. This is a pretty > > good indication of the major limitation of the review overall - these > > line-by-line comments often cosider only one atom of the spec in > > isolation from its surrounding context and thus pose difficulties > > that don't actually exist and propose remedies that do not fit very > > well into local surroundings or overall plan. > >One would have thought that the summary comments, at the beginning, >would have sufficiently served in terms of the larger picture. > >And while ye, I didn't catch the redundant vocabulary, you seem to have >missed my pint entirely. So I'll say it more fully: > > Overview text, for nything that is not defining new>cryptography,= but which starts by citing cryptography, is usually >faling to focus on wha is primary: necessary goals and functionality, >which are the why and what, and is instead bein distracted by the >underlying mechanics, which are the how. In this case, that means it >hould not be citing crypto but sould, for example, authentication. > >Cryptography and theuse of cryptography are not a primary goal and so >the summary text should instead focus on the primary goals. > > >>> >>> >>>> interdomain conext. This document defines a mechanism for >>>>securely >>> >>> 'terdomain' might suffice, but I suspect it's worth pressing the >>> issue with language like "especially acrosstrust boundaries" or >>>somesuch. > >{{ No response fm Jon. }} > > >>> >>>> identifying originators of SIP requests. It does so by defining a >>>> SIP header field for conveying a signature used for validating the >>>> identity, and for conveying a reference to the credentials of the >>>> signer. >>> ... >>> >>>> 1. Introduction >>>> >>>> This document provides enhancements t the existing mechanisms for >>>> authenticated identity management in the Session Initation >>>>Protocol >>>> (SIP, [RFC3261]). An identity, for the purposes of this documen, >>>>is >>>> defined as either a SIP URI, commonly a canonical address-of-record >>>> (AoR) employed to reach a user (such as >>>> 'sip:alice@atlanta.example.com'), or a telephone number, which can >>>>be >>>> represented as either a TEL URI [RFC3966] or as the user portion >>>>of a >>>> SIP URI. >>> >>>I suspect it does not 'enhance' existing mechanisms as much as add a >>>new >>> ne. If the claim is actual enhancement, then what mechanism is >>> enhaced and how does authenticating rigin constitute enhancement of >>> it? My point is that I believethe existing mechanisms will operate >>>the >>> same in the future as hey have been. This spec doesnt change them. >>> >>> Mve definitions toan explicit terminology section, rather than >>>putting >>> them into an Introduction. Also, does this document use the term >>> diffeetly than elsewhere than SIP??? Then why is 'for the purposes >>>of >>> his document' included? > > > At a high level, I > > don't object to the existence of a terminology section, but as, to my > knowledge, only three terms defined here - identity, auth service and > > verification service - I kind of think it's overkill.Also, all three > > of those terms in their current sense carry over from RFC4474, which > > made it to RFC without a terminology section. > >I don't understand the rationale behind citing a failed RFC as >precedent. In any event my point was simple: When there are terms of >art used in a document, they should be defined. A terminology section >is a common way of doing that, especially since the document already has >one. The benefits are to first to introduce the reader to the terms, >before they are needed, and second to make referencing back to the >definition easy. As for whether there ar only 3 terms in the document >that need to be explicitly defined,I didn't do an audit, but I believe >the actual number is significantly higher. > > >>> >>>> [RFC3261] spcifies several places within a SIP request where users >>>> can express an identity for hemselves, most prominently the user- >>>> populated From header field. However, the recipient of a SIP >>>>request >>>> has no way to verify that the From header field has been populated >>>> appropriately, in the absence of some sort of cryptographic >>>> autentication mechanism. This leaves SIP vulnerable to a category >>>> of abuses, including impersonation attacks that enable robocalling >>>> and related problems as described in [RFC7340]. Ideally, a >>>> cryptographic approach to identity can provide a much stronger and >>>> lessspoofable assurance of identity thn the Caller ID services >>>>that >>>> the telephone network provdes today. >>>> >>>> [RFC3261] encourages user agents (UAs) to implement a number of >>>> potential authentication mechanisms, including Digest >>>>authentication, >>>> Transport Layer Security (TLS), and S/MIME (implementations may >>>> support other security schemes as well). Howeve, few SIP user >>>> agents today support the end-user certificates ecessary to >>>> authenticate themseves (via S/MIME, for example) and for its part >>>> Digst authentication is limited by the fac that the originator >>>>and >>>> destination must share a prearranged secret. Practically speaking, >>>> originating user agents need to be able to securely communicate >>>>their >>>> users' identity to destinations with which they have no previous >>>> association. >>>> >>>> As n initial attempt to address this gap, [RFC4474] specified a >>>> mean of signing portions of SIP requests in order to provide an >>>> identty assurance. However, RFC 4474 was in several ways >>>>misaligned >>>> with deployment realities (see >>>>I-D.rosenberg-sip-rfc4474-concerns]). >>>> Most significantly, RFC 4474 id notdeal well with telephone >>>>numbers >>>> as identifiers, despite thei enduring use in SIP deployments. RFC >>>> 4474 also provided a signature over material that intermediaries in >>>> existing deployments commonly altered. This specification >>>>therefore >>>> >>>> >>>> >>>> Peterson, et al. Epires January 8, 2017 [Page >>>>3] >>>> >>>> >>>> Internet-Draft SIP Identity July >>>>2016 >>>> >>>>>>>> revises RFC 4474 in light of recent reconsideration of the prob= lem >>>> space to align with the threat model in [RFC7375], and aligns the >>>> signature format with PASSporT [I-D.ietf-tir-passport]. >>> >>> This kind of review of history is best relegated to a minor location in >>> the document. If the current spec is successful, history like this >>>will >>> be distracting, 10 years from now.... > > > [I]t belongs where it does becuse this is an > > update to a prior RFC, and the relationship to that RFC should be > > described up front. It also contains some important info about the > > objectives of the revised mechanism, including reducing signature > > breakage. > >A specification is not an historical narrative. It's job is to specify. > >To the extent hat historical narrative is necessary -- which it is not, >in this cae, given the lack of any installed base that cares about the >history - that should go into a separate section that can be ignored by >developrs. When historical narrative does have relevance, it needs to >be qute brief; when it isn't, the text is a distraction. > > >>>> 2. Terminlogy >>>> >>>> In this document, the key words "MUST", "MUST NOT", "REQUIRED", >>>> "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "REOMMENDED", "NOT >>>> RECOMMENDED", "MAY", and "OPTIONAL" are to be nterpreted as >>>> described in RFC 2119 [RFC2119] and RFC 6919 [RFC6919]. >>>> >>>> 3. Background >>> >>> This ection includes far more than background. It also provides a >>> summary descripton of the mechanism being defined here. I suggest >>> having this section only give background on sp and the problem, with a >>> separate section for the designsummary. r else call this >>> Introduction, but really it would be better to split hem > > > While I > > don't think this could realistically give rise to any confusion that > > would impact implementers, or improve the readability of the spec, it > > isn't a change I'd rule out. I don't se any great urgency to do it, > > either. > >Yeah. Clearer organization, designed to faciliate initial reading and >later consultation, probably isn't all that helpful. > > >>>> Per [RFC7340], problems such as robocalling, voicemail hacking, and >>>> swatting are enabled by an attacker's ability to impersonate >>>>omeone >>>> else. The secure operation of most SIP applications and services >>>> depends on authorizing the source of communications as it is >>>> represented in a SIP request. Such authorization policies can be >>>> automated or be a part of human operation of SIP devices. An >>>>example >>>> of the former would be a voicemail service that compares the >>>>identiy >>>> of the caller to a whitelist before determining whether it should >>>> allow the caller access to recorded messages. An example of the >>>> latter would be an Internet telephone application that displays the >>>> calling party number (and/or Caller-ID) of a caler, which a human >>>> may review to make a policy decision before answering a call. In >>>> both of these cases, attackers might attempt o circumvent these >>>> authorization policies through impersonation. Since the primary >>>> identifier of the sender of a SIP request, the From header field, >>>>can >>>> be populated arbitrarily by the controller of a user agent, >>>> impersonation is very simple today in many environments. The >>> >>> add: Hence the foundation to accurate authorization is valid >>> authentication. > >{{ No response from Jon. }} > > >>>> mechanism described in this document proides a strong identity >>>> system for detecting attempted impersonation in SIP requests. >>> >>> "provides a strong identity system for detecting" could mean >>> many things, whereas the goal her is quite specific. >>> >>> So replace it with: >>> >>> ...enables an authentication capability for protecting >>>against... > >{{ No response from Jon. }} > > > >>> >>>> This identity architecture for SIP depends on a logical >>>> "authentication service" which validates outgoing requests. An >>> >>> It likely will validate them in multiple places, including icoming >>> requests. > > > As described in his > > specification, an uthentication will not do that. > >On reflection, the more interesting issue is reference to an >'architecture' which is not defined (or depicted) in the document... >Worse, from various postings over thelast few weeks, it's clear that >different people have a different sense of what the purported >architecture is. > > >>>> authentication service may be implemented either as part of a user >>>> agent or as a proxy server; typically, it is a component of a>>>>ne= twork >>>> intermediary like a proxy to which originating user agents send >>>> unsigned requests. Once the sender of the message has been >>> authenticated, the authentication service then computes and adds >>> >>> sender? Does that mean the caller? the caller's ua? the caller's >>> opertor? the term is ambiguous. > >{{ No response from Jon. }} > > >>> >>>> cryptographic information (including a digitl signature over some >>>> components of messages) to requests to communicate to other SIP >>>> entities that the sending user has been authenticated and its claim >>> >>> worth breaking this sentence into two, for better clarity. > >{{ No response from Jon. }} > > >>>> of a particular identity has beenauthorized. A "veriication >>>> service" on the receiving end then validates this signaure and >>>> enables policy decisions to emade based on the results ofthe >>>> verification. >>>> >>>> >>>> >>>> >>>> Peterson, e al. Expires January 8, 2017 [Page >>>>4] >>>> >>>> >>>> Internet-Draft SIP Identity July>>>= >2016 >>>> >>>> >>>> Identities are issued to users by authorities. When a nw user >>>> becomes associated with example.com, the administrator of the SIP >>>> service for that domain can issue them an identity in hat >>>>namespace, >>>> such as alice@example.com. Alce may then send REGISTER requests >>>>to >>>> example.com that make her user agents eligible to receive requests >>>> for sip:alice@example.com. In some cases, Alice may be the owner >>>>of >>>> the domain herself, and may issue herself identities as she >>>>chooses. >>>> But ultimately, it s the controller of the SIP service at >>>> example.com that must be responsiblefor authorizing the use f >>>>names >>>> in the example.com domain. Therefore, for the purposes of baseline >>>> SIP, the credentials needed prove a user is athorized to use a >>>> particular From header field must ultimately derive from the domain >>>> owner: ether a user agent gives requests to the domain name ownr >>>>in >>>> order for them to e signed by the domain owner's credentials, or >>>>the >>>> user agent must possess credentials that prove in some fashion that >>>> the domain owner has given the user agent the rght to a name. >>>> >>>> The situation is however more complicated for telephoe numbrs, >>>> however. Authority over telephone numbers does ot correspond >>> >>> however...however > >{{ No response from Jon. }} > >>> >>>> directly to Internet domains. While a user could regiter at a SIP >>> domain with a username that corresponds to a telephone number, any >>>> connection between te administrator of that domin and the >>>> assignment of telephonenumbers isnot currently reflected on the >>>> nternet. Telephone numbers do not share the domai-scope property >>>> described above, as they are dialed without any dmain component. >>>> This document thus assumes the existence of a seprate means of >>>> establishing authority over telephone numbers, for cases where the >>>> telepone numberis the identity of the user. As with SIP URIs, >>>>the >>>> necessary credentials to prove authority for a name might reside >>> either in the endpoint or t some intermediary. >>> >>> Note that the preceding discussion makes no mentionof "SIP URI". If >>> one reads back and connects some dots, the reader might guess that the >>> alice@ discussion is for a SIP URI, but the text should make this >>>explicit. > > > But > > actualy the text says: > > > Identities are issued to users by authorities. When a new user > > becomes associated with example.com, the admnistrator of the SIP > > service for that domain can issue them an identity in that > > namespace, such as alice@example.com. Alice may then send REGISTER > > requests to example.com that make her user agents eligible to receive > > requests for sip:alice@example.com. > > > ... so it says sip:alice@, not merely alice@, and in fact a search > > will show that exact string "SIP URI" does appear in Section 3. > >The alice@ string was a shorthand. > >Actually Section 1. *This* is Section 3. > > >>> The following paragraph really is the design summary for the >>>specification: >>> >>>> This doument specifies a means of sharing a cryptographic >>>>assurance >>>> of end-user SIP identityin an interdomain or intradomain context. >>> >>> I suspect the above sentnce is seriously redundant. If it isn't, it >>> needs to be quite a bit soner, since it is fundamental. Certainly it >>> is not 'background'. > > > The review here does not like the > > presentation of this material in a section called "Background." It is > > hard to see how much sooner in the specification statements canbe > > made than here. > >A statement of the purpose of a document sould come sooner than Section >3. > > >>>> It relies on the authenticaton service constructing tokens based >>>>on >>>> the PASSporT [I-D.ietf-stir-passport] format, a JSON [RFC7159] >>>>object >>>> comprising values copied from certain header field values in the >>>>SIP >>>> request. The authentication service then computes a signature over= >>>> those JSON object in a manner following PASSporT. That signature >>>>is >>> >>> "those JSON object" ? >>> >>> Also, where is the object? How is it creaed? How is it conveyed? > > > This is > > a section on background, it is does not detail the protocol's > > operations. This review is very critical of forward references and > > yet equally critical of any section that lacks them. Information has > > to becommunicated in some order. Giving a big picture up front > > without suc details is helpful. > >Alas, talking about Passport and JSON is not 'background'. "Background" >normally means setting the stage about problems, needs, and maybe prior >work. Yet this references ext is about the *technical substance of >this document*. Tat's 'fore'ground. > > >>> Also 'The authentication service' might referto the signing side or t >>> the verifying side. How is the reader to know for certain? A diagram >>> of the overall service and its components could be quite helpful. > > > No, the "authentication service" as > > described here behaves differently, and doesnot appear on the > > verifying side. A diagram isn't out of the question, but the > > difficulty is that the authentication service is a logical role that > > might be played by elements in different components of a callflow, > > so it would always be just an example instantiation rather than a > > comlete picture. > >The term is used as if it is a term of art. But no definition is given >here or later and, as you note, it has no precise meaning. It could be >this o that, here or there. > > >>>> then placed in a SIP Identity heade. In order to assist in the >>> >>> header /field/? > > > This is the first of many places where the > > review mentions this. There's another in 5. ("header? or header > >field?"), some in 5.2 ("headers? header fields?" and a few hints of> "h= eader [field"), at the beginning of Section 8 ("header *field*") > > nd so on. Tobe clear, the review is absolutely correct that there > > is a distinction between a header, a header field, and a header field > > value, and that the text in rfc4474bis handles that distinction > > pretty loosely. It is full of constructions like the following (taken > > from 5.1): > > > An authentication service MUST add a Date header field to SIP > > requess that do not have one. The authentiction service MUST > > ensure that any preexisting Dte header in the request is accurate. > > > In one case there, it uses the full construction "Date header field", > > and then in literally the next sentence, it casually uses "Date > > header" instead. From a quick glance at the usage of "header" vs. > > "header field value" in rfc4474bis, it ooks like "header" appears > > around 240 times, and "header field" only a fw more than 70. Surely > > most of those usages of "header" should actually be "header field", > > as in the quote from 5.1 above. Probably many more should be "header > > field value" (which appears only a dozen times). However... SIP has > > never been real good about this. Oh, I remember during RFC3261 how > > diligent we were in trying to keep thse straight. But if you look at > > subsequent header specifications for SIP, lik say Replaces (RFC3891) > > or History-Info (RFC4244), we never really locked this down. The > > numbers of "header" vs. "header field" vs. "header field value" for > > the original RFC4474 are pretty similar to what we see in rfc4474bis. >> I think the reason why we continue to use it pretty casually is, > > well, because as that quote above from 5.1 illustrate, there isn't > > any damaging ambiguity about this. The second sentence reallyis > > talking about the "header field value", as it is not the "header > > field" that is "accurate" or not. I suspect the reason why we SIP > > folks have been lax about this is because the construction "Date > > header" in sentences like the above is not actually unclear in any > > meaningful way, it is perfectly obvious what it means. All that said, > > it isn't a huge amount of work to be precise about this - if anyone > > would like to make the case that there's actually a practical problem > > here rather than a merely pedantic exercise involved. The casual use > > of "header" certainly hasn't prevented the publication of many > > previous SIP header specification RFCs. > >I'm not sure wat the point of a lengthy history about other >inconsistent uses of the terms is, unless thy are supposed to somehow >make inconsistent use acceptable here. They don't. > >Really, I wa making only the simplest of points: These terms have >definition and this document is a specification. It should define (or >cite definitions of terms ofart and it should use them carefully and >correctly. > > >>>> validation of the Identity header, this specification also >>>>describes >>>> some metadata fields associated with the header that can be used by >>>> the recipient of a request to recover the credentials of the >>>>signer. >>>> Note that the scpe of this document is limited to providing this >>>> identity assurane for SIP requests; solving this problem for SIP >>>> responses is outside the scope of this work (see [RFC4916]). >>>>Future >>>> work might specify ways that a SIP implementation could gateway>>>>= PASSporT objects to other protocols. >>> >>> And it might not. To the extet that you have to say something about >>> work that might or might not be done, just cite the topic and that it >>> isn't covered hre. Such as: > >> > >> Gatewaying Passport objects to other services is outside the > >> scope of this specification. > >> > I think it is pretty > > clear from a casual glance at the RFC series that tatements about > > directions for future work are common in RFCs, and that there is no > > bar against them. > >Some RFCs are written well; some are not. This appears to take the view >that the very large body of problmatic RFC content serves as precedent >to allow the continued writing of bad RFCs. > >Forgive me for taking the view that the goal should be writingRFCs well >nd noting that RFCs that are clear about the boundaries of the spec -- >including explicitly noting items tha are outside of scope -- tend to >be the better sort of writing, as do RFCs that refrain from predicting >the future, especially since they are almost always wrong. > > >>> (Odd thought: Given that JSON isn't native to SIP and that there must >>> be some translation/encoding of the json object to work with SIP, that >>> effectively means that this /is/ a gatewaying application of the >>>object...) > >> As far as odd thoughts go, that's not far from >> how we see it. We imagine there will be hopefully seamless gatewaying >> to a lot of non-SIP applications. Cullen's draft about WebRTC >> gatewaying is a good place to look at what some of the practical >> challenges are to getting this to work. > >Hence my point that JSON/JWT aren't native to this work. While I'm a >fan of a core, canonical representation when there is a gatewaying >model, the nature of gatewaying that is interesting is semantic mapping >and the fact of the matter is that anything oher than trivial >encoding-translation gatewaying loses information... Always. > >(My graduate work was on email gatewaying, which was popular and >necessary back then, so this technical aspects of gatewaying, as a >special type of processing, is particularly significant topic to me.) > >(BTW, all I found was draft-ietf-rtcweb-gateways-02, which isn't by=20 >Cullen.) > > >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page= =20 >>>>5] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> This specification allows either a user agent or a proxy server to >>>> provide the authentication service function and/or the verification >>>> service function. To maximize end-to-end security, it is obviously >>>> preferable for end-users to acquire their own credentials; if they >>> >>> "To maximize end-to-end security, it is obviously preferable for >>> end-users to acquire their own credentials;? >>> >>> I'm not exactly sure what this means or is supposed to mean, but I >>> suspect it's incorrect. > > > Well, what it means is > > explained if you don't take this phrase in isolation and pretend like > > it is something with no context. The prior sentence begins by stating > > that the authentication service function can exist at either a user > > agent or a proxy server. One of those is an endpoint and one is an > > intermediary. For something to be "end-to-end", it will extend from > > endpoint to endpoint. As the authentication service does signing, it > > requires credentials to perform the signature. In order for an end > > user's endpoint to act as an authentication service, the end user > > thus needs to be able to acquire credentials. The rest of this > > paragraph is about why that isn't so easy. I don't think this is > > either incorrect or particularly hard to follow from the text that is > > already there. > >That's the problem with having text that makes a very broad assertions=20 >without explaining them. There is a rather substantial body of=20 >experience that says that individual end-users tend to be really awful=20 >at doing all the stuff that serves as the basis for the simplistic=20 >assertion here. > >If the draft had said something more like "To maximize end-to-end=20 >security, it is obviously preferable for end-systems to acquire their=20 >own credentials", the problematic human factor would be removed and the=20 >valid technical point would remain. > > >>> >>>> do, their user agents can act as authentication services. However, >>>> for some deployments, end-user credentials may be neither practical >>>> nor affordable, given the potentially large number of SIP user=20 >>>>agents >>>> (phones, PCs, laptops, PDAs, gaming devices) that may be employed=20 >>>>by >>>> a single user. In such environments, synchronizing keying material >>>> across multiple devices may be prohibitively complex and require >>>> quite a good deal of additional endpoint behavior. Managing=20 >>>>several >>>> credentials for the various devices could also be burdensome. In >>>> these cases, implementation the authentication service at an >>>> intermediary may be more practical. This trade-off needs to be >>>> understood by implementers of this specification. >>>> >>>> 4. Overview of Operations >>>> >>>> This section provides an informative (non-normative) high-level >>>> overview of the mechanisms described in this document. >>> >>> described -> specified (or defined) >>> >>> But note that we've already been given a high-level overview... >>> >>> On reflection, this section isn't an 'overview'. It's an example >>> scenario. The essential difference is that this makes specific=20 >>>choices, >>> such as use of a proxy, which might not apply in some valid scenarios. >>> As some integrative pedagogy, that's fine. So I suggest re=3Dlabeling= =20 >>>the >>> section rather than changing it's substance. > > > The > > "overview of operation" here follows the section of the same name, > > which also happens to be section 4, in RFC3261. Okay, the name of the > > section there is singular and not plural - but it is also basically a > > concrete example. > > > * That much said, I'd be willing to change the "Background" section > > to "Overview" and move the "Overview of Operations" section into an > > "example" subsection of "Overview", if that helps. Again, I don't > > think it'll help much, if at all, but it's easy to do. > > > >>>> Imagine a case where Alice, who has the home proxy of example.com=20 >>>>and >>>> the address-of-record sip:alice@example.com, wants to communicate >>>> with Bob at sip:bob@example.org. They have no prior relationship, >>>> and Bob implements best practices to prevent impersonation attacks. >>>> >>>> Alice generates an INVITE and places her identity, in this case her >>>> address-of-record, in the From header field of the request. She=20 >>>>then >>>> sends an INVITE over TLS to an authentication service proxy for the >>>> example.com domain. >>> >>> How is reference to TLS meaningful here? > > > The use of TLS to > > protect the first hop from the user agent to an intermediary-based > > authentication service has security properties that are discussed > > later in the document, in particular in Section 12.4. But for the > > purposes of this overview here, it is merely exemplary. > >I think that the problem is with the entire approach to the section. The=20 >title of the section does not match the content. The content is merely=20 >a specific example. Examples preclude alternatives. In this case it=20 >appears that the example also extends beyond the scope of the=20 >specification itself. So, for example, TLS comes in as a tidbit of=20 >detail, about a system component that is not covered in detail by the=20 >specification. > >Reference to TLS is appropriate for an overall system description that=20 >covers all of the pieces at all of the layers. Within a specification=20 >about a SIP Invitation Signing and Verifying protocol, it is a layer=20 >violation. > > >>>> >>>> The proxy authenticates Alice (possibly by sending a Digest >>>> authentication challenge), and validates that she is authorized to >>> >>> Again, how is discussion of the internal, non-STIR aspects of SIP >>> operationally relevant here? > >{{ No response from Jon. }} > > >>> >>>> assert the identity that she populated in the From header field. >>>> This value could be Alice's AoR, but in other cases it could be=20 >>>>some >>>> different value that the authentication service has authority over, >>> >>> That bit of vagueness isn't helpful, given the motivation for doing=20 >>>this >>> work. It reduces to: something will get authenticated, but we won't >>> say what and we won't say where to find out. > >{{ No response from Jon. }} > > >>> >>>> such as a telephone number. The proxy authentication service then >>>> constructs a PASSporT object which contains a JSON representations= =20 >>>>of >>>> headers and claims which mirror certain parts of the SIP request, >>>> including the identity in the From header field. As a part of >>>> generating the PASSporT object, the authentication service signs a >>>> hash of those headers and claims with the appropriate credential=20 >>>>for >>>> the identity (in this case, the certificate for example.com, which >>>> covers the identity sip:alice@example.com), and the signature is >>>> inserted by the proxy server into the Identity header field value=20 >>>>of >>>> the request. Optionally, the JSON headers and claims themselves=20 >>>>may >>>> also be included in the object, encoded in the "canon" parameter of >>>> the Identity header. >>> >>> why? when? >>> >>> Tossing in vague references about optional behavior that is neither >>> motivated nor explained usually proves more of a distraction than a >>> help, when writing an 'overview' or an example. > > > Well, I disagree. Having a non-normative overview of > > how the mechanism works is valuable precisely because it is not > > muddled by the motivation or the specification. > >Perhaps the import of 'vague' and 'neither motivated nor explained'=20 >wasn't clear. > >I'll try harder: Text that is meant to explain things should explain=20 >things. Telling people about an action that is not explained introduces=20 >the alternative but gives the reader no understanding about it. It does=20 >not even tell them what the *range* of equivalent alternatives is. > >What's missing is a separate description of this service, independent of=20 >the specifications for its technical details. Hence the text here is=20 >conflating document goals and it's not being clear about that. > > >>>> Peterson, et al. Expires January 8, 2017 [Page= =20 >>>>6] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> The proxy, as the holder of the private key for the example.com >>>> domain, is asserting that the originator of this request has been >>>> authenticated and that she is authorized to claim the identity that >>>> appears in the From header field. The proxy inserts an "info" >>>> parameter into the Identity header that tells Bob how to acquire >>>> keying material necessary to validate its credentials (a public=20 >>>>key), >>>> in case he doesn't already have it. >>> >>> A scheme that has an untrusted object carrying information about where >>> to find trust information for the object sounds like a serious security >>> hole. Why should the pointer be trusted? > > > This is a comment the reviewer has raised > > before, will raise again below in the comments on 6.2. The short > > answer is that there is no security hole, but a long response will > > wait for 6.2 (if we can use a forward reference here). This is just a > > section saying how the mechanism operates, not why the mechanism > > operates the way it does. > > >>> >>>> When Bob's domain receives the request, it verifies the signature >>>> provided in the Identity header, and thus can validate that the >>>> authority over the identity in the From header field authenticated >>>> the user, and permitted the user to assert that From header field >>>> value. This same validation operation may be performed by Bob's=20 >>>>user >>>> agent server (UAS). As the request has been validated, it is >>>> rendered to Bob. If the validation was unsuccessful, some other >>>> treatment would be applied by the receiving domain. >>> >>> Huge operational transition question: How is the absence of the >>> signature treated? Today, there are no signatures. Tomorrow there >>> might be some, both it won't be true that */all/ incoming requests are >>> signed. So how is the receiver supposed to handle the absence of a >>> signature? > > > The actual policies that SIP entities apply to requests > > in the presence or absence of the Identity header are outside the > > scope of this specification, as is clearly stated at the end of 5.2. > > The short answer is that this is an over-the-wire protocol spec, and > > that as such, it is already complex enough without dipping into those > > matters. But again, Section 4 probably wouldn't be the right place to > > explore that question anyway. > >That response suggests a serious lack of attention to well-established=20 >operational issues for this topic: The handling of a missing signature=20 >and the handling of a broken signature are an essential part of a=20 >signature service, especially when the service is being added to an=20 >already-running service. > >The realities of call request transit are going to have serious=20 >complexities for a long time, possibly forever. Transit complexities=20 >are essentially certain to sometimes break otherwise-legitimate=20 >signatures. > >Their semantics for handling need to be standardized, lest the=20 >inevitable variations of 'local policy' undermine the the efficacy of=20 >the overall service. > > >>> Related question: Is everyone certain that transit of the request will >>> /never/ break the signature? What is the basis for that assessment?=20 >>>And >>> if a signature /can/ break, then the interpretation of an invalid >>> signature could mean either spoofing or operational error. > > > We are > > certain that, with some exceptions detailed in the document, we want > > to treat the breaking of the signature in transit as a security > > violation, regardless of why it happens. > >*That's a mistake. If the infrastructure will sometimes break the=20 >signature, then penalizing the signer for actions not under their=20 >control will be problematic. That's why DKIM explicitly mandates=20 >treating a broken signature exactly the same an absent signature.* > > > > Circumstances in which the > > signature might be broken are discussed throughout the specification. > >Scattering this essential topic all over a document does not facilitate=20 >getting careful, focused consideration of it. Yet it is a discrete=20 >topic, entirely amenable to that focused attention. > > > > In fact, the mention of this in the last paragraph of Section 1 is > > one of the reasons why that text needs to stay in the specification. > > This entire effort, as the STIR problem statement (RFC7340) says, was > > largely motivated by trying to minimize signature breakage. It is > > nice that the overview of operations at least inspires these > > questions, which are the right sorts of questions to be asking about > > a mechanism like this. Suffice it to say that we've thought about the > > past three questions a lot over the years - these aren't exactly new > > issues being raised. > >No they aren't. DKIM wrestled with them extensively roughly 10 years=20 >ago. To the extent that STIR came up with different answers, it is not=20 >possible to see that it did or why, but it should be. > > >>>> 5. Signature Generation and Validation >>>> >>>> 5.1. Authentication Service Behavior >>>> >>>> This document specifies a role for SIP entities called an >>> >>> delete first sentence. it adds no useful information. > > > A similar comment is made about the > > first sentence in 5.2. I do not believe it is a problem for sections > > of a specification to begin with an introductory sentence that queues > > up the topic about to be discussed. I comment more about this as a > > document organization matter, as that is how it is raised in 5.2 - as > > a question of redundancy. > >A continuing issue that I found significant enough to count as=20 >problematic is extreme redundancy and verbosity throughout the document. > >Overall, the document seems to have been written with the view that more=20 >words are always better, rather than that the right *balance* of words=20 >is best and that excessive text serves more as a distraction than as=20 >clarification. That's why I gave in to using the unpleasant word=20 >'bloated' when commenting on the set of documents. > >The fact that IETF documents are free to include background and=20 >explanations is one of the things that make them so much better than the=20 >stilted over-structured documents done is some other SDOs, but this does=20 >not mean that constantly tossing in extended text is helpful. > > >>>> authentication service. The authentication service role can be >>>> instantiated, for example, by an intermediary such as a proxy=20 >>>>server >>> >>> Constant references to implementation (and 'instantiation') >>> possibilities distracts from the required task of defining the >>> architecture and functions of the service. > > > The idea that there are > > abstract "roles" which are instantiated by entities in a SIP > > architecture for the purposes of even a single transaction is a core > > SIP concept (see the UAC or UAS roles, or RFC3261 10.1 on the > > abstract "location service"), and is foundational to how the > > mechanism in this document is to be understood. This specification is > > only defining an "architecture" in so far as it defines the > > authentication and verification service roles. > >This appears to be a very basic disagreement about a very basic issue! > >*In point of fact, these specifications are attempting to define an=20 >authentication service overlay for SIP. That is, STIR is an additional=20 >layer of architecture ABOVE SIP. * > >An example of a comparable overlay is shown in Figure 1: > > DKIM Service Overview > https://tools.ietf.org/html/rfc5585 > >DKIM is on top of RFC 5322, not part of it, just as STIR is on top of=20 >SIP and is not part of it. > >This really is quite an important architectural point, IMO. > > >>>> or by a user agent. Any entity that instantiates the=20 >>>>authentication >>>> service role MUST possess the private key of one or more=20 >>>>credentials >>> >>> "private key of one or more credentials" - not sure what this=20 >>>means? > >> >>> One key can have more than one credential? On the signing side, I'd >>> expect the process to start by choosing a credential and then using its >>> associated key. > > > No, an authentication service may have multiple credentials > > associated with different names, where each credential has an > > associated public and private key. Review proposes the wording "The > > authentication service possesses the private..." but this is > > rejected, because that loses the sense that there may be multiple > > private keys due to having authority over multiple names. > >I'm not sure what "there may be multiple private keys due to having=20 >authority over multiple names" means exactly, but it probably doesn't=20 >matter for the immediate issue. > >A STIR-signed request comes in. The host doing the evaluation needs to=20 >find the key. They need a simple, efficient, reliable and secure means=20 >of locating that key. They are not going to search among multiple=20 >credentials, so in this context, it doesn't matter that there might be=20 >multiple. At the time of the lookup, they need to get to the one,=20 >correct credential needed at that time. > >Mostly, this discussion of credentials and keys is vague and confusing,=20 >but it needs to be extremely clear. > > >>> Simpler wording: The authentication service possesses the private... >>> >>> >>>> that can be used to sign for a domain or a telephone number (see >>> >>> can be used to sign the From identity. > > > The scope of the credential is over the domain or > > telephone number, and the credential could be used outside the SIP > > context - there's no sense in which the credential is specific to the > > identity appearing in a From header field. The value of this proposed > > edit is thus very dubious. > >First, text that has to constantly cite an 'or' condition, as above, is=20 >text that has not properly factored issues and references. As an=20 >example, the phone-number/domain-name distinction should be dealt with=20 >in some isolated sections and there should be a common name for the=20 >obtained value in the rest of the document. I keep using 'caller-id'=20 >because various folk thought it a workable choice, but I don't care what=20 >specific term is used. > >A common way to do this kind of abstracting of a set of technical=20 >choices is to define some ABNF that lists the alternatives and use the=20 >rulename for that ABNF in the rest of the document. In other cases what=20 >suffices is prose that defines a term, where the definition is the set=20 >of alternatives. > >The change in wording I was suggesting was trying to get to a single=20 >common term. I'm also fine if 'From' value is not the correct answer.=20 >But the document is constantly going back to underlying alternatives=20 >throughout rather than building things up into integrative constructs=20 >and labels for them. > >As for the explanation about credentials, I did not see anything in any=20 >of the three documents that specified/explained any of this well enough=20 >to provide or anticipate the above response. > > >>>> Section 6.1). Intermediaries that instantiate this role MUST be >>> >>> forward reference. better to put that material before this. > > > The review here refers to whether the header syntax (Section 8) > > should go before authentication service behavior (Section 5.1). There > > is no free lunch here; neither belongs before the other, one will > > have to refer to the other. We can't do everything at one time. > > Complaints like this are easy to lodge, but that doesn't make them > > persuasive. > >As I tried to explain: > >*The current approach places an extra burden on the reader. They are=20 >constantly presented with important terms and details that they do not=20 >yet understand. This forces them to interrupt their current reading,=20 >mark their place, and go search for the underlying detail, if they want=20 >to understand the current text. In contrast, a bottom-up model for such=20 >presentation of information ensures that the user can read in a smooth=20 >sequence, without the interruption.* > >The issue is not about the need for references, but about the reading=20 >process. > > >>> >>>> capable of authenticating one or more SIP users who can register=20 >>>>for >>> >>> one or more SIP users -> users >>> >>> the word identity hasn't bee used in this paragraph, before this, so=20 >>>the >>> referent is unclear. > > > Identity is a > > fundamental concept in this document, there is no need to refresh it > > here. > >Apparently the word 'referent' was not clear. Sorry. I meant that for=20 >the next use of identity (just below,) the 'that' isn't a clear=20 >reference to me. I was commenting on ambiguous writing, not the meaning=20 >of the term identity. > > >>> Also, this requirement for authentication appears to be redundant with >>> the later specification for authentication in Step 2. > > > This text in the introductory paragraph states, as a prerequiste for > > operations, "Intermediaries that instantiate this role MUST be > > capable of authenticating one or more SIP users who can register for > > that identity." The text in step 2 states that during operations, > > "The authentication service MUST then determine whether or not the > > sender of the request is authorized to claim the identity given in > > the identity field." The distinction here is between stating a > > prerequiste for any activity and then mandating performing the > > activity as a component of normative messaging processing. It is not > > redundant. > > >>> >>>> that identity. Commonly, this role will be instantiated by a proxy >>>> server, since these entities are more likely to have a static >>>> hostname, hold corresponding credentials, and have access to SIP >>>> registrar capabilities that allow them to authenticate users. It=20 >>>>is >>>> also possible that the authentication service role might be >>>> instantiated by an entity that acts as a redirect server, but that= =20 >>>>is >>>> left as a topic for future work. >>> >>> Not only is the above, last sentence about future work; it appears to=20 >>>be >>> entirely irrelevant to this specification. Remove it. > > > No, the purpose of statements like this in > > specifications is to say "hey, we thought of an idea that might be > > useful someday, and while we didn't want to spec it now, we did want > > to capture it and try to structure the mechanism in a way that > > wouldn't preclude it, in case somebody feels like fleshing this out > > sometime." The contention that statements like this are abnormal in > > IETF specifications would not withstand even casual scrutiny. > >Fantasy is fun. Discussing enhancements is fun. But it isn't=20 >specification. And, again, it is rarely correct, especially when the=20 >fantasy asserts a future statistic, like 'commonly'. > >(Again, the fact that some RFCs indulge in poor practices ought not to=20 >serve as justification for doing more of the same. Precedence is good=20 >for something that is useful, not for something that is problematic) > >So move it out of the specification, into a carefully marked section or=20 >document that makes clear it is romping through fields of possibility=20 >that might or might not have anything to do with what actually will=20 >happen. Placed in the middle of technical specification, it serves as=20 >distraction for the developer. > > >>>> An authentication service adds the Identity header to SIP requests. >>> >>> Note that we've read this before. So I'm raising a redundancy flag. > > > I don't think there is any harm in > > beginning a paragraph that describes the steps taken to add an > > Identity header to a request with a topic sentence that states what > > an authentication service does at a high level. > >There is harm. It bloats the document. It bores the reader. It=20 >invites opportunities for making errors by virtue of creating text that=20 >might vary from its sibling (parent?) text, thereby creating conflicting=20 >content. > >It also makes revision more difficult, when every occurrence of=20 >something needs to be tracked down and modified. (By way of example, the=20 >reply to my review was done as a note entirely separated from my inline=20 >review, but included text at the beginning of each response that was=20 >intended to set context, usually by quoting my text and/or the draft's=20 >text. Periodically, those quotations had errors... > > >>>> The procedures below define the steps that must be taken when each= =20 >>>>an >>>> header is added. More than one may appear in a single request, and >>> >>> header -> header /field/ ? >>> >>> And, by the way, what header field is that? > >{{ No response from Jon. }} > > >>> The "the procedures" sentence adds nothing and is redundant with the >>> later "entities instantiating" sentence. >>> >>> In any event, don't make forward references like this. Put it after=20 >>>the >>> relevant details, so that there already is context and this just >>> enhances it. > > > This is just > > introductory material that sets the stage for the steps that will > > follow, there is no order problem here. > >(My review missed the typo: "when each an header") > > >>> From what I can tell, this entire paragraph should be moved toward >>> the end of this section. > >The 'recommendation for moving text was especially about the 'more than=20 >one' text. > > >>>> an authentication service may add an Identity header to a request >>>> that already contains one or more Identity headers. If the=20 >>>>Identity >>>> header added follows extended signing procedures beyond the=20 >>>>baseline >>>> given in Section 8, then it differentiates the header with a "ppt" >>>> parameter per the fourth step below. >>>> >>>> >>>> >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page= =20 >>>>7] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> Entities instantiating the authentication service role perform the >>>> following steps, in order, to generate an Identity header for a SIP >>>> request: >>> >>> The authentication service performs the following steps in >>> order, to... >>> >>> Procedural detail should be in a procedural form. Extended prose like >>> this isn't as easily grokked. That invites both writing and reading >>> errors to the algorithm. > > > We ended up with the original text > > because too many people were reading "the authentication service" to > > mean "a proxy server or other intermediary", and by using the longer > > construction, we are reminding readers that the authentication > > service role may be instantiated by various entities in the > > architecture. I don't believe this construction as given here is too > > difficult to "grok"; it is not repeated in the steps below, and is > > only here to emphasize the flexibility of the role. > >Your explanation suggests deeper problems with reader comprehension. > >In any event: > >*The immediate problem is that the steps are part of the architecture,=20 >independent of implementation details. So by saying 'entities=20 >instantiating' the document is stepping into sounding like it is talking=20 >about implementation. > >There is a general challenge in the IETF, and elsewhere, in creating and=20 >maintaining clarity about networking architectures -- which are=20 >abstractions -- as distinct from the many ways they can be implemented.=20 >IETF specifications should encourage clarity, not add to the confusion.* > > >>> >>>> Step 1: >>> >>> >>> Step 1: Authoritative for Identity >>> >>> >>>> First, the authentication service must determine whether it is >>>> authoritative for the identity of the sender of the request. In >>>> ordinary operations, the authentication service decides this by >>>> inspecting the URI value from the addr-spec component of From=20 >>>>header >>>> field; this URI will be referred to here as the 'identity field'. = =20 >>>>If >>>> the identity field contains a SIP or SIP Secure (SIPS) URI, and the >>>> user portion is not a telephone number, the authentication service >>> >>> how is its not being a telephone number determined deterministically=20 >>>and >>> correctly? > > > By following the procedures in > > Section 7. > >That's nice. A shame the citation isn't in the step, so the reader will=20 >have some clue. *Also, Section 7 does not define clear, complete and=20 >deterministic (interoperable) procedures.* > >Given the complexities of figuring out what identifier is to be=20 >validated, this step should be in two parts. > >The first is to get the identifier. The above text seems to indicate the=20 >identifier always comes from the From: header field, but I believe that=20 >is not correct, given comments elsewhere in the document and in this=20 >review exchange. > >The second is to assess 'authority' over it -- although I suspect that=20 >question is the wrong one, where the right one is *authorization* to=20 >validate the use of the identifier. And that's a significant difference. > > >>>> MUST extract the hostname portion of the identity field and compare >>>> it to the domain(s) for which it is responsible (following the >>>> procedures in RFC 3261 [RFC3261], Section 16.4). If the identity >>>> field uses the TEL URI scheme [RFC3966], or the identity field is a >>>> SIP or SIPS URI with a telephone number in the user portion, the >>>> authentication service determines whether or not it is responsible >>>> for this telephone number; see Section 7.1 for more information. =20 >>>>An >>> >>> This canonicalization text seems entirely out of place, in the middle=20 >>>of >>> specification about authority. > > > It is not out of place in > > the process that authentication services must complete, it is given > > at exactly the point where it needs to happen. Before you can > > ascertain whether or not you are authoritative for an identity, you > > need to have the identity in a canonical form. > >Canonicalization is a relatively complex issue for this activity.=20 >(Among its complexities are the tradeoffs among loss of information,=20 >ease of use, and robustness against transit behaviors.) > >One can, of course, specify a series of steps that fully expand all the=20 >details inline. That's like programming without subroutines. However=20 >humans comprehend sequences better when they are presented with more=20 >coherence and brevity, versus presentation of all the fine-grained=20 >details in an extended sequence. That is, when the steps can be seen=20 >easily. One of the many downsides of expanding everything inline is=20 >that the reader is likely to lose their sense of the overall sequence. > >Move canonicalization to its own subsection and then just cite it here. > > >>>> authentication service proceeding with a signature over a telephone >>>> number MUST then follow the canonicalization procedures described=20 >>>>in >>>> Section 7.2. If the authentication service is not authoritative=20 >>>>for >>>> the identity in question, it SHOULD process and forward the request >>>> normally unless the local policy is to block such requests. The >>>> authentication service MUST NOT add an Identity header if the >>>> authentication service does not have the authority to make the=20 >>>>claim >>>> it asserts. >>>> >>>> Step 2: >>> >>> Step 2: Authorization >>> >>>> >>>> The authentication service MUST then determine whether or not the >>> >>> [or not] remove > > > A similar comment also appears in Section 7. > > I'd rather keep the "or not" with the "whether." Consulting the > > relevant entry on "whether" vs. "whether or not" in an English usage > > dictionary (Merriam Webster) it notes that "the use of 'or not' is > > more than 300 years old and is common among educated English speakers > > and writers. It is, in short, perfectly good, idiomatic English." > > More to the point, I am really unsure what the value would be in > > tagging stylistic decisions like this that can easily go either way > > in a review of a technical specification - other than in so far as it > > makes the review just a little longer and gives the person answering > > it just a little more work to do. That goes double for flagging this > > as an "issue" twice. > >This is, of course, purely a stylistic point: But again, the issue is=20 >not whether something is legal or has precedent, but whether it is=20 >constructive to the document's purpose. > >In this case the question is whether the 'or not' adds information. In=20 >some usages it does. This is not one of those. (cf, bloat. I realize=20 >you have already seen a number of such comments from me, but I figure it=20 >can't do any harm to keep repeating it...) > > >>> >>>> sender of the request is authorized to claim the identity given in >>> >>> sender: calling user?, calling ua?, originating operator? >>> intermediary? Although the word is used frequently in the SIP spec, it >>> is not defined. > > > Well, if it's flagged here, why not flag it back > >That's an interesting model you seem to be asserting: A problem isn't a=20 >problem unless it is properly cited at its first occurrence or at all=20 >its occurrence or...? Really, Jon? > >This is where I noted it or where I finally decided it was worth=20 >commenting on, or... So please explain: What is the intended benefit=20 >of criticizing which occurrence got the comment? > > > > in section 3, for the sentence, "Since the primary identifier of the > > sender of a SIP request, the From header field, can be populated > > arbitrarily by the controller of a user agent, impersonation is very > > simple today in many environments." The sender of a SIP request is > > the entity that instantiates (learn to love it) the user agent client > > role in a SIP transaction. Practically speaking, that could be an > > intermediary in some cases, but it is most commonly an endpoint under > > the control of a calling user. Anyway, I don't think there's any > > ambiguity about what "sender" means here, especially given the > > earlier usage in Section 3. It is as you note pretty common in SIP > > specs. > >There is a basic lack of semantic clarity with the word 'sender' in any=20 >store-and-forward networking environment. Everyone is a sender, except=20 >maybe the last guy in the sequence. As a consequence, the word 'sender'=20 >needs to be used only in very precise ways, such as calling a client a=20 >sender (unless it's a receiver...). > >In this case, the specific referent for the term was unclear to me. That=20 >raises the odds it will be unclear for some other readers. If you don't=20 >care about clarity for a broad base of readers, then sure, ignore my=20 >concern. > > >>> >>>> the identity field. In order to do so, the authentication service >>>> MUST authenticate the sender of the message. Some possible ways in >>>> which this authentication might be performed include: >>> >>> Remove the pedagogy after the first sentence. The choices are outside >>> of this specification and the spec is not enhanced by pedagogy about >>> technical matters outside of its scope. >>> >>> Also isn't the first sentence redundant with other text in the spec? > > > This requests the removal of some non-normative text that gives > > examples of how an authentication service might authenticate the > > sender of a message. Why this text should be "pedagogical" is a bit > > obscure to me, as is why it would be a bad thing if it were - the > > examples that follow are the ways that this step will probably be > > accomplished, though we don't want to mandate any one in particular. > >Examples are pedagogy. The provide legal and/or plausible and/or=20 >relevant details to improve the reader's understand of the general point=20 >being described. > >Putting pedagogy in the middle of the specification of a sequence=20 >invites reader distraction. When pedagogy is needed, put it in the=20 >discussion about the sequence that normally comes after specification of=20 >the sequence. > > >>>> If the authentication service is instantiated by a SIP >>>> intermediary (proxy server), it may authenticate the request=20 >>>>with >>>> the authentication scheme used for registration in its domain >>>> (e.g., Digest authentication). >>>> >>>> If the authentication service is instantiated by a SIP user=20 >>>>agent, >>>> a user agent may authenticate its own user through any system- >>>> specific means, perhaps simply by virtue of having physical=20 >>>>access >>>> to the user agent. >>>> >>>> >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page= =20 >>>>8] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> Authorization of the use of a particular username or telephone=20 >>>>number >>>> in the user part of the From header field is a matter of local=20 >>>>policy >>>> for the authentication service; see Section 6.1 for more=20 >>>>information. >>>> >>>> Note that this check is performed only on the addr-spec in the >>>> identity field (e.g., the URI of the sender, like >>>> 'sip:alice@atlanta.example.com'); it does not convert the display- >>>> name portion of the From header field (e.g., 'Alice Atlanta'). For >>>> more information, see Section 12.6. >>> >>> 'checking' and 'converting' are very different actions. So 'it does >>> not' does not flow from the preceding text in the sentence. > >{{ No response from Jon. }} > > >>> >>>> >>>> Step 3: >>> >>> Step 3: Timestamp >>> >>> >>>> >>>> An authentication service MUST add a Date header field to SIP >>> >>> Why? (Probably only need to cite the earlier discussion about its use >>> for replay mitigation. But merely cite; don't duplicate.) > > > The end of this step reads "See > > Section 12 for information on how the Date header field assists > > verifiers." That answers "why?" It would be nice if the line-by-line > > review here could keep state for half a minute and go back and remove > > comments when they are answered immediately afterwards. [$] > >Then cite section 12, so the reader can get easily linked to the=20 >explanation. > >However Section 12 is a long and varied section and a citation to all of=20 >it isn't very helpful. I suspect you mean Section 12.1. > > >>> >>>> requests that do not have one. The authentication service MUST >>>> ensure that any preexisting Date header in the request is accurate. >>>> Local policy can dictate precisely how accurate the Date must be; a >>>> RECOMMENDED maximum discrepancy of sixty seconds will ensure that=20 >>>>the >>>> request is unlikely to upset any verifiers. If the Date header >>>> contains a time different by more than one minute from the current >>>> time noted by the authentication service, the authentication=20 >>>>service >>>> SHOULD reject the request. This behavior is not mandatory because= =20 >>>>a >>>> user agent client (UAC) could only exploit the Date header in order >>>> to cause a request to fail verification; the Identity header is not >>>> intended to provide a source of non-repudiation or a perfect record >>> >>> Then where does the non-repudiation feature of STIR come from? > > > This is the only use of the term > > "non-repudiation" in rfc4474bis-10, and the term does not appear in > > RFC7375 or RFC7340, as non-repudiation is not a requirement needed to > > address the threats for which STIR was designed. While PASSporT > > contains some language about its potential use for non-repudiation, > > do note the first paragraph of Section 7.2 of PASSporT. So in short, > > I'm not aware that STIR has or has ever intended to have that > > "feature". > >Oh boy... > >1. First sentence in Passport: > > This document defines a token format for verifying with non- > repudiation the sender of and authorization to send information > related to the originator of personal communications. > >2. 7.2. Solution Considerations > > It should be recognized that the use of this token should not, in > it's own right, be considered a full solution for absolute non- > repudiation of the persona being asserted. > > {{which implies that it *does* serve as a partial solution for > non-repudiation. /d}} > >Passport was created for STIR. STIR uses Passport. STIR documents do=20 >not declare their use of a subset of passport, nevermind what that=20 >subset is. > > >>>> of when messages are processed. Finally, the authentication=20 >>>>service >>>> MUST verify that both the Date header and the current time fall >>>> within the validity period of its credential. >>>> >>>> See Section 12 for information on how the Date header field assists >>>> verifiers. >>>> >>>> Step 4: >>>> >>>> Subsequently, the authentication service MUST form a PASSporT=20 >>>>object >>>> and add a corresponding an Identity header to the request=20 >>>>containing >>> >>> a corresponding an ?->? a corresponding >>> >>> >>>> this signature. For baseline PASSporT objects headers (without an >>> >>> baseline PASSporT objects headers >>> -> >>> a baseline PASSporT objects header >>> >>> >>>> Identity header "ppt" parameter), this follows the procedures in >>> >>> header? or header field? >>> >>> >>>> Section 8; if the authentication service is using an alternative >>>> "ppt" format, it MUST add an appropriate "ppt" parameter and follow >>> >>> Isn't this text repeating specification text that is elsewhere in the >>> document? If so, remove it. > > > indeed the sentence containing this > > guidance says "(see Section 9)" at end of it. It is referring to > > specification text elsewhere in the document, but here in these > > steps, we do give some high level notion of what you're supposed to > > do in addition to giving a pointer to where the behavior is fully > > detailed. > > >>> >>>> the procedures associated with that extension (see Section 9). =20 >>>>After >>>> the Identity header has been added to the request, the=20 >>>>authentication >>>> service MUST also add a "info" parameter to the Identity header. =20 >>>>The >>>> "info" parameter contains a URI from which the authentication >>>> service's credential can be acquired; see Section 6.3 for more on >>>> credential acquisition. >>>> >>>> Step 5: >>> >>> >>> Step 5: Canonicalization >>> >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page= =20 >>>>9] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> In the circumstances described below, an authentication service=20 >>>>will >>> >>> another forward reference, this time without even a specific pointer. > > > Once again, a line-by-line review needs to be able to read > > literally the next sentence, which contains the "specific pointer" to > > Section 8. [$] > >Both a pointer *and* a redundant summary of what will be found at the=20 >pointer. But only syntax. No reference to semantics. > > >>> >>>> add a "canon" parameter to the Identity header. The syntax of >>>> "canon" is given in Section 8; essentially, it contains a base64 >>>> encoding of the JSON header and claims in the PASSporT object. The >>>> presence of "canon" is OPTIONAL baseline PASSporT objects in SIP=20 >>>>as a >>>> because the information carried in the baseline PASSporT object's >>>> headers and claims is usually redundant with information already >>>> carried elsewhere in the SIP request. Omitting "canon" can >>>> significantly reduce SIP message size, especially when the PASSporT >>>> object contains media keys. >>>> >>>> When however an authentication service creates a PASSporT that uses >>> >>> "When however"? > >{{ No response from Jon. }} > > >>> >>>> extension claims beyond the baseline PASSporT object, including >>>> "canon" is REQUIRED in order for the verification service to be >>>> capable of validating the signature. See Section 9. >>>> >>>> Also, in some cases, a request signed by an authentication service >>> >>> "in some cases"? This is a specification. Where is the clear detail? > > > If we let the sentence continue, it will clarify that > > it refers to those cases where the the request "will be rejected by > > the verification service on the receiving side" with a 4xx status > > code, after which it gives some guidance about what is to be done in > > those cases. Though of course, the sentence can't finish its thought, > > as the review interrupts yet again after "the receiving side" with > > the insistance that "'on the receiving side' is redundant. Remove it. > > Where else is there a verification service?" and then of course again > > before the end of the sentence to complain that the text here is > > "descriptive" and wondering "where is this SIP behavior documented in > > the spec?" Unsurprisingly, the text associated with sending a 438 in > > the backwards direction is to be found in the verification service > > behavior (5.2, Step 5 is a good place to start), though the formal > > defintions of the error codes are in 13.3. But the review here would > > benefit from letting a sentence end before objecting to it. [$] > >The constant reference to my including a comment in a way that broke up=20 >the text and gosh if only I'd read a bit further I'd have seen the=20 >answer, suffers from several problems: > > 1) Of course I read the whole thing. > > 2) 'Letting the sentence continue" does not alter my assessment. > > 3) I've placed the comment in order to make its referent clear. > >Saying 'in some cases' requires very explicit indication of what those=20 >cases are. The text doesn't do that, though I understand the author=20 >thinks it does. This reader doesn't. If one experienced reader is=20 >confused about something, what do we think the odds are that other,=20 >less-experienced readers will be?... > > >>>> will be rejected by the verification service on the receiving side, >>> >>> "on the receiving side" is redundant. Remove it. Where else is there a >>> verification service? > >Just realized: we again have confusion about who is doing what. The=20 >STIR verification entity does not reject requests. If reports a failed=20 >verification to its client, which is probably the system component that=20 >*does* issue the rejection. > > >>> >>>> and the authentication service will receive a SIP 4xx status code=20 >>>>in >>>> the backwards direction, such as a 438 indicating a verification >>> >>> This is offered as descriptive text here. Where is this SIP behavior >>> documented in this spec? > >{{ No response from Jon. }} > > >>> >>>> failure. If the authentication service did not originally send the >>> >>> The authentication service does sending? I think it doesn't, and the >>> definition of its roles implies that it doesn't, but rather that it is >>> part of one or another module that does. > > > This is why, when > > we're speaking strictly, we say things like "the entity which > > instantiates the role of the authentication service" instead of "the > > authentication service." If that entity is a proxy server, then yes, > > in certain SIP cases, even though it is an intermediary, it can > > resend a request in response to certain failed response codes it > > receives. So when the review says "hence it doesn't do retries. All > > of this needs to be recast in terms that match the specified > > architecture", it does do retries and it does match the architecture. > > This behavior entered the specification as a result of specific > > issues seen the wild with early deployments of this code, and while > > the review objects, "This is just guessing. Protocols that do > > guessing don't work very well" and that "This interaction needs to be > > re-specified to be deterministic", it is believed that this behavior > > works and that it is specified tightly enough. The same problem with > > "the entity which instantiates the role of the authentication > > service" vs. "the authentication service" is why the objection in the > > review to the text that "the authentication service MUST forward the > > message" is similarly misguided. > >The response again indicates confusion about the difference between the=20 >activities of a STIR architectural component, versus a range of ways=20 >that component might be implemented. > > >>> >>>> Identity header with the "canon" parameter, it SHOULD retry a=20 >>>>request >>> >>> and hence it doesn't do retries. All of this needs to be recast in >>> terms that match the specified architecture. > >{{ No response from Jon. }} > > >>> >>>> once after receiving a 438 response, this time including the=20 >>>>"canon". >>> >>> Why? This is just guessing. Protocols that do guessing don't work=20 >>>very >>> well. >>> >>> This interaction needs to be re-specified to be deterministic. > >{{ No response from Jon. }} > > >>> >>>> The information in "canon" is useful on the verification side for >>>> debugging errors, and there are some known causes of verification >>>> failures (such as the Date header changing in transit, see >>>> Section 12.1 for more information) that can be resolved by the >>>> inclusion of "canon". >>>> >>>> Finally, the authentication service MUST forward the message >>>> normally. >>> >>> it doesn't do forwarding. > >{{ No response from Jon. }} > > >>> >>>> >>>> 5.2. Verifier Behavior >>>> >>>> This document specifies a logical role for SIP entities called a >>> >>> redundant detail. > > > The review interrupts > > the sentence halfway through with "redundant detail." I don't think a > > high-level introductory statement counts as "detail". Is it redundant > > to begin a section on "Verifier Behavior" with a sentence making it > > clear that we're now into then business of defining the logical role > > of the verifier, or is it simply setting the stage for people who > > happen to skip to the top of that section and start reading? I don't > > see a need for any change there, any more than I do at the start of > > Section 4, which is titled "Overview of Operations" and begins with > > the sentence "This section provides an informative (non-normative) > > high-level overview of the mechanisms described in this document." Or > > that the section titled, "Changes from RFC4474" has a starting > > sentence that reads "the following are the salient changes from the > > original RFC4474." This is normal specmanship, and hardly a matter > > that warrants being flagged in a review. > > >>> >>>> verification service, or verifier. When a verifier receives a SIP >>>> message containing one or more Identity headers, it inspects the >>> >>> headers? header fields? >>> > >And, again, the verifier does not receive the SIP message... > > >>>> signature(s) to verify the identity of the sender of the message. >>>> The results of a verification are provided as input to an >>>> authorization process that is outside the scope of this document. >>> >>> Step 5, below, specifies a behavior that is within scope. > > > actually, what Step 5 says is that > > "the verification of an Identity header does not entail any > > particular treatment of the request", that "this specification does > > not propose any authorization policy" and that "local policy" is > > responsible for deciding what is authorized. Step 5 does talk a bit > > about circumstances in which an Identity header field value is > > "invalid" - but the text is also clear that it proposes no > > authorization decision based on "the presence of an invalid Identity > > header." > > >>> >>>> A SIP request may contain zero, one, or more Identity headers. A >>>> verification service performs the procedures above on each Identity >>>> header that appears in a request. If the verifier does not support >>> >>> What does it mean to 'not support an Identity header [field]"? > > > The sentence > > in full reads "not support an Identity header present in a request > > due to the presence of an unsupported 'ppt' parameter." Interjecting > > "what does this mean" in the middle of a sentence when the > > continuation of a sentence tells you what it means is a > > counterproductive method of review, instances of which occur here > > with mounting frequency. You don't support an Identity header (field > > value, really) if it contains a "ppt" you don't support. [$] > >So it's not the header field that isn't supported, it's one of it's=20 >parameters. And yes, that's an important semantic difference. > >Perhaps what is meant is that processing of the Identity header fails=20 >because a parameter in it is not supported? > > >>> Why might there be multiple Identity header [fields]? How might they >>> differ? > > > I'll agree that this isn't > > motivated in RFC4474bis-10. It is there for forward compatibility; we > > imagine that extensions (different "ppt"s) might be included in a > > message by different authentication services, or that different trust > > anchors might provide Identity headers that would be trusted by > > different recipients. We're not really going down those paths at the > > moment, we just didn't want to close the door on them. Still, I can > > see it might be helpful to have a paragraph of (gasp) foward-looking > > motivation about future work for this somewhere in the spec - > > probably in Section 9 (on extensibility). > > > >>>> an Identity header present in a request due to the presence of an >>>> unsupported "ppt" parameter, or if no Identity header is present,=20 >>>>and >>>> the presence of an Identity header is required by local policy (for >>>> example, based on a per-sending-domain policy, or a=20 >>>>per-sending-user >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>10] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> policy), then a 428 'Use Identity Header' response MUST be sent in >>>> the backwards direction. For more on this and other failure >>>> responses, see Section 13.3. >>>> >>>> In order to verify an Identity header in a message, an entity=20 >>>>acting >>>> as a verifier MUST perform the following steps, in the order here >>>> specified. Note that when an Identity header contains the optional >>>> "canon" parameter, the verifier MUST follow the additional=20 >>>>procedures >>>> in Section 5.2.1. >>>> >>>> Step 1: >>> >>> Step 1: PPT parameter >>> >>> >>>> The verifier MUST inspect any optional "ppt" parameter appearing=20 >>>>the >>> >>> [optional] remove. Especially given the MUST. It doesn't matter >>> whether the ppt was optional for the signer. > > > I don't think it is harmful here to > > reinforce that the parameter is optional, but that nonetheless, if > > present, it MUST be inspected. The review furthermore asks of "'any' > > can there be more than one? If only one then perhaps:" The review > > here doesn't like "the verifier MUST inspect any optional 'ppt' > > parameter," as the use of "any" here only connotes the possibility of > > "ppt"'s absence, rather than a potential plurality. I don't think > > there's any confusion in the English usage there. > > >>> "any" can there be more than one? If only one then perhaps: >>> >>> MUST inspect the "ppt" parameter, if present in the Identity=20 >>>request. >>> >>> >>>> Identity request. If no "ppt" parameter is present, then the >>>> verifier proceeds normally below. If a "ppt" parameter value is >>> >>> 'normally' implies the alternative is abnormal. also, 'below' where? > > > While I highly doubt this is unclear, for "below" we can say > > "with Step 2". The "abnormal" thing that happens is that you have > > special handling for the presence of a supported or unsupported > > "ppt." We could try instead of "normal" something like "default" or > > "baseline" or whatever, but I think "normal" is fine. This contention > > over what is "normal" continues with the review's claim that "it > > appears that ppt does not affect processing, as long as the ppt is > > 'supported'." This comments on a sentence that mentions that when a > > supported 'ppt' parameter value is present, you do the "variations" > > in Step 5. Step 5 has clear if-then handling for a supported ppt: > > > If a "ppt" parameter is present (and per Step 1, is understood), the > > verifier follows the procedures for that "ppt" (see Section 9). > > > That is the "variation" alluded to above. How this adds up to the > > claim that a supported "ppt" does not affect processing is beyond me. > > >>> >>>> present, and the verifier does not support it, it MUST ignore the >>>> Identity header. If a supported "ppt" parameter value is present, >>>> the verifier follows the procedures below, including the variations >>>> described in Step 5. >>> >>> is the 'below' here different from the one before it? > >{{ No response from Jon. }} > > >>> From the above text, it appears that ppt does not affect=20 >>>processing, >>> as long as the ppt is "supported". That is, an absent ppt and a valid >>> ppt both produce the same sequence 'below'. > >{{ No response from Jon. }} > > > >>>> Step 2: >>> >>> Step 2: Signature Scope > >{{ No response from Jon. }} > >I'm noting this here, but he didn't comment on them anywhere, from what=20 >I've seen. > >So I'll clarify why the extra labeling matters: It provides a semantic=20 >tag to the step and makes it easier to look over the entire sequence of=20 >labels and quickly understand the overall process. > > >>> >>>> In order to determine whether the signature for the identity field >>>> should be over the entire identity field URI or just a=20 >>>>canonicalized >>>> telephone number, the verification service MUST follow the >>>> canonicalization process described in Section 7.2. That section=20 >>>>also >>>> describes the procedures the verification service MUST follow to >>>> determine if the signer is authoritative for a telephone number. =20 >>>>For >>> >>> Those two functions are wildly different. Why are they part of the=20 >>>same >>> process? > > > The answer is that you're going to do either one > > or the other, but not both, between Step 1 and Step 3. Yes, telephone > > numbers and domain names are different, but dealing with one or the > > other is what you do at this stage of the process: it is the same > > process otherwise. I can't see any other useful way to organize or > > specify this behavior. I also don't see what possible problem someone > > might have with this. "Why?" questions like this about spec > > organization are very easy to ask, take a lot of thought to answer, > > and ultimately have no impact on the technology we are specifying > > here. > >For starters, I don't see how the process in 7.2 determines between the=20 >two types of identifiers, nor do I see a process here that makes the=20 >selection, nor do I see directives about what to do with the different=20 >results. > > >>> >>>> domains, the verifier MUST follow the process described in >>>> Section 7.3 to determine if the signer is authoritative for the >>>> identity field. >>>> >>>> Step 3: >>> >>> Step 3: Obtain Key >>> >>> >>>> The verifier must first ensure that it possesses the proper keying >>>> material to validate the signature in the Identity header field, >>>> which usually involves dereferencing a URI in the "info" parameter= =20 >>>>of >>>> the Identity header. See Section 6.2 for more information on these >>>> procedures. If the verifier does not support the credential >>>> described in the "info" parameter, then it should consider the >>> >>> Only should? Why??? > > > 5.2 On Step 3, the review denounces the soft guidance in the spec > > that a verifier merely "should" consider a credential for this header > > unsupported if it does not support the credential described in the > > "info" parameter. "Only should? Why???" Well, as the reference to 6.2 > > in the previous sentence would reveal if followed, verifiers may have > > alternative means to gain access to credentials associated with an > > identity than the contents of the "info" parameter, "such as an > > offline store of periodically-updated credentials" or something. So > > discovering the credential though "info" is only a SHOULD in section > > 6.2, which trickles down to here. Line-by-line is not helping here. > >"should" is not 'soft' guidance. or is 'should' not meant normatively?=20 >(It's so difficult to tell, sometimes.) > > >>> >>>> credential for this header unsupported. If a SIP request contains= =20 >>>>no >>>> Identity headers with a supported credential, then the verifier=20 >>>>MUST >>>> return a 437 "Unsupported Credential" response >>> >>> Verifier returns responses? > > > 5.2 Step 3 "verifier returns responses?" Well, yes, in the sense that > > "the entity that instantiates the verification service role" returns > > responses. Note that we have the same language here in 5.2 as we did > > in 5.1 right before the steps start to remind readers of this. > > >>> >>>> Step 4: >>> >>> Step 4: Date Window Enforcement >>> >>> >>>> The verifier MUST furthermore ensure that the value of the Date >>>> header of the request meets local policy for freshness (usually, >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>11] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> within sixty seconds) and that it falls within the validity period= =20 >>>>of >>>> the credential used to sign the Identity header. For more on the >>>> attacks this prevents, see Section 12.1. If the "canon" parameter= =20 >>>>is >>> >>> There was earlier discussion of using a date window validation to >>> mitigate against some attacks. There doesn't need to be yet-another >>> reference here. Just cite the earlier discussion. > > > Well, there was an earlier discussion of > > authentication service behavior. This is a discussion of verification > > service behavior. They aren't the same discussion. Things that the > > review flagged as missing from that part are present here, because we > > are describing the behavior of a different component of the > > architecture. > > >>> >>>> present, the verifier should follow the Date-related behavior in >>>> Section 5.2.1. >>>> >>>> Step 5: >>> >>> Step 5: Signature Validation >>> >>> >>>> The verifier MUST validate the signature in the Identity header=20 >>>>field >>>> over the PASSporT object. For baseline PASSporT objects (with no >>>> Identity header "ppt" parameter) the verifier MUST follow the >>>> procedures for generating the signature over a PASSporT object >>>> described in Section 8. If a "ppt" parameter is present (and per >>>> Step 1, is understood), the verifier follows the procedures for=20 >>>>that >>>> "ppt" (see Section 9). If a verifier determines that the that the >>>> signature in the Identity does not correspond to the reconstructed >>>> signed-identity-digest, then the Identity header should be=20 >>>>considered >>>> invalid. >>> >>> I suggest breaking this step into two parts: signature regeneration=20 >>>and >>> signature validation. >>> >>> It appears that the specification is calling for two (or more???) >>> different methods of doing signature validation, depending upon whether >>> ppt is present. This seems like an outstandingly bad idea. It creates >>> complexity and possibly even outright confusion. > > > If "ppt" is present, all that will mean is that > > potentially additionally headers (JWT headers that is) will be > > present, which correspond to components of a SIP request. Any > > PASSporT will always be a superset of the "bare minimum" headers and > > claims, so really what the "ppt" means is that something in addition > > to those has been signed. It would be as if, say, DKIM allowed one to > > specify a list of header fields that were signed in an "h=3D" > > parameter, which then listed the email headers in question. Except in > > our case, it assumes a baseline set of headers, and the "ppt" is > > effectively a profile that implies what additional headers have been > > included in the scope of the signature. I understand why it might > > seem like "an outstandingly bad idea" and in fact for years - maybe > > more than a decade - I held out against having anything but a fixed > > signature. Our "bare minimum" is the compromise that allowed us to > > move forward, while accommodating some important applications that > > participants in the working group want to apply this to with "ppt" > > extensions. I would prefer a "single algorithm", and indeed I think > > we do have one as you suggest, one where "components of the algorithm > > have branches." "ppt" is just one of those branches. > >The response, here, is enlightening for just how complicated the model=20 >appears to be. Lots of dependencies and conditionals to process=20 >through. Or at least, that's how I read what it means... > >(For reference, DKIM's h=3D is always present; it doesn't depend on other= =20 >meta-constructs being present. And while one can debate the efficacy,=20 >there's a minimum set of header fields required for h=3D, too.) > >By the way, I hope that the ppt profiles doesn't "imply" the set of=20 >headers fields that are signed, but that the profile actually and=20 >explicitly specifies them... > > >>> There needs to be a single algorithm for validation, even if components >>> of the algorithm have branches, such as depending on whether the >>> 'address' is a URI or a telephone number. > > > Whether we > > consider the process of generating and validating the signature to be > > one step or two seems like a very minor question to me: there's no > > ambiguity that you generate and then validate, regardless of whether > > from an organizational perspective we call that one step or two. Lots > > of the other steps are also composed of multiple discrete and > > separable actions. On matters this small it's hard to justify > > changing it or keeping it. (For the technical question posed in this > > same interjection, see the technical responses below). > >OK. Why not make the entire algorithm one step? > >The answer is clarity. The suggestion I'm making is for explicitly=20 >distinguishing two portions of the sequence that have completely=20 >different details and semantics. > > >>>> The presence of multiple Identity headers within a message raises=20 >>>>the >>>> prospect that a verification services could receive a message >>>> containing some valid and some invalid Identity headers. If the >>>> verifier determines all Identity headers within a message are >>>> invalid, then a 438 'Invalid Identity Header' response MUST be >>>> returned. >>> >>> So it's ok to have no Identity header fields but it's not ok to have >>> identity, where none validate. This means that the entire transfer >>> environment is expected and required to convey Identity fields >>> perfectly, all the time. > > > It means that there is a > > very real security difference between Identity not being used at all > > (which means you have no assurance either way) and Identity fields > > being present but broken (which means someone is trying to use the > > mechanism, and either an operational or security problem has arisen). > > Why on earth this would entail that "the entire transfer environment > > is expected and required to convey Identity fields perfectly, all the > > time" is beyond me. Identity headers will be dropped by some existing > > devices today which strip any headers they don't recognize, for > > example. And "canon" will fill in gaps in some other cases. > >The stated 'which means' interpretation here suggests a basic failure in=20 >the group's analysis of operational errors, as described in my comments=20 >earlier in this note. > > >>> >>>> The verification of an Identity header does not entail any=20 >>>>particular >>>> treatment of the request. The handling of the message after the >>>> verification process depends on how the implementation service is >>>> implemented and on local policy. This specification does not=20 >>>>propose >>>> any authorization policy for user agents or proxy servers to follow >>>> based on the presence of a valid Identity header, the presence of=20 >>>>an >>>> invalid Identity header, or the absence of an Identity header, but= =20 >>>>it >>>> is anticipated that local policies could involve making different >>>> forwarding decisions in intermediary implementations, or changing=20 >>>>how >>>> the user is alerted, or how identity is rendered, in user agent >>>> implementations. >>> >>> I suspect the above paragraph belongs elsewhere and sooner. It isn't >>> part of the step sequence. > > > This text is giving > > guidance on what happens at the end of this process. I disagree that > > it belongs earlier, but I can see that it isn't a part of Step 5 as > > such. Maybe I'll put in some clear divider to indicate where Step 5 > > ends. > > > >>>> 5.2.1. Handling 'canon' parameters >>>> >>>> If the optional "canon" parameter of the Identity header is=20 >>>>present, > > > I don't think it is harmful to reinforce that > > the "canon" parameter is optional. The review then goes on to also > > recommend removing "of the Identity header" as "there is no other > > canon parameter" than the one associated with that header. I for one > > do not feel that in the introductory sentence of a section, providing > > a bit of broader context and reinforcing what we hopefully already > > know for the benefit of people who skipped to this section via a > > pointer from elsewhere or what have you is harmful - I think it is > > actually good specmanship. The review however really doubles down on > > this: "But really I suspect that even the 'if' is unnecessary. The > > optionality has been established elsewhere. The task here is merely > > to specify what is in a canon." So the review proposes that 5.2.1 > > instead start with "The 'canon' parameter contains a base64 encoding > > of the header and claim..." etc. Comparing that to the existing text, > > I think the context that the existing text provides is valuable > > enough to warrant retaining it, over these forceful objections. > > >>> [optional] remove. it's redudnant with 'if' >>> >>> [of the Identity header] remove. there is no other canon parameter. >>> >>> But really I suspect that even the 'if' is unecessary. The optionality >>> has been established elsewhere. The task here is merely to specify=20 >>>what >>> is in a canon. > >{{ No response from Jon. }} > > >>>> it contains a base64 encoding of the header and claim component of >>> >>> This appears to be a re-specification of canon. Don't do that. Cite >>> its spec and then simply use it. > > > I do not feel that mentioning the fact > > that 'canon' contains a base64 encoding of the PASSporT header and > > claims is in any meaningful sense a "re-specification" of canon. A > > respecification would say, like, what those headers and claims are > > and how you build them. Providing basic and essential high-level > > context is not a reprimand-worthy offense. > >Again: Each time a specification detail is repeated elsewhere in the=20 >document is an opportunity to get it wrong and a burden to search and=20 >find when the details change. > > >>> >>>> the PASSporT object constructed by the authentication service, and >>>> this it conveys any canonical telephone number formats created by=20 >>>>the >>> >>> this -> thus ? >>> >>> there are multiple canon formats? that doesn't sound very canonical. >>> >>> but again, stating what it conveys is redundant. > > > There are not multiple "formats," but applying the canonicalization > > algorithm to telephone number representations will yield results that > > could be variable, because of matters of local policy described in > > Section 7.2. So if there's a problem with that, it's in 7.2, not in > > this section - the pluralization of "formats" is just an artifact of > > the "any" in the sentence construction. > >"canonical telephone number formats" does not mean multiple formats? I=20 >don't understand. > >Worse, the idea that a specification seeking standardization would=20 >include an algorithm that can produce variable results due to 'local=20 >policy' is a very basic error in the approach to doing standardization. > >*As soon as one says 'local policy' for anything other that a generic=20 >and non-normative discussion, one has stepped out of the sandbox in=20 >which the specification controls and, therefore, has stepped out of the=20 >specification. In other words, local policy for something like this=20 >needs to be out of scope.* > > >>>> authentication service (see Section 7.2), as well as an "iat" claim >>>> corresponding to the Date header that the authentication service >>>> used. The "canon" is provided purely as an optimization and >>>> debugging mechanism for the verification service. >>> >>> This is the wrong place to state what canon is for. > > > I think > > this is a good place to say what canon is for; it is the "canon" > > section, the only one dedicated to it in the document. Previously, > > 5.1 said that "The information in "canon" is useful on the > > verification side for debugging errors," and here in the verification > > side it makes sense to state what use there is to be made of it. > > Given the way the spec is organized now, putting a statement to this > > effect here makes more sense than placing this anywhere in section 7, > > say, since that really only deals with canonicalizing the > > identifiers. > >That is a bit like saying that a section of how to drive a car is a good=20 >place to explain what a car is for. Or by having extensive discourse on=20 >concepts of nutrition in the middle of a recipe for making a dish. In=20 >other worse, it isn't at all a good idea. > >Discussion of purpose is different from discussing procedure. > >There should be coherent and integration discussions about purpose=20 >earlier, before later diving into the many details of procedures. > > >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>12] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> When "canon" is present, the verification service MAY compute its=20 >>>>own >>> >>> 'MAY'??? I don't understand making canonicalization optional, either >>> during signing or during verification. > > > It really helps if you read the rest of the > > sentence. What it says is that you MAY compute it "-before- > > performing any cryptographic functions in order to ascertain whether > > or not the two ends agree on the canonical form." Clear? What > > implementations MAY do is to perform that comparison -before- any > > hard number crunching. Rather than doing it after. Reading the whole > > sentence helps. [$] > >Interesting. The problem here is the cascading and backward dependency=20 >sequence in the way the sentence is constructed. It does lend itself to=20 >easy comprehension. > > >>> >>>> canonicalization of the numbers and compare them to the values in=20 >>>>the >>>> "canon" parameter before performing any cryptographic functions in >>>> order to ascertain whether or not the two ends agree on the=20 >>>>canonical >>>> number form. Also, when "canon" is present, during Step 4 the >>>> verification service SHOULD compare the "iat" value in the "canon"= =20 >>>>to >>> >>> This is talking about actions during Step 4. Move it to Step 4! > >{{ No response from Jon. }} > > >>> >>>> its Date header field value. If the two are different, and the=20 >>>>"iat" >>>> value is later but within verification service policy for=20 >>>>freshness, >>>> the verification service SHOULD perform the computation required by >>>> Step 5 using the "iat" value instead of the Date value. As some >>>> deployments in the field have been observed to change the Date=20 >>>>header >>>> in transit, this procedure will prevent some unnecessary=20 >>>>verification >>>> failures. >>> >>> [unnecessary] remove. > > > I think the distinction between a > > security violation, which is a necessary verification failure, and > > some operational hijinx like intermediaries tinkering with the Date > > header when regenerating a SIP request, which is an unnecessary > > verification failure, is worth preserving. > >>> But it won't prevent others. This means that signatures that were=20 >>>valid >>> will break. And this ought to mitigate the handling of broken=20 >>>signatures. > > > Indeed, as the last paragraph of Section 1 states, the > > "revisited" in "STIR" derived from the fact that "RFC 4474 also > > provided a signature over material that intermediaries in existing > > deployments commonly altered," which led to unnecessary verification > > failures, and for us to revisit the signature scope. The signature > > scope we have now is the best one we think we can propose. We do > > believe that "canon" helps to mitigate the meaningful causes of > > unnecessary failures. The overall mechanism has gone through a great > > deal of working group scrutiny and also implementation and deployment > > testing. I've personally run it over live SIP networks. Casting vague > > doubt on it, while it is easy to do and it pads out the list of > > comments, is not persuasive. This is I think the only place so far in > > this review where I have asked for more information, but if you > > actually have something substantive to say about this, please say it, > > rather than just darkly hinting at stuff you know that we presumably > > don't. > >"The signature scope we have now is the best one we think we can=20 >propose" is fine. I'm not expressing concern over the details of the=20 >algorithm here, but on the persistent view that receive-side failures=20 >will only be due to the intervention of a bad actor. > > >>>> 6. Credentials >>>> >>>> 6.1. Credential Use by the Authentication Service >>>> >>>> In order to act as an authentication service, a SIP entity must=20 >>>>have >>>> access to the private keying material of one or more credentials=20 >>>>that >>>> cover domain names or telephone numbers. These credentials may >>>> represent authority over an entire domain (such as example.com) or >>>> potentially a set of domains enumerated by the credential. >>> >>> [potentially] remove > >{{ No response from Jon. }} > > >>> The implication is that "a set of domains" is not "an entire domain", >>> but I don't understand how the language says that. As written, this >>> actually translates to something like: authority over one or more >>> domains. Possibly what was meant is something like: authority over an >>> entire domain, or some number of sub-domains under that higher-level >>> domain. > > > The notion that a credential's scope > > might cover a single domain or "potentially" a set of domains > > suggests that the former is common and well understood and the latter > > is something we're endorsing a bit less heartily. Although the review > > speculates a bit about whether a "set of domains" means sub-domains > > under a higher-level domain, that isn't really material to the > > language here. Taking a step back, I can see how this might be > > confusing, though - could be worth a quick fix. > > >>>> Similarly, a credential may represent authority over a single >>>> telephone number or a range of telephone numbers. The way that the >>> >>> Similarly for telephone numbers, a credential can represent one=20 >>>or >>> a range of numbers. > > > While the latter is slightly shorter, the value of > > this sort of wordsmithing is unclear. It loses the connotation that a > > credential "represents authority over" those telephone numbers. The > > credential doesn't "represent" those telephone numbers. > >The sentence covers only credentials pertaining to telephone numbers.=20 >This is a pivotal point to the scope of the sentence. But it's only=20 >implied by the original form while being made the predicate for the=20 >suggested text. So in fact clarity is exactly the point behind the=20 >suggestion. > > >>> >>>> scope of a credential is expressed is specific to the credential >>>> mechanism. >>> >>> So, there is no standard for the specification of credentials, here. >>> That means that the technical details -- as distinct from the >>> operational policies -- of credentials are out of scope, although they >>> are fundamental to proper operation of this serve. This is a >>> showstopper, in terms of specification completeness for the service. > > > It would be, which is why we have a stir-certs > > specification that gives a credential system that we intend to use > > for initial implementation. RFC4474bis is pretty clear that the > > aggregate of it, stir-passport, and stir-certs is required for > > implementation. Historically, those two specifications effectively > > split out of RFC4474bis (though stir-passport first merged in from > > the verified-token draft, it then merged out again). > >Except that stir-certs is not a specification. > >And even if it were, it's not linked into the topic here properly.=20 >Instead, there's more pedagogy than specification, where the pedagogy is=20 >almost certainly redundant with was is, or should be, in stir-certs... > > >>> >>> The following paragraph is not about credentials. It is about signing >>> policy. It belongs elsewhere. And since it isn't really specifying >>> anything, that elsewhere probably is up towards introductory text. >>> >>> >>>> Authorization of the use of a particular username or telephone=20 >>>>number >>>> in the identity field is a matter of local policy for the >>>> authentication service, one that depends greatly on the manner in >>> >>> Huh? >>> >>> But really, when a specification says something is out of scope and is= =20 >>>a >>> matter for local policy, the specification should not then go on to >>> specify examples of local policy. In those cases where there is a >>> compelling benefit to include such examples, put them in an appendix. >>> But please, then, explain that compelling benefit. > > > > I would think that those examples might help to inform > > implementers who are trying to decide what kind of tools to provide > >Interesting view. And it might work well, for a companion document=20 >talking about such issues. > >But this is a specification, not an implementation guide. Giving=20 >guidance about the implementation of details that are out of scope is=20 >doubly out of scope. > > > > to operators, at least what sorts of building blocks might be in play > > in expressing that policy, or what protocol tools would be needed to > > extract elements that the policy could act upon. Or maybe we as > > specifiers thought that this would be a sound foundation for a > > policy, and while we don't want to give it normative force, we want > > to put it out there so that implementers and operators might consider > > it as a practice, if it happens to fit with their existing model. We > > might also think it is worth mentioning corner cases (like anonymity) > > that people might overlook in implementation otherwise. But... I > > really don't think there's any reason that the inclusive of a > > non-normative example requires a defense like this, nor do I think > > that the requirement the review expresses here is a valid one for > > IETF specifications. > >It shouldn't require a defense because text like that shouldn't be=20 >anywhere near text that is specifying an Internet protocol. > >>> >>>> which authentication is performed. For non-telephone number user >>>> parts, one policy might be as follows: the username given in the >>>> 'username' parameter of the Proxy-Authorization header MUST >>>> correspond exactly to the username in the From header field of the >>>> SIP message. However, there are many cases in which this is too >>>> limiting or inappropriate; a realm might use 'username' parameters= =20 >>>>in >>>> Proxy-Authorization that do not correspond to the user-portion of=20 >>>>SIP >>>> From headers, or a user might manage multiple accounts in the same >>>> administrative domain. In this latter case, a domain might=20 >>>>maintain >>>> a mapping between the values in the 'username' parameter of Proxy- >>>> Authorization and a set of one or more SIP URIs that might >>>> legitimately be asserted for that 'username'. For example, the >>>> username can correspond to the 'private identity' as defined in=20 >>>>Third >>>> Generation Partnership Project (3GPP), in which case the From=20 >>>>header >>>> field can contain any one of the public identities associated with >>>> this private identity. In this instance, another policy might be=20 >>>>as >>>> follows: the URI in the From header field MUST correspond exactly=20 >>>>to >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>13] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> one of the mapped URIs associated with the 'username' given in the >>>> Proxy-Authorization header. This is a suitable approach for >>>> telephone numbers in particular. >>>> >>>> This specification could also be used with credentials that cover a >>>> single name or URI, such as alice@example.com or >>>> sip:alice@example.com. This would require a modification to >>>> authentication service behavior to operate on a whole URI rather=20 >>>>than >>>> a domain name. Because this is not believed to be a pressing use >>>> case, this is deferred to future work, but implementers should note >>>> this as a possible future direction. >>>> >>>> Exceptions to such authentication service policies arise for cases >>>> like anonymity; if the AoR asserted in the From header field uses a >>>> form like 'sip:anonymous@example.com' (see [RFC3323]), then the >>>> 'example.com' proxy might authenticate only that the user is a=20 >>>>valid >>>> user in the domain and insert the signature over the From header >>>> field as usual. >>>> >>>> 6.2. Credential Use by the Verification Service >>>> >>>> In order to act as a verification service, a SIP entity must have a >>>> way to acquire and retain credentials for authorities over=20 >>>>particular >>> >>> for -> from ? > > > Um. You know I think either reads okay, strangely > > enough. I think I maybe like "for" better, the credentials are "for" > > those authorities, rather than merely received "from" them. Maybe > > "corresponding to" would be better. > >The two words create fundamentally different meanings. If the actually=20 >intended meaning is both, then say that. Otherwise, choose the word=20 >that means precisely what is intended. > > >>> >>>> domain names and/or telephone numbers or number ranges. >>>> Dereferencing the URI found in the "info" parameter of the Identity >>>> header (as described in the next section) MUST be supported by all >>> >>> forward reference > > > I don't think a parenthetical mention that the > > "info" parameter is described in the next section harms the > > comprehensibility of the document in any way. > > >>> >>>> verification service implementations to create a baseline means of >>> >>> I /really/ don't understand the trust model that has a security scheme >>> where the object giving a pointer to its own credential. Or rather, I >>> fear that I do understand it, but don't understand why its considered >>> credible. > > > As I rememeber > > discussing this with the reviewer on at least one previous occasion, > > I do gather this is a subject of some confusion. Relying parties > > trust these credentials because they trust the trust anchor that > > issued these credentials. They do not trust them because of the > > pointer they used to retrieve the credential, which may in fact be to > > an untrusted service. Who cares? If you find a certificate on a > > crumpled up piece of paper in a bus station and manually type it into > > your computer, you trust things signed with it (or not) based on your > > trust for the anchor that issued the credential and the scope of the > > authority that the anchor assigned to the credential. I seem to > > recall the reviewer being quickly convinced of this the last time we > > discussed it, and I can only assume this relapse is due to the fact > > that credential trust issues here are deferred to stir-certs rather > > than included in rfc4474bis. Although the review goes on to say that > > "A complete specification of a STIR service needs to include a > > publicly-usable key certification mechanism, a la DANE or DKIM or the > > like," that is really a document organization question, as stir-certs > > is intended to provide that. > >What is missing is a clear specification for this essential service=20 >component, including *very* clear explanations of the trust model --=20 >presumably using the above as a basis. It then needs a very diligent=20 >vetting by security folks, in terms of precedence of use, to provide a=20 >basis for believing it will work, and expected scaling issues. > >In effect, the model appears to emulate something like WEB certs, which=20 >have demonstrated extremely poor operational properties, or maybe=20 >DNSSec, (or maybe DANE) which is expected to do better, but absent a=20 >precise technical specification for this model, it's all just=20 >conjecture. In any event, this is not something to bury with a few,=20 >terse references in the middle of this specification here. > >>> >>>> credential acquisition. Provided that the credential used to sign= =20 >>>>a >>>> message is not previously known to the verifier, SIP entities=20 >>>>SHOULD >>>> discover this credential by dereferencing the "info" parameter, >>>> unless they have some more other implementation-specific way of >>>> acquiring the needed keying material, such as an offline store of >>>> periodically-updated credentials. If the URI in the "info"=20 >>>>parameter >>>> cannot be dereferenced, then a 436 'Bad Identity-Info' response=20 >>>>MUST >>>> be returned. >>> >>> Again, this much non-determinacy in such an essential mechanism ensures >>> /non-/interoperability. I do understand the intent to have >>> private/proprietary mechanism at work for use of this spec back in the >>> regulated telecom space, but that does not mean it needs to distract=20 >>>the >>> public specification. A complete specification of a STIR service needs >>> to include a publicly-usable key certification mechanism, a la DANE or >>> DKIM or the like. >>> >>> The application of STIR for other, non-open operations are always free >>> to amend the specification through a separate profile that overrides=20 >>>one >>> or another piece of the base STIR specifications. > >{{ No response from Jon. }} > > >>> >>>> >>>> This specification does not propose any particular policy for a >>>> verification service to determine whether or not the holder of a >>>> credential is the appropriate party to sign for a given SIP=20 >>>>identity. >>> >>> This is a fundamental flaw in this specification. It reduces to saying >>> that the document is specifying a validation service that does not >>> provide a deterministic means for assessing validation. > > > No, it is saying that this document > > tells you how to validate what goes over the wire, but that it is a > > matter of local policy who you trust and why. We're not here to say > > "all implementations of STIR shall trust the following trust anchor" > > or what have you. It is up the conscience of the individual > > churchgoer. This is no different than it is for web PKI. There is a > > lot of diversity of opinion about who will issue those credentials > > and what their scope will be, and the stir-certs spec gives some > > guidance on how those scopes would be managed for a couple of > > initially envisioned architectures. But the point is, the fields that > > go in PASSporT and the semantics of the SIP Identity header field > > value will not be any different as a result of those different > > architectures. This is simple matter of design modularity. I doubt > > there is some lurking flaw here, this has probably been the single > > most vetted and scrutinized aspect of the design. > >*The response shows a confusion about validation and trust. > >Validation is the task of STIR. Within the scope of establishing=20 >validation -- that is, within the standardized and interoperable details=20 >of an authentication mechanism like STIR -- there *must* be a semantic=20 >component provided which establishes the authority of the entity=20 >asserting validity to make that assertion.: The premise of an=20 >authentication mechanism is clarity about the authority of the entity=20 >vouching for the use of the key. > >This is entirely different from the trust component which assesses=20 >whether that entity is a good actor or not (or whether the authorized=20 >entity doing the signing is a good actor or not.)* > > >>> >>>> Guidance on this is deferred to the credential mechanism >>>> specifications, which must meet the requirements in Section 6.4. >>>> >>>> Verification service implementations supporting this specification >>>> may wish to have some means of retaining credentials (in accordance >>>> with normal practices for credential lifetimes and revocation) in >>>> order to prevent themselves from needlessly downloading the same >>>> credential every time a request from the same identity is received. >>>> Credentials cached in this manner may be indexed in accordance with >>> >>> This is gratuitous implementation advice. Remove it. >>> >>> If there is a compelling desire to give implementation advice, move it >>> to a separate document and make it more complete. >>> >>> It is especially ironic to try to give implementation advice about a >>> mechanism that isn't fully specified. > > > This commentary > > is inserted into a sentence directly before the one reading "Further > > consideration of how to cache credentials is deferred to the > > credential mechanism specifications." > >Another good reason to remove it. > > >>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>14] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> local policy: for example, by their scope, or the URI given in the >>>> "info" parameter value. Further consideration of how to cache >>>> credentials is deferred to the credential mechanism specifications. >>>> >>>> 6.3. Handling 'info' parameter URIs >>> >>> >>> I don't find a specification for the 'info' parameter. I find many >>> references to the Identity-Info header field, but assume that's not=20 >>>what >>> is meant here. > > > To my chagrin, the > > latter is at least partly true. There remain some references to the > > Identity-Info header that still need to be ripped out: two in 6.3 and > > one in 7.3. A mention in 6.2 still gives a reason code for 436 as > > "Bad Identity-Info" as well. I'd be willing to concede that counts as > > "many." I am however less persuaded that the 'info' parameter is not > > specified. It is introduced in Section 3, instructions on how to > > include it are given in Section 5.1 Step 4, instructions on how to > > process it are given in Section 5.2 Step 3 with a helpful forward > > reference to 6.2. The guidance on 'info' given in 6.3 seems perfectly > > adequate, and its abnf is indeed given in Section 8. The allegation > > in the review of 6.3 that there is some deficiency in the > > specification of 'alg' and 'ppt' is, as far as I can tell, baseless - > > 'alg' has not even been mentioned in the specification yet by section > > 6.3 in any context. But definitely we need to remove those extraneous > > references to Identity-Info. > > > > >>> I also find abnf for an ident-info rule, which includes an "ident" >>> literal string. I suspect this is the reference you intend? >>> >>> Please reference these more formally and properly cite their definition >>> at first use. (If you want to rename rules, to make the use of the >>> rulename more pleasant in the text, that's fine. But just make sure >>> that a new reader can understand what type of reference is being made >>> and where to go to find its definition. >>> >>> Ditto for "alg". >>> >>> Ditto for ppt. > >{{ No response*S* from Jon. }} > > >>> And, of course, these are more forward references. In this case, it's >>> giving detail about something that hasn't even been defined yet. > > > I'm not aware there are any forward references in 6.3. > > >>> >>>> An "info" parameter MUST contain a URI which dereferences to a >>> >>> This isn't about the handling of info. It's defining its contents.=20 >>>They >>> need to be separate segments of text. > > > Since this section primarily discusses the conditions in which > > the URI found in an 'info' parameter can be deferenced, this can > > hardly be considered "defining" its contents, which have long since > > been defined (in particular in places like 5.1 Step 4, at least until > > we get the final word in Section 8). > > >>>> resource that contains the public key components of the credential >>>> used by the authentication service to sign a request. It is >>>> essential that a URI in the "info parameter" be dereferencable by=20 >>>>any >>> >>> Again, specification, not handling. Also, what do the instructions >>> mean? How is the signer to know what is dereferenceable by the=20 >>>verifier? > >{{ No response from Jon. }} > > >>> >>>> entity that could plausibly receive the request. For common cases, >>>> this means that the URI must be dereferencable by any entity on the >>>> public Internet. In constrained deployment environments, a service >>>> private to the environment might be used instead. >>>> >>>> Beyond providing a means of accessing credentials for an identity, >>>> the "info" parameter further serves as a means of differentiating >>>> which particular credential was used to sign a request, when there >>>> are potentially multiple authorities eligible to sign. For=20 >>>>example, >>> >>> It sounds as if the real need is to have an external registry of >>> authorized credentialing services and then refer to the one that is=20 >>>used >>> by name. That provides independent vetting and limits the 'vocabulary' >>> of credential service references the message can cite. > > > That would certainly simplify the > > architecture, and in practical deployments, that may effectively be > > decided by fiat. The suggestion though that this is the "real need" > > is an unnecessary limitation. Later in 6.3 this returns as "Looks > > like this needs to define a STIR Credential Registry." While I > > wouldn't mind if one of those existed, it is not necessary for the > > deployment of STIR, and should not be introduced as a required > > component of the architecture. > >*The operational history of certificate-based services is highly=20 >problematic. For a criticial infrastructure service like STIR, the=20 >technical design of the cert service is not something that can be=20 >deferred and treated merely as a matter of operational design.* > > >>> >>>> imagine a case where a domain implements the authentication service >>>> role for a range of telephone and a user agent belonging to Alice=20 >>>>has >>>> acquired a credential for a single telephone number within that >>>> range. Either would be eligible to sign a SIP request for the=20 >>>>number >>>> in question. Verification services however need a means to >>>> differentiate which one performed the signature. The "info" >>>> parameter performs that function. >>>> >>>> 6.4. Credential System Requirements >>> >>> Besides having extraneous material, this section is almost certainly >>> incomplete and probably extremely incomplete. I suggest removing the >>> section and simply state that the details of the credentialing system >>> are outside the scope of this specification, except for specifying a >>> registry that lists possible systems. > > > While this section says little, the > > little it does say constrains external credential systems enough that > > it is worth retaining. The requirements here are, for example, > > discussed in the stir-certs document. The review rightly notes that > > "the entire topic appears to be larger than this specification," and > > this specification doesn't suggest otherwise. > >The section does indeed say little. Enough to give the impression that=20 >it is covering its topic, but too little to be of sufficient help. > > >>> Also note that the claimed interest in authentication beyond SIP will >>> also require credentialing systems. As such, the entire topic appears >>> to be larger than this specification. > >{{ No response from Jon. }} > > >>> >>>> This document makes no recommendation for the use of any specific >>>> credential system. Today, there are two primary credential systems >>> >>> A review of current, external services and hypothetical capabilities is >>> not appropriate for inclusion inside a technical specification. Move=20 >>>it >>> to a separate document. > > > As the text here points to existing RFcs in this space, > > and drafts tailored to provide this specific capability for STIR, it > > is baffling why the review alleges that this is "not appropriate for > > inclusion inside a technical specification," nor why moving such > > material to a separate document would more useful than keeping it > > here. > >Because a specification is not a review document. And the review text=20 >about what exists 'today' is likely to quickly be out of date. It also=20 >seems odd to have a 'requirements' section this late in the document... > > >>>> in place for proving ownership of domain names: certificates (e.g., >>>> X.509 v3, see [RFC5280]) and the domain name system itself (e.g., >>>> DANE, see [RFC6698]). It is envisioned that either could be used=20 >>>>in >>>> the SIP identity context: an "info" parameter could for example=20 >>>>give >>>> an HTTP URL of the Content-Type 'application/pkix-cert' pointing=20 >>>>to a >>>> certificate (following the conventions of [RFC2585]). The "info" >>>> parameter may use the DNS URL scheme (see [RFC4501]) to designate >>>> keys in the DNS. >>>> >>>> While no comparable public credentials exist for telephone numbers, >>>> either approach could be applied to telephone numbers. A=20 >>>>credential >>>> system based on certificates is given in >>>> [I-D.ietf-stir-certificates], but this specification can work with >>>> other credential systems; for example, using the DNS was proposed=20 >>>>in >>>> [I-D.kaplan-stir-cider]. >>> >>> the above isn't 'requirements'. > >{{ No response from Jon. }} > > >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>15] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> In order for a credential system to work with this mechanism, its >>>> specification must detail: >>>> >>>> which URIs schemes the credential will use in the "info" >>>> parameter, and any special procedures required to dereference=20 >>>>the >>>> URIs >>>> >>>> how the verifier can learn the scope of the credential >>> >>> what does scope of the credential'? > > > The scope of a credential is the scope of its authority: in this > > context the identifiers for which the credential is authorized to > > sign. Scope is discussed earlier in 6.2 and the first paragraph of > > 6.1 (probably the best place to look). > >then please say that. > > >>> >>>> any special procedures required to extract keying material from >>>> the resources designated by the URI >>>> >>>> any algorithms required to validate the credentials (e.g. for >>>> certificates, any algorithms used by certificate authorities to >>>> sign certificates themselves) >>> >>> Looks like this needs to define a STIR Credential Registry. > >{{ No response from Jon. }} > > >>> >>>> It is furthermore required that all credential specifications >>>> describe how the associated credentials will support the mandatory >>>> signing algorithm(s) required by PASSporT [I-D.ietf-stir-passport]. >>> >>> So this really is another bullet for the above, indented list? >>> >>> Then again: credentials supporting signing algorithms? I don't >>> understand this. The signing algorithms are for the payload using the >>> key /from/ the credential. So what does this requirement mean, and=20 >>>why? > > > This is in response to some text about > > how the "associated credentials will support the mandatory signing > > algorithm(s) required by PASSporT." This is simply a reference to the > > keying material associated with the credential actually supporting > > ECDSA as required by PASSporT. If you have a credential with an RSA > > key, like an old fashioned certificate, you will not be compliant. > >This is fun. A document that is supposed to be a protocol specification=20 >and is specifying neither the cert mechanism details nor the 'passport'=20 >mechanism details is making 'requirements' demands on both. That=20 >equates to having some specification of each of them buried in the=20 >middle of this document. > > >>>> SIP entities cannot reliably predict where SIP requests will >>>> terminate. When choosing a credential scheme for deployments of=20 >>>>this >>>> specification, it is therefore essential that the trust anchor(s)=20 >>>>for >>>> credentials be widely trusted, or that deployments restrict the use >>>> of this mechanism to environments where the reliance on particular >>>> trust anchors is assured by business arrangements or similar >>>> constraints. >>> >>> replace above with: Use of a credentialing mechanism must be >>> supported within a scope sufficient to include the authentication >>> service, the verifying service and the credentialing service. > > > I think > > the existing text is much more specific than the proposed edit, and > > while the edit may be more concise, it does not attest the > > possibility that "business arrangements or similar constraints" may > > be required to enforce a trust anchor in some deployments. > >Oh yes. It /is/ more specific. That's the problem. It is diving into=20 >detail that isn't appropriate for the protocol specification task of=20 >this document. > > >>>> Note that credential systems must address key lifecycle management >>>> concerns: were a domain to change the credential available at the >>>> Identity-Info URI before a verifier evaluates a request signed by=20 >>>>an >>>> authentication service, this would cause obvious verifier failures. >>>> When a rollover occurs, authentication services SHOULD thus provide >>>> new Identity-Info URIs for each new credential, and SHOULD continue >>>> to make older key acquisition URIs available for a duration longer >>>> than the plausible lifetime of a SIP transaction (a minute would=20 >>>>most >>>> likely suffice). >>>> >>>> 7. Identity Types >>>> >>>> This specification focuses primarily on cases where the called and >>> >>> Focuses primarily? What I've been reading in this spec covers both >>> phone and uri forms. So I don't know what the 'primarily' refers to. > > > STIR itself primarily focuses on telephone numbers > > and the problems of impersonation related to them. We went back and > > forth on the charter about whether to even allow this spec to cover > > regular SIP URIs as well. Ultimately, it does, though they have been > > second-class citizens throughout the spec's development. The recent > > restructuring of Section 7 and the introduction of the URI > > normalization section were intended to rectify that a bit. So perhaps > > it isn't as true anymore. But in terms of STIR's overall goal, > > telephone numbers are definitely the primary focus. > >Actually, this specification does /not/ "focus" on telephone numbers.=20 >It attempts to deal with both forms of identifier, although the way it=20 >does that is confusing. > >To the extent that you think this document focuses on telephone numbers=20 >"and the problems of impersonation related to them" as distinct from=20 >other types of identifiers, please describe where and how this focus is=20 >established and maintained, because I really don't see it. > >In additional, such a focus is probably a tactical mistake and probably=20 >a strategic one, especially given the many and varied claims of interest=20 >in providing for longer-term enhancements... > > >>> >>>> calling parties identified in the To and From header field values=20 >>>>use >>>> telephone numbers, as this remains the dominant use case in the >>>> deployment of SIP. However, this specification also works with >>>> "greenfield" identifiers (of the form "sip:user@host"), and >>>> potentially other identifiers when SIP interworks with another >>>> protocol. >>> >>> What about these is 'greenfield'? What does it mean here? > > > Even in the spec, > > "greenfield" is given in quotes to set it apart. While it's true that > > the term does not appear elsewhere in the specification, and could be > > discarded without doing any harm to readability, its presence does > > not strike me as a problem either. > >The response doesn't answer my question. And my question made clear=20 >that I've no idea what the word is supposed to mean here or what=20 >justifies use of the word. > > > >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>16] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> The guidance in this section also applies to extracting the URI >>> >>> guidance vs. specification? > > > I think the term > > "guidance" is adequate and not ambiguous. > >So, this section is only supposed to be a non-normative discussion of=20 >the topic? It isn't supposed to provide normative detail? > > >>> >>>> containing the originator's identity from the P-Asserted-Identity >>>> header field value instead of the From header field value. In some >>> >>> Huh? How is the verifier supposed to know where to draw the values=20 >>>from? > > > The > > answer to that is so obvious that perhaps it is easy to miss. If your > > environment uses PAI, then you take the identity value from there. If > > it doesn't, you don't. This may sound glib, but it is actually > > profoundly sound advice for the environments that actually do use > > PAI. This has been much discussed on the list, even very recently. We > > think the guidance here is sufficient. > > >>> >>>> environments, the P-Asserted-Identity header field is used in lieu= =20 >>>>of >>>> the From header field to convey the address-of-record or telephone >>>> number of the sender of a request; while it is not envisioned that >>>> many of those networks would or should make use of the Identity >>>> mechanism described in this specification, where they do, local >>>> policy might therefore dictate that the canonical identity derive >>>> from the P-Asserted-Identity header field rather than the From. >>> >>> As soon as a document says 'local policy' it needs to stop specifying >>> detail, since it is both outside of the scope of the document and it is >>> distracting from the details of the specification. >>> >>> If you have to make reference to the possibility, then include=20 >>>something >>> simple and brief, such as: >>> >>> Local policies might choose to use a value from fields other than >>> To and From. The details for this are outside the scope of this >>> specification. >>> >>> To the extent there is a compelling need to specify this alternative >>> mechanism, do it in a separate specification. > > > Especially here, this is nonsense. > > What is local policy, as the spec says, is the decision of whether > > you extract the identity from PAI or the From. There's still plenty > > to be said about what you do once that policy decision has been made > > one way or another. The notion that as soon as the words "local > > policy" appear in a spec then you can't say further related to the > > subject is a rule with no basis in practice or reality. Again, the > > review urges that "To the extent there is a compelling need to > > specify this alternative mechanism, do it in a separate > > specification." No thanks, it's fine here. On similar grounds, the > > review goes on to suggest that another helpful paragraph of mechanism > > be removed because it mentions "local policy" in connection with the > > "canon" parameter. No thanks. > >*"What is local policy, as the spec says, is the decision of whether you=20 >extract the identity from PAI or the From" is a perfect example of=20 >failing to ensure interoperability. It is exactly the sort of thing=20 >that needs to have determinacy in sources of information. The concept=20 >of "local" policy for such an action is an explicit statement that a=20 >participant has stepped outside the four walls of the standardization=20 >process.* > > >>> >>>> Ultimately, in any case where local policy canonicalizes the=20 >>>>idenity >>>> into a form different from how it appears in the From header field, >>>> the use of the "canon" parameter by authentication services is >>>> RECOMMENDED, but because "canon" itself could then divulge >>>> information about users or networks, implementers should be mindful >>>> of the guidelines in Section 11. >>> >>> remove above paragraph. > >{{ No response from Jon. }} > > >>>> >>>> It may not be trivial to tell if a given URI contains a telephone >>> >>> If that means it isn't deterministic, we've got a basic problem, since >>> protocol specs do not offer heuristics. >>> >>> If it just means there is complexity, then the sentence says nothing >>> useful. > > > Of course, the next sentence goes on > > to start explaining what you do, with some nice normative text. > > Similarly, the review then orders, "If there is an algorithm to > > follow, specify it as an algorithm. Otherwise, this is non-normative > > discussion and isn't very helpful here." And the very next sentence > > gives the first step in an algorithm. > > >>> >>>> number. In order to determine whether or not the user portion of a >>> >>> [or not] remove >>> >>> >>>> SIP URI is a telephone number, authentication services and >>>> verification services MUST perform the following procedure on any=20 >>>>SIP >>>> URI they inspect which contains a numeric user part. Note that the >>>> same procedures are followed for creating the canonical form of=20 >>>>URIs >>>> found in the From header field as they are in the To header field=20 >>>>or >>>> the P-Asserted-Identity header field. >>> >>> If there is an algorithm to follow, specify it as an algorithm. >>> Otherwise, this is non-normative discussion and isn't very helpful=20 >>>here. > >{{ No response from Jon. }} > > >>> >>>> First, implementations must look for obvious indications that the >>>> user-portion of the URI constitutes a telephone number. Telephone >>>> numbers most commonly appear in SIP header field values in the >>> >>> "most commonly" suggests that this is discussion, not specification. > > > Specifications are apparently > > forbidden from suggesting that something is rare or pervasive. There > > are two ways that a telephone number can appear in the user part of a > > SIP URI, and that one is more common than the other in contemporary > > operations. It is true that this information would only be of little > > use to implementers, because the scheme itself will tell you whether > > or not the less common of these approaches is in use. And maybe over > > time it would no longer be true. But is it even worth anyone's time > > to suggest removing it? Will any implementer do something wrong > > because those words are there? Will anyone be confused or understand > > the aim of the specification less? > >The essential point is confusing specification detail with operational=20 >detail, especially when the operational detail involves statistics and=20 >there is no data upon which to base the prediction. Conflating the two=20 >types of text confuses both of them. > > >>> >>>> username portion of a SIP URI (e.g., >>>> 'sip:+17005551008@chicago.example.com;user=3Dphone'). The user par= t=20 >>>>of >>>> that URI conforms to the syntax of the TEL URI scheme (RFC 3966 >>>> [RFC3966]). It is also possible for a TEL URI to appear in the SIP >>>> To or From header field outside the context of a SIP or SIPS URI >>>> (e.g., 'tel:+17005551008'). Thus, in some environments, numbers=20 >>>>will >>>> be explicitly labeled by the use of TEL URIs or the 'user=3Dphone' >>>> parameter, or implicitly by the presence of the '+' indicator at=20 >>>>the >>>> start of the user-portion. Absent these indications, if there are >>>> numbers present in the user-portion, implementations may also=20 >>>>detect >>>> that the user-portion of the URI contains a telephone number by >>>> determining whether or not those numbers would be dialable or >>>> routable in the local environment -- bearing in mind that the >>>> telephone number may be a valid E.164 number, a nationally-specific >>>> number, or even a private branch exchange number. Once a telephone >>>> number has been detected, implementations should follow the >>>> procedures in Section 7.2. >>>> >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>17] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> If the URI field does not contain a telephone number, URI >>>> normalization procedures are invoked to canonicalize the URI before >>>> it is included in a PASSporT object in, for example, an "uri"=20 >>>>claim. >>>> See Section 7.4 for that behavior. >>> >>> I suspect that the above topic is confusing what can/must be done as a >>> deterministic specification, with what incremental value can be=20 >>>obtained >>> by the addition of some non-normative heuristics. Separate these and >>> make the deterministic stuff part of the specification and the >>> heuristics part of an external document discussing real-world >>> implementation, or somesuch. > > > I'm not aware > > that there is any "heuristics part" of this mechanism to exile > > elsewhere. There is one sentence that talks about just treating a > > numeric string like a telephone number and seeing if it works - if > > that's the heuristics part, then I think it doesn't take up a lot of > > the reader's time. > >Given the style of the prose that apparently is attempting to specify an=20 >algorithm, I can't tell whether the outcome is deterministic and=20 >interoperable. > > >>> >>> >>> >>>> 7.1. Authority for Telephone Numbers >>>> >>>> In order for telephone numbers to be used with the mechanism >>>> described in this document, authentication services must enroll=20 >>>>with >>>> an authority that issues credentials authoritative for telephone >>>> numbers or telephone number ranges, and verification services must >>>> trust the authority employed by the authentication service that=20 >>>>signs >>> >>> "enroll"??? > > > 7.1 "'enroll'???" Yes, there is something called certificate > > enrollment. > >Some quick research shows the term tied to Microsoft products and to=20 >SCEP. Google certainly does not produce results that shows it as ab=20 >otherwise-common term. > >So here we are again, with a term of art being used that does not have a=20 >definitional anchor in this document, but apparently significant intent=20 >in its use. So the reader is not safe to guess or ignore but is mostly=20 >being required to guess. > >After review, the situation might be more interesting than I'd realized,=20 >since I can't find a definition of "authentication services", so I'm not=20 >even clear what function entity in the STIR architecture is being=20 >referenced and what its job is. > > >>> >>>> a request. Per Section 6.4, enrollment procedures and credential >>>> management are outside the scope of this document; approaches to >>>> credential management for telephone numbers are discussed in >>>> [I-D.ietf-stir-certificates]. >>> >>> If they are outside the scope, then don't provide details such as about >>> enrolling. At the least, don't repeat information provided elsewhere=20 >>>in >>> the document. > > > This is a comment on a two-sentence, one > > paragraph section which exists to give an external pointer to > > stir-certs. It says that this stuff is "outside the scope of the > > document." There are no "details" about enrolling in this section, > > nor does it repeat information provided in 6.4 - it only mentions > > that there is information in 6.4. This review comment does not even > > identify any real issue. > > >>> >>>> >>>> 7.2. Telephone Number Canonicalization Procedures >>>> >>>> Once an implementation has identified a telephone number in the=20 >>>>URI, >>> >>> Once a telephone number is identified... >>> >>> And what about telephone numbers that are not part of a URI? > > > The To and From header field values (and the sneaky > > P-Asserted-Identity header field value too) of SIP contain URIs. The > > only meaningful distinction here is between a SIP URI and a TEL URI. > > But you're always going to be extracting a telephone number from some > > sort of URI. > >Such a simple and even reasonable point. And yet this far into the=20 >document I had not understood that, in spite of extremely detailed=20 >reading of the draft. No doubt I'm the only reader who will suffer that=20 >confusion... > > >>>> it must construct a number string. That requires performing the >>>> following steps: >>> >>> If a 'number string' has been identified, then what does it mean to >>> 'construct a number string'? I think what's meant is that it is >>> necessary to put the number into a canonical form. In any case, please >>> clarify what is meant. > > > Of course, since > > the next sentence reads "That requires performing the following > > steps," clearly performing those steps is what it means to "construct > > a number string." But more importantly, the review question assumes > > that a "number string" has already been identified, whereas the spec > > text reads "once an implementation has identified a telephone > > number." The distinction here is between a "telephone number" and a > > "number string." The review though neatly twists this around to make > > it sound like that distinction is not obvious in the sentence. [$] > >The point behind my question is that the phrasing creates confusion. At=20 >the least, the nature/purpose of the string to be constructed needs to=20 >be clarified. > > > >> The algorithm should be specified in the form of an algorithm, rather > >> than as normative prose, and language like "except only" encourages > >> coding errors: > > > >>>> Implementations MUST drop any leading +'s, any internal dashes, >>>> parentheses or other non-numeric characters, excepting only the >>>> leading "#" or "*" keys used in some special service numbers >>>> (typically, these will appear only in the To header field=20 >>>>value). >>>> This MUST result in an ASCII string limited to "#", "*" and=20 >>>>digits >>>> without whitespace or visual separators. >>> >>> So '+' is retained if it's internal? Why? > > > It's true that as the text reads now, we only strip a > > leading "+". I'm not aware that there is any issue with an internal > > "+". The review goes on to propose that we simply replace all the > > fancy canonicalization stuff with a simple statement that one should > > "Take the original string and remove any characters that do not > > conform to the above format." This isn't really that far from what we > > recommend, except for cases where you are converting from a dial > > string or similar operation - which basically is a case where, as the > > review says, you "tweak that trext for any cases that need to add > > characters," as you typically just prepend characters when converting > > from a dial string (though you may add some first, depends on the > > string). > > >>> Move commentary about the algorithm -- such as "these will appear..."=20 >>>-- >>> to be outside of the algorithm specification. >>> >>>> Next, an implementation must assess if the number string is a >>>> valid, globally-routable number with a leading country code. If >>> >>> How are they to do this? > >{{ No response from Jon. }} > > >>>> not, implementations SHOULD convert the number into E.164=20 >>>>format, >>>> adding a country code if necessary; this may involve=20 >>>>transforming >>>> the number from a dial string (see [RFC3966]), removing any >>> >>> So, again, this isn't really a specification. Language like 'may >>> involve' makes this commentary. >>> >>> >>>> national or international dialing prefixes or performing similar >>>> procedures. It is only in the case that an implementation=20 >>>>cannot >>>> determine how to convert the number to a globally-routable=20 >>>>format >>> >>> Again, this kind of language is not really a specification. > > > 7.2 Here the review pushes back more strongly than previously on the > > whole idea of using steps to describe behavior. The review redas, > > "the algorithm should be specified in the form of an algorithm, > > rather than as normative prose," and goes on reading the steps to > > add, "again, this isn't really a specification," "this kind of > > language is not really a specification," and then "the above text > > also is not a specification." But in other places, the review seems > > to acknowledge that these steps do describe an algorithm, and it > > merely suggests moving "commentary about the algorithm -- such as > > 'these will appear...' to be outside of the algorithm specification." > > > One of the symptoms of being "commentary" instead of specification is > > language like "may involve," apparently. The spec here has a > > normative statement about transforming the number into an E.164 > > format, which, a separate clause reads, "may involve transforming the > > number from a dial string (see RFC3966)" or various other formats. > > The spec text here is a true and useful statement: the number may be > > a dial string (per RFC3966) and may need to be transformed into E.164 > > format. It won't always, or even usually (commonly!) be true that you > > need to do that, but you might. Listing this in the step is useful. > > Whatever prohibition the reviewer imagines that divides "commentary" > > from "specification" in this fashion would be an onerous and > > counterproductive constraint on IETF specifications. It is probably a > > good warning though that "language like "except only" encourages > > coding errors." > >(I've left Jon's entire comment -- including it's context-setting text=20 >-- to show that he covers multiple review comment entries. The placing=20 >here is for what I think is the last of the set.) > > >>> >>>> that this step may be skipped. This will be the case, for >>>> example, for nationally-specific service numbers (e.g. 911,=20 >>>>112); >>>> however, the routing procedures associated with those numbers=20 >>>>will >>>> likely make sure that the verification service understands the >>>> context of their use. >>>> >>>> Other transformations during canonicalization MAY be made in >>>> accordance with specific policies used within a local domain. =20 >>>>For >>>> example, one domain may only use local number formatting and=20 >>>>need >>>> to convert all To/From user portions to E.164 by prepending >>> >>> And the above text also is not a specification. It also isn't >>> interoperable. It says "the folks encoding the strings will do=20 >>>whatever >>> local stuff they feel like and the folks at the verification side won't >>> know what it was and won't be able to replicate it. So=20 >>>canonicalization >>> won't be a standard, global service. > > > It is true that we acknowledge it will be > > possible for different entities to canonicalize numbers different > > ways. This will happen in cases with private numbering plans, various > > strange nationally-specific numbers (like emergency service numbers), > > and some other corner cases. It is just our assessment that these > > will not be vectors for enabling impersonation of calling party > > numbers, and that they will be rare (as in, not "common") enough that > > it won't impact operations significantly. Overwhelmingly, networks > > will carry numbers in E.164 format, and the canonicalization pass > > will be very light and straightforward. Our confidence in that > > operational reality is the basis for the mechanism that we propose. > > It has been scrutinized by, well, the people that actually operate > > these systems. Also, because of "canon," the two networks will at > > least be able to spot debugging errors here. > >This guarantees non-interoperability, since the verifying entity won't=20 >know what to do to produce the same result. > > >>> The alternative model, is that 'local policy' will be the same for both >>> ends, in which case, the spec is saying that there might be >>> canonicalizations that are outside the specifications. But in that >>> case, text referring to it is distracting rather than helpful. >>> >>> If a local environment is doing 'local policy' then it will document >>> that separately. There is no utility in making vague statements about >>> possibilities that are outside the spec. > >{{ No response from Jon. }} > > >>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>18] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> country-code and region code digits; another domain might prefix >>>> usernames with trunk-routing codes and need to remove the=20 >>>>prefix. >>>> This specification cannot anticipate all of the potential >>>> transformations that might be useful. >>>> >>>> The resulting canonical number string will be used as input to=20 >>>>the >>>> hash calculation during signing and verifying processes. >>>> >>>> The ABNF of this number string is: >>>> >>>> tn-spec =3D [ "#" / "*" ] 1*DIGIT >>> >>> I suspect that the entire topic of canonicalization merely needs core >>> text that says somethg like: >>> >>> Take the original string and remove any characters that do not >>> conform to the above format. >>> >>> Then tweak that text for any cases that need to add characters. > >{{ No response from Jon. }} > > >>> >>>> >>>> If the result of this procedure forms a complete telephone number, >>> >>> What is the definition of a 'complete tn'? Cite it. > > > Um, > > we'll fix that as "E.164", though probably the ref here is to > > RFC3966. > > >>> >>>> that number is used for the purpose of creating and signing the >>> >>> for the purpose of creating and signing -> for creating >>> >>> I suspect it is /not/ used "for signing" but is in fact used to create >>> part of the content that is signed. That's different. > > > That's correct. I'm willing to ditch "and signing". > > >>> >>>> signed-identity-string by both the authentication service and >>>> verification service. Practically, entities that perform the >>>> authentication service role will sometimes alter the telephone >>>> numbers that appear in the To and From header field values, >>>> converting them to this format (though note this is not a function >>>> that [RFC3261] permits proxy servers to perform). The result of=20 >>>>the >>>> canonicalization process of the From header field value may also be >>>> recorded through the use of the "canon" parameter of the=20 >>>>Identity(see >>>> Section 8). >>> >>> Why is this significant? How does it affect processing? > > > It is significant > > because canon helps to debug operational errors that arise from > > canonicalization problems. > > >>>> >>>> If the result of the canonicalization of the From header field=20 >>>>value >>>> does not form a complete and valid telephone number, the >>>> authentication service and/or verification service SHOULD treat the >>>> entire URI as a SIP URI, and apply the procedures in Section 7.4. >>> >>> Here, having a SHOULD rather than a MUST seems likely to produce >>> non-interoperability, since signer and validator are allowed to behave >>> differently, thereby making it likely they will produce different=20 >>>results. > > > Again, we don't think there is a practical > > problem here. In cases where any form of meaningful inter-network > > interoperability is possible, different sides of the call path will > > arrive at the same decisions here, and in cases where they can't > > agree on what a number is, they probably can't meaningfully even > > route calls to each other, let alone sign calling party information. > >The response seems to be saying that choice of normative language=20 >doesn't matter here because there will be private agreements to cover=20 >it. In that case, remove the text from here, or include text that=20 >explicitly says the issue will be covered outside of the specification.=20 >(I don't think that's actually viable, in this case, for a public,=20 >interoperable protocols specification done in the IETF, but what the=20 >heck...) > > >>>> >>>> 7.3. Authority for Domain Names >>> >>> Authority for domain names comes from ICANN. Unfortunately, I'm not >>> clear enough about the specific purpose of this section, but it needs a >>> title that is more specific and clear. > > > The title obviously mirrors the title of 7.1, "Authority for > > Telephone Names," and both refer to the authority that credentials > > provide over the respective identifiers. Ultimately, we could say > > that this authority devolves from ICANN, in the domain name case, and > > trickles down through the TLD operators to the owners of second level > > domains who go get credentials from certificate authorities today. So > > actually, I'm not sure the subject of this section is so divorced > > from the reviewer's reading as he supposes. > > > > >> It appears that this section is both trying to give background about > >> various occurrences of domain names and (redundantly?) discuss the > >> challenges of finding the right caller-id string. This suggests > >> splitting the discussion to an earlier, non-normative section, and a > >> section here that simply specifies technical detail to perform. > > > 7.3 The review here proposes for this section "splitting the > > discussion to an earlier, non-normative section, and a section here > > that simply specifies technical detail to perform." Sounds like that > > would take some work, but the benefit of that split would be unclear. > >focus. clarity. > > >>>> When a verifier processes a request containing an Identity-Info >>>> header with a domain signature, it must compare the domain portion= =20 >>>>of >>> >>> must or MUST? > >{{ No response from Jon. }} > > >>> >>>> the URI in the From header field of the request with the domain=20 >>>>name >>>> that is the subject of the credential acquired from the "info" >>>> parameter. While it might seem that this should be a=20 >>>>straightforward >>>> process, it is complicated by two deployment realities. In the=20 >>>>first >>>> place, credentials have varying ways of describing their subjects, >>>> and may indeed have multiple subjects, especially in 'virtual >>>> hosting' cases where multiple domains are managed by a single >>>> application. Secondly, some SIP services may delegate SIP=20 >>>>functions >>>> to a subordinate domain and utilize the procedures in RFC 3263 >>>> [RFC3263] that allow requests for, say, 'example.com' to be routed= =20 >>>>to >>>> 'sip.example.com'. As a result, a user with the AoR >>>> 'sip:jon@example.com' may process requests through a host like >>>> 'sip.example.com', and it may be that latter host that acts as an >>>> authentication service. >>>> >>> >>> But since credentials are a modularized construct, outside of this >>> specification, why is this specification going into this sort of detail >>> about them? > > > The answer is that the > > spec text this highlights talks not about credentials, but about the > > way that SIP servers use identifiers, and how domain names are > > encoded within SIP URIs in particular. The discussion that this > > comment follows is about name subordination in SIP, not in > > credentials. It is necessary to give some SIP guidance related to > > name subordination as it may have implications for the use of > > credentials and the scope of authority that would not otherwise be > > obvious. The review goes to reiterate that "I suspect all of the > > above detail is out of scope, given the way these specifications have > > been partitioned," but the relevance of the discussion of NAPTR and > > SRV processing to the domain names attested by credentials is pretty > > obvious, I think. > > >>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>19] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> To meet the second of these problems, a domain that deploys an >>>> authentication service on a subordinate host MUST be willing to >>>> supply that host with the private keying material associated with a >>>> credential whose subject is a domain name that corresponds to the >>>> domain portion of the AoRs that the domain distributes to users. >>>> Note that this corresponds to the comparable case of routing=20 >>>>inbound >>>> SIP requests to a domain. When the NAPTR and SRV procedures of RFC >>>> 3263 are used to direct requests to a domain name other than the >>>> domain in the original Request-URI (e.g., for=20 >>>>'sip:jon@example.com', >>>> the corresponding SRV records point to the service >>>> 'sip1.example.org'), the client expects that the certificate passed >>>> back in any TLS exchange with that host will correspond exactly=20 >>>>with >>>> the domain of the original Request-URI, not the domain name of the >>>> host. Consequently, in order to make inbound routing to such SIP >>>> services work, a domain administrator must similarly be willing to >>>> share the domain's private key with the service. This design >>>> decision was made to compensate for the insecurity of the DNS, and= =20 >>>>it >>>> makes certain potential approaches to DNS-based 'virtual hosting' >>>> unsecurable for SIP in environments where domain administrators are >>>> unwilling to share keys with hosting services. >>> >>> Really, I suspect all of the above detail is out of scope, given the=20 >>>way >>> these specifications have been partitioned. > >{{ No response from Jon. }} > > >>>> >>>> A verifier MUST evaluate the correspondence between the user's >>>> identity and the signing credential by following the procedures >>>> defined in RFC 2818 [RFC2818], Section 3.1. While RFC 2818=20 >>>>[RFC2818] >>>> deals with the use of HTTP in TLS and is specific to certificates, >>>> the procedures described are applicable to verifying identity if=20 >>>>one >>>> substitutes the "hostname of the server" in HTTP for the domain >>>> portion of the user's identity in the From header field of a SIP >>>> request with an Identity header. >>> >>> What does 'must evaluate' mean? What specific 'evaluation' actions are >>> being required? And actions are to be taken in response to the=20 >>>evaluation? > > > The end of > > the spec sentence here says, inevitably, "by following the procedures > > defined in RFC 2818 [RFC2818], Section 3.1." So presumably the > > "evaluation" actions described there are the ones that the verifier > > takes in this case. That section also gives the "actions are to be > > taken in response to the evaluation". Again, extending a document the > > courtesy of reading the entire sentence is usually a good idea when > > writing a review of this kind. [$] > >Oh boy. > >The cited section refers to values with very specific names, which don't=20 >match parameter/value names in the current document. So the reference=20 >to using the procedures of Section 3.1 permits an approximation at best. > >In addition, Section 3.1 uses the term 'matching', not 'evaluating',=20 >which is a more precise and appropriate semantic. > >Next, Section 3.1 actually pints to RFC2459 for the meat of the work,=20 >which raises the question of why the current spec doesn't simply point=20 >to RFC2459. > >Lastly, I thought that the history of domain name matching with certs=20 >has shown far too much rigidity about the domain string and that there=20 >has recently been quite a bit of work to permit matching in the face of=20 >valid variations. Why isn't that recent work incorporated here? > > >>>> 7.4. URI Normalization >>> >>> Canonicalization for phone numbers and Normalization for URI. Why the >>> difference? > >{{ No response from Jon. }} > > >>> >>>> Just as telephone numbers may undergo a number of syntactic >>>> transformation during transit, the same can happen to SIP and SIPS >>> >>> transformation -> transformations > >{{ No response from Jon. }} > > >>> >>>> URIs without telephone numbers as they traverse certain >>>> intermediaries. Therefore, when generating a PASSporT object based >>>> on a SIP request, any SIP and SIPS URIs must be transformed into a >>>> canonical form which captures the address-of-record represented by >>>> the URI before they are provisioned in PASSporT claims such as=20 >>>>"uri". >>> >>> The above text belongs in an earlier discussion of issues, so that the >>> specification section can focus on specifying. > > > This is also > > a "what doesn't belong in specs" issue, but here presented > > organizationally, as if an RFC is divided into sections about > > "specification" and then non-normative sections. Where this is coming > > from is, as usual, beyond me. The spec text in this section is the > > only place in the document that we address either the normative or > > informative dimensions of URI normalization. > > >>> >>>> The URI normalization procedures required are as follows. >>>> >>>> Following the ABNF of RFC3261, the SIP or SIPS URI in question MUST >>> >>> Which ABNF? Where in the document? Section 25.1? >>> >>> What about the ABNF requires any of what is asserted here? > > > It is true that we don't give > > the section, but the text is clear we are talking about the ABNF of > > the "SIP and SIPS URI", and the rest of the sentence specifically > > references the structure of that ABNF, including the "hostport" > > component and the remaining elements. Reading to the end of the > > sentence frequently resolves things that might appear ambiguous at > > the beginning of a sentence. The review makes it to the end of the > > sentence, actually, and locates the proper ABNF, because then the > > review complains about the use of "including" when it precedes the > > requirement to remove the uri-parameters and heads, as "By my reading > > there isn't anything other than those two rules." Given that the > > review had no difficulty locating the ABNF and the elements in > > question, why ask "What about the ABNF requires any of what is > > asserted here?" Why pretend that this was unclear or ambiguous? [$] > >ad hominem. always a pleasure. > >Especially when the review comment was about nothing more than the lack=20 >of adequate precision in the reference, by repeating that referring to=20 >an entire document does not constitute a sufficiently narrow pointer. > > >>> Again, algorithms need to be specified as algorithms, not just prose. >>> >>>> discard all elements after the "hostport" of the URI, including all >>>> uri-parameters and headers, from its ayntax. Of the userinfo >>> >>> "including"? By my reading there isn't anything other than those two >>> rules. > >{{ No response from Jon. }} > > >>> >>>> component of the SIP URI, only the user element will be retained:=20 >>>>any >>>> password (and any leading ":" before the password) MUST be removed, >>>> and since this userinfo necessarily does not contain a telephone- >>> >>> I think the algorithm intended here is: >>> >>> 1. Parse the SIP/SIPS URI >>> >>> 2. Retain if present >>> ; will not be present >>> >>> 3. Retain >>> >>> done. > > > I > > don't believe it is more clear or helpful than the spec text as > > written. > >Oh boy. > > >>> >>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>20] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> subscriber component, no further parameters can appear in the user >>>> portion. >>>> >>>> The hostport portion of the SIP or SIPS URI MUST similarly be >>>> stripped of any trailing port along with the ":" that proceeds the >>>> port, leaving only the host. >>> >>> In other words, just get > >{{ No response from Jon. }} > > >>> >>>> >>>> The ABNF of this canonical URI form (following the syntax defined=20 >>>>in >>>> RFC3261) is: >>>> >>>> canon-uri =3D ( "sip" / "sips" ) ":" user "@" host >>> >>> What is the purpose of retaining the sip/sips distinction, within this >>> context? > > > We had considered using just > > rfc822 style identifiers here, and discarding the scheme entirely. If > > present, SIPS implies something valuable actually, especially when > > the URI appears in the To header field value - it would be an > > interesting security violation if an intermediary downgraded that > > from SIPS to SIP in transit, as that has implications for the > > hop-by-hop use of TLS. That much said, this sort of intermediary > > meddling is not specifically in the scope of STIR, it is merely a > > side effect of our work, but one worth preserving. > >Every time language like "SIP or SIPS" or "SIP/SIPS" is used, there is=20 >no tailored language for one or the other. Rather there is merely=20 >repetition adding unnecessary verbosity and possible distraction. > > >>> >>>> Finally, the URI will be subject to syntax-based URI normalization >>>> procedures of [RFC3986] Section 6.2.2, especially to perform case >>> >>> Except that 6.2.2 does not actually specify normalization. Rather, it >>> talks about an approach to normalization, without giving precise=20 >>>details. > > > If there's something > > better to cite here, I'm happy to cite it. We're not going to > > reinvent the wheel. Maybe I'll ask this question more broadly. This > > text is among the newest in rfc4474bis, so it's good to have some > > eyes on it. > >When something doesn't do what is needed, it's not a case of doing=20 >'better'. It is a case of doing what is needed. Either by citation or=20 >by direct exposition. > > >>>> normalization and percent-encoding normalization. However, note=20 >>>>that >>>> normalization procedures face known challenges in some >>>> internationalized environments (see [I-D.ietf-iri-comparison]) and >>>> that perfect normalization of URIs may not be possible in those >>>> environments. >>> >>> The above last sentence reduces to: do normalization but don't rely on >>> it working. >>> >>> This again raises the question of treating a broken signature the same >>> as no signature present. > > > Indeed, there are some internationalized > > environments where we expect normalization won't help, just as there > > are some oddball telephone environments where canonicalization is > > unlikely to help. We just think that there are operational > > environments where this will all work without any problems. For the > >Within the four walls of a protocol specification, there is a kind of=20 >perfection. The protocol works where it works. Where it doesn't work,=20 >it doesn't exist. > >Referring to the places a protocol won't work properly might be useful=20 >during an opening discussion about the applicable environments for using=20 >the protocol. But that does not include in the middle of the protocol's=20 >detailed specification. > >At base, the issue here is, again, failing to treat activities that are=20 >out of scope as outside of the specification, and/or failing to move=20 >discussion of operational consideration to a /separate/ discussion of=20 >operational issues. > > > > review, though, "This again raises the question of treating a broken > > signature the same as no signature present." Here I can only point > > once again to the text of rfc4474bis-10 section 5.2, in the last > > paragraph, which states that "This specification does not propose any > > authorization policy for user agents or proxy servers to follow based > > on the presence of a valid Identity header, the presence of an > > invalid Identity header," etc. At a protocol level, we believe it is > > helpful to send a 438 when there are only invalid Identity headers in > > a message, so we make that a MUST. But for the terminating side, that > > is not a question of operational policy, that is a question of > > getting the full "canon" for debugging purposes. For the originating > > side, who is going to the trouble of signing these things in the > > first place, merely ignoring an invalid signature silently and > > proceeding as if no Identity was provided is not particularly helpful > > - they should want to know that there is a failure, be it simply some > > sort of misconfiguration or something untoward going on. > > >>> >>>> >>>> For future PASSporT applications, it may be desirable to provide an >>>> identifier without an attached protocol scheme. Future >>> >>> Discussion about future hypotheticals, again. Remove. > > > Why is this information here? Because > > we want to warn implementers about the potential for identifiers > > without protocol schemes, including rfc822 identifiers, which we > > expect might come from WebRTC interaction (like SIP -> WebRTC > > gatewaying). > >This sort of 'warning' is almost certain to have no practical effect on=20 >programmer behavior. There are well-established reasons for this, at=20 >several levels. So it's text that makes the author feel like they'd=20 >been diligent, but they haven't actually accomplished anything useful. > > >>> >>>> specifications that define PASSporT claims for SIP as a using >>>> protocol could use these basic procedures, but eliminate the scheme >>>> component. A more exact definition is left to future=20 >>>>specifications. >>> >>> Exactly. >>> >>> >>>> >>>> 8. Header Syntax >>> >>> >>> I'm quite confused. This section appears to be simultaneously >>> specifying a SIP Identity header field as well as how to populate an >>> associate Passort entity. > > > Since constructing a > > PASSporT entity is a step in constructing the SIP Identity header, > > this is not such a confusing matter to me. But I'll take this as yet > > another organizational suggestion that there should be a subsection > > or what have you to contain the PASSporT-related text. It's not an > > awful idea, but nor would it solve any particular problem. > > Hypothetical changes like this are unlikely to have any impact on > > implementation. > > >>>> The Identity and Identity-Info headers that were previously defined >>> >>> header *field* >>> >>> >>>> in RFC4474 are deprecated. >>> >>> Reference to the previous 4474 content is unproductive and distracting. >>> Remove all of it. This is a new specification. >>> >>> It is not revising an installed base. So this section should merely >>> define what it defines and not put it in terms of the earlier document. > > > The > > idea that a bis of an existing RFC should not reference that RFC is > > pretty removed from my experience at the IETF. The review instead > > proposes that "this section should merely define what it defines and > > not put it in terms of the earlier document." I don't think the text > > here actually does put anything "in terms of the earlier document," > > it just has a one-paragraph introductory warning that this header > > syntax is revising an existing bit of grammar. > >The issue isn't 'reference' but rather concerns the distraction of=20 >'discussion' and of auditing the differences. > >As for IETF experience with bis documents, the ones I've seen over the=20 >years were for documents that had a significant installed base. The RFC=20 >in question here doesn't fit that model. > > >>> >>>> This revised specification collapses the >>>> grammar of Identity-Info into the Identity header via the "info" >>>> parameter. Note that unlike the prior specification in RFC4474,=20 >>>>the >>>> Identity header is now allowed to appear more than one time in a=20 >>>>SIP >>>> request. The revised grammar for the Identity header is (following >>>> the ABNF [RFC4234] in RFC 3261 [RFC3261]): >>>> >>>> Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-in= fo >>>> *( SEMI ident-info-params ) >>>> signed-identity-digest =3D LDQUOT *base64-char RDQUOT >>>> ident-info =3D "info" EQUAL ident-info-uri >>>> ident-info-uri =3D LAQUOT absoluteURI RAQUOT >>>> ident-info-params =3D ident-info-alg / ident-type / canonical-str / >>>> ident-info-extension >>>> ident-info-alg =3D "alg" EQUAL token >>>> ident-type =3D "ppt" EQUAL token >>>> canonical-str =3D "canon" EQUAL *base64-char >>>> ident-info-extension =3D generic-param >>>> >>>> base64-char =3D ALPHA / DIGIT / "/" / "+" >>> >>> >>> Note the use of ABNF here, rather than JSON. >>> >>> canon is optional. why doesn't the abnf show it as optional? I=20 >>>suspect >>> the issue is that the abnf needs to distinguish between mandatory and >>> optional components of the Identity header field. > >{{ No response from Jon. }} > > >>> isn't defined!!! >>> >>> isn't defined. >>> >>> LAQUOT, EQUAL, RAQUOT, absoluteURI are all undefined. Rules like these >>> are usually inherited from another document. If that's the case here, >>> cite it. >>> >>> These sorts of rules (including base-64-char, which is defined >>> syntactically but not semantically) need explicit ABNF rules with their >>> names and then need prose text to explain their semantics. > >{{ No response from Jon. }} > > > > The fact that before the > > ABNF of the header there is a clear statement that this is "following > > the ABNF [RFC4234] in RFC 3261 [RFC3261]", which defines all of those > > elements, is clearly lost on the reviewer. [$] > >Yes it was. For one thing, it is usual when importing rules to state=20 >that rules are being important. Specifications that are especially=20 >polite explicitly list the names of rules that are imported. > >And again, citations should be as precise as possible, naming sections=20 >or sub-sections rather than entire documents. > > >>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>21] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> In addition to "info" parameter, and the "alg" parameter previously >>> >>> to -> to the >>> >>> >>>> defined in RFC4474, this specification includes the optional=20 >>>>"canon" >>>> and "ppt" parameters. Note that in RFC4474, the signed-identity- >>>> digest (see ABNF above) was given as quoted 32LHEX, whereas here it >>>> is given as a quoted sequence of base64-char. > >Hmm. I'd missed the extraneous reference to RFC4474 here. It should be=20 >removed. > > >>>> The 'absoluteURI' portion of ident-info-uri MUST contain a URI; see >>>> Section 6.3 for more on choosing how to advertise credentials=20 >>>>through >>>> this parameter. >>>> >>>> The signed-identity-digest is the signed hash component of a=20 >>>>PASSporT >>>> object [I-D.ietf-stir-passport], a signature which PASSporT=20 >>>>generates >>> >>> That document does not contain the string "signed hash". The word >>> 'hash' only appears in 3.2.2.2 "mky". Worse, that section really does >>> not specify its contents. Rather -- yet again -- we get discussion >>> about purpose and possibility. >>> >>> Specific reference to a specific value that can be interoperably >>> generated is needed. > > > That's true. There was a relatively lengthy > > exchange on the list about the need for increased specificity (and > > examples) of exactly what component of the PASSporT object goes into > > the signed-identity-digest. So this was on our hit list to fix here > > already. But just because you weren't the first one to be right about > > this doesn't mean that it isn't a valid point that we need to fix. > > You are quite correct that "Specific reference to a specific value > > that can be interoperably generated is needed." > >>> >>>> over a pair of JSON objects. The first PASSporT object contains >>> >>> What is meant by "the first passport object"? Where is there >>> specification of multiple of them and how is their ordering determined? > > > Of course, this > > interrupts a sentence, and the remainder of the sentence reads, "the > > first PASSporT object contains header information, and the second > > contains claims, following the conventions of JWT [RFC7519]." Have I > > mentioned that the questions that might occur to us about the first > > few words of a sentence are often resolved by the remainder of it? > >You have. It's a shame that such mentions were mostly wrong, by my=20 >original and continued reading of the text... > >There is nothing in the draft text that specifies in clear and simple=20 >terms what or where this 'first' object is, nor the 'second'. > > > > After reading the rest of the sentence, the review then continues, > > "I've gone back and looked at the Passport references to "object" and > > do not see any clear indication that there are two, in the style > > being summarized here." Obviously, "object" is the "O" in "JSON," and > > indeed the JWT specification refers (for example) in Section 3 to how > > "JWTs represent a set of claims as a JSON object", which is combined > > with a JOSE header (a separate JSON object, as 3.1 makes clear by > > referring to it as "the JSON object above") - in other words, one > > might say they are two objects. > >How the heck is the reader to have guessed all this, nevermind be sure=20 >that that their guess was correct? > > > > > While the review objects that "I've gone back and looked at the > > Passport references to 'object'", what the spec text here says is > > "following the conventions of JWT [RFC7519]," not PASSporT. The > >JWT is inherited through Passport. It has no life in this specification=20 >except through passport. Or at least, it's not supposed to. > > > > reviewer would have found the answer to this question by actually > > looking where the text suggested, but the reviewer seems defiant > > about looking there: "I naturally assume that some portion of this is > > inherited from JSON and/or JWT, which is a nice example of the > > significant, additional overhead being being introduced with their > > use. And in this case, apparently confusion." There is no need to > > make any assumption here, the spec actually instructed you to refer > > to JWT. The notion that there is anything to be confused about here > > is a bunch of smoke and mirrors. [$] > >And of course, a series of indirections through multiple specifications=20 >is no risk of confusing any other reader, except one who is defiant, in=20 >spite of their explicitly iting efforts to follow those pointers,=20 >including the ones being noted in the reply, as noted just a bit further=20 >in the review comments... > >>> >>>> header information, and the second contains claims, following the >>>> conventions of JWT [RFC7519]; some header and claim values will >>>> mirror elements of the SIP request. Once these two JSON objects=20 >>>>have >>> >>> I've gone back and looked at the Passport references to "object" and do >>> not see any clear indication that there are two, in the style being >>> summarized here. Note that Passport's Section 3.1 does not say >>> "object". Nor does the next section, 3.2. Yet, apparently, both=20 >>>should. > >Again: For all of the sturm und drang, the text says 'passport object'=20 >and the passport spec has no such terminology. > > >>> But matters appear to be more confusing than that, in the Passport >>> document, such as Section 3.2.2.1, which is titled 'claims' but makes >>> references to objects. >>> >>> I naturally assume that some portion of this is inherited from JSON >>> and/or JWT, which is a nice example of the significant, additional >>> overhead being being introduced with their use. And in this case, >>> apparently confusion. > >{{ No response from Jon. }} > > >>> >>>> been generated, they will be encoded, then hashed with a SHA-256 >>>> hash. Those two hashes are then concatenated (header then claims) >>>> into a string separated by a single "." per baseline PASSporT. >>>> Finally, that string is signed to generate the=20 >>>>signed-identity-digest >>>> value of the Identity header. >>> >>> Another algorithm needing to be specified as an algorithm. >>> >>>> >>>> For SIP implementations to populate the PASSporT header object=20 >>>>from a >>>> SIP request, the following elements message MUST be placed as the >>> >>> placed where? > >> >>> Or is this really a straight data copy from the JSON form to parameters >>> in the SIP Identity header field? > >> >>>> values corresponding to the designated JSON keys: >>> >>> Delete the opening clause. > > > 8 When the spec tries to blurt out "the following elements message > > MUST be placed as the" the review interjects "placed where?" If we > > let the spec continues, it says, "placed as the values corresponding > > to the designated JSON keys." There is no change required as a result > > of this hasty review comment. The review then asks us to "Delete the > > opening clause," presumably referring to the entire sentence. Why > >Yeah, because 'clause' is often used when 'sentence' is what is meant? > > > > this sentence could possibly be a source of confusion or harm to the > > reader is absolutely beyond me. [$] > >(context-setting retained.) > >(is anyone else as amused as I am by the idea that anyone would suggest=20 >that anything about my review process was 'hasty'?) > >I'm really sorry it's beyond the editor, but: > > "the following elements message MUST be placed as the values=20 >corresponding to the designated JSON keys:" > >does not make any obvious sense to me, and lacks clear specification=20 >information for resolving what is being referenced. > > > >>>> First, per baseline [I-D.ietf-stir-passport], the JSON key "typ" >>>> key MUST have the value "passport". >>> >>> This appears to be introducing a redundancy between this spec and the >>> Passport spec. There needs to be language in one that merely cites the >>> other, rather than respecifying it. > > > > It is true, this is effectively reiterating > > the guidance of stir-passport. I don't however think this introduces > > any practical problem. > >sigh. > > >>>> Second, the JSON key "alg" MUST mirror the value of the optional >>>> "alg" parameter in the SIP Identity header. Note if the "alg" >>>> parameter is absent, the default value is "ES256". >>>> >>>> Third, the JSON key "x5u" MUST have a value equivalent to the >>>> quoted URI in the "info" parameter. >>>> >>>> Fourth, the optional JSON key "ppt", if present, MUST have a=20 >>>>value >>>> equivalent to the quoted value of the "ppt" parameter of the >>>> Identity header. If the "ppt" parameter is absent from the >>>> header, the "ppt" key MUST NOT not appear in the JSON heaer >>>> object. >>> >>> All of these 'must' formations are overkill. Normally, algorithms are >>> specified in a simple, declarative manner. > > > > 8 Once again the review here is concerned about "another algorithm > > needing to be specified as an algorithm"," where "all of these 'must' > > formations are overkill. Normally, algorithms are specified in a > > simple, declarative manner." I don't believe the division of an > > operation into steps containing normative MUSTs is an outlier in IETF > > specifications. > >(Again, Jon's context-setting retained, since the response cover's=20 >multiple of my review comments.) > > > >>> >>>> For example: >>>> >>>> { "typ":"passport", >>>> "alg":"ES256", >>>> "x5u":"https://www.example.com/cert.pkx" } >>> >>> What is this example demonstrating? How is the reader to know? > > > Given that it is an example of a header > > object containing the three mandatory JSON keys with values that were > > just described in the algorithm above, the reader would presumably > > know what this is an example of by virtue of having just read the > > words directly above it in the specification. The example is an > > example of how the PASSporT header object would look. It > > demonstrates... how the PASSporT header object would look. What is > > this review comment asking? How is the target of the review to know? > > Who could possibly think asking this question is a meaningful > > contribution to our standards process and that it requires the > > attention of the document authors or the working group? > >oh. so the goal is merely to show the reader what the appearance will=20 >be? no concern for maybe, you know, explaining the substance of the=20 >example? > > >>> >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>22] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> To populate the PASSporT claims JSON object from a SIP request, the >>>> following elements MUST be placed as values corresponding to the >>>> designated JSON keys: >>>> >>>> First, the JSON "orig" array MUST be populated. If the >>>> originating identity is a telephone number, then the array MUST= =20 >>>>be >>>> populated with a "tn" claim with a value set to the value of the >>>> quoted originating identity, a canonicalized telephone number=20 >>>>(see >>>> Section 7.2). Otherwise, the array MUST be populated with a=20 >>>>"uri" >>>> claim, set to the value of the AoR of the UA sending the message >>>> as taken from addr-spec of the From header field, per the >>>> procedures in Section 7.4. >>> >>> Again, this appears to be quite a bit of detail that is redundant with >>> specifications elsewhere. > > > Actually the "detail" > > here consists of one sentence about telephone numbers and one about > > URIs, the former of which contains a pointer to the telephone number > > section (7.2) and the latter of which contains a pointer to the URI > > section (7.4). There is no organizational or redundancy problem > > here. > > >>> >>>> >>>> Second, the JSON "dest" array MUST be populated. If the >>>> destination identity is a telephone number, then the array MUST= =20 >>>>be >>>> populated with a "tn" claim with a value set to the value of the >>>> quoted destination identity, a canonicalized telephone number=20 >>>>(see >>>> Section 7.2). Otherwise, the array MUST be populated with a=20 >>>>"uri" >>>> claim, set to the value of the addr-spec component of the To >>>> header field, which is the AoR to which the request is being=20 >>>>sent, >>>> per the procedures in Section 7.4. >>>> >>>> Third, the JSON key "iat" MUST appear, set to the value of a >>>> quoted encoding of the value of the SIP Date header field as a >>>> JSON NumericDate (as UNIX time, per [RFC7519] Section 2). >>>> >>>> Fourth, if the request contains an SDP message body, and if that >>>> SDP contains one or more "a=3Dfingerprint" attributes, then the= =20 >>>>JSON >>>> key "mky" MUST appear with the algorithm(s) and value(s) of the >>>> fingerprint attributes (if they differ), following the format >>>> given in [I-D.ietf-stir-passport] Section 3.2.2.2. >>>> >>>> For example: >>>> >>>> { "orig":{"tn":"12155551212"}, >>>> "dest":{"tn":"12155551213"}, >>>> "iat":"1443208345" } >>>> >>>> For more information on the security properties of these SIP=20 >>>>message >>> >>> 'more'? is there security information here? where? > > > If we were feeling generous, we might read the original text > > as "for more information, information on the security properties of > > these SIP message elements." I see no serious risk of this confusing > >Because readers won't see 'more' and think that it normally is a=20 >connector to related, /preceding/ material? > >Drop the 'more', and the sentence is fine. > > > > readers and implementers. The review continues that "And since every > > RFC contains a security considerations section, a generic reference > > like this, here, is of no obvious value. It's just more text." The > > fact that the Security Considerations contains specific analysis that > > takes each of these SIP message fields and notes their security > > properties is why they warrant a mention here - as the spec says, > > when it notes that the section answers "why their inclusion mitigates > > replay attacks" for example. Reviews that ignore what the text > > actually says and instead critique a generic strawman are unlikely to > > contribute much value. > >whereas comments like the above are the hallmark of professionalism. > > >>> >>>> elements, and why their inclusion mitigates replay attacks, see >>>> Section 12 and [RFC3893]. Note that future extensions to the >>> >>> And since every RFC contains a security considerations section, a >>> generic reference like this, here, is of no obvious value. It's just >>> more text. > >{{ No response from Jon. }} > > >>> >>>> PASSporT object could introduce new claims, and that further SIP >>> >>> Future reference to hypotheticals. > > > In this case, it is to the statement > > that future extensions to PASSporT might alter the security > > properties provided by the signature by covering new information. > > This is a useful thing to note in this case, and no change should be > > made as a result of this review comment. > >Future extensions could do all sorts of things. The statement here does=20 >not affect implementation of the current spec or use of the current spec. > > >>> >>>> procedures could be required to extract further information from=20 >>>>the >>>> SIP request to populate the values of those claims; see Section 9. >>>> >>>> The "orig" and "dest" arrays may contain identifiers of=20 >>>>heterogeneous >>>> type; for example, the "orig" array might contain a "tn" claim,=20 >>>>while >>> >>> What is the import of this observation? >>> >>> Is there something in the specification that appears to constrain the >>> choices? > > > The answer is no, there isn't > > something that appears to constrain the choices, but implementers > > might be tempted to think that a call to a telephone number always > > comes from a telephone number or vice versa, and thus create code > > that would not accommodate the heterogeneous case. > >The specification of orig and dest might warrant a comment highlighting=20 >the opportunity for variety. A document discussing implementation and=20 >use might warrant some similar commentary. But there is not compelling=20 >reason for having the commentary here. > > >>> >>>> the "dest" contains a "uri" claim. Also note that in some cases,=20 >>>>the >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>23] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> "orig" and "dest" arrays might be populated with more than one=20 >>>>value. >>>> This could for example occur when multiple "dest" identities are >>>> specified in a meshed conference. Defining how a SIP=20 >>>>implementation >>>> would provision multiple originating or destination identities is >>>> left as a subject for future specification. >>>> >>>> After these two JSON objects, the header and the claims, have been >>>> constructed, they must each be hashed per [I-D.ietf-stir-passport] >>>> Section 3.3. The signed value of those concatenated hashes then >>> >>> Except that Passport Section 3.3 says nothing more than: >>> >>> The signature of the PASSporT is created as specified by JWS using >>> the private key corresponding to the X.509 public key certificate >>> referenced by the "x5u" header parameter. >>> >>> and that doesn't look like an implementable specification to me. > > > Indeed, Section 3.3 just > > defers to JWS, as the part that reads "as specified by JWS" should > > indicate. So stir-passport just passes the buck - but surely that's > > what stir-passport should do, albeit it should do so with a bit more > > precision. I won't disagree that this could be beefed up in > > stir-passport, but I think rfc4474bis should defer to the > > stir-passport text. > >Because two levels of indirection always helps reader comprehension. > >And the text here refers to hashing, not signing, which is what the=20 >passport section says it is about... > > >>> >>>> becomes the signed-identity-string of the Identity header. The >>>> hashing and signing algorithm is specified by the 'alg' parameter=20 >>>>of >>>> the Identity header and the mirrored "alg" parameter of PASSporT. >>>> This specification inherits from the PASSporT specification one=20 >>>>value >>>> for the 'alg' parameter: 'ES256', as defined in [RFC7519], which >>>> connotes an ECDSA P-256 digital signature. All implementations of >>>> this specification MUST support the required signing algorithms of >>>> PASSporT. >>>> >>>> The complete form of the Identity header will therefore look like=20 >>>>the >>>> following example: >>>> >>>> Identity: >>>> "sv5CTo05KqpSmtHt3dcEiO/1CWTSZtnG3iV+1nmurLXV/HmtyNS7Ltrg9dlxkWzo >>>> eU7d7OV8HweTTDobV3itTmgPwCFjaEmMyEI3d7SyN21yNDo2ER/Ovgtw0Lu5csIp >>>> pPqOg1uXndzHbG7mR6Rl9BnUhHufVRbp51Mn3w0gfUs=3D"; \ >>>> info=3D;alg=3DES256 >>> >>> It would be quite a bit more helpful to have a detail, incremental >>> example that shows how each of the bits are created and then assembled. > > > We plan to have a separate spec to > > do that, actually. > > >>> >>>> In a departure from JWT practice, the SIP usage of PASSporT MAY NOT >>>> include the base64 encoded version of the JSON objects in the >>> >>> JWT normally calls for including the encoded version of JSON objects in >>> the Identity header (field)? >>> >>> Really, it isn't clear what the exact exception is. If citing this is >>> that important, please make the details clear including appropriate >>> citations, such as to the relevant part of the JWT spec. > > > 8 Exactly how radical the "departure from JWT practice" at the end of > > Section 8 was a recent subject of working group discussion, in light > > of varying interpretations of the JWS RFC (especially Appendix F on > > "Detatched Content"). Here the review is of course correct when it > > points out the unlikelihood that "JWT normally calls for including > > the encoded version of JSON objects in the Identity header (field)?" > > Our interpretation of JWT and JWS was much of what we discussed at > > the last meeting, and we expect that stir-passport will be crisper on > > this point. There may be some rfc4474bis text that falls out from > > that, we'll see. > > >>> >>>> Identity header: only the signature component of the PASSporT is >>>> REQUIRED. Optionally, as a debugging measure or optimization, the >>>> base64 encoded concatenation of the JSON header and claims may be >>>> included as the value of a "canon" parameter of the Identity=20 >>>>header. >>>> Note that this may be lengthy string. >>>> >>>> 9. Extensibility >>>> >>>> For the extensibility of baseline PASSporT with now claims, see >>>> [I-D.ietf-stir-passport] Section 4. >>> >>> "with now claims"? > >{{ No response from Jon. }} > > >>> And what is the benefit of having this directive? > > > the beginning of > > Section 9 gamely notes that the extensibility of PASSporT object is > > covered in Section 4 of stir-passport. The benefit of having this > > directive is that it directs you to the place where extensibility of > > PASSporT objects is covered. > >So the idea motivating the text here is that a reader having a question=20 >about extensibility of passport won't naturally think of looking at the=20 >passport spec? > > >>>> >>>> As future requirements may warrant increasing the scope of the >>>> Identity mechanism, this specification defines an optional "ppt" >>>> parameter of the Identity header, which mirrors the "ppt" header=20 >>>>key >>> >>> The term 'header key' does not occur in the Passport specifiction. >>> Perhaps this is meant to refer to that doc's section 4.1 header=20 >>>parameter? > >{{ No response from Jon. }} > > >>> >>>> in PASSporT. The "ppt" parameter value MUST consist of a token >>>> containing an extension specification, which denotes an extended=20 >>>>set >>>> of one or more signed claims per the type extensibility mechanism >>>> specified in [I-D.ietf-stir-passport]. >>> >>> So they will only be able to use one extension? >>> >>> Also, what is the utility of having this information in the SIP=20 >>>Identity >>> header field? > > > the latter presumably is asking why have "ppt" > > as a parameter of Identity rather than just reading it from the JOSE > > header of the PASSporT object. The answer to the second is that it is > > necessary for verification services, as in the absence of "canon," > > that is the only indication present that an extension is in use (and > > "canon", per the last paragraph here, is required only if the new > > claims cover elements not in the SIP request). Even when "canon" does > > appear, it is also a nice processing optimization, as the verifier > > only needs to read this parameter to know whether or not the header > > is supported, it doesn't have to crack the object open. To the first > > question: yes, we are currently thinking that each Identity header > > will contain a PASSporT object with at most one extension. This is > > mostly to keep it simple here at the start. We have played around > > with a few alternative models, but this is the one that stuck. > >The text here contains normative language about ppt here, rather than=20 >where ppt is specified. > >Neither of the already-asked questions were answered. The 'presumably'=20 >interpretation is incorrect. The point behind the second question is=20 >that I had not understand that ppt is a way of invoking a pre-registered=20 >configuration profile for STIR (or is it for Passport)? > >I also don't see an IANA registered section for the needed ppt registry. > > > >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>24] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> An authentication service cannot assume that verifiers will >>>> understand any given extension. Verifiers that do support an >>>> extension may then trigger appropriate application-level behavior=20 >>>>in >>>> the presence of an extension; authors of extensions should provide >>>> appropriate extension-specific guidance to application developers=20 >>>>on >>>> this point. >>> >>> This is likely redundant information. > > > This calls out a block of informative text in > > a section dedicated to extensibility, that, although reflected in the > > normative behavior of the authentication and verification services in > > Section 5, nonetheless merits a reminder. > > >>> >>>> >>>> If any claim in an extension contains a JSON value that does not >>>> correspond to any field of the SIP request, but then the optional >>>> "canon" parameter MUST be used for the Identity header containing >>>> that extension. >>> >>> If...but then appears to be a non-sequitor or incompletely=20 >>>formulated >>> sentence. > >{{ No response from Jon. }} > > >>> >>>> >>>> 10. Backwards Compatibililty with RFC4474 >>> >>> Delete this section. > > > It is a bit hard > > to see that argument in light of the fact that the Identity header, > > the associated response codes, the concepts of the authentication and > > verification service, and many other related elements were present in > > RFC4474. > >Consider efficacy. No one benefits from the discussion of the previous=20 >document, because it has no installed operational base. > > >>> >>>> This specification introduces several significant changes from the >>>> RFC4474 version of the Identity header. However, due to the=20 >>>>problems >>>> enumerated in [I-D.rosenberg-sip-rfc4474-concerns], it is not >>>> believed that the original Identity header has seen any deployment, >>>> or even implementation in deployed products. >>>> >>>> As such, this mechanism contains no provisions for signatures >>>> generated with this specification to work with RFC4474-compliant >>>> implementations, nor any related backwards-compatibility=20 >>>>provisions. >>>> Hypothetically, were an RFC4474-compliant implementation to receive >>>> messages containing this revised version of the Identity header, it >>>> would likely fail the request due to the absence of an=20 >>>>Identity-Info >>>> header with a 436 response code. Implementations of this >>>> specification, for debugging purposes, might interpret a 436 with a >>>> reason phrase of "Bad Identity-Info" as an indication that the >>>> request has failed because it reached a (hypothetical) >>>> RFC4474-compliant verification service. >>> >>> In fact there is so little overlap of substantive text, this really is >>> an entirely new document and not a bis. > >{{ No response from Jon. }} > > >>> >>>> 11. Privacy Considerations >>>> >>>> The purpose of this mechanism is to provide a strong identification >>> >>> I think the usual terms are 'strong authentication' or 'strong=20 >>>security' >>> (though 'security' has no clear technical meaning.) 'Strong >>> identification' appears to have no common meaning. > > > I think it has a > > common meaning of being a strong identification of the originator. > > This isn't a term of art. > >Correct. But while a word like 'strong' is likely to evokes useful=20 >marketing emotion, it is unlikely to have a technical meaning that is=20 >clear and consistent across readers. This being a specification rather=20 >than a sales brochure, such effects should be concerning. > > >>>> of the originator of a SIP request, specifically a cryptographic >>>> assurance that an authority asserts the originator can claim the=20 >>>>URI >>>> given in the From header field. This URI may contain a variety of >>>> personally identifying information, including the name of a human >>>> being, their place of work or service provider, and possibly=20 >>>>further >>>> details. The intrinsic privacy risks associated with that URI are, >>>> however, no different from those of baseline SIP. Per the guidance >>>> in [RFC6973], implementers should make users aware of the privacy >>>> trade-off of providing secure identity. >>>> >>>> The identity mechanism presented in this document is compatible=20 >>>>with >>>> the standard SIP practices for privacy described in [RFC3323]. A=20 >>>>SIP >>>> proxy server can act both as a privacy service and as an >>> >>> I think that I don't know what it means to be a 'privacy service'. =20 >>>What >>> functionality does this reference here and how is the reader to know? > > > Perhaps by looking at the prior sentence, which refers to "the > > standard SIP practices for privacy described in [RFC3323]". The > > abstract of that specification indicates that it is where a "privacy > > service" is defined. It is not a stretch to expect that an interested > > reader would make this deduction. [$] > >Except that a term like "a privacy service" surprisingly is read as=20 >referring to, well, you know. A service. A thing that provides=20 >service. It does not refer to some practices within some other service. > >The term is introduced without explanation and with an intuitive, and a=20 >denotational, meaning that is simply wrong. > > >>> >>>> >>>> >>>> >>>> Peterson, et al. Expires January 8, 2017 [Page=20 >>>>25] >>>> >>>> >>>> Internet-Draft SIP Identity July=20 >>>>2016 >>>> >>>> >>>> authentication service. Since a user agent can provide any From >>>> header field value that the authentication service is willing to >>>> authorize, there is no reason why private SIP URIs that contain >>>> legitimate domains (e.g., sip:anonymous@example.com) cannot be=20 >>>>signed >>> >>> This sentence sounds as if it is signaling an important point, but the >>> text does not make clear what that import is. My guess is that it=20 >>>needs >>> to be preceded by a sentence that explains what problem the reader=20 >>>might >>> think exists. Then this text explains that it doesn't. > > > The preceding sentence notes that a certain type of SIP intermediary, > > a proxy server, can act as both an authentication service and a > > privacy service. The preceding paragraph gave some indication of the > > nature of the personal information that might be revealed by the > > identity asserted in a SIP request, which could include "the name of > > a human being, their place of work or service provider, and possibly > > further details." So we've established that there is a certain > > tension between optimizing for privacy and asserting identity. So, > > when the current sentence explains that private SIP URIs could be > > signed by an authentication service, it is perhaps saying something > > counterintuitive. I'm not sure this is an important point, so much as > > perhaps a non-obvious one. I think its import is obvious, despite the > > reviewer's bafflement. > >Having re-read the original text a few times and the response here a few=20 >times, I will unfortunately have to say that none of it accomplishes the=20 >apparent goal. That is, I'm not understanding the issue being addressed=20 >nor the meaning of what is intended to address it. > >Again, I'm sure no one else will suffer this comprehension failure. > > > >>>> by an authentication service. The construction of the Identity >>>> header is the same for private URIs as it is for any other sort of >>> >>> How is that a privacy matter? > > > the review counters, perhaps questioning why > > this text appears in a section about privacy, or how it relates to > > privacy. It relates to privacy because it is making a statement about > > private URIs from RFC3323. > > >>> >>>> URIs. Similar practices could be used to support opportunistic >>>> signing of SIP requests for UA-integrated authentications services >>>> with self-signed certificates, though that is outside the scope of >>>> this specification and is left as a matter for future=20 >>>>investigation. >>>> >>>> Note, however, that even when using anonymous SIP URIs, an >>>> authentication service must possess a certificate corresponding to >>>> the host portion of the addr-spec of the From header field of the >>> >>> The 'however' does not follow any statement that it matches against. >>> Again, there's no stage that has been set, for which this resolves a >>> concern. > > > 11 The review objects to the presence of "however" in a sentence that > > will ultimately explain that you can't have a certificate associated > > with an invalid domain name like "anonymous.invalid", which is > > recommended for use in RFC3323. The "however" distinguishes that you > > can't have an authentication service sign these URIs like you can > > URIs for valid domains like "anonymous.example.com". Since the review > > requests that we cite where "anonymous.invalid" is documented, that > > would be RFC3323. Which is already cited here. As its last bit of > > wordsmithing, the review finally objects to the use of "like" in the > > construction "using domains like 'anonymous.invalid'". "how is one to > > tell what other domains are 'like it?" Well, the important property > > such domains would have is that they have invalid domain names, > > presumably (though not exclusively) in the .invalid TLD. [$] > >The response mostly makes the case for why the opening 'however' is=20 >incorrect. The word is a connector with something said immediately=20 >before, not immediately after. That is, correct: a, however b.=20 >Incorrect: however b, a. > >Again: there is no established context to which the 'however' is=20 >responding. > > >>>> request; accordingly, using domains like 'anonymous.invalid' will=20 >>>>not >>> >>> if this is actually a domain value that is used, please cite where it=20 >>>is >>> documented. For that matter, how is one to tell what other domains are >>> 'like' it? If the string isn't in actual use then why doesn't it use >>> the usual RFC choices for an example domain name? >>> >>> >>>> be possible for privacy services that also act as authentication >>>> services. The assurance offered by the usage of anonymous URIs=20 >>>>with >>>> a valid domain portion is "this is a known user in my domain that I >>>> have authenticated, but I am keeping its identity private". >>> >>> ... > > > > > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir --_002_D3E298EB1A9ECEjonpetersonneustarbiz_ Content-Type: text/plain; name="crocker-rereview-notes.txt" Content-Description: crocker-rereview-notes.txt Content-Disposition: attachment; filename="crocker-rereview-notes.txt"; size=24824; creation-date="Wed, 24 Aug 2016 07:31:39 GMT"; modification-date="Wed, 24 Aug 2016 07:31:39 GMT" Content-ID: <30968446B9613A4791018DBEA29C86B0@neustar.biz> Content-Transfer-Encoding: base64 DQpUaGlzIHJlLXJldmlldyBpZGVudGlmaWVzIGFib3V0IDQ2IHBvaW50cyBvbiB3aGljaCB0aGUg b3JpZ2luYWwgcmVzcG9uc2UgZGlkIG5vdCBhZGRyZXNzIHRoZSByZXZpZXcuIEdpdmVuIHRoYXQg dGhlIDE2MCsgaW50ZXJqZWN0aW9ucyBpbiB0aGUgb3JpZ2luYWwgcmV2aWV3IG9mdGVuIGNvbnRh aW4gbXVsdGlwbGUgY29tbWVudHMgZWFjaCwgZWFzaWx5IGFkZGluZyB1cCB0byBodW5kcmVkcyBv ZiBjb21tZW50cywgc29tZSBhbW91bnQgb2YgZXJyb3IgaGVyZSB3YXMgaW5ldml0YWJsZS4gVGhh dCB3YXMgbm8gZG91YnQgY29tcG91bmRlZCBieSBteSBhdHRlbXB0IHRvIHNvcnQgdGhlc2UgaW50 byBjYXRlZ29yaWVzIHRvIGhlbHAgaW5kaWNhdGUgdGhlIG92ZXJhbGwgY2hhcmFjdGVyIG9mIHRo ZSByZXZpZXcsIGFuZCBhbHNvIGJlY2F1c2UgSSBzb21ldGltZXMgYWRkcmVzc2VkIG11bHRpcGxl IGNvbW1lbnRzIGluIG9uZSByZXNwb25zZS4gU3RpbGwsIDQ2IHdvdWxkIGJlIHF1aXRlIGEgbnVt YmVyIHRvIGlnbm9yZS4gRnJvbSByZXZpZXdpbmcgdGhlc2UsIGhvd2V2ZXIsIEkgdGhpbmsgdGhl IGFjdHVhbCBudW1iZXIgb2YgbWlzc2luZyByZXNwb25zZXMgaXMgY2xvc2VyIHRvIDguIEZyZXNo IHJlc3BvbnNlcyB0byB0aG9zZSBhcmUgZ2l2ZW4gYmVsb3cgKHNlYXJjaCBKUCk7IG5vbmUgYXJl IGlzc3VlcyBvZiBhbnkgc2V2ZXJpdHkuIE5vIGRvdWJ0IHRoZSB3YXkgdGhhdCBJIGFnZ3JlZ2F0 ZWQgdGhlIHJlc3BvbnNlcyBkaWRuJ3QgaGVscCB0byBjb3JyZWxhdGUgdGhlc2UgYmFjayBpbnRv IGEgbGluZS1ieS1saW5lIHJldmlldy4NCg0KVGhlIHJlLXJldmlldyBhbHNvIGNvbnRhaW5zIHNv bWUgcG9pbnRzIG9mIHJlYnV0dGFsIHRvIHRoZSBvcmlnaW5hbCByZXNwb25zZSB0byB0aGUgcmV2 aWV3LiBXaGlsZSBmb3IgdGhlIG1vc3QgcGFydCwgdGhlc2UgZGlkbid0IGNvbnRhaW4gYW55IGZy ZXNoIGFyZ3VtZW50IHRoYXQgd291bGQgbWFrZSBtZSByZWNvbnNpZGVyIG15IG9yaWdpbmFsIHJl c3BvbnNlLCBJIGRvIGhhdmUgYSBmZXcgcmUtcmVzcG9uc2VzIGF0IHRoZSBlbmQgb2YgdGhpcyBk b2N1bWVudC4NCg0KLS0tLSBObyBSZXNwb25zZXMgLS0tLQ0KDQpBcyBhIGJpdCBvZiBhIHByZWNs dWRlLCB3aGVuIEkgd2FzIHdyaXRpbmcgbXkgbm90ZXMgb24gdGhlIG9yaWdpbmFsIHJldmlldywg SSBicm9rZSB0aGUgcmVzcG9uc2VzIGludG8gNCBjYXRlZ29yaWVzLiBBYm91dCBoYWxmd2F5IHRo cm91Z2gsIEkgZGVjaWRlZCB0byBjaGFuZ2UgdGhlbSBmcm9tIDEgdGhyb3VnaCA0IHRvIEEgdGhy b3VnaCBELiBJIG5ldmVyIHF1aXRlIGZvbGxvd2VkIHRocm91Z2ggb24gdGhhdCwgdGhvdWdoLCBz byB0aGUgZmlyc3Qgc2VjdGlvbiBpcyBsYWJlbGxlZCAiQSIgYW5kIHRoZSByZXN0IGFyZSBsYWJl bGxlZCAyLCAzLCBhbmQgNC4gVGhhdCBtYWtlcyBpZGVudGlmeWluZyBzZWN0aW9ucyB3aGVyZSBJ IHJlc3BvbmRlZCBhIGxpdHRsZSBoYXJkZXIgdGhhbiBpdCBzaG91bGQgYmUuIFlvdSdsbCBzZWUg YmVsb3cgY29uc3RydWN0aW9ucyBsaWtlIEEgNS4xLCBtZWFuaW5nIGxvb2sgaW4gc2VjdGlvbiBB IGFuZCBmaW5kIHRoZSBjb21tZW50cyBvbiA1LjEsIGJ1dCBhbHNvIDQgNS4xLCBmb3IgbG9vayBp bnRvIFNlY3Rpb24gNCBhbmQgZmluZCB0aGUgY29tbWVudHMgb24gNS4xLg0KDQpSZWdhcmRpbmcg dGhlIG1haW4gY29tbWVudHMgYmVmb3JlIHRoZSBsaW5lLWJ5LWxpbmUgcmV2aWV3LCBJJ2QgaGF2 ZSB0byBzYXkgSSBkaWQgcmVzcG9uZCB0byB0aG9zZSAtIEkgc2VudCBhIHN1bW1hcnkgbWFpbCB0 aGF0IGFsbHVkZXMgdG8gdGhlIHBvaW50cyBpbiB0aGUgIm1haW4gY29tbWVudHMiLCBidXQgbW9y ZSBtYXRlcmlhbGx5LCB0aGUgbWFpbiBjb21tZW50cyBkcmF3IG9uIHRoZSBkZXRhaWxlZCBwb2lu dHMgaGVyZSwgYW5kIGFkZHJlc3NpbmcgdGhlbSBuZWNlc3NhcmlseSBhZGRyZXNzZXMgdGhlIG1h aW4gY29tbWVudHMuDQoNCkxpbmUtYnktbGluZToNCg0KJ2ludGVyZG9tYWluJyBtaWdodCBzdWZm aWNlLCBidXQgSSBzdXNwZWN0IGl0J3Mgd29ydGggcHJlc3NpbmcgdGhlDQppc3N1ZSwgd2l0aCBs YW5ndWFnZSBsaWtlICJlc3BlY2lhbGx5IGFjcm9zcyB0cnVzdCBib3VuZGFyaWVzIiBvciBzb21l c3VjaC4gDQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9uLiB9fSAodHJ1ZSkNCg0KSlA6IEkgZG9u J3QgaGF2ZSBtdWNoIG9mIGFuIG9waW5pb24gZWl0aGVyIHdheS4gSSBndWVzcyBJIHRoaW5rICdp bnRlcmRvbWFpbicgc3VmZmljZXMuDQoNCg0KYWRkOiAgSGVuY2UgdGhlIGZvdW5kYXRpb24gdG8g YWNjdXJhdGUgYXV0aG9yaXphdGlvbiBpcyB2YWxpZA0KYXV0aGVudGljYXRpb24uIA0KDQp7eyBO byByZXNwb25zZSBmcm9tIEpvbi4gfX0gKHRydWUpDQoNCkpQOiBJIGFncmVlIHdpdGggdGhlIHN0 YXRlbWVudC4gSSdtIHJlbW92aW5nIHRoZSB0ZXh0IGluIHRoaXMgbmVpZ2hib3Job29kIHRob3Vn aCBkdWUgdG8gYSBkaWZmZXJlbnQgcmV2aWV3IGNvbW1lbnQuIEJ1dCBJJ2xsIHNlZSBpZiBJIGNh biBmaW5kIHNvbWV3aGVyZSBlbHNlIHRvIHN0aWNrIHRoaXMuDQoNCg0KICAgICAgICAgICJwcm92 aWRlcyBhIHN0cm9uZyBpZGVudGl0eSBzeXN0ZW0gZm9yIGRldGVjdGluZyIgY291bGQgbWVhbg0K bWFueSB0aGluZ3MsIHdoZXJlYXMgdGhlIGdvYWwgaGVyZSBpcyBxdWl0ZSBzcGVjaWZpYy4NCg0K U28gcmVwbGFjZSBpdCB3aXRoOg0KDQogICAgICAgICAgLi4uZW5hYmxlcyBhbiBhdXRoZW50aWNh dGlvbiBjYXBhYmlsaXR5IGZvciBwcm90ZWN0aW5nIGFnYWluc3QuLi4gDQoJCSAgDQp7eyBObyBy ZXNwb25zZSBmcm9tIEpvbi4gfX0JIChmYWxzZSwgdGhpcyBpcyBhZGRyZXNzZWQgaW4gQSAyKQ0K CQkgIA0KCQkgIA0KCQkgIHNlbmRlcj8gIERvZXMgdGhhdCBtZWFuIHRoZSBjYWxsZXI/ICB0aGUg Y2FsbGVyJ3MgdWE/ICB0aGUgY2FsbGVyJ3MNCm9wZXJhdG9yPyAgdGhlIHRlcm0gaXMgYW1iaWd1 b3VzLiANCg0Ke3sgTm8gcmVzcG9uc2UgZnJvbSBKb24uIH19ICh3ZWxsLCBmYWxzZSwgdGhlIGFt YmlndWl0eSBvZiAic2VuZGVyIiBpcyBhZGRyZXNzZWQgaW4gQSA1LjEpDQoNCg0Kd29ydGggYnJl YWtpbmcgdGhpcyBzZW50ZW5jZSBpbnRvIHR3bywgZm9yIGJldHRlciBjbGFyaXR5LiANCg0Ke3sg Tm8gcmVzcG9uc2UgZnJvbSBKb24uIH19IChmYWxzZSwgdGhpcyBpcyBhZGRyZXNzZWQgaW4gQSAy KQ0KDQoNCiAgIFRoZSBzaXR1YXRpb24gaXMgaG93ZXZlciBtb3JlIGNvbXBsaWNhdGVkIGZvciB0 ZWxlcGhvbmUgbnVtYmVycywNCiAgIGhvd2V2ZXIuICBBdXRob3JpdHkgb3ZlciB0ZWxlcGhvbmUg bnVtYmVycyBkb2VzIG5vdCBjb3JyZXNwb25kDQoNCiAgICAgICAgIGhvd2V2ZXIuLi5ob3dldmVy IA0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCBhbHNvIGluIEEgMikNCgkJ IA0KCQkgDQoJCSBBZ2FpbiwgaG93IGlzIGRpc2N1c3Npb24gb2YgdGhlIGludGVybmFsLCBub24t U1RJUiBhc3BlY3RzIG9mIFNJUA0Kb3BlcmF0aW9uYWxseSByZWxldmFudCBoZXJlPw0KDQp7eyBO byByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlIC0gdGhpcyB3YXMgYW5zd2VyZWQgYnkgdGhl IHByZXZpb3VzIGNvbW1lbnQgNCA0IHJlZ2FyZGluZyBUTFM7IG9uZSBtYXkgbm90IGxpa2UgdGhl IGFuc3dlciwgYnV0IGl0IHdhcyBhbnN3ZXJlZC4gVGhlICJhZ2FpbiIgaGVyZSBpcyBqdXN0IHBv c2luZyB0aGUgc2FtZSBxdWVzdGlvbi4pDQoNCg0KVGhhdCBiaXQgb2YgdmFndWVuZXNzIGlzbid0 IGhlbHBmdWwsIGdpdmVuIHRoZSBtb3RpdmF0aW9uIGZvciBkb2luZyB0aGlzDQp3b3JrLiAgSXQg cmVkdWNlcyB0bzogIHNvbWV0aGluZyB3aWxsIGdldCBhdXRoZW50aWNhdGVkLCBidXQgd2Ugd29u J3QNCnNheSB3aGF0IGFuZCB3ZSB3b24ndCBzYXkgd2hlcmUgdG8gZmluZCBvdXQuDQoNCnt7IE5v IHJlc3BvbnNlIGZyb20gSm9uLiB9fSAoZmFsc2UsIGFuc3dlcmVkIGluIDQgNCkNCg0KDQogICAg ICAgICBoZWFkZXIgLT4gaGVhZGVyIC9maWVsZC8gPw0KDQpBbmQsIGJ5IHRoZSB3YXksIHdoYXQg aGVhZGVyIGZpZWxkIGlzIHRoYXQ/DQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9uLiB9fSAoZmFs c2UsIGFsbCBhZ2dyZWdhdGVkIGluIDMgQSAtIHRob3VnaCB0aGUgIndoYXQgaGVhZGVyIGZpZWxk IiBhZG1pdHRlZGx5IGlzIG5vdC4pDQoNCg0KJ2NoZWNraW5nJyBhbmQgJ2NvbnZlcnRpbmcnIGFy ZSB2ZXJ5IGRpZmZlcmVudCBhY3Rpb25zLiAgU28gJ2l0IGRvZXMNCm5vdCcgZG9lcyBub3QgZmxv dyBmcm9tIHRoZSBwcmVjZWRpbmcgdGV4dCBpbiB0aGUgc2VudGVuY2UuDQoNCnt7IE5vIHJlc3Bv bnNlIGZyb20gSm9uLiB9fSAoZmFsc2UsIEEgNS4xKQ0KDQoNCiJXaGVuIGhvd2V2ZXIiPw0KDQp7 eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCBBIDUuMSkNCg0KDQpUaGlzIGlzIG9m ZmVyZWQgYXMgZGVzY3JpcHRpdmUgdGV4dCBoZXJlLiBXaGVyZSBpcyB0aGlzIFNJUCBiZWhhdmlv cg0KZG9jdW1lbnRlZCBpbiB0aGlzIHNwZWM/DQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9uLiB9 fSAoZmFsc2UsIGluIDQgNS4xLCB0aG91Z2ggaXQgaXMgYmxlbmRlZCBpbnRvIHRoZSBlbmQgb2Yg dGhlIG5vdGUgYmVnaW5uaW5nICJUaGUgcmV2aWV3IGludGVycnVwdHMgdGhlIHNwZWMgdGV4dCBy ZWFkaW5nLi4uIikNCg0KDQogICBJZGVudGl0eSBoZWFkZXIgd2l0aCB0aGUgImNhbm9uIiBwYXJh bWV0ZXIsIGl0IFNIT1VMRCByZXRyeSBhIHJlcXVlc3QNCg0KYW5kIGhlbmNlIGl0IGRvZXNuJ3Qg ZG8gcmV0cmllcy4gIEFsbCBvZiB0aGlzIG5lZWRzIHRvIGJlIHJlY2FzdCBpbg0KdGVybXMgdGhh dCBtYXRjaCB0aGUgc3BlY2lmaWVkIGFyY2hpdGVjdHVyZS4NCg0Ke3sgTm8gcmVzcG9uc2UgZnJv bSBKb24uIH19IChmYWxzZTogdGhlIHJldmlldyB0ZXh0IGlzIGxpdGVyYWxseSBpbiB0aGUgcXVv dGVkIHBhcmFncmFwaCBmcm9tIG15IG5vdGVzIHJpZ2h0IGFib3ZlIHRoZSBwbGFjZSB3aGVyZSB0 aGUgcmUtcmV2aWV3IHNheXMgdGhlcmUgaXMgbm8gcmVzcG9uc2UuKSBbJF0NCg0KDQpUaGlzIGlu dGVyYWN0aW9uIG5lZWRzIHRvIGJlIHJlLXNwZWNpZmllZCB0byBiZSBkZXRlcm1pbmlzdGljLg0K DQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCBBIDUuMSBpbiB0aGUgcGFyYWdy YXBoIGJlZ2lubmluZyAiVGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgZG9lcyB0aGUgc2VuZGlu Zz8iKQ0KDQoNCml0IGRvZXNuJ3QgZG8gZm9yd2FyZGluZy4NCg0Ke3sgTm8gcmVzcG9uc2UgZnJv bSBKb24uIH19IChmYWxzZSwgQSA1LjEgaW4gdGhlIHBhcmFncmFwaCBiZWdpbm5pbmcgIlRoZSBh dXRoZW50aWNhdGlvbiBzZXJ2aWNlIGRvZXMgdGhlIHNlbmRpbmc/Iiwgc2VlIHRoZSB2ZXJ5IGVu ZCkNCg0KDQppcyB0aGUgJ2JlbG93JyBoZXJlIGRpZmZlcmVudCBmcm9tIHRoZSBvbmUgYmVmb3Jl IGl0Pw0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKHdlbGwuLi4gdGhlIEEgNS4yICIn bm9ybWFsbHknIGltcGxpZXMiIGNvbW1lbnQgZXhwbGFpbnMgd2hhdCAiYmVsb3ciIG1lYW5zIGlu IHRoZSBzZWNvbmQgc2VudGVuY2Ugb2YgU3RlcCAxLiBJIHdpbGwgZ3J1ZGdpbmdseSBjb25jZWRl IHRoYXQgSSBkaWQgbm90IHNwZWNpZmljYWxseSBzYXkgaGVyZSBpZiB0aGUgImJlbG93IiBoZXJl IGluIHRoZSBmb3J0aCBzZW50ZW5jZSBvZiBTdGVwIDEgbWVhbnMgdGhlIHNhbWUgdGhpbmcuIEl0 IGRvZXMuIEkgYW0gbm90IHN1cmUgSSBmZWVsIHRoYXQgcmVxdWlyZXMgbWUgdG8gcHV0IHRoaXMg b25lIGludG8gdGhlICJ0cnVlIiBjYXRlZ29yeSB0aG91Z2guKQ0KDQoNCiAgICBGcm9tIHRoZSBh Ym92ZSB0ZXh0LCBpdCBhcHBlYXJzIHRoYXQgcHB0IGRvZXMgbm90IGFmZmVjdCBwcm9jZXNzaW5n LA0KYXMgbG9uZyBhcyB0aGUgcHB0IGlzICJzdXBwb3J0ZWQiLiAgVGhhdCBpcywgYW4gYWJzZW50 IHBwdCBhbmQgYSB2YWxpZA0KcHB0IGJvdGggcHJvZHVjZSB0aGUgc2FtZSBzZXF1ZW5jZSAnYmVs b3cnLg0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCB0aGlzIGlzIGFsc28g bGl0ZXJhbGx5IGluIHRoZSBxdW90ZWQgcGFyYWdyYXBoIGZyb20gbXkgbm90ZXMgcmlnaHQgYWJv dmUgdGhpcyBpbiB0aGUgQSA1LjIgIidub3JtYWxseScgaW1wbGVzIiBjb21tZW50KSBbJF0gJw0K DQoNCiAgIFN0ZXAgMjoNCg0KICAgICAgIFN0ZXAgMjogIFNpZ25hdHVyZSBTY29wZQ0KDQp7eyBO byByZXNwb25zZSBmcm9tIEpvbi4gfX0gKHRydWUsIEkgZGlkIG5vdCByZXBseSB0byBhbnkgb2Yg dGhlIHJldmlldyBwcm9wb3NhbHMgdGhhdCB0aGUgU3RlcHMgYmUgYXNzaWduZWQgdGhlaXIgb3du IG5hbWVzLiBUbyBiZSBob25lc3QsIEkgdGhpbmsgSSByZWFsbHkgbWlzc2VkIHRoYXQgdGhpcyB3 YXMgdGhlIGludGVudGlvbiBoZXJlLiBIZXJlJ3MgYSByZXNwb25zZS4pDQoNCkpQOiBJIGRvbid0 IG9iamVjdC4gSSdsbCB0cnkgdG8gc3RpY2sgc29tZSBpbi4NCg0KDQpbb3B0aW9uYWxdICByZW1v dmUuIGl0J3MgcmVkdWRuYW50IHdpdGggJ2lmJw0KDQpbb2YgdGhlIElkZW50aXR5IGhlYWRlcl0g cmVtb3ZlLiAgdGhlcmUgaXMgbm8gb3RoZXIgY2Fub24gcGFyYW1ldGVyLg0KDQpCdXQgcmVhbGx5 IEkgc3VzcGVjdCB0aGF0IGV2ZW4gdGhlICdpZicgaXMgdW5lY2Vzc2FyeS4gIFRoZSBvcHRpb25h bGl0eQ0KaGFzIGJlZW4gZXN0YWJsaXNoZWQgZWxzZXdoZXJlLiAgVGhlIHRhc2sgaGVyZSBpcyBt ZXJlbHkgdG8gc3BlY2lmeSB3aGF0DQppcyBpbiBhIGNhbm9uLg0KDQp7eyBObyByZXNwb25zZSBm cm9tIEpvbi4gfX0gKGZhbHNlLCBBIDUuMi4xICJUaGUgaW50cm9kdWN0b3J5IHNlbnRlbmNlIikN Cg0KDQogICBudW1iZXIgZm9ybS4gIEFsc28sIHdoZW4gImNhbm9uIiBpcyBwcmVzZW50LCBkdXJp bmcgU3RlcCA0IHRoZQ0KICAgdmVyaWZpY2F0aW9uIHNlcnZpY2UgU0hPVUxEIGNvbXBhcmUgdGhl ICJpYXQiIHZhbHVlIGluIHRoZSAiY2Fub24iIHRvDQoNClRoaXMgaXMgdGFsa2luZyBhYm91dCBh Y3Rpb25zIGR1cmluZyBTdGVwIDQuICBNb3ZlIGl0IHRvIFN0ZXAgNCENCg0Ke3sgTm8gcmVzcG9u c2UgZnJvbSBKb24uIH19ICh0cnVlLCBJIGRvbid0IHNlZW0gdG8gaGF2ZSByZXBsaWVkIHRvIHRo aXMsIHNvIGhlcmUncyBhIHJlc3BvbnNlLikNCg0KSlA6IFllYWgsIGFsbCByaWdodCwgSSdsbCBt b3ZlIGl0Lg0KDQoNCltwb3RlbnRpYWxseV0gcmVtb3ZlDQoNCnt7IE5vIHJlc3BvbnNlIGZyb20g Sm9uLiB9fSAoZmFsc2UsIEEgNi4xKQ0KDQoNCkFnYWluLCB0aGlzIG11Y2ggbm9uLWRldGVybWlu YWN5IGluIHN1Y2ggYW4gZXNzZW50aWFsIG1lY2hhbmlzbSBlbnN1cmVzDQovbm9uLS9pbnRlcm9w ZXJhYmlsaXR5LiAgSSBkbyB1bmRlcnN0YW5kIHRoZSBpbnRlbnQgdG8gaGF2ZQ0KcHJpdmF0ZS9w cm9wcmlldGFyeSBtZWNoYW5pc20gYXQgd29yayBmb3IgdXNlIG9mIHRoaXMgc3BlYyBiYWNrIGlu IHRoZQ0KcmVndWxhdGVkIHRlbGVjb20gc3BhY2UsIGJ1dCB0aGF0IGRvZXMgbm90IG1lYW4gaXQg bmVlZHMgdG8gZGlzdHJhY3QgdGhlDQpwdWJsaWMgc3BlY2lmaWNhdGlvbi4gIEEgY29tcGxldGUg c3BlY2lmaWNhdGlvbiBvZiBhIFNUSVIgc2VydmljZSBuZWVkcw0KdG8gaW5jbHVkZSBhIHB1Ymxp Y2x5LXVzYWJsZSBrZXkgY2VydGlmaWNhdGlvbiBtZWNoYW5pc20sIGEgbGEgREFORSBvcg0KREtJ TSBvciB0aGUgbGlrZS4NCg0KVGhlIGFwcGxpY2F0aW9uIG9mIFNUSVIgZm9yIG90aGVyLCBub24t b3BlbiBvcGVyYXRpb25zIGFyZSBhbHdheXMgZnJlZQ0KdG8gYW1lbmQgdGhlIHNwZWNpZmljYXRp b24gdGhyb3VnaCBhIHNlcGFyYXRlIHByb2ZpbGUgdGhhdCBvdmVycmlkZXMgb25lDQpvciBhbm90 aGVyIHBpZWNlIG9mIHRoZSBiYXNlIFNUSVIgc3BlY2lmaWNhdGlvbnMuDQoNCnt7IE5vIHJlc3Bv bnNlIGZyb20gSm9uLiB9fSAoZmFsc2UsIDQgNi4yIHRoZSBwYXJhZ3JhcGggYmVnaW5uaW5nICJU aGUgcmV2aWV3IGhlcmUgaW5zaXN0cyIgdG93YXJkIHRoZSBlbmQgLSBhZ2FpbiwgdGhlIGFuc3dl ciBtYXkgbm90IG1ha2UgZXZlcnlvbmUgaGFwcHksIGJ1dCBpdCdzIHRoZSBhbnN3ZXIgdGhlIFdH IGhhcyBjaG9zZW4pDQoNCg0KW29uIHRoZSBBQk5GIG9mIFJGQzMyNjEsIHNuaXBdDQoNCkRpdHRv IGZvciAiYWxnIi4NCg0KRGl0dG8gZm9yIHBwdC4NCg0Ke3sgTm8gcmVzcG9uc2UqUyogZnJvbSBK b24uIH19IChmYWxzZSwgdGhpcyBpcyBjb3ZlcmVkIGF0IHNvbWUgbGVuZ3RoIGluIDQgNi4zICJU aGUgcmV2aWV3IGFsbGVnZXMuLi4iLCB3aGljaCBpcyBsaXRlcmFsbHkgcXVvdGVkIGluIHRoZSBy ZXNwb25zZSByaWdodCBhYm92ZSB0aGlzIGluIHRoZSByZS1yZXZpZXcpIFskXQ0KDQoNCkFnYWlu LCBzcGVjaWZpY2F0aW9uLCBub3QgaGFuZGxpbmcuICBBbHNvLCB3aGF0IGRvIHRoZSBpbnN0cnVj dGlvbnMNCm1lYW4/ICBIb3cgaXMgdGhlIHNpZ25lciB0byBrbm93IHdoYXQgaXMgZGVyZWZlcmVu Y2VhYmxlIGJ5IHRoZSB2ZXJpZmllcj8NCg0Ke3sgTm8gcmVzcG9uc2UgZnJvbSBKb24uIH19ICh3 ZWxsLCB0aGlzIG9uZSBpcyBhbWJpZ3VvdXMgZXZlbiB0byBtZS4gSSBkbyByZXNwb25kIHRvIHRo aXMgd2l0aCBBIDYuMyB3aXRoIHJlZ2FyZHMgdG8gd2hhdCBpcyAiaGFuZGxpbmciIHZlcnN1cyAi c3BlY2lmaWNhdGlvbiIuIEJ1dCBtb3JlIHRoZSBtb3JlIHNpZ25pZmljYW50IHRlY2huaWNhbCBx dWVzdGlvbiBvZiBob3cgdGhlIHNpZ25lciBpcyBrbm93IHdoYXQgaXMgZGVyZWZlcmVuY2FibGUg aXMgcmVhbGx5IGFkZHJlc3NlZCBpbiA0IDYuMywgaW4gdGhlIGRpc2N1c3Npb25zIGFib3V0IHRo ZSAicmVhbCBuZWVkIiB0byBoYXZlIHNvbWUgY2VudHJhbGl6ZWQgY3JlZGVudGlhbCByZWdpc3Ry eS4gSSB3b3VsZG4ndCBzYXkgdGhpcyBjb21tZW50IHdhc24ndCBhZGRyZXNzZWQsIHRob3VnaCBp dCB3YXNuJ3QgYWRkcmVzc2VkIGhlcmUuIFRoaXMgZG9lc24ndCBhZGQgdXAgdG8gInRydWUiIEkg dGhpbmsuKQ0KDQoNCkFsc28gbm90ZSB0aGF0IHRoZSBjbGFpbWVkIGludGVyZXN0IGluIGF1dGhl bnRpY2F0aW9uIGJleW9uZCBTSVAgd2lsbA0KYWxzbyByZXF1aXJlIGNyZWRlbnRpYWxpbmcgc3lz dGVtcy4gIEFzIHN1Y2gsIHRoZSBlbnRpcmUgdG9waWMgYXBwZWFycw0KdG8gYmUgbGFyZ2VyIHRo YW4gdGhpcyBzcGVjaWZpY2F0aW9uLg0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZh bHNlLCB0aGlzIGlzIHNwZWNpZmljYWxseSBhZGRyZXNzZWQgaW4gMiA2LjQsICJUaGUgc3VnZ2Vz dGlvbiBpbiB0aGUgcmV2aWV3IiBwYXJhZ3JhcGguKQ0KDQoNCg0KdGhlIGFib3ZlIGlzbid0ICdy ZXF1aXJlbWVudHMnLg0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKHdlbGwsIG1heWJl LCB0aG91Z2ggdGhlIHJlc3BvbnNlIGluIDIgNi40ICJUaGUgc3VnZ2VzdGlvbiBpbiB0aGUgcmV2 aWV3IiBpcyBiYXNpY2FsbHkgYSByZXNwb25zZSB0byB0aGlzLCBpbiBzbyBmYXIgYXMgaXQgYWxs dWRlcyB0byB0aGUgZmFjdCB0aGF0IHRoZSBzZWN0aW9uIGRvZXMgaW4gZmFjdCBoYXZlIHJlcXVp cmVtZW50cy4gVGhlIHJlcXVpcmVtZW50cyBhcmUgYnJva2VuIGludG8gYnVsbGV0cywgYW5kIG9i dmlvdXNseSBmb2xsb3cgbGlrZSB0d28gbGluZXMgbGF0ZXIgaW4gdGhlIHNwZWMuIFRoZSBmYWN0 IHRoYXQgYW4gaW50cm9kdWN0b3J5IHBhcmFncmFwaCBiZWZvcmUgdGhlIHJlcXVpcmVtZW50cyBp cyBub3QgaW4gZmFjdCAicmVxdWlyZW1lbnRzIiB3b3VsZCBub3QgYmUgbG9zdCBvbiBhbnlvbmUg d2hvIGlzIHRyeWluZyB0byB1bmRlcnN0YW5kIHRoZSBzcGVjLiBCdXQgSSBhZ3JlZSBpdCBpc24n dCBzdXBlciBjbGVhciB0aGF0IDIgNi40IHdhcyBpbiBwYXNzaW5nIHJlZnV0aW5nIHRoaXMgc3Rh dGVtZW50IGluIHRoZSByZXZpZXcuKQ0KDQoNCkxvb2tzIGxpa2UgdGhpcyBuZWVkcyB0byBkZWZp bmUgYSBTVElSIENyZWRlbnRpYWwgUmVnaXN0cnkuDQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9u LiB9fSAoZmFsc2UsIHRoaXMgaXMgYWRkcmVzc2VkIGluIDQuIDYuMyAiYWZ0ZXIgcmVhZGluZyBh Ym91dCIuIFRob3VnaCBhZG1pdHRlZGx5IHRoYXQgaXMgbGFiZWxsZWQgNCA2LjMgYW5kIG5vdCA0 IDYuNCBhcyBpdCBzaG91bGQgYmUpDQoNCg0KDQpyZW1vdmUgYWJvdmUgcGFyYWdyYXBoLg0KDQp7 eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCB0aGlzIGlzIGFkZHJlc3NlZCBpbiAz IDcgIm9uY2UgYWdhaW4uIiBJbiBmYWN0LCB0aGUgdGV4dCByZWFkaW5nICJPbiBzaW1pbGFyIGdy b3VuZHMsIHRoZSByZXZpZXcgZ29lcyBvbiB0byBzdWdnZXN0IHRoYXQgYW5vdGhlciBoZWxwZnVs IHBhcmFncmFwaCBvZiBtZWNoYW5pc20gYmUgcmVtb3ZlZCIgaXMgbGl0ZXJhbGx5IHF1b3RlZCBh IGhhbmRmdWwgb2YgbGluZXMgdXAgaW4gdGhlIHJlLXJldmlldyBmcm9tIHRoZSBjbGFpbSB0aGF0 IHRoZXJlIGlzIG5vIHJlc3BvbnNlLikgWyRdICANCg0KDQpJZiB0aGVyZSBpcyBhbiBhbGdvcml0 aG0gdG8gZm9sbG93LCBzcGVjaWZ5IGl0IGFzIGFuIGFsZ29yaXRobS4NCk90aGVyd2lzZSwgdGhp cyBpcyBub24tbm9ybWF0aXZlIGRpc2N1c3Npb24gYW5kIGlzbid0IHZlcnkgaGVscGZ1bCBoZXJl Lg0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCB0aGlzIGlzIGFkZHJlc3Nl ZCBpbiA0IDcgIndoZW4gdGhlIHNwZWMiLikNCg0KDQpIb3cgYXJlIHRoZXkgdG8gZG8gdGhpcz8N Cg0Ke3sgTm8gcmVzcG9uc2UgZnJvbSBKb24uIH19ICh3ZWxsLCBJJ2Qgc2F5IHRoaXMgaXMgYWRk cmVzc2VkIGluIDQgNyAid2hlbiB0aGUgc3BlYyIpDQoNCg0KSWYgYSBsb2NhbCBlbnZpcm9ubWVu dCBpcyBkb2luZyAnbG9jYWwgcG9saWN5JyB0aGVuIGl0IHdpbGwgZG9jdW1lbnQNCnRoYXQgc2Vw YXJhdGVseS4gIFRoZXJlIGlzIG5vIHV0aWxpdHkgaW4gbWFraW5nIHZhZ3VlIHN0YXRlbWVudHMg YWJvdXQNCnBvc3NpYmlsaXRpZXMgdGhhdCBhcmUgb3V0c2lkZSB0aGUgc3BlYy4NCg0Ke3sgTm8g cmVzcG9uc2UgZnJvbSBKb24uIH19ICh3ZWxsLCBieSB0aGlzIHN0YWdlIHRoaXMgaGlnaCBsZXZl bCBjb21tZW50IHJlaGFzaGVzIGEgcG9pbnQgdGhhdCBoYXMgYmVlbiBhbnN3ZXJlZCBiZWZvcmUs IGxpa2UgaW4gMyA3ICJvbmNlIGFnYWluIikNCg0KDQogICAgVGFrZSB0aGUgb3JpZ2luYWwgc3Ry aW5nIGFuZCByZW1vdmUgYW55IGNoYXJhY3RlcnMgdGhhdCBkbyBub3QNCmNvbmZvcm0gdG8gdGhl IGFib3ZlIGZvcm1hdC4NCg0KVGhlbiB0d2VhayB0aGF0IHRleHQgZm9yIGFueSBjYXNlcyB0aGF0 IG5lZWQgdG8gYWRkIGNoYXJhY3RlcnMuDQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9uLiB9fSAo ZmFsc2UsIHRoaXMgcHJvcG9zYWwgaXMgZXhwbGljaXRseSBjb25zaWRlcmVkIGluIDQgNy4yLCAi YWxzbywgYXMgYSBtaW5vciBwb2ludCIpDQoNCg0KDQptdXN0IG9yIE1VU1Q/DQoNCnt7IE5vIHJl c3BvbnNlIGZyb20gSm9uLiB9fSAodHJ1ZSwgdGhpcyBkb2Vzbid0IGdldCBhIHJlc3BvbnNlKQ0K DQpKUDogSSBkb24ndCB0aGluayB0aGF0IHN0YXRlbWVudCBpcyBub3JtYXRpdmUuDQoNCg0KUmVh bGx5LCBJIHN1c3BlY3QgYWxsIG9mIHRoZSBhYm92ZSBkZXRhaWwgaXMgb3V0IG9mIHNjb3BlLCBn aXZlbiB0aGUgd2F5DQp0aGVzZSBzcGVjaWZpY2F0aW9ucyBoYXZlIGJlZW4gcGFydGl0aW9uZWQu DQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9uLiB9fSAoZmFsc2UsIHRoaXMgaXMgYWRkcmVzc2Vk IGluIDQgNy4zICJ0aGUgcmV2aWV3IGhlcmUgYXNrcyIpDQoNCg0KQ2Fub25pY2FsaXphdGlvbiBm b3IgcGhvbmUgbnVtYmVycyBhbmQgTm9ybWFsaXphdGlvbiBmb3IgVVJJLiAgV2h5IHRoZQ0KZGlm ZmVyZW5jZT8NCg0Ke3sgTm8gcmVzcG9uc2UgZnJvbSBKb24uIH19ICh0cnVlLCB0aGlzIGRvZXNu J3Qgc2VlbSB0byBnZXQgYSByZXNwb25zZSkNCg0KSlA6IFVSSSAibm9ybWFsaXphdGlvbiIgaXMg dGhlIHRlcm0gdXNlZCBieSBSRkMzOTg2LCBhbmQgImNhbm9uaWNhbGl6YXRpb24iIGlzIHRoZSB0 ZXJtIHdlIGhhZCBhbHJlYWR5IGJlZW4gdXNpbmcgZm9yIHRlbGVwaG9uZSBudW1iZXJzLiBJIHRo b3VnaHQgaXQgd2FzIGFjdHVhbGx5IGhlbHBmdWwgdG8gaGF2ZSB0aG9zZSB0ZXJtcyBiZSBkaWZm ZXJlbnQsIHNpbmNlIHlvdSBhcmUgcGVyZm9ybWluZyBhIGRpZmZlcmVudCBvcGVyYXRpb24gd2hl biB5b3UgZXhlY3V0ZSB0aGVtLg0KDQoNCiAgdHJhbnNmb3JtYXRpb24gIC0+IHRyYW5zZm9ybWF0 aW9ucw0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCBBIDcuNCkNCg0KDQoi aW5jbHVkaW5nIj8gIEJ5IG15IHJlYWRpbmcgdGhlcmUgaXNuJ3QgYW55dGhpbmcgb3RoZXIgdGhh biB0aG9zZSB0d28NCnJ1bGVzLg0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNl LCBhZGRyZXNzZWQgaW4gNCA3LjQgInRoZSByZXZpZXcgaGVyZSBpcyBhbGFybWVkIikNCg0KDQoN CkluIG90aGVyIHdvcmRzLCBqdXN0IGdldCA8aG9zdD4NCg0Ke3sgTm8gcmVzcG9uc2UgZnJvbSBK b24uIH19ICh3ZWxsLCA0IDcuNCBkaXNjdXNzZXMgdGhlIGNvbW1lbnRzIG9uIHRoaXMgYWxnb3Jp dGhtIGFzIGEgd2hvbGU7IGl0J3MgdHJ1ZSB0aGF0IHRoZSByZXNwb25zZSBkb2Vzbid0IHNwZWNp ZmljYWxseSBlbnRlcnRhaW4gcmVwbGFjaW5nIGV2ZXJ5dGhpbmcgd2l0aCAiZ2V0IDxob3N0PiIg YnV0IHN1cmVseSB0aGUgcmVzcG9uc2UgaXMgY2xlYXIgYWJvdXQgd2h5IHRoZSBtZWNoYW5pc20g YXMgd3JpdHRlbiBpcyByZXRhaW5lZC4pDQoNCg0KY2Fub24gaXMgb3B0aW9uYWwuICB3aHkgZG9l c24ndCB0aGUgYWJuZiBzaG93IGl0IGFzIG9wdGlvbmFsPyAgSSBzdXNwZWN0DQp0aGUgaXNzdWUg aXMgdGhhdCB0aGUgYWJuZiBuZWVkcyB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIG1hbmRhdG9yeSBh bmQNCm9wdGlvbmFsIGNvbXBvbmVudHMgb2YgdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZC4NCg0K e3sgTm8gcmVzcG9uc2UgZnJvbSBKb24uIH19ICh0cnVlLCBJIHRoaW5rLCBJIGRvbid0IHNlZSBh bnl3aGVyZSB0aGF0IEkgYWRkcmVzc2VkIHRoaXMuKQ0KDQpKUDogVGhlIGludGVudGlvbiBpcyBm b3IgdGhlIEFCTkYgdG8gc2hvdyBjYW5vbiAoYW5kIHRoZSByZW1haW5kZXIgb2YgdGhlIGlkZW50 LWluZm8tcGFyYW1ldGVycykgYXMgb3B0aW9uYWwsIGhlbmNlIHRoZSAiKiggU0VNSSBpZGVudC1p bmZvLXBhcmFtcyApIi4gTXkgQUJGTiBtYXkgYmUgcnVzdHksIGJ1dCBJJ20gbm90IHNlZWluZyB0 aGUgcHJvYmxlbT8NCg0KDQpUaGVzZSBzb3J0cyBvZiBydWxlcyAoaW5jbHVkaW5nIGJhc2UtNjQt Y2hhciwgd2hpY2ggaXMgZGVmaW5lZA0Kc3ludGFjdGljYWxseSBidXQgbm90IHNlbWFudGljYWxs eSkgbmVlZCBleHBsaWNpdCBBQk5GIHJ1bGVzIHdpdGggdGhlaXINCm5hbWVzIGFuZCB0aGVuIG5l ZWQgcHJvc2UgdGV4dCB0byBleHBsYWluIHRoZWlyIHNlbWFudGljcy4NCg0Ke3sgTm8gcmVzcG9u c2UgZnJvbSBKb24uIH19IChmYWxzZSwgOCAidGhlIHJldmlldyBpcyB2ZXJ5IGNvbmNlcm5lZCIg dGFsa3MgYWJvdXQgd2hlcmUgdGhlc2UgQUJORiBlbGVtZW50cyBjb21lIGZyb20pDQoNCg0KSSBu YXR1cmFsbHkgYXNzdW1lIHRoYXQgc29tZSBwb3J0aW9uIG9mIHRoaXMgaXMgaW5oZXJpdGVkIGZy b20gSlNPTg0KYW5kL29yIEpXVCwgd2hpY2ggaXMgYSBuaWNlIGV4YW1wbGUgb2YgdGhlIHNpZ25p ZmljYW50LCBhZGRpdGlvbmFsDQpvdmVyaGVhZCBiZWluZyBiZWluZyBpbnRyb2R1Y2VkIHdpdGgg dGhlaXIgdXNlLiAgQW5kIGluIHRoaXMgY2FzZSwNCmFwcGFyZW50bHkgY29uZnVzaW9uLg0KDQp7 eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCA4ICJXaGlsZSB0aGUgcmV2aWV3IG9i amVjdHMiIGNvdmVycyB0aGlzfQ0KDQoNCkFuZCBzaW5jZSBldmVyeSBSRkMgY29udGFpbnMgYSBz ZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uLCBhDQpnZW5lcmljIHJlZmVyZW5jZSBsaWtl IHRoaXMsIGhlcmUsIGlzIG9mIG5vIG9idmlvdXMgdmFsdWUuICBJdCdzIGp1c3QNCm1vcmUgdGV4 dC4NCg0Ke3sgTm8gcmVzcG9uc2UgZnJvbSBKb24uIH19IChmYWxzZSwgOCAidGhlIHJldmlldyBp cyBza2VwdGljYWwiIGNvdmVycyB0aGlzKQ0KDQoNCiJ3aXRoIG5vdyBjbGFpbXMiPw0KDQp7eyBO byByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCBBIDkpDQoNCg0KVGhlIHRlcm0gJ2hlYWRl ciBrZXknIGRvZXMgbm90IG9jY3VyIGluIHRoZSBQYXNzcG9ydCBzcGVjaWZpY3Rpb24uDQpQZXJo YXBzIHRoaXMgaXMgbWVhbnQgdG8gcmVmZXIgdG8gdGhhdCBkb2MncyBzZWN0aW9uIDQuMSBoZWFk ZXIgcGFyYW1ldGVyPw0KDQp7eyBObyByZXNwb25zZSBmcm9tIEpvbi4gfX0gKHRydWUsIEkgdGhp bmspDQoNCkpQOiBUaGlzIGlzIG5vdCBhIHRlcm0gb2YgYXJ0LiBQQVNTcG9yVCBvYmplY3RzIGFy ZSByZWZlcnJlZCB0byBhcyAiaGVhZGVyIiBhbmQgImNsYWltIiBvYmplY3RzIGhlcmUuIFRoZSBj b250ZW50cyBvZiBvYmplY3RzIGFyZSBrZXlzIGFuZCB2YWx1ZXMuIEEga2V5IGluIHRoZSBoZWFk ZXIgb2JqZWN0IGlzIGFsbCB0aGlzIG1lYW5zLiBCdXQuLi4gSSB0aGluayB0aGF0IGdvdCBraWxs ZWQgaW4gc29tZSB1bnJlbGF0ZWQgZWRpdCBJJ20gZG9pbmcsIHNvIGl0IG1heSBiZSBtb290Lg0K DQoNCiAgSWYuLi5idXQgdGhlbiAgYXBwZWFycyB0byBiZSBhIG5vbi1zZXF1aXRvciBvciBpbmNv bXBsZXRlbHkgZm9ybXVsYXRlZA0Kc2VudGVuY2UuDQoNCnt7IE5vIHJlc3BvbnNlIGZyb20gSm9u LiB9fSAoZmFsc2UsIEEgOSAidGhlIHJldmlldyBjb3JyZWN0bHkgbm90ZXMiKQ0KDQoNCkluIGZh Y3QgdGhlcmUgaXMgc28gbGl0dGxlIG92ZXJsYXAgb2Ygc3Vic3RhbnRpdmUgdGV4dCwgdGhpcyBy ZWFsbHkgaXMNCmFuIGVudGlyZWx5IG5ldyBkb2N1bWVudCBhbmQgbm90IGEgYmlzLg0KDQp7eyBO byByZXNwb25zZSBmcm9tIEpvbi4gfX0gKGZhbHNlLCAzIDEwKQ0KDQotLS0tIFJlLVJlc3BvbnNl cyAtLS0tLQ0KDQpBcyBJIGFscmVhZHkgc2FpZCBvbiB0aGUgbGlzdCwgdGhlIHJldmlldyAoYW5k IHJlLXJldmlldykgZm9jdXNlcyBhdHRlbnRpb24gb24gdGhlIHF1ZXN0aW9uIG9mIGhvdyB0byBo YW5kbGUgc2lnbmF0dXJlcyB0aGF0IGhhdmUgYmVlbiBicm9rZW4gYnkgaW50ZXJtZWRpYXJpZXMg aW4gdHJhbnNpdC4gVGhlIHJlLXJldmlldyBwdXRzIGhhcmQgZW1waGFzaXMgb24gcmZjNDQ3NGJp cydzIHJlbGF0aXZlIGZsZXhpYmlsaXR5IGFib3V0IHRoaXMgcXVlc3Rpb24uICIqVGhhdCdzIGEg bWlzdGFrZS4gSWYgdGhlIGluZnJhc3RydWN0dXJlIHdpbGwgc29tZXRpbWVzIGJyZWFrIHRoZSBz aWduYXR1cmUsIHRoZW4gcGVuYWxpemluZyB0aGUgc2lnbmVyIGZvciBhY3Rpb25zIG5vdCB1bmRl ciB0aGVpciBjb250cm9sIHdpbGwgYmUgcHJvYmxlbWF0aWMuIFRoYXQncyB3aHkgREtJTSBleHBs aWNpdGx5IG1hbmRhdGVzIHRyZWF0aW5nIGEgYnJva2VuIHNpZ25hdHVyZSBleGFjdGx5IHRoZSBz YW1lIGFuIGFic2VudCBzaWduYXR1cmUuKiIgQnV0IGZvciBhbGwgdGhhdCB2ZWhlbWVuY2UsIHRo ZSByZS1yZXZpZXcgaXNuJ3QgbWFraW5nIGFueSBuZXcgcG9pbnQgaGVyZS4gWWVzLCB0aGUgREtJ TSBjb21tdW5pdHkgaGFzIHRob3VnaHQgYWJvdXQgdGhpcyBmb3IgbW9yZSB0aGFuIGEgZGVjYWRl LiBTbyBoYXZlIHdlIGluIFNJUC4gV2UndmUgdG9vbGVkIHRoZSBzaWduYXR1cmUgdG8gbWluaW1p emUgdGhhdCBicmVha2FnZSwgY3JlYXRlZCBhIG1lY2hhbmlzbSB0byBjb21wZW5zYXRlIGZvciB1 bm5lY2Vzc2FyeSBicmVha2FnZSwgYW5kIGxlZnQgYSB0cmVtZW5kb3VzIGFtb3VudCBvZiBsYXRp dHVkZSBvbiBob3cgdG8gaGFuZGxlIGJyZWFrYWdlLiBUbyBzYXkgbWVyZWx5IHRoYXQgd2UncmUg YmVlbiBvdmVyIHRoaXMgdHVyZiBtYW55IHRpbWVzIGlzIGFuIHVuZGVyc3RhdGVtZW50LiBDb21p bmcgaW4gYXQgdGhlIGxhc3QgbWludXRlIGFuZCBqdXN0IHNheWluZyAidGhhdCdzIGEgbWlzdGFr ZSIgaXMgbm90IGdvaW5nIHRvIGNvbnZpbmNlIHVzLiBUaGVyZSBhcmUgZGlmZmVyZW5jZXMgYWJv dXQgdGhlIHdheSB0aGF0IFNJUCBhbmQgZW1haWwgaGFuZGxlIG1lc3NhZ2VzLiBSRkM1NTg1IFNl Y3Rpb24gMy4yLjIsIGZvciBleGFtcGxlLCBnaXZlcyBhIHJhdGlvbmFsZSBmb3IgdHJlYXRpbmcg YSBicm9rZW4gZW1haWwgc2lnbmF0dXJlIGFzIGFuIGFic2VudCBzaWduYXR1cmUgdGhhdCBoYXMg bm8gYmVhcmluZyBvbiBTSVAgd2hhdHNvZXZlci4NCg0KUmVnYXJkaW5nIHRoZSB3aG9sZSBpZGVh IG9mIGhhdmluZyBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGFuZCB2ZXJpZmljYXRpb24gc2Vydmlj ZSAicm9sZXMsIiB0aGUgcmUtcmV2aWV3IGV4Y2xhaW1zLCAiVGhpcyBhcHBlYXJzIHRvIGJlIGEg dmVyeSBiYXNpYyBkaXNhZ3JlZW1lbnQgYWJvdXQgYSB2ZXJ5IGJhc2ljIGlzc3VlISAqSW4gcG9p bnQgb2YgZmFjdCwgdGhlc2Ugc3BlY2lmaWNhdGlvbnMgYXJlIGF0dGVtcHRpbmcgdG8gZGVmaW5l IGFuIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2Ugb3ZlcmxheSBmb3IgU0lQLiBUaGF0IGlzLCBTVElS IGlzIGFuIGFkZGl0aW9uYWwgbGF5ZXIgb2YgYXJjaGl0ZWN0dXJlIEFCT1ZFIFNJUC4gKiIgSSBm YWlsIHRvIHNlZSB3aHkgdGhpcyBpcyBhbiBpbnRlcmVzdGluZyBvciBpbXBvcnRhbnQgcG9pbnQs IG5vciB3aGF0IGV4cGxhbmF0b3J5IHBvd2VyIHdlIGdhaW4gYnkgY2FsbGluZyB0aGlzIGFuICJv dmVybGF5LiIgSSBkbyB1bmRlcnN0YW5kIHRoYXQgU0lQIG1lc3NhZ2VzIGFyZSBjYXJyeWluZyBQ QVNTcG9yVCBvYmplY3RzLCBhbmQgaW4gc29tZSBzZW5zZSB0aGF0IHdlIGFyZSBzaW1wbHkgdHVu bmVsaW5nIFBBU1Nwb3JUIG92ZXIgU0lQIC0gYnV0IHNpbmNlIHRoZSBjb250ZW50cyBvZiB0aGF0 IFBBU1Nwb3JUIGNsYWltcyBhcmUgaW4gZmFjdCBzaWduZWQgZmllbGRzIHRha2VuIGZyb20gdGhl IFNJUCByZXF1ZXN0LCBJIGRvbid0IHNlZSB0aGUgc2FtZSBzaW1wbGUgYW5kIG9idmlvdXMgbGF5 ZXJpbmcgdGhhdCB0aGUgcmUtcmV2aWV3IHNlZW1zIHRvLiBUbyBtZSwgdGhpcyBpcyBhbiBldm9s dXRpb24gb2YgdGhlIGNvbmNhdGVuYXRlZCBzdHJpbmcgaW4gUkZDNDQ3NCwgd2hpY2ggd2FzIGlu IHR1cm4gYW4gZXZvbHV0aW9uIG9mIHRoZSBBSUIgbWVjaGFuaXNtIChSRkMzODkzKSwgd2hpY2gg d2FzIGluIHR1cm4gYW4gZXZvbHV0aW9uIG9mIHRoZSBtZWNoYW5pc20gaW4gUkZDMzI2MSAyMy40 LiBBbGwgb2YgdGhvc2UgYXJlIGVuY2Fwc3VsYXRpb24gbWVjaGFuaXNtcyB0aGF0IGNhcnJ5IHNp Z25lZCBmaWVsZHMgb2YgYSBTSVAgcmVxdWVzdC4gV2hlcmUgQUlCIGNhcnJpZWQgYSBjb3B5IG9m IHRoZSBmaWVsZHMsIHNvIHdlIGNvdWxkIHNlZSBob3cgdGhleSBsb29rZWQgdG8gdGhlIHNpZ25l ciBiZWZvcmUgdHJhbnNpdCAoYW5kIGFueSBpbnRlcm1lZGlhcnkgaW50ZXJmZXJlbmNlKSwgUkZD NDQ3NCBkaXNjYXJkZWQgdGhlIGNvcHkgLSBzbyBQQVNTcG9yVCBzcGxpdHMgdGhlIGRpZmZlcmVu Y2UsIG9mZmVyaW5nIHlvdSBib3RoIG1vZGVzLCBidXQgZGVmYXVsdGluZyB0byBkaXNjYXJkaW5n IHRoZSBjb3B5LiBXZSAoQ2hyaXMgYW5kIEkpIGRvIHNvbWV0aW1lcyBzdGlsbCBkZWJhdGUgd2hp Y2ggaXQgc2hvdWxkIGRlZmF1bHQgdG8uIEknbSB3aWxsaW5nIHRvIGdvIGludG8gdGhlIGZpZWxk IHdpdGggd2hhdCB3ZSBoYXZlIGFuZCBzZWUgaG93IGl0IHdvcmtzLiBTbyBpcyB0aGUgd29ya2lu ZyBncm91cCwgd2hpY2ggY29udGFpbnMgYSBtdWNoIGxhcmdlciBzaGFyZSBvZiB0aGUgbWFqb3Ig b3BlcmF0b3JzIHRoYW4gaXMgdHlwaWNhbCBpbiBhbiBJRVRGIHdvcmtpbmcgZ3JvdXAuDQoNCkJ1 dCB0aGlzIGdldHMgYSBmdXJ0aGVyIGhlYXJpbmcgaW4gdGhlIHNlY3Rpb24gYWJvdXQgdGhlIHN0 ZXBzIHRoYXQgZW50aXRpZXMgaW5zdGFudGlhdGluZyB0aGUgYXV0aGVudGljYXRpb24gYW5kIHZl cmlmaWNhdGlvbiBzZXJ2aWNlIG11c3QgcGVyZm9ybS4gVGhlIHJlLXJldmlldyBnb2VzIG9uICIq VGhlIGltbWVkaWF0ZSBwcm9ibGVtIGlzIHRoYXQgdGhlIHN0ZXBzIGFyZSBwYXJ0IG9mIHRoZSBh cmNoaXRlY3R1cmUsIGluZGVwZW5kZW50IG9mIGltcGxlbWVudGF0aW9uIGRldGFpbHMuIFNvIGJ5 IHNheWluZyAnZW50aXRpZXMgaW5zdGFudGlhdGluZycgdGhlIGRvY3VtZW50IGlzIHN0ZXBwaW5n IGludG8gc291bmRpbmcgbGlrZSBpdCBpcyB0YWxraW5nIGFib3V0IGltcGxlbWVudGF0aW9uLiBU aGVyZSBpcyBhIGdlbmVyYWwgY2hhbGxlbmdlIGluIHRoZSBJRVRGLCBhbmQgZWxzZXdoZXJlLCBp biBjcmVhdGluZyBhbmQgbWFpbnRhaW5pbmcgY2xhcml0eSBhYm91dCBuZXR3b3JraW5nIGFyY2hp dGVjdHVyZXMgLS0gd2hpY2ggYXJlIGFic3RyYWN0aW9ucyAtLSBhcyBkaXN0aW5jdCBmcm9tIHRo ZSBtYW55IHdheXMgdGhleSBjYW4gYmUgaW1wbGVtZW50ZWQuIElFVEYgc3BlY2lmaWNhdGlvbnMg c2hvdWxkIGVuY291cmFnZSBjbGFyaXR5LCBub3QgYWRkIHRvIHRoZSBjb25mdXNpb24uKiIgV2hp bGUgYXQgYSBoaWdoIGxldmVsLCBJIGFncmVlIHdlIHNob3VsZG4ndCBiZSBpbiB0aGUgYnVzaW5l c3Mgb2YgZGljdGF0aW5nIGltcGxlbWVudGF0aW9uLCBJIGRvbid0IHRoaW5rIHRoZSBzcGVjaWZp Y2F0aW9uIG9mIHRoZXNlIHN0ZXBzLCBvciB0aGUgZW50aXRpZXMgaW52b2x2ZWQsIG92ZXJzdGVw cyB0aGUgY29tbW9uIGJvdW5kcyBvZiB0aGUgSUVURi4gT3JkaW5hcmlseSwgSSBmaW5kIHJlZmVy ZW5jZSB0byBwcmVjZWRlbnRzIGluIGV4aXN0aW5nIFJGQ3MgY29udmluY2VzIHBhcnRpY2lwYW50 cyBpbiBvdXIgcHJvY2VzcyB0aGF0IHNvbWV0aGluZyBmYWxscyB3aXRoaW4gb3VyIG5vcm1zIC0g SSBnYXRoZXIgdGhhdCBhcmd1bWVudCBkb2Vzbid0IHBlcnN1YWRlIGV2ZXJ5b25lLiBJIHRoaW5r IHdoYXQgd2UndmUgZ290IGlzIGdvb2QgZW5vdWdoLg0KDQpUaGUgcmUtcmV2aWV3IGlzIHN0aWxs IHF1aXRlIGZpcm0gYWJvdXQgaG93IHRoZSBpbnZvY2F0aW9uIG9mICJsb2NhbCBwb2xpY3kiIHRo cm93cyBhbiBleGNlcHRpb24gdGhhdCBub3RoaW5nIGNhbiBjYXRjaC4gIipBcyBzb29uIGFzIG9u ZSBzYXlzICdsb2NhbCBwb2xpY3knIGZvciBhbnl0aGluZyBvdGhlciB0aGF0IGEgZ2VuZXJpYyBh bmQgbm9uLW5vcm1hdGl2ZSBkaXNjdXNzaW9uLCBvbmUgaGFzIHN0ZXBwZWQgb3V0IG9mIHRoZSBz YW5kYm94IGluIHdoaWNoIHRoZSBzcGVjaWZpY2F0aW9uIGNvbnRyb2xzIGFuZCwgdGhlcmVmb3Jl LCBoYXMgc3RlcHBlZCBvdXQgb2YgdGhlIHNwZWNpZmljYXRpb24uIEluIG90aGVyIHdvcmRzLCBs b2NhbCBwb2xpY3kgZm9yIHNvbWV0aGluZyBsaWtlIHRoaXMgbmVlZHMgdG8gYmUgb3V0IG9mIHNj b3BlLioiIEkgY2FuIG9ubHkgcmVpdGVyYXRlIHRoYXQgdGhpcyBpcyBhIGJpemFycmUgYW5kIGJh c2VsZXNzIHJlc3RyaWN0aW9uIG9uIElFVEYgZG9jdW1lbnRzLg0KDQpPbiB0aGUgcXVlc3Rpb24g b2YgaG93IGZhciByZmM0NDc0YmlzIG5lZWRzIHRvIGdvIGluIGFkdmlzaW5nIHJlbHlpbmcgcGFy dGllcyBhYm91dCB2YWxpZGF0aW9uIGFuZCB0cnVzdCB0aGUgcmUtcmV2aWV3IGhhcyBzb21lIGNo b2ljZSB3b3Jkcy4gIipUaGUgcmVzcG9uc2Ugc2hvd3MgYSBjb25mdXNpb24gYWJvdXQgdmFsaWRh dGlvbiBhbmQgdHJ1c3QuIFZhbGlkYXRpb24gaXMgdGhlIHRhc2sgb2YgU1RJUi4gV2l0aGluIHRo ZSBzY29wZSBvZiBlc3RhYmxpc2hpbmcgdmFsaWRhdGlvbiAtLSB0aGF0IGlzLCB3aXRoaW4gdGhl IHN0YW5kYXJkaXplZCBhbmQgaW50ZXJvcGVyYWJsZSBkZXRhaWxzIG9mIGFuIGF1dGhlbnRpY2F0 aW9uIG1lY2hhbmlzbSBsaWtlIFNUSVIgLS0gdGhlcmUgKm11c3QqIGJlIGEgc2VtYW50aWMgY29t cG9uZW50IHByb3ZpZGVkIHdoaWNoIGVzdGFibGlzaGVzIHRoZSBhdXRob3JpdHkgb2YgdGhlIGVu dGl0eSBhc3NlcnRpbmcgdmFsaWRpdHkgdG8gbWFrZSB0aGF0IGFzc2VydGlvbi4gVGhlIHByZW1p c2Ugb2YgYW4gYXV0aGVudGljYXRpb24gbWVjaGFuaXNtIGlzIGNsYXJpdHkgYWJvdXQgdGhlIGF1 dGhvcml0eSBvZiB0aGUgZW50aXR5IHZvdWNoaW5nIGZvciB0aGUgdXNlIG9mIHRoZSBrZXkuIFRo aXMgaXMgZW50aXJlbHkgZGlmZmVyZW50IGZyb20gdGhlIHRydXN0IGNvbXBvbmVudCB3aGljaCBh c3Nlc3NlcyB3aGV0aGVyIHRoYXQgZW50aXR5IGlzIGEgZ29vZCBhY3RvciBvciBub3QgKG9yIHdo ZXRoZXIgdGhlIGF1dGhvcml6ZWQgZW50aXR5IGRvaW5nIHRoZSBzaWduaW5nIGlzIGEgZ29vZCBh Y3RvciBvciBub3QuKSoiIEkgZG9uJ3QgdGhpbmsgd2UncmUgYWN0dWFsbHkgY29uZnVzZWQgYWJv dXQgdGhhdC4gV2UgaGF2ZSB0d28gc2VjdGlvbnMgYWJvdXQgd2hhdCBpdCBtZWFucyB0byBoYXZl ICJhdXRob3JpdHkiIG92ZXIgdGVsZXBob25lIG51bWJlcnMgYW5kIGRvbWFpbiBuYW1lcyBmb3Ig dGhlIHB1cnBvc2VzIG9mIHZhbGlkYXRpb24gLSB0aG91Z2ggYWRtaXR0ZWRseSwgdGhleSBkbyBk ZWZlciB0byBzdGlyLWNlcnRzIGJlY2F1c2UgaXQgaXMgdGhlIG5hdHVyZSBvZiB0aGUgY3JlZGVu dGlhbCB0aGF0IGNvbW11bmljYXRlcyB0aGF0IHNjb3BlIG9mIGF1dGhvcml0eSwgbm90IGFueSBv dGhlciBlbGVtZW50IG9mIHRoZSBvdmVyLXRoZS13aXJlIHBydG9vY29sLiBBbmQgeWVzLCB0aGF0 J3MgZW50aXJlbHkgc2VwYXJhdGUgZnJvbSB0aGUgcXVlc3Rpb24gb2Ygd2h5IHlvdSB0cnVzdCBh bnkgcGFydGljdWxhciBjcmVkZW50aWFsLiBCdXQgdGhhdCBtZWFucyB0aGF0IHVsdGltYXRlbHkg Ym90aCB0aGUgInZhbGlkYXRpb24iIGFuZCAidHJ1c3QiIHBhcnRzIG9mIHRoaXMgZXF1YXRpb24g bXVzdCBkZWZlciB0byB0aGUgY3JlZGVudGlhbCBtZWNoYW5pc20uIE15IHBvaW50IGluIHRoZSBy ZXNwb25zZSBzdGFuZHM6ICJ0aGUgZmllbGRzIHRoYXQgZ28gaW4gUEFTU3BvclQgYW5kIHRoZSBz ZW1hbnRpY3Mgb2YgdGhlIFNJUCBJZGVudGl0eSBoZWFkZXIgZmllbGQgdmFsdWUgd2lsbCBub3Qg YmUgYW55IGRpZmZlcmVudCBhcyBhIHJlc3VsdCBvZiB0aG9zZSBkaWZmZXJlbnQgYXJjaGl0ZWN0 dXJlcyIgZm9yIHRydXN0IGFuZC9vciBjcmVkZW50aWFsIHNjb3BlLg0KDQpNb3JlIHRvIHRoaXMg cG9pbnQsIHRoZSByZS1yZXZpZXcgYXNzZXJ0cyB0aGF0ICIqVGhlIG9wZXJhdGlvbmFsIGhpc3Rv cnkgb2YgY2VydGlmaWNhdGUtYmFzZWQgc2VydmljZXMgaXMgaGlnaGx5IHByb2JsZW1hdGljLiBG b3IgYSBjcml0aWNpYWwgaW5mcmFzdHJ1Y3R1cmUgc2VydmljZSBsaWtlIFNUSVIsIHRoZSB0ZWNo bmljYWwgZGVzaWduIG9mIHRoZSBjZXJ0IHNlcnZpY2UgaXMgbm90IHNvbWV0aGluZyB0aGF0IGNh biBiZSBkZWZlcnJlZCBhbmQgdHJlYXRlZCBtZXJlbHkgYXMgYSBtYXR0ZXIgb2Ygb3BlcmF0aW9u YWwgZGVzaWduLioiIFdoaWxlIEkga25vdyB0aGlzIGhhcyBnb3R0ZW4gc29tZSBsaXN0IGRpc2N1 c3Npb24gcmVjZW50bHksIHdlIGFyZSBub3QgY2xvc2luZyB0aGUgZG9vciBvbiB1c2luZywgc2F5 LCBhIEROUy1iYXNlZCBzZXJ2aWNlIGZvciB0aGlzLiBXZSBoYWQgYSBwcm9wb3NhbCBmb3Igb25l IGluaXRpYWxseTsgdGhlIHByb3BvbmVudHMgbG9zdCBpbnRlcmVzdC4gTWF5YmUgdGhhdCdsbCBy ZXR1cm4gc29tZSBkYXkgLSB3ZSBwdXQgc29tZSBtb2R1bGFyaXR5IGludG8gdGhlIGFyY2hpdGVj dHVyZSB0byBhbGxvdyBmb3IgdGhhdC4gV2hhdCB3ZSBoYXZlIG5vdyBhcmUgc29tZSBwZW9wbGUg dGhhdCB3YW50IHRvIHVzZSBjZXJ0cy4gV2hpbGUgbm8gY3JlZGVudGlhbCBtZWNoYW5pc20gaXMg cGVyZmVjdCwgd2UgYmVsaWV2ZSB0aGF0IGNlcnRpZmljYXRlLWJhc2VkIHNlcnZpY2VzIGFyZSBh ZGVxdWF0ZSwgYW5kIGhvcGUgdGhhdCB0aGV5J2xsIGJlIGltcGxlbWVudGVkIHByb3Blcmx5Lg0K DQpUaGUgUC1Bc3NlcnRlZC1JZGVudGl0eSBtZWNoYW5pc20gaW4gUkZDMzMyNSBpcyB0aGUgbWFp biBjdWxwcml0IGZvciByYWlzaW5nIHRoZSBkcmVhZCBzcGVjdGVyIG9mIGxvY2FsIHBvbGljeS4g IioiV2hhdCBpcyBsb2NhbCBwb2xpY3ksIGFzIHRoZSBzcGVjIHNheXMsIGlzIHRoZSBkZWNpc2lv biBvZiB3aGV0aGVyIHlvdSBleHRyYWN0IHRoZSBpZGVudGl0eSBmcm9tIFBBSSBvciB0aGUgRnJv bSIgaXMgYSBwZXJmZWN0IGV4YW1wbGUgb2YgZmFpbGluZyB0byBlbnN1cmUgaW50ZXJvcGVyYWJp bGl0eS4gSXQgaXMgZXhhY3RseSB0aGUgc29ydCBvZiB0aGluZyB0aGF0IG5lZWRzIHRvIGhhdmUg ZGV0ZXJtaW5hY3kgaW4gc291cmNlcyBvZiBpbmZvcm1hdGlvbi4gVGhlIGNvbmNlcHQgb2YgImxv Y2FsIiBwb2xpY3kgZm9yIHN1Y2ggYW4gYWN0aW9uIGlzIGFuIGV4cGxpY2l0IHN0YXRlbWVudCB0 aGF0IGEgcGFydGljaXBhbnQgaGFzIHN0ZXBwZWQgb3V0c2lkZSB0aGUgZm91ciB3YWxscyBvZiB0 aGUgc3RhbmRhcmRpemF0aW9uIHByb2Nlc3MuKiIgV2VsbCwgbG9vay4gUkZDMzMyNSAod2hpY2gg aW4gdHVybiByZWxpZXMgb24gUkZDMzMyNCkgaXMgYSB3ZWlyZCBiZWFzdC4gUEFJIGlzIHNwZWNp ZmllZCBvbmx5IGZvciB1c2UgaW4gYSBjbG9zZWQgYW5kIHRydXN0ZWQgZW52aXJvbm1lbnQgKG9m IHRoZSBraW5kIGRlc2NyaWJlZCBieSBSRkMzMzI0KS4gSWYgeW91IGFyZSBpbiBvbmUgb2YgdGhv c2UgZW52aXJvbm1lbnRzLCB5b3Uga25vdyB0aGF0IHlvdSBhcmUgLSBJIHRyaWVkIHRvIGV4cGxh aW4gdGhpcyBpbiB0aGUgcmVzcG9uc2UuIEknbSBub3QgZ29pbmcgc3BlbmQgbXVjaCB0aW1lIGRl ZmVuZGluZyBSRkMzMzI0LzU7IGl0cyBkZXBsb3ltZW50IGlzIHNvbWV0aGluZyB0aGF0IG11c3Qg YmUgbWFuYWdlZCwgbm90IGVuZG9yc2VkLiBUaGUgdGV4dCB3ZSBoYXZlIGFib3V0IHRoaXMgaXMg dGhlIGJlc3Qgd2F5IHdlIGNvdWxkIGFncmVlIHRvIG1hbmFnZSBpdC4gTGl0ZXJhbGx5IGF0IHRo ZSBsYXN0IElFVEYsIEkgcHV0IHVwIHNsaWRlcyBhYm91dCB0aGlzIGFnYWluLCBhc2tpbmcgaWYg d2Ugd2FudGVkIHRvIGhhdmUgc29tZSBleHBsaWNpdCBpbmRpY2F0aW9uIGluIFBBU1Nwb3JUIHRo YXQgd2Ugd2VyZSB1c2luZyBQQUkgcmF0aGVyIHRoYW4gRnJvbSB0byBkZXJpdmUgdGhlIGlkZW50 aWZpZXIuIFRoZSBhbnN3ZXIgb25jZSBhZ2FpbiB3YXMgbm8uIEkgY2FuIGltYWdpbmUgaWYgeW91 IGRvbid0IGRlYWwgd2l0aCBQQUkgaW4gZXZlcnlkYXkgbGlmZSB3aHkgeW91IG1pZ2h0IHRoaW5r IHRoaXMgd291bGQgbGVhZCB0byBpbnRlcm9wIGZhaWx1cmVzLiBCdXQgUkZDMzMyNSBpcyB3aGF0 IGl0IGlzLCBhbmQgd2UncmUganVzdCB0cnlpbmcgdG8gd29yayBhcm91bmQgaXRzIHdlaXJkIGNv bnN0cmFpbnRzLiBBbnl3YXksIHRoZSB3b3JraW5nIGdyb3VwIHRoaW5rcyB3aGF0IHdlIGhhdmUg d29ya3MuIFRoaXMgaXMgbm90IGFuIHVuY29uc2lkZXJlZCBkZWNpc2lvbi4NCg0KQSBjb3VwbGUg b3RoZXIgcmFuZG9tIHBvaW50czoNCg0KSW4gdGVybXMgb2Ygd2hldGhlciB0aGUgY2l0YXRpb24g b2YgIGEgZGlzY3Vzc2lvbiBvZiBob3cgdG8gaFJGQzI4MTggaXMgYWRlcXVhdGUgZm9yYW5kbGUg bmFtZSBzdWJvcmRpbmF0aW9uIC0gd2UgY291bGQgdXBncmFkZSB0aGF0IHRvIGNpdGluZyBSRkM1 OTIyLCBhbmQgaW4gcGFydGljdWxhciBwb2ludGluZyB0byA3LjIuIE9sbGUgYWxyZWFkeSBhc2tl ZCBmb3IgdGhhdC4gDQoNCiJUbyBtYXhpbWl6ZSBlbmQtdG8tZW5kIHNlY3VyaXR5LCBpdCBpcyBv YnZpb3VzbHkgcHJlZmVyYWJsZSBmb3IgZW5kLXN5c3RlbXMgdG8gYWNxdWlyZSB0aGVpciBvd24g Y3JlZGVudGlhbHMiIHdvcmtzIGZvciBtZS4NCg0KIkkgbWVhbnQgdGhhdCBmb3IgdGhlIG5leHQg dXNlIG9mIGlkZW50aXR5IChqdXN0IGJlbG93LCkgdGhlICd0aGF0JyBpc24ndCBhIGNsZWFyIHJl ZmVyZW5jZSB0byBtZS4gSSB3YXMgY29tbWVudGluZyBvbiBhbWJpZ3VvdXMgd3JpdGluZywgbm90 IHRoZSBtZWFuaW5nIG9mIHRoZSB0ZXJtIGlkZW50aXR5LiIgKDFzdCBwYXJhIDUuMSkgSSB0aGlu ayBpdCdzIGNsZWFyLg0KDQoiKE15IHJldmlldyBtaXNzZWQgdGhlIHR5cG86ICAid2hlbiBlYWNo IGFuIGhlYWRlciIpIiAtIFllYWgsIEkgc3BvdHRlZCB0aGF0IHRvbyB3aGVuIEkgd2FzIGdvaW5n IHRocm91Z2ggeW91ciByZXZpZXcgaW5pdGlhbGx5LiBJdCdzIGZpeGVkIGluIHRoZSBuZXh0IHYu DQoNCiJHb29nbGUgY2VydGFpbmx5IGRvZXMgbm90IHByb2R1Y2UgcmVzdWx0cyB0aGF0IHNob3dz IGl0IGFzIGFiIG90aGVyd2lzZS1jb21tb24gdGVybS4iIEdvb2dsaW5nIEkgZ2V0IG5vIHNob3J0 YWdlIG9mIHNwZWNzIG9uIGNlcnRpZmljYXRlIGVucm9sbG1lbnQgKGxpa2UsIHNheSwgUkZDMjc5 Nywgb3IgUkZDNDIxMCwgb3IgUkZDQzUyNzIsIG9yIFJGQzY0MDIsIG9yIFJGQzcwMzApLiBCdXQg aWYgdGhlcmUncyB0byBiZSBhIGNpdGUgaGVyZSwgaXQnbGwgYmUgdG8gc3Rpci1jZXJ0cywgd2hp Y2ggdXNlcyB0aGUgdGVybSBsaWJlcmFsbHkuDQo= --_002_D3E298EB1A9ECEjonpetersonneustarbiz_-- From nobody Wed Aug 24 00:32:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1306B12D591 for ; Wed, 24 Aug 2016 00:32:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pCo1-yeSyUVe for ; Wed, 24 Aug 2016 00:32:19 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B13212D1E7 for ; Wed, 24 Aug 2016 00:32:19 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u7O7OCB0021436; Wed, 24 Aug 2016 03:32:15 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=dZXnxiDX3I/UqAJHCWxh3aTKHYcGPONR1+d/dCT61LY=; b=1ATFtnDWtkWKChVayxK410KXdVuNgA4OMkRUd7Qzo2b9h+xRjFVnIF7BdjbU8zFB4Fzt NFRtacKjg/emoe3uDo4gh45bV/ZvIYYJ3SIzq3OO8IYauEVvT92+DBsE4YS9Xp3JaBIc fGhZy7s88gNjpa0/tjubgkytPukj0kPUVS4WtLxDuv1EOLdGcLjzVXXcQhg1GsyDF+ZZ V8cExcYz1PvF43dx0lPMU3o98o+BpXAe8ksCZ6Cn4kqqJaCf4KRN0a+/e87n3KAmskfQ Ml4vjbGGyo0DN7Q9zWPJIr6abafbKuouhQW+4nNy9srQjKq1tqC1JYxoEgM6Ni2AlrmY OA== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24xkhaj71v-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Wed, 24 Aug 2016 03:32:15 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 03:32:15 -0400 From: "Peterson, Jon" To: Paul Kyzivat , "stir@ietf.org" Thread-Topic: [stir] Review of: draft-ietf-stir-rfc4474bis-10 Thread-Index: AQHR8fCmKQLsUYw9dka3+jdXHWkJhKBGVbYAgAd9kQCAAPWxAIAAinMAgAAFyoCAAW8bAIAG1MMA Date: Wed, 24 Aug 2016 07:32:15 +0000 Message-ID: References: <7594FB04B1934943A5C02806D1A2204B4BC231EA@ESESSMB209.ericsson.se> <7594FB04B1934943A5C02806D1A2204B4BC2338A@ESESSMB209.ericsson.se> <58d5ff69-8135-69f6-4191-52f33c6029d5@alum.mit.edu> In-Reply-To: <58d5ff69-8135-69f6-4191-52f33c6029d5@alum.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <924D9A3F6BA6C0468996B0AC7DC32AE5@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240067 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 07:32:21 -0000 Okay, okay, we will endeavor to improve the "header" terminology here. Jon Peterson Neustar, Inc. On 8/19/16, 9:13 AM, "stir on behalf of Paul Kyzivat" wrote: >On 8/18/16 2:19 PM, Christer Holmberg wrote: >> >> >>>From my experience as GenART reviewer, I can say that usage of >>>consistent >terminology is something that the whole IETF suffers from. >>>But, it=B9s getting better :) >> >> The usage of inconsistent terminology, that is. > >+1 > >For the specific case of header vs. header field vs. header field >parameter, these have long been used in a sloppy way. (And I admit to >being a frequent offender.) > >Also note that while "header field" is used widely in 3261 it is never >defined. By context it is clear that it means the same as the abnf rule >"message-header". > >Nor is there any definition of "header" in an unqualified form in 3261, >nor (afaik) any use of that. > >In informal conversation it is common to use "header" in lieu of >"message-header"/"header field", and I would be shocked if its use ever >causes any confusion. > >I am in favor of cleaning up usage for consistency, using "header field" >or "header field parameter" when appropriate. But I consider this an >editorial issue, not a semantic issue. > > Thanks, > Paul > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 24 00:34:07 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A190212D1E7 for ; Wed, 24 Aug 2016 00:34:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Q41CYzCSb-I for ; Wed, 24 Aug 2016 00:34:04 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 717E312B035 for ; Wed, 24 Aug 2016 00:34:03 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7O7X3ff018030; Wed, 24 Aug 2016 03:33:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=wNWMYlG8wlpCKCnKWWgARVha5pPuIY1Q9o2IU+CRjUM=; b=Dz2cDpCh3KqciWfI7LYYvtFoZSBEAW+swMAvaQkOWOotg/795lBjd8wn4Du7uICzrH6C U78mo2Sr2yh7hvcxIKvF/CwhMJibPoT1cD9WArhvkp70m7xfMxTwR7d6IH8JmdzlZNWM pAszyR25UbK/iC6ix8Hi7lagzder3i+UKwDF0bz8N+NQXjYZDg4DBi9jMBat2LVZ9sGk pOfIAawaJurLyg9Y0OY7fu1o/Vn57N/Tv+Gv80qXltHERkD1SZRKrrOgrXNH3om7nLyl AXU38jXUcJc9sdWTVA4V0w21HCukWYqoJ5QmQil3o/Tc3NWUqhA3IdSuAii9WPLLDmur LQ== Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24xhuusgg3-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Wed, 24 Aug 2016 03:33:59 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 03:33:53 -0400 From: "Peterson, Jon" To: Christer Holmberg , "dcrocker@bbiw.net" , Eric Rescorla Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR/dncr77vwNs+2UWBNdjjYYBmLQ== Date: Wed, 24 Aug 2016 07:33:52 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> <3b89d32f-3090-d883-b0d1-26c021f94ce9@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC35CC8@ESESSMB209.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B4BC35CC8@ESESSMB209.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: text/plain; charset="us-ascii" Content-ID: <529F9F213363854A8326E4B470B5C4D6@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240068 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 07:34:05 -0000 >I guess Jon should reply to that question, but one reasons was related to >the suggestion (I don't think that WG has made a decision, but please >correct me if I'm wrong) that it should be optional to send the headers >representation of the JWS, as that information (cipher suite etc) can be >found in other SIP elements. What I see minuted from IETF 96 as a decision for this question was "keep what we have now," in other words, keep "canon" optional. As long as "canon" is optional, then we need at least to have the ability to convey "alg" and "ppt" in the Identity header (field!). Practically speaking though, "alg" exists only to give us some flexibility in case it turns out in the future that the one algorithm we've specified won't work for us. I doubt "alg" will be present over the wire much. > However, Appendix F of RFC 7575 is unclear on whether it's allowed >remove the headers representation from the JWS - the Appendix seems to >only talk about not sending the payload representation (which, in the >case of SIP, can also be found in other SIP elements). So, there could be >cases were one would only send the signature representation of the JWS. RFC7515, you mean. And yes, it basically just says "you can have detachable content" without detailing what that means. The new text in rfc4474bis-11 will, as promised, go into more detail about this, and furnish an example. Jon Peterson Neustar, Inc. >=20 > >Regards, > >Christer > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 24 00:38:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B12112D0E5 for ; Wed, 24 Aug 2016 00:38:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.69 X-Spam-Level: X-Spam-Status: No, score=-102.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PA1myjOPpmRu for ; Wed, 24 Aug 2016 00:38:29 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 974CD12B035 for ; Wed, 24 Aug 2016 00:38:29 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7O7X810003216; Wed, 24 Aug 2016 03:38:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=neustar.biz; bh=0A4lTt2QhC2OzLMGSV/Em32fJ3Dk8X22IhdbuYLLRJE=; b=ug/YoMfJFrQoXs9X4Q4DWmuxpTNwxJdksdCTIiqDY1GchW/MKBMHo6JWw4nIPfegaMlc Lcym+9x7mbskthJxctoDvpMYNxiR4Wkh6YxK1kLlZuCggjNXGUkzorXEhouCz6JWF9iG UwZL4TBy1WgCgRzBTwutRcdhmoZJq0Cp74ypQG6jJGHs8dwmDKDBW5Jwc8/89tEs0jh4 gfYbvHxjUwJhbqhVdVBlp0aljzJg40e5g7+PJdCuIEAjKz8Kb5KDIh4CP64LLfEM2EaV yqFFacSjMyQQ7E8DL77rOXGhgFx6Iiy3b5khLSRt9a+QclIEQby6wZZEbPvHCq+G0vWO gA== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24xj0j29nt-2 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Wed, 24 Aug 2016 03:38:28 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 03:38:27 -0400 From: "Peterson, Jon" To: David Frankel , "stir@ietf.org" Thread-Topic: [stir] My Editorial Suggestions on RFC4474bis Thread-Index: AdH7z7eNJwVvVOq8Rp+FvPvqZYjpxQB8aHMA Date: Wed, 24 Aug 2016 07:38:26 +0000 Message-ID: References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> In-Reply-To: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: multipart/alternative; boundary="_000_D3E1B6B11A8587jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240068 Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 07:38:33 -0000 --_000_D3E1B6B11A8587jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi David, You are correct that the first sentence of Section 3 sort of lumps robocall= ing, voicemail hacking, and swatting into one bucket, and that "enable" doe= sn't fit all the contents of that bucket equally well. Voicemail hacking ("= News of the World" style) is directly enabled by impersonation, you can't d= o it without impersonation. I think I might say instead that these practice= s "commonly leverage" an attacker's ability to impersonate someone else's i= dentity. I think though I'm going to end up removing this text from the spe= c anyway, and instead slightly amplifying the text in the introduction abou= t RFC7340. As to whether the mechanism described in the document "provides a strong id= entity system for detecting attempted impersonation," I'm afraid I can't ag= ree with your reasons for saying that is incorrect. A lack of implementatio= n would not change whether or not the -document- describes such a system. T= he presence or absence of an Identity header from any given SIP message wou= ldn't change that either. This is a sentence about a document, not about a = deployment. But again, I think this text will likely be removed for unrela= ted reasons. The specification is very careful to say that it does not protect caller na= me, but it does so by saying that it doesn't protect display-name (the text= you indicate in 12.6), which is the way you carry a caller name in SIP. Th= ere is no other commentary of any kind about how systems might derive calle= r name in this specification, and I'd hesitate to introduce some. The text = in the second paragraph of 12.6 serves a very different purpose than the pa= ragraph you propose to replace it. I don't see any harm in noting that tele= phone numbers are sometimes used to derive display names, but I see no just= ification for having this specification deliver guidance on what sort of na= me databases consumers should or should not trust. I think some of your concerns about anonymity demonstrate how we use the te= rm differently in SIP than we might in everyday discourse. If you "achieve = true anonymity by spoofing somebody else's phone number (often, in fact, ju= st random numbers)" you are still spoofing a phone number. Your ability to = spoof telephone numbers enables that. What it is to claim anonymity in SIP = is to not divulge an individual identifier for yourself, usually by using i= nstead some kind of privacy service which sets your identity to something t= hat makes it clear that you want to remain anonymous. Impersonating random = telephone numbers is different - it is still impersonating numbers. As the = Privacy Considerations state, and state correctly I believe, "None of the r= elevant attacks, all of which rely on the attacker taking on the identity o= f a victim or hiding their identity using someone else's identity, are enab= led by anonymous identity." As to the problem of abusive users obtaining telephone numbers "which they = can authenticate, but which still are ambiguous as to their ownership," thi= s is noted in the section on "Authorization and Transitional Strategies," a= s are most of the similar concerns you raise here. We all know, for example= , that security vulnerabilities could allow attackers to compromise devices= that could make calls which possess totally valid credentials. No one here= thinks secure signaling is a silver bullet. However, the barrier to entry = for populating a From header field, versus compromising a device, is very d= ifferent. Similarly, the barrier to entry to acquiring "ambiguous" telephon= e numbers is surely higher than just putting whatever comes to mind in a Fr= om header field. The differences are real; I don't think we're overselling = them. While I do agree that the STIR charter considers "greenfield" SIP URIs out = of scope, we long ago made a consensus decision in this working group not t= o bar that text from rfc4474bis or any other proposals for solutions here. = STIR does not require this to solve its immediate threat model. However, as= we looked at gatewaying and so on, we quickly saw that there were going to= be cases where such identifiers would appear. I don't think it constitutes= much of a distraction, and in fact, I'd say the solution would be incomple= te without it. Your nits are appreciated - this text is getting a pretty thorough errata-v= etting at this point. Thanks, Jon Peterson Neustar, Inc. From: stir > on behalf = of David Frankel > Organization: ZipDX LLC Date: Sunday, August 21, 2016 at 10:17 AM To: "stir@ietf.org" > Subject: [stir] My Editorial Suggestions on RFC4474bis Since my last notes, I=92ve gotten some constructive feedback here and priv= ately. Now, hoping to also be constructive, I want to volunteer some commen= ts about specific content in the 4474bis document. I=92ll preface this as follows: My interest is in how, and to what extent, = the proposed functionality will address abuse of the public telephone netwo= rk. By =93public telephone network=94 I mean that evolving set of networks and = technologies which permit any party to make a =93telephone call=94 to any o= ther party, from and to anywhere on the globe, using conventional telephone= number addressing and involving either conventional (circa 1970, perhaps?)= telephones, or something emulating such an instrument (mobile phone, smart= phone, web phone, IP phone, etc.). If we could start over today, we=92d no= doubt design the system completely differently, but with an installed base= of perhaps six or seven billion endpoints and associated addresses, and st= ill growing, it seems likely that this network is still some distance from = retirement. By =93abuse=94 I mean (1) the use of the network to defraud, steal from, or= deny service to a call recipient; (2) placing of programmatic unsolicited = marketing-related and similar calls that, intentionally or not, annoy or ha= rass a call recipient. I note that the prevalence of these abuses compromis= es the beneficial uses of the network by promoting suboptimal behaviors on = the part of telephone subscribers (refusing to answer any call for fear it = is an abusive call; sending all or most calls to voice-mail or CAPTCHA to a= void abusive calls; etc.); this impedes the flow and utility of good (non-a= busive) calls. Rather than parsing the document section by section, I=92ve structured my c= omments categorically since several of my suggestions touch in multiple pla= ces. OBJECTIVES / PURPOSE I want to reiterate some text from the SIP WG charter because I need to con= firm that we are all on the same page regarding our goals. It states: =93Si= nce it has become fairly easy to present an incorrect source telephone numb= er, a growing set of problems have emerged over the last decade. As with em= ail, the claimed source identity of a SIP request is not verified, permitti= ng unauthorized use of the source identity as part of deceptive and coerciv= e activities, such as robocalling (bulk unsolicited commercial communicatio= ns), vishing (voicemail hacking, and impersonating banks) and swatting (imp= ersonating callers to emergency services to stimulate unwarranted large sca= le law enforcement deployments). In addition, use of an incorrect source te= lephone number facilitates wire fraud or can lead to a return call at premi= um rates.=94 (Paragraph 1) And =93As its priority mechanism work item, the = working group will specify a SIP header-based mechanism for verification th= at the originator of a SIP session is authorized to use the claimed source = telephone number, where the session is established with SIP end to end.=94 = (Paragraph 3) That strikes me as a noble undertaking and I=92m reading the document in th= at context. 4474bis states at 3. Background: =93Per [RFC7340], problems such as robocal= ling, voicemail hacking, and swatting are enabled by an attacker's ability = to impersonate someone else.=94 I don=92t agree that RFC7340 states that th= ese abuses are =93enabled=94 by the =93ability to impersonate someone else.= =94 First, =93enabled=94 implies that if there were no such ability, then t= hese attacks would be =93disabled=94 and it isn=92t that cut and dried. Imp= ersonation =93facilitates=94 (or as the charter states, is =93part of=94) d= eceptive and coercive activities. Second, RFC7340 is explicit that both imp= ersonation and obfuscation (or obscuration) contribute to the problems. At = Page 4, it says: =93In general, number spoofing is used in two ways: impers= onation and anonymization.=94 When explaining the context and how 4474bis fits, caution and precision are= important. Here=92s my attempt at replacing the first paragraph of section= 3: =93Per [RFC7340], attackers often take advantage of the current ease with w= hich calling telephone numbers can be spoofed, and the singular reliance so= me call recipients place on that value. This allows abuse, for example, of = a voicemail service that compares the identity of the caller to a whitelist= before determining whether it should allow the caller access to recorded m= essages. Another example: an Internet telephone application that displays t= he calling party number (and/or an associated name retrieved from a local d= atabase) of a caller, which a human may review to make a policy decision be= fore answering a call. In both of these cases, attackers might attempt to c= ircumvent these authorization policies through impersonation. If the callin= g party number could be verified =96 that is, if the receiving person or ap= plication could know with reasonable certainty that the calling number was = not spoofed =96 then additional screening could be bypassed. The voicemail = service could give the caller direct access to the mailbox without demandin= g a password; the Internet telephone application could tell the human that = less stringent verbal verification procedures can be applied because we hav= e confidence that the caller is who they claim to be.=94 Obviously any well-designed use of current calling number information shoul= d recognize how readily this can be spoofed and should not operate without = some additional form of verification. It is incorrect to say =93The mechanism described in this document provides= a strong identity system for detecting attempted impersonation in SIP requ= ests.=94 What is strong about this mechanism is detecting that that the cal= ler is authorized to use the claimed phone number. Since most calls, for th= e foreseeable future, will lack the Identity header, the mechanism provides= no real means of detecting attempted impersonation. Whether a call without= an Identity header is or is not an impersonation cannot be determined. Cer= tainly a call with an Identity header that does not verify can be assumed t= o be either an impersonation or a technical or operational failure, but it = seems unlikely that impersonators would go to the trouble of sending an Ide= ntity header that will not verify. There is some related discussion currently in section 12.5, but I believe t= his needs to be brought forward and made more explicit because the =93trans= ition=94 will not be quick. We should also be careful not to assert that this mechanism universally pro= tects the CALLER NAME that is presented for many public network calls. If t= he NAME is being retrieved from a LOCAL DATABASE (such as the user=92s cont= act list in a mobile phone) there is less concern. But if the name is retri= eved, as it so often currently is in real-world deployments, from some netw= ork database populated by any number of different contributors (including a= busers), this mechanism provides no vehicle to prevent a caller with a veri= fied NUMBER from linking that number to a NAME like =93Card Services=94 or = =93FBI=94 or =93Frankel David=94 when they are in fact none of the above. T= he existing text says =93the calling party number (and/or Caller-ID) of a c= aller=94 but =93Caller-ID=94 is not defined and is ambiguous. Section 12.6 discusses signing of the Display Name; the text indicates this= is out of scope but offers some thoughts. I think Display Name generally i= s out of scope (RFC7340 states: =93This effort does not consider how the di= splay name of the caller might be validated.=94) so 4474bis shouldn=92t ind= icate what action =93should=94 or =93could=94 be taken with respect to that= field. Note that the Display Name field is only applicable for end-to-end = SIP calls. I suggest replacing 12.6 paragraph two as follows: =93Many current telephony deployments use the calling number to derive an a= lphanumeric Calling Name for display to the called party. Given the nature = of many of these deployments, even a verified calling number could result i= n the display of a falsified or impersonated name. The verified calling num= ber will be most useful when the name is derived from a local database (suc= h as a mobile phone contact list) maintained and trusted by the call recipi= ent.=94 We still need a discussion of the other half of the problem (per RFC7340), = which is ANONYMIZATION of the calling party. What I see today in 4474bis ad= dresses forms such as =93anonymous@example.com=94 where the caller explicitly declares anonymity. This is really rela= ted to privacy, which is why 4474bis has it in a section with that title. For abusive calls, the calling party generally achieves true anonymity eith= er by spoofing somebody else=92s phone number (often, in fact, just using r= andom numbers, or using a number similar to, but distinct from, the called = number), or by using one or more numbers that they have acquired but which = are challenging to identify (because when called, the number is not answere= d or yields only a vague voice-mail, and/or because the service provider re= sponsible for the number doesn=92t know or won=92t reveal who the actual cu= stomer is). The 3. Background section of 4474bis should include some mention of the ano= nymity problem, just as it discusses impersonation. I suggest: =93Today, be= cause it is easy to originate calls with any value in the From header, abus= ive callers can populate the field with random telephone numbers. Abusive c= allers (and their enabling service providers) are likely to be the last ado= pters of the Identity header. Until the Identity header becomes prevalent a= cross the universe of calls (and that will take some time, since it initial= ly will only apply to end-to-end SIP calls, which are a tiny minority), the= anonymity problem will remain because the abusive calls will be lost in th= e sea of normal (but unauthenticated) calls. Additionally, when a significa= nt number of calls generally ARE authenticated, abusive callers may seek to= obtain telephone numbers which they can authenticate, but which still are = ambiguous as to their ownership. It will be incumbent upon service provider= s and the regimes in which they operate to prevent such abuses (through mea= ns outside the scope of this document). If it is easy and cheap for abusers= to obtain quantities of telephone numbers and associated credentials witho= ut providing true identity information linked to those numbers, they will b= e able to remain anonymous even with valid Identity headers in their calls.= =94 As an aside, there are about six billion valid numbers in the North America= n (+1) Numbering Plan. There are currently probably on the order of one bil= lion of those assigned to end-users. Of the remaining five billion, some fr= action are allocated to service providers already (but unassigned to end-us= ers); the rest are currently unallocated. Abusive callers have, and will pr= obably continue to have, a variety of options for finding numbers they can = use to keep themselves anonymous until all the loopholes are finally closed= . DOMAIN vs. NUMBER AUTHENTICATION The Charter of the STIR Working Group states: =93The STIR working group will specify Internet-based mechanisms that allow= verification of the calling party's authorization to use a particular tele= phone number for an incoming call.=94 (First Sentence) =93The work of this group is limited to developing a solution for telephone= numbers. Expansion of the authorization mechanism to identities using the = user@domain or other name forms is out of scope.=94 (Fifth Paragraph) Given this, 4474bis should not contain, to the extent that it does, referen= ces to authenticating From headers containing alice@example.com or jon@example.com. (These appear re= peatedly in Sections 1, 4, 6, and 7.) There is also text about =93signing f= or a domain.=94 This is explicitly outside of scope, and it distracts from the stated purpo= se of the WG. If nothing else, I think we want the document to read very cl= early, to the greatest extent possible, how the spec is used to achieve the= goal of authenticating telephone numbers. I suggest that other than to briefly reiterate that it is out of scope, all= the references to authentication of domains be removed, and that all examp= les be restricted to that which is in scope (phone numbers). Certainly there is value in what has been (speculatively) documented regard= ing signing for a domain. This material could simply be archived for retrie= val later, when we are ready to tackle that. If there is insistence that it be included here (despite the mandate in the= charter that =93expansion...using user@domain...is out of scope=94), then it should be collected and placed in an appendix o= utside the primary flow of the document. I do realize the value of being fo= rward-looking. At the same time, there is such urgency in getting STIR depl= oyed for telephone numbers that I don=92t think we can afford the distracti= on. I must admit that I personally have had a terrible time reconciling how thi= s all actually functions for telephone numbers. =93Domain=94 appears 81 tim= es in the document and I can=92t tell which, if any, of those occurrences i= s relevant to the telephone number use case. ERRATA In going through the document I encountered a handful of typos. If you sear= ch for each of the text snippets below I think the issue will be apparent. those JSON object in a manner following PASSporT implementation the authentication service at an which contains a JSON representations of and add a corresponding an Identity header to the request is OPTIONAL baseline PASSporT objects in SIP as authentication service creates a PASSporT that uses [=93object=94 is missin= g] verification service performs the procedures above on each [should be =93be= low=94] verifier MUST inspect any optional "ppt" parameter appearing the Step 1, is understood), the verifier follows the procedures [=93supported= =94 instead of =93understood=94] prospect that a verification services could receive The verification of an Identity header does not entail [suggest =93The succ= essful verification=94] encoding of the header and claim component of this it conveys any canonical telephone number formats canonicalization of the numbers and compare them [=93numbers=94 plural?] unless they have some more other implementation-specific way role for a range of telephone and a user agent belonging to Alice included in a PASSporT object in, for example, an "uri" claim. correspond to any field of the SIP request, but then the optional legitimate request for one user is cut-and-pasted into a request consult some sort of directory that indications David Frankel ZipDX=AE LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! --_000_D3E1B6B11A8587jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable

Hi David,

You are correct that the first sentence of Section 3 sort of lumps robocall= ing, voicemail hacking, and swatting into one bucket, and that "enable= " doesn't fit all the contents of that bucket equally well. Voicemail = hacking ("News of the World" style) is directly enabled by impersonation, you can't do it without impersonation. I think I= might say instead that these practices "commonly leverage" an at= tacker's ability to impersonate someone else's identity. I think though I'm= going to end up removing this text from the spec anyway, and instead slightly amplifying the text in the introduction = about RFC7340.

As to whether the mechanism described in the document "provides a stro= ng identity system for detecting attempted impersonation," I'm afraid = I can't agree with your reasons for saying that is incorrect. A lack of imp= lementation would not change whether or not the -document- describes such a system. The presence or absence of an Iden= tity header from any given SIP message wouldn't change that either. This is= a sentence about a document, not about a deployment.  But again, I th= ink this text will likely be removed for unrelated reasons.

The specification is very careful to say that it does not protect caller na= me, but it does so by saying that it doesn't protect display-name (the text= you indicate in 12.6), which is the way you carry a caller name in SIP. Th= ere is no other commentary of any kind about how systems might derive caller name in this specification, and= I'd hesitate to introduce some. The text in the second paragraph of 12.6 s= erves a very different purpose than the paragraph you propose to replace it= . I don't see any harm in noting that telephone numbers are sometimes used to derive display names, but I s= ee no justification for having this specification deliver guidance on what = sort of name databases consumers should or should not trust.

I think some of your concerns about anonymity demonstrate how we use the te= rm differently in SIP than we might in everyday discourse. If you "ach= ieve true anonymity by spoofing somebody else's phone number (often, in fac= t, just random numbers)" you are still spoofing a phone number. Your ability to spoof telephone numbers enables t= hat. What it is to claim anonymity in SIP is to not divulge an individual i= dentifier for yourself, usually by using instead some kind of privacy servi= ce which sets your identity to something that makes it clear that you want to remain anonymous. Impersonating rando= m telephone numbers is different - it is still impersonating numbers. As th= e Privacy Considerations state, and state correctly I believe, "None o= f the relevant attacks, all of which rely on the attacker taking on the identity of a victim or hiding their id= entity using someone else's identity, are enabled by anonymous identity.&qu= ot;

As to the problem of abusive users o= btaining telephone numbers "which they can authenticate, but which sti= ll are ambiguous as to their ownership," this is noted in the section = on "Authorization and Transitional Strategies," as are most of the similar concerns you raise here. We all know, for = example, that security vulnerabilities could allow attackers to compromise = devices that could make calls which possess totally valid credentials. No o= ne here thinks secure signaling is a silver bullet. However, the barrier to entry for populating a From header = field, versus compromising a device, is very different. Similarly, the barr= ier to entry to acquiring "ambiguous" telephone numbers is surely= higher than just putting whatever comes to mind in a From header field. The differences are real; I don't think = we're overselling them.

While I do agree that the STIR charter considers "greenfield"= ; SIP URIs out of scope, we long ago made a consensus decision in this work= ing group not to bar that text from rfc4474bis or any other proposals for s= olutions here. STIR does not require this to solve its immediate threat model. However, as we looked at gatewaying a= nd so on, we quickly saw that there were going to be cases where such ident= ifiers would appear. I don't think it constitutes much of a distraction, an= d in fact, I'd say the solution would be incomplete without it.

Your nits are appreciated - this text is getting a pretty thorough err= ata-vetting at this point.

Thanks,

Jon Peterson
Neustar, Inc.

From: stir <stir-bounces@ietf.org> on behalf of David Frank= el <dfrankel@zipdx.com>
Organization: ZipDX LLC
Date: Sunday, August 21, 2016 at 10= :17 AM
To: "stir@ietf.org" <stir@i= etf.org>
Subject: [stir] My Editorial Sugges= tions on RFC4474bis

Since my last notes, I=92ve gotten some constructive= feedback here and privately. Now, hoping to also be constructive, I want t= o volunteer some comments about specific content in the 4474bis document.

 

I=92ll preface this as follows: My interest is in ho= w, and to what extent, the proposed functionality will address abuse of the= public telephone network.

 

By =93public telephone network=94 I mean that evolvi= ng set of networks and technologies which permit any party to make a =93tel= ephone call=94 to any other party, from and to anywhere on the globe, using= conventional telephone number addressing and involving either conventional (circa 1970, perhaps?) telephones, or so= mething emulating such an instrument (mobile phone, smart phone, web phone,= IP phone, etc.). If we could start over today, we=92d no doubt design the = system completely differently, but with an installed base of perhaps six or seven billion endpoints and assoc= iated addresses, and still growing, it seems likely that this network is st= ill some distance from retirement.

 

By =93abuse=94 I mean (1) the use of the network to = defraud, steal from, or deny service to a call recipient; (2) placing of pr= ogrammatic unsolicited marketing-related and similar calls that, intentiona= lly or not, annoy or harass a call recipient. I note that the prevalence of these abuses compromises the beneficial uses= of the network by promoting suboptimal behaviors on the part of telephone = subscribers (refusing to answer any call for fear it is an abusive call; se= nding all or most calls to voice-mail or CAPTCHA to avoid abusive calls; etc.); this impedes the flow and utilit= y of good (non-abusive) calls.

 

Rather than parsing the document section by section,= I=92ve structured my comments categorically since several of my suggestion= s touch in multiple places.

 

OBJECTIVES / PURPOSE

 

I want to reiterate some text from the SIP WG charte= r because I need to confirm that we are all on the same page regarding our = goals. It states: =93Since it has become fairly easy to present an incorrec= t source telephone number, a growing set of problems have emerged over the last decade. As with email, the clai= med source identity of a SIP request is not verified, permitting unauthoriz= ed use of the source identity as part of deceptive and coercive activities,= such as robocalling (bulk unsolicited commercial communications), vishing (voicemail hacking, and impersonating = banks) and swatting (impersonating callers to emergency services to stimula= te unwarranted large scale law enforcement deployments). In addition, use o= f an incorrect source telephone number facilitates wire fraud or can lead to a return call at premium rate= s.=94 (Paragraph 1) And =93As its priority mechanism work item, the working= group will specify a SIP header-based mechanism for verification that the = originator of a SIP session is authorized to use the claimed source telephone number, where the session is establish= ed with SIP end to end.=94 (Paragraph 3)

 

That strikes me as a noble undertaking and I=92m rea= ding the document in that context.

 

4474bis states at 3. Background: =93Per [RFC7340], p= roblems such as robocalling, voicemail hacking, and swatting are enabled by= an attacker's ability to impersonate someone else.=94 I don=92t agree that= RFC7340 states that these abuses are =93enabled=94 by the =93ability to impersonate someone else.=94 First, =93enabled=94 imp= lies that if there were no such ability, then these attacks would be =93dis= abled=94 and it isn=92t that cut and dried. Impersonation =93facilitates=94= (or as the charter states, is =93part of=94) deceptive and coercive activities. Second, RFC7340 is explicit that both impersonati= on and obfuscation (or obscuration) contribute to the problems. At Page 4, = it says: =93In general, number spoofing is used in two ways: impersonation = and anonymization.=94

 

When explaining the context and how 4474bis fits, ca= ution and precision are important. Here=92s my attempt at replacing the fir= st paragraph of section 3:

 

=93Per [RFC7340], attackers often take advantage of = the current ease with which calling telephone numbers can be spoofed, and t= he singular reliance some call recipients place on that value. This allows = abuse, for example, of a voicemail service that compares the identity of the caller to a whitelist before determining= whether it should allow the caller access to recorded messages. Another ex= ample: an Internet telephone application that displays the calling party nu= mber (and/or an associated name retrieved from a local database) of a caller, which a human may review to = make a policy decision before answering a call. In both of these cases, att= ackers might attempt to circumvent these authorization policies through imp= ersonation. If the calling party number could be verified =96 that is, if the receiving person or applicati= on could know with reasonable certainty that the calling number was not spo= ofed =96 then additional screening could be bypassed. The voicemail service= could give the caller direct access to the mailbox without demanding a password; the Internet telephone applic= ation could tell the human that less stringent verbal verification procedur= es can be applied because we have confidence that the caller is who they cl= aim to be.=94

 

Obviously any well-designed use of current calling n= umber information should recognize how readily this can be spoofed and shou= ld not operate without some additional form of verification.

 

It is incorrect to say =93The mechanism described in= this document provides a strong identity system for detecting attempted im= personation in SIP requests.=94 What is strong about this mechanism is dete= cting that that the caller is authorized to use the claimed phone number. Since most calls, for the foreseeable fut= ure, will lack the Identity header, the mechanism provides no real means of= detecting attempted impersonation. Whether a call without an Identity head= er is or is not an impersonation cannot be determined. Certainly a call with an Identity header that does n= ot verify can be assumed to be either an impersonation or a technical or op= erational failure, but it seems unlikely that impersonators would go to the= trouble of sending an Identity header that will not verify.

 

There is some related discussion currently in sectio= n 12.5, but I believe this needs to be brought forward and made more explic= it because the =93transition=94 will not be quick.

 

We should also be careful not to assert that this me= chanism universally protects the CALLER NAME that is presented for many pub= lic network calls. If the NAME is being retrieved from a LOCAL DATABASE (su= ch as the user=92s contact list in a mobile phone) there is less concern. But if the name is retrieved, as it s= o often currently is in real-world deployments, from some network database = populated by any number of different contributors (including abusers), this= mechanism provides no vehicle to prevent a caller with a verified NUMBER from linking that number to a NAME= like =93Card Services=94 or =93FBI=94 or =93Frankel David=94 when they are= in fact none of the above. The existing text says =93the calling party num= ber (and/or Caller-ID) of a caller=94 but =93Caller-ID=94 is not defined and is ambiguous.

 

Section 12.6 discusses signing of the Display Name; = the text indicates this is out of scope but offers some thoughts. I think D= isplay Name generally is out of scope (RFC7340 states: =93This effort does = not consider how the display name of the caller might be validated.=94) so 4474bis shouldn=92t indicate what ac= tion =93should=94 or =93could=94 be taken with respect to that field. Note = that the Display Name field is only applicable for end-to-end SIP calls. I = suggest replacing 12.6 paragraph two as follows:

        &nbs= p;     

=93Many current telephony deployments use the callin= g number to derive an alphanumeric Calling Name for display to the called p= arty. Given the nature of many of these deployments, even a verified callin= g number could result in the display of a falsified or impersonated name. The verified calling number will be m= ost useful when the name is derived from a local database (such as a mobile= phone contact list) maintained and trusted by the call recipient.=94<= /o:p>

 

We still need a discussion of the other half of the = problem (per RFC7340), which is ANONYMIZATION of the calling party. What I = see today in 4474bis addresses forms such as =93anonymous@example.com=94= where the caller explicitly declares anonymity. This is really related to = privacy, which is why 4474bis has it in a section with that title.

 

For abusive calls, the calling party generally achie= ves true anonymity either by spoofing somebody else=92s phone number (often= , in fact, just using random numbers, or using a number similar to, but dis= tinct from, the called number), or by using one or more numbers that they have acquired but which are challengin= g to identify (because when called, the number is not answered or yields on= ly a vague voice-mail, and/or because the service provider responsible for = the number doesn=92t know or won=92t reveal who the actual customer is).

 

The 3. Background section of 4474bis should include = some mention of the anonymity problem, just as it discusses impersonation. = I suggest: =93Today, because it is easy to originate calls with any value i= n the From header, abusive callers can populate the field with random telephone numbers. Abusive callers (and the= ir enabling service providers) are likely to be the last adopters of the Id= entity header. Until the Identity header becomes prevalent across the unive= rse of calls (and that will take some time, since it initially will only apply to end-to-end SIP calls, whi= ch are a tiny minority), the anonymity problem will remain because the abus= ive calls will be lost in the sea of normal (but unauthenticated) calls. Ad= ditionally, when a significant number of calls generally ARE authenticated, abusive callers may seek to obtain t= elephone numbers which they can authenticate, but which still are ambiguous= as to their ownership. It will be incumbent upon service providers and the= regimes in which they operate to prevent such abuses (through means outside the scope of this document). If= it is easy and cheap for abusers to obtain quantities of telephone numbers= and associated credentials without providing true identity information lin= ked to those numbers, they will be able to remain anonymous even with valid Identity headers in their call= s.=94

 

As an aside, there are about six billion valid numbe= rs in the North American (+1) Numbering Plan. There are currently proba= bly on the order of one billion of those assigned to end-users. Of the rema= ining five billion, some fraction are allocated to service providers already (but unassigned to end-users); the = rest are currently unallocated. Abusive callers have, and will probably con= tinue to have, a variety of options for finding numbers they can use to kee= p themselves anonymous until all the loopholes are finally closed.

 

DOMAIN vs. NUMBER AUTHENTICATION

 

The Charter of the STIR Working Group states:

 

=93The STIR working group will specify Internet-base= d mechanisms that allow verification of the calling party's authorization t= o use a particular telephone number for an incoming call.=94 (First Sentenc= e)

 

=93The work of this group is limited to developing a= solution for telephone numbers. Expansion of the authorization mechanism t= o identities using the user@domain or other name forms is out of scope.=94 = (Fifth Paragraph)

 

Given this, 4474bis should not contain, to the exten= t that it does, references to authenticating From headers containing alice@example.com or jon@example.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) = There is also text about =93signing for a domain.=94

 

This is explicitly outside of scope, and it distract= s from the stated purpose of the WG. If nothing else, I think we want the d= ocument to read very clearly, to the greatest extent possible, how the spec= is used to achieve the goal of authenticating telephone numbers.

 

I suggest that other than to briefly reiterate that = it is out of scope, all the references to authentication of domains be remo= ved, and that all examples be restricted to that which is in scope (phone n= umbers).

 

Certainly there is value in what has been (speculati= vely) documented regarding signing for a domain. This material could simply= be archived for retrieval later, when we are ready to tackle that.

 

If there is insistence that it be included here (des= pite the mandate in the charter that =93expansion...using user@domain...is out of scope=94), = then it should be collected and placed in an appendix outside the primary f= low of the document. I do realize the value of being forward-looking. At th= e same time, there is such urgency in getting STIR deployed for telephone numbers that I don=92t think we can af= ford the distraction.

 

I must admit that I personally have had a terrible t= ime reconciling how this all actually functions for telephone numbers. =93D= omain=94 appears 81 times in the document and I can=92t tell which, if any,= of those occurrences is relevant to the telephone number use case.

 

ERRATA

 

In going through the document I encountered a handfu= l of typos. If you search for each of the text snippets below I think the i= ssue will be apparent.

 

those JSON object in a manner following PASSporT

 

implementation the authentication service at an=

 

which contains a JSON representations of<= /p>

 

and add a corresponding an Identity header to the re= quest

 

is OPTIONAL baseline PASSporT objects in SIP as=

 

authentication service creates a PASSporT that uses = [=93object=94 is missing]

 

verification service performs the procedures above o= n each [should be =93below=94]

 

verifier MUST inspect any optional "ppt" p= arameter appearing the

 

Step 1, is understood), the verifier follows the pro= cedures [=93supported=94 instead of =93understood=94]

 

prospect that a verification services could receive<= o:p>

 

The verification of an Identity header does not enta= il [suggest =93The successful verification=94]

 

encoding of the header and claim component of

 

this it conveys any canonical telephone number forma= ts

 

canonicalization of the numbers and compare them [= =93numbers=94 plural?]

 

unless they have some more other implementation-spec= ific way

 

role for a range of telephone and a user agent belon= ging to Alice

 

included in a PASSporT object in, for example, an &q= uot;uri" claim.

 

correspond to any field of the SIP request, but then= the optional

 

legitimate request for one user is cut-and-pasted in= to a request

 

consult some sort of directory that indications=

 

 

David Frankel

ZipDX=AE LLC

Monte Sereno, CA USA

Tel: 1-800-FRANKEL (1-= 800-372-6535)

Watch Our Video!

 

 --_000_D3E1B6B11A8587jonpetersonneustarbiz_-- From nobody Wed Aug 24 00:49:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34D7E12D50B for ; Wed, 24 Aug 2016 00:49:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NvhuiGtx8EyK for ; Wed, 24 Aug 2016 00:49:36 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5626A12D08D for ; Wed, 24 Aug 2016 00:49:36 -0700 (PDT) X-AuditID: c1b4fb25-8bfff70000001071-38-57bd518c3e3c Received: from ESESSHC022.ericsson.se (Unknown_Domain [153.88.183.84]) by (Symantec Mail Security) with SMTP id 7F.60.04209.C815DB75; Wed, 24 Aug 2016 09:49:34 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.211]) by ESESSHC022.ericsson.se ([153.88.183.84]) with mapi id 14.03.0301.000; Wed, 24 Aug 2016 09:49:32 +0200 From: Christer Holmberg To: "Peterson, Jon" , "dcrocker@bbiw.net" , Eric Rescorla Thread-Topic: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) Thread-Index: AQHR/JI0ubFrdbKggkCO9F2iW0BZU6BWhCyAgAABtACAACpqMP//4L4AgABXHuCAALDnAIAAN+CA Date: Wed, 24 Aug 2016 07:49:31 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC29AD9@ESESSMB209.ericsson.se> <72ca2036-610e-2226-ed4f-34efbf0e9552@dcrocker.net> <31ee21c4-ac59-2dec-3ce2-82ae650ea7c8@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC3506B@ESESSMB209.ericsson.se> <3b89d32f-3090-d883-b0d1-26c021f94ce9@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B4BC35CC8@ESESSMB209.ericsson.se> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.5.160527 x-originating-ip: [153.88.183.16] Content-Type: text/plain; charset="us-ascii" Content-ID: <1CAB0F4928421D4ABEB6715F5EFDD7A4@ericsson.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrIIsWRmVeSWpSXmKPExsUyM2J7iG5f4N5wg2/XVCx+f/rAZrHi9Tl2 izMNlhbL125jcmDxuLTzJJvHkiU/mTx2NDxn9pj8uI05gCWKyyYlNSezLLVI3y6BK6Pz6Rvm gnd8FX9X7mRqYGzj6WLk5JAQMJFo/X2dqYuRi0NIYD2jxNcpc9lBEkICSxglrq2w6WLk4GAT sJDo/qcNEhYRKJd40DYbrIRZQF3ixaM3YLawQKBEz4W/LBA1QRInX7xkh7CjJDbfPcEEYrMI qErMb9rIBjKSV8BK4viOXIhN59gkXk4uALE5BcwlXk+ZAVbOKCAm8f3UGiaIVeISt57MZ4I4 WUBiyZ7zzBC2qMTLx/9YQWxRAT2J719nQ8UVJXaebWeG6NWRWLD7ExuEbS3xbe5zRghbW2LZ wtdgNbwCghInZz5hmcAoPgvJullI2mchaZ+FpH0WkvYFjKyrGEWLU4uTctONjPVSizKTi4vz 8/TyUks2MQIj8uCW36o7GC+/cTzEKMDBqMTD+yBsT7gQa2JZcWXuIUYJDmYlEd5Ir73hQrwp iZVVqUX58UWlOanFhxilOViUxHn9XyqGCwmkJ5akZqemFqQWwWSZODilGhiFV1qv47O+HTO1 9sljwZ1zXYVqZ8Sc+qXgpdaQOevm2ttLKrlkdP6uusRXfFWI59LSoubNU62ULj/5nhP/7OY/ 7gOtv01EVxmtnJe9r0Fk3snFGmrfXB9c6NzsfVFr3xT2k4vXJZi3nMsomTJX799tOYH4P3dC 7327d02G3+vPrivq16YYuqZ4K7EUZyQaajEXFScCAKpiaIvEAgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 07:49:39 -0000 Yes, I mean RFC 7515. For some strange reason I keep on getting the numbers of the RFCs associated with the STIR work wrong all the time :) Regards, Christer On 24/08/16 10:33, "Peterson, Jon" wrote: >>I guess Jon should reply to that question, but one reasons was related to >>the suggestion (I don't think that WG has made a decision, but please >>correct me if I'm wrong) that it should be optional to send the headers >>representation of the JWS, as that information (cipher suite etc) can be >>found in other SIP elements. > >What I see minuted from IETF 96 as a decision for this question was "keep >what we have now," in other words, keep "canon" optional. As long as >"canon" is optional, then we need at least to have the ability to convey >"alg" and "ppt" in the Identity header (field!). Practically speaking >though, "alg" exists only to give us some flexibility in case it turns out >in the future that the one algorithm we've specified won't work for us. I >doubt "alg" will be present over the wire much. > >> However, Appendix F of RFC 7575 is unclear on whether it's allowed >>remove the headers representation from the JWS - the Appendix seems to >>only talk about not sending the payload representation (which, in the >>case of SIP, can also be found in other SIP elements). So, there could be >>cases were one would only send the signature representation of the JWS. > >RFC7515, you mean. And yes, it basically just says "you can have >detachable content" without detailing what that means. The new text in >rfc4474bis-11 will, as promised, go into more detail about this, and >furnish an example. > >Jon Peterson >Neustar, Inc. > >>=20 >> >>Regards, >> >>Christer >> >>_______________________________________________ >>stir mailing list >>stir@ietf.org >>https://www.ietf.org/mailman/listinfo/stir > From nobody Wed Aug 24 01:19:11 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C0FBB12B042; Wed, 24 Aug 2016 01:19:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.30.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com> Date: Wed, 24 Aug 2016 01:19:07 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 08:19:08 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Authenticated Identity Management in the Session Initiation Protocol (SIP) Authors : Jon Peterson Cullen Jennings Eric Rescorla Chris Wendt Filename : draft-ietf-stir-rfc4474bis-11.txt Pages : 44 Date : 2016-08-24 Abstract: The baseline security mechanisms in the Session Initiation Protocol (SIP) are inadequate for cryptographically assuring the identity of the end users that originate SIP requests, especially in an interdomain context. This document defines a mechanism for securely identifying originators of SIP requests. It does so by defining a SIP header field for conveying a signature used for validating the identity, and for conveying a reference to the credentials of the signer. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rfc4474bis-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Aug 24 01:26:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67F9E12D090 for ; Wed, 24 Aug 2016 01:25:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SxL8rL7jm877 for ; Wed, 24 Aug 2016 01:25:57 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A40EA12D08D for ; Wed, 24 Aug 2016 01:25:57 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7O8OTix010438 for ; Wed, 24 Aug 2016 04:25:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=0r7eDMGkuxH8iTiG5dRwZWnt2GaqPf/EVk/CpBwgMLo=; b=2e32n63YliJCCOpM7mw4b/hXvNvizBLY2y3r2R8n6zrwKZK76cIzKwB4dgTnoe4ItQ2y JoZQpDwTBLjIxj2BuSc7XOhjU8V9EGmX9PfF2L1w7AK51n5gQxkIbEa8lHtubhIIAiqc zSPnKTrEKduTaay+86OZ0yydJQ2p6Z3/w0RNq36PxDupRAhHbXdCMexDklknGXWOVBuv i2F7KxGAJ1pN+rKyrDdMNJ7mBqFuthcJeVZVIEtzfv1weWo2fFXuCts3MhH2AVciol5W +MHLS1OkCIKYhjLxe0g8RhW1VY+qPCaAL6ALQIAQMiyjitsWD6Judkytvcsm5DClM6EA EA== Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 24xj0j2ejd-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT) for ; Wed, 24 Aug 2016 04:25:56 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 04:25:55 -0400 From: "Peterson, Jon" To: "stir@ietf.org" Thread-Topic: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt Thread-Index: AQHR/eA43NywUKPnKEKZYjh7TBCYkaBXlDaA Date: Wed, 24 Aug 2016 08:25:55 +0000 Message-ID: References: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com> In-Reply-To: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240077 Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 08:25:59 -0000 This new iteration of rfc4474bis has been provided (by special request) largely so people can see the example and the "canon" usage. If either of those needs some more work, let's talk about it. Though of course we can talk about anything else people want to talk about too. Jon Peterson Neustar, Inc. On 8/24/16, 1:19 AM, "stir on behalf of internet-drafts@ietf.org" wrote: > >A New Internet-Draft is available from the on-line Internet-Drafts >directories. >This draft is a work item of the Secure Telephone Identity Revisited of >the IETF. > > Title : Authenticated Identity Management in the >Session Initiation Protocol (SIP) > Authors : Jon Peterson > Cullen Jennings > Eric Rescorla > Chris Wendt > Filename : draft-ietf-stir-rfc4474bis-11.txt > Pages : 44 > Date : 2016-08-24 > >Abstract: > The baseline security mechanisms in the Session Initiation Protocol > (SIP) are inadequate for cryptographically assuring the identity of > the end users that originate SIP requests, especially in an > interdomain context. This document defines a mechanism for securely > identifying originators of SIP requests. It does so by defining a > SIP header field for conveying a signature used for validating the > identity, and for conveying a reference to the credentials of the > signer. > > >The IETF datatracker status page for this draft is: >https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ > >There's also a htmlized version available at: >https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-11 > >A diff from the previous version is available at: >https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-rfc4474bis-11 > > >Please note that it may take a couple of minutes from the time of >submission >until the htmlized version and diff are available at tools.ietf.org. > >Internet-Drafts are also available by anonymous FTP at: >ftp://ftp.ietf.org/internet-drafts/ > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 24 06:28:17 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5896612DD5C for ; Wed, 24 Aug 2016 06:28:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id inEsP59BycQK for ; Wed, 24 Aug 2016 06:28:12 -0700 (PDT) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0688B12DD53 for ; Wed, 24 Aug 2016 06:28:12 -0700 (PDT) Received: by mail-qk0-x232.google.com with SMTP id l2so14403259qkf.3 for ; Wed, 24 Aug 2016 06:28:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=tgOaf5jgsfm5MAh5Z/vEE88seW2cqmI4et734J1R8do=; b=yK1NiLXh73Ci8BgzpZhORUDlHkdTJ1wtXp/CMBMHDBk7X5PxiH8FVQuxeluIdh8HHf xpOoz4hGIpP9bUtSh+qkK+7ZlRhN6VfzYgPJx5hxEv/ZQ7Rb5xWaC+nHvnPSf94+9BUj vTbwZo4opDP/IIJUHOOh02rSbkEjNJQurPSe5SOJupQmrk1qD9eYDI8I170c6oWK9onq LtKLQXl+JRUPdVx01O4w9h66LJC5X6xoamt+YsQuZh1HFOsliIlx3wpij3NkIrYjmNKp OXw4HNEdkrRPJUlEh2zO9WKpbR4wzxh2giaZTNpWmUIIAr0ty+y+RjX9WxiVe+uJFOj6 Nelw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=tgOaf5jgsfm5MAh5Z/vEE88seW2cqmI4et734J1R8do=; b=IxZdtY712OSN1inzfxDB1IGv60ZMOPOHLoi8F5QVdNYyaVGCfLQorDOAwVbv9igX2+ s9rYeJ1F9AYYWN3mRjlh/FLwNK5Ki+FcTdX5Zm5w45OroQbWSoVat9f2EuNO3SPI1d+c kaXKPk+frpb8mXo7BgkReIHw2jCU//g3sq20nlwrlFfbKmL1Rrlgdhv+ZOPdj6NpHVcg y5OoGl5Cg0qvuNSs1RzOIVkmt3kFEc1gBx7dJAkxTT7a3MAloI7H0NOh8GrorLd51tiR MPLRWPNUUAokP0Gci7NrWHGL6nvOl07xSEwapLfgTcsQtvKJdFF0KAAE6Bs29u2CJxMa LTpQ== X-Gm-Message-State: AE9vXwMbpWqQOSX0VUfTCh2OT7VucP0xtlv2sKbYwyxuk2znhb1DF+qUkBIt0Efx3zUMSw== X-Received: by 10.55.148.193 with SMTP id w184mr3319578qkd.181.1472045290981; Wed, 24 Aug 2016 06:28:10 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id w94sm4644132qte.40.2016.08.24.06.28.09 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 24 Aug 2016 06:28:10 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_E16D8C03-70E1-4423-A4CB-6340E24D651C" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Wed, 24 Aug 2016 09:28:06 -0400 Message-Id: <09FAD04F-816D-4041-9F78-C740B532D114@brianrosen.net> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , "alex@bobotek.net" , Michael Hammer , "md3135@att.com" , "dfrankel@zipdx.com" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 13:28:15 -0000 --Apple-Mail=_E16D8C03-70E1-4423-A4CB-6340E24D651C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 The system we envisioned will grow, eventually quite large. It starts = off small, and grows gradually. That=92s an ideal deployment scenario. = It=92s not intended have a small number of tightly integrated = participants, you made that up. It starts with a relatively small = number of participants, period. I=92m not sure what you mean by =93administratively independent=94. = Within a country, participants are all regulated by the same regulator, = but that=92s the only common administration. We start =93small=94 (the number of TNs, and the number of transactions = does not start small) and we grow. Because we have a working delegation = process that we understand, asking that the PKI follow that seems pretty = reasonable. At least some of us want to get to the point where devices = generate and check, and since there are working delegation processes = that get numbers to devices, we believe we can grow out = straightforwardly to that. There has ALWAYS been some participants who scoff at the notion that = we=92ll ever get to devices generating and checking, but none have = objected to making the system capable of doing that. I believe we have = rough consensus on that point, since it=92s been part of the discussions = from the beginning. We do in fact care about being able to start small and grow. When = someone proposes a system that depends on something changing on a large = number of independent implementations with a hard cutover, we usually = don=92t think that=92s a good design. I=92m not aware of anyone who = believes OCSP doesn=92t scale at the levels we=92re discussing. There = are enough implementations at sufficient scale to convince me, and = others that it=92s more than feasible. This isn=92t web PKI, we have = root of trust in the regulator and leaves that follow the delegation = path. I don=92t see anyone else with your concern here. I see people agreeing = the document language can be improved in several ways. I believe, as do = most every one else who has dug into the details, that we have a = workable, deployable, scaleable approach to solving a real problem. The = work group consensus was determined some time ago, the industry has = embraced the approach and we have implementors using the documents to = build real code. =20 Brian > On Aug 23, 2016, at 11:13 PM, Dave Crocker wrote: >=20 > Brian, >=20 > On 8/23/2016 11:20 AM, Brian Rosen wrote: >> Scale here, at least initially, is a relatively small number of >> participants (service providers) with a relatively small number of >> certs (pool per SP) with a relatively high volume of OCSP queries >> (one per call, but clearly disbursed to multiple redundant >> responders). >=20 > So this system is intended for use with only a small number of = tightly-integrated participants? >=20 > But wait, we certainly know that they are expected to be = /administratively independent/? >=20 > So the scale and implied tight integration are not not what I've been = hearing, where some folk even believe this needs to support verification = by independent end-user devices. And your response leaves open the = question of what is expected for global operations. >=20 > Anyhow, what is significant is that no one has bothered to specify and = gain consensus on the operational targets. And of course, the larger = flaw in your response is that we don't use 'initially' as the design = target when asking about scaling. (We do use it when talking about = early adopters, but that's an entirely different topic.) >=20 >=20 >=20 >> What scaling are you worried about? The protocol? The database? >> The compute load? >=20 > None of those. >=20 > The task here is for a query service that operates on a global scale = with perhaps some thousands of /independent/ service providers and = perhaps billions of (potentially independent) verifiers, based on the = aggregate of comments people have been making. (Yes, I believe that is = a reasonable summary and yes I fully expect folk to challenge the = summary; that's fine. Get the goal documented with consensus and people = won't be pulling out stray targets they find convenient.) >=20 > Now, please point out the large number of query services successfully = deployed on the Internet that conform to that operational target. The = only one I know of is the DNS. >=20 > And then there the failure of ENUM to perform pretty much exactly the = query task needed here, albeit returning different information. Unless = that difference in what is returned is offered as justifying comfort for = this new effort -- with an explanation for why -- I remain mystified and = the lack of concern about the technical and operational details of this = key functional requirements for STIR. >=20 >=20 >> I know of at least one DoD deployment, and a couple of cert providers >> who do better than that. >=20 > None of that is relevant to the operational requirements here. >=20 > Seriously Brian, is the issue of large-scale, independent = administrative control that foreign a topic to this working group? >=20 > d/ >=20 >=20 >=20 >> Brian >>> On Aug 23, 2016, at 1:53 PM, Dave Crocker >>> wrote: >>>=20 >>> Brian, >>>=20 >>> I did not choose the example randomly, nor did I generate an >>> artificial comment to go along with it. >>>=20 >>> With your response -- which I expected -- my example moves from >>> theory to fact: So, please provide some documentation about its >>> successful use at scale. >>>=20 >>> d/ >>>=20 >>> On 8/23/2016 10:49 AM, Brian Rosen wrote: >>>> Yes, of course you are right. We specified OCSP for this >>>> purpose. >>>>=20 >>>> Brian >>>>=20 >>>>> On Aug 23, 2016, at 1:36 PM, Dave Crocker >>>>> wrote: >>>>>=20 >>>>> On 8/23/2016 10:09 AM, Brian Rosen wrote: >>>>>> Recognizing that we are beyond the IETF=92s purview, I would >>>>>> say as long as the SP has someone to hand the hot potato to, >>>>>> then its hands are clean and cool. >>>>>=20 >>>>>=20 >>>>> There is a piece of this that is essential to the IETF work, >>>>> namely sufficient and explicit clarity about usage alternatives >>>>> to ensure that the technical specifications can support them. >>>>>=20 >>>>> Specifying a cert subsystem that relies on a timely and >>>>> accurate revocation list, at the scale and granularity of >>>>> per-number, would be an example of something that has never >>>>> been done, where the relevant history strongly indicates it >>>>> won't work. >>>>>=20 >>>>> That level of consideration and design choice is very much >>>>> /inside/ the IETF's purview. >=20 >=20 >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net --Apple-Mail=_E16D8C03-70E1-4423-A4CB-6340E24D651C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 The system we envisioned will grow, eventually quite large. =  It starts off small, and grows gradually.  That=92s an ideal = deployment scenario.  It=92s not intended have a small number of = tightly integrated participants, you made that up.  It starts with = a relatively small number of participants, period.

I=92m not sure what you mean by = =93administratively independent=94.  Within a country, participants = are all regulated by the same regulator, but that=92s the only common = administration.

We start =93small=94 (the number of TNs, and the number of = transactions does not start small) and we grow.  Because we have a = working delegation process that we understand, asking that the PKI = follow that seems pretty reasonable.  At least some of us want to = get to the point where devices generate and check, and since there are = working delegation processes that get numbers to devices, we believe we = can grow out straightforwardly to that.

There has ALWAYS been some participants = who scoff at the notion that we=92ll ever get to devices generating and = checking, but none have objected to making the system capable of doing = that.  I believe we have rough consensus on that point, since it=92s = been part of the discussions from the beginning.

We do in fact care about being able to = start small and grow.  When someone proposes a system that depends = on something changing on a large number of independent implementations = with a hard cutover, we usually don=92t think that=92s a good design. =  I=92m not aware of anyone who believes OCSP doesn=92t scale at the = levels we=92re discussing.  There are enough implementations at = sufficient scale to convince me, and others that it=92s more than = feasible.  This isn=92t web PKI, we have root of trust in the = regulator and leaves that follow the delegation path.

I don=92t see anyone = else with your concern here.  I see people agreeing the document = language can be improved in several ways.  I believe, as do most = every one else who has dug into the details, that we have a workable, = deployable, scaleable approach to solving a real problem.  The work = group consensus was determined some time ago, the industry has embraced = the approach and we have implementors using the documents to build real = code.  

Brian

On Aug 23, 2016, at 11:13 PM, = Dave Crocker <dhc@dcrocker.net> wrote:

Brian,

On 8/23/2016 11:20 AM, Brian Rosen = wrote:
Scale = here, at least initially, is a relatively small number of
participants (service providers) with a relatively small = number of
certs (pool per SP) with a relatively high = volume of OCSP queries
(one per call, but clearly = disbursed to multiple redundant
responders).

So this system is intended for use with only a = small number of tightly-integrated participants?

But wait, we certainly know that they are = expected to be /administratively independent/?

So the scale and implied tight = integration are not not what I've been hearing, where some folk even = believe this needs to support verification by independent end-user = devices.  And your response leaves open the question of what is = expected for global operations.

Anyhow, what is significant is that no one has = bothered to specify and gain consensus on the operational targets. =  And of course, the larger flaw in your response is that we don't = use 'initially' as the design target when asking about scaling. =  (We do use it when talking about early adopters, but that's an = entirely different topic.)



What scaling are you worried about?  The protocol? =  The database?
The compute load?

None of those.

The task here is for a query service that = operates on a global scale with perhaps some thousands of /independent/ = service providers and perhaps billions of (potentially independent) = verifiers, based on the aggregate of comments people have been making. =  (Yes, I believe that is a reasonable summary and yes I fully = expect folk to challenge the summary; that's fine.  Get the goal = documented with consensus and people won't be pulling out stray targets = they find convenient.)

Now, please point out the large number of query = services successfully deployed on the Internet that conform to that = operational target.  The only one I know of is the DNS.

And then there the failure of ENUM to = perform pretty much exactly the query task needed here, albeit returning = different information.  Unless that difference in what is returned = is offered as justifying comfort for this new effort -- with an = explanation for why -- I remain mystified and the lack of concern about = the technical and operational details of this key functional = requirements for STIR.


I know of at least one DoD = deployment, and a couple of cert providers
who do better = than that.

None of that is relevant to the = operational requirements here.

Seriously Brian, is the issue of large-scale, = independent administrative control that foreign a topic to this working = group?

d/



Brian
On Aug 23, 2016, at 1:53 = PM, Dave Crocker <dhc@dcrocker.net>
wrote:
Brian,

I did not choose the = example randomly, nor did I generate an
artificial comment = to go along with it.

With your response -- = which I expected -- my example moves from
theory to fact: =  So, please provide some documentation about its
successful use at scale.

d/

On 8/23/2016 10:49 AM, Brian Rosen wrote:
Yes, of course you are = right.  We specified OCSP for this
purpose.

Brian

On Aug 23, 2016, at 1:36 PM, Dave Crocker = <dhc@dcrocker.net>
wrote:
On 8/23/2016 10:09 AM, Brian Rosen wrote:
Recognizing that we are = beyond the IETF=92s purview, I would
say as long as the SP = has someone to hand the hot potato to,
then its hands are = clean and cool.


There is a piece of this that is essential to the IETF = work,
namely sufficient and explicit clarity about usage = alternatives
to ensure that the technical specifications = can support them.

Specifying a cert = subsystem that relies on a timely and
accurate revocation = list, at the scale and granularity of
per-number, would be = an example of something that has never
been done, where = the relevant history strongly indicates it
won't work.

That level of consideration and design choice = is very much
/inside/ the IETF's purview.



-- 

 Dave Crocker
 Brandenburg = InternetWorking
 bbiw.net

-- 

 Dave Crocker
 Brandenburg = InternetWorking
 bbiw.net

= --Apple-Mail=_E16D8C03-70E1-4423-A4CB-6340E24D651C-- From nobody Wed Aug 24 08:46:52 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B4E812DF39 for ; Wed, 24 Aug 2016 08:46:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cIrLfcE1ONZs for ; Wed, 24 Aug 2016 08:46:49 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C3BE12DF5D for ; Wed, 24 Aug 2016 08:38:40 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7OFcnMx027096 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Wed, 24 Aug 2016 08:38:49 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472053129; bh=pTlCDSlQ4NtZsi1kfpJwf7gc1i4461F9aDSDtyg3qbQ=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=Dt8XaP4foKfBaHbNXUQBoSFaN/p7YZQgZCCemg8RR3t1WiDxG8DmFhsuKmy/w0a2i eyOfJ7PrHFh9mNgART8fwAXlslUg0p+wDmu8acxuLtsN2gr3uWcBNsNJYQnJyc9ut9 wOmWD2GYoJxsJ53vWNdYmjYR1AOS7pShAX+40hmU= To: Brian Rosen References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <4B1956260CD29F4A9622F00322FE05310128F703471A@BOBO1A.bobotek.net> <3BF60754-0E18-4E22-AE41-55B135C55754@att.com> <00C069FD01E0324C9FFCADF539701DB3BC1F41A3@sc9-ex2k10mb1.corp.yaanatech.com> <88176BD8-74E7-45FC-917F-F6C7819FD758@brianrosen.net> <52161642-8897-a29b-9643-1b17e9c4107f@dcrocker.net> <09FAD04F-816D-4041-9F78-C740B532D114@brianrosen.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Wed, 24 Aug 2016 08:38:18 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <09FAD04F-816D-4041-9F78-C740B532D114@brianrosen.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 15:46:50 -0000 On 8/24/2016 6:28 AM, Brian Rosen wrote: > The system we envisioned will grow, eventually quite large. It starts > off small, and grows gradually. Thats an ideal deployment scenario. > Its not intended have a small number of tightly integrated > participants, you made that up. It starts with a relatively small > number of participants, period. Sigh. No, Brian, it's the response you offered. And you offered it in response to an explicit question about scaling, without offering any other statements about scaling. Of course I knew it was wrong. But absent any documentation for the target scaling and in the presence of significant variations in implied answers, based on postings from different working group participants, I thought it important to underscore. For a number of choices made in the design, there is a long history of scaling problems. So while this latest note from you states a generic "quite large", there is no sense of how to achieve it. > Im not sure what you mean by administratively independent. That's a rather remarkably statement, within an IETF working group, since administrative independence is the essence of what makes almost all Internet services different from enterprise services. > Within a > country, participants are all regulated by the same regulator, but > thats the only common administration. First, regulation is not the same as administrative control, unless you want to say that all the telephone companies in the US operate under uniform administrative control. Second, regulation varies between countries. So there is quite a lot of independence for each service provider. And independent administrative operation imposes its own type of operational constraints. > We start small (the number of TNs, and the number of transactions does > not start small) and we grow. Because we have a working delegation > process that we understand, asking that the PKI follow that seems pretty > reasonable. At least some of us want to get to the point where devices > generate and check, and since there are working delegation processes > that get numbers to devices, we believe we can grow out > straightforwardly to that. That's fine. Where is this working design documented? Certainly it isn't anywhere in the 3 documents up for last call. > There has ALWAYS been some participants who scoff at the notion that > well ever get to devices generating and checking, but none have > objected to making the system capable of doing that. I believe we have > rough consensus on that point, since its been part of the discussions > from the beginning. Where is the working group consensus for that specific design goal? From the postings I've seen, there is an inconsistent sense of this goal among participants. Worse, the target for the query service apears to be non-public access, which precludes use by private (independent) user devices. > We do in fact care about being able to start small and grow. When > someone proposes a system that depends on something changing on a large > number of independent implementations with a hard cutover, we usually > dont think thats a good design. Im not aware of anyone who believes > OCSP doesnt scale at the levels were discussing. There are enough OCSP was published 17 years ago. That permits quite a lot of analysis of its production use. What is its operational history that encourages this faith in its ability to scale among many independent operators at a global level? > implementations at sufficient scale to convince me, and others that its > more than feasible. This isnt web PKI, we have root of trust in the > regulator and leaves that follow the delegation path. "The"? You mean "all of the". There is no one regulator at the top of the tree, unless I suppose you intend to have the PKI root be administered by the ITU. And by the way, all of this 'regulator' reference applies only to telephony using telephone numbers. It doesn't apply to telephony using non-telephonic URI's. > I dont see anyone else with your concern here. And yet I'm asking only the most basic and well-established questions. The lack of general concern about the pragmatics for this design, given how important and urgent the service, ought to have given folks more pause. I see people agreeing > the document language can be improved in several ways. I believe, as do > most every one else who has dug into the details, that we have a > workable, deployable, scaleable approach to solving a real problem. The > work group consensus was determined some time ago, the industry has > embraced the approach and we have implementors using the documents to > build real code. And yet, Brian, repeating statements of assurance like that does not take the place of serious technical and operational assessment. And what makes such assurances especially striking are the facts that the previous effort to create an inter-provider query service based on telephone numbers failed, and the proposed service is substantially more complex... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Aug 24 10:11:13 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3AED12D5D8 for ; Wed, 24 Aug 2016 10:11:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iIngi3n1yj6I for ; Wed, 24 Aug 2016 10:11:05 -0700 (PDT) Received: from resqmta-ch2-04v.sys.comcast.net (resqmta-ch2-04v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5D4712D943 for ; Wed, 24 Aug 2016 10:11:04 -0700 (PDT) Received: from resomta-ch2-09v.sys.comcast.net ([69.252.207.105]) by resqmta-ch2-04v.sys.comcast.net with SMTP id cbgpbCTzn8PeacbhgbFtKP; Wed, 24 Aug 2016 17:11:04 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-09v.sys.comcast.net with SMTP id cbhfbtC1WvsB5cbhgbyXy3; Wed, 24 Aug 2016 17:11:04 +0000 To: stir@ietf.org References: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com> From: Paul Kyzivat Message-ID: Date: Wed, 24 Aug 2016 13:11:02 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfJQofr6Iht81WQ4TQf1en3U7j6Ea4CySsgoi/2hRSyLPD9SUDaeFZ+LaJGviQSKfj7tHZajYHfsDcdMIckWJmfbtW0VVarAr42LmUiWk/t7VZMGulDxh 9UU+1SUfMHf7Ntdj5Y+A5FT2WIZ5/Z3x4xGfSVG95I4xRSGY/nsq7w1OLLN8f5rToMrSTlrUMFJ8hA== Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 17:11:07 -0000 I looked at this latest version and have a few small changes to recommend: * Section 2 ... Identities are extracted from an "identity field" a SIP request This isn't exactly right, because canonicalization of phone numbers is more than simple extraction. I suggest: ... Identities are extracted *or derived* from an "identity field" *of* a SIP request ... * Section 3 The following: ... a JSON [RFC7159] object comprising values copied from certain header field values in the SIP request. has a similar problem to that in the terminology. Again I suggest: ... a JSON [RFC7159] object comprising values copied *or derived* from certain header field values in the SIP request. * Section 4 Reference to RFC4234 is obsolete, it should be RFC5234. Thanks, Paul On 8/24/16 4:25 AM, Peterson, Jon wrote: > > This new iteration of rfc4474bis has been provided (by special request) > largely so people can see the example and the "canon" usage. If either of > those needs some more work, let's talk about it. Though of course we can > talk about anything else people want to talk about too. > > Jon Peterson > Neustar, Inc. > > On 8/24/16, 1:19 AM, "stir on behalf of internet-drafts@ietf.org" > wrote: > >> >> A New Internet-Draft is available from the on-line Internet-Drafts >> directories. >> This draft is a work item of the Secure Telephone Identity Revisited of >> the IETF. >> >> Title : Authenticated Identity Management in the >> Session Initiation Protocol (SIP) >> Authors : Jon Peterson >> Cullen Jennings >> Eric Rescorla >> Chris Wendt >> Filename : draft-ietf-stir-rfc4474bis-11.txt >> Pages : 44 >> Date : 2016-08-24 >> >> Abstract: >> The baseline security mechanisms in the Session Initiation Protocol >> (SIP) are inadequate for cryptographically assuring the identity of >> the end users that originate SIP requests, especially in an >> interdomain context. This document defines a mechanism for securely >> identifying originators of SIP requests. It does so by defining a >> SIP header field for conveying a signature used for validating the >> identity, and for conveying a reference to the credentials of the >> signer. >> >> >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ >> >> There's also a htmlized version available at: >> https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-11 >> >> A diff from the previous version is available at: >> https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rfc4474bis-11 >> >> >> Please note that it may take a couple of minutes from the time of >> submission >> until the htmlized version and diff are available at tools.ietf.org. >> >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > From nobody Wed Aug 24 10:47:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71C6312D613 for ; Wed, 24 Aug 2016 10:46:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.619 X-Spam-Level: X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hvsC_FWTN1wA for ; Wed, 24 Aug 2016 10:46:55 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 135E012B037 for ; Wed, 24 Aug 2016 10:46:55 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.17/8.16.0.17) with SMTP id u7OHijj9002794; Wed, 24 Aug 2016 13:46:54 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049287.ppops.net-00191d01. with ESMTP id 251fg2bh1e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 24 Aug 2016 13:46:53 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7OHkqnC023871; Wed, 24 Aug 2016 13:46:52 -0400 Received: from mlpi409.sfdc.sbc.com (mlpi409.sfdc.sbc.com [130.9.128.241]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u7OHkhUV023724 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 24 Aug 2016 13:46:47 -0400 Received: from MISOUT7MSGHUBAE.ITServices.sbc.com (MISOUT7MSGHUBAE.itservices.sbc.com [130.9.129.149]) by mlpi409.sfdc.sbc.com (RSA Interceptor); Wed, 24 Aug 2016 17:46:23 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.119]) by MISOUT7MSGHUBAE.ITServices.sbc.com ([130.9.129.149]) with mapi id 14.03.0301.000; Wed, 24 Aug 2016 13:46:23 -0400 From: "DOLLY, MARTIN C" To: "Peterson, Jon" Thread-Topic: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt Thread-Index: AQHR/eBGiJSIFUqHyE6CucUvV1C2OaBYCZGAgABZiWA= Date: Wed, 24 Aug 2016 17:46:22 +0000 Message-ID: References: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_F8DB7A19548643D69F6FBF1336D8217Battcom_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240180 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 17:46:58 -0000 --_000_F8DB7A19548643D69F6FBF1336D8217Battcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Jon Thank you Martin C. Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards AT&T Cell: +1.609.903.3360 Email: md3135@att.com On Aug 24, 2016, at 4:26 AM, Peterson, Jon > wrote: This new iteration of rfc4474bis has been provided (by special request) largely so people can see the example and the "canon" usage. If either of those needs some more work, let's talk about it. Though of course we can talk about anything else people want to talk about too. Jon Peterson Neustar, Inc. On 8/24/16, 1:19 AM, "stir on behalf of internet-drafts@ietf.org" on behalf of internet-= drafts@ietf.org> wrote: A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Authenticated Identity Management in the Session Initiation Protocol (SIP) Authors : Jon Peterson Cullen Jennings Eric Rescorla Chris Wendt Filename : draft-ietf-stir-rfc4474bis-11.txt Pages : 44 Date : 2016-08-24 Abstract: The baseline security mechanisms in the Session Initiation Protocol (SIP) are inadequate for cryptographically assuring the identity of the end users that originate SIP requests, especially in an interdomain context. This document defines a mechanism for securely identifying originators of SIP requests. It does so by defining a SIP header field for conveying a signature used for validating the identity, and for conveying a reference to the credentials of the signer. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-rfc4474bis-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_F8DB7A19548643D69F6FBF1336D8217Battcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Jon

Thank you

Martin C. Dolly=

Lead Member of Technical Staff

Core & Government/Regulatory = Standards

AT&T

Cell: +1.609.9= 03.3360

Email: md3135@att.com

 


On Aug 24, 2016, at 4:26 AM, Peterson, Jon <jon.peterson@neustar.biz> wrote:


This new iteration of rfc4474bis has been provided (by special reques= t)
largely so people can see the example and the "canon" usage= . If either of
those needs some more work, let's talk about it. Though of course we = can
talk about anything else people want to talk about too.

Jon Peterson
Neustar, Inc.

On 8/24/16, 1:19 AM, "stir on behalf of internet-drafts@ietf.org"
<stir-bounces@ietf.org on behalf of internet-drafts@ietf.org>= ; wrote:


A New Internet-Draft is available from the = on-line Internet-Drafts
directories.
This draft is a work item of the Secure Tel= ephone Identity Revisited of
the IETF.

      Title &= nbsp;         : Authenticated = Identity Management in the
Session Initiation Protocol (SIP)
      Authors=         : Jon Peterson
       &= nbsp;           &nbs= p;    Cullen Jennings
       &= nbsp;           &nbs= p;    Eric Rescorla
       &= nbsp;           &nbs= p;    Chris Wendt
   Filename    &nb= sp;   : draft-ietf-stir-rfc4474bis-11.txt
   Pages     =       : 44
   Date     &= nbsp;      : 2016-08-24

Abstract:
 The baseline security mechanisms in t= he Session Initiation Protocol
 (SIP) are inadequate for cryptographi= cally assuring the identity of
 the end users that originate SIP requ= ests, especially in an
 interdomain context.  This docum= ent defines a mechanism for securely
 identifying originators of SIP reques= ts.  It does so by defining a
 SIP header field for conveying a sign= ature used for validating the
 identity, and for conveying a referen= ce to the credentials of the
 signer.


The IETF datatracker status page for this d= raft is:
https://datatracker.ietf.org/doc/draft-ietf-s= tir-rfc4474bis/

There's also a htmlized version available a= t:
https://tools.ietf.org/html/draft-ietf-stir-rfc4= 474bis-11

A diff from the previous version is availab= le at:
https://www.ietf.org/rfcdiff?url2=3Ddraf= t-ietf-stir-rfc4474bis-11


Please note that it may take a couple of mi= nutes from the time of
submission
until the htmlized version and diff are ava= ilable at tools.ietf.org.

Internet-Drafts are also available by anony= mous FTP at:
ftp://ftp.ietf.org/internet-drafts/

___________________________________________= ____
stir mailing list
stir@ietf.= org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_F8DB7A19548643D69F6FBF1336D8217Battcom_-- From nobody Wed Aug 24 10:54:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E88312D61A for ; Wed, 24 Aug 2016 10:54:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E4PDhMCtAJiy for ; Wed, 24 Aug 2016 10:54:39 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 356DE12D5CD for ; Wed, 24 Aug 2016 10:54:39 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7OHr0eF028423; Wed, 24 Aug 2016 13:54:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=neustar.biz; bh=shQ42uRJZDt7gwny6f1l3sFXeGeYm6P3vhlvzcidC3w=; b=NHl7ufyFGfLsSwQtP4FMfaboCX5EJapfogxRRthZ9G2hqvYVZBlNNbTnNwiHthtvYlTO kupKFZquCjZ3kERgfETzfhqwUQF0E0kBQjVqPRabu2Dvtsn20zXPYXJko85DgNuX0VEX UZuifbSCshUTm86fN9IQz26PWDswydn3C5qLdN1jNLV4GbJW8Tamk9eHRp41vNIqTMDt iG/kLumsMOOWibtxsxbI6U5knv0zV5u6whmcegVIerZM8tsaObJPTehgVe/HiPoluuaL YF4Qvv/lMMNfVP1sUeT6ualPTpF/Eg0u4Aox2FBi0C2LnB6WBUihcyfB1DAxcx8i7S46 PA== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24xkaqwhmq-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Wed, 24 Aug 2016 13:54:36 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 13:54:32 -0400 From: "Peterson, Jon" To: Paul Kyzivat , "stir@ietf.org" Thread-Topic: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt Thread-Index: AQHR/eA43NywUKPnKEKZYjh7TBCYkaBXlDaAgAEIEgD//5bHgA== Date: Wed, 24 Aug 2016 17:54:31 +0000 Message-ID: References: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: text/plain; charset="us-ascii" Content-ID: <8A3744DC0F80FB4EA3F37396ECD098C9@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240182 Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 17:54:40 -0000 Thanks, I rolled these in for the next spin - though I went with just "derived" rather than "extracted or derived", same with "copied or derived" - it seemed to get the point across. Jon Peterson Neustar, Inc. On 8/24/16, 10:11 AM, "stir on behalf of Paul Kyzivat" wrote: >I looked at this latest version and have a few small changes to recommend: > >* Section 2 > > ... Identities are extracted from an "identity field" a SIP request > >This isn't exactly right, because canonicalization of phone numbers is >more than simple extraction. I suggest: > > ... Identities are extracted *or derived* from an "identity field" > *of* a SIP request ... > >* Section 3 > >The following: > > ... a JSON [RFC7159] object comprising values copied from certain > header field values in the SIP request. > >has a similar problem to that in the terminology. Again I suggest: > > ... a JSON [RFC7159] object comprising values copied *or derived* > from certain header field values in the SIP request. > >* Section 4 > >Reference to RFC4234 is obsolete, it should be RFC5234. > > Thanks, > Paul > > >On 8/24/16 4:25 AM, Peterson, Jon wrote: >> >> This new iteration of rfc4474bis has been provided (by special request) >> largely so people can see the example and the "canon" usage. If either >>of >> those needs some more work, let's talk about it. Though of course we can >> talk about anything else people want to talk about too. >> >> Jon Peterson >> Neustar, Inc. >> >> On 8/24/16, 1:19 AM, "stir on behalf of internet-drafts@ietf.org" >> wrote: >> >>> >>> A New Internet-Draft is available from the on-line Internet-Drafts >>> directories. >>> This draft is a work item of the Secure Telephone Identity Revisited of >>> the IETF. >>> >>> Title : Authenticated Identity Management in the >>> Session Initiation Protocol (SIP) >>> Authors : Jon Peterson >>> Cullen Jennings >>> Eric Rescorla >>> Chris Wendt >>> Filename : draft-ietf-stir-rfc4474bis-11.txt >>> Pages : 44 >>> Date : 2016-08-24 >>> >>> Abstract: >>> The baseline security mechanisms in the Session Initiation Protocol >>> (SIP) are inadequate for cryptographically assuring the identity of >>> the end users that originate SIP requests, especially in an >>> interdomain context. This document defines a mechanism for securely >>> identifying originators of SIP requests. It does so by defining a >>> SIP header field for conveying a signature used for validating the >>> identity, and for conveying a reference to the credentials of the >>> signer. >>> >>> >>> The IETF datatracker status page for this draft is: >>> https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ >>> >>> There's also a htmlized version available at: >>> https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-11 >>> >>> A diff from the previous version is available at: >>> https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-rfc4474bis-11 >>> >>> >>> Please note that it may take a couple of minutes from the time of >>> submission >>> until the htmlized version and diff are available at tools.ietf.org. >>> >>> Internet-Drafts are also available by anonymous FTP at: >>> ftp://ftp.ietf.org/internet-drafts/ >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >> > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Wed Aug 24 10:59:12 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D23F12D621 for ; Wed, 24 Aug 2016 10:59:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wbHTS135wbWd for ; Wed, 24 Aug 2016 10:59:09 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4441212D62C for ; Wed, 24 Aug 2016 10:59:08 -0700 (PDT) X-AuditID: c1b4fb30-ad3ff700000009f9-cd-57bde068f855 Received: from ESESSHC024.ericsson.se (Unknown_Domain [153.88.183.90]) by (Symantec Mail Security) with SMTP id F6.09.02553.860EDB75; Wed, 24 Aug 2016 19:59:06 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.211]) by ESESSHC024.ericsson.se ([153.88.183.90]) with mapi id 14.03.0301.000; Wed, 24 Aug 2016 19:59:04 +0200 From: Christer Holmberg To: IETF STIR Mail List Thread-Topic: Optional to include JSON key "ppt" Thread-Index: AdH+MQmCLvtsXevnRL+PcMME6GEAkA== Date: Wed, 24 Aug 2016 17:59:04 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B4BC57E5C@ESESSMB209.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B4BC57E5CESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrMLMWRmVeSWpSXmKPExsUyM2J7lG7Wg73hBjOOSlssX7uNyYHRY8mS n0wBjFFcNimpOZllqUX6dglcGX27pzAXnFWvWPy4lb2B8aNSFyMnh4SAiUTvhuUsXYxcHEIC 6xklHh+YxwKSEBJYwiixahJnFyMHB5uAhUT3P22QsIiAukRrWx8ziC0soC1x9vh0Joi4gcSN zo0sELaexL+OjWA1LAKqEj8PvWQHsXkFfCW2H7wLZjMKiEl8P7UGrJdZQFzi1pP5TBD3CEgs 2XOeGcIWlXj5+B8rhK0k0bjkCSvIOcwC+RIPP4lBjBSUODnzCcsERsFZSCbNQqiahaQKokRH YsHuT2wQtrbEsoWvmWHsMwceMyGLL2BkX8UoWpxanJSbbmSkl1qUmVxcnJ+nl5dasokRGPQH t/w22MH48rnjIUYBDkYlHt4HYXvChVgTy4orcw8xSnAwK4nwytzfGy7Em5JYWZValB9fVJqT WnyIUZqDRUmc1/+lYriQQHpiSWp2ampBahFMlomDU6qBsTeksf1TwQTvGfY6BRNKTmxa//ai ZdXJuu2TPpUVLqoKY/x2qy03pG+58w65LM6Tr1LLXdy64u5zLJ21jHfdnMv6zVw35m4rj3u2 bc3hrcUl8+sXTfm+YlX/RIk5zRcNbgRG+mgd5owIVD3+WWHrMXErCaOtCnNrXmgG8xgWGbxt 6jVx+lWUpcRSnJFoqMVcVJwIAOjcvKt2AgAA Archived-At: Subject: [stir] Optional to include JSON key "ppt" X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 17:59:11 -0000 --_000_7594FB04B1934943A5C02806D1A2204B4BC57E5CESESSMB209erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, The text in section 4.1. says: "Fourth, the optional JSON key "ppt", if present, MUST have a value equivalent to the quoted value of the "ppt" parameter of the Identity header field. If the "ppt" parameter is absent from the header field, the "ppt" key MUST NOT not appear in the JSON header object." Is there a reason why we can't simply mandate to include the JSON key "ppt"= if the "ppt" parameter is present? Less options, less errors :) Regards, Christer --_000_7594FB04B1934943A5C02806D1A2204B4BC57E5CESESSMB209erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

The text in section 4.1. says:

 

     &= nbsp;  “Fourth, the optional JSON key "ppt", if presen= t, MUST have a value

      =   equivalent to the quoted value of the "ppt" parameter of t= he

      =   Identity header field.  If the "ppt" parameter is abs= ent from the

      =   header field, the "ppt" key MUST NOT not appear in the JSO= N header

      =   object.”

 

Is there a reason why we can’t simply mandate = to include the JSON key “ppt” if the “ppt” paramete= r is present?

 

Less options, less errors :)

 

Regards,

 

Christer

 

--_000_7594FB04B1934943A5C02806D1A2204B4BC57E5CESESSMB209erics_-- From nobody Wed Aug 24 11:07:51 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29F9A12D618 for ; Wed, 24 Aug 2016 11:07:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.7 X-Spam-Level: X-Spam-Status: No, score=-102.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X88mWJ4atQml for ; Wed, 24 Aug 2016 11:07:47 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D943212D9C6 for ; Wed, 24 Aug 2016 11:07:47 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7OHr2vE000620; Wed, 24 Aug 2016 14:07:44 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : subject : date : message-id : content-type : mime-version; s=neustar.biz; bh=kNPDAj+Y7KBtSI5WX8LbwDtLpPI8gXg3CCEICd+eZuQ=; b=nXkaJ0ISWCk0rtooGBPCk7mR8m3nIxk0fEiYsewg7Q6+dsA3HSALJkryIGt7QOGuae1N +RZzjSuEdf7Leceq2xqy53wXvTL17r0JR3U+oS+KTByyySdfpqUuyJDwKa0p6Plnm3fK kABZlQ95x1Ho/fPogyJJSNMROyalU/Bl+NbvSLjGXWSJXwj1MoIQCuBEn7sztz180OQ8 biXP8dnQ1otli8aE6yY9AOtBAult8oTrnMh9482ug+Xfbg+PNo3s58DBayPP0fQuyHbF /FVLTcVGJGFPx4TT5RZtfk/keuWOA2MMZTrcRghRAXAT2X2cwie+zbguItHJKr+I2Lvu wg== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24xhuuws0h-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Wed, 24 Aug 2016 14:07:44 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Wed, 24 Aug 2016 14:07:43 -0400 From: "Peterson, Jon" To: Christer Holmberg , IETF STIR Mail List Thread-Topic: [stir] Optional to include JSON key "ppt" Thread-Index: AQHR/jJo5PxoP0TuO0iA7AuTZmLvog== Date: Wed, 24 Aug 2016 18:07:43 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.17] Content-Type: multipart/alternative; boundary="_000_D3E32EFD1AA538jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-24_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240182 Archived-At: Subject: Re: [stir] Optional to include JSON key "ppt" X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 18:07:49 -0000 --_000_D3E32EFD1AA538jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Well, we need to say more than simply that the JSON key is included, we nee= d to say how its value relates to the SIP request. We can reword it, but th= e semantics need to say pretty much what it does now. Jon Peterson Neustar, Inc. From: stir > on behalf = of Christer Holmberg > Date: Wednesday, August 24, 2016 at 10:59 AM To: IETF STIR Mail List > Subject: [stir] Optional to include JSON key "ppt" Hi, The text in section 4.1. says: =93Fourth, the optional JSON key "ppt", if present, MUST have a val= ue equivalent to the quoted value of the "ppt" parameter of the Identity header field. If the "ppt" parameter is absent from the header field, the "ppt" key MUST NOT not appear in the JSON header object.=94 Is there a reason why we can=92t simply mandate to include the JSON key =93= ppt=94 if the =93ppt=94 parameter is present? Less options, less errors :) Regards, Christer --_000_D3E32EFD1AA538jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: <4FFA1E7E448D0E4EBB0667DF8C5EAC25@neustar.biz> Content-Transfer-Encoding: quoted-printable

Well, we need to say more than simply that the JSON key is included, w= e need to say how its value relates to the SIP request. We can reword it, b= ut the semantics need to say pretty much what it does now. 

Jon Peterson
Neustar, Inc.

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Wednesday, August 24, 2016 at= 10:59 AM
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] Optional to include= JSON key "ppt"

Hi,

 

The text in section 4.1. says:

 

     &= nbsp;  =93Fourth, the optional JSON key "ppt", if present, M= UST have a value

      =   equivalent to the quoted value of the "ppt" parameter of t= he

      =   Identity header field.  If the "ppt" parameter is abs= ent from the

      =   header field, the "ppt" key MUST NOT not appear in the JSO= N header

      =   object.=94

 

Is there a reason why we can=92t simply mandate to i= nclude the JSON key =93ppt=94 if the =93ppt=94 parameter is present?

 

Less options, less errors :)

 

Regards,

 

Christer

 

 --_000_D3E32EFD1AA538jonpetersonneustarbiz_-- From nobody Wed Aug 24 11:08:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53D2712D618 for ; Wed, 24 Aug 2016 11:08:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RJcy1mYvzySa for ; Wed, 24 Aug 2016 11:08:43 -0700 (PDT) Received: from resqmta-ch2-04v.sys.comcast.net (resqmta-ch2-04v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20D6B12D5DE for ; Wed, 24 Aug 2016 11:08:43 -0700 (PDT) Received: from resomta-ch2-07v.sys.comcast.net ([69.252.207.103]) by resqmta-ch2-04v.sys.comcast.net with SMTP id ccbPbCZIf8PeaccbSbG66h; Wed, 24 Aug 2016 18:08:42 +0000 Received: from Paul-Kyzivats-MacBook-Pro.local ([73.218.51.154]) by resomta-ch2-07v.sys.comcast.net with SMTP id ccbRbnUSdo5B0ccbRbXogx; Wed, 24 Aug 2016 18:08:42 +0000 To: "Peterson, Jon" , "stir@ietf.org" References: <147202674776.13282.2368870125255406953.idtracker@ietfa.amsl.com> From: Paul Kyzivat Message-ID: Date: Wed, 24 Aug 2016 14:08:41 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfNborjKL0T1mg4ipbyCfcFS18OHC7CirN3MF55ogNPvRTNXyHMWmyKot+fTCJSGZU6ycQo9maQKKO/bmHMWJqJJ6g0RKbqeeo8Kz88pMfi9mYZLi+g1M QUZK/lk0ElVSSfGbM3HnmZbm6K9SjgjsU4+16Y8JSGDSWPaQBYRzk/odvALQAorufXmC3Em4MPXS0y5BxqMMi038I+RivV/Z/6Vd9qmX96DBfgpM7EeifqD8 Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-rfc4474bis-11.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2016 18:08:45 -0000 WFM On 8/24/16 1:54 PM, Peterson, Jon wrote: > > Thanks, I rolled these in for the next spin - though I went with just > "derived" rather than "extracted or derived", same with "copied or > derived" - it seemed to get the point across. > > Jon Peterson > Neustar, Inc. > > On 8/24/16, 10:11 AM, "stir on behalf of Paul Kyzivat" > wrote: > >> I looked at this latest version and have a few small changes to recommend: >> >> * Section 2 >> >> ... Identities are extracted from an "identity field" a SIP request >> >> This isn't exactly right, because canonicalization of phone numbers is >> more than simple extraction. I suggest: >> >> ... Identities are extracted *or derived* from an "identity field" >> *of* a SIP request ... >> >> * Section 3 >> >> The following: >> >> ... a JSON [RFC7159] object comprising values copied from certain >> header field values in the SIP request. >> >> has a similar problem to that in the terminology. Again I suggest: >> >> ... a JSON [RFC7159] object comprising values copied *or derived* >> from certain header field values in the SIP request. >> >> * Section 4 >> >> Reference to RFC4234 is obsolete, it should be RFC5234. >> >> Thanks, >> Paul >> >> >> On 8/24/16 4:25 AM, Peterson, Jon wrote: >>> >>> This new iteration of rfc4474bis has been provided (by special request) >>> largely so people can see the example and the "canon" usage. If either >>> of >>> those needs some more work, let's talk about it. Though of course we can >>> talk about anything else people want to talk about too. >>> >>> Jon Peterson >>> Neustar, Inc. >>> >>> On 8/24/16, 1:19 AM, "stir on behalf of internet-drafts@ietf.org" >>> wrote: >>> >>>> >>>> A New Internet-Draft is available from the on-line Internet-Drafts >>>> directories. >>>> This draft is a work item of the Secure Telephone Identity Revisited of >>>> the IETF. >>>> >>>> Title : Authenticated Identity Management in the >>>> Session Initiation Protocol (SIP) >>>> Authors : Jon Peterson >>>> Cullen Jennings >>>> Eric Rescorla >>>> Chris Wendt >>>> Filename : draft-ietf-stir-rfc4474bis-11.txt >>>> Pages : 44 >>>> Date : 2016-08-24 >>>> >>>> Abstract: >>>> The baseline security mechanisms in the Session Initiation Protocol >>>> (SIP) are inadequate for cryptographically assuring the identity of >>>> the end users that originate SIP requests, especially in an >>>> interdomain context. This document defines a mechanism for securely >>>> identifying originators of SIP requests. It does so by defining a >>>> SIP header field for conveying a signature used for validating the >>>> identity, and for conveying a reference to the credentials of the >>>> signer. >>>> >>>> >>>> The IETF datatracker status page for this draft is: >>>> https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ >>>> >>>> There's also a htmlized version available at: >>>> https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-11 >>>> >>>> A diff from the previous version is available at: >>>> https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rfc4474bis-11 >>>> >>>> >>>> Please note that it may take a couple of minutes from the time of >>>> submission >>>> until the htmlized version and diff are available at tools.ietf.org. >>>> >>>> Internet-Drafts are also available by anonymous FTP at: >>>> ftp://ftp.ietf.org/internet-drafts/ >>>> >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>> >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > > From nobody Wed Aug 24 18:31:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C075812D5F7 for ; Wed, 24 Aug 2016 18:31:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.538 X-Spam-Level: X-Spam-Status: No, score=-2.538 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zipdx.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m3yTzfujb_xk for ; Wed, 24 Aug 2016 18:31:34 -0700 (PDT) Received: from xdev1sjc.zipdx.com (sjc-e-66.zipdx.com [166.88.23.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DB9412B051 for ; Wed, 24 Aug 2016 18:31:34 -0700 (PDT) Received: from DPFyoga (c-73-15-29-134.hsd1.ca.comcast.net [73.15.29.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: dfrankel) by xdev1sjc.zipdx.com (Postfix) with ESMTPSA id 386841B8029A; Wed, 24 Aug 2016 18:31:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=zipdx.com; s=default; t=1472088694; bh=Yz0lRkP9s+s4H7fgnrwaX6j7+vQMhKiDW9Y4MsdlfjQ=; h=From:To:References:In-Reply-To:Subject:Date:From; b=WXe8Rj9RPaIqB1EEaIvMPOhn/EZ3uPRo2nKXCR14Y2bLUHMRJkmALFaBNQBNpfdWH U3qGDVcYTJbpGnzBIpxgELsD9MlnNXOwGZtt0Z/QeaGx/L+sm5ZBDFWw4VASduAwGi 4KEF6c/0z9BxDjjb2sEKt8iYoALSA/aLHmZtn54M= From: "David Frankel" To: "'Peterson, Jon'" , References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> In-Reply-To: Date: Wed, 24 Aug 2016 18:31:35 -0700 Organization: ZipDX LLC Message-ID: <10df01d1fe70$6af44280$40dcc780$@zipdx.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_10E0_01D1FE35.BE9EB950" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIqtKgeHI11CL1r+UjVBJ0q1nBB6gG+M0lNn5jFkuA= Content-Language: en-us Archived-At: Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Aug 2016 01:31:42 -0000 This is a multipart message in MIME format. ------=_NextPart_000_10E0_01D1FE35.BE9EB950 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Jon - Thanks for investing your time to respond to my comments. I'll try to step through each general area briefly. Regarding some of the text in section 3, Background: thanks for the modifications. Regarding caller-name: You say: "it doesn't protect display-name (the text you indicate in 12.6), which is the way you carry a caller name in SIP." My response is: In the context of what we (or at least I) am calling a "PUBLIC TELEPHONE NETWORK end-to-end SIP call" you are incorrect or at least not helpful when you say that display-name "is the way you carry a caller name". Again, my context is a "phone call" from an endpoint identified with a telephone number, to a different endpoint with a telephone number, using telephone-number-based addressing. And I continue to think that is the PRIMARY focus of this work. In that context, there are several ways of sourcing a caller-name for display to the end-user, but I believe the most common are consistent with what I described. At the end of these comments I've given a detailed example for reference. In the Working Group charter, I read "the claimed source identity of a SIP request is [currently] not verified, permitting unauthorized use of the source identity as part of deceptive and coercive activities.." This is the general problem that I think the group and the specs are trying to address. >From an end-user perspective both the number and name that they see are part of the "source identity". Including some sort of helpful, clarifying comment about how this particular spec does or does not influence the name, which is often the more important element in terms of what the user sees and relies on, strikes me as appropriate. You say you're happy with section 12.6 and that it serves a different purpose. Why don't you augment 12.6 then, and make it even more helpful by serving an additional purpose? My sense is that there is other text currently included that gives "guidance" on various matters that are perhaps peripheral to the precise specification but relevant in the context of the problem statement. Regarding anonymization: You say: "I think some of your concerns about anonymity demonstrate how we use the term differently in SIP than we might in everyday discourse." I introduced my comments by referencing what RFC7340 says about anonymization. I think I am using the term consistently with that RFC. The fact that "we use the term differently in SIP" is perhaps worthy of some explanation in the spec. Addressing anonymization the way it is used in the STIR Problem Statement (even if it is not "the way we use it in SIP") is also worth some explanation. You say: "[T]he barrier to entry to acquiring 'ambiguous' telephone numbers is surely higher than just putting whatever comes to mind in a From header field." I don't think we know that (yet). We certainly hope it will be. But robocallers are adept at leaping at least low hurdles, so if the barrier is only "slightly" higher it won't be effective. Yes, aspects are discussed in Section 12.5, but I believe it would be helpful if these issues got some brief mention in the Background section, with specific attention paid to the context set by RFC7340. If my text isn't perfect, can you tighten it up? I note, by the way, that 12.5 says: "Relying on an Identity header field generated by a remote administrative domain assumes that the issuing domain uses recommended administrative practices to authenticate its users." What are those "recommended administrative practices" - I could not find any in the document nor a reference. Regarding authentication of domain (not telephone number) URIs: You say: "I don't think it constitutes much of a distraction, and in fact, I'd say the solution would be incomplete without it." I indicated that my preference would be to have it removed, but I offered alternatives if you and/or others insist it be retained. The fact is that I found it "distracting." There is some possibility that I am the only person that will ever read the spec that found this to be the case. I (and I think others) would like to be able to read the spec in a way that made it crystal clear how to architect and implement a solution that works for telephone numbers. Improving the separation between the telephone number and domain-based steps would be helpful. I accept that I'm not going to get the help I want. If nothing else, I suggest keeping the examples "pure" - in section 5, rather than having 12155551212 calling sip:alice@example.org, use (or at least include) a phone number to phone number example. And rather than sip:12155551212@example.com, use sip:12155551212@123.123.213.231, since almost all real-world phone number to phone number SIP traffic uses IP addresses and not domain names. (See my calling name example below.) I'm glad you liked my nits. Speaking of nits, I note in the latest revision you say: "The problem statement of STIR [RFC7340] focuses primarily on cases where the called and calling parties identified in the To and From header field values use telephone numbers, as this remains the dominant use case in the deployment of SIP." The way I read RFC7340, it focuses ONLY on telephone number cases (not "primarily"). On the more substantive points, my request is that, if you determine that my (or somebody else's) suggestion is being made out of ignorance or misunderstanding, you see if there isn't SOME tweak to the spec that might be helpful in preventing others from making a similar error. CALLING NAME DELIVERY EXAMPLE (USA) - how it works today: An end-user, Fred, gets his service from a hosted PBX provider. Fred has been assigned telephone number 1-212-555-4321. Fred places a call with his IP phone to 1-415-555-6789; this is a mobile number assigned to Sally. The SIP phone sends an INVITE to the hosted PBX provider which reoriginates the call with an INVITE to their wholesale termination provider, with headers that look like (in relevant part) TO: and FROM: "Fred Smith" . The termination provider reoriginates the call to their transit provider with headers that look like (in relevant part) TO: and FROM: . Note that the Display Name has been removed from the FROM header; they didn't need to do this, but it's their practice. The transit provider sends the call to Sally's mobile operator by reoriginating the call using similar TO and FROM headers. The mobile operator receives the call; it has gone SIP end-to-end from the origination point. If Sally subscribes to the mobile operator's optional "calling name" service, the mobile operator performs an SS7 TCAP CNAM query, or something somewhat equivalent, supplying the telephone number from the TO header (14155556789). The query returns, perhaps, "SMITH FRED" and the mobile operator sends this over its air interface to Sally's phone for display. If Sally has NOT subscribed to the "calling name" service, the mobile operator sends only the telephone number. Sally's smartphone looks this up in her contact database; if it finds it, it displays the name; if not found, it may display nothing, or it may have an alternate look-up mechanism which might yield a name or a geographic indicator. David Frankel ZipDXR LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: Wednesday, August 24, 2016 12:38 AM To: David Frankel ; stir@ietf.org Subject: Re: [stir] My Editorial Suggestions on RFC4474bis Hi David, You are correct that the first sentence of Section 3 sort of lumps robocalling, voicemail hacking, and swatting into one bucket, and that "enable" doesn't fit all the contents of that bucket equally well. Voicemail hacking ("News of the World" style) is directly enabled by impersonation, you can't do it without impersonation. I think I might say instead that these practices "commonly leverage" an attacker's ability to impersonate someone else's identity. I think though I'm going to end up removing this text from the spec anyway, and instead slightly amplifying the text in the introduction about RFC7340. As to whether the mechanism described in the document "provides a strong identity system for detecting attempted impersonation," I'm afraid I can't agree with your reasons for saying that is incorrect. A lack of implementation would not change whether or not the -document- describes such a system. The presence or absence of an Identity header from any given SIP message wouldn't change that either. This is a sentence about a document, not about a deployment. But again, I think this text will likely be removed for unrelated reasons. The specification is very careful to say that it does not protect caller name, but it does so by saying that it doesn't protect display-name (the text you indicate in 12.6), which is the way you carry a caller name in SIP. There is no other commentary of any kind about how systems might derive caller name in this specification, and I'd hesitate to introduce some. The text in the second paragraph of 12.6 serves a very different purpose than the paragraph you propose to replace it. I don't see any harm in noting that telephone numbers are sometimes used to derive display names, but I see no justification for having this specification deliver guidance on what sort of name databases consumers should or should not trust. I think some of your concerns about anonymity demonstrate how we use the term differently in SIP than we might in everyday discourse. If you "achieve true anonymity by spoofing somebody else's phone number (often, in fact, just random numbers)" you are still spoofing a phone number. Your ability to spoof telephone numbers enables that. What it is to claim anonymity in SIP is to not divulge an individual identifier for yourself, usually by using instead some kind of privacy service which sets your identity to something that makes it clear that you want to remain anonymous. Impersonating random telephone numbers is different - it is still impersonating numbers. As the Privacy Considerations state, and state correctly I believe, "None of the relevant attacks, all of which rely on the attacker taking on the identity of a victim or hiding their identity using someone else's identity, are enabled by anonymous identity." As to the problem of abusive users obtaining telephone numbers "which they can authenticate, but which still are ambiguous as to their ownership," this is noted in the section on "Authorization and Transitional Strategies," as are most of the similar concerns you raise here. We all know, for example, that security vulnerabilities could allow attackers to compromise devices that could make calls which possess totally valid credentials. No one here thinks secure signaling is a silver bullet. However, the barrier to entry for populating a From header field, versus compromising a device, is very different. Similarly, the barrier to entry to acquiring "ambiguous" telephone numbers is surely higher than just putting whatever comes to mind in a From header field. The differences are real; I don't think we're overselling them. While I do agree that the STIR charter considers "greenfield" SIP URIs out of scope, we long ago made a consensus decision in this working group not to bar that text from rfc4474bis or any other proposals for solutions here. STIR does not require this to solve its immediate threat model. However, as we looked at gatewaying and so on, we quickly saw that there were going to be cases where such identifiers would appear. I don't think it constitutes much of a distraction, and in fact, I'd say the solution would be incomplete without it. Your nits are appreciated - this text is getting a pretty thorough errata-vetting at this point. Thanks, Jon Peterson Neustar, Inc. From: stir > on behalf of David Frankel > Organization: ZipDX LLC Date: Sunday, August 21, 2016 at 10:17 AM To: "stir@ietf.org " > Subject: [stir] My Editorial Suggestions on RFC4474bis Since my last notes, I've gotten some constructive feedback here and privately. Now, hoping to also be constructive, I want to volunteer some comments about specific content in the 4474bis document. I'll preface this as follows: My interest is in how, and to what extent, the proposed functionality will address abuse of the public telephone network. By "public telephone network" I mean that evolving set of networks and technologies which permit any party to make a "telephone call" to any other party, from and to anywhere on the globe, using conventional telephone number addressing and involving either conventional (circa 1970, perhaps?) telephones, or something emulating such an instrument (mobile phone, smart phone, web phone, IP phone, etc.). If we could start over today, we'd no doubt design the system completely differently, but with an installed base of perhaps six or seven billion endpoints and associated addresses, and still growing, it seems likely that this network is still some distance from retirement. By "abuse" I mean (1) the use of the network to defraud, steal from, or deny service to a call recipient; (2) placing of programmatic unsolicited marketing-related and similar calls that, intentionally or not, annoy or harass a call recipient. I note that the prevalence of these abuses compromises the beneficial uses of the network by promoting suboptimal behaviors on the part of telephone subscribers (refusing to answer any call for fear it is an abusive call; sending all or most calls to voice-mail or CAPTCHA to avoid abusive calls; etc.); this impedes the flow and utility of good (non-abusive) calls. Rather than parsing the document section by section, I've structured my comments categorically since several of my suggestions touch in multiple places. OBJECTIVES / PURPOSE I want to reiterate some text from the SIP WG charter because I need to confirm that we are all on the same page regarding our goals. It states: "Since it has become fairly easy to present an incorrect source telephone number, a growing set of problems have emerged over the last decade. As with email, the claimed source identity of a SIP request is not verified, permitting unauthorized use of the source identity as part of deceptive and coercive activities, such as robocalling (bulk unsolicited commercial communications), vishing (voicemail hacking, and impersonating banks) and swatting (impersonating callers to emergency services to stimulate unwarranted large scale law enforcement deployments). In addition, use of an incorrect source telephone number facilitates wire fraud or can lead to a return call at premium rates." (Paragraph 1) And "As its priority mechanism work item, the working group will specify a SIP header-based mechanism for verification that the originator of a SIP session is authorized to use the claimed source telephone number, where the session is established with SIP end to end." (Paragraph 3) That strikes me as a noble undertaking and I'm reading the document in that context. 4474bis states at 3. Background: "Per [RFC7340], problems such as robocalling, voicemail hacking, and swatting are enabled by an attacker's ability to impersonate someone else." I don't agree that RFC7340 states that these abuses are "enabled" by the "ability to impersonate someone else." First, "enabled" implies that if there were no such ability, then these attacks would be "disabled" and it isn't that cut and dried. Impersonation "facilitates" (or as the charter states, is "part of") deceptive and coercive activities. Second, RFC7340 is explicit that both impersonation and obfuscation (or obscuration) contribute to the problems. At Page 4, it says: "In general, number spoofing is used in two ways: impersonation and anonymization." When explaining the context and how 4474bis fits, caution and precision are important. Here's my attempt at replacing the first paragraph of section 3: "Per [RFC7340], attackers often take advantage of the current ease with which calling telephone numbers can be spoofed, and the singular reliance some call recipients place on that value. This allows abuse, for example, of a voicemail service that compares the identity of the caller to a whitelist before determining whether it should allow the caller access to recorded messages. Another example: an Internet telephone application that displays the calling party number (and/or an associated name retrieved from a local database) of a caller, which a human may review to make a policy decision before answering a call. In both of these cases, attackers might attempt to circumvent these authorization policies through impersonation. If the calling party number could be verified - that is, if the receiving person or application could know with reasonable certainty that the calling number was not spoofed - then additional screening could be bypassed. The voicemail service could give the caller direct access to the mailbox without demanding a password; the Internet telephone application could tell the human that less stringent verbal verification procedures can be applied because we have confidence that the caller is who they claim to be." Obviously any well-designed use of current calling number information should recognize how readily this can be spoofed and should not operate without some additional form of verification. It is incorrect to say "The mechanism described in this document provides a strong identity system for detecting attempted impersonation in SIP requests." What is strong about this mechanism is detecting that that the caller is authorized to use the claimed phone number. Since most calls, for the foreseeable future, will lack the Identity header, the mechanism provides no real means of detecting attempted impersonation. Whether a call without an Identity header is or is not an impersonation cannot be determined. Certainly a call with an Identity header that does not verify can be assumed to be either an impersonation or a technical or operational failure, but it seems unlikely that impersonators would go to the trouble of sending an Identity header that will not verify. There is some related discussion currently in section 12.5, but I believe this needs to be brought forward and made more explicit because the "transition" will not be quick. We should also be careful not to assert that this mechanism universally protects the CALLER NAME that is presented for many public network calls. If the NAME is being retrieved from a LOCAL DATABASE (such as the user's contact list in a mobile phone) there is less concern. But if the name is retrieved, as it so often currently is in real-world deployments, from some network database populated by any number of different contributors (including abusers), this mechanism provides no vehicle to prevent a caller with a verified NUMBER from linking that number to a NAME like "Card Services" or "FBI" or "Frankel David" when they are in fact none of the above. The existing text says "the calling party number (and/or Caller-ID) of a caller" but "Caller-ID" is not defined and is ambiguous. Section 12.6 discusses signing of the Display Name; the text indicates this is out of scope but offers some thoughts. I think Display Name generally is out of scope (RFC7340 states: "This effort does not consider how the display name of the caller might be validated.") so 4474bis shouldn't indicate what action "should" or "could" be taken with respect to that field. Note that the Display Name field is only applicable for end-to-end SIP calls. I suggest replacing 12.6 paragraph two as follows: "Many current telephony deployments use the calling number to derive an alphanumeric Calling Name for display to the called party. Given the nature of many of these deployments, even a verified calling number could result in the display of a falsified or impersonated name. The verified calling number will be most useful when the name is derived from a local database (such as a mobile phone contact list) maintained and trusted by the call recipient." We still need a discussion of the other half of the problem (per RFC7340), which is ANONYMIZATION of the calling party. What I see today in 4474bis addresses forms such as "anonymous@example.com" where the caller explicitly declares anonymity. This is really related to privacy, which is why 4474bis has it in a section with that title. For abusive calls, the calling party generally achieves true anonymity either by spoofing somebody else's phone number (often, in fact, just using random numbers, or using a number similar to, but distinct from, the called number), or by using one or more numbers that they have acquired but which are challenging to identify (because when called, the number is not answered or yields only a vague voice-mail, and/or because the service provider responsible for the number doesn't know or won't reveal who the actual customer is). The 3. Background section of 4474bis should include some mention of the anonymity problem, just as it discusses impersonation. I suggest: "Today, because it is easy to originate calls with any value in the From header, abusive callers can populate the field with random telephone numbers. Abusive callers (and their enabling service providers) are likely to be the last adopters of the Identity header. Until the Identity header becomes prevalent across the universe of calls (and that will take some time, since it initially will only apply to end-to-end SIP calls, which are a tiny minority), the anonymity problem will remain because the abusive calls will be lost in the sea of normal (but unauthenticated) calls. Additionally, when a significant number of calls generally ARE authenticated, abusive callers may seek to obtain telephone numbers which they can authenticate, but which still are ambiguous as to their ownership. It will be incumbent upon service providers and the regimes in which they operate to prevent such abuses (through means outside the scope of this document). If it is easy and cheap for abusers to obtain quantities of telephone numbers and associated credentials without providing true identity information linked to those numbers, they will be able to remain anonymous even with valid Identity headers in their calls." As an aside, there are about six billion valid numbers in the North American (+1) Numbering Plan. There are currently probably on the order of one billion of those assigned to end-users. Of the remaining five billion, some fraction are allocated to service providers already (but unassigned to end-users); the rest are currently unallocated. Abusive callers have, and will probably continue to have, a variety of options for finding numbers they can use to keep themselves anonymous until all the loopholes are finally closed. DOMAIN vs. NUMBER AUTHENTICATION The Charter of the STIR Working Group states: "The STIR working group will specify Internet-based mechanisms that allow verification of the calling party's authorization to use a particular telephone number for an incoming call." (First Sentence) "The work of this group is limited to developing a solution for telephone numbers. Expansion of the authorization mechanism to identities using the user@domain or other name forms is out of scope." (Fifth Paragraph) Given this, 4474bis should not contain, to the extent that it does, references to authenticating From headers containing alice@example.com or jon@example.com . (These appear repeatedly in Sections 1, 4, 6, and 7.) There is also text about "signing for a domain." This is explicitly outside of scope, and it distracts from the stated purpose of the WG. If nothing else, I think we want the document to read very clearly, to the greatest extent possible, how the spec is used to achieve the goal of authenticating telephone numbers. I suggest that other than to briefly reiterate that it is out of scope, all the references to authentication of domains be removed, and that all examples be restricted to that which is in scope (phone numbers). Certainly there is value in what has been (speculatively) documented regarding signing for a domain. This material could simply be archived for retrieval later, when we are ready to tackle that. If there is insistence that it be included here (despite the mandate in the charter that "expansion...using user@domain...is out of scope"), then it should be collected and placed in an appendix outside the primary flow of the document. I do realize the value of being forward-looking. At the same time, there is such urgency in getting STIR deployed for telephone numbers that I don't think we can afford the distraction. I must admit that I personally have had a terrible time reconciling how this all actually functions for telephone numbers. "Domain" appears 81 times in the document and I can't tell which, if any, of those occurrences is relevant to the telephone number use case. ERRATA In going through the document I encountered a handful of typos. If you search for each of the text snippets below I think the issue will be apparent. those JSON object in a manner following PASSporT implementation the authentication service at an which contains a JSON representations of and add a corresponding an Identity header to the request is OPTIONAL baseline PASSporT objects in SIP as authentication service creates a PASSporT that uses ["object" is missing] verification service performs the procedures above on each [should be "below"] verifier MUST inspect any optional "ppt" parameter appearing the Step 1, is understood), the verifier follows the procedures ["supported" instead of "understood"] prospect that a verification services could receive The verification of an Identity header does not entail [suggest "The successful verification"] encoding of the header and claim component of this it conveys any canonical telephone number formats canonicalization of the numbers and compare them ["numbers" plural?] unless they have some more other implementation-specific way role for a range of telephone and a user agent belonging to Alice included in a PASSporT object in, for example, an "uri" claim. correspond to any field of the SIP request, but then the optional legitimate request for one user is cut-and-pasted into a request consult some sort of directory that indications David Frankel ZipDXR LLC Monte Sereno, CA USA Tel: 1-800-FRANKEL (1-800-372-6535) Watch Our Video! ------=_NextPart_000_10E0_01D1FE35.BE9EB950 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Jon = –

 

Thanks = for investing your time to respond to my comments. I’ll try to = step through each general area briefly.

 

Regarding = some of the text in section 3, Background: thanks for the = modifications.

 

Regarding = caller-name:

You say: “it doesn't protect display-name = (the text you indicate in 12.6), which is the way you carry a caller = name in SIP.” My response is: In the context of what we (or at = least I) am calling a “PUBLIC TELEPHONE NETWORK end-to-end SIP = call” you are incorrect or at least not helpful when you say that = display-name “is the way you carry a caller = name”.

 

Again, my context is a = “phone call” from an endpoint identified with a telephone = number, to a different endpoint with a telephone number, using = telephone-number-based addressing. And I continue to think that is the = PRIMARY focus of this work. In that context, there are several ways of = sourcing a caller-name for display to the end-user, but I believe the = most common are consistent with what I described. At the end of these = comments I’ve given a detailed example for = reference.

 

In the Working Group charter, I = read “the claimed source identity of a SIP request is [currently] = not verified, permitting unauthorized use of the source identity as part = of deceptive and coercive activities….” This is the general = problem that I think the group and the specs are trying to address. From = an end-user perspective both the number and name that they see are part = of the “source identity”. Including some sort of helpful, = clarifying comment about how this particular spec does or does not = influence the name, which is often the more important element in terms = of what the user sees and relies on, strikes me as = appropriate.

 

You say you’re happy with = section 12.6 and that it serves a different purpose. Why don’t you = augment 12.6 then, and make it even more helpful by serving an = additional purpose? My sense is that there is other text currently = included that gives “guidance” on various matters that are = perhaps peripheral to the precise specification but relevant in the = context of the problem statement.

 

Regarding anonymization: =

You say: “I think some of = your concerns about anonymity demonstrate how we use the term = differently in SIP than we might in everyday discourse.” I = introduced my comments by referencing what RFC7340 says about = anonymization. I think I am using the term consistently with that RFC. = The fact that “we use the term differently in SIP” is = perhaps worthy of some explanation in the spec. Addressing anonymization = the way it is used in the STIR Problem Statement (even if it is not = “the way we use it in SIP”) is also worth some = explanation.

 

You say: ”[T]he barrier to = entry to acquiring ‘ambiguous’ telephone numbers is surely = higher than just putting whatever comes to mind in a From header = field.” I don’t think we know that (yet). We certainly hope = it will be. But robocallers are adept at leaping at least low hurdles, = so if the barrier is only “slightly” higher it won’t = be effective. Yes, aspects are discussed in Section 12.5, but I believe = it would be helpful if these issues got some brief mention in the = Background section, with specific attention paid to the context set by = RFC7340. If my text isn’t perfect, can you tighten it up? I note, = by the way, that 12.5 says: “Relying on an Identity header field = generated by a remote administrative domain assumes that the issuing = domain uses recommended administrative practices to authenticate its = users.” What are those “recommended administrative = practices” – I could not find any in the document nor a = reference.

 

Regarding authentication of = domain (not telephone number) URIs:

You say: “I don't think it = constitutes much of a distraction, and in fact, I'd say the solution = would be incomplete without it.” I indicated that my preference = would be to have it removed, but I offered alternatives if you and/or = others insist it be retained. The fact is that I found it = “distracting.” There is some possibility that I am the only = person that will ever read the spec that found this to be the case. I = (and I think others) would like to be able to read the spec in a way = that made it crystal clear how to architect and implement a solution = that works for telephone numbers. Improving the separation between the = telephone number and domain-based steps would be helpful. =

 

I accept that I’m not going = to get the help I want. If nothing else, I suggest keeping the examples = “pure” – in section 5, rather than having 12155551212 = calling sip:alice@example.org, use (or at least include) a phone number = to phone number example. And rather than sip:12155551212@example.com, = use sip:12155551212@123.123.213.231, since almost all real-world phone = number to phone number SIP traffic uses IP addresses and not domain = names. (See my calling name example below.) =

 

I’m glad you liked my nits. = Speaking of nits, I note in the latest revision you say: “The = problem statement of STIR [RFC7340] focuses primarily on cases where the = called and calling parties identified in the To and From header field = values use telephone numbers, as this remains the dominant use case in = the deployment of SIP.” The way I read RFC7340, it focuses ONLY on = telephone number cases (not = “primarily”).

 

On the more substantive points, = my request is that, if you determine that my (or somebody else’s) = suggestion is being made out of ignorance or misunderstanding, you see = if there isn’t SOME tweak to the spec that might be helpful in = preventing others from making a similar = error.

 

 

CALLING NAME DELIVERY EXAMPLE = (USA) – how it works today:

An end-user, Fred, gets his = service from a hosted PBX provider. Fred has been assigned telephone = number 1-212-555-4321. Fred places a call with his IP phone to = 1-415-555-6789; this is a mobile number assigned to Sally. The SIP phone = sends an INVITE to the hosted PBX provider which reoriginates the call = with an INVITE to their wholesale termination provider, with headers = that look like (in relevant part) TO: = <sip:14155556789@32.123.213.188> and FROM: “Fred = Smith” = <sip:12125554321@191.88.177.66>.

 

The termination provider = reoriginates the call to their transit provider with headers that look = like (in relevant part) TO: <sip:14155556789@154.132.10.198> and = FROM:  <sip:12125554321@32.123.213.186>. Note that the = Display Name has been removed from the FROM header; they didn’t = need to do this, but it’s their = practice.

 

The transit provider sends the = call to Sally’s mobile operator by reoriginating the call using = similar TO and FROM headers.

 

The mobile operator receives the = call; it has gone SIP end-to-end from the origination point. If Sally = subscribes to the mobile operator’s optional “calling = name” service, the mobile operator performs an SS7 TCAP CNAM = query, or something somewhat equivalent, supplying the telephone number = from the TO header (14155556789). The query returns, perhaps, = “SMITH FRED” and the mobile operator sends this over its air = interface to Sally’s phone for = display.

 

If Sally has NOT subscribed to = the “calling name” service, the mobile operator sends only = the telephone number. Sally’s smartphone looks this up in her = contact database; if it finds it, it displays the name; if not found, it = may display nothing, or it may have an alternate look-up mechanism which = might yield a name or a geographic = indicator.

 

 

<= p class=3DMsoNormal>David Frankel

Zip= DX® = LLC

Monte Sereno, CA USA

Tel: 1-800-FRANKEL = (1-800-372-6535)

Watch = Our Video!

 

From: stir = [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, = Jon
Sent: Wednesday, August 24, 2016 12:38 AM
To: = David Frankel <dfrankel@zipdx.com>; = stir@ietf.org
Subject: Re: [stir] My Editorial Suggestions on = RFC4474bis

 

 

=

Hi = David,

 

=

You are correct that the first = sentence of Section 3 sort of lumps robocalling, voicemail hacking, and = swatting into one bucket, and that "enable" doesn't fit all = the contents of that bucket equally well. Voicemail hacking ("News = of the World" style) is directly enabled by impersonation, you = can't do it without impersonation. I think I might say instead that = these practices "commonly leverage" an attacker's ability to = impersonate someone else's identity. I think though I'm going to end up = removing this text from the spec anyway, and instead slightly amplifying = the text in the introduction about = RFC7340.

 

=

As to whether the mechanism = described in the document "provides a strong identity system for = detecting attempted impersonation," I'm afraid I can't agree with = your reasons for saying that is incorrect. A lack of implementation = would not change whether or not the -document- describes such a system. = The presence or absence of an Identity header from any given SIP message = wouldn't change that either. This is a sentence about a document, not = about a deployment.  But again, I think this text will likely be = removed for unrelated reasons.

 

=

The specification is very careful = to say that it does not protect caller name, but it does so by saying = that it doesn't protect display-name (the text you indicate in 12.6), = which is the way you carry a caller name in SIP. There is no other = commentary of any kind about how systems might derive caller name in = this specification, and I'd hesitate to introduce some. The text in the = second paragraph of 12.6 serves a very different purpose than the = paragraph you propose to replace it. I don't see any harm in noting that = telephone numbers are sometimes used to derive display names, but I see = no justification for having this specification deliver guidance on what = sort of name databases consumers should or should not = trust.

 

=

I = think some of your concerns about anonymity demonstrate how we use the = term differently in SIP than we might in everyday discourse. If you = "achieve true anonymity by spoofing somebody else's phone number = (often, in fact, just random numbers)" you are still spoofing a = phone number. Your ability to spoof telephone numbers enables that. What = it is to claim anonymity in SIP is to not divulge an individual = identifier for yourself, usually by using instead some kind of privacy = service which sets your identity to something that makes it clear that = you want to remain anonymous. Impersonating random telephone numbers is = different - it is still impersonating numbers. As the Privacy = Considerations state, and state correctly I believe, "None of the = relevant attacks, all of which rely on the attacker taking on the = identity of a victim or hiding their identity using someone else's = identity, are enabled by anonymous = identity."

 

=

As to the problem of abusive = users obtaining telephone numbers "which they can authenticate, but = which still are ambiguous as to their ownership," this is noted in = the section on "Authorization and Transitional Strategies," as = are most of the similar concerns you raise here. We all know, = for example, that security vulnerabilities could allow attackers to = compromise devices that could make calls which possess totally valid = credentials. No one here thinks secure signaling is a silver bullet. = However, the barrier to entry for populating a From header field, versus = compromising a device, is very different. Similarly, the barrier to = entry to acquiring "ambiguous" telephone numbers is surely = higher than just putting whatever comes to mind in a From header field. = The differences are real; I don't think we're overselling = them.

 

=

While I do agree that the STIR = charter considers "greenfield" SIP URIs out of scope, we long = ago made a consensus decision in this working group not to bar that text = from rfc4474bis or any other proposals for solutions here. STIR does not = require this to solve its immediate threat model. However, as we looked = at gatewaying and so on, we quickly saw that there were going to be = cases where such identifiers would appear. I don't think it constitutes = much of a distraction, and in fact, I'd say the solution would be = incomplete without it.

 

=

Your nits are appreciated - this = text is getting a pretty thorough errata-vetting at this = point.

 

=

Thanks,

 

=

Jon = Peterson

Neustar, = Inc.

 

=

From: = stir <stir-bounces@ietf.org> on = behalf of David Frankel <dfrankel@zipdx.com>
Organ= ization: ZipDX LLC
Date: Sunday, August 21, 2016 at 10:17 = AM
To: "stir@ietf.org" <stir@ietf.org>
Subject: = [stir] My Editorial Suggestions on = RFC4474bis

 

=

Since my last notes, = I’ve gotten some constructive feedback here and privately. Now, = hoping to also be constructive, I want to volunteer some comments about = specific content in the 4474bis document.

 

I’ll preface this as = follows: My interest is in how, and to what extent, the proposed = functionality will address abuse of the public telephone network. =

 

By “public telephone = network” I mean that evolving set of networks and technologies = which permit any party to make a “telephone call” to any = other party, from and to anywhere on the globe, using conventional = telephone number addressing and involving either conventional (circa = 1970, perhaps?) telephones, or something emulating such an instrument = (mobile phone, smart phone, web phone, IP phone, etc.). If we could = start over today, we’d no doubt design the system completely = differently, but with an installed base of perhaps six or seven billion = endpoints and associated addresses, and still growing, it seems likely = that this network is still some distance from = retirement.

 

By “abuse” I = mean (1) the use of the network to defraud, steal from, or deny service = to a call recipient; (2) placing of programmatic unsolicited = marketing-related and similar calls that, intentionally or not, annoy or = harass a call recipient. I note that the prevalence of these abuses = compromises the beneficial uses of the network by promoting suboptimal = behaviors on the part of telephone subscribers (refusing to answer any = call for fear it is an abusive call; sending all or most calls to = voice-mail or CAPTCHA to avoid abusive calls; etc.); this impedes the = flow and utility of good (non-abusive) calls.

 

Rather than parsing the = document section by section, I’ve structured my comments = categorically since several of my suggestions touch in multiple = places.

 

OBJECTIVES / = PURPOSE

 

I want to reiterate some = text from the SIP WG charter because I need to confirm that we are all = on the same page regarding our goals. It states: “Since it has = become fairly easy to present an incorrect source telephone number, a = growing set of problems have emerged over the last decade. As with = email, the claimed source identity of a SIP request is not verified, = permitting unauthorized use of the source identity as part of deceptive = and coercive activities, such as robocalling (bulk unsolicited = commercial communications), vishing (voicemail hacking, and = impersonating banks) and swatting (impersonating callers to emergency = services to stimulate unwarranted large scale law enforcement = deployments). In addition, use of an incorrect source telephone number = facilitates wire fraud or can lead to a return call at premium = rates.” (Paragraph 1) And “As its priority mechanism work = item, the working group will specify a SIP header-based mechanism for = verification that the originator of a SIP session is authorized to use = the claimed source telephone number, where the session is established = with SIP end to end.” (Paragraph 3)

 

That strikes me as a noble = undertaking and I’m reading the document in that = context.

 

4474bis states at 3. = Background: “Per [RFC7340], problems such as robocalling, = voicemail hacking, and swatting are enabled by an attacker's ability to = impersonate someone else.” I don’t agree that RFC7340 states = that these abuses are “enabled” by the “ability to = impersonate someone else.” First, “enabled” implies = that if there were no such ability, then these attacks would be = “disabled” and it isn’t that cut and dried. = Impersonation “facilitates” (or as the charter states, is = “part of”) deceptive and coercive activities. Second, = RFC7340 is explicit that both impersonation and obfuscation (or = obscuration) contribute to the problems. At Page 4, it says: “In = general, number spoofing is used in two ways: impersonation and = anonymization.”

 

When explaining the = context and how 4474bis fits, caution and precision are important. = Here’s my attempt at replacing the first paragraph of section = 3:

 

“Per [RFC7340], = attackers often take advantage of the current ease with which calling = telephone numbers can be spoofed, and the singular reliance some call = recipients place on that value. This allows abuse, for example, of a = voicemail service that compares the identity of the caller to a = whitelist before determining whether it should allow the caller access = to recorded messages. Another example: an Internet telephone application = that displays the calling party number (and/or an associated name = retrieved from a local database) of a caller, which a human may review = to make a policy decision before answering a call. In both of these = cases, attackers might attempt to circumvent these authorization = policies through impersonation. If the calling party number could be = verified – that is, if the receiving person or application could = know with reasonable certainty that the calling number was not spoofed = – then additional screening could be bypassed. The voicemail = service could give the caller direct access to the mailbox without = demanding a password; the Internet telephone application could tell the = human that less stringent verbal verification procedures can be applied = because we have confidence that the caller is who they claim to = be.”

 

Obviously any = well-designed use of current calling number information should recognize = how readily this can be spoofed and should not operate without some = additional form of verification.

 

It is incorrect to say = “The mechanism described in this document provides a strong = identity system for detecting attempted impersonation in SIP = requests.” What is strong about this mechanism is detecting that = that the caller is authorized to use the claimed phone number. Since = most calls, for the foreseeable future, will lack the Identity header, = the mechanism provides no real means of detecting attempted = impersonation. Whether a call without an Identity header is or is not an = impersonation cannot be determined. Certainly a call with an Identity = header that does not verify can be assumed to be either an impersonation = or a technical or operational failure, but it seems unlikely that = impersonators would go to the trouble of sending an Identity header that = will not verify.

 

There is some related = discussion currently in section 12.5, but I believe this needs to be = brought forward and made more explicit because the = “transition” will not be quick.

 

We should also be careful = not to assert that this mechanism universally protects the CALLER NAME = that is presented for many public network calls. If the NAME is being = retrieved from a LOCAL DATABASE (such as the user’s contact list = in a mobile phone) there is less concern. But if the name is retrieved, = as it so often currently is in real-world deployments, from some network = database populated by any number of different contributors (including = abusers), this mechanism provides no vehicle to prevent a caller with a = verified NUMBER from linking that number to a NAME like “Card = Services” or “FBI” or “Frankel David” when = they are in fact none of the above. The existing text says “the = calling party number (and/or Caller-ID) of a caller” but = “Caller-ID” is not defined and is = ambiguous.

 

Section 12.6 discusses = signing of the Display Name; the text indicates this is out of scope but = offers some thoughts. I think Display Name generally is out of scope = (RFC7340 states: “This effort does not consider how the display = name of the caller might be validated.”) so 4474bis = shouldn’t indicate what action “should” or = “could” be taken with respect to that field. Note that the = Display Name field is only applicable for end-to-end SIP calls. I = suggest replacing 12.6 paragraph two as follows:

        &nb= sp;     

“Many current = telephony deployments use the calling number to derive an alphanumeric = Calling Name for display to the called party. Given the nature of many = of these deployments, even a verified calling number could result in the = display of a falsified or impersonated name. The verified calling number = will be most useful when the name is derived from a local database (such = as a mobile phone contact list) maintained and trusted by the call = recipient.”

 

We still need a discussion = of the other half of the problem (per RFC7340), which is ANONYMIZATION = of the calling party. What I see today in 4474bis addresses forms such = as “anonymous@example.com= ” where the caller explicitly declares anonymity. This is = really related to privacy, which is why 4474bis has it in a section with = that title.

 

For abusive calls, the = calling party generally achieves true anonymity either by spoofing = somebody else’s phone number (often, in fact, just using random = numbers, or using a number similar to, but distinct from, the called = number), or by using one or more numbers that they have acquired but = which are challenging to identify (because when called, the number is = not answered or yields only a vague voice-mail, and/or because the = service provider responsible for the number doesn’t know or = won’t reveal who the actual customer is).

 

The 3. Background section = of 4474bis should include some mention of the anonymity problem, just as = it discusses impersonation. I suggest: “Today, because it is easy = to originate calls with any value in the From header, abusive callers = can populate the field with random telephone numbers. Abusive callers = (and their enabling service providers) are likely to be the last = adopters of the Identity header. Until the Identity header becomes = prevalent across the universe of calls (and that will take some time, = since it initially will only apply to end-to-end SIP calls, which are a = tiny minority), the anonymity problem will remain because the abusive = calls will be lost in the sea of normal (but unauthenticated) calls. = Additionally, when a significant number of calls generally ARE = authenticated, abusive callers may seek to obtain telephone numbers = which they can authenticate, but which still are ambiguous as to their = ownership. It will be incumbent upon service providers and the regimes = in which they operate to prevent such abuses (through means outside the = scope of this document). If it is easy and cheap for abusers to obtain = quantities of telephone numbers and associated credentials without = providing true identity information linked to those numbers, they will = be able to remain anonymous even with valid Identity headers in their = calls.”

 

As an aside, there are = about six billion valid numbers in the North American (+1) Numbering = Plan. There are currently probably on the order of one billion of those = assigned to end-users. Of the remaining five billion, some fraction are = allocated to service providers already (but unassigned to end-users); = the rest are currently unallocated. Abusive callers have, and will = probably continue to have, a variety of options for finding numbers they = can use to keep themselves anonymous until all the loopholes are finally = closed.

 

DOMAIN vs. NUMBER = AUTHENTICATION

 

The Charter of the STIR = Working Group states:

 

“The STIR working = group will specify Internet-based mechanisms that allow verification of = the calling party's authorization to use a particular telephone number = for an incoming call.” (First Sentence)

 

“The work of this = group is limited to developing a solution for telephone numbers. = Expansion of the authorization mechanism to identities using the = user@domain or other name forms is out of scope.” (Fifth = Paragraph)

 

Given this, 4474bis should = not contain, to the extent that it does, references to authenticating = >From headers containing alice@example.com or jon@example.com. (These appear = repeatedly in Sections 1, 4, 6, and 7.) There is also text about = “signing for a domain.”

 

This is explicitly outside = of scope, and it distracts from the stated purpose of the WG. If nothing = else, I think we want the document to read very clearly, to the greatest = extent possible, how the spec is used to achieve the goal of = authenticating telephone numbers.

 

I suggest that other than = to briefly reiterate that it is out of scope, all the references to = authentication of domains be removed, and that all examples be = restricted to that which is in scope (phone = numbers).

 

Certainly there is value = in what has been (speculatively) documented regarding signing for a = domain. This material could simply be archived for retrieval later, when = we are ready to tackle that.

 

If there is insistence = that it be included here (despite the mandate in the charter that = “expansion...using user@domain...is out of = scope”), then it should be collected and placed in an appendix = outside the primary flow of the document. I do realize the value of = being forward-looking. At the same time, there is such urgency in = getting STIR deployed for telephone numbers that I don’t think we = can afford the distraction.

 

I must admit that I = personally have had a terrible time reconciling how this all actually = functions for telephone numbers. “Domain” appears 81 times = in the document and I can’t tell which, if any, of those = occurrences is relevant to the telephone number use = case.

 

ERRATA

 

In going through the = document I encountered a handful of typos. If you search for each of the = text snippets below I think the issue will be = apparent.

 

those JSON object in a = manner following PASSporT

 

implementation the = authentication service at an

 

which contains a JSON = representations of

 

and add a corresponding an = Identity header to the request

 

is OPTIONAL baseline = PASSporT objects in SIP as

 

authentication service = creates a PASSporT that uses [“object” is = missing]

 

verification service = performs the procedures above on each [should be = “below”]

 

verifier MUST inspect any = optional "ppt" parameter appearing the

 

Step 1, is understood), = the verifier follows the procedures [“supported” instead of = “understood”]

 

prospect that a = verification services could receive

 

The verification of an = Identity header does not entail [suggest “The successful = verification”]

 

encoding of the header and = claim component of

 

this it conveys any = canonical telephone number formats

 

canonicalization of the = numbers and compare them [“numbers” = plural?]

 

unless they have some more = other implementation-specific way

 

role for a range of = telephone and a user agent belonging to Alice

 

included in a PASSporT = object in, for example, an "uri" = claim.

 

correspond to any field of = the SIP request, but then the optional

 

legitimate request for one = user is cut-and-pasted into a request

 

consult some sort of = directory that indications

 

 

David = Frankel

ZipDX® LLC

Monte Sereno, CA USA

Tel: 1-800-FRANKEL (1-800-372-6535)

Watch Our Video!

 

------=_NextPart_000_10E0_01D1FE35.BE9EB950-- From nobody Wed Aug 24 22:41:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFABA12B028 for ; Wed, 24 Aug 2016 22:41:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.688 X-Spam-Level: X-Spam-Status: No, score=-2.688 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ml_zfM07SsLJ for ; Wed, 24 Aug 2016 22:41:35 -0700 (PDT) Received: from mail-pa0-x230.google.com (mail-pa0-x230.google.com [IPv6:2607:f8b0:400e:c03::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB4AD12B01C for ; Wed, 24 Aug 2016 22:41:34 -0700 (PDT) Received: by mail-pa0-x230.google.com with SMTP id fi15so13617216pac.1 for ; Wed, 24 Aug 2016 22:41:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B+ZCN7AxF5F+bzi4ANMZm6VNyO2oVxmAQW0eJv/xM3A=; b=kT9ghQYNZkykVFdiI9P1n+djyd8NLb4Ypa7UXdOJDBfQvI5joPi0TXcB4WybQyiF9N +PUuXzM8vZEMTfG012gT/1xE6VKFWmPZRvCgZRzq1dmb4ZqyEsvN+fGTZW/A0cM3qnZU Gd4nhwo8IJWa4nZj0V8R+Zj8Patf3YLXjZO9/iA6j9bz+7waVMxf8W2oOqiQ7CKETAP+ LfTUt/TuPKSmEDHmTyyfkutEl8Ik91PmvLERwgi5Yv7I6Z7Kp/oZzIz4EcFOJHvFUdZb T2pOJtW0f33/RutOkgLbI4l1aiYPmrWZ8z1ZyXTCqYneSeUM7KMRkQT6uaaCTZyEhrP/ x9Fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B+ZCN7AxF5F+bzi4ANMZm6VNyO2oVxmAQW0eJv/xM3A=; b=ZqCYftuFYtDVzfCbVWwW8NHrFyA69gxjnk4Hasl3ouw5Rv8h58vcZMUzLvxLhdQgRe edXgKvWPgthFppvgM7YmL9tXbRWSTb94xKzwQJ3yDp9BOuY4Gg4gHoLbMjvHP/m7L1rM OLX3I+QuJ6UbZdInSGTyNiuj7la+zAUyxQktOHhUJZPLl4LJg0loRyU8jbzjDkMO26tn hmlpUQ6C3rNpdQ0farpATLw/0aTVYIZqrbbAeWislGwvvZ0CtSOgKiNrpIwVB0oYC3+d tM9eOs2EeETjfzuzlj06/eV87FlYVKPworNa+vD51jPWqjydbdL0G7ZTCBof3xsF4Vop 5HWg== X-Gm-Message-State: AE9vXwMMXmqZJdBWNqMPan5MugZWcfpMgjRbEzDztrN2GTmcdXFUV62xbWaSjuR54Yl44A== X-Received: by 10.66.185.14 with SMTP id ey14mr13079350pac.71.1472103694330; Wed, 24 Aug 2016 22:41:34 -0700 (PDT) Received: from [10.104.156.125] ([166.176.186.107]) by smtp.gmail.com with ESMTPSA id e187sm17701389pfg.43.2016.08.24.22.41.32 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 24 Aug 2016 22:41:33 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-DE234AF6-CCE2-4AEC-B22E-B7CA290101B8 Mime-Version: 1.0 (1.0) From: Bernard Aboba X-Mailer: iPhone Mail (13G35) In-Reply-To: <10df01d1fe70$6af44280$40dcc780$@zipdx.com> Date: Wed, 24 Aug 2016 22:41:31 -0700 Content-Transfer-Encoding: 7bit Message-Id: <50FDDC35-0B7B-45DE-8C95-FECF5D070BE5@gmail.com> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <10df01d1fe70$6af44280$40dcc780$@zipdx.com> To: stir@ietf.org Archived-At: Cc: David Frankel , "Peterson, Jon" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Aug 2016 05:41:39 -0000 --Apple-Mail-DE234AF6-CCE2-4AEC-B22E-B7CA290101B8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Aug 24, 2016, at 6:31 PM, David Frankel wrote: > =20 > CALLING NAME DELIVERY EXAMPLE (USA) =E2=80=93 how it works today: > An end-user, Fred, gets his service from a hosted PBX provider. Fred has b= een assigned telephone number 1-212-555-4321. Fred places a call with his IP= phone to 1-415-555-6789; this is a mobile number assigned to Sally. The SIP= phone sends an INVITE to the hosted PBX provider which reoriginates the cal= l with an INVITE to their wholesale termination provider, with headers that l= ook like (in relevant part) TO: and FROM: =E2= =80=9CFred Smith=E2=80=9D . > =20 > The termination provider reoriginates the call to their transit provider w= ith headers that look like (in relevant part) TO: and FROM: . Note that the Display Na= me has been removed from the FROM header; they didn=E2=80=99t need to do thi= s, but it=E2=80=99s their practice. [BA] This is a good example since it highlights some of the issues with SP-o= nly signing. Due to the reorigination, even if we did have SP signing, the SIP headers ma= y not provide enough information to enable traceback since only the wholesal= e provider signature is available (and the hosted PBX provider may be obscur= ed). And there are reasons why even that could be absent. The hosted PBX provider and the wholesale termination provider may be differ= ent, and the hosted PBX provider while being able to authenticate endpoints,= may have no ability to verify TN authorization, since it did not assign the= TNs. Also, the wholesale provider may be presented with calls originating f= rom TNs outside its authority. As an example, PBXes frequently have PSTN lin= es for backup in event of an Internet outage and may use those PSTN TNs as t= he originator for emergency service calls that could be sent using VOIP even= when there is no outage. The wholesaler did not assign those TNs so has no a= bility to verify their authorization. > =20 > The transit provider sends the call to Sally=E2=80=99s mobile operator by r= eoriginating the call using similar TO and FROM headers. > =20 > The mobile operator receives the call; it has gone SIP end-to-end from the= origination point. If Sally subscribes to the mobile operator=E2=80=99s opt= ional =E2=80=9Ccalling name=E2=80=9D service, the mobile operator performs a= n SS7 TCAP CNAM query, or something somewhat equivalent, supplying the telep= hone number from the TO header (14155556789). The query returns, perhaps, =E2= =80=9CSMITH FRED=E2=80=9D and the mobile operator sends this over its air in= terface to Sally=E2=80=99s phone for display. > =20 > If Sally has NOT subscribed to the =E2=80=9Ccalling name=E2=80=9D service,= the mobile operator sends only the telephone number. Sally=E2=80=99s smartp= hone looks this up in her contact database; if it finds it, it displays the n= ame; if not found, it may display nothing, or it may have an alternate look-= up mechanism which might yield a name or a geographic indicator. > =20 > =20 > David Frankel > ZipDX=C2=AE LLC > Monte Sereno, CA USA > Tel: 1-800-FRANKEL (1-800-372-6535) > Watch Our Video! > =20 > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon > Sent: Wednesday, August 24, 2016 12:38 AM > To: David Frankel ; stir@ietf.org > Subject: Re: [stir] My Editorial Suggestions on RFC4474bis > =20 > =20 > Hi David, > =20 > You are correct that the first sentence of Section 3 sort of lumps robocal= ling, voicemail hacking, and swatting into one bucket, and that "enable" doe= sn't fit all the contents of that bucket equally well. Voicemail hacking ("N= ews of the World" style) is directly enabled by impersonation, you can't do i= t without impersonation. I think I might say instead that these practices "c= ommonly leverage" an attacker's ability to impersonate someone else's identi= ty. I think though I'm going to end up removing this text from the spec anyw= ay, and instead slightly amplifying the text in the introduction about RFC73= 40. > =20 > As to whether the mechanism described in the document "provides a strong i= dentity system for detecting attempted impersonation," I'm afraid I can't ag= ree with your reasons for saying that is incorrect. A lack of implementation= would not change whether or not the -document- describes such a system. The= presence or absence of an Identity header from any given SIP message wouldn= 't change that either. This is a sentence about a document, not about a depl= oyment. But again, I think this text will likely be removed for unrelated r= easons. > =20 > The specification is very careful to say that it does not protect caller n= ame, but it does so by saying that it doesn't protect display-name (the text= you indicate in 12.6), which is the way you carry a caller name in SIP. The= re is no other commentary of any kind about how systems might derive caller n= ame in this specification, and I'd hesitate to introduce some. The text in t= he second paragraph of 12.6 serves a very different purpose than the paragra= ph you propose to replace it. I don't see any harm in noting that telephone n= umbers are sometimes used to derive display names, but I see no justificatio= n for having this specification deliver guidance on what sort of name databa= ses consumers should or should not trust. > =20 > I think some of your concerns about anonymity demonstrate how we use the t= erm differently in SIP than we might in everyday discourse. If you "achieve t= rue anonymity by spoofing somebody else's phone number (often, in fact, just= random numbers)" you are still spoofing a phone number. Your ability to spo= of telephone numbers enables that. What it is to claim anonymity in SIP is t= o not divulge an individual identifier for yourself, usually by using instea= d some kind of privacy service which sets your identity to something that ma= kes it clear that you want to remain anonymous. Impersonating random telepho= ne numbers is different - it is still impersonating numbers. As the Privacy C= onsiderations state, and state correctly I believe, "None of the relevant at= tacks, all of which rely on the attacker taking on the identity of a victim o= r hiding their identity using someone else's identity, are enabled by anonym= ous identity." > =20 > As to the problem of abusive users obtaining telephone numbers "which they= can authenticate, but which still are ambiguous as to their ownership," thi= s is noted in the section on "Authorization and Transitional Strategies," as= are most of the similar concerns you raise here. We all know, for example, t= hat security vulnerabilities could allow attackers to compromise devices tha= t could make calls which possess totally valid credentials. No one here thin= ks secure signaling is a silver bullet. However, the barrier to entry for po= pulating a =46rom header field, versus compromising a device, is very differ= ent. Similarly, the barrier to entry to acquiring "ambiguous" telephone numb= ers is surely higher than just putting whatever comes to mind in a =46rom he= ader field. The differences are real; I don't think we're overselling them. > =20 > While I do agree that the STIR charter considers "greenfield" SIP URIs out= of scope, we long ago made a consensus decision in this working group not t= o bar that text from rfc4474bis or any other proposals for solutions here. S= TIR does not require this to solve its immediate threat model. However, as w= e looked at gatewaying and so on, we quickly saw that there were going to be= cases where such identifiers would appear. I don't think it constitutes muc= h of a distraction, and in fact, I'd say the solution would be incomplete wi= thout it. > =20 > Your nits are appreciated - this text is getting a pretty thorough errata-= vetting at this point. > =20 > Thanks, > =20 > Jon Peterson > Neustar, Inc. > =20 > From: stir on behalf of David Frankel > Organization: ZipDX LLC > Date: Sunday, August 21, 2016 at 10:17 AM > To: "stir@ietf.org" > Subject: [stir] My Editorial Suggestions on RFC4474bis > =20 > Since my last notes, I=E2=80=99ve gotten some constructive feedback here a= nd privately. Now, hoping to also be constructive, I want to volunteer some c= omments about specific content in the 4474bis document. > =20 > I=E2=80=99ll preface this as follows: My interest is in how, and to what e= xtent, the proposed functionality will address abuse of the public telephone= network. > =20 > By =E2=80=9Cpublic telephone network=E2=80=9D I mean that evolving set of n= etworks and technologies which permit any party to make a =E2=80=9Ctelephone= call=E2=80=9D to any other party, from and to anywhere on the globe, using c= onventional telephone number addressing and involving either conventional (c= irca 1970, perhaps?) telephones, or something emulating such an instrument (= mobile phone, smart phone, web phone, IP phone, etc.). If we could start ove= r today, we=E2=80=99d no doubt design the system completely differently, but= with an installed base of perhaps six or seven billion endpoints and associ= ated addresses, and still growing, it seems likely that this network is stil= l some distance from retirement. > =20 > By =E2=80=9Cabuse=E2=80=9D I mean (1) the use of the network to defraud, s= teal from, or deny service to a call recipient; (2) placing of programmatic u= nsolicited marketing-related and similar calls that, intentionally or not, a= nnoy or harass a call recipient. I note that the prevalence of these abuses c= ompromises the beneficial uses of the network by promoting suboptimal behavi= ors on the part of telephone subscribers (refusing to answer any call for fe= ar it is an abusive call; sending all or most calls to voice-mail or CAPTCHA= to avoid abusive calls; etc.); this impedes the flow and utility of good (n= on-abusive) calls. > =20 > Rather than parsing the document section by section, I=E2=80=99ve structur= ed my comments categorically since several of my suggestions touch in multip= le places. > =20 > OBJECTIVES / PURPOSE > =20 > I want to reiterate some text from the SIP WG charter because I need to co= nfirm that we are all on the same page regarding our goals. It states: =E2=80= =9CSince it has become fairly easy to present an incorrect source telephone n= umber, a growing set of problems have emerged over the last decade. As with e= mail, the claimed source identity of a SIP request is not verified, permitti= ng unauthorized use of the source identity as part of deceptive and coercive= activities, such as robocalling (bulk unsolicited commercial communications= ), vishing (voicemail hacking, and impersonating banks) and swatting (impers= onating callers to emergency services to stimulate unwarranted large scale l= aw enforcement deployments). In addition, use of an incorrect source telepho= ne number facilitates wire fraud or can lead to a return call at premium rat= es.=E2=80=9D (Paragraph 1) And =E2=80=9CAs its priority mechanism work item,= the working group will specify a SIP header-based mechanism for verificatio= n that the originator of a SIP session is authorized to use the claimed sour= ce telephone number, where the session is established with SIP end to end.=E2= =80=9D (Paragraph 3) > =20 > That strikes me as a noble undertaking and I=E2=80=99m reading the documen= t in that context. > =20 > 4474bis states at 3. Background: =E2=80=9CPer [RFC7340], problems such as r= obocalling, voicemail hacking, and swatting are enabled by an attacker's abi= lity to impersonate someone else.=E2=80=9D I don=E2=80=99t agree that RFC734= 0 states that these abuses are =E2=80=9Cenabled=E2=80=9D by the =E2=80=9Cabi= lity to impersonate someone else.=E2=80=9D First, =E2=80=9Cenabled=E2=80=9D i= mplies that if there were no such ability, then these attacks would be =E2=80= =9Cdisabled=E2=80=9D and it isn=E2=80=99t that cut and dried. Impersonation =E2= =80=9Cfacilitates=E2=80=9D (or as the charter states, is =E2=80=9Cpart of=E2= =80=9D) deceptive and coercive activities. Second, RFC7340 is explicit that b= oth impersonation and obfuscation (or obscuration) contribute to the problem= s. At Page 4, it says: =E2=80=9CIn general, number spoofing is used in two w= ays: impersonation and anonymization.=E2=80=9D > =20 > When explaining the context and how 4474bis fits, caution and precision ar= e important. Here=E2=80=99s my attempt at replacing the first paragraph of s= ection 3: > =20 > =E2=80=9CPer [RFC7340], attackers often take advantage of the current ease= with which calling telephone numbers can be spoofed, and the singular relia= nce some call recipients place on that value. This allows abuse, for example= , of a voicemail service that compares the identity of the caller to a white= list before determining whether it should allow the caller access to recorde= d messages. Another example: an Internet telephone application that displays= the calling party number (and/or an associated name retrieved from a local d= atabase) of a caller, which a human may review to make a policy decision bef= ore answering a call. In both of these cases, attackers might attempt to cir= cumvent these authorization policies through impersonation. If the calling p= arty number could be verified =E2=80=93 that is, if the receiving person or a= pplication could know with reasonable certainty that the calling number was n= ot spoofed =E2=80=93 then additional screening could be bypassed. The voicem= ail service could give the caller direct access to the mailbox without deman= ding a password; the Internet telephone application could tell the human tha= t less stringent verbal verification procedures can be applied because we ha= ve confidence that the caller is who they claim to be.=E2=80=9D > =20 > Obviously any well-designed use of current calling number information shou= ld recognize how readily this can be spoofed and should not operate without s= ome additional form of verification. > =20 > It is incorrect to say =E2=80=9CThe mechanism described in this document p= rovides a strong identity system for detecting attempted impersonation in SI= P requests.=E2=80=9D What is strong about this mechanism is detecting that t= hat the caller is authorized to use the claimed phone number. Since most cal= ls, for the foreseeable future, will lack the Identity header, the mechanism= provides no real means of detecting attempted impersonation. Whether a call= without an Identity header is or is not an impersonation cannot be determin= ed. Certainly a call with an Identity header that does not verify can be ass= umed to be either an impersonation or a technical or operational failure, bu= t it seems unlikely that impersonators would go to the trouble of sending an= Identity header that will not verify. > =20 > There is some related discussion currently in section 12.5, but I believe t= his needs to be brought forward and made more explicit because the =E2=80=9C= transition=E2=80=9D will not be quick. > =20 > We should also be careful not to assert that this mechanism universally pr= otects the CALLER NAME that is presented for many public network calls. If t= he NAME is being retrieved from a LOCAL DATABASE (such as the user=E2=80=99s= contact list in a mobile phone) there is less concern. But if the name is r= etrieved, as it so often currently is in real-world deployments, from some n= etwork database populated by any number of different contributors (including= abusers), this mechanism provides no vehicle to prevent a caller with a ver= ified NUMBER from linking that number to a NAME like =E2=80=9CCard Services=E2= =80=9D or =E2=80=9CFBI=E2=80=9D or =E2=80=9CFrankel David=E2=80=9D when they= are in fact none of the above. The existing text says =E2=80=9Cthe calling p= arty number (and/or Caller-ID) of a caller=E2=80=9D but =E2=80=9CCaller-ID=E2= =80=9D is not defined and is ambiguous. > =20 > Section 12.6 discusses signing of the Display Name; the text indicates thi= s is out of scope but offers some thoughts. I think Display Name generally i= s out of scope (RFC7340 states: =E2=80=9CThis effort does not consider how t= he display name of the caller might be validated.=E2=80=9D) so 4474bis shoul= dn=E2=80=99t indicate what action =E2=80=9Cshould=E2=80=9D or =E2=80=9Ccould= =E2=80=9D be taken with respect to that field. Note that the Display Name fi= eld is only applicable for end-to-end SIP calls. I suggest replacing 12.6 pa= ragraph two as follows: > =20 > =E2=80=9CMany current telephony deployments use the calling number to deri= ve an alphanumeric Calling Name for display to the called party. Given the n= ature of many of these deployments, even a verified calling number could res= ult in the display of a falsified or impersonated name. The verified calling= number will be most useful when the name is derived from a local database (= such as a mobile phone contact list) maintained and trusted by the call reci= pient.=E2=80=9D > =20 > We still need a discussion of the other half of the problem (per RFC7340),= which is ANONYMIZATION of the calling party. What I see today in 4474bis ad= dresses forms such as =E2=80=9Canonymous@example.com=E2=80=9D where the call= er explicitly declares anonymity. This is really related to privacy, which i= s why 4474bis has it in a section with that title. > =20 > For abusive calls, the calling party generally achieves true anonymity eit= her by spoofing somebody else=E2=80=99s phone number (often, in fact, just u= sing random numbers, or using a number similar to, but distinct from, the ca= lled number), or by using one or more numbers that they have acquired but wh= ich are challenging to identify (because when called, the number is not answ= ered or yields only a vague voice-mail, and/or because the service provider r= esponsible for the number doesn=E2=80=99t know or won=E2=80=99t reveal who t= he actual customer is). > =20 > The 3. Background section of 4474bis should include some mention of the an= onymity problem, just as it discusses impersonation. I suggest: =E2=80=9CTod= ay, because it is easy to originate calls with any value in the =46rom heade= r, abusive callers can populate the field with random telephone numbers. Abu= sive callers (and their enabling service providers) are likely to be the las= t adopters of the Identity header. Until the Identity header becomes prevale= nt across the universe of calls (and that will take some time, since it init= ially will only apply to end-to-end SIP calls, which are a tiny minority), t= he anonymity problem will remain because the abusive calls will be lost in t= he sea of normal (but unauthenticated) calls. Additionally, when a significa= nt number of calls generally ARE authenticated, abusive callers may seek to o= btain telephone numbers which they can authenticate, but which still are amb= iguous as to their ownership. It will be incumbent upon service providers an= d the regimes in which they operate to prevent such abuses (through means ou= tside the scope of this document). If it is easy and cheap for abusers to ob= tain quantities of telephone numbers and associated credentials without prov= iding true identity information linked to those numbers, they will be able t= o remain anonymous even with valid Identity headers in their calls.=E2=80=9D= > =20 > As an aside, there are about six billion valid numbers in the North Americ= an (+1) Numbering Plan. There are currently probably on the order of one bil= lion of those assigned to end-users. Of the remaining five billion, some fra= ction are allocated to service providers already (but unassigned to end-user= s); the rest are currently unallocated. Abusive callers have, and will proba= bly continue to have, a variety of options for finding numbers they can use t= o keep themselves anonymous until all the loopholes are finally closed. > =20 > DOMAIN vs. NUMBER AUTHENTICATION > =20 > The Charter of the STIR Working Group states: > =20 > =E2=80=9CThe STIR working group will specify Internet-based mechanisms tha= t allow verification of the calling party's authorization to use a particula= r telephone number for an incoming call.=E2=80=9D (First Sentence) > =20 > =E2=80=9CThe work of this group is limited to developing a solution for te= lephone numbers. Expansion of the authorization mechanism to identities usin= g the user@domain or other name forms is out of scope.=E2=80=9D (Fifth Parag= raph) > =20 > Given this, 4474bis should not contain, to the extent that it does, refere= nces to authenticating >=46rom headers containing alice@example.com or jon@e= xample.com. (These appear repeatedly in Sections 1, 4, 6, and 7.) There is a= lso text about =E2=80=9Csigning for a domain.=E2=80=9D > =20 > This is explicitly outside of scope, and it distracts from the stated purp= ose of the WG. If nothing else, I think we want the document to read very cl= early, to the greatest extent possible, how the spec is used to achieve the g= oal of authenticating telephone numbers. > =20 > I suggest that other than to briefly reiterate that it is out of scope, al= l the references to authentication of domains be removed, and that all examp= les be restricted to that which is in scope (phone numbers). > =20 > Certainly there is value in what has been (speculatively) documented regar= ding signing for a domain. This material could simply be archived for retrie= val later, when we are ready to tackle that. > =20 > If there is insistence that it be included here (despite the mandate in th= e charter that =E2=80=9Cexpansion...using user@domain...is out of scope=E2=80= =9D), then it should be collected and placed in an appendix outside the prim= ary flow of the document. I do realize the value of being forward-looking. A= t the same time, there is such urgency in getting STIR deployed for telephon= e numbers that I don=E2=80=99t think we can afford the distraction. > =20 > I must admit that I personally have had a terrible time reconciling how th= is all actually functions for telephone numbers. =E2=80=9CDomain=E2=80=9D ap= pears 81 times in the document and I can=E2=80=99t tell which, if any, of th= ose occurrences is relevant to the telephone number use case. > =20 > ERRATA > =20 > In going through the document I encountered a handful of typos. If you sea= rch for each of the text snippets below I think the issue will be apparent. > =20 > those JSON object in a manner following PASSporT > =20 > implementation the authentication service at an > =20 > which contains a JSON representations of > =20 > and add a corresponding an Identity header to the request > =20 > is OPTIONAL baseline PASSporT objects in SIP as > =20 > authentication service creates a PASSporT that uses [=E2=80=9Cobject=E2=80= =9D is missing] > =20 > verification service performs the procedures above on each [should be =E2=80= =9Cbelow=E2=80=9D] > =20 > verifier MUST inspect any optional "ppt" parameter appearing the > =20 > Step 1, is understood), the verifier follows the procedures [=E2=80=9Csupp= orted=E2=80=9D instead of =E2=80=9Cunderstood=E2=80=9D] > =20 > prospect that a verification services could receive > =20 > The verification of an Identity header does not entail [suggest =E2=80=9CT= he successful verification=E2=80=9D] > =20 > encoding of the header and claim component of > =20 > this it conveys any canonical telephone number formats > =20 > canonicalization of the numbers and compare them [=E2=80=9Cnumbers=E2=80=9D= plural?] > =20 > unless they have some more other implementation-specific way > =20 > role for a range of telephone and a user agent belonging to Alice > =20 > included in a PASSporT object in, for example, an "uri" claim. > =20 > correspond to any field of the SIP request, but then the optional > =20 > legitimate request for one user is cut-and-pasted into a request > =20 > consult some sort of directory that indications > =20 > =20 > David Frankel > ZipDX=C2=AE LLC > Monte Sereno, CA USA > Tel: 1-800-FRANKEL (1-800-372-6535) > Watch Our Video! > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail-DE234AF6-CCE2-4AEC-B22E-B7CA290101B8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
On Aug 24, 2016, at 6:31 PM= , David Frankel <dfrankel@zipdx.com= > wrote:
<= p class=3D"MsoNormal"> 

CALLING NAME DELIVERY EXAMPLE (USA) =E2=80=93= how it works today:

An end-user, Fred, gets his service from a hosted PBX provider. Fre= d has been assigned telephone number 1-212-555-4321. Fred places a call with= his IP phone to 1-415-555-6789; this is a mobile number assigned to Sally. T= he SIP phone sends an INVITE to the hosted PBX provider which reoriginates t= he call with an INVITE to their wholesale termination provider, with headers= that look like (in relevant part) TO: <sip:14155556789@32.123.213.188> and FROM: =E2=80=9CFred S= mith=E2=80=9D <sip:121255543= 21@191.88.177.66>.

 

The termination provider reoriginates the call to their transit p= rovider with headers that look like (in relevant part) TO: <sip:14155556789@154.132.10.198> and FR= OM:  <sip:12125554321@= 32.123.213.186>. Note that the Display Name has been removed from the= FROM header; they didn=E2=80=99t need to do this, but it=E2=80=99s their pr= actice.


[BA] This is= a good example since it highlights some of the issues with SP-only signing.=

Due to the reorigination, even if we did have SP s= igning, the SIP headers may not provide enough information to enable traceba= ck since only the wholesale provider signature is available (and the hosted P= BX provider may be obscured). And there are reasons why even that could be a= bsent.

The hosted PBX provider and the wholesale termination provider= may be different, and the hosted PBX provider while being able to authentic= ate endpoints, may have no ability to verify TN authorization, since it did n= ot assign the TNs. Also, the wholesale provider may be presented with calls o= riginating from TNs outside its authority. As an example, PBXes frequently h= ave PSTN lines for backup in event of an Internet outage and may use those P= STN TNs as the originator for emergency service calls that could be sent usi= ng VOIP even when there is no outage. The wholesaler did not assign those TN= s so has no ability to verify their authorization.


 

The transit provider sends the call to Sally=E2=80=99s mobile operato= r by reoriginating the call using similar TO and FROM headers.

 =

The mobile operator receives= the call; it has gone SIP end-to-end from the origination point. If Sally s= ubscribes to the mobile operator=E2=80=99s optional =E2=80=9Ccalling name=E2= =80=9D service, the mobile operator performs an SS7 TCAP CNAM query, or some= thing somewhat equivalent, supplying the telephone number from the TO header= (14155556789). The query returns, perhaps, =E2=80=9CSMITH FRED=E2=80=9D and= the mobile operator sends this over its air interface to Sally=E2=80=99s ph= one for display.

 

= If Sally has NOT subscribed to the =E2=80=9Ccalling name=E2=80=9D service, t= he mobile operator sends only the telephone number. Sally=E2=80=99s smartpho= ne looks this up in her contact database; if it finds it, it displays the na= me; if not found, it may display nothing, or it may have an alternate look-u= p mechanism which might yield a name or a geographic indicator.

 

 

David Frankel

ZipDX=C2=AE= LLC

Monte Sereno, CA USA<= /p>

Tel: 1-800-FRANKEL (1-800-372-6535)

Watch Our Video!

 

From:<= /b> stir [mailto:stir-bounces@ietf.= org] On Behalf Of Peterson, Jon
Sent: Wednesday, August= 24, 2016 12:38 AM
To: David Frankel <dfrankel@zipdx.com>; st= ir@ietf.org
Subject: Re: [stir] My Editorial Suggestions on RFC= 4474bis

 

<= o:p> 

Hi David,

 <= /o:p>

You are correct that the first sentence of Section 3 sort= of lumps robocalling, voicemail hacking, and swatting into one bucket, and t= hat "enable" doesn't fit all the contents of that bucket equally well. Voice= mail hacking ("News of the World" style) is directly enabled by impersonatio= n, you can't do it without impersonation. I think I might say instead that t= hese practices "commonly leverage" an attacker's ability to impersonate some= one else's identity. I think though I'm going to end up removing this text f= rom the spec anyway, and instead slightly amplifying the text in the introdu= ction about RFC7340.

=  

= As to whether the mechanism described in the document "provides a strong ide= ntity system for detecting attempted impersonation," I'm afraid I can't agre= e with your reasons for saying that is incorrect. A lack of implementation w= ould not change whether or not the -document- describes such a system. The p= resence or absence of an Identity header from any given SIP message wouldn't= change that either. This is a sentence about a document, not about a deploy= ment.  But again, I think this text will likely be removed for unrelate= d reasons.

 

The specif= ication is very careful to say that it does not protect caller name, but it d= oes so by saying that it doesn't protect display-name (the text you indicate= in 12.6), which is the way you carry a caller name in SIP. There is no othe= r commentary of any kind about how systems might derive caller name in this s= pecification, and I'd hesitate to introduce some. The text in the second par= agraph of 12.6 serves a very different purpose than the paragraph you propos= e to replace it. I don't see any harm in noting that telephone numbers are s= ometimes used to derive display names, but I see no justification for having= this specification deliver guidance on what sort of name databases consumer= s should or should not trust.

 

I think some of your concerns about anonymity demonstrate how we us= e the term differently in SIP than we might in everyday discourse. If you "a= chieve true anonymity by spoofing somebody else's phone number (often, in fa= ct, just random numbers)" you are still spoofing a phone number. Your abilit= y to spoof telephone numbers enables that. What it is to claim anonymity in S= IP is to not divulge an individual identifier for yourself, usually by using= instead some kind of privacy service which sets your identity to something t= hat makes it clear that you want to remain anonymous. Impersonating random t= elephone numbers is different - it is still impersonating numbers. As the Pr= ivacy Considerations state, and state correctly I believe, "None of the rele= vant attacks, all of which rely on the attacker taking on the identity of a v= ictim or hiding their identity using someone else's identity, are enabled by= anonymous identity."

 

As to the problem of abusive users obtaining telephone numbers "which they c= an authenticate, but which still are ambiguous as to their ownership," this i= s noted in the section on "Authorization and Transitional Strategies," as ar= e most of the similar concerns you raise here. We all know, for example= , that security vulnerabilities could allow attackers to compromise devices t= hat could make calls which possess totally valid credentials. No one here th= inks secure signaling is a silver bullet. However, the barrier to entry for p= opulating a =46rom header field, versus compromising a device, is very diffe= rent. Similarly, the barrier to entry to acquiring "ambiguous" telephone num= bers is surely higher than just putting whatever comes to mind in a =46rom h= eader field. The differences are real; I don't think we're overselling t= hem.

 

While I do agree= that the STIR charter considers "greenfield" SIP URIs out of scope, we long= ago made a consensus decision in this working group not to bar that text fr= om rfc4474bis or any other proposals for solutions here. STIR does not requi= re this to solve its immediate threat model. However, as we looked at gatewa= ying and so on, we quickly saw that there were going to be cases where such i= dentifiers would appear. I don't think it constitutes much of a distraction,= and in fact, I'd say the solution would be incomplete without it.

 

Your nits are appreciated - th= is text is getting a pretty thorough errata-vetting at this point.

 

Thanks,

<= /div>

 

Jon Peterson

=

Neustar,= Inc.

 

From: stir <stir-bou= nces@ietf.org> on behalf of David Frankel <dfrankel@zipdx.com>
Organization: ZipDX LLC<= br>Date: Sunday, August 21, 2016 at 10:17 AM
To: "stir@ietf.org" <stir@ietf.org>
Subject: [stir] My Editorial Suggestions o= n RFC4474bis

 

Sin= ce my last notes, I=E2=80=99ve gotten some constructive feedback here and pr= ivately. Now, hoping to also be constructive, I want to volunteer some comme= nts about specific content in the 4474bis document.

 

<= p class=3D"MsoNormal">I=E2=80=99ll preface this a= s follows: My interest is in how, and to what extent, the proposed functiona= lity will address abuse of the public telephone network. <= /p>

 

By =E2=80=9Cpublic t= elephone network=E2=80=9D I mean that evolving set of networks and technolog= ies which permit any party to make a =E2=80=9Ctelephone call=E2=80=9D to any= other party, from and to anywhere on the globe, using conventional telephon= e number addressing and involving either conventional (circa 1970, perhaps?)= telephones, or something emulating such an instrument (mobile phone, smart p= hone, web phone, IP phone, etc.). If we could start over today, we=E2=80=99d= no doubt design the system completely differently, but with an installed ba= se of perhaps six or seven billion endpoints and associated addresses, and s= till growing, it seems likely that this network is still some distance from r= etirement.

 

By =E2=80=9Cabuse=E2=80=9D I mean (1) the use of the network to de= fraud, steal from, or deny service to a call recipient; (2) placing of progr= ammatic unsolicited marketing-related and similar calls that, intentionally o= r not, annoy or harass a call recipient. I note that the prevalence of these= abuses compromises the beneficial uses of the network by promoting suboptim= al behaviors on the part of telephone subscribers (refusing to answer any ca= ll for fear it is an abusive call; sending all or most calls to voice-mail o= r CAPTCHA to avoid abusive calls; etc.); this impedes the flow and utility o= f good (non-abusive) calls.

 

<= span style=3D"color:black">Rather than parsing the document section by secti= on, I=E2=80=99ve structured my comments categorically since several of my su= ggestions touch in multiple places.

 

OBJECTIVES / PURPOSE

 =

I want to reiterate s= ome text from the SIP WG charter because I need to confirm that we are all o= n the same page regarding our goals. It states: =E2=80=9CSince it has become= fairly easy to present an incorrect source telephone number, a growing set o= f problems have emerged over the last decade. As with email, the claimed sou= rce identity of a SIP request is not verified, permitting unauthorized use o= f the source identity as part of deceptive and coercive activities, such as r= obocalling (bulk unsolicited commercial communications), vishing (voicemail h= acking, and impersonating banks) and swatting (impersonating callers to emer= gency services to stimulate unwarranted large scale law enforcement deployme= nts). In addition, use of an incorrect source telephone number facilitates w= ire fraud or can lead to a return call at premium rates.=E2=80=9D (Paragraph= 1) And =E2=80=9CAs its priority mechanism work item, the working group will= specify a SIP header-based mechanism for verification that the originator o= f a SIP session is authorized to use the claimed source telephone number, wh= ere the session is established with SIP end to end.=E2=80=9D (Paragraph 3)

 = ;

Th= at strikes me as a noble undertaking and I=E2=80=99m reading the document in= that context.

 

4474bis states at 3. Background: =E2=80=9CPer [RFC7340], probl= ems such as robocalling, voicemail hacking, and swatting are enabled by an a= ttacker's ability to impersonate someone else.=E2=80=9D I don=E2=80=99t agre= e that RFC7340 states that these abuses are =E2=80=9Cenabled=E2=80=9D by the= =E2=80=9Cability to impersonate someone else.=E2=80=9D First, =E2=80=9Cenab= led=E2=80=9D implies that if there were no such ability, then these attacks w= ould be =E2=80=9Cdisabled=E2=80=9D and it isn=E2=80=99t that cut and dried. I= mpersonation =E2=80=9Cfacilitates=E2=80=9D (or as the charter states, is =E2= =80=9Cpart of=E2=80=9D) deceptive and coercive activities. Second, RFC7340 i= s explicit that both impersonation and obfuscation (or obscuration) contribu= te to the problems. At Page 4, it says: =E2=80=9CIn general, number spoofing= is used in two ways: impersonation and anonymization.=E2=80=9D <= /span>

 

When explain= ing the context and how 4474bis fits, caution and precision are important. H= ere=E2=80=99s my attempt at replacing the first paragraph of section 3:=

 

=E2=80= =9CPer [RFC7340], attackers often take advantage of the current ease with wh= ich calling telephone numbers can be spoofed, and the singular reliance some= call recipients place on that value. This allows abuse, for example, of a v= oicemail service that compares the identity of the caller to a whitelist bef= ore determining whether it should allow the caller access to recorded messag= es. Another example: an Internet telephone application that displays the cal= ling party number (and/or an associated name retrieved from a local database= ) of a caller, which a human may review to make a policy decision before ans= wering a call. In both of these cases, attackers might attempt to circumvent= these authorization policies through impersonation. If the calling party nu= mber could be verified =E2=80=93 that is, if the receiving person or applica= tion could know with reasonable certainty that the calling number was not sp= oofed =E2=80=93 then additional screening could be bypassed. The voicemail s= ervice could give the caller direct access to the mailbox without demanding a= password; the Internet telephone application could tell the human that less= stringent verbal verification procedures can be applied because we have con= fidence that the caller is who they claim to be.=E2=80=9D =

 

Obviously any well= -designed use of current calling number information should recognize how rea= dily this can be spoofed and should not operate without some additional form= of verification.

 

It is incorrect to say =E2=80=9CThe mechanism described in t= his document provides a strong identity system for detecting attempted imper= sonation in SIP requests.=E2=80=9D What is strong about this mechanism is de= tecting that that the caller is authorized to use the claimed phone number. S= ince most calls, for the foreseeable future, will lack the Identity header, t= he mechanism provides no real means of detecting attempted impersonation. Wh= ether a call without an Identity header is or is not an impersonation cannot= be determined. Certainly a call with an Identity header that does not verif= y can be assumed to be either an impersonation or a technical or operational= failure, but it seems unlikely that impersonators would go to the trouble o= f sending an Identity header that will not verify.

 

<= p class=3D"MsoNormal">There is some related disc= ussion currently in section 12.5, but I believe this needs to be brought for= ward and made more explicit because the =E2=80=9Ctransition=E2=80=9D will no= t be quick.

 

We should also be careful not to assert that this mechanism unive= rsally protects the CALLER NAME that is presented for many public network ca= lls. If the NAME is being retrieved from a LOCAL DATABASE (such as the user=E2= =80=99s contact list in a mobile phone) there is less concern. But if the na= me is retrieved, as it so often currently is in real-world deployments, from= some network database populated by any number of different contributors (in= cluding abusers), this mechanism provides no vehicle to prevent a caller wit= h a verified NUMBER from linking that number to a NAME like =E2=80=9CCard Se= rvices=E2=80=9D or =E2=80=9CFBI=E2=80=9D or =E2=80=9CFrankel David=E2=80=9D w= hen they are in fact none of the above. The existing text says =E2=80=9Cthe c= alling party number (and/or Caller-ID) of a caller=E2=80=9D but =E2=80=9CCal= ler-ID=E2=80=9D is not defined and is ambiguous.

 

Section 12.6 discusses signin= g of the Display Name; the text indicates this is out of scope but offers so= me thoughts. I think Display Name generally is out of scope (RFC7340 states:= =E2=80=9CThis effort does not consider how the display name of the caller m= ight be validated.=E2=80=9D) so 4474bis shouldn=E2=80=99t indicate what acti= on =E2=80=9Cshould=E2=80=9D or =E2=80=9Ccould=E2=80=9D be taken with respect= to that field. Note that the Display Name field is only applicable for end-= to-end SIP calls. I suggest replacing 12.6 paragraph two as follows:

  = ;            

=E2=80= =9CMany current telephony deployments use the calling number to derive an al= phanumeric Calling Name for display to the called party. Given the nature of= many of these deployments, even a verified calling number could result in t= he display of a falsified or impersonated name. The verified calling number w= ill be most useful when the name is derived from a local database (such as a= mobile phone contact list) maintained and trusted by the call recipient.=E2= =80=9D

 

We still need a discussion of the other half of the problem (per RFC73= 40), which is ANONYMIZATION of the calling party. What I see today in 4474bi= s addresses forms such as = =E2=80=9Canonymous@example.com=E2=80=9D where the caller explicitly decl= ares anonymity. This is really related to privacy, which is why 4474bis has i= t in a section with that title.

 

For abusive calls, the calling party general= ly achieves true anonymity either by spoofing somebody else=E2=80=99s phone n= umber (often, in fact, just using random numbers, or using a number similar t= o, but distinct from, the called number), or by using one or more numbers th= at they have acquired but which are challenging to identify (because when ca= lled, the number is not answered or yields only a vague voice-mail, and/or b= ecause the service provider responsible for the number doesn=E2=80=99t know o= r won=E2=80=99t reveal who the actual customer is).

 

<= p class=3D"MsoNormal">The 3. Background section o= f 4474bis should include some mention of the anonymity problem, just as it d= iscusses impersonation. I suggest: =E2=80=9CToday, because it is easy to ori= ginate calls with any value in the =46rom header, abusive callers can popula= te the field with random telephone numbers. Abusive callers (and their enabl= ing service providers) are likely to be the last adopters of the Identity he= ader. Until the Identity header becomes prevalent across the universe of cal= ls (and that will take some time, since it initially will only apply to end-= to-end SIP calls, which are a tiny minority), the anonymity problem will rem= ain because the abusive calls will be lost in the sea of normal (but unauthe= nticated) calls. Additionally, when a significant number of calls generally A= RE authenticated, abusive callers may seek to obtain telephone numbers which= they can authenticate, but which still are ambiguous as to their ownership.= It will be incumbent upon service providers and the regimes in which they o= perate to prevent such abuses (through means outside the scope of this docum= ent). If it is easy and cheap for abusers to obtain quantities of telephone n= umbers and associated credentials without providing true identity informatio= n linked to those numbers, they will be able to remain anonymous even with v= alid Identity headers in their calls.=E2=80=9D

 

As an aside, there are about s= ix billion valid numbers in the North American (+1) Numbering Plan. There ar= e currently probably on the order of one billion of those assigned to end-us= ers. Of the remaining five billion, some fraction are allocated to service p= roviders already (but unassigned to end-users); the rest are currently unall= ocated. Abusive callers have, and will probably continue to have, a variety o= f options for finding numbers they can use to keep themselves anonymous unti= l all the loopholes are finally closed.

 

DOMAIN vs. NUMBER AUTHENTICATION=

 

The C= harter of the STIR Working Group states:

 

=E2=80=9CThe STIR working group will= specify Internet-based mechanisms that allow verification of the calling pa= rty's authorization to use a particular telephone number for an incoming cal= l.=E2=80=9D (First Sentence)

 

= =E2=80=9CThe work of this group is limited to de= veloping a solution for telephone numbers. Expansion of the authorization me= chanism to identities using the user@domain or other name forms is out of sc= ope.=E2=80=9D (Fifth Paragraph)

=  

Given this, 4474bis should not contain, to th= e extent that it does, references to authenticating >=46rom headers conta= ining alice@example.com or jon@example.com. (These appear repeatedly in Se= ctions 1, 4, 6, and 7.) There is also text about =E2=80=9Csigning for a doma= in.=E2=80=9D

 

This is explicitly outside of scope, and it distracts from the s= tated purpose of the WG. If nothing else, I think we want the document to re= ad very clearly, to the greatest extent possible, how the spec is used to ac= hieve the goal of authenticating telephone numbers.

 

<= p class=3D"MsoNormal">I suggest that other than t= o briefly reiterate that it is out of scope, all the references to authentic= ation of domains be removed, and that all examples be restricted to that whi= ch is in scope (phone numbers).

=  

Certainly there is value in what has been (sp= eculatively) documented regarding signing for a domain. This material could s= imply be archived for retrieval later, when we are ready to tackle that.

 <= o:p>

If t= here is insistence that it be included here (despite the mandate in the char= ter that =E2=80=9Cexpansion...using user= @domain...is out of scope=E2=80=9D), then it should be collected and pla= ced in an appendix outside the primary flow of the document. I do realize th= e value of being forward-looking. At the same time, there is such urgency in= getting STIR deployed for telephone numbers that I don=E2=80=99t think we c= an afford the distraction.

 

I must admit that I personally have had a terrible= time reconciling how this all actually functions for telephone numbers. =E2= =80=9CDomain=E2=80=9D appears 81 times in the document and I can=E2=80=99t t= ell which, if any, of those occurrences is relevant to the telephone number u= se case.

 

ERRATA

 

In going through the document I encountered a handful of typos= . If you search for each of the text snippets below I think the issue will b= e apparent.

 

those JSON object in a manner following PASSporT

 

implementation th= e authentication service at an

<= span style=3D"color:black"> 

which contains a JSON representations of<= /o:p>

 

and ad= d a corresponding an Identity header to the request

 

<= p class=3D"MsoNormal">is OPTIONAL baseline PASSp= orT objects in SIP as

 

authentication service creates a PASSporT that uses [=E2= =80=9Cobject=E2=80=9D is missing]

 

verification service performs the procedure= s above on each [should be =E2=80=9Cbelow=E2=80=9D]

 

<= p class=3D"MsoNormal">verifier MUST inspect any o= ptional "ppt" parameter appearing the

 

Step 1, is understood), the verifier fo= llows the procedures [=E2=80=9Csupported=E2=80=9D instead of =E2=80=9Cunders= tood=E2=80=9D]

 

prospect that a verification services could receive=

 

The verific= ation of an Identity header does not entail [suggest =E2=80=9CThe successful= verification=E2=80=9D]

 

encoding of the header and claim component of

 =

this it c= onveys any canonical telephone number formats

 

canonicalization of the numbers a= nd compare them [=E2=80=9Cnumbers=E2=80=9D plural?]

 

<= p class=3D"MsoNormal">unless they have some more= other implementation-specific way

 

role for a range of telephone and a user a= gent belonging to Alice

 

included in a PASSporT object in, for example, an "ur= i" claim.

 

correspond to any field of the SIP request, but then the optional

 = ;

le= gitimate request for one user is cut-and-pasted into a request

 =

consult some s= ort of directory that indications

 

 

David Frankel

ZipDX=C2=AE L= LC

Monte Sereno, CA USA

Tel: 1-800-FRANKEL (1-800-372-6535)

W= atch Our Video!

 

=
____________________= ___________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman= /listinfo/stir
= --Apple-Mail-DE234AF6-CCE2-4AEC-B22E-B7CA290101B8-- From nobody Thu Aug 25 06:21:26 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D548012D11B for ; Thu, 25 Aug 2016 06:21:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.589 X-Spam-Level: X-Spam-Status: No, score=-2.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ejwu9EqzDtbA for ; Thu, 25 Aug 2016 06:21:20 -0700 (PDT) Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BEF612B007 for ; Thu, 25 Aug 2016 06:21:19 -0700 (PDT) Received: by mail-qk0-x22e.google.com with SMTP id l2so45094153qkf.3 for ; Thu, 25 Aug 2016 06:21:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=i/VQt1L7ZLbi2lM5Z1lbfOh+ob7/b5B4yTHgPv3vnXk=; b=wPK/pTj//9FSo6O38FYloL6F/RD/a2KsdECMYljnt19lvcN3lWtGEF3TGOX6fUxip6 r2vMZrJfNTcQ1hjVU/rMQIH2I3XXEcOkVQ3nCLH4tYZxTPFdhtmPw/WYV4popOshtEz6 xcpRMocJ3kT4OMXxOdapyAPF/m6pjhf35ryoMpnkzLQsGFnUxJJF5qeuHxhBZ2eI6uAY OayHvZkF3E2fhx61q3BQQSMeV2ATrOmoLwxEqiGtrYa5iR0t4J5ThNKC8g9ADywdLb4B gAhpXKMLVpdaU2Z6AIjnMNidpIhUycRT81Ip6/3c8Y967AyL2kJaOetbzWJutBaCZOkA ghVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=i/VQt1L7ZLbi2lM5Z1lbfOh+ob7/b5B4yTHgPv3vnXk=; b=KwZHUpXVXylAHa2j0V/watTGiwCzZMPU6raGw8Dp/mD/Wiv1Iw4aHbh5KaGKdxzY8W 2YU0+paz5v0GYqVyxX1S2qZ9QRK2mGLptgmoSFif48jMiRxiXb+C4m661iTD4ibLEioA WlNNCEPRn0UkS3X1Nk8FVO0Rce4bvinWloJw+/ftzTQrgItzbElilUKkBkgE3tR48jm2 ZsNf1TYRs+pugYNm/PKOqlHpCPEqlH1yo3Bi/Hl6K9Zr6JwhmW25inNJTuaBQ3lInrhO qDBQ+C3lPUoINefnIr0JQ29JxbhktzXoVEiKYu23bZMtVQs3S/swKEdg4AoJdtTsxk6+ DD5A== X-Gm-Message-State: AE9vXwP7UkgXOfxMiZs8gprZsEHrnQegAWix7erUwYGzICsHINMqrqiWF5tyHKUvNPMQrw== X-Received: by 10.55.49.144 with SMTP id x138mr10240997qkx.227.1472131278502; Thu, 25 Aug 2016 06:21:18 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id n6sm5535744qkf.36.2016.08.25.06.21.17 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 25 Aug 2016 06:21:17 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_0380A203-F847-4F1C-AF5A-06B362503678" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: <50FDDC35-0B7B-45DE-8C95-FECF5D070BE5@gmail.com> Date: Thu, 25 Aug 2016 09:21:15 -0400 Message-Id: <19DDDF24-1C49-41DF-9DEB-981B5CBD06CB@brianrosen.net> References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <10df01d1fe70$6af44280$40dcc780$@zipdx.com> <50FDDC35-0B7B-45DE-8C95-FECF5D070BE5@gmail.com> To: Bernard Aboba X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , David Frankel , "Peterson, Jon" Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Aug 2016 13:21:25 -0000 --Apple-Mail=_0380A203-F847-4F1C-AF5A-06B362503678 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 25, 2016, at 1:41 AM, Bernard Aboba = wrote: >=20 > On Aug 24, 2016, at 6:31 PM, David Frankel > wrote: >> =20 >> CALLING NAME DELIVERY EXAMPLE (USA) =E2=80=93 how it works today: >> An end-user, Fred, gets his service from a hosted PBX provider. Fred = has been assigned telephone number 1-212-555-4321. Fred places a call = with his IP phone to 1-415-555-6789; this is a mobile number assigned to = Sally. The SIP phone sends an INVITE to the hosted PBX provider which = reoriginates the call with an INVITE to their wholesale termination = provider, with headers that look like (in relevant part) TO: = > and = FROM: =E2=80=9CFred Smith=E2=80=9D >. >> =20 >> The termination provider reoriginates the call to their transit = provider with headers that look like (in relevant part) TO: = > and = FROM: >. Note that the Display Name has = been removed from the FROM header; they didn=E2=80=99t need to do this, = but it=E2=80=99s their practice. The canonicalization would use only the phone number, so the fact that = the domain was re-written doesn=E2=80=99t matter. This also means that = editing out the display name doesn=E2=80=99t matter. Any of the device, the hosted PBX or the wholesale termination provider = (assuming the wholesale provider delegated the TN to the hosted PBX = provider) can sign. If the wholesale termination provider signs, he = does so with knowledge that he can pass the hot potato to the hosted PBX = provider. That hosted PBX provider will be left holding it if he = doesn=E2=80=99t really know who Fred is. If he does, then he gets to = pass it to Fred. The wholesale termination provider is very likely to = not tolerate bad calls coming from the hosted PBX provider, regardless = of which of the hosted PBX provider=E2=80=99s customers are at fault. = So, that hosted PBX provider will likely have to cut off Fred if the PBX = provider wants to keep his termination service. >=20 > [BA] This is a good example since it highlights some of the issues = with SP-only signing. >=20 > Due to the reorigination, even if we did have SP signing, the SIP = headers may not provide enough information to enable traceback since = only the wholesale provider signature is available (and the hosted PBX = provider may be obscured). And there are reasons why even that could be = absent. The wholesale termination provider knows that he delegated Fred=E2=80=99s = TN to the hosted PBX provider. So, as long as the TN arrives intact, = which happens in this example, the hot potato can be handed to the = hosted PBX provider. Whether it can be handed to Fred is up to the = hosted PBX provider. but from our point of view, the mechanism allows = the signer (we=E2=80=99re assuming the wholesale termination provider) = to avoid the gauze of law enforcement by being able to hand the potato = to the hosted PBX provider. That wholesale termination provider had = better make sure that the TN is one of the TNs that it assigned to the = hosted PBX provider or it may be left holding the potato. >=20 > The hosted PBX provider and the wholesale termination provider may be = different, and the hosted PBX provider while being able to authenticate = endpoints, may have no ability to verify TN authorization, since it did = not assign the TNs. I think that is incorrect. The wholesale termination = provider is the service provider of record (in the US, via NANPA or PA = delegation, or port in). This is not a case of =E2=80=9Cauthorized = spoofing=E2=80=9D. It=E2=80=99s Fred=E2=80=99s number, but it the = actual delegation processes is to to the wholesale termination provider = and to the hosted PBX provider. In the current scheme, the hosted PBX = provider controls the number, and the wholesale termination provider is = the one to whom calls are routed in the PSTN. > Also, the wholesale provider may be presented with calls originating = from TNs outside its authority. As an example, PBXes frequently have = PSTN lines for backup in event of an Internet outage and may use those = PSTN TNs as the originator for emergency service calls that could be = sent using VOIP even when there is no outage. The wholesaler did not = assign those TNs so has no ability to verify their authorization. There are cases where wholesale termination providers have allowed their = customers to originate calls that have a TN not delegated to the = customer by the termination provider. I use the term =E2=80=9Cauthorized = spoofing=E2=80=9D for them. This is the call center that calls on = behalf of an enterprise. You have another case, where there is a backup = set of trunks to a second provider and the second provider will allow = calls to be sent on those trunks from the TN delegated by the primary = provider. In the stir scheme, the wholesale termination provider would = need to be authorized by the primary provider to sign calls with those = TNs. That=E2=80=99s not a particularly onerous process, but it=E2=80=99s = a new process. >=20 >=20 >> =20 >> The transit provider sends the call to Sally=E2=80=99s mobile = operator by reoriginating the call using similar TO and FROM headers. >> =20 >> The mobile operator receives the call; it has gone SIP end-to-end = from the origination point. If Sally subscribes to the mobile = operator=E2=80=99s optional =E2=80=9Ccalling name=E2=80=9D service, the = mobile operator performs an SS7 TCAP CNAM query, or something somewhat = equivalent, supplying the telephone number from the TO header = (14155556789). The query returns, perhaps, =E2=80=9CSMITH FRED=E2=80=9D = and the mobile operator sends this over its air interface to Sally=E2=80=99= s phone for display. >> =20 >> If Sally has NOT subscribed to the =E2=80=9Ccalling name=E2=80=9D = service, the mobile operator sends only the telephone number. Sally=E2=80=99= s smartphone looks this up in her contact database; if it finds it, it = displays the name; if not found, it may display nothing, or it may have = an alternate look-up mechanism which might yield a name or a geographic = indicator. >> =20 >> =20 >> David Frankel >> ZipDX=C2=AE LLC >> Monte Sereno, CA USA >> Tel: 1-800-FRANKEL (1-800-372-6535) >> Watch Our Video! >> =20 >> From: stir [mailto:stir-bounces@ietf.org = ] On Behalf Of Peterson, Jon >> Sent: Wednesday, August 24, 2016 12:38 AM >> To: David Frankel >; = stir@ietf.org >> Subject: Re: [stir] My Editorial Suggestions on RFC4474bis >> =20 >> =20 >> Hi David, >> =20 >> You are correct that the first sentence of Section 3 sort of lumps = robocalling, voicemail hacking, and swatting into one bucket, and that = "enable" doesn't fit all the contents of that bucket equally well. = Voicemail hacking ("News of the World" style) is directly enabled by = impersonation, you can't do it without impersonation. I think I might = say instead that these practices "commonly leverage" an attacker's = ability to impersonate someone else's identity. I think though I'm going = to end up removing this text from the spec anyway, and instead slightly = amplifying the text in the introduction about RFC7340. >> =20 >> As to whether the mechanism described in the document "provides a = strong identity system for detecting attempted impersonation," I'm = afraid I can't agree with your reasons for saying that is incorrect. A = lack of implementation would not change whether or not the -document- = describes such a system. The presence or absence of an Identity header = from any given SIP message wouldn't change that either. This is a = sentence about a document, not about a deployment. But again, I think = this text will likely be removed for unrelated reasons. >> =20 >> The specification is very careful to say that it does not protect = caller name, but it does so by saying that it doesn't protect = display-name (the text you indicate in 12.6), which is the way you carry = a caller name in SIP. There is no other commentary of any kind about how = systems might derive caller name in this specification, and I'd hesitate = to introduce some. The text in the second paragraph of 12.6 serves a = very different purpose than the paragraph you propose to replace it. I = don't see any harm in noting that telephone numbers are sometimes used = to derive display names, but I see no justification for having this = specification deliver guidance on what sort of name databases consumers = should or should not trust. >> =20 >> I think some of your concerns about anonymity demonstrate how we use = the term differently in SIP than we might in everyday discourse. If you = "achieve true anonymity by spoofing somebody else's phone number (often, = in fact, just random numbers)" you are still spoofing a phone number. = Your ability to spoof telephone numbers enables that. What it is to = claim anonymity in SIP is to not divulge an individual identifier for = yourself, usually by using instead some kind of privacy service which = sets your identity to something that makes it clear that you want to = remain anonymous. Impersonating random telephone numbers is different - = it is still impersonating numbers. As the Privacy Considerations state, = and state correctly I believe, "None of the relevant attacks, all of = which rely on the attacker taking on the identity of a victim or hiding = their identity using someone else's identity, are enabled by anonymous = identity." >> =20 >> As to the problem of abusive users obtaining telephone numbers "which = they can authenticate, but which still are ambiguous as to their = ownership," this is noted in the section on "Authorization and = Transitional Strategies," as are most of the similar concerns you raise = here. We all know, for example, that security vulnerabilities could = allow attackers to compromise devices that could make calls which = possess totally valid credentials. No one here thinks secure signaling = is a silver bullet. However, the barrier to entry for populating a =46rom = header field, versus compromising a device, is very different. = Similarly, the barrier to entry to acquiring "ambiguous" telephone = numbers is surely higher than just putting whatever comes to mind in a = =46rom header field. The differences are real; I don't think we're = overselling them. >> =20 >> While I do agree that the STIR charter considers "greenfield" SIP = URIs out of scope, we long ago made a consensus decision in this working = group not to bar that text from rfc4474bis or any other proposals for = solutions here. STIR does not require this to solve its immediate threat = model. However, as we looked at gatewaying and so on, we quickly saw = that there were going to be cases where such identifiers would appear. I = don't think it constitutes much of a distraction, and in fact, I'd say = the solution would be incomplete without it. >> =20 >> Your nits are appreciated - this text is getting a pretty thorough = errata-vetting at this point. >> =20 >> Thanks, >> =20 >> Jon Peterson >> Neustar, Inc. >> =20 >> From: stir > on = behalf of David Frankel > >> Organization: ZipDX LLC >> Date: Sunday, August 21, 2016 at 10:17 AM >> To: "stir@ietf.org " > >> Subject: [stir] My Editorial Suggestions on RFC4474bis >> =20 >> Since my last notes, I=E2=80=99ve gotten some constructive feedback = here and privately. Now, hoping to also be constructive, I want to = volunteer some comments about specific content in the 4474bis document. >> =20 >> I=E2=80=99ll preface this as follows: My interest is in how, and to = what extent, the proposed functionality will address abuse of the public = telephone network.=20 >> =20 >> By =E2=80=9Cpublic telephone network=E2=80=9D I mean that evolving = set of networks and technologies which permit any party to make a = =E2=80=9Ctelephone call=E2=80=9D to any other party, from and to = anywhere on the globe, using conventional telephone number addressing = and involving either conventional (circa 1970, perhaps?) telephones, or = something emulating such an instrument (mobile phone, smart phone, web = phone, IP phone, etc.). If we could start over today, we=E2=80=99d no = doubt design the system completely differently, but with an installed = base of perhaps six or seven billion endpoints and associated addresses, = and still growing, it seems likely that this network is still some = distance from retirement. >> =20 >> By =E2=80=9Cabuse=E2=80=9D I mean (1) the use of the network to = defraud, steal from, or deny service to a call recipient; (2) placing of = programmatic unsolicited marketing-related and similar calls that, = intentionally or not, annoy or harass a call recipient. I note that the = prevalence of these abuses compromises the beneficial uses of the = network by promoting suboptimal behaviors on the part of telephone = subscribers (refusing to answer any call for fear it is an abusive call; = sending all or most calls to voice-mail or CAPTCHA to avoid abusive = calls; etc.); this impedes the flow and utility of good (non-abusive) = calls. >> =20 >> Rather than parsing the document section by section, I=E2=80=99ve = structured my comments categorically since several of my suggestions = touch in multiple places. >> =20 >> OBJECTIVES / PURPOSE >> =20 >> I want to reiterate some text from the SIP WG charter because I need = to confirm that we are all on the same page regarding our goals. It = states: =E2=80=9CSince it has become fairly easy to present an incorrect = source telephone number, a growing set of problems have emerged over the = last decade. As with email, the claimed source identity of a SIP request = is not verified, permitting unauthorized use of the source identity as = part of deceptive and coercive activities, such as robocalling (bulk = unsolicited commercial communications), vishing (voicemail hacking, and = impersonating banks) and swatting (impersonating callers to emergency = services to stimulate unwarranted large scale law enforcement = deployments). In addition, use of an incorrect source telephone number = facilitates wire fraud or can lead to a return call at premium rates.=E2=80= =9D (Paragraph 1) And =E2=80=9CAs its priority mechanism work item, the = working group will specify a SIP header-based mechanism for verification = that the originator of a SIP session is authorized to use the claimed = source telephone number, where the session is established with SIP end = to end.=E2=80=9D (Paragraph 3) >> =20 >> That strikes me as a noble undertaking and I=E2=80=99m reading the = document in that context. >> =20 >> 4474bis states at 3. Background: =E2=80=9CPer [RFC7340], problems = such as robocalling, voicemail hacking, and swatting are enabled by an = attacker's ability to impersonate someone else.=E2=80=9D I don=E2=80=99t = agree that RFC7340 states that these abuses are =E2=80=9Cenabled=E2=80=9D = by the =E2=80=9Cability to impersonate someone else.=E2=80=9D First, = =E2=80=9Cenabled=E2=80=9D implies that if there were no such ability, = then these attacks would be =E2=80=9Cdisabled=E2=80=9D and it isn=E2=80=99= t that cut and dried. Impersonation =E2=80=9Cfacilitates=E2=80=9D (or as = the charter states, is =E2=80=9Cpart of=E2=80=9D) deceptive and coercive = activities. Second, RFC7340 is explicit that both impersonation and = obfuscation (or obscuration) contribute to the problems. At Page 4, it = says: =E2=80=9CIn general, number spoofing is used in two ways: = impersonation and anonymization.=E2=80=9D=20 >> =20 >> When explaining the context and how 4474bis fits, caution and = precision are important. Here=E2=80=99s my attempt at replacing the = first paragraph of section 3: >> =20 >> =E2=80=9CPer [RFC7340], attackers often take advantage of the current = ease with which calling telephone numbers can be spoofed, and the = singular reliance some call recipients place on that value. This allows = abuse, for example, of a voicemail service that compares the identity of = the caller to a whitelist before determining whether it should allow the = caller access to recorded messages. Another example: an Internet = telephone application that displays the calling party number (and/or an = associated name retrieved from a local database) of a caller, which a = human may review to make a policy decision before answering a call. In = both of these cases, attackers might attempt to circumvent these = authorization policies through impersonation. If the calling party = number could be verified =E2=80=93 that is, if the receiving person or = application could know with reasonable certainty that the calling number = was not spoofed =E2=80=93 then additional screening could be bypassed. = The voicemail service could give the caller direct access to the mailbox = without demanding a password; the Internet telephone application could = tell the human that less stringent verbal verification procedures can be = applied because we have confidence that the caller is who they claim to = be.=E2=80=9D=20 >> =20 >> Obviously any well-designed use of current calling number information = should recognize how readily this can be spoofed and should not operate = without some additional form of verification. >> =20 >> It is incorrect to say =E2=80=9CThe mechanism described in this = document provides a strong identity system for detecting attempted = impersonation in SIP requests.=E2=80=9D What is strong about this = mechanism is detecting that that the caller is authorized to use the = claimed phone number. Since most calls, for the foreseeable future, will = lack the Identity header, the mechanism provides no real means of = detecting attempted impersonation. Whether a call without an Identity = header is or is not an impersonation cannot be determined. Certainly a = call with an Identity header that does not verify can be assumed to be = either an impersonation or a technical or operational failure, but it = seems unlikely that impersonators would go to the trouble of sending an = Identity header that will not verify. >> =20 >> There is some related discussion currently in section 12.5, but I = believe this needs to be brought forward and made more explicit because = the =E2=80=9Ctransition=E2=80=9D will not be quick. >> =20 >> We should also be careful not to assert that this mechanism = universally protects the CALLER NAME that is presented for many public = network calls. If the NAME is being retrieved from a LOCAL DATABASE = (such as the user=E2=80=99s contact list in a mobile phone) there is = less concern. But if the name is retrieved, as it so often currently is = in real-world deployments, from some network database populated by any = number of different contributors (including abusers), this mechanism = provides no vehicle to prevent a caller with a verified NUMBER from = linking that number to a NAME like =E2=80=9CCard Services=E2=80=9D or = =E2=80=9CFBI=E2=80=9D or =E2=80=9CFrankel David=E2=80=9D when they are = in fact none of the above. The existing text says =E2=80=9Cthe calling = party number (and/or Caller-ID) of a caller=E2=80=9D but =E2=80=9CCaller-I= D=E2=80=9D is not defined and is ambiguous. >> =20 >> Section 12.6 discusses signing of the Display Name; the text = indicates this is out of scope but offers some thoughts. I think Display = Name generally is out of scope (RFC7340 states: =E2=80=9CThis effort = does not consider how the display name of the caller might be = validated.=E2=80=9D) so 4474bis shouldn=E2=80=99t indicate what action = =E2=80=9Cshould=E2=80=9D or =E2=80=9Ccould=E2=80=9D be taken with = respect to that field. Note that the Display Name field is only = applicable for end-to-end SIP calls. I suggest replacing 12.6 paragraph = two as follows: >> =20 >> =E2=80=9CMany current telephony deployments use the calling number to = derive an alphanumeric Calling Name for display to the called party. = Given the nature of many of these deployments, even a verified calling = number could result in the display of a falsified or impersonated name. = The verified calling number will be most useful when the name is derived = from a local database (such as a mobile phone contact list) maintained = and trusted by the call recipient.=E2=80=9D >> =20 >> We still need a discussion of the other half of the problem (per = RFC7340), which is ANONYMIZATION of the calling party. What I see today = in 4474bis addresses forms such as =E2=80=9Canonymous@example.com = =E2=80=9D where the caller = explicitly declares anonymity. This is really related to privacy, which = is why 4474bis has it in a section with that title.=20 >> =20 >> For abusive calls, the calling party generally achieves true = anonymity either by spoofing somebody else=E2=80=99s phone number = (often, in fact, just using random numbers, or using a number similar = to, but distinct from, the called number), or by using one or more = numbers that they have acquired but which are challenging to identify = (because when called, the number is not answered or yields only a vague = voice-mail, and/or because the service provider responsible for the = number doesn=E2=80=99t know or won=E2=80=99t reveal who the actual = customer is). >> =20 >> The 3. Background section of 4474bis should include some mention of = the anonymity problem, just as it discusses impersonation. I suggest: = =E2=80=9CToday, because it is easy to originate calls with any value in = the =46rom header, abusive callers can populate the field with random = telephone numbers. Abusive callers (and their enabling service = providers) are likely to be the last adopters of the Identity header. = Until the Identity header becomes prevalent across the universe of calls = (and that will take some time, since it initially will only apply to = end-to-end SIP calls, which are a tiny minority), the anonymity problem = will remain because the abusive calls will be lost in the sea of normal = (but unauthenticated) calls. Additionally, when a significant number of = calls generally ARE authenticated, abusive callers may seek to obtain = telephone numbers which they can authenticate, but which still are = ambiguous as to their ownership. It will be incumbent upon service = providers and the regimes in which they operate to prevent such abuses = (through means outside the scope of this document). If it is easy and = cheap for abusers to obtain quantities of telephone numbers and = associated credentials without providing true identity information = linked to those numbers, they will be able to remain anonymous even with = valid Identity headers in their calls.=E2=80=9D >> =20 >> As an aside, there are about six billion valid numbers in the North = American (+1) Numbering Plan. There are currently probably on the order = of one billion of those assigned to end-users. Of the remaining five = billion, some fraction are allocated to service providers already (but = unassigned to end-users); the rest are currently unallocated. Abusive = callers have, and will probably continue to have, a variety of options = for finding numbers they can use to keep themselves anonymous until all = the loopholes are finally closed. >> =20 >> DOMAIN vs. NUMBER AUTHENTICATION >> =20 >> The Charter of the STIR Working Group states: >> =20 >> =E2=80=9CThe STIR working group will specify Internet-based = mechanisms that allow verification of the calling party's authorization = to use a particular telephone number for an incoming call.=E2=80=9D = (First Sentence) >> =20 >> =E2=80=9CThe work of this group is limited to developing a solution = for telephone numbers. Expansion of the authorization mechanism to = identities using the user@domain or other name forms is out of scope.=E2=80= =9D (Fifth Paragraph) >> =20 >> Given this, 4474bis should not contain, to the extent that it does, = references to authenticating >=46rom headers containing = alice@example.com or jon@example.com = . (These appear repeatedly in Sections 1, 4, 6, = and 7.) There is also text about =E2=80=9Csigning for a domain.=E2=80=9D=20= >> =20 >> This is explicitly outside of scope, and it distracts from the stated = purpose of the WG. If nothing else, I think we want the document to read = very clearly, to the greatest extent possible, how the spec is used to = achieve the goal of authenticating telephone numbers. >> =20 >> I suggest that other than to briefly reiterate that it is out of = scope, all the references to authentication of domains be removed, and = that all examples be restricted to that which is in scope (phone = numbers). >> =20 >> Certainly there is value in what has been (speculatively) documented = regarding signing for a domain. This material could simply be archived = for retrieval later, when we are ready to tackle that. >> =20 >> If there is insistence that it be included here (despite the mandate = in the charter that =E2=80=9Cexpansion...using user@domain...is = out of scope=E2=80=9D), then it should be = collected and placed in an appendix outside the primary flow of the = document. I do realize the value of being forward-looking. At the same = time, there is such urgency in getting STIR deployed for telephone = numbers that I don=E2=80=99t think we can afford the distraction. >> =20 >> I must admit that I personally have had a terrible time reconciling = how this all actually functions for telephone numbers. =E2=80=9CDomain=E2=80= =9D appears 81 times in the document and I can=E2=80=99t tell which, if = any, of those occurrences is relevant to the telephone number use case. >> =20 >> ERRATA >> =20 >> In going through the document I encountered a handful of typos. If = you search for each of the text snippets below I think the issue will be = apparent. >> =20 >> those JSON object in a manner following PASSporT >> =20 >> implementation the authentication service at an >> =20 >> which contains a JSON representations of >> =20 >> and add a corresponding an Identity header to the request >> =20 >> is OPTIONAL baseline PASSporT objects in SIP as >> =20 >> authentication service creates a PASSporT that uses [=E2=80=9Cobject=E2= =80=9D is missing] >> =20 >> verification service performs the procedures above on each [should be = =E2=80=9Cbelow=E2=80=9D] >> =20 >> verifier MUST inspect any optional "ppt" parameter appearing the >> =20 >> Step 1, is understood), the verifier follows the procedures = [=E2=80=9Csupported=E2=80=9D instead of =E2=80=9Cunderstood=E2=80=9D] >> =20 >> prospect that a verification services could receive >> =20 >> The verification of an Identity header does not entail [suggest = =E2=80=9CThe successful verification=E2=80=9D] >> =20 >> encoding of the header and claim component of >> =20 >> this it conveys any canonical telephone number formats >> =20 >> canonicalization of the numbers and compare them [=E2=80=9Cnumbers=E2=80= =9D plural?] >> =20 >> unless they have some more other implementation-specific way >> =20 >> role for a range of telephone and a user agent belonging to Alice >> =20 >> included in a PASSporT object in, for example, an "uri" claim. >> =20 >> correspond to any field of the SIP request, but then the optional >> =20 >> legitimate request for one user is cut-and-pasted into a request >> =20 >> consult some sort of directory that indications >> =20 >> =20 >> David Frankel >> ZipDX=C2=AE LLC >> Monte Sereno, CA USA >> Tel: 1-800-FRANKEL (1-800-372-6535) >> Watch Our Video! >> =20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir = > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_0380A203-F847-4F1C-AF5A-06B362503678 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On Aug 25, 2016, at 1:41 AM, Bernard Aboba <bernard.aboba@gmail.com> wrote:

On Aug 24, 2016, at 6:31 PM, = David Frankel <dfrankel@zipdx.com> wrote:
 
CALLING NAME DELIVERY EXAMPLE = (USA) =E2=80=93 how it works today:
An end-user, Fred, gets his service from a hosted PBX = provider. Fred has been assigned telephone number 1-212-555-4321. Fred = places a call with his IP phone to 1-415-555-6789; this is a mobile = number assigned to Sally. The SIP phone sends an INVITE to the hosted = PBX provider which reoriginates the call with an INVITE to their = wholesale termination provider, with headers that look like (in relevant = part) TO: <sip:14155556789@32.123.213.188> and FROM: =E2=80=9CFred = Smith=E2=80=9D <sip:12125554321@191.88.177.66>.
 
The termination provider = reoriginates the call to their transit provider with headers that look = like (in relevant part) TO: <sip:14155556789@154.132.10.198> and FROM:  <sip:12125554321@32.123.213.186>. Note that the Display = Name has been removed from the FROM header; they didn=E2=80=99t need to = do this, but it=E2=80=99s their = practice.
The canonicalization would use only the phone number, = so the fact that the domain was re-written doesn=E2=80=99t matter. =  This also means that editing out the display name doesn=E2=80=99t = matter.

Any of the device, the = hosted PBX or the wholesale termination provider (assuming the wholesale = provider delegated the TN to the hosted PBX provider) can sign.  If = the wholesale termination provider signs, he does so with knowledge that = he can pass the hot potato to the hosted PBX provider.  That hosted = PBX provider will be left holding it if he doesn=E2=80=99t really know = who Fred is.  If he does, then he gets to pass it to Fred. =  The wholesale termination provider is very likely to not tolerate = bad calls coming from the hosted PBX provider, regardless of which of = the hosted PBX provider=E2=80=99s customers are at fault.  So, that = hosted PBX provider will likely have to cut off Fred if the PBX provider = wants to keep his termination service.



[BA] This is a good example since it highlights some of the = issues with SP-only signing.

Due to the reorigination, even if we did have SP signing, the = SIP headers may not provide enough information to enable traceback since = only the wholesale provider signature is available (and the hosted PBX = provider may be obscured). And there are reasons why even that could be = absent.
The wholesale termination provider knows = that he delegated Fred=E2=80=99s TN to the hosted PBX provider. =  So, as long as the TN arrives intact, which happens in this = example, the hot potato can be handed to the hosted PBX provider. =  Whether it can be handed to Fred is up to the hosted PBX provider. = but from our point of view, the mechanism allows the signer (we=E2=80=99re= assuming the wholesale termination provider) to avoid the gauze of law = enforcement by being able to hand the potato to the hosted PBX provider. =  That wholesale termination provider had better make sure that the = TN is one of the TNs that it assigned to the hosted PBX provider or it = may be left holding the potato.

The hosted PBX provider and the wholesale termination = provider may be different, and the hosted PBX provider while being able = to authenticate endpoints, may have no ability to verify TN = authorization, since it did not assign the TNs. =
<broke here>I think that is = incorrect.  The wholesale termination provider is the service = provider of record (in the US, via NANPA or PA delegation, or port in). =  This is not a case of =E2=80=9Cauthorized spoofing=E2=80=9D. =  It=E2=80=99s Fred=E2=80=99s number, but it the actual delegation = processes is to to the wholesale termination provider and to the hosted = PBX provider.  In the current scheme, the hosted PBX provider = controls the number, and the wholesale termination provider is the one = to whom calls are routed in the PSTN.

Also, the wholesale provider may be presented with calls = originating from TNs outside its authority. As an example, PBXes = frequently have PSTN lines for backup in event of an Internet outage and = may use those PSTN TNs as the originator for emergency service calls = that could be sent using VOIP even when there is no outage. The = wholesaler did not assign those TNs so has no ability to verify their = authorization.
There are cases where = wholesale termination providers have allowed their customers to = originate calls that have a TN not delegated to the customer by the = termination provider.  I use the term =E2=80=9Cauthorized = spoofing=E2=80=9D for them.  This is the call center that calls on = behalf of an enterprise.  You have another case, where there is a = backup set of trunks to a second provider and the second provider will = allow calls to be sent on those trunks from the TN delegated by the = primary provider.  In the stir scheme, the wholesale termination = provider would need to be authorized by the primary provider to sign = calls with those TNs.  That=E2=80=99s not a particularly onerous = process, but it=E2=80=99s a new process.



 
The transit provider sends the = call to Sally=E2=80=99s mobile operator by reoriginating the call using = similar TO and FROM headers.
 
The mobile operator receives the call; it has gone SIP = end-to-end from the origination point. If Sally subscribes to the mobile = operator=E2=80=99s optional =E2=80=9Ccalling name=E2=80=9D service, the = mobile operator performs an SS7 TCAP CNAM query, or something somewhat = equivalent, supplying the telephone number from the TO header = (14155556789). The query returns, perhaps, =E2=80=9CSMITH FRED=E2=80=9D = and the mobile operator sends this over its air interface to Sally=E2=80=99= s phone for display.
 
If Sally has NOT subscribed to the =E2=80=9Ccalling name=E2=80=9D= service, the mobile operator sends only the telephone number. Sally=E2=80= =99s smartphone looks this up in her contact database; if it finds it, = it displays the name; if not found, it may display nothing, or it may = have an alternate look-up mechanism which might yield a name or a = geographic indicator.
 
 
David = Frankel
ZipDX=C2=AE LLC
Monte Sereno, CA USA
Tel: = 1-800-FRANKEL (1-800-372-6535)
Watch = Our Video!
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf = Of Peterson, = Jon
Sent: Wednesday, August 24, 2016 = 12:38 AM
To: David Frankel <dfrankel@zipdx.com>; stir@ietf.org
Subject: Re: [stir] My Editorial = Suggestions on RFC4474bis
 
 
Hi David,
 
You are correct that the first sentence of Section 3 = sort of lumps robocalling, voicemail hacking, and swatting into one = bucket, and that "enable" doesn't fit all the contents of that bucket = equally well. Voicemail hacking ("News of the World" style) is directly = enabled by impersonation, you can't do it without impersonation. I think = I might say instead that these practices "commonly leverage" an = attacker's ability to impersonate someone else's identity. I think = though I'm going to end up removing this text from the spec anyway, and = instead slightly amplifying the text in the introduction about = RFC7340.
 
As to whether the mechanism described in the = document "provides a strong identity system for detecting attempted = impersonation," I'm afraid I can't agree with your reasons for saying = that is incorrect. A lack of implementation would not change whether or = not the -document- describes such a system. The presence or absence of = an Identity header from any given SIP message wouldn't change that = either. This is a sentence about a document, not about a deployment. =  But again, I think this text will likely be removed for unrelated = reasons.
 
The specification is very careful to say that it = does not protect caller name, but it does so by saying that it doesn't = protect display-name (the text you indicate in 12.6), which is the way = you carry a caller name in SIP. There is no other commentary of any kind = about how systems might derive caller name in this specification, and = I'd hesitate to introduce some. The text in the second paragraph of 12.6 = serves a very different purpose than the paragraph you propose to = replace it. I don't see any harm in noting that telephone numbers are = sometimes used to derive display names, but I see no justification for = having this specification deliver guidance on what sort of name = databases consumers should or should not trust.
 
I think some of your concerns about anonymity demonstrate how = we use the term differently in SIP than we might in everyday discourse. = If you "achieve true anonymity by spoofing somebody else's phone number = (often, in fact, just random numbers)" you are still spoofing a phone = number. Your ability to spoof telephone numbers enables that. What it is = to claim anonymity in SIP is to not divulge an individual identifier for = yourself, usually by using instead some kind of privacy service which = sets your identity to something that makes it clear that you want to = remain anonymous. Impersonating random telephone numbers is different - = it is still impersonating numbers. As the Privacy Considerations state, = and state correctly I believe, "None of the relevant attacks, all of = which rely on the attacker taking on the identity of a victim or hiding = their identity using someone else's identity, are enabled by anonymous = identity."
 
As to the problem of abusive users obtaining = telephone numbers "which they can authenticate, but which still are = ambiguous as to their ownership," this is noted in the section on = "Authorization and Transitional Strategies," as are most of the similar = concerns you raise here. We all know, for example, that security = vulnerabilities could allow attackers to compromise devices that could = make calls which possess totally valid credentials. No one here thinks = secure signaling is a silver bullet. However, the barrier to entry for = populating a =46rom header field, versus compromising a device, is very = different. Similarly, the barrier to entry to acquiring "ambiguous" = telephone numbers is surely higher than just putting whatever comes to = mind in a =46rom header field. The differences are real; I don't = think we're overselling them.
 
While I do agree that the STIR charter considers = "greenfield" SIP URIs out of scope, we long ago made a consensus = decision in this working group not to bar that text from rfc4474bis or = any other proposals for solutions here. STIR does not require this to = solve its immediate threat model. However, as we looked at gatewaying = and so on, we quickly saw that there were going to be cases where such = identifiers would appear. I don't think it constitutes much of a = distraction, and in fact, I'd say the solution would be incomplete = without it.
 
Your nits are appreciated - this text is getting a = pretty thorough errata-vetting at this point.
 
Thanks,
 
Jon Peterson
Neustar, = Inc.
 
From: stir <stir-bounces@ietf.org> on behalf of David Frankel = <dfrankel@zipdx.com>
Organization: ZipDX LLC
Date: Sunday, August 21, 2016 = at 10:17 AM
To: "stir@ietf.org" <stir@ietf.org>
Subject: [stir] My Editorial = Suggestions on RFC4474bis
 
Since my = last notes, I=E2=80=99ve gotten some constructive feedback here and = privately. Now, hoping to also be constructive, I want to volunteer some = comments about specific content in the 4474bis document.
 
I=E2=80=99ll = preface this as follows: My interest is in how, and to what extent, the = proposed functionality will address abuse of the public telephone = network. 
 
By = =E2=80=9Cpublic telephone network=E2=80=9D I mean that evolving set of = networks and technologies which permit any party to make a =E2=80=9Cteleph= one call=E2=80=9D to any other party, from and to anywhere on the globe, = using conventional telephone number addressing and involving either = conventional (circa 1970, perhaps?) telephones, or something emulating = such an instrument (mobile phone, smart phone, web phone, IP phone, = etc.). If we could start over today, we=E2=80=99d no doubt design the = system completely differently, but with an installed base of perhaps six = or seven billion endpoints and associated addresses, and still growing, = it seems likely that this network is still some distance from = retirement.
 
By =E2=80=9Cabuse=E2=80=9D I mean (1) the use of = the network to defraud, steal from, or deny service to a call recipient; = (2) placing of programmatic unsolicited marketing-related and similar = calls that, intentionally or not, annoy or harass a call recipient. I = note that the prevalence of these abuses compromises the beneficial uses = of the network by promoting suboptimal behaviors on the part of = telephone subscribers (refusing to answer any call for fear it is an = abusive call; sending all or most calls to voice-mail or CAPTCHA to = avoid abusive calls; etc.); this impedes the flow and utility of good = (non-abusive) calls.
 
Rather than parsing the document section by = section, I=E2=80=99ve structured my comments categorically since several = of my suggestions touch in multiple places.
 
OBJECTIVES = / PURPOSE
 
I want to reiterate some text from the SIP WG = charter because I need to confirm that we are all on the same page = regarding our goals. It states: =E2=80=9CSince it has become fairly easy = to present an incorrect source telephone number, a growing set of = problems have emerged over the last decade. As with email, the claimed = source identity of a SIP request is not verified, permitting = unauthorized use of the source identity as part of deceptive and = coercive activities, such as robocalling (bulk unsolicited commercial = communications), vishing (voicemail hacking, and impersonating banks) = and swatting (impersonating callers to emergency services to stimulate = unwarranted large scale law enforcement deployments). In addition, use = of an incorrect source telephone number facilitates wire fraud or can = lead to a return call at premium rates.=E2=80=9D (Paragraph 1) And =E2=80=9C= As its priority mechanism work item, the working group will specify a = SIP header-based mechanism for verification that the originator of a SIP = session is authorized to use the claimed source telephone number, where = the session is established with SIP end to end.=E2=80=9D (Paragraph = 3)
 
That strikes me as a noble undertaking and I=E2=80=99= m reading the document in that context.
 
4474bis = states at 3. Background: =E2=80=9CPer [RFC7340], problems such as = robocalling, voicemail hacking, and swatting are enabled by an = attacker's ability to impersonate someone else.=E2=80=9D I don=E2=80=99t = agree that RFC7340 states that these abuses are =E2=80=9Cenabled=E2=80=9D = by the =E2=80=9Cability to impersonate someone else.=E2=80=9D First, = =E2=80=9Cenabled=E2=80=9D implies that if there were no such ability, = then these attacks would be =E2=80=9Cdisabled=E2=80=9D and it isn=E2=80=99= t that cut and dried. Impersonation =E2=80=9Cfacilitates=E2=80=9D (or as = the charter states, is =E2=80=9Cpart of=E2=80=9D) deceptive and coercive = activities. Second, RFC7340 is explicit that both impersonation and = obfuscation (or obscuration) contribute to the problems. At Page 4, it = says: =E2=80=9CIn general, number spoofing is used in two ways: = impersonation and anonymization.=E2=80=9D 
 
When = explaining the context and how 4474bis fits, caution and precision are = important. Here=E2=80=99s my attempt at replacing the first paragraph of = section 3:
 
=E2=80=9CPer [RFC7340], attackers often take = advantage of the current ease with which calling telephone numbers can = be spoofed, and the singular reliance some call recipients place on that = value. This allows abuse, for example, of a voicemail service that = compares the identity of the caller to a whitelist before determining = whether it should allow the caller access to recorded messages. Another = example: an Internet telephone application that displays the calling = party number (and/or an associated name retrieved from a local database) = of a caller, which a human may review to make a policy decision before = answering a call. In both of these cases, attackers might attempt to = circumvent these authorization policies through impersonation. If the = calling party number could be verified =E2=80=93 that is, if the = receiving person or application could know with reasonable certainty = that the calling number was not spoofed =E2=80=93 then additional = screening could be bypassed. The voicemail service could give the caller = direct access to the mailbox without demanding a password; the Internet = telephone application could tell the human that less stringent verbal = verification procedures can be applied because we have confidence that = the caller is who they claim to be.=E2=80=9D 
 
Obviously = any well-designed use of current calling number information should = recognize how readily this can be spoofed and should not operate without = some additional form of verification.
 
It is = incorrect to say =E2=80=9CThe mechanism described in this document = provides a strong identity system for detecting attempted impersonation = in SIP requests.=E2=80=9D What is strong about this mechanism is = detecting that that the caller is authorized to use the claimed phone = number. Since most calls, for the foreseeable future, will lack the = Identity header, the mechanism provides no real means of detecting = attempted impersonation. Whether a call without an Identity header is or = is not an impersonation cannot be determined. Certainly a call with an = Identity header that does not verify can be assumed to be either an = impersonation or a technical or operational failure, but it seems = unlikely that impersonators would go to the trouble of sending an = Identity header that will not verify.
 
There is = some related discussion currently in section 12.5, but I believe this = needs to be brought forward and made more explicit because the = =E2=80=9Ctransition=E2=80=9D will not be quick.
 
We should = also be careful not to assert that this mechanism universally protects = the CALLER NAME that is presented for many public network calls. If the = NAME is being retrieved from a LOCAL DATABASE (such as the user=E2=80=99s = contact list in a mobile phone) there is less concern. But if the name = is retrieved, as it so often currently is in real-world deployments, = from some network database populated by any number of different = contributors (including abusers), this mechanism provides no vehicle to = prevent a caller with a verified NUMBER from linking that number to a = NAME like =E2=80=9CCard Services=E2=80=9D or =E2=80=9CFBI=E2=80=9D or = =E2=80=9CFrankel David=E2=80=9D when they are in fact none of the above. = The existing text says =E2=80=9Cthe calling party number (and/or = Caller-ID) of a caller=E2=80=9D but =E2=80=9CCaller-ID=E2=80=9D is not = defined and is ambiguous.
 
Section 12.6 discusses signing of the Display = Name; the text indicates this is out of scope but offers some thoughts. = I think Display Name generally is out of scope (RFC7340 states: =E2=80=9CT= his effort does not consider how the display name of the caller might be = validated.=E2=80=9D) so 4474bis shouldn=E2=80=99t indicate what action = =E2=80=9Cshould=E2=80=9D or =E2=80=9Ccould=E2=80=9D be taken with = respect to that field. Note that the Display Name field is only = applicable for end-to-end SIP calls. I suggest replacing 12.6 paragraph = two as follows:
          &nb= sp;    
=E2=80=9CMany current telephony deployments use = the calling number to derive an alphanumeric Calling Name for display to = the called party. Given the nature of many of these deployments, even a = verified calling number could result in the display of a falsified or = impersonated name. The verified calling number will be most useful when = the name is derived from a local database (such as a mobile phone = contact list) maintained and trusted by the call recipient.=E2=80=9D
 
We still = need a discussion of the other half of the problem (per RFC7340), which = is ANONYMIZATION of the calling party. What I see today in 4474bis = addresses forms such as =E2=80=9Canonymous@example.com=E2=80=9D where the caller = explicitly declares anonymity. This is really related to privacy, which = is why 4474bis has it in a section with that title. 
 
For abusive = calls, the calling party generally achieves true anonymity either by = spoofing somebody else=E2=80=99s phone number (often, in fact, just = using random numbers, or using a number similar to, but distinct from, = the called number), or by using one or more numbers that they have = acquired but which are challenging to identify (because when called, the = number is not answered or yields only a vague voice-mail, and/or because = the service provider responsible for the number doesn=E2=80=99t know or = won=E2=80=99t reveal who the actual customer is).
 
The 3. = Background section of 4474bis should include some mention of the = anonymity problem, just as it discusses impersonation. I suggest: = =E2=80=9CToday, because it is easy to originate calls with any value in = the =46rom header, abusive callers can populate the field with random = telephone numbers. Abusive callers (and their enabling service = providers) are likely to be the last adopters of the Identity header. = Until the Identity header becomes prevalent across the universe of calls = (and that will take some time, since it initially will only apply to = end-to-end SIP calls, which are a tiny minority), the anonymity problem = will remain because the abusive calls will be lost in the sea of normal = (but unauthenticated) calls. Additionally, when a significant number of = calls generally ARE authenticated, abusive callers may seek to obtain = telephone numbers which they can authenticate, but which still are = ambiguous as to their ownership. It will be incumbent upon service = providers and the regimes in which they operate to prevent such abuses = (through means outside the scope of this document). If it is easy and = cheap for abusers to obtain quantities of telephone numbers and = associated credentials without providing true identity information = linked to those numbers, they will be able to remain anonymous even with = valid Identity headers in their calls.=E2=80=9D
 
As an = aside, there are about six billion valid numbers in the North American = (+1) Numbering Plan. There are currently probably on the order of one = billion of those assigned to end-users. Of the remaining five billion, = some fraction are allocated to service providers already (but unassigned = to end-users); the rest are currently unallocated. Abusive callers have, = and will probably continue to have, a variety of options for finding = numbers they can use to keep themselves anonymous until all the = loopholes are finally closed.
 
DOMAIN vs. NUMBER AUTHENTICATION
 
The Charter = of the STIR Working Group states:
 
=E2=80=9CThe STIR working group will specify = Internet-based mechanisms that allow verification of the calling party's = authorization to use a particular telephone number for an incoming = call.=E2=80=9D (First Sentence)
 
=E2=80=9CThe work of this group is limited to = developing a solution for telephone numbers. Expansion of the = authorization mechanism to identities using the user@domain or other = name forms is out of scope.=E2=80=9D (Fifth Paragraph)
 
Given this, = 4474bis should not contain, to the extent that it does, references to = authenticating >=46rom headers containing alice@example.com or jon@example.com. (These = appear repeatedly in Sections 1, 4, 6, and 7.) There is also text about = =E2=80=9Csigning for a domain.=E2=80=9D 
 
This is = explicitly outside of scope, and it distracts from the stated purpose of = the WG. If nothing else, I think we want the document to read very = clearly, to the greatest extent possible, how the spec is used to = achieve the goal of authenticating telephone numbers.
 
I suggest = that other than to briefly reiterate that it is out of scope, all the = references to authentication of domains be removed, and that all = examples be restricted to that which is in scope (phone numbers).
 
Certainly = there is value in what has been (speculatively) documented regarding = signing for a domain. This material could simply be archived for = retrieval later, when we are ready to tackle that.
 
If there is = insistence that it be included here (despite the mandate in the charter = that =E2=80=9Cexpansion...using user@domain...is out of scope=E2=80=9D), = then it should be collected and placed in an appendix outside the = primary flow of the document. I do realize the value of being = forward-looking. At the same time, there is such urgency in getting STIR = deployed for telephone numbers that I don=E2=80=99t think we can afford = the distraction.
 
I must admit that I personally have had a terrible = time reconciling how this all actually functions for telephone numbers. = =E2=80=9CDomain=E2=80=9D appears 81 times in the document and I can=E2=80=99= t tell which, if any, of those occurrences is relevant to the telephone = number use case.
 
ERRATA
 
In going through the document I encountered a = handful of typos. If you search for each of the text snippets below I = think the issue will be apparent.
 
those JSON object in a manner following = PASSporT
 
implementation the authentication service at = an
 
which contains a JSON representations of
 
and add a = corresponding an Identity header to the request
 
is OPTIONAL = baseline PASSporT objects in SIP as
 
authentication service creates a PASSporT that = uses [=E2=80=9Cobject=E2=80=9D is missing]
 
verification = service performs the procedures above on each [should be = =E2=80=9Cbelow=E2=80=9D]
 
verifier MUST inspect any optional "ppt" parameter = appearing the
 
Step 1, is understood), the verifier follows the = procedures [=E2=80=9Csupported=E2=80=9D instead of =E2=80=9Cunderstood=E2=80= =9D]
 
prospect that a verification services could = receive
 
The verification of an Identity header does not = entail [suggest =E2=80=9CThe successful verification=E2=80=9D]
 
encoding of = the header and claim component of
 
this it conveys any canonical telephone number = formats
 
canonicalization of the numbers and compare them = [=E2=80=9Cnumbers=E2=80=9D plural?]
 
unless they have some more other = implementation-specific way
 
role for a range of telephone and a user agent = belonging to Alice
 
included in a PASSporT object in, for example, an = "uri" claim.
 
correspond to any field of the SIP request, but = then the optional
 
legitimate request for one user is cut-and-pasted = into a request
 
consult some sort of directory that = indications
 
 
David Frankel
ZipDX=C2=AE LLC
Monte = Sereno, CA USA
Tel: 1-800-FRANKEL = (1-800-372-6535)
Watch Our = Video!
 
=
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_0380A203-F847-4F1C-AF5A-06B362503678-- From nobody Thu Aug 25 07:11:59 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01CFA12D0F1 for ; Thu, 25 Aug 2016 07:11:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsBjIcsAps9q for ; Thu, 25 Aug 2016 07:11:57 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C825712D836 for ; Thu, 25 Aug 2016 07:11:56 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7PEC6Xt007822 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 25 Aug 2016 07:12:06 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472134326; bh=2Dwxy3cl33hV4GfAvuv0n6aOm6qvviO0/GztAZ+FHB0=; h=Subject:To:References:Reply-To:Cc:From:Date:In-Reply-To:From; b=Jf8Xf5Wu0xpuZTmuVNHd+/FY09voNC0tSUHABc29DsWGjrvJzwtQ+1EzQl155G8x/ 0wqoc18qpf/EUGxAS/bBkaYrriKaBKTpOOhh0ciIuyNlN4lUHNgTjOAklIIaLfyZQU QVQ8RaoXzAsjDszMF748QcdAluT/VyJE8XO+6t8w= To: Bernard Aboba , stir@ietf.org References: <05e801d1fbcf$e1b606e0$a52214a0$@zipdx.com> <10df01d1fe70$6af44280$40dcc780$@zipdx.com> <50FDDC35-0B7B-45DE-8C95-FECF5D070BE5@gmail.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <3ab3a2a9-a137-3894-7e30-7e0c36cf166e@dcrocker.net> Date: Thu, 25 Aug 2016 07:11:32 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <50FDDC35-0B7B-45DE-8C95-FECF5D070BE5@gmail.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: David Frankel Subject: Re: [stir] My Editorial Suggestions on RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Aug 2016 14:11:58 -0000 On 8/24/2016 10:41 PM, Bernard Aboba wrote: > PBXes frequently have PSTN lines for backup in event of an Internet > outage and may use those PSTN TNs as the originator for emergency > service calls that could be sent using VOIP even when there is no > outage. The wholesaler did not assign those TNs so has no ability to > verify their authorization. Some of this might hinge on the semantics for a signature. The obvious and reasonable semantic to have is: "the entity using this telephone number has official authority to use this telephone number." in that case, there is the problem you observe. Among the alternative semantics is: "the entity using this telephone number is assessed to be good actor." That is, validate the actor, not the telephone number. In this case, the wholesaler /can/ sign for the usage. A more cumbersome alternative is for the PBX to register the alternative phone numbers with the wholesaler, ahead of time. This requires some additional mechanism for the wholesaler to validate the registration. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 25 16:11:33 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04C8612D0F5 for ; Thu, 25 Aug 2016 16:11:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f4z-XFS56z0z for ; Thu, 25 Aug 2016 16:11:28 -0700 (PDT) Received: from mail-yb0-x234.google.com (mail-yb0-x234.google.com [IPv6:2607:f8b0:4002:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0007512B026 for ; Thu, 25 Aug 2016 16:11:27 -0700 (PDT) Received: by mail-yb0-x234.google.com with SMTP id d10so21761410ybi.1 for ; Thu, 25 Aug 2016 16:11:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=hIA707xAmHSWO77VHceUeJMiHMV7f5wV+B69YtySPgE=; b=QwLUzCR5BsxBshedxWFd0KrezimIjxFxSHHBMs2N7oFNEu2eCOEM5QLky6hb2hKBAq pDS2/uZrH0AkhA4/OQZjcT1A1NDaNcYe4yH2DPgbD2PHeqYAxKZmAZBRSdEgyGJo6RE1 9UnE79Ulme+ERWNxXeJ9xcNeoR5TWSZIvAyDj0wrWYmH2fShS2v55Levv3K0DXCTS+lk gyBQbaq6tDLqdqVaU5OkYgZ3NwJlsjQJk/5K2KyYJzUiToB2Ul+zzUt3cpa5NzEb/acX EDq0dOtOdpdRXhWcfQC9qhL3vR7ZxO5L3n29qRiVFHJ17OoJ7b6wVw07NHa4SX02wY8P M2ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=hIA707xAmHSWO77VHceUeJMiHMV7f5wV+B69YtySPgE=; b=MSJ2mTtX49jZkwMzli0h13CLyTf1H39CQDRbrVdcvDVkqGPAgwnBKqoDJeH5dH6Yc9 jj9G2LO/VaoY+FHiZf4s+pYL+ryMRVq0B98zTV4q+FnQDmAgA3gYNQEmFwPouWnNW1oS 0sNpBoC+QHkMe49lLctgxCpl2Ku3Rh3oNpLFd/LJynvzT9qFbiw/Rj6clnZGa6Yy7hmF Dobf4TnUWXXIoYXjSEfvnGT9h5Q8K0WQmEh3RUwKNhLfHeWxP7FyQgCp37WdxUdvVVUa kUbB9AijmnQQkSaCPnmftBIWzDuINHaAEvSVK6eolq3LAKuE/3OVR4+Brfy0WU3mthKS HA7A== X-Gm-Message-State: AE9vXwNYHWOfWKNSvm34Wu8kdWLlg959Byj5wO+Ie6K5gY8LiVPxQnOcKVjMkz870eUPiVui6GVCYXN1ludvGg== X-Received: by 10.37.160.99 with SMTP id x90mr90849ybh.130.1472166687092; Thu, 25 Aug 2016 16:11:27 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Thu, 25 Aug 2016 16:10:46 -0700 (PDT) In-Reply-To: <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> From: Eric Rescorla Date: Thu, 25 Aug 2016 16:10:46 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=94eb2c19831e6f61fa053aed8433 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Aug 2016 23:11:32 -0000 --94eb2c19831e6f61fa053aed8433 Content-Type: text/plain; charset=UTF-8 Top-posting with my summary, detailed comments below. It's probably useful to separate out two questions: - What security properties people are relying on TLS to give them and what operational scenarios it is being used in. - What security properties people are actually getting from TLS in practice. I think it's clear from what I wrote previously and below that people are on a wide scale are relying on TLS and the Web PKI to provide the following features: - Server authentication - Confidentiality - Integrity As you suggest, they are not generally relying on the Web PKI to provide client authentication; client authentication is usually provided by sending secrets (e.g., passwords) over the TLS channel, thus relying on the previous three properties. I'm not quite sure if you're arguing that people aren't relying on TLS for those properties, but if you are, I don't think that's correct. Rather, I take you to be arguing that those properties are illusory because the Web PKI doesn't actually provide them. I think you're on somewhat stronger ground there though; it's clear that the Web PKI could work better, hence active efforts to improve it along the lines of Let's Encrypt, Certificate Transparency, and ongoing coordination between the major root programs. With that said, I do think that TLS and the WebPKI are providing substantial security here over and above not having them, though I don't think we have anything that would meet a medical standard of proof to that effect. Best,, -Ekr On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker wrote: > Eric, > > On 8/22/2016 9:26 AM, Eric Rescorla wrote: > >> On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker > > wrote: >> >> Eric, et al, >> >> On 8/21/2016 6:50 AM, Eric Rescorla wrote: >> >> On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker > >> >> wrote: >> >> [*] Use of certs for the web are famously problematic. >> First, the >> only serious reliance on them is to prevent MITM attacks. >> Second, >> are all of the operational problems with root CAs. Third >> are all >> the times sites do self-signing. >> ... >> >> 1. I'm not quite sure what you mean when you say that the only >> serious >> reliance of Web certificates is to prevent MITM attacks. In >> general, the >> purpose of Web certificates is to authenticate the endpoints >> involved in >> the HTTPS connection, thus preventing attackers from >> impersonating one >> of those endpoints (whether the attacker then does an MITM attack >> or >> some other attack is kind of a detail; for instance an attacker >> might >> just impersonate a site without ever connecting to it). What >> purpose >> would you expect these certificates to serve that they are not >> serving? >> >> First, apologies; my comment was much too cryptic. Second, my >> comment was on current operational realities, whereas your response >> started by noting intent. >> >> Thanks for clarifying. Responses below. >> >> This disparity evokes the cliche about the difference between theory >> and practice. >> >> Now to be less cryptic: >> >> The TLS specification supports server authentication, client >> authentication and channel encryption. Its primary use, at scale, >> is only for encryption. Server authentication is performed, if >> possible, but only to make the encryption protect against >> man-in-the-middle attacks. (My understanding is that client >> authentication has no significant use.) Absent that authentication, >> opportunistic encryption protects against passive wiretapping but >> not MITM. Hence my previous, cryptic summary. >> >> I don't believe that this is an accurate summary of the situation. >> Certificates are routinely used for server authentication in settings >> where the primary target is not confidentiality of the traffic but >> rather integrity of the data between the server and the client (or vice >> versa). A typical example would be software download (or alternately, >> embedding of JS libraries into Web applications) where it's obviously >> important that the user get the software they intended. As a specific >> example, Mozilla distributes Firefox over HTTPS not because Firefox is >> secret but because we don't want attackers tampering with it. Encryption >> is generally used in those scenarios as well merely because that's how >> TLS is customarily operated, but primary target is integrity/data origin >> authentication. >> > > So, yes, I take your point, although there's some irony to your > explanation. Your example for data integrity is concern with tampering. > Discounting my imprecision in saying "MITM" that you note, I believe your > example falls under that very same concern as the one I expressed... Sorry, but I'm puzzled. The threat in question here is active attack, not passive one. > I'm not sure what you would consider "significant" use of client >> authentication but I can tell you that it's in sufficiently wide use >> that we had to make special accommodations in TLS 1.3 for some variants >> of client auth because it was so important in enterprise use cases. >> > > Dandy. Let's see some citations for its successful and continuing use at > scale over the open Internet (ie, with lots of independent administrations.) Hmm... We're probably talking past each other here, which may be my fault. The typical TLS client auth scenario is as follows: - The server is authenticated with a WebPKI cert. - The client is authenticated with some locally issued cert. So the server authentication scenario is the usual one and the client essentially has one consumer and one administrator. Incidentally, it would probably be helpful here to avoid the use of the >> term "MITM". I appreciate that that terminology once had wide currency, >> but it really only refers to a specific class of impersonation attack, >> and not necessarily the one of interest. For instance, if I impersonate >> Mozilla and send you malware instead of Firefox, I don't need to connect >> to Mozilla's server, so it's not really a MITM Attack, just server >> impersonation. >> > > Point taken. And for careful technical discussions about very specific > attack vectors and mitigation strategies, careful labeling is of course > essential. > > My casual use of MITM was actually meant to refer to 'anything that has an > active attacker participating in the data stream with the client, at the > level of generating responses'. (Otherwise, it's just passive monitoring.) > > It would be nice to have a single term that covers MITM and server > compromise. If you mean "server impersonation" here, then the term you are looking for is "active attack". See https://tools.ietf.org/rfcmarkup?doc=3552#section-3.3 > > > As for serving other purposes, certs are also used to validate the >> target (server) domain name in a web session -- that is, it the >> obtained server authorized under the domain name used by the >> client. While I believe that the mechanisms for this are in >> relatively widescale use, there's been little-to-no demonstrated >> efficacy, which limits the amount people attend to any possible >> problems with the certs. (Why spend time worrying about something >> that isn't useful?) There are also the significant domain name >> matching problems with the mechanism, prompting a significant >> revision effort. I haven't been its status, but the work is recent. >> >> This seems to be raising a separate question, namely whether the Web PKI >> system actually meaningfully achieves its security goals. I'm not aware >> > > Well, 'efficacy' is meant in a somewhat higher-level way. Is the nature > of the use of that authentication -- that is, the consumption of the > produced data -- at at least the same level of trust as is being targeted > here? > > If the goal here is for use that requires more trust that that established > use -- e.g., greater downside if there is a problem -- then established use > isn't comparable. I suspect that the information being protected is generally of higher value given that we're talking about electronic banking, e-health etc. And of course the base case for STIR deployment is going to be that the existence of the call is authenticated but then that the actual call is in the clear, though we eventually hope to do better than that. 3. I'm not sure how self-signing comes into things; self-signing is >> largely a response to difficulty in obtaining valid certs. My >> understanding was that STIR was going to have a more >> straightforward >> (and initially less distributed) issuance story. >> >> I was noting an operational reality, in the environment that is the >> largest users of certs. It is the ultimate demonstration of the >> failure of that model. >> >> >> I'm going to have to differ here. I certainly wouldn't argue that the >> Web PKI system is perfect, but it has also become vastly easier to >> obtain and deploy certificates (thanks in large part to efforts like >> Let's Encrypt, SSLmate, Caddy, and Amazon's CA), and our telemetry shows >> that we're approaching 50% of browser transactions being HTTPS, despite >> the browsers strongly discouraging self-signed certs so I think >> "ultimate demonstration of the failure" somewhat overstates things. >> > > I note that you don't offer a metric on the amount of self-signing that is > done. Yeah, I didn't have it to hand, but I've looked since. Our telemetry shows that around 10% of TLS validations (more in beta, less in release) is by "non-default roots", which (I believe, but haven't completely validated) lumps in enterprise MITM boxes, enterprise CAs, and end-entity certs which don't chain to any valid CA. I believe that the latter category is what you mean by "self-signed". (Technically self-signed is just a description of the relationship between the subject and issuer of the certificate and it's common, for instance, to package CA certificates as self-signed certs, but that's not really the topic at hand). In any case, as far as I can tell, the vast majority of TLS connections go to valid WebPKI certs. More generally, if STIR authentication merely worked almost as >> well as >> the Web PKI, that seems like it would be pretty significant >> improvement >> over the current situation.> >> That does sound appealing, doesn't it? >> >> Except that I believe there is no documentation to support even this >> modest a claim of efficacy, while there is quite a bit of >> documentation of failures and problems with Web PKI. >> >> Hmm.... What kind of documentation would you consider to support this >> kind of claim (leaving aside the question of whether such documentation >> exists). >> > > Reports of tiger team efforts to crack a variety of web traffic -- and > failing -- would be nice. I'm not sure what you mean here. There has been an enormous amount of research on attacking TLS and TLS stacks, some of it successful and some of it not, and some of the things they found were big and have been fixed and some of the things they found were small and have not. But I think it gives a pretty clear picture of the security of TLS per se. If you mean efforts to obtain WebPKI certs and failing, that's obviously a harder problem to analyze > Certainly it would be nice to hear fewer stories about server data bases > getting compromised. > I'm not sure I'm seeing the connection here. Even a perfect WebPKI wouldn't do much to prevent server compromise because that's generally a result of vulnerabilities in the server of one kind or another, not of the cryptographic protocols deployed by the server. -Ekr > [*] A few articles on certs: > Thanks for providing these. I don't think they actually tell us much about the question at hand. > o Phishing sites exploit trust in valid SSL certificates > > http://www.infoworld.com/article/2992605/security/phishing-sites- > exploit-trust-in-valid-ssl-certificates.html > This article is about people misunderstanding valid TLS connections as meaning that the site can be trusted. Unfortunate, but it's the WebPKI behaving as intended. Arguably a browser UI failure. o Microsoft move to revoke trust in 20 root certificates could wreak > havoc on sites > > http://www.pcworld.com/article/3017157/security/microsoft-move-to- > revoke-trust-in-20-root-certificates-could-wreak-havoc- > on-sites.html > This article seems to be more or less about routine pruning of the browser trust anchor lists. As I think I observed previously, large trust anchor lists are in fact a problem (hence efforts like CT, etc.). However, this again seems to be the system operating as intended, namely the trust anchor lists being curated. > > o What You Should, But Don't, Do About Untrusted Certs, CAs > > http://www.darkreading.com/cloud/what-you-should-but-dont-do-about- > untrusted-certs-cas-/d/d-id/1322111 > This article seems to be an overview of the known threats. I think we've mostly recapped these here. > > o IT pros don't get cybersecurity risks around certificate > authorities > > http://searchsecurity.techtarget.com/news/4500253216/IT-pros- > dont-get-cybersecurity-risks-around-certificate-authorities > I can't read this, but it looks like it's reporting on the same survey as the one above. > o What you need to know about Dell's root certificate security > debacle > > http://www.infoworld.com/article/3008422/security/what-you-need- > to-know-about-dells-root-certificate-security-debacle.html This is an interesting case, but I don't see it really reflecting much on the PKI. Effectively, Dell installed a MITM proxy (in the precise sense of MITM that we generally use in the security community) on their boxes before shipping them. This proxy operated (as most do) by installing their own trust anchor on the box, but that's just one form of attack you can do if you control the user's computer (see https://www.chromium.org/ Home/chromium-security/security-faq) > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --94eb2c19831e6f61fa053aed8433 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Top-posting with my summary, detailed comments below.=

It's probably useful to separate out two questions:

- What security properties people are relying on TLS t= o give them and what operational scenarios it is being used in.
-= What security properties people are actually getting from TLS in practice.=

I think it's clear from what I wrote previous= ly and below that people are on a wide scale are relying on TLS and the Web= PKI to provide the following features:

- Server a= uthentication
- Confidentiality
- Integrity
<= br>
As you suggest, they are not generally relying on the Web PKI= to provide client authentication; client authentication is usually provide= d by sending secrets (e.g., passwords) over the TLS channel, thus relying o= n the previous three properties.

I'm not quite= sure if you're arguing that people aren't relying on TLS for those= properties, but if you are, I don't think that's correct.

Rather, I take you to be arguing that those properties are= illusory because the Web PKI doesn't actually provide them. I think yo= u're on somewhat stronger ground there though; it's clear that the = Web PKI could work better, hence active efforts to improve it along the lin= es of Let's Encrypt, Certificate Transparency, and ongoing coordination= between the major root programs. With that said, I do think that TLS and t= he WebPKI are providing substantial security here over and above not having= them, though I don't think we have anything that would meet a medical = standard of proof to that effect.

Best,,
-Ekr


On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker &l= t;dhc@dcrocker.net> wrote:
Er= ic,

On 8/22/2016 9:26 AM, Eric Rescorla wrote:
On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker <dhc@dcrocker.net
<mailto:dhc@dcrock= er.net>> wrote:

=C2=A0 =C2=A0 Eric, et al,

=C2=A0 =C2=A0 On 8/21/2016 6:50 AM, Eric Rescorla wrote:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker = <dhc@dcrocker.net<= /a>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net <mailto:dhc@dcrocker.net>>> wrote:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [*] Use of certs for the web are = famously problematic.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 First, the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 only serious reliance on them is = to prevent MITM attacks.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Second,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 are all of the operational proble= ms with root CAs.=C2=A0 Third
=C2=A0 =C2=A0 =C2=A0 =C2=A0 are all
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 the times sites do self-signing.<= br> =C2=A0 =C2=A0 ...

=C2=A0 =C2=A0 =C2=A0 =C2=A0 1. I'm not quite sure what you mean when yo= u say that the only
=C2=A0 =C2=A0 =C2=A0 =C2=A0 serious
=C2=A0 =C2=A0 =C2=A0 =C2=A0 reliance of Web certificates is to prevent MITM= attacks. In
=C2=A0 =C2=A0 =C2=A0 =C2=A0 general, the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 purpose of Web certificates is to authenticate = the endpoints
=C2=A0 =C2=A0 =C2=A0 =C2=A0 involved in
=C2=A0 =C2=A0 =C2=A0 =C2=A0 the HTTPS connection, thus preventing attackers= from
=C2=A0 =C2=A0 =C2=A0 =C2=A0 impersonating one
=C2=A0 =C2=A0 =C2=A0 =C2=A0 of those endpoints (whether the attacker then d= oes an MITM attack or
=C2=A0 =C2=A0 =C2=A0 =C2=A0 some other attack is kind of a detail; for inst= ance an attacker
=C2=A0 =C2=A0 =C2=A0 =C2=A0 might
=C2=A0 =C2=A0 =C2=A0 =C2=A0 just impersonate a site without ever connecting= to it). What purpose
=C2=A0 =C2=A0 =C2=A0 =C2=A0 would you expect these certificates to serve th= at they are not
=C2=A0 =C2=A0 =C2=A0 =C2=A0 serving?

=C2=A0 =C2=A0 First, apologies; my comment was much too cryptic.=C2=A0 Seco= nd, my
=C2=A0 =C2=A0 comment was on current operational realities, whereas your re= sponse
=C2=A0 =C2=A0 started by noting intent.

Thanks for clarifying. Responses below.

=C2=A0 =C2=A0 This disparity evokes the cliche about the difference between= theory
=C2=A0 =C2=A0 and practice.

=C2=A0 =C2=A0 Now to be less cryptic:

=C2=A0 =C2=A0 The TLS specification supports server authentication, client<= br> =C2=A0 =C2=A0 authentication and channel encryption.=C2=A0 Its primary use,= at scale,
=C2=A0 =C2=A0 is only for encryption.=C2=A0 Server authentication is perfor= med, if
=C2=A0 =C2=A0 possible, but only to make the encryption protect against
=C2=A0 =C2=A0 man-in-the-middle attacks.=C2=A0 (My understanding is that cl= ient
=C2=A0 =C2=A0 authentication has no significant use.) Absent that authentic= ation,
=C2=A0 =C2=A0 opportunistic encryption protects against passive wiretapping= but
=C2=A0 =C2=A0 not MITM.=C2=A0 Hence my previous, cryptic summary.

I don't believe that this is an accurate summary of the situation.
Certificates are routinely used for server authentication in settings
where the primary target is not confidentiality of the traffic but
rather integrity of the data between the server and the client (or vice
versa). A typical example would be software download (or alternately,
embedding of JS libraries into Web applications) where it's obviously important that the user get the software they intended. As a specific
example, Mozilla distributes Firefox over HTTPS not because Firefox is
secret but because we don't want attackers tampering with it. Encryptio= n
is generally used in those scenarios as well merely because that's how<= br> TLS is customarily operated, but primary target is integrity/data origin authentication.

So, yes, I take your point, although there's some irony to your explana= tion.=C2=A0 Your example for data integrity is concern with tampering.=C2= =A0 Discounting my imprecision in saying "MITM" that you note, I = believe your example falls under that very same concern as the one I expres= sed...

Sorry, but I'm puzzled. The thre= at in question here is active attack, not passive one.

=
=C2=A0
I'm not sure what you would consider "significant" use of cli= ent
authentication but I can tell you that it's in sufficiently wide use that we had to make special accommodations in TLS 1.3 for some variants
of client auth because it was so important in enterprise use cases.

 Dandy.=C2=A0 Let's see some citations for its successful and continuing= use at scale over the open Internet (ie, with lots of independent administ= rations.)

Hmm... We're probably talking= past each other here, which may be my fault. The typical TLS client auth s= cenario is as
follows:

- The server is a= uthenticated with a WebPKI cert.
- The client is authenticated wi= th some locally issued cert.

So the server authent= ication scenario is the usual one and the client essentially has one consum= er
and one administrator.=C2=A0


Incidentally, it would probably be helpful here to avoid the use of the
term "MITM". I appreciate that that terminology once had wide cur= rency,
but it really only refers to a specific class of impersonation attack,
and not necessarily the one of interest. For instance, if I impersonate
Mozilla and send you malware instead of Firefox, I don't need to connec= t
to Mozilla's server, so it's not really a MITM Attack, just server<= br> impersonation.

 Point taken.=C2=A0 And for careful technical discussions about very specifi= c attack vectors and mitigation strategies, careful labeling is of course e= ssential.

My casual use of MITM was actually meant to refer to 'anything that has= an active attacker participating in the data stream with the client, at th= e level of generating responses'.=C2=A0 (Otherwise, it's just passi= ve monitoring.)

It would be nice to have a single term that covers MITM and server compromi= se.

If you mean "server impersonation&= quot; here, then the term you are looking for is "active attack".=
=C2=A0


=C2=A0 =C2=A0 As for serving other purposes, certs are also used to validat= e the
=C2=A0 =C2=A0 target (server) domain name in a web session -- that is, it t= he
=C2=A0 =C2=A0 obtained server authorized under the domain name used by the<= br> =C2=A0 =C2=A0 client.=C2=A0 While I believe that the mechanisms for this ar= e in
=C2=A0 =C2=A0 relatively widescale use, there's been little-to-no demon= strated
=C2=A0 =C2=A0 efficacy, which limits the amount people attend to any possib= le
=C2=A0 =C2=A0 problems with the certs. (Why spend time worrying about somet= hing
=C2=A0 =C2=A0 that isn't useful?) There are also the significant domain= name
=C2=A0 =C2=A0 matching problems with the mechanism, prompting a significant=
=C2=A0 =C2=A0 revision effort.=C2=A0 I haven't been its status, but the= work is recent.

This seems to be raising a separate question, namely whether the Web PKI system actually meaningfully achieves its security goals. I'm not aware=

Well, 'efficacy' is meant in a somewhat higher-level way.=C2=A0 Is = the nature of the use of that authentication -- that is, the consumption of= the produced data -- at at least the same level of trust as is being targe= ted here?

If the goal here is for use that requires more trust that that established = use -- e.g., greater downside if there is a problem -- then established use= isn't comparable.

I suspect that the i= nformation being protected is generally of higher value given that we'r= e talking about electronic banking, e-health etc. And of course =C2=A0the b= ase case for STIR deployment is going to be that the existence of the call = is authenticated but then that the actual call is in the clear, though we e= ventually hope to do better than that.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 3. I'm not sure how self-signing comes into= things; self-signing is
=C2=A0 =C2=A0 =C2=A0 =C2=A0 largely a response to difficulty in obtaining v= alid certs. My
=C2=A0 =C2=A0 =C2=A0 =C2=A0 understanding was that STIR was going to have a= more straightforward
=C2=A0 =C2=A0 =C2=A0 =C2=A0 (and initially less distributed) issuance story= .

=C2=A0 =C2=A0 I was noting an operational reality, in the environment that = is the
=C2=A0 =C2=A0 largest users of certs.=C2=A0 It is the ultimate demonstratio= n of the
=C2=A0 =C2=A0 failure of that model.


I'm going to have to differ here. I certainly wouldn't argue that t= he
Web PKI system is perfect, but it has also become vastly easier to
obtain and deploy certificates (thanks in large part to efforts like
Let's Encrypt, SSLmate, Caddy, and Amazon's CA), and our telemetry = shows
that we're approaching 50% of browser transactions being HTTPS, despite=
the browsers strongly discouraging self-signed certs so I think
"ultimate demonstration of the failure" somewhat overstates thing= s.

 I note that you don't offer a metric on the amount of self-signing that= is done.

Yeah, I didn't have it to han= d, but I've looked since.

Our telemetry shows = that around 10% of TLS validations (more in beta, less in release) is by &q= uot;non-default roots", which (I believe, but haven't completely v= alidated) lumps in enterprise MITM boxes, enterprise CAs, and end-entity ce= rts which don't chain to any valid CA. I believe that the latter catego= ry is what you mean by "self-signed". (Technically self-signed is= just a description of the relationship between the subject and issuer of t= he certificate and it's common, for instance, to package CA certificate= s as self-signed certs, but that's not really the topic at hand). In an= y case, as far as I can tell, the vast majority of TLS connections go to va= lid WebPKI certs.


=C2=A0 =C2=A0 =C2=A0 =C2=A0 More generally, if STIR authentication merely w= orked almost as
=C2=A0 =C2=A0 =C2=A0 =C2=A0 well as
=C2=A0 =C2=A0 =C2=A0 =C2=A0 the Web PKI, that seems like it would be pretty= significant
=C2=A0 =C2=A0 =C2=A0 =C2=A0 improvement
=C2=A0 =C2=A0 =C2=A0 =C2=A0 over the current situation.>
=C2=A0 =C2=A0 That does sound appealing, doesn't it?

=C2=A0 =C2=A0 Except that I believe there is no documentation to support ev= en this
=C2=A0 =C2=A0 modest a claim of efficacy, while there is quite a bit of
=C2=A0 =C2=A0 documentation of failures and problems with Web PKI.

Hmm.... What kind of documentation would you consider to support this
kind of claim (leaving aside the question of whether such documentation
exists).

 Reports of tiger team efforts to crack a variety of web traffic -- and fail= ing -- would be nice.=C2=A0

I'm not sur= e what you mean here. There has been an enormous amount of research on atta= cking TLS and TLS stacks, some of it successful and some of it not, and som= e of the things they found were big and have been fixed and some of the thi= ngs they found were small and have not. But I think it gives a pretty clear= picture of the security of TLS per se. If you mean efforts to obtain WebPK= I certs and failing, that's obviously a harder problem to analyze=C2=A0=

=C2=A0
Certainly it would be nice to hear fewer stories about server= data bases getting compromised.

I'= m not sure I'm seeing the connection here. Even a perfect WebPKI wouldn= 't do much to prevent server compromise because that's generally a = result of vulnerabilities in the server of one kind or another, not of the = cryptographic protocols deployed by the server.

-E= kr

=C2=A0
[*]=C2=A0 A few articles on certs:

Than= ks for providing these.=C2=A0 I don't think they actually tell us much = about the question at hand.
=C2=A0
=C2=A0 =C2=A0o Phishing sites exploit trust in valid SSL certificates

=C2=A0 =C2=A0 =C2=A0http://www.info= world.com/article/2992605/security/phishing-sites-
=C2=A0 =C2=A0 =C2=A0exploit-trust-in-valid-ssl-certificates.html

This article is about people misunderstandin= g valid TLS connections as meaning that the site can be trusted. Unfortunat= e, but it's the WebPKI behaving as intended. Arguably a browser UI fail= ure.



=C2=A0 =C2=A0o Microsoft move to revoke trust in 20 root certificates could= wreak
=C2=A0 =C2=A0 =C2=A0havoc on sites

=C2=A0 =C2=A0 =C2=A0http://www.pcw= orld.com/article/3017157/security/microsoft-move-to-
=C2=A0 =C2=A0 =C2=A0revoke-trust-in-20-root-certificates-could-wreak-h= avoc-
=C2=A0 =C2=A0 =C2=A0on-sites.html

This = article seems to be more or less about routine pruning of the browser trust= anchor lists. As I think I observed previously, large trust anchor lists a= re in fact a problem (hence efforts like CT, etc.). However, this again see= ms to be the system operating as intended, namely the trust anchor lists be= ing curated.



=C2=A0 =C2=A0o What You Should, But Don't, Do About Untrusted Certs, CA= s

=C2=A0 =C2=A0 =C2=A0http://www.da= rkreading.com/cloud/what-you-should-but-dont-do-about-
=C2=A0 =C2=A0 =C2=A0untrusted-certs-cas-/d/d-id/1322111

This article seems to be an overview of the known thr= eats. I think we've mostly recapped these here.

=C2=A0

=C2=A0 =C2=A0o IT pros don't get cybersecurity risks around certificate=
=C2=A0 =C2=A0 =C2=A0authorities

=C2=A0 =C2=A0 =C2=A0http://searchsecuri= ty.techtarget.com/news/4500253216/IT-pros-
=C2=A0 =C2=A0 =C2=A0dont-get-cybersecurity-risks-around-certificate-au= thorities

I can't read this, but it= looks like it's reporting on the same survey as the one above.

=C2=A0
=C2=A0 =C2=A0o What you need to know about Dell's root certificate secu= rity
=C2=A0 =C2=A0 =C2=A0debacle

=C2=A0 =C2=A0 =C2=A0http://www.infow= orld.com/article/3008422/security/what-you-need-
=C2=A0 =C2=A0 =C2=A0to-know-about-dells-root-certificate-security-deba= cle.html

This is an interesting case, but I= don't see it really reflecting much on the PKI. Effectively, Dell inst= alled a MITM proxy (in the precise sense of MITM that we generally use in t= he security community) on their boxes before shipping them. This proxy oper= ated (as most do) by installing their own trust anchor on the box, but that= 's just one form of attack you can do if you control the user's com= puter (see=C2=A0https://www.chromium.org/Home/chromium= -security/security-faq)


= =C2=A0

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net



--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

--94eb2c19831e6f61fa053aed8433-- From nobody Thu Aug 25 20:47:59 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2526212D09E for ; Thu, 25 Aug 2016 20:47:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eeXsRuA2eGac for ; Thu, 25 Aug 2016 20:47:58 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05AA3127071 for ; Thu, 25 Aug 2016 20:47:58 -0700 (PDT) Received: from [172.17.219.44] ([12.219.197.18]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7Q3m82x003632 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 25 Aug 2016 20:48:09 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472183289; bh=zfZ30Nn/fs0Su6bPoR97E6/VaBR73hhnVS6UUP4ecEI=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=X74mG4F5jY0S0YitWKGA7EYK7rTacddN7aFEUofPtOZix7WR4xuJ3a57fcG0E6jRq DBuE6p1YjWJioME7Ee8o4PTOb3oXeomeuzG1udG/mgN6UVWyHvnFvEzAI9gAB8nU3Z 0TXNEoRWQeZJOIn8GQZI0+JrcgmTaxMh/jrka4Uo= To: Eric Rescorla References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <0ba79319-7e4f-2c2c-f53a-2a21881acfcb@dcrocker.net> Date: Thu, 25 Aug 2016 20:47:38 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 03:47:59 -0000 Eric, On 8/25/2016 4:10 PM, Eric Rescorla wrote: > - What security properties people are relying on TLS to give them and > what operational scenarios it is being used in. > - What security properties people are actually getting from TLS in practice. > > I think it's clear from what I wrote previously and below that people > are on a wide scale are relying on TLS and the Web PKI to provide the > following features: > > - Server authentication > - Confidentiality > - Integrity Yes. > I'm not quite sure if you're arguing that people aren't relying on TLS > for those properties, but if you are, I don't think that's correct. I'm not arguing that. And to carry this further, I'm not expressing concern about the mathematics of these mechanisms. That is, the underlying components appear to do what they are supposed to. > Rather, I take you to be arguing that those properties are illusory > because the Web PKI doesn't actually provide them. Not quite, though maybe somewhat. And I would not phrase it as "Web PKI doesn't actually provide them". The wording would be more along the lines of: The human factors challenges of getting and using Web PKI produce significant and frequent limitations in the operation of the Web's security service. In the aggregate, the limitations produce an overall system performance that is significantly different from what is typically promised. The very large number of CA roots has a continuing problem with some roots. The challenges of getting a cert has encouraged self-signed certs, and opportunistic encryption, which defeats the trust hierarchy. The efforts you cite to make it easier to get certs is -- from what I'm hearing -- improving the statistics. But still it is quite common to encounter an exception due to a self-signing cert. It's probably not excessive to guess that this is at least a daily occurrence for many folk. Limitations in the cert model also create failure scenarios, notably when the contacted host operates under a different domain name and/or administrative structure, than the user asked for, such as due to a redirect. Again, there are efforts to counter this, but I believe they aren't fielded yet, so we need to be careful about minimizing the real-world effect.[*] >With that said, I do think that TLS and the WebPKI > are providing substantial security here over and above not having them, > though I don't think we have anything that would meet a medical standard > of proof to that effect. My concern is not whether Web PKI is useful but whether there has been a diligent consideration of its real-world problems in relation to its application to a STIR service. From what I've seen, it has been embraced without that careful analysis. But I'd be quite glad to be wrong about this. So a pointer to that analysis -- a warts-and-all pragmatic assessment -- would be greatly appreciated. (A basic challenge in developing such an analysis is that it requires having a clear, concrete, concise and consensus-based specification for the administrative and operational characteristics for STIR, but there isn't one.) d/ [*] Possibly ironically, this includes the ietf.org site, I discovered this morning. Going to page: https://xml2rfc.ietf.org/wg/dkim/trac/ticket/8 I got: > Your connection is not secure > > The owner of xml2rfc.ietf.org has configured their website > improperly. To protect your information from being stolen, Firefox > has not connected to this website. and xml2rfc.ietf.org uses an > invalid security certificate. ... The problem is that http://xml2rfc.ietf.org/ now redirects to https://xml2rfc.tools.ietf.org/, which is under independent administration. The former is the Secretariat, while the latter is the tools team. The administrative separation is deemed appropriate, but it creates this problem. -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Aug 25 22:22:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0100128874 for ; Thu, 25 Aug 2016 22:22:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4snENOZlUUVV for ; Thu, 25 Aug 2016 22:22:27 -0700 (PDT) Received: from qproxy1-pub.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id 79E13126579 for ; Thu, 25 Aug 2016 22:22:27 -0700 (PDT) Received: (qmail 22923 invoked by uid 0); 26 Aug 2016 05:22:23 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy1.mail.unifiedlayer.com with SMTP; 26 Aug 2016 05:22:23 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id bhHJ1t00J1MNPNq01hHMbg; Thu, 25 Aug 2016 23:17:23 -0600 X-Authority-Analysis: v=2.1 cv=PJecp5aC c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=5IsXbjgYAAAA:8 a=k7Ga1wGzAAAA:8 a=b8OvNEjoAAAA:8 a=W3Fe57fLAAAA:8 a=ljfNB86AAAAA:8 a=gk5_sQNKAAAA:8 a=-tGrwHRrAAAA:8 a=cm27Pg_UAAAA:8 a=mXdDSI-0TX6lR7xthf4A:9 a=wKaSZR8huaae0aqQ:21 a=xIZOAmBbTgno1nc_:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=NoaS9yxR748Rur3Y:21 a=719tn1pgRVo1a_6S:21 a=cPOd-vT5G4Xd5sFc:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=RR2nPHISKLg-FD_FhCoU:22 a=ijMaxGghyylP-n2pFjDB:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=sPnIFPdooxIL6hyxNEsT:22 a=TztwP4ge8wSFCjunGe5j:22 a=60xEE-u4QZ50DWNRFoLx:22 a=Y1kBRiyytt91GMuF_drd:22 a=xmb-EsYY8bH0VWELuYED:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date; bh=clhbYmTFSaU5qUgrdGqmRr9EeF/CGqm4RiRpg8/zas4=; b=IXgx JrAOEI5sdYSsAb1tAx3+iV2o22Oal0pQbzQ8eV1rpDqAXKqewQkP52oIyAxCJ0xMYbx/v6y6vaWjA +C+ntUJCle/FP6Z7pk/1CzjMyrl9HfFp7Vlgq+n0VJ/NvIy; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:49370 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bd9W2-0007iK-0O; Thu, 25 Aug 2016 23:17:18 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 26 Aug 2016 01:17:16 -0400 From: Richard Shockey To: Eric Rescorla , Dave Crocker Message-ID: <5EF7A94B-0A6E-4849-9ECC-E6650ED2F8F9@shockey.us> Thread-Topic: [stir] Key query/validation References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3555019037_628306693" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bd9W2-0007iK-0O X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:49370 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 05:22:33 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3555019037_628306693 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 Ekr=E2=80=A6 =20 I simply going to say what should be obvious at this point. =20 In the first order implementation of the STIR/SHAKEN concept the root trust= authority for certificates bound to TN=E2=80=99s or ranges of TN will be a closed= system.=C2=A0 Certainly in North America and I=E2=80=99ll bet that is how it rolls ou= t in Europe/Asia. A system that will have to be agreed to by the =E2=80=9Cpowers t= hat be=E2=80=9D. =C2=A0I think I made that clear from my PPT I posted earlier.=20 =20 To restate the obvious. =E2=80=9CThis is Telephony, =C2=A0Not the Internet.=E2=80=9D=C2=A0=C2=A0 Is= that Shockey=E2=80=99s Third Law?=C2=A0 1.=C2=A0 Money is the answer what is the question= 2 The network is landline everything else is access.=E2=80=9D =20 That is actually a subtle distinction that is not well understood by some. = I know some of our mutual friends think we need to =E2=80=9Cdemocratize real-time = communications=E2=80=9D and some are resentful that the entire SIP construct was e= ssentially lifted by the IMS folks to reconstruct the PSTN on IP Transport p= rotocols.=C2=A0 Well we are not going to go over that ancient history either.=20 =20 We are all aware of industry specific root trust authorities that have scal= ed to the zillions. Think cable set top boxes, electric utility meters, cred= it cards etc.=C2=A0 I am doing my best to hold my fingers back from truly epic r= ant at the same time Dave and others do have some ..some legitimate points b= ut there is a new process in place now and we in the IETF have a role. A val= uable role, but NOT THE ONLY ROLE. The great wheels of progress have been se= t in motion by the FCC and the Strike Force and IMHO there is something that= looks like a rational plan to satisfy the goals and objectives of not only = our US Regulatory friends and colleagues but other NRA as well. =20 IMHO the root trust decision has been made.=C2=A0 As Brian Rosen ( to his etern= al credit THANK YOU BRIAN) =C2=A0has pointed out the delegation authority for th= ose identifiers is a well understood legal and regulatory construct in every= nation state on the planet.=20 =20 Many of our colleagues on this list have has endless sleepless nights tryin= g to understand and design all of this as a system.=C2=A0 The best task for this= WG is to encourage our document editors to make their documents A. more rea= dable B more implementable (examples) and we just move on.=20 =20 Noise is not helpful but OK whatever. It=E2=80=99s the IETF after all.=20 =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 =20 =20 From: stir on behalf of Eric Rescorla Date: Thursday, August 25, 2016 at 7:10 PM To: Dave Crocker Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation =20 Top-posting with my summary, detailed comments below. It's probably useful to separate out two questions: =20 - What security properties people are relying on TLS to give them and what = operational scenarios it is being used in. - What security properties people are actually getting from TLS in practice= . =20 I think it's clear from what I wrote previously and below that people are o= n a wide scale are relying on TLS and the Web PKI to provide the following f= eatures: =20 - Server authentication - Confidentiality - Integrity =20 As you suggest, they are not generally relying on the Web PKI to provide cl= ient authentication; client authentication is usually provided by sending se= crets (e.g., passwords) over the TLS channel, thus relying on the previous t= hree properties. =20 I'm not quite sure if you're arguing that people aren't relying on TLS for = those properties, but if you are, I don't think that's correct. =20 Rather, I take you to be arguing that those properties are illusory because= the Web PKI doesn't actually provide them. I think you're on somewhat stron= ger ground there though; it's clear that the Web PKI could work better, henc= e active efforts to improve it along the lines of Let's Encrypt, Certificate= Transparency, and ongoing coordination between the major root programs. Wit= h that said, I do think that TLS and the WebPKI are providing substantial se= curity here over and above not having them, though I don't think we have any= thing that would meet a medical standard of proof to that effect. =20 Best,, -Ekr =20 =20 On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker wrote: Eric, On 8/22/2016 9:26 AM, Eric Rescorla wrote: On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker > wrote: Eric, et al, On 8/21/2016 6:50 AM, Eric Rescorla wrote: On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker >> wrote: [*] Use of certs for the web are famously problematic. First, the only serious reliance on them is to prevent MITM attacks. Second, are all of the operational problems with root CAs. Third are all the times sites do self-signing. ... 1. I'm not quite sure what you mean when you say that the only serious reliance of Web certificates is to prevent MITM attacks. In general, the purpose of Web certificates is to authenticate the endpoints involved in the HTTPS connection, thus preventing attackers from impersonating one of those endpoints (whether the attacker then does an MITM attack o= r some other attack is kind of a detail; for instance an attacker might just impersonate a site without ever connecting to it). What purpos= e would you expect these certificates to serve that they are not serving? First, apologies; my comment was much too cryptic. Second, my comment was on current operational realities, whereas your response started by noting intent. Thanks for clarifying. Responses below. This disparity evokes the cliche about the difference between theory and practice. Now to be less cryptic: The TLS specification supports server authentication, client authentication and channel encryption. Its primary use, at scale, is only for encryption. Server authentication is performed, if possible, but only to make the encryption protect against man-in-the-middle attacks. (My understanding is that client authentication has no significant use.) Absent that authentication, opportunistic encryption protects against passive wiretapping but not MITM. Hence my previous, cryptic summary. I don't believe that this is an accurate summary of the situation. Certificates are routinely used for server authentication in settings where the primary target is not confidentiality of the traffic but rather integrity of the data between the server and the client (or vice versa). A typical example would be software download (or alternately, embedding of JS libraries into Web applications) where it's obviously important that the user get the software they intended. As a specific example, Mozilla distributes Firefox over HTTPS not because Firefox is secret but because we don't want attackers tampering with it. Encryption is generally used in those scenarios as well merely because that's how TLS is customarily operated, but primary target is integrity/data origin authentication. So, yes, I take your point, although there's some irony to your explanation= . Your example for data integrity is concern with tampering. Discounting m= y imprecision in saying "MITM" that you note, I believe your example falls u= nder that very same concern as the one I expressed... =20 Sorry, but I'm puzzled. The threat in question here is active attack, not p= assive one. =20 =20 I'm not sure what you would consider "significant" use of client authentication but I can tell you that it's in sufficiently wide use that we had to make special accommodations in TLS 1.3 for some variants of client auth because it was so important in enterprise use cases. Dandy. Let's see some citations for its successful and continuing use at s= cale over the open Internet (ie, with lots of independent administrations.) =20 Hmm... We're probably talking past each other here, which may be my fault. = The typical TLS client auth scenario is as follows: =20 - The server is authenticated with a WebPKI cert. - The client is authenticated with some locally issued cert. =20 So the server authentication scenario is the usual one and the client essen= tially has one consumer and one administrator.=20 =20 =20 Incidentally, it would probably be helpful here to avoid the use of the term "MITM". I appreciate that that terminology once had wide currency, but it really only refers to a specific class of impersonation attack, and not necessarily the one of interest. For instance, if I impersonate Mozilla and send you malware instead of Firefox, I don't need to connect to Mozilla's server, so it's not really a MITM Attack, just server impersonation. Point taken. And for careful technical discussions about very specific att= ack vectors and mitigation strategies, careful labeling is of course essenti= al. My casual use of MITM was actually meant to refer to 'anything that has an = active attacker participating in the data stream with the client, at the lev= el of generating responses'. (Otherwise, it's just passive monitoring.) It would be nice to have a single term that covers MITM and server compromi= se. =20 If you mean "server impersonation" here, then the term you are looking for = is "active attack". See https://tools.ietf.org/rfcmarkup?doc=3D3552#section-3.3 =20 =20 As for serving other purposes, certs are also used to validate the target (server) domain name in a web session -- that is, it the obtained server authorized under the domain name used by the client. While I believe that the mechanisms for this are in relatively widescale use, there's been little-to-no demonstrated efficacy, which limits the amount people attend to any possible problems with the certs. (Why spend time worrying about something that isn't useful?) There are also the significant domain name matching problems with the mechanism, prompting a significant revision effort. I haven't been its status, but the work is recent. This seems to be raising a separate question, namely whether the Web PKI system actually meaningfully achieves its security goals. I'm not aware Well, 'efficacy' is meant in a somewhat higher-level way. Is the nature of= the use of that authentication -- that is, the consumption of the produced = data -- at at least the same level of trust as is being targeted here? If the goal here is for use that requires more trust that that established = use -- e.g., greater downside if there is a problem -- then established use = isn't comparable. =20 I suspect that the information being protected is generally of higher value= given that we're talking about electronic banking, e-health etc. And of cou= rse the base case for STIR deployment is going to be that the existence of = the call is authenticated but then that the actual call is in the clear, tho= ugh we eventually hope to do better than that. =20 3. I'm not sure how self-signing comes into things; self-signing is largely a response to difficulty in obtaining valid certs. My understanding was that STIR was going to have a more straightforwar= d (and initially less distributed) issuance story. I was noting an operational reality, in the environment that is the largest users of certs. It is the ultimate demonstration of the failure of that model. I'm going to have to differ here. I certainly wouldn't argue that the Web PKI system is perfect, but it has also become vastly easier to obtain and deploy certificates (thanks in large part to efforts like Let's Encrypt, SSLmate, Caddy, and Amazon's CA), and our telemetry shows that we're approaching 50% of browser transactions being HTTPS, despite the browsers strongly discouraging self-signed certs so I think "ultimate demonstration of the failure" somewhat overstates things. I note that you don't offer a metric on the amount of self-signing that is = done. =20 Yeah, I didn't have it to hand, but I've looked since. =20 Our telemetry shows that around 10% of TLS validations (more in beta, less = in release) is by "non-default roots", which (I believe, but haven't complet= ely validated) lumps in enterprise MITM boxes, enterprise CAs, and end-entit= y certs which don't chain to any valid CA. I believe that the latter categor= y is what you mean by "self-signed". (Technically self-signed is just a desc= ription of the relationship between the subject and issuer of the certificat= e and it's common, for instance, to package CA certificates as self-signed c= erts, but that's not really the topic at hand). In any case, as far as I can= tell, the vast majority of TLS connections go to valid WebPKI certs. =20 =20 More generally, if STIR authentication merely worked almost as well as the Web PKI, that seems like it would be pretty significant improvement over the current situation.> That does sound appealing, doesn't it? Except that I believe there is no documentation to support even this modest a claim of efficacy, while there is quite a bit of documentation of failures and problems with Web PKI. Hmm.... What kind of documentation would you consider to support this kind of claim (leaving aside the question of whether such documentation exists). Reports of tiger team efforts to crack a variety of web traffic -- and fail= ing -- would be nice.=20 =20 I'm not sure what you mean here. There has been an enormous amount of resea= rch on attacking TLS and TLS stacks, some of it successful and some of it no= t, and some of the things they found were big and have been fixed and some o= f the things they found were small and have not. But I think it gives a pret= ty clear picture of the security of TLS per se. If you mean efforts to obtai= n WebPKI certs and failing, that's obviously a harder problem to analyze=20 =20 =20 Certainly it would be nice to hear fewer stories about server data bases ge= tting compromised. =20 I'm not sure I'm seeing the connection here. Even a perfect WebPKI wouldn't= do much to prevent server compromise because that's generally a result of v= ulnerabilities in the server of one kind or another, not of the cryptographi= c protocols deployed by the server. =20 -Ekr =20 =20 [*] A few articles on certs: =20 Thanks for providing these. I don't think they actually tell us much about= the question at hand. =20 o Phishing sites exploit trust in valid SSL certificates http://www.infoworld.com/article/2992605/security/phishing-sites- exploit-trust-in-valid-ssl-certificates.html =20 This article is about people misunderstanding valid TLS connections as mean= ing that the site can be trusted. Unfortunate, but it's the WebPKI behaving = as intended. Arguably a browser UI failure. =20 =20 =20 o Microsoft move to revoke trust in 20 root certificates could wreak havoc on sites http://www.pcworld.com/article/3017157/security/microsoft-move-to- revoke-trust-in-20-root-certificates-could-wreak-havoc- on-sites.html =20 This article seems to be more or less about routine pruning of the browser = trust anchor lists. As I think I observed previously, large trust anchor lis= ts are in fact a problem (hence efforts like CT, etc.). However, this again = seems to be the system operating as intended, namely the trust anchor lists = being curated. =20 o What You Should, But Don't, Do About Untrusted Certs, CAs http://www.darkreading.com/cloud/what-you-should-but-dont-do-about- untrusted-certs-cas-/d/d-id/1322111 =20 This article seems to be an overview of the known threats. I think we've mo= stly recapped these here. =20 =20 o IT pros don't get cybersecurity risks around certificate authorities http://searchsecurity.techtarget.com/news/4500253216/IT-pros- dont-get-cybersecurity-risks-around-certificate-authorities =20 I can't read this, but it looks like it's reporting on the same survey as t= he one above. =20 =20 o What you need to know about Dell's root certificate security debacle http://www.infoworld.com/article/3008422/security/what-you-need- to-know-about-dells-root-certificate-security-debacle.html =20 This is an interesting case, but I don't see it really reflecting much on t= he PKI. Effectively, Dell installed a MITM proxy (in the precise sense of MI= TM that we generally use in the security community) on their boxes before sh= ipping them. This proxy operated (as most do) by installing their own trust = anchor on the box, but that's just one form of attack you can do if you cont= rol the user's computer (see https://www.chromium.org/Home/chromium-security= /security-faq) =20 =20 =20 --=20 Dave Crocker Brandenburg InternetWorking bbiw.net --=20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir=20 --B_3555019037_628306693 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Ekr…

 

I simply going to say what should be obvious at this point.

 

In the first order implementation of the STIR/= SHAKEN concept the root trust authority for certificates bound to TN’s= or ranges of TN will be a closed system.=C2=A0 Certainly in North America and I= ’ll bet that is how it rolls out in Europe/Asia. A system that will ha= ve to be agreed to by the “powers that be”. =C2=A0I think I made tha= t clear from my PPT I posted earlier.

 

= To restate the obvious. “This is Telephony, =C2=A0Not the Internet.”= =C2=A0=C2=A0 Is that Shockey’s Third Law?=C2=A0 1.=C2=A0 Money is the answer what is t= he question 2 The network is landline everything else is access.”=

 

That is actually a subtle distinction that = is not well understood by some. I know some of our mutual friends think we n= eed to “democratize real-time communications” and some are resen= tful that the entire SIP construct was essentially lifted by the IMS folks t= o reconstruct the PSTN on IP Transport protocols.=C2=A0 Well we are not going to= go over that ancient history either.

 

= We are all aware of industry specific root trust authorities that have scale= d to the zillions. Think cable set top boxes, electric utility meters, credi= t cards etc.=C2=A0 I am doing my best to hold my fingers back from truly epic ra= nt at the same time Dave and others do have some ..some legitimate points bu= t there is a new process in place now and we in the IETF have a role. A valu= able role, but NOT THE ONLY ROLE. The great wheels of progress have been set= in motion by the FCC and the Strike Force and IMHO there is something that = looks like a rational plan to satisfy the goals and objectives of not only o= ur US Regulatory friends and colleagues but other NRA as well.

 

IMHO the root trust decision has been made.=C2=A0 As Bri= an Rosen ( to his eternal credit THANK YOU BRIAN) =C2=A0has pointed out the dele= gation authority for those identifiers is a well understood legal and regula= tory construct in every nation state on the planet.

&nb= sp;

Many of our colleagues on this list have has endless sleepless= nights trying to understand and design all of this as a system.=C2=A0 The best = task for this WG is to encourage our document editors to make their document= s A. more readable B more implementable (examples) and we just move on.

 

Noise is not helpful but OK whatever. It&#= 8217;s the IETF after all.

 

=

— 

= Richard Shock= ey

Shockey Consulting LLC

Chairman of the Board SIP Forum<= /p>

www.shockey.us

www= .sipforum.org

richard<at>shockey= .us

Skype-Linkedin-Facebook rshockey10= 1

PSTN +1 703-593-2683

 

 

From: stir <stir-bounces@ietf.or= g> on behalf of Eric Rescorla <ekr@rtfm.com>
Date: Thursd= ay, August 25, 2016 at 7:10 PM
To: Dave Crocker <dcrocker@bbiw.= net>
Cc: "stir@ietf.org" <stir@ietf.org>
= Subject: Re: [stir] Key query/validation

 

= Top-posting with my summary, detailed comments below.


It's probably useful to separate out two questions= :

 

- What security properties people are relying on TLS to= give them and what operational scenarios it is being used in.

- What security properties people are actuall= y getting from TLS in practice.

=  

I think it's clear from w= hat I wrote previously and below that people are on a wide scale are relying= on TLS and the Web PKI to provide the following features:

 

- Server authentication

- Conf= identiality

- Integrity

 

As you suggest, they are not generally relying on the Web PKI to = provide client authentication; client authentication is usually provided by = sending secrets (e.g., passwords) over the TLS channel, thus relying on the = previous three properties.

=  

I'm not quite sure if you're a= rguing that people aren't relying on TLS for those properties, but if you ar= e, I don't think that's correct.

 

Rather, I take you to be= arguing that those properties are illusory because the Web PKI doesn't actu= ally provide them. I think you're on somewhat stronger ground there though; = it's clear that the Web PKI could work better, hence active efforts to impro= ve it along the lines of Let's Encrypt, Certificate Transparency, and ongoin= g coordination between the major root programs. With that said, I do think t= hat TLS and the WebPKI are providing substantial security here over and abov= e not having them, though I don't think we have anything that would meet a m= edical standard of proof to that effect.

 

Best,,

-Ekr

 

 =

On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker &l= t;dhc@dcrocker.net>= wrote:

Eric,

On 8/22/2016 9:26 AM, Eric Rescorla wrote:

= On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker <dhc@dcrocker.net
<mailto:dhc@dcrocker.net>> wrote:

=     Eric, et al,

    On 8/21/2016 6:50 AM, Eric R= escorla wrote:

        On Sat, Aug 20, 2016 at 11= :53 AM, Dave Crocker <d= hc@dcrocker.net
        <mailto:dhc@dcrocker.net>

<= div>

        <mailto:dhc@dcrocker.net <mailto:dhc@dcrocker.net>>&= gt; wrote:

            [*] Use of certs= for the web are famously problematic.
        First,= the
            only serious reliance on t= hem is to prevent MITM attacks.
        Second,
&n= bsp;           are all of the operational problems = with root CAs.  Third
        are all
  =           the times sites do self-signing.
 = ;   ...

        1. I'm not quite sure what y= ou mean when you say that the only
        serious        reliance of Web certificates is to prevent MITM= attacks. In
        general, the
    &n= bsp;   purpose of Web certificates is to authenticate the endpoints
=         involved in
        the H= TTPS connection, thus preventing attackers from
      &nbs= p; impersonating one
        of those endpoints (whet= her the attacker then does an MITM attack or
        = some other attack is kind of a detail; for instance an attacker
  &n= bsp;     might
        just impersonate a s= ite without ever connecting to it). What purpose
      &nb= sp; would you expect these certificates to serve that they are not
 =       serving?

    First, apologies; my com= ment was much too cryptic.  Second, my
    comment was on = current operational realities, whereas your response
    starte= d by noting intent.

Thanks for clarifying. Responses below.

&n= bsp;   This disparity evokes the cliche about the difference between th= eory
    and practice.

    Now to be less cryp= tic:

    The TLS specification supports server authenticati= on, client
    authentication and channel encryption.  Its= primary use, at scale,
    is only for encryption.  Serve= r authentication is performed, if
    possible, but only to mak= e the encryption protect against
    man-in-the-middle attacks.=   (My understanding is that client
    authentication has = no significant use.) Absent that authentication,
    opportunis= tic encryption protects against passive wiretapping but
    not= MITM.  Hence my previous, cryptic summary.

I don't believe that= this is an accurate summary of the situation.
Certificates are routinely= used for server authentication in settings
where the primary target is n= ot confidentiality of the traffic but
rather integrity of the data betwee= n the server and the client (or vice
versa). A typical example would be s= oftware download (or alternately,
embedding of JS libraries into Web appl= ications) where it's obviously
important that the user get the software t= hey intended. As a specific
example, Mozilla distributes Firefox over HTT= PS not because Firefox is
secret but because we don't want attackers tamp= ering with it. Encryption
is generally used in those scenarios as well me= rely because that's how
TLS is customarily operated, but primary target i= s integrity/data origin
authentication.


So, yes, I take your point, although there's so= me irony to your explanation.  Your example for data integrity is conce= rn with tampering.  Discounting my imprecision in saying "MITM&quo= t; that you note, I believe your example falls under that very same concern = as the one I expressed...

 

Sorry, but I'm puzzled. = The threat in question here is active attack, not passive one.

 

 

I'= m not sure what you would consider "significant" use of client
= authentication but I can tell you that it's in sufficiently wide use
that= we had to make special accommodations in TLS 1.3 for some variants
of cl= ient auth because it was so important in enterprise use cases.


Dandy.  Let's see some citations f= or its successful and continuing use at scale over the open Internet (ie, wi= th lots of independent administrations.)

 

Hmm... We= 're probably talking past each other here, which may be my fault. The typica= l TLS client auth scenario is as

follows:

 

<= /div>

- The server is authenticated with a WebPKI cer= t.

- The client is authenticated= with some locally issued cert.

=  

So the server authenticat= ion scenario is the usual one and the client essentially has one consumer

and one administrator. <= /o:p>

 

 

Incidentally, it would probably be helpful here to avoid the use of th= e
term "MITM". I appreciate that that terminology once had wide= currency,
but it really only refers to a specific class of impersonation= attack,
and not necessarily the one of interest. For instance, if I impe= rsonate
Mozilla and send you malware instead of Firefox, I don't need to = connect
to Mozilla's server, so it's not really a MITM Attack, just serve= r
impersonation.


Point = taken.  And for careful technical discussions about very specific attac= k vectors and mitigation strategies, careful labeling is of course essential= .

My casual use of MITM was actually meant to refer to 'anything that= has an active attacker participating in the data stream with the client, at= the level of generating responses'.  (Otherwise, it's just passive mon= itoring.)

It would be nice to have a single term that covers MITM and= server compromise.

=  

If you mean "server imper= sonation" here, then the term you are looking for is "active attac= k".

 

 =

&nbs= p;   As for serving other purposes, certs are also used to validate the=
    target (server) domain name in a web session -- that is, i= t the
    obtained server authorized under the domain name used= by the
    client.  While I believe that the mechanisms f= or this are in
    relatively widescale use, there's been littl= e-to-no demonstrated
    efficacy, which limits the amount peop= le attend to any possible
    problems with the certs. (Why spe= nd time worrying about something
    that isn't useful?) There = are also the significant domain name
    matching problems with= the mechanism, prompting a significant
    revision effort.&nb= sp; I haven't been its status, but the work is recent.

This seems to = be raising a separate question, namely whether the Web PKI
system actuall= y meaningfully achieves its security goals. I'm not aware


Well, 'efficacy' is meant in a somewhat high= er-level way.  Is the nature of the use of that authentication -- that = is, the consumption of the produced data -- at at least the same level of tr= ust as is being targeted here?

If the goal here is for use that requi= res more trust that that established use -- e.g., greater downside if there = is a problem -- then established use isn't comparable.

 

I suspect that the information being protected is generally of higher v= alue given that we're talking about electronic banking, e-health etc. And of= course  the base case for STIR deployment is going to be that the exis= tence of the call is authenticated but then that the actual call is in the c= lear, though we eventually hope to do better than that.

=

 

        3. I'm not sure how self-signing= comes into things; self-signing is
        largely a= response to difficulty in obtaining valid certs. My
     =   understanding was that STIR was going to have a more straightforward=
        (and initially less distributed) issuance st= ory.

    I was noting an operational reality, in the enviro= nment that is the
    largest users of certs.  It is the u= ltimate demonstration of the
    failure of that model.

=
I'm going to have to differ here. I certainly wouldn't argue that theWeb PKI system is perfect, but it has also become vastly easier to
obtai= n and deploy certificates (thanks in large part to efforts like
Let's Enc= rypt, SSLmate, Caddy, and Amazon's CA), and our telemetry shows
that we'r= e approaching 50% of browser transactions being HTTPS, despite
the browse= rs strongly discouraging self-signed certs so I think
"ultimate demo= nstration of the failure" somewhat overstates things.


I note that you don't offer a metric on the= amount of self-signing that is done.

 

Yeah, I didn= 't have it to hand, but I've looked since.

 

Our telemetry = shows that around 10% of TLS validations (more in beta, less in release) is = by "non-default roots", which (I believe, but haven't completely v= alidated) lumps in enterprise MITM boxes, enterprise CAs, and end-entity cer= ts which don't chain to any valid CA. I believe that the latter category is = what you mean by "self-signed". (Technically self-signed is just a= description of the relationship between the subject and issuer of the certi= ficate and it's common, for instance, to package CA certificates as self-sig= ned certs, but that's not really the topic at hand). In any case, as far as = I can tell, the vast majority of TLS connections go to valid WebPKI certs.

 

<= p class=3DMsoNormal> 

        More generally, if STIR authentication= merely worked almost as
        well as
  &n= bsp;     the Web PKI, that seems like it would be pretty significa= nt
        improvement
       = over the current situation.>
    That does sound appealing,= doesn't it?

    Except that I believe there is no document= ation to support even this
    modest a claim of efficacy, whil= e there is quite a bit of
    documentation of failures and pro= blems with Web PKI.

Hmm.... What kind of documentation would you cons= ider to support this
kind of claim (leaving aside the question of whether= such documentation
exists).


Reports of tiger team efforts to crack a variety of web traffic -- and= failing -- would be nice. 

 

I'm not sure what= you mean here. There has been an enormous amount of research on attacking T= LS and TLS stacks, some of it successful and some of it not, and some of the= things they found were big and have been fixed and some of the things they = found were small and have not. But I think it gives a pretty clear picture o= f the security of TLS per se. If you mean efforts to obtain WebPKI certs and= failing, that's obviously a harder problem to analyze 

<= /div>

 

 

Certainly it would be nice to hear fewer stories abou= t server data bases getting compromised.

 

I'm not s= ure I'm seeing the connection here. Even a perfect WebPKI wouldn't do much t= o prevent server compromise because that's generally a result of vulnerabili= ties in the server of one kind or another, not of the cryptographic protocol= s deployed by the server.

&= nbsp;

-Ekr

<= p class=3DMsoNormal> 

 <= o:p>

[*]  A few articles on certs:

 

Tha= nks for providing these.  I don't think they actually tell us much abou= t the question at hand.

 

   o Phishing sites exploit trust in valid SSL certific= ates

     http://www.infoworld.com/art= icle/2992605/security/phishing-sites-
     exploit-tru= st-in-valid-ssl-certificates.html

 

This article is = about people misunderstanding valid TLS connections as meaning that the site= can be trusted. Unfortunate, but it's the WebPKI behaving as intended. Argu= ably a browser UI failure.

=  

 

 

   o Microsoft move to rev= oke trust in 20 root certificates could wreak
     havoc o= n sites

     http://www.pcworld.com/a= rticle/3017157/security/microsoft-move-to-
     revoke= -trust-in-20-root-certificates-could-wreak-havoc-
     on-= sites.html

 

This article seems to be more or less a= bout routine pruning of the browser trust anchor lists. As I think I observe= d previously, large trust anchor lists are in fact a problem (hence efforts = like CT, etc.). However, this again seems to be the system operating as inte= nded, namely the trust anchor lists being curated.

=

 



   o What You Should= , But Don't, Do About Untrusted Certs, CAs

     http://www.darkreading.com/cloud/what-you-should-but-dont-do-abo= ut-
     untrusted-certs-cas-/d/d-id/1322111

 

This article seems to be an overview of the known threats. = I think we've mostly recapped these here.

 

 


   o IT pros don't get cybersecurity risks around certific= ate
     authorities

     http://searchsecurity.techtarget.com/news/4500253216/IT-pros-
 = ;    dont-get-cybersecurity-risks-around-certificate-authorities

 

I can't read this, but it looks like it's reporting= on the same survey as the one above.

 

 

=    o What you need to know about Dell's root certificate security<= br>     debacle

     htt= p://www.infoworld.com/article/3008422/security/what-you-need-
  =    to-know-about-dells-root-certificate-security-debacle.html=

 

This is an interesting case, but I don't see it really= reflecting much on the PKI. Effectively, Dell installed a MITM proxy (in th= e precise sense of MITM that we generally use in the security community) on = their boxes before shipping them. This proxy operated (as most do) by instal= ling their own trust anchor on the box, but that's just one form of attack y= ou can do if you control the user's computer (see https://ww= w.chromium.org/Home/chromium-security/security-faq)

=

 

<= o:p> 

 


--

  Dave Crocker
  Brandenburg InternetWorking<= br>  bbiw.net


=
--

  Dave Crocker
  Brandenburg InternetWorking
=   bbiw.net

=

 

_______________________________________________ st= ir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--B_3555019037_628306693-- From nobody Fri Aug 26 04:40:52 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08D2F12D8D7 for ; Fri, 26 Aug 2016 04:40:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bbiw.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gr1Zhc9N1fgm for ; Fri, 26 Aug 2016 04:40:50 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2878312D7AC for ; Fri, 26 Aug 2016 04:34:43 -0700 (PDT) Received: from [172.17.219.44] ([12.219.197.18]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7QBYrXQ019969 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 26 Aug 2016 04:34:54 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=bbiw.net; s=default; t=1472211294; bh=PzmdkvZhFiMEuFBAabqwQO+vlqJ99ZIz1aFhTDUjhyU=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=adZK8SI8fFg5Er+fdQSs7T4Bwjl4e8LKk0z4Id96bc9dbU362ObO2gP1AZ1CUClmy cYvwF84karzxfErdQ4EiIQ6P4lPlbF+Zqo8QbeF7IwXTjfBRZK7WO4La/z50RHMojl x7RTTC0O1F7Cl2mH8I5+QnVTpuHA0voXIcTlzxio= To: Richard Shockey , Eric Rescorla References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> <5EF7A94B-0A6E-4849-9ECC-E6650ED2F8F9@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <33fac400-2877-2090-f405-4ae312ae2f77@bbiw.net> Date: Fri, 26 Aug 2016 04:34:23 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <5EF7A94B-0A6E-4849-9ECC-E6650ED2F8F9@shockey.us> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 11:40:51 -0000 On 8/25/2016 10:17 PM, Richard Shockey wrote: > Dave and others do have some ..some legitimate points Such as? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 26 05:51:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA57F12D749 for ; Fri, 26 Aug 2016 05:51:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C55yeFkCliHZ for ; Fri, 26 Aug 2016 05:51:11 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8670012D781 for ; Fri, 26 Aug 2016 05:49:35 -0700 (PDT) Received: from [172.17.219.44] ([12.219.197.18]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7QCnkYc023169 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 26 Aug 2016 05:49:46 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472215787; bh=2ucScFOfNi0UvbpW9XNYQyNGizM7qrizuorrW8ETqRE=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=MwwrmW6D5if8UpQeRHw062ZzyBlt7p6Q5bcLHtAFqS8mzH+cddF0ZKy1MzYeWbgKK XmaMZ6l1FTOwymIeOrOe+TCRt1klCS1/CkRE7AcWlHO5RafK8u2WFSgFsogUIvDhMh wMpDx9mOGOismGe0KWAUkY25NBTMFGjXy/eTsPdc= To: Eric Rescorla References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <9217e0cb-015d-d653-f37d-470ac7d33ce2@dcrocker.net> Date: Fri, 26 Aug 2016 05:49:16 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 12:51:13 -0000 Eric, Hadn't realized that your response included inline comments as well as the top-posting. Responses to the inline comments... On 8/25/2016 4:10 PM, Eric Rescorla wrote: > On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker > wrote: > > Eric, > > On 8/22/2016 9:26 AM, Eric Rescorla wrote: > > On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker > >> wrote: > > Eric, et al, > > On 8/21/2016 6:50 AM, Eric Rescorla wrote: > > On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker > > > > > >>> wrote: > > [*] Use of certs for the web are famously problematic. > First, the > only serious reliance on them is to prevent MITM > attacks. > Second, > are all of the operational problems with root CAs. > Third > are all > the times sites do self-signing. > ... > > 1. I'm not quite sure what you mean when you say that > the only > serious > reliance of Web certificates is to prevent MITM attacks. In > general, the > purpose of Web certificates is to authenticate the endpoints > involved in > the HTTPS connection, thus preventing attackers from > impersonating one > of those endpoints (whether the attacker then does an > MITM attack or > some other attack is kind of a detail; for instance an > attacker > might > just impersonate a site without ever connecting to it). > What purpose > would you expect these certificates to serve that they > are not > serving? > > First, apologies; my comment was much too cryptic. Second, my > comment was on current operational realities, whereas your > response > started by noting intent. > > Thanks for clarifying. Responses below. > > This disparity evokes the cliche about the difference > between theory > and practice. > > Now to be less cryptic: > > The TLS specification supports server authentication, client > authentication and channel encryption. Its primary use, at > scale, > is only for encryption. Server authentication is performed, if > possible, but only to make the encryption protect against > man-in-the-middle attacks. (My understanding is that client > authentication has no significant use.) Absent that > authentication, > opportunistic encryption protects against passive > wiretapping but > not MITM. Hence my previous, cryptic summary. > > I don't believe that this is an accurate summary of the situation. > Certificates are routinely used for server authentication in > settings > where the primary target is not confidentiality of the traffic but > rather integrity of the data between the server and the client > (or vice > versa). A typical example would be software download (or > alternately, > embedding of JS libraries into Web applications) where it's > obviously > important that the user get the software they intended. As a > specific > example, Mozilla distributes Firefox over HTTPS not because > Firefox is > secret but because we don't want attackers tampering with it. > Encryption > is generally used in those scenarios as well merely because > that's how > TLS is customarily operated, but primary target is > integrity/data origin > authentication. > > > So, yes, I take your point, although there's some irony to your > explanation. Your example for data integrity is concern with > tampering. Discounting my imprecision in saying "MITM" that you > note, I believe your example falls under that very same concern as > the one I expressed... > > > Sorry, but I'm puzzled. The threat in question here is active attack, > not passive one. Exactly. Your example was about an active attack that modifies data. Generically, that's what MITM was/is getting used for (albeit without the distinction between coercing the comms data stream versus operating on the server.) (And yes, I see your later clarification that I should have been using the term 'active attack' rather than MITM, to cover both server compromise and MITM. Thanks.) > > I'm not sure what you would consider "significant" use of client > authentication but I can tell you that it's in sufficiently wide use > that we had to make special accommodations in TLS 1.3 for some > variants > of client auth because it was so important in enterprise use cases. > > > Dandy. Let's see some citations for its successful and continuing > use at scale over the open Internet (ie, with lots of independent > administrations.) > > > Hmm... We're probably talking past each other here, which may be my > fault. The typical TLS client auth scenario is as > follows: > > - The server is authenticated with a WebPKI cert. > - The client is authenticated with some locally issued cert. With respect to use of TLS for client authentication: it is not done. It's supported in TLS, but not used. (Unless folk can supply some documentation of its use at scale in a multi-administration Internet environment.) Rather, client authentication is a separate function, using a mechanism that is independent of TLS. (The fact that it's running over a TLS-protected link does not make it part of TLS.) > So the server authentication scenario is the usual one and the client > essentially has one consumer > and one administrator. > > Incidentally, it would probably be helpful here to avoid the use > of the > term "MITM". I appreciate that that terminology once had wide > currency, > but it really only refers to a specific class of impersonation > attack, > and not necessarily the one of interest. For instance, if I > impersonate > Mozilla and send you malware instead of Firefox, I don't need to > connect > to Mozilla's server, so it's not really a MITM Attack, just server > impersonation. > > > Point taken. And for careful technical discussions about very > specific attack vectors and mitigation strategies, careful labeling > is of course essential. > > My casual use of MITM was actually meant to refer to 'anything that > has an active attacker participating in the data stream with the > client, at the level of generating responses'. (Otherwise, it's > just passive monitoring.) > > It would be nice to have a single term that covers MITM and server > compromise. > > > If you mean "server impersonation" here, then the term you are looking > for is "active attack". > See https://tools.ietf.org/rfcmarkup?doc=3552#section-3.3 > dandy. thanks. > > As for serving other purposes, certs are also used to > validate the > target (server) domain name in a web session -- that is, it the > obtained server authorized under the domain name used by the > client. While I believe that the mechanisms for this are in > relatively widescale use, there's been little-to-no demonstrated > efficacy, which limits the amount people attend to any possible > problems with the certs. (Why spend time worrying about > something > that isn't useful?) There are also the significant domain name > matching problems with the mechanism, prompting a significant > revision effort. I haven't been its status, but the work is > recent. > > This seems to be raising a separate question, namely whether the > Web PKI > system actually meaningfully achieves its security goals. I'm > not aware > > > Well, 'efficacy' is meant in a somewhat higher-level way. Is the > nature of the use of that authentication -- that is, the consumption > of the produced data -- at at least the same level of trust as is > being targeted here? > > If the goal here is for use that requires more trust that that > established use -- e.g., greater downside if there is a problem -- > then established use isn't comparable. > > > I suspect that the information being protected is generally of higher > value given that we're talking about electronic banking, e-health etc. > And of course the base case for STIR deployment is going to be that the > existence of the call is authenticated but then that the actual call is > in the clear, though we eventually hope to do better than that. The current global reality for TLS is that it is tolerated to operate with self-signed certs and constant user overrides of security warnings. Is that a tolerable mode for STIR? If it isn't, then what will eliminate the problematic operational behaviors. I think the answer implied in various people's comments is that this will be a closed system. Yet that's not documented anywhere except informal emails and maybe some powerpoints. It's an essential design constraint, but it isn't documented. To the extent anyone thinks this now or ever will be open, then it conflicts with this reality in Web PKI operational behavior and there needs to be a description of how to achieve the improvement. > 3. I'm not sure how self-signing comes into things; > self-signing is > largely a response to difficulty in obtaining valid > certs. My > understanding was that STIR was going to have a more > straightforward > (and initially less distributed) issuance story. > > I was noting an operational reality, in the environment that > is the > largest users of certs. It is the ultimate demonstration of the > failure of that model. > > > I'm going to have to differ here. I certainly wouldn't argue > that the > Web PKI system is perfect, but it has also become vastly easier to > obtain and deploy certificates (thanks in large part to efforts like > Let's Encrypt, SSLmate, Caddy, and Amazon's CA), and our > telemetry shows > that we're approaching 50% of browser transactions being HTTPS, > despite > the browsers strongly discouraging self-signed certs so I think > "ultimate demonstration of the failure" somewhat overstates things. > > > I note that you don't offer a metric on the amount of self-signing > that is done. > > > Yeah, I didn't have it to hand, but I've looked since. > > Our telemetry shows that around 10% of TLS validations (more in beta, > less in release) is by "non-default roots", which (I believe, but > haven't completely validated) lumps in enterprise MITM boxes, enterprise > CAs, and end-entity certs which don't chain to any valid CA. I believe > that the latter category is what you mean by "self-signed". (Technically > self-signed is just a description of the relationship between the > subject and issuer of the certificate and it's common, for instance, to > package CA certificates as self-signed certs, but that's not really the > topic at hand). In any case, as far as I can tell, the vast majority of > TLS connections go to valid WebPKI certs. Without worrying about the accuracy or even the precise meaning of the statistic, having 10% of a mechanism's use be violation of a fundamental operational precept of that mechanism undermines the credibility of that mechanism, especially given the sensitive purpose of this particular mechanism. > > More generally, if STIR authentication merely worked > almost as > well as > the Web PKI, that seems like it would be pretty significant > improvement > over the current situation.> > That does sound appealing, doesn't it? > > Except that I believe there is no documentation to support > even this > modest a claim of efficacy, while there is quite a bit of > documentation of failures and problems with Web PKI. > > Hmm.... What kind of documentation would you consider to support > this > kind of claim (leaving aside the question of whether such > documentation > exists). > > > Reports of tiger team efforts to crack a variety of web traffic -- > and failing -- would be nice. > > > I'm not sure what you mean here. There has been an enormous amount of > research on attacking TLS and TLS stacks, some of it successful and some > of it not, and some of the things they found were big and have been > fixed and some of the things they found were small and have not. But I > think it gives a pretty clear picture of the security of TLS per se. If > you mean efforts to obtain WebPKI certs and failing, that's obviously a > harder problem to analyze I was asking a simplistic question: The claim is that TLS is effective; I realize it is a widely-held view. I was asking for some empirical (operational) basis for that assurance. It's a pretty straightforward due-diligence question when choosing to use a critical service. > Certainly it would be nice to hear fewer stories about server data > bases getting compromised. > > > I'm not sure I'm seeing the connection here. Even a perfect WebPKI > wouldn't do much to prevent server compromise because that's generally a > result of vulnerabilities in the server of one kind or another, not of > the cryptographic protocols deployed by the server. > > -Ekr > > > > [*] A few articles on certs: ekr, thanks for the following per-article comments, but I'll note that the point behind my providing these citations was merely a very quick sampling of indications of varied and serious issues in the ongoing use of the Web PKI mechanism. At the least, they ought to create some modest caution in adopting the model for a new service. > > Thanks for providing these. I don't think they actually tell us much > about the question at hand. > > > o Phishing sites exploit trust in valid SSL certificates > > > http://www.infoworld.com/article/2992605/security/phishing-sites- > > exploit-trust-in-valid-ssl-certificates.html > > > This article is about people misunderstanding valid TLS connections as > meaning that the site can be trusted. Unfortunate, but it's the WebPKI > behaving as intended. Arguably a browser UI failure. And again: human factors (and failings) are part of the system, not separate from it. > > > o Microsoft move to revoke trust in 20 root certificates could wreak > havoc on sites > > > http://www.pcworld.com/article/3017157/security/microsoft-move-to- > > revoke-trust-in-20-root-certificates-could-wreak-havoc- > on-sites.html > > > This article seems to be more or less about routine pruning of the > browser trust anchor lists. As I think I observed previously, large > trust anchor lists are in fact a problem (hence efforts like CT, etc.). > However, this again seems to be the system operating as intended, namely > the trust anchor lists being curated. If it were 'as intended' it would not threaten havoc. Trust anchor list pruning has not been part of the presented characteristics of the PKI model for typical presentations, nor for public operational models using PKI. > > > o What You Should, But Don't, Do About Untrusted Certs, CAs > > > http://www.darkreading.com/cloud/what-you-should-but-dont-do-about- > > untrusted-certs-cas-/d/d-id/1322111 > > > This article seems to be an overview of the known threats. I think we've > mostly recapped these here. > > > > > o IT pros don't get cybersecurity risks around certificate > authorities > > http://searchsecurity.techtarget.com/news/4500253216/IT-pros- > > dont-get-cybersecurity-risks-around-certificate-authorities > > > I can't read this, but it looks like it's reporting on the same survey > as the one above. > > > > o What you need to know about Dell's root certificate security > debacle > > > http://www.infoworld.com/article/3008422/security/what-you-need- > > to-know-about-dells-root-certificate-security-debacle.html > > > This is an interesting case, but I don't see it really reflecting much > on the PKI. Effectively, Dell installed a MITM proxy (in the precise > sense of MITM that we generally use in the security community) on their > boxes before shipping them. This proxy operated (as most do) by > installing their own trust anchor on the box, but that's just one form > of attack you can do if you control the user's computer > (see https://www.chromium.org/Home/chromium-security/security-faq > ) -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 26 06:51:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB48012D89E for ; Fri, 26 Aug 2016 06:51:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M4MadsKCBoC6 for ; Fri, 26 Aug 2016 06:51:19 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0167212D8E1 for ; Fri, 26 Aug 2016 06:40:31 -0700 (PDT) Received: from [172.17.219.44] ([12.219.197.18]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7QDegjT026561 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 26 Aug 2016 06:40:42 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472218842; bh=BXsKtFn8RSv82DFTDpAJLW4vDKJuaCUBPKTlBgJ3T/E=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=nBGzdHr67hbZ4oSEobolLo9k59ORT0Sv4KYtFgK5yY6rKroK6uh+ngOKe3x4FJGK8 /AHfoP7ZOiUJiOGknQHNRm63eocl7p5902AV3QWTufGWveF05+si8w4wj2vfuT9z47 OlXNctzi7cIMUPyA7Zkmrc80oNtzzlsvHJhVtUVM= To: Brian Rosen References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 26 Aug 2016 06:40:11 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 13:51:23 -0000 On 8/22/2016 9:14 AM, Brian Rosen wrote: > The root of trust for every country is the regulator. They are the > ultimate source of telephone numbers for that country code ... > Our premise is that issuance of certs follows the delegation process. > When you delegate, a cert is issued (or the scope of an existing cert > is changed). > > The goal to to provide authenticated source of calls, but in reality, > what we need is a way for the authorities to find bad actors. By > making the PKI follow the delegation path, you end up with someone > holding the bag. Brian, The above is a useful start, for talking about what exactly is needed. The messiness seems to be getting to the granularity of individual telephone numbers, given that neighboring numbers don't have to be administered by the same organization. The administrative challenges in operating a query service with that many entries and that much variability in administrative responsibility from one entry to the next is beyond not merely challenging. I believe there is no example of it being done across organizational boundaries, such as having different parts being administered by competing telecom providers. Yet that's the requirement STIR is taking on. What has been occurring to me is that that level of granularity isn't needed, if we take your above summary seriously. So, don't have an entry per telephone number. Rather, we only need to have things be signed by the responsible /organization/. And operating at that coarser lever of granularity is something we /do/ know how to run. (Guess what reference gets inserted here.) That is, have the responsible provider (or their delegatee) do the signing and you have an accountable entity on the hook for any problems. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Aug 26 07:09:02 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6874C12B05F for ; Fri, 26 Aug 2016 07:09:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8z5zlFej11OR for ; Fri, 26 Aug 2016 07:08:57 -0700 (PDT) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66F8312D94A for ; Fri, 26 Aug 2016 06:58:16 -0700 (PDT) Received: by mail-qt0-x232.google.com with SMTP id 52so38122687qtq.3 for ; Fri, 26 Aug 2016 06:58:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=wNxJ641849Zd9rVDakGIaDSG17JmG0gB4F8ILsE66Mc=; b=pF8um6RuIiD+nQ4viyq5LluTCYH/SPngXDd51fWbDo4SqSOEr819q3Me2fwOG6hayr 4339lJ3lFXXXSqkr9XSAeL1H0Asaxj6ZW4X9PqkS8Y3q5jgnB271k0LOLESWORvuYPgw 1jiMnxMi0IRx+uFR/xVqiwEP4TeENMs8f3yscyadsP5XgQMztQNt71zGje1t+pVCPRen Kn6XXd0lYNonc9Tv5elYw2GMv7LwnpYCEwXOJudCQbTjZ3Jsk+rESVasD5rwPQFYnr3a VjF4/qXc4RkBUzUPnQoO07y8wksK8eF/CKKAoxgYYESGx9/tfsWtWV9xLiDhL6r7xTZq HTuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=wNxJ641849Zd9rVDakGIaDSG17JmG0gB4F8ILsE66Mc=; b=WSSWxltnIdn+LWjnKkUYXBXhOC33l3jwC4itOfvRNFdE09kX9KChTq6wsg5WGHW/2a Yu3WPCRIkKaG0ezddqCLucTlyMSBgLdjYVXcBRw5UX4lv0trPeul0wZuVk75NBKvMb6p L6KosZNUlMdixhbcEtd1r9bthfgg5EOZuvuN8g+LbSgb5GJin23WijU9lsMAnS/wBn3i +59r/QaT9lEakuPhdwUOEd+j71QV/5am5oN421gqx9yZPhuLQ7Td3cjqXbXDjTI1orHI HAecxk34m5nhIC+tnd7Imk2Os+i93AAoMC16cOAYkj4k5AFCiAIklLYp78yezagTlVnh KiLQ== X-Gm-Message-State: AE9vXwN2JV3DuXmghuYSy8r+4UGkoFnp26F6+4JJkca206E+Qdi35x47Jpj8lRISpAhMpQ== X-Received: by 10.200.53.135 with SMTP id k7mr3493588qtb.47.1472219895474; Fri, 26 Aug 2016 06:58:15 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id 73sm10403675qtc.16.2016.08.26.06.58.14 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 26 Aug 2016 06:58:14 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Fri, 26 Aug 2016 09:58:12 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 14:09:01 -0000 > On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: >=20 > On 8/22/2016 9:14 AM, Brian Rosen wrote: >> The root of trust for every country is the regulator. They are the >> ultimate source of telephone numbers for that country code > ... >> Our premise is that issuance of certs follows the delegation process. >> When you delegate, a cert is issued (or the scope of an existing cert >> is changed). >>=20 >> The goal to to provide authenticated source of calls, but in reality, >> what we need is a way for the authorities to find bad actors. By >> making the PKI follow the delegation path, you end up with someone >> holding the bag. >=20 >=20 > Brian, >=20 > The above is a useful start, for talking about what exactly is needed. >=20 > The messiness seems to be getting to the granularity of individual = telephone numbers, given that neighboring numbers don't have to be = administered by the same organization. The administrative challenges in = operating a query service with that many entries and that much = variability in administrative responsibility from one entry to the next = is beyond not merely challenging. Huh? The only problem is discovering the root of trust for a country = you haven=E2=80=99t gotten a call from. We=E2=80=99re not going to = build a golden root, but because the root of trust is either the = regulator itself or someone it designates, it=E2=80=99s trivial for = anyone who wants to to make a list of them. We=E2=80=99re standardizing = the protocols. >=20 > I believe there is no example of it being done across organizational = boundaries, such as having different parts being administered by = competing telecom providers. Yet that's the requirement STIR is taking = on. >=20 > What has been occurring to me is that that level of granularity isn't = needed, if we take your above summary seriously. >=20 > So, don't have an entry per telephone number. >=20 > Rather, we only need to have things be signed by the responsible = /organization/. And operating at that coarser lever of granularity is = something we /do/ know how to run. (Guess what reference gets inserted = here.) >=20 > That is, have the responsible provider (or their delegatee) do the = signing and you have an accountable entity on the hook for any problems. You get a call with a signature. How do you know who the responsible organization is? Could be an enterprise, could be a service provider, could be a phone. = It in fact could be all three. How do you know? There is no database of who the responsible organizations are. There is = no vetting of who constitutes =E2=80=9Cresponsible=E2=80=9D. A VoIP = service provider can set up shop, purchase some numbers and termination = service from a certificated carrier, resell 100 numbers to a PBX hosting = provider, who resells 10 to an enterprise, who contracts with a call = center (on another certificated carrier) to make calls. Who is the = =E2=80=9Cresponsible organization=E2=80=9D? Brian >=20 >=20 > d/ >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Fri Aug 26 08:07:51 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D316412D5AB for ; Fri, 26 Aug 2016 08:07:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hRkWAIGGw3QB for ; Fri, 26 Aug 2016 08:07:39 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2ED212D0CA for ; Fri, 26 Aug 2016 08:07:38 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id A21BD30058E for ; Fri, 26 Aug 2016 11:07:36 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id jzFhTKFaG5r6 for ; Fri, 26 Aug 2016 11:07:35 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 6C9DC3002C4; Fri, 26 Aug 2016 11:07:35 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: Date: Fri, 26 Aug 2016 11:07:43 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> To: Dave Crocker X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 15:07:43 -0000 On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: > On 8/22/2016 9:14 AM, Brian Rosen wrote: >> The root of trust for every country is the regulator. They are the >> ultimate source of telephone numbers for that country code > ... >> Our premise is that issuance of certs follows the delegation process. >> When you delegate, a cert is issued (or the scope of an existing cert >> is changed). >>=20 >> The goal to to provide authenticated source of calls, but in reality, >> what we need is a way for the authorities to find bad actors. By >> making the PKI follow the delegation path, you end up with someone >> holding the bag. >=20 >=20 > Brian, >=20 > The above is a useful start, for talking about what exactly is needed. >=20 > The messiness seems to be getting to the granularity of individual = telephone numbers, given that neighboring numbers don't have to be = administered by the same organization. The administrative challenges in = operating a query service with that many entries and that much = variability in administrative responsibility from one entry to the next = is beyond not merely challenging. >=20 > I believe there is no example of it being done across organizational = boundaries, such as having different parts being administered by = competing telecom providers. Yet that's the requirement STIR is taking = on. >=20 > What has been occurring to me is that that level of granularity isn't = needed, if we take your above summary seriously. >=20 > So, don't have an entry per telephone number. >=20 > Rather, we only need to have things be signed by the responsible = /organization/. And operating at that coarser lever of granularity is = something we /do/ know how to run. (Guess what reference gets inserted = here.) >=20 > That is, have the responsible provider (or their delegatee) do the = signing and you have an accountable entity on the hook for any problems. Dave, this is not correct. All of the numbers with a given country code = are under the authority of that national requlator. This regulator must = establish (and publish) one or more trust anchor. If the certificate = chains to that trust anchor, then it is valid. One can imagine this scaling to a certificate for each phone number, but = that is not the near-term plan. I have asked the authors to add a section to the stir-certificates = document that explains what a national regulator must do to establish = the trust anchor(s) for their country. Hopefully that yet-to-be-written = text will resolve this concern. Russ From nobody Fri Aug 26 08:46:05 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1735612D0E1 for ; Fri, 26 Aug 2016 08:46:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.701 X-Spam-Level: X-Spam-Status: No, score=-102.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=neustar.biz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GLdjd3Kk4WFi for ; Fri, 26 Aug 2016 08:46:02 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F49312D0CA for ; Fri, 26 Aug 2016 08:46:02 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u7QFh8m6013288; Fri, 26 Aug 2016 11:46:00 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=neustar.biz; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=neustar.biz; bh=xn+4tC3n38P8VBs80X21YUpRmPmZ9U6ezEqjNIOuLRQ=; b=BApTd+lSdeL6ayM1VyNXvjsCBTDyYMiFXJif07IGqEu5xT9PygRNhqyDtLZIMFYZ5aQp cv+GlbSJtm4zjEgzqI7DA3iyK47sWMMEtIHeHYNpLgCQTe66jRp59Il8w86MAl17zFO2 0TZRRtYH8hyXruOxD82o3xzLnFkgSrcaEbdVn2Hml5L2tSNNM3CWfb7n5GKppjhYunBY Y0/oI5T1htskT+XoA7kVjpwmFpHLHG/XeOMSCnEQqHNDRcGaSHOele2ifVYFbbs7Klnd f2Lj02NJXrn8PaXq7IpOwJtJWBhRcN1JuEBWU4Ankggzd6PE5D232qkafsQ5SqHBC3ID kA== Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24xhuv8n7d-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Fri, 26 Aug 2016 11:46:00 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Fri, 26 Aug 2016 11:45:59 -0400 From: "Peterson, Jon" To: Russ Housley Thread-Topic: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) Thread-Index: AQHR/6DwvMnmi2yAP0CcqIGJnE+oVaBbmvyA///Ho7U= Date: Fri, 26 Aug 2016 15:45:58 +0000 Message-ID: <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> , <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> In-Reply-To: <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-08-26_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608260205 Archived-At: Cc: IETF STIR Mail List , Dave Crocker Subject: Re: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 15:46:04 -0000 Well, the stir-certs document outlines a method for a responsible provider = doing the signing (the "first approach" of Section 3) without getting into = the details of who exactly has been assigned what number. That's so you hav= e an accountable entity on the hook for any problems. This reflects the app= roach that Rich and others in ATIS have been developing. They intend to mak= e use of the LoA in STIR-certs as well. We then have a separate story about number assignment for TNs that we belie= ve is also salient to the threat model. There are ways that could work with= and without the direct involvement of national regulators. Some of the mor= e casual approaches to establishing number ownership, while they don't cons= titute a definitive chain-of-title as it were, would still address our thre= at model I think. Ultimately I think we are looking at a situation where we have the flexibil= ity to experiment with some different trust models, to try transitional str= ategies and so on. STIR-certs intentionally creates that room for the trust= story to develop independently from the signaling defined in rfc4474bis. P= ersonally, if people wanted to deliver keys through the DNS, I'd still be o= pen to considering it as a model. I just don't see that model as mutually e= xclusive with the work we've done in stir-certs.=20 Jon Peterson Neustar, Inc. Sent from my iPad > On Aug 26, 2016, at 8:07 AM, Russ Housley wrote: >=20 >=20 >> On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: >>=20 >>> On 8/22/2016 9:14 AM, Brian Rosen wrote: >>> The root of trust for every country is the regulator. They are the >>> ultimate source of telephone numbers for that country code >> ... >>> Our premise is that issuance of certs follows the delegation process. >>> When you delegate, a cert is issued (or the scope of an existing cert >>> is changed). >>>=20 >>> The goal to to provide authenticated source of calls, but in reality, >>> what we need is a way for the authorities to find bad actors. By >>> making the PKI follow the delegation path, you end up with someone >>> holding the bag. >>=20 >>=20 >> Brian, >>=20 >> The above is a useful start, for talking about what exactly is needed. >>=20 >> The messiness seems to be getting to the granularity of individual telep= hone numbers, given that neighboring numbers don't have to be administered = by the same organization. The administrative challenges in operating a que= ry service with that many entries and that much variability in administrati= ve responsibility from one entry to the next is beyond not merely challengi= ng. >>=20 >> I believe there is no example of it being done across organizational bou= ndaries, such as having different parts being administered by competing tel= ecom providers. Yet that's the requirement STIR is taking on. >>=20 >> What has been occurring to me is that that level of granularity isn't ne= eded, if we take your above summary seriously. >>=20 >> So, don't have an entry per telephone number. >>=20 >> Rather, we only need to have things be signed by the responsible /organi= zation/. And operating at that coarser lever of granularity is something w= e /do/ know how to run. (Guess what reference gets inserted here.) >>=20 >> That is, have the responsible provider (or their delegatee) do the signi= ng and you have an accountable entity on the hook for any problems. >=20 > Dave, this is not correct. All of the numbers with a given country code = are under the authority of that national requlator. This regulator must es= tablish (and publish) one or more trust anchor. If the certificate chains = to that trust anchor, then it is valid. >=20 > One can imagine this scaling to a certificate for each phone number, but = that is not the near-term plan. >=20 > I have asked the authors to add a section to the stir-certificates docume= nt that explains what a national regulator must do to establish the trust a= nchor(s) for their country. Hopefully that yet-to-be-written text will res= olve this concern. >=20 > Russ >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 26 08:48:46 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D20312D0E1 for ; Fri, 26 Aug 2016 08:48:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gGlVfA3ZUder for ; Fri, 26 Aug 2016 08:48:43 -0700 (PDT) Received: from mail-yw0-x22c.google.com (mail-yw0-x22c.google.com [IPv6:2607:f8b0:4002:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7300312D0CA for ; Fri, 26 Aug 2016 08:48:43 -0700 (PDT) Received: by mail-yw0-x22c.google.com with SMTP id z8so50930490ywa.1 for ; Fri, 26 Aug 2016 08:48:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=d6pW6xbSLdKxVPLVhWJQRecL0I5hj4Kwx1xO3A02fHg=; b=RznK/7GQlcEwcZqvfGUqxSvD58l5kLHnhLj8Lb/1AhzlfFRdZOiWAPlDblwPU10QMg q1Rz+8Jkud/Ktxh8sXmEjDi1ZEN7FssDibEP6ZdEA9LigsngRFB3pkLYd5iK14AMoRuA IXt8k2t9wMGOiG+nGSEAVYqdzUQbSnPJL2X3IQDTkv3SqVfm/WEWs/C/e0XpOe8BebyT zLeihCg8yJW76JxDbfes3Df9mGFePQCkcFw8NYNaQSepQYdEZD2CaSYVR+8F3zuFUsds IBOhukx+T/sf5tiD6zKNtPF7AtX7wYJ6aaS5OvQU3bZGTvuIXipXF0SOrWDsM5neabPa DeqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=d6pW6xbSLdKxVPLVhWJQRecL0I5hj4Kwx1xO3A02fHg=; b=MSyrv0sQIRC+TQKYI15r897SERDs4NYIgCA7sFwHVP+P56I7RmVdQwM3pZ1RVKLM/J PVxnQpO3I5zGtt8QFkJiSQEIkgwbP3xd5beZAxuPqrbZcJtlK6pXGG8SOo1+EMALxfKQ OqXFl6yaKVNikM+HGyStnqMION3wbcGQyZgG/aS0WBMciY9+yHLXLbkiKvhVJhj+j2Vr wxL+fWHahILxwyx7TxW8A1UCjJS92FLLEkBwHIsNHPfsDivOHZcXTwODf11j3aPEA7+m bmuYF1K23ZUuUnF5peoB29H6bmwWT6xGa/IVkBZ6P8ns5SLhU2Vg/A8r6r45Yy16tjOM J9yA== X-Gm-Message-State: AE9vXwMgpGPJjk0G1O5ex60kQsG64ZNDKJCkYIpA5Cxx2j18xqNm9nBIsQWUItvouabajhKqqZCn12Ajc7OpOw== X-Received: by 10.129.125.135 with SMTP id y129mr3860602ywc.107.1472226522562; Fri, 26 Aug 2016 08:48:42 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Fri, 26 Aug 2016 08:48:02 -0700 (PDT) In-Reply-To: <9217e0cb-015d-d653-f37d-470ac7d33ce2@dcrocker.net> References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <8cdf87ab-30ab-0efc-ddab-27ec85cb3b8c@dcrocker.net> <9217e0cb-015d-d653-f37d-470ac7d33ce2@dcrocker.net> From: Eric Rescorla Date: Fri, 26 Aug 2016 08:48:02 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=001a11492ce8e8302d053afb72f9 Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Key query/validation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 15:48:45 -0000 --001a11492ce8e8302d053afb72f9 Content-Type: text/plain; charset=UTF-8 On Fri, Aug 26, 2016 at 5:49 AM, Dave Crocker wrote: > Eric, > > Hadn't realized that your response included inline comments as well as the > top-posting. > > Responses to the inline comments... > > > On 8/25/2016 4:10 PM, Eric Rescorla wrote: > > On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker > > wrote: >> >> Eric, >> >> On 8/22/2016 9:26 AM, Eric Rescorla wrote: >> >> On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker > >> >> wrote: >> >> Eric, et al, >> >> On 8/21/2016 6:50 AM, Eric Rescorla wrote: >> >> On Sat, Aug 20, 2016 at 11:53 AM, Dave Crocker >> >> > >> >> >>> wrote: >> >> [*] Use of certs for the web are famously problematic. >> First, the >> only serious reliance on them is to prevent MITM >> attacks. >> Second, >> are all of the operational problems with root CAs. >> Third >> are all >> the times sites do self-signing. >> ... >> >> 1. I'm not quite sure what you mean when you say that >> the only >> serious >> reliance of Web certificates is to prevent MITM attacks. >> In >> general, the >> purpose of Web certificates is to authenticate the >> endpoints >> involved in >> the HTTPS connection, thus preventing attackers from >> impersonating one >> of those endpoints (whether the attacker then does an >> MITM attack or >> some other attack is kind of a detail; for instance an >> attacker >> might >> just impersonate a site without ever connecting to it). >> What purpose >> would you expect these certificates to serve that they >> are not >> serving? >> >> First, apologies; my comment was much too cryptic. Second, my >> comment was on current operational realities, whereas your >> response >> started by noting intent. >> >> Thanks for clarifying. Responses below. >> >> This disparity evokes the cliche about the difference >> between theory >> and practice. >> >> Now to be less cryptic: >> >> The TLS specification supports server authentication, client >> authentication and channel encryption. Its primary use, at >> scale, >> is only for encryption. Server authentication is performed, >> if >> possible, but only to make the encryption protect against >> man-in-the-middle attacks. (My understanding is that client >> authentication has no significant use.) Absent that >> authentication, >> opportunistic encryption protects against passive >> wiretapping but >> not MITM. Hence my previous, cryptic summary. >> >> I don't believe that this is an accurate summary of the situation. >> Certificates are routinely used for server authentication in >> settings >> where the primary target is not confidentiality of the traffic but >> rather integrity of the data between the server and the client >> (or vice >> versa). A typical example would be software download (or >> alternately, >> embedding of JS libraries into Web applications) where it's >> obviously >> important that the user get the software they intended. As a >> specific >> example, Mozilla distributes Firefox over HTTPS not because >> Firefox is >> secret but because we don't want attackers tampering with it. >> Encryption >> is generally used in those scenarios as well merely because >> that's how >> TLS is customarily operated, but primary target is >> integrity/data origin >> authentication. >> >> >> So, yes, I take your point, although there's some irony to your >> explanation. Your example for data integrity is concern with >> tampering. Discounting my imprecision in saying "MITM" that you >> note, I believe your example falls under that very same concern as >> the one I expressed... >> >> >> Sorry, but I'm puzzled. The threat in question here is active attack, >> not passive one. >> > > Exactly. Your example was about an active attack that modifies data. > Generically, that's what MITM was/is getting used for (albeit without the > distinction between coercing the comms data stream versus operating on the > server.) > > (And yes, I see your later clarification that I should have been using the > term 'active attack' rather than MITM, to cover both server compromise and > MITM. Thanks.) Do you mean "server impersonation" here? Because "server compromise" is yet a different kind of attack. That's of course active too, but it's not a network attack, really, and falls under a different threat model. I'm not sure what you would consider "significant" use of client >> authentication but I can tell you that it's in sufficiently wide >> use >> that we had to make special accommodations in TLS 1.3 for some >> variants >> of client auth because it was so important in enterprise use >> cases. >> >> >> Dandy. Let's see some citations for its successful and continuing >> use at scale over the open Internet (ie, with lots of independent >> administrations.) >> >> >> Hmm... We're probably talking past each other here, which may be my >> fault. The typical TLS client auth scenario is as >> follows: >> >> - The server is authenticated with a WebPKI cert. >> - The client is authenticated with some locally issued cert. >> > > With respect to use of TLS for client authentication: it is not done. > It's supported in TLS, but not used. (Unless folk can supply some > documentation of its use at scale in a multi-administration Internet > environment.) > > Rather, client authentication is a separate function, using a mechanism > that is independent of TLS. (The fact that it's running over a > TLS-protected link does not make it part of TLS.) You seem to be applying an odd standard here. As I said, people use TLS client authentication (i.e., the mechanism specified in TLS, not just something that runs over TLS like FIDO) but with privately issued certificates. I concur that they don't generally use it with publicly verifiable certificates, but that does not mean that they do not use TLS for client authentication. > As for serving other purposes, certs are also used to >> validate the >> target (server) domain name in a web session -- that is, it >> the >> obtained server authorized under the domain name used by the >> client. While I believe that the mechanisms for this are in >> relatively widescale use, there's been little-to-no >> demonstrated >> efficacy, which limits the amount people attend to any >> possible >> problems with the certs. (Why spend time worrying about >> something >> that isn't useful?) There are also the significant domain name >> matching problems with the mechanism, prompting a significant >> revision effort. I haven't been its status, but the work is >> recent. >> >> This seems to be raising a separate question, namely whether the >> Web PKI >> system actually meaningfully achieves its security goals. I'm >> not aware >> >> >> Well, 'efficacy' is meant in a somewhat higher-level way. Is the >> nature of the use of that authentication -- that is, the consumption >> of the produced data -- at at least the same level of trust as is >> being targeted here? >> >> If the goal here is for use that requires more trust that that >> established use -- e.g., greater downside if there is a problem -- >> then established use isn't comparable. >> >> >> I suspect that the information being protected is generally of higher >> value given that we're talking about electronic banking, e-health etc. >> And of course the base case for STIR deployment is going to be that the >> existence of the call is authenticated but then that the actual call is >> in the clear, though we eventually hope to do better than that. >> > > The current global reality for TLS is that it is tolerated to operate with > self-signed certs and constant user overrides of security warnings. > I'm not sure what you mean by "constant user overrides". As I said in my previous e-mail, it's a big Internet so there are a lot of self-signed certs, but it's actually not the case that you have to override certs constantly to use the Internet (I basically never do except when I'm testing something), and the browsers strongly discourage it. Is that a tolerable mode for STIR? If it isn't, then what will eliminate > the problematic operational behaviors. I think the answer implied in > various people's comments is that this will be a closed system. I don't actually think that that's the answer. Rather the answer is that STIR is opportunistic in a way that HTTPS is not. I.e., if I enter an https:// URL, then that tells the browser I want to do HTTPS and if the server does not have a real cert, it can either offer a self-signed cert or fail and my browser can either accept that (possibly with an override) or fail. However, STIR is different in the sense that I can get non-STIR SIP messages and then I just don't show security indicators (or show unknown caller-ID, or whatever local policy demands). Thus, there is no need to fall back to an unvalidatable credential except for testing purposes. > I'm not sure what you mean here. There has been an enormous amount of >> research on attacking TLS and TLS stacks, some of it successful and some >> of it not, and some of the things they found were big and have been >> fixed and some of the things they found were small and have not. But I >> think it gives a pretty clear picture of the security of TLS per se. If >> you mean efforts to obtain WebPKI certs and failing, that's obviously a >> harder problem to analyze >> > > I was asking a simplistic question: The claim is that TLS is effective; I > realize it is a widely-held view. I was asking for some empirical > (operational) basis for that assurance. It's a pretty straightforward > due-diligence question when choosing to use a critical service. I think I've made clear what sort of evidence is available. You (and the WG in general) will have to make your own judgements about whether that evidence is sufficient. > This article seems to be more or less about routine pruning of the >> browser trust anchor lists. As I think I observed previously, large >> trust anchor lists are in fact a problem (hence efforts like CT, etc.). >> However, this again seems to be the system operating as intended, namely >> the trust anchor lists being curated. >> > > If it were 'as intended' it would not threaten havoc. Trust anchor list > pruning has not been part of the presented characteristics of the PKI model > for typical presentations, nor for public operational models using PKI. Well, I don't know what's in "typical presentations", but the fact that the trust anchor list maintainers can and do remove trust anchors is quite well known and in fact it's often very public when we choose to distrust a CA. -Ekr --001a11492ce8e8302d053afb72f9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Aug 26, 2016 at 5:49 AM, Dave Crocker <dhc@dcrocker.net>= wrote:
Eric,

Hadn't realized that your response included inline comments as well as = the top-posting.

Responses to the inline comments...


On 8/25/2016 4:10 PM, Eric Rescorla wrote:

On Tue, Aug 23, 2016 at 8:49 PM, Dave Crocker <dhc@dcrocker.net
 <mailto:dhc@dcrock= er.net>> wrote:

=C2=A0 =C2=A0 Eric,

=C2=A0 =C2=A0 On 8/22/2016 9:26 AM, Eric Rescorla wrote:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 On Mon, Aug 22, 2016 at 8:59 AM, Dave Crocker &= lt;dhc@dcrocker.net
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net <mailto:dhc@dcrocker.net>>> wrote:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Eric, et al,

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 On 8/21/2016 6:50 AM, Eric Rescor= la wrote:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 On Sat, Aug 20, 201= 6 at 11:53 AM, Dave Crocker
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <dhc@dcrocker.net <mailto:dhc@dcrocker.net>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net <mai= lto:dhc@dcrocker.net<= /a>>>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net <mai= lto:dhc@dcrocker.net<= /a>>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <mailto:dhc@dcrocker.net <mailto:dhc@dcrocker.net>>>> wrote:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [*] U= se of certs for the web are famously problematic.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 First, the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 only = serious reliance on them is to prevent MITM
=C2=A0 =C2=A0 =C2=A0 =C2=A0 attacks.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Second,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 are a= ll of the operational problems with root CAs.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Third
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 are all
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 the t= imes sites do self-signing.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ...

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 1. I'm not quit= e sure what you mean when you say that
=C2=A0 =C2=A0 =C2=A0 =C2=A0 the only
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 serious
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 reliance of Web cer= tificates is to prevent MITM attacks. In
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 general, the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 purpose of Web cert= ificates is to authenticate the endpoints
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 involved in
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 the HTTPS connectio= n, thus preventing attackers from
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 impersonating one =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 of those endpoints = (whether the attacker then does an
=C2=A0 =C2=A0 =C2=A0 =C2=A0 MITM attack or
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 some other attack i= s kind of a detail; for instance an
=C2=A0 =C2=A0 =C2=A0 =C2=A0 attacker
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 might
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 just impersonate a = site without ever connecting to it).
=C2=A0 =C2=A0 =C2=A0 =C2=A0 What purpose
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 would you expect th= ese certificates to serve that they
=C2=A0 =C2=A0 =C2=A0 =C2=A0 are not
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 serving?

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 First, apologies; my comment was = much too cryptic.=C2=A0 Second, my
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 comment was on current operationa= l realities, whereas your
=C2=A0 =C2=A0 =C2=A0 =C2=A0 response
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 started by noting intent.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Thanks for clarifying. Responses below.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 This disparity evokes the cliche = about the difference
=C2=A0 =C2=A0 =C2=A0 =C2=A0 between theory
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 and practice.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Now to be less cryptic:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 The TLS specification supports se= rver authentication, client
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 authentication and channel encryp= tion.=C2=A0 Its primary use, at
=C2=A0 =C2=A0 =C2=A0 =C2=A0 scale,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 is only for encryption.=C2=A0 Ser= ver authentication is performed, if
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 possible, but only to make the en= cryption protect against
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 man-in-the-middle attacks.=C2=A0 = (My understanding is that client
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 authentication has no significant= use.) Absent that
=C2=A0 =C2=A0 =C2=A0 =C2=A0 authentication,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 opportunistic encryption protects= against passive
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wiretapping but
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 not MITM.=C2=A0 Hence my previous= , cryptic summary.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 I don't believe that this is an accurate su= mmary of the situation.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Certificates are routinely used for server auth= entication in
=C2=A0 =C2=A0 =C2=A0 =C2=A0 settings
=C2=A0 =C2=A0 =C2=A0 =C2=A0 where the primary target is not confidentiality= of the traffic but
=C2=A0 =C2=A0 =C2=A0 =C2=A0 rather integrity of the data between the server= and the client
=C2=A0 =C2=A0 =C2=A0 =C2=A0 (or vice
=C2=A0 =C2=A0 =C2=A0 =C2=A0 versa). A typical example would be software dow= nload (or
=C2=A0 =C2=A0 =C2=A0 =C2=A0 alternately,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 embedding of JS libraries into Web applications= ) where it's
=C2=A0 =C2=A0 =C2=A0 =C2=A0 obviously
=C2=A0 =C2=A0 =C2=A0 =C2=A0 important that the user get the software they i= ntended. As a
=C2=A0 =C2=A0 =C2=A0 =C2=A0 specific
=C2=A0 =C2=A0 =C2=A0 =C2=A0 example, Mozilla distributes Firefox over HTTPS= not because
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Firefox is
=C2=A0 =C2=A0 =C2=A0 =C2=A0 secret but because we don't want attackers = tampering with it.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Encryption
=C2=A0 =C2=A0 =C2=A0 =C2=A0 is generally used in those scenarios as well me= rely because
=C2=A0 =C2=A0 =C2=A0 =C2=A0 that's how
=C2=A0 =C2=A0 =C2=A0 =C2=A0 TLS is customarily operated, but primary target= is
=C2=A0 =C2=A0 =C2=A0 =C2=A0 integrity/data origin
=C2=A0 =C2=A0 =C2=A0 =C2=A0 authentication.


=C2=A0 =C2=A0 So, yes, I take your point, although there's some irony t= o your
=C2=A0 =C2=A0 explanation.=C2=A0 Your example for data integrity is concern= with
=C2=A0 =C2=A0 tampering.=C2=A0 Discounting my imprecision in saying "M= ITM" that you
=C2=A0 =C2=A0 note, I believe your example falls under that very same conce= rn as
=C2=A0 =C2=A0 the one I expressed...


Sorry, but I'm puzzled. The threat in question here is active attack, not passive one.

Exactly.=C2=A0 Your example was about an active attack that modifies data. = Generically, that's what MITM was/is getting used for (albeit without t= he distinction between coercing the comms data stream versus operating on t= he server.)

(And yes, I see your later clarification that I should have been using the = term 'active attack' rather than MITM, to cover both server comprom= ise and MITM.=C2=A0 Thanks.)

Do you mean &q= uot;server impersonation" here? Because "server compromise" = is yet a different kind of attack. That's of course active too, but it&= #39;s not a network attack, really, and falls under a different threat mode= l.


=C2=A0 =C2=A0 =C2=A0 =C2=A0 I'm not sure what you would consider "= significant" use of client
=C2=A0 =C2=A0 =C2=A0 =C2=A0 authentication but I can tell you that it's= in sufficiently wide use
=C2=A0 =C2=A0 =C2=A0 =C2=A0 that we had to make special accommodations in T= LS 1.3 for some
=C2=A0 =C2=A0 =C2=A0 =C2=A0 variants
=C2=A0 =C2=A0 =C2=A0 =C2=A0 of client auth because it was so important in e= nterprise use cases.


=C2=A0 =C2=A0 Dandy.=C2=A0 Let's see some citations for its successful = and continuing
=C2=A0 =C2=A0 use at scale over the open Internet (ie, with lots of indepen= dent
=C2=A0 =C2=A0 administrations.)


Hmm... We're probably talking past each other here, which may be my
fault. The typical TLS client auth scenario is as
follows:

- The server is authenticated with a WebPKI cert.
- The client is authenticated with some locally issued cert.

 With respect to use of TLS for client authentication:=C2=A0 it is not done.= It's supported in TLS, but not used.=C2=A0 (Unless folk can supply som= e documentation of its use at scale in a multi-administration Internet envi= ronment.)

Rather, client authentication is a separate function, using a mechanism tha= t is independent of TLS.=C2=A0 (The fact that it's running over a TLS-p= rotected link does not make it part of TLS.)

You seem to be applying an odd standard here.

As= I said, people use TLS client authentication (i.e., the mechanism specifie= d in TLS, not just something that runs over TLS like FIDO) but with private= ly issued certificates. I concur that they don't generally use it with = publicly verifiable certificates, but that does not mean that they do not u= se TLS for client authentication.

=C2=A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 As for serving other purposes, ce= rts are also used to
=C2=A0 =C2=A0 =C2=A0 =C2=A0 validate the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 target (server) domain name in a = web session -- that is, it the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 obtained server authorized under = the domain name used by the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 client.=C2=A0 While I believe tha= t the mechanisms for this are in
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 relatively widescale use, there&#= 39;s been little-to-no demonstrated
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 efficacy, which limits the amount= people attend to any possible
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 problems with the certs. (Why spe= nd time worrying about
=C2=A0 =C2=A0 =C2=A0 =C2=A0 something
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 that isn't useful?) There are= also the significant domain name
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 matching problems with the mechan= ism, prompting a significant
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 revision effort.=C2=A0 I haven= 9;t been its status, but the work is
=C2=A0 =C2=A0 =C2=A0 =C2=A0 recent.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 This seems to be raising a separate question, n= amely whether the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Web PKI
=C2=A0 =C2=A0 =C2=A0 =C2=A0 system actually meaningfully achieves its secur= ity goals. I'm
=C2=A0 =C2=A0 =C2=A0 =C2=A0 not aware


=C2=A0 =C2=A0 Well, 'efficacy' is meant in a somewhat higher-level = way.=C2=A0 Is the
=C2=A0 =C2=A0 nature of the use of that authentication -- that is, the cons= umption
=C2=A0 =C2=A0 of the produced data -- at at least the same level of trust a= s is
=C2=A0 =C2=A0 being targeted here?

=C2=A0 =C2=A0 If the goal here is for use that requires more trust that tha= t
=C2=A0 =C2=A0 established use -- e.g., greater downside if there is a probl= em --
=C2=A0 =C2=A0 then established use isn't comparable.


I suspect that the information being protected is generally of higher
value given that we're talking about electronic banking, e-health etc.<= br> And of course=C2=A0 the base case for STIR deployment is going to be that t= he
existence of the call is authenticated but then that the actual call is
in the clear, though we eventually hope to do better than that.

The current global reality for TLS is that it is tolerated to operate with = self-signed certs and constant user overrides of security warnings.

I'm not sure what you mean by "consta= nt user overrides". As I said in my previous e-mail, it's a big In= ternet so there are a lot of self-signed certs, but it's actually not t= he case that you have to override certs constantly to use the Internet (I b= asically never do except when I'm testing something), and the browsers = strongly discourage it.


Is that a tolerable mode for STIR?=C2=A0 If it isn't, then what will el= iminate the problematic operational behaviors.=C2=A0 I think the answer imp= lied in various people's comments is that this will be a closed system.= =C2=A0

I don't actually think that that= 's the answer. Rather the answer is that STIR is opportunistic in a way= that HTTPS is not. I.e., if I enter an https:// URL, then that tells the b= rowser I want to do HTTPS and if the server does not have a real cert, it c= an either offer a self-signed cert or fail and my browser can either accept= that (possibly with an override) or fail. However, STIR is different in th= e sense that I can get non-STIR SIP messages and then I just don't show= security indicators (or show unknown caller-ID, or whatever local policy d= emands). Thus, there is no need to fall back to an unvalidatable credential= except for testing purposes.


I'm not= sure what you mean here. There has been an enormous amount of
research on attacking TLS and TLS stacks, some of it successful and some of it not, and some of the things they found were big and have been
fixed and some of the things they found were small and have not. But I
think it gives a pretty clear picture of the security of TLS per se. If
you mean efforts to obtain WebPKI certs and failing, that's obviously a=
harder problem to analyze

I was asking a simplistic question:=C2=A0 The claim is that TLS is effectiv= e; I realize it is a widely-held view.=C2=A0 I was asking for some empirica= l (operational) basis for that assurance.=C2=A0 It's a pretty straightf= orward due-diligence question when choosing to use a critical service.

I think I've made clear what sort of eviden= ce is available. You (and the WG in general) will have to make your own jud= gements about whether that evidence is sufficient.

=C2=A0
This article seems to be more or less about routine pruning of the
browser trust anchor lists. As I think I observed previously, large
trust anchor lists are in fact a problem (hence efforts like CT, etc.).
However, this again seems to be the system operating as intended, namely the trust anchor lists being curated.

 If it were 'as intended' it would not threaten havoc.=C2=A0 Trust a= nchor list pruning has not been part of the presented characteristics of th= e PKI model for typical presentations, nor for public operational models us= ing PKI.

Well, I don't know what's = in "typical presentations", but the fact that the trust anchor li= st maintainers can and do remove trust anchors is quite well known and in f= act it's often very public when we choose to distrust a CA.
<= br>
-Ekr


--001a11492ce8e8302d053afb72f9-- From nobody Fri Aug 26 08:51:28 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43C4012D11B for ; Fri, 26 Aug 2016 08:51:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ik3TvrzQMzbF for ; Fri, 26 Aug 2016 08:51:24 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DCBD12D11A for ; Fri, 26 Aug 2016 08:51:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 8FFB53005B6 for ; Fri, 26 Aug 2016 11:51:22 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 5f4NIzorGzdr for ; Fri, 26 Aug 2016 11:51:20 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 4AA743005A7; Fri, 26 Aug 2016 11:51:20 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> Date: Fri, 26 Aug 2016 11:50:04 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> , <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> To: Jon Peterson X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF STIR Mail List , Dave Crocker Subject: Re: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 15:51:26 -0000 Jon: I am not arguing against flexibility. However, I think a national = regulator would have a hard time figuring out what they needed to do if = they wanted to set up a trust anchor for their country code. I think we = should be more clear on that. Russ On Aug 26, 2016, at 11:45 AM, Peterson, Jon = wrote: > Well, the stir-certs document outlines a method for a responsible = provider doing the signing (the "first approach" of Section 3) without = getting into the details of who exactly has been assigned what number. = That's so you have an accountable entity on the hook for any problems. = This reflects the approach that Rich and others in ATIS have been = developing. They intend to make use of the LoA in STIR-certs as well. >=20 > We then have a separate story about number assignment for TNs that we = believe is also salient to the threat model. There are ways that could = work with and without the direct involvement of national regulators. = Some of the more casual approaches to establishing number ownership, = while they don't constitute a definitive chain-of-title as it were, = would still address our threat model I think. >=20 > Ultimately I think we are looking at a situation where we have the = flexibility to experiment with some different trust models, to try = transitional strategies and so on. STIR-certs intentionally creates that = room for the trust story to develop independently from the signaling = defined in rfc4474bis. Personally, if people wanted to deliver keys = through the DNS, I'd still be open to considering it as a model. I just = don't see that model as mutually exclusive with the work we've done in = stir-certs.=20 >=20 > Jon Peterson > Neustar, Inc. >=20 > Sent from my iPad >=20 >> On Aug 26, 2016, at 8:07 AM, Russ Housley = wrote: >>=20 >>=20 >>> On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: >>>=20 >>>> On 8/22/2016 9:14 AM, Brian Rosen wrote: >>>> The root of trust for every country is the regulator. They are the >>>> ultimate source of telephone numbers for that country code >>> ... >>>> Our premise is that issuance of certs follows the delegation = process. >>>> When you delegate, a cert is issued (or the scope of an existing = cert >>>> is changed). >>>>=20 >>>> The goal to to provide authenticated source of calls, but in = reality, >>>> what we need is a way for the authorities to find bad actors. By >>>> making the PKI follow the delegation path, you end up with someone >>>> holding the bag. >>>=20 >>>=20 >>> Brian, >>>=20 >>> The above is a useful start, for talking about what exactly is = needed. >>>=20 >>> The messiness seems to be getting to the granularity of individual = telephone numbers, given that neighboring numbers don't have to be = administered by the same organization. The administrative challenges in = operating a query service with that many entries and that much = variability in administrative responsibility from one entry to the next = is beyond not merely challenging. >>>=20 >>> I believe there is no example of it being done across organizational = boundaries, such as having different parts being administered by = competing telecom providers. Yet that's the requirement STIR is taking = on. >>>=20 >>> What has been occurring to me is that that level of granularity = isn't needed, if we take your above summary seriously. >>>=20 >>> So, don't have an entry per telephone number. >>>=20 >>> Rather, we only need to have things be signed by the responsible = /organization/. And operating at that coarser lever of granularity is = something we /do/ know how to run. (Guess what reference gets inserted = here.) >>>=20 >>> That is, have the responsible provider (or their delegatee) do the = signing and you have an accountable entity on the hook for any problems. >>=20 >> Dave, this is not correct. All of the numbers with a given country = code are under the authority of that national requlator. This regulator = must establish (and publish) one or more trust anchor. If the = certificate chains to that trust anchor, then it is valid. >>=20 >> One can imagine this scaling to a certificate for each phone number, = but that is not the near-term plan. >>=20 >> I have asked the authors to add a section to the stir-certificates = document that explains what a national regulator must do to establish = the trust anchor(s) for their country. Hopefully that yet-to-be-written = text will resolve this concern. >>=20 >> Russ >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 26 09:46:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1319012D142 for ; Fri, 26 Aug 2016 09:45:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yA_XUUpqr-Sb for ; Fri, 26 Aug 2016 09:45:58 -0700 (PDT) Received: from sc9-admin2.yaanatech.net (63-128-177-42-static.dzbja.com [63.128.177.42]) by ietfa.amsl.com (Postfix) with ESMTP id EEB3512D0C9 for ; Fri, 26 Aug 2016 09:45:57 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin2.yaanatech.net (Postfix) with ESMTP id CB6DB15A; Fri, 26 Aug 2016 16:45:57 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id B8CBC58090; Fri, 26 Aug 2016 16:45:36 +0000 (UTC) References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> To: Russ Housley , Jon Peterson From: Tony Rutkowski Organization: Yaana Technologies Message-ID: Date: Fri, 26 Aug 2016 12:45:55 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------6593B00468EEBBAFC002F955" Archived-At: Cc: IETF STIR Mail List , Dave Crocker Subject: Re: [stir] Delegation hierarchy and granularity X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 16:45:59 -0000 This is a multi-part message in MIME format. --------------6593B00468EEBBAFC002F955 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit 1. E.164 provides for an array of different constructs for both geographic areas and global services. Are you circumscribing the specifications here to only geographical areas? What happens for country codes that are shared? 2. The current reference should read: [E.164] Recommendation ITU-T E.164 (11/2010), "The international public telecommunication numbering plan." Amendment 1 (06/2011): "Revised Annex A Clarification and explanation of the structure and function of international ITU-T E.164-numbers." Is there some reason why the most current specification and the amendment are not being referenced? The amendment treats several new number constructs which seem significant. Will there be any mechanism to enhance trust in in the integrity of the numbers used against the provisions of the E.164 and related Recommendations? There are some related international treaty provisions in play here, e.g., PP-2014, Res. 190. Has everyone has actually read E.164? :-) --tony On 2016-08-26 11:50 AM, Russ Housley wrote: > I am not arguing against flexibility. However, I think a national regulator would have a hard time figuring out what they needed to do if they wanted to set up a trust anchor for their country code. I think we should be more clear on that. --------------6593B00468EEBBAFC002F955 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit 1. E.164 provides for an array of different constructs
for both geographic areas and global services. Are
you circumscribing the specifications here to only
geographical areas? What happens for country codes
that are shared?

2. The current reference should read:

[E.164] Recommendation ITU-T E.164 (11/2010), "The international public telecommunication numbering plan." Amendment 1 (06/2011): "Revised Annex A Clarification and explanation of the structure and function of international ITU-T E.164-numbers."

Is there some reason why the most current specification
and the amendment are not being referenced? The
amendment treats several new number constructs
which seem significant.

Will there be any mechanism to enhance trust in
in the integrity of the numbers used against the
provisions of the E.164 and related Recommendations?
There are some related international treaty provisions
in play here, e.g., PP-2014, Res. 190.

Has everyone has actually read E.164? :-)

--tony

On 2016-08-26 11:50 AM, Russ Housley wrote:
I am not arguing against flexibility.  However, I think a national regulator would have a hard time figuring out what they needed to do if they wanted to set up a trust anchor for their country code.  I think we should be more clear on that.

--------------6593B00468EEBBAFC002F955-- From nobody Fri Aug 26 09:54:02 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 167A412D14F for ; Fri, 26 Aug 2016 09:54:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w9IoBKNUZ3_x for ; Fri, 26 Aug 2016 09:53:59 -0700 (PDT) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 697FB12D155 for ; Fri, 26 Aug 2016 09:53:59 -0700 (PDT) Received: by mail-qk0-x230.google.com with SMTP id v123so82256286qkh.2 for ; Fri, 26 Aug 2016 09:53:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4V3Tut7msBZO/xVZg2sm1K7K2KVIyWhP0XrKJjdxFek=; b=CUlYSquLIZwNRBBThGHSU/tx24r70hBYkIUCmOf/z3hLstMck8cOiGz+d6DyPEtAfh aEXTzBOiofeJR5R2N/2Ly6QT6iKSpCxf+Z1mPWogpSAbBIcB0fSSf7PyqISoLEfcxFGB 2W14BqVwTBajyy860nre+pAxTucxScqWICHSeSFbkSr7p9SkYr8uc6qBKacHUxUmeN+W Bd7IyDmC++bETJoSe8Sf3EouSMrPy3zoijm21opa5cEozSWH/B82+hdvpHpUgnVIxECQ Ebhqlbm8s0/ywnY3q17kQ+CbPB3p9lDLDHgYxJxzPNwxOJ01yHQEM9fvGOaXZqRNuT8d W6kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4V3Tut7msBZO/xVZg2sm1K7K2KVIyWhP0XrKJjdxFek=; b=emar6RNAoDz/Ol5vTAfyVLjOyxiOZ00lg0tSdow7IXTSTM3IH3yJMKno5PNU1BVjEv lRTk1RG8arWsSBB1/MH/zbaL2cnwosoBWfjporruI1qmwLcBoJstTOj/2Pw9gQwMVzjK zYxgEEy4qd5eEZHjI2R1K9LyGJQqNv+m676jmXvrR3oNm0rINTAEOrL3+wzuGqcSTQPy gXAV4yq5N/xCzOgE6kkWluS4a2XGnOt+yHrKNG2e4gh1+jUKIpEVgCzfVrQVpyVAPGQH 4Mmw3jOJzANYZO0jtrjiiKGc+gyWbyCUGR2XD8pXDpNpTPVuuLR5P9R/NTf/tk7Bbq12 Ecrg== X-Gm-Message-State: AE9vXwMrbA4VgiIeadR29BoltCykChebKQnLbz4NYH7kHGPV7vR4SPwcmXogyfpQATL5ig== X-Received: by 10.55.74.14 with SMTP id x14mr4338553qka.102.1472230438458; Fri, 26 Aug 2016 09:53:58 -0700 (PDT) Received: from [10.33.192.33] ([156.154.81.54]) by smtp.gmail.com with ESMTPSA id v68sm10829659qkd.9.2016.08.26.09.53.57 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 26 Aug 2016 09:53:57 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Brian Rosen In-Reply-To: Date: Fri, 26 Aug 2016 12:53:52 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <455409D9-C31B-4D55-9A93-445FA9A0EB31@brianrosen.net> References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> To: tony@yaanatech.com X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Russ Housley , Dave Crocker , Jon Peterson Subject: Re: [stir] Delegation hierarchy and granularity X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 16:54:01 -0000 Just as there is no golden root, there will be multiple roots for shared = country codes, but there are a small number of these, and it=92s easy to = determine what the right thing is for anyone who wants to do it. There are no mechanisms to enhance trust in the integrity of numbers. = There is just a mechanism to follow delegation of telephone numbers as = they get delegated, and re-delegaed down towards the consumer/enterprise = that is assigned them. There is no assumption that any regulator will do anything, but if they = don=92t then calls from that country may not be treated well by the = recipient. Right now, I think the only assumptions we make about E.164 is that = telephone numbers have a maximum number of digits, and the first few = digits give us the information we need to determine the trust anchor. Brian > On Aug 26, 2016, at 12:45 PM, Tony Rutkowski = wrote: >=20 > 1. E.164 provides for an array of different constructs > for both geographic areas and global services. Are > you circumscribing the specifications here to only > geographical areas? What happens for country codes > that are shared? >=20 > 2. The current reference should read: >=20 > [E.164] Recommendation ITU-T E.164 (11/2010), "The international = public telecommunication numbering plan." Amendment 1 (06/2011): = "Revised Annex A =96 Clarification and explanation of the structure and = function of international ITU-T E.164-numbers." >=20 > Is there some reason why the most current specification > and the amendment are not being referenced? The > amendment treats several new number constructs > which seem significant. >=20 > Will there be any mechanism to enhance trust in > in the integrity of the numbers used against the > provisions of the E.164 and related Recommendations? > There are some related international treaty provisions > in play here, e.g., PP-2014, Res. 190. >=20 > Has everyone has actually read E.164? :-) >=20 > --tony >=20 > On 2016-08-26 11:50 AM, Russ Housley wrote: >> I am not arguing against flexibility. However, I think a national = regulator would have a hard time figuring out what they needed to do if = they wanted to set up a trust anchor for their country code. I think we = should be more clear on that. >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Aug 26 10:29:47 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9CF212D158 for ; Fri, 26 Aug 2016 10:29:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-hhBS1nzZRh for ; Fri, 26 Aug 2016 10:29:42 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 3E1EF12D16D for ; Fri, 26 Aug 2016 10:29:42 -0700 (PDT) Received: (qmail 1479 invoked by uid 0); 26 Aug 2016 17:29:42 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by qproxy2.mail.unifiedlayer.com with SMTP; 26 Aug 2016 17:29:42 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by CMOut01 with id btQe1t00Q1MNPNq01tQhbr; Fri, 26 Aug 2016 11:24:41 -0600 X-Authority-Analysis: v=2.1 cv=SeZkKJhu c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=etTHQkYnwnYA:10 a=7z1cN_iqozsA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=tGX7uwomAAAA:8 a=hGBaWAWWAAAA:8 a=b8OvNEjoAAAA:8 a=M58UtQ-RgtWD72PSeyUA:9 a=XtsCpJtML-uYUKM3:21 a=GFxTVlQyct7bMc2e:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=ZFOOzkjxzLGrPE5HuMia:22 a=Q-ofuW86YyylptHqTH-7:22 a=xfJ8-ueq0pyqlCF7aVox:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=jKTHzViQI1gtM21Ua9sjrLSJwmFRuH0h+wKDRGNsys8=; b=fH+0oQ8FeHg/nldKrbO5VCbZlI UC7lIInSEAS7Fyavab9GW2aMw2kQgAMeE+KDi+qA7a15IF1nG+o/gJx/ue+X4Qp5RfUnoY0NHUYCA 7/ozAW+3xno5VwC8F7yI1s1L2; Received: from pool-100-36-40-228.washdc.fios.verizon.net ([100.36.40.228]:50219 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bdKrv-0004rA-6m; Fri, 26 Aug 2016 11:24:39 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 26 Aug 2016 13:24:37 -0400 From: Richard Shockey To: Russ Housley , Jon Peterson Message-ID: Thread-Topic: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.40.228 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.40.228 X-Exim-ID: 1bdKrv-0004rA-6m X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-40-228.washdc.fios.verizon.net ([192.168.1.152]) [100.36.40.228]:50219 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF STIR Mail List , Dave Crocker Subject: Re: [stir] Delegation hierarchy and granularity (was: Re: Key query/validation) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 17:29:45 -0000 I totally agree with Russ=E2=80=A6 I think it would be reasonable and appropriate to insert some text in the c= ertificate document that says=20 =E2=80=9CNational Regulatory Authorities that have plenary and sovereign responsi= bilities for their portions of the global E.164 plan should take appropriate= steps to establish trust anchors consistent with applicable laws and regula= tions=E2=80=9D blah blah blah. For the time being phone numbers ARE NOT DOMAIN NAMES. Over time they may= ..may take on that function and role and certainly in the US there is an on= going discussion of National Number Portability that would remove the geogra= phic distinction in the US portions of the NANP and grant =E2=80=9Cone number for = life=E2=80=9D like functions. For the time being, this =E2=80=9Cflexibility=E2=80=9D in the trust model is a fine aca= demic discussion but frankly has no place in getting these documents complet= ed. I do not want these documents to confuse NRA=E2=80=99s with a bedtime =E2=80=9Cstor= y=E2=80=9D of what might be or could be only what the protocols can do right now.= =20 Jon .. please please don=E2=80=99t even start a discussion of number assignment. = For those of you that want to have that discussion you can go over to the M= ODERN list and perhaps listen to my epic rant at the MODERN WG meeting in Be= rlin.=20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 On 8/26/16, 11:50 AM, "stir on behalf of Russ Housley" wrote: Jon: =20 I am not arguing against flexibility. However, I think a national regu= lator would have a hard time figuring out what they needed to do if they wan= ted to set up a trust anchor for their country code. I think we should be m= ore clear on that. =20 Russ =20 =20 On Aug 26, 2016, at 11:45 AM, Peterson, Jon = wrote: =20 > Well, the stir-certs document outlines a method for a responsible pro= vider doing the signing (the "first approach" of Section 3) without getting = into the details of who exactly has been assigned what number. That's so you= have an accountable entity on the hook for any problems. This reflects the = approach that Rich and others in ATIS have been developing. They intend to m= ake use of the LoA in STIR-certs as well. >=20 > We then have a separate story about number assignment for TNs that we= believe is also salient to the threat model. There are ways that could work= with and without the direct involvement of national regulators. Some of the= more casual approaches to establishing number ownership, while they don't c= onstitute a definitive chain-of-title as it were, would still address our th= reat model I think. >=20 > Ultimately I think we are looking at a situation where we have the fl= exibility to experiment with some different trust models, to try transitiona= l strategies and so on. STIR-certs intentionally creates that room for the t= rust story to develop independently from the signaling defined in rfc4474bis= . Personally, if people wanted to deliver keys through the DNS, I'd still be= open to considering it as a model. I just don't see that model as mutually = exclusive with the work we've done in stir-certs.=20 >=20 > Jon Peterson > Neustar, Inc. >=20 > Sent from my iPad >=20 >> On Aug 26, 2016, at 8:07 AM, Russ Housley wro= te: >>=20 >>=20 >>> On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: >>>=20 >>>> On 8/22/2016 9:14 AM, Brian Rosen wrote: >>>> The root of trust for every country is the regulator. They are th= e >>>> ultimate source of telephone numbers for that country code >>> ... >>>> Our premise is that issuance of certs follows the delegation proce= ss. >>>> When you delegate, a cert is issued (or the scope of an existing c= ert >>>> is changed). >>>>=20 >>>> The goal to to provide authenticated source of calls, but in reali= ty, >>>> what we need is a way for the authorities to find bad actors. By >>>> making the PKI follow the delegation path, you end up with someone >>>> holding the bag. >>>=20 >>>=20 >>> Brian, >>>=20 >>> The above is a useful start, for talking about what exactly is need= ed. >>>=20 >>> The messiness seems to be getting to the granularity of individual = telephone numbers, given that neighboring numbers don't have to be administe= red by the same organization. The administrative challenges in operating a = query service with that many entries and that much variability in administra= tive responsibility from one entry to the next is beyond not merely challeng= ing. >>>=20 >>> I believe there is no example of it being done across organizationa= l boundaries, such as having different parts being administered by competing= telecom providers. Yet that's the requirement STIR is taking on. >>>=20 >>> What has been occurring to me is that that level of granularity isn= 't needed, if we take your above summary seriously. >>>=20 >>> So, don't have an entry per telephone number. >>>=20 >>> Rather, we only need to have things be signed by the responsible /o= rganization/. And operating at that coarser lever of granularity is somethi= ng we /do/ know how to run. (Guess what reference gets inserted here.) >>>=20 >>> That is, have the responsible provider (or their delegatee) do the = signing and you have an accountable entity on the hook for any problems. >>=20 >> Dave, this is not correct. All of the numbers with a given country = code are under the authority of that national requlator. This regulator mus= t establish (and publish) one or more trust anchor. If the certificate chai= ns to that trust anchor, then it is valid. >>=20 >> One can imagine this scaling to a certificate for each phone number,= but that is not the near-term plan. >>=20 >> I have asked the authors to add a section to the stir-certificates d= ocument that explains what a national regulator must do to establish the tru= st anchor(s) for their country. Hopefully that yet-to-be-written text will = resolve this concern. >>=20 >> Russ >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Fri Aug 26 11:09:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2025C12D53D for ; Fri, 26 Aug 2016 11:09:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ul3LsJY9hQ10 for ; Fri, 26 Aug 2016 11:08:59 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id 153AF12D519 for ; Fri, 26 Aug 2016 11:08:59 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id B65C2156; Fri, 26 Aug 2016 18:08:58 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id 9085158090; Fri, 26 Aug 2016 18:08:37 +0000 (UTC) References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> <5D30B789-87B0-41A3-A1A7-570DED9A05BD@neustar.biz> To: Richard Shockey , Russ Housley , Jon Peterson From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <391346ad-f43f-a548-4290-73d8f251270e@yaanatech.com> Date: Fri, 26 Aug 2016 14:08:57 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------715FFB4EA9246995E6A20272" Archived-At: Cc: IETF STIR Mail List , Dave Crocker Subject: Re: [stir] Delegation hierarchy and granularity X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 18:09:00 -0000 This is a multi-part message in MIME format. --------------715FFB4EA9246995E6A20272 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Rich, Suggest you avoid abstruse pseudo legal terms found in your proffered sentence that are not found in E.164 and related specifications. It's also desirable to keep it generic, simple, and flexible. Perhaps something like: "Assignees of E.164 numbering resources should take appropriate steps to establish trust anchors." --tony On 2016-08-26 1:24 PM, Richard Shockey wrote: > “National Regulatory Authorities that have plenary and sovereign responsibilities for their portions of the global E.164 plan should take appropriate steps to establish trust anchors consistent with applicable laws and regulations” blah blah blah. --------------715FFB4EA9246995E6A20272 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit Hi Rich,

Suggest you avoid abstruse pseudo legal terms
found in your proffered sentence that are not found
in E.164 and related specifications.   It's also desirable
to keep it generic, simple, and flexible.  Perhaps
something like:

"Assignees of E.164 numbering resources should
take appropriate steps to establish trust anchors."

--tony

On 2016-08-26 1:24 PM, Richard Shockey wrote:
“National Regulatory Authorities that have plenary and sovereign responsibilities for their portions of the global E.164 plan should take appropriate steps to establish trust anchors consistent with applicable laws and regulations”  blah blah blah.

--------------715FFB4EA9246995E6A20272-- From nobody Fri Aug 26 20:38:48 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A63612D5AD for ; Fri, 26 Aug 2016 20:38:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id evsef597TJyH for ; Fri, 26 Aug 2016 20:38:46 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E79612D0DB for ; Fri, 26 Aug 2016 20:38:46 -0700 (PDT) Received: from [172.17.219.44] ([12.219.197.18]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7R3cvgO026043 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 26 Aug 2016 20:38:57 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472269137; bh=wCHcTXpQw8mPZyJQW1oR+rtFWDV98T3cWfU+PJt/3jA=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=OXgder+hU0axSEy+PJvLPpBoJym16qN5JnTtymbkS8ClKCi1qi/ZSMvPobGyqnaSi oAaz9N6WclnLO5LWQqN7dQAQ6zqcW7j8LkPQJ1l3ZxiQVieDAW7AHiIsY/Ua6C+Usz lswZOQVuRNC7wG4XhZtfYLp2fz/ZjVlCsrDgn/Jk= To: Russ Housley References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <4f8ce9b7-ce52-8b56-3d38-cc3c4b5d4197@dcrocker.net> Date: Fri, 26 Aug 2016 20:38:22 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Delegation hierarchy and granularity X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Aug 2016 03:38:47 -0000 On 8/26/2016 8:07 AM, Russ Housley wrote: > On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: ... >> The messiness seems to be getting to the granularity of individual >> telephone numbers, given that neighboring numbers don't have to be >> administered by the same organization. The administrative >> challenges in operating a query service with that many entries and >> that much variability in administrative responsibility from one >> entry to the next is beyond not merely challenging. >> >> I believe there is no example of it being done across >> organizational boundaries, such as having different parts being >> administered by competing telecom providers. Yet that's the >> requirement STIR is taking on. >> >> What has been occurring to me is that that level of granularity >> isn't needed, if we take your above summary seriously. >> >> So, don't have an entry per telephone number. >> >> Rather, we only need to have things be signed by the responsible >> /organization/. And operating at that coarser lever of granularity >> is something we /do/ know how to run. (Guess what reference gets >> inserted here.) >> >> That is, have the responsible provider (or their delegatee) do the >> signing and you have an accountable entity on the hook for any >> problems. > > Dave, this is not correct. Russ, What, exactly, did I say that was incorrect? From your note I cannot tell. Please note that my point was not about the nature of hierarchies with a trust chain, but per-number administration at the other end of the hierarchy and a query service that has a different provider responsible for each number in a sequence. (cf, number portability with many possible providers.) Again, my comment was about the challenge of operating a query service for telephone numbers that has to support that level of per-number administrative variability. > One can imagine this scaling to a certificate for each phone number, > but that is not the near-term plan. There is no plan Russ. Not within the IETF. There are informal comments different folk have posted, but there is no document for a 'plan' and certainly nothing that distinguishes near-term from long-term, nevermind an explanation for how they are different and how the transition will be achieved. Please do provide a pointer to the specification for this plan, along with the rest of the necessary details that will permit IETF evaluation of operational feasibility. > I have asked the authors to add a section to the stir-certificates > document that explains what a national regulator must do to establish > the trust anchor(s) for their country. Hopefully that > yet-to-be-written text will resolve this concern. So, no single trust anchor for this service. Instead, every validator is going to be required to maintain an up-to-date list of keys for /all/ of the national trust anchors? And this is going to be kep up to date safely exactly how? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 27 07:34:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CC3F12D5A8 for ; Sat, 27 Aug 2016 07:34:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cnuzmoMMch6H for ; Sat, 27 Aug 2016 07:34:23 -0700 (PDT) Received: from sc9-admin1.yaanatech.net (63-128-177-34-static.dzbja.com [63.128.177.34]) by ietfa.amsl.com (Postfix) with ESMTP id 8EE0712D5A3 for ; Sat, 27 Aug 2016 07:34:23 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin1.yaanatech.net (Postfix) with ESMTP id F0FE414F; Sat, 27 Aug 2016 14:34:22 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id 2ED1658090; Sat, 27 Aug 2016 14:34:00 +0000 (UTC) References: <560b7bb0-ff3e-8c0f-65ff-a0891f2f29ee@dcrocker.net> <4C01118F-6A97-4888-9DE5-405D3A9A6A8D@vigilsec.com> <4f8ce9b7-ce52-8b56-3d38-cc3c4b5d4197@dcrocker.net> To: dcrocker@bbiw.net, Russ Housley From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <9720eba9-ff2a-bfac-adfb-050a9784ee32@yaanatech.com> Date: Sat, 27 Aug 2016 10:34:21 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <4f8ce9b7-ce52-8b56-3d38-cc3c4b5d4197@dcrocker.net> Content-Type: multipart/alternative; boundary="------------D9D7C495E62C5668DC06C215" Archived-At: Cc: IETF STIR Mail List , Olivier Dubuisson Subject: Re: [stir] Delegation hierarchy and granularity X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Aug 2016 14:34:25 -0000 This is a multi-part message in MIME format. --------------D9D7C495E62C5668DC06C215 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Russ et al., Dave raises some serious concerns. Indeed, a careful reading of some of the stir texts, especially draft-ietf-stir-certificates-07 raises fundamental problems. He has done everyone a service here. The trust anchor for E.164 telephone numbers is the ITU-T Telecommunication Standardization Bureau which allocates and assigns those numbers and blocks to a variety of parties, including designated Administration authorities pursuant to the E.164 sub-parts. Those assignees can then establish sub-allocation/assignment processes within a variety of legal/regulatory constraints. There are treaty provisions that have baked this trust construct into public international law for decades. The construct is also effectively a domain name system that was indeed a model for the DARPA Internet DNS, and was subsequently layered onto DNS resolvers via ENUM specifications and implementations. How can one even create a specification like this and not cite E.164 (except amusingly in the syntax expressions where you have to)? The assertion in the introduction of draft-ietf-stir- certificates-07, that "telephone numbers have long been a part of the X.509 standard" is flat wrong, if not bizarre. (This is the case both for Rec. ITU-T X.509 as well as the IETF's derivative version, RFC5280.] Furthermore, pause should be given to the assertions that > this document provides > ways to determine authority more aligned with telephone network > requirements, including extending X.509 with a Telephone Number > Authorization List which binds certificates to authority for > particular telephone numbers, or potentially telephone number blocks > or ranges. and > the credential system described in this document could be useful for > other protocols that want to make use of certificates to prove > authority over telephone numbers on the Internet "Prove authority?" How about "assert." The document provides basically four different schemes using certs - some of which have rather low levels of assurance. The casual constructs here and failure to tie anything to E.164 limits the utility and creates potential problems in the future. It's not clear why the certificates here make use of just PKIX and an IANA OID leaf. That seems rather constrained from an antitrust standpoint, and unlikely to fly globally. There are many inconsistencies threaded through this and related documents with respect to X.509 references, the use of OIDs, and related citations such as the mystifying one citing ISI as responsible for X.680 - X.683. --tony On 2016-08-26 11:38 PM, Dave Crocker wrote: > On 8/26/2016 8:07 AM, Russ Housley wrote: >> On Aug 26, 2016, at 9:40 AM, Dave Crocker wrote: > ... >>> The messiness seems to be getting to the granularity of individual >>> telephone numbers, given that neighboring numbers don't have to be >>> administered by the same organization. The administrative >>> challenges in operating a query service with that many entries and >>> that much variability in administrative responsibility from one >>> entry to the next is beyond not merely challenging. >>> >>> I believe there is no example of it being done across >>> organizational boundaries, such as having different parts being >>> administered by competing telecom providers. Yet that's the >>> requirement STIR is taking on. >>> >>> What has been occurring to me is that that level of granularity >>> isn't needed, if we take your above summary seriously. >>> >>> So, don't have an entry per telephone number. >>> >>> Rather, we only need to have things be signed by the responsible >>> /organization/. And operating at that coarser lever of granularity >>> is something we /do/ know how to run. (Guess what reference gets >>> inserted here.) >>> >>> That is, have the responsible provider (or their delegatee) do the >>> signing and you have an accountable entity on the hook for any >>> problems. >> >> Dave, this is not correct. > > > Russ, > > What, exactly, did I say that was incorrect? From your note I cannot > tell. > > Please note that my point was not about the nature of hierarchies with > a trust chain, but per-number administration at the other end of the > hierarchy and a query service that has a different provider > responsible for each number in a sequence. (cf, number portability > with many possible providers.) > > Again, my comment was about the challenge of operating a query service > for telephone numbers that has to support that level of per-number > administrative variability. > > >> One can imagine this scaling to a certificate for each phone number, >> but that is not the near-term plan. > > There is no plan Russ. Not within the IETF. There are informal > comments different folk have posted, but there is no document for a > 'plan' and certainly nothing that distinguishes near-term from > long-term, nevermind an explanation for how they are different and how > the transition will be achieved. > > Please do provide a pointer to the specification for this plan, along > with the rest of the necessary details that will permit IETF > evaluation of operational feasibility. > > >> I have asked the authors to add a section to the stir-certificates >> document that explains what a national regulator must do to establish >> the trust anchor(s) for their country. Hopefully that >> yet-to-be-written text will resolve this concern. > > So, no single trust anchor for this service. Instead, every validator > is going to be required to maintain an up-to-date list of keys for > /all/ of the national trust anchors? And this is going to be kep up > to date safely exactly how? > > d/ --------------D9D7C495E62C5668DC06C215 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Russ et al.,

Dave raises some serious concerns. Indeed,
a careful reading of some of the stir texts,
especially draft-ietf-stir-certificates-07 raises
fundamental problems. He has done everyone
a service here.

The trust anchor for E.164 telephone numbers is
the ITU-T Telecommunication Standardization Bureau
which allocates and assigns those numbers and blocks
to a variety of parties, including designated Administration
authorities pursuant to the E.164 sub-parts. Those
assignees can then establish sub-allocation/assignment
processes within a variety of legal/regulatory constraints.
There are treaty provisions that have baked this trust
construct into public international law for decades.

The construct is also effectively a domain name system
that was indeed a model for the DARPA Internet DNS,
and was subsequently layered onto DNS resolvers via
ENUM specifications and implementations.

How can one even create a specification like this and
not cite E.164 (except amusingly in the syntax
expressions where you have to)?

The assertion in the introduction of draft-ietf-stir-
certificates-07, that "telephone numbers have long
been a part of the X.509 standard" is flat wrong, if
not bizarre. (This is the case both for Rec. ITU-T X.509
as well as the IETF's derivative version, RFC5280.]
Furthermore, pause should be given to the assertions that
this document provides
ways to determine authority more aligned with telephone network
requirements, including extending X.509 with a Telephone Number
Authorization List which binds certificates to authority for
particular telephone numbers, or potentially telephone number blocks
or ranges.
and
the credential system described in this document could be useful for
other protocols that want to make use of certificates to prove
authority over telephone numbers on the Internet
"Prove authority?" How about "assert." The
document provides basically four different
schemes using certs - some of which have
rather low levels of assurance. The casual
constructs here and failure to tie anything to
E.164 limits the utility and creates potential
problems in the future.

It's not clear why the certificates here make
use of just PKIX and an IANA OID leaf. That
seems rather constrained from an antitrust
standpoint, and unlikely to fly globally.

There are many inconsistencies threaded through
this and related documents with respect to X.509
references, the use of OIDs, and related citations
such as the mystifying one citing ISI as responsible
for X.680 - X.683.

--tony


On 2016-08-26 11:38 PM, Dave Crocker wrote:
On 8/26/2016 8:07 AM, Russ Housley wrote:
On Aug 26, 2016, at 9:40 AM, Dave Crocker <dhc@dcrocker.net> wrote:
...
The messiness seems to be getting to the granularity of individual
telephone numbers, given that neighboring numbers don't have to be
administered by the same organization. The administrative
challenges in operating a query service with that many entries and
that much variability in administrative responsibility from one
entry to the next is beyond not merely challenging.

I believe there is no example of it being done across
organizational boundaries, such as having different parts being
administered by competing telecom providers. Yet that's the
requirement STIR is taking on.

What has been occurring to me is that that level of granularity
isn't needed, if we take your above summary seriously.

So, don't have an entry per telephone number.

Rather, we only need to have things be signed by the responsible
/organization/. And operating at that coarser lever of granularity
is something we /do/ know how to run. (Guess what reference gets
inserted here.)

That is, have the responsible provider (or their delegatee) do the
signing and you have an accountable entity on the hook for any
problems.

Dave, this is not correct.


Russ,

What, exactly, did I say that was incorrect? From your note I cannot tell.

Please note that my point was not about the nature of hierarchies with a trust chain, but per-number administration at the other end of the hierarchy and a query service that has a different provider responsible for each number in a sequence. (cf, number portability with many possible providers.)

Again, my comment was about the challenge of operating a query service for telephone numbers that has to support that level of per-number administrative variability.


One can imagine this scaling to a certificate for each phone number,
but that is not the near-term plan.

There is no plan Russ. Not within the IETF. There are informal comments different folk have posted, but there is no document for a 'plan' and certainly nothing that distinguishes near-term from long-term, nevermind an explanation for how they are different and how the transition will be achieved.

Please do provide a pointer to the specification for this plan, along with the rest of the necessary details that will permit IETF evaluation of operational feasibility.


I have asked the authors to add a section to the stir-certificates
document that explains what a national regulator must do to establish
the trust anchor(s) for their country. Hopefully that
yet-to-be-written text will resolve this concern.

So, no single trust anchor for this service. Instead, every validator is going to be required to maintain an up-to-date list of keys for /all/ of the national trust anchors? And this is going to be kep up to date safely exactly how?

d/

--------------D9D7C495E62C5668DC06C215-- From nobody Sat Aug 27 14:40:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF98D12B02F for ; Sat, 27 Aug 2016 14:40:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ewDicze4JAF3 for ; Sat, 27 Aug 2016 14:40:31 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A257912B069 for ; Sat, 27 Aug 2016 14:40:30 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7RLefcW028897 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 27 Aug 2016 14:40:41 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472334042; bh=X3XUH9/nDCl2zVdmVtNTDxG/aKm7zrErQUe4TTHMa1A=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=BTtBDF12QeJFpypnhra86qZY9VCzEpIfhh8UdK/lsWrotoP/U6bcLGzc/NZvMHYjC fb4zHI1RJDVwwQxF5uNe9+4aurOYfKbd/MA6427cZhGdKO/QBiLp6cuwdMmuMsMaOx Uqbk8MqxUgk41EDpmEBnoYW5WLqtCt0skJylQKF8= To: Chris Wendt References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> Date: Sat, 27 Aug 2016 14:40:03 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Aug 2016 21:40:34 -0000 Chris, Thanks for the followup. Pruned responses to responses, below... \ On 8/22/2016 10:58 AM, Chris Wendt wrote: >> Detailed Comments ----------------- >>> STIR >>> C. Wendt Internet-Draft >>> Comcast Intended status: Standards Track >>> J. Peterson Expires: January 23, 2017 >>> Neustar Inc. July 22, 2016 >>> >>> >>> Persona Assertion Token draft-ietf-stir-passport-05 >>> >>> Abstract ... >> Is the timestamp the basis of claiming non-repudiation? > > Partially, depending on your interpretation of how non-repudiation is > achieved. The digital signature based on a certificate is the > non-repudiation of the original assertion and signing of the token. That seems to equate authentication with non-reputation of originator. But they aren't the same. http://security.stackexchange.com/questions/6730/what-is-the-difference-between-authenticity-and-non-repudiation Worse, the opening sentence above, means that there is no way to know what the term applies to or how to validate its use. At the least, a technical specification should use terms of art precisely and should provide enough detail so there is reliable, cross-reader understanding of its meaning and appropriateness in the document. When the term refers to something that is foundational-but-partial, such as working 'in support of' something else that is detailed outside of the specification or hasn't even been detailed anywhere, then there needs to be text that explains the basis of that support. For example, authentication of an identifier used in an email 'supports' the development of accurate and reliable reputation assessment for mail associated with the identifier. A specification for authentication that makes this assertion but does not specify the detail for achieving that use needs to explain the claim, such as: It does that by ensuring that the identifier's use is only by authorized entities, thereby eliminating the reputation analysis 'noise' from unauthorized use of the identifier in messages. The current spec needs to similarly explain/justify a claim of use for non-reputation, but with something more substantive and reliable than "depending on your interpretation". To the extent that it's useful in some cases of non-repudiation and not others, there should be an explanation of which cases it helps and how. > The timestamp and including the destination identity adds the ability > to further validate that there wasn’t someone illegitimate that > simply replayed the sending of the token. My understanding is that a replay attack is quite different from non-repudiation protection. So the text should not conflate the two. >>> repudiation the sender of and authorization to send information >>> related to the originator of personal communications. A >> >> 'info related to'... what does this mean? > > Yes this was a bit too broad and the abstract text wasn’t updated > when the scope was reduced. > > replaced with: 'non-repudiation the author of the token, their > authority to author the token and, minimally, the asserted > originating identity or persona contained within the token > corresponding specifically to the originator of personal > communications' My guess is that all of the above fall under authentication, not non-repuduation. If my guess is wrong, it really would help to see a careful explanation of how it is non-repudiation rather than authentication. >>> This document defines a common method for creating and validating >>> a >> >> [common] delete > > fixed > >> >>> token that cryptographically verifies an originating identity, >>> or more generally a URI or application specific identity string >> >> 'identity string'? what does this mean? >> >> 'app string id'? what does this mean? > > Removed and replaced with 'URI or telephone number' So this seems like a good place to raise this basic question: I thought all of the strings that were to be used at 'identity' strings started as URIs, albeit with some variations on the type of URI. Also, there is the continuing point that has been repeatedly stressed that STIR's current goal is telephone numbers, not other forms of addressing. >>> representing the originator of personal communications. Through >>> extended profiles other information relevant to the personal >>> communications can also be attached to the token. The primary >>> goal of PASSporT is to provide a common framework for signing >>> persona >> >> What is a 'persona'? Where is this construct introduced or cited >> and explained? > > ‘persona’ replaced with 'originating identity' > >> >> 'profiles'? Where is this construct introduced or cited and >> explained? > > replaced with 'Through extensions defined in this document' Normally, when extensibility is permitted, a base document like this defines the extensibility mechanism and might or might not /also/ give an initial set of extensions. (In which case, these really are 'options' and not 'extensions', but yes, that's just quibbling...) In any event, the reference should point to where the extensions or extensibility mechanism are specified. >>> however this is intentionally out of scope for this document. >>> >>> Note: As of the authoring of this document, >>> [I-D.ietf-stir-rfc4474bis] provides details of how to use >>> PASSporT within SIP signaling for the signing and verification of >>> telephone numbers. >> >> remove Note. Or make it a note to RFC Editor to remove it, or >> rephrase so it's useful 10 years from now. > > Would probably like a reference here, don’t want to just remove. Why? It's an uplink reference. This is a component system used by rfc4474bism. So the uplink confuses the relationship and messes with the clean, subsystem interface. >>> 2. Token Overview >>> >>> Tokens are a convenient way of encapsulating information with >> >> Why? What are the alternatives? Why is this the starting point? >> >> >>> associated digital signatures. They are used in many >>> applications >> >> Such as? >> >> Anyhow, this section seems to take the construct of 'token' as >> being an established term of art. It isn't. Or, at least, I've no >> idea what is meant here that distinguishes a token from anything >> else, such as other forms of encapsulation. Say/cite what a token >> is, if it is such a distinctive thing. Say/cite how it differs >> from alternatives, if its superiority is going to be touted. >> >> >>> that require authentication, authorization, encryption, non- >>> repudiation and other use cases. JSON Web Token (JWT) [RFC7519] >>> and JSON Web Signature (JWS) [RFC7515] are designed to provide a >>> compact form for many of these purposes and define a specific >>> method and syntax for signing a specific set of information or >>> "claims" within the token and therefore providing an extensible >>> set of claims. Additionally, JWS provides extensible mechanisms >>> for specifying the method and cryptographic algorithms used for >>> the associated digital signatures. >> >> Note that there is nothing in the above text that actually explains >> what a token is or how it differs from things that aren't tokens. > > I would challenge the fact that ‘token’ is a term of art, but i > suppose maybe it depends on what crowd you run with. In either case, > I defined it as a canonical string object at the beginning of the > document. If it is not a term of art, then what does it mean and why is it used? That is, it is used here as if it has distinctive meaning -- even at the level of being part of a section title! -- but the meaning isn't provided. >>> 3.1.3. "x5u" (X.509 URL) Header Parameter >>> >>> As defined in JWS, the "x5u" header parameter is used to provide >>> a URI [RFC3986] referring to the resource for the X.509 public >>> key certificate or certificate chain [RFC5280] corresponding to >>> the key >> >> So this service uses a classic X.509 authentication hierarchy? >> That's a key design point, only mentioned in a third-level >> section. > > clarified this in overview > >> >> >>> used to digitally sign the JWS. Note: The definition of what the >>> URI represents in terms of the actor serving the X.509 public key >>> is out >> >> 'actor serving the X.509 public key' ? what does that mean? > > removed > >> >>> of scope of this document. However, generally this would >>> correspond to an HTTPS or DNSSEC resource with the guidance that >>> it MUST be a >> >> [a] remove > > fixed > >> >>> TLS protected, per JWS spec. >> >> This /object/ specification (that is transport independent) >> dictates /transport/ security??? This is probably wrong, but at >> least needs careful explanation. >> > > This is mostly a comment towards security consideration > recommendation. I could remove the comment if it’s bothering folks. For specification of a discrete component like this, which should be entirely independent of lower-level transport, etc. issues, I think the legitimate concern is noting that nature of sensitive information is carries and the need to protect that information 'appropriate', but to treat or state that the details of that protection are outside the scope of this specification. >>> 3.2.1. JWT defined claims >> >> When something like this is imported from another spec, there needs >> to be a precise pointer to the specific part of the spec defining >> it. > > This was the text provided by Ted based on discussion in Berlin, but > beyond that i’m not seeing what isn’t specific enough. iat - rfc7519, section 4.1.6, as I noted. etc. In other words, try to never require the reader to search around an entire document for the information being imported or referenced. >>> 3.2.2.1. Originating and Destination Identity Claims >>> >>> Baseline PASSporT defines claims that convey the identity of the >> >> "Baseline PASSporT defines claims" ? First reference in a >> 4th-level section??? > > Removed baseline > >> >> >>> origination and destination of personal communications. There >>> are >> >> 'personal'? so this can't be used by and between companies? >> Really, there is nothing about any of this that pertains to the >> type of users or even the content of the communication. > > defined ‘personal communications' > >> >> What is the exact definition or origination and destination? For >> example, there is an important distinction between the person >> making a call vs. the device they are using, versus the provider >> they are going through. Which is meant here and how is the reader >> to know? (cf, call for a terminology section.) > > we don’t want to make the distinction here, it’s only about the > identity, URI or TN. whether device or network. we don’t want to > predetermine what the end to end architecture is, this is protocol > only. origination and destinction are extremely important terms of art for STIR and for this specification. if they have no meaning, don't use them. if they have to be used, they need to be carefully defined, either here or in a cited document. >>> two claims that are required for PASSporT, the "orig" and "dest" >>> claims. Both "orig" and "dest" should have values that are JSON >>> objects that include identities represented by key value pairs, >>> where >> >> 'key value pairs' aren't 'claims'? >> >> should and not must? why? >> > > changed to MUST and clarified > >> >>> the key represents an identity type and the value is the >>> identity string. Currently, these identities can be represented >>> as either >> >> So, there is expectation of other types? There needs to be a >> pointer to an IANA registry. > > we do have IANA request for these types, will add text once i figure > out how to point to that > >> >> >>> telephone numbers or Uniform Resource Indicators (URIs). The >>> definition of how telephone numbers or URIs and examples are >>> provided below. >>> >>> The "orig" JSON object MUST only have one key value pair >>> representing the asserted identity of any type (currently either >>> "tn" or "uri") of the originator of the personal communications >>> signaling. >>> >>> The "dest" JSON object MUST have at least have one key value >>> pair, but could have multiple identity types (i.e. "tn" and/or >>> "uri") but only one of each. Additionaly, in the case of "dest" >>> only, the identity type key value MUST be an array signaled by >>> standard JSON brackets, even when there is a single identity >>> value in the identity type key value. >>> >>> 3.2.2.1.1. "tn" - Telephone Number identity >> >> A document that uses five-levels of section numbering warrants >> reconsideration of its structure. > > fair point, looking for suggestion My personal style is to try to have at most 3 levels, with the table of contents showing only the first two. OVerall it seems to be cleaner, but yeas, that's purely a matter of taste (although there are also some human factors cognitive loading issues when there are more than 3 levels in a structure...) (Re-)organzing things to fit that model sometimes requires creativity. But since you asked... 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. PASSporT Token Overview . . . . . . . . . . . . . . . . . . . 3 3. PASSporT Header . . . . . . . . . . . . . . . . . . . . . 4 3.1.1. "typ" (Type) Header Parameter . . . . . . . . . . . . 4 3.1.2. "alg" (Algorithm) Header Parameter . . . . . . . . . 4 3.1.3. "x5u" (X.509 URL) Header Parameter . . . . . . . . . 4 4 PASSporT Payload . . . . . . . . . . . . . . . . . . . . 5 3.2.1. JWT defined claims . . . . . . . . . . . . . . . . . 5 3.2.1.1. "iat" - Issued At claim . . . . . . . . . . . . . 5 3.2.2. PASSporT specific claims . . . . . . . . . . . . . . 5 3.2.2.1. Originating and Destination Identity Claims . . . 5 3.2.2.2. "mky" - Media Key claim . . . . . . . . . . . . . 7 3.3. PASSporT Signature . . . . . . . . . . . . . . . . . . . 8 5. Extending PASSporT . . . . . . . . . . . . . . . . . . . . . 8 4.1. "ppt" (PASSporT) header parameter . . . . . . . . . . . . 8 4.2. Extended PASSporT Claims . . . . . . . . . . . . . . . . 9 6. Deterministic JSON Serialization . . . . . . . . . . . . . . 9 5.1. Example PASSport deterministic JSON form . . . . . . . . 10 7. Security Considerations . . . . . . . . . . . . . . . . . . . 10 6.1. Avoidance of replay and cut and paste attacks . . . . . . 10 6.2. Solution Considerations . . . . . . . . . . . . . . . . . 10 6.3. Privacy Considerations . . . . . . . . . . . . . . . . . 11 For deeper subsections, consider converting them to a labeled hanging indent. This especially works when there's already a convenient label, like 'iat'. Lots of small subsections tends to break up the reading. Hanging indents don't. >>> >>> If the originating or destination identity is a telephone number, >>> the key representing the identity should be "tn". >> >> should and not must??? why? > > fixed > >> >> >>> Telephone Number strings for "tn" MUST be canonicalized according >>> to the procedures specified in [I-D.ietf-stir-rfc4474bis] Section >>> 7.2. >> >> Actually, this dependency on 4474bis seems odd. >> >> Given that the phone number construct is at the core of the work >> here and this is the essential data object, and this object is >> presumably intended for use outside of 4474bis, I'd expect that >> canonicalization algorithm to be here. >> >> If 4474 needs to cite/use the algorithm, it can cite here, which it >> already will have to do. There is no other normative use of 4474 >> in this document. >> > > needs discussion oh goodie. >>> 3.2.2.1.2. "uri" - URI identity >>> >>> If any of the originating or destination identities is of the >>> form URI, as defined in [RFC3986], the key representing the >>> identity should be "uri" URI form of the identity. >> >> should and not must? why? > > fixed > >> >> >>> 3.2.2.1.3. Future identity forms >>> >>> We recognize that in the future there may be other standard >>> mechanisms for representing identities. The "orig" and "dest" >>> JSON >>> >>> >>> >>> >>> Wendt & Peterson Expires January 23, 2017 >>> [Page 6] >>> >>> Internet-Draft PASSporT >>> July 2016 >>> >>> >>> objects with "tn" and "uri" allow for other identity types with >>> unique keys to represent these forms. >> >> Recognition is dandy, but where is the specification detail to >> support the extensibility? > > clarified text > >> >> >>> 3.2.2.1.4. Examples >> >> *** Explain these examples, so they aren't merely syntax detail >> *** >> >> >>> Single Originator to Single Destination example: >>> >>> { "dest":{"uri":["sip:alice@example.com"]}, "iat":"1443208345", >>> "orig":{"tn":"12155551212"} } >>> >>> Single Originator to Multiple Destination Identities example: >>> >>> { "dest":{ "tn":["12125551212"], "uri":["sip:alice@example.com", >>> "sip:bob@example.net"] }, "iat":"1443208345", >>> "orig":{"tn":"12155551212"} } >>> >>> 3.2.2.2. "mky" - Media Key claim >>> >>> Some protocols that use PASSporT convey hashes for media >>> security keys within their signaling in order to bind those keys >>> to the identities established in the signaling layers. One >>> example would be the DTLS-SRTP key fingerprints carried in SDP >>> via the "a=fingerprint" attribute; multiple instances of that >>> fingerprint may appear in a single SDP body corresponding to >>> difference media streams offered. >> >> difference -> different? >> >> The above text belongs elsewhere, explaining the overall set of >> capabilities, use cases, and the like In a definitions section >> like this, focus on definitions, not discussions about use. >> >> First use of 'SDP', with no explanation of its meaning. > > Added citation > >> >> 'DTLS-SRTP' citation? >> >> And again, how does this citation slip into a transport-independent >> object signing spec? > > Meant to be a useful/likely used example. Well, I fear it's a relatively esoteric reference, so that it probably needs to assume less familiarity by the reader, which is to say the example needs to explain itself more. >>> 4.2. Extended PASSporT Claims >>> >>> Future specifications that define such extensions to the >>> PASSporT >> >> [Future] remove >> >> [such] remove. there's no context for it. > > removed > >> >> >>> mechanism MUST explicitly designate what claims they include >>> beyond >> >> designate -> specify (it's defining, not appointing) > > fixed > >> >> >>> the base set of claims from this document, the order in which >>> they will appear, and any further information necessary to >>> implement the extension. All extensions MUST incorporate the >>> baseline JWT elements specified in Section 3; claims may only be >>> appended to the claims >> >> If all extensions include the baseline, then 'must incorporate' is >> an odd way to say that > > changed to include > >> >> This seems best and first handled by earlier in the spec, by >> providing a syntax (and text) that shows the base set and then an >> optional extended set. With that setup, it is clear that >> extensions are always /in addition to/ the base. > > JSON sort of provides this capability inherently, so would prefer to > keep it simple rather than adding more protocol. The 'sort of' does not encourage confidence about the resolution of this point... >> The JSON object MUST follow the rules for the construction of >>> the thumbprint of a JSON Web Key (JWK) as defined in [RFC7638] >>> Section 3. Each JSON object MUST contain no whitespace or line >>> breaks before or after any syntactic elements and with the >>> required members ordered lexicographically by the Unicode >>> [UNICODE] code points of the member names. >> >> mumble. > > ? I was reacting the to the redundant specification here, as well as to its being in prose that gets a bit complicated. (Humans process negation and discussion worse than conjunction.) Basically, this spec should not be repeated technical details that are being specified elsewhere and used here. They should be be reference. >>> 5.1. Example PASSport deterministic JSON form >>> >>> For the example PASSporT Payload shown in Section 3.2.2.2, the >>> following is the deterministic JSON object form. >>> >>> {"dest":{"uri":["sip:alice@example.com"],"iat": 1443208345,"mky" >>> :[{"alg":"sha-256","dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442 >>> CD54F17A03A27DF9B07F4619B2"},{"alg":"sha-256","dig":"4AADB9B13F8 >>> 2183B540212DF3E5D496B19E57CAB3E4B652E7D463F5442CD54F1"}], >>> "orig":{"tn":"12155551212"}} >> >> Perhaps explain the steps followed to produce this? Perhaps show >> the intermediate forms? >> > > will discuss the need for more explicit instructions, to me, it’s > following the spec, but could improve if folks think it’s necessary. I think the main concern I was expressing was that it should a result, without commentary, and without showing the intermediate steps. As such, the reader learns relatively little from the example, IMO. >>> 7. Security Considerations >>> >>> 7.1. Avoidance of replay and cut and paste attacks >>> >>> There are a number of security considerations for use of the >>> token >> >> I suspect they are not 'security considerations' as much as >> 'mechanisms' or 'provisions' >> >> >>> for avoidance of replay and cut and paste attacks. PASSporT >>> tokens must be sent along with other application level protocol >>> information >> >> Huh? You are trying to dictate application-level transport >> behavior? >> >> This smacks of layer/scoping violation. > > changed to should and removed along, but don’t want to remove this > consideration. > >> >> >>> (e.g. for SIP an INVITE as defined in [RFC3261]). There should >>> be a link between various information provided in the token and >>> information provided by the application level protocol >>> information. >> >> Why? > > explained > >> >> >>> These would include: >>> >>> o "iat" claim should closely correspond to a date/time the >>> message >> >> The semantics of iat are defined earlier. Either there is >> compliance or there isn't. The discussion here, therefore, should >> probably say something like "a valid iat claim aids in detecting >> re-use at a later time.” > > i am explaining the ‘why’ here, added a sentence about validation and > correlation to network time variances. > >> >> >>> was originated. It should also be within a relative delta time >> >> What is a delta time? How is the reader to know? Where is it >> defined? I suspect what is meant is that it's deviation from time >> of origination should be small. If this has a more precise >> technical definition, then cite it. > > removed delta > >> >> >>> that is reasonable for clock drift and transmission time >>> characteristics associated with the application using the >>> PASSporT token. >>> >>> o "dest" claim is included to prevent the ability to use a >>> previously originated message to send to another destination >>> party >> >> the ability to -> using (or use of) > > fixed with ‘valid re-use' > >> >>> >>> >>> >>> >>> >>> >>> >>> Wendt & Peterson Expires January 23, 2017 >>> [Page 10] >>> >>> Internet-Draft PASSporT >>> July 2016 >>> >>> >>> 7.2. Solution Considerations >>> >>> It should be recognized that the use of this token should not, >>> in it's own right, be considered a full solution for absolute >>> non- repudiation of the persona being asserted. This only >>> provides non- repudiation of the signer of PASSporT. If the >>> signer and the persona >> >> huh? So the originator isn't really being validated, as >> claimed??? > > This is only a statement to recognize that you are only trusting the > signer and certificate owner to tell the truth about the originating > identity. If you are familiar with how certificates work, this is an > obvious statement, but just a word of consideration. Start by saying the affirmative, so that the negative has a foundation. For the current topic, the usual caveat language is along the lines that "authentication validates authorization to use the identifier, but does not imply any assessment about the reputation or safety of the actor using the identifier" or somesuch... While authentication does involve a kind of trust, using that word here usually confuses readers that it it has something to do with 'usage reputation' that is the derivative function after authentication. >>> are not one in the same, which can and often will be the case in >>> telecommunications networks today, protecting the destination >>> party from being spoofed may take some interpretation or >>> additional verification of the link between the PASSporT >>> signature and the persona being asserted. >>> >>> In addition, the telecommunications systems and specifications >>> that use PASSporT should in practice provide mechanisms for: >>> >>> o Managing X.509 certificates and X.509 certificate chains to >>> an authorized trust anchor that can be a trusted entity to all >>> participants in the telecommunications network >> >> Touching this sort of topic is, at the very best, redundant with >> specifications devoted to X.509. Just cite them and don't attempt >> to repeat them. > > I see this as helpful, we can discuss if it’s not needed, but I > recall being asked by working group to include text to inform the > reader. > >> >>> o Accounting for entities that may route calls from other peer >>> or interconnected telecommunications networks that are not part >>> of the "trusted" communications network or may not be following >>> the usage of PASSporT or the profile of PASSporT appropriate to >>> that network >> >> Passport doesn't do calls. Dictating activity involving calls is >> out of scope. While some of my comments in this subsection can be class as matters of taste or an opinion about risks of redundant text, this here point is about language that is simply wrong. >> On the other hand, perhaps this qualifies for a discussion about >> transferring passport objects across administrative (trust) domain >> boundaries? >> >> At best, this section seems to be trying to compensate for the lack >> of a framework discussion about the problem domain and the >> practical uses of the various specifications being produced. > > similar to above comment, this is meant to be a cautionary statement > and something to consider if you are an implementer. If you > understand the limits of what X.509 based certificate signing and PKI > can represent in terms of trust, these are obvious statements, but I > think it’s good to include none-the-less. In other words, you are trying to provide a tutorial about X.509 rather than discussion about Passport. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 27 16:53:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55A2512D0CD for ; Sat, 27 Aug 2016 16:53:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vImWEHa83uPS for ; Sat, 27 Aug 2016 16:53:24 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6525512B05E for ; Sat, 27 Aug 2016 16:53:24 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id j12so68300662ywb.2 for ; Sat, 27 Aug 2016 16:53:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=eMqAGMKYF4fFhynquK1nTxOeCTUAkOsWO1mCNSGR+u0=; b=xoFvDuuxFuC1kBOTfmMBw86Yp9Rg4rbkipt++CL1VQHfzMzFHZ+votlmp6kC8k06lH 564VkRWZ/mDvfjS2VW74ZiT/f8z9cNnTJuoUP8rxQ0nyhWm8PfmOpm9lXbvh3TjQYjfH Y2847VvqixTP9IH6DSbibMkHdxITWz6GoKUU5Aq4bWlCwor3ZYxFg7meal/tv7D2ZUjX d4nC3NnqG7X7LazB5Aba8kZ/f4EAhqTQWlpvkObDqhUG/gFyiK+b1uTojFHUli1wOVJK ZQLcWlDMtbjQ8huQFZJiWgTTXQkNNuVBT+jVL2jI1UjcVK2Dxrso6oimPtqLPqvbtvZY 72iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=eMqAGMKYF4fFhynquK1nTxOeCTUAkOsWO1mCNSGR+u0=; b=WQbdS2gKds1jRI/K1EyP+rkpCKPTkdPzL4OIGkbwgQXI4H+HC3BJo34PmZ/Flq45w5 +IJbt2ADEtHxxgC9wWe165jkNCWfaG+kOKgXYinjAhCgrORw+EwF9IsJ7sTpmcLHUn1o qrhVjecmztZTLER0a7MabcBC0nPyXVBb4DV8poy8vVbO2YrYXkawnE1re3cKjB0T2YGH HTrnM9O2dnPYt6jN1WAndZMJbJCPfMEEZ9aU8qtu8IwvJFqwBclwmYf+QbdWcbXbh8cU bRYdDHFvdVrLzRXSpS0iDTjWkguRgps4wqc2rmHm8c6UvJr1m0NQw0Zj3uPbPZirWA/Q AdjQ== X-Gm-Message-State: AE9vXwO14qxBKTuQRW3K52KZpyOgTbHB+y4ongpNG7veWb2gw/Cajdo3W4bbKgFEY83rNxFAEOmrii0fN4zZQQ== X-Received: by 10.13.244.197 with SMTP id d188mr9460971ywf.276.1472342003577; Sat, 27 Aug 2016 16:53:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sat, 27 Aug 2016 16:52:42 -0700 (PDT) In-Reply-To: <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> From: Eric Rescorla Date: Sat, 27 Aug 2016 16:52:42 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=94eb2c0865481ca9f1053b16567f Archived-At: Cc: Chris Wendt , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Aug 2016 23:53:26 -0000 --94eb2c0865481ca9f1053b16567f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker wrote: > Chris, > > Thanks for the followup. Pruned responses to responses, below... > > > On 8/22/2016 10:58 AM, Chris Wendt wrote: > >> Detailed Comments ----------------- >>> >>>> STIR >>>> C. Wendt Internet-Draft >>>> Comcast Intended status: Standards Track >>>> J. Peterson Expires: January 23, 2017 >>>> Neustar Inc. July 22, 2016 >>>> >>>> >>>> Persona Assertion Token draft-ietf-stir-passport-05 >>>> >>>> Abstract >>>> >>> ... > >> Is the timestamp the basis of claiming non-repudiation? >>> >> >> Partially, depending on your interpretation of how non-repudiation is >> achieved. The digital signature based on a certificate is the >> non-repudiation of the original assertion and signing of the token. >> > > That seems to equate authentication with non-reputation of originator. Bu= t > they aren't the same. > Do you mean "non-repudiation" here? I ask because "reputation" is also a concept potentially in play here. repudiation the sender of and authorization to send information >>>> related to the originator of personal communications. A >>>> >>> >>> 'info related to'... what does this mean? >>> >> >> Yes this was a bit too broad and the abstract text wasn=E2=80=99t update= d >> when the scope was reduced. >> >> replaced with: 'non-repudiation the author of the token, their >> authority to author the token and, minimally, the asserted >> originating identity or persona contained within the token >> corresponding specifically to the originator of personal >> communications' >> > > My guess is that all of the above fall under authentication, not > non-repuduation. If my guess is wrong, it really would help to see a > careful explanation of how it is non-repudiation rather than authenticati= on. I think it would probably be fine to remove the term "non-repudiation" from this spec, since it only appears in the abstract. Generally, it's not that useful a concept for most security settings, especially when one starts to ask questions about the legal context. With that said, given that these tokens are signed by their creator and there is a timestamp to provide anti-replay, there is at least potentially an important technical property being provided here, which is that in the case where a passport creator signs a bogus passport, it is possible to demonstrate that it did so, which is not a property necessarily provided by authentication systems. -Ekr --94eb2c0865481ca9f1053b16567f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker <dhc@dcrocker.net>= wrote:
Chris,

Thanks for the followup.=C2=A0 Pruned responses to responses, below...


On 8/22/2016 10:58 AM, Chris Wendt wrote:
Detailed Comments -----------------
STIR
C. Wendt Internet-Draft
Comcast Intended status: Standards Track
J. Peterson Expires: January 23, 2017
Neustar Inc. July 22, 2016


Persona Assertion Token draft-ietf-stir-passport-05

Abstract
 ...
Is the timestamp the basis of claiming non-repudiation?

Partially, depending on your interpretation of how non-repudiation is
achieved.=C2=A0 The digital signature based on a certificate is the
non-repudiation of the original assertion and signing of the token.

 That seems to equate authentication with non-reputation of originator. But = they aren't the same.

Do you mean &= quot;non-repudiation" here? I ask because "reputation" is al= so a concept potentially in play here.


<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">
repudiation the sender of and authorization to send information
related to the originator of personal communications.=C2=A0 A

'info related to'... what does this mean?

Yes this was a bit too broad and the abstract text wasn=E2=80=99t updated when the scope was reduced.

replaced with: 'non-repudiation the author of the token, their
authority to author the token and, minimally, the asserted
originating identity or persona contained within the token
corresponding specifically to the originator of personal
communications'

 My guess is that all of the above fall under authentication, not non-repudu= ation.=C2=A0 If my guess is wrong, it really would help to see a careful ex= planation of how it is non-repudiation rather than authentication.

I think it would probably be fine to remove the ter= m "non-repudiation" from this spec, since it only appears in the = abstract. Generally, it's not that useful a concept for most security s= ettings, especially when one starts to ask questions about the legal contex= t.

With that said, given that these tokens are sig= ned by their creator and there is a timestamp to provide anti-replay, there= is at least potentially an important technical property being provided her= e, which is that in the case where a passport creator signs a bogus passpor= t, it is possible to demonstrate that it did so, which is not a property ne= cessarily provided by authentication systems.

-Ekr=


--94eb2c0865481ca9f1053b16567f-- From nobody Sat Aug 27 17:08:01 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0401912D1BC for ; Sat, 27 Aug 2016 17:08:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bbiw.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F6lpOOYjZcGu for ; Sat, 27 Aug 2016 17:07:59 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7EDE112D198 for ; Sat, 27 Aug 2016 17:07:59 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7S08AHo001796 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 27 Aug 2016 17:08:10 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=bbiw.net; s=default; t=1472342891; bh=vbB4enISmvgSzLA4Tu8cn7QHCPGbHezSsCKa8ttV3P4=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=WuyA4apKNc4ZVpdDCmGdEppAGG3LkdbNWjQ95cP0LEQpqN9JQRjCGAJyK1n2M4ztk HDiaMp4tAWuclGzTd+4lA8P4KamNyBtRvbcHzLKaCHI+Jq1LubJ0raW9mHSU/wTo5l mIrQwJRlockr/XfxwFkxR1fveYF4s/4shpFjKlpA= To: Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> Date: Sat, 27 Aug 2016 17:07:32 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Chris Wendt , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 00:08:00 -0000 On 8/27/2016 4:52 PM, Eric Rescorla wrote: > > > On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker > wrote: > > Is the timestamp the basis of claiming non-repudiation? > > > Partially, depending on your interpretation of how > non-repudiation is > achieved. The digital signature based on a certificate is the > non-repudiation of the original assertion and signing of the token. > > > That seems to equate authentication with non-reputation of > originator. But they aren't the same. > > > Do you mean "non-repudiation" here? I ask because "reputation" is also a > concept potentially in play here. I'm using 'non-repudiation' because the spec uses that term. If the spec really means 'reputation', that opens a different set of concerns, since nothing in any of the 3 documents has to do with reputation, per se. > I think it would probably be fine to remove the term "non-repudiation" > from this spec, since it only appears in the abstract. Generally, it's > not that useful a concept for most security settings, especially when > one starts to ask questions about the legal context. > > With that said, given that these tokens are signed by their creator and > there is a timestamp to provide anti-replay, there is at least > potentially an important technical property being provided here, which > is that in the case where a passport creator signs a bogus passport, it > is possible to demonstrate that it did so, which is not a property > necessarily provided by authentication systems. And I believe that was my original guess, although my very limited understanding of non-repudiation includes the significant burden of having the timestamp, itself, be validated by an independent authority. Otherwise, the signer could claim any time they want to... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 27 17:20:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DF6112D198 for ; Sat, 27 Aug 2016 17:20:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uCocyd3o2d9S for ; Sat, 27 Aug 2016 17:20:24 -0700 (PDT) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A8A712D0CD for ; Sat, 27 Aug 2016 17:20:24 -0700 (PDT) Received: by mail-yw0-x235.google.com with SMTP id u134so68450805ywg.3 for ; Sat, 27 Aug 2016 17:20:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4JD0QzOCktqhKq3k4GbymGYNxqur7p2nST8fCenOz14=; b=evEYbYX0bYC874zYreKxTVEpNV4I6ilzkGvSJyIQeLEUFZ/m6797sX4mxxmQMR9Oqk 3nVCdlQqlhRnBbmTwj7dSyn5rwmZD2nnnYyrp6mYYB9n/A78/53cyfA+gYaINAyVCN4M tMnBDp6moIibvCMjFp8zxd9uETkcrP2t0GcCrlu92fJWPu7+MG+lC0qkst+c5H6tgio3 VBM9meF+BRow+nB35K5NXNlEWewfkV7fmSVrAOel6+MIBCGArSQ70C4z03AzA26LDQDQ HAyCsY6Cxe5YbJLp7lx3czXdybL8RJ7/c4vEDGtX2TkY07ymU1c5u2iyDI6GuDvy6n53 kI3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4JD0QzOCktqhKq3k4GbymGYNxqur7p2nST8fCenOz14=; b=Mb9dUJupRa9dT3uF7bNh20Daynm8uGLa8+/S3t3zgmcFT92HHlM8ixhPHp2wTsDZJr sihjeuBVAkmAGf5cg9XZfd2s6JvwgNDk05+cJ61cHBuZYtvH8vocvcsfCW0E+KkML8iZ Ca8eWfjYU4HGJtM2tw8XlFDcXqtjvT24BpzW8FYu0/UX88MPanXNKl3df2wwc2V/2n3Y ihj63QHTff3xiXo700GLrdc+nP1wliiVOxQNuUe6sQwcPUAqcfvuo35eMRYwMivP4/1d GDsxW/op2kx4o4NsQjnvN8wsG4FsIpJcc+y2iWH0XurrrKeBDkpwZo/lyEg66qCZDUud fsJw== X-Gm-Message-State: AE9vXwPxWnmNO0wkVw+DbzE96WJU319keadXj26lm9834kQ4pigfbFLrUYQIClXxW1qEJ9olv30skpmgs/S5kQ== X-Received: by 10.129.92.215 with SMTP id q206mr9655374ywb.8.1472343623700; Sat, 27 Aug 2016 17:20:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sat, 27 Aug 2016 17:19:43 -0700 (PDT) In-Reply-To: <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> From: Eric Rescorla Date: Sat, 27 Aug 2016 17:19:43 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=001a114d85ceadcae3053b16b684 Archived-At: Cc: Chris Wendt , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 00:20:26 -0000 --001a114d85ceadcae3053b16b684 Content-Type: text/plain; charset=UTF-8 On Sat, Aug 27, 2016 at 5:07 PM, Dave Crocker wrote: > On 8/27/2016 4:52 PM, Eric Rescorla wrote: > >> >> >> On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker > > wrote: >> > > >> Is the timestamp the basis of claiming non-repudiation? >> >> >> Partially, depending on your interpretation of how >> non-repudiation is >> achieved. The digital signature based on a certificate is the >> non-repudiation of the original assertion and signing of the >> token. >> >> >> That seems to equate authentication with non-reputation of >> originator. But they aren't the same. >> >> >> Do you mean "non-repudiation" here? I ask because "reputation" is also a >> concept potentially in play here. >> > > I'm using 'non-repudiation' because the spec uses that term. > > If the spec really means 'reputation', that opens a different set of > concerns, since nothing in any of the 3 documents has to do with > reputation, per se. Just checking. I think it would probably be fine to remove the term "non-repudiation" >> from this spec, since it only appears in the abstract. Generally, it's >> not that useful a concept for most security settings, especially when >> one starts to ask questions about the legal context. >> >> With that said, given that these tokens are signed by their creator and >> there is a timestamp to provide anti-replay, there is at least >> potentially an important technical property being provided here, which >> is that in the case where a passport creator signs a bogus passport, it >> is possible to demonstrate that it did so, which is not a property >> necessarily provided by authentication systems. >> > > And I believe that was my original guess, although my very limited > understanding of non-repudiation includes the significant burden of having > the timestamp, itself, be validated by an independent authority. Otherwise, > the signer could claim any time they want to... That doesn't seem correct to me, at least if "independent" means someone other than the relying party. The signature is itself a proof attaching the signer's private key to the passport and to a claim by the signer about the passport object's assertions being valid at the time in the timestamp. If the relying party checks the timestamp and rejects it if it has a bogus timestamp, then any acceptable passport will be relatively fresh and thus will be usable as a proof of the signer's representation at the relevant time. Overall, this seems less important than the freshness property wrt authentication, but it's still a technical property. -Ekr > d/ > > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --001a114d85ceadcae3053b16b684 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Sat, Aug 27, 2016 at 5:07 PM, Dave Crocker <dcrocker@bbiw.net&g= t; wrote:
On 8/27/2016 4:52 = PM, Eric Rescorla wrote:


On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker <dhc@dcrocker.net
 <mailto:dhc@dcrock= er.net>> wrote:


=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Is the timestamp the basis of cla= iming non-repudiation?


=C2=A0 =C2=A0 =C2=A0 =C2=A0 Partially, depending on your interpretation of = how
=C2=A0 =C2=A0 =C2=A0 =C2=A0 non-repudiation is
=C2=A0 =C2=A0 =C2=A0 =C2=A0 achieved.=C2=A0 The digital signature based on = a certificate is the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 non-repudiation of the original assertion and s= igning of the token.


=C2=A0 =C2=A0 That seems to equate authentication with non-reputation of =C2=A0 =C2=A0 originator. But they aren't the same.


Do you mean "non-repudiation" here? I ask because "reputatio= n" is also a
concept potentially in play here.

 I'm using 'non-repudiation' because the spec uses that term.
If the spec really means 'reputation', that opens a different set o= f concerns, since nothing in any of the 3 documents has to do with reputati= on, per se.

Just checking.


I think it would probably be fine to remove the term "non-repudiation&= quot;
from this spec, since it only appears in the abstract. Generally, it's<= br> not that useful a concept for most security settings, especially when
one starts to ask questions about the legal context.

With that said, given that these tokens are signed by their creator and
there is a timestamp to provide anti-replay, there is at least
potentially an important technical property being provided here, which
is that in the case where a passport creator signs a bogus passport, it
is possible to demonstrate that it did so, which is not a property
necessarily provided by authentication systems.

 And I believe that was my original guess, although my very limited understa= nding of non-repudiation includes the significant burden of having the time= stamp, itself, be validated by an independent authority. Otherwise, the sig= ner could claim any time they want to...

Th= at doesn't seem correct to me, at least if "independent" mean= s someone other than the relying party. The signature is itself a proof att= aching the signer's private key to the passport and to a claim by the s= igner about the passport object's assertions being valid at the time in= the timestamp. If the relying party checks the timestamp and rejects it if= it has a bogus timestamp, then any acceptable passport will be relatively = fresh and thus will be usable as a proof of the signer's representation= at the relevant time. Overall, this seems less important than the freshnes= s property wrt authentication, but it's still a technical property.

-Ekr


d/


--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

--001a114d85ceadcae3053b16b684-- From nobody Sat Aug 27 18:46:31 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B8E212D53C for ; Sat, 27 Aug 2016 18:46:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UcevX2eg01Le for ; Sat, 27 Aug 2016 18:46:29 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C84A612D0C6 for ; Sat, 27 Aug 2016 18:46:29 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7S1ke86004046 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 27 Aug 2016 18:46:40 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472348801; bh=tmftwac4o3EyhLnedPLT3GsWSZPhmoqYnlW6/xNNhr8=; h=Subject:To:References:Cc:From:Reply-To:Date:In-Reply-To:From; b=Gp5dbeujZh9z5Ml/P/sX/6DF4rG80hw9lZ8YGY+sMEvg0tprDlYrH8+zQoBvcvxd2 YCQ7uC1am6uXo9LH6VUOn4bz4X0j0BY4BcYpPcToaB+nVOrZZ0zdNozQ9h+1Wjiyxw N0PeLz+r75TmkQyyfZl2Fx1pW7lxU/dq8/AO7+80= To: Eric Rescorla References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Sat, 27 Aug 2016 18:46:02 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: Chris Wendt , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 01:46:30 -0000 On 8/27/2016 5:19 PM, Eric Rescorla wrote: > And I believe that was my original guess, although my very limited > understanding of non-repudiation includes the significant burden of > having the timestamp, itself, be validated by an independent > authority. Otherwise, the signer could claim any time they want to... > > > That doesn't seem correct to me, at least if "independent" means someone > other than the relying party. The signature is itself a proof attaching > the signer's private key to the passport and to a claim by the signer > about the passport object's assertions being valid at the time in the > timestamp. If the relying party checks the timestamp and rejects it if > it has a bogus timestamp, then any acceptable passport will be > relatively fresh and thus will be usable as a proof of the signer's > representation at the relevant time. Overall, this seems less important > than the freshness property wrt authentication, but it's still a > technical property. This sounds pretty much the same as authentication. While the verifier might decide that the timestamp is ok, if the verification is close enough in time to that claimed occurrence, it does nothing for being able to prove the timing to a third-party, /later/. And that's the environment I'm used to hearing about needing 'non-repudiation' for. In that case, the timestamp needs to have validation that is independent of the signer. What I'm used to hearing, for that, is that an independent timestamp service does a kind of notary signature on the original signer's stuff, including the timestamp. Anyhow, all of seems to go beyond STIR's needs, suggesting that it would be best to remove use of the term? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Aug 27 18:54:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA42112D093 for ; Sat, 27 Aug 2016 18:54:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QGpx_IvFIA0e for ; Sat, 27 Aug 2016 18:54:42 -0700 (PDT) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEADD12B026 for ; Sat, 27 Aug 2016 18:54:41 -0700 (PDT) Received: by mail-yw0-x232.google.com with SMTP id j12so69014138ywb.2 for ; Sat, 27 Aug 2016 18:54:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mxBvBK+74NJ0I/Ve4I0buiuCXsH6O9jZGM7TuhX8adI=; b=N6iPhajM9oFXdi+kdlAzpP4uD6ZQzPkyWLI487xfdfJc6HVl0+qbakzlXmWEvcAS3e 5UA2KXIcdNO15ClamD/gJEgSFOH8NNgifDsUmLLEnGjmhenNCFvOdszQMX0AqEpLdTmY ZO9rLZ0vxfgT79OqmpsWbZh5mtl34Iyr+U6iS6/TB29+0eK5fCxozX1DhJ9+LJuvNdGQ 4YfvNpDSL4Jw8MR7Q5LlIXU29pCVcefEgrCz1dJm9gLSj1RyK5KOL/WgsEUBR9CG61nG a5sdmKF7+5ijwP5fnhztnBXJv2pvXETdZrYBbJk607dR6XK7jnp7P7qaDREVK5j3Bg8l MH0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mxBvBK+74NJ0I/Ve4I0buiuCXsH6O9jZGM7TuhX8adI=; b=MfyAr7HZgJ/fmP5P0/qHDF/tSPy8CDhgJ6LixmvGJcwwwu0YpkBp88XLiLDl/matEn SarWDbIpU+hFutR8WzGSQ579Xqji4DQxUbdGQQFK791IavMmnpadwffrsrujV3R8lbNE bO8NJBYxW2MmUxjw89aIiernNJsX+Zsb3Jbh0vJCdPNenjrkIrAOmgBZMqGDbRRc+0ZA 7t05ylTrOFCkBqGLDGT+xaoR90mb1eHsB+Ic6acq0JuP2GXbtBQVgFroTRjADqE5lnJi b9CGmzZoPb4WnrI/upn2Bu0v6o+4/B3n+z/X4xQ+1w5JBHAd8lEQMIwfZZqNjVvlcYd0 GkQA== X-Gm-Message-State: AE9vXwP++zuQFexFV7XlTa/R6PfMsLq5vTVOY/nFuuoOck5PRempVvHMu0QXb1JqVagD2K0oEaSLq0qzBQiKlw== X-Received: by 10.129.92.215 with SMTP id q206mr9834928ywb.8.1472349281088; Sat, 27 Aug 2016 18:54:41 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sat, 27 Aug 2016 18:54:00 -0700 (PDT) In-Reply-To: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> From: Eric Rescorla Date: Sat, 27 Aug 2016 18:54:00 -0700 Message-ID: To: Dave Crocker Content-Type: multipart/alternative; boundary=001a114d85cee2aa36053b18075b Archived-At: Cc: Chris Wendt , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 01:54:44 -0000 --001a114d85cee2aa36053b18075b Content-Type: text/plain; charset=UTF-8 On Sat, Aug 27, 2016 at 6:46 PM, Dave Crocker wrote: > On 8/27/2016 5:19 PM, Eric Rescorla wrote: > >> And I believe that was my original guess, although my very limited >> understanding of non-repudiation includes the significant burden of >> having the timestamp, itself, be validated by an independent >> authority. Otherwise, the signer could claim any time they want to... >> >> >> That doesn't seem correct to me, at least if "independent" means someone >> other than the relying party. The signature is itself a proof attaching >> the signer's private key to the passport and to a claim by the signer >> about the passport object's assertions being valid at the time in the >> timestamp. If the relying party checks the timestamp and rejects it if >> it has a bogus timestamp, then any acceptable passport will be >> relatively fresh and thus will be usable as a proof of the signer's >> representation at the relevant time. Overall, this seems less important >> than the freshness property wrt authentication, but it's still a >> technical property. >> > > > This sounds pretty much the same as authentication. > > While the verifier might decide that the timestamp is ok, if the > verification is close enough in time to that claimed occurrence, it does > nothing for being able to prove the timing to a third-party, /later/. Well, what you can prove (at any time in the future) is that the signer claimed that a given thing was true at (what it claimed was) a given time. You can prove this to a third party. This isn't a necessary property of authentication. For instance, the relying party could share a key with the passport generator and the passport could be secured with a MAC. And that's the environment I'm used to hearing about needing > 'non-repudiation' for. > > In that case, the timestamp needs to have validation that is independent > of the signer. What I'm used to hearing, for that, is that an independent > timestamp service does a kind of notary signature on the original signer's > stuff, including the timestamp. > I'm not sure why you think non-repudiation needs a notary signature. That's not generally the case, as indicated above, and even if you do have a timestamping service, all it can prove is that the signature was generated *prior* to a given time, not at a given time. Anyhow, all of seems to go beyond STIR's needs, suggesting that it would be > best to remove use of the term? Yes, I think that would be fine. > > > d/ > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --001a114d85cee2aa36053b18075b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Sat, Aug 27, 2016 at 6:46 PM, Dave Crocker <dhc@dcrocker.net>= wrote:
On 8/27/2016 5:19 PM= , Eric Rescorla wrote:
=C2=A0 =C2=A0 And I believe that was my original guess, although my very li= mited
=C2=A0 =C2=A0 understanding of non-repudiation includes the significant bur= den of
=C2=A0 =C2=A0 having the timestamp, itself, be validated by an independent<= br> =C2=A0 =C2=A0 authority. Otherwise, the signer could claim any time they wa= nt to...


That doesn't seem correct to me, at least if "independent" me= ans someone
other than the relying party. The signature is itself a proof attaching
the signer's private key to the passport and to a claim by the signer about the passport object's assertions being valid at the time in the timestamp. If the relying party checks the timestamp and rejects it if
it has a bogus timestamp, then any acceptable passport will be
relatively fresh and thus will be usable as a proof of the signer's
representation at the relevant time. Overall, this seems less important
than the freshness property wrt authentication, but it's still a
technical property.


 This sounds pretty much the same as authentication.

While the verifier might decide that the timestamp is ok, if the verificati= on is close enough in time to that claimed occurrence, it does nothing for = being able to prove the timing to a third-party, /later/.
=
Well, what you can prove (at any time in the future) is that= the signer claimed that a given thing was true at (what it claimed was) a = given time. You can prove this to a third party.

T= his isn't a necessary property of authentication. For instance, the rel= ying party could share a key with the passport generator and the passport c= ould be secured with a MAC.


And that's the environment I'm used to hearing = about needing 'non-repudiation' for.

In that case, the timestamp needs to have validation that is independent of= the signer.=C2=A0 What I'm used to hearing, for that, is that an indep= endent timestamp service does a kind of notary signature on the original si= gner's stuff, including the timestamp.

<= div>I'm not sure why you think non-repudiation needs a notary signature= . That's not generally the case, as indicated above, and even if you do= have a timestamping service, all it can prove is that the signature was ge= nerated *prior* to a given time, not at a given time.

<= div>
Anyhow, all of seems to go beyond STIR's needs, suggesting that it woul= d be best to remove use of the term?

Yes, I= think that would be fine.
=C2=A0


d/

--

=C2=A0 Dave Crocker
=C2=A0 Brandenburg InternetWorking
=C2=A0 bbi= w.net

--001a114d85cee2aa36053b18075b-- From nobody Sun Aug 28 08:42:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5053512B018 for ; Sun, 28 Aug 2016 08:42:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YqRHElESk1nV for ; Sun, 28 Aug 2016 08:42:05 -0700 (PDT) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC1E312D08E for ; Sun, 28 Aug 2016 08:42:05 -0700 (PDT) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.03.0123.003; Sun, 28 Aug 2016 08:41:59 -0700 From: Michael Hammer To: "ekr@rtfm.com" , "dcrocker@bbiw.net" Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR/J7SSQhHFzP2PUil+H2wqXS3l6Bd0z6AgAAlEACAAAQlAIAAA2eAgAAYHgCAAAI6AIAAcDEw Date: Sun, 28 Aug 2016 15:41:58 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BCBC0E72@sc9-ex2k10mb1.corp.yaanatech.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.151] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_03B3_01D20121.2E5051D0" MIME-Version: 1.0 Archived-At: Cc: "chris-ietf@chriswendt.net" , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 15:42:07 -0000 ------=_NextPart_000_03B3_01D20121.2E5051D0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_03B4_01D20121.2E5051D0" ------=_NextPart_001_03B4_01D20121.2E5051D0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ummm=E2=80=A6. =20 If any signature can be repudiated by the sender,=20 then how do you apply any consequences for bad behavior? Any caller could just say, it wasn=E2=80=99t me and they are off the = hook? =20 Isn=E2=80=99t the consequence tree: - Not signed: customer may not answer or caveat emptor - Signed, robocall: crackdown - Signed, normal call: good to go? =20 I assume that a signed call that has faulty credentials,=20 e.g. bad timestamp, unknown signer, could get filtered out. But, that gets into carrier policy that can=E2=80=99t be standardized. =20 ________________________________ Michael Hammer michael.hammer@yaanatech.com =20 +1 408 202 9291 =C2=A9 2016 Yaana Technologies, LLC. All Rights Reserved. Email = confidentiality notice. This message is private and confidential. If you = have received this message in error, please notify us and remove it from = your system. =20 From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Eric Rescorla Sent: Saturday, August 27, 2016 9:54 PM To: Dave Crocker Cc: Chris Wendt ; stir@ietf.org Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 =20 =20 =20 On Sat, Aug 27, 2016 at 6:46 PM, Dave Crocker > wrote: On 8/27/2016 5:19 PM, Eric Rescorla wrote: And I believe that was my original guess, although my very limited understanding of non-repudiation includes the significant burden of having the timestamp, itself, be validated by an independent authority. Otherwise, the signer could claim any time they want = to... That doesn't seem correct to me, at least if "independent" means someone other than the relying party. The signature is itself a proof attaching the signer's private key to the passport and to a claim by the signer about the passport object's assertions being valid at the time in the timestamp. If the relying party checks the timestamp and rejects it if it has a bogus timestamp, then any acceptable passport will be relatively fresh and thus will be usable as a proof of the signer's representation at the relevant time. Overall, this seems less important than the freshness property wrt authentication, but it's still a technical property. This sounds pretty much the same as authentication. While the verifier might decide that the timestamp is ok, if the = verification is close enough in time to that claimed occurrence, it does = nothing for being able to prove the timing to a third-party, /later/. =20 Well, what you can prove (at any time in the future) is that the signer = claimed that a given thing was true at (what it claimed was) a given = time. You can prove this to a third party. =20 This isn't a necessary property of authentication. For instance, the = relying party could share a key with the passport generator and the = passport could be secured with a MAC. =20 =20 And that's the environment I'm used to hearing about needing = 'non-repudiation' for. In that case, the timestamp needs to have validation that is independent = of the signer. What I'm used to hearing, for that, is that an = independent timestamp service does a kind of notary signature on the = original signer's stuff, including the timestamp. =20 I'm not sure why you think non-repudiation needs a notary signature. = That's not generally the case, as indicated above, and even if you do = have a timestamping service, all it can prove is that the signature was = generated *prior* to a given time, not at a given time. =20 =20 Anyhow, all of seems to go beyond STIR's needs, suggesting that it would = be best to remove use of the term? =20 Yes, I think that would be fine. =20 d/ --=20 Dave Crocker Brandenburg InternetWorking bbiw.net =20 =20 ------=_NextPart_001_03B4_01D20121.2E5051D0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Ummm=E2=80=A6.

 

If any signature can be repudiated by the sender, =

then how do you apply any consequences for bad = behavior?

Any caller could just say, it wasn=E2=80=99t me and they are off the = hook?

 

Isn=E2=80=99t the consequence tree:

-          = Not signed:=C2=A0 customer may not answer or caveat = emptor

-          = Signed, robocall:=C2=A0 crackdown

-          = Signed, normal call:=C2=A0 good to go?

 

I assume that a signed call that has faulty credentials, =

e.g. bad timestamp, unknown signer, could get filtered = out.

But, that gets into carrier policy that can=E2=80=99t be = standardized.

 

________________________________= <= o:p>

Michael Hammer<= o:p>

michael.hammer@yaanatech.com= <= o:p>

+1 408 202 9291<= o:p>

=C2=A9 2016 Yaana Technologies, LLC. All Rights Reserved. Email = confidentiality notice. This message is private and confidential. If you = have received this message in error, please notify us and remove it from = your system.<= o:p>

 

From:<= /b> = stir [mailto:stir-bounces@ietf.org] On Behalf Of Eric = Rescorla
Sent: Saturday, August 27, 2016 9:54 PM
To: = Dave Crocker <dcrocker@bbiw.net>
Cc: Chris Wendt = <chris-ietf@chriswendt.net>; stir@ietf.org
Subject: Re: = [stir] Review of: draft-ietf-stir-passport-05

 

 

 

On Sat, = Aug 27, 2016 at 6:46 PM, Dave Crocker <dhc@dcrocker.net> = wrote:

On = 8/27/2016 5:19 PM, Eric Rescorla wrote:

  =   And I believe that was my original guess, although my very = limited
    understanding of non-repudiation includes the = significant burden of
    having the timestamp, itself, be = validated by an independent
    authority. Otherwise, the = signer could claim any time they want to...


That doesn't seem = correct to me, at least if "independent" means = someone
other than the relying party. The signature is itself a proof = attaching
the signer's private key to the passport and to a claim by = the signer
about the passport object's assertions being valid at the = time in the
timestamp. If the relying party checks the timestamp and = rejects it if
it has a bogus timestamp, then any acceptable passport = will be
relatively fresh and thus will be usable as a proof of the = signer's
representation at the relevant time. Overall, this seems = less important
than the freshness property wrt authentication, but = it's still a
technical property.



This sounds pretty much the same as = authentication.

While the verifier might decide that the = timestamp is ok, if the verification is close enough in time to that = claimed occurrence, it does nothing for being able to prove the timing = to a third-party, /later/.

 

Well, what you can prove (at any time in the future) = is that the signer claimed that a given thing was true at (what it = claimed was) a given time. You can prove this to a third = party.

 

This isn't a necessary property of authentication. For = instance, the relying party could share a key with the passport = generator and the passport could be secured with a = MAC.

 

 

And = that's the environment I'm used to hearing about needing = 'non-repudiation' for.

In that case, the timestamp needs to have = validation that is independent of the signer.  What I'm used to = hearing, for that, is that an independent timestamp service does a kind = of notary signature on the original signer's stuff, including the = timestamp.

 

I'm not sure why you think non-repudiation needs a = notary signature. That's not generally the case, as indicated above, and = even if you do have a timestamping service, all it can prove is that the = signature was generated *prior* to a given time, not at a given = time.

 

 

Anyhow, = all of seems to go beyond STIR's needs, suggesting that it would be best = to remove use of the term?

 

Yes, I think that would be = fine.

 



d/

--

  Dave = Crocker
  Brandenburg InternetWorking
  bbiw.net

 

------=_NextPart_001_03B4_01D20121.2E5051D0-- ------=_NextPart_000_03B3_01D20121.2E5051D0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIR8DCCBBkw ggMBAhBhcMtJjF+YRSnnsKbZUFt6MA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUG A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4 BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkx RTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8K DcLVLNtnuS3llCfdpb7gsE2Ps2FWPNZ8w/TNPobLooji4dikacW14r/BpkdQXkY5i9WWurVvFL8Q zicTngVHmzF6E9gf2dMCN4utLEfwjoEGpw0wDOv3PA8gHdxyRu6lAshbw8lWaUzFGMGRewvVEwCb vO/DSD5GYCCFKtWQts2LoMwy3bf9QFWyUBxWrsyNd03HIE2nMXbvaJKKkB4IgVayrWmjUtDLHMQj PR+Z/kzoFmOOxgiO9jH20vrldt21HJKjSc3NAc1ozalpuqPrHQ2cpCCmwaDF0UZMF23SrGY/lozg hNQ2/yJZxfkRYKhfBH3yGvYlQmEPxEq4PokCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEANCYVPMCN TUNJHb3pIZLXZpy33sW40ORdX3YiwCb5hDo6+Yy1++xg8ejOBLDI3acDjzDzmN+k5qQx39McC0bc ciA/ru4FPKQzPws5rHB4c0uZK98wwlSwqDtVof4WKM1CvXRugNsnRKfORF3UG5CYDR5ClLEALATQ dKMCBSJjY82DtfvBbWJraXX9XXBBufW/fN++wTJzIiGLWIF7FZF6uuNkSLB/+zYl2pXQ8SQUF90Y gGtGIzlU9Y5iCQQdlJCmm+Yl4kJFqriQrb4Ij6kLQhiUz3I54bFD4CjPt+dabBNrSbP/4xh8iYsz Xawz16f52jpVyVgQ+arvWrbPS0vfKjCCBmAwggVIoAMCAQICEHaFyweo4MwP0sVNjzk1sxIwDQYJ KoZIhvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3Mg MiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTExMDYwNzAw MDAwMFoXDTIxMDYwNjIzNTk1OVowgckxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBD b3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xh c3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFu dGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3+D8MK4MjIIWmTUkBUTra3VAzvuMEpDo+o2Fm TDTC6HRwdUmlt0ns3bOSnN15DeK5+rg5PL6F44zvbXmjprcIv5xMvj6YjqzbfJor7AUoMF8pGzNN RNVw6FYimaY+nUJb6yOnY50tLLAuPxjzKc0aNomEksdXcFtwheY4oXxQ4zc4iGVba8s5KgSxgqoZ BP+gfz+j25FFdmaja/OFI15O2YVddaegFffBAHTg5cqUQmWawjd6i6hQrL+XdGd30TKnr43Lk6kl QrQwGnQK4iUQEMt0Z1UPyxT8QVAKpHxNCwv5Bak1+UWnMfGAu6LJPs52OeEq/3ZQ5+hRIt8tz7gz AgMBAAGjggI/MIICOzASBgNVHRMBAf8ECDAGAQH/AgEAMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6 Ly9jcmwudmVyaXNpZ24uY29tL3BjYTItZzMuY3JsMA4GA1UdDwEB/wQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRVmVyaVNpZ25NUEtJLTItNTYwHQYDVR0OBBYEFNhIKahfKheS4vqee+9v YIP4uLjcMIHwBgNVHSMEgegwgeWhgdCkgc0wgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJp U2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMp IDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8 VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt IEczghBhcMtJjF+YRSnnsKbZUFt6MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDov L29jc3AudmVyaXNpZ24uY29tMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcC ARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5z eW1hdXRoLmNvbS9ycGEwDQYJKoZIhvcNAQEFBQADggEBAKYqmwdAyez/s4joRdo00RcPKC23pYVn Mc3B5tUphjis4vBZGwzhoUXOJHjvacGwTGGiSNloT7r+dVQ3ulhp6sF2pTZC6p5meJAg2ZVqJHlU zd5aGoo7rhiVctAl2NJGvjQwp4Ce8VbOIB5sZ8lNT3mHieIugNae7SZhZaID0MXi8yi5K0lpgmfs 1ek0pC7cYiKkhU1I42oClPLN/eRnyEm8qtXH5zzeh7EQa10HXBnka6D0T5nL3LVbDMwy+WrkdMAq WDd5s/vNwzRv4XbdEAcAY4sHTicXkkebDr7eDROFEfyiL2V9zDqsHlRrVmfE7qWHIiMXK3BWw/Gu d1wnwTkwggdrMIIGU6ADAgECAhBMAzfzqk7mKu8vbItErxUIMA0GCSqGSIb3DQEBBQUAMIHJMQsw CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFu dGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1l ZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTE2MDIyOTAwMDAwMFoXDTE4MDIyODIzNTk1 OVoweTEXMBUGA1UEAwwOTWljaGFlbCBIYW1tZXIxDzANBgNVBAsMBlMvTUlNRTEgMB4GA1UECgwX WWFhbmEgVGVjaG5vbG9naWVzLCBMTEMxKzApBgkqhkiG9w0BCQEWHG1pY2hhZWwuaGFtbWVyQHlh YW5hdGVjaC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWEk4s5ORfNfQ/oXDD k4mHDQDDpO3s2oEy7055JdLoleNQXEJGsv8EsqPagYul55uVZ57tmx2H1LjM6QfD7N821joisKa4 +l92JImsffrTnll8gxJ9VV9/WmGpPWwFg4ipw3qRdDhQJnQiNKzlqPMSIDE76uhrKv3hYE30tVIO R8U9erAprCBoHd2Ch1+pIGlFjl91//BR1sehnJR9Z1gZHMEqjto/jYPR1uEapueR6W+YuL9O9HmW RLA925xiZmzwKqB8HS0wG+PjLnMRnohdIh4e+/FKWksC82rP7vmP3SHOzQKdgdapaavCTx/1ZYiR N6cMT95ZCgB1aHXR1lCfAgMBAAGjggOcMIIDmDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF oDAgBgNVHSUBAf8EFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwHQYDVR0OBBYEFFaFSmgtcRDwfRFi qt3Vq8LJCLn5MCcGA1UdEQQgMB6BHG1pY2hhZWwuaGFtbWVyQHlhYW5hdGVjaC5jb20wHwYDVR0j BBgwFoAU2EgpqF8qF5Li+p57729gg/i4uNwwggFxBggrBgEFBQcBAQSCAWMwggFfMCcGCCsGAQUF BzABhhtodHRwOi8vcGtpLW9jc3Auc3ltYXV0aC5jb20wggEyBggrBgEFBQcwAoaCASRsZGFwOi8v ZGlyZWN0b3J5LnZlcmlzaWduLmNvbS9DTiUyMCUzRCUyMFN5bWFudGVjJTIwQ2xhc3MlMjAyJTIw U2hhcmVkJTIwSW50ZXJtZWRpYXRlJTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHklMkNPVSUyMCUz RCUyMENsYXNzJTIwMiUyME1hbmFnZWQlMjBQS0klMjBJbmRpdmlkdWFsJTIwU3Vic2NyaWJlciUy MENBJTJDT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQ08lMjAlM0QlMjBT eW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNhdGU7YmluYXJ5 MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2NhXzA3YmI3ZDY0 NzdjZjRmNmJlOTZhZjFiMzZjYWJkMzE2L0xhdGVzdENSTC5jcmwwbAYDVR0gBGUwYzBhBgtghkgB hvhFAQcXAjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEF BQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTBCBgkqhkiG9w0BCQ8ENTAzMAoGCCqG SIb3DQMHMAsGCWCGSAFlAwQBAjALBglghkgBZQMEARYwCwYJYIZIAWUDBAEqMCwGCmCGSAGG+EUB EAMEHjAcBhJghkgBhvhFARABAgIBAYabp24WBjE4NzIwOTA5BgpghkgBhvhFARAFBCswKQIBABYk YUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3DQEBBQUAA4IBAQBX iSRv04vVx/Y5lWWITUJhWXUTnhM70UUqIEinNF+cV9+zY0lomYqoB8ovCfWrvx232tzX86NtreSn 9UjhBRj61oqSyK9v6P14dunX1MjRZmOVeKws3+XDS3NPsopui5YOPjSy02qhyVN4tIDCokj71db1 wO7uZ/DehNWkwFUgMKdVKM5LAGIDHgWn2dvzGi+ipdDNjMD2SxMnCSOiZ3z9gh/Yy+flNaXn5vLL O0AJEW5xCl2tbuPh/DghqlaiVeCLaCar3cj2Ka6ew5wRhNpvmno47b0C5w6JDxx++ijXjGPzYr57 J8QvCDs9f3Cn5doEF3bTQmcab+s3VEgIhAt1MYIE4zCCBN8CAQEwgd4wgckxCzAJBgNVBAYTAlVT MR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3Qg TmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmli ZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkCEEwDN/OqTuYq7y9si0SvFQgwCQYFKw4DAhoFAKCCAtkwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwODI4MTU0MTU2WjAjBgkqhkiG 9w0BCQQxFgQU7PHFIAM9SJWKRej+T8HUErGGOSowgZMGCSqGSIb3DQEJDzGBhTCBgjALBglghkgB ZQMEASowCwYJYIZIAWUDBAEWMAoGCCqGSIb3DQMHMAsGCWCGSAFlAwQBAjAOBggqhkiG9w0DAgIC AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAhowCwYJYIZIAWUDBAIDMAsGCWCGSAFlAwQCAjALBglg hkgBZQMEAgEwge8GCSsGAQQBgjcQBDGB4TCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eQIQTAM386pO5irvL2yLRK8VCDCB8QYLKoZIhvcNAQkQAgsxgeGggd4wgckxCzAJBgNVBAYT AlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1 c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNj cmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVkaWF0ZSBD ZXJ0aWZpY2F0ZSBBdXRob3JpdHkCEEwDN/OqTuYq7y9si0SvFQgwDQYJKoZIhvcNAQEBBQAEggEA mf6+GnYtrPP3kppCmx+lhHpo8beFlscipNJSrLEaW0CM1cZMYhK5d6sZc7e9A9izihtcETX6o4sV oFVyHy7d3LLG4csm8xwPMizm9DxPmyQTwENgmWhGESpLTL3UQpaa/YSMNAZLCEYZ6BhdYVQEe8Xr w+uuugZPj0OZABikR8JM5+tE6lrHEcS8l3gLw5e8mNbOfZGZ4TylOgB3UDR1YGRXi8V0CJmD6dO8 HsZm/1TRfE27+27Y3iyO71jVdDVkgcr6MI9Pd4y8kAwt5v8/M+yxjWrz0Q63t634Jc+/kO49FL3d JZpaO2jTwPsuKZavkgQAJRvtuYhhFCQPkDWa+wAAAAAAAA== ------=_NextPart_000_03B3_01D20121.2E5051D0-- From nobody Sun Aug 28 09:21:54 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7514F12B018 for ; Sun, 28 Aug 2016 09:21:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sxtw_5Db8D0d for ; Sun, 28 Aug 2016 09:21:51 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3999E12B012 for ; Sun, 28 Aug 2016 09:21:51 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id j12so74220699ywb.2 for ; Sun, 28 Aug 2016 09:21:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=UMm0CBWp1iBVeBXMEVpJDAw2wWzoa3or/BmhmDomCbM=; b=NGY3h2egMcunDsCeU1re8u/WoBEUrzW8RkkeKa6Xks/aRmdl2hA7+uYPv6B27QUSA4 z46g/ivycRhpPJJSsz+r+AtWsQkx4tsOwvf1rz5OfxF4tibuDHYmUHtEkIIFSgKGbU7L uyyWCiScpJePQCngC9nGxBqDZFtuWpUqgd+uTfnm/g8sg2Rzbs3eJb/SE9i+ngMBBCrc awBFwG45GWhfUU7TjleycEXQtho8Sqf+uzFGycqY7SHXMn78M3wIZjUOYTNjxd8wcfo3 dTE+eZ8/D/x42BVhXW89hvNamUpdPY0Rq7LlPzyJDeqS//hC2ANhbbSNAmrgarLp7PZD mtxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=UMm0CBWp1iBVeBXMEVpJDAw2wWzoa3or/BmhmDomCbM=; b=WZDEp0evsss81j6b07VZlRWzQvTI+yWemLyd6q6bng/pKxAxCzgeVvUAm9rK2Fs/my PqY/4ZOp98eDTCw0tsZres1HAwlfu8znxjK6OkYz+dNE7DGst76emvasrvjgxrazESCR VJSt8VwhAWTxp2/lfUqP0aRoS/WNrC1QvtKzoXrbkH8c/agUPAruGsa0dxmg7qa9B2p3 efpXk9/XLQLUg8ngSwwhybldrEmvjlVDI5v0eedl8cEU/ggMoFp1z5vgZH0/eUqbVIbH Adde6qkArFdHGrLpjh8IqZMHGfAZx20EOefQmzi2lMQbM8Giv4hj5v+T00tkwgTiFyLo ++Vg== X-Gm-Message-State: AE9vXwPpFaaZB3HEg6pt80dA25PdsAX0ytJ9+YFY6HH4u8yOolWRQNNqjqSgwD9gfNBa6jDe4dl4XlskJYuKCg== X-Received: by 10.129.39.200 with SMTP id n191mr12384892ywn.16.1472401310458; Sun, 28 Aug 2016 09:21:50 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.48.193 with HTTP; Sun, 28 Aug 2016 09:21:09 -0700 (PDT) In-Reply-To: <00C069FD01E0324C9FFCADF539701DB3BCBC0E72@sc9-ex2k10mb1.corp.yaanatech.com> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> <00C069FD01E0324C9FFCADF539701DB3BCBC0E72@sc9-ex2k10mb1.corp.yaanatech.com> From: Eric Rescorla Date: Sun, 28 Aug 2016 09:21:09 -0700 Message-ID: To: Michael Hammer Content-Type: multipart/alternative; boundary=001a1141826a13d23c053b2425d9 Archived-At: Cc: "chris-ietf@chriswendt.net" , "dcrocker@bbiw.net" , "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 16:21:53 -0000 --001a1141826a13d23c053b2425d9 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Sun, Aug 28, 2016 at 8:41 AM, Michael Hammer < michael.hammer@yaanatech.com> wrote: > Ummm=E2=80=A6. > > > > If any signature can be repudiated by the sender, > > then how do you apply any consequences for bad behavior? > > Any caller could just say, it wasn=E2=80=99t me and they are off the hook= ? > I don't think I said that. It certainly wasn't what I meant. > > > Isn=E2=80=99t the consequence tree: > > - Not signed: customer may not answer or caveat emptor > > - Signed, robocall: crackdown > > - Signed, normal call: good to go? > > > > I assume that a signed call that has faulty credentials, > > e.g. bad timestamp, unknown signer, could get filtered out. > > But, that gets into carrier policy that can=E2=80=99t be standardized. > Yes, this is correct. -Ekr > *________________________________* > > *Michael Hammer* > > michael.hammer@yaanatech.com > > +1 408 202 9291 > > > =C2=A9 2016 Yaana Technologies, LLC. All Rights Reserved. Email confident= iality > notice. This message is private and confidential. If you have received th= is > message in error, please notify us and remove it from your system. > > > > *From:* stir [mailto:stir-bounces@ietf.org] *On Behalf Of *Eric Rescorla > *Sent:* Saturday, August 27, 2016 9:54 PM > *To:* Dave Crocker > *Cc:* Chris Wendt ; stir@ietf.org > *Subject:* Re: [stir] Review of: draft-ietf-stir-passport-05 > > > > > > > > On Sat, Aug 27, 2016 at 6:46 PM, Dave Crocker wrote: > > On 8/27/2016 5:19 PM, Eric Rescorla wrote: > > And I believe that was my original guess, although my very limited > understanding of non-repudiation includes the significant burden of > having the timestamp, itself, be validated by an independent > authority. Otherwise, the signer could claim any time they want to... > > > That doesn't seem correct to me, at least if "independent" means someone > other than the relying party. The signature is itself a proof attaching > the signer's private key to the passport and to a claim by the signer > about the passport object's assertions being valid at the time in the > timestamp. If the relying party checks the timestamp and rejects it if > it has a bogus timestamp, then any acceptable passport will be > relatively fresh and thus will be usable as a proof of the signer's > representation at the relevant time. Overall, this seems less important > than the freshness property wrt authentication, but it's still a > technical property. > > > > This sounds pretty much the same as authentication. > > While the verifier might decide that the timestamp is ok, if the > verification is close enough in time to that claimed occurrence, it does > nothing for being able to prove the timing to a third-party, /later/. > > > > Well, what you can prove (at any time in the future) is that the signer > claimed that a given thing was true at (what it claimed was) a given time= . > You can prove this to a third party. > > > > This isn't a necessary property of authentication. For instance, the > relying party could share a key with the passport generator and the > passport could be secured with a MAC. > > > > > > And that's the environment I'm used to hearing about needing > 'non-repudiation' for. > > In that case, the timestamp needs to have validation that is independent > of the signer. What I'm used to hearing, for that, is that an independen= t > timestamp service does a kind of notary signature on the original signer'= s > stuff, including the timestamp. > > > > I'm not sure why you think non-repudiation needs a notary signature. > That's not generally the case, as indicated above, and even if you do hav= e > a timestamping service, all it can prove is that the signature was > generated *prior* to a given time, not at a given time. > > > > > > Anyhow, all of seems to go beyond STIR's needs, suggesting that it would > be best to remove use of the term? > > > > Yes, I think that would be fine. > > > > > > d/ > > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > --001a1141826a13d23c053b2425d9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Sun, Aug 28, 2016 at 8:41 AM, Michael Hammer <<= a href=3D"mailto:michael.hammer@yaanatech.com" target=3D"_blank">michael.ha= mmer@yaanatech.com> wrote:
=

Ummm=E2=80=A6.

=C2=A0

= If any signature can be repudiated by the sender, =

then how do you apply = any consequences for bad behavior?

Any caller could just say, it wasn=E2=80=99t me and t= hey are off the hook?


I don't think I said that. It certainly wasn't what I meant.

=C2=A0

= =C2=A0

Isn=E2=80=99t= the consequence tree:

-=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Not signed:=C2=A0 customer may not answer or caveat emptor

-=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 Signed, robocall:=C2= =A0 crackdown

-=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 S= igned, normal call:=C2=A0 good to go?

=C2=A0

I assume that a signed call that has faulty credentials,=

e.g. bad ti= mestamp, unknown signer, could get filtered out.

But, that gets into carrier policy that= can=E2=80=99t be standardized.


Yes, this is correct.

-Ekr
=C2=A0<= /div>

________________________________

Michael Hammer

michael.hammer@yaanatech.= com

= +1=C2=A0408 202 9291=


=C2=A9 2016 Yaana = Technologies, LLC. All Rights Reserved. Email confidentiality notice. This = message is private and confidential. If you have received this message in e= rror, please notify us and remove it from your system.<= u>

=C2=A0=

From: stir [mailto= :stir-bounces@ie= tf.org] On Behalf Of Eric Rescorla
Sent: Saturday, Aug= ust 27, 2016 9:54 PM
To: Dave Crocker <dcrocker@bbiw.net>
Cc: Chr= is Wendt <chris-ietf@chriswendt.net>; stir@ietf.org
Subject: Re: [stir= ] Review of: draft-ietf-stir-passport-05

=C2=A0

= =C2=A0

=C2=A0

On Sat, Aug 27, 2016 at 6:46 PM, Dave Crocker <= ;dhc@dcrocker.net= > wrote:

On 8/27/2016 5:19 PM, E= ric Rescorla wrote:

=C2=A0 =C2=A0 And I believe that was m= y original guess, although my very limited
=C2=A0 =C2=A0 understanding o= f non-repudiation includes the significant burden of
=C2=A0 =C2=A0 havin= g the timestamp, itself, be validated by an independent
=C2=A0 =C2=A0 au= thority. Otherwise, the signer could claim any time they want to...

=
That doesn't seem correct to me, at least if "independent"= ; means someone
other than the relying party. The signature is itself a = proof attaching
the signer's private key to the passport and to a cl= aim by the signer
about the passport object's assertions being valid= at the time in the
timestamp. If the relying party checks the timestamp= and rejects it if
it has a bogus timestamp, then any acceptable passpor= t will be
relatively fresh and thus will be usable as a proof of the sig= ner's
representation at the relevant time. Overall, this seems less = important
than the freshness property wrt authentication, but it's s= till a
technical property.



This sounds pretty much the same as authentication.

= While the verifier might decide that the timestamp is ok, if the verificati= on is close enough in time to that claimed occurrence, it does nothing for = being able to prove the timing to a third-party, /later/.

=

=C2=A0

Well, what you can prove (at any time in the future= ) is that the signer claimed that a given thing was true at (what it claime= d was) a given time. You can prove this to a third party.

=

=C2=A0

This isn't a necessary property of authentication. For= instance, the relying party could share a key with the passport generator = and the passport could be secured with a MAC.

<= p class=3D"MsoNormal">=C2=A0

=C2=A0

And that's the environment I'm u= sed to hearing about needing 'non-repudiation' for.

In that = case, the timestamp needs to have validation that is independent of the sig= ner.=C2=A0 What I'm used to hearing, for that, is that an independent t= imestamp service does a kind of notary signature on the original signer'= ;s stuff, including the timestamp.

=C2=A0

I'm not sure why you think non-repudiation needs a notary signature. T= hat's not generally the case, as indicated above, and even if you do ha= ve a timestamping service, all it can prove is that the signature was gener= ated *prior* to a given time, not at a given time.

<= div>

=C2=A0

=C2=A0

Anyhow, all of seems to go beyond S= TIR's needs, suggesting that it would be best to remove use of the term= ?

=C2=A0

Yes, I think that would be fine.=

=C2=A0



d/

--

=C2=A0 Dave Crocker
=C2=A0= Brandenburg InternetWorking
=C2=A0 bbiw.net

=C2=A0

=
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


--001a1141826a13d23c053b2425d9-- From nobody Mon Aug 29 11:52:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB21512B04E for ; Mon, 29 Aug 2016 11:52:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o_Uq81ERwBzI for ; Mon, 29 Aug 2016 11:52:05 -0700 (PDT) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA03012B00D for ; Mon, 29 Aug 2016 11:52:05 -0700 (PDT) Received: by mail-qk0-x234.google.com with SMTP id t7so147478170qkh.1 for ; Mon, 29 Aug 2016 11:52:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=429CcpIX/RJa2/kk6R/BqZhziEvoXF3IyDBf3B2DiAk=; b=Jv0QSUKyXQeG2BxFoX5+kCWwl9GT664r1C1Fh6YS7VwcE8EahLZg074UHruJYtEEBx VtMhenEPKrLeFwmbZiMdLazjpOYvEoRjNzhCu2NYuSrzLK2Ia4AhEw8E/R3k/ShV6snq Aq3gaZ2MZF+bQfjpv6/YQhiYiL9+A8CDDBJKWYQhqoeti47sQkH7zpz2o5KzvyJuDQrq yCWydIZV/ej1uYg8DmZjgWkgr9mEU8NiMu1JU/riwA1MVMVDrqIf1YS5mM+afXwcPFPH 6Frz8S+35CglR8yGBsX8MCz3tqABjAZpfYA0123LPtDvimitDr07Y5XjXPyYSYkZr7jG 98AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=429CcpIX/RJa2/kk6R/BqZhziEvoXF3IyDBf3B2DiAk=; b=dZgJHA+iWxmZZKnSBe5V0rmCtBURIOxixZ2O+alVHCdoxbsDLH0ybdHWCFuZyCYyWt UOVZnro28yKj6AZbRWypV6SvS3Dvk7/PSm/wBL12iyKX7kmD6vzVywTBeYIXKUPzW0ou dt4FaAglk3acB+Hl+0GX66UaG2WK0LorkZ4IF4HtOrXBTkU4nrqbHxwMdS2eFtQRflUu I9qQ7NOG6JX9rgFu1cg7zMTf59no53q5H0uBpevMPkIWa+9zeRqjxWisPtrtbOi8n6qj KW8bMGwUxcdHcTXfAyMZlGbb9qFjkSx3Sf1Tdb75FVf2pJcrexLXli9ygix693kapOjN MWog== X-Gm-Message-State: AE9vXwMu9aJGnhAardOtXqMvKjEo+U/dgi7Wqf34PqAgkOuK5wLuBYE6Lul+7cKdhWI1Pw== X-Received: by 10.55.44.69 with SMTP id s66mr21575654qkh.174.1472496724839; Mon, 29 Aug 2016 11:52:04 -0700 (PDT) Received: from [10.36.72.35] ([69.241.19.12]) by smtp.gmail.com with ESMTPSA id f17sm19325252qke.37.2016.08.29.11.52.03 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 29 Aug 2016 11:52:04 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> Date: Mon, 29 Aug 2016 14:52:03 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <958917CD-5FA5-4553-939E-CC1468AE8341@chriswendt.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> To: Dave Crocker X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "stir@ietf.org" , Eric Rescorla Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Aug 2016 18:52:07 -0000 Agree, will remove term =93non-repudiation", discussed this in ATIS Task = Force and came to realization that we are looking at the Passport = representing purely an assertion of the identity and the signer is the = party responsible for that assertion, and =93buyer beware=94. > On Aug 27, 2016, at 8:07 PM, Dave Crocker wrote: >=20 > On 8/27/2016 4:52 PM, Eric Rescorla wrote: >>=20 >>=20 >> On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker > > wrote: >=20 >>=20 >> Is the timestamp the basis of claiming non-repudiation? >>=20 >>=20 >> Partially, depending on your interpretation of how >> non-repudiation is >> achieved. The digital signature based on a certificate is the >> non-repudiation of the original assertion and signing of the = token. >>=20 >>=20 >> That seems to equate authentication with non-reputation of >> originator. But they aren't the same. >>=20 >>=20 >> Do you mean "non-repudiation" here? I ask because "reputation" is = also a >> concept potentially in play here. >=20 > I'm using 'non-repudiation' because the spec uses that term. >=20 > If the spec really means 'reputation', that opens a different set of = concerns, since nothing in any of the 3 documents has to do with = reputation, per se. >=20 >=20 >> I think it would probably be fine to remove the term = "non-repudiation" >> from this spec, since it only appears in the abstract. Generally, = it's >> not that useful a concept for most security settings, especially when >> one starts to ask questions about the legal context. >>=20 >> With that said, given that these tokens are signed by their creator = and >> there is a timestamp to provide anti-replay, there is at least >> potentially an important technical property being provided here, = which >> is that in the case where a passport creator signs a bogus passport, = it >> is possible to demonstrate that it did so, which is not a property >> necessarily provided by authentication systems. >=20 > And I believe that was my original guess, although my very limited = understanding of non-repudiation includes the significant burden of = having the timestamp, itself, be validated by an independent authority. = Otherwise, the signer could claim any time they want to... >=20 > d/ >=20 >=20 > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Mon Aug 29 12:06:08 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4621D12B065 for ; Mon, 29 Aug 2016 12:06:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vajkW23wKYz8 for ; Mon, 29 Aug 2016 12:06:05 -0700 (PDT) Received: from resqmta-po-04v.sys.comcast.net (resqmta-po-04v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:163]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DE0512D08C for ; Mon, 29 Aug 2016 12:06:05 -0700 (PDT) Received: from resomta-po-06v.sys.comcast.net ([96.114.154.230]) by resqmta-po-04v.sys.comcast.net with SMTP id eRrYbr0rfGkXBeRsjbOMlp; Mon, 29 Aug 2016 19:06:05 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by resomta-po-06v.sys.comcast.net with SMTP id eRsgbb149xbXJeRshbA72y; Mon, 29 Aug 2016 19:06:05 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Mon, 29 Aug 2016 11:50:11 -0700 From: Alex Bobotek To: Chris Wendt , Dave Crocker Date: Mon, 29 Aug 2016 11:50:11 -0700 Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AdICJD16EorSo0D/Q4eggf7cDbsc6AAA4l7A Message-ID: <4B1956260CD29F4A9622F00322FE05310128F7034723@BOBO1A.bobotek.net> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> <958917CD-5FA5-4553-939E-CC1468AE8341@chriswendt.net> In-Reply-To: <958917CD-5FA5-4553-939E-CC1468AE8341@chriswendt.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CMAE-Envelope: MS4wfKcdQWdpOWTyfvGk1iB+7vUpxSnUmFXvD9p0ANzcu0qT/r0ifc7GzK9hXgrcCB5PaFFWov55vS2u8thE3C7tcsSuuWGecVo/fZ34KOKswAJM5AxP3Vh+ Kt5SYOm/tQUmOcuT5U3Cdsch5wHVk0WLB/tBS/EVUiUtZGO3VctkpAE+StrbA9Ne56rtoDVXlvd5i4nQylh9n22RvU35WMPB0mXw0d1IpLjA6+jOVkDJbtwi qQxuZ0WYBq4yTN38l9Mxxw== Archived-At: Cc: "stir@ietf.org" , Eric Rescorla Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Aug 2016 19:06:07 -0000 The realization below also necessitates changes to the first sentence of th= e abstract and a scrub of the body of the document wrt to verifying the or= iginating identity. This verification is optional. =20 Regards, Alex > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Chris Wendt > Sent: Monday, August 29, 2016 11:52 AM > To: Dave Crocker > Cc: stir@ietf.org; Eric Rescorla > Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 >=20 > Agree, will remove term "non-repudiation", discussed this in ATIS Task Fo= rce > and came to realization that we are looking at the Passport representing > purely an assertion of the identity and the signer is the party responsib= le for > that assertion, and "buyer beware". >=20 >=20 > > On Aug 27, 2016, at 8:07 PM, Dave Crocker wrote: > > > > On 8/27/2016 4:52 PM, Eric Rescorla wrote: > >> > >> > >> On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker >> > wrote: > > > >> > >> Is the timestamp the basis of claiming non-repudiation? > >> > >> > >> Partially, depending on your interpretation of how > >> non-repudiation is > >> achieved. The digital signature based on a certificate is the > >> non-repudiation of the original assertion and signing of the to= ken. > >> > >> > >> That seems to equate authentication with non-reputation of > >> originator. But they aren't the same. > >> > >> > >> Do you mean "non-repudiation" here? I ask because "reputation" is > >> also a concept potentially in play here. > > > > I'm using 'non-repudiation' because the spec uses that term. > > > > If the spec really means 'reputation', that opens a different set of co= ncerns, > since nothing in any of the 3 documents has to do with reputation, per se= . > > > > > >> I think it would probably be fine to remove the term "non-repudiation" > >> from this spec, since it only appears in the abstract. Generally, > >> it's not that useful a concept for most security settings, especially > >> when one starts to ask questions about the legal context. > >> > >> With that said, given that these tokens are signed by their creator > >> and there is a timestamp to provide anti-replay, there is at least > >> potentially an important technical property being provided here, > >> which is that in the case where a passport creator signs a bogus > >> passport, it is possible to demonstrate that it did so, which is not > >> a property necessarily provided by authentication systems. > > > > And I believe that was my original guess, although my very limited > understanding of non-repudiation includes the significant burden of havin= g > the timestamp, itself, be validated by an independent authority. Otherwis= e, > the signer could claim any time they want to... > > > > d/ > > > > > > -- > > > > Dave Crocker > > Brandenburg InternetWorking > > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Mon Aug 29 13:12:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3EE812D870 for ; Mon, 29 Aug 2016 13:12:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.849 X-Spam-Level: X-Spam-Status: No, score=-4.849 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3V4Uvl-S5iG for ; Mon, 29 Aug 2016 13:12:34 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D355E12D845 for ; Mon, 29 Aug 2016 13:12:33 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 95D7CBDD0; Mon, 29 Aug 2016 21:12:32 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rzmzt2nnfZOT; Mon, 29 Aug 2016 21:12:31 +0100 (IST) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id CEBABBE25; Mon, 29 Aug 2016 21:12:30 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1472501551; bh=hL18KReeCJ2uejUQsxsjltVaox0xoCYQE/yKzhDPiRo=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=rQsUoep9zk/yi0G4AvYF6eD2aJ8V63R30fgLs71SCCxcwDNajG871ESkO77tlytC9 /Kr0J7mDd0HOBkF8M1Df5wx78ER/SG85en2pWhwDF0Rq/zY/JRdCTeWrgZ3tC0aH+X 2QyUCp3mOg0KAAHt4ZsAN1zn6TBro+HaxEf48TRE= To: Chris Wendt , Dave Crocker References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> <958917CD-5FA5-4553-939E-CC1468AE8341@chriswendt.net> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Mon, 29 Aug 2016 21:12:30 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <958917CD-5FA5-4553-939E-CC1468AE8341@chriswendt.net> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms060600090300070504040901" Archived-At: Cc: "stir@ietf.org" , Eric Rescorla Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Aug 2016 20:12:35 -0000 This is a cryptographically signed message in MIME format. --------------ms060600090300070504040901 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 29/08/16 19:52, Chris Wendt wrote: > will remove term =E2=80=9Cnon-repudiation", Almost always a good change to a protocol specification IMO:-) S. --------------ms060600090300070504040901 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA4Mjky MDEyMzBaMC8GCSqGSIb3DQEJBDEiBCBYAfCn6OqzSmENy8QPOVoxOxWOFw+IVEK7Aen+kNxd IjBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQCt17y2YLLjNAQ7zAEk6AGFUPbMnyUeROo/NFl4GfKdNfdXuWcAgbph fLh1+I6fIGQXLsD/wFwBLZbmHQxEUa44/P3uytx2YZxF6mG6Lha7oepwoaFaqTFq2LieL2dZ dW+96iiii7tTFnWrnQn6WX034+tnsza6KXpw4/14Qkq5NDdytWG/82FZuKnaJB1mEHY91MVR eU3ticxcVcJjbaQ+kt6EyLuyJYHQjHzI736rOTAhTnKpHRIXnt62+1/fz8R0+bp5xaqnu+1e uXWkPtRWDFcXypA9h0OW5GZ5h0RlOFFf5YvgZ285MGvqhZ7tgLUJnTh+6txvsgR02i35dO5q AAAAAAAA --------------ms060600090300070504040901-- From nobody Mon Aug 29 13:15:13 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3084F12D870 for ; Mon, 29 Aug 2016 13:15:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.209 X-Spam-Level: X-Spam-Status: No, score=-1.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ssdwHX41KxzV for ; Mon, 29 Aug 2016 13:15:11 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F8DA12D845 for ; Mon, 29 Aug 2016 13:15:11 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u7TKFM0b000733 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Mon, 29 Aug 2016 13:15:22 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1472501722; bh=4G5n0E2ylLWmTqM5e7XTJXlY5XYTT5/kkt4ugXkBs4c=; h=Subject:To:References:Cc:Reply-To:From:Date:In-Reply-To:From; b=AEJ5T9bVkAMXaW2uZ11uxTPuitFLK5uLBPlfPQB3UbUsYpk+7GNBRNwuQ7zb8pStS cO7y31wBcT7xpFvy4Buhp6Nf6AOPfnyf2QV727n6ny9y+gBnl111Wvt4+J9XMH6L4b fxMsN9xQ71RrW5Ct9gXxDgXwN0y5zYtxtOyWQynw= To: Stephen Farrell References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <67A1F75C-DAA9-4E84-8C70-9A392A90FF6F@chriswendt.net> <8fd2cf67-5241-039a-e3a4-a9ad0928023a@dcrocker.net> <1c29f054-5b26-5327-b6bc-4f1ebfdcb8f2@bbiw.net> <958917CD-5FA5-4553-939E-CC1468AE8341@chriswendt.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Mon, 29 Aug 2016 13:15:03 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" , Eric Rescorla Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Aug 2016 20:15:12 -0000 On 8/29/2016 1:12 PM, Stephen Farrell wrote: > > On 29/08/16 19:52, Chris Wendt wrote: >> > will remove term non-repudiation", > Almost always a good change to a protocol specification IMO:-) Bold statement. But will anyone repudiate it? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net